From 1c0bd0bc394a6cc63ee16cc9cab832eff5ada831 Mon Sep 17 00:00:00 2001 From: yangchao <1162485779@qq.com> Date: Mon, 17 Oct 2022 10:20:24 +0800 Subject: [PATCH] 3.6.1 oh network (#305) * openharmony network support * version.txt --- openharmony/CMakeLists.txt | 21 +- openharmony/arm64-v8a/include/mbedtls/aes.h | 689 ++ openharmony/arm64-v8a/include/mbedtls/aesni.h | 136 + openharmony/arm64-v8a/include/mbedtls/arc4.h | 145 + openharmony/arm64-v8a/include/mbedtls/aria.h | 373 ++ openharmony/arm64-v8a/include/mbedtls/asn1.h | 616 ++ .../arm64-v8a/include/mbedtls/asn1write.h | 370 ++ .../arm64-v8a/include/mbedtls/base64.h | 98 + .../arm64-v8a/include/mbedtls/bignum.h | 1063 +++ .../arm64-v8a/include/mbedtls/blowfish.h | 288 + .../arm64-v8a/include/mbedtls/bn_mul.h | 978 +++ .../arm64-v8a/include/mbedtls/camellia.h | 327 + openharmony/arm64-v8a/include/mbedtls/ccm.h | 311 + openharmony/arm64-v8a/include/mbedtls/certs.h | 250 + .../arm64-v8a/include/mbedtls/chacha20.h | 228 + .../arm64-v8a/include/mbedtls/chachapoly.h | 359 + .../arm64-v8a/include/mbedtls/check_config.h | 936 +++ .../arm64-v8a/include/mbedtls/cipher.h | 1102 ++++ .../include/mbedtls/cipher_internal.h | 150 + openharmony/arm64-v8a/include/mbedtls/cmac.h | 247 + .../arm64-v8a/include/mbedtls/compat-1.3.h | 2529 +++++++ .../arm64-v8a/include/mbedtls/config.h | 4127 ++++++++++++ .../arm64-v8a/include/mbedtls/config_psa.h | 831 +++ .../arm64-v8a/include/mbedtls/constant_time.h | 45 + .../arm64-v8a/include/mbedtls/ctr_drbg.h | 611 ++ openharmony/arm64-v8a/include/mbedtls/debug.h | 311 + openharmony/arm64-v8a/include/mbedtls/des.h | 370 ++ openharmony/arm64-v8a/include/mbedtls/dhm.h | 1103 ++++ openharmony/arm64-v8a/include/mbedtls/ecdh.h | 446 ++ openharmony/arm64-v8a/include/mbedtls/ecdsa.h | 626 ++ .../arm64-v8a/include/mbedtls/ecjpake.h | 275 + openharmony/arm64-v8a/include/mbedtls/ecp.h | 1311 ++++ .../arm64-v8a/include/mbedtls/ecp_internal.h | 297 + .../arm64-v8a/include/mbedtls/entropy.h | 294 + .../arm64-v8a/include/mbedtls/entropy_poll.h | 108 + openharmony/arm64-v8a/include/mbedtls/error.h | 217 + openharmony/arm64-v8a/include/mbedtls/gcm.h | 327 + .../arm64-v8a/include/mbedtls/havege.h | 80 + openharmony/arm64-v8a/include/mbedtls/hkdf.h | 140 + .../arm64-v8a/include/mbedtls/hmac_drbg.h | 474 ++ openharmony/arm64-v8a/include/mbedtls/md.h | 493 ++ openharmony/arm64-v8a/include/mbedtls/md2.h | 305 + openharmony/arm64-v8a/include/mbedtls/md4.h | 310 + openharmony/arm64-v8a/include/mbedtls/md5.h | 310 + .../arm64-v8a/include/mbedtls/md_internal.h | 90 + .../include/mbedtls/memory_buffer_alloc.h | 149 + openharmony/arm64-v8a/include/mbedtls/net.h | 35 + .../arm64-v8a/include/mbedtls/net_sockets.h | 301 + .../arm64-v8a/include/mbedtls/nist_kw.h | 182 + openharmony/arm64-v8a/include/mbedtls/oid.h | 649 ++ .../arm64-v8a/include/mbedtls/padlock.h | 125 + openharmony/arm64-v8a/include/mbedtls/pem.h | 153 + openharmony/arm64-v8a/include/mbedtls/pk.h | 918 +++ .../arm64-v8a/include/mbedtls/pk_internal.h | 140 + .../arm64-v8a/include/mbedtls/pkcs11.h | 246 + .../arm64-v8a/include/mbedtls/pkcs12.h | 140 + openharmony/arm64-v8a/include/mbedtls/pkcs5.h | 111 + .../arm64-v8a/include/mbedtls/platform.h | 421 ++ .../arm64-v8a/include/mbedtls/platform_time.h | 72 + .../arm64-v8a/include/mbedtls/platform_util.h | 283 + .../arm64-v8a/include/mbedtls/poly1305.h | 194 + .../arm64-v8a/include/mbedtls/psa_util.h | 512 ++ .../arm64-v8a/include/mbedtls/ripemd160.h | 236 + openharmony/arm64-v8a/include/mbedtls/rsa.h | 1351 ++++ .../arm64-v8a/include/mbedtls/rsa_internal.h | 224 + openharmony/arm64-v8a/include/mbedtls/sha1.h | 352 + .../arm64-v8a/include/mbedtls/sha256.h | 300 + .../arm64-v8a/include/mbedtls/sha512.h | 316 + openharmony/arm64-v8a/include/mbedtls/ssl.h | 4427 +++++++++++++ .../arm64-v8a/include/mbedtls/ssl_cache.h | 149 + .../include/mbedtls/ssl_ciphersuites.h | 556 ++ .../arm64-v8a/include/mbedtls/ssl_cookie.h | 113 + .../arm64-v8a/include/mbedtls/ssl_internal.h | 1352 ++++ .../arm64-v8a/include/mbedtls/ssl_ticket.h | 140 + .../arm64-v8a/include/mbedtls/threading.h | 126 + .../arm64-v8a/include/mbedtls/timing.h | 151 + .../arm64-v8a/include/mbedtls/version.h | 110 + openharmony/arm64-v8a/include/mbedtls/x509.h | 380 ++ .../arm64-v8a/include/mbedtls/x509_crl.h | 172 + .../arm64-v8a/include/mbedtls/x509_crt.h | 1097 ++++ .../arm64-v8a/include/mbedtls/x509_csr.h | 306 + openharmony/arm64-v8a/include/mbedtls/xtea.h | 139 + .../include/mbedtls_wrapper/internal/ssl3.h | 44 + .../mbedtls_wrapper/internal/ssl_cert.h | 55 + .../mbedtls_wrapper/internal/ssl_code.h | 124 + .../mbedtls_wrapper/internal/ssl_dbg.h | 190 + .../mbedtls_wrapper/internal/ssl_lib.h | 30 + .../mbedtls_wrapper/internal/ssl_methods.h | 121 + .../mbedtls_wrapper/internal/ssl_pkey.h | 86 + .../mbedtls_wrapper/internal/ssl_stack.h | 52 + .../mbedtls_wrapper/internal/ssl_types.h | 297 + .../mbedtls_wrapper/internal/ssl_x509.h | 110 + .../include/mbedtls_wrapper/internal/tls1.h | 58 + .../mbedtls_wrapper/internal/x509_vfy.h | 116 + .../include/mbedtls_wrapper/openssl/ssl.h | 1816 ++++++ .../include/mbedtls_wrapper/platform/ssl_pm.h | 61 + .../mbedtls_wrapper/platform/ssl_port.h | 47 + .../include/websockets/libwebsockets.h | 5787 +++++++++++++++++ .../include/websockets/lws-plugin-ssh.h | 364 ++ .../arm64-v8a/include/websockets/lws_config.h | 156 + openharmony/arm64-v8a/lib/libmbedcrypto.a | Bin 0 -> 3378110 bytes openharmony/arm64-v8a/lib/libmbedtls.a | Bin 0 -> 1163702 bytes openharmony/arm64-v8a/lib/libwebsockets.a | Bin 0 -> 2186418 bytes openharmony/armeabi-v7a/include/mbedtls/aes.h | 689 ++ .../armeabi-v7a/include/mbedtls/aesni.h | 136 + .../armeabi-v7a/include/mbedtls/arc4.h | 145 + .../armeabi-v7a/include/mbedtls/aria.h | 373 ++ .../armeabi-v7a/include/mbedtls/asn1.h | 616 ++ .../armeabi-v7a/include/mbedtls/asn1write.h | 370 ++ .../armeabi-v7a/include/mbedtls/base64.h | 98 + .../armeabi-v7a/include/mbedtls/bignum.h | 1063 +++ .../armeabi-v7a/include/mbedtls/blowfish.h | 288 + .../armeabi-v7a/include/mbedtls/bn_mul.h | 978 +++ .../armeabi-v7a/include/mbedtls/camellia.h | 327 + openharmony/armeabi-v7a/include/mbedtls/ccm.h | 311 + .../armeabi-v7a/include/mbedtls/certs.h | 250 + .../armeabi-v7a/include/mbedtls/chacha20.h | 228 + .../armeabi-v7a/include/mbedtls/chachapoly.h | 359 + .../include/mbedtls/check_config.h | 936 +++ .../armeabi-v7a/include/mbedtls/cipher.h | 1102 ++++ .../include/mbedtls/cipher_internal.h | 150 + .../armeabi-v7a/include/mbedtls/cmac.h | 247 + .../armeabi-v7a/include/mbedtls/compat-1.3.h | 2529 +++++++ .../armeabi-v7a/include/mbedtls/config.h | 4127 ++++++++++++ .../armeabi-v7a/include/mbedtls/config_psa.h | 831 +++ .../include/mbedtls/constant_time.h | 45 + .../armeabi-v7a/include/mbedtls/ctr_drbg.h | 611 ++ .../armeabi-v7a/include/mbedtls/debug.h | 311 + openharmony/armeabi-v7a/include/mbedtls/des.h | 370 ++ openharmony/armeabi-v7a/include/mbedtls/dhm.h | 1103 ++++ .../armeabi-v7a/include/mbedtls/ecdh.h | 446 ++ .../armeabi-v7a/include/mbedtls/ecdsa.h | 626 ++ .../armeabi-v7a/include/mbedtls/ecjpake.h | 275 + openharmony/armeabi-v7a/include/mbedtls/ecp.h | 1311 ++++ .../include/mbedtls/ecp_internal.h | 297 + .../armeabi-v7a/include/mbedtls/entropy.h | 294 + .../include/mbedtls/entropy_poll.h | 108 + .../armeabi-v7a/include/mbedtls/error.h | 217 + openharmony/armeabi-v7a/include/mbedtls/gcm.h | 327 + .../armeabi-v7a/include/mbedtls/havege.h | 80 + .../armeabi-v7a/include/mbedtls/hkdf.h | 140 + .../armeabi-v7a/include/mbedtls/hmac_drbg.h | 474 ++ openharmony/armeabi-v7a/include/mbedtls/md.h | 493 ++ openharmony/armeabi-v7a/include/mbedtls/md2.h | 305 + openharmony/armeabi-v7a/include/mbedtls/md4.h | 310 + openharmony/armeabi-v7a/include/mbedtls/md5.h | 310 + .../armeabi-v7a/include/mbedtls/md_internal.h | 90 + .../include/mbedtls/memory_buffer_alloc.h | 149 + openharmony/armeabi-v7a/include/mbedtls/net.h | 35 + .../armeabi-v7a/include/mbedtls/net_sockets.h | 301 + .../armeabi-v7a/include/mbedtls/nist_kw.h | 182 + openharmony/armeabi-v7a/include/mbedtls/oid.h | 649 ++ .../armeabi-v7a/include/mbedtls/padlock.h | 125 + openharmony/armeabi-v7a/include/mbedtls/pem.h | 153 + openharmony/armeabi-v7a/include/mbedtls/pk.h | 918 +++ .../armeabi-v7a/include/mbedtls/pk_internal.h | 140 + .../armeabi-v7a/include/mbedtls/pkcs11.h | 246 + .../armeabi-v7a/include/mbedtls/pkcs12.h | 140 + .../armeabi-v7a/include/mbedtls/pkcs5.h | 111 + .../armeabi-v7a/include/mbedtls/platform.h | 421 ++ .../include/mbedtls/platform_time.h | 72 + .../include/mbedtls/platform_util.h | 283 + .../armeabi-v7a/include/mbedtls/poly1305.h | 194 + .../armeabi-v7a/include/mbedtls/psa_util.h | 512 ++ .../armeabi-v7a/include/mbedtls/ripemd160.h | 236 + openharmony/armeabi-v7a/include/mbedtls/rsa.h | 1351 ++++ .../include/mbedtls/rsa_internal.h | 224 + .../armeabi-v7a/include/mbedtls/sha1.h | 352 + .../armeabi-v7a/include/mbedtls/sha256.h | 300 + .../armeabi-v7a/include/mbedtls/sha512.h | 316 + openharmony/armeabi-v7a/include/mbedtls/ssl.h | 4427 +++++++++++++ .../armeabi-v7a/include/mbedtls/ssl_cache.h | 149 + .../include/mbedtls/ssl_ciphersuites.h | 556 ++ .../armeabi-v7a/include/mbedtls/ssl_cookie.h | 113 + .../include/mbedtls/ssl_internal.h | 1352 ++++ .../armeabi-v7a/include/mbedtls/ssl_ticket.h | 140 + .../armeabi-v7a/include/mbedtls/threading.h | 126 + .../armeabi-v7a/include/mbedtls/timing.h | 151 + .../armeabi-v7a/include/mbedtls/version.h | 110 + .../armeabi-v7a/include/mbedtls/x509.h | 380 ++ .../armeabi-v7a/include/mbedtls/x509_crl.h | 172 + .../armeabi-v7a/include/mbedtls/x509_crt.h | 1097 ++++ .../armeabi-v7a/include/mbedtls/x509_csr.h | 306 + .../armeabi-v7a/include/mbedtls/xtea.h | 139 + .../include/mbedtls_wrapper/internal/ssl3.h | 44 + .../mbedtls_wrapper/internal/ssl_cert.h | 55 + .../mbedtls_wrapper/internal/ssl_code.h | 124 + .../mbedtls_wrapper/internal/ssl_dbg.h | 190 + .../mbedtls_wrapper/internal/ssl_lib.h | 30 + .../mbedtls_wrapper/internal/ssl_methods.h | 121 + .../mbedtls_wrapper/internal/ssl_pkey.h | 86 + .../mbedtls_wrapper/internal/ssl_stack.h | 52 + .../mbedtls_wrapper/internal/ssl_types.h | 297 + .../mbedtls_wrapper/internal/ssl_x509.h | 110 + .../include/mbedtls_wrapper/internal/tls1.h | 58 + .../mbedtls_wrapper/internal/x509_vfy.h | 116 + .../include/mbedtls_wrapper/openssl/ssl.h | 1816 ++++++ .../include/mbedtls_wrapper/platform/ssl_pm.h | 61 + .../mbedtls_wrapper/platform/ssl_port.h | 47 + .../include/websockets/libwebsockets.h | 2177 ++++++- .../include/websockets/lws-plugin-ssh.h | 364 ++ .../include/websockets/lws_config.h | 273 +- openharmony/armeabi-v7a/lib/libmbedcrypto.a | Bin 0 -> 2274830 bytes openharmony/armeabi-v7a/lib/libmbedtls.a | Bin 0 -> 814402 bytes openharmony/armeabi-v7a/lib/libwebsockets.a | Bin 120148 -> 1556918 bytes versions.txt | 8 + 206 files changed, 97792 insertions(+), 420 deletions(-) create mode 100644 openharmony/arm64-v8a/include/mbedtls/aes.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/aesni.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/arc4.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/aria.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/asn1.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/asn1write.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/base64.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/bignum.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/blowfish.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/bn_mul.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/camellia.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/ccm.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/certs.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/chacha20.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/chachapoly.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/check_config.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/cipher.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/cipher_internal.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/cmac.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/compat-1.3.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/config.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/config_psa.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/constant_time.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/ctr_drbg.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/debug.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/des.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/dhm.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/ecdh.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/ecdsa.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/ecjpake.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/ecp.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/ecp_internal.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/entropy.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/entropy_poll.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/error.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/gcm.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/havege.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/hkdf.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/hmac_drbg.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/md.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/md2.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/md4.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/md5.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/md_internal.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/memory_buffer_alloc.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/net.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/net_sockets.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/nist_kw.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/oid.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/padlock.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/pem.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/pk.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/pk_internal.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/pkcs11.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/pkcs12.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/pkcs5.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/platform.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/platform_time.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/platform_util.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/poly1305.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/psa_util.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/ripemd160.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/rsa.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/rsa_internal.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/sha1.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/sha256.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/sha512.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/ssl.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/ssl_cache.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/ssl_ciphersuites.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/ssl_cookie.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/ssl_internal.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/ssl_ticket.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/threading.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/timing.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/version.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/x509.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/x509_crl.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/x509_crt.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/x509_csr.h create mode 100644 openharmony/arm64-v8a/include/mbedtls/xtea.h create mode 100644 openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl3.h create mode 100644 openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_cert.h create mode 100644 openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_code.h create mode 100644 openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_dbg.h create mode 100644 openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_lib.h create mode 100644 openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_methods.h create mode 100644 openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_pkey.h create mode 100644 openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_stack.h create mode 100644 openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_types.h create mode 100644 openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_x509.h create mode 100644 openharmony/arm64-v8a/include/mbedtls_wrapper/internal/tls1.h create mode 100644 openharmony/arm64-v8a/include/mbedtls_wrapper/internal/x509_vfy.h create mode 100644 openharmony/arm64-v8a/include/mbedtls_wrapper/openssl/ssl.h create mode 100644 openharmony/arm64-v8a/include/mbedtls_wrapper/platform/ssl_pm.h create mode 100644 openharmony/arm64-v8a/include/mbedtls_wrapper/platform/ssl_port.h create mode 100644 openharmony/arm64-v8a/include/websockets/libwebsockets.h create mode 100644 openharmony/arm64-v8a/include/websockets/lws-plugin-ssh.h create mode 100644 openharmony/arm64-v8a/include/websockets/lws_config.h create mode 100644 openharmony/arm64-v8a/lib/libmbedcrypto.a create mode 100644 openharmony/arm64-v8a/lib/libmbedtls.a create mode 100644 openharmony/arm64-v8a/lib/libwebsockets.a create mode 100644 openharmony/armeabi-v7a/include/mbedtls/aes.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/aesni.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/arc4.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/aria.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/asn1.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/asn1write.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/base64.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/bignum.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/blowfish.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/bn_mul.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/camellia.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/ccm.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/certs.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/chacha20.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/chachapoly.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/check_config.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/cipher.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/cipher_internal.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/cmac.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/compat-1.3.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/config.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/config_psa.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/constant_time.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/ctr_drbg.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/debug.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/des.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/dhm.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/ecdh.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/ecdsa.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/ecjpake.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/ecp.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/ecp_internal.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/entropy.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/entropy_poll.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/error.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/gcm.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/havege.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/hkdf.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/hmac_drbg.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/md.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/md2.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/md4.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/md5.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/md_internal.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/memory_buffer_alloc.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/net.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/net_sockets.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/nist_kw.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/oid.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/padlock.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/pem.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/pk.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/pk_internal.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/pkcs11.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/pkcs12.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/pkcs5.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/platform.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/platform_time.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/platform_util.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/poly1305.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/psa_util.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/ripemd160.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/rsa.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/rsa_internal.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/sha1.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/sha256.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/sha512.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/ssl.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/ssl_cache.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/ssl_ciphersuites.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/ssl_cookie.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/ssl_internal.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/ssl_ticket.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/threading.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/timing.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/version.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/x509.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/x509_crl.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/x509_crt.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/x509_csr.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls/xtea.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl3.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_cert.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_code.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_dbg.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_lib.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_methods.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_pkey.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_stack.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_types.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_x509.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/tls1.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/x509_vfy.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls_wrapper/openssl/ssl.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls_wrapper/platform/ssl_pm.h create mode 100644 openharmony/armeabi-v7a/include/mbedtls_wrapper/platform/ssl_port.h create mode 100644 openharmony/armeabi-v7a/include/websockets/lws-plugin-ssh.h create mode 100644 openharmony/armeabi-v7a/lib/libmbedcrypto.a create mode 100644 openharmony/armeabi-v7a/lib/libmbedtls.a diff --git a/openharmony/CMakeLists.txt b/openharmony/CMakeLists.txt index f982d04b..23c7097a 100644 --- a/openharmony/CMakeLists.txt +++ b/openharmony/CMakeLists.txt @@ -1,9 +1,13 @@ set(ohos_lib_dir ${platform_spec_path}/lib) +add_library(mbedcrypto STATIC IMPORTED GLOBAL) +set_target_properties(mbedcrypto PROPERTIES + IMPORTED_LOCATION ${ohos_lib_dir}/libmbedcrypto.a +) -add_library(crypto STATIC IMPORTED GLOBAL) -set_target_properties(crypto PROPERTIES - IMPORTED_LOCATION ${ohos_lib_dir}/libcrypto.a +add_library(mbedtls STATIC IMPORTED GLOBAL) +set_target_properties(mbedtls PROPERTIES + IMPORTED_LOCATION ${ohos_lib_dir}/libmbedtls.a ) if (USE_DEBUG_RENDERER) @@ -24,11 +28,6 @@ set_target_properties(png PROPERTIES IMPORTED_LOCATION ${ohos_lib_dir}/libpng16.a ) -add_library(ssl STATIC IMPORTED GLOBAL) -set_target_properties(ssl PROPERTIES - IMPORTED_LOCATION ${ohos_lib_dir}/libssl.a -) - add_library(uv STATIC IMPORTED GLOBAL) set_target_properties(uv PROPERTIES IMPORTED_LOCATION ${ohos_lib_dir}/libuv_a.a @@ -42,6 +41,7 @@ set_target_properties(webp PROPERTIES add_library(websockets STATIC IMPORTED GLOBAL) set_target_properties(websockets PROPERTIES IMPORTED_LOCATION ${ohos_lib_dir}/libwebsockets.a + INTERFACE_INCLUDE_DIRECTORIES ${platform_spec_path}/include/websockets ) add_library(sqlite3 STATIC IMPORTED GLOBAL) set_target_properties(sqlite3 PROPERTIES @@ -117,8 +117,8 @@ endif() if(USE_SOCKET) list(APPEND CC_EXTERNAL_LIBS websockets - ssl - crypto + mbedtls + mbedcrypto ) endif() @@ -214,6 +214,7 @@ list(APPEND CC_EXTERNAL_INCLUDES ${platform_spec_path}/include/sqlite ${platform_spec_path}/include/png16 ${platform_spec_path}/include/uv + ${platform_spec_path}/include/mbedtls_wrapper ) #TODO: remove in future version diff --git a/openharmony/arm64-v8a/include/mbedtls/aes.h b/openharmony/arm64-v8a/include/mbedtls/aes.h new file mode 100644 index 00000000..401ac39d --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/aes.h @@ -0,0 +1,689 @@ +/** + * \file aes.h + * + * \brief This file contains AES definitions and functions. + * + * The Advanced Encryption Standard (AES) specifies a FIPS-approved + * cryptographic algorithm that can be used to protect electronic + * data. + * + * The AES algorithm is a symmetric block cipher that can + * encrypt and decrypt information. For more information, see + * FIPS Publication 197: Advanced Encryption Standard and + * ISO/IEC 18033-2:2006: Information technology -- Security + * techniques -- Encryption algorithms -- Part 2: Asymmetric + * ciphers. + * + * The AES-XTS block mode is standardized by NIST SP 800-38E + * + * and described in detail by IEEE P1619 + * . + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_AES_H +#define MBEDTLS_AES_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif +#include "mbedtls/platform_util.h" + +#include +#include + +/* padlock.c and aesni.c rely on these values! */ +#define MBEDTLS_AES_ENCRYPT 1 /**< AES encryption. */ +#define MBEDTLS_AES_DECRYPT 0 /**< AES decryption. */ + +/* Error codes in range 0x0020-0x0022 */ +/** Invalid key length. */ +#define MBEDTLS_ERR_AES_INVALID_KEY_LENGTH -0x0020 +/** Invalid data input length. */ +#define MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH -0x0022 + +/* Error codes in range 0x0021-0x0025 */ +/** Invalid input data. */ +#define MBEDTLS_ERR_AES_BAD_INPUT_DATA -0x0021 + +/* MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE is deprecated and should not be used. */ +/** Feature not available. For example, an unsupported AES key size. */ +#define MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE -0x0023 + +/* MBEDTLS_ERR_AES_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** AES hardware accelerator failed. */ +#define MBEDTLS_ERR_AES_HW_ACCEL_FAILED -0x0025 + +#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \ + !defined(inline) && !defined(__cplusplus) +#define inline __inline +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_AES_ALT) +// Regular implementation +// + +/** + * \brief The AES context-type definition. + */ +typedef struct mbedtls_aes_context +{ + int nr; /*!< The number of rounds. */ + uint32_t *rk; /*!< AES round keys. */ + uint32_t buf[68]; /*!< Unaligned data buffer. This buffer can + hold 32 extra Bytes, which can be used for + one of the following purposes: +
  • Alignment if VIA padlock is + used.
    • +
  • Simplifying key expansion in the 256-bit + case by generating an extra round key. +
*/ +} +mbedtls_aes_context; + +#if defined(MBEDTLS_CIPHER_MODE_XTS) +/** + * \brief The AES XTS context-type definition. + */ +typedef struct mbedtls_aes_xts_context +{ + mbedtls_aes_context crypt; /*!< The AES context to use for AES block + encryption or decryption. */ + mbedtls_aes_context tweak; /*!< The AES context used for tweak + computation. */ +} mbedtls_aes_xts_context; +#endif /* MBEDTLS_CIPHER_MODE_XTS */ + +#else /* MBEDTLS_AES_ALT */ +#include "aes_alt.h" +#endif /* MBEDTLS_AES_ALT */ + +/** + * \brief This function initializes the specified AES context. + * + * It must be the first API called before using + * the context. + * + * \param ctx The AES context to initialize. This must not be \c NULL. + */ +void mbedtls_aes_init( mbedtls_aes_context *ctx ); + +/** + * \brief This function releases and clears the specified AES context. + * + * \param ctx The AES context to clear. + * If this is \c NULL, this function does nothing. + * Otherwise, the context must have been at least initialized. + */ +void mbedtls_aes_free( mbedtls_aes_context *ctx ); + +#if defined(MBEDTLS_CIPHER_MODE_XTS) +/** + * \brief This function initializes the specified AES XTS context. + * + * It must be the first API called before using + * the context. + * + * \param ctx The AES XTS context to initialize. This must not be \c NULL. + */ +void mbedtls_aes_xts_init( mbedtls_aes_xts_context *ctx ); + +/** + * \brief This function releases and clears the specified AES XTS context. + * + * \param ctx The AES XTS context to clear. + * If this is \c NULL, this function does nothing. + * Otherwise, the context must have been at least initialized. + */ +void mbedtls_aes_xts_free( mbedtls_aes_xts_context *ctx ); +#endif /* MBEDTLS_CIPHER_MODE_XTS */ + +/** + * \brief This function sets the encryption key. + * + * \param ctx The AES context to which the key should be bound. + * It must be initialized. + * \param key The encryption key. + * This must be a readable buffer of size \p keybits bits. + * \param keybits The size of data passed in bits. Valid options are: + *
  • 128 bits
    • + *
  • 192 bits
    • + *
  • 256 bits
+ * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_setkey_enc( mbedtls_aes_context *ctx, const unsigned char *key, + unsigned int keybits ); + +/** + * \brief This function sets the decryption key. + * + * \param ctx The AES context to which the key should be bound. + * It must be initialized. + * \param key The decryption key. + * This must be a readable buffer of size \p keybits bits. + * \param keybits The size of data passed. Valid options are: + *
  • 128 bits
    • + *
  • 192 bits
    • + *
  • 256 bits
+ * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_setkey_dec( mbedtls_aes_context *ctx, const unsigned char *key, + unsigned int keybits ); + +#if defined(MBEDTLS_CIPHER_MODE_XTS) +/** + * \brief This function prepares an XTS context for encryption and + * sets the encryption key. + * + * \param ctx The AES XTS context to which the key should be bound. + * It must be initialized. + * \param key The encryption key. This is comprised of the XTS key1 + * concatenated with the XTS key2. + * This must be a readable buffer of size \p keybits bits. + * \param keybits The size of \p key passed in bits. Valid options are: + *
  • 256 bits (each of key1 and key2 is a 128-bit key)
    • + *
  • 512 bits (each of key1 and key2 is a 256-bit key)
+ * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_xts_setkey_enc( mbedtls_aes_xts_context *ctx, + const unsigned char *key, + unsigned int keybits ); + +/** + * \brief This function prepares an XTS context for decryption and + * sets the decryption key. + * + * \param ctx The AES XTS context to which the key should be bound. + * It must be initialized. + * \param key The decryption key. This is comprised of the XTS key1 + * concatenated with the XTS key2. + * This must be a readable buffer of size \p keybits bits. + * \param keybits The size of \p key passed in bits. Valid options are: + *
  • 256 bits (each of key1 and key2 is a 128-bit key)
    • + *
  • 512 bits (each of key1 and key2 is a 256-bit key)
+ * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_xts_setkey_dec( mbedtls_aes_xts_context *ctx, + const unsigned char *key, + unsigned int keybits ); +#endif /* MBEDTLS_CIPHER_MODE_XTS */ + +/** + * \brief This function performs an AES single-block encryption or + * decryption operation. + * + * It performs the operation defined in the \p mode parameter + * (encrypt or decrypt), on the input data buffer defined in + * the \p input parameter. + * + * mbedtls_aes_init(), and either mbedtls_aes_setkey_enc() or + * mbedtls_aes_setkey_dec() must be called before the first + * call to this API with the same context. + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param mode The AES operation: #MBEDTLS_AES_ENCRYPT or + * #MBEDTLS_AES_DECRYPT. + * \param input The buffer holding the input data. + * It must be readable and at least \c 16 Bytes long. + * \param output The buffer where the output data will be written. + * It must be writeable and at least \c 16 Bytes long. + + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_ecb( mbedtls_aes_context *ctx, + int mode, + const unsigned char input[16], + unsigned char output[16] ); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief This function performs an AES-CBC encryption or decryption operation + * on full blocks. + * + * It performs the operation defined in the \p mode + * parameter (encrypt/decrypt), on the input data buffer defined in + * the \p input parameter. + * + * It can be called as many times as needed, until all the input + * data is processed. mbedtls_aes_init(), and either + * mbedtls_aes_setkey_enc() or mbedtls_aes_setkey_dec() must be called + * before the first call to this API with the same context. + * + * \note This function operates on full blocks, that is, the input size + * must be a multiple of the AES block size of \c 16 Bytes. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the same function again on the next + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If you need to retain the contents of the IV, you should + * either save it manually or use the cipher module instead. + * + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param mode The AES operation: #MBEDTLS_AES_ENCRYPT or + * #MBEDTLS_AES_DECRYPT. + * \param length The length of the input data in Bytes. This must be a + * multiple of the block size (\c 16 Bytes). + * \param iv Initialization vector (updated after use). + * It must be a readable and writeable buffer of \c 16 Bytes. + * \param input The buffer holding the input data. + * It must be readable and of size \p length Bytes. + * \param output The buffer holding the output data. + * It must be writeable and of size \p length Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH + * on failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_cbc( mbedtls_aes_context *ctx, + int mode, + size_t length, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +#if defined(MBEDTLS_CIPHER_MODE_XTS) +/** + * \brief This function performs an AES-XTS encryption or decryption + * operation for an entire XTS data unit. + * + * AES-XTS encrypts or decrypts blocks based on their location as + * defined by a data unit number. The data unit number must be + * provided by \p data_unit. + * + * NIST SP 800-38E limits the maximum size of a data unit to 2^20 + * AES blocks. If the data unit is larger than this, this function + * returns #MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH. + * + * \param ctx The AES XTS context to use for AES XTS operations. + * It must be initialized and bound to a key. + * \param mode The AES operation: #MBEDTLS_AES_ENCRYPT or + * #MBEDTLS_AES_DECRYPT. + * \param length The length of a data unit in Bytes. This can be any + * length between 16 bytes and 2^24 bytes inclusive + * (between 1 and 2^20 block cipher blocks). + * \param data_unit The address of the data unit encoded as an array of 16 + * bytes in little-endian format. For disk encryption, this + * is typically the index of the block device sector that + * contains the data. + * \param input The buffer holding the input data (which is an entire + * data unit). This function reads \p length Bytes from \p + * input. + * \param output The buffer holding the output data (which is an entire + * data unit). This function writes \p length Bytes to \p + * output. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH if \p length is + * smaller than an AES block in size (16 Bytes) or if \p + * length is larger than 2^20 blocks (16 MiB). + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_xts( mbedtls_aes_xts_context *ctx, + int mode, + size_t length, + const unsigned char data_unit[16], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_XTS */ + +#if defined(MBEDTLS_CIPHER_MODE_CFB) +/** + * \brief This function performs an AES-CFB128 encryption or decryption + * operation. + * + * It performs the operation defined in the \p mode + * parameter (encrypt or decrypt), on the input data buffer + * defined in the \p input parameter. + * + * For CFB, you must set up the context with mbedtls_aes_setkey_enc(), + * regardless of whether you are performing an encryption or decryption + * operation, that is, regardless of the \p mode parameter. This is + * because CFB mode uses the same key schedule for encryption and + * decryption. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the same function again on the next + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If you need to retain the contents of the + * IV, you must either save it manually or use the cipher + * module instead. + * + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param mode The AES operation: #MBEDTLS_AES_ENCRYPT or + * #MBEDTLS_AES_DECRYPT. + * \param length The length of the input data in Bytes. + * \param iv_off The offset in IV (updated after use). + * It must point to a valid \c size_t. + * \param iv The initialization vector (updated after use). + * It must be a readable and writeable buffer of \c 16 Bytes. + * \param input The buffer holding the input data. + * It must be readable and of size \p length Bytes. + * \param output The buffer holding the output data. + * It must be writeable and of size \p length Bytes. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_cfb128( mbedtls_aes_context *ctx, + int mode, + size_t length, + size_t *iv_off, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function performs an AES-CFB8 encryption or decryption + * operation. + * + * It performs the operation defined in the \p mode + * parameter (encrypt/decrypt), on the input data buffer defined + * in the \p input parameter. + * + * Due to the nature of CFB, you must use the same key schedule for + * both encryption and decryption operations. Therefore, you must + * use the context initialized with mbedtls_aes_setkey_enc() for + * both #MBEDTLS_AES_ENCRYPT and #MBEDTLS_AES_DECRYPT. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the same function again on the next + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param mode The AES operation: #MBEDTLS_AES_ENCRYPT or + * #MBEDTLS_AES_DECRYPT + * \param length The length of the input data. + * \param iv The initialization vector (updated after use). + * It must be a readable and writeable buffer of \c 16 Bytes. + * \param input The buffer holding the input data. + * It must be readable and of size \p length Bytes. + * \param output The buffer holding the output data. + * It must be writeable and of size \p length Bytes. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_cfb8( mbedtls_aes_context *ctx, + int mode, + size_t length, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output ); +#endif /*MBEDTLS_CIPHER_MODE_CFB */ + +#if defined(MBEDTLS_CIPHER_MODE_OFB) +/** + * \brief This function performs an AES-OFB (Output Feedback Mode) + * encryption or decryption operation. + * + * For OFB, you must set up the context with + * mbedtls_aes_setkey_enc(), regardless of whether you are + * performing an encryption or decryption operation. This is + * because OFB mode uses the same key schedule for encryption and + * decryption. + * + * The OFB operation is identical for encryption or decryption, + * therefore no operation mode needs to be specified. + * + * \note Upon exit, the content of iv, the Initialisation Vector, is + * updated so that you can call the same function again on the next + * block(s) of data and get the same result as if it was encrypted + * in one call. This allows a "streaming" usage, by initialising + * iv_off to 0 before the first call, and preserving its value + * between calls. + * + * For non-streaming use, the iv should be initialised on each call + * to a unique value, and iv_off set to 0 on each call. + * + * If you need to retain the contents of the initialisation vector, + * you must either save it manually or use the cipher module + * instead. + * + * \warning For the OFB mode, the initialisation vector must be unique + * every encryption operation. Reuse of an initialisation vector + * will compromise security. + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param length The length of the input data. + * \param iv_off The offset in IV (updated after use). + * It must point to a valid \c size_t. + * \param iv The initialization vector (updated after use). + * It must be a readable and writeable buffer of \c 16 Bytes. + * \param input The buffer holding the input data. + * It must be readable and of size \p length Bytes. + * \param output The buffer holding the output data. + * It must be writeable and of size \p length Bytes. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_ofb( mbedtls_aes_context *ctx, + size_t length, + size_t *iv_off, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output ); + +#endif /* MBEDTLS_CIPHER_MODE_OFB */ + +#if defined(MBEDTLS_CIPHER_MODE_CTR) +/** + * \brief This function performs an AES-CTR encryption or decryption + * operation. + * + * Due to the nature of CTR, you must use the same key schedule + * for both encryption and decryption operations. Therefore, you + * must use the context initialized with mbedtls_aes_setkey_enc() + * for both #MBEDTLS_AES_ENCRYPT and #MBEDTLS_AES_DECRYPT. + * + * \warning You must never reuse a nonce value with the same key. Doing so + * would void the encryption for the two messages encrypted with + * the same nonce and key. + * + * There are two common strategies for managing nonces with CTR: + * + * 1. You can handle everything as a single message processed over + * successive calls to this function. In that case, you want to + * set \p nonce_counter and \p nc_off to 0 for the first call, and + * then preserve the values of \p nonce_counter, \p nc_off and \p + * stream_block across calls to this function as they will be + * updated by this function. + * + * With this strategy, you must not encrypt more than 2**128 + * blocks of data with the same key. + * + * 2. You can encrypt separate messages by dividing the \p + * nonce_counter buffer in two areas: the first one used for a + * per-message nonce, handled by yourself, and the second one + * updated by this function internally. + * + * For example, you might reserve the first 12 bytes for the + * per-message nonce, and the last 4 bytes for internal use. In that + * case, before calling this function on a new message you need to + * set the first 12 bytes of \p nonce_counter to your chosen nonce + * value, the last 4 to 0, and \p nc_off to 0 (which will cause \p + * stream_block to be ignored). That way, you can encrypt at most + * 2**96 messages of up to 2**32 blocks each with the same key. + * + * The per-message nonce (or information sufficient to reconstruct + * it) needs to be communicated with the ciphertext and must be unique. + * The recommended way to ensure uniqueness is to use a message + * counter. An alternative is to generate random nonces, but this + * limits the number of messages that can be securely encrypted: + * for example, with 96-bit random nonces, you should not encrypt + * more than 2**32 messages with the same key. + * + * Note that for both strategies, sizes are measured in blocks and + * that an AES block is 16 bytes. + * + * \warning Upon return, \p stream_block contains sensitive data. Its + * content must not be written to insecure storage and should be + * securely discarded as soon as it's no longer needed. + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param length The length of the input data. + * \param nc_off The offset in the current \p stream_block, for + * resuming within the current cipher stream. The + * offset pointer should be 0 at the start of a stream. + * It must point to a valid \c size_t. + * \param nonce_counter The 128-bit nonce and counter. + * It must be a readable-writeable buffer of \c 16 Bytes. + * \param stream_block The saved stream block for resuming. This is + * overwritten by the function. + * It must be a readable-writeable buffer of \c 16 Bytes. + * \param input The buffer holding the input data. + * It must be readable and of size \p length Bytes. + * \param output The buffer holding the output data. + * It must be writeable and of size \p length Bytes. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_ctr( mbedtls_aes_context *ctx, + size_t length, + size_t *nc_off, + unsigned char nonce_counter[16], + unsigned char stream_block[16], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CTR */ + +/** + * \brief Internal AES block encryption function. This is only + * exposed to allow overriding it using + * \c MBEDTLS_AES_ENCRYPT_ALT. + * + * \param ctx The AES context to use for encryption. + * \param input The plaintext block. + * \param output The output (ciphertext) block. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx, + const unsigned char input[16], + unsigned char output[16] ); + +/** + * \brief Internal AES block decryption function. This is only + * exposed to allow overriding it using see + * \c MBEDTLS_AES_DECRYPT_ALT. + * + * \param ctx The AES context to use for decryption. + * \param input The ciphertext block. + * \param output The output (plaintext) block. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx, + const unsigned char input[16], + unsigned char output[16] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief Deprecated internal AES block encryption function + * without return value. + * + * \deprecated Superseded by mbedtls_internal_aes_encrypt() + * + * \param ctx The AES context to use for encryption. + * \param input Plaintext block. + * \param output Output (ciphertext) block. + */ +MBEDTLS_DEPRECATED void mbedtls_aes_encrypt( mbedtls_aes_context *ctx, + const unsigned char input[16], + unsigned char output[16] ); + +/** + * \brief Deprecated internal AES block decryption function + * without return value. + * + * \deprecated Superseded by mbedtls_internal_aes_decrypt() + * + * \param ctx The AES context to use for decryption. + * \param input Ciphertext block. + * \param output Output (plaintext) block. + */ +MBEDTLS_DEPRECATED void mbedtls_aes_decrypt( mbedtls_aes_context *ctx, + const unsigned char input[16], + unsigned char output[16] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_aes_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* aes.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/aesni.h b/openharmony/arm64-v8a/include/mbedtls/aesni.h new file mode 100644 index 00000000..c1d22f59 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/aesni.h @@ -0,0 +1,136 @@ +/** + * \file aesni.h + * + * \brief AES-NI for hardware AES acceleration on some Intel processors + * + * \warning These functions are only for internal use by other library + * functions; you must not call them directly. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_AESNI_H +#define MBEDTLS_AESNI_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/aes.h" + +#define MBEDTLS_AESNI_AES 0x02000000u +#define MBEDTLS_AESNI_CLMUL 0x00000002u + +#if defined(MBEDTLS_HAVE_ASM) && defined(__GNUC__) && \ + ( defined(__amd64__) || defined(__x86_64__) ) && \ + ! defined(MBEDTLS_HAVE_X86_64) +#define MBEDTLS_HAVE_X86_64 +#endif + +#if defined(MBEDTLS_HAVE_X86_64) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Internal function to detect the AES-NI feature in CPUs. + * + * \note This function is only for internal use by other library + * functions; you must not call it directly. + * + * \param what The feature to detect + * (MBEDTLS_AESNI_AES or MBEDTLS_AESNI_CLMUL) + * + * \return 1 if CPU has support for the feature, 0 otherwise + */ +int mbedtls_aesni_has_support( unsigned int what ); + +/** + * \brief Internal AES-NI AES-ECB block encryption and decryption + * + * \note This function is only for internal use by other library + * functions; you must not call it directly. + * + * \param ctx AES context + * \param mode MBEDTLS_AES_ENCRYPT or MBEDTLS_AES_DECRYPT + * \param input 16-byte input block + * \param output 16-byte output block + * + * \return 0 on success (cannot fail) + */ +int mbedtls_aesni_crypt_ecb( mbedtls_aes_context *ctx, + int mode, + const unsigned char input[16], + unsigned char output[16] ); + +/** + * \brief Internal GCM multiplication: c = a * b in GF(2^128) + * + * \note This function is only for internal use by other library + * functions; you must not call it directly. + * + * \param c Result + * \param a First operand + * \param b Second operand + * + * \note Both operands and result are bit strings interpreted as + * elements of GF(2^128) as per the GCM spec. + */ +void mbedtls_aesni_gcm_mult( unsigned char c[16], + const unsigned char a[16], + const unsigned char b[16] ); + +/** + * \brief Internal round key inversion. This function computes + * decryption round keys from the encryption round keys. + * + * \note This function is only for internal use by other library + * functions; you must not call it directly. + * + * \param invkey Round keys for the equivalent inverse cipher + * \param fwdkey Original round keys (for encryption) + * \param nr Number of rounds (that is, number of round keys minus one) + */ +void mbedtls_aesni_inverse_key( unsigned char *invkey, + const unsigned char *fwdkey, + int nr ); + +/** + * \brief Internal key expansion for encryption + * + * \note This function is only for internal use by other library + * functions; you must not call it directly. + * + * \param rk Destination buffer where the round keys are written + * \param key Encryption key + * \param bits Key size in bits (must be 128, 192 or 256) + * + * \return 0 if successful, or MBEDTLS_ERR_AES_INVALID_KEY_LENGTH + */ +int mbedtls_aesni_setkey_enc( unsigned char *rk, + const unsigned char *key, + size_t bits ); + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_HAVE_X86_64 */ + +#endif /* MBEDTLS_AESNI_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/arc4.h b/openharmony/arm64-v8a/include/mbedtls/arc4.h new file mode 100644 index 00000000..f4b0f9f3 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/arc4.h @@ -0,0 +1,145 @@ +/** + * \file arc4.h + * + * \brief The ARCFOUR stream cipher + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers instead. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ +#ifndef MBEDTLS_ARC4_H +#define MBEDTLS_ARC4_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +/* MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** ARC4 hardware accelerator failed. */ +#define MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED -0x0019 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_ARC4_ALT) +// Regular implementation +// + +/** + * \brief ARC4 context structure + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers instead. + * + */ +typedef struct mbedtls_arc4_context +{ + int x; /*!< permutation index */ + int y; /*!< permutation index */ + unsigned char m[256]; /*!< permutation table */ +} +mbedtls_arc4_context; + +#else /* MBEDTLS_ARC4_ALT */ +#include "arc4_alt.h" +#endif /* MBEDTLS_ARC4_ALT */ + +/** + * \brief Initialize ARC4 context + * + * \param ctx ARC4 context to be initialized + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + * + */ +void mbedtls_arc4_init( mbedtls_arc4_context *ctx ); + +/** + * \brief Clear ARC4 context + * + * \param ctx ARC4 context to be cleared + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + * + */ +void mbedtls_arc4_free( mbedtls_arc4_context *ctx ); + +/** + * \brief ARC4 key schedule + * + * \param ctx ARC4 context to be setup + * \param key the secret key + * \param keylen length of the key, in bytes + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + * + */ +void mbedtls_arc4_setup( mbedtls_arc4_context *ctx, const unsigned char *key, + unsigned int keylen ); + +/** + * \brief ARC4 cipher function + * + * \param ctx ARC4 context + * \param length length of the input data + * \param input buffer holding the input data + * \param output buffer for the output data + * + * \return 0 if successful + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + * + */ +int mbedtls_arc4_crypt( mbedtls_arc4_context *ctx, size_t length, const unsigned char *input, + unsigned char *output ); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + * + */ +int mbedtls_arc4_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* arc4.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/aria.h b/openharmony/arm64-v8a/include/mbedtls/aria.h new file mode 100644 index 00000000..d294c47f --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/aria.h @@ -0,0 +1,373 @@ +/** + * \file aria.h + * + * \brief ARIA block cipher + * + * The ARIA algorithm is a symmetric block cipher that can encrypt and + * decrypt information. It is defined by the Korean Agency for + * Technology and Standards (KATS) in KS X 1213:2004 (in + * Korean, but see http://210.104.33.10/ARIA/index-e.html in English) + * and also described by the IETF in RFC 5794. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_ARIA_H +#define MBEDTLS_ARIA_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +#include "mbedtls/platform_util.h" + +#define MBEDTLS_ARIA_ENCRYPT 1 /**< ARIA encryption. */ +#define MBEDTLS_ARIA_DECRYPT 0 /**< ARIA decryption. */ + +#define MBEDTLS_ARIA_BLOCKSIZE 16 /**< ARIA block size in bytes. */ +#define MBEDTLS_ARIA_MAX_ROUNDS 16 /**< Maximum number of rounds in ARIA. */ +#define MBEDTLS_ARIA_MAX_KEYSIZE 32 /**< Maximum size of an ARIA key in bytes. */ + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#define MBEDTLS_ERR_ARIA_INVALID_KEY_LENGTH MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( -0x005C ) +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ +/** Bad input data. */ +#define MBEDTLS_ERR_ARIA_BAD_INPUT_DATA -0x005C + +/** Invalid data input length. */ +#define MBEDTLS_ERR_ARIA_INVALID_INPUT_LENGTH -0x005E + +/* MBEDTLS_ERR_ARIA_FEATURE_UNAVAILABLE is deprecated and should not be used. + */ +/** Feature not available. For example, an unsupported ARIA key size. */ +#define MBEDTLS_ERR_ARIA_FEATURE_UNAVAILABLE -0x005A + +/* MBEDTLS_ERR_ARIA_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** ARIA hardware accelerator failed. */ +#define MBEDTLS_ERR_ARIA_HW_ACCEL_FAILED -0x0058 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_ARIA_ALT) +// Regular implementation +// + +/** + * \brief The ARIA context-type definition. + */ +typedef struct mbedtls_aria_context +{ + unsigned char nr; /*!< The number of rounds (12, 14 or 16) */ + /*! The ARIA round keys. */ + uint32_t rk[MBEDTLS_ARIA_MAX_ROUNDS + 1][MBEDTLS_ARIA_BLOCKSIZE / 4]; +} +mbedtls_aria_context; + +#else /* MBEDTLS_ARIA_ALT */ +#include "aria_alt.h" +#endif /* MBEDTLS_ARIA_ALT */ + +/** + * \brief This function initializes the specified ARIA context. + * + * It must be the first API called before using + * the context. + * + * \param ctx The ARIA context to initialize. This must not be \c NULL. + */ +void mbedtls_aria_init( mbedtls_aria_context *ctx ); + +/** + * \brief This function releases and clears the specified ARIA context. + * + * \param ctx The ARIA context to clear. This may be \c NULL, in which + * case this function returns immediately. If it is not \c NULL, + * it must point to an initialized ARIA context. + */ +void mbedtls_aria_free( mbedtls_aria_context *ctx ); + +/** + * \brief This function sets the encryption key. + * + * \param ctx The ARIA context to which the key should be bound. + * This must be initialized. + * \param key The encryption key. This must be a readable buffer + * of size \p keybits Bits. + * \param keybits The size of \p key in Bits. Valid options are: + *
  • 128 bits
    • + *
  • 192 bits
    • + *
  • 256 bits
+ * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_setkey_enc( mbedtls_aria_context *ctx, + const unsigned char *key, + unsigned int keybits ); + +/** + * \brief This function sets the decryption key. + * + * \param ctx The ARIA context to which the key should be bound. + * This must be initialized. + * \param key The decryption key. This must be a readable buffer + * of size \p keybits Bits. + * \param keybits The size of data passed. Valid options are: + *
  • 128 bits
    • + *
  • 192 bits
    • + *
  • 256 bits
+ * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_setkey_dec( mbedtls_aria_context *ctx, + const unsigned char *key, + unsigned int keybits ); + +/** + * \brief This function performs an ARIA single-block encryption or + * decryption operation. + * + * It performs encryption or decryption (depending on whether + * the key was set for encryption on decryption) on the input + * data buffer defined in the \p input parameter. + * + * mbedtls_aria_init(), and either mbedtls_aria_setkey_enc() or + * mbedtls_aria_setkey_dec() must be called before the first + * call to this API with the same context. + * + * \param ctx The ARIA context to use for encryption or decryption. + * This must be initialized and bound to a key. + * \param input The 16-Byte buffer holding the input data. + * \param output The 16-Byte buffer holding the output data. + + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_crypt_ecb( mbedtls_aria_context *ctx, + const unsigned char input[MBEDTLS_ARIA_BLOCKSIZE], + unsigned char output[MBEDTLS_ARIA_BLOCKSIZE] ); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief This function performs an ARIA-CBC encryption or decryption operation + * on full blocks. + * + * It performs the operation defined in the \p mode + * parameter (encrypt/decrypt), on the input data buffer defined in + * the \p input parameter. + * + * It can be called as many times as needed, until all the input + * data is processed. mbedtls_aria_init(), and either + * mbedtls_aria_setkey_enc() or mbedtls_aria_setkey_dec() must be called + * before the first call to this API with the same context. + * + * \note This function operates on aligned blocks, that is, the input size + * must be a multiple of the ARIA block size of 16 Bytes. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the same function again on the next + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If you need to retain the contents of the IV, you should + * either save it manually or use the cipher module instead. + * + * + * \param ctx The ARIA context to use for encryption or decryption. + * This must be initialized and bound to a key. + * \param mode The mode of operation. This must be either + * #MBEDTLS_ARIA_ENCRYPT for encryption, or + * #MBEDTLS_ARIA_DECRYPT for decryption. + * \param length The length of the input data in Bytes. This must be a + * multiple of the block size (16 Bytes). + * \param iv Initialization vector (updated after use). + * This must be a readable buffer of size 16 Bytes. + * \param input The buffer holding the input data. This must + * be a readable buffer of length \p length Bytes. + * \param output The buffer holding the output data. This must + * be a writable buffer of length \p length Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_crypt_cbc( mbedtls_aria_context *ctx, + int mode, + size_t length, + unsigned char iv[MBEDTLS_ARIA_BLOCKSIZE], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +#if defined(MBEDTLS_CIPHER_MODE_CFB) +/** + * \brief This function performs an ARIA-CFB128 encryption or decryption + * operation. + * + * It performs the operation defined in the \p mode + * parameter (encrypt or decrypt), on the input data buffer + * defined in the \p input parameter. + * + * For CFB, you must set up the context with mbedtls_aria_setkey_enc(), + * regardless of whether you are performing an encryption or decryption + * operation, that is, regardless of the \p mode parameter. This is + * because CFB mode uses the same key schedule for encryption and + * decryption. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the same function again on the next + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If you need to retain the contents of the + * IV, you must either save it manually or use the cipher + * module instead. + * + * + * \param ctx The ARIA context to use for encryption or decryption. + * This must be initialized and bound to a key. + * \param mode The mode of operation. This must be either + * #MBEDTLS_ARIA_ENCRYPT for encryption, or + * #MBEDTLS_ARIA_DECRYPT for decryption. + * \param length The length of the input data \p input in Bytes. + * \param iv_off The offset in IV (updated after use). + * This must not be larger than 15. + * \param iv The initialization vector (updated after use). + * This must be a readable buffer of size 16 Bytes. + * \param input The buffer holding the input data. This must + * be a readable buffer of length \p length Bytes. + * \param output The buffer holding the output data. This must + * be a writable buffer of length \p length Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_crypt_cfb128( mbedtls_aria_context *ctx, + int mode, + size_t length, + size_t *iv_off, + unsigned char iv[MBEDTLS_ARIA_BLOCKSIZE], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CFB */ + +#if defined(MBEDTLS_CIPHER_MODE_CTR) +/** + * \brief This function performs an ARIA-CTR encryption or decryption + * operation. + * + * This function performs the operation defined in the \p mode + * parameter (encrypt/decrypt), on the input data buffer + * defined in the \p input parameter. + * + * Due to the nature of CTR, you must use the same key schedule + * for both encryption and decryption operations. Therefore, you + * must use the context initialized with mbedtls_aria_setkey_enc() + * for both #MBEDTLS_ARIA_ENCRYPT and #MBEDTLS_ARIA_DECRYPT. + * + * \warning You must never reuse a nonce value with the same key. Doing so + * would void the encryption for the two messages encrypted with + * the same nonce and key. + * + * There are two common strategies for managing nonces with CTR: + * + * 1. You can handle everything as a single message processed over + * successive calls to this function. In that case, you want to + * set \p nonce_counter and \p nc_off to 0 for the first call, and + * then preserve the values of \p nonce_counter, \p nc_off and \p + * stream_block across calls to this function as they will be + * updated by this function. + * + * With this strategy, you must not encrypt more than 2**128 + * blocks of data with the same key. + * + * 2. You can encrypt separate messages by dividing the \p + * nonce_counter buffer in two areas: the first one used for a + * per-message nonce, handled by yourself, and the second one + * updated by this function internally. + * + * For example, you might reserve the first 12 bytes for the + * per-message nonce, and the last 4 bytes for internal use. In that + * case, before calling this function on a new message you need to + * set the first 12 bytes of \p nonce_counter to your chosen nonce + * value, the last 4 to 0, and \p nc_off to 0 (which will cause \p + * stream_block to be ignored). That way, you can encrypt at most + * 2**96 messages of up to 2**32 blocks each with the same key. + * + * The per-message nonce (or information sufficient to reconstruct + * it) needs to be communicated with the ciphertext and must be unique. + * The recommended way to ensure uniqueness is to use a message + * counter. An alternative is to generate random nonces, but this + * limits the number of messages that can be securely encrypted: + * for example, with 96-bit random nonces, you should not encrypt + * more than 2**32 messages with the same key. + * + * Note that for both strategies, sizes are measured in blocks and + * that an ARIA block is 16 bytes. + * + * \warning Upon return, \p stream_block contains sensitive data. Its + * content must not be written to insecure storage and should be + * securely discarded as soon as it's no longer needed. + * + * \param ctx The ARIA context to use for encryption or decryption. + * This must be initialized and bound to a key. + * \param length The length of the input data \p input in Bytes. + * \param nc_off The offset in Bytes in the current \p stream_block, + * for resuming within the current cipher stream. The + * offset pointer should be \c 0 at the start of a + * stream. This must not be larger than \c 15 Bytes. + * \param nonce_counter The 128-bit nonce and counter. This must point to + * a read/write buffer of length \c 16 bytes. + * \param stream_block The saved stream block for resuming. This must + * point to a read/write buffer of length \c 16 bytes. + * This is overwritten by the function. + * \param input The buffer holding the input data. This must + * be a readable buffer of length \p length Bytes. + * \param output The buffer holding the output data. This must + * be a writable buffer of length \p length Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_crypt_ctr( mbedtls_aria_context *ctx, + size_t length, + size_t *nc_off, + unsigned char nonce_counter[MBEDTLS_ARIA_BLOCKSIZE], + unsigned char stream_block[MBEDTLS_ARIA_BLOCKSIZE], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CTR */ + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine. + * + * \return \c 0 on success, or \c 1 on failure. + */ +int mbedtls_aria_self_test( int verbose ); +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* aria.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/asn1.h b/openharmony/arm64-v8a/include/mbedtls/asn1.h new file mode 100644 index 00000000..5117fc7a --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/asn1.h @@ -0,0 +1,616 @@ +/** + * \file asn1.h + * + * \brief Generic ASN.1 parsing + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_ASN1_H +#define MBEDTLS_ASN1_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +#if defined(MBEDTLS_BIGNUM_C) +#include "mbedtls/bignum.h" +#endif + +/** + * \addtogroup asn1_module + * \{ + */ + +/** + * \name ASN1 Error codes + * These error codes are OR'ed to X509 error codes for + * higher error granularity. + * ASN1 is a standard to specify data structures. + * \{ + */ +/** Out of data when parsing an ASN1 data structure. */ +#define MBEDTLS_ERR_ASN1_OUT_OF_DATA -0x0060 +/** ASN1 tag was of an unexpected value. */ +#define MBEDTLS_ERR_ASN1_UNEXPECTED_TAG -0x0062 +/** Error when trying to determine the length or invalid length. */ +#define MBEDTLS_ERR_ASN1_INVALID_LENGTH -0x0064 +/** Actual length differs from expected length. */ +#define MBEDTLS_ERR_ASN1_LENGTH_MISMATCH -0x0066 +/** Data is invalid. */ +#define MBEDTLS_ERR_ASN1_INVALID_DATA -0x0068 +/** Memory allocation failed */ +#define MBEDTLS_ERR_ASN1_ALLOC_FAILED -0x006A +/** Buffer too small when writing ASN.1 data structure. */ +#define MBEDTLS_ERR_ASN1_BUF_TOO_SMALL -0x006C + +/** \} name ASN1 Error codes */ + +/** + * \name DER constants + * These constants comply with the DER encoded ASN.1 type tags. + * DER encoding uses hexadecimal representation. + * An example DER sequence is:\n + * - 0x02 -- tag indicating INTEGER + * - 0x01 -- length in octets + * - 0x05 -- value + * Such sequences are typically read into \c ::mbedtls_x509_buf. + * \{ + */ +#define MBEDTLS_ASN1_BOOLEAN 0x01 +#define MBEDTLS_ASN1_INTEGER 0x02 +#define MBEDTLS_ASN1_BIT_STRING 0x03 +#define MBEDTLS_ASN1_OCTET_STRING 0x04 +#define MBEDTLS_ASN1_NULL 0x05 +#define MBEDTLS_ASN1_OID 0x06 +#define MBEDTLS_ASN1_ENUMERATED 0x0A +#define MBEDTLS_ASN1_UTF8_STRING 0x0C +#define MBEDTLS_ASN1_SEQUENCE 0x10 +#define MBEDTLS_ASN1_SET 0x11 +#define MBEDTLS_ASN1_PRINTABLE_STRING 0x13 +#define MBEDTLS_ASN1_T61_STRING 0x14 +#define MBEDTLS_ASN1_IA5_STRING 0x16 +#define MBEDTLS_ASN1_UTC_TIME 0x17 +#define MBEDTLS_ASN1_GENERALIZED_TIME 0x18 +#define MBEDTLS_ASN1_UNIVERSAL_STRING 0x1C +#define MBEDTLS_ASN1_BMP_STRING 0x1E +#define MBEDTLS_ASN1_PRIMITIVE 0x00 +#define MBEDTLS_ASN1_CONSTRUCTED 0x20 +#define MBEDTLS_ASN1_CONTEXT_SPECIFIC 0x80 + +/* Slightly smaller way to check if tag is a string tag + * compared to canonical implementation. */ +#define MBEDTLS_ASN1_IS_STRING_TAG( tag ) \ + ( ( tag ) < 32u && ( \ + ( ( 1u << ( tag ) ) & ( ( 1u << MBEDTLS_ASN1_BMP_STRING ) | \ + ( 1u << MBEDTLS_ASN1_UTF8_STRING ) | \ + ( 1u << MBEDTLS_ASN1_T61_STRING ) | \ + ( 1u << MBEDTLS_ASN1_IA5_STRING ) | \ + ( 1u << MBEDTLS_ASN1_UNIVERSAL_STRING ) | \ + ( 1u << MBEDTLS_ASN1_PRINTABLE_STRING ) | \ + ( 1u << MBEDTLS_ASN1_BIT_STRING ) ) ) != 0 ) ) + +/* + * Bit masks for each of the components of an ASN.1 tag as specified in + * ITU X.690 (08/2015), section 8.1 "General rules for encoding", + * paragraph 8.1.2.2: + * + * Bit 8 7 6 5 1 + * +-------+-----+------------+ + * | Class | P/C | Tag number | + * +-------+-----+------------+ + */ +#define MBEDTLS_ASN1_TAG_CLASS_MASK 0xC0 +#define MBEDTLS_ASN1_TAG_PC_MASK 0x20 +#define MBEDTLS_ASN1_TAG_VALUE_MASK 0x1F + +/** \} name DER constants */ + +/** Returns the size of the binary string, without the trailing \\0 */ +#define MBEDTLS_OID_SIZE(x) (sizeof(x) - 1) + +/** + * Compares an mbedtls_asn1_buf structure to a reference OID. + * + * Only works for 'defined' oid_str values (MBEDTLS_OID_HMAC_SHA1), you cannot use a + * 'unsigned char *oid' here! + */ +#define MBEDTLS_OID_CMP(oid_str, oid_buf) \ + ( ( MBEDTLS_OID_SIZE(oid_str) != (oid_buf)->len ) || \ + memcmp( (oid_str), (oid_buf)->p, (oid_buf)->len) != 0 ) + +#define MBEDTLS_OID_CMP_RAW(oid_str, oid_buf, oid_buf_len) \ + ( ( MBEDTLS_OID_SIZE(oid_str) != (oid_buf_len) ) || \ + memcmp( (oid_str), (oid_buf), (oid_buf_len) ) != 0 ) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \name Functions to parse ASN.1 data structures + * \{ + */ + +/** + * Type-length-value structure that allows for ASN1 using DER. + */ +typedef struct mbedtls_asn1_buf +{ + int tag; /**< ASN1 type, e.g. MBEDTLS_ASN1_UTF8_STRING. */ + size_t len; /**< ASN1 length, in octets. */ + unsigned char *p; /**< ASN1 data, e.g. in ASCII. */ +} +mbedtls_asn1_buf; + +/** + * Container for ASN1 bit strings. + */ +typedef struct mbedtls_asn1_bitstring +{ + size_t len; /**< ASN1 length, in octets. */ + unsigned char unused_bits; /**< Number of unused bits at the end of the string */ + unsigned char *p; /**< Raw ASN1 data for the bit string */ +} +mbedtls_asn1_bitstring; + +/** + * Container for a sequence of ASN.1 items + */ +typedef struct mbedtls_asn1_sequence +{ + mbedtls_asn1_buf buf; /**< Buffer containing the given ASN.1 item. */ + struct mbedtls_asn1_sequence *next; /**< The next entry in the sequence. */ +} +mbedtls_asn1_sequence; + +/** + * Container for a sequence or list of 'named' ASN.1 data items + */ +typedef struct mbedtls_asn1_named_data +{ + mbedtls_asn1_buf oid; /**< The object identifier. */ + mbedtls_asn1_buf val; /**< The named value. */ + struct mbedtls_asn1_named_data *next; /**< The next entry in the sequence. */ + unsigned char next_merged; /**< Merge next item into the current one? */ +} +mbedtls_asn1_named_data; + +/** + * \brief Get the length of an ASN.1 element. + * Updates the pointer to immediately behind the length. + * + * \param p On entry, \c *p points to the first byte of the length, + * i.e. immediately after the tag. + * On successful completion, \c *p points to the first byte + * after the length, i.e. the first byte of the content. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param len On successful completion, \c *len contains the length + * read from the ASN.1 input. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_OUT_OF_DATA if the ASN.1 element + * would end beyond \p end. + * \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the length is unparsable. + */ +int mbedtls_asn1_get_len( unsigned char **p, + const unsigned char *end, + size_t *len ); + +/** + * \brief Get the tag and length of the element. + * Check for the requested tag. + * Updates the pointer to immediately behind the tag and length. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * after the length, i.e. the first byte of the content. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param len On successful completion, \c *len contains the length + * read from the ASN.1 input. + * \param tag The expected tag. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_UNEXPECTED_TAG if the data does not start + * with the requested tag. + * \return #MBEDTLS_ERR_ASN1_OUT_OF_DATA if the ASN.1 element + * would end beyond \p end. + * \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the length is unparsable. + */ +int mbedtls_asn1_get_tag( unsigned char **p, + const unsigned char *end, + size_t *len, int tag ); + +/** + * \brief Retrieve a boolean ASN.1 tag and its value. + * Updates the pointer to immediately behind the full tag. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the ASN.1 element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param val On success, the parsed value (\c 0 or \c 1). + * + * \return 0 if successful. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 BOOLEAN. + */ +int mbedtls_asn1_get_bool( unsigned char **p, + const unsigned char *end, + int *val ); + +/** + * \brief Retrieve an integer ASN.1 tag and its value. + * Updates the pointer to immediately behind the full tag. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the ASN.1 element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param val On success, the parsed value. + * + * \return 0 if successful. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 INTEGER. + * \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the parsed value does + * not fit in an \c int. + */ +int mbedtls_asn1_get_int( unsigned char **p, + const unsigned char *end, + int *val ); + +/** + * \brief Retrieve an enumerated ASN.1 tag and its value. + * Updates the pointer to immediately behind the full tag. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the ASN.1 element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param val On success, the parsed value. + * + * \return 0 if successful. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 ENUMERATED. + * \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the parsed value does + * not fit in an \c int. + */ +int mbedtls_asn1_get_enum( unsigned char **p, + const unsigned char *end, + int *val ); + +/** + * \brief Retrieve a bitstring ASN.1 tag and its value. + * Updates the pointer to immediately behind the full tag. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p is equal to \p end. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param bs On success, ::mbedtls_asn1_bitstring information about + * the parsed value. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_LENGTH_MISMATCH if the input contains + * extra data after a valid BIT STRING. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 BIT STRING. + */ +int mbedtls_asn1_get_bitstring( unsigned char **p, const unsigned char *end, + mbedtls_asn1_bitstring *bs ); + +/** + * \brief Retrieve a bitstring ASN.1 tag without unused bits and its + * value. + * Updates the pointer to the beginning of the bit/octet string. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * of the content of the BIT STRING. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param len On success, \c *len is the length of the content in bytes. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_INVALID_DATA if the input starts with + * a valid BIT STRING with a nonzero number of unused bits. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 BIT STRING. + */ +int mbedtls_asn1_get_bitstring_null( unsigned char **p, + const unsigned char *end, + size_t *len ); + +/** + * \brief Parses and splits an ASN.1 "SEQUENCE OF ". + * Updates the pointer to immediately behind the full sequence tag. + * + * This function allocates memory for the sequence elements. You can free + * the allocated memory with mbedtls_asn1_sequence_free(). + * + * \note On error, this function may return a partial list in \p cur. + * You must set `cur->next = NULL` before calling this function! + * Otherwise it is impossible to distinguish a previously non-null + * pointer from a pointer to an object allocated by this function. + * + * \note If the sequence is empty, this function does not modify + * \c *cur. If the sequence is valid and non-empty, this + * function sets `cur->buf.tag` to \p tag. This allows + * callers to distinguish between an empty sequence and + * a one-element sequence. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p is equal to \p end. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param cur A ::mbedtls_asn1_sequence which this function fills. + * When this function returns, \c *cur is the head of a linked + * list. Each node in this list is allocated with + * mbedtls_calloc() apart from \p cur itself, and should + * therefore be freed with mbedtls_free(). + * The list describes the content of the sequence. + * The head of the list (i.e. \c *cur itself) describes the + * first element, `*cur->next` describes the second element, etc. + * For each element, `buf.tag == tag`, `buf.len` is the length + * of the content of the content of the element, and `buf.p` + * points to the first byte of the content (i.e. immediately + * past the length of the element). + * Note that list elements may be allocated even on error. + * \param tag Each element of the sequence must have this tag. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_LENGTH_MISMATCH if the input contains + * extra data after a valid SEQUENCE OF \p tag. + * \return #MBEDTLS_ERR_ASN1_UNEXPECTED_TAG if the input starts with + * an ASN.1 SEQUENCE in which an element has a tag that + * is different from \p tag. + * \return #MBEDTLS_ERR_ASN1_ALLOC_FAILED if a memory allocation failed. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 SEQUENCE. + */ +int mbedtls_asn1_get_sequence_of( unsigned char **p, + const unsigned char *end, + mbedtls_asn1_sequence *cur, + int tag ); +/** + * \brief Free a heap-allocated linked list presentation of + * an ASN.1 sequence, including the first element. + * + * There are two common ways to manage the memory used for the representation + * of a parsed ASN.1 sequence: + * - Allocate a head node `mbedtls_asn1_sequence *head` with mbedtls_calloc(). + * Pass this node as the `cur` argument to mbedtls_asn1_get_sequence_of(). + * When you have finished processing the sequence, + * call mbedtls_asn1_sequence_free() on `head`. + * - Allocate a head node `mbedtls_asn1_sequence *head` in any manner, + * for example on the stack. Make sure that `head->next == NULL`. + * Pass `head` as the `cur` argument to mbedtls_asn1_get_sequence_of(). + * When you have finished processing the sequence, + * call mbedtls_asn1_sequence_free() on `head->cur`, + * then free `head` itself in the appropriate manner. + * + * \param seq The address of the first sequence component. This may + * be \c NULL, in which case this functions returns + * immediately. + */ +void mbedtls_asn1_sequence_free( mbedtls_asn1_sequence *seq ); + +/** + * \brief Traverse an ASN.1 SEQUENCE container and + * call a callback for each entry. + * + * This function checks that the input is a SEQUENCE of elements that + * each have a "must" tag, and calls a callback function on the elements + * that have a "may" tag. + * + * For example, to validate that the input is a SEQUENCE of `tag1` and call + * `cb` on each element, use + * ``` + * mbedtls_asn1_traverse_sequence_of(&p, end, 0xff, tag1, 0, 0, cb, ctx); + * ``` + * + * To validate that the input is a SEQUENCE of ANY and call `cb` on + * each element, use + * ``` + * mbedtls_asn1_traverse_sequence_of(&p, end, 0, 0, 0, 0, cb, ctx); + * ``` + * + * To validate that the input is a SEQUENCE of CHOICE {NULL, OCTET STRING} + * and call `cb` on each element that is an OCTET STRING, use + * ``` + * mbedtls_asn1_traverse_sequence_of(&p, end, 0xfe, 0x04, 0xff, 0x04, cb, ctx); + * ``` + * + * The callback is called on the elements with a "may" tag from left to + * right. If the input is not a valid SEQUENCE of elements with a "must" tag, + * the callback is called on the elements up to the leftmost point where + * the input is invalid. + * + * \warning This function is still experimental and may change + * at any time. + * + * \param p The address of the pointer to the beginning of + * the ASN.1 SEQUENCE header. This is updated to + * point to the end of the ASN.1 SEQUENCE container + * on a successful invocation. + * \param end The end of the ASN.1 SEQUENCE container. + * \param tag_must_mask A mask to be applied to the ASN.1 tags found within + * the SEQUENCE before comparing to \p tag_must_value. + * \param tag_must_val The required value of each ASN.1 tag found in the + * SEQUENCE, after masking with \p tag_must_mask. + * Mismatching tags lead to an error. + * For example, a value of \c 0 for both \p tag_must_mask + * and \p tag_must_val means that every tag is allowed, + * while a value of \c 0xFF for \p tag_must_mask means + * that \p tag_must_val is the only allowed tag. + * \param tag_may_mask A mask to be applied to the ASN.1 tags found within + * the SEQUENCE before comparing to \p tag_may_value. + * \param tag_may_val The desired value of each ASN.1 tag found in the + * SEQUENCE, after masking with \p tag_may_mask. + * Mismatching tags will be silently ignored. + * For example, a value of \c 0 for \p tag_may_mask and + * \p tag_may_val means that any tag will be considered, + * while a value of \c 0xFF for \p tag_may_mask means + * that all tags with value different from \p tag_may_val + * will be ignored. + * \param cb The callback to trigger for each component + * in the ASN.1 SEQUENCE that matches \p tag_may_val. + * The callback function is called with the following + * parameters: + * - \p ctx. + * - The tag of the current element. + * - A pointer to the start of the current element's + * content inside the input. + * - The length of the content of the current element. + * If the callback returns a non-zero value, + * the function stops immediately, + * forwarding the callback's return value. + * \param ctx The context to be passed to the callback \p cb. + * + * \return \c 0 if successful the entire ASN.1 SEQUENCE + * was traversed without parsing or callback errors. + * \return #MBEDTLS_ERR_ASN1_LENGTH_MISMATCH if the input + * contains extra data after a valid SEQUENCE + * of elements with an accepted tag. + * \return #MBEDTLS_ERR_ASN1_UNEXPECTED_TAG if the input starts + * with an ASN.1 SEQUENCE in which an element has a tag + * that is not accepted. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 SEQUENCE. + * \return A non-zero error code forwarded from the callback + * \p cb in case the latter returns a non-zero value. + */ +int mbedtls_asn1_traverse_sequence_of( + unsigned char **p, + const unsigned char *end, + unsigned char tag_must_mask, unsigned char tag_must_val, + unsigned char tag_may_mask, unsigned char tag_may_val, + int (*cb)( void *ctx, int tag, + unsigned char* start, size_t len ), + void *ctx ); + +#if defined(MBEDTLS_BIGNUM_C) +/** + * \brief Retrieve an integer ASN.1 tag and its value. + * Updates the pointer to immediately behind the full tag. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the ASN.1 element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param X On success, the parsed value. + * + * \return 0 if successful. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 INTEGER. + * \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the parsed value does + * not fit in an \c int. + * \return An MPI error code if the parsed value is too large. + */ +int mbedtls_asn1_get_mpi( unsigned char **p, + const unsigned char *end, + mbedtls_mpi *X ); +#endif /* MBEDTLS_BIGNUM_C */ + +/** + * \brief Retrieve an AlgorithmIdentifier ASN.1 sequence. + * Updates the pointer to immediately behind the full + * AlgorithmIdentifier. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the AlgorithmIdentifier element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param alg The buffer to receive the OID. + * \param params The buffer to receive the parameters. + * This is zeroized if there are no parameters. + * + * \return 0 if successful or a specific ASN.1 or MPI error code. + */ +int mbedtls_asn1_get_alg( unsigned char **p, + const unsigned char *end, + mbedtls_asn1_buf *alg, mbedtls_asn1_buf *params ); + +/** + * \brief Retrieve an AlgorithmIdentifier ASN.1 sequence with NULL or no + * params. + * Updates the pointer to immediately behind the full + * AlgorithmIdentifier. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the AlgorithmIdentifier element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param alg The buffer to receive the OID. + * + * \return 0 if successful or a specific ASN.1 or MPI error code. + */ +int mbedtls_asn1_get_alg_null( unsigned char **p, + const unsigned char *end, + mbedtls_asn1_buf *alg ); + +/** + * \brief Find a specific named_data entry in a sequence or list based on + * the OID. + * + * \param list The list to seek through + * \param oid The OID to look for + * \param len Size of the OID + * + * \return NULL if not found, or a pointer to the existing entry. + */ +mbedtls_asn1_named_data *mbedtls_asn1_find_named_data( mbedtls_asn1_named_data *list, + const char *oid, size_t len ); + +/** + * \brief Free a mbedtls_asn1_named_data entry + * + * \param entry The named data entry to free. + * This function calls mbedtls_free() on + * `entry->oid.p` and `entry->val.p`. + */ +void mbedtls_asn1_free_named_data( mbedtls_asn1_named_data *entry ); + +/** + * \brief Free all entries in a mbedtls_asn1_named_data list. + * + * \param head Pointer to the head of the list of named data entries to free. + * This function calls mbedtls_asn1_free_named_data() and + * mbedtls_free() on each list element and + * sets \c *head to \c NULL. + */ +void mbedtls_asn1_free_named_data_list( mbedtls_asn1_named_data **head ); + +/** \} name Functions to parse ASN.1 data structures */ +/** \} addtogroup asn1_module */ + +#ifdef __cplusplus +} +#endif + +#endif /* asn1.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/asn1write.h b/openharmony/arm64-v8a/include/mbedtls/asn1write.h new file mode 100644 index 00000000..44afae0e --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/asn1write.h @@ -0,0 +1,370 @@ +/** + * \file asn1write.h + * + * \brief ASN.1 buffer writing functionality + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_ASN1_WRITE_H +#define MBEDTLS_ASN1_WRITE_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/asn1.h" + +#define MBEDTLS_ASN1_CHK_ADD(g, f) \ + do \ + { \ + if( ( ret = (f) ) < 0 ) \ + return( ret ); \ + else \ + (g) += ret; \ + } while( 0 ) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Write a length field in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param len The length value to write. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_len( unsigned char **p, unsigned char *start, + size_t len ); +/** + * \brief Write an ASN.1 tag in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param tag The tag to write. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_tag( unsigned char **p, unsigned char *start, + unsigned char tag ); + +/** + * \brief Write raw buffer data. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param buf The data buffer to write. + * \param size The length of the data buffer. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_raw_buffer( unsigned char **p, unsigned char *start, + const unsigned char *buf, size_t size ); + +#if defined(MBEDTLS_BIGNUM_C) +/** + * \brief Write a arbitrary-precision number (#MBEDTLS_ASN1_INTEGER) + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param X The MPI to write. + * It must be non-negative. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_mpi( unsigned char **p, unsigned char *start, + const mbedtls_mpi *X ); +#endif /* MBEDTLS_BIGNUM_C */ + +/** + * \brief Write a NULL tag (#MBEDTLS_ASN1_NULL) with zero data + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_null( unsigned char **p, unsigned char *start ); + +/** + * \brief Write an OID tag (#MBEDTLS_ASN1_OID) and data + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param oid The OID to write. + * \param oid_len The length of the OID. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_oid( unsigned char **p, unsigned char *start, + const char *oid, size_t oid_len ); + +/** + * \brief Write an AlgorithmIdentifier sequence in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param oid The OID of the algorithm to write. + * \param oid_len The length of the algorithm's OID. + * \param par_len The length of the parameters, which must be already written. + * If 0, NULL parameters are added + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_algorithm_identifier( unsigned char **p, + unsigned char *start, + const char *oid, size_t oid_len, + size_t par_len ); + +/** + * \brief Write a boolean tag (#MBEDTLS_ASN1_BOOLEAN) and value + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param boolean The boolean value to write, either \c 0 or \c 1. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_bool( unsigned char **p, unsigned char *start, + int boolean ); + +/** + * \brief Write an int tag (#MBEDTLS_ASN1_INTEGER) and value + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param val The integer value to write. + * It must be non-negative. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_int( unsigned char **p, unsigned char *start, int val ); + +/** + * \brief Write an enum tag (#MBEDTLS_ASN1_ENUMERATED) and value + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param val The integer value to write. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_enum( unsigned char **p, unsigned char *start, int val ); + +/** + * \brief Write a string in ASN.1 format using a specific + * string encoding tag. + + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param tag The string encoding tag to write, e.g. + * #MBEDTLS_ASN1_UTF8_STRING. + * \param text The string to write. + * \param text_len The length of \p text in bytes (which might + * be strictly larger than the number of characters). + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_tagged_string( unsigned char **p, unsigned char *start, + int tag, const char *text, + size_t text_len ); + +/** + * \brief Write a string in ASN.1 format using the PrintableString + * string encoding tag (#MBEDTLS_ASN1_PRINTABLE_STRING). + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param text The string to write. + * \param text_len The length of \p text in bytes (which might + * be strictly larger than the number of characters). + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_printable_string( unsigned char **p, + unsigned char *start, + const char *text, size_t text_len ); + +/** + * \brief Write a UTF8 string in ASN.1 format using the UTF8String + * string encoding tag (#MBEDTLS_ASN1_UTF8_STRING). + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param text The string to write. + * \param text_len The length of \p text in bytes (which might + * be strictly larger than the number of characters). + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_utf8_string( unsigned char **p, unsigned char *start, + const char *text, size_t text_len ); + +/** + * \brief Write a string in ASN.1 format using the IA5String + * string encoding tag (#MBEDTLS_ASN1_IA5_STRING). + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param text The string to write. + * \param text_len The length of \p text in bytes (which might + * be strictly larger than the number of characters). + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_ia5_string( unsigned char **p, unsigned char *start, + const char *text, size_t text_len ); + +/** + * \brief Write a bitstring tag (#MBEDTLS_ASN1_BIT_STRING) and + * value in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param buf The bitstring to write. + * \param bits The total number of bits in the bitstring. + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_bitstring( unsigned char **p, unsigned char *start, + const unsigned char *buf, size_t bits ); + +/** + * \brief This function writes a named bitstring tag + * (#MBEDTLS_ASN1_BIT_STRING) and value in ASN.1 format. + * + * As stated in RFC 5280 Appendix B, trailing zeroes are + * omitted when encoding named bitstrings in DER. + * + * \note This function works backwards within the data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer which is used for bounds-checking. + * \param buf The bitstring to write. + * \param bits The total number of bits in the bitstring. + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_named_bitstring( unsigned char **p, + unsigned char *start, + const unsigned char *buf, + size_t bits ); + +/** + * \brief Write an octet string tag (#MBEDTLS_ASN1_OCTET_STRING) + * and value in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param buf The buffer holding the data to write. + * \param size The length of the data buffer \p buf. + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_octet_string( unsigned char **p, unsigned char *start, + const unsigned char *buf, size_t size ); + +/** + * \brief Create or find a specific named_data entry for writing in a + * sequence or list based on the OID. If not already in there, + * a new entry is added to the head of the list. + * Warning: Destructive behaviour for the val data! + * + * \param list The pointer to the location of the head of the list to seek + * through (will be updated in case of a new entry). + * \param oid The OID to look for. + * \param oid_len The size of the OID. + * \param val The associated data to store. If this is \c NULL, + * no data is copied to the new or existing buffer. + * \param val_len The minimum length of the data buffer needed. + * If this is 0, do not allocate a buffer for the associated + * data. + * If the OID was already present, enlarge, shrink or free + * the existing buffer to fit \p val_len. + * + * \return A pointer to the new / existing entry on success. + * \return \c NULL if if there was a memory allocation error. + */ +mbedtls_asn1_named_data *mbedtls_asn1_store_named_data( mbedtls_asn1_named_data **list, + const char *oid, size_t oid_len, + const unsigned char *val, + size_t val_len ); + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_ASN1_WRITE_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/base64.h b/openharmony/arm64-v8a/include/mbedtls/base64.h new file mode 100644 index 00000000..cf4149e7 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/base64.h @@ -0,0 +1,98 @@ +/** + * \file base64.h + * + * \brief RFC 1521 base64 encoding/decoding + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_BASE64_H +#define MBEDTLS_BASE64_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +/** Output buffer too small. */ +#define MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL -0x002A +/** Invalid character in input. */ +#define MBEDTLS_ERR_BASE64_INVALID_CHARACTER -0x002C + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Encode a buffer into base64 format + * + * \param dst destination buffer + * \param dlen size of the destination buffer + * \param olen number of bytes written + * \param src source buffer + * \param slen amount of data to be encoded + * + * \return 0 if successful, or MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL. + * *olen is always updated to reflect the amount + * of data that has (or would have) been written. + * If that length cannot be represented, then no data is + * written to the buffer and *olen is set to the maximum + * length representable as a size_t. + * + * \note Call this function with dlen = 0 to obtain the + * required buffer size in *olen + */ +int mbedtls_base64_encode( unsigned char *dst, size_t dlen, size_t *olen, + const unsigned char *src, size_t slen ); + +/** + * \brief Decode a base64-formatted buffer + * + * \param dst destination buffer (can be NULL for checking size) + * \param dlen size of the destination buffer + * \param olen number of bytes written + * \param src source buffer + * \param slen amount of data to be decoded + * + * \return 0 if successful, MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL, or + * MBEDTLS_ERR_BASE64_INVALID_CHARACTER if the input data is + * not correct. *olen is always updated to reflect the amount + * of data that has (or would have) been written. + * + * \note Call this function with *dst = NULL or dlen = 0 to obtain + * the required buffer size in *olen + */ +int mbedtls_base64_decode( unsigned char *dst, size_t dlen, size_t *olen, + const unsigned char *src, size_t slen ); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_base64_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* base64.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/bignum.h b/openharmony/arm64-v8a/include/mbedtls/bignum.h new file mode 100644 index 00000000..dd594c51 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/bignum.h @@ -0,0 +1,1063 @@ +/** + * \file bignum.h + * + * \brief Multi-precision integer library + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_BIGNUM_H +#define MBEDTLS_BIGNUM_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +#if defined(MBEDTLS_FS_IO) +#include +#endif + +/** An error occurred while reading from or writing to a file. */ +#define MBEDTLS_ERR_MPI_FILE_IO_ERROR -0x0002 +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_MPI_BAD_INPUT_DATA -0x0004 +/** There is an invalid character in the digit string. */ +#define MBEDTLS_ERR_MPI_INVALID_CHARACTER -0x0006 +/** The buffer is too small to write to. */ +#define MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL -0x0008 +/** The input arguments are negative or result in illegal output. */ +#define MBEDTLS_ERR_MPI_NEGATIVE_VALUE -0x000A +/** The input argument for division is zero, which is not allowed. */ +#define MBEDTLS_ERR_MPI_DIVISION_BY_ZERO -0x000C +/** The input arguments are not acceptable. */ +#define MBEDTLS_ERR_MPI_NOT_ACCEPTABLE -0x000E +/** Memory allocation failed. */ +#define MBEDTLS_ERR_MPI_ALLOC_FAILED -0x0010 + +#define MBEDTLS_MPI_CHK(f) \ + do \ + { \ + if( ( ret = (f) ) != 0 ) \ + goto cleanup; \ + } while( 0 ) + +/* + * Maximum size MPIs are allowed to grow to in number of limbs. + */ +#define MBEDTLS_MPI_MAX_LIMBS 10000 + +#if !defined(MBEDTLS_MPI_WINDOW_SIZE) +/* + * Maximum window size used for modular exponentiation. Default: 6 + * Minimum value: 1. Maximum value: 6. + * + * Result is an array of ( 2 ** MBEDTLS_MPI_WINDOW_SIZE ) MPIs used + * for the sliding window calculation. (So 64 by default) + * + * Reduction in size, reduces speed. + */ +#define MBEDTLS_MPI_WINDOW_SIZE 6 /**< Maximum window size used. */ +#endif /* !MBEDTLS_MPI_WINDOW_SIZE */ + +#if !defined(MBEDTLS_MPI_MAX_SIZE) +/* + * Maximum size of MPIs allowed in bits and bytes for user-MPIs. + * ( Default: 512 bytes => 4096 bits, Maximum tested: 2048 bytes => 16384 bits ) + * + * Note: Calculations can temporarily result in larger MPIs. So the number + * of limbs required (MBEDTLS_MPI_MAX_LIMBS) is higher. + */ +#define MBEDTLS_MPI_MAX_SIZE 1024 /**< Maximum number of bytes for usable MPIs. */ +#endif /* !MBEDTLS_MPI_MAX_SIZE */ + +#define MBEDTLS_MPI_MAX_BITS ( 8 * MBEDTLS_MPI_MAX_SIZE ) /**< Maximum number of bits for usable MPIs. */ + +/* + * When reading from files with mbedtls_mpi_read_file() and writing to files with + * mbedtls_mpi_write_file() the buffer should have space + * for a (short) label, the MPI (in the provided radix), the newline + * characters and the '\0'. + * + * By default we assume at least a 10 char label, a minimum radix of 10 + * (decimal) and a maximum of 4096 bit numbers (1234 decimal chars). + * Autosized at compile time for at least a 10 char label, a minimum radix + * of 10 (decimal) for a number of MBEDTLS_MPI_MAX_BITS size. + * + * This used to be statically sized to 1250 for a maximum of 4096 bit + * numbers (1234 decimal chars). + * + * Calculate using the formula: + * MBEDTLS_MPI_RW_BUFFER_SIZE = ceil(MBEDTLS_MPI_MAX_BITS / ln(10) * ln(2)) + + * LabelSize + 6 + */ +#define MBEDTLS_MPI_MAX_BITS_SCALE100 ( 100 * MBEDTLS_MPI_MAX_BITS ) +#define MBEDTLS_LN_2_DIV_LN_10_SCALE100 332 +#define MBEDTLS_MPI_RW_BUFFER_SIZE ( ((MBEDTLS_MPI_MAX_BITS_SCALE100 + MBEDTLS_LN_2_DIV_LN_10_SCALE100 - 1) / MBEDTLS_LN_2_DIV_LN_10_SCALE100) + 10 + 6 ) + +/* + * Define the base integer type, architecture-wise. + * + * 32 or 64-bit integer types can be forced regardless of the underlying + * architecture by defining MBEDTLS_HAVE_INT32 or MBEDTLS_HAVE_INT64 + * respectively and undefining MBEDTLS_HAVE_ASM. + * + * Double-width integers (e.g. 128-bit in 64-bit architectures) can be + * disabled by defining MBEDTLS_NO_UDBL_DIVISION. + */ +#if !defined(MBEDTLS_HAVE_INT32) + #if defined(_MSC_VER) && defined(_M_AMD64) + /* Always choose 64-bit when using MSC */ + #if !defined(MBEDTLS_HAVE_INT64) + #define MBEDTLS_HAVE_INT64 + #endif /* !MBEDTLS_HAVE_INT64 */ + typedef int64_t mbedtls_mpi_sint; + typedef uint64_t mbedtls_mpi_uint; + #elif defined(__GNUC__) && ( \ + defined(__amd64__) || defined(__x86_64__) || \ + defined(__ppc64__) || defined(__powerpc64__) || \ + defined(__ia64__) || defined(__alpha__) || \ + ( defined(__sparc__) && defined(__arch64__) ) || \ + defined(__s390x__) || defined(__mips64) || \ + defined(__aarch64__) ) + #if !defined(MBEDTLS_HAVE_INT64) + #define MBEDTLS_HAVE_INT64 + #endif /* MBEDTLS_HAVE_INT64 */ + typedef int64_t mbedtls_mpi_sint; + typedef uint64_t mbedtls_mpi_uint; + #if !defined(MBEDTLS_NO_UDBL_DIVISION) + /* mbedtls_t_udbl defined as 128-bit unsigned int */ + typedef unsigned int mbedtls_t_udbl __attribute__((mode(TI))); + #define MBEDTLS_HAVE_UDBL + #endif /* !MBEDTLS_NO_UDBL_DIVISION */ + #elif defined(__ARMCC_VERSION) && defined(__aarch64__) + /* + * __ARMCC_VERSION is defined for both armcc and armclang and + * __aarch64__ is only defined by armclang when compiling 64-bit code + */ + #if !defined(MBEDTLS_HAVE_INT64) + #define MBEDTLS_HAVE_INT64 + #endif /* !MBEDTLS_HAVE_INT64 */ + typedef int64_t mbedtls_mpi_sint; + typedef uint64_t mbedtls_mpi_uint; + #if !defined(MBEDTLS_NO_UDBL_DIVISION) + /* mbedtls_t_udbl defined as 128-bit unsigned int */ + typedef __uint128_t mbedtls_t_udbl; + #define MBEDTLS_HAVE_UDBL + #endif /* !MBEDTLS_NO_UDBL_DIVISION */ + #elif defined(MBEDTLS_HAVE_INT64) + /* Force 64-bit integers with unknown compiler */ + typedef int64_t mbedtls_mpi_sint; + typedef uint64_t mbedtls_mpi_uint; + #endif +#endif /* !MBEDTLS_HAVE_INT32 */ + +#if !defined(MBEDTLS_HAVE_INT64) + /* Default to 32-bit compilation */ + #if !defined(MBEDTLS_HAVE_INT32) + #define MBEDTLS_HAVE_INT32 + #endif /* !MBEDTLS_HAVE_INT32 */ + typedef int32_t mbedtls_mpi_sint; + typedef uint32_t mbedtls_mpi_uint; + #if !defined(MBEDTLS_NO_UDBL_DIVISION) + typedef uint64_t mbedtls_t_udbl; + #define MBEDTLS_HAVE_UDBL + #endif /* !MBEDTLS_NO_UDBL_DIVISION */ +#endif /* !MBEDTLS_HAVE_INT64 */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief MPI structure + */ +typedef struct mbedtls_mpi +{ + int s; /*!< Sign: -1 if the mpi is negative, 1 otherwise */ + size_t n; /*!< total # of limbs */ + mbedtls_mpi_uint *p; /*!< pointer to limbs */ +} +mbedtls_mpi; + +/** + * \brief Initialize an MPI context. + * + * This makes the MPI ready to be set or freed, + * but does not define a value for the MPI. + * + * \param X The MPI context to initialize. This must not be \c NULL. + */ +void mbedtls_mpi_init( mbedtls_mpi *X ); + +/** + * \brief This function frees the components of an MPI context. + * + * \param X The MPI context to be cleared. This may be \c NULL, + * in which case this function is a no-op. If it is + * not \c NULL, it must point to an initialized MPI. + */ +void mbedtls_mpi_free( mbedtls_mpi *X ); + +/** + * \brief Enlarge an MPI to the specified number of limbs. + * + * \note This function does nothing if the MPI is + * already large enough. + * + * \param X The MPI to grow. It must be initialized. + * \param nblimbs The target number of limbs. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_grow( mbedtls_mpi *X, size_t nblimbs ); + +/** + * \brief This function resizes an MPI downwards, keeping at least the + * specified number of limbs. + * + * If \c X is smaller than \c nblimbs, it is resized up + * instead. + * + * \param X The MPI to shrink. This must point to an initialized MPI. + * \param nblimbs The minimum number of limbs to keep. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed + * (this can only happen when resizing up). + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_shrink( mbedtls_mpi *X, size_t nblimbs ); + +/** + * \brief Make a copy of an MPI. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param Y The source MPI. This must point to an initialized MPI. + * + * \note The limb-buffer in the destination MPI is enlarged + * if necessary to hold the value in the source MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_copy( mbedtls_mpi *X, const mbedtls_mpi *Y ); + +/** + * \brief Swap the contents of two MPIs. + * + * \param X The first MPI. It must be initialized. + * \param Y The second MPI. It must be initialized. + */ +void mbedtls_mpi_swap( mbedtls_mpi *X, mbedtls_mpi *Y ); + +/** + * \brief Perform a safe conditional copy of MPI which doesn't + * reveal whether the condition was true or not. + * + * \param X The MPI to conditionally assign to. This must point + * to an initialized MPI. + * \param Y The MPI to be assigned from. This must point to an + * initialized MPI. + * \param assign The condition deciding whether to perform the + * assignment or not. Possible values: + * * \c 1: Perform the assignment `X = Y`. + * * \c 0: Keep the original value of \p X. + * + * \note This function is equivalent to + * `if( assign ) mbedtls_mpi_copy( X, Y );` + * except that it avoids leaking any information about whether + * the assignment was done or not (the above code may leak + * information through branch prediction and/or memory access + * patterns analysis). + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_safe_cond_assign( mbedtls_mpi *X, const mbedtls_mpi *Y, unsigned char assign ); + +/** + * \brief Perform a safe conditional swap which doesn't + * reveal whether the condition was true or not. + * + * \param X The first MPI. This must be initialized. + * \param Y The second MPI. This must be initialized. + * \param assign The condition deciding whether to perform + * the swap or not. Possible values: + * * \c 1: Swap the values of \p X and \p Y. + * * \c 0: Keep the original values of \p X and \p Y. + * + * \note This function is equivalent to + * if( assign ) mbedtls_mpi_swap( X, Y ); + * except that it avoids leaking any information about whether + * the assignment was done or not (the above code may leak + * information through branch prediction and/or memory access + * patterns analysis). + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + * + */ +int mbedtls_mpi_safe_cond_swap( mbedtls_mpi *X, mbedtls_mpi *Y, unsigned char assign ); + +/** + * \brief Store integer value in MPI. + * + * \param X The MPI to set. This must be initialized. + * \param z The value to use. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_lset( mbedtls_mpi *X, mbedtls_mpi_sint z ); + +/** + * \brief Get a specific bit from an MPI. + * + * \param X The MPI to query. This must be initialized. + * \param pos Zero-based index of the bit to query. + * + * \return \c 0 or \c 1 on success, depending on whether bit \c pos + * of \c X is unset or set. + * \return A negative error code on failure. + */ +int mbedtls_mpi_get_bit( const mbedtls_mpi *X, size_t pos ); + +/** + * \brief Modify a specific bit in an MPI. + * + * \note This function will grow the target MPI if necessary to set a + * bit to \c 1 in a not yet existing limb. It will not grow if + * the bit should be set to \c 0. + * + * \param X The MPI to modify. This must be initialized. + * \param pos Zero-based index of the bit to modify. + * \param val The desired value of bit \c pos: \c 0 or \c 1. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_set_bit( mbedtls_mpi *X, size_t pos, unsigned char val ); + +/** + * \brief Return the number of bits of value \c 0 before the + * least significant bit of value \c 1. + * + * \note This is the same as the zero-based index of + * the least significant bit of value \c 1. + * + * \param X The MPI to query. + * + * \return The number of bits of value \c 0 before the least significant + * bit of value \c 1 in \p X. + */ +size_t mbedtls_mpi_lsb( const mbedtls_mpi *X ); + +/** + * \brief Return the number of bits up to and including the most + * significant bit of value \c 1. + * + * * \note This is same as the one-based index of the most + * significant bit of value \c 1. + * + * \param X The MPI to query. This must point to an initialized MPI. + * + * \return The number of bits up to and including the most + * significant bit of value \c 1. + */ +size_t mbedtls_mpi_bitlen( const mbedtls_mpi *X ); + +/** + * \brief Return the total size of an MPI value in bytes. + * + * \param X The MPI to use. This must point to an initialized MPI. + * + * \note The value returned by this function may be less than + * the number of bytes used to store \p X internally. + * This happens if and only if there are trailing bytes + * of value zero. + * + * \return The least number of bytes capable of storing + * the absolute value of \p X. + */ +size_t mbedtls_mpi_size( const mbedtls_mpi *X ); + +/** + * \brief Import an MPI from an ASCII string. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param radix The numeric base of the input string. + * \param s Null-terminated string buffer. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_mpi_read_string( mbedtls_mpi *X, int radix, const char *s ); + +/** + * \brief Export an MPI to an ASCII string. + * + * \param X The source MPI. This must point to an initialized MPI. + * \param radix The numeric base of the output string. + * \param buf The buffer to write the string to. This must be writable + * buffer of length \p buflen Bytes. + * \param buflen The available size in Bytes of \p buf. + * \param olen The address at which to store the length of the string + * written, including the final \c NULL byte. This must + * not be \c NULL. + * + * \note You can call this function with `buflen == 0` to obtain the + * minimum required buffer size in `*olen`. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if the target buffer \p buf + * is too small to hold the value of \p X in the desired base. + * In this case, `*olen` is nonetheless updated to contain the + * size of \p buf required for a successful call. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_write_string( const mbedtls_mpi *X, int radix, + char *buf, size_t buflen, size_t *olen ); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief Read an MPI from a line in an opened file. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param radix The numeric base of the string representation used + * in the source line. + * \param fin The input file handle to use. This must not be \c NULL. + * + * \note On success, this function advances the file stream + * to the end of the current line or to EOF. + * + * The function returns \c 0 on an empty line. + * + * Leading whitespaces are ignored, as is a + * '0x' prefix for radix \c 16. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if the file read buffer + * is too small. + * \return Another negative error code on failure. + */ +int mbedtls_mpi_read_file( mbedtls_mpi *X, int radix, FILE *fin ); + +/** + * \brief Export an MPI into an opened file. + * + * \param p A string prefix to emit prior to the MPI data. + * For example, this might be a label, or "0x" when + * printing in base \c 16. This may be \c NULL if no prefix + * is needed. + * \param X The source MPI. This must point to an initialized MPI. + * \param radix The numeric base to be used in the emitted string. + * \param fout The output file handle. This may be \c NULL, in which case + * the output is written to \c stdout. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_mpi_write_file( const char *p, const mbedtls_mpi *X, + int radix, FILE *fout ); +#endif /* MBEDTLS_FS_IO */ + +/** + * \brief Import an MPI from unsigned big endian binary data. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param buf The input buffer. This must be a readable buffer of length + * \p buflen Bytes. + * \param buflen The length of the input buffer \p p in Bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_read_binary( mbedtls_mpi *X, const unsigned char *buf, + size_t buflen ); + +/** + * \brief Import X from unsigned binary data, little endian + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param buf The input buffer. This must be a readable buffer of length + * \p buflen Bytes. + * \param buflen The length of the input buffer \p p in Bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_read_binary_le( mbedtls_mpi *X, + const unsigned char *buf, size_t buflen ); + +/** + * \brief Export X into unsigned binary data, big endian. + * Always fills the whole buffer, which will start with zeros + * if the number is smaller. + * + * \param X The source MPI. This must point to an initialized MPI. + * \param buf The output buffer. This must be a writable buffer of length + * \p buflen Bytes. + * \param buflen The size of the output buffer \p buf in Bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if \p buf isn't + * large enough to hold the value of \p X. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_write_binary( const mbedtls_mpi *X, unsigned char *buf, + size_t buflen ); + +/** + * \brief Export X into unsigned binary data, little endian. + * Always fills the whole buffer, which will end with zeros + * if the number is smaller. + * + * \param X The source MPI. This must point to an initialized MPI. + * \param buf The output buffer. This must be a writable buffer of length + * \p buflen Bytes. + * \param buflen The size of the output buffer \p buf in Bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if \p buf isn't + * large enough to hold the value of \p X. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_write_binary_le( const mbedtls_mpi *X, + unsigned char *buf, size_t buflen ); + +/** + * \brief Perform a left-shift on an MPI: X <<= count + * + * \param X The MPI to shift. This must point to an initialized MPI. + * \param count The number of bits to shift by. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_shift_l( mbedtls_mpi *X, size_t count ); + +/** + * \brief Perform a right-shift on an MPI: X >>= count + * + * \param X The MPI to shift. This must point to an initialized MPI. + * \param count The number of bits to shift by. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_shift_r( mbedtls_mpi *X, size_t count ); + +/** + * \brief Compare the absolute values of two MPIs. + * + * \param X The left-hand MPI. This must point to an initialized MPI. + * \param Y The right-hand MPI. This must point to an initialized MPI. + * + * \return \c 1 if `|X|` is greater than `|Y|`. + * \return \c -1 if `|X|` is lesser than `|Y|`. + * \return \c 0 if `|X|` is equal to `|Y|`. + */ +int mbedtls_mpi_cmp_abs( const mbedtls_mpi *X, const mbedtls_mpi *Y ); + +/** + * \brief Compare two MPIs. + * + * \param X The left-hand MPI. This must point to an initialized MPI. + * \param Y The right-hand MPI. This must point to an initialized MPI. + * + * \return \c 1 if \p X is greater than \p Y. + * \return \c -1 if \p X is lesser than \p Y. + * \return \c 0 if \p X is equal to \p Y. + */ +int mbedtls_mpi_cmp_mpi( const mbedtls_mpi *X, const mbedtls_mpi *Y ); + +/** + * \brief Check if an MPI is less than the other in constant time. + * + * \param X The left-hand MPI. This must point to an initialized MPI + * with the same allocated length as Y. + * \param Y The right-hand MPI. This must point to an initialized MPI + * with the same allocated length as X. + * \param ret The result of the comparison: + * \c 1 if \p X is less than \p Y. + * \c 0 if \p X is greater than or equal to \p Y. + * + * \return 0 on success. + * \return MBEDTLS_ERR_MPI_BAD_INPUT_DATA if the allocated length of + * the two input MPIs is not the same. + */ +int mbedtls_mpi_lt_mpi_ct( const mbedtls_mpi *X, const mbedtls_mpi *Y, + unsigned *ret ); + +/** + * \brief Compare an MPI with an integer. + * + * \param X The left-hand MPI. This must point to an initialized MPI. + * \param z The integer value to compare \p X to. + * + * \return \c 1 if \p X is greater than \p z. + * \return \c -1 if \p X is lesser than \p z. + * \return \c 0 if \p X is equal to \p z. + */ +int mbedtls_mpi_cmp_int( const mbedtls_mpi *X, mbedtls_mpi_sint z ); + +/** + * \brief Perform an unsigned addition of MPIs: X = |A| + |B| + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The first summand. This must point to an initialized MPI. + * \param B The second summand. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_add_abs( mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *B ); + +/** + * \brief Perform an unsigned subtraction of MPIs: X = |A| - |B| + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The minuend. This must point to an initialized MPI. + * \param B The subtrahend. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_NEGATIVE_VALUE if \p B is greater than \p A. + * \return Another negative error code on different kinds of failure. + * + */ +int mbedtls_mpi_sub_abs( mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *B ); + +/** + * \brief Perform a signed addition of MPIs: X = A + B + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The first summand. This must point to an initialized MPI. + * \param B The second summand. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_add_mpi( mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *B ); + +/** + * \brief Perform a signed subtraction of MPIs: X = A - B + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The minuend. This must point to an initialized MPI. + * \param B The subtrahend. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_sub_mpi( mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *B ); + +/** + * \brief Perform a signed addition of an MPI and an integer: X = A + b + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The first summand. This must point to an initialized MPI. + * \param b The second summand. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_add_int( mbedtls_mpi *X, const mbedtls_mpi *A, + mbedtls_mpi_sint b ); + +/** + * \brief Perform a signed subtraction of an MPI and an integer: + * X = A - b + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The minuend. This must point to an initialized MPI. + * \param b The subtrahend. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_sub_int( mbedtls_mpi *X, const mbedtls_mpi *A, + mbedtls_mpi_sint b ); + +/** + * \brief Perform a multiplication of two MPIs: X = A * B + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The first factor. This must point to an initialized MPI. + * \param B The second factor. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + * + */ +int mbedtls_mpi_mul_mpi( mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *B ); + +/** + * \brief Perform a multiplication of an MPI with an unsigned integer: + * X = A * b + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The first factor. This must point to an initialized MPI. + * \param b The second factor. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + * + */ +int mbedtls_mpi_mul_int( mbedtls_mpi *X, const mbedtls_mpi *A, + mbedtls_mpi_uint b ); + +/** + * \brief Perform a division with remainder of two MPIs: + * A = Q * B + R + * + * \param Q The destination MPI for the quotient. + * This may be \c NULL if the value of the + * quotient is not needed. + * \param R The destination MPI for the remainder value. + * This may be \c NULL if the value of the + * remainder is not needed. + * \param A The dividend. This must point to an initialized MPi. + * \param B The divisor. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p B equals zero. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_div_mpi( mbedtls_mpi *Q, mbedtls_mpi *R, const mbedtls_mpi *A, + const mbedtls_mpi *B ); + +/** + * \brief Perform a division with remainder of an MPI by an integer: + * A = Q * b + R + * + * \param Q The destination MPI for the quotient. + * This may be \c NULL if the value of the + * quotient is not needed. + * \param R The destination MPI for the remainder value. + * This may be \c NULL if the value of the + * remainder is not needed. + * \param A The dividend. This must point to an initialized MPi. + * \param b The divisor. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p b equals zero. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_div_int( mbedtls_mpi *Q, mbedtls_mpi *R, const mbedtls_mpi *A, + mbedtls_mpi_sint b ); + +/** + * \brief Perform a modular reduction. R = A mod B + * + * \param R The destination MPI for the residue value. + * This must point to an initialized MPI. + * \param A The MPI to compute the residue of. + * This must point to an initialized MPI. + * \param B The base of the modular reduction. + * This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p B equals zero. + * \return #MBEDTLS_ERR_MPI_NEGATIVE_VALUE if \p B is negative. + * \return Another negative error code on different kinds of failure. + * + */ +int mbedtls_mpi_mod_mpi( mbedtls_mpi *R, const mbedtls_mpi *A, + const mbedtls_mpi *B ); + +/** + * \brief Perform a modular reduction with respect to an integer. + * r = A mod b + * + * \param r The address at which to store the residue. + * This must not be \c NULL. + * \param A The MPI to compute the residue of. + * This must point to an initialized MPi. + * \param b The integer base of the modular reduction. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p b equals zero. + * \return #MBEDTLS_ERR_MPI_NEGATIVE_VALUE if \p b is negative. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_mod_int( mbedtls_mpi_uint *r, const mbedtls_mpi *A, + mbedtls_mpi_sint b ); + +/** + * \brief Perform a sliding-window exponentiation: X = A^E mod N + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The base of the exponentiation. + * This must point to an initialized MPI. + * \param E The exponent MPI. This must point to an initialized MPI. + * \param N The base for the modular reduction. This must point to an + * initialized MPI. + * \param prec_RR A helper MPI depending solely on \p N which can be used to + * speed-up multiple modular exponentiations for the same value + * of \p N. This may be \c NULL. If it is not \c NULL, it must + * point to an initialized MPI. If it hasn't been used after + * the call to mbedtls_mpi_init(), this function will compute + * the helper value and store it in \p prec_RR for reuse on + * subsequent calls to this function. Otherwise, the function + * will assume that \p prec_RR holds the helper value set by a + * previous call to mbedtls_mpi_exp_mod(), and reuse it. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \c N is negative or + * even, or if \c E is negative. + * \return Another negative error code on different kinds of failures. + * + */ +int mbedtls_mpi_exp_mod( mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *E, const mbedtls_mpi *N, + mbedtls_mpi *prec_RR ); + +/** + * \brief Fill an MPI with a number of random bytes. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param size The number of random bytes to generate. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on failure. + * + * \note The bytes obtained from the RNG are interpreted + * as a big-endian representation of an MPI; this can + * be relevant in applications like deterministic ECDSA. + */ +int mbedtls_mpi_fill_random( mbedtls_mpi *X, size_t size, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** Generate a random number uniformly in a range. + * + * This function generates a random number between \p min inclusive and + * \p N exclusive. + * + * The procedure complies with RFC 6979 §3.3 (deterministic ECDSA) + * when the RNG is a suitably parametrized instance of HMAC_DRBG + * and \p min is \c 1. + * + * \note There are `N - min` possible outputs. The lower bound + * \p min can be reached, but the upper bound \p N cannot. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param min The minimum value to return. + * It must be nonnegative. + * \param N The upper bound of the range, exclusive. + * In other words, this is one plus the maximum value to return. + * \p N must be strictly larger than \p min. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p min or \p N is invalid + * or if they are incompatible. + * \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if the implementation was + * unable to find a suitable value within a limited number + * of attempts. This has a negligible probability if \p N + * is significantly larger than \p min, which is the case + * for all usual cryptographic applications. + * \return Another negative error code on failure. + */ +int mbedtls_mpi_random( mbedtls_mpi *X, + mbedtls_mpi_sint min, + const mbedtls_mpi *N, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief Compute the greatest common divisor: G = gcd(A, B) + * + * \param G The destination MPI. This must point to an initialized MPI. + * \param A The first operand. This must point to an initialized MPI. + * \param B The second operand. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_gcd( mbedtls_mpi *G, const mbedtls_mpi *A, + const mbedtls_mpi *B ); + +/** + * \brief Compute the modular inverse: X = A^-1 mod N + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The MPI to calculate the modular inverse of. This must point + * to an initialized MPI. + * \param N The base of the modular inversion. This must point to an + * initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p N is less than + * or equal to one. + * \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p has no modular inverse + * with respect to \p N. + */ +int mbedtls_mpi_inv_mod( mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *N ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief Perform a Miller-Rabin primality test with error + * probability of 2-80. + * + * \deprecated Superseded by mbedtls_mpi_is_prime_ext() which allows + * specifying the number of Miller-Rabin rounds. + * + * \param X The MPI to check for primality. + * This must point to an initialized MPI. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. + * This may be \c NULL if \p f_rng doesn't use a + * context parameter. + * + * \return \c 0 if successful, i.e. \p X is probably prime. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p X is not prime. + * \return Another negative error code on other kinds of failure. + */ +MBEDTLS_DEPRECATED int mbedtls_mpi_is_prime( const mbedtls_mpi *X, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief Miller-Rabin primality test. + * + * \warning If \p X is potentially generated by an adversary, for example + * when validating cryptographic parameters that you didn't + * generate yourself and that are supposed to be prime, then + * \p rounds should be at least the half of the security + * strength of the cryptographic algorithm. On the other hand, + * if \p X is chosen uniformly or non-adversarially (as is the + * case when mbedtls_mpi_gen_prime calls this function), then + * \p rounds can be much lower. + * + * \param X The MPI to check for primality. + * This must point to an initialized MPI. + * \param rounds The number of bases to perform the Miller-Rabin primality + * test for. The probability of returning 0 on a composite is + * at most 2-2*\p rounds. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. + * This may be \c NULL if \p f_rng doesn't use + * a context parameter. + * + * \return \c 0 if successful, i.e. \p X is probably prime. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p X is not prime. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_is_prime_ext( const mbedtls_mpi *X, int rounds, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); +/** + * \brief Flags for mbedtls_mpi_gen_prime() + * + * Each of these flags is a constraint on the result X returned by + * mbedtls_mpi_gen_prime(). + */ +typedef enum { + MBEDTLS_MPI_GEN_PRIME_FLAG_DH = 0x0001, /**< (X-1)/2 is prime too */ + MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR = 0x0002, /**< lower error rate from 2-80 to 2-128 */ +} mbedtls_mpi_gen_prime_flag_t; + +/** + * \brief Generate a prime number. + * + * \param X The destination MPI to store the generated prime in. + * This must point to an initialized MPi. + * \param nbits The required size of the destination MPI in bits. + * This must be between \c 3 and #MBEDTLS_MPI_MAX_BITS. + * \param flags A mask of flags of type #mbedtls_mpi_gen_prime_flag_t. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. + * This may be \c NULL if \p f_rng doesn't use + * a context parameter. + * + * \return \c 0 if successful, in which case \p X holds a + * probably prime number. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if `nbits` is not between + * \c 3 and #MBEDTLS_MPI_MAX_BITS. + */ +int mbedtls_mpi_gen_prime( mbedtls_mpi *X, size_t nbits, int flags, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_mpi_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* bignum.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/blowfish.h b/openharmony/arm64-v8a/include/mbedtls/blowfish.h new file mode 100644 index 00000000..d5f80992 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/blowfish.h @@ -0,0 +1,288 @@ +/** + * \file blowfish.h + * + * \brief Blowfish block cipher + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_BLOWFISH_H +#define MBEDTLS_BLOWFISH_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +#include "mbedtls/platform_util.h" + +#define MBEDTLS_BLOWFISH_ENCRYPT 1 +#define MBEDTLS_BLOWFISH_DECRYPT 0 +#define MBEDTLS_BLOWFISH_MAX_KEY_BITS 448 +#define MBEDTLS_BLOWFISH_MIN_KEY_BITS 32 +#define MBEDTLS_BLOWFISH_ROUNDS 16 /**< Rounds to use. When increasing this value, make sure to extend the initialisation vectors */ +#define MBEDTLS_BLOWFISH_BLOCKSIZE 8 /* Blowfish uses 64 bit blocks */ + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#define MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( -0x0016 ) +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ +/** Bad input data. */ +#define MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA -0x0016 + +/** Invalid data input length. */ +#define MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH -0x0018 + +/* MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED is deprecated and should not be used. + */ +/** Blowfish hardware accelerator failed. */ +#define MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED -0x0017 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_BLOWFISH_ALT) +// Regular implementation +// + +/** + * \brief Blowfish context structure + */ +typedef struct mbedtls_blowfish_context +{ + uint32_t P[MBEDTLS_BLOWFISH_ROUNDS + 2]; /*!< Blowfish round keys */ + uint32_t S[4][256]; /*!< key dependent S-boxes */ +} +mbedtls_blowfish_context; + +#else /* MBEDTLS_BLOWFISH_ALT */ +#include "blowfish_alt.h" +#endif /* MBEDTLS_BLOWFISH_ALT */ + +/** + * \brief Initialize a Blowfish context. + * + * \param ctx The Blowfish context to be initialized. + * This must not be \c NULL. + */ +void mbedtls_blowfish_init( mbedtls_blowfish_context *ctx ); + +/** + * \brief Clear a Blowfish context. + * + * \param ctx The Blowfish context to be cleared. + * This may be \c NULL, in which case this function + * returns immediately. If it is not \c NULL, it must + * point to an initialized Blowfish context. + */ +void mbedtls_blowfish_free( mbedtls_blowfish_context *ctx ); + +/** + * \brief Perform a Blowfish key schedule operation. + * + * \param ctx The Blowfish context to perform the key schedule on. + * \param key The encryption key. This must be a readable buffer of + * length \p keybits Bits. + * \param keybits The length of \p key in Bits. This must be between + * \c 32 and \c 448 and a multiple of \c 8. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_blowfish_setkey( mbedtls_blowfish_context *ctx, const unsigned char *key, + unsigned int keybits ); + +/** + * \brief Perform a Blowfish-ECB block encryption/decryption operation. + * + * \param ctx The Blowfish context to use. This must be initialized + * and bound to a key. + * \param mode The mode of operation. Possible values are + * #MBEDTLS_BLOWFISH_ENCRYPT for encryption, or + * #MBEDTLS_BLOWFISH_DECRYPT for decryption. + * \param input The input block. This must be a readable buffer + * of size \c 8 Bytes. + * \param output The output block. This must be a writable buffer + * of size \c 8 Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_blowfish_crypt_ecb( mbedtls_blowfish_context *ctx, + int mode, + const unsigned char input[MBEDTLS_BLOWFISH_BLOCKSIZE], + unsigned char output[MBEDTLS_BLOWFISH_BLOCKSIZE] ); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief Perform a Blowfish-CBC buffer encryption/decryption operation. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the function same function again on the following + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If on the other hand you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * \param ctx The Blowfish context to use. This must be initialized + * and bound to a key. + * \param mode The mode of operation. Possible values are + * #MBEDTLS_BLOWFISH_ENCRYPT for encryption, or + * #MBEDTLS_BLOWFISH_DECRYPT for decryption. + * \param length The length of the input data in Bytes. This must be + * multiple of \c 8. + * \param iv The initialization vector. This must be a read/write buffer + * of length \c 8 Bytes. It is updated by this function. + * \param input The input data. This must be a readable buffer of length + * \p length Bytes. + * \param output The output data. This must be a writable buffer of length + * \p length Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_blowfish_crypt_cbc( mbedtls_blowfish_context *ctx, + int mode, + size_t length, + unsigned char iv[MBEDTLS_BLOWFISH_BLOCKSIZE], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +#if defined(MBEDTLS_CIPHER_MODE_CFB) +/** + * \brief Perform a Blowfish CFB buffer encryption/decryption operation. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the function same function again on the following + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If on the other hand you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * \param ctx The Blowfish context to use. This must be initialized + * and bound to a key. + * \param mode The mode of operation. Possible values are + * #MBEDTLS_BLOWFISH_ENCRYPT for encryption, or + * #MBEDTLS_BLOWFISH_DECRYPT for decryption. + * \param length The length of the input data in Bytes. + * \param iv_off The offset in the initialization vector. + * The value pointed to must be smaller than \c 8 Bytes. + * It is updated by this function to support the aforementioned + * streaming usage. + * \param iv The initialization vector. This must be a read/write buffer + * of size \c 8 Bytes. It is updated after use. + * \param input The input data. This must be a readable buffer of length + * \p length Bytes. + * \param output The output data. This must be a writable buffer of length + * \p length Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_blowfish_crypt_cfb64( mbedtls_blowfish_context *ctx, + int mode, + size_t length, + size_t *iv_off, + unsigned char iv[MBEDTLS_BLOWFISH_BLOCKSIZE], + const unsigned char *input, + unsigned char *output ); +#endif /*MBEDTLS_CIPHER_MODE_CFB */ + +#if defined(MBEDTLS_CIPHER_MODE_CTR) +/** + * \brief Perform a Blowfish-CTR buffer encryption/decryption operation. + * + * \warning You must never reuse a nonce value with the same key. Doing so + * would void the encryption for the two messages encrypted with + * the same nonce and key. + * + * There are two common strategies for managing nonces with CTR: + * + * 1. You can handle everything as a single message processed over + * successive calls to this function. In that case, you want to + * set \p nonce_counter and \p nc_off to 0 for the first call, and + * then preserve the values of \p nonce_counter, \p nc_off and \p + * stream_block across calls to this function as they will be + * updated by this function. + * + * With this strategy, you must not encrypt more than 2**64 + * blocks of data with the same key. + * + * 2. You can encrypt separate messages by dividing the \p + * nonce_counter buffer in two areas: the first one used for a + * per-message nonce, handled by yourself, and the second one + * updated by this function internally. + * + * For example, you might reserve the first 4 bytes for the + * per-message nonce, and the last 4 bytes for internal use. In that + * case, before calling this function on a new message you need to + * set the first 4 bytes of \p nonce_counter to your chosen nonce + * value, the last 4 to 0, and \p nc_off to 0 (which will cause \p + * stream_block to be ignored). That way, you can encrypt at most + * 2**32 messages of up to 2**32 blocks each with the same key. + * + * The per-message nonce (or information sufficient to reconstruct + * it) needs to be communicated with the ciphertext and must be unique. + * The recommended way to ensure uniqueness is to use a message + * counter. + * + * Note that for both strategies, sizes are measured in blocks and + * that a Blowfish block is 8 bytes. + * + * \warning Upon return, \p stream_block contains sensitive data. Its + * content must not be written to insecure storage and should be + * securely discarded as soon as it's no longer needed. + * + * \param ctx The Blowfish context to use. This must be initialized + * and bound to a key. + * \param length The length of the input data in Bytes. + * \param nc_off The offset in the current stream_block (for resuming + * within current cipher stream). The offset pointer + * should be \c 0 at the start of a stream and must be + * smaller than \c 8. It is updated by this function. + * \param nonce_counter The 64-bit nonce and counter. This must point to a + * read/write buffer of length \c 8 Bytes. + * \param stream_block The saved stream-block for resuming. This must point to + * a read/write buffer of length \c 8 Bytes. + * \param input The input data. This must be a readable buffer of + * length \p length Bytes. + * \param output The output data. This must be a writable buffer of + * length \p length Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_blowfish_crypt_ctr( mbedtls_blowfish_context *ctx, + size_t length, + size_t *nc_off, + unsigned char nonce_counter[MBEDTLS_BLOWFISH_BLOCKSIZE], + unsigned char stream_block[MBEDTLS_BLOWFISH_BLOCKSIZE], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CTR */ + +#ifdef __cplusplus +} +#endif + +#endif /* blowfish.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/bn_mul.h b/openharmony/arm64-v8a/include/mbedtls/bn_mul.h new file mode 100644 index 00000000..31137cd4 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/bn_mul.h @@ -0,0 +1,978 @@ +/** + * \file bn_mul.h + * + * \brief Multi-precision integer library + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * Multiply source vector [s] with b, add result + * to destination vector [d] and set carry c. + * + * Currently supports: + * + * . IA-32 (386+) . AMD64 / EM64T + * . IA-32 (SSE2) . Motorola 68000 + * . PowerPC, 32-bit . MicroBlaze + * . PowerPC, 64-bit . TriCore + * . SPARC v8 . ARM v3+ + * . Alpha . MIPS32 + * . C, longlong . C, generic + */ +#ifndef MBEDTLS_BN_MUL_H +#define MBEDTLS_BN_MUL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/bignum.h" + + +/* + * Conversion macros for embedded constants: + * build lists of mbedtls_mpi_uint's from lists of unsigned char's grouped by 8, 4 or 2 + */ +#if defined(MBEDTLS_HAVE_INT32) + +#define MBEDTLS_BYTES_TO_T_UINT_4( a, b, c, d ) \ + ( (mbedtls_mpi_uint) (a) << 0 ) | \ + ( (mbedtls_mpi_uint) (b) << 8 ) | \ + ( (mbedtls_mpi_uint) (c) << 16 ) | \ + ( (mbedtls_mpi_uint) (d) << 24 ) + +#define MBEDTLS_BYTES_TO_T_UINT_2( a, b ) \ + MBEDTLS_BYTES_TO_T_UINT_4( a, b, 0, 0 ) + +#define MBEDTLS_BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \ + MBEDTLS_BYTES_TO_T_UINT_4( a, b, c, d ), \ + MBEDTLS_BYTES_TO_T_UINT_4( e, f, g, h ) + +#else /* 64-bits */ + +#define MBEDTLS_BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \ + ( (mbedtls_mpi_uint) (a) << 0 ) | \ + ( (mbedtls_mpi_uint) (b) << 8 ) | \ + ( (mbedtls_mpi_uint) (c) << 16 ) | \ + ( (mbedtls_mpi_uint) (d) << 24 ) | \ + ( (mbedtls_mpi_uint) (e) << 32 ) | \ + ( (mbedtls_mpi_uint) (f) << 40 ) | \ + ( (mbedtls_mpi_uint) (g) << 48 ) | \ + ( (mbedtls_mpi_uint) (h) << 56 ) + +#define MBEDTLS_BYTES_TO_T_UINT_4( a, b, c, d ) \ + MBEDTLS_BYTES_TO_T_UINT_8( a, b, c, d, 0, 0, 0, 0 ) + +#define MBEDTLS_BYTES_TO_T_UINT_2( a, b ) \ + MBEDTLS_BYTES_TO_T_UINT_8( a, b, 0, 0, 0, 0, 0, 0 ) + +#endif /* bits in mbedtls_mpi_uint */ + +#if defined(MBEDTLS_HAVE_ASM) + +#ifndef asm +#define asm __asm +#endif + +/* armcc5 --gnu defines __GNUC__ but doesn't support GNU's extended asm */ +#if defined(__GNUC__) && \ + ( !defined(__ARMCC_VERSION) || __ARMCC_VERSION >= 6000000 ) + +/* + * Disable use of the i386 assembly code below if option -O0, to disable all + * compiler optimisations, is passed, detected with __OPTIMIZE__ + * This is done as the number of registers used in the assembly code doesn't + * work with the -O0 option. + */ +#if defined(__i386__) && defined(__OPTIMIZE__) + +#define MULADDC_INIT \ + asm( \ + "movl %%ebx, %0 \n\t" \ + "movl %5, %%esi \n\t" \ + "movl %6, %%edi \n\t" \ + "movl %7, %%ecx \n\t" \ + "movl %8, %%ebx \n\t" + +#define MULADDC_CORE \ + "lodsl \n\t" \ + "mull %%ebx \n\t" \ + "addl %%ecx, %%eax \n\t" \ + "adcl $0, %%edx \n\t" \ + "addl (%%edi), %%eax \n\t" \ + "adcl $0, %%edx \n\t" \ + "movl %%edx, %%ecx \n\t" \ + "stosl \n\t" + +#if defined(MBEDTLS_HAVE_SSE2) + +#define MULADDC_HUIT \ + "movd %%ecx, %%mm1 \n\t" \ + "movd %%ebx, %%mm0 \n\t" \ + "movd (%%edi), %%mm3 \n\t" \ + "paddq %%mm3, %%mm1 \n\t" \ + "movd (%%esi), %%mm2 \n\t" \ + "pmuludq %%mm0, %%mm2 \n\t" \ + "movd 4(%%esi), %%mm4 \n\t" \ + "pmuludq %%mm0, %%mm4 \n\t" \ + "movd 8(%%esi), %%mm6 \n\t" \ + "pmuludq %%mm0, %%mm6 \n\t" \ + "movd 12(%%esi), %%mm7 \n\t" \ + "pmuludq %%mm0, %%mm7 \n\t" \ + "paddq %%mm2, %%mm1 \n\t" \ + "movd 4(%%edi), %%mm3 \n\t" \ + "paddq %%mm4, %%mm3 \n\t" \ + "movd 8(%%edi), %%mm5 \n\t" \ + "paddq %%mm6, %%mm5 \n\t" \ + "movd 12(%%edi), %%mm4 \n\t" \ + "paddq %%mm4, %%mm7 \n\t" \ + "movd %%mm1, (%%edi) \n\t" \ + "movd 16(%%esi), %%mm2 \n\t" \ + "pmuludq %%mm0, %%mm2 \n\t" \ + "psrlq $32, %%mm1 \n\t" \ + "movd 20(%%esi), %%mm4 \n\t" \ + "pmuludq %%mm0, %%mm4 \n\t" \ + "paddq %%mm3, %%mm1 \n\t" \ + "movd 24(%%esi), %%mm6 \n\t" \ + "pmuludq %%mm0, %%mm6 \n\t" \ + "movd %%mm1, 4(%%edi) \n\t" \ + "psrlq $32, %%mm1 \n\t" \ + "movd 28(%%esi), %%mm3 \n\t" \ + "pmuludq %%mm0, %%mm3 \n\t" \ + "paddq %%mm5, %%mm1 \n\t" \ + "movd 16(%%edi), %%mm5 \n\t" \ + "paddq %%mm5, %%mm2 \n\t" \ + "movd %%mm1, 8(%%edi) \n\t" \ + "psrlq $32, %%mm1 \n\t" \ + "paddq %%mm7, %%mm1 \n\t" \ + "movd 20(%%edi), %%mm5 \n\t" \ + "paddq %%mm5, %%mm4 \n\t" \ + "movd %%mm1, 12(%%edi) \n\t" \ + "psrlq $32, %%mm1 \n\t" \ + "paddq %%mm2, %%mm1 \n\t" \ + "movd 24(%%edi), %%mm5 \n\t" \ + "paddq %%mm5, %%mm6 \n\t" \ + "movd %%mm1, 16(%%edi) \n\t" \ + "psrlq $32, %%mm1 \n\t" \ + "paddq %%mm4, %%mm1 \n\t" \ + "movd 28(%%edi), %%mm5 \n\t" \ + "paddq %%mm5, %%mm3 \n\t" \ + "movd %%mm1, 20(%%edi) \n\t" \ + "psrlq $32, %%mm1 \n\t" \ + "paddq %%mm6, %%mm1 \n\t" \ + "movd %%mm1, 24(%%edi) \n\t" \ + "psrlq $32, %%mm1 \n\t" \ + "paddq %%mm3, %%mm1 \n\t" \ + "movd %%mm1, 28(%%edi) \n\t" \ + "addl $32, %%edi \n\t" \ + "addl $32, %%esi \n\t" \ + "psrlq $32, %%mm1 \n\t" \ + "movd %%mm1, %%ecx \n\t" + +#define MULADDC_STOP \ + "emms \n\t" \ + "movl %4, %%ebx \n\t" \ + "movl %%ecx, %1 \n\t" \ + "movl %%edi, %2 \n\t" \ + "movl %%esi, %3 \n\t" \ + : "=m" (t), "=m" (c), "=m" (d), "=m" (s) \ + : "m" (t), "m" (s), "m" (d), "m" (c), "m" (b) \ + : "eax", "ebx", "ecx", "edx", "esi", "edi" \ + ); + +#else + +#define MULADDC_STOP \ + "movl %4, %%ebx \n\t" \ + "movl %%ecx, %1 \n\t" \ + "movl %%edi, %2 \n\t" \ + "movl %%esi, %3 \n\t" \ + : "=m" (t), "=m" (c), "=m" (d), "=m" (s) \ + : "m" (t), "m" (s), "m" (d), "m" (c), "m" (b) \ + : "eax", "ebx", "ecx", "edx", "esi", "edi" \ + ); +#endif /* SSE2 */ +#endif /* i386 */ + +#if defined(__amd64__) || defined (__x86_64__) + +#define MULADDC_INIT \ + asm( \ + "xorq %%r8, %%r8\n" + +#define MULADDC_CORE \ + "movq (%%rsi), %%rax\n" \ + "mulq %%rbx\n" \ + "addq $8, %%rsi\n" \ + "addq %%rcx, %%rax\n" \ + "movq %%r8, %%rcx\n" \ + "adcq $0, %%rdx\n" \ + "nop \n" \ + "addq %%rax, (%%rdi)\n" \ + "adcq %%rdx, %%rcx\n" \ + "addq $8, %%rdi\n" + +#define MULADDC_STOP \ + : "+c" (c), "+D" (d), "+S" (s), "+m" (*(uint64_t (*)[16]) d) \ + : "b" (b), "m" (*(const uint64_t (*)[16]) s) \ + : "rax", "rdx", "r8" \ + ); + +#endif /* AMD64 */ + +#if defined(__aarch64__) + +#define MULADDC_INIT \ + asm( + +#define MULADDC_CORE \ + "ldr x4, [%2], #8 \n\t" \ + "ldr x5, [%1] \n\t" \ + "mul x6, x4, %4 \n\t" \ + "umulh x7, x4, %4 \n\t" \ + "adds x5, x5, x6 \n\t" \ + "adc x7, x7, xzr \n\t" \ + "adds x5, x5, %0 \n\t" \ + "adc %0, x7, xzr \n\t" \ + "str x5, [%1], #8 \n\t" + +#define MULADDC_STOP \ + : "+r" (c), "+r" (d), "+r" (s), "+m" (*(uint64_t (*)[16]) d) \ + : "r" (b), "m" (*(const uint64_t (*)[16]) s) \ + : "x4", "x5", "x6", "x7", "cc" \ + ); + +#endif /* Aarch64 */ + +#if defined(__mc68020__) || defined(__mcpu32__) + +#define MULADDC_INIT \ + asm( \ + "movl %3, %%a2 \n\t" \ + "movl %4, %%a3 \n\t" \ + "movl %5, %%d3 \n\t" \ + "movl %6, %%d2 \n\t" \ + "moveq #0, %%d0 \n\t" + +#define MULADDC_CORE \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d4:%%d1 \n\t" \ + "addl %%d3, %%d1 \n\t" \ + "addxl %%d0, %%d4 \n\t" \ + "moveq #0, %%d3 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "addxl %%d4, %%d3 \n\t" + +#define MULADDC_STOP \ + "movl %%d3, %0 \n\t" \ + "movl %%a3, %1 \n\t" \ + "movl %%a2, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "d0", "d1", "d2", "d3", "d4", "a2", "a3" \ + ); + +#define MULADDC_HUIT \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d4:%%d1 \n\t" \ + "addxl %%d3, %%d1 \n\t" \ + "addxl %%d0, %%d4 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d3:%%d1 \n\t" \ + "addxl %%d4, %%d1 \n\t" \ + "addxl %%d0, %%d3 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d4:%%d1 \n\t" \ + "addxl %%d3, %%d1 \n\t" \ + "addxl %%d0, %%d4 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d3:%%d1 \n\t" \ + "addxl %%d4, %%d1 \n\t" \ + "addxl %%d0, %%d3 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d4:%%d1 \n\t" \ + "addxl %%d3, %%d1 \n\t" \ + "addxl %%d0, %%d4 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d3:%%d1 \n\t" \ + "addxl %%d4, %%d1 \n\t" \ + "addxl %%d0, %%d3 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d4:%%d1 \n\t" \ + "addxl %%d3, %%d1 \n\t" \ + "addxl %%d0, %%d4 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d3:%%d1 \n\t" \ + "addxl %%d4, %%d1 \n\t" \ + "addxl %%d0, %%d3 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "addxl %%d0, %%d3 \n\t" + +#endif /* MC68000 */ + +#if defined(__powerpc64__) || defined(__ppc64__) + +#if defined(__MACH__) && defined(__APPLE__) + +#define MULADDC_INIT \ + asm( \ + "ld r3, %3 \n\t" \ + "ld r4, %4 \n\t" \ + "ld r5, %5 \n\t" \ + "ld r6, %6 \n\t" \ + "addi r3, r3, -8 \n\t" \ + "addi r4, r4, -8 \n\t" \ + "addic r5, r5, 0 \n\t" + +#define MULADDC_CORE \ + "ldu r7, 8(r3) \n\t" \ + "mulld r8, r7, r6 \n\t" \ + "mulhdu r9, r7, r6 \n\t" \ + "adde r8, r8, r5 \n\t" \ + "ld r7, 8(r4) \n\t" \ + "addze r5, r9 \n\t" \ + "addc r8, r8, r7 \n\t" \ + "stdu r8, 8(r4) \n\t" + +#define MULADDC_STOP \ + "addze r5, r5 \n\t" \ + "addi r4, r4, 8 \n\t" \ + "addi r3, r3, 8 \n\t" \ + "std r5, %0 \n\t" \ + "std r4, %1 \n\t" \ + "std r3, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "r3", "r4", "r5", "r6", "r7", "r8", "r9" \ + ); + + +#else /* __MACH__ && __APPLE__ */ + +#define MULADDC_INIT \ + asm( \ + "ld %%r3, %3 \n\t" \ + "ld %%r4, %4 \n\t" \ + "ld %%r5, %5 \n\t" \ + "ld %%r6, %6 \n\t" \ + "addi %%r3, %%r3, -8 \n\t" \ + "addi %%r4, %%r4, -8 \n\t" \ + "addic %%r5, %%r5, 0 \n\t" + +#define MULADDC_CORE \ + "ldu %%r7, 8(%%r3) \n\t" \ + "mulld %%r8, %%r7, %%r6 \n\t" \ + "mulhdu %%r9, %%r7, %%r6 \n\t" \ + "adde %%r8, %%r8, %%r5 \n\t" \ + "ld %%r7, 8(%%r4) \n\t" \ + "addze %%r5, %%r9 \n\t" \ + "addc %%r8, %%r8, %%r7 \n\t" \ + "stdu %%r8, 8(%%r4) \n\t" + +#define MULADDC_STOP \ + "addze %%r5, %%r5 \n\t" \ + "addi %%r4, %%r4, 8 \n\t" \ + "addi %%r3, %%r3, 8 \n\t" \ + "std %%r5, %0 \n\t" \ + "std %%r4, %1 \n\t" \ + "std %%r3, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "r3", "r4", "r5", "r6", "r7", "r8", "r9" \ + ); + +#endif /* __MACH__ && __APPLE__ */ + +#elif defined(__powerpc__) || defined(__ppc__) /* end PPC64/begin PPC32 */ + +#if defined(__MACH__) && defined(__APPLE__) + +#define MULADDC_INIT \ + asm( \ + "lwz r3, %3 \n\t" \ + "lwz r4, %4 \n\t" \ + "lwz r5, %5 \n\t" \ + "lwz r6, %6 \n\t" \ + "addi r3, r3, -4 \n\t" \ + "addi r4, r4, -4 \n\t" \ + "addic r5, r5, 0 \n\t" + +#define MULADDC_CORE \ + "lwzu r7, 4(r3) \n\t" \ + "mullw r8, r7, r6 \n\t" \ + "mulhwu r9, r7, r6 \n\t" \ + "adde r8, r8, r5 \n\t" \ + "lwz r7, 4(r4) \n\t" \ + "addze r5, r9 \n\t" \ + "addc r8, r8, r7 \n\t" \ + "stwu r8, 4(r4) \n\t" + +#define MULADDC_STOP \ + "addze r5, r5 \n\t" \ + "addi r4, r4, 4 \n\t" \ + "addi r3, r3, 4 \n\t" \ + "stw r5, %0 \n\t" \ + "stw r4, %1 \n\t" \ + "stw r3, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "r3", "r4", "r5", "r6", "r7", "r8", "r9" \ + ); + +#else /* __MACH__ && __APPLE__ */ + +#define MULADDC_INIT \ + asm( \ + "lwz %%r3, %3 \n\t" \ + "lwz %%r4, %4 \n\t" \ + "lwz %%r5, %5 \n\t" \ + "lwz %%r6, %6 \n\t" \ + "addi %%r3, %%r3, -4 \n\t" \ + "addi %%r4, %%r4, -4 \n\t" \ + "addic %%r5, %%r5, 0 \n\t" + +#define MULADDC_CORE \ + "lwzu %%r7, 4(%%r3) \n\t" \ + "mullw %%r8, %%r7, %%r6 \n\t" \ + "mulhwu %%r9, %%r7, %%r6 \n\t" \ + "adde %%r8, %%r8, %%r5 \n\t" \ + "lwz %%r7, 4(%%r4) \n\t" \ + "addze %%r5, %%r9 \n\t" \ + "addc %%r8, %%r8, %%r7 \n\t" \ + "stwu %%r8, 4(%%r4) \n\t" + +#define MULADDC_STOP \ + "addze %%r5, %%r5 \n\t" \ + "addi %%r4, %%r4, 4 \n\t" \ + "addi %%r3, %%r3, 4 \n\t" \ + "stw %%r5, %0 \n\t" \ + "stw %%r4, %1 \n\t" \ + "stw %%r3, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "r3", "r4", "r5", "r6", "r7", "r8", "r9" \ + ); + +#endif /* __MACH__ && __APPLE__ */ + +#endif /* PPC32 */ + +/* + * The Sparc(64) assembly is reported to be broken. + * Disable it for now, until we're able to fix it. + */ +#if 0 && defined(__sparc__) +#if defined(__sparc64__) + +#define MULADDC_INIT \ + asm( \ + "ldx %3, %%o0 \n\t" \ + "ldx %4, %%o1 \n\t" \ + "ld %5, %%o2 \n\t" \ + "ld %6, %%o3 \n\t" + +#define MULADDC_CORE \ + "ld [%%o0], %%o4 \n\t" \ + "inc 4, %%o0 \n\t" \ + "ld [%%o1], %%o5 \n\t" \ + "umul %%o3, %%o4, %%o4 \n\t" \ + "addcc %%o4, %%o2, %%o4 \n\t" \ + "rd %%y, %%g1 \n\t" \ + "addx %%g1, 0, %%g1 \n\t" \ + "addcc %%o4, %%o5, %%o4 \n\t" \ + "st %%o4, [%%o1] \n\t" \ + "addx %%g1, 0, %%o2 \n\t" \ + "inc 4, %%o1 \n\t" + + #define MULADDC_STOP \ + "st %%o2, %0 \n\t" \ + "stx %%o1, %1 \n\t" \ + "stx %%o0, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "g1", "o0", "o1", "o2", "o3", "o4", \ + "o5" \ + ); + +#else /* __sparc64__ */ + +#define MULADDC_INIT \ + asm( \ + "ld %3, %%o0 \n\t" \ + "ld %4, %%o1 \n\t" \ + "ld %5, %%o2 \n\t" \ + "ld %6, %%o3 \n\t" + +#define MULADDC_CORE \ + "ld [%%o0], %%o4 \n\t" \ + "inc 4, %%o0 \n\t" \ + "ld [%%o1], %%o5 \n\t" \ + "umul %%o3, %%o4, %%o4 \n\t" \ + "addcc %%o4, %%o2, %%o4 \n\t" \ + "rd %%y, %%g1 \n\t" \ + "addx %%g1, 0, %%g1 \n\t" \ + "addcc %%o4, %%o5, %%o4 \n\t" \ + "st %%o4, [%%o1] \n\t" \ + "addx %%g1, 0, %%o2 \n\t" \ + "inc 4, %%o1 \n\t" + +#define MULADDC_STOP \ + "st %%o2, %0 \n\t" \ + "st %%o1, %1 \n\t" \ + "st %%o0, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "g1", "o0", "o1", "o2", "o3", "o4", \ + "o5" \ + ); + +#endif /* __sparc64__ */ +#endif /* __sparc__ */ + +#if defined(__microblaze__) || defined(microblaze) + +#define MULADDC_INIT \ + asm( \ + "lwi r3, %3 \n\t" \ + "lwi r4, %4 \n\t" \ + "lwi r5, %5 \n\t" \ + "lwi r6, %6 \n\t" \ + "andi r7, r6, 0xffff \n\t" \ + "bsrli r6, r6, 16 \n\t" + +#define MULADDC_CORE \ + "lhui r8, r3, 0 \n\t" \ + "addi r3, r3, 2 \n\t" \ + "lhui r9, r3, 0 \n\t" \ + "addi r3, r3, 2 \n\t" \ + "mul r10, r9, r6 \n\t" \ + "mul r11, r8, r7 \n\t" \ + "mul r12, r9, r7 \n\t" \ + "mul r13, r8, r6 \n\t" \ + "bsrli r8, r10, 16 \n\t" \ + "bsrli r9, r11, 16 \n\t" \ + "add r13, r13, r8 \n\t" \ + "add r13, r13, r9 \n\t" \ + "bslli r10, r10, 16 \n\t" \ + "bslli r11, r11, 16 \n\t" \ + "add r12, r12, r10 \n\t" \ + "addc r13, r13, r0 \n\t" \ + "add r12, r12, r11 \n\t" \ + "addc r13, r13, r0 \n\t" \ + "lwi r10, r4, 0 \n\t" \ + "add r12, r12, r10 \n\t" \ + "addc r13, r13, r0 \n\t" \ + "add r12, r12, r5 \n\t" \ + "addc r5, r13, r0 \n\t" \ + "swi r12, r4, 0 \n\t" \ + "addi r4, r4, 4 \n\t" + +#define MULADDC_STOP \ + "swi r5, %0 \n\t" \ + "swi r4, %1 \n\t" \ + "swi r3, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "r3", "r4", "r5", "r6", "r7", "r8", \ + "r9", "r10", "r11", "r12", "r13" \ + ); + +#endif /* MicroBlaze */ + +#if defined(__tricore__) + +#define MULADDC_INIT \ + asm( \ + "ld.a %%a2, %3 \n\t" \ + "ld.a %%a3, %4 \n\t" \ + "ld.w %%d4, %5 \n\t" \ + "ld.w %%d1, %6 \n\t" \ + "xor %%d5, %%d5 \n\t" + +#define MULADDC_CORE \ + "ld.w %%d0, [%%a2+] \n\t" \ + "madd.u %%e2, %%e4, %%d0, %%d1 \n\t" \ + "ld.w %%d0, [%%a3] \n\t" \ + "addx %%d2, %%d2, %%d0 \n\t" \ + "addc %%d3, %%d3, 0 \n\t" \ + "mov %%d4, %%d3 \n\t" \ + "st.w [%%a3+], %%d2 \n\t" + +#define MULADDC_STOP \ + "st.w %0, %%d4 \n\t" \ + "st.a %1, %%a3 \n\t" \ + "st.a %2, %%a2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "d0", "d1", "e2", "d4", "a2", "a3" \ + ); + +#endif /* TriCore */ + +/* + * Note, gcc -O0 by default uses r7 for the frame pointer, so it complains about + * our use of r7 below, unless -fomit-frame-pointer is passed. + * + * On the other hand, -fomit-frame-pointer is implied by any -Ox options with + * x !=0, which we can detect using __OPTIMIZE__ (which is also defined by + * clang and armcc5 under the same conditions). + * + * So, only use the optimized assembly below for optimized build, which avoids + * the build error and is pretty reasonable anyway. + */ +#if defined(__GNUC__) && !defined(__OPTIMIZE__) +#define MULADDC_CANNOT_USE_R7 +#endif + +#if defined(__arm__) && !defined(MULADDC_CANNOT_USE_R7) + +#if defined(__thumb__) && !defined(__thumb2__) + +#define MULADDC_INIT \ + asm( \ + "ldr r0, %3 \n\t" \ + "ldr r1, %4 \n\t" \ + "ldr r2, %5 \n\t" \ + "ldr r3, %6 \n\t" \ + "lsr r7, r3, #16 \n\t" \ + "mov r9, r7 \n\t" \ + "lsl r7, r3, #16 \n\t" \ + "lsr r7, r7, #16 \n\t" \ + "mov r8, r7 \n\t" + +#define MULADDC_CORE \ + "ldmia r0!, {r6} \n\t" \ + "lsr r7, r6, #16 \n\t" \ + "lsl r6, r6, #16 \n\t" \ + "lsr r6, r6, #16 \n\t" \ + "mov r4, r8 \n\t" \ + "mul r4, r6 \n\t" \ + "mov r3, r9 \n\t" \ + "mul r6, r3 \n\t" \ + "mov r5, r9 \n\t" \ + "mul r5, r7 \n\t" \ + "mov r3, r8 \n\t" \ + "mul r7, r3 \n\t" \ + "lsr r3, r6, #16 \n\t" \ + "add r5, r5, r3 \n\t" \ + "lsr r3, r7, #16 \n\t" \ + "add r5, r5, r3 \n\t" \ + "add r4, r4, r2 \n\t" \ + "mov r2, #0 \n\t" \ + "adc r5, r2 \n\t" \ + "lsl r3, r6, #16 \n\t" \ + "add r4, r4, r3 \n\t" \ + "adc r5, r2 \n\t" \ + "lsl r3, r7, #16 \n\t" \ + "add r4, r4, r3 \n\t" \ + "adc r5, r2 \n\t" \ + "ldr r3, [r1] \n\t" \ + "add r4, r4, r3 \n\t" \ + "adc r2, r5 \n\t" \ + "stmia r1!, {r4} \n\t" + +#define MULADDC_STOP \ + "str r2, %0 \n\t" \ + "str r1, %1 \n\t" \ + "str r0, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "r0", "r1", "r2", "r3", "r4", "r5", \ + "r6", "r7", "r8", "r9", "cc" \ + ); + +#elif (__ARM_ARCH >= 6) && \ + defined (__ARM_FEATURE_DSP) && (__ARM_FEATURE_DSP == 1) + +#define MULADDC_INIT \ + asm( + +#define MULADDC_CORE \ + "ldr r0, [%0], #4 \n\t" \ + "ldr r1, [%1] \n\t" \ + "umaal r1, %2, %3, r0 \n\t" \ + "str r1, [%1], #4 \n\t" + +#define MULADDC_STOP \ + : "=r" (s), "=r" (d), "=r" (c) \ + : "r" (b), "0" (s), "1" (d), "2" (c) \ + : "r0", "r1", "memory" \ + ); + +#else + +#define MULADDC_INIT \ + asm( \ + "ldr r0, %3 \n\t" \ + "ldr r1, %4 \n\t" \ + "ldr r2, %5 \n\t" \ + "ldr r3, %6 \n\t" + +#define MULADDC_CORE \ + "ldr r4, [r0], #4 \n\t" \ + "mov r5, #0 \n\t" \ + "ldr r6, [r1] \n\t" \ + "umlal r2, r5, r3, r4 \n\t" \ + "adds r7, r6, r2 \n\t" \ + "adc r2, r5, #0 \n\t" \ + "str r7, [r1], #4 \n\t" + +#define MULADDC_STOP \ + "str r2, %0 \n\t" \ + "str r1, %1 \n\t" \ + "str r0, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "r0", "r1", "r2", "r3", "r4", "r5", \ + "r6", "r7", "cc" \ + ); + +#endif /* Thumb */ + +#endif /* ARMv3 */ + +#if defined(__alpha__) + +#define MULADDC_INIT \ + asm( \ + "ldq $1, %3 \n\t" \ + "ldq $2, %4 \n\t" \ + "ldq $3, %5 \n\t" \ + "ldq $4, %6 \n\t" + +#define MULADDC_CORE \ + "ldq $6, 0($1) \n\t" \ + "addq $1, 8, $1 \n\t" \ + "mulq $6, $4, $7 \n\t" \ + "umulh $6, $4, $6 \n\t" \ + "addq $7, $3, $7 \n\t" \ + "cmpult $7, $3, $3 \n\t" \ + "ldq $5, 0($2) \n\t" \ + "addq $7, $5, $7 \n\t" \ + "cmpult $7, $5, $5 \n\t" \ + "stq $7, 0($2) \n\t" \ + "addq $2, 8, $2 \n\t" \ + "addq $6, $3, $3 \n\t" \ + "addq $5, $3, $3 \n\t" + +#define MULADDC_STOP \ + "stq $3, %0 \n\t" \ + "stq $2, %1 \n\t" \ + "stq $1, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "$1", "$2", "$3", "$4", "$5", "$6", "$7" \ + ); +#endif /* Alpha */ + +#if defined(__mips__) && !defined(__mips64) + +#define MULADDC_INIT \ + asm( \ + "lw $10, %3 \n\t" \ + "lw $11, %4 \n\t" \ + "lw $12, %5 \n\t" \ + "lw $13, %6 \n\t" + +#define MULADDC_CORE \ + "lw $14, 0($10) \n\t" \ + "multu $13, $14 \n\t" \ + "addi $10, $10, 4 \n\t" \ + "mflo $14 \n\t" \ + "mfhi $9 \n\t" \ + "addu $14, $12, $14 \n\t" \ + "lw $15, 0($11) \n\t" \ + "sltu $12, $14, $12 \n\t" \ + "addu $15, $14, $15 \n\t" \ + "sltu $14, $15, $14 \n\t" \ + "addu $12, $12, $9 \n\t" \ + "sw $15, 0($11) \n\t" \ + "addu $12, $12, $14 \n\t" \ + "addi $11, $11, 4 \n\t" + +#define MULADDC_STOP \ + "sw $12, %0 \n\t" \ + "sw $11, %1 \n\t" \ + "sw $10, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "$9", "$10", "$11", "$12", "$13", "$14", "$15", "lo", "hi" \ + ); + +#endif /* MIPS */ +#endif /* GNUC */ + +#if (defined(_MSC_VER) && defined(_M_IX86)) || defined(__WATCOMC__) + +#define MULADDC_INIT \ + __asm mov esi, s \ + __asm mov edi, d \ + __asm mov ecx, c \ + __asm mov ebx, b + +#define MULADDC_CORE \ + __asm lodsd \ + __asm mul ebx \ + __asm add eax, ecx \ + __asm adc edx, 0 \ + __asm add eax, [edi] \ + __asm adc edx, 0 \ + __asm mov ecx, edx \ + __asm stosd + +#if defined(MBEDTLS_HAVE_SSE2) + +#define EMIT __asm _emit + +#define MULADDC_HUIT \ + EMIT 0x0F EMIT 0x6E EMIT 0xC9 \ + EMIT 0x0F EMIT 0x6E EMIT 0xC3 \ + EMIT 0x0F EMIT 0x6E EMIT 0x1F \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCB \ + EMIT 0x0F EMIT 0x6E EMIT 0x16 \ + EMIT 0x0F EMIT 0xF4 EMIT 0xD0 \ + EMIT 0x0F EMIT 0x6E EMIT 0x66 EMIT 0x04 \ + EMIT 0x0F EMIT 0xF4 EMIT 0xE0 \ + EMIT 0x0F EMIT 0x6E EMIT 0x76 EMIT 0x08 \ + EMIT 0x0F EMIT 0xF4 EMIT 0xF0 \ + EMIT 0x0F EMIT 0x6E EMIT 0x7E EMIT 0x0C \ + EMIT 0x0F EMIT 0xF4 EMIT 0xF8 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCA \ + EMIT 0x0F EMIT 0x6E EMIT 0x5F EMIT 0x04 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xDC \ + EMIT 0x0F EMIT 0x6E EMIT 0x6F EMIT 0x08 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xEE \ + EMIT 0x0F EMIT 0x6E EMIT 0x67 EMIT 0x0C \ + EMIT 0x0F EMIT 0xD4 EMIT 0xFC \ + EMIT 0x0F EMIT 0x7E EMIT 0x0F \ + EMIT 0x0F EMIT 0x6E EMIT 0x56 EMIT 0x10 \ + EMIT 0x0F EMIT 0xF4 EMIT 0xD0 \ + EMIT 0x0F EMIT 0x73 EMIT 0xD1 EMIT 0x20 \ + EMIT 0x0F EMIT 0x6E EMIT 0x66 EMIT 0x14 \ + EMIT 0x0F EMIT 0xF4 EMIT 0xE0 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCB \ + EMIT 0x0F EMIT 0x6E EMIT 0x76 EMIT 0x18 \ + EMIT 0x0F EMIT 0xF4 EMIT 0xF0 \ + EMIT 0x0F EMIT 0x7E EMIT 0x4F EMIT 0x04 \ + EMIT 0x0F EMIT 0x73 EMIT 0xD1 EMIT 0x20 \ + EMIT 0x0F EMIT 0x6E EMIT 0x5E EMIT 0x1C \ + EMIT 0x0F EMIT 0xF4 EMIT 0xD8 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCD \ + EMIT 0x0F EMIT 0x6E EMIT 0x6F EMIT 0x10 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xD5 \ + EMIT 0x0F EMIT 0x7E EMIT 0x4F EMIT 0x08 \ + EMIT 0x0F EMIT 0x73 EMIT 0xD1 EMIT 0x20 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCF \ + EMIT 0x0F EMIT 0x6E EMIT 0x6F EMIT 0x14 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xE5 \ + EMIT 0x0F EMIT 0x7E EMIT 0x4F EMIT 0x0C \ + EMIT 0x0F EMIT 0x73 EMIT 0xD1 EMIT 0x20 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCA \ + EMIT 0x0F EMIT 0x6E EMIT 0x6F EMIT 0x18 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xF5 \ + EMIT 0x0F EMIT 0x7E EMIT 0x4F EMIT 0x10 \ + EMIT 0x0F EMIT 0x73 EMIT 0xD1 EMIT 0x20 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCC \ + EMIT 0x0F EMIT 0x6E EMIT 0x6F EMIT 0x1C \ + EMIT 0x0F EMIT 0xD4 EMIT 0xDD \ + EMIT 0x0F EMIT 0x7E EMIT 0x4F EMIT 0x14 \ + EMIT 0x0F EMIT 0x73 EMIT 0xD1 EMIT 0x20 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCE \ + EMIT 0x0F EMIT 0x7E EMIT 0x4F EMIT 0x18 \ + EMIT 0x0F EMIT 0x73 EMIT 0xD1 EMIT 0x20 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCB \ + EMIT 0x0F EMIT 0x7E EMIT 0x4F EMIT 0x1C \ + EMIT 0x83 EMIT 0xC7 EMIT 0x20 \ + EMIT 0x83 EMIT 0xC6 EMIT 0x20 \ + EMIT 0x0F EMIT 0x73 EMIT 0xD1 EMIT 0x20 \ + EMIT 0x0F EMIT 0x7E EMIT 0xC9 + +#define MULADDC_STOP \ + EMIT 0x0F EMIT 0x77 \ + __asm mov c, ecx \ + __asm mov d, edi \ + __asm mov s, esi \ + +#else + +#define MULADDC_STOP \ + __asm mov c, ecx \ + __asm mov d, edi \ + __asm mov s, esi \ + +#endif /* SSE2 */ +#endif /* MSVC */ + +#endif /* MBEDTLS_HAVE_ASM */ + +#if !defined(MULADDC_CORE) +#if defined(MBEDTLS_HAVE_UDBL) + +#define MULADDC_INIT \ +{ \ + mbedtls_t_udbl r; \ + mbedtls_mpi_uint r0, r1; + +#define MULADDC_CORE \ + r = *(s++) * (mbedtls_t_udbl) b; \ + r0 = (mbedtls_mpi_uint) r; \ + r1 = (mbedtls_mpi_uint)( r >> biL ); \ + r0 += c; r1 += (r0 < c); \ + r0 += *d; r1 += (r0 < *d); \ + c = r1; *(d++) = r0; + +#define MULADDC_STOP \ +} + +#else +#define MULADDC_INIT \ +{ \ + mbedtls_mpi_uint s0, s1, b0, b1; \ + mbedtls_mpi_uint r0, r1, rx, ry; \ + b0 = ( b << biH ) >> biH; \ + b1 = ( b >> biH ); + +#define MULADDC_CORE \ + s0 = ( *s << biH ) >> biH; \ + s1 = ( *s >> biH ); s++; \ + rx = s0 * b1; r0 = s0 * b0; \ + ry = s1 * b0; r1 = s1 * b1; \ + r1 += ( rx >> biH ); \ + r1 += ( ry >> biH ); \ + rx <<= biH; ry <<= biH; \ + r0 += rx; r1 += (r0 < rx); \ + r0 += ry; r1 += (r0 < ry); \ + r0 += c; r1 += (r0 < c); \ + r0 += *d; r1 += (r0 < *d); \ + c = r1; *(d++) = r0; + +#define MULADDC_STOP \ +} + +#endif /* C (generic) */ +#endif /* C (longlong) */ + +#endif /* bn_mul.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/camellia.h b/openharmony/arm64-v8a/include/mbedtls/camellia.h new file mode 100644 index 00000000..d39d932f --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/camellia.h @@ -0,0 +1,327 @@ +/** + * \file camellia.h + * + * \brief Camellia block cipher + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_CAMELLIA_H +#define MBEDTLS_CAMELLIA_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +#include "mbedtls/platform_util.h" + +#define MBEDTLS_CAMELLIA_ENCRYPT 1 +#define MBEDTLS_CAMELLIA_DECRYPT 0 + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#define MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( -0x0024 ) +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ +/** Bad input data. */ +#define MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA -0x0024 + +/** Invalid data input length. */ +#define MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH -0x0026 + +/* MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED is deprecated and should not be used. + */ +/** Camellia hardware accelerator failed. */ +#define MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED -0x0027 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_CAMELLIA_ALT) +// Regular implementation +// + +/** + * \brief CAMELLIA context structure + */ +typedef struct mbedtls_camellia_context +{ + int nr; /*!< number of rounds */ + uint32_t rk[68]; /*!< CAMELLIA round keys */ +} +mbedtls_camellia_context; + +#else /* MBEDTLS_CAMELLIA_ALT */ +#include "camellia_alt.h" +#endif /* MBEDTLS_CAMELLIA_ALT */ + +/** + * \brief Initialize a CAMELLIA context. + * + * \param ctx The CAMELLIA context to be initialized. + * This must not be \c NULL. + */ +void mbedtls_camellia_init( mbedtls_camellia_context *ctx ); + +/** + * \brief Clear a CAMELLIA context. + * + * \param ctx The CAMELLIA context to be cleared. This may be \c NULL, + * in which case this function returns immediately. If it is not + * \c NULL, it must be initialized. + */ +void mbedtls_camellia_free( mbedtls_camellia_context *ctx ); + +/** + * \brief Perform a CAMELLIA key schedule operation for encryption. + * + * \param ctx The CAMELLIA context to use. This must be initialized. + * \param key The encryption key to use. This must be a readable buffer + * of size \p keybits Bits. + * \param keybits The length of \p key in Bits. This must be either \c 128, + * \c 192 or \c 256. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_setkey_enc( mbedtls_camellia_context *ctx, + const unsigned char *key, + unsigned int keybits ); + +/** + * \brief Perform a CAMELLIA key schedule operation for decryption. + * + * \param ctx The CAMELLIA context to use. This must be initialized. + * \param key The decryption key. This must be a readable buffer + * of size \p keybits Bits. + * \param keybits The length of \p key in Bits. This must be either \c 128, + * \c 192 or \c 256. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_setkey_dec( mbedtls_camellia_context *ctx, + const unsigned char *key, + unsigned int keybits ); + +/** + * \brief Perform a CAMELLIA-ECB block encryption/decryption operation. + * + * \param ctx The CAMELLIA context to use. This must be initialized + * and bound to a key. + * \param mode The mode of operation. This must be either + * #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. + * \param input The input block. This must be a readable buffer + * of size \c 16 Bytes. + * \param output The output block. This must be a writable buffer + * of size \c 16 Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_crypt_ecb( mbedtls_camellia_context *ctx, + int mode, + const unsigned char input[16], + unsigned char output[16] ); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief Perform a CAMELLIA-CBC buffer encryption/decryption operation. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the function same function again on the following + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If on the other hand you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * \param ctx The CAMELLIA context to use. This must be initialized + * and bound to a key. + * \param mode The mode of operation. This must be either + * #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. + * \param length The length in Bytes of the input data \p input. + * This must be a multiple of \c 16 Bytes. + * \param iv The initialization vector. This must be a read/write buffer + * of length \c 16 Bytes. It is updated to allow streaming + * use as explained above. + * \param input The buffer holding the input data. This must point to a + * readable buffer of length \p length Bytes. + * \param output The buffer holding the output data. This must point to a + * writable buffer of length \p length Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_crypt_cbc( mbedtls_camellia_context *ctx, + int mode, + size_t length, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +#if defined(MBEDTLS_CIPHER_MODE_CFB) +/** + * \brief Perform a CAMELLIA-CFB128 buffer encryption/decryption + * operation. + * + * \note Due to the nature of CFB mode, you should use the same + * key for both encryption and decryption. In particular, calls + * to this function should be preceded by a key-schedule via + * mbedtls_camellia_setkey_enc() regardless of whether \p mode + * is #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the function same function again on the following + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If on the other hand you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * \param ctx The CAMELLIA context to use. This must be initialized + * and bound to a key. + * \param mode The mode of operation. This must be either + * #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. + * \param length The length of the input data \p input. Any value is allowed. + * \param iv_off The current offset in the IV. This must be smaller + * than \c 16 Bytes. It is updated after this call to allow + * the aforementioned streaming usage. + * \param iv The initialization vector. This must be a read/write buffer + * of length \c 16 Bytes. It is updated after this call to + * allow the aforementioned streaming usage. + * \param input The buffer holding the input data. This must be a readable + * buffer of size \p length Bytes. + * \param output The buffer to hold the output data. This must be a writable + * buffer of length \p length Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_crypt_cfb128( mbedtls_camellia_context *ctx, + int mode, + size_t length, + size_t *iv_off, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CFB */ + +#if defined(MBEDTLS_CIPHER_MODE_CTR) +/** + * \brief Perform a CAMELLIA-CTR buffer encryption/decryption operation. + * + * *note Due to the nature of CTR mode, you should use the same + * key for both encryption and decryption. In particular, calls + * to this function should be preceded by a key-schedule via + * mbedtls_camellia_setkey_enc() regardless of whether \p mode + * is #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. + * + * \warning You must never reuse a nonce value with the same key. Doing so + * would void the encryption for the two messages encrypted with + * the same nonce and key. + * + * There are two common strategies for managing nonces with CTR: + * + * 1. You can handle everything as a single message processed over + * successive calls to this function. In that case, you want to + * set \p nonce_counter and \p nc_off to 0 for the first call, and + * then preserve the values of \p nonce_counter, \p nc_off and \p + * stream_block across calls to this function as they will be + * updated by this function. + * + * With this strategy, you must not encrypt more than 2**128 + * blocks of data with the same key. + * + * 2. You can encrypt separate messages by dividing the \p + * nonce_counter buffer in two areas: the first one used for a + * per-message nonce, handled by yourself, and the second one + * updated by this function internally. + * + * For example, you might reserve the first \c 12 Bytes for the + * per-message nonce, and the last \c 4 Bytes for internal use. + * In that case, before calling this function on a new message you + * need to set the first \c 12 Bytes of \p nonce_counter to your + * chosen nonce value, the last four to \c 0, and \p nc_off to \c 0 + * (which will cause \p stream_block to be ignored). That way, you + * can encrypt at most \c 2**96 messages of up to \c 2**32 blocks + * each with the same key. + * + * The per-message nonce (or information sufficient to reconstruct + * it) needs to be communicated with the ciphertext and must be + * unique. The recommended way to ensure uniqueness is to use a + * message counter. An alternative is to generate random nonces, + * but this limits the number of messages that can be securely + * encrypted: for example, with 96-bit random nonces, you should + * not encrypt more than 2**32 messages with the same key. + * + * Note that for both strategies, sizes are measured in blocks and + * that a CAMELLIA block is \c 16 Bytes. + * + * \warning Upon return, \p stream_block contains sensitive data. Its + * content must not be written to insecure storage and should be + * securely discarded as soon as it's no longer needed. + * + * \param ctx The CAMELLIA context to use. This must be initialized + * and bound to a key. + * \param length The length of the input data \p input in Bytes. + * Any value is allowed. + * \param nc_off The offset in the current \p stream_block (for resuming + * within current cipher stream). The offset pointer to + * should be \c 0 at the start of a stream. It is updated + * at the end of this call. + * \param nonce_counter The 128-bit nonce and counter. This must be a read/write + * buffer of length \c 16 Bytes. + * \param stream_block The saved stream-block for resuming. This must be a + * read/write buffer of length \c 16 Bytes. + * \param input The input data stream. This must be a readable buffer of + * size \p length Bytes. + * \param output The output data stream. This must be a writable buffer + * of size \p length Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_crypt_ctr( mbedtls_camellia_context *ctx, + size_t length, + size_t *nc_off, + unsigned char nonce_counter[16], + unsigned char stream_block[16], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CTR */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_camellia_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* camellia.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/ccm.h b/openharmony/arm64-v8a/include/mbedtls/ccm.h new file mode 100644 index 00000000..ece5a901 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/ccm.h @@ -0,0 +1,311 @@ +/** + * \file ccm.h + * + * \brief This file provides an API for the CCM authenticated encryption + * mode for block ciphers. + * + * CCM combines Counter mode encryption with CBC-MAC authentication + * for 128-bit block ciphers. + * + * Input to CCM includes the following elements: + *
  • Payload - data that is both authenticated and encrypted.
    • + *
  • Associated data (Adata) - data that is authenticated but not + * encrypted, For example, a header.
    • + *
  • Nonce - A unique value that is assigned to the payload and the + * associated data.
+ * + * Definition of CCM: + * http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C_updated-July20_2007.pdf + * RFC 3610 "Counter with CBC-MAC (CCM)" + * + * Related: + * RFC 5116 "An Interface and Algorithms for Authenticated Encryption" + * + * Definition of CCM*: + * IEEE 802.15.4 - IEEE Standard for Local and metropolitan area networks + * Integer representation is fixed most-significant-octet-first order and + * the representation of octets is most-significant-bit-first order. This is + * consistent with RFC 3610. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CCM_H +#define MBEDTLS_CCM_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/cipher.h" + +/** Bad input parameters to the function. */ +#define MBEDTLS_ERR_CCM_BAD_INPUT -0x000D +/** Authenticated decryption failed. */ +#define MBEDTLS_ERR_CCM_AUTH_FAILED -0x000F + +/* MBEDTLS_ERR_CCM_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** CCM hardware accelerator failed. */ +#define MBEDTLS_ERR_CCM_HW_ACCEL_FAILED -0x0011 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_CCM_ALT) +// Regular implementation +// + +/** + * \brief The CCM context-type definition. The CCM context is passed + * to the APIs called. + */ +typedef struct mbedtls_ccm_context +{ + mbedtls_cipher_context_t cipher_ctx; /*!< The cipher context used. */ +} +mbedtls_ccm_context; + +#else /* MBEDTLS_CCM_ALT */ +#include "ccm_alt.h" +#endif /* MBEDTLS_CCM_ALT */ + +/** + * \brief This function initializes the specified CCM context, + * to make references valid, and prepare the context + * for mbedtls_ccm_setkey() or mbedtls_ccm_free(). + * + * \param ctx The CCM context to initialize. This must not be \c NULL. + */ +void mbedtls_ccm_init( mbedtls_ccm_context *ctx ); + +/** + * \brief This function initializes the CCM context set in the + * \p ctx parameter and sets the encryption key. + * + * \param ctx The CCM context to initialize. This must be an initialized + * context. + * \param cipher The 128-bit block cipher to use. + * \param key The encryption key. This must not be \c NULL. + * \param keybits The key size in bits. This must be acceptable by the cipher. + * + * \return \c 0 on success. + * \return A CCM or cipher-specific error code on failure. + */ +int mbedtls_ccm_setkey( mbedtls_ccm_context *ctx, + mbedtls_cipher_id_t cipher, + const unsigned char *key, + unsigned int keybits ); + +/** + * \brief This function releases and clears the specified CCM context + * and underlying cipher sub-context. + * + * \param ctx The CCM context to clear. If this is \c NULL, the function + * has no effect. Otherwise, this must be initialized. + */ +void mbedtls_ccm_free( mbedtls_ccm_context *ctx ); + +/** + * \brief This function encrypts a buffer using CCM. + * + * \note The tag is written to a separate buffer. To concatenate + * the \p tag with the \p output, as done in RFC-3610: + * Counter with CBC-MAC (CCM), use + * \p tag = \p output + \p length, and make sure that the + * output buffer is at least \p length + \p tag_len wide. + * + * \param ctx The CCM context to use for encryption. This must be + * initialized and bound to a key. + * \param length The length of the input data in Bytes. + * \param iv The initialization vector (nonce). This must be a readable + * buffer of at least \p iv_len Bytes. + * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, + * or 13. The length L of the message length field is + * 15 - \p iv_len. + * \param add The additional data field. If \p add_len is greater than + * zero, \p add must be a readable buffer of at least that + * length. + * \param add_len The length of additional data in Bytes. + * This must be less than `2^16 - 2^8`. + * \param input The buffer holding the input data. If \p length is greater + * than zero, \p input must be a readable buffer of at least + * that length. + * \param output The buffer holding the output data. If \p length is greater + * than zero, \p output must be a writable buffer of at least + * that length. + * \param tag The buffer holding the authentication field. This must be a + * writable buffer of at least \p tag_len Bytes. + * \param tag_len The length of the authentication field to generate in Bytes: + * 4, 6, 8, 10, 12, 14 or 16. + * + * \return \c 0 on success. + * \return A CCM or cipher-specific error code on failure. + */ +int mbedtls_ccm_encrypt_and_tag( mbedtls_ccm_context *ctx, size_t length, + const unsigned char *iv, size_t iv_len, + const unsigned char *add, size_t add_len, + const unsigned char *input, unsigned char *output, + unsigned char *tag, size_t tag_len ); + +/** + * \brief This function encrypts a buffer using CCM*. + * + * \note The tag is written to a separate buffer. To concatenate + * the \p tag with the \p output, as done in RFC-3610: + * Counter with CBC-MAC (CCM), use + * \p tag = \p output + \p length, and make sure that the + * output buffer is at least \p length + \p tag_len wide. + * + * \note When using this function in a variable tag length context, + * the tag length has to be encoded into the \p iv passed to + * this function. + * + * \param ctx The CCM context to use for encryption. This must be + * initialized and bound to a key. + * \param length The length of the input data in Bytes. + * \param iv The initialization vector (nonce). This must be a readable + * buffer of at least \p iv_len Bytes. + * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, + * or 13. The length L of the message length field is + * 15 - \p iv_len. + * \param add The additional data field. This must be a readable buffer of + * at least \p add_len Bytes. + * \param add_len The length of additional data in Bytes. + * This must be less than 2^16 - 2^8. + * \param input The buffer holding the input data. If \p length is greater + * than zero, \p input must be a readable buffer of at least + * that length. + * \param output The buffer holding the output data. If \p length is greater + * than zero, \p output must be a writable buffer of at least + * that length. + * \param tag The buffer holding the authentication field. This must be a + * writable buffer of at least \p tag_len Bytes. + * \param tag_len The length of the authentication field to generate in Bytes: + * 0, 4, 6, 8, 10, 12, 14 or 16. + * + * \warning Passing \c 0 as \p tag_len means that the message is no + * longer authenticated. + * + * \return \c 0 on success. + * \return A CCM or cipher-specific error code on failure. + */ +int mbedtls_ccm_star_encrypt_and_tag( mbedtls_ccm_context *ctx, size_t length, + const unsigned char *iv, size_t iv_len, + const unsigned char *add, size_t add_len, + const unsigned char *input, unsigned char *output, + unsigned char *tag, size_t tag_len ); + +/** + * \brief This function performs a CCM authenticated decryption of a + * buffer. + * + * \param ctx The CCM context to use for decryption. This must be + * initialized and bound to a key. + * \param length The length of the input data in Bytes. + * \param iv The initialization vector (nonce). This must be a readable + * buffer of at least \p iv_len Bytes. + * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, + * or 13. The length L of the message length field is + * 15 - \p iv_len. + * \param add The additional data field. This must be a readable buffer + * of at least that \p add_len Bytes.. + * \param add_len The length of additional data in Bytes. + * This must be less than 2^16 - 2^8. + * \param input The buffer holding the input data. If \p length is greater + * than zero, \p input must be a readable buffer of at least + * that length. + * \param output The buffer holding the output data. If \p length is greater + * than zero, \p output must be a writable buffer of at least + * that length. + * \param tag The buffer holding the authentication field. This must be a + * readable buffer of at least \p tag_len Bytes. + * \param tag_len The length of the authentication field to generate in Bytes: + * 4, 6, 8, 10, 12, 14 or 16. + * + * \return \c 0 on success. This indicates that the message is authentic. + * \return #MBEDTLS_ERR_CCM_AUTH_FAILED if the tag does not match. + * \return A cipher-specific error code on calculation failure. + */ +int mbedtls_ccm_auth_decrypt( mbedtls_ccm_context *ctx, size_t length, + const unsigned char *iv, size_t iv_len, + const unsigned char *add, size_t add_len, + const unsigned char *input, unsigned char *output, + const unsigned char *tag, size_t tag_len ); + +/** + * \brief This function performs a CCM* authenticated decryption of a + * buffer. + * + * \note When using this function in a variable tag length context, + * the tag length has to be decoded from \p iv and passed to + * this function as \p tag_len. (\p tag needs to be adjusted + * accordingly.) + * + * \param ctx The CCM context to use for decryption. This must be + * initialized and bound to a key. + * \param length The length of the input data in Bytes. + * \param iv The initialization vector (nonce). This must be a readable + * buffer of at least \p iv_len Bytes. + * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, + * or 13. The length L of the message length field is + * 15 - \p iv_len. + * \param add The additional data field. This must be a readable buffer of + * at least that \p add_len Bytes. + * \param add_len The length of additional data in Bytes. + * This must be less than 2^16 - 2^8. + * \param input The buffer holding the input data. If \p length is greater + * than zero, \p input must be a readable buffer of at least + * that length. + * \param output The buffer holding the output data. If \p length is greater + * than zero, \p output must be a writable buffer of at least + * that length. + * \param tag The buffer holding the authentication field. This must be a + * readable buffer of at least \p tag_len Bytes. + * \param tag_len The length of the authentication field in Bytes. + * 0, 4, 6, 8, 10, 12, 14 or 16. + * + * \warning Passing \c 0 as \p tag_len means that the message is nos + * longer authenticated. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CCM_AUTH_FAILED if the tag does not match. + * \return A cipher-specific error code on calculation failure. + */ +int mbedtls_ccm_star_auth_decrypt( mbedtls_ccm_context *ctx, size_t length, + const unsigned char *iv, size_t iv_len, + const unsigned char *add, size_t add_len, + const unsigned char *input, unsigned char *output, + const unsigned char *tag, size_t tag_len ); + +#if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_AES_C) +/** + * \brief The CCM checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_ccm_self_test( int verbose ); +#endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CCM_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/certs.h b/openharmony/arm64-v8a/include/mbedtls/certs.h new file mode 100644 index 00000000..c93c741c --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/certs.h @@ -0,0 +1,250 @@ +/** + * \file certs.h + * + * \brief Sample certificates and DHM parameters for testing + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_CERTS_H +#define MBEDTLS_CERTS_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/* List of all PEM-encoded CA certificates, terminated by NULL; + * PEM encoded if MBEDTLS_PEM_PARSE_C is enabled, DER encoded + * otherwise. */ +extern const char * mbedtls_test_cas[]; +extern const size_t mbedtls_test_cas_len[]; + +/* List of all DER-encoded CA certificates, terminated by NULL */ +extern const unsigned char * mbedtls_test_cas_der[]; +extern const size_t mbedtls_test_cas_der_len[]; + +#if defined(MBEDTLS_PEM_PARSE_C) +/* Concatenation of all CA certificates in PEM format if available */ +extern const char mbedtls_test_cas_pem[]; +extern const size_t mbedtls_test_cas_pem_len; +#endif /* MBEDTLS_PEM_PARSE_C */ + +/* + * CA test certificates + */ + +extern const char mbedtls_test_ca_crt_ec_pem[]; +extern const char mbedtls_test_ca_key_ec_pem[]; +extern const char mbedtls_test_ca_pwd_ec_pem[]; +extern const char mbedtls_test_ca_key_rsa_pem[]; +extern const char mbedtls_test_ca_pwd_rsa_pem[]; +extern const char mbedtls_test_ca_crt_rsa_sha1_pem[]; +extern const char mbedtls_test_ca_crt_rsa_sha256_pem[]; + +extern const unsigned char mbedtls_test_ca_crt_ec_der[]; +extern const unsigned char mbedtls_test_ca_key_ec_der[]; +extern const unsigned char mbedtls_test_ca_key_rsa_der[]; +extern const unsigned char mbedtls_test_ca_crt_rsa_sha1_der[]; +extern const unsigned char mbedtls_test_ca_crt_rsa_sha256_der[]; + +extern const size_t mbedtls_test_ca_crt_ec_pem_len; +extern const size_t mbedtls_test_ca_key_ec_pem_len; +extern const size_t mbedtls_test_ca_pwd_ec_pem_len; +extern const size_t mbedtls_test_ca_key_rsa_pem_len; +extern const size_t mbedtls_test_ca_pwd_rsa_pem_len; +extern const size_t mbedtls_test_ca_crt_rsa_sha1_pem_len; +extern const size_t mbedtls_test_ca_crt_rsa_sha256_pem_len; + +extern const size_t mbedtls_test_ca_crt_ec_der_len; +extern const size_t mbedtls_test_ca_key_ec_der_len; +extern const size_t mbedtls_test_ca_pwd_ec_der_len; +extern const size_t mbedtls_test_ca_key_rsa_der_len; +extern const size_t mbedtls_test_ca_pwd_rsa_der_len; +extern const size_t mbedtls_test_ca_crt_rsa_sha1_der_len; +extern const size_t mbedtls_test_ca_crt_rsa_sha256_der_len; + +/* Config-dependent dispatch between PEM and DER encoding + * (PEM if enabled, otherwise DER) */ + +extern const char mbedtls_test_ca_crt_ec[]; +extern const char mbedtls_test_ca_key_ec[]; +extern const char mbedtls_test_ca_pwd_ec[]; +extern const char mbedtls_test_ca_key_rsa[]; +extern const char mbedtls_test_ca_pwd_rsa[]; +extern const char mbedtls_test_ca_crt_rsa_sha1[]; +extern const char mbedtls_test_ca_crt_rsa_sha256[]; + +extern const size_t mbedtls_test_ca_crt_ec_len; +extern const size_t mbedtls_test_ca_key_ec_len; +extern const size_t mbedtls_test_ca_pwd_ec_len; +extern const size_t mbedtls_test_ca_key_rsa_len; +extern const size_t mbedtls_test_ca_pwd_rsa_len; +extern const size_t mbedtls_test_ca_crt_rsa_sha1_len; +extern const size_t mbedtls_test_ca_crt_rsa_sha256_len; + +/* Config-dependent dispatch between SHA-1 and SHA-256 + * (SHA-256 if enabled, otherwise SHA-1) */ + +extern const char mbedtls_test_ca_crt_rsa[]; +extern const size_t mbedtls_test_ca_crt_rsa_len; + +/* Config-dependent dispatch between EC and RSA + * (RSA if enabled, otherwise EC) */ + +extern const char * mbedtls_test_ca_crt; +extern const char * mbedtls_test_ca_key; +extern const char * mbedtls_test_ca_pwd; +extern const size_t mbedtls_test_ca_crt_len; +extern const size_t mbedtls_test_ca_key_len; +extern const size_t mbedtls_test_ca_pwd_len; + +/* + * Server test certificates + */ + +extern const char mbedtls_test_srv_crt_ec_pem[]; +extern const char mbedtls_test_srv_key_ec_pem[]; +extern const char mbedtls_test_srv_pwd_ec_pem[]; +extern const char mbedtls_test_srv_key_rsa_pem[]; +extern const char mbedtls_test_srv_pwd_rsa_pem[]; +extern const char mbedtls_test_srv_crt_rsa_sha1_pem[]; +extern const char mbedtls_test_srv_crt_rsa_sha256_pem[]; + +extern const unsigned char mbedtls_test_srv_crt_ec_der[]; +extern const unsigned char mbedtls_test_srv_key_ec_der[]; +extern const unsigned char mbedtls_test_srv_key_rsa_der[]; +extern const unsigned char mbedtls_test_srv_crt_rsa_sha1_der[]; +extern const unsigned char mbedtls_test_srv_crt_rsa_sha256_der[]; + +extern const size_t mbedtls_test_srv_crt_ec_pem_len; +extern const size_t mbedtls_test_srv_key_ec_pem_len; +extern const size_t mbedtls_test_srv_pwd_ec_pem_len; +extern const size_t mbedtls_test_srv_key_rsa_pem_len; +extern const size_t mbedtls_test_srv_pwd_rsa_pem_len; +extern const size_t mbedtls_test_srv_crt_rsa_sha1_pem_len; +extern const size_t mbedtls_test_srv_crt_rsa_sha256_pem_len; + +extern const size_t mbedtls_test_srv_crt_ec_der_len; +extern const size_t mbedtls_test_srv_key_ec_der_len; +extern const size_t mbedtls_test_srv_pwd_ec_der_len; +extern const size_t mbedtls_test_srv_key_rsa_der_len; +extern const size_t mbedtls_test_srv_pwd_rsa_der_len; +extern const size_t mbedtls_test_srv_crt_rsa_sha1_der_len; +extern const size_t mbedtls_test_srv_crt_rsa_sha256_der_len; + +/* Config-dependent dispatch between PEM and DER encoding + * (PEM if enabled, otherwise DER) */ + +extern const char mbedtls_test_srv_crt_ec[]; +extern const char mbedtls_test_srv_key_ec[]; +extern const char mbedtls_test_srv_pwd_ec[]; +extern const char mbedtls_test_srv_key_rsa[]; +extern const char mbedtls_test_srv_pwd_rsa[]; +extern const char mbedtls_test_srv_crt_rsa_sha1[]; +extern const char mbedtls_test_srv_crt_rsa_sha256[]; + +extern const size_t mbedtls_test_srv_crt_ec_len; +extern const size_t mbedtls_test_srv_key_ec_len; +extern const size_t mbedtls_test_srv_pwd_ec_len; +extern const size_t mbedtls_test_srv_key_rsa_len; +extern const size_t mbedtls_test_srv_pwd_rsa_len; +extern const size_t mbedtls_test_srv_crt_rsa_sha1_len; +extern const size_t mbedtls_test_srv_crt_rsa_sha256_len; + +/* Config-dependent dispatch between SHA-1 and SHA-256 + * (SHA-256 if enabled, otherwise SHA-1) */ + +extern const char mbedtls_test_srv_crt_rsa[]; +extern const size_t mbedtls_test_srv_crt_rsa_len; + +/* Config-dependent dispatch between EC and RSA + * (RSA if enabled, otherwise EC) */ + +extern const char * mbedtls_test_srv_crt; +extern const char * mbedtls_test_srv_key; +extern const char * mbedtls_test_srv_pwd; +extern const size_t mbedtls_test_srv_crt_len; +extern const size_t mbedtls_test_srv_key_len; +extern const size_t mbedtls_test_srv_pwd_len; + +/* + * Client test certificates + */ + +extern const char mbedtls_test_cli_crt_ec_pem[]; +extern const char mbedtls_test_cli_key_ec_pem[]; +extern const char mbedtls_test_cli_pwd_ec_pem[]; +extern const char mbedtls_test_cli_key_rsa_pem[]; +extern const char mbedtls_test_cli_pwd_rsa_pem[]; +extern const char mbedtls_test_cli_crt_rsa_pem[]; + +extern const unsigned char mbedtls_test_cli_crt_ec_der[]; +extern const unsigned char mbedtls_test_cli_key_ec_der[]; +extern const unsigned char mbedtls_test_cli_key_rsa_der[]; +extern const unsigned char mbedtls_test_cli_crt_rsa_der[]; + +extern const size_t mbedtls_test_cli_crt_ec_pem_len; +extern const size_t mbedtls_test_cli_key_ec_pem_len; +extern const size_t mbedtls_test_cli_pwd_ec_pem_len; +extern const size_t mbedtls_test_cli_key_rsa_pem_len; +extern const size_t mbedtls_test_cli_pwd_rsa_pem_len; +extern const size_t mbedtls_test_cli_crt_rsa_pem_len; + +extern const size_t mbedtls_test_cli_crt_ec_der_len; +extern const size_t mbedtls_test_cli_key_ec_der_len; +extern const size_t mbedtls_test_cli_key_rsa_der_len; +extern const size_t mbedtls_test_cli_crt_rsa_der_len; + +/* Config-dependent dispatch between PEM and DER encoding + * (PEM if enabled, otherwise DER) */ + +extern const char mbedtls_test_cli_crt_ec[]; +extern const char mbedtls_test_cli_key_ec[]; +extern const char mbedtls_test_cli_pwd_ec[]; +extern const char mbedtls_test_cli_key_rsa[]; +extern const char mbedtls_test_cli_pwd_rsa[]; +extern const char mbedtls_test_cli_crt_rsa[]; + +extern const size_t mbedtls_test_cli_crt_ec_len; +extern const size_t mbedtls_test_cli_key_ec_len; +extern const size_t mbedtls_test_cli_pwd_ec_len; +extern const size_t mbedtls_test_cli_key_rsa_len; +extern const size_t mbedtls_test_cli_pwd_rsa_len; +extern const size_t mbedtls_test_cli_crt_rsa_len; + +/* Config-dependent dispatch between EC and RSA + * (RSA if enabled, otherwise EC) */ + +extern const char * mbedtls_test_cli_crt; +extern const char * mbedtls_test_cli_key; +extern const char * mbedtls_test_cli_pwd; +extern const size_t mbedtls_test_cli_crt_len; +extern const size_t mbedtls_test_cli_key_len; +extern const size_t mbedtls_test_cli_pwd_len; + +#ifdef __cplusplus +} +#endif + +#endif /* certs.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/chacha20.h b/openharmony/arm64-v8a/include/mbedtls/chacha20.h new file mode 100644 index 00000000..03b48714 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/chacha20.h @@ -0,0 +1,228 @@ +/** + * \file chacha20.h + * + * \brief This file contains ChaCha20 definitions and functions. + * + * ChaCha20 is a stream cipher that can encrypt and decrypt + * information. ChaCha was created by Daniel Bernstein as a variant of + * its Salsa cipher https://cr.yp.to/chacha/chacha-20080128.pdf + * ChaCha20 is the variant with 20 rounds, that was also standardized + * in RFC 7539. + * + * \author Daniel King + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CHACHA20_H +#define MBEDTLS_CHACHA20_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +/** Invalid input parameter(s). */ +#define MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA -0x0051 + +/* MBEDTLS_ERR_CHACHA20_FEATURE_UNAVAILABLE is deprecated and should not be + * used. */ +/** Feature not available. For example, s part of the API is not implemented. */ +#define MBEDTLS_ERR_CHACHA20_FEATURE_UNAVAILABLE -0x0053 + +/* MBEDTLS_ERR_CHACHA20_HW_ACCEL_FAILED is deprecated and should not be used. + */ +/** Chacha20 hardware accelerator failed. */ +#define MBEDTLS_ERR_CHACHA20_HW_ACCEL_FAILED -0x0055 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_CHACHA20_ALT) + +typedef struct mbedtls_chacha20_context +{ + uint32_t state[16]; /*! The state (before round operations). */ + uint8_t keystream8[64]; /*! Leftover keystream bytes. */ + size_t keystream_bytes_used; /*! Number of keystream bytes already used. */ +} +mbedtls_chacha20_context; + +#else /* MBEDTLS_CHACHA20_ALT */ +#include "chacha20_alt.h" +#endif /* MBEDTLS_CHACHA20_ALT */ + +/** + * \brief This function initializes the specified ChaCha20 context. + * + * It must be the first API called before using + * the context. + * + * It is usually followed by calls to + * \c mbedtls_chacha20_setkey() and + * \c mbedtls_chacha20_starts(), then one or more calls to + * to \c mbedtls_chacha20_update(), and finally to + * \c mbedtls_chacha20_free(). + * + * \param ctx The ChaCha20 context to initialize. + * This must not be \c NULL. + */ +void mbedtls_chacha20_init( mbedtls_chacha20_context *ctx ); + +/** + * \brief This function releases and clears the specified + * ChaCha20 context. + * + * \param ctx The ChaCha20 context to clear. This may be \c NULL, + * in which case this function is a no-op. If it is not + * \c NULL, it must point to an initialized context. + * + */ +void mbedtls_chacha20_free( mbedtls_chacha20_context *ctx ); + +/** + * \brief This function sets the encryption/decryption key. + * + * \note After using this function, you must also call + * \c mbedtls_chacha20_starts() to set a nonce before you + * start encrypting/decrypting data with + * \c mbedtls_chacha_update(). + * + * \param ctx The ChaCha20 context to which the key should be bound. + * It must be initialized. + * \param key The encryption/decryption key. This must be \c 32 Bytes + * in length. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA if ctx or key is NULL. + */ +int mbedtls_chacha20_setkey( mbedtls_chacha20_context *ctx, + const unsigned char key[32] ); + +/** + * \brief This function sets the nonce and initial counter value. + * + * \note A ChaCha20 context can be re-used with the same key by + * calling this function to change the nonce. + * + * \warning You must never use the same nonce twice with the same key. + * This would void any confidentiality guarantees for the + * messages encrypted with the same nonce and key. + * + * \param ctx The ChaCha20 context to which the nonce should be bound. + * It must be initialized and bound to a key. + * \param nonce The nonce. This must be \c 12 Bytes in size. + * \param counter The initial counter value. This is usually \c 0. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA if ctx or nonce is + * NULL. + */ +int mbedtls_chacha20_starts( mbedtls_chacha20_context* ctx, + const unsigned char nonce[12], + uint32_t counter ); + +/** + * \brief This function encrypts or decrypts data. + * + * Since ChaCha20 is a stream cipher, the same operation is + * used for encrypting and decrypting data. + * + * \note The \p input and \p output pointers must either be equal or + * point to non-overlapping buffers. + * + * \note \c mbedtls_chacha20_setkey() and + * \c mbedtls_chacha20_starts() must be called at least once + * to setup the context before this function can be called. + * + * \note This function can be called multiple times in a row in + * order to encrypt of decrypt data piecewise with the same + * key and nonce. + * + * \param ctx The ChaCha20 context to use for encryption or decryption. + * It must be initialized and bound to a key and nonce. + * \param size The length of the input data in Bytes. + * \param input The buffer holding the input data. + * This pointer can be \c NULL if `size == 0`. + * \param output The buffer holding the output data. + * This must be able to hold \p size Bytes. + * This pointer can be \c NULL if `size == 0`. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_chacha20_update( mbedtls_chacha20_context *ctx, + size_t size, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function encrypts or decrypts data with ChaCha20 and + * the given key and nonce. + * + * Since ChaCha20 is a stream cipher, the same operation is + * used for encrypting and decrypting data. + * + * \warning You must never use the same (key, nonce) pair more than + * once. This would void any confidentiality guarantees for + * the messages encrypted with the same nonce and key. + * + * \note The \p input and \p output pointers must either be equal or + * point to non-overlapping buffers. + * + * \param key The encryption/decryption key. + * This must be \c 32 Bytes in length. + * \param nonce The nonce. This must be \c 12 Bytes in size. + * \param counter The initial counter value. This is usually \c 0. + * \param size The length of the input data in Bytes. + * \param input The buffer holding the input data. + * This pointer can be \c NULL if `size == 0`. + * \param output The buffer holding the output data. + * This must be able to hold \p size Bytes. + * This pointer can be \c NULL if `size == 0`. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_chacha20_crypt( const unsigned char key[32], + const unsigned char nonce[12], + uint32_t counter, + size_t size, + const unsigned char* input, + unsigned char* output ); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief The ChaCha20 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_chacha20_self_test( int verbose ); +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CHACHA20_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/chachapoly.h b/openharmony/arm64-v8a/include/mbedtls/chachapoly.h new file mode 100644 index 00000000..ed568bc9 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/chachapoly.h @@ -0,0 +1,359 @@ +/** + * \file chachapoly.h + * + * \brief This file contains the AEAD-ChaCha20-Poly1305 definitions and + * functions. + * + * ChaCha20-Poly1305 is an algorithm for Authenticated Encryption + * with Associated Data (AEAD) that can be used to encrypt and + * authenticate data. It is based on ChaCha20 and Poly1305 by Daniel + * Bernstein and was standardized in RFC 7539. + * + * \author Daniel King + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CHACHAPOLY_H +#define MBEDTLS_CHACHAPOLY_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +/* for shared error codes */ +#include "mbedtls/poly1305.h" + +/** The requested operation is not permitted in the current state. */ +#define MBEDTLS_ERR_CHACHAPOLY_BAD_STATE -0x0054 +/** Authenticated decryption failed: data was not authentic. */ +#define MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED -0x0056 + +#ifdef __cplusplus +extern "C" { +#endif + +typedef enum +{ + MBEDTLS_CHACHAPOLY_ENCRYPT, /**< The mode value for performing encryption. */ + MBEDTLS_CHACHAPOLY_DECRYPT /**< The mode value for performing decryption. */ +} +mbedtls_chachapoly_mode_t; + +#if !defined(MBEDTLS_CHACHAPOLY_ALT) + +#include "mbedtls/chacha20.h" + +typedef struct mbedtls_chachapoly_context +{ + mbedtls_chacha20_context chacha20_ctx; /**< The ChaCha20 context. */ + mbedtls_poly1305_context poly1305_ctx; /**< The Poly1305 context. */ + uint64_t aad_len; /**< The length (bytes) of the Additional Authenticated Data. */ + uint64_t ciphertext_len; /**< The length (bytes) of the ciphertext. */ + int state; /**< The current state of the context. */ + mbedtls_chachapoly_mode_t mode; /**< Cipher mode (encrypt or decrypt). */ +} +mbedtls_chachapoly_context; + +#else /* !MBEDTLS_CHACHAPOLY_ALT */ +#include "chachapoly_alt.h" +#endif /* !MBEDTLS_CHACHAPOLY_ALT */ + +/** + * \brief This function initializes the specified ChaCha20-Poly1305 context. + * + * It must be the first API called before using + * the context. It must be followed by a call to + * \c mbedtls_chachapoly_setkey() before any operation can be + * done, and to \c mbedtls_chachapoly_free() once all + * operations with that context have been finished. + * + * In order to encrypt or decrypt full messages at once, for + * each message you should make a single call to + * \c mbedtls_chachapoly_crypt_and_tag() or + * \c mbedtls_chachapoly_auth_decrypt(). + * + * In order to encrypt messages piecewise, for each + * message you should make a call to + * \c mbedtls_chachapoly_starts(), then 0 or more calls to + * \c mbedtls_chachapoly_update_aad(), then 0 or more calls to + * \c mbedtls_chachapoly_update(), then one call to + * \c mbedtls_chachapoly_finish(). + * + * \warning Decryption with the piecewise API is discouraged! Always + * use \c mbedtls_chachapoly_auth_decrypt() when possible! + * + * If however this is not possible because the data is too + * large to fit in memory, you need to: + * + * - call \c mbedtls_chachapoly_starts() and (if needed) + * \c mbedtls_chachapoly_update_aad() as above, + * - call \c mbedtls_chachapoly_update() multiple times and + * ensure its output (the plaintext) is NOT used in any other + * way than placing it in temporary storage at this point, + * - call \c mbedtls_chachapoly_finish() to compute the + * authentication tag and compared it in constant time to the + * tag received with the ciphertext. + * + * If the tags are not equal, you must immediately discard + * all previous outputs of \c mbedtls_chachapoly_update(), + * otherwise you can now safely use the plaintext. + * + * \param ctx The ChachaPoly context to initialize. Must not be \c NULL. + */ +void mbedtls_chachapoly_init( mbedtls_chachapoly_context *ctx ); + +/** + * \brief This function releases and clears the specified + * ChaCha20-Poly1305 context. + * + * \param ctx The ChachaPoly context to clear. This may be \c NULL, in which + * case this function is a no-op. + */ +void mbedtls_chachapoly_free( mbedtls_chachapoly_context *ctx ); + +/** + * \brief This function sets the ChaCha20-Poly1305 + * symmetric encryption key. + * + * \param ctx The ChaCha20-Poly1305 context to which the key should be + * bound. This must be initialized. + * \param key The \c 256 Bit (\c 32 Bytes) key. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_chachapoly_setkey( mbedtls_chachapoly_context *ctx, + const unsigned char key[32] ); + +/** + * \brief This function starts a ChaCha20-Poly1305 encryption or + * decryption operation. + * + * \warning You must never use the same nonce twice with the same key. + * This would void any confidentiality and authenticity + * guarantees for the messages encrypted with the same nonce + * and key. + * + * \note If the context is being used for AAD only (no data to + * encrypt or decrypt) then \p mode can be set to any value. + * + * \warning Decryption with the piecewise API is discouraged, see the + * warning on \c mbedtls_chachapoly_init(). + * + * \param ctx The ChaCha20-Poly1305 context. This must be initialized + * and bound to a key. + * \param nonce The nonce/IV to use for the message. + * This must be a readable buffer of length \c 12 Bytes. + * \param mode The operation to perform: #MBEDTLS_CHACHAPOLY_ENCRYPT or + * #MBEDTLS_CHACHAPOLY_DECRYPT (discouraged, see warning). + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_chachapoly_starts( mbedtls_chachapoly_context *ctx, + const unsigned char nonce[12], + mbedtls_chachapoly_mode_t mode ); + +/** + * \brief This function feeds additional data to be authenticated + * into an ongoing ChaCha20-Poly1305 operation. + * + * The Additional Authenticated Data (AAD), also called + * Associated Data (AD) is only authenticated but not + * encrypted nor included in the encrypted output. It is + * usually transmitted separately from the ciphertext or + * computed locally by each party. + * + * \note This function is called before data is encrypted/decrypted. + * I.e. call this function to process the AAD before calling + * \c mbedtls_chachapoly_update(). + * + * You may call this function multiple times to process + * an arbitrary amount of AAD. It is permitted to call + * this function 0 times, if no AAD is used. + * + * This function cannot be called any more if data has + * been processed by \c mbedtls_chachapoly_update(), + * or if the context has been finished. + * + * \warning Decryption with the piecewise API is discouraged, see the + * warning on \c mbedtls_chachapoly_init(). + * + * \param ctx The ChaCha20-Poly1305 context. This must be initialized + * and bound to a key. + * \param aad_len The length in Bytes of the AAD. The length has no + * restrictions. + * \param aad Buffer containing the AAD. + * This pointer can be \c NULL if `aad_len == 0`. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA + * if \p ctx or \p aad are NULL. + * \return #MBEDTLS_ERR_CHACHAPOLY_BAD_STATE + * if the operations has not been started or has been + * finished, or if the AAD has been finished. + */ +int mbedtls_chachapoly_update_aad( mbedtls_chachapoly_context *ctx, + const unsigned char *aad, + size_t aad_len ); + +/** + * \brief Thus function feeds data to be encrypted or decrypted + * into an on-going ChaCha20-Poly1305 + * operation. + * + * The direction (encryption or decryption) depends on the + * mode that was given when calling + * \c mbedtls_chachapoly_starts(). + * + * You may call this function multiple times to process + * an arbitrary amount of data. It is permitted to call + * this function 0 times, if no data is to be encrypted + * or decrypted. + * + * \warning Decryption with the piecewise API is discouraged, see the + * warning on \c mbedtls_chachapoly_init(). + * + * \param ctx The ChaCha20-Poly1305 context to use. This must be initialized. + * \param len The length (in bytes) of the data to encrypt or decrypt. + * \param input The buffer containing the data to encrypt or decrypt. + * This pointer can be \c NULL if `len == 0`. + * \param output The buffer to where the encrypted or decrypted data is + * written. This must be able to hold \p len bytes. + * This pointer can be \c NULL if `len == 0`. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CHACHAPOLY_BAD_STATE + * if the operation has not been started or has been + * finished. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_chachapoly_update( mbedtls_chachapoly_context *ctx, + size_t len, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function finished the ChaCha20-Poly1305 operation and + * generates the MAC (authentication tag). + * + * \param ctx The ChaCha20-Poly1305 context to use. This must be initialized. + * \param mac The buffer to where the 128-bit (16 bytes) MAC is written. + * + * \warning Decryption with the piecewise API is discouraged, see the + * warning on \c mbedtls_chachapoly_init(). + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CHACHAPOLY_BAD_STATE + * if the operation has not been started or has been + * finished. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_chachapoly_finish( mbedtls_chachapoly_context *ctx, + unsigned char mac[16] ); + +/** + * \brief This function performs a complete ChaCha20-Poly1305 + * authenticated encryption with the previously-set key. + * + * \note Before using this function, you must set the key with + * \c mbedtls_chachapoly_setkey(). + * + * \warning You must never use the same nonce twice with the same key. + * This would void any confidentiality and authenticity + * guarantees for the messages encrypted with the same nonce + * and key. + * + * \param ctx The ChaCha20-Poly1305 context to use (holds the key). + * This must be initialized. + * \param length The length (in bytes) of the data to encrypt or decrypt. + * \param nonce The 96-bit (12 bytes) nonce/IV to use. + * \param aad The buffer containing the additional authenticated + * data (AAD). This pointer can be \c NULL if `aad_len == 0`. + * \param aad_len The length (in bytes) of the AAD data to process. + * \param input The buffer containing the data to encrypt or decrypt. + * This pointer can be \c NULL if `ilen == 0`. + * \param output The buffer to where the encrypted or decrypted data + * is written. This pointer can be \c NULL if `ilen == 0`. + * \param tag The buffer to where the computed 128-bit (16 bytes) MAC + * is written. This must not be \c NULL. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_chachapoly_encrypt_and_tag( mbedtls_chachapoly_context *ctx, + size_t length, + const unsigned char nonce[12], + const unsigned char *aad, + size_t aad_len, + const unsigned char *input, + unsigned char *output, + unsigned char tag[16] ); + +/** + * \brief This function performs a complete ChaCha20-Poly1305 + * authenticated decryption with the previously-set key. + * + * \note Before using this function, you must set the key with + * \c mbedtls_chachapoly_setkey(). + * + * \param ctx The ChaCha20-Poly1305 context to use (holds the key). + * \param length The length (in Bytes) of the data to decrypt. + * \param nonce The \c 96 Bit (\c 12 bytes) nonce/IV to use. + * \param aad The buffer containing the additional authenticated data (AAD). + * This pointer can be \c NULL if `aad_len == 0`. + * \param aad_len The length (in bytes) of the AAD data to process. + * \param tag The buffer holding the authentication tag. + * This must be a readable buffer of length \c 16 Bytes. + * \param input The buffer containing the data to decrypt. + * This pointer can be \c NULL if `ilen == 0`. + * \param output The buffer to where the decrypted data is written. + * This pointer can be \c NULL if `ilen == 0`. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED + * if the data was not authentic. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_chachapoly_auth_decrypt( mbedtls_chachapoly_context *ctx, + size_t length, + const unsigned char nonce[12], + const unsigned char *aad, + size_t aad_len, + const unsigned char tag[16], + const unsigned char *input, + unsigned char *output ); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief The ChaCha20-Poly1305 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_chachapoly_self_test( int verbose ); +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CHACHAPOLY_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/check_config.h b/openharmony/arm64-v8a/include/mbedtls/check_config.h new file mode 100644 index 00000000..be5c548e --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/check_config.h @@ -0,0 +1,936 @@ +/** + * \file check_config.h + * + * \brief Consistency checks for configuration options + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/* + * It is recommended to include this file from your config.h + * in order to catch dependency issues early. + */ + +#ifndef MBEDTLS_CHECK_CONFIG_H +#define MBEDTLS_CHECK_CONFIG_H + +/* + * We assume CHAR_BIT is 8 in many places. In practice, this is true on our + * target platforms, so not an issue, but let's just be extra sure. + */ +#include +#if CHAR_BIT != 8 +#error "mbed TLS requires a platform with 8-bit chars" +#endif + +#if defined(_WIN32) +#if !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_C is required on Windows" +#endif + +/* Fix the config here. Not convenient to put an #ifdef _WIN32 in config.h as + * it would confuse config.py. */ +#if !defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) && \ + !defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) +#define MBEDTLS_PLATFORM_SNPRINTF_ALT +#endif + +#if !defined(MBEDTLS_PLATFORM_VSNPRINTF_ALT) && \ + !defined(MBEDTLS_PLATFORM_VSNPRINTF_MACRO) +#define MBEDTLS_PLATFORM_VSNPRINTF_ALT +#endif +#endif /* _WIN32 */ + +#if defined(TARGET_LIKE_MBED) && defined(MBEDTLS_NET_C) +#error "The NET module is not available for mbed OS - please use the network functions provided by Mbed OS" +#endif + +#if defined(MBEDTLS_DEPRECATED_WARNING) && \ + !defined(__GNUC__) && !defined(__clang__) +#error "MBEDTLS_DEPRECATED_WARNING only works with GCC and Clang" +#endif + +#if defined(MBEDTLS_HAVE_TIME_DATE) && !defined(MBEDTLS_HAVE_TIME) +#error "MBEDTLS_HAVE_TIME_DATE without MBEDTLS_HAVE_TIME does not make sense" +#endif + +#if defined(MBEDTLS_AESNI_C) && !defined(MBEDTLS_HAVE_ASM) +#error "MBEDTLS_AESNI_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_CTR_DRBG_C) && !defined(MBEDTLS_AES_C) +#error "MBEDTLS_CTR_DRBG_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_DHM_C) && !defined(MBEDTLS_BIGNUM_C) +#error "MBEDTLS_DHM_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT) && !defined(MBEDTLS_SSL_TRUNCATED_HMAC) +#error "MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_CMAC_C) && \ + !defined(MBEDTLS_AES_C) && !defined(MBEDTLS_DES_C) +#error "MBEDTLS_CMAC_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_NIST_KW_C) && \ + ( !defined(MBEDTLS_AES_C) || !defined(MBEDTLS_CIPHER_C) ) +#error "MBEDTLS_NIST_KW_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECDH_C) && !defined(MBEDTLS_ECP_C) +#error "MBEDTLS_ECDH_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECDSA_C) && \ + ( !defined(MBEDTLS_ECP_C) || \ + !( defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) ) || \ + !defined(MBEDTLS_ASN1_PARSE_C) || \ + !defined(MBEDTLS_ASN1_WRITE_C) ) +#error "MBEDTLS_ECDSA_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECJPAKE_C) && \ + ( !defined(MBEDTLS_ECP_C) || !defined(MBEDTLS_MD_C) ) +#error "MBEDTLS_ECJPAKE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_RESTARTABLE) && \ + ( defined(MBEDTLS_USE_PSA_CRYPTO) || \ + defined(MBEDTLS_ECDH_COMPUTE_SHARED_ALT) || \ + defined(MBEDTLS_ECDH_GEN_PUBLIC_ALT) || \ + defined(MBEDTLS_ECDSA_SIGN_ALT) || \ + defined(MBEDTLS_ECDSA_VERIFY_ALT) || \ + defined(MBEDTLS_ECDSA_GENKEY_ALT) || \ + defined(MBEDTLS_ECP_INTERNAL_ALT) || \ + defined(MBEDTLS_ECP_ALT) ) +#error "MBEDTLS_ECP_RESTARTABLE defined, but it cannot coexist with an alternative or PSA-based ECP implementation" +#endif + +#if defined(MBEDTLS_ECP_RESTARTABLE) && \ + ! defined(MBEDTLS_ECDH_LEGACY_CONTEXT) +#error "MBEDTLS_ECP_RESTARTABLE defined, but not MBEDTLS_ECDH_LEGACY_CONTEXT" +#endif + +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) && \ + defined(MBEDTLS_ECDH_LEGACY_CONTEXT) +#error "MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED defined, but MBEDTLS_ECDH_LEGACY_CONTEXT not disabled" +#endif + +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) && !defined(MBEDTLS_HMAC_DRBG_C) +#error "MBEDTLS_ECDSA_DETERMINISTIC defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_C) && ( !defined(MBEDTLS_BIGNUM_C) || ( \ + !defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) ) ) +#error "MBEDTLS_ECP_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_C) && !( \ + defined(MBEDTLS_ECP_ALT) || \ + defined(MBEDTLS_CTR_DRBG_C) || \ + defined(MBEDTLS_HMAC_DRBG_C) || \ + defined(MBEDTLS_ECP_NO_INTERNAL_RNG)) +#error "MBEDTLS_ECP_C requires a DRBG module unless MBEDTLS_ECP_NO_INTERNAL_RNG is defined or an alternative implementation is used" +#endif + +#if defined(MBEDTLS_PK_PARSE_C) && !defined(MBEDTLS_ASN1_PARSE_C) +#error "MBEDTLS_PK_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PKCS5_C) && !defined(MBEDTLS_MD_C) +#error "MBEDTLS_PKCS5_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ENTROPY_C) && (!defined(MBEDTLS_SHA512_C) && \ + !defined(MBEDTLS_SHA256_C)) +#error "MBEDTLS_ENTROPY_C defined, but not all prerequisites" +#endif +#if defined(MBEDTLS_ENTROPY_C) && defined(MBEDTLS_SHA512_C) && \ + defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) && (MBEDTLS_CTR_DRBG_ENTROPY_LEN > 64) +#error "MBEDTLS_CTR_DRBG_ENTROPY_LEN value too high" +#endif +#if defined(MBEDTLS_ENTROPY_C) && \ + ( !defined(MBEDTLS_SHA512_C) || defined(MBEDTLS_ENTROPY_FORCE_SHA256) ) \ + && defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) && (MBEDTLS_CTR_DRBG_ENTROPY_LEN > 32) +#error "MBEDTLS_CTR_DRBG_ENTROPY_LEN value too high" +#endif +#if defined(MBEDTLS_ENTROPY_C) && \ + defined(MBEDTLS_ENTROPY_FORCE_SHA256) && !defined(MBEDTLS_SHA256_C) +#error "MBEDTLS_ENTROPY_FORCE_SHA256 defined, but not all prerequisites" +#endif + +#if defined(__has_feature) +#if __has_feature(memory_sanitizer) +#define MBEDTLS_HAS_MEMSAN +#endif +#endif +#if defined(MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN) && !defined(MBEDTLS_HAS_MEMSAN) +#error "MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN requires building with MemorySanitizer" +#endif +#undef MBEDTLS_HAS_MEMSAN + +#if defined(MBEDTLS_TEST_NULL_ENTROPY) && \ + ( !defined(MBEDTLS_ENTROPY_C) || !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES) ) +#error "MBEDTLS_TEST_NULL_ENTROPY defined, but not all prerequisites" +#endif +#if defined(MBEDTLS_TEST_NULL_ENTROPY) && \ + ( defined(MBEDTLS_ENTROPY_NV_SEED) || defined(MBEDTLS_ENTROPY_HARDWARE_ALT) || \ + defined(MBEDTLS_HAVEGE_C) ) +#error "MBEDTLS_TEST_NULL_ENTROPY defined, but entropy sources too" +#endif + +#if defined(MBEDTLS_CCM_C) && ( \ + !defined(MBEDTLS_AES_C) && !defined(MBEDTLS_CAMELLIA_C) && !defined(MBEDTLS_ARIA_C) ) +#error "MBEDTLS_CCM_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_CCM_C) && !defined(MBEDTLS_CIPHER_C) +#error "MBEDTLS_CCM_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_GCM_C) && ( \ + !defined(MBEDTLS_AES_C) && !defined(MBEDTLS_CAMELLIA_C) && !defined(MBEDTLS_ARIA_C) ) +#error "MBEDTLS_GCM_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_GCM_C) && !defined(MBEDTLS_CIPHER_C) +#error "MBEDTLS_GCM_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_CHACHAPOLY_C) && !defined(MBEDTLS_CHACHA20_C) +#error "MBEDTLS_CHACHAPOLY_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_CHACHAPOLY_C) && !defined(MBEDTLS_POLY1305_C) +#error "MBEDTLS_CHACHAPOLY_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_RANDOMIZE_JAC_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_ADD_MIXED_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_ADD_MIXED_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_DOUBLE_JAC_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_NORMALIZE_JAC_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_RANDOMIZE_MXZ_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_NORMALIZE_MXZ_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_NO_FALLBACK) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_NO_FALLBACK defined, but no alternative implementation enabled" +#endif + +#if defined(MBEDTLS_HAVEGE_C) && !defined(MBEDTLS_TIMING_C) +#error "MBEDTLS_HAVEGE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_HKDF_C) && !defined(MBEDTLS_MD_C) +#error "MBEDTLS_HKDF_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_HMAC_DRBG_C) && !defined(MBEDTLS_MD_C) +#error "MBEDTLS_HMAC_DRBG_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) && \ + ( !defined(MBEDTLS_ECDH_C) || !defined(MBEDTLS_ECDSA_C) || \ + !defined(MBEDTLS_X509_CRT_PARSE_C) ) +#error "MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \ + ( !defined(MBEDTLS_ECDH_C) || !defined(MBEDTLS_RSA_C) || \ + !defined(MBEDTLS_X509_CRT_PARSE_C) ) +#error "MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) && !defined(MBEDTLS_DHM_C) +#error "MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) && \ + !defined(MBEDTLS_ECDH_C) +#error "MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \ + ( !defined(MBEDTLS_DHM_C) || !defined(MBEDTLS_RSA_C) || \ + !defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_PKCS1_V15) ) +#error "MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \ + ( !defined(MBEDTLS_ECDH_C) || !defined(MBEDTLS_RSA_C) || \ + !defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_PKCS1_V15) ) +#error "MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \ + ( !defined(MBEDTLS_ECDH_C) || !defined(MBEDTLS_ECDSA_C) || \ + !defined(MBEDTLS_X509_CRT_PARSE_C) ) +#error "MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) && \ + ( !defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_X509_CRT_PARSE_C) || \ + !defined(MBEDTLS_PKCS1_V15) ) +#error "MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \ + ( !defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_X509_CRT_PARSE_C) || \ + !defined(MBEDTLS_PKCS1_V15) ) +#error "MBEDTLS_KEY_EXCHANGE_RSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) && \ + ( !defined(MBEDTLS_ECJPAKE_C) || !defined(MBEDTLS_SHA256_C) || \ + !defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) ) +#error "MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) && \ + !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) && \ + ( !defined(MBEDTLS_SHA256_C) && \ + !defined(MBEDTLS_SHA512_C) && \ + !defined(MBEDTLS_SHA1_C) ) +#error "!MBEDTLS_SSL_KEEP_PEER_CERTIFICATE requires MBEDTLS_SHA512_C, MBEDTLS_SHA256_C or MBEDTLS_SHA1_C" +#endif + +#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) && \ + ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_PLATFORM_MEMORY) ) +#error "MBEDTLS_MEMORY_BUFFER_ALLOC_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_MEMORY_BACKTRACE) && !defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) +#error "MBEDTLS_MEMORY_BACKTRACE defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_MEMORY_DEBUG) && !defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) +#error "MBEDTLS_MEMORY_DEBUG defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PADLOCK_C) && !defined(MBEDTLS_HAVE_ASM) +#error "MBEDTLS_PADLOCK_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PEM_PARSE_C) && !defined(MBEDTLS_BASE64_C) +#error "MBEDTLS_PEM_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PEM_WRITE_C) && !defined(MBEDTLS_BASE64_C) +#error "MBEDTLS_PEM_WRITE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PK_C) && \ + ( !defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_ECP_C) ) +#error "MBEDTLS_PK_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PK_PARSE_C) && !defined(MBEDTLS_PK_C) +#error "MBEDTLS_PK_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PK_WRITE_C) && !defined(MBEDTLS_PK_C) +#error "MBEDTLS_PK_WRITE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PKCS11_C) && !defined(MBEDTLS_PK_C) +#error "MBEDTLS_PKCS11_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PKCS11_C) +#if defined(MBEDTLS_DEPRECATED_REMOVED) +#error "MBEDTLS_PKCS11_C is deprecated and will be removed in a future version of Mbed TLS" +#elif defined(MBEDTLS_DEPRECATED_WARNING) +#warning "MBEDTLS_PKCS11_C is deprecated and will be removed in a future version of Mbed TLS" +#endif +#endif /* MBEDTLS_PKCS11_C */ + +#if defined(MBEDTLS_PLATFORM_EXIT_ALT) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_EXIT_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_EXIT_MACRO) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_EXIT_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_EXIT_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_EXIT) ||\ + defined(MBEDTLS_PLATFORM_EXIT_ALT) ) +#error "MBEDTLS_PLATFORM_EXIT_MACRO and MBEDTLS_PLATFORM_STD_EXIT/MBEDTLS_PLATFORM_EXIT_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_TIME_ALT) &&\ + ( !defined(MBEDTLS_PLATFORM_C) ||\ + !defined(MBEDTLS_HAVE_TIME) ) +#error "MBEDTLS_PLATFORM_TIME_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_TIME_MACRO) &&\ + ( !defined(MBEDTLS_PLATFORM_C) ||\ + !defined(MBEDTLS_HAVE_TIME) ) +#error "MBEDTLS_PLATFORM_TIME_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_TIME_TYPE_MACRO) &&\ + ( !defined(MBEDTLS_PLATFORM_C) ||\ + !defined(MBEDTLS_HAVE_TIME) ) +#error "MBEDTLS_PLATFORM_TIME_TYPE_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_TIME_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_TIME) ||\ + defined(MBEDTLS_PLATFORM_TIME_ALT) ) +#error "MBEDTLS_PLATFORM_TIME_MACRO and MBEDTLS_PLATFORM_STD_TIME/MBEDTLS_PLATFORM_TIME_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_TIME_TYPE_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_TIME) ||\ + defined(MBEDTLS_PLATFORM_TIME_ALT) ) +#error "MBEDTLS_PLATFORM_TIME_TYPE_MACRO and MBEDTLS_PLATFORM_STD_TIME/MBEDTLS_PLATFORM_TIME_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_FPRINTF_ALT) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_FPRINTF_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_FPRINTF_MACRO) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_FPRINTF_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_FPRINTF_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_FPRINTF) ||\ + defined(MBEDTLS_PLATFORM_FPRINTF_ALT) ) +#error "MBEDTLS_PLATFORM_FPRINTF_MACRO and MBEDTLS_PLATFORM_STD_FPRINTF/MBEDTLS_PLATFORM_FPRINTF_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_FREE_MACRO) &&\ + ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_PLATFORM_MEMORY) ) +#error "MBEDTLS_PLATFORM_FREE_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_FREE_MACRO) &&\ + defined(MBEDTLS_PLATFORM_STD_FREE) +#error "MBEDTLS_PLATFORM_FREE_MACRO and MBEDTLS_PLATFORM_STD_FREE cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_FREE_MACRO) && !defined(MBEDTLS_PLATFORM_CALLOC_MACRO) +#error "MBEDTLS_PLATFORM_CALLOC_MACRO must be defined if MBEDTLS_PLATFORM_FREE_MACRO is" +#endif + +#if defined(MBEDTLS_PLATFORM_CALLOC_MACRO) &&\ + ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_PLATFORM_MEMORY) ) +#error "MBEDTLS_PLATFORM_CALLOC_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_CALLOC_MACRO) &&\ + defined(MBEDTLS_PLATFORM_STD_CALLOC) +#error "MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_STD_CALLOC cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_CALLOC_MACRO) && !defined(MBEDTLS_PLATFORM_FREE_MACRO) +#error "MBEDTLS_PLATFORM_FREE_MACRO must be defined if MBEDTLS_PLATFORM_CALLOC_MACRO is" +#endif + +#if defined(MBEDTLS_PLATFORM_MEMORY) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_MEMORY defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_PRINTF_ALT) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_PRINTF_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_PRINTF_MACRO) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_PRINTF_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_PRINTF_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_PRINTF) ||\ + defined(MBEDTLS_PLATFORM_PRINTF_ALT) ) +#error "MBEDTLS_PLATFORM_PRINTF_MACRO and MBEDTLS_PLATFORM_STD_PRINTF/MBEDTLS_PLATFORM_PRINTF_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_SNPRINTF_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_SNPRINTF_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_SNPRINTF) ||\ + defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) ) +#error "MBEDTLS_PLATFORM_SNPRINTF_MACRO and MBEDTLS_PLATFORM_STD_SNPRINTF/MBEDTLS_PLATFORM_SNPRINTF_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_MEM_HDR) &&\ + !defined(MBEDTLS_PLATFORM_NO_STD_FUNCTIONS) +#error "MBEDTLS_PLATFORM_STD_MEM_HDR defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_CALLOC) && !defined(MBEDTLS_PLATFORM_MEMORY) +#error "MBEDTLS_PLATFORM_STD_CALLOC defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_FREE) && !defined(MBEDTLS_PLATFORM_MEMORY) +#error "MBEDTLS_PLATFORM_STD_FREE defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_EXIT) &&\ + !defined(MBEDTLS_PLATFORM_EXIT_ALT) +#error "MBEDTLS_PLATFORM_STD_EXIT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_TIME) &&\ + ( !defined(MBEDTLS_PLATFORM_TIME_ALT) ||\ + !defined(MBEDTLS_HAVE_TIME) ) +#error "MBEDTLS_PLATFORM_STD_TIME defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_FPRINTF) &&\ + !defined(MBEDTLS_PLATFORM_FPRINTF_ALT) +#error "MBEDTLS_PLATFORM_STD_FPRINTF defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_PRINTF) &&\ + !defined(MBEDTLS_PLATFORM_PRINTF_ALT) +#error "MBEDTLS_PLATFORM_STD_PRINTF defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_SNPRINTF) &&\ + !defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) +#error "MBEDTLS_PLATFORM_STD_SNPRINTF defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ENTROPY_NV_SEED) &&\ + ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_ENTROPY_C) ) +#error "MBEDTLS_ENTROPY_NV_SEED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_NV_SEED_ALT) &&\ + !defined(MBEDTLS_ENTROPY_NV_SEED) +#error "MBEDTLS_PLATFORM_NV_SEED_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_NV_SEED_READ) &&\ + !defined(MBEDTLS_PLATFORM_NV_SEED_ALT) +#error "MBEDTLS_PLATFORM_STD_NV_SEED_READ defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_NV_SEED_WRITE) &&\ + !defined(MBEDTLS_PLATFORM_NV_SEED_ALT) +#error "MBEDTLS_PLATFORM_STD_NV_SEED_WRITE defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_NV_SEED_READ_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_NV_SEED_READ) ||\ + defined(MBEDTLS_PLATFORM_NV_SEED_ALT) ) +#error "MBEDTLS_PLATFORM_NV_SEED_READ_MACRO and MBEDTLS_PLATFORM_STD_NV_SEED_READ cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_NV_SEED_WRITE) ||\ + defined(MBEDTLS_PLATFORM_NV_SEED_ALT) ) +#error "MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO and MBEDTLS_PLATFORM_STD_NV_SEED_WRITE cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_C) && \ + !( ( ( defined(MBEDTLS_CTR_DRBG_C) || defined(MBEDTLS_HMAC_DRBG_C) ) && \ + defined(MBEDTLS_ENTROPY_C) ) || \ + defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) ) +#error "MBEDTLS_PSA_CRYPTO_C defined, but not all prerequisites (missing RNG)" +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_SPM) && !defined(MBEDTLS_PSA_CRYPTO_C) +#error "MBEDTLS_PSA_CRYPTO_SPM defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_SE_C) && \ + ! ( defined(MBEDTLS_PSA_CRYPTO_C) && \ + defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) ) +#error "MBEDTLS_PSA_CRYPTO_SE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \ + ! defined(MBEDTLS_PSA_CRYPTO_C) +#error "MBEDTLS_PSA_CRYPTO_STORAGE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \ + !( defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \ + defined(MBEDTLS_ENTROPY_NV_SEED) ) +#error "MBEDTLS_PSA_INJECT_ENTROPY defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \ + !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES) +#error "MBEDTLS_PSA_INJECT_ENTROPY is not compatible with actual entropy sources" +#endif + +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \ + defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) +#error "MBEDTLS_PSA_INJECT_ENTROPY is not compatible with MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG" +#endif + +#if defined(MBEDTLS_PSA_ITS_FILE_C) && \ + !defined(MBEDTLS_FS_IO) +#error "MBEDTLS_PSA_ITS_FILE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER) && \ + defined(MBEDTLS_USE_PSA_CRYPTO) +#error "MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER defined, but it cannot coexist with MBEDTLS_USE_PSA_CRYPTO." +#endif + +#if defined(MBEDTLS_PK_C) && defined(MBEDTLS_USE_PSA_CRYPTO) && \ + !defined(MBEDTLS_PK_WRITE_C) && defined(MBEDTLS_ECDSA_C) +#error "MBEDTLS_PK_C in configuration with MBEDTLS_USE_PSA_CRYPTO and \ + MBEDTLS_ECDSA_C requires MBEDTLS_PK_WRITE_C to be defined." +#endif + +#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V15) && \ + !defined(MBEDTLS_PK_WRITE_C) && defined(MBEDTLS_PSA_CRYPTO_C) +#error "MBEDTLS_PSA_CRYPTO_C, MBEDTLS_RSA_C and MBEDTLS_PKCS1_V15 defined, \ + but not all prerequisites" +#endif + +#if defined(MBEDTLS_RSA_C) && ( !defined(MBEDTLS_BIGNUM_C) || \ + !defined(MBEDTLS_OID_C) ) +#error "MBEDTLS_RSA_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_RSA_C) && ( !defined(MBEDTLS_PKCS1_V21) && \ + !defined(MBEDTLS_PKCS1_V15) ) +#error "MBEDTLS_RSA_C defined, but none of the PKCS1 versions enabled" +#endif + +#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \ + ( !defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_PKCS1_V21) ) +#error "MBEDTLS_X509_RSASSA_PSS_SUPPORT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SHA512_NO_SHA384) && !defined(MBEDTLS_SHA512_C) +#error "MBEDTLS_SHA512_NO_SHA384 defined without MBEDTLS_SHA512_C" +#endif + +#if defined(MBEDTLS_SSL_PROTO_SSL3) && ( !defined(MBEDTLS_MD5_C) || \ + !defined(MBEDTLS_SHA1_C) ) +#error "MBEDTLS_SSL_PROTO_SSL3 defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1) && ( !defined(MBEDTLS_MD5_C) || \ + !defined(MBEDTLS_SHA1_C) ) +#error "MBEDTLS_SSL_PROTO_TLS1 defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1_1) && ( !defined(MBEDTLS_MD5_C) || \ + !defined(MBEDTLS_SHA1_C) ) +#error "MBEDTLS_SSL_PROTO_TLS1_1 defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && ( !defined(MBEDTLS_SHA1_C) && \ + !defined(MBEDTLS_SHA256_C) && !defined(MBEDTLS_SHA512_C) ) +#error "MBEDTLS_SSL_PROTO_TLS1_2 defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL) && ( !defined(MBEDTLS_HKDF_C) && \ + !defined(MBEDTLS_SHA256_C) && !defined(MBEDTLS_SHA512_C) ) +#error "MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL defined, but not all prerequisites" +#endif + +#if (defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ + defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)) && \ + !(defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) ) +#error "One or more versions of the TLS protocol are enabled " \ + "but no key exchange methods defined with MBEDTLS_KEY_EXCHANGE_xxxx" +#endif + +#if defined(MBEDTLS_SSL_PROTO_DTLS) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_1) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_2) +#error "MBEDTLS_SSL_PROTO_DTLS defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_CLI_C) && !defined(MBEDTLS_SSL_TLS_C) +#error "MBEDTLS_SSL_CLI_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_TLS_C) && ( !defined(MBEDTLS_CIPHER_C) || \ + !defined(MBEDTLS_MD_C) ) +#error "MBEDTLS_SSL_TLS_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_TLS_C) +#error "MBEDTLS_SSL_SRV_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_TLS_C) && (!defined(MBEDTLS_SSL_PROTO_SSL3) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1) && !defined(MBEDTLS_SSL_PROTO_TLS1_1) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_2)) +#error "MBEDTLS_SSL_TLS_C defined, but no protocols are active" +#endif + +#if defined(MBEDTLS_SSL_TLS_C) && (defined(MBEDTLS_SSL_PROTO_SSL3) && \ + defined(MBEDTLS_SSL_PROTO_TLS1_1) && !defined(MBEDTLS_SSL_PROTO_TLS1)) +#error "Illegal protocol selection" +#endif + +#if defined(MBEDTLS_SSL_TLS_C) && (defined(MBEDTLS_SSL_PROTO_TLS1) && \ + defined(MBEDTLS_SSL_PROTO_TLS1_2) && !defined(MBEDTLS_SSL_PROTO_TLS1_1)) +#error "Illegal protocol selection" +#endif + +#if defined(MBEDTLS_SSL_TLS_C) && (defined(MBEDTLS_SSL_PROTO_SSL3) && \ + defined(MBEDTLS_SSL_PROTO_TLS1_2) && (!defined(MBEDTLS_SSL_PROTO_TLS1) || \ + !defined(MBEDTLS_SSL_PROTO_TLS1_1))) +#error "Illegal protocol selection" +#endif + +#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && !defined(MBEDTLS_SSL_PROTO_DTLS) +#error "MBEDTLS_SSL_DTLS_HELLO_VERIFY defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && \ + !defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) +#error "MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \ + ( !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) ) +#error "MBEDTLS_SSL_DTLS_ANTI_REPLAY defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \ + ( !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) ) +#error "MBEDTLS_SSL_DTLS_CONNECTION_ID defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \ + defined(MBEDTLS_SSL_CID_IN_LEN_MAX) && \ + MBEDTLS_SSL_CID_IN_LEN_MAX > 255 +#error "MBEDTLS_SSL_CID_IN_LEN_MAX too large (max 255)" +#endif + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \ + defined(MBEDTLS_SSL_CID_OUT_LEN_MAX) && \ + MBEDTLS_SSL_CID_OUT_LEN_MAX > 255 +#error "MBEDTLS_SSL_CID_OUT_LEN_MAX too large (max 255)" +#endif + +#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) && \ + ( !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) ) +#error "MBEDTLS_SSL_DTLS_BADMAC_LIMIT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_1) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_2) +#error "MBEDTLS_SSL_ENCRYPT_THEN_MAC defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_1) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_2) +#error "MBEDTLS_SSL_EXTENDED_MASTER_SECRET defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_TICKET_C) && !defined(MBEDTLS_CIPHER_C) +#error "MBEDTLS_SSL_TICKET_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) && \ + !defined(MBEDTLS_SSL_PROTO_SSL3) && !defined(MBEDTLS_SSL_PROTO_TLS1) +#error "MBEDTLS_SSL_CBC_RECORD_SPLITTING defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \ + !defined(MBEDTLS_X509_CRT_PARSE_C) +#error "MBEDTLS_SSL_SERVER_NAME_INDICATION defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_THREADING_PTHREAD) +#if !defined(MBEDTLS_THREADING_C) || defined(MBEDTLS_THREADING_IMPL) +#error "MBEDTLS_THREADING_PTHREAD defined, but not all prerequisites" +#endif +#define MBEDTLS_THREADING_IMPL +#endif + +#if defined(MBEDTLS_THREADING_ALT) +#if !defined(MBEDTLS_THREADING_C) || defined(MBEDTLS_THREADING_IMPL) +#error "MBEDTLS_THREADING_ALT defined, but not all prerequisites" +#endif +#define MBEDTLS_THREADING_IMPL +#endif + +#if defined(MBEDTLS_THREADING_C) && !defined(MBEDTLS_THREADING_IMPL) +#error "MBEDTLS_THREADING_C defined, single threading implementation required" +#endif +#undef MBEDTLS_THREADING_IMPL + +#if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_PSA_CRYPTO_C) +#error "MBEDTLS_USE_PSA_CRYPTO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_VERSION_FEATURES) && !defined(MBEDTLS_VERSION_C) +#error "MBEDTLS_VERSION_FEATURES defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_USE_C) && ( !defined(MBEDTLS_BIGNUM_C) || \ + !defined(MBEDTLS_OID_C) || !defined(MBEDTLS_ASN1_PARSE_C) || \ + !defined(MBEDTLS_PK_PARSE_C) ) +#error "MBEDTLS_X509_USE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CREATE_C) && ( !defined(MBEDTLS_BIGNUM_C) || \ + !defined(MBEDTLS_OID_C) || !defined(MBEDTLS_ASN1_WRITE_C) || \ + !defined(MBEDTLS_PK_WRITE_C) ) +#error "MBEDTLS_X509_CREATE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_CERTS_C) && !defined(MBEDTLS_X509_USE_C) +#error "MBEDTLS_CERTS_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CRT_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) ) +#error "MBEDTLS_X509_CRT_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CRL_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) ) +#error "MBEDTLS_X509_CRL_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CSR_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) ) +#error "MBEDTLS_X509_CSR_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CRT_WRITE_C) && ( !defined(MBEDTLS_X509_CREATE_C) ) +#error "MBEDTLS_X509_CRT_WRITE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CSR_WRITE_C) && ( !defined(MBEDTLS_X509_CREATE_C) ) +#error "MBEDTLS_X509_CSR_WRITE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_HAVE_INT32) && defined(MBEDTLS_HAVE_INT64) +#error "MBEDTLS_HAVE_INT32 and MBEDTLS_HAVE_INT64 cannot be defined simultaneously" +#endif /* MBEDTLS_HAVE_INT32 && MBEDTLS_HAVE_INT64 */ + +#if ( defined(MBEDTLS_HAVE_INT32) || defined(MBEDTLS_HAVE_INT64) ) && \ + defined(MBEDTLS_HAVE_ASM) +#error "MBEDTLS_HAVE_INT32/MBEDTLS_HAVE_INT64 and MBEDTLS_HAVE_ASM cannot be defined simultaneously" +#endif /* (MBEDTLS_HAVE_INT32 || MBEDTLS_HAVE_INT64) && MBEDTLS_HAVE_ASM */ + +#if defined(MBEDTLS_SSL_PROTO_SSL3) +#if defined(MBEDTLS_DEPRECATED_REMOVED) +#error "MBEDTLS_SSL_PROTO_SSL3 is deprecated and will be removed in a future version of Mbed TLS" +#elif defined(MBEDTLS_DEPRECATED_WARNING) +#warning "MBEDTLS_SSL_PROTO_SSL3 is deprecated and will be removed in a future version of Mbed TLS" +#endif +#endif /* MBEDTLS_SSL_PROTO_SSL3 */ + +#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO) +#if defined(MBEDTLS_DEPRECATED_REMOVED) +#error "MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO is deprecated and will be removed in a future version of Mbed TLS" +#elif defined(MBEDTLS_DEPRECATED_WARNING) +#warning "MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO is deprecated and will be removed in a future version of Mbed TLS" +#endif +#endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */ + +#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) +#if defined(MBEDTLS_DEPRECATED_REMOVED) +#error "MBEDTLS_SSL_HW_RECORD_ACCEL is deprecated and will be removed in a future version of Mbed TLS" +#elif defined(MBEDTLS_DEPRECATED_WARNING) +#warning "MBEDTLS_SSL_HW_RECORD_ACCEL is deprecated and will be removed in a future version of Mbed TLS" +#endif /* MBEDTLS_DEPRECATED_REMOVED */ +#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */ + +#if defined(MBEDTLS_SSL_DTLS_SRTP) && ( !defined(MBEDTLS_SSL_PROTO_DTLS) ) +#error "MBEDTLS_SSL_DTLS_SRTP defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) && ( !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) ) +#error "MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH defined, but not all prerequisites" +#endif + +/* + * Avoid warning from -pedantic. This is a convenient place for this + * workaround since this is included by every single file before the + * #if defined(MBEDTLS_xxx_C) that results in empty translation units. + */ +typedef int mbedtls_iso_c_forbids_empty_translation_units; + +#endif /* MBEDTLS_CHECK_CONFIG_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/cipher.h b/openharmony/arm64-v8a/include/mbedtls/cipher.h new file mode 100644 index 00000000..6d83da88 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/cipher.h @@ -0,0 +1,1102 @@ +/** + * \file cipher.h + * + * \brief This file contains an abstraction interface for use with the cipher + * primitives provided by the library. It provides a common interface to all of + * the available cipher operations. + * + * \author Adriaan de Jong + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CIPHER_H +#define MBEDTLS_CIPHER_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include "mbedtls/platform_util.h" + +#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C) || defined(MBEDTLS_CHACHAPOLY_C) +#define MBEDTLS_CIPHER_MODE_AEAD +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +#define MBEDTLS_CIPHER_MODE_WITH_PADDING +#endif + +#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER) || \ + defined(MBEDTLS_CHACHA20_C) +#define MBEDTLS_CIPHER_MODE_STREAM +#endif + +#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \ + !defined(inline) && !defined(__cplusplus) +#define inline __inline +#endif + +/** The selected feature is not available. */ +#define MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE -0x6080 +/** Bad input parameters. */ +#define MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA -0x6100 +/** Failed to allocate memory. */ +#define MBEDTLS_ERR_CIPHER_ALLOC_FAILED -0x6180 +/** Input data contains invalid padding and is rejected. */ +#define MBEDTLS_ERR_CIPHER_INVALID_PADDING -0x6200 +/** Decryption of block requires a full block. */ +#define MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED -0x6280 +/** Authentication failed (for AEAD modes). */ +#define MBEDTLS_ERR_CIPHER_AUTH_FAILED -0x6300 +/** The context is invalid. For example, because it was freed. */ +#define MBEDTLS_ERR_CIPHER_INVALID_CONTEXT -0x6380 + +/* MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** Cipher hardware accelerator failed. */ +#define MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED -0x6400 + +#define MBEDTLS_CIPHER_VARIABLE_IV_LEN 0x01 /**< Cipher accepts IVs of variable length. */ +#define MBEDTLS_CIPHER_VARIABLE_KEY_LEN 0x02 /**< Cipher accepts keys of variable length. */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Supported cipher types. + * + * \warning RC4 and DES are considered weak ciphers and their use + * constitutes a security risk. Arm recommends considering stronger + * ciphers instead. + */ +typedef enum { + MBEDTLS_CIPHER_ID_NONE = 0, /**< Placeholder to mark the end of cipher ID lists. */ + MBEDTLS_CIPHER_ID_NULL, /**< The identity cipher, treated as a stream cipher. */ + MBEDTLS_CIPHER_ID_AES, /**< The AES cipher. */ + MBEDTLS_CIPHER_ID_DES, /**< The DES cipher. */ + MBEDTLS_CIPHER_ID_3DES, /**< The Triple DES cipher. */ + MBEDTLS_CIPHER_ID_CAMELLIA, /**< The Camellia cipher. */ + MBEDTLS_CIPHER_ID_BLOWFISH, /**< The Blowfish cipher. */ + MBEDTLS_CIPHER_ID_ARC4, /**< The RC4 cipher. */ + MBEDTLS_CIPHER_ID_ARIA, /**< The Aria cipher. */ + MBEDTLS_CIPHER_ID_CHACHA20, /**< The ChaCha20 cipher. */ +} mbedtls_cipher_id_t; + +/** + * \brief Supported {cipher type, cipher mode} pairs. + * + * \warning RC4 and DES are considered weak ciphers and their use + * constitutes a security risk. Arm recommends considering stronger + * ciphers instead. + */ +typedef enum { + MBEDTLS_CIPHER_NONE = 0, /**< Placeholder to mark the end of cipher-pair lists. */ + MBEDTLS_CIPHER_NULL, /**< The identity stream cipher. */ + MBEDTLS_CIPHER_AES_128_ECB, /**< AES cipher with 128-bit ECB mode. */ + MBEDTLS_CIPHER_AES_192_ECB, /**< AES cipher with 192-bit ECB mode. */ + MBEDTLS_CIPHER_AES_256_ECB, /**< AES cipher with 256-bit ECB mode. */ + MBEDTLS_CIPHER_AES_128_CBC, /**< AES cipher with 128-bit CBC mode. */ + MBEDTLS_CIPHER_AES_192_CBC, /**< AES cipher with 192-bit CBC mode. */ + MBEDTLS_CIPHER_AES_256_CBC, /**< AES cipher with 256-bit CBC mode. */ + MBEDTLS_CIPHER_AES_128_CFB128, /**< AES cipher with 128-bit CFB128 mode. */ + MBEDTLS_CIPHER_AES_192_CFB128, /**< AES cipher with 192-bit CFB128 mode. */ + MBEDTLS_CIPHER_AES_256_CFB128, /**< AES cipher with 256-bit CFB128 mode. */ + MBEDTLS_CIPHER_AES_128_CTR, /**< AES cipher with 128-bit CTR mode. */ + MBEDTLS_CIPHER_AES_192_CTR, /**< AES cipher with 192-bit CTR mode. */ + MBEDTLS_CIPHER_AES_256_CTR, /**< AES cipher with 256-bit CTR mode. */ + MBEDTLS_CIPHER_AES_128_GCM, /**< AES cipher with 128-bit GCM mode. */ + MBEDTLS_CIPHER_AES_192_GCM, /**< AES cipher with 192-bit GCM mode. */ + MBEDTLS_CIPHER_AES_256_GCM, /**< AES cipher with 256-bit GCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_ECB, /**< Camellia cipher with 128-bit ECB mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_ECB, /**< Camellia cipher with 192-bit ECB mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_ECB, /**< Camellia cipher with 256-bit ECB mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_CBC, /**< Camellia cipher with 128-bit CBC mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_CBC, /**< Camellia cipher with 192-bit CBC mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_CBC, /**< Camellia cipher with 256-bit CBC mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_CFB128, /**< Camellia cipher with 128-bit CFB128 mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_CFB128, /**< Camellia cipher with 192-bit CFB128 mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_CFB128, /**< Camellia cipher with 256-bit CFB128 mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_CTR, /**< Camellia cipher with 128-bit CTR mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_CTR, /**< Camellia cipher with 192-bit CTR mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_CTR, /**< Camellia cipher with 256-bit CTR mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_GCM, /**< Camellia cipher with 128-bit GCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_GCM, /**< Camellia cipher with 192-bit GCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_GCM, /**< Camellia cipher with 256-bit GCM mode. */ + MBEDTLS_CIPHER_DES_ECB, /**< DES cipher with ECB mode. */ + MBEDTLS_CIPHER_DES_CBC, /**< DES cipher with CBC mode. */ + MBEDTLS_CIPHER_DES_EDE_ECB, /**< DES cipher with EDE ECB mode. */ + MBEDTLS_CIPHER_DES_EDE_CBC, /**< DES cipher with EDE CBC mode. */ + MBEDTLS_CIPHER_DES_EDE3_ECB, /**< DES cipher with EDE3 ECB mode. */ + MBEDTLS_CIPHER_DES_EDE3_CBC, /**< DES cipher with EDE3 CBC mode. */ + MBEDTLS_CIPHER_BLOWFISH_ECB, /**< Blowfish cipher with ECB mode. */ + MBEDTLS_CIPHER_BLOWFISH_CBC, /**< Blowfish cipher with CBC mode. */ + MBEDTLS_CIPHER_BLOWFISH_CFB64, /**< Blowfish cipher with CFB64 mode. */ + MBEDTLS_CIPHER_BLOWFISH_CTR, /**< Blowfish cipher with CTR mode. */ + MBEDTLS_CIPHER_ARC4_128, /**< RC4 cipher with 128-bit mode. */ + MBEDTLS_CIPHER_AES_128_CCM, /**< AES cipher with 128-bit CCM mode. */ + MBEDTLS_CIPHER_AES_192_CCM, /**< AES cipher with 192-bit CCM mode. */ + MBEDTLS_CIPHER_AES_256_CCM, /**< AES cipher with 256-bit CCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_CCM, /**< Camellia cipher with 128-bit CCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_CCM, /**< Camellia cipher with 192-bit CCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_CCM, /**< Camellia cipher with 256-bit CCM mode. */ + MBEDTLS_CIPHER_ARIA_128_ECB, /**< Aria cipher with 128-bit key and ECB mode. */ + MBEDTLS_CIPHER_ARIA_192_ECB, /**< Aria cipher with 192-bit key and ECB mode. */ + MBEDTLS_CIPHER_ARIA_256_ECB, /**< Aria cipher with 256-bit key and ECB mode. */ + MBEDTLS_CIPHER_ARIA_128_CBC, /**< Aria cipher with 128-bit key and CBC mode. */ + MBEDTLS_CIPHER_ARIA_192_CBC, /**< Aria cipher with 192-bit key and CBC mode. */ + MBEDTLS_CIPHER_ARIA_256_CBC, /**< Aria cipher with 256-bit key and CBC mode. */ + MBEDTLS_CIPHER_ARIA_128_CFB128, /**< Aria cipher with 128-bit key and CFB-128 mode. */ + MBEDTLS_CIPHER_ARIA_192_CFB128, /**< Aria cipher with 192-bit key and CFB-128 mode. */ + MBEDTLS_CIPHER_ARIA_256_CFB128, /**< Aria cipher with 256-bit key and CFB-128 mode. */ + MBEDTLS_CIPHER_ARIA_128_CTR, /**< Aria cipher with 128-bit key and CTR mode. */ + MBEDTLS_CIPHER_ARIA_192_CTR, /**< Aria cipher with 192-bit key and CTR mode. */ + MBEDTLS_CIPHER_ARIA_256_CTR, /**< Aria cipher with 256-bit key and CTR mode. */ + MBEDTLS_CIPHER_ARIA_128_GCM, /**< Aria cipher with 128-bit key and GCM mode. */ + MBEDTLS_CIPHER_ARIA_192_GCM, /**< Aria cipher with 192-bit key and GCM mode. */ + MBEDTLS_CIPHER_ARIA_256_GCM, /**< Aria cipher with 256-bit key and GCM mode. */ + MBEDTLS_CIPHER_ARIA_128_CCM, /**< Aria cipher with 128-bit key and CCM mode. */ + MBEDTLS_CIPHER_ARIA_192_CCM, /**< Aria cipher with 192-bit key and CCM mode. */ + MBEDTLS_CIPHER_ARIA_256_CCM, /**< Aria cipher with 256-bit key and CCM mode. */ + MBEDTLS_CIPHER_AES_128_OFB, /**< AES 128-bit cipher in OFB mode. */ + MBEDTLS_CIPHER_AES_192_OFB, /**< AES 192-bit cipher in OFB mode. */ + MBEDTLS_CIPHER_AES_256_OFB, /**< AES 256-bit cipher in OFB mode. */ + MBEDTLS_CIPHER_AES_128_XTS, /**< AES 128-bit cipher in XTS block mode. */ + MBEDTLS_CIPHER_AES_256_XTS, /**< AES 256-bit cipher in XTS block mode. */ + MBEDTLS_CIPHER_CHACHA20, /**< ChaCha20 stream cipher. */ + MBEDTLS_CIPHER_CHACHA20_POLY1305, /**< ChaCha20-Poly1305 AEAD cipher. */ + MBEDTLS_CIPHER_AES_128_KW, /**< AES cipher with 128-bit NIST KW mode. */ + MBEDTLS_CIPHER_AES_192_KW, /**< AES cipher with 192-bit NIST KW mode. */ + MBEDTLS_CIPHER_AES_256_KW, /**< AES cipher with 256-bit NIST KW mode. */ + MBEDTLS_CIPHER_AES_128_KWP, /**< AES cipher with 128-bit NIST KWP mode. */ + MBEDTLS_CIPHER_AES_192_KWP, /**< AES cipher with 192-bit NIST KWP mode. */ + MBEDTLS_CIPHER_AES_256_KWP, /**< AES cipher with 256-bit NIST KWP mode. */ +} mbedtls_cipher_type_t; + +/** Supported cipher modes. */ +typedef enum { + MBEDTLS_MODE_NONE = 0, /**< None. */ + MBEDTLS_MODE_ECB, /**< The ECB cipher mode. */ + MBEDTLS_MODE_CBC, /**< The CBC cipher mode. */ + MBEDTLS_MODE_CFB, /**< The CFB cipher mode. */ + MBEDTLS_MODE_OFB, /**< The OFB cipher mode. */ + MBEDTLS_MODE_CTR, /**< The CTR cipher mode. */ + MBEDTLS_MODE_GCM, /**< The GCM cipher mode. */ + MBEDTLS_MODE_STREAM, /**< The stream cipher mode. */ + MBEDTLS_MODE_CCM, /**< The CCM cipher mode. */ + MBEDTLS_MODE_XTS, /**< The XTS cipher mode. */ + MBEDTLS_MODE_CHACHAPOLY, /**< The ChaCha-Poly cipher mode. */ + MBEDTLS_MODE_KW, /**< The SP800-38F KW mode */ + MBEDTLS_MODE_KWP, /**< The SP800-38F KWP mode */ +} mbedtls_cipher_mode_t; + +/** Supported cipher padding types. */ +typedef enum { + MBEDTLS_PADDING_PKCS7 = 0, /**< PKCS7 padding (default). */ + MBEDTLS_PADDING_ONE_AND_ZEROS, /**< ISO/IEC 7816-4 padding. */ + MBEDTLS_PADDING_ZEROS_AND_LEN, /**< ANSI X.923 padding. */ + MBEDTLS_PADDING_ZEROS, /**< Zero padding (not reversible). */ + MBEDTLS_PADDING_NONE, /**< Never pad (full blocks only). */ +} mbedtls_cipher_padding_t; + +/** Type of operation. */ +typedef enum { + MBEDTLS_OPERATION_NONE = -1, + MBEDTLS_DECRYPT = 0, + MBEDTLS_ENCRYPT, +} mbedtls_operation_t; + +enum { + /** Undefined key length. */ + MBEDTLS_KEY_LENGTH_NONE = 0, + /** Key length, in bits (including parity), for DES keys. */ + MBEDTLS_KEY_LENGTH_DES = 64, + /** Key length in bits, including parity, for DES in two-key EDE. */ + MBEDTLS_KEY_LENGTH_DES_EDE = 128, + /** Key length in bits, including parity, for DES in three-key EDE. */ + MBEDTLS_KEY_LENGTH_DES_EDE3 = 192, +}; + +/** Maximum length of any IV, in Bytes. */ +/* This should ideally be derived automatically from list of ciphers. + * This should be kept in sync with MBEDTLS_SSL_MAX_IV_LENGTH defined + * in ssl_internal.h. */ +#define MBEDTLS_MAX_IV_LENGTH 16 + +/** Maximum block size of any cipher, in Bytes. */ +/* This should ideally be derived automatically from list of ciphers. + * This should be kept in sync with MBEDTLS_SSL_MAX_BLOCK_LENGTH defined + * in ssl_internal.h. */ +#define MBEDTLS_MAX_BLOCK_LENGTH 16 + +/** Maximum key length, in Bytes. */ +/* This should ideally be derived automatically from list of ciphers. + * For now, only check whether XTS is enabled which uses 64 Byte keys, + * and use 32 Bytes as an upper bound for the maximum key length otherwise. + * This should be kept in sync with MBEDTLS_SSL_MAX_BLOCK_LENGTH defined + * in ssl_internal.h, which however deliberately ignores the case of XTS + * since the latter isn't used in SSL/TLS. */ +#if defined(MBEDTLS_CIPHER_MODE_XTS) +#define MBEDTLS_MAX_KEY_LENGTH 64 +#else +#define MBEDTLS_MAX_KEY_LENGTH 32 +#endif /* MBEDTLS_CIPHER_MODE_XTS */ + +/** + * Base cipher information (opaque struct). + */ +typedef struct mbedtls_cipher_base_t mbedtls_cipher_base_t; + +/** + * CMAC context (opaque struct). + */ +typedef struct mbedtls_cmac_context_t mbedtls_cmac_context_t; + +/** + * Cipher information. Allows calling cipher functions + * in a generic way. + */ +typedef struct mbedtls_cipher_info_t +{ + /** Full cipher identifier. For example, + * MBEDTLS_CIPHER_AES_256_CBC. + */ + mbedtls_cipher_type_t type; + + /** The cipher mode. For example, MBEDTLS_MODE_CBC. */ + mbedtls_cipher_mode_t mode; + + /** The cipher key length, in bits. This is the + * default length for variable sized ciphers. + * Includes parity bits for ciphers like DES. + */ + unsigned int key_bitlen; + + /** Name of the cipher. */ + const char * name; + + /** IV or nonce size, in Bytes. + * For ciphers that accept variable IV sizes, + * this is the recommended size. + */ + unsigned int iv_size; + + /** Bitflag comprised of MBEDTLS_CIPHER_VARIABLE_IV_LEN and + * MBEDTLS_CIPHER_VARIABLE_KEY_LEN indicating whether the + * cipher supports variable IV or variable key sizes, respectively. + */ + int flags; + + /** The block size, in Bytes. */ + unsigned int block_size; + + /** Struct for base cipher information and functions. */ + const mbedtls_cipher_base_t *base; + +} mbedtls_cipher_info_t; + +/** + * Generic cipher context. + */ +typedef struct mbedtls_cipher_context_t +{ + /** Information about the associated cipher. */ + const mbedtls_cipher_info_t *cipher_info; + + /** Key length to use. */ + int key_bitlen; + + /** Operation that the key of the context has been + * initialized for. + */ + mbedtls_operation_t operation; + +#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING) + /** Padding functions to use, if relevant for + * the specific cipher mode. + */ + void (*add_padding)( unsigned char *output, size_t olen, size_t data_len ); + int (*get_padding)( unsigned char *input, size_t ilen, size_t *data_len ); +#endif + + /** Buffer for input that has not been processed yet. */ + unsigned char unprocessed_data[MBEDTLS_MAX_BLOCK_LENGTH]; + + /** Number of Bytes that have not been processed yet. */ + size_t unprocessed_len; + + /** Current IV or NONCE_COUNTER for CTR-mode, data unit (or sector) number + * for XTS-mode. */ + unsigned char iv[MBEDTLS_MAX_IV_LENGTH]; + + /** IV size in Bytes, for ciphers with variable-length IVs. */ + size_t iv_size; + + /** The cipher-specific context. */ + void *cipher_ctx; + +#if defined(MBEDTLS_CMAC_C) + /** CMAC-specific context. */ + mbedtls_cmac_context_t *cmac_ctx; +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) + /** Indicates whether the cipher operations should be performed + * by Mbed TLS' own crypto library or an external implementation + * of the PSA Crypto API. + * This is unset if the cipher context was established through + * mbedtls_cipher_setup(), and set if it was established through + * mbedtls_cipher_setup_psa(). + */ + unsigned char psa_enabled; +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +} mbedtls_cipher_context_t; + +/** + * \brief This function retrieves the list of ciphers supported + * by the generic cipher module. + * + * For any cipher identifier in the returned list, you can + * obtain the corresponding generic cipher information structure + * via mbedtls_cipher_info_from_type(), which can then be used + * to prepare a cipher context via mbedtls_cipher_setup(). + * + * + * \return A statically-allocated array of cipher identifiers + * of type cipher_type_t. The last entry is zero. + */ +const int *mbedtls_cipher_list( void ); + +/** + * \brief This function retrieves the cipher-information + * structure associated with the given cipher name. + * + * \param cipher_name Name of the cipher to search for. This must not be + * \c NULL. + * + * \return The cipher information structure associated with the + * given \p cipher_name. + * \return \c NULL if the associated cipher information is not found. + */ +const mbedtls_cipher_info_t *mbedtls_cipher_info_from_string( const char *cipher_name ); + +/** + * \brief This function retrieves the cipher-information + * structure associated with the given cipher type. + * + * \param cipher_type Type of the cipher to search for. + * + * \return The cipher information structure associated with the + * given \p cipher_type. + * \return \c NULL if the associated cipher information is not found. + */ +const mbedtls_cipher_info_t *mbedtls_cipher_info_from_type( const mbedtls_cipher_type_t cipher_type ); + +/** + * \brief This function retrieves the cipher-information + * structure associated with the given cipher ID, + * key size and mode. + * + * \param cipher_id The ID of the cipher to search for. For example, + * #MBEDTLS_CIPHER_ID_AES. + * \param key_bitlen The length of the key in bits. + * \param mode The cipher mode. For example, #MBEDTLS_MODE_CBC. + * + * \return The cipher information structure associated with the + * given \p cipher_id. + * \return \c NULL if the associated cipher information is not found. + */ +const mbedtls_cipher_info_t *mbedtls_cipher_info_from_values( const mbedtls_cipher_id_t cipher_id, + int key_bitlen, + const mbedtls_cipher_mode_t mode ); + +/** + * \brief This function initializes a \p cipher_context as NONE. + * + * \param ctx The context to be initialized. This must not be \c NULL. + */ +void mbedtls_cipher_init( mbedtls_cipher_context_t *ctx ); + +/** + * \brief This function frees and clears the cipher-specific + * context of \p ctx. Freeing \p ctx itself remains the + * responsibility of the caller. + * + * \param ctx The context to be freed. If this is \c NULL, the + * function has no effect, otherwise this must point to an + * initialized context. + */ +void mbedtls_cipher_free( mbedtls_cipher_context_t *ctx ); + + +/** + * \brief This function initializes a cipher context for + * use with the given cipher primitive. + * + * \param ctx The context to initialize. This must be initialized. + * \param cipher_info The cipher to use. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_ALLOC_FAILED if allocation of the + * cipher-specific context fails. + * + * \internal Currently, the function also clears the structure. + * In future versions, the caller will be required to call + * mbedtls_cipher_init() on the structure first. + */ +int mbedtls_cipher_setup( mbedtls_cipher_context_t *ctx, + const mbedtls_cipher_info_t *cipher_info ); + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +/** + * \brief This function initializes a cipher context for + * PSA-based use with the given cipher primitive. + * + * \note See #MBEDTLS_USE_PSA_CRYPTO for information on PSA. + * + * \param ctx The context to initialize. May not be \c NULL. + * \param cipher_info The cipher to use. + * \param taglen For AEAD ciphers, the length in bytes of the + * authentication tag to use. Subsequent uses of + * mbedtls_cipher_auth_encrypt() or + * mbedtls_cipher_auth_decrypt() must provide + * the same tag length. + * For non-AEAD ciphers, the value must be \c 0. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_ALLOC_FAILED if allocation of the + * cipher-specific context fails. + */ +int mbedtls_cipher_setup_psa( mbedtls_cipher_context_t *ctx, + const mbedtls_cipher_info_t *cipher_info, + size_t taglen ); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +/** + * \brief This function returns the block size of the given cipher. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The block size of the underlying cipher. + * \return \c 0 if \p ctx has not been initialized. + */ +static inline unsigned int mbedtls_cipher_get_block_size( + const mbedtls_cipher_context_t *ctx ) +{ + MBEDTLS_INTERNAL_VALIDATE_RET( ctx != NULL, 0 ); + if( ctx->cipher_info == NULL ) + return 0; + + return ctx->cipher_info->block_size; +} + +/** + * \brief This function returns the mode of operation for + * the cipher. For example, MBEDTLS_MODE_CBC. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The mode of operation. + * \return #MBEDTLS_MODE_NONE if \p ctx has not been initialized. + */ +static inline mbedtls_cipher_mode_t mbedtls_cipher_get_cipher_mode( + const mbedtls_cipher_context_t *ctx ) +{ + MBEDTLS_INTERNAL_VALIDATE_RET( ctx != NULL, MBEDTLS_MODE_NONE ); + if( ctx->cipher_info == NULL ) + return MBEDTLS_MODE_NONE; + + return ctx->cipher_info->mode; +} + +/** + * \brief This function returns the size of the IV or nonce + * of the cipher, in Bytes. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The recommended IV size if no IV has been set. + * \return \c 0 for ciphers not using an IV or a nonce. + * \return The actual size if an IV has been set. + */ +static inline int mbedtls_cipher_get_iv_size( + const mbedtls_cipher_context_t *ctx ) +{ + MBEDTLS_INTERNAL_VALIDATE_RET( ctx != NULL, 0 ); + if( ctx->cipher_info == NULL ) + return 0; + + if( ctx->iv_size != 0 ) + return (int) ctx->iv_size; + + return (int) ctx->cipher_info->iv_size; +} + +/** + * \brief This function returns the type of the given cipher. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The type of the cipher. + * \return #MBEDTLS_CIPHER_NONE if \p ctx has not been initialized. + */ +static inline mbedtls_cipher_type_t mbedtls_cipher_get_type( + const mbedtls_cipher_context_t *ctx ) +{ + MBEDTLS_INTERNAL_VALIDATE_RET( + ctx != NULL, MBEDTLS_CIPHER_NONE ); + if( ctx->cipher_info == NULL ) + return MBEDTLS_CIPHER_NONE; + + return ctx->cipher_info->type; +} + +/** + * \brief This function returns the name of the given cipher + * as a string. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The name of the cipher. + * \return NULL if \p ctx has not been not initialized. + */ +static inline const char *mbedtls_cipher_get_name( + const mbedtls_cipher_context_t *ctx ) +{ + MBEDTLS_INTERNAL_VALIDATE_RET( ctx != NULL, 0 ); + if( ctx->cipher_info == NULL ) + return 0; + + return ctx->cipher_info->name; +} + +/** + * \brief This function returns the key length of the cipher. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The key length of the cipher in bits. + * \return #MBEDTLS_KEY_LENGTH_NONE if ctx \p has not been + * initialized. + */ +static inline int mbedtls_cipher_get_key_bitlen( + const mbedtls_cipher_context_t *ctx ) +{ + MBEDTLS_INTERNAL_VALIDATE_RET( + ctx != NULL, MBEDTLS_KEY_LENGTH_NONE ); + if( ctx->cipher_info == NULL ) + return MBEDTLS_KEY_LENGTH_NONE; + + return (int) ctx->cipher_info->key_bitlen; +} + +/** + * \brief This function returns the operation of the given cipher. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The type of operation: #MBEDTLS_ENCRYPT or #MBEDTLS_DECRYPT. + * \return #MBEDTLS_OPERATION_NONE if \p ctx has not been initialized. + */ +static inline mbedtls_operation_t mbedtls_cipher_get_operation( + const mbedtls_cipher_context_t *ctx ) +{ + MBEDTLS_INTERNAL_VALIDATE_RET( + ctx != NULL, MBEDTLS_OPERATION_NONE ); + if( ctx->cipher_info == NULL ) + return MBEDTLS_OPERATION_NONE; + + return ctx->operation; +} + +/** + * \brief This function sets the key to use with the given context. + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a cipher information structure. + * \param key The key to use. This must be a readable buffer of at + * least \p key_bitlen Bits. + * \param key_bitlen The key length to use, in Bits. + * \param operation The operation that the key will be used for: + * #MBEDTLS_ENCRYPT or #MBEDTLS_DECRYPT. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_setkey( mbedtls_cipher_context_t *ctx, + const unsigned char *key, + int key_bitlen, + const mbedtls_operation_t operation ); + +#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING) +/** + * \brief This function sets the padding mode, for cipher modes + * that use padding. + * + * The default passing mode is PKCS7 padding. + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a cipher information structure. + * \param mode The padding mode. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE + * if the selected padding mode is not supported. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA if the cipher mode + * does not support padding. + */ +int mbedtls_cipher_set_padding_mode( mbedtls_cipher_context_t *ctx, + mbedtls_cipher_padding_t mode ); +#endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */ + +/** + * \brief This function sets the initialization vector (IV) + * or nonce. + * + * \note Some ciphers do not use IVs nor nonce. For these + * ciphers, this function has no effect. + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a cipher information structure. + * \param iv The IV to use, or NONCE_COUNTER for CTR-mode ciphers. This + * must be a readable buffer of at least \p iv_len Bytes. + * \param iv_len The IV length for ciphers with variable-size IV. + * This parameter is discarded by ciphers with fixed-size IV. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + */ +int mbedtls_cipher_set_iv( mbedtls_cipher_context_t *ctx, + const unsigned char *iv, + size_t iv_len ); + +/** + * \brief This function resets the cipher state. + * + * \param ctx The generic cipher context. This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + */ +int mbedtls_cipher_reset( mbedtls_cipher_context_t *ctx ); + +#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C) +/** + * \brief This function adds additional data for AEAD ciphers. + * Currently supported with GCM and ChaCha20+Poly1305. + * This must be called exactly once, after + * mbedtls_cipher_reset(). + * + * \param ctx The generic cipher context. This must be initialized. + * \param ad The additional data to use. This must be a readable + * buffer of at least \p ad_len Bytes. + * \param ad_len The length of \p ad in Bytes. + * + * \return \c 0 on success. + * \return A specific error code on failure. + */ +int mbedtls_cipher_update_ad( mbedtls_cipher_context_t *ctx, + const unsigned char *ad, size_t ad_len ); +#endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */ + +/** + * \brief The generic cipher update function. It encrypts or + * decrypts using the given cipher context. Writes as + * many block-sized blocks of data as possible to output. + * Any data that cannot be written immediately is either + * added to the next block, or flushed when + * mbedtls_cipher_finish() is called. + * Exception: For MBEDTLS_MODE_ECB, expects a single block + * in size. For example, 16 Bytes for AES. + * + * \note If the underlying cipher is used in GCM mode, all calls + * to this function, except for the last one before + * mbedtls_cipher_finish(), must have \p ilen as a + * multiple of the block size of the cipher. + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a key. + * \param input The buffer holding the input data. This must be a + * readable buffer of at least \p ilen Bytes. + * \param ilen The length of the input data. + * \param output The buffer for the output data. This must be able to + * hold at least `ilen + block_size`. This must not be the + * same buffer as \p input. + * \param olen The length of the output data, to be updated with the + * actual number of Bytes written. This must not be + * \c NULL. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE on an + * unsupported mode for a cipher. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_update( mbedtls_cipher_context_t *ctx, + const unsigned char *input, + size_t ilen, unsigned char *output, + size_t *olen ); + +/** + * \brief The generic cipher finalization function. If data still + * needs to be flushed from an incomplete block, the data + * contained in it is padded to the size of + * the last block, and written to the \p output buffer. + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a key. + * \param output The buffer to write data to. This needs to be a writable + * buffer of at least \p block_size Bytes. + * \param olen The length of the data written to the \p output buffer. + * This may not be \c NULL. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption + * expecting a full block but not receiving one. + * \return #MBEDTLS_ERR_CIPHER_INVALID_PADDING on invalid padding + * while decrypting. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_finish( mbedtls_cipher_context_t *ctx, + unsigned char *output, size_t *olen ); + +#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C) +/** + * \brief This function writes a tag for AEAD ciphers. + * Currently supported with GCM and ChaCha20+Poly1305. + * This must be called after mbedtls_cipher_finish(). + * + * \param ctx The generic cipher context. This must be initialized, + * bound to a key, and have just completed a cipher + * operation through mbedtls_cipher_finish() the tag for + * which should be written. + * \param tag The buffer to write the tag to. This must be a writable + * buffer of at least \p tag_len Bytes. + * \param tag_len The length of the tag to write. + * + * \return \c 0 on success. + * \return A specific error code on failure. + */ +int mbedtls_cipher_write_tag( mbedtls_cipher_context_t *ctx, + unsigned char *tag, size_t tag_len ); + +/** + * \brief This function checks the tag for AEAD ciphers. + * Currently supported with GCM and ChaCha20+Poly1305. + * This must be called after mbedtls_cipher_finish(). + * + * \param ctx The generic cipher context. This must be initialized. + * \param tag The buffer holding the tag. This must be a readable + * buffer of at least \p tag_len Bytes. + * \param tag_len The length of the tag to check. + * + * \return \c 0 on success. + * \return A specific error code on failure. + */ +int mbedtls_cipher_check_tag( mbedtls_cipher_context_t *ctx, + const unsigned char *tag, size_t tag_len ); +#endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */ + +/** + * \brief The generic all-in-one encryption/decryption function, + * for all ciphers except AEAD constructs. + * + * \param ctx The generic cipher context. This must be initialized. + * \param iv The IV to use, or NONCE_COUNTER for CTR-mode ciphers. + * This must be a readable buffer of at least \p iv_len + * Bytes. + * \param iv_len The IV length for ciphers with variable-size IV. + * This parameter is discarded by ciphers with fixed-size + * IV. + * \param input The buffer holding the input data. This must be a + * readable buffer of at least \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * \param output The buffer for the output data. This must be able to + * hold at least `ilen + block_size`. This must not be the + * same buffer as \p input. + * \param olen The length of the output data, to be updated with the + * actual number of Bytes written. This must not be + * \c NULL. + * + * \note Some ciphers do not use IVs nor nonce. For these + * ciphers, use \p iv = NULL and \p iv_len = 0. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption + * expecting a full block but not receiving one. + * \return #MBEDTLS_ERR_CIPHER_INVALID_PADDING on invalid padding + * while decrypting. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_crypt( mbedtls_cipher_context_t *ctx, + const unsigned char *iv, size_t iv_len, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen ); + +#if defined(MBEDTLS_CIPHER_MODE_AEAD) +#if ! defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif /* MBEDTLS_DEPRECATED_WARNING */ +/** + * \brief The generic authenticated encryption (AEAD) function. + * + * \deprecated Superseded by mbedtls_cipher_auth_encrypt_ext(). + * + * \note This function only supports AEAD algorithms, not key + * wrapping algorithms such as NIST_KW; for this, see + * mbedtls_cipher_auth_encrypt_ext(). + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a key associated with an AEAD algorithm. + * \param iv The nonce to use. This must be a readable buffer of + * at least \p iv_len Bytes and must not be \c NULL. + * \param iv_len The length of the nonce. This must satisfy the + * constraints imposed by the AEAD cipher used. + * \param ad The additional data to authenticate. This must be a + * readable buffer of at least \p ad_len Bytes, and may + * be \c NULL is \p ad_len is \c 0. + * \param ad_len The length of \p ad. + * \param input The buffer holding the input data. This must be a + * readable buffer of at least \p ilen Bytes, and may be + * \c NULL if \p ilen is \c 0. + * \param ilen The length of the input data. + * \param output The buffer for the output data. This must be a + * writable buffer of at least \p ilen Bytes, and must + * not be \c NULL. + * \param olen This will be filled with the actual number of Bytes + * written to the \p output buffer. This must point to a + * writable object of type \c size_t. + * \param tag The buffer for the authentication tag. This must be a + * writable buffer of at least \p tag_len Bytes. See note + * below regarding restrictions with PSA-based contexts. + * \param tag_len The desired length of the authentication tag. This + * must match the constraints imposed by the AEAD cipher + * used, and in particular must not be \c 0. + * + * \note If the context is based on PSA (that is, it was set up + * with mbedtls_cipher_setup_psa()), then it is required + * that \c tag == output + ilen. That is, the tag must be + * appended to the ciphertext as recommended by RFC 5116. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_auth_encrypt( mbedtls_cipher_context_t *ctx, + const unsigned char *iv, size_t iv_len, + const unsigned char *ad, size_t ad_len, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen, + unsigned char *tag, size_t tag_len ) + MBEDTLS_DEPRECATED; + +/** + * \brief The generic authenticated decryption (AEAD) function. + * + * \deprecated Superseded by mbedtls_cipher_auth_decrypt_ext(). + * + * \note This function only supports AEAD algorithms, not key + * wrapping algorithms such as NIST_KW; for this, see + * mbedtls_cipher_auth_decrypt_ext(). + * + * \note If the data is not authentic, then the output buffer + * is zeroed out to prevent the unauthentic plaintext being + * used, making this interface safer. + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a key associated with an AEAD algorithm. + * \param iv The nonce to use. This must be a readable buffer of + * at least \p iv_len Bytes and must not be \c NULL. + * \param iv_len The length of the nonce. This must satisfy the + * constraints imposed by the AEAD cipher used. + * \param ad The additional data to authenticate. This must be a + * readable buffer of at least \p ad_len Bytes, and may + * be \c NULL is \p ad_len is \c 0. + * \param ad_len The length of \p ad. + * \param input The buffer holding the input data. This must be a + * readable buffer of at least \p ilen Bytes, and may be + * \c NULL if \p ilen is \c 0. + * \param ilen The length of the input data. + * \param output The buffer for the output data. This must be a + * writable buffer of at least \p ilen Bytes, and must + * not be \c NULL. + * \param olen This will be filled with the actual number of Bytes + * written to the \p output buffer. This must point to a + * writable object of type \c size_t. + * \param tag The buffer for the authentication tag. This must be a + * readable buffer of at least \p tag_len Bytes. See note + * below regarding restrictions with PSA-based contexts. + * \param tag_len The length of the authentication tag. This must match + * the constraints imposed by the AEAD cipher used, and in + * particular must not be \c 0. + * + * \note If the context is based on PSA (that is, it was set up + * with mbedtls_cipher_setup_psa()), then it is required + * that \c tag == input + len. That is, the tag must be + * appended to the ciphertext as recommended by RFC 5116. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_AUTH_FAILED if data is not authentic. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_auth_decrypt( mbedtls_cipher_context_t *ctx, + const unsigned char *iv, size_t iv_len, + const unsigned char *ad, size_t ad_len, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen, + const unsigned char *tag, size_t tag_len ) + MBEDTLS_DEPRECATED; +#undef MBEDTLS_DEPRECATED +#endif /* MBEDTLS_DEPRECATED_REMOVED */ +#endif /* MBEDTLS_CIPHER_MODE_AEAD */ + +#if defined(MBEDTLS_CIPHER_MODE_AEAD) || defined(MBEDTLS_NIST_KW_C) +/** + * \brief The authenticated encryption (AEAD/NIST_KW) function. + * + * \note For AEAD modes, the tag will be appended to the + * ciphertext, as recommended by RFC 5116. + * (NIST_KW doesn't have a separate tag.) + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a key, with an AEAD algorithm or NIST_KW. + * \param iv The nonce to use. This must be a readable buffer of + * at least \p iv_len Bytes and may be \c NULL if \p + * iv_len is \c 0. + * \param iv_len The length of the nonce. For AEAD ciphers, this must + * satisfy the constraints imposed by the cipher used. + * For NIST_KW, this must be \c 0. + * \param ad The additional data to authenticate. This must be a + * readable buffer of at least \p ad_len Bytes, and may + * be \c NULL is \p ad_len is \c 0. + * \param ad_len The length of \p ad. For NIST_KW, this must be \c 0. + * \param input The buffer holding the input data. This must be a + * readable buffer of at least \p ilen Bytes, and may be + * \c NULL if \p ilen is \c 0. + * \param ilen The length of the input data. + * \param output The buffer for the output data. This must be a + * writable buffer of at least \p output_len Bytes, and + * must not be \c NULL. + * \param output_len The length of the \p output buffer in Bytes. For AEAD + * ciphers, this must be at least \p ilen + \p tag_len. + * For NIST_KW, this must be at least \p ilen + 8 + * (rounded up to a multiple of 8 if KWP is used); + * \p ilen + 15 is always a safe value. + * \param olen This will be filled with the actual number of Bytes + * written to the \p output buffer. This must point to a + * writable object of type \c size_t. + * \param tag_len The desired length of the authentication tag. For AEAD + * ciphers, this must match the constraints imposed by + * the cipher used, and in particular must not be \c 0. + * For NIST_KW, this must be \c 0. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_auth_encrypt_ext( mbedtls_cipher_context_t *ctx, + const unsigned char *iv, size_t iv_len, + const unsigned char *ad, size_t ad_len, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t output_len, + size_t *olen, size_t tag_len ); + +/** + * \brief The authenticated encryption (AEAD/NIST_KW) function. + * + * \note If the data is not authentic, then the output buffer + * is zeroed out to prevent the unauthentic plaintext being + * used, making this interface safer. + * + * \note For AEAD modes, the tag must be appended to the + * ciphertext, as recommended by RFC 5116. + * (NIST_KW doesn't have a separate tag.) + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a key, with an AEAD algorithm or NIST_KW. + * \param iv The nonce to use. This must be a readable buffer of + * at least \p iv_len Bytes and may be \c NULL if \p + * iv_len is \c 0. + * \param iv_len The length of the nonce. For AEAD ciphers, this must + * satisfy the constraints imposed by the cipher used. + * For NIST_KW, this must be \c 0. + * \param ad The additional data to authenticate. This must be a + * readable buffer of at least \p ad_len Bytes, and may + * be \c NULL is \p ad_len is \c 0. + * \param ad_len The length of \p ad. For NIST_KW, this must be \c 0. + * \param input The buffer holding the input data. This must be a + * readable buffer of at least \p ilen Bytes, and may be + * \c NULL if \p ilen is \c 0. + * \param ilen The length of the input data. For AEAD ciphers this + * must be at least \p tag_len. For NIST_KW this must be + * at least \c 8. + * \param output The buffer for the output data. This must be a + * writable buffer of at least \p output_len Bytes, and + * may be \c NULL if \p output_len is \c 0. + * \param output_len The length of the \p output buffer in Bytes. For AEAD + * ciphers, this must be at least \p ilen - \p tag_len. + * For NIST_KW, this must be at least \p ilen - 8. + * \param olen This will be filled with the actual number of Bytes + * written to the \p output buffer. This must point to a + * writable object of type \c size_t. + * \param tag_len The actual length of the authentication tag. For AEAD + * ciphers, this must match the constraints imposed by + * the cipher used, and in particular must not be \c 0. + * For NIST_KW, this must be \c 0. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_AUTH_FAILED if data is not authentic. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_auth_decrypt_ext( mbedtls_cipher_context_t *ctx, + const unsigned char *iv, size_t iv_len, + const unsigned char *ad, size_t ad_len, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t output_len, + size_t *olen, size_t tag_len ); +#endif /* MBEDTLS_CIPHER_MODE_AEAD || MBEDTLS_NIST_KW_C */ +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CIPHER_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/cipher_internal.h b/openharmony/arm64-v8a/include/mbedtls/cipher_internal.h new file mode 100644 index 00000000..2484c01c --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/cipher_internal.h @@ -0,0 +1,150 @@ +/** + * \file cipher_internal.h + * + * \brief Cipher wrappers. + * + * \author Adriaan de Jong + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_CIPHER_WRAP_H +#define MBEDTLS_CIPHER_WRAP_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/cipher.h" + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#include "psa/crypto.h" +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Base cipher information. The non-mode specific functions and values. + */ +struct mbedtls_cipher_base_t +{ + /** Base Cipher type (e.g. MBEDTLS_CIPHER_ID_AES) */ + mbedtls_cipher_id_t cipher; + + /** Encrypt using ECB */ + int (*ecb_func)( void *ctx, mbedtls_operation_t mode, + const unsigned char *input, unsigned char *output ); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) + /** Encrypt using CBC */ + int (*cbc_func)( void *ctx, mbedtls_operation_t mode, size_t length, + unsigned char *iv, const unsigned char *input, + unsigned char *output ); +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CFB) + /** Encrypt using CFB (Full length) */ + int (*cfb_func)( void *ctx, mbedtls_operation_t mode, size_t length, size_t *iv_off, + unsigned char *iv, const unsigned char *input, + unsigned char *output ); +#endif + +#if defined(MBEDTLS_CIPHER_MODE_OFB) + /** Encrypt using OFB (Full length) */ + int (*ofb_func)( void *ctx, size_t length, size_t *iv_off, + unsigned char *iv, + const unsigned char *input, + unsigned char *output ); +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CTR) + /** Encrypt using CTR */ + int (*ctr_func)( void *ctx, size_t length, size_t *nc_off, + unsigned char *nonce_counter, unsigned char *stream_block, + const unsigned char *input, unsigned char *output ); +#endif + +#if defined(MBEDTLS_CIPHER_MODE_XTS) + /** Encrypt or decrypt using XTS. */ + int (*xts_func)( void *ctx, mbedtls_operation_t mode, size_t length, + const unsigned char data_unit[16], + const unsigned char *input, unsigned char *output ); +#endif + +#if defined(MBEDTLS_CIPHER_MODE_STREAM) + /** Encrypt using STREAM */ + int (*stream_func)( void *ctx, size_t length, + const unsigned char *input, unsigned char *output ); +#endif + + /** Set key for encryption purposes */ + int (*setkey_enc_func)( void *ctx, const unsigned char *key, + unsigned int key_bitlen ); + + /** Set key for decryption purposes */ + int (*setkey_dec_func)( void *ctx, const unsigned char *key, + unsigned int key_bitlen); + + /** Allocate a new context */ + void * (*ctx_alloc_func)( void ); + + /** Free the given context */ + void (*ctx_free_func)( void *ctx ); + +}; + +typedef struct +{ + mbedtls_cipher_type_t type; + const mbedtls_cipher_info_t *info; +} mbedtls_cipher_definition_t; + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +typedef enum +{ + MBEDTLS_CIPHER_PSA_KEY_UNSET = 0, + MBEDTLS_CIPHER_PSA_KEY_OWNED, /* Used for PSA-based cipher contexts which */ + /* use raw key material internally imported */ + /* as a volatile key, and which hence need */ + /* to destroy that key when the context is */ + /* freed. */ + MBEDTLS_CIPHER_PSA_KEY_NOT_OWNED, /* Used for PSA-based cipher contexts */ + /* which use a key provided by the */ + /* user, and which hence will not be */ + /* destroyed when the context is freed. */ +} mbedtls_cipher_psa_key_ownership; + +typedef struct +{ + psa_algorithm_t alg; + psa_key_id_t slot; + mbedtls_cipher_psa_key_ownership slot_state; +} mbedtls_cipher_context_psa; +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +extern const mbedtls_cipher_definition_t mbedtls_cipher_definitions[]; + +extern int mbedtls_cipher_supported[]; + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CIPHER_WRAP_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/cmac.h b/openharmony/arm64-v8a/include/mbedtls/cmac.h new file mode 100644 index 00000000..8934886a --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/cmac.h @@ -0,0 +1,247 @@ +/** + * \file cmac.h + * + * \brief This file contains CMAC definitions and functions. + * + * The Cipher-based Message Authentication Code (CMAC) Mode for + * Authentication is defined in RFC-4493: The AES-CMAC Algorithm. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CMAC_H +#define MBEDTLS_CMAC_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/cipher.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/* MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** CMAC hardware accelerator failed. */ +#define MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED -0x007A + +#define MBEDTLS_AES_BLOCK_SIZE 16 +#define MBEDTLS_DES3_BLOCK_SIZE 8 + +#if defined(MBEDTLS_AES_C) +#define MBEDTLS_CIPHER_BLKSIZE_MAX 16 /**< The longest block used by CMAC is that of AES. */ +#else +#define MBEDTLS_CIPHER_BLKSIZE_MAX 8 /**< The longest block used by CMAC is that of 3DES. */ +#endif + +#if !defined(MBEDTLS_CMAC_ALT) + +/** + * The CMAC context structure. + */ +struct mbedtls_cmac_context_t +{ + /** The internal state of the CMAC algorithm. */ + unsigned char state[MBEDTLS_CIPHER_BLKSIZE_MAX]; + + /** Unprocessed data - either data that was not block aligned and is still + * pending processing, or the final block. */ + unsigned char unprocessed_block[MBEDTLS_CIPHER_BLKSIZE_MAX]; + + /** The length of data pending processing. */ + size_t unprocessed_len; +}; + +#else /* !MBEDTLS_CMAC_ALT */ +#include "cmac_alt.h" +#endif /* !MBEDTLS_CMAC_ALT */ + +/** + * \brief This function starts a new CMAC computation + * by setting the CMAC key, and preparing to authenticate + * the input data. + * It must be called with an initialized cipher context. + * + * Once this function has completed, data can be supplied + * to the CMAC computation by calling + * mbedtls_cipher_cmac_update(). + * + * To start a CMAC computation using the same key as a previous + * CMAC computation, use mbedtls_cipher_cmac_finish(). + * + * \note When the CMAC implementation is supplied by an alternate + * implementation (through #MBEDTLS_CMAC_ALT), some ciphers + * may not be supported by that implementation, and thus + * return an error. Alternate implementations must support + * AES-128 and AES-256, and may support AES-192 and 3DES. + * + * \param ctx The cipher context used for the CMAC operation, initialized + * as one of the following types: MBEDTLS_CIPHER_AES_128_ECB, + * MBEDTLS_CIPHER_AES_192_ECB, MBEDTLS_CIPHER_AES_256_ECB, + * or MBEDTLS_CIPHER_DES_EDE3_ECB. + * \param key The CMAC key. + * \param keybits The length of the CMAC key in bits. + * Must be supported by the cipher. + * + * \return \c 0 on success. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_cmac_starts( mbedtls_cipher_context_t *ctx, + const unsigned char *key, size_t keybits ); + +/** + * \brief This function feeds an input buffer into an ongoing CMAC + * computation. + * + * The CMAC computation must have previously been started + * by calling mbedtls_cipher_cmac_starts() or + * mbedtls_cipher_cmac_reset(). + * + * Call this function as many times as needed to input the + * data to be authenticated. + * Once all of the required data has been input, + * call mbedtls_cipher_cmac_finish() to obtain the result + * of the CMAC operation. + * + * \param ctx The cipher context used for the CMAC operation. + * \param input The buffer holding the input data. + * \param ilen The length of the input data. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA + * if parameter verification fails. + */ +int mbedtls_cipher_cmac_update( mbedtls_cipher_context_t *ctx, + const unsigned char *input, size_t ilen ); + +/** + * \brief This function finishes an ongoing CMAC operation, and + * writes the result to the output buffer. + * + * It should be followed either by + * mbedtls_cipher_cmac_reset(), which starts another CMAC + * operation with the same key, or mbedtls_cipher_free(), + * which clears the cipher context. + * + * \param ctx The cipher context used for the CMAC operation. + * \param output The output buffer for the CMAC checksum result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA + * if parameter verification fails. + */ +int mbedtls_cipher_cmac_finish( mbedtls_cipher_context_t *ctx, + unsigned char *output ); + +/** + * \brief This function starts a new CMAC operation with the same + * key as the previous one. + * + * It should be called after finishing the previous CMAC + * operation with mbedtls_cipher_cmac_finish(). + * After calling this function, + * call mbedtls_cipher_cmac_update() to supply the new + * CMAC operation with data. + * + * \param ctx The cipher context used for the CMAC operation. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA + * if parameter verification fails. + */ +int mbedtls_cipher_cmac_reset( mbedtls_cipher_context_t *ctx ); + +/** + * \brief This function calculates the full generic CMAC + * on the input buffer with the provided key. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The CMAC result is calculated as + * output = generic CMAC(cmac key, input buffer). + * + * \note When the CMAC implementation is supplied by an alternate + * implementation (through #MBEDTLS_CMAC_ALT), some ciphers + * may not be supported by that implementation, and thus + * return an error. Alternate implementations must support + * AES-128 and AES-256, and may support AES-192 and 3DES. + * + * \param cipher_info The cipher information. + * \param key The CMAC key. + * \param keylen The length of the CMAC key in bits. + * \param input The buffer holding the input data. + * \param ilen The length of the input data. + * \param output The buffer for the generic CMAC result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA + * if parameter verification fails. + */ +int mbedtls_cipher_cmac( const mbedtls_cipher_info_t *cipher_info, + const unsigned char *key, size_t keylen, + const unsigned char *input, size_t ilen, + unsigned char *output ); + +#if defined(MBEDTLS_AES_C) +/** + * \brief This function implements the AES-CMAC-PRF-128 pseudorandom + * function, as defined in + * RFC-4615: The Advanced Encryption Standard-Cipher-based + * Message Authentication Code-Pseudo-Random Function-128 + * (AES-CMAC-PRF-128) Algorithm for the Internet Key + * Exchange Protocol (IKE). + * + * \param key The key to use. + * \param key_len The key length in Bytes. + * \param input The buffer holding the input data. + * \param in_len The length of the input data in Bytes. + * \param output The buffer holding the generated 16 Bytes of + * pseudorandom output. + * + * \return \c 0 on success. + */ +int mbedtls_aes_cmac_prf_128( const unsigned char *key, size_t key_len, + const unsigned char *input, size_t in_len, + unsigned char output[16] ); +#endif /* MBEDTLS_AES_C */ + +#if defined(MBEDTLS_SELF_TEST) && ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_DES_C) ) +/** + * \brief The CMAC checkup routine. + * + * \note In case the CMAC routines are provided by an alternative + * implementation (i.e. #MBEDTLS_CMAC_ALT is defined), the + * checkup routine will succeed even if the implementation does + * not support the less widely used AES-192 or 3DES primitives. + * The self-test requires at least AES-128 and AES-256 to be + * supported by the underlying implementation. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_cmac_self_test( int verbose ); +#endif /* MBEDTLS_SELF_TEST && ( MBEDTLS_AES_C || MBEDTLS_DES_C ) */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CMAC_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/compat-1.3.h b/openharmony/arm64-v8a/include/mbedtls/compat-1.3.h new file mode 100644 index 00000000..40177512 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/compat-1.3.h @@ -0,0 +1,2529 @@ +/** + * \file compat-1.3.h + * + * \brief Compatibility definitions for using mbed TLS with client code written + * for the PolarSSL naming conventions. + * + * \deprecated Use the new names directly instead + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#if ! defined(MBEDTLS_DEPRECATED_REMOVED) + +#if defined(MBEDTLS_DEPRECATED_WARNING) +#warning "Including compat-1.3.h is deprecated" +#endif + +#ifndef MBEDTLS_COMPAT13_H +#define MBEDTLS_COMPAT13_H + +/* + * config.h options + */ +#if defined MBEDTLS_AESNI_C +#define POLARSSL_AESNI_C MBEDTLS_AESNI_C +#endif +#if defined MBEDTLS_AES_ALT +#define POLARSSL_AES_ALT MBEDTLS_AES_ALT +#endif +#if defined MBEDTLS_AES_C +#define POLARSSL_AES_C MBEDTLS_AES_C +#endif +#if defined MBEDTLS_AES_ROM_TABLES +#define POLARSSL_AES_ROM_TABLES MBEDTLS_AES_ROM_TABLES +#endif +#if defined MBEDTLS_ARC4_ALT +#define POLARSSL_ARC4_ALT MBEDTLS_ARC4_ALT +#endif +#if defined MBEDTLS_ARC4_C +#define POLARSSL_ARC4_C MBEDTLS_ARC4_C +#endif +#if defined MBEDTLS_ASN1_PARSE_C +#define POLARSSL_ASN1_PARSE_C MBEDTLS_ASN1_PARSE_C +#endif +#if defined MBEDTLS_ASN1_WRITE_C +#define POLARSSL_ASN1_WRITE_C MBEDTLS_ASN1_WRITE_C +#endif +#if defined MBEDTLS_BASE64_C +#define POLARSSL_BASE64_C MBEDTLS_BASE64_C +#endif +#if defined MBEDTLS_BIGNUM_C +#define POLARSSL_BIGNUM_C MBEDTLS_BIGNUM_C +#endif +#if defined MBEDTLS_BLOWFISH_ALT +#define POLARSSL_BLOWFISH_ALT MBEDTLS_BLOWFISH_ALT +#endif +#if defined MBEDTLS_BLOWFISH_C +#define POLARSSL_BLOWFISH_C MBEDTLS_BLOWFISH_C +#endif +#if defined MBEDTLS_CAMELLIA_ALT +#define POLARSSL_CAMELLIA_ALT MBEDTLS_CAMELLIA_ALT +#endif +#if defined MBEDTLS_CAMELLIA_C +#define POLARSSL_CAMELLIA_C MBEDTLS_CAMELLIA_C +#endif +#if defined MBEDTLS_CAMELLIA_SMALL_MEMORY +#define POLARSSL_CAMELLIA_SMALL_MEMORY MBEDTLS_CAMELLIA_SMALL_MEMORY +#endif +#if defined MBEDTLS_CCM_C +#define POLARSSL_CCM_C MBEDTLS_CCM_C +#endif +#if defined MBEDTLS_CERTS_C +#define POLARSSL_CERTS_C MBEDTLS_CERTS_C +#endif +#if defined MBEDTLS_CIPHER_C +#define POLARSSL_CIPHER_C MBEDTLS_CIPHER_C +#endif +#if defined MBEDTLS_CIPHER_MODE_CBC +#define POLARSSL_CIPHER_MODE_CBC MBEDTLS_CIPHER_MODE_CBC +#endif +#if defined MBEDTLS_CIPHER_MODE_CFB +#define POLARSSL_CIPHER_MODE_CFB MBEDTLS_CIPHER_MODE_CFB +#endif +#if defined MBEDTLS_CIPHER_MODE_CTR +#define POLARSSL_CIPHER_MODE_CTR MBEDTLS_CIPHER_MODE_CTR +#endif +#if defined MBEDTLS_CIPHER_NULL_CIPHER +#define POLARSSL_CIPHER_NULL_CIPHER MBEDTLS_CIPHER_NULL_CIPHER +#endif +#if defined MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS +#define POLARSSL_CIPHER_PADDING_ONE_AND_ZEROS MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS +#endif +#if defined MBEDTLS_CIPHER_PADDING_PKCS7 +#define POLARSSL_CIPHER_PADDING_PKCS7 MBEDTLS_CIPHER_PADDING_PKCS7 +#endif +#if defined MBEDTLS_CIPHER_PADDING_ZEROS +#define POLARSSL_CIPHER_PADDING_ZEROS MBEDTLS_CIPHER_PADDING_ZEROS +#endif +#if defined MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN +#define POLARSSL_CIPHER_PADDING_ZEROS_AND_LEN MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN +#endif +#if defined MBEDTLS_CTR_DRBG_C +#define POLARSSL_CTR_DRBG_C MBEDTLS_CTR_DRBG_C +#endif +#if defined MBEDTLS_DEBUG_C +#define POLARSSL_DEBUG_C MBEDTLS_DEBUG_C +#endif +#if defined MBEDTLS_DEPRECATED_REMOVED +#define POLARSSL_DEPRECATED_REMOVED MBEDTLS_DEPRECATED_REMOVED +#endif +#if defined MBEDTLS_DEPRECATED_WARNING +#define POLARSSL_DEPRECATED_WARNING MBEDTLS_DEPRECATED_WARNING +#endif +#if defined MBEDTLS_DES_ALT +#define POLARSSL_DES_ALT MBEDTLS_DES_ALT +#endif +#if defined MBEDTLS_DES_C +#define POLARSSL_DES_C MBEDTLS_DES_C +#endif +#if defined MBEDTLS_DHM_C +#define POLARSSL_DHM_C MBEDTLS_DHM_C +#endif +#if defined MBEDTLS_ECDH_C +#define POLARSSL_ECDH_C MBEDTLS_ECDH_C +#endif +#if defined MBEDTLS_ECDSA_C +#define POLARSSL_ECDSA_C MBEDTLS_ECDSA_C +#endif +#if defined MBEDTLS_ECDSA_DETERMINISTIC +#define POLARSSL_ECDSA_DETERMINISTIC MBEDTLS_ECDSA_DETERMINISTIC +#endif +#if defined MBEDTLS_ECP_C +#define POLARSSL_ECP_C MBEDTLS_ECP_C +#endif +#if defined MBEDTLS_ECP_DP_BP256R1_ENABLED +#define POLARSSL_ECP_DP_BP256R1_ENABLED MBEDTLS_ECP_DP_BP256R1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_BP384R1_ENABLED +#define POLARSSL_ECP_DP_BP384R1_ENABLED MBEDTLS_ECP_DP_BP384R1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_BP512R1_ENABLED +#define POLARSSL_ECP_DP_BP512R1_ENABLED MBEDTLS_ECP_DP_BP512R1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_CURVE25519_ENABLED +#define POLARSSL_ECP_DP_M255_ENABLED MBEDTLS_ECP_DP_CURVE25519_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_SECP192K1_ENABLED +#define POLARSSL_ECP_DP_SECP192K1_ENABLED MBEDTLS_ECP_DP_SECP192K1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_SECP192R1_ENABLED +#define POLARSSL_ECP_DP_SECP192R1_ENABLED MBEDTLS_ECP_DP_SECP192R1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_SECP224K1_ENABLED +#define POLARSSL_ECP_DP_SECP224K1_ENABLED MBEDTLS_ECP_DP_SECP224K1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_SECP224R1_ENABLED +#define POLARSSL_ECP_DP_SECP224R1_ENABLED MBEDTLS_ECP_DP_SECP224R1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_SECP256K1_ENABLED +#define POLARSSL_ECP_DP_SECP256K1_ENABLED MBEDTLS_ECP_DP_SECP256K1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_SECP256R1_ENABLED +#define POLARSSL_ECP_DP_SECP256R1_ENABLED MBEDTLS_ECP_DP_SECP256R1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_SECP384R1_ENABLED +#define POLARSSL_ECP_DP_SECP384R1_ENABLED MBEDTLS_ECP_DP_SECP384R1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_SECP521R1_ENABLED +#define POLARSSL_ECP_DP_SECP521R1_ENABLED MBEDTLS_ECP_DP_SECP521R1_ENABLED +#endif +#if defined MBEDTLS_ECP_FIXED_POINT_OPTIM +#define POLARSSL_ECP_FIXED_POINT_OPTIM MBEDTLS_ECP_FIXED_POINT_OPTIM +#endif +#if defined MBEDTLS_ECP_MAX_BITS +#define POLARSSL_ECP_MAX_BITS MBEDTLS_ECP_MAX_BITS +#endif +#if defined MBEDTLS_ECP_NIST_OPTIM +#define POLARSSL_ECP_NIST_OPTIM MBEDTLS_ECP_NIST_OPTIM +#endif +#if defined MBEDTLS_ECP_WINDOW_SIZE +#define POLARSSL_ECP_WINDOW_SIZE MBEDTLS_ECP_WINDOW_SIZE +#endif +#if defined MBEDTLS_ENABLE_WEAK_CIPHERSUITES +#define POLARSSL_ENABLE_WEAK_CIPHERSUITES MBEDTLS_ENABLE_WEAK_CIPHERSUITES +#endif +#if defined MBEDTLS_ENTROPY_C +#define POLARSSL_ENTROPY_C MBEDTLS_ENTROPY_C +#endif +#if defined MBEDTLS_ENTROPY_FORCE_SHA256 +#define POLARSSL_ENTROPY_FORCE_SHA256 MBEDTLS_ENTROPY_FORCE_SHA256 +#endif +#if defined MBEDTLS_ERROR_C +#define POLARSSL_ERROR_C MBEDTLS_ERROR_C +#endif +#if defined MBEDTLS_ERROR_STRERROR_DUMMY +#define POLARSSL_ERROR_STRERROR_DUMMY MBEDTLS_ERROR_STRERROR_DUMMY +#endif +#if defined MBEDTLS_FS_IO +#define POLARSSL_FS_IO MBEDTLS_FS_IO +#endif +#if defined MBEDTLS_GCM_C +#define POLARSSL_GCM_C MBEDTLS_GCM_C +#endif +#if defined MBEDTLS_GENPRIME +#define POLARSSL_GENPRIME MBEDTLS_GENPRIME +#endif +#if defined MBEDTLS_HAVEGE_C +#define POLARSSL_HAVEGE_C MBEDTLS_HAVEGE_C +#endif +#if defined MBEDTLS_HAVE_ASM +#define POLARSSL_HAVE_ASM MBEDTLS_HAVE_ASM +#endif +#if defined MBEDTLS_HAVE_SSE2 +#define POLARSSL_HAVE_SSE2 MBEDTLS_HAVE_SSE2 +#endif +#if defined MBEDTLS_HAVE_TIME +#define POLARSSL_HAVE_TIME MBEDTLS_HAVE_TIME +#endif +#if defined MBEDTLS_HMAC_DRBG_C +#define POLARSSL_HMAC_DRBG_C MBEDTLS_HMAC_DRBG_C +#endif +#if defined MBEDTLS_HMAC_DRBG_MAX_INPUT +#define POLARSSL_HMAC_DRBG_MAX_INPUT MBEDTLS_HMAC_DRBG_MAX_INPUT +#endif +#if defined MBEDTLS_HMAC_DRBG_MAX_REQUEST +#define POLARSSL_HMAC_DRBG_MAX_REQUEST MBEDTLS_HMAC_DRBG_MAX_REQUEST +#endif +#if defined MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT +#define POLARSSL_HMAC_DRBG_MAX_SEED_INPUT MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT +#endif +#if defined MBEDTLS_HMAC_DRBG_RESEED_INTERVAL +#define POLARSSL_HMAC_DRBG_RESEED_INTERVAL MBEDTLS_HMAC_DRBG_RESEED_INTERVAL +#endif +#if defined MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED +#define POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED +#define POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED +#define POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED +#define POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED +#define POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED +#define POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED +#define POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_PSK_ENABLED +#define POLARSSL_KEY_EXCHANGE_PSK_ENABLED MBEDTLS_KEY_EXCHANGE_PSK_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_RSA_ENABLED +#define POLARSSL_KEY_EXCHANGE_RSA_ENABLED MBEDTLS_KEY_EXCHANGE_RSA_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED +#define POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED +#endif +#if defined MBEDTLS_MD2_ALT +#define POLARSSL_MD2_ALT MBEDTLS_MD2_ALT +#endif +#if defined MBEDTLS_MD2_C +#define POLARSSL_MD2_C MBEDTLS_MD2_C +#endif +#if defined MBEDTLS_MD2_PROCESS_ALT +#define POLARSSL_MD2_PROCESS_ALT MBEDTLS_MD2_PROCESS_ALT +#endif +#if defined MBEDTLS_MD4_ALT +#define POLARSSL_MD4_ALT MBEDTLS_MD4_ALT +#endif +#if defined MBEDTLS_MD4_C +#define POLARSSL_MD4_C MBEDTLS_MD4_C +#endif +#if defined MBEDTLS_MD4_PROCESS_ALT +#define POLARSSL_MD4_PROCESS_ALT MBEDTLS_MD4_PROCESS_ALT +#endif +#if defined MBEDTLS_MD5_ALT +#define POLARSSL_MD5_ALT MBEDTLS_MD5_ALT +#endif +#if defined MBEDTLS_MD5_C +#define POLARSSL_MD5_C MBEDTLS_MD5_C +#endif +#if defined MBEDTLS_MD5_PROCESS_ALT +#define POLARSSL_MD5_PROCESS_ALT MBEDTLS_MD5_PROCESS_ALT +#endif +#if defined MBEDTLS_MD_C +#define POLARSSL_MD_C MBEDTLS_MD_C +#endif +#if defined MBEDTLS_MEMORY_ALIGN_MULTIPLE +#define POLARSSL_MEMORY_ALIGN_MULTIPLE MBEDTLS_MEMORY_ALIGN_MULTIPLE +#endif +#if defined MBEDTLS_MEMORY_BACKTRACE +#define POLARSSL_MEMORY_BACKTRACE MBEDTLS_MEMORY_BACKTRACE +#endif +#if defined MBEDTLS_MEMORY_BUFFER_ALLOC_C +#define POLARSSL_MEMORY_BUFFER_ALLOC_C MBEDTLS_MEMORY_BUFFER_ALLOC_C +#endif +#if defined MBEDTLS_MEMORY_DEBUG +#define POLARSSL_MEMORY_DEBUG MBEDTLS_MEMORY_DEBUG +#endif +#if defined MBEDTLS_MPI_MAX_SIZE +#define POLARSSL_MPI_MAX_SIZE MBEDTLS_MPI_MAX_SIZE +#endif +#if defined MBEDTLS_MPI_WINDOW_SIZE +#define POLARSSL_MPI_WINDOW_SIZE MBEDTLS_MPI_WINDOW_SIZE +#endif +#if defined MBEDTLS_NET_C +#define POLARSSL_NET_C MBEDTLS_NET_C +#endif +#if defined MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES +#define POLARSSL_NO_DEFAULT_ENTROPY_SOURCES MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES +#endif +#if defined MBEDTLS_NO_PLATFORM_ENTROPY +#define POLARSSL_NO_PLATFORM_ENTROPY MBEDTLS_NO_PLATFORM_ENTROPY +#endif +#if defined MBEDTLS_OID_C +#define POLARSSL_OID_C MBEDTLS_OID_C +#endif +#if defined MBEDTLS_PADLOCK_C +#define POLARSSL_PADLOCK_C MBEDTLS_PADLOCK_C +#endif +#if defined MBEDTLS_PEM_PARSE_C +#define POLARSSL_PEM_PARSE_C MBEDTLS_PEM_PARSE_C +#endif +#if defined MBEDTLS_PEM_WRITE_C +#define POLARSSL_PEM_WRITE_C MBEDTLS_PEM_WRITE_C +#endif +#if defined MBEDTLS_PKCS11_C +#define POLARSSL_PKCS11_C MBEDTLS_PKCS11_C +#endif +#if defined MBEDTLS_PKCS12_C +#define POLARSSL_PKCS12_C MBEDTLS_PKCS12_C +#endif +#if defined MBEDTLS_PKCS1_V15 +#define POLARSSL_PKCS1_V15 MBEDTLS_PKCS1_V15 +#endif +#if defined MBEDTLS_PKCS1_V21 +#define POLARSSL_PKCS1_V21 MBEDTLS_PKCS1_V21 +#endif +#if defined MBEDTLS_PKCS5_C +#define POLARSSL_PKCS5_C MBEDTLS_PKCS5_C +#endif +#if defined MBEDTLS_PK_C +#define POLARSSL_PK_C MBEDTLS_PK_C +#endif +#if defined MBEDTLS_PK_PARSE_C +#define POLARSSL_PK_PARSE_C MBEDTLS_PK_PARSE_C +#endif +#if defined MBEDTLS_PK_PARSE_EC_EXTENDED +#define POLARSSL_PK_PARSE_EC_EXTENDED MBEDTLS_PK_PARSE_EC_EXTENDED +#endif +#if defined MBEDTLS_PK_RSA_ALT_SUPPORT +#define POLARSSL_PK_RSA_ALT_SUPPORT MBEDTLS_PK_RSA_ALT_SUPPORT +#endif +#if defined MBEDTLS_PK_WRITE_C +#define POLARSSL_PK_WRITE_C MBEDTLS_PK_WRITE_C +#endif +#if defined MBEDTLS_PLATFORM_C +#define POLARSSL_PLATFORM_C MBEDTLS_PLATFORM_C +#endif +#if defined MBEDTLS_PLATFORM_EXIT_ALT +#define POLARSSL_PLATFORM_EXIT_ALT MBEDTLS_PLATFORM_EXIT_ALT +#endif +#if defined MBEDTLS_PLATFORM_EXIT_MACRO +#define POLARSSL_PLATFORM_EXIT_MACRO MBEDTLS_PLATFORM_EXIT_MACRO +#endif +#if defined MBEDTLS_PLATFORM_FPRINTF_ALT +#define POLARSSL_PLATFORM_FPRINTF_ALT MBEDTLS_PLATFORM_FPRINTF_ALT +#endif +#if defined MBEDTLS_PLATFORM_FPRINTF_MACRO +#define POLARSSL_PLATFORM_FPRINTF_MACRO MBEDTLS_PLATFORM_FPRINTF_MACRO +#endif +#if defined MBEDTLS_PLATFORM_FREE_MACRO +#define POLARSSL_PLATFORM_FREE_MACRO MBEDTLS_PLATFORM_FREE_MACRO +#endif +#if defined MBEDTLS_PLATFORM_MEMORY +#define POLARSSL_PLATFORM_MEMORY MBEDTLS_PLATFORM_MEMORY +#endif +#if defined MBEDTLS_PLATFORM_NO_STD_FUNCTIONS +#define POLARSSL_PLATFORM_NO_STD_FUNCTIONS MBEDTLS_PLATFORM_NO_STD_FUNCTIONS +#endif +#if defined MBEDTLS_PLATFORM_PRINTF_ALT +#define POLARSSL_PLATFORM_PRINTF_ALT MBEDTLS_PLATFORM_PRINTF_ALT +#endif +#if defined MBEDTLS_PLATFORM_PRINTF_MACRO +#define POLARSSL_PLATFORM_PRINTF_MACRO MBEDTLS_PLATFORM_PRINTF_MACRO +#endif +#if defined MBEDTLS_PLATFORM_SNPRINTF_ALT +#define POLARSSL_PLATFORM_SNPRINTF_ALT MBEDTLS_PLATFORM_SNPRINTF_ALT +#endif +#if defined MBEDTLS_PLATFORM_SNPRINTF_MACRO +#define POLARSSL_PLATFORM_SNPRINTF_MACRO MBEDTLS_PLATFORM_SNPRINTF_MACRO +#endif +#if defined MBEDTLS_PLATFORM_STD_EXIT +#define POLARSSL_PLATFORM_STD_EXIT MBEDTLS_PLATFORM_STD_EXIT +#endif +#if defined MBEDTLS_PLATFORM_STD_FPRINTF +#define POLARSSL_PLATFORM_STD_FPRINTF MBEDTLS_PLATFORM_STD_FPRINTF +#endif +#if defined MBEDTLS_PLATFORM_STD_FREE +#define POLARSSL_PLATFORM_STD_FREE MBEDTLS_PLATFORM_STD_FREE +#endif +#if defined MBEDTLS_PLATFORM_STD_MEM_HDR +#define POLARSSL_PLATFORM_STD_MEM_HDR MBEDTLS_PLATFORM_STD_MEM_HDR +#endif +#if defined MBEDTLS_PLATFORM_STD_PRINTF +#define POLARSSL_PLATFORM_STD_PRINTF MBEDTLS_PLATFORM_STD_PRINTF +#endif +#if defined MBEDTLS_PLATFORM_STD_SNPRINTF +#define POLARSSL_PLATFORM_STD_SNPRINTF MBEDTLS_PLATFORM_STD_SNPRINTF +#endif +#if defined MBEDTLS_PSK_MAX_LEN +#define POLARSSL_PSK_MAX_LEN MBEDTLS_PSK_MAX_LEN +#endif +#if defined MBEDTLS_REMOVE_ARC4_CIPHERSUITES +#define POLARSSL_REMOVE_ARC4_CIPHERSUITES MBEDTLS_REMOVE_ARC4_CIPHERSUITES +#endif +#if defined MBEDTLS_RIPEMD160_ALT +#define POLARSSL_RIPEMD160_ALT MBEDTLS_RIPEMD160_ALT +#endif +#if defined MBEDTLS_RIPEMD160_C +#define POLARSSL_RIPEMD160_C MBEDTLS_RIPEMD160_C +#endif +#if defined MBEDTLS_RIPEMD160_PROCESS_ALT +#define POLARSSL_RIPEMD160_PROCESS_ALT MBEDTLS_RIPEMD160_PROCESS_ALT +#endif +#if defined MBEDTLS_RSA_C +#define POLARSSL_RSA_C MBEDTLS_RSA_C +#endif +#if defined MBEDTLS_RSA_NO_CRT +#define POLARSSL_RSA_NO_CRT MBEDTLS_RSA_NO_CRT +#endif +#if defined MBEDTLS_SELF_TEST +#define POLARSSL_SELF_TEST MBEDTLS_SELF_TEST +#endif +#if defined MBEDTLS_SHA1_ALT +#define POLARSSL_SHA1_ALT MBEDTLS_SHA1_ALT +#endif +#if defined MBEDTLS_SHA1_C +#define POLARSSL_SHA1_C MBEDTLS_SHA1_C +#endif +#if defined MBEDTLS_SHA1_PROCESS_ALT +#define POLARSSL_SHA1_PROCESS_ALT MBEDTLS_SHA1_PROCESS_ALT +#endif +#if defined MBEDTLS_SHA256_ALT +#define POLARSSL_SHA256_ALT MBEDTLS_SHA256_ALT +#endif +#if defined MBEDTLS_SHA256_C +#define POLARSSL_SHA256_C MBEDTLS_SHA256_C +#endif +#if defined MBEDTLS_SHA256_PROCESS_ALT +#define POLARSSL_SHA256_PROCESS_ALT MBEDTLS_SHA256_PROCESS_ALT +#endif +#if defined MBEDTLS_SHA512_ALT +#define POLARSSL_SHA512_ALT MBEDTLS_SHA512_ALT +#endif +#if defined MBEDTLS_SHA512_C +#define POLARSSL_SHA512_C MBEDTLS_SHA512_C +#endif +#if defined MBEDTLS_SHA512_PROCESS_ALT +#define POLARSSL_SHA512_PROCESS_ALT MBEDTLS_SHA512_PROCESS_ALT +#endif +#if defined MBEDTLS_SSL_ALL_ALERT_MESSAGES +#define POLARSSL_SSL_ALL_ALERT_MESSAGES MBEDTLS_SSL_ALL_ALERT_MESSAGES +#endif +#if defined MBEDTLS_SSL_ALPN +#define POLARSSL_SSL_ALPN MBEDTLS_SSL_ALPN +#endif +#if defined MBEDTLS_SSL_CACHE_C +#define POLARSSL_SSL_CACHE_C MBEDTLS_SSL_CACHE_C +#endif +#if defined MBEDTLS_SSL_CBC_RECORD_SPLITTING +#define POLARSSL_SSL_CBC_RECORD_SPLITTING MBEDTLS_SSL_CBC_RECORD_SPLITTING +#endif +#if defined MBEDTLS_SSL_CLI_C +#define POLARSSL_SSL_CLI_C MBEDTLS_SSL_CLI_C +#endif +#if defined MBEDTLS_SSL_COOKIE_C +#define POLARSSL_SSL_COOKIE_C MBEDTLS_SSL_COOKIE_C +#endif +#if defined MBEDTLS_SSL_COOKIE_TIMEOUT +#define POLARSSL_SSL_COOKIE_TIMEOUT MBEDTLS_SSL_COOKIE_TIMEOUT +#endif +#if defined MBEDTLS_SSL_DEBUG_ALL +#define POLARSSL_SSL_DEBUG_ALL MBEDTLS_SSL_DEBUG_ALL +#endif +#if defined MBEDTLS_SSL_DTLS_ANTI_REPLAY +#define POLARSSL_SSL_DTLS_ANTI_REPLAY MBEDTLS_SSL_DTLS_ANTI_REPLAY +#endif +#if defined MBEDTLS_SSL_DTLS_BADMAC_LIMIT +#define POLARSSL_SSL_DTLS_BADMAC_LIMIT MBEDTLS_SSL_DTLS_BADMAC_LIMIT +#endif +#if defined MBEDTLS_SSL_DTLS_HELLO_VERIFY +#define POLARSSL_SSL_DTLS_HELLO_VERIFY MBEDTLS_SSL_DTLS_HELLO_VERIFY +#endif +#if defined MBEDTLS_SSL_ENCRYPT_THEN_MAC +#define POLARSSL_SSL_ENCRYPT_THEN_MAC MBEDTLS_SSL_ENCRYPT_THEN_MAC +#endif +#if defined MBEDTLS_SSL_EXTENDED_MASTER_SECRET +#define POLARSSL_SSL_EXTENDED_MASTER_SECRET MBEDTLS_SSL_EXTENDED_MASTER_SECRET +#endif +#if defined MBEDTLS_SSL_FALLBACK_SCSV +#define POLARSSL_SSL_FALLBACK_SCSV MBEDTLS_SSL_FALLBACK_SCSV +#endif +#if defined MBEDTLS_SSL_HW_RECORD_ACCEL +#define POLARSSL_SSL_HW_RECORD_ACCEL MBEDTLS_SSL_HW_RECORD_ACCEL +#endif +#if defined MBEDTLS_SSL_MAX_FRAGMENT_LENGTH +#define POLARSSL_SSL_MAX_FRAGMENT_LENGTH MBEDTLS_SSL_MAX_FRAGMENT_LENGTH +#endif +#if defined MBEDTLS_SSL_PROTO_DTLS +#define POLARSSL_SSL_PROTO_DTLS MBEDTLS_SSL_PROTO_DTLS +#endif +#if defined MBEDTLS_SSL_PROTO_SSL3 +#define POLARSSL_SSL_PROTO_SSL3 MBEDTLS_SSL_PROTO_SSL3 +#endif +#if defined MBEDTLS_SSL_PROTO_TLS1 +#define POLARSSL_SSL_PROTO_TLS1 MBEDTLS_SSL_PROTO_TLS1 +#endif +#if defined MBEDTLS_SSL_PROTO_TLS1_1 +#define POLARSSL_SSL_PROTO_TLS1_1 MBEDTLS_SSL_PROTO_TLS1_1 +#endif +#if defined MBEDTLS_SSL_PROTO_TLS1_2 +#define POLARSSL_SSL_PROTO_TLS1_2 MBEDTLS_SSL_PROTO_TLS1_2 +#endif +#if defined MBEDTLS_SSL_RENEGOTIATION +#define POLARSSL_SSL_RENEGOTIATION MBEDTLS_SSL_RENEGOTIATION +#endif +#if defined MBEDTLS_SSL_SERVER_NAME_INDICATION +#define POLARSSL_SSL_SERVER_NAME_INDICATION MBEDTLS_SSL_SERVER_NAME_INDICATION +#endif +#if defined MBEDTLS_SSL_SESSION_TICKETS +#define POLARSSL_SSL_SESSION_TICKETS MBEDTLS_SSL_SESSION_TICKETS +#endif +#if defined MBEDTLS_SSL_SRV_C +#define POLARSSL_SSL_SRV_C MBEDTLS_SSL_SRV_C +#endif +#if defined MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE +#define POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE +#endif +#if defined MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO +#define POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO +#endif +#if defined MBEDTLS_SSL_TLS_C +#define POLARSSL_SSL_TLS_C MBEDTLS_SSL_TLS_C +#endif +#if defined MBEDTLS_SSL_TRUNCATED_HMAC +#define POLARSSL_SSL_TRUNCATED_HMAC MBEDTLS_SSL_TRUNCATED_HMAC +#endif +#if defined MBEDTLS_THREADING_ALT +#define POLARSSL_THREADING_ALT MBEDTLS_THREADING_ALT +#endif +#if defined MBEDTLS_THREADING_C +#define POLARSSL_THREADING_C MBEDTLS_THREADING_C +#endif +#if defined MBEDTLS_THREADING_PTHREAD +#define POLARSSL_THREADING_PTHREAD MBEDTLS_THREADING_PTHREAD +#endif +#if defined MBEDTLS_TIMING_ALT +#define POLARSSL_TIMING_ALT MBEDTLS_TIMING_ALT +#endif +#if defined MBEDTLS_TIMING_C +#define POLARSSL_TIMING_C MBEDTLS_TIMING_C +#endif +#if defined MBEDTLS_VERSION_C +#define POLARSSL_VERSION_C MBEDTLS_VERSION_C +#endif +#if defined MBEDTLS_VERSION_FEATURES +#define POLARSSL_VERSION_FEATURES MBEDTLS_VERSION_FEATURES +#endif +#if defined MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 +#define POLARSSL_X509_ALLOW_EXTENSIONS_NON_V3 MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 +#endif +#if defined MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION +#define POLARSSL_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION +#endif +#if defined MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE +#define POLARSSL_X509_CHECK_EXTENDED_KEY_USAGE MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE +#endif +#if defined MBEDTLS_X509_CHECK_KEY_USAGE +#define POLARSSL_X509_CHECK_KEY_USAGE MBEDTLS_X509_CHECK_KEY_USAGE +#endif +#if defined MBEDTLS_X509_CREATE_C +#define POLARSSL_X509_CREATE_C MBEDTLS_X509_CREATE_C +#endif +#if defined MBEDTLS_X509_CRL_PARSE_C +#define POLARSSL_X509_CRL_PARSE_C MBEDTLS_X509_CRL_PARSE_C +#endif +#if defined MBEDTLS_X509_CRT_PARSE_C +#define POLARSSL_X509_CRT_PARSE_C MBEDTLS_X509_CRT_PARSE_C +#endif +#if defined MBEDTLS_X509_CRT_WRITE_C +#define POLARSSL_X509_CRT_WRITE_C MBEDTLS_X509_CRT_WRITE_C +#endif +#if defined MBEDTLS_X509_CSR_PARSE_C +#define POLARSSL_X509_CSR_PARSE_C MBEDTLS_X509_CSR_PARSE_C +#endif +#if defined MBEDTLS_X509_CSR_WRITE_C +#define POLARSSL_X509_CSR_WRITE_C MBEDTLS_X509_CSR_WRITE_C +#endif +#if defined MBEDTLS_X509_MAX_INTERMEDIATE_CA +#define POLARSSL_X509_MAX_INTERMEDIATE_CA MBEDTLS_X509_MAX_INTERMEDIATE_CA +#endif +#if defined MBEDTLS_X509_RSASSA_PSS_SUPPORT +#define POLARSSL_X509_RSASSA_PSS_SUPPORT MBEDTLS_X509_RSASSA_PSS_SUPPORT +#endif +#if defined MBEDTLS_X509_USE_C +#define POLARSSL_X509_USE_C MBEDTLS_X509_USE_C +#endif +#if defined MBEDTLS_XTEA_ALT +#define POLARSSL_XTEA_ALT MBEDTLS_XTEA_ALT +#endif +#if defined MBEDTLS_XTEA_C +#define POLARSSL_XTEA_C MBEDTLS_XTEA_C +#endif +#if defined MBEDTLS_ZLIB_SUPPORT +#define POLARSSL_ZLIB_SUPPORT MBEDTLS_ZLIB_SUPPORT +#endif + +/* + * Misc names (macros, types, functions, enum constants...) + */ +#define AES_DECRYPT MBEDTLS_AES_DECRYPT +#define AES_ENCRYPT MBEDTLS_AES_ENCRYPT +#define ASN1_BIT_STRING MBEDTLS_ASN1_BIT_STRING +#define ASN1_BMP_STRING MBEDTLS_ASN1_BMP_STRING +#define ASN1_BOOLEAN MBEDTLS_ASN1_BOOLEAN +#define ASN1_CHK_ADD MBEDTLS_ASN1_CHK_ADD +#define ASN1_CONSTRUCTED MBEDTLS_ASN1_CONSTRUCTED +#define ASN1_CONTEXT_SPECIFIC MBEDTLS_ASN1_CONTEXT_SPECIFIC +#define ASN1_GENERALIZED_TIME MBEDTLS_ASN1_GENERALIZED_TIME +#define ASN1_IA5_STRING MBEDTLS_ASN1_IA5_STRING +#define ASN1_INTEGER MBEDTLS_ASN1_INTEGER +#define ASN1_NULL MBEDTLS_ASN1_NULL +#define ASN1_OCTET_STRING MBEDTLS_ASN1_OCTET_STRING +#define ASN1_OID MBEDTLS_ASN1_OID +#define ASN1_PRIMITIVE MBEDTLS_ASN1_PRIMITIVE +#define ASN1_PRINTABLE_STRING MBEDTLS_ASN1_PRINTABLE_STRING +#define ASN1_SEQUENCE MBEDTLS_ASN1_SEQUENCE +#define ASN1_SET MBEDTLS_ASN1_SET +#define ASN1_T61_STRING MBEDTLS_ASN1_T61_STRING +#define ASN1_UNIVERSAL_STRING MBEDTLS_ASN1_UNIVERSAL_STRING +#define ASN1_UTC_TIME MBEDTLS_ASN1_UTC_TIME +#define ASN1_UTF8_STRING MBEDTLS_ASN1_UTF8_STRING +#define BADCERT_CN_MISMATCH MBEDTLS_X509_BADCERT_CN_MISMATCH +#define BADCERT_EXPIRED MBEDTLS_X509_BADCERT_EXPIRED +#define BADCERT_FUTURE MBEDTLS_X509_BADCERT_FUTURE +#define BADCERT_MISSING MBEDTLS_X509_BADCERT_MISSING +#define BADCERT_NOT_TRUSTED MBEDTLS_X509_BADCERT_NOT_TRUSTED +#define BADCERT_OTHER MBEDTLS_X509_BADCERT_OTHER +#define BADCERT_REVOKED MBEDTLS_X509_BADCERT_REVOKED +#define BADCERT_SKIP_VERIFY MBEDTLS_X509_BADCERT_SKIP_VERIFY +#define BADCRL_EXPIRED MBEDTLS_X509_BADCRL_EXPIRED +#define BADCRL_FUTURE MBEDTLS_X509_BADCRL_FUTURE +#define BADCRL_NOT_TRUSTED MBEDTLS_X509_BADCRL_NOT_TRUSTED +#define BLOWFISH_BLOCKSIZE MBEDTLS_BLOWFISH_BLOCKSIZE +#define BLOWFISH_DECRYPT MBEDTLS_BLOWFISH_DECRYPT +#define BLOWFISH_ENCRYPT MBEDTLS_BLOWFISH_ENCRYPT +#define BLOWFISH_MAX_KEY MBEDTLS_BLOWFISH_MAX_KEY_BITS +#define BLOWFISH_MIN_KEY MBEDTLS_BLOWFISH_MIN_KEY_BITS +#define BLOWFISH_ROUNDS MBEDTLS_BLOWFISH_ROUNDS +#define CAMELLIA_DECRYPT MBEDTLS_CAMELLIA_DECRYPT +#define CAMELLIA_ENCRYPT MBEDTLS_CAMELLIA_ENCRYPT +#define COLLECT_SIZE MBEDTLS_HAVEGE_COLLECT_SIZE +#define CTR_DRBG_BLOCKSIZE MBEDTLS_CTR_DRBG_BLOCKSIZE +#define CTR_DRBG_ENTROPY_LEN MBEDTLS_CTR_DRBG_ENTROPY_LEN +#define CTR_DRBG_KEYBITS MBEDTLS_CTR_DRBG_KEYBITS +#define CTR_DRBG_KEYSIZE MBEDTLS_CTR_DRBG_KEYSIZE +#define CTR_DRBG_MAX_INPUT MBEDTLS_CTR_DRBG_MAX_INPUT +#define CTR_DRBG_MAX_REQUEST MBEDTLS_CTR_DRBG_MAX_REQUEST +#define CTR_DRBG_MAX_SEED_INPUT MBEDTLS_CTR_DRBG_MAX_SEED_INPUT +#define CTR_DRBG_PR_OFF MBEDTLS_CTR_DRBG_PR_OFF +#define CTR_DRBG_PR_ON MBEDTLS_CTR_DRBG_PR_ON +#define CTR_DRBG_RESEED_INTERVAL MBEDTLS_CTR_DRBG_RESEED_INTERVAL +#define CTR_DRBG_SEEDLEN MBEDTLS_CTR_DRBG_SEEDLEN +#define DEPRECATED MBEDTLS_DEPRECATED +#define DES_DECRYPT MBEDTLS_DES_DECRYPT +#define DES_ENCRYPT MBEDTLS_DES_ENCRYPT +#define DES_KEY_SIZE MBEDTLS_DES_KEY_SIZE +#define ENTROPY_BLOCK_SIZE MBEDTLS_ENTROPY_BLOCK_SIZE +#define ENTROPY_MAX_GATHER MBEDTLS_ENTROPY_MAX_GATHER +#define ENTROPY_MAX_SEED_SIZE MBEDTLS_ENTROPY_MAX_SEED_SIZE +#define ENTROPY_MAX_SOURCES MBEDTLS_ENTROPY_MAX_SOURCES +#define ENTROPY_MIN_HARDCLOCK MBEDTLS_ENTROPY_MIN_HARDCLOCK +#define ENTROPY_MIN_HAVEGE MBEDTLS_ENTROPY_MIN_HAVEGE +#define ENTROPY_MIN_PLATFORM MBEDTLS_ENTROPY_MIN_PLATFORM +#define ENTROPY_SOURCE_MANUAL MBEDTLS_ENTROPY_SOURCE_MANUAL +#define EXT_AUTHORITY_KEY_IDENTIFIER MBEDTLS_X509_EXT_AUTHORITY_KEY_IDENTIFIER +#define EXT_BASIC_CONSTRAINTS MBEDTLS_X509_EXT_BASIC_CONSTRAINTS +#define EXT_CERTIFICATE_POLICIES MBEDTLS_X509_EXT_CERTIFICATE_POLICIES +#define EXT_CRL_DISTRIBUTION_POINTS MBEDTLS_X509_EXT_CRL_DISTRIBUTION_POINTS +#define EXT_EXTENDED_KEY_USAGE MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE +#define EXT_FRESHEST_CRL MBEDTLS_X509_EXT_FRESHEST_CRL +#define EXT_INIHIBIT_ANYPOLICY MBEDTLS_X509_EXT_INIHIBIT_ANYPOLICY +#define EXT_ISSUER_ALT_NAME MBEDTLS_X509_EXT_ISSUER_ALT_NAME +#define EXT_KEY_USAGE MBEDTLS_X509_EXT_KEY_USAGE +#define EXT_NAME_CONSTRAINTS MBEDTLS_X509_EXT_NAME_CONSTRAINTS +#define EXT_NS_CERT_TYPE MBEDTLS_X509_EXT_NS_CERT_TYPE +#define EXT_POLICY_CONSTRAINTS MBEDTLS_X509_EXT_POLICY_CONSTRAINTS +#define EXT_POLICY_MAPPINGS MBEDTLS_X509_EXT_POLICY_MAPPINGS +#define EXT_SUBJECT_ALT_NAME MBEDTLS_X509_EXT_SUBJECT_ALT_NAME +#define EXT_SUBJECT_DIRECTORY_ATTRS MBEDTLS_X509_EXT_SUBJECT_DIRECTORY_ATTRS +#define EXT_SUBJECT_KEY_IDENTIFIER MBEDTLS_X509_EXT_SUBJECT_KEY_IDENTIFIER +#define GCM_DECRYPT MBEDTLS_GCM_DECRYPT +#define GCM_ENCRYPT MBEDTLS_GCM_ENCRYPT +#define KU_CRL_SIGN MBEDTLS_X509_KU_CRL_SIGN +#define KU_DATA_ENCIPHERMENT MBEDTLS_X509_KU_DATA_ENCIPHERMENT +#define KU_DIGITAL_SIGNATURE MBEDTLS_X509_KU_DIGITAL_SIGNATURE +#define KU_KEY_AGREEMENT MBEDTLS_X509_KU_KEY_AGREEMENT +#define KU_KEY_CERT_SIGN MBEDTLS_X509_KU_KEY_CERT_SIGN +#define KU_KEY_ENCIPHERMENT MBEDTLS_X509_KU_KEY_ENCIPHERMENT +#define KU_NON_REPUDIATION MBEDTLS_X509_KU_NON_REPUDIATION +#define LN_2_DIV_LN_10_SCALE100 MBEDTLS_LN_2_DIV_LN_10_SCALE100 +#define MEMORY_VERIFY_ALLOC MBEDTLS_MEMORY_VERIFY_ALLOC +#define MEMORY_VERIFY_ALWAYS MBEDTLS_MEMORY_VERIFY_ALWAYS +#define MEMORY_VERIFY_FREE MBEDTLS_MEMORY_VERIFY_FREE +#define MEMORY_VERIFY_NONE MBEDTLS_MEMORY_VERIFY_NONE +#define MPI_CHK MBEDTLS_MPI_CHK +#define NET_PROTO_TCP MBEDTLS_NET_PROTO_TCP +#define NET_PROTO_UDP MBEDTLS_NET_PROTO_UDP +#define NS_CERT_TYPE_EMAIL MBEDTLS_X509_NS_CERT_TYPE_EMAIL +#define NS_CERT_TYPE_EMAIL_CA MBEDTLS_X509_NS_CERT_TYPE_EMAIL_CA +#define NS_CERT_TYPE_OBJECT_SIGNING MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING +#define NS_CERT_TYPE_OBJECT_SIGNING_CA MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING_CA +#define NS_CERT_TYPE_RESERVED MBEDTLS_X509_NS_CERT_TYPE_RESERVED +#define NS_CERT_TYPE_SSL_CA MBEDTLS_X509_NS_CERT_TYPE_SSL_CA +#define NS_CERT_TYPE_SSL_CLIENT MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT +#define NS_CERT_TYPE_SSL_SERVER MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER +#define OID_ANSI_X9_62 MBEDTLS_OID_ANSI_X9_62 +#define OID_ANSI_X9_62_FIELD_TYPE MBEDTLS_OID_ANSI_X9_62_FIELD_TYPE +#define OID_ANSI_X9_62_PRIME_FIELD MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD +#define OID_ANSI_X9_62_SIG MBEDTLS_OID_ANSI_X9_62_SIG +#define OID_ANSI_X9_62_SIG_SHA2 MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 +#define OID_ANY_EXTENDED_KEY_USAGE MBEDTLS_OID_ANY_EXTENDED_KEY_USAGE +#define OID_AT MBEDTLS_OID_AT +#define OID_AT_CN MBEDTLS_OID_AT_CN +#define OID_AT_COUNTRY MBEDTLS_OID_AT_COUNTRY +#define OID_AT_DN_QUALIFIER MBEDTLS_OID_AT_DN_QUALIFIER +#define OID_AT_GENERATION_QUALIFIER MBEDTLS_OID_AT_GENERATION_QUALIFIER +#define OID_AT_GIVEN_NAME MBEDTLS_OID_AT_GIVEN_NAME +#define OID_AT_INITIALS MBEDTLS_OID_AT_INITIALS +#define OID_AT_LOCALITY MBEDTLS_OID_AT_LOCALITY +#define OID_AT_ORGANIZATION MBEDTLS_OID_AT_ORGANIZATION +#define OID_AT_ORG_UNIT MBEDTLS_OID_AT_ORG_UNIT +#define OID_AT_POSTAL_ADDRESS MBEDTLS_OID_AT_POSTAL_ADDRESS +#define OID_AT_POSTAL_CODE MBEDTLS_OID_AT_POSTAL_CODE +#define OID_AT_PSEUDONYM MBEDTLS_OID_AT_PSEUDONYM +#define OID_AT_SERIAL_NUMBER MBEDTLS_OID_AT_SERIAL_NUMBER +#define OID_AT_STATE MBEDTLS_OID_AT_STATE +#define OID_AT_SUR_NAME MBEDTLS_OID_AT_SUR_NAME +#define OID_AT_TITLE MBEDTLS_OID_AT_TITLE +#define OID_AT_UNIQUE_IDENTIFIER MBEDTLS_OID_AT_UNIQUE_IDENTIFIER +#define OID_AUTHORITY_KEY_IDENTIFIER MBEDTLS_OID_AUTHORITY_KEY_IDENTIFIER +#define OID_BASIC_CONSTRAINTS MBEDTLS_OID_BASIC_CONSTRAINTS +#define OID_CERTICOM MBEDTLS_OID_CERTICOM +#define OID_CERTIFICATE_POLICIES MBEDTLS_OID_CERTIFICATE_POLICIES +#define OID_CLIENT_AUTH MBEDTLS_OID_CLIENT_AUTH +#define OID_CMP MBEDTLS_OID_CMP +#define OID_CODE_SIGNING MBEDTLS_OID_CODE_SIGNING +#define OID_COUNTRY_US MBEDTLS_OID_COUNTRY_US +#define OID_CRL_DISTRIBUTION_POINTS MBEDTLS_OID_CRL_DISTRIBUTION_POINTS +#define OID_CRL_NUMBER MBEDTLS_OID_CRL_NUMBER +#define OID_DES_CBC MBEDTLS_OID_DES_CBC +#define OID_DES_EDE3_CBC MBEDTLS_OID_DES_EDE3_CBC +#define OID_DIGEST_ALG_MD2 MBEDTLS_OID_DIGEST_ALG_MD2 +#define OID_DIGEST_ALG_MD4 MBEDTLS_OID_DIGEST_ALG_MD4 +#define OID_DIGEST_ALG_MD5 MBEDTLS_OID_DIGEST_ALG_MD5 +#define OID_DIGEST_ALG_SHA1 MBEDTLS_OID_DIGEST_ALG_SHA1 +#define OID_DIGEST_ALG_SHA224 MBEDTLS_OID_DIGEST_ALG_SHA224 +#define OID_DIGEST_ALG_SHA256 MBEDTLS_OID_DIGEST_ALG_SHA256 +#define OID_DIGEST_ALG_SHA384 MBEDTLS_OID_DIGEST_ALG_SHA384 +#define OID_DIGEST_ALG_SHA512 MBEDTLS_OID_DIGEST_ALG_SHA512 +#define OID_DOMAIN_COMPONENT MBEDTLS_OID_DOMAIN_COMPONENT +#define OID_ECDSA_SHA1 MBEDTLS_OID_ECDSA_SHA1 +#define OID_ECDSA_SHA224 MBEDTLS_OID_ECDSA_SHA224 +#define OID_ECDSA_SHA256 MBEDTLS_OID_ECDSA_SHA256 +#define OID_ECDSA_SHA384 MBEDTLS_OID_ECDSA_SHA384 +#define OID_ECDSA_SHA512 MBEDTLS_OID_ECDSA_SHA512 +#define OID_EC_ALG_ECDH MBEDTLS_OID_EC_ALG_ECDH +#define OID_EC_ALG_UNRESTRICTED MBEDTLS_OID_EC_ALG_UNRESTRICTED +#define OID_EC_BRAINPOOL_V1 MBEDTLS_OID_EC_BRAINPOOL_V1 +#define OID_EC_GRP_BP256R1 MBEDTLS_OID_EC_GRP_BP256R1 +#define OID_EC_GRP_BP384R1 MBEDTLS_OID_EC_GRP_BP384R1 +#define OID_EC_GRP_BP512R1 MBEDTLS_OID_EC_GRP_BP512R1 +#define OID_EC_GRP_SECP192K1 MBEDTLS_OID_EC_GRP_SECP192K1 +#define OID_EC_GRP_SECP192R1 MBEDTLS_OID_EC_GRP_SECP192R1 +#define OID_EC_GRP_SECP224K1 MBEDTLS_OID_EC_GRP_SECP224K1 +#define OID_EC_GRP_SECP224R1 MBEDTLS_OID_EC_GRP_SECP224R1 +#define OID_EC_GRP_SECP256K1 MBEDTLS_OID_EC_GRP_SECP256K1 +#define OID_EC_GRP_SECP256R1 MBEDTLS_OID_EC_GRP_SECP256R1 +#define OID_EC_GRP_SECP384R1 MBEDTLS_OID_EC_GRP_SECP384R1 +#define OID_EC_GRP_SECP521R1 MBEDTLS_OID_EC_GRP_SECP521R1 +#define OID_EMAIL_PROTECTION MBEDTLS_OID_EMAIL_PROTECTION +#define OID_EXTENDED_KEY_USAGE MBEDTLS_OID_EXTENDED_KEY_USAGE +#define OID_FRESHEST_CRL MBEDTLS_OID_FRESHEST_CRL +#define OID_GOV MBEDTLS_OID_GOV +#define OID_HMAC_SHA1 MBEDTLS_OID_HMAC_SHA1 +#define OID_ID_CE MBEDTLS_OID_ID_CE +#define OID_INIHIBIT_ANYPOLICY MBEDTLS_OID_INIHIBIT_ANYPOLICY +#define OID_ISO_CCITT_DS MBEDTLS_OID_ISO_CCITT_DS +#define OID_ISO_IDENTIFIED_ORG MBEDTLS_OID_ISO_IDENTIFIED_ORG +#define OID_ISO_ITU_COUNTRY MBEDTLS_OID_ISO_ITU_COUNTRY +#define OID_ISO_ITU_US_ORG MBEDTLS_OID_ISO_ITU_US_ORG +#define OID_ISO_MEMBER_BODIES MBEDTLS_OID_ISO_MEMBER_BODIES +#define OID_ISSUER_ALT_NAME MBEDTLS_OID_ISSUER_ALT_NAME +#define OID_KEY_USAGE MBEDTLS_OID_KEY_USAGE +#define OID_KP MBEDTLS_OID_KP +#define OID_MGF1 MBEDTLS_OID_MGF1 +#define OID_NAME_CONSTRAINTS MBEDTLS_OID_NAME_CONSTRAINTS +#define OID_NETSCAPE MBEDTLS_OID_NETSCAPE +#define OID_NS_BASE_URL MBEDTLS_OID_NS_BASE_URL +#define OID_NS_CA_POLICY_URL MBEDTLS_OID_NS_CA_POLICY_URL +#define OID_NS_CA_REVOCATION_URL MBEDTLS_OID_NS_CA_REVOCATION_URL +#define OID_NS_CERT MBEDTLS_OID_NS_CERT +#define OID_NS_CERT_SEQUENCE MBEDTLS_OID_NS_CERT_SEQUENCE +#define OID_NS_CERT_TYPE MBEDTLS_OID_NS_CERT_TYPE +#define OID_NS_COMMENT MBEDTLS_OID_NS_COMMENT +#define OID_NS_DATA_TYPE MBEDTLS_OID_NS_DATA_TYPE +#define OID_NS_RENEWAL_URL MBEDTLS_OID_NS_RENEWAL_URL +#define OID_NS_REVOCATION_URL MBEDTLS_OID_NS_REVOCATION_URL +#define OID_NS_SSL_SERVER_NAME MBEDTLS_OID_NS_SSL_SERVER_NAME +#define OID_OCSP_SIGNING MBEDTLS_OID_OCSP_SIGNING +#define OID_OIW_SECSIG MBEDTLS_OID_OIW_SECSIG +#define OID_OIW_SECSIG_ALG MBEDTLS_OID_OIW_SECSIG_ALG +#define OID_OIW_SECSIG_SHA1 MBEDTLS_OID_OIW_SECSIG_SHA1 +#define OID_ORGANIZATION MBEDTLS_OID_ORGANIZATION +#define OID_ORG_ANSI_X9_62 MBEDTLS_OID_ORG_ANSI_X9_62 +#define OID_ORG_CERTICOM MBEDTLS_OID_ORG_CERTICOM +#define OID_ORG_DOD MBEDTLS_OID_ORG_DOD +#define OID_ORG_GOV MBEDTLS_OID_ORG_GOV +#define OID_ORG_NETSCAPE MBEDTLS_OID_ORG_NETSCAPE +#define OID_ORG_OIW MBEDTLS_OID_ORG_OIW +#define OID_ORG_RSA_DATA_SECURITY MBEDTLS_OID_ORG_RSA_DATA_SECURITY +#define OID_ORG_TELETRUST MBEDTLS_OID_ORG_TELETRUST +#define OID_PKCS MBEDTLS_OID_PKCS +#define OID_PKCS1 MBEDTLS_OID_PKCS1 +#define OID_PKCS12 MBEDTLS_OID_PKCS12 +#define OID_PKCS12_PBE MBEDTLS_OID_PKCS12_PBE +#define OID_PKCS12_PBE_SHA1_DES2_EDE_CBC MBEDTLS_OID_PKCS12_PBE_SHA1_DES2_EDE_CBC +#define OID_PKCS12_PBE_SHA1_DES3_EDE_CBC MBEDTLS_OID_PKCS12_PBE_SHA1_DES3_EDE_CBC +#define OID_PKCS12_PBE_SHA1_RC2_128_CBC MBEDTLS_OID_PKCS12_PBE_SHA1_RC2_128_CBC +#define OID_PKCS12_PBE_SHA1_RC2_40_CBC MBEDTLS_OID_PKCS12_PBE_SHA1_RC2_40_CBC +#define OID_PKCS12_PBE_SHA1_RC4_128 MBEDTLS_OID_PKCS12_PBE_SHA1_RC4_128 +#define OID_PKCS12_PBE_SHA1_RC4_40 MBEDTLS_OID_PKCS12_PBE_SHA1_RC4_40 +#define OID_PKCS1_MD2 MBEDTLS_OID_PKCS1_MD2 +#define OID_PKCS1_MD4 MBEDTLS_OID_PKCS1_MD4 +#define OID_PKCS1_MD5 MBEDTLS_OID_PKCS1_MD5 +#define OID_PKCS1_RSA MBEDTLS_OID_PKCS1_RSA +#define OID_PKCS1_SHA1 MBEDTLS_OID_PKCS1_SHA1 +#define OID_PKCS1_SHA224 MBEDTLS_OID_PKCS1_SHA224 +#define OID_PKCS1_SHA256 MBEDTLS_OID_PKCS1_SHA256 +#define OID_PKCS1_SHA384 MBEDTLS_OID_PKCS1_SHA384 +#define OID_PKCS1_SHA512 MBEDTLS_OID_PKCS1_SHA512 +#define OID_PKCS5 MBEDTLS_OID_PKCS5 +#define OID_PKCS5_PBES2 MBEDTLS_OID_PKCS5_PBES2 +#define OID_PKCS5_PBE_MD2_DES_CBC MBEDTLS_OID_PKCS5_PBE_MD2_DES_CBC +#define OID_PKCS5_PBE_MD2_RC2_CBC MBEDTLS_OID_PKCS5_PBE_MD2_RC2_CBC +#define OID_PKCS5_PBE_MD5_DES_CBC MBEDTLS_OID_PKCS5_PBE_MD5_DES_CBC +#define OID_PKCS5_PBE_MD5_RC2_CBC MBEDTLS_OID_PKCS5_PBE_MD5_RC2_CBC +#define OID_PKCS5_PBE_SHA1_DES_CBC MBEDTLS_OID_PKCS5_PBE_SHA1_DES_CBC +#define OID_PKCS5_PBE_SHA1_RC2_CBC MBEDTLS_OID_PKCS5_PBE_SHA1_RC2_CBC +#define OID_PKCS5_PBKDF2 MBEDTLS_OID_PKCS5_PBKDF2 +#define OID_PKCS5_PBMAC1 MBEDTLS_OID_PKCS5_PBMAC1 +#define OID_PKCS9 MBEDTLS_OID_PKCS9 +#define OID_PKCS9_CSR_EXT_REQ MBEDTLS_OID_PKCS9_CSR_EXT_REQ +#define OID_PKCS9_EMAIL MBEDTLS_OID_PKCS9_EMAIL +#define OID_PKIX MBEDTLS_OID_PKIX +#define OID_POLICY_CONSTRAINTS MBEDTLS_OID_POLICY_CONSTRAINTS +#define OID_POLICY_MAPPINGS MBEDTLS_OID_POLICY_MAPPINGS +#define OID_PRIVATE_KEY_USAGE_PERIOD MBEDTLS_OID_PRIVATE_KEY_USAGE_PERIOD +#define OID_RSASSA_PSS MBEDTLS_OID_RSASSA_PSS +#define OID_RSA_COMPANY MBEDTLS_OID_RSA_COMPANY +#define OID_RSA_SHA_OBS MBEDTLS_OID_RSA_SHA_OBS +#define OID_SERVER_AUTH MBEDTLS_OID_SERVER_AUTH +#define OID_SIZE MBEDTLS_OID_SIZE +#define OID_SUBJECT_ALT_NAME MBEDTLS_OID_SUBJECT_ALT_NAME +#define OID_SUBJECT_DIRECTORY_ATTRS MBEDTLS_OID_SUBJECT_DIRECTORY_ATTRS +#define OID_SUBJECT_KEY_IDENTIFIER MBEDTLS_OID_SUBJECT_KEY_IDENTIFIER +#define OID_TELETRUST MBEDTLS_OID_TELETRUST +#define OID_TIME_STAMPING MBEDTLS_OID_TIME_STAMPING +#define PADLOCK_ACE MBEDTLS_PADLOCK_ACE +#define PADLOCK_ALIGN16 MBEDTLS_PADLOCK_ALIGN16 +#define PADLOCK_PHE MBEDTLS_PADLOCK_PHE +#define PADLOCK_PMM MBEDTLS_PADLOCK_PMM +#define PADLOCK_RNG MBEDTLS_PADLOCK_RNG +#define PKCS12_DERIVE_IV MBEDTLS_PKCS12_DERIVE_IV +#define PKCS12_DERIVE_KEY MBEDTLS_PKCS12_DERIVE_KEY +#define PKCS12_DERIVE_MAC_KEY MBEDTLS_PKCS12_DERIVE_MAC_KEY +#define PKCS12_PBE_DECRYPT MBEDTLS_PKCS12_PBE_DECRYPT +#define PKCS12_PBE_ENCRYPT MBEDTLS_PKCS12_PBE_ENCRYPT +#define PKCS5_DECRYPT MBEDTLS_PKCS5_DECRYPT +#define PKCS5_ENCRYPT MBEDTLS_PKCS5_ENCRYPT +#define POLARSSL_AESNI_AES MBEDTLS_AESNI_AES +#define POLARSSL_AESNI_CLMUL MBEDTLS_AESNI_CLMUL +#define POLARSSL_AESNI_H MBEDTLS_AESNI_H +#define POLARSSL_AES_H MBEDTLS_AES_H +#define POLARSSL_ARC4_H MBEDTLS_ARC4_H +#define POLARSSL_ASN1_H MBEDTLS_ASN1_H +#define POLARSSL_ASN1_WRITE_H MBEDTLS_ASN1_WRITE_H +#define POLARSSL_BASE64_H MBEDTLS_BASE64_H +#define POLARSSL_BIGNUM_H MBEDTLS_BIGNUM_H +#define POLARSSL_BLOWFISH_H MBEDTLS_BLOWFISH_H +#define POLARSSL_BN_MUL_H MBEDTLS_BN_MUL_H +#define POLARSSL_CAMELLIA_H MBEDTLS_CAMELLIA_H +#define POLARSSL_CCM_H MBEDTLS_CCM_H +#define POLARSSL_CERTS_H MBEDTLS_CERTS_H +#define POLARSSL_CHECK_CONFIG_H MBEDTLS_CHECK_CONFIG_H +#define POLARSSL_CIPHERSUITE_NODTLS MBEDTLS_CIPHERSUITE_NODTLS +#define POLARSSL_CIPHERSUITE_SHORT_TAG MBEDTLS_CIPHERSUITE_SHORT_TAG +#define POLARSSL_CIPHERSUITE_WEAK MBEDTLS_CIPHERSUITE_WEAK +#define POLARSSL_CIPHER_AES_128_CBC MBEDTLS_CIPHER_AES_128_CBC +#define POLARSSL_CIPHER_AES_128_CCM MBEDTLS_CIPHER_AES_128_CCM +#define POLARSSL_CIPHER_AES_128_CFB128 MBEDTLS_CIPHER_AES_128_CFB128 +#define POLARSSL_CIPHER_AES_128_CTR MBEDTLS_CIPHER_AES_128_CTR +#define POLARSSL_CIPHER_AES_128_ECB MBEDTLS_CIPHER_AES_128_ECB +#define POLARSSL_CIPHER_AES_128_GCM MBEDTLS_CIPHER_AES_128_GCM +#define POLARSSL_CIPHER_AES_192_CBC MBEDTLS_CIPHER_AES_192_CBC +#define POLARSSL_CIPHER_AES_192_CCM MBEDTLS_CIPHER_AES_192_CCM +#define POLARSSL_CIPHER_AES_192_CFB128 MBEDTLS_CIPHER_AES_192_CFB128 +#define POLARSSL_CIPHER_AES_192_CTR MBEDTLS_CIPHER_AES_192_CTR +#define POLARSSL_CIPHER_AES_192_ECB MBEDTLS_CIPHER_AES_192_ECB +#define POLARSSL_CIPHER_AES_192_GCM MBEDTLS_CIPHER_AES_192_GCM +#define POLARSSL_CIPHER_AES_256_CBC MBEDTLS_CIPHER_AES_256_CBC +#define POLARSSL_CIPHER_AES_256_CCM MBEDTLS_CIPHER_AES_256_CCM +#define POLARSSL_CIPHER_AES_256_CFB128 MBEDTLS_CIPHER_AES_256_CFB128 +#define POLARSSL_CIPHER_AES_256_CTR MBEDTLS_CIPHER_AES_256_CTR +#define POLARSSL_CIPHER_AES_256_ECB MBEDTLS_CIPHER_AES_256_ECB +#define POLARSSL_CIPHER_AES_256_GCM MBEDTLS_CIPHER_AES_256_GCM +#define POLARSSL_CIPHER_ARC4_128 MBEDTLS_CIPHER_ARC4_128 +#define POLARSSL_CIPHER_BLOWFISH_CBC MBEDTLS_CIPHER_BLOWFISH_CBC +#define POLARSSL_CIPHER_BLOWFISH_CFB64 MBEDTLS_CIPHER_BLOWFISH_CFB64 +#define POLARSSL_CIPHER_BLOWFISH_CTR MBEDTLS_CIPHER_BLOWFISH_CTR +#define POLARSSL_CIPHER_BLOWFISH_ECB MBEDTLS_CIPHER_BLOWFISH_ECB +#define POLARSSL_CIPHER_CAMELLIA_128_CBC MBEDTLS_CIPHER_CAMELLIA_128_CBC +#define POLARSSL_CIPHER_CAMELLIA_128_CCM MBEDTLS_CIPHER_CAMELLIA_128_CCM +#define POLARSSL_CIPHER_CAMELLIA_128_CFB128 MBEDTLS_CIPHER_CAMELLIA_128_CFB128 +#define POLARSSL_CIPHER_CAMELLIA_128_CTR MBEDTLS_CIPHER_CAMELLIA_128_CTR +#define POLARSSL_CIPHER_CAMELLIA_128_ECB MBEDTLS_CIPHER_CAMELLIA_128_ECB +#define POLARSSL_CIPHER_CAMELLIA_128_GCM MBEDTLS_CIPHER_CAMELLIA_128_GCM +#define POLARSSL_CIPHER_CAMELLIA_192_CBC MBEDTLS_CIPHER_CAMELLIA_192_CBC +#define POLARSSL_CIPHER_CAMELLIA_192_CCM MBEDTLS_CIPHER_CAMELLIA_192_CCM +#define POLARSSL_CIPHER_CAMELLIA_192_CFB128 MBEDTLS_CIPHER_CAMELLIA_192_CFB128 +#define POLARSSL_CIPHER_CAMELLIA_192_CTR MBEDTLS_CIPHER_CAMELLIA_192_CTR +#define POLARSSL_CIPHER_CAMELLIA_192_ECB MBEDTLS_CIPHER_CAMELLIA_192_ECB +#define POLARSSL_CIPHER_CAMELLIA_192_GCM MBEDTLS_CIPHER_CAMELLIA_192_GCM +#define POLARSSL_CIPHER_CAMELLIA_256_CBC MBEDTLS_CIPHER_CAMELLIA_256_CBC +#define POLARSSL_CIPHER_CAMELLIA_256_CCM MBEDTLS_CIPHER_CAMELLIA_256_CCM +#define POLARSSL_CIPHER_CAMELLIA_256_CFB128 MBEDTLS_CIPHER_CAMELLIA_256_CFB128 +#define POLARSSL_CIPHER_CAMELLIA_256_CTR MBEDTLS_CIPHER_CAMELLIA_256_CTR +#define POLARSSL_CIPHER_CAMELLIA_256_ECB MBEDTLS_CIPHER_CAMELLIA_256_ECB +#define POLARSSL_CIPHER_CAMELLIA_256_GCM MBEDTLS_CIPHER_CAMELLIA_256_GCM +#define POLARSSL_CIPHER_DES_CBC MBEDTLS_CIPHER_DES_CBC +#define POLARSSL_CIPHER_DES_ECB MBEDTLS_CIPHER_DES_ECB +#define POLARSSL_CIPHER_DES_EDE3_CBC MBEDTLS_CIPHER_DES_EDE3_CBC +#define POLARSSL_CIPHER_DES_EDE3_ECB MBEDTLS_CIPHER_DES_EDE3_ECB +#define POLARSSL_CIPHER_DES_EDE_CBC MBEDTLS_CIPHER_DES_EDE_CBC +#define POLARSSL_CIPHER_DES_EDE_ECB MBEDTLS_CIPHER_DES_EDE_ECB +#define POLARSSL_CIPHER_H MBEDTLS_CIPHER_H +#define POLARSSL_CIPHER_ID_3DES MBEDTLS_CIPHER_ID_3DES +#define POLARSSL_CIPHER_ID_AES MBEDTLS_CIPHER_ID_AES +#define POLARSSL_CIPHER_ID_ARC4 MBEDTLS_CIPHER_ID_ARC4 +#define POLARSSL_CIPHER_ID_BLOWFISH MBEDTLS_CIPHER_ID_BLOWFISH +#define POLARSSL_CIPHER_ID_CAMELLIA MBEDTLS_CIPHER_ID_CAMELLIA +#define POLARSSL_CIPHER_ID_DES MBEDTLS_CIPHER_ID_DES +#define POLARSSL_CIPHER_ID_NONE MBEDTLS_CIPHER_ID_NONE +#define POLARSSL_CIPHER_ID_NULL MBEDTLS_CIPHER_ID_NULL +#define POLARSSL_CIPHER_MODE_AEAD MBEDTLS_CIPHER_MODE_AEAD +#define POLARSSL_CIPHER_MODE_STREAM MBEDTLS_CIPHER_MODE_STREAM +#define POLARSSL_CIPHER_MODE_WITH_PADDING MBEDTLS_CIPHER_MODE_WITH_PADDING +#define POLARSSL_CIPHER_NONE MBEDTLS_CIPHER_NONE +#define POLARSSL_CIPHER_NULL MBEDTLS_CIPHER_NULL +#define POLARSSL_CIPHER_VARIABLE_IV_LEN MBEDTLS_CIPHER_VARIABLE_IV_LEN +#define POLARSSL_CIPHER_VARIABLE_KEY_LEN MBEDTLS_CIPHER_VARIABLE_KEY_LEN +#define POLARSSL_CIPHER_WRAP_H MBEDTLS_CIPHER_WRAP_H +#define POLARSSL_CONFIG_H MBEDTLS_CONFIG_H +#define POLARSSL_CTR_DRBG_H MBEDTLS_CTR_DRBG_H +#define POLARSSL_DEBUG_H MBEDTLS_DEBUG_H +#define POLARSSL_DECRYPT MBEDTLS_DECRYPT +#define POLARSSL_DES_H MBEDTLS_DES_H +#define POLARSSL_DHM_H MBEDTLS_DHM_H +#define POLARSSL_DHM_RFC3526_MODP_2048_G MBEDTLS_DHM_RFC3526_MODP_2048_G +#define POLARSSL_DHM_RFC3526_MODP_2048_P MBEDTLS_DHM_RFC3526_MODP_2048_P +#define POLARSSL_DHM_RFC3526_MODP_3072_G MBEDTLS_DHM_RFC3526_MODP_3072_G +#define POLARSSL_DHM_RFC3526_MODP_3072_P MBEDTLS_DHM_RFC3526_MODP_3072_P +#define POLARSSL_DHM_RFC5114_MODP_2048_G MBEDTLS_DHM_RFC5114_MODP_2048_G +#define POLARSSL_DHM_RFC5114_MODP_2048_P MBEDTLS_DHM_RFC5114_MODP_2048_P +#define POLARSSL_ECDH_H MBEDTLS_ECDH_H +#define POLARSSL_ECDH_OURS MBEDTLS_ECDH_OURS +#define POLARSSL_ECDH_THEIRS MBEDTLS_ECDH_THEIRS +#define POLARSSL_ECDSA_H MBEDTLS_ECDSA_H +#define POLARSSL_ECP_DP_BP256R1 MBEDTLS_ECP_DP_BP256R1 +#define POLARSSL_ECP_DP_BP384R1 MBEDTLS_ECP_DP_BP384R1 +#define POLARSSL_ECP_DP_BP512R1 MBEDTLS_ECP_DP_BP512R1 +#define POLARSSL_ECP_DP_M255 MBEDTLS_ECP_DP_CURVE25519 +#define POLARSSL_ECP_DP_MAX MBEDTLS_ECP_DP_MAX +#define POLARSSL_ECP_DP_NONE MBEDTLS_ECP_DP_NONE +#define POLARSSL_ECP_DP_SECP192K1 MBEDTLS_ECP_DP_SECP192K1 +#define POLARSSL_ECP_DP_SECP192R1 MBEDTLS_ECP_DP_SECP192R1 +#define POLARSSL_ECP_DP_SECP224K1 MBEDTLS_ECP_DP_SECP224K1 +#define POLARSSL_ECP_DP_SECP224R1 MBEDTLS_ECP_DP_SECP224R1 +#define POLARSSL_ECP_DP_SECP256K1 MBEDTLS_ECP_DP_SECP256K1 +#define POLARSSL_ECP_DP_SECP256R1 MBEDTLS_ECP_DP_SECP256R1 +#define POLARSSL_ECP_DP_SECP384R1 MBEDTLS_ECP_DP_SECP384R1 +#define POLARSSL_ECP_DP_SECP521R1 MBEDTLS_ECP_DP_SECP521R1 +#define POLARSSL_ECP_H MBEDTLS_ECP_H +#define POLARSSL_ECP_MAX_BYTES MBEDTLS_ECP_MAX_BYTES +#define POLARSSL_ECP_MAX_PT_LEN MBEDTLS_ECP_MAX_PT_LEN +#define POLARSSL_ECP_PF_COMPRESSED MBEDTLS_ECP_PF_COMPRESSED +#define POLARSSL_ECP_PF_UNCOMPRESSED MBEDTLS_ECP_PF_UNCOMPRESSED +#define POLARSSL_ECP_TLS_NAMED_CURVE MBEDTLS_ECP_TLS_NAMED_CURVE +#define POLARSSL_ENCRYPT MBEDTLS_ENCRYPT +#define POLARSSL_ENTROPY_H MBEDTLS_ENTROPY_H +#define POLARSSL_ENTROPY_POLL_H MBEDTLS_ENTROPY_POLL_H +#define POLARSSL_ENTROPY_SHA256_ACCUMULATOR MBEDTLS_ENTROPY_SHA256_ACCUMULATOR +#define POLARSSL_ENTROPY_SHA512_ACCUMULATOR MBEDTLS_ENTROPY_SHA512_ACCUMULATOR +#define POLARSSL_ERROR_H MBEDTLS_ERROR_H +#define POLARSSL_ERR_AES_INVALID_INPUT_LENGTH MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH +#define POLARSSL_ERR_AES_INVALID_KEY_LENGTH MBEDTLS_ERR_AES_INVALID_KEY_LENGTH +#define POLARSSL_ERR_ASN1_BUF_TOO_SMALL MBEDTLS_ERR_ASN1_BUF_TOO_SMALL +#define POLARSSL_ERR_ASN1_INVALID_DATA MBEDTLS_ERR_ASN1_INVALID_DATA +#define POLARSSL_ERR_ASN1_INVALID_LENGTH MBEDTLS_ERR_ASN1_INVALID_LENGTH +#define POLARSSL_ERR_ASN1_LENGTH_MISMATCH MBEDTLS_ERR_ASN1_LENGTH_MISMATCH +#define POLARSSL_ERR_ASN1_MALLOC_FAILED MBEDTLS_ERR_ASN1_ALLOC_FAILED +#define POLARSSL_ERR_ASN1_OUT_OF_DATA MBEDTLS_ERR_ASN1_OUT_OF_DATA +#define POLARSSL_ERR_ASN1_UNEXPECTED_TAG MBEDTLS_ERR_ASN1_UNEXPECTED_TAG +#define POLARSSL_ERR_BASE64_BUFFER_TOO_SMALL MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL +#define POLARSSL_ERR_BASE64_INVALID_CHARACTER MBEDTLS_ERR_BASE64_INVALID_CHARACTER +#define POLARSSL_ERR_BLOWFISH_INVALID_INPUT_LENGTH MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH +#define POLARSSL_ERR_BLOWFISH_INVALID_KEY_LENGTH MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH +#define POLARSSL_ERR_CAMELLIA_INVALID_INPUT_LENGTH MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH +#define POLARSSL_ERR_CAMELLIA_INVALID_KEY_LENGTH MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH +#define POLARSSL_ERR_CCM_AUTH_FAILED MBEDTLS_ERR_CCM_AUTH_FAILED +#define POLARSSL_ERR_CCM_BAD_INPUT MBEDTLS_ERR_CCM_BAD_INPUT +#define POLARSSL_ERR_CIPHER_ALLOC_FAILED MBEDTLS_ERR_CIPHER_ALLOC_FAILED +#define POLARSSL_ERR_CIPHER_AUTH_FAILED MBEDTLS_ERR_CIPHER_AUTH_FAILED +#define POLARSSL_ERR_CIPHER_BAD_INPUT_DATA MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA +#define POLARSSL_ERR_CIPHER_FEATURE_UNAVAILABLE MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_CIPHER_FULL_BLOCK_EXPECTED MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED +#define POLARSSL_ERR_CIPHER_INVALID_PADDING MBEDTLS_ERR_CIPHER_INVALID_PADDING +#define POLARSSL_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED +#define POLARSSL_ERR_CTR_DRBG_FILE_IO_ERROR MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR +#define POLARSSL_ERR_CTR_DRBG_INPUT_TOO_BIG MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG +#define POLARSSL_ERR_CTR_DRBG_REQUEST_TOO_BIG MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG +#define POLARSSL_ERR_DES_INVALID_INPUT_LENGTH MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH +#define POLARSSL_ERR_DHM_BAD_INPUT_DATA MBEDTLS_ERR_DHM_BAD_INPUT_DATA +#define POLARSSL_ERR_DHM_CALC_SECRET_FAILED MBEDTLS_ERR_DHM_CALC_SECRET_FAILED +#define POLARSSL_ERR_DHM_FILE_IO_ERROR MBEDTLS_ERR_DHM_FILE_IO_ERROR +#define POLARSSL_ERR_DHM_INVALID_FORMAT MBEDTLS_ERR_DHM_INVALID_FORMAT +#define POLARSSL_ERR_DHM_MAKE_PARAMS_FAILED MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED +#define POLARSSL_ERR_DHM_MAKE_PUBLIC_FAILED MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED +#define POLARSSL_ERR_DHM_MALLOC_FAILED MBEDTLS_ERR_DHM_ALLOC_FAILED +#define POLARSSL_ERR_DHM_READ_PARAMS_FAILED MBEDTLS_ERR_DHM_READ_PARAMS_FAILED +#define POLARSSL_ERR_DHM_READ_PUBLIC_FAILED MBEDTLS_ERR_DHM_READ_PUBLIC_FAILED +#define POLARSSL_ERR_ECP_BAD_INPUT_DATA MBEDTLS_ERR_ECP_BAD_INPUT_DATA +#define POLARSSL_ERR_ECP_BUFFER_TOO_SMALL MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL +#define POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_ECP_INVALID_KEY MBEDTLS_ERR_ECP_INVALID_KEY +#define POLARSSL_ERR_ECP_MALLOC_FAILED MBEDTLS_ERR_ECP_ALLOC_FAILED +#define POLARSSL_ERR_ECP_RANDOM_FAILED MBEDTLS_ERR_ECP_RANDOM_FAILED +#define POLARSSL_ERR_ECP_SIG_LEN_MISMATCH MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH +#define POLARSSL_ERR_ECP_VERIFY_FAILED MBEDTLS_ERR_ECP_VERIFY_FAILED +#define POLARSSL_ERR_ENTROPY_FILE_IO_ERROR MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR +#define POLARSSL_ERR_ENTROPY_MAX_SOURCES MBEDTLS_ERR_ENTROPY_MAX_SOURCES +#define POLARSSL_ERR_ENTROPY_NO_SOURCES_DEFINED MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED +#define POLARSSL_ERR_ENTROPY_SOURCE_FAILED MBEDTLS_ERR_ENTROPY_SOURCE_FAILED +#define POLARSSL_ERR_GCM_AUTH_FAILED MBEDTLS_ERR_GCM_AUTH_FAILED +#define POLARSSL_ERR_GCM_BAD_INPUT MBEDTLS_ERR_GCM_BAD_INPUT +#define POLARSSL_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED +#define POLARSSL_ERR_HMAC_DRBG_FILE_IO_ERROR MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR +#define POLARSSL_ERR_HMAC_DRBG_INPUT_TOO_BIG MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG +#define POLARSSL_ERR_HMAC_DRBG_REQUEST_TOO_BIG MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG +#define POLARSSL_ERR_MD_ALLOC_FAILED MBEDTLS_ERR_MD_ALLOC_FAILED +#define POLARSSL_ERR_MD_BAD_INPUT_DATA MBEDTLS_ERR_MD_BAD_INPUT_DATA +#define POLARSSL_ERR_MD_FEATURE_UNAVAILABLE MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_MD_FILE_IO_ERROR MBEDTLS_ERR_MD_FILE_IO_ERROR +#define POLARSSL_ERR_MPI_BAD_INPUT_DATA MBEDTLS_ERR_MPI_BAD_INPUT_DATA +#define POLARSSL_ERR_MPI_BUFFER_TOO_SMALL MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL +#define POLARSSL_ERR_MPI_DIVISION_BY_ZERO MBEDTLS_ERR_MPI_DIVISION_BY_ZERO +#define POLARSSL_ERR_MPI_FILE_IO_ERROR MBEDTLS_ERR_MPI_FILE_IO_ERROR +#define POLARSSL_ERR_MPI_INVALID_CHARACTER MBEDTLS_ERR_MPI_INVALID_CHARACTER +#define POLARSSL_ERR_MPI_MALLOC_FAILED MBEDTLS_ERR_MPI_ALLOC_FAILED +#define POLARSSL_ERR_MPI_NEGATIVE_VALUE MBEDTLS_ERR_MPI_NEGATIVE_VALUE +#define POLARSSL_ERR_MPI_NOT_ACCEPTABLE MBEDTLS_ERR_MPI_NOT_ACCEPTABLE +#define POLARSSL_ERR_NET_ACCEPT_FAILED MBEDTLS_ERR_NET_ACCEPT_FAILED +#define POLARSSL_ERR_NET_BIND_FAILED MBEDTLS_ERR_NET_BIND_FAILED +#define POLARSSL_ERR_NET_CONNECT_FAILED MBEDTLS_ERR_NET_CONNECT_FAILED +#define POLARSSL_ERR_NET_CONN_RESET MBEDTLS_ERR_NET_CONN_RESET +#define POLARSSL_ERR_NET_LISTEN_FAILED MBEDTLS_ERR_NET_LISTEN_FAILED +#define POLARSSL_ERR_NET_RECV_FAILED MBEDTLS_ERR_NET_RECV_FAILED +#define POLARSSL_ERR_NET_SEND_FAILED MBEDTLS_ERR_NET_SEND_FAILED +#define POLARSSL_ERR_NET_SOCKET_FAILED MBEDTLS_ERR_NET_SOCKET_FAILED +#define POLARSSL_ERR_NET_TIMEOUT MBEDTLS_ERR_SSL_TIMEOUT +#define POLARSSL_ERR_NET_UNKNOWN_HOST MBEDTLS_ERR_NET_UNKNOWN_HOST +#define POLARSSL_ERR_NET_WANT_READ MBEDTLS_ERR_SSL_WANT_READ +#define POLARSSL_ERR_NET_WANT_WRITE MBEDTLS_ERR_SSL_WANT_WRITE +#define POLARSSL_ERR_OID_BUF_TOO_SMALL MBEDTLS_ERR_OID_BUF_TOO_SMALL +#define POLARSSL_ERR_OID_NOT_FOUND MBEDTLS_ERR_OID_NOT_FOUND +#define POLARSSL_ERR_PADLOCK_DATA_MISALIGNED MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED +#define POLARSSL_ERR_PEM_BAD_INPUT_DATA MBEDTLS_ERR_PEM_BAD_INPUT_DATA +#define POLARSSL_ERR_PEM_FEATURE_UNAVAILABLE MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_PEM_INVALID_DATA MBEDTLS_ERR_PEM_INVALID_DATA +#define POLARSSL_ERR_PEM_INVALID_ENC_IV MBEDTLS_ERR_PEM_INVALID_ENC_IV +#define POLARSSL_ERR_PEM_MALLOC_FAILED MBEDTLS_ERR_PEM_ALLOC_FAILED +#define POLARSSL_ERR_PEM_NO_HEADER_FOOTER_PRESENT MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT +#define POLARSSL_ERR_PEM_PASSWORD_MISMATCH MBEDTLS_ERR_PEM_PASSWORD_MISMATCH +#define POLARSSL_ERR_PEM_PASSWORD_REQUIRED MBEDTLS_ERR_PEM_PASSWORD_REQUIRED +#define POLARSSL_ERR_PEM_UNKNOWN_ENC_ALG MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG +#define POLARSSL_ERR_PKCS12_BAD_INPUT_DATA MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA +#define POLARSSL_ERR_PKCS12_FEATURE_UNAVAILABLE MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_PKCS12_PASSWORD_MISMATCH MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH +#define POLARSSL_ERR_PKCS12_PBE_INVALID_FORMAT MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT +#define POLARSSL_ERR_PKCS5_BAD_INPUT_DATA MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA +#define POLARSSL_ERR_PKCS5_FEATURE_UNAVAILABLE MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_PKCS5_INVALID_FORMAT MBEDTLS_ERR_PKCS5_INVALID_FORMAT +#define POLARSSL_ERR_PKCS5_PASSWORD_MISMATCH MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH +#define POLARSSL_ERR_PK_BAD_INPUT_DATA MBEDTLS_ERR_PK_BAD_INPUT_DATA +#define POLARSSL_ERR_PK_FEATURE_UNAVAILABLE MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_PK_FILE_IO_ERROR MBEDTLS_ERR_PK_FILE_IO_ERROR +#define POLARSSL_ERR_PK_INVALID_ALG MBEDTLS_ERR_PK_INVALID_ALG +#define POLARSSL_ERR_PK_INVALID_PUBKEY MBEDTLS_ERR_PK_INVALID_PUBKEY +#define POLARSSL_ERR_PK_KEY_INVALID_FORMAT MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +#define POLARSSL_ERR_PK_KEY_INVALID_VERSION MBEDTLS_ERR_PK_KEY_INVALID_VERSION +#define POLARSSL_ERR_PK_MALLOC_FAILED MBEDTLS_ERR_PK_ALLOC_FAILED +#define POLARSSL_ERR_PK_PASSWORD_MISMATCH MBEDTLS_ERR_PK_PASSWORD_MISMATCH +#define POLARSSL_ERR_PK_PASSWORD_REQUIRED MBEDTLS_ERR_PK_PASSWORD_REQUIRED +#define POLARSSL_ERR_PK_SIG_LEN_MISMATCH MBEDTLS_ERR_PK_SIG_LEN_MISMATCH +#define POLARSSL_ERR_PK_TYPE_MISMATCH MBEDTLS_ERR_PK_TYPE_MISMATCH +#define POLARSSL_ERR_PK_UNKNOWN_NAMED_CURVE MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE +#define POLARSSL_ERR_PK_UNKNOWN_PK_ALG MBEDTLS_ERR_PK_UNKNOWN_PK_ALG +#define POLARSSL_ERR_RSA_BAD_INPUT_DATA MBEDTLS_ERR_RSA_BAD_INPUT_DATA +#define POLARSSL_ERR_RSA_INVALID_PADDING MBEDTLS_ERR_RSA_INVALID_PADDING +#define POLARSSL_ERR_RSA_KEY_CHECK_FAILED MBEDTLS_ERR_RSA_KEY_CHECK_FAILED +#define POLARSSL_ERR_RSA_KEY_GEN_FAILED MBEDTLS_ERR_RSA_KEY_GEN_FAILED +#define POLARSSL_ERR_RSA_OUTPUT_TOO_LARGE MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE +#define POLARSSL_ERR_RSA_PRIVATE_FAILED MBEDTLS_ERR_RSA_PRIVATE_FAILED +#define POLARSSL_ERR_RSA_PUBLIC_FAILED MBEDTLS_ERR_RSA_PUBLIC_FAILED +#define POLARSSL_ERR_RSA_RNG_FAILED MBEDTLS_ERR_RSA_RNG_FAILED +#define POLARSSL_ERR_RSA_VERIFY_FAILED MBEDTLS_ERR_RSA_VERIFY_FAILED +#define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE +#define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST +#define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY +#define POLARSSL_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC MBEDTLS_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC +#define POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO +#define POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE +#define POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS +#define POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP +#define POLARSSL_ERR_SSL_BAD_HS_FINISHED MBEDTLS_ERR_SSL_BAD_HS_FINISHED +#define POLARSSL_ERR_SSL_BAD_HS_NEW_SESSION_TICKET MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET +#define POLARSSL_ERR_SSL_BAD_HS_PROTOCOL_VERSION MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION +#define POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO +#define POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO_DONE MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE +#define POLARSSL_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE +#define POLARSSL_ERR_SSL_BAD_INPUT_DATA MBEDTLS_ERR_SSL_BAD_INPUT_DATA +#define POLARSSL_ERR_SSL_BUFFER_TOO_SMALL MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL +#define POLARSSL_ERR_SSL_CA_CHAIN_REQUIRED MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED +#define POLARSSL_ERR_SSL_CERTIFICATE_REQUIRED MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED +#define POLARSSL_ERR_SSL_CERTIFICATE_TOO_LARGE MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE +#define POLARSSL_ERR_SSL_COMPRESSION_FAILED MBEDTLS_ERR_SSL_COMPRESSION_FAILED +#define POLARSSL_ERR_SSL_CONN_EOF MBEDTLS_ERR_SSL_CONN_EOF +#define POLARSSL_ERR_SSL_COUNTER_WRAPPING MBEDTLS_ERR_SSL_COUNTER_WRAPPING +#define POLARSSL_ERR_SSL_FATAL_ALERT_MESSAGE MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE +#define POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_SSL_HELLO_VERIFY_REQUIRED MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED +#define POLARSSL_ERR_SSL_HW_ACCEL_FAILED MBEDTLS_ERR_SSL_HW_ACCEL_FAILED +#define POLARSSL_ERR_SSL_HW_ACCEL_FALLTHROUGH MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH +#define POLARSSL_ERR_SSL_INTERNAL_ERROR MBEDTLS_ERR_SSL_INTERNAL_ERROR +#define POLARSSL_ERR_SSL_INVALID_MAC MBEDTLS_ERR_SSL_INVALID_MAC +#define POLARSSL_ERR_SSL_INVALID_RECORD MBEDTLS_ERR_SSL_INVALID_RECORD +#define POLARSSL_ERR_SSL_MALLOC_FAILED MBEDTLS_ERR_SSL_ALLOC_FAILED +#define POLARSSL_ERR_SSL_NO_CIPHER_CHOSEN MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN +#define POLARSSL_ERR_SSL_NO_CLIENT_CERTIFICATE MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE +#define POLARSSL_ERR_SSL_NO_RNG MBEDTLS_ERR_SSL_NO_RNG +#define POLARSSL_ERR_SSL_NO_USABLE_CIPHERSUITE MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE +#define POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY +#define POLARSSL_ERR_SSL_PEER_VERIFY_FAILED MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED +#define POLARSSL_ERR_SSL_PK_TYPE_MISMATCH MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH +#define POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED +#define POLARSSL_ERR_SSL_SESSION_TICKET_EXPIRED MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED +#define POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE +#define POLARSSL_ERR_SSL_UNKNOWN_CIPHER MBEDTLS_ERR_SSL_UNKNOWN_CIPHER +#define POLARSSL_ERR_SSL_UNKNOWN_IDENTITY MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY +#define POLARSSL_ERR_SSL_WAITING_SERVER_HELLO_RENEGO MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO +#define POLARSSL_ERR_THREADING_BAD_INPUT_DATA MBEDTLS_ERR_THREADING_BAD_INPUT_DATA +#define POLARSSL_ERR_THREADING_FEATURE_UNAVAILABLE MBEDTLS_ERR_THREADING_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_THREADING_MUTEX_ERROR MBEDTLS_ERR_THREADING_MUTEX_ERROR +#define POLARSSL_ERR_X509_BAD_INPUT_DATA MBEDTLS_ERR_X509_BAD_INPUT_DATA +#define POLARSSL_ERR_X509_CERT_UNKNOWN_FORMAT MBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT +#define POLARSSL_ERR_X509_CERT_VERIFY_FAILED MBEDTLS_ERR_X509_CERT_VERIFY_FAILED +#define POLARSSL_ERR_X509_FEATURE_UNAVAILABLE MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_X509_FILE_IO_ERROR MBEDTLS_ERR_X509_FILE_IO_ERROR +#define POLARSSL_ERR_X509_INVALID_ALG MBEDTLS_ERR_X509_INVALID_ALG +#define POLARSSL_ERR_X509_INVALID_DATE MBEDTLS_ERR_X509_INVALID_DATE +#define POLARSSL_ERR_X509_INVALID_EXTENSIONS MBEDTLS_ERR_X509_INVALID_EXTENSIONS +#define POLARSSL_ERR_X509_INVALID_FORMAT MBEDTLS_ERR_X509_INVALID_FORMAT +#define POLARSSL_ERR_X509_INVALID_NAME MBEDTLS_ERR_X509_INVALID_NAME +#define POLARSSL_ERR_X509_INVALID_SERIAL MBEDTLS_ERR_X509_INVALID_SERIAL +#define POLARSSL_ERR_X509_INVALID_SIGNATURE MBEDTLS_ERR_X509_INVALID_SIGNATURE +#define POLARSSL_ERR_X509_INVALID_VERSION MBEDTLS_ERR_X509_INVALID_VERSION +#define POLARSSL_ERR_X509_MALLOC_FAILED MBEDTLS_ERR_X509_ALLOC_FAILED +#define POLARSSL_ERR_X509_SIG_MISMATCH MBEDTLS_ERR_X509_SIG_MISMATCH +#define POLARSSL_ERR_X509_UNKNOWN_OID MBEDTLS_ERR_X509_UNKNOWN_OID +#define POLARSSL_ERR_X509_UNKNOWN_SIG_ALG MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG +#define POLARSSL_ERR_X509_UNKNOWN_VERSION MBEDTLS_ERR_X509_UNKNOWN_VERSION +#define POLARSSL_ERR_XTEA_INVALID_INPUT_LENGTH MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH +#define POLARSSL_GCM_H MBEDTLS_GCM_H +#define POLARSSL_HAVEGE_H MBEDTLS_HAVEGE_H +#define POLARSSL_HAVE_INT32 MBEDTLS_HAVE_INT32 +#define POLARSSL_HAVE_INT64 MBEDTLS_HAVE_INT64 +#define POLARSSL_HAVE_UDBL MBEDTLS_HAVE_UDBL +#define POLARSSL_HAVE_X86 MBEDTLS_HAVE_X86 +#define POLARSSL_HAVE_X86_64 MBEDTLS_HAVE_X86_64 +#define POLARSSL_HMAC_DRBG_H MBEDTLS_HMAC_DRBG_H +#define POLARSSL_HMAC_DRBG_PR_OFF MBEDTLS_HMAC_DRBG_PR_OFF +#define POLARSSL_HMAC_DRBG_PR_ON MBEDTLS_HMAC_DRBG_PR_ON +#define POLARSSL_KEY_EXCHANGE_DHE_PSK MBEDTLS_KEY_EXCHANGE_DHE_PSK +#define POLARSSL_KEY_EXCHANGE_DHE_RSA MBEDTLS_KEY_EXCHANGE_DHE_RSA +#define POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA +#define POLARSSL_KEY_EXCHANGE_ECDHE_PSK MBEDTLS_KEY_EXCHANGE_ECDHE_PSK +#define POLARSSL_KEY_EXCHANGE_ECDHE_RSA MBEDTLS_KEY_EXCHANGE_ECDHE_RSA +#define POLARSSL_KEY_EXCHANGE_ECDH_ECDSA MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA +#define POLARSSL_KEY_EXCHANGE_ECDH_RSA MBEDTLS_KEY_EXCHANGE_ECDH_RSA +#define POLARSSL_KEY_EXCHANGE_NONE MBEDTLS_KEY_EXCHANGE_NONE +#define POLARSSL_KEY_EXCHANGE_PSK MBEDTLS_KEY_EXCHANGE_PSK +#define POLARSSL_KEY_EXCHANGE_RSA MBEDTLS_KEY_EXCHANGE_RSA +#define POLARSSL_KEY_EXCHANGE_RSA_PSK MBEDTLS_KEY_EXCHANGE_RSA_PSK +#define POLARSSL_KEY_EXCHANGE__SOME__ECDHE_ENABLED MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED +#define POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED +#define POLARSSL_KEY_EXCHANGE__WITH_CERT__ENABLED MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED +#define POLARSSL_KEY_LENGTH_DES MBEDTLS_KEY_LENGTH_DES +#define POLARSSL_KEY_LENGTH_DES_EDE MBEDTLS_KEY_LENGTH_DES_EDE +#define POLARSSL_KEY_LENGTH_DES_EDE3 MBEDTLS_KEY_LENGTH_DES_EDE3 +#define POLARSSL_KEY_LENGTH_NONE MBEDTLS_KEY_LENGTH_NONE +#define POLARSSL_MAX_BLOCK_LENGTH MBEDTLS_MAX_BLOCK_LENGTH +#define POLARSSL_MAX_IV_LENGTH MBEDTLS_MAX_IV_LENGTH +#define POLARSSL_MD2_H MBEDTLS_MD2_H +#define POLARSSL_MD4_H MBEDTLS_MD4_H +#define POLARSSL_MD5_H MBEDTLS_MD5_H +#define POLARSSL_MD_H MBEDTLS_MD_H +#define POLARSSL_MD_MAX_SIZE MBEDTLS_MD_MAX_SIZE +#define POLARSSL_MD_MD2 MBEDTLS_MD_MD2 +#define POLARSSL_MD_MD4 MBEDTLS_MD_MD4 +#define POLARSSL_MD_MD5 MBEDTLS_MD_MD5 +#define POLARSSL_MD_NONE MBEDTLS_MD_NONE +#define POLARSSL_MD_RIPEMD160 MBEDTLS_MD_RIPEMD160 +#define POLARSSL_MD_SHA1 MBEDTLS_MD_SHA1 +#define POLARSSL_MD_SHA224 MBEDTLS_MD_SHA224 +#define POLARSSL_MD_SHA256 MBEDTLS_MD_SHA256 +#define POLARSSL_MD_SHA384 MBEDTLS_MD_SHA384 +#define POLARSSL_MD_SHA512 MBEDTLS_MD_SHA512 +#define POLARSSL_MD_WRAP_H MBEDTLS_MD_WRAP_H +#define POLARSSL_MEMORY_BUFFER_ALLOC_H MBEDTLS_MEMORY_BUFFER_ALLOC_H +#define POLARSSL_MODE_CBC MBEDTLS_MODE_CBC +#define POLARSSL_MODE_CCM MBEDTLS_MODE_CCM +#define POLARSSL_MODE_CFB MBEDTLS_MODE_CFB +#define POLARSSL_MODE_CTR MBEDTLS_MODE_CTR +#define POLARSSL_MODE_ECB MBEDTLS_MODE_ECB +#define POLARSSL_MODE_GCM MBEDTLS_MODE_GCM +#define POLARSSL_MODE_NONE MBEDTLS_MODE_NONE +#define POLARSSL_MODE_OFB MBEDTLS_MODE_OFB +#define POLARSSL_MODE_STREAM MBEDTLS_MODE_STREAM +#define POLARSSL_MPI_MAX_BITS MBEDTLS_MPI_MAX_BITS +#define POLARSSL_MPI_MAX_BITS_SCALE100 MBEDTLS_MPI_MAX_BITS_SCALE100 +#define POLARSSL_MPI_MAX_LIMBS MBEDTLS_MPI_MAX_LIMBS +#define POLARSSL_MPI_RW_BUFFER_SIZE MBEDTLS_MPI_RW_BUFFER_SIZE +#define POLARSSL_NET_H MBEDTLS_NET_SOCKETS_H +#define POLARSSL_NET_LISTEN_BACKLOG MBEDTLS_NET_LISTEN_BACKLOG +#define POLARSSL_OID_H MBEDTLS_OID_H +#define POLARSSL_OPERATION_NONE MBEDTLS_OPERATION_NONE +#define POLARSSL_PADDING_NONE MBEDTLS_PADDING_NONE +#define POLARSSL_PADDING_ONE_AND_ZEROS MBEDTLS_PADDING_ONE_AND_ZEROS +#define POLARSSL_PADDING_PKCS7 MBEDTLS_PADDING_PKCS7 +#define POLARSSL_PADDING_ZEROS MBEDTLS_PADDING_ZEROS +#define POLARSSL_PADDING_ZEROS_AND_LEN MBEDTLS_PADDING_ZEROS_AND_LEN +#define POLARSSL_PADLOCK_H MBEDTLS_PADLOCK_H +#define POLARSSL_PEM_H MBEDTLS_PEM_H +#define POLARSSL_PKCS11_H MBEDTLS_PKCS11_H +#define POLARSSL_PKCS12_H MBEDTLS_PKCS12_H +#define POLARSSL_PKCS5_H MBEDTLS_PKCS5_H +#define POLARSSL_PK_DEBUG_ECP MBEDTLS_PK_DEBUG_ECP +#define POLARSSL_PK_DEBUG_MAX_ITEMS MBEDTLS_PK_DEBUG_MAX_ITEMS +#define POLARSSL_PK_DEBUG_MPI MBEDTLS_PK_DEBUG_MPI +#define POLARSSL_PK_DEBUG_NONE MBEDTLS_PK_DEBUG_NONE +#define POLARSSL_PK_ECDSA MBEDTLS_PK_ECDSA +#define POLARSSL_PK_ECKEY MBEDTLS_PK_ECKEY +#define POLARSSL_PK_ECKEY_DH MBEDTLS_PK_ECKEY_DH +#define POLARSSL_PK_H MBEDTLS_PK_H +#define POLARSSL_PK_NONE MBEDTLS_PK_NONE +#define POLARSSL_PK_RSA MBEDTLS_PK_RSA +#define POLARSSL_PK_RSASSA_PSS MBEDTLS_PK_RSASSA_PSS +#define POLARSSL_PK_RSA_ALT MBEDTLS_PK_RSA_ALT +#define POLARSSL_PK_WRAP_H MBEDTLS_PK_WRAP_H +#define POLARSSL_PLATFORM_H MBEDTLS_PLATFORM_H +#define POLARSSL_PREMASTER_SIZE MBEDTLS_PREMASTER_SIZE +#define POLARSSL_RIPEMD160_H MBEDTLS_RIPEMD160_H +#define POLARSSL_RSA_H MBEDTLS_RSA_H +#define POLARSSL_SHA1_H MBEDTLS_SHA1_H +#define POLARSSL_SHA256_H MBEDTLS_SHA256_H +#define POLARSSL_SHA512_H MBEDTLS_SHA512_H +#define POLARSSL_SSL_CACHE_H MBEDTLS_SSL_CACHE_H +#define POLARSSL_SSL_CIPHERSUITES_H MBEDTLS_SSL_CIPHERSUITES_H +#define POLARSSL_SSL_COOKIE_H MBEDTLS_SSL_COOKIE_H +#define POLARSSL_SSL_H MBEDTLS_SSL_H +#define POLARSSL_THREADING_H MBEDTLS_THREADING_H +#define POLARSSL_THREADING_IMPL MBEDTLS_THREADING_IMPL +#define POLARSSL_TIMING_H MBEDTLS_TIMING_H +#define POLARSSL_VERSION_H MBEDTLS_VERSION_H +#define POLARSSL_VERSION_MAJOR MBEDTLS_VERSION_MAJOR +#define POLARSSL_VERSION_MINOR MBEDTLS_VERSION_MINOR +#define POLARSSL_VERSION_NUMBER MBEDTLS_VERSION_NUMBER +#define POLARSSL_VERSION_PATCH MBEDTLS_VERSION_PATCH +#define POLARSSL_VERSION_STRING MBEDTLS_VERSION_STRING +#define POLARSSL_VERSION_STRING_FULL MBEDTLS_VERSION_STRING_FULL +#define POLARSSL_X509_CRL_H MBEDTLS_X509_CRL_H +#define POLARSSL_X509_CRT_H MBEDTLS_X509_CRT_H +#define POLARSSL_X509_CSR_H MBEDTLS_X509_CSR_H +#define POLARSSL_X509_H MBEDTLS_X509_H +#define POLARSSL_XTEA_H MBEDTLS_XTEA_H +#define RSA_CRYPT MBEDTLS_RSA_CRYPT +#define RSA_PKCS_V15 MBEDTLS_RSA_PKCS_V15 +#define RSA_PKCS_V21 MBEDTLS_RSA_PKCS_V21 +#define RSA_PRIVATE MBEDTLS_RSA_PRIVATE +#define RSA_PUBLIC MBEDTLS_RSA_PUBLIC +#define RSA_SALT_LEN_ANY MBEDTLS_RSA_SALT_LEN_ANY +#define RSA_SIGN MBEDTLS_RSA_SIGN +#define SSL_ALERT_LEVEL_FATAL MBEDTLS_SSL_ALERT_LEVEL_FATAL +#define SSL_ALERT_LEVEL_WARNING MBEDTLS_SSL_ALERT_LEVEL_WARNING +#define SSL_ALERT_MSG_ACCESS_DENIED MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED +#define SSL_ALERT_MSG_BAD_CERT MBEDTLS_SSL_ALERT_MSG_BAD_CERT +#define SSL_ALERT_MSG_BAD_RECORD_MAC MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC +#define SSL_ALERT_MSG_CERT_EXPIRED MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED +#define SSL_ALERT_MSG_CERT_REVOKED MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED +#define SSL_ALERT_MSG_CERT_UNKNOWN MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN +#define SSL_ALERT_MSG_CLOSE_NOTIFY MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY +#define SSL_ALERT_MSG_DECODE_ERROR MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR +#define SSL_ALERT_MSG_DECOMPRESSION_FAILURE MBEDTLS_SSL_ALERT_MSG_DECOMPRESSION_FAILURE +#define SSL_ALERT_MSG_DECRYPTION_FAILED MBEDTLS_SSL_ALERT_MSG_DECRYPTION_FAILED +#define SSL_ALERT_MSG_DECRYPT_ERROR MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR +#define SSL_ALERT_MSG_EXPORT_RESTRICTION MBEDTLS_SSL_ALERT_MSG_EXPORT_RESTRICTION +#define SSL_ALERT_MSG_HANDSHAKE_FAILURE MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE +#define SSL_ALERT_MSG_ILLEGAL_PARAMETER MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER +#define SSL_ALERT_MSG_INAPROPRIATE_FALLBACK MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK +#define SSL_ALERT_MSG_INSUFFICIENT_SECURITY MBEDTLS_SSL_ALERT_MSG_INSUFFICIENT_SECURITY +#define SSL_ALERT_MSG_INTERNAL_ERROR MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR +#define SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL +#define SSL_ALERT_MSG_NO_CERT MBEDTLS_SSL_ALERT_MSG_NO_CERT +#define SSL_ALERT_MSG_NO_RENEGOTIATION MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION +#define SSL_ALERT_MSG_PROTOCOL_VERSION MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION +#define SSL_ALERT_MSG_RECORD_OVERFLOW MBEDTLS_SSL_ALERT_MSG_RECORD_OVERFLOW +#define SSL_ALERT_MSG_UNEXPECTED_MESSAGE MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE +#define SSL_ALERT_MSG_UNKNOWN_CA MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA +#define SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY +#define SSL_ALERT_MSG_UNRECOGNIZED_NAME MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME +#define SSL_ALERT_MSG_UNSUPPORTED_CERT MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT +#define SSL_ALERT_MSG_UNSUPPORTED_EXT MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT +#define SSL_ALERT_MSG_USER_CANCELED MBEDTLS_SSL_ALERT_MSG_USER_CANCELED +#define SSL_ANTI_REPLAY_DISABLED MBEDTLS_SSL_ANTI_REPLAY_DISABLED +#define SSL_ANTI_REPLAY_ENABLED MBEDTLS_SSL_ANTI_REPLAY_ENABLED +#define SSL_ARC4_DISABLED MBEDTLS_SSL_ARC4_DISABLED +#define SSL_ARC4_ENABLED MBEDTLS_SSL_ARC4_ENABLED +#define SSL_BUFFER_LEN ( ( ( MBEDTLS_SSL_IN_BUFFER_LEN ) < ( MBEDTLS_SSL_OUT_BUFFER_LEN ) ) \ + ? ( MBEDTLS_SSL_IN_BUFFER_LEN ) : ( MBEDTLS_SSL_OUT_BUFFER_LEN ) ) +#define SSL_CACHE_DEFAULT_MAX_ENTRIES MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES +#define SSL_CACHE_DEFAULT_TIMEOUT MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT +#define SSL_CBC_RECORD_SPLITTING_DISABLED MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED +#define SSL_CBC_RECORD_SPLITTING_ENABLED MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED +#define SSL_CERTIFICATE_REQUEST MBEDTLS_SSL_CERTIFICATE_REQUEST +#define SSL_CERTIFICATE_VERIFY MBEDTLS_SSL_CERTIFICATE_VERIFY +#define SSL_CERT_TYPE_ECDSA_SIGN MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN +#define SSL_CERT_TYPE_RSA_SIGN MBEDTLS_SSL_CERT_TYPE_RSA_SIGN +#define SSL_CHANNEL_INBOUND MBEDTLS_SSL_CHANNEL_INBOUND +#define SSL_CHANNEL_OUTBOUND MBEDTLS_SSL_CHANNEL_OUTBOUND +#define SSL_CIPHERSUITES MBEDTLS_SSL_CIPHERSUITES +#define SSL_CLIENT_CERTIFICATE MBEDTLS_SSL_CLIENT_CERTIFICATE +#define SSL_CLIENT_CHANGE_CIPHER_SPEC MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC +#define SSL_CLIENT_FINISHED MBEDTLS_SSL_CLIENT_FINISHED +#define SSL_CLIENT_HELLO MBEDTLS_SSL_CLIENT_HELLO +#define SSL_CLIENT_KEY_EXCHANGE MBEDTLS_SSL_CLIENT_KEY_EXCHANGE +#define SSL_COMPRESSION_ADD MBEDTLS_SSL_COMPRESSION_ADD +#define SSL_COMPRESS_DEFLATE MBEDTLS_SSL_COMPRESS_DEFLATE +#define SSL_COMPRESS_NULL MBEDTLS_SSL_COMPRESS_NULL +#define SSL_DEBUG_BUF MBEDTLS_SSL_DEBUG_BUF +#define SSL_DEBUG_CRT MBEDTLS_SSL_DEBUG_CRT +#define SSL_DEBUG_ECP MBEDTLS_SSL_DEBUG_ECP +#define SSL_DEBUG_MPI MBEDTLS_SSL_DEBUG_MPI +#define SSL_DEBUG_MSG MBEDTLS_SSL_DEBUG_MSG +#define SSL_DEBUG_RET MBEDTLS_SSL_DEBUG_RET +#define SSL_DEFAULT_TICKET_LIFETIME MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME +#define SSL_DTLS_TIMEOUT_DFL_MAX MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX +#define SSL_DTLS_TIMEOUT_DFL_MIN MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN +#define SSL_EMPTY_RENEGOTIATION_INFO MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO +#define SSL_ETM_DISABLED MBEDTLS_SSL_ETM_DISABLED +#define SSL_ETM_ENABLED MBEDTLS_SSL_ETM_ENABLED +#define SSL_EXTENDED_MS_DISABLED MBEDTLS_SSL_EXTENDED_MS_DISABLED +#define SSL_EXTENDED_MS_ENABLED MBEDTLS_SSL_EXTENDED_MS_ENABLED +#define SSL_FALLBACK_SCSV MBEDTLS_SSL_FALLBACK_SCSV +#define SSL_FLUSH_BUFFERS MBEDTLS_SSL_FLUSH_BUFFERS +#define SSL_HANDSHAKE_OVER MBEDTLS_SSL_HANDSHAKE_OVER +#define SSL_HANDSHAKE_WRAPUP MBEDTLS_SSL_HANDSHAKE_WRAPUP +#define SSL_HASH_MD5 MBEDTLS_SSL_HASH_MD5 +#define SSL_HASH_NONE MBEDTLS_SSL_HASH_NONE +#define SSL_HASH_SHA1 MBEDTLS_SSL_HASH_SHA1 +#define SSL_HASH_SHA224 MBEDTLS_SSL_HASH_SHA224 +#define SSL_HASH_SHA256 MBEDTLS_SSL_HASH_SHA256 +#define SSL_HASH_SHA384 MBEDTLS_SSL_HASH_SHA384 +#define SSL_HASH_SHA512 MBEDTLS_SSL_HASH_SHA512 +#define SSL_HELLO_REQUEST MBEDTLS_SSL_HELLO_REQUEST +#define SSL_HS_CERTIFICATE MBEDTLS_SSL_HS_CERTIFICATE +#define SSL_HS_CERTIFICATE_REQUEST MBEDTLS_SSL_HS_CERTIFICATE_REQUEST +#define SSL_HS_CERTIFICATE_VERIFY MBEDTLS_SSL_HS_CERTIFICATE_VERIFY +#define SSL_HS_CLIENT_HELLO MBEDTLS_SSL_HS_CLIENT_HELLO +#define SSL_HS_CLIENT_KEY_EXCHANGE MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE +#define SSL_HS_FINISHED MBEDTLS_SSL_HS_FINISHED +#define SSL_HS_HELLO_REQUEST MBEDTLS_SSL_HS_HELLO_REQUEST +#define SSL_HS_HELLO_VERIFY_REQUEST MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST +#define SSL_HS_NEW_SESSION_TICKET MBEDTLS_SSL_HS_NEW_SESSION_TICKET +#define SSL_HS_SERVER_HELLO MBEDTLS_SSL_HS_SERVER_HELLO +#define SSL_HS_SERVER_HELLO_DONE MBEDTLS_SSL_HS_SERVER_HELLO_DONE +#define SSL_HS_SERVER_KEY_EXCHANGE MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE +#define SSL_INITIAL_HANDSHAKE MBEDTLS_SSL_INITIAL_HANDSHAKE +#define SSL_IS_CLIENT MBEDTLS_SSL_IS_CLIENT +#define SSL_IS_FALLBACK MBEDTLS_SSL_IS_FALLBACK +#define SSL_IS_NOT_FALLBACK MBEDTLS_SSL_IS_NOT_FALLBACK +#define SSL_IS_SERVER MBEDTLS_SSL_IS_SERVER +#define SSL_LEGACY_ALLOW_RENEGOTIATION MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION +#define SSL_LEGACY_BREAK_HANDSHAKE MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE +#define SSL_LEGACY_NO_RENEGOTIATION MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION +#define SSL_LEGACY_RENEGOTIATION MBEDTLS_SSL_LEGACY_RENEGOTIATION +#define SSL_MAC_ADD MBEDTLS_SSL_MAC_ADD +#define SSL_MAJOR_VERSION_3 MBEDTLS_SSL_MAJOR_VERSION_3 +#define SSL_MAX_CONTENT_LEN MBEDTLS_SSL_MAX_CONTENT_LEN +#define SSL_MAX_FRAG_LEN_1024 MBEDTLS_SSL_MAX_FRAG_LEN_1024 +#define SSL_MAX_FRAG_LEN_2048 MBEDTLS_SSL_MAX_FRAG_LEN_2048 +#define SSL_MAX_FRAG_LEN_4096 MBEDTLS_SSL_MAX_FRAG_LEN_4096 +#define SSL_MAX_FRAG_LEN_512 MBEDTLS_SSL_MAX_FRAG_LEN_512 +#define SSL_MAX_FRAG_LEN_INVALID MBEDTLS_SSL_MAX_FRAG_LEN_INVALID +#define SSL_MAX_FRAG_LEN_NONE MBEDTLS_SSL_MAX_FRAG_LEN_NONE +#define SSL_MAX_MAJOR_VERSION MBEDTLS_SSL_MAX_MAJOR_VERSION +#define SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MAX_MINOR_VERSION +#define SSL_MINOR_VERSION_0 MBEDTLS_SSL_MINOR_VERSION_0 +#define SSL_MINOR_VERSION_1 MBEDTLS_SSL_MINOR_VERSION_1 +#define SSL_MINOR_VERSION_2 MBEDTLS_SSL_MINOR_VERSION_2 +#define SSL_MINOR_VERSION_3 MBEDTLS_SSL_MINOR_VERSION_3 +#define SSL_MIN_MAJOR_VERSION MBEDTLS_SSL_MIN_MAJOR_VERSION +#define SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MIN_MINOR_VERSION +#define SSL_MSG_ALERT MBEDTLS_SSL_MSG_ALERT +#define SSL_MSG_APPLICATION_DATA MBEDTLS_SSL_MSG_APPLICATION_DATA +#define SSL_MSG_CHANGE_CIPHER_SPEC MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC +#define SSL_MSG_HANDSHAKE MBEDTLS_SSL_MSG_HANDSHAKE +#define SSL_PADDING_ADD MBEDTLS_SSL_PADDING_ADD +#define SSL_RENEGOTIATION MBEDTLS_SSL_RENEGOTIATION +#define SSL_RENEGOTIATION_DISABLED MBEDTLS_SSL_RENEGOTIATION_DISABLED +#define SSL_RENEGOTIATION_DONE MBEDTLS_SSL_RENEGOTIATION_DONE +#define SSL_RENEGOTIATION_ENABLED MBEDTLS_SSL_RENEGOTIATION_ENABLED +#define SSL_RENEGOTIATION_NOT_ENFORCED MBEDTLS_SSL_RENEGOTIATION_NOT_ENFORCED +#define SSL_RENEGOTIATION_PENDING MBEDTLS_SSL_RENEGOTIATION_PENDING +#define SSL_RENEGO_MAX_RECORDS_DEFAULT MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT +#define SSL_RETRANS_FINISHED MBEDTLS_SSL_RETRANS_FINISHED +#define SSL_RETRANS_PREPARING MBEDTLS_SSL_RETRANS_PREPARING +#define SSL_RETRANS_SENDING MBEDTLS_SSL_RETRANS_SENDING +#define SSL_RETRANS_WAITING MBEDTLS_SSL_RETRANS_WAITING +#define SSL_SECURE_RENEGOTIATION MBEDTLS_SSL_SECURE_RENEGOTIATION +#define SSL_SERVER_CERTIFICATE MBEDTLS_SSL_SERVER_CERTIFICATE +#define SSL_SERVER_CHANGE_CIPHER_SPEC MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC +#define SSL_SERVER_FINISHED MBEDTLS_SSL_SERVER_FINISHED +#define SSL_SERVER_HELLO MBEDTLS_SSL_SERVER_HELLO +#define SSL_SERVER_HELLO_DONE MBEDTLS_SSL_SERVER_HELLO_DONE +#define SSL_SERVER_HELLO_VERIFY_REQUEST_SENT MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT +#define SSL_SERVER_KEY_EXCHANGE MBEDTLS_SSL_SERVER_KEY_EXCHANGE +#define SSL_SERVER_NEW_SESSION_TICKET MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET +#define SSL_SESSION_TICKETS_DISABLED MBEDTLS_SSL_SESSION_TICKETS_DISABLED +#define SSL_SESSION_TICKETS_ENABLED MBEDTLS_SSL_SESSION_TICKETS_ENABLED +#define SSL_SIG_ANON MBEDTLS_SSL_SIG_ANON +#define SSL_SIG_ECDSA MBEDTLS_SSL_SIG_ECDSA +#define SSL_SIG_RSA MBEDTLS_SSL_SIG_RSA +#define SSL_TRANSPORT_DATAGRAM MBEDTLS_SSL_TRANSPORT_DATAGRAM +#define SSL_TRANSPORT_STREAM MBEDTLS_SSL_TRANSPORT_STREAM +#define SSL_TRUNCATED_HMAC_LEN MBEDTLS_SSL_TRUNCATED_HMAC_LEN +#define SSL_TRUNC_HMAC_DISABLED MBEDTLS_SSL_TRUNC_HMAC_DISABLED +#define SSL_TRUNC_HMAC_ENABLED MBEDTLS_SSL_TRUNC_HMAC_ENABLED +#define SSL_VERIFY_DATA_MAX_LEN MBEDTLS_SSL_VERIFY_DATA_MAX_LEN +#define SSL_VERIFY_NONE MBEDTLS_SSL_VERIFY_NONE +#define SSL_VERIFY_OPTIONAL MBEDTLS_SSL_VERIFY_OPTIONAL +#define SSL_VERIFY_REQUIRED MBEDTLS_SSL_VERIFY_REQUIRED +#define TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA +#define TLS_DHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA +#define TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 +#define TLS_DHE_PSK_WITH_AES_128_CCM MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM +#define TLS_DHE_PSK_WITH_AES_128_CCM_8 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM_8 +#define TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 +#define TLS_DHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA +#define TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 +#define TLS_DHE_PSK_WITH_AES_256_CCM MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM +#define TLS_DHE_PSK_WITH_AES_256_CCM_8 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM_8 +#define TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 +#define TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 +#define TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_DHE_PSK_WITH_NULL_SHA MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA +#define TLS_DHE_PSK_WITH_NULL_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256 +#define TLS_DHE_PSK_WITH_NULL_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384 +#define TLS_DHE_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA +#define TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA +#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA +#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 +#define TLS_DHE_RSA_WITH_AES_128_CCM MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM +#define TLS_DHE_RSA_WITH_AES_128_CCM_8 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM_8 +#define TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 +#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA +#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 +#define TLS_DHE_RSA_WITH_AES_256_CCM MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM +#define TLS_DHE_RSA_WITH_AES_256_CCM_8 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM_8 +#define TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 +#define TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA +#define TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA +#define TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 +#define TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_DHE_RSA_WITH_DES_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_DES_CBC_SHA +#define TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA +#define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA +#define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 +#define TLS_ECDHE_ECDSA_WITH_AES_128_CCM MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM +#define TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 +#define TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 +#define TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA +#define TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 +#define TLS_ECDHE_ECDSA_WITH_AES_256_CCM MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM +#define TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 +#define TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 +#define TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 +#define TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_ECDHE_ECDSA_WITH_NULL_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA +#define TLS_ECDHE_ECDSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA +#define TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA +#define TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA +#define TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 +#define TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA +#define TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 +#define TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 +#define TLS_ECDHE_PSK_WITH_NULL_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA +#define TLS_ECDHE_PSK_WITH_NULL_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 +#define TLS_ECDHE_PSK_WITH_NULL_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 +#define TLS_ECDHE_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA +#define TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA +#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA +#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 +#define TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 +#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA +#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 +#define TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 +#define TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 +#define TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_ECDHE_RSA_WITH_NULL_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA +#define TLS_ECDHE_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA +#define TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA +#define TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA +#define TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 +#define TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 +#define TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA +#define TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 +#define TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 +#define TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 +#define TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_ECDH_ECDSA_WITH_NULL_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA +#define TLS_ECDH_ECDSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA +#define TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA +#define TLS_ECDH_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA +#define TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 +#define TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 +#define TLS_ECDH_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA +#define TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 +#define TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 +#define TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 +#define TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_ECDH_RSA_WITH_NULL_SHA MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA +#define TLS_ECDH_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA +#define TLS_EXT_ALPN MBEDTLS_TLS_EXT_ALPN +#define TLS_EXT_ENCRYPT_THEN_MAC MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC +#define TLS_EXT_EXTENDED_MASTER_SECRET MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET +#define TLS_EXT_MAX_FRAGMENT_LENGTH MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH +#define TLS_EXT_RENEGOTIATION_INFO MBEDTLS_TLS_EXT_RENEGOTIATION_INFO +#define TLS_EXT_SERVERNAME MBEDTLS_TLS_EXT_SERVERNAME +#define TLS_EXT_SERVERNAME_HOSTNAME MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME +#define TLS_EXT_SESSION_TICKET MBEDTLS_TLS_EXT_SESSION_TICKET +#define TLS_EXT_SIG_ALG MBEDTLS_TLS_EXT_SIG_ALG +#define TLS_EXT_SUPPORTED_ELLIPTIC_CURVES MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES +#define TLS_EXT_SUPPORTED_POINT_FORMATS MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS +#define TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT +#define TLS_EXT_TRUNCATED_HMAC MBEDTLS_TLS_EXT_TRUNCATED_HMAC +#define TLS_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA +#define TLS_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA +#define TLS_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 +#define TLS_PSK_WITH_AES_128_CCM MBEDTLS_TLS_PSK_WITH_AES_128_CCM +#define TLS_PSK_WITH_AES_128_CCM_8 MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8 +#define TLS_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 +#define TLS_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA +#define TLS_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 +#define TLS_PSK_WITH_AES_256_CCM MBEDTLS_TLS_PSK_WITH_AES_256_CCM +#define TLS_PSK_WITH_AES_256_CCM_8 MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8 +#define TLS_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 +#define TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 +#define TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_PSK_WITH_NULL_SHA MBEDTLS_TLS_PSK_WITH_NULL_SHA +#define TLS_PSK_WITH_NULL_SHA256 MBEDTLS_TLS_PSK_WITH_NULL_SHA256 +#define TLS_PSK_WITH_NULL_SHA384 MBEDTLS_TLS_PSK_WITH_NULL_SHA384 +#define TLS_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_PSK_WITH_RC4_128_SHA +#define TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA +#define TLS_RSA_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA +#define TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 +#define TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 +#define TLS_RSA_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA +#define TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 +#define TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 +#define TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 +#define TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_RSA_PSK_WITH_NULL_SHA MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA +#define TLS_RSA_PSK_WITH_NULL_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256 +#define TLS_RSA_PSK_WITH_NULL_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384 +#define TLS_RSA_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA +#define TLS_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA +#define TLS_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA +#define TLS_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 +#define TLS_RSA_WITH_AES_128_CCM MBEDTLS_TLS_RSA_WITH_AES_128_CCM +#define TLS_RSA_WITH_AES_128_CCM_8 MBEDTLS_TLS_RSA_WITH_AES_128_CCM_8 +#define TLS_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 +#define TLS_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA +#define TLS_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 +#define TLS_RSA_WITH_AES_256_CCM MBEDTLS_TLS_RSA_WITH_AES_256_CCM +#define TLS_RSA_WITH_AES_256_CCM_8 MBEDTLS_TLS_RSA_WITH_AES_256_CCM_8 +#define TLS_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 +#define TLS_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA +#define TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA +#define TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 +#define TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_RSA_WITH_DES_CBC_SHA MBEDTLS_TLS_RSA_WITH_DES_CBC_SHA +#define TLS_RSA_WITH_NULL_MD5 MBEDTLS_TLS_RSA_WITH_NULL_MD5 +#define TLS_RSA_WITH_NULL_SHA MBEDTLS_TLS_RSA_WITH_NULL_SHA +#define TLS_RSA_WITH_NULL_SHA256 MBEDTLS_TLS_RSA_WITH_NULL_SHA256 +#define TLS_RSA_WITH_RC4_128_MD5 MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 +#define TLS_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_SHA +#define X509_CRT_VERSION_1 MBEDTLS_X509_CRT_VERSION_1 +#define X509_CRT_VERSION_2 MBEDTLS_X509_CRT_VERSION_2 +#define X509_CRT_VERSION_3 MBEDTLS_X509_CRT_VERSION_3 +#define X509_FORMAT_DER MBEDTLS_X509_FORMAT_DER +#define X509_FORMAT_PEM MBEDTLS_X509_FORMAT_PEM +#define X509_MAX_DN_NAME_SIZE MBEDTLS_X509_MAX_DN_NAME_SIZE +#define X509_RFC5280_MAX_SERIAL_LEN MBEDTLS_X509_RFC5280_MAX_SERIAL_LEN +#define X509_RFC5280_UTC_TIME_LEN MBEDTLS_X509_RFC5280_UTC_TIME_LEN +#define XTEA_DECRYPT MBEDTLS_XTEA_DECRYPT +#define XTEA_ENCRYPT MBEDTLS_XTEA_ENCRYPT +#define _asn1_bitstring mbedtls_asn1_bitstring +#define _asn1_buf mbedtls_asn1_buf +#define _asn1_named_data mbedtls_asn1_named_data +#define _asn1_sequence mbedtls_asn1_sequence +#define _ssl_cache_context mbedtls_ssl_cache_context +#define _ssl_cache_entry mbedtls_ssl_cache_entry +#define _ssl_ciphersuite_t mbedtls_ssl_ciphersuite_t +#define _ssl_context mbedtls_ssl_context +#define _ssl_flight_item mbedtls_ssl_flight_item +#define _ssl_handshake_params mbedtls_ssl_handshake_params +#define _ssl_key_cert mbedtls_ssl_key_cert +#define _ssl_premaster_secret mbedtls_ssl_premaster_secret +#define _ssl_session mbedtls_ssl_session +#define _ssl_transform mbedtls_ssl_transform +#define _x509_crl mbedtls_x509_crl +#define _x509_crl_entry mbedtls_x509_crl_entry +#define _x509_crt mbedtls_x509_crt +#define _x509_csr mbedtls_x509_csr +#define _x509_time mbedtls_x509_time +#define _x509write_cert mbedtls_x509write_cert +#define _x509write_csr mbedtls_x509write_csr +#define aes_context mbedtls_aes_context +#define aes_crypt_cbc mbedtls_aes_crypt_cbc +#define aes_crypt_cfb128 mbedtls_aes_crypt_cfb128 +#define aes_crypt_cfb8 mbedtls_aes_crypt_cfb8 +#define aes_crypt_ctr mbedtls_aes_crypt_ctr +#define aes_crypt_ecb mbedtls_aes_crypt_ecb +#define aes_free mbedtls_aes_free +#define aes_init mbedtls_aes_init +#define aes_self_test mbedtls_aes_self_test +#define aes_setkey_dec mbedtls_aes_setkey_dec +#define aes_setkey_enc mbedtls_aes_setkey_enc +#define aesni_crypt_ecb mbedtls_aesni_crypt_ecb +#define aesni_gcm_mult mbedtls_aesni_gcm_mult +#define aesni_inverse_key mbedtls_aesni_inverse_key +#define aesni_setkey_enc mbedtls_aesni_setkey_enc +#define aesni_supports mbedtls_aesni_has_support +#define alarmed mbedtls_timing_alarmed +#define arc4_context mbedtls_arc4_context +#define arc4_crypt mbedtls_arc4_crypt +#define arc4_free mbedtls_arc4_free +#define arc4_init mbedtls_arc4_init +#define arc4_self_test mbedtls_arc4_self_test +#define arc4_setup mbedtls_arc4_setup +#define asn1_bitstring mbedtls_asn1_bitstring +#define asn1_buf mbedtls_asn1_buf +#define asn1_find_named_data mbedtls_asn1_find_named_data +#define asn1_free_named_data mbedtls_asn1_free_named_data +#define asn1_free_named_data_list mbedtls_asn1_free_named_data_list +#define asn1_get_alg mbedtls_asn1_get_alg +#define asn1_get_alg_null mbedtls_asn1_get_alg_null +#define asn1_get_bitstring mbedtls_asn1_get_bitstring +#define asn1_get_bitstring_null mbedtls_asn1_get_bitstring_null +#define asn1_get_bool mbedtls_asn1_get_bool +#define asn1_get_int mbedtls_asn1_get_int +#define asn1_get_len mbedtls_asn1_get_len +#define asn1_get_mpi mbedtls_asn1_get_mpi +#define asn1_get_sequence_of mbedtls_asn1_get_sequence_of +#define asn1_get_tag mbedtls_asn1_get_tag +#define asn1_named_data mbedtls_asn1_named_data +#define asn1_sequence mbedtls_asn1_sequence +#define asn1_store_named_data mbedtls_asn1_store_named_data +#define asn1_write_algorithm_identifier mbedtls_asn1_write_algorithm_identifier +#define asn1_write_bitstring mbedtls_asn1_write_bitstring +#define asn1_write_bool mbedtls_asn1_write_bool +#define asn1_write_ia5_string mbedtls_asn1_write_ia5_string +#define asn1_write_int mbedtls_asn1_write_int +#define asn1_write_len mbedtls_asn1_write_len +#define asn1_write_mpi mbedtls_asn1_write_mpi +#define asn1_write_null mbedtls_asn1_write_null +#define asn1_write_octet_string mbedtls_asn1_write_octet_string +#define asn1_write_oid mbedtls_asn1_write_oid +#define asn1_write_printable_string mbedtls_asn1_write_printable_string +#define asn1_write_raw_buffer mbedtls_asn1_write_raw_buffer +#define asn1_write_tag mbedtls_asn1_write_tag +#define base64_decode mbedtls_base64_decode +#define base64_encode mbedtls_base64_encode +#define base64_self_test mbedtls_base64_self_test +#define blowfish_context mbedtls_blowfish_context +#define blowfish_crypt_cbc mbedtls_blowfish_crypt_cbc +#define blowfish_crypt_cfb64 mbedtls_blowfish_crypt_cfb64 +#define blowfish_crypt_ctr mbedtls_blowfish_crypt_ctr +#define blowfish_crypt_ecb mbedtls_blowfish_crypt_ecb +#define blowfish_free mbedtls_blowfish_free +#define blowfish_init mbedtls_blowfish_init +#define blowfish_setkey mbedtls_blowfish_setkey +#define camellia_context mbedtls_camellia_context +#define camellia_crypt_cbc mbedtls_camellia_crypt_cbc +#define camellia_crypt_cfb128 mbedtls_camellia_crypt_cfb128 +#define camellia_crypt_ctr mbedtls_camellia_crypt_ctr +#define camellia_crypt_ecb mbedtls_camellia_crypt_ecb +#define camellia_free mbedtls_camellia_free +#define camellia_init mbedtls_camellia_init +#define camellia_self_test mbedtls_camellia_self_test +#define camellia_setkey_dec mbedtls_camellia_setkey_dec +#define camellia_setkey_enc mbedtls_camellia_setkey_enc +#define ccm_auth_decrypt mbedtls_ccm_auth_decrypt +#define ccm_context mbedtls_ccm_context +#define ccm_encrypt_and_tag mbedtls_ccm_encrypt_and_tag +#define ccm_free mbedtls_ccm_free +#define ccm_init mbedtls_ccm_init +#define ccm_self_test mbedtls_ccm_self_test +#define cipher_auth_decrypt mbedtls_cipher_auth_decrypt +#define cipher_auth_encrypt mbedtls_cipher_auth_encrypt +#define cipher_base_t mbedtls_cipher_base_t +#define cipher_check_tag mbedtls_cipher_check_tag +#define cipher_context_t mbedtls_cipher_context_t +#define cipher_crypt mbedtls_cipher_crypt +#define cipher_definition_t mbedtls_cipher_definition_t +#define cipher_definitions mbedtls_cipher_definitions +#define cipher_finish mbedtls_cipher_finish +#define cipher_free mbedtls_cipher_free +#define cipher_get_block_size mbedtls_cipher_get_block_size +#define cipher_get_cipher_mode mbedtls_cipher_get_cipher_mode +#define cipher_get_iv_size mbedtls_cipher_get_iv_size +#define cipher_get_key_size mbedtls_cipher_get_key_bitlen +#define cipher_get_name mbedtls_cipher_get_name +#define cipher_get_operation mbedtls_cipher_get_operation +#define cipher_get_type mbedtls_cipher_get_type +#define cipher_id_t mbedtls_cipher_id_t +#define cipher_info_from_string mbedtls_cipher_info_from_string +#define cipher_info_from_type mbedtls_cipher_info_from_type +#define cipher_info_from_values mbedtls_cipher_info_from_values +#define cipher_info_t mbedtls_cipher_info_t +#define cipher_init mbedtls_cipher_init +#define cipher_init_ctx mbedtls_cipher_setup +#define cipher_list mbedtls_cipher_list +#define cipher_mode_t mbedtls_cipher_mode_t +#define cipher_padding_t mbedtls_cipher_padding_t +#define cipher_reset mbedtls_cipher_reset +#define cipher_set_iv mbedtls_cipher_set_iv +#define cipher_set_padding_mode mbedtls_cipher_set_padding_mode +#define cipher_setkey mbedtls_cipher_setkey +#define cipher_type_t mbedtls_cipher_type_t +#define cipher_update mbedtls_cipher_update +#define cipher_update_ad mbedtls_cipher_update_ad +#define cipher_write_tag mbedtls_cipher_write_tag +#define ctr_drbg_context mbedtls_ctr_drbg_context +#define ctr_drbg_free mbedtls_ctr_drbg_free +#define ctr_drbg_init mbedtls_ctr_drbg_init +#define ctr_drbg_random mbedtls_ctr_drbg_random +#define ctr_drbg_random_with_add mbedtls_ctr_drbg_random_with_add +#define ctr_drbg_reseed mbedtls_ctr_drbg_reseed +#define ctr_drbg_self_test mbedtls_ctr_drbg_self_test +#define ctr_drbg_set_entropy_len mbedtls_ctr_drbg_set_entropy_len +#define ctr_drbg_set_prediction_resistance mbedtls_ctr_drbg_set_prediction_resistance +#define ctr_drbg_set_reseed_interval mbedtls_ctr_drbg_set_reseed_interval +#define ctr_drbg_update mbedtls_ctr_drbg_update +#define ctr_drbg_update_seed_file mbedtls_ctr_drbg_update_seed_file +#define ctr_drbg_write_seed_file mbedtls_ctr_drbg_write_seed_file +#define debug_print_buf mbedtls_debug_print_buf +#define debug_print_crt mbedtls_debug_print_crt +#define debug_print_ecp mbedtls_debug_print_ecp +#define debug_print_mpi mbedtls_debug_print_mpi +#define debug_print_msg mbedtls_debug_print_msg +#define debug_print_ret mbedtls_debug_print_ret +#define debug_set_threshold mbedtls_debug_set_threshold +#define des3_context mbedtls_des3_context +#define des3_crypt_cbc mbedtls_des3_crypt_cbc +#define des3_crypt_ecb mbedtls_des3_crypt_ecb +#define des3_free mbedtls_des3_free +#define des3_init mbedtls_des3_init +#define des3_set2key_dec mbedtls_des3_set2key_dec +#define des3_set2key_enc mbedtls_des3_set2key_enc +#define des3_set3key_dec mbedtls_des3_set3key_dec +#define des3_set3key_enc mbedtls_des3_set3key_enc +#define des_context mbedtls_des_context +#define des_crypt_cbc mbedtls_des_crypt_cbc +#define des_crypt_ecb mbedtls_des_crypt_ecb +#define des_free mbedtls_des_free +#define des_init mbedtls_des_init +#define des_key_check_key_parity mbedtls_des_key_check_key_parity +#define des_key_check_weak mbedtls_des_key_check_weak +#define des_key_set_parity mbedtls_des_key_set_parity +#define des_self_test mbedtls_des_self_test +#define des_setkey_dec mbedtls_des_setkey_dec +#define des_setkey_enc mbedtls_des_setkey_enc +#define dhm_calc_secret mbedtls_dhm_calc_secret +#define dhm_context mbedtls_dhm_context +#define dhm_free mbedtls_dhm_free +#define dhm_init mbedtls_dhm_init +#define dhm_make_params mbedtls_dhm_make_params +#define dhm_make_public mbedtls_dhm_make_public +#define dhm_parse_dhm mbedtls_dhm_parse_dhm +#define dhm_parse_dhmfile mbedtls_dhm_parse_dhmfile +#define dhm_read_params mbedtls_dhm_read_params +#define dhm_read_public mbedtls_dhm_read_public +#define dhm_self_test mbedtls_dhm_self_test +#define ecdh_calc_secret mbedtls_ecdh_calc_secret +#define ecdh_compute_shared mbedtls_ecdh_compute_shared +#define ecdh_context mbedtls_ecdh_context +#define ecdh_free mbedtls_ecdh_free +#define ecdh_gen_public mbedtls_ecdh_gen_public +#define ecdh_get_params mbedtls_ecdh_get_params +#define ecdh_init mbedtls_ecdh_init +#define ecdh_make_params mbedtls_ecdh_make_params +#define ecdh_make_public mbedtls_ecdh_make_public +#define ecdh_read_params mbedtls_ecdh_read_params +#define ecdh_read_public mbedtls_ecdh_read_public +#define ecdh_side mbedtls_ecdh_side +#define ecdsa_context mbedtls_ecdsa_context +#define ecdsa_free mbedtls_ecdsa_free +#define ecdsa_from_keypair mbedtls_ecdsa_from_keypair +#define ecdsa_genkey mbedtls_ecdsa_genkey +#define ecdsa_info mbedtls_ecdsa_info +#define ecdsa_init mbedtls_ecdsa_init +#define ecdsa_read_signature mbedtls_ecdsa_read_signature +#define ecdsa_sign mbedtls_ecdsa_sign +#define ecdsa_sign_det mbedtls_ecdsa_sign_det +#define ecdsa_verify mbedtls_ecdsa_verify +#define ecdsa_write_signature mbedtls_ecdsa_write_signature +#define ecdsa_write_signature_det mbedtls_ecdsa_write_signature_det +#define eckey_info mbedtls_eckey_info +#define eckeydh_info mbedtls_eckeydh_info +#define ecp_check_privkey mbedtls_ecp_check_privkey +#define ecp_check_pub_priv mbedtls_ecp_check_pub_priv +#define ecp_check_pubkey mbedtls_ecp_check_pubkey +#define ecp_copy mbedtls_ecp_copy +#define ecp_curve_info mbedtls_ecp_curve_info +#define ecp_curve_info_from_grp_id mbedtls_ecp_curve_info_from_grp_id +#define ecp_curve_info_from_name mbedtls_ecp_curve_info_from_name +#define ecp_curve_info_from_tls_id mbedtls_ecp_curve_info_from_tls_id +#define ecp_curve_list mbedtls_ecp_curve_list +#define ecp_gen_key mbedtls_ecp_gen_key +#define ecp_gen_keypair mbedtls_ecp_gen_keypair +#define ecp_group mbedtls_ecp_group +#define ecp_group_copy mbedtls_ecp_group_copy +#define ecp_group_free mbedtls_ecp_group_free +#define ecp_group_id mbedtls_ecp_group_id +#define ecp_group_init mbedtls_ecp_group_init +#define ecp_grp_id_list mbedtls_ecp_grp_id_list +#define ecp_is_zero mbedtls_ecp_is_zero +#define ecp_keypair mbedtls_ecp_keypair +#define ecp_keypair_free mbedtls_ecp_keypair_free +#define ecp_keypair_init mbedtls_ecp_keypair_init +#define ecp_mul mbedtls_ecp_mul +#define ecp_point mbedtls_ecp_point +#define ecp_point_free mbedtls_ecp_point_free +#define ecp_point_init mbedtls_ecp_point_init +#define ecp_point_read_binary mbedtls_ecp_point_read_binary +#define ecp_point_read_string mbedtls_ecp_point_read_string +#define ecp_point_write_binary mbedtls_ecp_point_write_binary +#define ecp_self_test mbedtls_ecp_self_test +#define ecp_set_zero mbedtls_ecp_set_zero +#define ecp_tls_read_group mbedtls_ecp_tls_read_group +#define ecp_tls_read_point mbedtls_ecp_tls_read_point +#define ecp_tls_write_group mbedtls_ecp_tls_write_group +#define ecp_tls_write_point mbedtls_ecp_tls_write_point +#define ecp_use_known_dp mbedtls_ecp_group_load +#define entropy_add_source mbedtls_entropy_add_source +#define entropy_context mbedtls_entropy_context +#define entropy_free mbedtls_entropy_free +#define entropy_func mbedtls_entropy_func +#define entropy_gather mbedtls_entropy_gather +#define entropy_init mbedtls_entropy_init +#define entropy_self_test mbedtls_entropy_self_test +#define entropy_update_manual mbedtls_entropy_update_manual +#define entropy_update_seed_file mbedtls_entropy_update_seed_file +#define entropy_write_seed_file mbedtls_entropy_write_seed_file +#define error_strerror mbedtls_strerror +#define f_source_ptr mbedtls_entropy_f_source_ptr +#define gcm_auth_decrypt mbedtls_gcm_auth_decrypt +#define gcm_context mbedtls_gcm_context +#define gcm_crypt_and_tag mbedtls_gcm_crypt_and_tag +#define gcm_finish mbedtls_gcm_finish +#define gcm_free mbedtls_gcm_free +#define gcm_init mbedtls_gcm_init +#define gcm_self_test mbedtls_gcm_self_test +#define gcm_starts mbedtls_gcm_starts +#define gcm_update mbedtls_gcm_update +#define get_timer mbedtls_timing_get_timer +#define hardclock mbedtls_timing_hardclock +#define hardclock_poll mbedtls_hardclock_poll +#define havege_free mbedtls_havege_free +#define havege_init mbedtls_havege_init +#define havege_poll mbedtls_havege_poll +#define havege_random mbedtls_havege_random +#define havege_state mbedtls_havege_state +#define hmac_drbg_context mbedtls_hmac_drbg_context +#define hmac_drbg_free mbedtls_hmac_drbg_free +#define hmac_drbg_init mbedtls_hmac_drbg_init +#define hmac_drbg_random mbedtls_hmac_drbg_random +#define hmac_drbg_random_with_add mbedtls_hmac_drbg_random_with_add +#define hmac_drbg_reseed mbedtls_hmac_drbg_reseed +#define hmac_drbg_self_test mbedtls_hmac_drbg_self_test +#define hmac_drbg_set_entropy_len mbedtls_hmac_drbg_set_entropy_len +#define hmac_drbg_set_prediction_resistance mbedtls_hmac_drbg_set_prediction_resistance +#define hmac_drbg_set_reseed_interval mbedtls_hmac_drbg_set_reseed_interval +#define hmac_drbg_update mbedtls_hmac_drbg_update +#define hmac_drbg_update_seed_file mbedtls_hmac_drbg_update_seed_file +#define hmac_drbg_write_seed_file mbedtls_hmac_drbg_write_seed_file +#define hr_time mbedtls_timing_hr_time +#define key_exchange_type_t mbedtls_key_exchange_type_t +#define md mbedtls_md +#define md2 mbedtls_md2 +#define md2_context mbedtls_md2_context +#define md2_finish mbedtls_md2_finish +#define md2_free mbedtls_md2_free +#define md2_info mbedtls_md2_info +#define md2_init mbedtls_md2_init +#define md2_process mbedtls_md2_process +#define md2_self_test mbedtls_md2_self_test +#define md2_starts mbedtls_md2_starts +#define md2_update mbedtls_md2_update +#define md4 mbedtls_md4 +#define md4_context mbedtls_md4_context +#define md4_finish mbedtls_md4_finish +#define md4_free mbedtls_md4_free +#define md4_info mbedtls_md4_info +#define md4_init mbedtls_md4_init +#define md4_process mbedtls_md4_process +#define md4_self_test mbedtls_md4_self_test +#define md4_starts mbedtls_md4_starts +#define md4_update mbedtls_md4_update +#define md5 mbedtls_md5 +#define md5_context mbedtls_md5_context +#define md5_finish mbedtls_md5_finish +#define md5_free mbedtls_md5_free +#define md5_info mbedtls_md5_info +#define md5_init mbedtls_md5_init +#define md5_process mbedtls_md5_process +#define md5_self_test mbedtls_md5_self_test +#define md5_starts mbedtls_md5_starts +#define md5_update mbedtls_md5_update +#define md_context_t mbedtls_md_context_t +#define md_file mbedtls_md_file +#define md_finish mbedtls_md_finish +#define md_free mbedtls_md_free +#define md_get_name mbedtls_md_get_name +#define md_get_size mbedtls_md_get_size +#define md_get_type mbedtls_md_get_type +#define md_hmac mbedtls_md_hmac +#define md_hmac_finish mbedtls_md_hmac_finish +#define md_hmac_reset mbedtls_md_hmac_reset +#define md_hmac_starts mbedtls_md_hmac_starts +#define md_hmac_update mbedtls_md_hmac_update +#define md_info_from_string mbedtls_md_info_from_string +#define md_info_from_type mbedtls_md_info_from_type +#define md_info_t mbedtls_md_info_t +#define md_init mbedtls_md_init +#define md_init_ctx mbedtls_md_init_ctx +#define md_list mbedtls_md_list +#define md_process mbedtls_md_process +#define md_starts mbedtls_md_starts +#define md_type_t mbedtls_md_type_t +#define md_update mbedtls_md_update +#define memory_buffer_alloc_cur_get mbedtls_memory_buffer_alloc_cur_get +#define memory_buffer_alloc_free mbedtls_memory_buffer_alloc_free +#define memory_buffer_alloc_init mbedtls_memory_buffer_alloc_init +#define memory_buffer_alloc_max_get mbedtls_memory_buffer_alloc_max_get +#define memory_buffer_alloc_max_reset mbedtls_memory_buffer_alloc_max_reset +#define memory_buffer_alloc_self_test mbedtls_memory_buffer_alloc_self_test +#define memory_buffer_alloc_status mbedtls_memory_buffer_alloc_status +#define memory_buffer_alloc_verify mbedtls_memory_buffer_alloc_verify +#define memory_buffer_set_verify mbedtls_memory_buffer_set_verify +#define mpi mbedtls_mpi +#define mpi_add_abs mbedtls_mpi_add_abs +#define mpi_add_int mbedtls_mpi_add_int +#define mpi_add_mpi mbedtls_mpi_add_mpi +#define mpi_cmp_abs mbedtls_mpi_cmp_abs +#define mpi_cmp_int mbedtls_mpi_cmp_int +#define mpi_cmp_mpi mbedtls_mpi_cmp_mpi +#define mpi_copy mbedtls_mpi_copy +#define mpi_div_int mbedtls_mpi_div_int +#define mpi_div_mpi mbedtls_mpi_div_mpi +#define mpi_exp_mod mbedtls_mpi_exp_mod +#define mpi_fill_random mbedtls_mpi_fill_random +#define mpi_free mbedtls_mpi_free +#define mpi_gcd mbedtls_mpi_gcd +#define mpi_gen_prime mbedtls_mpi_gen_prime +#define mpi_get_bit mbedtls_mpi_get_bit +#define mpi_grow mbedtls_mpi_grow +#define mpi_init mbedtls_mpi_init +#define mpi_inv_mod mbedtls_mpi_inv_mod +#define mpi_is_prime mbedtls_mpi_is_prime +#define mpi_lsb mbedtls_mpi_lsb +#define mpi_lset mbedtls_mpi_lset +#define mpi_mod_int mbedtls_mpi_mod_int +#define mpi_mod_mpi mbedtls_mpi_mod_mpi +#define mpi_msb mbedtls_mpi_bitlen +#define mpi_mul_int mbedtls_mpi_mul_int +#define mpi_mul_mpi mbedtls_mpi_mul_mpi +#define mpi_read_binary mbedtls_mpi_read_binary +#define mpi_read_file mbedtls_mpi_read_file +#define mpi_read_string mbedtls_mpi_read_string +#define mpi_safe_cond_assign mbedtls_mpi_safe_cond_assign +#define mpi_safe_cond_swap mbedtls_mpi_safe_cond_swap +#define mpi_self_test mbedtls_mpi_self_test +#define mpi_set_bit mbedtls_mpi_set_bit +#define mpi_shift_l mbedtls_mpi_shift_l +#define mpi_shift_r mbedtls_mpi_shift_r +#define mpi_shrink mbedtls_mpi_shrink +#define mpi_size mbedtls_mpi_size +#define mpi_sub_abs mbedtls_mpi_sub_abs +#define mpi_sub_int mbedtls_mpi_sub_int +#define mpi_sub_mpi mbedtls_mpi_sub_mpi +#define mpi_swap mbedtls_mpi_swap +#define mpi_write_binary mbedtls_mpi_write_binary +#define mpi_write_file mbedtls_mpi_write_file +#define mpi_write_string mbedtls_mpi_write_string +#define net_accept mbedtls_net_accept +#define net_bind mbedtls_net_bind +#define net_close mbedtls_net_free +#define net_connect mbedtls_net_connect +#define net_recv mbedtls_net_recv +#define net_recv_timeout mbedtls_net_recv_timeout +#define net_send mbedtls_net_send +#define net_set_block mbedtls_net_set_block +#define net_set_nonblock mbedtls_net_set_nonblock +#define net_usleep mbedtls_net_usleep +#define oid_descriptor_t mbedtls_oid_descriptor_t +#define oid_get_attr_short_name mbedtls_oid_get_attr_short_name +#define oid_get_cipher_alg mbedtls_oid_get_cipher_alg +#define oid_get_ec_grp mbedtls_oid_get_ec_grp +#define oid_get_extended_key_usage mbedtls_oid_get_extended_key_usage +#define oid_get_md_alg mbedtls_oid_get_md_alg +#define oid_get_numeric_string mbedtls_oid_get_numeric_string +#define oid_get_oid_by_ec_grp mbedtls_oid_get_oid_by_ec_grp +#define oid_get_oid_by_md mbedtls_oid_get_oid_by_md +#define oid_get_oid_by_pk_alg mbedtls_oid_get_oid_by_pk_alg +#define oid_get_oid_by_sig_alg mbedtls_oid_get_oid_by_sig_alg +#define oid_get_pk_alg mbedtls_oid_get_pk_alg +#define oid_get_pkcs12_pbe_alg mbedtls_oid_get_pkcs12_pbe_alg +#define oid_get_sig_alg mbedtls_oid_get_sig_alg +#define oid_get_sig_alg_desc mbedtls_oid_get_sig_alg_desc +#define oid_get_x509_ext_type mbedtls_oid_get_x509_ext_type +#define operation_t mbedtls_operation_t +#define padlock_supports mbedtls_padlock_has_support +#define padlock_xcryptcbc mbedtls_padlock_xcryptcbc +#define padlock_xcryptecb mbedtls_padlock_xcryptecb +#define pem_context mbedtls_pem_context +#define pem_free mbedtls_pem_free +#define pem_init mbedtls_pem_init +#define pem_read_buffer mbedtls_pem_read_buffer +#define pem_write_buffer mbedtls_pem_write_buffer +#define pk_can_do mbedtls_pk_can_do +#define pk_check_pair mbedtls_pk_check_pair +#define pk_context mbedtls_pk_context +#define pk_debug mbedtls_pk_debug +#define pk_debug_item mbedtls_pk_debug_item +#define pk_debug_type mbedtls_pk_debug_type +#define pk_decrypt mbedtls_pk_decrypt +#define pk_ec mbedtls_pk_ec +#define pk_encrypt mbedtls_pk_encrypt +#define pk_free mbedtls_pk_free +#define pk_get_len mbedtls_pk_get_len +#define pk_get_name mbedtls_pk_get_name +#define pk_get_size mbedtls_pk_get_bitlen +#define pk_get_type mbedtls_pk_get_type +#define pk_info_from_type mbedtls_pk_info_from_type +#define pk_info_t mbedtls_pk_info_t +#define pk_init mbedtls_pk_init +#define pk_init_ctx mbedtls_pk_setup +#define pk_init_ctx_rsa_alt mbedtls_pk_setup_rsa_alt +#define pk_load_file mbedtls_pk_load_file +#define pk_parse_key mbedtls_pk_parse_key +#define pk_parse_keyfile mbedtls_pk_parse_keyfile +#define pk_parse_public_key mbedtls_pk_parse_public_key +#define pk_parse_public_keyfile mbedtls_pk_parse_public_keyfile +#define pk_parse_subpubkey mbedtls_pk_parse_subpubkey +#define pk_rsa mbedtls_pk_rsa +#define pk_rsa_alt_decrypt_func mbedtls_pk_rsa_alt_decrypt_func +#define pk_rsa_alt_key_len_func mbedtls_pk_rsa_alt_key_len_func +#define pk_rsa_alt_sign_func mbedtls_pk_rsa_alt_sign_func +#define pk_rsassa_pss_options mbedtls_pk_rsassa_pss_options +#define pk_sign mbedtls_pk_sign +#define pk_type_t mbedtls_pk_type_t +#define pk_verify mbedtls_pk_verify +#define pk_verify_ext mbedtls_pk_verify_ext +#define pk_write_key_der mbedtls_pk_write_key_der +#define pk_write_key_pem mbedtls_pk_write_key_pem +#define pk_write_pubkey mbedtls_pk_write_pubkey +#define pk_write_pubkey_der mbedtls_pk_write_pubkey_der +#define pk_write_pubkey_pem mbedtls_pk_write_pubkey_pem +#define pkcs11_context mbedtls_pkcs11_context +#define pkcs11_decrypt mbedtls_pkcs11_decrypt +#define pkcs11_priv_key_free mbedtls_pkcs11_priv_key_free +#define pkcs11_priv_key_init mbedtls_pkcs11_priv_key_bind +#define pkcs11_sign mbedtls_pkcs11_sign +#define pkcs11_x509_cert_init mbedtls_pkcs11_x509_cert_bind +#define pkcs12_derivation mbedtls_pkcs12_derivation +#define pkcs12_pbe mbedtls_pkcs12_pbe +#define pkcs12_pbe_sha1_rc4_128 mbedtls_pkcs12_pbe_sha1_rc4_128 +#define pkcs5_pbes2 mbedtls_pkcs5_pbes2 +#define pkcs5_pbkdf2_hmac mbedtls_pkcs5_pbkdf2_hmac +#define pkcs5_self_test mbedtls_pkcs5_self_test +#define platform_entropy_poll mbedtls_platform_entropy_poll +#define platform_set_exit mbedtls_platform_set_exit +#define platform_set_fprintf mbedtls_platform_set_fprintf +#define platform_set_printf mbedtls_platform_set_printf +#define platform_set_snprintf mbedtls_platform_set_snprintf +#define polarssl_exit mbedtls_exit +#define polarssl_fprintf mbedtls_fprintf +#define polarssl_free mbedtls_free +#define polarssl_mutex_free mbedtls_mutex_free +#define polarssl_mutex_init mbedtls_mutex_init +#define polarssl_mutex_lock mbedtls_mutex_lock +#define polarssl_mutex_unlock mbedtls_mutex_unlock +#define polarssl_printf mbedtls_printf +#define polarssl_snprintf mbedtls_snprintf +#define polarssl_strerror mbedtls_strerror +#define ripemd160 mbedtls_ripemd160 +#define ripemd160_context mbedtls_ripemd160_context +#define ripemd160_finish mbedtls_ripemd160_finish +#define ripemd160_free mbedtls_ripemd160_free +#define ripemd160_info mbedtls_ripemd160_info +#define ripemd160_init mbedtls_ripemd160_init +#define ripemd160_process mbedtls_ripemd160_process +#define ripemd160_self_test mbedtls_ripemd160_self_test +#define ripemd160_starts mbedtls_ripemd160_starts +#define ripemd160_update mbedtls_ripemd160_update +#define rsa_alt_context mbedtls_rsa_alt_context +#define rsa_alt_info mbedtls_rsa_alt_info +#define rsa_check_privkey mbedtls_rsa_check_privkey +#define rsa_check_pub_priv mbedtls_rsa_check_pub_priv +#define rsa_check_pubkey mbedtls_rsa_check_pubkey +#define rsa_context mbedtls_rsa_context +#define rsa_copy mbedtls_rsa_copy +#define rsa_free mbedtls_rsa_free +#define rsa_gen_key mbedtls_rsa_gen_key +#define rsa_info mbedtls_rsa_info +#define rsa_init mbedtls_rsa_init +#define rsa_pkcs1_decrypt mbedtls_rsa_pkcs1_decrypt +#define rsa_pkcs1_encrypt mbedtls_rsa_pkcs1_encrypt +#define rsa_pkcs1_sign mbedtls_rsa_pkcs1_sign +#define rsa_pkcs1_verify mbedtls_rsa_pkcs1_verify +#define rsa_private mbedtls_rsa_private +#define rsa_public mbedtls_rsa_public +#define rsa_rsaes_oaep_decrypt mbedtls_rsa_rsaes_oaep_decrypt +#define rsa_rsaes_oaep_encrypt mbedtls_rsa_rsaes_oaep_encrypt +#define rsa_rsaes_pkcs1_v15_decrypt mbedtls_rsa_rsaes_pkcs1_v15_decrypt +#define rsa_rsaes_pkcs1_v15_encrypt mbedtls_rsa_rsaes_pkcs1_v15_encrypt +#define rsa_rsassa_pkcs1_v15_sign mbedtls_rsa_rsassa_pkcs1_v15_sign +#define rsa_rsassa_pkcs1_v15_verify mbedtls_rsa_rsassa_pkcs1_v15_verify +#define rsa_rsassa_pss_sign mbedtls_rsa_rsassa_pss_sign +#define rsa_rsassa_pss_verify mbedtls_rsa_rsassa_pss_verify +#define rsa_rsassa_pss_verify_ext mbedtls_rsa_rsassa_pss_verify_ext +#define rsa_self_test mbedtls_rsa_self_test +#define rsa_set_padding mbedtls_rsa_set_padding +#define safer_memcmp mbedtls_ssl_safer_memcmp +#define set_alarm mbedtls_set_alarm +#define sha1 mbedtls_sha1 +#define sha1_context mbedtls_sha1_context +#define sha1_finish mbedtls_sha1_finish +#define sha1_free mbedtls_sha1_free +#define sha1_info mbedtls_sha1_info +#define sha1_init mbedtls_sha1_init +#define sha1_process mbedtls_sha1_process +#define sha1_self_test mbedtls_sha1_self_test +#define sha1_starts mbedtls_sha1_starts +#define sha1_update mbedtls_sha1_update +#define sha224_info mbedtls_sha224_info +#define sha256 mbedtls_sha256 +#define sha256_context mbedtls_sha256_context +#define sha256_finish mbedtls_sha256_finish +#define sha256_free mbedtls_sha256_free +#define sha256_info mbedtls_sha256_info +#define sha256_init mbedtls_sha256_init +#define sha256_process mbedtls_sha256_process +#define sha256_self_test mbedtls_sha256_self_test +#define sha256_starts mbedtls_sha256_starts +#define sha256_update mbedtls_sha256_update +#define sha384_info mbedtls_sha384_info +#define sha512 mbedtls_sha512 +#define sha512_context mbedtls_sha512_context +#define sha512_finish mbedtls_sha512_finish +#define sha512_free mbedtls_sha512_free +#define sha512_info mbedtls_sha512_info +#define sha512_init mbedtls_sha512_init +#define sha512_process mbedtls_sha512_process +#define sha512_self_test mbedtls_sha512_self_test +#define sha512_starts mbedtls_sha512_starts +#define sha512_update mbedtls_sha512_update +#define source_state mbedtls_entropy_source_state +#define ssl_cache_context mbedtls_ssl_cache_context +#define ssl_cache_entry mbedtls_ssl_cache_entry +#define ssl_cache_free mbedtls_ssl_cache_free +#define ssl_cache_get mbedtls_ssl_cache_get +#define ssl_cache_init mbedtls_ssl_cache_init +#define ssl_cache_set mbedtls_ssl_cache_set +#define ssl_cache_set_max_entries mbedtls_ssl_cache_set_max_entries +#define ssl_cache_set_timeout mbedtls_ssl_cache_set_timeout +#define ssl_check_cert_usage mbedtls_ssl_check_cert_usage +#define ssl_ciphersuite_from_id mbedtls_ssl_ciphersuite_from_id +#define ssl_ciphersuite_from_string mbedtls_ssl_ciphersuite_from_string +#define ssl_ciphersuite_t mbedtls_ssl_ciphersuite_t +#define ssl_ciphersuite_uses_ec mbedtls_ssl_ciphersuite_uses_ec +#define ssl_ciphersuite_uses_psk mbedtls_ssl_ciphersuite_uses_psk +#define ssl_close_notify mbedtls_ssl_close_notify +#define ssl_context mbedtls_ssl_context +#define ssl_cookie_check mbedtls_ssl_cookie_check +#define ssl_cookie_check_t mbedtls_ssl_cookie_check_t +#define ssl_cookie_ctx mbedtls_ssl_cookie_ctx +#define ssl_cookie_free mbedtls_ssl_cookie_free +#define ssl_cookie_init mbedtls_ssl_cookie_init +#define ssl_cookie_set_timeout mbedtls_ssl_cookie_set_timeout +#define ssl_cookie_setup mbedtls_ssl_cookie_setup +#define ssl_cookie_write mbedtls_ssl_cookie_write +#define ssl_cookie_write_t mbedtls_ssl_cookie_write_t +#define ssl_derive_keys mbedtls_ssl_derive_keys +#define ssl_dtls_replay_check mbedtls_ssl_dtls_replay_check +#define ssl_dtls_replay_update mbedtls_ssl_dtls_replay_update +#define ssl_fetch_input mbedtls_ssl_fetch_input +#define ssl_flight_item mbedtls_ssl_flight_item +#define ssl_flush_output mbedtls_ssl_flush_output +#define ssl_free mbedtls_ssl_free +#define ssl_get_alpn_protocol mbedtls_ssl_get_alpn_protocol +#define ssl_get_bytes_avail mbedtls_ssl_get_bytes_avail +#define ssl_get_ciphersuite mbedtls_ssl_get_ciphersuite +#define ssl_get_ciphersuite_id mbedtls_ssl_get_ciphersuite_id +#define ssl_get_ciphersuite_name mbedtls_ssl_get_ciphersuite_name +#define ssl_get_ciphersuite_sig_pk_alg mbedtls_ssl_get_ciphersuite_sig_pk_alg +#define ssl_get_peer_cert mbedtls_ssl_get_peer_cert +#define ssl_get_record_expansion mbedtls_ssl_get_record_expansion +#define ssl_get_session mbedtls_ssl_get_session +#define ssl_get_verify_result mbedtls_ssl_get_verify_result +#define ssl_get_version mbedtls_ssl_get_version +#define ssl_handshake mbedtls_ssl_handshake +#define ssl_handshake_client_step mbedtls_ssl_handshake_client_step +#define ssl_handshake_free mbedtls_ssl_handshake_free +#define ssl_handshake_params mbedtls_ssl_handshake_params +#define ssl_handshake_server_step mbedtls_ssl_handshake_server_step +#define ssl_handshake_step mbedtls_ssl_handshake_step +#define ssl_handshake_wrapup mbedtls_ssl_handshake_wrapup +#define ssl_hdr_len mbedtls_ssl_hdr_len +#define ssl_hs_hdr_len mbedtls_ssl_hs_hdr_len +#define ssl_hw_record_activate mbedtls_ssl_hw_record_activate +#define ssl_hw_record_finish mbedtls_ssl_hw_record_finish +#define ssl_hw_record_init mbedtls_ssl_hw_record_init +#define ssl_hw_record_read mbedtls_ssl_hw_record_read +#define ssl_hw_record_reset mbedtls_ssl_hw_record_reset +#define ssl_hw_record_write mbedtls_ssl_hw_record_write +#define ssl_init mbedtls_ssl_init +#define ssl_key_cert mbedtls_ssl_key_cert +#define ssl_legacy_renegotiation mbedtls_ssl_conf_legacy_renegotiation +#define ssl_list_ciphersuites mbedtls_ssl_list_ciphersuites +#define ssl_md_alg_from_hash mbedtls_ssl_md_alg_from_hash +#define ssl_optimize_checksum mbedtls_ssl_optimize_checksum +#define ssl_own_cert mbedtls_ssl_own_cert +#define ssl_own_key mbedtls_ssl_own_key +#define ssl_parse_certificate mbedtls_ssl_parse_certificate +#define ssl_parse_change_cipher_spec mbedtls_ssl_parse_change_cipher_spec +#define ssl_parse_finished mbedtls_ssl_parse_finished +#define ssl_pk_alg_from_sig mbedtls_ssl_pk_alg_from_sig +#define ssl_pkcs11_decrypt mbedtls_ssl_pkcs11_decrypt +#define ssl_pkcs11_key_len mbedtls_ssl_pkcs11_key_len +#define ssl_pkcs11_sign mbedtls_ssl_pkcs11_sign +#define ssl_psk_derive_premaster mbedtls_ssl_psk_derive_premaster +#define ssl_read mbedtls_ssl_read +#define ssl_read_record mbedtls_ssl_read_record +#define ssl_read_version mbedtls_ssl_read_version +#define ssl_recv_flight_completed mbedtls_ssl_recv_flight_completed +#define ssl_renegotiate mbedtls_ssl_renegotiate +#define ssl_resend mbedtls_ssl_resend +#define ssl_reset_checksum mbedtls_ssl_reset_checksum +#define ssl_send_alert_message mbedtls_ssl_send_alert_message +#define ssl_send_fatal_handshake_failure mbedtls_ssl_send_fatal_handshake_failure +#define ssl_send_flight_completed mbedtls_ssl_send_flight_completed +#define ssl_session mbedtls_ssl_session +#define ssl_session_free mbedtls_ssl_session_free +#define ssl_session_init mbedtls_ssl_session_init +#define ssl_session_reset mbedtls_ssl_session_reset +#define ssl_set_alpn_protocols mbedtls_ssl_conf_alpn_protocols +#define ssl_set_arc4_support mbedtls_ssl_conf_arc4_support +#define ssl_set_authmode mbedtls_ssl_conf_authmode +#define ssl_set_bio mbedtls_ssl_set_bio +#define ssl_set_ca_chain mbedtls_ssl_conf_ca_chain +#define ssl_set_cbc_record_splitting mbedtls_ssl_conf_cbc_record_splitting +#define ssl_set_ciphersuites mbedtls_ssl_conf_ciphersuites +#define ssl_set_ciphersuites_for_version mbedtls_ssl_conf_ciphersuites_for_version +#define ssl_set_client_transport_id mbedtls_ssl_set_client_transport_id +#define ssl_set_curves mbedtls_ssl_conf_curves +#define ssl_set_dbg mbedtls_ssl_conf_dbg +#define ssl_set_dh_param mbedtls_ssl_conf_dh_param +#define ssl_set_dh_param_ctx mbedtls_ssl_conf_dh_param_ctx +#define ssl_set_dtls_anti_replay mbedtls_ssl_conf_dtls_anti_replay +#define ssl_set_dtls_badmac_limit mbedtls_ssl_conf_dtls_badmac_limit +#define ssl_set_dtls_cookies mbedtls_ssl_conf_dtls_cookies +#define ssl_set_encrypt_then_mac mbedtls_ssl_conf_encrypt_then_mac +#define ssl_set_endpoint mbedtls_ssl_conf_endpoint +#define ssl_set_extended_master_secret mbedtls_ssl_conf_extended_master_secret +#define ssl_set_fallback mbedtls_ssl_conf_fallback +#define ssl_set_handshake_timeout mbedtls_ssl_conf_handshake_timeout +#define ssl_set_hostname mbedtls_ssl_set_hostname +#define ssl_set_max_frag_len mbedtls_ssl_conf_max_frag_len +#define ssl_set_max_version mbedtls_ssl_conf_max_version +#define ssl_set_min_version mbedtls_ssl_conf_min_version +#define ssl_set_own_cert mbedtls_ssl_conf_own_cert +#define ssl_set_psk mbedtls_ssl_conf_psk +#define ssl_set_psk_cb mbedtls_ssl_conf_psk_cb +#define ssl_set_renegotiation mbedtls_ssl_conf_renegotiation +#define ssl_set_renegotiation_enforced mbedtls_ssl_conf_renegotiation_enforced +#define ssl_set_renegotiation_period mbedtls_ssl_conf_renegotiation_period +#define ssl_set_rng mbedtls_ssl_conf_rng +#define ssl_set_session mbedtls_ssl_set_session +#define ssl_set_session_cache mbedtls_ssl_conf_session_cache +#define ssl_set_session_tickets mbedtls_ssl_conf_session_tickets +#define ssl_set_sni mbedtls_ssl_conf_sni +#define ssl_set_transport mbedtls_ssl_conf_transport +#define ssl_set_truncated_hmac mbedtls_ssl_conf_truncated_hmac +#define ssl_set_verify mbedtls_ssl_conf_verify +#define ssl_sig_from_pk mbedtls_ssl_sig_from_pk +#define ssl_states mbedtls_ssl_states +#define ssl_transform mbedtls_ssl_transform +#define ssl_transform_free mbedtls_ssl_transform_free +#define ssl_write mbedtls_ssl_write +#define ssl_write_certificate mbedtls_ssl_write_certificate +#define ssl_write_change_cipher_spec mbedtls_ssl_write_change_cipher_spec +#define ssl_write_finished mbedtls_ssl_write_finished +#define ssl_write_record mbedtls_ssl_write_record +#define ssl_write_version mbedtls_ssl_write_version +#define supported_ciphers mbedtls_cipher_supported +#define t_sint mbedtls_mpi_sint +#define t_udbl mbedtls_t_udbl +#define t_uint mbedtls_mpi_uint +#define test_ca_crt mbedtls_test_ca_crt +#define test_ca_crt_ec mbedtls_test_ca_crt_ec +#define test_ca_crt_rsa mbedtls_test_ca_crt_rsa +#define test_ca_key mbedtls_test_ca_key +#define test_ca_key_ec mbedtls_test_ca_key_ec +#define test_ca_key_rsa mbedtls_test_ca_key_rsa +#define test_ca_list mbedtls_test_cas_pem +#define test_ca_pwd mbedtls_test_ca_pwd +#define test_ca_pwd_ec mbedtls_test_ca_pwd_ec +#define test_ca_pwd_rsa mbedtls_test_ca_pwd_rsa +#define test_cli_crt mbedtls_test_cli_crt +#define test_cli_crt_ec mbedtls_test_cli_crt_ec +#define test_cli_crt_rsa mbedtls_test_cli_crt_rsa +#define test_cli_key mbedtls_test_cli_key +#define test_cli_key_ec mbedtls_test_cli_key_ec +#define test_cli_key_rsa mbedtls_test_cli_key_rsa +#define test_srv_crt mbedtls_test_srv_crt +#define test_srv_crt_ec mbedtls_test_srv_crt_ec +#define test_srv_crt_rsa mbedtls_test_srv_crt_rsa +#define test_srv_key mbedtls_test_srv_key +#define test_srv_key_ec mbedtls_test_srv_key_ec +#define test_srv_key_rsa mbedtls_test_srv_key_rsa +#define threading_mutex_t mbedtls_threading_mutex_t +#define threading_set_alt mbedtls_threading_set_alt +#define timing_self_test mbedtls_timing_self_test +#define version_check_feature mbedtls_version_check_feature +#define version_get_number mbedtls_version_get_number +#define version_get_string mbedtls_version_get_string +#define version_get_string_full mbedtls_version_get_string_full +#define x509_bitstring mbedtls_x509_bitstring +#define x509_buf mbedtls_x509_buf +#define x509_crl mbedtls_x509_crl +#define x509_crl_entry mbedtls_x509_crl_entry +#define x509_crl_free mbedtls_x509_crl_free +#define x509_crl_info mbedtls_x509_crl_info +#define x509_crl_init mbedtls_x509_crl_init +#define x509_crl_parse mbedtls_x509_crl_parse +#define x509_crl_parse_der mbedtls_x509_crl_parse_der +#define x509_crl_parse_file mbedtls_x509_crl_parse_file +#define x509_crt mbedtls_x509_crt +#define x509_crt_check_extended_key_usage mbedtls_x509_crt_check_extended_key_usage +#define x509_crt_check_key_usage mbedtls_x509_crt_check_key_usage +#define x509_crt_free mbedtls_x509_crt_free +#define x509_crt_info mbedtls_x509_crt_info +#define x509_crt_init mbedtls_x509_crt_init +#define x509_crt_parse mbedtls_x509_crt_parse +#define x509_crt_parse_der mbedtls_x509_crt_parse_der +#define x509_crt_parse_file mbedtls_x509_crt_parse_file +#define x509_crt_parse_path mbedtls_x509_crt_parse_path +#define x509_crt_revoked mbedtls_x509_crt_is_revoked +#define x509_crt_verify mbedtls_x509_crt_verify +#define x509_csr mbedtls_x509_csr +#define x509_csr_free mbedtls_x509_csr_free +#define x509_csr_info mbedtls_x509_csr_info +#define x509_csr_init mbedtls_x509_csr_init +#define x509_csr_parse mbedtls_x509_csr_parse +#define x509_csr_parse_der mbedtls_x509_csr_parse_der +#define x509_csr_parse_file mbedtls_x509_csr_parse_file +#define x509_dn_gets mbedtls_x509_dn_gets +#define x509_get_alg mbedtls_x509_get_alg +#define x509_get_alg_null mbedtls_x509_get_alg_null +#define x509_get_ext mbedtls_x509_get_ext +#define x509_get_name mbedtls_x509_get_name +#define x509_get_rsassa_pss_params mbedtls_x509_get_rsassa_pss_params +#define x509_get_serial mbedtls_x509_get_serial +#define x509_get_sig mbedtls_x509_get_sig +#define x509_get_sig_alg mbedtls_x509_get_sig_alg +#define x509_get_time mbedtls_x509_get_time +#define x509_key_size_helper mbedtls_x509_key_size_helper +#define x509_name mbedtls_x509_name +#define x509_self_test mbedtls_x509_self_test +#define x509_sequence mbedtls_x509_sequence +#define x509_serial_gets mbedtls_x509_serial_gets +#define x509_set_extension mbedtls_x509_set_extension +#define x509_sig_alg_gets mbedtls_x509_sig_alg_gets +#define x509_string_to_names mbedtls_x509_string_to_names +#define x509_time mbedtls_x509_time +#define x509_time_expired mbedtls_x509_time_is_past +#define x509_time_future mbedtls_x509_time_is_future +#define x509_write_extensions mbedtls_x509_write_extensions +#define x509_write_names mbedtls_x509_write_names +#define x509_write_sig mbedtls_x509_write_sig +#define x509write_cert mbedtls_x509write_cert +#define x509write_crt_der mbedtls_x509write_crt_der +#define x509write_crt_free mbedtls_x509write_crt_free +#define x509write_crt_init mbedtls_x509write_crt_init +#define x509write_crt_pem mbedtls_x509write_crt_pem +#define x509write_crt_set_authority_key_identifier mbedtls_x509write_crt_set_authority_key_identifier +#define x509write_crt_set_basic_constraints mbedtls_x509write_crt_set_basic_constraints +#define x509write_crt_set_extension mbedtls_x509write_crt_set_extension +#define x509write_crt_set_issuer_key mbedtls_x509write_crt_set_issuer_key +#define x509write_crt_set_issuer_name mbedtls_x509write_crt_set_issuer_name +#define x509write_crt_set_key_usage mbedtls_x509write_crt_set_key_usage +#define x509write_crt_set_md_alg mbedtls_x509write_crt_set_md_alg +#define x509write_crt_set_ns_cert_type mbedtls_x509write_crt_set_ns_cert_type +#define x509write_crt_set_serial mbedtls_x509write_crt_set_serial +#define x509write_crt_set_subject_key mbedtls_x509write_crt_set_subject_key +#define x509write_crt_set_subject_key_identifier mbedtls_x509write_crt_set_subject_key_identifier +#define x509write_crt_set_subject_name mbedtls_x509write_crt_set_subject_name +#define x509write_crt_set_validity mbedtls_x509write_crt_set_validity +#define x509write_crt_set_version mbedtls_x509write_crt_set_version +#define x509write_csr mbedtls_x509write_csr +#define x509write_csr_der mbedtls_x509write_csr_der +#define x509write_csr_free mbedtls_x509write_csr_free +#define x509write_csr_init mbedtls_x509write_csr_init +#define x509write_csr_pem mbedtls_x509write_csr_pem +#define x509write_csr_set_extension mbedtls_x509write_csr_set_extension +#define x509write_csr_set_key mbedtls_x509write_csr_set_key +#define x509write_csr_set_key_usage mbedtls_x509write_csr_set_key_usage +#define x509write_csr_set_md_alg mbedtls_x509write_csr_set_md_alg +#define x509write_csr_set_ns_cert_type mbedtls_x509write_csr_set_ns_cert_type +#define x509write_csr_set_subject_name mbedtls_x509write_csr_set_subject_name +#define xtea_context mbedtls_xtea_context +#define xtea_crypt_cbc mbedtls_xtea_crypt_cbc +#define xtea_crypt_ecb mbedtls_xtea_crypt_ecb +#define xtea_free mbedtls_xtea_free +#define xtea_init mbedtls_xtea_init +#define xtea_self_test mbedtls_xtea_self_test +#define xtea_setup mbedtls_xtea_setup + +#endif /* compat-1.3.h */ +#endif /* MBEDTLS_DEPRECATED_REMOVED */ diff --git a/openharmony/arm64-v8a/include/mbedtls/config.h b/openharmony/arm64-v8a/include/mbedtls/config.h new file mode 100644 index 00000000..1cd6eb66 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/config.h @@ -0,0 +1,4127 @@ +/** + * \file config.h + * + * \brief Configuration options (set of defines) + * + * This set of compile-time options may be used to enable + * or disable features selectively, and reduce the global + * memory footprint. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CONFIG_H +#define MBEDTLS_CONFIG_H + +#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE) +#define _CRT_SECURE_NO_DEPRECATE 1 +#endif + +/** + * \name SECTION: System support + * + * This section sets system specific settings. + * \{ + */ + +/** + * \def MBEDTLS_HAVE_ASM + * + * The compiler has support for asm(). + * + * Requires support for asm() in compiler. + * + * Used in: + * library/aria.c + * library/timing.c + * include/mbedtls/bn_mul.h + * + * Required by: + * MBEDTLS_AESNI_C + * MBEDTLS_PADLOCK_C + * + * Comment to disable the use of assembly code. + */ +#define MBEDTLS_HAVE_ASM + +/** + * \def MBEDTLS_NO_UDBL_DIVISION + * + * The platform lacks support for double-width integer division (64-bit + * division on a 32-bit platform, 128-bit division on a 64-bit platform). + * + * Used in: + * include/mbedtls/bignum.h + * library/bignum.c + * + * The bignum code uses double-width division to speed up some operations. + * Double-width division is often implemented in software that needs to + * be linked with the program. The presence of a double-width integer + * type is usually detected automatically through preprocessor macros, + * but the automatic detection cannot know whether the code needs to + * and can be linked with an implementation of division for that type. + * By default division is assumed to be usable if the type is present. + * Uncomment this option to prevent the use of double-width division. + * + * Note that division for the native integer type is always required. + * Furthermore, a 64-bit type is always required even on a 32-bit + * platform, but it need not support multiplication or division. In some + * cases it is also desirable to disable some double-width operations. For + * example, if double-width division is implemented in software, disabling + * it can reduce code size in some embedded targets. + */ +//#define MBEDTLS_NO_UDBL_DIVISION + +/** + * \def MBEDTLS_NO_64BIT_MULTIPLICATION + * + * The platform lacks support for 32x32 -> 64-bit multiplication. + * + * Used in: + * library/poly1305.c + * + * Some parts of the library may use multiplication of two unsigned 32-bit + * operands with a 64-bit result in order to speed up computations. On some + * platforms, this is not available in hardware and has to be implemented in + * software, usually in a library provided by the toolchain. + * + * Sometimes it is not desirable to have to link to that library. This option + * removes the dependency of that library on platforms that lack a hardware + * 64-bit multiplier by embedding a software implementation in Mbed TLS. + * + * Note that depending on the compiler, this may decrease performance compared + * to using the library function provided by the toolchain. + */ +//#define MBEDTLS_NO_64BIT_MULTIPLICATION + +/** + * \def MBEDTLS_HAVE_SSE2 + * + * CPU supports SSE2 instruction set. + * + * Uncomment if the CPU supports SSE2 (IA-32 specific). + */ +//#define MBEDTLS_HAVE_SSE2 + +/** + * \def MBEDTLS_HAVE_TIME + * + * System has time.h and time(). + * The time does not need to be correct, only time differences are used, + * by contrast with MBEDTLS_HAVE_TIME_DATE + * + * Defining MBEDTLS_HAVE_TIME allows you to specify MBEDTLS_PLATFORM_TIME_ALT, + * MBEDTLS_PLATFORM_TIME_MACRO, MBEDTLS_PLATFORM_TIME_TYPE_MACRO and + * MBEDTLS_PLATFORM_STD_TIME. + * + * Comment if your system does not support time functions. + * + * \note If MBEDTLS_TIMING_C is set - to enable the semi-portable timing + * interface - timing.c will include time.h on suitable platforms + * regardless of the setting of MBEDTLS_HAVE_TIME, unless + * MBEDTLS_TIMING_ALT is used. See timing.c for more information. + */ +#define MBEDTLS_HAVE_TIME + +/** + * \def MBEDTLS_HAVE_TIME_DATE + * + * System has time.h, time(), and an implementation for + * mbedtls_platform_gmtime_r() (see below). + * The time needs to be correct (not necessarily very accurate, but at least + * the date should be correct). This is used to verify the validity period of + * X.509 certificates. + * + * Comment if your system does not have a correct clock. + * + * \note mbedtls_platform_gmtime_r() is an abstraction in platform_util.h that + * behaves similarly to the gmtime_r() function from the C standard. Refer to + * the documentation for mbedtls_platform_gmtime_r() for more information. + * + * \note It is possible to configure an implementation for + * mbedtls_platform_gmtime_r() at compile-time by using the macro + * MBEDTLS_PLATFORM_GMTIME_R_ALT. + */ +#define MBEDTLS_HAVE_TIME_DATE + +/** + * \def MBEDTLS_PLATFORM_MEMORY + * + * Enable the memory allocation layer. + * + * By default mbed TLS uses the system-provided calloc() and free(). + * This allows different allocators (self-implemented or provided) to be + * provided to the platform abstraction layer. + * + * Enabling MBEDTLS_PLATFORM_MEMORY without the + * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide + * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and + * free() function pointer at runtime. + * + * Enabling MBEDTLS_PLATFORM_MEMORY and specifying + * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the + * alternate function at compile time. + * + * Requires: MBEDTLS_PLATFORM_C + * + * Enable this layer to allow use of alternative memory allocators. + */ +//#define MBEDTLS_PLATFORM_MEMORY + +/** + * \def MBEDTLS_PLATFORM_NO_STD_FUNCTIONS + * + * Do not assign standard functions in the platform layer (e.g. calloc() to + * MBEDTLS_PLATFORM_STD_CALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF) + * + * This makes sure there are no linking errors on platforms that do not support + * these functions. You will HAVE to provide alternatives, either at runtime + * via the platform_set_xxx() functions or at compile time by setting + * the MBEDTLS_PLATFORM_STD_XXX defines, or enabling a + * MBEDTLS_PLATFORM_XXX_MACRO. + * + * Requires: MBEDTLS_PLATFORM_C + * + * Uncomment to prevent default assignment of standard functions in the + * platform layer. + */ +//#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS + +/** + * \def MBEDTLS_PLATFORM_EXIT_ALT + * + * MBEDTLS_PLATFORM_XXX_ALT: Uncomment a macro to let mbed TLS support the + * function in the platform abstraction layer. + * + * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, mbed TLS will + * provide a function "mbedtls_platform_set_printf()" that allows you to set an + * alternative printf function pointer. + * + * All these define require MBEDTLS_PLATFORM_C to be defined! + * + * \note MBEDTLS_PLATFORM_SNPRINTF_ALT is required on Windows; + * it will be enabled automatically by check_config.h + * + * \warning MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as + * MBEDTLS_PLATFORM_XXX_MACRO! + * + * Requires: MBEDTLS_PLATFORM_TIME_ALT requires MBEDTLS_HAVE_TIME + * + * Uncomment a macro to enable alternate implementation of specific base + * platform function + */ +//#define MBEDTLS_PLATFORM_EXIT_ALT +//#define MBEDTLS_PLATFORM_TIME_ALT +//#define MBEDTLS_PLATFORM_FPRINTF_ALT +//#define MBEDTLS_PLATFORM_PRINTF_ALT +//#define MBEDTLS_PLATFORM_SNPRINTF_ALT +//#define MBEDTLS_PLATFORM_VSNPRINTF_ALT +//#define MBEDTLS_PLATFORM_NV_SEED_ALT +//#define MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT + +/** + * \def MBEDTLS_DEPRECATED_WARNING + * + * Mark deprecated functions and features so that they generate a warning if + * used. Functionality deprecated in one version will usually be removed in the + * next version. You can enable this to help you prepare the transition to a + * new major version by making sure your code is not using this functionality. + * + * This only works with GCC and Clang. With other compilers, you may want to + * use MBEDTLS_DEPRECATED_REMOVED + * + * Uncomment to get warnings on using deprecated functions and features. + */ +//#define MBEDTLS_DEPRECATED_WARNING + +/** + * \def MBEDTLS_DEPRECATED_REMOVED + * + * Remove deprecated functions and features so that they generate an error if + * used. Functionality deprecated in one version will usually be removed in the + * next version. You can enable this to help you prepare the transition to a + * new major version by making sure your code is not using this functionality. + * + * Uncomment to get errors on using deprecated functions and features. + */ +//#define MBEDTLS_DEPRECATED_REMOVED + +/** + * \def MBEDTLS_CHECK_PARAMS + * + * This configuration option controls whether the library validates more of + * the parameters passed to it. + * + * When this flag is not defined, the library only attempts to validate an + * input parameter if: (1) they may come from the outside world (such as the + * network, the filesystem, etc.) or (2) not validating them could result in + * internal memory errors such as overflowing a buffer controlled by the + * library. On the other hand, it doesn't attempt to validate parameters whose + * values are fully controlled by the application (such as pointers). + * + * When this flag is defined, the library additionally attempts to validate + * parameters that are fully controlled by the application, and should always + * be valid if the application code is fully correct and trusted. + * + * For example, when a function accepts as input a pointer to a buffer that may + * contain untrusted data, and its documentation mentions that this pointer + * must not be NULL: + * - The pointer is checked to be non-NULL only if this option is enabled. + * - The content of the buffer is always validated. + * + * When this flag is defined, if a library function receives a parameter that + * is invalid: + * 1. The function will invoke the macro MBEDTLS_PARAM_FAILED(). + * 2. If MBEDTLS_PARAM_FAILED() did not terminate the program, the function + * will immediately return. If the function returns an Mbed TLS error code, + * the error code in this case is MBEDTLS_ERR_xxx_BAD_INPUT_DATA. + * + * When defining this flag, you also need to arrange a definition for + * MBEDTLS_PARAM_FAILED(). You can do this by any of the following methods: + * - By default, the library defines MBEDTLS_PARAM_FAILED() to call a + * function mbedtls_param_failed(), but the library does not define this + * function. If you do not make any other arrangements, you must provide + * the function mbedtls_param_failed() in your application. + * See `platform_util.h` for its prototype. + * - If you enable the macro #MBEDTLS_CHECK_PARAMS_ASSERT, then the + * library defines MBEDTLS_PARAM_FAILED(\c cond) to be `assert(cond)`. + * You can still supply an alternative definition of + * MBEDTLS_PARAM_FAILED(), which may call `assert`. + * - If you define a macro MBEDTLS_PARAM_FAILED() before including `config.h` + * or you uncomment the definition of MBEDTLS_PARAM_FAILED() in `config.h`, + * the library will call the macro that you defined and will not supply + * its own version. Note that if MBEDTLS_PARAM_FAILED() calls `assert`, + * you need to enable #MBEDTLS_CHECK_PARAMS_ASSERT so that library source + * files include ``. + * + * Uncomment to enable validation of application-controlled parameters. + */ +//#define MBEDTLS_CHECK_PARAMS + +/** + * \def MBEDTLS_CHECK_PARAMS_ASSERT + * + * Allow MBEDTLS_PARAM_FAILED() to call `assert`, and make it default to + * `assert`. This macro is only used if #MBEDTLS_CHECK_PARAMS is defined. + * + * If this macro is not defined, then MBEDTLS_PARAM_FAILED() defaults to + * calling a function mbedtls_param_failed(). See the documentation of + * #MBEDTLS_CHECK_PARAMS for details. + * + * Uncomment to allow MBEDTLS_PARAM_FAILED() to call `assert`. + */ +//#define MBEDTLS_CHECK_PARAMS_ASSERT + +/** \} name SECTION: System support */ + +/** + * \name SECTION: mbed TLS feature support + * + * This section sets support for features that are or are not needed + * within the modules that are enabled. + * \{ + */ + +/** + * \def MBEDTLS_TIMING_ALT + * + * Uncomment to provide your own alternate implementation for mbedtls_timing_hardclock(), + * mbedtls_timing_get_timer(), mbedtls_set_alarm(), mbedtls_set/get_delay() + * + * Only works if you have MBEDTLS_TIMING_C enabled. + * + * You will need to provide a header "timing_alt.h" and an implementation at + * compile time. + */ +//#define MBEDTLS_TIMING_ALT + +/** + * \def MBEDTLS_AES_ALT + * + * MBEDTLS__MODULE_NAME__ALT: Uncomment a macro to let mbed TLS use your + * alternate core implementation of a symmetric crypto, an arithmetic or hash + * module (e.g. platform specific assembly optimized implementations). Keep + * in mind that the function prototypes should remain the same. + * + * This replaces the whole module. If you only want to replace one of the + * functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. + * + * Example: In case you uncomment MBEDTLS_AES_ALT, mbed TLS will no longer + * provide the "struct mbedtls_aes_context" definition and omit the base + * function declarations and implementations. "aes_alt.h" will be included from + * "aes.h" to include the new function definitions. + * + * Uncomment a macro to enable alternate implementation of the corresponding + * module. + * + * \warning MD2, MD4, MD5, ARC4, DES and SHA-1 are considered weak and their + * use constitutes a security risk. If possible, we recommend + * avoiding dependencies on them, and considering stronger message + * digests and ciphers instead. + * + */ +//#define MBEDTLS_AES_ALT +//#define MBEDTLS_ARC4_ALT +//#define MBEDTLS_ARIA_ALT +//#define MBEDTLS_BLOWFISH_ALT +//#define MBEDTLS_CAMELLIA_ALT +//#define MBEDTLS_CCM_ALT +//#define MBEDTLS_CHACHA20_ALT +//#define MBEDTLS_CHACHAPOLY_ALT +//#define MBEDTLS_CMAC_ALT +//#define MBEDTLS_DES_ALT +//#define MBEDTLS_DHM_ALT +//#define MBEDTLS_ECJPAKE_ALT +//#define MBEDTLS_GCM_ALT +//#define MBEDTLS_NIST_KW_ALT +//#define MBEDTLS_MD2_ALT +//#define MBEDTLS_MD4_ALT +//#define MBEDTLS_MD5_ALT +//#define MBEDTLS_POLY1305_ALT +//#define MBEDTLS_RIPEMD160_ALT +//#define MBEDTLS_RSA_ALT +//#define MBEDTLS_SHA1_ALT +//#define MBEDTLS_SHA256_ALT +//#define MBEDTLS_SHA512_ALT +//#define MBEDTLS_XTEA_ALT + +/* + * When replacing the elliptic curve module, please consider, that it is + * implemented with two .c files: + * - ecp.c + * - ecp_curves.c + * You can replace them very much like all the other MBEDTLS__MODULE_NAME__ALT + * macros as described above. The only difference is that you have to make sure + * that you provide functionality for both .c files. + */ +//#define MBEDTLS_ECP_ALT + +/** + * \def MBEDTLS_MD2_PROCESS_ALT + * + * MBEDTLS__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use you + * alternate core implementation of symmetric crypto or hash function. Keep in + * mind that function prototypes should remain the same. + * + * This replaces only one function. The header file from mbed TLS is still + * used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. + * + * Example: In case you uncomment MBEDTLS_SHA256_PROCESS_ALT, mbed TLS will + * no longer provide the mbedtls_sha1_process() function, but it will still provide + * the other function (using your mbedtls_sha1_process() function) and the definition + * of mbedtls_sha1_context, so your implementation of mbedtls_sha1_process must be compatible + * with this definition. + * + * \note Because of a signature change, the core AES encryption and decryption routines are + * currently named mbedtls_aes_internal_encrypt and mbedtls_aes_internal_decrypt, + * respectively. When setting up alternative implementations, these functions should + * be overridden, but the wrapper functions mbedtls_aes_decrypt and mbedtls_aes_encrypt + * must stay untouched. + * + * \note If you use the AES_xxx_ALT macros, then it is recommended to also set + * MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES + * tables. + * + * Uncomment a macro to enable alternate implementation of the corresponding + * function. + * + * \warning MD2, MD4, MD5, DES and SHA-1 are considered weak and their use + * constitutes a security risk. If possible, we recommend avoiding + * dependencies on them, and considering stronger message digests + * and ciphers instead. + * + * \warning If both MBEDTLS_ECDSA_SIGN_ALT and MBEDTLS_ECDSA_DETERMINISTIC are + * enabled, then the deterministic ECDH signature functions pass the + * the static HMAC-DRBG as RNG to mbedtls_ecdsa_sign(). Therefore + * alternative implementations should use the RNG only for generating + * the ephemeral key and nothing else. If this is not possible, then + * MBEDTLS_ECDSA_DETERMINISTIC should be disabled and an alternative + * implementation should be provided for mbedtls_ecdsa_sign_det_ext() + * (and for mbedtls_ecdsa_sign_det() too if backward compatibility is + * desirable). + * + */ +//#define MBEDTLS_MD2_PROCESS_ALT +//#define MBEDTLS_MD4_PROCESS_ALT +//#define MBEDTLS_MD5_PROCESS_ALT +//#define MBEDTLS_RIPEMD160_PROCESS_ALT +//#define MBEDTLS_SHA1_PROCESS_ALT +//#define MBEDTLS_SHA256_PROCESS_ALT +//#define MBEDTLS_SHA512_PROCESS_ALT +//#define MBEDTLS_DES_SETKEY_ALT +//#define MBEDTLS_DES_CRYPT_ECB_ALT +//#define MBEDTLS_DES3_CRYPT_ECB_ALT +//#define MBEDTLS_AES_SETKEY_ENC_ALT +//#define MBEDTLS_AES_SETKEY_DEC_ALT +//#define MBEDTLS_AES_ENCRYPT_ALT +//#define MBEDTLS_AES_DECRYPT_ALT +//#define MBEDTLS_ECDH_GEN_PUBLIC_ALT +//#define MBEDTLS_ECDH_COMPUTE_SHARED_ALT +//#define MBEDTLS_ECDSA_VERIFY_ALT +//#define MBEDTLS_ECDSA_SIGN_ALT +//#define MBEDTLS_ECDSA_GENKEY_ALT + +/** + * \def MBEDTLS_ECP_INTERNAL_ALT + * + * Expose a part of the internal interface of the Elliptic Curve Point module. + * + * MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your + * alternative core implementation of elliptic curve arithmetic. Keep in mind + * that function prototypes should remain the same. + * + * This partially replaces one function. The header file from mbed TLS is still + * used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation + * is still present and it is used for group structures not supported by the + * alternative. + * + * The original implementation can in addition be removed by setting the + * MBEDTLS_ECP_NO_FALLBACK option, in which case any function for which the + * corresponding MBEDTLS_ECP__FUNCTION_NAME__ALT macro is defined will not be + * able to fallback to curves not supported by the alternative implementation. + * + * Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT + * and implementing the following functions: + * unsigned char mbedtls_internal_ecp_grp_capable( + * const mbedtls_ecp_group *grp ) + * int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) + * void mbedtls_internal_ecp_free( const mbedtls_ecp_group *grp ) + * The mbedtls_internal_ecp_grp_capable function should return 1 if the + * replacement functions implement arithmetic for the given group and 0 + * otherwise. + * The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_free are + * called before and after each point operation and provide an opportunity to + * implement optimized set up and tear down instructions. + * + * Example: In case you set MBEDTLS_ECP_INTERNAL_ALT and + * MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac() + * function, but will use your mbedtls_internal_ecp_double_jac() if the group + * for the operation is supported by your implementation (i.e. your + * mbedtls_internal_ecp_grp_capable() function returns 1 for this group). If the + * group is not supported by your implementation, then the original mbed TLS + * implementation of ecp_double_jac() is used instead, unless this fallback + * behaviour is disabled by setting MBEDTLS_ECP_NO_FALLBACK (in which case + * ecp_double_jac() will return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE). + * + * The function prototypes and the definition of mbedtls_ecp_group and + * mbedtls_ecp_point will not change based on MBEDTLS_ECP_INTERNAL_ALT, so your + * implementation of mbedtls_internal_ecp__function_name__ must be compatible + * with their definitions. + * + * Uncomment a macro to enable alternate implementation of the corresponding + * function. + */ +/* Required for all the functions in this section */ +//#define MBEDTLS_ECP_INTERNAL_ALT +/* Turn off software fallback for curves not supported in hardware */ +//#define MBEDTLS_ECP_NO_FALLBACK +/* Support for Weierstrass curves with Jacobi representation */ +//#define MBEDTLS_ECP_RANDOMIZE_JAC_ALT +//#define MBEDTLS_ECP_ADD_MIXED_ALT +//#define MBEDTLS_ECP_DOUBLE_JAC_ALT +//#define MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT +//#define MBEDTLS_ECP_NORMALIZE_JAC_ALT +/* Support for curves with Montgomery arithmetic */ +//#define MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT +//#define MBEDTLS_ECP_RANDOMIZE_MXZ_ALT +//#define MBEDTLS_ECP_NORMALIZE_MXZ_ALT + +/** + * \def MBEDTLS_TEST_NULL_ENTROPY + * + * Enables testing and use of mbed TLS without any configured entropy sources. + * This permits use of the library on platforms before an entropy source has + * been integrated (see for example the MBEDTLS_ENTROPY_HARDWARE_ALT or the + * MBEDTLS_ENTROPY_NV_SEED switches). + * + * WARNING! This switch MUST be disabled in production builds, and is suitable + * only for development. + * Enabling the switch negates any security provided by the library. + * + * Requires MBEDTLS_ENTROPY_C, MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES + * + */ +//#define MBEDTLS_TEST_NULL_ENTROPY + +/** + * \def MBEDTLS_ENTROPY_HARDWARE_ALT + * + * Uncomment this macro to let mbed TLS use your own implementation of a + * hardware entropy collector. + * + * Your function must be called \c mbedtls_hardware_poll(), have the same + * prototype as declared in entropy_poll.h, and accept NULL as first argument. + * + * Uncomment to use your own hardware entropy collector. + */ +//#define MBEDTLS_ENTROPY_HARDWARE_ALT + +/** + * \def MBEDTLS_AES_ROM_TABLES + * + * Use precomputed AES tables stored in ROM. + * + * Uncomment this macro to use precomputed AES tables stored in ROM. + * Comment this macro to generate AES tables in RAM at runtime. + * + * Tradeoff: Using precomputed ROM tables reduces RAM usage by ~8kb + * (or ~2kb if \c MBEDTLS_AES_FEWER_TABLES is used) and reduces the + * initialization time before the first AES operation can be performed. + * It comes at the cost of additional ~8kb ROM use (resp. ~2kb if \c + * MBEDTLS_AES_FEWER_TABLES below is used), and potentially degraded + * performance if ROM access is slower than RAM access. + * + * This option is independent of \c MBEDTLS_AES_FEWER_TABLES. + * + */ +//#define MBEDTLS_AES_ROM_TABLES + +/** + * \def MBEDTLS_AES_FEWER_TABLES + * + * Use less ROM/RAM for AES tables. + * + * Uncommenting this macro omits 75% of the AES tables from + * ROM / RAM (depending on the value of \c MBEDTLS_AES_ROM_TABLES) + * by computing their values on the fly during operations + * (the tables are entry-wise rotations of one another). + * + * Tradeoff: Uncommenting this reduces the RAM / ROM footprint + * by ~6kb but at the cost of more arithmetic operations during + * runtime. Specifically, one has to compare 4 accesses within + * different tables to 4 accesses with additional arithmetic + * operations within the same table. The performance gain/loss + * depends on the system and memory details. + * + * This option is independent of \c MBEDTLS_AES_ROM_TABLES. + * + */ +//#define MBEDTLS_AES_FEWER_TABLES + +/** + * \def MBEDTLS_CAMELLIA_SMALL_MEMORY + * + * Use less ROM for the Camellia implementation (saves about 768 bytes). + * + * Uncomment this macro to use less memory for Camellia. + */ +//#define MBEDTLS_CAMELLIA_SMALL_MEMORY + +/** + * \def MBEDTLS_CHECK_RETURN_WARNING + * + * If this macro is defined, emit a compile-time warning if application code + * calls a function without checking its return value, but the return value + * should generally be checked in portable applications. + * + * This is only supported on platforms where #MBEDTLS_CHECK_RETURN is + * implemented. Otherwise this option has no effect. + * + * Uncomment to get warnings on using fallible functions without checking + * their return value. + * + * \note This feature is a work in progress. + * Warnings will be added to more functions in the future. + * + * \note A few functions are considered critical, and ignoring the return + * value of these functions will trigger a warning even if this + * macro is not defined. To completely disable return value check + * warnings, define #MBEDTLS_CHECK_RETURN with an empty expansion. + */ +//#define MBEDTLS_CHECK_RETURN_WARNING + +/** + * \def MBEDTLS_CIPHER_MODE_CBC + * + * Enable Cipher Block Chaining mode (CBC) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_CBC + +/** + * \def MBEDTLS_CIPHER_MODE_CFB + * + * Enable Cipher Feedback mode (CFB) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_CFB + +/** + * \def MBEDTLS_CIPHER_MODE_CTR + * + * Enable Counter Block Cipher mode (CTR) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_CTR + +/** + * \def MBEDTLS_CIPHER_MODE_OFB + * + * Enable Output Feedback mode (OFB) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_OFB + +/** + * \def MBEDTLS_CIPHER_MODE_XTS + * + * Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES. + */ +#define MBEDTLS_CIPHER_MODE_XTS + +/** + * \def MBEDTLS_CIPHER_NULL_CIPHER + * + * Enable NULL cipher. + * Warning: Only do so when you know what you are doing. This allows for + * encryption or channels without any security! + * + * Requires MBEDTLS_ENABLE_WEAK_CIPHERSUITES as well to enable + * the following ciphersuites: + * MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA + * MBEDTLS_TLS_RSA_WITH_NULL_SHA256 + * MBEDTLS_TLS_RSA_WITH_NULL_SHA + * MBEDTLS_TLS_RSA_WITH_NULL_MD5 + * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA + * MBEDTLS_TLS_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_PSK_WITH_NULL_SHA + * + * Uncomment this macro to enable the NULL cipher and ciphersuites + */ +//#define MBEDTLS_CIPHER_NULL_CIPHER + +/** + * \def MBEDTLS_CIPHER_PADDING_PKCS7 + * + * MBEDTLS_CIPHER_PADDING_XXX: Uncomment or comment macros to add support for + * specific padding modes in the cipher layer with cipher modes that support + * padding (e.g. CBC) + * + * If you disable all padding modes, only full blocks can be used with CBC. + * + * Enable padding modes in the cipher layer. + */ +#define MBEDTLS_CIPHER_PADDING_PKCS7 +#define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS +#define MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN +#define MBEDTLS_CIPHER_PADDING_ZEROS + +/** \def MBEDTLS_CTR_DRBG_USE_128_BIT_KEY + * + * Uncomment this macro to use a 128-bit key in the CTR_DRBG module. + * By default, CTR_DRBG uses a 256-bit key. + */ +//#define MBEDTLS_CTR_DRBG_USE_128_BIT_KEY + +/** + * \def MBEDTLS_ENABLE_WEAK_CIPHERSUITES + * + * Enable weak ciphersuites in SSL / TLS. + * Warning: Only do so when you know what you are doing. This allows for + * channels with virtually no security at all! + * + * This enables the following ciphersuites: + * MBEDTLS_TLS_RSA_WITH_DES_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_DES_CBC_SHA + * + * Uncomment this macro to enable weak ciphersuites + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers instead. + */ +//#define MBEDTLS_ENABLE_WEAK_CIPHERSUITES + +/** + * \def MBEDTLS_REMOVE_ARC4_CIPHERSUITES + * + * Remove RC4 ciphersuites by default in SSL / TLS. + * This flag removes the ciphersuites based on RC4 from the default list as + * returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible to + * enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including them + * explicitly. + * + * Uncomment this macro to remove RC4 ciphersuites by default. + */ +#define MBEDTLS_REMOVE_ARC4_CIPHERSUITES + +/** + * \def MBEDTLS_REMOVE_3DES_CIPHERSUITES + * + * Remove 3DES ciphersuites by default in SSL / TLS. + * This flag removes the ciphersuites based on 3DES from the default list as + * returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible + * to enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including + * them explicitly. + * + * A man-in-the-browser attacker can recover authentication tokens sent through + * a TLS connection using a 3DES based cipher suite (see "On the Practical + * (In-)Security of 64-bit Block Ciphers" by Karthikeyan Bhargavan and Gaëtan + * Leurent, see https://sweet32.info/SWEET32_CCS16.pdf). If this attack falls + * in your threat model or you are unsure, then you should keep this option + * enabled to remove 3DES based cipher suites. + * + * Comment this macro to keep 3DES in the default ciphersuite list. + */ +#define MBEDTLS_REMOVE_3DES_CIPHERSUITES + +/** + * \def MBEDTLS_ECP_DP_SECP192R1_ENABLED + * + * MBEDTLS_ECP_XXXX_ENABLED: Enables specific curves within the Elliptic Curve + * module. By default all supported curves are enabled. + * + * Comment macros to disable the curve and functions for it + */ +/* Short Weierstrass curves (supporting ECP, ECDH, ECDSA) */ +#define MBEDTLS_ECP_DP_SECP192R1_ENABLED +#define MBEDTLS_ECP_DP_SECP224R1_ENABLED +#define MBEDTLS_ECP_DP_SECP256R1_ENABLED +#define MBEDTLS_ECP_DP_SECP384R1_ENABLED +#define MBEDTLS_ECP_DP_SECP521R1_ENABLED +#define MBEDTLS_ECP_DP_SECP192K1_ENABLED +#define MBEDTLS_ECP_DP_SECP224K1_ENABLED +#define MBEDTLS_ECP_DP_SECP256K1_ENABLED +#define MBEDTLS_ECP_DP_BP256R1_ENABLED +#define MBEDTLS_ECP_DP_BP384R1_ENABLED +#define MBEDTLS_ECP_DP_BP512R1_ENABLED +/* Montgomery curves (supporting ECP) */ +#define MBEDTLS_ECP_DP_CURVE25519_ENABLED +#define MBEDTLS_ECP_DP_CURVE448_ENABLED + +/** + * \def MBEDTLS_ECP_NIST_OPTIM + * + * Enable specific 'modulo p' routines for each NIST prime. + * Depending on the prime and architecture, makes operations 4 to 8 times + * faster on the corresponding curve. + * + * Comment this macro to disable NIST curves optimisation. + */ +#define MBEDTLS_ECP_NIST_OPTIM + +/** + * \def MBEDTLS_ECP_NO_INTERNAL_RNG + * + * When this option is disabled, mbedtls_ecp_mul() will make use of an + * internal RNG when called with a NULL \c f_rng argument, in order to protect + * against some side-channel attacks. + * + * This protection introduces a dependency of the ECP module on one of the + * DRBG modules. For very constrained implementations that don't require this + * protection (for example, because you're only doing signature verification, + * so not manipulating any secret, or because local/physical side-channel + * attacks are outside your threat model), it might be desirable to get rid of + * that dependency. + * + * \warning Enabling this option makes some uses of ECP vulnerable to some + * side-channel attacks. Only enable it if you know that's not a problem for + * your use case. + * + * Uncomment this macro to disable some counter-measures in ECP. + */ +//#define MBEDTLS_ECP_NO_INTERNAL_RNG + +/** + * \def MBEDTLS_ECP_RESTARTABLE + * + * Enable "non-blocking" ECC operations that can return early and be resumed. + * + * This allows various functions to pause by returning + * #MBEDTLS_ERR_ECP_IN_PROGRESS (or, for functions in the SSL module, + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS) and then be called later again in + * order to further progress and eventually complete their operation. This is + * controlled through mbedtls_ecp_set_max_ops() which limits the maximum + * number of ECC operations a function may perform before pausing; see + * mbedtls_ecp_set_max_ops() for more information. + * + * This is useful in non-threaded environments if you want to avoid blocking + * for too long on ECC (and, hence, X.509 or SSL/TLS) operations. + * + * Uncomment this macro to enable restartable ECC computations. + * + * \note This option only works with the default software implementation of + * elliptic curve functionality. It is incompatible with + * MBEDTLS_ECP_ALT, MBEDTLS_ECDH_XXX_ALT, MBEDTLS_ECDSA_XXX_ALT + * and MBEDTLS_ECDH_LEGACY_CONTEXT. + */ +//#define MBEDTLS_ECP_RESTARTABLE + +/** + * \def MBEDTLS_ECDH_LEGACY_CONTEXT + * + * Use a backward compatible ECDH context. + * + * Mbed TLS supports two formats for ECDH contexts (#mbedtls_ecdh_context + * defined in `ecdh.h`). For most applications, the choice of format makes + * no difference, since all library functions can work with either format, + * except that the new format is incompatible with MBEDTLS_ECP_RESTARTABLE. + + * The new format used when this option is disabled is smaller + * (56 bytes on a 32-bit platform). In future versions of the library, it + * will support alternative implementations of ECDH operations. + * The new format is incompatible with applications that access + * context fields directly and with restartable ECP operations. + * + * Define this macro if you enable MBEDTLS_ECP_RESTARTABLE or if you + * want to access ECDH context fields directly. Otherwise you should + * comment out this macro definition. + * + * This option has no effect if #MBEDTLS_ECDH_C is not enabled. + * + * \note This configuration option is experimental. Future versions of the + * library may modify the way the ECDH context layout is configured + * and may modify the layout of the new context type. + */ +#define MBEDTLS_ECDH_LEGACY_CONTEXT + +/** + * \def MBEDTLS_ECDSA_DETERMINISTIC + * + * Enable deterministic ECDSA (RFC 6979). + * Standard ECDSA is "fragile" in the sense that lack of entropy when signing + * may result in a compromise of the long-term signing key. This is avoided by + * the deterministic variant. + * + * Requires: MBEDTLS_HMAC_DRBG_C, MBEDTLS_ECDSA_C + * + * Comment this macro to disable deterministic ECDSA. + */ +#define MBEDTLS_ECDSA_DETERMINISTIC + +/** + * \def MBEDTLS_KEY_EXCHANGE_PSK_ENABLED + * + * Enable the PSK based ciphersuite modes in SSL / TLS. + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED + * + * Enable the DHE-PSK based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_DHM_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA + * + * \warning Using DHE constitutes a security risk as it + * is not possible to validate custom DH parameters. + * If possible, it is recommended users should consider + * preferring other methods of key exchange. + * See dhm.h for more details. + * + */ +#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED + * + * Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED + * + * Enable the RSA-PSK based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED + * + * Enable the RSA-only based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 + */ +#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED + * + * Enable the DHE-RSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_DHM_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA + * + * \warning Using DHE constitutes a security risk as it + * is not possible to validate custom DH parameters. + * If possible, it is recommended users should consider + * preferring other methods of key exchange. + * See dhm.h for more details. + * + */ +#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED + * + * Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED + * + * Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, MBEDTLS_X509_CRT_PARSE_C, + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED + * + * Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + */ +#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED + * + * Enable the ECDH-RSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C, MBEDTLS_RSA_C, MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 + */ +#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED + * + * Enable the ECJPAKE based ciphersuite modes in SSL / TLS. + * + * \warning This is currently experimental. EC J-PAKE support is based on the + * Thread v1.0.0 specification; incompatible changes to the specification + * might still happen. For this reason, this is disabled by default. + * + * Requires: MBEDTLS_ECJPAKE_C + * MBEDTLS_SHA256_C + * MBEDTLS_ECP_DP_SECP256R1_ENABLED + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8 + */ +//#define MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED + +/** + * \def MBEDTLS_PK_PARSE_EC_EXTENDED + * + * Enhance support for reading EC keys using variants of SEC1 not allowed by + * RFC 5915 and RFC 5480. + * + * Currently this means parsing the SpecifiedECDomain choice of EC + * parameters (only known groups are supported, not arbitrary domains, to + * avoid validation issues). + * + * Disable if you only need to support RFC 5915 + 5480 key formats. + */ +#define MBEDTLS_PK_PARSE_EC_EXTENDED + +/** + * \def MBEDTLS_ERROR_STRERROR_DUMMY + * + * Enable a dummy error function to make use of mbedtls_strerror() in + * third party libraries easier when MBEDTLS_ERROR_C is disabled + * (no effect when MBEDTLS_ERROR_C is enabled). + * + * You can safely disable this if MBEDTLS_ERROR_C is enabled, or if you're + * not using mbedtls_strerror() or error_strerror() in your application. + * + * Disable if you run into name conflicts and want to really remove the + * mbedtls_strerror() + */ +#define MBEDTLS_ERROR_STRERROR_DUMMY + +/** + * \def MBEDTLS_GENPRIME + * + * Enable the prime-number generation code. + * + * Requires: MBEDTLS_BIGNUM_C + */ +#define MBEDTLS_GENPRIME + +/** + * \def MBEDTLS_FS_IO + * + * Enable functions that use the filesystem. + */ +#define MBEDTLS_FS_IO + +/** + * \def MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES + * + * Do not add default entropy sources. These are the platform specific, + * mbedtls_timing_hardclock and HAVEGE based poll functions. + * + * This is useful to have more control over the added entropy sources in an + * application. + * + * Uncomment this macro to prevent loading of default entropy functions. + */ +//#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES + +/** + * \def MBEDTLS_NO_PLATFORM_ENTROPY + * + * Do not use built-in platform entropy functions. + * This is useful if your platform does not support + * standards like the /dev/urandom or Windows CryptoAPI. + * + * Uncomment this macro to disable the built-in platform entropy functions. + */ +//#define MBEDTLS_NO_PLATFORM_ENTROPY + +/** + * \def MBEDTLS_ENTROPY_FORCE_SHA256 + * + * Force the entropy accumulator to use a SHA-256 accumulator instead of the + * default SHA-512 based one (if both are available). + * + * Requires: MBEDTLS_SHA256_C + * + * On 32-bit systems SHA-256 can be much faster than SHA-512. Use this option + * if you have performance concerns. + * + * This option is only useful if both MBEDTLS_SHA256_C and + * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used. + */ +//#define MBEDTLS_ENTROPY_FORCE_SHA256 + +/** + * \def MBEDTLS_ENTROPY_NV_SEED + * + * Enable the non-volatile (NV) seed file-based entropy source. + * (Also enables the NV seed read/write functions in the platform layer) + * + * This is crucial (if not required) on systems that do not have a + * cryptographic entropy source (in hardware or kernel) available. + * + * Requires: MBEDTLS_ENTROPY_C, MBEDTLS_PLATFORM_C + * + * \note The read/write functions that are used by the entropy source are + * determined in the platform layer, and can be modified at runtime and/or + * compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used. + * + * \note If you use the default implementation functions that read a seedfile + * with regular fopen(), please make sure you make a seedfile with the + * proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at + * least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from + * and written to or you will get an entropy source error! The default + * implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE + * bytes from the file. + * + * \note The entropy collector will write to the seed file before entropy is + * given to an external source, to update it. + */ +//#define MBEDTLS_ENTROPY_NV_SEED + +/* MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER + * + * Enable key identifiers that encode a key owner identifier. + * + * The owner of a key is identified by a value of type ::mbedtls_key_owner_id_t + * which is currently hard-coded to be int32_t. + * + * Note that this option is meant for internal use only and may be removed + * without notice. It is incompatible with MBEDTLS_USE_PSA_CRYPTO. + */ +//#define MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER + +/** + * \def MBEDTLS_MEMORY_DEBUG + * + * Enable debugging of buffer allocator memory issues. Automatically prints + * (to stderr) all (fatal) messages on memory allocation issues. Enables + * function for 'debug output' of allocated memory. + * + * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C + * + * Uncomment this macro to let the buffer allocator print out error messages. + */ +//#define MBEDTLS_MEMORY_DEBUG + +/** + * \def MBEDTLS_MEMORY_BACKTRACE + * + * Include backtrace information with each allocated block. + * + * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C + * GLIBC-compatible backtrace() an backtrace_symbols() support + * + * Uncomment this macro to include backtrace information + */ +//#define MBEDTLS_MEMORY_BACKTRACE + +/** + * \def MBEDTLS_PK_RSA_ALT_SUPPORT + * + * Support external private RSA keys (eg from a HSM) in the PK layer. + * + * Comment this macro to disable support for external private RSA keys. + */ +#define MBEDTLS_PK_RSA_ALT_SUPPORT + +/** + * \def MBEDTLS_PKCS1_V15 + * + * Enable support for PKCS#1 v1.5 encoding. + * + * Requires: MBEDTLS_RSA_C + * + * This enables support for PKCS#1 v1.5 operations. + */ +#define MBEDTLS_PKCS1_V15 + +/** + * \def MBEDTLS_PKCS1_V21 + * + * Enable support for PKCS#1 v2.1 encoding. + * + * Requires: MBEDTLS_MD_C, MBEDTLS_RSA_C + * + * This enables support for RSAES-OAEP and RSASSA-PSS operations. + */ +#define MBEDTLS_PKCS1_V21 + +/** \def MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS + * + * Enable support for platform built-in keys. If you enable this feature, + * you must implement the function mbedtls_psa_platform_get_builtin_key(). + * See the documentation of that function for more information. + * + * Built-in keys are typically derived from a hardware unique key or + * stored in a secure element. + * + * Requires: MBEDTLS_PSA_CRYPTO_C. + * + * \warning This interface is experimental and may change or be removed + * without notice. + */ +//#define MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS + +/** \def MBEDTLS_PSA_CRYPTO_CLIENT + * + * Enable support for PSA crypto client. + * + * \note This option allows to include the code necessary for a PSA + * crypto client when the PSA crypto implementation is not included in + * the library (MBEDTLS_PSA_CRYPTO_C disabled). The code included is the + * code to set and get PSA key attributes. + * The development of PSA drivers partially relying on the library to + * fulfill the hardware gaps is another possible usage of this option. + * + * \warning This interface is experimental and may change or be removed + * without notice. + */ +//#define MBEDTLS_PSA_CRYPTO_CLIENT + +/** \def MBEDTLS_PSA_CRYPTO_DRIVERS + * + * Enable support for the experimental PSA crypto driver interface. + * + * Requires: MBEDTLS_PSA_CRYPTO_C + * + * \warning This interface is experimental and may change or be removed + * without notice. + */ +//#define MBEDTLS_PSA_CRYPTO_DRIVERS + +/** \def MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG + * + * Make the PSA Crypto module use an external random generator provided + * by a driver, instead of Mbed TLS's entropy and DRBG modules. + * + * \note This random generator must deliver random numbers with cryptographic + * quality and high performance. It must supply unpredictable numbers + * with a uniform distribution. The implementation of this function + * is responsible for ensuring that the random generator is seeded + * with sufficient entropy. If you have a hardware TRNG which is slow + * or delivers non-uniform output, declare it as an entropy source + * with mbedtls_entropy_add_source() instead of enabling this option. + * + * If you enable this option, you must configure the type + * ::mbedtls_psa_external_random_context_t in psa/crypto_platform.h + * and define a function called mbedtls_psa_external_get_random() + * with the following prototype: + * ``` + * psa_status_t mbedtls_psa_external_get_random( + * mbedtls_psa_external_random_context_t *context, + * uint8_t *output, size_t output_size, size_t *output_length); + * ); + * ``` + * The \c context value is initialized to 0 before the first call. + * The function must fill the \c output buffer with \p output_size bytes + * of random data and set \c *output_length to \p output_size. + * + * Requires: MBEDTLS_PSA_CRYPTO_C + * + * \warning If you enable this option, code that uses the PSA cryptography + * interface will not use any of the entropy sources set up for + * the entropy module, nor the NV seed that MBEDTLS_ENTROPY_NV_SEED + * enables. + * + * \note This option is experimental and may be removed without notice. + */ +//#define MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG + +/** + * \def MBEDTLS_PSA_CRYPTO_SPM + * + * When MBEDTLS_PSA_CRYPTO_SPM is defined, the code is built for SPM (Secure + * Partition Manager) integration which separates the code into two parts: a + * NSPE (Non-Secure Process Environment) and an SPE (Secure Process + * Environment). + * + * Module: library/psa_crypto.c + * Requires: MBEDTLS_PSA_CRYPTO_C + * + */ +//#define MBEDTLS_PSA_CRYPTO_SPM + +/** + * \def MBEDTLS_PSA_INJECT_ENTROPY + * + * Enable support for entropy injection at first boot. This feature is + * required on systems that do not have a built-in entropy source (TRNG). + * This feature is currently not supported on systems that have a built-in + * entropy source. + * + * Requires: MBEDTLS_PSA_CRYPTO_STORAGE_C, MBEDTLS_ENTROPY_NV_SEED + * + */ +//#define MBEDTLS_PSA_INJECT_ENTROPY + +/** + * \def MBEDTLS_RSA_NO_CRT + * + * Do not use the Chinese Remainder Theorem + * for the RSA private operation. + * + * Uncomment this macro to disable the use of CRT in RSA. + * + */ +//#define MBEDTLS_RSA_NO_CRT + +/** + * \def MBEDTLS_SELF_TEST + * + * Enable the checkup functions (*_self_test). + */ +#define MBEDTLS_SELF_TEST + +/** + * \def MBEDTLS_SHA256_SMALLER + * + * Enable an implementation of SHA-256 that has lower ROM footprint but also + * lower performance. + * + * The default implementation is meant to be a reasonable compromise between + * performance and size. This version optimizes more aggressively for size at + * the expense of performance. Eg on Cortex-M4 it reduces the size of + * mbedtls_sha256_process() from ~2KB to ~0.5KB for a performance hit of about + * 30%. + * + * Uncomment to enable the smaller implementation of SHA256. + */ +//#define MBEDTLS_SHA256_SMALLER + +/** + * \def MBEDTLS_SHA512_SMALLER + * + * Enable an implementation of SHA-512 that has lower ROM footprint but also + * lower performance. + * + * Uncomment to enable the smaller implementation of SHA512. + */ +//#define MBEDTLS_SHA512_SMALLER + +/** + * \def MBEDTLS_SHA512_NO_SHA384 + * + * Disable the SHA-384 option of the SHA-512 module. Use this to save some + * code size on devices that don't use SHA-384. + * + * Requires: MBEDTLS_SHA512_C + * + * Uncomment to disable SHA-384 + */ +//#define MBEDTLS_SHA512_NO_SHA384 + +/** + * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES + * + * Enable sending of alert messages in case of encountered errors as per RFC. + * If you choose not to send the alert messages, mbed TLS can still communicate + * with other servers, only debugging of failures is harder. + * + * The advantage of not sending alert messages, is that no information is given + * about reasons for failures thus preventing adversaries of gaining intel. + * + * Enable sending of all alert messages + */ +#define MBEDTLS_SSL_ALL_ALERT_MESSAGES + +/** + * \def MBEDTLS_SSL_RECORD_CHECKING + * + * Enable the function mbedtls_ssl_check_record() which can be used to check + * the validity and authenticity of an incoming record, to verify that it has + * not been seen before. These checks are performed without modifying the + * externally visible state of the SSL context. + * + * See mbedtls_ssl_check_record() for more information. + * + * Uncomment to enable support for record checking. + */ +#define MBEDTLS_SSL_RECORD_CHECKING + +/** + * \def MBEDTLS_SSL_DTLS_CONNECTION_ID + * + * Enable support for the DTLS Connection ID extension + * (version draft-ietf-tls-dtls-connection-id-05, + * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05) + * which allows to identify DTLS connections across changes + * in the underlying transport. + * + * Setting this option enables the SSL APIs `mbedtls_ssl_set_cid()`, + * `mbedtls_ssl_get_peer_cid()` and `mbedtls_ssl_conf_cid()`. + * See the corresponding documentation for more information. + * + * \warning The Connection ID extension is still in draft state. + * We make no stability promises for the availability + * or the shape of the API controlled by this option. + * + * The maximum lengths of outgoing and incoming CIDs can be configured + * through the options + * - MBEDTLS_SSL_CID_OUT_LEN_MAX + * - MBEDTLS_SSL_CID_IN_LEN_MAX. + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + * + * Uncomment to enable the Connection ID extension. + */ +//#define MBEDTLS_SSL_DTLS_CONNECTION_ID + +/** + * \def MBEDTLS_SSL_ASYNC_PRIVATE + * + * Enable asynchronous external private key operations in SSL. This allows + * you to configure an SSL connection to call an external cryptographic + * module to perform private key operations instead of performing the + * operation inside the library. + * + */ +//#define MBEDTLS_SSL_ASYNC_PRIVATE + +/** + * \def MBEDTLS_SSL_CONTEXT_SERIALIZATION + * + * Enable serialization of the TLS context structures, through use of the + * functions mbedtls_ssl_context_save() and mbedtls_ssl_context_load(). + * + * This pair of functions allows one side of a connection to serialize the + * context associated with the connection, then free or re-use that context + * while the serialized state is persisted elsewhere, and finally deserialize + * that state to a live context for resuming read/write operations on the + * connection. From a protocol perspective, the state of the connection is + * unaffected, in particular this is entirely transparent to the peer. + * + * Note: this is distinct from TLS session resumption, which is part of the + * protocol and fully visible by the peer. TLS session resumption enables + * establishing new connections associated to a saved session with shorter, + * lighter handshakes, while context serialization is a local optimization in + * handling a single, potentially long-lived connection. + * + * Enabling these APIs makes some SSL structures larger, as 64 extra bytes are + * saved after the handshake to allow for more efficient serialization, so if + * you don't need this feature you'll save RAM by disabling it. + * + * Comment to disable the context serialization APIs. + */ +#define MBEDTLS_SSL_CONTEXT_SERIALIZATION + +/** + * \def MBEDTLS_SSL_DEBUG_ALL + * + * Enable the debug messages in SSL module for all issues. + * Debug messages have been disabled in some places to prevent timing + * attacks due to (unbalanced) debugging function calls. + * + * If you need all error reporting you should enable this during debugging, + * but remove this for production servers that should log as well. + * + * Uncomment this macro to report all debug messages on errors introducing + * a timing side-channel. + * + */ +//#define MBEDTLS_SSL_DEBUG_ALL + +/** \def MBEDTLS_SSL_ENCRYPT_THEN_MAC + * + * Enable support for Encrypt-then-MAC, RFC 7366. + * + * This allows peers that both support it to use a more robust protection for + * ciphersuites using CBC, providing deep resistance against timing attacks + * on the padding or underlying cipher. + * + * This only affects CBC ciphersuites, and is useless if none is defined. + * + * Requires: MBEDTLS_SSL_PROTO_TLS1 or + * MBEDTLS_SSL_PROTO_TLS1_1 or + * MBEDTLS_SSL_PROTO_TLS1_2 + * + * Comment this macro to disable support for Encrypt-then-MAC + */ +#define MBEDTLS_SSL_ENCRYPT_THEN_MAC + +/** \def MBEDTLS_SSL_EXTENDED_MASTER_SECRET + * + * Enable support for RFC 7627: Session Hash and Extended Master Secret + * Extension. + * + * This was introduced as "the proper fix" to the Triple Handshake family of + * attacks, but it is recommended to always use it (even if you disable + * renegotiation), since it actually fixes a more fundamental issue in the + * original SSL/TLS design, and has implications beyond Triple Handshake. + * + * Requires: MBEDTLS_SSL_PROTO_TLS1 or + * MBEDTLS_SSL_PROTO_TLS1_1 or + * MBEDTLS_SSL_PROTO_TLS1_2 + * + * Comment this macro to disable support for Extended Master Secret. + */ +#define MBEDTLS_SSL_EXTENDED_MASTER_SECRET + +/** + * \def MBEDTLS_SSL_FALLBACK_SCSV + * + * Enable support for RFC 7507: Fallback Signaling Cipher Suite Value (SCSV) + * for Preventing Protocol Downgrade Attacks. + * + * For servers, it is recommended to always enable this, unless you support + * only one version of TLS, or know for sure that none of your clients + * implements a fallback strategy. + * + * For clients, you only need this if you're using a fallback strategy, which + * is not recommended in the first place, unless you absolutely need it to + * interoperate with buggy (version-intolerant) servers. + * + * Comment this macro to disable support for FALLBACK_SCSV + */ +#define MBEDTLS_SSL_FALLBACK_SCSV + +/** + * \def MBEDTLS_SSL_KEEP_PEER_CERTIFICATE + * + * This option controls the availability of the API mbedtls_ssl_get_peer_cert() + * giving access to the peer's certificate after completion of the handshake. + * + * Unless you need mbedtls_ssl_peer_cert() in your application, it is + * recommended to disable this option for reduced RAM usage. + * + * \note If this option is disabled, mbedtls_ssl_get_peer_cert() is still + * defined, but always returns \c NULL. + * + * \note This option has no influence on the protection against the + * triple handshake attack. Even if it is disabled, Mbed TLS will + * still ensure that certificates do not change during renegotiation, + * for example by keeping a hash of the peer's certificate. + * + * Comment this macro to disable storing the peer's certificate + * after the handshake. + */ +#define MBEDTLS_SSL_KEEP_PEER_CERTIFICATE + +/** + * \def MBEDTLS_SSL_HW_RECORD_ACCEL + * + * Enable hooking functions in SSL module for hardware acceleration of + * individual records. + * + * \deprecated This option is deprecated and will be removed in a future + * version of Mbed TLS. + * + * Uncomment this macro to enable hooking functions. + */ +//#define MBEDTLS_SSL_HW_RECORD_ACCEL + +/** + * \def MBEDTLS_SSL_CBC_RECORD_SPLITTING + * + * Enable 1/n-1 record splitting for CBC mode in SSLv3 and TLS 1.0. + * + * This is a countermeasure to the BEAST attack, which also minimizes the risk + * of interoperability issues compared to sending 0-length records. + * + * Comment this macro to disable 1/n-1 record splitting. + */ +#define MBEDTLS_SSL_CBC_RECORD_SPLITTING + +/** + * \def MBEDTLS_SSL_RENEGOTIATION + * + * Enable support for TLS renegotiation. + * + * The two main uses of renegotiation are (1) refresh keys on long-lived + * connections and (2) client authentication after the initial handshake. + * If you don't need renegotiation, it's probably better to disable it, since + * it has been associated with security issues in the past and is easy to + * misuse/misunderstand. + * + * Comment this to disable support for renegotiation. + * + * \note Even if this option is disabled, both client and server are aware + * of the Renegotiation Indication Extension (RFC 5746) used to + * prevent the SSL renegotiation attack (see RFC 5746 Sect. 1). + * (See \c mbedtls_ssl_conf_legacy_renegotiation for the + * configuration of this extension). + * + */ +#define MBEDTLS_SSL_RENEGOTIATION + +/** + * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO + * + * Enable support for receiving and parsing SSLv2 Client Hello messages for the + * SSL Server module (MBEDTLS_SSL_SRV_C). + * + * \deprecated This option is deprecated and will be removed in a future + * version of Mbed TLS. + * + * Uncomment this macro to enable support for SSLv2 Client Hello messages. + */ +//#define MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO + +/** + * \def MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE + * + * Pick the ciphersuite according to the client's preferences rather than ours + * in the SSL Server module (MBEDTLS_SSL_SRV_C). + * + * Uncomment this macro to respect client's ciphersuite order + */ +//#define MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE + +/** + * \def MBEDTLS_SSL_MAX_FRAGMENT_LENGTH + * + * Enable support for RFC 6066 max_fragment_length extension in SSL. + * + * Comment this macro to disable support for the max_fragment_length extension + */ +#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH + +/** + * \def MBEDTLS_SSL_PROTO_SSL3 + * + * Enable support for SSL 3.0. + * + * Requires: MBEDTLS_MD5_C + * MBEDTLS_SHA1_C + * + * \deprecated This option is deprecated and will be removed in a future + * version of Mbed TLS. + * + * Comment this macro to disable support for SSL 3.0 + */ +//#define MBEDTLS_SSL_PROTO_SSL3 + +/** + * \def MBEDTLS_SSL_PROTO_TLS1 + * + * Enable support for TLS 1.0. + * + * Requires: MBEDTLS_MD5_C + * MBEDTLS_SHA1_C + * + * Comment this macro to disable support for TLS 1.0 + */ +#define MBEDTLS_SSL_PROTO_TLS1 + +/** + * \def MBEDTLS_SSL_PROTO_TLS1_1 + * + * Enable support for TLS 1.1 (and DTLS 1.0 if DTLS is enabled). + * + * Requires: MBEDTLS_MD5_C + * MBEDTLS_SHA1_C + * + * Comment this macro to disable support for TLS 1.1 / DTLS 1.0 + */ +#define MBEDTLS_SSL_PROTO_TLS1_1 + +/** + * \def MBEDTLS_SSL_PROTO_TLS1_2 + * + * Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled). + * + * Requires: MBEDTLS_SHA1_C or MBEDTLS_SHA256_C or MBEDTLS_SHA512_C + * (Depends on ciphersuites) + * + * Comment this macro to disable support for TLS 1.2 / DTLS 1.2 + */ +#define MBEDTLS_SSL_PROTO_TLS1_2 + +/** + * \def MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL + * + * This macro is used to selectively enable experimental parts + * of the code that contribute to the ongoing development of + * the prototype TLS 1.3 and DTLS 1.3 implementation, and provide + * no other purpose. + * + * \warning TLS 1.3 and DTLS 1.3 aren't yet supported in Mbed TLS, + * and no feature exposed through this macro is part of the + * public API. In particular, features under the control + * of this macro are experimental and don't come with any + * stability guarantees. + * + * Uncomment this macro to enable experimental and partial + * functionality specific to TLS 1.3. + */ +//#define MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL + +/** + * \def MBEDTLS_SSL_PROTO_DTLS + * + * Enable support for DTLS (all available versions). + * + * Enable this and MBEDTLS_SSL_PROTO_TLS1_1 to enable DTLS 1.0, + * and/or this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2. + * + * Requires: MBEDTLS_SSL_PROTO_TLS1_1 + * or MBEDTLS_SSL_PROTO_TLS1_2 + * + * Comment this macro to disable support for DTLS + */ +#define MBEDTLS_SSL_PROTO_DTLS + +/** + * \def MBEDTLS_SSL_ALPN + * + * Enable support for RFC 7301 Application Layer Protocol Negotiation. + * + * Comment this macro to disable support for ALPN. + */ +#define MBEDTLS_SSL_ALPN + +/** + * \def MBEDTLS_SSL_DTLS_ANTI_REPLAY + * + * Enable support for the anti-replay mechanism in DTLS. + * + * Requires: MBEDTLS_SSL_TLS_C + * MBEDTLS_SSL_PROTO_DTLS + * + * \warning Disabling this is often a security risk! + * See mbedtls_ssl_conf_dtls_anti_replay() for details. + * + * Comment this to disable anti-replay in DTLS. + */ +#define MBEDTLS_SSL_DTLS_ANTI_REPLAY + +/** + * \def MBEDTLS_SSL_DTLS_HELLO_VERIFY + * + * Enable support for HelloVerifyRequest on DTLS servers. + * + * This feature is highly recommended to prevent DTLS servers being used as + * amplifiers in DoS attacks against other hosts. It should always be enabled + * unless you know for sure amplification cannot be a problem in the + * environment in which your server operates. + * + * \warning Disabling this can be a security risk! (see above) + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + * + * Comment this to disable support for HelloVerifyRequest. + */ +#define MBEDTLS_SSL_DTLS_HELLO_VERIFY + +/** + * \def MBEDTLS_SSL_DTLS_SRTP + * + * Enable support for negotiation of DTLS-SRTP (RFC 5764) + * through the use_srtp extension. + * + * \note This feature provides the minimum functionality required + * to negotiate the use of DTLS-SRTP and to allow the derivation of + * the associated SRTP packet protection key material. + * In particular, the SRTP packet protection itself, as well as the + * demultiplexing of RTP and DTLS packets at the datagram layer + * (see Section 5 of RFC 5764), are not handled by this feature. + * Instead, after successful completion of a handshake negotiating + * the use of DTLS-SRTP, the extended key exporter API + * mbedtls_ssl_conf_export_keys_ext_cb() should be used to implement + * the key exporter described in Section 4.2 of RFC 5764 and RFC 5705 + * (this is implemented in the SSL example programs). + * The resulting key should then be passed to an SRTP stack. + * + * Setting this option enables the runtime API + * mbedtls_ssl_conf_dtls_srtp_protection_profiles() + * through which the supported DTLS-SRTP protection + * profiles can be configured. You must call this API at + * runtime if you wish to negotiate the use of DTLS-SRTP. + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + * + * Uncomment this to enable support for use_srtp extension. + */ +//#define MBEDTLS_SSL_DTLS_SRTP + +/** + * \def MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE + * + * Enable server-side support for clients that reconnect from the same port. + * + * Some clients unexpectedly close the connection and try to reconnect using the + * same source port. This needs special support from the server to handle the + * new connection securely, as described in section 4.2.8 of RFC 6347. This + * flag enables that support. + * + * Requires: MBEDTLS_SSL_DTLS_HELLO_VERIFY + * + * Comment this to disable support for clients reusing the source port. + */ +#define MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE + +/** + * \def MBEDTLS_SSL_DTLS_BADMAC_LIMIT + * + * Enable support for a limit of records with bad MAC. + * + * See mbedtls_ssl_conf_dtls_badmac_limit(). + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + */ +#define MBEDTLS_SSL_DTLS_BADMAC_LIMIT + +/** + * \def MBEDTLS_SSL_SESSION_TICKETS + * + * Enable support for RFC 5077 session tickets in SSL. + * Client-side, provides full support for session tickets (maintenance of a + * session store remains the responsibility of the application, though). + * Server-side, you also need to provide callbacks for writing and parsing + * tickets, including authenticated encryption and key management. Example + * callbacks are provided by MBEDTLS_SSL_TICKET_C. + * + * Comment this macro to disable support for SSL session tickets + */ +#define MBEDTLS_SSL_SESSION_TICKETS + +/** + * \def MBEDTLS_SSL_EXPORT_KEYS + * + * Enable support for exporting key block and master secret. + * This is required for certain users of TLS, e.g. EAP-TLS. + * + * Comment this macro to disable support for key export + */ +#define MBEDTLS_SSL_EXPORT_KEYS + +/** + * \def MBEDTLS_SSL_SERVER_NAME_INDICATION + * + * Enable support for RFC 6066 server name indication (SNI) in SSL. + * + * Requires: MBEDTLS_X509_CRT_PARSE_C + * + * Comment this macro to disable support for server name indication in SSL + */ +#define MBEDTLS_SSL_SERVER_NAME_INDICATION + +/** + * \def MBEDTLS_SSL_TRUNCATED_HMAC + * + * Enable support for RFC 6066 truncated HMAC in SSL. + * + * Comment this macro to disable support for truncated HMAC in SSL + */ +#define MBEDTLS_SSL_TRUNCATED_HMAC + +/** + * \def MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT + * + * Fallback to old (pre-2.7), non-conforming implementation of the truncated + * HMAC extension which also truncates the HMAC key. Note that this option is + * only meant for a transitory upgrade period and will be removed in a future + * version of the library. + * + * \warning The old implementation is non-compliant and has a security weakness + * (2^80 brute force attack on the HMAC key used for a single, + * uninterrupted connection). This should only be enabled temporarily + * when (1) the use of truncated HMAC is essential in order to save + * bandwidth, and (2) the peer is an Mbed TLS stack that doesn't use + * the fixed implementation yet (pre-2.7). + * + * \deprecated This option is deprecated and will be removed in a + * future version of Mbed TLS. + * + * Uncomment to fallback to old, non-compliant truncated HMAC implementation. + * + * Requires: MBEDTLS_SSL_TRUNCATED_HMAC + */ +//#define MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT + +/** + * \def MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH + * + * When this option is enabled, the SSL buffer will be resized automatically + * based on the negotiated maximum fragment length in each direction. + * + * Requires: MBEDTLS_SSL_MAX_FRAGMENT_LENGTH + */ +//#define MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH + +/** + * \def MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN + * + * Enable testing of the constant-flow nature of some sensitive functions with + * clang's MemorySanitizer. This causes some existing tests to also test + * this non-functional property of the code under test. + * + * This setting requires compiling with clang -fsanitize=memory. The test + * suites can then be run normally. + * + * \warning This macro is only used for extended testing; it is not considered + * part of the library's API, so it may change or disappear at any time. + * + * Uncomment to enable testing of the constant-flow nature of selected code. + */ +//#define MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN + +/** + * \def MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND + * + * Enable testing of the constant-flow nature of some sensitive functions with + * valgrind's memcheck tool. This causes some existing tests to also test + * this non-functional property of the code under test. + * + * This setting requires valgrind headers for building, and is only useful for + * testing if the tests suites are run with valgrind's memcheck. This can be + * done for an individual test suite with 'valgrind ./test_suite_xxx', or when + * using CMake, this can be done for all test suites with 'make memcheck'. + * + * \warning This macro is only used for extended testing; it is not considered + * part of the library's API, so it may change or disappear at any time. + * + * Uncomment to enable testing of the constant-flow nature of selected code. + */ +//#define MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND + +/** + * \def MBEDTLS_TEST_HOOKS + * + * Enable features for invasive testing such as introspection functions and + * hooks for fault injection. This enables additional unit tests. + * + * Merely enabling this feature should not change the behavior of the product. + * It only adds new code, and new branching points where the default behavior + * is the same as when this feature is disabled. + * However, this feature increases the attack surface: there is an added + * risk of vulnerabilities, and more gadgets that can make exploits easier. + * Therefore this feature must never be enabled in production. + * + * See `docs/architecture/testing/mbed-crypto-invasive-testing.md` for more + * information. + * + * Uncomment to enable invasive tests. + */ +//#define MBEDTLS_TEST_HOOKS + +/** + * \def MBEDTLS_THREADING_ALT + * + * Provide your own alternate threading implementation. + * + * Requires: MBEDTLS_THREADING_C + * + * Uncomment this to allow your own alternate threading implementation. + */ +//#define MBEDTLS_THREADING_ALT + +/** + * \def MBEDTLS_THREADING_PTHREAD + * + * Enable the pthread wrapper layer for the threading layer. + * + * Requires: MBEDTLS_THREADING_C + * + * Uncomment this to enable pthread mutexes. + */ +//#define MBEDTLS_THREADING_PTHREAD + +/** + * \def MBEDTLS_USE_PSA_CRYPTO + * + * Make the X.509 and TLS library use PSA for cryptographic operations, and + * enable new APIs for using keys handled by PSA Crypto. + * + * \note Development of this option is currently in progress, and parts of Mbed + * TLS's X.509 and TLS modules are not ported to PSA yet. However, these parts + * will still continue to work as usual, so enabling this option should not + * break backwards compatibility. + * + * \note See docs/use-psa-crypto.md for a complete description of what this + * option currently does, and of parts that are not affected by it so far. + * + * \warning This option enables new Mbed TLS APIs which are currently + * considered experimental and may change in incompatible ways at any time. + * That is, the APIs enabled by this option are not covered by the usual + * promises of API stability. + * + * Requires: MBEDTLS_PSA_CRYPTO_C. + * + * Uncomment this to enable internal use of PSA Crypto and new associated APIs. + */ +//#define MBEDTLS_USE_PSA_CRYPTO + +/** + * \def MBEDTLS_PSA_CRYPTO_CONFIG + * + * This setting allows support for cryptographic mechanisms through the PSA + * API to be configured separately from support through the mbedtls API. + * + * When this option is disabled, the PSA API exposes the cryptographic + * mechanisms that can be implemented on top of the `mbedtls_xxx` API + * configured with `MBEDTLS_XXX` symbols. + * + * When this option is enabled, the PSA API exposes the cryptographic + * mechanisms requested by the `PSA_WANT_XXX` symbols defined in + * include/psa/crypto_config.h. The corresponding `MBEDTLS_XXX` settings are + * automatically enabled if required (i.e. if no PSA driver provides the + * mechanism). You may still freely enable additional `MBEDTLS_XXX` symbols + * in config.h. + * + * If the symbol #MBEDTLS_PSA_CRYPTO_CONFIG_FILE is defined, it specifies + * an alternative header to include instead of include/psa/crypto_config.h. + * + * If you enable this option and write your own configuration file, you must + * include mbedtls/config_psa.h in your configuration file. The default + * provided mbedtls/config.h contains the necessary inclusion. + * + * This feature is still experimental and is not ready for production since + * it is not completed. + */ +//#define MBEDTLS_PSA_CRYPTO_CONFIG + +/** + * \def MBEDTLS_VERSION_FEATURES + * + * Allow run-time checking of compile-time enabled features. Thus allowing users + * to check at run-time if the library is for instance compiled with threading + * support via mbedtls_version_check_feature(). + * + * Requires: MBEDTLS_VERSION_C + * + * Comment this to disable run-time checking and save ROM space + */ +#define MBEDTLS_VERSION_FEATURES + +/** + * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 + * + * If set, the X509 parser will not break-off when parsing an X509 certificate + * and encountering an extension in a v1 or v2 certificate. + * + * Uncomment to prevent an error. + */ +//#define MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 + +/** + * \def MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION + * + * If set, the X509 parser will not break-off when parsing an X509 certificate + * and encountering an unknown critical extension. + * + * \warning Depending on your PKI use, enabling this can be a security risk! + * + * Uncomment to prevent an error. + */ +//#define MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION + +/** + * \def MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK + * + * If set, this enables the X.509 API `mbedtls_x509_crt_verify_with_ca_cb()` + * and the SSL API `mbedtls_ssl_conf_ca_cb()` which allow users to configure + * the set of trusted certificates through a callback instead of a linked + * list. + * + * This is useful for example in environments where a large number of trusted + * certificates is present and storing them in a linked list isn't efficient + * enough, or when the set of trusted certificates changes frequently. + * + * See the documentation of `mbedtls_x509_crt_verify_with_ca_cb()` and + * `mbedtls_ssl_conf_ca_cb()` for more information. + * + * Uncomment to enable trusted certificate callbacks. + */ +//#define MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK + +/** + * \def MBEDTLS_X509_CHECK_KEY_USAGE + * + * Enable verification of the keyUsage extension (CA and leaf certificates). + * + * Disabling this avoids problems with mis-issued and/or misused + * (intermediate) CA and leaf certificates. + * + * \warning Depending on your PKI use, disabling this can be a security risk! + * + * Comment to skip keyUsage checking for both CA and leaf certificates. + */ +#define MBEDTLS_X509_CHECK_KEY_USAGE + +/** + * \def MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE + * + * Enable verification of the extendedKeyUsage extension (leaf certificates). + * + * Disabling this avoids problems with mis-issued and/or misused certificates. + * + * \warning Depending on your PKI use, disabling this can be a security risk! + * + * Comment to skip extendedKeyUsage checking for certificates. + */ +#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE + +/** + * \def MBEDTLS_X509_RSASSA_PSS_SUPPORT + * + * Enable parsing and verification of X.509 certificates, CRLs and CSRS + * signed with RSASSA-PSS (aka PKCS#1 v2.1). + * + * Comment this macro to disallow using RSASSA-PSS in certificates. + */ +#define MBEDTLS_X509_RSASSA_PSS_SUPPORT + +/** + * \def MBEDTLS_ZLIB_SUPPORT + * + * If set, the SSL/TLS module uses ZLIB to support compression and + * decompression of packet data. + * + * \warning TLS-level compression MAY REDUCE SECURITY! See for example the + * CRIME attack. Before enabling this option, you should examine with care if + * CRIME or similar exploits may be applicable to your use case. + * + * \note Currently compression can't be used with DTLS. + * + * \deprecated This feature is deprecated and will be removed + * in the next major revision of the library. + * + * Used in: library/ssl_tls.c + * library/ssl_cli.c + * library/ssl_srv.c + * + * This feature requires zlib library and headers to be present. + * + * Uncomment to enable use of ZLIB + */ +//#define MBEDTLS_ZLIB_SUPPORT +/** \} name SECTION: mbed TLS feature support */ + +/** + * \name SECTION: mbed TLS modules + * + * This section enables or disables entire modules in mbed TLS + * \{ + */ + +/** + * \def MBEDTLS_AESNI_C + * + * Enable AES-NI support on x86-64. + * + * Module: library/aesni.c + * Caller: library/aes.c + * + * Requires: MBEDTLS_HAVE_ASM + * + * This modules adds support for the AES-NI instructions on x86-64 + */ +#define MBEDTLS_AESNI_C + +/** + * \def MBEDTLS_AES_C + * + * Enable the AES block cipher. + * + * Module: library/aes.c + * Caller: library/cipher.c + * library/pem.c + * library/ctr_drbg.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA + * + * PEM_PARSE uses AES for decrypting encrypted keys. + */ +#define MBEDTLS_AES_C + +/** + * \def MBEDTLS_ARC4_C + * + * Enable the ARCFOUR stream cipher. + * + * Module: library/arc4.c + * Caller: library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA + * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 + * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA + * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. If possible, we recommend avoidng dependencies on + * it, and considering stronger ciphers instead. + * + */ +#define MBEDTLS_ARC4_C + +/** + * \def MBEDTLS_ASN1_PARSE_C + * + * Enable the generic ASN1 parser. + * + * Module: library/asn1.c + * Caller: library/x509.c + * library/dhm.c + * library/pkcs12.c + * library/pkcs5.c + * library/pkparse.c + */ +#define MBEDTLS_ASN1_PARSE_C + +/** + * \def MBEDTLS_ASN1_WRITE_C + * + * Enable the generic ASN1 writer. + * + * Module: library/asn1write.c + * Caller: library/ecdsa.c + * library/pkwrite.c + * library/x509_create.c + * library/x509write_crt.c + * library/x509write_csr.c + */ +#define MBEDTLS_ASN1_WRITE_C + +/** + * \def MBEDTLS_BASE64_C + * + * Enable the Base64 module. + * + * Module: library/base64.c + * Caller: library/pem.c + * + * This module is required for PEM support (required by X.509). + */ +#define MBEDTLS_BASE64_C + +/** + * \def MBEDTLS_BIGNUM_C + * + * Enable the multi-precision integer library. + * + * Module: library/bignum.c + * Caller: library/dhm.c + * library/ecp.c + * library/ecdsa.c + * library/rsa.c + * library/rsa_internal.c + * library/ssl_tls.c + * + * This module is required for RSA, DHM and ECC (ECDH, ECDSA) support. + */ +#define MBEDTLS_BIGNUM_C + +/** + * \def MBEDTLS_BLOWFISH_C + * + * Enable the Blowfish block cipher. + * + * Module: library/blowfish.c + */ +#define MBEDTLS_BLOWFISH_C + +/** + * \def MBEDTLS_CAMELLIA_C + * + * Enable the Camellia block cipher. + * + * Module: library/camellia.c + * Caller: library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 + */ +#define MBEDTLS_CAMELLIA_C + +/** + * \def MBEDTLS_ARIA_C + * + * Enable the ARIA block cipher. + * + * Module: library/aria.c + * Caller: library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * + * MBEDTLS_TLS_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384 + */ +//#define MBEDTLS_ARIA_C + +/** + * \def MBEDTLS_CCM_C + * + * Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher. + * + * Module: library/ccm.c + * + * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C + * + * This module enables the AES-CCM ciphersuites, if other requisites are + * enabled as well. + */ +#define MBEDTLS_CCM_C + +/** + * \def MBEDTLS_CERTS_C + * + * Enable the test certificates. + * + * Module: library/certs.c + * Caller: + * + * This module is used for testing (ssl_client/server). + */ +#define MBEDTLS_CERTS_C + +/** + * \def MBEDTLS_CHACHA20_C + * + * Enable the ChaCha20 stream cipher. + * + * Module: library/chacha20.c + */ +#define MBEDTLS_CHACHA20_C + +/** + * \def MBEDTLS_CHACHAPOLY_C + * + * Enable the ChaCha20-Poly1305 AEAD algorithm. + * + * Module: library/chachapoly.c + * + * This module requires: MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C + */ +#define MBEDTLS_CHACHAPOLY_C + +/** + * \def MBEDTLS_CIPHER_C + * + * Enable the generic cipher layer. + * + * Module: library/cipher.c + * Caller: library/ssl_tls.c + * + * Uncomment to enable generic cipher wrappers. + */ +#define MBEDTLS_CIPHER_C + +/** + * \def MBEDTLS_CMAC_C + * + * Enable the CMAC (Cipher-based Message Authentication Code) mode for block + * ciphers. + * + * \note When #MBEDTLS_CMAC_ALT is active, meaning that the underlying + * implementation of the CMAC algorithm is provided by an alternate + * implementation, that alternate implementation may opt to not support + * AES-192 or 3DES as underlying block ciphers for the CMAC operation. + * + * Module: library/cmac.c + * + * Requires: MBEDTLS_AES_C or MBEDTLS_DES_C + * + */ +//#define MBEDTLS_CMAC_C + +/** + * \def MBEDTLS_CTR_DRBG_C + * + * Enable the CTR_DRBG AES-based random generator. + * The CTR_DRBG generator uses AES-256 by default. + * To use AES-128 instead, enable \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY above. + * + * \note To achieve a 256-bit security strength with CTR_DRBG, + * you must use AES-256 *and* use sufficient entropy. + * See ctr_drbg.h for more details. + * + * Module: library/ctr_drbg.c + * Caller: + * + * Requires: MBEDTLS_AES_C + * + * This module provides the CTR_DRBG AES random number generator. + */ +#define MBEDTLS_CTR_DRBG_C + +/** + * \def MBEDTLS_DEBUG_C + * + * Enable the debug functions. + * + * Module: library/debug.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * + * This module provides debugging functions. + */ +#define MBEDTLS_DEBUG_C + +/** + * \def MBEDTLS_DES_C + * + * Enable the DES block cipher. + * + * Module: library/des.c + * Caller: library/pem.c + * library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA + * + * PEM_PARSE uses DES/3DES for decrypting encrypted keys. + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers instead. + */ +#define MBEDTLS_DES_C + +/** + * \def MBEDTLS_DHM_C + * + * Enable the Diffie-Hellman-Merkle module. + * + * Module: library/dhm.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * + * This module is used by the following key exchanges: + * DHE-RSA, DHE-PSK + * + * \warning Using DHE constitutes a security risk as it + * is not possible to validate custom DH parameters. + * If possible, it is recommended users should consider + * preferring other methods of key exchange. + * See dhm.h for more details. + * + */ +#define MBEDTLS_DHM_C + +/** + * \def MBEDTLS_ECDH_C + * + * Enable the elliptic curve Diffie-Hellman library. + * + * Module: library/ecdh.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * + * This module is used by the following key exchanges: + * ECDHE-ECDSA, ECDHE-RSA, DHE-PSK + * + * Requires: MBEDTLS_ECP_C + */ +#define MBEDTLS_ECDH_C + +/** + * \def MBEDTLS_ECDSA_C + * + * Enable the elliptic curve DSA library. + * + * Module: library/ecdsa.c + * Caller: + * + * This module is used by the following key exchanges: + * ECDHE-ECDSA + * + * Requires: MBEDTLS_ECP_C, MBEDTLS_ASN1_WRITE_C, MBEDTLS_ASN1_PARSE_C, + * and at least one MBEDTLS_ECP_DP_XXX_ENABLED for a + * short Weierstrass curve. + */ +#define MBEDTLS_ECDSA_C + +/** + * \def MBEDTLS_ECJPAKE_C + * + * Enable the elliptic curve J-PAKE library. + * + * \warning This is currently experimental. EC J-PAKE support is based on the + * Thread v1.0.0 specification; incompatible changes to the specification + * might still happen. For this reason, this is disabled by default. + * + * Module: library/ecjpake.c + * Caller: + * + * This module is used by the following key exchanges: + * ECJPAKE + * + * Requires: MBEDTLS_ECP_C, MBEDTLS_MD_C + */ +//#define MBEDTLS_ECJPAKE_C + +/** + * \def MBEDTLS_ECP_C + * + * Enable the elliptic curve over GF(p) library. + * + * Module: library/ecp.c + * Caller: library/ecdh.c + * library/ecdsa.c + * library/ecjpake.c + * + * Requires: MBEDTLS_BIGNUM_C and at least one MBEDTLS_ECP_DP_XXX_ENABLED + */ +#define MBEDTLS_ECP_C + +/** + * \def MBEDTLS_ENTROPY_C + * + * Enable the platform-specific entropy code. + * + * Module: library/entropy.c + * Caller: + * + * Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C + * + * This module provides a generic entropy pool + */ +#define MBEDTLS_ENTROPY_C + +/** + * \def MBEDTLS_ERROR_C + * + * Enable error code to error string conversion. + * + * Module: library/error.c + * Caller: + * + * This module enables mbedtls_strerror(). + */ +#define MBEDTLS_ERROR_C + +/** + * \def MBEDTLS_GCM_C + * + * Enable the Galois/Counter Mode (GCM). + * + * Module: library/gcm.c + * + * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C or MBEDTLS_ARIA_C + * + * This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other + * requisites are enabled as well. + */ +#define MBEDTLS_GCM_C + +/** + * \def MBEDTLS_HAVEGE_C + * + * Enable the HAVEGE random generator. + * + * Warning: the HAVEGE random generator is not suitable for virtualized + * environments + * + * Warning: the HAVEGE random generator is dependent on timing and specific + * processor traits. It is therefore not advised to use HAVEGE as + * your applications primary random generator or primary entropy pool + * input. As a secondary input to your entropy pool, it IS able add + * the (limited) extra entropy it provides. + * + * Module: library/havege.c + * Caller: + * + * Requires: MBEDTLS_TIMING_C + * + * Uncomment to enable the HAVEGE random generator. + */ +//#define MBEDTLS_HAVEGE_C + +/** + * \def MBEDTLS_HKDF_C + * + * Enable the HKDF algorithm (RFC 5869). + * + * Module: library/hkdf.c + * Caller: + * + * Requires: MBEDTLS_MD_C + * + * This module adds support for the Hashed Message Authentication Code + * (HMAC)-based key derivation function (HKDF). + */ +#define MBEDTLS_HKDF_C + +/** + * \def MBEDTLS_HMAC_DRBG_C + * + * Enable the HMAC_DRBG random generator. + * + * Module: library/hmac_drbg.c + * Caller: + * + * Requires: MBEDTLS_MD_C + * + * Uncomment to enable the HMAC_DRBG random number generator. + */ +#define MBEDTLS_HMAC_DRBG_C + +/** + * \def MBEDTLS_NIST_KW_C + * + * Enable the Key Wrapping mode for 128-bit block ciphers, + * as defined in NIST SP 800-38F. Only KW and KWP modes + * are supported. At the moment, only AES is approved by NIST. + * + * Module: library/nist_kw.c + * + * Requires: MBEDTLS_AES_C and MBEDTLS_CIPHER_C + */ +//#define MBEDTLS_NIST_KW_C + +/** + * \def MBEDTLS_MD_C + * + * Enable the generic message digest layer. + * + * Module: library/md.c + * Caller: + * + * Uncomment to enable generic message digest wrappers. + */ +#define MBEDTLS_MD_C + +/** + * \def MBEDTLS_MD2_C + * + * Enable the MD2 hash algorithm. + * + * Module: library/md2.c + * Caller: + * + * Uncomment to enable support for (rare) MD2-signed X.509 certs. + * + * \warning MD2 is considered a weak message digest and its use constitutes a + * security risk. If possible, we recommend avoiding dependencies on + * it, and considering stronger message digests instead. + * + */ +//#define MBEDTLS_MD2_C + +/** + * \def MBEDTLS_MD4_C + * + * Enable the MD4 hash algorithm. + * + * Module: library/md4.c + * Caller: + * + * Uncomment to enable support for (rare) MD4-signed X.509 certs. + * + * \warning MD4 is considered a weak message digest and its use constitutes a + * security risk. If possible, we recommend avoiding dependencies on + * it, and considering stronger message digests instead. + * + */ +//#define MBEDTLS_MD4_C + +/** + * \def MBEDTLS_MD5_C + * + * Enable the MD5 hash algorithm. + * + * Module: library/md5.c + * Caller: library/md.c + * library/pem.c + * library/ssl_tls.c + * + * This module is required for SSL/TLS up to version 1.1, and for TLS 1.2 + * depending on the handshake parameters. Further, it is used for checking + * MD5-signed certificates, and for PBKDF1 when decrypting PEM-encoded + * encrypted keys. + * + * \warning MD5 is considered a weak message digest and its use constitutes a + * security risk. If possible, we recommend avoiding dependencies on + * it, and considering stronger message digests instead. + * + */ +#define MBEDTLS_MD5_C + +/** + * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C + * + * Enable the buffer allocator implementation that makes use of a (stack) + * based buffer to 'allocate' dynamic memory. (replaces calloc() and free() + * calls) + * + * Module: library/memory_buffer_alloc.c + * + * Requires: MBEDTLS_PLATFORM_C + * MBEDTLS_PLATFORM_MEMORY (to use it within mbed TLS) + * + * Enable this module to enable the buffer memory allocator. + */ +//#define MBEDTLS_MEMORY_BUFFER_ALLOC_C + +/** + * \def MBEDTLS_NET_C + * + * Enable the TCP and UDP over IPv6/IPv4 networking routines. + * + * \note This module only works on POSIX/Unix (including Linux, BSD and OS X) + * and Windows. For other platforms, you'll want to disable it, and write your + * own networking callbacks to be passed to \c mbedtls_ssl_set_bio(). + * + * \note See also our Knowledge Base article about porting to a new + * environment: + * https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS + * + * Module: library/net_sockets.c + * + * This module provides networking routines. + */ +#define MBEDTLS_NET_C + +/** + * \def MBEDTLS_OID_C + * + * Enable the OID database. + * + * Module: library/oid.c + * Caller: library/asn1write.c + * library/pkcs5.c + * library/pkparse.c + * library/pkwrite.c + * library/rsa.c + * library/x509.c + * library/x509_create.c + * library/x509_crl.c + * library/x509_crt.c + * library/x509_csr.c + * library/x509write_crt.c + * library/x509write_csr.c + * + * This modules translates between OIDs and internal values. + */ +#define MBEDTLS_OID_C + +/** + * \def MBEDTLS_PADLOCK_C + * + * Enable VIA Padlock support on x86. + * + * Module: library/padlock.c + * Caller: library/aes.c + * + * Requires: MBEDTLS_HAVE_ASM + * + * This modules adds support for the VIA PadLock on x86. + */ +#define MBEDTLS_PADLOCK_C + +/** + * \def MBEDTLS_PEM_PARSE_C + * + * Enable PEM decoding / parsing. + * + * Module: library/pem.c + * Caller: library/dhm.c + * library/pkparse.c + * library/x509_crl.c + * library/x509_crt.c + * library/x509_csr.c + * + * Requires: MBEDTLS_BASE64_C + * + * This modules adds support for decoding / parsing PEM files. + */ +#define MBEDTLS_PEM_PARSE_C + +/** + * \def MBEDTLS_PEM_WRITE_C + * + * Enable PEM encoding / writing. + * + * Module: library/pem.c + * Caller: library/pkwrite.c + * library/x509write_crt.c + * library/x509write_csr.c + * + * Requires: MBEDTLS_BASE64_C + * + * This modules adds support for encoding / writing PEM files. + */ +#define MBEDTLS_PEM_WRITE_C + +/** + * \def MBEDTLS_PK_C + * + * Enable the generic public (asymmetric) key layer. + * + * Module: library/pk.c + * Caller: library/ssl_tls.c + * library/ssl_cli.c + * library/ssl_srv.c + * + * Requires: MBEDTLS_RSA_C or MBEDTLS_ECP_C + * + * Uncomment to enable generic public key wrappers. + */ +#define MBEDTLS_PK_C + +/** + * \def MBEDTLS_PK_PARSE_C + * + * Enable the generic public (asymmetric) key parser. + * + * Module: library/pkparse.c + * Caller: library/x509_crt.c + * library/x509_csr.c + * + * Requires: MBEDTLS_PK_C + * + * Uncomment to enable generic public key parse functions. + */ +#define MBEDTLS_PK_PARSE_C + +/** + * \def MBEDTLS_PK_WRITE_C + * + * Enable the generic public (asymmetric) key writer. + * + * Module: library/pkwrite.c + * Caller: library/x509write.c + * + * Requires: MBEDTLS_PK_C + * + * Uncomment to enable generic public key write functions. + */ +#define MBEDTLS_PK_WRITE_C + +/** + * \def MBEDTLS_PKCS5_C + * + * Enable PKCS#5 functions. + * + * Module: library/pkcs5.c + * + * Requires: MBEDTLS_MD_C + * + * This module adds support for the PKCS#5 functions. + */ +#define MBEDTLS_PKCS5_C + +/** + * \def MBEDTLS_PKCS11_C + * + * Enable wrapper for PKCS#11 smartcard support via the pkcs11-helper library. + * + * \deprecated This option is deprecated and will be removed in a future + * version of Mbed TLS. + * + * Module: library/pkcs11.c + * Caller: library/pk.c + * + * Requires: MBEDTLS_PK_C + * + * This module enables SSL/TLS PKCS #11 smartcard support. + * Requires the presence of the PKCS#11 helper library (libpkcs11-helper) + */ +//#define MBEDTLS_PKCS11_C + +/** + * \def MBEDTLS_PKCS12_C + * + * Enable PKCS#12 PBE functions. + * Adds algorithms for parsing PKCS#8 encrypted private keys + * + * Module: library/pkcs12.c + * Caller: library/pkparse.c + * + * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_CIPHER_C, MBEDTLS_MD_C + * Can use: MBEDTLS_ARC4_C + * + * This module enables PKCS#12 functions. + */ +#define MBEDTLS_PKCS12_C + +/** + * \def MBEDTLS_PLATFORM_C + * + * Enable the platform abstraction layer that allows you to re-assign + * functions like calloc(), free(), snprintf(), printf(), fprintf(), exit(). + * + * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT + * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned + * above to be specified at runtime or compile time respectively. + * + * \note This abstraction layer must be enabled on Windows (including MSYS2) + * as other module rely on it for a fixed snprintf implementation. + * + * Module: library/platform.c + * Caller: Most other .c files + * + * This module enables abstraction of common (libc) functions. + */ +#define MBEDTLS_PLATFORM_C + +/** + * \def MBEDTLS_POLY1305_C + * + * Enable the Poly1305 MAC algorithm. + * + * Module: library/poly1305.c + * Caller: library/chachapoly.c + */ +#define MBEDTLS_POLY1305_C + +/** + * \def MBEDTLS_PSA_CRYPTO_C + * + * Enable the Platform Security Architecture cryptography API. + * + * Module: library/psa_crypto.c + * + * Requires: either MBEDTLS_CTR_DRBG_C and MBEDTLS_ENTROPY_C, + * or MBEDTLS_HMAC_DRBG_C and MBEDTLS_ENTROPY_C, + * or MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. + * + */ +#define MBEDTLS_PSA_CRYPTO_C + +/** + * \def MBEDTLS_PSA_CRYPTO_SE_C + * + * Enable secure element support in the Platform Security Architecture + * cryptography API. + * + * \warning This feature is not yet suitable for production. It is provided + * for API evaluation and testing purposes only. + * + * Module: library/psa_crypto_se.c + * + * Requires: MBEDTLS_PSA_CRYPTO_C, MBEDTLS_PSA_CRYPTO_STORAGE_C + * + */ +//#define MBEDTLS_PSA_CRYPTO_SE_C + +/** + * \def MBEDTLS_PSA_CRYPTO_STORAGE_C + * + * Enable the Platform Security Architecture persistent key storage. + * + * Module: library/psa_crypto_storage.c + * + * Requires: MBEDTLS_PSA_CRYPTO_C, + * either MBEDTLS_PSA_ITS_FILE_C or a native implementation of + * the PSA ITS interface + */ +#define MBEDTLS_PSA_CRYPTO_STORAGE_C + +/** + * \def MBEDTLS_PSA_ITS_FILE_C + * + * Enable the emulation of the Platform Security Architecture + * Internal Trusted Storage (PSA ITS) over files. + * + * Module: library/psa_its_file.c + * + * Requires: MBEDTLS_FS_IO + */ +#define MBEDTLS_PSA_ITS_FILE_C + +/** + * \def MBEDTLS_RIPEMD160_C + * + * Enable the RIPEMD-160 hash algorithm. + * + * Module: library/ripemd160.c + * Caller: library/md.c + * + */ +#define MBEDTLS_RIPEMD160_C + +/** + * \def MBEDTLS_RSA_C + * + * Enable the RSA public-key cryptosystem. + * + * Module: library/rsa.c + * library/rsa_internal.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * library/x509.c + * + * This module is used by the following key exchanges: + * RSA, DHE-RSA, ECDHE-RSA, RSA-PSK + * + * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C + */ +#define MBEDTLS_RSA_C + +/** + * \def MBEDTLS_SHA1_C + * + * Enable the SHA1 cryptographic hash algorithm. + * + * Module: library/sha1.c + * Caller: library/md.c + * library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * library/x509write_crt.c + * + * This module is required for SSL/TLS up to version 1.1, for TLS 1.2 + * depending on the handshake parameters, and for SHA1-signed certificates. + * + * \warning SHA-1 is considered a weak message digest and its use constitutes + * a security risk. If possible, we recommend avoiding dependencies + * on it, and considering stronger message digests instead. + * + */ +#define MBEDTLS_SHA1_C + +/** + * \def MBEDTLS_SHA256_C + * + * Enable the SHA-224 and SHA-256 cryptographic hash algorithms. + * + * Module: library/sha256.c + * Caller: library/entropy.c + * library/md.c + * library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * + * This module adds support for SHA-224 and SHA-256. + * This module is required for the SSL/TLS 1.2 PRF function. + */ +#define MBEDTLS_SHA256_C + +/** + * \def MBEDTLS_SHA512_C + * + * Enable the SHA-384 and SHA-512 cryptographic hash algorithms. + * + * Module: library/sha512.c + * Caller: library/entropy.c + * library/md.c + * library/ssl_cli.c + * library/ssl_srv.c + * + * This module adds support for SHA-384 and SHA-512. + */ +#define MBEDTLS_SHA512_C + +/** + * \def MBEDTLS_SSL_CACHE_C + * + * Enable simple SSL cache implementation. + * + * Module: library/ssl_cache.c + * Caller: + * + * Requires: MBEDTLS_SSL_CACHE_C + */ +#define MBEDTLS_SSL_CACHE_C + +/** + * \def MBEDTLS_SSL_COOKIE_C + * + * Enable basic implementation of DTLS cookies for hello verification. + * + * Module: library/ssl_cookie.c + * Caller: + */ +#define MBEDTLS_SSL_COOKIE_C + +/** + * \def MBEDTLS_SSL_TICKET_C + * + * Enable an implementation of TLS server-side callbacks for session tickets. + * + * Module: library/ssl_ticket.c + * Caller: + * + * Requires: MBEDTLS_CIPHER_C + */ +#define MBEDTLS_SSL_TICKET_C + +/** + * \def MBEDTLS_SSL_CLI_C + * + * Enable the SSL/TLS client code. + * + * Module: library/ssl_cli.c + * Caller: + * + * Requires: MBEDTLS_SSL_TLS_C + * + * This module is required for SSL/TLS client support. + */ +#define MBEDTLS_SSL_CLI_C + +/** + * \def MBEDTLS_SSL_SRV_C + * + * Enable the SSL/TLS server code. + * + * Module: library/ssl_srv.c + * Caller: + * + * Requires: MBEDTLS_SSL_TLS_C + * + * This module is required for SSL/TLS server support. + */ +#define MBEDTLS_SSL_SRV_C + +/** + * \def MBEDTLS_SSL_TLS_C + * + * Enable the generic SSL/TLS code. + * + * Module: library/ssl_tls.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * + * Requires: MBEDTLS_CIPHER_C, MBEDTLS_MD_C + * and at least one of the MBEDTLS_SSL_PROTO_XXX defines + * + * This module is required for SSL/TLS. + */ +#define MBEDTLS_SSL_TLS_C + +/** + * \def MBEDTLS_THREADING_C + * + * Enable the threading abstraction layer. + * By default mbed TLS assumes it is used in a non-threaded environment or that + * contexts are not shared between threads. If you do intend to use contexts + * between threads, you will need to enable this layer to prevent race + * conditions. See also our Knowledge Base article about threading: + * https://tls.mbed.org/kb/development/thread-safety-and-multi-threading + * + * Module: library/threading.c + * + * This allows different threading implementations (self-implemented or + * provided). + * + * You will have to enable either MBEDTLS_THREADING_ALT or + * MBEDTLS_THREADING_PTHREAD. + * + * Enable this layer to allow use of mutexes within mbed TLS + */ +//#define MBEDTLS_THREADING_C + +/** + * \def MBEDTLS_TIMING_C + * + * Enable the semi-portable timing interface. + * + * \note The provided implementation only works on POSIX/Unix (including Linux, + * BSD and OS X) and Windows. On other platforms, you can either disable that + * module and provide your own implementations of the callbacks needed by + * \c mbedtls_ssl_set_timer_cb() for DTLS, or leave it enabled and provide + * your own implementation of the whole module by setting + * \c MBEDTLS_TIMING_ALT in the current file. + * + * \note The timing module will include time.h on suitable platforms + * regardless of the setting of MBEDTLS_HAVE_TIME, unless + * MBEDTLS_TIMING_ALT is used. See timing.c for more information. + * + * \note See also our Knowledge Base article about porting to a new + * environment: + * https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS + * + * Module: library/timing.c + * Caller: library/havege.c + * + * This module is used by the HAVEGE random number generator. + */ +#define MBEDTLS_TIMING_C + +/** + * \def MBEDTLS_VERSION_C + * + * Enable run-time version information. + * + * Module: library/version.c + * + * This module provides run-time version information. + */ +#define MBEDTLS_VERSION_C + +/** + * \def MBEDTLS_X509_USE_C + * + * Enable X.509 core for using certificates. + * + * Module: library/x509.c + * Caller: library/x509_crl.c + * library/x509_crt.c + * library/x509_csr.c + * + * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, + * MBEDTLS_PK_PARSE_C + * + * This module is required for the X.509 parsing modules. + */ +#define MBEDTLS_X509_USE_C + +/** + * \def MBEDTLS_X509_CRT_PARSE_C + * + * Enable X.509 certificate parsing. + * + * Module: library/x509_crt.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * + * Requires: MBEDTLS_X509_USE_C + * + * This module is required for X.509 certificate parsing. + */ +#define MBEDTLS_X509_CRT_PARSE_C + +/** + * \def MBEDTLS_X509_CRL_PARSE_C + * + * Enable X.509 CRL parsing. + * + * Module: library/x509_crl.c + * Caller: library/x509_crt.c + * + * Requires: MBEDTLS_X509_USE_C + * + * This module is required for X.509 CRL parsing. + */ +#define MBEDTLS_X509_CRL_PARSE_C + +/** + * \def MBEDTLS_X509_CSR_PARSE_C + * + * Enable X.509 Certificate Signing Request (CSR) parsing. + * + * Module: library/x509_csr.c + * Caller: library/x509_crt_write.c + * + * Requires: MBEDTLS_X509_USE_C + * + * This module is used for reading X.509 certificate request. + */ +#define MBEDTLS_X509_CSR_PARSE_C + +/** + * \def MBEDTLS_X509_CREATE_C + * + * Enable X.509 core for creating certificates. + * + * Module: library/x509_create.c + * + * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, MBEDTLS_PK_WRITE_C + * + * This module is the basis for creating X.509 certificates and CSRs. + */ +#define MBEDTLS_X509_CREATE_C + +/** + * \def MBEDTLS_X509_CRT_WRITE_C + * + * Enable creating X.509 certificates. + * + * Module: library/x509_crt_write.c + * + * Requires: MBEDTLS_X509_CREATE_C + * + * This module is required for X.509 certificate creation. + */ +#define MBEDTLS_X509_CRT_WRITE_C + +/** + * \def MBEDTLS_X509_CSR_WRITE_C + * + * Enable creating X.509 Certificate Signing Requests (CSR). + * + * Module: library/x509_csr_write.c + * + * Requires: MBEDTLS_X509_CREATE_C + * + * This module is required for X.509 certificate request writing. + */ +#define MBEDTLS_X509_CSR_WRITE_C + +/** + * \def MBEDTLS_XTEA_C + * + * Enable the XTEA block cipher. + * + * Module: library/xtea.c + * Caller: + */ +#define MBEDTLS_XTEA_C + +/** \} name SECTION: mbed TLS modules */ + +/** + * \name SECTION: General configuration options + * + * This section contains Mbed TLS build settings that are not associated + * with a particular module. + * + * \{ + */ + +/** + * \def MBEDTLS_CONFIG_FILE + * + * If defined, this is a header which will be included instead of + * `"mbedtls/config.h"`. + * This header file specifies the compile-time configuration of Mbed TLS. + * Unlike other configuration options, this one must be defined on the + * compiler command line: a definition in `config.h` would have no effect. + * + * This macro is expanded after an \#include directive. This is a popular but + * non-standard feature of the C language, so this feature is only available + * with compilers that perform macro expansion on an \#include line. + * + * The value of this symbol is typically a path in double quotes, either + * absolute or relative to a directory on the include search path. + */ +//#define MBEDTLS_CONFIG_FILE "mbedtls/config.h" + +/** + * \def MBEDTLS_USER_CONFIG_FILE + * + * If defined, this is a header which will be included after + * `"mbedtls/config.h"` or #MBEDTLS_CONFIG_FILE. + * This allows you to modify the default configuration, including the ability + * to undefine options that are enabled by default. + * + * This macro is expanded after an \#include directive. This is a popular but + * non-standard feature of the C language, so this feature is only available + * with compilers that perform macro expansion on an \#include line. + * + * The value of this symbol is typically a path in double quotes, either + * absolute or relative to a directory on the include search path. + */ +//#define MBEDTLS_USER_CONFIG_FILE "/dev/null" + +/** + * \def MBEDTLS_PSA_CRYPTO_CONFIG_FILE + * + * If defined, this is a header which will be included instead of + * `"psa/crypto_config.h"`. + * This header file specifies which cryptographic mechanisms are available + * through the PSA API when #MBEDTLS_PSA_CRYPTO_CONFIG is enabled, and + * is not used when #MBEDTLS_PSA_CRYPTO_CONFIG is disabled. + * + * This macro is expanded after an \#include directive. This is a popular but + * non-standard feature of the C language, so this feature is only available + * with compilers that perform macro expansion on an \#include line. + * + * The value of this symbol is typically a path in double quotes, either + * absolute or relative to a directory on the include search path. + */ +//#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "psa/crypto_config.h" + +/** + * \def MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE + * + * If defined, this is a header which will be included after + * `"psa/crypto_config.h"` or #MBEDTLS_PSA_CRYPTO_CONFIG_FILE. + * This allows you to modify the default configuration, including the ability + * to undefine options that are enabled by default. + * + * This macro is expanded after an \#include directive. This is a popular but + * non-standard feature of the C language, so this feature is only available + * with compilers that perform macro expansion on an \#include line. + * + * The value of this symbol is typically a path in double quotes, either + * absolute or relative to a directory on the include search path. + */ +//#define MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE "/dev/null" + +/** \} name SECTION: General configuration options */ + +/** + * \name SECTION: Module configuration options + * + * This section allows for the setting of module specific sizes and + * configuration options. The default values are already present in the + * relevant header files and should suffice for the regular use cases. + * + * Our advice is to enable options and change their values here + * only if you have a good reason and know the consequences. + * \{ + */ +/* The Doxygen documentation here is used when a user comments out a + * setting and runs doxygen themselves. On the other hand, when we typeset + * the full documentation including disabled settings, the documentation + * in specific modules' header files is used if present. When editing this + * file, make sure that each option is documented in exactly one place, + * plus optionally a same-line Doxygen comment here if there is a Doxygen + * comment in the specific module. */ + +/* MPI / BIGNUM options */ +//#define MBEDTLS_MPI_WINDOW_SIZE 6 /**< Maximum window size used. */ +//#define MBEDTLS_MPI_MAX_SIZE 1024 /**< Maximum number of bytes for usable MPIs. */ + +/* CTR_DRBG options */ +//#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48 /**< Amount of entropy used per seed by default (48 with SHA-512, 32 with SHA-256) */ +//#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ +//#define MBEDTLS_CTR_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ +//#define MBEDTLS_CTR_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ +//#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ + +/* HMAC_DRBG options */ +//#define MBEDTLS_HMAC_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ +//#define MBEDTLS_HMAC_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ +//#define MBEDTLS_HMAC_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ +//#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ + +/* ECP options */ +//#define MBEDTLS_ECP_MAX_BITS 521 /**< Maximum bit size of groups. Normally determined automatically from the configured curves. */ +//#define MBEDTLS_ECP_WINDOW_SIZE 4 /**< Maximum window size used */ +//#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */ + +/* Entropy options */ +//#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */ +//#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */ +//#define MBEDTLS_ENTROPY_MIN_HARDWARE 32 /**< Default minimum number of bytes required for the hardware entropy source mbedtls_hardware_poll() before entropy is released */ + +/* Memory buffer allocator options */ +//#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 4 /**< Align on multiples of this value */ + +/* Platform options */ +//#define MBEDTLS_PLATFORM_STD_MEM_HDR /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */ +//#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< Default allocator to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_FREE free /**< Default free to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ +//#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< Default printf to use, can be undefined */ +/* Note: your snprintf must correctly zero-terminate the buffer! */ +//#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< Default snprintf to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS 0 /**< Default exit value to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_EXIT_FAILURE 1 /**< Default exit value to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_NV_SEED_READ mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" /**< Seed file to read/write with default implementation */ + +/* To Use Function Macros MBEDTLS_PLATFORM_C must be enabled */ +/* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */ +//#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_EXIT_MACRO exit /**< Default exit macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_TIME_MACRO time /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ +//#define MBEDTLS_PLATFORM_TIME_TYPE_MACRO time_t /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ +//#define MBEDTLS_PLATFORM_FPRINTF_MACRO fprintf /**< Default fprintf macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_PRINTF_MACRO printf /**< Default printf macro to use, can be undefined */ +/* Note: your snprintf must correctly zero-terminate the buffer! */ +//#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf /**< Default snprintf macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_VSNPRINTF_MACRO vsnprintf /**< Default vsnprintf macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_NV_SEED_READ_MACRO mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */ + +/** + * \brief This macro is invoked by the library when an invalid parameter + * is detected that is only checked with #MBEDTLS_CHECK_PARAMS + * (see the documentation of that option for context). + * + * When you leave this undefined here, the library provides + * a default definition. If the macro #MBEDTLS_CHECK_PARAMS_ASSERT + * is defined, the default definition is `assert(cond)`, + * otherwise the default definition calls a function + * mbedtls_param_failed(). This function is declared in + * `platform_util.h` for the benefit of the library, but + * you need to define in your application. + * + * When you define this here, this replaces the default + * definition in platform_util.h (which no longer declares the + * function mbedtls_param_failed()) and it is your responsibility + * to make sure this macro expands to something suitable (in + * particular, that all the necessary declarations are visible + * from within the library - you can ensure that by providing + * them in this file next to the macro definition). + * If you define this macro to call `assert`, also define + * #MBEDTLS_CHECK_PARAMS_ASSERT so that library source files + * include ``. + * + * Note that you may define this macro to expand to nothing, in + * which case you don't have to worry about declarations or + * definitions. However, you will then be notified about invalid + * parameters only in non-void functions, and void function will + * just silently return early on invalid parameters, which + * partially negates the benefits of enabling + * #MBEDTLS_CHECK_PARAMS in the first place, so is discouraged. + * + * \param cond The expression that should evaluate to true, but doesn't. + */ +//#define MBEDTLS_PARAM_FAILED( cond ) assert( cond ) + +/** \def MBEDTLS_CHECK_RETURN + * + * This macro is used at the beginning of the declaration of a function + * to indicate that its return value should be checked. It should + * instruct the compiler to emit a warning or an error if the function + * is called without checking its return value. + * + * There is a default implementation for popular compilers in platform_util.h. + * You can override the default implementation by defining your own here. + * + * If the implementation here is empty, this will effectively disable the + * checking of functions' return values. + */ +//#define MBEDTLS_CHECK_RETURN __attribute__((__warn_unused_result__)) + +/** \def MBEDTLS_IGNORE_RETURN + * + * This macro requires one argument, which should be a C function call. + * If that function call would cause a #MBEDTLS_CHECK_RETURN warning, this + * warning is suppressed. + */ +//#define MBEDTLS_IGNORE_RETURN( result ) ((void) !(result)) + +/* PSA options */ +/** + * Use HMAC_DRBG with the specified hash algorithm for HMAC_DRBG for the + * PSA crypto subsystem. + * + * If this option is unset: + * - If CTR_DRBG is available, the PSA subsystem uses it rather than HMAC_DRBG. + * - Otherwise, the PSA subsystem uses HMAC_DRBG with either + * #MBEDTLS_MD_SHA512 or #MBEDTLS_MD_SHA256 based on availability and + * on unspecified heuristics. + */ +//#define MBEDTLS_PSA_HMAC_DRBG_MD_TYPE MBEDTLS_MD_SHA256 + +/** \def MBEDTLS_PSA_KEY_SLOT_COUNT + * Restrict the PSA library to supporting a maximum amount of simultaneously + * loaded keys. A loaded key is a key stored by the PSA Crypto core as a + * volatile key, or a persistent key which is loaded temporarily by the + * library as part of a crypto operation in flight. + * + * If this option is unset, the library will fall back to a default value of + * 32 keys. + */ +//#define MBEDTLS_PSA_KEY_SLOT_COUNT 32 + +/* SSL Cache options */ +//#define MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT 86400 /**< 1 day */ +//#define MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /**< Maximum entries in cache */ + +/* SSL options */ + +/** \def MBEDTLS_SSL_MAX_CONTENT_LEN + * + * Maximum length (in bytes) of incoming and outgoing plaintext fragments. + * + * This determines the size of both the incoming and outgoing TLS I/O buffers + * in such a way that both are capable of holding the specified amount of + * plaintext data, regardless of the protection mechanism used. + * + * To configure incoming and outgoing I/O buffers separately, use + * #MBEDTLS_SSL_IN_CONTENT_LEN and #MBEDTLS_SSL_OUT_CONTENT_LEN, + * which overwrite the value set by this option. + * + * \note When using a value less than the default of 16KB on the client, it is + * recommended to use the Maximum Fragment Length (MFL) extension to + * inform the server about this limitation. On the server, there + * is no supported, standardized way of informing the client about + * restriction on the maximum size of incoming messages, and unless + * the limitation has been communicated by other means, it is recommended + * to only change the outgoing buffer size #MBEDTLS_SSL_OUT_CONTENT_LEN + * while keeping the default value of 16KB for the incoming buffer. + * + * Uncomment to set the maximum plaintext size of both + * incoming and outgoing I/O buffers. + */ +//#define MBEDTLS_SSL_MAX_CONTENT_LEN 16384 + +/** \def MBEDTLS_SSL_IN_CONTENT_LEN + * + * Maximum length (in bytes) of incoming plaintext fragments. + * + * This determines the size of the incoming TLS I/O buffer in such a way + * that it is capable of holding the specified amount of plaintext data, + * regardless of the protection mechanism used. + * + * If this option is undefined, it inherits its value from + * #MBEDTLS_SSL_MAX_CONTENT_LEN. + * + * \note When using a value less than the default of 16KB on the client, it is + * recommended to use the Maximum Fragment Length (MFL) extension to + * inform the server about this limitation. On the server, there + * is no supported, standardized way of informing the client about + * restriction on the maximum size of incoming messages, and unless + * the limitation has been communicated by other means, it is recommended + * to only change the outgoing buffer size #MBEDTLS_SSL_OUT_CONTENT_LEN + * while keeping the default value of 16KB for the incoming buffer. + * + * Uncomment to set the maximum plaintext size of the incoming I/O buffer + * independently of the outgoing I/O buffer. + */ +//#define MBEDTLS_SSL_IN_CONTENT_LEN 16384 + +/** \def MBEDTLS_SSL_CID_IN_LEN_MAX + * + * The maximum length of CIDs used for incoming DTLS messages. + * + */ +//#define MBEDTLS_SSL_CID_IN_LEN_MAX 32 + +/** \def MBEDTLS_SSL_CID_OUT_LEN_MAX + * + * The maximum length of CIDs used for outgoing DTLS messages. + * + */ +//#define MBEDTLS_SSL_CID_OUT_LEN_MAX 32 + +/** \def MBEDTLS_SSL_CID_PADDING_GRANULARITY + * + * This option controls the use of record plaintext padding + * when using the Connection ID extension in DTLS 1.2. + * + * The padding will always be chosen so that the length of the + * padded plaintext is a multiple of the value of this option. + * + * Note: A value of \c 1 means that no padding will be used + * for outgoing records. + * + * Note: On systems lacking division instructions, + * a power of two should be preferred. + * + */ +//#define MBEDTLS_SSL_CID_PADDING_GRANULARITY 16 + +/** \def MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY + * + * This option controls the use of record plaintext padding + * in TLS 1.3. + * + * The padding will always be chosen so that the length of the + * padded plaintext is a multiple of the value of this option. + * + * Note: A value of \c 1 means that no padding will be used + * for outgoing records. + * + * Note: On systems lacking division instructions, + * a power of two should be preferred. + */ +//#define MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY 1 + +/** \def MBEDTLS_SSL_OUT_CONTENT_LEN + * + * Maximum length (in bytes) of outgoing plaintext fragments. + * + * This determines the size of the outgoing TLS I/O buffer in such a way + * that it is capable of holding the specified amount of plaintext data, + * regardless of the protection mechanism used. + * + * If this option undefined, it inherits its value from + * #MBEDTLS_SSL_MAX_CONTENT_LEN. + * + * It is possible to save RAM by setting a smaller outward buffer, while keeping + * the default inward 16384 byte buffer to conform to the TLS specification. + * + * The minimum required outward buffer size is determined by the handshake + * protocol's usage. Handshaking will fail if the outward buffer is too small. + * The specific size requirement depends on the configured ciphers and any + * certificate data which is sent during the handshake. + * + * Uncomment to set the maximum plaintext size of the outgoing I/O buffer + * independently of the incoming I/O buffer. + */ +//#define MBEDTLS_SSL_OUT_CONTENT_LEN 16384 + +/** \def MBEDTLS_SSL_DTLS_MAX_BUFFERING + * + * Maximum number of heap-allocated bytes for the purpose of + * DTLS handshake message reassembly and future message buffering. + * + * This should be at least 9/8 * MBEDTLS_SSL_IN_CONTENT_LEN + * to account for a reassembled handshake message of maximum size, + * together with its reassembly bitmap. + * + * A value of 2 * MBEDTLS_SSL_IN_CONTENT_LEN (32768 by default) + * should be sufficient for all practical situations as it allows + * to reassembly a large handshake message (such as a certificate) + * while buffering multiple smaller handshake messages. + * + */ +//#define MBEDTLS_SSL_DTLS_MAX_BUFFERING 32768 + +//#define MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME 86400 /**< Lifetime of session tickets (if enabled) */ +//#define MBEDTLS_PSK_MAX_LEN 32 /**< Max size of TLS pre-shared keys, in bytes (default 256 bits) */ +//#define MBEDTLS_SSL_COOKIE_TIMEOUT 60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */ + +/** \def MBEDTLS_TLS_EXT_CID + * + * At the time of writing, the CID extension has not been assigned its + * final value. Set this configuration option to make Mbed TLS use a + * different value. + * + * A future minor revision of Mbed TLS may change the default value of + * this option to match evolving standards and usage. + */ +//#define MBEDTLS_TLS_EXT_CID 254 + +/** + * Complete list of ciphersuites to use, in order of preference. + * + * \warning No dependency checking is done on that field! This option can only + * be used to restrict the set of available ciphersuites. It is your + * responsibility to make sure the needed modules are active. + * + * Use this to save a few hundred bytes of ROM (default ordering of all + * available ciphersuites) and a few to a few hundred bytes of RAM. + * + * The value below is only an example, not the default. + */ +//#define MBEDTLS_SSL_CIPHERSUITES MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + +/* X509 options */ +//#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 /**< Maximum number of intermediate CAs in a verification chain. */ +//#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 /**< Maximum length of a path/filename string in bytes including the null terminator character ('\0'). */ + +/** + * Allow SHA-1 in the default TLS configuration for TLS 1.2 handshake + * signature and ciphersuite selection. Without this build-time option, SHA-1 + * support must be activated explicitly through mbedtls_ssl_conf_sig_hashes. + * The use of SHA-1 in TLS <= 1.1 and in HMAC-SHA-1 is always allowed by + * default. At the time of writing, there is no practical attack on the use + * of SHA-1 in handshake signatures, hence this option is turned on by default + * to preserve compatibility with existing peers, but the general + * warning applies nonetheless: + * + * \warning SHA-1 is considered a weak message digest and its use constitutes + * a security risk. If possible, we recommend avoiding dependencies + * on it, and considering stronger message digests instead. + * + */ +//#define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE + +/** + * Uncomment the macro to let mbed TLS use your alternate implementation of + * mbedtls_platform_zeroize(). This replaces the default implementation in + * platform_util.c. + * + * mbedtls_platform_zeroize() is a widely used function across the library to + * zero a block of memory. The implementation is expected to be secure in the + * sense that it has been written to prevent the compiler from removing calls + * to mbedtls_platform_zeroize() as part of redundant code elimination + * optimizations. However, it is difficult to guarantee that calls to + * mbedtls_platform_zeroize() will not be optimized by the compiler as older + * versions of the C language standards do not provide a secure implementation + * of memset(). Therefore, MBEDTLS_PLATFORM_ZEROIZE_ALT enables users to + * configure their own implementation of mbedtls_platform_zeroize(), for + * example by using directives specific to their compiler, features from newer + * C standards (e.g using memset_s() in C11) or calling a secure memset() from + * their system (e.g explicit_bzero() in BSD). + */ +//#define MBEDTLS_PLATFORM_ZEROIZE_ALT + +/** + * Uncomment the macro to let Mbed TLS use your alternate implementation of + * mbedtls_platform_gmtime_r(). This replaces the default implementation in + * platform_util.c. + * + * gmtime() is not a thread-safe function as defined in the C standard. The + * library will try to use safer implementations of this function, such as + * gmtime_r() when available. However, if Mbed TLS cannot identify the target + * system, the implementation of mbedtls_platform_gmtime_r() will default to + * using the standard gmtime(). In this case, calls from the library to + * gmtime() will be guarded by the global mutex mbedtls_threading_gmtime_mutex + * if MBEDTLS_THREADING_C is enabled. We recommend that calls from outside the + * library are also guarded with this mutex to avoid race conditions. However, + * if the macro MBEDTLS_PLATFORM_GMTIME_R_ALT is defined, Mbed TLS will + * unconditionally use the implementation for mbedtls_platform_gmtime_r() + * supplied at compile time. + */ +//#define MBEDTLS_PLATFORM_GMTIME_R_ALT + +/** + * Enable the verified implementations of ECDH primitives from Project Everest + * (currently only Curve25519). This feature changes the layout of ECDH + * contexts and therefore is a compatibility break for applications that access + * fields of a mbedtls_ecdh_context structure directly. See also + * MBEDTLS_ECDH_LEGACY_CONTEXT in include/mbedtls/ecdh.h. + */ +//#define MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED + +/** \} name SECTION: Module configuration options */ + +/* Target and application specific configurations + * + * Allow user to override any previous default. + * + */ +#if defined(MBEDTLS_USER_CONFIG_FILE) +#include MBEDTLS_USER_CONFIG_FILE +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_CONFIG) +#include "mbedtls/config_psa.h" +#endif + +#include "mbedtls/check_config.h" + +#endif /* MBEDTLS_CONFIG_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/config_psa.h b/openharmony/arm64-v8a/include/mbedtls/config_psa.h new file mode 100644 index 00000000..1bf750ad --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/config_psa.h @@ -0,0 +1,831 @@ +/** + * \file mbedtls/config_psa.h + * \brief PSA crypto configuration options (set of defines) + * + * This set of compile-time options takes settings defined in + * include/mbedtls/config.h and include/psa/crypto_config.h and uses + * those definitions to define symbols used in the library code. + * + * Users and integrators should not edit this file, please edit + * include/mbedtls/config.h for MBETLS_XXX settings or + * include/psa/crypto_config.h for PSA_WANT_XXX settings. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CONFIG_PSA_H +#define MBEDTLS_CONFIG_PSA_H + +#if defined(MBEDTLS_PSA_CRYPTO_CONFIG) +#if defined(MBEDTLS_PSA_CRYPTO_CONFIG_FILE) +#include MBEDTLS_PSA_CRYPTO_CONFIG_FILE +#else +#include "psa/crypto_config.h" +#endif +#endif /* defined(MBEDTLS_PSA_CRYPTO_CONFIG) */ + +#if defined(MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE) +#include MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE +#endif + +#ifdef __cplusplus +extern "C" { +#endif + + + +/****************************************************************/ +/* De facto synonyms */ +/****************************************************************/ + +#if defined(PSA_WANT_ALG_ECDSA_ANY) && !defined(PSA_WANT_ALG_ECDSA) +#define PSA_WANT_ALG_ECDSA PSA_WANT_ALG_ECDSA_ANY +#elif !defined(PSA_WANT_ALG_ECDSA_ANY) && defined(PSA_WANT_ALG_ECDSA) +#define PSA_WANT_ALG_ECDSA_ANY PSA_WANT_ALG_ECDSA +#endif + +#if defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW) && !defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) +#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW +#elif !defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW) && defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) +#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW PSA_WANT_ALG_RSA_PKCS1V15_SIGN +#endif + +#if defined(PSA_WANT_ALG_RSA_PSS_ANY_SALT) && !defined(PSA_WANT_ALG_RSA_PSS) +#define PSA_WANT_ALG_RSA_PSS PSA_WANT_ALG_RSA_PSS_ANY_SALT +#elif !defined(PSA_WANT_ALG_RSA_PSS_ANY_SALT) && defined(PSA_WANT_ALG_RSA_PSS) +#define PSA_WANT_ALG_RSA_PSS_ANY_SALT PSA_WANT_ALG_RSA_PSS +#endif + + + +/****************************************************************/ +/* Require built-in implementations based on PSA requirements */ +/****************************************************************/ + +#if defined(MBEDTLS_PSA_CRYPTO_CONFIG) + +#if defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_DETERMINISTIC_ECDSA) +#define MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA 1 +#define MBEDTLS_ECDSA_DETERMINISTIC +#define MBEDTLS_ECDSA_C +#define MBEDTLS_HMAC_DRBG_C +#define MBEDTLS_MD_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_DETERMINISTIC_ECDSA */ +#endif /* PSA_WANT_ALG_DETERMINISTIC_ECDSA */ + +#if defined(PSA_WANT_ALG_ECDH) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_ECDH) +#define MBEDTLS_PSA_BUILTIN_ALG_ECDH 1 +#define MBEDTLS_ECDH_C +#define MBEDTLS_ECP_C +#define MBEDTLS_BIGNUM_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_ECDH */ +#endif /* PSA_WANT_ALG_ECDH */ + +#if defined(PSA_WANT_ALG_ECDSA) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_ECDSA) +#define MBEDTLS_PSA_BUILTIN_ALG_ECDSA 1 +#define MBEDTLS_ECDSA_C +#define MBEDTLS_ECP_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_ASN1_PARSE_C +#define MBEDTLS_ASN1_WRITE_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_ECDSA */ +#endif /* PSA_WANT_ALG_ECDSA */ + +#if defined(PSA_WANT_ALG_HKDF) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF) +#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1 +#define MBEDTLS_PSA_BUILTIN_ALG_HKDF 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_HKDF */ +#endif /* PSA_WANT_ALG_HKDF */ + +#if defined(PSA_WANT_ALG_HMAC) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_HMAC) +#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_HMAC */ +#endif /* PSA_WANT_ALG_HMAC */ + +#if defined(PSA_WANT_ALG_MD2) && !defined(MBEDTLS_PSA_ACCEL_ALG_MD2) +#define MBEDTLS_PSA_BUILTIN_ALG_MD2 1 +#define MBEDTLS_MD2_C +#endif + +#if defined(PSA_WANT_ALG_MD4) && !defined(MBEDTLS_PSA_ACCEL_ALG_MD4) +#define MBEDTLS_PSA_BUILTIN_ALG_MD4 1 +#define MBEDTLS_MD4_C +#endif + +#if defined(PSA_WANT_ALG_MD5) && !defined(MBEDTLS_PSA_ACCEL_ALG_MD5) +#define MBEDTLS_PSA_BUILTIN_ALG_MD5 1 +#define MBEDTLS_MD5_C +#endif + +#if defined(PSA_WANT_ALG_RIPEMD160) && !defined(MBEDTLS_PSA_ACCEL_ALG_RIPEMD160) +#define MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160 1 +#define MBEDTLS_RIPEMD160_C +#endif + +#if defined(PSA_WANT_ALG_RSA_OAEP) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_OAEP) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_PKCS1_V21 +#define MBEDTLS_MD_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_OAEP */ +#endif /* PSA_WANT_ALG_RSA_OAEP */ + +#if defined(PSA_WANT_ALG_RSA_PKCS1V15_CRYPT) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_CRYPT) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_PKCS1_V15 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_CRYPT */ +#endif /* PSA_WANT_ALG_RSA_PKCS1V15_CRYPT */ + +#if defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_SIGN) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_PKCS1_V15 +#define MBEDTLS_MD_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_SIGN */ +#endif /* PSA_WANT_ALG_RSA_PKCS1V15_SIGN */ + +#if defined(PSA_WANT_ALG_RSA_PSS) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_PSS) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_PKCS1_V21 +#define MBEDTLS_MD_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_PSS */ +#endif /* PSA_WANT_ALG_RSA_PSS */ + +#if defined(PSA_WANT_ALG_SHA_1) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_1) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_1 1 +#define MBEDTLS_SHA1_C +#endif + +#if defined(PSA_WANT_ALG_SHA_224) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_224) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_224 1 +#define MBEDTLS_SHA256_C +#endif + +#if defined(PSA_WANT_ALG_SHA_256) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_256) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_256 1 +#define MBEDTLS_SHA256_C +#endif + +#if defined(PSA_WANT_ALG_SHA_384) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_384) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_384 1 +#define MBEDTLS_SHA512_C +#endif + +#if defined(PSA_WANT_ALG_SHA_512) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_512) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_512 1 +#define MBEDTLS_SHA512_C +#endif + +#if defined(PSA_WANT_ALG_TLS12_PRF) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_TLS12_PRF) +#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_TLS12_PRF */ +#endif /* PSA_WANT_ALG_TLS12_PRF */ + +#if defined(PSA_WANT_ALG_TLS12_PSK_TO_MS) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_TLS12_PSK_TO_MS) +#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_TLS12_PSK_TO_MS */ +#endif /* PSA_WANT_ALG_TLS12_PSK_TO_MS */ + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR 1 +#define MBEDTLS_ECP_C +#define MBEDTLS_BIGNUM_C +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR */ +#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR */ + +#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY 1 +#define MBEDTLS_ECP_C +#define MBEDTLS_BIGNUM_C +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY */ +#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */ + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_GENPRIME +#define MBEDTLS_PK_PARSE_C +#define MBEDTLS_PK_WRITE_C +#define MBEDTLS_PK_C +#define MBEDTLS_ASN1_PARSE_C +#define MBEDTLS_ASN1_WRITE_C +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR */ +#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR */ + +#if defined(PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_PUBLIC_KEY) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_PK_PARSE_C +#define MBEDTLS_PK_WRITE_C +#define MBEDTLS_PK_C +#define MBEDTLS_ASN1_PARSE_C +#define MBEDTLS_ASN1_WRITE_C +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_PUBLIC_KEY */ +#endif /* PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY */ + +/* If any of the block modes are requested that don't have an + * associated HW assist, define PSA_HAVE_SOFT_BLOCK_MODE for checking + * in the block cipher key types. */ +#if (defined(PSA_WANT_ALG_CTR) && !defined(MBEDTLS_PSA_ACCEL_ALG_CTR)) || \ + (defined(PSA_WANT_ALG_CFB) && !defined(MBEDTLS_PSA_ACCEL_ALG_CFB)) || \ + (defined(PSA_WANT_ALG_OFB) && !defined(MBEDTLS_PSA_ACCEL_ALG_OFB)) || \ + defined(PSA_WANT_ALG_ECB_NO_PADDING) || \ + (defined(PSA_WANT_ALG_CBC_NO_PADDING) && \ + !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_NO_PADDING)) || \ + (defined(PSA_WANT_ALG_CBC_PKCS7) && \ + !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_PKCS7)) || \ + (defined(PSA_WANT_ALG_CMAC) && !defined(MBEDTLS_PSA_ACCEL_ALG_CMAC)) +#define PSA_HAVE_SOFT_BLOCK_MODE 1 +#endif + +#if (defined(PSA_WANT_ALG_GCM) && !defined(MBEDTLS_PSA_ACCEL_ALG_GCM)) || \ + (defined(PSA_WANT_ALG_CCM) && !defined(MBEDTLS_PSA_ACCEL_ALG_CCM)) +#define PSA_HAVE_SOFT_BLOCK_AEAD 1 +#endif + +#if defined(PSA_WANT_KEY_TYPE_AES) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_AES) +#define PSA_HAVE_SOFT_KEY_TYPE_AES 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_AES */ +#if defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ + defined(PSA_HAVE_SOFT_BLOCK_MODE) || \ + defined(PSA_HAVE_SOFT_BLOCK_AEAD) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES 1 +#define MBEDTLS_AES_C +#endif /* PSA_HAVE_SOFT_KEY_TYPE_AES || PSA_HAVE_SOFT_BLOCK_MODE */ +#endif /* PSA_WANT_KEY_TYPE_AES */ + +#if defined(PSA_WANT_KEY_TYPE_ARC4) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ARC4) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARC4 1 +#define MBEDTLS_ARC4_C +#endif /*!MBEDTLS_PSA_ACCEL_KEY_TYPE_ARC4 */ +#endif /* PSA_WANT_KEY_TYPE_ARC4 */ + +#if defined(PSA_WANT_KEY_TYPE_ARIA) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ARIA) +#define PSA_HAVE_SOFT_KEY_TYPE_ARIA 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_ARIA */ +#if defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ + defined(PSA_HAVE_SOFT_BLOCK_MODE) || \ + defined(PSA_HAVE_SOFT_BLOCK_AEAD) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARIA 1 +#define MBEDTLS_ARIA_C +#endif /* PSA_HAVE_SOFT_KEY_TYPE_ARIA || PSA_HAVE_SOFT_BLOCK_MODE */ +#endif /* PSA_WANT_KEY_TYPE_ARIA */ + +#if defined(PSA_WANT_KEY_TYPE_CAMELLIA) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_CAMELLIA) +#define PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_CAMELLIA */ +#if defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) || \ + defined(PSA_HAVE_SOFT_BLOCK_MODE) || \ + defined(PSA_HAVE_SOFT_BLOCK_AEAD) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CAMELLIA 1 +#define MBEDTLS_CAMELLIA_C +#endif /* PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA || PSA_HAVE_SOFT_BLOCK_MODE */ +#endif /* PSA_WANT_KEY_TYPE_CAMELLIA */ + +#if defined(PSA_WANT_KEY_TYPE_DES) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DES) +#define PSA_HAVE_SOFT_KEY_TYPE_DES 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_DES */ +#if defined(PSA_HAVE_SOFT_KEY_TYPE_DES) || \ + defined(PSA_HAVE_SOFT_BLOCK_MODE) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES 1 +#define MBEDTLS_DES_C +#endif /*PSA_HAVE_SOFT_KEY_TYPE_DES || PSA_HAVE_SOFT_BLOCK_MODE */ +#endif /* PSA_WANT_KEY_TYPE_DES */ + +#if defined(PSA_WANT_KEY_TYPE_CHACHA20) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_CHACHA20) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20 1 +#define MBEDTLS_CHACHA20_C +#endif /*!MBEDTLS_PSA_ACCEL_KEY_TYPE_CHACHA20 */ +#endif /* PSA_WANT_KEY_TYPE_CHACHA20 */ + +/* If any of the software block ciphers are selected, define + * PSA_HAVE_SOFT_BLOCK_CIPHER, which can be used in any of these + * situations. */ +#if defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_DES) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) +#define PSA_HAVE_SOFT_BLOCK_CIPHER 1 +#endif + +#if defined(PSA_WANT_ALG_STREAM_CIPHER) +#define MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER 1 +#endif /* PSA_WANT_ALG_STREAM_CIPHER */ + +#if defined(PSA_WANT_ALG_CBC_MAC) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_MAC) +#error "CBC-MAC is not yet supported via the PSA API in Mbed TLS." +#define MBEDTLS_PSA_BUILTIN_ALG_CBC_MAC 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_CBC_MAC */ +#endif /* PSA_WANT_ALG_CBC_MAC */ + +#if defined(PSA_WANT_ALG_CMAC) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CMAC) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_PSA_BUILTIN_ALG_CMAC 1 +#define MBEDTLS_CMAC_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_CMAC */ +#endif /* PSA_WANT_ALG_CMAC */ + +#if defined(PSA_WANT_ALG_CTR) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CTR) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_PSA_BUILTIN_ALG_CTR 1 +#define MBEDTLS_CIPHER_MODE_CTR +#endif +#endif /* PSA_WANT_ALG_CTR */ + +#if defined(PSA_WANT_ALG_CFB) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CFB) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_PSA_BUILTIN_ALG_CFB 1 +#define MBEDTLS_CIPHER_MODE_CFB +#endif +#endif /* PSA_WANT_ALG_CFB */ + +#if defined(PSA_WANT_ALG_OFB) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_OFB) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_PSA_BUILTIN_ALG_OFB 1 +#define MBEDTLS_CIPHER_MODE_OFB +#endif +#endif /* PSA_WANT_ALG_OFB */ + +#if defined(PSA_WANT_ALG_ECB_NO_PADDING) && \ + !defined(MBEDTLS_PSA_ACCEL_ALG_ECB_NO_PADDING) +#define MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING 1 +#endif + +#if defined(PSA_WANT_ALG_CBC_NO_PADDING) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_NO_PADDING) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_CIPHER_MODE_CBC +#define MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING 1 +#endif +#endif /* PSA_WANT_ALG_CBC_NO_PADDING */ + +#if defined(PSA_WANT_ALG_CBC_PKCS7) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_PKCS7) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_CIPHER_MODE_CBC +#define MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7 1 +#define MBEDTLS_CIPHER_PADDING_PKCS7 +#endif +#endif /* PSA_WANT_ALG_CBC_PKCS7 */ + +#if defined(PSA_WANT_ALG_CCM) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CCM) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) +#define MBEDTLS_PSA_BUILTIN_ALG_CCM 1 +#define MBEDTLS_CCM_C +#endif +#endif /* PSA_WANT_ALG_CCM */ + +#if defined(PSA_WANT_ALG_GCM) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_GCM) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) +#define MBEDTLS_PSA_BUILTIN_ALG_GCM 1 +#define MBEDTLS_GCM_C +#endif +#endif /* PSA_WANT_ALG_GCM */ + +#if defined(PSA_WANT_ALG_CHACHA20_POLY1305) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305) +#if defined(PSA_WANT_KEY_TYPE_CHACHA20) +#define MBEDTLS_CHACHAPOLY_C +#define MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 1 +#endif /* PSA_WANT_KEY_TYPE_CHACHA20 */ +#endif /* !MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305 */ +#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */ + +#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_256) +#define MBEDTLS_ECP_DP_BP256R1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_256 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_256 */ +#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_256 */ + +#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_384) +#define MBEDTLS_ECP_DP_BP384R1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_384 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_384 */ +#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_384 */ + +#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_512) +#define MBEDTLS_ECP_DP_BP512R1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_512 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_512 */ +#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_512 */ + +#if defined(PSA_WANT_ECC_MONTGOMERY_255) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_255) +#define MBEDTLS_ECP_DP_CURVE25519_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_255 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_255 */ +#endif /* PSA_WANT_ECC_MONTGOMERY_255 */ + +#if defined(PSA_WANT_ECC_MONTGOMERY_448) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_448) +/* + * Curve448 is not yet supported via the PSA API in Mbed TLS + * (https://github.com/Mbed-TLS/mbedtls/issues/4249). + */ +#error "Curve448 is not yet supported via the PSA API in Mbed TLS." +#define MBEDTLS_ECP_DP_CURVE448_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_448 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_448 */ +#endif /* PSA_WANT_ECC_MONTGOMERY_448 */ + +#if defined(PSA_WANT_ECC_SECP_R1_192) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_192) +#define MBEDTLS_ECP_DP_SECP192R1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_192 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_R1_192 */ +#endif /* PSA_WANT_ECC_SECP_R1_192 */ + +#if defined(PSA_WANT_ECC_SECP_R1_224) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_224) +#define MBEDTLS_ECP_DP_SECP224R1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_224 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_R1_224 */ +#endif /* PSA_WANT_ECC_SECP_R1_224 */ + +#if defined(PSA_WANT_ECC_SECP_R1_256) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256) +#define MBEDTLS_ECP_DP_SECP256R1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_256 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256 */ +#endif /* PSA_WANT_ECC_SECP_R1_256 */ + +#if defined(PSA_WANT_ECC_SECP_R1_384) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_384) +#define MBEDTLS_ECP_DP_SECP384R1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_R1_384 */ +#endif /* PSA_WANT_ECC_SECP_R1_384 */ + +#if defined(PSA_WANT_ECC_SECP_R1_521) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_521) +#define MBEDTLS_ECP_DP_SECP521R1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_R1_521 */ +#endif /* PSA_WANT_ECC_SECP_R1_521 */ + +#if defined(PSA_WANT_ECC_SECP_K1_192) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_192) +#define MBEDTLS_ECP_DP_SECP192K1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_K1_192 */ +#endif /* PSA_WANT_ECC_SECP_K1_192 */ + +#if defined(PSA_WANT_ECC_SECP_K1_224) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224) +/* + * SECP224K1 is buggy via the PSA API in Mbed TLS + * (https://github.com/Mbed-TLS/mbedtls/issues/3541). + */ +#error "SECP224K1 is buggy via the PSA API in Mbed TLS." +#define MBEDTLS_ECP_DP_SECP224K1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_224 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224 */ +#endif /* PSA_WANT_ECC_SECP_K1_224 */ + +#if defined(PSA_WANT_ECC_SECP_K1_256) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256) +#define MBEDTLS_ECP_DP_SECP256K1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256 */ +#endif /* PSA_WANT_ECC_SECP_K1_256 */ + + + +/****************************************************************/ +/* Infer PSA requirements from Mbed TLS capabilities */ +/****************************************************************/ + +#else /* MBEDTLS_PSA_CRYPTO_CONFIG */ + +/* + * Ensure PSA_WANT_* defines are setup properly if MBEDTLS_PSA_CRYPTO_CONFIG + * is not defined + */ + +#if defined(MBEDTLS_CCM_C) +#define MBEDTLS_PSA_BUILTIN_ALG_CCM 1 +#define PSA_WANT_ALG_CCM 1 +#endif /* MBEDTLS_CCM_C */ + +#if defined(MBEDTLS_CMAC_C) +#define MBEDTLS_PSA_BUILTIN_ALG_CMAC 1 +#define PSA_WANT_ALG_CMAC 1 +#endif /* MBEDTLS_CMAC_C */ + +#if defined(MBEDTLS_ECDH_C) +#define MBEDTLS_PSA_BUILTIN_ALG_ECDH 1 +#define PSA_WANT_ALG_ECDH 1 +#endif /* MBEDTLS_ECDH_C */ + +#if defined(MBEDTLS_ECDSA_C) +#define MBEDTLS_PSA_BUILTIN_ALG_ECDSA 1 +#define PSA_WANT_ALG_ECDSA 1 +#define PSA_WANT_ALG_ECDSA_ANY 1 + +// Only add in DETERMINISTIC support if ECDSA is also enabled +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) +#define MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA 1 +#define PSA_WANT_ALG_DETERMINISTIC_ECDSA 1 +#endif /* MBEDTLS_ECDSA_DETERMINISTIC */ + +#endif /* MBEDTLS_ECDSA_C */ + +#if defined(MBEDTLS_ECP_C) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR 1 +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY 1 +#define PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY 1 +#endif /* MBEDTLS_ECP_C */ + +#if defined(MBEDTLS_GCM_C) +#define MBEDTLS_PSA_BUILTIN_ALG_GCM 1 +#define PSA_WANT_ALG_GCM 1 +#endif /* MBEDTLS_GCM_C */ + +#if defined(MBEDTLS_HKDF_C) +#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1 +#define PSA_WANT_ALG_HMAC 1 +#define MBEDTLS_PSA_BUILTIN_ALG_HKDF 1 +#define PSA_WANT_ALG_HKDF 1 +#endif /* MBEDTLS_HKDF_C */ + +#if defined(MBEDTLS_MD_C) +#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1 +#define PSA_WANT_ALG_HMAC 1 +#define PSA_WANT_KEY_TYPE_HMAC +#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF 1 +#define PSA_WANT_ALG_TLS12_PRF 1 +#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS 1 +#define PSA_WANT_ALG_TLS12_PSK_TO_MS 1 +#endif /* MBEDTLS_MD_C */ + +#if defined(MBEDTLS_MD2_C) +#define MBEDTLS_PSA_BUILTIN_ALG_MD2 1 +#define PSA_WANT_ALG_MD2 1 +#endif + +#if defined(MBEDTLS_MD4_C) +#define MBEDTLS_PSA_BUILTIN_ALG_MD4 1 +#define PSA_WANT_ALG_MD4 1 +#endif + +#if defined(MBEDTLS_MD5_C) +#define MBEDTLS_PSA_BUILTIN_ALG_MD5 1 +#define PSA_WANT_ALG_MD5 1 +#endif + +#if defined(MBEDTLS_RIPEMD160_C) +#define MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160 1 +#define PSA_WANT_ALG_RIPEMD160 1 +#endif + +#if defined(MBEDTLS_RSA_C) +#if defined(MBEDTLS_PKCS1_V15) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT 1 +#define PSA_WANT_ALG_RSA_PKCS1V15_CRYPT 1 +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN 1 +#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN 1 +#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW 1 +#endif /* MBEDTLS_PKCS1_V15 */ +#if defined(MBEDTLS_PKCS1_V21) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP 1 +#define PSA_WANT_ALG_RSA_OAEP 1 +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS 1 +#define PSA_WANT_ALG_RSA_PSS 1 +#endif /* MBEDTLS_PKCS1_V21 */ +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR 1 +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY 1 +#define PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY 1 +#endif /* MBEDTLS_RSA_C */ + +#if defined(MBEDTLS_SHA1_C) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_1 1 +#define PSA_WANT_ALG_SHA_1 1 +#endif + +#if defined(MBEDTLS_SHA256_C) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_224 1 +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_256 1 +#define PSA_WANT_ALG_SHA_224 1 +#define PSA_WANT_ALG_SHA_256 1 +#endif + +#if defined(MBEDTLS_SHA512_C) +#if !defined(MBEDTLS_SHA512_NO_SHA384) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_384 1 +#define PSA_WANT_ALG_SHA_384 1 +#endif +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_512 1 +#define PSA_WANT_ALG_SHA_512 1 +#endif + +#if defined(MBEDTLS_AES_C) +#define PSA_WANT_KEY_TYPE_AES 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES 1 +#endif + +#if defined(MBEDTLS_ARC4_C) +#define PSA_WANT_KEY_TYPE_ARC4 1 +#define PSA_WANT_ALG_STREAM_CIPHER 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARC4 1 +#define MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER 1 +#endif + +#if defined(MBEDTLS_ARIA_C) +#define PSA_WANT_KEY_TYPE_ARIA 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARIA 1 +#endif + +#if defined(MBEDTLS_CAMELLIA_C) +#define PSA_WANT_KEY_TYPE_CAMELLIA 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CAMELLIA 1 +#endif + +#if defined(MBEDTLS_DES_C) +#define PSA_WANT_KEY_TYPE_DES 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES 1 +#endif + +#if defined(MBEDTLS_CHACHA20_C) +#define PSA_WANT_KEY_TYPE_CHACHA20 1 +#define PSA_WANT_ALG_STREAM_CIPHER 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20 1 +#define MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER 1 +#if defined(MBEDTLS_CHACHAPOLY_C) +#define PSA_WANT_ALG_CHACHA20_POLY1305 1 +#define MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 1 +#endif +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +#define MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING 1 +#define PSA_WANT_ALG_CBC_NO_PADDING 1 +#if defined(MBEDTLS_CIPHER_PADDING_PKCS7) +#define MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7 1 +#define PSA_WANT_ALG_CBC_PKCS7 1 +#endif +#endif + +#if defined(MBEDTLS_AES_C) || defined(MBEDTLS_DES_C) || \ + defined(MBEDTLS_ARIA_C) || defined(MBEDTLS_CAMELLIA_C) +#define MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING 1 +#define PSA_WANT_ALG_ECB_NO_PADDING 1 +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CFB) +#define MBEDTLS_PSA_BUILTIN_ALG_CFB 1 +#define PSA_WANT_ALG_CFB 1 +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CTR) +#define MBEDTLS_PSA_BUILTIN_ALG_CTR 1 +#define PSA_WANT_ALG_CTR 1 +#endif + +#if defined(MBEDTLS_CIPHER_MODE_OFB) +#define MBEDTLS_PSA_BUILTIN_ALG_OFB 1 +#define PSA_WANT_ALG_OFB 1 +#endif + +#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_256 1 +#define PSA_WANT_ECC_BRAINPOOL_P_R1_256 +#endif + +#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_384 1 +#define PSA_WANT_ECC_BRAINPOOL_P_R1_384 +#endif + +#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_512 1 +#define PSA_WANT_ECC_BRAINPOOL_P_R1_512 +#endif + +#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_255 1 +#define PSA_WANT_ECC_MONTGOMERY_255 +#endif + +/* Curve448 is not yet supported via the PSA API (https://github.com/Mbed-TLS/mbedtls/issues/4249) */ +#if 0 && defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_448 1 +#define PSA_WANT_ECC_MONTGOMERY_448 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_192 1 +#define PSA_WANT_ECC_SECP_R1_192 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_224 1 +#define PSA_WANT_ECC_SECP_R1_224 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_256 1 +#define PSA_WANT_ECC_SECP_R1_256 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384 1 +#define PSA_WANT_ECC_SECP_R1_384 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521 1 +#define PSA_WANT_ECC_SECP_R1_521 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192 1 +#define PSA_WANT_ECC_SECP_K1_192 +#endif + +/* SECP224K1 is buggy via the PSA API (https://github.com/Mbed-TLS/mbedtls/issues/3541) */ +#if 0 && defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_224 1 +#define PSA_WANT_ECC_SECP_K1_224 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256 1 +#define PSA_WANT_ECC_SECP_K1_256 +#endif + +#endif /* MBEDTLS_PSA_CRYPTO_CONFIG */ + +/* These features are always enabled. */ +#define PSA_WANT_KEY_TYPE_DERIVE 1 +#define PSA_WANT_KEY_TYPE_RAW_DATA 1 + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CONFIG_PSA_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/constant_time.h b/openharmony/arm64-v8a/include/mbedtls/constant_time.h new file mode 100644 index 00000000..c5de57a0 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/constant_time.h @@ -0,0 +1,45 @@ +/** + * Constant-time functions + * + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CONSTANT_TIME_H +#define MBEDTLS_CONSTANT_TIME_H + +#include + + +/** Constant-time buffer comparison without branches. + * + * This is equivalent to the standard memcmp function, but is likely to be + * compiled to code using bitwise operation rather than a branch. + * + * This function can be used to write constant-time code by replacing branches + * with bit operations using masks. + * + * \param a Pointer to the first buffer. + * \param b Pointer to the second buffer. + * \param n The number of bytes to compare in the buffer. + * + * \return Zero if the content of the two buffer is the same, + * otherwise non-zero. + */ +int mbedtls_ct_memcmp( const void *a, + const void *b, + size_t n ); + +#endif /* MBEDTLS_CONSTANT_TIME_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/ctr_drbg.h b/openharmony/arm64-v8a/include/mbedtls/ctr_drbg.h new file mode 100644 index 00000000..e68237a4 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/ctr_drbg.h @@ -0,0 +1,611 @@ +/** + * \file ctr_drbg.h + * + * \brief This file contains definitions and functions for the + * CTR_DRBG pseudorandom generator. + * + * CTR_DRBG is a standardized way of building a PRNG from a block-cipher + * in counter mode operation, as defined in NIST SP 800-90A: + * Recommendation for Random Number Generation Using Deterministic Random + * Bit Generators. + * + * The Mbed TLS implementation of CTR_DRBG uses AES-256 (default) or AES-128 + * (if \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled at compile time) + * as the underlying block cipher, with a derivation function. + * + * The security strength as defined in NIST SP 800-90A is + * 128 bits when AES-128 is used (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY enabled) + * and 256 bits otherwise, provided that #MBEDTLS_CTR_DRBG_ENTROPY_LEN is + * kept at its default value (and not overridden in config.h) and that the + * DRBG instance is set up with default parameters. + * See the documentation of mbedtls_ctr_drbg_seed() for more + * information. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CTR_DRBG_H +#define MBEDTLS_CTR_DRBG_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/aes.h" + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +/** The entropy source failed. */ +#define MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED -0x0034 +/** The requested random buffer length is too big. */ +#define MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG -0x0036 +/** The input (entropy + additional data) is too large. */ +#define MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG -0x0038 +/** Read or write error in file. */ +#define MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR -0x003A + +#define MBEDTLS_CTR_DRBG_BLOCKSIZE 16 /**< The block size used by the cipher. */ + +#if defined(MBEDTLS_CTR_DRBG_USE_128_BIT_KEY) +#define MBEDTLS_CTR_DRBG_KEYSIZE 16 +/**< The key size in bytes used by the cipher. + * + * Compile-time choice: 16 bytes (128 bits) + * because #MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled. + */ +#else +#define MBEDTLS_CTR_DRBG_KEYSIZE 32 +/**< The key size in bytes used by the cipher. + * + * Compile-time choice: 32 bytes (256 bits) + * because \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled. + */ +#endif + +#define MBEDTLS_CTR_DRBG_KEYBITS ( MBEDTLS_CTR_DRBG_KEYSIZE * 8 ) /**< The key size for the DRBG operation, in bits. */ +#define MBEDTLS_CTR_DRBG_SEEDLEN ( MBEDTLS_CTR_DRBG_KEYSIZE + MBEDTLS_CTR_DRBG_BLOCKSIZE ) /**< The seed length, calculated as (counter + AES key). */ + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h or define them using the compiler command + * line. + * \{ + */ + +/** \def MBEDTLS_CTR_DRBG_ENTROPY_LEN + * + * \brief The amount of entropy used per seed by default, in bytes. + */ +#if !defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) +#if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_ENTROPY_FORCE_SHA256) +/** This is 48 bytes because the entropy module uses SHA-512 + * (\c MBEDTLS_ENTROPY_FORCE_SHA256 is disabled). + */ +#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48 + +#else /* defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_ENTROPY_FORCE_SHA256) */ + +/** This is 32 bytes because the entropy module uses SHA-256 + * (the SHA512 module is disabled or + * \c MBEDTLS_ENTROPY_FORCE_SHA256 is enabled). + */ +#if !defined(MBEDTLS_CTR_DRBG_USE_128_BIT_KEY) +/** \warning To achieve a 256-bit security strength, you must pass a nonce + * to mbedtls_ctr_drbg_seed(). + */ +#endif /* !defined(MBEDTLS_CTR_DRBG_USE_128_BIT_KEY) */ +#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 32 +#endif /* defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_ENTROPY_FORCE_SHA256) */ +#endif /* !defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) */ + +#if !defined(MBEDTLS_CTR_DRBG_RESEED_INTERVAL) +#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000 +/**< The interval before reseed is performed by default. */ +#endif + +#if !defined(MBEDTLS_CTR_DRBG_MAX_INPUT) +#define MBEDTLS_CTR_DRBG_MAX_INPUT 256 +/**< The maximum number of additional input Bytes. */ +#endif + +#if !defined(MBEDTLS_CTR_DRBG_MAX_REQUEST) +#define MBEDTLS_CTR_DRBG_MAX_REQUEST 1024 +/**< The maximum number of requested Bytes per call. */ +#endif + +#if !defined(MBEDTLS_CTR_DRBG_MAX_SEED_INPUT) +#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384 +/**< The maximum size of seed or reseed buffer in bytes. */ +#endif + +/** \} name SECTION: Module settings */ + +#define MBEDTLS_CTR_DRBG_PR_OFF 0 +/**< Prediction resistance is disabled. */ +#define MBEDTLS_CTR_DRBG_PR_ON 1 +/**< Prediction resistance is enabled. */ + +#ifdef __cplusplus +extern "C" { +#endif + +#if MBEDTLS_CTR_DRBG_ENTROPY_LEN >= MBEDTLS_CTR_DRBG_KEYSIZE * 3 / 2 +/** The default length of the nonce read from the entropy source. + * + * This is \c 0 because a single read from the entropy source is sufficient + * to include a nonce. + * See the documentation of mbedtls_ctr_drbg_seed() for more information. + */ +#define MBEDTLS_CTR_DRBG_ENTROPY_NONCE_LEN 0 +#else +/** The default length of the nonce read from the entropy source. + * + * This is half of the default entropy length because a single read from + * the entropy source does not provide enough material to form a nonce. + * See the documentation of mbedtls_ctr_drbg_seed() for more information. + */ +#define MBEDTLS_CTR_DRBG_ENTROPY_NONCE_LEN ( MBEDTLS_CTR_DRBG_ENTROPY_LEN + 1 ) / 2 +#endif + +/** + * \brief The CTR_DRBG context structure. + */ +typedef struct mbedtls_ctr_drbg_context +{ + unsigned char counter[16]; /*!< The counter (V). */ + int reseed_counter; /*!< The reseed counter. + * This is the number of requests that have + * been made since the last (re)seeding, + * minus one. + * Before the initial seeding, this field + * contains the amount of entropy in bytes + * to use as a nonce for the initial seeding, + * or -1 if no nonce length has been explicitly + * set (see mbedtls_ctr_drbg_set_nonce_len()). + */ + int prediction_resistance; /*!< This determines whether prediction + resistance is enabled, that is + whether to systematically reseed before + each random generation. */ + size_t entropy_len; /*!< The amount of entropy grabbed on each + seed or reseed operation, in bytes. */ + int reseed_interval; /*!< The reseed interval. + * This is the maximum number of requests + * that can be made between reseedings. */ + + mbedtls_aes_context aes_ctx; /*!< The AES context. */ + + /* + * Callbacks (Entropy) + */ + int (*f_entropy)(void *, unsigned char *, size_t); + /*!< The entropy callback function. */ + + void *p_entropy; /*!< The context for the entropy function. */ + +#if defined(MBEDTLS_THREADING_C) + /* Invariant: the mutex is initialized if and only if f_entropy != NULL. + * This means that the mutex is initialized during the initial seeding + * in mbedtls_ctr_drbg_seed() and freed in mbedtls_ctr_drbg_free(). + * + * Note that this invariant may change without notice. Do not rely on it + * and do not access the mutex directly in application code. + */ + mbedtls_threading_mutex_t mutex; +#endif +} +mbedtls_ctr_drbg_context; + +/** + * \brief This function initializes the CTR_DRBG context, + * and prepares it for mbedtls_ctr_drbg_seed() + * or mbedtls_ctr_drbg_free(). + * + * \note The reseed interval is + * #MBEDTLS_CTR_DRBG_RESEED_INTERVAL by default. + * You can override it by calling + * mbedtls_ctr_drbg_set_reseed_interval(). + * + * \param ctx The CTR_DRBG context to initialize. + */ +void mbedtls_ctr_drbg_init( mbedtls_ctr_drbg_context *ctx ); + +/** + * \brief This function seeds and sets up the CTR_DRBG + * entropy source for future reseeds. + * + * A typical choice for the \p f_entropy and \p p_entropy parameters is + * to use the entropy module: + * - \p f_entropy is mbedtls_entropy_func(); + * - \p p_entropy is an instance of ::mbedtls_entropy_context initialized + * with mbedtls_entropy_init() (which registers the platform's default + * entropy sources). + * + * The entropy length is #MBEDTLS_CTR_DRBG_ENTROPY_LEN by default. + * You can override it by calling mbedtls_ctr_drbg_set_entropy_len(). + * + * The entropy nonce length is: + * - \c 0 if the entropy length is at least 3/2 times the entropy length, + * which guarantees that the security strength is the maximum permitted + * by the key size and entropy length according to NIST SP 800-90A §10.2.1; + * - Half the entropy length otherwise. + * You can override it by calling mbedtls_ctr_drbg_set_nonce_len(). + * With the default entropy length, the entropy nonce length is + * #MBEDTLS_CTR_DRBG_ENTROPY_NONCE_LEN. + * + * You can provide a nonce and personalization string in addition to the + * entropy source, to make this instantiation as unique as possible. + * See SP 800-90A §8.6.7 for more details about nonces. + * + * The _seed_material_ value passed to the derivation function in + * the CTR_DRBG Instantiate Process described in NIST SP 800-90A §10.2.1.3.2 + * is the concatenation of the following strings: + * - A string obtained by calling \p f_entropy function for the entropy + * length. + */ +#if MBEDTLS_CTR_DRBG_ENTROPY_NONCE_LEN == 0 +/** + * - If mbedtls_ctr_drbg_set_nonce_len() has been called, a string + * obtained by calling \p f_entropy function for the specified length. + */ +#else +/** + * - A string obtained by calling \p f_entropy function for the entropy nonce + * length. If the entropy nonce length is \c 0, this function does not + * make a second call to \p f_entropy. + */ +#endif +#if defined(MBEDTLS_THREADING_C) +/** + * \note When Mbed TLS is built with threading support, + * after this function returns successfully, + * it is safe to call mbedtls_ctr_drbg_random() + * from multiple threads. Other operations, including + * reseeding, are not thread-safe. + */ +#endif /* MBEDTLS_THREADING_C */ +/** + * - The \p custom string. + * + * \note To achieve the nominal security strength permitted + * by CTR_DRBG, the entropy length must be: + * - at least 16 bytes for a 128-bit strength + * (maximum achievable strength when using AES-128); + * - at least 32 bytes for a 256-bit strength + * (maximum achievable strength when using AES-256). + * + * In addition, if you do not pass a nonce in \p custom, + * the sum of the entropy length + * and the entropy nonce length must be: + * - at least 24 bytes for a 128-bit strength + * (maximum achievable strength when using AES-128); + * - at least 48 bytes for a 256-bit strength + * (maximum achievable strength when using AES-256). + * + * \param ctx The CTR_DRBG context to seed. + * It must have been initialized with + * mbedtls_ctr_drbg_init(). + * After a successful call to mbedtls_ctr_drbg_seed(), + * you may not call mbedtls_ctr_drbg_seed() again on + * the same context unless you call + * mbedtls_ctr_drbg_free() and mbedtls_ctr_drbg_init() + * again first. + * After a failed call to mbedtls_ctr_drbg_seed(), + * you must call mbedtls_ctr_drbg_free(). + * \param f_entropy The entropy callback, taking as arguments the + * \p p_entropy context, the buffer to fill, and the + * length of the buffer. + * \p f_entropy is always called with a buffer size + * less than or equal to the entropy length. + * \param p_entropy The entropy context to pass to \p f_entropy. + * \param custom The personalization string. + * This can be \c NULL, in which case the personalization + * string is empty regardless of the value of \p len. + * \param len The length of the personalization string. + * This must be at most + * #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + * - #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. + */ +int mbedtls_ctr_drbg_seed( mbedtls_ctr_drbg_context *ctx, + int (*f_entropy)(void *, unsigned char *, size_t), + void *p_entropy, + const unsigned char *custom, + size_t len ); + +/** + * \brief This function resets CTR_DRBG context to the state immediately + * after initial call of mbedtls_ctr_drbg_init(). + * + * \param ctx The CTR_DRBG context to clear. + */ +void mbedtls_ctr_drbg_free( mbedtls_ctr_drbg_context *ctx ); + +/** + * \brief This function turns prediction resistance on or off. + * The default value is off. + * + * \note If enabled, entropy is gathered at the beginning of + * every call to mbedtls_ctr_drbg_random_with_add() + * or mbedtls_ctr_drbg_random(). + * Only use this if your entropy source has sufficient + * throughput. + * + * \param ctx The CTR_DRBG context. + * \param resistance #MBEDTLS_CTR_DRBG_PR_ON or #MBEDTLS_CTR_DRBG_PR_OFF. + */ +void mbedtls_ctr_drbg_set_prediction_resistance( mbedtls_ctr_drbg_context *ctx, + int resistance ); + +/** + * \brief This function sets the amount of entropy grabbed on each + * seed or reseed. + * + * The default value is #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + * + * \note The security strength of CTR_DRBG is bounded by the + * entropy length. Thus: + * - When using AES-256 + * (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled, + * which is the default), + * \p len must be at least 32 (in bytes) + * to achieve a 256-bit strength. + * - When using AES-128 + * (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled) + * \p len must be at least 16 (in bytes) + * to achieve a 128-bit strength. + * + * \param ctx The CTR_DRBG context. + * \param len The amount of entropy to grab, in bytes. + * This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + * and at most the maximum length accepted by the + * entropy function that is set in the context. + */ +void mbedtls_ctr_drbg_set_entropy_len( mbedtls_ctr_drbg_context *ctx, + size_t len ); + +/** + * \brief This function sets the amount of entropy grabbed + * as a nonce for the initial seeding. + * + * Call this function before calling mbedtls_ctr_drbg_seed() to read + * a nonce from the entropy source during the initial seeding. + * + * \param ctx The CTR_DRBG context. + * \param len The amount of entropy to grab for the nonce, in bytes. + * This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + * and at most the maximum length accepted by the + * entropy function that is set in the context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if \p len is + * more than #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED + * if the initial seeding has already taken place. + */ +int mbedtls_ctr_drbg_set_nonce_len( mbedtls_ctr_drbg_context *ctx, + size_t len ); + +/** + * \brief This function sets the reseed interval. + * + * The reseed interval is the number of calls to mbedtls_ctr_drbg_random() + * or mbedtls_ctr_drbg_random_with_add() after which the entropy function + * is called again. + * + * The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL. + * + * \param ctx The CTR_DRBG context. + * \param interval The reseed interval. + */ +void mbedtls_ctr_drbg_set_reseed_interval( mbedtls_ctr_drbg_context *ctx, + int interval ); + +/** + * \brief This function reseeds the CTR_DRBG context, that is + * extracts data from the entropy source. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param ctx The CTR_DRBG context. + * \param additional Additional data to add to the state. Can be \c NULL. + * \param len The length of the additional data. + * This must be less than + * #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len + * where \c entropy_len is the entropy length + * configured for the context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. + */ +int mbedtls_ctr_drbg_reseed( mbedtls_ctr_drbg_context *ctx, + const unsigned char *additional, size_t len ); + +/** + * \brief This function updates the state of the CTR_DRBG context. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param ctx The CTR_DRBG context. + * \param additional The data to update the state with. This must not be + * \c NULL unless \p add_len is \c 0. + * \param add_len Length of \p additional in bytes. This must be at + * most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if + * \p add_len is more than + * #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + * \return An error from the underlying AES cipher on failure. + */ +int mbedtls_ctr_drbg_update_ret( mbedtls_ctr_drbg_context *ctx, + const unsigned char *additional, + size_t add_len ); + +/** + * \brief This function updates a CTR_DRBG instance with additional + * data and uses it to generate random data. + * + * This function automatically reseeds if the reseed counter is exceeded + * or prediction resistance is enabled. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param p_rng The CTR_DRBG context. This must be a pointer to a + * #mbedtls_ctr_drbg_context structure. + * \param output The buffer to fill. + * \param output_len The length of the buffer in bytes. + * \param additional Additional data to update. Can be \c NULL, in which + * case the additional data is empty regardless of + * the value of \p add_len. + * \param add_len The length of the additional data + * if \p additional is not \c NULL. + * This must be less than #MBEDTLS_CTR_DRBG_MAX_INPUT + * and less than + * #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len + * where \c entropy_len is the entropy length + * configured for the context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or + * #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. + */ +int mbedtls_ctr_drbg_random_with_add( void *p_rng, + unsigned char *output, size_t output_len, + const unsigned char *additional, size_t add_len ); + +/** + * \brief This function uses CTR_DRBG to generate random data. + * + * This function automatically reseeds if the reseed counter is exceeded + * or prediction resistance is enabled. + */ +#if defined(MBEDTLS_THREADING_C) +/** + * \note When Mbed TLS is built with threading support, + * it is safe to call mbedtls_ctr_drbg_random() + * from multiple threads. Other operations, including + * reseeding, are not thread-safe. + */ +#endif /* MBEDTLS_THREADING_C */ +/** + * \param p_rng The CTR_DRBG context. This must be a pointer to a + * #mbedtls_ctr_drbg_context structure. + * \param output The buffer to fill. + * \param output_len The length of the buffer in bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or + * #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. + */ +int mbedtls_ctr_drbg_random( void *p_rng, + unsigned char *output, size_t output_len ); + + +#if ! defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function updates the state of the CTR_DRBG context. + * + * \deprecated Superseded by mbedtls_ctr_drbg_update_ret() + * in 2.16.0. + * + * \note If \p add_len is greater than + * #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT, only the first + * #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT Bytes are used. + * The remaining Bytes are silently discarded. + * + * \param ctx The CTR_DRBG context. + * \param additional The data to update the state with. + * \param add_len Length of \p additional data. + */ +MBEDTLS_DEPRECATED void mbedtls_ctr_drbg_update( + mbedtls_ctr_drbg_context *ctx, + const unsigned char *additional, + size_t add_len ); +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_FS_IO) +/** + * \brief This function writes a seed file. + * + * \param ctx The CTR_DRBG context. + * \param path The name of the file. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR on file error. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on reseed + * failure. + */ +int mbedtls_ctr_drbg_write_seed_file( mbedtls_ctr_drbg_context *ctx, const char *path ); + +/** + * \brief This function reads and updates a seed file. The seed + * is added to this instance. + * + * \param ctx The CTR_DRBG context. + * \param path The name of the file. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR on file error. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on + * reseed failure. + * \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if the existing + * seed file is too large. + */ +int mbedtls_ctr_drbg_update_seed_file( mbedtls_ctr_drbg_context *ctx, const char *path ); +#endif /* MBEDTLS_FS_IO */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The CTR_DRBG checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_ctr_drbg_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* ctr_drbg.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/debug.h b/openharmony/arm64-v8a/include/mbedtls/debug.h new file mode 100644 index 00000000..4fc4662d --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/debug.h @@ -0,0 +1,311 @@ +/** + * \file debug.h + * + * \brief Functions for controlling and providing debug output from the library. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_DEBUG_H +#define MBEDTLS_DEBUG_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/ssl.h" + +#if defined(MBEDTLS_ECP_C) +#include "mbedtls/ecp.h" +#endif + +#if defined(MBEDTLS_DEBUG_C) + +#define MBEDTLS_DEBUG_STRIP_PARENS( ... ) __VA_ARGS__ + +#define MBEDTLS_SSL_DEBUG_MSG( level, args ) \ + mbedtls_debug_print_msg( ssl, level, __FILE__, __LINE__, \ + MBEDTLS_DEBUG_STRIP_PARENS args ) + +#define MBEDTLS_SSL_DEBUG_RET( level, text, ret ) \ + mbedtls_debug_print_ret( ssl, level, __FILE__, __LINE__, text, ret ) + +#define MBEDTLS_SSL_DEBUG_BUF( level, text, buf, len ) \ + mbedtls_debug_print_buf( ssl, level, __FILE__, __LINE__, text, buf, len ) + +#if defined(MBEDTLS_BIGNUM_C) +#define MBEDTLS_SSL_DEBUG_MPI( level, text, X ) \ + mbedtls_debug_print_mpi( ssl, level, __FILE__, __LINE__, text, X ) +#endif + +#if defined(MBEDTLS_ECP_C) +#define MBEDTLS_SSL_DEBUG_ECP( level, text, X ) \ + mbedtls_debug_print_ecp( ssl, level, __FILE__, __LINE__, text, X ) +#endif + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +#define MBEDTLS_SSL_DEBUG_CRT( level, text, crt ) \ + mbedtls_debug_print_crt( ssl, level, __FILE__, __LINE__, text, crt ) +#endif + +#if defined(MBEDTLS_ECDH_C) +#define MBEDTLS_SSL_DEBUG_ECDH( level, ecdh, attr ) \ + mbedtls_debug_printf_ecdh( ssl, level, __FILE__, __LINE__, ecdh, attr ) +#endif + +#else /* MBEDTLS_DEBUG_C */ + +#define MBEDTLS_SSL_DEBUG_MSG( level, args ) do { } while( 0 ) +#define MBEDTLS_SSL_DEBUG_RET( level, text, ret ) do { } while( 0 ) +#define MBEDTLS_SSL_DEBUG_BUF( level, text, buf, len ) do { } while( 0 ) +#define MBEDTLS_SSL_DEBUG_MPI( level, text, X ) do { } while( 0 ) +#define MBEDTLS_SSL_DEBUG_ECP( level, text, X ) do { } while( 0 ) +#define MBEDTLS_SSL_DEBUG_CRT( level, text, crt ) do { } while( 0 ) +#define MBEDTLS_SSL_DEBUG_ECDH( level, ecdh, attr ) do { } while( 0 ) + +#endif /* MBEDTLS_DEBUG_C */ + +/** + * \def MBEDTLS_PRINTF_ATTRIBUTE + * + * Mark a function as having printf attributes, and thus enable checking + * via -wFormat and other flags. This does nothing on builds with compilers + * that do not support the format attribute + * + * Module: library/debug.c + * Caller: + * + * This module provides debugging functions. + */ +#if defined(__has_attribute) +#if __has_attribute(format) +#if defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 1 +#define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check) \ + __attribute__((__format__ (gnu_printf, string_index, first_to_check))) +#else /* defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 1 */ +#define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check) \ + __attribute__((format(printf, string_index, first_to_check))) +#endif +#else /* __has_attribute(format) */ +#define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check) +#endif /* __has_attribute(format) */ +#else /* defined(__has_attribute) */ +#define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check) +#endif + +/** + * \def MBEDTLS_PRINTF_SIZET + * + * MBEDTLS_PRINTF_xxx: Due to issues with older window compilers + * and MinGW we need to define the printf specifier for size_t + * and long long per platform. + * + * Module: library/debug.c + * Caller: + * + * This module provides debugging functions. + */ +#if (defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 0) || (defined(_MSC_VER) && _MSC_VER < 1800) + #include + #define MBEDTLS_PRINTF_SIZET PRIuPTR + #define MBEDTLS_PRINTF_LONGLONG "I64d" +#else /* (defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 0) || (defined(_MSC_VER) && _MSC_VER < 1800) */ + #define MBEDTLS_PRINTF_SIZET "zu" + #define MBEDTLS_PRINTF_LONGLONG "lld" +#endif /* (defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 0) || (defined(_MSC_VER) && _MSC_VER < 1800) */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Set the threshold error level to handle globally all debug output. + * Debug messages that have a level over the threshold value are + * discarded. + * (Default value: 0 = No debug ) + * + * \param threshold threshold level of messages to filter on. Messages at a + * higher level will be discarded. + * - Debug levels + * - 0 No debug + * - 1 Error + * - 2 State change + * - 3 Informational + * - 4 Verbose + */ +void mbedtls_debug_set_threshold( int threshold ); + +/** + * \brief Print a message to the debug output. This function is always used + * through the MBEDTLS_SSL_DEBUG_MSG() macro, which supplies the ssl + * context, file and line number parameters. + * + * \param ssl SSL context + * \param level error level of the debug message + * \param file file the message has occurred in + * \param line line number the message has occurred at + * \param format format specifier, in printf format + * \param ... variables used by the format specifier + * + * \attention This function is intended for INTERNAL usage within the + * library only. + */ +void mbedtls_debug_print_msg( const mbedtls_ssl_context *ssl, int level, + const char *file, int line, + const char *format, ... ) MBEDTLS_PRINTF_ATTRIBUTE(5, 6); + +/** + * \brief Print the return value of a function to the debug output. This + * function is always used through the MBEDTLS_SSL_DEBUG_RET() macro, + * which supplies the ssl context, file and line number parameters. + * + * \param ssl SSL context + * \param level error level of the debug message + * \param file file the error has occurred in + * \param line line number the error has occurred in + * \param text the name of the function that returned the error + * \param ret the return code value + * + * \attention This function is intended for INTERNAL usage within the + * library only. + */ +void mbedtls_debug_print_ret( const mbedtls_ssl_context *ssl, int level, + const char *file, int line, + const char *text, int ret ); + +/** + * \brief Output a buffer of size len bytes to the debug output. This function + * is always used through the MBEDTLS_SSL_DEBUG_BUF() macro, + * which supplies the ssl context, file and line number parameters. + * + * \param ssl SSL context + * \param level error level of the debug message + * \param file file the error has occurred in + * \param line line number the error has occurred in + * \param text a name or label for the buffer being dumped. Normally the + * variable or buffer name + * \param buf the buffer to be outputted + * \param len length of the buffer + * + * \attention This function is intended for INTERNAL usage within the + * library only. + */ +void mbedtls_debug_print_buf( const mbedtls_ssl_context *ssl, int level, + const char *file, int line, const char *text, + const unsigned char *buf, size_t len ); + +#if defined(MBEDTLS_BIGNUM_C) +/** + * \brief Print a MPI variable to the debug output. This function is always + * used through the MBEDTLS_SSL_DEBUG_MPI() macro, which supplies the + * ssl context, file and line number parameters. + * + * \param ssl SSL context + * \param level error level of the debug message + * \param file file the error has occurred in + * \param line line number the error has occurred in + * \param text a name or label for the MPI being output. Normally the + * variable name + * \param X the MPI variable + * + * \attention This function is intended for INTERNAL usage within the + * library only. + */ +void mbedtls_debug_print_mpi( const mbedtls_ssl_context *ssl, int level, + const char *file, int line, + const char *text, const mbedtls_mpi *X ); +#endif + +#if defined(MBEDTLS_ECP_C) +/** + * \brief Print an ECP point to the debug output. This function is always + * used through the MBEDTLS_SSL_DEBUG_ECP() macro, which supplies the + * ssl context, file and line number parameters. + * + * \param ssl SSL context + * \param level error level of the debug message + * \param file file the error has occurred in + * \param line line number the error has occurred in + * \param text a name or label for the ECP point being output. Normally the + * variable name + * \param X the ECP point + * + * \attention This function is intended for INTERNAL usage within the + * library only. + */ +void mbedtls_debug_print_ecp( const mbedtls_ssl_context *ssl, int level, + const char *file, int line, + const char *text, const mbedtls_ecp_point *X ); +#endif + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Print a X.509 certificate structure to the debug output. This + * function is always used through the MBEDTLS_SSL_DEBUG_CRT() macro, + * which supplies the ssl context, file and line number parameters. + * + * \param ssl SSL context + * \param level error level of the debug message + * \param file file the error has occurred in + * \param line line number the error has occurred in + * \param text a name or label for the certificate being output + * \param crt X.509 certificate structure + * + * \attention This function is intended for INTERNAL usage within the + * library only. + */ +void mbedtls_debug_print_crt( const mbedtls_ssl_context *ssl, int level, + const char *file, int line, + const char *text, const mbedtls_x509_crt *crt ); +#endif + +#if defined(MBEDTLS_ECDH_C) +typedef enum +{ + MBEDTLS_DEBUG_ECDH_Q, + MBEDTLS_DEBUG_ECDH_QP, + MBEDTLS_DEBUG_ECDH_Z, +} mbedtls_debug_ecdh_attr; + +/** + * \brief Print a field of the ECDH structure in the SSL context to the debug + * output. This function is always used through the + * MBEDTLS_SSL_DEBUG_ECDH() macro, which supplies the ssl context, file + * and line number parameters. + * + * \param ssl SSL context + * \param level error level of the debug message + * \param file file the error has occurred in + * \param line line number the error has occurred in + * \param ecdh the ECDH context + * \param attr the identifier of the attribute being output + * + * \attention This function is intended for INTERNAL usage within the + * library only. + */ +void mbedtls_debug_printf_ecdh( const mbedtls_ssl_context *ssl, int level, + const char *file, int line, + const mbedtls_ecdh_context *ecdh, + mbedtls_debug_ecdh_attr attr ); +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* debug.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/des.h b/openharmony/arm64-v8a/include/mbedtls/des.h new file mode 100644 index 00000000..325aab53 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/des.h @@ -0,0 +1,370 @@ +/** + * \file des.h + * + * \brief DES block cipher + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ +#ifndef MBEDTLS_DES_H +#define MBEDTLS_DES_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif +#include "mbedtls/platform_util.h" + +#include +#include + +#define MBEDTLS_DES_ENCRYPT 1 +#define MBEDTLS_DES_DECRYPT 0 + +/** The data input has an invalid length. */ +#define MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH -0x0032 + +/* MBEDTLS_ERR_DES_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** DES hardware accelerator failed. */ +#define MBEDTLS_ERR_DES_HW_ACCEL_FAILED -0x0033 + +#define MBEDTLS_DES_KEY_SIZE 8 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_DES_ALT) +// Regular implementation +// + +/** + * \brief DES context structure + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +typedef struct mbedtls_des_context +{ + uint32_t sk[32]; /*!< DES subkeys */ +} +mbedtls_des_context; + +/** + * \brief Triple-DES context structure + */ +typedef struct mbedtls_des3_context +{ + uint32_t sk[96]; /*!< 3DES subkeys */ +} +mbedtls_des3_context; + +#else /* MBEDTLS_DES_ALT */ +#include "des_alt.h" +#endif /* MBEDTLS_DES_ALT */ + +/** + * \brief Initialize DES context + * + * \param ctx DES context to be initialized + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +void mbedtls_des_init( mbedtls_des_context *ctx ); + +/** + * \brief Clear DES context + * + * \param ctx DES context to be cleared + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +void mbedtls_des_free( mbedtls_des_context *ctx ); + +/** + * \brief Initialize Triple-DES context + * + * \param ctx DES3 context to be initialized + */ +void mbedtls_des3_init( mbedtls_des3_context *ctx ); + +/** + * \brief Clear Triple-DES context + * + * \param ctx DES3 context to be cleared + */ +void mbedtls_des3_free( mbedtls_des3_context *ctx ); + +/** + * \brief Set key parity on the given key to odd. + * + * DES keys are 56 bits long, but each byte is padded with + * a parity bit to allow verification. + * + * \param key 8-byte secret key + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +void mbedtls_des_key_set_parity( unsigned char key[MBEDTLS_DES_KEY_SIZE] ); + +/** + * \brief Check that key parity on the given key is odd. + * + * DES keys are 56 bits long, but each byte is padded with + * a parity bit to allow verification. + * + * \param key 8-byte secret key + * + * \return 0 is parity was ok, 1 if parity was not correct. + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_key_check_key_parity( const unsigned char key[MBEDTLS_DES_KEY_SIZE] ); + +/** + * \brief Check that key is not a weak or semi-weak DES key + * + * \param key 8-byte secret key + * + * \return 0 if no weak key was found, 1 if a weak key was identified. + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_key_check_weak( const unsigned char key[MBEDTLS_DES_KEY_SIZE] ); + +/** + * \brief DES key schedule (56-bit, encryption) + * + * \param ctx DES context to be initialized + * \param key 8-byte secret key + * + * \return 0 + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_setkey_enc( mbedtls_des_context *ctx, const unsigned char key[MBEDTLS_DES_KEY_SIZE] ); + +/** + * \brief DES key schedule (56-bit, decryption) + * + * \param ctx DES context to be initialized + * \param key 8-byte secret key + * + * \return 0 + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_setkey_dec( mbedtls_des_context *ctx, const unsigned char key[MBEDTLS_DES_KEY_SIZE] ); + +/** + * \brief Triple-DES key schedule (112-bit, encryption) + * + * \param ctx 3DES context to be initialized + * \param key 16-byte secret key + * + * \return 0 + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_set2key_enc( mbedtls_des3_context *ctx, + const unsigned char key[MBEDTLS_DES_KEY_SIZE * 2] ); + +/** + * \brief Triple-DES key schedule (112-bit, decryption) + * + * \param ctx 3DES context to be initialized + * \param key 16-byte secret key + * + * \return 0 + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_set2key_dec( mbedtls_des3_context *ctx, + const unsigned char key[MBEDTLS_DES_KEY_SIZE * 2] ); + +/** + * \brief Triple-DES key schedule (168-bit, encryption) + * + * \param ctx 3DES context to be initialized + * \param key 24-byte secret key + * + * \return 0 + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_set3key_enc( mbedtls_des3_context *ctx, + const unsigned char key[MBEDTLS_DES_KEY_SIZE * 3] ); + +/** + * \brief Triple-DES key schedule (168-bit, decryption) + * + * \param ctx 3DES context to be initialized + * \param key 24-byte secret key + * + * \return 0 + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_set3key_dec( mbedtls_des3_context *ctx, + const unsigned char key[MBEDTLS_DES_KEY_SIZE * 3] ); + +/** + * \brief DES-ECB block encryption/decryption + * + * \param ctx DES context + * \param input 64-bit input block + * \param output 64-bit output block + * + * \return 0 if successful + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_crypt_ecb( mbedtls_des_context *ctx, + const unsigned char input[8], + unsigned char output[8] ); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief DES-CBC buffer encryption/decryption + * + * \note Upon exit, the content of the IV is updated so that you can + * call the function same function again on the following + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If on the other hand you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * \param ctx DES context + * \param mode MBEDTLS_DES_ENCRYPT or MBEDTLS_DES_DECRYPT + * \param length length of the input data + * \param iv initialization vector (updated after use) + * \param input buffer holding the input data + * \param output buffer holding the output data + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_crypt_cbc( mbedtls_des_context *ctx, + int mode, + size_t length, + unsigned char iv[8], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +/** + * \brief 3DES-ECB block encryption/decryption + * + * \param ctx 3DES context + * \param input 64-bit input block + * \param output 64-bit output block + * + * \return 0 if successful + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_crypt_ecb( mbedtls_des3_context *ctx, + const unsigned char input[8], + unsigned char output[8] ); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief 3DES-CBC buffer encryption/decryption + * + * \note Upon exit, the content of the IV is updated so that you can + * call the function same function again on the following + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If on the other hand you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * \param ctx 3DES context + * \param mode MBEDTLS_DES_ENCRYPT or MBEDTLS_DES_DECRYPT + * \param length length of the input data + * \param iv initialization vector (updated after use) + * \param input buffer holding the input data + * \param output buffer holding the output data + * + * \return 0 if successful, or MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_crypt_cbc( mbedtls_des3_context *ctx, + int mode, + size_t length, + unsigned char iv[8], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +/** + * \brief Internal function for key expansion. + * (Only exposed to allow overriding it, + * see MBEDTLS_DES_SETKEY_ALT) + * + * \param SK Round keys + * \param key Base key + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +void mbedtls_des_setkey( uint32_t SK[32], + const unsigned char key[MBEDTLS_DES_KEY_SIZE] ); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_des_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* des.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/dhm.h b/openharmony/arm64-v8a/include/mbedtls/dhm.h new file mode 100644 index 00000000..c4b15a2c --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/dhm.h @@ -0,0 +1,1103 @@ +/** + * \file dhm.h + * + * \brief This file contains Diffie-Hellman-Merkle (DHM) key exchange + * definitions and functions. + * + * Diffie-Hellman-Merkle (DHM) key exchange is defined in + * RFC-2631: Diffie-Hellman Key Agreement Method and + * Public-Key Cryptography Standards (PKCS) #3: Diffie + * Hellman Key Agreement Standard. + * + * RFC-3526: More Modular Exponential (MODP) Diffie-Hellman groups for + * Internet Key Exchange (IKE) defines a number of standardized + * Diffie-Hellman groups for IKE. + * + * RFC-5114: Additional Diffie-Hellman Groups for Use with IETF + * Standards defines a number of standardized Diffie-Hellman + * groups that can be used. + * + * \warning The security of the DHM key exchange relies on the proper choice + * of prime modulus - optimally, it should be a safe prime. The usage + * of non-safe primes both decreases the difficulty of the underlying + * discrete logarithm problem and can lead to small subgroup attacks + * leaking private exponent bits when invalid public keys are used + * and not detected. This is especially relevant if the same DHM + * parameters are reused for multiple key exchanges as in static DHM, + * while the criticality of small-subgroup attacks is lower for + * ephemeral DHM. + * + * \warning For performance reasons, the code does neither perform primality + * nor safe primality tests, nor the expensive checks for invalid + * subgroups. Moreover, even if these were performed, non-standardized + * primes cannot be trusted because of the possibility of backdoors + * that can't be effectively checked for. + * + * \warning Diffie-Hellman-Merkle is therefore a security risk when not using + * standardized primes generated using a trustworthy ("nothing up + * my sleeve") method, such as the RFC 3526 / 7919 primes. In the TLS + * protocol, DH parameters need to be negotiated, so using the default + * primes systematically is not always an option. If possible, use + * Elliptic Curve Diffie-Hellman (ECDH), which has better performance, + * and for which the TLS protocol mandates the use of standard + * parameters. + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_DHM_H +#define MBEDTLS_DHM_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif +#include "mbedtls/bignum.h" + +/* + * DHM Error codes + */ +/** Bad input parameters. */ +#define MBEDTLS_ERR_DHM_BAD_INPUT_DATA -0x3080 +/** Reading of the DHM parameters failed. */ +#define MBEDTLS_ERR_DHM_READ_PARAMS_FAILED -0x3100 +/** Making of the DHM parameters failed. */ +#define MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED -0x3180 +/** Reading of the public values failed. */ +#define MBEDTLS_ERR_DHM_READ_PUBLIC_FAILED -0x3200 +/** Making of the public value failed. */ +#define MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED -0x3280 +/** Calculation of the DHM secret failed. */ +#define MBEDTLS_ERR_DHM_CALC_SECRET_FAILED -0x3300 +/** The ASN.1 data is not formatted correctly. */ +#define MBEDTLS_ERR_DHM_INVALID_FORMAT -0x3380 +/** Allocation of memory failed. */ +#define MBEDTLS_ERR_DHM_ALLOC_FAILED -0x3400 +/** Read or write of file failed. */ +#define MBEDTLS_ERR_DHM_FILE_IO_ERROR -0x3480 + +/* MBEDTLS_ERR_DHM_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** DHM hardware accelerator failed. */ +#define MBEDTLS_ERR_DHM_HW_ACCEL_FAILED -0x3500 + +/** Setting the modulus and generator failed. */ +#define MBEDTLS_ERR_DHM_SET_GROUP_FAILED -0x3580 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_DHM_ALT) + +/** + * \brief The DHM context structure. + */ +typedef struct mbedtls_dhm_context +{ + size_t len; /*!< The size of \p P in Bytes. */ + mbedtls_mpi P; /*!< The prime modulus. */ + mbedtls_mpi G; /*!< The generator. */ + mbedtls_mpi X; /*!< Our secret value. */ + mbedtls_mpi GX; /*!< Our public key = \c G^X mod \c P. */ + mbedtls_mpi GY; /*!< The public key of the peer = \c G^Y mod \c P. */ + mbedtls_mpi K; /*!< The shared secret = \c G^(XY) mod \c P. */ + mbedtls_mpi RP; /*!< The cached value = \c R^2 mod \c P. */ + mbedtls_mpi Vi; /*!< The blinding value. */ + mbedtls_mpi Vf; /*!< The unblinding value. */ + mbedtls_mpi pX; /*!< The previous \c X. */ +} +mbedtls_dhm_context; + +#else /* MBEDTLS_DHM_ALT */ +#include "dhm_alt.h" +#endif /* MBEDTLS_DHM_ALT */ + +/** + * \brief This function initializes the DHM context. + * + * \param ctx The DHM context to initialize. + */ +void mbedtls_dhm_init( mbedtls_dhm_context *ctx ); + +/** + * \brief This function parses the DHM parameters in a + * TLS ServerKeyExchange handshake message + * (DHM modulus, generator, and public key). + * + * \note In a TLS handshake, this is the how the client + * sets up its DHM context from the server's public + * DHM key material. + * + * \param ctx The DHM context to use. This must be initialized. + * \param p On input, *p must be the start of the input buffer. + * On output, *p is updated to point to the end of the data + * that has been read. On success, this is the first byte + * past the end of the ServerKeyExchange parameters. + * On error, this is the point at which an error has been + * detected, which is usually not useful except to debug + * failures. + * \param end The end of the input buffer. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_read_params( mbedtls_dhm_context *ctx, + unsigned char **p, + const unsigned char *end ); + +/** + * \brief This function generates a DHM key pair and exports its + * public part together with the DHM parameters in the format + * used in a TLS ServerKeyExchange handshake message. + * + * \note This function assumes that the DHM parameters \c ctx->P + * and \c ctx->G have already been properly set. For that, use + * mbedtls_dhm_set_group() below in conjunction with + * mbedtls_mpi_read_binary() and mbedtls_mpi_read_string(). + * + * \note In a TLS handshake, this is the how the server generates + * and exports its DHM key material. + * + * \param ctx The DHM context to use. This must be initialized + * and have the DHM parameters set. It may or may not + * already have imported the peer's public key. + * \param x_size The private key size in Bytes. + * \param olen The address at which to store the number of Bytes + * written on success. This must not be \c NULL. + * \param output The destination buffer. This must be a writable buffer of + * sufficient size to hold the reduced binary presentation of + * the modulus, the generator and the public key, each wrapped + * with a 2-byte length field. It is the responsibility of the + * caller to ensure that enough space is available. Refer to + * mbedtls_mpi_size() to computing the byte-size of an MPI. + * \param f_rng The RNG function. Must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context parameter. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_make_params( mbedtls_dhm_context *ctx, int x_size, + unsigned char *output, size_t *olen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function sets the prime modulus and generator. + * + * \note This function can be used to set \c ctx->P, \c ctx->G + * in preparation for mbedtls_dhm_make_params(). + * + * \param ctx The DHM context to configure. This must be initialized. + * \param P The MPI holding the DHM prime modulus. This must be + * an initialized MPI. + * \param G The MPI holding the DHM generator. This must be an + * initialized MPI. + * + * \return \c 0 if successful. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_set_group( mbedtls_dhm_context *ctx, + const mbedtls_mpi *P, + const mbedtls_mpi *G ); + +/** + * \brief This function imports the raw public value of the peer. + * + * \note In a TLS handshake, this is the how the server imports + * the Client's public DHM key. + * + * \param ctx The DHM context to use. This must be initialized and have + * its DHM parameters set, e.g. via mbedtls_dhm_set_group(). + * It may or may not already have generated its own private key. + * \param input The input buffer containing the \c G^Y value of the peer. + * This must be a readable buffer of size \p ilen Bytes. + * \param ilen The size of the input buffer \p input in Bytes. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_read_public( mbedtls_dhm_context *ctx, + const unsigned char *input, size_t ilen ); + +/** + * \brief This function creates a DHM key pair and exports + * the raw public key in big-endian format. + * + * \note The destination buffer is always fully written + * so as to contain a big-endian representation of G^X mod P. + * If it is larger than \c ctx->len, it is padded accordingly + * with zero-bytes at the beginning. + * + * \param ctx The DHM context to use. This must be initialized and + * have the DHM parameters set. It may or may not already + * have imported the peer's public key. + * \param x_size The private key size in Bytes. + * \param output The destination buffer. This must be a writable buffer of + * size \p olen Bytes. + * \param olen The length of the destination buffer. This must be at least + * equal to `ctx->len` (the size of \c P). + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + * if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_make_public( mbedtls_dhm_context *ctx, int x_size, + unsigned char *output, size_t olen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function derives and exports the shared secret + * \c (G^Y)^X mod \c P. + * + * \note If \p f_rng is not \c NULL, it is used to blind the input as + * a countermeasure against timing attacks. Blinding is used + * only if our private key \c X is re-used, and not used + * otherwise. We recommend always passing a non-NULL + * \p f_rng argument. + * + * \param ctx The DHM context to use. This must be initialized + * and have its own private key generated and the peer's + * public key imported. + * \param output The buffer to write the generated shared key to. This + * must be a writable buffer of size \p output_size Bytes. + * \param output_size The size of the destination buffer. This must be at + * least the size of \c ctx->len (the size of \c P). + * \param olen On exit, holds the actual number of Bytes written. + * \param f_rng The RNG function, for blinding purposes. This may + * b \c NULL if blinding isn't needed. + * \param p_rng The RNG context. This may be \c NULL if \p f_rng + * doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_calc_secret( mbedtls_dhm_context *ctx, + unsigned char *output, size_t output_size, size_t *olen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function frees and clears the components + * of a DHM context. + * + * \param ctx The DHM context to free and clear. This may be \c NULL, + * in which case this function is a no-op. If it is not \c NULL, + * it must point to an initialized DHM context. + */ +void mbedtls_dhm_free( mbedtls_dhm_context *ctx ); + +#if defined(MBEDTLS_ASN1_PARSE_C) +/** + * \brief This function parses DHM parameters in PEM or DER format. + * + * \param dhm The DHM context to import the DHM parameters into. + * This must be initialized. + * \param dhmin The input buffer. This must be a readable buffer of + * length \p dhminlen Bytes. + * \param dhminlen The size of the input buffer \p dhmin, including the + * terminating \c NULL Byte for PEM data. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX or \c MBEDTLS_ERR_PEM_XXX error + * code on failure. + */ +int mbedtls_dhm_parse_dhm( mbedtls_dhm_context *dhm, const unsigned char *dhmin, + size_t dhminlen ); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief This function loads and parses DHM parameters from a file. + * + * \param dhm The DHM context to load the parameters to. + * This must be initialized. + * \param path The filename to read the DHM parameters from. + * This must not be \c NULL. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX or \c MBEDTLS_ERR_PEM_XXX + * error code on failure. + */ +int mbedtls_dhm_parse_dhmfile( mbedtls_dhm_context *dhm, const char *path ); +#endif /* MBEDTLS_FS_IO */ +#endif /* MBEDTLS_ASN1_PARSE_C */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The DMH checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_dhm_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ +#ifdef __cplusplus +} +#endif + +/** + * RFC 3526, RFC 5114 and RFC 7919 standardize a number of + * Diffie-Hellman groups, some of which are included here + * for use within the SSL/TLS module and the user's convenience + * when configuring the Diffie-Hellman parameters by hand + * through \c mbedtls_ssl_conf_dh_param. + * + * The following lists the source of the above groups in the standards: + * - RFC 5114 section 2.2: 2048-bit MODP Group with 224-bit Prime Order Subgroup + * - RFC 3526 section 3: 2048-bit MODP Group + * - RFC 3526 section 4: 3072-bit MODP Group + * - RFC 3526 section 5: 4096-bit MODP Group + * - RFC 7919 section A.1: ffdhe2048 + * - RFC 7919 section A.2: ffdhe3072 + * - RFC 7919 section A.3: ffdhe4096 + * - RFC 7919 section A.4: ffdhe6144 + * - RFC 7919 section A.5: ffdhe8192 + * + * The constants with suffix "_p" denote the chosen prime moduli, while + * the constants with suffix "_g" denote the chosen generator + * of the associated prime field. + * + * The constants further suffixed with "_bin" are provided in binary format, + * while all other constants represent null-terminated strings holding the + * hexadecimal presentation of the respective numbers. + * + * The primes from RFC 3526 and RFC 7919 have been generating by the following + * trust-worthy procedure: + * - Fix N in { 2048, 3072, 4096, 6144, 8192 } and consider the N-bit number + * the first and last 64 bits are all 1, and the remaining N - 128 bits of + * which are 0x7ff...ff. + * - Add the smallest multiple of the first N - 129 bits of the binary expansion + * of pi (for RFC 5236) or e (for RFC 7919) to this intermediate bit-string + * such that the resulting integer is a safe-prime. + * - The result is the respective RFC 3526 / 7919 prime, and the corresponding + * generator is always chosen to be 2 (which is a square for these prime, + * hence the corresponding subgroup has order (p-1)/2 and avoids leaking a + * bit in the private exponent). + * + */ + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) + +/** + * \warning The origin of the primes in RFC 5114 is not documented and + * their use therefore constitutes a security risk! + * + * \deprecated The hex-encoded primes from RFC 5114 are deprecated and are + * likely to be removed in a future version of the library without + * replacement. + */ + +/** + * The hexadecimal presentation of the prime underlying the + * 2048-bit MODP Group with 224-bit Prime Order Subgroup, as defined + * in RFC-5114: Additional Diffie-Hellman Groups for Use with + * IETF Standards. + */ +#define MBEDTLS_DHM_RFC5114_MODP_2048_P \ + MBEDTLS_DEPRECATED_STRING_CONSTANT( \ + "AD107E1E9123A9D0D660FAA79559C51FA20D64E5683B9FD1" \ + "B54B1597B61D0A75E6FA141DF95A56DBAF9A3C407BA1DF15" \ + "EB3D688A309C180E1DE6B85A1274A0A66D3F8152AD6AC212" \ + "9037C9EDEFDA4DF8D91E8FEF55B7394B7AD5B7D0B6C12207" \ + "C9F98D11ED34DBF6C6BA0B2C8BBC27BE6A00E0A0B9C49708" \ + "B3BF8A317091883681286130BC8985DB1602E714415D9330" \ + "278273C7DE31EFDC7310F7121FD5A07415987D9ADC0A486D" \ + "CDF93ACC44328387315D75E198C641A480CD86A1B9E587E8" \ + "BE60E69CC928B2B9C52172E413042E9B23F10B0E16E79763" \ + "C9B53DCF4BA80A29E3FB73C16B8E75B97EF363E2FFA31F71" \ + "CF9DE5384E71B81C0AC4DFFE0C10E64F" ) + +/** + * The hexadecimal presentation of the chosen generator of the 2048-bit MODP + * Group with 224-bit Prime Order Subgroup, as defined in RFC-5114: + * Additional Diffie-Hellman Groups for Use with IETF Standards. + */ +#define MBEDTLS_DHM_RFC5114_MODP_2048_G \ + MBEDTLS_DEPRECATED_STRING_CONSTANT( \ + "AC4032EF4F2D9AE39DF30B5C8FFDAC506CDEBE7B89998CAF" \ + "74866A08CFE4FFE3A6824A4E10B9A6F0DD921F01A70C4AFA" \ + "AB739D7700C29F52C57DB17C620A8652BE5E9001A8D66AD7" \ + "C17669101999024AF4D027275AC1348BB8A762D0521BC98A" \ + "E247150422EA1ED409939D54DA7460CDB5F6C6B250717CBE" \ + "F180EB34118E98D119529A45D6F834566E3025E316A330EF" \ + "BB77A86F0C1AB15B051AE3D428C8F8ACB70A8137150B8EEB" \ + "10E183EDD19963DDD9E263E4770589EF6AA21E7F5F2FF381" \ + "B539CCE3409D13CD566AFBB48D6C019181E1BCFE94B30269" \ + "EDFE72FE9B6AA4BD7B5A0F1C71CFFF4C19C418E1F6EC0179" \ + "81BC087F2A7065B384B890D3191F2BFA" ) + +/** + * The hexadecimal presentation of the prime underlying the 2048-bit MODP + * Group, as defined in RFC-3526: More Modular Exponential (MODP) + * Diffie-Hellman groups for Internet Key Exchange (IKE). + * + * \deprecated The hex-encoded primes from RFC 3625 are deprecated and + * superseded by the corresponding macros providing them as + * binary constants. Their hex-encoded constants are likely + * to be removed in a future version of the library. + * + */ +#define MBEDTLS_DHM_RFC3526_MODP_2048_P \ + MBEDTLS_DEPRECATED_STRING_CONSTANT( \ + "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1" \ + "29024E088A67CC74020BBEA63B139B22514A08798E3404DD" \ + "EF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245" \ + "E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED" \ + "EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3D" \ + "C2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F" \ + "83655D23DCA3AD961C62F356208552BB9ED529077096966D" \ + "670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B" \ + "E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9" \ + "DE2BCBF6955817183995497CEA956AE515D2261898FA0510" \ + "15728E5A8AACAA68FFFFFFFFFFFFFFFF" ) + +/** + * The hexadecimal presentation of the chosen generator of the 2048-bit MODP + * Group, as defined in RFC-3526: More Modular Exponential (MODP) + * Diffie-Hellman groups for Internet Key Exchange (IKE). + */ +#define MBEDTLS_DHM_RFC3526_MODP_2048_G \ + MBEDTLS_DEPRECATED_STRING_CONSTANT( "02" ) + +/** + * The hexadecimal presentation of the prime underlying the 3072-bit MODP + * Group, as defined in RFC-3072: More Modular Exponential (MODP) + * Diffie-Hellman groups for Internet Key Exchange (IKE). + */ +#define MBEDTLS_DHM_RFC3526_MODP_3072_P \ + MBEDTLS_DEPRECATED_STRING_CONSTANT( \ + "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1" \ + "29024E088A67CC74020BBEA63B139B22514A08798E3404DD" \ + "EF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245" \ + "E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED" \ + "EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3D" \ + "C2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F" \ + "83655D23DCA3AD961C62F356208552BB9ED529077096966D" \ + "670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B" \ + "E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9" \ + "DE2BCBF6955817183995497CEA956AE515D2261898FA0510" \ + "15728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64" \ + "ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7" \ + "ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6B" \ + "F12FFA06D98A0864D87602733EC86A64521F2B18177B200C" \ + "BBE117577A615D6C770988C0BAD946E208E24FA074E5AB31" \ + "43DB5BFCE0FD108E4B82D120A93AD2CAFFFFFFFFFFFFFFFF" ) + +/** + * The hexadecimal presentation of the chosen generator of the 3072-bit MODP + * Group, as defined in RFC-3526: More Modular Exponential (MODP) + * Diffie-Hellman groups for Internet Key Exchange (IKE). + */ +#define MBEDTLS_DHM_RFC3526_MODP_3072_G \ + MBEDTLS_DEPRECATED_STRING_CONSTANT( "02" ) + +/** + * The hexadecimal presentation of the prime underlying the 4096-bit MODP + * Group, as defined in RFC-3526: More Modular Exponential (MODP) + * Diffie-Hellman groups for Internet Key Exchange (IKE). + */ +#define MBEDTLS_DHM_RFC3526_MODP_4096_P \ + MBEDTLS_DEPRECATED_STRING_CONSTANT( \ + "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1" \ + "29024E088A67CC74020BBEA63B139B22514A08798E3404DD" \ + "EF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245" \ + "E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED" \ + "EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3D" \ + "C2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F" \ + "83655D23DCA3AD961C62F356208552BB9ED529077096966D" \ + "670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B" \ + "E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9" \ + "DE2BCBF6955817183995497CEA956AE515D2261898FA0510" \ + "15728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64" \ + "ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7" \ + "ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6B" \ + "F12FFA06D98A0864D87602733EC86A64521F2B18177B200C" \ + "BBE117577A615D6C770988C0BAD946E208E24FA074E5AB31" \ + "43DB5BFCE0FD108E4B82D120A92108011A723C12A787E6D7" \ + "88719A10BDBA5B2699C327186AF4E23C1A946834B6150BDA" \ + "2583E9CA2AD44CE8DBBBC2DB04DE8EF92E8EFC141FBECAA6" \ + "287C59474E6BC05D99B2964FA090C3A2233BA186515BE7ED" \ + "1F612970CEE2D7AFB81BDD762170481CD0069127D5B05AA9" \ + "93B4EA988D8FDDC186FFB7DC90A6C08F4DF435C934063199" \ + "FFFFFFFFFFFFFFFF" ) + +/** + * The hexadecimal presentation of the chosen generator of the 4096-bit MODP + * Group, as defined in RFC-3526: More Modular Exponential (MODP) + * Diffie-Hellman groups for Internet Key Exchange (IKE). + */ +#define MBEDTLS_DHM_RFC3526_MODP_4096_G \ + MBEDTLS_DEPRECATED_STRING_CONSTANT( "02" ) + +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +/* + * Trustworthy DHM parameters in binary form + */ + +#define MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34, \ + 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, \ + 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, \ + 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, \ + 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD, \ + 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, \ + 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37, \ + 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, \ + 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6, \ + 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, \ + 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED, \ + 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, \ + 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6, \ + 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D, \ + 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05, \ + 0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A, \ + 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F, \ + 0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96, \ + 0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB, \ + 0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D, \ + 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04, \ + 0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C, \ + 0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B, \ + 0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03, \ + 0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F, \ + 0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9, \ + 0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18, \ + 0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5, \ + 0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10, \ + 0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAC, 0xAA, 0x68, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC3526_MODP_3072_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34, \ + 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, \ + 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, \ + 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, \ + 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD, \ + 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, \ + 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37, \ + 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, \ + 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6, \ + 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, \ + 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED, \ + 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, \ + 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6, \ + 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D, \ + 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05, \ + 0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A, \ + 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F, \ + 0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96, \ + 0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB, \ + 0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D, \ + 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04, \ + 0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C, \ + 0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B, \ + 0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03, \ + 0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F, \ + 0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9, \ + 0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18, \ + 0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5, \ + 0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10, \ + 0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAA, 0xC4, 0x2D, \ + 0xAD, 0x33, 0x17, 0x0D, 0x04, 0x50, 0x7A, 0x33, \ + 0xA8, 0x55, 0x21, 0xAB, 0xDF, 0x1C, 0xBA, 0x64, \ + 0xEC, 0xFB, 0x85, 0x04, 0x58, 0xDB, 0xEF, 0x0A, \ + 0x8A, 0xEA, 0x71, 0x57, 0x5D, 0x06, 0x0C, 0x7D, \ + 0xB3, 0x97, 0x0F, 0x85, 0xA6, 0xE1, 0xE4, 0xC7, \ + 0xAB, 0xF5, 0xAE, 0x8C, 0xDB, 0x09, 0x33, 0xD7, \ + 0x1E, 0x8C, 0x94, 0xE0, 0x4A, 0x25, 0x61, 0x9D, \ + 0xCE, 0xE3, 0xD2, 0x26, 0x1A, 0xD2, 0xEE, 0x6B, \ + 0xF1, 0x2F, 0xFA, 0x06, 0xD9, 0x8A, 0x08, 0x64, \ + 0xD8, 0x76, 0x02, 0x73, 0x3E, 0xC8, 0x6A, 0x64, \ + 0x52, 0x1F, 0x2B, 0x18, 0x17, 0x7B, 0x20, 0x0C, \ + 0xBB, 0xE1, 0x17, 0x57, 0x7A, 0x61, 0x5D, 0x6C, \ + 0x77, 0x09, 0x88, 0xC0, 0xBA, 0xD9, 0x46, 0xE2, \ + 0x08, 0xE2, 0x4F, 0xA0, 0x74, 0xE5, 0xAB, 0x31, \ + 0x43, 0xDB, 0x5B, 0xFC, 0xE0, 0xFD, 0x10, 0x8E, \ + 0x4B, 0x82, 0xD1, 0x20, 0xA9, 0x3A, 0xD2, 0xCA, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC3526_MODP_3072_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC3526_MODP_4096_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34, \ + 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, \ + 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, \ + 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, \ + 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD, \ + 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, \ + 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37, \ + 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, \ + 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6, \ + 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, \ + 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED, \ + 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, \ + 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6, \ + 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D, \ + 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05, \ + 0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A, \ + 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F, \ + 0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96, \ + 0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB, \ + 0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D, \ + 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04, \ + 0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C, \ + 0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B, \ + 0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03, \ + 0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F, \ + 0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9, \ + 0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18, \ + 0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5, \ + 0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10, \ + 0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAA, 0xC4, 0x2D, \ + 0xAD, 0x33, 0x17, 0x0D, 0x04, 0x50, 0x7A, 0x33, \ + 0xA8, 0x55, 0x21, 0xAB, 0xDF, 0x1C, 0xBA, 0x64, \ + 0xEC, 0xFB, 0x85, 0x04, 0x58, 0xDB, 0xEF, 0x0A, \ + 0x8A, 0xEA, 0x71, 0x57, 0x5D, 0x06, 0x0C, 0x7D, \ + 0xB3, 0x97, 0x0F, 0x85, 0xA6, 0xE1, 0xE4, 0xC7, \ + 0xAB, 0xF5, 0xAE, 0x8C, 0xDB, 0x09, 0x33, 0xD7, \ + 0x1E, 0x8C, 0x94, 0xE0, 0x4A, 0x25, 0x61, 0x9D, \ + 0xCE, 0xE3, 0xD2, 0x26, 0x1A, 0xD2, 0xEE, 0x6B, \ + 0xF1, 0x2F, 0xFA, 0x06, 0xD9, 0x8A, 0x08, 0x64, \ + 0xD8, 0x76, 0x02, 0x73, 0x3E, 0xC8, 0x6A, 0x64, \ + 0x52, 0x1F, 0x2B, 0x18, 0x17, 0x7B, 0x20, 0x0C, \ + 0xBB, 0xE1, 0x17, 0x57, 0x7A, 0x61, 0x5D, 0x6C, \ + 0x77, 0x09, 0x88, 0xC0, 0xBA, 0xD9, 0x46, 0xE2, \ + 0x08, 0xE2, 0x4F, 0xA0, 0x74, 0xE5, 0xAB, 0x31, \ + 0x43, 0xDB, 0x5B, 0xFC, 0xE0, 0xFD, 0x10, 0x8E, \ + 0x4B, 0x82, 0xD1, 0x20, 0xA9, 0x21, 0x08, 0x01, \ + 0x1A, 0x72, 0x3C, 0x12, 0xA7, 0x87, 0xE6, 0xD7, \ + 0x88, 0x71, 0x9A, 0x10, 0xBD, 0xBA, 0x5B, 0x26, \ + 0x99, 0xC3, 0x27, 0x18, 0x6A, 0xF4, 0xE2, 0x3C, \ + 0x1A, 0x94, 0x68, 0x34, 0xB6, 0x15, 0x0B, 0xDA, \ + 0x25, 0x83, 0xE9, 0xCA, 0x2A, 0xD4, 0x4C, 0xE8, \ + 0xDB, 0xBB, 0xC2, 0xDB, 0x04, 0xDE, 0x8E, 0xF9, \ + 0x2E, 0x8E, 0xFC, 0x14, 0x1F, 0xBE, 0xCA, 0xA6, \ + 0x28, 0x7C, 0x59, 0x47, 0x4E, 0x6B, 0xC0, 0x5D, \ + 0x99, 0xB2, 0x96, 0x4F, 0xA0, 0x90, 0xC3, 0xA2, \ + 0x23, 0x3B, 0xA1, 0x86, 0x51, 0x5B, 0xE7, 0xED, \ + 0x1F, 0x61, 0x29, 0x70, 0xCE, 0xE2, 0xD7, 0xAF, \ + 0xB8, 0x1B, 0xDD, 0x76, 0x21, 0x70, 0x48, 0x1C, \ + 0xD0, 0x06, 0x91, 0x27, 0xD5, 0xB0, 0x5A, 0xA9, \ + 0x93, 0xB4, 0xEA, 0x98, 0x8D, 0x8F, 0xDD, 0xC1, \ + 0x86, 0xFF, 0xB7, 0xDC, 0x90, 0xA6, 0xC0, 0x8F, \ + 0x4D, 0xF4, 0x35, 0xC9, 0x34, 0x06, 0x31, 0x99, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC3526_MODP_4096_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC7919_FFDHE2048_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, \ + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, \ + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, \ + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, \ + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, \ + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, \ + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, \ + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, \ + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, \ + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, \ + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, \ + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, \ + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, \ + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, \ + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, \ + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, \ + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, \ + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, \ + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, \ + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, \ + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, \ + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, \ + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, \ + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, \ + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, \ + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, \ + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, \ + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, \ + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, \ + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x28, 0x5C, 0x97, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, } + +#define MBEDTLS_DHM_RFC7919_FFDHE2048_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC7919_FFDHE3072_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, \ + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, \ + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, \ + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, \ + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, \ + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, \ + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, \ + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, \ + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, \ + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, \ + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, \ + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, \ + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, \ + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, \ + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, \ + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, \ + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, \ + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, \ + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, \ + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, \ + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, \ + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, \ + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, \ + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, \ + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, \ + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, \ + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, \ + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, \ + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, \ + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC, \ + 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B, \ + 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38, \ + 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07, \ + 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE, \ + 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C, \ + 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70, \ + 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44, \ + 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3, \ + 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF, \ + 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E, \ + 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D, \ + 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA, \ + 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E, \ + 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF, \ + 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C, \ + 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0xC6, 0x2E, 0x37, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC7919_FFDHE3072_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC7919_FFDHE4096_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, \ + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, \ + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, \ + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, \ + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, \ + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, \ + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, \ + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, \ + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, \ + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, \ + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, \ + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, \ + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, \ + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, \ + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, \ + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, \ + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, \ + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, \ + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, \ + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, \ + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, \ + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, \ + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, \ + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, \ + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, \ + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, \ + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, \ + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, \ + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, \ + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC, \ + 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B, \ + 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38, \ + 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07, \ + 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE, \ + 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C, \ + 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70, \ + 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44, \ + 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3, \ + 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF, \ + 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E, \ + 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D, \ + 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA, \ + 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E, \ + 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF, \ + 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C, \ + 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0x9E, 0x1E, 0xF1, \ + 0x6E, 0x6F, 0x52, 0xC3, 0x16, 0x4D, 0xF4, 0xFB, \ + 0x79, 0x30, 0xE9, 0xE4, 0xE5, 0x88, 0x57, 0xB6, \ + 0xAC, 0x7D, 0x5F, 0x42, 0xD6, 0x9F, 0x6D, 0x18, \ + 0x77, 0x63, 0xCF, 0x1D, 0x55, 0x03, 0x40, 0x04, \ + 0x87, 0xF5, 0x5B, 0xA5, 0x7E, 0x31, 0xCC, 0x7A, \ + 0x71, 0x35, 0xC8, 0x86, 0xEF, 0xB4, 0x31, 0x8A, \ + 0xED, 0x6A, 0x1E, 0x01, 0x2D, 0x9E, 0x68, 0x32, \ + 0xA9, 0x07, 0x60, 0x0A, 0x91, 0x81, 0x30, 0xC4, \ + 0x6D, 0xC7, 0x78, 0xF9, 0x71, 0xAD, 0x00, 0x38, \ + 0x09, 0x29, 0x99, 0xA3, 0x33, 0xCB, 0x8B, 0x7A, \ + 0x1A, 0x1D, 0xB9, 0x3D, 0x71, 0x40, 0x00, 0x3C, \ + 0x2A, 0x4E, 0xCE, 0xA9, 0xF9, 0x8D, 0x0A, 0xCC, \ + 0x0A, 0x82, 0x91, 0xCD, 0xCE, 0xC9, 0x7D, 0xCF, \ + 0x8E, 0xC9, 0xB5, 0x5A, 0x7F, 0x88, 0xA4, 0x6B, \ + 0x4D, 0xB5, 0xA8, 0x51, 0xF4, 0x41, 0x82, 0xE1, \ + 0xC6, 0x8A, 0x00, 0x7E, 0x5E, 0x65, 0x5F, 0x6A, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC7919_FFDHE4096_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC7919_FFDHE6144_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, \ + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, \ + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, \ + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, \ + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, \ + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, \ + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, \ + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, \ + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, \ + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, \ + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, \ + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, \ + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, \ + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, \ + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, \ + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, \ + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, \ + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, \ + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, \ + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, \ + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, \ + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, \ + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, \ + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, \ + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, \ + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, \ + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, \ + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, \ + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, \ + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC, \ + 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B, \ + 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38, \ + 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07, \ + 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE, \ + 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C, \ + 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70, \ + 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44, \ + 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3, \ + 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF, \ + 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E, \ + 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D, \ + 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA, \ + 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E, \ + 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF, \ + 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C, \ + 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0x9E, 0x1E, 0xF1, \ + 0x6E, 0x6F, 0x52, 0xC3, 0x16, 0x4D, 0xF4, 0xFB, \ + 0x79, 0x30, 0xE9, 0xE4, 0xE5, 0x88, 0x57, 0xB6, \ + 0xAC, 0x7D, 0x5F, 0x42, 0xD6, 0x9F, 0x6D, 0x18, \ + 0x77, 0x63, 0xCF, 0x1D, 0x55, 0x03, 0x40, 0x04, \ + 0x87, 0xF5, 0x5B, 0xA5, 0x7E, 0x31, 0xCC, 0x7A, \ + 0x71, 0x35, 0xC8, 0x86, 0xEF, 0xB4, 0x31, 0x8A, \ + 0xED, 0x6A, 0x1E, 0x01, 0x2D, 0x9E, 0x68, 0x32, \ + 0xA9, 0x07, 0x60, 0x0A, 0x91, 0x81, 0x30, 0xC4, \ + 0x6D, 0xC7, 0x78, 0xF9, 0x71, 0xAD, 0x00, 0x38, \ + 0x09, 0x29, 0x99, 0xA3, 0x33, 0xCB, 0x8B, 0x7A, \ + 0x1A, 0x1D, 0xB9, 0x3D, 0x71, 0x40, 0x00, 0x3C, \ + 0x2A, 0x4E, 0xCE, 0xA9, 0xF9, 0x8D, 0x0A, 0xCC, \ + 0x0A, 0x82, 0x91, 0xCD, 0xCE, 0xC9, 0x7D, 0xCF, \ + 0x8E, 0xC9, 0xB5, 0x5A, 0x7F, 0x88, 0xA4, 0x6B, \ + 0x4D, 0xB5, 0xA8, 0x51, 0xF4, 0x41, 0x82, 0xE1, \ + 0xC6, 0x8A, 0x00, 0x7E, 0x5E, 0x0D, 0xD9, 0x02, \ + 0x0B, 0xFD, 0x64, 0xB6, 0x45, 0x03, 0x6C, 0x7A, \ + 0x4E, 0x67, 0x7D, 0x2C, 0x38, 0x53, 0x2A, 0x3A, \ + 0x23, 0xBA, 0x44, 0x42, 0xCA, 0xF5, 0x3E, 0xA6, \ + 0x3B, 0xB4, 0x54, 0x32, 0x9B, 0x76, 0x24, 0xC8, \ + 0x91, 0x7B, 0xDD, 0x64, 0xB1, 0xC0, 0xFD, 0x4C, \ + 0xB3, 0x8E, 0x8C, 0x33, 0x4C, 0x70, 0x1C, 0x3A, \ + 0xCD, 0xAD, 0x06, 0x57, 0xFC, 0xCF, 0xEC, 0x71, \ + 0x9B, 0x1F, 0x5C, 0x3E, 0x4E, 0x46, 0x04, 0x1F, \ + 0x38, 0x81, 0x47, 0xFB, 0x4C, 0xFD, 0xB4, 0x77, \ + 0xA5, 0x24, 0x71, 0xF7, 0xA9, 0xA9, 0x69, 0x10, \ + 0xB8, 0x55, 0x32, 0x2E, 0xDB, 0x63, 0x40, 0xD8, \ + 0xA0, 0x0E, 0xF0, 0x92, 0x35, 0x05, 0x11, 0xE3, \ + 0x0A, 0xBE, 0xC1, 0xFF, 0xF9, 0xE3, 0xA2, 0x6E, \ + 0x7F, 0xB2, 0x9F, 0x8C, 0x18, 0x30, 0x23, 0xC3, \ + 0x58, 0x7E, 0x38, 0xDA, 0x00, 0x77, 0xD9, 0xB4, \ + 0x76, 0x3E, 0x4E, 0x4B, 0x94, 0xB2, 0xBB, 0xC1, \ + 0x94, 0xC6, 0x65, 0x1E, 0x77, 0xCA, 0xF9, 0x92, \ + 0xEE, 0xAA, 0xC0, 0x23, 0x2A, 0x28, 0x1B, 0xF6, \ + 0xB3, 0xA7, 0x39, 0xC1, 0x22, 0x61, 0x16, 0x82, \ + 0x0A, 0xE8, 0xDB, 0x58, 0x47, 0xA6, 0x7C, 0xBE, \ + 0xF9, 0xC9, 0x09, 0x1B, 0x46, 0x2D, 0x53, 0x8C, \ + 0xD7, 0x2B, 0x03, 0x74, 0x6A, 0xE7, 0x7F, 0x5E, \ + 0x62, 0x29, 0x2C, 0x31, 0x15, 0x62, 0xA8, 0x46, \ + 0x50, 0x5D, 0xC8, 0x2D, 0xB8, 0x54, 0x33, 0x8A, \ + 0xE4, 0x9F, 0x52, 0x35, 0xC9, 0x5B, 0x91, 0x17, \ + 0x8C, 0xCF, 0x2D, 0xD5, 0xCA, 0xCE, 0xF4, 0x03, \ + 0xEC, 0x9D, 0x18, 0x10, 0xC6, 0x27, 0x2B, 0x04, \ + 0x5B, 0x3B, 0x71, 0xF9, 0xDC, 0x6B, 0x80, 0xD6, \ + 0x3F, 0xDD, 0x4A, 0x8E, 0x9A, 0xDB, 0x1E, 0x69, \ + 0x62, 0xA6, 0x95, 0x26, 0xD4, 0x31, 0x61, 0xC1, \ + 0xA4, 0x1D, 0x57, 0x0D, 0x79, 0x38, 0xDA, 0xD4, \ + 0xA4, 0x0E, 0x32, 0x9C, 0xD0, 0xE4, 0x0E, 0x65, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC7919_FFDHE6144_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC7919_FFDHE8192_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, \ + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, \ + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, \ + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, \ + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, \ + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, \ + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, \ + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, \ + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, \ + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, \ + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, \ + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, \ + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, \ + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, \ + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, \ + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, \ + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, \ + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, \ + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, \ + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, \ + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, \ + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, \ + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, \ + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, \ + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, \ + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, \ + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, \ + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, \ + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, \ + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC, \ + 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B, \ + 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38, \ + 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07, \ + 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE, \ + 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C, \ + 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70, \ + 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44, \ + 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3, \ + 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF, \ + 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E, \ + 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D, \ + 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA, \ + 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E, \ + 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF, \ + 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C, \ + 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0x9E, 0x1E, 0xF1, \ + 0x6E, 0x6F, 0x52, 0xC3, 0x16, 0x4D, 0xF4, 0xFB, \ + 0x79, 0x30, 0xE9, 0xE4, 0xE5, 0x88, 0x57, 0xB6, \ + 0xAC, 0x7D, 0x5F, 0x42, 0xD6, 0x9F, 0x6D, 0x18, \ + 0x77, 0x63, 0xCF, 0x1D, 0x55, 0x03, 0x40, 0x04, \ + 0x87, 0xF5, 0x5B, 0xA5, 0x7E, 0x31, 0xCC, 0x7A, \ + 0x71, 0x35, 0xC8, 0x86, 0xEF, 0xB4, 0x31, 0x8A, \ + 0xED, 0x6A, 0x1E, 0x01, 0x2D, 0x9E, 0x68, 0x32, \ + 0xA9, 0x07, 0x60, 0x0A, 0x91, 0x81, 0x30, 0xC4, \ + 0x6D, 0xC7, 0x78, 0xF9, 0x71, 0xAD, 0x00, 0x38, \ + 0x09, 0x29, 0x99, 0xA3, 0x33, 0xCB, 0x8B, 0x7A, \ + 0x1A, 0x1D, 0xB9, 0x3D, 0x71, 0x40, 0x00, 0x3C, \ + 0x2A, 0x4E, 0xCE, 0xA9, 0xF9, 0x8D, 0x0A, 0xCC, \ + 0x0A, 0x82, 0x91, 0xCD, 0xCE, 0xC9, 0x7D, 0xCF, \ + 0x8E, 0xC9, 0xB5, 0x5A, 0x7F, 0x88, 0xA4, 0x6B, \ + 0x4D, 0xB5, 0xA8, 0x51, 0xF4, 0x41, 0x82, 0xE1, \ + 0xC6, 0x8A, 0x00, 0x7E, 0x5E, 0x0D, 0xD9, 0x02, \ + 0x0B, 0xFD, 0x64, 0xB6, 0x45, 0x03, 0x6C, 0x7A, \ + 0x4E, 0x67, 0x7D, 0x2C, 0x38, 0x53, 0x2A, 0x3A, \ + 0x23, 0xBA, 0x44, 0x42, 0xCA, 0xF5, 0x3E, 0xA6, \ + 0x3B, 0xB4, 0x54, 0x32, 0x9B, 0x76, 0x24, 0xC8, \ + 0x91, 0x7B, 0xDD, 0x64, 0xB1, 0xC0, 0xFD, 0x4C, \ + 0xB3, 0x8E, 0x8C, 0x33, 0x4C, 0x70, 0x1C, 0x3A, \ + 0xCD, 0xAD, 0x06, 0x57, 0xFC, 0xCF, 0xEC, 0x71, \ + 0x9B, 0x1F, 0x5C, 0x3E, 0x4E, 0x46, 0x04, 0x1F, \ + 0x38, 0x81, 0x47, 0xFB, 0x4C, 0xFD, 0xB4, 0x77, \ + 0xA5, 0x24, 0x71, 0xF7, 0xA9, 0xA9, 0x69, 0x10, \ + 0xB8, 0x55, 0x32, 0x2E, 0xDB, 0x63, 0x40, 0xD8, \ + 0xA0, 0x0E, 0xF0, 0x92, 0x35, 0x05, 0x11, 0xE3, \ + 0x0A, 0xBE, 0xC1, 0xFF, 0xF9, 0xE3, 0xA2, 0x6E, \ + 0x7F, 0xB2, 0x9F, 0x8C, 0x18, 0x30, 0x23, 0xC3, \ + 0x58, 0x7E, 0x38, 0xDA, 0x00, 0x77, 0xD9, 0xB4, \ + 0x76, 0x3E, 0x4E, 0x4B, 0x94, 0xB2, 0xBB, 0xC1, \ + 0x94, 0xC6, 0x65, 0x1E, 0x77, 0xCA, 0xF9, 0x92, \ + 0xEE, 0xAA, 0xC0, 0x23, 0x2A, 0x28, 0x1B, 0xF6, \ + 0xB3, 0xA7, 0x39, 0xC1, 0x22, 0x61, 0x16, 0x82, \ + 0x0A, 0xE8, 0xDB, 0x58, 0x47, 0xA6, 0x7C, 0xBE, \ + 0xF9, 0xC9, 0x09, 0x1B, 0x46, 0x2D, 0x53, 0x8C, \ + 0xD7, 0x2B, 0x03, 0x74, 0x6A, 0xE7, 0x7F, 0x5E, \ + 0x62, 0x29, 0x2C, 0x31, 0x15, 0x62, 0xA8, 0x46, \ + 0x50, 0x5D, 0xC8, 0x2D, 0xB8, 0x54, 0x33, 0x8A, \ + 0xE4, 0x9F, 0x52, 0x35, 0xC9, 0x5B, 0x91, 0x17, \ + 0x8C, 0xCF, 0x2D, 0xD5, 0xCA, 0xCE, 0xF4, 0x03, \ + 0xEC, 0x9D, 0x18, 0x10, 0xC6, 0x27, 0x2B, 0x04, \ + 0x5B, 0x3B, 0x71, 0xF9, 0xDC, 0x6B, 0x80, 0xD6, \ + 0x3F, 0xDD, 0x4A, 0x8E, 0x9A, 0xDB, 0x1E, 0x69, \ + 0x62, 0xA6, 0x95, 0x26, 0xD4, 0x31, 0x61, 0xC1, \ + 0xA4, 0x1D, 0x57, 0x0D, 0x79, 0x38, 0xDA, 0xD4, \ + 0xA4, 0x0E, 0x32, 0x9C, 0xCF, 0xF4, 0x6A, 0xAA, \ + 0x36, 0xAD, 0x00, 0x4C, 0xF6, 0x00, 0xC8, 0x38, \ + 0x1E, 0x42, 0x5A, 0x31, 0xD9, 0x51, 0xAE, 0x64, \ + 0xFD, 0xB2, 0x3F, 0xCE, 0xC9, 0x50, 0x9D, 0x43, \ + 0x68, 0x7F, 0xEB, 0x69, 0xED, 0xD1, 0xCC, 0x5E, \ + 0x0B, 0x8C, 0xC3, 0xBD, 0xF6, 0x4B, 0x10, 0xEF, \ + 0x86, 0xB6, 0x31, 0x42, 0xA3, 0xAB, 0x88, 0x29, \ + 0x55, 0x5B, 0x2F, 0x74, 0x7C, 0x93, 0x26, 0x65, \ + 0xCB, 0x2C, 0x0F, 0x1C, 0xC0, 0x1B, 0xD7, 0x02, \ + 0x29, 0x38, 0x88, 0x39, 0xD2, 0xAF, 0x05, 0xE4, \ + 0x54, 0x50, 0x4A, 0xC7, 0x8B, 0x75, 0x82, 0x82, \ + 0x28, 0x46, 0xC0, 0xBA, 0x35, 0xC3, 0x5F, 0x5C, \ + 0x59, 0x16, 0x0C, 0xC0, 0x46, 0xFD, 0x82, 0x51, \ + 0x54, 0x1F, 0xC6, 0x8C, 0x9C, 0x86, 0xB0, 0x22, \ + 0xBB, 0x70, 0x99, 0x87, 0x6A, 0x46, 0x0E, 0x74, \ + 0x51, 0xA8, 0xA9, 0x31, 0x09, 0x70, 0x3F, 0xEE, \ + 0x1C, 0x21, 0x7E, 0x6C, 0x38, 0x26, 0xE5, 0x2C, \ + 0x51, 0xAA, 0x69, 0x1E, 0x0E, 0x42, 0x3C, 0xFC, \ + 0x99, 0xE9, 0xE3, 0x16, 0x50, 0xC1, 0x21, 0x7B, \ + 0x62, 0x48, 0x16, 0xCD, 0xAD, 0x9A, 0x95, 0xF9, \ + 0xD5, 0xB8, 0x01, 0x94, 0x88, 0xD9, 0xC0, 0xA0, \ + 0xA1, 0xFE, 0x30, 0x75, 0xA5, 0x77, 0xE2, 0x31, \ + 0x83, 0xF8, 0x1D, 0x4A, 0x3F, 0x2F, 0xA4, 0x57, \ + 0x1E, 0xFC, 0x8C, 0xE0, 0xBA, 0x8A, 0x4F, 0xE8, \ + 0xB6, 0x85, 0x5D, 0xFE, 0x72, 0xB0, 0xA6, 0x6E, \ + 0xDE, 0xD2, 0xFB, 0xAB, 0xFB, 0xE5, 0x8A, 0x30, \ + 0xFA, 0xFA, 0xBE, 0x1C, 0x5D, 0x71, 0xA8, 0x7E, \ + 0x2F, 0x74, 0x1E, 0xF8, 0xC1, 0xFE, 0x86, 0xFE, \ + 0xA6, 0xBB, 0xFD, 0xE5, 0x30, 0x67, 0x7F, 0x0D, \ + 0x97, 0xD1, 0x1D, 0x49, 0xF7, 0xA8, 0x44, 0x3D, \ + 0x08, 0x22, 0xE5, 0x06, 0xA9, 0xF4, 0x61, 0x4E, \ + 0x01, 0x1E, 0x2A, 0x94, 0x83, 0x8F, 0xF8, 0x8C, \ + 0xD6, 0x8C, 0x8B, 0xB7, 0xC5, 0xC6, 0x42, 0x4C, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC7919_FFDHE8192_G_BIN { 0x02 } + +#endif /* dhm.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/ecdh.h b/openharmony/arm64-v8a/include/mbedtls/ecdh.h new file mode 100644 index 00000000..05855cdf --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/ecdh.h @@ -0,0 +1,446 @@ +/** + * \file ecdh.h + * + * \brief This file contains ECDH definitions and functions. + * + * The Elliptic Curve Diffie-Hellman (ECDH) protocol is an anonymous + * key agreement protocol allowing two parties to establish a shared + * secret over an insecure channel. Each party must have an + * elliptic-curve public–private key pair. + * + * For more information, see NIST SP 800-56A Rev. 2: Recommendation for + * Pair-Wise Key Establishment Schemes Using Discrete Logarithm + * Cryptography. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_ECDH_H +#define MBEDTLS_ECDH_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/ecp.h" + +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) +#undef MBEDTLS_ECDH_LEGACY_CONTEXT +#include "everest/everest.h" +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Defines the source of the imported EC key. + */ +typedef enum +{ + MBEDTLS_ECDH_OURS, /**< Our key. */ + MBEDTLS_ECDH_THEIRS, /**< The key of the peer. */ +} mbedtls_ecdh_side; + +#if !defined(MBEDTLS_ECDH_LEGACY_CONTEXT) +/** + * Defines the ECDH implementation used. + * + * Later versions of the library may add new variants, therefore users should + * not make any assumptions about them. + */ +typedef enum +{ + MBEDTLS_ECDH_VARIANT_NONE = 0, /*!< Implementation not defined. */ + MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0,/*!< The default Mbed TLS implementation */ +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) + MBEDTLS_ECDH_VARIANT_EVEREST /*!< Everest implementation */ +#endif +} mbedtls_ecdh_variant; + +/** + * The context used by the default ECDH implementation. + * + * Later versions might change the structure of this context, therefore users + * should not make any assumptions about the structure of + * mbedtls_ecdh_context_mbed. + */ +typedef struct mbedtls_ecdh_context_mbed +{ + mbedtls_ecp_group grp; /*!< The elliptic curve used. */ + mbedtls_mpi d; /*!< The private key. */ + mbedtls_ecp_point Q; /*!< The public key. */ + mbedtls_ecp_point Qp; /*!< The value of the public key of the peer. */ + mbedtls_mpi z; /*!< The shared secret. */ +#if defined(MBEDTLS_ECP_RESTARTABLE) + mbedtls_ecp_restart_ctx rs; /*!< The restart context for EC computations. */ +#endif +} mbedtls_ecdh_context_mbed; +#endif + +/** + * + * \warning Performing multiple operations concurrently on the same + * ECDSA context is not supported; objects of this type + * should not be shared between multiple threads. + * \brief The ECDH context structure. + */ +typedef struct mbedtls_ecdh_context +{ +#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT) + mbedtls_ecp_group grp; /*!< The elliptic curve used. */ + mbedtls_mpi d; /*!< The private key. */ + mbedtls_ecp_point Q; /*!< The public key. */ + mbedtls_ecp_point Qp; /*!< The value of the public key of the peer. */ + mbedtls_mpi z; /*!< The shared secret. */ + int point_format; /*!< The format of point export in TLS messages. */ + mbedtls_ecp_point Vi; /*!< The blinding value. */ + mbedtls_ecp_point Vf; /*!< The unblinding value. */ + mbedtls_mpi _d; /*!< The previous \p d. */ +#if defined(MBEDTLS_ECP_RESTARTABLE) + int restart_enabled; /*!< The flag for restartable mode. */ + mbedtls_ecp_restart_ctx rs; /*!< The restart context for EC computations. */ +#endif /* MBEDTLS_ECP_RESTARTABLE */ +#else + uint8_t point_format; /*!< The format of point export in TLS messages + as defined in RFC 4492. */ + mbedtls_ecp_group_id grp_id;/*!< The elliptic curve used. */ + mbedtls_ecdh_variant var; /*!< The ECDH implementation/structure used. */ + union + { + mbedtls_ecdh_context_mbed mbed_ecdh; +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) + mbedtls_ecdh_context_everest everest_ecdh; +#endif + } ctx; /*!< Implementation-specific context. The + context in use is specified by the \c var + field. */ +#if defined(MBEDTLS_ECP_RESTARTABLE) + uint8_t restart_enabled; /*!< The flag for restartable mode. Functions of + an alternative implementation not supporting + restartable mode must return + MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED error + if this flag is set. */ +#endif /* MBEDTLS_ECP_RESTARTABLE */ +#endif /* MBEDTLS_ECDH_LEGACY_CONTEXT */ +} +mbedtls_ecdh_context; + +/** + * \brief Check whether a given group can be used for ECDH. + * + * \param gid The ECP group ID to check. + * + * \return \c 1 if the group can be used, \c 0 otherwise + */ +int mbedtls_ecdh_can_do( mbedtls_ecp_group_id gid ); + +/** + * \brief This function generates an ECDH keypair on an elliptic + * curve. + * + * This function performs the first of two core computations + * implemented during the ECDH key exchange. The second core + * computation is performed by mbedtls_ecdh_compute_shared(). + * + * \see ecp.h + * + * \param grp The ECP group to use. This must be initialized and have + * domain parameters loaded, for example through + * mbedtls_ecp_load() or mbedtls_ecp_tls_read_group(). + * \param d The destination MPI (private key). + * This must be initialized. + * \param Q The destination point (public key). + * This must be initialized. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL in case \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return Another \c MBEDTLS_ERR_ECP_XXX or + * \c MBEDTLS_MPI_XXX error code on failure. + */ +int mbedtls_ecdh_gen_public( mbedtls_ecp_group *grp, mbedtls_mpi *d, mbedtls_ecp_point *Q, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function computes the shared secret. + * + * This function performs the second of two core computations + * implemented during the ECDH key exchange. The first core + * computation is performed by mbedtls_ecdh_gen_public(). + * + * \see ecp.h + * + * \note If \p f_rng is not NULL, it is used to implement + * countermeasures against side-channel attacks. + * For more information, see mbedtls_ecp_mul(). + * + * \param grp The ECP group to use. This must be initialized and have + * domain parameters loaded, for example through + * mbedtls_ecp_load() or mbedtls_ecp_tls_read_group(). + * \param z The destination MPI (shared secret). + * This must be initialized. + * \param Q The public key from another party. + * This must be initialized. + * \param d Our secret exponent (private key). + * This must be initialized. + * \param f_rng The RNG function. This may be \c NULL if randomization + * of intermediate results during the ECP computations is + * not needed (discouraged). See the documentation of + * mbedtls_ecp_mul() for more. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a + * context argument. + * + * \return \c 0 on success. + * \return Another \c MBEDTLS_ERR_ECP_XXX or + * \c MBEDTLS_MPI_XXX error code on failure. + */ +int mbedtls_ecdh_compute_shared( mbedtls_ecp_group *grp, mbedtls_mpi *z, + const mbedtls_ecp_point *Q, const mbedtls_mpi *d, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function initializes an ECDH context. + * + * \param ctx The ECDH context to initialize. This must not be \c NULL. + */ +void mbedtls_ecdh_init( mbedtls_ecdh_context *ctx ); + +/** + * \brief This function sets up the ECDH context with the information + * given. + * + * This function should be called after mbedtls_ecdh_init() but + * before mbedtls_ecdh_make_params(). There is no need to call + * this function before mbedtls_ecdh_read_params(). + * + * This is the first function used by a TLS server for ECDHE + * ciphersuites. + * + * \param ctx The ECDH context to set up. This must be initialized. + * \param grp_id The group id of the group to set up the context for. + * + * \return \c 0 on success. + */ +int mbedtls_ecdh_setup( mbedtls_ecdh_context *ctx, + mbedtls_ecp_group_id grp_id ); + +/** + * \brief This function frees a context. + * + * \param ctx The context to free. This may be \c NULL, in which + * case this function does nothing. If it is not \c NULL, + * it must point to an initialized ECDH context. + */ +void mbedtls_ecdh_free( mbedtls_ecdh_context *ctx ); + +/** + * \brief This function generates an EC key pair and exports its + * in the format used in a TLS ServerKeyExchange handshake + * message. + * + * This is the second function used by a TLS server for ECDHE + * ciphersuites. (It is called after mbedtls_ecdh_setup().) + * + * \see ecp.h + * + * \param ctx The ECDH context to use. This must be initialized + * and bound to a group, for example via mbedtls_ecdh_setup(). + * \param olen The address at which to store the number of Bytes written. + * \param buf The destination buffer. This must be a writable buffer of + * length \p blen Bytes. + * \param blen The length of the destination buffer \p buf in Bytes. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL in case \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_ecdh_make_params( mbedtls_ecdh_context *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function parses the ECDHE parameters in a + * TLS ServerKeyExchange handshake message. + * + * \note In a TLS handshake, this is the how the client + * sets up its ECDHE context from the server's public + * ECDHE key material. + * + * \see ecp.h + * + * \param ctx The ECDHE context to use. This must be initialized. + * \param buf On input, \c *buf must be the start of the input buffer. + * On output, \c *buf is updated to point to the end of the + * data that has been read. On success, this is the first byte + * past the end of the ServerKeyExchange parameters. + * On error, this is the point at which an error has been + * detected, which is usually not useful except to debug + * failures. + * \param end The end of the input buffer. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + * + */ +int mbedtls_ecdh_read_params( mbedtls_ecdh_context *ctx, + const unsigned char **buf, + const unsigned char *end ); + +/** + * \brief This function sets up an ECDH context from an EC key. + * + * It is used by clients and servers in place of the + * ServerKeyEchange for static ECDH, and imports ECDH + * parameters from the EC key information of a certificate. + * + * \see ecp.h + * + * \param ctx The ECDH context to set up. This must be initialized. + * \param key The EC key to use. This must be initialized. + * \param side Defines the source of the key. Possible values are: + * - #MBEDTLS_ECDH_OURS: The key is ours. + * - #MBEDTLS_ECDH_THEIRS: The key is that of the peer. + * + * \return \c 0 on success. + * \return Another \c MBEDTLS_ERR_ECP_XXX error code on failure. + * + */ +int mbedtls_ecdh_get_params( mbedtls_ecdh_context *ctx, + const mbedtls_ecp_keypair *key, + mbedtls_ecdh_side side ); + +/** + * \brief This function generates a public key and exports it + * as a TLS ClientKeyExchange payload. + * + * This is the second function used by a TLS client for ECDH(E) + * ciphersuites. + * + * \see ecp.h + * + * \param ctx The ECDH context to use. This must be initialized + * and bound to a group, the latter usually by + * mbedtls_ecdh_read_params(). + * \param olen The address at which to store the number of Bytes written. + * This must not be \c NULL. + * \param buf The destination buffer. This must be a writable buffer + * of length \p blen Bytes. + * \param blen The size of the destination buffer \p buf in Bytes. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL in case \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_ecdh_make_public( mbedtls_ecdh_context *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function parses and processes the ECDHE payload of a + * TLS ClientKeyExchange message. + * + * This is the third function used by a TLS server for ECDH(E) + * ciphersuites. (It is called after mbedtls_ecdh_setup() and + * mbedtls_ecdh_make_params().) + * + * \see ecp.h + * + * \param ctx The ECDH context to use. This must be initialized + * and bound to a group, for example via mbedtls_ecdh_setup(). + * \param buf The pointer to the ClientKeyExchange payload. This must + * be a readable buffer of length \p blen Bytes. + * \param blen The length of the input buffer \p buf in Bytes. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_ecdh_read_public( mbedtls_ecdh_context *ctx, + const unsigned char *buf, size_t blen ); + +/** + * \brief This function derives and exports the shared secret. + * + * This is the last function used by both TLS client + * and servers. + * + * \note If \p f_rng is not NULL, it is used to implement + * countermeasures against side-channel attacks. + * For more information, see mbedtls_ecp_mul(). + * + * \see ecp.h + + * \param ctx The ECDH context to use. This must be initialized + * and have its own private key generated and the peer's + * public key imported. + * \param olen The address at which to store the total number of + * Bytes written on success. This must not be \c NULL. + * \param buf The buffer to write the generated shared key to. This + * must be a writable buffer of size \p blen Bytes. + * \param blen The length of the destination buffer \p buf in Bytes. + * \param f_rng The RNG function, for blinding purposes. This may + * b \c NULL if blinding isn't needed. + * \param p_rng The RNG context. This may be \c NULL if \p f_rng + * doesn't need a context argument. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_ecdh_calc_secret( mbedtls_ecdh_context *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +#if defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief This function enables restartable EC computations for this + * context. (Default: disabled.) + * + * \see \c mbedtls_ecp_set_max_ops() + * + * \note It is not possible to safely disable restartable + * computations once enabled, except by free-ing the context, + * which cancels possible in-progress operations. + * + * \param ctx The ECDH context to use. This must be initialized. + */ +void mbedtls_ecdh_enable_restart( mbedtls_ecdh_context *ctx ); +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +#ifdef __cplusplus +} +#endif + +#endif /* ecdh.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/ecdsa.h b/openharmony/arm64-v8a/include/mbedtls/ecdsa.h new file mode 100644 index 00000000..264a638b --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/ecdsa.h @@ -0,0 +1,626 @@ +/** + * \file ecdsa.h + * + * \brief This file contains ECDSA definitions and functions. + * + * The Elliptic Curve Digital Signature Algorithm (ECDSA) is defined in + * Standards for Efficient Cryptography Group (SECG): + * SEC1 Elliptic Curve Cryptography. + * The use of ECDSA for TLS is defined in RFC-4492: Elliptic Curve + * Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS). + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_ECDSA_H +#define MBEDTLS_ECDSA_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/ecp.h" +#include "mbedtls/md.h" + +/** + * \brief Maximum ECDSA signature size for a given curve bit size + * + * \param bits Curve size in bits + * \return Maximum signature size in bytes + * + * \note This macro returns a compile-time constant if its argument + * is one. It may evaluate its argument multiple times. + */ +/* + * Ecdsa-Sig-Value ::= SEQUENCE { + * r INTEGER, + * s INTEGER + * } + * + * For each of r and s, the value (V) may include an extra initial "0" bit. + */ +#define MBEDTLS_ECDSA_MAX_SIG_LEN( bits ) \ + ( /*T,L of SEQUENCE*/ ( ( bits ) >= 61 * 8 ? 3 : 2 ) + \ + /*T,L of r,s*/ 2 * ( ( ( bits ) >= 127 * 8 ? 3 : 2 ) + \ + /*V of r,s*/ ( ( bits ) + 8 ) / 8 ) ) + +/** The maximal size of an ECDSA signature in Bytes. */ +#define MBEDTLS_ECDSA_MAX_LEN MBEDTLS_ECDSA_MAX_SIG_LEN( MBEDTLS_ECP_MAX_BITS ) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief The ECDSA context structure. + * + * \warning Performing multiple operations concurrently on the same + * ECDSA context is not supported; objects of this type + * should not be shared between multiple threads. + */ +typedef mbedtls_ecp_keypair mbedtls_ecdsa_context; + +#if defined(MBEDTLS_ECP_RESTARTABLE) + +/** + * \brief Internal restart context for ecdsa_verify() + * + * \note Opaque struct, defined in ecdsa.c + */ +typedef struct mbedtls_ecdsa_restart_ver mbedtls_ecdsa_restart_ver_ctx; + +/** + * \brief Internal restart context for ecdsa_sign() + * + * \note Opaque struct, defined in ecdsa.c + */ +typedef struct mbedtls_ecdsa_restart_sig mbedtls_ecdsa_restart_sig_ctx; + +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) +/** + * \brief Internal restart context for ecdsa_sign_det() + * + * \note Opaque struct, defined in ecdsa.c + */ +typedef struct mbedtls_ecdsa_restart_det mbedtls_ecdsa_restart_det_ctx; +#endif + +/** + * \brief General context for resuming ECDSA operations + */ +typedef struct +{ + mbedtls_ecp_restart_ctx ecp; /*!< base context for ECP restart and + shared administrative info */ + mbedtls_ecdsa_restart_ver_ctx *ver; /*!< ecdsa_verify() sub-context */ + mbedtls_ecdsa_restart_sig_ctx *sig; /*!< ecdsa_sign() sub-context */ +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) + mbedtls_ecdsa_restart_det_ctx *det; /*!< ecdsa_sign_det() sub-context */ +#endif +} mbedtls_ecdsa_restart_ctx; + +#else /* MBEDTLS_ECP_RESTARTABLE */ + +/* Now we can declare functions that take a pointer to that */ +typedef void mbedtls_ecdsa_restart_ctx; + +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +/** + * \brief This function checks whether a given group can be used + * for ECDSA. + * + * \param gid The ECP group ID to check. + * + * \return \c 1 if the group can be used, \c 0 otherwise + */ +int mbedtls_ecdsa_can_do( mbedtls_ecp_group_id gid ); + +/** + * \brief This function computes the ECDSA signature of a + * previously-hashed message. + * + * \note The deterministic version implemented in + * mbedtls_ecdsa_sign_det() is usually preferred. + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated + * as defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.3, step 5. + * + * \see ecp.h + * + * \param grp The context for the elliptic curve to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param r The MPI context in which to store the first part + * the signature. This must be initialized. + * \param s The MPI context in which to store the second part + * the signature. This must be initialized. + * \param d The private signing key. This must be initialized. + * \param buf The content to be signed. This is usually the hash of + * the original data to be signed. This must be a readable + * buffer of length \p blen Bytes. It may be \c NULL if + * \p blen is zero. + * \param blen The length of \p buf in Bytes. + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context parameter. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX + * or \c MBEDTLS_MPI_XXX error code on failure. + */ +int mbedtls_ecdsa_sign( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s, + const mbedtls_mpi *d, const unsigned char *buf, size_t blen, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ); + +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) +#if ! defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function computes the ECDSA signature of a + * previously-hashed message, deterministic version. + * + * For more information, see RFC-6979: Deterministic + * Usage of the Digital Signature Algorithm (DSA) and Elliptic + * Curve Digital Signature Algorithm (ECDSA). + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.3, step 5. + * + * \warning Since the output of the internal RNG is always the same for + * the same key and message, this limits the efficiency of + * blinding and leaks information through side channels. For + * secure behavior use mbedtls_ecdsa_sign_det_ext() instead. + * + * (Optimally the blinding is a random value that is different + * on every execution. In this case the blinding is still + * random from the attackers perspective, but is the same on + * each execution. This means that this blinding does not + * prevent attackers from recovering secrets by combining + * several measurement traces, but may prevent some attacks + * that exploit relationships between secret data.) + * + * \see ecp.h + * + * \param grp The context for the elliptic curve to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param r The MPI context in which to store the first part + * the signature. This must be initialized. + * \param s The MPI context in which to store the second part + * the signature. This must be initialized. + * \param d The private signing key. This must be initialized + * and setup, for example through mbedtls_ecp_gen_privkey(). + * \param buf The hashed content to be signed. This must be a readable + * buffer of length \p blen Bytes. It may be \c NULL if + * \p blen is zero. + * \param blen The length of \p buf in Bytes. + * \param md_alg The hash algorithm used to hash the original data. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + * error code on failure. + */ +int mbedtls_ecdsa_sign_det( mbedtls_ecp_group *grp, mbedtls_mpi *r, + mbedtls_mpi *s, const mbedtls_mpi *d, + const unsigned char *buf, size_t blen, + mbedtls_md_type_t md_alg ) MBEDTLS_DEPRECATED; +#undef MBEDTLS_DEPRECATED +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief This function computes the ECDSA signature of a + * previously-hashed message, deterministic version. + * + * For more information, see RFC-6979: Deterministic + * Usage of the Digital Signature Algorithm (DSA) and Elliptic + * Curve Digital Signature Algorithm (ECDSA). + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.3, step 5. + * + * \see ecp.h + * + * \param grp The context for the elliptic curve to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param r The MPI context in which to store the first part + * the signature. This must be initialized. + * \param s The MPI context in which to store the second part + * the signature. This must be initialized. + * \param d The private signing key. This must be initialized + * and setup, for example through mbedtls_ecp_gen_privkey(). + * \param buf The hashed content to be signed. This must be a readable + * buffer of length \p blen Bytes. It may be \c NULL if + * \p blen is zero. + * \param blen The length of \p buf in Bytes. + * \param md_alg The hash algorithm used to hash the original data. + * \param f_rng_blind The RNG function used for blinding. This must not be + * \c NULL. + * \param p_rng_blind The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context parameter. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + * error code on failure. + */ +int mbedtls_ecdsa_sign_det_ext( mbedtls_ecp_group *grp, mbedtls_mpi *r, + mbedtls_mpi *s, const mbedtls_mpi *d, + const unsigned char *buf, size_t blen, + mbedtls_md_type_t md_alg, + int (*f_rng_blind)(void *, unsigned char *, size_t), + void *p_rng_blind ); +#endif /* MBEDTLS_ECDSA_DETERMINISTIC */ + +/** + * \brief This function verifies the ECDSA signature of a + * previously-hashed message. + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.4, step 3. + * + * \see ecp.h + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param buf The hashed content that was signed. This must be a readable + * buffer of length \p blen Bytes. It may be \c NULL if + * \p blen is zero. + * \param blen The length of \p buf in Bytes. + * \param Q The public key to use for verification. This must be + * initialized and setup. + * \param r The first integer of the signature. + * This must be initialized. + * \param s The second integer of the signature. + * This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the signature + * is invalid. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + * error code on failure for any other reason. + */ +int mbedtls_ecdsa_verify( mbedtls_ecp_group *grp, + const unsigned char *buf, size_t blen, + const mbedtls_ecp_point *Q, const mbedtls_mpi *r, + const mbedtls_mpi *s); + +/** + * \brief This function computes the ECDSA signature and writes it + * to a buffer, serialized as defined in RFC-4492: + * Elliptic Curve Cryptography (ECC) Cipher Suites for + * Transport Layer Security (TLS). + * + * \warning It is not thread-safe to use the same context in + * multiple threads. + * + * \note The deterministic version is used if + * #MBEDTLS_ECDSA_DETERMINISTIC is defined. For more + * information, see RFC-6979: Deterministic Usage + * of the Digital Signature Algorithm (DSA) and Elliptic + * Curve Digital Signature Algorithm (ECDSA). + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.3, step 5. + * + * \see ecp.h + * + * \param ctx The ECDSA context to use. This must be initialized + * and have a group and private key bound to it, for example + * via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + * \param md_alg The message digest that was used to hash the message. + * \param hash The message hash to be signed. This must be a readable + * buffer of length \p blen Bytes. + * \param hlen The length of the hash \p hash in Bytes. + * \param sig The buffer to which to write the signature. This must be a + * writable buffer of length at least twice as large as the + * size of the curve used, plus 9. For example, 73 Bytes if + * a 256-bit curve is used. A buffer length of + * #MBEDTLS_ECDSA_MAX_LEN is always safe. + * \param slen The address at which to store the actual length of + * the signature written. Must not be \c NULL. + * \param f_rng The RNG function. This must not be \c NULL if + * #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise, + * it is used only for blinding and may be set to \c NULL, but + * doing so is DEPRECATED. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't use a context. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + * \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_ecdsa_write_signature( mbedtls_ecdsa_context *ctx, + mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hlen, + unsigned char *sig, size_t *slen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function computes the ECDSA signature and writes it + * to a buffer, in a restartable way. + * + * \see \c mbedtls_ecdsa_write_signature() + * + * \note This function is like \c mbedtls_ecdsa_write_signature() + * but it can return early and restart according to the limit + * set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + * + * \param ctx The ECDSA context to use. This must be initialized + * and have a group and private key bound to it, for example + * via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + * \param md_alg The message digest that was used to hash the message. + * \param hash The message hash to be signed. This must be a readable + * buffer of length \p blen Bytes. + * \param hlen The length of the hash \p hash in Bytes. + * \param sig The buffer to which to write the signature. This must be a + * writable buffer of length at least twice as large as the + * size of the curve used, plus 9. For example, 73 Bytes if + * a 256-bit curve is used. A buffer length of + * #MBEDTLS_ECDSA_MAX_LEN is always safe. + * \param slen The address at which to store the actual length of + * the signature written. Must not be \c NULL. + * \param f_rng The RNG function. This must not be \c NULL if + * #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise, + * it is unused and may be set to \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't use a context. + * \param rs_ctx The restart context to use. This may be \c NULL to disable + * restarting. If it is not \c NULL, it must point to an + * initialized restart context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + * \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_ecdsa_write_signature_restartable( mbedtls_ecdsa_context *ctx, + mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hlen, + unsigned char *sig, size_t *slen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + mbedtls_ecdsa_restart_ctx *rs_ctx ); + +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) +#if ! defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function computes an ECDSA signature and writes + * it to a buffer, serialized as defined in RFC-4492: + * Elliptic Curve Cryptography (ECC) Cipher Suites for + * Transport Layer Security (TLS). + * + * The deterministic version is defined in RFC-6979: + * Deterministic Usage of the Digital Signature Algorithm (DSA) + * and Elliptic Curve Digital Signature Algorithm (ECDSA). + * + * \warning It is not thread-safe to use the same context in + * multiple threads. + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.3, step 5. + * + * \see ecp.h + * + * \deprecated Superseded by mbedtls_ecdsa_write_signature() in + * Mbed TLS version 2.0 and later. + * + * \param ctx The ECDSA context to use. This must be initialized + * and have a group and private key bound to it, for example + * via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + * \param hash The message hash to be signed. This must be a readable + * buffer of length \p blen Bytes. + * \param hlen The length of the hash \p hash in Bytes. + * \param sig The buffer to which to write the signature. This must be a + * writable buffer of length at least twice as large as the + * size of the curve used, plus 9. For example, 73 Bytes if + * a 256-bit curve is used. A buffer length of + * #MBEDTLS_ECDSA_MAX_LEN is always safe. + * \param slen The address at which to store the actual length of + * the signature written. Must not be \c NULL. + * \param md_alg The message digest that was used to hash the message. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + * \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_ecdsa_write_signature_det( mbedtls_ecdsa_context *ctx, + const unsigned char *hash, size_t hlen, + unsigned char *sig, size_t *slen, + mbedtls_md_type_t md_alg ) MBEDTLS_DEPRECATED; +#undef MBEDTLS_DEPRECATED +#endif /* MBEDTLS_DEPRECATED_REMOVED */ +#endif /* MBEDTLS_ECDSA_DETERMINISTIC */ + +/** + * \brief This function reads and verifies an ECDSA signature. + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.4, step 3. + * + * \see ecp.h + * + * \param ctx The ECDSA context to use. This must be initialized + * and have a group and public key bound to it. + * \param hash The message hash that was signed. This must be a readable + * buffer of length \p size Bytes. + * \param hlen The size of the hash \p hash. + * \param sig The signature to read and verify. This must be a readable + * buffer of length \p slen Bytes. + * \param slen The size of \p sig in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. + * \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid + * signature in \p sig, but its length is less than \p siglen. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX + * error code on failure for any other reason. + */ +int mbedtls_ecdsa_read_signature( mbedtls_ecdsa_context *ctx, + const unsigned char *hash, size_t hlen, + const unsigned char *sig, size_t slen ); + +/** + * \brief This function reads and verifies an ECDSA signature, + * in a restartable way. + * + * \see \c mbedtls_ecdsa_read_signature() + * + * \note This function is like \c mbedtls_ecdsa_read_signature() + * but it can return early and restart according to the limit + * set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + * + * \param ctx The ECDSA context to use. This must be initialized + * and have a group and public key bound to it. + * \param hash The message hash that was signed. This must be a readable + * buffer of length \p size Bytes. + * \param hlen The size of the hash \p hash. + * \param sig The signature to read and verify. This must be a readable + * buffer of length \p slen Bytes. + * \param slen The size of \p sig in Bytes. + * \param rs_ctx The restart context to use. This may be \c NULL to disable + * restarting. If it is not \c NULL, it must point to an + * initialized restart context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. + * \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid + * signature in \p sig, but its length is less than \p siglen. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX + * error code on failure for any other reason. + */ +int mbedtls_ecdsa_read_signature_restartable( mbedtls_ecdsa_context *ctx, + const unsigned char *hash, size_t hlen, + const unsigned char *sig, size_t slen, + mbedtls_ecdsa_restart_ctx *rs_ctx ); + +/** + * \brief This function generates an ECDSA keypair on the given curve. + * + * \see ecp.h + * + * \param ctx The ECDSA context to store the keypair in. + * This must be initialized. + * \param gid The elliptic curve to use. One of the various + * \c MBEDTLS_ECP_DP_XXX macros depending on configuration. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX code on failure. + */ +int mbedtls_ecdsa_genkey( mbedtls_ecdsa_context *ctx, mbedtls_ecp_group_id gid, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ); + +/** + * \brief This function sets up an ECDSA context from an EC key pair. + * + * \see ecp.h + * + * \param ctx The ECDSA context to setup. This must be initialized. + * \param key The EC key to use. This must be initialized and hold + * a private-public key pair or a public key. In the former + * case, the ECDSA context may be used for signature creation + * and verification after this call. In the latter case, it + * may be used for signature verification. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX code on failure. + */ +int mbedtls_ecdsa_from_keypair( mbedtls_ecdsa_context *ctx, + const mbedtls_ecp_keypair *key ); + +/** + * \brief This function initializes an ECDSA context. + * + * \param ctx The ECDSA context to initialize. + * This must not be \c NULL. + */ +void mbedtls_ecdsa_init( mbedtls_ecdsa_context *ctx ); + +/** + * \brief This function frees an ECDSA context. + * + * \param ctx The ECDSA context to free. This may be \c NULL, + * in which case this function does nothing. If it + * is not \c NULL, it must be initialized. + */ +void mbedtls_ecdsa_free( mbedtls_ecdsa_context *ctx ); + +#if defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Initialize a restart context. + * + * \param ctx The restart context to initialize. + * This must not be \c NULL. + */ +void mbedtls_ecdsa_restart_init( mbedtls_ecdsa_restart_ctx *ctx ); + +/** + * \brief Free the components of a restart context. + * + * \param ctx The restart context to free. This may be \c NULL, + * in which case this function does nothing. If it + * is not \c NULL, it must be initialized. + */ +void mbedtls_ecdsa_restart_free( mbedtls_ecdsa_restart_ctx *ctx ); +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +#ifdef __cplusplus +} +#endif + +#endif /* ecdsa.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/ecjpake.h b/openharmony/arm64-v8a/include/mbedtls/ecjpake.h new file mode 100644 index 00000000..3564ff8d --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/ecjpake.h @@ -0,0 +1,275 @@ +/** + * \file ecjpake.h + * + * \brief Elliptic curve J-PAKE + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_ECJPAKE_H +#define MBEDTLS_ECJPAKE_H + +/* + * J-PAKE is a password-authenticated key exchange that allows deriving a + * strong shared secret from a (potentially low entropy) pre-shared + * passphrase, with forward secrecy and mutual authentication. + * https://en.wikipedia.org/wiki/Password_Authenticated_Key_Exchange_by_Juggling + * + * This file implements the Elliptic Curve variant of J-PAKE, + * as defined in Chapter 7.4 of the Thread v1.0 Specification, + * available to members of the Thread Group http://threadgroup.org/ + * + * As the J-PAKE algorithm is inherently symmetric, so is our API. + * Each party needs to send its first round message, in any order, to the + * other party, then each sends its second round message, in any order. + * The payloads are serialized in a way suitable for use in TLS, but could + * also be use outside TLS. + */ +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/ecp.h" +#include "mbedtls/md.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Roles in the EC J-PAKE exchange + */ +typedef enum { + MBEDTLS_ECJPAKE_CLIENT = 0, /**< Client */ + MBEDTLS_ECJPAKE_SERVER, /**< Server */ +} mbedtls_ecjpake_role; + +#if !defined(MBEDTLS_ECJPAKE_ALT) +/** + * EC J-PAKE context structure. + * + * J-PAKE is a symmetric protocol, except for the identifiers used in + * Zero-Knowledge Proofs, and the serialization of the second message + * (KeyExchange) as defined by the Thread spec. + * + * In order to benefit from this symmetry, we choose a different naming + * convention from the Thread v1.0 spec. Correspondence is indicated in the + * description as a pair C: client name, S: server name + */ +typedef struct mbedtls_ecjpake_context +{ + const mbedtls_md_info_t *md_info; /**< Hash to use */ + mbedtls_ecp_group grp; /**< Elliptic curve */ + mbedtls_ecjpake_role role; /**< Are we client or server? */ + int point_format; /**< Format for point export */ + + mbedtls_ecp_point Xm1; /**< My public key 1 C: X1, S: X3 */ + mbedtls_ecp_point Xm2; /**< My public key 2 C: X2, S: X4 */ + mbedtls_ecp_point Xp1; /**< Peer public key 1 C: X3, S: X1 */ + mbedtls_ecp_point Xp2; /**< Peer public key 2 C: X4, S: X2 */ + mbedtls_ecp_point Xp; /**< Peer public key C: Xs, S: Xc */ + + mbedtls_mpi xm1; /**< My private key 1 C: x1, S: x3 */ + mbedtls_mpi xm2; /**< My private key 2 C: x2, S: x4 */ + + mbedtls_mpi s; /**< Pre-shared secret (passphrase) */ +} mbedtls_ecjpake_context; + +#else /* MBEDTLS_ECJPAKE_ALT */ +#include "ecjpake_alt.h" +#endif /* MBEDTLS_ECJPAKE_ALT */ + +/** + * \brief Initialize an ECJPAKE context. + * + * \param ctx The ECJPAKE context to initialize. + * This must not be \c NULL. + */ +void mbedtls_ecjpake_init( mbedtls_ecjpake_context *ctx ); + +/** + * \brief Set up an ECJPAKE context for use. + * + * \note Currently the only values for hash/curve allowed by the + * standard are #MBEDTLS_MD_SHA256/#MBEDTLS_ECP_DP_SECP256R1. + * + * \param ctx The ECJPAKE context to set up. This must be initialized. + * \param role The role of the caller. This must be either + * #MBEDTLS_ECJPAKE_CLIENT or #MBEDTLS_ECJPAKE_SERVER. + * \param hash The identifier of the hash function to use, + * for example #MBEDTLS_MD_SHA256. + * \param curve The identifier of the elliptic curve to use, + * for example #MBEDTLS_ECP_DP_SECP256R1. + * \param secret The pre-shared secret (passphrase). This must be + * a readable buffer of length \p len Bytes. It need + * only be valid for the duration of this call. + * \param len The length of the pre-shared secret \p secret. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_setup( mbedtls_ecjpake_context *ctx, + mbedtls_ecjpake_role role, + mbedtls_md_type_t hash, + mbedtls_ecp_group_id curve, + const unsigned char *secret, + size_t len ); + +/** + * \brief Check if an ECJPAKE context is ready for use. + * + * \param ctx The ECJPAKE context to check. This must be + * initialized. + * + * \return \c 0 if the context is ready for use. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA otherwise. + */ +int mbedtls_ecjpake_check( const mbedtls_ecjpake_context *ctx ); + +/** + * \brief Generate and write the first round message + * (TLS: contents of the Client/ServerHello extension, + * excluding extension type and length bytes). + * + * \param ctx The ECJPAKE context to use. This must be + * initialized and set up. + * \param buf The buffer to write the contents to. This must be a + * writable buffer of length \p len Bytes. + * \param len The length of \p buf in Bytes. + * \param olen The address at which to store the total number + * of Bytes written to \p buf. This must not be \c NULL. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. This + * may be \c NULL if \p f_rng doesn't use a context. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_write_round_one( mbedtls_ecjpake_context *ctx, + unsigned char *buf, size_t len, size_t *olen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief Read and process the first round message + * (TLS: contents of the Client/ServerHello extension, + * excluding extension type and length bytes). + * + * \param ctx The ECJPAKE context to use. This must be initialized + * and set up. + * \param buf The buffer holding the first round message. This must + * be a readable buffer of length \p len Bytes. + * \param len The length in Bytes of \p buf. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_read_round_one( mbedtls_ecjpake_context *ctx, + const unsigned char *buf, + size_t len ); + +/** + * \brief Generate and write the second round message + * (TLS: contents of the Client/ServerKeyExchange). + * + * \param ctx The ECJPAKE context to use. This must be initialized, + * set up, and already have performed round one. + * \param buf The buffer to write the round two contents to. + * This must be a writable buffer of length \p len Bytes. + * \param len The size of \p buf in Bytes. + * \param olen The address at which to store the total number of Bytes + * written to \p buf. This must not be \c NULL. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. This + * may be \c NULL if \p f_rng doesn't use a context. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_write_round_two( mbedtls_ecjpake_context *ctx, + unsigned char *buf, size_t len, size_t *olen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief Read and process the second round message + * (TLS: contents of the Client/ServerKeyExchange). + * + * \param ctx The ECJPAKE context to use. This must be initialized + * and set up and already have performed round one. + * \param buf The buffer holding the second round message. This must + * be a readable buffer of length \p len Bytes. + * \param len The length in Bytes of \p buf. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_read_round_two( mbedtls_ecjpake_context *ctx, + const unsigned char *buf, + size_t len ); + +/** + * \brief Derive the shared secret + * (TLS: Pre-Master Secret). + * + * \param ctx The ECJPAKE context to use. This must be initialized, + * set up and have performed both round one and two. + * \param buf The buffer to write the derived secret to. This must + * be a writable buffer of length \p len Bytes. + * \param len The length of \p buf in Bytes. + * \param olen The address at which to store the total number of Bytes + * written to \p buf. This must not be \c NULL. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. This + * may be \c NULL if \p f_rng doesn't use a context. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_derive_secret( mbedtls_ecjpake_context *ctx, + unsigned char *buf, size_t len, size_t *olen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This clears an ECJPAKE context and frees any + * embedded data structure. + * + * \param ctx The ECJPAKE context to free. This may be \c NULL, + * in which case this function does nothing. If it is not + * \c NULL, it must point to an initialized ECJPAKE context. + */ +void mbedtls_ecjpake_free( mbedtls_ecjpake_context *ctx ); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if a test failed + */ +int mbedtls_ecjpake_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + + +#endif /* ecjpake.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/ecp.h b/openharmony/arm64-v8a/include/mbedtls/ecp.h new file mode 100644 index 00000000..64a0bccd --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/ecp.h @@ -0,0 +1,1311 @@ +/** + * \file ecp.h + * + * \brief This file provides an API for Elliptic Curves over GF(P) (ECP). + * + * The use of ECP in cryptography and TLS is defined in + * Standards for Efficient Cryptography Group (SECG): SEC1 + * Elliptic Curve Cryptography and + * RFC-4492: Elliptic Curve Cryptography (ECC) Cipher Suites + * for Transport Layer Security (TLS). + * + * RFC-2409: The Internet Key Exchange (IKE) defines ECP + * group types. + * + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_ECP_H +#define MBEDTLS_ECP_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/bignum.h" + +/* + * ECP error codes + */ +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_ECP_BAD_INPUT_DATA -0x4F80 +/** The buffer is too small to write to. */ +#define MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL -0x4F00 +/** The requested feature is not available, for example, the requested curve is not supported. */ +#define MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE -0x4E80 +/** The signature is not valid. */ +#define MBEDTLS_ERR_ECP_VERIFY_FAILED -0x4E00 +/** Memory allocation failed. */ +#define MBEDTLS_ERR_ECP_ALLOC_FAILED -0x4D80 +/** Generation of random value, such as ephemeral key, failed. */ +#define MBEDTLS_ERR_ECP_RANDOM_FAILED -0x4D00 +/** Invalid private or public key. */ +#define MBEDTLS_ERR_ECP_INVALID_KEY -0x4C80 +/** The buffer contains a valid signature followed by more data. */ +#define MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH -0x4C00 + +/* MBEDTLS_ERR_ECP_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** The ECP hardware accelerator failed. */ +#define MBEDTLS_ERR_ECP_HW_ACCEL_FAILED -0x4B80 + +/** Operation in progress, call again with the same parameters to continue. */ +#define MBEDTLS_ERR_ECP_IN_PROGRESS -0x4B00 + +/* Flags indicating whether to include code that is specific to certain + * types of curves. These flags are for internal library use only. */ +#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) +#define MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED +#endif +#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) || \ + defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) +#define MBEDTLS_ECP_MONTGOMERY_ENABLED +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Domain-parameter identifiers: curve, subgroup, and generator. + * + * \note Only curves over prime fields are supported. + * + * \warning This library does not support validation of arbitrary domain + * parameters. Therefore, only standardized domain parameters from trusted + * sources should be used. See mbedtls_ecp_group_load(). + */ +/* Note: when adding a new curve: + * - Add it at the end of this enum, otherwise you'll break the ABI by + * changing the numerical value for existing curves. + * - Increment MBEDTLS_ECP_DP_MAX below if needed. + * - Update the calculation of MBEDTLS_ECP_MAX_BITS_MIN below. + * - Add the corresponding MBEDTLS_ECP_DP_xxx_ENABLED macro definition to + * config.h. + * - List the curve as a dependency of MBEDTLS_ECP_C and + * MBEDTLS_ECDSA_C if supported in check_config.h. + * - Add the curve to the appropriate curve type macro + * MBEDTLS_ECP_yyy_ENABLED above. + * - Add the necessary definitions to ecp_curves.c. + * - Add the curve to the ecp_supported_curves array in ecp.c. + * - Add the curve to applicable profiles in x509_crt.c if applicable. + */ +typedef enum +{ + MBEDTLS_ECP_DP_NONE = 0, /*!< Curve not defined. */ + MBEDTLS_ECP_DP_SECP192R1, /*!< Domain parameters for the 192-bit curve defined by FIPS 186-4 and SEC1. */ + MBEDTLS_ECP_DP_SECP224R1, /*!< Domain parameters for the 224-bit curve defined by FIPS 186-4 and SEC1. */ + MBEDTLS_ECP_DP_SECP256R1, /*!< Domain parameters for the 256-bit curve defined by FIPS 186-4 and SEC1. */ + MBEDTLS_ECP_DP_SECP384R1, /*!< Domain parameters for the 384-bit curve defined by FIPS 186-4 and SEC1. */ + MBEDTLS_ECP_DP_SECP521R1, /*!< Domain parameters for the 521-bit curve defined by FIPS 186-4 and SEC1. */ + MBEDTLS_ECP_DP_BP256R1, /*!< Domain parameters for 256-bit Brainpool curve. */ + MBEDTLS_ECP_DP_BP384R1, /*!< Domain parameters for 384-bit Brainpool curve. */ + MBEDTLS_ECP_DP_BP512R1, /*!< Domain parameters for 512-bit Brainpool curve. */ + MBEDTLS_ECP_DP_CURVE25519, /*!< Domain parameters for Curve25519. */ + MBEDTLS_ECP_DP_SECP192K1, /*!< Domain parameters for 192-bit "Koblitz" curve. */ + MBEDTLS_ECP_DP_SECP224K1, /*!< Domain parameters for 224-bit "Koblitz" curve. */ + MBEDTLS_ECP_DP_SECP256K1, /*!< Domain parameters for 256-bit "Koblitz" curve. */ + MBEDTLS_ECP_DP_CURVE448, /*!< Domain parameters for Curve448. */ +} mbedtls_ecp_group_id; + +/** + * The number of supported curves, plus one for #MBEDTLS_ECP_DP_NONE. + * + * \note Montgomery curves are currently excluded. + */ +#define MBEDTLS_ECP_DP_MAX 12 + +/* + * Curve types + */ +typedef enum +{ + MBEDTLS_ECP_TYPE_NONE = 0, + MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS, /* y^2 = x^3 + a x + b */ + MBEDTLS_ECP_TYPE_MONTGOMERY, /* y^2 = x^3 + a x^2 + x */ +} mbedtls_ecp_curve_type; + +/** + * Curve information, for use by other modules. + */ +typedef struct mbedtls_ecp_curve_info +{ + mbedtls_ecp_group_id grp_id; /*!< An internal identifier. */ + uint16_t tls_id; /*!< The TLS NamedCurve identifier. */ + uint16_t bit_size; /*!< The curve size in bits. */ + const char *name; /*!< A human-friendly name. */ +} mbedtls_ecp_curve_info; + +/** + * \brief The ECP point structure, in Jacobian coordinates. + * + * \note All functions expect and return points satisfying + * the following condition: Z == 0 or + * Z == 1. Other values of \p Z are + * used only by internal functions. + * The point is zero, or "at infinity", if Z == 0. + * Otherwise, \p X and \p Y are its standard (affine) + * coordinates. + */ +typedef struct mbedtls_ecp_point +{ + mbedtls_mpi X; /*!< The X coordinate of the ECP point. */ + mbedtls_mpi Y; /*!< The Y coordinate of the ECP point. */ + mbedtls_mpi Z; /*!< The Z coordinate of the ECP point. */ +} +mbedtls_ecp_point; + +/* Determine the minimum safe value of MBEDTLS_ECP_MAX_BITS. */ +#if !defined(MBEDTLS_ECP_C) +#define MBEDTLS_ECP_MAX_BITS_MIN 0 +/* Note: the curves must be listed in DECREASING size! */ +#elif defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 521 +#elif defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 512 +#elif defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 448 +#elif defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 384 +#elif defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 384 +#elif defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 256 +#elif defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 256 +#elif defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 256 +#elif defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 255 +#elif defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 225 // n is slightly above 2^224 +#elif defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 224 +#elif defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 192 +#elif defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 192 +#else +#error "MBEDTLS_ECP_C enabled, but no curve?" +#endif + +#if !defined(MBEDTLS_ECP_ALT) +/* + * default mbed TLS elliptic curve arithmetic implementation + * + * (in case MBEDTLS_ECP_ALT is defined then the developer has to provide an + * alternative implementation for the whole module and it will replace this + * one.) + */ + +/** + * \brief The ECP group structure. + * + * We consider two types of curve equations: + *
  • Short Weierstrass: y^2 = x^3 + A x + B mod P + * (SEC1 + RFC-4492)
    • + *
  • Montgomery: y^2 = x^3 + A x^2 + x mod P (Curve25519, + * Curve448)
+ * In both cases, the generator (\p G) for a prime-order subgroup is fixed. + * + * For Short Weierstrass, this subgroup is the whole curve, and its + * cardinality is denoted by \p N. Our code requires that \p N is an + * odd prime as mbedtls_ecp_mul() requires an odd number, and + * mbedtls_ecdsa_sign() requires that it is prime for blinding purposes. + * + * For Montgomery curves, we do not store \p A, but (A + 2) / 4, + * which is the quantity used in the formulas. Additionally, \p nbits is + * not the size of \p N but the required size for private keys. + * + * If \p modp is NULL, reduction modulo \p P is done using a generic algorithm. + * Otherwise, \p modp must point to a function that takes an \p mbedtls_mpi in the + * range of 0..2^(2*pbits)-1, and transforms it in-place to an integer + * which is congruent mod \p P to the given MPI, and is close enough to \p pbits + * in size, so that it may be efficiently brought in the 0..P-1 range by a few + * additions or subtractions. Therefore, it is only an approximative modular + * reduction. It must return 0 on success and non-zero on failure. + * + * \note Alternative implementations must keep the group IDs distinct. If + * two group structures have the same ID, then they must be + * identical. + * + */ +typedef struct mbedtls_ecp_group +{ + mbedtls_ecp_group_id id; /*!< An internal group identifier. */ + mbedtls_mpi P; /*!< The prime modulus of the base field. */ + mbedtls_mpi A; /*!< For Short Weierstrass: \p A in the equation. For + Montgomery curves: (A + 2) / 4. */ + mbedtls_mpi B; /*!< For Short Weierstrass: \p B in the equation. + For Montgomery curves: unused. */ + mbedtls_ecp_point G; /*!< The generator of the subgroup used. */ + mbedtls_mpi N; /*!< The order of \p G. */ + size_t pbits; /*!< The number of bits in \p P.*/ + size_t nbits; /*!< For Short Weierstrass: The number of bits in \p P. + For Montgomery curves: the number of bits in the + private keys. */ + unsigned int h; /*!< \internal 1 if the constants are static. */ + int (*modp)(mbedtls_mpi *); /*!< The function for fast pseudo-reduction + mod \p P (see above).*/ + int (*t_pre)(mbedtls_ecp_point *, void *); /*!< Unused. */ + int (*t_post)(mbedtls_ecp_point *, void *); /*!< Unused. */ + void *t_data; /*!< Unused. */ + mbedtls_ecp_point *T; /*!< Pre-computed points for ecp_mul_comb(). */ + size_t T_size; /*!< The number of pre-computed points. */ +} +mbedtls_ecp_group; + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h, or define them using the compiler command line. + * \{ + */ + +#if defined(MBEDTLS_ECP_MAX_BITS) + +#if MBEDTLS_ECP_MAX_BITS < MBEDTLS_ECP_MAX_BITS_MIN +#error "MBEDTLS_ECP_MAX_BITS is smaller than the largest supported curve" +#endif + +#elif defined(MBEDTLS_ECP_C) +/** + * The maximum size of the groups, that is, of \c N and \c P. + */ +#define MBEDTLS_ECP_MAX_BITS MBEDTLS_ECP_MAX_BITS_MIN + +#else +/* MBEDTLS_ECP_MAX_BITS is not relevant without MBEDTLS_ECP_C, but set it + * to a nonzero value so that code that unconditionally allocates an array + * of a size based on it keeps working if built without ECC support. */ +#define MBEDTLS_ECP_MAX_BITS 1 +#endif + +#define MBEDTLS_ECP_MAX_BYTES ( ( MBEDTLS_ECP_MAX_BITS + 7 ) / 8 ) +#define MBEDTLS_ECP_MAX_PT_LEN ( 2 * MBEDTLS_ECP_MAX_BYTES + 1 ) + +#if !defined(MBEDTLS_ECP_WINDOW_SIZE) +/* + * Maximum "window" size used for point multiplication. + * Default: a point where higher memory usage yields diminishing performance + * returns. + * Minimum value: 2. Maximum value: 7. + * + * Result is an array of at most ( 1 << ( MBEDTLS_ECP_WINDOW_SIZE - 1 ) ) + * points used for point multiplication. This value is directly tied to EC + * peak memory usage, so decreasing it by one should roughly cut memory usage + * by two (if large curves are in use). + * + * Reduction in size may reduce speed, but larger curves are impacted first. + * Sample performances (in ECDHE handshakes/s, with FIXED_POINT_OPTIM = 1): + * w-size: 6 5 4 3 2 + * 521 145 141 135 120 97 + * 384 214 209 198 177 146 + * 256 320 320 303 262 226 + * 224 475 475 453 398 342 + * 192 640 640 633 587 476 + */ +#define MBEDTLS_ECP_WINDOW_SIZE 4 /**< The maximum window size used. */ +#endif /* MBEDTLS_ECP_WINDOW_SIZE */ + +#if !defined(MBEDTLS_ECP_FIXED_POINT_OPTIM) +/* + * Trade memory for speed on fixed-point multiplication. + * + * This speeds up repeated multiplication of the generator (that is, the + * multiplication in ECDSA signatures, and half of the multiplications in + * ECDSA verification and ECDHE) by a factor roughly 3 to 4. + * + * The cost is increasing EC peak memory usage by a factor roughly 2. + * + * Change this value to 0 to reduce peak memory usage. + */ +#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up. */ +#endif /* MBEDTLS_ECP_FIXED_POINT_OPTIM */ + +/** \} name SECTION: Module settings */ + +#else /* MBEDTLS_ECP_ALT */ +#include "ecp_alt.h" +#endif /* MBEDTLS_ECP_ALT */ + +#if defined(MBEDTLS_ECP_RESTARTABLE) + +/** + * \brief Internal restart context for multiplication + * + * \note Opaque struct + */ +typedef struct mbedtls_ecp_restart_mul mbedtls_ecp_restart_mul_ctx; + +/** + * \brief Internal restart context for ecp_muladd() + * + * \note Opaque struct + */ +typedef struct mbedtls_ecp_restart_muladd mbedtls_ecp_restart_muladd_ctx; + +/** + * \brief General context for resuming ECC operations + */ +typedef struct +{ + unsigned ops_done; /*!< current ops count */ + unsigned depth; /*!< call depth (0 = top-level) */ + mbedtls_ecp_restart_mul_ctx *rsm; /*!< ecp_mul_comb() sub-context */ + mbedtls_ecp_restart_muladd_ctx *ma; /*!< ecp_muladd() sub-context */ +} mbedtls_ecp_restart_ctx; + +/* + * Operation counts for restartable functions + */ +#define MBEDTLS_ECP_OPS_CHK 3 /*!< basic ops count for ecp_check_pubkey() */ +#define MBEDTLS_ECP_OPS_DBL 8 /*!< basic ops count for ecp_double_jac() */ +#define MBEDTLS_ECP_OPS_ADD 11 /*!< basic ops count for see ecp_add_mixed() */ +#define MBEDTLS_ECP_OPS_INV 120 /*!< empirical equivalent for mpi_mod_inv() */ + +/** + * \brief Internal; for restartable functions in other modules. + * Check and update basic ops budget. + * + * \param grp Group structure + * \param rs_ctx Restart context + * \param ops Number of basic ops to do + * + * \return \c 0 if doing \p ops basic ops is still allowed, + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS otherwise. + */ +int mbedtls_ecp_check_budget( const mbedtls_ecp_group *grp, + mbedtls_ecp_restart_ctx *rs_ctx, + unsigned ops ); + +/* Utility macro for checking and updating ops budget */ +#define MBEDTLS_ECP_BUDGET( ops ) \ + MBEDTLS_MPI_CHK( mbedtls_ecp_check_budget( grp, rs_ctx, \ + (unsigned) (ops) ) ); + +#else /* MBEDTLS_ECP_RESTARTABLE */ + +#define MBEDTLS_ECP_BUDGET( ops ) /* no-op; for compatibility */ + +/* We want to declare restartable versions of existing functions anyway */ +typedef void mbedtls_ecp_restart_ctx; + +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +/** + * \brief The ECP key-pair structure. + * + * A generic key-pair that may be used for ECDSA and fixed ECDH, for example. + * + * \note Members are deliberately in the same order as in the + * ::mbedtls_ecdsa_context structure. + */ +typedef struct mbedtls_ecp_keypair +{ + mbedtls_ecp_group grp; /*!< Elliptic curve and base point */ + mbedtls_mpi d; /*!< our secret value */ + mbedtls_ecp_point Q; /*!< our public value */ +} +mbedtls_ecp_keypair; + +/* + * Point formats, from RFC 4492's enum ECPointFormat + */ +#define MBEDTLS_ECP_PF_UNCOMPRESSED 0 /**< Uncompressed point format. */ +#define MBEDTLS_ECP_PF_COMPRESSED 1 /**< Compressed point format. */ + +/* + * Some other constants from RFC 4492 + */ +#define MBEDTLS_ECP_TLS_NAMED_CURVE 3 /**< The named_curve of ECCurveType. */ + +#if defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Set the maximum number of basic operations done in a row. + * + * If more operations are needed to complete a computation, + * #MBEDTLS_ERR_ECP_IN_PROGRESS will be returned by the + * function performing the computation. It is then the + * caller's responsibility to either call again with the same + * parameters until it returns 0 or an error code; or to free + * the restart context if the operation is to be aborted. + * + * It is strictly required that all input parameters and the + * restart context be the same on successive calls for the + * same operation, but output parameters need not be the + * same; they must not be used until the function finally + * returns 0. + * + * This only applies to functions whose documentation + * mentions they may return #MBEDTLS_ERR_ECP_IN_PROGRESS (or + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS for functions in the + * SSL module). For functions that accept a "restart context" + * argument, passing NULL disables restart and makes the + * function equivalent to the function with the same name + * with \c _restartable removed. For functions in the ECDH + * module, restart is disabled unless the function accepts + * an "ECDH context" argument and + * mbedtls_ecdh_enable_restart() was previously called on + * that context. For function in the SSL module, restart is + * only enabled for specific sides and key exchanges + * (currently only for clients and ECDHE-ECDSA). + * + * \param max_ops Maximum number of basic operations done in a row. + * Default: 0 (unlimited). + * Lower (non-zero) values mean ECC functions will block for + * a lesser maximum amount of time. + * + * \note A "basic operation" is defined as a rough equivalent of a + * multiplication in GF(p) for the NIST P-256 curve. + * As an indication, with default settings, a scalar + * multiplication (full run of \c mbedtls_ecp_mul()) is: + * - about 3300 basic operations for P-256 + * - about 9400 basic operations for P-384 + * + * \note Very low values are not always respected: sometimes + * functions need to block for a minimum number of + * operations, and will do so even if max_ops is set to a + * lower value. That minimum depends on the curve size, and + * can be made lower by decreasing the value of + * \c MBEDTLS_ECP_WINDOW_SIZE. As an indication, here is the + * lowest effective value for various curves and values of + * that parameter (w for short): + * w=6 w=5 w=4 w=3 w=2 + * P-256 208 208 160 136 124 + * P-384 682 416 320 272 248 + * P-521 1364 832 640 544 496 + * + * \note This setting is currently ignored by Curve25519. + */ +void mbedtls_ecp_set_max_ops( unsigned max_ops ); + +/** + * \brief Check if restart is enabled (max_ops != 0) + * + * \return \c 0 if \c max_ops == 0 (restart disabled) + * \return \c 1 otherwise (restart enabled) + */ +int mbedtls_ecp_restart_is_enabled( void ); +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +/* + * Get the type of a curve + */ +mbedtls_ecp_curve_type mbedtls_ecp_get_type( const mbedtls_ecp_group *grp ); + +/** + * \brief This function retrieves the information defined in + * mbedtls_ecp_curve_info() for all supported curves. + * + * \note This function returns information about all curves + * supported by the library. Some curves may not be + * supported for all algorithms. Call mbedtls_ecdh_can_do() + * or mbedtls_ecdsa_can_do() to check if a curve is + * supported for ECDH or ECDSA. + * + * \return A statically allocated array. The last entry is 0. + */ +const mbedtls_ecp_curve_info *mbedtls_ecp_curve_list( void ); + +/** + * \brief This function retrieves the list of internal group + * identifiers of all supported curves in the order of + * preference. + * + * \note This function returns information about all curves + * supported by the library. Some curves may not be + * supported for all algorithms. Call mbedtls_ecdh_can_do() + * or mbedtls_ecdsa_can_do() to check if a curve is + * supported for ECDH or ECDSA. + * + * \return A statically allocated array, + * terminated with MBEDTLS_ECP_DP_NONE. + */ +const mbedtls_ecp_group_id *mbedtls_ecp_grp_id_list( void ); + +/** + * \brief This function retrieves curve information from an internal + * group identifier. + * + * \param grp_id An \c MBEDTLS_ECP_DP_XXX value. + * + * \return The associated curve information on success. + * \return NULL on failure. + */ +const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_grp_id( mbedtls_ecp_group_id grp_id ); + +/** + * \brief This function retrieves curve information from a TLS + * NamedCurve value. + * + * \param tls_id An \c MBEDTLS_ECP_DP_XXX value. + * + * \return The associated curve information on success. + * \return NULL on failure. + */ +const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_tls_id( uint16_t tls_id ); + +/** + * \brief This function retrieves curve information from a + * human-readable name. + * + * \param name The human-readable name. + * + * \return The associated curve information on success. + * \return NULL on failure. + */ +const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_name( const char *name ); + +/** + * \brief This function initializes a point as zero. + * + * \param pt The point to initialize. + */ +void mbedtls_ecp_point_init( mbedtls_ecp_point *pt ); + +/** + * \brief This function initializes an ECP group context + * without loading any domain parameters. + * + * \note After this function is called, domain parameters + * for various ECP groups can be loaded through the + * mbedtls_ecp_group_load() or mbedtls_ecp_tls_read_group() + * functions. + */ +void mbedtls_ecp_group_init( mbedtls_ecp_group *grp ); + +/** + * \brief This function initializes a key pair as an invalid one. + * + * \param key The key pair to initialize. + */ +void mbedtls_ecp_keypair_init( mbedtls_ecp_keypair *key ); + +/** + * \brief This function frees the components of a point. + * + * \param pt The point to free. + */ +void mbedtls_ecp_point_free( mbedtls_ecp_point *pt ); + +/** + * \brief This function frees the components of an ECP group. + * + * \param grp The group to free. This may be \c NULL, in which + * case this function returns immediately. If it is not + * \c NULL, it must point to an initialized ECP group. + */ +void mbedtls_ecp_group_free( mbedtls_ecp_group *grp ); + +/** + * \brief This function frees the components of a key pair. + * + * \param key The key pair to free. This may be \c NULL, in which + * case this function returns immediately. If it is not + * \c NULL, it must point to an initialized ECP key pair. + */ +void mbedtls_ecp_keypair_free( mbedtls_ecp_keypair *key ); + +#if defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Initialize a restart context. + * + * \param ctx The restart context to initialize. This must + * not be \c NULL. + */ +void mbedtls_ecp_restart_init( mbedtls_ecp_restart_ctx *ctx ); + +/** + * \brief Free the components of a restart context. + * + * \param ctx The restart context to free. This may be \c NULL, in which + * case this function returns immediately. If it is not + * \c NULL, it must point to an initialized restart context. + */ +void mbedtls_ecp_restart_free( mbedtls_ecp_restart_ctx *ctx ); +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +/** + * \brief This function copies the contents of point \p Q into + * point \p P. + * + * \param P The destination point. This must be initialized. + * \param Q The source point. This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return Another negative error code for other kinds of failure. + */ +int mbedtls_ecp_copy( mbedtls_ecp_point *P, const mbedtls_ecp_point *Q ); + +/** + * \brief This function copies the contents of group \p src into + * group \p dst. + * + * \param dst The destination group. This must be initialized. + * \param src The source group. This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_group_copy( mbedtls_ecp_group *dst, + const mbedtls_ecp_group *src ); + +/** + * \brief This function sets a point to the point at infinity. + * + * \param pt The point to set. This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_set_zero( mbedtls_ecp_point *pt ); + +/** + * \brief This function checks if a point is the point at infinity. + * + * \param pt The point to test. This must be initialized. + * + * \return \c 1 if the point is zero. + * \return \c 0 if the point is non-zero. + * \return A negative error code on failure. + */ +int mbedtls_ecp_is_zero( mbedtls_ecp_point *pt ); + +/** + * \brief This function compares two points. + * + * \note This assumes that the points are normalized. Otherwise, + * they may compare as "not equal" even if they are. + * + * \param P The first point to compare. This must be initialized. + * \param Q The second point to compare. This must be initialized. + * + * \return \c 0 if the points are equal. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the points are not equal. + */ +int mbedtls_ecp_point_cmp( const mbedtls_ecp_point *P, + const mbedtls_ecp_point *Q ); + +/** + * \brief This function imports a non-zero point from two ASCII + * strings. + * + * \param P The destination point. This must be initialized. + * \param radix The numeric base of the input. + * \param x The first affine coordinate, as a null-terminated string. + * \param y The second affine coordinate, as a null-terminated string. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_MPI_XXX error code on failure. + */ +int mbedtls_ecp_point_read_string( mbedtls_ecp_point *P, int radix, + const char *x, const char *y ); + +/** + * \brief This function exports a point into unsigned binary data. + * + * \param grp The group to which the point should belong. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param P The point to export. This must be initialized. + * \param format The point format. This must be either + * #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + * (For groups without these formats, this parameter is + * ignored. But it still has to be either of the above + * values.) + * \param olen The address at which to store the length of + * the output in Bytes. This must not be \c NULL. + * \param buf The output buffer. This must be a writable buffer + * of length \p buflen Bytes. + * \param buflen The length of the output buffer \p buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer + * is too small to hold the point. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format + * or the export for the given group is not implemented. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_point_write_binary( const mbedtls_ecp_group *grp, + const mbedtls_ecp_point *P, + int format, size_t *olen, + unsigned char *buf, size_t buflen ); + +/** + * \brief This function imports a point from unsigned binary data. + * + * \note This function does not check that the point actually + * belongs to the given group, see mbedtls_ecp_check_pubkey() + * for that. + * + * \param grp The group to which the point should belong. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param P The destination context to import the point to. + * This must be initialized. + * \param buf The input buffer. This must be a readable buffer + * of length \p ilen Bytes. + * \param ilen The length of the input buffer \p buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the import for the + * given group is not implemented. + */ +int mbedtls_ecp_point_read_binary( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *P, + const unsigned char *buf, size_t ilen ); + +/** + * \brief This function imports a point from a TLS ECPoint record. + * + * \note On function return, \p *buf is updated to point immediately + * after the ECPoint record. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param pt The destination point. + * \param buf The address of the pointer to the start of the input buffer. + * \param len The length of the buffer. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_MPI_XXX error code on initialization + * failure. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + */ +int mbedtls_ecp_tls_read_point( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *pt, + const unsigned char **buf, size_t len ); + +/** + * \brief This function exports a point as a TLS ECPoint record + * defined in RFC 4492, Section 5.4. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param pt The point to be exported. This must be initialized. + * \param format The point format to use. This must be either + * #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + * \param olen The address at which to store the length in Bytes + * of the data written. + * \param buf The target buffer. This must be a writable buffer of + * length \p blen Bytes. + * \param blen The length of the target buffer \p buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. + * \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the target buffer + * is too small to hold the exported point. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_tls_write_point( const mbedtls_ecp_group *grp, + const mbedtls_ecp_point *pt, + int format, size_t *olen, + unsigned char *buf, size_t blen ); + +/** + * \brief This function sets up an ECP group context + * from a standardized set of domain parameters. + * + * \note The index should be a value of the NamedCurve enum, + * as defined in RFC-4492: Elliptic Curve Cryptography + * (ECC) Cipher Suites for Transport Layer Security (TLS), + * usually in the form of an \c MBEDTLS_ECP_DP_XXX macro. + * + * \param grp The group context to setup. This must be initialized. + * \param id The identifier of the domain parameter set to load. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p id doesn't + * correspond to a known group. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_group_load( mbedtls_ecp_group *grp, mbedtls_ecp_group_id id ); + +/** + * \brief This function sets up an ECP group context from a TLS + * ECParameters record as defined in RFC 4492, Section 5.4. + * + * \note The read pointer \p buf is updated to point right after + * the ECParameters record on exit. + * + * \param grp The group context to setup. This must be initialized. + * \param buf The address of the pointer to the start of the input buffer. + * \param len The length of the input buffer \c *buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not + * recognized. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_tls_read_group( mbedtls_ecp_group *grp, + const unsigned char **buf, size_t len ); + +/** + * \brief This function extracts an elliptic curve group ID from a + * TLS ECParameters record as defined in RFC 4492, Section 5.4. + * + * \note The read pointer \p buf is updated to point right after + * the ECParameters record on exit. + * + * \param grp The address at which to store the group id. + * This must not be \c NULL. + * \param buf The address of the pointer to the start of the input buffer. + * \param len The length of the input buffer \c *buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not + * recognized. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_tls_read_group_id( mbedtls_ecp_group_id *grp, + const unsigned char **buf, + size_t len ); +/** + * \brief This function exports an elliptic curve as a TLS + * ECParameters record as defined in RFC 4492, Section 5.4. + * + * \param grp The ECP group to be exported. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param olen The address at which to store the number of Bytes written. + * This must not be \c NULL. + * \param buf The buffer to write to. This must be a writable buffer + * of length \p blen Bytes. + * \param blen The length of the output buffer \p buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output + * buffer is too small to hold the exported group. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_tls_write_group( const mbedtls_ecp_group *grp, + size_t *olen, + unsigned char *buf, size_t blen ); + +/** + * \brief This function performs a scalar multiplication of a point + * by an integer: \p R = \p m * \p P. + * + * It is not thread-safe to use same group in multiple threads. + * + * \note To prevent timing attacks, this function + * executes the exact same sequence of base-field + * operations for any valid \p m. It avoids any if-branch or + * array index depending on the value of \p m. + * + * \note If \p f_rng is not NULL, it is used to randomize + * intermediate results to prevent potential timing attacks + * targeting these results. We recommend always providing + * a non-NULL \p f_rng. The overhead is negligible. + * Note: unless #MBEDTLS_ECP_NO_INTERNAL_RNG is defined, when + * \p f_rng is NULL, an internal RNG (seeded from the value + * of \p m) will be used instead. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param R The point in which to store the result of the calculation. + * This must be initialized. + * \param m The integer by which to multiply. This must be initialized. + * \param P The point to multiply. This must be initialized. + * \param f_rng The RNG function. This may be \c NULL if randomization + * of intermediate results isn't desired (discouraged). + * \param p_rng The RNG context to be passed to \p p_rng. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private + * key, or \p P is not a valid public key. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_mul( mbedtls_ecp_group *grp, mbedtls_ecp_point *R, + const mbedtls_mpi *m, const mbedtls_ecp_point *P, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ); + +/** + * \brief This function performs multiplication of a point by + * an integer: \p R = \p m * \p P in a restartable way. + * + * \see mbedtls_ecp_mul() + * + * \note This function does the same as \c mbedtls_ecp_mul(), but + * it can return early and restart according to the limit set + * with \c mbedtls_ecp_set_max_ops() to reduce blocking. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param R The point in which to store the result of the calculation. + * This must be initialized. + * \param m The integer by which to multiply. This must be initialized. + * \param P The point to multiply. This must be initialized. + * \param f_rng The RNG function. This may be \c NULL if randomization + * of intermediate results isn't desired (discouraged). + * \param p_rng The RNG context to be passed to \p p_rng. + * \param rs_ctx The restart context (NULL disables restart). + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private + * key, or \p P is not a valid public key. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_mul_restartable( mbedtls_ecp_group *grp, mbedtls_ecp_point *R, + const mbedtls_mpi *m, const mbedtls_ecp_point *P, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, + mbedtls_ecp_restart_ctx *rs_ctx ); + +#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) +/** + * \brief This function performs multiplication and addition of two + * points by integers: \p R = \p m * \p P + \p n * \p Q + * + * It is not thread-safe to use same group in multiple threads. + * + * \note In contrast to mbedtls_ecp_mul(), this function does not + * guarantee a constant execution flow and timing. + * + * \note This function is only defined for short Weierstrass curves. + * It may not be included in builds without any short + * Weierstrass curve. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param R The point in which to store the result of the calculation. + * This must be initialized. + * \param m The integer by which to multiply \p P. + * This must be initialized. + * \param P The point to multiply by \p m. This must be initialized. + * \param n The integer by which to multiply \p Q. + * This must be initialized. + * \param Q The point to be multiplied by \p n. + * This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not + * valid private keys, or \p P or \p Q are not valid public + * keys. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not + * designate a short Weierstrass curve. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_muladd( mbedtls_ecp_group *grp, mbedtls_ecp_point *R, + const mbedtls_mpi *m, const mbedtls_ecp_point *P, + const mbedtls_mpi *n, const mbedtls_ecp_point *Q ); + +/** + * \brief This function performs multiplication and addition of two + * points by integers: \p R = \p m * \p P + \p n * \p Q in a + * restartable way. + * + * \see \c mbedtls_ecp_muladd() + * + * \note This function works the same as \c mbedtls_ecp_muladd(), + * but it can return early and restart according to the limit + * set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + * + * \note This function is only defined for short Weierstrass curves. + * It may not be included in builds without any short + * Weierstrass curve. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param R The point in which to store the result of the calculation. + * This must be initialized. + * \param m The integer by which to multiply \p P. + * This must be initialized. + * \param P The point to multiply by \p m. This must be initialized. + * \param n The integer by which to multiply \p Q. + * This must be initialized. + * \param Q The point to be multiplied by \p n. + * This must be initialized. + * \param rs_ctx The restart context (NULL disables restart). + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not + * valid private keys, or \p P or \p Q are not valid public + * keys. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not + * designate a short Weierstrass curve. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_muladd_restartable( + mbedtls_ecp_group *grp, mbedtls_ecp_point *R, + const mbedtls_mpi *m, const mbedtls_ecp_point *P, + const mbedtls_mpi *n, const mbedtls_ecp_point *Q, + mbedtls_ecp_restart_ctx *rs_ctx ); +#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ + +/** + * \brief This function checks that a point is a valid public key + * on this curve. + * + * It only checks that the point is non-zero, has + * valid coordinates and lies on the curve. It does not verify + * that it is indeed a multiple of \p G. This additional + * check is computationally more expensive, is not required + * by standards, and should not be necessary if the group + * used has a small cofactor. In particular, it is useless for + * the NIST groups which all have a cofactor of 1. + * + * \note This function uses bare components rather than an + * ::mbedtls_ecp_keypair structure, to ease use with other + * structures, such as ::mbedtls_ecdh_context or + * ::mbedtls_ecdsa_context. + * + * \param grp The ECP group the point should belong to. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param pt The point to check. This must be initialized. + * + * \return \c 0 if the point is a valid public key. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not + * a valid public key for the given curve. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_check_pubkey( const mbedtls_ecp_group *grp, + const mbedtls_ecp_point *pt ); + +/** + * \brief This function checks that an \p mbedtls_mpi is a + * valid private key for this curve. + * + * \note This function uses bare components rather than an + * ::mbedtls_ecp_keypair structure to ease use with other + * structures, such as ::mbedtls_ecdh_context or + * ::mbedtls_ecdsa_context. + * + * \param grp The ECP group the private key should belong to. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param d The integer to check. This must be initialized. + * + * \return \c 0 if the point is a valid private key. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not a valid + * private key for the given curve. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_check_privkey( const mbedtls_ecp_group *grp, + const mbedtls_mpi *d ); + +/** + * \brief This function generates a private key. + * + * \param grp The ECP group to generate a private key for. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param d The destination MPI (secret part). This must be initialized. + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + * on failure. + */ +int mbedtls_ecp_gen_privkey( const mbedtls_ecp_group *grp, + mbedtls_mpi *d, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function generates a keypair with a configurable base + * point. + * + * \note This function uses bare components rather than an + * ::mbedtls_ecp_keypair structure to ease use with other + * structures, such as ::mbedtls_ecdh_context or + * ::mbedtls_ecdsa_context. + * + * \param grp The ECP group to generate a key pair for. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param G The base point to use. This must be initialized + * and belong to \p grp. It replaces the default base + * point \c grp->G used by mbedtls_ecp_gen_keypair(). + * \param d The destination MPI (secret part). + * This must be initialized. + * \param Q The destination point (public part). + * This must be initialized. + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may + * be \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + * on failure. + */ +int mbedtls_ecp_gen_keypair_base( mbedtls_ecp_group *grp, + const mbedtls_ecp_point *G, + mbedtls_mpi *d, mbedtls_ecp_point *Q, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function generates an ECP keypair. + * + * \note This function uses bare components rather than an + * ::mbedtls_ecp_keypair structure to ease use with other + * structures, such as ::mbedtls_ecdh_context or + * ::mbedtls_ecdsa_context. + * + * \param grp The ECP group to generate a key pair for. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param d The destination MPI (secret part). + * This must be initialized. + * \param Q The destination point (public part). + * This must be initialized. + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may + * be \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + * on failure. + */ +int mbedtls_ecp_gen_keypair( mbedtls_ecp_group *grp, mbedtls_mpi *d, + mbedtls_ecp_point *Q, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function generates an ECP key. + * + * \param grp_id The ECP group identifier. + * \param key The destination key. This must be initialized. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may + * be \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + * on failure. + */ +int mbedtls_ecp_gen_key( mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function reads an elliptic curve private key. + * + * \param grp_id The ECP group identifier. + * \param key The destination key. + * \param buf The buffer containing the binary representation of the + * key. (Big endian integer for Weierstrass curves, byte + * string for Montgomery curves.) + * \param buflen The length of the buffer in bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY error if the key is + * invalid. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for + * the group is not implemented. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_ecp_read_key( mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key, + const unsigned char *buf, size_t buflen ); + +/** + * \brief This function exports an elliptic curve private key. + * + * \param key The private key. + * \param buf The output buffer for containing the binary representation + * of the key. (Big endian integer for Weierstrass curves, byte + * string for Montgomery curves.) + * \param buflen The total length of the buffer in bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the \p key + representation is larger than the available space in \p buf. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for + * the group is not implemented. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_ecp_write_key( mbedtls_ecp_keypair *key, + unsigned char *buf, size_t buflen ); + +/** + * \brief This function checks that the keypair objects + * \p pub and \p prv have the same group and the + * same public point, and that the private key in + * \p prv is consistent with the public key. + * + * \param pub The keypair structure holding the public key. This + * must be initialized. If it contains a private key, that + * part is ignored. + * \param prv The keypair structure holding the full keypair. + * This must be initialized. + * + * \return \c 0 on success, meaning that the keys are valid and match. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the keys are invalid or do not match. + * \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX + * error code on calculation failure. + */ +int mbedtls_ecp_check_pub_priv( const mbedtls_ecp_keypair *pub, + const mbedtls_ecp_keypair *prv ); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The ECP checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_ecp_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* ecp.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/ecp_internal.h b/openharmony/arm64-v8a/include/mbedtls/ecp_internal.h new file mode 100644 index 00000000..6a47a8ff --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/ecp_internal.h @@ -0,0 +1,297 @@ +/** + * \file ecp_internal.h + * + * \brief Function declarations for alternative implementation of elliptic curve + * point arithmetic. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/* + * References: + * + * [1] BERNSTEIN, Daniel J. Curve25519: new Diffie-Hellman speed records. + * + * + * [2] CORON, Jean-S'ebastien. Resistance against differential power analysis + * for elliptic curve cryptosystems. In : Cryptographic Hardware and + * Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302. + * + * + * [3] HEDABOU, Mustapha, PINEL, Pierre, et B'EN'ETEAU, Lucien. A comb method to + * render ECC resistant against Side Channel Attacks. IACR Cryptology + * ePrint Archive, 2004, vol. 2004, p. 342. + * + * + * [4] Certicom Research. SEC 2: Recommended Elliptic Curve Domain Parameters. + * + * + * [5] HANKERSON, Darrel, MENEZES, Alfred J., VANSTONE, Scott. Guide to Elliptic + * Curve Cryptography. + * + * [6] Digital Signature Standard (DSS), FIPS 186-4. + * + * + * [7] Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer + * Security (TLS), RFC 4492. + * + * + * [8] + * + * [9] COHEN, Henri. A Course in Computational Algebraic Number Theory. + * Springer Science & Business Media, 1 Aug 2000 + */ + +#ifndef MBEDTLS_ECP_INTERNAL_H +#define MBEDTLS_ECP_INTERNAL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#if defined(MBEDTLS_ECP_INTERNAL_ALT) + +/** + * \brief Indicate if the Elliptic Curve Point module extension can + * handle the group. + * + * \param grp The pointer to the elliptic curve group that will be the + * basis of the cryptographic computations. + * + * \return Non-zero if successful. + */ +unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ); + +/** + * \brief Initialise the Elliptic Curve Point module extension. + * + * If mbedtls_internal_ecp_grp_capable returns true for a + * group, this function has to be able to initialise the + * module for it. + * + * This module can be a driver to a crypto hardware + * accelerator, for which this could be an initialise function. + * + * \param grp The pointer to the group the module needs to be + * initialised for. + * + * \return 0 if successful. + */ +int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ); + +/** + * \brief Frees and deallocates the Elliptic Curve Point module + * extension. + * + * \param grp The pointer to the group the module was initialised for. + */ +void mbedtls_internal_ecp_free( const mbedtls_ecp_group *grp ); + +#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) + +#if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT) +/** + * \brief Randomize jacobian coordinates: + * (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l. + * + * \param grp Pointer to the group representing the curve. + * + * \param pt The point on the curve to be randomised, given with Jacobian + * coordinates. + * + * \param f_rng A function pointer to the random number generator. + * + * \param p_rng A pointer to the random number generator state. + * + * \return 0 if successful. + */ +int mbedtls_internal_ecp_randomize_jac( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *pt, int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); +#endif + +#if defined(MBEDTLS_ECP_ADD_MIXED_ALT) +/** + * \brief Addition: R = P + Q, mixed affine-Jacobian coordinates. + * + * The coordinates of Q must be normalized (= affine), + * but those of P don't need to. R is not normalized. + * + * This function is used only as a subrutine of + * ecp_mul_comb(). + * + * Special cases: (1) P or Q is zero, (2) R is zero, + * (3) P == Q. + * None of these cases can happen as intermediate step in + * ecp_mul_comb(): + * - at each step, P, Q and R are multiples of the base + * point, the factor being less than its order, so none of + * them is zero; + * - Q is an odd multiple of the base point, P an even + * multiple, due to the choice of precomputed points in the + * modified comb method. + * So branches for these cases do not leak secret information. + * + * We accept Q->Z being unset (saving memory in tables) as + * meaning 1. + * + * Cost in field operations if done by [5] 3.22: + * 1A := 8M + 3S + * + * \param grp Pointer to the group representing the curve. + * + * \param R Pointer to a point structure to hold the result. + * + * \param P Pointer to the first summand, given with Jacobian + * coordinates + * + * \param Q Pointer to the second summand, given with affine + * coordinates. + * + * \return 0 if successful. + */ +int mbedtls_internal_ecp_add_mixed( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *R, const mbedtls_ecp_point *P, + const mbedtls_ecp_point *Q ); +#endif + +/** + * \brief Point doubling R = 2 P, Jacobian coordinates. + * + * Cost: 1D := 3M + 4S (A == 0) + * 4M + 4S (A == -3) + * 3M + 6S + 1a otherwise + * when the implementation is based on the "dbl-1998-cmo-2" + * doubling formulas in [8] and standard optimizations are + * applied when curve parameter A is one of { 0, -3 }. + * + * \param grp Pointer to the group representing the curve. + * + * \param R Pointer to a point structure to hold the result. + * + * \param P Pointer to the point that has to be doubled, given with + * Jacobian coordinates. + * + * \return 0 if successful. + */ +#if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) +int mbedtls_internal_ecp_double_jac( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *R, const mbedtls_ecp_point *P ); +#endif + +/** + * \brief Normalize jacobian coordinates of an array of (pointers to) + * points. + * + * Using Montgomery's trick to perform only one inversion mod P + * the cost is: + * 1N(t) := 1I + (6t - 3)M + 1S + * (See for example Algorithm 10.3.4. in [9]) + * + * This function is used only as a subrutine of + * ecp_mul_comb(). + * + * Warning: fails (returning an error) if one of the points is + * zero! + * This should never happen, see choice of w in ecp_mul_comb(). + * + * \param grp Pointer to the group representing the curve. + * + * \param T Array of pointers to the points to normalise. + * + * \param t_len Number of elements in the array. + * + * \return 0 if successful, + * an error if one of the points is zero. + */ +#if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT) +int mbedtls_internal_ecp_normalize_jac_many( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *T[], size_t t_len ); +#endif + +/** + * \brief Normalize jacobian coordinates so that Z == 0 || Z == 1. + * + * Cost in field operations if done by [5] 3.2.1: + * 1N := 1I + 3M + 1S + * + * \param grp Pointer to the group representing the curve. + * + * \param pt pointer to the point to be normalised. This is an + * input/output parameter. + * + * \return 0 if successful. + */ +#if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT) +int mbedtls_internal_ecp_normalize_jac( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *pt ); +#endif + +#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ + +#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) + +#if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT) +int mbedtls_internal_ecp_double_add_mxz( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *R, mbedtls_ecp_point *S, const mbedtls_ecp_point *P, + const mbedtls_ecp_point *Q, const mbedtls_mpi *d ); +#endif + +/** + * \brief Randomize projective x/z coordinates: + * (X, Z) -> (l X, l Z) for random l + * + * \param grp pointer to the group representing the curve + * + * \param P the point on the curve to be randomised given with + * projective coordinates. This is an input/output parameter. + * + * \param f_rng a function pointer to the random number generator + * + * \param p_rng a pointer to the random number generator state + * + * \return 0 if successful + */ +#if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT) +int mbedtls_internal_ecp_randomize_mxz( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *P, int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); +#endif + +/** + * \brief Normalize Montgomery x/z coordinates: X = X/Z, Z = 1. + * + * \param grp pointer to the group representing the curve + * + * \param P pointer to the point to be normalised. This is an + * input/output parameter. + * + * \return 0 if successful + */ +#if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT) +int mbedtls_internal_ecp_normalize_mxz( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *P ); +#endif + +#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ + +#endif /* MBEDTLS_ECP_INTERNAL_ALT */ + +#endif /* ecp_internal.h */ + diff --git a/openharmony/arm64-v8a/include/mbedtls/entropy.h b/openharmony/arm64-v8a/include/mbedtls/entropy.h new file mode 100644 index 00000000..40259ebc --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/entropy.h @@ -0,0 +1,294 @@ +/** + * \file entropy.h + * + * \brief Entropy accumulator implementation + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_ENTROPY_H +#define MBEDTLS_ENTROPY_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +#if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_ENTROPY_FORCE_SHA256) +#include "mbedtls/sha512.h" +#define MBEDTLS_ENTROPY_SHA512_ACCUMULATOR +#else +#if defined(MBEDTLS_SHA256_C) +#define MBEDTLS_ENTROPY_SHA256_ACCUMULATOR +#include "mbedtls/sha256.h" +#endif +#endif + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +#if defined(MBEDTLS_HAVEGE_C) +#include "mbedtls/havege.h" +#endif + +/** Critical entropy source failure. */ +#define MBEDTLS_ERR_ENTROPY_SOURCE_FAILED -0x003C +/** No more sources can be added. */ +#define MBEDTLS_ERR_ENTROPY_MAX_SOURCES -0x003E +/** No sources have been added to poll. */ +#define MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED -0x0040 +/** No strong sources have been added to poll. */ +#define MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE -0x003D +/** Read/write error in file. */ +#define MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR -0x003F + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h or define them on the compiler command line. + * \{ + */ + +#if !defined(MBEDTLS_ENTROPY_MAX_SOURCES) +#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */ +#endif + +#if !defined(MBEDTLS_ENTROPY_MAX_GATHER) +#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */ +#endif + +/** \} name SECTION: Module settings */ + +#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR) +#define MBEDTLS_ENTROPY_BLOCK_SIZE 64 /**< Block size of entropy accumulator (SHA-512) */ +#else +#define MBEDTLS_ENTROPY_BLOCK_SIZE 32 /**< Block size of entropy accumulator (SHA-256) */ +#endif + +#define MBEDTLS_ENTROPY_MAX_SEED_SIZE 1024 /**< Maximum size of seed we read from seed file */ +#define MBEDTLS_ENTROPY_SOURCE_MANUAL MBEDTLS_ENTROPY_MAX_SOURCES + +#define MBEDTLS_ENTROPY_SOURCE_STRONG 1 /**< Entropy source is strong */ +#define MBEDTLS_ENTROPY_SOURCE_WEAK 0 /**< Entropy source is weak */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Entropy poll callback pointer + * + * \param data Callback-specific data pointer + * \param output Data to fill + * \param len Maximum size to provide + * \param olen The actual amount of bytes put into the buffer (Can be 0) + * + * \return 0 if no critical failures occurred, + * MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise + */ +typedef int (*mbedtls_entropy_f_source_ptr)(void *data, unsigned char *output, size_t len, + size_t *olen); + +/** + * \brief Entropy source state + */ +typedef struct mbedtls_entropy_source_state +{ + mbedtls_entropy_f_source_ptr f_source; /**< The entropy source callback */ + void * p_source; /**< The callback data pointer */ + size_t size; /**< Amount received in bytes */ + size_t threshold; /**< Minimum bytes required before release */ + int strong; /**< Is the source strong? */ +} +mbedtls_entropy_source_state; + +/** + * \brief Entropy context structure + */ +typedef struct mbedtls_entropy_context +{ + int accumulator_started; /* 0 after init. + * 1 after the first update. + * -1 after free. */ +#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR) + mbedtls_sha512_context accumulator; +#elif defined(MBEDTLS_ENTROPY_SHA256_ACCUMULATOR) + mbedtls_sha256_context accumulator; +#endif + int source_count; /* Number of entries used in source. */ + mbedtls_entropy_source_state source[MBEDTLS_ENTROPY_MAX_SOURCES]; +#if defined(MBEDTLS_HAVEGE_C) + mbedtls_havege_state havege_data; +#endif +#if defined(MBEDTLS_THREADING_C) + mbedtls_threading_mutex_t mutex; /*!< mutex */ +#endif +#if defined(MBEDTLS_ENTROPY_NV_SEED) + int initial_entropy_run; +#endif +} +mbedtls_entropy_context; + +/** + * \brief Initialize the context + * + * \param ctx Entropy context to initialize + */ +void mbedtls_entropy_init( mbedtls_entropy_context *ctx ); + +/** + * \brief Free the data in the context + * + * \param ctx Entropy context to free + */ +void mbedtls_entropy_free( mbedtls_entropy_context *ctx ); + +/** + * \brief Adds an entropy source to poll + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param ctx Entropy context + * \param f_source Entropy function + * \param p_source Function data + * \param threshold Minimum required from source before entropy is released + * ( with mbedtls_entropy_func() ) (in bytes) + * \param strong MBEDTLS_ENTROPY_SOURCE_STRONG or + * MBEDTLS_ENTROPY_SOURCE_WEAK. + * At least one strong source needs to be added. + * Weaker sources (such as the cycle counter) can be used as + * a complement. + * + * \return 0 if successful or MBEDTLS_ERR_ENTROPY_MAX_SOURCES + */ +int mbedtls_entropy_add_source( mbedtls_entropy_context *ctx, + mbedtls_entropy_f_source_ptr f_source, void *p_source, + size_t threshold, int strong ); + +/** + * \brief Trigger an extra gather poll for the accumulator + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param ctx Entropy context + * + * \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + */ +int mbedtls_entropy_gather( mbedtls_entropy_context *ctx ); + +/** + * \brief Retrieve entropy from the accumulator + * (Maximum length: MBEDTLS_ENTROPY_BLOCK_SIZE) + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param data Entropy context + * \param output Buffer to fill + * \param len Number of bytes desired, must be at most MBEDTLS_ENTROPY_BLOCK_SIZE + * + * \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + */ +int mbedtls_entropy_func( void *data, unsigned char *output, size_t len ); + +/** + * \brief Add data to the accumulator manually + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param ctx Entropy context + * \param data Data to add + * \param len Length of data + * + * \return 0 if successful + */ +int mbedtls_entropy_update_manual( mbedtls_entropy_context *ctx, + const unsigned char *data, size_t len ); + +#if defined(MBEDTLS_ENTROPY_NV_SEED) +/** + * \brief Trigger an update of the seed file in NV by using the + * current entropy pool. + * + * \param ctx Entropy context + * + * \return 0 if successful + */ +int mbedtls_entropy_update_nv_seed( mbedtls_entropy_context *ctx ); +#endif /* MBEDTLS_ENTROPY_NV_SEED */ + +#if defined(MBEDTLS_FS_IO) +/** + * \brief Write a seed file + * + * \param ctx Entropy context + * \param path Name of the file + * + * \return 0 if successful, + * MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR on file error, or + * MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + */ +int mbedtls_entropy_write_seed_file( mbedtls_entropy_context *ctx, const char *path ); + +/** + * \brief Read and update a seed file. Seed is added to this + * instance. No more than MBEDTLS_ENTROPY_MAX_SEED_SIZE bytes are + * read from the seed file. The rest is ignored. + * + * \param ctx Entropy context + * \param path Name of the file + * + * \return 0 if successful, + * MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR on file error, + * MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + */ +int mbedtls_entropy_update_seed_file( mbedtls_entropy_context *ctx, const char *path ); +#endif /* MBEDTLS_FS_IO */ + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine + * + * This module self-test also calls the entropy self-test, + * mbedtls_entropy_source_self_test(); + * + * \return 0 if successful, or 1 if a test failed + */ +int mbedtls_entropy_self_test( int verbose ); + +#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT) +/** + * \brief Checkup routine + * + * Verifies the integrity of the hardware entropy source + * provided by the function 'mbedtls_hardware_poll()'. + * + * Note this is the only hardware entropy source that is known + * at link time, and other entropy sources configured + * dynamically at runtime by the function + * mbedtls_entropy_add_source() will not be tested. + * + * \return 0 if successful, or 1 if a test failed + */ +int mbedtls_entropy_source_self_test( int verbose ); +#endif /* MBEDTLS_ENTROPY_HARDWARE_ALT */ +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* entropy.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/entropy_poll.h b/openharmony/arm64-v8a/include/mbedtls/entropy_poll.h new file mode 100644 index 00000000..e1d7491a --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/entropy_poll.h @@ -0,0 +1,108 @@ +/** + * \file entropy_poll.h + * + * \brief Platform-specific and custom entropy polling functions + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_ENTROPY_POLL_H +#define MBEDTLS_ENTROPY_POLL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * Default thresholds for built-in sources, in bytes + */ +#define MBEDTLS_ENTROPY_MIN_PLATFORM 32 /**< Minimum for platform source */ +#define MBEDTLS_ENTROPY_MIN_HAVEGE 32 /**< Minimum for HAVEGE */ +#define MBEDTLS_ENTROPY_MIN_HARDCLOCK 4 /**< Minimum for mbedtls_timing_hardclock() */ +#if !defined(MBEDTLS_ENTROPY_MIN_HARDWARE) +#define MBEDTLS_ENTROPY_MIN_HARDWARE 32 /**< Minimum for the hardware source */ +#endif + +/** + * \brief Entropy poll callback that provides 0 entropy. + */ +#if defined(MBEDTLS_TEST_NULL_ENTROPY) + int mbedtls_null_entropy_poll( void *data, + unsigned char *output, size_t len, size_t *olen ); +#endif + +#if !defined(MBEDTLS_NO_PLATFORM_ENTROPY) +/** + * \brief Platform-specific entropy poll callback + */ +int mbedtls_platform_entropy_poll( void *data, + unsigned char *output, size_t len, size_t *olen ); +#endif + +#if defined(MBEDTLS_HAVEGE_C) +/** + * \brief HAVEGE based entropy poll callback + * + * Requires an HAVEGE state as its data pointer. + */ +int mbedtls_havege_poll( void *data, + unsigned char *output, size_t len, size_t *olen ); +#endif + +#if defined(MBEDTLS_TIMING_C) +/** + * \brief mbedtls_timing_hardclock-based entropy poll callback + */ +int mbedtls_hardclock_poll( void *data, + unsigned char *output, size_t len, size_t *olen ); +#endif + +#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT) +/** + * \brief Entropy poll callback for a hardware source + * + * \warning This is not provided by mbed TLS! + * See \c MBEDTLS_ENTROPY_HARDWARE_ALT in config.h. + * + * \note This must accept NULL as its first argument. + */ +int mbedtls_hardware_poll( void *data, + unsigned char *output, size_t len, size_t *olen ); +#endif + +#if defined(MBEDTLS_ENTROPY_NV_SEED) +/** + * \brief Entropy poll callback for a non-volatile seed file + * + * \note This must accept NULL as its first argument. + */ +int mbedtls_nv_seed_poll( void *data, + unsigned char *output, size_t len, size_t *olen ); +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* entropy_poll.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/error.h b/openharmony/arm64-v8a/include/mbedtls/error.h new file mode 100644 index 00000000..50f25385 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/error.h @@ -0,0 +1,217 @@ +/** + * \file error.h + * + * \brief Error to string translation + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_ERROR_H +#define MBEDTLS_ERROR_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \ + !defined(inline) && !defined(__cplusplus) +#define inline __inline +#endif + +/** + * Error code layout. + * + * Currently we try to keep all error codes within the negative space of 16 + * bits signed integers to support all platforms (-0x0001 - -0x7FFF). In + * addition we'd like to give two layers of information on the error if + * possible. + * + * For that purpose the error codes are segmented in the following manner: + * + * 16 bit error code bit-segmentation + * + * 1 bit - Unused (sign bit) + * 3 bits - High level module ID + * 5 bits - Module-dependent error code + * 7 bits - Low level module errors + * + * For historical reasons, low-level error codes are divided in even and odd, + * even codes were assigned first, and -1 is reserved for other errors. + * + * Low-level module errors (0x0002-0x007E, 0x0001-0x007F) + * + * Module Nr Codes assigned + * ERROR 2 0x006E 0x0001 + * MPI 7 0x0002-0x0010 + * GCM 3 0x0012-0x0014 0x0013-0x0013 + * BLOWFISH 3 0x0016-0x0018 0x0017-0x0017 + * THREADING 3 0x001A-0x001E + * AES 5 0x0020-0x0022 0x0021-0x0025 + * CAMELLIA 3 0x0024-0x0026 0x0027-0x0027 + * XTEA 2 0x0028-0x0028 0x0029-0x0029 + * BASE64 2 0x002A-0x002C + * OID 1 0x002E-0x002E 0x000B-0x000B + * PADLOCK 1 0x0030-0x0030 + * DES 2 0x0032-0x0032 0x0033-0x0033 + * CTR_DBRG 4 0x0034-0x003A + * ENTROPY 3 0x003C-0x0040 0x003D-0x003F + * NET 13 0x0042-0x0052 0x0043-0x0049 + * ARIA 4 0x0058-0x005E + * ASN1 7 0x0060-0x006C + * CMAC 1 0x007A-0x007A + * PBKDF2 1 0x007C-0x007C + * HMAC_DRBG 4 0x0003-0x0009 + * CCM 3 0x000D-0x0011 + * ARC4 1 0x0019-0x0019 + * MD2 1 0x002B-0x002B + * MD4 1 0x002D-0x002D + * MD5 1 0x002F-0x002F + * RIPEMD160 1 0x0031-0x0031 + * SHA1 1 0x0035-0x0035 0x0073-0x0073 + * SHA256 1 0x0037-0x0037 0x0074-0x0074 + * SHA512 1 0x0039-0x0039 0x0075-0x0075 + * CHACHA20 3 0x0051-0x0055 + * POLY1305 3 0x0057-0x005B + * CHACHAPOLY 2 0x0054-0x0056 + * PLATFORM 2 0x0070-0x0072 + * + * High-level module nr (3 bits - 0x0...-0x7...) + * Name ID Nr of Errors + * PEM 1 9 + * PKCS#12 1 4 (Started from top) + * X509 2 20 + * PKCS5 2 4 (Started from top) + * DHM 3 11 + * PK 3 15 (Started from top) + * RSA 4 11 + * ECP 4 10 (Started from top) + * MD 5 5 + * HKDF 5 1 (Started from top) + * SSL 5 2 (Started from 0x5F00) + * CIPHER 6 8 (Started from 0x6080) + * SSL 6 24 (Started from top, plus 0x6000) + * SSL 7 32 + * + * Module dependent error code (5 bits 0x.00.-0x.F8.) + */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** Generic error */ +#define MBEDTLS_ERR_ERROR_GENERIC_ERROR -0x0001 +/** This is a bug in the library */ +#define MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED -0x006E + +/** + * \brief Combines a high-level and low-level error code together. + * + * Wrapper macro for mbedtls_error_add(). See that function for + * more details. + */ +#define MBEDTLS_ERROR_ADD( high, low ) \ + mbedtls_error_add( high, low, __FILE__, __LINE__ ) + +#if defined(MBEDTLS_TEST_HOOKS) +/** + * \brief Testing hook called before adding/combining two error codes together. + * Only used when invasive testing is enabled via MBEDTLS_TEST_HOOKS. + */ +extern void (*mbedtls_test_hook_error_add)( int, int, const char *, int ); +#endif + +/** + * \brief Combines a high-level and low-level error code together. + * + * This function can be called directly however it is usually + * called via the #MBEDTLS_ERROR_ADD macro. + * + * While a value of zero is not a negative error code, it is still an + * error code (that denotes success) and can be combined with both a + * negative error code or another value of zero. + * + * \note When invasive testing is enabled via #MBEDTLS_TEST_HOOKS, also try to + * call \link mbedtls_test_hook_error_add \endlink. + * + * \param high high-level error code. See error.h for more details. + * \param low low-level error code. See error.h for more details. + * \param file file where this error code addition occurred. + * \param line line where this error code addition occurred. + */ +static inline int mbedtls_error_add( int high, int low, + const char *file, int line ) +{ +#if defined(MBEDTLS_TEST_HOOKS) + if( *mbedtls_test_hook_error_add != NULL ) + ( *mbedtls_test_hook_error_add )( high, low, file, line ); +#endif + (void)file; + (void)line; + + return( high + low ); +} + +/** + * \brief Translate a mbed TLS error code into a string representation, + * Result is truncated if necessary and always includes a terminating + * null byte. + * + * \param errnum error code + * \param buffer buffer to place representation in + * \param buflen length of the buffer + */ +void mbedtls_strerror( int errnum, char *buffer, size_t buflen ); + +/** + * \brief Translate the high-level part of an Mbed TLS error code into a string + * representation. + * + * This function returns a const pointer to an un-modifiable string. The caller + * must not try to modify the string. It is intended to be used mostly for + * logging purposes. + * + * \param error_code error code + * + * \return The string representation of the error code, or \c NULL if the error + * code is unknown. + */ +const char * mbedtls_high_level_strerr( int error_code ); + +/** + * \brief Translate the low-level part of an Mbed TLS error code into a string + * representation. + * + * This function returns a const pointer to an un-modifiable string. The caller + * must not try to modify the string. It is intended to be used mostly for + * logging purposes. + * + * \param error_code error code + * + * \return The string representation of the error code, or \c NULL if the error + * code is unknown. + */ +const char * mbedtls_low_level_strerr( int error_code ); + +#ifdef __cplusplus +} +#endif + +#endif /* error.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/gcm.h b/openharmony/arm64-v8a/include/mbedtls/gcm.h new file mode 100644 index 00000000..9723a17b --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/gcm.h @@ -0,0 +1,327 @@ +/** + * \file gcm.h + * + * \brief This file contains GCM definitions and functions. + * + * The Galois/Counter Mode (GCM) for 128-bit block ciphers is defined + * in D. McGrew, J. Viega, The Galois/Counter Mode of Operation + * (GCM), Natl. Inst. Stand. Technol. + * + * For more information on GCM, see NIST SP 800-38D: Recommendation for + * Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC. + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_GCM_H +#define MBEDTLS_GCM_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/cipher.h" + +#include + +#define MBEDTLS_GCM_ENCRYPT 1 +#define MBEDTLS_GCM_DECRYPT 0 + +/** Authenticated decryption failed. */ +#define MBEDTLS_ERR_GCM_AUTH_FAILED -0x0012 + +/* MBEDTLS_ERR_GCM_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** GCM hardware accelerator failed. */ +#define MBEDTLS_ERR_GCM_HW_ACCEL_FAILED -0x0013 + +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_GCM_BAD_INPUT -0x0014 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_GCM_ALT) + +/** + * \brief The GCM context structure. + */ +typedef struct mbedtls_gcm_context +{ + mbedtls_cipher_context_t cipher_ctx; /*!< The cipher context used. */ + uint64_t HL[16]; /*!< Precalculated HTable low. */ + uint64_t HH[16]; /*!< Precalculated HTable high. */ + uint64_t len; /*!< The total length of the encrypted data. */ + uint64_t add_len; /*!< The total length of the additional data. */ + unsigned char base_ectr[16]; /*!< The first ECTR for tag. */ + unsigned char y[16]; /*!< The Y working value. */ + unsigned char buf[16]; /*!< The buf working value. */ + int mode; /*!< The operation to perform: + #MBEDTLS_GCM_ENCRYPT or + #MBEDTLS_GCM_DECRYPT. */ +} +mbedtls_gcm_context; + +#else /* !MBEDTLS_GCM_ALT */ +#include "gcm_alt.h" +#endif /* !MBEDTLS_GCM_ALT */ + +/** + * \brief This function initializes the specified GCM context, + * to make references valid, and prepares the context + * for mbedtls_gcm_setkey() or mbedtls_gcm_free(). + * + * The function does not bind the GCM context to a particular + * cipher, nor set the key. For this purpose, use + * mbedtls_gcm_setkey(). + * + * \param ctx The GCM context to initialize. This must not be \c NULL. + */ +void mbedtls_gcm_init( mbedtls_gcm_context *ctx ); + +/** + * \brief This function associates a GCM context with a + * cipher algorithm and a key. + * + * \param ctx The GCM context. This must be initialized. + * \param cipher The 128-bit block cipher to use. + * \param key The encryption key. This must be a readable buffer of at + * least \p keybits bits. + * \param keybits The key size in bits. Valid options are: + *
  • 128 bits
    • + *
  • 192 bits
    • + *
  • 256 bits
+ * + * \return \c 0 on success. + * \return A cipher-specific error code on failure. + */ +int mbedtls_gcm_setkey( mbedtls_gcm_context *ctx, + mbedtls_cipher_id_t cipher, + const unsigned char *key, + unsigned int keybits ); + +/** + * \brief This function performs GCM encryption or decryption of a buffer. + * + * \note For encryption, the output buffer can be the same as the + * input buffer. For decryption, the output buffer cannot be + * the same as input buffer. If the buffers overlap, the output + * buffer must trail at least 8 Bytes behind the input buffer. + * + * \warning When this function performs a decryption, it outputs the + * authentication tag and does not verify that the data is + * authentic. You should use this function to perform encryption + * only. For decryption, use mbedtls_gcm_auth_decrypt() instead. + * + * \param ctx The GCM context to use for encryption or decryption. This + * must be initialized. + * \param mode The operation to perform: + * - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. + * The ciphertext is written to \p output and the + * authentication tag is written to \p tag. + * - #MBEDTLS_GCM_DECRYPT to perform decryption. + * The plaintext is written to \p output and the + * authentication tag is written to \p tag. + * Note that this mode is not recommended, because it does + * not verify the authenticity of the data. For this reason, + * you should use mbedtls_gcm_auth_decrypt() instead of + * calling this function in decryption mode. + * \param length The length of the input data, which is equal to the length + * of the output data. + * \param iv The initialization vector. This must be a readable buffer of + * at least \p iv_len Bytes. + * \param iv_len The length of the IV. + * \param add The buffer holding the additional data. This must be of at + * least that size in Bytes. + * \param add_len The length of the additional data. + * \param input The buffer holding the input data. If \p length is greater + * than zero, this must be a readable buffer of at least that + * size in Bytes. + * \param output The buffer for holding the output data. If \p length is greater + * than zero, this must be a writable buffer of at least that + * size in Bytes. + * \param tag_len The length of the tag to generate. + * \param tag The buffer for holding the tag. This must be a writable + * buffer of at least \p tag_len Bytes. + * + * \return \c 0 if the encryption or decryption was performed + * successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, + * this does not indicate that the data is authentic. + * \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are + * not valid or a cipher-specific error code if the encryption + * or decryption failed. + */ +int mbedtls_gcm_crypt_and_tag( mbedtls_gcm_context *ctx, + int mode, + size_t length, + const unsigned char *iv, + size_t iv_len, + const unsigned char *add, + size_t add_len, + const unsigned char *input, + unsigned char *output, + size_t tag_len, + unsigned char *tag ); + +/** + * \brief This function performs a GCM authenticated decryption of a + * buffer. + * + * \note For decryption, the output buffer cannot be the same as + * input buffer. If the buffers overlap, the output buffer + * must trail at least 8 Bytes behind the input buffer. + * + * \param ctx The GCM context. This must be initialized. + * \param length The length of the ciphertext to decrypt, which is also + * the length of the decrypted plaintext. + * \param iv The initialization vector. This must be a readable buffer + * of at least \p iv_len Bytes. + * \param iv_len The length of the IV. + * \param add The buffer holding the additional data. This must be of at + * least that size in Bytes. + * \param add_len The length of the additional data. + * \param tag The buffer holding the tag to verify. This must be a + * readable buffer of at least \p tag_len Bytes. + * \param tag_len The length of the tag to verify. + * \param input The buffer holding the ciphertext. If \p length is greater + * than zero, this must be a readable buffer of at least that + * size. + * \param output The buffer for holding the decrypted plaintext. If \p length + * is greater than zero, this must be a writable buffer of at + * least that size. + * + * \return \c 0 if successful and authenticated. + * \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. + * \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are + * not valid or a cipher-specific error code if the decryption + * failed. + */ +int mbedtls_gcm_auth_decrypt( mbedtls_gcm_context *ctx, + size_t length, + const unsigned char *iv, + size_t iv_len, + const unsigned char *add, + size_t add_len, + const unsigned char *tag, + size_t tag_len, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function starts a GCM encryption or decryption + * operation. + * + * \param ctx The GCM context. This must be initialized. + * \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or + * #MBEDTLS_GCM_DECRYPT. + * \param iv The initialization vector. This must be a readable buffer of + * at least \p iv_len Bytes. + * \param iv_len The length of the IV. + * \param add The buffer holding the additional data, or \c NULL + * if \p add_len is \c 0. + * \param add_len The length of the additional data. If \c 0, + * \p add may be \c NULL. + * + * \return \c 0 on success. + */ +int mbedtls_gcm_starts( mbedtls_gcm_context *ctx, + int mode, + const unsigned char *iv, + size_t iv_len, + const unsigned char *add, + size_t add_len ); + +/** + * \brief This function feeds an input buffer into an ongoing GCM + * encryption or decryption operation. + * + * ` The function expects input to be a multiple of 16 + * Bytes. Only the last call before calling + * mbedtls_gcm_finish() can be less than 16 Bytes. + * + * \note For decryption, the output buffer cannot be the same as + * input buffer. If the buffers overlap, the output buffer + * must trail at least 8 Bytes behind the input buffer. + * + * \param ctx The GCM context. This must be initialized. + * \param length The length of the input data. This must be a multiple of + * 16 except in the last call before mbedtls_gcm_finish(). + * \param input The buffer holding the input data. If \p length is greater + * than zero, this must be a readable buffer of at least that + * size in Bytes. + * \param output The buffer for holding the output data. If \p length is + * greater than zero, this must be a writable buffer of at + * least that size in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure. + */ +int mbedtls_gcm_update( mbedtls_gcm_context *ctx, + size_t length, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function finishes the GCM operation and generates + * the authentication tag. + * + * It wraps up the GCM stream, and generates the + * tag. The tag can have a maximum length of 16 Bytes. + * + * \param ctx The GCM context. This must be initialized. + * \param tag The buffer for holding the tag. This must be a writable + * buffer of at least \p tag_len Bytes. + * \param tag_len The length of the tag to generate. This must be at least + * four. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure. + */ +int mbedtls_gcm_finish( mbedtls_gcm_context *ctx, + unsigned char *tag, + size_t tag_len ); + +/** + * \brief This function clears a GCM context and the underlying + * cipher sub-context. + * + * \param ctx The GCM context to clear. If this is \c NULL, the call has + * no effect. Otherwise, this must be initialized. + */ +void mbedtls_gcm_free( mbedtls_gcm_context *ctx ); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The GCM checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_gcm_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + + +#endif /* gcm.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/havege.h b/openharmony/arm64-v8a/include/mbedtls/havege.h new file mode 100644 index 00000000..7d27039e --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/havege.h @@ -0,0 +1,80 @@ +/** + * \file havege.h + * + * \brief HAVEGE: HArdware Volatile Entropy Gathering and Expansion + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_HAVEGE_H +#define MBEDTLS_HAVEGE_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +#define MBEDTLS_HAVEGE_COLLECT_SIZE 1024 + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief HAVEGE state structure + */ +typedef struct mbedtls_havege_state +{ + uint32_t PT1, PT2, offset[2]; + uint32_t pool[MBEDTLS_HAVEGE_COLLECT_SIZE]; + uint32_t WALK[8192]; +} +mbedtls_havege_state; + +/** + * \brief HAVEGE initialization + * + * \param hs HAVEGE state to be initialized + */ +void mbedtls_havege_init( mbedtls_havege_state *hs ); + +/** + * \brief Clear HAVEGE state + * + * \param hs HAVEGE state to be cleared + */ +void mbedtls_havege_free( mbedtls_havege_state *hs ); + +/** + * \brief HAVEGE rand function + * + * \param p_rng A HAVEGE state + * \param output Buffer to fill + * \param len Length of buffer + * + * \return 0 + */ +int mbedtls_havege_random( void *p_rng, unsigned char *output, size_t len ); + +#ifdef __cplusplus +} +#endif + +#endif /* havege.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/hkdf.h b/openharmony/arm64-v8a/include/mbedtls/hkdf.h new file mode 100644 index 00000000..111d960e --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/hkdf.h @@ -0,0 +1,140 @@ +/** + * \file hkdf.h + * + * \brief This file contains the HKDF interface. + * + * The HMAC-based Extract-and-Expand Key Derivation Function (HKDF) is + * specified by RFC 5869. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_HKDF_H +#define MBEDTLS_HKDF_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/md.h" + +/** + * \name HKDF Error codes + * \{ + */ +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_HKDF_BAD_INPUT_DATA -0x5F80 +/** \} name */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief This is the HMAC-based Extract-and-Expand Key Derivation Function + * (HKDF). + * + * \param md A hash function; md.size denotes the length of the hash + * function output in bytes. + * \param salt An optional salt value (a non-secret random value); + * if the salt is not provided, a string of all zeros of + * md.size length is used as the salt. + * \param salt_len The length in bytes of the optional \p salt. + * \param ikm The input keying material. + * \param ikm_len The length in bytes of \p ikm. + * \param info An optional context and application specific information + * string. This can be a zero-length string. + * \param info_len The length of \p info in bytes. + * \param okm The output keying material of \p okm_len bytes. + * \param okm_len The length of the output keying material in bytes. This + * must be less than or equal to 255 * md.size bytes. + * + * \return 0 on success. + * \return #MBEDTLS_ERR_HKDF_BAD_INPUT_DATA when the parameters are invalid. + * \return An MBEDTLS_ERR_MD_* error for errors returned from the underlying + * MD layer. + */ +int mbedtls_hkdf( const mbedtls_md_info_t *md, const unsigned char *salt, + size_t salt_len, const unsigned char *ikm, size_t ikm_len, + const unsigned char *info, size_t info_len, + unsigned char *okm, size_t okm_len ); + +/** + * \brief Take the input keying material \p ikm and extract from it a + * fixed-length pseudorandom key \p prk. + * + * \warning This function should only be used if the security of it has been + * studied and established in that particular context (eg. TLS 1.3 + * key schedule). For standard HKDF security guarantees use + * \c mbedtls_hkdf instead. + * + * \param md A hash function; md.size denotes the length of the + * hash function output in bytes. + * \param salt An optional salt value (a non-secret random value); + * if the salt is not provided, a string of all zeros + * of md.size length is used as the salt. + * \param salt_len The length in bytes of the optional \p salt. + * \param ikm The input keying material. + * \param ikm_len The length in bytes of \p ikm. + * \param[out] prk A pseudorandom key of at least md.size bytes. + * + * \return 0 on success. + * \return #MBEDTLS_ERR_HKDF_BAD_INPUT_DATA when the parameters are invalid. + * \return An MBEDTLS_ERR_MD_* error for errors returned from the underlying + * MD layer. + */ +int mbedtls_hkdf_extract( const mbedtls_md_info_t *md, + const unsigned char *salt, size_t salt_len, + const unsigned char *ikm, size_t ikm_len, + unsigned char *prk ); + +/** + * \brief Expand the supplied \p prk into several additional pseudorandom + * keys, which is the output of the HKDF. + * + * \warning This function should only be used if the security of it has been + * studied and established in that particular context (eg. TLS 1.3 + * key schedule). For standard HKDF security guarantees use + * \c mbedtls_hkdf instead. + * + * \param md A hash function; md.size denotes the length of the hash + * function output in bytes. + * \param prk A pseudorandom key of at least md.size bytes. \p prk is + * usually the output from the HKDF extract step. + * \param prk_len The length in bytes of \p prk. + * \param info An optional context and application specific information + * string. This can be a zero-length string. + * \param info_len The length of \p info in bytes. + * \param okm The output keying material of \p okm_len bytes. + * \param okm_len The length of the output keying material in bytes. This + * must be less than or equal to 255 * md.size bytes. + * + * \return 0 on success. + * \return #MBEDTLS_ERR_HKDF_BAD_INPUT_DATA when the parameters are invalid. + * \return An MBEDTLS_ERR_MD_* error for errors returned from the underlying + * MD layer. + */ +int mbedtls_hkdf_expand( const mbedtls_md_info_t *md, const unsigned char *prk, + size_t prk_len, const unsigned char *info, + size_t info_len, unsigned char *okm, size_t okm_len ); + +#ifdef __cplusplus +} +#endif + +#endif /* hkdf.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/hmac_drbg.h b/openharmony/arm64-v8a/include/mbedtls/hmac_drbg.h new file mode 100644 index 00000000..6d372b97 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/hmac_drbg.h @@ -0,0 +1,474 @@ +/** + * \file hmac_drbg.h + * + * \brief The HMAC_DRBG pseudorandom generator. + * + * This module implements the HMAC_DRBG pseudorandom generator described + * in NIST SP 800-90A: Recommendation for Random Number Generation Using + * Deterministic Random Bit Generators. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_HMAC_DRBG_H +#define MBEDTLS_HMAC_DRBG_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/md.h" + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +/* + * Error codes + */ +/** Too many random requested in single call. */ +#define MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG -0x0003 +/** Input too large (Entropy + additional). */ +#define MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG -0x0005 +/** Read/write error in file. */ +#define MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR -0x0007 +/** The entropy source failed. */ +#define MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED -0x0009 + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h or define them on the compiler command line. + * \{ + */ + +#if !defined(MBEDTLS_HMAC_DRBG_RESEED_INTERVAL) +#define MBEDTLS_HMAC_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ +#endif + +#if !defined(MBEDTLS_HMAC_DRBG_MAX_INPUT) +#define MBEDTLS_HMAC_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ +#endif + +#if !defined(MBEDTLS_HMAC_DRBG_MAX_REQUEST) +#define MBEDTLS_HMAC_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ +#endif + +#if !defined(MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT) +#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ +#endif + +/** \} name SECTION: Module settings */ + +#define MBEDTLS_HMAC_DRBG_PR_OFF 0 /**< No prediction resistance */ +#define MBEDTLS_HMAC_DRBG_PR_ON 1 /**< Prediction resistance enabled */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * HMAC_DRBG context. + */ +typedef struct mbedtls_hmac_drbg_context +{ + /* Working state: the key K is not stored explicitly, + * but is implied by the HMAC context */ + mbedtls_md_context_t md_ctx; /*!< HMAC context (inc. K) */ + unsigned char V[MBEDTLS_MD_MAX_SIZE]; /*!< V in the spec */ + int reseed_counter; /*!< reseed counter */ + + /* Administrative state */ + size_t entropy_len; /*!< entropy bytes grabbed on each (re)seed */ + int prediction_resistance; /*!< enable prediction resistance (Automatic + reseed before every random generation) */ + int reseed_interval; /*!< reseed interval */ + + /* Callbacks */ + int (*f_entropy)(void *, unsigned char *, size_t); /*!< entropy function */ + void *p_entropy; /*!< context for the entropy function */ + +#if defined(MBEDTLS_THREADING_C) + /* Invariant: the mutex is initialized if and only if + * md_ctx->md_info != NULL. This means that the mutex is initialized + * during the initial seeding in mbedtls_hmac_drbg_seed() or + * mbedtls_hmac_drbg_seed_buf() and freed in mbedtls_ctr_drbg_free(). + * + * Note that this invariant may change without notice. Do not rely on it + * and do not access the mutex directly in application code. + */ + mbedtls_threading_mutex_t mutex; +#endif +} mbedtls_hmac_drbg_context; + +/** + * \brief HMAC_DRBG context initialization. + * + * This function makes the context ready for mbedtls_hmac_drbg_seed(), + * mbedtls_hmac_drbg_seed_buf() or mbedtls_hmac_drbg_free(). + * + * \note The reseed interval is #MBEDTLS_HMAC_DRBG_RESEED_INTERVAL + * by default. Override this value by calling + * mbedtls_hmac_drbg_set_reseed_interval(). + * + * \param ctx HMAC_DRBG context to be initialized. + */ +void mbedtls_hmac_drbg_init( mbedtls_hmac_drbg_context *ctx ); + +/** + * \brief HMAC_DRBG initial seeding. + * + * Set the initial seed and set up the entropy source for future reseeds. + * + * A typical choice for the \p f_entropy and \p p_entropy parameters is + * to use the entropy module: + * - \p f_entropy is mbedtls_entropy_func(); + * - \p p_entropy is an instance of ::mbedtls_entropy_context initialized + * with mbedtls_entropy_init() (which registers the platform's default + * entropy sources). + * + * You can provide a personalization string in addition to the + * entropy source, to make this instantiation as unique as possible. + * + * \note By default, the security strength as defined by NIST is: + * - 128 bits if \p md_info is SHA-1; + * - 192 bits if \p md_info is SHA-224; + * - 256 bits if \p md_info is SHA-256, SHA-384 or SHA-512. + * Note that SHA-256 is just as efficient as SHA-224. + * The security strength can be reduced if a smaller + * entropy length is set with + * mbedtls_hmac_drbg_set_entropy_len(). + * + * \note The default entropy length is the security strength + * (converted from bits to bytes). You can override + * it by calling mbedtls_hmac_drbg_set_entropy_len(). + * + * \note During the initial seeding, this function calls + * the entropy source to obtain a nonce + * whose length is half the entropy length. + */ +#if defined(MBEDTLS_THREADING_C) +/** + * \note When Mbed TLS is built with threading support, + * after this function returns successfully, + * it is safe to call mbedtls_hmac_drbg_random() + * from multiple threads. Other operations, including + * reseeding, are not thread-safe. + */ +#endif /* MBEDTLS_THREADING_C */ +/** + * \param ctx HMAC_DRBG context to be seeded. + * \param md_info MD algorithm to use for HMAC_DRBG. + * \param f_entropy The entropy callback, taking as arguments the + * \p p_entropy context, the buffer to fill, and the + * length of the buffer. + * \p f_entropy is always called with a length that is + * less than or equal to the entropy length. + * \param p_entropy The entropy context to pass to \p f_entropy. + * \param custom The personalization string. + * This can be \c NULL, in which case the personalization + * string is empty regardless of the value of \p len. + * \param len The length of the personalization string. + * This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT + * and also at most + * #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len * 3 / 2 + * where \p entropy_len is the entropy length + * described above. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA if \p md_info is + * invalid. + * \return #MBEDTLS_ERR_MD_ALLOC_FAILED if there was not enough + * memory to allocate context data. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED + * if the call to \p f_entropy failed. + */ +int mbedtls_hmac_drbg_seed( mbedtls_hmac_drbg_context *ctx, + const mbedtls_md_info_t * md_info, + int (*f_entropy)(void *, unsigned char *, size_t), + void *p_entropy, + const unsigned char *custom, + size_t len ); + +/** + * \brief Initialisation of simplified HMAC_DRBG (never reseeds). + * + * This function is meant for use in algorithms that need a pseudorandom + * input such as deterministic ECDSA. + */ +#if defined(MBEDTLS_THREADING_C) +/** + * \note When Mbed TLS is built with threading support, + * after this function returns successfully, + * it is safe to call mbedtls_hmac_drbg_random() + * from multiple threads. Other operations, including + * reseeding, are not thread-safe. + */ +#endif /* MBEDTLS_THREADING_C */ +/** + * \param ctx HMAC_DRBG context to be initialised. + * \param md_info MD algorithm to use for HMAC_DRBG. + * \param data Concatenation of the initial entropy string and + * the additional data. + * \param data_len Length of \p data in bytes. + * + * \return \c 0 if successful. or + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA if \p md_info is + * invalid. + * \return #MBEDTLS_ERR_MD_ALLOC_FAILED if there was not enough + * memory to allocate context data. + */ +int mbedtls_hmac_drbg_seed_buf( mbedtls_hmac_drbg_context *ctx, + const mbedtls_md_info_t * md_info, + const unsigned char *data, size_t data_len ); + +/** + * \brief This function turns prediction resistance on or off. + * The default value is off. + * + * \note If enabled, entropy is gathered at the beginning of + * every call to mbedtls_hmac_drbg_random_with_add() + * or mbedtls_hmac_drbg_random(). + * Only use this if your entropy source has sufficient + * throughput. + * + * \param ctx The HMAC_DRBG context. + * \param resistance #MBEDTLS_HMAC_DRBG_PR_ON or #MBEDTLS_HMAC_DRBG_PR_OFF. + */ +void mbedtls_hmac_drbg_set_prediction_resistance( mbedtls_hmac_drbg_context *ctx, + int resistance ); + +/** + * \brief This function sets the amount of entropy grabbed on each + * seed or reseed. + * + * See the documentation of mbedtls_hmac_drbg_seed() for the default value. + * + * \param ctx The HMAC_DRBG context. + * \param len The amount of entropy to grab, in bytes. + */ +void mbedtls_hmac_drbg_set_entropy_len( mbedtls_hmac_drbg_context *ctx, + size_t len ); + +/** + * \brief Set the reseed interval. + * + * The reseed interval is the number of calls to mbedtls_hmac_drbg_random() + * or mbedtls_hmac_drbg_random_with_add() after which the entropy function + * is called again. + * + * The default value is #MBEDTLS_HMAC_DRBG_RESEED_INTERVAL. + * + * \param ctx The HMAC_DRBG context. + * \param interval The reseed interval. + */ +void mbedtls_hmac_drbg_set_reseed_interval( mbedtls_hmac_drbg_context *ctx, + int interval ); + +/** + * \brief This function updates the state of the HMAC_DRBG context. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param ctx The HMAC_DRBG context. + * \param additional The data to update the state with. + * If this is \c NULL, there is no additional data. + * \param add_len Length of \p additional in bytes. + * Unused if \p additional is \c NULL. + * + * \return \c 0 on success, or an error from the underlying + * hash calculation. + */ +int mbedtls_hmac_drbg_update_ret( mbedtls_hmac_drbg_context *ctx, + const unsigned char *additional, size_t add_len ); + +/** + * \brief This function reseeds the HMAC_DRBG context, that is + * extracts data from the entropy source. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param ctx The HMAC_DRBG context. + * \param additional Additional data to add to the state. + * If this is \c NULL, there is no additional data + * and \p len should be \c 0. + * \param len The length of the additional data. + * This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT + * and also at most + * #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len + * where \p entropy_len is the entropy length + * (see mbedtls_hmac_drbg_set_entropy_len()). + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED + * if a call to the entropy function failed. + */ +int mbedtls_hmac_drbg_reseed( mbedtls_hmac_drbg_context *ctx, + const unsigned char *additional, size_t len ); + +/** + * \brief This function updates an HMAC_DRBG instance with additional + * data and uses it to generate random data. + * + * This function automatically reseeds if the reseed counter is exceeded + * or prediction resistance is enabled. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param p_rng The HMAC_DRBG context. This must be a pointer to a + * #mbedtls_hmac_drbg_context structure. + * \param output The buffer to fill. + * \param output_len The length of the buffer in bytes. + * This must be at most #MBEDTLS_HMAC_DRBG_MAX_REQUEST. + * \param additional Additional data to update with. + * If this is \c NULL, there is no additional data + * and \p add_len should be \c 0. + * \param add_len The length of the additional data. + * This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED + * if a call to the entropy source failed. + * \return #MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG if + * \p output_len > #MBEDTLS_HMAC_DRBG_MAX_REQUEST. + * \return #MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG if + * \p add_len > #MBEDTLS_HMAC_DRBG_MAX_INPUT. + */ +int mbedtls_hmac_drbg_random_with_add( void *p_rng, + unsigned char *output, size_t output_len, + const unsigned char *additional, + size_t add_len ); + +/** + * \brief This function uses HMAC_DRBG to generate random data. + * + * This function automatically reseeds if the reseed counter is exceeded + * or prediction resistance is enabled. + */ +#if defined(MBEDTLS_THREADING_C) +/** + * \note When Mbed TLS is built with threading support, + * it is safe to call mbedtls_ctr_drbg_random() + * from multiple threads. Other operations, including + * reseeding, are not thread-safe. + */ +#endif /* MBEDTLS_THREADING_C */ +/** + * \param p_rng The HMAC_DRBG context. This must be a pointer to a + * #mbedtls_hmac_drbg_context structure. + * \param output The buffer to fill. + * \param out_len The length of the buffer in bytes. + * This must be at most #MBEDTLS_HMAC_DRBG_MAX_REQUEST. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED + * if a call to the entropy source failed. + * \return #MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG if + * \p out_len > #MBEDTLS_HMAC_DRBG_MAX_REQUEST. + */ +int mbedtls_hmac_drbg_random( void *p_rng, unsigned char *output, size_t out_len ); + +/** + * \brief This function resets HMAC_DRBG context to the state immediately + * after initial call of mbedtls_hmac_drbg_init(). + * + * \param ctx The HMAC_DRBG context to free. + */ +void mbedtls_hmac_drbg_free( mbedtls_hmac_drbg_context *ctx ); + +#if ! defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function updates the state of the HMAC_DRBG context. + * + * \deprecated Superseded by mbedtls_hmac_drbg_update_ret() + * in 2.16.0. + * + * \param ctx The HMAC_DRBG context. + * \param additional The data to update the state with. + * If this is \c NULL, there is no additional data. + * \param add_len Length of \p additional in bytes. + * Unused if \p additional is \c NULL. + */ +MBEDTLS_DEPRECATED void mbedtls_hmac_drbg_update( + mbedtls_hmac_drbg_context *ctx, + const unsigned char *additional, size_t add_len ); +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_FS_IO) +/** + * \brief This function writes a seed file. + * + * \param ctx The HMAC_DRBG context. + * \param path The name of the file. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR on file error. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED on reseed + * failure. + */ +int mbedtls_hmac_drbg_write_seed_file( mbedtls_hmac_drbg_context *ctx, const char *path ); + +/** + * \brief This function reads and updates a seed file. The seed + * is added to this instance. + * + * \param ctx The HMAC_DRBG context. + * \param path The name of the file. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR on file error. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED on + * reseed failure. + * \return #MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG if the existing + * seed file is too large. + */ +int mbedtls_hmac_drbg_update_seed_file( mbedtls_hmac_drbg_context *ctx, const char *path ); +#endif /* MBEDTLS_FS_IO */ + + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief The HMAC_DRBG Checkup routine. + * + * \return \c 0 if successful. + * \return \c 1 if the test failed. + */ +int mbedtls_hmac_drbg_self_test( int verbose ); +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* hmac_drbg.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/md.h b/openharmony/arm64-v8a/include/mbedtls/md.h new file mode 100644 index 00000000..84fafd2a --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/md.h @@ -0,0 +1,493 @@ + /** + * \file md.h + * + * \brief This file contains the generic message-digest wrapper. + * + * \author Adriaan de Jong + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_MD_H +#define MBEDTLS_MD_H + +#include + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif +#include "mbedtls/platform_util.h" + +/** The selected feature is not available. */ +#define MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE -0x5080 +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_MD_BAD_INPUT_DATA -0x5100 +/** Failed to allocate memory. */ +#define MBEDTLS_ERR_MD_ALLOC_FAILED -0x5180 +/** Opening or reading of file failed. */ +#define MBEDTLS_ERR_MD_FILE_IO_ERROR -0x5200 + +/* MBEDTLS_ERR_MD_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** MD hardware accelerator failed. */ +#define MBEDTLS_ERR_MD_HW_ACCEL_FAILED -0x5280 + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Supported message digests. + * + * \warning MD2, MD4, MD5 and SHA-1 are considered weak message digests and + * their use constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +typedef enum { + MBEDTLS_MD_NONE=0, /**< None. */ + MBEDTLS_MD_MD2, /**< The MD2 message digest. */ + MBEDTLS_MD_MD4, /**< The MD4 message digest. */ + MBEDTLS_MD_MD5, /**< The MD5 message digest. */ + MBEDTLS_MD_SHA1, /**< The SHA-1 message digest. */ + MBEDTLS_MD_SHA224, /**< The SHA-224 message digest. */ + MBEDTLS_MD_SHA256, /**< The SHA-256 message digest. */ + MBEDTLS_MD_SHA384, /**< The SHA-384 message digest. */ + MBEDTLS_MD_SHA512, /**< The SHA-512 message digest. */ + MBEDTLS_MD_RIPEMD160, /**< The RIPEMD-160 message digest. */ +} mbedtls_md_type_t; + +#if defined(MBEDTLS_SHA512_C) +#define MBEDTLS_MD_MAX_SIZE 64 /* longest known is SHA512 */ +#else +#define MBEDTLS_MD_MAX_SIZE 32 /* longest known is SHA256 or less */ +#endif + +#if defined(MBEDTLS_SHA512_C) +#define MBEDTLS_MD_MAX_BLOCK_SIZE 128 +#else +#define MBEDTLS_MD_MAX_BLOCK_SIZE 64 +#endif + +/** + * Opaque struct defined in md_internal.h. + */ +typedef struct mbedtls_md_info_t mbedtls_md_info_t; + +/** + * The generic message-digest context. + */ +typedef struct mbedtls_md_context_t +{ + /** Information about the associated message digest. */ + const mbedtls_md_info_t *md_info; + + /** The digest-specific context. */ + void *md_ctx; + + /** The HMAC part of the context. */ + void *hmac_ctx; +} mbedtls_md_context_t; + +/** + * \brief This function returns the list of digests supported by the + * generic digest module. + * + * \note The list starts with the strongest available hashes. + * + * \return A statically allocated array of digests. Each element + * in the returned list is an integer belonging to the + * message-digest enumeration #mbedtls_md_type_t. + * The last entry is 0. + */ +const int *mbedtls_md_list( void ); + +/** + * \brief This function returns the message-digest information + * associated with the given digest name. + * + * \param md_name The name of the digest to search for. + * + * \return The message-digest information associated with \p md_name. + * \return NULL if the associated message-digest information is not found. + */ +const mbedtls_md_info_t *mbedtls_md_info_from_string( const char *md_name ); + +/** + * \brief This function returns the message-digest information + * associated with the given digest type. + * + * \param md_type The type of digest to search for. + * + * \return The message-digest information associated with \p md_type. + * \return NULL if the associated message-digest information is not found. + */ +const mbedtls_md_info_t *mbedtls_md_info_from_type( mbedtls_md_type_t md_type ); + +/** + * \brief This function initializes a message-digest context without + * binding it to a particular message-digest algorithm. + * + * This function should always be called first. It prepares the + * context for mbedtls_md_setup() for binding it to a + * message-digest algorithm. + */ +void mbedtls_md_init( mbedtls_md_context_t *ctx ); + +/** + * \brief This function clears the internal structure of \p ctx and + * frees any embedded internal structure, but does not free + * \p ctx itself. + * + * If you have called mbedtls_md_setup() on \p ctx, you must + * call mbedtls_md_free() when you are no longer using the + * context. + * Calling this function if you have previously + * called mbedtls_md_init() and nothing else is optional. + * You must not call this function if you have not called + * mbedtls_md_init(). + */ +void mbedtls_md_free( mbedtls_md_context_t *ctx ); + +#if ! defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function selects the message digest algorithm to use, + * and allocates internal structures. + * + * It should be called after mbedtls_md_init() or mbedtls_md_free(). + * Makes it necessary to call mbedtls_md_free() later. + * + * \deprecated Superseded by mbedtls_md_setup() in 2.0.0 + * + * \param ctx The context to set up. + * \param md_info The information structure of the message-digest algorithm + * to use. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + * \return #MBEDTLS_ERR_MD_ALLOC_FAILED on memory-allocation failure. + */ +int mbedtls_md_init_ctx( mbedtls_md_context_t *ctx, const mbedtls_md_info_t *md_info ) MBEDTLS_DEPRECATED; +#undef MBEDTLS_DEPRECATED +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief This function selects the message digest algorithm to use, + * and allocates internal structures. + * + * It should be called after mbedtls_md_init() or + * mbedtls_md_free(). Makes it necessary to call + * mbedtls_md_free() later. + * + * \param ctx The context to set up. + * \param md_info The information structure of the message-digest algorithm + * to use. + * \param hmac Defines if HMAC is used. 0: HMAC is not used (saves some memory), + * or non-zero: HMAC is used with this context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + * \return #MBEDTLS_ERR_MD_ALLOC_FAILED on memory-allocation failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_setup( mbedtls_md_context_t *ctx, const mbedtls_md_info_t *md_info, int hmac ); + +/** + * \brief This function clones the state of an message-digest + * context. + * + * \note You must call mbedtls_md_setup() on \c dst before calling + * this function. + * + * \note The two contexts must have the same type, + * for example, both are SHA-256. + * + * \warning This function clones the message-digest state, not the + * HMAC state. + * + * \param dst The destination context. + * \param src The context to be cloned. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_clone( mbedtls_md_context_t *dst, + const mbedtls_md_context_t *src ); + +/** + * \brief This function extracts the message-digest size from the + * message-digest information structure. + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * + * \return The size of the message-digest output in Bytes. + */ +unsigned char mbedtls_md_get_size( const mbedtls_md_info_t *md_info ); + +/** + * \brief This function extracts the message-digest type from the + * message-digest information structure. + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * + * \return The type of the message digest. + */ +mbedtls_md_type_t mbedtls_md_get_type( const mbedtls_md_info_t *md_info ); + +/** + * \brief This function extracts the message-digest name from the + * message-digest information structure. + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * + * \return The name of the message digest. + */ +const char *mbedtls_md_get_name( const mbedtls_md_info_t *md_info ); + +/** + * \brief This function starts a message-digest computation. + * + * You must call this function after setting up the context + * with mbedtls_md_setup(), and before passing data with + * mbedtls_md_update(). + * + * \param ctx The generic message-digest context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_starts( mbedtls_md_context_t *ctx ); + +/** + * \brief This function feeds an input buffer into an ongoing + * message-digest computation. + * + * You must call mbedtls_md_starts() before calling this + * function. You may call this function multiple times. + * Afterwards, call mbedtls_md_finish(). + * + * \param ctx The generic message-digest context. + * \param input The buffer holding the input data. + * \param ilen The length of the input data. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_update( mbedtls_md_context_t *ctx, const unsigned char *input, size_t ilen ); + +/** + * \brief This function finishes the digest operation, + * and writes the result to the output buffer. + * + * Call this function after a call to mbedtls_md_starts(), + * followed by any number of calls to mbedtls_md_update(). + * Afterwards, you may either clear the context with + * mbedtls_md_free(), or call mbedtls_md_starts() to reuse + * the context for another digest operation with the same + * algorithm. + * + * \param ctx The generic message-digest context. + * \param output The buffer for the generic message-digest checksum result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_finish( mbedtls_md_context_t *ctx, unsigned char *output ); + +/** + * \brief This function calculates the message-digest of a buffer, + * with respect to a configurable message-digest algorithm + * in a single call. + * + * The result is calculated as + * Output = message_digest(input buffer). + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * \param input The buffer holding the data. + * \param ilen The length of the input data. + * \param output The generic message-digest checksum result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md( const mbedtls_md_info_t *md_info, const unsigned char *input, size_t ilen, + unsigned char *output ); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief This function calculates the message-digest checksum + * result of the contents of the provided file. + * + * The result is calculated as + * Output = message_digest(file contents). + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * \param path The input file name. + * \param output The generic message-digest checksum result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_FILE_IO_ERROR on an I/O error accessing + * the file pointed by \p path. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA if \p md_info was NULL. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_file( const mbedtls_md_info_t *md_info, const char *path, + unsigned char *output ); +#endif /* MBEDTLS_FS_IO */ + +/** + * \brief This function sets the HMAC key and prepares to + * authenticate a new message. + * + * Call this function after mbedtls_md_setup(), to use + * the MD context for an HMAC calculation, then call + * mbedtls_md_hmac_update() to provide the input data, and + * mbedtls_md_hmac_finish() to get the HMAC value. + * + * \param ctx The message digest context containing an embedded HMAC + * context. + * \param key The HMAC secret key. + * \param keylen The length of the HMAC key in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_hmac_starts( mbedtls_md_context_t *ctx, const unsigned char *key, + size_t keylen ); + +/** + * \brief This function feeds an input buffer into an ongoing HMAC + * computation. + * + * Call mbedtls_md_hmac_starts() or mbedtls_md_hmac_reset() + * before calling this function. + * You may call this function multiple times to pass the + * input piecewise. + * Afterwards, call mbedtls_md_hmac_finish(). + * + * \param ctx The message digest context containing an embedded HMAC + * context. + * \param input The buffer holding the input data. + * \param ilen The length of the input data. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_hmac_update( mbedtls_md_context_t *ctx, const unsigned char *input, + size_t ilen ); + +/** + * \brief This function finishes the HMAC operation, and writes + * the result to the output buffer. + * + * Call this function after mbedtls_md_hmac_starts() and + * mbedtls_md_hmac_update() to get the HMAC value. Afterwards + * you may either call mbedtls_md_free() to clear the context, + * or call mbedtls_md_hmac_reset() to reuse the context with + * the same HMAC key. + * + * \param ctx The message digest context containing an embedded HMAC + * context. + * \param output The generic HMAC checksum result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_hmac_finish( mbedtls_md_context_t *ctx, unsigned char *output); + +/** + * \brief This function prepares to authenticate a new message with + * the same key as the previous HMAC operation. + * + * You may call this function after mbedtls_md_hmac_finish(). + * Afterwards call mbedtls_md_hmac_update() to pass the new + * input. + * + * \param ctx The message digest context containing an embedded HMAC + * context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_hmac_reset( mbedtls_md_context_t *ctx ); + +/** + * \brief This function calculates the full generic HMAC + * on the input buffer with the provided key. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The HMAC result is calculated as + * output = generic HMAC(hmac key, input buffer). + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * \param key The HMAC secret key. + * \param keylen The length of the HMAC secret key in Bytes. + * \param input The buffer holding the input data. + * \param ilen The length of the input data. + * \param output The generic HMAC result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_hmac( const mbedtls_md_info_t *md_info, const unsigned char *key, size_t keylen, + const unsigned char *input, size_t ilen, + unsigned char *output ); + +/* Internal use */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_process( mbedtls_md_context_t *ctx, const unsigned char *data ); + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_MD_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/md2.h b/openharmony/arm64-v8a/include/mbedtls/md2.h new file mode 100644 index 00000000..7f3d5cf4 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/md2.h @@ -0,0 +1,305 @@ +/** + * \file md2.h + * + * \brief MD2 message digest algorithm (hash function) + * + * \warning MD2 is considered a weak message digest and its use constitutes a + * security risk. We recommend considering stronger message digests + * instead. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ +#ifndef MBEDTLS_MD2_H +#define MBEDTLS_MD2_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +/* MBEDTLS_ERR_MD2_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** MD2 hardware accelerator failed */ +#define MBEDTLS_ERR_MD2_HW_ACCEL_FAILED -0x002B + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_MD2_ALT) +// Regular implementation +// + +/** + * \brief MD2 context structure + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +typedef struct mbedtls_md2_context +{ + unsigned char cksum[16]; /*!< checksum of the data block */ + unsigned char state[48]; /*!< intermediate digest state */ + unsigned char buffer[16]; /*!< data block being processed */ + size_t left; /*!< amount of data in buffer */ +} +mbedtls_md2_context; + +#else /* MBEDTLS_MD2_ALT */ +#include "md2_alt.h" +#endif /* MBEDTLS_MD2_ALT */ + +/** + * \brief Initialize MD2 context + * + * \param ctx MD2 context to be initialized + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md2_init( mbedtls_md2_context *ctx ); + +/** + * \brief Clear MD2 context + * + * \param ctx MD2 context to be cleared + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md2_free( mbedtls_md2_context *ctx ); + +/** + * \brief Clone (the state of) an MD2 context + * + * \param dst The destination context + * \param src The context to be cloned + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md2_clone( mbedtls_md2_context *dst, + const mbedtls_md2_context *src ); + +/** + * \brief MD2 context setup + * + * \param ctx context to be initialized + * + * \return 0 if successful + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md2_starts_ret( mbedtls_md2_context *ctx ); + +/** + * \brief MD2 process buffer + * + * \param ctx MD2 context + * \param input buffer holding the data + * \param ilen length of the input data + * + * \return 0 if successful + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md2_update_ret( mbedtls_md2_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief MD2 final digest + * + * \param ctx MD2 context + * \param output MD2 checksum result + * + * \return 0 if successful + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md2_finish_ret( mbedtls_md2_context *ctx, + unsigned char output[16] ); + +/** + * \brief MD2 process data block (internal use only) + * + * \param ctx MD2 context + * + * \return 0 if successful + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_internal_md2_process( mbedtls_md2_context *ctx ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief MD2 context setup + * + * \deprecated Superseded by mbedtls_md2_starts_ret() in 2.7.0 + * + * \param ctx context to be initialized + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md2_starts( mbedtls_md2_context *ctx ); + +/** + * \brief MD2 process buffer + * + * \deprecated Superseded by mbedtls_md2_update_ret() in 2.7.0 + * + * \param ctx MD2 context + * \param input buffer holding the data + * \param ilen length of the input data + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md2_update( mbedtls_md2_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief MD2 final digest + * + * \deprecated Superseded by mbedtls_md2_finish_ret() in 2.7.0 + * + * \param ctx MD2 context + * \param output MD2 checksum result + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md2_finish( mbedtls_md2_context *ctx, + unsigned char output[16] ); + +/** + * \brief MD2 process data block (internal use only) + * + * \deprecated Superseded by mbedtls_internal_md2_process() in 2.7.0 + * + * \param ctx MD2 context + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md2_process( mbedtls_md2_context *ctx ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief Output = MD2( input buffer ) + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output MD2 checksum result + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md2_ret( const unsigned char *input, + size_t ilen, + unsigned char output[16] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief Output = MD2( input buffer ) + * + * \deprecated Superseded by mbedtls_md2_ret() in 2.7.0 + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output MD2 checksum result + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md2( const unsigned char *input, + size_t ilen, + unsigned char output[16] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md2_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_md2.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/md4.h b/openharmony/arm64-v8a/include/mbedtls/md4.h new file mode 100644 index 00000000..0238c672 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/md4.h @@ -0,0 +1,310 @@ +/** + * \file md4.h + * + * \brief MD4 message digest algorithm (hash function) + * + * \warning MD4 is considered a weak message digest and its use constitutes a + * security risk. We recommend considering stronger message digests + * instead. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ +#ifndef MBEDTLS_MD4_H +#define MBEDTLS_MD4_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +/* MBEDTLS_ERR_MD4_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** MD4 hardware accelerator failed */ +#define MBEDTLS_ERR_MD4_HW_ACCEL_FAILED -0x002D + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_MD4_ALT) +// Regular implementation +// + +/** + * \brief MD4 context structure + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +typedef struct mbedtls_md4_context +{ + uint32_t total[2]; /*!< number of bytes processed */ + uint32_t state[4]; /*!< intermediate digest state */ + unsigned char buffer[64]; /*!< data block being processed */ +} +mbedtls_md4_context; + +#else /* MBEDTLS_MD4_ALT */ +#include "md4_alt.h" +#endif /* MBEDTLS_MD4_ALT */ + +/** + * \brief Initialize MD4 context + * + * \param ctx MD4 context to be initialized + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md4_init( mbedtls_md4_context *ctx ); + +/** + * \brief Clear MD4 context + * + * \param ctx MD4 context to be cleared + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md4_free( mbedtls_md4_context *ctx ); + +/** + * \brief Clone (the state of) an MD4 context + * + * \param dst The destination context + * \param src The context to be cloned + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md4_clone( mbedtls_md4_context *dst, + const mbedtls_md4_context *src ); + +/** + * \brief MD4 context setup + * + * \param ctx context to be initialized + * + * \return 0 if successful + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + */ +int mbedtls_md4_starts_ret( mbedtls_md4_context *ctx ); + +/** + * \brief MD4 process buffer + * + * \param ctx MD4 context + * \param input buffer holding the data + * \param ilen length of the input data + * + * \return 0 if successful + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md4_update_ret( mbedtls_md4_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief MD4 final digest + * + * \param ctx MD4 context + * \param output MD4 checksum result + * + * \return 0 if successful + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md4_finish_ret( mbedtls_md4_context *ctx, + unsigned char output[16] ); + +/** + * \brief MD4 process data block (internal use only) + * + * \param ctx MD4 context + * \param data buffer holding one block of data + * + * \return 0 if successful + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_internal_md4_process( mbedtls_md4_context *ctx, + const unsigned char data[64] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief MD4 context setup + * + * \deprecated Superseded by mbedtls_md4_starts_ret() in 2.7.0 + * + * \param ctx context to be initialized + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md4_starts( mbedtls_md4_context *ctx ); + +/** + * \brief MD4 process buffer + * + * \deprecated Superseded by mbedtls_md4_update_ret() in 2.7.0 + * + * \param ctx MD4 context + * \param input buffer holding the data + * \param ilen length of the input data + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md4_update( mbedtls_md4_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief MD4 final digest + * + * \deprecated Superseded by mbedtls_md4_finish_ret() in 2.7.0 + * + * \param ctx MD4 context + * \param output MD4 checksum result + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md4_finish( mbedtls_md4_context *ctx, + unsigned char output[16] ); + +/** + * \brief MD4 process data block (internal use only) + * + * \deprecated Superseded by mbedtls_internal_md4_process() in 2.7.0 + * + * \param ctx MD4 context + * \param data buffer holding one block of data + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md4_process( mbedtls_md4_context *ctx, + const unsigned char data[64] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief Output = MD4( input buffer ) + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output MD4 checksum result + * + * \return 0 if successful + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md4_ret( const unsigned char *input, + size_t ilen, + unsigned char output[16] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief Output = MD4( input buffer ) + * + * \deprecated Superseded by mbedtls_md4_ret() in 2.7.0 + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output MD4 checksum result + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md4( const unsigned char *input, + size_t ilen, + unsigned char output[16] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md4_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_md4.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/md5.h b/openharmony/arm64-v8a/include/mbedtls/md5.h new file mode 100644 index 00000000..73e4dd2c --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/md5.h @@ -0,0 +1,310 @@ +/** + * \file md5.h + * + * \brief MD5 message digest algorithm (hash function) + * + * \warning MD5 is considered a weak message digest and its use constitutes a + * security risk. We recommend considering stronger message + * digests instead. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_MD5_H +#define MBEDTLS_MD5_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +/* MBEDTLS_ERR_MD5_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** MD5 hardware accelerator failed */ +#define MBEDTLS_ERR_MD5_HW_ACCEL_FAILED -0x002F + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_MD5_ALT) +// Regular implementation +// + +/** + * \brief MD5 context structure + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +typedef struct mbedtls_md5_context +{ + uint32_t total[2]; /*!< number of bytes processed */ + uint32_t state[4]; /*!< intermediate digest state */ + unsigned char buffer[64]; /*!< data block being processed */ +} +mbedtls_md5_context; + +#else /* MBEDTLS_MD5_ALT */ +#include "md5_alt.h" +#endif /* MBEDTLS_MD5_ALT */ + +/** + * \brief Initialize MD5 context + * + * \param ctx MD5 context to be initialized + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md5_init( mbedtls_md5_context *ctx ); + +/** + * \brief Clear MD5 context + * + * \param ctx MD5 context to be cleared + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md5_free( mbedtls_md5_context *ctx ); + +/** + * \brief Clone (the state of) an MD5 context + * + * \param dst The destination context + * \param src The context to be cloned + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md5_clone( mbedtls_md5_context *dst, + const mbedtls_md5_context *src ); + +/** + * \brief MD5 context setup + * + * \param ctx context to be initialized + * + * \return 0 if successful + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md5_starts_ret( mbedtls_md5_context *ctx ); + +/** + * \brief MD5 process buffer + * + * \param ctx MD5 context + * \param input buffer holding the data + * \param ilen length of the input data + * + * \return 0 if successful + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md5_update_ret( mbedtls_md5_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief MD5 final digest + * + * \param ctx MD5 context + * \param output MD5 checksum result + * + * \return 0 if successful + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md5_finish_ret( mbedtls_md5_context *ctx, + unsigned char output[16] ); + +/** + * \brief MD5 process data block (internal use only) + * + * \param ctx MD5 context + * \param data buffer holding one block of data + * + * \return 0 if successful + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_internal_md5_process( mbedtls_md5_context *ctx, + const unsigned char data[64] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief MD5 context setup + * + * \deprecated Superseded by mbedtls_md5_starts_ret() in 2.7.0 + * + * \param ctx context to be initialized + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md5_starts( mbedtls_md5_context *ctx ); + +/** + * \brief MD5 process buffer + * + * \deprecated Superseded by mbedtls_md5_update_ret() in 2.7.0 + * + * \param ctx MD5 context + * \param input buffer holding the data + * \param ilen length of the input data + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md5_update( mbedtls_md5_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief MD5 final digest + * + * \deprecated Superseded by mbedtls_md5_finish_ret() in 2.7.0 + * + * \param ctx MD5 context + * \param output MD5 checksum result + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md5_finish( mbedtls_md5_context *ctx, + unsigned char output[16] ); + +/** + * \brief MD5 process data block (internal use only) + * + * \deprecated Superseded by mbedtls_internal_md5_process() in 2.7.0 + * + * \param ctx MD5 context + * \param data buffer holding one block of data + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md5_process( mbedtls_md5_context *ctx, + const unsigned char data[64] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief Output = MD5( input buffer ) + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output MD5 checksum result + * + * \return 0 if successful + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md5_ret( const unsigned char *input, + size_t ilen, + unsigned char output[16] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief Output = MD5( input buffer ) + * + * \deprecated Superseded by mbedtls_md5_ret() in 2.7.0 + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output MD5 checksum result + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md5( const unsigned char *input, + size_t ilen, + unsigned char output[16] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md5_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_md5.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/md_internal.h b/openharmony/arm64-v8a/include/mbedtls/md_internal.h new file mode 100644 index 00000000..f33cdf60 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/md_internal.h @@ -0,0 +1,90 @@ +/** + * \file md_internal.h + * + * \brief Message digest wrappers. + * + * \warning This in an internal header. Do not include directly. + * + * \author Adriaan de Jong + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_MD_WRAP_H +#define MBEDTLS_MD_WRAP_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/md.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Message digest information. + * Allows message digest functions to be called in a generic way. + */ +struct mbedtls_md_info_t +{ + /** Name of the message digest */ + const char * name; + + /** Digest identifier */ + mbedtls_md_type_t type; + + /** Output length of the digest function in bytes */ + unsigned char size; + + /** Block length of the digest function in bytes */ + unsigned char block_size; +}; + +#if defined(MBEDTLS_MD2_C) +extern const mbedtls_md_info_t mbedtls_md2_info; +#endif +#if defined(MBEDTLS_MD4_C) +extern const mbedtls_md_info_t mbedtls_md4_info; +#endif +#if defined(MBEDTLS_MD5_C) +extern const mbedtls_md_info_t mbedtls_md5_info; +#endif +#if defined(MBEDTLS_RIPEMD160_C) +extern const mbedtls_md_info_t mbedtls_ripemd160_info; +#endif +#if defined(MBEDTLS_SHA1_C) +extern const mbedtls_md_info_t mbedtls_sha1_info; +#endif +#if defined(MBEDTLS_SHA256_C) +extern const mbedtls_md_info_t mbedtls_sha224_info; +extern const mbedtls_md_info_t mbedtls_sha256_info; +#endif +#if defined(MBEDTLS_SHA512_C) +#if !defined(MBEDTLS_SHA512_NO_SHA384) +extern const mbedtls_md_info_t mbedtls_sha384_info; +#endif +extern const mbedtls_md_info_t mbedtls_sha512_info; +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_MD_WRAP_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/memory_buffer_alloc.h b/openharmony/arm64-v8a/include/mbedtls/memory_buffer_alloc.h new file mode 100644 index 00000000..3954b36a --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/memory_buffer_alloc.h @@ -0,0 +1,149 @@ +/** + * \file memory_buffer_alloc.h + * + * \brief Buffer-based memory allocator + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_MEMORY_BUFFER_ALLOC_H +#define MBEDTLS_MEMORY_BUFFER_ALLOC_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h or define them on the compiler command line. + * \{ + */ + +#if !defined(MBEDTLS_MEMORY_ALIGN_MULTIPLE) +#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 4 /**< Align on multiples of this value */ +#endif + +/** \} name SECTION: Module settings */ + +#define MBEDTLS_MEMORY_VERIFY_NONE 0 +#define MBEDTLS_MEMORY_VERIFY_ALLOC (1 << 0) +#define MBEDTLS_MEMORY_VERIFY_FREE (1 << 1) +#define MBEDTLS_MEMORY_VERIFY_ALWAYS (MBEDTLS_MEMORY_VERIFY_ALLOC | MBEDTLS_MEMORY_VERIFY_FREE) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Initialize use of stack-based memory allocator. + * The stack-based allocator does memory management inside the + * presented buffer and does not call calloc() and free(). + * It sets the global mbedtls_calloc() and mbedtls_free() pointers + * to its own functions. + * (Provided mbedtls_calloc() and mbedtls_free() are thread-safe if + * MBEDTLS_THREADING_C is defined) + * + * \note This code is not optimized and provides a straight-forward + * implementation of a stack-based memory allocator. + * + * \param buf buffer to use as heap + * \param len size of the buffer + */ +void mbedtls_memory_buffer_alloc_init( unsigned char *buf, size_t len ); + +/** + * \brief Free the mutex for thread-safety and clear remaining memory + */ +void mbedtls_memory_buffer_alloc_free( void ); + +/** + * \brief Determine when the allocator should automatically verify the state + * of the entire chain of headers / meta-data. + * (Default: MBEDTLS_MEMORY_VERIFY_NONE) + * + * \param verify One of MBEDTLS_MEMORY_VERIFY_NONE, MBEDTLS_MEMORY_VERIFY_ALLOC, + * MBEDTLS_MEMORY_VERIFY_FREE or MBEDTLS_MEMORY_VERIFY_ALWAYS + */ +void mbedtls_memory_buffer_set_verify( int verify ); + +#if defined(MBEDTLS_MEMORY_DEBUG) +/** + * \brief Print out the status of the allocated memory (primarily for use + * after a program should have de-allocated all memory) + * Prints out a list of 'still allocated' blocks and their stack + * trace if MBEDTLS_MEMORY_BACKTRACE is defined. + */ +void mbedtls_memory_buffer_alloc_status( void ); + +/** + * \brief Get the peak heap usage so far + * + * \param max_used Peak number of bytes in use or committed. This + * includes bytes in allocated blocks too small to split + * into smaller blocks but larger than the requested size. + * \param max_blocks Peak number of blocks in use, including free and used + */ +void mbedtls_memory_buffer_alloc_max_get( size_t *max_used, size_t *max_blocks ); + +/** + * \brief Reset peak statistics + */ +void mbedtls_memory_buffer_alloc_max_reset( void ); + +/** + * \brief Get the current heap usage + * + * \param cur_used Current number of bytes in use or committed. This + * includes bytes in allocated blocks too small to split + * into smaller blocks but larger than the requested size. + * \param cur_blocks Current number of blocks in use, including free and used + */ +void mbedtls_memory_buffer_alloc_cur_get( size_t *cur_used, size_t *cur_blocks ); +#endif /* MBEDTLS_MEMORY_DEBUG */ + +/** + * \brief Verifies that all headers in the memory buffer are correct + * and contain sane values. Helps debug buffer-overflow errors. + * + * Prints out first failure if MBEDTLS_MEMORY_DEBUG is defined. + * Prints out full header information if MBEDTLS_MEMORY_DEBUG + * is defined. (Includes stack trace information for each block if + * MBEDTLS_MEMORY_BACKTRACE is defined as well). + * + * \return 0 if verified, 1 otherwise + */ +int mbedtls_memory_buffer_alloc_verify( void ); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if a test failed + */ +int mbedtls_memory_buffer_alloc_self_test( int verbose ); +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* memory_buffer_alloc.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/net.h b/openharmony/arm64-v8a/include/mbedtls/net.h new file mode 100644 index 00000000..66921887 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/net.h @@ -0,0 +1,35 @@ +/** + * \file net.h + * + * \brief Deprecated header file that includes net_sockets.h + * + * \deprecated Superseded by mbedtls/net_sockets.h + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#include "mbedtls/net_sockets.h" +#if defined(MBEDTLS_DEPRECATED_WARNING) +#warning "Deprecated header file: Superseded by mbedtls/net_sockets.h" +#endif /* MBEDTLS_DEPRECATED_WARNING */ +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ diff --git a/openharmony/arm64-v8a/include/mbedtls/net_sockets.h b/openharmony/arm64-v8a/include/mbedtls/net_sockets.h new file mode 100644 index 00000000..ceb7d5f6 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/net_sockets.h @@ -0,0 +1,301 @@ +/** + * \file net_sockets.h + * + * \brief Network sockets abstraction layer to integrate Mbed TLS into a + * BSD-style sockets API. + * + * The network sockets module provides an example integration of the + * Mbed TLS library into a BSD sockets implementation. The module is + * intended to be an example of how Mbed TLS can be integrated into a + * networking stack, as well as to be Mbed TLS's network integration + * for its supported platforms. + * + * The module is intended only to be used with the Mbed TLS library and + * is not intended to be used by third party application software + * directly. + * + * The supported platforms are as follows: + * * Microsoft Windows and Windows CE + * * POSIX/Unix platforms including Linux, OS X + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_NET_SOCKETS_H +#define MBEDTLS_NET_SOCKETS_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/ssl.h" + +#include +#include + +/** Failed to open a socket. */ +#define MBEDTLS_ERR_NET_SOCKET_FAILED -0x0042 +/** The connection to the given server / port failed. */ +#define MBEDTLS_ERR_NET_CONNECT_FAILED -0x0044 +/** Binding of the socket failed. */ +#define MBEDTLS_ERR_NET_BIND_FAILED -0x0046 +/** Could not listen on the socket. */ +#define MBEDTLS_ERR_NET_LISTEN_FAILED -0x0048 +/** Could not accept the incoming connection. */ +#define MBEDTLS_ERR_NET_ACCEPT_FAILED -0x004A +/** Reading information from the socket failed. */ +#define MBEDTLS_ERR_NET_RECV_FAILED -0x004C +/** Sending information through the socket failed. */ +#define MBEDTLS_ERR_NET_SEND_FAILED -0x004E +/** Connection was reset by peer. */ +#define MBEDTLS_ERR_NET_CONN_RESET -0x0050 +/** Failed to get an IP address for the given hostname. */ +#define MBEDTLS_ERR_NET_UNKNOWN_HOST -0x0052 +/** Buffer is too small to hold the data. */ +#define MBEDTLS_ERR_NET_BUFFER_TOO_SMALL -0x0043 +/** The context is invalid, eg because it was free()ed. */ +#define MBEDTLS_ERR_NET_INVALID_CONTEXT -0x0045 +/** Polling the net context failed. */ +#define MBEDTLS_ERR_NET_POLL_FAILED -0x0047 +/** Input invalid. */ +#define MBEDTLS_ERR_NET_BAD_INPUT_DATA -0x0049 + +#define MBEDTLS_NET_LISTEN_BACKLOG 10 /**< The backlog that listen() should use. */ + +#define MBEDTLS_NET_PROTO_TCP 0 /**< The TCP transport protocol */ +#define MBEDTLS_NET_PROTO_UDP 1 /**< The UDP transport protocol */ + +#define MBEDTLS_NET_POLL_READ 1 /**< Used in \c mbedtls_net_poll to check for pending data */ +#define MBEDTLS_NET_POLL_WRITE 2 /**< Used in \c mbedtls_net_poll to check if write possible */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Wrapper type for sockets. + * + * Currently backed by just a file descriptor, but might be more in the future + * (eg two file descriptors for combined IPv4 + IPv6 support, or additional + * structures for hand-made UDP demultiplexing). + */ +typedef struct mbedtls_net_context +{ + int fd; /**< The underlying file descriptor */ +} +mbedtls_net_context; + +/** + * \brief Initialize a context + * Just makes the context ready to be used or freed safely. + * + * \param ctx Context to initialize + */ +void mbedtls_net_init( mbedtls_net_context *ctx ); + +/** + * \brief Initiate a connection with host:port in the given protocol + * + * \param ctx Socket to use + * \param host Host to connect to + * \param port Port to connect to + * \param proto Protocol: MBEDTLS_NET_PROTO_TCP or MBEDTLS_NET_PROTO_UDP + * + * \return 0 if successful, or one of: + * MBEDTLS_ERR_NET_SOCKET_FAILED, + * MBEDTLS_ERR_NET_UNKNOWN_HOST, + * MBEDTLS_ERR_NET_CONNECT_FAILED + * + * \note Sets the socket in connected mode even with UDP. + */ +int mbedtls_net_connect( mbedtls_net_context *ctx, const char *host, const char *port, int proto ); + +/** + * \brief Create a receiving socket on bind_ip:port in the chosen + * protocol. If bind_ip == NULL, all interfaces are bound. + * + * \param ctx Socket to use + * \param bind_ip IP to bind to, can be NULL + * \param port Port number to use + * \param proto Protocol: MBEDTLS_NET_PROTO_TCP or MBEDTLS_NET_PROTO_UDP + * + * \return 0 if successful, or one of: + * MBEDTLS_ERR_NET_SOCKET_FAILED, + * MBEDTLS_ERR_NET_UNKNOWN_HOST, + * MBEDTLS_ERR_NET_BIND_FAILED, + * MBEDTLS_ERR_NET_LISTEN_FAILED + * + * \note Regardless of the protocol, opens the sockets and binds it. + * In addition, make the socket listening if protocol is TCP. + */ +int mbedtls_net_bind( mbedtls_net_context *ctx, const char *bind_ip, const char *port, int proto ); + +/** + * \brief Accept a connection from a remote client + * + * \param bind_ctx Relevant socket + * \param client_ctx Will contain the connected client socket + * \param client_ip Will contain the client IP address, can be NULL + * \param buf_size Size of the client_ip buffer + * \param ip_len Will receive the size of the client IP written, + * can be NULL if client_ip is null + * + * \return 0 if successful, or + * MBEDTLS_ERR_NET_SOCKET_FAILED, + * MBEDTLS_ERR_NET_BIND_FAILED, + * MBEDTLS_ERR_NET_ACCEPT_FAILED, or + * MBEDTLS_ERR_NET_BUFFER_TOO_SMALL if buf_size is too small, + * MBEDTLS_ERR_SSL_WANT_READ if bind_fd was set to + * non-blocking and accept() would block. + */ +int mbedtls_net_accept( mbedtls_net_context *bind_ctx, + mbedtls_net_context *client_ctx, + void *client_ip, size_t buf_size, size_t *ip_len ); + +/** + * \brief Check and wait for the context to be ready for read/write + * + * \note The current implementation of this function uses + * select() and returns an error if the file descriptor + * is \c FD_SETSIZE or greater. + * + * \param ctx Socket to check + * \param rw Bitflag composed of MBEDTLS_NET_POLL_READ and + * MBEDTLS_NET_POLL_WRITE specifying the events + * to wait for: + * - If MBEDTLS_NET_POLL_READ is set, the function + * will return as soon as the net context is available + * for reading. + * - If MBEDTLS_NET_POLL_WRITE is set, the function + * will return as soon as the net context is available + * for writing. + * \param timeout Maximal amount of time to wait before returning, + * in milliseconds. If \c timeout is zero, the + * function returns immediately. If \c timeout is + * -1u, the function blocks potentially indefinitely. + * + * \return Bitmask composed of MBEDTLS_NET_POLL_READ/WRITE + * on success or timeout, or a negative return code otherwise. + */ +int mbedtls_net_poll( mbedtls_net_context *ctx, uint32_t rw, uint32_t timeout ); + +/** + * \brief Set the socket blocking + * + * \param ctx Socket to set + * + * \return 0 if successful, or a non-zero error code + */ +int mbedtls_net_set_block( mbedtls_net_context *ctx ); + +/** + * \brief Set the socket non-blocking + * + * \param ctx Socket to set + * + * \return 0 if successful, or a non-zero error code + */ +int mbedtls_net_set_nonblock( mbedtls_net_context *ctx ); + +/** + * \brief Portable usleep helper + * + * \param usec Amount of microseconds to sleep + * + * \note Real amount of time slept will not be less than + * select()'s timeout granularity (typically, 10ms). + */ +void mbedtls_net_usleep( unsigned long usec ); + +/** + * \brief Read at most 'len' characters. If no error occurs, + * the actual amount read is returned. + * + * \param ctx Socket + * \param buf The buffer to write to + * \param len Maximum length of the buffer + * + * \return the number of bytes received, + * or a non-zero error code; with a non-blocking socket, + * MBEDTLS_ERR_SSL_WANT_READ indicates read() would block. + */ +int mbedtls_net_recv( void *ctx, unsigned char *buf, size_t len ); + +/** + * \brief Write at most 'len' characters. If no error occurs, + * the actual amount read is returned. + * + * \param ctx Socket + * \param buf The buffer to read from + * \param len The length of the buffer + * + * \return the number of bytes sent, + * or a non-zero error code; with a non-blocking socket, + * MBEDTLS_ERR_SSL_WANT_WRITE indicates write() would block. + */ +int mbedtls_net_send( void *ctx, const unsigned char *buf, size_t len ); + +/** + * \brief Read at most 'len' characters, blocking for at most + * 'timeout' seconds. If no error occurs, the actual amount + * read is returned. + * + * \note The current implementation of this function uses + * select() and returns an error if the file descriptor + * is \c FD_SETSIZE or greater. + * + * \param ctx Socket + * \param buf The buffer to write to + * \param len Maximum length of the buffer + * \param timeout Maximum number of milliseconds to wait for data + * 0 means no timeout (wait forever) + * + * \return The number of bytes received if successful. + * MBEDTLS_ERR_SSL_TIMEOUT if the operation timed out. + * MBEDTLS_ERR_SSL_WANT_READ if interrupted by a signal. + * Another negative error code (MBEDTLS_ERR_NET_xxx) + * for other failures. + * + * \note This function will block (until data becomes available or + * timeout is reached) even if the socket is set to + * non-blocking. Handling timeouts with non-blocking reads + * requires a different strategy. + */ +int mbedtls_net_recv_timeout( void *ctx, unsigned char *buf, size_t len, + uint32_t timeout ); + +/** + * \brief Closes down the connection and free associated data + * + * \param ctx The context to close + */ +void mbedtls_net_close( mbedtls_net_context *ctx ); + +/** + * \brief Gracefully shutdown the connection and free associated data + * + * \param ctx The context to free + */ +void mbedtls_net_free( mbedtls_net_context *ctx ); + +#ifdef __cplusplus +} +#endif + +#endif /* net_sockets.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/nist_kw.h b/openharmony/arm64-v8a/include/mbedtls/nist_kw.h new file mode 100644 index 00000000..7f3e64a5 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/nist_kw.h @@ -0,0 +1,182 @@ +/** + * \file nist_kw.h + * + * \brief This file provides an API for key wrapping (KW) and key wrapping with + * padding (KWP) as defined in NIST SP 800-38F. + * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf + * + * Key wrapping specifies a deterministic authenticated-encryption mode + * of operation, according to NIST SP 800-38F: Recommendation for + * Block Cipher Modes of Operation: Methods for Key Wrapping. Its + * purpose is to protect cryptographic keys. + * + * Its equivalent is RFC 3394 for KW, and RFC 5649 for KWP. + * https://tools.ietf.org/html/rfc3394 + * https://tools.ietf.org/html/rfc5649 + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_NIST_KW_H +#define MBEDTLS_NIST_KW_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/cipher.h" + +#ifdef __cplusplus +extern "C" { +#endif + +typedef enum +{ + MBEDTLS_KW_MODE_KW = 0, + MBEDTLS_KW_MODE_KWP = 1 +} mbedtls_nist_kw_mode_t; + +#if !defined(MBEDTLS_NIST_KW_ALT) +// Regular implementation +// + +/** + * \brief The key wrapping context-type definition. The key wrapping context is passed + * to the APIs called. + * + * \note The definition of this type may change in future library versions. + * Don't make any assumptions on this context! + */ +typedef struct { + mbedtls_cipher_context_t cipher_ctx; /*!< The cipher context used. */ +} mbedtls_nist_kw_context; + +#else /* MBEDTLS_NIST_key wrapping_ALT */ +#include "nist_kw_alt.h" +#endif /* MBEDTLS_NIST_KW_ALT */ + +/** + * \brief This function initializes the specified key wrapping context + * to make references valid and prepare the context + * for mbedtls_nist_kw_setkey() or mbedtls_nist_kw_free(). + * + * \param ctx The key wrapping context to initialize. + * + */ +void mbedtls_nist_kw_init( mbedtls_nist_kw_context *ctx ); + +/** + * \brief This function initializes the key wrapping context set in the + * \p ctx parameter and sets the encryption key. + * + * \param ctx The key wrapping context. + * \param cipher The 128-bit block cipher to use. Only AES is supported. + * \param key The Key Encryption Key (KEK). + * \param keybits The KEK size in bits. This must be acceptable by the cipher. + * \param is_wrap Specify whether the operation within the context is wrapping or unwrapping + * + * \return \c 0 on success. + * \return \c MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA for any invalid input. + * \return \c MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE for 128-bit block ciphers + * which are not supported. + * \return cipher-specific error code on failure of the underlying cipher. + */ +int mbedtls_nist_kw_setkey( mbedtls_nist_kw_context *ctx, + mbedtls_cipher_id_t cipher, + const unsigned char *key, + unsigned int keybits, + const int is_wrap ); + +/** + * \brief This function releases and clears the specified key wrapping context + * and underlying cipher sub-context. + * + * \param ctx The key wrapping context to clear. + */ +void mbedtls_nist_kw_free( mbedtls_nist_kw_context *ctx ); + +/** + * \brief This function encrypts a buffer using key wrapping. + * + * \param ctx The key wrapping context to use for encryption. + * \param mode The key wrapping mode to use (MBEDTLS_KW_MODE_KW or MBEDTLS_KW_MODE_KWP) + * \param input The buffer holding the input data. + * \param in_len The length of the input data in Bytes. + * The input uses units of 8 Bytes called semiblocks. + *
  • For KW mode: a multiple of 8 bytes between 16 and 2^57-8 inclusive.
    • + *
  • For KWP mode: any length between 1 and 2^32-1 inclusive.
+ * \param[out] output The buffer holding the output data. + *
  • For KW mode: Must be at least 8 bytes larger than \p in_len.
    • + *
  • For KWP mode: Must be at least 8 bytes larger rounded up to a multiple of + * 8 bytes for KWP (15 bytes at most).
+ * \param[out] out_len The number of bytes written to the output buffer. \c 0 on failure. + * \param[in] out_size The capacity of the output buffer. + * + * \return \c 0 on success. + * \return \c MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA for invalid input length. + * \return cipher-specific error code on failure of the underlying cipher. + */ +int mbedtls_nist_kw_wrap( mbedtls_nist_kw_context *ctx, mbedtls_nist_kw_mode_t mode, + const unsigned char *input, size_t in_len, + unsigned char *output, size_t* out_len, size_t out_size ); + +/** + * \brief This function decrypts a buffer using key wrapping. + * + * \param ctx The key wrapping context to use for decryption. + * \param mode The key wrapping mode to use (MBEDTLS_KW_MODE_KW or MBEDTLS_KW_MODE_KWP) + * \param input The buffer holding the input data. + * \param in_len The length of the input data in Bytes. + * The input uses units of 8 Bytes called semiblocks. + * The input must be a multiple of semiblocks. + *
  • For KW mode: a multiple of 8 bytes between 24 and 2^57 inclusive.
    • + *
  • For KWP mode: a multiple of 8 bytes between 16 and 2^32 inclusive.
+ * \param[out] output The buffer holding the output data. + * The output buffer's minimal length is 8 bytes shorter than \p in_len. + * \param[out] out_len The number of bytes written to the output buffer. \c 0 on failure. + * For KWP mode, the length could be up to 15 bytes shorter than \p in_len, + * depending on how much padding was added to the data. + * \param[in] out_size The capacity of the output buffer. + * + * \return \c 0 on success. + * \return \c MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA for invalid input length. + * \return \c MBEDTLS_ERR_CIPHER_AUTH_FAILED for verification failure of the ciphertext. + * \return cipher-specific error code on failure of the underlying cipher. + */ +int mbedtls_nist_kw_unwrap( mbedtls_nist_kw_context *ctx, mbedtls_nist_kw_mode_t mode, + const unsigned char *input, size_t in_len, + unsigned char *output, size_t* out_len, size_t out_size); + + +#if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_AES_C) +/** + * \brief The key wrapping checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_nist_kw_self_test( int verbose ); +#endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_NIST_KW_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/oid.h b/openharmony/arm64-v8a/include/mbedtls/oid.h new file mode 100644 index 00000000..01862178 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/oid.h @@ -0,0 +1,649 @@ +/** + * \file oid.h + * + * \brief Object Identifier (OID) database + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_OID_H +#define MBEDTLS_OID_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/asn1.h" +#include "mbedtls/pk.h" + +#include + +#if defined(MBEDTLS_CIPHER_C) +#include "mbedtls/cipher.h" +#endif + +#if defined(MBEDTLS_MD_C) +#include "mbedtls/md.h" +#endif + +/** OID is not found. */ +#define MBEDTLS_ERR_OID_NOT_FOUND -0x002E +/** output buffer is too small */ +#define MBEDTLS_ERR_OID_BUF_TOO_SMALL -0x000B + +/* This is for the benefit of X.509, but defined here in order to avoid + * having a "backwards" include of x.509.h here */ +/* + * X.509 extension types (internal, arbitrary values for bitsets) + */ +#define MBEDTLS_OID_X509_EXT_AUTHORITY_KEY_IDENTIFIER (1 << 0) +#define MBEDTLS_OID_X509_EXT_SUBJECT_KEY_IDENTIFIER (1 << 1) +#define MBEDTLS_OID_X509_EXT_KEY_USAGE (1 << 2) +#define MBEDTLS_OID_X509_EXT_CERTIFICATE_POLICIES (1 << 3) +#define MBEDTLS_OID_X509_EXT_POLICY_MAPPINGS (1 << 4) +#define MBEDTLS_OID_X509_EXT_SUBJECT_ALT_NAME (1 << 5) +#define MBEDTLS_OID_X509_EXT_ISSUER_ALT_NAME (1 << 6) +#define MBEDTLS_OID_X509_EXT_SUBJECT_DIRECTORY_ATTRS (1 << 7) +#define MBEDTLS_OID_X509_EXT_BASIC_CONSTRAINTS (1 << 8) +#define MBEDTLS_OID_X509_EXT_NAME_CONSTRAINTS (1 << 9) +#define MBEDTLS_OID_X509_EXT_POLICY_CONSTRAINTS (1 << 10) +#define MBEDTLS_OID_X509_EXT_EXTENDED_KEY_USAGE (1 << 11) +#define MBEDTLS_OID_X509_EXT_CRL_DISTRIBUTION_POINTS (1 << 12) +#define MBEDTLS_OID_X509_EXT_INIHIBIT_ANYPOLICY (1 << 13) +#define MBEDTLS_OID_X509_EXT_FRESHEST_CRL (1 << 14) +#define MBEDTLS_OID_X509_EXT_NS_CERT_TYPE (1 << 16) + +/* + * Top level OID tuples + */ +#define MBEDTLS_OID_ISO_MEMBER_BODIES "\x2a" /* {iso(1) member-body(2)} */ +#define MBEDTLS_OID_ISO_IDENTIFIED_ORG "\x2b" /* {iso(1) identified-organization(3)} */ +#define MBEDTLS_OID_ISO_CCITT_DS "\x55" /* {joint-iso-ccitt(2) ds(5)} */ +#define MBEDTLS_OID_ISO_ITU_COUNTRY "\x60" /* {joint-iso-itu-t(2) country(16)} */ + +/* + * ISO Member bodies OID parts + */ +#define MBEDTLS_OID_COUNTRY_US "\x86\x48" /* {us(840)} */ +#define MBEDTLS_OID_ORG_RSA_DATA_SECURITY "\x86\xf7\x0d" /* {rsadsi(113549)} */ +#define MBEDTLS_OID_RSA_COMPANY MBEDTLS_OID_ISO_MEMBER_BODIES MBEDTLS_OID_COUNTRY_US \ + MBEDTLS_OID_ORG_RSA_DATA_SECURITY /* {iso(1) member-body(2) us(840) rsadsi(113549)} */ +#define MBEDTLS_OID_ORG_ANSI_X9_62 "\xce\x3d" /* ansi-X9-62(10045) */ +#define MBEDTLS_OID_ANSI_X9_62 MBEDTLS_OID_ISO_MEMBER_BODIES MBEDTLS_OID_COUNTRY_US \ + MBEDTLS_OID_ORG_ANSI_X9_62 + +/* + * ISO Identified organization OID parts + */ +#define MBEDTLS_OID_ORG_DOD "\x06" /* {dod(6)} */ +#define MBEDTLS_OID_ORG_OIW "\x0e" +#define MBEDTLS_OID_OIW_SECSIG MBEDTLS_OID_ORG_OIW "\x03" +#define MBEDTLS_OID_OIW_SECSIG_ALG MBEDTLS_OID_OIW_SECSIG "\x02" +#define MBEDTLS_OID_OIW_SECSIG_SHA1 MBEDTLS_OID_OIW_SECSIG_ALG "\x1a" +#define MBEDTLS_OID_ORG_CERTICOM "\x81\x04" /* certicom(132) */ +#define MBEDTLS_OID_CERTICOM MBEDTLS_OID_ISO_IDENTIFIED_ORG MBEDTLS_OID_ORG_CERTICOM +#define MBEDTLS_OID_ORG_TELETRUST "\x24" /* teletrust(36) */ +#define MBEDTLS_OID_TELETRUST MBEDTLS_OID_ISO_IDENTIFIED_ORG MBEDTLS_OID_ORG_TELETRUST + +/* + * ISO ITU OID parts + */ +#define MBEDTLS_OID_ORGANIZATION "\x01" /* {organization(1)} */ +#define MBEDTLS_OID_ISO_ITU_US_ORG MBEDTLS_OID_ISO_ITU_COUNTRY MBEDTLS_OID_COUNTRY_US MBEDTLS_OID_ORGANIZATION /* {joint-iso-itu-t(2) country(16) us(840) organization(1)} */ + +#define MBEDTLS_OID_ORG_GOV "\x65" /* {gov(101)} */ +#define MBEDTLS_OID_GOV MBEDTLS_OID_ISO_ITU_US_ORG MBEDTLS_OID_ORG_GOV /* {joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101)} */ + +#define MBEDTLS_OID_ORG_NETSCAPE "\x86\xF8\x42" /* {netscape(113730)} */ +#define MBEDTLS_OID_NETSCAPE MBEDTLS_OID_ISO_ITU_US_ORG MBEDTLS_OID_ORG_NETSCAPE /* Netscape OID {joint-iso-itu-t(2) country(16) us(840) organization(1) netscape(113730)} */ + +/* ISO arc for standard certificate and CRL extensions */ +#define MBEDTLS_OID_ID_CE MBEDTLS_OID_ISO_CCITT_DS "\x1D" /**< id-ce OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 29} */ + +#define MBEDTLS_OID_NIST_ALG MBEDTLS_OID_GOV "\x03\x04" /** { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithm(4) */ + +/** + * Private Internet Extensions + * { iso(1) identified-organization(3) dod(6) internet(1) + * security(5) mechanisms(5) pkix(7) } + */ +#define MBEDTLS_OID_INTERNET MBEDTLS_OID_ISO_IDENTIFIED_ORG MBEDTLS_OID_ORG_DOD "\x01" +#define MBEDTLS_OID_PKIX MBEDTLS_OID_INTERNET "\x05\x05\x07" + +/* + * Arc for standard naming attributes + */ +#define MBEDTLS_OID_AT MBEDTLS_OID_ISO_CCITT_DS "\x04" /**< id-at OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 4} */ +#define MBEDTLS_OID_AT_CN MBEDTLS_OID_AT "\x03" /**< id-at-commonName AttributeType:= {id-at 3} */ +#define MBEDTLS_OID_AT_SUR_NAME MBEDTLS_OID_AT "\x04" /**< id-at-surName AttributeType:= {id-at 4} */ +#define MBEDTLS_OID_AT_SERIAL_NUMBER MBEDTLS_OID_AT "\x05" /**< id-at-serialNumber AttributeType:= {id-at 5} */ +#define MBEDTLS_OID_AT_COUNTRY MBEDTLS_OID_AT "\x06" /**< id-at-countryName AttributeType:= {id-at 6} */ +#define MBEDTLS_OID_AT_LOCALITY MBEDTLS_OID_AT "\x07" /**< id-at-locality AttributeType:= {id-at 7} */ +#define MBEDTLS_OID_AT_STATE MBEDTLS_OID_AT "\x08" /**< id-at-state AttributeType:= {id-at 8} */ +#define MBEDTLS_OID_AT_ORGANIZATION MBEDTLS_OID_AT "\x0A" /**< id-at-organizationName AttributeType:= {id-at 10} */ +#define MBEDTLS_OID_AT_ORG_UNIT MBEDTLS_OID_AT "\x0B" /**< id-at-organizationalUnitName AttributeType:= {id-at 11} */ +#define MBEDTLS_OID_AT_TITLE MBEDTLS_OID_AT "\x0C" /**< id-at-title AttributeType:= {id-at 12} */ +#define MBEDTLS_OID_AT_POSTAL_ADDRESS MBEDTLS_OID_AT "\x10" /**< id-at-postalAddress AttributeType:= {id-at 16} */ +#define MBEDTLS_OID_AT_POSTAL_CODE MBEDTLS_OID_AT "\x11" /**< id-at-postalCode AttributeType:= {id-at 17} */ +#define MBEDTLS_OID_AT_GIVEN_NAME MBEDTLS_OID_AT "\x2A" /**< id-at-givenName AttributeType:= {id-at 42} */ +#define MBEDTLS_OID_AT_INITIALS MBEDTLS_OID_AT "\x2B" /**< id-at-initials AttributeType:= {id-at 43} */ +#define MBEDTLS_OID_AT_GENERATION_QUALIFIER MBEDTLS_OID_AT "\x2C" /**< id-at-generationQualifier AttributeType:= {id-at 44} */ +#define MBEDTLS_OID_AT_UNIQUE_IDENTIFIER MBEDTLS_OID_AT "\x2D" /**< id-at-uniqueIdentifier AttributeType:= {id-at 45} */ +#define MBEDTLS_OID_AT_DN_QUALIFIER MBEDTLS_OID_AT "\x2E" /**< id-at-dnQualifier AttributeType:= {id-at 46} */ +#define MBEDTLS_OID_AT_PSEUDONYM MBEDTLS_OID_AT "\x41" /**< id-at-pseudonym AttributeType:= {id-at 65} */ + +#define MBEDTLS_OID_DOMAIN_COMPONENT "\x09\x92\x26\x89\x93\xF2\x2C\x64\x01\x19" /** id-domainComponent AttributeType:= {itu-t(0) data(9) pss(2342) ucl(19200300) pilot(100) pilotAttributeType(1) domainComponent(25)} */ + +/* + * OIDs for standard certificate extensions + */ +#define MBEDTLS_OID_AUTHORITY_KEY_IDENTIFIER MBEDTLS_OID_ID_CE "\x23" /**< id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 35 } */ +#define MBEDTLS_OID_SUBJECT_KEY_IDENTIFIER MBEDTLS_OID_ID_CE "\x0E" /**< id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 14 } */ +#define MBEDTLS_OID_KEY_USAGE MBEDTLS_OID_ID_CE "\x0F" /**< id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 } */ +#define MBEDTLS_OID_CERTIFICATE_POLICIES MBEDTLS_OID_ID_CE "\x20" /**< id-ce-certificatePolicies OBJECT IDENTIFIER ::= { id-ce 32 } */ +#define MBEDTLS_OID_POLICY_MAPPINGS MBEDTLS_OID_ID_CE "\x21" /**< id-ce-policyMappings OBJECT IDENTIFIER ::= { id-ce 33 } */ +#define MBEDTLS_OID_SUBJECT_ALT_NAME MBEDTLS_OID_ID_CE "\x11" /**< id-ce-subjectAltName OBJECT IDENTIFIER ::= { id-ce 17 } */ +#define MBEDTLS_OID_ISSUER_ALT_NAME MBEDTLS_OID_ID_CE "\x12" /**< id-ce-issuerAltName OBJECT IDENTIFIER ::= { id-ce 18 } */ +#define MBEDTLS_OID_SUBJECT_DIRECTORY_ATTRS MBEDTLS_OID_ID_CE "\x09" /**< id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= { id-ce 9 } */ +#define MBEDTLS_OID_BASIC_CONSTRAINTS MBEDTLS_OID_ID_CE "\x13" /**< id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 } */ +#define MBEDTLS_OID_NAME_CONSTRAINTS MBEDTLS_OID_ID_CE "\x1E" /**< id-ce-nameConstraints OBJECT IDENTIFIER ::= { id-ce 30 } */ +#define MBEDTLS_OID_POLICY_CONSTRAINTS MBEDTLS_OID_ID_CE "\x24" /**< id-ce-policyConstraints OBJECT IDENTIFIER ::= { id-ce 36 } */ +#define MBEDTLS_OID_EXTENDED_KEY_USAGE MBEDTLS_OID_ID_CE "\x25" /**< id-ce-extKeyUsage OBJECT IDENTIFIER ::= { id-ce 37 } */ +#define MBEDTLS_OID_CRL_DISTRIBUTION_POINTS MBEDTLS_OID_ID_CE "\x1F" /**< id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= { id-ce 31 } */ +#define MBEDTLS_OID_INIHIBIT_ANYPOLICY MBEDTLS_OID_ID_CE "\x36" /**< id-ce-inhibitAnyPolicy OBJECT IDENTIFIER ::= { id-ce 54 } */ +#define MBEDTLS_OID_FRESHEST_CRL MBEDTLS_OID_ID_CE "\x2E" /**< id-ce-freshestCRL OBJECT IDENTIFIER ::= { id-ce 46 } */ + +/* + * Certificate policies + */ +#define MBEDTLS_OID_ANY_POLICY MBEDTLS_OID_CERTIFICATE_POLICIES "\x00" /**< anyPolicy OBJECT IDENTIFIER ::= { id-ce-certificatePolicies 0 } */ + +/* + * Netscape certificate extensions + */ +#define MBEDTLS_OID_NS_CERT MBEDTLS_OID_NETSCAPE "\x01" +#define MBEDTLS_OID_NS_CERT_TYPE MBEDTLS_OID_NS_CERT "\x01" +#define MBEDTLS_OID_NS_BASE_URL MBEDTLS_OID_NS_CERT "\x02" +#define MBEDTLS_OID_NS_REVOCATION_URL MBEDTLS_OID_NS_CERT "\x03" +#define MBEDTLS_OID_NS_CA_REVOCATION_URL MBEDTLS_OID_NS_CERT "\x04" +#define MBEDTLS_OID_NS_RENEWAL_URL MBEDTLS_OID_NS_CERT "\x07" +#define MBEDTLS_OID_NS_CA_POLICY_URL MBEDTLS_OID_NS_CERT "\x08" +#define MBEDTLS_OID_NS_SSL_SERVER_NAME MBEDTLS_OID_NS_CERT "\x0C" +#define MBEDTLS_OID_NS_COMMENT MBEDTLS_OID_NS_CERT "\x0D" +#define MBEDTLS_OID_NS_DATA_TYPE MBEDTLS_OID_NETSCAPE "\x02" +#define MBEDTLS_OID_NS_CERT_SEQUENCE MBEDTLS_OID_NS_DATA_TYPE "\x05" + +/* + * OIDs for CRL extensions + */ +#define MBEDTLS_OID_PRIVATE_KEY_USAGE_PERIOD MBEDTLS_OID_ID_CE "\x10" +#define MBEDTLS_OID_CRL_NUMBER MBEDTLS_OID_ID_CE "\x14" /**< id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 } */ + +/* + * X.509 v3 Extended key usage OIDs + */ +#define MBEDTLS_OID_ANY_EXTENDED_KEY_USAGE MBEDTLS_OID_EXTENDED_KEY_USAGE "\x00" /**< anyExtendedKeyUsage OBJECT IDENTIFIER ::= { id-ce-extKeyUsage 0 } */ + +#define MBEDTLS_OID_KP MBEDTLS_OID_PKIX "\x03" /**< id-kp OBJECT IDENTIFIER ::= { id-pkix 3 } */ +#define MBEDTLS_OID_SERVER_AUTH MBEDTLS_OID_KP "\x01" /**< id-kp-serverAuth OBJECT IDENTIFIER ::= { id-kp 1 } */ +#define MBEDTLS_OID_CLIENT_AUTH MBEDTLS_OID_KP "\x02" /**< id-kp-clientAuth OBJECT IDENTIFIER ::= { id-kp 2 } */ +#define MBEDTLS_OID_CODE_SIGNING MBEDTLS_OID_KP "\x03" /**< id-kp-codeSigning OBJECT IDENTIFIER ::= { id-kp 3 } */ +#define MBEDTLS_OID_EMAIL_PROTECTION MBEDTLS_OID_KP "\x04" /**< id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 } */ +#define MBEDTLS_OID_TIME_STAMPING MBEDTLS_OID_KP "\x08" /**< id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 } */ +#define MBEDTLS_OID_OCSP_SIGNING MBEDTLS_OID_KP "\x09" /**< id-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-kp 9 } */ + +/** + * Wi-SUN Alliance Field Area Network + * { iso(1) identified-organization(3) dod(6) internet(1) + * private(4) enterprise(1) WiSUN(45605) FieldAreaNetwork(1) } + */ +#define MBEDTLS_OID_WISUN_FAN MBEDTLS_OID_INTERNET "\x04\x01\x82\xe4\x25\x01" + +#define MBEDTLS_OID_ON MBEDTLS_OID_PKIX "\x08" /**< id-on OBJECT IDENTIFIER ::= { id-pkix 8 } */ +#define MBEDTLS_OID_ON_HW_MODULE_NAME MBEDTLS_OID_ON "\x04" /**< id-on-hardwareModuleName OBJECT IDENTIFIER ::= { id-on 4 } */ + +/* + * PKCS definition OIDs + */ + +#define MBEDTLS_OID_PKCS MBEDTLS_OID_RSA_COMPANY "\x01" /**< pkcs OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) 1 } */ +#define MBEDTLS_OID_PKCS1 MBEDTLS_OID_PKCS "\x01" /**< pkcs-1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1 } */ +#define MBEDTLS_OID_PKCS5 MBEDTLS_OID_PKCS "\x05" /**< pkcs-5 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 5 } */ +#define MBEDTLS_OID_PKCS9 MBEDTLS_OID_PKCS "\x09" /**< pkcs-9 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 9 } */ +#define MBEDTLS_OID_PKCS12 MBEDTLS_OID_PKCS "\x0c" /**< pkcs-12 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 12 } */ + +/* + * PKCS#1 OIDs + */ +#define MBEDTLS_OID_PKCS1_RSA MBEDTLS_OID_PKCS1 "\x01" /**< rsaEncryption OBJECT IDENTIFIER ::= { pkcs-1 1 } */ +#define MBEDTLS_OID_PKCS1_MD2 MBEDTLS_OID_PKCS1 "\x02" /**< md2WithRSAEncryption ::= { pkcs-1 2 } */ +#define MBEDTLS_OID_PKCS1_MD4 MBEDTLS_OID_PKCS1 "\x03" /**< md4WithRSAEncryption ::= { pkcs-1 3 } */ +#define MBEDTLS_OID_PKCS1_MD5 MBEDTLS_OID_PKCS1 "\x04" /**< md5WithRSAEncryption ::= { pkcs-1 4 } */ +#define MBEDTLS_OID_PKCS1_SHA1 MBEDTLS_OID_PKCS1 "\x05" /**< sha1WithRSAEncryption ::= { pkcs-1 5 } */ +#define MBEDTLS_OID_PKCS1_SHA224 MBEDTLS_OID_PKCS1 "\x0e" /**< sha224WithRSAEncryption ::= { pkcs-1 14 } */ +#define MBEDTLS_OID_PKCS1_SHA256 MBEDTLS_OID_PKCS1 "\x0b" /**< sha256WithRSAEncryption ::= { pkcs-1 11 } */ +#define MBEDTLS_OID_PKCS1_SHA384 MBEDTLS_OID_PKCS1 "\x0c" /**< sha384WithRSAEncryption ::= { pkcs-1 12 } */ +#define MBEDTLS_OID_PKCS1_SHA512 MBEDTLS_OID_PKCS1 "\x0d" /**< sha512WithRSAEncryption ::= { pkcs-1 13 } */ + +#define MBEDTLS_OID_RSA_SHA_OBS "\x2B\x0E\x03\x02\x1D" + +#define MBEDTLS_OID_PKCS9_EMAIL MBEDTLS_OID_PKCS9 "\x01" /**< emailAddress AttributeType ::= { pkcs-9 1 } */ + +/* RFC 4055 */ +#define MBEDTLS_OID_RSASSA_PSS MBEDTLS_OID_PKCS1 "\x0a" /**< id-RSASSA-PSS ::= { pkcs-1 10 } */ +#define MBEDTLS_OID_MGF1 MBEDTLS_OID_PKCS1 "\x08" /**< id-mgf1 ::= { pkcs-1 8 } */ + +/* + * Digest algorithms + */ +#define MBEDTLS_OID_DIGEST_ALG_MD2 MBEDTLS_OID_RSA_COMPANY "\x02\x02" /**< id-mbedtls_md2 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 2 } */ +#define MBEDTLS_OID_DIGEST_ALG_MD4 MBEDTLS_OID_RSA_COMPANY "\x02\x04" /**< id-mbedtls_md4 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 4 } */ +#define MBEDTLS_OID_DIGEST_ALG_MD5 MBEDTLS_OID_RSA_COMPANY "\x02\x05" /**< id-mbedtls_md5 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 5 } */ +#define MBEDTLS_OID_DIGEST_ALG_SHA1 MBEDTLS_OID_ISO_IDENTIFIED_ORG MBEDTLS_OID_OIW_SECSIG_SHA1 /**< id-mbedtls_sha1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) oiw(14) secsig(3) algorithms(2) 26 } */ +#define MBEDTLS_OID_DIGEST_ALG_SHA224 MBEDTLS_OID_NIST_ALG "\x02\x04" /**< id-sha224 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 4 } */ +#define MBEDTLS_OID_DIGEST_ALG_SHA256 MBEDTLS_OID_NIST_ALG "\x02\x01" /**< id-mbedtls_sha256 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 1 } */ + +#define MBEDTLS_OID_DIGEST_ALG_SHA384 MBEDTLS_OID_NIST_ALG "\x02\x02" /**< id-sha384 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 2 } */ + +#define MBEDTLS_OID_DIGEST_ALG_SHA512 MBEDTLS_OID_NIST_ALG "\x02\x03" /**< id-mbedtls_sha512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 3 } */ + +#define MBEDTLS_OID_DIGEST_ALG_RIPEMD160 MBEDTLS_OID_TELETRUST "\x03\x02\x01" /**< id-ripemd160 OBJECT IDENTIFIER :: { iso(1) identified-organization(3) teletrust(36) algorithm(3) hashAlgorithm(2) ripemd160(1) } */ + +#define MBEDTLS_OID_HMAC_SHA1 MBEDTLS_OID_RSA_COMPANY "\x02\x07" /**< id-hmacWithSHA1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 7 } */ + +#define MBEDTLS_OID_HMAC_SHA224 MBEDTLS_OID_RSA_COMPANY "\x02\x08" /**< id-hmacWithSHA224 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 8 } */ + +#define MBEDTLS_OID_HMAC_SHA256 MBEDTLS_OID_RSA_COMPANY "\x02\x09" /**< id-hmacWithSHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 9 } */ + +#define MBEDTLS_OID_HMAC_SHA384 MBEDTLS_OID_RSA_COMPANY "\x02\x0A" /**< id-hmacWithSHA384 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 10 } */ + +#define MBEDTLS_OID_HMAC_SHA512 MBEDTLS_OID_RSA_COMPANY "\x02\x0B" /**< id-hmacWithSHA512 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 11 } */ + +/* + * Encryption algorithms + */ +#define MBEDTLS_OID_DES_CBC MBEDTLS_OID_ISO_IDENTIFIED_ORG MBEDTLS_OID_OIW_SECSIG_ALG "\x07" /**< desCBC OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) oiw(14) secsig(3) algorithms(2) 7 } */ +#define MBEDTLS_OID_DES_EDE3_CBC MBEDTLS_OID_RSA_COMPANY "\x03\x07" /**< des-ede3-cbc OBJECT IDENTIFIER ::= { iso(1) member-body(2) -- us(840) rsadsi(113549) encryptionAlgorithm(3) 7 } */ +#define MBEDTLS_OID_AES MBEDTLS_OID_NIST_ALG "\x01" /** aes OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithm(4) 1 } */ + +/* + * Key Wrapping algorithms + */ +/* + * RFC 5649 + */ +#define MBEDTLS_OID_AES128_KW MBEDTLS_OID_AES "\x05" /** id-aes128-wrap OBJECT IDENTIFIER ::= { aes 5 } */ +#define MBEDTLS_OID_AES128_KWP MBEDTLS_OID_AES "\x08" /** id-aes128-wrap-pad OBJECT IDENTIFIER ::= { aes 8 } */ +#define MBEDTLS_OID_AES192_KW MBEDTLS_OID_AES "\x19" /** id-aes192-wrap OBJECT IDENTIFIER ::= { aes 25 } */ +#define MBEDTLS_OID_AES192_KWP MBEDTLS_OID_AES "\x1c" /** id-aes192-wrap-pad OBJECT IDENTIFIER ::= { aes 28 } */ +#define MBEDTLS_OID_AES256_KW MBEDTLS_OID_AES "\x2d" /** id-aes256-wrap OBJECT IDENTIFIER ::= { aes 45 } */ +#define MBEDTLS_OID_AES256_KWP MBEDTLS_OID_AES "\x30" /** id-aes256-wrap-pad OBJECT IDENTIFIER ::= { aes 48 } */ +/* + * PKCS#5 OIDs + */ +#define MBEDTLS_OID_PKCS5_PBKDF2 MBEDTLS_OID_PKCS5 "\x0c" /**< id-PBKDF2 OBJECT IDENTIFIER ::= {pkcs-5 12} */ +#define MBEDTLS_OID_PKCS5_PBES2 MBEDTLS_OID_PKCS5 "\x0d" /**< id-PBES2 OBJECT IDENTIFIER ::= {pkcs-5 13} */ +#define MBEDTLS_OID_PKCS5_PBMAC1 MBEDTLS_OID_PKCS5 "\x0e" /**< id-PBMAC1 OBJECT IDENTIFIER ::= {pkcs-5 14} */ + +/* + * PKCS#5 PBES1 algorithms + */ +#define MBEDTLS_OID_PKCS5_PBE_MD2_DES_CBC MBEDTLS_OID_PKCS5 "\x01" /**< pbeWithMD2AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 1} */ +#define MBEDTLS_OID_PKCS5_PBE_MD2_RC2_CBC MBEDTLS_OID_PKCS5 "\x04" /**< pbeWithMD2AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 4} */ +#define MBEDTLS_OID_PKCS5_PBE_MD5_DES_CBC MBEDTLS_OID_PKCS5 "\x03" /**< pbeWithMD5AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 3} */ +#define MBEDTLS_OID_PKCS5_PBE_MD5_RC2_CBC MBEDTLS_OID_PKCS5 "\x06" /**< pbeWithMD5AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 6} */ +#define MBEDTLS_OID_PKCS5_PBE_SHA1_DES_CBC MBEDTLS_OID_PKCS5 "\x0a" /**< pbeWithSHA1AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 10} */ +#define MBEDTLS_OID_PKCS5_PBE_SHA1_RC2_CBC MBEDTLS_OID_PKCS5 "\x0b" /**< pbeWithSHA1AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 11} */ + +/* + * PKCS#8 OIDs + */ +#define MBEDTLS_OID_PKCS9_CSR_EXT_REQ MBEDTLS_OID_PKCS9 "\x0e" /**< extensionRequest OBJECT IDENTIFIER ::= {pkcs-9 14} */ + +/* + * PKCS#12 PBE OIDs + */ +#define MBEDTLS_OID_PKCS12_PBE MBEDTLS_OID_PKCS12 "\x01" /**< pkcs-12PbeIds OBJECT IDENTIFIER ::= {pkcs-12 1} */ + +#define MBEDTLS_OID_PKCS12_PBE_SHA1_RC4_128 MBEDTLS_OID_PKCS12_PBE "\x01" /**< pbeWithSHAAnd128BitRC4 OBJECT IDENTIFIER ::= {pkcs-12PbeIds 1} */ +#define MBEDTLS_OID_PKCS12_PBE_SHA1_RC4_40 MBEDTLS_OID_PKCS12_PBE "\x02" /**< pbeWithSHAAnd40BitRC4 OBJECT IDENTIFIER ::= {pkcs-12PbeIds 2} */ +#define MBEDTLS_OID_PKCS12_PBE_SHA1_DES3_EDE_CBC MBEDTLS_OID_PKCS12_PBE "\x03" /**< pbeWithSHAAnd3-KeyTripleDES-CBC OBJECT IDENTIFIER ::= {pkcs-12PbeIds 3} */ +#define MBEDTLS_OID_PKCS12_PBE_SHA1_DES2_EDE_CBC MBEDTLS_OID_PKCS12_PBE "\x04" /**< pbeWithSHAAnd2-KeyTripleDES-CBC OBJECT IDENTIFIER ::= {pkcs-12PbeIds 4} */ +#define MBEDTLS_OID_PKCS12_PBE_SHA1_RC2_128_CBC MBEDTLS_OID_PKCS12_PBE "\x05" /**< pbeWithSHAAnd128BitRC2-CBC OBJECT IDENTIFIER ::= {pkcs-12PbeIds 5} */ +#define MBEDTLS_OID_PKCS12_PBE_SHA1_RC2_40_CBC MBEDTLS_OID_PKCS12_PBE "\x06" /**< pbeWithSHAAnd40BitRC2-CBC OBJECT IDENTIFIER ::= {pkcs-12PbeIds 6} */ + +/* + * EC key algorithms from RFC 5480 + */ + +/* id-ecPublicKey OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) keyType(2) 1 } */ +#define MBEDTLS_OID_EC_ALG_UNRESTRICTED MBEDTLS_OID_ANSI_X9_62 "\x02\01" + +/* id-ecDH OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) + * schemes(1) ecdh(12) } */ +#define MBEDTLS_OID_EC_ALG_ECDH MBEDTLS_OID_CERTICOM "\x01\x0c" + +/* + * ECParameters namedCurve identifiers, from RFC 5480, RFC 5639, and SEC2 + */ + +/* secp192r1 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) curves(3) prime(1) 1 } */ +#define MBEDTLS_OID_EC_GRP_SECP192R1 MBEDTLS_OID_ANSI_X9_62 "\x03\x01\x01" + +/* secp224r1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 33 } */ +#define MBEDTLS_OID_EC_GRP_SECP224R1 MBEDTLS_OID_CERTICOM "\x00\x21" + +/* secp256r1 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) curves(3) prime(1) 7 } */ +#define MBEDTLS_OID_EC_GRP_SECP256R1 MBEDTLS_OID_ANSI_X9_62 "\x03\x01\x07" + +/* secp384r1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 34 } */ +#define MBEDTLS_OID_EC_GRP_SECP384R1 MBEDTLS_OID_CERTICOM "\x00\x22" + +/* secp521r1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 35 } */ +#define MBEDTLS_OID_EC_GRP_SECP521R1 MBEDTLS_OID_CERTICOM "\x00\x23" + +/* secp192k1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 31 } */ +#define MBEDTLS_OID_EC_GRP_SECP192K1 MBEDTLS_OID_CERTICOM "\x00\x1f" + +/* secp224k1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 32 } */ +#define MBEDTLS_OID_EC_GRP_SECP224K1 MBEDTLS_OID_CERTICOM "\x00\x20" + +/* secp256k1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 10 } */ +#define MBEDTLS_OID_EC_GRP_SECP256K1 MBEDTLS_OID_CERTICOM "\x00\x0a" + +/* RFC 5639 4.1 + * ecStdCurvesAndGeneration OBJECT IDENTIFIER::= {iso(1) + * identified-organization(3) teletrust(36) algorithm(3) signature- + * algorithm(3) ecSign(2) 8} + * ellipticCurve OBJECT IDENTIFIER ::= {ecStdCurvesAndGeneration 1} + * versionOne OBJECT IDENTIFIER ::= {ellipticCurve 1} */ +#define MBEDTLS_OID_EC_BRAINPOOL_V1 MBEDTLS_OID_TELETRUST "\x03\x03\x02\x08\x01\x01" + +/* brainpoolP256r1 OBJECT IDENTIFIER ::= {versionOne 7} */ +#define MBEDTLS_OID_EC_GRP_BP256R1 MBEDTLS_OID_EC_BRAINPOOL_V1 "\x07" + +/* brainpoolP384r1 OBJECT IDENTIFIER ::= {versionOne 11} */ +#define MBEDTLS_OID_EC_GRP_BP384R1 MBEDTLS_OID_EC_BRAINPOOL_V1 "\x0B" + +/* brainpoolP512r1 OBJECT IDENTIFIER ::= {versionOne 13} */ +#define MBEDTLS_OID_EC_GRP_BP512R1 MBEDTLS_OID_EC_BRAINPOOL_V1 "\x0D" + +/* + * SEC1 C.1 + * + * prime-field OBJECT IDENTIFIER ::= { id-fieldType 1 } + * id-fieldType OBJECT IDENTIFIER ::= { ansi-X9-62 fieldType(1)} + */ +#define MBEDTLS_OID_ANSI_X9_62_FIELD_TYPE MBEDTLS_OID_ANSI_X9_62 "\x01" +#define MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD MBEDTLS_OID_ANSI_X9_62_FIELD_TYPE "\x01" + +/* + * ECDSA signature identifiers, from RFC 5480 + */ +#define MBEDTLS_OID_ANSI_X9_62_SIG MBEDTLS_OID_ANSI_X9_62 "\x04" /* signatures(4) */ +#define MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 MBEDTLS_OID_ANSI_X9_62_SIG "\x03" /* ecdsa-with-SHA2(3) */ + +/* ecdsa-with-SHA1 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) 1 } */ +#define MBEDTLS_OID_ECDSA_SHA1 MBEDTLS_OID_ANSI_X9_62_SIG "\x01" + +/* ecdsa-with-SHA224 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) + * ecdsa-with-SHA2(3) 1 } */ +#define MBEDTLS_OID_ECDSA_SHA224 MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 "\x01" + +/* ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) + * ecdsa-with-SHA2(3) 2 } */ +#define MBEDTLS_OID_ECDSA_SHA256 MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 "\x02" + +/* ecdsa-with-SHA384 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) + * ecdsa-with-SHA2(3) 3 } */ +#define MBEDTLS_OID_ECDSA_SHA384 MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 "\x03" + +/* ecdsa-with-SHA512 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) + * ecdsa-with-SHA2(3) 4 } */ +#define MBEDTLS_OID_ECDSA_SHA512 MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 "\x04" + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Base OID descriptor structure + */ +typedef struct mbedtls_oid_descriptor_t +{ + const char *asn1; /*!< OID ASN.1 representation */ + size_t asn1_len; /*!< length of asn1 */ + const char *name; /*!< official name (e.g. from RFC) */ + const char *description; /*!< human friendly description */ +} mbedtls_oid_descriptor_t; + +/** + * \brief Translate an ASN.1 OID into its numeric representation + * (e.g. "\x2A\x86\x48\x86\xF7\x0D" into "1.2.840.113549") + * + * \param buf buffer to put representation in + * \param size size of the buffer + * \param oid OID to translate + * + * \return Length of the string written (excluding final NULL) or + * MBEDTLS_ERR_OID_BUF_TOO_SMALL in case of error + */ +int mbedtls_oid_get_numeric_string( char *buf, size_t size, const mbedtls_asn1_buf *oid ); + +/** + * \brief Translate an X.509 extension OID into local values + * + * \param oid OID to use + * \param ext_type place to store the extension type + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_x509_ext_type( const mbedtls_asn1_buf *oid, int *ext_type ); + +/** + * \brief Translate an X.509 attribute type OID into the short name + * (e.g. the OID for an X520 Common Name into "CN") + * + * \param oid OID to use + * \param short_name place to store the string pointer + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_attr_short_name( const mbedtls_asn1_buf *oid, const char **short_name ); + +/** + * \brief Translate PublicKeyAlgorithm OID into pk_type + * + * \param oid OID to use + * \param pk_alg place to store public key algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_pk_alg( const mbedtls_asn1_buf *oid, mbedtls_pk_type_t *pk_alg ); + +/** + * \brief Translate pk_type into PublicKeyAlgorithm OID + * + * \param pk_alg Public key type to look for + * \param oid place to store ASN.1 OID string pointer + * \param olen length of the OID + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_oid_by_pk_alg( mbedtls_pk_type_t pk_alg, + const char **oid, size_t *olen ); + +#if defined(MBEDTLS_ECP_C) +/** + * \brief Translate NamedCurve OID into an EC group identifier + * + * \param oid OID to use + * \param grp_id place to store group id + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_ec_grp( const mbedtls_asn1_buf *oid, mbedtls_ecp_group_id *grp_id ); + +/** + * \brief Translate EC group identifier into NamedCurve OID + * + * \param grp_id EC group identifier + * \param oid place to store ASN.1 OID string pointer + * \param olen length of the OID + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_oid_by_ec_grp( mbedtls_ecp_group_id grp_id, + const char **oid, size_t *olen ); +#endif /* MBEDTLS_ECP_C */ + +#if defined(MBEDTLS_MD_C) +/** + * \brief Translate SignatureAlgorithm OID into md_type and pk_type + * + * \param oid OID to use + * \param md_alg place to store message digest algorithm + * \param pk_alg place to store public key algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_sig_alg( const mbedtls_asn1_buf *oid, + mbedtls_md_type_t *md_alg, mbedtls_pk_type_t *pk_alg ); + +/** + * \brief Translate SignatureAlgorithm OID into description + * + * \param oid OID to use + * \param desc place to store string pointer + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_sig_alg_desc( const mbedtls_asn1_buf *oid, const char **desc ); + +/** + * \brief Translate md_type and pk_type into SignatureAlgorithm OID + * + * \param md_alg message digest algorithm + * \param pk_alg public key algorithm + * \param oid place to store ASN.1 OID string pointer + * \param olen length of the OID + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_oid_by_sig_alg( mbedtls_pk_type_t pk_alg, mbedtls_md_type_t md_alg, + const char **oid, size_t *olen ); + +/** + * \brief Translate hash algorithm OID into md_type + * + * \param oid OID to use + * \param md_alg place to store message digest algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_md_alg( const mbedtls_asn1_buf *oid, mbedtls_md_type_t *md_alg ); + +/** + * \brief Translate hmac algorithm OID into md_type + * + * \param oid OID to use + * \param md_hmac place to store message hmac algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_md_hmac( const mbedtls_asn1_buf *oid, mbedtls_md_type_t *md_hmac ); +#endif /* MBEDTLS_MD_C */ + +/** + * \brief Translate Extended Key Usage OID into description + * + * \param oid OID to use + * \param desc place to store string pointer + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_extended_key_usage( const mbedtls_asn1_buf *oid, const char **desc ); + +/** + * \brief Translate certificate policies OID into description + * + * \param oid OID to use + * \param desc place to store string pointer + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_certificate_policies( const mbedtls_asn1_buf *oid, const char **desc ); + +/** + * \brief Translate md_type into hash algorithm OID + * + * \param md_alg message digest algorithm + * \param oid place to store ASN.1 OID string pointer + * \param olen length of the OID + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_oid_by_md( mbedtls_md_type_t md_alg, const char **oid, size_t *olen ); + +#if defined(MBEDTLS_CIPHER_C) +/** + * \brief Translate encryption algorithm OID into cipher_type + * + * \param oid OID to use + * \param cipher_alg place to store cipher algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_cipher_alg( const mbedtls_asn1_buf *oid, mbedtls_cipher_type_t *cipher_alg ); +#endif /* MBEDTLS_CIPHER_C */ + +#if defined(MBEDTLS_PKCS12_C) +/** + * \brief Translate PKCS#12 PBE algorithm OID into md_type and + * cipher_type + * + * \param oid OID to use + * \param md_alg place to store message digest algorithm + * \param cipher_alg place to store cipher algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_pkcs12_pbe_alg( const mbedtls_asn1_buf *oid, mbedtls_md_type_t *md_alg, + mbedtls_cipher_type_t *cipher_alg ); +#endif /* MBEDTLS_PKCS12_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* oid.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/padlock.h b/openharmony/arm64-v8a/include/mbedtls/padlock.h new file mode 100644 index 00000000..624d02df --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/padlock.h @@ -0,0 +1,125 @@ +/** + * \file padlock.h + * + * \brief VIA PadLock ACE for HW encryption/decryption supported by some + * processors + * + * \warning These functions are only for internal use by other library + * functions; you must not call them directly. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_PADLOCK_H +#define MBEDTLS_PADLOCK_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/aes.h" + +/** Input data should be aligned. */ +#define MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED -0x0030 + +#if defined(__has_feature) +#if __has_feature(address_sanitizer) +#define MBEDTLS_HAVE_ASAN +#endif +#endif + +/* Some versions of ASan result in errors about not enough registers */ +#if defined(MBEDTLS_HAVE_ASM) && defined(__GNUC__) && defined(__i386__) && \ + !defined(MBEDTLS_HAVE_ASAN) + +#ifndef MBEDTLS_HAVE_X86 +#define MBEDTLS_HAVE_X86 +#endif + +#include + +#define MBEDTLS_PADLOCK_RNG 0x000C +#define MBEDTLS_PADLOCK_ACE 0x00C0 +#define MBEDTLS_PADLOCK_PHE 0x0C00 +#define MBEDTLS_PADLOCK_PMM 0x3000 + +#define MBEDTLS_PADLOCK_ALIGN16(x) (uint32_t *) (16 + ((int32_t) (x) & ~15)) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Internal PadLock detection routine + * + * \note This function is only for internal use by other library + * functions; you must not call it directly. + * + * \param feature The feature to detect + * + * \return non-zero if CPU has support for the feature, 0 otherwise + */ +int mbedtls_padlock_has_support( int feature ); + +/** + * \brief Internal PadLock AES-ECB block en(de)cryption + * + * \note This function is only for internal use by other library + * functions; you must not call it directly. + * + * \param ctx AES context + * \param mode MBEDTLS_AES_ENCRYPT or MBEDTLS_AES_DECRYPT + * \param input 16-byte input block + * \param output 16-byte output block + * + * \return 0 if success, 1 if operation failed + */ +int mbedtls_padlock_xcryptecb( mbedtls_aes_context *ctx, + int mode, + const unsigned char input[16], + unsigned char output[16] ); + +/** + * \brief Internal PadLock AES-CBC buffer en(de)cryption + * + * \note This function is only for internal use by other library + * functions; you must not call it directly. + * + * \param ctx AES context + * \param mode MBEDTLS_AES_ENCRYPT or MBEDTLS_AES_DECRYPT + * \param length length of the input data + * \param iv initialization vector (updated after use) + * \param input buffer holding the input data + * \param output buffer holding the output data + * + * \return 0 if success, 1 if operation failed + */ +int mbedtls_padlock_xcryptcbc( mbedtls_aes_context *ctx, + int mode, + size_t length, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output ); + +#ifdef __cplusplus +} +#endif + +#endif /* HAVE_X86 */ + +#endif /* padlock.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/pem.h b/openharmony/arm64-v8a/include/mbedtls/pem.h new file mode 100644 index 00000000..daa71c88 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/pem.h @@ -0,0 +1,153 @@ +/** + * \file pem.h + * + * \brief Privacy Enhanced Mail (PEM) decoding + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_PEM_H +#define MBEDTLS_PEM_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +/** + * \name PEM Error codes + * These error codes are returned in case of errors reading the + * PEM data. + * \{ + */ +/** No PEM header or footer found. */ +#define MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT -0x1080 +/** PEM string is not as expected. */ +#define MBEDTLS_ERR_PEM_INVALID_DATA -0x1100 +/** Failed to allocate memory. */ +#define MBEDTLS_ERR_PEM_ALLOC_FAILED -0x1180 +/** RSA IV is not in hex-format. */ +#define MBEDTLS_ERR_PEM_INVALID_ENC_IV -0x1200 +/** Unsupported key encryption algorithm. */ +#define MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG -0x1280 +/** Private key password can't be empty. */ +#define MBEDTLS_ERR_PEM_PASSWORD_REQUIRED -0x1300 +/** Given private key password does not allow for correct decryption. */ +#define MBEDTLS_ERR_PEM_PASSWORD_MISMATCH -0x1380 +/** Unavailable feature, e.g. hashing/encryption combination. */ +#define MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE -0x1400 +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_PEM_BAD_INPUT_DATA -0x1480 +/** \} name PEM Error codes */ + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(MBEDTLS_PEM_PARSE_C) +/** + * \brief PEM context structure + */ +typedef struct mbedtls_pem_context +{ + unsigned char *buf; /*!< buffer for decoded data */ + size_t buflen; /*!< length of the buffer */ + unsigned char *info; /*!< buffer for extra header information */ +} +mbedtls_pem_context; + +/** + * \brief PEM context setup + * + * \param ctx context to be initialized + */ +void mbedtls_pem_init( mbedtls_pem_context *ctx ); + +/** + * \brief Read a buffer for PEM information and store the resulting + * data into the specified context buffers. + * + * \param ctx context to use + * \param header header string to seek and expect + * \param footer footer string to seek and expect + * \param data source data to look in (must be nul-terminated) + * \param pwd password for decryption (can be NULL) + * \param pwdlen length of password + * \param use_len destination for total length used (set after header is + * correctly read, so unless you get + * MBEDTLS_ERR_PEM_BAD_INPUT_DATA or + * MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT, use_len is + * the length to skip) + * + * \note Attempts to check password correctness by verifying if + * the decrypted text starts with an ASN.1 sequence of + * appropriate length + * + * \return 0 on success, or a specific PEM error code + */ +int mbedtls_pem_read_buffer( mbedtls_pem_context *ctx, const char *header, const char *footer, + const unsigned char *data, + const unsigned char *pwd, + size_t pwdlen, size_t *use_len ); + +/** + * \brief PEM context memory freeing + * + * \param ctx context to be freed + */ +void mbedtls_pem_free( mbedtls_pem_context *ctx ); +#endif /* MBEDTLS_PEM_PARSE_C */ + +#if defined(MBEDTLS_PEM_WRITE_C) +/** + * \brief Write a buffer of PEM information from a DER encoded + * buffer. + * + * \param header The header string to write. + * \param footer The footer string to write. + * \param der_data The DER data to encode. + * \param der_len The length of the DER data \p der_data in Bytes. + * \param buf The buffer to write to. + * \param buf_len The length of the output buffer \p buf in Bytes. + * \param olen The address at which to store the total length written + * or required (if \p buf_len is not enough). + * + * \note You may pass \c NULL for \p buf and \c 0 for \p buf_len + * to request the length of the resulting PEM buffer in + * `*olen`. + * + * \note This function may be called with overlapping \p der_data + * and \p buf buffers. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL if \p buf isn't large + * enough to hold the PEM buffer. In this case, `*olen` holds + * the required minimum size of \p buf. + * \return Another PEM or BASE64 error code on other kinds of failure. + */ +int mbedtls_pem_write_buffer( const char *header, const char *footer, + const unsigned char *der_data, size_t der_len, + unsigned char *buf, size_t buf_len, size_t *olen ); +#endif /* MBEDTLS_PEM_WRITE_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* pem.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/pk.h b/openharmony/arm64-v8a/include/mbedtls/pk.h new file mode 100644 index 00000000..c9a13f48 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/pk.h @@ -0,0 +1,918 @@ +/** + * \file pk.h + * + * \brief Public Key abstraction layer + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_PK_H +#define MBEDTLS_PK_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/md.h" + +#if defined(MBEDTLS_RSA_C) +#include "mbedtls/rsa.h" +#endif + +#if defined(MBEDTLS_ECP_C) +#include "mbedtls/ecp.h" +#endif + +#if defined(MBEDTLS_ECDSA_C) +#include "mbedtls/ecdsa.h" +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#include "psa/crypto.h" +#endif + +#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \ + !defined(inline) && !defined(__cplusplus) +#define inline __inline +#endif + +/** Memory allocation failed. */ +#define MBEDTLS_ERR_PK_ALLOC_FAILED -0x3F80 +/** Type mismatch, eg attempt to encrypt with an ECDSA key */ +#define MBEDTLS_ERR_PK_TYPE_MISMATCH -0x3F00 +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_PK_BAD_INPUT_DATA -0x3E80 +/** Read/write of file failed. */ +#define MBEDTLS_ERR_PK_FILE_IO_ERROR -0x3E00 +/** Unsupported key version */ +#define MBEDTLS_ERR_PK_KEY_INVALID_VERSION -0x3D80 +/** Invalid key tag or value. */ +#define MBEDTLS_ERR_PK_KEY_INVALID_FORMAT -0x3D00 +/** Key algorithm is unsupported (only RSA and EC are supported). */ +#define MBEDTLS_ERR_PK_UNKNOWN_PK_ALG -0x3C80 +/** Private key password can't be empty. */ +#define MBEDTLS_ERR_PK_PASSWORD_REQUIRED -0x3C00 +/** Given private key password does not allow for correct decryption. */ +#define MBEDTLS_ERR_PK_PASSWORD_MISMATCH -0x3B80 +/** The pubkey tag or value is invalid (only RSA and EC are supported). */ +#define MBEDTLS_ERR_PK_INVALID_PUBKEY -0x3B00 +/** The algorithm tag or value is invalid. */ +#define MBEDTLS_ERR_PK_INVALID_ALG -0x3A80 +/** Elliptic curve is unsupported (only NIST curves are supported). */ +#define MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE -0x3A00 +/** Unavailable feature, e.g. RSA disabled for RSA key. */ +#define MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE -0x3980 +/** The buffer contains a valid signature followed by more data. */ +#define MBEDTLS_ERR_PK_SIG_LEN_MISMATCH -0x3900 + +/* MBEDTLS_ERR_PK_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** PK hardware accelerator failed. */ +#define MBEDTLS_ERR_PK_HW_ACCEL_FAILED -0x3880 + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Public key types + */ +typedef enum { + MBEDTLS_PK_NONE=0, + MBEDTLS_PK_RSA, + MBEDTLS_PK_ECKEY, + MBEDTLS_PK_ECKEY_DH, + MBEDTLS_PK_ECDSA, + MBEDTLS_PK_RSA_ALT, + MBEDTLS_PK_RSASSA_PSS, + MBEDTLS_PK_OPAQUE, +} mbedtls_pk_type_t; + +/** + * \brief Options for RSASSA-PSS signature verification. + * See \c mbedtls_rsa_rsassa_pss_verify_ext() + */ +typedef struct mbedtls_pk_rsassa_pss_options +{ + mbedtls_md_type_t mgf1_hash_id; + int expected_salt_len; + +} mbedtls_pk_rsassa_pss_options; + +/** + * \brief Maximum size of a signature made by mbedtls_pk_sign(). + */ +/* We need to set MBEDTLS_PK_SIGNATURE_MAX_SIZE to the maximum signature + * size among the supported signature types. Do it by starting at 0, + * then incrementally increasing to be large enough for each supported + * signature mechanism. + * + * The resulting value can be 0, for example if MBEDTLS_ECDH_C is enabled + * (which allows the pk module to be included) but neither MBEDTLS_ECDSA_C + * nor MBEDTLS_RSA_C nor any opaque signature mechanism (PSA or RSA_ALT). + */ +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE 0 + +#if ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_PK_RSA_ALT_SUPPORT) ) && \ + MBEDTLS_MPI_MAX_SIZE > MBEDTLS_PK_SIGNATURE_MAX_SIZE +/* For RSA, the signature can be as large as the bignum module allows. + * For RSA_ALT, the signature size is not necessarily tied to what the + * bignum module can do, but in the absence of any specific setting, + * we use that (rsa_alt_sign_wrap in pk_wrap will check). */ +#undef MBEDTLS_PK_SIGNATURE_MAX_SIZE +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE MBEDTLS_MPI_MAX_SIZE +#endif + +#if defined(MBEDTLS_ECDSA_C) && \ + MBEDTLS_ECDSA_MAX_LEN > MBEDTLS_PK_SIGNATURE_MAX_SIZE +/* For ECDSA, the ecdsa module exports a constant for the maximum + * signature size. */ +#undef MBEDTLS_PK_SIGNATURE_MAX_SIZE +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE MBEDTLS_ECDSA_MAX_LEN +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#if PSA_SIGNATURE_MAX_SIZE > MBEDTLS_PK_SIGNATURE_MAX_SIZE +/* PSA_SIGNATURE_MAX_SIZE is the maximum size of a signature made + * through the PSA API in the PSA representation. */ +#undef MBEDTLS_PK_SIGNATURE_MAX_SIZE +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE PSA_SIGNATURE_MAX_SIZE +#endif + +#if PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE + 11 > MBEDTLS_PK_SIGNATURE_MAX_SIZE +/* The Mbed TLS representation is different for ECDSA signatures: + * PSA uses the raw concatenation of r and s, + * whereas Mbed TLS uses the ASN.1 representation (SEQUENCE of two INTEGERs). + * Add the overhead of ASN.1: up to (1+2) + 2 * (1+2+1) for the + * types, lengths (represented by up to 2 bytes), and potential leading + * zeros of the INTEGERs and the SEQUENCE. */ +#undef MBEDTLS_PK_SIGNATURE_MAX_SIZE +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE ( PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE + 11 ) +#endif +#endif /* defined(MBEDTLS_USE_PSA_CRYPTO) */ + +/** + * \brief Types for interfacing with the debug module + */ +typedef enum +{ + MBEDTLS_PK_DEBUG_NONE = 0, + MBEDTLS_PK_DEBUG_MPI, + MBEDTLS_PK_DEBUG_ECP, +} mbedtls_pk_debug_type; + +/** + * \brief Item to send to the debug module + */ +typedef struct mbedtls_pk_debug_item +{ + mbedtls_pk_debug_type type; + const char *name; + void *value; +} mbedtls_pk_debug_item; + +/** Maximum number of item send for debugging, plus 1 */ +#define MBEDTLS_PK_DEBUG_MAX_ITEMS 3 + +/** + * \brief Public key information and operations + */ +typedef struct mbedtls_pk_info_t mbedtls_pk_info_t; + +/** + * \brief Public key container + */ +typedef struct mbedtls_pk_context +{ + const mbedtls_pk_info_t * pk_info; /**< Public key information */ + void * pk_ctx; /**< Underlying public key context */ +} mbedtls_pk_context; + +#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Context for resuming operations + */ +typedef struct +{ + const mbedtls_pk_info_t * pk_info; /**< Public key information */ + void * rs_ctx; /**< Underlying restart context */ +} mbedtls_pk_restart_ctx; +#else /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ +/* Now we can declare functions that take a pointer to that */ +typedef void mbedtls_pk_restart_ctx; +#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ + +#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT) +/** + * \brief Types for RSA-alt abstraction + */ +typedef int (*mbedtls_pk_rsa_alt_decrypt_func)( void *ctx, int mode, size_t *olen, + const unsigned char *input, unsigned char *output, + size_t output_max_len ); +typedef int (*mbedtls_pk_rsa_alt_sign_func)( void *ctx, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, + int mode, mbedtls_md_type_t md_alg, unsigned int hashlen, + const unsigned char *hash, unsigned char *sig ); +typedef size_t (*mbedtls_pk_rsa_alt_key_len_func)( void *ctx ); +#endif /* MBEDTLS_PK_RSA_ALT_SUPPORT */ + +/** + * \brief Return information associated with the given PK type + * + * \param pk_type PK type to search for. + * + * \return The PK info associated with the type or NULL if not found. + */ +const mbedtls_pk_info_t *mbedtls_pk_info_from_type( mbedtls_pk_type_t pk_type ); + +/** + * \brief Initialize a #mbedtls_pk_context (as NONE). + * + * \param ctx The context to initialize. + * This must not be \c NULL. + */ +void mbedtls_pk_init( mbedtls_pk_context *ctx ); + +/** + * \brief Free the components of a #mbedtls_pk_context. + * + * \param ctx The context to clear. It must have been initialized. + * If this is \c NULL, this function does nothing. + * + * \note For contexts that have been set up with + * mbedtls_pk_setup_opaque(), this does not free the underlying + * PSA key and you still need to call psa_destroy_key() + * independently if you want to destroy that key. + */ +void mbedtls_pk_free( mbedtls_pk_context *ctx ); + +#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Initialize a restart context + * + * \param ctx The context to initialize. + * This must not be \c NULL. + */ +void mbedtls_pk_restart_init( mbedtls_pk_restart_ctx *ctx ); + +/** + * \brief Free the components of a restart context + * + * \param ctx The context to clear. It must have been initialized. + * If this is \c NULL, this function does nothing. + */ +void mbedtls_pk_restart_free( mbedtls_pk_restart_ctx *ctx ); +#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ + +/** + * \brief Initialize a PK context with the information given + * and allocates the type-specific PK subcontext. + * + * \param ctx Context to initialize. It must not have been set + * up yet (type #MBEDTLS_PK_NONE). + * \param info Information to use + * + * \return 0 on success, + * MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input, + * MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure. + * + * \note For contexts holding an RSA-alt key, use + * \c mbedtls_pk_setup_rsa_alt() instead. + */ +int mbedtls_pk_setup( mbedtls_pk_context *ctx, const mbedtls_pk_info_t *info ); + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +/** + * \brief Initialize a PK context to wrap a PSA key. + * + * \note This function replaces mbedtls_pk_setup() for contexts + * that wrap a (possibly opaque) PSA key instead of + * storing and manipulating the key material directly. + * + * \param ctx The context to initialize. It must be empty (type NONE). + * \param key The PSA key to wrap, which must hold an ECC key pair + * (see notes below). + * + * \note The wrapped key must remain valid as long as the + * wrapping PK context is in use, that is at least between + * the point this function is called and the point + * mbedtls_pk_free() is called on this context. The wrapped + * key might then be independently used or destroyed. + * + * \note This function is currently only available for ECC key + * pairs (that is, ECC keys containing private key material). + * Support for other key types may be added later. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input + * (context already used, invalid key identifier). + * \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the key is not an + * ECC key pair. + * \return #MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure. + */ +int mbedtls_pk_setup_opaque( mbedtls_pk_context *ctx, + const psa_key_id_t key ); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT) +/** + * \brief Initialize an RSA-alt context + * + * \param ctx Context to initialize. It must not have been set + * up yet (type #MBEDTLS_PK_NONE). + * \param key RSA key pointer + * \param decrypt_func Decryption function + * \param sign_func Signing function + * \param key_len_func Function returning key length in bytes + * + * \return 0 on success, or MBEDTLS_ERR_PK_BAD_INPUT_DATA if the + * context wasn't already initialized as RSA_ALT. + * + * \note This function replaces \c mbedtls_pk_setup() for RSA-alt. + */ +int mbedtls_pk_setup_rsa_alt( mbedtls_pk_context *ctx, void * key, + mbedtls_pk_rsa_alt_decrypt_func decrypt_func, + mbedtls_pk_rsa_alt_sign_func sign_func, + mbedtls_pk_rsa_alt_key_len_func key_len_func ); +#endif /* MBEDTLS_PK_RSA_ALT_SUPPORT */ + +/** + * \brief Get the size in bits of the underlying key + * + * \param ctx The context to query. It must have been initialized. + * + * \return Key size in bits, or 0 on error + */ +size_t mbedtls_pk_get_bitlen( const mbedtls_pk_context *ctx ); + +/** + * \brief Get the length in bytes of the underlying key + * + * \param ctx The context to query. It must have been initialized. + * + * \return Key length in bytes, or 0 on error + */ +static inline size_t mbedtls_pk_get_len( const mbedtls_pk_context *ctx ) +{ + return( ( mbedtls_pk_get_bitlen( ctx ) + 7 ) / 8 ); +} + +/** + * \brief Tell if a context can do the operation given by type + * + * \param ctx The context to query. It must have been initialized. + * \param type The desired type. + * + * \return 1 if the context can do operations on the given type. + * \return 0 if the context cannot do the operations on the given + * type. This is always the case for a context that has + * been initialized but not set up, or that has been + * cleared with mbedtls_pk_free(). + */ +int mbedtls_pk_can_do( const mbedtls_pk_context *ctx, mbedtls_pk_type_t type ); + +/** + * \brief Verify signature (including padding if relevant). + * + * \param ctx The PK context to use. It must have been set up. + * \param md_alg Hash algorithm used (see notes) + * \param hash Hash of the message to sign + * \param hash_len Hash length or 0 (see notes) + * \param sig Signature to verify + * \param sig_len Signature length + * + * \return 0 on success (signature is valid), + * #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid + * signature in sig but its length is less than \p siglen, + * or a specific error code. + * + * \note For RSA keys, the default padding type is PKCS#1 v1.5. + * Use \c mbedtls_pk_verify_ext( MBEDTLS_PK_RSASSA_PSS, ... ) + * to verify RSASSA_PSS signatures. + * + * \note If hash_len is 0, then the length associated with md_alg + * is used instead, or an error returned if it is invalid. + * + * \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0 + */ +int mbedtls_pk_verify( mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + const unsigned char *sig, size_t sig_len ); + +/** + * \brief Restartable version of \c mbedtls_pk_verify() + * + * \note Performs the same job as \c mbedtls_pk_verify(), but can + * return early and restart according to the limit set with + * \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC + * operations. For RSA, same as \c mbedtls_pk_verify(). + * + * \param ctx The PK context to use. It must have been set up. + * \param md_alg Hash algorithm used (see notes) + * \param hash Hash of the message to sign + * \param hash_len Hash length or 0 (see notes) + * \param sig Signature to verify + * \param sig_len Signature length + * \param rs_ctx Restart context (NULL to disable restart) + * + * \return See \c mbedtls_pk_verify(), or + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + */ +int mbedtls_pk_verify_restartable( mbedtls_pk_context *ctx, + mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + const unsigned char *sig, size_t sig_len, + mbedtls_pk_restart_ctx *rs_ctx ); + +/** + * \brief Verify signature, with options. + * (Includes verification of the padding depending on type.) + * + * \param type Signature type (inc. possible padding type) to verify + * \param options Pointer to type-specific options, or NULL + * \param ctx The PK context to use. It must have been set up. + * \param md_alg Hash algorithm used (see notes) + * \param hash Hash of the message to sign + * \param hash_len Hash length or 0 (see notes) + * \param sig Signature to verify + * \param sig_len Signature length + * + * \return 0 on success (signature is valid), + * #MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can't be + * used for this type of signatures, + * #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid + * signature in sig but its length is less than \p siglen, + * or a specific error code. + * + * \note If hash_len is 0, then the length associated with md_alg + * is used instead, or an error returned if it is invalid. + * + * \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0 + * + * \note If type is MBEDTLS_PK_RSASSA_PSS, then options must point + * to a mbedtls_pk_rsassa_pss_options structure, + * otherwise it must be NULL. + */ +int mbedtls_pk_verify_ext( mbedtls_pk_type_t type, const void *options, + mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + const unsigned char *sig, size_t sig_len ); + +/** + * \brief Make signature, including padding if relevant. + * + * \param ctx The PK context to use. It must have been set up + * with a private key. + * \param md_alg Hash algorithm used (see notes) + * \param hash Hash of the message to sign + * \param hash_len Hash length or 0 (see notes) + * \param sig Place to write the signature. + * It must have enough room for the signature. + * #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + * You may use a smaller buffer if it is large enough + * given the key type. + * \param sig_len On successful return, + * the number of bytes written to \p sig. + * \param f_rng RNG function + * \param p_rng RNG parameter + * + * \return 0 on success, or a specific error code. + * + * \note For RSA keys, the default padding type is PKCS#1 v1.5. + * There is no interface in the PK module to make RSASSA-PSS + * signatures yet. + * + * \note If hash_len is 0, then the length associated with md_alg + * is used instead, or an error returned if it is invalid. + * + * \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. + * For ECDSA, md_alg may never be MBEDTLS_MD_NONE. + */ +int mbedtls_pk_sign( mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + unsigned char *sig, size_t *sig_len, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ); + +/** + * \brief Restartable version of \c mbedtls_pk_sign() + * + * \note Performs the same job as \c mbedtls_pk_sign(), but can + * return early and restart according to the limit set with + * \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC + * operations. For RSA, same as \c mbedtls_pk_sign(). + * + * \param ctx The PK context to use. It must have been set up + * with a private key. + * \param md_alg Hash algorithm used (see notes for mbedtls_pk_sign()) + * \param hash Hash of the message to sign + * \param hash_len Hash length or 0 (see notes for mbedtls_pk_sign()) + * \param sig Place to write the signature. + * It must have enough room for the signature. + * #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + * You may use a smaller buffer if it is large enough + * given the key type. + * \param sig_len On successful return, + * the number of bytes written to \p sig. + * \param f_rng RNG function + * \param p_rng RNG parameter + * \param rs_ctx Restart context (NULL to disable restart) + * + * \return See \c mbedtls_pk_sign(). + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + */ +int mbedtls_pk_sign_restartable( mbedtls_pk_context *ctx, + mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + unsigned char *sig, size_t *sig_len, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, + mbedtls_pk_restart_ctx *rs_ctx ); + +/** + * \brief Decrypt message (including padding if relevant). + * + * \param ctx The PK context to use. It must have been set up + * with a private key. + * \param input Input to decrypt + * \param ilen Input size + * \param output Decrypted output + * \param olen Decrypted message length + * \param osize Size of the output buffer + * \param f_rng RNG function + * \param p_rng RNG parameter + * + * \note For RSA keys, the default padding type is PKCS#1 v1.5. + * + * \return 0 on success, or a specific error code. + */ +int mbedtls_pk_decrypt( mbedtls_pk_context *ctx, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen, size_t osize, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ); + +/** + * \brief Encrypt message (including padding if relevant). + * + * \param ctx The PK context to use. It must have been set up. + * \param input Message to encrypt + * \param ilen Message size + * \param output Encrypted output + * \param olen Encrypted output length + * \param osize Size of the output buffer + * \param f_rng RNG function + * \param p_rng RNG parameter + * + * \note For RSA keys, the default padding type is PKCS#1 v1.5. + * + * \return 0 on success, or a specific error code. + */ +int mbedtls_pk_encrypt( mbedtls_pk_context *ctx, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen, size_t osize, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ); + +/** + * \brief Check if a public-private pair of keys matches. + * + * \param pub Context holding a public key. + * \param prv Context holding a private (and public) key. + * + * \return \c 0 on success (keys were checked and match each other). + * \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the keys could not + * be checked - in that case they may or may not match. + * \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA if a context is invalid. + * \return Another non-zero value if the keys do not match. + */ +int mbedtls_pk_check_pair( const mbedtls_pk_context *pub, const mbedtls_pk_context *prv ); + +/** + * \brief Export debug information + * + * \param ctx The PK context to use. It must have been initialized. + * \param items Place to write debug items + * + * \return 0 on success or MBEDTLS_ERR_PK_BAD_INPUT_DATA + */ +int mbedtls_pk_debug( const mbedtls_pk_context *ctx, mbedtls_pk_debug_item *items ); + +/** + * \brief Access the type name + * + * \param ctx The PK context to use. It must have been initialized. + * + * \return Type name on success, or "invalid PK" + */ +const char * mbedtls_pk_get_name( const mbedtls_pk_context *ctx ); + +/** + * \brief Get the key type + * + * \param ctx The PK context to use. It must have been initialized. + * + * \return Type on success. + * \return #MBEDTLS_PK_NONE for a context that has not been set up. + */ +mbedtls_pk_type_t mbedtls_pk_get_type( const mbedtls_pk_context *ctx ); + +#if defined(MBEDTLS_RSA_C) +/** + * Quick access to an RSA context inside a PK context. + * + * \warning This function can only be used when the type of the context, as + * returned by mbedtls_pk_get_type(), is #MBEDTLS_PK_RSA. + * Ensuring that is the caller's responsibility. + * Alternatively, you can check whether this function returns NULL. + * + * \return The internal RSA context held by the PK context, or NULL. + */ +static inline mbedtls_rsa_context *mbedtls_pk_rsa( const mbedtls_pk_context pk ) +{ + switch( mbedtls_pk_get_type( &pk ) ) + { + case MBEDTLS_PK_RSA: + return( (mbedtls_rsa_context *) (pk).pk_ctx ); + default: + return( NULL ); + } +} +#endif /* MBEDTLS_RSA_C */ + +#if defined(MBEDTLS_ECP_C) +/** + * Quick access to an EC context inside a PK context. + * + * \warning This function can only be used when the type of the context, as + * returned by mbedtls_pk_get_type(), is #MBEDTLS_PK_ECKEY, + * #MBEDTLS_PK_ECKEY_DH, or #MBEDTLS_PK_ECDSA. + * Ensuring that is the caller's responsibility. + * Alternatively, you can check whether this function returns NULL. + * + * \return The internal EC context held by the PK context, or NULL. + */ +static inline mbedtls_ecp_keypair *mbedtls_pk_ec( const mbedtls_pk_context pk ) +{ + switch( mbedtls_pk_get_type( &pk ) ) + { + case MBEDTLS_PK_ECKEY: + case MBEDTLS_PK_ECKEY_DH: + case MBEDTLS_PK_ECDSA: + return( (mbedtls_ecp_keypair *) (pk).pk_ctx ); + default: + return( NULL ); + } +} +#endif /* MBEDTLS_ECP_C */ + +#if defined(MBEDTLS_PK_PARSE_C) +/** \ingroup pk_module */ +/** + * \brief Parse a private key in PEM or DER format + * + * \param ctx The PK context to fill. It must have been initialized + * but not set up. + * \param key Input buffer to parse. + * The buffer must contain the input exactly, with no + * extra trailing material. For PEM, the buffer must + * contain a null-terminated string. + * \param keylen Size of \b key in bytes. + * For PEM data, this includes the terminating null byte, + * so \p keylen must be equal to `strlen(key) + 1`. + * \param pwd Optional password for decryption. + * Pass \c NULL if expecting a non-encrypted key. + * Pass a string of \p pwdlen bytes if expecting an encrypted + * key; a non-encrypted key will also be accepted. + * The empty password is not supported. + * \param pwdlen Size of the password in bytes. + * Ignored if \p pwd is \c NULL. + * + * \note On entry, ctx must be empty, either freshly initialised + * with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + * specific key type, check the result with mbedtls_pk_can_do(). + * + * \note The key is also checked for correctness. + * + * \return 0 if successful, or a specific PK or PEM error code + */ +int mbedtls_pk_parse_key( mbedtls_pk_context *ctx, + const unsigned char *key, size_t keylen, + const unsigned char *pwd, size_t pwdlen ); + +/** \ingroup pk_module */ +/** + * \brief Parse a public key in PEM or DER format + * + * \param ctx The PK context to fill. It must have been initialized + * but not set up. + * \param key Input buffer to parse. + * The buffer must contain the input exactly, with no + * extra trailing material. For PEM, the buffer must + * contain a null-terminated string. + * \param keylen Size of \b key in bytes. + * For PEM data, this includes the terminating null byte, + * so \p keylen must be equal to `strlen(key) + 1`. + * + * \note On entry, ctx must be empty, either freshly initialised + * with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + * specific key type, check the result with mbedtls_pk_can_do(). + * + * \note The key is also checked for correctness. + * + * \return 0 if successful, or a specific PK or PEM error code + */ +int mbedtls_pk_parse_public_key( mbedtls_pk_context *ctx, + const unsigned char *key, size_t keylen ); + +#if defined(MBEDTLS_FS_IO) +/** \ingroup pk_module */ +/** + * \brief Load and parse a private key + * + * \param ctx The PK context to fill. It must have been initialized + * but not set up. + * \param path filename to read the private key from + * \param password Optional password to decrypt the file. + * Pass \c NULL if expecting a non-encrypted key. + * Pass a null-terminated string if expecting an encrypted + * key; a non-encrypted key will also be accepted. + * The empty password is not supported. + * + * \note On entry, ctx must be empty, either freshly initialised + * with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + * specific key type, check the result with mbedtls_pk_can_do(). + * + * \note The key is also checked for correctness. + * + * \return 0 if successful, or a specific PK or PEM error code + */ +int mbedtls_pk_parse_keyfile( mbedtls_pk_context *ctx, + const char *path, const char *password ); + +/** \ingroup pk_module */ +/** + * \brief Load and parse a public key + * + * \param ctx The PK context to fill. It must have been initialized + * but not set up. + * \param path filename to read the public key from + * + * \note On entry, ctx must be empty, either freshly initialised + * with mbedtls_pk_init() or reset with mbedtls_pk_free(). If + * you need a specific key type, check the result with + * mbedtls_pk_can_do(). + * + * \note The key is also checked for correctness. + * + * \return 0 if successful, or a specific PK or PEM error code + */ +int mbedtls_pk_parse_public_keyfile( mbedtls_pk_context *ctx, const char *path ); +#endif /* MBEDTLS_FS_IO */ +#endif /* MBEDTLS_PK_PARSE_C */ + +#if defined(MBEDTLS_PK_WRITE_C) +/** + * \brief Write a private key to a PKCS#1 or SEC1 DER structure + * Note: data is written at the end of the buffer! Use the + * return value to determine where you should start + * using the buffer + * + * \param ctx PK context which must contain a valid private key. + * \param buf buffer to write to + * \param size size of the buffer + * + * \return length of data written if successful, or a specific + * error code + */ +int mbedtls_pk_write_key_der( mbedtls_pk_context *ctx, unsigned char *buf, size_t size ); + +/** + * \brief Write a public key to a SubjectPublicKeyInfo DER structure + * Note: data is written at the end of the buffer! Use the + * return value to determine where you should start + * using the buffer + * + * \param ctx PK context which must contain a valid public or private key. + * \param buf buffer to write to + * \param size size of the buffer + * + * \return length of data written if successful, or a specific + * error code + */ +int mbedtls_pk_write_pubkey_der( mbedtls_pk_context *ctx, unsigned char *buf, size_t size ); + +#if defined(MBEDTLS_PEM_WRITE_C) +/** + * \brief Write a public key to a PEM string + * + * \param ctx PK context which must contain a valid public or private key. + * \param buf Buffer to write to. The output includes a + * terminating null byte. + * \param size Size of the buffer in bytes. + * + * \return 0 if successful, or a specific error code + */ +int mbedtls_pk_write_pubkey_pem( mbedtls_pk_context *ctx, unsigned char *buf, size_t size ); + +/** + * \brief Write a private key to a PKCS#1 or SEC1 PEM string + * + * \param ctx PK context which must contain a valid private key. + * \param buf Buffer to write to. The output includes a + * terminating null byte. + * \param size Size of the buffer in bytes. + * + * \return 0 if successful, or a specific error code + */ +int mbedtls_pk_write_key_pem( mbedtls_pk_context *ctx, unsigned char *buf, size_t size ); +#endif /* MBEDTLS_PEM_WRITE_C */ +#endif /* MBEDTLS_PK_WRITE_C */ + +/* + * WARNING: Low-level functions. You probably do not want to use these unless + * you are certain you do ;) + */ + +#if defined(MBEDTLS_PK_PARSE_C) +/** + * \brief Parse a SubjectPublicKeyInfo DER structure + * + * \param p the position in the ASN.1 data + * \param end end of the buffer + * \param pk The PK context to fill. It must have been initialized + * but not set up. + * + * \return 0 if successful, or a specific PK error code + */ +int mbedtls_pk_parse_subpubkey( unsigned char **p, const unsigned char *end, + mbedtls_pk_context *pk ); +#endif /* MBEDTLS_PK_PARSE_C */ + +#if defined(MBEDTLS_PK_WRITE_C) +/** + * \brief Write a subjectPublicKey to ASN.1 data + * Note: function works backwards in data buffer + * + * \param p reference to current position pointer + * \param start start of the buffer (for bounds-checking) + * \param key PK context which must contain a valid public or private key. + * + * \return the length written or a negative error code + */ +int mbedtls_pk_write_pubkey( unsigned char **p, unsigned char *start, + const mbedtls_pk_context *key ); +#endif /* MBEDTLS_PK_WRITE_C */ + +/* + * Internal module functions. You probably do not want to use these unless you + * know you do. + */ +#if defined(MBEDTLS_FS_IO) +int mbedtls_pk_load_file( const char *path, unsigned char **buf, size_t *n ); +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +/** + * \brief Turn an EC key into an opaque one. + * + * \warning This is a temporary utility function for tests. It might + * change or be removed at any time without notice. + * + * \note Only ECDSA keys are supported so far. Signing with the + * specified hash is the only allowed use of that key. + * + * \param pk Input: the EC key to import to a PSA key. + * Output: a PK context wrapping that PSA key. + * \param key Output: a PSA key identifier. + * It's the caller's responsibility to call + * psa_destroy_key() on that key identifier after calling + * mbedtls_pk_free() on the PK context. + * \param hash_alg The hash algorithm to allow for use with that key. + * + * \return \c 0 if successful. + * \return An Mbed TLS error code otherwise. + */ +int mbedtls_pk_wrap_as_opaque( mbedtls_pk_context *pk, + psa_key_id_t *key, + psa_algorithm_t hash_alg ); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_PK_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/pk_internal.h b/openharmony/arm64-v8a/include/mbedtls/pk_internal.h new file mode 100644 index 00000000..47f77677 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/pk_internal.h @@ -0,0 +1,140 @@ +/** + * \file pk_internal.h + * + * \brief Public Key abstraction layer: wrapper functions + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_PK_WRAP_H +#define MBEDTLS_PK_WRAP_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/pk.h" + +struct mbedtls_pk_info_t +{ + /** Public key type */ + mbedtls_pk_type_t type; + + /** Type name */ + const char *name; + + /** Get key size in bits */ + size_t (*get_bitlen)( const void * ); + + /** Tell if the context implements this type (e.g. ECKEY can do ECDSA) */ + int (*can_do)( mbedtls_pk_type_t type ); + + /** Verify signature */ + int (*verify_func)( void *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + const unsigned char *sig, size_t sig_len ); + + /** Make signature */ + int (*sign_func)( void *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + unsigned char *sig, size_t *sig_len, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) + /** Verify signature (restartable) */ + int (*verify_rs_func)( void *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + const unsigned char *sig, size_t sig_len, + void *rs_ctx ); + + /** Make signature (restartable) */ + int (*sign_rs_func)( void *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + unsigned char *sig, size_t *sig_len, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, void *rs_ctx ); +#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ + + /** Decrypt message */ + int (*decrypt_func)( void *ctx, const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen, size_t osize, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + + /** Encrypt message */ + int (*encrypt_func)( void *ctx, const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen, size_t osize, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + + /** Check public-private key pair */ + int (*check_pair_func)( const void *pub, const void *prv ); + + /** Allocate a new context */ + void * (*ctx_alloc_func)( void ); + + /** Free the given context */ + void (*ctx_free_func)( void *ctx ); + +#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) + /** Allocate the restart context */ + void * (*rs_alloc_func)( void ); + + /** Free the restart context */ + void (*rs_free_func)( void *rs_ctx ); +#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ + + /** Interface with the debug module */ + void (*debug_func)( const void *ctx, mbedtls_pk_debug_item *items ); + +}; +#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT) +/* Container for RSA-alt */ +typedef struct +{ + void *key; + mbedtls_pk_rsa_alt_decrypt_func decrypt_func; + mbedtls_pk_rsa_alt_sign_func sign_func; + mbedtls_pk_rsa_alt_key_len_func key_len_func; +} mbedtls_rsa_alt_context; +#endif + +#if defined(MBEDTLS_RSA_C) +extern const mbedtls_pk_info_t mbedtls_rsa_info; +#endif + +#if defined(MBEDTLS_ECP_C) +extern const mbedtls_pk_info_t mbedtls_eckey_info; +extern const mbedtls_pk_info_t mbedtls_eckeydh_info; +#endif + +#if defined(MBEDTLS_ECDSA_C) +extern const mbedtls_pk_info_t mbedtls_ecdsa_info; +#endif + +#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT) +extern const mbedtls_pk_info_t mbedtls_rsa_alt_info; +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +extern const mbedtls_pk_info_t mbedtls_pk_opaque_info; +#endif + +#endif /* MBEDTLS_PK_WRAP_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/pkcs11.h b/openharmony/arm64-v8a/include/mbedtls/pkcs11.h new file mode 100644 index 00000000..3530ee16 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/pkcs11.h @@ -0,0 +1,246 @@ +/** + * \file pkcs11.h + * + * \brief Wrapper for PKCS#11 library libpkcs11-helper + * + * \author Adriaan de Jong + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_PKCS11_H +#define MBEDTLS_PKCS11_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#if defined(MBEDTLS_PKCS11_C) + +#include "mbedtls/x509_crt.h" + +#include + +#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \ + !defined(inline) && !defined(__cplusplus) +#define inline __inline +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(MBEDTLS_DEPRECATED_REMOVED) + +/** + * Context for PKCS #11 private keys. + */ +typedef struct mbedtls_pkcs11_context +{ + pkcs11h_certificate_t pkcs11h_cert; + int len; +} mbedtls_pkcs11_context; + +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif + +/** + * Initialize a mbedtls_pkcs11_context. + * (Just making memory references valid.) + * + * \deprecated This function is deprecated and will be removed in a + * future version of the library. + */ +MBEDTLS_DEPRECATED void mbedtls_pkcs11_init( mbedtls_pkcs11_context *ctx ); + +/** + * Fill in a mbed TLS certificate, based on the given PKCS11 helper certificate. + * + * \deprecated This function is deprecated and will be removed in a + * future version of the library. + * + * \param cert X.509 certificate to fill + * \param pkcs11h_cert PKCS #11 helper certificate + * + * \return 0 on success. + */ +MBEDTLS_DEPRECATED int mbedtls_pkcs11_x509_cert_bind( mbedtls_x509_crt *cert, + pkcs11h_certificate_t pkcs11h_cert ); + +/** + * Set up a mbedtls_pkcs11_context storing the given certificate. Note that the + * mbedtls_pkcs11_context will take over control of the certificate, freeing it when + * done. + * + * \deprecated This function is deprecated and will be removed in a + * future version of the library. + * + * \param priv_key Private key structure to fill. + * \param pkcs11_cert PKCS #11 helper certificate + * + * \return 0 on success + */ +MBEDTLS_DEPRECATED int mbedtls_pkcs11_priv_key_bind( + mbedtls_pkcs11_context *priv_key, + pkcs11h_certificate_t pkcs11_cert ); + +/** + * Free the contents of the given private key context. Note that the structure + * itself is not freed. + * + * \deprecated This function is deprecated and will be removed in a + * future version of the library. + * + * \param priv_key Private key structure to cleanup + */ +MBEDTLS_DEPRECATED void mbedtls_pkcs11_priv_key_free( + mbedtls_pkcs11_context *priv_key ); + +/** + * \brief Do an RSA private key decrypt, then remove the message + * padding + * + * \deprecated This function is deprecated and will be removed in a future + * version of the library. + * + * \param ctx PKCS #11 context + * \param mode must be MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's signature + * \param input buffer holding the encrypted data + * \param output buffer that will hold the plaintext + * \param olen will contain the plaintext length + * \param output_max_len maximum length of the output buffer + * + * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code + * + * \note The output buffer must be as large as the size + * of ctx->N (eg. 128 bytes if RSA-1024 is used) otherwise + * an error is thrown. + */ +MBEDTLS_DEPRECATED int mbedtls_pkcs11_decrypt( mbedtls_pkcs11_context *ctx, + int mode, size_t *olen, + const unsigned char *input, + unsigned char *output, + size_t output_max_len ); + +/** + * \brief Do a private RSA to sign a message digest + * + * \deprecated This function is deprecated and will be removed in a future + * version of the library. + * + * \param ctx PKCS #11 context + * \param mode must be MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's signature + * \param md_alg a MBEDTLS_MD_XXX (use MBEDTLS_MD_NONE for signing raw data) + * \param hashlen message digest length (for MBEDTLS_MD_NONE only) + * \param hash buffer holding the message digest + * \param sig buffer that will hold the ciphertext + * + * \return 0 if the signing operation was successful, + * or an MBEDTLS_ERR_RSA_XXX error code + * + * \note The "sig" buffer must be as large as the size + * of ctx->N (eg. 128 bytes if RSA-1024 is used). + */ +MBEDTLS_DEPRECATED int mbedtls_pkcs11_sign( mbedtls_pkcs11_context *ctx, + int mode, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + unsigned char *sig ); + +/** + * SSL/TLS wrappers for PKCS#11 functions + * + * \deprecated This function is deprecated and will be removed in a future + * version of the library. + */ +MBEDTLS_DEPRECATED static inline int mbedtls_ssl_pkcs11_decrypt( void *ctx, + int mode, size_t *olen, + const unsigned char *input, unsigned char *output, + size_t output_max_len ) +{ + return mbedtls_pkcs11_decrypt( (mbedtls_pkcs11_context *) ctx, mode, olen, input, output, + output_max_len ); +} + +/** + * \brief This function signs a message digest using RSA. + * + * \deprecated This function is deprecated and will be removed in a future + * version of the library. + * + * \param ctx The PKCS #11 context. + * \param f_rng The RNG function. This parameter is unused. + * \param p_rng The RNG context. This parameter is unused. + * \param mode The operation to run. This must be set to + * MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's + * signature. + * \param md_alg The message digest algorithm. One of the MBEDTLS_MD_XXX + * must be passed to this function and MBEDTLS_MD_NONE can be + * used for signing raw data. + * \param hashlen The message digest length (for MBEDTLS_MD_NONE only). + * \param hash The buffer holding the message digest. + * \param sig The buffer that will hold the ciphertext. + * + * \return \c 0 if the signing operation was successful. + * \return A non-zero error code on failure. + * + * \note The \p sig buffer must be as large as the size of + * ctx->N. For example, 128 bytes if RSA-1024 is + * used. + */ +MBEDTLS_DEPRECATED static inline int mbedtls_ssl_pkcs11_sign( void *ctx, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, + int mode, mbedtls_md_type_t md_alg, unsigned int hashlen, + const unsigned char *hash, unsigned char *sig ) +{ + ((void) f_rng); + ((void) p_rng); + return mbedtls_pkcs11_sign( (mbedtls_pkcs11_context *) ctx, mode, md_alg, + hashlen, hash, sig ); +} + +/** + * This function gets the length of the private key. + * + * \deprecated This function is deprecated and will be removed in a future + * version of the library. + * + * \param ctx The PKCS #11 context. + * + * \return The length of the private key. + */ +MBEDTLS_DEPRECATED static inline size_t mbedtls_ssl_pkcs11_key_len( void *ctx ) +{ + return ( (mbedtls_pkcs11_context *) ctx )->len; +} + +#undef MBEDTLS_DEPRECATED + +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_PKCS11_C */ + +#endif /* MBEDTLS_PKCS11_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/pkcs12.h b/openharmony/arm64-v8a/include/mbedtls/pkcs12.h new file mode 100644 index 00000000..d9e85b1d --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/pkcs12.h @@ -0,0 +1,140 @@ +/** + * \file pkcs12.h + * + * \brief PKCS#12 Personal Information Exchange Syntax + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_PKCS12_H +#define MBEDTLS_PKCS12_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/md.h" +#include "mbedtls/cipher.h" +#include "mbedtls/asn1.h" + +#include + +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA -0x1F80 +/** Feature not available, e.g. unsupported encryption scheme. */ +#define MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE -0x1F00 +/** PBE ASN.1 data not as expected. */ +#define MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT -0x1E80 +/** Given private key password does not allow for correct decryption. */ +#define MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH -0x1E00 + +#define MBEDTLS_PKCS12_DERIVE_KEY 1 /**< encryption/decryption key */ +#define MBEDTLS_PKCS12_DERIVE_IV 2 /**< initialization vector */ +#define MBEDTLS_PKCS12_DERIVE_MAC_KEY 3 /**< integrity / MAC key */ + +#define MBEDTLS_PKCS12_PBE_DECRYPT 0 +#define MBEDTLS_PKCS12_PBE_ENCRYPT 1 + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(MBEDTLS_ASN1_PARSE_C) + +/** + * \brief PKCS12 Password Based function (encryption / decryption) + * for pbeWithSHAAnd128BitRC4 + * + * \param pbe_params an ASN1 buffer containing the pkcs-12PbeParams structure + * \param mode either MBEDTLS_PKCS12_PBE_ENCRYPT or MBEDTLS_PKCS12_PBE_DECRYPT + * \param pwd the password used (may be NULL if no password is used) + * \param pwdlen length of the password (may be 0) + * \param input the input data + * \param len data length + * \param output the output buffer + * + * \return 0 if successful, or a MBEDTLS_ERR_XXX code + */ +int mbedtls_pkcs12_pbe_sha1_rc4_128( mbedtls_asn1_buf *pbe_params, int mode, + const unsigned char *pwd, size_t pwdlen, + const unsigned char *input, size_t len, + unsigned char *output ); + +/** + * \brief PKCS12 Password Based function (encryption / decryption) + * for cipher-based and mbedtls_md-based PBE's + * + * \param pbe_params an ASN1 buffer containing the pkcs-12 PbeParams structure + * \param mode either #MBEDTLS_PKCS12_PBE_ENCRYPT or + * #MBEDTLS_PKCS12_PBE_DECRYPT + * \param cipher_type the cipher used + * \param md_type the mbedtls_md used + * \param pwd Latin1-encoded password used. This may only be \c NULL when + * \p pwdlen is 0. No null terminator should be used. + * \param pwdlen length of the password (may be 0) + * \param input the input data + * \param len data length + * \param output the output buffer + * + * \return 0 if successful, or a MBEDTLS_ERR_XXX code + */ +int mbedtls_pkcs12_pbe( mbedtls_asn1_buf *pbe_params, int mode, + mbedtls_cipher_type_t cipher_type, mbedtls_md_type_t md_type, + const unsigned char *pwd, size_t pwdlen, + const unsigned char *input, size_t len, + unsigned char *output ); + +#endif /* MBEDTLS_ASN1_PARSE_C */ + +/** + * \brief The PKCS#12 derivation function uses a password and a salt + * to produce pseudo-random bits for a particular "purpose". + * + * Depending on the given id, this function can produce an + * encryption/decryption key, an initialization vector or an + * integrity key. + * + * \param data buffer to store the derived data in + * \param datalen length of buffer to fill + * \param pwd The password to use. For compliance with PKCS#12 §B.1, this + * should be a BMPString, i.e. a Unicode string where each + * character is encoded as 2 bytes in big-endian order, with + * no byte order mark and with a null terminator (i.e. the + * last two bytes should be 0x00 0x00). + * \param pwdlen length of the password (may be 0). + * \param salt Salt buffer to use This may only be \c NULL when + * \p saltlen is 0. + * \param saltlen length of the salt (may be zero) + * \param mbedtls_md mbedtls_md type to use during the derivation + * \param id id that describes the purpose (can be + * #MBEDTLS_PKCS12_DERIVE_KEY, #MBEDTLS_PKCS12_DERIVE_IV or + * #MBEDTLS_PKCS12_DERIVE_MAC_KEY) + * \param iterations number of iterations + * + * \return 0 if successful, or a MD, BIGNUM type error. + */ +int mbedtls_pkcs12_derivation( unsigned char *data, size_t datalen, + const unsigned char *pwd, size_t pwdlen, + const unsigned char *salt, size_t saltlen, + mbedtls_md_type_t mbedtls_md, int id, int iterations ); + +#ifdef __cplusplus +} +#endif + +#endif /* pkcs12.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/pkcs5.h b/openharmony/arm64-v8a/include/mbedtls/pkcs5.h new file mode 100644 index 00000000..696930f7 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/pkcs5.h @@ -0,0 +1,111 @@ +/** + * \file pkcs5.h + * + * \brief PKCS#5 functions + * + * \author Mathias Olsson + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_PKCS5_H +#define MBEDTLS_PKCS5_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/asn1.h" +#include "mbedtls/md.h" + +#include +#include + +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA -0x2f80 +/** Unexpected ASN.1 data. */ +#define MBEDTLS_ERR_PKCS5_INVALID_FORMAT -0x2f00 +/** Requested encryption or digest alg not available. */ +#define MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE -0x2e80 +/** Given private key password does not allow for correct decryption. */ +#define MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH -0x2e00 + +#define MBEDTLS_PKCS5_DECRYPT 0 +#define MBEDTLS_PKCS5_ENCRYPT 1 + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(MBEDTLS_ASN1_PARSE_C) + +/** + * \brief PKCS#5 PBES2 function + * + * \param pbe_params the ASN.1 algorithm parameters + * \param mode either MBEDTLS_PKCS5_DECRYPT or MBEDTLS_PKCS5_ENCRYPT + * \param pwd password to use when generating key + * \param pwdlen length of password + * \param data data to process + * \param datalen length of data + * \param output output buffer + * + * \returns 0 on success, or a MBEDTLS_ERR_XXX code if verification fails. + */ +int mbedtls_pkcs5_pbes2( const mbedtls_asn1_buf *pbe_params, int mode, + const unsigned char *pwd, size_t pwdlen, + const unsigned char *data, size_t datalen, + unsigned char *output ); + +#endif /* MBEDTLS_ASN1_PARSE_C */ + +/** + * \brief PKCS#5 PBKDF2 using HMAC + * + * \param ctx Generic HMAC context + * \param password Password to use when generating key + * \param plen Length of password + * \param salt Salt to use when generating key + * \param slen Length of salt + * \param iteration_count Iteration count + * \param key_length Length of generated key in bytes + * \param output Generated key. Must be at least as big as key_length + * + * \returns 0 on success, or a MBEDTLS_ERR_XXX code if verification fails. + */ +int mbedtls_pkcs5_pbkdf2_hmac( mbedtls_md_context_t *ctx, const unsigned char *password, + size_t plen, const unsigned char *salt, size_t slen, + unsigned int iteration_count, + uint32_t key_length, unsigned char *output ); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_pkcs5_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* pkcs5.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/platform.h b/openharmony/arm64-v8a/include/mbedtls/platform.h new file mode 100644 index 00000000..06dd192e --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/platform.h @@ -0,0 +1,421 @@ +/** + * \file platform.h + * + * \brief This file contains the definitions and functions of the + * Mbed TLS platform abstraction layer. + * + * The platform abstraction layer removes the need for the library + * to directly link to standard C library functions or operating + * system services, making the library easier to port and embed. + * Application developers and users of the library can provide their own + * implementations of these functions, or implementations specific to + * their platform, which can be statically linked to the library or + * dynamically configured at runtime. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_PLATFORM_H +#define MBEDTLS_PLATFORM_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#if defined(MBEDTLS_HAVE_TIME) +#include "mbedtls/platform_time.h" +#endif + +/** Hardware accelerator failed */ +#define MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED -0x0070 +/** The requested feature is not supported by the platform */ +#define MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED -0x0072 + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h or define them on the compiler command line. + * \{ + */ + +/* The older Microsoft Windows common runtime provides non-conforming + * implementations of some standard library functions, including snprintf + * and vsnprintf. This affects MSVC and MinGW builds. + */ +#if defined(__MINGW32__) || (defined(_MSC_VER) && _MSC_VER <= 1900) +#define MBEDTLS_PLATFORM_HAS_NON_CONFORMING_SNPRINTF +#define MBEDTLS_PLATFORM_HAS_NON_CONFORMING_VSNPRINTF +#endif + +#if !defined(MBEDTLS_PLATFORM_NO_STD_FUNCTIONS) +#include +#include +#if defined(MBEDTLS_HAVE_TIME) +#include +#endif +#if !defined(MBEDTLS_PLATFORM_STD_SNPRINTF) +#if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_SNPRINTF) +#define MBEDTLS_PLATFORM_STD_SNPRINTF mbedtls_platform_win32_snprintf /**< The default \c snprintf function to use. */ +#else +#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< The default \c snprintf function to use. */ +#endif +#endif +#if !defined(MBEDTLS_PLATFORM_STD_VSNPRINTF) +#if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_VSNPRINTF) +#define MBEDTLS_PLATFORM_STD_VSNPRINTF mbedtls_platform_win32_vsnprintf /**< The default \c vsnprintf function to use. */ +#else +#define MBEDTLS_PLATFORM_STD_VSNPRINTF vsnprintf /**< The default \c vsnprintf function to use. */ +#endif +#endif +#if !defined(MBEDTLS_PLATFORM_STD_PRINTF) +#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< The default \c printf function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_FPRINTF) +#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< The default \c fprintf function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_CALLOC) +#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< The default \c calloc function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_FREE) +#define MBEDTLS_PLATFORM_STD_FREE free /**< The default \c free function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_EXIT) +#define MBEDTLS_PLATFORM_STD_EXIT exit /**< The default \c exit function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_TIME) +#define MBEDTLS_PLATFORM_STD_TIME time /**< The default \c time function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_EXIT_SUCCESS) +#define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS EXIT_SUCCESS /**< The default exit value to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_EXIT_FAILURE) +#define MBEDTLS_PLATFORM_STD_EXIT_FAILURE EXIT_FAILURE /**< The default exit value to use. */ +#endif +#if defined(MBEDTLS_FS_IO) +#if !defined(MBEDTLS_PLATFORM_STD_NV_SEED_READ) +#define MBEDTLS_PLATFORM_STD_NV_SEED_READ mbedtls_platform_std_nv_seed_read +#endif +#if !defined(MBEDTLS_PLATFORM_STD_NV_SEED_WRITE) +#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write +#endif +#if !defined(MBEDTLS_PLATFORM_STD_NV_SEED_FILE) +#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" +#endif +#endif /* MBEDTLS_FS_IO */ +#else /* MBEDTLS_PLATFORM_NO_STD_FUNCTIONS */ +#if defined(MBEDTLS_PLATFORM_STD_MEM_HDR) +#include MBEDTLS_PLATFORM_STD_MEM_HDR +#endif +#endif /* MBEDTLS_PLATFORM_NO_STD_FUNCTIONS */ + + +/** \} name SECTION: Module settings */ + +/* + * The function pointers for calloc and free. + */ +#if defined(MBEDTLS_PLATFORM_MEMORY) +#if defined(MBEDTLS_PLATFORM_FREE_MACRO) && \ + defined(MBEDTLS_PLATFORM_CALLOC_MACRO) +#define mbedtls_free MBEDTLS_PLATFORM_FREE_MACRO +#define mbedtls_calloc MBEDTLS_PLATFORM_CALLOC_MACRO +#else +/* For size_t */ +#include +extern void *mbedtls_calloc( size_t n, size_t size ); +extern void mbedtls_free( void *ptr ); + +/** + * \brief This function dynamically sets the memory-management + * functions used by the library, during runtime. + * + * \param calloc_func The \c calloc function implementation. + * \param free_func The \c free function implementation. + * + * \return \c 0. + */ +int mbedtls_platform_set_calloc_free( void * (*calloc_func)( size_t, size_t ), + void (*free_func)( void * ) ); +#endif /* MBEDTLS_PLATFORM_FREE_MACRO && MBEDTLS_PLATFORM_CALLOC_MACRO */ +#else /* !MBEDTLS_PLATFORM_MEMORY */ +#define mbedtls_free free +#define mbedtls_calloc calloc +#endif /* MBEDTLS_PLATFORM_MEMORY && !MBEDTLS_PLATFORM_{FREE,CALLOC}_MACRO */ + +/* + * The function pointers for fprintf + */ +#if defined(MBEDTLS_PLATFORM_FPRINTF_ALT) +/* We need FILE * */ +#include +extern int (*mbedtls_fprintf)( FILE *stream, const char *format, ... ); + +/** + * \brief This function dynamically configures the fprintf + * function that is called when the + * mbedtls_fprintf() function is invoked by the library. + * + * \param fprintf_func The \c fprintf function implementation. + * + * \return \c 0. + */ +int mbedtls_platform_set_fprintf( int (*fprintf_func)( FILE *stream, const char *, + ... ) ); +#else +#if defined(MBEDTLS_PLATFORM_FPRINTF_MACRO) +#define mbedtls_fprintf MBEDTLS_PLATFORM_FPRINTF_MACRO +#else +#define mbedtls_fprintf fprintf +#endif /* MBEDTLS_PLATFORM_FPRINTF_MACRO */ +#endif /* MBEDTLS_PLATFORM_FPRINTF_ALT */ + +/* + * The function pointers for printf + */ +#if defined(MBEDTLS_PLATFORM_PRINTF_ALT) +extern int (*mbedtls_printf)( const char *format, ... ); + +/** + * \brief This function dynamically configures the snprintf + * function that is called when the mbedtls_snprintf() + * function is invoked by the library. + * + * \param printf_func The \c printf function implementation. + * + * \return \c 0 on success. + */ +int mbedtls_platform_set_printf( int (*printf_func)( const char *, ... ) ); +#else /* !MBEDTLS_PLATFORM_PRINTF_ALT */ +#if defined(MBEDTLS_PLATFORM_PRINTF_MACRO) +#define mbedtls_printf MBEDTLS_PLATFORM_PRINTF_MACRO +#else +#define mbedtls_printf printf +#endif /* MBEDTLS_PLATFORM_PRINTF_MACRO */ +#endif /* MBEDTLS_PLATFORM_PRINTF_ALT */ + +/* + * The function pointers for snprintf + * + * The snprintf implementation should conform to C99: + * - it *must* always correctly zero-terminate the buffer + * (except when n == 0, then it must leave the buffer untouched) + * - however it is acceptable to return -1 instead of the required length when + * the destination buffer is too short. + */ +#if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_SNPRINTF) +/* For Windows (inc. MSYS2), we provide our own fixed implementation */ +int mbedtls_platform_win32_snprintf( char *s, size_t n, const char *fmt, ... ); +#endif + +#if defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) +extern int (*mbedtls_snprintf)( char * s, size_t n, const char * format, ... ); + +/** + * \brief This function allows configuring a custom + * \c snprintf function pointer. + * + * \param snprintf_func The \c snprintf function implementation. + * + * \return \c 0 on success. + */ +int mbedtls_platform_set_snprintf( int (*snprintf_func)( char * s, size_t n, + const char * format, ... ) ); +#else /* MBEDTLS_PLATFORM_SNPRINTF_ALT */ +#if defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) +#define mbedtls_snprintf MBEDTLS_PLATFORM_SNPRINTF_MACRO +#else +#define mbedtls_snprintf MBEDTLS_PLATFORM_STD_SNPRINTF +#endif /* MBEDTLS_PLATFORM_SNPRINTF_MACRO */ +#endif /* MBEDTLS_PLATFORM_SNPRINTF_ALT */ + +/* + * The function pointers for vsnprintf + * + * The vsnprintf implementation should conform to C99: + * - it *must* always correctly zero-terminate the buffer + * (except when n == 0, then it must leave the buffer untouched) + * - however it is acceptable to return -1 instead of the required length when + * the destination buffer is too short. + */ +#if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_VSNPRINTF) +#include +/* For Older Windows (inc. MSYS2), we provide our own fixed implementation */ +int mbedtls_platform_win32_vsnprintf( char *s, size_t n, const char *fmt, va_list arg ); +#endif + +#if defined(MBEDTLS_PLATFORM_VSNPRINTF_ALT) +#include +extern int (*mbedtls_vsnprintf)( char * s, size_t n, const char * format, va_list arg ); + +/** + * \brief Set your own snprintf function pointer + * + * \param vsnprintf_func The \c vsnprintf function implementation + * + * \return \c 0 + */ +int mbedtls_platform_set_vsnprintf( int (*vsnprintf_func)( char * s, size_t n, + const char * format, va_list arg ) ); +#else /* MBEDTLS_PLATFORM_VSNPRINTF_ALT */ +#if defined(MBEDTLS_PLATFORM_VSNPRINTF_MACRO) +#define mbedtls_vsnprintf MBEDTLS_PLATFORM_VSNPRINTF_MACRO +#else +#define mbedtls_vsnprintf vsnprintf +#endif /* MBEDTLS_PLATFORM_VSNPRINTF_MACRO */ +#endif /* MBEDTLS_PLATFORM_VSNPRINTF_ALT */ + +/* + * The function pointers for exit + */ +#if defined(MBEDTLS_PLATFORM_EXIT_ALT) +extern void (*mbedtls_exit)( int status ); + +/** + * \brief This function dynamically configures the exit + * function that is called when the mbedtls_exit() + * function is invoked by the library. + * + * \param exit_func The \c exit function implementation. + * + * \return \c 0 on success. + */ +int mbedtls_platform_set_exit( void (*exit_func)( int status ) ); +#else +#if defined(MBEDTLS_PLATFORM_EXIT_MACRO) +#define mbedtls_exit MBEDTLS_PLATFORM_EXIT_MACRO +#else +#define mbedtls_exit exit +#endif /* MBEDTLS_PLATFORM_EXIT_MACRO */ +#endif /* MBEDTLS_PLATFORM_EXIT_ALT */ + +/* + * The default exit values + */ +#if defined(MBEDTLS_PLATFORM_STD_EXIT_SUCCESS) +#define MBEDTLS_EXIT_SUCCESS MBEDTLS_PLATFORM_STD_EXIT_SUCCESS +#else +#define MBEDTLS_EXIT_SUCCESS 0 +#endif +#if defined(MBEDTLS_PLATFORM_STD_EXIT_FAILURE) +#define MBEDTLS_EXIT_FAILURE MBEDTLS_PLATFORM_STD_EXIT_FAILURE +#else +#define MBEDTLS_EXIT_FAILURE 1 +#endif + +/* + * The function pointers for reading from and writing a seed file to + * Non-Volatile storage (NV) in a platform-independent way + * + * Only enabled when the NV seed entropy source is enabled + */ +#if defined(MBEDTLS_ENTROPY_NV_SEED) +#if !defined(MBEDTLS_PLATFORM_NO_STD_FUNCTIONS) && defined(MBEDTLS_FS_IO) +/* Internal standard platform definitions */ +int mbedtls_platform_std_nv_seed_read( unsigned char *buf, size_t buf_len ); +int mbedtls_platform_std_nv_seed_write( unsigned char *buf, size_t buf_len ); +#endif + +#if defined(MBEDTLS_PLATFORM_NV_SEED_ALT) +extern int (*mbedtls_nv_seed_read)( unsigned char *buf, size_t buf_len ); +extern int (*mbedtls_nv_seed_write)( unsigned char *buf, size_t buf_len ); + +/** + * \brief This function allows configuring custom seed file writing and + * reading functions. + * + * \param nv_seed_read_func The seed reading function implementation. + * \param nv_seed_write_func The seed writing function implementation. + * + * \return \c 0 on success. + */ +int mbedtls_platform_set_nv_seed( + int (*nv_seed_read_func)( unsigned char *buf, size_t buf_len ), + int (*nv_seed_write_func)( unsigned char *buf, size_t buf_len ) + ); +#else +#if defined(MBEDTLS_PLATFORM_NV_SEED_READ_MACRO) && \ + defined(MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO) +#define mbedtls_nv_seed_read MBEDTLS_PLATFORM_NV_SEED_READ_MACRO +#define mbedtls_nv_seed_write MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO +#else +#define mbedtls_nv_seed_read mbedtls_platform_std_nv_seed_read +#define mbedtls_nv_seed_write mbedtls_platform_std_nv_seed_write +#endif +#endif /* MBEDTLS_PLATFORM_NV_SEED_ALT */ +#endif /* MBEDTLS_ENTROPY_NV_SEED */ + +#if !defined(MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT) + +/** + * \brief The platform context structure. + * + * \note This structure may be used to assist platform-specific + * setup or teardown operations. + */ +typedef struct mbedtls_platform_context +{ + char dummy; /**< A placeholder member, as empty structs are not portable. */ +} +mbedtls_platform_context; + +#else +#include "platform_alt.h" +#endif /* !MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT */ + +/** + * \brief This function performs any platform-specific initialization + * operations. + * + * \note This function should be called before any other library functions. + * + * Its implementation is platform-specific, and unless + * platform-specific code is provided, it does nothing. + * + * \note The usage and necessity of this function is dependent on the platform. + * + * \param ctx The platform context. + * + * \return \c 0 on success. + */ +int mbedtls_platform_setup( mbedtls_platform_context *ctx ); +/** + * \brief This function performs any platform teardown operations. + * + * \note This function should be called after every other Mbed TLS module + * has been correctly freed using the appropriate free function. + * + * Its implementation is platform-specific, and unless + * platform-specific code is provided, it does nothing. + * + * \note The usage and necessity of this function is dependent on the platform. + * + * \param ctx The platform context. + * + */ +void mbedtls_platform_teardown( mbedtls_platform_context *ctx ); + +#ifdef __cplusplus +} +#endif + +#endif /* platform.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/platform_time.h b/openharmony/arm64-v8a/include/mbedtls/platform_time.h new file mode 100644 index 00000000..94055711 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/platform_time.h @@ -0,0 +1,72 @@ +/** + * \file platform_time.h + * + * \brief mbed TLS Platform time abstraction + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_PLATFORM_TIME_H +#define MBEDTLS_PLATFORM_TIME_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * The time_t datatype + */ +#if defined(MBEDTLS_PLATFORM_TIME_TYPE_MACRO) +typedef MBEDTLS_PLATFORM_TIME_TYPE_MACRO mbedtls_time_t; +#else +/* For time_t */ +#include +typedef time_t mbedtls_time_t; +#endif /* MBEDTLS_PLATFORM_TIME_TYPE_MACRO */ + +/* + * The function pointers for time + */ +#if defined(MBEDTLS_PLATFORM_TIME_ALT) +extern mbedtls_time_t (*mbedtls_time)( mbedtls_time_t* time ); + +/** + * \brief Set your own time function pointer + * + * \param time_func the time function implementation + * + * \return 0 + */ +int mbedtls_platform_set_time( mbedtls_time_t (*time_func)( mbedtls_time_t* time ) ); +#else +#if defined(MBEDTLS_PLATFORM_TIME_MACRO) +#define mbedtls_time MBEDTLS_PLATFORM_TIME_MACRO +#else +#define mbedtls_time time +#endif /* MBEDTLS_PLATFORM_TIME_MACRO */ +#endif /* MBEDTLS_PLATFORM_TIME_ALT */ + +#ifdef __cplusplus +} +#endif + +#endif /* platform_time.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/platform_util.h b/openharmony/arm64-v8a/include/mbedtls/platform_util.h new file mode 100644 index 00000000..cd112ab5 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/platform_util.h @@ -0,0 +1,283 @@ +/** + * \file platform_util.h + * + * \brief Common and shared functions used by multiple modules in the Mbed TLS + * library. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_PLATFORM_UTIL_H +#define MBEDTLS_PLATFORM_UTIL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#if defined(MBEDTLS_HAVE_TIME_DATE) +#include "mbedtls/platform_time.h" +#include +#endif /* MBEDTLS_HAVE_TIME_DATE */ + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(MBEDTLS_CHECK_PARAMS) + +#if defined(MBEDTLS_CHECK_PARAMS_ASSERT) +/* Allow the user to define MBEDTLS_PARAM_FAILED to something like assert + * (which is what our config.h suggests). */ +#include +#endif /* MBEDTLS_CHECK_PARAMS_ASSERT */ + +#if defined(MBEDTLS_PARAM_FAILED) +/** An alternative definition of MBEDTLS_PARAM_FAILED has been set in config.h. + * + * This flag can be used to check whether it is safe to assume that + * MBEDTLS_PARAM_FAILED() will expand to a call to mbedtls_param_failed(). + */ +#define MBEDTLS_PARAM_FAILED_ALT + +#elif defined(MBEDTLS_CHECK_PARAMS_ASSERT) +#define MBEDTLS_PARAM_FAILED( cond ) assert( cond ) +#define MBEDTLS_PARAM_FAILED_ALT + +#else /* MBEDTLS_PARAM_FAILED */ +#define MBEDTLS_PARAM_FAILED( cond ) \ + mbedtls_param_failed( #cond, __FILE__, __LINE__ ) + +/** + * \brief User supplied callback function for parameter validation failure. + * See #MBEDTLS_CHECK_PARAMS for context. + * + * This function will be called unless an alternative treatment + * is defined through the #MBEDTLS_PARAM_FAILED macro. + * + * This function can return, and the operation will be aborted, or + * alternatively, through use of setjmp()/longjmp() can resume + * execution in the application code. + * + * \param failure_condition The assertion that didn't hold. + * \param file The file where the assertion failed. + * \param line The line in the file where the assertion failed. + */ +void mbedtls_param_failed( const char *failure_condition, + const char *file, + int line ); +#endif /* MBEDTLS_PARAM_FAILED */ + +/* Internal macro meant to be called only from within the library. */ +#define MBEDTLS_INTERNAL_VALIDATE_RET( cond, ret ) \ + do { \ + if( !(cond) ) \ + { \ + MBEDTLS_PARAM_FAILED( cond ); \ + return( ret ); \ + } \ + } while( 0 ) + +/* Internal macro meant to be called only from within the library. */ +#define MBEDTLS_INTERNAL_VALIDATE( cond ) \ + do { \ + if( !(cond) ) \ + { \ + MBEDTLS_PARAM_FAILED( cond ); \ + return; \ + } \ + } while( 0 ) + +#else /* MBEDTLS_CHECK_PARAMS */ + +/* Internal macros meant to be called only from within the library. */ +#define MBEDTLS_INTERNAL_VALIDATE_RET( cond, ret ) do { } while( 0 ) +#define MBEDTLS_INTERNAL_VALIDATE( cond ) do { } while( 0 ) + +#endif /* MBEDTLS_CHECK_PARAMS */ + +/* Internal helper macros for deprecating API constants. */ +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +/* Deliberately don't (yet) export MBEDTLS_DEPRECATED here + * to avoid conflict with other headers which define and use + * it, too. We might want to move all these definitions here at + * some point for uniformity. */ +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +MBEDTLS_DEPRECATED typedef char const * mbedtls_deprecated_string_constant_t; +#define MBEDTLS_DEPRECATED_STRING_CONSTANT( VAL ) \ + ( (mbedtls_deprecated_string_constant_t) ( VAL ) ) +MBEDTLS_DEPRECATED typedef int mbedtls_deprecated_numeric_constant_t; +#define MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( VAL ) \ + ( (mbedtls_deprecated_numeric_constant_t) ( VAL ) ) +#undef MBEDTLS_DEPRECATED +#else /* MBEDTLS_DEPRECATED_WARNING */ +#define MBEDTLS_DEPRECATED_STRING_CONSTANT( VAL ) VAL +#define MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( VAL ) VAL +#endif /* MBEDTLS_DEPRECATED_WARNING */ +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +/* Implementation of the check-return facility. + * See the user documentation in config.h. + * + * Do not use this macro directly to annotate function: instead, + * use one of MBEDTLS_CHECK_RETURN_CRITICAL or MBEDTLS_CHECK_RETURN_TYPICAL + * depending on how important it is to check the return value. + */ +#if !defined(MBEDTLS_CHECK_RETURN) +#if defined(__GNUC__) +#define MBEDTLS_CHECK_RETURN __attribute__((__warn_unused_result__)) +#elif defined(_MSC_VER) && _MSC_VER >= 1700 +#include +#define MBEDTLS_CHECK_RETURN _Check_return_ +#else +#define MBEDTLS_CHECK_RETURN +#endif +#endif + +/** Critical-failure function + * + * This macro appearing at the beginning of the declaration of a function + * indicates that its return value should be checked in all applications. + * Omitting the check is very likely to indicate a bug in the application + * and will result in a compile-time warning if #MBEDTLS_CHECK_RETURN + * is implemented for the compiler in use. + * + * \note The use of this macro is a work in progress. + * This macro may be added to more functions in the future. + * Such an extension is not considered an API break, provided that + * there are near-unavoidable circumstances under which the function + * can fail. For example, signature/MAC/AEAD verification functions, + * and functions that require a random generator, are considered + * return-check-critical. + */ +#define MBEDTLS_CHECK_RETURN_CRITICAL MBEDTLS_CHECK_RETURN + +/** Ordinary-failure function + * + * This macro appearing at the beginning of the declaration of a function + * indicates that its return value should be generally be checked in portable + * applications. Omitting the check will result in a compile-time warning if + * #MBEDTLS_CHECK_RETURN is implemented for the compiler in use and + * #MBEDTLS_CHECK_RETURN_WARNING is enabled in the compile-time configuration. + * + * You can use #MBEDTLS_IGNORE_RETURN to explicitly ignore the return value + * of a function that is annotated with #MBEDTLS_CHECK_RETURN. + * + * \note The use of this macro is a work in progress. + * This macro will be added to more functions in the future. + * Eventually this should appear before most functions returning + * an error code (as \c int in the \c mbedtls_xxx API or + * as ::psa_status_t in the \c psa_xxx API). + */ +#if defined(MBEDTLS_CHECK_RETURN_WARNING) +#define MBEDTLS_CHECK_RETURN_TYPICAL MBEDTLS_CHECK_RETURN +#else +#define MBEDTLS_CHECK_RETURN_TYPICAL +#endif + +/** Benign-failure function + * + * This macro appearing at the beginning of the declaration of a function + * indicates that it is rarely useful to check its return value. + * + * This macro has an empty expansion. It exists for documentation purposes: + * a #MBEDTLS_CHECK_RETURN_OPTIONAL annotation indicates that the function + * has been analyzed for return-check usefulness, whereas the lack of + * an annotation indicates that the function has not been analyzed and its + * return-check usefulness is unknown. + */ +#define MBEDTLS_CHECK_RETURN_OPTIONAL + +/** \def MBEDTLS_IGNORE_RETURN + * + * Call this macro with one argument, a function call, to suppress a warning + * from #MBEDTLS_CHECK_RETURN due to that function call. + */ +#if !defined(MBEDTLS_IGNORE_RETURN) +/* GCC doesn't silence the warning with just (void)(result). + * (void)!(result) is known to work up at least up to GCC 10, as well + * as with Clang and MSVC. + * + * https://gcc.gnu.org/onlinedocs/gcc-3.4.6/gcc/Non_002dbugs.html + * https://stackoverflow.com/questions/40576003/ignoring-warning-wunused-result + * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425#c34 + */ +#define MBEDTLS_IGNORE_RETURN(result) ( (void) !( result ) ) +#endif + +/** + * \brief Securely zeroize a buffer + * + * The function is meant to wipe the data contained in a buffer so + * that it can no longer be recovered even if the program memory + * is later compromised. Call this function on sensitive data + * stored on the stack before returning from a function, and on + * sensitive data stored on the heap before freeing the heap + * object. + * + * It is extremely difficult to guarantee that calls to + * mbedtls_platform_zeroize() are not removed by aggressive + * compiler optimizations in a portable way. For this reason, Mbed + * TLS provides the configuration option + * MBEDTLS_PLATFORM_ZEROIZE_ALT, which allows users to configure + * mbedtls_platform_zeroize() to use a suitable implementation for + * their platform and needs + * + * \param buf Buffer to be zeroized + * \param len Length of the buffer in bytes + * + */ +void mbedtls_platform_zeroize( void *buf, size_t len ); + +#if defined(MBEDTLS_HAVE_TIME_DATE) +/** + * \brief Platform-specific implementation of gmtime_r() + * + * The function is a thread-safe abstraction that behaves + * similarly to the gmtime_r() function from Unix/POSIX. + * + * Mbed TLS will try to identify the underlying platform and + * make use of an appropriate underlying implementation (e.g. + * gmtime_r() for POSIX and gmtime_s() for Windows). If this is + * not possible, then gmtime() will be used. In this case, calls + * from the library to gmtime() will be guarded by the mutex + * mbedtls_threading_gmtime_mutex if MBEDTLS_THREADING_C is + * enabled. It is recommended that calls from outside the library + * are also guarded by this mutex. + * + * If MBEDTLS_PLATFORM_GMTIME_R_ALT is defined, then Mbed TLS will + * unconditionally use the alternative implementation for + * mbedtls_platform_gmtime_r() supplied by the user at compile time. + * + * \param tt Pointer to an object containing time (in seconds) since the + * epoch to be converted + * \param tm_buf Pointer to an object where the results will be stored + * + * \return Pointer to an object of type struct tm on success, otherwise + * NULL + */ +struct tm *mbedtls_platform_gmtime_r( const mbedtls_time_t *tt, + struct tm *tm_buf ); +#endif /* MBEDTLS_HAVE_TIME_DATE */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_PLATFORM_UTIL_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/poly1305.h b/openharmony/arm64-v8a/include/mbedtls/poly1305.h new file mode 100644 index 00000000..a69ede98 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/poly1305.h @@ -0,0 +1,194 @@ +/** + * \file poly1305.h + * + * \brief This file contains Poly1305 definitions and functions. + * + * Poly1305 is a one-time message authenticator that can be used to + * authenticate messages. Poly1305-AES was created by Daniel + * Bernstein https://cr.yp.to/mac/poly1305-20050329.pdf The generic + * Poly1305 algorithm (not tied to AES) was also standardized in RFC + * 7539. + * + * \author Daniel King + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_POLY1305_H +#define MBEDTLS_POLY1305_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +/** Invalid input parameter(s). */ +#define MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA -0x0057 + +/* MBEDTLS_ERR_POLY1305_FEATURE_UNAVAILABLE is deprecated and should not be + * used. */ +/** Feature not available. For example, s part of the API is not implemented. */ +#define MBEDTLS_ERR_POLY1305_FEATURE_UNAVAILABLE -0x0059 + +/* MBEDTLS_ERR_POLY1305_HW_ACCEL_FAILED is deprecated and should not be used. + */ +/** Poly1305 hardware accelerator failed. */ +#define MBEDTLS_ERR_POLY1305_HW_ACCEL_FAILED -0x005B + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_POLY1305_ALT) + +typedef struct mbedtls_poly1305_context +{ + uint32_t r[4]; /** The value for 'r' (low 128 bits of the key). */ + uint32_t s[4]; /** The value for 's' (high 128 bits of the key). */ + uint32_t acc[5]; /** The accumulator number. */ + uint8_t queue[16]; /** The current partial block of data. */ + size_t queue_len; /** The number of bytes stored in 'queue'. */ +} +mbedtls_poly1305_context; + +#else /* MBEDTLS_POLY1305_ALT */ +#include "poly1305_alt.h" +#endif /* MBEDTLS_POLY1305_ALT */ + +/** + * \brief This function initializes the specified Poly1305 context. + * + * It must be the first API called before using + * the context. + * + * It is usually followed by a call to + * \c mbedtls_poly1305_starts(), then one or more calls to + * \c mbedtls_poly1305_update(), then one call to + * \c mbedtls_poly1305_finish(), then finally + * \c mbedtls_poly1305_free(). + * + * \param ctx The Poly1305 context to initialize. This must + * not be \c NULL. + */ +void mbedtls_poly1305_init( mbedtls_poly1305_context *ctx ); + +/** + * \brief This function releases and clears the specified + * Poly1305 context. + * + * \param ctx The Poly1305 context to clear. This may be \c NULL, in which + * case this function is a no-op. If it is not \c NULL, it must + * point to an initialized Poly1305 context. + */ +void mbedtls_poly1305_free( mbedtls_poly1305_context *ctx ); + +/** + * \brief This function sets the one-time authentication key. + * + * \warning The key must be unique and unpredictable for each + * invocation of Poly1305. + * + * \param ctx The Poly1305 context to which the key should be bound. + * This must be initialized. + * \param key The buffer containing the \c 32 Byte (\c 256 Bit) key. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_poly1305_starts( mbedtls_poly1305_context *ctx, + const unsigned char key[32] ); + +/** + * \brief This functions feeds an input buffer into an ongoing + * Poly1305 computation. + * + * It is called between \c mbedtls_cipher_poly1305_starts() and + * \c mbedtls_cipher_poly1305_finish(). + * It can be called repeatedly to process a stream of data. + * + * \param ctx The Poly1305 context to use for the Poly1305 operation. + * This must be initialized and bound to a key. + * \param ilen The length of the input data in Bytes. + * Any value is accepted. + * \param input The buffer holding the input data. + * This pointer can be \c NULL if `ilen == 0`. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_poly1305_update( mbedtls_poly1305_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief This function generates the Poly1305 Message + * Authentication Code (MAC). + * + * \param ctx The Poly1305 context to use for the Poly1305 operation. + * This must be initialized and bound to a key. + * \param mac The buffer to where the MAC is written. This must + * be a writable buffer of length \c 16 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_poly1305_finish( mbedtls_poly1305_context *ctx, + unsigned char mac[16] ); + +/** + * \brief This function calculates the Poly1305 MAC of the input + * buffer with the provided key. + * + * \warning The key must be unique and unpredictable for each + * invocation of Poly1305. + * + * \param key The buffer containing the \c 32 Byte (\c 256 Bit) key. + * \param ilen The length of the input data in Bytes. + * Any value is accepted. + * \param input The buffer holding the input data. + * This pointer can be \c NULL if `ilen == 0`. + * \param mac The buffer to where the MAC is written. This must be + * a writable buffer of length \c 16 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_poly1305_mac( const unsigned char key[32], + const unsigned char *input, + size_t ilen, + unsigned char mac[16] ); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief The Poly1305 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_poly1305_self_test( int verbose ); +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_POLY1305_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/psa_util.h b/openharmony/arm64-v8a/include/mbedtls/psa_util.h new file mode 100644 index 00000000..af7a809e --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/psa_util.h @@ -0,0 +1,512 @@ +/** + * \file psa_util.h + * + * \brief Utility functions for the use of the PSA Crypto library. + * + * \warning This function is not part of the public API and may + * change at any time. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_PSA_UTIL_H +#define MBEDTLS_PSA_UTIL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) + +#include "psa/crypto.h" + +#include "mbedtls/ecp.h" +#include "mbedtls/md.h" +#include "mbedtls/pk.h" +#include "mbedtls/oid.h" + +#include + +/* Translations for symmetric crypto. */ + +static inline psa_key_type_t mbedtls_psa_translate_cipher_type( + mbedtls_cipher_type_t cipher ) +{ + switch( cipher ) + { + case MBEDTLS_CIPHER_AES_128_CCM: + case MBEDTLS_CIPHER_AES_192_CCM: + case MBEDTLS_CIPHER_AES_256_CCM: + case MBEDTLS_CIPHER_AES_128_GCM: + case MBEDTLS_CIPHER_AES_192_GCM: + case MBEDTLS_CIPHER_AES_256_GCM: + case MBEDTLS_CIPHER_AES_128_CBC: + case MBEDTLS_CIPHER_AES_192_CBC: + case MBEDTLS_CIPHER_AES_256_CBC: + case MBEDTLS_CIPHER_AES_128_ECB: + case MBEDTLS_CIPHER_AES_192_ECB: + case MBEDTLS_CIPHER_AES_256_ECB: + return( PSA_KEY_TYPE_AES ); + + /* ARIA not yet supported in PSA. */ + /* case MBEDTLS_CIPHER_ARIA_128_CCM: + case MBEDTLS_CIPHER_ARIA_192_CCM: + case MBEDTLS_CIPHER_ARIA_256_CCM: + case MBEDTLS_CIPHER_ARIA_128_GCM: + case MBEDTLS_CIPHER_ARIA_192_GCM: + case MBEDTLS_CIPHER_ARIA_256_GCM: + case MBEDTLS_CIPHER_ARIA_128_CBC: + case MBEDTLS_CIPHER_ARIA_192_CBC: + case MBEDTLS_CIPHER_ARIA_256_CBC: + return( PSA_KEY_TYPE_ARIA ); */ + + default: + return( 0 ); + } +} + +static inline psa_algorithm_t mbedtls_psa_translate_cipher_mode( + mbedtls_cipher_mode_t mode, size_t taglen ) +{ + switch( mode ) + { + case MBEDTLS_MODE_ECB: + return( PSA_ALG_ECB_NO_PADDING ); + case MBEDTLS_MODE_GCM: + return( PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_GCM, taglen ) ); + case MBEDTLS_MODE_CCM: + return( PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) ); + case MBEDTLS_MODE_CBC: + if( taglen == 0 ) + return( PSA_ALG_CBC_NO_PADDING ); + else + return( 0 ); + default: + return( 0 ); + } +} + +static inline psa_key_usage_t mbedtls_psa_translate_cipher_operation( + mbedtls_operation_t op ) +{ + switch( op ) + { + case MBEDTLS_ENCRYPT: + return( PSA_KEY_USAGE_ENCRYPT ); + case MBEDTLS_DECRYPT: + return( PSA_KEY_USAGE_DECRYPT ); + default: + return( 0 ); + } +} + +/* Translations for hashing. */ + +static inline psa_algorithm_t mbedtls_psa_translate_md( mbedtls_md_type_t md_alg ) +{ + switch( md_alg ) + { +#if defined(MBEDTLS_MD2_C) + case MBEDTLS_MD_MD2: + return( PSA_ALG_MD2 ); +#endif +#if defined(MBEDTLS_MD4_C) + case MBEDTLS_MD_MD4: + return( PSA_ALG_MD4 ); +#endif +#if defined(MBEDTLS_MD5_C) + case MBEDTLS_MD_MD5: + return( PSA_ALG_MD5 ); +#endif +#if defined(MBEDTLS_SHA1_C) + case MBEDTLS_MD_SHA1: + return( PSA_ALG_SHA_1 ); +#endif +#if defined(MBEDTLS_SHA256_C) + case MBEDTLS_MD_SHA224: + return( PSA_ALG_SHA_224 ); + case MBEDTLS_MD_SHA256: + return( PSA_ALG_SHA_256 ); +#endif +#if defined(MBEDTLS_SHA512_C) + case MBEDTLS_MD_SHA384: + return( PSA_ALG_SHA_384 ); + case MBEDTLS_MD_SHA512: + return( PSA_ALG_SHA_512 ); +#endif +#if defined(MBEDTLS_RIPEMD160_C) + case MBEDTLS_MD_RIPEMD160: + return( PSA_ALG_RIPEMD160 ); +#endif + case MBEDTLS_MD_NONE: + return( 0 ); + default: + return( 0 ); + } +} + +/* Translations for ECC. */ + +static inline int mbedtls_psa_get_ecc_oid_from_id( + psa_ecc_family_t curve, size_t bits, + char const **oid, size_t *oid_len ) +{ + switch( curve ) + { + case PSA_ECC_FAMILY_SECP_R1: + switch( bits ) + { +#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) + case 192: + *oid = MBEDTLS_OID_EC_GRP_SECP192R1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP192R1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) + case 224: + *oid = MBEDTLS_OID_EC_GRP_SECP224R1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP224R1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) + case 256: + *oid = MBEDTLS_OID_EC_GRP_SECP256R1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP256R1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) + case 384: + *oid = MBEDTLS_OID_EC_GRP_SECP384R1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP384R1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) + case 521: + *oid = MBEDTLS_OID_EC_GRP_SECP521R1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP521R1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */ + } + break; + case PSA_ECC_FAMILY_SECP_K1: + switch( bits ) + { +#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) + case 192: + *oid = MBEDTLS_OID_EC_GRP_SECP192K1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP192K1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) + case 224: + *oid = MBEDTLS_OID_EC_GRP_SECP224K1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP224K1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) + case 256: + *oid = MBEDTLS_OID_EC_GRP_SECP256K1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP256K1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */ + } + break; + case PSA_ECC_FAMILY_BRAINPOOL_P_R1: + switch( bits ) + { +#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) + case 256: + *oid = MBEDTLS_OID_EC_GRP_BP256R1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_BP256R1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_BP256R1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) + case 384: + *oid = MBEDTLS_OID_EC_GRP_BP384R1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_BP384R1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_BP384R1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) + case 512: + *oid = MBEDTLS_OID_EC_GRP_BP512R1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_BP512R1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */ + } + break; + } + (void) oid; + (void) oid_len; + return( -1 ); +} + +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH 1 + +#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 192 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 192 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 224 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 224 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 256 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 256 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 384 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 384 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 521 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 521 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 192 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 192 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 224 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 224 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 256 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 256 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 256 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 256 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_BP256R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 384 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 384 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_BP384R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 512 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 512 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */ + + +/* Translations for PK layer */ + +static inline int mbedtls_psa_err_translate_pk( psa_status_t status ) +{ + switch( status ) + { + case PSA_SUCCESS: + return( 0 ); + case PSA_ERROR_NOT_SUPPORTED: + return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE ); + case PSA_ERROR_INSUFFICIENT_MEMORY: + return( MBEDTLS_ERR_PK_ALLOC_FAILED ); + case PSA_ERROR_INSUFFICIENT_ENTROPY: + return( MBEDTLS_ERR_ECP_RANDOM_FAILED ); + case PSA_ERROR_BAD_STATE: + return( MBEDTLS_ERR_PK_BAD_INPUT_DATA ); + /* All other failures */ + case PSA_ERROR_COMMUNICATION_FAILURE: + case PSA_ERROR_HARDWARE_FAILURE: + case PSA_ERROR_CORRUPTION_DETECTED: + return( MBEDTLS_ERR_PK_HW_ACCEL_FAILED ); + default: /* We return the same as for the 'other failures', + * but list them separately nonetheless to indicate + * which failure conditions we have considered. */ + return( MBEDTLS_ERR_PK_HW_ACCEL_FAILED ); + } +} + +/* Translations for ECC */ + +/* This function transforms an ECC group identifier from + * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 + * into a PSA ECC group identifier. */ +#if defined(MBEDTLS_ECP_C) +static inline psa_key_type_t mbedtls_psa_parse_tls_ecc_group( + uint16_t tls_ecc_grp_reg_id, size_t *bits ) +{ + const mbedtls_ecp_curve_info *curve_info = + mbedtls_ecp_curve_info_from_tls_id( tls_ecc_grp_reg_id ); + if( curve_info == NULL ) + return( 0 ); + return( PSA_KEY_TYPE_ECC_KEY_PAIR( + mbedtls_ecc_group_to_psa( curve_info->grp_id, bits ) ) ); +} +#endif /* MBEDTLS_ECP_C */ + +/* This function takes a buffer holding an EC public key + * exported through psa_export_public_key(), and converts + * it into an ECPoint structure to be put into a ClientKeyExchange + * message in an ECDHE exchange. + * + * Both the present and the foreseeable future format of EC public keys + * used by PSA have the ECPoint structure contained in the exported key + * as a subbuffer, and the function merely selects this subbuffer instead + * of making a copy. + */ +static inline int mbedtls_psa_tls_psa_ec_to_ecpoint( unsigned char *src, + size_t srclen, + unsigned char **dst, + size_t *dstlen ) +{ + *dst = src; + *dstlen = srclen; + return( 0 ); +} + +/* This function takes a buffer holding an ECPoint structure + * (as contained in a TLS ServerKeyExchange message for ECDHE + * exchanges) and converts it into a format that the PSA key + * agreement API understands. + */ +static inline int mbedtls_psa_tls_ecpoint_to_psa_ec( unsigned char const *src, + size_t srclen, + unsigned char *dst, + size_t dstlen, + size_t *olen ) +{ + if( srclen > dstlen ) + return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ); + + memcpy( dst, src, srclen ); + *olen = srclen; + return( 0 ); +} + +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +/* Expose whatever RNG the PSA subsystem uses to applications using the + * mbedtls_xxx API. The declarations and definitions here need to be + * consistent with the implementation in library/psa_crypto_random_impl.h. + * See that file for implementation documentation. */ +#if defined(MBEDTLS_PSA_CRYPTO_C) + +/* The type of a `f_rng` random generator function that many library functions + * take. + * + * This type name is not part of the Mbed TLS stable API. It may be renamed + * or moved without warning. + */ +typedef int mbedtls_f_rng_t( void *p_rng, unsigned char *output, size_t output_size ); + +#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) + +/** The random generator function for the PSA subsystem. + * + * This function is suitable as the `f_rng` random generator function + * parameter of many `mbedtls_xxx` functions. Use #MBEDTLS_PSA_RANDOM_STATE + * to obtain the \p p_rng parameter. + * + * The implementation of this function depends on the configuration of the + * library. + * + * \note Depending on the configuration, this may be a function or + * a pointer to a function. + * + * \note This function may only be used if the PSA crypto subsystem is active. + * This means that you must call psa_crypto_init() before any call to + * this function, and you must not call this function after calling + * mbedtls_psa_crypto_free(). + * + * \param p_rng The random generator context. This must be + * #MBEDTLS_PSA_RANDOM_STATE. No other state is + * supported. + * \param output The buffer to fill. It must have room for + * \c output_size bytes. + * \param output_size The number of bytes to write to \p output. + * This function may fail if \p output_size is too + * large. It is guaranteed to accept any output size + * requested by Mbed TLS library functions. The + * maximum request size depends on the library + * configuration. + * + * \return \c 0 on success. + * \return An `MBEDTLS_ERR_ENTROPY_xxx`, + * `MBEDTLS_ERR_PLATFORM_xxx, + * `MBEDTLS_ERR_CTR_DRBG_xxx` or + * `MBEDTLS_ERR_HMAC_DRBG_xxx` on error. + */ +int mbedtls_psa_get_random( void *p_rng, + unsigned char *output, + size_t output_size ); + +/** The random generator state for the PSA subsystem. + * + * This macro expands to an expression which is suitable as the `p_rng` + * random generator state parameter of many `mbedtls_xxx` functions. + * It must be used in combination with the random generator function + * mbedtls_psa_get_random(). + * + * The implementation of this macro depends on the configuration of the + * library. Do not make any assumption on its nature. + */ +#define MBEDTLS_PSA_RANDOM_STATE NULL + +#else /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */ + +#if defined(MBEDTLS_CTR_DRBG_C) +#include "mbedtls/ctr_drbg.h" +typedef mbedtls_ctr_drbg_context mbedtls_psa_drbg_context_t; +static mbedtls_f_rng_t *const mbedtls_psa_get_random = mbedtls_ctr_drbg_random; +#elif defined(MBEDTLS_HMAC_DRBG_C) +#include "mbedtls/hmac_drbg.h" +typedef mbedtls_hmac_drbg_context mbedtls_psa_drbg_context_t; +static mbedtls_f_rng_t *const mbedtls_psa_get_random = mbedtls_hmac_drbg_random; +#endif +extern mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state; + +#define MBEDTLS_PSA_RANDOM_STATE mbedtls_psa_random_state + +#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */ + +#endif /* MBEDTLS_PSA_CRYPTO_C */ + +#endif /* MBEDTLS_PSA_UTIL_H */ diff --git a/openharmony/arm64-v8a/include/mbedtls/ripemd160.h b/openharmony/arm64-v8a/include/mbedtls/ripemd160.h new file mode 100644 index 00000000..63270d12 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/ripemd160.h @@ -0,0 +1,236 @@ +/** + * \file ripemd160.h + * + * \brief RIPE MD-160 message digest + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_RIPEMD160_H +#define MBEDTLS_RIPEMD160_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +/* MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED is deprecated and should not be used. + */ +/** RIPEMD160 hardware accelerator failed */ +#define MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED -0x0031 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_RIPEMD160_ALT) +// Regular implementation +// + +/** + * \brief RIPEMD-160 context structure + */ +typedef struct mbedtls_ripemd160_context +{ + uint32_t total[2]; /*!< number of bytes processed */ + uint32_t state[5]; /*!< intermediate digest state */ + unsigned char buffer[64]; /*!< data block being processed */ +} +mbedtls_ripemd160_context; + +#else /* MBEDTLS_RIPEMD160_ALT */ +#include "ripemd160_alt.h" +#endif /* MBEDTLS_RIPEMD160_ALT */ + +/** + * \brief Initialize RIPEMD-160 context + * + * \param ctx RIPEMD-160 context to be initialized + */ +void mbedtls_ripemd160_init( mbedtls_ripemd160_context *ctx ); + +/** + * \brief Clear RIPEMD-160 context + * + * \param ctx RIPEMD-160 context to be cleared + */ +void mbedtls_ripemd160_free( mbedtls_ripemd160_context *ctx ); + +/** + * \brief Clone (the state of) an RIPEMD-160 context + * + * \param dst The destination context + * \param src The context to be cloned + */ +void mbedtls_ripemd160_clone( mbedtls_ripemd160_context *dst, + const mbedtls_ripemd160_context *src ); + +/** + * \brief RIPEMD-160 context setup + * + * \param ctx context to be initialized + * + * \return 0 if successful + */ +int mbedtls_ripemd160_starts_ret( mbedtls_ripemd160_context *ctx ); + +/** + * \brief RIPEMD-160 process buffer + * + * \param ctx RIPEMD-160 context + * \param input buffer holding the data + * \param ilen length of the input data + * + * \return 0 if successful + */ +int mbedtls_ripemd160_update_ret( mbedtls_ripemd160_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief RIPEMD-160 final digest + * + * \param ctx RIPEMD-160 context + * \param output RIPEMD-160 checksum result + * + * \return 0 if successful + */ +int mbedtls_ripemd160_finish_ret( mbedtls_ripemd160_context *ctx, + unsigned char output[20] ); + +/** + * \brief RIPEMD-160 process data block (internal use only) + * + * \param ctx RIPEMD-160 context + * \param data buffer holding one block of data + * + * \return 0 if successful + */ +int mbedtls_internal_ripemd160_process( mbedtls_ripemd160_context *ctx, + const unsigned char data[64] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief RIPEMD-160 context setup + * + * \deprecated Superseded by mbedtls_ripemd160_starts_ret() in 2.7.0 + * + * \param ctx context to be initialized + */ +MBEDTLS_DEPRECATED void mbedtls_ripemd160_starts( + mbedtls_ripemd160_context *ctx ); + +/** + * \brief RIPEMD-160 process buffer + * + * \deprecated Superseded by mbedtls_ripemd160_update_ret() in 2.7.0 + * + * \param ctx RIPEMD-160 context + * \param input buffer holding the data + * \param ilen length of the input data + */ +MBEDTLS_DEPRECATED void mbedtls_ripemd160_update( + mbedtls_ripemd160_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief RIPEMD-160 final digest + * + * \deprecated Superseded by mbedtls_ripemd160_finish_ret() in 2.7.0 + * + * \param ctx RIPEMD-160 context + * \param output RIPEMD-160 checksum result + */ +MBEDTLS_DEPRECATED void mbedtls_ripemd160_finish( + mbedtls_ripemd160_context *ctx, + unsigned char output[20] ); + +/** + * \brief RIPEMD-160 process data block (internal use only) + * + * \deprecated Superseded by mbedtls_internal_ripemd160_process() in 2.7.0 + * + * \param ctx RIPEMD-160 context + * \param data buffer holding one block of data + */ +MBEDTLS_DEPRECATED void mbedtls_ripemd160_process( + mbedtls_ripemd160_context *ctx, + const unsigned char data[64] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief Output = RIPEMD-160( input buffer ) + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output RIPEMD-160 checksum result + * + * \return 0 if successful + */ +int mbedtls_ripemd160_ret( const unsigned char *input, + size_t ilen, + unsigned char output[20] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief Output = RIPEMD-160( input buffer ) + * + * \deprecated Superseded by mbedtls_ripemd160_ret() in 2.7.0 + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output RIPEMD-160 checksum result + */ +MBEDTLS_DEPRECATED void mbedtls_ripemd160( const unsigned char *input, + size_t ilen, + unsigned char output[20] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_ripemd160_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_ripemd160.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/rsa.h b/openharmony/arm64-v8a/include/mbedtls/rsa.h new file mode 100644 index 00000000..062df73a --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/rsa.h @@ -0,0 +1,1351 @@ +/** + * \file rsa.h + * + * \brief This file provides an API for the RSA public-key cryptosystem. + * + * The RSA public-key cryptosystem is defined in Public-Key + * Cryptography Standards (PKCS) #1 v1.5: RSA Encryption + * and Public-Key Cryptography Standards (PKCS) #1 v2.1: + * RSA Cryptography Specifications. + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_RSA_H +#define MBEDTLS_RSA_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/bignum.h" +#include "mbedtls/md.h" + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +/* + * RSA Error codes + */ +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_RSA_BAD_INPUT_DATA -0x4080 +/** Input data contains invalid padding and is rejected. */ +#define MBEDTLS_ERR_RSA_INVALID_PADDING -0x4100 +/** Something failed during generation of a key. */ +#define MBEDTLS_ERR_RSA_KEY_GEN_FAILED -0x4180 +/** Key failed to pass the validity check of the library. */ +#define MBEDTLS_ERR_RSA_KEY_CHECK_FAILED -0x4200 +/** The public key operation failed. */ +#define MBEDTLS_ERR_RSA_PUBLIC_FAILED -0x4280 +/** The private key operation failed. */ +#define MBEDTLS_ERR_RSA_PRIVATE_FAILED -0x4300 +/** The PKCS#1 verification failed. */ +#define MBEDTLS_ERR_RSA_VERIFY_FAILED -0x4380 +/** The output buffer for decryption is not large enough. */ +#define MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE -0x4400 +/** The random generator failed to generate non-zeros. */ +#define MBEDTLS_ERR_RSA_RNG_FAILED -0x4480 + +/* MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION is deprecated and should not be used. + */ +/** The implementation does not offer the requested operation, for example, because of security violations or lack of functionality. */ +#define MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION -0x4500 + +/* MBEDTLS_ERR_RSA_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** RSA hardware accelerator failed. */ +#define MBEDTLS_ERR_RSA_HW_ACCEL_FAILED -0x4580 + +/* + * RSA constants + */ +#define MBEDTLS_RSA_PUBLIC 0 /**< Request private key operation. */ +#define MBEDTLS_RSA_PRIVATE 1 /**< Request public key operation. */ + +#define MBEDTLS_RSA_PKCS_V15 0 /**< Use PKCS#1 v1.5 encoding. */ +#define MBEDTLS_RSA_PKCS_V21 1 /**< Use PKCS#1 v2.1 encoding. */ + +#define MBEDTLS_RSA_SIGN 1 /**< Identifier for RSA signature operations. */ +#define MBEDTLS_RSA_CRYPT 2 /**< Identifier for RSA encryption and decryption operations. */ + +#define MBEDTLS_RSA_SALT_LEN_ANY -1 + +/* + * The above constants may be used even if the RSA module is compile out, + * eg for alternative (PKCS#11) RSA implementations in the PK layers. + */ + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_RSA_ALT) +// Regular implementation +// + +/** + * \brief The RSA context structure. + * + * \note Direct manipulation of the members of this structure + * is deprecated. All manipulation should instead be done through + * the public interface functions. + */ +typedef struct mbedtls_rsa_context +{ + int ver; /*!< Reserved for internal purposes. + * Do not set this field in application + * code. Its meaning might change without + * notice. */ + size_t len; /*!< The size of \p N in Bytes. */ + + mbedtls_mpi N; /*!< The public modulus. */ + mbedtls_mpi E; /*!< The public exponent. */ + + mbedtls_mpi D; /*!< The private exponent. */ + mbedtls_mpi P; /*!< The first prime factor. */ + mbedtls_mpi Q; /*!< The second prime factor. */ + + mbedtls_mpi DP; /*!< D % (P - 1). */ + mbedtls_mpi DQ; /*!< D % (Q - 1). */ + mbedtls_mpi QP; /*!< 1 / (Q % P). */ + + mbedtls_mpi RN; /*!< cached R^2 mod N. */ + + mbedtls_mpi RP; /*!< cached R^2 mod P. */ + mbedtls_mpi RQ; /*!< cached R^2 mod Q. */ + + mbedtls_mpi Vi; /*!< The cached blinding value. */ + mbedtls_mpi Vf; /*!< The cached un-blinding value. */ + + int padding; /*!< Selects padding mode: + #MBEDTLS_RSA_PKCS_V15 for 1.5 padding and + #MBEDTLS_RSA_PKCS_V21 for OAEP or PSS. */ + int hash_id; /*!< Hash identifier of mbedtls_md_type_t type, + as specified in md.h for use in the MGF + mask generating function used in the + EME-OAEP and EMSA-PSS encodings. */ +#if defined(MBEDTLS_THREADING_C) + /* Invariant: the mutex is initialized iff ver != 0. */ + mbedtls_threading_mutex_t mutex; /*!< Thread-safety mutex. */ +#endif +} +mbedtls_rsa_context; + +#else /* MBEDTLS_RSA_ALT */ +#include "rsa_alt.h" +#endif /* MBEDTLS_RSA_ALT */ + +/** + * \brief This function initializes an RSA context. + * + * \note Set padding to #MBEDTLS_RSA_PKCS_V21 for the RSAES-OAEP + * encryption scheme and the RSASSA-PSS signature scheme. + * + * \note The \p hash_id parameter is ignored when using + * #MBEDTLS_RSA_PKCS_V15 padding. + * + * \note The choice of padding mode is strictly enforced for private key + * operations, since there might be security concerns in + * mixing padding modes. For public key operations it is + * a default value, which can be overridden by calling specific + * \c rsa_rsaes_xxx or \c rsa_rsassa_xxx functions. + * + * \note The hash selected in \p hash_id is always used for OEAP + * encryption. For PSS signatures, it is always used for + * making signatures, but can be overridden for verifying them. + * If set to #MBEDTLS_MD_NONE, it is always overridden. + * + * \param ctx The RSA context to initialize. This must not be \c NULL. + * \param padding The padding mode to use. This must be either + * #MBEDTLS_RSA_PKCS_V15 or #MBEDTLS_RSA_PKCS_V21. + * \param hash_id The hash identifier of ::mbedtls_md_type_t type, if + * \p padding is #MBEDTLS_RSA_PKCS_V21. It is unused + * otherwise. + */ +void mbedtls_rsa_init( mbedtls_rsa_context *ctx, + int padding, + int hash_id ); + +/** + * \brief This function imports a set of core parameters into an + * RSA context. + * + * \note This function can be called multiple times for successive + * imports, if the parameters are not simultaneously present. + * + * Any sequence of calls to this function should be followed + * by a call to mbedtls_rsa_complete(), which checks and + * completes the provided information to a ready-for-use + * public or private RSA key. + * + * \note See mbedtls_rsa_complete() for more information on which + * parameters are necessary to set up a private or public + * RSA key. + * + * \note The imported parameters are copied and need not be preserved + * for the lifetime of the RSA context being set up. + * + * \param ctx The initialized RSA context to store the parameters in. + * \param N The RSA modulus. This may be \c NULL. + * \param P The first prime factor of \p N. This may be \c NULL. + * \param Q The second prime factor of \p N. This may be \c NULL. + * \param D The private exponent. This may be \c NULL. + * \param E The public exponent. This may be \c NULL. + * + * \return \c 0 on success. + * \return A non-zero error code on failure. + */ +int mbedtls_rsa_import( mbedtls_rsa_context *ctx, + const mbedtls_mpi *N, + const mbedtls_mpi *P, const mbedtls_mpi *Q, + const mbedtls_mpi *D, const mbedtls_mpi *E ); + +/** + * \brief This function imports core RSA parameters, in raw big-endian + * binary format, into an RSA context. + * + * \note This function can be called multiple times for successive + * imports, if the parameters are not simultaneously present. + * + * Any sequence of calls to this function should be followed + * by a call to mbedtls_rsa_complete(), which checks and + * completes the provided information to a ready-for-use + * public or private RSA key. + * + * \note See mbedtls_rsa_complete() for more information on which + * parameters are necessary to set up a private or public + * RSA key. + * + * \note The imported parameters are copied and need not be preserved + * for the lifetime of the RSA context being set up. + * + * \param ctx The initialized RSA context to store the parameters in. + * \param N The RSA modulus. This may be \c NULL. + * \param N_len The Byte length of \p N; it is ignored if \p N == NULL. + * \param P The first prime factor of \p N. This may be \c NULL. + * \param P_len The Byte length of \p P; it ns ignored if \p P == NULL. + * \param Q The second prime factor of \p N. This may be \c NULL. + * \param Q_len The Byte length of \p Q; it is ignored if \p Q == NULL. + * \param D The private exponent. This may be \c NULL. + * \param D_len The Byte length of \p D; it is ignored if \p D == NULL. + * \param E The public exponent. This may be \c NULL. + * \param E_len The Byte length of \p E; it is ignored if \p E == NULL. + * + * \return \c 0 on success. + * \return A non-zero error code on failure. + */ +int mbedtls_rsa_import_raw( mbedtls_rsa_context *ctx, + unsigned char const *N, size_t N_len, + unsigned char const *P, size_t P_len, + unsigned char const *Q, size_t Q_len, + unsigned char const *D, size_t D_len, + unsigned char const *E, size_t E_len ); + +/** + * \brief This function completes an RSA context from + * a set of imported core parameters. + * + * To setup an RSA public key, precisely \p N and \p E + * must have been imported. + * + * To setup an RSA private key, sufficient information must + * be present for the other parameters to be derivable. + * + * The default implementation supports the following: + *
  • Derive \p P, \p Q from \p N, \p D, \p E.
    • + *
  • Derive \p N, \p D from \p P, \p Q, \p E.
+ * Alternative implementations need not support these. + * + * If this function runs successfully, it guarantees that + * the RSA context can be used for RSA operations without + * the risk of failure or crash. + * + * \warning This function need not perform consistency checks + * for the imported parameters. In particular, parameters that + * are not needed by the implementation might be silently + * discarded and left unchecked. To check the consistency + * of the key material, see mbedtls_rsa_check_privkey(). + * + * \param ctx The initialized RSA context holding imported parameters. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_RSA_BAD_INPUT_DATA if the attempted derivations + * failed. + * + */ +int mbedtls_rsa_complete( mbedtls_rsa_context *ctx ); + +/** + * \brief This function exports the core parameters of an RSA key. + * + * If this function runs successfully, the non-NULL buffers + * pointed to by \p N, \p P, \p Q, \p D, and \p E are fully + * written, with additional unused space filled leading by + * zero Bytes. + * + * Possible reasons for returning + * #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
    + *
  • An alternative RSA implementation is in use, which + * stores the key externally, and either cannot or should + * not export it into RAM.
    • + *
  • A SW or HW implementation might not support a certain + * deduction. For example, \p P, \p Q from \p N, \p D, + * and \p E if the former are not part of the + * implementation.
+ * + * If the function fails due to an unsupported operation, + * the RSA context stays intact and remains usable. + * + * \param ctx The initialized RSA context. + * \param N The MPI to hold the RSA modulus. + * This may be \c NULL if this field need not be exported. + * \param P The MPI to hold the first prime factor of \p N. + * This may be \c NULL if this field need not be exported. + * \param Q The MPI to hold the second prime factor of \p N. + * This may be \c NULL if this field need not be exported. + * \param D The MPI to hold the private exponent. + * This may be \c NULL if this field need not be exported. + * \param E The MPI to hold the public exponent. + * This may be \c NULL if this field need not be exported. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the + * requested parameters cannot be done due to missing + * functionality or because of security policies. + * \return A non-zero return code on any other failure. + * + */ +int mbedtls_rsa_export( const mbedtls_rsa_context *ctx, + mbedtls_mpi *N, mbedtls_mpi *P, mbedtls_mpi *Q, + mbedtls_mpi *D, mbedtls_mpi *E ); + +/** + * \brief This function exports core parameters of an RSA key + * in raw big-endian binary format. + * + * If this function runs successfully, the non-NULL buffers + * pointed to by \p N, \p P, \p Q, \p D, and \p E are fully + * written, with additional unused space filled leading by + * zero Bytes. + * + * Possible reasons for returning + * #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
    + *
  • An alternative RSA implementation is in use, which + * stores the key externally, and either cannot or should + * not export it into RAM.
    • + *
  • A SW or HW implementation might not support a certain + * deduction. For example, \p P, \p Q from \p N, \p D, + * and \p E if the former are not part of the + * implementation.
+ * If the function fails due to an unsupported operation, + * the RSA context stays intact and remains usable. + * + * \note The length parameters are ignored if the corresponding + * buffer pointers are NULL. + * + * \param ctx The initialized RSA context. + * \param N The Byte array to store the RSA modulus, + * or \c NULL if this field need not be exported. + * \param N_len The size of the buffer for the modulus. + * \param P The Byte array to hold the first prime factor of \p N, + * or \c NULL if this field need not be exported. + * \param P_len The size of the buffer for the first prime factor. + * \param Q The Byte array to hold the second prime factor of \p N, + * or \c NULL if this field need not be exported. + * \param Q_len The size of the buffer for the second prime factor. + * \param D The Byte array to hold the private exponent, + * or \c NULL if this field need not be exported. + * \param D_len The size of the buffer for the private exponent. + * \param E The Byte array to hold the public exponent, + * or \c NULL if this field need not be exported. + * \param E_len The size of the buffer for the public exponent. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the + * requested parameters cannot be done due to missing + * functionality or because of security policies. + * \return A non-zero return code on any other failure. + */ +int mbedtls_rsa_export_raw( const mbedtls_rsa_context *ctx, + unsigned char *N, size_t N_len, + unsigned char *P, size_t P_len, + unsigned char *Q, size_t Q_len, + unsigned char *D, size_t D_len, + unsigned char *E, size_t E_len ); + +/** + * \brief This function exports CRT parameters of a private RSA key. + * + * \note Alternative RSA implementations not using CRT-parameters + * internally can implement this function based on + * mbedtls_rsa_deduce_opt(). + * + * \param ctx The initialized RSA context. + * \param DP The MPI to hold \c D modulo `P-1`, + * or \c NULL if it need not be exported. + * \param DQ The MPI to hold \c D modulo `Q-1`, + * or \c NULL if it need not be exported. + * \param QP The MPI to hold modular inverse of \c Q modulo \c P, + * or \c NULL if it need not be exported. + * + * \return \c 0 on success. + * \return A non-zero error code on failure. + * + */ +int mbedtls_rsa_export_crt( const mbedtls_rsa_context *ctx, + mbedtls_mpi *DP, mbedtls_mpi *DQ, mbedtls_mpi *QP ); + +/** + * \brief This function sets padding for an already initialized RSA + * context. See mbedtls_rsa_init() for details. + * + * \param ctx The initialized RSA context to be configured. + * \param padding The padding mode to use. This must be either + * #MBEDTLS_RSA_PKCS_V15 or #MBEDTLS_RSA_PKCS_V21. + * \param hash_id The #MBEDTLS_RSA_PKCS_V21 hash identifier. + */ +void mbedtls_rsa_set_padding( mbedtls_rsa_context *ctx, int padding, + int hash_id ); + +/** + * \brief This function retrieves the length of RSA modulus in Bytes. + * + * \param ctx The initialized RSA context. + * + * \return The length of the RSA modulus in Bytes. + * + */ +size_t mbedtls_rsa_get_len( const mbedtls_rsa_context *ctx ); + +/** + * \brief This function generates an RSA keypair. + * + * \note mbedtls_rsa_init() must be called before this function, + * to set up the RSA context. + * + * \param ctx The initialized RSA context used to hold the key. + * \param f_rng The RNG function to be used for key generation. + * This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. + * This may be \c NULL if \p f_rng doesn't need a context. + * \param nbits The size of the public key in bits. + * \param exponent The public exponent to use. For example, \c 65537. + * This must be odd and greater than \c 1. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_gen_key( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + unsigned int nbits, int exponent ); + +/** + * \brief This function checks if a context contains at least an RSA + * public key. + * + * If the function runs successfully, it is guaranteed that + * enough information is present to perform an RSA public key + * operation using mbedtls_rsa_public(). + * + * \param ctx The initialized RSA context to check. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + * + */ +int mbedtls_rsa_check_pubkey( const mbedtls_rsa_context *ctx ); + +/** + * \brief This function checks if a context contains an RSA private key + * and perform basic consistency checks. + * + * \note The consistency checks performed by this function not only + * ensure that mbedtls_rsa_private() can be called successfully + * on the given context, but that the various parameters are + * mutually consistent with high probability, in the sense that + * mbedtls_rsa_public() and mbedtls_rsa_private() are inverses. + * + * \warning This function should catch accidental misconfigurations + * like swapping of parameters, but it cannot establish full + * trust in neither the quality nor the consistency of the key + * material that was used to setup the given RSA context: + *
  • Consistency: Imported parameters that are irrelevant + * for the implementation might be silently dropped. If dropped, + * the current function does not have access to them, + * and therefore cannot check them. See mbedtls_rsa_complete(). + * If you want to check the consistency of the entire + * content of an PKCS1-encoded RSA private key, for example, you + * should use mbedtls_rsa_validate_params() before setting + * up the RSA context. + * Additionally, if the implementation performs empirical checks, + * these checks substantiate but do not guarantee consistency.
    • + *
  • Quality: This function is not expected to perform + * extended quality assessments like checking that the prime + * factors are safe. Additionally, it is the responsibility of the + * user to ensure the trustworthiness of the source of his RSA + * parameters, which goes beyond what is effectively checkable + * by the library.
+ * + * \param ctx The initialized RSA context to check. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_check_privkey( const mbedtls_rsa_context *ctx ); + +/** + * \brief This function checks a public-private RSA key pair. + * + * It checks each of the contexts, and makes sure they match. + * + * \param pub The initialized RSA context holding the public key. + * \param prv The initialized RSA context holding the private key. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_check_pub_priv( const mbedtls_rsa_context *pub, + const mbedtls_rsa_context *prv ); + +/** + * \brief This function performs an RSA public key operation. + * + * \param ctx The initialized RSA context to use. + * \param input The input buffer. This must be a readable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * \param output The output buffer. This must be a writable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \note This function does not handle message padding. + * + * \note Make sure to set \p input[0] = 0 or ensure that + * input is smaller than \p N. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_public( mbedtls_rsa_context *ctx, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function performs an RSA private key operation. + * + * \note Blinding is used if and only if a PRNG is provided. + * + * \note If blinding is used, both the base of exponentiation + * and the exponent are blinded, providing protection + * against some side-channel attacks. + * + * \warning It is deprecated and a security risk to not provide + * a PRNG here and thereby prevent the use of blinding. + * Future versions of the library may enforce the presence + * of a PRNG. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function, used for blinding. It is discouraged + * and deprecated to pass \c NULL here, in which case + * blinding will be omitted. + * \param p_rng The RNG context to pass to \p f_rng. This may be \c NULL + * if \p f_rng is \c NULL or if \p f_rng doesn't need a context. + * \param input The input buffer. This must be a readable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * \param output The output buffer. This must be a writable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + * + */ +int mbedtls_rsa_private( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function adds the message padding, then performs an RSA + * operation. + * + * It is the generic wrapper for performing a PKCS#1 encryption + * operation using the \p mode from the context. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PRIVATE mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PUBLIC. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PRIVATE and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG to use. It is mandatory for PKCS#1 v2.1 padding + * encoding, and for PKCS#1 v1.5 padding encoding when used + * with \p mode set to #MBEDTLS_RSA_PUBLIC. For PKCS#1 v1.5 + * padding encoding and \p mode set to #MBEDTLS_RSA_PRIVATE, + * it is used for blinding and should be provided in this + * case; see mbedtls_rsa_private() for more. + * \param p_rng The RNG context to be passed to \p f_rng. May be + * \c NULL if \p f_rng is \c NULL or if \p f_rng doesn't + * need a context argument. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE (deprecated). + * \param ilen The length of the plaintext in Bytes. + * \param input The input data to encrypt. This must be a readable + * buffer of size \p ilen Bytes. It may be \c NULL if + * `ilen == 0`. + * \param output The output buffer. This must be a writable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_pkcs1_encrypt( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, size_t ilen, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function performs a PKCS#1 v1.5 encryption operation + * (RSAES-PKCS1-v1_5-ENCRYPT). + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PRIVATE mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PUBLIC. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PRIVATE and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function to use. It is needed for padding generation + * if \p mode is #MBEDTLS_RSA_PUBLIC. If \p mode is + * #MBEDTLS_RSA_PRIVATE (discouraged), it is used for + * blinding and should be provided; see mbedtls_rsa_private(). + * \param p_rng The RNG context to be passed to \p f_rng. This may + * be \c NULL if \p f_rng is \c NULL or if \p f_rng + * doesn't need a context argument. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE (deprecated). + * \param ilen The length of the plaintext in Bytes. + * \param input The input data to encrypt. This must be a readable + * buffer of size \p ilen Bytes. It may be \c NULL if + * `ilen == 0`. + * \param output The output buffer. This must be a writable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsaes_pkcs1_v15_encrypt( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, size_t ilen, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function performs a PKCS#1 v2.1 OAEP encryption + * operation (RSAES-OAEP-ENCRYPT). + * + * \note The output buffer must be as large as the size + * of ctx->N. For example, 128 Bytes if RSA-1024 is used. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PRIVATE mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PUBLIC. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PRIVATE and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function to use. This is needed for padding + * generation and must be provided. + * \param p_rng The RNG context to be passed to \p f_rng. This may + * be \c NULL if \p f_rng doesn't need a context argument. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE (deprecated). + * \param label The buffer holding the custom label to use. + * This must be a readable buffer of length \p label_len + * Bytes. It may be \c NULL if \p label_len is \c 0. + * \param label_len The length of the label in Bytes. + * \param ilen The length of the plaintext buffer \p input in Bytes. + * \param input The input data to encrypt. This must be a readable + * buffer of size \p ilen Bytes. It may be \c NULL if + * `ilen == 0`. + * \param output The output buffer. This must be a writable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsaes_oaep_encrypt( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + const unsigned char *label, size_t label_len, + size_t ilen, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function performs an RSA operation, then removes the + * message padding. + * + * It is the generic wrapper for performing a PKCS#1 decryption + * operation using the \p mode from the context. + * + * \note The output buffer length \c output_max_len should be + * as large as the size \p ctx->len of \p ctx->N (for example, + * 128 Bytes if RSA-1024 is used) to be able to hold an + * arbitrary decrypted message. If it is not large enough to + * hold the decryption of the particular ciphertext provided, + * the function returns \c MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PUBLIC mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PRIVATE. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PUBLIC and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. If \p mode is #MBEDTLS_RSA_PRIVATE, + * this is used for blinding and should be provided; see + * mbedtls_rsa_private() for more. If \p mode is + * #MBEDTLS_RSA_PUBLIC, it is ignored. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a context. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PRIVATE or #MBEDTLS_RSA_PUBLIC (deprecated). + * \param olen The address at which to store the length of + * the plaintext. This must not be \c NULL. + * \param input The ciphertext buffer. This must be a readable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * \param output The buffer used to hold the plaintext. This must + * be a writable buffer of length \p output_max_len Bytes. + * \param output_max_len The length in Bytes of the output buffer \p output. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_pkcs1_decrypt( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, size_t *olen, + const unsigned char *input, + unsigned char *output, + size_t output_max_len ); + +/** + * \brief This function performs a PKCS#1 v1.5 decryption + * operation (RSAES-PKCS1-v1_5-DECRYPT). + * + * \note The output buffer length \c output_max_len should be + * as large as the size \p ctx->len of \p ctx->N, for example, + * 128 Bytes if RSA-1024 is used, to be able to hold an + * arbitrary decrypted message. If it is not large enough to + * hold the decryption of the particular ciphertext provided, + * the function returns #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PUBLIC mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PRIVATE. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PUBLIC and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. If \p mode is #MBEDTLS_RSA_PRIVATE, + * this is used for blinding and should be provided; see + * mbedtls_rsa_private() for more. If \p mode is + * #MBEDTLS_RSA_PUBLIC, it is ignored. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a context. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PRIVATE or #MBEDTLS_RSA_PUBLIC (deprecated). + * \param olen The address at which to store the length of + * the plaintext. This must not be \c NULL. + * \param input The ciphertext buffer. This must be a readable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * \param output The buffer used to hold the plaintext. This must + * be a writable buffer of length \p output_max_len Bytes. + * \param output_max_len The length in Bytes of the output buffer \p output. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + * + */ +int mbedtls_rsa_rsaes_pkcs1_v15_decrypt( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, size_t *olen, + const unsigned char *input, + unsigned char *output, + size_t output_max_len ); + +/** + * \brief This function performs a PKCS#1 v2.1 OAEP decryption + * operation (RSAES-OAEP-DECRYPT). + * + * \note The output buffer length \c output_max_len should be + * as large as the size \p ctx->len of \p ctx->N, for + * example, 128 Bytes if RSA-1024 is used, to be able to + * hold an arbitrary decrypted message. If it is not + * large enough to hold the decryption of the particular + * ciphertext provided, the function returns + * #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PUBLIC mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PRIVATE. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PUBLIC and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. If \p mode is #MBEDTLS_RSA_PRIVATE, + * this is used for blinding and should be provided; see + * mbedtls_rsa_private() for more. If \p mode is + * #MBEDTLS_RSA_PUBLIC, it is ignored. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a context. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PRIVATE or #MBEDTLS_RSA_PUBLIC (deprecated). + * \param label The buffer holding the custom label to use. + * This must be a readable buffer of length \p label_len + * Bytes. It may be \c NULL if \p label_len is \c 0. + * \param label_len The length of the label in Bytes. + * \param olen The address at which to store the length of + * the plaintext. This must not be \c NULL. + * \param input The ciphertext buffer. This must be a readable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * \param output The buffer used to hold the plaintext. This must + * be a writable buffer of length \p output_max_len Bytes. + * \param output_max_len The length in Bytes of the output buffer \p output. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsaes_oaep_decrypt( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + const unsigned char *label, size_t label_len, + size_t *olen, + const unsigned char *input, + unsigned char *output, + size_t output_max_len ); + +/** + * \brief This function performs a private RSA operation to sign + * a message digest using PKCS#1. + * + * It is the generic wrapper for performing a PKCS#1 + * signature using the \p mode from the context. + * + * \note The \p sig buffer must be as large as the size + * of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. + * + * \note For PKCS#1 v2.1 encoding, see comments on + * mbedtls_rsa_rsassa_pss_sign() for details on + * \p md_alg and \p hash_id. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PUBLIC mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PRIVATE. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PUBLIC and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function to use. If the padding mode is PKCS#1 v2.1, + * this must be provided. If the padding mode is PKCS#1 v1.5 and + * \p mode is #MBEDTLS_RSA_PRIVATE, it is used for blinding + * and should be provided; see mbedtls_rsa_private() for more + * more. It is ignored otherwise. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + * if \p f_rng is \c NULL or doesn't need a context argument. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PRIVATE or #MBEDTLS_RSA_PUBLIC (deprecated). + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest. + * Ths is only used if \p md_alg is #MBEDTLS_MD_NONE. + * \param hash The buffer holding the message digest or raw data. + * If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable + * buffer of length \p hashlen Bytes. If \p md_alg is not + * #MBEDTLS_MD_NONE, it must be a readable buffer of length + * the size of the hash corresponding to \p md_alg. + * \param sig The buffer to hold the signature. This must be a writable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. A buffer length of + * #MBEDTLS_MPI_MAX_SIZE is always safe. + * + * \return \c 0 if the signing operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_pkcs1_sign( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + unsigned char *sig ); + +/** + * \brief This function performs a PKCS#1 v1.5 signature + * operation (RSASSA-PKCS1-v1_5-SIGN). + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PUBLIC mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PRIVATE. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PUBLIC and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. If \p mode is #MBEDTLS_RSA_PRIVATE, + * this is used for blinding and should be provided; see + * mbedtls_rsa_private() for more. If \p mode is + * #MBEDTLS_RSA_PUBLIC, it is ignored. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + * if \p f_rng is \c NULL or doesn't need a context argument. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PRIVATE or #MBEDTLS_RSA_PUBLIC (deprecated). + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest. + * Ths is only used if \p md_alg is #MBEDTLS_MD_NONE. + * \param hash The buffer holding the message digest or raw data. + * If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable + * buffer of length \p hashlen Bytes. If \p md_alg is not + * #MBEDTLS_MD_NONE, it must be a readable buffer of length + * the size of the hash corresponding to \p md_alg. + * \param sig The buffer to hold the signature. This must be a writable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. A buffer length of + * #MBEDTLS_MPI_MAX_SIZE is always safe. + * + * \return \c 0 if the signing operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pkcs1_v15_sign( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + unsigned char *sig ); + +/** + * \brief This function performs a PKCS#1 v2.1 PSS signature + * operation (RSASSA-PSS-SIGN). + * + * \note The \c hash_id set in \p ctx (when calling + * mbedtls_rsa_init() or by calling mbedtls_rsa_set_padding() + * afterwards) selects the hash used for the + * encoding operation and for the mask generation function + * (MGF1). For more details on the encoding operation and the + * mask generation function, consult RFC-3447: Public-Key + * Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + * Specifications. + * + * \note This function enforces that the provided salt length complies + * with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 v2.2) §9.1.1 + * step 3. The constraint is that the hash length plus the salt + * length plus 2 bytes must be at most the key length. If this + * constraint is not met, this function returns + * #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. It must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + * if \p f_rng doesn't need a context argument. + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest. + * Ths is only used if \p md_alg is #MBEDTLS_MD_NONE. + * \param hash The buffer holding the message digest or raw data. + * If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable + * buffer of length \p hashlen Bytes. If \p md_alg is not + * #MBEDTLS_MD_NONE, it must be a readable buffer of length + * the size of the hash corresponding to \p md_alg. + * \param saltlen The length of the salt that should be used. + * If passed #MBEDTLS_RSA_SALT_LEN_ANY, the function will use + * the largest possible salt length up to the hash length, + * which is the largest permitted by some standards including + * FIPS 186-4 §5.5. + * \param sig The buffer to hold the signature. This must be a writable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. A buffer length of + * #MBEDTLS_MPI_MAX_SIZE is always safe. + * + * \return \c 0 if the signing operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pss_sign_ext( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + int saltlen, + unsigned char *sig ); + +/** + * \brief This function performs a PKCS#1 v2.1 PSS signature + * operation (RSASSA-PSS-SIGN). + * + * \note The \c hash_id set in \p ctx (when calling + * mbedtls_rsa_init() or by calling mbedtls_rsa_set_padding() + * afterwards) selects the hash used for the + * encoding operation and for the mask generation function + * (MGF1). For more details on the encoding operation and the + * mask generation function, consult RFC-3447: Public-Key + * Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + * Specifications. + * + * \note This function always uses the maximum possible salt size, + * up to the length of the payload hash. This choice of salt + * size complies with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 + * v2.2) §9.1.1 step 3. Furthermore this function enforces a + * minimum salt size which is the hash size minus 2 bytes. If + * this minimum size is too large given the key size (the salt + * size, plus the hash size, plus 2 bytes must be no more than + * the key size in bytes), this function returns + * #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PUBLIC mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PRIVATE. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PUBLIC and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. It must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + * if \p f_rng doesn't need a context argument. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PRIVATE or #MBEDTLS_RSA_PUBLIC (deprecated). + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest. + * This is only used if \p md_alg is #MBEDTLS_MD_NONE. + * \param hash The buffer holding the message digest or raw data. + * If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable + * buffer of length \p hashlen Bytes. If \p md_alg is not + * #MBEDTLS_MD_NONE, it must be a readable buffer of length + * the size of the hash corresponding to \p md_alg. + * \param sig The buffer to hold the signature. This must be a writable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. A buffer length of + * #MBEDTLS_MPI_MAX_SIZE is always safe. + * + * \return \c 0 if the signing operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pss_sign( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + unsigned char *sig ); + +/** + * \brief This function performs a public RSA operation and checks + * the message digest. + * + * This is the generic wrapper for performing a PKCS#1 + * verification using the mode from the context. + * + * \note For PKCS#1 v2.1 encoding, see comments on + * mbedtls_rsa_rsassa_pss_verify() about \p md_alg and + * \p hash_id. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PRIVATE mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * set to #MBEDTLS_RSA_PUBLIC. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PRIVATE and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA public key context to use. + * \param f_rng The RNG function to use. If \p mode is #MBEDTLS_RSA_PRIVATE, + * this is used for blinding and should be provided; see + * mbedtls_rsa_private() for more. Otherwise, it is ignored. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a context. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE (deprecated). + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest. + * This is only used if \p md_alg is #MBEDTLS_MD_NONE. + * \param hash The buffer holding the message digest or raw data. + * If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable + * buffer of length \p hashlen Bytes. If \p md_alg is not + * #MBEDTLS_MD_NONE, it must be a readable buffer of length + * the size of the hash corresponding to \p md_alg. + * \param sig The buffer holding the signature. This must be a readable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 if the verify operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_pkcs1_verify( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + const unsigned char *sig ); + +/** + * \brief This function performs a PKCS#1 v1.5 verification + * operation (RSASSA-PKCS1-v1_5-VERIFY). + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PRIVATE mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * set to #MBEDTLS_RSA_PUBLIC. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PRIVATE and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA public key context to use. + * \param f_rng The RNG function to use. If \p mode is #MBEDTLS_RSA_PRIVATE, + * this is used for blinding and should be provided; see + * mbedtls_rsa_private() for more. Otherwise, it is ignored. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a context. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE (deprecated). + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest. + * This is only used if \p md_alg is #MBEDTLS_MD_NONE. + * \param hash The buffer holding the message digest or raw data. + * If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable + * buffer of length \p hashlen Bytes. If \p md_alg is not + * #MBEDTLS_MD_NONE, it must be a readable buffer of length + * the size of the hash corresponding to \p md_alg. + * \param sig The buffer holding the signature. This must be a readable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 if the verify operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pkcs1_v15_verify( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + const unsigned char *sig ); + +/** + * \brief This function performs a PKCS#1 v2.1 PSS verification + * operation (RSASSA-PSS-VERIFY). + * + * \note The \c hash_id set in \p ctx (when calling + * mbedtls_rsa_init() or by calling mbedtls_rsa_set_padding() + * afterwards) selects the hash used for the + * encoding operation and for the mask generation function + * (MGF1). For more details on the encoding operation and the + * mask generation function, consult RFC-3447: Public-Key + * Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + * Specifications. If the \c hash_id set in \p ctx is + * #MBEDTLS_MD_NONE, the \p md_alg parameter is used. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PRIVATE mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PUBLIC. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PRIVATE and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA public key context to use. + * \param f_rng The RNG function to use. If \p mode is #MBEDTLS_RSA_PRIVATE, + * this is used for blinding and should be provided; see + * mbedtls_rsa_private() for more. Otherwise, it is ignored. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a context. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE (deprecated). + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest. + * This is only used if \p md_alg is #MBEDTLS_MD_NONE. + * \param hash The buffer holding the message digest or raw data. + * If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable + * buffer of length \p hashlen Bytes. If \p md_alg is not + * #MBEDTLS_MD_NONE, it must be a readable buffer of length + * the size of the hash corresponding to \p md_alg. + * \param sig The buffer holding the signature. This must be a readable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 if the verify operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pss_verify( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + const unsigned char *sig ); + +/** + * \brief This function performs a PKCS#1 v2.1 PSS verification + * operation (RSASSA-PSS-VERIFY). + * + * \note The \p sig buffer must be as large as the size + * of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. + * + * \note The \c hash_id set in \p ctx (when calling + * mbedtls_rsa_init() or by calling mbedtls_rsa_set_padding() + * afterwards) is ignored. + * + * \param ctx The initialized RSA public key context to use. + * \param f_rng The RNG function to use. If \p mode is #MBEDTLS_RSA_PRIVATE, + * this is used for blinding and should be provided; see + * mbedtls_rsa_private() for more. Otherwise, it is ignored. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a context. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE. + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest. + * This is only used if \p md_alg is #MBEDTLS_MD_NONE. + * \param hash The buffer holding the message digest or raw data. + * If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable + * buffer of length \p hashlen Bytes. If \p md_alg is not + * #MBEDTLS_MD_NONE, it must be a readable buffer of length + * the size of the hash corresponding to \p md_alg. + * \param mgf1_hash_id The message digest algorithm used for the + * verification operation and the mask generation + * function (MGF1). For more details on the encoding + * operation and the mask generation function, consult + * RFC-3447: Public-Key Cryptography Standards + * (PKCS) #1 v2.1: RSA Cryptography + * Specifications. + * \param expected_salt_len The length of the salt used in padding. Use + * #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. + * \param sig The buffer holding the signature. This must be a readable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 if the verify operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pss_verify_ext( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + mbedtls_md_type_t mgf1_hash_id, + int expected_salt_len, + const unsigned char *sig ); + +/** + * \brief This function copies the components of an RSA context. + * + * \param dst The destination context. This must be initialized. + * \param src The source context. This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory allocation failure. + */ +int mbedtls_rsa_copy( mbedtls_rsa_context *dst, const mbedtls_rsa_context *src ); + +/** + * \brief This function frees the components of an RSA key. + * + * \param ctx The RSA context to free. May be \c NULL, in which case + * this function is a no-op. If it is not \c NULL, it must + * point to an initialized RSA context. + */ +void mbedtls_rsa_free( mbedtls_rsa_context *ctx ); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The RSA checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_rsa_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* rsa.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/rsa_internal.h b/openharmony/arm64-v8a/include/mbedtls/rsa_internal.h new file mode 100644 index 00000000..d55492bb --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/rsa_internal.h @@ -0,0 +1,224 @@ +/** + * \file rsa_internal.h + * + * \brief Context-independent RSA helper functions + * + * This module declares some RSA-related helper functions useful when + * implementing the RSA interface. These functions are provided in a separate + * compilation unit in order to make it easy for designers of alternative RSA + * implementations to use them in their own code, as it is conceived that the + * functionality they provide will be necessary for most complete + * implementations. + * + * End-users of Mbed TLS who are not providing their own alternative RSA + * implementations should not use these functions directly, and should instead + * use only the functions declared in rsa.h. + * + * The interface provided by this module will be maintained through LTS (Long + * Term Support) branches of Mbed TLS, but may otherwise be subject to change, + * and must be considered an internal interface of the library. + * + * There are two classes of helper functions: + * + * (1) Parameter-generating helpers. These are: + * - mbedtls_rsa_deduce_primes + * - mbedtls_rsa_deduce_private_exponent + * - mbedtls_rsa_deduce_crt + * Each of these functions takes a set of core RSA parameters and + * generates some other, or CRT related parameters. + * + * (2) Parameter-checking helpers. These are: + * - mbedtls_rsa_validate_params + * - mbedtls_rsa_validate_crt + * They take a set of core or CRT related RSA parameters and check their + * validity. + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ + +#ifndef MBEDTLS_RSA_INTERNAL_H +#define MBEDTLS_RSA_INTERNAL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/bignum.h" + +#ifdef __cplusplus +extern "C" { +#endif + + +/** + * \brief Compute RSA prime moduli P, Q from public modulus N=PQ + * and a pair of private and public key. + * + * \note This is a 'static' helper function not operating on + * an RSA context. Alternative implementations need not + * overwrite it. + * + * \param N RSA modulus N = PQ, with P, Q to be found + * \param E RSA public exponent + * \param D RSA private exponent + * \param P Pointer to MPI holding first prime factor of N on success + * \param Q Pointer to MPI holding second prime factor of N on success + * + * \return + * - 0 if successful. In this case, P and Q constitute a + * factorization of N. + * - A non-zero error code otherwise. + * + * \note It is neither checked that P, Q are prime nor that + * D, E are modular inverses wrt. P-1 and Q-1. For that, + * use the helper function \c mbedtls_rsa_validate_params. + * + */ +int mbedtls_rsa_deduce_primes( mbedtls_mpi const *N, mbedtls_mpi const *E, + mbedtls_mpi const *D, + mbedtls_mpi *P, mbedtls_mpi *Q ); + +/** + * \brief Compute RSA private exponent from + * prime moduli and public key. + * + * \note This is a 'static' helper function not operating on + * an RSA context. Alternative implementations need not + * overwrite it. + * + * \param P First prime factor of RSA modulus + * \param Q Second prime factor of RSA modulus + * \param E RSA public exponent + * \param D Pointer to MPI holding the private exponent on success. + * + * \return + * - 0 if successful. In this case, D is set to a simultaneous + * modular inverse of E modulo both P-1 and Q-1. + * - A non-zero error code otherwise. + * + * \note This function does not check whether P and Q are primes. + * + */ +int mbedtls_rsa_deduce_private_exponent( mbedtls_mpi const *P, + mbedtls_mpi const *Q, + mbedtls_mpi const *E, + mbedtls_mpi *D ); + + +/** + * \brief Generate RSA-CRT parameters + * + * \note This is a 'static' helper function not operating on + * an RSA context. Alternative implementations need not + * overwrite it. + * + * \param P First prime factor of N + * \param Q Second prime factor of N + * \param D RSA private exponent + * \param DP Output variable for D modulo P-1 + * \param DQ Output variable for D modulo Q-1 + * \param QP Output variable for the modular inverse of Q modulo P. + * + * \return 0 on success, non-zero error code otherwise. + * + * \note This function does not check whether P, Q are + * prime and whether D is a valid private exponent. + * + */ +int mbedtls_rsa_deduce_crt( const mbedtls_mpi *P, const mbedtls_mpi *Q, + const mbedtls_mpi *D, mbedtls_mpi *DP, + mbedtls_mpi *DQ, mbedtls_mpi *QP ); + + +/** + * \brief Check validity of core RSA parameters + * + * \note This is a 'static' helper function not operating on + * an RSA context. Alternative implementations need not + * overwrite it. + * + * \param N RSA modulus N = PQ + * \param P First prime factor of N + * \param Q Second prime factor of N + * \param D RSA private exponent + * \param E RSA public exponent + * \param f_rng PRNG to be used for primality check, or NULL + * \param p_rng PRNG context for f_rng, or NULL + * + * \return + * - 0 if the following conditions are satisfied + * if all relevant parameters are provided: + * - P prime if f_rng != NULL (%) + * - Q prime if f_rng != NULL (%) + * - 1 < N = P * Q + * - 1 < D, E < N + * - D and E are modular inverses modulo P-1 and Q-1 + * (%) This is only done if MBEDTLS_GENPRIME is defined. + * - A non-zero error code otherwise. + * + * \note The function can be used with a restricted set of arguments + * to perform specific checks only. E.g., calling it with + * (-,P,-,-,-) and a PRNG amounts to a primality check for P. + */ +int mbedtls_rsa_validate_params( const mbedtls_mpi *N, const mbedtls_mpi *P, + const mbedtls_mpi *Q, const mbedtls_mpi *D, + const mbedtls_mpi *E, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief Check validity of RSA CRT parameters + * + * \note This is a 'static' helper function not operating on + * an RSA context. Alternative implementations need not + * overwrite it. + * + * \param P First prime factor of RSA modulus + * \param Q Second prime factor of RSA modulus + * \param D RSA private exponent + * \param DP MPI to check for D modulo P-1 + * \param DQ MPI to check for D modulo P-1 + * \param QP MPI to check for the modular inverse of Q modulo P. + * + * \return + * - 0 if the following conditions are satisfied: + * - D = DP mod P-1 if P, D, DP != NULL + * - Q = DQ mod P-1 if P, D, DQ != NULL + * - QP = Q^-1 mod P if P, Q, QP != NULL + * - \c MBEDTLS_ERR_RSA_KEY_CHECK_FAILED if check failed, + * potentially including \c MBEDTLS_ERR_MPI_XXX if some + * MPI calculations failed. + * - \c MBEDTLS_ERR_RSA_BAD_INPUT_DATA if insufficient + * data was provided to check DP, DQ or QP. + * + * \note The function can be used with a restricted set of arguments + * to perform specific checks only. E.g., calling it with the + * parameters (P, -, D, DP, -, -) will check DP = D mod P-1. + */ +int mbedtls_rsa_validate_crt( const mbedtls_mpi *P, const mbedtls_mpi *Q, + const mbedtls_mpi *D, const mbedtls_mpi *DP, + const mbedtls_mpi *DQ, const mbedtls_mpi *QP ); + +#ifdef __cplusplus +} +#endif + +#endif /* rsa_internal.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/sha1.h b/openharmony/arm64-v8a/include/mbedtls/sha1.h new file mode 100644 index 00000000..4c3251b4 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/sha1.h @@ -0,0 +1,352 @@ +/** + * \file sha1.h + * + * \brief This file contains SHA-1 definitions and functions. + * + * The Secure Hash Algorithm 1 (SHA-1) cryptographic hash function is defined in + * FIPS 180-4: Secure Hash Standard (SHS). + * + * \warning SHA-1 is considered a weak message digest and its use constitutes + * a security risk. We recommend considering stronger message + * digests instead. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SHA1_H +#define MBEDTLS_SHA1_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +/* MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** SHA-1 hardware accelerator failed */ +#define MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED -0x0035 +/** SHA-1 input data was malformed. */ +#define MBEDTLS_ERR_SHA1_BAD_INPUT_DATA -0x0073 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_SHA1_ALT) +// Regular implementation +// + +/** + * \brief The SHA-1 context structure. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +typedef struct mbedtls_sha1_context +{ + uint32_t total[2]; /*!< The number of Bytes processed. */ + uint32_t state[5]; /*!< The intermediate digest state. */ + unsigned char buffer[64]; /*!< The data block being processed. */ +} +mbedtls_sha1_context; + +#else /* MBEDTLS_SHA1_ALT */ +#include "sha1_alt.h" +#endif /* MBEDTLS_SHA1_ALT */ + +/** + * \brief This function initializes a SHA-1 context. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context to initialize. + * This must not be \c NULL. + * + */ +void mbedtls_sha1_init( mbedtls_sha1_context *ctx ); + +/** + * \brief This function clears a SHA-1 context. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context to clear. This may be \c NULL, + * in which case this function does nothing. If it is + * not \c NULL, it must point to an initialized + * SHA-1 context. + * + */ +void mbedtls_sha1_free( mbedtls_sha1_context *ctx ); + +/** + * \brief This function clones the state of a SHA-1 context. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param dst The SHA-1 context to clone to. This must be initialized. + * \param src The SHA-1 context to clone from. This must be initialized. + * + */ +void mbedtls_sha1_clone( mbedtls_sha1_context *dst, + const mbedtls_sha1_context *src ); + +/** + * \brief This function starts a SHA-1 checksum calculation. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context to initialize. This must be initialized. + * + * \return \c 0 on success. + * \return A negative error code on failure. + * + */ +int mbedtls_sha1_starts_ret( mbedtls_sha1_context *ctx ); + +/** + * \brief This function feeds an input buffer into an ongoing SHA-1 + * checksum calculation. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context. This must be initialized + * and have a hash operation started. + * \param input The buffer holding the input data. + * This must be a readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data \p input in Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha1_update_ret( mbedtls_sha1_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief This function finishes the SHA-1 operation, and writes + * the result to the output buffer. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context to use. This must be initialized and + * have a hash operation started. + * \param output The SHA-1 checksum result. This must be a writable + * buffer of length \c 20 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha1_finish_ret( mbedtls_sha1_context *ctx, + unsigned char output[20] ); + +/** + * \brief SHA-1 process data block (internal use only). + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context to use. This must be initialized. + * \param data The data block being processed. This must be a + * readable buffer of length \c 64 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + * + */ +int mbedtls_internal_sha1_process( mbedtls_sha1_context *ctx, + const unsigned char data[64] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function starts a SHA-1 checksum calculation. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \deprecated Superseded by mbedtls_sha1_starts_ret() in 2.7.0. + * + * \param ctx The SHA-1 context to initialize. This must be initialized. + * + */ +MBEDTLS_DEPRECATED void mbedtls_sha1_starts( mbedtls_sha1_context *ctx ); + +/** + * \brief This function feeds an input buffer into an ongoing SHA-1 + * checksum calculation. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \deprecated Superseded by mbedtls_sha1_update_ret() in 2.7.0. + * + * \param ctx The SHA-1 context. This must be initialized and + * have a hash operation started. + * \param input The buffer holding the input data. + * This must be a readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data \p input in Bytes. + * + */ +MBEDTLS_DEPRECATED void mbedtls_sha1_update( mbedtls_sha1_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief This function finishes the SHA-1 operation, and writes + * the result to the output buffer. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \deprecated Superseded by mbedtls_sha1_finish_ret() in 2.7.0. + * + * \param ctx The SHA-1 context. This must be initialized and + * have a hash operation started. + * \param output The SHA-1 checksum result. + * This must be a writable buffer of length \c 20 Bytes. + */ +MBEDTLS_DEPRECATED void mbedtls_sha1_finish( mbedtls_sha1_context *ctx, + unsigned char output[20] ); + +/** + * \brief SHA-1 process data block (internal use only). + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \deprecated Superseded by mbedtls_internal_sha1_process() in 2.7.0. + * + * \param ctx The SHA-1 context. This must be initialized. + * \param data The data block being processed. + * This must be a readable buffer of length \c 64 bytes. + * + */ +MBEDTLS_DEPRECATED void mbedtls_sha1_process( mbedtls_sha1_context *ctx, + const unsigned char data[64] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief This function calculates the SHA-1 checksum of a buffer. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The SHA-1 result is calculated as + * output = SHA-1(input buffer). + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param input The buffer holding the input data. + * This must be a readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data \p input in Bytes. + * \param output The SHA-1 checksum result. + * This must be a writable buffer of length \c 20 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + * + */ +int mbedtls_sha1_ret( const unsigned char *input, + size_t ilen, + unsigned char output[20] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function calculates the SHA-1 checksum of a buffer. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The SHA-1 result is calculated as + * output = SHA-1(input buffer). + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \deprecated Superseded by mbedtls_sha1_ret() in 2.7.0 + * + * \param input The buffer holding the input data. + * This must be a readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data \p input in Bytes. + * \param output The SHA-1 checksum result. This must be a writable + * buffer of size \c 20 Bytes. + * + */ +MBEDTLS_DEPRECATED void mbedtls_sha1( const unsigned char *input, + size_t ilen, + unsigned char output[20] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The SHA-1 checkup routine. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \return \c 0 on success. + * \return \c 1 on failure. + * + */ +int mbedtls_sha1_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_sha1.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/sha256.h b/openharmony/arm64-v8a/include/mbedtls/sha256.h new file mode 100644 index 00000000..5b54be21 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/sha256.h @@ -0,0 +1,300 @@ +/** + * \file sha256.h + * + * \brief This file contains SHA-224 and SHA-256 definitions and functions. + * + * The Secure Hash Algorithms 224 and 256 (SHA-224 and SHA-256) cryptographic + * hash functions are defined in FIPS 180-4: Secure Hash Standard (SHS). + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SHA256_H +#define MBEDTLS_SHA256_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +/* MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** SHA-256 hardware accelerator failed */ +#define MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED -0x0037 +/** SHA-256 input data was malformed. */ +#define MBEDTLS_ERR_SHA256_BAD_INPUT_DATA -0x0074 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_SHA256_ALT) +// Regular implementation +// + +/** + * \brief The SHA-256 context structure. + * + * The structure is used both for SHA-256 and for SHA-224 + * checksum calculations. The choice between these two is + * made in the call to mbedtls_sha256_starts_ret(). + */ +typedef struct mbedtls_sha256_context +{ + uint32_t total[2]; /*!< The number of Bytes processed. */ + uint32_t state[8]; /*!< The intermediate digest state. */ + unsigned char buffer[64]; /*!< The data block being processed. */ + int is224; /*!< Determines which function to use: + 0: Use SHA-256, or 1: Use SHA-224. */ +} +mbedtls_sha256_context; + +#else /* MBEDTLS_SHA256_ALT */ +#include "sha256_alt.h" +#endif /* MBEDTLS_SHA256_ALT */ + +/** + * \brief This function initializes a SHA-256 context. + * + * \param ctx The SHA-256 context to initialize. This must not be \c NULL. + */ +void mbedtls_sha256_init( mbedtls_sha256_context *ctx ); + +/** + * \brief This function clears a SHA-256 context. + * + * \param ctx The SHA-256 context to clear. This may be \c NULL, in which + * case this function returns immediately. If it is not \c NULL, + * it must point to an initialized SHA-256 context. + */ +void mbedtls_sha256_free( mbedtls_sha256_context *ctx ); + +/** + * \brief This function clones the state of a SHA-256 context. + * + * \param dst The destination context. This must be initialized. + * \param src The context to clone. This must be initialized. + */ +void mbedtls_sha256_clone( mbedtls_sha256_context *dst, + const mbedtls_sha256_context *src ); + +/** + * \brief This function starts a SHA-224 or SHA-256 checksum + * calculation. + * + * \param ctx The context to use. This must be initialized. + * \param is224 This determines which function to use. This must be + * either \c 0 for SHA-256, or \c 1 for SHA-224. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha256_starts_ret( mbedtls_sha256_context *ctx, int is224 ); + +/** + * \brief This function feeds an input buffer into an ongoing + * SHA-256 checksum calculation. + * + * \param ctx The SHA-256 context. This must be initialized + * and have a hash operation started. + * \param input The buffer holding the data. This must be a readable + * buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha256_update_ret( mbedtls_sha256_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief This function finishes the SHA-256 operation, and writes + * the result to the output buffer. + * + * \param ctx The SHA-256 context. This must be initialized + * and have a hash operation started. + * \param output The SHA-224 or SHA-256 checksum result. + * This must be a writable buffer of length \c 32 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha256_finish_ret( mbedtls_sha256_context *ctx, + unsigned char output[32] ); + +/** + * \brief This function processes a single data block within + * the ongoing SHA-256 computation. This function is for + * internal use only. + * + * \param ctx The SHA-256 context. This must be initialized. + * \param data The buffer holding one block of data. This must + * be a readable buffer of length \c 64 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_internal_sha256_process( mbedtls_sha256_context *ctx, + const unsigned char data[64] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function starts a SHA-224 or SHA-256 checksum + * calculation. + * + * \deprecated Superseded by mbedtls_sha256_starts_ret() in 2.7.0. + * + * \param ctx The context to use. This must be initialized. + * \param is224 Determines which function to use. This must be + * either \c 0 for SHA-256, or \c 1 for SHA-224. + */ +MBEDTLS_DEPRECATED void mbedtls_sha256_starts( mbedtls_sha256_context *ctx, + int is224 ); + +/** + * \brief This function feeds an input buffer into an ongoing + * SHA-256 checksum calculation. + * + * \deprecated Superseded by mbedtls_sha256_update_ret() in 2.7.0. + * + * \param ctx The SHA-256 context to use. This must be + * initialized and have a hash operation started. + * \param input The buffer holding the data. This must be a readable + * buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + */ +MBEDTLS_DEPRECATED void mbedtls_sha256_update( mbedtls_sha256_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief This function finishes the SHA-256 operation, and writes + * the result to the output buffer. + * + * \deprecated Superseded by mbedtls_sha256_finish_ret() in 2.7.0. + * + * \param ctx The SHA-256 context. This must be initialized and + * have a hash operation started. + * \param output The SHA-224 or SHA-256 checksum result. This must be + * a writable buffer of length \c 32 Bytes. + */ +MBEDTLS_DEPRECATED void mbedtls_sha256_finish( mbedtls_sha256_context *ctx, + unsigned char output[32] ); + +/** + * \brief This function processes a single data block within + * the ongoing SHA-256 computation. This function is for + * internal use only. + * + * \deprecated Superseded by mbedtls_internal_sha256_process() in 2.7.0. + * + * \param ctx The SHA-256 context. This must be initialized. + * \param data The buffer holding one block of data. This must be + * a readable buffer of size \c 64 Bytes. + */ +MBEDTLS_DEPRECATED void mbedtls_sha256_process( mbedtls_sha256_context *ctx, + const unsigned char data[64] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief This function calculates the SHA-224 or SHA-256 + * checksum of a buffer. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The SHA-256 result is calculated as + * output = SHA-256(input buffer). + * + * \param input The buffer holding the data. This must be a readable + * buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * \param output The SHA-224 or SHA-256 checksum result. This must + * be a writable buffer of length \c 32 Bytes. + * \param is224 Determines which function to use. This must be + * either \c 0 for SHA-256, or \c 1 for SHA-224. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha256_ret( const unsigned char *input, + size_t ilen, + unsigned char output[32], + int is224 ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif + +/** + * \brief This function calculates the SHA-224 or SHA-256 checksum + * of a buffer. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The SHA-256 result is calculated as + * output = SHA-256(input buffer). + * + * \deprecated Superseded by mbedtls_sha256_ret() in 2.7.0. + * + * \param input The buffer holding the data. This must be a readable + * buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * \param output The SHA-224 or SHA-256 checksum result. This must be + * a writable buffer of length \c 32 Bytes. + * \param is224 Determines which function to use. This must be either + * \c 0 for SHA-256, or \c 1 for SHA-224. + */ +MBEDTLS_DEPRECATED void mbedtls_sha256( const unsigned char *input, + size_t ilen, + unsigned char output[32], + int is224 ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The SHA-224 and SHA-256 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_sha256_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_sha256.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/sha512.h b/openharmony/arm64-v8a/include/mbedtls/sha512.h new file mode 100644 index 00000000..cca47c2f --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/sha512.h @@ -0,0 +1,316 @@ +/** + * \file sha512.h + * \brief This file contains SHA-384 and SHA-512 definitions and functions. + * + * The Secure Hash Algorithms 384 and 512 (SHA-384 and SHA-512) cryptographic + * hash functions are defined in FIPS 180-4: Secure Hash Standard (SHS). + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SHA512_H +#define MBEDTLS_SHA512_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +/* MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** SHA-512 hardware accelerator failed */ +#define MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED -0x0039 +/** SHA-512 input data was malformed. */ +#define MBEDTLS_ERR_SHA512_BAD_INPUT_DATA -0x0075 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_SHA512_ALT) +// Regular implementation +// + +/** + * \brief The SHA-512 context structure. + * + * The structure is used both for SHA-384 and for SHA-512 + * checksum calculations. The choice between these two is + * made in the call to mbedtls_sha512_starts_ret(). + */ +typedef struct mbedtls_sha512_context +{ + uint64_t total[2]; /*!< The number of Bytes processed. */ + uint64_t state[8]; /*!< The intermediate digest state. */ + unsigned char buffer[128]; /*!< The data block being processed. */ +#if !defined(MBEDTLS_SHA512_NO_SHA384) + int is384; /*!< Determines which function to use: + 0: Use SHA-512, or 1: Use SHA-384. */ +#endif +} +mbedtls_sha512_context; + +#else /* MBEDTLS_SHA512_ALT */ +#include "sha512_alt.h" +#endif /* MBEDTLS_SHA512_ALT */ + +/** + * \brief This function initializes a SHA-512 context. + * + * \param ctx The SHA-512 context to initialize. This must + * not be \c NULL. + */ +void mbedtls_sha512_init( mbedtls_sha512_context *ctx ); + +/** + * \brief This function clears a SHA-512 context. + * + * \param ctx The SHA-512 context to clear. This may be \c NULL, + * in which case this function does nothing. If it + * is not \c NULL, it must point to an initialized + * SHA-512 context. + */ +void mbedtls_sha512_free( mbedtls_sha512_context *ctx ); + +/** + * \brief This function clones the state of a SHA-512 context. + * + * \param dst The destination context. This must be initialized. + * \param src The context to clone. This must be initialized. + */ +void mbedtls_sha512_clone( mbedtls_sha512_context *dst, + const mbedtls_sha512_context *src ); + +/** + * \brief This function starts a SHA-384 or SHA-512 checksum + * calculation. + * + * \param ctx The SHA-512 context to use. This must be initialized. + * \param is384 Determines which function to use. This must be + * either \c 0 for SHA-512, or \c 1 for SHA-384. + * + * \note When \c MBEDTLS_SHA512_NO_SHA384 is defined, \p is384 must + * be \c 0, or the function will return + * #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha512_starts_ret( mbedtls_sha512_context *ctx, int is384 ); + +/** + * \brief This function feeds an input buffer into an ongoing + * SHA-512 checksum calculation. + * + * \param ctx The SHA-512 context. This must be initialized + * and have a hash operation started. + * \param input The buffer holding the input data. This must + * be a readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha512_update_ret( mbedtls_sha512_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief This function finishes the SHA-512 operation, and writes + * the result to the output buffer. + * + * \param ctx The SHA-512 context. This must be initialized + * and have a hash operation started. + * \param output The SHA-384 or SHA-512 checksum result. + * This must be a writable buffer of length \c 64 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha512_finish_ret( mbedtls_sha512_context *ctx, + unsigned char output[64] ); + +/** + * \brief This function processes a single data block within + * the ongoing SHA-512 computation. + * This function is for internal use only. + * + * \param ctx The SHA-512 context. This must be initialized. + * \param data The buffer holding one block of data. This + * must be a readable buffer of length \c 128 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_internal_sha512_process( mbedtls_sha512_context *ctx, + const unsigned char data[128] ); +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function starts a SHA-384 or SHA-512 checksum + * calculation. + * + * \deprecated Superseded by mbedtls_sha512_starts_ret() in 2.7.0 + * + * \param ctx The SHA-512 context to use. This must be initialized. + * \param is384 Determines which function to use. This must be either + * \c 0 for SHA-512 or \c 1 for SHA-384. + * + * \note When \c MBEDTLS_SHA512_NO_SHA384 is defined, \p is384 must + * be \c 0, or the function will fail to work. + */ +MBEDTLS_DEPRECATED void mbedtls_sha512_starts( mbedtls_sha512_context *ctx, + int is384 ); + +/** + * \brief This function feeds an input buffer into an ongoing + * SHA-512 checksum calculation. + * + * \deprecated Superseded by mbedtls_sha512_update_ret() in 2.7.0. + * + * \param ctx The SHA-512 context. This must be initialized + * and have a hash operation started. + * \param input The buffer holding the data. This must be a readable + * buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + */ +MBEDTLS_DEPRECATED void mbedtls_sha512_update( mbedtls_sha512_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief This function finishes the SHA-512 operation, and writes + * the result to the output buffer. + * + * \deprecated Superseded by mbedtls_sha512_finish_ret() in 2.7.0. + * + * \param ctx The SHA-512 context. This must be initialized + * and have a hash operation started. + * \param output The SHA-384 or SHA-512 checksum result. This must + * be a writable buffer of size \c 64 Bytes. + */ +MBEDTLS_DEPRECATED void mbedtls_sha512_finish( mbedtls_sha512_context *ctx, + unsigned char output[64] ); + +/** + * \brief This function processes a single data block within + * the ongoing SHA-512 computation. This function is for + * internal use only. + * + * \deprecated Superseded by mbedtls_internal_sha512_process() in 2.7.0. + * + * \param ctx The SHA-512 context. This must be initialized. + * \param data The buffer holding one block of data. This must be + * a readable buffer of length \c 128 Bytes. + */ +MBEDTLS_DEPRECATED void mbedtls_sha512_process( + mbedtls_sha512_context *ctx, + const unsigned char data[128] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief This function calculates the SHA-512 or SHA-384 + * checksum of a buffer. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The SHA-512 result is calculated as + * output = SHA-512(input buffer). + * + * \param input The buffer holding the input data. This must be + * a readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * \param output The SHA-384 or SHA-512 checksum result. + * This must be a writable buffer of length \c 64 Bytes. + * \param is384 Determines which function to use. This must be either + * \c 0 for SHA-512, or \c 1 for SHA-384. + * + * \note When \c MBEDTLS_SHA512_NO_SHA384 is defined, \p is384 must + * be \c 0, or the function will return + * #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha512_ret( const unsigned char *input, + size_t ilen, + unsigned char output[64], + int is384 ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif + +/** + * \brief This function calculates the SHA-512 or SHA-384 + * checksum of a buffer. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The SHA-512 result is calculated as + * output = SHA-512(input buffer). + * + * \deprecated Superseded by mbedtls_sha512_ret() in 2.7.0 + * + * \param input The buffer holding the data. This must be a + * readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * \param output The SHA-384 or SHA-512 checksum result. This must + * be a writable buffer of length \c 64 Bytes. + * \param is384 Determines which function to use. This must be either + * \c 0 for SHA-512, or \c 1 for SHA-384. + * + * \note When \c MBEDTLS_SHA512_NO_SHA384 is defined, \p is384 must + * be \c 0, or the function will fail to work. + */ +MBEDTLS_DEPRECATED void mbedtls_sha512( const unsigned char *input, + size_t ilen, + unsigned char output[64], + int is384 ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_SELF_TEST) + + /** + * \brief The SHA-384 or SHA-512 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_sha512_self_test( int verbose ); +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_sha512.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/ssl.h b/openharmony/arm64-v8a/include/mbedtls/ssl.h new file mode 100644 index 00000000..5064ec56 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/ssl.h @@ -0,0 +1,4427 @@ +/** + * \file ssl.h + * + * \brief SSL/TLS functions. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SSL_H +#define MBEDTLS_SSL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/bignum.h" +#include "mbedtls/ecp.h" + +#include "mbedtls/ssl_ciphersuites.h" + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +#include "mbedtls/x509_crt.h" +#include "mbedtls/x509_crl.h" +#endif + +#if defined(MBEDTLS_DHM_C) +#include "mbedtls/dhm.h" +#endif + +/* Adding guard for MBEDTLS_ECDSA_C to ensure no compile errors due + * to guards also being in ssl_srv.c and ssl_cli.c. There is a gap + * in functionality that access to ecdh_ctx structure is needed for + * MBEDTLS_ECDSA_C which does not seem correct. + */ +#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) +#include "mbedtls/ecdh.h" +#endif + +#if defined(MBEDTLS_ZLIB_SUPPORT) + +#if defined(MBEDTLS_DEPRECATED_WARNING) +#warning "Record compression support via MBEDTLS_ZLIB_SUPPORT is deprecated and will be removed in the next major revision of the library" +#endif + +#if defined(MBEDTLS_DEPRECATED_REMOVED) +#error "Record compression support via MBEDTLS_ZLIB_SUPPORT is deprecated and cannot be used if MBEDTLS_DEPRECATED_REMOVED is set" +#endif + +#include "zlib.h" +#endif + +#if defined(MBEDTLS_HAVE_TIME) +#include "mbedtls/platform_time.h" +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#include "psa/crypto.h" +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +/* + * SSL Error codes + */ +/** The requested feature is not available. */ +#define MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE -0x7080 +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_SSL_BAD_INPUT_DATA -0x7100 +/** Verification of the message MAC failed. */ +#define MBEDTLS_ERR_SSL_INVALID_MAC -0x7180 +/** An invalid SSL record was received. */ +#define MBEDTLS_ERR_SSL_INVALID_RECORD -0x7200 +/** The connection indicated an EOF. */ +#define MBEDTLS_ERR_SSL_CONN_EOF -0x7280 +/** An unknown cipher was received. */ +#define MBEDTLS_ERR_SSL_UNKNOWN_CIPHER -0x7300 +/** The server has no ciphersuites in common with the client. */ +#define MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN -0x7380 +/** No RNG was provided to the SSL module. */ +#define MBEDTLS_ERR_SSL_NO_RNG -0x7400 +/** No client certification received from the client, but required by the authentication mode. */ +#define MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE -0x7480 +/** Our own certificate(s) is/are too large to send in an SSL message. */ +#define MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE -0x7500 +/** The own certificate is not set, but needed by the server. */ +#define MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED -0x7580 +/** The own private key or pre-shared key is not set, but needed. */ +#define MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED -0x7600 +/** No CA Chain is set, but required to operate. */ +#define MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED -0x7680 +/** An unexpected message was received from our peer. */ +#define MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE -0x7700 +/** A fatal alert message was received from our peer. */ +#define MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE -0x7780 +/** Verification of our peer failed. */ +#define MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED -0x7800 +/** The peer notified us that the connection is going to be closed. */ +#define MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY -0x7880 +/** Processing of the ClientHello handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO -0x7900 +/** Processing of the ServerHello handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO -0x7980 +/** Processing of the Certificate handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE -0x7A00 +/** Processing of the CertificateRequest handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST -0x7A80 +/** Processing of the ServerKeyExchange handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE -0x7B00 +/** Processing of the ServerHelloDone handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE -0x7B80 +/** Processing of the ClientKeyExchange handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE -0x7C00 +/** Processing of the ClientKeyExchange handshake message failed in DHM / ECDH Read Public. */ +#define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP -0x7C80 +/** Processing of the ClientKeyExchange handshake message failed in DHM / ECDH Calculate Secret. */ +#define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS -0x7D00 +/** Processing of the CertificateVerify handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY -0x7D80 +/** Processing of the ChangeCipherSpec handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC -0x7E00 +/** Processing of the Finished handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_FINISHED -0x7E80 +/** Memory allocation failed */ +#define MBEDTLS_ERR_SSL_ALLOC_FAILED -0x7F00 +/** Hardware acceleration function returned with error */ +#define MBEDTLS_ERR_SSL_HW_ACCEL_FAILED -0x7F80 +/** Hardware acceleration function skipped / left alone data */ +#define MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH -0x6F80 +/** Processing of the compression / decompression failed */ +#define MBEDTLS_ERR_SSL_COMPRESSION_FAILED -0x6F00 +/** Handshake protocol not within min/max boundaries */ +#define MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION -0x6E80 +/** Processing of the NewSessionTicket handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET -0x6E00 +/** Session ticket has expired. */ +#define MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED -0x6D80 +/** Public key type mismatch (eg, asked for RSA key exchange and presented EC key) */ +#define MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH -0x6D00 +/** Unknown identity received (eg, PSK identity) */ +#define MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY -0x6C80 +/** Internal error (eg, unexpected failure in lower-level module) */ +#define MBEDTLS_ERR_SSL_INTERNAL_ERROR -0x6C00 +/** A counter would wrap (eg, too many messages exchanged). */ +#define MBEDTLS_ERR_SSL_COUNTER_WRAPPING -0x6B80 +/** Unexpected message at ServerHello in renegotiation. */ +#define MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO -0x6B00 +/** DTLS client must retry for hello verification */ +#define MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED -0x6A80 +/** A buffer is too small to receive or write a message */ +#define MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL -0x6A00 +/** None of the common ciphersuites is usable (eg, no suitable certificate, see debug messages). */ +#define MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE -0x6980 +/** No data of requested type currently available on underlying transport. */ +#define MBEDTLS_ERR_SSL_WANT_READ -0x6900 +/** Connection requires a write call. */ +#define MBEDTLS_ERR_SSL_WANT_WRITE -0x6880 +/** The operation timed out. */ +#define MBEDTLS_ERR_SSL_TIMEOUT -0x6800 +/** The client initiated a reconnect from the same port. */ +#define MBEDTLS_ERR_SSL_CLIENT_RECONNECT -0x6780 +/** Record header looks valid but is not expected. */ +#define MBEDTLS_ERR_SSL_UNEXPECTED_RECORD -0x6700 +/** The alert message received indicates a non-fatal error. */ +#define MBEDTLS_ERR_SSL_NON_FATAL -0x6680 +/** Couldn't set the hash for verifying CertificateVerify */ +#define MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH -0x6600 +/** Internal-only message signaling that further message-processing should be done */ +#define MBEDTLS_ERR_SSL_CONTINUE_PROCESSING -0x6580 +/** The asynchronous operation is not completed yet. */ +#define MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS -0x6500 +/** Internal-only message signaling that a message arrived early. */ +#define MBEDTLS_ERR_SSL_EARLY_MESSAGE -0x6480 +/** An encrypted DTLS-frame with an unexpected CID was received. */ +#define MBEDTLS_ERR_SSL_UNEXPECTED_CID -0x6000 +/** An operation failed due to an unexpected version or configuration. */ +#define MBEDTLS_ERR_SSL_VERSION_MISMATCH -0x5F00 +/** A cryptographic operation is in progress. Try again later. */ +#define MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS -0x7000 +/** Invalid value in SSL config */ +#define MBEDTLS_ERR_SSL_BAD_CONFIG -0x5E80 + +/* + * Various constants + */ +#define MBEDTLS_SSL_MAJOR_VERSION_3 3 +#define MBEDTLS_SSL_MINOR_VERSION_0 0 /*!< SSL v3.0 */ +#define MBEDTLS_SSL_MINOR_VERSION_1 1 /*!< TLS v1.0 */ +#define MBEDTLS_SSL_MINOR_VERSION_2 2 /*!< TLS v1.1 */ +#define MBEDTLS_SSL_MINOR_VERSION_3 3 /*!< TLS v1.2 */ +#define MBEDTLS_SSL_MINOR_VERSION_4 4 /*!< TLS v1.3 (experimental) */ + +#define MBEDTLS_SSL_TRANSPORT_STREAM 0 /*!< TLS */ +#define MBEDTLS_SSL_TRANSPORT_DATAGRAM 1 /*!< DTLS */ + +#define MBEDTLS_SSL_MAX_HOST_NAME_LEN 255 /*!< Maximum host name defined in RFC 1035 */ +#define MBEDTLS_SSL_MAX_ALPN_NAME_LEN 255 /*!< Maximum size in bytes of a protocol name in alpn ext., RFC 7301 */ + +#define MBEDTLS_SSL_MAX_ALPN_LIST_LEN 65535 /*!< Maximum size in bytes of list in alpn ext., RFC 7301 */ + +/* RFC 6066 section 4, see also mfl_code_to_length in ssl_tls.c + * NONE must be zero so that memset()ing structure to zero works */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_NONE 0 /*!< don't use this extension */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_512 1 /*!< MaxFragmentLength 2^9 */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_1024 2 /*!< MaxFragmentLength 2^10 */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_2048 3 /*!< MaxFragmentLength 2^11 */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_4096 4 /*!< MaxFragmentLength 2^12 */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_INVALID 5 /*!< first invalid value */ + +#define MBEDTLS_SSL_IS_CLIENT 0 +#define MBEDTLS_SSL_IS_SERVER 1 + +#define MBEDTLS_SSL_IS_NOT_FALLBACK 0 +#define MBEDTLS_SSL_IS_FALLBACK 1 + +#define MBEDTLS_SSL_EXTENDED_MS_DISABLED 0 +#define MBEDTLS_SSL_EXTENDED_MS_ENABLED 1 + +#define MBEDTLS_SSL_CID_DISABLED 0 +#define MBEDTLS_SSL_CID_ENABLED 1 + +#define MBEDTLS_SSL_ETM_DISABLED 0 +#define MBEDTLS_SSL_ETM_ENABLED 1 + +#define MBEDTLS_SSL_COMPRESS_NULL 0 +#define MBEDTLS_SSL_COMPRESS_DEFLATE 1 + +#define MBEDTLS_SSL_VERIFY_NONE 0 +#define MBEDTLS_SSL_VERIFY_OPTIONAL 1 +#define MBEDTLS_SSL_VERIFY_REQUIRED 2 +#define MBEDTLS_SSL_VERIFY_UNSET 3 /* Used only for sni_authmode */ + +#define MBEDTLS_SSL_LEGACY_RENEGOTIATION 0 +#define MBEDTLS_SSL_SECURE_RENEGOTIATION 1 + +#define MBEDTLS_SSL_RENEGOTIATION_DISABLED 0 +#define MBEDTLS_SSL_RENEGOTIATION_ENABLED 1 + +#define MBEDTLS_SSL_ANTI_REPLAY_DISABLED 0 +#define MBEDTLS_SSL_ANTI_REPLAY_ENABLED 1 + +#define MBEDTLS_SSL_RENEGOTIATION_NOT_ENFORCED -1 +#define MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT 16 + +#define MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION 0 +#define MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION 1 +#define MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE 2 + +#define MBEDTLS_SSL_TRUNC_HMAC_DISABLED 0 +#define MBEDTLS_SSL_TRUNC_HMAC_ENABLED 1 +#define MBEDTLS_SSL_TRUNCATED_HMAC_LEN 10 /* 80 bits, rfc 6066 section 7 */ + +#define MBEDTLS_SSL_SESSION_TICKETS_DISABLED 0 +#define MBEDTLS_SSL_SESSION_TICKETS_ENABLED 1 + +#define MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED 0 +#define MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED 1 + +#define MBEDTLS_SSL_ARC4_ENABLED 0 +#define MBEDTLS_SSL_ARC4_DISABLED 1 + +#define MBEDTLS_SSL_PRESET_DEFAULT 0 +#define MBEDTLS_SSL_PRESET_SUITEB 2 + +#define MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED 1 +#define MBEDTLS_SSL_CERT_REQ_CA_LIST_DISABLED 0 + +#define MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED 0 +#define MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED 1 + +/* + * Default range for DTLS retransmission timer value, in milliseconds. + * RFC 6347 4.2.4.1 says from 1 second to 60 seconds. + */ +#define MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN 1000 +#define MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX 60000 + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h or define them on the compiler command line. + * \{ + */ + +#if !defined(MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME) +#define MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME 86400 /**< Lifetime of session tickets (if enabled) */ +#endif + +/* + * Maximum fragment length in bytes, + * determines the size of each of the two internal I/O buffers. + * + * Note: the RFC defines the default size of SSL / TLS messages. If you + * change the value here, other clients / servers may not be able to + * communicate with you anymore. Only change this value if you control + * both sides of the connection and have it reduced at both sides, or + * if you're using the Max Fragment Length extension and you know all your + * peers are using it too! + */ +#if !defined(MBEDTLS_SSL_MAX_CONTENT_LEN) +#define MBEDTLS_SSL_MAX_CONTENT_LEN 16384 /**< Size of the input / output buffer */ +#endif + +#if !defined(MBEDTLS_SSL_IN_CONTENT_LEN) +#define MBEDTLS_SSL_IN_CONTENT_LEN MBEDTLS_SSL_MAX_CONTENT_LEN +#endif + +#if !defined(MBEDTLS_SSL_OUT_CONTENT_LEN) +#define MBEDTLS_SSL_OUT_CONTENT_LEN MBEDTLS_SSL_MAX_CONTENT_LEN +#endif + +/* + * Maximum number of heap-allocated bytes for the purpose of + * DTLS handshake message reassembly and future message buffering. + */ +#if !defined(MBEDTLS_SSL_DTLS_MAX_BUFFERING) +#define MBEDTLS_SSL_DTLS_MAX_BUFFERING 32768 +#endif + +/* + * Maximum length of CIDs for incoming and outgoing messages. + */ +#if !defined(MBEDTLS_SSL_CID_IN_LEN_MAX) +#define MBEDTLS_SSL_CID_IN_LEN_MAX 32 +#endif + +#if !defined(MBEDTLS_SSL_CID_OUT_LEN_MAX) +#define MBEDTLS_SSL_CID_OUT_LEN_MAX 32 +#endif + +#if !defined(MBEDTLS_SSL_CID_PADDING_GRANULARITY) +#define MBEDTLS_SSL_CID_PADDING_GRANULARITY 16 +#endif + +#if !defined(MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY) +#define MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY 1 +#endif + +/** \} name SECTION: Module settings */ + +/* + * Length of the verify data for secure renegotiation + */ +#if defined(MBEDTLS_SSL_PROTO_SSL3) +#define MBEDTLS_SSL_VERIFY_DATA_MAX_LEN 36 +#else +#define MBEDTLS_SSL_VERIFY_DATA_MAX_LEN 12 +#endif + +/* + * Signaling ciphersuite values (SCSV) + */ +#define MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO 0xFF /**< renegotiation info ext */ +#define MBEDTLS_SSL_FALLBACK_SCSV_VALUE 0x5600 /**< RFC 7507 section 2 */ + +/* + * Supported Signature and Hash algorithms (For TLS 1.2) + * RFC 5246 section 7.4.1.4.1 + */ +#define MBEDTLS_SSL_HASH_NONE 0 +#define MBEDTLS_SSL_HASH_MD5 1 +#define MBEDTLS_SSL_HASH_SHA1 2 +#define MBEDTLS_SSL_HASH_SHA224 3 +#define MBEDTLS_SSL_HASH_SHA256 4 +#define MBEDTLS_SSL_HASH_SHA384 5 +#define MBEDTLS_SSL_HASH_SHA512 6 + +#define MBEDTLS_SSL_SIG_ANON 0 +#define MBEDTLS_SSL_SIG_RSA 1 +#define MBEDTLS_SSL_SIG_ECDSA 3 + +/* + * Client Certificate Types + * RFC 5246 section 7.4.4 plus RFC 4492 section 5.5 + */ +#define MBEDTLS_SSL_CERT_TYPE_RSA_SIGN 1 +#define MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN 64 + +/* + * Message, alert and handshake types + */ +#define MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC 20 +#define MBEDTLS_SSL_MSG_ALERT 21 +#define MBEDTLS_SSL_MSG_HANDSHAKE 22 +#define MBEDTLS_SSL_MSG_APPLICATION_DATA 23 +#define MBEDTLS_SSL_MSG_CID 25 + +#define MBEDTLS_SSL_ALERT_LEVEL_WARNING 1 +#define MBEDTLS_SSL_ALERT_LEVEL_FATAL 2 + +#define MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY 0 /* 0x00 */ +#define MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE 10 /* 0x0A */ +#define MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC 20 /* 0x14 */ +#define MBEDTLS_SSL_ALERT_MSG_DECRYPTION_FAILED 21 /* 0x15 */ +#define MBEDTLS_SSL_ALERT_MSG_RECORD_OVERFLOW 22 /* 0x16 */ +#define MBEDTLS_SSL_ALERT_MSG_DECOMPRESSION_FAILURE 30 /* 0x1E */ +#define MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE 40 /* 0x28 */ +#define MBEDTLS_SSL_ALERT_MSG_NO_CERT 41 /* 0x29 */ +#define MBEDTLS_SSL_ALERT_MSG_BAD_CERT 42 /* 0x2A */ +#define MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT 43 /* 0x2B */ +#define MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED 44 /* 0x2C */ +#define MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED 45 /* 0x2D */ +#define MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN 46 /* 0x2E */ +#define MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER 47 /* 0x2F */ +#define MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA 48 /* 0x30 */ +#define MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED 49 /* 0x31 */ +#define MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR 50 /* 0x32 */ +#define MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR 51 /* 0x33 */ +#define MBEDTLS_SSL_ALERT_MSG_EXPORT_RESTRICTION 60 /* 0x3C */ +#define MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION 70 /* 0x46 */ +#define MBEDTLS_SSL_ALERT_MSG_INSUFFICIENT_SECURITY 71 /* 0x47 */ +#define MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR 80 /* 0x50 */ +#define MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK 86 /* 0x56 */ +#define MBEDTLS_SSL_ALERT_MSG_USER_CANCELED 90 /* 0x5A */ +#define MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION 100 /* 0x64 */ +#define MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT 110 /* 0x6E */ +#define MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME 112 /* 0x70 */ +#define MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY 115 /* 0x73 */ +#define MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL 120 /* 0x78 */ + +#define MBEDTLS_SSL_HS_HELLO_REQUEST 0 +#define MBEDTLS_SSL_HS_CLIENT_HELLO 1 +#define MBEDTLS_SSL_HS_SERVER_HELLO 2 +#define MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST 3 +#define MBEDTLS_SSL_HS_NEW_SESSION_TICKET 4 +#define MBEDTLS_SSL_HS_CERTIFICATE 11 +#define MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE 12 +#define MBEDTLS_SSL_HS_CERTIFICATE_REQUEST 13 +#define MBEDTLS_SSL_HS_SERVER_HELLO_DONE 14 +#define MBEDTLS_SSL_HS_CERTIFICATE_VERIFY 15 +#define MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE 16 +#define MBEDTLS_SSL_HS_FINISHED 20 + +/* + * TLS extensions + */ +#define MBEDTLS_TLS_EXT_SERVERNAME 0 +#define MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME 0 + +#define MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH 1 + +#define MBEDTLS_TLS_EXT_TRUNCATED_HMAC 4 + +#define MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES 10 +#define MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS 11 + +#define MBEDTLS_TLS_EXT_SIG_ALG 13 + +#define MBEDTLS_TLS_EXT_USE_SRTP 14 + +#define MBEDTLS_TLS_EXT_ALPN 16 + +#define MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC 22 /* 0x16 */ +#define MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET 0x0017 /* 23 */ + +#define MBEDTLS_TLS_EXT_SESSION_TICKET 35 + +/* The value of the CID extension is still TBD as of + * draft-ietf-tls-dtls-connection-id-05 + * (https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05). + * + * A future minor revision of Mbed TLS may change the default value of + * this option to match evolving standards and usage. + */ +#if !defined(MBEDTLS_TLS_EXT_CID) +#define MBEDTLS_TLS_EXT_CID 254 /* TBD */ +#endif + +#define MBEDTLS_TLS_EXT_ECJPAKE_KKPP 256 /* experimental */ + +#define MBEDTLS_TLS_EXT_RENEGOTIATION_INFO 0xFF01 + +/* + * Size defines + */ +#if !defined(MBEDTLS_PSK_MAX_LEN) +#define MBEDTLS_PSK_MAX_LEN 32 /* 256 bits */ +#endif + +/* Dummy type used only for its size */ +union mbedtls_ssl_premaster_secret +{ +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) + unsigned char _pms_rsa[48]; /* RFC 5246 8.1.1 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) + unsigned char _pms_dhm[MBEDTLS_MPI_MAX_SIZE]; /* RFC 5246 8.1.2 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) + unsigned char _pms_ecdh[MBEDTLS_ECP_MAX_BYTES]; /* RFC 4492 5.10 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) + unsigned char _pms_psk[4 + 2 * MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 2 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) + unsigned char _pms_dhe_psk[4 + MBEDTLS_MPI_MAX_SIZE + + MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 3 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) + unsigned char _pms_rsa_psk[52 + MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 4 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) + unsigned char _pms_ecdhe_psk[4 + MBEDTLS_ECP_MAX_BYTES + + MBEDTLS_PSK_MAX_LEN]; /* RFC 5489 2 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) + unsigned char _pms_ecjpake[32]; /* Thread spec: SHA-256 output */ +#endif +}; + +#define MBEDTLS_PREMASTER_SIZE sizeof( union mbedtls_ssl_premaster_secret ) + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * SSL state machine + */ +typedef enum +{ + MBEDTLS_SSL_HELLO_REQUEST, + MBEDTLS_SSL_CLIENT_HELLO, + MBEDTLS_SSL_SERVER_HELLO, + MBEDTLS_SSL_SERVER_CERTIFICATE, + MBEDTLS_SSL_SERVER_KEY_EXCHANGE, + MBEDTLS_SSL_CERTIFICATE_REQUEST, + MBEDTLS_SSL_SERVER_HELLO_DONE, + MBEDTLS_SSL_CLIENT_CERTIFICATE, + MBEDTLS_SSL_CLIENT_KEY_EXCHANGE, + MBEDTLS_SSL_CERTIFICATE_VERIFY, + MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC, + MBEDTLS_SSL_CLIENT_FINISHED, + MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC, + MBEDTLS_SSL_SERVER_FINISHED, + MBEDTLS_SSL_FLUSH_BUFFERS, + MBEDTLS_SSL_HANDSHAKE_WRAPUP, + MBEDTLS_SSL_HANDSHAKE_OVER, + MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET, + MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT, +} +mbedtls_ssl_states; + +/* + * The tls_prf function types. + */ +typedef enum +{ + MBEDTLS_SSL_TLS_PRF_NONE, + MBEDTLS_SSL_TLS_PRF_SSL3, + MBEDTLS_SSL_TLS_PRF_TLS1, + MBEDTLS_SSL_TLS_PRF_SHA384, + MBEDTLS_SSL_TLS_PRF_SHA256 +} +mbedtls_tls_prf_types; +/** + * \brief Callback type: send data on the network. + * + * \note That callback may be either blocking or non-blocking. + * + * \param ctx Context for the send callback (typically a file descriptor) + * \param buf Buffer holding the data to send + * \param len Length of the data to send + * + * \return The callback must return the number of bytes sent if any, + * or a non-zero error code. + * If performing non-blocking I/O, \c MBEDTLS_ERR_SSL_WANT_WRITE + * must be returned when the operation would block. + * + * \note The callback is allowed to send fewer bytes than requested. + * It must always return the number of bytes actually sent. + */ +typedef int mbedtls_ssl_send_t( void *ctx, + const unsigned char *buf, + size_t len ); + +/** + * \brief Callback type: receive data from the network. + * + * \note That callback may be either blocking or non-blocking. + * + * \param ctx Context for the receive callback (typically a file + * descriptor) + * \param buf Buffer to write the received data to + * \param len Length of the receive buffer + * + * \returns If data has been received, the positive number of bytes received. + * \returns \c 0 if the connection has been closed. + * \returns If performing non-blocking I/O, \c MBEDTLS_ERR_SSL_WANT_READ + * must be returned when the operation would block. + * \returns Another negative error code on other kinds of failures. + * + * \note The callback may receive fewer bytes than the length of the + * buffer. It must always return the number of bytes actually + * received and written to the buffer. + */ +typedef int mbedtls_ssl_recv_t( void *ctx, + unsigned char *buf, + size_t len ); + +/** + * \brief Callback type: receive data from the network, with timeout + * + * \note That callback must block until data is received, or the + * timeout delay expires, or the operation is interrupted by a + * signal. + * + * \param ctx Context for the receive callback (typically a file descriptor) + * \param buf Buffer to write the received data to + * \param len Length of the receive buffer + * \param timeout Maximum nomber of millisecondes to wait for data + * 0 means no timeout (potentially waiting forever) + * + * \return The callback must return the number of bytes received, + * or a non-zero error code: + * \c MBEDTLS_ERR_SSL_TIMEOUT if the operation timed out, + * \c MBEDTLS_ERR_SSL_WANT_READ if interrupted by a signal. + * + * \note The callback may receive fewer bytes than the length of the + * buffer. It must always return the number of bytes actually + * received and written to the buffer. + */ +typedef int mbedtls_ssl_recv_timeout_t( void *ctx, + unsigned char *buf, + size_t len, + uint32_t timeout ); +/** + * \brief Callback type: set a pair of timers/delays to watch + * + * \param ctx Context pointer + * \param int_ms Intermediate delay in milliseconds + * \param fin_ms Final delay in milliseconds + * 0 cancels the current timer. + * + * \note This callback must at least store the necessary information + * for the associated \c mbedtls_ssl_get_timer_t callback to + * return correct information. + * + * \note If using a event-driven style of programming, an event must + * be generated when the final delay is passed. The event must + * cause a call to \c mbedtls_ssl_handshake() with the proper + * SSL context to be scheduled. Care must be taken to ensure + * that at most one such call happens at a time. + * + * \note Only one timer at a time must be running. Calling this + * function while a timer is running must cancel it. Cancelled + * timers must not generate any event. + */ +typedef void mbedtls_ssl_set_timer_t( void * ctx, + uint32_t int_ms, + uint32_t fin_ms ); + +/** + * \brief Callback type: get status of timers/delays + * + * \param ctx Context pointer + * + * \return This callback must return: + * -1 if cancelled (fin_ms == 0), + * 0 if none of the delays have passed, + * 1 if only the intermediate delay has passed, + * 2 if the final delay has passed. + */ +typedef int mbedtls_ssl_get_timer_t( void * ctx ); + +/* Defined below */ +typedef struct mbedtls_ssl_session mbedtls_ssl_session; +typedef struct mbedtls_ssl_context mbedtls_ssl_context; +typedef struct mbedtls_ssl_config mbedtls_ssl_config; + +/* Defined in ssl_internal.h */ +typedef struct mbedtls_ssl_transform mbedtls_ssl_transform; +typedef struct mbedtls_ssl_handshake_params mbedtls_ssl_handshake_params; +typedef struct mbedtls_ssl_sig_hash_set_t mbedtls_ssl_sig_hash_set_t; +#if defined(MBEDTLS_X509_CRT_PARSE_C) +typedef struct mbedtls_ssl_key_cert mbedtls_ssl_key_cert; +#endif +#if defined(MBEDTLS_SSL_PROTO_DTLS) +typedef struct mbedtls_ssl_flight_item mbedtls_ssl_flight_item; +#endif + +#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Callback type: start external signature operation. + * + * This callback is called during an SSL handshake to start + * a signature decryption operation using an + * external processor. The parameter \p cert contains + * the public key; it is up to the callback function to + * determine how to access the associated private key. + * + * This function typically sends or enqueues a request, and + * does not wait for the operation to complete. This allows + * the handshake step to be non-blocking. + * + * The parameters \p ssl and \p cert are guaranteed to remain + * valid throughout the handshake. On the other hand, this + * function must save the contents of \p hash if the value + * is needed for later processing, because the \p hash buffer + * is no longer valid after this function returns. + * + * This function may call mbedtls_ssl_set_async_operation_data() + * to store an operation context for later retrieval + * by the resume or cancel callback. + * + * \note For RSA signatures, this function must produce output + * that is consistent with PKCS#1 v1.5 in the same way as + * mbedtls_rsa_pkcs1_sign(). Before the private key operation, + * apply the padding steps described in RFC 8017, section 9.2 + * "EMSA-PKCS1-v1_5" as follows. + * - If \p md_alg is #MBEDTLS_MD_NONE, apply the PKCS#1 v1.5 + * encoding, treating \p hash as the DigestInfo to be + * padded. In other words, apply EMSA-PKCS1-v1_5 starting + * from step 3, with `T = hash` and `tLen = hash_len`. + * - If `md_alg != MBEDTLS_MD_NONE`, apply the PKCS#1 v1.5 + * encoding, treating \p hash as the hash to be encoded and + * padded. In other words, apply EMSA-PKCS1-v1_5 starting + * from step 2, with `digestAlgorithm` obtained by calling + * mbedtls_oid_get_oid_by_md() on \p md_alg. + * + * \note For ECDSA signatures, the output format is the DER encoding + * `Ecdsa-Sig-Value` defined in + * [RFC 4492 section 5.4](https://tools.ietf.org/html/rfc4492#section-5.4). + * + * \param ssl The SSL connection instance. It should not be + * modified other than via + * mbedtls_ssl_set_async_operation_data(). + * \param cert Certificate containing the public key. + * In simple cases, this is one of the pointers passed to + * mbedtls_ssl_conf_own_cert() when configuring the SSL + * connection. However, if other callbacks are used, this + * property may not hold. For example, if an SNI callback + * is registered with mbedtls_ssl_conf_sni(), then + * this callback determines what certificate is used. + * \param md_alg Hash algorithm. + * \param hash Buffer containing the hash. This buffer is + * no longer valid when the function returns. + * \param hash_len Size of the \c hash buffer in bytes. + * + * \return 0 if the operation was started successfully and the SSL + * stack should call the resume callback immediately. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if the operation + * was started successfully and the SSL stack should return + * immediately without calling the resume callback yet. + * \return #MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH if the external + * processor does not support this key. The SSL stack will + * use the private key object instead. + * \return Any other error indicates a fatal failure and is + * propagated up the call chain. The callback should + * use \c MBEDTLS_ERR_PK_xxx error codes, and must not + * use \c MBEDTLS_ERR_SSL_xxx error codes except as + * directed in the documentation of this callback. + */ +typedef int mbedtls_ssl_async_sign_t( mbedtls_ssl_context *ssl, + mbedtls_x509_crt *cert, + mbedtls_md_type_t md_alg, + const unsigned char *hash, + size_t hash_len ); + +/** + * \brief Callback type: start external decryption operation. + * + * This callback is called during an SSL handshake to start + * an RSA decryption operation using an + * external processor. The parameter \p cert contains + * the public key; it is up to the callback function to + * determine how to access the associated private key. + * + * This function typically sends or enqueues a request, and + * does not wait for the operation to complete. This allows + * the handshake step to be non-blocking. + * + * The parameters \p ssl and \p cert are guaranteed to remain + * valid throughout the handshake. On the other hand, this + * function must save the contents of \p input if the value + * is needed for later processing, because the \p input buffer + * is no longer valid after this function returns. + * + * This function may call mbedtls_ssl_set_async_operation_data() + * to store an operation context for later retrieval + * by the resume or cancel callback. + * + * \warning RSA decryption as used in TLS is subject to a potential + * timing side channel attack first discovered by Bleichenbacher + * in 1998. This attack can be remotely exploitable + * in practice. To avoid this attack, you must ensure that + * if the callback performs an RSA decryption, the time it + * takes to execute and return the result does not depend + * on whether the RSA decryption succeeded or reported + * invalid padding. + * + * \param ssl The SSL connection instance. It should not be + * modified other than via + * mbedtls_ssl_set_async_operation_data(). + * \param cert Certificate containing the public key. + * In simple cases, this is one of the pointers passed to + * mbedtls_ssl_conf_own_cert() when configuring the SSL + * connection. However, if other callbacks are used, this + * property may not hold. For example, if an SNI callback + * is registered with mbedtls_ssl_conf_sni(), then + * this callback determines what certificate is used. + * \param input Buffer containing the input ciphertext. This buffer + * is no longer valid when the function returns. + * \param input_len Size of the \p input buffer in bytes. + * + * \return 0 if the operation was started successfully and the SSL + * stack should call the resume callback immediately. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if the operation + * was started successfully and the SSL stack should return + * immediately without calling the resume callback yet. + * \return #MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH if the external + * processor does not support this key. The SSL stack will + * use the private key object instead. + * \return Any other error indicates a fatal failure and is + * propagated up the call chain. The callback should + * use \c MBEDTLS_ERR_PK_xxx error codes, and must not + * use \c MBEDTLS_ERR_SSL_xxx error codes except as + * directed in the documentation of this callback. + */ +typedef int mbedtls_ssl_async_decrypt_t( mbedtls_ssl_context *ssl, + mbedtls_x509_crt *cert, + const unsigned char *input, + size_t input_len ); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +/** + * \brief Callback type: resume external operation. + * + * This callback is called during an SSL handshake to resume + * an external operation started by the + * ::mbedtls_ssl_async_sign_t or + * ::mbedtls_ssl_async_decrypt_t callback. + * + * This function typically checks the status of a pending + * request or causes the request queue to make progress, and + * does not wait for the operation to complete. This allows + * the handshake step to be non-blocking. + * + * This function may call mbedtls_ssl_get_async_operation_data() + * to retrieve an operation context set by the start callback. + * It may call mbedtls_ssl_set_async_operation_data() to modify + * this context. + * + * Note that when this function returns a status other than + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, it must free any + * resources associated with the operation. + * + * \param ssl The SSL connection instance. It should not be + * modified other than via + * mbedtls_ssl_set_async_operation_data(). + * \param output Buffer containing the output (signature or decrypted + * data) on success. + * \param output_len On success, number of bytes written to \p output. + * \param output_size Size of the \p output buffer in bytes. + * + * \return 0 if output of the operation is available in the + * \p output buffer. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if the operation + * is still in progress. Subsequent requests for progress + * on the SSL connection will call the resume callback + * again. + * \return Any other error means that the operation is aborted. + * The SSL handshake is aborted. The callback should + * use \c MBEDTLS_ERR_PK_xxx error codes, and must not + * use \c MBEDTLS_ERR_SSL_xxx error codes except as + * directed in the documentation of this callback. + */ +typedef int mbedtls_ssl_async_resume_t( mbedtls_ssl_context *ssl, + unsigned char *output, + size_t *output_len, + size_t output_size ); + +/** + * \brief Callback type: cancel external operation. + * + * This callback is called if an SSL connection is closed + * while an asynchronous operation is in progress. Note that + * this callback is not called if the + * ::mbedtls_ssl_async_resume_t callback has run and has + * returned a value other than + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, since in that case + * the asynchronous operation has already completed. + * + * This function may call mbedtls_ssl_get_async_operation_data() + * to retrieve an operation context set by the start callback. + * + * \param ssl The SSL connection instance. It should not be + * modified. + */ +typedef void mbedtls_ssl_async_cancel_t( mbedtls_ssl_context *ssl ); +#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ + +#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) && \ + !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) +#define MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN 48 +#if defined(MBEDTLS_SHA256_C) +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE MBEDTLS_MD_SHA256 +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN 32 +#elif defined(MBEDTLS_SHA512_C) +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE MBEDTLS_MD_SHA384 +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN 48 +#elif defined(MBEDTLS_SHA1_C) +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE MBEDTLS_MD_SHA1 +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN 20 +#else +/* This is already checked in check_config.h, but be sure. */ +#error "Bad configuration - need SHA-1, SHA-256 or SHA-512 enabled to compute digest of peer CRT." +#endif +#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED && + !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ + +#if defined(MBEDTLS_SSL_DTLS_SRTP) + +#define MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH 255 +#define MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH 4 +/* + * For code readability use a typedef for DTLS-SRTP profiles + * + * Use_srtp extension protection profiles values as defined in + * http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml + * + * Reminder: if this list is expanded mbedtls_ssl_check_srtp_profile_value + * must be updated too. + */ +#define MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80 ( (uint16_t) 0x0001) +#define MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32 ( (uint16_t) 0x0002) +#define MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80 ( (uint16_t) 0x0005) +#define MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32 ( (uint16_t) 0x0006) +/* This one is not iana defined, but for code readability. */ +#define MBEDTLS_TLS_SRTP_UNSET ( (uint16_t) 0x0000) + +typedef uint16_t mbedtls_ssl_srtp_profile; + +typedef struct mbedtls_dtls_srtp_info_t +{ + /*! The SRTP profile that was negotiated. */ + mbedtls_ssl_srtp_profile chosen_dtls_srtp_profile; + /*! The length of mki_value. */ + uint16_t mki_len; + /*! The mki_value used, with max size of 256 bytes. */ + unsigned char mki_value[MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH]; +} +mbedtls_dtls_srtp_info; + +#endif /* MBEDTLS_SSL_DTLS_SRTP */ + +/* + * This structure is used for storing current session data. + * + * Note: when changing this definition, we need to check and update: + * - in tests/suites/test_suite_ssl.function: + * ssl_populate_session() and ssl_serialize_session_save_load() + * - in library/ssl_tls.c: + * mbedtls_ssl_session_init() and mbedtls_ssl_session_free() + * mbedtls_ssl_session_save() and ssl_session_load() + * ssl_session_copy() + */ +struct mbedtls_ssl_session +{ +#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) + unsigned char mfl_code; /*!< MaxFragmentLength negotiated by peer */ +#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ + +#if defined(MBEDTLS_HAVE_TIME) + mbedtls_time_t start; /*!< starting time */ +#endif + int ciphersuite; /*!< chosen ciphersuite */ + int compression; /*!< chosen compression */ + size_t id_len; /*!< session id length */ + unsigned char id[32]; /*!< session identifier */ + unsigned char master[48]; /*!< the master secret */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) + mbedtls_x509_crt *peer_cert; /*!< peer X.509 cert chain */ +#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ + /*! The digest of the peer's end-CRT. This must be kept to detect CRT + * changes during renegotiation, mitigating the triple handshake attack. */ + unsigned char *peer_cert_digest; + size_t peer_cert_digest_len; + mbedtls_md_type_t peer_cert_digest_type; +#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + uint32_t verify_result; /*!< verification result */ + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) + unsigned char *ticket; /*!< RFC 5077 session ticket */ + size_t ticket_len; /*!< session ticket length */ + uint32_t ticket_lifetime; /*!< ticket lifetime hint */ +#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */ + +#if defined(MBEDTLS_SSL_TRUNCATED_HMAC) + int trunc_hmac; /*!< flag for truncated hmac activation */ +#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ + +#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) + int encrypt_then_mac; /*!< flag for EtM activation */ +#endif +}; + +/** + * SSL/TLS configuration to be shared between mbedtls_ssl_context structures. + */ +struct mbedtls_ssl_config +{ + /* Group items by size and reorder them to maximize usage of immediate offset access. */ + + /* + * Numerical settings (char) + */ + + unsigned char max_major_ver; /*!< max. major version used */ + unsigned char max_minor_ver; /*!< max. minor version used */ + unsigned char min_major_ver; /*!< min. major version used */ + unsigned char min_minor_ver; /*!< min. minor version used */ + + /* + * Flags (could be bit-fields to save RAM, but separate bytes make + * the code smaller on architectures with an instruction for direct + * byte access). + */ + + uint8_t endpoint /*bool*/; /*!< 0: client, 1: server */ + uint8_t transport /*bool*/; /*!< stream (TLS) or datagram (DTLS) */ + uint8_t authmode /*2 bits*/; /*!< MBEDTLS_SSL_VERIFY_XXX */ + /* needed even with renego disabled for LEGACY_BREAK_HANDSHAKE */ + uint8_t allow_legacy_renegotiation /*2 bits*/; /*!< MBEDTLS_LEGACY_XXX */ +#if defined(MBEDTLS_ARC4_C) + uint8_t arc4_disabled /*bool*/; /*!< blacklist RC4 ciphersuites? */ +#endif +#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) + uint8_t mfl_code /*3 bits*/; /*!< desired fragment length */ +#endif +#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) + uint8_t encrypt_then_mac /*bool*/; /*!< negotiate encrypt-then-mac? */ +#endif +#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) + uint8_t extended_ms /*bool*/; /*!< negotiate extended master secret? */ +#endif +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) + uint8_t anti_replay /*bool*/; /*!< detect and prevent replay? */ +#endif +#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) + uint8_t cbc_record_splitting /*bool*/; /*!< do cbc record splitting */ +#endif +#if defined(MBEDTLS_SSL_RENEGOTIATION) + uint8_t disable_renegotiation /*bool*/; /*!< disable renegotiation? */ +#endif +#if defined(MBEDTLS_SSL_TRUNCATED_HMAC) + uint8_t trunc_hmac /*bool*/; /*!< negotiate truncated hmac? */ +#endif +#if defined(MBEDTLS_SSL_SESSION_TICKETS) + uint8_t session_tickets /*bool*/; /*!< use session tickets? */ +#endif +#if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C) + uint8_t fallback /*bool*/; /*!< is this a fallback? */ +#endif +#if defined(MBEDTLS_SSL_SRV_C) + uint8_t cert_req_ca_list /*bool*/; /*!< enable sending CA list in + Certificate Request messages? */ +#endif +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + uint8_t ignore_unexpected_cid /*bool*/; /*!< Determines whether DTLS + * record with unexpected CID + * should lead to failure. */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ +#if defined(MBEDTLS_SSL_DTLS_SRTP) + uint8_t dtls_srtp_mki_support /*bool*/; /*!< support having mki_value + in the use_srtp extension? */ +#endif + + /* + * Numerical settings (int or larger) + */ + + uint32_t read_timeout; /*!< timeout for mbedtls_ssl_read (ms) */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + uint32_t hs_timeout_min; /*!< initial value of the handshake + retransmission timeout (ms) */ + uint32_t hs_timeout_max; /*!< maximum value of the handshake + retransmission timeout (ms) */ +#endif + +#if defined(MBEDTLS_SSL_RENEGOTIATION) + int renego_max_records; /*!< grace period for renegotiation */ + unsigned char renego_period[8]; /*!< value of the record counters + that triggers renegotiation */ +#endif + +#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) + unsigned int badmac_limit; /*!< limit of records with a bad MAC */ +#endif + +#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C) + unsigned int dhm_min_bitlen; /*!< min. bit length of the DHM prime */ +#endif + + /* + * Pointers + */ + + const int *ciphersuite_list[4]; /*!< allowed ciphersuites per version */ + + /** Callback for printing debug output */ + void (*f_dbg)(void *, int, const char *, int, const char *); + void *p_dbg; /*!< context for the debug function */ + + /** Callback for getting (pseudo-)random numbers */ + int (*f_rng)(void *, unsigned char *, size_t); + void *p_rng; /*!< context for the RNG function */ + + /** Callback to retrieve a session from the cache */ + int (*f_get_cache)(void *, mbedtls_ssl_session *); + /** Callback to store a session into the cache */ + int (*f_set_cache)(void *, const mbedtls_ssl_session *); + void *p_cache; /*!< context for cache callbacks */ + +#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) + /** Callback for setting cert according to SNI extension */ + int (*f_sni)(void *, mbedtls_ssl_context *, const unsigned char *, size_t); + void *p_sni; /*!< context for SNI callback */ +#endif + +#if defined(MBEDTLS_X509_CRT_PARSE_C) + /** Callback to customize X.509 certificate chain verification */ + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *); + void *p_vrfy; /*!< context for X.509 verify calllback */ +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) + /** Callback to retrieve PSK key from identity */ + int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *, size_t); + void *p_psk; /*!< context for PSK callback */ +#endif + +#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) + /** Callback to create & write a cookie for ClientHello verification */ + int (*f_cookie_write)( void *, unsigned char **, unsigned char *, + const unsigned char *, size_t ); + /** Callback to verify validity of a ClientHello cookie */ + int (*f_cookie_check)( void *, const unsigned char *, size_t, + const unsigned char *, size_t ); + void *p_cookie; /*!< context for the cookie callbacks */ +#endif + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_SRV_C) + /** Callback to create & write a session ticket */ + int (*f_ticket_write)( void *, const mbedtls_ssl_session *, + unsigned char *, const unsigned char *, size_t *, uint32_t * ); + /** Callback to parse a session ticket into a session structure */ + int (*f_ticket_parse)( void *, mbedtls_ssl_session *, unsigned char *, size_t); + void *p_ticket; /*!< context for the ticket callbacks */ +#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_SRV_C */ + +#if defined(MBEDTLS_SSL_EXPORT_KEYS) + /** Callback to export key block and master secret */ + int (*f_export_keys)( void *, const unsigned char *, + const unsigned char *, size_t, size_t, size_t ); + /** Callback to export key block, master secret, + * tls_prf and random bytes. Should replace f_export_keys */ + int (*f_export_keys_ext)( void *, const unsigned char *, + const unsigned char *, size_t, size_t, size_t, + const unsigned char[32], const unsigned char[32], + mbedtls_tls_prf_types ); + void *p_export_keys; /*!< context for key export callback */ +#endif + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + size_t cid_len; /*!< The length of CIDs for incoming DTLS records. */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) + const mbedtls_x509_crt_profile *cert_profile; /*!< verification profile */ + mbedtls_ssl_key_cert *key_cert; /*!< own certificate/key pair(s) */ + mbedtls_x509_crt *ca_chain; /*!< trusted CAs */ + mbedtls_x509_crl *ca_crl; /*!< trusted CAs CRLs */ +#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) + mbedtls_x509_crt_ca_cb_t f_ca_cb; + void *p_ca_cb; +#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) +#if defined(MBEDTLS_X509_CRT_PARSE_C) + mbedtls_ssl_async_sign_t *f_async_sign_start; /*!< start asynchronous signature operation */ + mbedtls_ssl_async_decrypt_t *f_async_decrypt_start; /*!< start asynchronous decryption operation */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + mbedtls_ssl_async_resume_t *f_async_resume; /*!< resume asynchronous operation */ + mbedtls_ssl_async_cancel_t *f_async_cancel; /*!< cancel asynchronous operation */ + void *p_async_config_data; /*!< Configuration data set by mbedtls_ssl_conf_async_private_cb(). */ +#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ + +#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) + const int *sig_hashes; /*!< allowed signature hashes */ +#endif + +#if defined(MBEDTLS_ECP_C) + const mbedtls_ecp_group_id *curve_list; /*!< allowed curves */ +#endif + +#if defined(MBEDTLS_DHM_C) + mbedtls_mpi dhm_P; /*!< prime modulus for DHM */ + mbedtls_mpi dhm_G; /*!< generator for DHM */ +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) + +#if defined(MBEDTLS_USE_PSA_CRYPTO) + psa_key_id_t psk_opaque; /*!< PSA key slot holding opaque PSK. This field + * should only be set via + * mbedtls_ssl_conf_psk_opaque(). + * If either no PSK or a raw PSK have been + * configured, this has value \c 0. + */ +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + + unsigned char *psk; /*!< The raw pre-shared key. This field should + * only be set via mbedtls_ssl_conf_psk(). + * If either no PSK or an opaque PSK + * have been configured, this has value NULL. */ + size_t psk_len; /*!< The length of the raw pre-shared key. + * This field should only be set via + * mbedtls_ssl_conf_psk(). + * Its value is non-zero if and only if + * \c psk is not \c NULL. */ + + unsigned char *psk_identity; /*!< The PSK identity for PSK negotiation. + * This field should only be set via + * mbedtls_ssl_conf_psk(). + * This is set if and only if either + * \c psk or \c psk_opaque are set. */ + size_t psk_identity_len;/*!< The length of PSK identity. + * This field should only be set via + * mbedtls_ssl_conf_psk(). + * Its value is non-zero if and only if + * \c psk is not \c NULL or \c psk_opaque + * is not \c 0. */ +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ + +#if defined(MBEDTLS_SSL_ALPN) + const char **alpn_list; /*!< ordered list of protocols */ +#endif + +#if defined(MBEDTLS_SSL_DTLS_SRTP) + /*! ordered list of supported srtp profile */ + const mbedtls_ssl_srtp_profile *dtls_srtp_profile_list; + /*! number of supported profiles */ + size_t dtls_srtp_profile_list_len; +#endif /* MBEDTLS_SSL_DTLS_SRTP */ +}; + +struct mbedtls_ssl_context +{ + const mbedtls_ssl_config *conf; /*!< configuration information */ + + /* + * Miscellaneous + */ + int state; /*!< SSL handshake: current state */ +#if defined(MBEDTLS_SSL_RENEGOTIATION) + int renego_status; /*!< Initial, in progress, pending? */ + int renego_records_seen; /*!< Records since renego request, or with DTLS, + number of retransmissions of request if + renego_max_records is < 0 */ +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + + int major_ver; /*!< equal to MBEDTLS_SSL_MAJOR_VERSION_3 */ + int minor_ver; /*!< either 0 (SSL3) or 1 (TLS1.0) */ + +#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) + unsigned badmac_seen; /*!< records with a bad MAC received */ +#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) + /** Callback to customize X.509 certificate chain verification */ + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *); + void *p_vrfy; /*!< context for X.509 verify callback */ +#endif + + mbedtls_ssl_send_t *f_send; /*!< Callback for network send */ + mbedtls_ssl_recv_t *f_recv; /*!< Callback for network receive */ + mbedtls_ssl_recv_timeout_t *f_recv_timeout; + /*!< Callback for network receive with timeout */ + + void *p_bio; /*!< context for I/O operations */ + + /* + * Session layer + */ + mbedtls_ssl_session *session_in; /*!< current session data (in) */ + mbedtls_ssl_session *session_out; /*!< current session data (out) */ + mbedtls_ssl_session *session; /*!< negotiated session data */ + mbedtls_ssl_session *session_negotiate; /*!< session data in negotiation */ + + mbedtls_ssl_handshake_params *handshake; /*!< params required only during + the handshake process */ + + /* + * Record layer transformations + */ + mbedtls_ssl_transform *transform_in; /*!< current transform params (in) */ + mbedtls_ssl_transform *transform_out; /*!< current transform params (in) */ + mbedtls_ssl_transform *transform; /*!< negotiated transform params */ + mbedtls_ssl_transform *transform_negotiate; /*!< transform params in negotiation */ + + /* + * Timers + */ + void *p_timer; /*!< context for the timer callbacks */ + + mbedtls_ssl_set_timer_t *f_set_timer; /*!< set timer callback */ + mbedtls_ssl_get_timer_t *f_get_timer; /*!< get timer callback */ + + /* + * Record layer (incoming data) + */ + unsigned char *in_buf; /*!< input buffer */ + unsigned char *in_ctr; /*!< 64-bit incoming message counter + TLS: maintained by us + DTLS: read from peer */ + unsigned char *in_hdr; /*!< start of record header */ +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + unsigned char *in_cid; /*!< The start of the CID; + * (the end is marked by in_len). */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + unsigned char *in_len; /*!< two-bytes message length field */ + unsigned char *in_iv; /*!< ivlen-byte IV */ + unsigned char *in_msg; /*!< message contents (in_iv+ivlen) */ + unsigned char *in_offt; /*!< read offset in application data */ + + int in_msgtype; /*!< record header: message type */ + size_t in_msglen; /*!< record header: message length */ + size_t in_left; /*!< amount of data read so far */ +#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) + size_t in_buf_len; /*!< length of input buffer */ +#endif +#if defined(MBEDTLS_SSL_PROTO_DTLS) + uint16_t in_epoch; /*!< DTLS epoch for incoming records */ + size_t next_record_offset; /*!< offset of the next record in datagram + (equal to in_left if none) */ +#endif /* MBEDTLS_SSL_PROTO_DTLS */ +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) + uint64_t in_window_top; /*!< last validated record seq_num */ + uint64_t in_window; /*!< bitmask for replay detection */ +#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */ + + size_t in_hslen; /*!< current handshake message length, + including the handshake header */ + int nb_zero; /*!< # of 0-length encrypted messages */ + + int keep_current_message; /*!< drop or reuse current message + on next call to record layer? */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + uint8_t disable_datagram_packing; /*!< Disable packing multiple records + * within a single datagram. */ +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + + /* + * Record layer (outgoing data) + */ + unsigned char *out_buf; /*!< output buffer */ + unsigned char *out_ctr; /*!< 64-bit outgoing message counter */ + unsigned char *out_hdr; /*!< start of record header */ +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + unsigned char *out_cid; /*!< The start of the CID; + * (the end is marked by in_len). */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + unsigned char *out_len; /*!< two-bytes message length field */ + unsigned char *out_iv; /*!< ivlen-byte IV */ + unsigned char *out_msg; /*!< message contents (out_iv+ivlen) */ + + int out_msgtype; /*!< record header: message type */ + size_t out_msglen; /*!< record header: message length */ + size_t out_left; /*!< amount of data not yet written */ +#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) + size_t out_buf_len; /*!< length of output buffer */ +#endif + + unsigned char cur_out_ctr[8]; /*!< Outgoing record sequence number. */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + uint16_t mtu; /*!< path mtu, used to fragment outgoing messages */ +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + +#if defined(MBEDTLS_ZLIB_SUPPORT) + unsigned char *compress_buf; /*!< zlib data buffer */ +#endif /* MBEDTLS_ZLIB_SUPPORT */ +#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) + signed char split_done; /*!< current record already split? */ +#endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */ + + /* + * PKI layer + */ + int client_auth; /*!< flag for client auth. */ + + /* + * User settings + */ +#if defined(MBEDTLS_X509_CRT_PARSE_C) + char *hostname; /*!< expected peer CN for verification + (and SNI if available) */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_ALPN) + const char *alpn_chosen; /*!< negotiated protocol */ +#endif /* MBEDTLS_SSL_ALPN */ + +#if defined(MBEDTLS_SSL_DTLS_SRTP) + /* + * use_srtp extension + */ + mbedtls_dtls_srtp_info dtls_srtp_info; +#endif /* MBEDTLS_SSL_DTLS_SRTP */ + + /* + * Information for DTLS hello verify + */ +#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) + unsigned char *cli_id; /*!< transport-level ID of the client */ + size_t cli_id_len; /*!< length of cli_id */ +#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */ + + /* + * Secure renegotiation + */ + /* needed to know when to send extension on server */ + int secure_renegotiation; /*!< does peer support legacy or + secure renegotiation */ +#if defined(MBEDTLS_SSL_RENEGOTIATION) + size_t verify_data_len; /*!< length of verify data stored */ + char own_verify_data[MBEDTLS_SSL_VERIFY_DATA_MAX_LEN]; /*!< previous handshake verify data */ + char peer_verify_data[MBEDTLS_SSL_VERIFY_DATA_MAX_LEN]; /*!< previous handshake verify data */ +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + /* CID configuration to use in subsequent handshakes. */ + + /*! The next incoming CID, chosen by the user and applying to + * all subsequent handshakes. This may be different from the + * CID currently used in case the user has re-configured the CID + * after an initial handshake. */ + unsigned char own_cid[ MBEDTLS_SSL_CID_IN_LEN_MAX ]; + uint8_t own_cid_len; /*!< The length of \c own_cid. */ + uint8_t negotiate_cid; /*!< This indicates whether the CID extension should + * be negotiated in the next handshake or not. + * Possible values are #MBEDTLS_SSL_CID_ENABLED + * and #MBEDTLS_SSL_CID_DISABLED. */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ +}; + +#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) + +#define MBEDTLS_SSL_CHANNEL_OUTBOUND MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( 0 ) +#define MBEDTLS_SSL_CHANNEL_INBOUND MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( 1 ) + +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif /* MBEDTLS_DEPRECATED_WARNING */ + +MBEDTLS_DEPRECATED extern int (*mbedtls_ssl_hw_record_init)( + mbedtls_ssl_context *ssl, + const unsigned char *key_enc, const unsigned char *key_dec, + size_t keylen, + const unsigned char *iv_enc, const unsigned char *iv_dec, + size_t ivlen, + const unsigned char *mac_enc, const unsigned char *mac_dec, + size_t maclen); +MBEDTLS_DEPRECATED extern int (*mbedtls_ssl_hw_record_activate)( + mbedtls_ssl_context *ssl, + int direction ); +MBEDTLS_DEPRECATED extern int (*mbedtls_ssl_hw_record_reset)( + mbedtls_ssl_context *ssl ); +MBEDTLS_DEPRECATED extern int (*mbedtls_ssl_hw_record_write)( + mbedtls_ssl_context *ssl ); +MBEDTLS_DEPRECATED extern int (*mbedtls_ssl_hw_record_read)( + mbedtls_ssl_context *ssl ); +MBEDTLS_DEPRECATED extern int (*mbedtls_ssl_hw_record_finish)( + mbedtls_ssl_context *ssl ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */ + +/** + * \brief Return the name of the ciphersuite associated with the + * given ID + * + * \param ciphersuite_id SSL ciphersuite ID + * + * \return a string containing the ciphersuite name + */ +const char *mbedtls_ssl_get_ciphersuite_name( const int ciphersuite_id ); + +/** + * \brief Return the ID of the ciphersuite associated with the + * given name + * + * \param ciphersuite_name SSL ciphersuite name + * + * \return the ID with the ciphersuite or 0 if not found + */ +int mbedtls_ssl_get_ciphersuite_id( const char *ciphersuite_name ); + +/** + * \brief Initialize an SSL context + * Just makes the context ready for mbedtls_ssl_setup() or + * mbedtls_ssl_free() + * + * \param ssl SSL context + */ +void mbedtls_ssl_init( mbedtls_ssl_context *ssl ); + +/** + * \brief Set up an SSL context for use + * + * \note No copy of the configuration context is made, it can be + * shared by many mbedtls_ssl_context structures. + * + * \warning The conf structure will be accessed during the session. + * It must not be modified or freed as long as the session + * is active. + * + * \warning This function must be called exactly once per context. + * Calling mbedtls_ssl_setup again is not supported, even + * if no session is active. + * + * \param ssl SSL context + * \param conf SSL configuration to use + * + * \return 0 if successful, or MBEDTLS_ERR_SSL_ALLOC_FAILED if + * memory allocation failed + */ +int mbedtls_ssl_setup( mbedtls_ssl_context *ssl, + const mbedtls_ssl_config *conf ); + +/** + * \brief Reset an already initialized SSL context for re-use + * while retaining application-set variables, function + * pointers and data. + * + * \param ssl SSL context + * \return 0 if successful, or MBEDTLS_ERR_SSL_ALLOC_FAILED, + MBEDTLS_ERR_SSL_HW_ACCEL_FAILED or + * MBEDTLS_ERR_SSL_COMPRESSION_FAILED + */ +int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl ); + +/** + * \brief Set the current endpoint type + * + * \param conf SSL configuration + * \param endpoint must be MBEDTLS_SSL_IS_CLIENT or MBEDTLS_SSL_IS_SERVER + */ +void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint ); + +/** + * \brief Set the transport type (TLS or DTLS). + * Default: TLS + * + * \note For DTLS, you must either provide a recv callback that + * doesn't block, or one that handles timeouts, see + * \c mbedtls_ssl_set_bio(). You also need to provide timer + * callbacks with \c mbedtls_ssl_set_timer_cb(). + * + * \param conf SSL configuration + * \param transport transport type: + * MBEDTLS_SSL_TRANSPORT_STREAM for TLS, + * MBEDTLS_SSL_TRANSPORT_DATAGRAM for DTLS. + */ +void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport ); + +/** + * \brief Set the certificate verification mode + * Default: NONE on server, REQUIRED on client + * + * \param conf SSL configuration + * \param authmode can be: + * + * MBEDTLS_SSL_VERIFY_NONE: peer certificate is not checked + * (default on server) + * (insecure on client) + * + * MBEDTLS_SSL_VERIFY_OPTIONAL: peer certificate is checked, however the + * handshake continues even if verification failed; + * mbedtls_ssl_get_verify_result() can be called after the + * handshake is complete. + * + * MBEDTLS_SSL_VERIFY_REQUIRED: peer *must* present a valid certificate, + * handshake is aborted if verification failed. + * (default on client) + * + * \note On client, MBEDTLS_SSL_VERIFY_REQUIRED is the recommended mode. + * With MBEDTLS_SSL_VERIFY_OPTIONAL, the user needs to call mbedtls_ssl_get_verify_result() at + * the right time(s), which may not be obvious, while REQUIRED always perform + * the verification as soon as possible. For example, REQUIRED was protecting + * against the "triple handshake" attack even before it was found. + */ +void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode ); + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Set the verification callback (Optional). + * + * If set, the provided verify callback is called for each + * certificate in the peer's CRT chain, including the trusted + * root. For more information, please see the documentation of + * \c mbedtls_x509_crt_verify(). + * + * \note For per context callbacks and contexts, please use + * mbedtls_ssl_set_verify() instead. + * + * \param conf The SSL configuration to use. + * \param f_vrfy The verification callback to use during CRT verification. + * \param p_vrfy The opaque context to be passed to the callback. + */ +void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy ); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +/** + * \brief Set the random number generator callback + * + * \param conf SSL configuration + * \param f_rng RNG function + * \param p_rng RNG parameter + */ +void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief Set the debug callback + * + * The callback has the following argument: + * void * opaque context for the callback + * int debug level + * const char * file name + * int line number + * const char * message + * + * \param conf SSL configuration + * \param f_dbg debug function + * \param p_dbg debug parameter + */ +void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf, + void (*f_dbg)(void *, int, const char *, int, const char *), + void *p_dbg ); + +/** + * \brief Set the underlying BIO callbacks for write, read and + * read-with-timeout. + * + * \param ssl SSL context + * \param p_bio parameter (context) shared by BIO callbacks + * \param f_send write callback + * \param f_recv read callback + * \param f_recv_timeout blocking read callback with timeout. + * + * \note One of f_recv or f_recv_timeout can be NULL, in which case + * the other is used. If both are non-NULL, f_recv_timeout is + * used and f_recv is ignored (as if it were NULL). + * + * \note The two most common use cases are: + * - non-blocking I/O, f_recv != NULL, f_recv_timeout == NULL + * - blocking I/O, f_recv == NULL, f_recv_timeout != NULL + * + * \note For DTLS, you need to provide either a non-NULL + * f_recv_timeout callback, or a f_recv that doesn't block. + * + * \note See the documentations of \c mbedtls_ssl_send_t, + * \c mbedtls_ssl_recv_t and \c mbedtls_ssl_recv_timeout_t for + * the conventions those callbacks must follow. + * + * \note On some platforms, net_sockets.c provides + * \c mbedtls_net_send(), \c mbedtls_net_recv() and + * \c mbedtls_net_recv_timeout() that are suitable to be used + * here. + */ +void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl, + void *p_bio, + mbedtls_ssl_send_t *f_send, + mbedtls_ssl_recv_t *f_recv, + mbedtls_ssl_recv_timeout_t *f_recv_timeout ); + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + + +/** + * \brief Configure the use of the Connection ID (CID) + * extension in the next handshake. + * + * Reference: draft-ietf-tls-dtls-connection-id-05 + * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05 + * + * The DTLS CID extension allows the reliable association of + * DTLS records to DTLS connections across changes in the + * underlying transport (changed IP and Port metadata) by + * adding explicit connection identifiers (CIDs) to the + * headers of encrypted DTLS records. The desired CIDs are + * configured by the application layer and are exchanged in + * new `ClientHello` / `ServerHello` extensions during the + * handshake, where each side indicates the CID it wants the + * peer to use when writing encrypted messages. The CIDs are + * put to use once records get encrypted: the stack discards + * any incoming records that don't include the configured CID + * in their header, and adds the peer's requested CID to the + * headers of outgoing messages. + * + * This API enables or disables the use of the CID extension + * in the next handshake and sets the value of the CID to + * be used for incoming messages. + * + * \param ssl The SSL context to configure. This must be initialized. + * \param enable This value determines whether the CID extension should + * be used or not. Possible values are: + * - MBEDTLS_SSL_CID_ENABLED to enable the use of the CID. + * - MBEDTLS_SSL_CID_DISABLED (default) to disable the use + * of the CID. + * \param own_cid The address of the readable buffer holding the CID we want + * the peer to use when sending encrypted messages to us. + * This may be \c NULL if \p own_cid_len is \c 0. + * This parameter is unused if \p enabled is set to + * MBEDTLS_SSL_CID_DISABLED. + * \param own_cid_len The length of \p own_cid. + * This parameter is unused if \p enabled is set to + * MBEDTLS_SSL_CID_DISABLED. + * + * \note The value of \p own_cid_len must match the value of the + * \c len parameter passed to mbedtls_ssl_conf_cid() + * when configuring the ::mbedtls_ssl_config that \p ssl + * is bound to. + * + * \note This CID configuration applies to subsequent handshakes + * performed on the SSL context \p ssl, but does not trigger + * one. You still have to call `mbedtls_ssl_handshake()` + * (for the initial handshake) or `mbedtls_ssl_renegotiate()` + * (for a renegotiation handshake) explicitly after a + * successful call to this function to run the handshake. + * + * \note This call cannot guarantee that the use of the CID + * will be successfully negotiated in the next handshake, + * because the peer might not support it. Specifically: + * - On the Client, enabling the use of the CID through + * this call implies that the `ClientHello` in the next + * handshake will include the CID extension, thereby + * offering the use of the CID to the server. Only if + * the `ServerHello` contains the CID extension, too, + * the CID extension will actually be put to use. + * - On the Server, enabling the use of the CID through + * this call implies that that the server will look for + * the CID extension in a `ClientHello` from the client, + * and, if present, reply with a CID extension in its + * `ServerHello`. + * + * \note To check whether the use of the CID was negotiated + * after the subsequent handshake has completed, please + * use the API mbedtls_ssl_get_peer_cid(). + * + * \warning If the use of the CID extension is enabled in this call + * and the subsequent handshake negotiates its use, Mbed TLS + * will silently drop every packet whose CID does not match + * the CID configured in \p own_cid. It is the responsibility + * of the user to adapt the underlying transport to take care + * of CID-based demultiplexing before handing datagrams to + * Mbed TLS. + * + * \return \c 0 on success. In this case, the CID configuration + * applies to the next handshake. + * \return A negative error code on failure. + */ +int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl, + int enable, + unsigned char const *own_cid, + size_t own_cid_len ); + +/** + * \brief Get information about the use of the CID extension + * in the current connection. + * + * \param ssl The SSL context to query. + * \param enabled The address at which to store whether the CID extension + * is currently in use or not. If the CID is in use, + * `*enabled` is set to MBEDTLS_SSL_CID_ENABLED; + * otherwise, it is set to MBEDTLS_SSL_CID_DISABLED. + * \param peer_cid The address of the buffer in which to store the CID + * chosen by the peer (if the CID extension is used). + * This may be \c NULL in case the value of peer CID + * isn't needed. If it is not \c NULL, \p peer_cid_len + * must not be \c NULL. + * \param peer_cid_len The address at which to store the size of the CID + * chosen by the peer (if the CID extension is used). + * This is also the number of Bytes in \p peer_cid that + * have been written. + * This may be \c NULL in case the length of the peer CID + * isn't needed. If it is \c NULL, \p peer_cid must be + * \c NULL, too. + * + * \note This applies to the state of the CID negotiated in + * the last complete handshake. If a handshake is in + * progress, this function will attempt to complete + * the handshake first. + * + * \note If CID extensions have been exchanged but both client + * and server chose to use an empty CID, this function + * sets `*enabled` to #MBEDTLS_SSL_CID_DISABLED + * (the rationale for this is that the resulting + * communication is the same as if the CID extensions + * hadn't been used). + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl, + int *enabled, + unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ], + size_t *peer_cid_len ); + +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + +/** + * \brief Set the Maximum Transport Unit (MTU). + * Special value: 0 means unset (no limit). + * This represents the maximum size of a datagram payload + * handled by the transport layer (usually UDP) as determined + * by the network link and stack. In practice, this controls + * the maximum size datagram the DTLS layer will pass to the + * \c f_send() callback set using \c mbedtls_ssl_set_bio(). + * + * \note The limit on datagram size is converted to a limit on + * record payload by subtracting the current overhead of + * encapsulation and encryption/authentication if any. + * + * \note This can be called at any point during the connection, for + * example when a Path Maximum Transfer Unit (PMTU) + * estimate becomes available from other sources, + * such as lower (or higher) protocol layers. + * + * \note This setting only controls the size of the packets we send, + * and does not restrict the size of the datagrams we're + * willing to receive. Client-side, you can request the + * server to use smaller records with \c + * mbedtls_ssl_conf_max_frag_len(). + * + * \note If both a MTU and a maximum fragment length have been + * configured (or negotiated with the peer), the resulting + * lower limit on record payload (see first note) is used. + * + * \note This can only be used to decrease the maximum size + * of datagrams (hence records, see first note) sent. It + * cannot be used to increase the maximum size of records over + * the limit set by #MBEDTLS_SSL_OUT_CONTENT_LEN. + * + * \note Values lower than the current record layer expansion will + * result in an error when trying to send data. + * + * \note Using record compression together with a non-zero MTU value + * will result in an error when trying to send data. + * + * \param ssl SSL context + * \param mtu Value of the path MTU in bytes + */ +void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu ); +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Set a connection-specific verification callback (optional). + * + * If set, the provided verify callback is called for each + * certificate in the peer's CRT chain, including the trusted + * root. For more information, please see the documentation of + * \c mbedtls_x509_crt_verify(). + * + * \note This call is analogous to mbedtls_ssl_conf_verify() but + * binds the verification callback and context to an SSL context + * as opposed to an SSL configuration. + * If mbedtls_ssl_conf_verify() and mbedtls_ssl_set_verify() + * are both used, mbedtls_ssl_set_verify() takes precedence. + * + * \param ssl The SSL context to use. + * \param f_vrfy The verification callback to use during CRT verification. + * \param p_vrfy The opaque context to be passed to the callback. + */ +void mbedtls_ssl_set_verify( mbedtls_ssl_context *ssl, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy ); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +/** + * \brief Set the timeout period for mbedtls_ssl_read() + * (Default: no timeout.) + * + * \param conf SSL configuration context + * \param timeout Timeout value in milliseconds. + * Use 0 for no timeout (default). + * + * \note With blocking I/O, this will only work if a non-NULL + * \c f_recv_timeout was set with \c mbedtls_ssl_set_bio(). + * With non-blocking I/O, this will only work if timer + * callbacks were set with \c mbedtls_ssl_set_timer_cb(). + * + * \note With non-blocking I/O, you may also skip this function + * altogether and handle timeouts at the application layer. + */ +void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout ); + +#if defined(MBEDTLS_SSL_RECORD_CHECKING) +/** + * \brief Check whether a buffer contains a valid and authentic record + * that has not been seen before. (DTLS only). + * + * This function does not change the user-visible state + * of the SSL context. Its sole purpose is to provide + * an indication of the legitimacy of an incoming record. + * + * This can be useful e.g. in distributed server environments + * using the DTLS Connection ID feature, in which connections + * might need to be passed between service instances on a change + * of peer address, but where such disruptive operations should + * only happen after the validity of incoming records has been + * confirmed. + * + * \param ssl The SSL context to use. + * \param buf The address of the buffer holding the record to be checked. + * This must be a read/write buffer of length \p buflen Bytes. + * \param buflen The length of \p buf in Bytes. + * + * \note This routine only checks whether the provided buffer begins + * with a valid and authentic record that has not been seen + * before, but does not check potential data following the + * initial record. In particular, it is possible to pass DTLS + * datagrams containing multiple records, in which case only + * the first record is checked. + * + * \note This function modifies the input buffer \p buf. If you need + * to preserve the original record, you have to maintain a copy. + * + * \return \c 0 if the record is valid and authentic and has not been + * seen before. + * \return MBEDTLS_ERR_SSL_INVALID_MAC if the check completed + * successfully but the record was found to be not authentic. + * \return MBEDTLS_ERR_SSL_INVALID_RECORD if the check completed + * successfully but the record was found to be invalid for + * a reason different from authenticity checking. + * \return MBEDTLS_ERR_SSL_UNEXPECTED_RECORD if the check completed + * successfully but the record was found to be unexpected + * in the state of the SSL context, including replayed records. + * \return Another negative error code on different kinds of failure. + * In this case, the SSL context becomes unusable and needs + * to be freed or reset before reuse. + */ +int mbedtls_ssl_check_record( mbedtls_ssl_context const *ssl, + unsigned char *buf, + size_t buflen ); +#endif /* MBEDTLS_SSL_RECORD_CHECKING */ + +/** + * \brief Set the timer callbacks (Mandatory for DTLS.) + * + * \param ssl SSL context + * \param p_timer parameter (context) shared by timer callbacks + * \param f_set_timer set timer callback + * \param f_get_timer get timer callback. Must return: + * + * \note See the documentation of \c mbedtls_ssl_set_timer_t and + * \c mbedtls_ssl_get_timer_t for the conventions this pair of + * callbacks must follow. + * + * \note On some platforms, timing.c provides + * \c mbedtls_timing_set_delay() and + * \c mbedtls_timing_get_delay() that are suitable for using + * here, except if using an event-driven style. + * + * \note See also the "DTLS tutorial" article in our knowledge base. + * https://tls.mbed.org/kb/how-to/dtls-tutorial + */ +void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl, + void *p_timer, + mbedtls_ssl_set_timer_t *f_set_timer, + mbedtls_ssl_get_timer_t *f_get_timer ); + +/** + * \brief Callback type: generate and write session ticket + * + * \note This describes what a callback implementation should do. + * This callback should generate an encrypted and + * authenticated ticket for the session and write it to the + * output buffer. Here, ticket means the opaque ticket part + * of the NewSessionTicket structure of RFC 5077. + * + * \param p_ticket Context for the callback + * \param session SSL session to be written in the ticket + * \param start Start of the output buffer + * \param end End of the output buffer + * \param tlen On exit, holds the length written + * \param lifetime On exit, holds the lifetime of the ticket in seconds + * + * \return 0 if successful, or + * a specific MBEDTLS_ERR_XXX code. + */ +typedef int mbedtls_ssl_ticket_write_t( void *p_ticket, + const mbedtls_ssl_session *session, + unsigned char *start, + const unsigned char *end, + size_t *tlen, + uint32_t *lifetime ); + +#if defined(MBEDTLS_SSL_EXPORT_KEYS) +/** + * \brief Callback type: Export key block and master secret + * + * \note This is required for certain uses of TLS, e.g. EAP-TLS + * (RFC 5216) and Thread. The key pointers are ephemeral and + * therefore must not be stored. The master secret and keys + * should not be used directly except as an input to a key + * derivation function. + * + * \param p_expkey Context for the callback + * \param ms Pointer to master secret (fixed length: 48 bytes) + * \param kb Pointer to key block, see RFC 5246 section 6.3 + * (variable length: 2 * maclen + 2 * keylen + 2 * ivlen). + * \param maclen MAC length + * \param keylen Key length + * \param ivlen IV length + * + * \return 0 if successful, or + * a specific MBEDTLS_ERR_XXX code. + */ +typedef int mbedtls_ssl_export_keys_t( void *p_expkey, + const unsigned char *ms, + const unsigned char *kb, + size_t maclen, + size_t keylen, + size_t ivlen ); + +/** + * \brief Callback type: Export key block, master secret, + * handshake randbytes and the tls_prf function + * used to derive keys. + * + * \note This is required for certain uses of TLS, e.g. EAP-TLS + * (RFC 5216) and Thread. The key pointers are ephemeral and + * therefore must not be stored. The master secret and keys + * should not be used directly except as an input to a key + * derivation function. + * + * \param p_expkey Context for the callback. + * \param ms Pointer to master secret (fixed length: 48 bytes). + * \param kb Pointer to key block, see RFC 5246 section 6.3. + * (variable length: 2 * maclen + 2 * keylen + 2 * ivlen). + * \param maclen MAC length. + * \param keylen Key length. + * \param ivlen IV length. + * \param client_random The client random bytes. + * \param server_random The server random bytes. + * \param tls_prf_type The tls_prf enum type. + * + * \return 0 if successful, or + * a specific MBEDTLS_ERR_XXX code. + */ +typedef int mbedtls_ssl_export_keys_ext_t( void *p_expkey, + const unsigned char *ms, + const unsigned char *kb, + size_t maclen, + size_t keylen, + size_t ivlen, + const unsigned char client_random[32], + const unsigned char server_random[32], + mbedtls_tls_prf_types tls_prf_type ); +#endif /* MBEDTLS_SSL_EXPORT_KEYS */ + +/** + * \brief Callback type: parse and load session ticket + * + * \note This describes what a callback implementation should do. + * This callback should parse a session ticket as generated + * by the corresponding mbedtls_ssl_ticket_write_t function, + * and, if the ticket is authentic and valid, load the + * session. + * + * \note The implementation is allowed to modify the first len + * bytes of the input buffer, eg to use it as a temporary + * area for the decrypted ticket contents. + * + * \param p_ticket Context for the callback + * \param session SSL session to be loaded + * \param buf Start of the buffer containing the ticket + * \param len Length of the ticket. + * + * \return 0 if successful, or + * MBEDTLS_ERR_SSL_INVALID_MAC if not authentic, or + * MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED if expired, or + * any other non-zero code for other failures. + */ +typedef int mbedtls_ssl_ticket_parse_t( void *p_ticket, + mbedtls_ssl_session *session, + unsigned char *buf, + size_t len ); + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Configure SSL session ticket callbacks (server only). + * (Default: none.) + * + * \note On server, session tickets are enabled by providing + * non-NULL callbacks. + * + * \note On client, use \c mbedtls_ssl_conf_session_tickets(). + * + * \param conf SSL configuration context + * \param f_ticket_write Callback for writing a ticket + * \param f_ticket_parse Callback for parsing a ticket + * \param p_ticket Context shared by the two callbacks + */ +void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf, + mbedtls_ssl_ticket_write_t *f_ticket_write, + mbedtls_ssl_ticket_parse_t *f_ticket_parse, + void *p_ticket ); +#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_SRV_C */ + +#if defined(MBEDTLS_SSL_EXPORT_KEYS) +/** + * \brief Configure key export callback. + * (Default: none.) + * + * \note See \c mbedtls_ssl_export_keys_t. + * + * \param conf SSL configuration context + * \param f_export_keys Callback for exporting keys + * \param p_export_keys Context for the callback + */ +void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf, + mbedtls_ssl_export_keys_t *f_export_keys, + void *p_export_keys ); + +/** + * \brief Configure extended key export callback. + * (Default: none.) + * + * \note See \c mbedtls_ssl_export_keys_ext_t. + * \warning Exported key material must not be used for any purpose + * before the (D)TLS handshake is completed + * + * \param conf SSL configuration context + * \param f_export_keys_ext Callback for exporting keys + * \param p_export_keys Context for the callback + */ +void mbedtls_ssl_conf_export_keys_ext_cb( mbedtls_ssl_config *conf, + mbedtls_ssl_export_keys_ext_t *f_export_keys_ext, + void *p_export_keys ); +#endif /* MBEDTLS_SSL_EXPORT_KEYS */ + +#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) +/** + * \brief Configure asynchronous private key operation callbacks. + * + * \param conf SSL configuration context + * \param f_async_sign Callback to start a signature operation. See + * the description of ::mbedtls_ssl_async_sign_t + * for more information. This may be \c NULL if the + * external processor does not support any signature + * operation; in this case the private key object + * associated with the certificate will be used. + * \param f_async_decrypt Callback to start a decryption operation. See + * the description of ::mbedtls_ssl_async_decrypt_t + * for more information. This may be \c NULL if the + * external processor does not support any decryption + * operation; in this case the private key object + * associated with the certificate will be used. + * \param f_async_resume Callback to resume an asynchronous operation. See + * the description of ::mbedtls_ssl_async_resume_t + * for more information. This may not be \c NULL unless + * \p f_async_sign and \p f_async_decrypt are both + * \c NULL. + * \param f_async_cancel Callback to cancel an asynchronous operation. See + * the description of ::mbedtls_ssl_async_cancel_t + * for more information. This may be \c NULL if + * no cleanup is needed. + * \param config_data A pointer to configuration data which can be + * retrieved with + * mbedtls_ssl_conf_get_async_config_data(). The + * library stores this value without dereferencing it. + */ +void mbedtls_ssl_conf_async_private_cb( mbedtls_ssl_config *conf, + mbedtls_ssl_async_sign_t *f_async_sign, + mbedtls_ssl_async_decrypt_t *f_async_decrypt, + mbedtls_ssl_async_resume_t *f_async_resume, + mbedtls_ssl_async_cancel_t *f_async_cancel, + void *config_data ); + +/** + * \brief Retrieve the configuration data set by + * mbedtls_ssl_conf_async_private_cb(). + * + * \param conf SSL configuration context + * \return The configuration data set by + * mbedtls_ssl_conf_async_private_cb(). + */ +void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf ); + +/** + * \brief Retrieve the asynchronous operation user context. + * + * \note This function may only be called while a handshake + * is in progress. + * + * \param ssl The SSL context to access. + * + * \return The asynchronous operation user context that was last + * set during the current handshake. If + * mbedtls_ssl_set_async_operation_data() has not yet been + * called during the current handshake, this function returns + * \c NULL. + */ +void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl ); + +/** + * \brief Retrieve the asynchronous operation user context. + * + * \note This function may only be called while a handshake + * is in progress. + * + * \param ssl The SSL context to access. + * \param ctx The new value of the asynchronous operation user context. + * Call mbedtls_ssl_get_async_operation_data() later during the + * same handshake to retrieve this value. + */ +void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl, + void *ctx ); +#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ + +/** + * \brief Callback type: generate a cookie + * + * \param ctx Context for the callback + * \param p Buffer to write to, + * must be updated to point right after the cookie + * \param end Pointer to one past the end of the output buffer + * \param info Client ID info that was passed to + * \c mbedtls_ssl_set_client_transport_id() + * \param ilen Length of info in bytes + * + * \return The callback must return 0 on success, + * or a negative error code. + */ +typedef int mbedtls_ssl_cookie_write_t( void *ctx, + unsigned char **p, unsigned char *end, + const unsigned char *info, size_t ilen ); + +/** + * \brief Callback type: verify a cookie + * + * \param ctx Context for the callback + * \param cookie Cookie to verify + * \param clen Length of cookie + * \param info Client ID info that was passed to + * \c mbedtls_ssl_set_client_transport_id() + * \param ilen Length of info in bytes + * + * \return The callback must return 0 if cookie is valid, + * or a negative error code. + */ +typedef int mbedtls_ssl_cookie_check_t( void *ctx, + const unsigned char *cookie, size_t clen, + const unsigned char *info, size_t ilen ); + +#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Register callbacks for DTLS cookies + * (Server only. DTLS only.) + * + * Default: dummy callbacks that fail, in order to force you to + * register working callbacks (and initialize their context). + * + * To disable HelloVerifyRequest, register NULL callbacks. + * + * \warning Disabling hello verification allows your server to be used + * for amplification in DoS attacks against other hosts. + * Only disable if you known this can't happen in your + * particular environment. + * + * \note See comments on \c mbedtls_ssl_handshake() about handling + * the MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED that is expected + * on the first handshake attempt when this is enabled. + * + * \note This is also necessary to handle client reconnection from + * the same port as described in RFC 6347 section 4.2.8 (only + * the variant with cookies is supported currently). See + * comments on \c mbedtls_ssl_read() for details. + * + * \param conf SSL configuration + * \param f_cookie_write Cookie write callback + * \param f_cookie_check Cookie check callback + * \param p_cookie Context for both callbacks + */ +void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf, + mbedtls_ssl_cookie_write_t *f_cookie_write, + mbedtls_ssl_cookie_check_t *f_cookie_check, + void *p_cookie ); + +/** + * \brief Set client's transport-level identification info. + * (Server only. DTLS only.) + * + * This is usually the IP address (and port), but could be + * anything identify the client depending on the underlying + * network stack. Used for HelloVerifyRequest with DTLS. + * This is *not* used to route the actual packets. + * + * \param ssl SSL context + * \param info Transport-level info identifying the client (eg IP + port) + * \param ilen Length of info in bytes + * + * \note An internal copy is made, so the info buffer can be reused. + * + * \return 0 on success, + * MBEDTLS_ERR_SSL_BAD_INPUT_DATA if used on client, + * MBEDTLS_ERR_SSL_ALLOC_FAILED if out of memory. + */ +int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl, + const unsigned char *info, + size_t ilen ); + +#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */ + +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) +/** + * \brief Enable or disable anti-replay protection for DTLS. + * (DTLS only, no effect on TLS.) + * Default: enabled. + * + * \param conf SSL configuration + * \param mode MBEDTLS_SSL_ANTI_REPLAY_ENABLED or MBEDTLS_SSL_ANTI_REPLAY_DISABLED. + * + * \warning Disabling this is a security risk unless the application + * protocol handles duplicated packets in a safe way. You + * should not disable this without careful consideration. + * However, if your application already detects duplicated + * packets and needs information about them to adjust its + * transmission strategy, then you'll want to disable this. + */ +void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode ); +#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */ + +#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) +/** + * \brief Set a limit on the number of records with a bad MAC + * before terminating the connection. + * (DTLS only, no effect on TLS.) + * Default: 0 (disabled). + * + * \param conf SSL configuration + * \param limit Limit, or 0 to disable. + * + * \note If the limit is N, then the connection is terminated when + * the Nth non-authentic record is seen. + * + * \note Records with an invalid header are not counted, only the + * ones going through the authentication-decryption phase. + * + * \note This is a security trade-off related to the fact that it's + * often relatively easy for an active attacker to inject UDP + * datagrams. On one hand, setting a low limit here makes it + * easier for such an attacker to forcibly terminated a + * connection. On the other hand, a high limit or no limit + * might make us waste resources checking authentication on + * many bogus packets. + */ +void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit ); +#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + +/** + * \brief Allow or disallow packing of multiple handshake records + * within a single datagram. + * + * \param ssl The SSL context to configure. + * \param allow_packing This determines whether datagram packing may + * be used or not. A value of \c 0 means that every + * record will be sent in a separate datagram; a + * value of \c 1 means that, if space permits, + * multiple handshake messages (including CCS) belonging to + * a single flight may be packed within a single datagram. + * + * \note This is enabled by default and should only be disabled + * for test purposes, or if datagram packing causes + * interoperability issues with peers that don't support it. + * + * \note Allowing datagram packing reduces the network load since + * there's less overhead if multiple messages share the same + * datagram. Also, it increases the handshake efficiency + * since messages belonging to a single datagram will not + * be reordered in transit, and so future message buffering + * or flight retransmission (if no buffering is used) as + * means to deal with reordering are needed less frequently. + * + * \note Application records are not affected by this option and + * are currently always sent in separate datagrams. + * + */ +void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl, + unsigned allow_packing ); + +/** + * \brief Set retransmit timeout values for the DTLS handshake. + * (DTLS only, no effect on TLS.) + * + * \param conf SSL configuration + * \param min Initial timeout value in milliseconds. + * Default: 1000 (1 second). + * \param max Maximum timeout value in milliseconds. + * Default: 60000 (60 seconds). + * + * \note Default values are from RFC 6347 section 4.2.4.1. + * + * \note The 'min' value should typically be slightly above the + * expected round-trip time to your peer, plus whatever time + * it takes for the peer to process the message. For example, + * if your RTT is about 600ms and you peer needs up to 1s to + * do the cryptographic operations in the handshake, then you + * should set 'min' slightly above 1600. Lower values of 'min' + * might cause spurious resends which waste network resources, + * while larger value of 'min' will increase overall latency + * on unreliable network links. + * + * \note The more unreliable your network connection is, the larger + * your max / min ratio needs to be in order to achieve + * reliable handshakes. + * + * \note Messages are retransmitted up to log2(ceil(max/min)) times. + * For example, if min = 1s and max = 5s, the retransmit plan + * goes: send ... 1s -> resend ... 2s -> resend ... 4s -> + * resend ... 5s -> give up and return a timeout error. + */ +void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf, uint32_t min, uint32_t max ); +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + +#if defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Set the session cache callbacks (server-side only) + * If not set, no session resuming is done (except if session + * tickets are enabled too). + * + * The session cache has the responsibility to check for stale + * entries based on timeout. See RFC 5246 for recommendations. + * + * Warning: session.peer_cert is cleared by the SSL/TLS layer on + * connection shutdown, so do not cache the pointer! Either set + * it to NULL or make a full copy of the certificate. + * + * The get callback is called once during the initial handshake + * to enable session resuming. The get function has the + * following parameters: (void *parameter, mbedtls_ssl_session *session) + * If a valid entry is found, it should fill the master of + * the session object with the cached values and return 0, + * return 1 otherwise. Optionally peer_cert can be set as well + * if it is properly present in cache entry. + * + * The set callback is called once during the initial handshake + * to enable session resuming after the entire handshake has + * been finished. The set function has the following parameters: + * (void *parameter, const mbedtls_ssl_session *session). The function + * should create a cache entry for future retrieval based on + * the data in the session structure and should keep in mind + * that the mbedtls_ssl_session object presented (and all its referenced + * data) is cleared by the SSL/TLS layer when the connection is + * terminated. It is recommended to add metadata to determine if + * an entry is still valid in the future. Return 0 if + * successfully cached, return 1 otherwise. + * + * \param conf SSL configuration + * \param p_cache parameter (context) for both callbacks + * \param f_get_cache session get callback + * \param f_set_cache session set callback + */ +void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf, + void *p_cache, + int (*f_get_cache)(void *, mbedtls_ssl_session *), + int (*f_set_cache)(void *, const mbedtls_ssl_session *) ); +#endif /* MBEDTLS_SSL_SRV_C */ + +#if defined(MBEDTLS_SSL_CLI_C) +/** + * \brief Request resumption of session (client-side only) + * Session data is copied from presented session structure. + * + * \param ssl SSL context + * \param session session context + * + * \return 0 if successful, + * MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed, + * MBEDTLS_ERR_SSL_BAD_INPUT_DATA if used server-side or + * arguments are otherwise invalid + * + * \sa mbedtls_ssl_get_session() + */ +int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session ); +#endif /* MBEDTLS_SSL_CLI_C */ + +/** + * \brief Load serialized session data into a session structure. + * On client, this can be used for loading saved sessions + * before resuming them with mbedtls_ssl_set_session(). + * On server, this can be used for alternative implementations + * of session cache or session tickets. + * + * \warning If a peer certificate chain is associated with the session, + * the serialized state will only contain the peer's + * end-entity certificate and the result of the chain + * verification (unless verification was disabled), but not + * the rest of the chain. + * + * \see mbedtls_ssl_session_save() + * \see mbedtls_ssl_set_session() + * + * \param session The session structure to be populated. It must have been + * initialised with mbedtls_ssl_session_init() but not + * populated yet. + * \param buf The buffer holding the serialized session data. It must be a + * readable buffer of at least \p len bytes. + * \param len The size of the serialized data in bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed. + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if input data is invalid. + * \return #MBEDTLS_ERR_SSL_VERSION_MISMATCH if the serialized data + * was generated in a different version or configuration of + * Mbed TLS. + * \return Another negative value for other kinds of errors (for + * example, unsupported features in the embedded certificate). + */ +int mbedtls_ssl_session_load( mbedtls_ssl_session *session, + const unsigned char *buf, + size_t len ); + +/** + * \brief Save session structure as serialized data in a buffer. + * On client, this can be used for saving session data, + * potentially in non-volatile storage, for resuming later. + * On server, this can be used for alternative implementations + * of session cache or session tickets. + * + * \see mbedtls_ssl_session_load() + * \see mbedtls_ssl_get_session_pointer() + * + * \param session The session structure to be saved. + * \param buf The buffer to write the serialized data to. It must be a + * writeable buffer of at least \p len bytes, or may be \c + * NULL if \p len is \c 0. + * \param buf_len The number of bytes available for writing in \p buf. + * \param olen The size in bytes of the data that has been or would have + * been written. It must point to a valid \c size_t. + * + * \note \p olen is updated to the correct value regardless of + * whether \p buf_len was large enough. This makes it possible + * to determine the necessary size by calling this function + * with \p buf set to \c NULL and \p buf_len to \c 0. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL if \p buf is too small. + */ +int mbedtls_ssl_session_save( const mbedtls_ssl_session *session, + unsigned char *buf, + size_t buf_len, + size_t *olen ); + +/** + * \brief Get a pointer to the current session structure, for example + * to serialize it. + * + * \warning Ownership of the session remains with the SSL context, and + * the returned pointer is only guaranteed to be valid until + * the next API call operating on the same \p ssl context. + * + * \see mbedtls_ssl_session_save() + * + * \param ssl The SSL context. + * + * \return A pointer to the current session if successful. + * \return \c NULL if no session is active. + */ +const mbedtls_ssl_session *mbedtls_ssl_get_session_pointer( const mbedtls_ssl_context *ssl ); + +/** + * \brief Set the list of allowed ciphersuites and the preference + * order. First in the list has the highest preference. + * (Overrides all version-specific lists) + * + * The ciphersuites array is not copied, and must remain + * valid for the lifetime of the ssl_config. + * + * Note: The server uses its own preferences + * over the preference of the client unless + * MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE is defined! + * + * \param conf SSL configuration + * \param ciphersuites 0-terminated list of allowed ciphersuites + */ +void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf, + const int *ciphersuites ); + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) +#define MBEDTLS_SSL_UNEXPECTED_CID_IGNORE 0 +#define MBEDTLS_SSL_UNEXPECTED_CID_FAIL 1 +/** + * \brief Specify the length of Connection IDs for incoming + * encrypted DTLS records, as well as the behaviour + * on unexpected CIDs. + * + * By default, the CID length is set to \c 0, + * and unexpected CIDs are silently ignored. + * + * \param conf The SSL configuration to modify. + * \param len The length in Bytes of the CID fields in encrypted + * DTLS records using the CID mechanism. This must + * not be larger than #MBEDTLS_SSL_CID_OUT_LEN_MAX. + * \param ignore_other_cids This determines the stack's behaviour when + * receiving a record with an unexpected CID. + * Possible values are: + * - #MBEDTLS_SSL_UNEXPECTED_CID_IGNORE + * In this case, the record is silently ignored. + * - #MBEDTLS_SSL_UNEXPECTED_CID_FAIL + * In this case, the stack fails with the specific + * error code #MBEDTLS_ERR_SSL_UNEXPECTED_CID. + * + * \note The CID specification allows implementations to either + * use a common length for all incoming connection IDs or + * allow variable-length incoming IDs. Mbed TLS currently + * requires a common length for all connections sharing the + * same SSL configuration; this allows simpler parsing of + * record headers. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if \p own_cid_len + * is too large. + */ +int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf, size_t len, + int ignore_other_cids ); +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + +/** + * \brief Set the list of allowed ciphersuites and the + * preference order for a specific version of the protocol. + * (Only useful on the server side) + * + * The ciphersuites array is not copied, and must remain + * valid for the lifetime of the ssl_config. + * + * \param conf SSL configuration + * \param ciphersuites 0-terminated list of allowed ciphersuites + * \param major Major version number (only MBEDTLS_SSL_MAJOR_VERSION_3 + * supported) + * \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_0, + * MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2, + * MBEDTLS_SSL_MINOR_VERSION_3 supported) + * + * \note With DTLS, use MBEDTLS_SSL_MINOR_VERSION_2 for DTLS 1.0 + * and MBEDTLS_SSL_MINOR_VERSION_3 for DTLS 1.2 + */ +void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf, + const int *ciphersuites, + int major, int minor ); + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Set the X.509 security profile used for verification + * + * \note The restrictions are enforced for all certificates in the + * chain. However, signatures in the handshake are not covered + * by this setting but by \b mbedtls_ssl_conf_sig_hashes(). + * + * \param conf SSL configuration + * \param profile Profile to use + */ +void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf, + const mbedtls_x509_crt_profile *profile ); + +/** + * \brief Set the data required to verify peer certificate + * + * \note See \c mbedtls_x509_crt_verify() for notes regarding the + * parameters ca_chain (maps to trust_ca for that function) + * and ca_crl. + * + * \param conf SSL configuration + * \param ca_chain trusted CA chain (meaning all fully trusted top-level CAs) + * \param ca_crl trusted CA CRLs + */ +void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf, + mbedtls_x509_crt *ca_chain, + mbedtls_x509_crl *ca_crl ); + +#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) +/** + * \brief Set the trusted certificate callback. + * + * This API allows to register the set of trusted certificates + * through a callback, instead of a linked list as configured + * by mbedtls_ssl_conf_ca_chain(). + * + * This is useful for example in contexts where a large number + * of CAs are used, and the inefficiency of maintaining them + * in a linked list cannot be tolerated. It is also useful when + * the set of trusted CAs needs to be modified frequently. + * + * See the documentation of `mbedtls_x509_crt_ca_cb_t` for + * more information. + * + * \param conf The SSL configuration to register the callback with. + * \param f_ca_cb The trusted certificate callback to use when verifying + * certificate chains. + * \param p_ca_cb The context to be passed to \p f_ca_cb (for example, + * a reference to a trusted CA database). + * + * \note This API is incompatible with mbedtls_ssl_conf_ca_chain(): + * Any call to this function overwrites the values set through + * earlier calls to mbedtls_ssl_conf_ca_chain() or + * mbedtls_ssl_conf_ca_cb(). + * + * \note This API is incompatible with CA indication in + * CertificateRequest messages: A server-side SSL context which + * is bound to an SSL configuration that uses a CA callback + * configured via mbedtls_ssl_conf_ca_cb(), and which requires + * client authentication, will send an empty CA list in the + * corresponding CertificateRequest message. + * + * \note This API is incompatible with mbedtls_ssl_set_hs_ca_chain(): + * If an SSL context is bound to an SSL configuration which uses + * CA callbacks configured via mbedtls_ssl_conf_ca_cb(), then + * calls to mbedtls_ssl_set_hs_ca_chain() have no effect. + * + * \note The use of this API disables the use of restartable ECC + * during X.509 CRT signature verification (but doesn't affect + * other uses). + * + * \warning This API is incompatible with the use of CRLs. Any call to + * mbedtls_ssl_conf_ca_cb() unsets CRLs configured through + * earlier calls to mbedtls_ssl_conf_ca_chain(). + * + * \warning In multi-threaded environments, the callback \p f_ca_cb + * must be thread-safe, and it is the user's responsibility + * to guarantee this (for example through a mutex + * contained in the callback context pointed to by \p p_ca_cb). + */ +void mbedtls_ssl_conf_ca_cb( mbedtls_ssl_config *conf, + mbedtls_x509_crt_ca_cb_t f_ca_cb, + void *p_ca_cb ); +#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ + +/** + * \brief Set own certificate chain and private key + * + * \note own_cert should contain in order from the bottom up your + * certificate chain. The top certificate (self-signed) + * can be omitted. + * + * \note On server, this function can be called multiple times to + * provision more than one cert/key pair (eg one ECDSA, one + * RSA with SHA-256, one RSA with SHA-1). An adequate + * certificate will be selected according to the client's + * advertised capabilities. In case multiple certificates are + * adequate, preference is given to the one set by the first + * call to this function, then second, etc. + * + * \note On client, only the first call has any effect. That is, + * only one client certificate can be provisioned. The + * server's preferences in its CertificateRequest message will + * be ignored and our only cert will be sent regardless of + * whether it matches those preferences - the server can then + * decide what it wants to do with it. + * + * \note The provided \p pk_key needs to match the public key in the + * first certificate in \p own_cert, or all handshakes using + * that certificate will fail. It is your responsibility + * to ensure that; this function will not perform any check. + * You may use mbedtls_pk_check_pair() in order to perform + * this check yourself, but be aware that this function can + * be computationally expensive on some key types. + * + * \param conf SSL configuration + * \param own_cert own public certificate chain + * \param pk_key own private key + * + * \return 0 on success or MBEDTLS_ERR_SSL_ALLOC_FAILED + */ +int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf, + mbedtls_x509_crt *own_cert, + mbedtls_pk_context *pk_key ); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) +/** + * \brief Configure a pre-shared key (PSK) and identity + * to be used in PSK-based ciphersuites. + * + * \note This is mainly useful for clients. Servers will usually + * want to use \c mbedtls_ssl_conf_psk_cb() instead. + * + * \note A PSK set by \c mbedtls_ssl_set_hs_psk() in the PSK callback + * takes precedence over a PSK configured by this function. + * + * \warning Currently, clients can only register a single pre-shared key. + * Calling this function or mbedtls_ssl_conf_psk_opaque() more + * than once will overwrite values configured in previous calls. + * Support for setting multiple PSKs on clients and selecting + * one based on the identity hint is not a planned feature, + * but feedback is welcomed. + * + * \param conf The SSL configuration to register the PSK with. + * \param psk The pointer to the pre-shared key to use. + * \param psk_len The length of the pre-shared key in bytes. + * \param psk_identity The pointer to the pre-shared key identity. + * \param psk_identity_len The length of the pre-shared key identity + * in bytes. + * + * \note The PSK and its identity are copied internally and + * hence need not be preserved by the caller for the lifetime + * of the SSL configuration. + * + * \return \c 0 if successful. + * \return An \c MBEDTLS_ERR_SSL_XXX error code on failure. + */ +int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf, + const unsigned char *psk, size_t psk_len, + const unsigned char *psk_identity, size_t psk_identity_len ); + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +/** + * \brief Configure an opaque pre-shared key (PSK) and identity + * to be used in PSK-based ciphersuites. + * + * \note This is mainly useful for clients. Servers will usually + * want to use \c mbedtls_ssl_conf_psk_cb() instead. + * + * \note An opaque PSK set by \c mbedtls_ssl_set_hs_psk_opaque() in + * the PSK callback takes precedence over an opaque PSK + * configured by this function. + * + * \warning Currently, clients can only register a single pre-shared key. + * Calling this function or mbedtls_ssl_conf_psk() more than + * once will overwrite values configured in previous calls. + * Support for setting multiple PSKs on clients and selecting + * one based on the identity hint is not a planned feature, + * but feedback is welcomed. + * + * \param conf The SSL configuration to register the PSK with. + * \param psk The identifier of the key slot holding the PSK. + * Until \p conf is destroyed or this function is successfully + * called again, the key slot \p psk must be populated with a + * key of type PSA_ALG_CATEGORY_KEY_DERIVATION whose policy + * allows its use for the key derivation algorithm applied + * in the handshake. + * \param psk_identity The pointer to the pre-shared key identity. + * \param psk_identity_len The length of the pre-shared key identity + * in bytes. + * + * \note The PSK identity hint is copied internally and hence need + * not be preserved by the caller for the lifetime of the + * SSL configuration. + * + * \return \c 0 if successful. + * \return An \c MBEDTLS_ERR_SSL_XXX error code on failure. + */ +int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf, + psa_key_id_t psk, + const unsigned char *psk_identity, + size_t psk_identity_len ); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +/** + * \brief Set the pre-shared Key (PSK) for the current handshake. + * + * \note This should only be called inside the PSK callback, + * i.e. the function passed to \c mbedtls_ssl_conf_psk_cb(). + * + * \note A PSK set by this function takes precedence over a PSK + * configured by \c mbedtls_ssl_conf_psk(). + * + * \param ssl The SSL context to configure a PSK for. + * \param psk The pointer to the pre-shared key. + * \param psk_len The length of the pre-shared key in bytes. + * + * \return \c 0 if successful. + * \return An \c MBEDTLS_ERR_SSL_XXX error code on failure. + */ +int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl, + const unsigned char *psk, size_t psk_len ); + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +/** + * \brief Set an opaque pre-shared Key (PSK) for the current handshake. + * + * \note This should only be called inside the PSK callback, + * i.e. the function passed to \c mbedtls_ssl_conf_psk_cb(). + * + * \note An opaque PSK set by this function takes precedence over an + * opaque PSK configured by \c mbedtls_ssl_conf_psk_opaque(). + * + * \param ssl The SSL context to configure a PSK for. + * \param psk The identifier of the key slot holding the PSK. + * For the duration of the current handshake, the key slot + * must be populated with a key of type + * PSA_ALG_CATEGORY_KEY_DERIVATION whose policy allows its + * use for the key derivation algorithm + * applied in the handshake. + * + * \return \c 0 if successful. + * \return An \c MBEDTLS_ERR_SSL_XXX error code on failure. + */ +int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl, + psa_key_id_t psk ); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +/** + * \brief Set the PSK callback (server-side only). + * + * If set, the PSK callback is called for each + * handshake where a PSK-based ciphersuite was negotiated. + * The caller provides the identity received and wants to + * receive the actual PSK data and length. + * + * The callback has the following parameters: + * - \c void*: The opaque pointer \p p_psk. + * - \c mbedtls_ssl_context*: The SSL context to which + * the operation applies. + * - \c const unsigned char*: The PSK identity + * selected by the client. + * - \c size_t: The length of the PSK identity + * selected by the client. + * + * If a valid PSK identity is found, the callback should use + * \c mbedtls_ssl_set_hs_psk() or + * \c mbedtls_ssl_set_hs_psk_opaque() + * on the SSL context to set the correct PSK and return \c 0. + * Any other return value will result in a denied PSK identity. + * + * \note A dynamic PSK (i.e. set by the PSK callback) takes + * precedence over a static PSK (i.e. set by + * \c mbedtls_ssl_conf_psk() or + * \c mbedtls_ssl_conf_psk_opaque()). + * This means that if you set a PSK callback using this + * function, you don't need to set a PSK using + * \c mbedtls_ssl_conf_psk() or + * \c mbedtls_ssl_conf_psk_opaque()). + * + * \param conf The SSL configuration to register the callback with. + * \param f_psk The callback for selecting and setting the PSK based + * in the PSK identity chosen by the client. + * \param p_psk A pointer to an opaque structure to be passed to + * the callback, for example a PSK store. + */ +void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf, + int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *, + size_t), + void *p_psk ); +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ + +#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C) + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) + +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif + +/** + * \brief Set the Diffie-Hellman public P and G values, + * read as hexadecimal strings (server-side only) + * (Default values: MBEDTLS_DHM_RFC3526_MODP_2048_[PG]) + * + * \param conf SSL configuration + * \param dhm_P Diffie-Hellman-Merkle modulus + * \param dhm_G Diffie-Hellman-Merkle generator + * + * \deprecated Superseded by \c mbedtls_ssl_conf_dh_param_bin. + * + * \return 0 if successful + */ +MBEDTLS_DEPRECATED int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, + const char *dhm_P, + const char *dhm_G ); + +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief Set the Diffie-Hellman public P and G values + * from big-endian binary presentations. + * (Default values: MBEDTLS_DHM_RFC3526_MODP_2048_[PG]_BIN) + * + * \param conf SSL configuration + * \param dhm_P Diffie-Hellman-Merkle modulus in big-endian binary form + * \param P_len Length of DHM modulus + * \param dhm_G Diffie-Hellman-Merkle generator in big-endian binary form + * \param G_len Length of DHM generator + * + * \return 0 if successful + */ +int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf, + const unsigned char *dhm_P, size_t P_len, + const unsigned char *dhm_G, size_t G_len ); + +/** + * \brief Set the Diffie-Hellman public P and G values, + * read from existing context (server-side only) + * + * \param conf SSL configuration + * \param dhm_ctx Diffie-Hellman-Merkle context + * + * \return 0 if successful + */ +int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx ); +#endif /* MBEDTLS_DHM_C && defined(MBEDTLS_SSL_SRV_C) */ + +#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C) +/** + * \brief Set the minimum length for Diffie-Hellman parameters. + * (Client-side only.) + * (Default: 1024 bits.) + * + * \param conf SSL configuration + * \param bitlen Minimum bit length of the DHM prime + */ +void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf, + unsigned int bitlen ); +#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */ + +#if defined(MBEDTLS_ECP_C) +/** + * \brief Set the allowed curves in order of preference. + * (Default: all defined curves in order of decreasing size, + * except that Montgomery curves come last. This order + * is likely to change in a future version.) + * + * On server: this only affects selection of the ECDHE curve; + * the curves used for ECDH and ECDSA are determined by the + * list of available certificates instead. + * + * On client: this affects the list of curves offered for any + * use. The server can override our preference order. + * + * Both sides: limits the set of curves accepted for use in + * ECDHE and in the peer's end-entity certificate. + * + * \note This has no influence on which curves are allowed inside the + * certificate chains, see \c mbedtls_ssl_conf_cert_profile() + * for that. For the end-entity certificate however, the key + * will be accepted only if it is allowed both by this list + * and by the cert profile. + * + * \note This list should be ordered by decreasing preference + * (preferred curve first). + * + * \param conf SSL configuration + * \param curves Ordered list of allowed curves, + * terminated by MBEDTLS_ECP_DP_NONE. + */ +void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf, + const mbedtls_ecp_group_id *curves ); +#endif /* MBEDTLS_ECP_C */ + +#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) +/** + * \brief Set the allowed hashes for signatures during the handshake. + * (Default: all SHA-2 hashes, largest first. Also SHA-1 if + * the compile-time option + * `MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE` is enabled.) + * + * \note This only affects which hashes are offered and can be used + * for signatures during the handshake. Hashes for message + * authentication and the TLS PRF are controlled by the + * ciphersuite, see \c mbedtls_ssl_conf_ciphersuites(). Hashes + * used for certificate signature are controlled by the + * verification profile, see \c mbedtls_ssl_conf_cert_profile(). + * + * \note This list should be ordered by decreasing preference + * (preferred hash first). + * + * \param conf SSL configuration + * \param hashes Ordered list of allowed signature hashes, + * terminated by \c MBEDTLS_MD_NONE. + */ +void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf, + const int *hashes ); +#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Set or reset the hostname to check against the received + * server certificate. It sets the ServerName TLS extension, + * too, if that extension is enabled. (client-side only) + * + * \param ssl SSL context + * \param hostname the server hostname, may be NULL to clear hostname + + * \note Maximum hostname length MBEDTLS_SSL_MAX_HOST_NAME_LEN. + * + * \return 0 if successful, MBEDTLS_ERR_SSL_ALLOC_FAILED on + * allocation failure, MBEDTLS_ERR_SSL_BAD_INPUT_DATA on + * too long input hostname. + * + * Hostname set to the one provided on success (cleared + * when NULL). On allocation failure hostname is cleared. + * On too long input failure, old hostname is unchanged. + */ +int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname ); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) +/** + * \brief Set own certificate and key for the current handshake + * + * \note Same as \c mbedtls_ssl_conf_own_cert() but for use within + * the SNI callback. + * + * \param ssl SSL context + * \param own_cert own public certificate chain + * \param pk_key own private key + * + * \return 0 on success or MBEDTLS_ERR_SSL_ALLOC_FAILED + */ +int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl, + mbedtls_x509_crt *own_cert, + mbedtls_pk_context *pk_key ); + +/** + * \brief Set the data required to verify peer certificate for the + * current handshake + * + * \note Same as \c mbedtls_ssl_conf_ca_chain() but for use within + * the SNI callback. + * + * \param ssl SSL context + * \param ca_chain trusted CA chain (meaning all fully trusted top-level CAs) + * \param ca_crl trusted CA CRLs + */ +void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl, + mbedtls_x509_crt *ca_chain, + mbedtls_x509_crl *ca_crl ); + +/** + * \brief Set authmode for the current handshake. + * + * \note Same as \c mbedtls_ssl_conf_authmode() but for use within + * the SNI callback. + * + * \param ssl SSL context + * \param authmode MBEDTLS_SSL_VERIFY_NONE, MBEDTLS_SSL_VERIFY_OPTIONAL or + * MBEDTLS_SSL_VERIFY_REQUIRED + */ +void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl, + int authmode ); + +/** + * \brief Set server side ServerName TLS extension callback + * (optional, server-side only). + * + * If set, the ServerName callback is called whenever the + * server receives a ServerName TLS extension from the client + * during a handshake. The ServerName callback has the + * following parameters: (void *parameter, mbedtls_ssl_context *ssl, + * const unsigned char *hostname, size_t len). If a suitable + * certificate is found, the callback must set the + * certificate(s) and key(s) to use with \c + * mbedtls_ssl_set_hs_own_cert() (can be called repeatedly), + * and may optionally adjust the CA and associated CRL with \c + * mbedtls_ssl_set_hs_ca_chain() as well as the client + * authentication mode with \c mbedtls_ssl_set_hs_authmode(), + * then must return 0. If no matching name is found, the + * callback must either set a default cert, or + * return non-zero to abort the handshake at this point. + * + * \param conf SSL configuration + * \param f_sni verification function + * \param p_sni verification parameter + */ +void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf, + int (*f_sni)(void *, mbedtls_ssl_context *, const unsigned char *, + size_t), + void *p_sni ); +#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ + +#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) +/** + * \brief Set the EC J-PAKE password for current handshake. + * + * \note An internal copy is made, and destroyed as soon as the + * handshake is completed, or when the SSL context is reset or + * freed. + * + * \note The SSL context needs to be already set up. The right place + * to call this function is between \c mbedtls_ssl_setup() or + * \c mbedtls_ssl_reset() and \c mbedtls_ssl_handshake(). + * + * \param ssl SSL context + * \param pw EC J-PAKE password (pre-shared secret) + * \param pw_len length of pw in bytes + * + * \return 0 on success, or a negative error code. + */ +int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl, + const unsigned char *pw, + size_t pw_len ); +#endif /*MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ + +#if defined(MBEDTLS_SSL_ALPN) +/** + * \brief Set the supported Application Layer Protocols. + * + * \param conf SSL configuration + * \param protos Pointer to a NULL-terminated list of supported protocols, + * in decreasing preference order. The pointer to the list is + * recorded by the library for later reference as required, so + * the lifetime of the table must be at least as long as the + * lifetime of the SSL configuration structure. + * + * \return 0 on success, or MBEDTLS_ERR_SSL_BAD_INPUT_DATA. + */ +int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos ); + +/** + * \brief Get the name of the negotiated Application Layer Protocol. + * This function should be called after the handshake is + * completed. + * + * \param ssl SSL context + * + * \return Protocol name, or NULL if no protocol was negotiated. + */ +const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl ); +#endif /* MBEDTLS_SSL_ALPN */ + +#if defined(MBEDTLS_SSL_DTLS_SRTP) +#if defined(MBEDTLS_DEBUG_C) +static inline const char *mbedtls_ssl_get_srtp_profile_as_string( mbedtls_ssl_srtp_profile profile ) +{ + switch( profile ) + { + case MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80: + return( "MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80" ); + case MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32: + return( "MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" ); + case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80: + return( "MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80" ); + case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32: + return( "MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32" ); + default: break; + } + return( "" ); +} +#endif /* MBEDTLS_DEBUG_C */ +/** + * \brief Manage support for mki(master key id) value + * in use_srtp extension. + * MKI is an optional part of SRTP used for key management + * and re-keying. See RFC3711 section 3.1 for details. + * The default value is + * #MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED. + * + * \param conf The SSL configuration to manage mki support. + * \param support_mki_value Enable or disable mki usage. Values are + * #MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED + * or #MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED. + */ +void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf, + int support_mki_value ); + +/** + * \brief Set the supported DTLS-SRTP protection profiles. + * + * \param conf SSL configuration + * \param profiles Pointer to a List of MBEDTLS_TLS_SRTP_UNSET terminated + * supported protection profiles + * in decreasing preference order. + * The pointer to the list is recorded by the library + * for later reference as required, so the lifetime + * of the table must be at least as long as the lifetime + * of the SSL configuration structure. + * The list must not hold more than + * MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH elements + * (excluding the terminating MBEDTLS_TLS_SRTP_UNSET). + * + * \return 0 on success + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA when the list of + * protection profiles is incorrect. + */ +int mbedtls_ssl_conf_dtls_srtp_protection_profiles + ( mbedtls_ssl_config *conf, + const mbedtls_ssl_srtp_profile *profiles ); + +/** + * \brief Set the mki_value for the current DTLS-SRTP session. + * + * \param ssl SSL context to use. + * \param mki_value The MKI value to set. + * \param mki_len The length of the MKI value. + * + * \note This function is relevant on client side only. + * The server discovers the mki value during handshake. + * A mki value set on server side using this function + * is ignored. + * + * \return 0 on success + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA + * \return #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE + */ +int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl, + unsigned char *mki_value, + uint16_t mki_len ); +/** + * \brief Get the negotiated DTLS-SRTP information: + * Protection profile and MKI value. + * + * \warning This function must be called after the handshake is + * completed. The value returned by this function must + * not be trusted or acted upon before the handshake completes. + * + * \param ssl The SSL context to query. + * \param dtls_srtp_info The negotiated DTLS-SRTP information: + * - Protection profile in use. + * A direct mapping of the iana defined value for protection + * profile on an uint16_t. + http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml + * #MBEDTLS_TLS_SRTP_UNSET if the use of SRTP was not negotiated + * or peer's Hello packet was not parsed yet. + * - mki size and value( if size is > 0 ). + */ +void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ssl, + mbedtls_dtls_srtp_info *dtls_srtp_info ); +#endif /* MBEDTLS_SSL_DTLS_SRTP */ + +/** + * \brief Set the maximum supported version sent from the client side + * and/or accepted at the server side + * (Default: MBEDTLS_SSL_MAX_MAJOR_VERSION, MBEDTLS_SSL_MAX_MINOR_VERSION) + * + * \note This ignores ciphersuites from higher versions. + * + * \note With DTLS, use MBEDTLS_SSL_MINOR_VERSION_2 for DTLS 1.0 and + * MBEDTLS_SSL_MINOR_VERSION_3 for DTLS 1.2 + * + * \param conf SSL configuration + * \param major Major version number (only MBEDTLS_SSL_MAJOR_VERSION_3 supported) + * \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_0, + * MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2, + * MBEDTLS_SSL_MINOR_VERSION_3 supported) + */ +void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor ); + +/** + * \brief Set the minimum accepted SSL/TLS protocol version + * (Default: TLS 1.0) + * + * \note Input outside of the SSL_MAX_XXXXX_VERSION and + * SSL_MIN_XXXXX_VERSION range is ignored. + * + * \note MBEDTLS_SSL_MINOR_VERSION_0 (SSL v3) should be avoided. + * + * \note With DTLS, use MBEDTLS_SSL_MINOR_VERSION_2 for DTLS 1.0 and + * MBEDTLS_SSL_MINOR_VERSION_3 for DTLS 1.2 + * + * \param conf SSL configuration + * \param major Major version number (only MBEDTLS_SSL_MAJOR_VERSION_3 supported) + * \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_0, + * MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2, + * MBEDTLS_SSL_MINOR_VERSION_3 supported) + */ +void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor ); + +#if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C) +/** + * \brief Set the fallback flag (client-side only). + * (Default: MBEDTLS_SSL_IS_NOT_FALLBACK). + * + * \note Set to MBEDTLS_SSL_IS_FALLBACK when preparing a fallback + * connection, that is a connection with max_version set to a + * lower value than the value you're willing to use. Such + * fallback connections are not recommended but are sometimes + * necessary to interoperate with buggy (version-intolerant) + * servers. + * + * \warning You should NOT set this to MBEDTLS_SSL_IS_FALLBACK for + * non-fallback connections! This would appear to work for a + * while, then cause failures when the server is upgraded to + * support a newer TLS version. + * + * \param conf SSL configuration + * \param fallback MBEDTLS_SSL_IS_NOT_FALLBACK or MBEDTLS_SSL_IS_FALLBACK + */ +void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback ); +#endif /* MBEDTLS_SSL_FALLBACK_SCSV && MBEDTLS_SSL_CLI_C */ + +#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) +/** + * \brief Enable or disable Encrypt-then-MAC + * (Default: MBEDTLS_SSL_ETM_ENABLED) + * + * \note This should always be enabled, it is a security + * improvement, and should not cause any interoperability + * issue (used only if the peer supports it too). + * + * \param conf SSL configuration + * \param etm MBEDTLS_SSL_ETM_ENABLED or MBEDTLS_SSL_ETM_DISABLED + */ +void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm ); +#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ + +#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) +/** + * \brief Enable or disable Extended Master Secret negotiation. + * (Default: MBEDTLS_SSL_EXTENDED_MS_ENABLED) + * + * \note This should always be enabled, it is a security fix to the + * protocol, and should not cause any interoperability issue + * (used only if the peer supports it too). + * + * \param conf SSL configuration + * \param ems MBEDTLS_SSL_EXTENDED_MS_ENABLED or MBEDTLS_SSL_EXTENDED_MS_DISABLED + */ +void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems ); +#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ + +#if defined(MBEDTLS_ARC4_C) +/** + * \brief Disable or enable support for RC4 + * (Default: MBEDTLS_SSL_ARC4_DISABLED) + * + * \warning Use of RC4 in DTLS/TLS has been prohibited by RFC 7465 + * for security reasons. Use at your own risk. + * + * \note This function is deprecated and will be removed in + * a future version of the library. + * RC4 is disabled by default at compile time and needs to be + * actively enabled for use with legacy systems. + * + * \param conf SSL configuration + * \param arc4 MBEDTLS_SSL_ARC4_ENABLED or MBEDTLS_SSL_ARC4_DISABLED + */ +void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 ); +#endif /* MBEDTLS_ARC4_C */ + +#if defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Whether to send a list of acceptable CAs in + * CertificateRequest messages. + * (Default: do send) + * + * \param conf SSL configuration + * \param cert_req_ca_list MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED or + * MBEDTLS_SSL_CERT_REQ_CA_LIST_DISABLED + */ +void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf, + char cert_req_ca_list ); +#endif /* MBEDTLS_SSL_SRV_C */ + +#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) +/** + * \brief Set the maximum fragment length to emit and/or negotiate. + * (Typical: the smaller of #MBEDTLS_SSL_IN_CONTENT_LEN and + * #MBEDTLS_SSL_OUT_CONTENT_LEN, usually `2^14` bytes) + * (Server: set maximum fragment length to emit, + * usually negotiated by the client during handshake) + * (Client: set maximum fragment length to emit *and* + * negotiate with the server during handshake) + * (Default: #MBEDTLS_SSL_MAX_FRAG_LEN_NONE) + * + * \note On the client side, the maximum fragment length extension + * *will not* be used, unless the maximum fragment length has + * been set via this function to a value different than + * #MBEDTLS_SSL_MAX_FRAG_LEN_NONE. + * + * \note With TLS, this currently only affects ApplicationData (sent + * with \c mbedtls_ssl_read()), not handshake messages. + * With DTLS, this affects both ApplicationData and handshake. + * + * \note This sets the maximum length for a record's payload, + * excluding record overhead that will be added to it, see + * \c mbedtls_ssl_get_record_expansion(). + * + * \note For DTLS, it is also possible to set a limit for the total + * size of datagrams passed to the transport layer, including + * record overhead, see \c mbedtls_ssl_set_mtu(). + * + * \param conf SSL configuration + * \param mfl_code Code for maximum fragment length (allowed values: + * MBEDTLS_SSL_MAX_FRAG_LEN_512, MBEDTLS_SSL_MAX_FRAG_LEN_1024, + * MBEDTLS_SSL_MAX_FRAG_LEN_2048, MBEDTLS_SSL_MAX_FRAG_LEN_4096) + * + * \return 0 if successful or MBEDTLS_ERR_SSL_BAD_INPUT_DATA + */ +int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code ); +#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ + +#if defined(MBEDTLS_SSL_TRUNCATED_HMAC) +/** + * \brief Activate negotiation of truncated HMAC + * (Default: MBEDTLS_SSL_TRUNC_HMAC_DISABLED) + * + * \param conf SSL configuration + * \param truncate Enable or disable (MBEDTLS_SSL_TRUNC_HMAC_ENABLED or + * MBEDTLS_SSL_TRUNC_HMAC_DISABLED) + */ +void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate ); +#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ + +#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) +/** + * \brief Enable / Disable 1/n-1 record splitting + * (Default: MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED) + * + * \note Only affects SSLv3 and TLS 1.0, not higher versions. + * Does not affect non-CBC ciphersuites in any version. + * + * \param conf SSL configuration + * \param split MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED or + * MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED + */ +void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split ); +#endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */ + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) +/** + * \brief Enable / Disable session tickets (client only). + * (Default: MBEDTLS_SSL_SESSION_TICKETS_ENABLED.) + * + * \note On server, use \c mbedtls_ssl_conf_session_tickets_cb(). + * + * \param conf SSL configuration + * \param use_tickets Enable or disable (MBEDTLS_SSL_SESSION_TICKETS_ENABLED or + * MBEDTLS_SSL_SESSION_TICKETS_DISABLED) + */ +void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets ); +#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */ + +#if defined(MBEDTLS_SSL_RENEGOTIATION) +/** + * \brief Enable / Disable renegotiation support for connection when + * initiated by peer + * (Default: MBEDTLS_SSL_RENEGOTIATION_DISABLED) + * + * \warning It is recommended to always disable renegotiation unless you + * know you need it and you know what you're doing. In the + * past, there have been several issues associated with + * renegotiation or a poor understanding of its properties. + * + * \note Server-side, enabling renegotiation also makes the server + * susceptible to a resource DoS by a malicious client. + * + * \param conf SSL configuration + * \param renegotiation Enable or disable (MBEDTLS_SSL_RENEGOTIATION_ENABLED or + * MBEDTLS_SSL_RENEGOTIATION_DISABLED) + */ +void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation ); +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + +/** + * \brief Prevent or allow legacy renegotiation. + * (Default: MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION) + * + * MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION allows connections to + * be established even if the peer does not support + * secure renegotiation, but does not allow renegotiation + * to take place if not secure. + * (Interoperable and secure option) + * + * MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION allows renegotiations + * with non-upgraded peers. Allowing legacy renegotiation + * makes the connection vulnerable to specific man in the + * middle attacks. (See RFC 5746) + * (Most interoperable and least secure option) + * + * MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE breaks off connections + * if peer does not support secure renegotiation. Results + * in interoperability issues with non-upgraded peers + * that do not support renegotiation altogether. + * (Most secure option, interoperability issues) + * + * \param conf SSL configuration + * \param allow_legacy Prevent or allow (SSL_NO_LEGACY_RENEGOTIATION, + * SSL_ALLOW_LEGACY_RENEGOTIATION or + * MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE) + */ +void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy ); + +#if defined(MBEDTLS_SSL_RENEGOTIATION) +/** + * \brief Enforce renegotiation requests. + * (Default: enforced, max_records = 16) + * + * When we request a renegotiation, the peer can comply or + * ignore the request. This function allows us to decide + * whether to enforce our renegotiation requests by closing + * the connection if the peer doesn't comply. + * + * However, records could already be in transit from the peer + * when the request is emitted. In order to increase + * reliability, we can accept a number of records before the + * expected handshake records. + * + * The optimal value is highly dependent on the specific usage + * scenario. + * + * \note With DTLS and server-initiated renegotiation, the + * HelloRequest is retransmitted every time mbedtls_ssl_read() times + * out or receives Application Data, until: + * - max_records records have beens seen, if it is >= 0, or + * - the number of retransmits that would happen during an + * actual handshake has been reached. + * Please remember the request might be lost a few times + * if you consider setting max_records to a really low value. + * + * \warning On client, the grace period can only happen during + * mbedtls_ssl_read(), as opposed to mbedtls_ssl_write() and mbedtls_ssl_renegotiate() + * which always behave as if max_record was 0. The reason is, + * if we receive application data from the server, we need a + * place to write it, which only happens during mbedtls_ssl_read(). + * + * \param conf SSL configuration + * \param max_records Use MBEDTLS_SSL_RENEGOTIATION_NOT_ENFORCED if you don't want to + * enforce renegotiation, or a non-negative value to enforce + * it but allow for a grace period of max_records records. + */ +void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records ); + +/** + * \brief Set record counter threshold for periodic renegotiation. + * (Default: 2^48 - 1) + * + * Renegotiation is automatically triggered when a record + * counter (outgoing or incoming) crosses the defined + * threshold. The default value is meant to prevent the + * connection from being closed when the counter is about to + * reached its maximal value (it is not allowed to wrap). + * + * Lower values can be used to enforce policies such as "keys + * must be refreshed every N packets with cipher X". + * + * The renegotiation period can be disabled by setting + * conf->disable_renegotiation to + * MBEDTLS_SSL_RENEGOTIATION_DISABLED. + * + * \note When the configured transport is + * MBEDTLS_SSL_TRANSPORT_DATAGRAM the maximum renegotiation + * period is 2^48 - 1, and for MBEDTLS_SSL_TRANSPORT_STREAM, + * the maximum renegotiation period is 2^64 - 1. + * + * \param conf SSL configuration + * \param period The threshold value: a big-endian 64-bit number. + */ +void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf, + const unsigned char period[8] ); +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + +/** + * \brief Check if there is data already read from the + * underlying transport but not yet processed. + * + * \param ssl SSL context + * + * \return 0 if nothing's pending, 1 otherwise. + * + * \note This is different in purpose and behaviour from + * \c mbedtls_ssl_get_bytes_avail in that it considers + * any kind of unprocessed data, not only unread + * application data. If \c mbedtls_ssl_get_bytes + * returns a non-zero value, this function will + * also signal pending data, but the converse does + * not hold. For example, in DTLS there might be + * further records waiting to be processed from + * the current underlying transport's datagram. + * + * \note If this function returns 1 (data pending), this + * does not imply that a subsequent call to + * \c mbedtls_ssl_read will provide any data; + * e.g., the unprocessed data might turn out + * to be an alert or a handshake message. + * + * \note This function is useful in the following situation: + * If the SSL/TLS module successfully returns from an + * operation - e.g. a handshake or an application record + * read - and you're awaiting incoming data next, you + * must not immediately idle on the underlying transport + * to have data ready, but you need to check the value + * of this function first. The reason is that the desired + * data might already be read but not yet processed. + * If, in contrast, a previous call to the SSL/TLS module + * returned MBEDTLS_ERR_SSL_WANT_READ, it is not necessary + * to call this function, as the latter error code entails + * that all internal data has been processed. + * + */ +int mbedtls_ssl_check_pending( const mbedtls_ssl_context *ssl ); + +/** + * \brief Return the number of application data bytes + * remaining to be read from the current record. + * + * \param ssl SSL context + * + * \return How many bytes are available in the application + * data record read buffer. + * + * \note When working over a datagram transport, this is + * useful to detect the current datagram's boundary + * in case \c mbedtls_ssl_read has written the maximal + * amount of data fitting into the input buffer. + * + */ +size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl ); + +/** + * \brief Return the result of the certificate verification + * + * \param ssl The SSL context to use. + * + * \return \c 0 if the certificate verification was successful. + * \return \c -1u if the result is not available. This may happen + * e.g. if the handshake aborts early, or a verification + * callback returned a fatal error. + * \return A bitwise combination of \c MBEDTLS_X509_BADCERT_XXX + * and \c MBEDTLS_X509_BADCRL_XXX failure flags; see x509.h. + */ +uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl ); + +/** + * \brief Return the name of the current ciphersuite + * + * \param ssl SSL context + * + * \return a string containing the ciphersuite name + */ +const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl ); + +/** + * \brief Return the current SSL version (SSLv3/TLSv1/etc) + * + * \param ssl SSL context + * + * \return a string containing the SSL version + */ +const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl ); + +/** + * \brief Return the (maximum) number of bytes added by the record + * layer: header + encryption/MAC overhead (inc. padding) + * + * \note This function is not available (always returns an error) + * when record compression is enabled. + * + * \param ssl SSL context + * + * \return Current maximum record expansion in bytes, or + * MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if compression is + * enabled, which makes expansion much less predictable + */ +int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl ); + +#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) +/** + * \brief Return the maximum fragment length (payload, in bytes) for + * the output buffer. For the client, this is the configured + * value. For the server, it is the minimum of two - the + * configured value and the negotiated one. + * + * \sa mbedtls_ssl_conf_max_frag_len() + * \sa mbedtls_ssl_get_max_record_payload() + * + * \param ssl SSL context + * + * \return Current maximum fragment length for the output buffer. + */ +size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl ); + +/** + * \brief Return the maximum fragment length (payload, in bytes) for + * the input buffer. This is the negotiated maximum fragment + * length, or, if there is none, MBEDTLS_SSL_MAX_CONTENT_LEN. + * If it is not defined either, the value is 2^14. This function + * works as its predecessor, \c mbedtls_ssl_get_max_frag_len(). + * + * \sa mbedtls_ssl_conf_max_frag_len() + * \sa mbedtls_ssl_get_max_record_payload() + * + * \param ssl SSL context + * + * \return Current maximum fragment length for the output buffer. + */ +size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) + +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif + +/** + * \brief This function is a deprecated approach to getting the max + * fragment length. Its an alias for + * \c mbedtls_ssl_get_output_max_frag_len(), as the behaviour + * is the same. See \c mbedtls_ssl_get_output_max_frag_len() for + * more detail. + * + * \sa mbedtls_ssl_get_input_max_frag_len() + * \sa mbedtls_ssl_get_output_max_frag_len() + * + * \param ssl SSL context + * + * \return Current maximum fragment length for the output buffer. + */ +MBEDTLS_DEPRECATED size_t mbedtls_ssl_get_max_frag_len( + const mbedtls_ssl_context *ssl ); +#endif /* MBEDTLS_DEPRECATED_REMOVED */ +#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ + +/** + * \brief Return the current maximum outgoing record payload in bytes. + * This takes into account the config.h setting \c + * MBEDTLS_SSL_OUT_CONTENT_LEN, the configured and negotiated + * max fragment length extension if used, and for DTLS the + * path MTU as configured and current record expansion. + * + * \note With DTLS, \c mbedtls_ssl_write() will return an error if + * called with a larger length value. + * With TLS, \c mbedtls_ssl_write() will fragment the input if + * necessary and return the number of bytes written; it is up + * to the caller to call \c mbedtls_ssl_write() again in + * order to send the remaining bytes if any. + * + * \note This function is not available (always returns an error) + * when record compression is enabled. + * + * \sa mbedtls_ssl_set_mtu() + * \sa mbedtls_ssl_get_output_max_frag_len() + * \sa mbedtls_ssl_get_input_max_frag_len() + * \sa mbedtls_ssl_get_record_expansion() + * + * \param ssl SSL context + * + * \return Current maximum payload for an outgoing record, + * or a negative error code. + */ +int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl ); + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Return the peer certificate from the current connection. + * + * \param ssl The SSL context to use. This must be initialized and setup. + * + * \return The current peer certificate, if available. + * The returned certificate is owned by the SSL context and + * is valid only until the next call to the SSL API. + * \return \c NULL if no peer certificate is available. This might + * be because the chosen ciphersuite doesn't use CRTs + * (PSK-based ciphersuites, for example), or because + * #MBEDTLS_SSL_KEEP_PEER_CERTIFICATE has been disabled, + * allowing the stack to free the peer's CRT to save memory. + * + * \note For one-time inspection of the peer's certificate during + * the handshake, consider registering an X.509 CRT verification + * callback through mbedtls_ssl_conf_verify() instead of calling + * this function. Using mbedtls_ssl_conf_verify() also comes at + * the benefit of allowing you to influence the verification + * process, for example by masking expected and tolerated + * verification failures. + * + * \warning You must not use the pointer returned by this function + * after any further call to the SSL API, including + * mbedtls_ssl_read() and mbedtls_ssl_write(); this is + * because the pointer might change during renegotiation, + * which happens transparently to the user. + * If you want to use the certificate across API calls, + * you must make a copy. + */ +const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl ); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_CLI_C) +/** + * \brief Save session in order to resume it later (client-side only) + * Session data is copied to presented session structure. + * + * + * \param ssl SSL context + * \param session session context + * + * \return 0 if successful, + * MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed, + * MBEDTLS_ERR_SSL_BAD_INPUT_DATA if used server-side or + * arguments are otherwise invalid. + * + * \note Only the server certificate is copied, and not the full chain, + * so you should not attempt to validate the certificate again + * by calling \c mbedtls_x509_crt_verify() on it. + * Instead, you should use the results from the verification + * in the original handshake by calling \c mbedtls_ssl_get_verify_result() + * after loading the session again into a new SSL context + * using \c mbedtls_ssl_set_session(). + * + * \note Once the session object is not needed anymore, you should + * free it by calling \c mbedtls_ssl_session_free(). + * + * \sa mbedtls_ssl_set_session() + */ +int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl, mbedtls_ssl_session *session ); +#endif /* MBEDTLS_SSL_CLI_C */ + +/** + * \brief Perform the SSL handshake + * + * \param ssl SSL context + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_WANT_READ or #MBEDTLS_ERR_SSL_WANT_WRITE + * if the handshake is incomplete and waiting for data to + * be available for reading from or writing to the underlying + * transport - in this case you must call this function again + * when the underlying transport is ready for the operation. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if an asynchronous + * operation is in progress (see + * mbedtls_ssl_conf_async_private_cb()) - in this case you + * must call this function again when the operation is ready. + * \return #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS if a cryptographic + * operation is in progress (see mbedtls_ecp_set_max_ops()) - + * in this case you must call this function again to complete + * the handshake when you're done attending other tasks. + * \return #MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED if DTLS is in use + * and the client did not demonstrate reachability yet - in + * this case you must stop using the context (see below). + * \return Another SSL error code - in this case you must stop using + * the context (see below). + * + * \warning If this function returns something other than + * \c 0, + * #MBEDTLS_ERR_SSL_WANT_READ, + * #MBEDTLS_ERR_SSL_WANT_WRITE, + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + * you must stop using the SSL context for reading or writing, + * and either free it or call \c mbedtls_ssl_session_reset() + * on it before re-using it for a new connection; the current + * connection must be closed. + * + * \note If DTLS is in use, then you may choose to handle + * #MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED specially for logging + * purposes, as it is an expected return value rather than an + * actual error, but you still need to reset/free the context. + * + * \note Remarks regarding event-driven DTLS: + * If the function returns #MBEDTLS_ERR_SSL_WANT_READ, no datagram + * from the underlying transport layer is currently being processed, + * and it is safe to idle until the timer or the underlying transport + * signal a new event. This is not true for a successful handshake, + * in which case the datagram of the underlying transport that is + * currently being processed might or might not contain further + * DTLS records. + */ +int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl ); + +/** + * \brief Perform a single step of the SSL handshake + * + * \note The state of the context (ssl->state) will be at + * the next state after this function returns \c 0. Do not + * call this function if state is MBEDTLS_SSL_HANDSHAKE_OVER. + * + * \param ssl SSL context + * + * \return See mbedtls_ssl_handshake(). + * + * \warning If this function returns something other than \c 0, + * #MBEDTLS_ERR_SSL_WANT_READ, #MBEDTLS_ERR_SSL_WANT_WRITE, + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, you must stop using + * the SSL context for reading or writing, and either free it + * or call \c mbedtls_ssl_session_reset() on it before + * re-using it for a new connection; the current connection + * must be closed. + */ +int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl ); + +#if defined(MBEDTLS_SSL_RENEGOTIATION) +/** + * \brief Initiate an SSL renegotiation on the running connection. + * Client: perform the renegotiation right now. + * Server: request renegotiation, which will be performed + * during the next call to mbedtls_ssl_read() if honored by + * client. + * + * \param ssl SSL context + * + * \return 0 if successful, or any mbedtls_ssl_handshake() return + * value except #MBEDTLS_ERR_SSL_CLIENT_RECONNECT that can't + * happen during a renegotiation. + * + * \warning If this function returns something other than \c 0, + * #MBEDTLS_ERR_SSL_WANT_READ, #MBEDTLS_ERR_SSL_WANT_WRITE, + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, you must stop using + * the SSL context for reading or writing, and either free it + * or call \c mbedtls_ssl_session_reset() on it before + * re-using it for a new connection; the current connection + * must be closed. + * + */ +int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl ); +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + +/** + * \brief Read at most 'len' application data bytes + * + * \param ssl SSL context + * \param buf buffer that will hold the data + * \param len maximum number of bytes to read + * + * \return The (positive) number of bytes read if successful. + * \return \c 0 if the read end of the underlying transport was closed + * without sending a CloseNotify beforehand, which might happen + * because of various reasons (internal error of an underlying + * stack, non-conformant peer not sending a CloseNotify and + * such) - in this case you must stop using the context + * (see below). + * \return #MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY if the underlying + * transport is still functional, but the peer has + * acknowledged to not send anything anymore. + * \return #MBEDTLS_ERR_SSL_WANT_READ or #MBEDTLS_ERR_SSL_WANT_WRITE + * if the handshake is incomplete and waiting for data to + * be available for reading from or writing to the underlying + * transport - in this case you must call this function again + * when the underlying transport is ready for the operation. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if an asynchronous + * operation is in progress (see + * mbedtls_ssl_conf_async_private_cb()) - in this case you + * must call this function again when the operation is ready. + * \return #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS if a cryptographic + * operation is in progress (see mbedtls_ecp_set_max_ops()) - + * in this case you must call this function again to complete + * the handshake when you're done attending other tasks. + * \return #MBEDTLS_ERR_SSL_CLIENT_RECONNECT if we're at the server + * side of a DTLS connection and the client is initiating a + * new connection using the same source port. See below. + * \return Another SSL error code - in this case you must stop using + * the context (see below). + * + * \warning If this function returns something other than + * a positive value, + * #MBEDTLS_ERR_SSL_WANT_READ, + * #MBEDTLS_ERR_SSL_WANT_WRITE, + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + * #MBEDTLS_ERR_SSL_CLIENT_RECONNECT, + * you must stop using the SSL context for reading or writing, + * and either free it or call \c mbedtls_ssl_session_reset() + * on it before re-using it for a new connection; the current + * connection must be closed. + * + * \note When this function returns #MBEDTLS_ERR_SSL_CLIENT_RECONNECT + * (which can only happen server-side), it means that a client + * is initiating a new connection using the same source port. + * You can either treat that as a connection close and wait + * for the client to resend a ClientHello, or directly + * continue with \c mbedtls_ssl_handshake() with the same + * context (as it has been reset internally). Either way, you + * must make sure this is seen by the application as a new + * connection: application state, if any, should be reset, and + * most importantly the identity of the client must be checked + * again. WARNING: not validating the identity of the client + * again, or not transmitting the new identity to the + * application layer, would allow authentication bypass! + * + * \note Remarks regarding event-driven DTLS: + * - If the function returns #MBEDTLS_ERR_SSL_WANT_READ, no datagram + * from the underlying transport layer is currently being processed, + * and it is safe to idle until the timer or the underlying transport + * signal a new event. + * - This function may return MBEDTLS_ERR_SSL_WANT_READ even if data was + * initially available on the underlying transport, as this data may have + * been only e.g. duplicated messages or a renegotiation request. + * Therefore, you must be prepared to receive MBEDTLS_ERR_SSL_WANT_READ even + * when reacting to an incoming-data event from the underlying transport. + * - On success, the datagram of the underlying transport that is currently + * being processed may contain further DTLS records. You should call + * \c mbedtls_ssl_check_pending to check for remaining records. + * + */ +int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len ); + +/** + * \brief Try to write exactly 'len' application data bytes + * + * \warning This function will do partial writes in some cases. If the + * return value is non-negative but less than length, the + * function must be called again with updated arguments: + * buf + ret, len - ret (if ret is the return value) until + * it returns a value equal to the last 'len' argument. + * + * \param ssl SSL context + * \param buf buffer holding the data + * \param len how many bytes must be written + * + * \return The (non-negative) number of bytes actually written if + * successful (may be less than \p len). + * \return #MBEDTLS_ERR_SSL_WANT_READ or #MBEDTLS_ERR_SSL_WANT_WRITE + * if the handshake is incomplete and waiting for data to + * be available for reading from or writing to the underlying + * transport - in this case you must call this function again + * when the underlying transport is ready for the operation. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if an asynchronous + * operation is in progress (see + * mbedtls_ssl_conf_async_private_cb()) - in this case you + * must call this function again when the operation is ready. + * \return #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS if a cryptographic + * operation is in progress (see mbedtls_ecp_set_max_ops()) - + * in this case you must call this function again to complete + * the handshake when you're done attending other tasks. + * \return Another SSL error code - in this case you must stop using + * the context (see below). + * + * \warning If this function returns something other than + * a non-negative value, + * #MBEDTLS_ERR_SSL_WANT_READ, + * #MBEDTLS_ERR_SSL_WANT_WRITE, + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + * you must stop using the SSL context for reading or writing, + * and either free it or call \c mbedtls_ssl_session_reset() + * on it before re-using it for a new connection; the current + * connection must be closed. + * + * \note When this function returns #MBEDTLS_ERR_SSL_WANT_WRITE/READ, + * it must be called later with the *same* arguments, + * until it returns a value greater that or equal to 0. When + * the function returns #MBEDTLS_ERR_SSL_WANT_WRITE there may be + * some partial data in the output buffer, however this is not + * yet sent. + * + * \note If the requested length is greater than the maximum + * fragment length (either the built-in limit or the one set + * or negotiated with the peer), then: + * - with TLS, less bytes than requested are written. + * - with DTLS, MBEDTLS_ERR_SSL_BAD_INPUT_DATA is returned. + * \c mbedtls_ssl_get_output_max_frag_len() may be used to + * query the active maximum fragment length. + * + * \note Attempting to write 0 bytes will result in an empty TLS + * application record being sent. + */ +int mbedtls_ssl_write( mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len ); + +/** + * \brief Send an alert message + * + * \param ssl SSL context + * \param level The alert level of the message + * (MBEDTLS_SSL_ALERT_LEVEL_WARNING or MBEDTLS_SSL_ALERT_LEVEL_FATAL) + * \param message The alert message (SSL_ALERT_MSG_*) + * + * \return 0 if successful, or a specific SSL error code. + * + * \note If this function returns something other than 0 or + * MBEDTLS_ERR_SSL_WANT_READ/WRITE, you must stop using + * the SSL context for reading or writing, and either free it or + * call \c mbedtls_ssl_session_reset() on it before re-using it + * for a new connection; the current connection must be closed. + */ +int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl, + unsigned char level, + unsigned char message ); +/** + * \brief Notify the peer that the connection is being closed + * + * \param ssl SSL context + * + * \return 0 if successful, or a specific SSL error code. + * + * \note If this function returns something other than 0 or + * MBEDTLS_ERR_SSL_WANT_READ/WRITE, you must stop using + * the SSL context for reading or writing, and either free it or + * call \c mbedtls_ssl_session_reset() on it before re-using it + * for a new connection; the current connection must be closed. + */ +int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl ); + +/** + * \brief Free referenced items in an SSL context and clear memory + * + * \param ssl SSL context + */ +void mbedtls_ssl_free( mbedtls_ssl_context *ssl ); + +#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) +/** + * \brief Save an active connection as serialized data in a buffer. + * This allows the freeing or re-using of the SSL context + * while still picking up the connection later in a way that + * it entirely transparent to the peer. + * + * \see mbedtls_ssl_context_load() + * + * \note This feature is currently only available under certain + * conditions, see the documentation of the return value + * #MBEDTLS_ERR_SSL_BAD_INPUT_DATA for details. + * + * \note When this function succeeds, it calls + * mbedtls_ssl_session_reset() on \p ssl which as a result is + * no longer associated with the connection that has been + * serialized. This avoids creating copies of the connection + * state. You're then free to either re-use the context + * structure for a different connection, or call + * mbedtls_ssl_free() on it. See the documentation of + * mbedtls_ssl_session_reset() for more details. + * + * \param ssl The SSL context to save. On success, it is no longer + * associated with the connection that has been serialized. + * \param buf The buffer to write the serialized data to. It must be a + * writeable buffer of at least \p buf_len bytes, or may be \c + * NULL if \p buf_len is \c 0. + * \param buf_len The number of bytes available for writing in \p buf. + * \param olen The size in bytes of the data that has been or would have + * been written. It must point to a valid \c size_t. + * + * \note \p olen is updated to the correct value regardless of + * whether \p buf_len was large enough. This makes it possible + * to determine the necessary size by calling this function + * with \p buf set to \c NULL and \p buf_len to \c 0. However, + * the value of \p olen is only guaranteed to be correct when + * the function returns #MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL or + * \c 0. If the return value is different, then the value of + * \p olen is undefined. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL if \p buf is too small. + * \return #MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed + * while resetting the context. + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if a handshake is in + * progress, or there is pending data for reading or sending, + * or the connection does not use DTLS 1.2 with an AEAD + * ciphersuite, or renegotiation is enabled. + */ +int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl, + unsigned char *buf, + size_t buf_len, + size_t *olen ); + +/** + * \brief Load serialized connection data to an SSL context. + * + * \see mbedtls_ssl_context_save() + * + * \warning The same serialized data must never be loaded into more + * that one context. In order to ensure that, after + * successfully loading serialized data to an SSL context, you + * should immediately destroy or invalidate all copies of the + * serialized data that was loaded. Loading the same data in + * more than one context would cause severe security failures + * including but not limited to loss of confidentiality. + * + * \note Before calling this function, the SSL context must be + * prepared in one of the two following ways. The first way is + * to take a context freshly initialised with + * mbedtls_ssl_init() and call mbedtls_ssl_setup() on it with + * the same ::mbedtls_ssl_config structure that was used in + * the original connection. The second way is to + * call mbedtls_ssl_session_reset() on a context that was + * previously prepared as above but used in the meantime. + * Either way, you must not use the context to perform a + * handshake between calling mbedtls_ssl_setup() or + * mbedtls_ssl_session_reset() and calling this function. You + * may however call other setter functions in that time frame + * as indicated in the note below. + * + * \note Before or after calling this function successfully, you + * also need to configure some connection-specific callbacks + * and settings before you can use the connection again + * (unless they were already set before calling + * mbedtls_ssl_session_reset() and the values are suitable for + * the present connection). Specifically, you want to call + * at least mbedtls_ssl_set_bio() and + * mbedtls_ssl_set_timer_cb(). All other SSL setter functions + * are not necessary to call, either because they're only used + * in handshakes, or because the setting is already saved. You + * might choose to call them anyway, for example in order to + * share code between the cases of establishing a new + * connection and the case of loading an already-established + * connection. + * + * \note If you have new information about the path MTU, you want to + * call mbedtls_ssl_set_mtu() after calling this function, as + * otherwise this function would overwrite your + * newly-configured value with the value that was active when + * the context was saved. + * + * \note When this function returns an error code, it calls + * mbedtls_ssl_free() on \p ssl. In this case, you need to + * prepare the context with the usual sequence starting with a + * call to mbedtls_ssl_init() if you want to use it again. + * + * \param ssl The SSL context structure to be populated. It must have + * been prepared as described in the note above. + * \param buf The buffer holding the serialized connection data. It must + * be a readable buffer of at least \p len bytes. + * \param len The size of the serialized data in bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed. + * \return #MBEDTLS_ERR_SSL_VERSION_MISMATCH if the serialized data + * comes from a different Mbed TLS version or build. + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if input data is invalid. + */ +int mbedtls_ssl_context_load( mbedtls_ssl_context *ssl, + const unsigned char *buf, + size_t len ); +#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */ + +/** + * \brief Initialize an SSL configuration context + * Just makes the context ready for + * mbedtls_ssl_config_defaults() or mbedtls_ssl_config_free(). + * + * \note You need to call mbedtls_ssl_config_defaults() unless you + * manually set all of the relevant fields yourself. + * + * \param conf SSL configuration context + */ +void mbedtls_ssl_config_init( mbedtls_ssl_config *conf ); + +/** + * \brief Load reasonable default SSL configuration values. + * (You need to call mbedtls_ssl_config_init() first.) + * + * \param conf SSL configuration context + * \param endpoint MBEDTLS_SSL_IS_CLIENT or MBEDTLS_SSL_IS_SERVER + * \param transport MBEDTLS_SSL_TRANSPORT_STREAM for TLS, or + * MBEDTLS_SSL_TRANSPORT_DATAGRAM for DTLS + * \param preset a MBEDTLS_SSL_PRESET_XXX value + * + * \note See \c mbedtls_ssl_conf_transport() for notes on DTLS. + * + * \return 0 if successful, or + * MBEDTLS_ERR_XXX_ALLOC_FAILED on memory allocation error. + */ +int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf, + int endpoint, int transport, int preset ); + +/** + * \brief Free an SSL configuration context + * + * \param conf SSL configuration context + */ +void mbedtls_ssl_config_free( mbedtls_ssl_config *conf ); + +/** + * \brief Initialize SSL session structure + * + * \param session SSL session + */ +void mbedtls_ssl_session_init( mbedtls_ssl_session *session ); + +/** + * \brief Free referenced items in an SSL session including the + * peer certificate and clear memory + * + * \note A session object can be freed even if the SSL context + * that was used to retrieve the session is still in use. + * + * \param session SSL session + */ +void mbedtls_ssl_session_free( mbedtls_ssl_session *session ); + +/** + * \brief TLS-PRF function for key derivation. + * + * \param prf The tls_prf type function type to be used. + * \param secret Secret for the key derivation function. + * \param slen Length of the secret. + * \param label String label for the key derivation function, + * terminated with null character. + * \param random Random bytes. + * \param rlen Length of the random bytes buffer. + * \param dstbuf The buffer holding the derived key. + * \param dlen Length of the output buffer. + * + * \return 0 on success. An SSL specific error on failure. + */ +int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf, + const unsigned char *secret, size_t slen, + const char *label, + const unsigned char *random, size_t rlen, + unsigned char *dstbuf, size_t dlen ); + +#ifdef __cplusplus +} +#endif + +#endif /* ssl.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/ssl_cache.h b/openharmony/arm64-v8a/include/mbedtls/ssl_cache.h new file mode 100644 index 00000000..02eab96d --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/ssl_cache.h @@ -0,0 +1,149 @@ +/** + * \file ssl_cache.h + * + * \brief SSL session cache implementation + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SSL_CACHE_H +#define MBEDTLS_SSL_CACHE_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/ssl.h" + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h or define them on the compiler command line. + * \{ + */ + +#if !defined(MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT) +#define MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT 86400 /*!< 1 day */ +#endif + +#if !defined(MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES) +#define MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /*!< Maximum entries in cache */ +#endif + +/** \} name SECTION: Module settings */ + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct mbedtls_ssl_cache_context mbedtls_ssl_cache_context; +typedef struct mbedtls_ssl_cache_entry mbedtls_ssl_cache_entry; + +/** + * \brief This structure is used for storing cache entries + */ +struct mbedtls_ssl_cache_entry +{ +#if defined(MBEDTLS_HAVE_TIME) + mbedtls_time_t timestamp; /*!< entry timestamp */ +#endif + mbedtls_ssl_session session; /*!< entry session */ +#if defined(MBEDTLS_X509_CRT_PARSE_C) && \ + defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) + mbedtls_x509_buf peer_cert; /*!< entry peer_cert */ +#endif + mbedtls_ssl_cache_entry *next; /*!< chain pointer */ +}; + +/** + * \brief Cache context + */ +struct mbedtls_ssl_cache_context +{ + mbedtls_ssl_cache_entry *chain; /*!< start of the chain */ + int timeout; /*!< cache entry timeout */ + int max_entries; /*!< maximum entries */ +#if defined(MBEDTLS_THREADING_C) + mbedtls_threading_mutex_t mutex; /*!< mutex */ +#endif +}; + +/** + * \brief Initialize an SSL cache context + * + * \param cache SSL cache context + */ +void mbedtls_ssl_cache_init( mbedtls_ssl_cache_context *cache ); + +/** + * \brief Cache get callback implementation + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param data SSL cache context + * \param session session to retrieve entry for + */ +int mbedtls_ssl_cache_get( void *data, mbedtls_ssl_session *session ); + +/** + * \brief Cache set callback implementation + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param data SSL cache context + * \param session session to store entry for + */ +int mbedtls_ssl_cache_set( void *data, const mbedtls_ssl_session *session ); + +#if defined(MBEDTLS_HAVE_TIME) +/** + * \brief Set the cache timeout + * (Default: MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT (1 day)) + * + * A timeout of 0 indicates no timeout. + * + * \param cache SSL cache context + * \param timeout cache entry timeout in seconds + */ +void mbedtls_ssl_cache_set_timeout( mbedtls_ssl_cache_context *cache, int timeout ); +#endif /* MBEDTLS_HAVE_TIME */ + +/** + * \brief Set the maximum number of cache entries + * (Default: MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES (50)) + * + * \param cache SSL cache context + * \param max cache entry maximum + */ +void mbedtls_ssl_cache_set_max_entries( mbedtls_ssl_cache_context *cache, int max ); + +/** + * \brief Free referenced items in a cache context and clear memory + * + * \param cache SSL cache context + */ +void mbedtls_ssl_cache_free( mbedtls_ssl_cache_context *cache ); + +#ifdef __cplusplus +} +#endif + +#endif /* ssl_cache.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/ssl_ciphersuites.h b/openharmony/arm64-v8a/include/mbedtls/ssl_ciphersuites.h new file mode 100644 index 00000000..93c32a5e --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/ssl_ciphersuites.h @@ -0,0 +1,556 @@ +/** + * \file ssl_ciphersuites.h + * + * \brief SSL Ciphersuites for mbed TLS + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SSL_CIPHERSUITES_H +#define MBEDTLS_SSL_CIPHERSUITES_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/pk.h" +#include "mbedtls/cipher.h" +#include "mbedtls/md.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * Supported ciphersuites (Official IANA names) + */ +#define MBEDTLS_TLS_RSA_WITH_NULL_MD5 0x01 /**< Weak! */ +#define MBEDTLS_TLS_RSA_WITH_NULL_SHA 0x02 /**< Weak! */ + +#define MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 0x04 +#define MBEDTLS_TLS_RSA_WITH_RC4_128_SHA 0x05 +#define MBEDTLS_TLS_RSA_WITH_DES_CBC_SHA 0x09 /**< Weak! Not in TLS 1.2 */ + +#define MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA 0x0A + +#define MBEDTLS_TLS_DHE_RSA_WITH_DES_CBC_SHA 0x15 /**< Weak! Not in TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA 0x16 + +#define MBEDTLS_TLS_PSK_WITH_NULL_SHA 0x2C /**< Weak! */ +#define MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA 0x2D /**< Weak! */ +#define MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA 0x2E /**< Weak! */ +#define MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA 0x2F + +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA 0x33 +#define MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA 0x35 +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA 0x39 + +#define MBEDTLS_TLS_RSA_WITH_NULL_SHA256 0x3B /**< Weak! */ +#define MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 0x3C /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 0x3D /**< TLS 1.2 */ + +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 0x41 +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 0x45 + +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 0x67 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 0x6B /**< TLS 1.2 */ + +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 0x84 +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 0x88 + +#define MBEDTLS_TLS_PSK_WITH_RC4_128_SHA 0x8A +#define MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA 0x8B +#define MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA 0x8C +#define MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA 0x8D + +#define MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA 0x8E +#define MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA 0x8F +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA 0x90 +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA 0x91 + +#define MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA 0x92 +#define MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA 0x93 +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA 0x94 +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA 0x95 + +#define MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 0x9C /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 0x9D /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 0x9E /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 0x9F /**< TLS 1.2 */ + +#define MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 0xA8 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 0xA9 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 0xAA /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 0xAB /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 0xAC /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 0xAD /**< TLS 1.2 */ + +#define MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 0xAE +#define MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 0xAF +#define MBEDTLS_TLS_PSK_WITH_NULL_SHA256 0xB0 /**< Weak! */ +#define MBEDTLS_TLS_PSK_WITH_NULL_SHA384 0xB1 /**< Weak! */ + +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 0xB2 +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 0xB3 +#define MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256 0xB4 /**< Weak! */ +#define MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384 0xB5 /**< Weak! */ + +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 0xB6 +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 0xB7 +#define MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256 0xB8 /**< Weak! */ +#define MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384 0xB9 /**< Weak! */ + +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xBA /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xBE /**< TLS 1.2 */ + +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 0xC0 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 0xC4 /**< TLS 1.2 */ + +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA 0xC001 /**< Weak! */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA 0xC002 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA 0xC003 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0xC004 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA 0xC005 /**< Not in SSL3! */ + +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA 0xC006 /**< Weak! */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA 0xC007 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA 0xC008 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0xC009 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0xC00A /**< Not in SSL3! */ + +#define MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA 0xC00B /**< Weak! */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA 0xC00C /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA 0xC00D /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA 0xC00E /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA 0xC00F /**< Not in SSL3! */ + +#define MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA 0xC010 /**< Weak! */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA 0xC011 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 0xC012 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 0xC013 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 0xC014 /**< Not in SSL3! */ + +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 0xC023 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 0xC024 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 0xC025 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 0xC026 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 0xC027 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 0xC028 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 0xC029 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 0xC02A /**< TLS 1.2 */ + +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0xC02B /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0xC02C /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 0xC02D /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 0xC02E /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0xC02F /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 0xC030 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 0xC031 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 0xC032 /**< TLS 1.2 */ + +#define MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA 0xC033 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA 0xC034 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA 0xC035 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA 0xC036 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 0xC037 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 0xC038 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA 0xC039 /**< Weak! No SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 0xC03A /**< Weak! No SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 0xC03B /**< Weak! No SSL3! */ + +#define MBEDTLS_TLS_RSA_WITH_ARIA_128_CBC_SHA256 0xC03C /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_ARIA_256_CBC_SHA384 0xC03D /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256 0xC044 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384 0xC045 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256 0xC048 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384 0xC049 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256 0xC04A /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384 0xC04B /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256 0xC04C /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384 0xC04D /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256 0xC04E /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384 0xC04F /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256 0xC050 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384 0xC051 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 0xC052 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 0xC053 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 0xC05C /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 0xC05D /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256 0xC05E /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384 0xC05F /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 0xC060 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 0xC061 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256 0xC062 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384 0xC063 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_ARIA_128_CBC_SHA256 0xC064 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_ARIA_256_CBC_SHA384 0xC065 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256 0xC066 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384 0xC067 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256 0xC068 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384 0xC069 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256 0xC06A /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384 0xC06B /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256 0xC06C /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384 0xC06D /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256 0xC06E /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384 0xC06F /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256 0xC070 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384 0xC071 /**< TLS 1.2 */ + +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC072 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC073 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC074 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC075 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xC076 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 0xC077 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xC078 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 0xC079 /**< Not in SSL3! */ + +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC07A /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC07B /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC07C /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC07D /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 0xC086 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 0xC087 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 0xC088 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 0xC089 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC08A /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC08B /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC08C /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC08D /**< TLS 1.2 */ + +#define MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 0xC08E /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 0xC08F /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 0xC090 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 0xC091 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 0xC092 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 0xC093 /**< TLS 1.2 */ + +#define MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC094 +#define MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC095 +#define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC096 +#define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC097 +#define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC098 +#define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC099 +#define MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC09A /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC09B /**< Not in SSL3! */ + +#define MBEDTLS_TLS_RSA_WITH_AES_128_CCM 0xC09C /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_AES_256_CCM 0xC09D /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM 0xC09E /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM 0xC09F /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_AES_128_CCM_8 0xC0A0 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_AES_256_CCM_8 0xC0A1 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM_8 0xC0A2 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM_8 0xC0A3 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_AES_128_CCM 0xC0A4 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_AES_256_CCM 0xC0A5 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM 0xC0A6 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM 0xC0A7 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8 0xC0A8 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8 0xC0A9 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM_8 0xC0AA /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM_8 0xC0AB /**< TLS 1.2 */ +/* The last two are named with PSK_DHE in the RFC, which looks like a typo */ + +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM 0xC0AC /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM 0xC0AD /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 0xC0AE /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 0xC0AF /**< TLS 1.2 */ + +#define MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8 0xC0FF /**< experimental */ + +/* RFC 7905 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA8 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA9 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0xCCAA /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAB /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAC /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAD /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAE /**< TLS 1.2 */ + +/* Reminder: update mbedtls_ssl_premaster_secret when adding a new key exchange. + * Reminder: update MBEDTLS_KEY_EXCHANGE__xxx below + */ +typedef enum { + MBEDTLS_KEY_EXCHANGE_NONE = 0, + MBEDTLS_KEY_EXCHANGE_RSA, + MBEDTLS_KEY_EXCHANGE_DHE_RSA, + MBEDTLS_KEY_EXCHANGE_ECDHE_RSA, + MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA, + MBEDTLS_KEY_EXCHANGE_PSK, + MBEDTLS_KEY_EXCHANGE_DHE_PSK, + MBEDTLS_KEY_EXCHANGE_RSA_PSK, + MBEDTLS_KEY_EXCHANGE_ECDHE_PSK, + MBEDTLS_KEY_EXCHANGE_ECDH_RSA, + MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA, + MBEDTLS_KEY_EXCHANGE_ECJPAKE, +} mbedtls_key_exchange_type_t; + +/* Key exchanges using a certificate */ +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED +#endif + +/* Key exchanges allowing client certificate requests */ +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED +#endif + +/* Key exchanges involving server signature in ServerKeyExchange */ +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED +#endif + +/* Key exchanges using ECDH */ +#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED +#endif + +/* Key exchanges that don't involve ephemeral keys */ +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED +#endif + +/* Key exchanges that involve ephemeral keys */ +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED +#endif + +/* Key exchanges using a PSK */ +#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED +#endif + +/* Key exchanges using DHE */ +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED +#endif + +/* Key exchanges using ECDHE */ +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED +#endif + +typedef struct mbedtls_ssl_ciphersuite_t mbedtls_ssl_ciphersuite_t; + +#define MBEDTLS_CIPHERSUITE_WEAK 0x01 /**< Weak ciphersuite flag */ +#define MBEDTLS_CIPHERSUITE_SHORT_TAG 0x02 /**< Short authentication tag, + eg for CCM_8 */ +#define MBEDTLS_CIPHERSUITE_NODTLS 0x04 /**< Can't be used with DTLS */ + +/** + * \brief This structure is used for storing ciphersuite information + */ +struct mbedtls_ssl_ciphersuite_t +{ + int id; + const char * name; + + mbedtls_cipher_type_t cipher; + mbedtls_md_type_t mac; + mbedtls_key_exchange_type_t key_exchange; + + int min_major_ver; + int min_minor_ver; + int max_major_ver; + int max_minor_ver; + + unsigned char flags; +}; + +const int *mbedtls_ssl_list_ciphersuites( void ); + +const mbedtls_ssl_ciphersuite_t *mbedtls_ssl_ciphersuite_from_string( const char *ciphersuite_name ); +const mbedtls_ssl_ciphersuite_t *mbedtls_ssl_ciphersuite_from_id( int ciphersuite_id ); + +#if defined(MBEDTLS_PK_C) +mbedtls_pk_type_t mbedtls_ssl_get_ciphersuite_sig_pk_alg( const mbedtls_ssl_ciphersuite_t *info ); +mbedtls_pk_type_t mbedtls_ssl_get_ciphersuite_sig_alg( const mbedtls_ssl_ciphersuite_t *info ); +#endif + +int mbedtls_ssl_ciphersuite_uses_ec( const mbedtls_ssl_ciphersuite_t *info ); +int mbedtls_ssl_ciphersuite_uses_psk( const mbedtls_ssl_ciphersuite_t *info ); + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED) +static inline int mbedtls_ssl_ciphersuite_has_pfs( const mbedtls_ssl_ciphersuite_t *info ) +{ + switch( info->key_exchange ) + { + case MBEDTLS_KEY_EXCHANGE_DHE_RSA: + case MBEDTLS_KEY_EXCHANGE_DHE_PSK: + case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: + case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: + case MBEDTLS_KEY_EXCHANGE_ECJPAKE: + return( 1 ); + + default: + return( 0 ); + } +} +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED */ + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED) +static inline int mbedtls_ssl_ciphersuite_no_pfs( const mbedtls_ssl_ciphersuite_t *info ) +{ + switch( info->key_exchange ) + { + case MBEDTLS_KEY_EXCHANGE_ECDH_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: + case MBEDTLS_KEY_EXCHANGE_RSA: + case MBEDTLS_KEY_EXCHANGE_PSK: + case MBEDTLS_KEY_EXCHANGE_RSA_PSK: + return( 1 ); + + default: + return( 0 ); + } +} +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */ + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) +static inline int mbedtls_ssl_ciphersuite_uses_ecdh( const mbedtls_ssl_ciphersuite_t *info ) +{ + switch( info->key_exchange ) + { + case MBEDTLS_KEY_EXCHANGE_ECDH_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: + return( 1 ); + + default: + return( 0 ); + } +} +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED */ + +static inline int mbedtls_ssl_ciphersuite_cert_req_allowed( const mbedtls_ssl_ciphersuite_t *info ) +{ + switch( info->key_exchange ) + { + case MBEDTLS_KEY_EXCHANGE_RSA: + case MBEDTLS_KEY_EXCHANGE_DHE_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDH_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: + return( 1 ); + + default: + return( 0 ); + } +} + +static inline int mbedtls_ssl_ciphersuite_uses_srv_cert( const mbedtls_ssl_ciphersuite_t *info ) +{ + switch( info->key_exchange ) + { + case MBEDTLS_KEY_EXCHANGE_RSA: + case MBEDTLS_KEY_EXCHANGE_RSA_PSK: + case MBEDTLS_KEY_EXCHANGE_DHE_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDH_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: + return( 1 ); + + default: + return( 0 ); + } +} + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED) +static inline int mbedtls_ssl_ciphersuite_uses_dhe( const mbedtls_ssl_ciphersuite_t *info ) +{ + switch( info->key_exchange ) + { + case MBEDTLS_KEY_EXCHANGE_DHE_RSA: + case MBEDTLS_KEY_EXCHANGE_DHE_PSK: + return( 1 ); + + default: + return( 0 ); + } +} +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED) */ + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) +static inline int mbedtls_ssl_ciphersuite_uses_ecdhe( const mbedtls_ssl_ciphersuite_t *info ) +{ + switch( info->key_exchange ) + { + case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: + return( 1 ); + + default: + return( 0 ); + } +} +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) */ + +#if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) +static inline int mbedtls_ssl_ciphersuite_uses_server_signature( const mbedtls_ssl_ciphersuite_t *info ) +{ + switch( info->key_exchange ) + { + case MBEDTLS_KEY_EXCHANGE_DHE_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: + return( 1 ); + + default: + return( 0 ); + } +} +#endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ + +#ifdef __cplusplus +} +#endif + +#endif /* ssl_ciphersuites.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/ssl_cookie.h b/openharmony/arm64-v8a/include/mbedtls/ssl_cookie.h new file mode 100644 index 00000000..2aa37317 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/ssl_cookie.h @@ -0,0 +1,113 @@ +/** + * \file ssl_cookie.h + * + * \brief DTLS cookie callbacks implementation + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SSL_COOKIE_H +#define MBEDTLS_SSL_COOKIE_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/ssl.h" + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h or define them on the compiler command line. + * \{ + */ +#ifndef MBEDTLS_SSL_COOKIE_TIMEOUT +#define MBEDTLS_SSL_COOKIE_TIMEOUT 60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */ +#endif + +/** \} name SECTION: Module settings */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Context for the default cookie functions. + */ +typedef struct mbedtls_ssl_cookie_ctx +{ + mbedtls_md_context_t hmac_ctx; /*!< context for the HMAC portion */ +#if !defined(MBEDTLS_HAVE_TIME) + unsigned long serial; /*!< serial number for expiration */ +#endif + unsigned long timeout; /*!< timeout delay, in seconds if HAVE_TIME, + or in number of tickets issued */ + +#if defined(MBEDTLS_THREADING_C) + mbedtls_threading_mutex_t mutex; +#endif +} mbedtls_ssl_cookie_ctx; + +/** + * \brief Initialize cookie context + */ +void mbedtls_ssl_cookie_init( mbedtls_ssl_cookie_ctx *ctx ); + +/** + * \brief Setup cookie context (generate keys) + */ +int mbedtls_ssl_cookie_setup( mbedtls_ssl_cookie_ctx *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief Set expiration delay for cookies + * (Default MBEDTLS_SSL_COOKIE_TIMEOUT) + * + * \param ctx Cookie context + * \param delay Delay, in seconds if HAVE_TIME, or in number of cookies + * issued in the meantime. + * 0 to disable expiration (NOT recommended) + */ +void mbedtls_ssl_cookie_set_timeout( mbedtls_ssl_cookie_ctx *ctx, unsigned long delay ); + +/** + * \brief Free cookie context + */ +void mbedtls_ssl_cookie_free( mbedtls_ssl_cookie_ctx *ctx ); + +/** + * \brief Generate cookie, see \c mbedtls_ssl_cookie_write_t + */ +mbedtls_ssl_cookie_write_t mbedtls_ssl_cookie_write; + +/** + * \brief Verify cookie, see \c mbedtls_ssl_cookie_write_t + */ +mbedtls_ssl_cookie_check_t mbedtls_ssl_cookie_check; + +#ifdef __cplusplus +} +#endif + +#endif /* ssl_cookie.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/ssl_internal.h b/openharmony/arm64-v8a/include/mbedtls/ssl_internal.h new file mode 100644 index 00000000..46ade67b --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/ssl_internal.h @@ -0,0 +1,1352 @@ +/** + * \file ssl_internal.h + * + * \brief Internal functions shared by the SSL modules + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SSL_INTERNAL_H +#define MBEDTLS_SSL_INTERNAL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/ssl.h" +#include "mbedtls/cipher.h" + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#include "psa/crypto.h" +#endif + +#if defined(MBEDTLS_MD5_C) +#include "mbedtls/md5.h" +#endif + +#if defined(MBEDTLS_SHA1_C) +#include "mbedtls/sha1.h" +#endif + +#if defined(MBEDTLS_SHA256_C) +#include "mbedtls/sha256.h" +#endif + +#if defined(MBEDTLS_SHA512_C) +#include "mbedtls/sha512.h" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) +#include "mbedtls/ecjpake.h" +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#include "psa/crypto.h" +#include "mbedtls/psa_util.h" +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \ + !defined(inline) && !defined(__cplusplus) +#define inline __inline +#endif + +/* Determine minimum supported version */ +#define MBEDTLS_SSL_MIN_MAJOR_VERSION MBEDTLS_SSL_MAJOR_VERSION_3 + +#if defined(MBEDTLS_SSL_PROTO_SSL3) +#define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_0 +#else +#if defined(MBEDTLS_SSL_PROTO_TLS1) +#define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_1 +#else +#if defined(MBEDTLS_SSL_PROTO_TLS1_1) +#define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_2 +#else +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) +#define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_3 +#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ +#endif /* MBEDTLS_SSL_PROTO_TLS1_1 */ +#endif /* MBEDTLS_SSL_PROTO_TLS1 */ +#endif /* MBEDTLS_SSL_PROTO_SSL3 */ + +#define MBEDTLS_SSL_MIN_VALID_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_1 +#define MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION MBEDTLS_SSL_MAJOR_VERSION_3 + +/* Determine maximum supported version */ +#define MBEDTLS_SSL_MAX_MAJOR_VERSION MBEDTLS_SSL_MAJOR_VERSION_3 + +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) +#define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_3 +#else +#if defined(MBEDTLS_SSL_PROTO_TLS1_1) +#define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_2 +#else +#if defined(MBEDTLS_SSL_PROTO_TLS1) +#define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_1 +#else +#if defined(MBEDTLS_SSL_PROTO_SSL3) +#define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_0 +#endif /* MBEDTLS_SSL_PROTO_SSL3 */ +#endif /* MBEDTLS_SSL_PROTO_TLS1 */ +#endif /* MBEDTLS_SSL_PROTO_TLS1_1 */ +#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ + +/* Shorthand for restartable ECC */ +#if defined(MBEDTLS_ECP_RESTARTABLE) && \ + defined(MBEDTLS_SSL_CLI_C) && \ + defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) +#define MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED +#endif + +#define MBEDTLS_SSL_INITIAL_HANDSHAKE 0 +#define MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS 1 /* In progress */ +#define MBEDTLS_SSL_RENEGOTIATION_DONE 2 /* Done or aborted */ +#define MBEDTLS_SSL_RENEGOTIATION_PENDING 3 /* Requested (server only) */ + +/* + * DTLS retransmission states, see RFC 6347 4.2.4 + * + * The SENDING state is merged in PREPARING for initial sends, + * but is distinct for resends. + * + * Note: initial state is wrong for server, but is not used anyway. + */ +#define MBEDTLS_SSL_RETRANS_PREPARING 0 +#define MBEDTLS_SSL_RETRANS_SENDING 1 +#define MBEDTLS_SSL_RETRANS_WAITING 2 +#define MBEDTLS_SSL_RETRANS_FINISHED 3 + +/* + * Allow extra bytes for record, authentication and encryption overhead: + * counter (8) + header (5) + IV(16) + MAC (16-48) + padding (0-256) + * and allow for a maximum of 1024 of compression expansion if + * enabled. + */ +#if defined(MBEDTLS_ZLIB_SUPPORT) +#define MBEDTLS_SSL_COMPRESSION_ADD 1024 +#else +#define MBEDTLS_SSL_COMPRESSION_ADD 0 +#endif + +/* This macro determines whether CBC is supported. */ +#if defined(MBEDTLS_CIPHER_MODE_CBC) && \ + ( defined(MBEDTLS_AES_C) || \ + defined(MBEDTLS_CAMELLIA_C) || \ + defined(MBEDTLS_ARIA_C) || \ + defined(MBEDTLS_DES_C) ) +#define MBEDTLS_SSL_SOME_SUITES_USE_CBC +#endif + +/* This macro determines whether the CBC construct used in TLS 1.0-1.2 (as + * opposed to the very different CBC construct used in SSLv3) is supported. */ +#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC) && \ + ( defined(MBEDTLS_SSL_PROTO_TLS1) || \ + defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ + defined(MBEDTLS_SSL_PROTO_TLS1_2) ) +#define MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC +#endif + +#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER) || \ + defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC) +#define MBEDTLS_SSL_SOME_MODES_USE_MAC +#endif + +#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) +/* Ciphersuites using HMAC */ +#if defined(MBEDTLS_SHA512_C) +#define MBEDTLS_SSL_MAC_ADD 48 /* SHA-384 used for HMAC */ +#elif defined(MBEDTLS_SHA256_C) +#define MBEDTLS_SSL_MAC_ADD 32 /* SHA-256 used for HMAC */ +#else +#define MBEDTLS_SSL_MAC_ADD 20 /* SHA-1 used for HMAC */ +#endif +#else /* MBEDTLS_SSL_SOME_MODES_USE_MAC */ +/* AEAD ciphersuites: GCM and CCM use a 128 bits tag */ +#define MBEDTLS_SSL_MAC_ADD 16 +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +#define MBEDTLS_SSL_PADDING_ADD 256 +#else +#define MBEDTLS_SSL_PADDING_ADD 0 +#endif + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) +#define MBEDTLS_SSL_MAX_CID_EXPANSION MBEDTLS_SSL_CID_PADDING_GRANULARITY +#else +#define MBEDTLS_SSL_MAX_CID_EXPANSION 0 +#endif + +#define MBEDTLS_SSL_PAYLOAD_OVERHEAD ( MBEDTLS_SSL_COMPRESSION_ADD + \ + MBEDTLS_MAX_IV_LENGTH + \ + MBEDTLS_SSL_MAC_ADD + \ + MBEDTLS_SSL_PADDING_ADD + \ + MBEDTLS_SSL_MAX_CID_EXPANSION \ + ) + +#define MBEDTLS_SSL_IN_PAYLOAD_LEN ( MBEDTLS_SSL_PAYLOAD_OVERHEAD + \ + ( MBEDTLS_SSL_IN_CONTENT_LEN ) ) + +#define MBEDTLS_SSL_OUT_PAYLOAD_LEN ( MBEDTLS_SSL_PAYLOAD_OVERHEAD + \ + ( MBEDTLS_SSL_OUT_CONTENT_LEN ) ) + +/* The maximum number of buffered handshake messages. */ +#define MBEDTLS_SSL_MAX_BUFFERED_HS 4 + +/* Maximum length we can advertise as our max content length for + RFC 6066 max_fragment_length extension negotiation purposes + (the lesser of both sizes, if they are unequal.) + */ +#define MBEDTLS_TLS_EXT_ADV_CONTENT_LEN ( \ + (MBEDTLS_SSL_IN_CONTENT_LEN > MBEDTLS_SSL_OUT_CONTENT_LEN) \ + ? ( MBEDTLS_SSL_OUT_CONTENT_LEN ) \ + : ( MBEDTLS_SSL_IN_CONTENT_LEN ) \ + ) + +/* Maximum size in bytes of list in sig-hash algorithm ext., RFC 5246 */ +#define MBEDTLS_SSL_MAX_SIG_HASH_ALG_LIST_LEN 65534 + +/* Maximum size in bytes of list in supported elliptic curve ext., RFC 4492 */ +#define MBEDTLS_SSL_MAX_CURVE_LIST_LEN 65535 + +/* + * Check that we obey the standard's message size bounds + */ + +#if MBEDTLS_SSL_MAX_CONTENT_LEN > 16384 +#error "Bad configuration - record content too large." +#endif + +#if MBEDTLS_SSL_IN_CONTENT_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN +#error "Bad configuration - incoming record content should not be larger than MBEDTLS_SSL_MAX_CONTENT_LEN." +#endif + +#if MBEDTLS_SSL_OUT_CONTENT_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN +#error "Bad configuration - outgoing record content should not be larger than MBEDTLS_SSL_MAX_CONTENT_LEN." +#endif + +#if MBEDTLS_SSL_IN_PAYLOAD_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN + 2048 +#error "Bad configuration - incoming protected record payload too large." +#endif + +#if MBEDTLS_SSL_OUT_PAYLOAD_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN + 2048 +#error "Bad configuration - outgoing protected record payload too large." +#endif + +/* Calculate buffer sizes */ + +/* Note: Even though the TLS record header is only 5 bytes + long, we're internally using 8 bytes to store the + implicit sequence number. */ +#define MBEDTLS_SSL_HEADER_LEN 13 + +#if !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) +#define MBEDTLS_SSL_IN_BUFFER_LEN \ + ( ( MBEDTLS_SSL_HEADER_LEN ) + ( MBEDTLS_SSL_IN_PAYLOAD_LEN ) ) +#else +#define MBEDTLS_SSL_IN_BUFFER_LEN \ + ( ( MBEDTLS_SSL_HEADER_LEN ) + ( MBEDTLS_SSL_IN_PAYLOAD_LEN ) \ + + ( MBEDTLS_SSL_CID_IN_LEN_MAX ) ) +#endif + +#if !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) +#define MBEDTLS_SSL_OUT_BUFFER_LEN \ + ( ( MBEDTLS_SSL_HEADER_LEN ) + ( MBEDTLS_SSL_OUT_PAYLOAD_LEN ) ) +#else +#define MBEDTLS_SSL_OUT_BUFFER_LEN \ + ( ( MBEDTLS_SSL_HEADER_LEN ) + ( MBEDTLS_SSL_OUT_PAYLOAD_LEN ) \ + + ( MBEDTLS_SSL_CID_OUT_LEN_MAX ) ) +#endif + +#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) +static inline size_t mbedtls_ssl_get_output_buflen( const mbedtls_ssl_context *ctx ) +{ +#if defined (MBEDTLS_SSL_DTLS_CONNECTION_ID) + return mbedtls_ssl_get_output_max_frag_len( ctx ) + + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD + + MBEDTLS_SSL_CID_OUT_LEN_MAX; +#else + return mbedtls_ssl_get_output_max_frag_len( ctx ) + + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD; +#endif +} + +static inline size_t mbedtls_ssl_get_input_buflen( const mbedtls_ssl_context *ctx ) +{ +#if defined (MBEDTLS_SSL_DTLS_CONNECTION_ID) + return mbedtls_ssl_get_input_max_frag_len( ctx ) + + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD + + MBEDTLS_SSL_CID_IN_LEN_MAX; +#else + return mbedtls_ssl_get_input_max_frag_len( ctx ) + + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD; +#endif +} +#endif + +#ifdef MBEDTLS_ZLIB_SUPPORT +/* Compression buffer holds both IN and OUT buffers, so should be size of the larger */ +#define MBEDTLS_SSL_COMPRESS_BUFFER_LEN ( \ + ( MBEDTLS_SSL_IN_BUFFER_LEN > MBEDTLS_SSL_OUT_BUFFER_LEN ) \ + ? MBEDTLS_SSL_IN_BUFFER_LEN \ + : MBEDTLS_SSL_OUT_BUFFER_LEN \ + ) +#endif + +/* + * TLS extension flags (for extensions with outgoing ServerHello content + * that need it (e.g. for RENEGOTIATION_INFO the server already knows because + * of state of the renegotiation flag, so no indicator is required) + */ +#define MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT (1 << 0) +#define MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK (1 << 1) + +/** + * \brief This function checks if the remaining size in a buffer is + * greater or equal than a needed space. + * + * \param cur Pointer to the current position in the buffer. + * \param end Pointer to one past the end of the buffer. + * \param need Needed space in bytes. + * + * \return Zero if the needed space is available in the buffer, non-zero + * otherwise. + */ +static inline int mbedtls_ssl_chk_buf_ptr( const uint8_t *cur, + const uint8_t *end, size_t need ) +{ + return( ( cur > end ) || ( need > (size_t)( end - cur ) ) ); +} + +/** + * \brief This macro checks if the remaining size in a buffer is + * greater or equal than a needed space. If it is not the case, + * it returns an SSL_BUFFER_TOO_SMALL error. + * + * \param cur Pointer to the current position in the buffer. + * \param end Pointer to one past the end of the buffer. + * \param need Needed space in bytes. + * + */ +#define MBEDTLS_SSL_CHK_BUF_PTR( cur, end, need ) \ + do { \ + if( mbedtls_ssl_chk_buf_ptr( ( cur ), ( end ), ( need ) ) != 0 ) \ + { \ + return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); \ + } \ + } while( 0 ) + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ + defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) +/* + * Abstraction for a grid of allowed signature-hash-algorithm pairs. + */ +struct mbedtls_ssl_sig_hash_set_t +{ + /* At the moment, we only need to remember a single suitable + * hash algorithm per signature algorithm. As long as that's + * the case - and we don't need a general lookup function - + * we can implement the sig-hash-set as a map from signatures + * to hash algorithms. */ + mbedtls_md_type_t rsa; + mbedtls_md_type_t ecdsa; +}; +#endif /* MBEDTLS_SSL_PROTO_TLS1_2 && + MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ + +typedef int mbedtls_ssl_tls_prf_cb( const unsigned char *secret, size_t slen, + const char *label, + const unsigned char *random, size_t rlen, + unsigned char *dstbuf, size_t dlen ); + +/* cipher.h exports the maximum IV, key and block length from + * all ciphers enabled in the config, regardless of whether those + * ciphers are actually usable in SSL/TLS. Notably, XTS is enabled + * in the default configuration and uses 64 Byte keys, but it is + * not used for record protection in SSL/TLS. + * + * In order to prevent unnecessary inflation of key structures, + * we introduce SSL-specific variants of the max-{key,block,IV} + * macros here which are meant to only take those ciphers into + * account which can be negotiated in SSL/TLS. + * + * Since the current definitions of MBEDTLS_MAX_{KEY|BLOCK|IV}_LENGTH + * in cipher.h are rough overapproximations of the real maxima, here + * we content ourselves with replicating those overapproximations + * for the maximum block and IV length, and excluding XTS from the + * computation of the maximum key length. */ +#define MBEDTLS_SSL_MAX_BLOCK_LENGTH 16 +#define MBEDTLS_SSL_MAX_IV_LENGTH 16 +#define MBEDTLS_SSL_MAX_KEY_LENGTH 32 + +/** + * \brief The data structure holding the cryptographic material (key and IV) + * used for record protection in TLS 1.3. + */ +struct mbedtls_ssl_key_set +{ + /*! The key for client->server records. */ + unsigned char client_write_key[ MBEDTLS_SSL_MAX_KEY_LENGTH ]; + /*! The key for server->client records. */ + unsigned char server_write_key[ MBEDTLS_SSL_MAX_KEY_LENGTH ]; + /*! The IV for client->server records. */ + unsigned char client_write_iv[ MBEDTLS_SSL_MAX_IV_LENGTH ]; + /*! The IV for server->client records. */ + unsigned char server_write_iv[ MBEDTLS_SSL_MAX_IV_LENGTH ]; + + size_t key_len; /*!< The length of client_write_key and + * server_write_key, in Bytes. */ + size_t iv_len; /*!< The length of client_write_iv and + * server_write_iv, in Bytes. */ +}; +typedef struct mbedtls_ssl_key_set mbedtls_ssl_key_set; + +/* + * This structure contains the parameters only needed during handshake. + */ +struct mbedtls_ssl_handshake_params +{ + /* + * Handshake specific crypto variables + */ + + uint8_t max_major_ver; /*!< max. major version client*/ + uint8_t max_minor_ver; /*!< max. minor version client*/ + uint8_t resume; /*!< session resume indicator*/ + uint8_t cli_exts; /*!< client extension presence*/ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) && \ + defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) + uint8_t sni_authmode; /*!< authmode from SNI callback */ +#endif + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) + uint8_t new_session_ticket; /*!< use NewSessionTicket? */ +#endif /* MBEDTLS_SSL_SESSION_TICKETS */ + +#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) + uint8_t extended_ms; /*!< use Extended Master Secret? */ +#endif + +#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) + uint8_t async_in_progress; /*!< an asynchronous operation is in progress */ +#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + unsigned char retransmit_state; /*!< Retransmission state */ +#endif + +#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) + uint8_t ecrs_enabled; /*!< Handshake supports EC restart? */ + enum { /* this complements ssl->state with info on intra-state operations */ + ssl_ecrs_none = 0, /*!< nothing going on (yet) */ + ssl_ecrs_crt_verify, /*!< Certificate: crt_verify() */ + ssl_ecrs_ske_start_processing, /*!< ServerKeyExchange: pk_verify() */ + ssl_ecrs_cke_ecdh_calc_secret, /*!< ClientKeyExchange: ECDH step 2 */ + ssl_ecrs_crt_vrfy_sign, /*!< CertificateVerify: pk_sign() */ + } ecrs_state; /*!< current (or last) operation */ + mbedtls_x509_crt *ecrs_peer_cert; /*!< The peer's CRT chain. */ + size_t ecrs_n; /*!< place for saving a length */ +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ + defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) + mbedtls_ssl_sig_hash_set_t hash_algs; /*!< Set of suitable sig-hash pairs */ +#endif + + size_t pmslen; /*!< premaster length */ + + mbedtls_ssl_ciphersuite_t const *ciphersuite_info; + + void (*update_checksum)(mbedtls_ssl_context *, const unsigned char *, size_t); + void (*calc_verify)(const mbedtls_ssl_context *, unsigned char *, size_t *); + void (*calc_finished)(mbedtls_ssl_context *, unsigned char *, int); + mbedtls_ssl_tls_prf_cb *tls_prf; + +#if defined(MBEDTLS_DHM_C) + mbedtls_dhm_context dhm_ctx; /*!< DHM key exchange */ +#endif + +/* Adding guard for MBEDTLS_ECDSA_C to ensure no compile errors due + * to guards also being in ssl_srv.c and ssl_cli.c. There is a gap + * in functionality that access to ecdh_ctx structure is needed for + * MBEDTLS_ECDSA_C which does not seem correct. + */ +#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) + mbedtls_ecdh_context ecdh_ctx; /*!< ECDH key exchange */ + +#if defined(MBEDTLS_USE_PSA_CRYPTO) + psa_key_type_t ecdh_psa_type; + uint16_t ecdh_bits; + psa_key_id_t ecdh_psa_privkey; + unsigned char ecdh_psa_peerkey[MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH]; + size_t ecdh_psa_peerkey_len; +#endif /* MBEDTLS_USE_PSA_CRYPTO */ +#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */ + +#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) + mbedtls_ecjpake_context ecjpake_ctx; /*!< EC J-PAKE key exchange */ +#if defined(MBEDTLS_SSL_CLI_C) + unsigned char *ecjpake_cache; /*!< Cache for ClientHello ext */ + size_t ecjpake_cache_len; /*!< Length of cached data */ +#endif +#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ + +#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) + const mbedtls_ecp_curve_info **curves; /*!< Supported elliptic curves */ +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) +#if defined(MBEDTLS_USE_PSA_CRYPTO) + psa_key_id_t psk_opaque; /*!< Opaque PSK from the callback */ +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + unsigned char *psk; /*!< PSK from the callback */ + size_t psk_len; /*!< Length of PSK from callback */ +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) + mbedtls_ssl_key_cert *key_cert; /*!< chosen key/cert pair (server) */ +#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) + mbedtls_ssl_key_cert *sni_key_cert; /*!< key/cert list from SNI */ + mbedtls_x509_crt *sni_ca_chain; /*!< trusted CAs from SNI callback */ + mbedtls_x509_crl *sni_ca_crl; /*!< trusted CAs CRLs from SNI */ +#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) + mbedtls_x509_crt_restart_ctx ecrs_ctx; /*!< restart context */ +#endif + +#if defined(MBEDTLS_X509_CRT_PARSE_C) && \ + !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) + mbedtls_pk_context peer_pubkey; /*!< The public key from the peer. */ +#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + struct + { + size_t total_bytes_buffered; /*!< Cumulative size of heap allocated + * buffers used for message buffering. */ + + uint8_t seen_ccs; /*!< Indicates if a CCS message has + * been seen in the current flight. */ + + struct mbedtls_ssl_hs_buffer + { + unsigned is_valid : 1; + unsigned is_fragmented : 1; + unsigned is_complete : 1; + unsigned char *data; + size_t data_len; + } hs[MBEDTLS_SSL_MAX_BUFFERED_HS]; + + struct + { + unsigned char *data; + size_t len; + unsigned epoch; + } future_record; + + } buffering; + + unsigned int out_msg_seq; /*!< Outgoing handshake sequence number */ + unsigned int in_msg_seq; /*!< Incoming handshake sequence number */ + + unsigned char *verify_cookie; /*!< Cli: HelloVerifyRequest cookie + Srv: unused */ + unsigned char verify_cookie_len; /*!< Cli: cookie length + Srv: flag for sending a cookie */ + + uint32_t retransmit_timeout; /*!< Current value of timeout */ + mbedtls_ssl_flight_item *flight; /*!< Current outgoing flight */ + mbedtls_ssl_flight_item *cur_msg; /*!< Current message in flight */ + unsigned char *cur_msg_p; /*!< Position in current message */ + unsigned int in_flight_start_seq; /*!< Minimum message sequence in the + flight being received */ + mbedtls_ssl_transform *alt_transform_out; /*!< Alternative transform for + resending messages */ + unsigned char alt_out_ctr[8]; /*!< Alternative record epoch/counter + for resending messages */ + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + /* The state of CID configuration in this handshake. */ + + uint8_t cid_in_use; /*!< This indicates whether the use of the CID extension + * has been negotiated. Possible values are + * #MBEDTLS_SSL_CID_ENABLED and + * #MBEDTLS_SSL_CID_DISABLED. */ + unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ]; /*! The peer's CID */ + uint8_t peer_cid_len; /*!< The length of + * \c peer_cid. */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + + uint16_t mtu; /*!< Handshake mtu, used to fragment outgoing messages */ +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + + /* + * Checksum contexts + */ +#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ + defined(MBEDTLS_SSL_PROTO_TLS1_1) + mbedtls_md5_context fin_md5; + mbedtls_sha1_context fin_sha1; +#endif +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) +#if defined(MBEDTLS_SHA256_C) +#if defined(MBEDTLS_USE_PSA_CRYPTO) + psa_hash_operation_t fin_sha256_psa; +#else + mbedtls_sha256_context fin_sha256; +#endif +#endif +#if defined(MBEDTLS_SHA512_C) +#if defined(MBEDTLS_USE_PSA_CRYPTO) + psa_hash_operation_t fin_sha384_psa; +#else + mbedtls_sha512_context fin_sha512; +#endif +#endif +#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ + + unsigned char randbytes[64]; /*!< random bytes */ + unsigned char premaster[MBEDTLS_PREMASTER_SIZE]; + /*!< premaster secret */ + +#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) + /** Asynchronous operation context. This field is meant for use by the + * asynchronous operation callbacks (mbedtls_ssl_config::f_async_sign_start, + * mbedtls_ssl_config::f_async_decrypt_start, + * mbedtls_ssl_config::f_async_resume, mbedtls_ssl_config::f_async_cancel). + * The library does not use it internally. */ + void *user_async_ctx; +#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ +}; + +typedef struct mbedtls_ssl_hs_buffer mbedtls_ssl_hs_buffer; + +/* + * Representation of decryption/encryption transformations on records + * + * There are the following general types of record transformations: + * - Stream transformations (TLS versions <= 1.2 only) + * Transformation adding a MAC and applying a stream-cipher + * to the authenticated message. + * - CBC block cipher transformations ([D]TLS versions <= 1.2 only) + * In addition to the distinction of the order of encryption and + * authentication, there's a fundamental difference between the + * handling in SSL3 & TLS 1.0 and TLS 1.1 and TLS 1.2: For SSL3 + * and TLS 1.0, the final IV after processing a record is used + * as the IV for the next record. No explicit IV is contained + * in an encrypted record. The IV for the first record is extracted + * at key extraction time. In contrast, for TLS 1.1 and 1.2, no + * IV is generated at key extraction time, but every encrypted + * record is explicitly prefixed by the IV with which it was encrypted. + * - AEAD transformations ([D]TLS versions >= 1.2 only) + * These come in two fundamentally different versions, the first one + * used in TLS 1.2, excluding ChaChaPoly ciphersuites, and the second + * one used for ChaChaPoly ciphersuites in TLS 1.2 as well as for TLS 1.3. + * In the first transformation, the IV to be used for a record is obtained + * as the concatenation of an explicit, static 4-byte IV and the 8-byte + * record sequence number, and explicitly prepending this sequence number + * to the encrypted record. In contrast, in the second transformation + * the IV is obtained by XOR'ing a static IV obtained at key extraction + * time with the 8-byte record sequence number, without prepending the + * latter to the encrypted record. + * + * Additionally, DTLS 1.2 + CID as well as TLS 1.3 use an inner plaintext + * which allows to add flexible length padding and to hide a record's true + * content type. + * + * In addition to type and version, the following parameters are relevant: + * - The symmetric cipher algorithm to be used. + * - The (static) encryption/decryption keys for the cipher. + * - For stream/CBC, the type of message digest to be used. + * - For stream/CBC, (static) encryption/decryption keys for the digest. + * - For AEAD transformations, the size (potentially 0) of an explicit, + * random initialization vector placed in encrypted records. + * - For some transformations (currently AEAD and CBC in SSL3 and TLS 1.0) + * an implicit IV. It may be static (e.g. AEAD) or dynamic (e.g. CBC) + * and (if present) is combined with the explicit IV in a transformation- + * dependent way (e.g. appending in TLS 1.2 and XOR'ing in TLS 1.3). + * - For stream/CBC, a flag determining the order of encryption and MAC. + * - The details of the transformation depend on the SSL/TLS version. + * - The length of the authentication tag. + * + * Note: Except for CBC in SSL3 and TLS 1.0, these parameters are + * constant across multiple encryption/decryption operations. + * For CBC, the implicit IV needs to be updated after each + * operation. + * + * The struct below refines this abstract view as follows: + * - The cipher underlying the transformation is managed in + * cipher contexts cipher_ctx_{enc/dec}, which must have the + * same cipher type. The mode of these cipher contexts determines + * the type of the transformation in the sense above: e.g., if + * the type is MBEDTLS_CIPHER_AES_256_CBC resp. MBEDTLS_CIPHER_AES_192_GCM + * then the transformation has type CBC resp. AEAD. + * - The cipher keys are never stored explicitly but + * are maintained within cipher_ctx_{enc/dec}. + * - For stream/CBC transformations, the message digest contexts + * used for the MAC's are stored in md_ctx_{enc/dec}. These contexts + * are unused for AEAD transformations. + * - For stream/CBC transformations and versions > SSL3, the + * MAC keys are not stored explicitly but maintained within + * md_ctx_{enc/dec}. + * - For stream/CBC transformations and version SSL3, the MAC + * keys are stored explicitly in mac_enc, mac_dec and have + * a fixed size of 20 bytes. These fields are unused for + * AEAD transformations or transformations >= TLS 1.0. + * - For transformations using an implicit IV maintained within + * the transformation context, its contents are stored within + * iv_{enc/dec}. + * - The value of ivlen indicates the length of the IV. + * This is redundant in case of stream/CBC transformations + * which always use 0 resp. the cipher's block length as the + * IV length, but is needed for AEAD ciphers and may be + * different from the underlying cipher's block length + * in this case. + * - The field fixed_ivlen is nonzero for AEAD transformations only + * and indicates the length of the static part of the IV which is + * constant throughout the communication, and which is stored in + * the first fixed_ivlen bytes of the iv_{enc/dec} arrays. + * Note: For CBC in SSL3 and TLS 1.0, the fields iv_{enc/dec} + * still store IV's for continued use across multiple transformations, + * so it is not true that fixed_ivlen == 0 means that iv_{enc/dec} are + * not being used! + * - minor_ver denotes the SSL/TLS version + * - For stream/CBC transformations, maclen denotes the length of the + * authentication tag, while taglen is unused and 0. + * - For AEAD transformations, taglen denotes the length of the + * authentication tag, while maclen is unused and 0. + * - For CBC transformations, encrypt_then_mac determines the + * order of encryption and authentication. This field is unused + * in other transformations. + * + */ +struct mbedtls_ssl_transform +{ + /* + * Session specific crypto layer + */ + size_t minlen; /*!< min. ciphertext length */ + size_t ivlen; /*!< IV length */ + size_t fixed_ivlen; /*!< Fixed part of IV (AEAD) */ + size_t maclen; /*!< MAC(CBC) len */ + size_t taglen; /*!< TAG(AEAD) len */ + + unsigned char iv_enc[16]; /*!< IV (encryption) */ + unsigned char iv_dec[16]; /*!< IV (decryption) */ + +#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) + +#if defined(MBEDTLS_SSL_PROTO_SSL3) + /* Needed only for SSL v3.0 secret */ + unsigned char mac_enc[20]; /*!< SSL v3.0 secret (enc) */ + unsigned char mac_dec[20]; /*!< SSL v3.0 secret (dec) */ +#endif /* MBEDTLS_SSL_PROTO_SSL3 */ + + mbedtls_md_context_t md_ctx_enc; /*!< MAC (encryption) */ + mbedtls_md_context_t md_ctx_dec; /*!< MAC (decryption) */ + +#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) + int encrypt_then_mac; /*!< flag for EtM activation */ +#endif + +#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */ + + mbedtls_cipher_context_t cipher_ctx_enc; /*!< encryption context */ + mbedtls_cipher_context_t cipher_ctx_dec; /*!< decryption context */ + int minor_ver; + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + uint8_t in_cid_len; + uint8_t out_cid_len; + unsigned char in_cid [ MBEDTLS_SSL_CID_OUT_LEN_MAX ]; + unsigned char out_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ]; +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + + /* + * Session specific compression layer + */ +#if defined(MBEDTLS_ZLIB_SUPPORT) + z_stream ctx_deflate; /*!< compression context */ + z_stream ctx_inflate; /*!< decompression context */ +#endif + +#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) + /* We need the Hello random bytes in order to re-derive keys from the + * Master Secret and other session info, see ssl_populate_transform() */ + unsigned char randbytes[64]; /*!< ServerHello.random+ClientHello.random */ +#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */ +}; + +/* + * Return 1 if the transform uses an AEAD cipher, 0 otherwise. + * Equivalently, return 0 if a separate MAC is used, 1 otherwise. + */ +static inline int mbedtls_ssl_transform_uses_aead( + const mbedtls_ssl_transform *transform ) +{ +#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) + return( transform->maclen == 0 && transform->taglen != 0 ); +#else + (void) transform; + return( 1 ); +#endif +} + +/* + * Internal representation of record frames + * + * Instances come in two flavors: + * (1) Encrypted + * These always have data_offset = 0 + * (2) Unencrypted + * These have data_offset set to the amount of + * pre-expansion during record protection. Concretely, + * this is the length of the fixed part of the explicit IV + * used for encryption, or 0 if no explicit IV is used + * (e.g. for CBC in TLS 1.0, or stream ciphers). + * + * The reason for the data_offset in the unencrypted case + * is to allow for in-place conversion of an unencrypted to + * an encrypted record. If the offset wasn't included, the + * encrypted content would need to be shifted afterwards to + * make space for the fixed IV. + * + */ +#if MBEDTLS_SSL_CID_OUT_LEN_MAX > MBEDTLS_SSL_CID_IN_LEN_MAX +#define MBEDTLS_SSL_CID_LEN_MAX MBEDTLS_SSL_CID_OUT_LEN_MAX +#else +#define MBEDTLS_SSL_CID_LEN_MAX MBEDTLS_SSL_CID_IN_LEN_MAX +#endif + +typedef struct +{ + uint8_t ctr[8]; /* In TLS: The implicit record sequence number. + * In DTLS: The 2-byte epoch followed by + * the 6-byte sequence number. + * This is stored as a raw big endian byte array + * as opposed to a uint64_t because we rarely + * need to perform arithmetic on this, but do + * need it as a Byte array for the purpose of + * MAC computations. */ + uint8_t type; /* The record content type. */ + uint8_t ver[2]; /* SSL/TLS version as present on the wire. + * Convert to internal presentation of versions + * using mbedtls_ssl_read_version() and + * mbedtls_ssl_write_version(). + * Keep wire-format for MAC computations. */ + + unsigned char *buf; /* Memory buffer enclosing the record content */ + size_t buf_len; /* Buffer length */ + size_t data_offset; /* Offset of record content */ + size_t data_len; /* Length of record content */ + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + uint8_t cid_len; /* Length of the CID (0 if not present) */ + unsigned char cid[ MBEDTLS_SSL_CID_LEN_MAX ]; /* The CID */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ +} mbedtls_record; + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/* + * List of certificate + private key pairs + */ +struct mbedtls_ssl_key_cert +{ + mbedtls_x509_crt *cert; /*!< cert */ + mbedtls_pk_context *key; /*!< private key */ + mbedtls_ssl_key_cert *next; /*!< next key/cert pair */ +}; +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) +/* + * List of handshake messages kept around for resending + */ +struct mbedtls_ssl_flight_item +{ + unsigned char *p; /*!< message, including handshake headers */ + size_t len; /*!< length of p */ + unsigned char type; /*!< type of the message: handshake or CCS */ + mbedtls_ssl_flight_item *next; /*!< next handshake message(s) */ +}; +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ + defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) + +/* Find an entry in a signature-hash set matching a given hash algorithm. */ +mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set, + mbedtls_pk_type_t sig_alg ); +/* Add a signature-hash-pair to a signature-hash set */ +void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set, + mbedtls_pk_type_t sig_alg, + mbedtls_md_type_t md_alg ); +/* Allow exactly one hash algorithm for each signature. */ +void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set, + mbedtls_md_type_t md_alg ); + +/* Setup an empty signature-hash set */ +static inline void mbedtls_ssl_sig_hash_set_init( mbedtls_ssl_sig_hash_set_t *set ) +{ + mbedtls_ssl_sig_hash_set_const_hash( set, MBEDTLS_MD_NONE ); +} + +#endif /* MBEDTLS_SSL_PROTO_TLS1_2) && + MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ + +/** + * \brief Free referenced items in an SSL transform context and clear + * memory + * + * \param transform SSL transform context + */ +void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform ); + +/** + * \brief Free referenced items in an SSL handshake context and clear + * memory + * + * \param ssl SSL context + */ +void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl ); + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_handshake_client_step( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl ); +void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl ); + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl ); + +void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl ); + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context *ssl ); +void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl ); + +/** + * \brief Update record layer + * + * This function roughly separates the implementation + * of the logic of (D)TLS from the implementation + * of the secure transport. + * + * \param ssl The SSL context to use. + * \param update_hs_digest This indicates if the handshake digest + * should be automatically updated in case + * a handshake message is found. + * + * \return 0 or non-zero error code. + * + * \note A clarification on what is called 'record layer' here + * is in order, as many sensible definitions are possible: + * + * The record layer takes as input an untrusted underlying + * transport (stream or datagram) and transforms it into + * a serially multiplexed, secure transport, which + * conceptually provides the following: + * + * (1) Three datagram based, content-agnostic transports + * for handshake, alert and CCS messages. + * (2) One stream- or datagram-based transport + * for application data. + * (3) Functionality for changing the underlying transform + * securing the contents. + * + * The interface to this functionality is given as follows: + * + * a Updating + * [Currently implemented by mbedtls_ssl_read_record] + * + * Check if and on which of the four 'ports' data is pending: + * Nothing, a controlling datagram of type (1), or application + * data (2). In any case data is present, internal buffers + * provide access to the data for the user to process it. + * Consumption of type (1) datagrams is done automatically + * on the next update, invalidating that the internal buffers + * for previous datagrams, while consumption of application + * data (2) is user-controlled. + * + * b Reading of application data + * [Currently manual adaption of ssl->in_offt pointer] + * + * As mentioned in the last paragraph, consumption of data + * is different from the automatic consumption of control + * datagrams (1) because application data is treated as a stream. + * + * c Tracking availability of application data + * [Currently manually through decreasing ssl->in_msglen] + * + * For efficiency and to retain datagram semantics for + * application data in case of DTLS, the record layer + * provides functionality for checking how much application + * data is still available in the internal buffer. + * + * d Changing the transformation securing the communication. + * + * Given an opaque implementation of the record layer in the + * above sense, it should be possible to implement the logic + * of (D)TLS on top of it without the need to know anything + * about the record layer's internals. This is done e.g. + * in all the handshake handling functions, and in the + * application data reading function mbedtls_ssl_read. + * + * \note The above tries to give a conceptual picture of the + * record layer, but the current implementation deviates + * from it in some places. For example, our implementation of + * the update functionality through mbedtls_ssl_read_record + * discards datagrams depending on the current state, which + * wouldn't fall under the record layer's responsibility + * following the above definition. + * + */ +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl, + unsigned update_hs_digest ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want ); + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_write_handshake_msg( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl, uint8_t force_flush ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl ); + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl ); + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl ); + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl ); + +void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl, + const mbedtls_ssl_ciphersuite_t *ciphersuite_info ); + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex ); + +/** + * Get the first defined PSK by order of precedence: + * 1. handshake PSK set by \c mbedtls_ssl_set_hs_psk() in the PSK callback + * 2. static PSK configured by \c mbedtls_ssl_conf_psk() + * Return a code and update the pair (PSK, PSK length) passed to this function + */ +static inline int mbedtls_ssl_get_psk( const mbedtls_ssl_context *ssl, + const unsigned char **psk, size_t *psk_len ) +{ + if( ssl->handshake->psk != NULL && ssl->handshake->psk_len > 0 ) + { + *psk = ssl->handshake->psk; + *psk_len = ssl->handshake->psk_len; + } + + else if( ssl->conf->psk != NULL && ssl->conf->psk_len > 0 ) + { + *psk = ssl->conf->psk; + *psk_len = ssl->conf->psk_len; + } + + else + { + *psk = NULL; + *psk_len = 0; + return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ); + } + + return( 0 ); +} + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +/** + * Get the first defined opaque PSK by order of precedence: + * 1. handshake PSK set by \c mbedtls_ssl_set_hs_psk_opaque() in the PSK + * callback + * 2. static PSK configured by \c mbedtls_ssl_conf_psk_opaque() + * Return an opaque PSK + */ +static inline psa_key_id_t mbedtls_ssl_get_opaque_psk( + const mbedtls_ssl_context *ssl ) +{ + if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) ) + return( ssl->handshake->psk_opaque ); + + if( ! mbedtls_svc_key_id_is_null( ssl->conf->psk_opaque ) ) + return( ssl->conf->psk_opaque ); + + return( MBEDTLS_SVC_KEY_ID_INIT ); +} +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ + +#if defined(MBEDTLS_PK_C) +unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk ); +unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type ); +mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig ); +#endif + +mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash ); +unsigned char mbedtls_ssl_hash_from_md_alg( int md ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md ); + +#if defined(MBEDTLS_ECP_C) +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_check_curve_tls_id( const mbedtls_ssl_context *ssl, uint16_t tls_id ); +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl, + mbedtls_md_type_t md ); +#endif + +#if defined(MBEDTLS_SSL_DTLS_SRTP) +static inline mbedtls_ssl_srtp_profile mbedtls_ssl_check_srtp_profile_value + ( const uint16_t srtp_profile_value ) +{ + switch( srtp_profile_value ) + { + case MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80: + case MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32: + case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80: + case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32: + return srtp_profile_value; + default: break; + } + return( MBEDTLS_TLS_SRTP_UNSET ); +} +#endif + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +static inline mbedtls_pk_context *mbedtls_ssl_own_key( mbedtls_ssl_context *ssl ) +{ + mbedtls_ssl_key_cert *key_cert; + + if( ssl->handshake != NULL && ssl->handshake->key_cert != NULL ) + key_cert = ssl->handshake->key_cert; + else + key_cert = ssl->conf->key_cert; + + return( key_cert == NULL ? NULL : key_cert->key ); +} + +static inline mbedtls_x509_crt *mbedtls_ssl_own_cert( mbedtls_ssl_context *ssl ) +{ + mbedtls_ssl_key_cert *key_cert; + + if( ssl->handshake != NULL && ssl->handshake->key_cert != NULL ) + key_cert = ssl->handshake->key_cert; + else + key_cert = ssl->conf->key_cert; + + return( key_cert == NULL ? NULL : key_cert->cert ); +} + +/* + * Check usage of a certificate wrt extensions: + * keyUsage, extendedKeyUsage (later), and nSCertType (later). + * + * Warning: cert_endpoint is the endpoint of the cert (ie, of our peer when we + * check a cert we received from them)! + * + * Return 0 if everything is OK, -1 if not. + */ +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert, + const mbedtls_ssl_ciphersuite_t *ciphersuite, + int cert_endpoint, + uint32_t *flags ); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +void mbedtls_ssl_write_version( int major, int minor, int transport, + unsigned char ver[2] ); +void mbedtls_ssl_read_version( int *major, int *minor, int transport, + const unsigned char ver[2] ); + +static inline size_t mbedtls_ssl_in_hdr_len( const mbedtls_ssl_context *ssl ) +{ +#if !defined(MBEDTLS_SSL_PROTO_DTLS) + ((void) ssl); +#endif + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) + { + return( 13 ); + } + else +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + { + return( 5 ); + } +} + +static inline size_t mbedtls_ssl_out_hdr_len( const mbedtls_ssl_context *ssl ) +{ + return( (size_t) ( ssl->out_iv - ssl->out_hdr ) ); +} + +static inline size_t mbedtls_ssl_hs_hdr_len( const mbedtls_ssl_context *ssl ) +{ +#if defined(MBEDTLS_SSL_PROTO_DTLS) + if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) + return( 12 ); +#else + ((void) ssl); +#endif + return( 4 ); +} + +#if defined(MBEDTLS_SSL_PROTO_DTLS) +void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl ); +void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_resend( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_flight_transmit( mbedtls_ssl_context *ssl ); +#endif + +/* Visible for testing purposes only */ +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context const *ssl ); +void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context *ssl ); +#endif + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst, + const mbedtls_ssl_session *src ); + +#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ + defined(MBEDTLS_SSL_PROTO_TLS1_1) +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl, + unsigned char *output, + unsigned char *data, size_t data_len ); +#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \ + MBEDTLS_SSL_PROTO_TLS1_1 */ + +#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ + defined(MBEDTLS_SSL_PROTO_TLS1_2) +/* The hash buffer must have at least MBEDTLS_MD_MAX_SIZE bytes of length. */ +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl, + unsigned char *hash, size_t *hashlen, + unsigned char *data, size_t data_len, + mbedtls_md_type_t md_alg ); +#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \ + MBEDTLS_SSL_PROTO_TLS1_2 */ + +#ifdef __cplusplus +} +#endif + +void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_encrypt_buf( mbedtls_ssl_context *ssl, + mbedtls_ssl_transform *transform, + mbedtls_record *rec, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_decrypt_buf( mbedtls_ssl_context const *ssl, + mbedtls_ssl_transform *transform, + mbedtls_record *rec ); + +/* Length of the "epoch" field in the record header */ +static inline size_t mbedtls_ssl_ep_len( const mbedtls_ssl_context *ssl ) +{ +#if defined(MBEDTLS_SSL_PROTO_DTLS) + if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) + return( 2 ); +#else + ((void) ssl); +#endif + return( 0 ); +} + +#if defined(MBEDTLS_SSL_PROTO_DTLS) +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_resend_hello_request( mbedtls_ssl_context *ssl ); +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + +void mbedtls_ssl_set_timer( mbedtls_ssl_context *ssl, uint32_t millisecs ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_check_timer( mbedtls_ssl_context *ssl ); + +void mbedtls_ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl ); +void mbedtls_ssl_update_out_pointers( mbedtls_ssl_context *ssl, + mbedtls_ssl_transform *transform ); +void mbedtls_ssl_update_in_pointers( mbedtls_ssl_context *ssl ); + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial ); + +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) +void mbedtls_ssl_dtls_replay_reset( mbedtls_ssl_context *ssl ); +#endif + +void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl ); + +#if defined(MBEDTLS_SSL_RENEGOTIATION) +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_start_renegotiation( mbedtls_ssl_context *ssl ); +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) +size_t mbedtls_ssl_get_current_mtu( const mbedtls_ssl_context *ssl ); +void mbedtls_ssl_buffering_free( mbedtls_ssl_context *ssl ); +void mbedtls_ssl_flight_free( mbedtls_ssl_flight_item *flight ); +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + +#if defined(MBEDTLS_TEST_HOOKS) +int mbedtls_ssl_check_dtls_clihlo_cookie( + mbedtls_ssl_context *ssl, + const unsigned char *cli_id, size_t cli_id_len, + const unsigned char *in, size_t in_len, + unsigned char *obuf, size_t buf_len, size_t *olen ); +#endif + +#endif /* ssl_internal.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/ssl_ticket.h b/openharmony/arm64-v8a/include/mbedtls/ssl_ticket.h new file mode 100644 index 00000000..8221051b --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/ssl_ticket.h @@ -0,0 +1,140 @@ +/** + * \file ssl_ticket.h + * + * \brief TLS server ticket callbacks implementation + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SSL_TICKET_H +#define MBEDTLS_SSL_TICKET_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +/* + * This implementation of the session ticket callbacks includes key + * management, rotating the keys periodically in order to preserve forward + * secrecy, when MBEDTLS_HAVE_TIME is defined. + */ + +#include "mbedtls/ssl.h" +#include "mbedtls/cipher.h" + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Information for session ticket protection + */ +typedef struct mbedtls_ssl_ticket_key +{ + unsigned char name[4]; /*!< random key identifier */ + uint32_t generation_time; /*!< key generation timestamp (seconds) */ + mbedtls_cipher_context_t ctx; /*!< context for auth enc/decryption */ +} +mbedtls_ssl_ticket_key; + +/** + * \brief Context for session ticket handling functions + */ +typedef struct mbedtls_ssl_ticket_context +{ + mbedtls_ssl_ticket_key keys[2]; /*!< ticket protection keys */ + unsigned char active; /*!< index of the currently active key */ + + uint32_t ticket_lifetime; /*!< lifetime of tickets in seconds */ + + /** Callback for getting (pseudo-)random numbers */ + int (*f_rng)(void *, unsigned char *, size_t); + void *p_rng; /*!< context for the RNG function */ + +#if defined(MBEDTLS_THREADING_C) + mbedtls_threading_mutex_t mutex; +#endif +} +mbedtls_ssl_ticket_context; + +/** + * \brief Initialize a ticket context. + * (Just make it ready for mbedtls_ssl_ticket_setup() + * or mbedtls_ssl_ticket_free().) + * + * \param ctx Context to be initialized + */ +void mbedtls_ssl_ticket_init( mbedtls_ssl_ticket_context *ctx ); + +/** + * \brief Prepare context to be actually used + * + * \param ctx Context to be set up + * \param f_rng RNG callback function + * \param p_rng RNG callback context + * \param cipher AEAD cipher to use for ticket protection. + * Recommended value: MBEDTLS_CIPHER_AES_256_GCM. + * \param lifetime Tickets lifetime in seconds + * Recommended value: 86400 (one day). + * + * \note It is highly recommended to select a cipher that is at + * least as strong as the strongest ciphersuite + * supported. Usually that means a 256-bit key. + * + * \note The lifetime of the keys is twice the lifetime of tickets. + * It is recommended to pick a reasonable lifetime so as not + * to negate the benefits of forward secrecy. + * + * \return 0 if successful, + * or a specific MBEDTLS_ERR_XXX error code + */ +int mbedtls_ssl_ticket_setup( mbedtls_ssl_ticket_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, + mbedtls_cipher_type_t cipher, + uint32_t lifetime ); + +/** + * \brief Implementation of the ticket write callback + * + * \note See \c mbedtls_ssl_ticket_write_t for description + */ +mbedtls_ssl_ticket_write_t mbedtls_ssl_ticket_write; + +/** + * \brief Implementation of the ticket parse callback + * + * \note See \c mbedtls_ssl_ticket_parse_t for description + */ +mbedtls_ssl_ticket_parse_t mbedtls_ssl_ticket_parse; + +/** + * \brief Free a context's content and zeroize it. + * + * \param ctx Context to be cleaned up + */ +void mbedtls_ssl_ticket_free( mbedtls_ssl_ticket_context *ctx ); + +#ifdef __cplusplus +} +#endif + +#endif /* ssl_ticket.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/threading.h b/openharmony/arm64-v8a/include/mbedtls/threading.h new file mode 100644 index 00000000..d147c73f --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/threading.h @@ -0,0 +1,126 @@ +/** + * \file threading.h + * + * \brief Threading abstraction layer + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_THREADING_H +#define MBEDTLS_THREADING_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/* MBEDTLS_ERR_THREADING_FEATURE_UNAVAILABLE is deprecated and should not be + * used. */ +/** The selected feature is not available. */ +#define MBEDTLS_ERR_THREADING_FEATURE_UNAVAILABLE -0x001A + +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_THREADING_BAD_INPUT_DATA -0x001C +/** Locking / unlocking / free failed with error code. */ +#define MBEDTLS_ERR_THREADING_MUTEX_ERROR -0x001E + +#if defined(MBEDTLS_THREADING_PTHREAD) +#include +typedef struct mbedtls_threading_mutex_t +{ + pthread_mutex_t mutex; + /* is_valid is 0 after a failed init or a free, and nonzero after a + * successful init. This field is not considered part of the public + * API of Mbed TLS and may change without notice. */ + char is_valid; +} mbedtls_threading_mutex_t; +#endif + +#if defined(MBEDTLS_THREADING_ALT) +/* You should define the mbedtls_threading_mutex_t type in your header */ +#include "threading_alt.h" + +/** + * \brief Set your alternate threading implementation function + * pointers and initialize global mutexes. If used, this + * function must be called once in the main thread before any + * other mbed TLS function is called, and + * mbedtls_threading_free_alt() must be called once in the main + * thread after all other mbed TLS functions. + * + * \note mutex_init() and mutex_free() don't return a status code. + * If mutex_init() fails, it should leave its argument (the + * mutex) in a state such that mutex_lock() will fail when + * called with this argument. + * + * \param mutex_init the init function implementation + * \param mutex_free the free function implementation + * \param mutex_lock the lock function implementation + * \param mutex_unlock the unlock function implementation + */ +void mbedtls_threading_set_alt( void (*mutex_init)( mbedtls_threading_mutex_t * ), + void (*mutex_free)( mbedtls_threading_mutex_t * ), + int (*mutex_lock)( mbedtls_threading_mutex_t * ), + int (*mutex_unlock)( mbedtls_threading_mutex_t * ) ); + +/** + * \brief Free global mutexes. + */ +void mbedtls_threading_free_alt( void ); +#endif /* MBEDTLS_THREADING_ALT */ + +#if defined(MBEDTLS_THREADING_C) +/* + * The function pointers for mutex_init, mutex_free, mutex_ and mutex_unlock + * + * All these functions are expected to work or the result will be undefined. + */ +extern void (*mbedtls_mutex_init)( mbedtls_threading_mutex_t *mutex ); +extern void (*mbedtls_mutex_free)( mbedtls_threading_mutex_t *mutex ); +extern int (*mbedtls_mutex_lock)( mbedtls_threading_mutex_t *mutex ); +extern int (*mbedtls_mutex_unlock)( mbedtls_threading_mutex_t *mutex ); + +/* + * Global mutexes + */ +#if defined(MBEDTLS_FS_IO) +extern mbedtls_threading_mutex_t mbedtls_threading_readdir_mutex; +#endif + +#if defined(MBEDTLS_HAVE_TIME_DATE) && !defined(MBEDTLS_PLATFORM_GMTIME_R_ALT) +/* This mutex may or may not be used in the default definition of + * mbedtls_platform_gmtime_r(), but in order to determine that, + * we need to check POSIX features, hence modify _POSIX_C_SOURCE. + * With the current approach, this declaration is orphaned, lacking + * an accompanying definition, in case mbedtls_platform_gmtime_r() + * doesn't need it, but that's not a problem. */ +extern mbedtls_threading_mutex_t mbedtls_threading_gmtime_mutex; +#endif /* MBEDTLS_HAVE_TIME_DATE && !MBEDTLS_PLATFORM_GMTIME_R_ALT */ + +#endif /* MBEDTLS_THREADING_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* threading.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/timing.h b/openharmony/arm64-v8a/include/mbedtls/timing.h new file mode 100644 index 00000000..b7290cfc --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/timing.h @@ -0,0 +1,151 @@ +/** + * \file timing.h + * + * \brief Portable interface to timeouts and to the CPU cycle counter + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_TIMING_H +#define MBEDTLS_TIMING_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_TIMING_ALT) +// Regular implementation +// + +/** + * \brief timer structure + */ +struct mbedtls_timing_hr_time +{ + unsigned char opaque[32]; +}; + +/** + * \brief Context for mbedtls_timing_set/get_delay() + */ +typedef struct mbedtls_timing_delay_context +{ + struct mbedtls_timing_hr_time timer; + uint32_t int_ms; + uint32_t fin_ms; +} mbedtls_timing_delay_context; + +#else /* MBEDTLS_TIMING_ALT */ +#include "timing_alt.h" +#endif /* MBEDTLS_TIMING_ALT */ + +extern volatile int mbedtls_timing_alarmed; + +/** + * \brief Return the CPU cycle counter value + * + * \warning This is only a best effort! Do not rely on this! + * In particular, it is known to be unreliable on virtual + * machines. + * + * \note This value starts at an unspecified origin and + * may wrap around. + */ +unsigned long mbedtls_timing_hardclock( void ); + +/** + * \brief Return the elapsed time in milliseconds + * + * \param val points to a timer structure + * \param reset If 0, query the elapsed time. Otherwise (re)start the timer. + * + * \return Elapsed time since the previous reset in ms. When + * restarting, this is always 0. + * + * \note To initialize a timer, call this function with reset=1. + * + * Determining the elapsed time and resetting the timer is not + * atomic on all platforms, so after the sequence + * `{ get_timer(1); ...; time1 = get_timer(1); ...; time2 = + * get_timer(0) }` the value time1+time2 is only approximately + * the delay since the first reset. + */ +unsigned long mbedtls_timing_get_timer( struct mbedtls_timing_hr_time *val, int reset ); + +/** + * \brief Setup an alarm clock + * + * \param seconds delay before the "mbedtls_timing_alarmed" flag is set + * (must be >=0) + * + * \warning Only one alarm at a time is supported. In a threaded + * context, this means one for the whole process, not one per + * thread. + */ +void mbedtls_set_alarm( int seconds ); + +/** + * \brief Set a pair of delays to watch + * (See \c mbedtls_timing_get_delay().) + * + * \param data Pointer to timing data. + * Must point to a valid \c mbedtls_timing_delay_context struct. + * \param int_ms First (intermediate) delay in milliseconds. + * The effect if int_ms > fin_ms is unspecified. + * \param fin_ms Second (final) delay in milliseconds. + * Pass 0 to cancel the current delay. + * + * \note To set a single delay, either use \c mbedtls_timing_set_timer + * directly or use this function with int_ms == fin_ms. + */ +void mbedtls_timing_set_delay( void *data, uint32_t int_ms, uint32_t fin_ms ); + +/** + * \brief Get the status of delays + * (Memory helper: number of delays passed.) + * + * \param data Pointer to timing data + * Must point to a valid \c mbedtls_timing_delay_context struct. + * + * \return -1 if cancelled (fin_ms = 0), + * 0 if none of the delays are passed, + * 1 if only the intermediate delay is passed, + * 2 if the final delay is passed. + */ +int mbedtls_timing_get_delay( void *data ); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if a test failed + */ +int mbedtls_timing_self_test( int verbose ); +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* timing.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/version.h b/openharmony/arm64-v8a/include/mbedtls/version.h new file mode 100644 index 00000000..44adcbfe --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/version.h @@ -0,0 +1,110 @@ +/** + * \file version.h + * + * \brief Run-time version information + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * This set of compile-time defines and run-time variables can be used to + * determine the version number of the mbed TLS library used. + */ +#ifndef MBEDTLS_VERSION_H +#define MBEDTLS_VERSION_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +/** + * The version number x.y.z is split into three parts. + * Major, Minor, Patchlevel + */ +#define MBEDTLS_VERSION_MAJOR 2 +#define MBEDTLS_VERSION_MINOR 28 +#define MBEDTLS_VERSION_PATCH 1 + +/** + * The single version number has the following structure: + * MMNNPP00 + * Major version | Minor version | Patch version + */ +#define MBEDTLS_VERSION_NUMBER 0x021C0100 +#define MBEDTLS_VERSION_STRING "2.28.1" +#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.28.1" + +#if defined(MBEDTLS_VERSION_C) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Get the version number. + * + * \return The constructed version number in the format + * MMNNPP00 (Major, Minor, Patch). + */ +unsigned int mbedtls_version_get_number( void ); + +/** + * Get the version string ("x.y.z"). + * + * \param string The string that will receive the value. + * (Should be at least 9 bytes in size) + */ +void mbedtls_version_get_string( char *string ); + +/** + * Get the full version string ("mbed TLS x.y.z"). + * + * \param string The string that will receive the value. The mbed TLS version + * string will use 18 bytes AT MOST including a terminating + * null byte. + * (So the buffer should be at least 18 bytes to receive this + * version string). + */ +void mbedtls_version_get_string_full( char *string ); + +/** + * \brief Check if support for a feature was compiled into this + * mbed TLS binary. This allows you to see at runtime if the + * library was for instance compiled with or without + * Multi-threading support. + * + * \note only checks against defines in the sections "System + * support", "mbed TLS modules" and "mbed TLS feature + * support" in config.h + * + * \param feature The string for the define to check (e.g. "MBEDTLS_AES_C") + * + * \return 0 if the feature is present, + * -1 if the feature is not present and + * -2 if support for feature checking as a whole was not + * compiled in. + */ +int mbedtls_version_check_feature( const char *feature ); + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_VERSION_C */ + +#endif /* version.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/x509.h b/openharmony/arm64-v8a/include/mbedtls/x509.h new file mode 100644 index 00000000..31b78df3 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/x509.h @@ -0,0 +1,380 @@ +/** + * \file x509.h + * + * \brief X.509 generic defines and structures + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_X509_H +#define MBEDTLS_X509_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/asn1.h" +#include "mbedtls/pk.h" + +#if defined(MBEDTLS_RSA_C) +#include "mbedtls/rsa.h" +#endif + +/** + * \addtogroup x509_module + * \{ + */ + +#if !defined(MBEDTLS_X509_MAX_INTERMEDIATE_CA) +/** + * Maximum number of intermediate CAs in a verification chain. + * That is, maximum length of the chain, excluding the end-entity certificate + * and the trusted root certificate. + * + * Set this to a low value to prevent an adversary from making you waste + * resources verifying an overlong certificate chain. + */ +#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 +#endif + +/** + * \name X509 Error codes + * \{ + */ +/** Unavailable feature, e.g. RSA hashing/encryption combination. */ +#define MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE -0x2080 +/** Requested OID is unknown. */ +#define MBEDTLS_ERR_X509_UNKNOWN_OID -0x2100 +/** The CRT/CRL/CSR format is invalid, e.g. different type expected. */ +#define MBEDTLS_ERR_X509_INVALID_FORMAT -0x2180 +/** The CRT/CRL/CSR version element is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_VERSION -0x2200 +/** The serial tag or value is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_SERIAL -0x2280 +/** The algorithm tag or value is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_ALG -0x2300 +/** The name tag or value is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_NAME -0x2380 +/** The date tag or value is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_DATE -0x2400 +/** The signature tag or value invalid. */ +#define MBEDTLS_ERR_X509_INVALID_SIGNATURE -0x2480 +/** The extension tag or value is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_EXTENSIONS -0x2500 +/** CRT/CRL/CSR has an unsupported version number. */ +#define MBEDTLS_ERR_X509_UNKNOWN_VERSION -0x2580 +/** Signature algorithm (oid) is unsupported. */ +#define MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG -0x2600 +/** Signature algorithms do not match. (see \c ::mbedtls_x509_crt sig_oid) */ +#define MBEDTLS_ERR_X509_SIG_MISMATCH -0x2680 +/** Certificate verification failed, e.g. CRL, CA or signature check failed. */ +#define MBEDTLS_ERR_X509_CERT_VERIFY_FAILED -0x2700 +/** Format not recognized as DER or PEM. */ +#define MBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT -0x2780 +/** Input invalid. */ +#define MBEDTLS_ERR_X509_BAD_INPUT_DATA -0x2800 +/** Allocation of memory failed. */ +#define MBEDTLS_ERR_X509_ALLOC_FAILED -0x2880 +/** Read/write of file failed. */ +#define MBEDTLS_ERR_X509_FILE_IO_ERROR -0x2900 +/** Destination buffer is too small. */ +#define MBEDTLS_ERR_X509_BUFFER_TOO_SMALL -0x2980 +/** A fatal error occurred, eg the chain is too long or the vrfy callback failed. */ +#define MBEDTLS_ERR_X509_FATAL_ERROR -0x3000 +/** \} name X509 Error codes */ + +/** + * \name X509 Verify codes + * \{ + */ +/* Reminder: update x509_crt_verify_strings[] in library/x509_crt.c */ +#define MBEDTLS_X509_BADCERT_EXPIRED 0x01 /**< The certificate validity has expired. */ +#define MBEDTLS_X509_BADCERT_REVOKED 0x02 /**< The certificate has been revoked (is on a CRL). */ +#define MBEDTLS_X509_BADCERT_CN_MISMATCH 0x04 /**< The certificate Common Name (CN) does not match with the expected CN. */ +#define MBEDTLS_X509_BADCERT_NOT_TRUSTED 0x08 /**< The certificate is not correctly signed by the trusted CA. */ +#define MBEDTLS_X509_BADCRL_NOT_TRUSTED 0x10 /**< The CRL is not correctly signed by the trusted CA. */ +#define MBEDTLS_X509_BADCRL_EXPIRED 0x20 /**< The CRL is expired. */ +#define MBEDTLS_X509_BADCERT_MISSING 0x40 /**< Certificate was missing. */ +#define MBEDTLS_X509_BADCERT_SKIP_VERIFY 0x80 /**< Certificate verification was skipped. */ +#define MBEDTLS_X509_BADCERT_OTHER 0x0100 /**< Other reason (can be used by verify callback) */ +#define MBEDTLS_X509_BADCERT_FUTURE 0x0200 /**< The certificate validity starts in the future. */ +#define MBEDTLS_X509_BADCRL_FUTURE 0x0400 /**< The CRL is from the future */ +#define MBEDTLS_X509_BADCERT_KEY_USAGE 0x0800 /**< Usage does not match the keyUsage extension. */ +#define MBEDTLS_X509_BADCERT_EXT_KEY_USAGE 0x1000 /**< Usage does not match the extendedKeyUsage extension. */ +#define MBEDTLS_X509_BADCERT_NS_CERT_TYPE 0x2000 /**< Usage does not match the nsCertType extension. */ +#define MBEDTLS_X509_BADCERT_BAD_MD 0x4000 /**< The certificate is signed with an unacceptable hash. */ +#define MBEDTLS_X509_BADCERT_BAD_PK 0x8000 /**< The certificate is signed with an unacceptable PK alg (eg RSA vs ECDSA). */ +#define MBEDTLS_X509_BADCERT_BAD_KEY 0x010000 /**< The certificate is signed with an unacceptable key (eg bad curve, RSA too short). */ +#define MBEDTLS_X509_BADCRL_BAD_MD 0x020000 /**< The CRL is signed with an unacceptable hash. */ +#define MBEDTLS_X509_BADCRL_BAD_PK 0x040000 /**< The CRL is signed with an unacceptable PK alg (eg RSA vs ECDSA). */ +#define MBEDTLS_X509_BADCRL_BAD_KEY 0x080000 /**< The CRL is signed with an unacceptable key (eg bad curve, RSA too short). */ + +/** \} name X509 Verify codes */ +/** \} addtogroup x509_module */ + +/* + * X.509 v3 Subject Alternative Name types. + * otherName [0] OtherName, + * rfc822Name [1] IA5String, + * dNSName [2] IA5String, + * x400Address [3] ORAddress, + * directoryName [4] Name, + * ediPartyName [5] EDIPartyName, + * uniformResourceIdentifier [6] IA5String, + * iPAddress [7] OCTET STRING, + * registeredID [8] OBJECT IDENTIFIER + */ +#define MBEDTLS_X509_SAN_OTHER_NAME 0 +#define MBEDTLS_X509_SAN_RFC822_NAME 1 +#define MBEDTLS_X509_SAN_DNS_NAME 2 +#define MBEDTLS_X509_SAN_X400_ADDRESS_NAME 3 +#define MBEDTLS_X509_SAN_DIRECTORY_NAME 4 +#define MBEDTLS_X509_SAN_EDI_PARTY_NAME 5 +#define MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER 6 +#define MBEDTLS_X509_SAN_IP_ADDRESS 7 +#define MBEDTLS_X509_SAN_REGISTERED_ID 8 + +/* + * X.509 v3 Key Usage Extension flags + * Reminder: update x509_info_key_usage() when adding new flags. + */ +#define MBEDTLS_X509_KU_DIGITAL_SIGNATURE (0x80) /* bit 0 */ +#define MBEDTLS_X509_KU_NON_REPUDIATION (0x40) /* bit 1 */ +#define MBEDTLS_X509_KU_KEY_ENCIPHERMENT (0x20) /* bit 2 */ +#define MBEDTLS_X509_KU_DATA_ENCIPHERMENT (0x10) /* bit 3 */ +#define MBEDTLS_X509_KU_KEY_AGREEMENT (0x08) /* bit 4 */ +#define MBEDTLS_X509_KU_KEY_CERT_SIGN (0x04) /* bit 5 */ +#define MBEDTLS_X509_KU_CRL_SIGN (0x02) /* bit 6 */ +#define MBEDTLS_X509_KU_ENCIPHER_ONLY (0x01) /* bit 7 */ +#define MBEDTLS_X509_KU_DECIPHER_ONLY (0x8000) /* bit 8 */ + +/* + * Netscape certificate types + * (http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn3.html) + */ + +#define MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT (0x80) /* bit 0 */ +#define MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER (0x40) /* bit 1 */ +#define MBEDTLS_X509_NS_CERT_TYPE_EMAIL (0x20) /* bit 2 */ +#define MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING (0x10) /* bit 3 */ +#define MBEDTLS_X509_NS_CERT_TYPE_RESERVED (0x08) /* bit 4 */ +#define MBEDTLS_X509_NS_CERT_TYPE_SSL_CA (0x04) /* bit 5 */ +#define MBEDTLS_X509_NS_CERT_TYPE_EMAIL_CA (0x02) /* bit 6 */ +#define MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING_CA (0x01) /* bit 7 */ + +/* + * X.509 extension types + * + * Comments refer to the status for using certificates. Status can be + * different for writing certificates or reading CRLs or CSRs. + * + * Those are defined in oid.h as oid.c needs them in a data structure. Since + * these were previously defined here, let's have aliases for compatibility. + */ +#define MBEDTLS_X509_EXT_AUTHORITY_KEY_IDENTIFIER MBEDTLS_OID_X509_EXT_AUTHORITY_KEY_IDENTIFIER +#define MBEDTLS_X509_EXT_SUBJECT_KEY_IDENTIFIER MBEDTLS_OID_X509_EXT_SUBJECT_KEY_IDENTIFIER +#define MBEDTLS_X509_EXT_KEY_USAGE MBEDTLS_OID_X509_EXT_KEY_USAGE +#define MBEDTLS_X509_EXT_CERTIFICATE_POLICIES MBEDTLS_OID_X509_EXT_CERTIFICATE_POLICIES +#define MBEDTLS_X509_EXT_POLICY_MAPPINGS MBEDTLS_OID_X509_EXT_POLICY_MAPPINGS +#define MBEDTLS_X509_EXT_SUBJECT_ALT_NAME MBEDTLS_OID_X509_EXT_SUBJECT_ALT_NAME /* Supported (DNS) */ +#define MBEDTLS_X509_EXT_ISSUER_ALT_NAME MBEDTLS_OID_X509_EXT_ISSUER_ALT_NAME +#define MBEDTLS_X509_EXT_SUBJECT_DIRECTORY_ATTRS MBEDTLS_OID_X509_EXT_SUBJECT_DIRECTORY_ATTRS +#define MBEDTLS_X509_EXT_BASIC_CONSTRAINTS MBEDTLS_OID_X509_EXT_BASIC_CONSTRAINTS /* Supported */ +#define MBEDTLS_X509_EXT_NAME_CONSTRAINTS MBEDTLS_OID_X509_EXT_NAME_CONSTRAINTS +#define MBEDTLS_X509_EXT_POLICY_CONSTRAINTS MBEDTLS_OID_X509_EXT_POLICY_CONSTRAINTS +#define MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE MBEDTLS_OID_X509_EXT_EXTENDED_KEY_USAGE +#define MBEDTLS_X509_EXT_CRL_DISTRIBUTION_POINTS MBEDTLS_OID_X509_EXT_CRL_DISTRIBUTION_POINTS +#define MBEDTLS_X509_EXT_INIHIBIT_ANYPOLICY MBEDTLS_OID_X509_EXT_INIHIBIT_ANYPOLICY +#define MBEDTLS_X509_EXT_FRESHEST_CRL MBEDTLS_OID_X509_EXT_FRESHEST_CRL +#define MBEDTLS_X509_EXT_NS_CERT_TYPE MBEDTLS_OID_X509_EXT_NS_CERT_TYPE + +/* + * Storage format identifiers + * Recognized formats: PEM and DER + */ +#define MBEDTLS_X509_FORMAT_DER 1 +#define MBEDTLS_X509_FORMAT_PEM 2 + +#define MBEDTLS_X509_MAX_DN_NAME_SIZE 256 /**< Maximum value size of a DN entry */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \addtogroup x509_module + * \{ */ + +/** + * \name Structures for parsing X.509 certificates, CRLs and CSRs + * \{ + */ + +/** + * Type-length-value structure that allows for ASN1 using DER. + */ +typedef mbedtls_asn1_buf mbedtls_x509_buf; + +/** + * Container for ASN1 bit strings. + */ +typedef mbedtls_asn1_bitstring mbedtls_x509_bitstring; + +/** + * Container for ASN1 named information objects. + * It allows for Relative Distinguished Names (e.g. cn=localhost,ou=code,etc.). + */ +typedef mbedtls_asn1_named_data mbedtls_x509_name; + +/** + * Container for a sequence of ASN.1 items + */ +typedef mbedtls_asn1_sequence mbedtls_x509_sequence; + +/** Container for date and time (precision in seconds). */ +typedef struct mbedtls_x509_time +{ + int year, mon, day; /**< Date. */ + int hour, min, sec; /**< Time. */ +} +mbedtls_x509_time; + +/** \} name Structures for parsing X.509 certificates, CRLs and CSRs */ + +/** + * \brief Store the certificate DN in printable form into buf; + * no more than size characters will be written. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param dn The X509 name to represent + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_dn_gets( char *buf, size_t size, const mbedtls_x509_name *dn ); + +/** + * \brief Store the certificate serial in printable form into buf; + * no more than size characters will be written. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param serial The X509 serial to represent + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_serial_gets( char *buf, size_t size, const mbedtls_x509_buf *serial ); + +/** + * \brief Check a given mbedtls_x509_time against the system time + * and tell if it's in the past. + * + * \note Intended usage is "if( is_past( valid_to ) ) ERROR". + * Hence the return value of 1 if on internal errors. + * + * \param to mbedtls_x509_time to check + * + * \return 1 if the given time is in the past or an error occurred, + * 0 otherwise. + */ +int mbedtls_x509_time_is_past( const mbedtls_x509_time *to ); + +/** + * \brief Check a given mbedtls_x509_time against the system time + * and tell if it's in the future. + * + * \note Intended usage is "if( is_future( valid_from ) ) ERROR". + * Hence the return value of 1 if on internal errors. + * + * \param from mbedtls_x509_time to check + * + * \return 1 if the given time is in the future or an error occurred, + * 0 otherwise. + */ +int mbedtls_x509_time_is_future( const mbedtls_x509_time *from ); + +/** \} addtogroup x509_module */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_x509_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +/* + * Internal module functions. You probably do not want to use these unless you + * know you do. + */ +int mbedtls_x509_get_name( unsigned char **p, const unsigned char *end, + mbedtls_x509_name *cur ); +int mbedtls_x509_get_alg_null( unsigned char **p, const unsigned char *end, + mbedtls_x509_buf *alg ); +int mbedtls_x509_get_alg( unsigned char **p, const unsigned char *end, + mbedtls_x509_buf *alg, mbedtls_x509_buf *params ); +#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) +int mbedtls_x509_get_rsassa_pss_params( const mbedtls_x509_buf *params, + mbedtls_md_type_t *md_alg, mbedtls_md_type_t *mgf_md, + int *salt_len ); +#endif +int mbedtls_x509_get_sig( unsigned char **p, const unsigned char *end, mbedtls_x509_buf *sig ); +int mbedtls_x509_get_sig_alg( const mbedtls_x509_buf *sig_oid, const mbedtls_x509_buf *sig_params, + mbedtls_md_type_t *md_alg, mbedtls_pk_type_t *pk_alg, + void **sig_opts ); +int mbedtls_x509_get_time( unsigned char **p, const unsigned char *end, + mbedtls_x509_time *t ); +int mbedtls_x509_get_serial( unsigned char **p, const unsigned char *end, + mbedtls_x509_buf *serial ); +int mbedtls_x509_get_ext( unsigned char **p, const unsigned char *end, + mbedtls_x509_buf *ext, int tag ); +int mbedtls_x509_sig_alg_gets( char *buf, size_t size, const mbedtls_x509_buf *sig_oid, + mbedtls_pk_type_t pk_alg, mbedtls_md_type_t md_alg, + const void *sig_opts ); +int mbedtls_x509_key_size_helper( char *buf, size_t buf_size, const char *name ); +int mbedtls_x509_string_to_names( mbedtls_asn1_named_data **head, const char *name ); +int mbedtls_x509_set_extension( mbedtls_asn1_named_data **head, const char *oid, size_t oid_len, + int critical, const unsigned char *val, + size_t val_len ); +int mbedtls_x509_write_extensions( unsigned char **p, unsigned char *start, + mbedtls_asn1_named_data *first ); +int mbedtls_x509_write_names( unsigned char **p, unsigned char *start, + mbedtls_asn1_named_data *first ); +int mbedtls_x509_write_sig( unsigned char **p, unsigned char *start, + const char *oid, size_t oid_len, + unsigned char *sig, size_t size ); + +#define MBEDTLS_X509_SAFE_SNPRINTF \ + do { \ + if( ret < 0 || (size_t) ret >= n ) \ + return( MBEDTLS_ERR_X509_BUFFER_TOO_SMALL ); \ + \ + n -= (size_t) ret; \ + p += (size_t) ret; \ + } while( 0 ) + +#ifdef __cplusplus +} +#endif + +#endif /* x509.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/x509_crl.h b/openharmony/arm64-v8a/include/mbedtls/x509_crl.h new file mode 100644 index 00000000..92220090 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/x509_crl.h @@ -0,0 +1,172 @@ +/** + * \file x509_crl.h + * + * \brief X.509 certificate revocation list parsing + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_X509_CRL_H +#define MBEDTLS_X509_CRL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/x509.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \addtogroup x509_module + * \{ */ + +/** + * \name Structures and functions for parsing CRLs + * \{ + */ + +/** + * Certificate revocation list entry. + * Contains the CA-specific serial numbers and revocation dates. + */ +typedef struct mbedtls_x509_crl_entry +{ + mbedtls_x509_buf raw; + + mbedtls_x509_buf serial; + + mbedtls_x509_time revocation_date; + + mbedtls_x509_buf entry_ext; + + struct mbedtls_x509_crl_entry *next; +} +mbedtls_x509_crl_entry; + +/** + * Certificate revocation list structure. + * Every CRL may have multiple entries. + */ +typedef struct mbedtls_x509_crl +{ + mbedtls_x509_buf raw; /**< The raw certificate data (DER). */ + mbedtls_x509_buf tbs; /**< The raw certificate body (DER). The part that is To Be Signed. */ + + int version; /**< CRL version (1=v1, 2=v2) */ + mbedtls_x509_buf sig_oid; /**< CRL signature type identifier */ + + mbedtls_x509_buf issuer_raw; /**< The raw issuer data (DER). */ + + mbedtls_x509_name issuer; /**< The parsed issuer data (named information object). */ + + mbedtls_x509_time this_update; + mbedtls_x509_time next_update; + + mbedtls_x509_crl_entry entry; /**< The CRL entries containing the certificate revocation times for this CA. */ + + mbedtls_x509_buf crl_ext; + + mbedtls_x509_buf sig_oid2; + mbedtls_x509_buf sig; + mbedtls_md_type_t sig_md; /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */ + mbedtls_pk_type_t sig_pk; /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */ + void *sig_opts; /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */ + + struct mbedtls_x509_crl *next; +} +mbedtls_x509_crl; + +/** + * \brief Parse a DER-encoded CRL and append it to the chained list + * + * \param chain points to the start of the chain + * \param buf buffer holding the CRL data in DER format + * \param buflen size of the buffer + * (including the terminating null byte for PEM data) + * + * \return 0 if successful, or a specific X509 or PEM error code + */ +int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain, + const unsigned char *buf, size_t buflen ); +/** + * \brief Parse one or more CRLs and append them to the chained list + * + * \note Multiple CRLs are accepted only if using PEM format + * + * \param chain points to the start of the chain + * \param buf buffer holding the CRL data in PEM or DER format + * \param buflen size of the buffer + * (including the terminating null byte for PEM data) + * + * \return 0 if successful, or a specific X509 or PEM error code + */ +int mbedtls_x509_crl_parse( mbedtls_x509_crl *chain, const unsigned char *buf, size_t buflen ); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief Load one or more CRLs and append them to the chained list + * + * \note Multiple CRLs are accepted only if using PEM format + * + * \param chain points to the start of the chain + * \param path filename to read the CRLs from (in PEM or DER encoding) + * + * \return 0 if successful, or a specific X509 or PEM error code + */ +int mbedtls_x509_crl_parse_file( mbedtls_x509_crl *chain, const char *path ); +#endif /* MBEDTLS_FS_IO */ + +/** + * \brief Returns an informational string about the CRL. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param prefix A line prefix + * \param crl The X509 CRL to represent + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_crl_info( char *buf, size_t size, const char *prefix, + const mbedtls_x509_crl *crl ); + +/** + * \brief Initialize a CRL (chain) + * + * \param crl CRL chain to initialize + */ +void mbedtls_x509_crl_init( mbedtls_x509_crl *crl ); + +/** + * \brief Unallocate all CRL data + * + * \param crl CRL chain to free + */ +void mbedtls_x509_crl_free( mbedtls_x509_crl *crl ); + +/** \} name Structures and functions for parsing CRLs */ +/** \} addtogroup x509_module */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_x509_crl.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/x509_crt.h b/openharmony/arm64-v8a/include/mbedtls/x509_crt.h new file mode 100644 index 00000000..0f2885a7 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/x509_crt.h @@ -0,0 +1,1097 @@ +/** + * \file x509_crt.h + * + * \brief X.509 certificate parsing and writing + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_X509_CRT_H +#define MBEDTLS_X509_CRT_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/x509.h" +#include "mbedtls/x509_crl.h" +#include "mbedtls/bignum.h" + +/** + * \addtogroup x509_module + * \{ + */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \name Structures and functions for parsing and writing X.509 certificates + * \{ + */ + +/** + * Container for an X.509 certificate. The certificate may be chained. + */ +typedef struct mbedtls_x509_crt +{ + int own_buffer; /**< Indicates if \c raw is owned + * by the structure or not. */ + mbedtls_x509_buf raw; /**< The raw certificate data (DER). */ + mbedtls_x509_buf tbs; /**< The raw certificate body (DER). The part that is To Be Signed. */ + + int version; /**< The X.509 version. (1=v1, 2=v2, 3=v3) */ + mbedtls_x509_buf serial; /**< Unique id for certificate issued by a specific CA. */ + mbedtls_x509_buf sig_oid; /**< Signature algorithm, e.g. sha1RSA */ + + mbedtls_x509_buf issuer_raw; /**< The raw issuer data (DER). Used for quick comparison. */ + mbedtls_x509_buf subject_raw; /**< The raw subject data (DER). Used for quick comparison. */ + + mbedtls_x509_name issuer; /**< The parsed issuer data (named information object). */ + mbedtls_x509_name subject; /**< The parsed subject data (named information object). */ + + mbedtls_x509_time valid_from; /**< Start time of certificate validity. */ + mbedtls_x509_time valid_to; /**< End time of certificate validity. */ + + mbedtls_x509_buf pk_raw; + mbedtls_pk_context pk; /**< Container for the public key context. */ + + mbedtls_x509_buf issuer_id; /**< Optional X.509 v2/v3 issuer unique identifier. */ + mbedtls_x509_buf subject_id; /**< Optional X.509 v2/v3 subject unique identifier. */ + mbedtls_x509_buf v3_ext; /**< Optional X.509 v3 extensions. */ + mbedtls_x509_sequence subject_alt_names; /**< Optional list of raw entries of Subject Alternative Names extension (currently only dNSName and OtherName are listed). */ + + mbedtls_x509_sequence certificate_policies; /**< Optional list of certificate policies (Only anyPolicy is printed and enforced, however the rest of the policies are still listed). */ + + int ext_types; /**< Bit string containing detected and parsed extensions */ + int ca_istrue; /**< Optional Basic Constraint extension value: 1 if this certificate belongs to a CA, 0 otherwise. */ + int max_pathlen; /**< Optional Basic Constraint extension value: The maximum path length to the root certificate. Path length is 1 higher than RFC 5280 'meaning', so 1+ */ + + unsigned int key_usage; /**< Optional key usage extension value: See the values in x509.h */ + + mbedtls_x509_sequence ext_key_usage; /**< Optional list of extended key usage OIDs. */ + + unsigned char ns_cert_type; /**< Optional Netscape certificate type extension value: See the values in x509.h */ + + mbedtls_x509_buf sig; /**< Signature: hash of the tbs part signed with the private key. */ + mbedtls_md_type_t sig_md; /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */ + mbedtls_pk_type_t sig_pk; /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */ + void *sig_opts; /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */ + + struct mbedtls_x509_crt *next; /**< Next certificate in the CA-chain. */ +} +mbedtls_x509_crt; + +/** + * From RFC 5280 section 4.2.1.6: + * OtherName ::= SEQUENCE { + * type-id OBJECT IDENTIFIER, + * value [0] EXPLICIT ANY DEFINED BY type-id } + */ +typedef struct mbedtls_x509_san_other_name +{ + /** + * The type_id is an OID as defined in RFC 5280. + * To check the value of the type id, you should use + * \p MBEDTLS_OID_CMP with a known OID mbedtls_x509_buf. + */ + mbedtls_x509_buf type_id; /**< The type id. */ + union + { + /** + * From RFC 4108 section 5: + * HardwareModuleName ::= SEQUENCE { + * hwType OBJECT IDENTIFIER, + * hwSerialNum OCTET STRING } + */ + struct + { + mbedtls_x509_buf oid; /**< The object identifier. */ + mbedtls_x509_buf val; /**< The named value. */ + } + hardware_module_name; + } + value; +} +mbedtls_x509_san_other_name; + +/** + * A structure for holding the parsed Subject Alternative Name, according to type + */ +typedef struct mbedtls_x509_subject_alternative_name +{ + int type; /**< The SAN type, value of MBEDTLS_X509_SAN_XXX. */ + union { + mbedtls_x509_san_other_name other_name; /**< The otherName supported type. */ + mbedtls_x509_buf unstructured_name; /**< The buffer for the un constructed types. Only dnsName currently supported */ + } + san; /**< A union of the supported SAN types */ +} +mbedtls_x509_subject_alternative_name; + +/** + * Build flag from an algorithm/curve identifier (pk, md, ecp) + * Since 0 is always XXX_NONE, ignore it. + */ +#define MBEDTLS_X509_ID_FLAG( id ) ( 1 << ( (id) - 1 ) ) + +/** + * Security profile for certificate verification. + * + * All lists are bitfields, built by ORing flags from MBEDTLS_X509_ID_FLAG(). + */ +typedef struct mbedtls_x509_crt_profile +{ + uint32_t allowed_mds; /**< MDs for signatures */ + uint32_t allowed_pks; /**< PK algs for public keys; + * this applies to all certificates + * in the provided chain. */ + uint32_t allowed_curves; /**< Elliptic curves for ECDSA */ + uint32_t rsa_min_bitlen; /**< Minimum size for RSA keys */ +} +mbedtls_x509_crt_profile; + +#define MBEDTLS_X509_CRT_VERSION_1 0 +#define MBEDTLS_X509_CRT_VERSION_2 1 +#define MBEDTLS_X509_CRT_VERSION_3 2 + +#define MBEDTLS_X509_RFC5280_MAX_SERIAL_LEN 32 +#define MBEDTLS_X509_RFC5280_UTC_TIME_LEN 15 + +#if !defined( MBEDTLS_X509_MAX_FILE_PATH_LEN ) +#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 +#endif + +/** + * Container for writing a certificate (CRT) + */ +typedef struct mbedtls_x509write_cert +{ + int version; + mbedtls_mpi serial; + mbedtls_pk_context *subject_key; + mbedtls_pk_context *issuer_key; + mbedtls_asn1_named_data *subject; + mbedtls_asn1_named_data *issuer; + mbedtls_md_type_t md_alg; + char not_before[MBEDTLS_X509_RFC5280_UTC_TIME_LEN + 1]; + char not_after[MBEDTLS_X509_RFC5280_UTC_TIME_LEN + 1]; + mbedtls_asn1_named_data *extensions; +} +mbedtls_x509write_cert; + +/** + * Item in a verification chain: cert and flags for it + */ +typedef struct { + mbedtls_x509_crt *crt; + uint32_t flags; +} mbedtls_x509_crt_verify_chain_item; + +/** + * Max size of verification chain: end-entity + intermediates + trusted root + */ +#define MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE ( MBEDTLS_X509_MAX_INTERMEDIATE_CA + 2 ) + +/** + * Verification chain as built by \c mbedtls_crt_verify_chain() + */ +typedef struct +{ + mbedtls_x509_crt_verify_chain_item items[MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE]; + unsigned len; + +#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) + /* This stores the list of potential trusted signers obtained from + * the CA callback used for the CRT verification, if configured. + * We must track it somewhere because the callback passes its + * ownership to the caller. */ + mbedtls_x509_crt *trust_ca_cb_result; +#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ +} mbedtls_x509_crt_verify_chain; + +#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) + +/** + * \brief Context for resuming X.509 verify operations + */ +typedef struct +{ + /* for check_signature() */ + mbedtls_pk_restart_ctx pk; + + /* for find_parent_in() */ + mbedtls_x509_crt *parent; /* non-null iff parent_in in progress */ + mbedtls_x509_crt *fallback_parent; + int fallback_signature_is_good; + + /* for find_parent() */ + int parent_is_trusted; /* -1 if find_parent is not in progress */ + + /* for verify_chain() */ + enum { + x509_crt_rs_none, + x509_crt_rs_find_parent, + } in_progress; /* none if no operation is in progress */ + int self_cnt; + mbedtls_x509_crt_verify_chain ver_chain; + +} mbedtls_x509_crt_restart_ctx; + +#else /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ + +/* Now we can declare functions that take a pointer to that */ +typedef void mbedtls_x509_crt_restart_ctx; + +#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * Default security profile. Should provide a good balance between security + * and compatibility with current deployments. + * + * This profile permits: + * - SHA2 hashes. + * - All supported elliptic curves. + * - RSA with 2048 bits and above. + * + * New minor versions of Mbed TLS may extend this profile, for example if + * new curves are added to the library. New minor versions of Mbed TLS will + * not reduce this profile unless serious security concerns require it. + */ +extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default; + +/** + * Expected next default profile. Recommended for new deployments. + * Currently targets a 128-bit security level, except for allowing RSA-2048. + */ +extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_next; + +/** + * NSA Suite B profile. + */ +extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_suiteb; + +/** + * \brief Parse a single DER formatted certificate and add it + * to the end of the provided chained list. + * + * \param chain The pointer to the start of the CRT chain to attach to. + * When parsing the first CRT in a chain, this should point + * to an instance of ::mbedtls_x509_crt initialized through + * mbedtls_x509_crt_init(). + * \param buf The buffer holding the DER encoded certificate. + * \param buflen The size in Bytes of \p buf. + * + * \note This function makes an internal copy of the CRT buffer + * \p buf. In particular, \p buf may be destroyed or reused + * after this call returns. To avoid duplicating the CRT + * buffer (at the cost of stricter lifetime constraints), + * use mbedtls_x509_crt_parse_der_nocopy() instead. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_x509_crt_parse_der( mbedtls_x509_crt *chain, + const unsigned char *buf, + size_t buflen ); + +/** + * \brief The type of certificate extension callbacks. + * + * Callbacks of this type are passed to and used by the + * mbedtls_x509_crt_parse_der_with_ext_cb() routine when + * it encounters either an unsupported extension or a + * "certificate policies" extension containing any + * unsupported certificate policies. + * Future versions of the library may invoke the callback + * in other cases, if and when the need arises. + * + * \param p_ctx An opaque context passed to the callback. + * \param crt The certificate being parsed. + * \param oid The OID of the extension. + * \param critical Whether the extension is critical. + * \param p Pointer to the start of the extension value + * (the content of the OCTET STRING). + * \param end End of extension value. + * + * \note The callback must fail and return a negative error code + * if it can not parse or does not support the extension. + * When the callback fails to parse a critical extension + * mbedtls_x509_crt_parse_der_with_ext_cb() also fails. + * When the callback fails to parse a non critical extension + * mbedtls_x509_crt_parse_der_with_ext_cb() simply skips + * the extension and continues parsing. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +typedef int (*mbedtls_x509_crt_ext_cb_t)( void *p_ctx, + mbedtls_x509_crt const *crt, + mbedtls_x509_buf const *oid, + int critical, + const unsigned char *p, + const unsigned char *end ); + +/** + * \brief Parse a single DER formatted certificate and add it + * to the end of the provided chained list. + * + * \param chain The pointer to the start of the CRT chain to attach to. + * When parsing the first CRT in a chain, this should point + * to an instance of ::mbedtls_x509_crt initialized through + * mbedtls_x509_crt_init(). + * \param buf The buffer holding the DER encoded certificate. + * \param buflen The size in Bytes of \p buf. + * \param make_copy When not zero this function makes an internal copy of the + * CRT buffer \p buf. In particular, \p buf may be destroyed + * or reused after this call returns. + * When zero this function avoids duplicating the CRT buffer + * by taking temporary ownership thereof until the CRT + * is destroyed (like mbedtls_x509_crt_parse_der_nocopy()) + * \param cb A callback invoked for every unsupported certificate + * extension. + * \param p_ctx An opaque context passed to the callback. + * + * \note This call is functionally equivalent to + * mbedtls_x509_crt_parse_der(), and/or + * mbedtls_x509_crt_parse_der_nocopy() + * but it calls the callback with every unsupported + * certificate extension and additionally the + * "certificate policies" extension if it contains any + * unsupported certificate policies. + * The callback must return a negative error code if it + * does not know how to handle such an extension. + * When the callback fails to parse a critical extension + * mbedtls_x509_crt_parse_der_with_ext_cb() also fails. + * When the callback fails to parse a non critical extension + * mbedtls_x509_crt_parse_der_with_ext_cb() simply skips + * the extension and continues parsing. + * Future versions of the library may invoke the callback + * in other cases, if and when the need arises. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_x509_crt_parse_der_with_ext_cb( mbedtls_x509_crt *chain, + const unsigned char *buf, + size_t buflen, + int make_copy, + mbedtls_x509_crt_ext_cb_t cb, + void *p_ctx ); + +/** + * \brief Parse a single DER formatted certificate and add it + * to the end of the provided chained list. This is a + * variant of mbedtls_x509_crt_parse_der() which takes + * temporary ownership of the CRT buffer until the CRT + * is destroyed. + * + * \param chain The pointer to the start of the CRT chain to attach to. + * When parsing the first CRT in a chain, this should point + * to an instance of ::mbedtls_x509_crt initialized through + * mbedtls_x509_crt_init(). + * \param buf The address of the readable buffer holding the DER encoded + * certificate to use. On success, this buffer must be + * retained and not be changed for the liftetime of the + * CRT chain \p chain, that is, until \p chain is destroyed + * through a call to mbedtls_x509_crt_free(). + * \param buflen The size in Bytes of \p buf. + * + * \note This call is functionally equivalent to + * mbedtls_x509_crt_parse_der(), but it avoids creating a + * copy of the input buffer at the cost of stronger lifetime + * constraints. This is useful in constrained environments + * where duplication of the CRT cannot be tolerated. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_x509_crt_parse_der_nocopy( mbedtls_x509_crt *chain, + const unsigned char *buf, + size_t buflen ); + +/** + * \brief Parse one DER-encoded or one or more concatenated PEM-encoded + * certificates and add them to the chained list. + * + * For CRTs in PEM encoding, the function parses permissively: + * if at least one certificate can be parsed, the function + * returns the number of certificates for which parsing failed + * (hence \c 0 if all certificates were parsed successfully). + * If no certificate could be parsed, the function returns + * the first (negative) error encountered during parsing. + * + * PEM encoded certificates may be interleaved by other data + * such as human readable descriptions of their content, as + * long as the certificates are enclosed in the PEM specific + * '-----{BEGIN/END} CERTIFICATE-----' delimiters. + * + * \param chain The chain to which to add the parsed certificates. + * \param buf The buffer holding the certificate data in PEM or DER format. + * For certificates in PEM encoding, this may be a concatenation + * of multiple certificates; for DER encoding, the buffer must + * comprise exactly one certificate. + * \param buflen The size of \p buf, including the terminating \c NULL byte + * in case of PEM encoded data. + * + * \return \c 0 if all certificates were parsed successfully. + * \return The (positive) number of certificates that couldn't + * be parsed if parsing was partly successful (see above). + * \return A negative X509 or PEM error code otherwise. + * + */ +int mbedtls_x509_crt_parse( mbedtls_x509_crt *chain, const unsigned char *buf, size_t buflen ); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief Load one or more certificates and add them + * to the chained list. Parses permissively. If some + * certificates can be parsed, the result is the number + * of failed certificates it encountered. If none complete + * correctly, the first error is returned. + * + * \param chain points to the start of the chain + * \param path filename to read the certificates from + * + * \return 0 if all certificates parsed successfully, a positive number + * if partly successful or a specific X509 or PEM error code + */ +int mbedtls_x509_crt_parse_file( mbedtls_x509_crt *chain, const char *path ); + +/** + * \brief Load one or more certificate files from a path and add them + * to the chained list. Parses permissively. If some + * certificates can be parsed, the result is the number + * of failed certificates it encountered. If none complete + * correctly, the first error is returned. + * + * \param chain points to the start of the chain + * \param path directory / folder to read the certificate files from + * + * \return 0 if all certificates parsed successfully, a positive number + * if partly successful or a specific X509 or PEM error code + */ +int mbedtls_x509_crt_parse_path( mbedtls_x509_crt *chain, const char *path ); + +#endif /* MBEDTLS_FS_IO */ +/** + * \brief This function parses an item in the SubjectAlternativeNames + * extension. + * + * \param san_buf The buffer holding the raw data item of the subject + * alternative name. + * \param san The target structure to populate with the parsed presentation + * of the subject alternative name encoded in \p san_raw. + * + * \note Only "dnsName" and "otherName" of type hardware_module_name + * as defined in RFC 4180 is supported. + * + * \note This function should be called on a single raw data of + * subject alternative name. For example, after successful + * certificate parsing, one must iterate on every item in the + * \p crt->subject_alt_names sequence, and pass it to + * this function. + * + * \warning The target structure contains pointers to the raw data of the + * parsed certificate, and its lifetime is restricted by the + * lifetime of the certificate. + * + * \return \c 0 on success + * \return #MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE for an unsupported + * SAN type. + * \return Another negative value for any other failure. + */ +int mbedtls_x509_parse_subject_alt_name( const mbedtls_x509_buf *san_buf, + mbedtls_x509_subject_alternative_name *san ); +/** + * \brief Returns an informational string about the + * certificate. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param prefix A line prefix + * \param crt The X509 certificate to represent + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_crt_info( char *buf, size_t size, const char *prefix, + const mbedtls_x509_crt *crt ); + +/** + * \brief Returns an informational string about the + * verification status of a certificate. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param prefix A line prefix + * \param flags Verification flags created by mbedtls_x509_crt_verify() + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_crt_verify_info( char *buf, size_t size, const char *prefix, + uint32_t flags ); + +/** + * \brief Verify a chain of certificates. + * + * The verify callback is a user-supplied callback that + * can clear / modify / add flags for a certificate. If set, + * the verification callback is called for each + * certificate in the chain (from the trust-ca down to the + * presented crt). The parameters for the callback are: + * (void *parameter, mbedtls_x509_crt *crt, int certificate_depth, + * int *flags). With the flags representing current flags for + * that specific certificate and the certificate depth from + * the bottom (Peer cert depth = 0). + * + * All flags left after returning from the callback + * are also returned to the application. The function should + * return 0 for anything (including invalid certificates) + * other than fatal error, as a non-zero return code + * immediately aborts the verification process. For fatal + * errors, a specific error code should be used (different + * from MBEDTLS_ERR_X509_CERT_VERIFY_FAILED which should not + * be returned at this point), or MBEDTLS_ERR_X509_FATAL_ERROR + * can be used if no better code is available. + * + * \note In case verification failed, the results can be displayed + * using \c mbedtls_x509_crt_verify_info() + * + * \note Same as \c mbedtls_x509_crt_verify_with_profile() with the + * default security profile. + * + * \note It is your responsibility to provide up-to-date CRLs for + * all trusted CAs. If no CRL is provided for the CA that was + * used to sign the certificate, CRL verification is skipped + * silently, that is *without* setting any flag. + * + * \note The \c trust_ca list can contain two types of certificates: + * (1) those of trusted root CAs, so that certificates + * chaining up to those CAs will be trusted, and (2) + * self-signed end-entity certificates to be trusted (for + * specific peers you know) - in that case, the self-signed + * certificate doesn't need to have the CA bit set. + * + * \param crt The certificate chain to be verified. + * \param trust_ca The list of trusted CAs. + * \param ca_crl The list of CRLs for trusted CAs. + * \param cn The expected Common Name. This will be checked to be + * present in the certificate's subjectAltNames extension or, + * if this extension is absent, as a CN component in its + * Subject name. Currently only DNS names are supported. This + * may be \c NULL if the CN need not be verified. + * \param flags The address at which to store the result of the verification. + * If the verification couldn't be completed, the flag value is + * set to (uint32_t) -1. + * \param f_vrfy The verification callback to use. See the documentation + * of mbedtls_x509_crt_verify() for more information. + * \param p_vrfy The context to be passed to \p f_vrfy. + * + * \return \c 0 if the chain is valid with respect to the + * passed CN, CAs, CRLs and security profile. + * \return #MBEDTLS_ERR_X509_CERT_VERIFY_FAILED in case the + * certificate chain verification failed. In this case, + * \c *flags will have one or more + * \c MBEDTLS_X509_BADCERT_XXX or \c MBEDTLS_X509_BADCRL_XXX + * flags set. + * \return Another negative error code in case of a fatal error + * encountered during the verification process. + */ +int mbedtls_x509_crt_verify( mbedtls_x509_crt *crt, + mbedtls_x509_crt *trust_ca, + mbedtls_x509_crl *ca_crl, + const char *cn, uint32_t *flags, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy ); + +/** + * \brief Verify a chain of certificates with respect to + * a configurable security profile. + * + * \note Same as \c mbedtls_x509_crt_verify(), but with explicit + * security profile. + * + * \note The restrictions on keys (RSA minimum size, allowed curves + * for ECDSA) apply to all certificates: trusted root, + * intermediate CAs if any, and end entity certificate. + * + * \param crt The certificate chain to be verified. + * \param trust_ca The list of trusted CAs. + * \param ca_crl The list of CRLs for trusted CAs. + * \param profile The security profile to use for the verification. + * \param cn The expected Common Name. This may be \c NULL if the + * CN need not be verified. + * \param flags The address at which to store the result of the verification. + * If the verification couldn't be completed, the flag value is + * set to (uint32_t) -1. + * \param f_vrfy The verification callback to use. See the documentation + * of mbedtls_x509_crt_verify() for more information. + * \param p_vrfy The context to be passed to \p f_vrfy. + * + * \return \c 0 if the chain is valid with respect to the + * passed CN, CAs, CRLs and security profile. + * \return #MBEDTLS_ERR_X509_CERT_VERIFY_FAILED in case the + * certificate chain verification failed. In this case, + * \c *flags will have one or more + * \c MBEDTLS_X509_BADCERT_XXX or \c MBEDTLS_X509_BADCRL_XXX + * flags set. + * \return Another negative error code in case of a fatal error + * encountered during the verification process. + */ +int mbedtls_x509_crt_verify_with_profile( mbedtls_x509_crt *crt, + mbedtls_x509_crt *trust_ca, + mbedtls_x509_crl *ca_crl, + const mbedtls_x509_crt_profile *profile, + const char *cn, uint32_t *flags, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy ); + +/** + * \brief Restartable version of \c mbedtls_crt_verify_with_profile() + * + * \note Performs the same job as \c mbedtls_crt_verify_with_profile() + * but can return early and restart according to the limit + * set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + * + * \param crt The certificate chain to be verified. + * \param trust_ca The list of trusted CAs. + * \param ca_crl The list of CRLs for trusted CAs. + * \param profile The security profile to use for the verification. + * \param cn The expected Common Name. This may be \c NULL if the + * CN need not be verified. + * \param flags The address at which to store the result of the verification. + * If the verification couldn't be completed, the flag value is + * set to (uint32_t) -1. + * \param f_vrfy The verification callback to use. See the documentation + * of mbedtls_x509_crt_verify() for more information. + * \param p_vrfy The context to be passed to \p f_vrfy. + * \param rs_ctx The restart context to use. This may be set to \c NULL + * to disable restartable ECC. + * + * \return See \c mbedtls_crt_verify_with_profile(), or + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + */ +int mbedtls_x509_crt_verify_restartable( mbedtls_x509_crt *crt, + mbedtls_x509_crt *trust_ca, + mbedtls_x509_crl *ca_crl, + const mbedtls_x509_crt_profile *profile, + const char *cn, uint32_t *flags, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy, + mbedtls_x509_crt_restart_ctx *rs_ctx ); + +/** + * \brief The type of trusted certificate callbacks. + * + * Callbacks of this type are passed to and used by the CRT + * verification routine mbedtls_x509_crt_verify_with_ca_cb() + * when looking for trusted signers of a given certificate. + * + * On success, the callback returns a list of trusted + * certificates to be considered as potential signers + * for the input certificate. + * + * \param p_ctx An opaque context passed to the callback. + * \param child The certificate for which to search a potential signer. + * This will point to a readable certificate. + * \param candidate_cas The address at which to store the address of the first + * entry in the generated linked list of candidate signers. + * This will not be \c NULL. + * + * \note The callback must only return a non-zero value on a + * fatal error. If, in contrast, the search for a potential + * signer completes without a single candidate, the + * callback must return \c 0 and set \c *candidate_cas + * to \c NULL. + * + * \return \c 0 on success. In this case, \c *candidate_cas points + * to a heap-allocated linked list of instances of + * ::mbedtls_x509_crt, and ownership of this list is passed + * to the caller. + * \return A negative error code on failure. + */ +typedef int (*mbedtls_x509_crt_ca_cb_t)( void *p_ctx, + mbedtls_x509_crt const *child, + mbedtls_x509_crt **candidate_cas ); + +#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) +/** + * \brief Version of \c mbedtls_x509_crt_verify_with_profile() which + * uses a callback to acquire the list of trusted CA + * certificates. + * + * \param crt The certificate chain to be verified. + * \param f_ca_cb The callback to be used to query for potential signers + * of a given child certificate. See the documentation of + * ::mbedtls_x509_crt_ca_cb_t for more information. + * \param p_ca_cb The opaque context to be passed to \p f_ca_cb. + * \param profile The security profile for the verification. + * \param cn The expected Common Name. This may be \c NULL if the + * CN need not be verified. + * \param flags The address at which to store the result of the verification. + * If the verification couldn't be completed, the flag value is + * set to (uint32_t) -1. + * \param f_vrfy The verification callback to use. See the documentation + * of mbedtls_x509_crt_verify() for more information. + * \param p_vrfy The context to be passed to \p f_vrfy. + * + * \return See \c mbedtls_crt_verify_with_profile(). + */ +int mbedtls_x509_crt_verify_with_ca_cb( mbedtls_x509_crt *crt, + mbedtls_x509_crt_ca_cb_t f_ca_cb, + void *p_ca_cb, + const mbedtls_x509_crt_profile *profile, + const char *cn, uint32_t *flags, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy ); + +#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ + +#if defined(MBEDTLS_X509_CHECK_KEY_USAGE) +/** + * \brief Check usage of certificate against keyUsage extension. + * + * \param crt Leaf certificate used. + * \param usage Intended usage(s) (eg MBEDTLS_X509_KU_KEY_ENCIPHERMENT + * before using the certificate to perform an RSA key + * exchange). + * + * \note Except for decipherOnly and encipherOnly, a bit set in the + * usage argument means this bit MUST be set in the + * certificate. For decipherOnly and encipherOnly, it means + * that bit MAY be set. + * + * \return 0 is these uses of the certificate are allowed, + * MBEDTLS_ERR_X509_BAD_INPUT_DATA if the keyUsage extension + * is present but does not match the usage argument. + * + * \note You should only call this function on leaf certificates, on + * (intermediate) CAs the keyUsage extension is automatically + * checked by \c mbedtls_x509_crt_verify(). + */ +int mbedtls_x509_crt_check_key_usage( const mbedtls_x509_crt *crt, + unsigned int usage ); +#endif /* MBEDTLS_X509_CHECK_KEY_USAGE) */ + +#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE) +/** + * \brief Check usage of certificate against extendedKeyUsage. + * + * \param crt Leaf certificate used. + * \param usage_oid Intended usage (eg MBEDTLS_OID_SERVER_AUTH or + * MBEDTLS_OID_CLIENT_AUTH). + * \param usage_len Length of usage_oid (eg given by MBEDTLS_OID_SIZE()). + * + * \return 0 if this use of the certificate is allowed, + * MBEDTLS_ERR_X509_BAD_INPUT_DATA if not. + * + * \note Usually only makes sense on leaf certificates. + */ +int mbedtls_x509_crt_check_extended_key_usage( const mbedtls_x509_crt *crt, + const char *usage_oid, + size_t usage_len ); +#endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */ + +#if defined(MBEDTLS_X509_CRL_PARSE_C) +/** + * \brief Verify the certificate revocation status + * + * \param crt a certificate to be verified + * \param crl the CRL to verify against + * + * \return 1 if the certificate is revoked, 0 otherwise + * + */ +int mbedtls_x509_crt_is_revoked( const mbedtls_x509_crt *crt, const mbedtls_x509_crl *crl ); +#endif /* MBEDTLS_X509_CRL_PARSE_C */ + +/** + * \brief Initialize a certificate (chain) + * + * \param crt Certificate chain to initialize + */ +void mbedtls_x509_crt_init( mbedtls_x509_crt *crt ); + +/** + * \brief Unallocate all certificate data + * + * \param crt Certificate chain to free + */ +void mbedtls_x509_crt_free( mbedtls_x509_crt *crt ); + +#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Initialize a restart context + */ +void mbedtls_x509_crt_restart_init( mbedtls_x509_crt_restart_ctx *ctx ); + +/** + * \brief Free the components of a restart context + */ +void mbedtls_x509_crt_restart_free( mbedtls_x509_crt_restart_ctx *ctx ); +#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +/** \} name Structures and functions for parsing and writing X.509 certificates */ + +#if defined(MBEDTLS_X509_CRT_WRITE_C) +/** + * \brief Initialize a CRT writing context + * + * \param ctx CRT context to initialize + */ +void mbedtls_x509write_crt_init( mbedtls_x509write_cert *ctx ); + +/** + * \brief Set the version for a Certificate + * Default: MBEDTLS_X509_CRT_VERSION_3 + * + * \param ctx CRT context to use + * \param version version to set (MBEDTLS_X509_CRT_VERSION_1, MBEDTLS_X509_CRT_VERSION_2 or + * MBEDTLS_X509_CRT_VERSION_3) + */ +void mbedtls_x509write_crt_set_version( mbedtls_x509write_cert *ctx, int version ); + +/** + * \brief Set the serial number for a Certificate. + * + * \param ctx CRT context to use + * \param serial serial number to set + * + * \return 0 if successful + */ +int mbedtls_x509write_crt_set_serial( mbedtls_x509write_cert *ctx, const mbedtls_mpi *serial ); + +/** + * \brief Set the validity period for a Certificate + * Timestamps should be in string format for UTC timezone + * i.e. "YYYYMMDDhhmmss" + * e.g. "20131231235959" for December 31st 2013 + * at 23:59:59 + * + * \param ctx CRT context to use + * \param not_before not_before timestamp + * \param not_after not_after timestamp + * + * \return 0 if timestamp was parsed successfully, or + * a specific error code + */ +int mbedtls_x509write_crt_set_validity( mbedtls_x509write_cert *ctx, const char *not_before, + const char *not_after ); + +/** + * \brief Set the issuer name for a Certificate + * Issuer names should contain a comma-separated list + * of OID types and values: + * e.g. "C=UK,O=ARM,CN=mbed TLS CA" + * + * \param ctx CRT context to use + * \param issuer_name issuer name to set + * + * \return 0 if issuer name was parsed successfully, or + * a specific error code + */ +int mbedtls_x509write_crt_set_issuer_name( mbedtls_x509write_cert *ctx, + const char *issuer_name ); + +/** + * \brief Set the subject name for a Certificate + * Subject names should contain a comma-separated list + * of OID types and values: + * e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" + * + * \param ctx CRT context to use + * \param subject_name subject name to set + * + * \return 0 if subject name was parsed successfully, or + * a specific error code + */ +int mbedtls_x509write_crt_set_subject_name( mbedtls_x509write_cert *ctx, + const char *subject_name ); + +/** + * \brief Set the subject public key for the certificate + * + * \param ctx CRT context to use + * \param key public key to include + */ +void mbedtls_x509write_crt_set_subject_key( mbedtls_x509write_cert *ctx, mbedtls_pk_context *key ); + +/** + * \brief Set the issuer key used for signing the certificate + * + * \param ctx CRT context to use + * \param key private key to sign with + */ +void mbedtls_x509write_crt_set_issuer_key( mbedtls_x509write_cert *ctx, mbedtls_pk_context *key ); + +/** + * \brief Set the MD algorithm to use for the signature + * (e.g. MBEDTLS_MD_SHA1) + * + * \param ctx CRT context to use + * \param md_alg MD algorithm to use + */ +void mbedtls_x509write_crt_set_md_alg( mbedtls_x509write_cert *ctx, mbedtls_md_type_t md_alg ); + +/** + * \brief Generic function to add to or replace an extension in the + * CRT + * + * \param ctx CRT context to use + * \param oid OID of the extension + * \param oid_len length of the OID + * \param critical if the extension is critical (per the RFC's definition) + * \param val value of the extension OCTET STRING + * \param val_len length of the value data + * + * \return 0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_extension( mbedtls_x509write_cert *ctx, + const char *oid, size_t oid_len, + int critical, + const unsigned char *val, size_t val_len ); + +/** + * \brief Set the basicConstraints extension for a CRT + * + * \param ctx CRT context to use + * \param is_ca is this a CA certificate + * \param max_pathlen maximum length of certificate chains below this + * certificate (only for CA certificates, -1 is + * unlimited) + * + * \return 0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_basic_constraints( mbedtls_x509write_cert *ctx, + int is_ca, int max_pathlen ); + +#if defined(MBEDTLS_SHA1_C) +/** + * \brief Set the subjectKeyIdentifier extension for a CRT + * Requires that mbedtls_x509write_crt_set_subject_key() has been + * called before + * + * \param ctx CRT context to use + * + * \return 0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_subject_key_identifier( mbedtls_x509write_cert *ctx ); + +/** + * \brief Set the authorityKeyIdentifier extension for a CRT + * Requires that mbedtls_x509write_crt_set_issuer_key() has been + * called before + * + * \param ctx CRT context to use + * + * \return 0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_authority_key_identifier( mbedtls_x509write_cert *ctx ); +#endif /* MBEDTLS_SHA1_C */ + +/** + * \brief Set the Key Usage Extension flags + * (e.g. MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_KEY_CERT_SIGN) + * + * \param ctx CRT context to use + * \param key_usage key usage flags to set + * + * \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_key_usage( mbedtls_x509write_cert *ctx, + unsigned int key_usage ); + +/** + * \brief Set the Netscape Cert Type flags + * (e.g. MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT | MBEDTLS_X509_NS_CERT_TYPE_EMAIL) + * + * \param ctx CRT context to use + * \param ns_cert_type Netscape Cert Type flags to set + * + * \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_ns_cert_type( mbedtls_x509write_cert *ctx, + unsigned char ns_cert_type ); + +/** + * \brief Free the contents of a CRT write context + * + * \param ctx CRT context to free + */ +void mbedtls_x509write_crt_free( mbedtls_x509write_cert *ctx ); + +/** + * \brief Write a built up certificate to a X509 DER structure + * Note: data is written at the end of the buffer! Use the + * return value to determine where you should start + * using the buffer + * + * \param ctx certificate to write away + * \param buf buffer to write to + * \param size size of the buffer + * \param f_rng RNG function (for signature, see note) + * \param p_rng RNG parameter + * + * \return length of data written if successful, or a specific + * error code + * + * \note f_rng may be NULL if RSA is used for signature and the + * signature is made offline (otherwise f_rng is desirable + * for countermeasures against timing attacks). + * ECDSA signatures always require a non-NULL f_rng. + */ +int mbedtls_x509write_crt_der( mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +#if defined(MBEDTLS_PEM_WRITE_C) +/** + * \brief Write a built up certificate to a X509 PEM string + * + * \param ctx certificate to write away + * \param buf buffer to write to + * \param size size of the buffer + * \param f_rng RNG function (for signature, see note) + * \param p_rng RNG parameter + * + * \return 0 if successful, or a specific error code + * + * \note f_rng may be NULL if RSA is used for signature and the + * signature is made offline (otherwise f_rng is desirable + * for countermeasures against timing attacks). + * ECDSA signatures always require a non-NULL f_rng. + */ +int mbedtls_x509write_crt_pem( mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); +#endif /* MBEDTLS_PEM_WRITE_C */ +#endif /* MBEDTLS_X509_CRT_WRITE_C */ + +/** \} addtogroup x509_module */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_x509_crt.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/x509_csr.h b/openharmony/arm64-v8a/include/mbedtls/x509_csr.h new file mode 100644 index 00000000..2a1c0461 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/x509_csr.h @@ -0,0 +1,306 @@ +/** + * \file x509_csr.h + * + * \brief X.509 certificate signing request parsing and writing + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_X509_CSR_H +#define MBEDTLS_X509_CSR_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/x509.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \addtogroup x509_module + * \{ */ + +/** + * \name Structures and functions for X.509 Certificate Signing Requests (CSR) + * \{ + */ + +/** + * Certificate Signing Request (CSR) structure. + */ +typedef struct mbedtls_x509_csr +{ + mbedtls_x509_buf raw; /**< The raw CSR data (DER). */ + mbedtls_x509_buf cri; /**< The raw CertificateRequestInfo body (DER). */ + + int version; /**< CSR version (1=v1). */ + + mbedtls_x509_buf subject_raw; /**< The raw subject data (DER). */ + mbedtls_x509_name subject; /**< The parsed subject data (named information object). */ + + mbedtls_pk_context pk; /**< Container for the public key context. */ + + mbedtls_x509_buf sig_oid; + mbedtls_x509_buf sig; + mbedtls_md_type_t sig_md; /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */ + mbedtls_pk_type_t sig_pk; /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */ + void *sig_opts; /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */ +} +mbedtls_x509_csr; + +/** + * Container for writing a CSR + */ +typedef struct mbedtls_x509write_csr +{ + mbedtls_pk_context *key; + mbedtls_asn1_named_data *subject; + mbedtls_md_type_t md_alg; + mbedtls_asn1_named_data *extensions; +} +mbedtls_x509write_csr; + +#if defined(MBEDTLS_X509_CSR_PARSE_C) +/** + * \brief Load a Certificate Signing Request (CSR) in DER format + * + * \note CSR attributes (if any) are currently silently ignored. + * + * \param csr CSR context to fill + * \param buf buffer holding the CRL data + * \param buflen size of the buffer + * + * \return 0 if successful, or a specific X509 error code + */ +int mbedtls_x509_csr_parse_der( mbedtls_x509_csr *csr, + const unsigned char *buf, size_t buflen ); + +/** + * \brief Load a Certificate Signing Request (CSR), DER or PEM format + * + * \note See notes for \c mbedtls_x509_csr_parse_der() + * + * \param csr CSR context to fill + * \param buf buffer holding the CRL data + * \param buflen size of the buffer + * (including the terminating null byte for PEM data) + * + * \return 0 if successful, or a specific X509 or PEM error code + */ +int mbedtls_x509_csr_parse( mbedtls_x509_csr *csr, const unsigned char *buf, size_t buflen ); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief Load a Certificate Signing Request (CSR) + * + * \note See notes for \c mbedtls_x509_csr_parse() + * + * \param csr CSR context to fill + * \param path filename to read the CSR from + * + * \return 0 if successful, or a specific X509 or PEM error code + */ +int mbedtls_x509_csr_parse_file( mbedtls_x509_csr *csr, const char *path ); +#endif /* MBEDTLS_FS_IO */ + +/** + * \brief Returns an informational string about the + * CSR. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param prefix A line prefix + * \param csr The X509 CSR to represent + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_csr_info( char *buf, size_t size, const char *prefix, + const mbedtls_x509_csr *csr ); + +/** + * \brief Initialize a CSR + * + * \param csr CSR to initialize + */ +void mbedtls_x509_csr_init( mbedtls_x509_csr *csr ); + +/** + * \brief Unallocate all CSR data + * + * \param csr CSR to free + */ +void mbedtls_x509_csr_free( mbedtls_x509_csr *csr ); +#endif /* MBEDTLS_X509_CSR_PARSE_C */ + +/** \} name Structures and functions for X.509 Certificate Signing Requests (CSR) */ + +#if defined(MBEDTLS_X509_CSR_WRITE_C) +/** + * \brief Initialize a CSR context + * + * \param ctx CSR context to initialize + */ +void mbedtls_x509write_csr_init( mbedtls_x509write_csr *ctx ); + +/** + * \brief Set the subject name for a CSR + * Subject names should contain a comma-separated list + * of OID types and values: + * e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" + * + * \param ctx CSR context to use + * \param subject_name subject name to set + * + * \return 0 if subject name was parsed successfully, or + * a specific error code + */ +int mbedtls_x509write_csr_set_subject_name( mbedtls_x509write_csr *ctx, + const char *subject_name ); + +/** + * \brief Set the key for a CSR (public key will be included, + * private key used to sign the CSR when writing it) + * + * \param ctx CSR context to use + * \param key Asymmetric key to include + */ +void mbedtls_x509write_csr_set_key( mbedtls_x509write_csr *ctx, mbedtls_pk_context *key ); + +/** + * \brief Set the MD algorithm to use for the signature + * (e.g. MBEDTLS_MD_SHA1) + * + * \param ctx CSR context to use + * \param md_alg MD algorithm to use + */ +void mbedtls_x509write_csr_set_md_alg( mbedtls_x509write_csr *ctx, mbedtls_md_type_t md_alg ); + +/** + * \brief Set the Key Usage Extension flags + * (e.g. MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_KEY_CERT_SIGN) + * + * \param ctx CSR context to use + * \param key_usage key usage flags to set + * + * \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + * + * \note The decipherOnly flag from the Key Usage + * extension is represented by bit 8 (i.e. + * 0x8000), which cannot typically be represented + * in an unsigned char. Therefore, the flag + * decipherOnly (i.e. + * #MBEDTLS_X509_KU_DECIPHER_ONLY) cannot be set using this + * function. + */ +int mbedtls_x509write_csr_set_key_usage( mbedtls_x509write_csr *ctx, unsigned char key_usage ); + +/** + * \brief Set the Netscape Cert Type flags + * (e.g. MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT | MBEDTLS_X509_NS_CERT_TYPE_EMAIL) + * + * \param ctx CSR context to use + * \param ns_cert_type Netscape Cert Type flags to set + * + * \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_csr_set_ns_cert_type( mbedtls_x509write_csr *ctx, + unsigned char ns_cert_type ); + +/** + * \brief Generic function to add to or replace an extension in the + * CSR + * + * \param ctx CSR context to use + * \param oid OID of the extension + * \param oid_len length of the OID + * \param val value of the extension OCTET STRING + * \param val_len length of the value data + * + * \return 0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_csr_set_extension( mbedtls_x509write_csr *ctx, + const char *oid, size_t oid_len, + const unsigned char *val, size_t val_len ); + +/** + * \brief Free the contents of a CSR context + * + * \param ctx CSR context to free + */ +void mbedtls_x509write_csr_free( mbedtls_x509write_csr *ctx ); + +/** + * \brief Write a CSR (Certificate Signing Request) to a + * DER structure + * Note: data is written at the end of the buffer! Use the + * return value to determine where you should start + * using the buffer + * + * \param ctx CSR to write away + * \param buf buffer to write to + * \param size size of the buffer + * \param f_rng RNG function (for signature, see note) + * \param p_rng RNG parameter + * + * \return length of data written if successful, or a specific + * error code + * + * \note f_rng may be NULL if RSA is used for signature and the + * signature is made offline (otherwise f_rng is desirable + * for countermeasures against timing attacks). + * ECDSA signatures always require a non-NULL f_rng. + */ +int mbedtls_x509write_csr_der( mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +#if defined(MBEDTLS_PEM_WRITE_C) +/** + * \brief Write a CSR (Certificate Signing Request) to a + * PEM string + * + * \param ctx CSR to write away + * \param buf buffer to write to + * \param size size of the buffer + * \param f_rng RNG function (for signature, see note) + * \param p_rng RNG parameter + * + * \return 0 if successful, or a specific error code + * + * \note f_rng may be NULL if RSA is used for signature and the + * signature is made offline (otherwise f_rng is desirable + * for countermeasures against timing attacks). + * ECDSA signatures always require a non-NULL f_rng. + */ +int mbedtls_x509write_csr_pem( mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); +#endif /* MBEDTLS_PEM_WRITE_C */ +#endif /* MBEDTLS_X509_CSR_WRITE_C */ + +/** \} addtogroup x509_module */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_x509_csr.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls/xtea.h b/openharmony/arm64-v8a/include/mbedtls/xtea.h new file mode 100644 index 00000000..4bdc711f --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls/xtea.h @@ -0,0 +1,139 @@ +/** + * \file xtea.h + * + * \brief XTEA block cipher (32-bit) + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_XTEA_H +#define MBEDTLS_XTEA_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +#define MBEDTLS_XTEA_ENCRYPT 1 +#define MBEDTLS_XTEA_DECRYPT 0 + +/** The data input has an invalid length. */ +#define MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH -0x0028 + +/* MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** XTEA hardware accelerator failed. */ +#define MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED -0x0029 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_XTEA_ALT) +// Regular implementation +// + +/** + * \brief XTEA context structure + */ +typedef struct mbedtls_xtea_context +{ + uint32_t k[4]; /*!< key */ +} +mbedtls_xtea_context; + +#else /* MBEDTLS_XTEA_ALT */ +#include "xtea_alt.h" +#endif /* MBEDTLS_XTEA_ALT */ + +/** + * \brief Initialize XTEA context + * + * \param ctx XTEA context to be initialized + */ +void mbedtls_xtea_init( mbedtls_xtea_context *ctx ); + +/** + * \brief Clear XTEA context + * + * \param ctx XTEA context to be cleared + */ +void mbedtls_xtea_free( mbedtls_xtea_context *ctx ); + +/** + * \brief XTEA key schedule + * + * \param ctx XTEA context to be initialized + * \param key the secret key + */ +void mbedtls_xtea_setup( mbedtls_xtea_context *ctx, const unsigned char key[16] ); + +/** + * \brief XTEA cipher function + * + * \param ctx XTEA context + * \param mode MBEDTLS_XTEA_ENCRYPT or MBEDTLS_XTEA_DECRYPT + * \param input 8-byte input block + * \param output 8-byte output block + * + * \return 0 if successful + */ +int mbedtls_xtea_crypt_ecb( mbedtls_xtea_context *ctx, + int mode, + const unsigned char input[8], + unsigned char output[8] ); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief XTEA CBC cipher function + * + * \param ctx XTEA context + * \param mode MBEDTLS_XTEA_ENCRYPT or MBEDTLS_XTEA_DECRYPT + * \param length the length of input, multiple of 8 + * \param iv initialization vector for CBC mode + * \param input input block + * \param output output block + * + * \return 0 if successful, + * MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH if the length % 8 != 0 + */ +int mbedtls_xtea_crypt_cbc( mbedtls_xtea_context *ctx, + int mode, + size_t length, + unsigned char iv[8], + const unsigned char *input, + unsigned char *output); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_xtea_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* xtea.h */ diff --git a/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl3.h b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl3.h new file mode 100644 index 00000000..007b392f --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl3.h @@ -0,0 +1,44 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL3_H_ +#define _SSL3_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +# define SSL3_AD_CLOSE_NOTIFY 0 +# define SSL3_AD_UNEXPECTED_MESSAGE 10/* fatal */ +# define SSL3_AD_BAD_RECORD_MAC 20/* fatal */ +# define SSL3_AD_DECOMPRESSION_FAILURE 30/* fatal */ +# define SSL3_AD_HANDSHAKE_FAILURE 40/* fatal */ +# define SSL3_AD_NO_CERTIFICATE 41 +# define SSL3_AD_BAD_CERTIFICATE 42 +# define SSL3_AD_UNSUPPORTED_CERTIFICATE 43 +# define SSL3_AD_CERTIFICATE_REVOKED 44 +# define SSL3_AD_CERTIFICATE_EXPIRED 45 +# define SSL3_AD_CERTIFICATE_UNKNOWN 46 +# define SSL3_AD_ILLEGAL_PARAMETER 47/* fatal */ + +# define SSL3_AL_WARNING 1 +# define SSL3_AL_FATAL 2 + +#define SSL3_VERSION 0x0300 + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_cert.h b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_cert.h new file mode 100644 index 00000000..86cf31ad --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_cert.h @@ -0,0 +1,55 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_CERT_H_ +#define _SSL_CERT_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include "ssl_types.h" + +/** + * @brief create a certification object include private key object according to input certification + * + * @param ic - input certification point + * + * @return certification object point + */ +CERT *__ssl_cert_new(CERT *ic); + +/** + * @brief create a certification object include private key object + * + * @param none + * + * @return certification object point + */ +CERT* ssl_cert_new(void); + +/** + * @brief free a certification object + * + * @param cert - certification object point + * + * @return none + */ +void ssl_cert_free(CERT *cert); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_code.h b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_code.h new file mode 100644 index 00000000..80fdbb20 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_code.h @@ -0,0 +1,124 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_CODE_H_ +#define _SSL_CODE_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include "ssl3.h" +#include "tls1.h" +#include "x509_vfy.h" + +/* Used in SSL_set_shutdown()/SSL_get_shutdown(); */ +# define SSL_SENT_SHUTDOWN 1 +# define SSL_RECEIVED_SHUTDOWN 2 + +# define SSL_VERIFY_NONE 0x00 +# define SSL_VERIFY_PEER 0x01 +# define SSL_VERIFY_FAIL_IF_NO_PEER_CERT 0x02 +# define SSL_VERIFY_CLIENT_ONCE 0x04 + +/* + * The following 3 states are kept in ssl->rlayer.rstate when reads fail, you + * should not need these + */ +# define SSL_ST_READ_HEADER 0xF0 +# define SSL_ST_READ_BODY 0xF1 +# define SSL_ST_READ_DONE 0xF2 + +# define SSL_NOTHING 1 +# define SSL_WRITING 2 +# define SSL_READING 3 +# define SSL_X509_LOOKUP 4 +# define SSL_ASYNC_PAUSED 5 +# define SSL_ASYNC_NO_JOBS 6 + + +# define SSL_ERROR_NONE 0 +# define SSL_ERROR_SSL 1 +# define SSL_ERROR_WANT_READ 2 +# define SSL_ERROR_WANT_WRITE 3 +# define SSL_ERROR_WANT_X509_LOOKUP 4 +# define SSL_ERROR_SYSCALL 5/* look at error stack/return value/errno */ +# define SSL_ERROR_ZERO_RETURN 6 +# define SSL_ERROR_WANT_CONNECT 7 +# define SSL_ERROR_WANT_ACCEPT 8 +# define SSL_ERROR_WANT_ASYNC 9 +# define SSL_ERROR_WANT_ASYNC_JOB 10 + +/* Message flow states */ +typedef enum { + /* No handshake in progress */ + MSG_FLOW_UNINITED, + /* A permanent error with this connection */ + MSG_FLOW_ERROR, + /* We are about to renegotiate */ + MSG_FLOW_RENEGOTIATE, + /* We are reading messages */ + MSG_FLOW_READING, + /* We are writing messages */ + MSG_FLOW_WRITING, + /* Handshake has finished */ + MSG_FLOW_FINISHED +} MSG_FLOW_STATE; + +/* SSL subsystem states */ +typedef enum { + TLS_ST_BEFORE, + TLS_ST_OK, + DTLS_ST_CR_HELLO_VERIFY_REQUEST, + TLS_ST_CR_SRVR_HELLO, + TLS_ST_CR_CERT, + TLS_ST_CR_CERT_STATUS, + TLS_ST_CR_KEY_EXCH, + TLS_ST_CR_CERT_REQ, + TLS_ST_CR_SRVR_DONE, + TLS_ST_CR_SESSION_TICKET, + TLS_ST_CR_CHANGE, + TLS_ST_CR_FINISHED, + TLS_ST_CW_CLNT_HELLO, + TLS_ST_CW_CERT, + TLS_ST_CW_KEY_EXCH, + TLS_ST_CW_CERT_VRFY, + TLS_ST_CW_CHANGE, + TLS_ST_CW_NEXT_PROTO, + TLS_ST_CW_FINISHED, + TLS_ST_SW_HELLO_REQ, + TLS_ST_SR_CLNT_HELLO, + DTLS_ST_SW_HELLO_VERIFY_REQUEST, + TLS_ST_SW_SRVR_HELLO, + TLS_ST_SW_CERT, + TLS_ST_SW_KEY_EXCH, + TLS_ST_SW_CERT_REQ, + TLS_ST_SW_SRVR_DONE, + TLS_ST_SR_CERT, + TLS_ST_SR_KEY_EXCH, + TLS_ST_SR_CERT_VRFY, + TLS_ST_SR_NEXT_PROTO, + TLS_ST_SR_CHANGE, + TLS_ST_SR_FINISHED, + TLS_ST_SW_SESSION_TICKET, + TLS_ST_SW_CERT_STATUS, + TLS_ST_SW_CHANGE, + TLS_ST_SW_FINISHED +} OSSL_HANDSHAKE_STATE; + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_dbg.h b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_dbg.h new file mode 100644 index 00000000..ad32cb92 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_dbg.h @@ -0,0 +1,190 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_DEBUG_H_ +#define _SSL_DEBUG_H_ + +#include "platform/ssl_port.h" + +#ifdef __cplusplus + extern "C" { +#endif + +#ifdef CONFIG_OPENSSL_DEBUG_LEVEL + #define SSL_DEBUG_LEVEL CONFIG_OPENSSL_DEBUG_LEVEL +#else + #define SSL_DEBUG_LEVEL 0 +#endif + +#define SSL_DEBUG_ON (SSL_DEBUG_LEVEL + 1) +#define SSL_DEBUG_OFF (SSL_DEBUG_LEVEL - 1) + +#ifdef CONFIG_OPENSSL_DEBUG + #ifndef SSL_DEBUG_LOG + #error "SSL_DEBUG_LOG is not defined" + #endif + + #ifndef SSL_DEBUG_FL + #define SSL_DEBUG_FL "\n" + #endif + + #define SSL_SHOW_LOCATION() \ + SSL_DEBUG_LOG("SSL assert : %s %d\n", \ + __FILE__, __LINE__) + + #define SSL_DEBUG(level, fmt, ...) \ + { \ + if (level > SSL_DEBUG_LEVEL) { \ + SSL_DEBUG_LOG(fmt SSL_DEBUG_FL, ##__VA_ARGS__); \ + } \ + } +#else /* CONFIG_OPENSSL_DEBUG */ + #define SSL_SHOW_LOCATION() + + #define SSL_DEBUG(level, fmt, ...) +#endif /* CONFIG_OPENSSL_DEBUG */ + +/** + * OpenSSL assert function + * + * if select "CONFIG_OPENSSL_ASSERT_DEBUG", SSL_ASSERT* will show error file name and line + * if select "CONFIG_OPENSSL_ASSERT_EXIT", SSL_ASSERT* will just return error code. + * if select "CONFIG_OPENSSL_ASSERT_DEBUG_EXIT" SSL_ASSERT* will show error file name and line, + * then return error code. + * if select "CONFIG_OPENSSL_ASSERT_DEBUG_BLOCK", SSL_ASSERT* will show error file name and line, + * then block here with "while (1)" + * + * SSL_ASSERT1 may will return "-1", so function's return argument is integer. + * SSL_ASSERT2 may will return "NULL", so function's return argument is a point. + * SSL_ASSERT2 may will return nothing, so function's return argument is "void". + */ +#if defined(CONFIG_OPENSSL_ASSERT_DEBUG) + #define SSL_ASSERT1(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + } \ + } + + #define SSL_ASSERT2(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + } \ + } + + #define SSL_ASSERT3(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + } \ + } +#elif defined(CONFIG_OPENSSL_ASSERT_EXIT) + #define SSL_ASSERT1(s) \ + { \ + if (!(s)) { \ + return -1; \ + } \ + } + + #define SSL_ASSERT2(s) \ + { \ + if (!(s)) { \ + return NULL; \ + } \ + } + + #define SSL_ASSERT3(s) \ + { \ + if (!(s)) { \ + return ; \ + } \ + } +#elif defined(CONFIG_OPENSSL_ASSERT_DEBUG_EXIT) + #define SSL_ASSERT1(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + return -1; \ + } \ + } + + #define SSL_ASSERT2(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + return NULL; \ + } \ + } + + #define SSL_ASSERT3(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + return ; \ + } \ + } +#elif defined(CONFIG_OPENSSL_ASSERT_DEBUG_BLOCK) + #define SSL_ASSERT1(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + while (1); \ + } \ + } + + #define SSL_ASSERT2(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + while (1); \ + } \ + } + + #define SSL_ASSERT3(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + while (1); \ + } \ + } +#else + #define SSL_ASSERT1(s) + #define SSL_ASSERT2(s) + #define SSL_ASSERT3(s) +#endif + +#define SSL_PLATFORM_DEBUG_LEVEL SSL_DEBUG_OFF +#define SSL_PLATFORM_ERROR_LEVEL SSL_DEBUG_ON + +#define SSL_CERT_DEBUG_LEVEL SSL_DEBUG_OFF +#define SSL_CERT_ERROR_LEVEL SSL_DEBUG_ON + +#define SSL_PKEY_DEBUG_LEVEL SSL_DEBUG_OFF +#define SSL_PKEY_ERROR_LEVEL SSL_DEBUG_ON + +#define SSL_X509_DEBUG_LEVEL SSL_DEBUG_OFF +#define SSL_X509_ERROR_LEVEL SSL_DEBUG_ON + +#define SSL_LIB_DEBUG_LEVEL SSL_DEBUG_OFF +#define SSL_LIB_ERROR_LEVEL SSL_DEBUG_ON + +#define SSL_STACK_DEBUG_LEVEL SSL_DEBUG_OFF +#define SSL_STACK_ERROR_LEVEL SSL_DEBUG_ON + +#ifdef __cplusplus + } +#endif + +#endif diff --git a/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_lib.h b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_lib.h new file mode 100644 index 00000000..42b2de75 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_lib.h @@ -0,0 +1,30 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_LIB_H_ +#define _SSL_LIB_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include "ssl_types.h" + + void _ssl_set_alpn_list(const SSL *ssl); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_methods.h b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_methods.h new file mode 100644 index 00000000..cd2f8c05 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_methods.h @@ -0,0 +1,121 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_METHODS_H_ +#define _SSL_METHODS_H_ + +#include "ssl_types.h" + +#ifdef __cplusplus + extern "C" { +#endif + +/** + * TLS method function implement + */ +#define IMPLEMENT_TLS_METHOD_FUNC(func_name, \ + new, free, \ + handshake, shutdown, clear, \ + read, send, pending, \ + set_fd, get_fd, \ + set_bufflen, \ + get_verify_result, \ + get_state) \ + static const SSL_METHOD_FUNC func_name LOCAL_ATRR = { \ + new, \ + free, \ + handshake, \ + shutdown, \ + clear, \ + read, \ + send, \ + pending, \ + set_fd, \ + get_fd, \ + set_bufflen, \ + get_verify_result, \ + get_state \ + }; + +#define IMPLEMENT_TLS_METHOD(ver, mode, fun, func_name) \ + const SSL_METHOD* func_name(void) { \ + static const SSL_METHOD func_name##_data LOCAL_ATRR = { \ + ver, \ + mode, \ + &(fun), \ + }; \ + return &func_name##_data; \ + } + +#define IMPLEMENT_SSL_METHOD(ver, mode, fun, func_name) \ + const SSL_METHOD* func_name(void) { \ + static const SSL_METHOD func_name##_data LOCAL_ATRR = { \ + ver, \ + mode, \ + &(fun), \ + }; \ + return &func_name##_data; \ + } + +#define IMPLEMENT_X509_METHOD(func_name, \ + new, \ + free, \ + load, \ + show_info) \ + const X509_METHOD* func_name(void) { \ + static const X509_METHOD func_name##_data LOCAL_ATRR = { \ + new, \ + free, \ + load, \ + show_info \ + }; \ + return &func_name##_data; \ + } + +#define IMPLEMENT_PKEY_METHOD(func_name, \ + new, \ + free, \ + load) \ + const PKEY_METHOD* func_name(void) { \ + static const PKEY_METHOD func_name##_data LOCAL_ATRR = { \ + new, \ + free, \ + load \ + }; \ + return &func_name##_data; \ + } + +/** + * @brief get X509 object method + * + * @param none + * + * @return X509 object method point + */ +const X509_METHOD* X509_method(void); + +/** + * @brief get private key object method + * + * @param none + * + * @return private key object method point + */ +const PKEY_METHOD* EVP_PKEY_method(void); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_pkey.h b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_pkey.h new file mode 100644 index 00000000..e790fcc9 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_pkey.h @@ -0,0 +1,86 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_PKEY_H_ +#define _SSL_PKEY_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include "ssl_types.h" + +/** + * @brief create a private key object according to input private key + * + * @param ipk - input private key point + * + * @return new private key object point + */ +EVP_PKEY* __EVP_PKEY_new(EVP_PKEY *ipk); + +/** + * @brief create a private key object + * + * @param none + * + * @return private key object point + */ +EVP_PKEY* EVP_PKEY_new(void); + +/** + * @brief load a character key context into system context. If '*a' is pointed to the + * private key, then load key into it. Or create a new private key object + * + * @param type - private key type + * @param a - a point pointed to a private key point + * @param pp - a point pointed to the key context memory point + * @param length - key bytes + * + * @return private key object point + */ +EVP_PKEY* d2i_PrivateKey(int type, + EVP_PKEY **a, + const unsigned char **pp, + long length); + +/** + * @brief free a private key object + * + * @param pkey - private key object point + * + * @return none + */ +void EVP_PKEY_free(EVP_PKEY *x); + +/** + * @brief load private key into the SSL + * + * @param type - private key type + * @param ssl - SSL point + * @param len - data bytes + * @param d - data point + * + * @return result + * 0 : failed + * 1 : OK + */ + int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d, long len); + + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_stack.h b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_stack.h new file mode 100644 index 00000000..7a7051a0 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_stack.h @@ -0,0 +1,52 @@ +#ifndef _SSL_STACK_H_ +#define _SSL_STACK_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include "ssl_types.h" + +#define STACK_OF(type) struct stack_st_##type + +#define SKM_DEFINE_STACK_OF(t1, t2, t3) \ + STACK_OF(t1); \ + static ossl_inline STACK_OF(t1) *sk_##t1##_new_null(void) \ + { \ + return (STACK_OF(t1) *)OPENSSL_sk_new_null(); \ + } \ + +#define DEFINE_STACK_OF(t) SKM_DEFINE_STACK_OF(t, t, t) + +/** + * @brief create a openssl stack object + * + * @param c - stack function + * + * @return openssl stack object point + */ +OPENSSL_STACK* OPENSSL_sk_new(OPENSSL_sk_compfunc c); + +/** + * @brief create a NULL function openssl stack object + * + * @param none + * + * @return openssl stack object point + */ +OPENSSL_STACK *OPENSSL_sk_new_null(void); + +/** + * @brief free openssl stack object + * + * @param openssl stack object point + * + * @return none + */ +void OPENSSL_sk_free(OPENSSL_STACK *stack); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_types.h b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_types.h new file mode 100644 index 00000000..2ca438c4 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_types.h @@ -0,0 +1,297 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_TYPES_H_ +#define _SSL_TYPES_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include +#if defined(LWS_WITH_ESP32) +#undef MBEDTLS_CONFIG_FILE +#define MBEDTLS_CONFIG_FILE +#endif + +#include "ssl_code.h" + +typedef void SSL_CIPHER; + +typedef void X509_STORE_CTX; +typedef void X509_STORE; + +typedef void RSA; + +typedef void STACK; +typedef void BIO; + +#define ossl_inline inline + +#define SSL_METHOD_CALL(f, s, ...) s->method->func->ssl_##f(s, ##__VA_ARGS__) +#define X509_METHOD_CALL(f, x, ...) x->method->x509_##f(x, ##__VA_ARGS__) +#define EVP_PKEY_METHOD_CALL(f, k, ...) k->method->pkey_##f(k, ##__VA_ARGS__) + +typedef int (*OPENSSL_sk_compfunc)(const void *, const void *); + +struct stack_st; +typedef struct stack_st OPENSSL_STACK; + +struct ssl_method_st; +typedef struct ssl_method_st SSL_METHOD; + +struct ssl_method_func_st; +typedef struct ssl_method_func_st SSL_METHOD_FUNC; + +struct record_layer_st; +typedef struct record_layer_st RECORD_LAYER; + +struct ossl_statem_st; +typedef struct ossl_statem_st OSSL_STATEM; + +struct ssl_session_st; +typedef struct ssl_session_st SSL_SESSION; + +struct ssl_ctx_st; +typedef struct ssl_ctx_st SSL_CTX; + +struct ssl_st; +typedef struct ssl_st SSL; + +struct cert_st; +typedef struct cert_st CERT; + +struct x509_st; +typedef struct x509_st X509; + +struct X509_VERIFY_PARAM_st; +typedef struct X509_VERIFY_PARAM_st X509_VERIFY_PARAM; + +struct evp_pkey_st; +typedef struct evp_pkey_st EVP_PKEY; + +struct x509_method_st; +typedef struct x509_method_st X509_METHOD; + +struct pkey_method_st; +typedef struct pkey_method_st PKEY_METHOD; + +struct stack_st { + + char **data; + + int num_alloc; + + OPENSSL_sk_compfunc c; +}; + +struct evp_pkey_st { + + void *pkey_pm; + + const PKEY_METHOD *method; +}; + +struct x509_st { + + /* X509 certification platform private point */ + void *x509_pm; + + const X509_METHOD *method; +}; + +struct cert_st { + + int sec_level; + + X509 *x509; + + EVP_PKEY *pkey; + +}; + +struct ossl_statem_st { + + MSG_FLOW_STATE state; + + int hand_state; +}; + +struct record_layer_st { + + int rstate; + + int read_ahead; +}; + +struct ssl_session_st { + + long timeout; + + long time; + + X509 *peer; +}; + +struct X509_VERIFY_PARAM_st { + + int depth; + +}; + +typedef int (*next_proto_cb)(SSL *ssl, unsigned char **out, + unsigned char *outlen, const unsigned char *in, + unsigned int inlen, void *arg); + +struct ssl_ctx_st +{ + int version; + + int references; + + unsigned long options; + + const SSL_METHOD *method; + + CERT *cert; + + X509 *client_CA; + + const char **alpn_protos; + + next_proto_cb alpn_cb; + + int verify_mode; + + int (*default_verify_callback) (int ok, X509_STORE_CTX *ctx); + + long session_timeout; + + int read_ahead; + + int read_buffer_len; + + X509_VERIFY_PARAM param; +}; + +struct ssl_st +{ + /* protocol version(one of SSL3.0, TLS1.0, etc.) */ + int version; + + unsigned long options; + + /* shut things down(0x01 : sent, 0x02 : received) */ + int shutdown; + + CERT *cert; + + X509 *client_CA; + + SSL_CTX *ctx; + + const SSL_METHOD *method; + + RECORD_LAYER rlayer; + + /* where we are */ + OSSL_STATEM statem; + + SSL_SESSION *session; + + int verify_mode; + + int (*verify_callback) (int ok, X509_STORE_CTX *ctx); + + int rwstate; + int interrupted_remaining_write; + + long verify_result; + + X509_VERIFY_PARAM param; + + int err; + + void (*info_callback) (const SSL *ssl, int type, int val); + + /* SSL low-level system arch point */ + void *ssl_pm; +}; + +struct ssl_method_st { + /* protocol version(one of SSL3.0, TLS1.0, etc.) */ + int version; + + /* SSL mode(client(0) , server(1), not known(-1)) */ + int endpoint; + + const SSL_METHOD_FUNC *func; +}; + +struct ssl_method_func_st { + + int (*ssl_new)(SSL *ssl); + + void (*ssl_free)(SSL *ssl); + + int (*ssl_handshake)(SSL *ssl); + + int (*ssl_shutdown)(SSL *ssl); + + int (*ssl_clear)(SSL *ssl); + + int (*ssl_read)(SSL *ssl, void *buffer, int len); + + int (*ssl_send)(SSL *ssl, const void *buffer, int len); + + int (*ssl_pending)(const SSL *ssl); + + void (*ssl_set_fd)(SSL *ssl, int fd, int mode); + + int (*ssl_get_fd)(const SSL *ssl, int mode); + + void (*ssl_set_bufflen)(SSL *ssl, int len); + + long (*ssl_get_verify_result)(const SSL *ssl); + + OSSL_HANDSHAKE_STATE (*ssl_get_state)(const SSL *ssl); +}; + +struct x509_method_st { + + int (*x509_new)(X509 *x, X509 *m_x); + + void (*x509_free)(X509 *x); + + int (*x509_load)(X509 *x, const unsigned char *buf, int len); + + int (*x509_show_info)(X509 *x); +}; + +struct pkey_method_st { + + int (*pkey_new)(EVP_PKEY *pkey, EVP_PKEY *m_pkey); + + void (*pkey_free)(EVP_PKEY *pkey); + + int (*pkey_load)(EVP_PKEY *pkey, const unsigned char *buf, int len); +}; + +#define OPENSSL_NPN_NEGOTIATED 1 + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_x509.h b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_x509.h new file mode 100644 index 00000000..7594d064 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/ssl_x509.h @@ -0,0 +1,110 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_X509_H_ +#define _SSL_X509_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include "ssl_types.h" +#include "ssl_stack.h" + +DEFINE_STACK_OF(X509_NAME) + +/** + * @brief create a X509 certification object according to input X509 certification + * + * @param ix - input X509 certification point + * + * @return new X509 certification object point + */ +X509* __X509_new(X509 *ix); + +/** + * @brief create a X509 certification object + * + * @param none + * + * @return X509 certification object point + */ +X509* X509_new(void); + +/** + * @brief load a character certification context into system context. If '*cert' is pointed to the + * certification, then load certification into it. Or create a new X509 certification object + * + * @param cert - a point pointed to X509 certification + * @param buffer - a point pointed to the certification context memory point + * @param length - certification bytes + * + * @return X509 certification object point + */ +X509* d2i_X509(X509 **cert, const unsigned char *buffer, long len); + +/** + * @brief free a X509 certification object + * + * @param x - X509 certification object point + * + * @return none + */ +void X509_free(X509 *x); + +/** + * @brief set SSL context client CA certification + * + * @param ctx - SSL context point + * @param x - X509 certification point + * + * @return result + * 0 : failed + * 1 : OK + */ +int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x); + +/** + * @brief add CA client certification into the SSL + * + * @param ssl - SSL point + * @param x - X509 certification point + * + * @return result + * 0 : failed + * 1 : OK + */ +int SSL_add_client_CA(SSL *ssl, X509 *x); + +/** + * @brief load certification into the SSL + * + * @param ssl - SSL point + * @param len - data bytes + * @param d - data point + * + * @return result + * 0 : failed + * 1 : OK + * + */ +int SSL_use_certificate_ASN1(SSL *ssl, int len, const unsigned char *d); + +const char *X509_verify_cert_error_string(long n); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/tls1.h b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/tls1.h new file mode 100644 index 00000000..7af1b015 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/tls1.h @@ -0,0 +1,58 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _TLS1_H_ +#define _TLS1_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +# define TLS1_AD_DECRYPTION_FAILED 21 +# define TLS1_AD_RECORD_OVERFLOW 22 +# define TLS1_AD_UNKNOWN_CA 48/* fatal */ +# define TLS1_AD_ACCESS_DENIED 49/* fatal */ +# define TLS1_AD_DECODE_ERROR 50/* fatal */ +# define TLS1_AD_DECRYPT_ERROR 51 +# define TLS1_AD_EXPORT_RESTRICTION 60/* fatal */ +# define TLS1_AD_PROTOCOL_VERSION 70/* fatal */ +# define TLS1_AD_INSUFFICIENT_SECURITY 71/* fatal */ +# define TLS1_AD_INTERNAL_ERROR 80/* fatal */ +# define TLS1_AD_INAPPROPRIATE_FALLBACK 86/* fatal */ +# define TLS1_AD_USER_CANCELLED 90 +# define TLS1_AD_NO_RENEGOTIATION 100 +/* codes 110-114 are from RFC3546 */ +# define TLS1_AD_UNSUPPORTED_EXTENSION 110 +# define TLS1_AD_CERTIFICATE_UNOBTAINABLE 111 +# define TLS1_AD_UNRECOGNIZED_NAME 112 +# define TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE 113 +# define TLS1_AD_BAD_CERTIFICATE_HASH_VALUE 114 +# define TLS1_AD_UNKNOWN_PSK_IDENTITY 115/* fatal */ +# define TLS1_AD_NO_APPLICATION_PROTOCOL 120 /* fatal */ + +/* Special value for method supporting multiple versions */ +#define TLS_ANY_VERSION 0x10000 + +#define TLS1_VERSION 0x0301 +#define TLS1_1_VERSION 0x0302 +#define TLS1_2_VERSION 0x0303 + +#define SSL_TLSEXT_ERR_OK 0 +#define SSL_TLSEXT_ERR_NOACK 3 + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/x509_vfy.h b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/x509_vfy.h new file mode 100644 index 00000000..e57e42bd --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls_wrapper/internal/x509_vfy.h @@ -0,0 +1,116 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _X509_VFY_H_ +#define _X509_VFY_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#define X509_V_OK 0 +#define X509_V_ERR_UNSPECIFIED 1 +#define X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT 2 +#define X509_V_ERR_UNABLE_TO_GET_CRL 3 +#define X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE 4 +#define X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE 5 +#define X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY 6 +#define X509_V_ERR_CERT_SIGNATURE_FAILURE 7 +#define X509_V_ERR_CRL_SIGNATURE_FAILURE 8 +#define X509_V_ERR_CERT_NOT_YET_VALID 9 +#define X509_V_ERR_CERT_HAS_EXPIRED 10 +#define X509_V_ERR_CRL_NOT_YET_VALID 11 +#define X509_V_ERR_CRL_HAS_EXPIRED 12 +#define X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD 13 +#define X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD 14 +#define X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD 15 +#define X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD 16 +#define X509_V_ERR_OUT_OF_MEM 17 +#define X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT 18 +#define X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN 19 +#define X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY 20 +#define X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE 21 +#define X509_V_ERR_CERT_CHAIN_TOO_LONG 22 +#define X509_V_ERR_CERT_REVOKED 23 +#define X509_V_ERR_INVALID_CA 24 +#define X509_V_ERR_PATH_LENGTH_EXCEEDED 25 +#define X509_V_ERR_INVALID_PURPOSE 26 +#define X509_V_ERR_CERT_UNTRUSTED 27 +#define X509_V_ERR_CERT_REJECTED 28 +/* These are 'informational' when looking for issuer cert */ +#define X509_V_ERR_SUBJECT_ISSUER_MISMATCH 29 +#define X509_V_ERR_AKID_SKID_MISMATCH 30 +#define X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH 31 +#define X509_V_ERR_KEYUSAGE_NO_CERTSIGN 32 +#define X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER 33 +#define X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION 34 +#define X509_V_ERR_KEYUSAGE_NO_CRL_SIGN 35 +#define X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION 36 +#define X509_V_ERR_INVALID_NON_CA 37 +#define X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED 38 +#define X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE 39 +#define X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED 40 +#define X509_V_ERR_INVALID_EXTENSION 41 +#define X509_V_ERR_INVALID_POLICY_EXTENSION 42 +#define X509_V_ERR_NO_EXPLICIT_POLICY 43 +#define X509_V_ERR_DIFFERENT_CRL_SCOPE 44 +#define X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE 45 +#define X509_V_ERR_UNNESTED_RESOURCE 46 +#define X509_V_ERR_PERMITTED_VIOLATION 47 +#define X509_V_ERR_EXCLUDED_VIOLATION 48 +#define X509_V_ERR_SUBTREE_MINMAX 49 +/* The application is not happy */ +#define X509_V_ERR_APPLICATION_VERIFICATION 50 +#define X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE 51 +#define X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX 52 +#define X509_V_ERR_UNSUPPORTED_NAME_SYNTAX 53 +#define X509_V_ERR_CRL_PATH_VALIDATION_ERROR 54 +/* Another issuer check debug option */ +#define X509_V_ERR_PATH_LOOP 55 +/* Suite B mode algorithm violation */ +#define X509_V_ERR_SUITE_B_INVALID_VERSION 56 +#define X509_V_ERR_SUITE_B_INVALID_ALGORITHM 57 +#define X509_V_ERR_SUITE_B_INVALID_CURVE 58 +#define X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM 59 +#define X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED 60 +#define X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256 61 +/* Host, email and IP check errors */ +#define X509_V_ERR_HOSTNAME_MISMATCH 62 +#define X509_V_ERR_EMAIL_MISMATCH 63 +#define X509_V_ERR_IP_ADDRESS_MISMATCH 64 +/* DANE TLSA errors */ +#define X509_V_ERR_DANE_NO_MATCH 65 +/* security level errors */ +#define X509_V_ERR_EE_KEY_TOO_SMALL 66 +#define X509_V_ERR_CA_KEY_TOO_SMALL 67 +#define X509_V_ERR_CA_MD_TOO_WEAK 68 +/* Caller error */ +#define X509_V_ERR_INVALID_CALL 69 +/* Issuer lookup error */ +#define X509_V_ERR_STORE_LOOKUP 70 +/* Certificate transparency */ +#define X509_V_ERR_NO_VALID_SCTS 71 + +#define X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION 72 + +typedef void X509_STORE_CTX; +int X509_STORE_CTX_get_error(X509_STORE_CTX *ctx); +int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx); + + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/arm64-v8a/include/mbedtls_wrapper/openssl/ssl.h b/openharmony/arm64-v8a/include/mbedtls_wrapper/openssl/ssl.h new file mode 100644 index 00000000..bea50b75 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls_wrapper/openssl/ssl.h @@ -0,0 +1,1816 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_H_ +#define _SSL_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include +#include "internal/ssl_x509.h" +#include "internal/ssl_pkey.h" + +/* +{ +*/ + +#define SSL_CB_ALERT 0x4000 + +#define X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT (1 << 0) +#define X509_CHECK_FLAG_NO_WILDCARDS (1 << 1) +#define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS (1 << 2) +#define X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS (1 << 3) +#define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS (1 << 4) + +/** + * @brief create a SSL context + * + * @param method - the SSL context method point + * + * @return the context point + */ +SSL_CTX* SSL_CTX_new(const SSL_METHOD *method); + +/** + * @brief free a SSL context + * + * @param method - the SSL context point + * + * @return none + */ +void SSL_CTX_free(SSL_CTX *ctx); + +/** + * @brief create a SSL + * + * @param ctx - the SSL context point + * + * @return the SSL point + */ +SSL* SSL_new(SSL_CTX *ctx); + +/** + * @brief free the SSL + * + * @param ssl - the SSL point + * + * @return none + */ +void SSL_free(SSL *ssl); + +/** + * @brief connect to the remote SSL server + * + * @param ssl - the SSL point + * + * @return result + * 1 : OK + * -1 : failed + */ +int SSL_connect(SSL *ssl); + +/** + * @brief accept the remote connection + * + * @param ssl - the SSL point + * + * @return result + * 1 : OK + * -1 : failed + */ +int SSL_accept(SSL *ssl); + +/** + * @brief read data from to remote + * + * @param ssl - the SSL point which has been connected + * @param buffer - the received data buffer point + * @param len - the received data length + * + * @return result + * > 0 : OK, and return received data bytes + * = 0 : connection is closed + * < 0 : an error catch + */ +int SSL_read(SSL *ssl, void *buffer, int len); + +/** + * @brief send the data to remote + * + * @param ssl - the SSL point which has been connected + * @param buffer - the send data buffer point + * @param len - the send data length + * + * @return result + * > 0 : OK, and return sent data bytes + * = 0 : connection is closed + * < 0 : an error catch + */ +int SSL_write(SSL *ssl, const void *buffer, int len); + +/** + * @brief get the verifying result of the SSL certification + * + * @param ssl - the SSL point + * + * @return the result of verifying + */ +long SSL_get_verify_result(const SSL *ssl); + +/** + * @brief shutdown the connection + * + * @param ssl - the SSL point + * + * @return result + * 1 : OK + * 0 : shutdown is not finished + * -1 : an error catch + */ +int SSL_shutdown(SSL *ssl); + +/** + * @brief bind the socket file description into the SSL + * + * @param ssl - the SSL point + * @param fd - socket handle + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_set_fd(SSL *ssl, int fd); + +/** + * @brief These functions load the private key into the SSL_CTX or SSL object + * + * @param ctx - the SSL context point + * @param pkey - private key object point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey); + +/** + * @brief These functions load the certification into the SSL_CTX or SSL object + * + * @param ctx - the SSL context point + * @param pkey - certification object point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x); + +/** + * @brief create the target SSL context client method + * + * @param none + * + * @return the SSLV2.3 version SSL context client method + */ +const SSL_METHOD* SSLv23_client_method(void); + +/** + * @brief create the target SSL context client method + * + * @param none + * + * @return the TLSV1.0 version SSL context client method + */ +const SSL_METHOD* TLSv1_client_method(void); + +/** + * @brief create the target SSL context client method + * + * @param none + * + * @return the SSLV1.0 version SSL context client method + */ +const SSL_METHOD* SSLv3_client_method(void); + +/** + * @brief create the target SSL context client method + * + * @param none + * + * @return the TLSV1.1 version SSL context client method + */ +const SSL_METHOD* TLSv1_1_client_method(void); + +/** + * @brief create the target SSL context client method + * + * @param none + * + * @return the TLSV1.2 version SSL context client method + */ +const SSL_METHOD* TLSv1_2_client_method(void); + +/** + * @brief create the target SSL context server method + * + * @param none + * + * @return the TLS any version SSL context client method + */ +const SSL_METHOD* TLS_client_method(void); + +/** + * @brief create the target SSL context server method + * + * @param none + * + * @return the SSLV2.3 version SSL context server method + */ +const SSL_METHOD* SSLv23_server_method(void); + +/** + * @brief create the target SSL context server method + * + * @param none + * + * @return the TLSV1.1 version SSL context server method + */ +const SSL_METHOD* TLSv1_1_server_method(void); + +/** + * @brief create the target SSL context server method + * + * @param none + * + * @return the TLSV1.2 version SSL context server method + */ +const SSL_METHOD* TLSv1_2_server_method(void); + +/** + * @brief create the target SSL context server method + * + * @param none + * + * @return the TLSV1.0 version SSL context server method + */ +const SSL_METHOD* TLSv1_server_method(void); + +/** + * @brief create the target SSL context server method + * + * @param none + * + * @return the SSLV3.0 version SSL context server method + */ +const SSL_METHOD* SSLv3_server_method(void); + +/** + * @brief create the target SSL context server method + * + * @param none + * + * @return the TLS any version SSL context server method + */ +const SSL_METHOD* TLS_server_method(void); + + +/** + * @brief set the SSL context ALPN select callback function + * + * @param ctx - SSL context point + * @param cb - ALPN select callback function + * @param arg - ALPN select callback function entry private data point + * + * @return none + */ +void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx, + int (*cb) (SSL *ssl, + const unsigned char **out, + unsigned char *outlen, + const unsigned char *in, + unsigned int inlen, + void *arg), + void *arg); + + +/** + * @brief set the SSL context ALPN select protocol + * + * @param ctx - SSL context point + * @param protos - ALPN protocol name + * @param protos_len - ALPN protocol name bytes + * + * @return result + * 0 : OK + * 1 : failed + */ +int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos, unsigned int protos_len); + +/** + * @brief set the SSL context next ALPN select callback function + * + * @param ctx - SSL context point + * @param cb - ALPN select callback function + * @param arg - ALPN select callback function entry private data point + * + * @return none + */ +void SSL_CTX_set_next_proto_select_cb(SSL_CTX *ctx, + int (*cb) (SSL *ssl, + unsigned char **out, + unsigned char *outlen, + const unsigned char *in, + unsigned int inlen, + void *arg), + void *arg); + +void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data, + unsigned int *len); + +void _ssl_set_alpn_list(const SSL *ssl); + +/** + * @brief get SSL error code + * + * @param ssl - SSL point + * @param ret_code - SSL return code + * + * @return SSL error number + */ +int SSL_get_error(const SSL *ssl, int ret_code); + +/** + * @brief clear the SSL error code + * + * @param none + * + * @return none + */ +void ERR_clear_error(void); + +/** + * @brief get the current SSL error code + * + * @param none + * + * @return current SSL error number + */ +int ERR_get_error(void); + +/** + * @brief register the SSL error strings + * + * @param none + * + * @return none + */ +void ERR_load_SSL_strings(void); + +/** + * @brief initialize the SSL library + * + * @param none + * + * @return none + */ +void SSL_library_init(void); + +/** + * @brief generates a human-readable string representing the error code e + * and store it into the "ret" point memory + * + * @param e - error code + * @param ret - memory point to store the string + * + * @return the result string point + */ +char *ERR_error_string(unsigned long e, char *ret); + +/** + * @brief add the SSL context option + * + * @param ctx - SSL context point + * @param opt - new SSL context option + * + * @return the SSL context option + */ +unsigned long SSL_CTX_set_options(SSL_CTX *ctx, unsigned long opt); + +/** + * @brief add the SSL context mode + * + * @param ctx - SSL context point + * @param mod - new SSL context mod + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_set_mode(SSL_CTX *ctx, int mod); + +/* +} +*/ + +/** + * @brief perform the SSL handshake + * + * @param ssl - SSL point + * + * @return result + * 1 : OK + * 0 : failed + * -1 : a error catch + */ +int SSL_do_handshake(SSL *ssl); + +/** + * @brief get the SSL current version + * + * @param ssl - SSL point + * + * @return the version string + */ +const char *SSL_get_version(const SSL *ssl); + +/** + * @brief set the SSL context version + * + * @param ctx - SSL context point + * @param meth - SSL method point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth); + +/** + * @brief get the bytes numbers which are to be read + * + * @param ssl - SSL point + * + * @return bytes number + */ +int SSL_pending(const SSL *ssl); + +/** + * @brief check if SSL want nothing + * + * @param ssl - SSL point + * + * @return result + * 0 : false + * 1 : true + */ +int SSL_want_nothing(const SSL *ssl); + +/** + * @brief check if SSL want to read + * + * @param ssl - SSL point + * + * @return result + * 0 : false + * 1 : true + */ +int SSL_want_read(const SSL *ssl); + +/** + * @brief check if SSL want to write + * + * @param ssl - SSL point + * + * @return result + * 0 : false + * 1 : true + */ +int SSL_want_write(const SSL *ssl); + +/** + * @brief get the SSL context current method + * + * @param ctx - SSL context point + * + * @return the SSL context current method + */ +const SSL_METHOD *SSL_CTX_get_ssl_method(SSL_CTX *ctx); + +/** + * @brief get the SSL current method + * + * @param ssl - SSL point + * + * @return the SSL current method + */ +const SSL_METHOD *SSL_get_ssl_method(SSL *ssl); + +/** + * @brief set the SSL method + * + * @param ssl - SSL point + * @param meth - SSL method point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_set_ssl_method(SSL *ssl, const SSL_METHOD *method); + +/** + * @brief add CA client certification into the SSL + * + * @param ssl - SSL point + * @param x - CA certification point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_add_client_CA(SSL *ssl, X509 *x); + +/** + * @brief add CA client certification into the SSL context + * + * @param ctx - SSL context point + * @param x - CA certification point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x); + +/** + * @brief set the SSL CA certification list + * + * @param ssl - SSL point + * @param name_list - CA certification list + * + * @return none + */ +void SSL_set_client_CA_list(SSL *ssl, STACK_OF(X509_NAME) *name_list); + +/** + * @brief set the SSL context CA certification list + * + * @param ctx - SSL context point + * @param name_list - CA certification list + * + * @return none + */ +void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list); + +/** + * @briefget the SSL CA certification list + * + * @param ssl - SSL point + * + * @return CA certification list + */ +STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *ssl); + +/** + * @brief get the SSL context CA certification list + * + * @param ctx - SSL context point + * + * @return CA certification list + */ +STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *ctx); + +/** + * @brief get the SSL certification point + * + * @param ssl - SSL point + * + * @return SSL certification point + */ +X509 *SSL_get_certificate(const SSL *ssl); + +/** + * @brief get the SSL private key point + * + * @param ssl - SSL point + * + * @return SSL private key point + */ +EVP_PKEY *SSL_get_privatekey(const SSL *ssl); + +/** + * @brief set the SSL information callback function + * + * @param ssl - SSL point + * @param cb - information callback function + * + * @return none + */ +void SSL_set_info_callback(SSL *ssl, void (*cb) (const SSL *ssl, int type, int val)); + +/** + * @brief get the SSL state + * + * @param ssl - SSL point + * + * @return SSL state + */ +OSSL_HANDSHAKE_STATE SSL_get_state(const SSL *ssl); + +/** + * @brief set the SSL context read buffer length + * + * @param ctx - SSL context point + * @param len - read buffer length + * + * @return none + */ +void SSL_CTX_set_default_read_buffer_len(SSL_CTX *ctx, size_t len); + +/** + * @brief set the SSL read buffer length + * + * @param ssl - SSL point + * @param len - read buffer length + * + * @return none + */ +void SSL_set_default_read_buffer_len(SSL *ssl, size_t len); + +/** + * @brief set the SSL security level + * + * @param ssl - SSL point + * @param level - security level + * + * @return none + */ +void SSL_set_security_level(SSL *ssl, int level); + +/** + * @brief get the SSL security level + * + * @param ssl - SSL point + * + * @return security level + */ +int SSL_get_security_level(const SSL *ssl); + +/** + * @brief get the SSL verifying mode of the SSL context + * + * @param ctx - SSL context point + * + * @return verifying mode + */ +int SSL_CTX_get_verify_mode(const SSL_CTX *ctx); + +/** + * @brief get the SSL verifying depth of the SSL context + * + * @param ctx - SSL context point + * + * @return verifying depth + */ +int SSL_CTX_get_verify_depth(const SSL_CTX *ctx); + +/** + * @brief set the SSL context verifying of the SSL context + * + * @param ctx - SSL context point + * @param mode - verifying mode + * @param verify_callback - verifying callback function + * + * @return none + */ +void SSL_CTX_set_verify(SSL_CTX *ctx, int mode, int (*verify_callback)(int, X509_STORE_CTX *)); + +/** + * @brief set the SSL verifying of the SSL context + * + * @param ctx - SSL point + * @param mode - verifying mode + * @param verify_callback - verifying callback function + * + * @return none + */ +void SSL_set_verify(SSL *s, int mode, int (*verify_callback)(int, X509_STORE_CTX *)); + +/** + * @brief set the SSL verify depth of the SSL context + * + * @param ctx - SSL context point + * @param depth - verifying depth + * + * @return none + */ +void SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth); + +/** + * @brief certification verifying callback function + * + * @param preverify_ok - verifying result + * @param x509_ctx - X509 certification point + * + * @return verifying result + */ +int verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx); + +/** + * @brief set the session timeout time + * + * @param ctx - SSL context point + * @param t - new session timeout time + * + * @return old session timeout time + */ +long SSL_CTX_set_timeout(SSL_CTX *ctx, long t); + +/** + * @brief get the session timeout time + * + * @param ctx - SSL context point + * + * @return current session timeout time + */ +long SSL_CTX_get_timeout(const SSL_CTX *ctx); + +/** + * @brief set the SSL context cipher through the list string + * + * @param ctx - SSL context point + * @param str - cipher controller list string + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str); + +/** + * @brief set the SSL cipher through the list string + * + * @param ssl - SSL point + * @param str - cipher controller list string + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_set_cipher_list(SSL *ssl, const char *str); + +/** + * @brief get the SSL cipher list string + * + * @param ssl - SSL point + * + * @return cipher controller list string + */ +const char *SSL_get_cipher_list(const SSL *ssl, int n); + +/** + * @brief get the SSL cipher + * + * @param ssl - SSL point + * + * @return current cipher + */ +const SSL_CIPHER *SSL_get_current_cipher(const SSL *ssl); + +/** + * @brief get the SSL cipher string + * + * @param ssl - SSL point + * + * @return cipher string + */ +const char *SSL_get_cipher(const SSL *ssl); + +/** + * @brief get the SSL context object X509 certification storage + * + * @param ctx - SSL context point + * + * @return x509 certification storage + */ +X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *ctx); + +/** + * @brief set the SSL context object X509 certification store + * + * @param ctx - SSL context point + * @param store - X509 certification store + * + * @return none + */ +void SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store); + +/** + * @brief get the SSL specifical statement + * + * @param ssl - SSL point + * + * @return specifical statement + */ +int SSL_want(const SSL *ssl); + +/** + * @brief check if the SSL is SSL_X509_LOOKUP state + * + * @param ssl - SSL point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_want_x509_lookup(const SSL *ssl); + +/** + * @brief reset the SSL + * + * @param ssl - SSL point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_clear(SSL *ssl); + +/** + * @brief get the socket handle of the SSL + * + * @param ssl - SSL point + * + * @return result + * >= 0 : yes, and return socket handle + * < 0 : a error catch + */ +int SSL_get_fd(const SSL *ssl); + +/** + * @brief get the read only socket handle of the SSL + * + * @param ssl - SSL point + * + * @return result + * >= 0 : yes, and return socket handle + * < 0 : a error catch + */ +int SSL_get_rfd(const SSL *ssl); + +/** + * @brief get the write only socket handle of the SSL + * + * @param ssl - SSL point + * + * @return result + * >= 0 : yes, and return socket handle + * < 0 : a error catch + */ +int SSL_get_wfd(const SSL *ssl); + +/** + * @brief set the SSL if we can read as many as data + * + * @param ssl - SSL point + * @param yes - enable the function + * + * @return none + */ +void SSL_set_read_ahead(SSL *s, int yes); + +/** + * @brief set the SSL context if we can read as many as data + * + * @param ctx - SSL context point + * @param yes - enbale the function + * + * @return none + */ +void SSL_CTX_set_read_ahead(SSL_CTX *ctx, int yes); + +/** + * @brief get the SSL ahead signal if we can read as many as data + * + * @param ssl - SSL point + * + * @return SSL context ahead signal + */ +int SSL_get_read_ahead(const SSL *ssl); + +/** + * @brief get the SSL context ahead signal if we can read as many as data + * + * @param ctx - SSL context point + * + * @return SSL context ahead signal + */ +long SSL_CTX_get_read_ahead(SSL_CTX *ctx); + +/** + * @brief check if some data can be read + * + * @param ssl - SSL point + * + * @return + * 1 : there are bytes to be read + * 0 : no data + */ +int SSL_has_pending(const SSL *ssl); + +/** + * @brief load the X509 certification into SSL context + * + * @param ctx - SSL context point + * @param x - X509 certification point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x);//loads the certificate x into ctx + +/** + * @brief load the ASN1 certification into SSL context + * + * @param ctx - SSL context point + * @param len - certification length + * @param d - data point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d); + +/** + * @brief load the certification file into SSL context + * + * @param ctx - SSL context point + * @param file - certification file name + * @param type - certification encoding type + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type); + +/** + * @brief load the certification chain file into SSL context + * + * @param ctx - SSL context point + * @param file - certification chain file name + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file); + + +/** + * @brief load the ASN1 private key into SSL context + * + * @param ctx - SSL context point + * @param d - data point + * @param len - private key length + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_PrivateKey_ASN1(int pk, SSL_CTX *ctx, const unsigned char *d, long len);//adds the private key of type pk stored at memory location d (length len) to ctx + +/** + * @brief load the private key file into SSL context + * + * @param ctx - SSL context point + * @param file - private key file name + * @param type - private key encoding type + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type); + +/** + * @brief load the RSA private key into SSL context + * + * @param ctx - SSL context point + * @param x - RSA private key point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa); + +/** + * @brief load the RSA ASN1 private key into SSL context + * + * @param ctx - SSL context point + * @param d - data point + * @param len - RSA private key length + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, long len); + +/** + * @brief load the RSA private key file into SSL context + * + * @param ctx - SSL context point + * @param file - RSA private key file name + * @param type - private key encoding type + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type); + + +/** + * @brief check if the private key and certification is matched + * + * @param ctx - SSL context point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_check_private_key(const SSL_CTX *ctx); + +/** + * @brief set the SSL context server information + * + * @param ctx - SSL context point + * @param serverinfo - server information string + * @param serverinfo_length - server information length + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_serverinfo(SSL_CTX *ctx, const unsigned char *serverinfo, size_t serverinfo_length); + +/** + * @brief load the SSL context server infomation file into SSL context + * + * @param ctx - SSL context point + * @param file - server information file + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file); + +/** + * @brief SSL select next function + * + * @param out - point of output data point + * @param outlen - output data length + * @param in - input data + * @param inlen - input data length + * @param client - client data point + * @param client_len -client data length + * + * @return NPN state + * OPENSSL_NPN_UNSUPPORTED : not support + * OPENSSL_NPN_NEGOTIATED : negotiated + * OPENSSL_NPN_NO_OVERLAP : no overlap + */ +int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, + const unsigned char *in, unsigned int inlen, + const unsigned char *client, unsigned int client_len); + +/** + * @brief load the extra certification chain into the SSL context + * + * @param ctx - SSL context point + * @param x509 - X509 certification + * + * @return result + * 1 : OK + * 0 : failed + */ +long SSL_CTX_add_extra_chain_cert(SSL_CTX *ctx, X509 *); + +/** + * @brief control the SSL context + * + * @param ctx - SSL context point + * @param cmd - command + * @param larg - parameter length + * @param parg - parameter point + * + * @return result + * 1 : OK + * 0 : failed + */ +long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, char *parg); + +/** + * @brief get the SSL context cipher + * + * @param ctx - SSL context point + * + * @return SSL context cipher + */ +STACK *SSL_CTX_get_ciphers(const SSL_CTX *ctx); + +/** + * @brief check if the SSL context can read as many as data + * + * @param ctx - SSL context point + * + * @return result + * 1 : OK + * 0 : failed + */ +long SSL_CTX_get_default_read_ahead(SSL_CTX *ctx); + +/** + * @brief get the SSL context extra data + * + * @param ctx - SSL context point + * @param idx - index + * + * @return data point + */ +char *SSL_CTX_get_ex_data(const SSL_CTX *ctx, int idx); + +/** + * @brief get the SSL context quiet shutdown option + * + * @param ctx - SSL context point + * + * @return quiet shutdown option + */ +int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx); + +/** + * @brief load the SSL context CA file + * + * @param ctx - SSL context point + * @param CAfile - CA certification file + * @param CApath - CA certification file path + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile, const char *CApath); + +/** + * @brief add SSL context reference count by '1' + * + * @param ctx - SSL context point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_up_ref(SSL_CTX *ctx); + +/** + * @brief set SSL context application private data + * + * @param ctx - SSL context point + * @param arg - private data + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_set_app_data(SSL_CTX *ctx, void *arg); + +/** + * @brief set SSL context client certification callback function + * + * @param ctx - SSL context point + * @param cb - callback function + * + * @return none + */ +void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx, int (*cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey)); + +/** + * @brief set the SSL context if we can read as many as data + * + * @param ctx - SSL context point + * @param m - enable the fuction + * + * @return none + */ +void SSL_CTX_set_default_read_ahead(SSL_CTX *ctx, int m); + +/** + * @brief set SSL context default verifying path + * + * @param ctx - SSL context point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx); + +/** + * @brief set SSL context default verifying directory + * + * @param ctx - SSL context point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_set_default_verify_dir(SSL_CTX *ctx); + +/** + * @brief set SSL context default verifying file + * + * @param ctx - SSL context point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_set_default_verify_file(SSL_CTX *ctx); + +/** + * @brief set SSL context extra data + * + * @param ctx - SSL context point + * @param idx - data index + * @param arg - data point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_set_ex_data(SSL_CTX *s, int idx, char *arg); + +/** + * @brief clear the SSL context option bit of "op" + * + * @param ctx - SSL context point + * @param op - option + * + * @return SSL context option + */ +unsigned long SSL_CTX_clear_options(SSL_CTX *ctx, unsigned long op); + +/** + * @brief get the SSL context option + * + * @param ctx - SSL context point + * @param op - option + * + * @return SSL context option + */ +unsigned long SSL_CTX_get_options(SSL_CTX *ctx); + +/** + * @brief set the SSL context quiet shutdown mode + * + * @param ctx - SSL context point + * @param mode - mode + * + * @return none + */ +void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode); + +/** + * @brief get the SSL context X509 certification + * + * @param ctx - SSL context point + * + * @return X509 certification + */ +X509 *SSL_CTX_get0_certificate(const SSL_CTX *ctx); + +/** + * @brief get the SSL context private key + * + * @param ctx - SSL context point + * + * @return private key + */ +EVP_PKEY *SSL_CTX_get0_privatekey(const SSL_CTX *ctx); + +/** + * @brief set SSL context PSK identity hint + * + * @param ctx - SSL context point + * @param hint - PSK identity hint + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *hint); + +/** + * @brief set SSL context PSK server callback function + * + * @param ctx - SSL context point + * @param callback - callback function + * + * @return none + */ +void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, + unsigned int (*callback)(SSL *ssl, + const char *identity, + unsigned char *psk, + int max_psk_len)); +/** + * @brief get alert description string + * + * @param value - alert value + * + * @return alert description string + */ +const char *SSL_alert_desc_string(int value); + +/** + * @brief get alert description long string + * + * @param value - alert value + * + * @return alert description long string + */ +const char *SSL_alert_desc_string_long(int value); + +/** + * @brief get alert type string + * + * @param value - alert value + * + * @return alert type string + */ +const char *SSL_alert_type_string(int value); + +/** + * @brief get alert type long string + * + * @param value - alert value + * + * @return alert type long string + */ +const char *SSL_alert_type_string_long(int value); + +/** + * @brief get SSL context of the SSL + * + * @param ssl - SSL point + * + * @return SSL context + */ +SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl); + +/** + * @brief get SSL application data + * + * @param ssl - SSL point + * + * @return application data + */ +char *SSL_get_app_data(SSL *ssl); + +/** + * @brief get SSL cipher bits + * + * @param ssl - SSL point + * @param alg_bits - algorithm bits + * + * @return strength bits + */ +int SSL_get_cipher_bits(const SSL *ssl, int *alg_bits); + +/** + * @brief get SSL cipher name + * + * @param ssl - SSL point + * + * @return SSL cipher name + */ +char *SSL_get_cipher_name(const SSL *ssl); + +/** + * @brief get SSL cipher version + * + * @param ssl - SSL point + * + * @return SSL cipher version + */ +char *SSL_get_cipher_version(const SSL *ssl); + +/** + * @brief get SSL extra data + * + * @param ssl - SSL point + * @param idx - data index + * + * @return extra data + */ +char *SSL_get_ex_data(const SSL *ssl, int idx); + +/** + * @brief get index of the SSL extra data X509 storage context + * + * @param none + * + * @return data index + */ +int SSL_get_ex_data_X509_STORE_CTX_idx(void); + +/** + * @brief get peer certification chain + * + * @param ssl - SSL point + * + * @return certification chain + */ +STACK *SSL_get_peer_cert_chain(const SSL *ssl); + +/** + * @brief get peer certification + * + * @param ssl - SSL point + * + * @return certification + */ +X509 *SSL_get_peer_certificate(const SSL *ssl); + +/** + * @brief get SSL quiet shutdown mode + * + * @param ssl - SSL point + * + * @return quiet shutdown mode + */ +int SSL_get_quiet_shutdown(const SSL *ssl); + +/** + * @brief get SSL read only IO handle + * + * @param ssl - SSL point + * + * @return IO handle + */ +BIO *SSL_get_rbio(const SSL *ssl); + +/** + * @brief get SSL shared ciphers + * + * @param ssl - SSL point + * @param buf - buffer to store the ciphers + * @param len - buffer len + * + * @return shared ciphers + */ +char *SSL_get_shared_ciphers(const SSL *ssl, char *buf, int len); + +/** + * @brief get SSL shutdown mode + * + * @param ssl - SSL point + * + * @return shutdown mode + */ +int SSL_get_shutdown(const SSL *ssl); + +/** + * @brief get SSL session time + * + * @param ssl - SSL point + * + * @return session time + */ +long SSL_get_time(const SSL *ssl); + +/** + * @brief get SSL session timeout time + * + * @param ssl - SSL point + * + * @return session timeout time + */ +long SSL_get_timeout(const SSL *ssl); + +/** + * @brief get SSL verifying mode + * + * @param ssl - SSL point + * + * @return verifying mode + */ +int SSL_get_verify_mode(const SSL *ssl); + +/** + * @brief get SSL verify parameters + * + * @param ssl - SSL point + * + * @return verify parameters + */ +X509_VERIFY_PARAM *SSL_get0_param(SSL *ssl); + +/** + * @brief set expected hostname the peer cert CN should have + * + * @param param - verify parameters from SSL_get0_param() + * + * @param name - the expected hostname + * + * @param namelen - the length of the hostname, or 0 if NUL terminated + * + * @return verify parameters + */ +int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param, + const char *name, size_t namelen); + +/** + * @brief set parameters for X509 host verify action + * + * @param param -verify parameters from SSL_get0_param() + * + * @param flags - bitfield of X509_CHECK_FLAG_... parameters to set + * + * @return 1 for success, 0 for failure + */ +int X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param, + unsigned long flags); + +/** + * @brief clear parameters for X509 host verify action + * + * @param param -verify parameters from SSL_get0_param() + * + * @param flags - bitfield of X509_CHECK_FLAG_... parameters to clear + * + * @return 1 for success, 0 for failure + */ +int X509_VERIFY_PARAM_clear_hostflags(X509_VERIFY_PARAM *param, + unsigned long flags); + +/** + * @brief get SSL write only IO handle + * + * @param ssl - SSL point + * + * @return IO handle + */ +BIO *SSL_get_wbio(const SSL *ssl); + +/** + * @brief load SSL client CA certification file + * + * @param file - file name + * + * @return certification loading object + */ +STACK *SSL_load_client_CA_file(const char *file); + +/** + * @brief add SSL reference by '1' + * + * @param ssl - SSL point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_up_ref(SSL *ssl); + +/** + * @brief read and put data into buf, but not clear the SSL low-level storage + * + * @param ssl - SSL point + * @param buf - storage buffer point + * @param num - data bytes + * + * @return result + * > 0 : OK, and return read bytes + * = 0 : connect is closed + * < 0 : a error catch + */ +int SSL_peek(SSL *ssl, void *buf, int num); + +/** + * @brief make SSL renegotiate + * + * @param ssl - SSL point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_renegotiate(SSL *ssl); + +/** + * @brief get the state string where SSL is reading + * + * @param ssl - SSL point + * + * @return state string + */ +const char *SSL_rstate_string(SSL *ssl); + +/** + * @brief get the statement long string where SSL is reading + * + * @param ssl - SSL point + * + * @return statement long string + */ +const char *SSL_rstate_string_long(SSL *ssl); + +/** + * @brief set SSL accept statement + * + * @param ssl - SSL point + * + * @return none + */ +void SSL_set_accept_state(SSL *ssl); + +/** + * @brief set SSL application data + * + * @param ssl - SSL point + * @param arg - SSL application data point + * + * @return none + */ +void SSL_set_app_data(SSL *ssl, char *arg); + +/** + * @brief set SSL BIO + * + * @param ssl - SSL point + * @param rbio - read only IO + * @param wbio - write only IO + * + * @return none + */ +void SSL_set_bio(SSL *ssl, BIO *rbio, BIO *wbio); + +/** + * @brief clear SSL option + * + * @param ssl - SSL point + * @param op - clear option + * + * @return SSL option + */ +unsigned long SSL_clear_options(SSL *ssl, unsigned long op); + +/** + * @brief get SSL option + * + * @param ssl - SSL point + * + * @return SSL option + */ +unsigned long SSL_get_options(SSL *ssl); + +/** + * @brief clear SSL option + * + * @param ssl - SSL point + * @param op - setting option + * + * @return SSL option + */ +unsigned long SSL_set_options(SSL *ssl, unsigned long op); + +/** + * @brief set SSL quiet shutdown mode + * + * @param ssl - SSL point + * @param mode - quiet shutdown mode + * + * @return none + */ +void SSL_set_quiet_shutdown(SSL *ssl, int mode); + +/** + * @brief set SSL shutdown mode + * + * @param ssl - SSL point + * @param mode - shutdown mode + * + * @return none + */ +void SSL_set_shutdown(SSL *ssl, int mode); + +/** + * @brief set SSL session time + * + * @param ssl - SSL point + * @param t - session time + * + * @return session time + */ +void SSL_set_time(SSL *ssl, long t); + +/** + * @brief set SSL session timeout time + * + * @param ssl - SSL point + * @param t - session timeout time + * + * @return session timeout time + */ +void SSL_set_timeout(SSL *ssl, long t); + +/** + * @brief get SSL statement string + * + * @param ssl - SSL point + * + * @return SSL statement string + */ +char *SSL_state_string(const SSL *ssl); + +/** + * @brief get SSL statement long string + * + * @param ssl - SSL point + * + * @return SSL statement long string + */ +char *SSL_state_string_long(const SSL *ssl); + +/** + * @brief get SSL renegotiation count + * + * @param ssl - SSL point + * + * @return renegotiation count + */ +long SSL_total_renegotiations(SSL *ssl); + +/** + * @brief get SSL version + * + * @param ssl - SSL point + * + * @return SSL version + */ +int SSL_version(const SSL *ssl); + +/** + * @brief set SSL PSK identity hint + * + * @param ssl - SSL point + * @param hint - identity hint + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_use_psk_identity_hint(SSL *ssl, const char *hint); + +/** + * @brief get SSL PSK identity hint + * + * @param ssl - SSL point + * + * @return identity hint + */ +const char *SSL_get_psk_identity_hint(SSL *ssl); + +/** + * @brief get SSL PSK identity + * + * @param ssl - SSL point + * + * @return identity + */ +const char *SSL_get_psk_identity(SSL *ssl); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/arm64-v8a/include/mbedtls_wrapper/platform/ssl_pm.h b/openharmony/arm64-v8a/include/mbedtls_wrapper/platform/ssl_pm.h new file mode 100644 index 00000000..cbbe3aa3 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls_wrapper/platform/ssl_pm.h @@ -0,0 +1,61 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_PM_H_ +#define _SSL_PM_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include +#include "ssl_types.h" +#include "ssl_port.h" + +#define LOCAL_ATRR + +int ssl_pm_new(SSL *ssl); +void ssl_pm_free(SSL *ssl); + +int ssl_pm_handshake(SSL *ssl); +int ssl_pm_shutdown(SSL *ssl); +int ssl_pm_clear(SSL *ssl); + +int ssl_pm_read(SSL *ssl, void *buffer, int len); +int ssl_pm_send(SSL *ssl, const void *buffer, int len); +int ssl_pm_pending(const SSL *ssl); + +void ssl_pm_set_fd(SSL *ssl, int fd, int mode); +int ssl_pm_get_fd(const SSL *ssl, int mode); + +OSSL_HANDSHAKE_STATE ssl_pm_get_state(const SSL *ssl); + +void ssl_pm_set_bufflen(SSL *ssl, int len); + +int x509_pm_show_info(X509 *x); +int x509_pm_new(X509 *x, X509 *m_x); +void x509_pm_free(X509 *x); +int x509_pm_load(X509 *x, const unsigned char *buffer, int len); + +int pkey_pm_new(EVP_PKEY *pk, EVP_PKEY *m_pk); +void pkey_pm_free(EVP_PKEY *pk); +int pkey_pm_load(EVP_PKEY *pk, const unsigned char *buffer, int len); + +long ssl_pm_get_verify_result(const SSL *ssl); + +#ifdef __cplusplus + } +#endif + +#endif diff --git a/openharmony/arm64-v8a/include/mbedtls_wrapper/platform/ssl_port.h b/openharmony/arm64-v8a/include/mbedtls_wrapper/platform/ssl_port.h new file mode 100644 index 00000000..c4c26618 --- /dev/null +++ b/openharmony/arm64-v8a/include/mbedtls_wrapper/platform/ssl_port.h @@ -0,0 +1,47 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_PORT_H_ +#define _SSL_PORT_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +/* +#include "esp_types.h" +#include "esp_log.h" +*/ +#include "string.h" +#include "malloc.h" + +void *ssl_mem_zalloc(size_t size); + +#define ssl_mem_malloc malloc +#define ssl_mem_free free + +#define ssl_memcpy memcpy +#define ssl_strlen strlen + +#define ssl_speed_up_enter() +#define ssl_speed_up_exit() + +#define SSL_DEBUG_FL +#define SSL_DEBUG_LOG(fmt, ...) ESP_LOGI("openssl", fmt, ##__VA_ARGS__) + +#ifdef __cplusplus + } +#endif + +#endif diff --git a/openharmony/arm64-v8a/include/websockets/libwebsockets.h b/openharmony/arm64-v8a/include/websockets/libwebsockets.h new file mode 100644 index 00000000..460c7326 --- /dev/null +++ b/openharmony/arm64-v8a/include/websockets/libwebsockets.h @@ -0,0 +1,5787 @@ +/* + * libwebsockets - small server side websockets and web server implementation + * + * Copyright (C) 2010-2016 Andy Green + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation: + * version 2.1 of the License. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, + * MA 02110-1301 USA + */ + +/** @file */ + +#ifndef LIBWEBSOCKET_H_3060898B846849FF9F88F5DB59B5950C +#define LIBWEBSOCKET_H_3060898B846849FF9F88F5DB59B5950C + +#ifdef __cplusplus +#include +#include +# +extern "C" { +#else +#include +#endif + +#include "lws_config.h" + +/* + * CARE: everything using cmake defines needs to be below here + */ + +#if defined(LWS_WITH_ESP8266) +struct sockaddr_in; +#define LWS_POSIX 0 +#else +#define LWS_POSIX 1 +#endif + +#if defined(LWS_HAS_INTPTR_T) +#include +#define lws_intptr_t intptr_t +#else +typedef unsigned long long lws_intptr_t; +#endif + +#if defined(WIN32) || defined(_WIN32) +#ifndef WIN32_LEAN_AND_MEAN +#define WIN32_LEAN_AND_MEAN +#endif + +#include +#include +#include +#include +#ifndef _WIN32_WCE +#include +#else +#define _O_RDONLY 0x0000 +#define O_RDONLY _O_RDONLY +#endif + +// Visual studio older than 2015 and WIN_CE has only _stricmp +#if (defined(_MSC_VER) && _MSC_VER < 1900) || defined(_WIN32_WCE) +#define strcasecmp _stricmp +#elif !defined(__MINGW32__) +#define strcasecmp stricmp +#endif +#define getdtablesize() 30000 + +#define LWS_INLINE __inline +#define LWS_VISIBLE +#define LWS_WARN_UNUSED_RESULT +#define LWS_WARN_DEPRECATED +#define LWS_FORMAT(string_index) + +#ifdef LWS_DLL +#ifdef LWS_INTERNAL +#define LWS_EXTERN extern __declspec(dllexport) +#else +#define LWS_EXTERN extern __declspec(dllimport) +#endif +#else +#define LWS_EXTERN +#endif + +#define LWS_INVALID_FILE INVALID_HANDLE_VALUE +#define LWS_O_RDONLY _O_RDONLY +#define LWS_O_WRONLY _O_WRONLY +#define LWS_O_CREAT _O_CREAT +#define LWS_O_TRUNC _O_TRUNC + +#if !defined(__MINGW32__) && (!defined(_MSC_VER) || _MSC_VER < 1900) /* Visual Studio 2015 already defines this in */ +#define lws_snprintf _snprintf +#endif + +#ifndef __func__ +#define __func__ __FUNCTION__ +#endif + +#if !defined(__MINGW32__) &&(!defined(_MSC_VER) || _MSC_VER < 1900) && !defined(snprintf) +#define snprintf(buf,len, format,...) _snprintf_s(buf, len,len, format, __VA_ARGS__) +#endif + +#else /* NOT WIN32 */ +#include +#if defined(LWS_HAVE_SYS_CAPABILITY_H) && defined(LWS_HAVE_LIBCAP) +#include +#endif + +#if defined(__NetBSD__) || defined(__FreeBSD__) +#include +#endif + +#define LWS_INLINE inline +#define LWS_O_RDONLY O_RDONLY +#define LWS_O_WRONLY O_WRONLY +#define LWS_O_CREAT O_CREAT +#define LWS_O_TRUNC O_TRUNC + +#if !defined(LWS_WITH_ESP8266) && !defined(OPTEE_TA) && !defined(LWS_WITH_ESP32) +#include +#include +#define LWS_INVALID_FILE -1 +#else +#define getdtablesize() (30) +#if defined(LWS_WITH_ESP32) +#define LWS_INVALID_FILE NULL +#else +#define LWS_INVALID_FILE NULL +#endif +#endif + +#if defined(__GNUC__) + +/* warn_unused_result attribute only supported by GCC 3.4 or later */ +#if __GNUC__ >= 4 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 4) +#define LWS_WARN_UNUSED_RESULT __attribute__((warn_unused_result)) +#else +#define LWS_WARN_UNUSED_RESULT +#endif + +#define LWS_VISIBLE __attribute__((visibility("default"))) +#define LWS_WARN_DEPRECATED __attribute__ ((deprecated)) +#define LWS_FORMAT(string_index) __attribute__ ((format(printf, string_index, string_index+1))) +#else +#define LWS_VISIBLE +#define LWS_WARN_UNUSED_RESULT +#define LWS_WARN_DEPRECATED +#define LWS_FORMAT(string_index) +#endif + +#if defined(__ANDROID__) +#include +#define getdtablesize() sysconf(_SC_OPEN_MAX) +#endif + +#endif + +#ifdef LWS_WITH_LIBEV +#include +#endif /* LWS_WITH_LIBEV */ +#ifdef LWS_WITH_LIBUV +#include +#ifdef LWS_HAVE_UV_VERSION_H +#include +#endif +#endif /* LWS_WITH_LIBUV */ +#ifdef LWS_WITH_LIBEVENT +#include +#endif /* LWS_WITH_LIBEVENT */ + +#ifndef LWS_EXTERN +#define LWS_EXTERN extern +#endif + +#ifdef _WIN32 +#define random rand +#else +#if !defined(OPTEE_TA) +#include +#include +#endif +#endif + +#ifdef LWS_OPENSSL_SUPPORT + +#ifdef USE_WOLFSSL +#ifdef USE_OLD_CYASSL +#include +#include +#else +#include +#include +#endif /* not USE_OLD_CYASSL */ +#else +#if defined(LWS_WITH_MBEDTLS) +#if defined(LWS_WITH_ESP32) +/* this filepath is passed to us but without quotes or <> */ +#undef MBEDTLS_CONFIG_FILE +#define MBEDTLS_CONFIG_FILE +#endif +#include +#endif +#include +#if !defined(LWS_WITH_MBEDTLS) +#include +#endif +#endif /* not USE_WOLFSSL */ +#endif + + +#define CONTEXT_PORT_NO_LISTEN -1 +#define CONTEXT_PORT_NO_LISTEN_SERVER -2 + +/** \defgroup log Logging + * + * ##Logging + * + * Lws provides flexible and filterable logging facilities, which can be + * used inside lws and in user code. + * + * Log categories may be individually filtered bitwise, and directed to built-in + * sinks for syslog-compatible logging, or a user-defined function. + */ +///@{ + +enum lws_log_levels { + LLL_ERR = 1 << 0, + LLL_WARN = 1 << 1, + LLL_NOTICE = 1 << 2, + LLL_INFO = 1 << 3, + LLL_DEBUG = 1 << 4, + LLL_PARSER = 1 << 5, + LLL_HEADER = 1 << 6, + LLL_EXT = 1 << 7, + LLL_CLIENT = 1 << 8, + LLL_LATENCY = 1 << 9, + LLL_USER = 1 << 10, + + LLL_COUNT = 11 /* set to count of valid flags */ +}; + +LWS_VISIBLE LWS_EXTERN void _lws_log(int filter, const char *format, ...) LWS_FORMAT(2); +LWS_VISIBLE LWS_EXTERN void _lws_logv(int filter, const char *format, va_list vl); +/** + * lwsl_timestamp: generate logging timestamp string + * + * \param level: logging level + * \param p: char * buffer to take timestamp + * \param len: length of p + * + * returns length written in p + */ +LWS_VISIBLE LWS_EXTERN int +lwsl_timestamp(int level, char *p, int len); + +/* these guys are unconditionally included */ + +#define lwsl_err(...) _lws_log(LLL_ERR, __VA_ARGS__) +#define lwsl_user(...) _lws_log(LLL_USER, __VA_ARGS__) + +#if !defined(LWS_WITH_NO_LOGS) +/* notice and warn are usually included by being compiled in */ +#define lwsl_warn(...) _lws_log(LLL_WARN, __VA_ARGS__) +#define lwsl_notice(...) _lws_log(LLL_NOTICE, __VA_ARGS__) +#endif +/* + * weaker logging can be deselected by telling CMake to build in RELEASE mode + * that gets rid of the overhead of checking while keeping _warn and _err + * active + */ + +#if defined(LWS_WITH_ESP8266) +#undef _DEBUG +#endif + +#ifdef _DEBUG +#if defined(LWS_WITH_NO_LOGS) +/* notice, warn and log are always compiled in */ +#define lwsl_warn(...) _lws_log(LLL_WARN, __VA_ARGS__) +#define lwsl_notice(...) _lws_log(LLL_NOTICE, __VA_ARGS__) +#endif +#define lwsl_info(...) _lws_log(LLL_INFO, __VA_ARGS__) +#define lwsl_debug(...) _lws_log(LLL_DEBUG, __VA_ARGS__) +#define lwsl_parser(...) _lws_log(LLL_PARSER, __VA_ARGS__) +#define lwsl_header(...) _lws_log(LLL_HEADER, __VA_ARGS__) +#define lwsl_ext(...) _lws_log(LLL_EXT, __VA_ARGS__) +#define lwsl_client(...) _lws_log(LLL_CLIENT, __VA_ARGS__) +#define lwsl_latency(...) _lws_log(LLL_LATENCY, __VA_ARGS__) + +#else /* no debug */ +#if defined(LWS_WITH_NO_LOGS) +#define lwsl_warn(...) do {} while(0) +#define lwsl_notice(...) do {} while(0) +#endif +#define lwsl_info(...) do {} while(0) +#define lwsl_debug(...) do {} while(0) +#define lwsl_parser(...) do {} while(0) +#define lwsl_header(...) do {} while(0) +#define lwsl_ext(...) do {} while(0) +#define lwsl_client(...) do {} while(0) +#define lwsl_latency(...) do {} while(0) + +#endif + +/** + * lwsl_hexdump() - helper to hexdump a buffer + * + * \param level: one of LLL_ constants + * \param buf: buffer start to dump + * \param len: length of buffer to dump + * + * If \p level is visible, does a nice hexdump -C style dump of \p buf for + * \p len bytes. This can be extremely convenient while debugging. + */ +LWS_VISIBLE LWS_EXTERN void +lwsl_hexdump_level(int level, const void *vbuf, size_t len); + +/** + * lwsl_hexdump() - helper to hexdump a buffer (DEBUG builds only) + * + * \param buf: buffer start to dump + * \param len: length of buffer to dump + * + * Calls through to lwsl_hexdump_level(LLL_DEBUG, ... for compatability. + * It's better to use lwsl_hexdump_level(level, ... directly so you can control + * the visibility. + */ +LWS_VISIBLE LWS_EXTERN void +lwsl_hexdump(const void *buf, size_t len); + +/** + * lws_is_be() - returns nonzero if the platform is Big Endian + */ +static LWS_INLINE int lws_is_be(void) { + const int probe = ~0xff; + + return *(const char *)&probe; +} + +/** + * lws_set_log_level() - Set the logging bitfield + * \param level: OR together the LLL_ debug contexts you want output from + * \param log_emit_function: NULL to leave it as it is, or a user-supplied + * function to perform log string emission instead of + * the default stderr one. + * + * log level defaults to "err", "warn" and "notice" contexts enabled and + * emission on stderr. If stderr is a tty (according to isatty()) then + * the output is coloured according to the log level using ANSI escapes. + */ +LWS_VISIBLE LWS_EXTERN void +lws_set_log_level(int level, + void (*log_emit_function)(int level, const char *line)); + +/** + * lwsl_emit_syslog() - helper log emit function writes to system log + * + * \param level: one of LLL_ log level indexes + * \param line: log string + * + * You use this by passing the function pointer to lws_set_log_level(), to set + * it as the log emit function, it is not called directly. + */ +LWS_VISIBLE LWS_EXTERN void +lwsl_emit_syslog(int level, const char *line); + +/** + * lwsl_visible() - returns true if the log level should be printed + * + * \param level: one of LLL_ log level indexes + * + * This is useful if you have to do work to generate the log content, you + * can skip the work if the log level used to print it is not actually + * enabled at runtime. + */ +LWS_VISIBLE LWS_EXTERN int +lwsl_visible(int level); + +///@} + + +#include + +#ifndef lws_container_of +#define lws_container_of(P,T,M) ((T *)((char *)(P) - offsetof(T, M))) +#endif + + +struct lws; +#ifndef ARRAY_SIZE +#define ARRAY_SIZE(x) (sizeof(x) / sizeof(x[0])) +#endif + +/* api change list for user code to test against */ + +#define LWS_FEATURE_SERVE_HTTP_FILE_HAS_OTHER_HEADERS_ARG + +/* the struct lws_protocols has the id field present */ +#define LWS_FEATURE_PROTOCOLS_HAS_ID_FIELD + +/* you can call lws_get_peer_write_allowance */ +#define LWS_FEATURE_PROTOCOLS_HAS_PEER_WRITE_ALLOWANCE + +/* extra parameter introduced in 917f43ab821 */ +#define LWS_FEATURE_SERVE_HTTP_FILE_HAS_OTHER_HEADERS_LEN + +/* File operations stuff exists */ +#define LWS_FEATURE_FOPS + + +#if defined(_WIN32) +typedef SOCKET lws_sockfd_type; +typedef HANDLE lws_filefd_type; +#define lws_sockfd_valid(sfd) (!!sfd) +struct lws_pollfd { + lws_sockfd_type fd; /**< file descriptor */ + SHORT events; /**< which events to respond to */ + SHORT revents; /**< which events happened */ +}; +#define LWS_POLLHUP (FD_CLOSE) +#define LWS_POLLIN (FD_READ | FD_ACCEPT) +#define LWS_POLLOUT (FD_WRITE) +#else + + +#if defined(LWS_WITH_ESP8266) + +#include +#include + +typedef struct espconn * lws_sockfd_type; +typedef void * lws_filefd_type; +#define lws_sockfd_valid(sfd) (!!sfd) +struct pollfd { + lws_sockfd_type fd; /**< fd related to */ + short events; /**< which POLL... events to respond to */ + short revents; /**< which POLL... events occurred */ +}; +#define POLLIN 0x0001 +#define POLLPRI 0x0002 +#define POLLOUT 0x0004 +#define POLLERR 0x0008 +#define POLLHUP 0x0010 +#define POLLNVAL 0x0020 + +struct lws_vhost; + +lws_sockfd_type esp8266_create_tcp_listen_socket(struct lws_vhost *vh); +void esp8266_tcp_stream_accept(lws_sockfd_type fd, struct lws *wsi); + +#include +#include +#include "ets_sys.h" + +int ets_snprintf(char *str, size_t size, const char *format, ...) LWS_FORMAT(3); +#define snprintf ets_snprintf + +typedef os_timer_t uv_timer_t; +typedef void uv_cb_t(uv_timer_t *); + +void os_timer_disarm(void *); +void os_timer_setfn(os_timer_t *, os_timer_func_t *, void *); + +void ets_timer_arm_new(os_timer_t *, int, int, int); + +//void os_timer_arm(os_timer_t *, int, int); + +#define UV_VERSION_MAJOR 1 + +#define lws_uv_getloop(a, b) (NULL) + +static inline void uv_timer_init(void *l, uv_timer_t *t) +{ + (void)l; + memset(t, 0, sizeof(*t)); + os_timer_disarm(t); +} + +static inline void uv_timer_start(uv_timer_t *t, uv_cb_t *cb, int first, int rep) +{ + os_timer_setfn(t, (os_timer_func_t *)cb, t); + /* ms, repeat */ + os_timer_arm(t, first, !!rep); +} + +static inline void uv_timer_stop(uv_timer_t *t) +{ + os_timer_disarm(t); +} + +#else +#if defined(LWS_WITH_ESP32) + +typedef int lws_sockfd_type; +typedef int lws_filefd_type; +#define lws_sockfd_valid(sfd) (sfd >= 0) +struct pollfd { + lws_sockfd_type fd; /**< fd related to */ + short events; /**< which POLL... events to respond to */ + short revents; /**< which POLL... events occurred */ +}; +#define POLLIN 0x0001 +#define POLLPRI 0x0002 +#define POLLOUT 0x0004 +#define POLLERR 0x0008 +#define POLLHUP 0x0010 +#define POLLNVAL 0x0020 + +#include +#include +#include +#include "esp_wifi.h" +#include "esp_system.h" +#include "esp_event.h" +#include "esp_event_loop.h" +#include "nvs.h" +#include "driver/gpio.h" +#include "esp_spi_flash.h" +#include "freertos/timers.h" + +#if !defined(CONFIG_FREERTOS_HZ) +#define CONFIG_FREERTOS_HZ 100 +#endif + +typedef TimerHandle_t uv_timer_t; +typedef void uv_cb_t(uv_timer_t *); +typedef void * uv_handle_t; + +struct timer_mapping { + uv_cb_t *cb; + uv_timer_t *t; +}; + +#define UV_VERSION_MAJOR 1 + +#define lws_uv_getloop(a, b) (NULL) + +static inline void uv_timer_init(void *l, uv_timer_t *t) +{ + (void)l; + *t = NULL; +} + +extern void esp32_uvtimer_cb(TimerHandle_t t); + +static inline void uv_timer_start(uv_timer_t *t, uv_cb_t *cb, int first, int rep) +{ + struct timer_mapping *tm = (struct timer_mapping *)malloc(sizeof(*tm)); + + if (!tm) + return; + + tm->t = t; + tm->cb = cb; + + *t = xTimerCreate("x", pdMS_TO_TICKS(first), !!rep, tm, + (TimerCallbackFunction_t)esp32_uvtimer_cb); + xTimerStart(*t, 0); +} + +static inline void uv_timer_stop(uv_timer_t *t) +{ + xTimerStop(*t, 0); +} + +static inline void uv_close(uv_handle_t *h, void *v) +{ + free(pvTimerGetTimerID((uv_timer_t)h)); + xTimerDelete(*(uv_timer_t *)h, 0); +} + +/* ESP32 helper declarations */ + +#include +#include + +#define LWS_PLUGIN_STATIC +#define LWS_MAGIC_REBOOT_TYPE_ADS 0x50001ffc +#define LWS_MAGIC_REBOOT_TYPE_REQ_FACTORY 0xb00bcafe +#define LWS_MAGIC_REBOOT_TYPE_FORCED_FACTORY 0xfaceb00b +#define LWS_MAGIC_REBOOT_TYPE_FORCED_FACTORY_BUTTON 0xf0cedfac + + +/* user code provides these */ + +extern void +lws_esp32_identify_physical_device(void); + +/* lws-plat-esp32 provides these */ + +typedef void (*lws_cb_scan_done)(uint16_t count, wifi_ap_record_t *recs, void *arg); + +enum genled_state { + LWSESP32_GENLED__INIT, + LWSESP32_GENLED__LOST_NETWORK, + LWSESP32_GENLED__NO_NETWORK, + LWSESP32_GENLED__CONN_AP, + LWSESP32_GENLED__GOT_IP, + LWSESP32_GENLED__OK, +}; + +struct lws_group_member { + struct lws_group_member *next; + uint64_t last_seen; + char model[16]; + char role[16]; + char host[32]; + char mac[20]; + int width, height; + struct ip4_addr addr; + struct ip6_addr addrv6; + uint8_t flags; +}; + +#define LWS_SYSTEM_GROUP_MEMBER_ADD 1 +#define LWS_SYSTEM_GROUP_MEMBER_CHANGE 2 +#define LWS_SYSTEM_GROUP_MEMBER_REMOVE 3 + +#define LWS_GROUP_FLAG_SELF 1 + +struct lws_esp32 { + char sta_ip[16]; + char sta_mask[16]; + char sta_gw[16]; + char serial[16]; + char opts[16]; + char model[16]; + char group[16]; + char role[16]; + char ssid[4][16]; + char password[4][32]; + char active_ssid[32]; + char access_pw[16]; + char hostname[32]; + char mac[20]; + mdns_server_t *mdns; + char region; + char inet; + char conn_ap; + + enum genled_state genled; + uint64_t genled_t; + + lws_cb_scan_done scan_consumer; + void *scan_consumer_arg; + struct lws_group_member *first; + int extant_group_members; +}; + +struct lws_esp32_image { + uint32_t romfs; + uint32_t romfs_len; + uint32_t json; + uint32_t json_len; +}; + +extern struct lws_esp32 lws_esp32; +struct lws_vhost; + +extern esp_err_t +lws_esp32_event_passthru(void *ctx, system_event_t *event); +extern void +lws_esp32_wlan_config(void); +extern void +lws_esp32_wlan_start_ap(void); +extern void +lws_esp32_wlan_start_station(void); +struct lws_context_creation_info; +extern void +lws_esp32_set_creation_defaults(struct lws_context_creation_info *info); +extern struct lws_context * +lws_esp32_init(struct lws_context_creation_info *, struct lws_vhost **pvh); +extern int +lws_esp32_wlan_nvs_get(int retry); +extern esp_err_t +lws_nvs_set_str(nvs_handle handle, const char* key, const char* value); +extern void +lws_esp32_restart_guided(uint32_t type); +extern const esp_partition_t * +lws_esp_ota_get_boot_partition(void); +extern int +lws_esp32_get_image_info(const esp_partition_t *part, struct lws_esp32_image *i, char *json, int json_len); +extern int +lws_esp32_leds_network_indication(void); + +extern uint32_t lws_esp32_get_reboot_type(void); +extern uint16_t lws_esp32_sine_interp(int n); + +/* required in external code by esp32 plat (may just return if no leds) */ +extern void lws_esp32_leds_timer_cb(TimerHandle_t th); +#else +typedef int lws_sockfd_type; +typedef int lws_filefd_type; +#define lws_sockfd_valid(sfd) (sfd >= 0) +#endif +#endif + +#define lws_pollfd pollfd +#define LWS_POLLHUP (POLLHUP|POLLERR) +#define LWS_POLLIN (POLLIN) +#define LWS_POLLOUT (POLLOUT) +#endif + + +#if (defined(WIN32) || defined(_WIN32)) && !defined(__MINGW32__) +/* ... */ +#define ssize_t SSIZE_T +#endif + +#if defined(WIN32) && defined(LWS_HAVE__STAT32I64) +#include +#include +#endif + +#if defined(LWS_HAVE_STDINT_H) +#include +#else +#if defined(WIN32) || defined(_WIN32) +/* !!! >:-[ */ +typedef unsigned __int32 uint32_t; +typedef unsigned __int16 uint16_t; +typedef unsigned __int8 uint8_t; +#else +typedef unsigned int uint32_t; +typedef unsigned short uint16_t; +typedef unsigned char uint8_t; +#endif +#endif + +typedef unsigned long long lws_filepos_t; +typedef long long lws_fileofs_t; +typedef uint32_t lws_fop_flags_t; + +/** struct lws_pollargs - argument structure for all external poll related calls + * passed in via 'in' */ +struct lws_pollargs { + lws_sockfd_type fd; /**< applicable socket descriptor */ + int events; /**< the new event mask */ + int prev_events; /**< the previous event mask */ +}; + +struct lws_tokens; +struct lws_token_limits; + +/*! \defgroup wsclose Websocket Close + * + * ##Websocket close frame control + * + * When we close a ws connection, we can send a reason code and a short + * UTF-8 description back with the close packet. + */ +///@{ + +/* + * NOTE: These public enums are part of the abi. If you want to add one, + * add it at where specified so existing users are unaffected. + */ +/** enum lws_close_status - RFC6455 close status codes */ +enum lws_close_status { + LWS_CLOSE_STATUS_NOSTATUS = 0, + LWS_CLOSE_STATUS_NORMAL = 1000, + /**< 1000 indicates a normal closure, meaning that the purpose for + which the connection was established has been fulfilled. */ + LWS_CLOSE_STATUS_GOINGAWAY = 1001, + /**< 1001 indicates that an endpoint is "going away", such as a server + going down or a browser having navigated away from a page. */ + LWS_CLOSE_STATUS_PROTOCOL_ERR = 1002, + /**< 1002 indicates that an endpoint is terminating the connection due + to a protocol error. */ + LWS_CLOSE_STATUS_UNACCEPTABLE_OPCODE = 1003, + /**< 1003 indicates that an endpoint is terminating the connection + because it has received a type of data it cannot accept (e.g., an + endpoint that understands only text data MAY send this if it + receives a binary message). */ + LWS_CLOSE_STATUS_RESERVED = 1004, + /**< Reserved. The specific meaning might be defined in the future. */ + LWS_CLOSE_STATUS_NO_STATUS = 1005, + /**< 1005 is a reserved value and MUST NOT be set as a status code in a + Close control frame by an endpoint. It is designated for use in + applications expecting a status code to indicate that no status + code was actually present. */ + LWS_CLOSE_STATUS_ABNORMAL_CLOSE = 1006, + /**< 1006 is a reserved value and MUST NOT be set as a status code in a + Close control frame by an endpoint. It is designated for use in + applications expecting a status code to indicate that the + connection was closed abnormally, e.g., without sending or + receiving a Close control frame. */ + LWS_CLOSE_STATUS_INVALID_PAYLOAD = 1007, + /**< 1007 indicates that an endpoint is terminating the connection + because it has received data within a message that was not + consistent with the type of the message (e.g., non-UTF-8 [RFC3629] + data within a text message). */ + LWS_CLOSE_STATUS_POLICY_VIOLATION = 1008, + /**< 1008 indicates that an endpoint is terminating the connection + because it has received a message that violates its policy. This + is a generic status code that can be returned when there is no + other more suitable status code (e.g., 1003 or 1009) or if there + is a need to hide specific details about the policy. */ + LWS_CLOSE_STATUS_MESSAGE_TOO_LARGE = 1009, + /**< 1009 indicates that an endpoint is terminating the connection + because it has received a message that is too big for it to + process. */ + LWS_CLOSE_STATUS_EXTENSION_REQUIRED = 1010, + /**< 1010 indicates that an endpoint (client) is terminating the + connection because it has expected the server to negotiate one or + more extension, but the server didn't return them in the response + message of the WebSocket handshake. The list of extensions that + are needed SHOULD appear in the /reason/ part of the Close frame. + Note that this status code is not used by the server, because it + can fail the WebSocket handshake instead */ + LWS_CLOSE_STATUS_UNEXPECTED_CONDITION = 1011, + /**< 1011 indicates that a server is terminating the connection because + it encountered an unexpected condition that prevented it from + fulfilling the request. */ + LWS_CLOSE_STATUS_TLS_FAILURE = 1015, + /**< 1015 is a reserved value and MUST NOT be set as a status code in a + Close control frame by an endpoint. It is designated for use in + applications expecting a status code to indicate that the + connection was closed due to a failure to perform a TLS handshake + (e.g., the server certificate can't be verified). */ + + /****** add new things just above ---^ ******/ + + LWS_CLOSE_STATUS_NOSTATUS_CONTEXT_DESTROY = 9999, +}; + +/** + * lws_close_reason - Set reason and aux data to send with Close packet + * If you are going to return nonzero from the callback + * requesting the connection to close, you can optionally + * call this to set the reason the peer will be told if + * possible. + * + * \param wsi: The websocket connection to set the close reason on + * \param status: A valid close status from websocket standard + * \param buf: NULL or buffer containing up to 124 bytes of auxiliary data + * \param len: Length of data in \param buf to send + */ +LWS_VISIBLE LWS_EXTERN void +lws_close_reason(struct lws *wsi, enum lws_close_status status, + unsigned char *buf, size_t len); + +///@} + +struct lws; +struct lws_context; +/* needed even with extensions disabled for create context */ +struct lws_extension; + +/*! \defgroup lwsmeta lws-meta + * + * ##lws-meta protocol + * + * The protocol wraps other muxed connections inside one tcp connection. + * + * Commands are assigned from 0x41 up (so they are valid unicode) + */ +///@{ + +enum lws_meta_commands { + LWS_META_CMD_OPEN_SUBCHANNEL = 'A', + /**< Client requests to open new subchannel + */ + LWS_META_CMD_OPEN_RESULT, + /**< Result of client request to open new subchannel */ + LWS_META_CMD_CLOSE_NOTIFY, + /**< Notification of subchannel closure */ + LWS_META_CMD_CLOSE_RQ, + /**< client requests to close a subchannel */ + LWS_META_CMD_WRITE, + /**< connection writes something to specific channel index */ + + /****** add new things just above ---^ ******/ +}; + +/* channel numbers are transported offset by 0x20 so they are valid unicode */ + +#define LWS_META_TRANSPORT_OFFSET 0x20 + +///@} + +/*! \defgroup usercb User Callback + * + * ##User protocol callback + * + * The protocol callback is the primary way lws interacts with + * user code. For one of a list of a few dozen reasons the callback gets + * called at some event to be handled. + * + * All of the events can be ignored, returning 0 is taken as "OK" and returning + * nonzero in most cases indicates that the connection should be closed. + */ +///@{ + +struct lws_ssl_info { + int where; + int ret; +}; + +/* + * NOTE: These public enums are part of the abi. If you want to add one, + * add it at where specified so existing users are unaffected. + */ +/** enum lws_callback_reasons - reason you're getting a protocol callback */ +enum lws_callback_reasons { + LWS_CALLBACK_ESTABLISHED = 0, + /**< (VH) after the server completes a handshake with an incoming + * client. If you built the library with ssl support, in is a + * pointer to the ssl struct associated with the connection or NULL.*/ + LWS_CALLBACK_CLIENT_CONNECTION_ERROR = 1, + /**< the request client connection has been unable to complete a + * handshake with the remote server. If in is non-NULL, you can + * find an error string of length len where it points to + * + * Diagnostic strings that may be returned include + * + * "getaddrinfo (ipv6) failed" + * "unknown address family" + * "getaddrinfo (ipv4) failed" + * "set socket opts failed" + * "insert wsi failed" + * "lws_ssl_client_connect1 failed" + * "lws_ssl_client_connect2 failed" + * "Peer hung up" + * "read failed" + * "HS: URI missing" + * "HS: Redirect code but no Location" + * "HS: URI did not parse" + * "HS: Redirect failed" + * "HS: Server did not return 200" + * "HS: OOM" + * "HS: disallowed by client filter" + * "HS: disallowed at ESTABLISHED" + * "HS: ACCEPT missing" + * "HS: ws upgrade response not 101" + * "HS: UPGRADE missing" + * "HS: Upgrade to something other than websocket" + * "HS: CONNECTION missing" + * "HS: UPGRADE malformed" + * "HS: PROTOCOL malformed" + * "HS: Cannot match protocol" + * "HS: EXT: list too big" + * "HS: EXT: failed setting defaults" + * "HS: EXT: failed parsing defaults" + * "HS: EXT: failed parsing options" + * "HS: EXT: Rejects server options" + * "HS: EXT: unknown ext" + * "HS: Accept hash wrong" + * "HS: Rejected by filter cb" + * "HS: OOM" + * "HS: SO_SNDBUF failed" + * "HS: Rejected at CLIENT_ESTABLISHED" + */ + LWS_CALLBACK_CLIENT_FILTER_PRE_ESTABLISH = 2, + /**< this is the last chance for the client user code to examine the + * http headers and decide to reject the connection. If the + * content in the headers is interesting to the + * client (url, etc) it needs to copy it out at + * this point since it will be destroyed before + * the CLIENT_ESTABLISHED call */ + LWS_CALLBACK_CLIENT_ESTABLISHED = 3, + /**< after your client connection completed + * a handshake with the remote server */ + LWS_CALLBACK_CLOSED = 4, + /**< when the websocket session ends */ + LWS_CALLBACK_CLOSED_HTTP = 5, + /**< when a HTTP (non-websocket) session ends */ + LWS_CALLBACK_RECEIVE = 6, + /**< data has appeared for this server endpoint from a + * remote client, it can be found at *in and is + * len bytes long */ + LWS_CALLBACK_RECEIVE_PONG = 7, + /**< servers receive PONG packets with this callback reason */ + LWS_CALLBACK_CLIENT_RECEIVE = 8, + /**< data has appeared from the server for the client connection, it + * can be found at *in and is len bytes long */ + LWS_CALLBACK_CLIENT_RECEIVE_PONG = 9, + /**< clients receive PONG packets with this callback reason */ + LWS_CALLBACK_CLIENT_WRITEABLE = 10, + /**< If you call lws_callback_on_writable() on a connection, you will + * get one of these callbacks coming when the connection socket + * is able to accept another write packet without blocking. + * If it already was able to take another packet without blocking, + * you'll get this callback at the next call to the service loop + * function. Notice that CLIENTs get LWS_CALLBACK_CLIENT_WRITEABLE + * and servers get LWS_CALLBACK_SERVER_WRITEABLE. */ + LWS_CALLBACK_SERVER_WRITEABLE = 11, + /**< See LWS_CALLBACK_CLIENT_WRITEABLE */ + LWS_CALLBACK_HTTP = 12, + /**< an http request has come from a client that is not + * asking to upgrade the connection to a websocket + * one. This is a chance to serve http content, + * for example, to send a script to the client + * which will then open the websockets connection. + * in points to the URI path requested and + * lws_serve_http_file() makes it very + * simple to send back a file to the client. + * Normally after sending the file you are done + * with the http connection, since the rest of the + * activity will come by websockets from the script + * that was delivered by http, so you will want to + * return 1; to close and free up the connection. */ + LWS_CALLBACK_HTTP_BODY = 13, + /**< the next len bytes data from the http + * request body HTTP connection is now available in in. */ + LWS_CALLBACK_HTTP_BODY_COMPLETION = 14, + /**< the expected amount of http request body has been delivered */ + LWS_CALLBACK_HTTP_FILE_COMPLETION = 15, + /**< a file requested to be sent down http link has completed. */ + LWS_CALLBACK_HTTP_WRITEABLE = 16, + /**< you can write more down the http protocol link now. */ + LWS_CALLBACK_FILTER_NETWORK_CONNECTION = 17, + /**< called when a client connects to + * the server at network level; the connection is accepted but then + * passed to this callback to decide whether to hang up immediately + * or not, based on the client IP. in contains the connection + * socket's descriptor. Since the client connection information is + * not available yet, wsi still pointing to the main server socket. + * Return non-zero to terminate the connection before sending or + * receiving anything. Because this happens immediately after the + * network connection from the client, there's no websocket protocol + * selected yet so this callback is issued only to protocol 0. */ + LWS_CALLBACK_FILTER_HTTP_CONNECTION = 18, + /**< called when the request has + * been received and parsed from the client, but the response is + * not sent yet. Return non-zero to disallow the connection. + * user is a pointer to the connection user space allocation, + * in is the URI, eg, "/" + * In your handler you can use the public APIs + * lws_hdr_total_length() / lws_hdr_copy() to access all of the + * headers using the header enums lws_token_indexes from + * libwebsockets.h to check for and read the supported header + * presence and content before deciding to allow the http + * connection to proceed or to kill the connection. */ + LWS_CALLBACK_SERVER_NEW_CLIENT_INSTANTIATED = 19, + /**< A new client just had + * been connected, accepted, and instantiated into the pool. This + * callback allows setting any relevant property to it. Because this + * happens immediately after the instantiation of a new client, + * there's no websocket protocol selected yet so this callback is + * issued only to protocol 0. Only wsi is defined, pointing to the + * new client, and the return value is ignored. */ + LWS_CALLBACK_FILTER_PROTOCOL_CONNECTION = 20, + /**< called when the handshake has + * been received and parsed from the client, but the response is + * not sent yet. Return non-zero to disallow the connection. + * user is a pointer to the connection user space allocation, + * in is the requested protocol name + * In your handler you can use the public APIs + * lws_hdr_total_length() / lws_hdr_copy() to access all of the + * headers using the header enums lws_token_indexes from + * libwebsockets.h to check for and read the supported header + * presence and content before deciding to allow the handshake + * to proceed or to kill the connection. */ + LWS_CALLBACK_OPENSSL_LOAD_EXTRA_CLIENT_VERIFY_CERTS = 21, + /**< if configured for + * including OpenSSL support, this callback allows your user code + * to perform extra SSL_CTX_load_verify_locations() or similar + * calls to direct OpenSSL where to find certificates the client + * can use to confirm the remote server identity. user is the + * OpenSSL SSL_CTX* */ + LWS_CALLBACK_OPENSSL_LOAD_EXTRA_SERVER_VERIFY_CERTS = 22, + /**< if configured for + * including OpenSSL support, this callback allows your user code + * to load extra certificates into the server which allow it to + * verify the validity of certificates returned by clients. user + * is the server's OpenSSL SSL_CTX* */ + LWS_CALLBACK_OPENSSL_PERFORM_CLIENT_CERT_VERIFICATION = 23, + /**< if the libwebsockets vhost was created with the option + * LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT, then this + * callback is generated during OpenSSL verification of the cert + * sent from the client. It is sent to protocol[0] callback as + * no protocol has been negotiated on the connection yet. + * Notice that the libwebsockets context and wsi are both NULL + * during this callback. See + * http://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html + * to understand more detail about the OpenSSL callback that + * generates this libwebsockets callback and the meanings of the + * arguments passed. In this callback, user is the x509_ctx, + * in is the ssl pointer and len is preverify_ok + * Notice that this callback maintains libwebsocket return + * conventions, return 0 to mean the cert is OK or 1 to fail it. + * This also means that if you don't handle this callback then + * the default callback action of returning 0 allows the client + * certificates. */ + LWS_CALLBACK_CLIENT_APPEND_HANDSHAKE_HEADER = 24, + /**< this callback happens + * when a client handshake is being compiled. user is NULL, + * in is a char **, it's pointing to a char * which holds the + * next location in the header buffer where you can add + * headers, and len is the remaining space in the header buffer, + * which is typically some hundreds of bytes. So, to add a canned + * cookie, your handler code might look similar to: + * + * char **p = (char **)in; + * + * if (len < 100) + * return 1; + * + * *p += sprintf(*p, "Cookie: a=b\x0d\x0a"); + * + * return 0; + * + * Notice if you add anything, you just have to take care about + * the CRLF on the line you added. Obviously this callback is + * optional, if you don't handle it everything is fine. + * + * Notice the callback is coming to protocols[0] all the time, + * because there is no specific protocol negotiated yet. */ + LWS_CALLBACK_CONFIRM_EXTENSION_OKAY = 25, + /**< When the server handshake code + * sees that it does support a requested extension, before + * accepting the extension by additing to the list sent back to + * the client it gives this callback just to check that it's okay + * to use that extension. It calls back to the requested protocol + * and with in being the extension name, len is 0 and user is + * valid. Note though at this time the ESTABLISHED callback hasn't + * happened yet so if you initialize user content there, user + * content during this callback might not be useful for anything. */ + LWS_CALLBACK_CLIENT_CONFIRM_EXTENSION_SUPPORTED = 26, + /**< When a client + * connection is being prepared to start a handshake to a server, + * each supported extension is checked with protocols[0] callback + * with this reason, giving the user code a chance to suppress the + * claim to support that extension by returning non-zero. If + * unhandled, by default 0 will be returned and the extension + * support included in the header to the server. Notice this + * callback comes to protocols[0]. */ + LWS_CALLBACK_PROTOCOL_INIT = 27, + /**< One-time call per protocol, per-vhost using it, so it can + * do initial setup / allocations etc */ + LWS_CALLBACK_PROTOCOL_DESTROY = 28, + /**< One-time call per protocol, per-vhost using it, indicating + * this protocol won't get used at all after this callback, the + * vhost is getting destroyed. Take the opportunity to + * deallocate everything that was allocated by the protocol. */ + LWS_CALLBACK_WSI_CREATE = 29, + /**< outermost (earliest) wsi create notification to protocols[0] */ + LWS_CALLBACK_WSI_DESTROY = 30, + /**< outermost (latest) wsi destroy notification to protocols[0] */ + LWS_CALLBACK_GET_THREAD_ID = 31, + /**< lws can accept callback when writable requests from other + * threads, if you implement this callback and return an opaque + * current thread ID integer. */ + + /* external poll() management support */ + LWS_CALLBACK_ADD_POLL_FD = 32, + /**< lws normally deals with its poll() or other event loop + * internally, but in the case you are integrating with another + * server you will need to have lws sockets share a + * polling array with the other server. This and the other + * POLL_FD related callbacks let you put your specialized + * poll array interface code in the callback for protocol 0, the + * first protocol you support, usually the HTTP protocol in the + * serving case. + * This callback happens when a socket needs to be + * added to the polling loop: in points to a struct + * lws_pollargs; the fd member of the struct is the file + * descriptor, and events contains the active events + * + * If you are using the internal lws polling / event loop + * you can just ignore these callbacks. */ + LWS_CALLBACK_DEL_POLL_FD = 33, + /**< This callback happens when a socket descriptor + * needs to be removed from an external polling array. in is + * again the struct lws_pollargs containing the fd member + * to be removed. If you are using the internal polling + * loop, you can just ignore it. */ + LWS_CALLBACK_CHANGE_MODE_POLL_FD = 34, + /**< This callback happens when lws wants to modify the events for + * a connection. + * in is the struct lws_pollargs with the fd to change. + * The new event mask is in events member and the old mask is in + * the prev_events member. + * If you are using the internal polling loop, you can just ignore + * it. */ + LWS_CALLBACK_LOCK_POLL = 35, + /**< These allow the external poll changes driven + * by lws to participate in an external thread locking + * scheme around the changes, so the whole thing is threadsafe. + * These are called around three activities in the library, + * - inserting a new wsi in the wsi / fd table (len=1) + * - deleting a wsi from the wsi / fd table (len=1) + * - changing a wsi's POLLIN/OUT state (len=0) + * Locking and unlocking external synchronization objects when + * len == 1 allows external threads to be synchronized against + * wsi lifecycle changes if it acquires the same lock for the + * duration of wsi dereference from the other thread context. */ + LWS_CALLBACK_UNLOCK_POLL = 36, + /**< See LWS_CALLBACK_LOCK_POLL, ignore if using lws internal poll */ + + LWS_CALLBACK_OPENSSL_CONTEXT_REQUIRES_PRIVATE_KEY = 37, + /**< if configured for including OpenSSL support but no private key + * file has been specified (ssl_private_key_filepath is NULL), this is + * called to allow the user to set the private key directly via + * libopenssl and perform further operations if required; this might be + * useful in situations where the private key is not directly accessible + * by the OS, for example if it is stored on a smartcard. + * user is the server's OpenSSL SSL_CTX* */ + LWS_CALLBACK_WS_PEER_INITIATED_CLOSE = 38, + /**< The peer has sent an unsolicited Close WS packet. in and + * len are the optional close code (first 2 bytes, network + * order) and the optional additional information which is not + * defined in the standard, and may be a string or non-human- readable data. + * If you return 0 lws will echo the close and then close the + * connection. If you return nonzero lws will just close the + * connection. */ + + LWS_CALLBACK_WS_EXT_DEFAULTS = 39, + /**< Gives client connections an opportunity to adjust negotiated + * extension defaults. `user` is the extension name that was + * negotiated (eg, "permessage-deflate"). `in` points to a + * buffer and `len` is the buffer size. The user callback can + * set the buffer to a string describing options the extension + * should parse. Or just ignore for defaults. */ + + LWS_CALLBACK_CGI = 40, + /**< CGI: CGI IO events on stdin / out / err are sent here on + * protocols[0]. The provided `lws_callback_http_dummy()` + * handles this and the callback should be directed there if + * you use CGI. */ + LWS_CALLBACK_CGI_TERMINATED = 41, + /**< CGI: The related CGI process ended, this is called before + * the wsi is closed. Used to, eg, terminate chunking. + * The provided `lws_callback_http_dummy()` + * handles this and the callback should be directed there if + * you use CGI. The child PID that terminated is in len. */ + LWS_CALLBACK_CGI_STDIN_DATA = 42, + /**< CGI: Data is, to be sent to the CGI process stdin, eg from + * a POST body. The provided `lws_callback_http_dummy()` + * handles this and the callback should be directed there if + * you use CGI. */ + LWS_CALLBACK_CGI_STDIN_COMPLETED = 43, + /**< CGI: no more stdin is coming. The provided + * `lws_callback_http_dummy()` handles this and the callback + * should be directed there if you use CGI. */ + LWS_CALLBACK_ESTABLISHED_CLIENT_HTTP = 44, + /**< The HTTP client connection has succeeded, and is now + * connected to the server */ + LWS_CALLBACK_CLOSED_CLIENT_HTTP = 45, + /**< The HTTP client connection is closing */ + LWS_CALLBACK_RECEIVE_CLIENT_HTTP = 46, + /**< This simply indicates data was received on the HTTP client + * connection. It does NOT drain or provide the data. + * This exists to neatly allow a proxying type situation, + * where this incoming data will go out on another connection. + * If the outgoing connection stalls, we should stall processing + * the incoming data. So a handler for this in that case should + * simply set a flag to indicate there is incoming data ready + * and ask for a writeable callback on the outgoing connection. + * In the writable callback he can check the flag and then get + * and drain the waiting incoming data using lws_http_client_read(). + * This will use callbacks to LWS_CALLBACK_RECEIVE_CLIENT_HTTP_READ + * to get and drain the incoming data, where it should be sent + * back out on the outgoing connection. */ + LWS_CALLBACK_COMPLETED_CLIENT_HTTP = 47, + /**< The client transaction completed... at the moment this + * is the same as closing since transaction pipelining on + * client side is not yet supported. */ + LWS_CALLBACK_RECEIVE_CLIENT_HTTP_READ = 48, + /**< This is generated by lws_http_client_read() used to drain + * incoming data. In the case the incoming data was chunked, + * it will be split into multiple smaller callbacks for each + * chunk block, removing the chunk headers. If not chunked, + * it will appear all in one callback. */ + LWS_CALLBACK_HTTP_BIND_PROTOCOL = 49, + /**< By default, all HTTP handling is done in protocols[0]. + * However you can bind different protocols (by name) to + * different parts of the URL space using callback mounts. This + * callback occurs in the new protocol when a wsi is bound + * to that protocol. Any protocol allocation related to the + * http transaction processing should be created then. + * These specific callbacks are necessary because with HTTP/1.1, + * a single connection may perform at series of different + * transactions at different URLs, thus the lifetime of the + * protocol bind is just for one transaction, not connection. */ + LWS_CALLBACK_HTTP_DROP_PROTOCOL = 50, + /**< This is called when a transaction is unbound from a protocol. + * It indicates the connection completed its transaction and may + * do something different now. Any protocol allocation related + * to the http transaction processing should be destroyed. */ + LWS_CALLBACK_CHECK_ACCESS_RIGHTS = 51, + /**< This gives the user code a chance to forbid an http access. + * `in` points to a `struct lws_process_html_args`, which + * describes the URL, and a bit mask describing the type of + * authentication required. If the callback returns nonzero, + * the transaction ends with HTTP_STATUS_UNAUTHORIZED. */ + LWS_CALLBACK_PROCESS_HTML = 52, + /**< This gives your user code a chance to mangle outgoing + * HTML. `in` points to a `struct lws_process_html_args` + * which describes the buffer containing outgoing HTML. + * The buffer may grow up to `.max_len` (currently +128 + * bytes per buffer). + * */ + LWS_CALLBACK_ADD_HEADERS = 53, + /**< This gives your user code a chance to add headers to a + * transaction bound to your protocol. `in` points to a + * `struct lws_process_html_args` describing a buffer and length + * you can add headers into using the normal lws apis. + * + * Only `args->p` and `args->len` are valid, and `args->p` should + * be moved on by the amount of bytes written, if any. Eg + * + * case LWS_CALLBACK_ADD_HEADERS: + * + * struct lws_process_html_args *args = + * (struct lws_process_html_args *)in; + * + * if (lws_add_http_header_by_name(wsi, + * (unsigned char *)"set-cookie:", + * (unsigned char *)cookie, cookie_len, + * (unsigned char **)&args->p, + * (unsigned char *)args->p + args->max_len)) + * return 1; + * + * break; + */ + LWS_CALLBACK_SESSION_INFO = 54, + /**< This is only generated by user code using generic sessions. + * It's used to get a `struct lws_session_info` filled in by + * generic sessions with information about the logged-in user. + * See the messageboard sample for an example of how to use. */ + + LWS_CALLBACK_GS_EVENT = 55, + /**< Indicates an event happened to the Generic Sessions session. + * `in` contains a `struct lws_gs_event_args` describing the event. */ + LWS_CALLBACK_HTTP_PMO = 56, + /**< per-mount options for this connection, called before + * the normal LWS_CALLBACK_HTTP when the mount has per-mount + * options. + */ + LWS_CALLBACK_CLIENT_HTTP_WRITEABLE = 57, + /**< when doing an HTTP type client connection, you can call + * lws_client_http_body_pending(wsi, 1) from + * LWS_CALLBACK_CLIENT_APPEND_HANDSHAKE_HEADER to get these callbacks + * sending the HTTP headers. + * + * From this callback, when you have sent everything, you should let + * lws know by calling lws_client_http_body_pending(wsi, 0) + */ + LWS_CALLBACK_OPENSSL_PERFORM_SERVER_CERT_VERIFICATION = 58, + /**< Similar to LWS_CALLBACK_OPENSSL_PERFORM_CLIENT_CERT_VERIFICATION + * this callback is called during OpenSSL verification of the cert + * sent from the server to the client. It is sent to protocol[0] + * callback as no protocol has been negotiated on the connection yet. + * Notice that the wsi is set because lws_client_connect_via_info was + * successful. + * + * See http://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html + * to understand more detail about the OpenSSL callback that + * generates this libwebsockets callback and the meanings of the + * arguments passed. In this callback, user is the x509_ctx, + * in is the ssl pointer and len is preverify_ok. + * + * THIS IS NOT RECOMMENDED BUT if a cert validation error shall be + * overruled and cert shall be accepted as ok, + * X509_STORE_CTX_set_error((X509_STORE_CTX*)user, X509_V_OK); must be + * called and return value must be 0 to mean the cert is OK; + * returning 1 will fail the cert in any case. + * + * This also means that if you don't handle this callback then + * the default callback action of returning 0 will not accept the + * certificate in case of a validation error decided by the SSL lib. + * + * This is expected and secure behaviour when validating certificates. + * + * Note: LCCSCF_ALLOW_SELFSIGNED and + * LCCSCF_SKIP_SERVER_CERT_HOSTNAME_CHECK still work without this + * callback being implemented. + */ + LWS_CALLBACK_RAW_RX = 59, + /**< RAW mode connection RX */ + LWS_CALLBACK_RAW_CLOSE = 60, + /**< RAW mode connection is closing */ + LWS_CALLBACK_RAW_WRITEABLE = 61, + /**< RAW mode connection may be written */ + LWS_CALLBACK_RAW_ADOPT = 62, + /**< RAW mode connection was adopted (equivalent to 'wsi created') */ + LWS_CALLBACK_RAW_ADOPT_FILE = 63, + /**< RAW mode file was adopted (equivalent to 'wsi created') */ + LWS_CALLBACK_RAW_RX_FILE = 64, + /**< RAW mode file has something to read */ + LWS_CALLBACK_RAW_WRITEABLE_FILE = 65, + /**< RAW mode file is writeable */ + LWS_CALLBACK_RAW_CLOSE_FILE = 66, + /**< RAW mode wsi that adopted a file is closing */ + LWS_CALLBACK_SSL_INFO = 67, + /**< SSL connections only. An event you registered an + * interest in at the vhost has occurred on a connection + * using the vhost. in is a pointer to a + * struct lws_ssl_info containing information about the + * event*/ + LWS_CALLBACK_CHILD_WRITE_VIA_PARENT = 68, + /**< Child has been marked with parent_carries_io attribute, so + * lws_write directs the to this callback at the parent, + * in is a struct lws_write_passthru containing the args + * the lws_write() was called with. + */ + LWS_CALLBACK_CHILD_CLOSING = 69, + /**< Sent to parent to notify them a child is closing / being + * destroyed. in is the child wsi. + */ + LWS_CALLBACK_CGI_PROCESS_ATTACH = 70, + /**< CGI: Sent when the CGI process is spawned for the wsi. The + * len parameter is the PID of the child process */ + + /****** add new things just above ---^ ******/ + + LWS_CALLBACK_USER = 1000, + /**< user code can use any including above without fear of clashes */ +}; + + + +/** + * typedef lws_callback_function() - User server actions + * \param wsi: Opaque websocket instance pointer + * \param reason: The reason for the call + * \param user: Pointer to per-session user data allocated by library + * \param in: Pointer used for some callback reasons + * \param len: Length set for some callback reasons + * + * This callback is the way the user controls what is served. All the + * protocol detail is hidden and handled by the library. + * + * For each connection / session there is user data allocated that is + * pointed to by "user". You set the size of this user data area when + * the library is initialized with lws_create_server. + */ +typedef int +lws_callback_function(struct lws *wsi, enum lws_callback_reasons reason, + void *user, void *in, size_t len); + +#define LWS_CB_REASON_AUX_BF__CGI 1 +#define LWS_CB_REASON_AUX_BF__PROXY 2 +#define LWS_CB_REASON_AUX_BF__CGI_CHUNK_END 4 +#define LWS_CB_REASON_AUX_BF__CGI_HEADERS 8 +///@} + +/*! \defgroup generic hash + * ## Generic Hash related functions + * + * Lws provides generic hash / digest accessors that abstract the ones + * provided by whatever OpenSSL library you are linking against. + * + * It lets you use the same code if you build against mbedtls or OpenSSL + * for example. + */ +///@{ + +#ifdef LWS_OPENSSL_SUPPORT + +#if defined(LWS_WITH_MBEDTLS) +#include +#include +#include +#endif + +#define LWS_GENHASH_TYPE_SHA1 0 +#define LWS_GENHASH_TYPE_SHA256 1 +#define LWS_GENHASH_TYPE_SHA512 2 + +struct lws_genhash_ctx { + uint8_t type; +#if defined(LWS_WITH_MBEDTLS) + union { + mbedtls_sha1_context sha1; + mbedtls_sha256_context sha256; + mbedtls_sha512_context sha512; + } u; +#else + const EVP_MD *evp_type; + EVP_MD_CTX *mdctx; +#endif +}; + +/** lws_genhash_size() - get hash size in bytes + * + * \param type: one of LWS_GENHASH_TYPE_... + * + * Returns number of bytes in this type of hash + */ +LWS_VISIBLE LWS_EXTERN size_t LWS_WARN_UNUSED_RESULT +lws_genhash_size(int type); + +/** lws_genhash_init() - prepare your struct lws_genhash_ctx for use + * + * \param ctx: your struct lws_genhash_ctx + * \param type: one of LWS_GENHASH_TYPE_... + * + * Initializes the hash context for the type you requested + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_genhash_init(struct lws_genhash_ctx *ctx, int type); + +/** lws_genhash_update() - digest len bytes of the buffer starting at in + * + * \param ctx: your struct lws_genhash_ctx + * \param in: start of the bytes to digest + * \param len: count of bytes to digest + * + * Updates the state of your hash context to reflect digesting len bytes from in + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_genhash_update(struct lws_genhash_ctx *ctx, const void *in, size_t len); + +/** lws_genhash_destroy() - copy out the result digest and destroy the ctx + * + * \param ctx: your struct lws_genhash_ctx + * \param result: NULL, or where to copy the result hash + * + * Finalizes the hash and copies out the digest. Destroys any allocations such + * that ctx can safely go out of scope after calling this. + * + * NULL result is supported so that you can destroy the ctx cleanly on error + * conditions, where there is no valid result. + */ +LWS_VISIBLE LWS_EXTERN int +lws_genhash_destroy(struct lws_genhash_ctx *ctx, void *result); + +#endif + +///@} + +/*! \defgroup extensions Extension related functions + * ##Extension releated functions + * + * Ws defines optional extensions, lws provides the ability to implement these + * in user code if so desired. + * + * We provide one extensions permessage-deflate. + */ +///@{ + +/* + * NOTE: These public enums are part of the abi. If you want to add one, + * add it at where specified so existing users are unaffected. + */ +enum lws_extension_callback_reasons { + LWS_EXT_CB_SERVER_CONTEXT_CONSTRUCT = 0, + LWS_EXT_CB_CLIENT_CONTEXT_CONSTRUCT = 1, + LWS_EXT_CB_SERVER_CONTEXT_DESTRUCT = 2, + LWS_EXT_CB_CLIENT_CONTEXT_DESTRUCT = 3, + LWS_EXT_CB_CONSTRUCT = 4, + LWS_EXT_CB_CLIENT_CONSTRUCT = 5, + LWS_EXT_CB_CHECK_OK_TO_REALLY_CLOSE = 6, + LWS_EXT_CB_CHECK_OK_TO_PROPOSE_EXTENSION = 7, + LWS_EXT_CB_DESTROY = 8, + LWS_EXT_CB_DESTROY_ANY_WSI_CLOSING = 9, + LWS_EXT_CB_ANY_WSI_ESTABLISHED = 10, + LWS_EXT_CB_PACKET_RX_PREPARSE = 11, + LWS_EXT_CB_PACKET_TX_PRESEND = 12, + LWS_EXT_CB_PACKET_TX_DO_SEND = 13, + LWS_EXT_CB_HANDSHAKE_REPLY_TX = 14, + LWS_EXT_CB_FLUSH_PENDING_TX = 15, + LWS_EXT_CB_EXTENDED_PAYLOAD_RX = 16, + LWS_EXT_CB_CAN_PROXY_CLIENT_CONNECTION = 17, + LWS_EXT_CB_1HZ = 18, + LWS_EXT_CB_REQUEST_ON_WRITEABLE = 19, + LWS_EXT_CB_IS_WRITEABLE = 20, + LWS_EXT_CB_PAYLOAD_TX = 21, + LWS_EXT_CB_PAYLOAD_RX = 22, + LWS_EXT_CB_OPTION_DEFAULT = 23, + LWS_EXT_CB_OPTION_SET = 24, + LWS_EXT_CB_OPTION_CONFIRM = 25, + LWS_EXT_CB_NAMED_OPTION_SET = 26, + + /****** add new things just above ---^ ******/ +}; + +/** enum lws_ext_options_types */ +enum lws_ext_options_types { + EXTARG_NONE, /**< does not take an argument */ + EXTARG_DEC, /**< requires a decimal argument */ + EXTARG_OPT_DEC /**< may have an optional decimal argument */ + + /* Add new things just above here ---^ + * This is part of the ABI, don't needlessly break compatibility */ +}; + +/** struct lws_ext_options - Option arguments to the extension. These are + * used in the negotiation at ws upgrade time. + * The helper function lws_ext_parse_options() + * uses these to generate callbacks */ +struct lws_ext_options { + const char *name; /**< Option name, eg, "server_no_context_takeover" */ + enum lws_ext_options_types type; /**< What kind of args the option can take */ + + /* Add new things just above here ---^ + * This is part of the ABI, don't needlessly break compatibility */ +}; + +/** struct lws_ext_option_arg */ +struct lws_ext_option_arg { + const char *option_name; /**< may be NULL, option_index used then */ + int option_index; /**< argument ordinal to use if option_name missing */ + const char *start; /**< value */ + int len; /**< length of value */ +}; + +/** + * typedef lws_extension_callback_function() - Hooks to allow extensions to operate + * \param context: Websockets context + * \param ext: This extension + * \param wsi: Opaque websocket instance pointer + * \param reason: The reason for the call + * \param user: Pointer to ptr to per-session user data allocated by library + * \param in: Pointer used for some callback reasons + * \param len: Length set for some callback reasons + * + * Each extension that is active on a particular connection receives + * callbacks during the connection lifetime to allow the extension to + * operate on websocket data and manage itself. + * + * Libwebsockets takes care of allocating and freeing "user" memory for + * each active extension on each connection. That is what is pointed to + * by the user parameter. + * + * LWS_EXT_CB_CONSTRUCT: called when the server has decided to + * select this extension from the list provided by the client, + * just before the server will send back the handshake accepting + * the connection with this extension active. This gives the + * extension a chance to initialize its connection context found + * in user. + * + * LWS_EXT_CB_CLIENT_CONSTRUCT: same as LWS_EXT_CB_CONSTRUCT + * but called when client is instantiating this extension. Some + * extensions will work the same on client and server side and then + * you can just merge handlers for both CONSTRUCTS. + * + * LWS_EXT_CB_DESTROY: called when the connection the extension was + * being used on is about to be closed and deallocated. It's the + * last chance for the extension to deallocate anything it has + * allocated in the user data (pointed to by user) before the + * user data is deleted. This same callback is used whether you + * are in client or server instantiation context. + * + * LWS_EXT_CB_PACKET_RX_PREPARSE: when this extension was active on + * a connection, and a packet of data arrived at the connection, + * it is passed to this callback to give the extension a chance to + * change the data, eg, decompress it. user is pointing to the + * extension's private connection context data, in is pointing + * to an lws_tokens struct, it consists of a char * pointer called + * token, and an int called token_len. At entry, these are + * set to point to the received buffer and set to the content + * length. If the extension will grow the content, it should use + * a new buffer allocated in its private user context data and + * set the pointed-to lws_tokens members to point to its buffer. + * + * LWS_EXT_CB_PACKET_TX_PRESEND: this works the same way as + * LWS_EXT_CB_PACKET_RX_PREPARSE above, except it gives the + * extension a chance to change websocket data just before it will + * be sent out. Using the same lws_token pointer scheme in in, + * the extension can change the buffer and the length to be + * transmitted how it likes. Again if it wants to grow the + * buffer safely, it should copy the data into its own buffer and + * set the lws_tokens token pointer to it. + * + * LWS_EXT_CB_ARGS_VALIDATE: + */ +typedef int +lws_extension_callback_function(struct lws_context *context, + const struct lws_extension *ext, struct lws *wsi, + enum lws_extension_callback_reasons reason, + void *user, void *in, size_t len); + +/** struct lws_extension - An extension we support */ +struct lws_extension { + const char *name; /**< Formal extension name, eg, "permessage-deflate" */ + lws_extension_callback_function *callback; /**< Service callback */ + const char *client_offer; /**< String containing exts and options client offers */ + + /* Add new things just above here ---^ + * This is part of the ABI, don't needlessly break compatibility */ +}; + +/** + * lws_set_extension_option(): set extension option if possible + * + * \param wsi: websocket connection + * \param ext_name: name of ext, like "permessage-deflate" + * \param opt_name: name of option, like "rx_buf_size" + * \param opt_val: value to set option to + */ +LWS_VISIBLE LWS_EXTERN int +lws_set_extension_option(struct lws *wsi, const char *ext_name, + const char *opt_name, const char *opt_val); + +#ifndef LWS_NO_EXTENSIONS +/* lws_get_internal_extensions() - DEPRECATED + * + * \Deprecated There is no longer a set internal extensions table. The table is provided + * by user code along with application-specific settings. See the test + * client and server for how to do. + */ +static LWS_INLINE LWS_WARN_DEPRECATED const struct lws_extension * +lws_get_internal_extensions(void) { return NULL; } + +/** + * lws_ext_parse_options() - deal with parsing negotiated extension options + * + * \param ext: related extension struct + * \param wsi: websocket connection + * \param ext_user: per-connection extension private data + * \param opts: list of supported options + * \param o: option string to parse + * \param len: length + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_ext_parse_options(const struct lws_extension *ext, struct lws *wsi, + void *ext_user, const struct lws_ext_options *opts, + const char *o, int len); +#endif + +/** lws_extension_callback_pm_deflate() - extension for RFC7692 + * + * \param context: lws context + * \param ext: related lws_extension struct + * \param wsi: websocket connection + * \param reason: incoming callback reason + * \param user: per-connection extension private data + * \param in: pointer parameter + * \param len: length parameter + * + * Built-in callback implementing RFC7692 permessage-deflate + */ +LWS_EXTERN +int lws_extension_callback_pm_deflate( + struct lws_context *context, const struct lws_extension *ext, + struct lws *wsi, enum lws_extension_callback_reasons reason, + void *user, void *in, size_t len); + +/* + * The internal exts are part of the public abi + * If we add more extensions, publish the callback here ------v + */ +///@} + +/*! \defgroup Protocols-and-Plugins Protocols and Plugins + * \ingroup lwsapi + * + * ##Protocol and protocol plugin -related apis + * + * Protocols bind ws protocol names to a custom callback specific to that + * protocol implementaion. + * + * A list of protocols can be passed in at context creation time, but it is + * also legal to leave that NULL and add the protocols and their callback code + * using plugins. + * + * Plugins are much preferable compared to cut and pasting code into an + * application each time, since they can be used standalone. + */ +///@{ +/** struct lws_protocols - List of protocols and handlers client or server + * supports. */ + +struct lws_protocols { + const char *name; + /**< Protocol name that must match the one given in the client + * Javascript new WebSocket(url, 'protocol') name. */ + lws_callback_function *callback; + /**< The service callback used for this protocol. It allows the + * service action for an entire protocol to be encapsulated in + * the protocol-specific callback */ + size_t per_session_data_size; + /**< Each new connection using this protocol gets + * this much memory allocated on connection establishment and + * freed on connection takedown. A pointer to this per-connection + * allocation is passed into the callback in the 'user' parameter */ + size_t rx_buffer_size; + /**< lws allocates this much space for rx data and informs callback + * when something came. Due to rx flow control, the callback may not + * be able to consume it all without having to return to the event + * loop. That is supported in lws. + * + * If .tx_packet_size is 0, this also controls how much may be sent at once + * for backwards compatibility. + */ + unsigned int id; + /**< ignored by lws, but useful to contain user information bound + * to the selected protocol. For example if this protocol was + * called "myprotocol-v2", you might set id to 2, and the user + * code that acts differently according to the version can do so by + * switch (wsi->protocol->id), user code might use some bits as + * capability flags based on selected protocol version, etc. */ + void *user; /**< ignored by lws, but user code can pass a pointer + here it can later access from the protocol callback */ + size_t tx_packet_size; + /**< 0 indicates restrict send() size to .rx_buffer_size for backwards- + * compatibility. + * If greater than zero, a single send() is restricted to this amount + * and any remainder is buffered by lws and sent afterwards also in + * these size chunks. Since that is expensive, it's preferable + * to restrict one fragment you are trying to send to match this + * size. + */ + + /* Add new things just above here ---^ + * This is part of the ABI, don't needlessly break compatibility */ +}; + +struct lws_vhost; + +/** + * lws_vhost_name_to_protocol() - get vhost's protocol object from its name + * + * \param vh: vhost to search + * \param name: protocol name + * + * Returns NULL or a pointer to the vhost's protocol of the requested name + */ +LWS_VISIBLE LWS_EXTERN const struct lws_protocols * +lws_vhost_name_to_protocol(struct lws_vhost *vh, const char *name); + +/** + * lws_get_protocol() - Returns a protocol pointer from a websocket + * connection. + * \param wsi: pointer to struct websocket you want to know the protocol of + * + * + * Some apis can act on all live connections of a given protocol, + * this is how you can get a pointer to the active protocol if needed. + */ +LWS_VISIBLE LWS_EXTERN const struct lws_protocols * +lws_get_protocol(struct lws *wsi); + +/** lws_protocol_get() - deprecated: use lws_get_protocol */ +LWS_VISIBLE LWS_EXTERN const struct lws_protocols * +lws_protocol_get(struct lws *wsi) LWS_WARN_DEPRECATED; + +/** + * lws_protocol_vh_priv_zalloc() - Allocate and zero down a protocol's per-vhost + * storage + * \param vhost: vhost the instance is related to + * \param prot: protocol the instance is related to + * \param size: bytes to allocate + * + * Protocols often find it useful to allocate a per-vhost struct, this is a + * helper to be called in the per-vhost init LWS_CALLBACK_PROTOCOL_INIT + */ +LWS_VISIBLE LWS_EXTERN void * +lws_protocol_vh_priv_zalloc(struct lws_vhost *vhost, const struct lws_protocols *prot, + int size); + +/** + * lws_protocol_vh_priv_get() - retreive a protocol's per-vhost storage + * + * \param vhost: vhost the instance is related to + * \param prot: protocol the instance is related to + * + * Recover a pointer to the allocated per-vhost storage for the protocol created + * by lws_protocol_vh_priv_zalloc() earlier + */ +LWS_VISIBLE LWS_EXTERN void * +lws_protocol_vh_priv_get(struct lws_vhost *vhost, const struct lws_protocols *prot); + +/** + * lws_adjust_protocol_psds - change a vhost protocol's per session data size + * + * \param wsi: a connection with the protocol to change + * \param new_size: the new size of the per session data size for the protocol + * + * Returns user_space for the wsi, after allocating + * + * This should not be used except to initalize a vhost protocol's per session + * data size one time, before any connections are accepted. + * + * Sometimes the protocol wraps another protocol and needs to discover and set + * its per session data size at runtime. + */ +LWS_VISIBLE LWS_EXTERN void * +lws_adjust_protocol_psds(struct lws *wsi, size_t new_size); + +/** + * lws_finalize_startup() - drop initial process privileges + * + * \param context: lws context + * + * This is called after the end of the vhost protocol initializations, but + * you may choose to call it earlier + */ +LWS_VISIBLE LWS_EXTERN int +lws_finalize_startup(struct lws_context *context); + +LWS_VISIBLE LWS_EXTERN int +lws_protocol_init(struct lws_context *context); + +#ifdef LWS_WITH_PLUGINS + +/* PLUGINS implies LIBUV */ + +#define LWS_PLUGIN_API_MAGIC 180 + +/** struct lws_plugin_capability - how a plugin introduces itself to lws */ +struct lws_plugin_capability { + unsigned int api_magic; /**< caller fills this in, plugin fills rest */ + const struct lws_protocols *protocols; /**< array of supported protocols provided by plugin */ + int count_protocols; /**< how many protocols */ + const struct lws_extension *extensions; /**< array of extensions provided by plugin */ + int count_extensions; /**< how many extensions */ +}; + +typedef int (*lws_plugin_init_func)(struct lws_context *, + struct lws_plugin_capability *); +typedef int (*lws_plugin_destroy_func)(struct lws_context *); + +/** struct lws_plugin */ +struct lws_plugin { + struct lws_plugin *list; /**< linked list */ +#if (UV_VERSION_MAJOR > 0) + uv_lib_t lib; /**< shared library pointer */ +#else + void *l; /**< so we can compile on ancient libuv */ +#endif + char name[64]; /**< name of the plugin */ + struct lws_plugin_capability caps; /**< plugin capabilities */ +}; + +#endif + +///@} + + +/*! \defgroup generic-sessions plugin: generic-sessions + * \ingroup Protocols-and-Plugins + * + * ##Plugin Generic-sessions related + * + * generic-sessions plugin provides a reusable, generic session and login / + * register / forgot password framework including email verification. + */ +///@{ + +#define LWSGS_EMAIL_CONTENT_SIZE 16384 +/**< Maximum size of email we might send */ + +/* SHA-1 binary and hexified versions */ +/** typedef struct lwsgw_hash_bin */ +typedef struct { unsigned char bin[20]; /**< binary representation of hash */} lwsgw_hash_bin; +/** typedef struct lwsgw_hash */ +typedef struct { char id[41]; /**< ascii hex representation of hash */ } lwsgw_hash; + +/** enum lwsgs_auth_bits */ +enum lwsgs_auth_bits { + LWSGS_AUTH_LOGGED_IN = 1, /**< user is logged in as somebody */ + LWSGS_AUTH_ADMIN = 2, /**< logged in as the admin user */ + LWSGS_AUTH_VERIFIED = 4, /**< user has verified his email */ + LWSGS_AUTH_FORGOT_FLOW = 8, /**< he just completed "forgot password" flow */ +}; + +/** struct lws_session_info - information about user session status */ +struct lws_session_info { + char username[32]; /**< username logged in as, or empty string */ + char email[100]; /**< email address associated with login, or empty string */ + char ip[72]; /**< ip address session was started from */ + unsigned int mask; /**< access rights mask associated with session + * see enum lwsgs_auth_bits */ + char session[42]; /**< session id string, usable as opaque uid when not logged in */ +}; + +/** enum lws_gs_event */ +enum lws_gs_event { + LWSGSE_CREATED, /**< a new user was created */ + LWSGSE_DELETED /**< an existing user was deleted */ +}; + +/** struct lws_gs_event_args */ +struct lws_gs_event_args { + enum lws_gs_event event; /**< which event happened */ + const char *username; /**< which username the event happened to */ + const char *email; /**< the email address of that user */ +}; + +///@} + + +/*! \defgroup context-and-vhost context and vhost related functions + * ##Context and Vhost releated functions + * \ingroup lwsapi + * + * + * LWS requires that there is one context, in which you may define multiple + * vhosts. Each vhost is a virtual host, with either its own listen port + * or sharing an existing one. Each vhost has its own SSL context that can + * be set up individually or left disabled. + * + * If you don't care about multiple "site" support, you can ignore it and + * lws will create a single default vhost at context creation time. + */ +///@{ + +/* + * NOTE: These public enums are part of the abi. If you want to add one, + * add it at where specified so existing users are unaffected. + */ + +/** enum lws_context_options - context and vhost options */ +enum lws_context_options { + LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT = (1 << 1) | + (1 << 12), + /**< (VH) Don't allow the connection unless the client has a + * client cert that we recognize; provides + * LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT */ + LWS_SERVER_OPTION_SKIP_SERVER_CANONICAL_NAME = (1 << 2), + /**< (CTX) Don't try to get the server's hostname */ + LWS_SERVER_OPTION_ALLOW_NON_SSL_ON_SSL_PORT = (1 << 3) | + (1 << 12), + /**< (VH) Allow non-SSL (plaintext) connections on the same + * port as SSL is listening... undermines the security of SSL; + * provides LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT */ + LWS_SERVER_OPTION_LIBEV = (1 << 4), + /**< (CTX) Use libev event loop */ + LWS_SERVER_OPTION_DISABLE_IPV6 = (1 << 5), + /**< (VH) Disable IPV6 support */ + LWS_SERVER_OPTION_DISABLE_OS_CA_CERTS = (1 << 6), + /**< (VH) Don't load OS CA certs, you will need to load your + * own CA cert(s) */ + LWS_SERVER_OPTION_PEER_CERT_NOT_REQUIRED = (1 << 7), + /**< (VH) Accept connections with no valid Cert (eg, selfsigned) */ + LWS_SERVER_OPTION_VALIDATE_UTF8 = (1 << 8), + /**< (VH) Check UT-8 correctness */ + LWS_SERVER_OPTION_SSL_ECDH = (1 << 9) | + (1 << 12), + /**< (VH) initialize ECDH ciphers */ + LWS_SERVER_OPTION_LIBUV = (1 << 10), + /**< (CTX) Use libuv event loop */ + LWS_SERVER_OPTION_REDIRECT_HTTP_TO_HTTPS = (1 << 11) | + (1 << 12), + /**< (VH) Use http redirect to force http to https + * (deprecated: use mount redirection) */ + LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT = (1 << 12), + /**< (CTX) Initialize the SSL library at all */ + LWS_SERVER_OPTION_EXPLICIT_VHOSTS = (1 << 13), + /**< (CTX) Only create the context when calling context + * create api, implies user code will create its own vhosts */ + LWS_SERVER_OPTION_UNIX_SOCK = (1 << 14), + /**< (VH) Use Unix socket */ + LWS_SERVER_OPTION_STS = (1 << 15), + /**< (VH) Send Strict Transport Security header, making + * clients subsequently go to https even if user asked for http */ + LWS_SERVER_OPTION_IPV6_V6ONLY_MODIFY = (1 << 16), + /**< (VH) Enable LWS_SERVER_OPTION_IPV6_V6ONLY_VALUE to take effect */ + LWS_SERVER_OPTION_IPV6_V6ONLY_VALUE = (1 << 17), + /**< (VH) if set, only ipv6 allowed on the vhost */ + LWS_SERVER_OPTION_UV_NO_SIGSEGV_SIGFPE_SPIN = (1 << 18), + /**< (CTX) Libuv only: Do not spin on SIGSEGV / SIGFPE. A segfault + * normally makes the lib spin so you can attach a debugger to it + * even if it happened without a debugger in place. You can disable + * that by giving this option. + */ + LWS_SERVER_OPTION_JUST_USE_RAW_ORIGIN = (1 << 19), + /**< For backwards-compatibility reasons, by default + * lws prepends "http://" to the origin you give in the client + * connection info struct. If you give this flag when you create + * the context, only the string you give in the client connect + * info for .origin (if any) will be used directly. + */ + LWS_SERVER_OPTION_FALLBACK_TO_RAW = (1 << 20), + /**< (VH) if invalid http is coming in the first line, */ + LWS_SERVER_OPTION_LIBEVENT = (1 << 21), + /**< (CTX) Use libevent event loop */ + LWS_SERVER_OPTION_ONLY_RAW = (1 << 22), + /**< (VH) All connections to this vhost / port are RAW as soon as + * the connection is accepted, no HTTP is going to be coming. + */ + LWS_SERVER_OPTION_ALLOW_LISTEN_SHARE = (1 << 23), + /**< (VH) Set to allow multiple listen sockets on one interface + + * address + port. The default is to strictly allow only one + * listen socket at a time. This is automatically selected if you + * have multiple service threads. + */ + LWS_SERVER_OPTION_CREATE_VHOST_SSL_CTX = (1 << 24), + /**< (VH) Force setting up the vhost SSL_CTX, even though the user + * code doesn't explicitly provide a cert in the info struct. It + * implies the user code is going to provide a cert at the + * LWS_CALLBACK_OPENSSL_LOAD_EXTRA_SERVER_VERIFY_CERTS callback, which + * provides the vhost SSL_CTX * in the user parameter. + */ + + /****** add new things just above ---^ ******/ +}; + +#define lws_check_opt(c, f) (((c) & (f)) == (f)) + +struct lws_plat_file_ops; + +/** struct lws_context_creation_info - parameters to create context and /or vhost with + * + * This is also used to create vhosts.... if LWS_SERVER_OPTION_EXPLICIT_VHOSTS + * is not given, then for backwards compatibility one vhost is created at + * context-creation time using the info from this struct. + * + * If LWS_SERVER_OPTION_EXPLICIT_VHOSTS is given, then no vhosts are created + * at the same time as the context, they are expected to be created afterwards. + */ +struct lws_context_creation_info { + int port; + /**< VHOST: Port to listen on. Use CONTEXT_PORT_NO_LISTEN to suppress + * listening for a client. Use CONTEXT_PORT_NO_LISTEN_SERVER if you are + * writing a server but you are using \ref sock-adopt instead of the + * built-in listener */ + const char *iface; + /**< VHOST: NULL to bind the listen socket to all interfaces, or the + * interface name, eg, "eth2" + * If options specifies LWS_SERVER_OPTION_UNIX_SOCK, this member is + * the pathname of a UNIX domain socket. you can use the UNIX domain + * sockets in abstract namespace, by prepending an at symbol to the + * socket name. */ + const struct lws_protocols *protocols; + /**< VHOST: Array of structures listing supported protocols and a protocol- + * specific callback for each one. The list is ended with an + * entry that has a NULL callback pointer. */ + const struct lws_extension *extensions; + /**< VHOST: NULL or array of lws_extension structs listing the + * extensions this context supports. */ + const struct lws_token_limits *token_limits; + /**< CONTEXT: NULL or struct lws_token_limits pointer which is initialized + * with a token length limit for each possible WSI_TOKEN_ */ + const char *ssl_private_key_password; + /**< VHOST: NULL or the passphrase needed for the private key. (For + * backwards compatibility, this can also be used to pass the client + * cert passphrase when setting up a vhost client SSL context, but it is + * preferred to use .client_ssl_private_key_password for that.) */ + const char *ssl_cert_filepath; + /**< VHOST: If libwebsockets was compiled to use ssl, and you want + * to listen using SSL, set to the filepath to fetch the + * server cert from, otherwise NULL for unencrypted. (For backwards + * compatibility, this can also be used to pass the client certificate + * when setting up a vhost client SSL context, but it is preferred to + * use .client_ssl_cert_filepath for that.) */ + const char *ssl_private_key_filepath; + /**< VHOST: filepath to private key if wanting SSL mode; + * if this is set to NULL but ssl_cert_filepath is set, the + * OPENSSL_CONTEXT_REQUIRES_PRIVATE_KEY callback is called + * to allow setting of the private key directly via openSSL + * library calls. (For backwards compatibility, this can also be used + * to pass the client cert private key filepath when setting up a + * vhost client SSL context, but it is preferred to use + * .client_ssl_private_key_filepath for that.) */ + const char *ssl_ca_filepath; + /**< VHOST: CA certificate filepath or NULL. (For backwards + * compatibility, this can also be used to pass the client CA + * filepath when setting up a vhost client SSL context, + * but it is preferred to use .client_ssl_ca_filepath for that.) */ + const char *ssl_cipher_list; + /**< VHOST: List of valid ciphers to use (eg, + * "RC4-MD5:RC4-SHA:AES128-SHA:AES256-SHA:HIGH:!DSS:!aNULL" + * or you can leave it as NULL to get "DEFAULT" (For backwards + * compatibility, this can also be used to pass the client cipher + * list when setting up a vhost client SSL context, + * but it is preferred to use .client_ssl_cipher_list for that.)*/ + const char *http_proxy_address; + /**< VHOST: If non-NULL, attempts to proxy via the given address. + * If proxy auth is required, use format "username:password\@server:port" */ + unsigned int http_proxy_port; + /**< VHOST: If http_proxy_address was non-NULL, uses this port */ + int gid; + /**< CONTEXT: group id to change to after setting listen socket, or -1. */ + int uid; + /**< CONTEXT: user id to change to after setting listen socket, or -1. */ + unsigned int options; + /**< VHOST + CONTEXT: 0, or LWS_SERVER_OPTION_... bitfields */ + void *user; + /**< VHOST + CONTEXT: optional user pointer that will be associated + * with the context when creating the context (and can be retrieved by + * lws_context_user(context), or with the vhost when creating the vhost + * (and can be retrieved by lws_vhost_user(vhost)). You will need to + * use LWS_SERVER_OPTION_EXPLICIT_VHOSTS and create the vhost separately + * if you care about giving the context and vhost different user pointer + * values. + */ + int ka_time; + /**< CONTEXT: 0 for no TCP keepalive, otherwise apply this keepalive + * timeout to all libwebsocket sockets, client or server */ + int ka_probes; + /**< CONTEXT: if ka_time was nonzero, after the timeout expires how many + * times to try to get a response from the peer before giving up + * and killing the connection */ + int ka_interval; + /**< CONTEXT: if ka_time was nonzero, how long to wait before each ka_probes + * attempt */ +#ifdef LWS_OPENSSL_SUPPORT + SSL_CTX *provided_client_ssl_ctx; + /**< CONTEXT: If non-null, swap out libwebsockets ssl + * implementation for the one provided by provided_ssl_ctx. + * Libwebsockets no longer is responsible for freeing the context + * if this option is selected. */ +#else /* maintain structure layout either way */ + void *provided_client_ssl_ctx; /**< dummy if ssl disabled */ +#endif + + short max_http_header_data; + /**< CONTEXT: The max amount of header payload that can be handled + * in an http request (unrecognized header payload is dropped) */ + short max_http_header_pool; + /**< CONTEXT: The max number of connections with http headers that + * can be processed simultaneously (the corresponding memory is + * allocated for the lifetime of the context). If the pool is + * busy new incoming connections must wait for accept until one + * becomes free. */ + + unsigned int count_threads; + /**< CONTEXT: how many contexts to create in an array, 0 = 1 */ + unsigned int fd_limit_per_thread; + /**< CONTEXT: nonzero means restrict each service thread to this + * many fds, 0 means the default which is divide the process fd + * limit by the number of threads. */ + unsigned int timeout_secs; + /**< VHOST: various processes involving network roundtrips in the + * library are protected from hanging forever by timeouts. If + * nonzero, this member lets you set the timeout used in seconds. + * Otherwise a default timeout is used. */ + const char *ecdh_curve; + /**< VHOST: if NULL, defaults to initializing server with "prime256v1" */ + const char *vhost_name; + /**< VHOST: name of vhost, must match external DNS name used to + * access the site, like "warmcat.com" as it's used to match + * Host: header and / or SNI name for SSL. */ + const char * const *plugin_dirs; + /**< CONTEXT: NULL, or NULL-terminated array of directories to + * scan for lws protocol plugins at context creation time */ + const struct lws_protocol_vhost_options *pvo; + /**< VHOST: pointer to optional linked list of per-vhost + * options made accessible to protocols */ + int keepalive_timeout; + /**< VHOST: (default = 0 = 60s) seconds to allow remote + * client to hold on to an idle HTTP/1.1 connection */ + const char *log_filepath; + /**< VHOST: filepath to append logs to... this is opened before + * any dropping of initial privileges */ + const struct lws_http_mount *mounts; + /**< VHOST: optional linked list of mounts for this vhost */ + const char *server_string; + /**< CONTEXT: string used in HTTP headers to identify server + * software, if NULL, "libwebsockets". */ + unsigned int pt_serv_buf_size; + /**< CONTEXT: 0 = default of 4096. This buffer is used by + * various service related features including file serving, it + * defines the max chunk of file that can be sent at once. + * At the risk of lws having to buffer failed large sends, it + * can be increased to, eg, 128KiB to improve throughput. */ + unsigned int max_http_header_data2; + /**< CONTEXT: if max_http_header_data is 0 and this + * is nonzero, this will be used in place of the default. It's + * like this for compatibility with the original short version, + * this is unsigned int length. */ + long ssl_options_set; + /**< VHOST: Any bits set here will be set as SSL options */ + long ssl_options_clear; + /**< VHOST: Any bits set here will be cleared as SSL options */ + unsigned short ws_ping_pong_interval; + /**< CONTEXT: 0 for none, else interval in seconds between sending + * PINGs on idle websocket connections. When the PING is sent, + * the PONG must come within the normal timeout_secs timeout period + * or the connection will be dropped. + * Any RX or TX traffic on the connection restarts the interval timer, + * so a connection which always sends or receives something at intervals + * less than the interval given here will never send PINGs / expect + * PONGs. Conversely as soon as the ws connection is established, an + * idle connection will do the PING / PONG roundtrip as soon as + * ws_ping_pong_interval seconds has passed without traffic + */ + const struct lws_protocol_vhost_options *headers; + /**< VHOST: pointer to optional linked list of per-vhost + * canned headers that are added to server responses */ + + const struct lws_protocol_vhost_options *reject_service_keywords; + /**< CONTEXT: Optional list of keywords and rejection codes + text. + * + * The keywords are checked for existing in the user agent string. + * + * Eg, "badrobot" "404 Not Found" + */ + void *external_baggage_free_on_destroy; + /**< CONTEXT: NULL, or pointer to something externally malloc'd, that + * should be freed when the context is destroyed. This allows you to + * automatically sync the freeing action to the context destruction + * action, so there is no need for an external free() if the context + * succeeded to create. + */ + + const char *client_ssl_private_key_password; + /**< VHOST: Client SSL context init: NULL or the passphrase needed + * for the private key */ + const char *client_ssl_cert_filepath; + /**< VHOST: Client SSL context init:T he certificate the client + * should present to the peer on connection */ + const char *client_ssl_private_key_filepath; + /**< VHOST: Client SSL context init: filepath to client private key + * if this is set to NULL but client_ssl_cert_filepath is set, you + * can handle the LWS_CALLBACK_OPENSSL_LOAD_EXTRA_CLIENT_VERIFY_CERTS + * callback of protocols[0] to allow setting of the private key directly + * via openSSL library calls */ + const char *client_ssl_ca_filepath; + /**< VHOST: Client SSL context init: CA certificate filepath or NULL */ + const char *client_ssl_cipher_list; + /**< VHOST: Client SSL context init: List of valid ciphers to use (eg, + * "RC4-MD5:RC4-SHA:AES128-SHA:AES256-SHA:HIGH:!DSS:!aNULL" + * or you can leave it as NULL to get "DEFAULT" */ + + const struct lws_plat_file_ops *fops; + /**< CONTEXT: NULL, or pointer to an array of fops structs, terminated + * by a sentinel with NULL .open. + * + * If NULL, lws provides just the platform file operations struct for + * backwards compatibility. + */ + int simultaneous_ssl_restriction; + /**< CONTEXT: 0 (no limit) or limit of simultaneous SSL sessions possible.*/ + const char *socks_proxy_address; + /**< VHOST: If non-NULL, attempts to proxy via the given address. + * If proxy auth is required, use format "username:password\@server:port" */ + unsigned int socks_proxy_port; + /**< VHOST: If socks_proxy_address was non-NULL, uses this port */ +#if defined(LWS_HAVE_SYS_CAPABILITY_H) && defined(LWS_HAVE_LIBCAP) + cap_value_t caps[4]; + /**< CONTEXT: array holding Linux capabilities you want to + * continue to be available to the server after it transitions + * to a noprivileged user. Usually none are needed but for, eg, + * .bind_iface, CAP_NET_RAW is required. This gives you a way + * to still have the capability but drop root. + */ + char count_caps; + /**< CONTEXT: count of Linux capabilities in .caps[]. 0 means + * no capabilities will be inherited from root (the default) */ +#endif + int bind_iface; + /**< VHOST: nonzero to strictly bind sockets to the interface name in + * .iface (eg, "eth2"), using SO_BIND_TO_DEVICE. + * + * Requires SO_BINDTODEVICE support from your OS and CAP_NET_RAW + * capability. + * + * Notice that common things like access network interface IP from + * your local machine use your lo / loopback interface and will be + * disallowed by this. + */ + int ssl_info_event_mask; + /**< VHOST: mask of ssl events to be reported on LWS_CALLBACK_SSL_INFO + * callback for connections on this vhost. The mask values are of + * the form SSL_CB_ALERT, defined in openssl/ssl.h. The default of + * 0 means no info events will be reported. + */ + unsigned int timeout_secs_ah_idle; + /**< VHOST: seconds to allow a client to hold an ah without using it. + * 0 defaults to 10s. */ + unsigned short ip_limit_ah; + /**< CONTEXT: max number of ah a single IP may use simultaneously + * 0 is no limit. This is a soft limit: if the limit is + * reached, connections from that IP will wait in the ah + * waiting list and not be able to acquire an ah until + * a connection belonging to the IP relinquishes one it + * already has. + */ + unsigned short ip_limit_wsi; + /**< CONTEXT: max number of wsi a single IP may use simultaneously. + * 0 is no limit. This is a hard limit, connections from + * the same IP will simply be dropped once it acquires the + * amount of simultaneous wsi / accepted connections + * given here. + */ + uint32_t http2_settings[7]; + /**< CONTEXT: after context creation http2_settings[1] thru [6] have + * been set to the lws platform default values. + * VHOST: if http2_settings[0] is nonzero, the values given in + * http2_settings[1]..[6] are used instead of the lws + * platform default values. + * Just leave all at 0 if you don't care. + */ + + /* Add new things just above here ---^ + * This is part of the ABI, don't needlessly break compatibility + * + * The below is to ensure later library versions with new + * members added above will see 0 (default) even if the app + * was not built against the newer headers. + */ + + void *_unused[8]; /**< dummy */ +}; + +/** + * lws_create_context() - Create the websocket handler + * \param info: pointer to struct with parameters + * + * This function creates the listening socket (if serving) and takes care + * of all initialization in one step. + * + * If option LWS_SERVER_OPTION_EXPLICIT_VHOSTS is given, no vhost is + * created; you're expected to create your own vhosts afterwards using + * lws_create_vhost(). Otherwise a vhost named "default" is also created + * using the information in the vhost-related members, for compatibility. + * + * After initialization, it returns a struct lws_context * that + * represents this server. After calling, user code needs to take care + * of calling lws_service() with the context pointer to get the + * server's sockets serviced. This must be done in the same process + * context as the initialization call. + * + * The protocol callback functions are called for a handful of events + * including http requests coming in, websocket connections becoming + * established, and data arriving; it's also called periodically to allow + * async transmission. + * + * HTTP requests are sent always to the FIRST protocol in protocol, since + * at that time websocket protocol has not been negotiated. Other + * protocols after the first one never see any HTTP callback activity. + * + * The server created is a simple http server by default; part of the + * websocket standard is upgrading this http connection to a websocket one. + * + * This allows the same server to provide files like scripts and favicon / + * images or whatever over http and dynamic data over websockets all in + * one place; they're all handled in the user callback. + */ +LWS_VISIBLE LWS_EXTERN struct lws_context * +lws_create_context(struct lws_context_creation_info *info); + +/** + * lws_context_destroy() - Destroy the websocket context + * \param context: Websocket context + * + * This function closes any active connections and then frees the + * context. After calling this, any further use of the context is + * undefined. + */ +LWS_VISIBLE LWS_EXTERN void +lws_context_destroy(struct lws_context *context); + +LWS_VISIBLE LWS_EXTERN void +lws_context_destroy2(struct lws_context *context); + +typedef int (*lws_reload_func)(void); + +/** + * lws_context_deprecate() - Deprecate the websocket context + * + * \param context: Websocket context + * \param cb: Callback notified when old context listen sockets are closed + * + * This function is used on an existing context before superceding it + * with a new context. + * + * It closes any listen sockets in the context, so new connections are + * not possible. + * + * And it marks the context to be deleted when the number of active + * connections into it falls to zero. + * + * Otherwise if you attach the deprecated context to the replacement + * context when it has been created using lws_context_attach_deprecated() + * both any deprecated and the new context will service their connections. + * + * This is aimed at allowing seamless configuration reloads. + * + * The callback cb will be called after the listen sockets are actually + * closed and may be reopened. In the callback the new context should be + * configured and created. (With libuv, socket close happens async after + * more loop events). + */ +LWS_VISIBLE LWS_EXTERN void +lws_context_deprecate(struct lws_context *context, lws_reload_func cb); + +LWS_VISIBLE LWS_EXTERN int +lws_context_is_deprecated(struct lws_context *context); + +/** + * lws_set_proxy() - Setups proxy to lws_context. + * \param vhost: pointer to struct lws_vhost you want set proxy for + * \param proxy: pointer to c string containing proxy in format address:port + * + * Returns 0 if proxy string was parsed and proxy was setup. + * Returns -1 if proxy is NULL or has incorrect format. + * + * This is only required if your OS does not provide the http_proxy + * environment variable (eg, OSX) + * + * IMPORTANT! You should call this function right after creation of the + * lws_context and before call to connect. If you call this + * function after connect behavior is undefined. + * This function will override proxy settings made on lws_context + * creation with genenv() call. + */ +LWS_VISIBLE LWS_EXTERN int +lws_set_proxy(struct lws_vhost *vhost, const char *proxy); + +/** + * lws_set_socks() - Setup socks to lws_context. + * \param vhost: pointer to struct lws_vhost you want set socks for + * \param socks: pointer to c string containing socks in format address:port + * + * Returns 0 if socks string was parsed and socks was setup. + * Returns -1 if socks is NULL or has incorrect format. + * + * This is only required if your OS does not provide the socks_proxy + * environment variable (eg, OSX) + * + * IMPORTANT! You should call this function right after creation of the + * lws_context and before call to connect. If you call this + * function after connect behavior is undefined. + * This function will override proxy settings made on lws_context + * creation with genenv() call. + */ +LWS_VISIBLE LWS_EXTERN int +lws_set_socks(struct lws_vhost *vhost, const char *socks); + +struct lws_vhost; + +/** + * lws_create_vhost() - Create a vhost (virtual server context) + * \param context: pointer to result of lws_create_context() + * \param info: pointer to struct with parameters + * + * This function creates a virtual server (vhost) using the vhost-related + * members of the info struct. You can create many vhosts inside one context + * if you created the context with the option LWS_SERVER_OPTION_EXPLICIT_VHOSTS + */ +LWS_VISIBLE LWS_EXTERN struct lws_vhost * +lws_create_vhost(struct lws_context *context, + struct lws_context_creation_info *info); + +/** + * lws_vhost_destroy() - Destroy a vhost (virtual server context) + * + * \param vh: pointer to result of lws_create_vhost() + * + * This function destroys a vhost. Normally, if you just want to exit, + * then lws_destroy_context() will take care of everything. If you want + * to destroy an individual vhost and all connections and allocations, you + * can do it with this. + * + * If the vhost has a listen sockets shared by other vhosts, it will be given + * to one of the vhosts sharing it rather than closed. + */ +LWS_VISIBLE LWS_EXTERN void +lws_vhost_destroy(struct lws_vhost *vh); + +/** + * lwsws_get_config_globals() - Parse a JSON server config file + * \param info: pointer to struct with parameters + * \param d: filepath of the config file + * \param config_strings: storage for the config strings extracted from JSON, + * the pointer is incremented as strings are stored + * \param len: pointer to the remaining length left in config_strings + * the value is decremented as strings are stored + * + * This function prepares a n lws_context_creation_info struct with global + * settings from a file d. + * + * Requires CMake option LWS_WITH_LEJP_CONF to have been enabled + */ +LWS_VISIBLE LWS_EXTERN int +lwsws_get_config_globals(struct lws_context_creation_info *info, const char *d, + char **config_strings, int *len); + +/** + * lwsws_get_config_vhosts() - Create vhosts from a JSON server config file + * \param context: pointer to result of lws_create_context() + * \param info: pointer to struct with parameters + * \param d: filepath of the config file + * \param config_strings: storage for the config strings extracted from JSON, + * the pointer is incremented as strings are stored + * \param len: pointer to the remaining length left in config_strings + * the value is decremented as strings are stored + * + * This function creates vhosts into a context according to the settings in + *JSON files found in directory d. + * + * Requires CMake option LWS_WITH_LEJP_CONF to have been enabled + */ +LWS_VISIBLE LWS_EXTERN int +lwsws_get_config_vhosts(struct lws_context *context, + struct lws_context_creation_info *info, const char *d, + char **config_strings, int *len); + +/** lws_vhost_get() - \deprecated deprecated: use lws_get_vhost() */ +LWS_VISIBLE LWS_EXTERN struct lws_vhost * +lws_vhost_get(struct lws *wsi) LWS_WARN_DEPRECATED; + +/** + * lws_get_vhost() - return the vhost a wsi belongs to + * + * \param wsi: which connection + */ +LWS_VISIBLE LWS_EXTERN struct lws_vhost * +lws_get_vhost(struct lws *wsi); + +/** + * lws_json_dump_vhost() - describe vhost state and stats in JSON + * + * \param vh: the vhost + * \param buf: buffer to fill with JSON + * \param len: max length of buf + */ +LWS_VISIBLE LWS_EXTERN int +lws_json_dump_vhost(const struct lws_vhost *vh, char *buf, int len); + +/** + * lws_json_dump_context() - describe context state and stats in JSON + * + * \param context: the context + * \param buf: buffer to fill with JSON + * \param len: max length of buf + * \param hide_vhosts: nonzero to not provide per-vhost mount etc information + * + * Generates a JSON description of vhost state into buf + */ +LWS_VISIBLE LWS_EXTERN int +lws_json_dump_context(const struct lws_context *context, char *buf, int len, + int hide_vhosts); + +/** + * lws_vhost_user() - get the user data associated with the vhost + * \param vhost: Websocket vhost + * + * This returns the optional user pointer that can be attached to + * a vhost when it was created. Lws never dereferences this pointer, it only + * sets it when the vhost is created, and returns it using this api. + */ +LWS_VISIBLE LWS_EXTERN void * +lws_vhost_user(struct lws_vhost *vhost); + +/** + * lws_context_user() - get the user data associated with the context + * \param context: Websocket context + * + * This returns the optional user allocation that can be attached to + * the context the sockets live in at context_create time. It's a way + * to let all sockets serviced in the same context share data without + * using globals statics in the user code. + */ +LWS_VISIBLE LWS_EXTERN void * +lws_context_user(struct lws_context *context); + +/*! \defgroup vhost-mounts Vhost mounts and options + * \ingroup context-and-vhost-creation + * + * ##Vhost mounts and options + */ +///@{ +/** struct lws_protocol_vhost_options - linked list of per-vhost protocol + * name=value options + * + * This provides a general way to attach a linked-list of name=value pairs, + * which can also have an optional child link-list using the options member. + */ +struct lws_protocol_vhost_options { + const struct lws_protocol_vhost_options *next; /**< linked list */ + const struct lws_protocol_vhost_options *options; /**< child linked-list of more options for this node */ + const char *name; /**< name of name=value pair */ + const char *value; /**< value of name=value pair */ +}; + +/** enum lws_mount_protocols + * This specifies the mount protocol for a mountpoint, whether it is to be + * served from a filesystem, or it is a cgi etc. + */ +enum lws_mount_protocols { + LWSMPRO_HTTP = 0, /**< http reverse proxy */ + LWSMPRO_HTTPS = 1, /**< https reverse proxy */ + LWSMPRO_FILE = 2, /**< serve from filesystem directory */ + LWSMPRO_CGI = 3, /**< pass to CGI to handle */ + LWSMPRO_REDIR_HTTP = 4, /**< redirect to http:// url */ + LWSMPRO_REDIR_HTTPS = 5, /**< redirect to https:// url */ + LWSMPRO_CALLBACK = 6, /**< hand by named protocol's callback */ +}; + +/** struct lws_http_mount + * + * arguments for mounting something in a vhost's url namespace + */ +struct lws_http_mount { + const struct lws_http_mount *mount_next; + /**< pointer to next struct lws_http_mount */ + const char *mountpoint; + /**< mountpoint in http pathspace, eg, "/" */ + const char *origin; + /**< path to be mounted, eg, "/var/www/warmcat.com" */ + const char *def; + /**< default target, eg, "index.html" */ + const char *protocol; + /**<"protocol-name" to handle mount */ + + const struct lws_protocol_vhost_options *cgienv; + /**< optional linked-list of cgi options. These are created + * as environment variables for the cgi process + */ + const struct lws_protocol_vhost_options *extra_mimetypes; + /**< optional linked-list of mimetype mappings */ + const struct lws_protocol_vhost_options *interpret; + /**< optional linked-list of files to be interpreted */ + + int cgi_timeout; + /**< seconds cgi is allowed to live, if cgi://mount type */ + int cache_max_age; + /**< max-age for reuse of client cache of files, seconds */ + unsigned int auth_mask; + /**< bits set here must be set for authorized client session */ + + unsigned int cache_reusable:1; /**< set if client cache may reuse this */ + unsigned int cache_revalidate:1; /**< set if client cache should revalidate on use */ + unsigned int cache_intermediaries:1; /**< set if intermediaries are allowed to cache */ + + unsigned char origin_protocol; /**< one of enum lws_mount_protocols */ + unsigned char mountpoint_len; /**< length of mountpoint string */ + + const char *basic_auth_login_file; + /**revents will be zeroed now. + * + * If the socket is foreign to lws, it leaves revents alone. So you can + * see if you should service yourself by checking the pollfd revents + * after letting lws try to service it. + * + * You should also call this with pollfd = NULL to just allow the + * once-per-second global timeout checks; if less than a second since the last + * check it returns immediately then. + */ +LWS_VISIBLE LWS_EXTERN int +lws_service_fd(struct lws_context *context, struct lws_pollfd *pollfd); + +/** + * lws_service_fd_tsi() - Service polled socket in specific service thread + * \param context: Websocket context + * \param pollfd: The pollfd entry describing the socket fd and which events + * happened. + * \param tsi: thread service index + * + * Same as lws_service_fd() but used with multiple service threads + */ +LWS_VISIBLE LWS_EXTERN int +lws_service_fd_tsi(struct lws_context *context, struct lws_pollfd *pollfd, + int tsi); + +/** + * lws_service_adjust_timeout() - Check for any connection needing forced service + * \param context: Websocket context + * \param timeout_ms: The original poll timeout value. You can just set this + * to 1 if you don't really have a poll timeout. + * \param tsi: thread service index + * + * Under some conditions connections may need service even though there is no + * pending network action on them, this is "forced service". For default + * poll() and libuv / libev, the library takes care of calling this and + * dealing with it for you. But for external poll() integration, you need + * access to the apis. + * + * If anybody needs "forced service", returned timeout is zero. In that case, + * you can call lws_service_tsi() with a timeout of -1 to only service + * guys who need forced service. + */ +LWS_VISIBLE LWS_EXTERN int +lws_service_adjust_timeout(struct lws_context *context, int timeout_ms, int tsi); + +/* Backwards compatibility */ +#define lws_plat_service_tsi lws_service_tsi + +LWS_VISIBLE LWS_EXTERN int +lws_handle_POLLOUT_event(struct lws *wsi, struct lws_pollfd *pollfd); + +///@} + +/*! \defgroup http HTTP + + Modules related to handling HTTP +*/ +//@{ + +/*! \defgroup httpft HTTP File transfer + * \ingroup http + + APIs for sending local files in response to HTTP requests +*/ +//@{ + +/** + * lws_get_mimetype() - Determine mimetype to use from filename + * + * \param file: filename + * \param m: NULL, or mount context + * + * This uses a canned list of known filetypes first, if no match and m is + * non-NULL, then tries a list of per-mount file suffix to mimtype mappings. + * + * Returns either NULL or a pointer to the mimetype matching the file. + */ +LWS_VISIBLE LWS_EXTERN const char * +lws_get_mimetype(const char *file, const struct lws_http_mount *m); + +/** + * lws_serve_http_file() - Send a file back to the client using http + * \param wsi: Websocket instance (available from user callback) + * \param file: The file to issue over http + * \param content_type: The http content type, eg, text/html + * \param other_headers: NULL or pointer to header string + * \param other_headers_len: length of the other headers if non-NULL + * + * This function is intended to be called from the callback in response + * to http requests from the client. It allows the callback to issue + * local files down the http link in a single step. + * + * Returning <0 indicates error and the wsi should be closed. Returning + * >0 indicates the file was completely sent and + * lws_http_transaction_completed() called on the wsi (and close if != 0) + * ==0 indicates the file transfer is started and needs more service later, + * the wsi should be left alone. + */ +LWS_VISIBLE LWS_EXTERN int +lws_serve_http_file(struct lws *wsi, const char *file, const char *content_type, + const char *other_headers, int other_headers_len); + +LWS_VISIBLE LWS_EXTERN int +lws_serve_http_file_fragment(struct lws *wsi); +//@} + + +enum http_status { + HTTP_STATUS_CONTINUE = 100, + + HTTP_STATUS_OK = 200, + HTTP_STATUS_NO_CONTENT = 204, + HTTP_STATUS_PARTIAL_CONTENT = 206, + + HTTP_STATUS_MOVED_PERMANENTLY = 301, + HTTP_STATUS_FOUND = 302, + HTTP_STATUS_SEE_OTHER = 303, + HTTP_STATUS_NOT_MODIFIED = 304, + + HTTP_STATUS_BAD_REQUEST = 400, + HTTP_STATUS_UNAUTHORIZED, + HTTP_STATUS_PAYMENT_REQUIRED, + HTTP_STATUS_FORBIDDEN, + HTTP_STATUS_NOT_FOUND, + HTTP_STATUS_METHOD_NOT_ALLOWED, + HTTP_STATUS_NOT_ACCEPTABLE, + HTTP_STATUS_PROXY_AUTH_REQUIRED, + HTTP_STATUS_REQUEST_TIMEOUT, + HTTP_STATUS_CONFLICT, + HTTP_STATUS_GONE, + HTTP_STATUS_LENGTH_REQUIRED, + HTTP_STATUS_PRECONDITION_FAILED, + HTTP_STATUS_REQ_ENTITY_TOO_LARGE, + HTTP_STATUS_REQ_URI_TOO_LONG, + HTTP_STATUS_UNSUPPORTED_MEDIA_TYPE, + HTTP_STATUS_REQ_RANGE_NOT_SATISFIABLE, + HTTP_STATUS_EXPECTATION_FAILED, + + HTTP_STATUS_INTERNAL_SERVER_ERROR = 500, + HTTP_STATUS_NOT_IMPLEMENTED, + HTTP_STATUS_BAD_GATEWAY, + HTTP_STATUS_SERVICE_UNAVAILABLE, + HTTP_STATUS_GATEWAY_TIMEOUT, + HTTP_STATUS_HTTP_VERSION_NOT_SUPPORTED, +}; +/*! \defgroup html-chunked-substitution HTML Chunked Substitution + * \ingroup http + * + * ##HTML chunked Substitution + * + * APIs for receiving chunks of text, replacing a set of variable names via + * a callback, and then prepending and appending HTML chunked encoding + * headers. + */ +//@{ + +struct lws_process_html_args { + char *p; /**< pointer to the buffer containing the data */ + int len; /**< length of the original data at p */ + int max_len; /**< maximum length we can grow the data to */ + int final; /**< set if this is the last chunk of the file */ +}; + +typedef const char *(*lws_process_html_state_cb)(void *data, int index); + +struct lws_process_html_state { + char *start; /**< pointer to start of match */ + char swallow[16]; /**< matched character buffer */ + int pos; /**< position in match */ + void *data; /**< opaque pointer */ + const char * const *vars; /**< list of variable names */ + int count_vars; /**< count of variable names */ + + lws_process_html_state_cb replace; /**< called on match to perform substitution */ +}; + +/*! lws_chunked_html_process() - generic chunked substitution + * \param args: buffer to process using chunked encoding + * \param s: current processing state + */ +LWS_VISIBLE LWS_EXTERN int +lws_chunked_html_process(struct lws_process_html_args *args, + struct lws_process_html_state *s); +//@} + +/** \defgroup HTTP-headers-read HTTP headers: read + * \ingroup http + * + * ##HTTP header releated functions + * + * In lws the client http headers are temporarily stored in a pool, only for the + * duration of the http part of the handshake. It's because in most cases, + * the header content is ignored for the whole rest of the connection lifetime + * and would then just be taking up space needlessly. + * + * During LWS_CALLBACK_HTTP when the URI path is delivered is the last time + * the http headers are still allocated, you can use these apis then to + * look at and copy out interesting header content (cookies, etc) + * + * Notice that the header total length reported does not include a terminating + * '\0', however you must allocate for it when using the _copy apis. So the + * length reported for a header containing "123" is 3, but you must provide + * a buffer of length 4 so that "123\0" may be copied into it, or the copy + * will fail with a nonzero return code. + * + * In the special case of URL arguments, like ?x=1&y=2, the arguments are + * stored in a token named for the method, eg, WSI_TOKEN_GET_URI if it + * was a GET or WSI_TOKEN_POST_URI if POST. You can check the total + * length to confirm the method. + * + * For URL arguments, each argument is stored urldecoded in a "fragment", so + * you can use the fragment-aware api lws_hdr_copy_fragment() to access each + * argument in turn: the fragments contain urldecoded strings like x=1 or y=2. + * + * As a convenience, lws has an api that will find the fragment with a + * given name= part, lws_get_urlarg_by_name(). + */ +///@{ + +/** struct lws_tokens + * you need these to look at headers that have been parsed if using the + * LWS_CALLBACK_FILTER_CONNECTION callback. If a header from the enum + * list below is absent, .token = NULL and token_len = 0. Otherwise .token + * points to .token_len chars containing that header content. + */ +struct lws_tokens { + char *token; /**< pointer to start of the token */ + int token_len; /**< length of the token's value */ +}; + +/* enum lws_token_indexes + * these have to be kept in sync with lextable.h / minilex.c + * + * NOTE: These public enums are part of the abi. If you want to add one, + * add it at where specified so existing users are unaffected. + */ +enum lws_token_indexes { + WSI_TOKEN_GET_URI = 0, + WSI_TOKEN_POST_URI = 1, + WSI_TOKEN_OPTIONS_URI = 2, + WSI_TOKEN_HOST = 3, + WSI_TOKEN_CONNECTION = 4, + WSI_TOKEN_UPGRADE = 5, + WSI_TOKEN_ORIGIN = 6, + WSI_TOKEN_DRAFT = 7, + WSI_TOKEN_CHALLENGE = 8, + WSI_TOKEN_EXTENSIONS = 9, + WSI_TOKEN_KEY1 = 10, + WSI_TOKEN_KEY2 = 11, + WSI_TOKEN_PROTOCOL = 12, + WSI_TOKEN_ACCEPT = 13, + WSI_TOKEN_NONCE = 14, + WSI_TOKEN_HTTP = 15, + WSI_TOKEN_HTTP2_SETTINGS = 16, + WSI_TOKEN_HTTP_ACCEPT = 17, + WSI_TOKEN_HTTP_AC_REQUEST_HEADERS = 18, + WSI_TOKEN_HTTP_IF_MODIFIED_SINCE = 19, + WSI_TOKEN_HTTP_IF_NONE_MATCH = 20, + WSI_TOKEN_HTTP_ACCEPT_ENCODING = 21, + WSI_TOKEN_HTTP_ACCEPT_LANGUAGE = 22, + WSI_TOKEN_HTTP_PRAGMA = 23, + WSI_TOKEN_HTTP_CACHE_CONTROL = 24, + WSI_TOKEN_HTTP_AUTHORIZATION = 25, + WSI_TOKEN_HTTP_COOKIE = 26, + WSI_TOKEN_HTTP_CONTENT_LENGTH = 27, + WSI_TOKEN_HTTP_CONTENT_TYPE = 28, + WSI_TOKEN_HTTP_DATE = 29, + WSI_TOKEN_HTTP_RANGE = 30, + WSI_TOKEN_HTTP_REFERER = 31, + WSI_TOKEN_KEY = 32, + WSI_TOKEN_VERSION = 33, + WSI_TOKEN_SWORIGIN = 34, + + WSI_TOKEN_HTTP_COLON_AUTHORITY = 35, + WSI_TOKEN_HTTP_COLON_METHOD = 36, + WSI_TOKEN_HTTP_COLON_PATH = 37, + WSI_TOKEN_HTTP_COLON_SCHEME = 38, + WSI_TOKEN_HTTP_COLON_STATUS = 39, + + WSI_TOKEN_HTTP_ACCEPT_CHARSET = 40, + WSI_TOKEN_HTTP_ACCEPT_RANGES = 41, + WSI_TOKEN_HTTP_ACCESS_CONTROL_ALLOW_ORIGIN = 42, + WSI_TOKEN_HTTP_AGE = 43, + WSI_TOKEN_HTTP_ALLOW = 44, + WSI_TOKEN_HTTP_CONTENT_DISPOSITION = 45, + WSI_TOKEN_HTTP_CONTENT_ENCODING = 46, + WSI_TOKEN_HTTP_CONTENT_LANGUAGE = 47, + WSI_TOKEN_HTTP_CONTENT_LOCATION = 48, + WSI_TOKEN_HTTP_CONTENT_RANGE = 49, + WSI_TOKEN_HTTP_ETAG = 50, + WSI_TOKEN_HTTP_EXPECT = 51, + WSI_TOKEN_HTTP_EXPIRES = 52, + WSI_TOKEN_HTTP_FROM = 53, + WSI_TOKEN_HTTP_IF_MATCH = 54, + WSI_TOKEN_HTTP_IF_RANGE = 55, + WSI_TOKEN_HTTP_IF_UNMODIFIED_SINCE = 56, + WSI_TOKEN_HTTP_LAST_MODIFIED = 57, + WSI_TOKEN_HTTP_LINK = 58, + WSI_TOKEN_HTTP_LOCATION = 59, + WSI_TOKEN_HTTP_MAX_FORWARDS = 60, + WSI_TOKEN_HTTP_PROXY_AUTHENTICATE = 61, + WSI_TOKEN_HTTP_PROXY_AUTHORIZATION = 62, + WSI_TOKEN_HTTP_REFRESH = 63, + WSI_TOKEN_HTTP_RETRY_AFTER = 64, + WSI_TOKEN_HTTP_SERVER = 65, + WSI_TOKEN_HTTP_SET_COOKIE = 66, + WSI_TOKEN_HTTP_STRICT_TRANSPORT_SECURITY = 67, + WSI_TOKEN_HTTP_TRANSFER_ENCODING = 68, + WSI_TOKEN_HTTP_USER_AGENT = 69, + WSI_TOKEN_HTTP_VARY = 70, + WSI_TOKEN_HTTP_VIA = 71, + WSI_TOKEN_HTTP_WWW_AUTHENTICATE = 72, + + WSI_TOKEN_PATCH_URI = 73, + WSI_TOKEN_PUT_URI = 74, + WSI_TOKEN_DELETE_URI = 75, + + WSI_TOKEN_HTTP_URI_ARGS = 76, + WSI_TOKEN_PROXY = 77, + WSI_TOKEN_HTTP_X_REAL_IP = 78, + WSI_TOKEN_HTTP1_0 = 79, + WSI_TOKEN_X_FORWARDED_FOR = 80, + WSI_TOKEN_CONNECT = 81, + WSI_TOKEN_HEAD_URI = 82, + WSI_TOKEN_TE = 83, + /****** add new things just above ---^ ******/ + + /* use token storage to stash these internally, not for + * user use */ + + _WSI_TOKEN_CLIENT_SENT_PROTOCOLS, + _WSI_TOKEN_CLIENT_PEER_ADDRESS, + _WSI_TOKEN_CLIENT_URI, + _WSI_TOKEN_CLIENT_HOST, + _WSI_TOKEN_CLIENT_ORIGIN, + _WSI_TOKEN_CLIENT_METHOD, + _WSI_TOKEN_CLIENT_IFACE, + + /* always last real token index*/ + WSI_TOKEN_COUNT, + + /* parser state additions, no storage associated */ + WSI_TOKEN_NAME_PART, + WSI_TOKEN_SKIPPING, + WSI_TOKEN_SKIPPING_SAW_CR, + WSI_PARSING_COMPLETE, + WSI_INIT_TOKEN_MUXURL, +}; + +struct lws_token_limits { + unsigned short token_limit[WSI_TOKEN_COUNT]; /**< max chars for this token */ +}; + +/** + * lws_token_to_string() - returns a textual representation of a hdr token index + * + * \param token: token index + */ +LWS_VISIBLE LWS_EXTERN const unsigned char * +lws_token_to_string(enum lws_token_indexes token); + +/** + * lws_hdr_total_length: report length of all fragments of a header totalled up + * The returned length does not include the space for a + * terminating '\0' + * + * \param wsi: websocket connection + * \param h: which header index we are interested in + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_hdr_total_length(struct lws *wsi, enum lws_token_indexes h); + +/** + * lws_hdr_fragment_length: report length of a single fragment of a header + * The returned length does not include the space for a + * terminating '\0' + * + * \param wsi: websocket connection + * \param h: which header index we are interested in + * \param frag_idx: which fragment of h we want to get the length of + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_hdr_fragment_length(struct lws *wsi, enum lws_token_indexes h, int frag_idx); + +/** + * lws_hdr_copy() - copy a single fragment of the given header to a buffer + * The buffer length len must include space for an additional + * terminating '\0', or it will fail returning -1. + * + * \param wsi: websocket connection + * \param dest: destination buffer + * \param len: length of destination buffer + * \param h: which header index we are interested in + * + * copies the whole, aggregated header, even if it was delivered in + * several actual headers piece by piece + */ +LWS_VISIBLE LWS_EXTERN int +lws_hdr_copy(struct lws *wsi, char *dest, int len, enum lws_token_indexes h); + +/** + * lws_hdr_copy_fragment() - copy a single fragment of the given header to a buffer + * The buffer length len must include space for an additional + * terminating '\0', or it will fail returning -1. + * If the requested fragment index is not present, it fails + * returning -1. + * + * \param wsi: websocket connection + * \param dest: destination buffer + * \param len: length of destination buffer + * \param h: which header index we are interested in + * \param frag_idx: which fragment of h we want to copy + * + * Normally this is only useful + * to parse URI arguments like ?x=1&y=2, token index WSI_TOKEN_HTTP_URI_ARGS + * fragment 0 will contain "x=1" and fragment 1 "y=2" + */ +LWS_VISIBLE LWS_EXTERN int +lws_hdr_copy_fragment(struct lws *wsi, char *dest, int len, + enum lws_token_indexes h, int frag_idx); + +/** + * lws_get_urlarg_by_name() - return pointer to arg value if present + * \param wsi: the connection to check + * \param name: the arg name, like "token=" + * \param buf: the buffer to receive the urlarg (including the name= part) + * \param len: the length of the buffer to receive the urlarg + * + * Returns NULL if not found or a pointer inside buf to just after the + * name= part. + */ +LWS_VISIBLE LWS_EXTERN const char * +lws_get_urlarg_by_name(struct lws *wsi, const char *name, char *buf, int len); +///@} + +/*! \defgroup HTTP-headers-create HTTP headers: create + * + * ## HTTP headers: Create + * + * These apis allow you to create HTTP response headers in a way compatible with + * both HTTP/1.x and HTTP/2. + * + * They each append to a buffer taking care about the buffer end, which is + * passed in as a pointer. When data is written to the buffer, the current + * position p is updated accordingly. + * + * All of these apis are LWS_WARN_UNUSED_RESULT as they can run out of space + * and fail with nonzero return. + */ +///@{ + +#define LWSAHH_CODE_MASK ((1 << 16) - 1) +#define LWSAHH_FLAG_NO_SERVER_NAME (1 << 30) + +/** + * lws_add_http_header_status() - add the HTTP response status code + * + * \param wsi: the connection to check + * \param code: an HTTP code like 200, 404 etc (see enum http_status) + * \param p: pointer to current position in buffer pointer + * \param end: pointer to end of buffer + * + * Adds the initial response code, so should be called first. + * + * Code may additionally take OR'd flags: + * + * LWSAHH_FLAG_NO_SERVER_NAME: don't apply server name header this time + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_add_http_header_status(struct lws *wsi, + unsigned int code, unsigned char **p, + unsigned char *end); +/** + * lws_add_http_header_by_name() - append named header and value + * + * \param wsi: the connection to check + * \param name: the hdr name, like "my-header" + * \param value: the value after the = for this header + * \param length: the length of the value + * \param p: pointer to current position in buffer pointer + * \param end: pointer to end of buffer + * + * Appends name: value to the headers + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_add_http_header_by_name(struct lws *wsi, const unsigned char *name, + const unsigned char *value, int length, + unsigned char **p, unsigned char *end); +/** + * lws_add_http_header_by_token() - append given header and value + * + * \param wsi: the connection to check + * \param token: the token index for the hdr + * \param value: the value after the = for this header + * \param length: the length of the value + * \param p: pointer to current position in buffer pointer + * \param end: pointer to end of buffer + * + * Appends name=value to the headers, but is able to take advantage of better + * HTTP/2 coding mechanisms where possible. + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_add_http_header_by_token(struct lws *wsi, enum lws_token_indexes token, + const unsigned char *value, int length, + unsigned char **p, unsigned char *end); +/** + * lws_add_http_header_content_length() - append content-length helper + * + * \param wsi: the connection to check + * \param content_length: the content length to use + * \param p: pointer to current position in buffer pointer + * \param end: pointer to end of buffer + * + * Appends content-length: content_length to the headers + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_add_http_header_content_length(struct lws *wsi, + lws_filepos_t content_length, + unsigned char **p, unsigned char *end); +/** + * lws_finalize_http_header() - terminate header block + * + * \param wsi: the connection to check + * \param p: pointer to current position in buffer pointer + * \param end: pointer to end of buffer + * + * Indicates no more headers will be added + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_finalize_http_header(struct lws *wsi, unsigned char **p, + unsigned char *end); +///@} + +/** \defgroup form-parsing Form Parsing + * \ingroup http + * ##POSTed form parsing functions + * + * These lws_spa (stateful post arguments) apis let you parse and urldecode + * POSTed form arguments, both using simple urlencoded and multipart transfer + * encoding. + * + * It's capable of handling file uploads as well a named input parsing, + * and the apis are the same for both form upload styles. + * + * You feed it a list of parameter names and it creates pointers to the + * urldecoded arguments: file upload parameters pass the file data in chunks to + * a user-supplied callback as they come. + * + * Since it's stateful, it handles the incoming data needing more than one + * POST_BODY callback and has no limit on uploaded file size. + */ +///@{ + +/** enum lws_spa_fileupload_states */ +enum lws_spa_fileupload_states { + LWS_UFS_CONTENT, + /**< a chunk of file content has arrived */ + LWS_UFS_FINAL_CONTENT, + /**< the last chunk (possibly zero length) of file content has arrived */ + LWS_UFS_OPEN + /**< a new file is starting to arrive */ +}; + +/** + * lws_spa_fileupload_cb() - callback to receive file upload data + * + * \param data: opt_data pointer set in lws_spa_create + * \param name: name of the form field being uploaded + * \param filename: original filename from client + * \param buf: start of data to receive + * \param len: length of data to receive + * \param state: information about how this call relates to file + * + * Notice name and filename shouldn't be trusted, as they are passed from + * HTTP provided by the client. + */ +typedef int (*lws_spa_fileupload_cb)(void *data, const char *name, + const char *filename, char *buf, int len, + enum lws_spa_fileupload_states state); + +/** struct lws_spa - opaque urldecode parser capable of handling multipart + * and file uploads */ +struct lws_spa; + +/** + * lws_spa_create() - create urldecode parser + * + * \param wsi: lws connection (used to find Content Type) + * \param param_names: array of form parameter names, like "username" + * \param count_params: count of param_names + * \param max_storage: total amount of form parameter values we can store + * \param opt_cb: NULL, or callback to receive file upload data. + * \param opt_data: NULL, or user pointer provided to opt_cb. + * + * Creates a urldecode parser and initializes it. + * + * opt_cb can be NULL if you just want normal name=value parsing, however + * if one or more entries in your form are bulk data (file transfer), you + * can provide this callback and filter on the name callback parameter to + * treat that urldecoded data separately. The callback should return -1 + * in case of fatal error, and 0 if OK. + */ +LWS_VISIBLE LWS_EXTERN struct lws_spa * +lws_spa_create(struct lws *wsi, const char * const *param_names, + int count_params, int max_storage, lws_spa_fileupload_cb opt_cb, + void *opt_data); + +/** + * lws_spa_process() - parses a chunk of input data + * + * \param spa: the parser object previously created + * \param in: incoming, urlencoded data + * \param len: count of bytes valid at \param in + */ +LWS_VISIBLE LWS_EXTERN int +lws_spa_process(struct lws_spa *spa, const char *in, int len); + +/** + * lws_spa_finalize() - indicate incoming data completed + * + * \param spa: the parser object previously created + */ +LWS_VISIBLE LWS_EXTERN int +lws_spa_finalize(struct lws_spa *spa); + +/** + * lws_spa_get_length() - return length of parameter value + * + * \param spa: the parser object previously created + * \param n: parameter ordinal to return length of value for + */ +LWS_VISIBLE LWS_EXTERN int +lws_spa_get_length(struct lws_spa *spa, int n); + +/** + * lws_spa_get_string() - return pointer to parameter value + * \param spa: the parser object previously created + * \param n: parameter ordinal to return pointer to value for + */ +LWS_VISIBLE LWS_EXTERN const char * +lws_spa_get_string(struct lws_spa *spa, int n); + +/** + * lws_spa_destroy() - destroy parser object + * + * \param spa: the parser object previously created + */ +LWS_VISIBLE LWS_EXTERN int +lws_spa_destroy(struct lws_spa *spa); +///@} + +/*! \defgroup urlendec Urlencode and Urldecode + * \ingroup http + * + * ##HTML chunked Substitution + * + * APIs for receiving chunks of text, replacing a set of variable names via + * a callback, and then prepending and appending HTML chunked encoding + * headers. + */ +//@{ + +/** + * lws_urlencode() - like strncpy but with urlencoding + * + * \param escaped: output buffer + * \param string: input buffer ('/0' terminated) + * \param len: output buffer max length + * + * Because urlencoding expands the output string, it's not + * possible to do it in-place, ie, with escaped == string + */ +LWS_VISIBLE LWS_EXTERN const char * +lws_urlencode(char *escaped, const char *string, int len); + +/* + * URLDECODE 1 / 2 + * + * This simple urldecode only operates until the first '\0' and requires the + * data to exist all at once + */ +/** + * lws_urldecode() - like strncpy but with urldecoding + * + * \param string: output buffer + * \param escaped: input buffer ('\0' terminated) + * \param len: output buffer max length + * + * This is only useful for '\0' terminated strings + * + * Since urldecoding only shrinks the output string, it is possible to + * do it in-place, ie, string == escaped + * + * Returns 0 if completed OK or nonzero for urldecode violation (non-hex chars + * where hex required, etc) + */ +LWS_VISIBLE LWS_EXTERN int +lws_urldecode(char *string, const char *escaped, int len); +///@} +/** + * lws_return_http_status() - Return simple http status + * \param wsi: Websocket instance (available from user callback) + * \param code: Status index, eg, 404 + * \param html_body: User-readable HTML description < 1KB, or NULL + * + * Helper to report HTTP errors back to the client cleanly and + * consistently + */ +LWS_VISIBLE LWS_EXTERN int +lws_return_http_status(struct lws *wsi, unsigned int code, + const char *html_body); + +/** + * lws_http_redirect() - write http redirect into buffer + * + * \param wsi: websocket connection + * \param code: HTTP response code (eg, 301) + * \param loc: where to redirect to + * \param len: length of loc + * \param p: pointer current position in buffer (updated as we write) + * \param end: pointer to end of buffer + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_http_redirect(struct lws *wsi, int code, const unsigned char *loc, int len, + unsigned char **p, unsigned char *end); + +/** + * lws_http_transaction_completed() - wait for new http transaction or close + * \param wsi: websocket connection + * + * Returns 1 if the HTTP connection must close now + * Returns 0 and resets connection to wait for new HTTP header / + * transaction if possible + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_http_transaction_completed(struct lws *wsi); +///@} + +/*! \defgroup pur Sanitize / purify SQL and JSON helpers + * + * ##Sanitize / purify SQL and JSON helpers + * + * APIs for escaping untrusted JSON and SQL safely before use + */ +//@{ + +/** + * lws_sql_purify() - like strncpy but with escaping for sql quotes + * + * \param escaped: output buffer + * \param string: input buffer ('/0' terminated) + * \param len: output buffer max length + * + * Because escaping expands the output string, it's not + * possible to do it in-place, ie, with escaped == string + */ +LWS_VISIBLE LWS_EXTERN const char * +lws_sql_purify(char *escaped, const char *string, int len); + +/** + * lws_json_purify() - like strncpy but with escaping for json chars + * + * \param escaped: output buffer + * \param string: input buffer ('/0' terminated) + * \param len: output buffer max length + * + * Because escaping expands the output string, it's not + * possible to do it in-place, ie, with escaped == string + */ +LWS_VISIBLE LWS_EXTERN const char * +lws_json_purify(char *escaped, const char *string, int len); +///@} + +/*! \defgroup ev libev helpers + * + * ##libev helpers + * + * APIs specific to libev event loop itegration + */ +///@{ + +#ifdef LWS_WITH_LIBEV +typedef void (lws_ev_signal_cb_t)(EV_P_ struct ev_signal *w, int revents); + +LWS_VISIBLE LWS_EXTERN int +lws_ev_sigint_cfg(struct lws_context *context, int use_ev_sigint, + lws_ev_signal_cb_t *cb); + +LWS_VISIBLE LWS_EXTERN int +lws_ev_initloop(struct lws_context *context, struct ev_loop *loop, int tsi); + +LWS_VISIBLE LWS_EXTERN void +lws_ev_sigint_cb(struct ev_loop *loop, struct ev_signal *watcher, int revents); +#endif /* LWS_WITH_LIBEV */ + +///@} + +/*! \defgroup uv libuv helpers + * + * ##libuv helpers + * + * APIs specific to libuv event loop itegration + */ +///@{ +#ifdef LWS_WITH_LIBUV +LWS_VISIBLE LWS_EXTERN int +lws_uv_sigint_cfg(struct lws_context *context, int use_uv_sigint, + uv_signal_cb cb); + +LWS_VISIBLE LWS_EXTERN void +lws_libuv_run(const struct lws_context *context, int tsi); + +LWS_VISIBLE LWS_EXTERN void +lws_libuv_stop(struct lws_context *context); + +LWS_VISIBLE LWS_EXTERN void +lws_libuv_stop_without_kill(const struct lws_context *context, int tsi); + +LWS_VISIBLE LWS_EXTERN int +lws_uv_initloop(struct lws_context *context, uv_loop_t *loop, int tsi); + +LWS_VISIBLE LWS_EXTERN uv_loop_t * +lws_uv_getloop(struct lws_context *context, int tsi); + +LWS_VISIBLE LWS_EXTERN void +lws_uv_sigint_cb(uv_signal_t *watcher, int signum); + +LWS_VISIBLE LWS_EXTERN void +lws_close_all_handles_in_loop(uv_loop_t *loop); +#endif /* LWS_WITH_LIBUV */ +///@} + +/*! \defgroup event libevent helpers + * + * ##libevent helpers + * + * APIs specific to libevent event loop itegration + */ +///@{ + +#ifdef LWS_WITH_LIBEVENT +typedef void (lws_event_signal_cb_t) (evutil_socket_t sock_fd, short revents, + void *ctx); + +LWS_VISIBLE LWS_EXTERN int +lws_event_sigint_cfg(struct lws_context *context, int use_event_sigint, + lws_event_signal_cb_t cb); + +LWS_VISIBLE LWS_EXTERN int +lws_event_initloop(struct lws_context *context, struct event_base *loop, + int tsi); + +LWS_VISIBLE LWS_EXTERN void +lws_event_sigint_cb(evutil_socket_t sock_fd, short revents, + void *ctx); +#endif /* LWS_WITH_LIBEVENT */ + +///@} + +/*! \defgroup timeout Connection timeouts + + APIs related to setting connection timeouts +*/ +//@{ + +/* + * NOTE: These public enums are part of the abi. If you want to add one, + * add it at where specified so existing users are unaffected. + */ +enum pending_timeout { + NO_PENDING_TIMEOUT = 0, + PENDING_TIMEOUT_AWAITING_PROXY_RESPONSE = 1, + PENDING_TIMEOUT_AWAITING_CONNECT_RESPONSE = 2, + PENDING_TIMEOUT_ESTABLISH_WITH_SERVER = 3, + PENDING_TIMEOUT_AWAITING_SERVER_RESPONSE = 4, + PENDING_TIMEOUT_AWAITING_PING = 5, + PENDING_TIMEOUT_CLOSE_ACK = 6, + PENDING_TIMEOUT_AWAITING_EXTENSION_CONNECT_RESPONSE = 7, + PENDING_TIMEOUT_SENT_CLIENT_HANDSHAKE = 8, + PENDING_TIMEOUT_SSL_ACCEPT = 9, + PENDING_TIMEOUT_HTTP_CONTENT = 10, + PENDING_TIMEOUT_AWAITING_CLIENT_HS_SEND = 11, + PENDING_FLUSH_STORED_SEND_BEFORE_CLOSE = 12, + PENDING_TIMEOUT_SHUTDOWN_FLUSH = 13, + PENDING_TIMEOUT_CGI = 14, + PENDING_TIMEOUT_HTTP_KEEPALIVE_IDLE = 15, + PENDING_TIMEOUT_WS_PONG_CHECK_SEND_PING = 16, + PENDING_TIMEOUT_WS_PONG_CHECK_GET_PONG = 17, + PENDING_TIMEOUT_CLIENT_ISSUE_PAYLOAD = 18, + PENDING_TIMEOUT_AWAITING_SOCKS_GREETING_REPLY = 19, + PENDING_TIMEOUT_AWAITING_SOCKS_CONNECT_REPLY = 20, + PENDING_TIMEOUT_AWAITING_SOCKS_AUTH_REPLY = 21, + PENDING_TIMEOUT_KILLED_BY_SSL_INFO = 22, + PENDING_TIMEOUT_KILLED_BY_PARENT = 23, + PENDING_TIMEOUT_CLOSE_SEND = 24, + PENDING_TIMEOUT_HOLDING_AH = 25, + + /****** add new things just above ---^ ******/ + + PENDING_TIMEOUT_USER_REASON_BASE = 1000 +}; + +#define LWS_TO_KILL_ASYNC -1 +/**< If LWS_TO_KILL_ASYNC is given as the timeout sec in a lws_set_timeout() + * call, then the connection is marked to be killed at the next timeout + * check. This is how you should force-close the wsi being serviced if + * you are doing it outside the callback (where you should close by nonzero + * return). + */ +#define LWS_TO_KILL_SYNC -2 +/**< If LWS_TO_KILL_SYNC is given as the timeout sec in a lws_set_timeout() + * call, then the connection is closed before returning (which may delete + * the wsi). This should only be used where the wsi being closed is not the + * wsi currently being serviced. + */ +/** + * lws_set_timeout() - marks the wsi as subject to a timeout + * + * You will not need this unless you are doing something special + * + * \param wsi: Websocket connection instance + * \param reason: timeout reason + * \param secs: how many seconds. You may set to LWS_TO_KILL_ASYNC to + * force the connection to timeout at the next opportunity, or + * LWS_TO_KILL_SYNC to close it synchronously if you know the + * wsi is not the one currently being serviced. + */ +LWS_VISIBLE LWS_EXTERN void +lws_set_timeout(struct lws *wsi, enum pending_timeout reason, int secs); +///@} + +/*! \defgroup sending-data Sending data + + APIs related to writing data on a connection +*/ +//@{ +#if !defined(LWS_SIZEOFPTR) +#define LWS_SIZEOFPTR (sizeof (void *)) +#endif + +#if defined(__x86_64__) +#define _LWS_PAD_SIZE 16 /* Intel recommended for best performance */ +#else +#define _LWS_PAD_SIZE LWS_SIZEOFPTR /* Size of a pointer on the target arch */ +#endif +#define _LWS_PAD(n) (((n) % _LWS_PAD_SIZE) ? \ + ((n) + (_LWS_PAD_SIZE - ((n) % _LWS_PAD_SIZE))) : (n)) +/* last 2 is for lws-meta */ +#define LWS_PRE _LWS_PAD(4 + 10 + 2) +/* used prior to 1.7 and retained for backward compatibility */ +#define LWS_SEND_BUFFER_PRE_PADDING LWS_PRE +#define LWS_SEND_BUFFER_POST_PADDING 0 + +/* + * NOTE: These public enums are part of the abi. If you want to add one, + * add it at where specified so existing users are unaffected. + */ +enum lws_write_protocol { + LWS_WRITE_TEXT = 0, + /**< Send a ws TEXT message,the pointer must have LWS_PRE valid + * memory behind it. The receiver expects only valid utf-8 in the + * payload */ + LWS_WRITE_BINARY = 1, + /**< Send a ws BINARY message, the pointer must have LWS_PRE valid + * memory behind it. Any sequence of bytes is valid */ + LWS_WRITE_CONTINUATION = 2, + /**< Continue a previous ws message, the pointer must have LWS_PRE valid + * memory behind it */ + LWS_WRITE_HTTP = 3, + /**< Send HTTP content */ + + /* LWS_WRITE_CLOSE is handled by lws_close_reason() */ + LWS_WRITE_PING = 5, + LWS_WRITE_PONG = 6, + + /* Same as write_http but we know this write ends the transaction */ + LWS_WRITE_HTTP_FINAL = 7, + + /* HTTP2 */ + + LWS_WRITE_HTTP_HEADERS = 8, + /**< Send http headers (http2 encodes this payload and LWS_WRITE_HTTP + * payload differently, http 1.x links also handle this correctly. so + * to be compatible with both in the future,header response part should + * be sent using this regardless of http version expected) + */ + LWS_WRITE_HTTP_HEADERS_CONTINUATION = 9, + /**< Continuation of http/2 headers + */ + + /****** add new things just above ---^ ******/ + + /* flags */ + + LWS_WRITE_NO_FIN = 0x40, + /**< This part of the message is not the end of the message */ + + LWS_WRITE_H2_STREAM_END = 0x80, + /**< Flag indicates this packet should go out with STREAM_END if h2 + * STREAM_END is allowed on DATA or HEADERS. + */ + + LWS_WRITE_CLIENT_IGNORE_XOR_MASK = 0x80 + /**< client packet payload goes out on wire unmunged + * only useful for security tests since normal servers cannot + * decode the content if used */ +}; + +/* used with LWS_CALLBACK_CHILD_WRITE_VIA_PARENT */ + +struct lws_write_passthru { + struct lws *wsi; + unsigned char *buf; + size_t len; + enum lws_write_protocol wp; +}; + + +/** + * lws_write() - Apply protocol then write data to client + * \param wsi: Websocket instance (available from user callback) + * \param buf: The data to send. For data being sent on a websocket + * connection (ie, not default http), this buffer MUST have + * LWS_PRE bytes valid BEFORE the pointer. + * This is so the protocol header data can be added in-situ. + * \param len: Count of the data bytes in the payload starting from buf + * \param protocol: Use LWS_WRITE_HTTP to reply to an http connection, and one + * of LWS_WRITE_BINARY or LWS_WRITE_TEXT to send appropriate + * data on a websockets connection. Remember to allow the extra + * bytes before and after buf if LWS_WRITE_BINARY or LWS_WRITE_TEXT + * are used. + * + * This function provides the way to issue data back to the client + * for both http and websocket protocols. + * + * IMPORTANT NOTICE! + * + * When sending with websocket protocol + * + * LWS_WRITE_TEXT, + * LWS_WRITE_BINARY, + * LWS_WRITE_CONTINUATION, + * LWS_WRITE_PING, + * LWS_WRITE_PONG + * + * the send buffer has to have LWS_PRE bytes valid BEFORE + * the buffer pointer you pass to lws_write(). + * + * This allows us to add protocol info before and after the data, and send as + * one packet on the network without payload copying, for maximum efficiency. + * + * So for example you need this kind of code to use lws_write with a + * 128-byte payload + * + * char buf[LWS_PRE + 128]; + * + * // fill your part of the buffer... for example here it's all zeros + * memset(&buf[LWS_PRE], 0, 128); + * + * lws_write(wsi, &buf[LWS_PRE], 128, LWS_WRITE_TEXT); + * + * When sending HTTP, with + * + * LWS_WRITE_HTTP, + * LWS_WRITE_HTTP_HEADERS + * LWS_WRITE_HTTP_FINAL + * + * there is no protocol data prepended, and don't need to take care about the + * LWS_PRE bytes valid before the buffer pointer. + * + * LWS_PRE is at least the frame nonce + 2 header + 8 length + * LWS_SEND_BUFFER_POST_PADDING is deprecated, it's now 0 and can be left off. + * The example apps no longer use it. + * + * Pad LWS_PRE to the CPU word size, so that word references + * to the address immediately after the padding won't cause an unaligned access + * error. Sometimes for performance reasons the recommended padding is even + * larger than sizeof(void *). + * + * In the case of sending using websocket protocol, be sure to allocate + * valid storage before and after buf as explained above. This scheme + * allows maximum efficiency of sending data and protocol in a single + * packet while not burdening the user code with any protocol knowledge. + * + * Return may be -1 for a fatal error needing connection close, or the + * number of bytes sent. + * + * Truncated Writes + * ================ + * + * The OS may not accept everything you asked to write on the connection. + * + * Posix defines POLLOUT indication from poll() to show that the connection + * will accept more write data, but it doesn't specifiy how much. It may just + * accept one byte of whatever you wanted to send. + * + * LWS will buffer the remainder automatically, and send it out autonomously. + * + * During that time, WRITABLE callbacks will be suppressed. + * + * This is to handle corner cases where unexpectedly the OS refuses what we + * usually expect it to accept. You should try to send in chunks that are + * almost always accepted in order to avoid the inefficiency of the buffering. + */ +LWS_VISIBLE LWS_EXTERN int +lws_write(struct lws *wsi, unsigned char *buf, size_t len, + enum lws_write_protocol protocol); + +/* helper for case where buffer may be const */ +#define lws_write_http(wsi, buf, len) \ + lws_write(wsi, (unsigned char *)(buf), len, LWS_WRITE_HTTP) +///@} + +/** \defgroup callback-when-writeable Callback when writeable + * + * ##Callback When Writeable + * + * lws can only write data on a connection when it is able to accept more + * data without blocking. + * + * So a basic requirement is we should only use the lws_write() apis when the + * connection we want to write on says that he can accept more data. + * + * When lws cannot complete your send at the time, it will buffer the data + * and send it in the background, suppressing any further WRITEABLE callbacks + * on that connection until it completes. So it is important to write new + * things in a new writeable callback. + * + * These apis reflect the various ways we can indicate we would like to be + * called back when one or more connections is writeable. + */ +///@{ + +/** + * lws_callback_on_writable() - Request a callback when this socket + * becomes able to be written to without + * blocking + * + * \param wsi: Websocket connection instance to get callback for + * + * - Which: only this wsi + * - When: when the individual connection becomes writeable + * - What: LWS_CALLBACK_*_WRITEABLE + */ +LWS_VISIBLE LWS_EXTERN int +lws_callback_on_writable(struct lws *wsi); + +/** + * lws_callback_on_writable_all_protocol() - Request a callback for all + * connections using the given protocol when it + * becomes possible to write to each socket without + * blocking in turn. + * + * \param context: lws_context + * \param protocol: Protocol whose connections will get callbacks + * + * - Which: connections using this protocol on ANY VHOST + * - When: when the individual connection becomes writeable + * - What: LWS_CALLBACK_*_WRITEABLE + */ +LWS_VISIBLE LWS_EXTERN int +lws_callback_on_writable_all_protocol(const struct lws_context *context, + const struct lws_protocols *protocol); + +/** + * lws_callback_on_writable_all_protocol_vhost() - Request a callback for + * all connections on same vhost using the given protocol + * when it becomes possible to write to each socket without + * blocking in turn. + * + * \param vhost: Only consider connections on this lws_vhost + * \param protocol: Protocol whose connections will get callbacks + * + * - Which: connections using this protocol on GIVEN VHOST ONLY + * - When: when the individual connection becomes writeable + * - What: LWS_CALLBACK_*_WRITEABLE + */ +LWS_VISIBLE LWS_EXTERN int +lws_callback_on_writable_all_protocol_vhost(const struct lws_vhost *vhost, + const struct lws_protocols *protocol); + +/** + * lws_callback_all_protocol() - Callback all connections using + * the given protocol with the given reason + * + * \param context: lws_context + * \param protocol: Protocol whose connections will get callbacks + * \param reason: Callback reason index + * + * - Which: connections using this protocol on ALL VHOSTS + * - When: before returning + * - What: reason + * + * This isn't normally what you want... normally any update of connection- + * specific information can wait until a network-related callback like rx, + * writable, or close. + */ +LWS_VISIBLE LWS_EXTERN int +lws_callback_all_protocol(struct lws_context *context, + const struct lws_protocols *protocol, int reason); + +/** + * lws_callback_all_protocol_vhost() - Callback all connections using + * the given protocol with the given reason. This is + * deprecated since v2.4: use lws_callback_all_protocol_vhost_args + * + * \param vh: Vhost whose connections will get callbacks + * \param protocol: Which protocol to match. NULL means all. + * \param reason: Callback reason index + * + * - Which: connections using this protocol on GIVEN VHOST ONLY + * - When: now + * - What: reason + */ +LWS_VISIBLE LWS_EXTERN int +lws_callback_all_protocol_vhost(struct lws_vhost *vh, + const struct lws_protocols *protocol, int reason) +LWS_WARN_DEPRECATED; + +/** + * lws_callback_all_protocol_vhost_args() - Callback all connections using + * the given protocol with the given reason and args + * + * \param vh: Vhost whose connections will get callbacks + * \param protocol: Which protocol to match. NULL means all. + * \param reason: Callback reason index + * \param argp: Callback "in" parameter + * \param len: Callback "len" parameter + * + * - Which: connections using this protocol on GIVEN VHOST ONLY + * - When: now + * - What: reason + */ +LWS_VISIBLE int +lws_callback_all_protocol_vhost_args(struct lws_vhost *vh, + const struct lws_protocols *protocol, int reason, + void *argp, size_t len); + +/** + * lws_callback_vhost_protocols() - Callback all protocols enabled on a vhost + * with the given reason + * + * \param wsi: wsi whose vhost will get callbacks + * \param reason: Callback reason index + * \param in: in argument to callback + * \param len: len argument to callback + * + * - Which: connections using this protocol on same VHOST as wsi ONLY + * - When: now + * - What: reason + */ +LWS_VISIBLE LWS_EXTERN int +lws_callback_vhost_protocols(struct lws *wsi, int reason, void *in, int len); + +LWS_VISIBLE LWS_EXTERN int +lws_callback_http_dummy(struct lws *wsi, enum lws_callback_reasons reason, + void *user, void *in, size_t len); + +/** + * lws_get_socket_fd() - returns the socket file descriptor + * + * You will not need this unless you are doing something special + * + * \param wsi: Websocket connection instance + */ +LWS_VISIBLE LWS_EXTERN int +lws_get_socket_fd(struct lws *wsi); + +/** + * lws_get_peer_write_allowance() - get the amount of data writeable to peer + * if known + * + * \param wsi: Websocket connection instance + * + * if the protocol does not have any guidance, returns -1. Currently only + * http2 connections get send window information from this API. But your code + * should use it so it can work properly with any protocol. + * + * If nonzero return is the amount of payload data the peer or intermediary has + * reported it has buffer space for. That has NO relationship with the amount + * of buffer space your OS can accept on this connection for a write action. + * + * This number represents the maximum you could send to the peer or intermediary + * on this connection right now without the protocol complaining. + * + * lws manages accounting for send window updates and payload writes + * automatically, so this number reflects the situation at the peer or + * intermediary dynamically. + */ +LWS_VISIBLE LWS_EXTERN size_t +lws_get_peer_write_allowance(struct lws *wsi); +///@} + +enum { + /* + * Flags for enable and disable rxflow with reason bitmap and with + * backwards-compatible single bool + */ + LWS_RXFLOW_REASON_USER_BOOL = (1 << 0), + LWS_RXFLOW_REASON_HTTP_RXBUFFER = (1 << 6), + LWS_RXFLOW_REASON_H2_PPS_PENDING = (1 << 7), + + LWS_RXFLOW_REASON_APPLIES = (1 << 14), + LWS_RXFLOW_REASON_APPLIES_ENABLE_BIT = (1 << 13), + LWS_RXFLOW_REASON_APPLIES_ENABLE = LWS_RXFLOW_REASON_APPLIES | + LWS_RXFLOW_REASON_APPLIES_ENABLE_BIT, + LWS_RXFLOW_REASON_APPLIES_DISABLE = LWS_RXFLOW_REASON_APPLIES, + LWS_RXFLOW_REASON_FLAG_PROCESS_NOW = (1 << 12), + +}; + +/** + * lws_rx_flow_control() - Enable and disable socket servicing for + * received packets. + * + * If the output side of a server process becomes choked, this allows flow + * control for the input side. + * + * \param wsi: Websocket connection instance to get callback for + * \param enable: 0 = disable read servicing for this connection, 1 = enable + * + * If you need more than one additive reason for rxflow control, you can give + * iLWS_RXFLOW_REASON_APPLIES_ENABLE or _DISABLE together with one or more of + * b5..b0 set to idicate which bits to enable or disable. If any bits are + * enabled, rx on the connection is suppressed. + * + * LWS_RXFLOW_REASON_FLAG_PROCESS_NOW flag may also be given to force any change + * in rxflowbstatus to benapplied immediately, this should be used when you are + * changing a wsi flow control state from outside a callback on that wsi. + */ +LWS_VISIBLE LWS_EXTERN int +lws_rx_flow_control(struct lws *wsi, int enable); + +/** + * lws_rx_flow_allow_all_protocol() - Allow all connections with this protocol to receive + * + * When the user server code realizes it can accept more input, it can + * call this to have the RX flow restriction removed from all connections using + * the given protocol. + * \param context: lws_context + * \param protocol: all connections using this protocol will be allowed to receive + */ +LWS_VISIBLE LWS_EXTERN void +lws_rx_flow_allow_all_protocol(const struct lws_context *context, + const struct lws_protocols *protocol); + +/** + * lws_remaining_packet_payload() - Bytes to come before "overall" + * rx packet is complete + * \param wsi: Websocket instance (available from user callback) + * + * This function is intended to be called from the callback if the + * user code is interested in "complete packets" from the client. + * libwebsockets just passes through payload as it comes and issues a buffer + * additionally when it hits a built-in limit. The LWS_CALLBACK_RECEIVE + * callback handler can use this API to find out if the buffer it has just + * been given is the last piece of a "complete packet" from the client -- + * when that is the case lws_remaining_packet_payload() will return + * 0. + * + * Many protocols won't care becuse their packets are always small. + */ +LWS_VISIBLE LWS_EXTERN size_t +lws_remaining_packet_payload(struct lws *wsi); + + +/** \defgroup sock-adopt Socket adoption helpers + * ##Socket adoption helpers + * + * When integrating with an external app with its own event loop, these can + * be used to accept connections from someone else's listening socket. + * + * When using lws own event loop, these are not needed. + */ +///@{ + +/** + * lws_adopt_socket() - adopt foreign socket as if listen socket accepted it + * for the default vhost of context. + * + * \param context: lws context + * \param accept_fd: fd of already-accepted socket to adopt + * + * Either returns new wsi bound to accept_fd, or closes accept_fd and + * returns NULL, having cleaned up any new wsi pieces. + * + * LWS adopts the socket in http serving mode, it's ready to accept an upgrade + * to ws or just serve http. + */ +LWS_VISIBLE LWS_EXTERN struct lws * +lws_adopt_socket(struct lws_context *context, lws_sockfd_type accept_fd); +/** + * lws_adopt_socket_vhost() - adopt foreign socket as if listen socket accepted it + * for vhost + * + * \param vh: lws vhost + * \param accept_fd: fd of already-accepted socket to adopt + * + * Either returns new wsi bound to accept_fd, or closes accept_fd and + * returns NULL, having cleaned up any new wsi pieces. + * + * LWS adopts the socket in http serving mode, it's ready to accept an upgrade + * to ws or just serve http. + */ +LWS_VISIBLE LWS_EXTERN struct lws * +lws_adopt_socket_vhost(struct lws_vhost *vh, lws_sockfd_type accept_fd); + +typedef enum { + LWS_ADOPT_RAW_FILE_DESC = 0, /* convenience constant */ + LWS_ADOPT_HTTP = 1, /* flag: absent implies RAW */ + LWS_ADOPT_SOCKET = 2, /* flag: absent implies file descr */ + LWS_ADOPT_ALLOW_SSL = 4, /* flag: if set requires LWS_ADOPT_SOCKET */ + LWS_ADOPT_WS_PARENTIO = 8, /* flag: ws mode parent handles IO + * if given must be only flag + * wsi put directly into ws mode + */ +} lws_adoption_type; + +typedef union { + lws_sockfd_type sockfd; + lws_filefd_type filefd; +} lws_sock_file_fd_type; + +/* +* lws_adopt_descriptor_vhost() - adopt foreign socket or file descriptor +* if socket descriptor, should already have been accepted from listen socket +* +* \param vhost: lws vhost +* \param type: OR-ed combinations of lws_adoption_type flags +* \param fd: union with either .sockfd or .filefd set +* \param vh_prot_name: NULL or vh protocol name to bind raw connection to +* \param parent: NULL or struct lws to attach new_wsi to as a child +* +* Either returns new wsi bound to accept_fd, or closes accept_fd and +* returns NULL, having cleaned up any new wsi pieces. +* +* If LWS_ADOPT_SOCKET is set, LWS adopts the socket in http serving mode, it's +* ready to accept an upgrade to ws or just serve http. +* +* parent may be NULL, if given it should be an existing wsi that will become the +* parent of the new wsi created by this call. +*/ +LWS_VISIBLE LWS_EXTERN struct lws * +lws_adopt_descriptor_vhost(struct lws_vhost *vh, lws_adoption_type type, + lws_sock_file_fd_type fd, const char *vh_prot_name, + struct lws *parent); + +/** + * lws_adopt_socket_readbuf() - adopt foreign socket and first rx as if listen socket accepted it + * for the default vhost of context. + * \param context: lws context + * \param accept_fd: fd of already-accepted socket to adopt + * \param readbuf: NULL or pointer to data that must be drained before reading from + * accept_fd + * \param len: The length of the data held at \param readbuf + * + * Either returns new wsi bound to accept_fd, or closes accept_fd and + * returns NULL, having cleaned up any new wsi pieces. + * + * LWS adopts the socket in http serving mode, it's ready to accept an upgrade + * to ws or just serve http. + * + * If your external code did not already read from the socket, you can use + * lws_adopt_socket() instead. + * + * This api is guaranteed to use the data at \param readbuf first, before reading from + * the socket. + * + * readbuf is limited to the size of the ah rx buf, currently 2048 bytes. + */ +LWS_VISIBLE LWS_EXTERN struct lws * +lws_adopt_socket_readbuf(struct lws_context *context, lws_sockfd_type accept_fd, + const char *readbuf, size_t len); +/** + * lws_adopt_socket_vhost_readbuf() - adopt foreign socket and first rx as if listen socket + * accepted it for vhost. + * \param vhost: lws vhost + * \param accept_fd: fd of already-accepted socket to adopt + * \param readbuf: NULL or pointer to data that must be drained before reading from + * accept_fd + * \param len: The length of the data held at \param readbuf + * + * Either returns new wsi bound to accept_fd, or closes accept_fd and + * returns NULL, having cleaned up any new wsi pieces. + * + * LWS adopts the socket in http serving mode, it's ready to accept an upgrade + * to ws or just serve http. + * + * If your external code did not already read from the socket, you can use + * lws_adopt_socket() instead. + * + * This api is guaranteed to use the data at \param readbuf first, before reading from + * the socket. + * + * readbuf is limited to the size of the ah rx buf, currently 2048 bytes. + */ +LWS_VISIBLE LWS_EXTERN struct lws * +lws_adopt_socket_vhost_readbuf(struct lws_vhost *vhost, lws_sockfd_type accept_fd, + const char *readbuf, size_t len); +///@} + +/** \defgroup net Network related helper APIs + * ##Network related helper APIs + * + * These wrap miscellaneous useful network-related functions + */ +///@{ + +/** + * lws_canonical_hostname() - returns this host's hostname + * + * This is typically used by client code to fill in the host parameter + * when making a client connection. You can only call it after the context + * has been created. + * + * \param context: Websocket context + */ +LWS_VISIBLE LWS_EXTERN const char * LWS_WARN_UNUSED_RESULT +lws_canonical_hostname(struct lws_context *context); + +/** + * lws_get_peer_addresses() - Get client address information + * \param wsi: Local struct lws associated with + * \param fd: Connection socket descriptor + * \param name: Buffer to take client address name + * \param name_len: Length of client address name buffer + * \param rip: Buffer to take client address IP dotted quad + * \param rip_len: Length of client address IP buffer + * + * This function fills in name and rip with the name and IP of + * the client connected with socket descriptor fd. Names may be + * truncated if there is not enough room. If either cannot be + * determined, they will be returned as valid zero-length strings. + */ +LWS_VISIBLE LWS_EXTERN void +lws_get_peer_addresses(struct lws *wsi, lws_sockfd_type fd, char *name, + int name_len, char *rip, int rip_len); + +/** + * lws_get_peer_simple() - Get client address information without RDNS + * + * \param wsi: Local struct lws associated with + * \param name: Buffer to take client address name + * \param namelen: Length of client address name buffer + * + * This provides a 123.123.123.123 type IP address in name from the + * peer that has connected to wsi + */ +LWS_VISIBLE LWS_EXTERN const char * +lws_get_peer_simple(struct lws *wsi, char *name, int namelen); +#if !defined(LWS_WITH_ESP8266) && !defined(LWS_WITH_ESP32) +/** + * lws_interface_to_sa() - Convert interface name or IP to sockaddr struct + * + * \param ipv6: Allow IPV6 addresses + * \param ifname: Interface name or IP + * \param addr: struct sockaddr_in * to be written + * \param addrlen: Length of addr + * + * This converts a textual network interface name to a sockaddr usable by + * other network functions + */ +LWS_VISIBLE LWS_EXTERN int +lws_interface_to_sa(int ipv6, const char *ifname, struct sockaddr_in *addr, + size_t addrlen); +///@} +#endif + +/** \defgroup misc Miscellaneous APIs +* ##Miscellaneous APIs +* +* Various APIs outside of other categories +*/ +///@{ + +/** + * lws_start_foreach_ll(): linkedlist iterator helper start + * + * \param type: type of iteration, eg, struct xyz * + * \param it: iterator var name to create + * \param start: start of list + * + * This helper creates an iterator and starts a while (it) { + * loop. The iterator runs through the linked list starting at start and + * ends when it gets a NULL. + * The while loop should be terminated using lws_start_foreach_ll(). + */ +#define lws_start_foreach_ll(type, it, start)\ +{ \ + type it = start; \ + while (it) { + +/** + * lws_end_foreach_ll(): linkedlist iterator helper end + * + * \param it: same iterator var name given when starting + * \param nxt: member name in the iterator pointing to next list element + * + * This helper is the partner for lws_start_foreach_ll() that ends the + * while loop. + */ + +#define lws_end_foreach_ll(it, nxt) \ + it = it->nxt; \ + } \ +} + +/** + * lws_start_foreach_llp(): linkedlist pointer iterator helper start + * + * \param type: type of iteration, eg, struct xyz ** + * \param it: iterator var name to create + * \param start: start of list + * + * This helper creates an iterator and starts a while (it) { + * loop. The iterator runs through the linked list starting at the + * address of start and ends when it gets a NULL. + * The while loop should be terminated using lws_start_foreach_llp(). + * + * This helper variant iterates using a pointer to the previous linked-list + * element. That allows you to easily delete list members by rewriting the + * previous pointer to the element's next pointer. + */ +#define lws_start_foreach_llp(type, it, start)\ +{ \ + type it = &(start); \ + while (*(it)) { + +/** + * lws_end_foreach_llp(): linkedlist pointer iterator helper end + * + * \param it: same iterator var name given when starting + * \param nxt: member name in the iterator pointing to next list element + * + * This helper is the partner for lws_start_foreach_llp() that ends the + * while loop. + */ + +#define lws_end_foreach_llp(it, nxt) \ + it = &(*(it))->nxt; \ + } \ +} + +/** + * lws_snprintf(): snprintf that truncates the returned length too + * + * \param str: destination buffer + * \param size: bytes left in destination buffer + * \param format: format string + * \param ...: args for format + * + * This lets you correctly truncate buffers by concatenating lengths, if you + * reach the limit the reported length doesn't exceed the limit. + */ +LWS_VISIBLE LWS_EXTERN int +lws_snprintf(char *str, size_t size, const char *format, ...) LWS_FORMAT(3); + +/** + * lws_get_random(): fill a buffer with platform random data + * + * \param context: the lws context + * \param buf: buffer to fill + * \param len: how much to fill + * + * This is intended to be called from the LWS_CALLBACK_RECEIVE callback if + * it's interested to see if the frame it's dealing with was sent in binary + * mode. + */ +LWS_VISIBLE LWS_EXTERN int +lws_get_random(struct lws_context *context, void *buf, int len); +/** + * lws_daemonize(): make current process run in the background + * + * \param _lock_path: the filepath to write the lock file + * + * Spawn lws as a background process, taking care of various things + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_daemonize(const char *_lock_path); +/** + * lws_get_library_version(): return string describing the version of lws + * + * On unix, also includes the git describe + */ +LWS_VISIBLE LWS_EXTERN const char * LWS_WARN_UNUSED_RESULT +lws_get_library_version(void); + +/** + * lws_wsi_user() - get the user data associated with the connection + * \param wsi: lws connection + * + * Not normally needed since it's passed into the callback + */ +LWS_VISIBLE LWS_EXTERN void * +lws_wsi_user(struct lws *wsi); + +/** + * lws_wsi_set_user() - set the user data associated with the client connection + * \param wsi: lws connection + * \param user: user data + * + * By default lws allocates this and it's not legal to externally set it + * yourself. However client connections may have it set externally when the + * connection is created... if so, this api can be used to modify it at + * runtime additionally. + */ +LWS_VISIBLE LWS_EXTERN void +lws_set_wsi_user(struct lws *wsi, void *user); + +/** + * lws_parse_uri: cut up prot:/ads:port/path into pieces + * Notice it does so by dropping '\0' into input string + * and the leading / on the path is consequently lost + * + * \param p: incoming uri string.. will get written to + * \param prot: result pointer for protocol part (https://) + * \param ads: result pointer for address part + * \param port: result pointer for port part + * \param path: result pointer for path part + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_parse_uri(char *p, const char **prot, const char **ads, int *port, + const char **path); + +/** + * lws_now_secs(): return seconds since 1970-1-1 + */ +LWS_VISIBLE LWS_EXTERN unsigned long +lws_now_secs(void); + +/** + * lws_get_context - Allow getting lws_context from a Websocket connection + * instance + * + * With this function, users can access context in the callback function. + * Otherwise users may have to declare context as a global variable. + * + * \param wsi: Websocket connection instance + */ +LWS_VISIBLE LWS_EXTERN struct lws_context * LWS_WARN_UNUSED_RESULT +lws_get_context(const struct lws *wsi); + +/** + * lws_get_count_threads(): how many service threads the context uses + * + * \param context: the lws context + * + * By default this is always 1, if you asked for more than lws can handle it + * will clip the number of threads. So you can use this to find out how many + * threads are actually in use. + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_get_count_threads(struct lws_context *context); + +/** + * lws_get_parent() - get parent wsi or NULL + * \param wsi: lws connection + * + * Specialized wsi like cgi stdin/out/err are associated to a parent wsi, + * this allows you to get their parent. + */ +LWS_VISIBLE LWS_EXTERN struct lws * LWS_WARN_UNUSED_RESULT +lws_get_parent(const struct lws *wsi); + +/** + * lws_get_child() - get child wsi or NULL + * \param wsi: lws connection + * + * Allows you to find a related wsi from the parent wsi. + */ +LWS_VISIBLE LWS_EXTERN struct lws * LWS_WARN_UNUSED_RESULT +lws_get_child(const struct lws *wsi); + +/** + * lws_parent_carries_io() - mark wsi as needing to send messages via parent + * + * \param wsi: child lws connection + */ + +LWS_VISIBLE LWS_EXTERN void +lws_set_parent_carries_io(struct lws *wsi); + +LWS_VISIBLE LWS_EXTERN void * +lws_get_opaque_parent_data(const struct lws *wsi); + +LWS_VISIBLE LWS_EXTERN void +lws_set_opaque_parent_data(struct lws *wsi, void *data); + +LWS_VISIBLE LWS_EXTERN int +lws_get_child_pending_on_writable(const struct lws *wsi); + +LWS_VISIBLE LWS_EXTERN void +lws_clear_child_pending_on_writable(struct lws *wsi); + +LWS_VISIBLE LWS_EXTERN int +lws_get_close_length(struct lws *wsi); + +LWS_VISIBLE LWS_EXTERN unsigned char * +lws_get_close_payload(struct lws *wsi); + +/** + * lws_get_network_wsi() - Returns wsi that has the tcp connection for this wsi + * + * \param wsi: wsi you have + * + * Returns wsi that has the tcp connection (which may be the incoming wsi) + * + * HTTP/1 connections will always return the incoming wsi + * HTTP/2 connections may return a different wsi that has the tcp connection + */ +LWS_VISIBLE LWS_EXTERN +struct lws *lws_get_network_wsi(struct lws *wsi); + +/* + * \deprecated DEPRECATED Note: this is not normally needed as a user api. + * It's provided in case it is + * useful when integrating with other app poll loop service code. + */ +LWS_VISIBLE LWS_EXTERN int +lws_read(struct lws *wsi, unsigned char *buf, lws_filepos_t len); + +/** + * lws_set_allocator() - custom allocator support + * + * \param realloc + * + * Allows you to replace the allocator (and deallocator) used by lws + */ +LWS_VISIBLE LWS_EXTERN void +lws_set_allocator(void *(*realloc)(void *ptr, size_t size, const char *reason)); +///@} + +/** \defgroup wsstatus Websocket status APIs + * ##Websocket connection status APIs + * + * These provide information about ws connection or message status + */ +///@{ +/** + * lws_send_pipe_choked() - tests if socket is writable or not + * \param wsi: lws connection + * + * Allows you to check if you can write more on the socket + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_send_pipe_choked(struct lws *wsi); + +/** + * lws_is_final_fragment() - tests if last part of ws message + * + * \param wsi: lws connection + */ +LWS_VISIBLE LWS_EXTERN int +lws_is_final_fragment(struct lws *wsi); + +/** + * lws_is_first_fragment() - tests if first part of ws message + * + * \param wsi: lws connection + */ +LWS_VISIBLE LWS_EXTERN int +lws_is_first_fragment(struct lws *wsi); + +/** + * lws_get_reserved_bits() - access reserved bits of ws frame + * \param wsi: lws connection + */ +LWS_VISIBLE LWS_EXTERN unsigned char +lws_get_reserved_bits(struct lws *wsi); + +/** + * lws_partial_buffered() - find out if lws buffered the last write + * \param wsi: websocket connection to check + * + * Returns 1 if you cannot use lws_write because the last + * write on this connection is still buffered, and can't be cleared without + * returning to the service loop and waiting for the connection to be + * writeable again. + * + * If you will try to do >1 lws_write call inside a single + * WRITEABLE callback, you must check this after every write and bail if + * set, ask for a new writeable callback and continue writing from there. + * + * This is never set at the start of a writeable callback, but any write + * may set it. + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_partial_buffered(struct lws *wsi); + +/** + * lws_frame_is_binary(): true if the current frame was sent in binary mode + * + * \param wsi: the connection we are inquiring about + * + * This is intended to be called from the LWS_CALLBACK_RECEIVE callback if + * it's interested to see if the frame it's dealing with was sent in binary + * mode. + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_frame_is_binary(struct lws *wsi); + +/** + * lws_is_ssl() - Find out if connection is using SSL + * \param wsi: websocket connection to check + * + * Returns 0 if the connection is not using SSL, 1 if using SSL and + * using verified cert, and 2 if using SSL but the cert was not + * checked (appears for client wsi told to skip check on connection) + */ +LWS_VISIBLE LWS_EXTERN int +lws_is_ssl(struct lws *wsi); +/** + * lws_is_cgi() - find out if this wsi is running a cgi process + * \param wsi: lws connection + */ +LWS_VISIBLE LWS_EXTERN int +lws_is_cgi(struct lws *wsi); + +#ifdef LWS_OPENSSL_SUPPORT +/** + * lws_get_ssl() - Return wsi's SSL context structure + * \param wsi: websocket connection + * + * Returns pointer to the SSL library's context structure + */ +LWS_VISIBLE LWS_EXTERN SSL* +lws_get_ssl(struct lws *wsi); +#endif +///@} + +/** \defgroup lws_ring LWS Ringbuffer APIs + * ##lws_ring: generic ringbuffer struct + * + * Provides an abstract ringbuffer api supporting one head and one or an + * unlimited number of tails. + * + * All of the members are opaque and manipulated by lws_ring_...() apis. + * + * The lws_ring and its buffer is allocated at runtime on the heap, using + * + * - lws_ring_create() + * - lws_ring_destroy() + * + * It may contain any type, the size of the "element" stored in the ring + * buffer and the number of elements is given at creation time. + * + * When you create the ringbuffer, you can optionally provide an element + * destroy callback that frees any allocations inside the element. This is then + * automatically called for elements with no tail behind them, ie, elements + * which don't have any pending consumer are auto-freed. + * + * Whole elements may be inserted into the ringbuffer and removed from it, using + * + * - lws_ring_insert() + * - lws_ring_consume() + * + * You can find out how many whole elements are free or waiting using + * + * - lws_ring_get_count_free_elements() + * - lws_ring_get_count_waiting_elements() + * + * In addition there are special purpose optional byte-centric apis + * + * - lws_ring_next_linear_insert_range() + * - lws_ring_bump_head() + * + * which let you, eg, read() directly into the ringbuffer without needing + * an intermediate bounce buffer. + * + * The accessors understand that the ring wraps, and optimizes insertion and + * consumption into one or two memcpy()s depending on if the head or tail + * wraps. + * + * lws_ring only supports a single head, but optionally multiple tails with + * an API to inform it when the "oldest" tail has moved on. You can give + * NULL where-ever an api asks for a tail pointer, and it will use an internal + * single tail pointer for convenience. + * + * The "oldest tail", which is the only tail if you give it NULL instead of + * some other tail, is used to track which elements in the ringbuffer are + * still unread by anyone. + * + * - lws_ring_update_oldest_tail() + */ +///@{ +struct lws_ring; + +/** + * lws_ring_create(): create a new ringbuffer + * + * \param element_len: the size in bytes of one element in the ringbuffer + * \param count: the number of elements the ringbuffer can contain + * \param destroy_element: NULL, or callback to be called for each element + * that is removed from the ringbuffer due to the + * oldest tail moving beyond it + * + * Creates the ringbuffer and allocates the storage. Returns the new + * lws_ring *, or NULL if the allocation failed. + * + * If non-NULL, destroy_element will get called back for every element that is + * retired from the ringbuffer after the oldest tail has gone past it, and for + * any element still left in the ringbuffer when it is destroyed. It replaces + * all other element destruction code in your user code. + */ +LWS_VISIBLE LWS_EXTERN struct lws_ring * +lws_ring_create(size_t element_len, size_t count, + void (*destroy_element)(void *element)); + +/** + * lws_ring_destroy(): destroy a previously created ringbuffer + * + * \param ring: the struct lws_ring to destroy + * + * Destroys the ringbuffer allocation and the struct lws_ring itself. + */ +LWS_VISIBLE LWS_EXTERN void +lws_ring_destroy(struct lws_ring *ring); + +/** + * lws_ring_get_count_free_elements(): return how many elements can fit + * in the free space + * + * \param ring: the struct lws_ring to report on + * + * Returns how much room is left in the ringbuffer for whole element insertion. + */ +LWS_VISIBLE LWS_EXTERN size_t +lws_ring_get_count_free_elements(struct lws_ring *ring); + +/** + * lws_ring_get_count_waiting_elements(): return how many elements can be consumed + * + * \param ring: the struct lws_ring to report on + * \param tail: a pointer to the tail struct to use, or NULL for single tail + * + * Returns how many elements are waiting to be consumed from the perspective + * of the tail pointer given. + */ +LWS_VISIBLE LWS_EXTERN size_t +lws_ring_get_count_waiting_elements(struct lws_ring *ring, uint32_t *tail); + +/** + * lws_ring_insert(): attempt to insert up to max_count elements from src + * + * \param ring: the struct lws_ring to report on + * \param src: the array of elements to be inserted + * \param max_count: the number of available elements at src + * + * Attempts to insert as many of the elements at src as possible, up to the + * maximum max_count. Returns the number of elements actually inserted. + */ +LWS_VISIBLE LWS_EXTERN size_t +lws_ring_insert(struct lws_ring *ring, const void *src, size_t max_count); + +/** + * lws_ring_consume(): attempt to copy out and remove up to max_count elements + * to src + * + * \param ring: the struct lws_ring to report on + * \param tail: a pointer to the tail struct to use, or NULL for single tail + * \param dest: the array of elements to be inserted. or NULL for no copy + * \param max_count: the number of available elements at src + * + * Attempts to copy out as many waiting elements as possible into dest, from + * the perspective of the given tail, up to max_count. If dest is NULL, the + * copying out is not done but the elements are logically consumed as usual. + * NULL dest is useful in combination with lws_ring_get_element(), where you + * can use the element direct from the ringbuffer and then call this with NULL + * dest to logically consume it. + * + * Increments the tail position according to how many elements could be + * consumed. + * + * Returns the number of elements consumed. + */ +LWS_VISIBLE LWS_EXTERN size_t +lws_ring_consume(struct lws_ring *ring, uint32_t *tail, void *dest, + size_t max_count); + +/** + * lws_ring_get_element(): get a pointer to the next waiting element for tail + * + * \param ring: the struct lws_ring to report on + * \param tail: a pointer to the tail struct to use, or NULL for single tail + * + * Points to the next element that tail would consume, directly in the + * ringbuffer. This lets you write() or otherwise use the element without + * having to copy it out somewhere first. + * + * After calling this, you must call lws_ring_consume(ring, &tail, NULL, 1) + * which will logically consume the element you used up and increment your + * tail (tail may also be NULL there if you use a single tail). + * + * Returns NULL if no waiting element, or a const void * pointing to it. + */ +LWS_VISIBLE LWS_EXTERN const void * +lws_ring_get_element(struct lws_ring *ring, uint32_t *tail); + +/** + * lws_ring_update_oldest_tail(): free up elements older than tail for reuse + * + * \param ring: the struct lws_ring to report on + * \param tail: a pointer to the tail struct to use, or NULL for single tail + * + * If you are using multiple tails, you must use this API to inform the + * lws_ring when none of the tails still need elements in the fifo any more, + * by updating it when the "oldest" tail has moved on. + */ +LWS_VISIBLE LWS_EXTERN void +lws_ring_update_oldest_tail(struct lws_ring *ring, uint32_t tail); + +/** + * lws_ring_get_oldest_tail(): get current oldest available data index + * + * \param ring: the struct lws_ring to report on + * + * If you are initializing a new ringbuffer consumer, you can set its tail to + * this to start it from the oldest ringbuffer entry still available. + */ +LWS_VISIBLE LWS_EXTERN uint32_t +lws_ring_get_oldest_tail(struct lws_ring *ring); + +/** + * lws_ring_next_linear_insert_range(): used to write directly into the ring + * + * \param ring: the struct lws_ring to report on + * \param start: pointer to a void * set to the start of the next ringbuffer area + * \param bytes: pointer to a size_t set to the max length you may use from *start + * + * This provides a low-level, bytewise access directly into the ringbuffer + * allowing direct insertion of data without having to use a bounce buffer. + * + * The api reports the position and length of the next linear range that can + * be written in the ringbuffer, ie, up to the point it would wrap, and sets + * *start and *bytes accordingly. You can then, eg, directly read() into + * *start for up to *bytes, and use lws_ring_bump_head() to update the lws_ring + * with what you have done. + * + * Returns nonzero if no insertion is currently possible. + */ +LWS_VISIBLE LWS_EXTERN int +lws_ring_next_linear_insert_range(struct lws_ring *ring, void **start, + size_t *bytes); + +/** + * lws_ring_bump_head(): used to write directly into the ring + * + * \param ring: the struct lws_ring to operate on + * \param bytes: the number of bytes you inserted at the current head + */ +LWS_VISIBLE LWS_EXTERN void +lws_ring_bump_head(struct lws_ring *ring, size_t bytes); +///@} + +/** \defgroup sha SHA and B64 helpers + * ##SHA and B64 helpers + * + * These provide SHA-1 and B64 helper apis + */ +///@{ +#ifdef LWS_SHA1_USE_OPENSSL_NAME +#define lws_SHA1 SHA1 +#else +/** + * lws_SHA1(): make a SHA-1 digest of a buffer + * + * \param d: incoming buffer + * \param n: length of incoming buffer + * \param md: buffer for message digest (must be >= 20 bytes) + * + * Reduces any size buffer into a 20-byte SHA-1 hash. + */ +LWS_VISIBLE LWS_EXTERN unsigned char * +lws_SHA1(const unsigned char *d, size_t n, unsigned char *md); +#endif +/** + * lws_b64_encode_string(): encode a string into base 64 + * + * \param in: incoming buffer + * \param in_len: length of incoming buffer + * \param out: result buffer + * \param out_size: length of result buffer + * + * Encodes a string using b64 + */ +LWS_VISIBLE LWS_EXTERN int +lws_b64_encode_string(const char *in, int in_len, char *out, int out_size); +/** + * lws_b64_decode_string(): decode a string from base 64 + * + * \param in: incoming buffer + * \param out: result buffer + * \param out_size: length of result buffer + * + * Decodes a string using b64 + */ +LWS_VISIBLE LWS_EXTERN int +lws_b64_decode_string(const char *in, char *out, int out_size); +///@} + + +/*! \defgroup cgi cgi handling + * + * ##CGI handling + * + * These functions allow low-level control over stdin/out/err of the cgi. + * + * However for most cases, binding the cgi to http in and out, the default + * lws implementation already does the right thing. + */ + +enum lws_enum_stdinouterr { + LWS_STDIN = 0, + LWS_STDOUT = 1, + LWS_STDERR = 2, +}; + +enum lws_cgi_hdr_state { + LCHS_HEADER, + LCHS_CR1, + LCHS_LF1, + LCHS_CR2, + LCHS_LF2, + LHCS_RESPONSE, + LHCS_DUMP_HEADERS, + LHCS_PAYLOAD, + LCHS_SINGLE_0A, +}; + +struct lws_cgi_args { + struct lws **stdwsi; /**< get fd with lws_get_socket_fd() */ + enum lws_enum_stdinouterr ch; /**< channel index */ + unsigned char *data; /**< for messages with payload */ + enum lws_cgi_hdr_state hdr_state; /**< track where we are in cgi headers */ + int len; /**< length */ +}; + +#ifdef LWS_WITH_CGI +/** + * lws_cgi: spawn network-connected cgi process + * + * \param wsi: connection to own the process + * \param exec_array: array of "exec-name" "arg1" ... "argn" NULL + * \param script_uri_path_len: how many chars on the left of the uri are the + * path to the cgi, or -1 to spawn without URL-related env vars + * \param timeout_secs: seconds script should be allowed to run + * \param mp_cgienv: pvo list with per-vhost cgi options to put in env + */ +LWS_VISIBLE LWS_EXTERN int +lws_cgi(struct lws *wsi, const char * const *exec_array, + int script_uri_path_len, int timeout_secs, + const struct lws_protocol_vhost_options *mp_cgienv); + +/** + * lws_cgi_write_split_stdout_headers: write cgi output accounting for header part + * + * \param wsi: connection to own the process + */ +LWS_VISIBLE LWS_EXTERN int +lws_cgi_write_split_stdout_headers(struct lws *wsi); + +/** + * lws_cgi_kill: terminate cgi process associated with wsi + * + * \param wsi: connection to own the process + */ +LWS_VISIBLE LWS_EXTERN int +lws_cgi_kill(struct lws *wsi); + +/** + * lws_cgi_get_stdwsi: get wsi for stdin, stdout, or stderr + * + * \param wsi: parent wsi that has cgi + * \param ch: which of LWS_STDIN, LWS_STDOUT or LWS_STDERR + */ +LWS_VISIBLE LWS_EXTERN struct lws * +lws_cgi_get_stdwsi(struct lws *wsi, enum lws_enum_stdinouterr ch); + +#endif +///@} + + +/*! \defgroup fops file operation wrapping + * + * ##File operation wrapping + * + * Use these helper functions if you want to access a file from the perspective + * of a specific wsi, which is usually the case. If you just want contextless + * file access, use the fops callbacks directly with NULL wsi instead of these + * helpers. + * + * If so, then it calls the platform handler or user overrides where present + * (as defined in info->fops) + * + * The advantage from all this is user code can be portable for file operations + * without having to deal with differences between platforms. + */ +//@{ + +/** struct lws_plat_file_ops - Platform-specific file operations + * + * These provide platform-agnostic ways to deal with filesystem access in the + * library and in the user code. + */ + +#if defined(LWS_WITH_ESP32) +/* sdk preprocessor defs? compiler issue? gets confused with member names */ +#define LWS_FOP_OPEN _open +#define LWS_FOP_CLOSE _close +#define LWS_FOP_SEEK_CUR _seek_cur +#define LWS_FOP_READ _read +#define LWS_FOP_WRITE _write +#else +#define LWS_FOP_OPEN open +#define LWS_FOP_CLOSE close +#define LWS_FOP_SEEK_CUR seek_cur +#define LWS_FOP_READ read +#define LWS_FOP_WRITE write +#endif + +#define LWS_FOP_FLAGS_MASK ((1 << 23) - 1) +#define LWS_FOP_FLAG_COMPR_ACCEPTABLE_GZIP (1 << 24) +#define LWS_FOP_FLAG_COMPR_IS_GZIP (1 << 25) +#define LWS_FOP_FLAG_MOD_TIME_VALID (1 << 26) +#define LWS_FOP_FLAG_VIRTUAL (1 << 27) + +struct lws_plat_file_ops; + +struct lws_fop_fd { + lws_filefd_type fd; + /**< real file descriptor related to the file... */ + const struct lws_plat_file_ops *fops; + /**< fops that apply to this fop_fd */ + void *filesystem_priv; + /**< ignored by lws; owned by the fops handlers */ + lws_filepos_t pos; + /**< generic "position in file" */ + lws_filepos_t len; + /**< generic "length of file" */ + lws_fop_flags_t flags; + /**< copy of the returned flags */ + uint32_t mod_time; + /**< optional "modification time of file", only valid if .open() + * set the LWS_FOP_FLAG_MOD_TIME_VALID flag */ +}; +typedef struct lws_fop_fd *lws_fop_fd_t; + +struct lws_fops_index { + const char *sig; /* NULL or vfs signature, eg, ".zip/" */ + uint8_t len; /* length of above string */ +}; + +struct lws_plat_file_ops { + lws_fop_fd_t (*LWS_FOP_OPEN)(const struct lws_plat_file_ops *fops, + const char *filename, const char *vpath, + lws_fop_flags_t *flags); + /**< Open file (always binary access if plat supports it) + * vpath may be NULL, or if the fops understands it, the point at which + * the filename's virtual part starts. + * *flags & LWS_FOP_FLAGS_MASK should be set to O_RDONLY or O_RDWR. + * If the file may be gzip-compressed, + * LWS_FOP_FLAG_COMPR_ACCEPTABLE_GZIP is set. If it actually is + * gzip-compressed, then the open handler should OR + * LWS_FOP_FLAG_COMPR_IS_GZIP on to *flags before returning. + */ + int (*LWS_FOP_CLOSE)(lws_fop_fd_t *fop_fd); + /**< close file AND set the pointer to NULL */ + lws_fileofs_t (*LWS_FOP_SEEK_CUR)(lws_fop_fd_t fop_fd, + lws_fileofs_t offset_from_cur_pos); + /**< seek from current position */ + int (*LWS_FOP_READ)(lws_fop_fd_t fop_fd, lws_filepos_t *amount, + uint8_t *buf, lws_filepos_t len); + /**< Read from file, on exit *amount is set to amount actually read */ + int (*LWS_FOP_WRITE)(lws_fop_fd_t fop_fd, lws_filepos_t *amount, + uint8_t *buf, lws_filepos_t len); + /**< Write to file, on exit *amount is set to amount actually written */ + + struct lws_fops_index fi[3]; + /**< vfs path signatures implying use of this fops */ + + const struct lws_plat_file_ops *next; + /**< NULL or next fops in list */ + + /* Add new things just above here ---^ + * This is part of the ABI, don't needlessly break compatibility */ +}; + +/** + * lws_get_fops() - get current file ops + * + * \param context: context + */ +LWS_VISIBLE LWS_EXTERN struct lws_plat_file_ops * LWS_WARN_UNUSED_RESULT +lws_get_fops(struct lws_context *context); +LWS_VISIBLE LWS_EXTERN void +lws_set_fops(struct lws_context *context, const struct lws_plat_file_ops *fops); +/** + * lws_vfs_tell() - get current file position + * + * \param fop_fd: fop_fd we are asking about + */ +LWS_VISIBLE LWS_EXTERN lws_filepos_t LWS_WARN_UNUSED_RESULT +lws_vfs_tell(lws_fop_fd_t fop_fd); +/** + * lws_vfs_get_length() - get current file total length in bytes + * + * \param fop_fd: fop_fd we are asking about + */ +LWS_VISIBLE LWS_EXTERN lws_filepos_t LWS_WARN_UNUSED_RESULT +lws_vfs_get_length(lws_fop_fd_t fop_fd); +/** + * lws_vfs_get_mod_time() - get time file last modified + * + * \param fop_fd: fop_fd we are asking about + */ +LWS_VISIBLE LWS_EXTERN uint32_t LWS_WARN_UNUSED_RESULT +lws_vfs_get_mod_time(lws_fop_fd_t fop_fd); +/** + * lws_vfs_file_seek_set() - seek relative to start of file + * + * \param fop_fd: fop_fd we are seeking in + * \param offset: offset from start of file + */ +LWS_VISIBLE LWS_EXTERN lws_fileofs_t +lws_vfs_file_seek_set(lws_fop_fd_t fop_fd, lws_fileofs_t offset); +/** + * lws_vfs_file_seek_end() - seek relative to end of file + * + * \param fop_fd: fop_fd we are seeking in + * \param offset: offset from start of file + */ +LWS_VISIBLE LWS_EXTERN lws_fileofs_t +lws_vfs_file_seek_end(lws_fop_fd_t fop_fd, lws_fileofs_t offset); + +extern struct lws_plat_file_ops fops_zip; + +/** + * lws_plat_file_open() - open vfs filepath + * + * \param fops: file ops struct that applies to this descriptor + * \param vfs_path: filename to open + * \param flags: pointer to open flags + * + * The vfs_path is scanned for known fops signatures, and the open directed + * to any matching fops open. + * + * User code should use this api to perform vfs opens. + * + * returns semi-opaque handle + */ +LWS_VISIBLE LWS_EXTERN lws_fop_fd_t LWS_WARN_UNUSED_RESULT +lws_vfs_file_open(const struct lws_plat_file_ops *fops, const char *vfs_path, + lws_fop_flags_t *flags); + +/** + * lws_plat_file_close() - close file + * + * \param fop_fd: file handle to close + */ +static LWS_INLINE int +lws_vfs_file_close(lws_fop_fd_t *fop_fd) +{ + return (*fop_fd)->fops->LWS_FOP_CLOSE(fop_fd); +} + +/** + * lws_plat_file_seek_cur() - close file + * + * + * \param fop_fd: file handle + * \param offset: position to seek to + */ +static LWS_INLINE lws_fileofs_t +lws_vfs_file_seek_cur(lws_fop_fd_t fop_fd, lws_fileofs_t offset) +{ + return fop_fd->fops->LWS_FOP_SEEK_CUR(fop_fd, offset); +} +/** + * lws_plat_file_read() - read from file + * + * \param fop_fd: file handle + * \param amount: how much to read (rewritten by call) + * \param buf: buffer to write to + * \param len: max length + */ +static LWS_INLINE int LWS_WARN_UNUSED_RESULT +lws_vfs_file_read(lws_fop_fd_t fop_fd, lws_filepos_t *amount, + uint8_t *buf, lws_filepos_t len) +{ + return fop_fd->fops->LWS_FOP_READ(fop_fd, amount, buf, len); +} +/** + * lws_plat_file_write() - write from file + * + * \param fop_fd: file handle + * \param amount: how much to write (rewritten by call) + * \param buf: buffer to read from + * \param len: max length + */ +static LWS_INLINE int LWS_WARN_UNUSED_RESULT +lws_vfs_file_write(lws_fop_fd_t fop_fd, lws_filepos_t *amount, + uint8_t *buf, lws_filepos_t len) +{ + return fop_fd->fops->LWS_FOP_WRITE(fop_fd, amount, buf, len); +} + +/* these are the platform file operations implementations... they can + * be called directly and used in fops arrays + */ + +LWS_VISIBLE LWS_EXTERN lws_fop_fd_t +_lws_plat_file_open(const struct lws_plat_file_ops *fops, const char *filename, + const char *vpath, lws_fop_flags_t *flags); +LWS_VISIBLE LWS_EXTERN int +_lws_plat_file_close(lws_fop_fd_t *fop_fd); +LWS_VISIBLE LWS_EXTERN lws_fileofs_t +_lws_plat_file_seek_cur(lws_fop_fd_t fop_fd, lws_fileofs_t offset); +LWS_VISIBLE LWS_EXTERN int +_lws_plat_file_read(lws_fop_fd_t fop_fd, lws_filepos_t *amount, + uint8_t *buf, lws_filepos_t len); +LWS_VISIBLE LWS_EXTERN int +_lws_plat_file_write(lws_fop_fd_t fop_fd, lws_filepos_t *amount, + uint8_t *buf, lws_filepos_t len); + +LWS_VISIBLE LWS_EXTERN int +lws_alloc_vfs_file(struct lws_context *context, const char *filename, + uint8_t **buf, lws_filepos_t *amount); +//@} + +/** \defgroup smtp SMTP related functions + * ##SMTP related functions + * \ingroup lwsapi + * + * These apis let you communicate with a local SMTP server to send email from + * lws. It handles all the SMTP sequencing and protocol actions. + * + * Your system should have postfix, sendmail or another MTA listening on port + * 25 and able to send email using the "mail" commandline app. Usually distro + * MTAs are configured for this by default. + * + * It runs via its own libuv events if initialized (which requires giving it + * a libuv loop to attach to). + * + * It operates using three callbacks, on_next() queries if there is a new email + * to send, on_get_body() asks for the body of the email, and on_sent() is + * called after the email is successfully sent. + * + * To use it + * + * - create an lws_email struct + * + * - initialize data, loop, the email_* strings, max_content_size and + * the callbacks + * + * - call lws_email_init() + * + * When you have at least one email to send, call lws_email_check() to + * schedule starting to send it. + */ +//@{ +#ifdef LWS_WITH_SMTP + +/** enum lwsgs_smtp_states - where we are in SMTP protocol sequence */ +enum lwsgs_smtp_states { + LGSSMTP_IDLE, /**< awaiting new email */ + LGSSMTP_CONNECTING, /**< opening tcp connection to MTA */ + LGSSMTP_CONNECTED, /**< tcp connection to MTA is connected */ + LGSSMTP_SENT_HELO, /**< sent the HELO */ + LGSSMTP_SENT_FROM, /**< sent FROM */ + LGSSMTP_SENT_TO, /**< sent TO */ + LGSSMTP_SENT_DATA, /**< sent DATA request */ + LGSSMTP_SENT_BODY, /**< sent the email body */ + LGSSMTP_SENT_QUIT, /**< sent the session quit */ +}; + +/** struct lws_email - abstract context for performing SMTP operations */ +struct lws_email { + void *data; + /**< opaque pointer set by user code and available to the callbacks */ + uv_loop_t *loop; + /**< the libuv loop we will work on */ + + char email_smtp_ip[32]; /**< Fill before init, eg, "127.0.0.1" */ + char email_helo[32]; /**< Fill before init, eg, "myserver.com" */ + char email_from[100]; /**< Fill before init or on_next */ + char email_to[100]; /**< Fill before init or on_next */ + + unsigned int max_content_size; + /**< largest possible email body size */ + + /* Fill all the callbacks before init */ + + int (*on_next)(struct lws_email *email); + /**< (Fill in before calling lws_email_init) + * called when idle, 0 = another email to send, nonzero is idle. + * If you return 0, all of the email_* char arrays must be set + * to something useful. */ + int (*on_sent)(struct lws_email *email); + /**< (Fill in before calling lws_email_init) + * called when transfer of the email to the SMTP server was + * successful, your callback would remove the current email + * from its queue */ + int (*on_get_body)(struct lws_email *email, char *buf, int len); + /**< (Fill in before calling lws_email_init) + * called when the body part of the queued email is about to be + * sent to the SMTP server. */ + + + /* private things */ + uv_timer_t timeout_email; /**< private */ + enum lwsgs_smtp_states estate; /**< private */ + uv_connect_t email_connect_req; /**< private */ + uv_tcp_t email_client; /**< private */ + time_t email_connect_started; /**< private */ + char email_buf[256]; /**< private */ + char *content; /**< private */ +}; + +/** + * lws_email_init() - Initialize a struct lws_email + * + * \param email: struct lws_email to init + * \param loop: libuv loop to use + * \param max_content: max email content size + * + * Prepares a struct lws_email for use ending SMTP + */ +LWS_VISIBLE LWS_EXTERN int +lws_email_init(struct lws_email *email, uv_loop_t *loop, int max_content); + +/** + * lws_email_check() - Request check for new email + * + * \param email: struct lws_email context to check + * + * Schedules a check for new emails in 1s... call this when you have queued an + * email for send. + */ +LWS_VISIBLE LWS_EXTERN void +lws_email_check(struct lws_email *email); +/** + * lws_email_destroy() - stop using the struct lws_email + * + * \param email: the struct lws_email context + * + * Stop sending email using email and free allocations + */ +LWS_VISIBLE LWS_EXTERN void +lws_email_destroy(struct lws_email *email); + +#endif +//@} + +/* + * Stats are all uint64_t numbers that start at 0. + * Index names here have the convention + * + * _C_ counter + * _B_ byte count + * _MS_ millisecond count + */ + +enum { + LWSSTATS_C_CONNECTIONS, /**< count incoming connections */ + LWSSTATS_C_API_CLOSE, /**< count calls to close api */ + LWSSTATS_C_API_READ, /**< count calls to read from socket api */ + LWSSTATS_C_API_LWS_WRITE, /**< count calls to lws_write API */ + LWSSTATS_C_API_WRITE, /**< count calls to write API */ + LWSSTATS_C_WRITE_PARTIALS, /**< count of partial writes */ + LWSSTATS_C_WRITEABLE_CB_REQ, /**< count of writable callback requests */ + LWSSTATS_C_WRITEABLE_CB_EFF_REQ, /**< count of effective writable callback requests */ + LWSSTATS_C_WRITEABLE_CB, /**< count of writable callbacks */ + LWSSTATS_C_SSL_CONNECTIONS_FAILED, /**< count of failed SSL connections */ + LWSSTATS_C_SSL_CONNECTIONS_ACCEPTED, /**< count of accepted SSL connections */ + LWSSTATS_C_SSL_CONNECTIONS_ACCEPT_SPIN, /**< count of SSL_accept() attempts */ + LWSSTATS_C_SSL_CONNS_HAD_RX, /**< count of accepted SSL conns that have had some RX */ + LWSSTATS_C_TIMEOUTS, /**< count of timed-out connections */ + LWSSTATS_C_SERVICE_ENTRY, /**< count of entries to lws service loop */ + LWSSTATS_B_READ, /**< aggregate bytes read */ + LWSSTATS_B_WRITE, /**< aggregate bytes written */ + LWSSTATS_B_PARTIALS_ACCEPTED_PARTS, /**< aggreate of size of accepted write data from new partials */ + LWSSTATS_MS_SSL_CONNECTIONS_ACCEPTED_DELAY, /**< aggregate delay in accepting connection */ + LWSSTATS_MS_WRITABLE_DELAY, /**< aggregate delay between asking for writable and getting cb */ + LWSSTATS_MS_WORST_WRITABLE_DELAY, /**< single worst delay between asking for writable and getting cb */ + LWSSTATS_MS_SSL_RX_DELAY, /**< aggregate delay between ssl accept complete and first RX */ + LWSSTATS_C_PEER_LIMIT_AH_DENIED, /**< number of times we would have given an ah but for the peer limit */ + LWSSTATS_C_PEER_LIMIT_WSI_DENIED, /**< number of times we would have given a wsi but for the peer limit */ + + /* Add new things just above here ---^ + * This is part of the ABI, don't needlessly break compatibility */ + LWSSTATS_SIZE +}; + +#if defined(LWS_WITH_STATS) + +LWS_VISIBLE LWS_EXTERN uint64_t +lws_stats_get(struct lws_context *context, int index); +LWS_VISIBLE LWS_EXTERN void +lws_stats_log_dump(struct lws_context *context); +#else +static LWS_INLINE uint64_t +lws_stats_get(struct lws_context *context, int index) { return 0; } +static LWS_INLINE void +lws_stats_log_dump(struct lws_context *context) { } +#endif + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/arm64-v8a/include/websockets/lws-plugin-ssh.h b/openharmony/arm64-v8a/include/websockets/lws-plugin-ssh.h new file mode 100644 index 00000000..4ba11658 --- /dev/null +++ b/openharmony/arm64-v8a/include/websockets/lws-plugin-ssh.h @@ -0,0 +1,364 @@ +/* + * libwebsockets - lws-plugin-ssh-base + * + * Copyright (C) 2017 Andy Green + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation: + * version 2.1 of the License. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, + * MA 02110-1301 USA + */ + +#if !defined(__LWS_PLUGIN_SSH_H__) +#define __LWS_PLUGIN_SSH_H__ + +#define LWS_CALLBACK_SSH_UART_SET_RXFLOW (LWS_CALLBACK_USER + 800) + +#define LWS_SSH_OPS_VERSION 1 + +struct lws_ssh_pty { + char term[16]; + char *modes; + uint32_t width_ch; + uint32_t height_ch; + uint32_t width_px; + uint32_t height_px; + uint32_t modes_len; +}; + +#define SSHMO_TTY_OP_END 0 /* Indicates end of options. */ +#define SSHMO_VINTR 1 /* Interrupt character; 255 if none. Similarly + * for the other characters. Not all of these + * characters are supported on all systems. */ +#define SSHMO_VQUIT 2 /* The quit character (sends SIGQUIT signal on + * POSIX systems). */ +#define SSHMO_VERASE 3 /* Erase the character to left of the cursor. */ +#define SSHMO_VKILL 4 /* Kill the current input line. */ +#define SSHMO_VEOF 5 /* End-of-file character (sends EOF from the + * terminal). */ +#define SSHMO_VEOL 6 /* End-of-line character in addition to + * carriage return and/or linefeed. */ +#define SSHMO_VEOL2 7 /* Additional end-of-line character. */ +#define SSHMO_VSTART 8 /* Continues paused output (normally + * control-Q). */ +#define SSHMO_VSTOP 9 /* Pauses output (normally control-S). */ +#define SSHMO_VSUSP 10 /* Suspends the current program. */ +#define SSHMO_VDSUSP 11 /* Another suspend character. */ +#define SSHMO_VREPRINT 12 /* Reprints the current input line. */ +#define SSHMO_VWERASE 13 /* Erases a word left of cursor. */ +#define SSHMO_VLNEXT 14 /* Enter the next character typed literally, + * even if it is a special character */ +#define SSHMO_VFLUSH 15 /* Character to flush output. */ +#define SSHMO_VSWTCH 16 /* Switch to a different shell layer. */ +#define SSHMO_VSTATUS 17 /* Prints system status line (load, command, + * pid, etc). */ +#define SSHMO_VDISCARD 18 /* Toggles the flushing of terminal output. */ +#define SSHMO_IGNPAR 30 /* The ignore parity flag. The parameter + * SHOULD be 0 if this flag is FALSE, + * and 1 if it is TRUE. */ +#define SSHMO_PARMRK 31 /* Mark parity and framing errors. */ +#define SSHMO_INPCK 32 /* Enable checking of parity errors. */ +#define SSHMO_ISTRIP 33 /* Strip 8th bit off characters. */ +#define SSHMO_INLCR 34 /* Map NL into CR on input. */ +#define SSHMO_IGNCR 35 /* Ignore CR on input. */ +#define SSHMO_ICRNL 36 /* Map CR to NL on input. */ +#define SSHMO_IUCLC 37 /* Translate uppercase characters to lowercase. */ +#define SSHMO_IXON 38 /* Enable output flow control. */ +#define SSHMO_IXANY 39 /* Any char will restart after stop. */ +#define SSHMO_IXOFF 40 /* Enable input flow control. */ +#define SSHMO_IMAXBEL 41 /* Ring bell on input queue full. */ +#define SSHMO_ISIG 50 /* Enable signals INTR, QUIT, [D]SUSP. */ +#define SSHMO_ICANON 51 /* Canonicalize input lines. */ +#define SSHMO_XCASE 52 /* Enable input and output of uppercase + * characters by preceding their lowercase + * equivalents with "\". */ +#define SSHMO_ECHO 53 /* Enable echoing. */ +#define SSHMO_ECHOE 54 /* Visually erase chars. */ +#define SSHMO_ECHOK 55 /* Kill character discards current line. */ +#define SSHMO_ECHONL 56 /* Echo NL even if ECHO is off. */ +#define SSHMO_NOFLSH 57 /* Don't flush after interrupt. */ +#define SSHMO_TOSTOP 58 /* Stop background jobs from output. */ +#define SSHMO_IEXTEN 59 /* Enable extensions. */ +#define SSHMO_ECHOCTL 60 /* Echo control characters as ^(Char). */ +#define SSHMO_ECHOKE 61 /* Visual erase for line kill. */ +#define SSHMO_PENDIN 62 /* Retype pending input. */ +#define SSHMO_OPOST 70 /* Enable output processing. */ +#define SSHMO_OLCUC 71 /* Convert lowercase to uppercase. */ +#define SSHMO_ONLCR 72 /* Map NL to CR-NL. */ +#define SSHMO_OCRNL 73 /* Translate carriage return to newline (out). */ +#define SSHMO_ONOCR 74 /* Translate newline to CR-newline (out). */ +#define SSHMO_ONLRET 75 /* Newline performs a carriage return (out). */ +#define SSHMO_CS7 90 /* 7 bit mode. */ +#define SSHMO_CS8 91 /* 8 bit mode. */ +#define SSHMO_PARENB 92 /* Parity enable. */ +#define SSHMO_PARODD 93 /* Odd parity, else even. */ +#define SSHMO_TTY_OP_ISPEED 128 /* Specifies the input baud rate in + * bits per second. */ +#define SSHMO_TTY_OP_OSPEED 129 /* Specifies the output baud rate in + * bits per second. */ + +/*! \defgroup ssh-base plugin: lws-ssh-base + * \ingroup Protocols-and-Plugins + * + * ##Plugin lws-ssh-base + * + * This is the interface to customize the ssh server per-vhost. A pointer + * to your struct lws_ssh_ops with the members initialized is passed in using + * pvo when you create the vhost. The pvo is attached to the protocol name + * + * - "lws-ssh-base" - the ssh serving part + * + * - "lws-telnetd-base" - the telnet serving part + * + * This way you can have different instances of ssh servers wired up to + * different IO and server keys per-vhost. + * + * See also ./READMEs/README-plugin-sshd-base.md + */ +///@{ + +struct lws_ssh_ops { + /** + * channel_create() - Channel created + * + * \param wsi: raw wsi representing this connection + * \param priv: pointer to void * you can allocate and attach to the + * channel + * + * Called when new channel created, *priv should be set to any + * allocation your implementation needs + * + * You probably want to save the wsi inside your priv struct. Calling + * lws_callback_on_writable() on this wsi causes your ssh server + * instance to call .tx_waiting() next time you can write something + * to the client. + */ + int (*channel_create)(struct lws *wsi, void **priv); + + /** + * channel_destroy() - Channel is being destroyed + * + * \param priv: void * you set when channel was created (or NULL) + * + * Called when channel destroyed, priv should be freed if you allocated + * into it. + */ + int (*channel_destroy)(void *priv); + + /** + * rx() - receive payload from peer + * + * \param priv: void * you set when this channel was created + * \param wsi: struct lws * for the ssh connection + * \param buf: pointer to start of received data + * \param len: bytes of received data available at buf + * + * len bytes of payload from the peer arrived and is available at buf + */ + int (*rx)(void *priv, struct lws *wsi, const uint8_t *buf, uint32_t len); + + /** + * tx_waiting() - report if data waiting to transmit on the channel + * + * \param priv: void * you set when this channel was created + * + * returns a bitmask of LWS_STDOUT and LWS_STDERR, with the bits set + * if they have tx waiting to send, else 0 if nothing to send + * + * You should use one of the lws_callback_on_writable() family to + * trigger the ssh protocol to ask if you have any tx waiting. + * + * Returning -1 from here will close the tcp connection to the client. + */ + int (*tx_waiting)(void *priv); + + /** + * tx() - provide data to send on the channel + * + * \param priv: void * you set when this channel was created + * \param stdch: LWS_STDOUT or LWS_STDERR + * \param buf: start of the buffer to copy the transmit data into + * \param len: max length of the buffer in bytes + * + * copy and consume up to len bytes into *buf, + * return the actual copied count. + * + * You should use one of the lws_callback_on_writable() family to + * trigger the ssh protocol to ask if you have any tx waiting. If you + * do you will get calls here to fetch it, for each of LWS_STDOUT or + * LWS_STDERR that were reported to be waiting by tx_waiting(). + */ + size_t (*tx)(void *priv, int stdch, uint8_t *buf, size_t len); + + /** + * get_server_key() - retreive the secret keypair for this server + * + * \param wsi: the wsi representing the connection to the client + * \param buf: start of the buffer to copy the keypair into + * \param len: length of the buffer in bytes + * + * load the server key into buf, max len len. Returns length of buf + * set to key, or 0 if no key or other error. If there is no key, + * the error isn't fatal... the plugin will generate a random key and + * store it using *get_server_key() for subsequent times. + */ + size_t (*get_server_key)(struct lws *wsi, uint8_t *buf, size_t len); + + /** + * set_server_key() - store the secret keypair of this server + * + * \param wsi: the wsi representing the connection to the client + * \param buf: start of the buffer containing the keypair + * \param len: length of the keypair in bytes + * + * store the server key in buf, length len, to nonvolatile stg. + * Return length stored, 0 for fail. + */ + size_t (*set_server_key)(struct lws *wsi, uint8_t *buf, size_t len); + + /** + * set_env() - Set environment variable + * + * \param priv: void * you set when this channel was created + * \param name: env var name + * \param value: value to set env var to + * + * Client requested to set environment var. Return nonzero to fail. + */ + int (*set_env)(void *priv, const char *name, const char *value); + + /** + * exec() - spawn command and wire up stdin/out/err to ssh channel + * + * \param priv: void * you set when this channel was created + * \param wsi: the struct lws the connection belongs to + * \param command: string containing path to app and arguments + * + * Client requested to exec something. Return nonzero to fail. + */ + int (*exec)(void *priv, struct lws *wsi, const char *command); + + /** + * shell() - Spawn shell that is appropriate for user + * + * \param priv: void * you set when this channel was created + * \param wsi: the struct lws the connection belongs to + * + * Spawn the appropriate shell for this user. Return 0 for OK + * or nonzero to fail. + */ + int (*shell)(void *priv, struct lws *wsi); + + /** + * pty_req() - Create a Pseudo-TTY as described in pty + * + * \param priv: void * you set when this channel was created + * \param pty: pointer to struct describing the desired pty + * + * Client requested a pty. Return nonzero to fail. + */ + int (*pty_req)(void *priv, struct lws_ssh_pty *pty); + + /** + * child_process_io() - Child process has IO + * + * \param priv: void * you set when this channel was created + * \param wsi: the struct lws the connection belongs to + * \param args: information related to the cgi IO events + * + * Child process has IO + */ + int (*child_process_io)(void *priv, struct lws *wsi, + struct lws_cgi_args *args); + + /** + * child_process_io() - Child process has terminated + * + * \param priv: void * you set when this channel was created + * \param wsi: the struct lws the connection belongs to + * + * Child process has terminated + */ + int (*child_process_terminated)(void *priv, struct lws *wsi); + + /** + * disconnect_reason() - Optional notification why connection is lost + * + * \param reason: one of the SSH_DISCONNECT_ constants + * \param desc: UTF-8 description of reason + * \param desc_lang: RFC3066 language for description + * + * The remote peer may tell us why it's going to disconnect. Handling + * this is optional. + */ + void (*disconnect_reason)(uint32_t reason, const char *desc, + const char *desc_lang); + + /** + * is_pubkey_authorized() - check if auth pubkey is valid for user + * + * \param username: username the key attempted to authenticate + * \param type: "ssh-rsa" + * \param peer: start of Public key peer used to authenticate + * \param peer_len: length of Public key at peer + * + * We confirmed the client has the private key for this public key... + * but is that keypair something authorized for this username on this + * server? 0 = OK, 1 = fail + * + * Normally this checks for a copy of the same public key stored + * somewhere out of band, it's the same procedure as openssh does + * when looking in ~/.ssh/authorized_keys + */ + int (*is_pubkey_authorized)(const char *username, + const char *type, const uint8_t *peer, int peer_len); + + /** + * banner() - copy the connection banner to buffer + * + * \param buf: start of the buffer to copy to + * \param max_len: maximum number of bytes the buffer can hold + * \param lang: start of the buffer to copy language descriptor to + * \param max_lang_len: maximum number of bytes lang can hold + * + * Copy the text banner to be returned to client on connect, + * before auth, into buf. The text should be in UTF-8. + * if none wanted then leave .banner as NULL. + * + * lang should have a RFC3066 language descriptor like "en/US" + * copied to it. + * + * Returns the number of bytes copies to buf. + */ + size_t (*banner)(char *buf, size_t max_len, char *lang, + size_t max_lang_len); + + /** + * SSH version string sent to client (required) + * By convention a string like "SSH-2.0-Libwebsockets" + */ + const char *server_string; + + /** + * set to the API version you support (current is in + * LWS_SSH_OPS_VERSION) You should set it to an integer like 1, + * that reflects the latest api at the time your code was written. If + * the ops api_version is not equal to the LWS_SSH_OPS_VERSION of the + * plugin, it will error out at runtime. + */ + char api_version; +}; +///@} + +#endif + diff --git a/openharmony/arm64-v8a/include/websockets/lws_config.h b/openharmony/arm64-v8a/include/websockets/lws_config.h new file mode 100644 index 00000000..757e51da --- /dev/null +++ b/openharmony/arm64-v8a/include/websockets/lws_config.h @@ -0,0 +1,156 @@ +/* lws_config.h Generated from lws_config.h.in */ + +#ifndef NDEBUG + #ifndef _DEBUG + #define _DEBUG + #endif +#endif + +#define LWS_INSTALL_DATADIR "E:/work/harmonyos_data/third_libs2/20220210/build_libwebsockets_arm64-v8a/output/share" + +/* Define to 1 to use wolfSSL/CyaSSL as a replacement for OpenSSL. + * LWS_OPENSSL_SUPPORT needs to be set also for this to work. */ +/* #undef USE_WOLFSSL */ + +/* Also define to 1 (in addition to USE_WOLFSSL) when using the + (older) CyaSSL library */ +/* #undef USE_OLD_CYASSL */ +/* #undef LWS_WITH_BORINGSSL */ + +#define LWS_WITH_MBEDTLS +/* #undef LWS_WITH_POLARSSL */ +/* #undef LWS_WITH_ESP8266 */ +/* #undef LWS_WITH_ESP32 */ + +/* #undef LWS_WITH_PLUGINS */ +/* #undef LWS_WITH_NO_LOGS */ + +/* The Libwebsocket version */ +#define LWS_LIBRARY_VERSION "2.4.2" + +#define LWS_LIBRARY_VERSION_MAJOR 2 +#define LWS_LIBRARY_VERSION_MINOR 4 +#define LWS_LIBRARY_VERSION_PATCH 2 +/* LWS_LIBRARY_VERSION_NUMBER looks like 1005001 for e.g. version 1.5.1 */ +#define LWS_LIBRARY_VERSION_NUMBER (LWS_LIBRARY_VERSION_MAJOR*1000000)+(LWS_LIBRARY_VERSION_MINOR*1000)+LWS_LIBRARY_VERSION_PATCH + +/* The current git commit hash that we're building from */ +#define LWS_BUILD_HASH "xlb-20210911jjb\\administrator@XLB-20210911JJB-v2.0.0-640-g8964ce9d" + +/* Build with OpenSSL support */ +#define LWS_OPENSSL_SUPPORT + +/* The client should load and trust CA root certs it finds in the OS */ +#define LWS_SSL_CLIENT_USE_OS_CA_CERTS + +/* Sets the path where the client certs should be installed. */ +#define LWS_OPENSSL_CLIENT_CERTS "../share" + +/* Turn off websocket extensions */ +/* #undef LWS_NO_EXTENSIONS */ + +/* Enable libev io loop */ +/* #undef LWS_WITH_LIBEV */ + +/* Enable libuv io loop */ +/* #undef LWS_WITH_LIBUV */ + +/* Enable libevent io loop */ +/* #undef LWS_WITH_LIBEVENT */ + +/* Build with support for ipv6 */ +/* #undef LWS_WITH_IPV6 */ + +/* Build with support for UNIX domain socket */ +/* #undef LWS_WITH_UNIX_SOCK */ + +/* Build with support for HTTP2 */ +/* #undef LWS_WITH_HTTP2 */ + +/* Turn on latency measuring code */ +/* #undef LWS_LATENCY */ + +/* Don't build the daemonizeation api */ +#define LWS_NO_DAEMONIZE + +/* Build without server support */ +/* #undef LWS_NO_SERVER */ + +/* Build without client support */ +/* #undef LWS_NO_CLIENT */ + +/* If we should compile with MinGW support */ +#define LWS_MINGW_SUPPORT + +/* Use the BSD getifaddrs that comes with libwebsocket, for uclibc support */ +/* #undef LWS_BUILTIN_GETIFADDRS */ + +/* use SHA1() not internal libwebsockets_SHA1 */ +/* #undef LWS_SHA1_USE_OPENSSL_NAME */ + +/* SSL server using ECDH certificate */ +/* #undef LWS_SSL_SERVER_WITH_ECDH_CERT */ +/* #undef LWS_HAVE_SSL_CTX_set1_param */ +#define LWS_HAVE_X509_VERIFY_PARAM_set1_host +/* #undef LWS_HAVE_RSA_SET0_KEY */ + +/* #undef LWS_HAVE_UV_VERSION_H */ + +/* CGI apis */ +/* #undef LWS_WITH_CGI */ + +/* whether the Openssl is recent enough, and / or built with, ecdh */ +/* #undef LWS_HAVE_OPENSSL_ECDH_H */ + +/* HTTP Proxy support */ +/* #undef LWS_WITH_HTTP_PROXY */ + +/* HTTP Ranges support */ +#define LWS_WITH_RANGES + +/* Http access log support */ +/* #undef LWS_WITH_ACCESS_LOG */ +/* #undef LWS_WITH_SERVER_STATUS */ + +/* #undef LWS_WITH_STATEFUL_URLDECODE */ +/* #undef LWS_WITH_PEER_LIMITS */ + +/* Maximum supported service threads */ +#define LWS_MAX_SMP 1 + +/* Lightweight JSON Parser */ +/* #undef LWS_WITH_LEJP */ + +/* SMTP */ +/* #undef LWS_WITH_SMTP */ + +/* OPTEE */ +/* #undef LWS_PLAT_OPTEE */ + +/* ZIP FOPS */ +#define LWS_WITH_ZIP_FOPS +#define LWS_HAVE_STDINT_H + +/* #undef LWS_AVOID_SIGPIPE_IGN */ + +/* #undef LWS_FALLBACK_GETHOSTBYNAME */ + +/* #undef LWS_WITH_STATS */ +/* #undef LWS_WITH_SOCKS5 */ + +#define LWS_HAVE_SYS_CAPABILITY_H +/* #undef LWS_HAVE_LIBCAP */ + +#define LWS_HAVE_ATOLL +/* #undef LWS_HAVE__ATOI64 */ +/* #undef LWS_HAVE__STAT32I64 */ + +/* OpenSSL various APIs */ + +#define LWS_HAVE_TLS_CLIENT_METHOD +/* #undef LWS_HAVE_TLSV1_2_CLIENT_METHOD */ +/* #undef LWS_HAVE_SSL_SET_INFO_CALLBACK */ + +#define LWS_HAS_INTPTR_T + + diff --git a/openharmony/arm64-v8a/lib/libmbedcrypto.a b/openharmony/arm64-v8a/lib/libmbedcrypto.a new file mode 100644 index 0000000000000000000000000000000000000000..271b03e55752b7a3dfe56d4e5d6df0660915a15b GIT binary patch literal 3378110 zcmeEv34B!5_5XeI=1nFm2?<*S5*9TCS;CrV)IkJc0ACS+k3BA`XV zO4PR2+750lP-$J;U~Q|_T1yqRbopsFRJ3tLT){&5f6smQzHMemwElko-|zG3=$m)$ zIp>~x?z!ild+vR2!m#pSOQ`;Wv~h*@&v;8whppd*g%ie?PMpGds?r#99b&Aq=?lG- z@4w69uJ^8F%D-{Bw(n;k6E(I+xR=y)0O(=T6VfCZD>AA zdVOamOY6mzKHSf~=qqE|SVmXo+x{=)%6e!5`@C15O;@rn>dJ0RW4*m{#$3QY)Ajdi zmh(BTzK`9;{)vbGK)Rm3-na&xdw}(H<)3wc8CU)FEdO&}XO#bo z{ZC(mwS4xuu5DMc!T;tp>os)9BkT*ge)TRJ>bMH-C}#31ENNoK^~f?-nBW?o zF@?olyYty_y1M?RU(dVP@FdrW2?yAJF1roRerFG(t7!R`db~yr*w2is>}zb)|B|ct z?ENh1weJ8cPI8SN*}{@u_k53yPI8?y_W=7$*TGHfoFvznbAHThSKBYyn9p&I?K6e_ z|GdU8c!0%SKO4%%e~zo<;+NRxy8hr{C7xQc1=vblNs0Gp={#p-zB;ltHU*I z4XuG-xHS-JS<~DW2vvtz0&Hz{$%N9xgoNm}mITbv*E%` z@wnQSaM;EaX^OPj5Ut^c+CW>l)roCe9$phbGY)2sMoTs{vwHN4K>%o6=gFN&>Z!rkX%g zurXW{s0p?O9YmPFx5Pk0#5xEhyDr=o2sYH&WeQ}VslA~go>CoYYi(SZYV-Gc0IVS`g#Rr{m)dsN*BS z$$>;eC8$mV>*zQW>*zQm>uB9APpfsj7wJ`_p*A>Qa{Z!_nnXruhU>Kjs~a#N3A|7j z-4a|CsBW*VO>E=1(bp>hU56=_Txxq;ZK;!79c&FxnM6@6T4RPmfrbAiz{XE}*ftQX zsR;zD%@8bc)@dMd*0CTQ%x@hvLWLTeB7+!VlAH=0)ETyPn5*QQ=wOLUbDVGFiY zE7AmI9g0O-6Ns0{KzOyijfPfp%_NBpSYm8#LVTQ!2nS|6UwcD5A8<~-1SV?<2W!yz zreKSGcr5rpgWX)5gds?Pb@(}TDzRsxr*S54t&h~U1vEd`S|e-i z+O)P;$GIxuoUTeZrrSF2UvrSGNt;2ktxE>h=I91i&wh-SL&zK&8Y0028aqk$q|-^YsO%tFRW?XA zl?|*-Wdj@Uc@|P!F6X3Kleti+F%WETtEZ4m`L$^V5JdhKKsX9mR{^SIR~HDora&Z6 zl4D6fTQjX~!ItDoaB5Ob>Vu*B;DqsxtP(gKZP!v_?W#&_0)0)AU1nkS={w3?HM>>rzu+~*s z$c;4BMln00m;m;KD~{f_rrF{nxnnyWvgkEx!esBZNVF-=0IluK z&C!;&utgZwTO+LuaI=|RG-&XI0Op~&-iF!&^^HMu+l+E!xDg4SwK8Fv*90Q9f$)k1 z_-Jh{>|i5cQEkUk90)}bG=r_Jkvek=Momb1L*i!}=*yDAkrgXh2zYDj(yW^Rhvrbw{ z%)1twhYA%1jrvY|js#7MbS{peCfqtPL2hJ0ThkkkwyjGXV;fqIK~E<*54dauOkkty zk}xq@4Nh>>NUXHLI&`*sB$~6QH-w<3^)-Z`<{*wM%(TYNuqqrhC$%Ke&?cxAza~=! zFryV~{{_l+AZT(@>Sl7|7$p>J2%$>I>I^l&+lPkETdc>C#L*aB9wtSDjbIpm_SF5==-ey>iNn}|IA%W~fw&FDs8H*EO7rRYb zv9Sp{`wpbDgB*n<25#3JjF`(Nq=JObTm4Z-I(rB{t{1I=!M64mGsx)tb|S?&N-XKD z$~rEPVp~M@x`cx7n`@9AZA%t)5>6!}wdNGkks`IU71T@A{IJ{w72GvL62P$%CM!IB${S| zQ$>MuxQ@X~c%HS{RNzx8fsN>Z-Igr#R%x~)S#U@9fv@sEPa~V_cA6`p8*Lf^J-4Fh!5T*iGp{Wxyk>y3};wx4%kUfFEyyVb2bMf zlCE%Kp*k(To{o2RM)#?PsAW$p(?S}z)@XZ+C8v`l`_PCqvbNo_UQ5opU>i2bW(NeX zeGmmQfnfzjWO|Lkrgls6DBDPy2TBIL>+yLa*2tPrLlj$R?EFnPZ*B;-)ka(B>_|_L zZPfZmT|IK*mEi{39EV%X&f%CaF+t~xnw)hwL`ryKMFhTgk2|j-iem%MQP$l%A#9c< zM7&jXtSuSiDEpBJp>)d{qgTJY#@t&`0ZUXf4%Tc8v~0BmEjugPp(fZOnP{8JCfcz{ zauVWqNfr+KHpwK|_DOa$Jv}lzV(1)iK5Mnan9A!^m?wgb79mTrC9ynVGq(j2?XWY@W@_R%6tmHs3fi2Tb4GBm(ze>F zv@II}PjgE&6mGTYWY2-Y6R);Iv8 zH?cIHZ*s{5J0IWV)4LVqF7aKNZ0Y&rIQNif#ID2#>gv~1np{J_$cNGY)M_|WG4Cs?%uS*zy?r+iOySt^dV#>&g0#Td;vH~il#HiXW+yo9Ax$Fav>1bH&U7MJ51>UE zR*c_jgXY*G8yMSe+QcT3qHn8h@eq$$Fmd8hIG(W~h4S%88<%j%8cd*-K{`J*eA0B) z1SmSxDGAUUW7hWssS4t3b+~nctq$RkqD`<*U!6NX=D{Mg39zr;Kst}@=&@wtc)8Y@eKGLX#m?Zi#}>(J&4~=w1Y<7w z9gCe&#j&)7L$tWiiAA(F(A;Xil?YhhwM6OZNo}MK=VZp_N#8=6$&7{B9(m}fjlVQR zi?8L$b6b=e3t*>(9TY)9dMQRe>o*WGvT;NMc6GFb>cKPs5v>i;HobQ1n#RU3RxNBw z#QOrgiix&L5)TD~)mX84b%C%}wWCB_BbkDbK%PLw^NQ5fQX2%V;!1A)&fq!@$@Bv#0(jl#UOk^hysc5O#E2yuT#=8*BCzE7b_dJ*U3 zI3YLLL;AtFiLi_Wuc1$VLx9EFoGjKIqDLBS1~ZG)A&cQjb8`)_DC{6mFGIoRV2Ga1 zPy-HnqzOm<$hKtn6Ow^URF`;zb%-sEIP6Ho5N&Tet#m<8BA&eTbgG+1rG2b9WK^<_ z2$d-dkh=r2f`PLOu?!4xSjNRHI>qQrmf1*elg68-CEOUr88s2;t!!jYc({Pa>ruR& zM;dVr$s6n?M4?DSTcpXvHez>2Ik-_tAZ(mMDMOy6oQTgVQ?MqIx(eGu-UA*G<*yJ( z5nEV|Bgh~o2_m*pUZdLqBFt3_;sk>}rm_~bV-J^!>WJX#%n;4GPGu}&?U6M>yN<&F zOI31K%i{|R#o|*kyeVT)Ftf zOH4IaszgjYV@c4qb=gW(kMF7UC_rwIjD_Lak-B_~?LyMu077!ujmz8Kizt>u9;UuLY~()z@i=S+^8&2;!L6GMANgJhXZ zP7d3QaS|=g;w151YD*Z0>aECF?7L^2RV81KEEC5n(=ub?(PFB^5fZE+mdO#vE*!{; zC#Q&C8VM^s+R1Ho<%BfdxtydVZQH%pSxHdiCDQpul3}-yk_Bpr4lCK+}joo?7E zN)nGbiLCu0igkuqX%v=ev#BrMh?{upM}}vj(M#j}`5*;mV+To;aAR{D-y)f4iecDY z(R+-NU6+do@p$JA2cm?=>j1t-Dw?7%{_9_^TD+u4qZPO4`T>G9`2rYy(7kCTu@q9df3 zwRD2L7TiLdRy$sbp?N7N&KHMlBzTlL0#pYr<)^>KsgzYoog&lhcnXC+ zTa$VPJ?_~F{LI;IJw0CA*w7QavKbAAn-l6|AtzEwCkq|$#<$#QSQU5jB$0!SvgOtB zxPC&4og+b)B~L5fL3P^6L9;z20FBlaE+2JIFIg-x)*oq5{RFd*V~w9H*sP8xbnSTK z+UcSK&3_tc9;A|ZlY$2cICDit)j^9EjStR|udRZ1i=q1i}8yx~l2B0=%SBmN%DNAC|L&=qK_`G_md ze1wcQpNVzq$SDr<5zc8o!X;KIk;H`NBN6fDGqH&T#hZ`#6POQ~3?7jNTg*pZc+5mU zed0*VYu^G*%T!IcA!sgM76Lt?G9OS0g7IdYF$RJV-&up;Yy%Oom3|vSt>bNhYD+6t zlH&z}cv7I&`Zp;gT~8fq!}gc5@tOlNgt$MlVnJJfB*D?Pg`Q(Vf-K4T(qV%a2tu1dq>GI$AoYDJ?kHZ(RmF3tMVp^ni{nB~C`()nmeCm1g(wzowZ z1PY6Sc%Vb4h;c~$XfPh#5J9_fX!}7!YaAUfzQ*BbBOHgs#x@Rz^(zk7DvUt83DFJO zcHykQ2|EyaMiE~{-<_Cv+85BnWgSDSq>R=&MtYF&9nmYKJDe;>EZJY#oH9utz0xTY zr^>&wxpBsvnJz_P@}sbyFta4FjCG%DVtpL#V_zoD!z{{}cQ0cpxIDNtTy9({E*CBZ z7u)-o8u()sV-G1KI~JmxN9B|2ezE(c$~s-MIu^dH78C=2%gJ?*?;=`cGVmm+IC$ zDc;ny^o-1`K4$Zd8bvf}=1>e~a@ zzBko^J)>F2!nZePcfPZkbvCK6K?*y5s1G|H9pbHQ9#l}dZB234o+YEZ{2J?g?y4Kp z(p~BPfZ{&7T#iA(i|f!hrDE>6?@ge%$LySc=bv425i zOlf1Jq;xO(^9%GtIeBW)yAS$D9l6A}@4b1xeJb>V?RIFmJh)PD<>Jc2)eqOy>>Uf= zf!)@kKPzCb5M!NNaNUFJDO~@+)#_rMx8Qmh*DL7Xfb9EPj-hW$3%r$IDPVoeH{6~U z2@I^fJtf~CDaf9`@Ue}eXWTfXSebURXn)>ZCl&thCH%|Tb?Wd{^dX?<-AmG0N zzFkdC?+^O06IBQQrsk)2Y)r}hiY$bthyB|GP9&-!*QsZY;)BhR z=F*)*d^fF#tSGIDRF!U5vi#eJW&6iIe$}Y$({lXVgUnxY^@dSj1OA*cWmJ|c%Re61 z*lDg&Swnp{k(``=Ej~!~vsjj&T`=n)$;rNQK9_v}b}W26&~;#1w*Npd$N#*-P*)xG zu7Wl)U0u&Anf@^v+jqyOrxwkEtq-XkeJ{a1UGxicUhh|x-mmTG+g$2bndsLY?C1}a zbpNyH*A4Ku=h3$v=+g`6TPJi{4*Acbe?(i3evOAN%h9jp!AyT6bT|U~xJ;$%UG#7C zy1s;<(7aa4#HxH@ay@%8k zTpnB+E;lX}mkXDIi|zHocX96|`B+zqSsym}ZM9?Hb{E^%4WEytvK6U08QY2!-@dJV z*}ftT_x`x2;-1g;6=&kUiFIB-lT<8G={j?5RTopzw^cKj|03qbrO~|KH{3_Q!aAoz*2R!D1F}dC$+!rz z?ump;N%j+vb9hZnm$o+CHGFM#*Jh^rLy$r8TyDte2z32hGQ4cxu*U*j!=c9r=rPjL zr(vQ`cSM4=J`GzN?2`SN#uUGj!S+4#@u@{cu+=tK+Hcd)uT+~XGRi<|Af_%dSPAvL%7!+Dp%&wR&E zuB+S)zw4x2gnZ=Wx}WX-2)W3I^ISY9_&`7(H&0pm9?R#g0GO8H!CX32m z-@bS6LK*X?50x`~`;LrojiPy!gYr@2MA?v2gz={{U1x3>Sb6ah%!?)Au0qEA$U$+racTaiQ0LGY zY~Mdn=h`K;U2f<#?8@xQx+Qg8cU?8GavJ1}fQ%=>zlEjv&$KzNtmrC% ztk)ppXaU=I4dg56$M?~0Eo423`jI`EZTq*vMkac(j+qV~OD(L3{@HZ}L z>^cJeOP4ftjaw4!3c3{k7?z0`n&p2Gd7X;<>Vvb{zRl1jGsm~@Z0OMh**7lDuAB${ zM(~EvPtuj@>_wen&~dM#`rm>5$sSq#eEV)J_f|&1udN?gITq_%5PhXSl5Gy4&Stc8 zKvDb$6wUu`AHBUO+ENDj_Ic12)t!mHkxi*i5d9j*`XJ7GaB2P!+B}krHRo!?P_#w* zdWZP-RV}INDnVNdV6!b~n`~0gynZj%PmJ9HFV>12#qBRhV=KBbhiKflA3e2*;QL_T z*Ks`tdp&{sVce8XtzCZLJn)$k^k*;ZPh(I59VcQu#-Oi1a#6qXaHZhFdIn#~gO3~l-&l+l z`D2LXAwIf!j0~|{|EutYJoo|m=TWTHC0Mt!U3q@QcU+2}a*lT~{&^Vt8pOabVqPoa z;C8gL4Qu~0_`M(N_?sB-JdE|kNNefykn8MCU z>2_C+zjIiwf7nHee{@y4A8XjYT=>nf_1Tpr8@!dv(eE1M_FpT^@;^H*)BnAo$NxI~ zBzM^KQ3tN_!iL$EPhotUvHp9NRDas=G=J)_KK@IlrTE89!(6G-{D+W(y#^ogga03p zdk^?W0X~AdhcNEbysT{2cvj{G{?G`-XLrZKIgFJpaI>X{kCn|G$jW98 zW@YmWSs5l(*(F7+Y{ogPZ1yBpHm?*i%2^r3*ko~?@{5l~P^_K4n{pAvI3uo8?ESwK z^G0AkSYzI=Fit(iyzgVqIAh+csOOA%6z@i2ek6){PeFz=?wu~?9Ra_Lc@#@%&QZ)8 zgZV}=k75bsuD^!=Q_TB^CFWg?_%jxIkbV^JUPXKfVV=`G9EVtNBgsR&+l%-`F_7XO z#XJpsVa)f<@F$Xe1ajtqmtrNwxoddL>w}o5@|ZUawxmAw5iu`__9*7PiuzRNM?Bss zhzArKRR3nkKMWZ%?rlN5p_oVUj`U-wM{%zZv1lugd8#GmvD3!9Lg+#_otQ^4jN;xz*l#TKyC1Qx1aYdwm4YkRe^kUeiizXISXpCTl*V7C7~5%Zo}@2&JBZe_!cRfz8t^Rz+@F)z!1zb^-S!#@7e)#?7{ zf+_yD5cBQIvd-D1#TgOzT_!H#LN*bHgUtte_8$8r@mFMyDKVHO+ z-f|J^-0A8#e`jB|XsgRtwi{PL3R`hV9l&$wBE{>k#~IaD4`{evL0-*q9^le|!^O*K zC}*LJif0S|Ya(|TbQO3o~`6v%X85b`PMR_>NxOjOu%4eaBirB7pp1)`C!jn9Wn8>G1?6*5#>LC$qI?0$xOn*jR`xjdLu4yD zr}=Rzd#JVWKXgymjS!&0xkj@d69$E!)ChxFN2N9 zuj^s6U4SF75vRjuy8thPjW``P+XXlR8*w^pwhQnw*of0%vt58Auo0)jX1f3{gN-;H zHroX_0vmBUY_<#VGT4aIVY6L;Bd`&t!)ChxFN2LZ9X8tqI074SI&8KJ@G{tl(_yn+ z97f+@uS4o%=eG)fx&yW|&La}+0j*~dC)ZtsJ)oH@oZ9Td-pGyf2@U5I9-LRC;M~HC zbK+F&2^C|XG~35scyr$12^T79Z^^k35p!XsLUTbWrhVh$4Bt&lPF#GDbzq-3oprv< z=Z1zk;^ycH@ur=~?pRnU=F7{fZ|}#L6Az<*-tsR(U~|HUwt~fJ?^=>+>cnykiQ-du(Bf?S=oBI&(@-N7iX8AIwHR0r2Tm|3o%{hX}r;JFAqZ(L41 zfrHC%g@-ghIAU<~gL^?M!P;?YZd2MDm8|T|R^quFJeME5X2|LXrw?BJpm#`0<=4(W zkpIR!(4(NU%stCk&YmBfn0K%N*Rxuxf7Y6UiK9+la?p?K@H*(cij}=p!OGrV&dT1I z&dT1n1hF@S`gN>qO<(p=^Oe0E^_7vGJws<5e76EIXt}TK%pvn1ycRabnReN$bw237 z3c4?T@EP3Cf?e;2-NLZjZ*lhwu6l4MY;+H7^epaY!A^I;9>0P;4&Xi$HhFWpuk23r z|26dgIoxYugI7b)A?302=jS%3dC|umXFs2RH%r^|Yo_kG3pUt~E8FAV-+gT3gV&sZ z4R9Sw?>PSrjNeg=&0Da^A=v*N*yUx|`CZug71;9#?D;C}^d{`|9_;j*u+w4K>1~WV z&b0F0gFdfO->AQ21F{F%26lP_HtU9NhtcmhVT&WM&%0zRvK!eD_WT}V(nb$kk&PVW zJ(ZQ+hd6W}!#bM+7%`}s;B>%Z5o9*S7pu!4ky6(q$ zP=yjGtx#Cmo@Mo=qnFp0(*CbFQdH{2nR|iieT$yy6pUa;cOzDGs{{Ao*$2*r3W^as z^1LpbzbgZOTdZAmlUGgK_7-Hmt)}gH)-`Zj;quid?oa|Jwhv=R+2CPgt0JW*29Ch_ zBF^6_2KjI7{m{eK_B3{sc*&+@XR;-YQ4o62IzrD9=-#cuuDGa=?_j>{%v7?9 z$PQRfUe3Mf#4EYePQ04yJHZz9>BHQqeTosU-r5X3r?bw&!PR3Mm9#zA<6?tHjNPML zf7_wH>_qq3zB0e!E1L`6h?2SI23)fsbChz!ZQWQGx<}Jk`pOzXUnc0(rl06oC%VV^ z%4QQ?+wj2kxJWM732R38M4h%bQC+Md-BWe?vebn1!|C608|Bv3AVB+4jX)S6s#(^yIpq z?mmvQ#bW^%cvY+?ZhpqNhT)w2LUxqa4u(8xFvj6S)r0jxLk{KM^8wb2Pk1iH_DplJ zNtYv!qB;8XvNfg1XG)7xSPtojbL-Nlmz9++$@JYc70*>a@vs+;|LfGlhu~u`Bi_A& zi^lhT`0!L01HPbmjf>9zE`~nSq5DP9kM_^M;%D+$`%8a=Hc0*`$iL1i|6iw0EC19J zbiU|?`d@N@|-x<*RV(32|<9LyNp74a3BP1KkC62KigmL-+V~4)%xf*ffLyRe{`yXRW zsc*1Fp4HAYc5*BSh%p>=Dt-(c> z?-S^G+@|N+Qa}9R%N9LL(XW9i?1g-;=OB#H0K?b1F((T&c7GvaUg}l8o8DX&p*Z*g zo*(ACxolKv@u^FuzA5^$*5Qkv*3t7J-4{>$++NLjLHg7{_!ffL4%nUhSU&D}_RpUy z)AOHCU^9A_G!Xtq&yUM+|1z$1xae6jJ@4PS`GUQNHs|8X!_^O0e_R7_4a7AFS3a&Y z_R{_db1dgnKAwGg*rF3Sx87QpU)f)A z0_I}zFE*C#{u5(U3I8#4qqP7JAtrr-+|k4h+OzTkHo5_<4g?}PVDnaU>TEts@z5c>HO*kPyoV)-5FpUQWt-^Be}<sMiKcjwM@91~YB=&GFo?)ZC9k@EFUHEKH!5M7Du;Zr|;a!A0S-#`g zsYUe6N!mmAE!4rg7xaDt+2v8_@ep(%pE;D$aX$4$)<2ZV77c*Cx`n+yKwpsKw@}+; zFKXZL2jq7o{}c3sY@+lVu4rS$mc%IeT^~-aUk`#~tx>Ptiz>{|BcMj{hC++kId9{X?+9!x&@h z*jC{g@PFsn`U=?OflA^r{a78m2k*<|b)@+AZt62_ue4o%jJq6f#5e92Y2e$nY!${x zA9uN~>{>Rp6m!1w6vq7!@(rFJIL4gv0~tH+ow|1SfeWVXzVDKCJdW&lUBt&^o07Hv z-t*S)#&fCt&v~ZrPIIO0AMav3#%u=;&z$yCp66Gx_kec~#h%$pI=??XfIWQkM~TN` z*hl7AP^`}LbS&)J?0R9}6D~duGG0BF#umvK3qRcv6!VIFwi|KyBh{q2U z`6i74S3}0E^fmgV@^%MyHz(cHksxyt$BcL@rcG-vA(OVOhNQZi?6ue|FQ8NOiLjEAGoZhhdH>u!ASybE6(`;#$y3nxyReXP6upZ=%6H)HC~2X|li z?5of2jSYTn+ga@eb$9*te&78a+mC+r?hpU|ScNuu{S||=-hA?@XzY{sUw`)L%;;Z_ zZvVlgUoJ`g&27`#>JDt&c=doO!@iL}x_Q8m^Vg0Ydi{_;e0%HtPru&houQvT`J2ZA zvDK$f7!6*7cZ^pU$NoYE!W<9MQK&psdw_uE4u&b2|4AVlGl9e z{+^vXvfpbJH{Ef;^SjPk`^xe5yRK==-*@0xVM+D*m)(DO#q!60{>oTi>>F>Kzagjf z<^jb&9CQ8UL)Ck4|L#ws_s;my*A|R_dhpDK(w|%FMR1&m;Tq8-}GriZx6iv@$`#7*)_cCooB|+2^W35 z?_lAYIfH@)-0cLsmu zk#9cfRnE#AQuo2S?#dg#yzL*p!(0B{{$pm1r|Bg=3TycBpC4Ov-jbJQy@;rV1pbh+ z?(9_?FZ2(%_B|^9uzumOzS(upRD5#J%F9-L@ZAj~J*x+NdgxEn|9GHaLS<)YW#`Y; zE9V#Py0Ed3fjg zkH7n~`Ul?rcI=J2-u&zLZhCh5?>_qat?yj3-Sx}xxL@2f_Q^#9uUyvu=BBcVzS4V- zY~J?IfzeZK9ebZFx_Q&ve>`~0dq28n;_@YHPvq}NAN#=2-^~8qO@E)`-jF`5a@e)^ zd^3Oe+UriEIwxKHZ+=E^=-0pKhrj#Y4?gL)HTAi9wBFl3Uu(VZlb5n;7CxQ*!RU@1 zYhJ59_U7*vp0j+NWU4ykr?%=Bia!7fe1U<-DNxPh)P)zAH8F?;jpc zy<*-^zW?BwF~Rn`&dSZ{lJ%0^7r5{6^uNC4#Wk7J-u>E32e-a8cIb(jFJ1ohiPy*f zy>r^ni=6cye{R;U*tnA~J~wmW8%O@!@~0WTyGQ@6arKlx+_v=1AAW#$WgbWwXRT9- z-`g~V3-K?og_ajKw$@o`31P=O^VvClbMyN3A24uG{uzUZ3@wPO(*u9uu;DmbNdB2f z9}C%8J|#XD77k+V=O2a5mms#R{NrXHDDz{YVBC@k!eIgbK#&CGJW^Olf^q`uvSo=@ zZu+3E4w&E0<`T#@nRUonMbftm0If*y9BfVL<6<`s^kHj4pNqvEY!aL$P@l~rTXlKp z)dC4x+Vjfxq;Rl_3dSv2PqG!AMPUmiXp!uWmrUuN?cM!Z36`Zp0 zkF4Ti<9i)siiB{?O$jy|%GPuUaEpoRNf}A6G6XM>pp-(BenGD_l(jK6C1@42ut!1X z2u1@Q=z?yJNC|gKUZP#$>@~A~RyLaIrvYY<0#6caH|D(d9C8;6w2P9}-N) z&1tjsg0e;2Rkp?*lLZ+Kf%L{?;TDrKBPOkIj?tmDH8EM3WFqThvQTa!8)C9xc71I_ zFS_0!RCv-*W&Oq&6N2RcX>9$5lEE=ql$xrHcpV?7RpfY&w?-{lkRgqSJXv_usuEOFaE}fp zYOrzvAOJ{EN~1`!FeXb-Kz;u+X^6so6!^p)(m9S)$cV`u8;7Ni3 ztMg48V?I%uCGHrBDgnwK=!^ns+??V|1x2c^upTv%%3DUp5HA2{E3(RGXhn*Y{r``z zkwtvMEdTK}VTkxx@^ARs-G+7N-z&h?B94EyO@=9G!L9^?dY`yF>ej0x97*s!fzsoa zkZ#*DfX7#+7EF3eD17orv*K|}LY%K8W#rR=Gk)TZOd153BGGzwR z8tH2kA-#}@y9GgI9UEh^P$f(ODBI-EEJhYZ%h{En8=Kn zEHs%&rDhG)-C*hW~L;_UkZhj=xd5B$=ncAN`f*u`)rGk%$zMrv}}U} zEr`j|NTCN9C1`E2_p8)EL(oDA$~N>>N|uUDMhRM5?0Fw9>NC@-l@gR~P>YpDAEhZ3 zRw+Sii$&Sf_*|VDXp4EsN#w}UT$_0nQE|Z|CQ%LG$wiS|X$(=Wj+9mj?u?TO@ z?$P(8$I2%3EnSsRM|P4QV#?NK(>m);(V84i&T8~m0M2g9)?_;htJ@;nLbd|bXO|L+ zmlFE_C8a)ImmVjTw2Q^=7EcpB(Fa2m?lzH%k%m2FB3&_Ac+y0wFnGutPTTNtUOcvz) zMmMu!varkKWHDKI$VB#u$$}*;^c;+K2|LROhM*?A&bT=viBUyVRalL|D}ZEGq-wp0 zG*aZn0>Hv6LAmJZ36w0E!P{7&2jh(;`t(9WosluQEF*i8pedzC(?}^*0C8R_B=w8`4&+Lvp7#!OFCUICU(4( zP`s2LCw9D)sN4^my7c()@V`fji}_;GMsljS*o83(OD7~g`5;&xd(i`730JAQpY}%9a-zpfM z5qB5cF|D_C%(2_ylWpE&=(xkzlN=`cEsuG6HSs=IB^lMq4eiFqB-|iyc)szN01ug{ zY)$XQU~wm(lra6ig+4A;8k2CFfh&ti_!a|qZcM`W8MyOe5`NymmB%Ffwt+i8CSkA0 z9Jn6{SjJWI16?cg+Zk4+HO!vZ$p|mS^dbj}mlBDW5;3*VA*U|#(E=0w?8RFSpQDP@ zqDTP9*Ccq3KI)eti|^U>e~iakIS>*G~R1N3fCcU+r^zUSYW(mAj2^j z4+#d@oX#ka#?5J2N$?2(>7E2-moUl=g4!(ZD*Nij*fXN=ycH>6`O0Fdf8&B0Pq7S37Udy;|2Hn7-^Cr_%aEa77EW7)MkSV|DKHg*>0j_^Us^8 z-wV*}YFJ>5TQVDtH>7+?f~H0_^98lp;Hrt&sOCOFect4X*QiDijhj=W!Gf~OkP?xC z&3^Sb%L_&A`QonUgj+>Pnvox5$ifaAYqu!LHaV-n88@fy4+)C2Knh#UvQH`bJqAcA zagG2GE+lxjf$H^?pJh~8AVE_~kB3@Pmvam$3neIB0>6UX7?TBQV(dqDiYl@-m0jEO zn?JHWp8zn8B`D?e;)M+u#ien%J~ed z*u{nv-pHIhr-ow~@S;da4*qXo$- z@6IZPf^fIE_iBboVZC-R=?9jueXkJG3ms*1rg01hli@;TTQ|n41Y@(fbEItNAuCeA z#?5IJNswM;aWE<8GdP%>QwZD=lv?#7tCzZ5EC4u|1WhTQ!%Z*q34x}R&*7$DDvy)W zYd3w;=+QC(88_#E6bgzQZ+&^#BCxUty>i|~qLNgz*Exu6ZL1J~*6@asD99;?HyV0g z21Feu*GWtZ2}%d)g?lv!F^5fkSWFh)6G%ib2_CcZ$%5NB!mZ5~;6QQb)|5YAc;1SX z1$o?nMkIL1$|no&2_*Om#UqH3;*PFMFhd+Z@OEXPTp+=>UVuAHlsvELcI$oPRb^q4 zrXx|cS%CP{fc(SxWMR8Nf^Vk)?=w;7r07*T#GP05dUa%>xTESM0alr))dK7?QBMl+ zX>o@%B_<2c8+^4A{JnviFTukGs&;;=uEt_<=hAeP`R$xaw+Pa$;?6rH3rmfWs%sEn zhjm0{VX-lM^)&*NFOwl-xLcqWi(vt(Lx6{kL8+IACX0n-5eub}Z?PI%7NqU)>(X-^ z9S6$nunsx9Eqi#kV1zG9-N>TS_k`D_g*#!~a`MrUe^L?>hqP_aXd$_`_67Wbsl zF2NulQlJy^!KYLM&CADhhYgF@?GT#C!!a06YLaI-Zg{)^CmE>461>~6c=$;Hn#K*s z8#mljS9S=q$$^JPa@5SWBD><+ip00oW5#lyQ0B0>!}!h!2h?_gdc4|;Lm`b2#LwkKIWp;e8z z_j;jscBgly{Cu^XR_a|_pRZPf@L#za_O7kZSIas5G5UqEZbty%Naqyb$ezabc@fm! zHiBEjdjgaTb}!b1FGk8Chc3N3)QNApCcXnTJ(aF@AbTpt$9VO zXe~P?3xf@0FB0ITVwIE`QZF7O9~1I3L{&G-#&4N>GSEoDU3%JDN{(`7R<5RIWe+$b zD@VBue=f!~7RbIH-@tEPG)T=lH~l>A>_M}0FT~&5QztPsYj!T7@UO9G%r!u#&(6g^ z%rc3&2AV|=iWX`L)uejF>P-`c9IRBSLzI$SYHxA+676#Q$&56}9asXkbfR1~K;p3! z5jHcOYsXj?wNIEn)D!{PY2YB4IT{jl zOi#Z6oWuG9#|?qPaLxc=1pcWhHqv5sQtV8<^{-zvhjOUC zsHsuS5{tt6*pd#6O`!2J2YaGbqORj4IsW)dNi<~mcN-1S>7^8@iwg9A_YuCrlbH;s zvm0fRSTME}d9l(+c;$6Z7iJ7!`W^(JTqvJU8#K+;IiIt>>B&V?n%cQzBQL+@DbULu zdihhd9|EdFbyvnzD}Zws|yAHi@8s`F8*c%1;phMM=@p+?~iW{zR1YtUR5n zj7`ba@n-;&aW=kC+_5n>(SR-_R{Z;E`X?JVSazpwiRKitBun=|C;BK|DShzItYK;b zkue%yyfmFk^XTg<_@ary>Lk!AfsFvNx8X~EQl*lFASIMz?g6HmZ;`P=Cg=wxE3#pzm&HEfgq&{Ska}MEWdbKq5#=_Xoh-!6APCcb) zX`UMkN9=Uzu4%ejA)D(v2?9JuU)8L3{YUlh|e*pbDT*GnetJIFg zt^c|B8qlH4#EqL`Apn-ToW8|}i>el)R)fGrZ29>7oC0ugw$qBsN>d5ap@*mLxgy;7i8Cs*_`U2k0jyOLO7qyoMYgb+#Nu` zXJFKrswmvuSI2V7_8dzgX`MmFkJQ1PuPktV72gXLU%qk~1=M_Hk$$UGF%j~W`Ra{$ zTVjy4Rj|9Ru4lg*@e!bn9s#MY6p>AT@ zX{zacU}w;pi_nIc@8%Ql547}NuB3`BDDoowYs9SJ4O*-eoztrnqQJZ5@N#%v9$@Ybx!PC)X7E* zb|`gnI9Vl)aox#|%1R~Mu-h$4$njhy^>;Xf9iC*`${i|&n7sK&5CK-m~-c1W~fO$QW`0>;A>r6DggmZ zp;W@%Y$Ou8hDW7_M-{H2A#xHINeed@8Mjb#kyxlX^)w5$ZZn#qgx47(DU&FORUdlx&TV3|;+I5aje3gqgJ9T{zbe$h| zfohK%`lidwR=H9544-JWpJ>T`?KD zn0(?4`ZDHH8+ELa5^6qMD1qhxCD0t86dF|-qa>OGltJ@snwOrDXv(Kk=W`sfBY5Ca z-f^X;DWNNXPE!^}aLZ_?FZ@gOEaL|H`WC+MKV$bu;C?DP47|{F4GcVA-Gb?Nragtz zNef(?iNUo6bse3fjR)@vZ8SJQ8x0Q7R)aTAn+*=oPJ{0{c9FB?~=%u~nH7#@L{Fb$YlK=zEYDWcH_Dl;WYkaDd$L76Wg(sqKffS10?b)A42 zL|j|Brf1qW81pf~us^X)H#7WL>~fRCE;l*sa_^(`LR!n)1;l%VLQaCYl+nt!X?M|#X z=q@*%r;$hTkD|KCsm-$6ZFhQ&(~Y$y)lCOr=HPm{c(a_s%acg9a*5kKc013V+Z+2? z4(iUb)ZpiIyuSV9%VuGl?FZS%cp;B-3lQfh+I4Q!6iVwgjW&N7Gfm$~;NteVzd?w~g~MyJs+8cmLJRE|y|?@qg8bXvJMb97o9 z=+DF&bKBD@K+Yq}h=4Ob;}xr`*WfHa#Nd)=y4*m{BbKJK|J8`Mx_9 zCtumI?*YMq2LSZ{IeqP?uRqe)EBLb1`IbAAYf5!EkhBgzakY5%!wy^hn48+P<^8;D zvrQqIR(|d7lcv;AudsqAjuKd>t#N`5Id058-Qks$+vfA;qWw0t-AL!syqk0$&4B_5 z7>CnSC5BF^IS-vwbD)RQ>dACyVe2uCu|lWKO17@98c4+_Gv1_8Am@{ zqwo2ytqF|hpqn%C5H||Gm{OqG<79zmkCTNC`Y_ENCx>hHI5|SI$H|eLuDNeyH)H8W zgGE{j9>SRZau#pEET64WNY_(|>GZgWf6VzYQS06Oh_e=@d<*o%kE~_7$lWL?jdbSE z2b+%gIY7t!9Qcg{=(wL_=*XV~bnMS_J39F10G<6$rnCQehoCe6e`9=2ji2Ef)1v{d zgzZTH$6P2$^hAJTKK}!O$@D>fLeX*PW3Lk>}$8lZkczMILFz zV)G(jqxHq+B~H-cKl6~I!+&wdU}+uxt7UQe8(#r*{NFiVUz}d$b#?d^E>nkJ=I|sa z!jyp;GY(C(vBl)zdR8)r`=-!t4xbr%3v>A_(BVrpQ=@s@+jabWJ`;3!0mthtFXDA| zxRN)ZYk{{{^j6ncTU}#mb*-hTqtV}ZmLm^W)) zWns~%!car7sjhHkxTQ4`Z7M98Fn0XdlER{fhLw$Dnp>jF!lAapNt5tzcZF)FjvpVM zFm>wq(ojjsl-en^Apq5rLc!qV;FR&f@PyDPHsjoJtD-H-$JGa08lz2XqOF0NU|Vq9 zKkmKvaMyLOe`DWkkKFv)&u)7Cj=RQ97(W63my93RSRJluYiJ$U5UFknwyaqi47ZLA zLC{hXwA3zWX}qANQqa=s_DDlbK!^)Kfhm*5tSk+(ruN1_Te!8Yl|`D`*v!gm*51?_ zscQ@e`d`a0im{*KvT3S6b^)n{7Y;>h!qn+jMz+IM9f9NGUc$d*X#$ld z@KSxSp_Xb?uYpT3qeRtY*GQdE%bI5HfvgctU@A1Xx3Oq@8{H&dT`gRzvArR%IskR? zx0!;hnzaO3OSQpbiVAVBV;Ir8wtChIi@}(Ym4Rq&EpDudwct+>;9n73jiHhan6=?Z z39#@0))e9*>|WK{))EdjLM!}(RN!b#V68|Y#>tyNIvg+D(iCh6kRiZNV`7u<#Mvq!bi`Figwux_k;5ih$D(fuuo%ly z8@e?Nr=k$W7FNLT*RaY8wv4smUvgN&+QN;^thpt;GN4=AoRJOT+O{ZG62`}=m9D@;V<@ezOzwt9@s${3RUUDtQ$_>pK!35O5g{LIf7Qh2lbyPofOxt!HH ziP5uER+TZN>Sot1?yq~k;r(XXtr_3Sx-I+LeQ(eEZvXF)9Fo0D@Y7RFwkTuBc;dg^ z``xtfWN`Y^g5E}Vw8iOPH|gCy(B*He=rM&MU(~0*7x6c2&7)P)sa)Wa)serIlgF{t zmu69?6tLA^BTQ1Aa}l1?zghP z+xI(pe9M&~&i@Y)-%=+Z#)Na~2R@~O_io}njm#>+_e?@QQzrS=cEP(e6@?yrVr_pK zi|f!cMN$5ll}R`1CL#X)v@2QW7Oh7P*IKiDTvMXCFcM4H-HkD;1N`3m)KXeUH372!5XTF7YSN74vW1REOK z)-?PX#fiEP7x;uWY3oBJzFYzwv;m8rAS7X^2B(lo)9mUinO-X)P!px zfxCFB7(cw&@}{b2T3SC%aTVpd+!!2YAsz)WH7!@u=4#63IO?aos@l3qQ`EkXxV(CHu=Gu`+l6LPVnNz&!Ryd^&jiJhqY9XdZ*jl=GmnFZJl4s^r+XU zz-D(;Xu~hjGB4G%4g7niM?JOPujP2u8`Mo&AMb-&j=JU%kNN?SeLU*dRli4lYyBpV zdW*Wrd%iZ{Qmvl{;{3SH`KgxvsMc?`mcB*nH>*NR->juxqorS>WzVV5&QRO^n&$DV zZ>--$t^YuE)hn|rv|*QOnKQLfbG6J_{QDBE??P?VOf6GQ^=o}+YT4?VO@zvxrLOfa zsL%@L{dD%6*|X=)me;I`IkPHe&8fJA?j03#Aalyb3Xl3EDfu(ikD6NF`7l%+Ky?s= zR#a%&;L_AE6rZCpkNQXGG{B?Y&M)F<5UCsAOt zHe$0j6g7%Hmrw)LgBbvY5`}ZQ9B7NXy4t@GU0n&0YF`XY!X80j1v-SzSmmKRmufS( z*uq&AFsh*>#4W&ps%?HU?vJ3a;!#h+xE^&gTrtj7uhGa=)$R?%ant%ov^M(GkFxNl10NvxCm+XjAT!Y?=iLiDaeC%>)aTav)%!K? zy#&Bx)rU22xpvkD5I3QCX+;IRX*OJ`qT&+me2?FQUSZJ5!_UI-^s_Q(=Yvg9J)6yn zJ>oTT>U2z_C)bh>sgG)#NWVm?Q&%*P`jZXdzJ5Js;gcF>u=*$}#u@RjZp0>Z2u9z# z7Wc^>^#zzQOU>|WqtyN|1LUQ8HftG|dep6J;p`Zf&O~i z)=i#xS-YAizgJ`HS7HH+rql|{ILMxlCmE#+T)0O&pwrCg5@~FFLPI}ar zFkAyY@6)_Y^~`boMahM8p5^+z(nm|3t7#i4?r4{g9lobmI0X6muG^J4$}91E1%oMJ|8t%y|oDFMxT$ zkgsO@v7k_qhG&I;0THmmS0qD5e(K6_OulQpik6+GX7Dxp5%t|wXz&iN_psUztB^V!L0bJ4 zgTq{kSD<0H%!Rnax?|_^S%hW&XB)vdSDUIn#x`kZ!1KrQ*@h+E=jT|z1v?c5$??Av zmOa9nejWOW;$2=I@N?8fxU1(p05MtS15fc!wf8(WP@+Yej%>5&99XMIGs|b7@;Lrwp)c3uZS49;5 zbJQcWlEC@YPg0ObkSiZgfu9Y+66;3>L@C~UwD;gf|K`~h^q*F!J_RpIRrdjVRUv9r1eJzq|K?= zS226DItnQuGM^7%hyEV56Y(`wo%0B9L|0QNtIY$!)DLn#QyD5y?=1o{)pL;ys zLCpTzHzTYZRz5gN8b3v8;s4hCf&=6MKHe{6-;Z?1OE zC464zVtCG=pn_zjKO|#2qh75CgZQoE-Dx}@Pj{Vz&ODE{(a-~Fuw{<=tE;eqQunzY z(NgD#BATbTTp23I0SqYW8FtOCz0eUIj$RS;nUh9K2$kye6T-i0p8rTFE& zeJ_4WZz}`FN<(Y!xAE3G)6v?IHg3?{(?Kh)fYo_hMP^%|n{6Fl&pUqIYHZ0o>aCRA zcS9I97~cZy_iw^a?*9PzF=Wx>?{SV3V^{eBkId2t1wNyk$j zLCAg(62#Pc7MU$gEsEq13v{MufyZ0!nO}i*VGfyuJ3uMK{t^;#2=G)E#z1J&7mkIN zr7~HhO#359c!fImuJEhB&+@CdLyN5c$KKljR#99J-@A8nLlOccA$*E(L6q+hAV^S< zpr{Z~1EOL}O+pe#B#;QfA|gaU1w{p=7A*?4Q~}Xa#R?QHR@&NXE&jEZR-ZOh+ET%a ziWdChJ!j^e-E+^qYiRBNeV+Gy{sY;a`R$oAXU=@=-o1BsK*^)ltiPdI_gl06(R#^c zt_M%r7K)1Ie2|ft+A7{J| zDqy^w=C#5TBMc}QlRTEt9fub$+D{bk2~D;aB-FTjk#eRUV?M9Bp-(xe0PlJs1q;f7k{* zy41`nkQb(%W`n-A zM%z6bP5+UZ%kX1=8~pgc8~XX5>TnKuBn$e$A58Q=HCB0~{vZp6EqsE8j~lJLA7m95 z+orh6Z;Ao<$z}UoXpnmrLVeCk^`zxINz7K~W>oL4vVd!C`4+4ep_)Zqi6kzLpb#S;1 zq*0G))HPP+ds)yV{c}=Rz;(_{aAeKG;ul_0bwKVbNX1U}aAkqP`-qaPkm zRiVz*_dG@6DNn;kCGg!wPf-HD&G69)e3IekC-8xWUy#7RF!qm0;BOj!VFI^{SzMIB z&o}ZHC-93+x$px-6>3a<$0`aBOBy~df&a+pDNf)w8$LdPPcZzF1m4H+OB48UV}D5k z|E=NXsinAMcNu-DhO!`BRl z=j~L;1MWIv9>y;jA(Voh^dnpgsHsmgT+EZip9DKyN6eGNZ!%oWlf?0rSgw7D$mnNJ zooTq3KgpgeO}XN{Kzecv7v}}yn@zdmyg;D1(<2Kv`$6Y6wZ@DDT z@L;}W-UhxSbe&+n-9vh=0fnv;%&SGj|73VD&#WSjzjAh+V4h_C`;7izp5&f!x8b8H zw__iLgjAlGJ1-9&M|x!pX*%c^D>IT8`ppb^D5he<+#q61o>YXJr^Z#1Rj1PoFsU`17&eX zz2NB+#S_OV3V7g$WWjS1&o5Sh53RgTJty({)AACT z-H&_DBtI@Ao|AapcmU2vI7jQS8m8c6{K*jcC*gdQ;{@{wzeD;lxK79s^TrV>=$nT3 z^ownx*ma;k$3A#t$jih(G5Ujf%=~T*j{V;7vq;KuHd1VW(G&Bz{aoib?*Pehf_W0M zoA5ougZY+uBlsaloOjqKKY{aI4zvsho}rc)J;6L?enSTA8e?a09cX?(2pks%$Z;}R zjr|=Wq{<8r&R={bx6zafCr=9O5nNI)2mWzrpvZGZ4_ocPk40@rH+q8ei23ax9QrBz z<%shUb9@z4poNsc4%8&&_&W1s@{tfdTcEv?$zKq{*)yG?oF4?{_&QDl{zJjJrpTo{ zx0}`zqrAgF{(hmSC&ddDFC*R-IQtk;CGqx(Zx`~@D2}@winC946YmFlr2HPmS$?n3 zGmql9dy(SpK#$}+&d~k}A^$qXyDGk)ILcoyJ@pD*}2 z!EX?JgWwAU=ilC9eWm?7NFKSgf4AV${yl*+{b>zPU%^=zUz z?lw|fw+qW4m;Gw1keB^xo8Yov$@x?EtGy(z+gHwevRt0`P+pe1Pw0{5@_dN$vfK%9 zp2DEdFD1maKY3jm?axM`N4CodtKR5mA0lG^;$emP$)7hKL)tArjYzeaE=-%-pbavT+ic|-CYDOQng-`&J@ z`|c&K+xLjjBionEgtsX;&J&z~{a0xh+0SF76a6Xsc~9clE>d2$i3%XbL=Rt|=yErK z9T?&kL1;%l%6@{%_YNB=x5=1e+ z-!1gW{QMEItk3lnFa0QXF}?;Cn*&hk{oM`3lI70rg1!YzXf_*FReR_aXcRy57+8`1_n> zMN{)To7HSz4B^?Wtq|&$@?Q(#1GAFLZx;MoQSJvJ{M_t7 zkCa~)!mn
dq|Yel&i<_7YTKNG_H(2WB0gOvY{;IoAOjP`+k$xA}`?hqd7kX+Aw zA-qG!-k-mV%Liohq$>q0% zaIa5t`EP~rUVW3x&kEshhwv`_0zLIMYPQot_@)rvv43(s*M#tALipz)eC&Ya`fm*3 zPlWKdLwNhV!!ru{muJA*CL7-pq8D}Tw*9=R}kB0Cc z7bchQH9R?gIfVB2;UXLQ_fAUrzC{02;n~o;U9(Ye)NS9o@b?>%R~6LL-?;l zc>j^f>oq5Y?+D@VhVUWhCD&ga!XFOdheLSRQOWgB4&kX*+=+lc*H9dHnS$RZc#h&% zP?|13jh=4{`OZrIAxhKf(a3)b7=I5Lj2D| zEMR-FzNlvj>8TX*$T!gE`3A*D5MQP^{|=0O$oj7*{Tr41`VOVpD!~{qAZqyNa3Xbv{Nj_ikL1gC$!BNj%(o-Zj>bZ~P zCkT%6Kco4gL~xXUkmRQ-K7;%(?>o%}`Pb861EHSec^<2`*jXj?;J7HF`%Usb73w)g za<2$^w5NjX!ROR4p#M=%J?S|lIM(Ykn%_TGJVu;flgaH{OFW14F@KWyX^M}fdAv7q zuJ1u=uc3-p6TedFd4}|qDtVZ~ul7ZdpV zP_EZh;+?2`_Rrl^ZV$z;CO(Kb>)FTsP|0tj^Gc24J&Dgz{958SD*hMZ{QFq8vmc#T z?o{$+#P3u5e&XLF&i40jVg0jB@ncl4*MuJIpBu=(Zwik6c>&2ER(h&Qe>#mbE|+<4 z#W#}tP~u$Qx5@tDf@8VksN8W%&oR<-tB}WW)Sk|-Ym|J9#`~*EegeriDfvRWU-?A{ zKb`s)*LN(*k5v31mHQ3Fo4{5K*DB8QJ3fztf%Rw6ys%91{=`=+&cEAuNb$Ew9-jk} z`eW4YO^Ro7ds92GJ^VXw{(hGE%Or2#4-nXYi2PWs^wd&$cPP$sk1L)+?at$p%RNH; zLnWU^{?Dc3EMGu;sN(a9+voZN`}upC#Y%n*wfh5#mk{4c9Q!%;=MSyhojr>GllZTN zp6iL>?rkOiDII%9aeR&l!~2S#PW%g@|3)inwjHV7Y$rbdjG>$2-HD&2IDUVHVF+>b z^FoWvmcJil{pXVWI3a(Nke{UVk0SX}A-_n-S1b7oNPeD>Uo7MoDfx>@{thAkO(DNV z$&V-bhlTunA-_e*UqBa?{2nELIm!Q8$S)A`Zz%bzNd9dhKTpW>_lfL(zD|l# zKgITH5c2Jav;4KBzlV^&S;(KS$fG0O9Zl7F7$pAzzS3;nMs`QMWKn?n8;A^)+G=j%T&!wRAQZx!+# ziL-w`CH-d#d1-&1l5a`#`ME+~+CN6g^Y8N}3i;cFJzrDu{Yn1}A-`P6*DLuEB!82T zUm@ggRq|Jn{Jlc{b|Jq`$yby7W+8uvkbh3e-$3#&3Hen*{;x`Y1<8LXSjgk`DhK&Jav4CH#+~bgJYGLcrg9f3&h?ew zJD0O^*gqiTvD|TV>`~%qC(36L-=XAp5dXQ7j}d=c@h-%VE1pk0yOoWwKdY!-ofYTb zp`N8UUw;l(d?D#MPjSAlQml9*$zQ4X65{p5(La@BJMI=K`Sa*H_IAP1&xa|`U4mmf za(g`>ILdz=%E9oE;3&`c!L|sF@=ufe6M~~W--p>HILcp4*Wu3zj`F?ey7^avqx=Gr ze?@SVXMg^YIQwTM95bP{-C_Hp9(=zKhIGYWC7z@BkIDb1DV|IAoJAbVt+J}kwm`_E zomWu16bX*@JVAQK2#)gHE+vAad<)VuS#Xr+b}17a#cA2YqU-JKA!BNl4 zq-Uw%sE6C@ZoyH07wNfIaFpl!kn06UdH!AI_XJ1zJks+6!BPHc`uy;e;3&`i;U|Kl ze0!S6UJxAR`F`MU6zBVOZxHA99Yg)(Z6S~MD>xhx9Lv3*{PszRo(^qnPS#&WiiRuB z&l^l6&hr)DuenBX?hn^0&h37^;#;YoFH!u5#P3pk7x4!a{|WI&6zAXTKdJZ|B>x(5 z^uu)W0q*`PAzU<3B<2ZdWx)Cr(W?g z;&%#OO$>M65&Cg{;QK<43Xc8on`HlEf}=do+s_D&@_R`B$AY8$7u5fMAvntO`ROIW zQ9gyv7k^NE2+fm!6&&?UqIu^X!BG#-+aC*#^1Y~?J`o({d0x$+FZ{5*&~N;l^O?kX zUb62+1%D_$jO-jO^wfYJ4wotU6*PZdtvLI6hT`ncd5W{&ZXu5LW4Yu`=lgK%4#~eJILfpAe-a$!hfsUGEjY?^y*^N!`@#GnD); z^8a;;v!53$&i=eparWDT#L<2%m;1xBg4eP!u-_;2+zaWKDE)iIN76+0XT^U&{IKHP z+u1^n6GwZnT>ktLrF_i$TXCliac;-AX+G(qIQyr!;{3g8f#U49BE{KnlZc}|v&a_Q zl_~jGsJ&_hzZc~0rTW$jF2~D4!BIZa9<{@BNrIz1+rLt9lpjm-s{}`R{@k%naFpLp z@*4z4dHx=MtKcaA3CV909Oc<>y9G!2yE?!I!XCjBS4Cf1uFSfz0Jq-49_Q>1xNXfB;QqV^be2IzJjCtJ0zbcILh-lJx6eq zAJP>z5Y7`E<@x*BV!=^iJE~9(Y&rb;LhbJks6DJ2YSN{Ih|^ zT~u(?e_0PJpDy@)fOvlEB>1<0Z?ob~55ZB-FevyJ?}TJal+ZxbB#?;|}=3yymJLh?HWm;U*g;3)s$nXrNIOTkfo2KB?= z3Xbx_&q8T<-=^Rw&)1)SC(iw(iTY0(odJYb-HNXvK3efE zRPLpUA1D5G#T}Xts|2qj-ME`iobCS$*?F_#GkV!fw=4d8;`b^(uD6w6r}%e?e_!!W zi9ezEoqepHXB6+&*YZ7zR}ufE;%^dvlQ{Yx{V?CEaWd(=&3r%ck%})T{td+s5nmuU zw=Eu8P8|J={pu5HmoY(A9}*np`8;((@wusR5JI%G z-E+VFi1efjj(Ye!(oS$Jw{@P)-$`(kucC2urs8}(*`GM}6Kvm&R*f@U$m2YgMfX?F z7aYrdbAZh-UhzkWPgZ;`@oy+zM0_T3wx^ctSuXf>#Blc=rDrtxVWZ;Ph(E4)kAYU% zj})&a{u9NYApWA_$B4hG_&NDj{~r{eMf?bHtS{D!$Jpto*?i0!ZPGbM@HxbAcL{Os zKi?(&S1O)8$Yv^4d@1p2#eYfsI>p-zwt5yQeg*NRihqarO2rQl|CZvpL#+OX6fY(I zsN!ph?<9_Xn*%ButQzMX#g`FpL7zW(9?PTglB+n+S24wTUh1zn&p(BVUqSlED9-aw ziQ+uZOjVrclWN6FNq>XlJa05A&hx`c#d&_XU-3&x|MwNICH|!1?6>C>XaD?4arVy} zinD+ItT_AUABwYoK2e3zRxMnetTW< zH%b1@5Pnec-;n%K#rgBm7m9yK@-6A}DBI8WbWohXzdJ*5{{C*D;_Od;9+~y?_jDI4 zdH$a6a>e=kzEZ{c`@vepThsN}4T^KUZc&`;wOVnm*Mo|4y*4Y(^?F)yuGjO5bG?48 zIM?eBiua*7t+yXY!N(D3(vFN5a=1@N~7XyNuJAR`!^C_ zrQ|meXS-OQ@4sym^0Oh%`FAMJp9l9SK9=T_7ZsmCe4pZcziz+cjU?Zs_)6l36kkRB zsN(C0A6J~mi$nfEKVW_N_a|wJ$7r76`wc9=f%NuP@?8IX#a||QeD4ni)^p4zog&5A z?y-u$PHDc+!FrAmuU7Ia>H5E3@m0j=eVPa=Mq1zco*XQxeE2yLmTou(~=g?jjNQ<2a!7kDPwF;?*`;{1CS)Q|EViBD1T{fXBrK7!hDzT!Mi8x`kq zw_Ndk+#eL@=Y}>ZzBkP}Vw>Xq>GvBu6zAWU?-TqQtHNyeE6(SOCc)+JR1YbhMY@g( zUMBP(SDepN4%Hj|UoPbN_pQte=vbDJuN3n9zI2pFzK+hDF(HrVK@PnYUq<%j3qGBN zVPB|t105?8T>kEb=XJCPIm?#_dG5=oYKr3gUduAUsT1} zFDib7j_ng1=M4_~6>p*gO@ib73J!-9-$)0J3XY%0IUHB~Wj;WT#dg8@heMj;yiOC3 zn<&W3@taQ>k;`#9M({FL4ttKHe7WF!y@tF}@U0X_F2@nq1GyY8>~G|9T=0C1T=svS zUy;jxUIb|j$Yp;n6I}M&2El7>R*?)O1{4A>uJ`#vSOY~NP}FEcsqMxK|;1@A)TqJG)FzYzURwr?h#w^3fU zFONUuvVHlzsmNvf=F<5JxoqG5g3I>3m(F7-FWdJq!DajYR&d$AS(&!-s7JOh|NaxX zY~QQsM21|p?`wj~_8pZS=$GyLE5T*^I{!E3cYc+E6vOp>%%3 z+|rp8>R72JL1}Ltow%kPXW=*TA zY^a@EirMB?)lN6XhY3{8u9$N}ebW3jvm2`B%r37rioQe+%c-n7H8p{p@(wz|n4vgU zIT^2*K5fw8LUX91Zq}@-*;oaY7d?(`P&#jRP0|{orrFC}~p}2ckJn{XE#%2DL3cr+oH|DnK?hw_#3LYg!#(TB0-1-r04tE2>H> z>gHj~Vlfrf<#U{A6|?H&imRDDy)L>+UnKT z_@Jt~bo!j~S$sU9fw1kSMMZjMQNXUr>~QyE`cT?M6+YKNwWF4M8Hb$V9j4IPf#0<#@rwu50iKW~uP4u|q=O)KU$ z6n=T(FyIP}Mzbw2+ab;8fmsD};TB3YTLXp;GlrS%5VIW&TM#i@1BRY$M9g-G*$zHi z8axOXWH4KEc<4}*!EA?^?O@n~h>6=xfe|s=A!a)mwjg4;_2Q(-L&%*FK_{ARf!Pi* z+rhAfOlC{6lO_-5OoL4(vn>FaY#yy|7!q=%0*^qUb~_m2P>|V@{z;PuaY2JjL1tTE zwnJb$KX0(v4zgRneCRlX@+j-1$@#1!A9b8A@yHN1@e7|u=1}6see6{&%F%mk7euf@je>*KZgsT{XW`rem>0Y!TVC^f64M2 z2${G%&d+Jy|1qTgX{Zze-$${jL|^|tr2ZSI{`|WptUq3gbGh6vra|27E+6kJBrCr+eV*X^HeuyI6;l8FS8NV$KP(^HOqV}6 zr2gwpvHSrc^)E|OKK3zP{%&B&>YtSX2O#i$BAZI|^)qlFng3T&`HjN=xge{{e-K!* z@|`xeM6Fw=ahz&~IkWcJ{M^sb|Lx&Vm+wL0$;wZm@|&yw7oam)`Ms%pS%0)emwymg zvht6$g#!?@Zk_&95*f_5=~dhY>i}Z?@uxSsd|W3dS^50@Me}0nkdnYL$uXB>se@_e!K;ZknHkDZZH{pP` z31wGN`SbCl3jzJ#7yfkp@x6b@U>6snuZ-Oh6oe-|%Jm zwE?>Pi7lGRuQI5l)9Nec$Lo|YwOT8oXn*^!m>=Iq_f_gY|10K?{fqra z_viDW{>TQae#!m!+lq63-rofcigB0*;=(i3|9Sr9gPf1k`1^@u`Tur``R9e???As3 zZ?61L>H1gOfAJ~iZ$a~?&i_ryzlSSIdtLu40VJ#cu>LkfQ8W493(5aY%D<QWaS^E{AGSl8$nqa z-h%O)EdQ81D^(_iA+Gb|I!?**Z#>2P=a5d_|566pg3IjA-|F&z2OwGbm6U&#pVLNk z{0tZv92@UX*I|4_=YIzBC$qotsLj!PsNJLe zm%^X6|B{gMkFU1*VoJF#e{4wko6fY7N9l7smS2*j{I65_)Lgbu*mlH+Ss*+N<3k26 zpZC{61mimY&UH4|l`=ELIUnyo2&sP?{9v9Wa6UdXKIHt7Mfv%6NG#9(=k!G({cr6+ zTT&Ahi2l0*{y0Bh*Plb>vp(LxxZcJV;fH<^wEaUv%AY?dvHYt*k1ikAjRhAbgt0%e z=y;ahqqep1r}M-2D6?zwD)Q}8k7diRM{)WSE2vFoem%&n=L9UC+_FF$Wktaokg^|J=l z&#Ak%s-huQPypY2R7@Y1pIlckO?JtG-Dj-z9v91YZE?;h;62Qo1)tC9%qBqTC~u7U5=d z1k?DZhA_2($_z<0)tFb2VSZhiBFfs_*v77>ZNjYgQGUJCvRH1izK#7D!&tjBWuTuD z`u3cP0@1Z&&Gqd;!-fsDz5CSr_FB;hMaG^YryE*y(5dUz=$wETx;+jp0Dn>VOMyQR z{vz<_!k_c_9Y8h3*3Oz;SAX4{xefEK z|K|J~7Tmb-rbUYzZ(g!=*)6x;wtU6ycdWeguDe&QzUSUG-@5PHYwv&HJL?{NX#IwV zzx%z7-+$!MO`Eqow)OERez5I_Pd>H%=^s6_W9P0P?|$~VpX_=5r!VaN+0TFR;xB*o z(#yYoZeG>s?iq>un`ys<_V0MkmZcPj%aapDcQ%e-S-0`# z5iB2RTrz_5c#TU(a2}^|nUKFl$logDZxiy%h5QO3f4h*s!^j`cW|W)^{E-c4pzssFU5t&1~7nZPl{R=|%Una?aiv7$bsBhGfXXOo=~b5{2`-N_kWQ&ZR- zCiOJ8Wy>^3qy7mseG12ejyr(O1ice-iwcWtW)>E^nZ?)UI)yIiOOH8yn!rZX`}vK# zHh)&I3v(E9MbTe;_3t40)1;D&gxGiH$8da zv_Rj}zz%c>bRB4GbsT78^BrhuWe>Dy9Jy&}*W*oIo5!2H*6`N~{xadOCH!T;UpoAy zJ&yhFr01S!@)}3Nc_jCZRA=>{T08IWY41$F7hX^Be5#Y(E*0W zyYc$t&`-8BzJK?KrgMSKa8_gAc?bRs8wTuAXSInBf%xAjJ`nS}miNPa6z_%d6h8yy zDc)_*$fhOBM>L&=`xPUaI^h2H5lwAzf5(WXHn?9oqNyeB?;O$80{3@~X!39m{kFSv zUG2=8!U1jC-+_Ji@o}avwZ#5g41Kp4`q;aX4AXaK&+JnO{d4sw>bu>cuf5Z2%<#X1 z|NGTkTX?uv%J9B5eG8BD8#DY8H}j4sAn(AM*@f4-8AcDvyw@*fc>kKb!hZ}LGyDjQ zkChWzMg)6&{Ej~IhWq2Owd~e8@;jJUBTfPD^d7$$# zx6K{1AU>#OR^isRT?=0sJ+}CXGrAVOKO|-Nz?uPt?+zO?ynm#PuYac7>W(_2zpgO* z^Rm}gmX9soI;3mi(P1gW2hr_K!mOHbTC&&|m*r+UM1;ZGw6n9fkIT{tLzo&jkCqzM#M5LeSr@W?|u` z%exjXhcY%*bS*r5LCSDEHn3(yA&&1pFt&TU8O59Cb}iiGU2}XK^s8=e`r+qYXYy-@ zPZl(Jxu)N7pS=0-$;oMMZ(%j_XZJuQ}ca<_Y{8<)$4T4Yo9SZTrG}vijI%7s4Df2IiUz zV9q%o=AO};Kfm$ko9NuXCKek#>4Jh7{wyaegN$lU9H9@ht}~sh&!qxtPIUvR zj?qU#qnZ$Xv^bykPdT4%dgz%N@O z1&-HxT-$S6p4&14bF=5V3 zZx1_59j8NED63@@Mc`I?E5EXZknCh?3D=OF(Fv^Ow4jV}ZEY!CL><|3JmxsC*j=PU zkhd!u9wfVAg@R-(gNi|ibUz)Ob47f8dS0edE}KhESU2<+nV!3>*Gz}(x?sk1;MPXv(i4cK^Qo90CE2BNt+ndZXR;Lx=A zZLZ^(oQ*-w0NxeAG`PyPp+D^0I($Ga!!7wSTIwG%cOdJs!3H?g33e_2K$&ot=}z>r zmV@?In2LPd`YzbDK7t8j72JHoIEGwM>(+GwSy0s7>?Y!pOBwE@VX!k_Qk@TxEDx?} z@H-ttrf{SJBH6QH6PSiqFK*o(z;dtvTzAt%zRQuvIf7qd7G%1uaz%^HR?tovQbK1QO+xGaqBL?q07>?k1*DEv^Nm0n=onyaVGx2j%49`Rk zi^dtpL{mI$x=z@baIe#rGLlLeiKW;AM=pR|HhSJ-h{BBxkS{{LHhTW8espwF0VC_Q z!>(hSB&8jee40`8byP&9emyAl>#5Mtw$!f&222f#x+XB7*=Q*$v&NR82B*F09}r17 z$JTo=Suogmmp>*rc+up}GIp-T@=nJn2G=CJMpl=Z)VhTr*wusUHj{i1Tc;aFF}M$4 z*3jg4FmKEV{us9yy5m5=;I5CF4rN9}ckH@`Zc5Kc!HY!f#67SJpOF^dgHz$?8DHLs zyJNRC+BT<~4vF0_JFe>`c37t;jzbPTA>!_iT3c{rI%g&snwf5i^^ECnG;Oeo|JjoV z{#(9AyYQTW->jQ6b09o|H>+;;4R!We#esj@y7l0W6@R^N=U;Z+`W_qJrI(NU+J&W)uP(W;v{Z=WldVB! zc*>D=Cp`XFTL)i7`l{hkL0{D5HxFG_G|Yz=f8wzl;H5;Y${eq#gNGO4f!8<)56jJ~ zchCm-!-o{(^w+=x#@E6_@Nrqp6KW2~&S*EMc66 z;Mv-`Y4fH#@a^ify17-(9C%u^20_()cRaXr| zac1hJo|u&Vl>MM%BP_=#teibl{oQdGiNg z&Z*OC;Ne{}6yWhmsI=ez=QY&S=2bf|kz+rmSZ!^?4fXJ(Wi@<;fxwHN!==CgHyX`o z8+9YS+eT8riSpQBH<}K|qL)P7r3nYmbEB;@yo};#W~67UXzRR_gd@>(nLD(^9=i+Eb6d4DK=Yw5d zCKPo^Bu&+7t&3Im?pqwGcB4+JHxUi;9(E)1UGJ{Nks=pR+Cgt%akNva_kpv^nA<9K z+4xlNtwp<_Q16#ew{-7+ImM~o9~Pk*hO~-oa63jj+!AedF?s>2pX&V=NX9OVwz~{m z@}*ul!#k}QT(oR_^o)z5+2gr}15-;(?OLZUGDikZG)d6BUl*+8#%9PO{x&Fs73I#^h{s#l*8>kh6>7 z=0Yui5X&~)Tw%uXRKwxhKovg4NsM0>FOJ#waPaIG9QccoHy5@6gcx3a25<2T4s|f) znrrX?LhP`S&x~W3_%FlF2dlVa<|5fV2^WW*pBi~{)fjhRgeg~CIMPvk?gc%q1Ab2N z7ts?3UBms)bN-Q!O}X%`s|p(-?b=UU<_LQbHMqil=CchC>dPE6dv^B3Xk74;*pC99 z{j3uwYq|N9oP;OV%gQI#%ksqbvOKU~7UGHe#`DDXvU(Exx#fxd-15Z!Y`OVtiqW{> z`EQvFa7$>%WTmbM;g>_!oZ!>Ae@*dCkk1kA!a8p^@eIkABJ%LLZ&n58{lgRB5i@g9V9>S2tT7efqM?iGv__a z$EXDJIUM3F&z#2x%jc6kA7^>yJ?S{h7g3szvpn+xC0{~m{yK-{nR7nYUqbSWc{qCM9G(s zJois7w~Tlh$+I3VSNFqul5bG*Y!CN0*563-vcJ)zokl|==|Oq_J{K_VZ)^|Szf#EK zJhqDTuM#{)aoov%h_~SQ45a%Z`(XoSg247~ApILHHr&6J2W%U0wv+wC{gCx+BR#uG zz8$2cANDFe?6((*vz|Sq=VhTs`fZ=!F^c1EKgHQj_S;*;S^qxL-$Weklzuy+^ss-9 zDm_i4=a|w%N#`@AhyCMFKDOs5rTKjjY(M)Ui;gpA`#UPm_V5?fEYJFDN&Yn0=dqEn zKS-y1y~N#6NG+w9xoxT=OuiP1qMC;@OSvA z|12wFwrLc{n;-I1KuHK+8p3}mxVbA&=^W6D0rgA%^$@->guffYhnVa6MEx^D__`4O z=MdhG+Fjd!so-5~70q^62tOLa$5VTueyQh?5dM!4-W|S3#Gv&|4&e`k@Qdi9o!0YN z2>$_H+G=_Jgoy9m?_o_d+f0fh?(z<)b;MD>oSzpc`CcS{tB{XT9CxcI zj(X&$p~nR8NO9cB@ra!L{wB$=9}1}4cNM>cIM3TyF8drsyU=me)1C6-E>H2XbPVSy z3@m@6O*$75NBwesxLV0SPx8|g&!F^7#V@CHgW~HbeUsw$K8WMos(3$|7w%TPl=xc3 z;WySMJgoR1h;LE670nCV1;_qVO6lE-Uq|Uz6<{xjnC>)62lCyB3A^7eifJX@zY*Y|sh|AF*8p*X+qcc7mZSJTsoc(rvwzMa?t+{=4;CnS{_0_r z;N7AB;q#jqE)X31=b2>pM8#vo%M@pOW(tn_4^g^KaMaKJc!A(3e?batAn-ap>>u{$ z3MKznlD|`M)IW&qT&uXfj|}VX5@)~h4=EoL@@E)J>;~Txh5_wCJD;TV^Ma#1U*qC? z*)XvDLu4mBgA&I((e=b1dC-+n2To$Sr1!)Y}A7r`mbD1oc`y!`76r}(~U^Zh@(TUoss8J=o4 zFFZD{8^+fPSLO}#TNU1Sj4uwZG_Mba_urbRd0DV|O)$O=cz&LFCosR{7iG>JAADIZbVIz3qp8U6niwfL*Ct2Pe98x@n{(1R6Jp5tb1ok!;)vSQ>BgtaAogYX zd4A&zIzL{gB+Jj^o#(r-{CJ;B>qOZdJ#7vi`}mm{<g)3H{uJuOaU{c5a`3sTV{rMr zzY#Je%l|jJIKf|s%fR_~kN2-QF6Bnbix_c0%TA;G%1oz-@~;(nG0OF4{0+#T%ztI) zSc&;0i0y|};{4qICQ|t%=I{1X`TRMM4`}-*gp|KON%?r)sLS64`E}i~tXK@Ua36#! zhvl9He>#8poSO1~<((}5e|+DN9V$t#LYjNuknvrz3o|{MuqFQWfTy4&Ryj?iYJ^gW zZ7c((@$cWgHp25Y=GV0;0*0Zvv5oV!wh8myhnplp%i>pIuq!grB4-HHI?aK14LE5pjfy(& z!+R+vXShYff8`VoONVz+z^}tjV7eIgaGJ|4?&RdaPar3jwsNjp?m3g;L9kVDAAR*o zIOWZPcT22HZ*@nb+wF}}>CXFbpKo$Tv}kyGy0aRlm|R$I>V0@;v0*LKi-u>mf@9gv z>aow(zgB(v{HHS9%q?&#%pKLvc^|%Got%+fv?IM89KWgTHMpM1Ez4}o!S@`DYUR9t zE&QarsijSW-2C)bAUCq)wTxDK{(!ck-MyXkmrCLN35P(=xp{qO%54|hm0My~wW#_{?Ax3Wodskzf z(QhA}Jc(!NHUCN-4nzByI;1<-!M(oFIzWdub?6Q6*Qo*f`?`CE|H?f+48CU>itjUl zdcR)-_BW+CllwxwZa;al0Qjrjpg$}Jdy6B5XJg!j`lGF(2L^qr4jT$G#fkh|s2^!^_lA8Bs8J5F^x;Fvyk*#( z>pI&(=G9Hmx9k`w8eV$3bKRC6&hT+CmnG}h*ndB2iFUnU-rs_K68q-n46CEJn|4Px zH}~*n7!yt2iq2T)521gae8Kwsv$_bp1IB}Q!KA=DVWKcEr8et-oRiI%e%`sRdkbgs zCtjp4*3HgKEuem>P`_y3kG+(>|Ma}R$Dz(Apw3+14N+%k8nnyb;V<1yzhji!>F@^d z@dmIFuG!4|)D!mIfL~zVThpy?4AP&0Jm$l3mgaVWdUZOS24fT6;XXMX%1?**X)q60 zdz~}7xx;3T2A`u%O2fR*Ou)X#`pLqTAliRDk_8>EKX8GqQC!^ko(c2c}PV4)& z*JVp%WYilQK08_PW%Fcru{x%ed9%VM<4c$<IG5pj#`t_z z1n(G3bAoFFf9yivfp@zmjNOl*pL`5`M)nn~Z_roTh4htnhnI@Jat!LV_OH%nc&-`F zd)#L_LZ4}O7<~c1yD@zR$4UqA<;lp|GrRl!1^a=0R~Y*L2FSlWqv*tO=p)t8cVh4k zCiEBfr^eRK3Fs$J$67V!d|6*{OYSD=m5V!M9`@<*`gS>bR@@ME*oEOXS^Hblh zfxOkA19hcAS$Mpg+y3w-GiNRDd@ASia^v3%U@X%3qdD63WWVm#_x-qYGtAjbgMRxq z&fjniv}tL#<0lt8n@_^Lj`fUzop61%6USP&cFuLsrzbCWfWdWBH`jR|-Z|G9ucJ0C zEscBU*3BUI`HkoM*HFf1Fy?R!eh9kpe1YT7Nh>ntl(n~e9Dg6eobIMIPQq~v`OJGc z<=D-2icTD(@w>b;_z!&62z?aGXe2$DpWi*k`v&mwnlIwVv_6NSO?yB$o>y@^!e@=# zxlqOsVAar8cs{uqu6fF!JRB!~ruUmQeQ|Oq+OE$@`kg0WqX}DS53kAM=r%(3HCde6 z9SCxCPn;m94h4c7JrXBK34a%6TK_;1NBL8sHH}jRfgnc<3H@uY`kD|Z;^;CTRd5u# zoeAJFj;D*T-;D@I4y&)`gsPN75ahAcljMZ&a9rQ;FjZinO5zM3i8 zWE4xZnalMH4J(bCA;rnQXYqPY)%xX?=<=)}m&n5hs_Yj<5nUo5XV(ZXZSsq&;OJH# zH8YmC2ZC==lz+Q$3QngS{-fCNVm$T%TVnegr-I@p>f*j~$K*1g%W*U)ZjvtU|A>yc z!T0_Yw(nqoIC_*&ijzO6%X&^7BZ}{AN^@E zRq7pRX|_gLWcC=^+rGr9dcRU7+JRP(eYhg%}@nS$wpXBCc~eN4WsknZZ#m0Hin?lr@8O@jk4qV5XYPQ7!=9bIegL z0B)RdG$;#yrWF^$%BmzO*SUhDTma0%9OVK)ilaeU&5j2)q|7htN{(^?@ZpN1T!8Cb z$P%R7T$l5>)J8fHlxMq6- zbey96(GF&K{!|uJqJ)I}U0BO?1Z4CSr~TTG(JNGT{W1Nk`bd_FT!SGCB$tvL>#&73A7C27(mxcVV8+4YF{wzmF<7 z8u+M^qg=~VxGL^Q3OOq@4oCk5EnJl{-@FozuJTa@N7wkMgrhvP?GWKq@DcQs+nO5z zPVgM%V&SyHQ7!hw~&b?`q?oHz)7lOF*-ZV~fK_tz|t)z^kU#29RLzt__ zdp#5i=s+3mVVH5W!AH$@4%WhB5zl5EZ}in%t!sp0+*I3rvFav@I&_hWVjK_7G~7xo zoG`DjQDr0{s>X)E_~q!DK#Dyal+~;Q>M8fiL@gTwbd;iej}|N<;_r0(uzR?9;Zi%% z70q5(Cu*rq)Y7a&Sqt|(FrTA=d9VnPtxVv(X2&2a4z$cj)Y9xlb`mZ7$*+Me&1&J6 zm`o9SM1*@3KUl* zDn8|znfoowgB%SMS0pNKb^!GxOWD`L?d;i8xU69<%Sao}930=~`{HVf`8z%6SWOv8 z*b5C#Z6pdNvd*Re9i?c{`vfWpF%5C1?&r-tC`GoArpA!B~ z*Pah>Za9Z?R4O|4C9XI(oS-=>6*a%aRg6sH+_pV9RY*snJ=k>KhgB^%$ih+92B!p$ zvSRBtPK^liaxuIQE3RXZg`*RE)a=m6B2lj0DU1U)h${!K;ppU3FPOE&{45hW8km2| zQ$`nG%Os8lS}N(Fze~0>j9f>>3s!(hX#=^UcCD3EUnUAq`L%^*K4BRZh^F}~tweF9 zm2|TT3m$_+hJUOj9%~u8xJqXH;wr6hWtm_#mDVC3u9(t>7m0xf_h|JPSTY4xRiPDV zauU~dX)9Nc$+b(}w2NP}rM+H`wS z;xD*tj9K5N8`&7`)oEN?yEabDu8q^()+HOJv>w8wD6SoIMoY7lPfxp8j#((?-t#-6 z=vl%?#&bq7E?m>g_iYrH>#f+9dlV$%nc6wls_Vz)M5}XIeA+Q}s;t0WG2IymqjZ zP%p?dP*w_Ekxyf%OuuLA zNMtAx_Z$ynEz(k==fghrQsR+I+!k4pac&x>XTx7)JU-O{VIC$XzyXsnni5@r;1)at z!TS;X^v!W%-VZZy{|NkfPnkzYop&(4y`vNPAs&I?J#1t5Oe9=)W*L=$r$@_sxm~W;c19w6q zc#|+rv~JyXz;IwY_+FVTcj9uhn{=<)UH%a4vfsnQ9C9!cnSo`x(19?H1=?se7H6Y1 zSQtf7*ok7LqT7MyVy&WBU%xtgAz{~QiCiCFo$FD1P`htp2|;rHkKiY#?I5!WksDEI zkX(SO+G7nl6hI_$Q?_5>4z{{=Slx~;*4F7HtJ~R~6uBFqdA2XILezRiQ0v=+THk>Z zw$^u`X=VnF+=XV@=$$CwL~-j^zBd$0m46x!1l4;wzVbhculzGu!s-0Jy~xg1rdo3W zc31=(lUji(d^Hw6&gj6i95%8AB8iS!72=qPaZGa0B&)^l_*(3auf?kvMQK8abay6cEFB&^+vp}-iY_r8}YvS-H+pZ_50+`c`I;^>B%@!O~i~< z&opND_t+NPx8_8x8BpzE?lu{EaAW{S3ORBCM=s^a)f}nhNF7AX=vly#TOrazPAe0j zBB0E zAVS8S=LQ9z=i(U_hl~k0QwCO?Zw@-0QqXf0u+J|w9>|KpMG4aA$FUKxv;Ezkq>f|9 zqLb7Kth$|;Kfzkt=%;ulN{D_IP!aw7VKBhTp2U*+!=Dq0xM;SGyT)GwY$D6WQytj# z2xQAcORRk+hNr@qsqa9PiCkuKy69a@pn4lGF$ZjXqKnyVe3B^kO5-3~>ST8$>hOC5 zeiSB$*BMoT)9X}ksCVOg!*xb&AV0_C589={Js(QyfuoGWL5M`IckK+0qpkyvxIz4J z?WBw2t^+0PhxQ`D_qv^bP*3DW<@Fnt*B2_U-{c;L$uaP{P4`A! z7$S|P;e+&Iqd#tp8ec6DV>HQRG?-_v$VxXm%dNzVKjR;9`PVVk%v-A3$z5@)nTX&t zq@*WCf+I->usc@t*7;CF>aC9|zdfq_wn_PIv+>&ybFl_)+UnwEc;KeTjJi%M&AAU9 z3Ga4*S@do++k>B=!DI@%iO`a;gR5o#RD#ZQXWf-a?)f%E3gRm=F_Kke=OcI^1{Ftk zx-^n^x*I{>iEf5%WIIM7ct15=tjPPZF$V4Qp0y`p6MwFw;qQXD_mg}R$N9+HQwUej z0R72y3Q+RaUNM>Obw7t56jc4^#)uwR1rA*x5_!o@hla-rCC;tOz%N)Y(KcluN2TpE z8iPKn)33S_@LzEJRnupk=r*t`f>$CKQhpxYgXx!GgTdQs+|to|#8kO2qD|H*iI>uBdX#F*T#A!6&74 z(@QI+mBM0>ur_0yCX~YBt7caQ*#OL_s)RQVHaORp*P3-0In%8An$kH{<&~w=YG%X2 zna*7JfHV&T&xXY=ea$F@Py#>hFXOkMYEB)j7U>@_RyWKkhvgsVR!P$xu%~p^ytxgf zv&!er3{q&DIaGdwI06YgP%+KHwJ$?l;mmC)pVI(B=#zL0@YRE*v&(0J11ifK%ALBJ zO5^L&SygkuEAhfYjy>d;h^?3ar`6TfCQ|7uKY!Kid1A#*Zc^}VVt!mIv0+Zl>=|Ej zsC4$cT2(Z682h@#1Y7;Xb<-2|me(dJ3}BLClt)WzYvu-B!&G;A&Fo6)^C`}>xzPXT z&4orV%Rt827St9jbkGoZl}-7qxlT27Ovh+9L*~C}#n3F8E5p_cJwnG(u0O@`79s|` zpeVu!guS>a$vi!V>wrF#`d}I)@pu{hVZggx$&NSTK?q^TH<+W2vm5u5Gf&Sq>x`y7 zl<{Du(Z7d|<6Q~VFOQ?WO~@hO#kteWI;ChY|4MKrW}1*#pM1K|C`xj?C$JJaZoZA2 znt6Ij+`6b)59K_V>%>5AKFJxo{CdIqsitQ39klC61}~7&maK;&52ir0BmC{4Vm^`e82Ssaf+uiP)BC0HJyn>@Gb^)BgLRPS&9ZU-Oh5~|;$>+{L@v)d(2Zup z@~mxOWzqEFXv@@FU{TCsSaEecEVl~lZDQ0QZ|p8y6!YA)hG_0B(VX$oY%g<3wCgS7 zqxm481M+8$jpn5mLnQmQXx^OQw{6h}*toCR#(jKI+K42*>36n_dl!S{ zrp;`BO!e+wyaf8w67V>5DDUssvo1A_hM?murYWHhMca*wrbAD9U=g&zAuKA|@|I}Y z_-OjFXxfe>EppNpcz6-q?-WJK4vZtgENJ__149%$w0DnNTw*!^EMc5p?0t085?sjk zuE+=24L*QWn^f<+ktNXgaNPazCS2|KyAiXHaV^GkA?iV_H!hxxE9p*virERFRq6-O zVL{Cy$kobQ3%UBF-Woj<4tFT_4&G#(_(;TzkU!j%b})$(w?@nmc@BDVGAClU#Y#Nu zngJPwM8-1oWwG~5C==RfcO-2Dny~jKvq108NO6*Z_#BiH&G>Puw+Axyhjn|w()96= z-fg|H2hwnRA#ntMU@}H}=E6kxG1MopF~sZ8>Zj!NtW@t{WLGq20(f{gOkPlfW?hf2 zXb1CM>IdNBi7?jsX8v6#9OD6D**Yu@0G z7f#7T2AubktwU|!Q%!flMAnt&_7z?^#)q2?KPw(W>UzWdyKMgP_YL>&68gN!aPwV> z&oJ^E!}*FnIP{$1c>$o<xj~yL=#+O&tHHLG9xhCjM$TUcttP-x`i@-i;4? z4ack6`0$kB<_><`f$tg~i({Dhw&6Vz_?w2OCh%Vwj-O)U!%oA^&C0j~n+(s4W0-i* zaJWsW!aaubr?24PZHAj~vH}P(yN(C{%q;E@c;94-hmi7|#Qugt;p*4OgH z`dXe?U&|BgYk6XQEf1@2V!yKTiT%p*#C~OYV!yIHv0qsp!(Bq~oWy>GLSEd8dqFlY z_@*v^Mm}-;qJU?=>x`4NJaIhYdTPnMd;mVUB;yZ*qGbHT5c#)4_|?z_bA%tt$l5`M z2mUmlSK(M8{N*??l5+fYz>kCdIby{V^Z6L0aGzs7@!Kr(Dd&F~9@Jn5@zI6{{l|Qs zhhs6rgMM!ATL8!R!{-FQ!Lj!vfK?eD^nY`o0@$An560aQNMpctE^>k|lI(p8;JD6O zj=!3NKQ}z+=S7A(PMP7scwzrQu}Rx;3CIWDAtkWmc4!M3sn84A}oXBiY_-NS$nro6ag&lf6QLNcc*J*$XoJ!^?;J$rG zr`A6|M9;Ah&iD7Ue$#ruR?Ju^%nBx`(#S<*wpsK=(x5=wo4Jo z;Ev}fZBM4Kzd*=yf7a#p5Ankkp-1-rT+*rag!Q+nB(Lq<8p6Zs#q+c-m)lqSjpt+C zE@ADP8B#Bvf3$wtzQZXm?sz`bc1|G~t*3!F+A00a{zNYOPfW;5&TWnJx$K8LjxZ4-P&!+~%a;5weA^cbfx4)vd?I`t}Ntaw&e_aTFQSk0)IE7;R-74yl{E-k2 z@4hub%U?(XUh@qhJcoYZg7Q7s7}zfg;qQd-E9s+@*0U~z|2c&BHox<-ewOw;Aov-= z&Mq{OVY!ko58=l`cv-eps`b1a!VBrrR?BY;;aTRlnYLci&YdCrWC&kGCn_wL=RmZ) zZM(pJ$!`ha?}zYVbSba(-xR{%6Z}kTg4uqZ){8LZwlak8 z3*mj}@HTWZ(0W#f@V$cf7WTJ_*#zp5{K^o%K7=0~s(YZnuZ^1R zgCTsM;PNhIdzz%sPRXZ+a5}A-b(05(a%p-te4ya}4}0$dUqyB8kMB8?b2v!|1QK3~ zaCm7z2nhxVR^w!BnOF#omotTnT;bB07~@2~gwcYl)Edw=)ZYpuQZ+K-tzGs9=l_C~(DM}}rhkCScuXOl4p;@m7+4n5V>>X6a3WWqe^8$HPE61H>0E<8OneFq zJelxv1LytyaswYj^w;^|KQZuBqQBF?&m{ao1LyOEM||+D2F~qz(ZIVC|2GW0C*ivd zycgm72uHiqRH2b?4Eoms4iHcE(Efvo2BRc_W1q5I+&5$3{#rx%Qw*H-KaFtINA6?K z74#_gF3nXbKJQ?99;=mt9`#vB`DF&qdagEb)^ojqvz{9bocrY&!ciZZqO_*38T9ad z2_4=RIJS%J_@2O}JwFmS(*KO|dj*d4tp67RNBUHf`<1|v{(i~_shs;4udiW<7dX+BgMo8D-e%xzpE?6)J3MIM+}@`M$M(`vqxF8-pg&CcKM5S|@N=@~I|7&fuv_3r z|D!m~UhNUM^as3Nje+~?zli=zflGe~k$j}bd7DEAfur1aX<_MU;A;sVWZ-#po_3mn z_aXWy;cT}E3Fhy*v;IAZ&jN#<{bYr}nFq33E97E(lPG_ez_DGY(RtlQflK@2$1gCj zKHG?%&vOx%_IK`!dGx2#`QFolkF-C3f1d5nYwaHeJ?eQGo!7zljC5dqP9l7tfqzPJ zj~Mtb=7pfN+bzk)G!P{li1Zvwb!Y z{e1>K&kqk1j&?@-^oM^8je;KKeo1=nH0Wn&YNZYtcm?6`tvVf0AJp?fh%pQ{@Lhyw z8Tj*rM-BXUgikVXo^NLx_;#Y7XW+jlyqa*dLtjTleOzJCXOo}YByhA3ygoyRbpprs zvOaeU9O)MleVxFOp4Wv31&;LZ6aB9Qj`Syz-M0!H=_4KC0O7X+M|$q}*9hnKCTnV? z{vzm+&joay;zI*pPxwC!{9VFrnn#)cIO3lq@P3406d|1b_7>8gubVNRN{S9M=xYi8 zk%50o_&5WfLDx0TH}Dq-zsSHd=tLyX!0#r!#K6OJ{bGTEe@XZ<2sm6^ji%+O9}sjfgdLPQv>Jw2l2FSpg#SH7Nc&2^Z1=k{@+jF+MiRMN~Z`M z{f+&f*D>zLM7sVm(x7MmA1iR=e-+W6CvfD?^WJoUBYh2>AYLqR>Hn7z&h2dvbucUv z^vLI9lDo>lhZ6t04L)aRF0gMB_yEE%+AR2>K2>DTrv#32KO+8(0!R9@X}rH`@F(-D zcLY81nNHW6{vvSX!{>v4H~4Vh2Weg9e*cW-$!-Q7qJ3LG1LuBEH*oIXQ3jqye8w60 z2*M{D_*lYc8u%2#iw%4h;S~m+NB9y0XTQ4Mz-=XMnc9O(}deX+oip6$6n;7AYO4%DGW;7HH* zxt4IYPnJWjZWr{(=QX5uaIvv)w94ZiRuf{x=Ey6r#n* zc>|NPkHvm@ko@o$hFqI2(mW_|q-Q^TT;SN=Sw!zV-tF;cKm5Hxzm4c$5jgTchvwn8 z1djas&_$O&3moYu5dB92NBTyh-z#vW=W+d|z>&Tkoy31FaHQvXDUtT+Xn(XP&*wb} z=k@nWl6!{0(NCf@&rcFK%3V!zFEjY(Lm7r82G0I=n}Kt`|H{DgN$&3ip60OD#~p<8 zJl075@K=GOo==gUe-k*`hyCFn0!R8_1P&13dzU&efA$By&&YPWAmY&3?VHoHKXf*5 z?)P2-N4a+ppS}W@{Wy$p>_@Z%*1<4C-~$~SMXV z|0wCdMBu2;HqvLgz)_zIN&hthNBRzZHG6flz>%K&Q2%znfz7C9d9pT9o zV?QGP9_49!;nMSYQ-+|AKpOus@Hj(05y;oUKZdA2I{HK)&HTq3IP=dJct1#QrhJKk zKSlWp18=1KA_ISc^0fxOjq4^y7? zLVF^gqlB}3#ub!fc-x6|e<3~l)jk7feOM0jVf~mN<7{W%S2Es6e0e@#obAl=8Rzyy zNMFX;&S?hD^`ipE^?fDD9dFeSE)+{csk^iwJtT zKj-sxq(_|f&k*!!Bom`-17AdCQGv_-%y|bgBBLbK9mwqMf zze)73w0|+}r;vX{Tf{l^jdNne`w09xflK>;DR623SArfNY5&ZShfDikE^ul8aqT>M zX@7ig9|qJ@+JBC~rTuRgxU~OA0+;r8-??JGb0@v1cy`TYc?Gj)R~9c+>DBlmp!CY( zvI3nWHf>n15Mul_KHrx*0XQa9%|-lG6Ee z%6&CK=J-mS^vZI4uTFC{y~5bdz;gXQoa3pk->q|80)9=7^OBn5k-BfP$;*RR1r^TC zD=e9tH>aSq3|>)LUR|7i-USy9(FMnCFTSkjcv8GK*&L4w-*9uha(sW&@yg|UeEjHQ zzITZ|$$e1=zp}~U;`l{b>HK06Ut9uj5`s4;`D){8f^Mm#X)miOs4P;2@D`EsLaI*e zAur!1k`A6%T`*gvS1q2Whu1UxtR4IhXNBr+QYQ5U^@*1 z4BJW5sr%&MTY#Z_T81Fy1U@e^d7JI;3>9PPpFxD#%#dP}UlPY@H< zV^e?p-CQjBB_#g^s?U)r3!nQiF{F)>{IygO<)dsd?cYQ4qa>FjQ~r}a?XMvD za{j_w&1U}(^O2uMgnWMJCx3{K{5q1~NEOll&=#ir13va&8ShkVt^e_UwP_QqnSZHM z|7|DI&qCv^I#d1}ANl)mvVgG2iQJ zoAU8@Cb8rnCHY*R*tC#!flvD@NIv=;25e_v_&4P@k^du&46|^uhHxiV5&?CU;VU2i zUq$kxBoO8IhksLk55P>G$o~txNe2Pv2N_J-2cgi!kp4HBPOVhBUhd>t(*7I@V)fs) z%bXe&IA|cC{8Ecq{wh5`t+t>}LZ(8Q9Ty+T)48MHA(`FOr-%D){jl+W`V zBz4FcA*g6HQ5Th9$3UnhfoMN;DX!1sqK@PvtqjQ%oLqmJhq=tu|1KZ-dsaI& zqLGYtdD1JS5%h5NpoR(`OrutBjN=o?HosBW$A+9 zSy|cHI+dTW{G3VW1}v{dmU_HJ|DYB#w&BqUQ5{8LJXk94sI`AQe6~KUqDSH_>y^<# zwSP^#%8d`I*THN@BC2*;V1MuIMmz7#yrcI1J#f3trHxnn;oVfZ`AM~%v3&f|DLb~= z>M^%GN$o$ioyQCLVA+JD<98$ge^{Q5#50y$JB_h?kcl|*WIedo6T3naCK?j3=4gcDBcAp+lX}!L=>) z(<>mG?GphSv=Q2j^*OfWxApK_fg|uft#wpyFU(cB2W`7yv}Ny|4e2WAJJ_bBhOLxW zz%P&Nw8IU%>_Ef&b_z62t>0;<3_6$?J#uWxbDNO&u_aH}e{r!@e`s=`9{C=$Rl`o8 z{{sFG*_N(T5{Mq@t4kLLD&y8d&pKieu+AG}X}fObZ^e6DTn*yRw|_H(o;^bPk3 ztVP;Bw|>(!a`v+5EjyvDyTESP)>`ZE$W_`-U9^2Bf_>&vTVDqKs-Uf_sja)AtjXJy#RGW$K-fLhykG4|w!f#%4W9jv1=x__Y>Hw2^%?&D3uT0kK zfjE`>=9tsgaJ$|IzrePku8nqcKCti1eI<~h`!XTaynXOf`x50~U&=DsmluJZ zSeNI)HaI@GZ=}znK3^IBvNxb|Vav1t{o)gQ<4p7m^oe-zsWg}`z?b)<9ys5mp}#;m z&N*1F=PVl2JRju)4VE9zr?8K33}yjsiRk;eU`Nyg=IjNf&}N()#w-n|tcS7k>Nid9 zcq&zgM*{Xb&H?c-4)y#G?ZCQN&l^)+U`(azzNiB~ld=+_O>2C{6s(J>Jm#fuqtD5) z@o(1-tNGk;ymrX>u=yB|gLyV?uQ|r0AL01=0{ZZCJ21!@Pqv_45xco*nzbBs%SH`miy4@^B}e|?{G(G6hRV1714eV@r*^JWjn1d-BwHD9eGl z;A41fEx}To^Wvii@|&7+2cBe2N4&JD-H5S4wGPL}-|XHEr7#Db3Tyr~Fvphw|Ab>> zcPzIO_QHIU8{U7_EnO}9l?#D>5XgrYTE9NAq$In&s_lGZpEpk!0{OXC`-FKg@0<$$ zi@cn5FWfNDN_Zs#_41(%*8?m|1A4jMmq6JFsHfL`caEZUALb}t_b-RJQm*@QY|F7} zu8TNNpK4iqpEuezf!c<4Mf?75YvaGmc)J1m#eZISvi_^ftop-w0oXg*u>XwH`_B`g zPY%I;<#X7te5v=Ls^Kv7!Ax6iK4_nSkDR7foe({;1N^Nd6g|@0>bCc4@ZbCd^sVkN z*LKru+D_PSu7`b2NoS-<-5Z7V6Zh1(m(>0QWnV!5=68*1|Er!EsP6&1k;V$w;+Y=q zQ5tIF)Mlq%w}vZ1j<4n?s3ZBH56gq+NHx#u&g#e?;b(GEPJUN)q!Gs1l_x0F`A8Sg z`w-+&F7ESq4Nd^rtjlt!1E-j&JMA7$TWIfo5XK{pk3*Bkfz8H(?Z$u&ao_zrz3=9) z>4EOeLVwD^H^@0Tm>}oF>YN+z5pr@;GeXX7@CZ3s*Nl*Jjf8?|PHrQ}5zRUN%^~VY zXTO6fCLJjUC$~BPAtxs_Bjnr^kC2o6gA<1%=QeqSoP4+$M^f00{OpX^QZayPoMd}D z5;>RV&>ci&w^Sk9ig^RXnsIDuXqq{oGB$n(Hq0LH zwO|0#b8@_c092Su$(UW{<+(C;7^j(0lFICy+(!45BO0p8rVVvCLQWa6kjap|sHA=*6dKfO8^cWYr z94XN{V|UtO2ZWi7lgt>qx9u}ogk-}^#>q4nDvVNcy$5l!jvy2_eIw@{@CZ36^_t#l z$5MUwSAU{Q@?GBFrAx+BZI8?MWPjr8Mt;2*A&TQ$I^U&gbJi~*yBFBCX(9>l+m6N>jgte(9<2L)}IG6D>PQFc$GZ}EMr>pcd zQ{1YazcL>n!~b^UB<2MA51Rj+|2PI zf6hq8QrM93YFILMcgGVpatl4j_|}Rz1Az_ss;f%jA1TR=)n3mT*2$^OIo1$J1FcTF z-1>2@$X16oS7B}2Fu=Hqw-3P`1?Tcz*@c|E(S@dPaxFn^+IO%(ULmmuIn6TKa6ZFq z#<}XW**e)&1toKOip!?eA;4XHh^jbU%sJ7;t#2SrR;ZE5=v(f=NGX-?HfRbbO9;YQ zWy(g*m3f4m#PYhwzVAdS_ zwW7OMg_BRYP^-Sd+*92u?ipF53$=L(;RQ*Y8ILC}ZCe?bL9Hvh)j`5l22&MVty~`C zq_?P=%2&Cpizwwrriq#LN}^~!vu<)3x#wq_32Kw?up%3%Qa}yc$Z2MT7!|vbsU;V1 z?}P7f@+m57!?em=esBb^glXdcX-7Cch9jKbW=BYKdwoijl03hFZ*bCc-&V%~F%f4| zZ96q>b?efS@if+W5|zPJ!bwl#Hcv>NDW)^ye3$WbPBLShquPFM8F3l8J4#PnVU$YO zyHtgotRo1;<+k;lH}|`AKle5F@VB_Q<~7B==HPMp4jmiI{$vL?GKU=(L?{8b&^YO- z=UUoRuhmsAnHVw`T(;TE{z*1bVqHQpvgUL(VQttgni@Jw4>QjvMh?n3k9{F0?kJ`ca2j0aTNd0&Q{-HQgLUiTvy}&|6EA( z9E67q8KLF+$pvYyncPXmFLbRTG?xeDwieLv-M@b$a-(pkcF?N^V ze3$V*V?B?{zoqp&^;(@n$Q57>lW34BIW{}koH}s^9#6#i6t|)8VzG%* zb?!1`&FKo4b*rZ=ChO*t`z&JQpq%sA{|{f#vke2<3k3>0e?;t8paZ077)Irjje;NP6&vGeUVx1JL2jKz%pxlN?U<==9~V)Onm z-;*a%6mcEvc&lZ;OZ8pm`;=JoeM+kvNpm*+VZL{J;k(?xYB}GJjWOSkZM9oS2{E1h zU%ndgJ^GzqHZA#BDPrOd~V*4OEW% zM@}Cl41QVD8k?0wQ0G>e$;r1}Xa=R+$W&%Mm2eB%@IzMS#a#$?;N*5H`xXN)+pRK{ zlOC5g4?MOh_yZ@|KHqNO)w=3T=cHuR`rVo{h=JFLR&QSPrz&EEbCPvv!-z^IE>Vin ztvLMvVQp|LW>ZI19N*{M3ofH6uTqj5+9uzpIzMdE*$_I8Q11AfA0DbOxHwry6`gA> zob!77`@blYPZIyRO}fXW)oG6836Gf;B`lZXHY@_nCE`~3o-Ql!aN#BJhl>HOg}=+@ zko$=@Ah5P@a+S+?&IU>z_MlYS@_E11Y<1dYSs5;ushk||ZXipTieqyDWt<%VoRO0r z7kV!b)3)3WaS1O4FcWZcoU2Ql$4Z3QiTl@4mrD`L;@E5v8-Z6cOI^-MuG@z7ovTD$ zT?)rhlDiMMY$C|(wpPy{YN^U9ior!V=`n86`Bo=uK!=o|-66T#i5)sw7s3~k0{xZU z;jBdbD2v@yO-QjjoSyh2$i#Jo47`l_WF3V%f}D0KmfayS(J2onLA?nnn8^n6_;ldi zITY=F$Cw_OP%j~<0^Kl?2#M~PXrDz$QaZ4~dZ+Z5kTSYQ1ZsB(0yBhAWJkeD62hCg zkf}%52|0S%&I!assg#qf%#;he%}Bf?@nT?~8dN2!iF)c6S9P+Ct}+?1$xScVY5y$TcQOZ`(AEKg4pEV zLQD`fhG(98CZWcC+?Hs(uhi7BT|cs&X4Ie5)0qLTeRTF@Sr^qiC8$tDTB7bc=-{tA z^BbAMdZ4r?=V}?jv(xZGBg-B{Mb_2!d7M057q$!QC>R$v6AFSz7>dKOYgZ6q;5m5v zgi_JKlVObO;Xm-S^Ohu?{%v=Se~9=q89I$z0*%?q-V6y0f%`O%?t!~>`2`5wgovaHcT7`}YiqHh90p0#Cx9VDaPw$EgfsfOK3T(m&@UQI3=B?QTm^JSY;GSCCyPWud6Z<&vH6(NkJ8=s` zkVwH{fWdysQMk>c!SlCgz$QhGzZGkL3pxJQ+<~T&Ypn!f&Pe)=Fu`v;6a2)$?0Uh!-s4}7{GI9#dYm58oZRt>kDJhV zeF2HQ5%~gg5?SQtWq*eni!5^WvM*xR8@?|!&u&9OJ+Lo1lt9AXj^@RVO|*)S)2-N> zZvXb+ZbeRM$mJ>If}IOonoV>tS2UmITJ2cnQS30gK0|kX4;)?`#-aFE<3YSL){4K) zSSxbIS~1T0vBsKi+pkS6XrvianD9WOWExC(T`f`WP23fry;Y8FvEOO#2=AaHoM=sT z%Fqo?gbCFp^t$=aSkKG8hrQlxW{F^>-Oz|;GmF)7X3>Nnw47NiXJ+XMe3bnOilZ6v z6VL5GK@B^26e8&ihR;whC;2I|P$%I5!#4P*!O+gaBKKPvb~_6t$UKUXd8F?>APh$e zxCyr7tt4=~On|{3&wxlzU*|z05|{=@?a7yNq689sc#5?H7MO|_I6dL$x{e82bS$n{ z+_BeyS}XPJ!J8eL&srr2E9` z2Y`YMdKss&GdPXj<)k}XIQ4QGeYrpUE4z#3rBgLi&j%cHX|jmn0};aqB8Ct2(c(Nu z@1w=^;V*I8{j8*aw=QU9tnetoK5$2gu+Yhdg-$jsbh2TgQw$58VpwS4|8o`^Y*=Wp zVWGi>g@zaw8e&*z=>KX9_0{9*Qf(6&$Crw6e5p2uGhTme;a->1-gwQ|m7Q^1Aja|R z7HQ98#m;S*(I3N%{y5F(k1VZ*H>QURF(Y+)0JaH(ZRWFeT}Rc^twBKI(T>vj-j8p>o<*8<@>1dhJxyy{sU1oId za-(yX8y&jB$X~7bd+XrJ@4gORFV;cl3@J``i_va50iTS$X5Vb(V|O?MW3A3O>2+eU zTc;KG20$+KIPKQ%(^Wi&{+V?It`>Ot`;7_ce$C1&f55QWe;PLWh34OTpS!tLDhu_l zx12AFAA^EZ;z8soUGOSJ8vN^k!^9gNZ&`U7jr$mgf`5mDjn@z`#Jw1ouMFBp+gP&}+~pgQODp;wew z&K+7(P&u!B{^IhgJp2me(2pK^X!n-YAKw1N2U~Cb;OSdFyzl;@!!m}!UuMQo`uyO~ zveMa=1(l0ui4REtyIII?R&#c}JibDJ?6?<8K;*8Y8lXEX*!YHS?=VFPmRn z6e$E|ss=uQnVnay%F3bbZV`SJv#RvUVkp35d1;ZtuP);EEGyjabfSKFvuoz4g#~45 zK7N%G4|(&7D=#Z9YECsDzLHp^Ezlg--^s{B*6?x3%4)X|KLLvJRh62rRUDB8s&HGd z6!n&XOy@alXP3?gGr9#@U8e-w!OR3)S#SlmXHGGE>l2!#6^KEG*3hHN!-{>UjFw161o-lsG%rDiX#F4m+q^J}U= zhz7MT<_90kN~>aOi{I{yAqPIjSq>jFDVdj7S_Gd+EuB*e)`>xS1`+pk3&;hF#I^BjwgE7iy@@Euo^zU8cT_)>hj9sJmJhU zRAE_h!Tg#ERZ&o>?T>Z1Ol=3%EO5anj_s!B@dRKwsXDK03&VWX=6sZ#%vNyxo> zU|l&)Sxb9aC${gcF}OLd1KuUYfOi=N>y#HGO_VVGW28y#Pm0_ccW>yPu!;aai^_Il zJf;0f8Mg-3$K4jXJ$!G%J$OckJZs?}!z3qCJt1CCX}mh*)pKe^0NRW=1Uwh_%A50j zTT>{QjGTacKc)0Gj9q;kzF6L#+8V1o0_FVPx8{0za*@Xr;?bPOlTp!1Io{~P5UYL! zaPAMkwj<3Si3gr+d+ltlCx7EQmYg)G#@}4W(>*n#{Yg`}@9s$0(Eg_#?o7V7^F66h z^eSAReF9Xh|Dx^!Xj(9_a~r4LUZF|=xNRb_d3 z_0XEC%Auw63(IPXiiZ{yR2G)NvIO7Mtywe#YtGUWmk;Zft6j^*lUUE9as554!%D$d zdaD;#6j!B}V8d}1gA|-(Vv4@>1kVt_NWW};%{-?_#n~#J&O_mpbbu9%Pe=(StqdlI za)L=Y!GzGY!A_yAK`UgB%n8QZ=L5=x_5~{t|C_>si$wv|S^@FIUmPw`q-b4z`o980oLo$G#Dii?Hb{%Y9@`#KARhNhkuOuZK3752epx}84fu&;j6OkH;#SFfnBR zXhl#XiFP)npr(EM@>or)x2#}Ng59*tYVJGGNMPi0bqob6hV0*~oRIzB%W~{rTd^2E z4h-WH?5CC=h+!^pq30~9{@Z2HLu@;0wf#IW&IwI|?f}vC%U#(Z^DVG($bJa0p#3ME zeh|{!s`f4H{-RbQyhpQvUJJ&fzh38B_&dqM#(zjUg8HE3ZJv@zA^RU%vGu5!{i&CB zOdqlb=CsAa&`sJY-U6pkU0sb(%M5ASsAhla z3E~^<&kfL@dt&zI^>9lQ9Hcb-kW@c7DVQ)`yI>Mb7U;O>(m6Ty^;)p~wY7rWb)}vx zTu1#7%E?o~WcL6W7!|N2`%W+Im<;W`ItC$Ie>qCL=%>W5P>I+7#Y#NpDA6HYjbr(# zt8#+fL-vb-oM6w1!Cv;loM3+#t|y0VTxh2Tg%e2#d|pm^wB&-Es&F+HysQS~u8W?k|?|P!*$O4RnONMD6nI1(w>VZL}M(pnZ={ z{|(aqOVoebR`8UB@D(r=mSQK^x7y(|pa&t-HDupqgH-T?V7E!ZzR*3rL)Rd$&=bK9 z_6R^H2Ri_o5?UQhdJ=tW6I6?Y>_6MsljtB5g9GiUFb5wBcD>;0iMl&*rjCc-5P}OX zMbFs^#9eV)F)?_;B=Agd9iT{=7VJ1N*v0Oa6FlJ>WM*$%x)pi9CU|$UtHJAF9S25W zu-*37Ku=htVCx<;TmswIIJLjYEUX8d?yWW}x>w`wT^P5lcN`}5{U;a0LtdMroyPI(zIoWHakyV=gkNbKZt)u70ga10f1=#R zbEz1?1`mxDY}K;8NM}1gByLd!PRv?h4t>k^I(WvsXi z>q}-B1FjPbKhX!T1-!HJ+NH0D0Mpg*-`V+Hf)=5#$3UtcX3);w-Ey^Cmnt-Z&dTdAeVqo%qVV6@`~9f?@g!FHLgSz;1-?#nz2>ifFt1B?Qu*r| z_xhdn$M$s={?FItnl$e9JL_|*wvRV17>Dou0Uyr~8Gj1ocNXJOUpE8{zI_I`H+~0` zo|kCc^MB@Zt;Rk7XZ#buWA!hn9}~x4q{gC;lKc~)Vh*J-iclKy@s!4>NZ=C${*b`W z6!;8*Oa5g7m-H;l)Mu6teVq?p`z>+FU+T&Ji~2}Cziqqz)%1T9?Uni;61dcVslX-u z-2#{N-&TKV&(nw}MpAB;z;C29+IhIZ>jW<8xA@@O1uomg^AqxyeE3?p>2Ek+VKDVc z^TF}Ta4h<;1M3}UPfBA{LG-v2JxSp2`{3}sL>-Xc{bdm#KlZ_Y;e+qSG^#C{1n1N7C2$;P3n3rL>hnJ`tzs`uJxb{N#{BWYRD8!5X9_{*up`KKKS7{0kraEZX8A{{fCD zeO&2-zwCpjq&k&NKIi)2_xa#WKKOaG+0z#`TWucKbN+WrraBS z@Hc$$?%iX{UEqUn@xfDQYi{b(=!1VQ@KYQW^zj1yNR;DO690t{Zqt?>O^yUDfo6Ur2Oa z1wD1CMrhmO(mz0SG!1JUT@POzfq{J(^+Eps&?sClrI_(!lt0_RyFon+^w%2r*@Uk%@N)>i$G~$4|D}QRb(6<@@TU#@Wa9IZfe#}5 zPX?Y&_@{)UKg;VdO@f}LI*qWsk)F148fQ7!Ur1j<{7~IYTz3QuQc#IgfB7hvu%g}wE{;!oKN|62F`Z7+rYX0FASXfWeefhUfObM z!7m#02T4!7K97Ozwuji(*e+{+sVFTYv_!a|aKX}2w?m{IMUuAUnKm;B1G#893YF?*^Vqc0Xd^{QKxQ9tR*#`hPOv zXtzF&Y4ow5phvqsK>80h@MDAzH}H$vIn2&7@J9$g&%mFGcj%`Wc(()xzf|BjzM>AS ziUp2(=7gPs`3An0@GA`bO~PvpyeH|i+Q4fFzeC`tPX+0-g>befd%DgFb=${%V1vKfFNxbFIM9{;cO(fg}A%iEx0hUf@X2`fn6C z(k~?X`vs2l+%LZrIMVMS`bPwg^xR)h3moZlX~X-hz>)qO>hD(tj`aUU^xFlF^lVSQ z|APL2^dpks0O79&J@?Ds31|EFcgR(H8u!fS8RFB$zz-14^C;5~=-@Cq#h|~P@GQbj zxzh~#zYzUw15fVg@UIX!j?;%p|62@vAK{M@&T`)-{B=Q(cDtDPziZ$>Bm5&DKFKuy zG55$z)>IGhYd4uw!@hQ&UP4Y;Aewg7^WLI@2h`o;M}fK184ix5RUETwj%#)4Eh}E z-d$t5T+kz* z#8fyyc+tSmBK*G%{HKJ!Cvdbg|L))u#L?58_mi1vf%lp?SqaqZB5j~I7(OsN^ z9~t-t!p9l-e!|Z;@Ep4EbCH4nobWsYf0*u{l^A#;-4Ck~INIT18t=;lj&?YU?&n=^ z;42AVYv3;v{!;@_CVhTp;H88=EO69^&#QkgaMWiD>HjCfv0u>s)$otuQ$de@RYm){ zBL>d?9HjjVuP^MkoeZ4kJ>E|-J)g%8H0Xaya)%o@&y!~xIM0(85RUCSMYqT~%rfW~ z)A%hBINIkkvQL@7<@jABaHKz%E*vfuxE#N$1dj9@iT*}`BR$(;gTRsgYofnf;7HH* zc}U>c?-8=wV**D$x6=L8-x~Nkg#X^akJ3f5?FQbPCX{y!yqNI!4g4m$NVeC&_Yi(q z;Hdu;(%+(eE6)S36aNGQ??!s282F`x_cZYP2_InK=aN3B2^{sQC4F)Pj`qBbE{0t~ zIQv@#lwqh4c$x$0<1)bq`*8#L;SB;u{(m92Hp}0m3f@j`Zw@TLq5vdn0gw@LPc+J^SGw1deuVB)h#OaO87MA2>kRY2Ysr{;`37 z+RvdsVBj75I{4QHej(v;be_Tfa}{lxk_`N9!cP!5>d(Kc>nCv3|5@Tc*udM7p2H3N ze8Ty6P^{0bgr8^7k05<66gcX`*Tu>Nj{00no0KJlqaUKbu^-+d@PUAHs1tm!AD^Y@a-!cZaHMBHd{5v=|7W7#DR87` zKins9v|B#4>xjUSPZcc=few&?!2R+B;fV(R9vLsyz?+EvBm+N(2K~tfK5vjCZ>WK9 zBm4}3qyGGR&2t2v4*0K${{;sACE*tv_?e`CzJXsuc&UM(O!{0QaMY)f?D-RcrvqMd zDjXo(Lpb^&vSvTrEa$6e(dP>s>Dg{&0!R8=h`vJL(w<8Vob9km;K--b5I8`%QQ*jj?YTkV zNI#zF?-n@HUl<1m2%8N2$AoVdIPzISe6|Q2`OGHzZG>}wv44If=#kGO#Aly@e?a&V z1MiNNAiyKzP7MBl&_co!4g6`sQw`i6>eTNe@C<}V|8az~{)ZiMRUmM3DP2-6_@KxU z#Q!P-UrP9O2L2r3Hye0jh9h``f#(u_pMhUbc!PnzM);!!o{F6Yp;6#S8YMftPdM5E z+gk_!7@7o5uB`E-PC9b$A34uw!W-uWj`pb}xhDx6As&wd1&;Ku5ItXC;dz6{<0yl^ z|1d|7GX;(;csx!JIP$M0`tt>j^n4%Z5`iQA4Owu2aH+tNp69nxfg}9~L_bg9NYC@+ zRRTx**OL9O6FBnePQPEd*}#8H_yz-ifbjba{1d_(416rn8yM&`ZV82(u zKZgB+J`?iq(7gSPf&ZOw{=GE!V_)Ehp(|ZCVw~;Sk8qSrQ-h|@H0VzvJ^6Rn$Or9q z%WzGu&Nk?)i2i(mBmFl-KULt^F4pr>fg}Am`aw#8z>$6wwRfJtk^TmvUm$R#Kb!1u zmB5jHJJDY)aHL;E`rjmQq@Ohs4iMG}9O>Dw?jxM-iG7UW5kZf9x)Prk4SK$gvBRK$ zjOgDIILhU5ebB)9zB$UqfcoGm*=C)CPf1bC_zRRzHt=nfr^_@hpY4Q44EjG(p0;r= z{Z7K86r#wF>t1vVc@eUUt!>E&qW5llJd0%zKZf3vz}`S=a}*Jgl{nT z)KUInf%k=U5#_fSIP2MH;H>vH1Fxn0b_3^jy=~w(QhuL-KScS%2L2S~6^$EgFY4b& zc-X*Mzhnb{mFW5THRi+m@pW#*`vWc8JzMZWd;{@`8u;CWk2mlK2%lo$n+Ts_;F}4r z5ICMXvObFpob{toSJ_BdJI&9!;iI1Xr8v7UZ=kelvtj?L25U(Tph@i()Q*LjXfpdE^417HC z$u{s!guB=0Kp)9}hC$E#^9`K&ml!zDKeYzV<9d~WuOxle8u%*0HyAkEv(CWTo|_E3 zj`%bR9NWb9+-Bh1-t7j??S0$8Hxd7R2G0Bs8#wbB`!_eKJ?@oBcz<@hYf%+qV_J=J7{YuiO(ZJaswi!74 z!*&B_e|X!#>xln8f%hZ~qr(Qy>mt9>0`;d`Bf3^N=u~DL+lC=o;PUs+@cCICkRI_| zCyU>Ob#eLoVg6ki(j&gpAyXNGK0+8q*#JVtXALy1pO)lXZp1Q$912>1_S5z)(M<0RqHC744mm7 z7I+#nhj@#DGkv4L=~A+;wavhpe!IZs_0qQuobA6;;PSfG9s}P^y6zJ=`z#h6HgMKQ zg`A4$hw}VAY~cL<93E3apyxDl$Z*&w#N{{|CvZ7l@&zu(#Y%xkD2);Cmyv%Tf%ANc zxb)}uhz4=#xBCPx{gc-Lq#q#oXFwhU;?m#P9*9f7suuLpf7T0J`pIU2H}eO9%YHv9 zaM{27JABkf_Ty-x$NrW5RVwyZvcLE_45XL+CHHT#zpfPPaztCoIq-)9kxw6iPln?%I{u(O$Q});M0+;VCcHPk zn57EY04j-FP=~av8>DXudwD>AS z|DyEFQL6u8_bQ|f<9*+9sl4 z$WJ4}*5qI5Bfl<&eEey)DZjsu{OxU&-`hw2_89WJ#gJd`BcFed-&*@0@R6^s0$~uO z{qd*8X8T|9@xKV|k6RnR_&jZ_{?CXZ|HK&b@Ar|)XBKWY?k`E%Ns7&7$HIXG$OI3g=cgPB<)hh^(je!}u|CY>9wycSvN@tC&QHcYFe z4^cXv2$aW`Y^^_9ZqMF_hgSmg0-D5fS;r7w0jSN zy}^-*kRGUNrya6Y!-UV5J(>@+qb+MM-0#W#!nPZp>7e$*Z;x^h+r1mUv{M^;+g*K=xNavn|klO*bn#>cn7lRL}V6sGZ9K)1g`GqqZ8AzdUaG z&QMP@_4;T#HL7-bXnKCfUQRv{^4;Kd+fa6KidqNn@?6*3?y(nsJ3HztyIaH9V@|S={tUJ4fcukQ((w zyV_}3rw(GQ*Vv(#)^AT|wQgsE8g-yIsYaZ{t6_hxH-^+2-P{3Z0qA+YHew$<=C*n1D~KLU0`+g%x_*4-7SUI+h6 z4F^@H-tlU|st#ahXrI%@ZhM~#s@&c-#LyqBFJF{B`f9b{<8B*ID1iKOyZhcc=$DCe z7iA|vox^rQ!*VE(HZ?)tB{ZO2J_dPMA6^fiTYLH8>`wySU&)JC`^Q54-dSn^xN2^K zow_Cm`YmrD)IHjiTbiIo)>*aF;PPK;?=-cb?(3#pSZ5b}@{5fp473skmBy=)y$`7c z`Cm2VhU4|Cpw~BsvqxgvUTYuuYk`{_{TmS3H3**#sgT6`mjI4 z+?`U^zoj)jd%98dVFGmJy72_=bSLT0PvaZR416i zQ_<(bJypt^f$*Ta0o$0O7TgE^_R_NC>3i%G8}izz1@T=}_BOD|wq@bzD6a(k_fB{{ z^^!!j?sU*?7qqtod=}mjFzPRmM*k_XyJ-J`X(lxv#vYs_!&vFo@Y64w9^)~1Jilss zKJfanCGqtKr>i5!#s=1bf2<8#(IW?KH3;KP*YrMI>%1a+Ewo`BwgaZTwS|!0*-x!| zALa@xxprDyxON(r?F{Qa(zLsvJdo(%5x{S43m>Ad3#s9&;#R-$@q^L&yJu&#vG0TEl@;|6}ukPhY?Pz@90u9$0huxdVe|zjXu$=e}~FeAj^k9RnR-4qNdJtE~FOIi^)1ya@Etyac{j(0ozgZXic0c$4+B^~&qgRng z@%+N_BKSydq`J7O`t%5VdbJ8Zd7I#t7Zt}WS91zV%i!Cq{m0M0==#|+pMIv>J3o7& z+X>eC&u;G3>Cw01+yCa{t}Dh zEpuk#9XaQe)LaA#TwFP9=((fjl`a}nSa9~t-0I60WlgIZRhTnw((HqsxI3evBeiZmDUUT<@v_L$G=9oaD}dVZlkSQ)r*-ifYj* zQ7U3?mYT_2xQhYWOjO)-OO<*oos`)Kwq+d=22{pIHX?ffVx0C^vwT-VYplWdOwIr? zWA-siUCzm!#M)LjSQ|OB&jSM+IiuV@zQNwe8Bf*A_=R=`85jsG zgJV;PZ7q1+*fu4YVHPD|y5eLO?3*xvw>t^%Xo}~O3`$sPDkqCvi_hUCcZM_Ha89(A zll?IwvQ&tt;You+lIHT54Rx8gcAr z$uw71E+>1svMyuB8EzL{#!1gQt&Zdf$(TejP6(W?CCpMKYbjahLNhtZzoY{y*6w?f z&r>(dbx~?Jdj*VLZoen2)fq8D+H(VK)k(EFM9oUlLj0>kP>0RH0~a864E74F$qk5e zd+l=AdgJX@duuT&zykfDS1^yF+rf6FYRW zE`*JFAWPXDCZwF6_@l%?ceqPzSrby=VqqUOA!Q_7l?t8=3Ak|FAE?esOa!DICKD6S zf@HWW6xtoIu2TA$;)HY%(K!_De#e*|PQfWXCZvppdjg3;73k(b$gq7@vux7p6_(0O z=>%5kkZyT3&**`5I|j89$xx@e$D$L|v79=cZ-DB7?(4=t3sO32Vukl6ofWv6?t3Wp5a?#jLpp2lTo4Y1bb>XwvUzqn;G*=3W~D=xHqRol+hA+xakH5y z$Ro}`HIAQ6dYrr$RsDW5N?(b#A45}h)b?^sH3Mu;rmAdis>w<(!<(u&~8SC8vgvVK;Sf7yG_V)+mEvh zwSRB(_UmkNz*^^aSdY4ut2Cj1?n-{~Gl1AXjlMa;??bnijZOb+)D; zw@%wcKWnlXvB;dE5sXX0{z^e{DL8l>w~q^>RWJnB*hrwqR4oGkT$nt5^7KgBz(`>k z{J<@;u(-0Sw0wRfb69#tdS)c8tZd=DAr+P7mlqdSN3yaqhh-Pe8JUq$JZ$91jO@b9 z%n@@&%qfJ#?5x6qg5d=tG75@^6%JJAoIdo5^2)hGOA0FImCs*XUX@o=P+c(eqlX^a zy=C=>w?Fa0)>}V#`j!vxyMO4gjA8JXnK6`p;WV_YbarJy<>Fbh=~_APnuWY(HRm;} zC9he`Yu4>EVFd}Qn!t4U&@XW&tCV6mqMAgi%D!pueaZ#iYn5(?Jv!_iv z`;xrr6K0;1mwU;SbMo?<)qo2ws;nH0Ad>oMa2qb872A(PqB$s6_?G?O;kly)v5@88d#2ps>(uDg^Bra zwp*dbW~#Bn)Y#KhRYgHzaaCSLWpNe$=COD|O+i_eXBw1SP*_+qucoY^y0|E>sPwYZ z>MFHJxA?SS(B#=QbLJFRDsY|I{4oTjX$y{r@4_twu+z>=i{ zt^{gU`;+o-4Xls5Ep&VMj)V>Ef7;>B-3I^9##rii(F86jTK)Kzn~1tuw^RVoqX*fRxmyx z{Bg)WKL@__ZI4>N5^pQpdm{v-H0`8g}#+wJz5kQ%!pWDke`i7VhE-}durMeqdp zX7|&}x8gU&Us3R(_>leBa`@hN$bJV3JKAMiL-vzU+!;RUt+wKK#6uG&1~VtYC*na? zP7t!ef$*jH3HlS`@U?T18wxojOUw!O3)waJ-EyrTH!A!PeBs>gwH4|lgzSVB!H7M> zX+n?Cb-|vY6~TU>{fc0ZoM2D*yt)0&GRWF1EGG>gQxDmzt*xldm&>%ZZ?y2s>^Z>! zp@TY33Qf2nWPiF0x@D~eeX?&E9M)SaRs}n)o&O&!Tzl=b;L;c8e9>jiR?L+X`QVx1R>B1_H|tf~h-0j9+{2JR#U=V(?_G+h!o{Z@&t( zP!h5qg=`=DHQ?4CHGdSigBq_xF&N$c6=Y>YK(n_TMIQtT%O051qC@st=+uG!-6sAv zI5`BJkpK$BhksJOe z8lUhJD2(;Z`OkGF*y0=E&l*oPP`LN4@vbfK-)Wp@N3R%vO9VsN11Qy~ad)@mmOrU+ zcjxTlztOn6(RJ}(Yn*-%;iAq?9kylyagxqAB|5dhzt((c?;}cgX&ml=8R1Qh(~Wph zwhVAf|0>b}qf|CW<6gTi5q12(!QN6XR{Q?GweIO7)B*l2?d-^HX=ev-X-@}l=~oWk z(ob%O0$y{Gh67%jiG|k!K`b2K=_$X7t=CF2Q2M`!%D#Mw3@fuDR%;gWqDOsBCR&VY2{-$972#(8@;GC;qlnkT zM9*>=-%PkESNa?NW|Kph61e!`k8n8DQNqMO_Q8jeT$BDKAAC4%PEGos_~0M=;QTEV zlg}{cVwhgkWxJO7;ExMj&br5Z@Y`rWpF~>_6EF6`$qf3PZ9I07U3=mg0RH%! zW)9qUj9*9vJQpF}lZhdwS1W7&$mc#P<1vWzOoK(IQaSVIbz&sp*e;fZ&{Tu|DCK#6 zV?GH`4?~_4x%%`Xd@kY0U(P=(4SHUO))+Xy)rA!Vd}@ z>7OP1OMxT(XM|%vVZa#ahtT{I5;)Qypgdly$H4U05k1boj3fOa%0~pQ+e`HQ1&;Lm zZ77~Ung4#;YMo}#AEx|S0!RLXXr3A)aOD3r<z=u|9*iZ{pUpgxxkU0{h#mmasS>#>j&QxW&PRzJCeUJJ%76_Mc~Mv z{lAyMQJ>K?(e@QM(zE}wzcc>_i9XYyXMc9@lS2ED|EaVNMGbl$FB1ih^c#qNvcORv zi}EuCj`aKt`;P^V^vRTm-y!S3`d8C>Hc#M4&-Zy32^{(Vjp&yO9O-#HUN3N@=Wl|o z5jfJ1r2L%}<9I=TYfpag3j=?F@LwBzE+_ms1HX>&mjoZV{=Q|{{#($t_%*=Z9pf!2Qehv5goQ=kw)=Mjc%C zSDJydKky#LInO2{i1<7UaXF7IB@)CX|IY<~x$b9^Jy=hc@RDI?#`z5jt-X_h?tXZ8 zGu*c_RMf!5Yx(?p%U3h-jglC5VP?mCvqD~;eyai8sF|CGKaf@C>kjnW0_M2)T0F+y zJshc0tVi-=ya}NBEgpXYy3-@IysW06vZ$FEoCo>K@lIPhG1hmw@V-@gWlJ2Gdba?~ zr~Khzdi~fwJg{GckLnjW59#X%^Yz2{nfeKQeaQ44z|W*d?^zzaJ0LS1FnIp|dwK@{ z4)9BIE!U+mu`PqLANQ z^l@rzaw2^$f$ijZgXaU>|HYF3DS{Aqo^Wz4W#RdIEcwZOof>RLJeR?(gef2KSn~N9 za-Me_ZY^cuwWL_`qa?qA`VZyc(r(JfeG|$b2LCefJDA2x5YkACf#Zc#-*6K(g&ZQP zsl5Z&W8}v^_19AUOPG*iv;K6dZ;+{vss8=6u5r0p{{jGF+3(^0P7P^4Joh#2hx|;Q zSo21@RLtk8h+!~kZ-{{*-6C2P>Wsl@*1r~LW9c6`1-ZaGU`b)@f4oaz>W}M|$rB*e zold5sm=VFGJrBxa$=`$z{6SdjM0)(8Nlf`O0YjcVPKaF1Ao&*>j>Ymh#_MUZ>i-uF z@Qaus#axf$Ur>F6Oxg0HhbZKF4DF-(hMFo&^|}2_&+X^@UP#2UUp5(JJP~65p-H$t z&tHE9%+v|1Y#{jq4CW^7yFhD@V0Bd+Lq5th+=($M=-|v@SNKd%fC@j2cJ25j-EGs zs{Tvh@x{dfcqY`=&xD5GUpZ~G3h#yA0q5?tYCFT;I<;FIJ}YLybBC&-DPZmWSwQ7l z@I2p6JEZ~nH-6K!`F4$H&o|xr zrmBa2(a(||nmiVsjT{3yp^h)KS;s8W@et^Uwm=;R!n2()x4yo|j&G<3yOe^=L5oWc z#|PExmp3(ShIrj*D|PSs5v%TW+LEgEtUcDWc_FpsB3o@uPo*kUJ z@LZ!?w=H(y{y{rbw`zwc>yJQR9nK4Yjcn+zINe{pl?BhBs@ycuN894m=8rpuU-=xK zWrXKI_a6ZpG(vx(4F)E4Su^Nrcoq$w+e-jDYyf{L4Md*^!?Ucb!AAn{%p>~1GlB44 zct0cca~Ex!Xi#mw19*G^HogM-x%)xvXQyA^x4Tn6cY}U*(%jFty{qccUaLUXc<^1s z@p<6@_~|ZaJIY1dCIZcBC}TVVx+0FgRRI6*+dW=Ed5EFS4ow~hwipY~(vAV!pwIkH z`waT+5qNH{>3IduJqGHJU8CG*9^taHe)bWcc?`ptff?XT_`dRyop$Y+X^@XVJ{(qn z*8&~|yb*ACMj7(vGkjNrO^+=Z1JCa%{rn#4b!^Gg^`8U3Lz6)+jLop_7X@R-YFGt+ zSOe|A_Q4vL3OuKw?_s?t_!^EM^ocs41H0&UvX9^x4ghTl_=z*NdJn>SB|yJ1p!UbB z+RkW`8!lS^?!d=Z&xGs6(68!=LzBmVK4_cgUE6#Own4o{cMtD{^X*);!@#3scMSaC zs$0UPrH8`YJP$y`PQW4`W=GKkbG8^u==ze+u#WmbLD`2fTVGTsItfBg`=yEo=YP@VxL`NH2%yK0mRO8t(t5 zDHn8XK)Xh*_G>VX2ituNJQILt+6Pze2m_x}VXlJfLz^c6Z^*w6JYHW7V|GH|@Z%^m zLG62E`4P3h40vyX_UFK}`{!HnH|(|BH=GZ2AKUF;QC7U>&+;a~^QU2WjyL|Brr#*5 zw=4T4Df=Wx_S_h<2Yw6Lu#d-iUAGhE?g6<2K`uN)j?c@kQOCyaz_vGCgU=_&!L#r| z@Uam1SUVWkVVL9MVGLRB*c}*FQ%8?d3&Ow)$8RaL`3mrn4?qr%k3F_}qNz#M&s5P- zxDI?3r?T=MR|_soU2!Ll8F*%1kD0%YQ44S_yBg-VRo^VzvFBLRW2?Ryw_{_6=z*^A z&I6qP{tENop6)7lG0a(`?XG)Q!1M0Xhv1^+=0)Gahj<(>1Rt6X`ocS%HX{Z;?7L=v z34YA$_Crvo1a#R3^jAPVoI_xrnu;|439+0@A}RQufHuq}pvz8JlW`8_xnvaBu{X>e zi(&5AoS-%zw!02`a;$oN6Fdjs^I0`@<0)!EDa;x1L2D{}cXvSv^g++RsHt!olNx`m zH8p%G;631-0=;Xe^~_v-!bZF6+`b7gHeoK@1^WeFCmJm^e2?98&@RB=FNEjJq3pWNKu@54vR12CM``Z}eC!*lriAA@J{Ef~j{y1i=9Y>2;rvDpLkLt8wj*W~8y!1V>& zfpcIru7}`rI9B1h^y_7%)!8>eTb_aU69BK=&)}K*1mJlSwCNep9kJI!&U5xRL7Sd| zc7|bHd@Z52GdyFSxbaMQ9{}txE`ag&htK{$_TC4+s_M!YKQ|ZTCIp2sDgvEc1T_iN z$)9_Z8>QvuZv(*^FntXWn`jc65Ug0~6cn2v^f!TE1+`NfeJ@ezr?~+;I0g+JJEYZl zF9=mAOl4Z%Gazjff`3r{To8MI-*wJf``nzHcn;d>`+VMK^7)+Xb@thNt+m%)d+oK? z-sjv0AHAaCTNwL^Xo7iwuI1gNAs+8 zzRZK(K;JNL&%^jG!8rd4#(OcweG%+>VF-30Y91YVz9B#7G`?GMhJC#$kS)He@H~7I zeU9<0xj&5WF&wN%`@7Na{|(<#knxP)p;zPiF6G1WoPcjdeAe+yx_cD%Mc3Ien*V9^ z>0P*j_@={p=o{tJoP={W`WQw(b+5wnk^F#W*afmpWE(nAZd5kF zPje{wLZi*05w{C=7k>XMrhin0pTnA0{?PA^%|IU8S<)HLu9hVsj7_2ee`$9oY{K9S zmp)EM>TAO{DhPpw>Qm!86l2lfm!aRsq5nP5gLv5agwQ7i!|nVz*lMe-zaM;j%>_H7 z`x#?k&)x8=;vfU9i{`I1%iQ^wn7{B1k}k4sGVWyl!gnWHBbUR@z1cn`@@3eE>-V-1 zOsQvrwl&@re3Z)2_eeHk3}VckzX1NP2mdJ~!z*d7a)nZ~;BNR&8Q8QhKZE{^U~ak- za0c3VaJtq_zS0-*-JP%Ex(C-5TphTsgUy4#yoLBXj%(08Y2OKVMpvT?_Qy48-*dQL z$Mrt0iE)$mP0}Xq3wpJK$6%LlKzok6$EMXRC_A*_V&S2hhMGWaLv7$$eAi~%4O(CZ z(R4TT7j(5l7mtr?pE4J7@gMMwnr+&cwDvKO z59~y77I;_D_)KAGI42{`lUw>~@r`MgMCbM9Po9 zAMulJ{sZQV&auslNWVL;)&jqUO(Z?@p0=`9q?BmwDs~BYnF#GubygL zxBs!bWz` z$lLwSv*iCIcMZ%E+v(PACxYF6_*AFJk7{{En?yFdBC$= z@e3L+U6|WQPA%bx-&hM?tNf~6__kFizBfhRJVM#6doV7@_VlBzy);*&?GhiNJer$E zwBMK?``uG8SI>uyo(Ef90-OC6*zRJ?)kW%?H6-hL%rPfm+e)UlOqmOLq~dWSF zLBCVK(l?EW4y}zZe%%FoZ>)_Y?i=Y_Rr-2-B;TIae~8;Aoq>%<{0Zwyt*am3^m-_J z-6HW>>HbdKALIGg3qOYP&fp@N)$p;B`))Y(H00Y4d|AK;zvpkrmyE}^vS5d|CNwkz z=v!4TjNjyj)IbP0JRa@f2|SzMP#@?={Dk_2Vo6ng?cQGk*C3wtBfc`XA%(U=lW3iT zLalq?^F5Qfscisu7Hvz~1pl!WK5-TN%EpYADNU{`8&3ewGoV%FLd*r}f>Tw2dFaF}x10Sy-y;j-o@g9HdVGeqwE%r$#D)xB zu^vlnhHqr_x2~6`u5$fQUzbrmiYXCJf;;opE%G#aSFgetC7*OU<_XgCV~G8{0~TJQamG~21Z6x^-PWW?akO^dH#+NSY zF%%>AK=eO(AU1Ydf*4AbC-@@;zlUPFC>ugP`2w^qXkETMaOuKgZi4Jar*wYCg|oq`c~C+ZR@OtFNS|<#3A&x0paZcEi0XPtc8iz+i~$j#9!ol zTF3(#MX!aMQSZfvz{kgtT_>TZhR-=tEO+D>=GR$n(SH5e%YM`r#@s`)I}iUl=O!9OqQJDTcNeeUa))+NbLVViU($ z&&~oDJs*T!jh_(TnwqB_oHaIhJ^}MZ|Kekg4$<|6m_E*it+ zi_^M`=tj#{_=uJ*@iVt+WZC{bWPAETv}{eijE;ML^1vPybMzoSknD;Z8ib9S0b4!@ zog75JQOs)o2M-<^!u<;9$n1s{;aj02o3HCVpYkm@k8^WCr8l^s!KLe zVqJ;AaX0F2hJI09Do6Ea*Ut)2-MOes^@#p6ut#3a)0(e&AX_8OKyvxyfnOT&NQ_T` zM~j^%p)KukaYOmwKLsyB=W9ub1H1IK&sFF%>Qm}3>N|?7?nOE3vw3Le3GiMDUdJ~y zhG&DY?F~9LxyZ&ddTRg6$ z*5qp^5AB5v;y)=qlzdh2L;u)~dfbcR{tYx&Vh;Z@WJ%w+d`PX8jWwv1i&%_#4n)4Zt_x_IIUB@U)V@lYp2k#fahm9HcU{5EI6l zzPtxxn()Qpx#$zk6Ex0=_c-uMeIJilBk3!R>FpTXiRgcdBRxF*a9fuvp(~+bR(Lt; zv|_zRbM^_0*;iCw8n!E3Mf0cZL;WlK7MDK0X#JUnxHiQYt1#v}A+MCA;G-VI8|eO* zkn2Y9No)M;Mu_#3Px6;q}$)2o6t4E`&wI2bK&{i(EG5rG*8V1Z`GtHsM`wuZ$f_} zzJBVB>-*a9t;Vj`r@z+rMfB;rz)OBP@rDJqzR!WZK7Ai>?pW=4*kRoU%3k1n=<+P| zC(3Lk9e^?Eo(22X2sy1-R~0Tr-32I9ihYUg(6hOa3ylx>kc%jGt@l6p!W#bh4y0sX zDGo6nJf?!j`M9V~i{6HWA@bj!0j$A3P<`T)QreH9XJoH+T%bYwG6`!M!YRlXJ^|bC z>FH{P9#ZU&_{1LaZi7$HPzd)axF2wPO5wX2ba9`C3pDS=W?OlJE1WHDgI@cp;Lqa& zD~ex|VKdrE`xGQ6*vCWjVH?RlR>AI<;CrW(!e;92`~&#|+{Og7aW2;MvmiUf>bp|Q z*Zr<~SL+gzG0DD(`)7Q7@cas_y_D?HW{QDOEaW+qp*dwQ`s88wGS6w+E-&K*$v2Hs2M!S9(r@4<|jXk z{D2ayA>$#}TcGPn@tC79Mykha3Vn%{^S&tG`CAA&or&V-Hts_uupW^mkBqKKP(-4%0lj8f)BA zy+5z&N`y~zEA*A-%gwH9x4(xq_&wLRw{3P!*!~|GkF=2wnFwEr#`AgT=oIjM7IVUQ z@JsvOo$#^f9vTchRnmX!BgxHA7^t+vBDT)rTYHk+`Ix zINTe4DeuRhi|Bi*+1S&!JCh*o{6DO(*6-d-oy@~~g2*Qa_kUwbE9t=FS+LHP1CS8vC)8JFzQ+={-w3FYs>zRDI{q)#Vc&)&bW zeaiFx_O>$D#Gw<@x3*QeUHTusfv~OO#&< z{uV&50B@ze-Tj!O7Qpsyo-n@kVa!q3|2;_iy<~S&Fh*9uzc~qc&>Y?gSwb&J)qz`rr)OpNI<$Vy`FCO#gm?_r&!CCU1yMzt-yLAts3*( zdyotH04=~n=ak4kUWA|M0Y0*i8^MQX!qnCT;3PXq=ak}rkLtV`H?@^)VT9KyXJIS9 zif8u&*AQaBRroeN-reANfX|-cyvG{g4PzXx0gWXX-~BkFMCUt>xu@u3u^;eJhGj1J z?lCPyGD)DeAf>jPMk;O5Fn)i5wwyz~-^CmIhsUtiFmRiD>Lgp)le-1}$wu%(dxRd> zw0&`y<5SVr8EC7VZGvq))em_OxSAim24w;yE0iZYO!cUoyWzXx>s;69wv=MT^zHt0 z*BQR@0OHLp@MY+G_hh$d|F{!pyf)&}^B(j}rLo+PSa25F(+hhtfcZ^gKa@{x?4Js| zj{3CU*Mzu_UhbNxa(GVV(AP10z0=VL;L~=mm;5i9vk6bfsR+&+IN19{zx)((r#i_& z?bM89$O?1h%niYCkrq7v|E+aD`44MfdGaUPW!wLxCAa-V^K2hLTC_n6|5us+lFw+m zp#>3Zn4_KQdl#`QuXbvEyjK2S`ts@eqG3-tc^YJPHd5XU+v-GK8scWO1}H&!_(=G`#^CJ21nfs$j(w>s z5M!H&7~3TH9e;zf1a5U^OwI_<`DG90Ia>F0x|758@TcP8H<54T^=Rd>35A6#>ULEc`!o8r`xxO+i zb0_5y&mHTRhOzgw=mp4!;`(|y_foSQo>RGg(0T!Ktl}~QIZ^W~p6O-&4)Zi{eFR?G zrQEEja(J%Od{#T?a-$sdvI*rVPoJCJ!+(2Z`b{)9PsZH52xDd;#!eZ=&}|q?UqvkO zR_yJL(a-FJL4$tl=PtFrH2TsT#{M&CLbtk&IIO4Z*m`#;%gK(d2r^fe+Hem z9UIyK8SH@mhS2^^&`ET3cZ#vkez24MycCSn7MyLP^R4k%ztQ?{F3z~Yr_s;2mbyHf z8c{YCcv7wk{)T)*vJWo6y8h14bb09g|6#;`6tqc)NglfXB9Hi>dJ&YR{-ft)4_a{L zAbxrDkM|!MoZ$|g9A}(Gq z^YQUG4+>q=+k-P;cxxp|%A{VcmA`~B(24#XgdQBde|0zxZJmqw*F)sfUOu^1gI#-v z$2ekf&ktaqkK%$J7tU^g-}s5`zoWjPzCQtaB;(}q+9`Z3ao>q+G{jHR!grya6fbb2 z+#qnKx~jsV^qIof^>{LopE(E7g($7657=%+MY z7V(I04?y3cW8GosEZIehpGVuN>VCsN?Z@*DloLBe_oQ3Omeh=eouc)HVW()Uq+$Hh z8i4fv1jgr&Q2zvc?lkB=wUzcN=*)iVn(yj-_hbGziVHfaw?7U#K{T4L(EKN66osA> z`6Fgv)hCL_Nj$Zg^nqikE1*yBUV(WI`bqKZ@mPz@#oW+;{nSbG4eXC@TfjHbrE=A880DTu9?eBGKgzS_*CYOVntQ>2GR0&t9%xOM%IA6- z(58Ce@5H#J`KtcU^xJ1z+A=*gV^DYDo^Xy7TWG>KYA9d-yLYgzBY%h1@*eCp{3XtB zM#pvNj03gh82l>Q%aS(rLk~u3lP7^Uvt zox*Yo;=Ba;OY>Py%ONM~i;_P_a_FoCmA#fy}8y^Z@N0<{?afqqv{UOy$Djw8AJbB?_eSlg1}^fcli_pA z-VEWVJhG|vn2TtvVVs>xUAOPC+3~+>+xU~Xsk3nQtpRZAb8-6FH`+HU)#CRNZj$dz zoPleYw6QH-$7}2_ecEptM%+`?`7h%)4dc4bTm1CzqCEqME786f`t|ur(Dxa1 zU!CMheLe&~ek0_ch4wz?(XxMseyPBGa00ft3Ux_0_u)D1=a3C)MBluIx@qIWIX{Oj z+)sUnefar!_vT&H!8dKXTi4tj#{EI;JLxuO2!09eZ6?Au*#n>CXRxIhujQL@?*0+i z_)WC`cpLBzxi8;GecTFOXkWAu@4e9e>vC5@YgK&kR10+MyYPEYzz!0c^mnHQ`68FIPWz2Z&S{}oYMbF+}5~W{6-=A`#9#|NRvlj6GbBK(8UL| z-524XUd+P9>mssIH=~WOL9QiyzTpVkId9Es{e33d+uz9ToCi74dr2G7PLh+8cbll4 zBoqCd^@9ng8qg1KfzL$bC;!5&-@lA|58Z#srQbh=dm2y4chH$jyrc5{_O^4_Ym&7~ zJah=}OLTpV@z4VP$nUPduCFcr`nTFr@xDp_J$M%ub3-rMG0+(0gCn2Xdm3}fnOC%} z_g$xLrMO*qAFUB5gbt&;@$RUxHlcA&<;gETi}|h_<-?GlinGC2ku?RC(aXY*ID~S3 z;5`F5w@XY8ev2xLGE{Z|^X?g12cS$nXnU}q;Q0W*7x@*Oi+UgadqGqkQbPwa)b``dLF#?|S_u8ugolL;N^ ze5lG?J0Xww{fK-F;3C}Tz*988{fH%c?tMs)6Q6TW2-Tm8l%KoMbSSz^?+4fy#JcZh zH|#Iuh4)A@G}@OKhjj(yg?M)Nz&oz3X@I@1-Y+G@Yv(mr^Ox%HPrluQ1N9!)gOAQb zUwB+swkG`K$|p-6^gJnP8vKf6ulwKQkq>|2$-$4C{yF~oE1%2)JP+fW<`S}J9njfS z-48V0O`eaowxSO(zo>owR_@WWvjTF@TX(KUyt&+sEGetLEkmz=SyrgPum^TLhrtZf}gAX84GN|60-~>;r2J!y%_jWrZ$4yW^!c@2)MnzrdlY{B zc)UxEF-vWvcR&q&rglt@(r5DFS+{w7qa#9L^cV3;z6Z&D6VE^6X^-vWNKP`%Q<&G& zP>%X8#=pRt%j#e3MSJJ{IimY16X0`5JBeTTiGGsT@%7}B5`U%-Mfu{VR>RNv82;jK z;2%=|3_csT^=LsH*Q4{ZMm>@PwSRC%LTKPIZTG-!&}-0X#~SNn%s1~KzG0PV%bSsM zvWL{SG=6WM-q+^ASOz^^&nsqmp1czK*iCVex!Ql>cWJNC&Nu%%#v{rPqVCcgJx?}V zkrxg@?zGoHW8p5WtB+!iKZf<$N4O_`j*g=^g5eWZyNxkV=hv?V&3ar%Az#6{7&vJU zhwAm8i}*iAd9vMx%xG`N(3y9*KktK$X?I^aL}!I=$Not@>`vzuTK6I763I?}Q<>(M zDbwF-i=Yj}=Z|sTy_^>8<&;3a@mQk`f-c#Z=~(-R-P5`*Kt7}4 zLETf+(H`oP3y||s;3It@nH+;&7;7S9zl&lL1CTG#TT(;kJtq&XgWi$cj?NHW8_wqi zlqWgRyBEas%i#GV&{!R(?HXO*rgmBNYye{ia>?kxc=;H1;|Ay}@!pTKL!-6rKG^Q2 zxG5)k!6Ws%lrwbNkmLK{rw{#CkMkaS3>Cj0?)hX~wg&F|O*OwHwLAkMg2F zCD5M=ystOqX~^GVPdfKR%9rBzd&!}Wgc-opZ;S|LF zX?)Wj>^sQwTtDr}s~(*EB+)nu+~gw}&y00Ay-)hJ8QNC*J@ZQF_(jB|+hK328dJg- z(62`^M#v{T1AHHWzh=-g#+qS6I+x!^-~ZT3zHw-IR@evseh_8mLzjn8|0L+8Vy?g2 z6+C~__k-b1tk2%XnUmXa=HzmmKkS_TNE@9w{1)~ljzSMZ_pb`iaC!DUd%rKd4tNZH zuj)E|+gBjdV#u}#GA@Ly3lLYucOu+z6xT>Xs=x1kZkC2`udwXhF12T&pBDj7w0}-( z__OE>dY|AN?nm02CwXCCBdzy3ihI!fZ^Y^;&x<^oTRqg)siS|d;E_-HUICr2Av;L% zDk#9NFxoH=-!0JZ|5ocBg07y#b6OXz#CqvHq>o@tGwFuc+cJRnb;$f}m+>70tfRK> zfzNW%eMJ}HJqlc#U6*g~pQ@F&W4_NuyC2Wk*micjw)^Z1?6H97lb9FMuqNGqEyYGx zg!MQnd?<>K&O+Xa8NuBrCTqR{j6YgCP%P~xtnrAayTQju-($e~Z!5jmHiWaTIv*%Y zx^pMmMRF&ZdM876XtORmv{BB#U&^;0qH*UDZuAe~4qk;g-n03m#)MDK%KOxq@B*}z zV#2iM8AAKXhBQHb4Vb&Z^KOa_m&U_iLR*gFqW5`;Zu2C~Pcgb7_;e>A+a~DqI@n?A z-vOL~nhreCG0$L<@m&%+3(yhm2jZUaoqaPdgm=uahJhaey?Y#XW(Cgr-irMz!dZ{` z@HzC|dsv_D{6$mfb({~*7<*gS`(qD079W>)=$~-L_qjanAkABJZWF#>ImN>1{Okh6 z8?hEXl{$7o*JfAVp?NspOY2-JI}dzPyHBF6Xv4j&m}7T@BRLzfH!)J2yYrkG=l(f( z+y`H)9WjfCp@aIEfqafZPSmDq_>@EFcU?y4cRLw*$Fq!3c9@KCPxxs3oyB`^x}2cb zhzWfz83oZ+Co&?s>7ZrU1jAn@o6t=DB-%^1m)2fYe+Yh94Lw?p`Et`34L&x#&u*5d zzW)g8&R+CC;Z$o))&cV2X#O974yg4jfs~&7Cu`sH#rYBW3(H1;rEQ(IH;-UH3sM5A7xOX+;?)m<*v*-`_V7fxKZ?3S;yaYfy_UGk3n%jn)9gd!st8N7p6IH&y8PBU5r>DeE;q)@SMW& zq*?I25%7xnX2!-#_)g6nm#1~LEBqq$HN7J|8E^q$iAnAK#Q0_nmFpQ7e(6Wa+SZeQ z#`lsyJ9-@-0$oJai_+ z>&a5Ys3ZSFJ5_>rN%vyybj!MyDJS7?MVjJ5YYGrS!XZJ3WPmJ%{{MbEZ z-#`NN1^zL~AQ|V^-I%MXZRBIicc=EMF+2@p_!>2aX+0ypvdeXCYcs|$_AvZ!qCNC% z5dJQ`pEzr*({~f;yKVfPHrRp(#%cHVLidi=Xj`AjqP2$MLv~=Ucn0eam|cIf$vGQH+)JhHS*oA^U#J8~xbBqy1y)f6AjiYhb%> zoawndbkTaAXT5ozht92vO(#1+wxI-eAptsDMKON(53~m$XA0;$Fcd$UPv`65OKe1Z zH<|V;v5!D~+Ob~K&$iGyvgaM_i8p;Iv?p>4&imXPqVqm4;rX7(mqT>UhvM8c_Bz*3 z!?~BKJ)P^X?HNGKw$uH$Jp+ifQhbg2dcaL*XN~h0G~ae$KP&X?_d*HqYf^DebOH8_ zW`SRNPjoZ*3%S41vz+`<@JF${c-jjEFUI#1&3U*Q-wNm`z*z%4Bf055zuN0G%Xum9 z6~t>)w@lKycdcI%rn%uq=$m@j0)3xW(ujR9_7up0q25_E>d<^(1 zyXbwP7tlxF8O07fT_JP0d7k7V&Xaudz*p5-l7=Wc*wZSfcl(G=C*Iuhf?Lm`{CVhu!n^(( zCSL5j=y?AQ?}wmou0*?Xfcqurj_^$94}=dnQ=sn;)Mz@-=Qy6<3waETv_F9HL_E_P z>TLA>zzAcmA7l3{bd`9mMyz}Q_CwLeGvf98=!@vJKy!)V=XO9w9pC|WOOFT8J(U+5 z+4=RGVIwKdW!OlZRnfm2M6nDy-xPv8DfWB@@*64k94umg8qcHYP@hE88F=%uVRUFe zpW;%#wKa39E-HmP!`M`<}8M zU;Q^5XX}`MqrZ4O?Ed{Np|`Pi+l{e+@Af8@V%@gm@&tX|R)TfgW{m%LVWS?|-4uEb z>$dc>G~_VlDQAU(O9}&NJ3+6wB6q37kK-Tep!ez;5TF|Mjy|1lQv`JRKOv zPveraAH9CqFpO0?hw%*CJ1_FKyO)G%UDgFWWIygyZ6Dv|wX|K!GUPs*zV3#e(wdCM zH?{xstXrx5PS#{YIlQifuG;edMb?{9#=&{$Kk-jCXAQ>c=i%RrGtW-=uL7O(&{Lf* zbn?s$%)!vf&MUQ?6R=56bTW8DtWL@v=lS2eb)7`;e)nHXCuuw@oy3?Eo$QC*C4WeC z(mNeG>85!VJ`(F>vlp=f*cv@n06cbmT8(%a=It)>eTLZr+>^~Y4_l+l7B=OtrjxK? zI{#=p@$ZTnQ(v%*scL-pQs*CKX&+hU0GdyT|Ie$3%?|bOF6d#`vk!#gVWS543>=-G zAU}}KP7Fa8L$F754z3mUg1+TM?-P^1Mf)?Q@SBtQ>|2+6X%EHEC>}TuZ6C-&JP|(6 z@-g8Y-QR*Aa_ki&Hl!hbrfd~-gW6m@(X>_AXW2??biz3VJXP>D_rW&o`y`TsbDH5s z@Jss>v?q8s&SBE`H)y>@XE9r_{*p6wN724bh*32mMs+L2s6hWHu4ljt(d@;0RHC2H zz;05Wm-0ZL^z#_(Cgn9_zm??V0o??&Ipz!+kwe(87{Z!55$E_w zeptKea+{C5fvNabbX+)FXp`SebjTOg!0)4^%*^u5{|9zR^h3;&hAxkcj*=T{Dn z2T$}ZB%E2%ztMd+`e+{V6LHb|jI<9+j@~@4NudXW=aT5YEQZ+LqR? zw0_=*wO$MSeL7D?XJd(%O}w6N#4|b*MrUKOCiGR&nK1PC3GkDQwL>%ZZ0SAJ3Fw?_nZ$dFita0?%B=ys;^jLU&X&-P+DzoI5P1YgUWxtwH2Dp%FZ#M= z5cbovEf|8Xbq)Mf3!Oj=U>5fI8`o9o=aWc}NuP(H-x!zA_d<_mqfewi8nLFK@#;Z7 z#l4&0!_yjWHsYqFXYF`ajaX?F*PX@Zo(Qk3hp4Xj|5!KZ{y)tFO_=YgF7`8Xmt(H( zKwHzG*En0Vh04!DnawVIPh(A2&->v2J;d`LK|ifr^R4h3;CTyZybby^o>H)erab{F zw{p!r;rEgM`nm&;9gP2V+f6^8F!cb=m0h0j>$cZ_IYB>H_A~V9d|D6v_qbCo>JI9mm^fV?X*4KXV_BxF!sx;5ntQgC80@be;`s_?Y+6Txe(Xx4NgV4L(L=h5CuU z8Lju1o8Bo&z<$km?As(_|7HUAaW2Q+*cI3ti&OhE6qAzoC#f%~PdnT=|NSh^MPohM zSzxT)K0+*OH}dJ75qgJ2-WM6f+(v6j@*8PANqRu*#m=98IfOIJJ#=Q7_@T3(;L%U# z(>)k_A*_K&_SDyxx(7jLnrJQlb$t&4=W)T8(CEcGywT@niEgt;^U=EuA7NeNpTTP| z@F8midC!5?DYTxUH5jcsUZl3lT4`3)ngZpB9?kP-FkWa4cGkgq<^`0CIqx*edgctT zXV9Jz*E1vO#nXOTyVAQ5x1q1Uiax&;eZK%YP>S{Ie8i!RcOiDcm!$Xbry`z5@f)&# za-KqD0)Nww_+i?3$ayYo%Spt?Mk`A)*3MuL9&JG^t6M)ejqiS^V!w*)Um{{=%dyvm z`-9kXJh%zt={3YODIQMW{B6e>z=ttLIx!aLo4?<3C2Ts0y)2wx?#B09_R$$Q+JD)O zK5IoBoAie4V<%#YU&J%S`t@(*Y(i|4p3QT`w^CW`i*)Zmzb^+bbT093(EiUl2TAg~N@QDU?NC3}^BUPNI=fguqpz*Sm9i-X`#yN@<=);KQ5JL5Q{%Kr2^jD6ZJCkY znfTcYYeUA`i!yY>)X(&6(2{+>D-%|e=$Cf zyS1(FaJ;VnZ?R{2V}2+N^1&V;&Y>9okFxRhD!1L1m@k%kPpqf3qY6lQ}x*N z)Ts9YSUxnzk}VH`f6UpXo2FNlc6v@j>D_g1J+2p9Gjceg@En_%zvqHY4>mH!j6 zrhJk!=B0awCW&u!NBAW0(Y!@{xA7XS`-_kZeW&PdT&dviZS+}5l#fL7`*OsUWbW&~ z%9#7wL9Y|#2p9YW=zc;e`BM>mM`Z@Sqe5p{sn1_a(0tG(oCCT>-*=2|&u5WaDb59v zPLp0y8x5Z_ekg=7Cvr=}JB7M0NA?33*~B1xO1(c{A)CT+SNN3C{kRYB@5p;WBgvP1 zl&6HKE&9fW$`P>BDxRg+*%{ft!>A+kM4uLm~%(!g8|SIKXpHF&1XM# z0rKe#&gYfmcHRpSIeO7oq<@GXDLK;FyXEg0{_*~yNcl=jo5W%E8woKYBm* z)vRrV{TZ>1^{6jxB)z3Jk)D&SUVwGRc<3YTm(zG6pIB@H@!W~{_?4g=9b4@O?-E<} zz)zVEToPL){{!DF$M;{Z8lv|;T)&Q#Psg4o!O2K_;Cp>Rzt_^HA|;)92XSzE_ritm z>f%1h?%UeOvG3r4U!?mhiHJjE&X{|CE__GB7bU*eAihiTO2xO$<|YL{q`kOv_~s|= z!_k_L;#9X_e}leTP2aD6M)Tw(-TfQGupdJ{^`}H25_HzZqlhik_GZcYOsZfZB;U}^nv z7(-m=WUlt*RaNAUmFrO`ZpE#~=8|DNq*TQ>jZ&@FpD{Cn&#-nZ=ke7F{S ze7}#IyzjA&vmer4Iq_!1(hR$F!`|<5Kd|wakH_A@c*9IN5 zZ$jlDbNJQ&oPfCAk8nN)=NxwnURh5i2XHxH(wdFt?D_a+ap{A5pCsR)aqRf<^IhXh7r@WnggpA4kojX1 zS~s~8_R;y5yZ;>7)rmDyGR8EOXKB4;oP+Fi z<69%MaL#9z@jYZ}ulE$bYg|C@3KrGS1R`}mggknj!z=KG{~h(Uw6aLgidXKAk_07)}QoV3;9y_MEO#Cutuyw z-#-W4p?3!#o}hITeCvd84z2g}wHkgmg?=9+LhERhrBv2xwevD|{ zgEb`1jGcOJ-5ZbXjNjij;l;$M{{-EA7w~hxNHo@npo8yvh)^`;Mb+uTOfU?I!HeM7K@sMf4sa^`QnEqd(Kf5B>g{5uc%F)xVAS=H8-Z z;OuYtPRt|JF4Fh@e~;{X0r&d&xeUJzggGSzXAS-b^3G%K(QWPF$gVD~gEMVW>*W#F z%CDGfWyoO*&flcb*r&NBAKzf6Jy#dTD6N%W1dR1A*2lE=#o7`3uOaM5&>pPadYNqR zY2a?g8ky+mxZg2w%d-yHX7#MVrPGyXh^Of5-lxHX#MKBN$x!N$Uq-x29c_Z9k#O!N`AFFj_BUxQe)bh@>s2!Z_f&;@w7tbJ+DEw0V=XSYN84LO+(XB$zt==D z3|Z$xhlFp6Ym+=E9{gM24P#BN@M7*%&>x~hy4o=m8C6$%PeeUK-$mggR$u1t}E<|>vXCpWRTQGY6Y!7~F|14md4MY>McIltJko5rG%c1^(-HmA{ z$xcJTe(V6E+-ynmNXgBE_t?3pFMRHO{IS*SBbsqL5s(aDss~v-Q2Ltz|Sktv*4w{X7 zTGLVAg}|ruT_e5=VU>lFYqWm;c6536{(CHr&!vMrUI)>3lH;`&d2YwJ-EjAV2>PSL(-^X10(p~;?ipq%nWaZfnu9NPKY$A&t;cg>Si8asRFy#qOG zLEoB~g7pE}aI)z-9mHHmI+qZ{xnn|#UF&_5DuqSzC~h`QY0=#dyv3;L%E-<*(m zju-cd6vKeb$#9_i07NMd_It1)14Ce{o?(VSzu8U6h@h z5%A>|`|`3fiVFS3{;ZCf{O z`*QRA#aTs}ImN!hyg+`TKexb_Q_+HpIPiLD$LFIXJ+R3GxKr-S?T%Nxw#qH zMgA;*L7+I@m*dX}yqUJ3TWm zKc}bwMRW493bXV5+0@2NFkb{t{JBK|e@;(pce=fqF?gz{Mp%A z`4B`#VSX<7FU&0P75IyNnHj}JXrwQYo}Q7PlUWq-1@f{21$jjo1=;@MoIsI3J1-wS zU6heom{pLTm75>POV0%TB7bgHae97!ej!j7XA~6_XXoT(pbLuw={|HsK}KFyy1yW= z7`>ifoRO6t$bmGn3$il`i~P`xbf`pLrq7p?=g%n8yxv>O=6P4u-M7j+Bg30=_jguQ z-Mz9Q^=7Y@>CcA3Wo2cjqmBMdaF&?~srYhyIqB%P+`L?$mYtoERh*ffk&W)jDlGN| z0!6t6g}y*RK}J?)K~7$JUO{eFK@M6-txV6&Ebuv(T!%qQXL`a==$yke*W*D9$Y^$S%stFD~>KWEJM; zKfQXtO~&`ibA0a$m#UD_7KczgeU6wd~G@6?L`VJ6CzHuT9Xt_ARhnSF;K^ zb>IH>J>Q<~{dV1|?|l1P-kN)A>%3p`UY{PQNYGZ^dEb3?wVF{Chsv>V!I>xxd#2iP z9LBB1Mn~n*s0=1m(~zaXSJDvA!t2-?mNc3+3D=dlXwt)(4-MzYwCi!D z;(}kI{T(hpu3K>7Jh_JR@!D5#&BJvYuG?`f#&svII$Ynxg%~V;zZ^eEhN}tJdR!ZE zwc`3At{>t0@3@}D^;2BW;d%krE?j$X{Sw!|;rd^=V8gYyalM1<54Z+#y^re@u8(oK z(6Dj1Cg8dP*HyT1Zcdwu3%|LiW#P)fm5b|3xJq#?#I+RH9k}kq^-Wy&;KFb3Xb<3O z!u5Sz598X3>&LjB#q|?h|Agy#Trc7J7hJ!@wHMc~alL`-5H7?fv_Ih*!u1iZbGSai z6_5Ubf2Mr_7k-;X!~U95ZBjnEyh)as}2|9JX#~J@8VjAYdx-i z!1XY$$8h}+*VDN0dwAM*Trc4I1+IU?^#-mtas6*x@8J3quJ>`B!F3*&%MHE2btSGZ z;7Y|c3zr{P4z62peF@iBaD5HeVq8mcRpGiD*S)yz!}VQUt+*b+^&?zQ;|k$=4%Z8~ zcH{bAxc1>Xi0e&UZ{zv{t{+FtKXmJ`za+kMX=MTiRaT9Fg`718GB0cA8MIL$?`1E$4R;6s&i$(lt?G`aYpaMR{7^wdiw#(fS#X;={44Oa2y;fl<6VSv$#&6i4m6sj-w1-njUO=;vwpfJ3Y!i!s6JcWL z4=tL_pwG-Qo|*rx?8y^RRw$`}CgPe{#I}kthcQR>fq<{_Bk1h_gC?!ISX#Ey*}z!L zVO1ueNoyGwQpsqdSj8pKQvynQX+}nBL8byqYG}J+g@MsHnrw0;;NvQ*rh~ywGm9aW zjD~ocsBn=2*6GWXwq6J5I4*RpJix@y*z@;sZCA@qX3fx$+^l|}HF1B{;39hn@Q<&NA7%a9u zxu2^XQCP|ZG}Euwt3b z`KGiNujDKfi|z0gETSlh+Qer0bG4Vm&{$%nF}wnoSIKBh3pwg&`RLkqE z%>+?tV~^@xTc<%RmNd|(tco2X|>i-ci4)5@xzDMFLfDpaBQ0T(cwdBOh#H_^zI zySF$O1hn?ke1o$;`X6+CGK161ECKNbk^ZMwm78?4oPZ)wm-fwSe!4Td>H)r)$-i=aiu$cj~iTH#u>9i@a9VFOu=T_x5ov5wWKVH8l3 zvh`!T8GkRQ=obOacG-$TT2#n{Y1JrAlF{pAC27S2TW3Y%!2DUU7;0%nW@@DxqP7FQldB(4%!o^% z7_dt7A{P}C>(VN4$X@?DtO!@C>I_)1Sa~J>g>Tb#*{c4zvO9d+C4ERF$QI#b;*ONkNJRxyo>lvW#<0wrp3OR)i#0L2jb473&73yjeA+ zOh7TY4s=vnZ>|Q_UX2U_2a*;nGZ}z)DPXzMT3g3Puy_@gMFJjIS+yq_L@Zwa!&F(q z-~uyC3Q20!?P>gAHm4XN0tPwDt!;AIF7jlJx`QhjHn4~9`Z#s4>RQP~*P2xX6x;I45Toa49 zMk-2b<#-N1@N&24s{pyFS1n&I;9Abo%gK$&!g65&FFWXeh(w=eFl=TCHhXIv5o1&y8aT7^(k!R3OC<|%y`0=kR8HaT0w$@f zx(WtYaH?088}aTC%h<-xd!oz9O)qCspoKvXdoBhmd^1tGGj)Xwic_SQlbdR@+~W*( za;le;o1JDke1~2C^NcZ4%xMDR^XmE^xHACrzf}#=S*DvgCDjoRU;2mE7)SW|fGU^K zK89N^!liNorz-)K%VJYxOU1-{7CGw67;ccrjPk@G75PwJ2bU9B=ylB&>dtSJ~|Xn|UwFY}yRdt_p}OlC5J>6uET3|J*=#T4bD2p$J6N-P%T zHkep!-3Gx@&8;*1;3S@iE7XKs=Co0Qh`PMqA~Kg&f0!|vEY{m$E|0;|5R0Y34$Dr) z(#I*LI{^=e7}7I8k9)>}9af%u*N` zup$;LV^o!zX$%Ii^@$B^Uj_M--#{I zvC54YE2AhQQ;Agrgl(Y?r4gEf(19LVn@N6AuzXd%q1fMp7cE&GB+1`+%M0Zm?NrIe&r zQ49OkT)@yOxvS?~T><6h@nJ>fE*xD{Zsu@v46Je|)2xnFZe&t-rqRAOy~pfOuvdjeH(O;%LYTNAx1t7boghs`X8 zRAS{t9{5z1g#wmvmf0j0I@cvdk& zA%H9ar4gjz0{1BTj@4D<4~r&Xk8&JrO)1mUyo&Hb0ZoUiRzQiAI$PBVJC7^ew(M95 zIarxZ=EiPNjkficgfXc?Js_~0)Imov+bXe+Ye6GS8{UfCiL7+TMsE5PlVu7m16J%} zB1Bse&THnPn>lrG_FA-brK+;Hg+b9d2kw$!Dd(!g_vS?1O&UwAG=^7TEGn@!-Aa!7 zM@Uz4Ewo)glWwJzF4a_I7_d@%g7bGO%oVb%G98S1aieQh57yT+xKm}>YTjX{(XVKg z37Dj?*t(+Ixaba5WvPHBFShE-ENGKWUIctfWz}qB@H5yH>Bgu?(Q3wK7!ZY9kz3fq zVDGSka#yYzys(aaJPjCs+Xu-Uh+fI1`cPJ6vp>Q%_MJ+;D&Ci{!wxoqJATjRbSxEvFD-`s63{f>VjCD`?5Zku41HqqY))Z~MVkaUMnE+`71R#qRIZ`Uh1v>qmEu6XJuYf!$Vu+Dm<0uVoU@FAawp;* zRq~x&t>45b;Bn6S++DPS5xKQBu6AjH5Y{uffJ!c*iv&6PLr^y}o=fPWiKF3me-!qwuHmfQX zR(>$7tlS`L2UqAfD>9@KD|RiVoRYW}cw)&2Ra{t95W7vAIqNv54i0E<aTAID2%wY z2H{1z8d<`Nq*k6z$^(Vi-s9$?iK!@KdxnNgewQ0qf{}eR4LIiVC@ts z+G&cxu8KUL#sCyZK$(qbnq-6?PMvw|f_t*Uy->iY5gFj8M^q`bV|UujVn`*{rpp5p zvD!ir0>tzp_1%iY3il!bWyBZ-<<4Yck$}-+us>5XQFv3mVr#gh6~a1tMZ_a)ATH9rD`rLEy25q^%gu1;;mdm|0pQIQOfrLKZEiK80IWP z`Q*-Y4;)WTlND~Ik9{hu;s}Gs%`BlcM)hC?KU9fT(DL9_g=LX|LcmZnxiiTv5>S!V z6<6IUCKd@lA_D`Xke1ZS+C+XJazy}2a0?;_F)5kY(p3W&`xtED)R88Yap7`>r?SF= z$AKnE{~b|S%B)g^a#`i&V8Adwt;9qu;7ZOi^ic{*YL&X=OYNvQZ!{w3>pw4Jgli<= zOwKa&K<-S6pY!FsprTkNpij9fHS(f``G&LO0V&uZ69J!4wCXw;oULfp#nQ6%v>Aye zdJC}$DBc6KeiaWclU8jkty;k)skN_z{6JhWeJw0EAMitHwG2C%UP;lJ0ddK2ym5@c z!kmsyZiG`RXl0f1ghxrOyoz>+$7i^ro4I%gr$(;aNsr(N&kE*O*g;l@MTR=NqA2DI zEz3kvK2ZH?yO*){SyuU>A`?`JReU@7NjIkm zSG>%iNxo6YzsjOF&AFNpz(Qb zAUB&)&!kjhtT5jQIyI005P4q`V}EQStS5gECvNeqnEvTdqm=_9nv ze*08-5_6sB`Z|&+E#j*E4``)NtuAAj@s&lNO!;6fM9zC zJj_{c?c1Jqx#?HsDg=~Qw6F`~X&>O{=Id*=!A)TykpWsY3fyOsvvNS%D%9kqIjSnK z$w7rskkqO|k}obeoDTsPCY)n^^&F&j!`5WkTL;m#xhfTB5g3HxE=j zX2>ud^?cW(*sSkmFp1eT3a0Q~x?;Xw+L5BfS)al)b_u6=Np2N`E5;h~LY9CFE;F+9 zIX28UJI6`6vX>d`GqVmbc*M-Y53=fiNgh>k8iO;+N&Ol~%) za`gf}5nWDh`pt3!44zb3Wdfd7S@j0r=6|ay7xJSLPBBdjD2|V#)yi6~FVnqSdpKxo zM4K&@#%K?BHrdwN5L4@se$BR)ct$dKu7Cl1Y|LY0vhb4M!xi`^)48ZzOabeFiYdT+ zsl+PlEf&TRW9Z>537j~R^$|-Y2g|@YJn*FTu%6bj=)j;_v5>*HqMKz#fZ>axWDZDTrWdR_(J_npmEq+b5WuwQoPm+?+wn1Pt>d2TPnn=3aWq zL1(Y#DpBnAY3*WJdU&=&Bamw+SSv2siYl(?< z*3Pv|<0<6}l-Y@bG$$(B6_Xj1j}XEC6;PZgtaW;|1zb)%MLp9_#1&krUeQ}Dpx{B2MciVA z%{moS#-OPf0Zl;FXTXZ4nbB-e+$=r7;9-?jd4xfa@)wsTGC0x9x^!BLyBTrR=MG-x ztU`s@b}!7@2;GMg)bfc5XO0yU7jYPa+KS5AP#2GSB{zh6Rp2eEarFW|9#u?WamL}F zTfJap*~weJP}awoFVpUM%(Kw`(+t*nSfyPmDU2AqD&@Sk=-||u*RqOBujLd|hk$~} zfn@X_hXaEiwPIP4$lzL)Wvg~GxoD76N5|k!a^Z;{LqJZKic;^Q;%|w7g37^(x*nz~ z%OR)KU*>wfoMN>j;9<_vPqW%}x;!so0Np3xO3wPfwD}=yK-mS1=E#0iR+{EjO}kyd znVdyUyM2UD9Ns<>#oKND7{)r%X6I(*jMYjhNv$)03BV3Fr>Ni7FSl_gpb$#5i2Y6|SSj|pe zP|X};pg>kNgPX^zEI}`+RfLi+7A-3HZ<22i@;!=tgOE2DQVoi{a(5dxGbnB^)=YT+ zmNQol;wQ^Z78mB~tb%4RY+$IPl`aI=|J z$hu|fSlJ5BTB+2oY!!p6RaT>bn^jiXDvu$!W=_FZCxiPr)n~^8e6y2x&GgKEzA0f1 z&@;>Vre3K<*=h!*L-lgpVJflqXdyol(~H=afYtoSQJ`ck7w+WL>73fkN zN~~RIB}a~*kUq|}T-qH1nr-`rm97()F@@z2Q1Yk`-u-43Sie(O087{X4oNLlpVx=*>!ljZUaS3VJ9)NlXXwt2;(sd%}dS<^v z$wU1Li#at{$ZX>sV{i}OI)%Y>PVu5xQ@h**RJqz9gECR++qI? zATqOKR*^YeG6l2RL=M1?S_^vSp<^&~_|VbEOuOl!J}3*xjHq*%*>t z69>Uo*_K$LbfDgj-PK%lv#L^NSEYrEZsXLMFhwt=mVL@6YWTA=E$wJZGXs8u>g4)5!{aC~ev53`* z&O~gxqLYtH&ryO~8jNYgl2}?xq!9zk*|%N6%Yx!K6L1!2>fzF|X98^yP!Kt=W{)$Q z+Z4NH0=}iPY;B?}W6ZTnjVx5U)k394Kslm?HI;y3lCe(I5_#sC%_)kNGq~E!60n=I zsHVU&hoPoSV>6Y3Z%koOY(Gi~D6l2-u>sRtP8yV+8R8l!cfBA2ycOLZOweXf;YHNv$SG@}(-m zjsnhBSZc}{Z002^WHC`{N@|b!cEKFvIu3L~uuD~!RxaQig{4kPNowV#gdfy1{|?-O zGOkj|DJH_z48Ce+33yy(+43R?1sho^flV|G0uC@{D#oBntj!eEClxog6TxOKDhlX8 z@wRc5R}~f8HcNZhxIRKcAEW)}0M604YeTvXyh4rVKN*+JR6wL`41+7pthEeEcmTGzpR*q4g(R{% z7?jl_vLuSXQc13?nZX?@t4{h*)awmg3 zRn{E>cB?Ggb;G9-Gtt;al&$;`&%&#TM$8kl7rTku!%tpS4OraApsCr51r)6tQP~&A zcE)1Sd+8Jh`fue3@d{77@HCP2P|sA2V!*21R!k%!LG%{ap*(>HIFEkjnCW=b5U3JR zSa9%T$d}51iQ3lGS$U>*2>&LUZ`g?_o!eKzsnb0gsTWZ4sSvPGWmO6&*d4_01+i2? zN87(6XstxTxYU+^mO74@la|!7T!@gsE0wI4wlKIwW!)j*<0{M6DtsC-6OFBnvhqhf z3$G>`TjR2W8Smwk&UGQq9ggtD9DEO@wsIWspg$^;a)9C$mjeGpXaRthM>cOb28T)Sk9(N+?=z!jY5 z0L>0Y)2oZx_Ci&?M;B1(HPbkZ7 zyGju(W^_b-IK{+byC4=UDTa9Vyg&NEZmJOlEPt~D|e>A$~4QLwezg#si$JZZmR-`F;zrw6?rS+ zetE)G9jHib6U^H`0o!Ivs4Ra+|LD3RF}wpdog2+`ITmDUw90P88> zNyW=D0VR@RoNbo7*<*~#4&ILyazRB-g{S%yxq3mYsfo;183b{OLcB;oVIFgzAT~L+ z9fN{c%&AMeUBCgwacwMOTa6dQ>5AiW0Zqg;v50LoR@yBB#kR;=^{eo!*)h{IJuKfO zPW25GahG0J!Y>m)XTO;xrzK9CS>mk7E3XKOi`(H*8d8?XV2a9GE|QScI?$~RqD@7S zi?B|4JDC@GuQyJ6c$L5dici~7w1D{#`H{aEOD?@#oHQW;aw~<5DHdCDqA07B9xQ!X zI54vqQi)YYtNBR>r*LRrWpKZl#gIxy!?J-(3_tnyIOle7idC7=I6Ptn&QysVIg+%H z-mHi$6|h5PRa)s%O+|(QE45C}->J~7=w?s^jt!0joF%=FEb06)N{3c(A(dEZy~R(; zm5Hbnu!XZ|n@r$W&0<1K#)p&LG@;hdRPmAV;|vBEvwn<5$cZoN=xmK37fdjtg2!ar z){I)QNchf*O7fX~m5e4}ldF0wDhC^gR<2OxFM{Q>Na!NB)uZ$y!&armZ4jn$)WoVk z$WlUNz$(iMrf6bm5G*oXIQVRRES6=lSZp2VYM!4ifpBaUTPm^>WKt=!6H+rXCb1VR zXeYOCv4lDF%uB_DdD4ov;vA&t^NANi>!|@yT-_tJ6YJm_YmCD+eSg@a8tSJCUf6+s_|Nvc$tAc ziBk*;FN5-09kMz+Mk#rD0atRrin4#2cK4s=pr_IWO49XjE zC?)U1HJhb+8SGP8b^QzusI0O+9;BvH+d5)%SinI}alS>sa?Wz}&RPW*mcj8^)v%xO zh}$E>Kzh`}-6;87TqRbuw&KIbajM&`$n;Ewf&n{B)IuvFCj-sO(O(MB=Wp3*Zn=Zq zk1!XNZu+c^sAj7t!x$eNdZMXajPnOPR*hUHsS;}kS#c3hR!mMh$co1>DS}CY9!9QW zh5P#0zyas4sG**-F!#d{-}pOIL6T7tB81P|k(dnw9L|oLbF=Mf+UZJ$7o+ z!BxzOu1rAD5(nFUCmD-xj6u(dVp;1rdowAvmXmKrN-f#3brSKh)^Wz41S==9Brrh> zD8g|dPucC2m#Un|(^|)or*Ey~%uY$IUe(OQ|Kxm`hNsHT2+Kfr$)T45idY;-QjR{psw9a>Hp7QGb>I(_ zaM4wqI+Ij6m#$QV$^>jyS+;9HVfTQlBF?BXmDXwb2p8>FRVoEMuCi)IU3sqJ{GlRV1tJf$-I#Dw>HVij38~=!M$XRR4XQD<5zG= z_tBWKVshd@#p20mw~FXe+7``EEFOCgB$gk%9>vO+$X!P55_p>G#!J?CYL=iDZE(`m zUhcjMjv^5|0@rh%19K(cl8{$^o%Q!;8 zaJ9;^?SmdJTESha%Z}lCWn*m7^fH>mitl|?91QfO$nEDk=bCqJZQb5sM2b$K*wI5elmJ0ZU%Bm3K>`^0XsSL8oD$7<{ zUM?!H$m6WFfHKDZfA+oy&Z?@~|C~8QBRLD42dp&kkfDlbjZP+=Go5ET_2 z{>;FP49qw)2qGp7plBA7q}0Pd6&5KK=ARHTsYpqwM@8mSDl#%mN<%ctKmERI?Y+-g zXP<3UTl->-Z@##Is!Vcaz|fT@ zX{bX&xx`@t@>>Hc^?P)3U9e?Vf8bQEFjV#hgfD+jCnpAk4}!hRt90ox0hP*RzG zbf6sb;@|LWTAo)#z|^!&Ct&gm8`@@@4j_|UD`@Bcw@5?U;|%RJK?BE`q@bvLM z;O30rPtwRs^*tZ&)!?oSDw>zOqE#As^8r+3aJT9*5P})*W@{)9x!6=#3k{uNdQ>rR zxXu{jdFkse&77eGeYNT2p~Aa06|;4Q&so-5+yJDJf}3rc4lk8Gx*qr%Z^qcW+ORi1 zuuC~#&yBO!VyGCA=h2@w6*F{gQU)GKODA#*?O?cav=~eW(m=8~%4cx(&~yfdVl~O3 z0ccXLHW?~?gCcdgid1RT0YQ;TCTSQ*I13Kw6W#-LotSD(azsFVT3@}(79OFrFv(x0TDlYjpx|2AJgd05sKLnY&G8 zfqq~tZa#`+m&xPB3%dw5ONZy2K~`wq$^$tyn!Yf{GH_znh;F#$%H}bF}LgICjN^mOmdx$l5kOz zG4UJVndHi(;*#;q>7dmb2t1Qq8-N!!EYY7Fu?b;71%^w6Au&P$(- z(VnmM8T-L`d@IyAzH4-;ydn!`{joJHlza1ki$>n5?|ICaMsx%8c%x1+={o{_yv8Jr zDifMXhf=>Lm(&eqGpcz+n9M4Df&gz!tkuaq!FX+skFVxjwHZUPBQPvDa=k}qlDdk# zmYlciLaX#0aVJA(e+bIOk2$8YB`9*mKAn6o1m#O*tu7LM$7Z93hIL$N*AXpnpw+RZ z(Um+Ja6Qo^!+Ni>>!p&pYTK?U8tGDmM|YGt1_O|7<7v(_CVpfPy3VN|c4f*2=<3Wt zn!F6d&KTQQn3Lh_G`&0={VI)WP7A@SH%HSO11dQk{ec?Q93R3)WxWP92UKzzYeQw2 zE)rFmk+C`^+I2(=D9}eL7hc5Dvb= zZR82_WvXuuv2rQeP>niC-_5$)bciwJ2A(gy@FQyzOtLoMDyMC;xnd2lS;|W-Y)Yi5 zHlcj9_g_Wl;9EAv>bZk$S)pD&mFPPHM&^$aO$tDln-x{RVDi3vm`;ZCc}}}w>Z;d- z*{T}ShE86lHcp8=M@=@Ql!vM9rwa`T8ar{IPMSkf7+T{s$Z!sjsqM|6V9s^g9U9dX z&39C-(B)PIRZTF-wE-ySs9I;$o{!$w>P{XX^!tPfI=LnQU2fLV<}5=VM$Qm6_K|zt z(5cevn!HpYP6@ppr<8{(H0u_%1}&S|p_As&75aUZ2CWUSt}wN24nesLWwmbNe0|SX z6->FI!P0L+uBwJvRpry~hNdox0O?qhEZ5Ht;LoU%^;p7t%r-e+=+ z0aJ}8Y4}u#y1L+&ja3tTfh0{bWOaI+)#-*+vmn4<2{FkI%{_52?mm-yF=*5DIQP>7 z26ZAEpGGMWGBwGtuj&n-Mh1DjK4>cLrxW5!;3h1M4=E%KWpf&qV5X?K+dL1~5BBIg zVjgYxnM}xalcC)hC_)F|H2Xnn#0HU1=J+IRKei*9=R? z9+yV$&ALc_=UPpC&-f6S0!-4dmB-&9GvTf60lO1T(#SZECB%Nic`)}hm}$t&L3y09 zwW;u2V(1j=xr~7&I%A0EHS0{!%o$2(mrW;+rcTsUOu!9R%tZJW1g*bnu}~3GitZ$GP^?dOma^E%6ZhmPzfV(IghSv)6{o{wV0$~AmQAU zmqj&wZ{lLC1G}|im>rJ16l16^WGF!kY&v-;#xPCA1leF7hHKCSeRrLlGBs3I>LU4S zfr&wxa`|Y%T3v^E#}Dk8cGAUP)bsBY3P-L=68U_;1!o0M=R5eg1 zUg!EiRe?pV zuhz-1`g&7+7{#kM$<;b^!MfX5v$r&0bBsxvy=2BSnROwaX-?muIrS!49e~D|of$Ea(@`X90xEfxcuG@SY!FQ`5isju1gtj5^hxP zJ=j96Sc5}{EcceuK#gpC!aR;1tkFfxQUuIZ-DlLwY^fBs*p(`%U8{oH)#lfS zrryvoykduzlxaSC$L0ed!^Hf+-d}EWkVm(g57z7pdS{~X82f5LqYvZNUumijr{SF4 zI#Lr{9T09Y{bo4Fs5QN|CumpB1M@avXaW90lP+&aGtef^K%)}oZmWhNUmNg!#h6%A zE;se95BR>^t}T!LsMmxWgSsX*>*O5)=*ks38A|d>Q~ipd`keid)TpK_dGHvqzo#EE zaJ8P-&0NbsGu!S9qFH(DLD+SwL1I^`pmwbaYFC@zFf;X*1md}(+-g30$L0ed!^BqI zN`Pz*^61unx~>61^%Do`T`Chi6WVz+*ziR3Ijg~on<>SjA=%J zx!a?`Ca>gg(^pWtg8cf*)L`OqnAXfzt!WcPZr2EqscwJZuU%fEJuu^><cVguA)31_Oyi!K&1QBxO~$+ij8(p2KlGv-3`ujhNgFB) zbdTp309mTB!`;uEXDTP?B9rtTs|AxZb?31GvQL*b8-RIyLDuY4?$Jf_YvCr1y(MJV zBn_cF*d3r%YgT~EFXWV>8mm5s3EkZD!zR=CHP zb@#op^4>?6Rk)Y*cASEtj#oCS`^SsV@C&LO$8+6L-5sa!!_KJgr{gtK{{$o)C(#dB zXB8I%Qbft(;aR=;ue$r( zJ|}}{neP--QKH*PuEOcxry6*eK~$D%t^iVRLaIE*J-IuTpHO^x@nt~keru=e5XfFIOzy@u+-y?tOhP8EtU702mw8%h^cEk75HJ}N9es{7f@!_g!bVw-sA z+a3IIJ5lX1rFg;uD;|dIv7%9?5k$msK17^{M5>9GF#F-5PT$fndt6%A=Qtm+Df<1n zO_=O70iT#U9`vf10B27~YgzOsIbG5lQu0Yk12Rxk{CzZFhzWcwV2HE-p&3HY4%FfS zAEUZc2c4)ph!IcHlH$yup)BXYvV;=o$)SuD;1p8I-uxy<%ZAL5}dJC&MAiPHe- zMv2oiw8(LWkurti_)oN^TbTWLF)RBS1SJ}0hTM$mu2kj|-O&SQqTkMvX)2NGqy z8y+@}o}N<-{?9#zrO(RA{C~2Tb=`4BD3$xdxqYae=Y?fWz32DDAnK2LFCff2&#fZ7 zkr~=Zoj!`kCHkZ$7+A6;@)&;TD!8L$ z6DLsn9b8>eGK74*_*Zzy;H0Z>#eV|Gqw-u`xl{Zu0gBLK4e;q zuX6mlE!Sg)Ds#syq=|}5mE(TOr6;&QfM1<_mLNgNk@R@xXHler;9o$Z@;`Mw1R&e% zHl;xJ96-z52^>P|{(wMndJtmaJ3Uw9)^ihO0`dfMXMPxRX7VSR1Z@rWBFs-B5vh=R z*j-Xu=1!vudvkSFvbsL**n(S}KJJ);n}K>15picz*Xp*;z6c~$TW3>Sk7kTHBmt+G zqCF*b_@S%dnZ9(ZD%f-k-HArQ4;)TY!Ga$qIZY)CHkUic;?5VTqC1n4?g}dOA%=36 z>K0idQyo0LJDR{g9&~rhP z=ygopq!*)2dNJCh7vF*IeV7?`Un0zEPUFXYnVNSTW!(=V&7zkB-M7I>y=qoN_GSgW zKRxVyC)WK-x%+Pc*^f|lbamjLZa~8A#~^|vTw>qOA78MHG2Eof;lDs#*D#eY7io3< zmPu?tg4OjIBu@A_e$3V1^qy0ZW5H(rtNjxMt~nB+A^e zsdE4xfPZ|IguOS+rA`SOJj@cnF!x#OIoYF+G8z21XY%tfe+K72#?Rf4Gx7hRjC-LQ zHvIxOm2cC74sPtKgKy;yUW$4GIj|D7j2W)wa1|2VBTXhT+awku;S9t-$8BKl-4k_Y z26Xo%PB*#_;;z!u8OiYp5>z)I8MkFK3UJGQh6GplYa|A}hM)fbi66S$PPZH5oNsW( znZ(tMLOtlXb0jNsTpC8I`s?|DOvC=;sZXjIbnybB(ZZB&;{st9-^RrH6R-UIcFoVB z@a&w-q%PGq^->x|8a744rZ7x3t_LfImU9nQIVJNR?#mb~s&T!9_I${7N?z5&s9;&i zUv<)(!;SEhs{1}K$$s7?d#T8(2PXX+;#DznDo^s7kyCwQQDL3xlf+FrWa@Mlvtn?V z-$5hOBSqke*A3<0qY(0+Nfo(YWv)W`f7Kdd@#ll#Vgxql8*FpJ5%zT^7v>+Z@?Ycb z4xi`BuVK};@lRpae+xsQt|8%_~pTV49P6y@aO*) z4u=>HNlHUWQZHyuG3!TJ9r7_^SYPD!xG%bJvZkI6FuMJde4B6)Zl@M3tGbf!%Uh@8 z?hG-Og-X{`(H(BjxK$it3?iXb6B-O-nR|IQvpB>k8R0WWzhe!|SJ`4-K`?1VX3|Ke z>Oq=+^wq~5S3sV`*n&ko-M}ZPIVj1p$$o6X65Rt%)luDKuUuTP_$KO`+X|xn5q5!a z(BCK=i?X4J-zbbagl`l^yFlf`F8C{#xAV%HrhUWKkRN}{Bpv4tB;CIkVsuS-0pK!s z+$*@T_wW~!_y^%v&FmkRQrhNJeI}^OXkbQ|bGj)?+i%)4nB@<1#}M3|#hRm>K|J+u z2Gvjqtv*eq!`zD*_geORf@yq*ZX6q(+W2y6RuBCPF=1UZJPhBp)Ju_(U#v#M&o`?FpvfvL1A z@zKJNKb6)z)yUE{qI6ARSa)qbQq*noP5h`qVt}e{?;NoGvCzDrW_9}8@`HDB>6Yyg$E^-MhE!8^&4|<=CA1*N(i9wes+_shPmn!}TeoujnXrGx57ii0yhc z;ZMsl;fEgEEeRd~PUaO&#BF0H4mPM1_1&sTzISi~@aKlqs%(11ffGxblRuD_MOKGq`QZKz4f2)`zc1gx9IkGEmry-_FeR089C*oBbi4B{8JVVP zsRLI)(+V-j?~BY+k>wYU3toOr$hQ3IZw#sXyuK1V)tXXJAd8A^$N5)$5CE z_*UXrE-(xadXK;l=f)s$nlllB~CWz^zM4eL;oAM-_XVPqBzjo{R* zHN+NIi+OQ{nIrb(W_rStNMr_!;VBA>x>^)R2t+dW;@urdvnFOD>%kbcLN8o4Y(>(k znn6v~7vqC{3r37%QQc#05nsRLp2GaK)02Owfjyrlg2kKh`w4nJfPUzrT{!LkEweMJZJ#dO$UvJMw}<==r^#`7{Bi+NOk7U8*1Qp@%Bz?0Oi z5D9_FQ4A#@_8NP7R3dC~PcNzry}YX;66xhdea@piTK60GCTo5a&5 z@rX(M$|Qb|M7Xa0gIE5q+zE+}o1h_U97wB$LIG_2RS;lomLNb-Y8RKHbqSXu-yJ7A zg2fj_u++Gx$3dx`T#5o`1a@eNfKoxEjACS5ik1oC8V@lNMvpHL!YabSxH}vHR~C*% zE#Wx7(%L_{(%L^!`B1~J;__ksYK}i=&({@_&lWzfE2R0Tt32VW5%Rf0B>9Tyaw|aY z?85MLPCk29^88U4w75l!G4u4E^BkMK*dkxqUh$0O70(zPaf?3*kG-i0dNm76PtdDb zvL{me-3M4|D*d%W+Wb-JuX9>W_z!YnmHvj<6_9Y1c8clXOyI#*!Lie`#Cl6R)?3=K z-qH@04}0@TOB*&=+Om;(RK2@9bMMwud!H{f`;n~9*$)*)B1l!55%-scrM-_whKI<> zCh-ZA7=;AWy~HFYo5W0$xE_gkhXq^GdXuGy+owCMNNlpGwD!bAXQVhC%3hrGsK?0i!$xHdZymboh_Ub;vUSpui^dhR( zD!tV|Fq_yUj_id~?oTw8!x$%y7*cL1opg zg6xY-+k=sI{n$#lFzcec4R$qLx%sK%;aX5T-PfRl_LMP+{YoqJ~ zYoqJ~-Utg#oyv#9&*2??71<~+ibPv^5$+eMWfwV9+=RfLA}@+fe{AoO3ubq#GDUW| zNV=#5`$YLgc1;~95O>^64JRLx^9nY_Q0xw>;b(+>UUpyv)3Z`CnVlZG81y3F>!N+23*(WT$06w`u>zs@u-1 z@@krVgysppBIA1iK<@4$+M5l>9IGJ>?F?rMxBzb{cQNK@`DHFH@H*8XHm$qbuL*0& zzG)p<;x|(p{=zjJ(gHtrj`Izc%c0N=H`m`OqJ8oGW?$U6D(*W)#{!P+=7mLQMu`76 z;CuM&0)ykO%YG(jw%H@%Xe4pGd&uGlS9QfnpZoJbR(01%U&ust-N%!u-uZeHp&znd z*MBf2tC{my$r6$gy|z_Pe43Yk99ieE%q5eiWaNb}QSylcXwMELaVH^3jtcGK;vdwh+igMBvw9TSmBLmH*$Ek%Z+Goe{dVoVN7OVQh6OT zwKJ1hLO=0f#wp<1ZHlxh;xcpZlgliZyF=bQSv8t|*|Ru1iB)sM-vNf6_%NdgomJ3{ z$Lldjo$4*S!~G}{XSk>0H+q_6B>?V7Xgmp`OMbXpiJz%r)I^%KlxSU?EM;0OjO?uo zsLhbn&L#fzMbn)7`D7{E`J3?Ilky2eS1@`+CIhI{LvfkR=vpQbmprz84gV>EkUe7+ z9b51jcEE142*ef?D#n1RJwiIRFHXKg)m}P=p)cCyBp(l3y!)vp_AWAGU?D@kAUY`v zlk~)1=!9ijcy~}$O9$oDp?c+C(gFPO1oPTVNG**ger1`*95#%YB%?RPM4=TV{J z92CX2pHu&hQ;JE8$PvdABl@Bz^qiNM>ik5a?H)Yrxyk%E=Miqf$M{Tt&tAjv>}dL- zw^f~DdV{;T8hM{meEcEtRaN*L!aARR6zV1isH2hhDWw)bm+;#GdNp{7co*|B@!CK< ztxLbmn|8YN%e*6~){HOn?w?u;{f2k?RQlHfo-M8Lbq)RHYY_dJKUG72<}VBf4@YcJ zuQ@j-$D)0qs%=h2k5X(-M%SDw9|SPBBx&Uw1Ta+=8lo=u8KxfQpH0$ISv60kc|LUq zrc9BzOaD_$tz85wf0~rR$}z(YA$&6eN%t4YG?%^#4|oP|GKuJmze8ln2~=`>vY0)J zoF(4`MRO&Qa9>LHN*$Zb5i|<@z1+bf$@&OlAeEvs_0{*~ zWL=i5rIKkbnao)-WUqTF+#+OoWpPLQe-6^1%k7n-llRs4(Z=m*?$`0l9rFkhXE?NF zdxrbG0Y>&~hZz6c!8Hv3T-vuKQW?&JM*Kwf?C4!KLOwVL+zA_SG&dl5;0*|)--_{M zCdR`BreZjG&GP=`_2rbGQ;MjE_I+*W zhFro#L;HRSGbQs>G|XSh%!T>OQmgSiwBVOBy)b`;U~XC}JR&zK)#VYnyiYm(uN|gp zgH-8q>r=&S$8G|E6Q41OyG`P&NU+WNwn;o`63-$L9?Tl42c9~ZRZj=AxZGt(@CmJh zKbRF&;D|C_;5MkXs57Z*oZSM@00SOah=!`5^EH-&Tw^K7j1;}c7b-+^D(Vo-v=n9* zD-1k>Dyqz#or=D6*J|lcTZ$aGP@n94I}e=jd54w1mg$|sb*)R$jjr&k7VW8?a9R&3 zRvAp)*QfH@?+NF|>{GYW0#>hx$Af-x++``6sH$}6GdOj+LMu}jCr_v4YvB)SSn(`M zCr|UPCK~zS=+PH+D>6q-oyZ(NiKKCtmPQ^M#gRFml%2k=!=lVE=OZj-#yl{c#f1J9 zxIgYR8u?{-7mo%$);~1t5rc{h`cvKMG~`cpo4OkC(+}%_k4HowKEQcBVkIJ(3*34V z0$t(yi`Hk+so9(|x*1O%zEI(-GPDm(C6{;bEL&wiH!FRO)fzQldf9eO0Z(hZV&k8m zP#wi&Ap+C2tpxp~OxJqLbgj2c*LurTsXShMoJ2gkPqJx3cBIUD%h%l$&998+m+hp- zLGfU>%#hQ&WkFWi!5}LOhh}YqFk@wD#=%dxYS{EIF+Jh7$`5IfEgxy`w)`-KT^I-? z4nH06l^Nh;GVa=JX7ZD4GMiJ!0Nw1?gxqXSorY1XH+e$vkEC6Un9U@0$dACR`4UZF zvw!@r5u90xxZCv*%)>fG9D6qXnQdSsCeJPF;uuSL`e0rA^7MhZ_TeT_dHQr_Ki|nl zmK<}CB`XfPofYYWeOt34ecC~CTY1pjRvu`t1e*BEe~%^x^}q0MuK!nE)_)iW-w+eY zATzz5EYGhI5MVQTm_iy%D_2Z|y(#i<7(0W56R{(hHPt728pQ4wTp-z&O@#9YZVOEN zp|yqHZsYI_PZPP?62xa1J6BsW+r(&FHdFntQd=-zAGWp-t^C_U*az8`Fxa$D$JeMk z*ct@^v*!Wfbp*xCIPr){M8al~s1uXOJXsyaArkEi9wV=F&}{G_cEvD9s};Eixq2cP zA%vW(Bk~>~Z*fDa4zVG@_@ISeu7(7|gOGDIB+KXsSEYZ;Gh!P#5Jg_BTbM3U)+WC* zQCx=3M6rd6A4P=uF@74TJJnQ00##5e!y39e6U9ZS1}c)Ng0R)8bhghGjK-J<*W*>a z&H*3#q7@BqcI#jzRt{OVx>b+`ONm&Rb2+`E&Z~;pBi_qa`>!(0817)&+w+k%+yAjl zY~y?h7KzsOEVY&5!B{%5P_VR$9TO#a@%!V10TUWsDMlK709EqG_z)$=!qh&O$`#@> zeH=yZvO2ruvccS#b*eE~H^yl5Cjh%@E-41}H<1E+gJUFAVIbgRg3Nz+$%QRot*rra zj3K4X;q$28nYZvMct_ULanDGPrQ3-*L$N;@qX$qK!_>ZMmqZmSrs`&bJG{pE_CNI{`=|c$Hv0)$! zVHv9t0Jz^zry`%!U?9vYOXSg zCL{*U#!o1M^V4dRF23n_C@=m+J^{va)Tnf-w>rMvqK+3k)jRN0%w->0CD$|8^RKYA zR}`o`tt#-n9NJmYu5;)IR$am#nn4aeH?90cIFk0MT_P4ZnwZgO#&+Bb_?=Si;9Vd- zeSd-Y^!){X_%YW};?wsv>eKfF6cg&hJ^G`VQyX+{d>HTWF1g5U|JX%;x)2#jwY{ccNC$@$amui=*fn2VkUS1wo z7+)G*tn5@gzVyg&ZP=bRi6G(>i7!RAY=LTyWtC@&Yea%f+^&O-XBdyz9a*db{9Sm$ zamxgc80P}WE|s|x$;_VWPRzs3x(!|1^I5DbkO3}U4ZtI2lh@VTi_Q?!7Am#_|J+f< zOe3=5YP;_vZV3x2b$u8vJF8xWuQ z)PZUH!@@bqSb-b=zL_*4};&9a7?SA3z^KaZEcfv1kFFH7FQMn<1A%2fJPvqB38RJ!EA z29zwR%=Cfp8mCK6g@Mldugr;;4$~zU9%RYlgKlSW$-%a>_(0nkc<8H&Q{2w{efq}^ zxWwZJTw?11mv|-L62Y$XTgCKJD2|Y1-qY&xWlWShIOikWQQL>=%~llmK)$bn=CdV5 z6Jh+%s)TFO{n~Xqyiq;-lcnx(UQ|trealooz?R1X;#6OlsrZ4~@vzn?CfdDx68ZIH znKPE9Fnwf(J-iwFn-+>IEFZy@ULbYNTNb9#8fyU;P^LW%rk|tLRX>lMs>4Ty)%L(4 z2`sjyrS>g&F9yryNjPG6Dn9(+{{~%HOp$z#Qllo|=TV$DAB$%-^hH{_ypeA46hfxg zr1)he{kKj%3c_=GIN=?+j!58$1dd4Hhy;#E;D`i{NZ^PBj!58$1dd4Hhy;#E;D`i{ zNZ^PBj!58$1dd4Hhy;#E;D`i{NZ^PBj!58$1dd4Hhy;#E;D`i{NZ^PBj!58$1dd4H zhy;#E;QxOKTr~2ci>n8Gw0dguH*Eo*Udb!wXNlv zhN&IZLx-Mx%CM=^P9HqD;gr))A3SX8$tRyS?X+oAk(e@c>g36%PCjk$d6)GWZny zfAZi#Gp97vcQm&TYHpg+Ho5KkiBp=U&ze2+q^Y1ak!Vef(wZ2jHPO(TIAwNIbA6qr zSO*?X8+zh(!zMfJGbcAU*R{4a&1`U*W_37qb?1y5ch2Q?7mvE)yt?t1k2$Zd&Y3>7 zzOHq0Q(L<;dsaJmXsE9y)CfL3!z`yM0&JSq6m8N;BL8e7`Y^4V>5^t`UEX?ml` zHaAS`a5`oxk&ynNAMCOut@hbdxaG}Gv_FXR$)bCSf@$UKlbzXv9pswoNkG@mZs}-h zKzoQDMs`PAL%s7UXXZ?2ymJWy+Z&o;DxC3k)F`K^9(tk%cHPtthSg1JX=$!&xHf<@ zYm=un)J<)fRbMx`od#X-5QXSDw<^kVuQ-GCYXk{$+PNPW>Wt)w9T5_?98g0a(zcbyECn>ZPs)s3H`Rf zMm9D~u8&Y_R(zu6L~Cke!_*md%GykuJhh_*)+E9kdV;hf0&8q*nl&Q=n%dGD)xGvP zlOrRu4g-f95g|l^mw+}fTi4zJ^3x;mnX{W?T&VGp0hx(FMp4oVJqBjvDNVCr$Lp*T z;!%VdMJaO``7BbXo%=Xy^k~dWZDw77yloia;aQX(@N5`KiDBqhN|Wu7(xs6SD+9}6 z!y4woKD0n>$XhrB?-ihReK1Se5MI)f5Szv)k3-xbmSMyw5!(2UDq2CQ{&~V5& zBW45$`=RGaNfd*7S{=qihjSeUN6WNnn5i&W+sTl^o;od*nBh!A4Q%G7wamrdj2-Zi+ERGB>j?>02mRER98-R8!99gY_Qk*L1jDt4 ze!%BorjfiieNPFuXCJ|F4OTaPACq}Pp8mRTyxy`eshX8Mm^Yw}*X2n@BdHv&`Rc~? zOw_Oi8bn?fChZn2gs{psNmap)M~ zLAR=@k66=n|LfN!;G+I))iCZ4$SmIfs`shSR%u-Bi;TFT zu8`hu)%eK_eADwi`Z?>k)h^PX64FUrne=CXenx)}K9~Mb+b3xJ{kl$SPqT&<;D&7S@@y0tk=(0WN0hZ|Dt|=Khktj{d+Ww{tR)h`U$_Uj~`t0m(FtGR|BP1c>H3S9+4Q^c)VZZ(x>WdThW7T z1TOj(S+06X)+01NrRgHsP0%pA&3b#S95 z;GcWwL4rexGc?Vb+C00yVWReLvXN@R(yOk$e#W3#lRKKOYZx@-q*G2h^`z4VwO`-f z*3!~3Xm)$sAWdq}V-RNL&BcRc7 zeQQJeNsSJMZm_za-OYG}Sgi>Mw1;+@hyAA|Ef<+FVQI9w&ZEo@IMcc;e!{EW>mTc#wt=&b_Ya_yCA?dKg93m1G*|sOx2B+n)shu1 zwIq3c!h01+sQO+PRlkCC3Q3}TbHe-0r)#{gAXA69|?&A_maNmG(%-Anb zYs&j3F#Ccr63ht+@5?uBV6mhU-ie+53B+*DmVoDVN?hyRFc>bl1>qY&9?(i0WdIKrK!U8by&l{5+ z1xc$DPlmWjgsC?!@oiNDB9Zf=)+K606Vu7K+nb0x}rUAD|hfZ;{p{ycyvAt{ZE-KS2UVlOE~Z2ET%>O&_3X ziN8CaB)-I>L3jarw6W9gLk1~>8N1D69cqOM0QU!8ZNhtRK9nZm-A=W6*MTvr4gvdv@~c-$mSflQN-XSOUOO6i^yEaWOAAA&RW03D}#2T%E;)FYD5ER1623G2U;nb zI~ooDt_u}ii>@n8crSRJes^zp&6EB|LA85g5v=`L$uk!vpu65T6wde4XvpJ!dK8(p z(hI%2udnfYpHC$AlAPXmVE=?E@HvfvZR&%O#<-YY<2{GUN@1`fp9PIE4@m{ z*}IP>vbchI3vb*D9rZe?k`I(3{fUOLQuLaLq7wygFS-q4UkzMLZol^SV$%HzEXRQf zU(JV@>i!6F)U92p05o)$m+VM*tL7KEG!q@P?qX=|$LzMjuY$fDiz*!NgLZU=*IB|9sjTuHxK$BlJ%p(M0^db4 z_Ew>9FvtBK8HnZPlA3}l%ZNReCVP@R*Dt*#;XREu7bm=@(i>Py7eR|L014`Q-%lqy zkc`i2%L|2V_`?k_;b_sj1yGPBJVU%&u;C!=6e$f^Dy3`@Bh`nE6y}!ya%%_#q<(WCq-{5$GAzc)&LgmlDv@`joa0kiICzY4SNQQkaw5@Y<{ zbnlty6lm}-sRYR2PRc-IvI==L@^KLRZ~}EJdvz4tG^(jD{Kvt`KY}bs$H40e?ob0ebI!T z-R_I&haMu+>3@PV^q`YW$70w|e>7&MJ3qY_Ed9l0-|ZhLRqEYL&(N~|i%3ia zgP(ktr{_#eS8uqTFgJgj#~$HrKH2bh<|WUJneb&kTbwjE_f=p}Ywq!rXTs9W+ly39 zqBfCS3&~;B??bzGfH`!@17IM!Zxj)_KWYF^29+xc*V;3w+?OeeuqjtPbsGuJ~{ zKY_69iFZ4Mb!>W((uu^Uh}o~9+LZSa7<5z`(>M&Yx9a*DO2G0hMqfDIm#$~Wnm`}H zKMYfcaESfa3I7X7S0=nY=z#8j^($f3fOS0dg8DlJf2QXWe~>A-?0WVM-ll?|xxUjw zBDP?97rgd{`@a{GqfV{$D{k|v;RA!nQCKRac-{EsT%zu+EP~zLJ+}slkmXnBGRp+g zEc=PE&`O})SJdhEgLyoDq2CW0%fH8gaCgnHLs&Ebzgh$qe?2$8u3b~aYoedSu7ys= z!7Prb6S{UfKJ0yql(lw|_oM5vibw2+BR^){o@cZtT)(61f)&ojqR!fc_k+2e-uEDq zqp^nQ!P16?Le!&R8lQ%^z7G-hfw)pj{bM*_<2^o?jI_74Xs`d_1%A&9NBhTo+CK`< zMiTMIA$cgqFN@;i^<~JdBK-ru{DOpcA7l)3ybIJ(Xcb6)gfr;SFGAhq!sM_yrdad- zflRX3h=n9-U4dFt-ku`NX1$d{^c?N?9mTFQl)Sg{#J%NcQBOqWz-sSNkP|4>0EnJ= zrwBi{&4rrmr_|E9dnp0oB+mj7EUFWu7x~AI^!q?KfAK3fk~$|w!#5`oCNHJH`;`oq z&W#U*TaqNP-k6|i%)K=SW6t|*l9mi`l_||S7V!wPbHx)=n6KY}+qIz?9G9)Yr=r_P~J!E1t(AOi3{etWMW@g6zn;$-$ zg)z7%%omtQc~~G(*72UDiZNrMPzgCk;N?dEReDbXlIrA)eqM>jB)rXvZz|xEnT<8g zci)Mbndi6>-W1m_hJAhu^Uy?Yc82DpA?IE&hEN}Jt;%^;e;$>Vdyf%Icubr_@sFW~ z)Ds(hF~xe*$TS8#)4%|FCE~!uGZz4W=0 zF?!~}0=|~4S%gKvUBFMnwLvWv2xg*cpJr>NE~GEeQZlKXB96><^*{s2L97Hm@!wEe z3A~V7sVn}Og#S_oBQlaaj9!cAiQfx+B+mCsKIQx8!w$a>4;FL$tq8%UyaiNxF$9L; zP;y(sdm9~&_AkN^>`87oPwQ{b>0Dy0o(iJCd*b*ud+Jm`gtyt?0dz;Iv!Ji#nyydL zm?F774KC8&_fs^-Q5uU*)MC}E z2l|NC?2yzc{96q;i4}7cDG&+JyMheX2|y+-VIa`eqst-s?O+pr=eJU@Xx$h2eJ=2O z)MA-{UdOyi1TOIVUFiD=!+0NqF}o1<2<|nv@at$lB>EDF!N^f$x{rE9!qE?Zjfcg& zd`KN23o7n@7t!$6G?(j9_Fs9$x)CM5IXYPVvP3_ zy!&TkfeKwGJ)bdxT6||ueQ|x-Q(-wIM1vSWgf$B8FVFz= zGJ?!K3i|0hw6+B6#`SF2*ZVH7H@1^TB)mI|b1))I!8A{e0WJw;)d z&tUnL#uD49q1kdIez5vR{Pf`>JR}b(iQN@vL!z^W@xG&+s|>D_pIAa&)}`N+#k#zP zXi<}L`4u!B6Z;T78r*4B)x(D6wgQJlUIp)OQwQcb3E3N57 zf+KY6F%|mWYgp?QLu#1vpP&F)r?&%-(+Q7UYv^j|n1=B^@8`5PKtpK_ zu!vpMJ~ixJ!w``#jS|wa#%#IB_pt?pup~U69+*0nM~Z;8@>ah_?ebotCayu!d$Fw( zi4C|T@QF5dgZU<}q7)HYD(#`8APJLFv7TbKM?Zy*+T2d2C_3JvE+Ix@<_&CgAN(F@{s!8)E=7PHmG45g z!ZWxBd#Js=`-;(+&0wd$w-H?T=FJ&e6_zgYdoHA%`wiX?OlRQ z#>0hBZtCP;u^!WoI<&HsLNC-ka5WL=%50}gy{}@G1o=Jy77-`dfsu+0xwg*OH1p?D z-U~X1_kxxJ8v)&YPz>6!)O$e$#jX}ecuU*jdqE$70;Y{`%|mR2`Xh~zf`OD_?)V9S z{)K30QDO;x(SomJZ9#} z5$r#p_HEcv=;f`$)&y-tfX+|R%_X$pb-jM*=kHwGNg&+0(k{0tN@$w`G}nVtnYRUm zDrwP9n-+?2%uoHFZro45n9FV^)XWjKELd=B)KcwLIT|lOuhcy{{z2i5``xB<0l=oQ}9{)nW^hq$@H}N*3nl0$e zXDuKcitF{E(+$+4pp)=E-^zl2x`H-EzCVj5E}G$R9477kzICs3XRsF!aLVhn+jEdC zVDw`qg>wQHKIFaMt&>xLe$WkbQzt`_gqi$4qR}nPGyHSq5qt>N3kI2jgCB!((3;fy z4&!uY*%w!n`+hzDpI}1&5X4cK25!Rah-i6Qoq9tnv-!7*%%-l~2zh=E;@(x7U_8lk?^fdGFRB~w zMCEgcgx`IMrjU{v(#Q=c%uXQiE zexK_`mI~pjGTI6DJ;dOS2~yzteGrBPxm$HC=8x}@MIhI2JED3j?g{zB@xsBEAn4gW z2zsWyH!*n){648g!2l~Nyt#ry9>sj(aGf&Wbl?!tFf2SFK`fTxH&!8>iMEnr<#Up= z%6kc`3!D_lfsI~TfML%&1vphy@f5i`-aVu#?9f79IX!&H{DFBW5by;rH_HK2bk(hu z6c9yoeg;*~w>cg+_fqdSDT?ia|K|>!e^B{4{Ngfi2V|fdlJZ{0$(RFZLxp!LjjZ>umc%j=OT~q) z?2jPMjKSB91#1?`=Q=t3p$vHTv4 zba|2^<*llKK_Y(DOqn^78u1ZR-d>pE5^pjoQjPb$nL%S|E`vTb@o=CS1Un{#f;Tj} zKBkiLUIfW<|$0eSmk>&Tpv8EdT0)XjoqzX=d2eCt_(!m@Tp>lL! z1m4^3$_=rdm%l)iW$A*EJ<-TpF}A4*2eBfeAmV#`8qE6}x}&f688YkfHB!oZ3z`F# zZZ#%>rI2BrmQLigg$f%(2ba5fJuq#))x4MN41&EFuD`=?4t>}MClgzVWJk5lLB?UmGqKg>j{!c!b70Ib6G@OtQ791#a* zSB}AO5y|&O*b}b@z%s7F>jQk|mcmz{_;eh@P6LR9DTDpnEpj`jfVu?m1Ut0K#}ajH5Ncv-<<;p z`#P{{p}8><grXjIWbh|IWbqIu-eVmjAOl2~#hlzvD{ZZr@Z zQ(dmg^F}ctf{fc+c~i-QmoE1rc!Chi==`_O)Uf23GFcwP^~vS-?&op56Y0ZrjtL97 z|DUPD)#&Mc50fMf3OF*iVpCDMbF_NJs#UshPSd8S&dMy6Pu8S&y~!dBg|`b(5u3Oo%uJ`kH1xo1DM)>?CEU{JLO$OIsfII^5@K* zvJdXizfmZMp;I_crTaL4hg_{<^t1zWAG%Fu{wbvagI55c$d1@T5RbduKY*|By~pEEeZ`OPFnuheu2Xk`Bh z6n{y(YVXg0lMaFy_;fzP4&-NA*rMo*RP-MxdNYcql;eyI0y>-Fdp|>ffc9F6=2ts_ zXyTY8rC-o446mDolqir12D^@8=Gq~Jpx{?*OyY+Q9BPpr%P05D8A{p;G8;j+lMlOZ z#)jB_&0{_3#qs2y{B9hm`QbI>qCC};=lVCXgipxFK{Tg0*6c z+I2Gi1hF*}rZX2BlyzYV!ii7MfVj}09wbdT@7~54%m)P?m=CZ+J%AJW-XG}&h2LFE zM%jC!jNYTk^cqX4w}Kc$EL>6AOg-qm-OgLSagPRwPpjjb+j_$J>GuSgeedCGI%8ho zi#>3@C5_`_1!uyM|K@B&^DuT^LX>@^{?FTs(0>X?Z1JLu@7)C%Re67%N$trmU;{zC zj!si99Zk9Kq6uK||EiCb+pj^3zS$FD(Q~le!5$Qv1Do(RwXwtd407n$&Ym%JCvZWcPk=m8CH=cbRrq(2eVSmymwdOy^X02 zhafM2Dk60;j(_m)m7IV%@YZ3%1H)0%0adX~2OBl0S?&WCSt41dCA=S(5Z#9`%jpr- z#j=9mR*H`jtPx1AI1d1xrS*nxXAME6ysagB(bLoc51{s_?M1Is5C{S)Rg0TLY2{#q z5^0O^9kOM#jv}i<%BE__-eBx{bIYDY39D)0!~|A1#wI4HF4p8IlUZ8u0e@Nod-d0A z_{759(DE`INJfNN!8Dgz1*qFYb`OI=vKU>kGS&rQjoAf+1!C4VX4Hrr zV#9n+^A|@}sGI&p0^nZ3=FdimwdAjM*TSp7DVSgu&Dg(Cso#=H?KCRIc05m&qGJ?Y zD95o-(GsPi4qHXv`wJ`-rQ=7&U&M5cc_$U0k>0=)e5jzJU?7a^KbtVp(Cs(l9a8Tf zO&gG4A-`}<4Zc#~eGBt@51a>ks|kC4&JbQjp@QI>)XN+O#0j_m#t7==?Zt2@j@%+bevb= z=Md6}*r?upm46^z0ygzXxJC z)KzH00-S+QKW03W3h!>R4Bl&G4+L~2nX9jZXUJ`H53*XMk=gw*d&0qyTMB(Tp#eZG zCd9;n!zHM<+yh7ze9z>taoDPbUJAX3W<3JE2aB(o2fSrME@8~Cf4dj$A{O++0is1so!8NozALqM-^FH@79}=y8wK(QLjf?N#%0suz5Hz!@tKK zI67h%x(MC!WD*=8n~yh!!n?{kark#5bvbo3PLA+&aS^!x$-jboJ@=;GATvRS2?xSE zFN0P+5B4F{!*ZzDHbLQ08&riQqiXS5ZZWI{HTLm;MPs=;xO4L94PYOTBaO)?l?ddB zzPuBsQc}8cYTW9^-T!ZI90wm_eGi_$p?H1@-qbTxUPjqzODtYuEV1$^}cq^208`yKRs*EloR0LRCteJi@d4rUGx6Oj&~Ibt@VBU_k?z6+8k@O%8I3o@2fx}b=@6ZzMF+6eOjcbqG2u=5;!>(ZGRgRf-xRWbN% zhF=|nk7M|x82osKPmaM6y1_Ly2LCPd*${(oWcaig{EG~4jKQyC_%$*3Zmw5l*RfF` za@!eR9fLp2@Z)0e&oR7T41Ooqt3OIAp6+1y2?C;$4>Ei}41Np4KNf@6Gn~GZ8of?u z_(@S9ay=M6C*d_>dTUDZ@{V!CSdr{)s$$fkCH7V3b+S@c)d# z7c%^e82oC6e!V{F7X7ItJgy z@KG`Ny$l~6gWtgL3uEvJ48JG_{||c}1M`1L4E_U#UlxPk$MDNz@M@+{ z9}Vc-)>Vc-)>Vc-)>Vc-)>Vc-)>V zc-)>Vcs1Q(m**T8gAu@UjMhXSdrsVLEBpabM4j`TxZPIxal5VHal5VHal5VHal5VH zal5VHL+BQ}JST3q3CVNf_F2K>_F2K>_F2KhaYT7@c~0Cu(=*Q*Zcrk34}UW$)8#pF z`%HMA6SvO_9*%cO&vW8-SmDR*u!6_!u!6_!u!6_!u!4tniSp+1@F$EiT^|16NT$of z-+Ib)c^Ujw!t;ckl;u2O-=grVWj08A&ZHnM6J7?tl%9J|+%Hw|Yh-aw7s7OAvQ|HW zYn2H;5~ec~d@$yVOz{4&-ve3T=_CFK;MKJxD;5)L=p96TM6OL2!_cgA$ z(C)QriR^+LD#bYEztMnapGUowPH2bcYy1gJKeQ)nG~8$UgLTevcIwnEOh2?UyEL3M zvr^1E=5Lq0&hX(HOaILWY5?4Y{42$HN0wAKEuO#d4a}1pXC<%1N`@FP_za08W|c|bbk*2DusRHzw-dtliaQfLg9=5 zHVIPI+^%r`-Jphw;#t8DBG)&(NP)pr7Bxbi(=6{Jop`%uhH! zwrYHj>4fvC;j@C}9Qtn^8lNDQ{1;yoV7rD-XL+8WbI?DX>c{Zv0A8!xdmPs*{3YPg zH6QRya<0d-Oz>VHh9>1KMC;0pzO zgiaIuCIN30@W%z*^n*>`*jJl=v!EmC-!9;iz8T*(KU=flzbN3cy*mY5ws(PmOMX@h zxa4P@fJ^%81zghKDc}Z&K>M@6jlNTRWxXXD|8&4_)M>gI9T{f9dt|{Mui-X+tAv#s0qhc8HlHg6T(?)<%Oy;;#2Cs)CVc&J2Y>EFZ+F!fJ;85J&}AqD)4XDX}WC{@OlB?C*YDFX*XoO zJ-{Db#HXxxpn%K%DpBaM@siEXjL`T*U+TliEOf?bxGjGvXDR>cEOh#1p)*Fet2^!; z8i#IXT=cZyRfP(P_?Pl8$Gl7z!9S;x{5wg&zboLk3%Hd33ISgz@K=rrA0b(-KC1zg&n2L#;6-{xlm%F|`@Lw+D# zL|?Y6uL8&Puv)`yI+HZqZr5A^H)D-Ji#6QniSdk=YPiu817E4(wj5Sxfy;TVQ{&K0 z+J6auPvaPVDoq(JAH$D<%kln%!NuLo7q>ug6`ww`B^9ENV{DKzUi{tCFLyn94zo9pHd$rpTiV+ zrZ3^!1YFYDC*YD#>F3DyO1VisCkZ}fy~aLMdu6?oM7@%Jqkv2L3j|!!m+h5y^?rdb z>)kBivb|D1lAjj^zU1e2(OyY^t$<7V>jhlW-z4A*bzO8@CF+&*Hwn0;zg55`{p|uS z>C1kUbcPFlq?`u|I!kn#Zj$~t1^i8&rhb=jDSrvynFU|!p{%z=1OPzJzh-whTz%yOZL08 zw+jV*ls(0LPl&_#44e7Nw>Bm4-sfjqRRS*g*(l%=f3tu~{G9?W@plWj#7~NKoWw5| zaEaefz$N|w4Y&1hu!h@uI9Je-a+B**Ij&a=d|B^W0hfGIeAUSR8!E}aL$kn}v%psi zxU`dUJ@TNSzgesoJ}uy_I<86jAlqyHE-=AmyY3M9vR!KgTD(dUQl91<1o1ENom9w=v_B;Z99zHS zGY`u3=Ey8`4s;%@)pUq|NxxperF>d}M;GBs`ByVE|9G02zwGh2Lesa$<9niBsaLy% z-H`ez?f*i}8{N#`mM8ute%~zPbhv;^{E-4K={F0w#P1Mri7(??5`Rq={LKO`$LVeX zmv(8NfJ^%C3Ap5EjIbvX-~2s!lAFZu5craxm093(h5eD^hg`P~z0+)7A^0{8%OZjgWaLNBx0hjy_7xqocXQF^#Blv6-aEZT0 zz$Lyp8b$pm`5z|io8*6lfJ^>s1zhs4&MPYWAo*D#@FhRh!cIzfV;1;g0beZSutLDU zCg58HT+%O3D2DQq zNq?7sOZs~RT+*Lgs4Am+zai>fBj8eQn+06b-zwme{vH9B`1=H0;_ugRyMG;RpY8s| zI|zIc|586E>b4Nv=pKO<3%KORw9%ITrY!hd1YGjJN5Eyj$bA#Z&p_};m(6E2L-Y5G z=4PQ|){nM4w`qJ^o>f8*rF^OdT()<(fJ^+50xt2J1zgHUt`j9(t`jAEhoBRYr_gf= zACUzv{U|xEHwye!x-aM^_Xj1sO6aqcgIupkISdf^Qg8ca>Gx_4xBF|GhLiq$UZ?3+ zg*;sZm;Q;=H>2}}H(cOL`1mYvV<&CBGI0!>&wir6q?E)_8 zuNH7gf4hK7`Ug7Sm5BLE(jOz>l778_Oa7Y$T=Jh3>jmj&_7!ls9d zy(MBDA?frJa7kyNfJ-{N1YFYDFW{1nT&GAntHe6u7Gq>^Unk&F4m$-rQm=qV>J{q+ zS?~PsAVFXgsFz$N~sl8{e1 zk8BliIp1k;-f=Cn4@LXh*NJ}IsnfKtE#Y&Kr^}wF%=*Hfr_8)Ya&A>c`Pa;A1eg3* zYaE+?KMl9(8=2Vs_@>4uxWOS%q2{09(mxp>;8K4E3;04!lWr3PT;fj>aEZTIz$O0e z0xt2_3An^xFW?e?yMRml9Re=#cWSsTXS3g7%lS+(FW({L(3l0jN!asc0^gixC;8tm z;4;1~{i`*?K1e+=dQR)vFA6$FPwaLL&^UIxc4;{ABirR@`4C*nGb!K;MZF~&Zr5wp zDR#Yc1sz%M{Q@rabE|;M_R9SoX-}koCG}tWKhl1V7k-6o??eG#DB8P2!)?28|fj9sovpAC7MpXus=lKz~wql(wQ&l%YC<{ z7N709J!XAp_%v|2A1&>`YKzX@n$8-FPXm8c@FVGLw&=X0>1?s+82DB}N6LS#mXj^F zbsBEkW#sm#hEqRExos72IlsSX(Kr3N!=i8Cy9FKDUK6)8eA4?=biHTMF>n*lwDqk} zucr(h(=M})v)e28r(}EOymPl=g?|TF^l#OC4%Bc%-@u27^_^_*NQ=&&G##^kG;|Dn zjG!a?cc*~Q7krxaqb-N>B86n=8~OCmaJ%2DG~CcJafiMZ9RsfxbR?f<-AZ(33qI-n zR=S8E2_G-$NWZ07z@`1{5b%YHB>&za;AXC*2kLt=D!wP_Zx{HI{tf|`^xqS3Nnf6e zka0z`A7|ug`FIb+^<{bN<25`LG@*W<74`82EbOSId6UVESWMk+;$7wG0V< zo=(&4sVwkbz@y8?pD5txD-`~HEDO9w+c}~m@$bk2e<2IJuO3fC=K@jh>@4t~W`TcP z%hjf{K)^=|`ajMBuk;lX(HSN1={-%lZ1_uA;AY?4#vlLxNW1^|s^|WH;0KlI3PUuN zjFKT)Kh)5rMHos;KMc`UTP;>i4MP~hPz=S;#Sn%tlxtU4G(MFf3}IYh2tydUGKBBz z`F=f~?b*Zo<@)3MzTJACo%?y5=j-);y?>nddGB_=2w>v)IcL#h!z|;4PuU{JQ=K|htulPD60$v&L4+GvC zZ(w=ciUR(0z&{UopOpCi&kp#50pA$#{(HyQzbfD_2Rs>HQ6b}y?Mp`U@c~~H@T6{S z{jqhj1Aa%qKMMGs-Q(+@X?(Ql|Kfmu6Yz=qwADY=)OjG_zX$xZ9`SW*0>0C}@%eiK z{${{aQse8K9q?BJe$;;Pb#4pzF+Jn+2la~g2?5{kfcX4wz2p7NfZrSNF9M!^V0``S z1Ktquz0%_AoEY#00e>;ze;6O*n~LT$4r*)H`qF?Oad3S8`+%QxNPNB`;O`h8>z^9U z59`xb$NCKc|03Xr9vWZgx`00$@RooN>f2U-oc}SJ&k6Vo0Z%$CzRpnr{~_QR>G5?Q z3i$g0-??9WolN87eI%M+6Y#YG-@SiZeOu?HfNu%-VFTjpoFDM&fPWkC{RYO@9~g4zzqxrOeHwOHKjQBe91O9oy zhaM4MXQlDeO+VWo*_OAS7w`oEe=*>{1bo<0@$KFd@XrE%$dLFtcLqG^@A3JPfG-cY zekGrr*PY=@M)T8;ZmVy7Q@}?Kjn6+A@a;0=^MeC^X~2IE`0!zE_0RM_M)QvXKIEAA z{6gasOr0x_ZOdE#DBu~x+wy0bI+q2!CEz`ei?4H2z+Vjbug1?d{TX(ATYc--2mI53 zPdg#L&XWQEDd2z4im&r%z=xg~pPv=*R|5Wfz)w3VzWzS~{;Bba{;ARYpp)C`Sf3g2 zWdY9^5nt!_fPWD1mR;ndA#h{;q&;3iwF8$Z?&u0dI#F8_uu9 z!I6E(T;DnNApxHi@aljcf}M)%&kp#50pA$#f!L|Iep$fR1bi3lR9t6Rz^@DV+X3GX z8x7Z=7Vu>O|25!!v5|58ivwO4@XZ15GbMgInH2Da0sl|Hhfa;JUmoz*fDbKcm+{IH_#^+xO_^##g`EddN zN5C5b-sQTs`Z#5X;HrSX6!4zc$Jdz_@FxQPNx+Y~A-?`?0e>mrTLOOAy!iT)1O9Bl zTLRv5ep~%>{g2UnPQaT3KK91=I%nP#@AU!SwIV)0KH$v(?|*ZAou>o7%PsNwaRHwn z@XrI@?bi7EqXK?az-t43z=HVtMFD?0;HeAa>r4&!;{k6C_%XM|*MB_VU2l)i=LP)L zfbUQlU+2Vt-xTn70)EUL@%2js{#?M@-5Fo!h=9*9UgVz|&6fuJmw;#9)z+@9b4|d1 z4|u;t@pUc?__G1u;UDpJP7L@>0sl7O1MiNnKQ-WY2K?24>zBUCd5#^=0r$kWdr`ob z7@zK+8qK>^wbij+67W|8-uvG8I+q7L`@Z=6%7FL1KR#a)@Z|wNXmNa<+XKGC1M&Iu z0{&XSJ3km-CqLki1iU5SgC2^ne@?(_0=_xmL#pHJ&kXo|0e?H-`#v0BzaZd`2K?iI zcYY+k{uu$kKj7~Ky!)f^^+yGKu5nyqi3+p?e8Q5p`Zix5@Le8@&z~Le2Lt|Xzz04a zU;iIZ#QSFfKeQ%3e`&y94EU~3#@9J5;P(c6UBJ6P6<@zF;57l?67a0290G*FPfQGXlOi z;Ee&_xi-GtF#*3e;L8Kv67XLCif{L{fd3=l8v@>Sd3^ocfZrPM_X3{!@A&%j0{%k4 zlUBsnIVIo=1HRp}@pT3V{L+B`U%x>Ba zx>KdT>;+|@FQP~uYY~O z8v>s4dVHO;1AcSB*BdYPC8PP_4Q=(U-x%;O0)FTl@pbY7z98T)1-$25@%1YL{%*i~ ztc$OcAMiT@{(8XMy&Yfwh=3Ob{QZDuy%S&mmVh?~yvMuob>;{B*MJu`#@Bf&;H?2a z`n~u%a|8Zk!1LaZuk&iayZk3UpBL~~1Fm1JBiGaHel&1>eEnMk{zJge{vf{2%K`8D zVSGL};Ex3ShkzgXQGETm0bd*NjHdWHR|b4-z%xFMuTvcGX9E6Jz>obTzW)4xzZ>vl zKaH<*Nx&Zu_$S8C^ChEs+J?6J)@K->W%4fueAZ`eb!@)t=kY!};I9RIS#x}yfnUaZ zZNU3{6`y}J;O)MS&z}|W>VSV6@QjV|^~(bOpMdxLCce(O0bdpHUjm-_ZG8P}0=_oj zhkO@b=e&Tw9PsU1;_D0w_?&=05%6CEKK%RmcCQb3L%@@Mh_5pw;8zBGS-=xNw$-2Q ze~jjr2fSoceE#8pe;Dx2|BbJ6Qot_{_|kxX5%A+T$G2M@@XkNQ=gR`VDd0t|@pZlq z_-Q}K=W7DK>o4*7O9K8yz|Z_OzRp_#KXprd{<(nf^ILrW@__#y@N<5Tud_PfzXrVT zAMtfc0{&3IKL~hFd~uHa1fxAXC{+}wTo}W{Bhjh7q>G0$D*d(97*}tasL?dPjP=F`DeI)I&P)@ za8tj?|y*dp>Y_=Bd7Y$spfeyzzLhpgPZV)D}N1U#nSlPu#Vz6|~W<#)mT zuW&2NCH0Gt|J(Nd2X)=|_J`|wN#K58^4)O%2=bn|Kb(9|+}H2d)cRfExs+Ge?`PKh z9?0q6169}cSVncU-T81?-s3R_a&s5u=d||^K4@IVc`U~95#zERbsUx%m;7VM|I4`K zb$s-DkEQ>TKL)va%8$YQw~R|(|Bl7G#-+Y4@8@t`-bL;)ncD5(Z?)amklPKe`34_L z3?Q$7k0)Ob*Y7ozIw!#7W`=23`gs$^`6A=8T>5>fmm0U@tlw*@{hyAUey^!+57}`2 zUQ>1bJ0JI(`qJ(i+<(Zpw5#L)6nPEC?OC`kZ?SuhO#d-?so%d{#EE9gS9?x$#N%3L zDO|trP&^AJH~Kxqx?EKl&%vmp<5Pwk#)J>W8KC!2g9lb7*-68AHV%W`G!=%1v2_e!@1JuYQY zUcV=FgmI~_-#?pUTgaJ- z^GCw3Gxeoi-G3L7>;8DJaoHZy-9MQgF)sbg+$rM3)8sqDSCC%=e+jPZtHqZ|d`+(B zd)s3@OMV2haA0YpPamnkr{oAa?CI15QyBL?ezCY?}T=Mx{+{{fqj7wgRdj}hr{D;W*H7OO_bNapY$~O0@Qia)RF!t zb@mT@M0vg5u^nEAW&EXG{d-FtjZ2;4J$;=$$kX86$=9RZgWx(2x!67jnY^@{>)MxT zsBvlcHq^-?KLtLT{Dr-vGKsU{+U^33{}m=L?N*`Pg~p}bbFtp&!r;nn}DU{!W{B`7;(EmHB&fPlBgfKsg>`Td=ZxSUUL2WB99u+Mjz$oUvPb0 z`xdWLtBuR{lhoBe=_TWGeACz2w~b5w6y)DCE_r?Z{mi)J7a;$oamnlJvYzMac9rPn z9(2>sl-J{bdz>d~J`4Gsj7xoeJ=&98kI(xVm;Fo6s|OpG{=bX*!;MS680+f{c`dvn&VRK(dj8ytT(9T% zHJ*zaax(<3+to(AugEekLGS0a!ukWLmkY~8ZWO~Kak#<+2 z-F4(Uj*jAqPpD41=fr06MtDb@S89JY!MhpHhsn)Ba9zJ?IPV`ouIE?7$aOqN8kgld z{7m1-XyY=TdfqjWT#pau8kah?s58^J)Y115bI3R0_<0>%#sNbab!d^vOZ_p}e;*)U z1b>|TGx#f1U-#>;OkVo=6^mt!2> zAn%3xACl{N$XDb?BEOkjmuq{x-_rd{munYtJ&tuH*Y$oN`4F@_kX*N`Ome**K7w4w zEr(p+?-Y=qigss_YrB_`>o{LeuKl@ZFw{`;G8$yX!4 z9o~QI_A>(Ylgah{es|+iXS;pf%uT7rrCmKf^f4~^0sBeXy)QH_c|9K+VqEe!BA;no z^12>Jkn3?{3|!Z*UQf>@*W>DWrjE3GJC^HW@|WTBjLZ33754Xq#-&bjs++m#Zu0S| z5horZUk!f-uKm~d1#g(VwA+Ao-!U%j9@*2^f8V%_+i0xc&y7odzg|B7m2t`I{=3<@ z8>t+XBcaiN%@;@Wr(YWOGIMB_wELQ@@fnLU?&Q87M!9?Ov@-gtE$nSs; zC;tdOl05A|Uw=ILmGDBiu9rFOeEuTJ*CT%=`7UWbe*^h2_}x@r|DNKf;>0;YW{G_&qMws%Ip48NM4Tjee=k>V;ri;J0o95UIBmEc!3|9Xx<3dR`?y8W!eICsJIGp(cffpE?L zbD}SlWn7Mj`g`rs#$_D-Kz^ce$?M<6EHp0pfw^wxrVETmuOryME;laub8;n}NX$1b z`DCp32gozwD~wB>o_SIwkyuTBF8nRyQok5=)*F{PcO(B9`3Cs6bL6>JsiD1lKQ2{?@az2d@u6H^8NFB!gc+w-_HB-(QTAO4+9bG+A(-vVDreg^za;}^LS6-DP-$kVXjZ6>dV?~dz*IzGMH`El+|o&g_D zUJO5-yc&Knc|P`|+sWr)d$xb4QVwmc@H)!t=kC^%H(-1FiF^Y*1=mG%dAsBFaUgjg z_$YEcKPe_JLjDGF{rp}vc@6R_jgRp|AI)Ed%l3S+lWrJ?_l(Pa{ZpEM(g(&RukQ=K zG%oom2l@Or#wA~m?d@mdl3#-SZ^k7*2L11Z>pr#6BybAdw8<#rzzVcY(lD`7^ z6O2n<-}j9%F8O81pJrV0dDxyO8<%`D@>7jVUboxXKJ3)|1<#$~zs_VrKt%D60-w!7K5yx+E7 z3g3^s34RD%Ul;WAP6NsHc%DhF>wN_IBN&Gq@_)e#$X|q)lD`7Knp}S$cMDv`VLX;e zZmK9h8T;1~*;GG)`d3n3&wH;oF7+=T=w@!Zm3#zz z5&2W_N8q|#g}zK;HM#D0Uzs}5@dW+<(YW;Ib1ZLCPhU`v&sFfE~zY=Un5mUFqvug>lKB zcDS3lX@POc>+4#Tamhc8{9@yh*Zr=>xa4;o{N#-+ZF|82%4{~Pjm8khW< zc5ddT2aQX9-jNX}9x*QYx!8W5F)sO)$S*f8`A^&VI%|we{s-h=HZJ)l25Fc|EWD+_>ZufA{&Xj7wg}f3tDPKZX1+#wGt{J71^60sdBxGy1x-GhEl>QoJs7 zCGYH?o;bwRk# zlrO^gETViX^3RdC!#KQc{0wB}rkU!uqW<^fqmTAa`h|QWe23otaXro)H`L$nM1D7X zPxA9KeZB|zX80k-W&G3I`}{EDGX6iK{wc;KpNo9HamgQ+>1J*^4=&>`<1-;r_qs!# z55L>^nJ~F|lIjl`<{x~X{9X9Vnt)ZdA;6SZCvtKBEQ7ABTZ~KoTD(prr9}@%?>i)a4)UFhOI}~cQ;bXg|B&x)T=M$8#cCyxOFER}wFY%lhY3fM351-&4IFtN4cp=rPN1f|UUbg>aY=^fRm--7&@=sVq zJ_`N-`DTp6Q*d3b8Z6g3a=g4Gn#tFppW7egf6zKBP-kzrzRrHWgU|IQ*Xwxw$@O~g z(d0j%&Pn9@`;qbFy1h*z*X?!&xqd$6V)F9segEgdWqBuJ4CLlc$~R(tJ!o9k*MG2H z9x*Q4p&mD$F)sQ2PIfalEjKQCJ#MTqF8Qg*zieFcdfa%&xa1#0{(a+;*Y)zbamlBT za5Fc3WnA)loY`z#^8YwR(uu?`#wCAUQpAZ4_&tDbC%WJ54A*hi|L4_}ywsOT^fz^+ z-J8(Qp_E^Re4fe6{*{UKHPg7%NgC;&P)dFj{0j27(eCx+GmyWPd_8;-`CyFO1LWtx zpN8xB===1SOqXKbew?H~dH%;}z875AZ(>LP z;Qq#CoJWrK-rKnJU;EkLxa3zLKghV`b-&Qx|LE&o+Nr+&@s!v7;#A{O|NoF5Z(Qo{ zf#bj=-seiILvI@0b=X!mjQ(eM>irylhi z$Tz?@kn8#Xe~nK28yk*M(xdE<9vh#$o6gl1?OQ$bUNB`@hH^g|C6jb}r*kg?8UEd1%qs~CM))|62IVLZ4Qn5eg z8J9ZCQD+9#$w!@A$QQZi$h3rfIL2)ac_F-sd=-2Xx&Hs?B>WyvmuoosvnP2Ge1GzF z@IG)E&x>8ZJGP6upE!cN2mCm4{r*24$wO!rce>6VTmyYJ!rTaTNo>|zgb~Y~kJaUH5 z?PgrYUq83Mk8#PDA-|t-$?I|cP~(z+5BYw^C9lW%zZ;kQt;KHUreVeR|Ip zd`bCn=lOna4&?X1??3f;J|Fo5;o8qiUuNs?V>SOa^24Z3-&y_%qo__c>P#aqgkMKq zg5$}9#x*NX`4?RKa~;}kARjr~H}D?$t?*CC*TBCwF5A^0?AO1L>-OBCzi&tPqhpZY zoqRaF2l)x`gUL^X4i|D_89zpxB+rvea&%e|!=cUGFd~|!b&bZW{dzsJAH!k^C z(EmG(Oa7n8|HHWC_5Ar^@;6XtnQ^Ie(p)!l)4z;M9o>Id8<+gmS4%pPc*(fr_4{?- zHZJ*ElarlK&X__5hF2D|3Sz3AUSz=(}Bi?S~^CY zNH;FaI}`aM$d|#7A@3!F?WWOi9p~$uzmyq98=JVxnUEYnj4*7`5OS_q9 zcLn7~;Pt(U^2Nx1XNH`TyAJmKl5v)Ht5Bz>ajEkQ>ZHT9|N1^_tjR~~ z1$E9cE_Kq&+{{hqP#yi=j2lf}>ZI-*#S^z1mpTPy-WOAyLX2lUc?J9na{XSfzh(G( zIu6-rx3h6+_hYo%i@fs{{`vilOaIGI=P2V+=LF=3lV1uSNnQg#)40^HL;VutQosBv zH*?b!a9v;Ra2?}Dlb1UBeN_(`mpad(&QhvV-(IS_@8vT2XnpPCy~()L`M)c@e@T80 z{0H(+vAn;McSnDAI>Oh}<`@!|N(GKSWeJQ^J;IQ&B42^mi_KJLVYy$PKgjFhosQggd6RLx?Mq&^lg|x>>o|-=ovc899OZXJKA-X} zs9#O4@AsFHr(nN(iF`Qx9r9xMr{s&_E#$56jz?`fK4Wp5>_V>J&(M#&0o(J@o$aCR8kr%;tAF}Q8E`eu~>*o(Ake4L+=a-UK!XF^- zh4ua>c@g{%@^W}LeC|p2(@OXta{b=&eDcoNUv44S?;%}DUWEL&%E(eOMbu&Zsw+6j7whMpLQ4;J-qdO(~Zb?G%oocu>J34TKr)F&D=DD{7m?T62)MeyF4@~pQ1A8{LebY{fSdXYNMz|SVv z>q6&{>*sqfAlLPNCAnTtxQTo%+FeAh?N*a(yGzOS^SyQC`Z?jX~*iFVI ze@ca<-S07sOMWw!_a5?};g6E*b(N>!I{r0Sk1NSDrBOG1NS@_6@f&$Dyvs5E2R#oQ zbCbWHN?r#)hr|7U0DqEvB-&k0z6bIz8kcr!&~AfqY4=0a`H=i-_z!ShuAJ?B zKRX@kZ*_gupxr&m_gUa`J;?Lnec)Pu3F;qD`A3l-MV_+I*UurJ2%lnH#v!q*&(Ab2 zAVU<4rAGnTN)%MpbHZx~8s0Kd&Kw4So~(Gk5s@Eix|k zD^P!_ajAbK^3NNWd>!)d8JB!9@}I+X9GZ4;54x%2asF1uLF%-i&K}04&KA^3g=?L< zcK-RpO-Q**B42`Wn?POMk?VQIJo0^z zuOvSJzL@+Fcn!I}{;nXu5#vx#-Vb%wk?ZU1PjDIMBCK1vX@7#hqsu!F=Q+C>m+fi_ zwyQmj%lPOx>}Oo^OOQXnxa5Ds`9MG8lK%nu!;MQ`$8DH#$!FZ0p)f4&m-4yzSOwvr@7cqZ!j+XIcSlaxvA2)6t3$_ z-;cab`3B_QH7@mUxm&8c^GEWD@Gr?%!+(NnyT!gtVt1Tqsh7bA!}a)<*v&tXXzO5gw>YRuC3b>AEK8~wzkn88xz9cXA%_cUJuYzxPqW?kb>*wN9j88{aZhFJ@ zIIws}|6qUP(*MQi{~+VCAL()67~_)Pqsq)%y6)wtw~s@%*?F z&$`dodBC{jci+kTlg1_gPvn;wmwY$mpEoY~n-=>ztBp%uuUo!hT=Ksn|F&_->+9FY z#w9=LAvbf=XT~M3*8#pK*W+O;T((2m-a6rRw*5&`&0i0Z{iOo?%bv!i-QM?0%3TLC zF8Mm-(~V2M2>Bz(pMoDlz8}V6v~j85g8F9|m-@{Qx|y3Mlivp~BJTu0pL_!RO5@UQ z>h4kb#0|!!-8Bz*zk_@l{66x&SYJ=Vb^OQTIMZPA(rz}|eb2bG`z`8xLS7C3&bZVm zL!IqU_Wjj%hv0m#H(XyYYLM@1T-u#l?VmrGd>}lN{7(2OaBWx5OQ(@{Mt^Q3FN5Dh z^+4eEvcB#@em?nY@Vkslo#Z`yf2xd2oz9PXe+;huEJZ(G zAfE$&pF9c2nXjq-38>#n`Oe69AL-lIcDrMo4$=4r6u7787B6&aLXOipn(#yyP zB0ryeFnkfY{vF3^<1!9?9{2rRVqC^S_upD_eLYlQ zD%3yL$?M>6khj2_;kv%+eRmS=v;7acT&a8d z`@0yI^)>2A?_J1ugr|}pP~-Clk*|agGA`qmjdq6`mv+xbekA!FXm>pMT6lqRsb7Zr zGmK09&QH0Sn=T~Jg_n_6!{@_wJU8Gtd8f%syLD*ye&f>aCe&F%p82%&#(hsD`P60J zUw~`7HE8!Ulb3cAd-?pg#--hI)c=+0q+ zN8^t=lZ;E9A5mu})zRy9x0-x3o~X0PxYRjlsqgp0RHqvKdDY~j@#*68?--Xl6H(_= zs-ypZYR6Ok^R|u;>LeSNItx%|AGnTBJFKr^CLfIt>YQX;>b#6Pr%|1B)VajuqwztV zxyGf=AEi=LnoH^)h*Bw;1gnYFz4njQ$TIe+)j9{GVud1YFxqLAx_eUfQie zyQRjZ-G+a$}`{lfs{08{rR6h&#U#I+f)L$RS|3>-U zQNQCj-@Y!_1k~?KuAi411=scR2I}OKr~KR3olc&>h2V>+{_qYye;4KFqE2-n{}Sbw zBmWNN^>cl{kZ(Y{-NyU&b-9j5Khw$Q!;c_8|5^Y1DhosvL)A>|K4 z{rf1Niu!9z{vy|vs=a-GUNj%hiJVqsaCDug#=7{a)~O=aQGg=ac7RJGqnUHzxTy%PGGBbzThQ zzo2|q)ZavTeV?9kdfPb2c9M?mWIy8Iw?ZMaGzI-B=T>l?d8F{+vuS|E5>+hSMA=l6OG?1s^{lW+2 zIq=+*gnvY?e|LK$`4$|<^b0L@ob~Uc?KffD@n4GL z&oJ^W@KeZF;P`(g`Qnbg?xp0l@O#Mn;5bl6o(cb$TtD~zE%^%McR6d@#Jvz>-E5M$o2EF7m(}rd?mT=7dOCVea-Y;jOKSx{uQj> z2aL<{rwcA%J#1W-OZ&gfxa6Ng{$Iu=pNaLm+PLI*dCAS(^pbJO>+f^lHZJ*dkblp( zPw~$YQ|4jZo{BINe^K|{TV4OP}mvO%GHJ{sueB`U% zdz0@7Ka9LT>I^Y1>o>KVuXCJnX?G*)j3K`jK7qU*_0NUtdQZaZ^-Yvde%-fQNj@Ha zFZp%wWmI23AGpSNu`eCX*O@x9e{H~VrpdT0?>f}qU|jNgoM|yG`9mAr%uSn&OJ0vN ziClTK?Rx{RLB3sX#9ROWg&t>;jZ6KHkne0<>g#c)C%Jxq#Q^dnaXxSix&FVQ(d7Dj zv|MuiK8+&d($DALa5Fa*=SDYMmrIXhbBs%VFP!j|8JFeS1LsTgj7vWMZ8vjMMQ(Jn zwZ6U{Eix|oH<7P0F7@?uBTI}+{>OLS%uO}9(aqNS`u|o|7?=DbjXqarTd(I{NvRJd>CHB)a?h=NOkdFQU$cRHqF6 zxy$6GPA2LsHZFCxpw5$2NB`f!+a@2459)kqTsme`N{diVh2(w`>O8Dd=OG$4N*`Cjk(`lpaz4L{4c)KA{W=cgE#`niqXXOg$T z_3sAj@@AsW^^_m81|e|-IC$ydMceGU2P@YmT< z=L5KI|H*jY_d~#U$oK8&e!3cUI+3@+yBU||s=>JRGA_&2XT7g`DESTWLF8Y-hmw!~ zz}FdRT-t3xyW@>ZyZt}%`HAFTedxWA`~}oMkNiI5FEcLfruOi4t~D<0<{-b2e0TWW zG1yKtFT;0u_J$?acQ>v{E2+JBJv{m3i4I$eEv)F(hlBtn(A+L9Q5z@_J+%LE9YH$J!$~Cp0^Jr z*Yn$x$v;OwPa|)JPbSyD?@$bvexB#M9L+DI{C{`!56&akepVWn?fiXgCyR{B^6LAA zYU7em-QeplF)n$1zpw(X{Y>`p#3#mQ!Q`fe>U6|@vBkKwI|c0~aH6Q|MVG6SamlYl zKH0eRQ@?MmyK%{%^O>8uDb={-Pr!ARKE@@#`{$B&zXvdG$8Csl$)AgSrg1xNqsX&& zh{`9 z-(+0!`ab0@V_cTE3CsIW-OAi@=_;xU*DhajZ2-& z(9d7USHX8U$3IWkW6$sW{XOBjToZ8oKZ^1%AfFY;7f^m0@-xVPfnQ2>>d@|ul<(W( z`*}Ng3A~E@A^1|N-?_c7^BU!UK>l6wA>aG_msBSMb#^<~Kd$3hk9-ffj;H4TPWda5 zKb}1CgReV|>QtfKDU=_G{7mwT;icq{!RJx^b{PLP7Rq`=5jT zy*GI(#^-qQO!yS?b~p~-NUpz+d)oMHjE&qp50~+mkMB{`=jR-J;?Pqb||@iFZ2-dk?3cZaapblfAsB*FfPlb zuj4t!B|qtRpPyh{@_K!;kX&CkXToK@%lN0FKXb^leEGy(#7$#dbqkmKbz zvG+_L(Eb!7pFv&<9|za{v;zC-*~Vpjitq;JT&knj-)=H_+20#br_#98xfgXFpgMZ} z?In|sUcXY^lic*CajEkT>U>0X%CKMWfCbm(%1)Ik?mWo2)amr!h!cCmb=+!D=kF#j z{i#Ux`QwdConugE4AohWIv1LJG(Mt3eOxw3}mG+O7WC*U2Lv1wV&;$6tJYHu-G$6~?9A-1H;)6$$TK$WMW{$4P^Z|CjLHjZ3@wcgMRKmv)yTe-L>$cz^Qo=;tuFuHU)R zc{iOwUKOc(Z6#j;pHIFH{segoyq;XIv%O8O*V#TH*XwNGk=OcRPHZ9H0N<&^cR-g{ z{~z&Q&Cizm_&m!0DGn>2)_jAZQVLK@{KGOZ%2lq?K$Krk&xjw&~9IGi&W&9NU zEH~BU6L7zVT*s}Jd=Bn6kZb=N$+iDY1-NS>#LMx#U{EkX(-g#pIc2x0HN1yo_A?Q%Z%QU#hwEl3#>cp2(&JACc{{AHO!8EC7I`K-*Z4SBUyq-K-f}?Z$W<=$Xnoz@$ScgsITAip`HuZ&r_%u!u9`;sxN@2QvFtV8oBP*ndF+!B2UKlkWJnl zoI3s<<aE3W%vCgrtG7I`J=s~OW-x++HNg*8S-`HbK&*mx<59M zFG9YNd@;Oy=nyb<0?uG^>n9Sm77XS=NKM=5y!q^`$*eZQq%g8es*^7Zgc z;}czd-LJFA^}HyXd^qalkS~B28=vgzm%{b)9nw$nDtH;?_57fmd?Q}JtH`x}HTfLW zuOTmk*OJeL*O6;~>dCb~P2_#_e1kk4-a@X|S6j(PAfLedU>&!y@FemH@KkcGqyN8( z>!ed&>tvAYd49I>0=FKE+&`Ie$csHEa>;f7)$3}~AE`43dA%N>uKQyt)zSU2f?V6J zB-i6f6}h%sOvH;`+)jpRBGP2}2cGr1neTFABCR&qTqB`5ig>3C`# zz3!;4uP^$0KXt8>Ms;eiyqV-$CyQLyV>Y?g$syPGJH_OBJS-*8#{OGIUI#BH?~MJW zid^eglk0I$|38F|kG{{UrM&j1j$HdwPu_}tHj&rDo5{6K3wZ{XtChS6o{Zl&YX7x< z3c1$T-%n~@>!(p(k4yTwB+Zwi-7L!M`^;=|{eQ1Hwef5IpQeNMm6q3(v=a;jXT)%IplspIL zXBFgQ@j6{euICd~$^{qmEqb*OTk#>l(;&(Vs^0DtL?WX>JG_aNKSsZ-poR z=6{fJmV6S9KS|{JelwL^kB4dG#i)}`UJB13*Yme*^7Y8)kT=0|$(!MY9p;3vJ{?5uGe?c$dj-?>fc}0`f2bi%BRD#$ur?OLao&!%J z&xPyXmDTarI%$;GI_czECxd)0>SvP|>h?fB2cAo=uM36b<;a(j>+4H7xz?#5*E*Ht z^H9HvyaHZLz8GFdz5uUN_2hbep@Do0@{Q#Bxxp54t=~$n*KrcNY`Z-yM*Sr64e(U* zRxDQf6q#`&vV_Pq~o|+X!7DY@M7{tJ)V#^ z>G6cT1>0>o`6hS;xo*#ul3eRok!$^G@^*SWA=mo#ok#Ton~_Fzy6&c*&bv( zt582_H~)kB5_mFs0>|wXa=qT0POk4?GRQ}uP9}LaJd0fG=aNrAzL2~aUQDjbvB3cS|^vh9bS(L$xGp7z4@?3Zg`B-=@xz?#8*E;p&+W#hUJ)dtT&)3%r@*;REc_ln~k8QVyVt5Mq zTzD$^Ja`)U0=WKt16jW_TvHjoxkQ%9i|g?`n_Pb%mqT8K?X#F%>z9&i{W5Z`Urw&| z_3s#H|L3Cr)s!!X*N|7kYsvL^+d!^$8p-FOP7}G-X(q2hKGE6#p#9f6N#qsCCzETP z6!N9Wr;}@)4Dw3kGs(417I`i5x#U`>kX&Eii^;W4DY+iEE6BA@C3zM4Q$?$n+ zuOrtw_2i3@Zy?t?jpX{e&_b?tTFG@gOzi0!((OU(B$3ynKl=ABG~WbIqkIzf$8>VN z-k3q2gyW?CT??+C!+F%tCD;0eh?R!t2Pj zKlS8==w}0Y5xkLH``<*a{ck2;i~i`}!O-#F`u=gRZMT!oSYOHHDex3>y^fkno{4-K zc@|v%o`&{E>ts=0>tvH_og8v~oy{dLLc4|JCGawGty4~}bt=fUP9^y~)UP71gjbVS z!RyGiPCdESX&~1+jpVhc-$bsTH*O|hi+rNXw%du;Ng~%e$>drmg?t0*r;=}ir;+RL z#WKmYP8PY=$tKr2Ipm$OzvPnZ_2EMDG~~<3wN5#?)~O)ZI+f&^s9!}s0$xo%7G6iL zb?V8rP6N5tX(TT~{U&lfpKK;CMLvEwFc&LG$0b|(2o z)X5^(&pBt4XSegqlS4ihUQDk2DJ9qbl#y$H%E|TmQU&=Y^uLmPAo^27uFF+RuFF+N zuFF+VuGga)$n|;E<6 z`ZnC;Hb~{;u{wI@b{S_0@tJN&()_R_D#`o6tH{&g z)#StBb>v#Vo?PoUkZb)$a;@J&-i&rz$@Tq6qMHxM_8`lv*CCV0_54}C*IDygKaKKQ zKb>6bXOL@s{hnH>U+nrb1pUu3dGQ>0E_oTekbD8Wj650d7s|;~;1%TE;g#eA;Z@|r z;nn0i4t3;Or=DEvG>~hZM)G{L+eEI{ft$%ok=O5+)$!LlN!|Sbs%xEOa;=j>UV-|l z|i)?X#Y|5#B_u`DXH5)|=%&G20E4BZ~chr^4> z^>enRo{V-Y$@ToCio84W)#Q3!QA0i)`C4*4uV^6GI*sI7r-@waG?V9} z-4=2^uV^LL^NQqDzd~jG%J^uV6mqSTO0IR%$o0G;oxBSD%pk9ZXOnB49CEFbORjYa z$@To9n0zhTEhS$EuOQbtmE>Bdid^edlW#=*8uBghTJm-{{xpzloknu4(?qUyn#sHC z`3ZS1cq@4yc=CRUXwvOR>!grtom6tIlSZD6`kCa_@GSCnIPPVWr^0i{C%|*bQ*k~} zNS+QaBVUI)<>XqYf?VrVl4qiR75P{khpWje;5FoH;kD%J;SJp}+kCU`b^4m^ik z>*SJaokDW`d$q;n4LA=eCGWnIU;YYm{Tys1c^S@&s>sXX)#UnpYc=Fm$k&oDhBuIF ze;Ua%k#8a&4sRyc{_FR&>Gq)gOzOGq_MrVtCf9zZkZ(l0spOmBY2@v&Ued{v;Thz5 zKABCf{m&uS{^ycw{|m|Wx?(Z8URNw7*X6As?}h$XlBdC|$os&n$@Twj){$%ddUCDb zK(6&0$+doq@niia5Y1c3ll8G)ZQIFkHFujto`uJfjUQ+7DddasSgP^kO+Jl0$sNyR zN;iIjr)Zu*uIGW7#~ge>wB)XFw~B1~>_$gA;KuJMyhzK}c}j};p~+2l*fJ7Iat zjE^w+a`Lfwtit$6ldmM7gU70jpJMXWZYr>-L#ye7wo0 zk>{d*y7ALYK7+gtk7XLyYtr&i7Wq2lvyGn)lbam!dh{pP_!%Z&NM4J4vGFrazLZ?| zuQKBkOun3a10Jg|ewN8sk~iV8D&uFHd^LG9`d?#wqRH2ir)=*ZtTUc#^7Z6;d}}bC zXY!5YdVFXyKFQ>p$#s8eF+SPkTgmnR@g;iukZk|?CZ9yE*GZC%7npnsc{`ksr5c}N z@@eGS|8(P1O+JHs0oGTh@j{c&BCo<@*~X`td=9z(KiFL3=a_sU`CRm;*!a07UrL_Y z-alAoyvXFs$(Nvhg>m_OxK5SiecJg)s*KC$cy+2KZ|LM7sWC3UkJG7^yaxTLGp_4U zo>Nc0B*|B5Fn*pEcejn?$#|^ExLlXhshPZ_gMXyOxLlvnsg*n(+b4dFkZA9g$DS{x z!nTpszpT_B^4))UoFSi;ZVXVN4Ci?d$tS^f4aV*3rXCliUHkf&vV&hhar-)$VcfpnjWBLs*Yvuz)UmH$B_?lQ zr>czG*P{mGxjOjnRzGJX_4AA;<9HxG$+#XT#3viq&)taI*M(wJ#~%Nyj88Fj^z$!L z#~#nuo4h@4w-~p_=TsaorH(xgXB)T2+Y;mUxLRf09zPq5+vB8O7m;@D@i3)>Ur2G? z_eHXd+vA&FcbB|9j_Kcj6Sv2!$J~9Hm?Ofa*m$I<^ zh}+}Rff#>rdt4e}+#Z+K8n?%#oiUzL#~zo~8Mnu!ZWuSo+v8G&aeG|qu%ll{$=l=7 z8#u0u+v8GG$F{sZF75xfHn+#67k6oMdt6$uYn$8S(gDeBZjVcSc58EcTsnRCHn+#6 z_ItFsJuWRaZjVdrJGbTSacLLxd0=~7ddRpvE)|*2f7;{H!6|L^?Qv<+-feD=OD~$w z`Q-XYG{4w<-XqU=U%UXz`m)ERV&nF>bhY`tUcRaGlko!M8+-XXQh$o^z6Z3qJuVIE z-RAbV^p0_RT)M7rTiza*N)KyudtBPwzs>D&Y1qIvx5uR}gWKF5mp&ib=JvR>&#*SP z$EAhX$z>euap?);_PF#Mc3R2X<5HsUtb(Gvz9j{vC4Hw)D#$M>nmuuP@wAB-&YD(I zFmckf8F{lV3T0*$DTa%QL&6#I1?A<(Y~{+)8kv(0~=mV|M)) zl|-At3-TVGcdA z2S$&C_rSk;*zJaY@vv-cfAO$vY=7~vKPtM_F>S`w(1JxrMMT_zYDUSFm}QjhaqGrX zT$EQbW#+8u6E7~9H8XmkVEXi#7ZfC>MD3v=zXcXen^6#IS&xjN$EOy|@P|$p@H_JC z>3MG3i4LcDQbFOwDYNq2U!e|cY<>jXCKpUZ%l}sa`_eM;f7J0WK!1^%GOM6qn+G@Al}DX#=9Lo4bxj^8wMke>CssC5rTqBGG(6H18kH`}v=vNWUl&%?CvD z{?WXjpSyK{jksi1zrM~~C)1;6MDqdByni(B7tPcCnbiN^e2ROYg11`R6spDt8@@@} zh7;~|Yny4IyC;UXL0cco-1^hDKj7`yR=mSK`LCXjw=G-q{QSpV!*S2g#xv}DL?M3u z!|wTPlFM4?-2+pV|8i-B$FGNLJg)tLxNfAs z*Orr2mk2eJNW%57GCbc!qKVr- z$~}=yf@%No?Kk?TMeWNaByPV)p#5@Ochldepv<4z+B?vG;%?u*_FtAiHKzUYK>O?V z^ez6c)$;+cKOqA{d1iZGZVKZ!^0-=hM4x#oOAnK z-IL?Se+$~z&uK_anYgVz9k5BR8SR(K9XHALC+nKqf5B}gaqX|d^<4ejht!aX+j`bL zpG|VP_xkNGSMIn;+VA83ar>tR+Mk2}?^7*LHWRmXg@d^M_rmq!4d%J>BR~HSXK~L@ z+Sfm^$=__9^YhOO^k4r!f`0Bq3-I%c0^?VQ@w3OTey#|QUqzsO{amyD-YC@m4T1J6 z?{g2h$-aIJaQC_W58VRAjbC%m=;{CS{P{iid>#{dX4?I}{VZQ5+I|jqKXd!P1=`oo ziT$thuhu~O#WC&6rFw4v0=MvS%fCeqjBfg0uixjnC&w*+E!wx^e}t>Y?N#o4^XD#;Q-zp2|CfR?Fa{st}`Tv@6%Rk{Dd6xTsVmOcY_x{}e)Ik5o z9_pW=pEC+Qe^Q|TnGgE@m$}DflKvm<{&D|5a~9YCoI&mZH~p{m*W@y2LgHJex<`Eb zcKv0#N4fo#f#t79`}#R3EzE5#cfcmu>_>h3S$Lu>|1s_#w=bU~iCg{&8UBe?{$}f( z+xpeLfW|$43!bl^v(f_m{LSw9Y?7@+|7+d(rA*TQ>){||xpFY|`Wv)teFl+Kxn z+xo^mpH1S~Px|q*ub=X(G;Y6Z;Qd$f@xD?09GJiN=eG8A&yQ=r9_^?3ZbZv3znACs zpA0O2Hh#ai_ZDjcN4D%+ONR}d+hN? zu9a~6>jT?g+GyXte(ufR`}0`88`%D;pYhADfA36|Up|Mx?N>RATmDx3l3hPX=VH;s z%YTFysd|Gynb`}o*_`^is9 zIB-p-;*ym~Zx40N$j?~J=rNfU;lfX^t>S;6a*53te|~-io{zU7TdVN%hv4|RHGm(| zFZVxOFCS1a)3)~#iNS&6XX7irM>TTLbd!wV+3p{Y-?h%TrlZ92GOvwp|F9Eh55)dw zGxGB-c;P8Kf7?g+`TGaqOFNZ~FGLWv6q~|6}hxz@kXHf8p*K28J945Xm4agGv%*P}Bhv4u~kIC@2{jKv2Md z5ygOu0nBLy(=MQ>yCyJV&XLtMi=r-w3MeW@?x~)tnX!R)ci;Q}zUMyAz5P(rb$)&7 zoKvSxg${Hh{ZWwE`q456$#jOKyxH2w{6A7%8CBRy?8t#kOXbrYWaUTvSX^FLQhpd1 zPx8vF*Km1d4CUFpx_JJOX;W}t$K}cQH^~uFe?n`tGJj0P58AE8&PD!!Dj7) zbmuGGgb*Wu5>qz7$x)v>>K22&?sNV4ZHnq`q9DIT<_b8d5}+y*XP6mCoBaxyYNws8^2 zTN!SvpL>F%$6zwr254&~+68E5IjsS*s<>7~HDFueEN-BLrg9T`lztwqp0GrcAgbw@ zZHnk+kVhDyQGPLCwPQ>I5w^RRURT8LFO4gCMQb@ELzyLGOuAmCwIxl!n;36j!q=yA z5wDdEUH{~3Q&2VN1>Fuv_e;np#>bb8hx$l>FN~(^7t@-OWn=ULvn?otrM>upIWtWH zcMo#P-ZN@K$*w_;**gYx%6?7vE4@nllqS%ArNy+KW-+ZJ*+FY+CeVCI6<5n4;#*Tt zoP&?B%lld7eY~i8p*oeji=Op6A7uN|T9SnLE+ujCjwM{MM+$tez>e3DlH!InC(qXO)>F~}vm2J9*u6<%_EkaM;Rr(fwMut$$0vjw_@rZY!RqRAn) z=rXq0GkSF;OTeDIPu%)T(k>;%V9#Q(>pbM!fgQw#B(Nb_$%d;?_6FE+3G`kEJIcV0 zda$DcY^VbpYCyje*g4LXbsNf0kB*@67=|F0c3|A*M&(yAR5 z5T^}8yrHjp6@Ht3ssQy}AA7M-UA=6y52Oe#<%Z%|GcLa56_@XzZ7qxCI9gqz1MQ{` z?WPIsrVH(c;&=C`HF-&u+LQj}FRsV1GNO;r@ww^eoM@3vZ2yE7%#HF3U)&xDuqti^iKp*H+ z8i+PTG(Ql=Xb%m*`@J= z0>-*0ToZ?W{wzog4Rw%${aKJ08tNbg`?DZ1G}Iv#>|O_UpZMGqB#ZBU z&_;a=8^gSz&BUL+O+UlL`M2pUw_!RZ{?x~cs+U4LqPYq#g&Q_-RiXWOMIWFo-$7e` zWZIG{ir`Rga1U|60q~rUPZt#$i$xA^L;0_Z_HgrH-Qk`DLpO@FHc)%o){ z8hr6%+>VAihbh(Bj)`3+ULh{2eaiL!2=)I2F$`-FLzz9(L=v!PG}M#SJD5Z5Gf|^% zm^P96wuSnlSdq=?Rp0|F9`zgby(vh2rg-_wc&P~9wQ&Rbul~z;p~#_WpnEm=1o>kc z%O9V|p|MKVhQDaK+}OGQ@!I<--<%FUHog9O_mh&bRRocM^mZk(>$)5N|Vl>xcThR3Vqeh?f zxaGW25dPMo-JTm~>gI>ro1}YPtQFla+4CTMsg6mH@NAt;iM@Za+;d`z(VrcCU5?&! z+C4QqG<^8G_QPMS+%dc;a;?uuv0+tIyvN1i2lRG0xP@NcceTn(fA@l*%`2)?X6PHf z+3Rp5Icm(A!cHGtOwx>dhhDW@v2a7zL$`N_Ub9P_6X-f^%7Rt)YkijW++FIMU{-bf z^a>mM*vsm7B616DzJ%|b;p3X|YRs51^J;&aG{2hDuET>YvzVGWy%)7RvvYO%yX5h@ z9^MU^bNgvJs#wq4CaF6w9lOD5lXu)%oArs+A0jqtjjPKl-*Gd4XndSg&>j0(W^K~5p3?*Ybv+NQb@(#NBBp-xWO}zp?@9GYU&pp1 z3oe!Erk(Ha5vFArle{Y{R?($ZvFOAjPmp0nE-hXU7 z$;^8q{o1WzB*Ojd8^;xeZ)8<>^{;!gd@*7>!p9QXu z>EC$Z$e^V+bJl$Ez4!LvldiKaZSxX*iL5&N?CQOX*0r?Xlt4=(UX_--|Mt6`ChMLqx>_-$VBf(C z!M8a*PtUkpP<%6XOPDcl%Bl>*)XOWT7@FF|SQo!o@Ol4~_ufJ0u66tQi`MQdHTjEr zPcJv~x;U(19?7-1? zw}i~JK2!RfGnv~Vv+&xg$hfxW^}Qsi{ujFp+$$+GoIZ>iYGx!1T;FG;?(Ju1HyoL~ zExZ$z_F~Tda{(Ie)c8PjD?;O1p{h3f_$ z;>WAaPpY0U&9|R$?|w)1N%z}zXnT6kFGc_B*xz3-o4B~>Ra2Yw(!^oW zBc5#f?c{b&_qIYm^+{sEsQlhNOrEV@8`LM}XYY{P&z2?J?(=b-+Qyrk-#b^;z7Ta8 zd}2)dx&_t`{W{c4n0K~%Zq(SzmYhBbaq1Up5A`-QS>w5RLVUu!ZnNVSJk1}*3*30n zT`i!`5Q7d(rMA zR#VnL(&MkVYp^SOuVbHU53EuQhTBa{aD4I5G+^PCd3h!SgQvB*$4@)5KJUolnZDIM zUQK)T*<$|v*uLsfH%~>M9%y1-%fD;n>fW>OL*qjy?fMShY%uh644j>>40!mghhS6V zMYpn(0jD`Ush8-tM>9QeGntmwfJk@?M1ya+MkadHuZv^WBgvdjfZrM z&Q5*#bY-CD*X<2mG%SDh|M<37CyVa79X#5Gr=M)g|Fzw)0|tVRN#BcWVy#ZST-E#6Od6OYZe369~c-4Um|{py>ZtDNo^&#ZNr=adv;f566Q zLWG)d(!htW^o;T%oC_`sRv(S1vHb4Fy%xnS$_Y)~@3CcqpXR1bw+tT@T{^Ph@|#~f zM~3eR-LWxg-n-v-TV_XJtUKDaRN5{-;PB`e*U@p}z55(IZ&hz{`B-98)>boU!@B&i zg|pUuTvaf$SLFIE_r@t*D%XUqc&$IjAkJ8r)lKKN)r)hRA3s{X?oja5?epG`j7qUJ zYdV#=VfBEMrZpOSuLLL|^}x9kr|gVoFHgH9)%r%RU&04Xf{#DrR`#o(FN4Yg=`(jky(eyJwC`ozG`{{Xo8Cr}UVD~x%By_w zu{iU7+~{7_AH{Q4ns@N~;3kx={Ag|D_3;nRWXFVtBXQK0KPKAo|A=p}?t1W#gMD{L zPyvn~JS+$Fw_B4o#KusZm3`de>#D)KbN8< zw|wt2WO4DrD%Fa``w!f1m^Q=mYSF7O_wsdHr(X4TNDz11^xe92{=2(7{`7d0?QhWY zRmCF2Wp6 zRpYk_P90T3jSgp2cDCpF7@b&UJO1pmK7tcI4;JX2dvoEFny!_K*S7S5;x3g|No!<qeJ-Cs>a7=iBVQ3_ZjGHa(%+NF(h`k(VQC>D^|5j zc(S~A*GNsfp0=gO-so)kef~P_LoXIiyce^v8ZZvNJ>Mt8HE1c&X4 zLxvttUpc+zcF)Os9X;IBN9kW)^Rz=o7Z=BdUyHrtdUlFGd)aT2fqA{-RCjNK_`ilO zKltMCX4QbGFTN&v38tT4U(~;Iw0*A&r=C0=W$fK=fxti`>6O-9hnG8U`H$Nj9aga5 zURL$-W8Y6biyoPAFeJT@|airucNqwBl}43BUOKEA9W*ni8nhi^r-X$>cjE?Ri%Q*2<`(!J-0 zzn!$N^zPRI5glr#&3kN-ovsr<@9Ca&pLPbt;K$iI2WGm)GWQun|s(N zvOs@RVcMhvZD$`;e^6MlS-nea*8#4lIaZ^q79XoqZ=b(TqW3+?!lGBH>EmtNHFe)E z*etD&v(LPD@WFRgkC7X$KHWTQ_LU*@Sp9&{nX12@-p|SJc>RTT$Hk57y%zMDqUslZ zYQJhhg#ENObrlQVmlXwvQ;{}D*V5tdT9p!Da#Df>cBn0_tUR6cch(Chu%zw*mx^ty9e zw|MZ_+5pSO7ZJbRHJrc2Q!q5~uXDGOPy0U^arL-EclYyWAG*1&|I=V@)bgdDb;eat z;bQlz9zCwT|6J}q<>U^tE@wt>8n-9Z+kNX0amTsk$2J^U_w!QyTSlq6$7h*$xjp?f zbuPhd@xlH%n{AH$mh}6+r0(%fJA6i_C#^hkbMn@+=T8obdDEyHIP=kx0Tvpmx6Tf} z?sxyNhcIBkp~9*Tt9GhXjy+a)>+|OIL%YO3U0fSw`)0xVl9P+dJ~-O-E#g{k-*)}& z#zPThnS9qga<=<(}lk zj0&G+&pBn3?!@V_^VaH_zs#g>_r7++zRS!R z*V^YGG<}BYWBlV{bLuI||Zs z>9DE8!zaD&r?dLw;<4qGe~jlD9U9+|)jnb~_h?--&uCN4sVyUOJYSi1T;rhDqj1Cc zK4$N2qAb6}ZhYVN-GdJHce_q{|84khbKOR84|^W^Nq@>v`^LK(C&vxFyd!LR@#Udy zss=B8;4F#^{@FeEll6*|In!QVo!-G_pK}Yjuc#dnR0ku^ygg$u}cOfdmfK^w&CWcF-}2dQ%>%h5as`2iMCGK zNI}S76OB_E$IJ}e&A%iTUw*pJKYqYXw|TpbXnU1CPb_+@U9~T-MAauh>FV5`eUj(y zuT_kM3O;-P5?`aLR)_u6yp;87`le4C(Y+#lcaVKK3~L zzHd|8TW>e^zuU31?V95bUtbta{Fi^74vKZu#YwZznGDO4Be~?6%d{ zdg8G&cU&i*T9Vi8v7^(v4Fi)kUs%*v>IU8Od!Bpep5?Xl$g9b-dS8kC&BT~z(fQk% zo6F{{v;Fd6S2?c858Y4n=z#z~h`Z)PozT>a?!pwc;J zIRSo#BhF4ddhYBC4Z~@!s@I?NUqAirsc(Tr7bx9=$fw8KAO3LjXg8kJV4^KY<@Xua zE*0VKOec4rQ5fS?<4 zKWwc@@x)v-HI!u0gCA(4e|Y@|1GOf_o;iw&3?tdaawvvmzsezWzxs!bEw~XMRl)aw zIFxf9$!B4Vrbdx0F&VM_AQuR>Xj07?m=TpB&tk2_7)^zcY`z={CE0CqD1>D9$e~b@ z-6w}aNcM;v3O$XpcjQnA$=1oCFp?!z2fG&I+N0Z}Xk*OBdEy3|3Y8sH{Ib1}gAZ-Q zdnAVB3ou4gWB$O|2XZKsWED0kzcqs4YfV``mV%U#JaHF?a>*lk;v5d;nn&`)6&$K- z9?6sX!j;ayZFWBPQ83=qR4~bg%c0PzI7mq^`QvSB1lOlGCN_NIs@*e~=75;aMNok^34Q~1BHPNPj>vpy-E|o$3 zZ6QBwV36GAF(ga;2wwg>n+Yqi`5*KO(j+V8ibEQ3mOL&Eil^e+;^YYyWD6cM?d4-< zNEXhLApHjxXJB0l^}*y8yh432-1uNNh5BHv1vHFRt^P|Dv)Q9p&-dN%DKjV#aU~)bAySWrz#+l&5%Q5 z=izLD9QwyTD3Dh;gk*^?Xex|k6>gEoiNY-*#4Y5_?GOPZOWZ?KV@X!wDS3b?JQYGb zg&%&TKo-dokAW#7_UK4-ktZvmq4wcsJR)z-0HWSa5n!G;Oa8SMmQ=)|BMPq5 zID1(R1rQ_q$vrvN4`+kqP=LZ>S&nTtF|rIB$%SXj^Vl{qAln26WNT!=ztc$^LfS=* znk^g9iCakPs8O?I2Z$#~8_5rl%9ECoANV^P?%?`9kT*^Q$yUgraFQi`4kAAkw?MSK zCBjIS^d{hXhL65daFHzOC%~16+ljn}4}ykdNe=+7zpDx{j<^$~5KD+7TkM`K^fL4; z;tv};T*$#RoPlU1*{K*(q2AE}d4#&7U?gS9o-Lb?4;adej3QEIC?K-_(vr7QFcC=h zY{6RifI@I^bHTw?n9EKs_;1e?%yAKN-T`L?BpZhhq3H-`6Xnn-k|kyU7d|N8u`5Az z5o!NmML}#K+Mu!I;&Fzpg%okd$H6cW&Whzw7|zLeY$>EPQLIKy{bwsSwk|G=41c>~ z3&nPX<2{@@kZiOZ3L#mA|Ngdl=i$;haw(%o_PQJjCfPsa&?u6CkFn5h#*DQD(aGtvjuYKZzF<~CW`-YM6h-Jqlh?-4LdJ4a16;_ zmO~*Vt8n?>Mg%TQ*~z5@kgPq1WWyh!#0o}|-6Zf2N*^P22ZXeDPpVQ3K{uq?)TC*TPE@kKpoXx>|*#JYRl?uiRoF(f1 z-AE*s3mQhUq)Ie3E)gG{fcMaeXXjnV#2?Ba&dYbL)zA}j&{QDFDqI(}4<99U`4`u< zMRLJGB&!e{+g$KJo(J6If`^l=!b33u_$cuZ49sa5%8?h0A?p87KQqMKV3jYY_J>{d0$M|R3}Nr~VF1tc$yGi)g(824N%6DwfkOR&* z1Gig9mdN=RUBpK&C6Hu^RnXUoF0yaU7DcE9k*q?>f77ePSffJ9f3db1;n_^eKaSq> zxG4R@>*g7d?SvrAN@V}zP|d;x7vnw5x%@mrct?_o4K+yM4lk?Xb$|@KN68p=Tph$kQEGNjq_?If zWcetoso5K{>T*FmBuImi0RKj&iC%rK^R0IAVg zG?%7b1gpH;>ciBl`_o+bZ!D8sZxE;FNRx7&Oi6tnW0-*gw+15wJg^5@iKH1KiwI$) z%kUcuK#nF)R*^Q^z#yx;2nw4hWDOD^X>D7udXNCwZ3=d`Q3yA4`++pKfJzK+6RbH( zb0mndaHCwn981K6GVp-7EMtxMkY5O=jjaBt^0sW>dhzr zy2odhFIqStn(vrPTYUiMbW+C`vLFC_0Z@sA9|MXP06SH3{ff?pf9iwQmwmI3ucnTu z*^oGE=$6W>Xdo%DhSF5sgfg(va~KhPT5c4|(9E02Ihoot(noPJlab+a7Ci;aBEqr= zvFMQX87ieq59R8ew}wbT6!(Mva@gq`AW1T_`S8CCAbb!FK0|vX0cXp8%o;KberEuc zWqpxdEoUjCG+Om5{M`13wJ!Cq$`$!x&1JWK1CgLgWh1Y5xx>Y(WoF&uEq@ zgl+~KCleAp~2RRk-;K*<{xogU*3cJs%Ey@^z5)65$!IOXV= zHa(0n<`2}y+H@d8+_DBj(P)4E*oF*gO`L`bpy`bBmpW5LdHbLiW87)+Kh{##iV&Ij--n38x2KVBWu2zsN8dL5*lFJXc=SX2ANtTo zU_>zINmY$C*YoQ_wD~+A8So%yB!pJ`YBo zf)+9QnpJoKQ(^QQz*KlB?b6&UEiox7eO*!ML{_B|S(P5os$>$YlF6(}PGHd!S(Q#< zReBPu(rJu63Ma_uR-7Pf&qd%0y z|J(kb2mZG_FvMp_ptZfwIw}!9)nPq3CM8vxoMi3d>gep~Vr`$8IC*@R2`S0(F;QvO zZf-8FqNrGRXXhAKcXww|l#5IE*zU1Wkco7QiiqeI(cL*B#x+Vv_3z;{B{?O*2|maH zACyQ>P7Oof2yyyr=gwy(i(afQeST=g^P|gOY~JeR>g)=CF3wK)LnBU!(#RC}zD%g% zr4k@56iEyHQCetoX`w_~XyhbmB7D>Ve?bDQ=$xTW^AKi$FwuY}TQ0QA6 zU0uV{;8pcr!-jc{3JV-Gx_?;EsDS=qVeqLsIWO~N5yUJ4ULv*GCmIry!GrQLNIt1V zSWHqB6_qwsURHhpJ_Lfk4nR#!q^73870cAPPk;}4O{F3gmdK97 zHwWNNFzE{U(J@iYWiua#A=b(@GG9k%hQhaA5@OORWOTD*Q7P#Y(!ye*B3nBY71@Gz zS*fVl$nI{fmV@uMAgz$#t0t*%7LLM%N?>-0%rAVgB{@0nG#V;wa`TE@_l>GW>-l$Hr1gR8o{IlbjTVKBh7WJe-2Qml6{(J`CItl>o2t`u`&8 zQ9snfosph4jG|{)(q>v#35MO7Ekuugmi!p|l_*8(Fh4Tu|N|jZrtNEKW zenw>xZ#3p1H&f7DGZkZKl|uz+GvMNKtL;_Kyn<62dU8sPDv4I(#bJST^(H=yE%4u zN=;8qNls34nv|O2Bu$D+oD?176cLdU6$gD6K5;T>Y8O;8l!=s9L^mH2S{-2icg84e zT`2A;@K&b8#I*DYF{zGmsN$rn!KXjqG(|p4OiGg`0s}OxoPnVzIK5G4&S#LXxtTQ0 z<7pUjw7``=9$5rO)HMV=-e4Y`$x&%`d^H?*(`Z!XR?gyka(|}h@=R5^S`t<6pR*2e z3u(!J+Viwkx!dSNs@w;&Bs`%i_jg*t)A!}s4MM-dK|DKEpj9C|2g7CS69O0F>?F>Nt6um z? zXx8TD&6fCr_{V^^@#XObsB%w3wHV!pTG8!8RCCiMLqRF8%^;qZ-=NlYYlCiIZWXBD z59FB+=4t!#tOoEb{ds&)cbKS~+lsn>T~#G@v;VJB$D?HKq*b|BXbDHJS=ir#u-DKq z&E%>3sdDp(C8s_v=jP2Mam;XIz1V=P{V)2$8R?>c?|0;h}!%2p|T0lmK@L&x{=W@A9C- zmuKh?U2ZbS4^ZV+%tT#|yNENFr|p-?bL98o^#B75RpD3-922Q>mvKO?%%~m!5F7qS z@}PPe7%~hDnhJ02Q00CEoe(I690^?3W{;l-IB5LjYVp&cS&z(|tI9oxT&O4Exh`bP zHUbxle0Wx1E%?<;72;_N2sDNf6e^+b2gQDw$@fGxz5oE|I|zqiqu>I3qb!Elm!eTCM{cxxqgB$&TA;N^gnM49;AQ{{iPSIJ`BEwcTRuA*)8k!HW!zzGm~|wij?3 zo=G8_56%=axRM`~vRt$#X<_41&Fh8OxU%aM%}Q{o=Jk^CH?NlrZ(c7M-n?EiT*+tz z;0-;-($dClp&bz)S9VFZSrM-6(tith^Z1m>VXj>Mzz^^F1Fees%Hoouo-??jzRda? zO0I)szOC6bg0*9AUBK~v2YT z6`Y(OvH53Ueq;~++ysLx#yGM^8NZ_>zXQ&rogVO^4arx=vt)2H{8cOXyjF1HPjqsn zJc{~bem1_c75sH8xDU3UEytf3m(bbWk9rTcg7?8g37dayE4Ye^%pf+udn@?NR`3I@ z;5Dt_F1QP^^+vaXSGIyjs&SpXEwH+%vSINt>D$I;7)i-V9Sqd1^>Af{6i~vBzo`x zHn#j#t>EWd!N0VEd*Q*BEq_`o`0iG4c-O1kPUTr?N-KDID|jEg#6k8b%bDK_uFBkf zm-$DTe`70ncf15-%aq=p_huHjg51$acq20EBLZj@LR3mX4nX}{D@ZYm95}cTEX$KM{%IO z%x!yFHRTV2AlwFHXh&Am1Rsu%;bvsy*edbkYB4yHvlSmBb1RZ#4OkiM(MHw=ME)BY zOu6Gd@`Lg`PV^K0Ztv+-H46k+#d_oMae||D5Zb25c1*h~uXEO7obWqf z{yY|Lj`3fV&K8b$f2jZ8rEdFJfzQV%uF@2YX6TdxU;af0W%fh!|`ZEjP zk7*uW?-4r>VqA}fmtx$Eg&)RvM;87I#%0$NWaA_rs+qVU{~Sy7e!%<#mE7MIs)Qr{d6-U9!V&*-%s*8LNBkrXGnH_} zFQ#P$7AoP0e=(+)E8&d&m|m@fBmSkB-mHWpe*7sPYP%AS_*YA5!jXLZ2~z5&5^fDR*&Zw5NUu9SPpD$yIT){J;XId3Z2?L+vS&1&NJp{o zvH1KUl7+9r>-c0P+#2NUfrPdxN;s0g3!iUfuy9j+Ua^9O-^BPv7Cr!rl>aBJWv z*`Ab>&6O5l@;T`e$+btFzj&bxYO0<#wz6#^7F;415uKS>GM=JBb!ThRt zTp@Bs|!N;u*t@vvVB zNBrt|5-3%|5kHBCGfFt(-+=iqDB+0z2Dbl}5{~$vVE(&GIN~Sk>S~Omc1P_?)}J~` z*A)?72MKM?N;p1cXYk$_C-FemweYP3W+VN@6b};qN;tBI#KUMM9NE7J^OJQ7kx$w; zp2hzK^P_J~p^fmDWB*K3!jXJ09MrRvaAeOt%>R=Tj`$a1{-sJd;wS6K^-4J6zk>NU zDdC8p#6yu1j`#)Gsk@YL#82YkkP?pgM`8YBN;u*t@o-TINBoO1|5YU%@soJCr-UQ^ zGnoI85{~%E`11ziD1HztxeuX-*Mr3WI@q5MEW8ZkP?Xt_9Mpwm|E2_c7EaES@$|!t zSBM||!wuTVnu^FF{|xRdJ1pnd!u%o@PVTRWSva{);={s&u$*ufz7pecEW82Z6Ii(H zzO~}{I$}RLughTZ=VQNRv2b#0E{BDaH*~FK;aPZ{x`&06b#Dm^C;u{E#=^;e!=Gp2 z6}Z0FS-3g2{|*bc#&`t_?~L&(79Nf9Iu^bSH2Q<5?`6#9s~zC-Fz(2>A`w>j;*U&*Cq`cmWH)jPWuhT>1Lsc@~aOJE-eQxbk(# zJ1kre%db$v@f6M+sbb;ezIL4wj_O6WMiy>|X$r>?@`Lg^na{#cV}5eI3-RMAgi%4p z34%9Z#iZXL91q#d5ql;12q*oJ#1{|vmHp|AtPue+y`K-iwNG2HQy1O z8Xq%0YC<~Ym=cp1;fNl!cWm~2JAU@vF*+u4(zvjQ$jFqK$rQs&IYuRqA0Gn`#s8=B zvghn$#)BNpCzF%{|4|W>N@2P10Q!HFf}fX{bID{#lVX!8$E4)67{`JB!@H!WMZn|h zqz3Xwi>Jk;Bul5o{Gc5knI=F?Tv%*M#CSrs>;>lk0%X;csfH)z|B1oy?7#eZW+>3I zaK*n6ID#M2A|ffr)b#PpJ|!7F^zRr5x@5Tk$}ZZ`1O155k30Ht=}y^Ab%Y)!hr^rYT zJPwe9xSJ4?`4}F;aM;Unu{`%<26rbpI2dyOsXQ5%Ndb0wA2`6q5O3K~Sqai-t${@K z z87^oIdo%>G^-pM}{w7$cd>+Db*t+_)Qr;7fk7QoL#hcmMrxpM0873=10^J%&bSal@ z|KnEllSj(PJSUUZ+*kKn(O=PmeiVyr{VMxSrlK^W;zgHhP0GpWAux#E5z|)fc`~;>rH39cS zYar3OhOIvnFeH=oGsrUA9531aeJlEj9mvd<%1`bmD?dWElmC)(WPb*imownZWn7+( zlX3)C0RUkvGpXyid>vuLds2S_H$kQ)|LIMXaTH)iYuKYuCgn-{y#tJG6F^j1fAmXH zXYn{7qnh)+fdeh+FKIzPx~{_3zYdhM>yC6~p@|hX5f+YYYzK*5J_?pyiHXvPfBJ3o z?#|tu-K^2}&%cen_7So~wuzaY7@m6pi=I)*R(f#guONN-IH3#Z72kJEk>NN-IHHRt=r>USk z4tJt8v*%3o@}q*{;G3^PNY%5s!Z;3Gj)w0&!w_hg1=w8pPCLTvA>Y)FE6ndp-+)@I zL^9@}@9=U%zf!^0j`^A9UkkaM8*nR@`Nq2ge9JrmzVF^JkSa~2`PoZc#KL0uZuMeF zU8MFUevtS!RIb$ts-A9Y3fkE&L{yL(BHG2+;PY&{g+7>2VtNMydw+ccN#|>GU@t> z<~umkrVh(!bNDPhmGjD%DplvSm0YHEB`zE)7uF&omYGLl%IrrY(kO< z=J%ZKo<8MQLDpgm@p2)gGtwB*Woe>F2;cs_0=6UjchXu8gDG`~!o8uQg1sT4ZDUNj zE~d03`zk|4pRG8;X|%e-4zJ6SYF(;yjm;&=&Ues`??Oe;`yB>zDM=>OH-XlcY;m6` zw4t;dqCi$OMN6J>R3!5#ZOM3>KP5Y8jwBN5@|>&bU>hGPLbk8`8eIOKtKu*~8Y>Et zril)W4Je1**d@ zV1qBE>2Q)#aR>@E>6*>alz59TNv7JIl=xD*l5Krbgb6lxBpmqnrvzw&TCisxr73w1 zHof5LI`jv>`~fzt0-NA_(++<@yQL+hiMqv45?u$o0;Cf}Rqd$KDz1LfZ{X)#(7O-x z8^S&ZY&;D%*Mhxg!S2)0KB!%ErOBe}P%anj`vZ~_N7o^Tqv!A({JV$JlN8gGq~7bg zMA!C)qzgw|vfbvIq_}UYu%5$}yrA_Z)tXdkG5GH~@cssNKI3XT=u0PxR)U>I-;teq z4#;oA!8aGcMrndn zXgdfw>JIzCwr2yyrG*@INwL=jNjIA-l0x`?e4YwtVt1QclJC&xD&48lt?E=zHT1(` zjtTg(jpRGm)Zr48DeRjj6av2<)W-#Ewgdf!V54lALZ3;RwI=5q8UTPah? zJn;>Qi|uJiCdHLZwZ0*7=jck*x$2Tyj-JFBY;gfwDq-&iwmgG8@|{E)C8`8k5A-5i zYQYv{&keBkDzqQ6i4V5uf(-%C&nAE!%b?A#gDp;w_#D1NHLdTUf>Qch3jE32n|x z_}~Y=%>{`A^bIuTA|F-3x3ynFYJ~I=(k>21^0cO}u>Mp(;rsIb!b%vszQA0tXkd<@ z)4*JTcE42ur+zC1U&m<(E7UZF)lOQ%*L}2wa6iMn2F52Tf1O~k<{ZH?^^JlA^$bC^ zlMWo$6)qZ*BdE@VF$Tr}8*WESTe_?lZLZ~SV{YgVb6QRdza)VQ6Q^^YgJ@zp6~y|Qo{rul{Z?-SYJskxI$D-lY59jk z9cuc|5!6IcrD#ry1p8~;y@hZ-1($z2TIO4r`y*TC0{%)@T$-T1Nr3EItez>T*{dV0 z(L~rX!RtO^Va;r+v=fKpu-QV(|A~d6{}b#J%6zkbMc)OUn#j+f`;}jY;L4CCf@HsC zf`q}KyQ?1fSzq|d$y-?K?j@`Po&^1cg2noq1jYK9f?E9?;4uImflv$lnb=Wl1M2(tL}5 zJC!cU+swE5^Mbkz*=oMk|3gm=;d3)h;Zp&(xUyYFuPqeS%|^vDnF{h8!ql~6Mz0_2 z+}yIAOQG!^lYLF8?N0HipsG$9!p1O7;Y2RgO|$<`0>A!i1=<7G2;L0H z66mV`1b)#H`l_!LyzZ$j)Y4odsD+rV(Z~{Xfp&Q1q$_+4kHu*YhH`_U+z=?|pC$8m zPko`L{!apl{#t>SV2z;40Ps!*!dLACLJjb-w4=rb=wC&`dMfuN_Az|lKGzDzT_!fS#?!c$ry&>X^@I#*PmdWgw{Axi7=ay32UBsCyfoL-IQhe zD#=9h5_sa$PU-d~D3&Xrf5SS_FkB_W0QIc`Zdjub)^{lNq4_m7&=(qpjD$7e2v{2q zhc#jltQ7+bzfB)j2y4e&v_?hiv8KK}**bEh0M?F%Kdc=aV2y~@j}@>UKx@bMurJ88 zYHSkFr4^ZK#TA*Vka&<(AaNmaAkmPh;tFm?FC-t^)t&eyfZu(aj76(+AzDA z=3lCX7%zt7$7$V~lN{*FU{f`;i)5ljU;?d^y%=I_)4mU6iMVWWVC_FY!UW$8HSV1bQf%M=U5e zv@S$3iN-cGZmaXCq5OO*7p)Ibd@hCr>xf)x{!F0}*lYu99eDYqq&=)-IFLHP+N3M2 z7h+(2qXKy~$fGsn3Tdjy2G#`Qq~k;s>^DmzL>ba>5n7AwgZ0fenDfwDI1T2yr!eQa z!8(BhX%0u#K@4lG_AvLVU701!rznYyxJ<&aJ|S_2bqZyBQW8Mv!x~pjLURNXTbTRp zV9rPObcA^y=_WQI-N-Iv2eQWn)&R(kT$p>29Y{a21L^-2^5ejkj$nf=tO1@-st!Z3 z9lwD-!BDZ#2IhZT+Y=H;sQ(RE_xXb_oH$036SP3`6s@0N&PR6q1@nDNcA&YR*s=`f zeq;;MPi#@P<0;Jj$QCcK;VIbCAN;Wy*1Wody@cN46A~NilM*rbh62CXfM4_|Lx~gE z!vTM&fIrZ>Qw{s$1=!U9HW7cIwGgspC9F?!U|q5sY-!1kh2Rek_~I|HWr&g;yFriM zP;ao~nxq!|Fckb_YYTZ=2Ye!s)X{p98=(I*=;eVu=Ro&R@VP43B>VFst}};{=)w9d7yLwV z3?+^n9SIHXf#UKE@(0AG7x?@v*j29N4`K(3(_LT(Iv*sl`UKm6Y(nvI4(yoT z+8xF@N#~g+fn8?m1xmFj58+HWw}o@PM2hn81AM#+duIBrjQjCZCy;@zOEi1LW@q&(iMc{ieY zqbZYyIfGO9(Tw`^VWbMo8$6gdV2*$>1kDp+TH?28kLHSSbgmC`6!c}ocU)dk16QT! zJ(pYbfy*iS2=mJvb;`|HK<&%oh&>7+RdCxBJ>?3DDk0g^dvo0EwZ&e^T&W0VIY7|4G4j1&|mT{3iw96+mKW@ShZXR{)8j z!GBWlT>&J92LDOHcLk6b8vG{(-xWY&Xz-sDd{+R8p}~Jr@Ld5Uh6evh!FL6a7#jR1 z1>Y4wVrcN66ns|ziJ`%N72L93sn~CuKQzG{YUR+{{Ms<2Kdh1ZK`e_ueVguG2(c}n zU%yR1T=+?o`qUW40Uj>Ixk}+Tn6uLZK6d;Sk$!{m!s~s|s<=gSb{HdI$0S z5#qZM;@b zX(9>OG8*bf>MP<<`%KiR8>UUDo^7F?ZRGW=qBDlUE5d)X{@xU%K2yB>C0s{>_3#aN zJB6`Qh92L$KDRp*|d_4;Ore$0%sKrc+usz&>W2 zf;!~BD7O->qwR;}3v0z{E9%oASPxe3 zrVG)v)TThR9#)5SFCS7X>taC$^jY2FiZ)c~l-YD(Rjg^CG0oAR2J-~62gT=XE|tQE z^%gomhIY@frL)$H zsGDri^# z&X=kOch1&<^SH;bp5FrN_;^^S*MQH_nmwLbhi44)gSB#o(t4dr==3$gMz&r@YjjPn z`XwLm`yg18$HRIZt<&L}rC|lMAE_IvbKIL5<@xbdo{NmlvmxHHt%2u_uK3d+Sijc* zeMMb6`wdsOC?Buki!CzaOl+OY1=f;GGkTKmHqUJI|`HDL`8=U1h^+i4*m*26x` z8lEp-!)JkBDcC?st33-i>e&_Jz?X2H0NMGpuWD{(rfP0Ql+3?X9Y+_wbP6uy(;64y zn$|@ayNdWu)c&r}rqk-x+&{Mwm%{%qxFkK!6#=XC%-qH9Bjsu{yjJfmy9FLkL;KS9h3QA~HD z3M(`-dZBYs7?1RuOsR?arc}_US#;nB4rS1FoN1tP%)jTL=48i$E0HHby4d9Ee{OuN7RaV#F5-6m{YG6D-*e%7 z^q<6c1}na^TZnJCS7eC#-5V}De)ayV_$9tU=b|meG4j!e4^7?pvkf;?j4SK48TwHb z*Q}@_ETh*Gr8urU#mjvLvHToj8Qt$eW7B_%={PfLzcEd9Lq4Z@WxYsjA{`uvPoND6 zMgvXSrvloG1N^8BThy7YSOS{JT)!C2s(%k#;Z}b)cjX+PA9;m0Q1 zIm@j7Mt^JS_6pWV$iMlUVrTcfoRfWET2-)LQR?q!Yu%lyhs-?|)D*bAzC77n?|H}1 zkK(#m>=}`Da_@^1-_ZSKbZ@ysN4xfI42_J`-;JgHt2XK zd!Ykl4N=}epr@}1LUf@}TT?R=3rj0=grQ?-v$pQ*HMqZ@-yp9p{rh@%Y2P*4+P;0N zu!l8;Uh9lr9j(OC*SoJWhw_o2VO`(_-K6Y)IK)n|e%A=W)O2?Xa_)(J*H5qc;Qlb~9GHHpsX8;X3VId-ikB zyX@HV_S!gOVeM4$neC7FtNAR{RW%OaU(3!O9TglE8Pq$-!N+;W=+m3Gh(`_oX0z(r ziZP=XY`Ed~+&j8)`7aM0Pu+4aA9c!YZTCC#D)ovV$DJPZ;@Z}*vQ7fY;Le)k+;{fA z*ZopW>d^pS@r2(FKI&vs6HsXyK3q6+^~J8vSL%OTpplty;@DG1ao+0cUbFO5SF~~1 z)#ay=mfW2iHyupg*?;%aq0Z;c2W$;}rvLoQiMFO1!)hV^lpoQdsl)^K%Yu52y61Bj zE;mv%RY6bhIAwMpNt*@ekr#Sb+^|Liy>XX)KW?8qe9F5`v+Pu-w)tG~XW!dbty}|h zqbBDbgWG!61v`@><_kaNKhT3h){yKVO_;`f3VQyMjMqs4TF0`JTlWach%i!9BA^^_Itl;zn|JaE!U1; zRS^DF8c=jSf9B>zk!ylNELT-DMc>prP5Es7IO+aR+!y!M`#fB^Ff@~MMUvAsb=-${ zKhHk?bl8SF9nQO-?Kx+4vajG+lw)=JuZ#1Njw}_v|8&6V+rCj#*Q&<>Pd|L2?+K&I;)W^bGB#E4g71#=pL6Mg=C1f# zCS&FfcznC#Pp-b+_sutL>~XREbnS^@R*ir5{&_}t>9Hf(#%_a8rL5Yq^w6}uoPEVx zcHUXv#R5q-%iG6YP^7+u*$a(tx&E7xLNiC{>ILa__dC>K#6DkK~1pNA8%8CV<4(CFu-z=kh ziM)&_-(3;@Hs$1w^^;Ub=I4Ige__kwn>ioUe(kvQ_d$>PhW>f3_xokztW1)2J3XDR z9ay(9=H=F1n_gvfNhs*l{g*Qf26z1y8@#%Q`YOGtcf2pxc6c6P+NbB-1NZ+}Tb0eJ z(dcZkCwWPhPTPh4nuS{F`m=5S8ujE}uk!{fX+h4j_Sp}Q3pjTDw96%jV%>`qnp~y) zNXqWUmqV}n&q*CWFYk@yl;a8dMSGuhrF*A;x_bQaMB$Z0LG*^GpUZp?ZeJAkTbqU> z5=)MXvUNgJhN>^ZkFba!>kRf zk3M|1x#Fk#+tUtLiib?-ytnMx$d|j?CG_9^dWgmH1-oZh^?oo`^B0d>WA2U~nwY)* z%bv7Ob@Luya+^H9@P>+Ek4O5h8w1~dzjkVxT~)ZWD1UQgkYz=*9<_DSPcPITF3h}= zlltN3_y)mF<3kHau);Z-`4q^oW(on(&o?L2s3kC zV-wqczwgiG7kmx4K6BBUkX21LPy2kl&%M`YWhh6|b=geke!!vj-djGa4S%CCC{DD^e)@$Il?~@M(e3(=TeRa!?e_CYn@U)~(nIbk|E9^R`)&*s)&D;2N@ce738(;W#3jH~?en^)wKVMzD z=*r`O1*?_I1WJ>}CB|4YpBAtlpE^$YSc`dBXDB}xht?Ko-2h7tGgz8fH7oNs{IE>< zU+jGgcvZ!<|Ln7~4<|3ki}02xAQ3SnAwWRX!_(v>KnOulu}Me*i3CEEpg};=fQpI* z)GAf<(AM4yNG(-t5$!FuUTa(1i&uM#)_WT*Rurndw9sPtuQhwEz30q1n?&2*|98Ky z8#1%zH*40cS+nM`A7^iT^w2r%T?OoCv;!Vck_UVQlgaD^hH9n~S>!^*??hgL_Yntt zF`LN%NwGgl%c&$s_H0Ke5ni%cQ}_ZVlZTz^YMJB;OtI-D!3npv+OBFVBL>*&%EJ)z zw-LFWVt}Fr&!yc>AEig?v2F;L8B=@QFNl zM8u}~w`p)mBFuD#!6Ea}HJz zW}1HpBijKNfADyaVz}fSW}4p>ihN9ObNKSZOgryd0UI!l57*$~6QjdScRE->nCT-9 zmK$dJn1khqnLh1c1!1Q7nQyc`(<$^EJ=V+gPzNgrR}j6x!ScdPuXeEfFw^TDY;>6E z7aXi0%ybex|BSX`I!KryZsecE)jDi>VWxLDSbmu4!wxn&%yavecQ z6-;h**z&?mZ*#EGVWwYku!1nt{GwwJ$K+5r`^N)~%yglH<%gNBaIn!~rW+lsAiSRF z-4w$xX7Z53mK$c8hd8j=^}AtLLmOU0Z8&3_Cem+(T!l9B;xHu zywY^4*D(XX&Tb$v#(`y`#WEK!j372UCL=TOYKdZRM2RuEnJbspwm~*`xd%J56%acb z0)zv5wBeYCmtI%&+*l1{wjhbV$Po?f)zJoFzBgj=Ul+~Ke7wS=I*U*d5Fdk`*?93s zGivOL2Q$}cQU<*#HaGYfGx2@_ji@k#JxMa~G7rC#t6wbMIdUK~3%{nTZ!A{H$sFt9 zYCRq?h1N?}W(m-K!;5wC198lf6q|LvY!*lbR%YSdktP*bZ+IZiW@Q%MKy}e=%$7|` zBu5&7Vcu+z>A%EYpw`Sh3utR_0VSEGmRL2@gH&z~bMT&^ccgv~1ngGZ{o;oDE+L!d z)y)(eV!>`A54jMNywNqpVppV1>4JIHdC-w^{lO@~H+Ch3=fEPG1K|e1dLlPC5dG@c zm8I*FLabArA~&{1Nx6{)x{a)NMaFLAc9L@15nP!~19v3FhN$jJ$`e%jxFe;4f647i zsbbPqud*w_MWn+rS$}{<~l{HT8V6Ppo*?^*+8r>I7O~MMkG%hpk7x}Hc}COaiAe8&k-bO9_hw8 z0N0X51YBBSatEEg8=`g}kuSIq7vxwU2aHz{0hd;oWGVKg6=vkPYeD6)1eJ$b0LQu@ zygiHuk2FIx*?=4BMQSO_HAPLdDQevEHl<5xC5Cp2p>vtsK#(cc$AvlZpbMsiIq`~H zID>j&zSA4m*AfX&8py*GZAoEH;42*P05B!Yi8dF^2yD5&FFAe&h@Ie8m9f4Q}sl$5huJB$BNNZp`1IxuoBG6y`IktEu*Bnog~>5P!cU%QhAt2 z9!%YkvVn^1b)?KbL*zLJ>as;iG%gD%Hbhk;kv#rjYuQzcQmDv8M@nTok?S3(OI`Q` z?j@(lm-x~eUw8ubn9Qbu11D--skfB`zTyb33Q%d5){T>=fmEc-skp42$juJ)B_?@) z(2btVqSB?Vl#Nk>yS-N_AZx&0p2q>%-Lo#5Hqu0I~KQ>qC_BsZL#Um~?Ga$6OqH zNeMbqDwuRNu4RpRCV?|9o=mtAaDtE$j&4RRSIn`O0=$bc#9Ss_1!`CU-l!X*CR%}Y zt^!Xu(@PDLJE$j30eq|t$GTQr-*RGrn@l3iiFOw>!kpObg1#^(w!5Gi=ENQsj0La@sIH81 zmpfeWeqQ_7=t5lmK^J<1NVlooUZ`>%Dc3RSYE)ZBxyv1{+Gvex_fYOZmn&MMTFP`H z-S`73XNM!Dfd#wmYH*4Zp-b6IIP20ww274SM*l9CC>G44wabB9N+p1i$=wdrrJh_} zfm38QlVt>%V#C^S6(yFdAlJiuMEDx>CN#s0xx~S4y`>0-N6u*YRxPO6j)uzU0{DW^N?MdWTd{2FvcYtFEVl8z_dQ zHpRJ^yv+gIjBYzU&vM|)OmeRpqRWP`8*O*0hTR<}-lo;l5KE2_dB%kVo%Iw^3{4SX zPCV$`)>wQdK(guHWjB0`M+_?xCpH}rU0Q@o?V$=mAtTI*!vwlApPY zVG=`hISU>l<&IG-yZ<;P_Bn1+qpJzORrd`s!f|mnYk*=|JcAN^0Zf90bf=7OqDhbw zn<*2d3XsalII=(RLRFOD=Ldk-0A5b=Q;@*xa~_H04kT?k+3t8z4YkyX^eG}h+wLP2 z+dj-!a5j*Ey64%tEa)*^P&eFaYLrIz?O7An1;q(Oon{fCw@#M@vkwd6tvf(nNvS1` z_zsgF$2r_Z;`DOL_lZq~O!LXE&70!fh}xs@vMOa{Wh`Go^a6@aaa&TD6ICvl;+&Aw zyI@9`6O9B~;M$o*9k~0~o!f3N(8R!_ z&2~E;W)o=;b|&qp2xDzIWu7y3+hYl=!WO<1${-MgKNSC zB)~PueSmi5#Zzh4Dx;Xan9~&zcuJVln+Zqne1+%~(g3jxqK8r}J(d&ME|?PL1V8Hl zoEc$G@ch|LkL71LSbOkTRw~P>6Fim^tPprClOtWe)nQJsI^FbGo^cP-0*jI*LLY$(G6&bZa|l-bt_f9 zp5ktASf8K*{LntEk}1v;{4Y=@+_~<0!+M06*rkW}o7nFfcnwjSCG|=t+#2353nartDcLO4xi{(oHOfS0 zFUj9WsoKsQ-mf?v1;Ucy>*MnGD}buqWPeC1xdR4)nsfWiPrTlm2h|R=1gbv>nUJ{1 z)#@6l*Wh$eKhd(ApOp-H*%mK^!tf1WyVNCEB^Do2AjJ($fCvpS3~NJ+aebHCcEY^j zXggQWY`11?7TV;p1TupVBbdaJ;{8LAQbjnW3wZdQ%+%D{rT9}#Af$WX1x*rd33*{JM6;# zxXI=0DVNLs6Pft!@Ff0Fc-*wXXrv4yE|`S`c6r=nA?Y)~7&j$OnCKyLBuyomc`P%} zmgzY63pk@J{R24B#VG9*6X%)04Z$V8O`;FP(#%7c7zM--TZb5H@}cZLazrt8A*YA*kd=Hl-fFGsle zpJVsCm(Tt+HoKP-p8I_4!uPp+*7y0?yAs%&Z-=qShb9ZYOt;xQ(6GVv@EFEa5l zKPGWo)9q4@O^0P=DlIZ`lw{&w$Js349S?HNd(Fr}XQy#9utqlPtLFc}D1r3x)iS-w zv^NKv?C0o=%_febe�oQ9EM`r;o$HhFTt=^p=CRyoWiz)6U<@=>y0vjBO@%hwG~M zN&VdPBU)O|?<)O}iRQ2kWYZ&Lz5Jmy*l9Rx)#IkJRt><#QL=u=Ouo<}X+l%K*eW@U zYsPBOd2qGt83*#h(aR-Fb@p;8^W};uTpi#1|E1#qUea+Xmu9k68-}w39}7_TjJV{U zahu>KU&M4_Hy5V~$n5lmKleN#qH7xRkE)5=itUoym+^7XU)ZKtJD74GPFb_fO`Rsp zurOlc^gWKwaR8>h*n1qiw6+$Ro3?}Gaudd;tN@EgZlWS9zmRCJa$TwPKmcq(2Q*eT zx!ee*7;|myDs1iMn46CK93}tv3Pm=n+)QaV)Gj#?z0N>)fudm4_Bco1D7#0qc-aa$g=)_UQJ-6`z7+D0GTK!_MB30JuYEf!Kc@|FpnAE$~kZ{L=!`0<(%{&B@BX zEUTumdfDQvTk4uy8k&}6<>lw(=Hz8%H#Xj~^or%pO*hxov}P3)z}szW7LCizt;-)b zF1N5IFK_Ikv5RVeSXfX~T|K6HY;JX3e$8cK+JsTJHZ?C9RbSn_v}xJOrk2Xu>elK} z@9*Ayc;DTBc<8zJ_CN665AXlOH@-D0KQ|x#=jD!Cy0EUcwXtPXW5dGc>gJUTYMk%( zg0uxFZ9$~81<}$Lu(SmWS2Q%%R+7w0&|+-C6}J>ti#f&D&X`m=rD#(59I;|qOT*%2 zb+uVFAXrpZPAV^-bbaNV;v1$_R$N~;t+G-~pR*AE@-Y~VL4jzgZ&=jYA{v&}*0t5O z2vtIBbM>;8C%Vh%*$B)8Q;%j()d0dAfny{38P@>Z}_vj9sjZmk!~YATx+EfSHv z(bC#nSG}}SzTpzgy?jNhXj;*V5qL?oP*M)xTm0X--B^q^FI`LIALqj*Lyya@@U$&jK?z{LwQ;7w;cZPz-!2&B56>r&A%=1c*0|N zmWq52!XF;;cdSJ{vm^_gDr5n+2Q%QnOMzm3(x9MIU((|}A4`#ER&PiSA&y}TJY^0K z>Xh<$+G82=jQJe#y&97bbeEj=%eb>qUpVCRpIx*Q`96dD+i_w7lrjwCFFlhnLJq|@Rl2Oa5TN`ev8#Ov7KW9wN*ikJjTbi4iT1TyDX&%+Etfp~AZQZEq z>gJkySPL2(maS;J0!uEC!}f2`jzlk@fhL@pFsB9^UftN(x^j74OHMuBeRXEF6|D`8 z0Ko-(o(b#}JU}2X`=B|^Cw+!xC1hBJZ)CbJ4y>tWeh)I^6VfefhGnda%KbN4)a>cY zHa=-DUgsN{;WziJ2~4yG_|5 ztDiq)^$D5Z0^IVOzxVC8`aJ)<)w{UFN-qK=WTpDeU79^7V1tln?vTC2;ONWn0o=~Wj2L?Od%?B25OZ!!^$iH3aUe;O4dT9(`H(u?KJAK z5)_2kAM#&|3iY0WdiYC9N@Nwbz;yF`Zud6$d zz`lPFjfpmZs%Mmd4YAEd(}A2hy$jQ&nyuJ*Ng&tkl#TobH4;3~H`;5%rx zStZj;W=x+2J+d-ncLSJ;jb-bfP+DSJ1ibY=)0b=bPj+;er&fm`6@oZ$7ztl?TBsv* zvcp$^G5EUw6Tf+UH8gVzw6DYb82EvLI4}_jUob5cXjS1>fcIlQ5~09EDaP`D>i11e z>*xrXM^~RTzvg6s{B{10kZ)vKC=@c^Uk!ShU*}v%pTxoSnAu_V_xpyXSysqO_OFAE z8s=YT4e@utGd%CC?ywB-Z__svqPL+PQDgl{6Q>EYV{PCtc*#8mj9By2+fPaw#y>Q& z!%Fvq%bM{(n74+k{&!l*)2-B*R&uFj&4TWPA|Wf$|16~Z=Kj@z-R8^Ye!$mT!`rQ1 z5XvzRInZ%_^HubPy`Tze|1xNw8o1i(6}ZZ>)>_GdsUQg30d5OU0X1L}7~i`cO8tBd zjM)D&1Fe2@7uYbWEx&`dBqf+VVfMJzN}5$#Gxuq83pV9{Q&KmE zEzP`LYgJO>%mAgcoXHccJ^^xg)Y`Kr8avtioe?SlM}(mdiIk4gBKgm6e!41TrTEQF zao{*7pnH=g37qBN?zeP+iDB_eI1a8*Qe5&}DgG5fSiJ7EFQBcK-;Oh^lms&Yd^X;{ z-#oYqL_QM-ex4q(a%NcLrN@?9GiF-x<}F~xG8mv> zJ($FwjRV7#mONL2?ZibO!#}gsD#W#onmQq56>?MmPted*Xl5HUv)qn_-~0u%7ADAF zL!bK1Cs)OoTHXa0h)*yR1Ff)9Y*__!{>eC46<{lnf0r~&ZxCBpWDN!zfmaOh!vymu z+!4Uy2eV@;E--(&?IhatbR2wM(r<2rI$`>`4|0teFx@r;TCJQC+#QU(*6M>|V0j#X zy26~B3F%bmBfoj~s*_Rk-eZsUxA$7;O9VxV6hYCF9Cqe7o@`QL~7)Y^4=bD9r@-e zU#Vf9ih~vIzE%6p6LGkP^t!`u{ts9j8vpGcuv|f-0#{o7ORV@}zxh@hOzOLOfQHGi z5Ljjh*u`ClU>$))$zF)iBxtF`{jd;$=E<-$^@p9Gb+?r~%}SkR^~X6eaXqd|&=^>W zT0!2+a?5c#Vl9Gos0=2A_sqcVQ|tWZFWdIpixJd(x?5`z6h0HT|9PzDHM?QohlWAw z=O8NH{C*ETU`@lB1+{5ChSQ*s)D=oKJ-)});s+q7KX3TW+jaAqqf1e(Z z+koA+NrohlP+rhXN z03k_%Vs`|b9=ixT3pM!jtsPbt3}?uShn?`LAATQBA^<-HqaBKD3Y?tbH$S=+_d4IV z_W!M;7bJd!`|;o13bVrBLEc4v^RTbO>?M8vty}k_%1;FX6VW`g9rJ+qL5qF~Ed`hQ zzAtc?ws89c&_li9luB+(?{Dj{XEZ!*^*);MX*+S^yw1@_KKmvgIf%$Q0Z*pElNk{h zCf<^`^RR}KzeD1D6~}?$-IPeflkM73C2{A`2`9H$;scyC6GJ6FkdscFE^+xpj)Nib zrhGn6KCBplcS?TcF)GSUm3EMiEk^JkmHb%|7$)A3_{CB9Hzj^a6n?wJheY8wNPK7% zK1SlhqVS6(erXh*Eb-w{`0LUR@?oEdyhPbv`FKeL{+^U`c?5=uUrGFmD14j5M@8ZG zJK^|ho||p|*eu@#h#Dp36hz^Jq@J=75qW=-{4$8ZpOO&$mPN_AN8<2kk#;PSxbpZ1 z<{c#BXXVx+z^Vt;l(;Qo(DOG$da@S2!B}O zioX%wB5}pv2>+>+?~ZHkiQSNIxQ{T&j}>D*3*pazr`dy;fFs3@L=MD;aQ(1~aQsQD zA>47w^8X_FUH{xn{3y?`pPZ8j^G}s>+;NK6Wbs%p^>oKO^FIf9hH(9y<^NLhyYoyH z3W1{({tPih(ij{dYN)JtD5ZqRB5IJ7@ zQCTMcI9|&!`DFl6c(mUli|Ic67*WC$(SB?5NBgafNBgafyMCosV8&Q4Y<|~nk^Ir? zh0X8wV=@{|1F$ z#n=07Ce&vlkSSDVBjJ~8_*RXdtJtCOGrmXRpT;1>{B1O}kBZmQmWcJqr84z|vp$UT z&%BvGi}?9By)w&xJNA!v{TZele;p z{{;ABw>eA~y?18s?;8}$0`V1vp*N4Xq_KW(i;zHs_ock1^i3%=%#zkrF z3+yjdP6g#7uF6sSU6r#(k$)}FytCo?8TCP&cT_JZ@>Tu=8qWML5zcZbDR^B)Jy8xH zZxDg~ax;S%LmCgn)%7B%;EQb*8J_mQTNQs$$M1FpU#Q4=m2lP{pHs%;AmOY(<8LT( z8f{h?o>TB83eH;ul#hKKq&)oPEgmRe#rZ{A$X{%;$gnT*BOX%lY(u+hUDs>;jN`rw58WT^U+&oR8~Z%+ZByi^_#Q=$>OaR7 zT=gH`(qX--pQOZLEw(-?Kfi)U=WmtQC2ammyQmDe5zhUULV4Q>$9~6tVVr+eqx0|e z;6LV3Z-%lTK>1lzZ(qW>UdH*uU|cWbBR%+Q2}e7q?N#?V=qEg0HYjpbocBK{M;%Ao z75VBodV+A&lVxMm_9^mJ{E)(r_42&;wuZCc9#-V2{6{pL`HyLGcpm3pUGTiY_!;8I z_TG$&(-GIhCa_&43__elILcA+427Tf09dTA!mr}|ZX&FAu_C`vkuyWVCn|DOyj02WIM%C<$L$KfP?2*;!Bzgg0ho6CHbsu=w;L5)_1o>5d_H%2LX*$<4n>YCf1iTaEBe1cxV}GmiEw>?!k3WH zo(mK?#E!Qk#Z?MkO|*{x&;!Tw0X%em-dF2*CCy_xzS9H$54seq^Jn*rUGFjve6I(d z+$*-6IUe|K58R@OUDvb31K;9-|HcC!lp0&l8U?@FW|83w9=Mg}%2D}edf;F2z<=t2 zZ>LKkXa`mP@C>)!YZN`#dEmeE!0UU*mh*-O{wQ5iM19nH-|@gF(1fq^Kj4AC>46WX zOOv{sIuHCw5B!7&9vT?i4x2sj4?OTugIqa5o0Q?>9(c+{vH4ef;6L`jrwooQ=S>g% zC$xb?drngHoHoRjqvAjCz=zX`oGz!`1Ao&4UotFqy`OpDQ!b6ozgod3EA2Y!f!{RT zm80^1%LD(w10R(gTh0m({CN-jBM*G|WwGUdS;40$?froVK4XL{N9AAVfuHigOD~Tt z=Y$8IN|(IRPt*vlafAHU3e=|AB_%3;gi-#ExXUrV))1?#uDudatJR zB^n;0bPmO+|8%>k42w1Xxs<+6;V)PCZ`JshP+Hx$7b*PT*7%w4X+{1Vg&*(Bs*7(0i>2nHyh0Q9%K0Z6a@_$Nvcz+)cv`?{3%5a*--%0%C3V%r9 zU#jt+A^zJG{t|_MoyO1iu{JCG>UsLtHU1n*|BJ#uLy><#smpQ_=_gb&nkzE3uUaFjp67AeE475qvCU!dVU z4=&T>vwhn&d?)F1mxe!2IA3pM|KaPxe7%wJUlIQfO%7i#-mBsNN&E*i{MUrPO*q=& zDy6+2YWy!z`cnnxITnlkS;29>{fOlIY5qq2kss%DJQ5Tf`KM6%Oa({&XOS6>{tAx# z*Al<|9F*%1_VZHEryBokN{2Lj9;L5SaIAL-=!=K_T%0Q(@Au zp4G&Ei-IHnJPQIiZc}jNzk&GgRB+_~2Jzpc;F6!xk0?0X809~$;3(&($%xv|cVW!^ zl10}eex~rFoXyAt$2$s+auyN)hZ??{@G}aIaysD;j}&SL*K75%@qQX!LO8t9S02cZ za&pPe*C;sZ^91o1X*m8K6_4u_9OW!0Im;9rR@ZPB?9oBaR$9_CS;{~35mIt;MaUMqpHT(?m|HcFF)bNwU&)4l){wIW6wBci% z=hL1V&iV`>9OsRzZIxx1qwu30Zlv~()9}572Q~aN!e?vvO4?xFpy59vyk5h%rrS#0 zMmX!qJ0%LHz_#sFC;x16dd_qCH|!fj{J4Rzed5aA5+Mmzoy_Q=Yf6@!11_-ze)IR z1xGn$B((cM=3)5Qp5Yub+O+nILhJszNZu%<>Zqbe%(FxJL2~eo)CZp9EhWw zPSWQR1xNmysNTyp{9A;NS8$Y*Mg2Hi!BNf!#D9Z^Pp0d1^$L!1sz^?|f}@-b#DBMj zzeD(ggyVP&0zV($RQR!f|3dPgQgD<%oUQ{tt>DPd^U}X5IPyP4{6AK3;oL8^G#}2^@U4U|Q}9Ws7#*uM`MjUopx~&_ z^Ox8KHYzyk!~M8b!IA%}AvXUu1xJ4F#~lie{NE-1-3pHU+>iSd9Qg+ig#eBh6dd`R z$eyn#IP$j<|Emg){M_${6dd_qBmTD)9QnE5k0?0u*9?OIj$;ar{M_$n6dd_KA^vj; zj{FD6ZvzRCfP?3mD=)Rv{QMjH)sKmPAn~I=VE=Bg*~LT+KSKER3O<=Ij2g9iTdCd^ z8vc92Z`bg-!);-AY51drZ`Sa42>-f<56`ycd{e`h68@xyKSTIl4gUk-Kh*HSm)Y`v zPB_{P?Xcd4#rq0B_RDax^Jxud{}+jNLGBkmKT6VYJ`d`v;j>8oPz|3$c&>)?dOcCY z`Fx~E!@opwDm0wulPV3rnfRMEyoT_V8s0?sof^*exnIM1TtBYiTS(3>4c|)m_ci=q z2>-E$^EmyLhVyuQOT&5G{XxTde4W&Awp%=1SU~@oLcW7hAHvxm3TR#$qTo0WG>{(- zS8(*V4&ooD;p|t}YB-;-&eL!{UtO%>_V3Ezyh+1(KDRKSg-HhQF9+%b!X(x0jzIoUP%nP=9?{k%R5ZCI7ii!LeQc zO7-5Y$>HbqpV0UR(tWQNHGDJq^UpQ>zX*R_!)KG6w>A7>!r#;IgM^ z`vNa&cpLfoe{1*?g!6--TrYo4a$t(BFXM6K4}}_@L3o9R^H&y^Yj_)7pZd0jA1C}R z4d?4Sz3BQ7>%-3x=4<#9biO@T!})7*Z5qzcvDvM4pC5aP>>QvBtQW77zd|^v={#@7 z_gVON3e2BHcFxk|@ckj$RyuO_5Pz=5zmIT!o}c9(AUvq?^L>OO4L?NuWg32raK7iu z@{bc^soa^1E;TuVx z0~*fj;42#bAn|uDp@t0}%LBi*2_}hdp*YMMXw`q7S%^U3+UQak* zf8};H624jEUrzW|4PQ_A9u4Pu_h~rSdqBfk4$mK~PYPWZ?o{~kx_TD*!4VA~O89XN zr)5W+(eMStpF-mX>&5HOJZ^d3V!V;~dER22$20%_k@2^QKUb6ANqC`#vwxRqIM+L0 z!@1rn4X>wm)@!))foTnA|7g>2wqv`7^Y484zA?8qKz!RZezwC74QD&-(QvlIJ`Lw~ z9nf%Y*DD&%?dsHUZr2eF=XM>}aBkNb4QG4te9v}RO?*7RGQOGcESeV?XF1s#&T?`! zoaGd1IO`GAaGw8*G`ugRt2CVD)N44)S+3zMr%l6o-sX87+dBn(zm)uctHO_XE#ccW zoc(-tKZ&z?!FZkG@;V+Os>``#_{^LFk=k^>>@E{9^ z_!SN3`Q@O3Pg3{~Y4|b9>s0W`3jYxef0go%EBF+J|BQz7dk^Tgldz!uYJYM6Ag=by zRFa9fYX4RRSMAK>68Tko?p64ML}PS_Xyl)y-~!TkAgGl9<)grevPhUBR)yN^XWP#;%dA2x+~&pyTsDE zr8Ub}ik#*q{9Z&3zZ%>Ai~@gyz#|vFY=AG~kDVL)6Abt@1b8QXPHo-76^kpY7cOkB zgOvOVKu&XAW3?o6qTZnIzU@ACWvD28=OCx1Y3b5B_{M>U82Ld0Zwc`E1bDxHi_;+f zN-n_#}X;dc(3sO-^$)Jv_c!fnx3NS;Vduy8=HYP+8g1T3xfGvZj7X<)Z3_Mv=3u zskJWW+L?2&kQrimGkj5Ek@IB(=RNKG^$Ar^czJvsDPC7!xu_YwRB}Nh%MVDX8Z2H> z-CP^d^v0%|3yM%a=y0L#R6a^^AvWsug*EQW=Pz8nT>!rskpmvpT8;6_r81_Wil0j1 zE>J(RGPE`)f4qP&55l&b@fU0*>1BUp0!tRkk`T7#NHTw%1R!k7k>u#H2;`4->aJ;N z&6600Z8?%0Jw`IgFb~4EoG}i+{HP0v7+oNFWS9qGTTX$>Ga7S8%P?Ptc@Vbcj8=K_ zodhT`I$xHMVZIFWY+Ay3vN9RwLD-g)=adEe=0Osx%avR*%!9Bkhu1A-iv2?5w_qOy z|D%rOZ`#l$v_E17n5H9+J0OJ^EfY>&(4is;TAm&7H$YveyxvZ|Jf0WDD!-g+NO5Yi z3B5c%cdKK_x%^?9zpovMu@EC4Eql(FbFTyt>!-)Vh+BwuqRJe^CRiViO)!2e{SQ(( z-runpUDv;Q=)ZyV-wyeBp#FF%RM&rmNBw*snfHq*0}s9aVNhPjkT3fY429TXN3wo= zBtfsg!=wH;lI()K|0FR{b*=HJ{~*U?_Txa3mLKMZ>Rc?P=(n3bokTj$FGWG{WMH~ zvXA2z*)iLXapYAG{C$6{@>zpzuI(x_(0ch{9_0^E`Rp#rpM%DuOu9|xa37)awGLtv zTtCPE?ooefmd#&fM^4D)71ARx}VJXdj0r34VWxp&)v{EY^S1m zPeI{W`k#5qE^&q~{Gk5$h>foQRUY-f@nyR_|4zkDMb}^GQUCE@*d-3)rUMSF{|fli z>o1}D^?B~_Em%s3N43TQyF57l6{L{X%dcH!^Id00PRQjrUgF_Dzozm|K_a*u{?})#ez^0~dB)DuvwS;0GsTwErf=6Lrr33fXfN+HjS=sd=7>}92cjOV@`=5H ztl)F-d%#_TCy6h=V~C1Qv-d8{!}uLDQ_?|0jIq-hyWTa^N1UED8S0p{a|p=%Y}HS8 z0Dnfi(VoUQVyH`%A@+W@>fd&rN)%^Nms3!WEjxYJsl?z}BN5C0Se8fr^FI-A?S3?S@Q&@ zu?;)c4L-A>hp2$xK)m)T)H}GJI1zyKGgk)Bu1ydp;N4;sYbT2n@GMKkJAK4+qy1vs zj&Z@W4Yyo0=XXM!xa=J>74EZ~Jz}(%_cJm}j`Rrkzbti7+WyhOv)TOuBQ6^((oTb( zmsw)=8E8+o5g5_#3qB3~0&UCO^(V6j^p}6vIcWD^0Q<0)IQv1Oc<#tg#CUAy5p(da zcw_u8J~aF8y4M%DH(-g^ZoW#4zs3k04SiPhdiDA96*mj97u%8m{nFX%z*U{Sf@j|W zoBkgDo>(Vd^ZCFR65H_-@`Ig*D1c>R^Nw|uXD$O9;2+AGlqD)o&nf}Cg}{ErV8dDE13el|hu{m}$*;^)v-&~MAmgabG1&A;anVXS>Rdriumcg%s%ri@+Z z*P1(z)QFW*|D(b2A3PZx|KZ2M@khTK9DnRoaQq*i36B5hPr>mY{~$R2_+NtK!6u;( zo)3<{*+>W-Js%vu+eixi@khX8^bCExE;#-&BPDeFuHg92Aydx1Gi35PY~PbcV(5<- z&kg-?ofx0&>mAA(n3bcq`Hy#r@kgE%<3Iea7=P>;G5(_;2$11B_rddG{LvrT_TB!c z^J9*H&U<|szkuK2?){n>xHk;_9RQnc%ir)wz!><8@HOJZyX!VQf^8PYz2T-er2?8S0{tHhR1Kqq)k z?kvo68T)#Qy@RLNZ5cRv!y|9{#29Rs+NSNGM`U~YM6^e>DYi%Y64;CVY5O0~kNF1F z{d=g_X)ENTo(GPd9}^w|wzEV9`tb)~w-0ZwFMJaIU_7K^e}|T27iJF%-XAstN3+3~ zujwJa{Gv}(bggIq&!uP8k@I6d=n*`7gE{ctKS7)Ongf4<_8VaY;gew^b;Kuw3-9^# z+OdO;0Y_nsZJ7eP>^XnF&pkcFYe&oxBT)CjgG4j7qx01wT66!0V6USvpB*#%@A{+J zXV>;Sg6Af|-;#^P3H0UmJH$C0+c-8qFaskdeR{s)Ind`77<&PjXLf?kvyJRuzzr|( z!NDWgH@y0ys`LDq&K}^Orad>nyuJ(jll!p~Wc>NB=lfv4Ma;|KYd?c|eHYB%-IpXTUsd?)+qkID2}QwevHu0ng3P4i26@4Rie|m=AGoem}-qfO9p> zD_bsxe#3d@$Zy0>SYytj&Yj@f&%*k)V?gliF26YOqA4n%&vqS!b{&H<$qfyKUxh#H z>tgV?YmDAUe`zF#mKez+hJc-63s}$zHhG7A7j(xqpj~3kmoLWQd^ru;5jQCaxCVZp)!5WfiV$MNDsibx6NiB!-vWyD4!b;LV=MZf5M^j;%z#Kqu)uYq5n z{Ffn?{nv$^(Y|QQuf>VIZ1Y(5zL2fa&Od_n@mYYdg%rXFAuJ-|1Wz_nppB?N^rRd;t5JfEj%H$Z+3II8Vsf z)lU8vW!N)wvG#zBtwav)A2zyFR7;t38j1E&Wjr$VHh06gmTF*#2*ZTO^x5@%6hG z?eo5rgL7xUT{U2n!!Q@asq~gVm;-iw^19ghCz@N}V)Pi6Y4jd=Z-*>THcSv>Sgw=_ zcER}x^^PU?{CR8V`Elax8IX_rMr;q9Xp9NNoOREg;YTWAynhqc5L{<)j=**260jxa zZ-D%G*#8|dFOzc&uSZ$n^Vh%}^8w5Oa1FfT<8hOB7M)#tKhH6^etZXP_z|o(Jim0p z{PGUWFTe7bUn*hU!TF^cbV-2vQT8rax09CGYqwmpVU4>7*6<}p!U$Zuv0vaFKx6Pc z0^9xxoll@&KJ)SU2;W-?W9A*;!S=s?G&1i79AD5svacb=^9H0_z=wjc{z)9{GMmO- zaMI){Q>RV8wx}4sM>=EXtgNglQ)W!ag1f3KmS^E@s|)!>(B{b=_uU5?*BZS4Hy2mNn*bl``_e);hGiPg94 zdh?0N_k6o(%Kd+NanIMml=k74uqke@AHXKM{GK=yIQNtwH87EE|WnoU` zI*i@!vWadHCW{ENWmCe5y!1|S1kGmB?V@tljOzdoaU>Gawcv6VJk+UcPPE`TpI`7C z7M$e>u80=Q4&%u0T4Vk#j~M6(o*ONAt|O6%t_9C!joG&iab2`v{Sv0=TJUu&n4QlM z^9x8VxAW$8S7R<}h z41(q`=~lOdtAq13c^F~|lWaDuZcewWD|M=?VA8E_5m(2u4bkms@fAn#Tqa$?jV!p# zX-DG%BKJ^??U>u`cD&?NcO8>%b#>9z)p5-)DAirp?dlFV)y-qlt!^<_=Q_n={!x+Y z6kQJ{9z*n$I{;Z?SpNH|rM2Nc{&B%Bd2#6J={MuQQ!hLRC;DF(=9cSGGO z8!5|eN&`3LjH6_OTi&L0DQ^=4_X5ljOtP(DN@Uw?b8J*sM0K!_8t@wmYN9(L>pySx zK9L(vqDrzU_K9o4Omky>A{ge@vQmgK4U@J!P#)6*9V{=*be4mS4>Qfb0riP1!%Sy8 zd=tY=k94rB!c6Bn*wtaC3mj}hnCU_XyC%%^1_ujPm;`VRc^>4=cAX?yKrbPCNBQkn9eV z!2%**aG=Jnq(sj$jrvLmC#KP}%;K&DM;E!dt0LLt8SKG^=u&+aIh6>Q!@8Wy2uU8%CT1wR{IMn*5w9@YhOSF z3_~V)4z$NBGjgn}%lJ@7&}=5(aG=`5M6zt$FlmRE;Hi$3awb_*I2F@`c%GLB9Vv5| zWNFyWIblw@vb#MxCOWb!m}F@vyCR0{ZVwPXXE4NECRN#UW619I7%6b{zK%&%_H{92 zcR5B#qLjGj$otqVEz z5TRFBMfhrpO}M=i=EODv4RIsa#-b%3Wjj$GMqhy!a~XFxLU2ok^|(xQQ&t>ejCS>UUv5X=eD zb#;4bp6W_r(iL10E%*z}KNUf$!xcO?TJRT`eCAG!5`0~>;4d)qTvr$+cwV&NFEH&m zS29@|T$g9kb(DG0j?(39!OrN~xXTrhi?9OVv|Mpx_dT?pOtpt%I1h}LGM_S?NcZz- zUFxEx)H%h8@RCwR`Sz5_snvwS48gMbY!V>KbRu1LJLPPr7^Xs^oT%#}UG9Zg7Vp17 zF(wZ>71tailF$9Yi?|@ix-LAp7Z5|7*mPWUdDhLPxN~iTa`k*pZljzUNWLQ%hC`G% z?l@E#pPm)cIhW)sr9`U=a$7jo+r(2wyVEAT=fq z%XF_Bc=*)1O=6N&?#BL7?>1arxzpJ0-8k{xO*jP>k8;%cjxi9zvMP7-jrOUPa3l!-~m#p|= zZ8y%bzCaPa-0arUWm~>L5xy|Z7n$vunNv?V7w5{}CbH9o9RKj}dX^oaDH>*+Tq1cY z@5Uq)Eu}76N|y_Lw3H>$Qo0<+(Nb=XmeS=+6)mM9T1uCbmoCMgymUd`o6>Yy|LiH- zrK9cg|GTGnWb&AT{yikZF?t=)uEys-QkE$;p@R5_SF3 zNHvD_Ot;LQDSZa?Of}~AfhRx;gxRw=eL~`umai|osKYRd)8YBSi$!tzxI}nK)TKbc zyEldc*VT!Mfb>8zG4X031DTL%_Jp#Kh>wGkiHUY1Asd(m!rK56C6NqY^TbyJBY;FCh9Lky1cJ>fIfNk(Ztdt76(c@JcCP-z}3tzjPb^+T?zi zlaXV{>aF4Ziqj|dyQZHIy)CJ5W-l4_Ne2e06x_Y)o9r~T5ESm`Xb*Y)(;;snlpo-V zv;_|AZ43u|P;Y1+5*L96!d7fB@g@%MXY*z$?X&HIiU|Rag8TZ|04CuJtiHZ(atOBB zO%6?z9WyLZ+DeE^ooovW4|f$TPQRvK7PJIzJIdlR|1zh^kTb$*aw0bQ@Syo-LF75KqtT|a*%CqA7&cmHq)*T?&Q1b=DE47Pd*7tL}8u7Vff zQM+ZWV;rl<6E(IhGPbyM`g?ESK zGpYdtUsWOkJ!GL3KpM}-EYw#>j)#%sCo0Fc0Fh!%VeLRs&p?2O&wimMdrIQWWeKto zGBjl9lc6cYI2l?p^vke^4DD~e#7jCshKVw?zxk3Z>7Fv|CBqaMrpge100;wHh8Z&K zEyGM1_K{&<8TON5e;E#tq5bWcL6W{mhJ$68CButlc!>;$$Z)6(hsp3#84j0WwhS+m z;RqRCF2j*Byh4UKG8`qtTp8xcFkgnFWmq7?F)|!0!*MdSf1^8I(i3EOr3~$F+*~E; zt7UkN41+S9B*V!voFc=iGMpyE=`y@lhW0yriX|PAVTlY&WjI5IGi5l-_WvGn)Zagr zsF2~`p}$4^&!ro^4U>xyYh@_kiUYR_!ibYa@Z}j@U0;`LC!1^GJCj8E0 zPopeZE;yXE5wn)|0}Np?jEP((u4DpVqo0C2vzb@`MCxDS5VMaoquj_#GiIA`XDQ7n zgJ`x${WYv2d;sXX0}B0CHkk{}_T4EcC;enZ&Kwk1?pp`hvwiECNx;kp^VgF`9}wO9 zHLz=MG;Z(t5Qt2Ct*8YHi-1KOevEEr7}$LA03c>R!+v|h^;{)?YM(^KaM&=O+Wi#fRSKG~K1sUcfYKBy4DrtTX<`f%A zQl+n9Viq-H4<^c}8UKNa3ep_sXLFvBE6d278;wGlkU3v6iev)6AZAt@Wg>GWl(ue% zpdVTo4|BW`_%0eA>CVhYAa7vrCn4;OB4i*k(I+#X1#pn;C^!4(fQd|58S>C_WcTmu zhGa%d^v0g1ZokLp!uSbByYHn6nYe^FUY`pIW9eG(S@2W%TsROHsm_?bKrVHd2YV@S zu$1}eh3gPTANDXRvjdK%l&Er%e9hw%vN=q9(J*SN{Yu&A4SG%`0FDeCdaq*nGDsIn{So2cVZRKdl5 zi?xYi7~pZxfIX>Af}*L0%uRjEp3WtX^J5Tt&9|iry3n^N3%w4*vbars;j@hYYs_VG zGL5N>u0$->T+|!-N7FYJD>bn@tSptr`JeT1j^ogtS>(c*iRs~JSK}HvQ@{jlC(x^z z#!j&5pn*Ngw2Mzt@JX`MY@W#qKH0$TxA7?vG|CZ~o1w&AAMt`PQrv81DfX z_t*V!GRMPgF`U_CKBSGMEijeH*`%F`jZAE10>7>d|3MxTFEH^66K?>4vq`5N_dN#j zOAC5tGLD)OK*fGNY;8LTA65PVj~k< znRtSUJxsg+1gM<*iX9ie0r5!RroNpJ%iYE?CeAPs2j3CW=E!pC&$Ds2fV&QuF1wx} zQ}yZJ-e0VPmfK!cr+QVL;d)h_;w6g|FIlAEixqsag4Zi}z2Zp?3f>_3ufQHL8V#JK zYQvE7WXPrH!4y$D)@a0exHJWRl&ci)VxW-H%WeBTYfQFc(Jtn zXxmWmDt@&6QcM}INj(cVhtgwAxbZCWUpH{_g!Cah{iZPrwtr)Mo9v!>%eWGf?y~x} z6z8UYE49htZ`d3EW7wpe;&Sl3M%L14#7i>b{AO$y=Qi+qWiEfx=q1T^2qn?o33_ZN zm%zz5hbQCcNw~ZF$FY%WoynV$>gqAoV{@zP@@p;=(w!NL^{jkT5heF{)uY{3<`6jlrP4u<{7 z3{*v|Sk}_8cv)R-mi+2MW#y#u@=4cM&MCfOT4lxcWz#Av#nP6=3O}acn+Xci*aY@+ z#K4CVL`%bMb(O86;TDAp5|PEKYn9yU+FC8UwOX&IxvoVi5mDic$<^77Fypk^-ks zhR9Qkp7X~wkD(&9;8UF7D+?k6W7 z<;Un^CtsQ&y2spnkRPLOoP24J3zbKYh}j8_h&-&~!Ys0u3$u9iXJjqWJ?G@hDlU-k z(Y;Q2Y{i8-66MFpp9;e;M*koj!|alK>NKws(;&;c)aVNo8y&0ME;3wUQs;jwxe4TQ$^$dh6{ z@=#`svE*p$m4`CD@}!>8j^N0Q;UunMW0a%ib=Gvx<<%n#mGsC$9p_ifi8TbURE(@C zMU&uvey(1G@yfDUrPt?;&K;vO@Q5p!7c&PsE_M#;5jzK!FPT^7EiPu3EzixGF$?Cn zh&_%()Zrol)z@u6=?Dp^HnuqwZ;p8k({_m~ zW}|4zprd2MJS)a1!LxphES&UX!o`zf!0fqV1=y+(cG|qjx4)rQiJwY?FOM}Xt-PhW zaRq$ut##${I-LnIEZS5Xm4z5&;fcb+hF1JS+A{o#nLI;)eLQaO#iGXQ#VukXe41>D z4J@o~i4ugEhk8*;%kQ8m4G>Ms>zb=u;Uvt_+(AGlo-r(kpkdi!vAC|)p;s(}v$UEz zeC?h**Mbuq7r>^#C;h0Fn$|W)G(%0x@B@F*I?K2G>D=}Q)f_bHvv69stXK|bT#Aiq zmg0Bknk(y;*`GG6UIwQ`)r&=hUcgjiDdrlkHCnsq(Qk4_#TY=n*X7|;|Y%?0ff9|m4!rj+s*(m(vFwKvwkCbO=OZbPrfti3Jo7QE z1ON8HA0G2DP-G2+!oCy)ZLV%?#Ob>w zryd_Iv_~V*U`S^UTG86jXhT>^=D{<+@{vO{x_OmhSqT}I5xB}12i8=xUKWOxo)B1N z#RsmoGG|!AZ+>TO$ci^#7a_~?-(jV$x8nW#tyKREzxnO8fy0*JH{TT@Uy3H^eGn9% zkZxIlt4m_m^b?<9B`5f@`+?ZNL|>9teyd?vnF(f^FB>ZO_3bC&(W(xJLlk#F93mX! zkTuM2{<{&f`V?EkN~{!f`F^X9*$dzjE5YAkCHqUPUJxgAKvW7{O04p5brlTjnItSOJ>aU`x?_u1`dbJuVaND7@*vAt52Dg z{6pW!bicU;B!6s#I^bW($^>0Ok$Ce~V13xG|0}+bmGl+V5?Wzh;$LU=mP(p`U9%tB zX|D6_w=6R$Wc3d`WhK8b1Eq%cOL5qYKx@eS!u36D{DgLd0zDqO*Ku&B>@HY%;M4zU=;f^T=vxsXzIk^HDeRZfF%) z1vEnyNwt&RRqZiSZK17N@ItD=^WCUihBkg)1Ldp)^P|?k?LKU=(Z!FyvGQgfN={AKDtV} z`+5^z<&W;tfek(?0u$E(^Hb*j5`^Dd)nR)CPN}huEimE6i4*7bJbZu;o*L3&0pHAl zBQpwrPvY{C%ZR);B#tX}BntnP#GOamocte3+`0Yk;JYQB?WCD_RO0eE zD28O*E^)kf8+iNxnhAzXiB z{(qM^r{GsbRPT2s&b7JwWBeJ2VLw_dIl1IKiM!*1@wcQL*AJ^m{t(IU`YrQgwu$?s z7>5ZXHP&I;&qqgPnIgI$k;zo-qZTrq)~hJ;NB5&GC%PYPJh~rk+_k4#gBfFnHLY3ov{FG)?jIjgZD;HTVrxJ~LNWse#e1?Lz65Sv8 zOBI|)v@VD1MgCa|e<9Jxf4PEZ5j_s@pn?x2x=_Op5sq?LXN0mLjR)d0ZBmB0gzNHA zE*`r4|Ht0HfLBqR5B&J<*_^{kP9T9Ggo|>xNk9lm2#_Gk;ieEk!mXmlhL8)11QL@V zK@lPs4T2REE4CwM+mRe9$RBG{7@luPmTJTmx6bPuGP=4<_`@VZ7?>Q@|-~Rv4 z^ZRw4WOwGX@4WNQyR);Gvpcg&)1&L>&xED^8fXs~kgJzU?WD0tmq+h z*dEj?)S+qde&=PZ_nF^OZ_{EOZ`0Vo3#Ij+L@=> zqt|zn#&tV)5SMoDa-#~_gCwPqn>n%e0FG&+(f4R*Fl1vY+LCKTh&kZic4k6veSz zod+R}f$ik>!TlTC$-F1YV|{fyx!*%Q&RfQy7wyADXKC`QG^%(5Qc+rYBR=ulGv>g?{#FNa$y-pYL@2xte~xKgrX$ zUT&$zCunxoXk0(P_(=vI>ZfS(1upy%7j8g)3{uZ!F8pB^{<+50S5vlH<7(RPs9(Q3 z_>Buc<-#YCAEch&x$q`2wgFOpiVNTF!aa07fO>eJqvlE%{)!8?hfJ{jtn1l8k36J) zPm{3yy8QJne4h&+OASTpU*y8KyYMev`0KIJ?X*WYh^+6*xajh)$4BRP!pBD#r2R?s z2te{{T=;`7{96~^Dm!zjoo>I~poTKj*pdJ6-tm zF8nJOKCV;ra_@EF@4N8Moulh1bK#G<@b6ssV7g$I{<+PCzvjY|x<jcXNto8GOf`MX%xrRc#5<9H_^e?P!*&|azQ z#=aEC)iH{*d?m^2_d)$MdAy&*!16a!x)ZI@p8mFoT3#gN@1!(8-#~fZcbH+YkbjWU zSI`>evo-zK3weHCFk5hLKWs1C|1rre6!K>%y+rV~9=mX^2kYre{2n3Cb3XlA@aZJa z^n|p54-*(Jx1M-YA^#}x zB*9-H-bV1xiFXh@;I-}VD)>djFA^Ny9#J7(@ae?+3%-E(C4%2ae5l}CiH{Wgb>d?M z|D52k5!XX~DY@ zx2RuX{|_b3!-_KhIq?J`KZp2vg0CdrPVmQwcNF|(;@t%Qka#b_?NK`68bfex&4^94Ua+y-@fAW(D)D;-A4L3q!E=fKM(|SN8w9TZ*p z4$%13g7bYvq2OyMPr2YHh|d!IQaX<234TBErNq&Gw6iDa*(CS~;yVSONcNB67s`|zv05)5&U|R|4i_&i8lzonD`mN*`M)r{la#x zAo(_eKSumQ!Ji`DNASN84+*}P_!z+t5WiY*-jCA+|D5C(3eN5APQiao^8XY(fqu_8 zCU_U(ZRk1(kE8C?_HosdIQk8bcfLQ#7V^oI=Q6>262Df{gU>4lP`MSFd=HYv)dEc( z%NZ4$wII;ak#wsm9Ttx063dY8>TD>3A5Uag^u&XR^jo{sofH z(>TgMMEa*`9OW~pJx$j*%5yuvLE|X@Aj#jTag^Uc`WI^)<-aBQB^pQhEhG4 zvyA+{O5-TMmE?b;an!$;9))N`8joYFYT|Anrr4O(+Me4h04eFOX1 z9@!qoj}!8{NWQJcQU5Z!{=7irXpfKNyK7w8L+6)X8drWG`7Dj2{B6|l4b(WwzfSU( zYaHbR>nRpk25bLzaG3U z|G;{oJ+~205PTo;p2WFc{M*STLjG^`!_H-bKSX@2;1$Ft3qFu|32`oW7&;R|rN(>N zNG%r%J$`y0VwvFMh~FdlM&b_$euVfVf{&*6C$j{x|NQ1?T=@mf+k!+#)#l4|fR8{lk5N zbN}$L;M_m_UU2Roo)(<@hnEEB{^4(ebN{ek@MGkMF9hf7gp-1sbo_cLAN!Nf<1L7z z|5M5Lxaz9O)W=i5;s;0K85(hg8!EI6M`Qi{;c35=zW*ng5N~^ z9pb!Srr72fhXvn4ocAa1Uq9{lX0&F`^=~UU56pa_;4Ggmcuz_X6#Q~Z^P0;YMSQ%F z=XQIo;QV}GhTwfDT_gAeO5Y+l+kc1P+&}Pr8{5hK!^1+J`-k5P&i%vFf^+}ylHlAw z{7rD~ANC8*{lgc6bN}$I;1!f^Lg!nq7yBVeaP~t7!PyV|-XrT_KlB&!?1!O(vmeF^ z&VIN?aQ4GA!PyVhg0mm$1g|GQ)Cf1>Z&Tr5Z6-y`^!B>#ZmL6YAjcqfwIu5q-V-(PuN z<7odu+K;aY{wLyZ3qFbTzc2VAlK)ijr%3*=;NwXCwBU!SUh#BYjO_~TPlGjv^E8h3 zkL#+iae?3g;@t$F*wL0x6a3FzY@RLnlO#Vx@cAS^O7aVBJrf20jO@8q@NCjkBKWb+ zww`K@qaW(X4|6q+et3lB7YklM{1<|EqlPqwRNTq<}C@d<+0 z5uYjeYT|bazL)mn(}MH&x`!pVY(*B`Z?T;di6;v_g*X-Od>>Ix<7rRPj85)QMyiWzVEIVd?KaS3eI}g3(k7B2+n%AerzYVlRZLyE%|@1;OmL+6MPeK z_7m&p_GZv_=B(c@IO|Uoob@LQ&ic8ZX8k8fE=$OF;r1XnPue{~aD&=&uHZ4mCkxI~ zY)=uKC)+L+Jd51B{xYhgPEe!mqt_A?wN zYvm%ZrS{gI1n_-peSfk4kn8(}`w!&0|0^{;x}SN!p}g+T9h$uEH|}RpUiZ%lO-dA+_PiK8F%dKGD0uNS|^i}HHC{;J9A_4-2Ndc9sFzoH(!Ui|wla=l*5V{H48 z>-Fm84RgI-#*E?_g_U!{BeB{ewbC%Isa3`01*td$YHH(ARn;J`sYS(8XHCm5m^!tp z_y$9X8Lm0XOVr#Pt^zpDZKGjcT{OAL-~hJTAh4;06*FcO!$8rI*4ty&7SDh>8ZaEL zHVQ3`QY!~Xwk@$MTLp8!z<9}2^=cSY7F4Klj~xd&9-LKaOf8&INmaJ<s5z=ON+^};!+qr8b^Edd;WJDyS-IauvClmETc6@X=JYC8De_AEF&9gdG2vN!)5DJ5s;J8>u_wq#7d$na?41BqY+D6zYuqu;Kgi^Yw#U{?0D>`8>?$CAa+e zctF~OvXvEfjw$v^_3mDkf^W!-NeJsnz?^~jk z-x48&5%$Vi%Cde5a*`=wI?;1Iv3x9Bmj42cqLm**@A>fc9f+wQ z%eo$@WGGlk<*!${>}!l>5SQhz0T!+NauVe0MN$({)~{egwDOay?HqdfiGXDJlYm7l z|KnIYKVN^^smQW&VMDa?cT)K$Xe0U`AF0UlAEDz9R*eGx{)#s10d3WT3Hp&`=n&%N zO>H1K=jZiU=sYnl%YT6K^YO##IiHhu$-m7dKi8l0KkZWgJ(M5YtR7_f2VC;woS7J; z{j&UG7yEH?WehFtm9v!P_jSpih>ab>*~-W7JEHkN_91t_gT^GPh4c@-;!dl(f*F`FYWIR`K3RE)1nCevcWg{H#CN`StSgzFd~S2J*vSM5vu+qZ4!<#&QS2zswJ}i13$@mRguv z(K{Fnrolf4J8m!gWo9beCnGbvpNdV1n?HQ?WgatJBh&a(R9_sa37Z#E(Gd93G)~|2 z%!cD*%?+n5V}#Lb+uW3b8xobjLoUPE-R~aNa$p86Jy07Bl&X}S93)v`0bYeoSAqB zoQC=v$*-L8m`6J|F($6}Brm-W{@XS+R@?x7-e)Ck+;6qoh&GmHfc;*hd1;2R{eV$- z*GS91^g1Z(qVq!8qdN}H?geRoM`J~Y{l?LyW+3O$jz;!HZD3p1!PzR^71HNJx;v%2 zL%JiRdr`Uif@Go6g1PQAd7h2V#S;DaUbe}^Y-=|=c} z6yk%-xX)kpv|f6!+nToX&8DA!4(mZ?{O6y+`d^-=pN}#Fakve>ckbWajEn0I>oW_C zqf=p6y91yXUaxC;;NVSn#SJx9EFrzqhnOo4S^kZo#q&2$y<`67Ww#hdb8azKOo#ta z`{2xi_8n&i7Z2Lp9n$+@f1UC8Ki_8=6VLc=ZU}meiJ135!_9ZyZYD3C?uiGRZF{Gi z=89#e|CP|<(5V9WU)It1eXxBnHMrO~RdB}EvliM)oXY24`kBZ7O1+kM^m(DI8SoEv zIJ(J<&w(+TvM}Flb-WFO_Ba&U(B5Iaeqo0brV-j~`3G;_ZyB3E3YeP@4jR(^lXju*2fAI>{mcHtx*ts%+WlCE z!QGGaxxD*_3B$WTY{Ug#G!g>Up5}pn8!-XD>CNeG`f?IINjb~RCOQ7W^-0|aFG)%q zvOHT+U-=Le4m&c}|fLlan*<_N2q(?o3J_zanW- z?xLjOrZ@1Z=?nDnBn56WngrGx{+ySL*qlmFV$LBWKF41G`U^n+RM1~=4*H8he=+DU z0sTdbl0E_b7kYewyNx8UKQ6Eg?B5M#lzC!vju?qKXtQ321*Rupf!(Q4kEWicfw4wH z&h=pXE;A-)Bh*E=9qXd&zuasR*aS8=(hoN4bvT=TXun5w`*WZ^`;VQ0VZB1zA2wPB zT0%eeBCJ1YXLR>LUseKj`!rx|_d$R8sR8i>h(n*513o>NWNeRve)FIi7dY4&;?Q^Y z@IbsB#G(JZ9sF^y1H^-&?XaH$2RlQ&OKAJ=<|a>ox&{t*gLF!0`{ucc6LL`YB1rcP zZNCoVy&;|keG*EV)_FI`WxG0vqIYs!1=>(&U-x86C3#KVqgP9 z+n1OSA7pIro@lIqpTe_y#2DGV{6=1gw>Exld3xY6(-zJbCqV}LVeHpXZlBdg z^~;!dzm>f4+o8ru+nM*PVUcKl6bf;zHX$>)Zq%>#wxs&)fK+)pFxU(7$s& zRZsieiJyo^)UzY>7stnrfqIOF`iz2l1?d9puQiH-0o)gzWLdsp$&oc zOW)jd<*(lS;;F$K{5$^GFlzIThMv}+8vL0bG)#YaPec6HHyYMAX=r$~^(PIRuKlPX z;cvITnR{{lo6tU99%%+%KKR&>4bZo}{KYR8y?OZl?G0&5A8TlO>XC+uqknBkJNR-# z)7I}bJhuNtL*j;`4P!q0wBfI2!pk{k;>(9$7`kD)+4SWxGwR=Ldhat0n>{Zy^ji5* z!xz9RPAq@(^?sWh#=i4@!(*==X-M!SybR~yjZ4gC8*|LS#z)PBjhKe=)jGv8{s`lw zW@6pZ7wiX&cQowl9o**Tmrfw_QK~J6GU&5?;I9vf!3ALE-I}j${dFy(?cWDs|DGCq zHSE)?pdI_v{(MX14M9JSI7Nv!hEYSbtK6u9|AYUh9vD1xPOy5`)EQ;f)i9-Hu%;qdQ(7DxIeg+} zL7b3qW)U=jsdE$@3iCZyl}(*hQ&ANxf&a=`Q_IT=)l`_lg6bel{uV@9P*oGGC4TY^m@DD}Tz|@oYi&=0+K~ZsVc3Dkn8CU@((Cm`B zs)9n8?yjt6POz*RH&>Sx6<2|IP*Nvluwx+9q*H2e!mPs5Z~@g&A2lT&m{3sOnA?_C z!|a@pv$`kNW_B@D2iH|)HQ)wiaB+Dt%;#7!v#bz`pD|+=L{#moZQ~1SRF!JVW)v$& zlou2h_YBT1Edw(Os)~c~yAAw01ji6~`G#%#Hm^N;$@0*(*L^bK)~8dRezVQCwRe2c zc74CYuP&Y4^e_JyeAV1>SB|)2c9(sFw(ZU7f8Ee+$InZCu>A|SJyG`fm&LdKpSFSj z?T|<-tJ>> z_5bFrN^i3Ve)-Pje|llf&-SIi{PQQeHVqBg*KP5kL*I@X^~VDT_Y7+meB!`+v3qZM z3k?{nHI&etz3C>#yFEuxR8L zcUJ9rXX>Ng3s<~cGGx^58NE(4Ti0ReqbK{n)%E^ekMH@{*4xWhWWWFSZ^}wOOZl|# zq>CRZ&%5pZoBF=}z~i4@4*CL`#|!RQGpj$UvS&>HW&YAQrWCQ z^(~g|ynW-Z3*UIKqV90liGNRCJ-EZ|Jede`Z?@=gsM&rpyJttA1|$mM97g9Sqh4mVD&h^4aq8LnLJV$j!Wa?ZE;H>?onim67X110&L2=SKY4?vRPY#=oYfnVd9r^*p1waKPx@K& z#7ETU(jSp$z>mn&??>dxIBTB7i24lr5qU2D5qbLmh&+AHnrFADk7>|53DllpCHt9I zMHY`S@T|o|<~h3yBJ-Smmqz9}dlTIgQJ=FPa*=tm&gz56JZImfk$KMEMBk36&)E;T z$UJB7LL&2Ip4A7DdCuNMe@r*Zt(Q;f+S$F5wwXpLM{6B4jx+LFHh$)OeufJfj_#vv zaKb-M(Gy`rF=yqbc!ZN>JV*cOppr<%C5}dlxG5gyXqmv#wGJxg=oSZ^vnxVQmWdo) z=b$2vh85#umqx+OV!p65jY%9`PZ{CTjH6-26B=oSgj7751m1SEoVBy#EZjt5jOKUE zU&AThzn0P5IBVNy>$*6l=W=u>9kNg@?!k_P5ohGJtQKntQ5L-R;CQaX(%0}c#m5di zduPJBr%>T`{W--(MygZb3&ndOMBo*;E+BPjAONHZMgxIMAqqb{a$duTZ3U86Gf)Iu;#7Wk2Oy9D zR>r47!7Y5Dv-Ne69By@sbXMw%^IV4CSk&7t-Qw=XaaPx6W(U_@f7X)Eg1W?-8^ z@TGloud<>A-y61ocgrwfK9o#@p`_+=p`4o7TgywiO#*{KX>nkFdbtS*o-*i2>6MV>kSp zUzry6Gc5it#A82(1qP2jLsJvKssO%SV9t(iMI2TG##;{yKA{N)VzFWvJhwPr%7Uah z1IKz)uV-Bik!DMv2o4G6I8S0I!OXSbL4w<+g*!n!5wlodH}3(tn=9L$LU5B=fj(_v z=K5ikB#N*S>mgT5)PP|k{DV9$cOD0e;3s4|m^(`#*~(O>8}qsEAQ7HnHy0A-j2D5a zs=UdO_c?L^B2g-*6^!pjnKQ5~^GM@@k6^)JJC5QW3MU)Tl5q0ac-XV}BY_I$S124# zevQdyhty88CD6&Y8sKEl!tdJ>e)SD+H_6V$;bIqG3B`t!x1tqoJa^hg)Z_S>VI!8H z5p6F8hQVAOt9*7Dq}!g1Az0&WXT$?(7t4{vM(hn3g%C5mBd+RW26e(Uwyc=JhKfIi@gX4kJD^Qe9i3Vc|3sDjo{= zaNg9;sKzD!X&`#&p20JBYyCM!B{rYxz3Fz)LPVPSQ#p^TH0;=>8((%gg{YBJ9dqnA5N$YhjjPHwIrcs&feDwWpdi$C%jOuy_5Q zRwKHX4wNeNUcYjXJRj(0wJC<2{R1{>3i&$6;sBjo8^! zcyUO3D&T3nr|dL%7W@lBO+7d=XxOvOJbwfnPA91B&01>yNiZjxag1!z9!@|OtI;rwxC6NAK_@4*<=Yjuu;C~+Yp9lWuf&UkKVC;yo6M`w- zgN5brC3*0M;wtsFPkKgbT55VQrM&!x8NDj2Dz1a~TY{OH=^0stCH>RViZlB6Ps=Jy zPw!XKucQznQ!@(-3i=lGODibODC}+wAJBVtMb-4)r3FF(p_D540)FuL@q@3* zpD^<3;rSD<${n7cZ_CcCm{|zl*QX4(rTl; z0=(&zfpXRGRXakBxD1(yLdI z8^DYz7`XuJsXS(ouOcPYXZI0`X?%wWPM`fd2DsFyuxd_a*msU}buo|f05w%R04zk$ zlhZ3oN^sDHG6S1e+01D;3_?vY$duKT6_iuTagu>w{O7|CHmV>~VR>=EOc+rCj+m(x z)y0PKUpbIe$D^J(LCm~yykXA0z-$-aLET5glUfz<>6S4%{`}zGo|Q2V`0mF$2+X56 z#bKowKfK3>PZ;oidYAJ?`!s}#0Og3 zk59Ew*CrH%pk5WoZEO?jdR1*T)IF<_=dLRVa(G{hK|NBpb*<+5AzuJDKQYGLcu!@T z-!*HBE4=AM@Y8!Bw@$306uPtOqUpV7!Yh6^6!-3vnvvQ!wO{Y*In`Aa6*awQRaf<< z7Ych96jT+KLe~RBRm`gGg*o%4mceoI6RacEd330_bdHA86+r(9{(x67YvxoISErWZ zV^gPdnN?F(4hWvJ@iAkkxQ=;t9rLJ;d3ZX=gC06hoh|b0vqT=7R9#b4R9pfY)T6an z=dRh>Y?@wg+|xem^?3`d-+*og`dT&e6&Lqwbds~k1 zb{I{@kMVj(dlH3~W1yu~oE7V@@m}D|u@-_NuXWmd(%aUzc;qN=vMZ3rG+WOx}fi1IhyopxRoRLtEnK|BAt9667>lkH5H{Vm<*wNl@BYf8Tw%reV za(vc%H+v?+F9V(h-j4o(VCQIWKd`YQ*q*t=8}tEI)mQ+64Il=#`~1HP%ZvsYTO6wj z+dfs>u!#rqmyTAtU*Izwo!{aymKaMbB zX$(AkgqG1}lsDnH&pLRMCk1*LpS30?$LHB?w(vIfjTvQK|0HY$rLnNp=O37pW9`35 z)ox>qf0MVVRogJi8~cpc@LBKPw7~AT@Kh8v41^vq#yEOLZv05~jLuIO&gK^sZ{?&p z^0?y8LvzLkjsX!lQh;HsR=kZP#}Rw(P#OT4A*}5=fYprf;w`zcuEO$DOT*y{k*3 z{>bCbmXAE{Y#w=h**u7=h+u_(oN=~Y1N%L)wZYGq&|aeP;V$yaL1POo2VZ~3fSwjw zdtjYUDfw{w$s&ucQ#{IssJ)PwyV25C=`jU#xC#`{woS1UEH@5fCV&!#x8wrO0K-$7j3zl*rE|G1_{_rnj} zFL=L<0o%`oc2q5UQv5u@Gl`?$F4p9^U7;T57ev@TkYtc^S%^X!$B&9R45J8^tLqt| zab3@7jq7^yh@+i-D2}U4NMqpocCnKN`WFM&m-#^As0Rl7a6(Av;SIxt9_IW@we(xA zrU&aAqzn@^j`fWvK3U^f-`SMrG2z&6L6Ya=7rCydi1H!V_0$lTeyb&pe(Rx?JC``> z(K)__gaP$r*ip4yNu2%PlD4fPj(V^iGG9$x`hOj9dAw{Qj{8&Zm-Z0na(Vy0O`OYR zzL&Txcb~?&ZDSP&bPgA~WrW{RVHM~&n83xnj`J|$mF_8{+M zXH`pnH$n2|)Za>OUvJyx>U!>Xk^k6*521b=_3P&so~vB)w_W6U?rSNZ8)H{e@|FD)mov;q@+jhYLUA!n@GR7qZ;RE_|5_f7XTb9Kuq6H@XCu{2CX2rwf0< zg@5D1FQNlRmYeUw?{?vTapB*&@ZPb}+fSj!yJ*MJ4i|nNU1FmBy8KKR{udXHZvkVF zdgi$BO)mT!jd!(GswK}!kNS1KiB2?E|nR=96d}-#H@h zt;x5gILrTr(idvH7sRJfySYf?SnijU=Iao&zZ)@JO{O^OKSAky!F`YqLy5go^+o-7 z-HoBzUa9?(LUCOEg5syf$hJE(w%6H@_2sdkS64Bqcon6F`&GDzTuW#9vpLGYK=r>~(}VswNa?v6M|u8brcUE1f0)usHIDLQDSfBLQT{7R z|4QR1e-EV}&^XGUqVxuhqdecQ+RyRA^|k1_WCzJ(d+P-9%i$lxJA(6d_7@u0uYbNH z&i;Rx(^L*}v}XXNeHusmlPKL><0!w7(&uR$}jTPEVq*K_Ypiq>5Dav_DrDj?=ZnT5FaD>=e*wq{}b^djiWt@WM{d?vE0sd z-8M_`!&L4(!Ji_2o8Y$*zenR(?mjAaoyM`;V^r>D!Jj4mgy2hwKPxzXP=euQjbpi6 z$Pce;9Lw!S*OzZ;T<@iG0sD9kfJWCut(^G-@pNVt(WsYOP zW9Tg8Um~6=INxUu68trizg%#(XM*4#lKeG-^LeLI@b+{Z&357Q1?O^?3Vw>py;pGi z12)6hDL7w`{YCJ;WY1fIv;7|kK91x+6P)kEzY=^5$(z)Ucz@*+j}@HDJ&!oHpDy;U zwfC=(SMTG%mfjl2_IVAp&psN*_Q}^dgEWrvTS| zNBI(xFVr~7Uqt;|g~n0-S(2~TILh<&#(a&Vd~yI55Eg12<@tK!F2UK)4`>|qtRp=S zX&m)rlAXU3Jd5}riSz#20(mezugPP7!atq8qH!$udMfu_jiY=T^@pci^tYkyTrS^7 z^%1-j%Z4yU@LC%i(*$2d{1(BvUXKXAgXEvpcvoV$dW|@@|5vE}zpHWd!(sBn`x;08 zhse)|1n2$BV_lm-$n9?v>o*$-%UJO@V&(Ox{T#nf0mG+OzDu|MU);PcqyfG1+Sqr z>*I23iBA#oizvn{M(dfeJsD1_)a1JF{N1_%O4=VN5~(iH0xve6U6rk`50;^tdHgW#QFN2 z`DDt^+nMuybRy+rUP|)Gf|nBy3SLV*Mew=A`FREFuP2@*2*Fnq&lP+< z@yUX3B0fd%ZNy6j=YFqJ@ZBU|EBLF#>jd9Ryk78s5??O(0phC!KSX@3;3tT$7yK0Q zErRf|nCNAUO96M+Bcs@+SnZBX00@7Hr46>5kY7#m$%3yX9u#~N@f5+iU%O#ypp*6URl`B zHNS+!M75Jmxxs0_Op{XzhA+8 z7x6?PzlV6T;BONT3cimxj90A!>;ITI&xy4oe?JB{uNPey0!-%gJd<5|=f=?vAP4LOY zcM4uae7E4G#PZ_MS@3PdgM#lSo+3E^uE5XFxZGrt=jV~k+Y^_+U#AeCEcEvzK1J{>;-!M~`vH}L zk0AM4!ABFX6MQo9dcpIEFBiO&_$tB6iLVvBmiT(X=Mvu{cs=oLf-fV!Q}9*9cMHCn z_#VO66W=TNCgS@9-$wj^;5&#P5&Tu+Cj{r~9)1og+X+9HV;&?uL3%F4yeIJ#!PAJR z2|kc`mf#`cA;CuzA0c=y@m#_4h)))L3h^m|mlH1)yplLS_v8A`C0;A!>xkD0zKnRi z;LC|G7koAGRf4Z2zEc1cM#tu_)g+G1>Zw_x8QFR-zRvG_yNJY5I-V# z8u1f?XA7Yl)W%zK(dM;9H2-3ci(io!~o(*9*Rj_;SJD zCcaAWy~MW&K7y_zw+TL)_)ftm6W=X(9`QYb^Y#5+!55MIKEe5V{ea+n{msuoaesAz z_SVzB3^4rkypDM(@kGHZiNl;{DzJPFaei*fyq0*DkY7bSBsf1G7$G>{_f65b{vJiC z;8~=>oI6 z6P&+W*{N~dzZ`Z8&d(+GXuK;6!+NjaN2vX`CmAoKb^j04xbA1JH_8V|23JKCN8VB6 zi!`qLXN$&lKkU)CUSGa%M*VudxWB>nsoTE?(io8I_8-!CP)XQ}%jx(-`HmXDL*u&r zff!o|<#qe@^P_HmSMB)K?T0zqi^~gAYl>@YQX{_Dr!V|2`>uIDk}~iUlT+`CfDJTmQy}snH=|kbvs%%|`jHKO4o$Qv-&f&rT0Tk9%gYT=AZD#6ZPHnXGx#-RYkh12s3OQ+}K zG)uY-{E0RV>ySFLqNX_Y@+&6wQdwZ;Y#4o^#2IkG`NsRk;;IT5dP3I}vD0Xn1-&-# z$vWpLF3m5gDwx5^==)ub>!6!I4aTV`YE(lQjUxP=d7+UC?x-o43hOyDaNVUSH9Z@b zYLT90bg4~+1Mu>EWZ}~kLB}wuXe8RdttJCPV*Z59?kx>q=?VMtXJBKc_l;H z6tX{!GNS!xyR`ocVA0Cw=WV%^pI5T11F%6dl$}iF>;A)^-evhuLE+KLABGSDUnkh9 z$g-XQxoG8A4z_dX^^XT6%fBA-V^OmG^YbRY?r<>f z<;OI!GoG+l&Qg}O7`8};!f8Y7EPhlD0n1N>e_4JJuxRD;@7sJ`1Y#=4vhY1>$xtwB zs1i5$c_)^S$A~QduXOxm*y7Ie5WP2ozq#vys-tX1{s#Ob12v68YkJQk)QH-$I=TQd zN6Qa${;I(3m-BG>oE{C4X!$EB|JnNAESLP(HnmGQTmE$NAKSz0QMj`q9L7ek1!;dz z$RBP0?Y_*;#Lvxe|KZoia{qM!CUs)Y0d(=1Eq08Q9ScA*%wJ6(uU^LmB7`7i@%{2> z_Aei0%P&u`*JwXp+p{{}uZb?@zmFLp9BE>&c`3^exRf8f#?CQ?hGIZ}qmLv;h?6^)&+A7Z1IA_k^XTKppRqz(b3R_*3K5R$qSN({C$$Yy_AuoayV^>+T9 zq!G)<`xIF|zK<^Jj#(1vBiTK8(EtI<#eF36+ZW!I73FhM3sWn42h)P#V8`uczsyXv zp--Re>OgK#2mE14k5J)!8bdmf%DEE3m7L)!#uz^7d&iQ zIi-_l1+M4+r|E|IHy9_61wtozUimuH*!n~BfUcHjERUMo`>Q_2$>U?2G@9T07|c_Q z^Yb2u^8GN6G0s_x<$ncp{!Z~2eT|QeiVwlQkKo^)ySOFHd2DWm-<3AAT+lT7)`8vo zL55kKVf0ObId0cLJ?gJGzdOi(?_A9L;Z>@A)_FaSkG*`uSADR~FekI+aporW9|&#l z;5DvCIe&TRWUT2~>JNHW#FiT;_rYB1P;Sd9adj&JCOeX(9+9K0uc{rVVV;xT*9W|+U(fccxvjab%mFt2X?KSJ9_LOqrogn6o) z8dXr&iLsu#@mSwZrhnA_&c=!}$BYwan%HwVqtEKALMNAeiSt{Zx3s>>IN9AYGHw5~ zg1MW|Q~Mcxwh!iU-Vf;ytyXG2XY}0^@EaUksxEK}j+o220OpQAKGvSc{q#*kHb7mK zkD}=^{&R-*OOjLWl+$OR+zvfHqd9=jShlZ@kF{L=1ivX|qF;`oUt*2x(Ff?C!C(ve z2mONk1+K4@-SACW%lZ#(el~yY13%n8GjtMtRz`kaiERn|>H$Avy$=4y*nqyN1K-&7 zOj16K=AQ?_j^ks8!d%GU8<=mK=k$jBhKUOZXBOJW!?)9XFdudkXeWMXC$Wu=3!LA3 zzvThHb?AX@=9tw4+Jz71_4dNN-!U6cLVH1<@bU6394~d}aJ-;gNE|Q7)J5%%{!t1TRxBf(cAz-O1k9O5)@`oi!rdMuTUfM37T{Q9-< zYxI7oRil0g>kx!G@6`GsWOY#2V2qLQFYxJ3;nQyeM&I4!(}I98aX0wX&L8&aZq27t z;;{X-f_BjoeA?PMW>q<{Mqljza62@ymB{w_jlSzWq3qABQ1(V&DEsp!q3lg@q3kaL zq3qu^3uPZp2xV_+5z0QA6v|%PDwMsybtoI=IM2DxjLUhbZ7BPrb|7!Y=lIRI9_ua$ zWq;Bkl>MdI4ASvEe%mRO{qN49>@-gzq?`44;zB5=TPQnd7?4iv@n{by=b}*dRKo*l zqsL>ZP)_eq_Bta5(w-gyd%!V4%^PmZ@1yhNA@wb6J8ZR2K9k`+yms6!~Y7npK1y9 z!CNf+*>d?1V1@AiFy;SrsIlVTVAtSgb>kP&{Ocjm@dwbQ>%npjBl@ui-xo}TdaXD< zb_mpUF!XCLtj9jhu@lM|0{T(MTG0E}=`(ocrR-}C_8sUJ+K|(E^_#CG-1X*l9UpCY zrFeV8!S2sB1lqpZkdyaC!z;mt254U|cQ*qs(4L#WpqJNSusp?KC>uzIXrVN$EnM4hH^Dwd3ix~H72@cXAcODED4T;D$FV`0#s65 z6`WHsD_AkJd=4y%gEeK9Y6^ACS2C*xjPD7vu+OY6tSSbDvsJdK#lftj169G>_5y3JpV>ps)}pA8@W@sWOCPJQQ+XV(3E*@kH?7JU0%*+1^8TH5yd z58@v11-g6RdH9KWuU*{luJ@mw-)r{LWvi^;eUuX0Zt}N(=<@Nm@61{`X>r}s5$S*5 zG3fXQM}9Ht#`{0H;mzV(|N7#nf>v$!2d)|$`{8x-mZ!e5XNqryoOBIbqe3FBVTM7D zrZ}jOqiKYG*sQcI9YxN>&^;Yg$k89Cn{$EP9NpsRF4{@aU13BqXXWM)Z2cHuW<-v% zmLE37b5N;4MdLXdwyGaUyRR=4ctmQ7!=7 z#?f$D<08vCXHW7EoZ1ZET!3kma5P-j_{g$K*lu3C?KN%#rZIt|TmZByj)u#c5Lp(S z=NboDRu|elm)3Uc<5V3{Xb$Trx+#oyP?RkJDUPyHwmN>gicgU+fM9!yb_pYUTX-o= zolKkRXnhVXgtKscOlP1Arx;lZZ{TJRwsJH#Trfu`Iw+T;T&8`zaB7t!Sj16w-w!*m zxVwllS3NWewu_4eDUNb+=g=hu$=Ett+k25yi->|}xG`)EBZ@gIH~+GwpoOCYowiUk zk)o5s$k9j_@NS&+V5st+ZI6A_q zcUh#xW#_7Rn4@?iN5iftjZ|EEu8KpB;z=A0ITn{hDn92fZ=j?2XB-VHE{;@u&i!_l zqxedWhMQYqq~f!7oV>sJ@Uo8)PHl6FyN+VcO14{8#945jTt}E9Zh3w{W0S?4L+{C1 z_~^E)$SHngZ5roX#UEiVm-0ir!gkTz!Iwyjpr-@N(B%U$buHgd8$4Suy*ZbXr}>oQ___!NkCCy4<8vL> zXAQ@fIV^Jx$5%V7?;4J8a#+7L9N*!v{%bh?s>8C@aQvSR%Z@Tv{eU$e)Ar+z+{J4+ ze#&73*KjQ8Q$+RO`O|4rlT=3sXvU@;k^(d@M=~Ukh(Mw0MZ1bfxx8@ z^@sDqC~~bp(rN~ZU`t#Ks0jq@L?8unw1<~K;^E(DnhI95@P(4^9nvNpR5$Y)p4J#i zShB!0)03Km!xL{`0Q0{muNVRrHBU8dt=-xTY%>Vne`(=WCM6}PRm&vU%q5-Ilq(a+ z0xMd9M#I(!b7*^#v6SRYqkU71w6Tl3XGj|?v2D1Nkx6zr?J_A#dx$6t&yOQ*7ubp^ zZwEau4jvlxf*DwMbX`Yu5+^!omFHTGOu|~h;7*>_VZkm~W;ogPeDKVq){_HQ1+Ihw zE=1G9Tf5;_bSiI8(SR2-bk|KB)CP_05l42xpenT0+pW#WB;3}MD&WNm^r8x=L@MR- z!mvcLE-E|LCC#ae%9HK|x4}@XqX@NYh2S~tVm&R}>KKs@#i zSYYrBP`R4ez3E0E=KSv|DIQKW5R}|)nq0WBJ542V95t=fB&5w%wk9RFL6cLt)oV;I zXjJA-G~%v;rXFMUg(H$5(x5T2HiY}#h;OsYN%o*wM13$h)X=KAP z;TaM`kZ9&w$IM(KfzRv=7uJJRb4*OC&J)x_UY5G=P}F_S_vf9A(Uq zkmBcId}y6vm7~DVAqPyp4!;pPldtnG@usR0e0eQ;p)-;)V5v&T_1PuN2H>L-RD4LH zDq$h=p+ObL0WE#QGM$or!$)W($7pdlJ{&6&4aY~BP_#LtntgN=L|Xj=lyXS;x0XPM zX}&48ePdUn#IA;;I0hA03142CFvNPBV9QM4~wk_QyEr+OYJP z*<(RO712VC1F2fDHzo;>3a6M|Sj>zhXqccBCa>T~502pb3GHBZ_zV~CD&R6tto*= zoWx={Yc6J@%HGkqvMp3|w*BzC@Fr|K${8&Ru&5+#|4PU=O9^31vYn-NN|Uc!Oo5iy z0<(o())NwD#R>3$a#;+#Jki=5m!MYT+rsLC7qxnj{@WYtw^epPz2*SiWCkG$@dW5* zJF4g(d zWm=aVQ1KNgbNL}777tPkF~ei=Xu{yTJlqE^kLAaG)&ModygED+j83*FoJ1hMIRjJX zHY}hsZ!ouEy~4@u3t&q)`6RZ_aPleKIbEE*Pot`?`^l%~s|m{OUqBk#r5``(R_)S) z5{v}h_1I4C^ka)uO{npv@t(!1A>9f~5*SQHV9D4p7s7J92L;9{;atxmDB;|sq8El5 z?ZWJ7V$3VFeSbxG-;WFL`&_l}9Ty(}+sMVAH+J#oja_`G0BUm~)E{eO9zFsWVqGwb z!Tb`lcH6Jj7o+C439Zc{-LXc>`>NMaxzrn@reUJcXMoZB$8qzyI~_d;J~c!3t}zl$ ztFy4J9+`3wx|t4}U!kF@XS9#l?kH;BqIvBWtaec01=x)2=t6AM9TmOx=imZ6x)}5I zP;{LUZowfn#++fcGL>FDzA=G{?RaYw)!Ff66WgvGZ)0MKcD$_?Z>Pz$*ZBD+?i5@8 z0u}G2$_lE2Q&l|8v_}dzH)xgI5U%9La3vo_OTy#2^jC24cUY){{3D2*e;5`VQt;HpVHrfsPG&$U`!T07BL%y44!EPt3(Wwuce|4> zvpe}x?Bt=@U#J~F&UsIr@SrKfd2hVzEbQk0e{a{AoH{+^!YNm_OJwSt0bAsyAf8fk;ml#blV+HCW)R}A#!izu zQ+0V~1|bc%h~duk2JB4jb3-k5x9Y7n!z?v}5QnwW;2a0*!yW8<;yAF=85TT(Q90i? z@nQ|yX`)K*GfzP~b(-yd)oks){{s^*Rl`m8UrKXdyz5d~516s7WAMoi-hLT<@rFS0 zgQk5QgtrEY;mv{SBk}gYNWohY4)9FHF#p4f@E#@dMh-2PH*%_jkT)7i@IuuC+WHgC ziRM7uIf+$?=9TKA{bx{d>=Bi$emmqqaa)8XX=h}(<-<#Jb$z+pF6DpAAMb(x%0%`* zVa9WqZ@j9YYEGX18IH@e=Xw9$wCUq*OFsSO_D`O?`;({d`t-ry#L*M-hmIHwf4O5vUzI=nilO7Lg13I6Y#KJ)-ZTrcW`QlZ?vnu#uDLUg zfExP%1`ntyHgM2`nyTW08Cl_I{?s{OPyVdx;-bjBg%vY#8~|qnejSA`?dB_`RWKJ% zL1CeB{jB0y#r9HFn@w<}r5eXJHJm_%cq8h_(vTDAD$Wt!R#Q*~Lpeln8u5U+V-St& z;PCQ-nv#mD8TmYlg0q3^ON#6QQB8hjK~X;L@WPr}XSjoWOgM#L0wk16aQF1fgxynE zR#{qHg-*3y1ur=Zvz7K4z$131+QPm>Q(+v6N~m~QLAgCzgiWB><5*Y%yRo{| z;aW~|klnZ)c|3foilGwa#RW5GRZ_iev#RD)*6=&p1{^liYD%&8hCSK`xBP->(Mq$u ztK7++*KAR3EefXwfks8y8l@2_Lq(I&%5nEb@ytfAphqjNU{+0Oeo?VKCP@@?s*8C@ z6V;^@&!q7^up1~WEr!8B;N5nksH~*KC^K#-u9{j=T?}*Vj2Js12yeU>mcytcLBQ2z z6*GhB8L4Th>A{rp@*8IKs;sKGuDGx!n3GUz&8R7aj^d-IvLH??wB zokwYxleVGt7O92kk%IE_nmLul)v2ZUdq(&`gfv`s+v$unJH=JZv#Xd#Rm{UfAP+7b z^3)NMXCE1PRN1`hnxdlO63`F>yO_FiTc0y-&a9fUavOzbz=EsJe;TIO8~2sB($BdQ_oUDI zt?94vS^t>luZht6DClh#*9tP{cw6`udwVYOwiw}U3e{QY@eA9Y0@=hkPnTqGnlHzC zX5N#K%i3)=cr&fz^A>npTE8$Ccsp4QU_$H|pEWqg+tX+5GIG2jkW4{$7);`RN>8yMq_9R*9Db@*nrw^n-4iHB}(i16W49^5z9>+?X7&-!X!gS8YK z4mK=2hds5{%o&Nh${TC_$9U4)%(?^2a`px|PVJaFa2-fA7z>nP&<4=5H*aph8tn4; zKlWKWZuWm1VcH(sv?qUvY2Nd%_>mTYg}ocR&8^rRZ(A_CIjr25$*^ew3P7Y8i~XO+ zK_L_Y`Xe>lgq90XCe}B4w9opby}u88JY7s|Co9mg^3ZZrrL13+VC}OFs$3> zs-|Bbz)jeQ19{qCj( zwxxKoi4vZIjx)wMdPZ)#20Fm-NKN6bIf}z?^&(^|u6_k;v?WFHc8wS&S}U%eG&I`g zQ(PbY&ffeTK38cp`kl?~F{jl}U^bwoJ*IWXMhp}7Tx6Xh_#{H#_ z!`if;NGVc9{4&ME?J!9Eaiu3bN+Msk4pltdK3V^Cr6=6pSU;+>@Tww8u+(T`ksB-{ z($6Sm8IgXrd8D6h9_eSBNBY_3k?qIkk^Z-Nr2lOm*?w%!SNWI<2TP4A6i#!@vVV5t zq_eiP{p&!8Sla$=%)|SoF%R$G#yqkg!0nd(a8?&pam(lu!4Oz#Hv7m;mi-G~qYe08 z3b!$R!xhkUqVYev$ai&-@8BYjJyJCNvt8tIEVgL!PlKKo_8TwCe05&~u}qL}p^c2E z?u~$d1NvJS;dZF*sgNsqd{k}+bzhk)T>a4c z)>2;7uj^Us!nbKWL~&g4?-#OOdq_ssD+bELApM!FaowI2jq83$wAC20T=s)3cP`1x z`mT53dVNQe46b%iT$anny)5@*l9&6D+q2XYBzdWaeS&)Q_Nnj35aq>{-VXKlxr$_x zK#zVkxSBYQU8wUd#IanxJ^xeVY#X8z8Xrk^urjWe*U^n`VG&I7^L6$D-_hD`;CtmsVCW1 z6QQRkacn=mD2}T%ik~NV7I7?h9K~@pOyl}_fqjMY`gvg@$z!>x6vx$MietGtFC~t8 z^z%Y3akihY zv0g(cj;oy%=X&*{H1|uqUzl^hE%(bF$|u{yUgEM{ozlw9ptxFreHgG@o$LJo4QHt2 zl1ZNJ|CyrjoLtj``-OR)ke@;FQ-nP8BH~!z2_%cFN{tWHc&*0AXuO^{+j$FZTSlDy z%zQaK!gtc-i!|O@<2yCpRpV_)KkCu>R2Tk~3vW&R4C>LJ zLM+j^{uF}ezD0SR7r=Ea2FYJ@;r8>KNcoRrqU(Y0WK@v);rW!qQ|zc(e(1ul@I{y3 zsB!h~CF!#0mK)2}d7caZqYH0FJ6`IU=E8Tn@HVkw`*nM&T=-Ki{ICn}6c=6pBp3dG z3xC6fd+Cvc^aFktg#r0Rc2q4_xbTB6d}zF#S?XEs!oPCiS2T^T=MfifzugpR|Hx+1 z_1x^jx47_+TzJof==$?r_}wo2MHilx7+wDw7v7B?38DXc+F8}I&V{EWh4t(5*SPR? zE}RZu!vp2^)yk#at9XBnlQ|BbMB7@?8uesp^892EIqG?swsD_{9M8$iiE|rf`6I+x zC;BIq7_KH$oaIkaI$!W6kPkzNy>jfw^Ad*J?3Kd@690wZJ&5CT5)54KP~s2SSRIeO zDUPeBDbDg&ko?QUv0iBu$JJXDXZb5h{$GOgdHoP^)T3W7alKhj1?g!?Yn0ERytq1_ zILqHeX|6ZQ_tE6X2>BJ1o*?)pN?$GbB1)GC{ufGLFZk<}=Iax*N539es>x?+cJlQG z%ky_`*#KZlG2|D&L4Xp75ogP+mb%^KexkmN?(34*g+zTl%MJzel|l*Z?27|@^k_1I&YJnok~B?ZqD zgnTmbmjn+Ie^1kc`=y4`2L!*J()x8*7t(>Nj@tDVa=Lsn1`ucetR+3Uf^Q?9r|Idc z>95e_vA)}ATdm;DX}{khI3Fi>3H}F?Uqc-IjO8vO{hI{mW8ihc+5a#mxC*SNlJq2! zLzr{_+>JQU3sft$Q4u$^*415dF)ds z(({xiKY;9iQIW?u=|lPtYJ4Q|&o!Pyyj|n_h)2+MGW+30;ypEfA945yx!72qd5XsK zNj_8KmlF4Dd;#%%jbBB4uEu#?s?hj4l5f&DuW!v7=XGX-#%oE>?Hb=ed?#@n-wSB0 z@bH)>|1tUfIfdi6uc2{&LE$*QJYH`o9OXYF`F|)Jue5L`)vxu{wSCOKb z8o!r#qsE^key7IyIo&>u^K*)S5$ArrL;g9UaUQR)G|uyjUut4KJilU;`$YA=wHI-g zKSTZ*sBrY#1R9S)3RmMNQ{gE8Pm<44ILcp7e2T`eAwEOlsAmfGbC$wU5085VaU3t~ zmmmIdQ-4DeIbZKSsL3~@Fl_2?Hlq9kf*QuBnmmv151Kvj9ou4y_sJvslYfgaN#i_@ zgEc;o{69+Lyv}56d@#x9Yn=TvN8@8jev!uI`$7z3xyISfwHjx8Hfj8F(tnr6xnDap zUP1D$8t3(ypG&Ymc|Cbeljn8gZH>$K#~8*TjkAA_Yn=VluJILQr%lf>*dF#zXN_~e z&eJ&e>w+-PLq=-yd|u2}IL?cEXkJWKxH=zaC>-U#<9VcTl;`m(Q#i^OQ+!t{9OZc& zmnt0Pd0sUs9Oc;$YZQ+1Uh?mC3P*YN&#eka`4W=}MM1>t~x(&v$rVt=R5VIF45u z<$t4aj2~Vfb}1a?Z=n1i6pr#dANML8e)bcUZwFl#IMu%0OG&X_`CGnwv{-y%W?j!#@U{~X?k{$o_96gMEsD( zvx)QbZ63!{G>#taIrhEKXWTk#yj5ajtj3FpmuQ^Vjq5bd>&7;X?$&6YCMVVn=*)_A21&7pzDV*8t3(4ipC!z`67+8{N);dndGZ9&T-zT@z+Uy zmBv~Bdg9pMA>;!*+^)&bqd31u;TX?}^uYUmg`*$vD_n4URO8(4Uo_71{Y{PYeZ&Ec z^SnEzaI|MR*>hasXb<~`-vWr^h4+tX@Q+&p%`@hug2Hn!g`@tv=yifrjVBQwq4Al- zvx&2xYoLAH$~2xMv9V0!JTGq4cn!&K)p#rMS2f;9?H+!CtCoaL5l zoc+8>;r%F$hb{IwaO5@=rjXzKM{R%&y z(s+1V<2VMm9T0o@yc)-yw>Cq!4S=2w|svq_dM}MmQ{Y2qve|yq-59QVV;%@@uhFtBh z`hE|!zmF*LYJca@^A*&i_E&wshuUAhu0(mYzt7V72f5l`V_1DYM}*1h&~P;z~l$T&t?dJ ziu%Xp0zQpBth{b9{7zTnSvnc;F?0U3sQjXXK$k$rh3t|h_}uJ|+o6BY0Dql;#`&|Z zCB&st>BM^YK|upzSbkrEIs{iXmDN{(2}qV848rNM>XR0Q=>`L^2~? z0N5`dmhPAUMy5j++ei~7V$atGa>e}5_AkLYNlRsbf_;rLyN)jqs1%mLfbDX~A@c@M z_qn=;o!5VvABDt^)z|x|nPYqc^>v223v+PqUY8GrH1^Yn5Viz)FiybvBUJlKsGP5- zC>zukzRnt|{pJwu}p{d=iFUALacx;n$EyQzKdC-%Ps{Oj$H2L++p-+@YC zdtM%#z24RssH`&-eu>(Dn`&bF_()K1e;Eu)sP_53Cg7Y4_4T%vLVcZKliPA}?~XIJ z9}WL{`>Vo?{}wa~HohK}x!|_&E0IIBzlYlA>sV~RBmC>_AH=t-=(%-Up)*3x=kp%Ctud!>s@R=9{%FqCo%GiE}6nFM1^!$CjLu7*7 zDe54>&nzILa6=@v-Bdq`@_gX>oWF?TN3Xx1>c_Ak9rgO9Vd}qkj`gnsy`k)Hqx$t{ zX}>&7{mY_c#k1Al6~_M8sD9_Ow2$vE(tUze-lO_|qvt-XMwh)4>W7M-E%YH6eqRd4 zPa^#5@iQHmt`pn(1AWAp-*lTbPV{So1Xp=(2kOgtGtmY+3&}O?0%s zAN=d~Z-)B1PORBLZ_e~EaX`3h<0WCU;|!V=Yu5JvMJJp-<|guqhYz*G|2R~r<(r9qf8@naJGRjiAy%w z*t5{i-t)?tGx#>Vc;;~J_xK>Axd=YXja}OWdfV~$(YZXu_P1A=Ml0$pF^xsgWbvRf znKSrUC;kg7an}K>>n{BL_OGJ-?fm=gs(o#s3vI%F zrP$f0(B7zS{`New8SRRSMElJ}CZ=sndlqf~!L`>oWYi_5z;D$zn-3bz#)F2@JP!K- zfzf(;<`ANiTAgEX_>oFzi*J#SDI?Hqu=0tx9#h_{>Kv|jiqbA z|L8~T{{bs8)n^*F4ub!x^Ua+wP2vwEZj6Ju7=K{+#yIpJ%6vH;fA{`5@w@ktFupsX zPlLb*<3V4x$0#1(*;twbM>ySVI&7J#d7$t2@G@I|b#>OF$e0anU{k4?C}IL-P$#yD za*>0~o!CcgR~$RZBia{E_P;6Pwi5@+c8%z`o=MFeaf8h;=Z*(M#_jnv* z@Ym`HW2q;`90X%l90~m%)X|uMeTM-m#__}Pw37YprAFdgiWNRD-Sq(D$C;bF=}+5y$f@%d_hScsZ|IPygf3csxga;AfZvk0&OZOOwI2k~HH) z85~Pf_YVq>}^G#eF6P|_b-b+!Os+lINToVfBd&C zlXl(%Z6AWRKi1|c*dgK(E??qBpP>&QLSJ@3y=~Cn?NASXgk$N!4qNe~E1Q!{V!u~YlJOEp^Ti|Oe{%Epo6yvMN22`gk(Te( zBT+`{cr*U!M^Q#`o5#1oSc7rZ9pWlp#1+b7?D)+14Q;)Qb~rW09|3lwVLWnU)Z2IF zy^-+iSH3&bD&sWRM;LFaPd|FjxYgIu-+l;U0o(W(+WG`z7}itchchFGgMOAj2(ll6 zoUe(_YHVc-8@jKKa=Z2~~>AN!{;rhdomoe9Um#>c;U(x=zXGV4c znZwXOnBT4F*H>X4u{{_Q!k(V~cC=l!C+XCgkvNvmfIRvPeT#mr`sz$E=2KwZ=n3pw zu+4AzHb@`$ls<;@3dfw#4}CajC4l~3qQAaKd44dyIx`Z_L63M6HoWEOxnZ-X=c_(5 zVM7(Pdj`g)F~VqF4`b33#sof#`v{JE6|8UVa8AW@L>r8GqG_CHx3=7gbq|0o&wAoF z9JI&|u+wMu6yqEZ>p)vbyWD=WUH;?JE{qYh<>#~pt%9SGG-PzIiM{eetu;B&27H#R zU0-ifVZAPaxNd>=d(rl313H~_z!4J3$YeTaK1OogGjo#q{kuf^h+B{5?=+UgQ5o62$Kg@E7XGIv6v!w*B^? zaqGRH8-4XL&MAy@Sod&E%zPmTZ2;xW+g!AN-CS-Xaknd3fb*dGNL*qoY}nmu=j7 z)Qa5YUo-x}MIe_4>&SM{jqMnx;b>oTav#`&GLa{)xosiX0rg^|jHnHZ%*a<4B^!VA zUuS&(EY&$;MW(L#_Du0R;Ac#~fw2S|y)}d1iXpx`33*4{!4@SC&bJ`>C=b^lV&hv2 zy2N+xWB8U0d@DA%whY+#YW%;g--g#sU5wUy;Qv^sKHnc5Y%V_B-?KOc{OCJTl7;bl zq{r4?gACu%qZe%LHPwtx&4oDv@AYUM-z@zPAMH18 z{UscaSy8*HGf&i3Wgf3xl=(&Nph4SXuRgK*!G)P8Ya<73FQ|fi4jdO{eq8GtR2G{u zsH~tG*rLo&YilwO)h^8Zq;?VHzgzod!PD@61ISK=|Mwxi75;yo`9tl>%a_JSwi ze??|{?NyoI)Fy!ZTd7#DEcV^OWd&JK_I2v^g11u3V!K2Bt<>b$%M$z5-Ua{51}7I> zmRMDAd*ZT!^mShq6v2N3{C9@`PuG4`@B;kb2mfo~e^0tqI=TVI zIvL{saQ_L5j}FdWyc*_U+xU%fZLoG7>oDxeD|9)yU4xMKO`aiO8ycS-%x? zT+ZLs$#Tx8!ad$$Sjz^%oSzDFEmh3W{TdWuyb*;ys;bV~Y8p$A!8K=% z8I!uzj9zrqy5Y_$Si^ImPBfH*kKQz<)^F2HpDrVnL1sl-+HD;9J{~=<{9Rz+$Igywp*WSQ!@RQHc_dE_e!2e=werz0I z4gRrlD5Y^QXdG}1a4c{PVqqOV+Ze2YG5DJ@1~1VV!26>lk(td!QJ<~4?Rs3JV7*F)V+6!W zbdquFCR(4eGC!&voq15q{ib(TFFpnHeKf2)Z>;^apaK3bgth4#SQ8$GbTRyofORY# z*0j;EHe_agS(^cCSp$@(!~Zw1PV|6v;uoM}2K=W(eral1!AV#*(&7K%zV)$h^j#WT zzV>?PCvhU6mH}~EaYevMx!ukM5FC8s$Of;j! zx&YS%0qX*;30Q_}LN=@k>RQ0D*ar7B{oq`G80O^ZmCuO#AhE+KgIs#9DJ_t{Dl}57DU~ z!u*E$-u}Q3XCA?86^va+H(Z;*+R%zT8)UG|XTbF&v=bQv*Ian71%1S8J-q)a1Do+a z98R+Cy&^EYw^qye-kjSzGtqqG^h)L4?^?LFg7|^^O}KW2XH?fF!Vi(beLC2J?czP` z%W$3bHS|9c+A2!2xzox=<&PZej;5v_aDO`VlU9vH*8}xIBN7(o{-rM8# zDeB6G_+VYEXCK^$pdJszIqE_V&+(VGfu677TmaW7@n3_V4}i>v)c(sb7g6rawdfyn zXM0zp{Zxqs_pA|ck8JNeJu%QvZ5<5w_!3-Gb_jf)0gr&`d4?D6|82Nmj)41Syni-! zodQ3!)ANmE{R8(f{Cp!R!WaqHSmOBx_(VM4Xoh>( zcVL{F;Tl=W%KMOC!E=oD;H&izJJ|mZtsbC9-cuif{=(A(jGN8d;5xbrOA?}mmy!)wTfbCwm|Bc-BDLh9#`g>z1>SdV^q3j^&`UrF$0{tI@ z+$SJ+WVn?31Ni*|h$Ru1uhvp1IZ#v4yb|1AX85`|O>+2RZEfP0;s`g`H@xXV){(_k+~;XQ1!dVAlfb zdt0Kh6Zq%jwq6 z(@^%O^I&a(xTyAcH{iNa4KYmd6yMqdd|-GtwEflC3G+n6CdRMN?79JB81CmL!t)|n zS1cJ%hlS6)yIwFNkHUAG6d!^3`2eo}+Cb+Kh|L|ahWp^2sO@*g&LdKvh+Q0)GqgcJ z#Fj!wn73jxjZ6KM%%LM7N;wBz3m5P^s!gMilYT0TFyIHP;ptl77ETeH1&TQ7np45a zd{PEdfocsSoMNR4C%NuVvk+g{#|_%%B){*+G|D;Y7c%&A7xtcWaN#1hpI~>ITZNM~ z4l3v55(gD>vXPLqfOE}`AUwbh+`@Toh*M<-C%IYEsNf_wU>Y+x+3ZxT2y7|*D7n#C z$jP~mmbsjq=b%DPmJ*V^grw=5 zOLGM|xz<7DTPV5DMU-+5;rg8ERGGm^S8+wK;tEG2CBiALaugSFvXKyWt!OLf+~$hT zrrS>fZk5Vl3oFm2h09|o0dd301P9IKWN!x*ax#g~Pm8Vrt|Ct6JE)SA#R0lGH`fs? zG=g(m96`r3+X6Il?p{}rQqCdVh;l5#QpL#}M~icgVUy9W8CyBW_CZ}vZg%T( zavLF8mvgSE6;$pV!kL;x5~fkaN!QeJPO@>>Tu}&9i-Jup4`pi6)@{_DYwB4~6RW67 zGabQHN;wC;cPzTzslp3m*eYD$cdKx6t%I)IL`m)(%m_|$K*=!U+#a{?^OQX9qVFlW zg&yLX#+9v<&K+|F zImsQ9f}C@^xgfZk3rLG|2-nTAPIE<^T;-q&PIAZ4f}*XQ9K!WH%duc4Cz~Bq$w}@j8Z|RS&u4Pa zc~niKl9Sw5S(kG>svyWo?yD5!oZItC?z!8|b3WY+ar#uu$yE+2=cL-rVyBxtgm9(I zN$v%jTD+BWJcJ;~N$!Odye*AMQiD38dW^*dtAh0dfY|9qgTaFcO$Zjd1$xzpe>PR^q;n1P%ubxLkxJeNI2`c_U)A~|?ymqSTz4aEpK2YuMNU6`^xG z+i=_LIUGq&bN6`K=9A_sr_r-cTUNnUQ9Y+!HD{f+tftXv`K;5H$1TAbn?g=<|IW=r ztf;r6Xa*-$MdyAFjc^ndaWct4JbMU)e}u_Z;T+4!|3Hh+X}FM+0~~bDwzyShaQqjO z7WDDiUBhk1Q!NaWEK2kAHI1`I8&{v?biuh>XS-lk;v{$P940^Mb3POTD=eGLvG5Zn zt?RC{JaF|p{cs*rbJt|-axTXeImrVC*FZH?+S{40 zXT2<<8qRMWz^Jg6SLCCvn1_)S%R5ch z&6Y~axw}Z2xGLq$9>7MIUnaN4l z!gGF-SnOyi=A^6ToCk*|uW8KUq^sqe=UTpF%WO`%TFx5(L#Vdj(NZ{xk{k!HPIB@k zN9wF0!HT(xoI;#yBSj*Qijzp#_0Bn89QSr@;UsIrXqvT^ zbFOXacGy;g!oY z=5Uhj!>P?_cZHb4Np2KPn6s60t_gFgZL%x+jMu zVKw1o1tILW`$V+H73AdF071^}b_F@f3ysuxhy;$gf|PO&x>vX$)2ZUTpJ1MYoJW$Y zT*OB4n8M{laPvj1o{!<0AL1(Jq}%+=3MzG*pUKVdaVpLXZvLE?JZ=+KNlv=W7Y8?A z%*{XPG+!Lt{5h|JDXtbyvKctA#m-YN*Qi;+M$KZQ_BrZi1siqF%jE!93nx{hW`!_n zZUxnG2WswGLT;SQJw)i3(*my*1j4V7>{8R1%}H((JvG~TnW53qJ)4tki4^4A^R6H# z-y|dj4^hsw_MBHp?iQ?&oUBlE&vC4E{WXV^YXby1=X%juOjT>=Yz?;dtcxj+DtFLh z+>}I(I|qHYR1a_LD9Se0g2VIdv1e}mFGmF{ni)#bxxX=wYs0&RIjMH7_^eOJgDsjBO3|$UK+)__ie~=@ispn;H0P{} z^jbe5MzajLK^0DpCG^umFUCeFS?_n9)IXI#sr=4Iof299}W3fY%V(bVn}up)oiH)zKox( z%Cg}%Q5^k{iF5QrrmG`pqyG5wg+1N6K{FThgfBL;MZQNjIAA`Zn~8^>!@v`9UVp+J z6M9OsFX)-u6+V4q^g?%_4QS?hnTDr_o9%4}Wcxri!7c3@LMLiWyrIQ3ela1T3*4k9 zLE233`pXGDF_(NJlz0+uodACCHw>JH?OxDxY)`D#pMWhbOM=b~u%&G_+BUEcD4Nw{ zZuF(mbD->eG$tMR1-8+r_s>9{C_y@mn5p+Z9_OdJ{FgCHB!`A0zf1 z#XeT-C?T%I7(^4Ft!iS&7553>n2m_)Gk6?^#h z5ZIE$9=<6BwtiyYU+f|JVH+s+5bdx*sKb^b_7L5$L1@D^SnP+0{ZO%o&;G(TT%in9nkB`CcE{OeTvB&iXzM)I(A(&vhNbDhYU>hg)7mGc7`Vcn1*k_Bq z{H?l)B0Wj$CyV_QvA;y@bHqMZ?DNEas@TilgPbPP1!6zl5aZv0$NM=!|34dVgTm;t z|34m~!HmP>T+hWOELrgVa!}yO zHVu(MdCw%%Co=fWcb;4`Mr82k(md16&LZ%Qip?aEK~H+-m}zdw&&({h ztQDb(P#QL zBls2Uy4(jlQ6bV4F;?mwCdTh#@R~PWj%zNaGkt=$VEV$&BK>r+ z09Sgar-<}OOwX3T(sc!ElGa}z%$pgOS0OB#eePVY#Wc7+T%%Y;A!nZq|;5$$dB#kP3 z9|cwsYC}rnuYoE?XoA=U)siuR(xR`Tis-Q0YhQVwperMs;%f;k78S*^;JXV-dY~hH z_d_Z{_|)({EYiXnp$d0~4}Yms+U}NMCyf~NFD*AQIM;dUah8%zKHCR_(;0TSS-B$A zj$3m0ajCN=$WSW-5o_XlG5n~?n)J4to_s*0r=W@{Z6f^-l)vPd5m`gJeU}K`g+94d z{t>W`mP(PHAVc>lxO$`Tr(q;11pJYi`)5B-A1jDagyxy^-x z3Ev|F`@(9t=)vz~Gt8m}NS=pD+{~HxLDq2U_>svvmAH)chP>F!1-l#-Rj9(PQwkY# zF-nulv0 zf|IsQeP9Vh<(ulz`HsjWWYWmn-A>((LWw4NN^D7^#fZsFvN^-kd2X^<=(!d^KZKEA z%c(A+sXr3)xP>;F11N(EW%`8Gh{}9;R*L+R*MfH(S8v2>(xPWkg=^KbsKm`ahYlJj z;}ojA8FRi_J{u%1Fy>QLQ|1Gbt}**ibn)!&WK20H>Nv3y5<^hM^^h3)h=_j7 z!i^e?!CE*D!;F0sw%&a|l*^?_E*yAe;&eO-B+RmjN$MvwpQ4a%O5iXd-9lx zeRg}c$HZ={d7O@Eq)5DVC7m#{xwl9*XF(h#o5j$dWV6U~U6wJl zEuee`vLs(eR*Sta5_J?Gbof&E;3KHnU8KYcit#92A|lg=S4hHT*6)Ro1xjVPSSNhA z`pNRQv~p2D15NO>o9JH|*`9CBacG!t0_@{4q#dX3hPKG5M>MA%(VTijbLvqOo$5OI zsENzDn#V=m_3LLsznlMD)F07baT#>XFg>2Q^UcCE#NyG6TVsSroIpmJ#ZV@;WOJtH zI^pSca0j%g6La*wTS9S|wDHHwN4ZN$vN>Dmo#k04wBx83d#=wyt=Fd+0g|(XWU-LM zu@*8QSrjCx>Xee8Gby}$P!GbkTjaDG+O``-FV>T7p=I2jLLal_j~*Hw;>D%R>NIxQaZjHUD9ArCrXES+Ev ziTN;=&afYgoI6|EJa{?f=0BCQ2frLeY?E+(sKccBxfmnY_n!we^Laos|Mmn<>yx6H zi-jJUcAGq*nI!Xu(?@)ULng#n+{YL((A>w47S4I@qs+MtbP}a*zO#jWHk>}L!rsX~ z_R!+1M?f<@0-8w>vE`~gPpA!_?U)2<2GqNbjA`-mrSn#Mn~+%Wo?Xx`1w6KeFltM&@5 zXY<_AtI&E@p{cG2=v$@Mw<^trR|;v_S6Sw|6EEE;WL9g9t`2bL>VPJjMU(D{6;Dy5 zX1I8^<92&^1g>lx;As(ZO3TaSvM~)M-*XF|q78Fi1U}_(NA7Z=E?bn{kE^HH zhN|7*Wo`!Q7&;O!?P%i?TmbP@jpb^enFZF7(nY49i}kC2yk09528)ZOs6kVpz3zq3 zu-plk`DQ_WLVvWxED?^Qn}HH>^)o;el!_}KnJyDoEi!btBWk;zpX+-5 zAygM>~)XM*;l|L-v$(4UNB5=KK745r2_lT%J0x$4+y9*NLw-H^$ zsS_{w$Kb{On1Bm?BMUFnaWhXxzzMKIT&xFO{;!8yf=iSuJiLs;feE~{xn2y_T9AE# z&fKUNhYus7$a4$ih9kl)9{y=&y=3E<@`>XmTb)-g+Ze%o;&|DXrx9_lW4=OV;yMy? zvP`^5#e9{@W@B5BlV#%l4CZULn5&*!vCM!hx^}GRRyiqN=hDui^mS1+=~RLc7CY#X z1uw2c#KK_)^b8I~;0!p-1kb>s816LSFbgg~;V?VdoC61F+&QDYhYia!TAb*;JJNBY z|8Bmk=!u%gzPR~#tvp^B?3Q=a%DZXh-9>+0`R>9UZoY?B-a|U%xN{FH?hws%WBds5 zm_hn!{01c>uQ5Bw`yltW$-U4Fm2wtD`6y4!{^;#u_Adq9Vy$%VxAc^#?Wiz(%b-dW znl?9jy12K+`={s`bbV|MQ&wBo8125!(HSy|KM0884+5h207aubI~))m94oIK%@3(e zM)8MKCZqTumB}bRNM$mLKjJtQ4mUpvjN(JGrsq}}#fRjeJ?%Vn67v#*^1q7WW6(5R zFwEDYc)k|J<-#5}s>+2yZoWb*uh7aXwem`>e1R6F3$!S{QmcQZsP8;Wz_Wt8nBF8h z<34Ff3Mjo>D;*n9`k*YG7}Wu%Z^w&RWQaC{^ zFG8%sa|wM>Ni^v!;Paq;8vJ%`@Y}V)|5kJUx7y%+r~QloP3r7jDpo^$G0NK@pSk0sPH&^n@L{!hEQ!Zgf8y~qs(Af( zqlBXW+x?#h{?7ydxd*1_OrM#QGAOCM27Y2YX<21`Lv>wkQhLU)v|;HrcO+H=Dvw?F>z-d}wD)NP+^|LyRMv<&!5Pa96Z zEhT&ROZlSS!G5;(~>21 z^^KJk@~6w;XSt20+J@>YYbz^~Ff(n!dpPLHz9xeoGH08b3)Z~%0jf~mQ9&3DpQ{jZfUT$ zvx_EXV#w=tc(Ixoetv~162lr?%N;h1&mSwt;QW#DF#5BL!p~h<26{t`yC_4Q;mX3y zS4U@v;c#?@D-$|H&MsGN_+sIK@Wn!TsF6kop>xBO3AJI$P-lp_T`>xO@}ou;2K8|b-D;+IqK}v`*Ku0@$7hG`@<=t-5#a!;Bz`iOt#3da_ z!>~DxxWaJS2th}L#=JC!sKHBjh$39ML*m@*5SYWyDVkn5xhT6hcX~l!eDN5_@ri`{W|0s%&T zNnOnfT=+#8)Ef;(S$Vm!w5hVGQtpLT?xibCAyif-o0Z+is0xsmA&0d}C`?$BQo`ZL zMN4YR8W+^nFD|*dvc3+ZhYQHZFly{Zq1C_u)?~=#>Hu-4VFK1SHaHc~F&a{A3t!T- z1fB|1mVg5sRb(Fyvl8lT88##!aaJ43^G*3b4b;*pt`oYp(>Ofy`-^ZapmIj z#Ys=Q)5*L%u&=E&{pUI*QcS&W&dlc8x&=diOIX5zHYHt?%byIQdm-OI`e># zm)zRR%4(V_-3W8atAkp^)kW6>zHSONT(ENKq8x)kAs9NEC^p2Bw5Ys+Cy`v2RDcq7 zwGiAez&Hs5MMIZh9Vv^oAgBV=hc0pJs7qvUi?wx*GR^5%)mOtL3MT0{!Ppzh?dN?7BvOpy9 zVW>z{8@$S*xX>c_d}skmN~$ZC8x;^N#*+HVWhEko;{pFd%pIZ1*A-lx*NU` z7Ledr1pl}pYZNK@Hh)ZFTkx(Bu}#7~=t=rT#BaQJ`^4Mk@0CTyMm*+Y8MGlvrM~B> zd_NtrjkhUXK}WO|Ut-2>AMQff%3lbUgypbd9ejfnZmqb}>flR)ek#XzO&fD#`V@-( zdvEvM5w#`eSFv|?{!QH7@lb@i@U5-5iKC_qZQe-bYpIS>^(swJD|y7|M`wi2Mj_PhldRy#n-sy1MYu&#(57O4V#@<}W=Rv;3?&P)J zH(Kn3wYELY69eO_D)|JIq(^nLZSP(?&O6oa2$g;bmD0V|5hD+99%I||KJD>o)lWk8 z$f&RE^l7NUx*nSE@3p>#<~l>oj;IGd#_WZHy-?r!!N~K(Ybvfa9Sf}XpXb@>*7atK zZRgnuU`}7ql7Y!#oMNDoF_tS;dUsCjOuE~TK#=v(Jgi? zs6G#l$$54pb}~O?z2`)|C&6uYhVNpp_2|!A>@4dQGtV9f-4s>3d#Bk`tsS5W)%NmQ z-CN+J+Ft9+t3+;tFK=qD*ZS(J7VQ1Irf+P}0G#Mx+TCFQ`a%7vWR4Zr;UV9@CDE>LJ{e@3qE(@2|BZbM5o37>Hi$ z>OA}WLVNgBI}_Z{-}|&Z9*%?Z>@Mio0^6K!_y4)eg0z1qw10!zy;eu~-*^pp@EZ^8 zZn&le6ZQ~L({Y;J`+7SHRCn}VZ|7fUcZFo^UVF0lMz8hRs*~8OZC0KgWvw`AN5ZG= zz1GJ-yL+v>fI{xjs+OS0yT`(w#bevnyQ{>o|Ivc+p60b)Ta{f2-PJ9ZDcGhOWQPHSxl~59mZi?{OeW8KoRe2F6c*VLlBF{c=y4O0j z5^Y%@u@~I*rQPW|dq}>W4f=a|r{>xjn8>qEtn@vAE6cAVTI>m6DA3+s&wvEs-A>Sj z=>l5suJjBr?Vet17YIh);I;m`@}wQ_wf01SrRl=xmsakzvjJcSURs%FPZQ~J(EWt< zU_lE^ji=E0PeWNh>p75vcB}W=1EBU0jE^;5>n$jQe!maP#t`eF)u0;uUt@f5+cFs+#<^RK>08#?*+$>qOenNVV8WnR}NPm*kVrt;a;E@W~f-@;=I

6BXGwk@OcGqck9PB6C{npwYVd~j^3hl&e?e0_U z5kmRxpuDfwItt3WTyW4^%lCq`wY$Sf)VY88NeFc7sSdC( zqg{Q$B8Vl3%vgwG5txbAb_+qI^#RN-sPm5OP;|ct=|c)L#(%<9E0Q%7@{sy?Tj3VZ!wqyy+v3{+Hg0tiL!H(o4#=Xsy76Q}&xMPg++SLnj$x^t`DeX+si3V9Y@$29>oIM9nXPjJnAy z+~BoNfSB#IegS&Ag9E0*lDq=?)E~%?xCLY$z&a@0C`9{uedBEV1XlNCncx#^GpMv- zmH2GM-k|gE7HA%Q(rFzuX?HEK?VsCSud|b&N^A=pfI;(};lks*$#$RVHcl1mUn}yg zdq5%!LdAU2YrVOm#d^RSywJDGzKJ1z5$uD`JPsFHxbDyx_k$#iagTghK5+?y+$CNM zWFG*@JWMn~0@pz5)Qc-TnI>edz0|1}Lv-pH>QsMuiVGa)BA9(J%KJgS+thdJqA!}EY?-0h)dr^5o4IT<>%BRwl{(FTfUp3+YZivQk^ZD&zu%v=1 z9WmX>0_uRTZT}5q(e-H2{zkNDcQo3)-X7`HyUJ_5&?rLuxo8;FryGNp^B=&r^S~J} zZ0K<40ZP8vAcFXQxUTM$V@E$_o6iJY3qBfS+6ho|FN91(p7l;l9voY6k^Waqo;_Mv z4!2qRWE{~Gg3yOP@L{R=m>R}P!JW?tIRzDh zk9YE%m?pTNv(9mp;1irYCkFa3HHov%(I@z1C(ntaLeC|fb&mfdc&?M@M2X;WoOO=l zgnoJm<4}0MBsjdQT-!zq&QFQl!d`;Y=ha+noEGi&P>4((5M2435=lHDI6gTF+CKfMF(H@cu#k8=+!A5dWv(=Lhkp1WyU# z_+38qy&nN(YXo;bd*GBU6r7(NJJ^^hxcDHJ3n4XD@U#GinNI|d4B~@Df5rC-1eC=J zo*BR}b3*7D6~x~ZJS&JlCis{j{<7f8H=B?Ie!mfXZBdZ?uLX|{;>!fbr_V;(DxW_obWSW{PHr7;l>+3L%vUNHy&6%NpN@Ed88K!EsFqmn*Egvc{OQJzT3{)09?0D|4CHQ{ z2XZ$K1GyXjf!vMHK<>_qKpwpAVY%hJVx~$X4_^1AeDJy_xf}ngCQE+TiHbzpQs$9b zXgR;orBbvfczr_&OPOD44a@!Pv5G-H__{*snGhhy87su~gOtx@5$Bi!Q##aa+2#$+ zalHv8p9+@5OUlB&nt6}$acxHfT4_aM$NT;zxy@?s*ws@55~`{Kr9r@-~+e zNkWgiP9_n@kEX_nFBXtsAMs{kzZ)t0iQ@_%C%=DF5cDr@hlPH3{og3D@o<>&eNyz- zU5CZ%%24M^(XP90x00UE#dx{vPcd;jOdOVje_ZQH7!Fgy#Np~NdZvdN_rHbFQyPY2 zc!jd3YZ(1MgyGziuAuO8&cG4eBew1u=QH(a;Eg1M2eu_k<4Gig@@puKhXIsEd6o0b z(&c$x>hd|HN4GPdxUQ!#OuK{)y&D@xB)b)gGm;KNS z^lVV-bH8vL^Ayf;jhuag#k_8H)8tF3E^<}AH*wT6fzo*3aYT8Qvz@vZ%FmZvSXFZ!VdDb(DIJetO`FxFY zeQt;Kv%I<3rRK8~!XHt-9%|T44^d53-%Qvzrq(% z8V~W5#`6WYg(!hIo_AC}HjMnFF!H=!p`EHd50E_a>nM$f_Y|($`K7{DdH$hL)U$zP z@WAsLdAZ6dt@k&HxZYpYesvw&NAjqjV-HcA!doaU4j_jc$~VcR*z-E0+mk}_x;@2; z9<^VcNhgjw#~z|$gdK zXPsD_Ml#qhwOt=^cuiWl+j7sj$ek~<1lcw0p+@SDT%Ps8xJ^k`n!zab3&o5JTRet0Iy^^eL2Cx_;D zgyB}d(DJ!q_JSEycLE=4G1lNaTs2&aP|5jX`rh|zUPOQzdH=ixFEFr zi(zi29#}U@6!{oRBQH}poi>F$a$d{mv>^C=MV^*J zM}9k%QMd_S3d|4f;6`q95`R$9y{RT8%Fx-l*~Gh+nPoZN!^3{si%L8h?xUMvZ?-{5Flpc_i4PasIs3Z!|uY zv@7WKTlx(H{$&?`NPEd{+;FJZ&kv#yK3_C7b4-;GBhrKkrD1~H9m*# z(|F#qe*7X&+@@&q__J}i`7^}58t)Y;^~7jAgE+7EtY;?i z1WkT1@xB_rp7;QbZzs;rg;@WS#QA)}{C|m$*7Tf_<{MKqev;(#H69TqD->zG8*%X?@hdcW{>g?4jpva3LXGqDmn9lsNb<`x{&V81G=2;57L9KszFy;dh~KR7mx$l3 z@pp*-R^!Ks@6>pQXz9;~G~S2!BN`t;{0WWc5r0G>uM=eKgnWU5J0J@m|C|bp6Zv z`xB4V_;BLAG(MjA`5K>2oUiv;{}se1YVv=fel6DcLE_)ibuR1qmh?o?bszJGX?^Gt zhWFI?D3X_-qjCK_k+}SPhs)Oxm!E%e`3=N#HT`^knWb@_FAFqYMS2#8;Y}KsKh+NJ zdDD0i>A6Yc#l(N5@wvqB)A$v{|EcjU#6KjC&zHu?P!;=sYx0BX0ob=1KTNOR*mOOM z<9LOlCsN^MzHx6f#t?R=Fu+Ig{J=R2DG-DKxMjeF^J(9ab;;}t#MYw~|2Jr-TRbNr-3 z`?z&bIQEzI#}h|8QU4GWhAmm+enAZ*OVjf@#ebg0KOsIx@Q`N=|3?hY&RXy>0v{}+lpueDgir288l$Ky1P9Tkpx z_`0Es!qsu?qi~e}g035q6^`R>j`F{u>xp!Qqx@)+A4eShgZ5X!KW=%7JnG@| zeSyMJ56|n%6pr$%==^tu!cqQWYPXI!x67}c-=gtmsDs;YHNH(y_?(5N{~{X4!x}Fj z9!b|(JT6tl2WWg9@pO&z`j$f+?Z1Ri1IqQH7)YJd%G-;V3_uu6tilILh;V&|AdW{{x^5w|^`0rI1fU2-}wmNBz%}{!=~9Ip(@ z^ZUx!PS$@ylYgJ`Unv~Nm*d$adr=SSucy4NaFpkG?xOHg;0NFzH~cs-k|6y1-6^`I!!(S`i9VUPF2gDm;&L;NduN9L4+yv@+$r%=BxS2*gQO8Uzbj{14suG9DiYWEtA zbANA8IO^X_`fpM=>i;F_`IW}GU-u~-^?X5kb}Ah8u-_h0ILeQq{ywg7l>ZgA`vP(F z+ce<3y{XC1AwB=nILE^=jdMJFt8w;^m-@l;aWUzSQaIYle(0`n?AJDu@1=0n4;K)} zeid-1;5br~UrKti6^{Bl(Q|;w3P=4M5Bxq=j(?7aGEJWQyIA3DfSjdrspV5BoLF z@$fH=vww~#9PMZRxx!WZzg0NO|CQ|jLE$LR@e@tcr;`3z3P=4szGWKce(}8Fd9;i4a9nf0c-*g1^kBOu zNPdmNv0YvtZYGX?n*p4+yEOS{D1WcQQU3sXe=xtln(g5@Y1QNxll&fqqdgoy&nq1D zKT7g1DIDe5&u=Om<-aHSw-t`^?4OT`V}FZ)^Y(=%{|4pHC>-@qNRTxwny=hnjuT#2 zc)Zq=d{<4L<0o0;+^?Yu$9CT!J?RR^e(`!TPT?q@K<|gnR=DbiX&UGC;WFarpP90& zVqc}ne?)$1R5-S~l-gacaBP?Tvrgmehs_#iKWrzC_7p4jJfz8=BzvAvINI|V+4GFT z(H_2DeO=?bX`Ojjo$7dY4d8i)8$uYX#>Z|cH#77cG{j;PBv7e~P zM^k^{K~NpIwwsc^NwB??FRH%Y!+;V933s8cw~4?Pcdur(+g<=HrcQ*R~j!$Xw z11R2JRydC1<-KL4*A!;`EHQHQQqGdcCZaqILh<=?1c(P z`432boWfC_=S8l%l?q3B9^VFqqx{_@f0e>fp2z)K zg`@n`{;-4XdWEAr$HOlaj`E}ELFyd}M|qBu-zpsCJtY4-g`+&j&z}^I^8Z8jJf?7z z=eT;2IK~ym5693yHQo$mxP7Ye*CaMhX!>jDe3VJo9UO=2h+n1gdx)>rIKRJWqsAX4 z`Dclv{g;w0c=)R(zm($teT{RRAJsU=bGyblZadI*4fl)Vvzx{_4*P4I<1Jm|99QEt z&hb;AagLMAHO}!+qj4VhRm9nEyq-Lx@XHi`zOL!Hi7LFKaE!Nw6rb-a9OI4sd|2Tq zpD<81@|nU>-toV}QT`5+Kdo?-=W&Uo>kb?jl<$5%>|pDtaFplq>Zx#)|0T)yQ8>!; zI1W-c%BNlcJJ^OQ9OZd@FH|_nKST246pr#d?zsv_`NeeOF-_qp&+%}n!cqR(L9m03 zuh%#}IZmoI`ROFTSmCIj<7b7!QU7@)e~rRXp5y8U;uu#LKYsYf?RG^T^*ly;?o>GH z;p?B@X?iM932d#3JnAu0aR;AkP`Ik+FPffBQr!5PB9D46u4*zSQ_C z;wD``vL9X|9!;Fb01iN{@zCY{injQ zzdTPrQ8>y+42B(SM--0oJWsz?ILc2WdA^S3{_;Ha_C;;(>o~WQe3ZgbKhM+d3P=4P zkbEzNqdd>k^A(QrDRe=cs&JI&c{)nrD8H2C$0!`-d7e&DILhxO`8n&=fPQNz>|ncI;n*(EqdSOW9AcdK;UBl{3g=ix{*b2UWs09C6n+KB zjiPp+Q8>2C@$|=ymfYihM4l@1p#2jc=oTv&QeG{CbV=ru-(2ze)Km8h@MeTo3I; zd&W|~_Gt3_xypSSpG5L}eqcR?#1CllY*nWzP0-zmbn2Sv=$@dXUehGVV9ZUqlQKa}{~yeuS`mk>j91n zt^>UB`*)c0_vm(3r3zPH=dIE>>*vo=qMaP$sA{<)k9-x`)2#3r)FvL* zYdnR@HYr?v-EE7;`Mk4D;p*#9J2c*#^zT-9F)=*s(KwgwQ}`@J{w0kkQGfR<9M?nM z-q!eBl0Tqu^?7ES#^XuRafS1mhef9}{vJ0>=RF)R_4$TR5-xlT7`}YJz9{DlS zpQLd0J_5gw9XHg2oX3lQ9~U_@l*>}&k&i_PTW@(VY>-#i|1^cG>pZVHD9<`jl-DQZ z0qeG+M_r$Jy+nC+9p0hH`zehFKJTG?w!+_|H1dfGKdx}L8Bu4D!wu!t^>Bc~)pd{0 z|0u7nZ%Y(;bsgKJaCN=9SK;cq#OpljSJxkYUnFvMo#FKvxw@W2P<$d+*Np^)tLsCi z!qs&kN8##x=l55lexAGN$0drqI)67ST%D&+DqNk9Jg-r|I`0lC^6LEJ`H1rBJc_3{ zN3PD7Ooh)w!)e9k|3k?hJ*->@YxYEgL)<^yj9_9{HNKjyc+-I3RmO*ZH24xKh)>yQRBZl^8c~-Cg4?7 zSO5RHxk(rjkWs;jph1x#BqTs^40EU`2&g!QkX%S4BryX9hZ-luso)4W;*5$@#fn2q z91yJ&THDfU6{}W#9b0Xy^|k)?T4$|u)>&uoB(%QI|9zi-&jaV4^V#3M*4k_Dv(IpE z?hUyd|8EE`$A5kIP%p>-=Yq@eKO-yD%klq=;Bx$zWQTe={`v3DA#Za0^WSX)m*f9q zVMmVt89hS#a{T{Va5?_Z>ly0h_`gALIsSX@66)pnA1b&U|91;6$NzhR%kl3mNiC_U zU*_dCrCOTu=(ozt{NE5SYfLpQPMNZXR86@{P*%Ov%d1Q+XkJuSzFF{qxHF9dp((;<-6ifZ_*HB)&2#~+m*woODA=8ZJde3MomedDPS2UHu;b4fLTHg@(^vWRY zip6CWRg23OmRHw!d9`&-sk~`N9z7BZLK|UDph1mQ_C!*d%ood@M_br<6L)p(BC@R5zti6I2d+k7p=w31$L`8QQKg z820{TrEAsKls7G`YgmHGtUf&znhQNP*H@M|rP_%%5Y!oAxt^`5l;eb0f(ot)JRDL@ z%j(&+KkRF&YZ;`f%rRHKgm-PT$-;(Id&TB(<3250QdbF5Ya3!ZdE6~(E^nv|6X(wx z!Q>Sd=!}+?msfU})v`cC&9AHQ{GpUr;pLeFuBm*1d0n;yUUMt+3dei7EqSAHU4Uz| zGPoEqt_#e%G7ndU;}Dy5WnKYp<7VMl#AAbWR5UgfAoJH|)0iBCB3u{X8drryh|SuV z#BJOxDg<1J>(RI_@CoROMq?qaN8`G{-^RiMEX4I_To?FjEX>D3T#v?e0j~Kz(Z5Rh z*Vp@Xf!{leFY}Y;Ld+}^>3WkDKIJ|CS`Aoch;XY!?ei{O9`mlZ(QLI>UtW_zC0+l1 z3j^KyTVd^a{CwwdvkmR!<_v&Bv%vRv*!-{Yi@g$hClFffHK(okedf3;#t~T{G z1KrTuVIBV6Blw3~5#9dxjUSu;7381$32ecleHEI4XRE)C>QDBo1#4YD&(zlp#PcYA z_7CyHt%#2QT}S@jBmb9zF|lZ0Z#nW;PyXjqUGNXLD%$^SNBjA{cpKH{7w!KDNBg&t z{~gp0@ZZbgzlHppW<-_}IM~dR;lBiHG8gPadw>};k)@RCS4L>OuMRNfw)z{Wep?6i zb4|I<2~>IDPQRi&e&Jc7&j0R?{;wgUIlh@-t$lsw=)X%z2=k*{bp4MU{kMbSFQv-R zf4iCgI{r1LgKYULp^oGC4>$(x|4O6N475Yn`!(nVe{*S|LE8UD@~_9w7bIl8Z_SUD zx8b$I^s_Dguc;!xpTTu>tnfP@w)&Oy9E9g#SN#jkqzd)v<0mZhO0xXTwt)B>a16o1 zuj3s4`TPI){Sv=cJlCU5ecdL|Zd>oyXocX+0{stfm2*CMUi+&ff0OCC2%kT}1}xgw zuO0Pg&~uM7{c6El*N5+Av*rIes^5|SvmN!fQG)sX8V*4FKivS$Ks)Phzebz?g89oe z+d6-{o65HMXV8EcO7;0g`|59iW}xkLk6(lP3Hon8^I!Y_xg-Bg-rx$>VHE1)!LPyd5A=VY`LF%| z$}pS%P4qc_3d1*M*4o$076#&+dtn{^E*bcTzR>>vVVKQ7|J~7>rd%%C|6fg^W}q)7 z|D{wJ{Es&Owf_mmxy}FjUHyt3wf|sK+2+61(*7cgfB3#?oBt=s|0jMJ!CL#e+TnkV zrTt?q{^7G+HvjA4WN(&^j(>Qztz&|EJ1p%lHeBcbBExL{`S)=S24iB;zRovgnt}Xl zi+^~ZNc;cZI0t5?!N^iV6DPzb7wxMLoxi09wz>ZHk6zB*jrGTqL7mj9D>b%+gE=5b>tBIPc;9vfB0TzXcM0&{92y(V2!`^ zTbc)%bNl%f-tV>5UvaKqL%xRugzNDueE%75vk!QEi|R`T+gh7T*Z-y&k!1(f=lduw zXGyl0h9Ufj^^3V48HD|fM#or&pT*nXJTWagS`P@?BABLp% zpJ$FA-FEO*a*gk?s)zpyek;s>U7wyhpVm-bpI4DrH!43TT>Nc+J+`O_3kvebk1j?u zzx&x!W=u^>ge^*Vk8sq!Q(Dij3^gUlO1$0udT@HN{{QZbU)*KBlkJ=DlHTPxUhC{c zZtHBLz3R)PclUhras3_1zHo(k6}*0#Rr1YuXFRpOEm`&(Sr4>YWA^(UmhPQeVm=Nq z!F=5Z?C%(KX&Ss?u^ZMK|fABGYM}^n?4&f?7K6bjP)1hdhib$3&bP;%Y31~ zZs-1B<4XFG+uG+j`}}Zi-d$6&8ZXh`lQ7=eq}wJJE6_34Cs}0{L01M%m(P&7|<*0_?3&hn+?!+Hl9gF3OQ{x z|K-AV`IXBin+?#nF`!r0@hca@wKeEF8&8&zLZ7vo|8ilw{K{q7W&`wX4Cs}0{K~~} zDFgb>#xvDOp$|H%hwD4ks|zZQgI~cUEbxdg)BJBW|K$Shf+4Q;@JJ5yZRWpRTzaSv zdL6$@Kio)RjJBHpa&hTL7!l~(q}Xh`^l&SO*N^J>b?Jv0Jse}L=D%%GX7KqOuvUv0 zx&(cTvi;4rZGHfqO+VCd+wtqtA7J#h@$Ay~HhNe5rYJTZ`jEa23N4EsKk!HnbEXqV zb+sN&__qA8j$hd|-0Fe8jRC!~j$gTWSF-_nJw92-udIhhDz^Nyj$c_1_gJ8BV?eL0 z<5w<*_eVhA*?4w0Qd|GBU48|Vu!FBjMGwYL$0zDGC;56aq0PaX)Dwbi%UPsXyDjr6I$4G>GMq)=sO!v4oOSQt8GDBqF^7h-QMx2 z^|_>P6E@_g)(?e23Hk|+D zGF0xEZ8(3)1OJacO3 zl(#{~+h}m^?9du*qbcUb&b+yEPy?K|q3*OvM+9|w8#KI)_Jw8=ZKHkIo;|4uvg1vh zG4t4|)8~|8I)WW&cepck;@BdwYr>l};fN_SW=x+DBsc_=*LO)NX6DE~TFdxS>Yup$)YvzpO3JUY#aV%X^T8@Vw3hDFM4`r9_ z{9m`P&&%AdAL>nOh7N#HwyT#B!{3K#MvY{Hwxn{3Tk;Z43UO834@%({u|@~g`>UtSv9 zyvbLL|FR+W$*Qa^9 zMMua5?YsLo40k0DCR@B2CJ^2}i!842xN5?i&6}YWcw;cKXe<9lH-uh(_(9Aq`A=%T zk942e;bYB=VBX}O@P|6@8Xhan;ELSDGkl;&=A+k z51Lj%TfvJS;9S62G1=fvw)QVixoqG+;XsyMng8E#Eb}P%-xLd9Z<)i2H~D~uqX3W1E}KuN`;O9L`c`rNgt)|FT1Y8_W6lPmcYJ{E)LB=QtcC!3imc%69HN z6B;^-H>IJ@9}ryI91y%I4Rw5;q434Ic8<-^oDNS|`bbLmdS7w&O>B#=%T2GaM}Bo3 zrIw4)p;X6DHt&rfYHaf+pQd)MS3-|R@h1E5rzzfJ^E)x;utC#Nyvf$U_UxN@FSPxC zbtdBWnf~BSZrp!54#(>M$ET1)@5GRveKV3hd+oMI&)$in&D$<%MP9P!^uC7;JTU8^ zj5Kq!CKHM2=IxyH!QS+~M!#|vw|h9xl6CK zQ@g_EGT3eO-%@WfcG8-kM3H;<^j2 zyW+YVuDjzp3)k7W?t$x`xZVZVy>Q(d*L`r^7uWr8-5=Mx;(9k+55V<6Tl|DU#`Qk9-WS)oxE_M*{cycMu7~3K09+5l^>AE|!1YL6=iz!3uJdtS zfa}q?F2r>auE*edEUw4lx)|5vaeW}J55o1qxIP5ehvND$T$kW_0CM0k{L-S(hkCz?^4( zC;{peC30|QDU^&$4D~X*&@fJHqapYd2I}EDf$M*32zuG@m)RLrW`#}fn!uNg^z1W$ zx0+RtOU(+FL^uCekmsl6;W0DB9F=JW{xQ=G+eKZGzY5#qd*ODrnGDlP2H^H#ustmY zx2s@#=1|w(X7m$5W@w82WxveJvK^lB?zXQdx&is{{^DdzWYRyrh2WgRVa*Ay+}Tj@bo zdWxoKcc!Ljx7kWtt@Ok$wsHbz)WTl5$>5r`RSSwv%rAw^zdQCAq=V*#8zSBy7YNhXJigusX6zzUu zrGK~5UG#WByI*D4dT63myT7IwL$ju6_jpZFyN8t?X{D`J`hXs(=K?-*39j!*JZMA`AyiKG7mlC_SEh8 zIl~WuPn(wrcS`5`JKLaSdX?DuQH$6)e1*RQ;dhy_CgJtyXDYywX!Nf{=OqsHuSDU7 zB{6}nL_wdJOc$SUR!&S$nEPn6tTXi!GwDk7XRtGiu0$b}#9X@ggcEe)*hD_o!IBda z#khkdCnrjA2Tsh1^297J`*u@%SO3}rPwuetvL83pzf!>~2P}ch4lfDUK$zcNUJ}wn z+u_yDs_d@~&P>t=U%Srf1>w)@Iuo-CS?_A@3Atq1%Ce z-{AH^=~(+1qwjWbS3in9;ZnhTEIGRhOf{0J?$gm!X|L{+vC7qkcc1E;x*4{om3rYI z=_9t&1A~u(!Dq-|))X|@FOgM(1|goTiM~M?g;|r*z3h*n#^0z$_B3pAYxX3pkYzHS zJ;kIh7@9d=HrzL4?vH(8O8uePn#i7kH4cFqN6H%W%|6sPj%xInf-Y9{I1DQ+H@L?H zKc*{Sd!ipJ^jnWft-`hGwHu89d#%LFgx-WDc~16y24_BMRrEJP7*_2f< z-*8h_`R($Xa=G6w{MLx{%duT|^nphDOMCqhZC6g>7}Gps$8X+s*5>`jnAUB~hKAc3 zx>h!Ht!(I8zis}ATI;vXA5quJKD$=-8I}w>!#t+rrSom$Mtv_Dh23RqkF6=U$fn#P zn{tb6$}O@fx5}o_j^Agu$v(Rc`|NoCZX27{`F5#3o1F$>`UjS39yk&AytX#JDBJj= zY~zc5ync7R1lJdXKIe^$ERitd;6=Rsf|Hru8g zc8^y5j9A*Sg>S$Zq@ zE0grMz-VqZ{MjEZ6fB#$)Hf641Mcc+KHdQN2u*E}8QCBwihJcmai5EiJTYwL${6Ng5LSl4~D7aoQmkn^eV5XaWK+>fV6LplS z(+8f7`qLP8UpCy&1P6~u*>Mm?IM`2s-CX{~Z!l^ch6(FZ-UqB(kLHT-5UfBe{CnJF z#RO_DnaoHuffglvJGMNPM)Fju@>HtwG~LhBad=FDZHTyoJaw(ZJS{VIVtIla5L=#V zqIs&t7Cs*FD)Q8Iejl)I&C}8_PfO8Cn)u^1>Ry`lx}M>i3DRUbhlkUiU7!&>oc8Pj zrg%2kvkT00JR9uQ#h)Ae>xR9%;A!;IxKqcaC=RV|r(?=Cm|A_pdCi~F;C3vCP#i(~ zVuaz4-WOw(`_Unv+XaT|sBZioIP@i+L%LPG#?)P`CSH>z;erkxyV@V zb|hL25B^+8u78d@s7n~;L1;I3ebkOWn*H#O_YDO(5WTcAQ})uzOxa5-GvVaKy|gM* z_R^|M?4{AcP;{KVgBu3yrS7fROS4U_*!=?B>DnS(9f@#tB*N8^2-jr#qskvgYcRrL zbknegqW90BYyIf|*~#dmm)A6zb;m2oK4DvM*g;mr)tRk9H%A(DbEH8xM;dfXq(Qf2 z!Zj&3=oV_8-=JHmdB?z*OuyA{-h1MYM1yJBayJ)kUT`Jq_t-C0kEyFs9P)UW*_wJ! zq^b8rntBg4&c7DDhZ^Vi-G)ft@t)t*dm~M~*Kg`8gP`I5@-H+MZqd&%Z|lSOU~kZ(9FEv=?C?Na5_UoRGt6V?G@N0c$gF@F=EL?T=hiEvFM!nJ8~hFOad@&S1*MemQ&YyIfw z<3SWjnKk<8AxIscb+2kmXJ?pOA`QAF(x6)+4Z1bbpj*@A409_r&u`Fe)I5KNxy^6h z)ZoI*F@$OQk2Wtl!({oF^I?yvL$CcAW<#W@8zN2JK#lW{x((Dge}=g?(s#V)H}$?q zQ}6SeS^#HXTK?4;CTo;G!(dxgGdnTEJRWK5WYd7xE=1I;qS zm{S^G)IA&t;o(RK4@W}ynIFOoyaMs_W=$K1(9&)Q;xg(k*gZW7mr? z_1ND={pd!B=9?!{EWNxrp-12JJHx_WUL2pAIjgxE+H;J8*z^b_%~U(xN*fExME9 z^pExR8912kbH+(WSoTH?AV{e-kvB!$-V||rQ^f5$-|di~J4BCSdf4sLF1O;Cegz$c z$MmZie=d1&+ z9U1X!A|rlHWW@VrgZd4(gxu*7f4FGJPL23SA}x9((xOKqLvNEm^wv4!i>&xitYn<6^|0+6UTU zJ&S!NM*L@JH}~PF9XaA#d_%TDwKbB9t&v=8jpX7vKNtH32cRn#e{$tQjOEP{x0@qw zH%HvI`EIZ6(CuGbZgWfyX`)!F9{(&=kAIfpL#ptIKMfyKh5Ie|pejgo`srvdcS@kp zInnQ-;=MtS`!Lj$sTF&01#gQ7{R9stDe_ZPl=c(sb7j&5pLv^=NMo)`5F@{66$MJojHP)fJN<6n(?b0U zhm2)t)tZOxA`jdBJXA&Ph&*JR>l?~G-AFRw4H{T7oBY@RtpAgN|776*7a5pYI&)6W z&;xQRYRs=@=PXS%G@75@&M6q3m!DUVGqk2=>5`H44RxoaDw=YNip-aqRV*BrpPw2% zZd`tGMM1&Xg<}_1n2iNR73Jk)%E#uHr$$#C;7vJj)M<4Mi$_(JH!P{EU1olg8h)sF z)CU_jytnD1KV9?a`;T4u{?D)Y)6KVz8l6Ad{42;GML$r^MLNGiGRJzFn})|6RKD941vdpsz2cVH+17uJ3XB3Khw&5E-VaV%V;>ilWoKl(N$;wfL-5ReIb{ouC?Ulo@X{X#_f5PnP z6I{oxUuNuDj!P^9o31h(=JDe#uxaUzz^1DVZCa16(5$-{GvF>p=_rC+!WZgV3_>kS(Io!b zRaJ#~S@12aO2F|Seyq(Kbez2e;;@%M@P{8e%WckD5XfHg71&46 z5z$tNG@=fY$JdH<=?P6YX;_?ER<@wJsU}tH)s`@v)>wUd%3D}dzNpb; zs>xeWQ&+LrhYQLZjSMd@1E+KWIel_8e*#-BBaPY&6^jjXs1;7R*Cl=dilcWH42+plo4tZADOT=Bz2RC(NBb^T=p2CQq3(`?y(i1KE@#{eAA2 zy82W@d6T(4F*bv%bnK3b1r@%BnmTh66O=)}KsOnE#X^dqjyEcr8vHsfO^yCWV^c$_ zd*#3ennGDS$U1=b6*a-3mZ}?e~$yEfdu2hgrF!KUU6EPT3B6M zO^qxon=pI!gyYKQOh0}~+1%r1O(`qWRvMe@>+2etQk7nLsu53$kZnA40R$T`sYFWP z*pC31LLiTkDiHuxA^@u_TmUc8T8d#s#h?=OMWkW`K&=Qscc#}ORiGOKfQ}@9D$u{E zfQ?8}KpvEG{uWg%@#U})kwXrHQYeA?5r7eL{R&%sfYERR&`^PwXH*P(IB-yHW|z|z zRyS6KT^5jNdC)&Wxf%Imi+rOY;~Z6(8Lg(Kx;#2^0*bbSy~r2}C?p{mNCCx6@MsFD z$zTv+K(W{2S{RRF&;)V_!&-oLtTn(?yvblEM$t%&LUV$ihK(Sac!~mDpaGk48XGKu zK5jD@Hh~7?e@x#qEu6`-CS#)fmNg$8&j3|B+HzBLI76= z)k_11?8NtJqA8t$k(q(C^4FLrjwTdSMCIjvBK@R8Cr9*R z$kEjtTM{K478l`&X;@a@1V={DijbOPz(#T6u@sn7n1w>0ONVrQVXil9*j#o*FkB); z09<=SKm|6yoZLLz@|sRdm4`hIje!%Nt?9rW(TE})5fsIu0vL%5#YR00sGp^D_d&_!?(4&3TOF&2U% z)#89hq77&y;@}+N4+1%gRgsKX7e&XjE)^jMMSjR|%^b8;m&suhltr2p&`6VTYKrAQ zq_QDEEujc3qW~NU0D$&wra+r>#>#skxF1co4?!x7-LODK0H<6rno$~$!B{PHS;Ycr zHJD_Z>&<&F;p7l-KSe=!0gpry&`2~s#WT0n3YJ*xAV*8#Yzh}A@N4OK|Kexaq%(&6 z%Q_{5y90&bf-XRQaCj4^nMqZs3vTB8An0CBLu+BX6APJ@d<~v~$ z-2e-#@E*!xrqgm@p`7>pMB^0#4qm#w^)msO8WDofhCh9BB7$iqI12o1C?52i=6DB! zZgdIvR={OU0Sx1cAU_|$1q~meer&-!qQ;cwVqoba4ldxj*L6YA?Lk2pc?1O=A5htD z>_BdoEP$y=bwP-N>;uw~3Kj&3RrxW7$9ou>+2Oe@I6eiFuEIGDo|RxHqtZlxQ=oKb zY)XIrZs^cd;rT6Uh$lDdS-!Q913H+fWWE9zx{V-z0HHZCnMp5*b?pH9_04r_b!~lf zlULW=1TW^oeo<2uJR+=HxX?36!I!$)ij=wDYBqNw<|@~J(qu++#bUU4hN;Gbx5&$y z;XD9ygmDUe0{;uWhLrhW&i}|e_3#;oUi3kS#ObrW#F=|1_Q)QDYyffi5Em?<TYH<=Fl-h~D$8?WZzZ%(JMB{XiZnEv&`DF14_Aia~4} ziP>V?MrF3xK2f%?kIbK0z#`-AXJJDv>|hIKbDc0k=8X<`MzW#qeu6CmaIJNEP33N48@oZ&&W96;&zJ>bnD(f zBctnKhi4?dv=~1>9XjJYOF+N#5*fYQGybj-IGX#s)9NQ3S^b;a>Ww`iMYe%+nKdV|+aF4`O@^#{W@_*CPKo#&<*hX^gjFyFQEY(a1lK z@f)$de~$422w=rIh{JR+MjyyIzy@#+}cqtyK zGX#0kTv|q#%duS{TK^C&qgqKQG4DV*D4xIQ;IA=Uo`%A7h*s#rR3c zFNyI?zzdy#`#&$gz z<3}NXD8~PRe--&~j4#A?Jrd*ocU(Ri<9A`Z9*^%+_*uxO#Q1*5r^WbBv0c++`~>8O$9OvOBVv3hws&TX4?=!aj30sVWX1R;*xorY zzBlrtV|**xIX1@YkslZ11CgH)* zpNsZ)iSZU}?-?=P2l-hsJ{;}zj`7#gZ{HZ7ioAb}!;kDHybA)3&$rDU{6bv9yEDe& zXA%R>$~|p1{wJ@ftHVB)pqr{1`Jt65i!8{u48$CcGPBJPY*~#`wD! z|6MU&WFGz}yvt&IFvhbs#^1*H&xvvP0lI{DYm8ry@mv|_nCFXPd=1*UC&u5!Jg*BP{^0><`_ub@ z{ZRqu_{aAFUJ!7OKMU=Q4EPAz>W<^;!GQDedppMYP>lZ?+dC%U98Zbq!Zh<^p}a6Z z5B-j3%x@2RS7Cn@#`q%4^TPq>czR%a!|McY@AueW;q?Hw_bnWs_s8tyVV=JU_r_jHWkhwXYk#!KLHO4n%ex8i+$5H>g81IJhY>n}6 zFh4KF_?4KS$7B5W82_(g9DnE1n-p;F$K7#!PKoh5aC}aS@kelcPKfd0I1Y~pIFG|U z@wl5Aa2|&Zn9pwmKA*M<@i;m>;2dX-*+}!I$M{Ih&tC&RpSI4&aXTd7CcU`8PX{Hu z?*l%cwmv}poPe|btG?iO|A2G5KEUJafPizm?!@sHK1Z5QinB03&4HfnEXMqt7I3!n zF^-210-jG>`(wW}#`wp`PYrkuZIxj>;q$Bc#A~o!XV4yf{>1E6V!OiYB95oVjFW`- zQK08|CSl%|#rPgLPAUR!x(}D%BQFoQIZSY=!2DDPobxjq^RqbM98U|5lSKh%`wyCp zG%pq7$D+P2##f6+Y*jPl`OW^KML^hIalC<1bMb zZzR1iZ_MB|>Hn6EM7W&{e^?_@mh{5$BMXxLm(@x{cEa%>3zPn@MMy;Y{bLM3GW;64 zNO{s59@*!eq&Jc`BdZw<&)%Yu$}a#1lw{W=}nWn!FEzyCj`)JB)!AsZm^y7!t0g* zqJE~_4YreBIL`zS^>gHIu$}b6^FjboAD%~|Je((^Je*gf{3N*>Y$v_4U|Vh^z3}`S zQ_*ufuh z@JAi|aR>jogKu{5CmsB02jAl0TOIs)2YU4Q0ocK$n)8NR1u+wgjhc|YC8k9P1Dhn-u^a|W9oID%}v+7bV2<~fEK63Qq7KeS9No;w@bL3$^N53y{*g4K&r(18k z-w6(Wv%`*YYmI-MDd_EeY)bv5KIy+sF!A^HK4l#IjbXl{UtV(XevUlA-w)dI`LLtE z_IB{=9X!LqUv}`tj`*)|jE9#^W^D1#cG!R1G2S*h?0?~~zlVc!N9}I%dLwkUT7X~Y z;QaTOvI^*La_Dbx@Y@{xR>4ggaM{DKwSx2WKj60r&N&8tv*0;o2jaX|aDMI!9LBa@ zfUkG(I|c7doOd|%w+qhgYA??1Lf;v`zZH6!pWg_cLk(}w?=OVDGk$+A^wRGWg1h{3 zKR`Tp2|fS#D)jFL!8;SrJwh+zxm)ng#KV7U%rU|%#CflyB4*rF zyOa8bJE?EpN&PuHspluioz4H+owUzSU^{F7!JV|vPcWtZ3)>mb{DiTy`d?e(S<#OD zcXm?GcSnLDXJ z(W1YU7<9d!KbP#J{>MA1U%8WdzPFM6+g|*9?bum8pKCj-=X;ON>i=se+xyR*)bC=R zE5Xv)cye}9UtrN+Mlph4J$@$cq<+p$>iN5eWP5+oPCU&P`|atM@1%aUMbBg0mY`3e~(3fc{}<|7JYm1v|04+#q**?-(Ebwv*@pAC;mTL^j8XfS4gT^;CheeLfGf) zIN-B{UXGKa1n19Nfqu5&rC`h~z~=})&&SB;3SK4n(So-KevIHN1V2{rHGzkq zeC`FmUkhF<^j+!rfIQR*K0xq#!G{Wds^GF()yQkpNFJJpZ9qD&(p)VnWV1JO{ z(!S)gkHu!N^lu}zTh(c0>NecqXn1o7YZ)p zFA`kFKSppF|5(9g{Nn_d_KO9V_9d70cXr&4ci5L)+V9M`mH9tV*q8Y~NO0NSg9VrE zJw$LB&!K|Ld>$sajHg6!8P5d4WjqrFm+?#zT*fn5a2d}O!T+6jrV2YUo@s*bY&^xD zzrZ|MD(uKSOcz}Gm0bG$kx2%(quj}%lS&Qy3oO25?sy$=0jh&fZxFs1Ar3+ zm*=Tl9Q;GUQH|8EDMw@YY8&WD!>F6ToU z&R&}Fd$sw`3%}0>e6`@_V?MYrKbrQ<$BqKNM(FYDF-!^T?;zcN^a}hMp&u?d_~lRT z%Jb2)LVt|Xw^Dw~70;$ROBCOo#@~+>PbYqv;yf2$sW@LF^7~QTUY_@FQu=a=hu@E4 zJ>R?Dqx9Sd{C*Vce@b>9QTmsN^ZQY(=kv^GgxPyESh=DEZ(C{N5M6VFn-k~rUk zv;KVIyD9x`#Q9v$`mMzIT*>^uh##Qr^q})1pPN`ek~rT}Fo*BOfQ7H6nJ*zeLD|2I zIA1HW{$AodhcJJM_#9>DJ>thH{w?t`#doFibV~68;)@kOf;d0p;&`fwpQiK|5I;-t zn~9&N_-5i4DgFlWm5P5!oaaoArzcIQ*D3u0#BWx7GVwbVuOxo2;^z~8Nb%cQ~KU?eRhcABZ$NIEl9uceI>9=S3E_0rs8K4KU(p%#7|KCA>!qVzf63Q;vW&O zRh;MF^AtaY&ij`*_*IJY^}x-F52EuvpMN;dgXuc*ait$YoS#dxek}1{EB&Fw`F$|f zmlFS6>E{qn(D{M&S;TuOo=frXs`yyqdn!JS_&$oyBhJsa*>5%RJf%OKc#-0l5I<1y z>xq{r{s8f*ia$wwhT^XgpRM?R5$EUX9RELvS1Wx1<&*zzfc2A!U!e4JX}n$L;8!a? zkL=v6cm-W(->di*;*ToM_aR#p|AO?dD*g@eKPa9?@qeT^d|w+Ze^q=p;t4vRbAI+G z-b3+m#0M%ql{kEV1uSf5CdD~karoXDSPoNsDe)5%Fskzm@o1iq{aoU-9#ZKdktb#Gh6C5#rw~zJqusUDt5G zyi9x-x-MW2-=hc1u8KcEd|%>lKf9IA#h@=%`sYc{*Fm74DfCAu{qISCoUp%K=ocvc zyQHrZdinW*7N!4+^cM*IQNsRDls<#*!><$i*+S3PWt_KNN&leG^R+bO=P_k}f6{Li zdinW;ZAxEE`acN$(ITEdDg6x6e<}3G2>pL6{e04QC1)w1ff4g={J%7G@(CH=v$TkdD34d z^d|}ZHA??`(%&ldCky=srT>`pj|%;TLjRP~e@*&Vgr4ukAfMZnz8gI!dSB@03;Ulb z{qCgyR_Ipm%ONIR-m3|-6pCI%#LSL!$#iTz~=$8on z=}Lbj=`R%eTA^R1^p&K)LFns*{tl%-o%DQv2KkqtFM2}hSCRgCVV|GLK;B+c`nyQ~ zw$L|-cs^A6r%3--p>GuWe=7YOq|c)3dWc_seyJaE9zTC3{a~SQ7WRiJeHZih$*_zQ z`lUi&qV#)_9=@L$7Kn$RO~L*#N?%C&3ZcJD*soFgDWsS0r?d$Dxk`Tm=~oK-%Y+`j z-xwCo !pUFc62`umjrLej(ck-`G){fW>&qx5S@|EkcRA@sjj`uj=$fzb0aa`5+s z(r+RCcS6t406`Dm;|dG6_chY@B@XfPvp&%6sq}A<{s5u>v50@P(tkqw!-Rg7(DQvi z$MX&8j~4o~h5lq^Ka1XwSuFII3w@K)4D^V7W!{1!U(w#cPQ_rueDEw<_LD{B_08BL0rz7ZU$Wan8fHiu3cm9(13_ z{W6{G^mp*R75_WsVYuS_oUmB&B-x*$cn{*U6(2~vOz|PaYZM<#9KJUm7H-#6;>#81 z=aW||&i(tT;wiH8o#HnTPpA6~_RBn5akjsY;t!LZ0~~y`;t!JkP{nyX{7CVKNWVn! zmx=RzD#y?KET#V?=`T|JMdH6u`~%`!9QT z!E{~B_ID#YLmj+8akeu@@#D!3-&e7H<_na51nFxPA5Hvp#itOzRq;cJKcx8Q#2<6; zrxb4_{mY8C692v8zaai6#h)eq7sa`~d|$%(;dyBnx;|xoJK5RQ!S`1DGSUxId?oR* zieFBAqT*K*=lc(i=Q`r&DgCdBUrZd%oBUo4%tvdKekpx01bznr7PdcOkiY*^#d-eR ztoRhtzo_`(#QFY!yPsO>tdnnHB9jZ9D zcZ}l4Q645L&Uu)rIOpL+#W@e~efY3I9-v*EhdY&iEal-%p_hLj@n1^s|6ZEs@%f+g z!+A)j`JOqqx3}Wl-n|v)_6}E^+gq$Sw|5$GXfMRi?LAZJXHt9b6#D)~&kLW2IsPrw z@9=vrurTNLzM?p{_f5s;Q~!RX_#)zeQ@oitpWoOo=b;zPH_SN?gNQ>Opk17Y6O=wh zdALOAcNKY9tMuC`4|gced3Z?ib1D8d#rgX172*&l_~khHe8ufLgW}}*3G};(I0sNU z>p!75hbYc*j#ixGJWO$p^GM?Cm*cEe`YUMvBB383;#{rt{1xoC2!55&-y!&F!ZQ=bAIxuzxGy~$BF+tjG=u#?haIXKJH2t z=e*4$&hhZ^*rN0q)Xpn~eoqnq%}PI&;=f;Uj{oP1bNnwT&hh)dXBxJbPH zMDf%MJ%1J$;{LJH*Hb*p1&4U}S^33+%j5SN!9l;n{D2ph;3J!7dIQd3!(4S5E?*s=uk01YcqWyk{ zIQe)VJrJS|`!PlBI+i%(A;3xoLr^! zJU`wn;u$RB@qbS_jQ>`O=V!tW#KV7|{FvZ!oIJ1W^LghDrN4;s^O4Z+BjWkH(mz1) zWYBd4&u^TE-hxA%bLn$J{RNl(K3H(jUrYKSg3Ep%Lmc`M;^clmUg@u;cAYKs`x-qj zmnr=-)Gq(`ZNq-wLGkeYjc)Hf%0Bn|6UzR*6wmWQFaPf8w@UvS#q*Znke|LZA^uTt z+3$Z=_PO7aWRK(j1;x{gIOKDP$j{zN|2FN9P@MbyK*jm`p;U3cPB=z!zD`(3oa5p7 z|1zb2h2sCI(C;VWZ&Uie(f*5qLq7R)SK9=a`FvAw(7!_g?GRj!=T8I&{V@8x)E9!w z@$AtTgF<^D{u~;h-HCI5{gK)`Sm^gRdR|5;eHYq4NN|X!k>WW_aM|9O#33HA&*OQ% z(*Kp>St9g9MLcIH{jRisp5PGA9Td-ng3EYT6Nh-fK9A?Sl)ejHH~dWK4-oM@qx8A7 z|C-`Fo_8qD*U6tL&g1#N73cAsy_erZ5I@Aj5Hhn2kaf@XSitZIO3e2xzye% zigSDCD9-IISDf2hr#L@vIZJWQ!zGGy9@Z+(dAN%>&#-s`FgUHIK&BlInFAjzmVcQPw3^}3tz7E*HN4| z2oCdJ8hvi^X2IpW_aJeI2ki4a{FKt)MDe^L^rMWPmp>5ayxm9fye~M!Glt^%NN^d? zH^dj}sN=<9e3jJPuD*oX24;agK-k z_iCl*`_;#Uz98YZ5!TNs{dS7~H;Qxo?`nMCeBwJuhpO{tIgFor-gNA6A^(`?TWR-d7dpdH8L`IS-#I&UyG& zan3{5zJ5y}56~{o!!+WY=LFqnE*1Jhk%#k@K8wz0S18VTSf@C*_ddmW9)3b`o`-*_ zIM2h|73VzsNpa4@--tsVpk17Y(YbzpI1hs;4-1HczDVSuUg`IxJp5R3&cmgO^E`a5 z;ye%EO`QFv(?I;C(jQ21zAyA+M4VqL{lOGxVo0>T9Oo{IbDVoA&T)<;4sn8Cj`Ikm zKZfG068f-dW#>wY|6;{C{%Zt>c=+@E*9tDoek zL;5`g2R+Yk`wI^Gt)w3=IOuuaJBT>67urQ1_wr6q`WtB+o+te={FT!GiQ;@magOtI#W~LJ6z4d5 z9N>=th!gyBocj^ye7-|*9xU|y-U3+ok<$Nz;ygxh7|%Vr`TmX<9LDqYbiZ^8afk=( zQ`p`aO8+&*vqI<(GkRXGQTncQUwWh95Kl=rzs46 zFTR)Hpy%UmByq?Cw2SANBb0u3%0sQtPcV93&QyASK60_*oQE}vb9?VloadR1it{}4 zl;WI+ZHjYycMym6Li~JO^dBDP8S+y=?JXe=`ibU0FGniYU^raN%BSJq(#JNT3`FYc?6z4eKQJmxaTyc)`d*To$_~keUjELs5oZ`$Q z4tn{0SqCe9HRZEZa2U_0cK7Yh5FGkz9nCW*D*HUoEK&N?DW21Xeu}Zf%L=7$p?Fpa z4)NSZ@mwW1#KZZ#P1)yp=4VQODaG@&&`%ZdysGreDW10#XTP5+&i(kU;@po}BmI^` zzkpxv$6VrkzPOR%JW%MTi8xD@{(6e@7{xixO2s+O2E{qfbBRNo;FsgPPU#<^I3E=H zQW587rT;0#`GVlkzh0J~msbRr{riUCpr20qw*?11&to484*Dxd|GD6x=XvZ~!9o89 z>Ax2o^gO?1<@xdQ`64&l-`_=W(BDqS%OK*APsk6+y{SsSjqwkw+QioeV(rd5a;90qxVOL2>szAol1aERxZ6whIT%Xnrg`<$P0rQem}sTKMeBAzpqK0)Jch2Rj+em(v6Un;naXN};X zUqkxq1qVHkhxLMk{wvaN5FGS89-bf$`G@$qz0WHB2x{*;LVtwO^YXdU51{sbD>%e6 zYZt%9_kzpz?vn49Lp)%g$3qTr9uHF~o{>U-q=@Grr5{Q0OcEU8IgjF*Cb*2}SY@B{ zQ?2wTQ#@xY&Yw@?JVCp9i#WSd0dtv`p5m;ZFZgc4ewE^^uNPc?9<@brZcnS=^7EoA z6wjsoRf5aUbFNW*0PU|6Tz;N#z2Y4I1A@!X?`=|?^=*R7&&xfhIJbA3;PUfq+Z7){ z`#S`O&t>uQq2j%0{|mu$g#K&AIUbKRFb)R`eOJXf|Gfm?N9eh)!47bahhqRPKQ9EI zJ%EKd$HVV!0hgcW;b)l4IUcw-WIOWnHhfJ5df?n&vxHuLzGa@`od5ZP!{;}6sZyNd zuNR!#2z6Q%=lEL%htD(cvO;l=f0f|yc>rG4D9-wIg3HeXtXG`%4+t*bH{YZ<>)QmE z?=L^6IP13wF5ltnVeb zd|z*X;;hdRT)zJ`RB_hl3tlARFIJrOC4$TMYf2So{Vc)d`zG@g=lstXe4L1axwlSm`TTjk;+&rc1eecmH!05gHo@g{ z)aMju{Wihn^UUpvbN+V-E}u7ks5s~U3&Bf7{=Zh7^CQ2PeuB_aE_n9{}7Is zi9#=buLn5mbA%oF{D;5i5bVh3Gxh%-)9JRO3i;>T7({W4i&TtF7I1cD4tLHRf5a=zBP(-e%1*t z@5|OJ&iQ#jaCzUfNpX&+O>lYN@toou&o;s3eZh9cIUf3WgqLA*Ca=%gKX7>+KAG|a zTwZU_6I@r&nZF0Vg%?gcKdGv^9B@_MpL@EqEPP|g>8u;A+im)C(C1((-*eBOt6?e;PN_Tgy8aeqeO6dUBQ1(0QTke1J7^3<#hso|2lAa zJ;3t}a2|Wmj~j(wd4A{l0rc`b{-)5&^Ys^k%ky%2I*t~cALRLWfZ*~xTO_zVpUx6o zo;NE6pI~C;rA2Ug9=ud=dA?gGxIC{tA@~$wf4kuFJoSm-@_giFgn5AT3om;LF3&H; zg3I&BT*2k}qF!)$Ubs|nIsdO0T+Z`PQEYI2l=JzUg3I~*Z-UGDycZouU`Nj9!vvS} z`DDT6e15Xvaz1YnT+Zj$2`=aJp9wDK^X-Dm`TQ?}^BfL+mQCXv+9l`nk%G(le5T-X zKIiXS20L;-zgXx8Q*OcU?Sjkse6!$kKHnj@oX@`%e2B2$pT;f3Bj@wkg3I~5S#UX@ zuM%9&=XVP(=ksR-m-G2sg3I~*Yr*Aw-iO9B#4qRbF@nqae3syHK0ifpIiH^|xSY># z6kN{dn*^8h`D=p9`TP^X<$TWHGYsvL^ZBq$7#05W89ATJ?+upo`N={r=X3tPU$8Id z^DBg2&gUBhm-G3vg3I~*Bf;f-p57&lU(V-y3qHZb#7nW@az39exSY>x1ef#qO2OrP zez)LqK7U4VIiJ5JxSY@bDY%@^bGwG^mGk*D!R36uKyW#q^Y^1df64h=e&4B_&%GrJ zQk6|Ljb#;8<>p^~UCpwx##Gbd)Uu#tQN;%)=(Z%K(e8sj$%lCJHymq+Pgti(7<+d+`x7ufhlNUJ34M)JCeW@G_V~VH_*S9>bQaJ=(vIHNP?)a2h9oI zF=)7foiT+y=r$D$W9bSnz$6ftZ{m<&P~Mnwh6oqF?FoYGkM=}x+@~s?PH;*#^SmR} zplxuzacI~>JCa}wxUB>ohexqn7mNY7Brt_zz^$Xe3(Go+9FAbOnZO;66St0&0B1%= zD!FkTNWf7$5^R?_!8)7-eF|qlhlcyK9SJw59Z8rOGjX+}<7T%b2~0tswxbLBv>gpb zZc^BeByb0*Zbt|6UZ8d45~i3AHQ^nkb%x|*(*=ji6I;P!$iISdNIB)5G>Au1hX(Ng zXjc{Fp<^lDyFf!6EeM9Oe|hCl1>?a{9?YSBd2L-&DsS46M~`f5Dz8`^+%E^J=6ZAO zmg0*voaAe&YZ;`f$`&@5K2Y`W`N_hD6wCAtaz#^%sTVDVxNV%T)of+Zr#6m*)ZzmN zriF)@wG;+DX!GRXZ(3@Z=9p>LQV?V|DCCD5&>CnhW`-f8B?3Sd0npe8fL2C8(7Xr@ z+7+SLpa{X1L`cvCq7C3fQXd@>C_he$5@a)9t}K1!bb-|5v0w6p@szq zt+13~q=xgu2kD{^jPXN%M0s=4$UP@U=0|9dwda^ z#r3$NAhl{>;e`bV#~PvWiR&V)R8WXJum+#F18eY!JFo_yxP#l{3xO2ldK|9Dnzb>D z>mnotg}4K2FpE2|2D7*WYcPvDxIKO}n#J`vT#q$tV;0v%ND2yZ2i9N~cVG=>aR=65 z)-QqW@ddCh#`QR}Zpj;q>oK@4LS9gaJFo_`xC3i2i#xCev;K}b>($|tFLUG-TUXT>CjPPHAwf4Wt zG5)q&{O@I~X#ZvA^K`cS^Jj~C1)lv4?f-aFUo%j4-R$e-_=7)L)&76&$UlF!rlb6C zbL2mV{LABiu*LuLj{Kib`Oo#65v+AvpK;`Wmc{?R7XLqXXJ?%fk;eP=6@96l4i%K06#NDe6*5U6g!2Cbb>}&s%`q__v{@iaz z{eP&bZ}UI24ZNH4p#S25fA|x5?Z43cZWVO3xr~b}{PzU85gPZEXX@Mh&ujB5O8*50 zY5zZQTz{_XWdC2}xc*#0{^k5vXz~Aw!m@Bh+q{k6{Ge~iWdf##yzmVf>` zKkZNNk1_Q%Gj6<17XRZc{?BrZ{|%kYe~V-MZ?pIxZ}ESF@ndWM1D*80#^`MA|Ip(9 zAdCMlj^l45`S0lXOLH85-jl|eS>*UX#O&+w55MDVYyT(YKNqcpE8W(w9P@9!#s6Uz z{|`Ejzh0(aVbT8dK78(3GpIM8{LABSg5kRTe{mdt{W|IYQ^)bwV(~x8;=iBc_~XA* z(rwfGyEu-&RTlqKEdJM-b|wrrX^bp;cC!7~8J&&^46V2LpJuqu|3XvQ=0B&C{>x2$ zoBuY8|LGS0BOU#p+e!aJ9sR%E;{R}q{~?a!e<=Cy==jfZ9RFXCe|h{LVe!AKD+8<|C>yG&7jIG@-L77qYT&n z-*NcAirU|i|2G}}t1SNKSp3g+%zw9$|7>WCSae&DaLj+L7XL>ZJG%W>I>tZ$J+t}+Yi~p3xe}m)rAJIwwOB~1l3XA_m7XK$X&VTvjzoYR#&vE`+NB-sb ztG4)`;W+wo@xXzfq$UtoY{7~C^{h;sZd zvG_mA(f|DSqT06JpW*2L0T%yt7XR-j?d`vc9Od}U2-e#F4pUz<5a(O`pK7?y|6qsz zjbxO^4+o%q!F94`pe?odZ?yP7%`yJpBcmOS{|3kSpHKcdet7=UZ1JCRjDP<7_grX< zSSYN3%y*3cRTlrJnOZvkhoss2zr>6ySU7%vFP`gSQ(wmf+BWhp$Nw_Jwf}{V^DqD1 zenTiSny#sA5U^Dlo7KrS>!EV`}7InKXbxA>Jff6)JD8Km1kzR{a@_xKlEAS%q-l0F#azx`#S#@m^Yht*fjiddu%yT7JI`aRjqy3vK{#P1%96$S? z-oxJh)=v7LZ0g(E|DnbI{ zOD+Ddw)p?C3CK47dr_br_5U)Xv*o|V;(xWpf4^>a|0SLDzl*7F^S|EWf33y;^N#k{ zchdhej`nZ2_`lBL|C}!N_OI)t|1(W}Tl>2{XPlXZ`wzz74Q8Lr2A@B>&EbDrC;i{# z@Lz24f0M<3nWO(b!(rk0{k<@L-ap>a|5XgIg9_>E&fZ)?_JoA|5csze~_tf8-HJ0{NHKu{~L$@wodwg)!~2W^TwH3 zc>KWlzsv0F{=dZGANmy*uJ7-K^?84}!~Z;s|9ea&?Z2g$J^wkzE-W4SZ#4C7`Cno2 zf3LBp{lDrs|NKApzCFH*;{1E|Y|hEaJs|-C1acxMAp{5*ASlWKQ6bzyh!vGzlaK@w z2?QZ13P=Pm2&jN)sa1oQwj_m$cd%CRQcDFDuf=L>P+Oy5fp8HNn)i8TpJ#V6Iollj zzQ2FoPxq6v^UQai+dT8k?Cj=T3c|F%*X8=NBZU1YLfAhW6T1I(VcI_h@}c_Q9K!yS zA?$B*iU0O6?ceJX|I|0Z7#uu)n14@0U623O0EC)G{&Rhp%l*&d5cZ!3A-(@6Tnaq@@j+g$oz8N&W6A?*Lg<^CrJ^y1Nx{a?A<|7;3j|25F3=l`U{(DT0}O#9Hnz^_Wu~d{v+T}sP%7GnD!q8`B44O+zZCw;PJ!! z$4i3V|KU-g?H>u#{t%E4Wq*1I`xp}4{vntC2Vh>|!Twt{N1p3nx%7Wk2>Wk=kZym4 zOaBYPw7<-y|2sn1eV%g@t^C*UFVO2`zKuNZw}M`5f}UZx2+N4 z@x%Q4YY6+l1v{bozb{Pt4Zs(w|9K(oe-^_2-(o`B7jRv{gZ;N^PX2KHV~`JJzcPgV z10ba5Uq)bpO|dY5!x8 z57qxuA?$w@!hSJ4KMIw9yTY`8HOPmupZN|LgM;%2^Z#q8>*Ief;GygvA^Y=9sm4CB zJOg)wa47rJ$$p~O;zaugfn<4p{yh@@e~6f7Mw9@K$EQ|dpLJVT!slbr{~yF z`2VPSATJ(VjsoLI>-ML^=W_8Vk!R<`{xfm`0J=}uR{4R&v7Z>R|A&EQdG7z`F5|x= zO#6Rz8UG+&?BG~z74q{3M}gMu8vumre`;4tu!Q8fV0o^eak0OH?6W-f{}>3dJoi7~ zVt;X%_IrSQsQ9OTWO=CCKM}(IjV|l&{xI#=x~#v8$-Wx@??Twe-)#&P|2zs1`wyb> z;P`Pp&Bgu^vcHQMG5)84W_gZ(1dECB%sRKMOR=bN@%X*q`35tvso*<+(o6#s0n!_FF^P|D)Ud57Yju zF7q!3H+yibvkE!?@w>V8{=e*!f2s7n10^KS1tP9&kUSUcKi4O@ z*q@G@Z8%EgS;+B^3Ss{~djA!%*~KQZ{~6@BdVq>H$2ynyU+p0K>h(V+g#GJ4o30ZL z+|b`Lv&!ZAZMDMhEK~fr&L#hz^zAu}Sfy@jq)YsEH(C7ardlPAUwjDvcLApBM2Xve zYRU2M&seqgyuSnCQ0wP(`Y{K74vO~iGtoT$oWE}a27mTGkL@g)X;BU7j94Y|;=$!6 zqO~xIUMnP<_=#26XO`pgG|WGyZ6+XUNnXW})_I2~S(rA=Vlm0@qWvT5;r?@d2*`(u z-zoYL2!0;?;1lk;G)uOHQu-sh9H#Fz`Jc}xcUViDs%RG2dpu-T)w;La9 zN_>Giga}G9DEb3u>m}md*7L;(_}!Oh{3*e_e(?I{{NM=qPL89QhChFt;m>M@_Keon zq9(wBfBi1A_@ic1Oz;~bODs!IrurVJH;S{%?+sP=3u8}|sM`=YyXsAB&xD`-{@V0| zOjM))?DF@)l|sg&fVZEKx!P|StHB4<`9A5CHsQB!t_y5m(H*g%DW0iH3vNhH6i1uQ zs6G9>;$65#6-6Ie_WlGBy=J*#931ZvMOi=>8=iw-L)$lIdgH{S%ifO>(R;E)?3#)2 zy6d*!smVt0^c=4^y3O#fe%pvz{gx5eIO#TV3j2<>qL1IaLB#ndXTWPhP^`~}*SBVL z(;c4$-jixinK>3KbH2`~+O`&WZuwVh zQL!NomYi)Z`de$O+@-!cN{CnBbuo+$6fic{XN^B>6)-?f9hPeO9U$goM+bUPKEg=yXH-RxH)674(u^dL_DK9{BQ7g8QB17@TtwszTAguiG>k`9Fs&rs zZ$xKBi}QL#jf|DFFruI&J1C?hH+AAE~3Vq(@p8TWmC;Xvtsbk?;-Y*vggrlL=t*ogQzBQ9n)@StBYsm9cd zf56AG!M`!LJ{G?P{EJNyN!Nm}A}wR!s*FnLQxy0dh)3U5pCR|M;J34;qTgd6k5&m& z&B=R<1LEk{W@gqG0`tcM`6CYYgItQ1v~loHluM9jdtxEKFvli!4(8o$1V>nT6czop z;g5zq%DStw$m2XJt`kRRf=;k(F7PGJnUft?y* ztZ9aRMG5bkMq#e`4fJhm#IgJV}+>CELVJ0*_dN<7T`A|Yv*(B>7oH>5 zw;7My#ToSTWzcoPjB5;@Y%TgD_}seEeD~}Uf5VxYsD|%nM>m`*j)C!rg)xe2IBR;= z;~e+Hns&?-(1*yzlcui`>))B)##3fQ<7pU&Ei2Pc!4={3_ofH@Ga6xe*_fUtuDdom zc)G+BJni?_6-Fi26=oW%9{8rW0mCjfo-svM(@KF?w~eL1gY@TSdKT8Hya|40(89X`-qpr~9+AuXaQ)b_viMX#@DpF74FADL5=Bvy*(2-t zlu6LPiO|mp(BFLM_xOghOU5-o9OO0Wf%M>pjEK6zCNssh+v@3Z@K2^FI`D;9kG9#z zx-+fP7p@DaH^+=_Kpw;JtYIAH5c%xr#J<41uyN*XI_>C$Jy*(%0F{HL16_4%Z}HKfZ-r z?FTxGFA>*03UlEQ)W3}kp8f`O@O;lVV%Mzk#ID&2!6T$d$&fi{^~x{Lh#SYsTai-djfEn(?xy`$5sXP5lG z;Y5r$jcd|bQ>;G@`I`|DJbl9SWMR%@97UuUy2=yWSp~1gUg^_dy-9*SLQ+2?D;ln0 z@QR87Y%2UF=+3pi;OR=p`^H|u4PTqld#d4@um zVegoN*Md1f7aK7LXTmzx5B5=CoBbLmfWFwOIj6w>`n4b*Th;#*^Yw;!;~IP-CV2Yn zlGnE28hqD@n_;c@PaX}gd9dClSZi+MtFTA;680!>!~P?&6OUc{J<8{>M>z~UxOUY; zzXasz9*DOd>vUlpgnd1%w^q!pHO7;LF%Njf&{F726O2FBH%Ew}TWAbcD`U`~#-P&h z+hc%y{cv1hjQr3J*KFAa-{rBh5_D#I#4|WX4e-L4aeM|qjOu%d1sJEhjJqC)gE%3! z)mZyLwi2_I(61&~tMs@fK;C4+s}TRPpge3Ot$x>to{%FF8wY#*(KRBWG4Wr^-#-j{-NBy3=zJqFYrc^X-Om%1g?x#g zr09Nt`Z52$tYUZE{NX*Go18VV^djTCD%48Qb{CopMec z&4B$r?)x9PbJVtNFn>nF+#F@Z9)$aoqEX&uEln_|2OeFv;U2?S1M=~24S@X+yw)1= zdk)Z=3_9Wuz*>BZl#M@l3)qbYn^oY;T}D)66s#-Ruy?x)_Ls1R!F@_}H0~>r|78!{ zuL=K}>mOOs9j;${a6kJs`23CO*)t(RybF7QlmV4<^6Cw76lB*QdhD+5qhNoRUD-bm zeakkw?1_QB*Ilsg{1f(!39xn@0Xs*%!4WUR*t`ugiBGNX{+U-i3Eyiq!T_6xU|lGO zpZRTqeFV;P^r3nAs!q+1t?G_3zutpuv$aS3I(=2Az>}-G^E%Z^2gtQK;9r6AFhl`_ zTOM@x437wo83pwO+C|5Trs6#l9;%|L|AC@H{y}n8QDKLQAoTL!u6aaGhcevv0LdC+ zI#G6^cU}4r0{5y8ac^yt*_G=swIO(g2eqF(sk4wED?0+ROKs0nUVT75rZ?v@(Fu94K@S?$r zrW1kPVwyFAKTNXnFa|7zG>)Y*3gVpDYIMHRxYod{2@jqJ4|3EN|Nam8Q5-Po7 zi3r0Ii*fJ3#l2yxYh34 z;&A$wLhQV(_+Yl>1p3-bRDk}Yz&Nqng}zL219x3r?pPOM%*Um!Czcx6KSNCGLr@Ww z05Q3dyfj29E96pFyp$SP#3!zo9cF$mbvX_YXDN1~Nz)Zh$5=lH2xb?P$EnQ_W&DlF z0&a8g0LUVov+f|ba7+v_mC3!-W{3(_oNY&}Vl$EaExo|SB){Pb=X>}YW$q8$?J>z| zZHQ~xPcGg1!7C&TGm{Voc^IOK`{4wriWPF{rZ`9paI?eY85^o>ueg#L?ZQnlueXM{ zf=MUxvstkd`Pm%#XY78>wv7IPs9{be1=5BnAv^WiFBCm$4O*ASqb+t)I@Uljf!~un3XvoC2-9xU=seJ zEe}|Rx!=_eMErK4hl(3gh=7%uNk?&cd&N9sSYC9jxR4d6*|sWdaUygrO@x0*Wf;#3 z0>s*fN)!GSUC$LKG6mFZ7rJR)Ve*J0j13Zt@CqA-x4EQ!hHd3)+an@$$Jn8zCJx}Yq_SqmTRcdF7zIkP>bWs^!8fV;SRO1FF5aX zHQ~%f_U1vdWQZBM8h~s!h|v4AkMIb4u68)^tg;Ugum~{eT+74Wi>29GrZVYh>2P3q zE@#?W3Ym1Yl(WZN>Osh+22N?{(MW_%YGVBlL~3m-9nKzR{Sn<~k;UO#xs_NqQHk@B>Akj^4g8sKKD*FoU>dcsC_XtH+`XQCXH5j#YKYLa^&#Bx^y*avt);hAvzr6 zY?7YgXxU1nqqu-c?w=t-*eWJDyU_c^wj3>2{|6p(J}tIAF10NZp&MqAYFnhFBN2`V z&pzmJMJr3%{K5TQH8YoMRT3iBkD=xTeabhzo%)xh)A_F6g|%Jy2O zw%5|(9_Igz7B&oT-jat8hZ#bjrv-=cjsnecV@VzZ-I2^h%~lv!-GX)^rMeX($v8JY z*=xopcI^?LWLyDnck)CSK%l0P`k@@$kuL-+8i# z94ZTc7bwhlODbw0=vAJLbRbX2j zv?;9dG19vPMfG6dg3oq&x+0M@&~Quzz|BrxMOiYiDTY#d8iSM3#py9u#as!@ov|I& zbU~{~bXE0@>V_Iq6)7)DbyJ*?#=YFn?sh-D*q0u5Ut~3{rx=`kMOQE`)%5g=v;?%- z3k^7UIz|WaKrZkLkwGqj70aP>sEbl*Zwj8Q^uf=$og2bE9E9`iU`XD+Ua37ZMh=<~ z{m`t{9rPVOa$r@GKxO|sR~W#JWHyj8itwX$s{!?-t{;;s#6ZW%@yR2>QTQB)SEfi# zGAJ4e^}%XrEtVk;WC7>H8{^|S3v=T@a(psoMjnKHD1IJrm}&<{XE^%_Uwo~$S)m%? zK*)RnjsPWq9D@tb1DzucNPQtL$^d_d1J}iv^f56P11WZ<@Q1wo(0Re%jfJFkcxnKM zFfKMFF3*NMd*s=a=LmVmUmk>+B+rrZ?3d>#>+@uh5#A-(UI(Yh+u#%dFX1<2;f?S= zj8!;17f2-1A7#}c0zeq(hcE}@P8;5aXC3C?tDz%Kbx7Ol`S$`_jAwl;a+`T|aJI-{ z*W2W9B;j*A)?p4sk$9{)*eG;Xs|x-)5ty{lYSerS%M(%p-$2aYHOh^Mn?FI-j<2#B zlCkn4@X}$FRrxU^Vcw29j80OYq%HCegsrZvJ_!SAk#{-dIwXY;+3cuVeoIyNwRKHa zli?#iaG3XFTgp>1O%Sj?ac6Fd?`#yj1ZZbtDtzDFanziyJc+tk@l#lF z!ul+_=u}^BTYcjIrY%ktd8EPFsL6u5jQKDizz_WBc^7P-$i$UE2>FpN^RgP0vEn6Z zM;qi2Xd4Zxq_)X$25nc%qHq=zQt1L9QgN91@B?9bjm{7VIp~hU*P+Fz`3JZRZHHws z^#@rLM#9*1Hl`&*A+`2rA{_@U33Z!~W5SWElD545CBhc@DJKNt$Gi;K2f%(ZIbg9luk3^Q@Mgn7;m${i0>&L2bP}Qo`5rS?FA@g zFaCgny;#DW3Y^^~=lRG9ffJ$)uN2zXR;Un!a;4Bk9SJ#o+yR=YkJF85Fpy3kr^`M$ zeY{%h<4hyg@wnKC?KxT+zgq7bx*4jIB_L8NMQ*Z0rehb=BNx}p_ljUhLUpqg#B!wA zhz`4n*((p+E*mvJcxBWh;Nx15pZG&TosGgYSxn26MNuvkfgqfu>4`wd#Z1<&f*M?R z@nrtoFwP-jHozABfKhGJzc6rmTKIzs{g9-4OWDl^PEw10#JCP*`&gC7B@=9}FzdY7 z;6v(Ml)_`9><&`q7UMjlfGG6jJX&@dq%Y?gg|e+tDm>4aCTqW;T9K@6rP>v;woTTY zQGY_#Q!#XWWP^3{X(I{}7(?0D3gi`5AWN-47Pb#0-wFzpR|4uJBmU>sm@D1bVXTGH zNyZ(<&25r%r|h27{(^MVssB!Ee^G1yy;grotG{euF#CD#!E2{5|7?_id8h_tb-%F? zs!ovJF;=#ze_-6(rvAQGe@_m)BmWoKTc`e^*8Z{dE=$^uvschIgK`SpJcWZ&F7w;G zC$HWbm}{+pnQaYB<-Zvi)S(Pa|EugP5A5}BQYzW_CCz*cFbXg(*-as^AKGArp4DQ2 zG1YS$oC`cFVb`d)-yz%YwA;JlRf`U`(?`QrN*NfaY`jO|BeaFkRxPh?wXL?bFxBI< z;FnwQ!4`_!U{j%Ap*@`n$;2&f`;A@=Fba*quwh2+Mud?C#h^JDJ@0%t`xe0|2it%L z7*6AIV6_jC!2N?ZN#=*(d_E$nMsY5dZvtS<6q5c7=?cF?S0)PYI{^AVfRi6>;9*=n z)UxttoP$!aG&KmTOUE>{?FN|AiJ0~4}aK`is%I_4K) zjJ-F(*@rzGhK`usqy(+Q-Q?BDT5r3{28-??X=_>SW8f~xq66}(XVDo7-PgJr`fw|d zA%7S9 z!*+WEf^R~g_3&KJS`cv7w{tz4V1;q&=XtiYsrQ9Rrmj%^J*e4PVfsmZPCd(mm#Zvz z3G+f{g;}oTw%o(ydSW{p6>9;Oo03gTJPw3hI<_QqlWsAg!4Y zu}fw=GDN&;%>?Xh#B0_}z=4c-J<$n!6EsrTFV(_+sTTIjwEE>T?ADM^&_X_53%Op; zmqXwT$wVnX9Gnqmg(tP$P+W~eQQl@K`i3 zXP)ON=$$nf3*>#c6WosK^R>aS_*H7(gUj8rL1;$OB$?t>)>RsVUNRNLX&B`HhOyfNe^BioHgw! zIR;MsX|4Skt^HZg^Dy4d82>>V^FL~1`i8bfzOJ=DuT9t;TDxA~E$yY^eJ~&L7WW%Z zx6YBvt$zjJy>U;0x5hmUyfY5qU9o5*gHLbFgP!i4BkA7)ittfxy~>n^?!U6s7Hw`qJ2kN57P7i%(2GqtmE%^F~ayQ=$9 z<^twKD>$dku4as5CEe`O8SZQF*|}m2bl9duuScbAknCq#SB&2PAhGA+-1jv&$yxOd z6Q3~g6%g@gShgRBn&avnM)$s!qgP2s9X|N37)u}y2*=fX3~<$Y%r9Myth0twKI4eI z#j2p&>5~j7%zlBg>e6|$1J_q9SXfmvFEDt>z?^}D1DVy;*Uud= ze?iT)6=k)7+}y!K^2%ln&&jD6GJJSWUfJNm!)6VeRR+Y&+_KWrp{2ueN-Ktx^%Iv~ zFzAMw1#<>fmM)lEGw;Tlg~jEiwWWi;+Pd}29e4iY{+)k+;oiUhe#1W=d2G;-oFVWx zIA_q@nHA-=)e8qzSIt~dy5PncWi|5_)|SqzEv~JaTQRTSTt{8)$Dl{<$~KNz}G8k$k4%UtQL+hxOCFk!NYPKx62>~0)4Np zfgx+tn}t<3RTS3>?sHjfu|(#UE}TDiOYr*A>O~c8 zn$Vci<9_3O#|OZw=FO^6x<*{sJyo)5UKMoT;>NP9 zcCo0OTUsUwb_(&Dd9@Xb!HO!pu%dR+d=*$UAM&=1{#gqu+Sb9~!b(*JvUWl3LKTtr z7gT_D6)l6&b5y}dflKAZ3oEK&s==tuhVTGTRSVNmRLvR;FGv9--~`kHTNkj;onKWf zhfnG#T`0xp0q4BhVYzA_iO-fr!PyI7Bo_*$)JP!SCkc7 z^Mw`_osZI=x~M3?w6GPT#|ukmRajX-Bgo8c8yDVC>O=sWs;vYlYZIvj3ri~&7SEqk zws3Iq^@E2NFPb;Mw7k4(-fU4`HER}pig~6OEyl=7@!W+oB{3Mzvtj-~e`rXG=T^nD(r;i6=+#3J+47)W@)*YUtJ254p$brGC|CXr92X4HH#pn9S#(hT%@eF2Bt>o z0?179zj9TkorJuh1=_f&P#8;l89idtnP~SlPaq+MA$RZ$}?DQ9Jjk4`5pf!v}Sa3^*yZ0tQDtJnM}R z_yypGVf+vuhXslu@PDxptD09Xbb0G03c`plbFcsrRPtq z6MT~(Bq6%8(u3N~H*Yp%kJEhS4g*88A_VVt;PpnENrumSX<5GcswW@H6;%31ssI>2 z=IsZDlYQg8X%oDI(eHe35~?2WHNg9EV9!4i_$ElcZpgP1_*Qt&UExhy0j=Yu8?o)8 z|0cMR8EyXU=6rAVt==BveCD5#^qIdgKw;)MZ}vpx{G#__cne3q_p-~q7lRYseCDUX zJ=y#vVBO45Zq5gAvd{b#R4*QHAs~U(nDO3=C&GEcgz*!+-U%TBvfuJ#-_0w~W{+{+ zOmKgK&)f;pndTpF26x){GSO##2*$yOt;Pzl3#?B|H{Jqtg83YYL1!jVyg2 z7;~?bk?hFQ4Mq#up9T7Y@zj2StVWIZUNF%cWx1RLLk=n4KBFEoaU4@25=-;V$ITWf z{k1^k1F-^27?t12QR(hFdMJ#%E4=3@qj-)!iU>e50dor}_Aio}C8wGf7H7Vv{djMa z?*86u+~G6dT-pNq%qPLeu|7|BCzzi;b770xl^4(}_AYdfFwc~HL}_#n`m)0A`oHOl z)$h(ewJWMh?n+|2)O{Jc5{xzzJmX*vJ-Kv+_dN3*=t?@w&H)p=d5|B!S&CKjJ#&T6 z{4LPEAZ38Vd#4$-!oS$R$n4{<^_eY8p!uE%f2|kZ&3bf+rwK_>*A$}bp*P&?tNT2!kk`?At5&8MvTp!FC z994+JGMFTnP4IRv@D2c^PrkPc1UTAU?aBA{o9G?n%QxS|nD}7Df=D=PnSX2eYgm$b z66RkI89{UR5?Hff-bbwPrr+XCn&9nm3#iZc-EQ7~bIX6c(ESnm85RA#&)g2`!P}2u z2+c<5FcA5^31E5%^ec9}_gr(2OP9ApmxoU94lws316&0$D0mUEBJw0Or^;o*d=w&* z;4_;dUhw9u^kz@+rd{UEo&>$Z)nEcFuX6QH^<9P?gEzuI3O+#+e-)AMX`ko+1kYom z%_zg00?cr&?e4pCg7+L);tRb=E4|SGdVPg3Qa9zB>%1+nZbEu{hr;SPDBqjtGv9~I zPnZH+o$>lz;O&f_#}|0h%*S9dM45ku_AUyYFbQ~JVZ`@^Y_L;v1)gOCTc+-5hdb`$nhfS0YU7qjly23jQLW}NMwJ6`^ zFi6oWyirrUahJl`XKn)FW)L0#!fED%vfp3AN+oF!?CLZBZmzi8n>5)Qb(uHToUy{2 zJP}%V0cVo=6J&rW_{=N}+d(sblDCJ9LVxo~@VlG&4(LZJ&AbC7yygZ-;Ux2Qxn#T; z0pgNA*ZdvOJ`ASfG3aVYr+n_1U`~m1FNvB}A%m#A> zM&cRm@O+8)ZikPMc%OE7ro_){hj*2@{RUFI{jl^OZl<*3 zPRTDD+q5i}xIDGNS4v2Ea}l*JkT|{PLy;(zxO^9eg2L^S#O2#C+Tf!kp4bq+wZNg+pN!k*zc6E@!68!YuB0hiNx{Ucx{hMB@RE}rX9Hw$2T*y zJ$g&r{@{Y$*h%8_|7shBkF7`?-#FC%F!_6%v?kN~&$x!dI|4-eej$@7+V{)C+xN@D z+xN@D+xN@D+xN@D-TKu&KP~?D`DWqm^UcEB=bMGM&o>KipKli4KHn_7eZEj}1+*4r!{MxspX-A5tt_Uph8u>9fk4gFXPOF$_6Al#65az1Wi zKleEa3OYF-qOqU(>;yfXgc46$TFSw0Cnaz5$bq2}cgBmK3C)-Ko$-{?`FN^GE?YEp_4F>%!m7h5t^_7fSy$7km=L zClvqhT=?<_+Tn~6}k+?G-n*hTD;E?*uTyT`Z zBN+tMt16FFFAe9FkomdJD;V=L9+cW0{oMD7gfltUSbhC>{N5ib^fh|bgSBEowBo=-FuwF*97!Rr*9V}j5+1)oGT7F!g2 zih}QQ!S^ZnIEDWMqV;}#O1R!HUZ1dE@?${6mkV_~5Wn0a<$0`vPgd|53aw>RR za8*A)r$)OI6#csu{>v16zk;iJ4#B#C2kKG%;qQAye5l1D&jF$lFHmsK7aiyIUdQ>1 zXb|U|L3Mu8iQDy_ivFoC_yaEZ7cMxi^LXg`^Ih;|3a(zA-%xOMx1T`qMEwD2$vRC} z@C*fiM8VHd@NZo3p0KXsf%;Yc0vCLxg7>yW<$13Q-s*x+rv(V@^4v#7kGSCb75rSq zZh*F=s7J+TDR^In{|Og7iZ1P_N97;uf-iHyx4Yn9x!{3F%Q@ZdG#7leg7X|f4ez_) z184%EewDx61^-lE8j?M&0p33Q7-r$F8Jpz_;$KA z(*69x1@A%|51k+1!;OcIuTb!8i$$LCP33qXzl!J57GKA2a>3#ER72`H;euz4IV@Bx;nJiq0FC)3s${Z#p{a>46e z@b_GBul($QHSVhZJQsY93;wVR{;mriL0f;lU&CGSYhCasUGOgze4rBN<+Q;@yDI*P z3*L_&4e0#$x!?xfn(F+QyWlsu;M-jACKvoX`cRN=w_3pmDRFq#1^<@|K9+7UP`|3@ z1{b{11wZ0~-%XoEU4OF+zKk|=I)5kH%<1?wF8JLp_`h86;Q=d%y8dfj@Vzd0azj`CF&mnbddIuY|FL_?Rbo^3R@3NO2h9Xe7=Ssqx$U{-bnm+Y4{GpH);6Wgx72Mi-iA* zaLga|KJFQf|1r8xcv-=7h{obI1;?@bj>hqA1xNnzRDVywk^eOD|5d?}e*@JIC^+)} zh3Fk$)WVZ&h&g(@z(!9fV_idIQeK9)%zEEFnFgX!z@df2rZ$ z5&lmFN4u?H2aoSHoacp)VD2*S5(_(g>OPQ%9#{)UE+CH!3tpG5dy3CFngRr+;M zX||O*DE;k z?;`#+3Xc4HiGQPp-%I#I8lFeb@3s(*@$UzE`1nHOuOa?J3Xc99A%Bi4IQsK4@t;v} zjPsQ=AH5WB9^V?mlQg`R@SYmJnDBlYzLfBx8qU|7(Hg#j_$O&NUze}eaNeigKsd%t zea?BC#{U!Q|2-Pc{e4Koxxc^B@Y^UacWQVl)&HpBy{Z18hI8BwC^(K+Bt38ayMp6* z4W#-BD!IRv(1u4g%_kg3)Kfxwh7zvxkJ0$$cXEN;WQAXSE;>WuM}KN4o|OuYcKNH- zsudjhr<31{6&(3T#J~xTr3#MxGl+kcf+PR$h<~kuBYy?)Z&GmNH|RO?g9?uP3y6P< zf+PRc#J^R+k)QKyhk_&j)5QOxf+PPOq<^=9BY%1voZ#52;K;v``1dO~@-HU-PZb>b zA0hsO8lFe^_ZnVAxR2H$&XadZf3$+5e!lK>QE>Dpf}VGGS8(Kih4i1N;K)Cm__Guo z`QIS^VG54?%ZdL21xNlp#DAHBBmZBBKVQL-|9qOKKT&Yx-$KvduU2s6|A_R@QgGz| zg!r#jaOCH8;Cc;jB0b9p$9aeIXfM3*SgqlFfAR-K5891SlzB}8;yUu zrAB_pj_}`VcnRUJ zYWQNpKiBZJgrCvy2MJHq{?E0SaQGH+d2oC_C48)gAEE2l)r9l)l<%Xi*YJmle~E@~ zCw#4jzfSnW8qV(<_?3o#K>SZ>_@{)wq~Tu>{;`I$p9eJDp#Aq54evyFDy`EThdzX# ztKqqXkJRwX2%oIs(+Mxp@OgySY4~!&@6zyJ5dL!w=lh~xYIpqV;X5g5x^eOzZ6`1xNn(iGQtvBmXzV zze&N7Kb!uq`JjR${~_YvqTtBCfcUp6IPxDO{v8UA{J$jr7Zn`&`8u^*!I6Jr3Y_5B ztKi7b@!zlEeBJqsaE@~XtyhOM9BtqcLDzrY4}430#%Xw19>`x@4BJK>oc z|4za$RPZ67Iza2sSOrHPeH4dD8ooH$^5-WSK7{aM4L?M7=W6&%#J_}aj$0o~y|_!^ z$M~P5eBPqr{Cr`%hV%1?7d4#c?`{o`qJ7JUgrh$L$QLZW(D)yu`EppnF>cE#ZpRcH z{pb18s^G}~2jVwrKgH_?&zA%RNB$W4KXkH!qyDp$|LGde^P<0kqn@dxXOM!U9-bE$ zDme20jQII|8tf;>d4k42lm34^MZr-&&!cM;9Q8L4f3boizlZkIb2Oai-3^5Ec#Q)Y zJnm8WQU9Cd|3eynmhfL`cn1J8D#T|R|DTAzS;Oxq{G^7TA-q+? z2T^?DXkW~Bv&n9E4IfE(f5LgZtk227{egz_bMi47&d;SMX}I;d6u7_CaL%7{!qLxx z!HH2&vl9^I_qI9{Jpe^)3t<^#{8yA>SyZ=m-dY*29I=XtbQ!`aWR8t$Wf+o9m7 z|9#T`qJpFT6yo2l;K-jr?{CUq==Y-Zc?~;b8oiga&tKj&jGv_ zy-#9{f}{V#X&s)T;k;kEM#FjEI9tPc-?&i2d4E->;nwHSgjlQLJTHEx;XE%M)A0Wx z|F>%RjfC&e@a2TVw@b@|=PBRk?$dD2hfg(pE$M02aK7H1(C~G{@1cDM+r6LgcnyD; z@N)>qc|FK-S)Ow={(A={|mM%IP%|4Z!Xxb;K)CP^uMU!$lpZ#yA&Mxe@gs&6&(2&(LclYDLC@a zCjL(q9QmW^pW#gkj{Lmd9#U}RpGN#g6dd`lBmHL-9QkkOf40-UlJl15MXZ7&|I7fK z;7C+()PF1K=lwP3^D~kg-jh%KjPD|Rm4?4g_(O{RA%O97iC-x=`g4-}|AVII5b61g z!jF0awC_Ev;HYO%z!ET$trFva{3XPnpyBHX?@u`QD;wnS2x|Phh<~nzA0hmD1xJ5= zmLb)MK3Q*iX>ucYS%1()$8{(Tx= zNBD;dj(SST?%yb zBuM-G#Tw4fqwdo1Cy4)14d?qN%Zl~?R$LnBcD3E-P-y#O|34P{h5WQ!*`F6=Jd+e- z4Dmp`FO(E!>)Y)WJQ11T2+Fg=Ka%RauV+0I2`|w2OQ=3w!^^48?W|`$;guSHE!FEZ zocG(SG(4B;>olDG*reezsJ>mpSHMyevZR*4d*zNXgK$)Qp1C!f4+tn5YErb*`Ff9*J=E$XOo7rp3NH0dbVizbke^| z!|nXh@M_}Ur{Q&k@7M5K2|uFX{RqS2l!jMwo5vzB4#>}T{Tj}B5KwTOizSx0$kg!H z3D41Re&1o9hV$oY`92B#!TVN@+jNB=@e;~K_Ght%vp>A=W4mc&mw!l-ah_kBH9dWZe~X4^6242rj}yLI z!+HMi)9^FIzhA=zjrS1^k0AV%hWiQU4F>lsm2iKAl>m%a6CTj;T*B4&p<({y5uT&* zk0d-#!}MUNKkMJD z;U#2ui-wmIzDvV7{<}3iK>YhOybs~~H9V8>CJoOfyjjC@2tT6XJieziob!SA;~bw` zNe{oTlkruAtDon^aoj{Wzb}sYA0(VVhk-cVip#_tNBe!o^CSxQ6AG@rFMYa(^S-4- z!TDAhRq^}lP(R|#KVRVwAR`@%HJthD6g-2OpQLOUM#1D|*xe}9XVXMW$DjnjG>Q24VI{!9(${ZfvC4^a5| z{ZObM@g{2H`&Y!({|k&$^dP>M_zM&q=NBLRzBbf@_~SIcI4|(?DC+#mAwk5|c{EnR z)%h}A!2?8NQB5@J$x!e*1y}QYqk^}|X9ZXD_C*ChmuM{ZDY%-4Un;noZ>JPo%`4s) zp#N(AWJ4Vf#ML~Rq2OvhELCuI+#ghMb$qugxH^ub3CD3%$LkgaSI6s@3a*Zq^#kcv zo(E)4tP?-KNBtQJj^9Uw2jc2@1r=N!ulWkDju)@%s7D>I-ZY;OSI3LrpMtnLUgZ&v zKk9h#`|*)q9k0JB>w`L8eIgw_>UhQa9b6r+HxyhQuZN=?es#Qr^-BWISK#w+Hw-MV zn7L?nap}yN3o5P`1M%DE#lW(fxpVOs6l8TE|B?Xy5Ce$GpKO4ib6{BhULg6$<^k1Ry~_k1=pTMRh4TE`LvCp`hBr+6BUD#g3?+>p#ZO z)}sC^4((d$hZwBiAyIm6{pv?Z_PO&zxf0^%7}W0I50!)nA%|W4iH;EcY^$7pv7i{k z2ET1kRyn75R%umrd-ZZe<*!||?+9BC-E99Ph8Q@nrnX|><&&=%Ag!s{G0XaylMwzw z*xi3>qMa}LZ-qcY;BURiUqJ}1oCe+bnGI#++W$ODs2`58erQD4I`nXU#9sycv@aHlHmMyH!6MYsB94yZkIUE5vl@A;;Ot#50oB$Xq0eOZK0J##7 zXE*_Hz69hMP5=y%fIPzqfWZ>5&JxIxfIRax-CC*sv-8KWPSaA|MnT=PR`qULm$?y^ z;Wh`Z?TFDf#cm7QR9iw*Cw>aT|4u%yt+>$TW8u0KN`5iP@jjf@=<=7j$gc`hzORe? zrZDAy3c(NM|CTW2lU(ArgXB}G~sF3eSAxqZoeKdP|K_v5&?9?PtJCx8DR9 z>f}5HQXU^ovC8}CevV+;-J$T(<;&pr_Xd^?tQi!rjvOknuxRT%EH_uS3>!X# zI7*_IUpnzJkKy#l5YOBBVOh7%0f$8dB@~494#5A-A9zz8AUXhLsNWbEF54lH`XO(J zl&1*Vt)Ue=xMOK|=c3OhU2%AI+}nrnN;Hx9NKK6rX4!&ud}&Jvje#Z%Rec@7sgLq{ zZ-Ri~(b3#a1RmWdl)E2KAr74vpZkQ$?M);*j!KlnIJL{|+6Bes3ueyd{O%~XhYlG& z#Nr7*w~xF;PCyZqWDvd+9X$F{)c8eRClOJ1kv~!F^nZS9Vfq$vTGT~t6Lo%gMZ(Jm zFE6|z;AO(g121En@Yh`=1jq%%&Ru5lM-YT(&MtYW;aH3~ebyA~kC~!TY!>Um+(x5+ zU15`%+=w*Vhyt6H=ZKwEoy5*#F~QSkm%O?Kbr>m@F8EyZX{<**9z0zo#4{znx=vUh zC45JrUerYOX0Xv@re_&RBuBoqt~A~~yCkCF_!Mu$S<_e#F<<95f~WDdWo7!QR}JwD z+!Hi5^|t&2U$ZvD(sKanO=gPp6ESQze07EBH;i%0F|ZW{y0)w=KGhF&;cJxPKllpz zWF}`FpK@u#*(GBe!2Ws}6OaR0=P*2Ggx448kBW|ojf+o6OzM=J(z#35)Nb8-r1k8T zes;-=4QGmthLcx%z;_dT7wcPJi+z{O!19qp5PntO|fqT@}qAU6JhMSC<9*pM34bL4!jnz-V>-R z+!Ri{;wZ|04t)=# z1?GJLWrjdM>Mr{3{8bO2p1Oav=JtnvHz!;+q6uVJm)|Rrny#$7s5!wm;y=|3`|mb- zQIFJnjivWlujA{Mf8*;3#aHY%_6dD&f_@vhR!%it;Fp&RTo0@<-h9f1$LH|WeP{8MMAu!kv$eG=%C?#w zId8w~FHWDl(g$-Ovd#QG0eQ{2j`JV|))$=5%?9*krGOl+yC~f&o@|1-5w$G1;o57f z@}RHp!uv#%uD!NjURLYn!<~G>oK9|p@9>d*htJMs)%nEGFUE-VsIMbER!&+v(03^x zA%-@CKJ%9UTt|sV$oL+J32uXZlbl1iCiRB7u-Uikq60CzE(%)nV%z5ET^HdTX^OGp ziawOUI@Sa{I37(P&+AvHyn$^I-%w7`@VxUk^S++22Z1(&5@$W55D>h&z_T}*_dva2QNX)=&~o> zNICcg%pbXanlX?=(eR3bmmgk{@bbaS3$F-xneg(!%Yc{IhJE$d6*XX9;#dh|)JG8i z+#A4$bHLvl;)AEVKujuE6g7Me?HNYbHJ`(JihND~Y90EWr^}kocrAi!9OjLH_5(22 zKBsHYcb=3rIEJYEbF-_QgOIOTaOob37_SM4;kakQe656QsvLLdFT`wPs5o2W-WA4u z2E_3ii09R?R$SEp@pZ=C#JOlTobD}7pDOkOAI-jrDu&UkV9`A)%|*cZ7TVQhe}1p1d5Db|mA zSseAB9sPdu%2f}vdc<{KJi6)uxR%lN$jT|V{&7y9D!vr@fO&mM+q}L6`{!*qRqTVl zMM5t5A(x!JLa|6}bFF<2#=N9$$}4hl%nm?&K8H9_Udy#30N2G@Q#^CSqhft3to`AvLC#v%Rjy?iJJ=u( zt%vK<{X;fAVC4wrlNHyEo-PNUg`CSc+gfzs5+{G;x&iA>C5#2Emr0mI@EkDZ)*o7* zk=G3J7xg2r%s*Wo@^2rkqg7&THFz%U=b)AlztGZ*m0d1(0=OFG6bD=#{9}mFzAilNviYmBTtcN5%0;Mg4i8EZXAZZkfp&l;ZyWqd4I9-k9( ze88qXJ}HgwLS7Da85?UY?3~qliQm~f$$JuO?}U9jyX1Eb@Ld+L4tgL*O;{@;+U?C@ zY_jD26pRn9d3c{=T`TaKf!7YahTydXuPJzK!D|d&Yv7twR(DbB9&x(4OzhkY*AK9{ z4qkF!f;zu}dzhj}#QH9P`(ck51@j5_1h{Yi%mZ?R#Obf6iJj={cY}hbVGp|w_vO!e zV68S_jeab(;RaZ9yTY3L9q^u-25at0pS`z0xu#yQck#jf#!Jqcn{JBhaE#2yRy|;i zld;}Id(@Ji*7XLih4T93@nddT^R)R&%a>pp%%u?RXs@J)7`prPZSQ^EKiIHl^QQNz zr>%MK+Y3iGRDSYYOU(2wE!i+$q?`0bPH^&<>Z+}|k@)7}OD<`cW5m5VpmpPWcTI0>xoiF(TLwfmw|ooO zlzF$kmvH~KmU|X{(o(ayxh27q@TT90YP{2kZ_GDh8h>LXG-4g>%d$B|Jd0x@V+no6 zdtRiwLLT5f_IEJ0%`isC^znuG0-rtB>iA+#;P~Rc1Ld1mLawZYoLLFEvl4P>CFIgd z$f=c(TPq>QdgGqYvyJls^8xT|A5pBt^|Dr#E2UVvhaT`%v5))kRzSpl|C@2lfHyK3;cZ zJ}FoU?Rzk`$ZycTXOZ7M_v+wU>z0?B;T~X1?rNEr2Rq;P-rnzjA@kCo^GwU0e?8Zd zUG!Xw|GhuA{AS2sTec?rrKR$v6D|F3{#VQ1%EK-9JaYGY+b7@OE-xoN`0#sA{Pg9P zb?-deGT@c1Ej91G)-pf%LCd6NZ?qiV@OjI=4d1lf75k5Nc^Q}azmX=Ixem z3%-(hnK0^>_wG6TSj(WEe`}c{j&+!qm9VDXtL0n(t^=X2QyHcxvhE?r!a8>eT#Mm8 zQm%!6koS?H@|&OM;M#?2(EFOLAlysg_~CP!FX%q+?2_L%oPhQ8_!N&^M^hlL?(bgQjafA5rk} z>T93=!=TSHw?WZ>*JnxcgovpOwLQa{=t^#K1hBp`-WX# z{Ui4BvG=`n_5Az3z9m?A{`zS*FZ!t4L%p`ez47b6Ri`(7lY0J^n|*<=-yZbIb00rH z;>Bgx;5T~y;_9nT-5j@f=8}q}D-sVre9_}Sq+Of3tM-$>e&y+1ma%Wd>0iHI zc%e?PeA(nZHU`qk<=znoh4$hwz~ZF?f~ zTjT)4x9A+0;r0h+{?p{;RUh;ify5xIj0Pi3C}S zxR&NHG8t&Y$hAHWBa=BcG@U5BaPuqE7AatoWeriz95q~IogTPolhZylyc67^g;MIfXre*h|nY(kLhh+O4B9}vl&0T+`T z9?*3wdAimfigG3&CrG-%m0b=Wle<+uu6*h6F?mSk(Bo7_h3=T3tOmaM7HZaMdGsVipdafLyka+>@omkIR4j=FaI!v`46qy&PgjgrkbLCS9 zOt0q(2M{;|^=F8KLny_$!f6R$Vto;XfWs&`xx(2hIkyle2TgKvg(E0A$+%tUIl*(1 zN5l~HA8}hk=pvjc6Uhm%BkH-rdZcl#>~}Z=_IzLLqR{i9${&SD?Gx| z5LcXWg}`$~nIkzJ4mJ;6kX$yzY)*7eWq_FEjzQF>Q+JlyleEJ?Mv#pZDm`M|Xr_7H z0xUR#+N%{lrt2ImxSi--4mO(U4;(D$46Q}!1I%&fz=e?$tdg(2uz)hTlq|zkT}R|b z2Vy}kbzd0oLj+vQnB=a5d+il>82mg^SVyHyF0MGLXSG*7izMtq_nFsOULy=KZ7(z1 zJ)g!1m%5g*)W8e0bdW3is8MD=R|-fufE}-DtbV$!X|Z8n3^uDEtN&63iM9*fdv4&} z5+nqZZ1G3zWJZ!Y7=0#L%a7Zju(TlxnN$^pzwcmaYpcgK-t<6kIRISh0m`NZ76p%( zl}lZO@r^`)6()1-yb61F_@J$2DwB?u4yOsSi{6MN6~C{gG=2VRIwXi7k)8-{Y7vXju2^fDSYwao2 zVW(IN#}JlCCO1Ca_%~-(XNE@0?lwIiNSfqqFAO|k1=L)+I7iuOqt9(S; zg|3|a7)u-wBqmuOZ2Oqp>~Pr{iO?0ZmJ({W)^4tq6Z#|e7d)}RLnhbS$x!wnk((We zOxT6)Avg4~eX)n}aT_Y%N+eHC@VK08@MbBDPH>omqz!i^OphZBI>w~3PB6)Spd{1J z*pjoDWZ#gDTJ1s)06WFKm5U4O{*=Td$dzn6x*e{AB_!`S#6S6F`_t|!!!k>W1(w@7 zA~_5Iv4^`IE~4y0?PO%94$P5ZKrf^SehNMBF?p(@bic*@V*{q36sYotVUR%;4Mh*CMv2ga$%xKLO*p$mnV6Z}-RDg39Od$n$ckrRp3 z_kbOP4s(M0zL-StLdNv1wwewfy|9{9Bw~#T*LK*7I=qfCD}TYBrHE@E*or#L5@tQr z#v`uT-^bT+vh!rfBmxqP$#DeX_A~tdYp2Y*tJJ|l5qumB*2p^%=q!i7sOoX^`ye*r@Dyo$!0uM z;RA~ieW2~)m>3|vhA}=FK0=lO&BLJ{c^(k(Q7hz#iMbe%D0n-oh)$4jOtJy6*U}Oj z#};DpfGa+bGc8RZ+?*=!F`bYC7t1s)1;T1p0-(XV|P>RCJEbDyzMT)r+isoc@eYwt93f zLEgUI7&=ddMs*87towQ`gHmNCjx<=8m42)rJ{qle4Rm5~`rBQT64^avq&xYh$6V#T z5|j_{LTupM)2uPLZ%j9Ibr9C>9g~W5P6);0lTr2HT#*)s!b7|wEdh!1lfk)>(3C4P z3=(6gorzEx=0w2i*>LJv48|_cX+{0m^ATz=5V!!{zoIKUe<2u_9*hj>B&6~`Ad##M zleNQ(rRmkakn4O9aL+(9idHL_NfU_ExIn6j^h>@<V~sUT5nhC)?y({|8qCL|&k1NdAswm-K{OVP9+-H-!?=Z4UojD@HGfNj zrOPPz2Nd8U9b>U+?pvK;F+=1-I49o&8u>_hM5%N(3Op-CXJe|FxF2A6V={QXHsL{J ziN-EV#Cy_mOeULc2y@4%`7P)NAD)xN)K}1^#!+o?)LIJa9cutXSp3Z5c@!)7 zNium@c98VkkZKfILc@|^n9II=gV$8h|#H7w~OcXIu0>uAe?_J=lsIL9- znKPM_lNSUC@7F=l0zwE66%^~?rEqu!f)yw>gd{*DkeCDn1dRa|D=nZ@X{!dUT2$z@ z7OxTU7Oh&n^+Bz*wAB`^Rj^t$(27;$|6P05n%QTcbA(=d|Nr0b^Y4b4z4mvnz1G@m zKWENlrfX3l^$*VfT4lNl2V=o7fdr*N;<9M87Q1Cwe zeK!Z?oP4W5J|9eQM|-A|-x#8vh}sB;d;r+vm|+j?XqSXG5wkj@T_EOP$D|JvF~MkC zCx5$xEY%>!NaA)^jgy=eRi)5SW|kdOs^FtURXi}!nbLb|e;QAfgsxRiqO@$se1(f%Vwf#6S?;$KoVmh&@|K zwb)?qt0OZ**P+KHdS_O>SzC`mQ<%1MH=(*kdT;PY97C z_3A7{Um=EopbDOcSXJ;MA?Qo4NoxVs!5miC(fq|L0@+iL*dpGjouP(yF(x}14tMIq z;ZAKh+@%eNyHwu{-ZZjPwH*056bjKOJCkS%NYjoiNIM}KdwMzswjiAmqEV-(DIe3G zw~CqOlz0g_UJNI>$)ohGHnz7l##^1RK3Dh`P80 zY#p$D4|Qy3ms6KVQ&<*tdPPvTH@!?tP`U|Gb+TYmP1DD)JSX-}Zy`$0eW!0a4LpDL zgd8KsUp9k{UoL83*X+b59vjj}RW##i70vu5qONxF>xhQlboF6Gg=;j=q#5F~Xo&kG z{S5L~Xu9${Pq@=n_wXj!>8kNOx;PXAuh)Q;eKcQuTH z(T2UQ;cRapqV16NbAHJe>7>a5UBpt0S@=S=LLH#|?ALJ~PAs0+Ds`__Dvx-cS{NFE z8hPHiEHuHV7pnpuUKN@N+*_vBhOF#SNM(K%rwmdMvDJ0jh(=1-R`w;xIE&P)^hCSJ zqb!Slh2)iNy^?;W8Mi-PpE$|{W02(g5|sSFFo-Uek*kiK4t3(_}+=#ni+-w=u+ z?TyXtA&@F0EROWUN9c|aZrYTmxnOZNZ3v~mVzCBMFOpDA((VoAL0V#;A|e0tPF0@J zsmc>Ol~wQpU59d@opH@OW`sa#AyM+<8JZmmtYc3&cJi}&_IPW8Mp-ahnX1O$A z`G#WgB+TIK8A0|;D#Z%MaP}Bg-BBbuRHaw9N~`W=TD6ualfCLzYgJrkPsWbOt5%JM z*D9gjw16iKf?1%^4%T-1?U4ulc!#VE2Dz8+<80bTHd>(z9lF=#FU}V^uVcYHm+rBs z>`9KRCTVrIscsrN;L6Zb^UmJipY-V|Ab=r)N2n%F`!9k*QujBBPlC&QxZ z#>pVMRU$!gl?WHzI~kU*Zk?PfYeHxaTSv=4F#ivtn>G@Zl-VMM?&F+itJ^pUD~sAY z%yryhF+&vHXp+zmMCeixMR%Sw|1B2WaNyGaH3u#cjbG@%YT?oxn6PcyOtrdPxM=4z zOl_NnS+r*wL_2;7iuG&h!jYwIkZs~k4q6B=V?&KxtRv}DrU38k~<6i+BEwQ4Kt>WQ#qHvZ7RywRM#hRpkv;HOop-q6%L(Syo=@i>|I* zMhd9_WK`CzD66*0D(g$j8&+D&AZtlrIO(8Im<%6Q+F&hMzR>?Jh~lq7X?%KTVJRDJ z)%uk9P}&2gdCVkjB!meA30g>B7!jbhx~ySgP2JMc)s=NMRjY#x;>1^35{u$nHcKj3 zL2bD&K$%vzs}zJW?iYN z^rd+Ivxr>`5Aw>ERn#nnGwPNtvTBw$kR&fs;uqrkEcN)J%B1O~7fzZoA-Vh&byW?O zrK)`v;>8+x%SOXuOLd`zmMXEZvaYVCF1cWWcYJe5kX63Cz5zDDSJtu`bOvQflI8HG zv|xIMlax>0_q1-9q&1=WeY5o*O0A=+L8p{HC(HE`)TbBVvo!dGP*v^XO1vC+A)4EJ zM{p^30oD0Qbdp8JcXs@O_;3?iw)BdshQ+1mCFu%kZI>jvzOs5@Da|K=IX)!5x0Gd6 zg$8_(iRM6cQcY58Rnb6H^kvradaotXJF1phRV(mbg=N-?%DM&A!~VD4xt-7Jh`oBI zWv}UFchBvu?y1rCm%TWou{Zotd_AN zj)@Q3OBJLn-Fn-`*hY$#uFzIbn|F(>h4U>3#O&Ojv73?qo$xJ@TeEM=y`#zR*ko*VMENnNNuDj#t!4hrO_eO#7qe_FG0dlr$7+ah;l-=1ql0UhN0 z?WSz@64{x-_tDhD#ipINd3KVnLCmMx8h%o`zT@fYjO(`yyaEurVB7w*O&&$0l7KW@ zfttnG6x3HN8M3Ubp=w3tkl}^H3ePG$dr1AN`nsB$h9S%A>xNV*n#qkWSP;QBlh(tFCTXRa;qKxR`t=vsGa^ ze&`KSi>cdVZ3Ghtf0bR{P*v?g^$itOH6Sy*=FQ@k!?P2^ZP(52;C6l7b+2~2g^D`6 z_T*3onhU)^V|&7~-7N6+jEr~Pa6CLY?CidJkJ~NmykIrCU6Fj~>L%9?J1<%B6vbag z@hFO?lzjl1ozi9g0hw*GJGxonxO2zVaZ>R&EAD1Fwehg?eNQKVuyZ3ayM~=3Fvp&f z!h~ZG)GeKs$3s-T$f2*zd@RPI2-ZLfad~j70k@3)o0!qZ)%&>F29e3S{*FNHA?{!_c?@hq@ zVdrkU$!)jSS+&Q_pYFDs0vno~-(7|3J!J2h>h_!pkH_7PFsduawQkqxbnd8C=TzxL^g+;+&1CqZpZ0v zUKk~_h@RkPeN5*(WTpbb&RthEg(6Aa_j8-Nd8mJvu=DBKCgDxH#;*gRYPjb~Yk24dZC%eemRjo$nIQDe$`;!cI0dG*xrDoBuEX zB;#%eG&o_`Lt_&>IQ_b?^Xs*H!p_c6q#^9QvNp0aMUQ*g>$X>fo%@OR$q@QkLIYYJ(1IkuaZ-64hh-h-Yt*)%!OF#I+=*c#fyF}3#%Zimpwj%Y5l zN|Uo5KIs^C8Xcsjx}B%E=KyaXck{@aX>N~c7^Q2P+)fx14tbdB{n#`RkESJbH06b91|G&v+J})pE+=)>SMby(0soF zH#*~wG7>uDXc&hPa=lw{)XkZMVvFG~rw0{lb-RS8V(`pqr6~X%cQj26Vdu3g)#UTv z8G9Z>!(ZvmTp3ikpIn*Jb^B4DoNOn{4&^2dowt$KHal_{6}vL-yqD30xCt=~z)Rx^ zqyg|dO5;Y=&S_)?ypXeJFS-C~1Yb6}VQ_v$9+TP_5(LhzB* zR7GdA8;>l9Oy>inF+twqHmNa#e)cX9Xu6Y1?4=p+br1MHSlVGk&=jG%6iwmIt2E{x z$CNXXbWM|msA?Nw;l z$(T69&VKZ`cFr}_qn#6L_Bg93xdF*e&J8fUtJ9ToUdO_tI_u;~lP8_L!=iUM4J0U+ z3cnvhU)%}7+#*ruA6LQyInH%x9%#k1n&VtUQ?%2lCW3ocp%4BZ>v`x|JhYFR#Mc=M zJ6d%MsLz+)wSA_c(R8^{bjvjF$(|DLQ2z z#a;o6c!Bd1aufW8@$aq+6<~N_3zj}KV~3XN+eY`}$2KeB%g~;T^$J%{0wf4ss&Ms- zUjqI$h4)XuC~<+p)h~VtdHogcKeFcMISTiG@$>Ok+F@F9W$44!8wwvB08H&y_>d(0 zZY5u?3WMyc6h15fm|CQ8`l&xLsB0MY#jHepl;T%E(k5h_rf~JsY6AYbvQw_Kf~@~k z{B+To7&a?h6-vl>P~qCI`JDSrh2w`RBh)J#Z>u)KJcauYa{Ia1`5|=m(?S#~yt^d* zxU<6jXGwkhm@?ge^4Q1UQFtFeEySw|?<+|^UZv!R{j?AZ6rL$bKc1{`xw`gYYlOnH z0)Q#}{SHEQ68^rjhn~nu46i91&#@R`53YzpcuBJ#xJjwSL*DZxDob7Kf+|t`fgE)| z0r*$w0ylWX)Bo$XN`(jGu~td5tSgk9pncUn1mxkH7myQ-uPF0htngs`3Qp6Ct&O`F z^N&+_Fs=pv0rG9{i3!E2d)!esQCNT$Io?x28sd?TmE69R<5*2aKPlkslx37mM zx37mMk4F#J+K~Vbjuo_*U=-7z{HF?zl{_9j{-C||a*mZe9zFi#@#x{n%6GK>kjNkO+eAF*hlzO5-xBfUb%gRAt)D0IC$A$OfATuw z;mPZWhbONW9-h2jczE*spNnxy_uR}tf5(~%&r5?}f$^A%|JF2k9p+G%Tb|J@;9WBb06g3V|czB#xu16aeK6+gegoMMZMZvK|hxfI|CxxYwMKU%gj@F zFz#fgC{lPZz7DedsfgQKLI3yGd&~NP(i_Y_BImyqE~(&~h)=6}1@oA2^o5_>Tfw{} z_}>&B%p2?3o;}K*V7}VO_!1>Q7{A+L2Zak19*lQ&-xm0Pr)ggriK*IaM;iXCpeGgo zt7+uOeg5t!Hy1n-`Y}OxwSb64_Bp^yG`xUmdbxp)4`Q6;=%XyA;pZ|WdgZqS zQ*QW#= zpK0*#GjQR5jd8L^d_qt^q$v;2(94cFV{SQ=b@Qy_bE{(SUX z3ML*+gZE?HY%lpO!fY>j+pXyz^=Fu@SNG38O|Oo>l?Inr(31Qw)2~)4FC@2@^b?Y= z+w)l(etF4M@d+C_eoGW}V>{H8xQYjX7ZN`Exvq?-q1ERda}xGoe;)as?r1G6+- z??1B{H}%eE+_b-uakIU!yr@9Wv7XN~MO~OS<@aFRl>Z*%BwwEgu-R6@tZ#va>-8q8CK+fm*YMSjrROWMV3--%i~>ijakh+l8tT8&@F8yGkJ zCiA)Jw;h@s-ER@D7xnY`Oj9J|)RZrNHswdTEUjx3n5JkD({%l+<0BcT`hJaRie_v0 ze5NUCV4C=ahoFrbuKQ=JhR9*Sx;ejV5Q`NbOlZ5qGsH+`JyetS^k*YSNCuFu=AXt>_b-_meh z?}usdV~mU6IB9*xg!oPH473vk({K9zXTIX_PBD#N?^m-mT(?u^PqW=+oSN-^neW^20KwDU$v`axTfuYWqOFpA<7rcGA2jV_+8J(q4kk*5pWAlbU&koG5_^^9?ysg<4jH zCP!~~+4q|5yI14a+xIC=Z=7XQB%gpG`*r+1O^)7P5uVV<50f=H`HYhs9q+-o*ZynSq(8{TlG0^xeSiWnC=#TVXva_|1J-VaA=a&$Xm8eYS7rD%$V>+@JX^N?PB zJ}F?_>~H-UC;Rn%R8boK2;+1=dl=IcRcQEG8ZPq#@t>pN7b8u<#DAOy&*T1V@>grP z-VdKngP+6wisb10bl*(u(ec;0pP2jwJh7YjM``eWe5=dkx7nd4zBCQ)@~tkDf24*> zU!(fahlME+zmC6~2A{yU#!UVj)8Ox>!6)Sede8Gnb>5T)Kad9Rlbc%3Wod9cMyUeX zudgqEN`nu`OU>Vu27fjU-cJ7N+R$6A;a~Mssq@om@EraLgzVS(XQaVzO@qIl1|P)} zgekvT!!OY6d?*dxhi|Qt9G!nr8vM6u@X751|LbzLq`{~1t!GnjV;cM?Y4Ag7@a{ZO zlKe569~#o&e@cVL_$Me+&Ue$`Z)*5hP49V~0{`gv57XeI`4&9s)%m}h27e(9enywn zdTY|)ccsC9lLpW3np*zMH2AhO_!}BNPV?Kj-2(YKUYiDgG!6dOG!HgNJ&imOnBLz9bEPM;iQ>Y49$+QtK^CgWsP9KceB|J(21> znt#Hf{;%WTNrV4B4bICr-sosq(=_?Kj3~TV!+E;$@ryZ+hpED6X#Cu*eEuJB-WeQ| z-szy_dg)9JC%u2=^hl1Wz85l05$!E0kR0OAMNDCe7y0-9U!A@EgMK}@ znsJeTI`dy+;KLc;VBi-q{vA#JM5ZaapJ|alo%tVOoa#G?X^Ng_TKMNM|8E&5{y5VV ziT{LuDf54-@lV$H<$6~5uV8+94=V+dFTSNT?WZXS|2j_7??yT4#@7%HSN1Ufa1AGZ8SfVuxb*)E8K-t9{}*%rDKYRh$fK~* z!1sEvb*q8Pa|Zuu;PSiIZw!1M>-{U^;!oL6d}`qGyFzy!_riZO_p8wcejnqL3|#uj z#RmQy^OqU;D~!v1OVRrpM_Y$fIyV<0m-_ausal^SB|u z5#E*Yo{WnexyCrtz(;#xtP2cW_~#h-Z04`kaFIb-w;4E_ZT(Ec&u1AFy~?=Q{~fmf zj|TpG#t#{IpFB_4M+Ux{@eq$=k-v}e90Skd`>I_SC%=)MvhLu!A1Vlbx0kfeGVtda zpJd>29av@HU3i?z{3P;6F#dgw|EnyUq8~9X^{Qa|A2IO98Q*8%4&Uc}&cG)z{<48@ zV*F1A{%gkHGw`ALp0S@WPW2-DWq+H;<3Mnk4+{-^hbP9G%sADT#>)phKg>388K)Hn zF5|J*z%zN@xR!CUN57wZqrv}Yo;PmQa2j_NT;K0&IN8~k<^NE_iT{4)e?Y^DU-svZ zXgKkA<@?}|X*ls0vHYKFIPsS<|1UJ0_{9&u(QxAbCG-DY!--$!rFRWn=I2igT-JA& z$E)zaWdVEhFG zm-~3{7&twjLg7;bpTc;@JTG7BCC|+aG4KZFpP=C}uc$g-ZQ!iV+QqnxYq^iG$G~MA zJ!9Z9US2kE85e&raOqd?8o2bIj~S=>j?wJT=6O{5VTS@Qvx9+GGv3d@f6w?}10Tu1 z-<-?1=v~jcFEa4)j4w6hY+*T98vOH^|26~P%=jY)zK!u`HTl&4&*ORK4+cJ#@jn^( zWX3-L|mNUq}Wt?7M;Bwz*o`K7!`YITwb{WgQ zp{UN_5A${4RT@4Oe81y%Y0_}=r}*L98czJf`NscE8czJ;pF0g){Ig5LNlr7%`LTwR z9P!WN8czHp`1iagG@SUw&o5{=@o!=NUurn;$@s>;ENa^Vc@+OA7jXWjpa`_@MDZGGUU9(a#k65 zsH<0?$-v``dtW{9?qg7Ylk3OZ488fNH-#q+Ih$F|FAe^U9=r8t1K-ZL{Hdh)S@vCd zye|-3{H*_uPj)`Va>g3`2N=K9z@;5m8u(G>zuCZLAO5g`%R2ia<1%lo<$2(b1}>l8 ze8<3LJRULd@39>Gv6u=XU-)wkTz=Q+V&L+-Mn40W=i7=5T=u1-4P5SvPBd^Cr?U+F zF}8oHfz#i`QCM!`ysvIFaIt5jfxpdiwi&qi=LZHZa{j}>UEWteV&Ed@Ndu?98>H}} zfuG0ts|GG|-ZXIfdqoN#7`X6%YT&Ye&g6ZW^arU|2Ll)X_cn0)`%emI8u%5ApJU+C zzT*sB=E*sX(>NXHiB{)D2EX^-2g|D0aGKA5%k#z+8eR*i%XuHnRA#ATk*aN>WP`Cl^d9{fDS0Rx}T_}d2lW0rHwz!x)a^L|a% zktUYYmT~d(cDC~@1HYT`uWNFsUbT!@XgJmDbC$oCP*H*mRr{M^82 zF@JB~_lY0mck$r{KAPKQx`FRwyxhP)Wc*qKkFuZdFz{N&e`4UWA9%^Yw=w@;4171^ znY_P~dhKVtzk$EU_#^|*=Xv!~1Mk833Jo96Z9>s{#;L#2{5+2NH)}Y}Cx7AouvNo} zUw)U_uHnQ#f}dx)Tf>Q8=JN+NocO=R{JS-r_+=g3r{To^E9QSn!--$+|A16M{Mnz= z5d*L0biRSF;WUd^&((|r*2s7f$0C0{r$-w222RHed@H9X8u)FTrn*oN`8&L%|2J-e z%Q&j#e8GG0cv)%SGS4>}_z30~dqs|n$L$9HVjeGIm+&_*{-D7x&zH0qxcpAE&%ot( z%x4W;=HY_|E_x3cxaj@Rz+2ePV+JncU9N|yUPGCOBDudV_!Q2Ivi}Glrt!;lhTt;x zq#Xz!uJMb%1&?r^{4PiM2#tTDrk8NxFV^t0H2&EJUc`CxHT-OiU+&M5UcyCwt;THEdG|AEX|6Yw>@8@r6xZa;5C{Kap=>4{z zhU@)vq=xJLaK47?{cVGW>-|dlKk1Dr3%t`)8vhs#m*-rFf2@W}{~=s&cWGb3_4bwi zLhY`%oNkpdOKdq z`zEqqZ^s8TTyMvxHC%7U%lJ7KlB2iduQgn6$9uHrG-94<>imR;kJ0cxJfV^Nu^RrG zhU@M4k@kD5-i}sbU1fDyA$|L!P+m5UPag1h4g8N7EUjExUc1UFtf*YDd{JrHf(3Pz zD=bw?7w`oiNGL3?S-KRT7V$r`;C}(c)16dQegC3xL47^)gAcZ7)+UwEJ_drXbkwt9 zp2hgs!=g$+UaG#K4!Je-F$M@!Uu#icVG%6&MvEY+zT_f#ECJtk5k$TOBWa^FIQgp| zuv2{t#H*HPT-CCLHP*tKT6~Qpjcd#=dwc;~@O_Uj@|^c641ClEAD5x8Y%E?68M)Ofl)`iw{6vYLjnR6{07lKH)tFRC;9C-^vwNTac# zKBV$Rr9Fn!R!|Q~{p}XLjTbF1tE>1zzj&?kg)Hh*E?;D)`JENmT_#$+9*(y4DupxTs1I~3dR|*clK>T-G&yb{NY843ukbtvuv2Ox&MDc(sRE~ih@Otdf;Qcz6lGK zn}k4XAz{3%`FSy)N+fvM^}!}kUsPW9e^S6K{{tAGs=QpUB&>B1VwS%H8>|G+7hr+r?k@&~!R*q=^+PwbCUmCq*- zLF((Jl6|!s8L7&5;quZB>B|2HGE(_}KKp+k7bO4F7Dnvp!gv2vOf=pY5&x8`dO%47n2MMrml%; z^snR#p%1-cN`G6>rha-}E>-<2ctEe`@)DW)>31d*Bi_Z!y%PJpNa=3}+SH$k!m0Eh zV*SF;Vv=-)P(GFZ{wur^(oe|$^plRr6a4Zt_5YCd%YA@!`ssZUsr1KKzl>wj-!X;$ zfobYLj}1L2ia9oQoesdnh_%ZVUV(jHr2O9*v|0bjY4nfg=Vs+T1&c}2bzvI)2Ux#c z=TiN^gAoqE^RI>iD$S`dp-VJNK67n7$(%%P%sh@^fD*Y`yp-=S0_-9iWl{GP9F22Sq zGT)1o|NDYA_0!)ikqrG_g(^am1%j!ccqvGH2WXOsW=IGVxxDC;Of!8c1d%LEBMCvu z*CwEWUV-WF6jPONVf|5IFXr;m zla&7i`Kj#Rz~y5nDZdt-$E*_-d6vtEqlp4c-jyhys{cKBjaTjvH#qhG!8oM-WnL-- zX3C_JFOHxy-mhqMER**}047G|{=qlF-W5dzBAC3_0Z3*4wr_g;BTx5YvcCw2Y5zfB zrc6NATio!)M#naJe-GYN`uEeu5Me)Ge~^9}qo)490wbAZn;u4#cq#9@B0-Mmmv}L< zQk6e2+bi?6ps1pxoW$EuKcRKj!Z~^>piN%-duPH7H(5nop7wWokopUDI?AW=-}Z++ z4*6Y!{6}3v%1gKC%KAl~#4Eqs@;F}y1R<=(PtF!S$14RF{vtX=z@(pTqO)^0n$k<2Ziw8xi&{A?UqI3hSQ zafETWI5Kdgky8}NiCD2w*%`4>Ig!|?+}zlxy!_axHU+U!ZM(!q<@bnoBaU4r)v?m|yj;T0C-K)ny~ktXeX1P*wHF!BtB~7FI1AIi#v) zX=O!Y}T$0V^4&Dp-wv1hcMJp$F8w~q0Tz?2L6O73qBw$qHKvQIhfhpjckot zjWa2R|2{eVGwY$=cGh2FIo2$d{(YuO+=Wb@#Mwe zb5*})$om6q`-5j&BmA!L|HypkxhMYE`rH#IJpJ&qhqry`xj#P9`rIEqehf~9XT8?^ za@K1+o-2Q{D{J4}cdM#e2843&KeOG` z_>vc__J94oGi=Zk88=ngS@8$j<;0iRZN8b0@`LlN_JxBZB}1p?m-JcMrR20eZb{!U zc_mBi-23qx=#~Lx9ZTMuv$W;?Im=r9I_L71kLHxMyfJ4%%bRn`Tgr!Kl^mW^)l$=L z%&(lek5W8&#Zp>>taEaY+;6^uN;F6y9z>T&$a7owDz>Ph_ z1DABn8o04*=D?-xvIl;}p9uH|*W@&hX}{Pe3b zkPaiAi*yd+P{}=3X8ZM)JMi>1Ht5{;<)A05=?p&bf2|X+HVQlaDi>JJ@Cm5Q;61?O$r``LDajAn1Fx}q zwl9P3ar3*Dlv`ce=ZBnuKU>=#bT9A{oe8=-fhf8`7 zt3iJ#M1NRw;zZ{onPZO8Ja_!cpWb)ev9@6S*?JIt>iCsU?C|jay6;Gi^$F!2anvi3 zww8s)?OM<#wu|_%xGn1wvzN^eTf53aV|R^>g_f1aoMq+N4tU1w3i9n;G31pYuPhYW zbtEVD$?+?nR60&LnZG=KW!L*YyQJHFN2hnc@A$az7H^%1eR9;X?^MGMdn2_KwNoS7VY@y1v!%e$E~=fj zkFk!=M?0b2wlrR29Uu39NE>ZWQ?CcOUe%}rwV7V8UH{AV`p2TZ_Z=&>@B8~DA&evE zzJ3KUdbQ|g{CV7FS})f}_RYNq$G!REKZ0$Fboa@%C z?|^Ok=Jzl*-#uavJN%9{?9fZru)j20!**f4eh~+)+qBLO#nA_U23C$^J&sH(_r@c| zu>pVUF=oKVG1iu5J9K${$c?Y)WVOHI>`2Lf&RNm2@@x4eznODI%hvW!$Lm*gDLFQ0 zWy^PwPiyP8pj-pwEQgHUa~fJ!p!~1rEN^)y{~4v{@6i2mfv4x#h)BsfbFXN*7PfsdE5Bsq z?3FF|SRLc8D1HJb^AJ)kD8^=z}+L>`}hi}>8`2BWv z_7poe9tZv38Q<*itv>Pi19nb!HDP^n;x}f+e z$9xzKH?~JyaKv%%|Jcd6|ES~K|2HRe|KBm+U65g2ehv1Uf6KOZZwSRk9ma9c>2&`a zPKW#7#1Vm=i$m6^L*dw{8*ucuBk{#yq_dI6q0-q%w?P_*O1D9}J<>Q-x;@gJkjA0X zosjN^G!B*ShIB8aaj0}J^*W)gi?53vd-yc#qmQwUYzSGO^!fC}tih-U?(gkB=5)Tl z>-Di?o~@mgtu((chW$6-Q01I1_bYj@zY4Z*z@h2``>SC41{^94`>SC41{^94`>SC4 z1{^94`>SC41{^94`>SC41{^94`>SC41{^94`|DxzcVY7z|G=7swmLd}JlbX)+I}qB ziq_VrRoi{qw)?SvEV6+IZPzzHHURg?H_O~mjyZwmhHLZ3#qYtqa5u(wdA=LJ7W2YA zv2k&gj=Ay5$oTj@m=~}YjIWO%9Yq@R!uqHiR~W|pwaB{%^8%%5&e7)vl2f^6T?d*Y z-cB(uY{Y!|Wcc&KEj%wgqUMFC)ObC>^TLri-n{TM#%foY z7v`?U*!1RwvoSBw_-w$u;Eh)rr`>RL!a?(b>(2{Yd0u!}%?sZA^D55^q=)8(&X^b0 z!!|W9%w5@neWschMqysS{xZG@^8)sj@%7NZ9(vbfURclb0{JG>3T-)p`ZjzmHekiH zF$1K&TVcnon4h*`e!3O){4VCF7S!=!%!4$){dUf(mOaQn3L75-&s(se8|wK8_|BVq zC3JR)KMcNeX2U+{Tt0g_;sWUIhNC+UvZrJG6_oo9)Su2^w8Y9 zlJ%?tPZ!kj9@w@Td^GQp-)LT@xtDxgKf4}r0emTQAo;d~ng^-AxSxS}|NkHDyD?)u z=6zS2_d$QDc|REY|5)^|nfpJ@oWR!w|DOA4o%+9V?uX4*`w?GTx%q(?J~-U>(WS?) zwD0?@CUoCF7CBfCGO%8_Sj)q>-mvT?T$i z*L%2sIoGkae4NvB*jY|!%PqKW>4Nl*bv=(oo!nhfCl5y(9Bp?UTxa31afEOS zIKntGaYS%r;mF33v+H1{^(gj?1y^QT?XK=_U5*b<&02G{U2?>>Mnp0jXEr<5{e5lRct^Jq2*m`wm zTo14RYwMv*>y!RNtXYSg?gMYY&%W^`i$@N~%Dypb_oi35Za#?XPuh=C`999{U8l93 z;$O!`Gjn(Kai;m#xqWlmB7drupXXoa_JJR;$0{&oP5_3V+BVl?-+K^#ro9m9D#Mz7 z(CMgX|C+XU+I-+{;`~icV$c-=J8p6A#wFX3&T=p4V%hI*dPTPKzu45Z7Tdb~? z9&nMywG&;__R#gAZ4>o%O43KyFr@EW&=p)mTLT&|OV$@%lB|#FB-hZ{e*L{YKGhRH z&#+Gd?B?9YnRslufPDW(Uu(;oIEc4CjDCQ78S_q@7;%tnH}b}uIDvNTG4L_`RB<>n zMz4t497i9Zex#=-u3CKTNM`I&x`w}|yEW^`dnf4EvduV@9_e$}ymw+&%vSf$xAJ&6 zei(W`MV&rI{~v9KwyZ|KC;1aSvl-d|623i|7guGTF4tg`u#(;4>&tu54VFT*|g|E+#I(Ql(*EGz)_&-B|5 z;J3++*O%V6BR5V%|CPRbuqwGP%}>#n@ccudliELFtR(kc(s?86Tnc^P)^yHKFuYb%XwnJ>r>JJwyAaL>)g?+FK;4g;}9Z8z7th5R z8(%w=kr~O!Ym?uhW2dg&di0L=J^hRU0|yNmI&8!_BhNektFdttE}RsfGJVF(S(nWI z`la6}TTroR@sg#>YU`J;Shaf1)s5?}z3zr@ZrrrxrmeSb`~K~B+Q5jVla!3}+ zc)TRW3xvgdUL}`wBGZ#AGQF~p@99ytsB)^jXCsw?K4m%hl%2u@RMi23y*hbz6Tf$; zIuTb!KA0~#6!HKPuW1W#gHKR6jK@jb|_g?B*;@Z^eY*{3qGYIYDXKb zYoeAq8ZFCeq_ov&*>pq!Pyj~9HFPKdeE6q$R6d=EpHK>3*~Td35={tbl}m9nkVP2D zu`~?qUH~TLM2@ZaAU6s*;JSv=h)IVPr5N%MH!56c3xViHoGIWO#Tn^nV?KfOk7(rO zQx=YV%5DUWn0Ro2_BaC`;KYlv$nk=rSQg4FUN4V$iBhtZd{u&YNuTA*VSU6)IQ~UJ zfsbqfFG3@oR26XMvXo{SQKpfn7?q4hMG_CmY4q}+EGgd$dk%Ed;D=ujkz#~cWc z0tbx{!l1)J0Wsx)VqT;@ng%BFR9RJyXeASJ6;5&}5RVqa4ke3alYHbVxr!J3N{6R6 zu#fHX>=cP%664Od5Xugm1u>NOwx_s zAZw^?Wq{7Ws)(368v+`I2*QaEbOsoRhcZ=`I)M=&_=uOXaH2Abmx>WDl|!DALAr<} zKGv&}B!e=%1BE&h!RaBN+mCMR4$sRX$oSt1O6UJtnhX%o;zBks+6^2Lj$K@JjMf zz?oEqp zJj&EKk{M?E8ZQ-co)3L}4U^LCZ0qa&*q*>!mkL?TS++G(j0t=&lSTQFX_483Z0l0# zJ)*$2%B13fEn zhmc(u^5$=0l=$R=5P_MvhajL!!UQ+{OnLNY`e8b`=La7D6UX*nrxnS!Tq&U}s?YgNc! zC^rUR#wpi5%7svOAzOT?{COt#2M|+!WSS@$Bm5#WgbV~%Bnv)i-HTY@W{w?e)5$mN zqFM^s)=Bjw7dh!*EM}8LwrUn>4p9y8)SG3H?>)au?)9Pa{Y<_RKuq~jx@HLk`&}{+ zT#+nTs+3l+48v;XP<59&Zw^oW~~B`lex~*qUVTKhY(N`GyagMM!xs!#}rzu4gOI z3_|W;$Xl``wJ%^4Qr9@+q?24f79iabKl2GGyK39|n(Qi`^7m6;dzQ&VJ~UTIvB0*H z{y5R>cm0#pUo3OJ?451v;+?Exx3BABA>Z<$c|soZp|1;B;5W=%A^ZE#Y_`FVOe3Wa z%W4dV#F%*s$AF5Nlx_uRK0~zuR|AvcWN;m1=$Ow{E@VHyDisr%obN;BLgE=n6>RI0 zy-WrTHFrNlulZbGKggss7#iwBhQwpGHJ5LFTH-O=f0-;Bim$?P5I|}rZHSGBb< zg{3QE^av^4!y7%43fiGq$h-Z@@!xZb&}17WCuq7E(gQx^Ja3FiN*V)$F@x1?=h$Nu zi4vP$5qu;QxEc{s?6<8-u}9Pb63wCxkjRoaovsnSt`Z>wA5}j<&k2Fh-`*F>c@sb!3 zfOfMa#s^@?znq;FfR2Bwr6K@vJBJ0FVmasgi+#jf;KV(W+x$cGUUxpl6p2^6jIlC@~uLD z7O>S9R3fCbGS+HYrz-pkUc8;j_X4Ot-=5gPF)i{;KJP zTbu{E=|AHb&`36Jmal#m{b3RXc^5ypgnZWLnkVFIKJ;}VKl7ovLaN6|AoCO!(-BI! zWyLs#kH#}u96+;}oF70HOg042N+zYjAnPrLq!Zg#xsd&Rw^U4FQid0}gxu_NUGfT( z@A*)LkX`&nuas{r%<`cMAscADL6;2+olr zYMzxuKc2U3Yl*Dw^3qA$TC|2<42RIjF}UQFkVk#!q?ao)2sd*PWq`=}Ob0z}!P%^e zbYQU__sdRxmtL4#SgvhV?`3j|U;ApQ{d^y)s9;jOfE#T>1`er~iUbak9fn^Ivl^yF zA>4_UOQ9XSz~@-`FaF{6bvM0#+vbL50cEA80zz-+cXK5a5O6PNQURe4r795NX2|uM zb@2!$$NSK1A$KrDV$J#!CccoyO|Z>(3lpYyM({Riq`zI7ak3)gnROn=^m~(R#8zt9 z$>fMik*9j9BxLUnFw`sw(FicyED2E!Fyh;>nC$?V-7E<)4q%&RNvsJtPu{yXF!M%^ zaiw#zTDCCj-awDlED5=o^t635;AH?lsxeBTdz?0wQ zznht5OepcQxKGdHSb+yQAst?UCv%PrE0HwW8ryucoj-z3U!&7XI&GFtYg6ihgwzWO zsSos2HCwcX<8!SI76fdtMxL&sm={g-qWmbw{W&h;SaILRGGwTK8CiP`PyI_PeX1Up zX3DklZ#s0~$?IF+eftBuSx}jvY-_QQ`N6~_q|9015^_qwbuvrd;|c#me+@Y4Sd#0V zf(%bM%{)DrF4C}*sTP$YPxVzvSS$!&s96%C5n#Ak5~3Pl#J3|F6whv!gct|THqDY4 z5pbS-=7}-$c#cnD=BZ^?dS536D7Ts=vC#)HH9W|Py#aXgso^bVe$Oui@shB(kE@BT zA14L{;K{|CBhJN2*Z1W2MgK*`RFisc3(hjR2x96|4wg)b%|bGsw6$MYB{qu`@t~4H zc8ad}7ZpocE4!V2dYcZe(SZ9bIx-^UC`TXdlLTIGNX?* zslz$=Geh?b5P1D#KX83DCkIF-kvTbE1sU(XVaiLit6@o;T3Ws>Fr5%mqf3&%H-ZCuWB3ZiMo;_X6MXtFG0~hloRlumTi%m zzJdG;l!ksC;ES9b&%3ARL4#_woRJW5hRSojysrc$sdi*t{~Xj{KsH-tSp$Wnnw?1o zUEEpB8I+@%2`>S5l_7;AR5WCS)gzA#vwGp}@ZRJRL20xrol*w13yC4iKHJXX^#WaN z3XqK1I5k=>Egou|L~Q&aHo8=%DzqG=y)0#+d{s0;e++?-I}_ipHQ74=D29CXx>75v zh1d{6H!3xm89}+%gK`Qy3^x0}0?_e=#XN0_;g*0QD77pVcws8={#0O7DsXNpa99B1 zkIwNYrf34Y$O(K(e?o%rpM(!^0`7pLi^p+*IL=DR;joL9B*iyc;|uhTcLI({8b^Q@ zYiLfE>=Z)R_|+pvgoxzZ8j;vfDzi-Go1WJ)PdM6 z=kM+4_ItZKiNkB?h_7QLFuUd=Pe*YI9k+Wr?oF)&9k)H{ps*1K%%$@fyMwLnqJugL zT?K?vu*cbdqw#@Z;)UIaxX=`p)k$*fDfWk84T?@Piqd5c7hPu*U1t=%)+_3pS`E9o z=q5YRxXJztH0tR@3vNWd|JCtmz1v)zLU@_<&^nqpn&8tr|POEr|K%=iz|GJZJ)Zn*Pd#9={Yf;<1RJodugasLgRiz)whGK zp4qocLy1%N0(vjHHV>aHU8b~oJ#K;OiNU%>cZuw!i)3sy2+=6SMj^Hdakmf;f>6Ea z6(OD#VlRl(4&v0MN$oqRm1!BA8Cpk+p*k0bu1lMLJ-AeUurSfpDZB46!+nn#-DPir z`yMykx6g3j$oz?(0hh?H;n6^suR;S-t4{16gMfiI8zoKZ+VN#+^~IrFWr5QqJyTCjMYd{dd^t!i&- ztJ+(NslV54-&G5}#i_q|DVBCXmv%stc0fsEuI{Q8S!Z|EVLY8ZRA=$j^imTGm&nsg zu&lSqZm?L}KxhfcgT_Pl;bx9*TupTnAU?`qclMYHZb&ARtB>ps$~ z`#`hqL(RG#4)>ov(trAR-O%e*g@P7(y~#q0`YZ+7Rq4t^U{5sP2NK*_BR~r z(O3=D2HP%msAmTI!b?^0Q%}!#0-v9(Y`NkMWG_(ZfvR1)!)Py@NmmUN?1he-mjSz* z)dj?vw9{AkBFEdfs6Bs_c9arkfv{IQ9lTI-S%FQjdN6{W>c zg6eSZqm;i4CaiuaO)H)1uKwCbtD$$r6pX3At1*=zS{d{yiylm32h)N&Btn7;m5``j z0cFZ3TmiLMC+uT}MEt#rs)iM%Yk3J&F}p_w4_vyux1w|%EQq498#$Y{Wh4m+UF&V0B4&C3a}~`EiN-*)vuWP{jehykK1k)*llkqWN|RgHrpqx}A=9)xua?rp|BnCd z0eE2g#OWo`{sW@r)n&^TMOReT)mPOliw+%DSX4MP+P}Jb#nQpGbv2h&mN!I4j2Jp> zWck8#ii#?SopVmn$nv2>&t7=;!g3G`MwFM8omF;rQCa1%@&VR_bBA0}Q@3Qu; zHOp4j)R$J2HIxl`XXnnhT5fpzmPh}*=jJ~@e$(4`{$R+kqG9+yv}g!_n0!ce)q=XR zx>fVkC&?ga9toP4C}>`?pm`!_-h$;-)fJ`wch2jUo;_mlijiejO+`g%ZCPDa!>Uqz z;=H=jTE48lYSFUFifB2cTcxFAX3iWlr?h0!+zF+#<`hpTEw!$wEL&1aA5r%TOqp08 z6slU*U@gaK_^{FjYbJ6^#*V~sHjWWEhT%8|$5}Xr;~0vU`P2_DZK$koC|$68p_YRD zdM#O5zMz!e`xCGeLT>>Ikg640qI^NQQGgICK<15vb>fTK>avD~HFZl%S69~6RIRSG zs%y~Xz8k1UN(a6iKMYn`mGw)k3LHdNS$g(xfsHk^l)_uq(wYi*qjK4zhQ(Gr zJOih}$5qQ}mp527%NrD3EW z-?mC7}#sXy$q43wY);kFqC?uJz1A_du=UHZjkf zTOzk+Z_E8|oA2fK1H6NI=$524JGWlS5yuu zE2}GCj8(3>YT5FYgQ?`a1yv38=|m?lp2@2)i=M|b0vttO2&FogRaZBxszqwC1xNZz z%JPP)YC!1E#Hk3}D->5-&TS#vb+bFTcI13~Y#t8O^6o@l7V_MwuDvcP_dY2Z8qpys z^G9D;^a2)O($yG=`fHTJbM3n*I|d2&3+}$mn!JHbF>M_Ov6D+*~Is?w&c-&2k#z zUShbHnCzbEtM@o-}hc8sQ z6W!d4+%v(D3kE$tH$2tNo#=L-qEITHJIOtFvfDk7105(fF`<}<85?$1#@+tl7#p7M zW?ks^pLU^}HQkKe%qedFiDBpWFg`Qv>~JEZ!_EODdWD@mPN+ZL#2t2?L3$V>)NBwr zf}v3!)XrJ1pr^q#$b&`^GzhvahtPIm=jSMkVvl;Myr-!B`T6&i0AtL}UN^DrsN=e!k)4vbzMVnEoyDO+P;djB-81YQgR{Q^!`!&D0SKz}nX||3 z7{f& zro4Z>3kVW`oWT& zWXY?_lKWFx@<&*bm3=I7zUxj2JGWjLDz=@&8Lgn2+$=O{MrfqH&h2oKYWb}2l+a?V zkD3#m$@Q7EJTjnY@{Z(JJkl+`K7nhjnh@$7)F_2p5N)U#*V2Bg4)Q zU0Q0C3FiV3bN(eXe28I^=VZeTzkxc8yxndSo&-(YdOQxFWo1XkayvY_n%d##ZmaX? zYSj+Ez<^HK4q@jJ^6*QjLe`X24Hb5NObowH%Rnvpe(IKdUvJ58k(j^#AKH?KSE-iV zf>!*0qb1*mI<({+;pCS5eb~-+?p}pC2GhYEp~y}rZ;w;o>g2V$U7dY2oYYWi8(vS{ zbkr2Jeqc@L6%Rk==0)nH(|nD^$U)!pCv7Y}SR&9d!_IYUnn+O7mlQkz&cOdQECI)iU2x+Jsle1Xl4_oHbMiW z9)pSw&iB_s>iZ}Hso#XuJZJTusbS}nE6_SON8;3IcL$C31~u9{S2Pj#y`Hq+c@1%I z2x9`Kys&l;4W+vxv~Bpq71%v{lOtUjrwsVs8LoprI$>sRpzCsV1)iAmb39vbdCyiP zWPD%Y{Sz=s)G1s&;E<3vN#W`T_5?ht@G}!IN_?#Bkvls<_KON18~{w+qwvBcyh-6h zlJJ=dr#lIW;R$8W&_oa^d^;6kSQ762E!prSe4OGRk%V_s_*qH#N6MbFlkjI1eohkJ ztZ=!z6=bhb_^1G2YKp?oO~M~j_KZ%#H!1x5Bz&R5FG#}ASNNDDyg=b&lW=;>5;x6~ z@Fx|1VG{l;C5LXbC59g=Top>lctPQ~sbqvZ74AQi;^(eZxVmHKV?<0>xOx^i0Y5|G zJrXcV99O3FO2S`Jcr*!rK;fq);j(yRT(%N!RgT>Cwkaqmy7wCB+ncND+& zmMRhg&&)mrkmjp17 z@QvnzsDKy(gbyuhgr6>^-yZzIRM~`n+qs>%ZPv$;_GG*=L`9_Sxsm$DMme z%rnHlZn&5?h~wAiT>nlq7)X2_gskfXNpL7Yed&k5orkq6^9kq6^9ktZL=G2e5<_!0#?M~u@1 zF2;KT7vnL3i*cR6#r%-K#XOV1laJ$=?TK+G#DNFnH<1V9H<6E)yMEde^Mel|;W^32 zam@Fe=K~EPkZ?Mk4L0%Uz&#RgKUHsYC zaSjoG#>fZblmug8-6Zg3@N*Y2 z@2!G;T(I3;#QeF@P{;YM;bOegDZu9q59Uep86~iDO}m2mu!{7oHukgC!RM>HLi)Wq zgkKZFvqN}{>hA^lYblMJFdiov)OQ`FanqmDT@~jZ(ekWc%kvo>%3m+^^9+gdlFuO- zl)pj9uM+l1&h_>N`9>knp4Xfsc@)T-Zv|2rj-%0v^GvJt@XVn37Se}Y`hP2NU2hX{ zUGD**XECL5^J(ob5PBLZjhjMBYx~(wZT~is*Y-b5T-(p{1nT)u?Ekd>FA8ZF+ppWz z6wOK9olO zIl-3;j&mt5t0;l;Wej24D0n%gakGxnC|@D?Cc)vvR_sRdHY3v$H9J=T=t7>uk07u-Z<&h{k2MP z+1^IMWqW16l#>i@Hc(pk*A~HLdu6{!`(?jK`(?k#{*wJ7?cYoFqW`7+`vfniG;U#caJjb&_s2|70NGj8VILb>7U+Xgq_RD&b#ZA88cL-iU9QBt9&hKtJPjS58g$vum z<7YU zNZumk<+wg37RZ7-}>%8yC224H(7=j&swr-I?0x5%rEHd9+jV zQsO9I3GzHY%og&J&k^;m7y9c3zeDgw;;f%PF! z<75YMeIBxlxIPcz-#|tE@_HdgHsHg+6NNp07JQQ6*MS@^C@=YMX?{jtWJSz+vS)WR zA4qm0pDg4b3*qOr3-n0&T_L;=HB9TD9>O0Ge2TEAC4>*8TluK}Y9U`2!uN!5CnIQ= z)boA8`J50XJ7fm(l2?cDCj_5ni<)(;L!d|UiV%K(2!A<*e;mRm(nlKTw`+tw+e7%t z5I(k3VE=TX=j$Q-cnBYOPHH`KLijx){C9#E3w!!y1^Ol562h}Prm8_Y2Vz!rup$S)G|{0SP%KS+7h?M8kfu!F?O ze81keh>xZ%j>qdLjT@eeSpP?qcRg*H^ZluE#ruFhT-avRKieX+-au*Ab1}(pA&&A~ z7ozVe`7tE_l;T5(?^ApN@mGkWe))OOua*2{l0PEkKTB!cd_ZZoe;Uc-J}#)A@0H;` z{wymlEMG$V-G%(;tcY31mHaH)A1vhM{mBtZ{(9QKO32ImmQ$4c=VEko*K8KUT<>3qDTp z+Z5;di0{jByWS-I-z0hF9}{mDdd3U=`vspM_#29Iy~hQgDC8q_y~g#{(|!lV*^hjm z4doXIJ$#>y^;|^t4J19-FO!7)D5d{y+8-x4>i;8^nIt&Q+icHF!BKuX`RzKvQJ(Fo zB98VHk#5{9QSy(`{%wMz{$EnN)(9@``Lf_Be--WDE4Z|0J8`sUG8#h5<4XRgwEqLa zQGZ`L06rx+>Ytuw75zkTl;`^kFAFa1|Fz&K-;J)fe?FC19?%!_2(VtULF)agyJl2ap;)=^K#Sas| zQt9bn#T~w{i2AQ4hMR>-Pv7=7vqACs#BWvnB=Plv<9P)ycMFd8?;`oH5@&npGR^s( zkVpS?qPTrV@!rILs(3E(*A(Y*_b0{K{~stmko4H+gzfQqDmMzY_?#*(+`r$+u=_m~ zPs_ACk2tm$^$fPyxmL-WpMHeADkYy!@{NiY61UI!2X<~H{(T`ojTmlTQuRJccK%Xv z{xQ>|N>7}0olx@Ecd!}%R{VM5?P%Py-@Z&dOY!5x&m)e0L;LxB^isvglRbPNmF2e) zuNC@hfn7rVyG(J8tJ@XlxcZXf99Lgeoa5>d;%JY&kF;CK|DNWNeS+h7xuT{10;V)aFk~|-&A}$>3N?x+d0@)>-461k^Adi(m#+m%X55AP`r@zlq)`! z_)5i_h<`=!>BMmJ5OK5z+lAkg!R2wm(GQo=eY7V9M|t+!vx1}iS4jSO!BL+5c2IHl zTMKdY1KJsfe_Y-Z@~HnE(*Kd-rF1{eqxqZt+?RL<#qT8Ei#XTI<6?y3JT8hA=X-Dq z6@S=R51;i2&a#-bnK=8u1I?T8(sFS;3%I-_bdM-ILh;R!rOwQ{4SFJr{E~h$NkfSqx|pb!u_n^ zD9`glW_#Fyh5gCrKRt+J|H}K57YljRe-7ObEl~V6;+HG_F7b(q&!GeGbj80(e754} z(|ytk#h)Vn1;vNZjf$m;zfAW}?;y_YJ#4(OYU}FE3U6OTHXO z_$=w^tT^jAS8>)eP;vI#NX36c`o}5G`ll<-`ai2U>#tG#pQL}8;;jF6#iMkb{gUDt z#J{RI-)H%@;yh12sW{J*&niBE^z-Mo?0=4jUn}`bNdAc8Ly7-G@y^84>3o*;k0hS0 zIQu78arV!}inD)4DbD^Gr#Sm(y5j7g&nnLTnXfqeXQ|@spVf-9e>NySjr_1#arVQ5 zihrKuA61;?cN53?lRvw_k@bR-zm$&GzYrXcBbj~eIQ*61wSYcH@^2{4^}eS#-v>D( zIO;DU{VtuSb3Cv=I|`2Szash0f}=g`=W_)&`ujm9EPVw>`D(KN62VdaO_CofILgl_ z`O6jO`#6&YM?LWiVFk-H!BNj5(sRAwD8HKIKPNcKbKEWv9Od7;2v)Ex5*+30NdF4O zIo=wHb3AOK>(4I<`Gue-AC<%MZNMhm&ewmeXD;cvU+Ia_ zJikAL|5MrXJn8wjlIQ0sd(w3k*Sm6nwV$6GVg3Q}i%FjS@Gi{{qm`cTlKdnkUqJCQ zSIIXIwDs02`C^iPFoeIX^t?`b4lDWnq$i!O^VojoLy2>HKQqYMQ>f(U(EYEQ6yHdE zqtf##>A6qwuMz*Y;<1Zuz28;*a^n0P4%&(1XplToNd9@jar`bNKfFqu{cw!z zcj>y8d7Q>?cjD}y*GYd|@oy6!qImXTYv>h9KhF=JS9}}Qd#mC+PVZHGBaPoj6@Qrc z3ySX|{<`8hG`>DiJWf1|uCv)cd|o|R@r@*3sCX0cQpNWWU#9pW;`b@e<8G(o3p`t^IKR60tBSuudLCE& zB=Mgso=@@f55+mIGU$E=w~L==rQu{g$G;kOsJQ=qSd>Rjm$UwNubIb50o@Mp^~@%o zPg}0Hi1tS-UP}9gidWG-mt#E*#LJaD>#0$k_0%iQdX_8x813_X!}apKu~o@`O#RZN zI6vsWL-7vOU%M2~BECoQ0^$b+A4_T699Fys?Y9U%j?%a}rg#?Zzbp87O5^6F;-fi_ z<`wkM1ZJ@1=Vh3){wyIsQONgDd?V%Y^C75bl91=~Am+O%FJI{4n87TbM^PR*pU)Hu z`N^aMH${rq(s937@F_xmw&Lvna=~#N@lvC>AD@CxWntJZSNs*qYZQE%kl&y<$IT|e zuMzTF6+c9IO@dDs@;ekiOnJKmFBbB96rWA={64`;g!}=;_tO4B!Dk5h!;16wSXu<1 zDddkS&idaKTwdRu)SN#5;CV3$`EoqwQ(egAxZ^Q}oYN>eTgc0CR4cd~FO7oBaj`{k z8UH&3mvO#Na2e093ohgKq~J0>`;dRIT`~>}1()$wCAf?$j$70t`7PMFPW0T+s z{n$Q`m;K21;jv!Xj}K-B^0FV{tzOl&6?ypjkUaTf3Ve%2(wi|pK~}tABSebcmyuUh zJ$KpsvWmHLmsH>6n2N(}2;O&*x14kL$Z`ivbHXPclJ~xvPR%*XgG~8tDzPxZCHXu&1-I~3vB5Hi|5tBdvBID zRKROSDr**&&8t{Y>*Ou2YpBkfbj_?wOhyXRgB~!i9;sgfuZEfDzb3?gB>=x=Mpg;0 zD5$0uRM)^OQYseVuC+et1wEXhUc(d8i{|Yrsq=>0m$AsE&R3!D-l(msr2V9j zvjJk>of1|7zeWY$G4lyB_+A~-V;ddxFuaE*B!^!Blv*#p4+mf1l3F5o`%5b_#yTsL z%DU7!{KBHtb&Hqmq!!>;%0Tn!B@?OT#G7YQ3$P-5WlbK0JiN0BwksClwtrRL@Jn$$ z4A#r@hMM)I;4a(D%B2mX{T+Od6Uv+QFtZ*C>*aY;WRwvx>tV14m1aFkXc>tj1!g_m ztcSrG1kHM+5FB9y&3d?54}&!bn)L`FSYQOrdbn8+gEa`6b%78ZZUoJGxLFT_H3*vZ za3MI%2%7b9vmOR(5H#yyLU5=NH0$AJJq*?$XxF|VxP54z$uG#q62r}U7_33otodxp z&iVh7HGbcjPT>=Z&;FI&Jxs?>&V<8F!m=9nkkR4M&nxs(i3zAKVfi`ieNuV8Uf@Ey z{CRNPPgS1J8?(3|ZFTvcP+l_>UH)ZTfa}L|4V0t9wEs(GM}eiPzs45#pJ$`pq`L5P z<5cCFs6cD>j|j1UQwsa>ltkM<3|OlAcTxQtY0De!t4kn5GnCyy^>c)x|L{~s*N<_N zs{SzuVd3jnyO&%SilwUmaEkiz)JWHl=hdm|=j)wSWJg&27-y-<^K~(A!^-2iTPpiw z_t+BUR1p2w3I4VHD?;MuFbznKUs97)S3^kr)KL9g9_z5%qsrTX_#L2Q2x{OkHZ7t;PX2_B^K zywUZ~4r%}FO}4~7Dv0&tBUZZpuZOh%T@vK`6{IG~*LdBeZ9>@|n{A21R1oXOSkU!f z8q)s#blt+`Nlj8+_`4>l>VG#y{rKpUuK(X5^>53tHS+zGu=?@&{#5lJxYw3wr16jK z$9o#Oe*E4;s`%&UoA*-ru=;m})L%q5Ead!&k2dN0bHVsj_3y&T0+vG6IJN8a0-za| zTTb=M_Q!$i`hOGB{&#V(!qQs%Ukz#h$@^@1+5Ucjbp4fJJhq>zvxQ*23kNGKEN}OM zedb?;j8y*HL*>O!p&Aw1S9bu_3*6>_5M4<=2Ll@87oak5TzyB+i@h7ueKz2DD{&@b+WisoKAR z%JVp7HC&GO@2B}s$6r$$%b$dTsp{X;#`3E|>Oa`V^8X!D|FJffUqI#AAO7}2n<^UY z6O+*XtAg?nf=SEC2Q8BG=VgHO{COiVtrJTY&A>I>YX<#t(XyWfpc%@4snnM0*HxBI zmc{Q&r?UURqqf|>zIKcA|K;$n?LRl9{wEgLa#^j|-y@{{4KLgB{5xJ)|CK4~A4m1` zan_b{oaYwW)Xl1KAZ`}k?uR{0>+&P(t=zSCH6_G57k6d@ZjyX{0=&Sz{9$kB)Cbq4H6NcIZ9cQsd|hc%%q={1 z!gF`xcE{S>lYO1SQ$>#Zv)uO1dvB*Zr33mGF8{!b?2KJr{95;p`+k2Q;$D3=5?ctr zIe+S%s8gB~cQ(WK%yzbTIXmC*y6*%Nx9oGAf@8VsyL5MA7avJ;N*{_8o&s0r?0~K7 zcE20Tf*w=H&pca4O8pV1w0w=TIhEeNkoQS?;Ws0U?Wy$s9r8XrXMGpA%-XbLZQ03z z(02U4(v7`+1lrW%bsuzm`h?~Wt{V?ND?D{(<=AHM;b!#ZP2Y4kw|L$Bwl;~j-hSpR zepSV^GY0M40qulm1o3KY3vS0cjWdpbpK$*}&l%JNFFm;m80tf|&pA2j2*~k1T%X(s zQ;D$^;xy+&FLw~@8}-rI5$JO)R}S_3{Ono$*3OnQE1z!uxXx|*!&jMn*lx_2s+!l&Wa+p>(65Coy|4i8@NtC^)C2_$3cQ$)&}Ds8)EsS=MF-@ z;CN{9vY~ysJ3j!weF%QT@qukP0kN|@c5+l<%qc*b6JC!&$a9^pZ*P6W**p;93)^(W z>uTEdCiw@xCqJku-5CMXN=}98cWiey^hNibM}-VbY6Z_-<_v{?DIF1YM%)knza9Ey z4d`AsH)7)BO(kCdV0pa{&4h z_giqhJ+ZzE%;uTLr;mm5I6hxAalqr@n2F8YLD=^nLcgC``JB4ejsoa10Wv>*D{ zjy1F$V>;J~Erj?k#dbA8zv6s=F@X6P>&K>pe-9Mig0b&(Zp5EJ$!P(m+j@3w1m^TK z7za@p59u)0+re0m!Q9>++Unw0QO(@W^E$U1PK`=WLAwuuUL3|?pt6Sd<1jC z2VgI@={Ot{&?e+|-m?COc|gotc0Mrk7Rd4Z!1ET?gZ7`oSb==h_q%QotLNJ^e4k`D z^HUJpr`LF(qoo$nY2uw5bqYN@Qgdc_YkYfu6wT zeQ-=kCGP;oJ`VDFCiFAM-ZLQg2K0lDl@=JIhCz%-`<#EAE#SU9R<^#&3NMCVRZcpW zxXR3dJz)-<3}dqh#^@v%s}o_&PJp>^Je*TR%sB=6V;_u#Gb?}G{65TwI2YnM6`aqR zF;foyLz!~0(QKhjW*ea`oRgS+m`}_WV%uzC-Za~Oc8kZV_hG(ta~o%zS^2^a$jdS3 zhaS!)QLr%`=8tyGXT}BdhdH;abT;FBjB^Rj3wRv-re}|Z_rW~4Ba(A>?7gzla6hNu z_DI*eo7Ot7ezVef)k|-jvD-V(95be*^{k)atQmi*X;WYLs{UB` zN1cz1b6$NDY&iTSVe%sFei;BgP<>*rz4{DD_?@?{u1$A5cO^ADiyFF~4Z zdL7a`yw9J^b-TU|;~tKC)>hlj;MfJ{RQ~xJ+~PEC`*kFiiF*C=Sl6ocUG}4Xael{j z;c@o`$U{5NtlSGR3@$8-JjKGqNO^^*>q z_u6y592k$eFdlOUVI99scQ(giJRhNR`*@nO8|Pj;=R?1NkBt74u=VwM-QKQ%^Ln(y z+R%09b6*%a8uh`gz4s199{8F)x5DG2ogcwo@J&~!+wNl;yD*LZmgoTGw$o8aHXWzbe<^IRBTXgkDwg3NI6TSu@r zl`Qz>#`oK8$5*T7NWJevKX5#yiudR7oCAFH@$?dCV=>GrY5tsY2`*zNOqzU6e0)*7 z_^KIKO`A|UVa80u9kZTr&G=M#ae&j}^%eM3R73TWcx_!p)n##K$y{5?>U8QWmM*QX z%5d;ut?DY7m0VrNjA@f66#@V$a=9N@lb7|={ z1tUh>ym0!|QTZc=72UFY`HX9)t*E(v(aj~5^QYWY(=lV{(u$#@=dGAGlfa5ZQZ1)*NnQcYD7iJHP^MEm*c-?DWY) z=U=m6blpueXJ2>ARr4o|>zMHg-s+g)oTUYNE@7#nJ=ZDbB=$Zou2VUclE(sM^MZAl zV!kuzIwhRsPyJn|niap}E3OVy+Eke0@g(RvGdLMoJdYI@`-I-p+fh&~@f>k}b4? zhp1Q!Z9%Yx+*9wnY5pNfvYSAP5em z`~Yp+P=vj7*e_DuLdkamL@9rxD^AujuZ4sIE%W^1l+aopBhGyVerq8VXlb=WxbZ=Y zij%dp>Pj9k{B(?)@GcZ%l{TMk3`U|q!~-p@4)J6yt@;h$%!^A<@qC^FIL5)19Oi*7 zt-5j!DGrLX>NghMN<}@Vv$LId_7enaIC+3j6fUE;uinnPhXYC5wqUK@&N=y%fS~8( z>prSFPRTyL;#OxIR$Sm~Dd8k*!D+Ol)oGL!_4gIc;AD%Bs*^2jHC9-0+}ARblR?uf zlNDETLEeV>bbzn8l#}dRIP`Fmy#g0ftdO^1iU<3OXK|9Xxz0>Z28w5~Lf&e{EL!L* zF6J3|OMsdvxhFvTDJiClJAAb8Bqiaz$1JY@?Ig}fIxe%~ppo;F&1-e0Vf7pgFo-$1 z+_$A_BPBNlhzs&ox0^YKFPw^Tk{#<_9?;`1d_L6ZOSKvlB9-vi}Yzz>k{7sk-i-IDY+~ir-hC2IcGB_Jv| z$y(6ut&b#DRPHO9$w^l9DQ4t3zLru>23lG@x>8~PoEJiXJCV;}T;~f1=n%OJKBT|} z5GTh|H(=9S4-}5}Jys8V&W3lic<&HV*IB@)8>9V$^8!w?F|M|10T>c zZ=@SGI>?GCi{sNAk9lWDU=t@FBShElyt_A$q?EtWH6EZGZY9Jpw<>5#tLInATIMBd zX*B|pwWR89zbTZ^EjpRhqJ{5L*NyRmW??-g@xv}$pbK|UGH7?J{l(w@U~QnqsteZI zJg$&yYeNxMmO}}c(>Ph{qe@OLCxpYGcsuWL5dCLI#lt~$$0)hS9~PBF{EcopXYkO2 z$&Zs$DGv^2tT^9ST*c!pI9G4;6gk>gJcE-#UDf538+fN$S08b{RL`cc9dJ^>Nj3?^ zNSVLU?bim_DTkZVK;@u^)=_d(fVNWd;Q(=RkB@xgv&eV02Hp#9dlYjr81~hJsSLLa z?BFCf657qlQonbKYbn|2qj{WM=c8&)ZuQYTPVOdTW;<$(ztK+Q-YfQ7UByWr0niua zoaRn}dnue`zo8g6r-)2I#_8FDG>9Gri8XVg`qWUDEGOW@LDpXC`?V2 z?}8Ez;B7wgdy4x4I*K4NDRNIuwd2G;@8QJffSgQ(%;r%=pV_L4R`3VDxxWTKsS z*jsS6#YuLYElsNYjqVgSZwyI5r*M)hhPjn>^YCxOwL=jpEDaQMlC{CDE>6B1NS&l) zP*f6AEZ zE2?8r-i8(7dEZ6>?>+1*D(2*FLROIXUiSqnk5Q6MPjO=Jc6Kl5lpXatWp(e}sk1u^ zo}h^oI9{j8*_UO0Cfes5_$h}Aoypnoje>5l@j3y`bew2^5V;~V6O!qHbfkylv~yjQ zj`aoUQIHKUH}yJYW?liw3{d7|o@2Ci$b*Wzq!;#hU~JE!Am1_SM0#MNQ=V%pxv1yl zZ2X1$bE2RCYeltLSQ+nh&IZxUOlwh>j*w%F&KwP;vNK2!KBN;>1*)%vmn3wBO1lU8 zx)mhsc0bo0nmw!g?9A&kuLF%eP#7(Q*EQj$7fNHIH_BmSSh7#l>C+K&&IJ+ED0mYC zia1X0U29w;?Ktr-u5lrI^H^|NUutv|8$G5c+SV^>{B(Zc4$J#CJUly!6nji>@Ij|mGP)iGlaU! z?BsJf$AKS2iS!7>hWVa0bq!BpG@4vsop;~Zo>=pUOcO!y+WWvo>^yk$GR0~XzABOp z7L9@Omj;4Y_B1a~_&$97JI#!d7-)nykehU>mAOtB4LOmWk<+e+U%N`is zS@Z2BZ+l>%O&bGcvI!?NOPf%bT2>ttj8y*vYOyUdN!y0`XuVC=pfH3tc%i|`d>^=n znK?*sc?WjfMVN}LK~Z=_-7b+e`1XQecP%*fou$FkiI(SGFa&M>AOrv?5^ z;%!Lu`~X(wMJxF2CX?s@iQda##S4aFWJc#cjSsHA9WeChM%eUx09W5MazPy%Q`BK9 z`(Li-OaDPV7^R=wp5EUz&9V-djpCa+cXa1H4YZ?M^%K~f8@b0h2wUSZd_(DZe}R?1 zvo;=&St<`OHtTlm?ALu`U|UpFSPgzwZQ3%B<+NY(bW&%X4ntIuAiBAGI4aC zZv+mSJd%DT5=g&=MczmIGXDW<4~v*;qHuVICGBP_9LQOGy}+19_54oO^MH$H^fTH1 zaKiIG8cqk%j9|bVOdL)s_f?!10^wIXK_myezgiAcWw86&{U98SyWE`@!Q7|#iOMVKKsK*9{=YDk<{4=aD^&T~QJ zB|GQfEMN+?WggJOa4mWQx~VR?OV)yW?-eyew;K1`$)hB4hjBG_($5p5N{!S^GsVn^ zU%ob|*MlSRHVhnlP~L_?V~@lS1_AReC-YVixe!S| zl;~$F!GTK#EcQ&Enexmu^L>yvqE6niry=V;?!qmsD43tn&E_$nf-#5d28%N zs1TPL_@@~yYUbeq2E!^6b#eRz`{^$FAlPqb_6Pd%?M?YXNeBGSE*$ai3pwKFz5`G8 z^J0$+G#NQ6i{lm#aC#D22O4a{W8z?9=5D{G<3Wa6+FP}>w`yr07mq_hOZ&LkcR@?f zGvzOq2VlpqXH!s5o~kEL)uZ!=xELrwy+cgB!G6Arp%?5AbuqdEyM~+k1_N^<aNW$9_NGZx>t4IS4{T} zjo9~BNA5SS3wrZD(VNfuy*Y@FBIv{#_>Vm3cJ66UD68o}690q~%3+_O4v0MBwl_zg zA^;{)%87DFz#*{+TQFarVc`ibpN(0kT2tW+OUED^fsqI;X-!j!I~)py`NMZ&K5L`tc7Vo2}bb5Es4QT zY3%baukm`c#LGJAVn4uDjJ+;T|G=I^7h(JT)2uykL?qX=sN-~tI!?E!)43z&I1R^L zbJUCc)%^|}*qlA%f`Y89l1i6`}hHE36>)Fm!dXf%=5JIW# zy~np#hYol&>A(Tk0jcb^an!E3Ustp>vlp!G9p852%t_z_K-*2QC!ctx-)^Ek`7|8f z!Z#8fAN!}dW~+z3vA3z_gPMNGoJII5 zSR!j9_BP0?0DArrS8u_}oNu1sgo}3O-i!DBX@T%`;l%5E3CP|MO%${2#T0VCN|973x*?a%;(6@#R%O3`RL-U8wONEBiE||NdV#$g*=7$AA(HvAX zCsEOyWJPmW(VV%<7SvXi@jHsZfRP24+%&qve`kmd&&s?NzF|UH>Gj1E%E}yHiIG?a zsz!qv)ad8n4%WYyW}5j+&V6n>KBwD^eqA4R4=Y_mQ)9< zddZTyC1n*=RZh)<`8Cj*o1J;^a}8WN5r(<}E=IpxYB9ZeFsWp&Gno z3^HD;SX@=NsBCUEwsM9u&6!uWWbu5b-mIl6@IY-DG#R85G^Rk+%fYm|ssyphy80ES zo0io>?1Bm4%&G-YQ)R<)2V-WEGikOn>3Vqk*NkH4+6B(F^PKwGz6#^@y2beNBA=n# zYT?yH31HE(+9bDtElF&_;+qm|OnR{sx4pi45%_*VgEM#8Jp4yn&AX+fK&3LRV(H?c zW%H{W${H%>`{wyjb{ncs=r#m4l$Xt$SG@!R0>avaUwuVGjWf?Fn>@X2;^e6l9J4Y# zJa1`r^+IP}Lv?MfGq19?ZfVfz=(vPnGo6k@#g13sI^>Hg7FIL&_wg-Xb&C_^!0Bc4 zm(+<^540|Wo~=xfwpx>UWkqczyx*x(4n5S9;0^>}>C$SPV-nQ*)HsKG1LcEPlr1ka z{;6Bm0Ivvh>agz?4|Ns~a~2PWPDBRd8e;GIxsH{w^3Vq`A;2q}pi1~(u-L9qw0b#& z0!-_3(aFyLk=Z_r4o&VYGaPr-d2a6xx#oi)b8ZBA=0pm%aglxp&aIu<9nLNMN@Ppg zed+hd9_a93r*C8#*<#4T#XMO!r^C7BzD&l}4qxr`wXCmq*_QKQw{M{S{_x)j|F~>Q z(h2fLt9|#v4l8Ev6g$No&doP^V-IG)eR$M$fb#Lv5vQobxmgcJzL5sWKJb4O87!M{ zrOIOa(y(q=@Rqq#{>e6DU3hJQ3*Oa0eetiPJ(&KDm=nic%EQZgr63_`*l z=4~4D4fLn*Wep2z2~|@b&b<~bZKzsM2T6>?w20H*zaH^UIc_wXkrQs&W_PKGxwG8jHaNS_jIKPB2L{f=nPiD-M+%SbPZwx1ex(!KAko)Ybx?!D@)fsCiU zCst2M^P*kSy=HexS|mEgn>!_Xj`u7GWq2Ldzy}fyPa6eB*Rx@|pt|%m$+{|0*WT83 zS*zT1?|wH1KhdA={p~i`8Y@wAqLu01Z*N0WGt#|7(1@tl?df&tu`wVwHF`-pT6^_V z>E6AoAuHWG;Q;V@uZd<&i*^DN|9;z=6ux^6e3zNwwU6`%8@_eh8t;!T)_ZldpVt|E zHznFHeQh*jG61`Y-Vx216pc@L$Jtuh$gtPy46SV@K1yM^{e?_tQgQa7V9aY)rcM zk~JDUm+svSUIdr?%#Agqdq03qNn!S#5jQ$8<0N#~n&_yfqXWThoiYB>Z%_CBb!$R& zx!&KMDbcKV(Kqkh`gF9Dw!ofZ%5Wd zvXV+YX-b{MQr>}E(Sv&;HkFy~JrjZE{N&bufnDC-2)O0BbniLX1t;x~tbsmTn!q_==y#wR*!%UWr?IB*deE&$fnS5wfG`Ao z$MoqCR+xP?4D@vAuhP50h{s=#7vlMzPi8X)CuhIX4UnF3*wezkYljg9dhy^Z$% z2z#I#C8-vXni_io{CeIRn}^jMUS*X17>x5?ShdEVOn8_=`0V#EeDlap< z5%hc-49#=A@2`eU`^bRq>E4~Irg*2I>T}Y)PT;yzP_9S1_iqp952NC8pg)1q5C=_Z zQ_`ov$UkRow0-RIXs5N{_LafNVpn%c_Z~+{?=>ivmG1orjDSfGym^gL73q)^-KW#c zQKJ+)XxGXq-oZ3zDTdQD?AymdPtAqK1q9?tl(<1pUOgMYNIy)S|<+nhWrF&0B*F;Cet^lD7Gm4%8 z42BxPSGs7PXy;T@9X?=ZYm z62HZ8zN!hb>kK!ak^~S^RfdZj>6CjKP6i`RV5hl0fxPqa1ltMX;k3}^;n`w}#WUxB z$r)bKn^UcfC+d}@JSW*dnC}H&GmzrIll^1mll^0PvVSa3_K)Ss@nCs!JXmf%6v1S| z;t7As49{G>Nn+Dpit&Xxp8f19seorcH%q|>B(X|3MNj3O??Bh4;%|rWz9Bp_ME{>d zEWP7o0;AsyVxz&_n}Afl(I3nk z<4ONq*mkjxiCKB#FB?6<_^Khk9JZwTyPmbapJmN{fX;#RS7+^Um66L{@ftAjGwK7%YNA{xb*)% z!DYR#gzy%@rG6Pd(*H7kuBNiM=^^@2@_fOi9vMF}p6iADG@*Zk;8O+PD!AGde`RFobhiT`$MH=Cecel!tJhmwG{auO%7WY57U<0#e5fWwDWpOx>9&W}TQ7U;!A>+d1B)SqR=ldd~*i0g5|b1(bnGLkE%E&GQ#`w8v2j%08% zo6@Mqe^wqCpC_Xp$!ka+^+S-!Pi@av z1ee!w?}YH#bSn_;k@8Q5@Qlo$UMc_05PmF#=XFS}ry+zt9m1WCsr5_@;TuEvUj^rL z6VzPTDbO$ZT_OCJA^eJS0zLB6v0WkjR0tnS2P*6@spoFNUFS)U2v2=7C`@1o_u9KsKU z@Lt_g+g~2SUkTx7L-;WI76#hcPx$j8!Os``qYyr?M_^}yd#7&AJy&jwmnrT_OC95PmI9Qd-XwA-p#YaxH&N2)|wM3xxgehwuw&(4u}R zPlp{R0(_v*L(`t&7Yk0q#pkmqkHW<8!9t$8#g~7O@-Cz;);kE&n_!Cz*M%I@ZyD-1 zV`3p5NZAtQ}r$#0FVjBziS5}-e2tR-1?_)H@z-d7tKz?<{ckDG zpT|6*_z~KFM)CJ(|0Tsgr2SVFKSldo54Vf^<*!QqH0^UajDLCE(T>jNSc-e(f&6CNBzC%dj287QUCMgANT@*Sy=y4lHVmb%JV$(jNqvM6_S5WaFpkG`!B&! zzB~piSoppN_aoc)J0<@J$^TJs)c-K;9}^t)zeDox2#)f6y!cRXl%LQZRikA{!sCX6e)rzkozFqMq;?F6*pZM#7 z%ljdJBhKx8na1Y{!O?GbliyAWj(+3gcpAk8$JJ4ij|q|Z_&#B&DDEU7VKd$&m;=O2GqJQYtg6V+)#99CEXr3t$d;m!PiQ;Xv;5bfs zo*6GV%8#b|m_>r4JYNTu3Xbx(lRV!~W_vEB^Rp@?|5K8$5ghfiKbI5d_Ktx(Tpm@t zzs1fAiu3W}b;W0s{NIVQo&0%88qF(Mue`t7g*eOqll*+1;OK{ublgDKj#UK z@;gX=nBXYCla8DCo(f#BUX*{2JMSr)8dnISmJv!CY@=k^XZ(vDLr zc$^q+Zc%#Lk)7)W$9mUNy8Y(D8@)c#EC$6leJ{#M#g1(m0*0IQQ2q#n}%PigSAxDbDlo z3dOm-cPP&7eL(T)Waon+{1L@RkUSsfxxGA({aDHKeDz<7^L@PEDE=AJ|AyjM5dVkb ze7*gV;^Rm@o#tt_b0Tqgos3zSPbPkz;!}xVOdR8(FU10GE>-fmG=3)tj`8^f#ph(f zF+Tlx5FF)Cko@(6qdbqtYQa(dGxRyl0>M%KDY9po;3&V2jnNLzW-HG36{jk`k>slt-$s13;(LgHMe+T_A65Jy@n;l2O8nP~^LhI}73cHz z_H-QP{^~<v z#H$qN=b;-FXFb~#-$r`&5J!LZv!C5hc&}o&PR4`v0rs|MvvP&#NTgQE-(1 zd=FT`(phlS|67ueEB+JWg9SJBlAe6Q<@vxE!BKt`eaKuWILh-pIaP3!f1l)w1xI;4 z@0}w!%3nqwHkJ#H^1Eq1tW~^)+O?E8#wYgI!z8~-alU`GQR#V^^lVe|t4Pl)igP@- zD9-W5ul`|s)`3m9#OXNCe5=Jyq2iAbFI9XG@fyXm$j%Ll7ZTs5I3EXhDPBYJ2Nmbz z<59(%NdBbaj}dQAan14kGL5g^ivNxH`HKIZ_z=bUxzEoij^E$LrAYCA6JMlwcAAyH zOYs53?^pa%;y+Qmg!r!%|19zUR-D`QH^upRh7S}kCq3|6I%Z*i))PNh@rA@MP<$@& zLBuf*`&*S}JzB|sp2o#^!Eu~EMdP$ca2%&Rzm*D(@?GcvGh1+!Xa7_Qj`F`J`5M7d zp086H1V{O7y6L!FaFl01uM-^QCzAXI!BL+5zg2L&9x11Ien@cCb356&Tk&h?!6 z{uSaJpUWuTzOOicKD}S@+e!Y{ifD7Ak&#_KOtf>&J4z z`-AQtq`yXSj-PtPxxbbx-iP)#2~I=M)UZ|Y!BlUP;PN@W9g6e)gk6I7Asx8cqd42M zPjEVPnNsX0_CMQwP{`AiWaJMk&f}*=aQS)GF~!FlE$}@%!Q;emb5e00R}S4*Ks);i z`IzGTyE<8d_Y?9x6kkPoeBTB2pD*MG2zlh}-+aL_et6;gG^hu80c>$86!P-8R-`z` z756DV-z?)N->P$v%Qz_&oXa9wC%Ei)9`~q6_U|h~KA|54k5d{qF=`*`=_~kX!TSkb zD!BCXa>1oPd0e1=>9-$|Jo;Js=Qn~&|8$}229%fnk>5v?{^92tQC|Azn`yQ&$fbV{ z3mzBk&7<=Ulq#D>7TQLOaF9;1@%h*{8(`5AOF|3@rTwEemI_gY#TG^XZMqS z;okhe#$n=-&YS2 zG47L3>dGJH!}EKmIBs8J%9b`%R4#-UDl9CUSFr$oz25wiecs}_hU&aY*UY-a zWcwAT`~`gu6WIEK$lCHI0AC^gPJjIpc<;iz1RV+QPw;QX6o=K8{*H(*4M&w?F6~Vz&)rD*{E}2fXtjSQ{$l!gj?X-1e`^8+xhJ ze|a9PAUPV7u!7_$Ou`D1BQXgpNRGfHtRPu{NmxO0I3{5Q$zhm;RaM@wp_m+M*Zx?A z`iJHLgZzAxZ`OP;6!Yq*OF492UHHf^u}Y@z0kFL+YPR z=QVu(i8^r6b$uqJ{_-za`5ks+>PH{z`cH(^&!5-u`7EhPsvplowM{4+TWCu(LOw3o zeym&9|6)k}X>{DL!NOwEb^SP`{teWDMN}5+&wzhj{~%C^ChGXBrTWKHdEV&yF94t! z${wWp`ML<}?*RY0{&r9}RsH;&n1B9`N@3A;MMCO7M)mU$$NKT3b6x*QV5#aaB!}?z z0En4I*Z)3H%}}t%A|vj+OOpfEp9TNA{w0u~s{SnOELiyZ!tN#4wFt_msy}w4Ey3s4 zSU-N`sq4QA##yTRH&Xq4y%JVGJ`a(q{;Vao1YbvC{W&S>pBB>o@fa+y@b!<~ORful zmnv2L@djIhuTQal{AfbAe-5xz?O#sMt-NE^_-kF)b&#VO3Ljf$i=0H|uweZ-7IghT zg~BK@4F2U(MbCNENeF3D=WlxhKt|K0FZ~*oKkXBn;PQ+=B>(e1Z+}70U3^Pkq(G)F z|F01Lx7=(sZJ-8Y`|-L-w|`s;omle5A-IO;hg8FK{YL?4hUMTjKW6!nyto6RW&Z>q zRsYpA+VZghc8m6-E42Oiyq(sGB`%nTYxumN75i@wslR@QE#E}*FxKA}{&oFdr}}xG zv!xv8j_Ee_cPh`EZRKqfWMEpCUoy*e`tL&c=kk19x`gUyeY|bNfelNXo^!W*$@UKjsXzY- zTSC@90FbW#S}9ZNQqBFQ+}r$NrgQ3p z>mtp^r+dw3JZJN9&)fNd7uop+Y~S?KcD@h)Cp>p2%r`qh#g=_AwI828uK9!O#zNV` zQ)gE0-+{W`9P4gw@w)Fk;&p?vU3VV!a(4dN%ibwv|KjEDM0wDYb9P+h)iW!j%_qy! zL03DdKh}I^oVywPv?=Bmo;nHjwHSM%J8}O6*zp0_^dZ>xKG?HkZ7!YyY=Q4>LcKkp z&Te3Dcc`~3)SI&t>%#owo-?S>bw;2r+%HG_|9KaFZ867|&GzM320~}kj+`^D^bYxzaq`2dpoB-nx6*kkAff4q2JmypIPhp z{f2#oeG{8qc&aAq?C!Sbs;7Flc$-g%zB}UehW<)}{)+BA1^*vG8v4oD1br}KEBI=y ziKiThC+yqa(67CqUwiuf+7xj{92tjwp9A^bL04B>9{Tzi`0dT}Z620C8j0Qg?MUor z5F>-I-TUD2mAAfC*gU|E-CYxLPQf_NX@QtX)$e_w-;Yn91Z|xNZJyBl(fsk?1C0Bz z&EONi@6UQJ_{VKNk?ou^V+m~ISUv$Ui|uR41_u7Y_&wInIW@p3JT=yd{S0kt0=tj2 zD|`yugZt$Wr!COO@U^R)nn>ZP+aYdjTeEk53)+G*Xz#IhHbyy4pNF@l;g~y-jW%8d zHoCrzXI4Jjd;;S0`1FX0CA1^v6h74#{?R_LbI=B;H`jF+x)G-oPNj3SJ(<9M?K%bU zeZ?D(KwXVsR|WLf@#$khH`e*$4zSJmQ!J@S=88!akV4O+1(xDsu#r7`w&;h!M`|19f26(xH@TK3+D_QS8<4| zKS13tnz-r)vKWKCAg+2sT=nqds>RF|oZo#A##JzvO#oZQgH7Wg4#t9w*xr{!dsF9| z@$;f%;=}k}#K!w3He9g9#>Sg4HZe9}ZaU?b+qnXKzUi1(cL!&+{Rw3-Hf*%GBGd~<|pX?7ahO<&%S8q+|$F+x9y-EF=$VF@NGuI z+{pj%NSM^XcK(UodCC zXvgh=8wyXgz;UDfnQ^b>wlDnGfaqOc+X3?d#^*O-%;m!`%JC-?13#1bkKF@KTVot_LAkBH-E#96W4Lf0q_+$?hadJGBb)ETBDOn#NO8J}C z6_>E$LSIWYE3OTYuaOdAiuofK*O|e|LSM_gWX1E^s<^+eWhN)ta`frU?YuX}7p&sy zY68^O>IV2lN;w%Qu1r>3*;d7Drs&eqeqH~|T^cCT}v4;23|b!oEV|D^L+ z8yw0x8Cd*3={(j_K(0u0I^Vl`JMRU$i#ae#eV-Lm%HQab!@5~Z#L3^zYF1GxWWEAQ zXg!?IqXPnrlWc?Q)NnEw5=^*!=wwt#60TFi$-O?RJV?ny0iu+@39~pDSTi^|+t)Im zlYzxEeT|d|Q_L=Potc~rI%Xax1I07is<^;6uauK>d{oWJKrvV4>kqSdu&-qnC(C_Q z#mPW%(#5-0Jf2F|($+>U?==#2ovL+|+#MiF`I|7^T%;{gs_lWAef^YZts2*<{`5s! zJ2^gfDC2gL3 zxHPnj4DmN%t_X^h__CDHMPkIchz(}m>p{7nqVAla2q#51aFWNf^(pU_2W2VcZ?xTm zDTft)iZ15S0gd8h3u%L)!^xvQYO~v?`bA1O$=bj?P6mow?HtnQzsv#70E>vRHW*W! z3>3F{(j8CQU^eF@YlA6)lY!zkA12Cu#ig8NZLaeLP6mp(8>v|M={tvt>&)ULYjd3i zoD3AVI-BQHm78d52LSJFBMPyygOYm!^a>?g0z@f)qvLiz<#17Ghc8PBU1VQUkygFM zjjE!esY9JI{f(}84CS=Y)^%E)@(W3nXKm|E-dpY~DyEdb(RCM64tFwit}jc8up;G@ z4}sR!B7vVc<(CYr<^MXv>dE9Se)HMwp>6pe6k+YVNNL2mCyUcTOwT?<*@t~&X8Tr9 zLOYg61{Vd*F;2JmYOZfh4d?gwi}>g4n|xH&M9GH(L@9rx?cNsAqfyvK*AHXPe|A}At7&^2kCE+z)&Ih67@+Jm}? zwTBgy`ihu@D&mZIP=u4^KB}svWJ7=&DY-2`l=3&)XwK;47b)RnoDiPGlx*j{a-wj^ zPqv`4k#YkI+8iH2M9<)4m0wpiC%H~EYQ}cn3ufMGPO>FdkoTGbjhx&;$O_VqzX|hK zoFpK;I61&aY%GD~!#x)nLlQPrd~r(Xx;fwzOYvSIm1;x4bEKC0MXDMp8FXB$jY!t= zKk0tf!qvfv8QaoCHnrjMjkRzKUtK9Dclc-lCuMb|DXJ@_BK}4XQqJIrgfn1HKI~Ul z!%11)tQ6I?diKoKaZII-OqSxUHhKVMuvu-mmC=WatfH+QTfDc9Xd5P@!6eF_wTgJJ z>eDM?cf-9)D(r7`ySZ)-h&G&tbCJN|tzI>7k^k!qn?sIiq^;{L^j$>>?Xmws5mq_I zuceri9426#ECaKyj<*Hf$cx z-e3zS>#0&W+2rc|t!_B0VYk^K!h0O$Z5V5;h%0ZyZKdQQJS5v}ZW|0^UEC%p!pVb_ z2bbqru1(LOZ5yuGS@CRNO9>|f#ns7*TfO>V#XM0#%y2SLT$!x6)tF($#lFQeIT^pF2feI;dseKxSBQ`FO!S3dfO_wNUMifF7p4UwggUY^{C9v|AZoLXZM0m*-@`k zR`=eWI=i#rag<1!J2^Wu^Rmp(z~e*S0LSap=Nx$Cwm&4U$jk&5gtv4iNW7~9jbi+WDZz7l?cBNlZc-7T7&?Kti8+#o*=x-z1m7L{ObW`Wr0kU=}} z6Sn6-UGQxVze;%C=bUWNWUPdptd1Z%IUDpuM}yMNeje<=?~_tqCgx>#h1OjJmgPi^ z(yrZXHK3)NXvI*duRGd~i5};=L$hafpPhMq=5?T=X902e>Fc4{ona2?eb*WnL@?Rs zi)&mb(qr@39`JJs7T-6vC+3_-ZI7aF#`Hw*z%)2&JL5vpU})7vqE+mBta|{o&L|%k=(5TO=@MWumblpO%P4loU}1F> z{c;I3mmHE87(6)}EgVAqY)a-+KbxJQLG>6iC_F5M0XCe57dU-7{(tP9dwdne+4y(Q zo;?JTV1RH@Kn{oq$R&vhprS@D8p16%E?R05l0YJX#3UdHYUHAzRzPV*>jf)s3zS+^ zs)(1yOD(m&Ev+|feQQuuyuBiVf@1kS&&>1e&UwyRq4s_M`F-B~B)c=;dFGj!XP%vz z-E+>aYK6+1?RAW*K#ptmI0fxB4135I8}6A0>@mVKk2?aQ)>!DMFdV^G)ohTW!ijdF zn}CMxg^o&8dt2>8YVWAMe*KQC!V$G^qxMN^-&XD0seQ8Ar>K3Zu0orzE+aHtQA_Q? zopizLOsK*k%ZnIym8MpwMriZ4zozCJbMu+vJ8*@zqJ~8)1i=-QC9V z1D@Luw$m_xb+IG1`mvNX9wTk+B$c8fNp{qaw6jO3$bBf5V(ZVml~}61UZwmNG}`U$ zZGPkwdxwgk5$%q4i;BFC3Od=lRODlfbhdZg|~O}`EN3;)W1W%PFQd{cBGYxLaF$yO%1Uv z>DW3e6>XV{E~!%xruV{Rtg4mT7lO*OlI+wB2zN$mZ?x&LZ~6yo_S_G_74W-^)?p5y zM<{}Gh6;4yKyL_i`x>QT3sW9Kg51!H@)xdxOAf#jx|X z?nCwItUwRDz=7LsJ?ug_6!x%-;ZV}UE`md`)pJpdEe1 zgu6#^_cZQ2oupXlM1M%#0m;3T_UAB!OrOm4sEkhLdjDj;%0HPKE`&i3x(Mvvkmm&( z{qwpBTcHK!`{(sS^b+Vb$aXcBp-=IftkltyR@sk0=)M>V5jtc$N_u>l_JME0Lu$aIzymOXtfoE zqw*V=%&gP+ol>fd?zcy{ESScj*H^>DEjyW(x6 z-D|z6O<57oc&qz00xpAJX39QxmaPdTfbgv1`0N{;1d=U@AUv`zK0CfoT=(pZP&%IO z`faN2ZZ&|=`THE2j{595>@$5LK96&xKKp)$68sADZkY!vZ*I zh4<*w=MLaX{5}Y%vtctzc0WrEA`pTtcHrc3?{Z_b8i-=r%|4|nf2!O}C17G1{8M+f zwa-R^Tez)_9XjYjqqGd<9c@?D>Jm&CY@Qk2%?Q?P8Jc*wG7hTL)m;WA?#{1^AqYcy z0zveIIF;xLaS%MAXIwep3DkLS>dw>s+DQF61j`QhSLdfalp<&u9UfrsgNkz)yHke; z+BoZS7$;vHKHJ8@S%-(%I6CX_P*nh0&I)H5;Vc{TYOcdpDw0ekS!Q@xnLk66`7=bB z1;r`ThRgkFVWyhgvQP(ZQS{Tf7z)o+W&7PbQ+2Ny$M*X13e`?Cj~;0*|5 z<7!5gcd6Y$X~b1ce|ygNS<^ta6Rc=*tnXOPfd9rWXbMBO0Fx8bDmY_HLN~*{2-0zS z!6~UgEoO?H<+~xvFgWXYgY}G>#fsD{ro~`JO0&Aph>_CsTa2>MY8Wi^;^j^~9H?c` zG{~pdjW1y#skqltV+<*^ut6707xLOWUopJ%6&xj0KZIXV*DI+wbLo?7m2v|*xmMZ! z$#t{67jo$nxdF1!)a$c5Jn7hW%1_%5Z@cgeez=3$^fZQ*-V zem{P%jTIh*!!mC;z=nTecj#|d;vn7ME{q$ZmB^k{lz<>gz`-A$twFyw^ublD75=4- z(oZRU6}!}->Qxl#-tQDHnAR0xa0y%j$BpvfAy)TGW5kQpLYSPwSq@_$_2g3BlcPX7 z9qpX1yLup$rMr5d(bZ}->r3ec>QHsHr+YP{8B0xF0sCHl*FJ4_?bAlrK4b3!$)VV; z@Nex7X*|X~t1?)r|A~733cL3IfE{l3WA<=7PPgrC`dSkgHufXtwdSMtkr60^OB;K; z4R?kkw_zN%(D|OPY=S8H%4@<`UK76Zx~it{D{rW(`o8g|%0H-@>WBs5Vj%pst)H0P zgbDGk^RC_b-*BDmo2j_)0U9vx1fWK?2RZO-2qsxj4L+5!Lh3PzR6Y|gVq>w*}CMltzSgCN^ zkUxpG4f&I3yO2MLriO4X)AH?AUOic+sjxpl=*t(SHbW)(othEC!O4ur&T*Nl8h(1F zs)`@aQq}R}=cp>t9G9aC%f6G09nKBuIc_6>-rHcO`t2!KR3lU@1!X0j{)hi9^z6U<~dZC8nyr(k^kC;yOHCxCfjNJSJ2N_ox=`QKQuO-Cd)K z81z2es^qNz0^vI9=`SEbb@FizB&SoScIChs5Re0Ru^PCG;5rmfFT4t(^XLY%;Wro! zUuv93OO119nQ`tcH_n}#jB{tDQmTz}vo=m9HYdEsn8nxlYs@wN8gs3G7hYPns-h{Hot>FAqGHzYjEt(R;lndV zRAgojn>B1!1q5bhSCp6Mln=`&ugaP&%fd zbkgKWVno$KgnF%U7 zdP>pMu~|7e@QhZ`UTWL;ptc1hOnvDajiQ8_p}(a~7J5YP9O{Mh>Rk*Kf zY=Q%xB36l2QX2EXVy{Z@OXxytR%ye$*}f-Nz-eLCE7s6hTG6yHrf6!c;tf?z@EeY* z@_F;?V`P+V8fq5Isah1n@xjZcv6La=sn=K0Tl=?bf?#xur!4Ry8f`0knWXIbF9^DOS%s(I+lmFUT($m^Tbfs0e>{1YIi z!cDb}^hkJB^?)?(z%lxiEp#J|N1gjMt(q5W87xQ%dgqp}uD;YuO;8ec|XN(mGVFHWbrD4 z{U3jVS2dM3Evomcj8f*)`k_x_G?-~#f~s;w`MlCf{}fY9oQP04;ekL5my1>FU9!60`Jt~ z7KQ&o7=UdF?n+X6=H3xn7yfbNCrNjv+}HlzH1!D?UfkpMD(%WZi{dUXrDxiGp?mRq1?#j88Ej>^EAaF6hv>`5V2i>f zv{jbUv&^d>lzmtGyVHJ}eqWb+yQy!vA5oI<4n;gdTQZbv(tYjjO;PFHPzP*yI~2?)*wDsBjSY2mO+)85 zHVh?IL(9t>Dym_b32zRVzi=?-oS`QAf1{SP4z^&Jtshd2ZN^hshu}f~I9fD94DN3$ zUV$I)&4l&s{JC1j3Wu$>kg7N5T-$Zqbq*zg4Pz7Dv23?(JLjsTtr2JI^-G;st)2O< z8*$R}oq0(kLm6=y?yymnGb_~BjyN|$j<2nxrpSaysBcHNZDe9(sdK~iO2Z0!>EVcT ztP@}sY+wIUU z)b})ZOyrb4k8CG~(RmEOpNt2ZiLjgCon_)Nv8# z3rKe{#UuDU&148;e8P;N}shC7d7X5m(TMP*4XvY4*9N9dIw4;C6`Q zJO6ZEcniZ~Cr2i-hK z$wv2g_AJg1ILDySyTVHg;l$f>jZ*SE7YxuvouO{q32u)(@VI<8iar7sn1DU<$~9Qm zU%B~iT4Y(o`Rg@1!MU7m5QoIw*X&fM5)U5o*d8XRu=V+I$s2Iuig^o@mYA)04=HZV zP~3dmk`^gcyjPt3C5rcsSMio7K2dAW zgsw`&Pl3fmNAJxomiI2)E}*9)l)xK%WEr52Mn9@`AP99*-0zn%%J`7t%83+FYiJ0a zqssN|uhyHu55j*(!ynW-8Q4@M@At1->jM9a((m^d*XJ4~@3(j($l`Wb$@~4dTx07g zCGVeKQR3Kxz7~RT7#YB41lYedfaB-aiS#dldM4r@Lp>AmwE_D75WvyiiS*#l5)yH= zQzHK7fcjJi$m6GWiS&FGP|w!`IO@O9kgqhjslUnK=Nt038ho_D*Bkr-gWp48StfPAdMqZF3yWt&KD+TYYOB0x`W0M9eHsVB+c=TR6BX8ldOMM(zh zX>zmv+@~mN)}QN)oWrQcl+VRP*ra~5{${z;wYY_TXzGa)m;Kw9xa{9b;#jWf=cZqo zez?()znH>!*k$lh2H!_vS)Wgc%lhy;z_321zwt;e^>BYlJzQthbCFS>2^2qilaiPK4CWy8X zM?GeLr4g6yW&6wan(fM^ym;WUq#pKXsi&FpO1njgOFeywOFfl_9&=n>Zg8#}qICv0 z$JMO{H|@N`;O6=Gg26ALFdkl|u&n=E#AW^aLx13gb{MXMYM*Oxwjm}I82nO0o}Y*y z?U_U}c$2J)Azx^4<0}{HMF^OL@+NnvT*%k#NKIntV9imrTUh1n>_7_$azGlKOudz`qLMXVdR}q@F7R z_}T#eLID3NfDa^x!*bOZqqJH4cO3!8wKQ)}81g0$(N9KDkI8cacy$1O*x=?npQE(I zNBt%*Hh2%NBpkN}a5q^Cp&nEIiU9t208dLvtfwY`?+M_^_?>XrWPL6S;L8K};{jZ~ zXfc8QbLf&xmOCqe-xa`L4&cWFcouw>88=yORRCWfzz+uSb7_J^{XKP2YJYnG|2Tk; zfv@V~CiVO%fa5oP6Uq0aOJ&q^x)xFURRKJizIZC-p9tXiHB{WBd=4!LB)=|zzYxIN z(N`p;o`L}WYlEA2|4ygL4E31&M*;j;0G~sXoYeET06vZeeJQ^>fIk<&lWB02dP)NL zO#yso0RJ?AM`)>&6~)gLJQ?!gc9A}K`uh?eD>(kl5V!IA;K}3t zQ``#m!Q*wrrwP82_zwlYpLm7fj}fmC{6C4;3H|}``GVtz*tjj$2d|!|62C$4EaEE# z|A^vu3Z75$_X>{pZE@r4LGG7&;*aQLuRb>t-yt|Yr~$VZ^ud#VgZLi>{~hta5=Vb# zA4Akioa^&Et-n7ucpnPm;WLAyKd+&6_BVq6gUW3~{lNPFNxY-rTj)Bfr{G(O^Ytw2 z!TbKW;eCGGm_JASLcwXl_?E@jXI*9`W}CZz6tB@CC$=3%;0m3fYg# zy@5ENf6V!MyPuF>P4edmzLxk{!SVM%xD^OKlK8X$UMhGGlAj~^>BO%VJWBjWg5&d0 za9b~UAL0)RUP63J0DnaANhJS_;045A61<2wetw4=+kZR7GX?)M#qk}=xZ!w0OIj6Y zze7EJfQ(brvZfe%kpGPM6@v3PGFxyyKkEg5p8V`ugX28N+X{nYxjjNUY<5J^O0));1yk8O`I*2>ulD-wVEq_-?_c5`RMP+`BuSyP5iLndx=|QZ?4bF#M=b$G{O1&?IAdykNpMb^EXFu^_(cM z-6+9%9GEQlV^q%>f#FrDtey3XzswZz3@^4W5E`#Iw+lSVx_Zs|6 z;B5b`#92SxcC&T~PPd_~{}P-o|E+_9_f@sDtTt3W>mNkChu}QUX9_-&xtZc~4UY9;{nrvl`=EaIx7!SP)YFYVhqy<` zvp;h=tcU&i86nU5UlE-B`2)e(pN|R7{@lU%d<5&y{@hRS8IXqC2;%H-)nxy%f-fS@ zpUbd3f38+01h$1&%2ie z-$n9!1m|_YM}ogW@?Q$h^NXFV`+@Dr^Gk~0Jil}moZH(+aBlAq;^>F$n^@vVA^#1X zFL?$>KOax^o?!4Zfph;(H#o{~B>5QzM|tk|YJ;Qvw&y z*d{n%H$5#l>-mG^RL|E0=j)BniK9K~BO2A><3c{2))~pvZ`{9`Y1%-i7#z<>u1|M^ zqkrB^^1TeMGMx&G%H9QBW+&x0>AIO^y5V!Xjoeg(--HaN<&{Y#0n zeexg;x1|AmgP{lYzfAgnE#!HA|C`{ss2sM#f){9PwWafk>(fO1EaL2+)5+iR1YbbB zM)0-7=L^pLc#GiwLGt`P0WO#2HwyV@NPe5(uM>YtaPF@+1b>d?-wxm(3eNNRmxA*= z?vQ_R{dpemBKY5_+@8eI{^s`z&KB~6>3kV(aP)`H^g-GA23P(c)*X4N!BPGOk{@qy zlxKTRGdRjS^u2^17#!u<&a(}U@?Vks9D}1g+kY`}ZZBUa-fGCBo`*@#-9nz%$xjFH zzY9Hsseq3Rj`L0n{Nwh8!Li&0B!5isr--|B{_%JcqVGwx7d(%658~WjUe9L;UaM*Y z>vzF#C0;E!&o4I+XMg*Y{A#`6|0Mn&g7f+Hu;9FYds=W_xBo$KUbnv{IIq+83eM}X zPX*_7*HOWF-Q|-1a(mgYIub`a(?{{ja#0~amd>L=2FHH?1@%{k!Oin%q`^_X3w=nK zYjBijyG<}S%C8{#0)s34E+oP>!{8`?h~&!*j`D2JT7#o}1%1d+Z*Y`nJ1;Rf%Kw$* zn+=ZgZ2un#&i238;CLP#fPdV6ZgA9pG2JBIF8EEvUl)8Q@plc5`uTT8pBNnVkEfd= z#{_?vxJ%;)pQqi3w-@|9x=GgE;8-qy-}elIW4Vuz{5gVONBTz!em%*L6?_8m62Tqf z<;2;amq6LLT_t#l#?}hKS$>D$+e!Wd;(Q);qwB##g7f%b(fG&me7>g$&i>g=@F;!G z(pPXke=~_=d!tlGJX|E?ub}gHyuq;D6Tqx@jHnN(_UCGSEaY;z2b z@;8!voxxF_+j~86u74ELa9d-@qn_7#C~Vy&_|J&{Oz=A5zZCp!s?T=8`;q)}#JN5r zb+J~fA&>RXqJIBWaJJh~!FhahX}pyF&_QsvPfx*lTpA!ak3Ttr^Z0YI;Osw>1fM|d zx?FHxzf}p&_vh;c=k?oS!Fj!Rqu|`GwSsfI?j?@>(wq7O55E-hSCgMVZgBLUB)X`2 z(%{N(!&=$z4UY2VB>zW)qdfQH8wN-Doh1KvgDd^6*8hRQQN9x`T0b^8%5%SeWpI?Q zCHZd*j`D1`HZdYmAKSZ48e{R>Mmjd9Le3RgV$j(m*K8E<~g7fz=J|)iMWHpUT#|2+RyaTO+SpGKR zg9YD0oT}@6&xD45?-$%?Pb_K#3DRYaCqIEWsrUF2;u&;AJ*b=GtdBXzbA|j!isuR5 zO7Swmxjx+gte>xs>V-VV7Ye?H;(TO1tbe_bXZ;%lXZ@Q5XT2>3$DxYbxl3@?zgzHT zitiDe%R69jJcYP_j|h%qf!fF)vArnYpKy}keBMO`A3^f`eL~hVop^?jpFtddUxypZ zFVRtN9nGBePZ#p6zf5q}UoAN6Z#H;uC^Lh~T`4%*eU0F06kjhmf3K0pd#rzN(49;A zcL;f|e~aLiB)?1Wr--)-&ieNY&iW4s&iaoC&ieWL&RBmMl2yswLb?LXlc+vXgVPYD zQu+(d_RlbQH`0NJ5rV%;X}JccOC6PxC-@AK=kFzAJ!y%rQl=a7$fG1*W^h^}tCVWN z%SgW7;5~@pVWHqrvTw7&X{n@g;rj(~!+Ij$sA91GH#jY2RLXk6`F!7CaGEle{3gNK zp4$u_r84obL-6I4)?)D9hWswU%c#9<6Bpv9|L}Q+-1L(Y(uv&k2lf}_X1}jD+_cYmM!%T$xx(P4eV#D5X`k_Q{muT#^?cairhWQ{wFJtW_E~H2 zC@X;@e;*R%dmG$)xTJiFrk8-vT#b3~EK0@z^;A}TZZJI?cSvQ`%=xoR%V*APs9InR z5l@!Y4>8pb<&;k`jeEf95O|F4+$!Vo!C02c1y2&KF&|j#J&f4ISXCuAq@k*|T-9Vq z%wsmcGtqq1W{?8o!Ja`P=F>uhWXuPLY8h?A26)hTRii}~ZER|=f;8yo%=(Qp%^d&8 zT7J5)Sys)wS#`R%Vr@iENi8jf$3a)jDXplUQ#z}>rq&uVudb|0*^)SyKo5XAUFbpu!G=m48jhA!!QUt2t@@^7BEK^#LSEhOz}^xc5I_#PYFhSw8+= zFH!l25W*H!dw(a(!rwDVhSF)}IuF|!%g3)=$?{VJ?4M5Shcd0k+sm?&0_@+P%5R~Z zSbhrp%km4L{_q#)|4meW6cde2mOmcSB}4K3cA5eaCh0ak%8L|EN5t%Ii zj{*JPN(J%t1*wT^>x%*X-%91@8Re%ZDF3s7^0(7{=H*;49cBAJ3MjvSrOvR1@?rb& zx<$6XZIJ!RA<7`#++_LT0Q>Kt^3lI>!}9T5l;z{^Aw>}=Zmp;Lde`((QEw+@?+9pr z(kz`NjlL&{<>PgOEFZ7aq)yD)aUkyD_feqV+@x$6&Qr-yK7Fvx#m{SC9a0v5|0r#W zvfZxIIi?TLN31_y&&m4ZI4yNzjvtQ2J=_W;`{HafbtJKpmUhz z_e)TIPpG_XJLa4|UFYZDC1Eqpf`3_mSjje)52+YZH#DlY41F-dnheX%RxD@Oh+#TZ z*6#YT6D|qa+>_Y0$CWSWlKp-3FMc>z1#_)zkW8{p&+3(9UDe-eE^2jFp4Q@&zJ7d} z^_OoK+nc`~ZLNL3m$ezh*L}PA;?2Oke<5vSY7+gU(Y^e^O4fD&0kLIu=&vB zj*!P$3+-EzWal2m|4mLW_!&s<6G^r%r+3IIIriDAj_?zNHJhB$BLhGN|1YwWKJMMw zDrt3k3_LWs2=o<#-U84+8OoWo`P;=4Hy?jKtjbR+$vt}1v9|2`_W1U%9eYb}Rd;90 z7fzckhn&ck!;ZVncW2;wn{IBE3 zyKWkudvrsE{g?e+t)rXH$vwKilXVpHwJx*Qs^b}SeBM&={Z6le14i3x;X8dtzieY2 z?KRlCsx{Rr`4V&|xmJgt+Ra6v>xso}tgE8H_kx~Q=hQ9lIO$v7bvmi?qbXL-yLVi? z`Ms{WM<0N)-yxazonAUU*~&rQ>YN7ox+vD%&dR~~UXroCJ)YgaH23Jr8n4m6}&M5B38~jr;OUX7i@rS!Mw2Of%Qc z$6!=<7=LrL{klOJy6hJ(kmk2$>t!fBg+ z%u$b7PCs`4s*c$I-__^E;3t@Fo*y4TKOA?oubAh^w~Kdz-`e26A@E}d{5cHghr9V( z$69-Qbeq5MIr0_w@lo*GFTiKxo8}M5^ce>1gesv-PkAR=6x;Ym3Jox_U z&W?d+cx?y}v4?1u6w$tY=v}^65$z!3dW1!8Wq3xr<1{cG*`{E`XH?aIa9Mt{? zgGveOR`ok}Jm=UoE{Upfn4V;`@lBu!TEXg3_b3l z&ZnW@Ti>(|AAi~>cIT>lfUhE zU_8=3hRfgd;|`9$$(xT>SVxbPrh>iOgKwR(`P=71-q;Jz#@^EESZlu`zxu)n!`SG6 zuZ3Vtw6|r<S> zc!p!fW7vmaKO9Rif39<6_>teP>WFnYnex=Uuq<|7cs2$7s~gMu!ZMWBdX5=W__y2=h}87>#ru2=1czB~f!gj;zmbX@So_M49_wvK*1I}Q4#1N2cx@W)P@ zzg_091#rx2U1qI43}YRRb6>(djbk2;cRWuYb?kxcm#t@Le;NI*qtAbcHE&913v&C13y>uG#m#u!?=ZIpiMb{B7fQ&L4WED{!|QgErL21!dO)RZ9t!z1U}^| zpW5%hIk3;FvmU-_q-8t5vN|_kkTe+l`&}GE!R}b6WzMf!mxX@S+Nt@1{k{CUw0r|T z$Z}k#(2?PA9uMqtan3DX8l5Lt|LE6#o=`-OA-VRE;d^`K9^Ex6=aw!PM{j9`e&jwn z409N)eUCm5eS!I((V_@?_*_wganhw;Opv(XCQf_?fR%w=Z3Y#0sxUjdK&hjy}m zHN)$d_rv&-ZYAMQmC`pqc-`hCyX`H#>`ouUd|$Ht7>pxq%QJL8C+uGb`!^l>_fn|m zB{2Vtg+2|bKE-n10UchMFz+Y^`k1xC{PO&$@Y;PK_a5+8=%c-AK229PIRv(b{>{Pl zE7ooQ^{YA_f^*_cvj4Y>pWb{p**bb?a!AehUx1C#CeTMJ{|0F1p~<5_2L0`MH8(!+ zjP$tgX??NB%gLB=KLEB5cXkU2dh*zgFm}|;F59&f&t9rttsLMd_1MttR8Om>j zuS?-LjZE7rwm!M~>s0ADZ-Y$ws0rgHjTtxT(&%V-JLlNxCDw7;ATef3qnK?Ka1bXg z+`<;T;~XzmW40hgoC_3jFiIJ}ucE?4iVD9+jfxT}D*7IZiW4a+{vL`-5-BSA9*U+U zQZ(gzD4Lo`(bVsuXj&pg(@t7ZE;$YOQ8NWs`iO(a=mOrhYADe=1Ucv!PfKAl1=sk9 zgTCS`DbYKeSaDG^32&pLZ546QS6uCBq`-+47dMmWRyx{NF$aCcvnkO#oLF&5GYM~^ zqivONFr98w*w!o#a#$-TUC_k9ZsxxYBLFMprdU~ z<)E*)k`leci4{+4CgFSNXj{`b=qs-9G*Un+&LGa8tc9)Bt=9d`oQ>|cYRZt0Qdc%5 zjG&_pFFO{S%z`(papPWetPa-weF^fnTR{&8U!{`^dYR8 zWp-2WRUdJX?Wj7HBZg7^(sfAIVI!&JQcuF4wo;Z>uQqc|R0^keqX2X*2m2EG*H#If z+qMchXev7SRRZURp_+rHqLW`GaBdiyIcO?6`BehvhM|~)rlONyC2(#SW;tjoI{8%s z=Z0aGgQlXBUnS)E-OoWDoNQ}$I{DKC?>sx{8Lh-qT*yIRaWx0I0Ccs&`#I(pS4~>H zgFIO{VT@N?5eNBXx2-uGe3hhN9PP&8JzmZ^Tt1IpD8>cwF{lE$o|<9~!Z@oom_b>y z-?EdQR7ZM>OE`GULzVH0D=E=C1l2g((=vsFzT%2_#V4Fpxx@lb@l*~@_Ye~nj+?(Y zfv0Gg;5nG&8MG$8dM8|VvVX6k67<;4v8TKm*0xZPJp`r_4zjc8y!^dVf2yrrNL6GP zg1n^7JIMa1r<4{tg1>U>n!N^}a6D%Vmw8$WILMW^tt&am?SN6A%kpb{!gcmKDx<|K z%Nr?tQ=D+5kXjsTb<`UISdW5KjCYV0l$vbIJ1`&TL zIMzaCgIloOv%Nm9>R!z+!wgFyVMaT}$ycv-wl48P!6UUmvd z6TT(9A9`=Z39mDGiG<%`zzr4A|s0o?BNxMM1t)Itf>+r(&AC z;!Zdq$g$`oO5rU3f~#^CK5b&>)n>oZ9AtZ_p^+noaj1dbA+8fi<#bQ=2`$0R@k=@3 zQiF>hYCtXDdM2-G}RpR z6_=2_caR3>1U?VoVvK_ey|QL=&{sT#Gx9M=F^|tM7;&)0Q(PHu0mIN0K$ zig?8*J<5&rv`pn-vxjDJ&^N_2O7spvrpWfROyl6K9y;ON$6d);^ts5f7kowB^lqNt zRxPLCN*~=yLEpPiSc6t7gB9xhs$2id!ovZ6nSN%P0<-icbEv5$A@Hii4)2lfP}mxnX4DpsDEOZyRxLxNXEiQ_;!aHsaiH z+lYgvqLaUE#JS<(oP(yKlmBoj!}lW&j{IJJ#KnUjagY^)N03VI5aiaJ6|!*9*HY|d zr$CUFZj^4^cw}vOaunasF<&drDcha+K)YCGB zgT9uNzE0z;;J_UG7qoEuxEV0qa?scEJz7-2b=hv|4aUC~3ikCz$&(%u{kjx#&{td) zulR)13{}N@Yy>!Ee`3{igxeam6m0fU3k8$BMpP2<4ngjfOA_F^9Ar~y*Yz||;KYhb z5-B?I;FnDWY@?%XRkTo$YXpdhcaYWL*)^9WjOAxNp^){XdJZ>vV$)kFm_|lKF%I*R z@(YUa-H^RUAwpMU{8VX>W0GhxK7E*=Ov#HzvFWHTTc5P@WA14UkF^7 zoD9sx=MP6tvBq_Rcc%1Hhom8(sAD9z+nu9M%>>-mwL)Dn(9TG3+JjE_tW(Ezx(FUK z0dJEEb=3$JrL08kda+LLOiYJWOaNkw{59Y84Rsc_-R7M-97)h!U|lL{3b*9n_A z0tCdP8-FLj^O@vyzi9gkY9-f*+4M6+7S@ zzgpuuq0zFjC(-UXs=Y2YU%lqQvjs%qY3DsoL7@?T_KQx%?B{}Z=r7WKUV38wSD-PW_t2Sp%W?o5V{Fi*k0(UB(=BIUjLZUQQ@%KyJ{a%`!;Hyr1ovqzMa}9 zt9^>vr|KWOwF&DoLKiA(sr|oPhUG@y#F}C?lkCWQaA<=d2?1_6+}d^c6Eyg$tYy6i z0rewpj95|lx94KWxx+pPNoXXsLA)Cn%Zwieox$;S_FXX6`04BHR#0Tdn`83-*uF8% zO#iX{3dpDI2S4F0)h=-08>6XqAsh-*?IJi7rP{@CC{DFY;82okPl3afRC_8Mrl#7{ z-~jiV=mGVh2&_sCJcjL~C#?fNhRyS%-(u?mqyNOV`KkYG12Z|tY>JMS(Z7J!hBpnAw zu`{idk+CRriv^B^=UNKC01Cy?xzNrjvtq;xl(FL>SX@Fhd&@-R_NnBX-z^p~teYZg#|0uYa>}P_x_ENh(D}lI*A-X=jg65gZHc6uZDr zNwwFj2$pWQx3~F`Q|uioaubwgceGnnOxd_dpDo|Cc}z+1o_Uys`SI& zv?3@JIqpGhQa@~@6+x4pg`x1(A(i25Ov}N+Dv|;FHrP&8Q#VP=U1rFku)ezkXLmpK z7QG18d4STmyI-TygDO;ByE&}NxC^jK>-QjrbWQGqU>kIo$R-Hs+G9$;S8=Dzrj_h< zl#)*|D;C*LRrw%>Jawc~srw32+F-48{RimmST&tfHA1HyR_BkdT5D{v;fr;(uuzoJZ`jknS(EwyC!I@$IT^e*8D~6|ltA z3$b2cBE6l>D=p_wwhR6Zt4=tdQ~;M)Du8P&75JA{S$u2CS_n#^86!}+^WUnKey#S2 zR(xvbL#wP5emxUr(mpXY!CES6rTo%cG;2YykCn0kTFM)*LkdDGKohJ+z`k*7A6&x} z(h3X=p7KmZn)SJmc$-AiDH!)zuX9I4hrpD z)gZ|KZ&XKgfpQ@AY@g7r_duWbyA2DAJOIHqKZo5Aj1Ew2dA}X#6p^Q4uO`9f$YpA> z>jy@R{7_GVjTpW{Pl7l(L`wAsEO=#Ve})a8<1eG`m=(T^Pc7BF!#Qv5V9! zk!Gt;vz&|69Fb0;o~ z2)S^}K;27l)|RPT3IE1CCvOmhpmA|m{a~(mmKVpA;iRCxw2r-JQJ@C)gm*6Vwf{1x zgt%r@6_axqRxFM|#RSt8lTh6bkQGzc?TK!w=!)G06_a-!)IATHn6N@}Qbi_j&}eO# zA}3Wnm#;0uISA9`1-nkiYC<|RHTHVF2pCSvD!*>Fyk1udFbPjwbakPkkZ$OpBD(F7 zScQ3G+J$8X}%F!`y{<_~M1 zhH7IL>;J9h8bAFrF>HP&hRp-2M!x(3)e1lUxtgu~_(3&Y=@x%M!ze86U~|5tVO0N~ znWFwUcv#h3k9(aR%z;~%vyI;02Egg$xLqCiLCFY6fI!myV=!P>7N|qT3^-&vt6QvU z2&lWIO&nAQh=uh4$P zyc_taePkHQsC$0fZTR9!cXg2fC^XJn-;IPQjR+a4RsI>8p&I7LGgX7kI5x_UXQ_sn zacrC)KSvp-3-&5+cv3s(I;malf|x$;Y8PP-ceRVLf4kZxF}*w7!mb@|VZR1+EPjYp zr#lZ0_~93Pz=a=v!DnFj;TL=ch97>xXJGi@S4rXp@5Ra>yr92WnS&R+qm(gtK|jht zQ}BX*G^K%BXx?a*mQ|zf10y-9C9Y8;{3Z@{(PYs@lSLO5h%PEnW&2%FDAEg6y7svu zN3UgR5T5SnwJZ(7I*R?JHfO5RT+BbTGwp`o=4z2wDH!K{7 zO`N8SLpUtK3Z)tczP0ryKZ4Fs_t|wzSQ`w;FidJa0qHPc>-5;m75!ONp}L_^pa%UZ zYH%-68jGD9@ks`1)NA{hKkBtY@%^SjMfxGLA~-gxE6%o^)%?~^4Xa8@-30c|*y$im z?yy$4!&>1EYaRTM!0-Os)evLGahUNtX`RxSGB^s9w%DQ4${G{p6zqr+>InT|9WKv` zoE2+Ac*d=ODUH@dmn*gX)Ea6aW>@XBpEj0O>ZY)|7wz4F*1s`xo^@!PeO5KjU(3{j zBC^9qVTX;v4jY{+xB~Ut`Ew=T<;o~lMsIi>?>ywd$Ep>LQ3$6L^wtTu7e+{#9h0Wo ziXzK!7QarWp*bK8oFL`LF==?!!nW9~`&^j_Z|-Xog_Dfi>1uM-mb*twD|_Jrls-XN z66*ILmJq>d0^CV&`VIxQ6-HTX+qq^ntn)}reMUi7`j0z2=sm71nbi)=#~T@g3$5Tn zaR!Q@FGtP->GM%M>6-3%*9o`C0)Iie+=}4M-N>K!I%)Exv62--TIRV~MVW~bva+%R5^{zmPB>>oK#rWO%=jFm z3bGO@8dZ=`&8UK$%mfu3J*8;s*sPo!czug#FSTuaP}>3$a)!kxs6w){M|ed{9209! zh)*1oWhPG?lN}q)F{8zK7yH$M%n%1_3kk4}AYd3lz$PXs8dorO;+V`~8NMe}fLj?a z;(>>Tm(u%=&_`z1#J=iBy-2APU}Y7&>#C|0ULR!5Zm73_6j+VcJgc@2&Y>7L!#5$7 zHd*!7d{8(n8-nbY`0gQuCa^BHMp>7_)1of3F88?iN+WBMRX?+)2?|pCYHMy?Wxdq| zFW#!ceO+S{9PmW5O01Fu?_k1r48iA3Gw08;X4Y2Cvl^B=*Ra9{X=;^A41?9EYtWwHj)q5dsnqOV2hG!f!wtmf<=ovptjMaRss*7G4 zU&#D=@b4<9tZy*v1n5BQFK9zkIlj88*0(Sw^XtykoC1D6dtQ0d{02BL>q^TT=Ve+A z7BH(3ErS1CET&NtOz$vofOJ#&Y)^?UQyao7*}^WYgr{0?QCQ14Rg3D&YkY6jIX$yh zmX_E0YN6lJk)YG7%Nwh$YOKku(uR4np^tFSidALtEp=v{JZLrxtDpxs^%^o(pfH@L ziE9_rgT98C_XDCM!~m3w1EgQSj?FBb6U69&Lp9pd@;f!4|5>uM61>KchUiJ;D1}qY zv!>1si=>)ai%6A@e1{^@_5Xq-*4MWLHbV_`z88I0;&+q-Z;k__3e{?CO5DlH@Be3WDQpR9B?uaEp2M3fwvRZtA3zJL!%zAXn4{Fqw`XwDEBO#3Ge=^)DBBwY!&J7 zRf8w1Olnf22+6~|tA{Xjcg<7>E6t^~182P_m<(v*Pj?4q$KsX$E^t|J=5+B-HTU2$nz*o zeVx55rDxe4p>^ROM}CrYXS?+&ceTGe?WY~@Nx!ely{HHO7m|EmJPKXwC=I^_WSu}4 z*7XIF$BRbXknK?+x=MpEmh%ZQ^(2%TDLo5f>X>$4$9vP&MQOUN1@VK2gymC9upPN1 ztG-=nv;)&-P#WH@G~0;vTS#eWKis15&p+u`zhWy%>6yXxyRY57*fuO<8|9l0VXJ^; zl9U9d@22$H1nF4r0ZM0EVgK?IjJPhC^<20x4qLN8+P3X)+Na_Hvm*F6E}UxSRn*R} zteQcC!vDZESdfakYPg_ltei6xrcqc14?Sl{){vYb!-h64YHX;hYZ^Mgv0*6HW@veN zLq#=Qf5G`af8k)vIYTX8Vf3sYQjKk%Td9v~s2EaVfoINyv0(mOjmv9maiVL47~CfG z773IHGqf6CO%+NjPH`Gq@RO3Z=DlFxWme`Nxo)+Rkaa({&?D zLn(3TOGCEXuU#nPG}m>GTKN&@*pi*D9dVkSq^)j_bIbLizVJ=4$WrI2;`|cs>Nu}K zxKG5{5jyC0h~xtD(DUk^g=eBFnGS25v ze+$|Nje*$L(7I(*e`m$DOG8OnkZs$o6XV;Q^XNQBe z#UK{&qyu(|IKNx66wLmllMl7;fQ@&1M4Y>?1CfbtpX<#g?~FK)h4Pn0oVOP*#qRle zIBB2T)A`-C*gc*lcDiRpCPHuJ??gj6|FFTF&Lc~}B7cT5K>fMM(QXl^Jw#6#A8{U7 z63WINb`CiCPr0WgUFfDJUG1LY^i&4&i#v*I(x%OO;8>55;wBUJspnyA}gTU_gx1SMmNlfIPZs-VtXP^=X`fSWG6V& zipA(}--Pqs;+-l2=6uY}*WE>moL$!_D?RNdHMwn_-(C;K!rX(f<>*$QU^m3sIM%Ip zf?H`j{@6(xS%|JV0e9nLLr!vjB-FPfD4wWV;3H9Otpi1VHc*8Ax-`3X94V+6bEx9AZGeE3n7 z>MVe9z;#YZ8ks=kc_q>%L0|tBQrvb0x^RKk8F3=kc_bJ~9Hp6RsD zcRP$jC0ip!k$mUdg^3J)dmGzLZkP11+jhKbPj-hLaL*p^ri=^qi1X`>Alac^(jxa# z=*$67NETG6L%w@KOss9B**O(G$eFV=lpd$#Sy0jzhGgg|dwc@pJPzq@yUr?w$MFQm zX>hMOY<+%QCau8FQ}kC1W0I~>{LC1JkvhfIo%NWsVHkN^arHq)Oxm9m9~8qd z^0eaW1E83+t%?tgVHo+T;+b(g8P*Z-Aw?YjSjn3!4lUv;dE<*Tlv8~V%v+WE>RwfP zj8A7N>3PM~s>~OL&?AbgAF{;o2NaLSFpR8G9B%B3?Qe>!T};X!6!JdD@X~fD?tLES z@n0y;t1%B-KT*8B4=8kt;<%EF-I^8e7z-gbUvXZ=`^k@j=|leKQkGh4L-L!7t4vy$ zx^A`Nez|H5P3oKk{fkMC{)~jA{DT88k4v;U{^vh2$&OJ^Gr>_mJ2Z(7JI3!o%~VHS z8JL9S8g?@uZd{egnsj>WWPRb-f0`w$r>|CTeF(>nUajGyV&c~-?vFF9F${r@hX1pt z?p6Bz@p&ZafoCd!yni04YiCFs2mgusrFTGo-5wyH6~HqB{HHNM|1Y7QiRv=~+LeeO z06Qe&^8@s(3*fy2^uHD$KQlmne?Ytb5#Y~v2I$ETXxGgFdcpyEh6l)B9?)Me1hls> zK!1;b{#_7I?)U(XXHcSkEDf;deF1u)nhEvH3E*62cgWZqWO$2GU^wvM4B^<9!sw4C z9}^%yAwYf`aV+-=3gh7ggO?h7zrm*({D8q{8vIBA$D1X%VY#OK7=usLB5Gf0@M44W z{V~*2Y4DYXyxA_kFNX574EdK0`Pl|2ao zX@>mEhP-LFJ;Y_ZT8YbXpg*(+H*A;b&$$LS{kg>8ra#vk+-%nxgX0*^+j`z{4t>22uAHMrTo{2B@@*YxKk%6l4c)1O%-@_rnFBd@chKSW6e>uJsldBm|?bKEX4 z_)H4pfo+cRCNCoy$=PQlUuVdh%;O2PJV(@Yb<6&0--yOjDJi>aKdfp;= zY0rJcr9Jtff~d!A*C2@FhTLqId48GWK$9VFo~P#gW$L-dkY}4?dD{(cj`QZcW{&gw z40&^$KW1=KKHczVQ+}kuc`U{HOfWe681gcMn|hiIZnk%&!Oim}ippS<{nb}vOZFGn zP5LK~`I0XuJ;=@T(e&qXlEK40hP=r)5SR62|CjYlGwiRvW=i?Z@!aI*dg(lp#RGq) zi1i<7@P&r{D-CXr=cb+c`VaNw8}frFEIEtdcr}_Ma7?GLv_m)I(hgi_)IZbEGls&F zo8#5FhP>I2V|0xfDkE@dju8$O{b~rZARkauz{e#1S|qQP>9F%ix?B zdDP%{8}cT9H-PhaEA`9=y|_vKOaN~~iOpYj!(bD4fUAvzYXBsQWDEw6~JE#;AyFe z_0$A#n{N5ZdR`j99}VC~1NdnA35C?ZDuDkvfb+Wyq#pd)A#Ret9KiMOapL8(JNSCc zar;LB{Ad6#qFbL>A5+gS19({d3|iO6l>cD>-yFc-4&aqEG0Xbg8Ngo(;NJ%DdFoej z@%4WofWK<+v$V<8esCAx{wBXMfWIBU@%PfWVS7zIYXkU40emz~v{KKi0G@nm;&LAi z;P?YM+@$`84BlUhsQp&~Jh!_RLOrJZssR4i0N$MzB2rIf0RL40|I*+CjQU?hzaT~Z zCSMW2{}{l}I^A!tsplsF{H*}qhZZZcKGg<4+o=Du0sOS6UmsKc#sL230N$;4Vm(&` z@V5ha3r$+sF0(#EXc9usYeg*arU1S>fDh>F*VELqG=RTk@WDE(+NYiA>oNJ%08Yyg zD+Kk&&wzNNX;ATOhH#|e*5iDyfrbsma}0Spy*&91l*VH+mU|Ac4B{BZ4LO#3M8)9y zl5}LA0_nJ2qz|6_nZ(Bmej)Mkf=?sP>uT0tPkfq?UqzhnIkP<9r>hY1kCS|j;C~`s zC-{Ei^98p<8Y~w4G~zc1eh%@Kf`3f$I|Uz4^7jh<1L6+~ekJkEf-fTeYr*+`#BT&& zPx4O+zJ>U+fv>jxspP|DEJ7F*wSPBmG4NNBO=K zpK5TFzov~=G}GWHKbPY8&1KxUy$4BugTYb$F^VrRIO_kBcILhBc@_gQNzi>ZZDC7^5{3wH?e(uMK21orf z={mX4;3&`iIK$v5|0Kzm864%gALkex<MX2>W>f!sXn}z%eI^Xg8OSqxkP)}Prf1eb5B=KFuxt>QLA8xM;zFlMM zL&0|ucc|U0=M&=H1V2O^zmJ3)%OBHGYn0$&s?Sux^N3$7cs21~2)=~)F2Qdl{+8hU zxyW(BcauDyuUvorTx2Nq8*{d2q2T;^;T*wv9K1zv{=D#4g7f(QXTfPO+@_ z1@A%r`i0=#i2qaYC~^HgVSj$-aiIg9XIw7NcRd6@Kzhy+oadJ;!Fe9JKyV&s@&rFl z`iljRkiT9bIFCzBg5&qPa9a| zrNm1D_zb~$T~sYNe}2#;_$<=DLU8;(D{i+6K9Tr6f?q}a7lKz4e?;)Ri9Zp*z4a#9 ze;vvHr;z^%@izruPrP$m-46EKu5?}u6Z~xA7YLqByhQLk;jGS@|$Q} zt0K^9Ob!R;0I`GV?Rlwc*Ni+&;8QT;HbZb;#~}m^4u?d436^8 zQM{kQQJ(uH%it)VM4z7xGdRlg_1z_c^YvYk;Cy{IQ}BDq{tbfv2k{#O=lSt=!TCD$ zK7(WZ%c=f9GdR|t*DVhj9OaLa{38ZO`5jcBXAF+=7t!Z`Y*!u+e@^4fpA31_!|R;a zh@=0bpSQq2ZtocKe6JPx#|Fo8e@W#Y68v-G-wJ*{eZCl>_OZX+K>QTJe^0!d;N$7@ z#omHnM|=ozZWn)FXN2Hov$KD&wc7M#Bqk|Q{OUuv@8 z)4{)Rs}r2RpSMczbtM0=;Jb)_BKTXx`Ne-+{{zI&B0pjtrt70z!AB5ZEch7Ww-V>` zYX+TPzYu%@@vVZdB>s%x!|D3!MZxbU`M(POGVy;1{toev1n2A9F9rXWCXz_=Lyc^)g^+n9f|~hi1g1DobBH%_@7Ar0l^EY{!a^j zCGkHBegpB31;2-Qn-1EZ=x=>>Q0+StXFIo}^~@Q9^Ex3@a9$5wBskCe69wn_{Re{c zJYFL>&(~KA&hzpL!Fm2&Cpgc)8;P?WXgaVyF!-5o!Lj}vPxm zzS;ld?pxriF0TB4zk6@UO#;Z95K%4mzSbtH9V}er4mR20Z~w~#i}I= z?PApeEpBP`-^53^f$B;t?!vC!#zI@R>u$03L3i029&V%9RmwwR!Ti5x=A4ER{L+~?tCU-V%Qe*x2fp7G>|m$DDiV~L0 zs)MKUm$2TCICv^A^Om<9JeB_fmp|d)sr-vfzth1}`QLE)C~pvn9cBOh0tZj!%ej7E z2T%0HE<+qVm4ATC4|niXUhMTz2T$b>bNO)&p32L6^T`gL%3r~0Iaew2%YMc6PI;mu zXhj{o6jK9glZ)N=L9=@6JU-Iz% zIKF+y!^^sRpNE(Cysvxs8m5!a?GrusWk0{v!dU%Ns^E|x7ff^4l{r$5Z zUfxrRzNKAX;P%RSW*`4GkB+QUnmxR%L!a^RvW{r=@Xs>epE928GE$pX-GAkkzn906 zLk^zo{@-lh*Bm_AQS5cx!BhDOeD3*_gQxOhuaN19U){^)^Bg>t7d!TL@I-$Pm+$Z3 zsl3>CsDr2SL-_pkB@Uj-i`~aKcq;!DE??>3sl52%491H-IT?J$DNl5M$#m}a@Fjfs z@ez+sIqJ}Lz`>Vkl)C?yLx<#PVtbwR@M4z;>q-1g^xwj{IvpIxn#N>m5Alt%mip!NF5|rCnPbJeA+g<+nO`DlhGQ%E43lJ_+1# zwK#YxFM8PN;Hmr<61d^o<>0Bj=x48kr}95d;D&3TgQxPMw_kdAnI|0a@G?*MqlcGy z!g~&$`1Tq~Tyc(s{Z8yI?=^cmcq;!1F5kz&lbkXyz1YE1`QLE)VGf?k%RFSXgQxPl zhT(>5tb?cWGQYjj$Fl>?U_AL1`A;MM=$hlkGJJe8MmbB}|k@m8AB4>Zr^Xpt*@M5nH zk4}tf6>(gY@{cg%QV;(Lra#WZ%X_XHJp4f}FCtTWsf%u5gtSlat&H!*Pr=K&so2BI z`(Lp$mFF&~N>(}L3Ez*?Ne7=`m>x43COQeg^hZ~^zfgIFkLt`C{ZQpu zB?{Bv;kkR^w}JFUbU1`5#2ODT-w)F0;DrXEHhB2%oZjT%-S;wEJ-qlsvxBF7Ik{RG zAUO&DP(&kkIQUB$rpGQ1FYkX_9egRn^w{U&rC;xN@FN+f#{myNiPLQkzKmgdw0n4I z@7oUEogbd@@FUP}b@7w*K=E9zxQCz58ND358;6TM{0c6gaPV$?DE07S-*N}<#)m2o zFYOh*<{{thFXhai@Cko&&pT)jJ$MxHTPI=cq#V%Cd^+VAc z;az`|a|(oa{i+6Ox(M(3kDQAqyz3{Mobs+e>~!$1-GAxeUHhJN@U9)>+;51lYcKcv zH(a|&zaf81sFvuP$V2#{4*pH1Pk7fZg&dy<@7m>|)u3f(2;9a}u@2S@NimqMaJf9`{u3btUylWTp zLpfdkq7`Li`VF!!eh?|`_mAu^B-P(iyXvlB^zHR47LBGK^%|Y}6F>aRLl%jjY;t}> zt;>4+i$A05>KEU+bm5}Ki*K+0Y@ir)%}f0t5B)}x`vXWyQvNx((X}gYxdp!rX7oet zTD1~C81I=HSM5%_8G(Es-|-AFLyd%8!@1GSIKdY5RE&!arX4zRfrG>f(pY ztQFAIx|O%!N9FLdYPB~ntZle?;gUtmRs^GOUAek`^wrnh@E0m0l_34t7}{cx;xazY z|Is~1nzW)Be)BKW@AKW^{kEU^owKwbKhs8b(YDp*=jXcAqUR!A8@h|%>ylsnv%d%E z8W%s6Q_m#p8}NH*i*AvmiU{s+kfr>{mm{t&Bfg$PsjhxG&;KPxhldS9^vh(PO1fg1 zS}9dMDRpeYtiSH3Lr&T+(MiZj$slJ;L0GdZbeHW@xo$^Tdgr3s?Jq$R-Aum@>HMHx ziiua&2J(AHqY*;zlZC>Mes7KB8Z#O=^_b(dM9GvPQ- za3RKPo^qtr?DaF9?8W1-WMY_3xoF-`I3D&*UeZ9R08dv8ax3OX?^j>eiBiF@zpIP- z^SDAnD)Q5>{~YT3I4aumIbETc>y5*c%EdV?_*a0;B>!qI=PTFe^>0AITL^R{FAJcHMMkJEvTP~ z|J%%;>`NE%FT|hE{|IoI_#fqYuB^*YOkF;&-vR66s9?*zs<`>30^(1!eEwvnO#I(w z{yuF#eLL#=IG}>o4E%cn@AH2El{4{|@4J(I0isEl&ucvpK90&AVE*F2)c#)h^ZEBi zJ2UZbAX5n zKNJ7t{kn$h{}hXS{{I2ynfS~14NMZo{PcPK8kKz<6`h}fKOK?r`Cp34nfR~Z_WQK` z^e`ZN9PwY3fj{ZO=YLff_LuX?W}k+L;_`V->B9aSn7{0sko`;W=ktFSxJ>QeQiKd# z^Yz2reg4~#pERUMp)uczU1?#@AJsS|4rt!k$#JM2@|6v*U zzl}kW_>ZMZ&eg#DdpkG+sVrUcoW=Du*52>p`d`1q;s}y@g1s8`Gs)k`^2_I5$$mu2 zx8Kh)&?MTuxIq^qKDn3ApW?fZqw=FGb*)vTH0Scm{#6(L*Zvhi42L&(u`K$MmOi1`IMgQ@ds7f^7 zq6@~^e#Cb?{(SlCYnQKDbaVaa+R-aNn!r^~H@-Bi@8c^f6n6ZCv7B2|xOT>@t0JLo zQ5gJvMq4IqksztWN@6Y!57h zYr!TYH@8L?{+iI3CMfwx$D~)PMMEUnhT2He9cl-4S3bf3NaN_)gKoIc#!Urbaw2{N zdIHLALcL9(vkCc|5@GAd7UA!H{5=^aDRghTHVih84jShq^MYrl7Bqfr+MwWE&rp30 zrI9Zl3uX@)6WrELZf90t~mp)CIc>! z0oT?o1HBBmnhdx^23%WS26`EAH5qVZH@s8bjCWzT1!2=SN9b4hs;xsE7;{uwCMi6Q zcp4b--oW_ifq}86Gw=lt44*J~*wn!AHv_{54Sb>~*>UdfAGIi3mnS=5 zXC$K2i}f=&8mwIVg`#b1e-!Mlx&NU_HTOS^zpqRZUYX?jFuZCGM>l8Ur`k9*#@7u?ns2J>o$v98Wj zcQv0)b|C2NZ1{Y#qa_mTtb|PmL>uQMAZNc|z=Ms8gO^FZwrD@qKap1Lqw+tD#E%_D zpC=m6cMCTEdRVx*=Dp76-|g%iNOCLMs&3!yC$FCh`KN3PhcwPPclREI6!;kUWz+@q zn~N^Rt|zY#l}=7X!|f+^Oxe;L1eGK!_L>!~Mtt4V$?KR%57-`P1nc7zYifc5+6lHlL=)&qT{4O$;R*meprR{Z2-G`js%G%S-gv~n8`Mf;Z>W}AX8 zbTbw8sITu)GErLuN9`4xoxA%Vx4pYG+;(PR1on(V?wD%dyQKF-u=$;6-u4sG*!I)l z+YybForFzD)|umy9UI_hGbblI@ZFr-@%>Rd&;0y>KGYu3OLHu!n4BNnmdFd{;rkIQ zDZaG4yY{&u;lN}2B0)!cESR?exP}2i75O8L8Hc0&75y_&EMsD3n!$u=5?(`zh%AbTk6pYkjwm)&05s%47%ii4Ev$`y$DSLwX0dA)d_J z2jBW(x8OL=W6mS{w((*M}dZluq?u)_dj2hdja z$>!~mK)J)_02d_by z!_heTq>3ZbufGjHI*ERPec{dDjs-8D08P?C0QnjsXe)e+o^kMLfRADB*U#_U3%du$ z@jZz1N+DAL%8djsn)6NW5!^NfI>B$8Y%c7<_`KvqD7hnEkepchnc{KrYwSD?XROqG zPUdN)n5TuIj(yS=vNN@bcuwnr=Y3gt7Jz3d=7uzf#D4R40$^+DI z2A6>sV(bj?pAI>uL7u6Qi(K}84JUJV~Q3*USd@uO`|H#H6tjT21gF7%bQ=pa>>`bgXG zpo7}eR;%Y(C(y6|g!oD{@4O8Bfj<;=+BY6;1}zs?QyEl-kW1()-Bh65@MK50M~}sX zO8}?ij+UKpjpKsKB+5{%X}eI%qUw(Y9yCd|M}~p6;;G|)@|rUfR2n!L3#d-pdz}>< z!l2)Vo01)UFA6r_`QEfwsD7Zw_$_O1iXVUABf-40O%L>$jB@v3j*0lKbV1{D2gYZr z`*HZ(L--@#L+m{M*nJOvGae3pung((Uu-IYf4+Rf&|jDIEjakicIfXL7X=lMVm|cg zi-Miawc*QJpW1HUzK{VhyO4$ON^f!K zvX*o{2yt(q@inY{Dph&p9gdciN%`h(h^ZGQJIMavTXq`H2x152w+}>YgI&lcYcVFg zi}9=D2;w93e*%AtZYq9M+OTi==c)=4uaw+@xH~!8_gFkEDBHJuLe-)7I_JFuTxX>C z*doAh?73><5t9|v&h5u;%b1rxWO>zqgJC;3UX=UB(@ zUY6`waG}=0nacv2$EkIP__XrxzS^f=haByYZP&#?pBv#<@ny@ZI-(bDKXXCQG2o)0 zPv1dPUTFh8jQ7V$_gdFlr-`BPTht+&iJlu1L1l4%@bbjr;b!RPpI=Qou^F8V~_A(W>)!Yg0q_EH;9T$bE@1~$9rBHdSH>{R_^a8P;p(qzYx zA+WcaAKAWz{#4nKk2w&veIfcX=c5gZPfdyT6SCQf3z8kggM7Ok{jhXdgVIj{bn|-O zVD|v%=T+8?_EGXht)Jv5(ND3#HD4A~l3qwZzs7T%qn|_hkQMDa?8KF3=;j3Yt2n^( zlGpoUF2On?{X{OhrcmZAUFitl1ycDW{KIdn($zbi72l*W7W3e+K+os#8JF#iSZh%~ zBp>Yye8=!$_l6O^p?7IY{XbY^|5B`y*5&5 z^hUUE{-kr~JwNHJkTFf-K8*{MKZ@i?Y3GHupQv_r<93#yoiWiW`|rWn?2d^< zTkK0?l}htCcnW>$;ESD=G#)o#?nmQs%bw2X$w%Ul2WyN?C(v*1js}}2h@KF`rLPii zO<#{MZGAQUgQq%G%%;5i5GSad8`G&DAO_tgapDAz1JVx`N8*KIZ=ylA7G7un*x6+) z2#_azLh3z;Il>zh8=?cs=H45BbR7Bt<`CO2$2eC6Tb@8{EG_!kH?JAKuVg&pK>W4B zM-SZk-A7v@!SkY3#4F+AUj!b1gr}H8 zyb=Wz7in!r@k8sY5n~?7HZfn1JtWWLf9jmK8}WN`QE*!=)*)C^Y^OCs0rK8}EsAd0 z_Go<2khvefYuK3~;h>xGz4M!EJ3HqcLZ0{|>8s{wXXR&yhcAyr-O`JaUws|zEa)-v z!P4XRzOp77e{kdE&Nc=&faRl;Rjy%!f>*%xXh*yo6 zd-Q-lUq_op-Zf-y>7XHfCP(8p$1!%bM+cP^A+D~)Tw)pG;g7~?*=atp3-b_Hw#HXs zL$u44xes{&NLmhrbOs$*5#lX_37Z5lt1=)J?Xb^IL8&pmqX zOEObi4uiHEy93O#PQk8}hdmU$rI zZ6aA+Ud^-~j!xO#5}p~a^Ys2vA`B`HLk5l0?Gsw$d$iws=*cL?)Y#@D_!FO!GHnzm zr$slDOovg9WFbGndb~pH_hI!%_8$DJ&dO8pP2Yz2j)lrL$A-ec^{vi|M-e~UUx7bU zn@L9aKjoV?6ApibllD-Xe*qsq44-I&U5THYU(?Z9d5HAIHg65iOi=oxvWz<=_19&n z|4wIR`;*DtGf5`OXPH{j7Zn}C;g5Kp0G&g_BbyH+oypb#V*Vlc*x@6Q6x)#g6DQF> zAiJv1eyIBI36`JRMgFGvQdzI9t*|(te}`%_`C~uy(-84Q??H)uYW@KEseUc3u_$ipd}>?cn}~6>kQ07Lc`5#X z4E5kAhl?<$h0UcMRIl|7w1IpG^$xR4gbxG{SxHXP6_v{*JLzgV$xiu9Uu5eIJjqXf zOmt5nrb^!+S_D)4l-Q|sLUK{uL_M*+8ynjwZh}{)JfWQ_ZW6y2{(;-;wiUP|peK5h zxjf06*saUE>w~>$1I=0f9Zz~M_&DAN_UO|%XYr{oeDzI?i%;~3U-vNDl)w}FUf+Lc zO0fA!z<9iO(ORh1;(iQS|7wSOX3T3y*yTWAx!@kL^=< ze4dK&aXR7v>6G4kxck|0yn~{>5PAnidoZ-$xet45)J|CsoZ3kHLT4u2r`Fs0y&}z- z+Mau)WDsKGDa>I9;HmcyIlf>I*rm}7I|{uAun!Q&*fb<8I7WM!Lpq|z7hx_y_LnlS zZ3XeA^@Qx3%U(Lohv}V2=brH8b9cwE-;;;^rf%483OCDM6YZ1J9(@Au323j0WNBHa z_m|*P6{kU4?Io>C-AfuekoFG-fag`9I|F-1)3_`7%1YhV3!s0(G2g}_^kXg~V=U2W zqxb_`o`y|#LB|p!8pvi?KMmOHG2LXIa z%Deh(hCb0(`jIUT+AYAGWbxs2dtv>TVy}SWF7YEeY(udZtu0mCkf-!U>w2`~ zbaX=r;R#1|={XHHr6>OSb?%9v|Kx4^(>Tmym*!*7G!CCHKwm1{c5a&OOVod;?@+A3 zdm0lfW&&=D(mSedcsG@|{oSbE&;66y;|=kiO!ItB^$V@{=YK>x(7t~N`Q%53F<+*+ z|54tfq5Zl>YQOR^dKW@#&q1mAuqVbTRbQ{cbw8oH%`_k5y3|&}k(>mZ_`))f&FQ^X zrdTiqKBwP7T?@Tj1O3dzp7Pbu7rpP8fw&Nnb0;dUy6=-Ij?#O%Ht2$Ugx(v{`y`Tq z{2TVIF!Ssv`Elb{CEbd7Bk4%LkE0mS&%EzF3RPu?F&dr&9kJrm}h>OBp`PI^yF zGPrf5f0F;vJD&USN3xOLX>ad7{7KzR^^(y4XStrp-3+};U804wdJjtcC3frBr~6C- zbNa`Jkqybl156u*UuQH1|18?pQ5$reS=a;Z=n3DvVB0z9UE)01Z9ZZ=>6`qN#xPnp zQ+vs0OM#aB`8eunpD$KEPc(40zpN2m$f?uJ{v-Q+R4!A$3@@O5IS6C)_3(-7&@cZI zK0#^fTwcaa)n>G1GI*Ih?zc+*-=9CNQKT2>nQV9%{6wx+?9sGDKdt=+ zd9GZhJdZ^p*C5bRzJT&+?LVx2;V|UY_O?D+a|pVrML#4Noc1)gp*d_>Ll5KE6BPx}|0XV5-Od5wrm&%-yn%tu@j zdek4>y3L4BuCJ^47kHE0BCDE1VttY+ZqZr?V@bxf1=08~?Xx)NkiJHvaf;SxM=_Qi z!B|G)T?25DnuzLWVy7WhdY>=|8%yY{4xIs@HCn#~TGxkF{n+*mcn{Ja&ZEDRCX?YW$Hc-hk^!_n_*jw0^7resJh3mZW9>F0uE?k2jU^H?N{Ix7UbxqRg;44sQOqTYeiyJ&r$ z$LA|$HQ&_ph`OybZ|#qEM$t|^cSJm^{5zcI)AK{3OEF*Dt2x7b>v5c)d{W6lzB~YP zXlc8i7rJ`)&qJYoW#ngVO78>9NDrr24%L_N9)Z@x?Yt)L#5(OX=F*Sj-S>vP;Q6Ne zgX2T-ZtZiBHxeU1B3;HGG@mcf(wQfXv>HI2e zxJCEv^s`U2rtCmmBtGxpnW=xbaQ{95{nEOD_Adz64B9kTr!}+m8L=6iDROb-b1i&E z>~X}Jwf6_d5A(U6)8I?xThQKybDhus5own;$=`eqV-?vG@000_T<4x{n1A=*cJ?`1 z9}YynEJnW^ggJN#)`xj!4o-1gtq*Y)1n;jZM&fw}@?(GJ=An3x*?$_&$WR|m(tf*R)|0P`~lgS&V$KkA+*hdP20XZX&aTh8F~1<2b9B^IsBd66QQ~P zCVU=z(|4cy*fyd=bz8nOaT~4Qs1E$1>=~5(H~bN8q9OJ1{%P|w|9IuL?ayAmt>rsc zZ0meZ+okb-ZI8yo{6u`C_B1}h&xp21Blar^Pj+d8%{tc(*w%SRxVsT&+8c4Ey%A^H zPq8g`F1CK)?orUZ;~n+`S{uk(@SPtKto1MYZ9{u0ZV^wKFVTC}uOTKQtv+W!cq&UV zOv=zXqjuCQo`U%to`=AT_KEa90uRs^OgEQm7N9hCSfXWol zEWFKpkmH1}_d7s0$+BdccMVnhID>FLFpfP9d!G2LbDo&w=#0{S7|yD!j3SQ25Kr<~8pbvMY?xSVUuX9`<}< zm?!A7sk$H2c{O?$KM>$x9nNC3;Syo|B&(-7yZt56y_<*qBMRb zJLvNT?cWKuHALvF0pxMyy8rWcp3$9=*f!rUzVT)&>1(40`~xDou_^ZOf?V7$XQbjZDX zLmu`}Iqq-x6xtArA8Vkw3d$&aIQiEJ%ulxrqcg)eD;vQcFUre$sgc%_D%}_Scs`7E zsKOoM!``Q6USIQ*#~BpHU3;T-hlf-va#xuL1ovB`IF zh6m%|KLfA#ZN2^4J$ApA_Q0Cg1uxTFjbb*<;UrcQAK{_;-Vq%`O&=Ss(;Mhr0_I1D zkWaCI)fT&VmsS%9s6d!Z-E}D!+bzu=%f{LzT~cHg!)yk7M*spXzLcUYj*_~$670XluIVt@({(L!S zk(|TR+uMqQ^@tyd)r+B^}oL{?evicB>3Rx&}(6#HTB?aE5;9lDYg?_&D>{bH?e z?IRS^bgUs65;U$rPckMd{bBCy+fBXOK)FnIL*GzskTtoi$B9-e=7uEO`}uLk@xaU* z?Y{oGyRSC;`EAgND>L5XRT56@r{twH{(So#ME^WAT>FQ}EIOyYPPTPv2aHRhjWUXc z=fgiH+Uu|{hBiNmKi4l?ai)TFt#o+A`d&b1E$BRxI%`2~;JtT>Wm4YZ(+t1)F8C;& zO1?v{5oaoho_ha9`Ajc(A9`O0J*7X;p?)L!NMK*H{R*aqycAlLrt+R_>q!TM$DgkQ z+Q&3}hFd;u|9$>^mV?ie6q7(ld|TwM!Ct0s$5x!JAY3kXoJ(z3M|AZXMENrIFV%kd z5i56sa4ZAyeja;ro$K^FyLXp%!&sV+F*T0)NkPi{I$C?t8uF9)5I)6!75nM4B^YNy zjNL8XJMS0!(mJX?)|c0S-b~QF8e{ZT7@zTuYn_@G_6zYDMtYY;>r;{?=t-Zy2{6A2 zFu&=GJpvtjaCZIpuMrdO!`TDVH*0m9+M@ayhYY0C@I{@bHFg_f=i0*H_#VvFN`{l& z`)!|zayQnHp6FfJ!0k~kUxRpxvx~<+rOFN5{v!63;*hUlPW;hu5#Eyw(_;_Gsn+i} z11b3fUkqL@9v-~h0h#gHxZ^L<`WW&(j{ZdD+u+AnP|N|2`Wf+-nAVJ#8Nd6kGgMac zM5b26%|lVhje1A$NA;ARfDcjU2=WMb7`7oi?Ozft!9#AeS?ARtZmK+{hn0XZ>MCUG-ybhF_%>MfOSUtdS`L)@}e`H^VGh@vk&y?gLaaBy0Q~}Zs8Q{AZ^i~ zOXz!y_D|{Tr^KI(F;>mFX|FT0Ptjfl$@+eK#k6NYF^b;bksqIi@2PzeKF2}*jc6=} zy{R0ntMr^&>mGfetOk0fcbP|!PyJ1FOnHsa^C8eUj6BIFdX(1;z3MTO=6^K*(epjZ zYo)ag)x)1(uMKN+dY3A7U4A4Z(HFU0z5Vd=V9Xmh-_DUr`Lk#A-?he9;ydkzK# z_;v!mFiz6;J?snMd!kxR+Eny_^7FgK1XpFgW{e$w)!3`1 zjhRq>)%b}OP&IbOxbi7eXH1xmZ_cbZKat9V37JLe5*t*W=XKs9`7H=4r;YnC|H^~P z31cc}Oq(`iY(-_&xT_{inNU7<+_bS3W5!pEn^<01HNL81>(V2U7c9DYGLilJ8xY*DzSLc9rX$I?X!uiM_!)rD~-)qY31sM`rCCa zTjwuV-nx3}%3JDhze_Vr=SF33xV3)Gs`}d1^>vB*+izca`>4e2^{el^{nkY7%DVc* z#}b#6SIsXB?!cEuSB@QX`@Q+ECBfKMEG_juFZ<^Nvr@Uh3ne(&6u7UvCEc+IY0;bV`y@MQHv zBfhu)dpA6`?yXP9rZ3n#fACknbYR$Z|GB@Z_l+)({~zE^zWlb}v*79qgK7aWjHoLX zoCvF%B$Z$+3JN%aQMw=}%%dxgQoBn+LbjAip`d`+`BK;UaqMRa3AmH}CJbsh(>#2+ z2XoOuWg5?buLH>!7Xf<##XtUsyrmbj21fzKKVUlnKbT(#L5FsoVOJ~Q z3Pzou&t;(9XlXNK9=^UCIH!@Hv0&Y%NRuhffL}}U#mUhw0i^>$X9AWR+SJV@Rl!)) z6>{?Iik)}>stCB#P^lGgmqAqvxX++!1w6p0+>|XQTFtd0L3xwFTNxJ(zPPqY5-o;f z{nHGJe5#yC_JS?Pka={ag?^@rQF@g@)e4woly0A-rkjFUm7d_DLhwU-h8R8!>V&2h zM-zbR&g5d!%W@d~(+STO9!bs%gL)x6&!VKFJiBUl!c>_fU=5?l3FmwOGt3oT z+NRfugtqBfEhFs|v2+)dR4EGyO;<2D%c2-EkFHuTJREz;a%bZ9i zL?~sLFp!;>F`-C~;CKF1=7{jNuP-})DszR(D6Sg@OU|FlJfULE@&WqH4MJsvk!5K% zS)__MR$kD%@yHjN9^-mX8%hlV{*qB#Qj!O4NdezxR1|Lkn|#YFBo{Cb-}aL@$GT=# zcabX6W8j(sN(<2A1>DIDP)a~qFrbt;uuSrS@|yvak)8p+5xzP;kk6aBS+(g*O9hD^w|Q+k_UlRK$mvzBdT@dIRe^c)Di(*+PMcx>)dk%>}PaRFQEJ|An9ao z)*#%Ebupcv?Ax0-*^-Ku)SG^g018;dzE416>gw%=uwp zrU*ifOm;&CZQPKJc6Tly>eZcGQbOK|DI&Knn2o&TOVj`%0atLI_BKhaVk`;@xH_ev zP?Tp^%BtZ4Sjh-j$0*`ByGc?)9tAnyJbc;#2LJH37iG$T1BwFP!`yO&Oq&*Iy;=vkCD!boP~cxg%#B{j+x6tFy{proweCg97clAF?)Y9PwPASs{_iUzlb zSzRf{gyKeWsV*GSoV*|BNTW%U(k`idKH8mSSXT?U!l3F}7;MPb0HSs)gDt%ciVK;C z-(w_0tb!gRpyjn(cLes|%$Be955dMaURy7K<7I@#V}? zv6{gei#kc?1n8pk1h{Bv!{FIo8WjyT?$?lW@2bhx)#eCjo4mAzDU66}0CU{#+=!&n z_)=+%6?17Z9bdq8l*L6wkzB+CD#j+VrpkG0nN;Md{c{DhayN+F4Sc*K3>rl4t;Prq zVyY_Bl!o-CG)PmbxJjUu-joIw$2_{yw{%0C_7Tv^T`zK57poT+lNAa)MdTL0%3(z; za#b*Zd5M6Q{gQO{ON71k@Fl|Dy7LlIoAuo#>At(fsLeRVlCunoQ$&J|RU)fAeO1ol zjCuT|rQ@M5G)c0V(P6N{Zx5IB+r((UU5tK#y+hgvx&oHRH7_nH$w`bxNdZM0YQiB2 z=`UQ}sE7M8qos2^ZQ_|&j2oK%l0n=@8j7eW_OtF^cOb1N*R5j7ZMUrx%ZL~`tVV_X zK4XdH0*XW`Mu|-QOfOw7popo;iJ-QhE*CJ##!=;b=@rtKUm=a=81P+8S|H*gR*A3~ zLZJwYQX;Cz1(d`OtJ4n>_tGV55Q*MD$caRvF@!IX$cbpVDx{4IBIF1tI)Y;N1tQZK zGa%MyFzLQPq!B%-${FmpFUVj&aV9HtSN1z-#9bnwh)a=1q{a7nsS7*F0*chJVB?NR zlcdDbRM}UoF6lRnO8V_0oZl?M+4g9tt5)shf_kAMjSv|%R-`ND4x+J=5-BM{rH8kE zJkp7upwtT-r&~?vu6~I@>(|w}Ho)4Tyh+5L$2Oq3p}?YUylM`bq(ve-6%^RI5eoY1 zR<(V7E98ffS9%?ZA#;lb98n3EN!&j-zrhYafklQexH*#uqN$l|b`;Ad)k!WOmcj@i zL*-sGnKIMvDjq^mN(Qu(JfP(;bO95#a2mJBi`({UzHQp25d%!OgCiCP9uB~ zS_QNs)cPWzlrI2K>Fl$AJpL8Y^nDMqDA%zF<~p zD+K(dK~*1M5Fg`E7xqW$=!iG2Mt&mf3b?_bs<$%OY)~soxqnrdepW5uK7(4JiQBtB zy3Aswh;noTB_(=-P?m&-d_rfKPTvxzTr606W^VSLa8;A#Q88yzpnM!1w^kg=>=@IcTjEHUF*Ia3$B zq_-OU#srm@iGoZ8x&<2VukQt)O|JQ#TzESwL+mKi;H)t~S|wF6{K(Wm1O`eb1|n+? zgOpDgF>-(4lU7KdxI$)Yy^wcS8o5@HrmERZxym=dFA-j-*S3B}2MI zK>C*-V?;;NV0W4=#&xIJV%=P(*+To5Q7wfIgp$JVXQ>N;a08E#E&K%PD1#zH4&hSR zNmKrZyy+mf<~;n{nmcQ>mPXhrIeW+p+}X97CAG?kyP}mr+k&h^&`F_bsLYQsDAeEy z<=MO}&UK_!G_MzUfg!zAK#@5TjA>fW*&Fy74erjq-QJH2i;S`0;pTg@_D+$glxvfe z0t=-a4(@H`>O1%u1~&<~lTrD>nxI!F0)95dZQ=@+{Y}}bJjPX84Ey=ns)$2K&v63$ zL#9i9kN_`)dzrqzTtMNK(o2P#LS~3(`~8-ry)_Yzmb|l&wd6l&02lHxZV)-Y!2L`k zKPjL{LB%9yix7nKo0v;q5)p)U%77rm71F1!kiG`}0l_B^k<7k}P$!&EoN&3)-o={I zkxEi$js8{$*pEJJic9VGN@6-AG1EWDpy&dlgs*0xd{GrOP1xRjJ#=SjgtQJJK6Q=t z8RQmjq$ebplX7}Vj4;Z`x*`{6i?K4uiAFJ8Zge$YKxq&a^93iIRf&dt#rP6Zlsw-$ z+VGROjWbPKtE(Br7w4!8HWv5TXHZ#3EfGFABl-qF^I2j z6qNMrHw`MQ)rFl@$;s+|C3M}EwOP&K*UG_H{3_^by>x5s-S2Aax$#f&Gaq%f#B*>L zso2aFwdN%y3d+G#a64e?y1+wGUYs8wxtvPAn$j4Dil$D`3UC=m`mgp+FMwu+NzSW3RxixtIV7B6Wmb(!NN96Y)flFj)3NnoP??yrY~&H3g0v zIp+*!u+*UD-^1Weeo{?oP9whrCfs_4x0n~ha|GOKP@fU-DTB&-?9x|+ib$df@m7Tt zvBY0n0l-u0Mr-ipGKA{|5 zxcqsj>|*V_U}9NywjkA-rqF5;-@a<87VxBre#^5Fewzu)wrvi^J;2n(06A2V!xl5` z;xC(EvNUMnD%uw%)ouu79mV%?(F6Rg$QF|T zxWg11lXX%sD=l_4WYZdbF&15Q{M1^L)M~~eR^P+mLl%`GqHALI?vI`FMr8!QE79yE zwaUCfSuWr`29?!r4{=fYo?W^ypp`zx@Kc7&Yyqoy@aX)cFdi-^utg=JuxM z|1mMeCTQG&peaL>fz4HYVg&8ot62YH4}?DfH*uEQ50FHQvDb=#9i`Yf%!asERsld_qhsM!`kj8!hT3aKTXaV~HXtigQ3)oy~Nq^DS zl$6!q3en$w)}Qh?Nr*1c6|ymuqU}saGklvU33!lEN>7rI0G5McgtS!2P0W}V4B3Ae zJJ`lU0cSBvi7APBwp=!C?&G2oYBfViwOK*}#yJoxhLVuzoP%Cu*0X@=Xoiw%VJv;p zfx%q{m9;ZS(S0ejC1p=SWhEq9OE7@YFQ6O^M+_8jfh{HA4uh)O%iv2E#gKXUV}fLi zFjZy?C_M2JPC(&_Pnrm5+1IACuNCt0?23KDus5xjiE0kBM4>K{Lx%z;4dL2V3~n;V zsA_BYg=@KadzZ7s<%aNV0V^1#Km8}E8dI=NB$#B_)p4eI_zG&|968VgV|)Oi)2Y;@ zQ^{GDw^=6LpCmQPsC9|Zewx*b!*F{UJZMqfSqt(aSaowrSc@!SZsy^uXfQJt0kl|> zDz{<@IFC_^p(Lz=b7oj-NN3%fs^g-L@0s>6;5VyGAfU8U7c_Jk@X6OOzL}q4u#zG3@T*8hv8iIdK2kR4aQbu&=Qf*C=390STGUYn z6GkERrD;0K`u>WE;47^4g^7!RVkL~IB9Z70sHeHY0aLM7B$Dw4r9`5cM#x$&Zywoo zG)L5BXFOS>vyhjnhyVhPFcM1(rEr)1Zjy8N$N&Rs+F;b5c?S1Z&3`HhcAx! z+S^=0)0PxIKCCX#jxi{G8z@7R0iU+yS1^Do0#+GR*47J^a#O|3gGZPVymk_UyZDVZ z`ixYRXLj-ChCYv3fp@Gl;gZg=aP`~!Z|RMGrhZ*v}P!&Hp?)ZU5o_?GX{0Igx zMHTQVgQ}MyKV}HmOGSD5gp-_6$4{*yNeRImR_4OM&JL;tl(AHQzmKHsI9)B^JR<~s z3%R5gFcwn~0ners6xQTbhe?Nyz^&G;cECarM(yL_M zZAh<@bw5M|nrYf1ZfE541(TVbG@rkaAMIB)9 zs6{bk9@zxN=8GxIKvz}jI6ntB5_MSdGj)et8Cxpmm4x)99Cq_pFdIvyUR3#}X;Ieb zC$dVULWmJidIPpbM3-v};RdNFPhY!&PcVRBBB1rZdLg{pl*(D+Qd7lzC$30NVRlZF zq%6B7>Fhqt7J^mKQXy;=lyxD%;;Y}oCKw)D!MN%CblzyKvM7ekqbtpqn<_U5XbGEl zRhDqAp~!$wSQIL8M30n`ns3-uXCsuZt*q{pUL~u7rOIj}SXN`FSIO#*QpM^~;)&6M zugCN%SyeBz#E|Hw0$Q6c6^FF4WK~i+VY5Gxy2X%yPA;IDwK=H{)j%9IAnvn#`jdJ)(K6xtuoV-iM|Iq8J|OdgX?_`~>y zP(uh8(5m8t_=ZraU{&ZyD=ACcd}*eH6vPFwn>>B{NrCfl)$}S^W1Li3Wm-V)CNjyh zE7{H?&Ilu0C2ItcDk9r??2{I=KHjmo-s_X&NlUjOHzBI2Ki-=|l}>f}=8JZ$Dy(fuOu zuC8KiF_&{9wGc$SmyO3sW}k5B0tV|W%45~#i($)awt#~T`>at!xJXqec#kqvKEM!Q zf_JH*lGRKigM?|d4J?T&LuZMA;xx1`gr7N*yw;ogFbEeN=jz^a9#Ii)qW+6B}~yg{Ei?Q zwj-Dq5F#whvyY1%->!Zv;MB8QLeaKoKi?b+9m z()5`OpkE327!!;H4@)1F(p`@2Vg<~<1(ZPtsuw2^$~nAr7LJpQeCF3X8jN!^q!VtC zit_YrDtHkS?=u8kV0h)cAt+U`ry<~cLnZ5cJ6)C=gvvZarA|u8({GX3Z4(!u??n*! zX+y>wi`?rJ6Igr)Q88VmSp%gAP{Wi}K$e7v4+j&l(Jd#54U9xN0VVe1Jg~Gw1V*Vg zu5i>=6fk8LC5bBIHs+V^8mKs!D1%oRrN(4Ay zQExLCH`b|RjCo{dZ?=|38N#)~-V)9lx`pFlL&falk1(j5cfJy)%3J|0m8>J8C{(KG zFE7-4w| zILl0X>S`D~o2QGN$NL?z3C4K=E#ca9!Z~-GQAXl90#+M|>(dG6JSeSa!diinYBB80 zjQS;ms@~7wFAb_ez&9DC$(fW1K@Bww+D}?Fv@vRwduDMuC*+JHCh{$elH-g(z0IgN z>q2>qB<2|fHHd;%SyVHFa>P(omBdT7T#meMEXRCj9v0p%llilHRzG$1QO8ED0nnxUk2T80A3 z`baU9gjgTSF->E@Z=n=DnbJZ@ov{oBl*93gp(Mo3a$qQ=ZI$|LGCu7&saA@(tUZC- zAYeOJP%=tF{5l62eb?3u#nD$=M;34^qZC6)NN>o2;R{?}`iN#Isr{CrfO6(uF_eUK zs~i~SdZM=>#}mC-{Y<*B9N5(@lvJbb-~!55PO274Vy7*a&1s~l9N5(iCH0aeB;XlF zDTa~=Y)r| zm30?m0~>FXF{1gHov_6WQ$XQ~)(B{MiRUt<^tZqVIY-P#Uo$_8^;E?oM}r5}Hc4WV zMSh`a1t(VXlXgl3wnF5*`IE2>7I1_yU#<91l|^xR^XRJU$<*4JWn01@=3@cnMq+bl zXr4itbDs+gD(fp+X^KP$?4}7g-%v4UH7sG_D)rMg7OOa?hM(GDCDqU9v|d1~=4!5D z9%1kBlAe9@qCI;Jys&5Q@P>i-io4N3_UV=^{`%BG(VmwVU6FU`plkY09)$1qstBSz zujxyuNO2Ivid4ZM$Rj*qujv~E-712?7uaO}2;^N^RD^G-i-#cR=C({}>Wg#!Sn zl1LQAkXcj&DoAuMMJ4(=oE}uWsOU=IdVU0@gW!U`Az^g6UOkYl1S+aRk=_@mB7KaQ zMI>fl`of!jqk}FQ)!%9E7%&)+7eodUFt8$^2PX27fwnz^DpHaq58NMyWBT@n(l7k- z{b3L(-aHjN2W#{rQwLGbMWZ1zNqp&`NrOm{7w0KKhcF%ro;)al1|;&(9#Q1bixlBL z-R2j4GVey@4ud4cB+_tDhipW8gwY|!%u9@JkobtvO&;my(*DrzrQluav{y4D?m;k; z*xfKtn3d(J)?Y@=C7z=Snd4trp|9zyn=`tQ#U_b9>gMZal}mmQjM1XAV#ZR7Y>UTP zJ&`sr|Ilh9yI1x_ViM#W@6xAY6N#kKEkVh^Q1Rr-i0LkEjM)XOqy*G#~_>;*##-PsqZWc zuZ~==DCbjFp8o2RzoAkUkpe?2{(WEyhC;%gLE#UmB(BJYq7qTcUSiwff6WRf02{Fa zVte8W|0#m^_6iC~D7vDT_g+YJmJ6LtHfxh&{2+3|bq?eB*MU*Wj0HWZvXyVMQ_NO= zz`?RB@V6`~6S6A=IxFu=h13py-d+;)Wz83kRQw^_ef@Mxb)Vr5F;Tg8f5{mEAY3^J z=>dfL2!MfODc6)3rAqt&{Xv!Z8GwPm#!Y6fK|qt<@D^Z#aIK<_p+sLulg}Xjar!=$ zZ;5O6$I;Og@%O05rERMr~Y3)eBL$logmn;H3@awKxT$aC7k6uh(8;-4?K;;$gm zw|o{6MTx%_z))(8T%@J&?;?4_V(W04j#?KCccu2*8d;af(A26lTomLoAlow`8^a7G zX?>#=^S7dyzl}UZk+Jt?+(-N$0&zty3@@SQnMf@B2mvaFbPEHOP`b$v<2Dfw6E;y8 zR;dK3I?_F?wmCh*ttvsiH_|iQVG|dGyHtXLYNSutsuIh)A<;M7rxI%^(Lda869d8n zDp87F5g8b^sRUU$QXICcgyJ(Od^_m9vKwX`6hJQiJfNUAHKF%voayqv)m>gY^)JM!e-Tl= zy;O)E0Kmq4)iLI)%J*#yJEZ0VLrFNfR98M0DbQV+qzy(&e)z{ok1~Zy7djrKPLk3(r#mIWZ*Y6idQ4P@pNRfiqASKKCAjmib@kyG8)ycuhchuk)v^6cI|#?tt9tLLz4TYAyeFM zmJ;)8Fstf$%>q0P;4w?6M_dOQVY%&243E5I4h}&w3u28Iprz` zj{6rxC>9S@IHCdT;+~k~2fh2^-jjwd(^p6<;mVn-vD6ByZ@@#zya>SH*;Iuu7K$lH zJ{47z8&Kk6HDB#bVcihb8h9HcpQ3gSz-2_J0At;#{bmGrCJz?U*NM;-j_sxrk~rDe_`P z-H_GIrHbKXkL={=9&9gIHc6E(`F#o-H4!oPPR(=d?bS-R_a_|*mA#FGH6+_DO2Rpw zgmYBGt%QF5+$c@LY`#w0fOdnTH(JrYi6@UxXly_{R75tTfQN>3mw2s)1<*_aJi~)(>F&cA6^ZKwnc~1 z{8lbtVS#yVH{qK4G<@-@ul3MG2Us=yubEjwB=N;?*K7(~z zUGoj47%JB&0O7BqgD@FPiKsz}4^VUs_q#+=eIPA-Qm+fg1YHK)k~e#c1QZj+L%yW@ zX@&tF3#gJlYDKQ=ss4;|shn+pE*YIt*b4-xm?>X{h%qinc9)oT7d7aSW!Rs30PJa< zYK0R#lt-#{uXd_aPM)P;BE@u4@Jec0c--@q2VJ3LZoDicGs8v&yl4&ePA*xg5HS%&*+ZyAF z7|AuXjzr|E2G1}V>s@vmki){+_o~O72k=lcoks+C9KcZ8|Bx#IAY2kFRw3N(hXiBX z>6V>J-9yD!5^GiA&&E#c_S3FzKOLcFYJ+^n)9rjE25v!ko2T2`l*@_J-{v{g?aHCX zhI3Wj+dWOMR(2msJ4kY=A?_~LkKIuU#wh~d2rKmScT}bK5!?&^n`?)EUD&~3{%0?s zVvYHqR2^tBbeI1bz3Z}*;G6WW3-z7+h4WPza?Je2H40Yv+6D{PuTXF+)ooa%U|P!O zFIy87-l7Zx#Vu1ji}Mz${BHuCw^;L}vU&A-D^bB9-Ma||dOn3);j=>FQd8jPo+;jiK(YnZ@|66ECq)2OH6U&sFmlTd*vAZYkEacYo; z55$SShJPFXSCr9?a41eX*6@EQW*YvTk}@5BHEu`SgH9P2{?E9L0vcZ);0muPn4k&1 z8~=9*0Q=JJZSQ@6d(uu%?_U6_qKwE>VNar=mC#w>D50~!DxtH$Dj_JeN(c(A62d~O zgh-*X4si(c3yGzcCtgUKIT|i3vPP2E6)&rtIiBuOq;g?Efb7}MbQFE`+G z0_Tlc7UBv|6WOC2d2oPM;-=|{_*espX6g%UCA3a1~fbo$FJioTY3V}Yxq1&)qBlNVkr zzVVqn>!HgXz1-~JSLD&wx|V8%qsMeuOSlamCM7FqF}~#v6W=PZruvpMOf(f(w`?k~ z!@>3fYqo8QkY@2*0aO1Mm-@dr)L(L_yYRmj*bd{u|5jkT?Qb2f|I_dRr&WKHR-JQa z_2<+~Pdn6mF*1dQJ7dn!nrEetC^Kq3<%vuG-lh0^hhn=!@pXsd8w%D&e^XV~6yJ)m z=I?hkf4`&o`<3Q(&4--UZ7#4Y|EICI<+W6e8qMt@p{6i((NI%JzGU+ksTqZvCWG4a zVl}gH(>BW07E+YM2&=EKUhy7Hsqm|2GdO)=|K-AhVPT!x`5E~tD5we#7U~V5H-W&w zj(2JT#K2u)dI>OCfKmWgMmO$=RA}HpkW|3t=6h!WP^*~v0@Mkx3c#p)aFc83&v?pB z2(_8qy$~-YL8a*zl#}w(as&`zPs#^h{nBzM?UTz@MfrmzzZp5h!iKK5&4bBQQAzqm zlpXo6Oe*Zh3i&M%s`*C+cniRl(akMu-vyv*=D`RG=q12~07iYp*oJrvy;;4MAdp)* zS6X=o<)plP0OcV3gtS7veHhveaZaxFlwYO{*%xT7j3EStH(#b6wG;4AVon2~q`Mx# zs88c&u90<|3NPp8-Uftf?!5v$AiyI6JTAa902GVe3fQCfCr*okSAY@YMpm(yY50Xt+wt+NQaH zl;jHu71>yRGoFgr=Kzdahnu;EKIEik5w$~#+BblPE*m3F-v*?peUDI}_5(Z>wSNXM z>Q}g#Yot&Mj}++FMMOu{P9dW(??Wf0jgv^KqfQ$)?h3s&MmM$wxi)e-k$cT;WOL{> zlE~#M-Ap3aZlqH!BLhHr8^R`Kf!M~kgQi@?Q#N?Ribt}L?le7R14S=a`BZb?GV+lD zSv>r5WeyG!r1Unmf%2EOw?#MZ56-`{4gH(Rl(x?|MNaQQoUCn zccoO6+Q?n=_dqDz2?06?PEs2M zcoe{>@8Bj^de}Y^=di58_GBukxb8qL8(IGp@1dIU=Zmb@I)Szqn1($HXo$NJ=waO+ z2zrGjO|?`cWgr<$1;-ThC{qVtM!v^1!WrC$i?G&Gat;(=IDoQ`O6m$qT`j4(0xT5Z zX3GB@ZitZ0_pSq=bg@x@M*$4{4sN5K!%eP{_lO*K$8{`u00o(807L@s2YrvN1a zd_;h;0AS+D>H)Rh%fx2^p@`21P*x|YRRY{2zy<-f2+$0m>}lLo({=$+((DyrKY&pO zag!^>xavK}+xaw$z|f#A{2CVy3*vgN^G6_*bngKuD}+O+)Bpj70Z>dw3vfArfmh)+ z%6t|Z?1z3D7`bWygueynu&x2X3Md&orHZA`GiPBORI}yu zc_y?Hgo_abm35}bks)fS%34uSkm1$fS9nBHYlxE9t`x<12T$;R{$JG~p!4a?{08$* z_#bG9=8InLV>XZ1d(=9MjC`41EJoM2;{{%N`DpsVE=9yW!btB8vAN=(6{8~nJ}!#i znomC|qXd56ERs9*6b-Rdjm1mM)Ep>)&e!B&cC!UXuiRIUB&lj{`g>GlKwR&@P~^*? zo~kcC_@Gt!Qi^{0jVon|vWK@jC5E4K5+2!VWi^;#f4U-R8I(bjTcH#Gr9PR#$Ng0X zjsF$7h^AXSL!3dsHKwfDO1bbC;!)uh(EfrfL&D>z>3XWvw0va7mSsZHK@;DZl!IlI zPK%$1QGq-lQ<3Tjw=%ZC24ikfxZXJ zgZJt0>1S<-n({*3h^rU4ZJo;peCYVb94bJ)O@&_XOr}1FrAaJJA;IOnJ_j#Kk8?Ps zm=^o!(2-yF%NgoYj7%$sx_*NnRO)-522%m;>P~|(0Qn78gt}@l%6r0St$9f0A|6gg z3=gdbCLgJ~j)z1HPvaijn4r$!jh9;bOfg19Wzxg?3|*+}7?VjH&Ez~n$(vs$>=6-$pH z-e9W6mD^Iv>3IgvWV9%$1*#(|YUl_eUY*eceWV(d(vXd4Y#OpX!v_I2?$3nWl?mCL z3ArH?@@*LU;S>dMkWj5;qh+3?DSKv~q$zvmVsTZF$Eef}%N-<&txOm?wy`|Js7IM; z;_Dg+&s?#XDrWX3T|}3J5Tx`}A>fkjIFqjgR6_)rAfvPSNM-9ZB#E1bB(`bDOpLI9 znxQ1wI;}d{It@v-PW9!i&d#%L>2TFu*@49M+z8tS^l=9LfB}^q(#r5`eiw>j(#4C4 z)HPHT?S>7QLaM{TGL#7}iUOBOH6qF|mu8oXH-n09Bt@plM^!*w)nw|KeMv$Xl>|pJ zK<0wtbgEHNY%%*>;dF1)U`<36^9<`s4wYT$#H^82*LlAlKqXTHZ>sV1P^pOzb{Xh%Vg5ve)@SKBrsL04x-LA{`LM<$oLS;_{-G$foqs4wZRdX%(M$Q1 zcJ`uno+-jxhFbj*ih;FSNpwF;nH@#F)i&e^WMH4O9FL(Na|-RJLjP6NqwHE$p!O5$ zQNI|EDJb9JREx-X)&D8!k7rfE+)g2!(pfDTR2wGko z1P%dC-RG!JR%e!$YI@<1m)}x9C~-faLo{jq;cJR;nOf~Gl}J*O9a2Fb-cTkjNl3mg zul~Fb)lB8hdqo5N4boB4ubg*52I^}D$ z#So~EB&&~6>CaM41un?@>Czu*7=`F}oV)4TWn?zPvmp7pHfvY&mKtJ=b(Ur+NOZ~Kn0*%lu+ zx4P~N)n$(zF5ZGM?^od?j2;?emLU;nbt-T(vK(&H%C2R3EVT(<9!q_0YDH`lSdi?B zR>bhRsNv`WRCi|#pR|MBbg`Sb4H~(_q}IER^dRC-WhotVtQ+I9oTH$2*er(dV<=Z<^z9}6RnjDG6;P#t+gvehqnR-0fFb|0Mi-x2= zzLMJGjX(u^qWGKv^?7ltAW{;3dTNgsd;;lfqsu&jguQOclS9xC4_Wz3&%SglL%-O? zWGy3xcUR+p;oSJjzOa!K83Mm%G%yS{`sTq;VmU}^$N?N_D>V%HcQka68q)s>4g4Gx zS~VJN=xj8QPvXWWCOhVVpnv3(fVTbrSG9GM+J>-gLspV)@n0;jfNec~SzG!qY73NI zJQh8i%Ko45d!XTiIv8M35rYicgRllNwRN$#3wW{w+bd|#KwHfvSk89APTuy_L$G&4 z19ZP<2VHnX4~Ou`nQ#uDnVLM!;X;zwtX&3;E*J!jt{#qID-KPhNgo@!@bvLWc>2lV zi5_L()c8MVQ&9~Y1;;`9sZ!(3jT)QFM0Wx1P0gRpne9a)?l1z6Kv6?#w^zccb!Gg=^8{a3z-SOK;jz8#{>1?-_dDZmvD1HC%E2W zXX2djqOl$#n?Xy!LuN3D$04_H{69}wRVdJJTjKwNph&%{OqmU zOo-v9VG`rp4axECN$QH_Bz47dlDcBaiQ)J*Io`GViSh0kbj7j+$CdD8u-)~StTUZt zVjmu?kjLS%=G0xIpQY0lN#W%1c&xbmxiUFCmTytuOQ4anV(noz=knIMFxr3xpXkDnI%kDiYYjG9WtsAFX4AM4bpDdn0d1H5lC~BQF8`XkhNQX{5PQ}- zvqi(&?0-$)WiSw>;d>XY>>pVdXmQNFdid^7Rj@I_IX&G#ndTZNn)MJBd(QwH5n!hB zX+a-rpoUltgAAG!oeES))lu5V2*xEICa@#fa48<+Vap98Ij}gjWw!%uB?Wm+l}a2R zVYQf67;M$;zkLWTIjYvOKey7NUtfv#1KeF(U zNS>o~V)0-cCI$W%lp1YkQsLn$V5)_owx*nx8aIhBL_b+MlZp;kJI6}x7v<2#VR-H- z$+SgKnt|*C3$+uZ&4?F{r?xSPK_rw$>Je}=w->=9wvB-yl9@?w`RNrf)-V(DJeJCmkK zF!j`u#|9qD{4yxbR6X25Vydapz51$2fK;Bj170lHo==LHnm=7u>_g^&o z$;Ra+qpzQl-3lh!hFKyrt3o@Fw9L?^BLEp(J_(r<`WT-IPD}qU$WkO z&C2uwk%z^Xs^s=V=43nJ@Oo?daK<+C>^<`Kb@Ny`s&c zBK|VV$~MVQrQBjpw&}ju#%uckSa03%n0ABtrmj7Z~td)uW5a8k`A>jl(<}m1o)*h2R`-Lp2{(`Q0OD!RjpW&=LM! zDY`$}+TIZA7WdD0A<{9&A-{A2)qpguM8f%??Uhw4)^yVR#< zJ~CB489*Pa&&li-pOZ;Tmb#oJG!uV&&0}MBmasTw;xFa<PEl&aj}i^F8K1z|*)G@=&{uM&n*5j07+_Q^~pMR!N z?;bfD1CCuW#ylz;iKCjxSo2&gZzsQTbw{lpes$>Z!#6?E&o;6;L+WWr{6amo=pyi5He zH9sq9hIgne^>ElJ$&`Df3e$sQkTBJXN->HvAD2#!?CtpGWL<6gV?H9QDx#I-=?=WnlQ$0MjiY(v6y6vM8>TeQ zg^j*b;fI%la0JFnU)YFTo?%A`I3_b?ilZ{Kf#Wi>fg>}sfnzhXful38+cQ|!v?OXW z4#>{3!!sC=nM(-W?4M;GZOu22zVgE=wym=>#0x;D^=`eaob?$vVvA#fk=Yq|ch7EL zAS&tw8A-2SC@Sq7QE4wWN^M15kdgFwJu0qv5ZV}%$4$JknK!oa#!lY&0yYlAGQuTt zQ-=M}&i_SO^}z)G{jzctmicofb`TAPWiI=Esjzsu#}2}xH1F(_)>Czm1;Iu8P&=0_N_+W zVOY|*MDC(;`~RZEQz~Q}t${*5JiIaaoA#}=%FU&>4G0`>K;GLY6}vE zTP-K##V~3}3>?ZMiLzR!%4(e|t97cZ?$5v(*<{(>Z+g*W zSv_d<^)u!4Q3kGXN$CQSMjn^%z@!|`!o%;#!^&GUp$6W9S&q~{oWLCvhWfa)taz}` z!Dr1w~#~z78_Pj_pKiP$JGk^FY>3|){Anu-t^LWXi?4H@2 z(!kjL;pXlOs_mJH7x#(B-w({hKU0&8;RB318^b4Lq9M2(#(x?x(ig_^NbH6BOf#Is zefqnmM`lLNdqM8MCKp|len_7E>Xvs9{#__uOzdaV`S_Qj;Oj^DccQ$MX2%rDAd)h3 zGv*0|l!3s(kuq$3ay%RZJ&kUfgJM)y-#WxY`d}!%EQQbZ5exz?he4njHg3bXoK_^q3gxPC)B6>fsrMNw zGgI#~RAu5cQ*x|PotgUF>iL=JbLH`xOq`-hwr?}kex0!=d3m0owp3GtEtPEU%;;iaCd^R%lV_{HLwIH+2jdFvNCtaJ?BeWG z&ituE7`UnPc|4x;PoD0L;8Jb@8#Et!I}Qj((sbzUIF&e({$ki2I2ImBf0gPEESnxX zFJ=vn+g3E`)N-M{<*4o#AB|^6Zjj&Hzd?Lw{|0lb*bEXQ%fz?!?`=U-S#OA$s^ksH zBT;LM!^AX~KK6+|&&&>=YR>!4+}Jj^MGb9_w+`Fi3teunCe!ai&;L*)7iA|z($?9( z4sHHe;{)=qLq8bVI|^lRxSX~=k`?jVqsQ8R3p(1Owsic1kmiq5#Ju*IbAg(_5Q*pf zcloae{_BDNdf>kv_^${4>w*7z;J+UD=RI)7h%?5=`y3W8Dle>@7N1#CQ(IP586PmP zUv|F%@jm6{Gb@g)uBke&q^K@Fc<_LMLyD#zlbu~M@R(z=hZGGMaP-uprxwA+l)*)X zg+~=0on2Tmu;?&v_;LMbRn<)IUs_mGQB^s+sO4?iP&=c#x~itGq_|*OO?5$8u{Wc# zwrpBu34E&oB*vUFd|3YI@dd+A%_|s|S1|UBvBNbR561=^J8;~9umb}J4t5+k>gezT zgN8WHIBMX4;2Edn4GdFsN?xd%Q}T`)5Mt=5XN^01_`su%8gOh_79ek-KRj~jRL#Dei7&mCTnKQV83L4hirq8T+aOKLqTBnXm} zvZ^hGGW2FZkqtPypw62DrCeKfL5WvcSW)5?LExk$YjhQqRZgw)DrS@y6jjZDqAst3 z&`&A+;wgNru(+6{(CT{QtAZ(o#Rb(>kYvFCuhy&dFhNMW+L&?lVA$lWR#cZ2pluR( zAzDI}4-85UOerVhu0UiOI)20%#4GEK8PSW1r>c9h&5KjP$Mz<@ODLp@Lu5Vwjz$SMNSD#^H!dBevH8*p@X zvW}XfMb{2d?#7Cqa5wtZmXyKOb>0MTqIYiacnYE5L`4vF9yASk-pSr6-s#?0uNoo@ z%G~^xdKFd0)m~jebxjHWR@K(Q3fnp_-^;gg$dQl;`b0_?8&hjaN)jMxYznR}FRYtd zRZ~%LK}k&&hBm821w~cWvlAeZMnQR1VQ~VZTzPE?1-gpHf}#qjhp7>27@U=&p{4|) zzP7HWta4g{n*>Yh3hHK8C(S}=>sbm$D@@Il=Fh4rt1Bs(QdS9VenKls$^!-EN#%HK z8l(vRPsn3}kUircuLkm2R9;e8IiorufF~LAZ9-Zfo-6e!@q`*o2b&+GD$#&VnK9KX zFRAoo(_%Zbf}|&~#eu@EsxS&5px6mvBGl61q2ih;)1Y)9vqg3FUIny8c4b>IN(Qje zU+0xp6c$;Le!w4<9)xglSy3JI{*b@g zvf8@B%AyiJ0pg>iW@cfzH?@Gy@v0MBoE4L}F_@Ax?RWs#cDG`RH_od7eKinH)#kUR zHpO(zK3Gy$SW{=XRRr13FQ}T1$)8^^&70*Fdl0532Y3Q1uc*Jk8<*$hP4K3qx*4m= znMtG26<%#g5k`z%88x&yWp*8OI^f#WAh!G9OiZo1tY~_{tg_1Ds#!L)5f)WdOaa4- zs)|brYKscXp$7tU3n9>F7eMVPn(mG9Dk{wR?23ZIso-C1Md0LWZ`?R@R4OW}f)=LU zJI^cfii*6#;`3%eQ^OfHf<_|0zRb|tl5!Za8B@G6LWNUHAWUF{S66UeVG)diW_lH8 zPV_3PDzRNLr;!0Oph}`nFFzln+8i?8H_Z~JS_#cjVLA4CpsJvvuyVFH!#lUkI~V@p z@tQ*LNd+Fq!YH>Is%A_nFDbwd72$aAWN1=P@rJ|ec*DG5Cwr%!k|-^#fJUw=Sy7PH z&X`gFEv`|QGy$~*V=$!~;FAldK#?Y^MmdDJ+!wV}HfVe{tdr7c4!RU#y||#T7DtYW zgUOm;svEWtoNDq=N*j+!Sf?c<5kaejb(2pvh9nZLomH6H#2J?<8=;sJE-NZ6fq1Q+ zF=cwm?1I`^-o%OCxDn%xH&YH()C-mv>(oNAc@rw~Qmnxwb?1Sl6kw%gQ|k(#ZbIqV zL03wi?9qf~454Wyl~5tdW|FNet`C7trDfAfP5TWkmx;Rqs=Hj!;K-?E<>g@xt~DvA zjuD|&1}p(9ste0%VB}Yu?2FhII+%Kr8Q+@Txfp`1wx%d?I2i&|;;6?ABsh~;&ZZ?( zg$Y6ha4eyT<$~UZUV3^$4E5XIDJ9^I`R2-}Ai$HIneDaAXqwH#6WJjt)y!(dfqhDF zOZmWovRd13OXYUN1_P6nELiFqhS;NW*x))@jW*D_M6YhNq@0L{tk&>j$-#i*G&4|0 zIfg|`JzF6(i7CgZBHF+YJ7Q{Y$^lS^)zGC8Q!^JyMKfUFin%rIL|Hxbez=!xNU>Xx z#b6buAWKMGJIgQwyLg#y*<1?1tY zcrbUEUn@<0m!~a(eXQtSO<{3ay*Jy#fj2xCRfWwkwBu%^gg<2j%#Z;`{AL3rV2BJO z77xl5+U-2AdYo4ctNa08{y;B(ke5H$g9aEzTQj}dSp_Ba)i5Jb3FT5DwxN%nQU&cy z@@Sz-GwP~mfXQZM%sR^}hi9|?Po{c251%B%C33+yFEXcR zq<|Pr>XL;0BO2;?hqd}uH4v1gZ;+ELW z=|;YhjJC?dBFhFs=20^O9-d@vU@xGHj!rHZL|OeE{vDKV=_Q_Gla4%f|)F02lP5k%u+DjT&x;wIU9OOX+-k@i1vaGQO~! zuOb=zI+{00my0cxI2>9}azm(0bgZJi+en7v4gIj2*gn`!+F;`X)6byH&Bfy>Wet8c zrEOzkFv-;iG68WKRCay4x2>$bl|NrFP zL0M%{`HbR{Ni>FWsj4c48xpm})B9Hz)|JgH=|8C7zT*rU@Hy5N2O@lrs)z+oaNVG%ij$mtUv_ou+Sw~{u1k$<{?A^^Z+Y)fR%(Z{PT0=xvV34K+JDvkF<-8jb@FAwrh+=HU(5aV^sUo zoBspl2l!dJ(Ja3*7t@IPSxwO%{;xx=3MBtBB;N`g6-_@W+S6vOCuJ=Xdo-9~ARD<{H_yR4zSZqjBF~bU|*+-x_Uz zV0v_3w5Q*t!H69Zn-^_0(l2U=M*Kq>qCHMCG#VR|)S`hKcXp+ zzbj%G59ueza$}=nO|h{Lr*%?^{0=1gx9$vqnHxC!c60XQaH8YnKZ3xatuMoqqx~SG z4S|5%1QM-Ur{_cmg2=(()x%)jDmOY%?!`vL{6}Z!Mj;Q+gBiM_zGBQsf52p-IX3q5 zfTwnWM6cF<>-4oT|LWNd(G35qSTj@<|F(;5*~$qg~T4HVJm z^-WRm>vb)2qwPmWJC1Li-Ll2$}r@Xg}JoPhSg_D>vG?A=(KWh*5a@ z_WFjjUaF`bXlZ^ndRgM(s?n8Q}F(Xl2}{uiyh0sZ!-btZ^iX8qI* zCqoWy2D>1SAGJ)c3k2O)CMSNINOb?pqFIn|XGplOjSM)abwjlECDF{rKs4Q$jvnwc zpd7Z(%8ecv^Vg*3Vo3ShV7GnDzY}(`-u8^08O?xo6wB?US%&IW!!7WSe|f7WEUNEeFBNm`Ru<~EXf_io%wB?6E zdL443gW-5quK#^SL-Ygy4Pedprfv0?N1FXBTR@ZeD0M*dVBLU${y|%`emXXw{*q2j zpu08np)r5Y`M5$$zL*UXOCS)gY}+)(Fo@jl5LM6(`fpE%gR47%EI=^hZx=O0`-2%r znNEL0Rc^Eow8>EG|9Wu)*yqm&tFqwukcMd6n19zL4bjg2TV8Xt3q%Ceic6#2Mn&6? zjK;yeUxMjbG5=b~SQj`0JP3}w@8aBf(O#FKE1IJF$1aZ!!g>Tve00zy&>O_id8SE8 zAL>6)1-3P|#nuM$mFw?=Ecx@>g3rD?AFcGSXxj`y2|jIz9-9jd1r#gpVNJa>+I1vm zFxnORW-!@@u|u@u!&szWK`-9XzZ&#L(ZDgIqMa@WgQHm(+M}YGBXO(ih-h2zkPl(; zY+CL-XppL)X8i!A^M^VZJYX?EX&5Iq_}ifE>Ir<%+C^XjlI< zF#Ucw1Ym2sTxt#Aq|-qWDE{oiTxcTdph}H`j6rT=^U_a>`5Wp?xn7agga!Exlm;|O z*Fe-X`^~Te{#*juTb%*>AKQIM81r~o7D@(vSI@ zAawmFq1|uxAA?M`gZhh|z{a|!Xn)*PR^5nJfz2@bS(4UZ8pTH;fS}Z&AGyCnGmK2W zuECRVu!ZrO7<55z=P$^#%@O3`?OMnX+7lb)zm^WMy9`R`SJ3TrYKR^IZXRG_aV01g zu?Xiq8i8y;v9`e~l|C!x|LJ0I!mf4z|dTnMh*T?5iK6C~o_iG!F&BMo6DH24p-Xn?3$a{;*Yb%?WG{*PEu z@3s~7%Kacr{VPp8*d_ri{qO=9CdB;LqF}!`)nDBv*MIT?jE|vETl~vGTRZ;;2)RN2 zWiW)Y+gN8!(D)BWA<0Xjw4vm0Xb+wR4)u3erRnv*Y>UAKBQS9B{xSb+s6kkrJA(WD zg}~bT-$2F4jE%JDr@K2fKwt9;lpCCPZznT=d3m}~ zybi`Bt-c3GJco_wBb}_T{aY`=wx}U`G@b&Z+vKLD{%z$(**s{dp_Th_2Atf8jdruY z54U%8gk)Eh!=W7=b8}$}*r(7(VHNSOoe6e+)+!e^ns5!r_Oyb$-h%S)f;{w9Gfn&A zU*7s3*l{J;0YTCPt-t>aX5mrn2mGgTb0g#iOVod0251kY3Is6b0PF{I8(V`z_swX+ zjNlqA27&8l!q#W4;74kJP7B=b{|-%tEgXMCMfO)1yOaKq`cN;N@;)lP5zqSwU2~&y zO@r`E1Da?&WNrNflf1sX*@ul>*nqv=fNWn==U<25vyRxZUW=QUwPv;j65TfgI``HM zv<3|TV*VGXba6T4{SO^M6NVH7397C0Uq&_SOcJ4i^?WCA%YzU};N+`8tjYfh&$z~( z(Tv-RVB7!F=xm4M_m``26anq>eeKe+;p*iPL=9Mv?`zi-?PxnZ=t5vzXDh?K(A9tl z{5*(T&sXOL#*LSE!OLfVQAIPvf@zCvO9T~XWf#cJJJXt?N5W=q^a$viaO8WbfnXh6 zwe^D_!C^VC2SBj@3MzB!Kr@{d^!w&490fq#h3*bagHXmjC}(IjJt$)IiT~#Q(0&{V=MRGF zo(npfqC?Ff?$JwfFOT_elp3i!_s5emUS-ZjG}w!wHo1&YwHCjXIA zlhT&`;aqhEz%jK=OCMgpB|93mRYptfDy+?#>}tp?`tEJQIJQc}Gjf z`HfZ0^PvB_6S^}fy!Sgp>*_BrgUAge{V|vXSHRG7Uwa<3W>8FRVg97mY0Tt0`3dGPPGnQ+k+^|#LfH|M6;VJq}~T7!QXT#$m$bu&%qeFp8OiK=U1 zA2Rm|Tqc?Tv}I=6U-<(K+Vxh!XSPaQM^)les1ndJe9GrP2Ge6!dPwW^ zd!U(`fw8fsb%V)8CbuB-xyP`j2qWpWwDk>^zW+x!4NB$3))@8o&wvYjJ+JmD)Hj$c z4K&2>+J^YSax5Xy5W|q~a~NE;^QSu|S2`2Wi3_*lxJ8nF`~%t_`_R|1$mC=D^x4pez$tfh#TGPrjA=b5 zndT5og#IGuOPK6|E-TY0i7O@dTO|*~{O6`N`5RD)nbCO*I?rT(a66dN{<~-Yzfr*VQy$qxVAKPsO=Te>WxrUNutUuF%2RdDmXhvJ8N+Wp7x6L!prw08L3Jp77$0jb*;Ci+Juj(FzF*jTd|EDwI{r#ODjuK33wiK@EGX3vN z((|KWP^;0=Y}3$>;`IiYYygX)-oF;joj1?_0EVLe6D19S0=TU^2A2;Fdc<#&zSEzP z3$4HTHT~(c#W1f3^`$%DCLgMz-v+Yfe_saI4*n1Op)i_K26p}1bNx{tf+-89x!Xax zJ`FVy%!W=gd6&UlGsfno&fGvj-`crhzNwXGz*W*l7;D~D40IcGDVZ?$h$XWYu1lhA zpl3_p1#=W_HsS_Mk@%mMHOzxK8UKdP4fa&H0M3IfL6Z}01K@n>e^r#eGtewGLy)y=oxW?-s1c(;E#&61k_P{WZn>~-f^`EJ1}&N? zxR^q?z;mi^YS)r2Rn5{W> zIpih-=i~o2)3m_Lp%pS$rZIm=6Uci0Ju@K_{wr`U49Q0|MUMl8@6HTX=0{-0@W# z)44i<8RcV$2| z{pcbaULj)-P`!i(6qmxS1xP(y=z0>`<{k!_Jete-e{0mSoKkrC7gJbCQeQboQ((re zAe0!DY_AQDO5TJ~NvqarePM9*dnl~KaOMNM5*X4!thU8^4_>|&z1$2_A{{S(f)AjoMF9%zH{@j_ilGqobqRGkbQUcFY+;NO)AH3mBi==Rsz7*7Ve-AbQ@ zY5LE=a2gWa2tz>ssT$L)JdWG{Qv-t?Gf0Cc48oU(+TimDU;eC*zF|IDLJu>DgO!HE zmsQmAgW<)BdfsD(PYv)q!>0xKdl`sI1H8%bvH)LVxcFcyNt|o=^nm;T!^;Ca-SEl) ze;ND(PhSQ2*T(+y1N>pbYXUsiaDLhZPv2`e3MCc zLV(|B__+Z-+3-mLevIM24e+*xPY&>H#t%~h{5~UZ4yGKt+;Ee*6n=)`@QEk2^fnxy z=u2I`Fsk8`wraUP4WFHxo}lTpb-Cfmet~&9=t+Z@QF$@Xdcw|~h9~`Co(Tj#1G>62 zc;%Is7PPU@$S32_Jnsj`-iCi^-ei*UJoC&T>{S@~q~BP+927?2H9TH+(8jLT$dmme z*UZbnl@YI;#Stc9ifa50!BVMxq#b*t1$$@m!yd1NQKjyhuShs<6)4XJy@N?O- zj6ak8FZ=Uu;A!w$FfZnLP1sp&>`C^UaS}Mj@MOQq91r{W=wHa<+rKXmIO2OyI3bJg z1=}SQ^Sxj_wHyj3Wbr*PHe~U=VBDgZZ=RwKp5S}IxV7@Z{?YPa|7dxapmHF-7wjLc ze6WACJlH>49>-N+@x6ls41u3`>mc>8@AXavwC9_rwu6U!@9-c5;wRo>n);_K%ha`$x;U7UEuV@x5UGh(~=d*biDB><2B+!Bt@KMSCR=`d+gA zN#&=>-Nd%zsvFfoY%p;y|=%+T3{=4_UVll>;!zZi~p@RI!z zh?!+M__;%3bVKij!IAsH^bYVJFXgl`*il}`n*1im16&dx!_-Cx(XX*RvrM|l{&X1W zzuKhRiIepf(AHfLR~h1xF47J3EN$6wdD+BcJRS%sWjWe~qz| zt%G-+ta|S(V`pdD^Xxlyus7YzN@d5r9V}BgB?85dJ8lKHK(Nf%K;&xzy&!Mf|MnC5! z`N`npjGn;>`3bc3w2@Da6WHRbjQ!&h@@r`8Nk_eY9sHT}X5uvOGDmxI2lz8g{wOHl zFy0gF4CDPB>7L-w-`8PJONX9_L(h|t#V~tLa_E1+;kOo05yJF5=dfqDL(hQ@J%>5$ z@9xmQpF{o}N4_c?e(3M8^BRZ#b`JgcPFa|LzHr$87l)p=9R7LBA^)7i&ZQ1Lr#kF8 z)1l`Ghu=Cn{Pwy-PZx(hPdMcN=8(^JaD4YK%>P`&J3>2g4e!7j)R<*I#R+>Tzle8W z&GMZU$95GLl>d$0G{0;MbKd73hk2aN=|XGdax~k6_z_A!pU0f__fqmK*N1pdrJq}1 zOm{KK;3}K8(La(8Bd+~0g1FYh{e#vc{q{RL7gwAQln>*m|0W^NenWZ5rJt98{4|Jr zT%^3@adQ;EL+*Ls&^E5vZ$e5NAEi*`HcZp3-wA z>B(1mm`@_E^%N^T%SlhE(!;#kp{HKyxt;WIKhODM-ssSCmC|z`>EYO8J7U_EYCbg$;U~47;%Esghqze3_DGzDmij zBKg%yp7~lOzmDYBDS75ubR6UG4cf*P_Y0c$A(?JUz7ugR-^0OsIXL$tTF+pI{7?rU z=HUN-v9s7=f4PI#Id~)SUn;NHNd{N4yd>vxK|PXlJYacAo=rM6AL8IS4nD%c^BjDF zgU@yF1rEO0!8Zzi8*SriD{Z5Hz7$->8_s?4;_|bs7t){Xf9+3>e_bvz-Pbr#SWEqq zv!79q5#Z&?Dnh@<}9v z`IUA`{htUuGTx;9ONBk33;E50e<3*cvuOX{1uutvT+kk=N5+G+r`U>{al5p?&cRm; z{vK`PYMtOR4z~#YA#LMo2W_MMGTk`YkNjPd!4;1~G|wk_?f)D)7x^aI##NlQQP2O- zHm*j~HumE;37${e*e^>ynK9_5I@3vVtzk3CLNpN@w z!7OMe*Fgk51ef~D1($xVbMQvNW&5+j!TB3$+HaeM{Abo=^UL2zL;3dw=WnASZx%e8 zuAh)gd!7HDZ zF6;X)!R2_M1R;#J8ytL#;L>lq1($x?C%E)mM!Gc){Ve^^NpNXr4+rn%;C&rDkGL+c z3B+}I)j9Ocad7yfy=K9DN&6QIF6+xG!DYSPD7dWGTLqW(dWYaL-Mxa#_9_GJv*3bu zUTinb?_|MK>Z5}%cJQ@=%l5DZ+_%LA)4j@Wn%_LZW&5*AaB1fT!KEIrja7>JrJs8U z{*Fj@h~Nta&v)?2f=fTo6`aR-sBX33vj5#6_y;20tq#6JaG9@N4sM@=wSJcJdmZxT zMn2e~{bt{H2=c59YqXZ{;^1)yA1wGQ!VjYbm*X+}e6qD?w~%iX^0FLP37%5F1ef(| zi{R3pJ%UU9S(!;cNd0laWt{YJ@N5Sk;@~+BKElE6do(w+$p`NG-)4}%%F5@AqZPNd{MLhHpT$al)!KFPD1ef+y3ogrjv4gJ>TwZ|3Ywi9nqq_JsHO#zk$tc(v?n} z@4qu&Lmb=NRV0fmK8{?L`!JG0F8y3Axa^O39s}hipDW~3`Zd9&d?(_1o}>$LJx?-N z=#lp4IP{Eg=vm;G!$-y@ZF5``Tf_{^Hmynn7Am?)=m-92SzM#Kw(dEeZ z2a(JABIjp5v8S5fMxjUgneU@%`&S8hIS$+?xNLtm3oiXB=VxTPUywY;|MkMoJ;ZSw zF8My<+7B&go&@#WAoQdYM?I2fiFp-iXD`8D7J7yVF6HIC(5FIvfsmK^mGeKcd^ZYt z84p_pm-4#=m-g%vT*gBuF%Ki<`8)aOPuaf7`69`O2tBJret8q;dz*L%)^Xa_?LaT$ zx*d@1lB`G7B(LLhj)N~1oMjNLcknHO%j=Gvg3IfUF9etVk@L5bd*Bybw4XDGYyWg2 zuKhDY=vien+MhnOjrwK04RLU8Kec=v$?I}tAELbMzpfJcC0`@-NG|;^+mok+9?5qI zJ(6>5qdk&KKT9s>$tBMg{*->pBaVKM?OPABN0(QexGpb_b8MG5CQ)=4$>Z~KlIJ`4 z1mdpp(p;8{%-1TRN7gScFVrKs>>nlH;Lx+l!Jl(*S?{ENS?^?fD9cy!9$+^vXussL z-;|uo7v*L7P8ND({gwTx>}5S-gOJYkjKGGFTim+h^*zau&Sy&24}QMTKo z9ek4D+i4qD^@2-(a-XQChaCU~RZ9|^up@DBxF>)_IFQhqPVB%Y3F@H{~RGN$N$+P zT`6DZknbhrxvUZ82rl)w((NncrJi!Z-=l3@Nq@@xt`PE)vra4*$u~RXcRDza^HI;c zB!jCyu#XG!)ppbT<_IpwA;U-p%j00o$T>xyrjGwe@ZUrb0qHz>EWXF=L^m; zhH`S8DeIS<&yoILD)dOc+QHWgF5_yWgFofqn+2E8XKojK6=sN*9<q6xKc&0`m-*tq`^xE_OzF;1=`xqs?=s!1gnsFtrGiWU$a!+fS3Bf6jNdh5lZGUnh7U!LJpZ`#U|a zm`yUsrJlipOFff_qd&QgLNrHkS?{G4keBI>AkO~e7sR<8W`8oz zBYCuw`%-I({l)8o7X*mYHp=f1e1zaz1)n3hoUh>i8uh#)zCk z-$vW$2k9R!7hPVvNM7^3Lcg@X3vpe4dl1+4cL;H`N5;=k;<|i?Ik@z*ye`NidGx2` z6C8Z9gUj-g^C4UpP(OZqkQc6B$Yr^3Jwh(aaVMRKT;rT(h~m*u!h za9NJ)1()S0-@lOa@H>ROP`y(CaaVk3<=iDD@`4JBJI^sA^kk2_Z632GzR@%nZ z3c+PRCHoP{H#p=sIk+4TNdI`Ey_MzFSMcqm6IYW2mwM_2mwJ{u_*w^l%E9@%68$Fi z?{mm!h<5d3VZXdilzgy|m+k5V2cPWVvLBIp__`16mwd6%bDOYpDRCWdD~Rj(l>N&p zp{EmVYdt(p(|UM3hIYz$%OO3Q%W>2@B3+JuU0#cY9$AiS9sD^5-|66A2rm7+*TMG@ z*Z$$_4(*@8BHmWfxwuNFZT$Ws&Wq~r7cuAW5%p2>{2d|oKg;uXfw-Mv&focA|1;JlgN0cn*e&>&McCfpyb!l{$#~B(LS$O&td}FZ`H&(9hT1_uKgA#&TEz@oVbs`d@>!#rZsck z*M4I=a+Lf!+Sh(tMLbW*&!v6sHwhVKFui}I?OE^O9}0fH$nU9bllDly(!qal@N?RQ>*<;m&PO}=?G7Gk zAFgMx;5Amn{4RFz*B$)84oUq|&p5$rh5n};Jl-*>N6OD}@K+tY9}PgUe5Ia+4*rqg zJcdL|e!XAP9?2he@GhOh}gTF8M44ahsox6WBUCAGG@DCik8+Ekkx0yo! zA07Nh2hZ-Bv`6Zx7krk`zth2A>z33b)?ZWhwEAC;Kv*qF8`2&f7B;j ze&Au@yxzf|a`4uNhwI66@Ocit-NEaQ2-n}_;2ryh%hx#g?GE1J$Z$Q!IQR_?-t6Fo z{lfKca`3Mlym$X_Jrf=Lj}E@i!OOG5_225?A369@1H$!`I{0!2-{as@2Zrl^+QCN* z3YWjr!TrJE^7lD-`=i3;Cp!3Z4!+O9rym`zf0cv3;^47k!u6cs;Fml2;||{J;DtlN z)4jpLH#_*x4nFAEaQ)>D{znJ@)WJ_bE?oaA2mipqPdPqZ&&Lk_)zEPHaVLcH60a6K~wpJPSLZ_Bfi@{-@=;BPzlug(tFQ|aIj zJNSha`39(hU?kk;Aa*jt4X^~`keyBvJGgSRUU*MEwG&v5WHf;U)|<~LH7 z)GztD4*sBnAADZ8o(mm(tAh`k90+5!u3pa@I?;(KMwx2 zgZHUSraRAWn%_zXf7Zb>tHSk+ckmSszSqG|tPa=T=-|&gc*pa@^-Of|TOE9tgZHZm z*FVd_A9HZOHeAoq4qoQqD;)e~!5eK-=J&+9WV(_!I{054JZna{o=+V-J~Lc?yx^Bv z5%c@1gP$`isYlAc?%)T~MF{qTQvOK?|3>i3g*_#75rTRo-|FClE=bxb<;xs=h2Zl= zx_cdb8eI&aJyQN=2Y*HI1wwx}8cd@e$!i^avx9e_L8{g>!NG5F@B?YkqxGD4Nz$Lv z&Kd`Aa`3dd;d*ifUuZ?l@1Gs~;7hF#+9~Br9sFJg&!)~&>zV1`FFN>L)VQObD~0`O zRLM2}wS%vB@XINPwVrPsyp)1c%fIg68C0lR{vrqe%)tw;NS2HA!xjfWnF>#*`+$QV zLQ1v#Qo*kh{{Pg$Cz25Ak@A0Z@SfKs^CjgMI(WN9N%^aVJ*5u*goAfm9ImIXB6)W=i##1t`hbfN&IESPb0of@dDy+DbCM@?^JvV$$zZ)-Ne68{0ZXU zD87yOKE*#Lj()_2{n?8AkgoW_#M>%G7=M%^0o2C8?+CNzFOG*AP#jhuRG;u6P zs>()hzLI~BPo8Py9l~`MuovioZ_s%M^c>_)5h$5MQVGTf`q${Cnb0 z5=TE=Yh7!8H!FF54)PVnJNx#ew}qbTgq~eWp5Kq!BjlF~`5%@1;iSJc*^72wFXZ`s zG>$iZKk5*Y*Zc^@`MvLB6vw{`PUSGmiU{Be@uM0;;|Msk!Hm^ z6W^=&uZaJo_+a83kL>?biMOWonU5#V@9{A&A3_)khcPP{|Z zZm>M->8*G+$se!y5aM}?=MXPZd<5}X#Muw6Xn(HaaoWE@@j}|a#li1Xycg~B`<0yT zp~Rn1@`us>3yL2>`)??IB<=4~yg%)Kt@r@mr*S&la}4ozil0EdhvFv@KTL6cfAwg^ zb4mVG#rb`PJjMBa*WW09F6p_RIL6OZDqCFLrsVrld-VswF`g$-dvTxOW^CWyD*Kb* zcwNKGE5tcnj@vzom(mGQy8b{vW4he`b|lVvxW2>{kCUFkigUUn6zBT#8^yW4)F_@q z`sXXo^<{auC|*ze4aFA_|5Wg4#LOz)?y%psQh8+(N57#w`>mVeaeKPg zPjU9oNkTuCdo9J)XvG_epQSjr+f#)8Qc4q7)k=Oi#bLeR7!N#d;lIPh^^x131xo&D zYEQ2c9PQ`p*%idmKc&Ej!arR2?{J}hbDeIn_o9;Le(gQQ2b27_inIPUt*ij2JB;Mx zijO9Kl;Zisa~0>YQGw!(BwwreRmA5j&es^r72ihk4-#kpFQ;;UTF94?EUsQr@{_21 z-w+(jcO>a~TX5OVd`=wwRtEBM_-B^ZcE$0(f%LQ`&hi}p-4&19)4goP`w$36dhO0}6vz?!joeLB{o!ZAGimxJm3vtZXd7zi$@DGY}exFsG^YxD69B+Gx zbNOZRnlUFE;0#`<}Dewvc!_ZxpB?5Py?Ojq((kUg^mH|;PLnb?f&+YyJg3J6KCOFFXp?2y>!BM^ojhBuU9OW-1`4a?3dH#EfBLzqKzmWVG z!BM^^>7OV#${#}Y`8R^2{7dAYGR0pdUQHa!1^vc;zDV&n9K&Um;@l5zQhc(JhHp<1 zXaD!4bek3D@$t`!bHC4j503SWB0UFD{G$Cl=E9`=6KDCyX#aS@(Qn*dpCmZ?jnf?^ zILd!Qem+BRl;?W!Yr#=|0JRqdf*bu*j?)E4`B@}iCAiT~@)rt@@{f`HC4!^;Db$`^ zDLBgeR8JNOj`Dp;|8l`mek93ryU}Gccb#VPjJ*fi1a_IILG0$#JL`Hk^aYLqZ<)x2OH5 zXwBuq@yvh65X%?kZzj2qmHaML4$BY3S^hiPZ$#TSw@&1a}6Ca`Y8sepj zuO~i7@vX$=`|0Nc+e!Q`CC}gG{IlZteH~ohQ+xvPPl708YU|F?8 zzfo|MKY{pdiVr7#pWvuxf7*XgaMUxF1#bHk8t{AJxYX1;=!A zY5xqQsZZzH(TPx;zkaMWK%``rac`9n$mP{C3D zdD=fhaFplrI!17m?@bp5#|w_~6G;E*f}?x`$&V5o<+&aEHE}GLTHw9lA1)v>Ia*0Ym1=C{sf)%-Rq`2iGf zKM9Whe24s*#%s`n{$xM26&&Tq?`PC|9R!!<8&{nD(^qiRb06u+7F?F&P{C3DZhEjK zM{tzq`=)uswIAw)JnG3JJr^lHleqlOMjgoW{Md3Oe=5n}N1W3whI4RvMDQ6FncvMy z&zq#@J;m$ywIFwV_mG}Bf}@^9Jyo3BlN$s_J$<^u4=leE z9QAO1?t_YR&$am4-m zJ*2;_;=74=Q~WdHy%qnF_&~*5kv%6WejxE&#rqRKTk&IwPgDFgO1IL%xxR9K*OPpM zl4n0$qxcIXf0yDLiLZ0;Hx#cV`*$hM@w`Xz3rXIiddc=*L_9-rzE1C=_$4IYOYzHy zXDfas@u7;}O?-sn+@Izv&iC&oEB+wqDOa5D19E%D`Q1SBjY|Gc#1||61o0J$^L>*w ziu3iz{fa+LdR|fdTH-qt|10rN73cE(PH`^ZD76QiUoPMFigWoMpg5QBVTyD49;G;c zPwiyI|4#OgQJl+tqT*ccC5p43&sY3S(tnZS?ElLZXa6r%{B6?nd&Sv5+}^W4d7kzW zCC~OhtvK8Bg5u4T?%x&X_W6CqJ(}nILh+Wwe^9&w@fh_pZ2y78+bhoPSP#WHUxzBr z`5LD9p`?G5;>Qx7pg6~KvEp1$s}<*ZdXeH|N&iB{S^o`+bG^7#@eH+m_~{>fIH+ts0p zbNf6(arRHX;_T1KieEzYqFixqf9e(I{-sfIF2}`+vp-iTzLfm7MsY63^@_9q|DyPf zq~{gI`ToV*inAX+QJnqut>RoRes?=w|i)gy|(K>2-IagM8( z6z6hzQ*n-;4;1I`ihiXy`}1eT*`IBCq{ajLbAQFzpNA;UcJ^1CmWhG*|I~B!9Ky?Ejk-XaC=>IOpqr#o0fPDbD%*v*O&YzN+|0 zvhy9qM-l&2@v+3eQ=I+QvS(_!k0bd`inAZ$igUd6Rh-+&A&PT5IZW|lN;gk&_S+=I z+5Qs6r;?r;#o7Lg73X$uq2jYi&kc%mes5Kr+mm}0=la#8I6r6mjN%tkx-Tov&)>eK z_{AjuvEr8!|3>k7#M2H;E%(caw^f|KH{DI~g(TlwaW1ccigS4#ulUuZXN2NhUipgi zbKa8`XMdI}&VH*`ob7B>ob9|?@!yl3zf+v;yhCxe^8v-#&c_vJJO83M+xa)e+0M5W z|0CJCTXD8?ui_lfE#j&1!0Bcw&gpg~j`NDM?5XDWP$geV^QeOaUk;LdJ$8)Xw*Y55 zPZb>Hx6}2>>4Kv?*WdAiqx_3B-aSWfl;?48k>DslzdQWEGA(XaiT4NDKed9R{7KZ0 z&JrB;bGtWBaFlor1<#nIpTwV_m=kh9tb8vYw zZdT?y`B;u??5?+iIF83|1~!@aM}nh0-_s4MX2qxe%AW9p;(sFE;vjn*^`o96dfWX> z#cw3uS@HgdTKVG?znA!_iobTUl^?D6z*8)rNSytXPS=l972jjUy~`EfNBj=OM@Q^| z=ZJHD-|1udt4h9+Hv7+}kNQ`fd7&_Q02dqx?FO|6XvEfBgh|z(3fo*`Di& zXDI$F(%)0@`-vZ__)g;4idUax(>sAU`*{z|SC3Yl{a>zl7M06YitnLz?`h(kuM1DM z>AtMwC((0UJA^#?Eh}Q>KN1}MHv1IIn-%{P@gEfLcB++cafn^BJyVHiD*goV&WdLa zv*%YUK9TrE#Mz%c=sBN-iua-CxYjB?uMfBSA5*-P_+ONsI?}UE@nyunS9&fw&FXJM z?F9QFgLoI>Z2wNu(_6@6x#Uo}^cNhsW`tcxmfABYlKbrR>emVzfbAuLeHf^FV5^?s=Qj#B|_(tO8O3#E*R_}#^V?6V7iH(9|Jg@C( z<*!!!2pYHDp!lc6`8)q?|0Qv&XN{8oiTM4B-$VVxbBfQScI_p_hfzKMyW)F@zo&RH z#ounlw;pco{9f_$BP{n1wQJ7T`^Vb-EaF@)IV~+eK=BP0d&der=zlNG9yn2O^nV)J zGfHrj-$LzAzThZdeVEnr8^sSNK2`CJ#OoCwLFrzq_=Ut5Dt-d>r#BL3Kk)N!cPQS6 z^82FVgJahIkA;5BZ#Kz)B{=5y0VJtf51Z=G6MUL)j9JtaR}C^-6I1LK zXA*ykINP(yxAHFud9-I8+4Fb7(VpULEB~J2_mKV{6yHO<1;rzm*Y8MArsD4q@2vQd z18lknDn6NbKf%%d9c2G8f}{P{k$jHgyNQog{I>&by5}f<=U~exEB+YCmnohz$ja9! zzLNMAivK|TTE)*i%IaB3oXfE~-SV}HZ>RFzEcBp%`1>TU3Xc9+cC^*=mg21_-Q9{8 zk^I++|CRVpifDUSjeN_^2nd_1xLRI|CKoVjo)kA zrZ~Un`@Pb01od|r)b4V*6cgW1@q36LOq|o*8nu2Hpg70pIH3pq$$z(dmf+~mzfr$4 zSMdXLtp2N&{_Pb1D}+4i-$LbeyWpt*q~olf2NhpN{0YV1BEC)W@$!~d|L2OYCLX2!mi;h<%Dppj&hKp$KfRQEo>lMV zC|*qbT*WsLuTp#)@r8=>{LD(l`MY5273c4NJ*Rk_#(~=v??e1c#reIY3>p`(fB1ce zLlrM4Jtr$Zm-ufLUrKzI;%kXtsrW|XD;3{Nyh-sL#J4NXe~0@c#amGS{*B^s;_YeN z!G5SFuK)fN|NZRamHYydKSS|V#ETT??~+}t_!g31srWA9PbfZ^+N-}Q&fgFEL~;IJ zgh%5h&M$vIXg|gGkp9CI_ozQTLGhu)Co7&ue6Hf<#IIL;F7byHUrPKhimxU9zT!L{ z_+Ig?B;S$7aqNdLh@YrCE1pgKcE#(7Hz_`s_zQ~j zcV2cXzLey@Q+ze?ZghRXe%M63pW@qyk5qgo@!u-GkN6deXVG}(HpPpHKdks1;!i2g z!}-l8-dpk2#E(;aBk{3{w`gMrE_~g_`s2hGDfywqHz+=V z`1^_%6aQZEM&fPhdWF+nL;PUHHxfTp@omJXD!!BWg^KSczF6@+#BW!8AMqx|TVzya&m*rRzNQ1Aian5XFa({4mAyh!-ecO#D*C7ZAT&@zuniS9}xk zcNO1CJVw`lZ2w;3{T1(&Y5g`%@m|EIDc+a(9K{C{U!wR>;&&)MjQFF9k0!oF@qFSu z@5}j`MErXtUrf9mT^F+aT;kb^FC~7K;_Hc@r}%TkuTgv#@dp+6+FCzvQM?oJJ&N}s z-j%LX+5Qp4`zg-feHy2D9m!v)_)_Al6<LXk;^}nV%y#Z2K0xtK?W`Zp zRy><{h2q1AU#~bnPx6%F3rPM;#a9#WO4r$J=O*IA6yHX?O!3{s=PT}I*?irjcrW7H z6we|4sp1oecc=U3Y-b(u5sEJ+uK%9q3gQctJb$O)4#jtn{0oZjA^w5j^){>KcMoyA zuD=CHBl*Xp>wCW5|NSU?QVYRRo}cr{5_~!G(N?~b;3&_}(e)yZ{y}@lOz$Wmk9t;; zo>P@P4P(4XijT0#db1QSC4Qyi?2FZkHXiv4-^Sr}y><0Q7c`?lc97mkXcm5ex zZY*(@Urh2BDETImpReR6&~^6>LjGnC%9pMaR|<~#+C=$Uqj+pA9E9bG9J5M%H()gJ z7l^Z+z39684aIwq{n3+C_2iTNZ54ly^!Fgn`ZrU)hAH{G^Q_)6iXTh-T%{+2>?~7! zh*jgwQT!_6ixpo*e6`~1i9fFRQ^dC^zJ>U1#kUdnPO%&8huy?`E6($8qZQ}*v~tCV zMy#UC70)AnhvGb+)};6Xl7B(*WyIfAd^PcXif&Yt&%GCvmk6Qx zNE4rdD1w5aso|r-uo2D5jN+{zs03(~ny6TmR#?_p*?^5xVp>)Tb2jVV%e^r(|IhC~f6qtG+2?!KUTg2Q*IsAebC1xnzx;jiaKZU` z+GN2Er&&Kw@J__95uCrzy-V;>B)?T~e$Mum;HyafGr{?JnrlMKe(farSi$!bpC~y0 z9`-!J4VS5Rx!_%i-zWGW;*ScRMEq&uoIm;ZGrl4CNA&sYu;AYl|4ncweeURXp4nd3 z--CFv;0eU15Xbnx#jL9KSwjAs2=ijG#xcLOzs=b)9A`O|7)2V0%SQJ&vleOPdQpZ{6Gzl>CBj8`>|`in{b8yZLb{9Y@+ zr^f#0_gWiCp8d>u=4-)eS!g)UH|?`L4Y$!*@Jv(8NEN)2_)Njq5ML$uR^pEdzK8gJ z!4DDtP4MHyPrJY@aQjaX@2l~Z#PE2Z?^l-!UO~@omI%)OFN5FL<9_k~$GK0)AEbC|&^Wed zGqq=n#`SpHAvnj|PU7f)^fTX=-w=Eq-4_g6SYkWT?zcC<4z_UOtml}CjdO+k^&~$@ z$n$+$D**_5{1`cqQ>W1?TUDpB8*G$$udD zPU1fbzK?ik`n<*MKSn%R@GxEn3LZ_oNbpqRw+YUl2Ok!^gyeS%UPb(n;2VgC)8{j8 z|90YM3C`aOj}`oLlFt#G{|?ZNf_I`kbFbh%h(97Ye-3>~a9;QRQ}7bfb4>6m;vw`o zmHWGf_&~w85zi2uzt=7joZnkpF8DFh^Jl^N^ZToU$57roEcgWCzY0E`c+U)T0&>49 ziH{bXzrUU$_(qbyT5$e*Gphw}B>BGxew_Hrg7f#+M+6^4`7m@!%l4-c?Am~tc@B8lVu0@qi^I+_=I zY8=-^QPWM{TjMCt>(9X&NBPT1K2hT+&+E_88b|rZNPeuwQJ&YI7ik>jn@E0&##Q@+ z;390gA6JH|u9OAbLUP}B=g7g0;-6A;ueWhmv=fAJCTjSWTF_)X|+@o>q z7k|#$FF3DzKPHaz4#$`8M@I$c=O>{Tn|64eu=@)0yc==Wvxn{@DMCJyZv5wK9G?fK z(!86jaqQRZ8K(Z}f^Q|BBlyq6XA9nsc)8#csQp#Mx&0M%U$|B9O5)E8Ju|3ZdxZQh zl7C@E}X{N8V^ z7rsmA`4{PVTgY#v@%`8f?{taTZ|>KutIYG>#MuugNY4<#lPF*13O)Nt&paVtMe>UU z=XL2?!7FK4HVa-${AIy65Pwhb&BVVJd>e7+rDlQq`wa0eg6|?8C-@%X=L)`$_{DO_a}1& z=XLS|!Fip0m*Bik-Xu7`Ke<*OJV^E&ww!FioLUvOS0-y}G%lN$uD zpnUk6;I+g*5_|*k-vr-DJeux@+^++~lLbFU{4&8KD6cLNoY%<@3O<44Ullx?_=kd5 z5dT$helN5OC2($kJ;^5u&hLe$5$AR6MWJS%Dipks_ySGO^^{ZbP%Y&7??cpT{9cfo zm}OR4qj6lP@p`yk<0yYW$#2j&%JcWUj|qo2_aN8tyz?*$)aVxt4C3s^plcyGb!3&C#UrBaL%9Oh+{mU-(uhgx5=9PeF)m&4*u?h#?fxf zGKGyC!RHd6E%+Uzlh|QY8>VH_o3aQag=|TTgcpyz<=HIDM*U9f{~i^fs@K9YY_<0yYD2&Lig>}ee3|3&gIXdLDF_oVF= z{7QO`dO+}O;)gVj`tPLYYezMX`twM>N#iL00m+}xILdPz1{J^wY&`B9haHJy{49j) zN0pRe^bkCO_+U*B+U4h-=Lq=;BtJ>WkDO*+m?7lZ?lpoJlAe`@@NheE92n%K`PKBi??sKHJkQfNHIDNCB>BH<9OZeQexz}f z?@7$XcCh^>ILCS5Eb}^!FZ#JF9C15M@Xt+bBoase zqunRzx!4#X--+~05_~i1xl-u)k=j2~@EFoRPw*>37$mb`;*|)h<7S74e>m^BFsGREjZ7|!GiNTWQ5@5q~|=rInJjD&T&3N@M}rW z)x>eUmXL4outdo7?0viUi+C?O7oBOT?E6&h5EXaBj~% zf^&Nw5S-idnBaTJ?sI~3{JcUO{ai&p#>2ZpzHfwi@e_?>o}7?v@`D=3{LJz5oyJlA zW0L<-<0#L5a1_G{Y@CNHa?JBUjiWsKCsO06zmeoSYaHd-Z~cjLf2mu>I87cu&z1(j z4z_fSqkdioPZRvCd?jvNDfn?($Ile}1>*Ar=g&ozfF@o`>!1aD9G^}7TgNxV+*ImEXR=k{~_|5NZP>Q}qDW`X0d zO9%5jN^p*=UV;y%`&XRcoF~r~obQ|C1?RY$EI7y26@v49WR~E3zbGY+epp6*#lvz< z9`j^9`E8Zp&BX5%d@9}V|0MWB#2*yAJKaCFX&m!*J>~6ZHID5mC;7h#zK8f*g2z$* z+AnxD@lOQ*koZ@E52tzigW$IjH|9a(U}Jx#n5RYu!83@TNu1~V*A#ze3H}uE1i^14 zK0@#*#K#GKCh>H^k5Kz(5a;$MQ9G*z=g$$_G(C7J*ctLQU7jFp8@&BIS9RCLe z=lK6laE|}qh-3SgQ`_+nR%)K`{5>baJnyP;jH_rG*B%%R+Op+g@ag;ac zIZuklQT}<7AEj}W=YFMW9OVP4Ka(_$^4#C)8b^5^*G!G0Jm-NDjpO{{K#!=4` zWw3+odchm7Hu;T$Pa$3_cqs9^1%H{&AJDk^-huMuBO1r{%%k>f7kmKm7X-hD?7k-W zB07IZ@ZofRK=5Pa|AT_BA^tsaj<;;nJw_1O=Xt%R+`JGecnB!5WbC_k<}Rx*s^8b|pTNxn(rC_g9?r41v1{Kw-GG~eVw8b^7aFP#ME z`{o(M(f{Z-{{A;caL)fDG(FhPgJkytA%Dzljxk-xcU@p!m?`8FNPel{6qd$%!D~pK z=Qp>%p7@(Wo}cG@DfnKJchdN?oJ%89Od62`E?rC<87nHQGW6@rrpgN*W+!w#!w#RsXAz&L>A!(=<6*Iozm7V5lg6?A-%$H+(K!0EoaX!88b|pnuZ10K z_h}sEuOay@g7Z4$8Nqoyvs>e+e-G*3qj7zF_Y2PB`!R9!Kl*{+_c*G_<2Yv1IR2<{ zv>QiXD!M4Iu%6>^4Y%HcN6`ElFL)a9BEd6>-$I=8XAaqYSjcnx-xNI4Y>x4%;HAWW z6`b!$od39A`$>K<%~$516CW%1G2)j9Zg77E4BO4_uOQx=<~{qNhWIGK*Al-}@QuVv1>a75h2T4h-!1rV;#&mYOZ+*F-$-ME zhdsnOpWI3FeZR&r&W};N9nd(=uQfD(j|$H7^n~F2oF|m>2ixW6Io$>4=RdK6FC@Do z1g{}}p2o5LYpDGbHLmA}O9bcqkVzcJ7yVZ1gdJ=}nmp!*TFMV)8b`ZX3sD+AX9zvJ zO>Eq+$)ldVq~{@xqn!Fl}?M&r!w4<2+r>% z-YxhblHVeD8u3>IFCl(HaE`;sMdm z>K{&Dx^~kz%0EEz{WXsAchPyQ#!;UCK5w$dQNGLdu!C)c#!;R>hn}Z#l%GxQnW%A; ze~j95iN;a>F_OPr<0$_u$rorG<$osmB8{W`ZjzrbINzrh5y$z0akz@|!%c$c!!_Jq z5uDd=f!CYYSx>fkYV;DkiuiegHxj=}aD&>jRO2_1EFNwn&hzDInlI}F=jU$?g1knMv)zL-8AIcOZXJ=Mg+1?TU_y9>_qae&|)S3?EoaXd%xTgdKZ zg0ClDF8C9~Zxj4g;*Sd+K>m5!3x8Q~?$_T1=jX{E3(lY8$ldDsJbuMR!)pZ51soUT zljxkUGtVI2RmgKZCuqD7%JebKND+Juou>-Ena1(~2$aQ?fQYbB2`!B)YylHKisb9;6Q&h6PPIRAam zM!~tihXiN+#{_5nO@g!j2=XiY`9P>C$m=-fg%sz}LcX4OjNmckpH#sENS@bmtiK0w zUdJ(K{nLdW{`-=pg0tT%1wTstuacb3YXo0Q<5(;Be&TBdXFt~qUP^JbQSi@0%m!^0 z`~>-JyWkrspX?R9iO%;69!Be^M!~uLhXn6I^Me0B4f~(xT@dMG&iW$+XZ>9TXZ;C+ z7t%TZ{~Jp``8id{vp>@W?;33SGedCp=XAk2KbH#5?Wq)eKfR}2CHQ6<-x|TU60a3} zJMp!GKSO-0;K%8FyWmyS9$rVY->Ql47V9p*BPfqG3C{T~g2oNU3m-*PnbX?f-?zb>KiBj4GtZ{DovX%SP$YG1y3Qq zRqzbr+Xb&AzE|VRfh7>%FL)a9M!_?Q9}>KZxIyy({if>=5}fr%2%b%Px(d$vdA_3l z6(CC=pADX`%xg#w&sXN_h^J}#QO`!=*&4qA*lyy5g6|<-D)>I)m4frSw^rl$T(q9# z*9yLYc)j3TiEk8~*FReYKSuJ~1rGxM;kH+B*0W!5*3&3B>p3JiKM&;pmx=zr8SEt~ ztA-Iod5AgtEkba%+f{Ib+Ml3tj!iU?B6t|tP1Sf7F+8LRK8>zrXgr%39;OT4kFI5F zJV%o+6nqd}E7f?eCSNJ|PU>%!#`84!8o{|ewHnXY6JTmh5rs1^B|Is(B#=?c!~c$7|J7O{n48I9MXY@7{Pgb6Ese*YN=W&g0ucqjngYZ zN}m5N8MX&`wxaNNWi|OyVtAM?cqPSWw#Kj4Do&vm65r&l&qE&h9G*dF9OUR9br zy&9n8YXr|A+qD|6Aclvvg7dX{jnh}Vs@6uq`M$GNkuM>7^oW9~y^1B7! z%%2A}&i8PvuwU>!N{eAMYMj36QCAKL&c9#in8xWV5hdRwcmV0=2TwRI3z@-@pEod{ zMDY+o69GB<46Ah&od17Qw8rUCtFjU!IN#3_G)|8sm3)feDb$`+jngAHC7&iZof;V$ zuTqlcZo1$n=vubMmum8bf>+VCQjOz!kGD#}dF-n+j_WJlY6P#M3$+@rW??w46}*J} zQ?KzAn*2t=H`2AO8oxo4-!3>mr`W0S8#Vdef=9T_i+eR*qsi|Vd>ysFQRDc$nzuuO zb37l@IId54YZ9E-IR;K;G#&=$xFIhzi)x>s@gj|L9zuEj{?74^T)&T3X?nQtsE*?c<@NjWc1>Qt z|L)hgexGg9xPCw7?}t&pe&0-^xInJoA2T(s-v<|IobPGaetu4cdi49+22H-j{Y&He zeTttWp&rgjs6UA2D{}q5Gf3n5{Uuf7`hBECv@u&Z=pQT zK{PXo@(uEvG`swH7P+3^sx)~$kMZY9l-KjsK22WFOW7cY8|EuL|5R#R&p!`pJX_T? zcQ0u?N8^0oK>fKI=lOy>Pves)Zjt9}yj>iOpot(TGO`Dap;tzXYS`5M>r z&&L|q^Uvf?wjMqITz$ID_58C><9hx%s_`nbs@i9FvGpv~_$rMr)A$P-*Yi)iuC|_P zP5wTOuh4kAZnnIhf6nY~^BXn!;xlZn=byM9HrMmdc#Z4%=bswa^H2L;wjMqIoEB|! zJ^vW-Wd$WU@f8J?74dU&3-T*U%CidcO0!Dm70s>4x~8nCq97}`Xl_o~wFY0FQ(DyW zLaQpu3Ucy2Y0$YB1+&WL%`eT$n^$_Rw^piadb^}Bc4h9ovN<^=Mb{N%&Cbconv*lv ztGZbQbF)gziWU?XcooSjEXXVNQ)qr}D~ixoE0;~rw<4hY*UEKj==@yOSR+2aAb0+( zteo83vVsMM8gH*oonN+~AgiRPyuu#xeDmDvK$T_{wJuU#P%<;Cq5yQp=a!ep&zWBW z13P~%o#yAZIL*n==c{&fS{lsQ^wxR|VAFXjgj*9+E;OZD#Lyh*4YW*W*j~x7m6DZ% zzmdh~&6_i)01I{pSf4$;islx1m4Klw%_%AaZQfolRzY1qoV!kn^}nhJ|%R%CgtZpV%C zDp}E+A3v%5nj+8}Uy+krQqUq>damr2R8dR?ooNC(lQ*Z-TYt<9i~=qEku$RZ=EmIo ztnzDeyw=5$y{@2ao;Te^<@#mQwMBDh&hug_r@Xuf{zJLm4v3qQf|h7zQAtS_3}ODf zIW0s9X)^%>L4~A{wqw=34jae15NJkLR(VAZq~g57;;flDMI|jvmaDOrtgL8mu@OIa zUPVFt1%J3?u&Upp8aO)(CPoW}LG8xo<-0M=22u`#7n#;|y&L8TtAKz|D1u*+z*nJ? z87P9=4k|BzDU>^ZrUCb>xfL^8)GUX4odrruaw=xR9Z(H8UhvWwZTe*8=9Gh+Tlivb zsJOP&);$Lk;LLehGt1`9F|U}(U0X-YDzk14@tBvg^5@OvHkff&Qe=UGLQs`6hp)Re zK&1@L*<|JzvHNC3VP6@ar1rzqeyG|fs{II1JWu&Pue>5f)l&Op*h4L~AEx$0)jm<}VF&8Z zR_b97f@(iZ?T4y;qT0g_1cxg@*n^^iXtDhZ05W=vVqHtMN-YcYILCqxcs|uy{V+??EXevNpt58rnfe53wcr22X9d_# zdK_cW;{u}$44~v`@S|@Tbdst=C`ZsaAAbb@d8%Jaa%_*)@HrocdFlUJsxXZ!(oyy` z9_mYmqNUXTLemZESuH-IV!Pb`r$RjY|0vn(M@K$LTTeiJ$xwFxU)}v53|!jp=f!>m zwR;d7rlYjg%ZvS>C*AGCP`TN^7aD|;GJZ#q{hf5=W=Q*YL4C3+Y ze|InTPr$h1*3Udxdugixg4$F2qiIt6@?SQ{Nu6jc<5{!gX=EAOk1;RX|Bx5^lgNGv z)#rn>^?(=qYsvmbs)+V+j!OGCda=*no7AvjI!gP?yx32D&g?&bFN*f@5vjC48G_oA z|5M3Ok`MbALVejLtdjP;yZ`agsaU+cwwE!mGYo1yXt<_u~7YA^Qr z`1mrkB@Yv{hNV# zvVVZShhTZsiJP>A&#EOuxl*#vdAb_dnefBsLd64sDzs5uVqdnM1 zJD%((P~PhYb@WZz`q+#8y&n4C2NcQv*Lbl%jqLmC|8g((4|(W6_C?yC4L4O!{jVqc z*?Q-pEc;&o^(Dh92`{2n$OCF`e%Cqx%F;fX@nqk?n>}p&J*9c(ZVT&rvR_H|c^y*? zaxw5D?N0>e$$ljX@_TR~rZ#D70#M0NFo?b|J*H}z{U3;&&N=?S@Unh71bGEF)UR*S z)+b)pPfcW>?No!3LGUB(KkvoUp`X;dHkp8!A7{#3BzY5b3o{Y6xt57PccASW5hmXdw6i5uD<3O~~R zPf*#D{SsX4!8YAISbJ&fdjOK5aJ>incrTasUjg9B{w}i5?>TYDNvU7$9u6q3U5}h z@q3u&nY*nqUhGf*hiRYRXTkoDgdb`D&yWC7lF}`kF)DkTMcFrb{wJs?8P-gD-?XpK zzfr)Y{ciwxvcHJz^ZQw5Yus%ehWeiDXOn&X^V=8?_D4cxPxg2BF)i|Yr{3%*Lw!&7 zcYk2^U$>v?!M>9||4RS&=x18w_gKBz|JBR{olSzc1Fbm}077 z^KN~`zhCC5|HnQvD^^i`v_HXv{WHAS4~sKRa=dT@q^;Av*e^Y38rI|Qd=K`20fv&& z|DDMG2{ueeY5!lqB}35~vcHk)Rl_k2ez-r}uAjWDec#%#xtP4r~WscH0^WyvH$t- zBkfNHfK1x&I?l9UYB9^Wm$p8G`14dhn(C+6RaGfMoHxQlWwe2xjr5J{w-*MvJ$x*4 zdbS^PzNwA-%ev+H(too)zPInG|Nh#qr2b3)bA8Sq-r8Rd^@WR+XaasQ1sm6|hH?q~ zaQ~Tyda<8M{$n}Rg&Ws5&)~k{#eSLx`*XGWtalyRH(SeEAy#T((?~#-?+du?8|;PFV8>LI!%x2_A5Nt zzl`#q=%!If_Ft)Od4=a4)2Uwa-(DBl?{7+C{4IbV+5bbJQ0l}QL-ykye(#iUjFfe? z^IZRo17`iGD)Y#DS^qaL{tJpV+dqA)Srglj@2$)B-vEckrHnI=u8=Xl6)ld?;p zKKygrvfnf9N1tw9Li_k0ytI$McLH@Lm}1s`Zh>j(D|+vqFR*<+UIza4RDb$4ro^RO zk&axCkKcLm|HD*YRCnt?{{9uzW%kyV-b(e4!T9JK_n+B~06h7x>RVG|69r@esPd)e;KHf_VGEJ>^oZQ`X|$V4F5j@VD<1L z>*ISQ=9{kZdGYgxL?=Ysn^`vZ!;_NKg~X&`2}4yeJ7mdulg@WK?A|+!Cq4QiA^vxwLy;5=Ho8Mz#m-3CM<7U-m3{J zt!Z>cZNg(sJ7Y?(MB{4soh>_dyNqctMQURm#_F5l<3`-Ig_RcuhptR@^!f+tN;ayd z!Wwq<{9BFfkZNneUA2X|Ml)V3f@>GTwPN@|nd6|pXp_-^a`T58JBl85HQX5LEwk~bo&dzM;OD{|M?d}Uvr_a543AoP2)1Q@Ln}1vX>dFdmHs-g)@z2 zoL9$P#=z*FM)LeV$g8F{x;k%Sp54Pp{-jq+w(|@lIoD~jPc&HrIMs$>PqBeVm z(cByU{I8SbS#NzeBY7$4?IY|pb~Tc-$2nH_2LG^ZDl(^2wT)SQ7hv~0plimO-JqxN zDx*1v`uTh2zBTXToeh{H=HKsXz?k8Ak2zvK#SP{J%mYQ6f*astc8ge7xdU zjMW^E7@uQ1-(ihE+`K%-W@>vQ+0mnAY}U6kk~yaI*lY}RmrVucNfz$CRvcr$Fdo-K zoO0|{x!mKi(P_sc#{LUuyT|rU2ebkFgYyCVyUbHgG)i-3oYPHhP5klOr}D`?XnZW-6q2*;I<(1(tlUDy55 z{&n}f4&_jX(HuH-^*zOojt_MV8`s3wiXCAOg#nKUPHjE{a;uV8DS14uazrQ{TR_Ju zsMlfWE%)pJ`Ors=hKG`Gx#!%@#&__!vN_!W_x29KE6;U=9En|e^F4=LF`Hr>K`VoD zjJKWNEx!E|SFeHO4~VI;4ZkjYaU;eO_V0&KqZ#|>fc$~$2$W0hY$O+kq&9~@pMpE5 zHg_1D8aw&d>~{vi&lX3=;&1xa&Di1yD?WBsUH3N~5yc%G#tvBbO?%rB8i)OYrDUgL zuJH6FaP1h#0uK$3Ol=PBmfGwHOl?kdh8KSdbrYST#SuGKXti4r&H+!9@^IkR=ON87W0gbaaey`(z5Q~I>O@c z_}yY?Bj}p~`cPLQwC`JL-?y$v(ABZ{TWBBf&_T|y;y%!xM6mk_v}ctgJnkEZBmK?f zTcI2phsViA*rtxbM)O-eji_5e-?xs)xNk_`H?EH9=YpTm*T6#|Hj2LmJ;jcQxHlag zm7Zcp2c@S3+7$+R_K=>N9U*Z?NY4>hSb7%JJpy`whhFIDP<&MB2}{4w5gb>Pys~>N z)Qel(5HcI|gg`vaZkO78Ve^uAvicj}!RrmvLLfGdEXjUs(vR1_vkKy=Ls3anmLv81 zxsH|ZUl?et-r@+qxkJ&QrV^-^6&QBprQc3Yi*+>(Hv&_)gcvjbSJ8afQ6@ z3^cajT!5VZ#6XxklfGO0PAKXNHohwcU7?_-5Ml}S#+^L5EySogZ8oeQF%}QIg41Jr zrrt4eY4FNmXy*^1m>b<=8SjN0%RBp+u{;HAbr_o(8yq{XA#CvZu^oG+Hunbq#X}5T z1V0#Oi394o_cp@grX;L}Bg7i`skaeUoJcX++XyZ01Le2VxLx0#7-+x8aQYj%9>zzbk4_6 zI**_}2ZMdH&wb$-33G0o5nenN`iT9`Go0zU&_@Tf0sA=4h-~54bIGs3!FCw?la8U{ z*fFjj_pX-1qwI+n0e2Ggmk^O~70Mb7&dZ?E72xJJrgjOY^HUeF^z>oZ$kS z+#f!6r2g?Sg3d!!e^nnLhQUAXeFVF{``D5C#K#CaH;`nQhoO=F>-iO|oEFppF&1OM8&%mKNFavAs+a%|kU$+tniHjfE#OkA9O zJF;MBu(}rO2r2#w#w`}|%U6z&^siMptQhi5I_8^L$Uzr6!qSgGIUe%NL`NvhWg}`J zowzM9w>SztM8fSFVAZj=Dls{t1aRn!{l3zMT&r@4ZQ~orB_|<%@E#8NA~YOw z=BGIBDnErQ-H;#STwpT+=7y=SLowV-RW2K6L~O!5206dE55(J2HK#hZn8zm_W_}z8 z`riV*aHO~nrX$bg4s;$)`6I;2nV1jpo(*}RID_&B9wX=&NylJ1hSD*Fjvb2+f*Z#!UqVq2=AY#tqS439ex_-dH58r zPO64uSez4bj9HGr9QXKl(6(wLGJQ4J#r%eO4en=gpV9r|Gg!A|8Lr~bV2pu>_5&S} z{ZpIsl9ofgusHJ=Nym=rc&ibvj&DMo<%8TyFoxfNo%5j2HyGjRe}VqK3HBzyeIpR^ z%MD<2mm|Ph%Y6!K!#cxUcL5KLSNS%a`WB)3b{oV2_6^rwPMCMtCy4Lj&mec;ItZ?( ze-8P>1^RCT{mbFrWaqB{=#!bhfQRNmuEtyi_ce7ag?sd8aNZHtS2)KeK)VZ!i1ccs zVA!F#dV0vxtN#Xe6X`aF^;7Zaya-QeXP-8(|6GS2=JYw zv*`oO%eD_9Exo`)!(dz!VD26UUGUi?E;jilSWAYh<7~*?n3o|(tDJlh_!#qY2;}7s z4Nf~Rk1+G{rZ(i|S2-_34s-_Z9F4gdbFvH8h0*Xc7Jfpy8Soh@^mUiR*y0GT8Xe*( zN5f~HR@aH3AJ>T!m&UFP27P*-J~`eA&r#bq{4gFq^StD+o}u!y)1ZLV=3cPo&4u-6 zBYbA+htCmu8*g6-{p|(!q*%z~NAlp=X5!8F9CjHy4m|?T&w^5$ajglTv)*ZhYrP%j zGZy@;iR)1Hc?v%3;^(Pg$T6|KQ*RIMZ8R6bTKQbi`5D;4XMDY`jcvmFUo5P9@pIhr zlP9N{pKqh!^R4+j*VD6t^-%wZ@wg7Y0G<&z)iVOL$)B5Zq0OJUdTsg~eh$J9TV6`mGm?+u=~~8GPO> zLjQhy(`j*V{qS=5tp2$%?{G(aKH}KY7*#d8g-_vn?;QF(-`80ENqf_$Rq#yVP-tqi z`K&E!)2A?ALEt;okNvMgpMyWqF2vI`^gljp^5o}6)C)iOj1KG8~;jph53%U$57FnD&*0iGSWJjYpY+fVSmSf`+#%&nEuB)03y@WFGJOG{(p)VUDcmFm#Wc+hnc=L;CYXX&1@WxsMO|$ z<(b>j=MBqyG+}IGyMthEL@$MBnoEtht!EL?mQUaZ^`OtQ;aLwpj`J zSR9{x5j@+N)Bygs$6`E=Mf-+dV9x(ME4ZO4E2QCHmxaREgf)200S@O8&H?axOsDCF z>-B35=gJ^Q*VlVFx*Zt_{yqE>v>W2~oaHt5{0zC^=NpZNpJCh@mqQGLuYNhp*$_nI zbKK?J)ClrH9h@s29bB*H{;>F+A62ZHgK-?xq0`FXrTEOS^Uc9ado`&zcXT=uOmTh~o-=xkbJPz%?DL%% z=Wwq3w$WiEdCD_m+Z)r4Po4z6O9vlb*zohLiQrStJEp&}9q1GG0sAWjeAEQ($F?7K zb$Q(h{Wty53H%Yf636);vj4xFOm2d{9|9i)xq|%a|6zzXw9)I@Bo+H>+8L|soM!AR z-)entY&z-I_ZR7z;7Qtk;{qKY-Esa4M?c#B+r)%^We**Gu;Z6i>kf7c?45sF#K~p9 zhMYWZ)T|$WB>MS9|Ef*c8ou$Cu90cip1J;-=JI#n=vVx8WJF%&`@2ux8P~0SV$9#S zJ^E^Kr{PT>-L0E|ylibc$1+~ncJh+G<41&^_0<07|M}$B2^p6T9sA=$j|YUU2npPV z*L(NOjQmH{(4;<*FJAi23$6=y)J6?m^8B{qXT!pu#Oq1d8!PT!`tF4M3);`9pFjSM zFFx)w>6gAgJyDZ)_Op0>^uWx_^I|`Y8gp!W**N^8MRgihrE){Mm)6e|`PUs}hSZ8}?@0>3{0D=)xmk-g@tn?!SFH?z72L z`sbZ^@wFX4RR5{VgIj+7;u&rawnH!Txg0;1;p4XhkG}Ku?iB;?dprK-TSi>^w;4A^ zW!x6j$#vS;rN7Nx*RyN4!A+kP2j05&^DoDI`rwen$Da&YP?mDlw2>vTmpp&v_s&aF z22NYnIQFN@*WUZ!%G`5$&aK!I{ll5BJbLTdfh(Wu^V*G@vckWrUDR{@b@wg3zUP~d zW{2$De(Z^;#P<&`>U2-cvptVD#U8l*_UG6B>B@P72HbVwM_q=O$G*I0cDJKPuX}K7 z+G8EMPycxE*~gb&l=lj^_dkB*fIBy%cwevczWpv~(CC_v%ahwb|L8f-?wor1!aJ@% zI%Pz+OFs$z?$*^eZQK4s=g059qU`c4WMqI^g(K zcb9$h$3Zj4oYm#oN4gYFxc9P&6MkI#-WiJrZOghjGhpXA_f*b~9nqEg6`Y^4`phTi zJ^ku%cq>J#Ve{Y&sqX^uThitifo{PG)bnDVnPhmxMNzd3o*Q!G()4SscIaY^G> zkG}nvo=L}_ta2{iI^f~Mm+cJyZt@5B4Y}&QnoY}6lWusf^WMC%)epv8x^B*pA@|<$ z>qix{&oAoO<;3>`bp3MtjwNe0=w@ zi-uis-g=b#OU|52K1hG<)61XTy7Q-QpZ)ZYUtU`_F6pTyU)Kd)kJo>Cv~I!G4aZ)q z&N=$`LkBo0@QV2!#*h=<+oQLMUO_h2c4<2OilyIQ{$9+RgFiTNud{vVjc?wWTYt&s zrw=q=Kl8b3x9^Mi<+i;Stm`&y#RF;Ey8OB^C^G!SFB`5b*!AZD*StS6ZS2_Ldskic z_vg>4PkZEx0}nr?`v&b@bMf3>J=3D1W1(q;gZY)175hK>X$E1UN<&j{=dGtEMd@z`N1<5|F!+9lU)z&DSq>lpE6@l zufFs7MgM$Suai6U&3m4`c*4jR`#$^GCue=MU!+&4-$D)8C zuT1NiIqlZ32S=TE&5N)0%<0tq{H8zty6gRylAErd_TZ&ye_R%RX6;W8qe}) zTD0%tqwN!;j0LHy!9{WYc_4BUm7&9m3 z&&$r-v1&lfn|(ffWn;jReIqk2T>6)rJ2tO=>f3_VQ8%9T*yLO9f9}QlM*`mr2`U>E z)_K+Fzb$)dVdSKYpYOWi$&qVb{oqdLh;57B%{?;aFX1)u5B&W=`%e}>Ib_j9z`P|I~1p$YhLu<~7cxg%TBYz$F)`R^6HkZsjz1QPj`ujuL$my46Z;Dy* zw`GHeoLn07Mb)3b7`Xn8hsPEE?Ox;FixyuUG_3Tsb$R~?|NE+MgxI_%*u z_MN+O*WnMg-}m9B*Vdf4=Az9ne7WP5@8cfq61n7w-S@0~^}G0x^&|UloN?vXgP+M; z`_*e>lQu@2-aPu24_{yN@}$0-&%1i)r#GFGy)yC736*_+I=w3I+2EKD4?cC(lNqUN zXN?Iu@OyOjY1;8jaG&Irg;&i^y&z-GqO8R`?pRp(cE&CH_I_H~>ztFf2Jb!oP3}3{ zUO4@|CrazSUUA3lN$cW=_MVadUi|)NKYw`X?LqrTc0BWq%68L^Z5$H!+S?E3optm6 z^w+MqDlO~6i60$!EOKeDnk!y5>bo!eOF!eM;O~F!Q~6fI^Iz>eIyCRnD^osNTx2w? zTXxrtPki|Pl|f72d9>#R5u2BE%ei4}w*d{4#%7MWq|}H1I0JP0sQIJ&e_HpC>8Is& z&;0S7ua_quIQ^VQ`~7uF?5p!Wx?}V$Wg|;B9k_AyoM{g}4R41U#;cKLzPJPa13v0_ zo8EcDIg1<0=-VJVaTpm~EVWSHGgPD(6hUKNKWbSL9RXEQvDQYM!H(K!6unrLK}V># zj*44t#J@{}|1SneRZwm(2{2m&Xg3uP*eHoIaT*;#ivO`4N+kabk`yAAUDjP&!{E5zuqK+RkR()iJYCH-2m}}eJtV}0j9pqGNLlwT^a1Qk& zVz|lyY6tY?7!?Dobn7#fuogD#G9sdV&ZDDb=YP49)9{@eq#xQ+r%ev`BRtv=3&+K< z`jJrDP^F2i@F!+J5=tAYz<2Fx`&}U#Au9QiQF^#l@j2z9-KtC{mskgxQQA<2*Q>k) z^CM)qN(wa)GRh<>X4}YWBo$;^SqmHXE5Or8|Nn9&f3k!0LtE;!$>Dy4M;l@xLkz1Q z8Kn(XrjeBjD@c7#s5Vq76n*i_%_X9e9~q_6t%}c#vdFE9PY1N23V+M(@B7}of%N|`SMn!2NI$ftPMaL=M|iX$7B-7v^&_LSp~_aW zveybypA)JLRd$KK_~qu^qLLpOWuIFWpBZJpTNR%UXhW5wWF^UZ%H#8a6<0Y%RUxAU zQ0=ak7N6Z?Eo>M(@B33d|6k7kgo)i9qC*M=&Eq}^_q&qu0ls8T{!YOTKbbn?GZh5O>y zgkw8)rRBb7=_27Zzbv^|TAt$b!DDq>EY*lge&n|`ZdH6n+gi6OJ_of8RW_296LbVu z`~E0&suJa}f6EbD$>n||tIZ_3)2iY#7TQpS8^p2TN5ghegZ5hu^BLD|sIr^1+YR%X zMcYti4_P^8^~I-?|BWi#7r!PP+p#P8kwp&(ulZ%ky^R|u4r&{!1kw8f)9DDVPW5^3IaP_W=)dI%?L8M?3(GJXooG5b44<*khAP}3js-um zXg_LDiq$ZmaovV0F{IsYn9nTQhAM-|N`}=JpHBWas&HTYns98#uH;7+<=^RUSMp3L?u76=rp$~KBH|FRpIxd0*uJpm(=mubor%-y0y*caBdS-{Aru418wu&p=X34Ka%xMw<Af{R0$yM9HM?i^?#s>KLH@k_?6k~X^bnQ&_%bS5RPm=nvW{QrFh&^i zBONBVRq+`(ZK%Tk1!5gp^JA)Ul@hCp&$}pBVJm)(C;zF*|BqDiCw63)+ES-YzVl;P zGiW$}$FOEol}alTd}h!#RLLjp)s_{X6QK=NN=Z9Mn;#kUKTyS=0FY+<%Akuxcl?T) z8d1rQ47y5G@ux$wj$avcjWFa#2JHdAgB>^iZ%O7yc|J?9{-;+y7gGqSkMa}fB*T{D zBL62bzdrJFD_A*9MOMvv{Ft3)PvDnZPyzlA9vAmpD4(VHDBmyUD)l6Qub*&vFEKv` zoz?W9DyC!k%x+H}UAGRhJ^kp)G&;ij>|CrOiDGIh7nf7`Tw$jWY;=Av3rw2 zb*zK8Mx@xvyVmi^W`cpByl;@t=R4e?2~-Uo%;jui4ueYs+mVJRO;^|=S>jXH4A;qPz*jEF{u&pvXkNmLu#%jIca>j>|Rlnyb@Ds^c=hlnlRZtd7fJ^u4Lm7+%Nat``!aOQ}nvawZ-9$dcSm zHlY>|Tz{LT$LCi_tfwov!MyqM8N1$(I2}X^IO98vE7J(E`vGyWf-b@GfG6r&3r#sj z#U>jW;$90~!A1UW3ot03)79ga)C~52 zgyr%XT;!34K5~&?L-A)4v8y=wIgG2=FDER&Ol7|WSWTMB4d)1hiX?9xyxn*TEydZE zEEQyxeZ-H`(T{Zqw=v9at1m05Bs#&WlH;oi5A<}aN|vuGnIxKRRpFbrRa17qmPGCU zPvg@{JyqFgS@Ah8n@M!5RmJB=;zJ~Q%>OC|#cq%l!#>jnzm-}^Rh&j*9hVnbETN9e z)fP*vTSeuybcBgjPsI&3vOG@(IRJc}6PWf9rXs++_&e?~i>M0RW2&5f-(#w&5jdT> z%sC4^!etIcr!lmS%bZs59>Zn658yq9%XZ30uH!O)OOE##F7Kjmnw`ekbzDARu@QC0 zsT^cE$LDi4b}g$@_ZY5UV(IZ2EUc$1xvS+phF$N+Jtl?}q|y;?C{|fS8lYbSWYUjyU$Llun~KN z-2lIvlKaX{b{P2UR$FXxj<2Pw^>l>aiPJ(JPGpr`Bw*hneRgu6TNR(FoV6QPk9{_b zZ+e}qDmlLTl0u^SRu!KOOLMD|?aK;}+9JzJj;|`)Nwm?b;xh-Z=;u}ypQF!ruqLaD zPba6)Y@24yI-g07MW>iyCgTvXVp>Syg-nOcjaNSXF!uWmtgOjzM(9TQHXs zES6NqlX)#S-hd+>fRjE>yT&Z?R!@TpmO*i3=4jZ?;%+9hdoqQCz5SnFkgZ zDqP-AgN)Dnxy&QyG)7pX$Zsh*jgfU+=JyDk#yNFd=I^|n#^|~T@>oC1***h_-Nx$F z!iVegR|kGP{bW6!7d||czhmK(Mq}nMGP9}3!wIViF7k~Y=5hr|Ra+Iawo-AIjgC`s zl9g$*YN)u*LQ|4xfJfO0X#y2FiNX!KmXLktpW1^)mlr^=7)T(LYR&Fx`Bb!X#MFI+ zPFPYGM+BH{jiDoa?5v{VDjTh#;szV-r{Vz%&EVnXFX{YQMCFsKYAo;Nu=jYi4^CiL zrCP3<%C1VY5&MOE?l3Op9&`snBrA)oNXqfmu&pGz&HpO=S<_yzTUYvW>xX| zDRL)??y{=*%rG&uBH{OVaJ|aqX><+mNnD<8vE(`~XIgA{9hdoi71UQk*X@^TW>gWX zrsMBe!zR!ifF%nTlL!SEKR7b#_>4Uaf?V8b)y<=lb&z>9ny&Co%Y0zOXWQwjAL}N5 z1hkH-;98Q)ybkhX9Y?hd?z7MCXV^{T;xt00pZKiQ7Ubdy3;FFQ?xyJ{KI4u;Yd4e5 z1D5WLLsUF&BPv-3IV@Z0$}T$M>YvN|iTz*mX0~<1_uHErsVk;8`HVXX-fSd+qgJ0Y z*o$2)a~VlgOtlfOuczCHR9FY;^J==n&48B}f~YosK*M3M>Qh0g;p?eXfL?HM0wFUn z`Hby?AQ!nq@M*P#nvh`K>3w>atl-~VRvX-exX6mJ1ykyzZj*9#K6>k54GF+Hii@ls z-tl7H$E^X#H>e9ibVPGg{r2Yu%iP6Ww9U<8bGDmiar^n`tsnK4;%Qv870+~6Jd+jj z(VJpBD_p`wTXBKA;sRF4N2xf0E^t~lrwyO&qN@-`J;>=Xmh&@s(QmgPgIi#K@XX-H zjXUj%U1_xXSpk^A&mnAQXK<7GD4YH{U1+izna{;A%hu(eQ_)tO&kFhIh;;N1j|y~! zM|3$OJkoIq{Bdz-JXCWf8Lse&Q6odo33PTfi~xsYVif%4j^4(^sI%d3-nTm)3a)Ut z3@7dTf$W&jP$&jrF*I}x6oV}dp{OBb0MsyyP>Tlk=x7*W@z8+N+NE~=W zP^?3s;p}PxJPp5TnZuD7b?3Nl@VA4FjyErJz~$BBKy5?-G%PgKY)E7bSVy&|!4Lf1 zLS?a2yn{7IL$f*uf(&*G^`0ID*SL0<4sbe0&d{c_x*0~#K-GdXvCnL>R|uULMzqJyp9>XxL-)Jbb^7##&R^1Hdg$eWmx2Di zcoqHP#V3;@@FNHd`t)kpa)}tbVb>Lrel%C+5H{W4I44Y1{0%9 zG?-B6S=~$!kE-p44&lzB!h|H%oJ1T-v^CVO%=(65JM8L4{Wu6U6`JO)B8NmUyrd!$n(Rc*M$BfY{S&GAU*c%9ro|5|4C+N4io{ z70-Y4Nb5Y(2R+h9JklpU(&r_e4RtIaX?+Gv`imxHV~Dg zBaDzyP*&1G4qN>W=cY%^+e9H&e#&Fz9)@*~=>hF>%){2X{usCh?hneay2acbXnUZ8 zL#@t0<}#28FCBw5%&ntis$*D3M}`X?D0FmO0*84W9n;Li#dv@P56f!S9u(FZJXm|s zleKBii0F=viyet*IEf5$7EB4Z(h)8flKtN@r>Y3U*)ZVG~F0~I( z`#`mCr}pjDK1l8157Wa2f8HLpP_++J`wr%ywhuTh3h%=0&=PKrm7Vb5>g9w#A#E0L zEV%rDR=yXjL}kLh-7GA^=KR~~c@2n?`S z5F?{-c>rrqXhD(_t5YkIoR`48#B4>f({4qw6ZM*WxWM1{#|j-Bdc0V;@c>{cf?;7Mo4Ui;*9$9{Fv z6}5G7G^&$(QLL-uka>bvx;c&+?Y60j4`(&)CV~WR0Z*zCP78Qcjil<-f*LO;!Ho;&lzDwqC!VWoVo;&{j5HSEl(R&~?fmdVGYQ@&`tnHD4l6`J;tDy8IXX(f|K` z?&z?{P%Kzy@HATFSzpmA9Mdrp8FHXg&zQjb>3!t2}hL!et<&ENfJ{z zVBjY8K~$9ue)cl(*_P0`9KK_DU9xC*wgOa4aU>c8zZAmif-B;r!x;Emi%V0Scqv2e zr#i+P1N-44CECmj#=zlj3?CJx8Uru$cmWsq>09!5FJjF2rd$@eBTW_Gv>Pi*V zDQ~IMwfqo>%T}R7B&!Bi)v_}9-mMV<5%53{d$v4UUNha$ngbhsIMBQ6{irEBw8Fjd zj^ws_u(hFj&Lziqs$&wm2;Fx}3zxQt7j<2XmtrEQRs4F8GvYAN0?M5|)x(`Ae7a$`OV6tJRhR!-sMs{VArPs-3*)Sc9;1`=P>|%kvs>5{;$C< z;UBP5sq#}Ow5ZZiNxE0Dq*Yz5${j9mRiu?~(H3mbu>Q(Q6M+5!J)u1jurmg5%TXu{ z1@G|M1KAu)_Z^;f+g`cD)h*Elzn%xXnCO_{%_r`SS>tzOxF4=Hu8v?U!k4Xq1?n** zb{k%pfLqIOOh53w1S~cXIS<(rQ%w{zqTl6MeAm?g3e1Rp*L9{9-S4^{M#WJ`q8^80 zd(_s>VOD>OtG}gHe@mdUrC(Mul^aXAM76RlA_pYGO}m+DI(6|4T~SRd1oT54>rMRoc|du=Vxf*12M= zR$b-!GPmXm`|<#{*2DyGYqDEw4T_mAxYE{Uw7!jdgT^P*zUC&=E8_fZE(*5V+(EvYJE*nh4zikiWoykHM9ocf=!4+qTNLxq zSogU(*b0bN<8LrET@LCYoTId5!_hT3AXeRSI!D9ZsyFNmx1^n7C2b4?wJm}qL%A+R zqd%P=YHNY*Ns&A?A$gopk=NbsZz6<>!w+`&W`#~;2<+AUEbQbj3NgmI<(|v z=Yi3l+^k>boTOz){qh-}MpG9UpafbbVz*cy9Wa{uGF9t~TkxQmr{K}`sr-MgNey7{WZOxvMKe`CN+s{e7&GNYqG4{FUCHE0bvwZGDjD4QvDGyAve6IP-_W4B5d7wpWR2Wb6 z*QqGzms8U%r?%R^bjzte#Mr5t8(MTj&7O42sXoNmsjaS4Ct1#&VF#q`+)3ozL`SR3 zfJy$k76tus?H?@Hw%W@-Sg!RU#;(jM&#}s?+xG(2W%rC!BvHaeu3#M3p*Tn3_(G*&=`t;Bg^0*MR z18^$&ND0`E&;`ttt9ePkXx`$yTr_Y0+Qk9-x)q-kxTXe-_O)(RPm9&V1{@K!;qQ!~ zb?cR4-Fl^1w`PfTtNVG&b!(Pbw`PfTYnHZdU16hc`L%s|nXuG}Zr9Ls@PUs@Pbo|$7g z(1(~`H{3av16!S-a{_oR)9R?r3Gi^c_0)w6=&r0yciZc8tx?k+Uh0>9Eb-?;?Dz^< zHEwgQahuj!wnH%w`s`F)YK@%MANOvTS|jH}j7LsiP;i)FMptoAYK>g0`J|LaPNp#r z`grWLxYGN`W9Bh0U2Tn-7TYacpgevxd0e)}Er+9Et3EHce6F>pg+b+|a?9sF#MtMp zPJ?pG=dI?ra({hZZp{}hBJ4=7u$(%jwe(YAg|Qw9ZZ1VJ4=#20*#gV8x<0pnSzx(V zTY-AgX1Z1kxgA*xET?KiWIN#+%L&>YuZ0;ES=U%jXmu{5m|sq~)^b9tH=t`RC$u_Q zuch0WbOH~O>pH8K+MUY1m)B7*g&y}s2@3kv&qY>0wQ1kNu$o7UtbS?}#2&*%zWTS= z>R+piuEqZL4+Z_|-x8~T+7xr|-x8~Tt;YNkU;V72eyRa#ZPHdzPZJ%QL*2&_#XR)W z_WUyHpNt5%>AH-1=!YQZLfsV{sd)d1fFIX#FFn;iz*U%nK0m;XcK_nxC{(2na1V$N za1W>taKrEg64bvb0RLkPoSOe#=AnRc_)m29*9sfO$F&CaaZi0a;@TB3aP%0ZMeXp5 zYy2#!UQL&@qRaqW{Rh(nB_cie2D!u$stzq?6iF%C#6P4PM>~D}SQvXxV zex>3f^}piub9~oBKgTbr?ejkb`a1sun6$hzHISU8+TpTJ6Y$)1ao~~`zROUJvwb;5 z88dyiGEn-?d4qBhjKjdoKn-uE!@##NLdv;ty;bMJbulXcInDOB`1sp3D8T+H0_>k0 zV3_(0*9RP6(dzU-KuagRCj#t!Ex>+s3ovKIxylJa?k~k*Y{C0*`0m|%sc6dF@D;l8 z%6&mxvsL#&qs`bnB7;x`s1<~(YzIV$AdFB!Xa!BDmO(?OuGL$YU<+NH16RUugR~h$ zodf^aB8W~CK@_D0(Wt!Tu-XO zYOAUt(U=}yFFmZiAohXBYxXaU2r=w(JFOg~mDSrW6b7dbr#x`V1E)N2$^)l7aLNOx zJaEbbr#x`V1E)N2$^)l7aLNOxJaEbbr#x`V1E)N2$^)l7aLNOxJaEbbr#x`V1E)N2 z$^)l7aLNOIdth?ffao)%w*UT#` z9#WW7HfP@4Yv+|`<>yr74Eb{N=Fhj^^u=8}4nB3q!Dny(V*Q_o3{4mc{}L01%*idt zuP7-WQc{##mQ!|ZW97$x(dtMliU7tNYmkRM$%x5AhYyWvUjS5djboYJB!ghp1@*r`*;UY>RF z#2M#hO}jkfysRvv92%E6VrW@nR;gCb)ylIf^^3^#45b`DFIacYgPG z&pmVJZFe*4)%F&scGd{LwkcC>Q|8*<0@XGPUhU!8e%oHztL>GkHZ6Fyy#=p!*07L{XpzJw$8gilq&&gY$91P10IYDkhPF|VvVL0c* zTcCWH1#-$7;X9eK7t=6PCMQ#7CvSnA%)&wkM(wgg6B>`m);uCx^GH~0gk)O%j6;0DV@F0=;tn8w6x5tF?Vs9GjCQ%g>K$jfcef?_|c*Z zoy(mo!UScDu#JnHvKjNrmpBW}yu?|sXjYk1URbtxHqI9GAt~_83wj=$!zZ==4E;DY#6Mivx^rlEel_b`MGFG zWOIdc7SE0nMd7@K^TJP6rAxqCp1YQm%$rkQSQ^fj&VZWXI!FZuE2}P^T|BFB#=M1a z77pXk1mN)MVe#QcjfiXsGzu%6;#spsWID4T$x9Z`bY>PW2KRXmm0*pG08)Le0~Lo4 zgHd75(Pk$G3m`1S{LYzIQMhpS+~V?i*UWazR$Z{<+K>X{@$#@ZjDb&K@eDuRs9UhK zG$J>s!_c`!)=B0MKQo+h5r$PEULJS@9T(teAQrMl_zSSR`U|k9`wQk==P#PmnpniM zj$F+07jQ6f9P<~=D4kb+oilskEIbA}GiN$eoGE3_CC(*f&Qu3>sd)<^6UDQBz7)3% z4jN}c@sjzD^Z(?!&|H<`x9M>TTsPGTEI%#KE2)oz&zUn{XNOn(Q3hvP(y1Bu#H@?` zW&Cdw?@u!8vjOAOinGZ{r>5ch-^SgKUs}ex1;}B-$CY{Oy|uUwznG5`KHf*Kt2S#K z2mggyuiHZF_Tg(jw&{6dADU<#JtNQjm%z>_tX(mTCly{r6M`^Ws+K<;CSrnv^?f;-pD&d3o-?uFnge6z4X@tqgW` zx35?Uvin2TcA07$EY+Z)Ux0n0`|D7Jk4=T&*eg_<3Ts0ZJ~tKau~+z&sc?I!!a-Bv zj>rn|`;OQb=ymM2xCZEV+(hi4*IQT;9R|tD|4u@U^^9}>5*NQE7<6~um>2BnZiL|c z@=C89w=!-@T>R*`NpT0@FMf3J#JEYp;4Q)A6~UlcF&WohWY!)C_Q92LdG0%~C6nXa zhl6=>?psiXrq-KO+~TDImcKQrSWT&z2pya_5&8{1#@XbF5Kv_dZqS=<+?E^XesDcl zJrJ7*E>QWXseBVu2JOU2H+glvsxUH4Ec*rm{TFq%I#DyZ1Uw z_ea44khKdju|V=-;^Ej5zSG=#9PTuYaR-7)P}|*Kkr(V1=k9}Uo&dvTWw2WwthhPY zEjO41b2kCFyA(8T7g*t53nf@H*{ng1#SlONIC#sj5wMBi8SWW*7~sB&ZBSl!9CSP` z{^OYBh{zs@$H<}#*=$@M7A`wXE+EJ)2wm7wq}xA@+k?gp%ZctEK{mjB&-B$)G0{LpNUjLu zJyY?IrXrT%*l8-hZz?_%3LptK3Ty~$7NdV3Q@YZ9>)HeE!}0N>SHfZ9Ef_KbU}|1`AD_-g@Ok_f8&_pnSoMC#lOo;*Q*6I`X|~0JX<#Ko2c!s>5`u%2=r~oQ7~uT4~n(V46W) zWHV#jo8Z)y+JSJ_cq`o= zpo2cj$AAzI`d^_C5Bh7&+5B^K;++zFB%?g3NVFVkkeGXSZ<{O>dC*BN)z8uz=P z>KHgXqTmzRhM#%NwHG|chug?6Cz^_5++Q1K1kPu&72LG&#ooqcOs@rVZ>- z4;RCwF4S@t-UEhm>;kTj-2cJecsyX@7R(hM$BtZcz+IK#U1l7)2J^Nm!5qg{<8ka+JdT|J*SQIC7yma0GrZWi7!EO? zI?=8+{+JL5CMCKF@q3{ixXyK(uUQG#jqaZyl7v<5cpdW^gq9NLJ_Q{e1iN!EFW3(b zeQ-k-w=EbSHzjxq)ax7fG#m}{+~=Y8332YTpzS*`cm}Ki;jMA*GuIrzTZxww;F{mv zcFlp9*of<%Uv~)vyC(LG=^e4=L9-?`%9`zFO^+yR-ZlM-|CD<5d#_h}Ot0Yf8E(d) zSHU><8aB94k}ceT0L- zgi7es6YfXe}c-#<7QhGcffsRDU9f+fF#@mxiHn-mzSDt z_Dmvfv*(va+h%_^J&DOkr8GYTUFjX??uM@PoD@u+7)*eKZ4V~oy4U1Qx+oaD1b)33 zuGCX5fxA19!u=jJ30+Fd3l7c;A;?1bznGuY6_cODa9}{MhN>{24@29qbTeoNn*|uz zUMx`XB7pY0fpbD$+$~W;I9zT*xCQPkbqMY^tYSZpUnuLHo%X&(9bZ0t(a=KdH6&a4;r2p#&7|Dch>Qrlz|Io zy3O#@c`@{wZ{jzPM+q@3^fJ7E7{i516aN_z9Df%VerzFv|6t-Y&$0|#_Z!3Uoy_oQ zvf%^5AuJs=@ehpPe>42-2)@d2^T2|zb$O;=<_BrQ_z@F-=%F8>b=Mhgp2r?ySUAV< zj4*}^ttS4V5&Ry*&Ch~_t-HYR;b9CHzBTb@MsWOrVaLge;5QgPB7#pa{T&&>zcKM= zNAPmPM@8_n4F6FCf6v5!ZUn!>@X--G$M7)`{Gf?nJbi`~&lrAQg#KE?b0YYUO@GHm z@ckzKaS?o>;o~ECU&ALv@Es=p^CS3b!!L;7KQjEn2>!W=KR1Hc8a^?CUu}3^1kX18 zofN@8Gx1N3;3bAniQv5q$EW6mPk%S@UmOl$X`bQv5xlqImqhT7P5e_M_`QZ-8o}oq zJ}rU|GyT0Rf`4e@|49U&VfarY_(_KIr$zqiCKLbVKA_S}!>@?oJq-U@1m9)ipB};S zmu?*A$_PH&@T(&DAk*K%2>yYIzc_+VH+)6}Ki+WjES#`)&ztz?gfU#W((t(vJlXJh z5&V4<|NIC(-NX+ctf=WHhMS*|4_njMaQt*Ee8S(acbrqgAuO#i98S(^I?r$uRM?tC z!_6#=|H1StDU9Jlf#KaEco)O*6TtB49n<8A;SiSYGCU=M?>P=Xi^~o1G%6(+J~4t{ zf*;&Dc@Z2(a=@7s!C!^XIs=Y>97rR@DA*(c_>u%q%#WCM{o??i;YJ$n9|xGW;g-g592V#JR8+BFrRxv@z2J`ABP;z0OR8y zf7s_bam@OcabF`-ZW zVSk40hf_B=4#YVAez(uVP70(f0AKCliTy8!LckfpIFyk$%sBC{e^{RugL?n^hmSaC znepRa|1e)`#)*IZ!~CcjC;s&q^Vz0d|2m)fW5)lqP@K#gfCL=>I-mJjrrop%{Vz?s zoOSn?8TL=&ff-NpO{6HiXapZRAd9{)O!`6Z^^ z(0R^#c^1!c0)%INzvaw9?CVY|C~jMLGK^O z^lB&TdsAzA2XH6lwHR^Zp)RfIIf2C$m=Lv?}pAcQjOd{j>$Ey_p^}_ znX)U6V{)bIq{+ol*^Tmk1+H`*|F{tn8{SVYhRUuuZiJxGpCK1RWjD(E6}Zy%eq%MH z-{GkkTu-^!H8 zl-(H_H1JxYBj}>-><|@W}ToJbkg0h03loD^!*R*O?<1 zLuJ>QA1ZU0_PXmLJd@p;7JlK?4;<}=6Q^PR;9&n(e=p0)V!o#{xp z-u!_#8ocs-Rkq@Mh1?7HQK9EE8gjTW4o!T0+8x-Y5QVRfQ~4yti-@Csv(T3az2s#= z|0kg@7yQqHFBkkN!EdHA#v^^I1eZQ*1eZQF#4-LSsf;gM1aA<$p32y+)Nd7B>YIem zL&B$7=p}Cv`fWnLQ}Cw+-z)etg72d;#wmT;1(!aD1eZQMHZVWig?|bxMI17`by&H|FH0>5_-w2h5kjMUnlrWg5&!YIH5m}Rb1Xk z9OINeb%INuErLs*2IA=dG8)tLn&5wB2(Qh;N9uP7F7-Qw&m+QTuh2`rPv~C}`gXzp zCU}S7uL}-u;+YBaBYk28mp<`=OP>_tn4edLf4bnW2|h^pNPULjQlBGyT7^%p&`X{# z^t*(9n&7(ypDy@^f)^3T{79c!f=izg!KF_*am>#i;lD<3J_h3IYT+aG>janjTH*7N z@UIhk$?JvwW1-(Fc$?tc1^-O&M&U1gUKCvVGzl(!b_oAZg#SLlKNY-P_(=UB!KI!r z4Ke@wgipNdE#UT*JefG^KNtEG!M_l^x8VB)PZR#qr@!FRCtYyqlPUba6#kP1=W`;i z&KEvXKTU9{pDuh32>&9Xm%Lo)9~b)NLNECm;&`1F4}UyuwD1POy9#}?;KvKzDmee& z9=6d&9Jk{^ZWLbIiQ{&c{IKxpBK%Wgy~-GWlHlor%YKcv@X3M)h0k>280VuRPP`w% z3FDN!ROtWiNzA-V@HYgn5S*{saCN2dmp(TOE`6#5mp;|P|1HsOjo@zzzESXh2wo@r zrOy_@rO$T3rB9RauNVH!LNECaq2D3&twJyPUZH*G^aX-+1y#PL4k2hna)oVS4ae?stN;y6wu?@b)zIS&4KN*7!n z4|6Phn&9#{Un;mf&Q}U9^)-S^eVyPkZw-RWIA62yor25bcDvy6yl|K}=9BM9O^%N9 zGKKk+Jc&5wQ=WJF3!W_UoGG}BXSCo)d85E~@8wY+BY2~wUA_m@?eaA(`pCSIjkyo~iWlIO z4(H}PE_o_xP63~-LeE7UKVS0#yh#Yb|R&;NA0ET^{gcBv9vZkIa2<$knR z@C32FIs}*7@i1{cet6&4+p#}+>h1Wy)!&UGPFKXw=O%1d=Aqr9PZM#<{Vqdr>7OgO zJWlfaJlL+(7m;4)t%SJFTb1ya<3G)k|Ng|akIawUe|cZf`AHS+CQ=!#2MI361HaFv z`!$;M5%CD0uy_QQ+bf0cH!)5bPrBeTo(#cd-r^}g0r25{0Z|`nS95;9Li4-GU-P#u z9N+)PN$ba0_|+Ev2MhnFg?EjO-Y$NR4ksPYQVZw%1+9PIqVGo6KUzQ5!udK->mRh} z-?#8?bUmPb##(r}g+FNF?^$>no!@o4ms$8PEc{suKV;zpXh7?Bue9*B7XGq@d;fnC zIZg&8L?1te7Jj#dzhvPZ7ViDONn|`liP7V^$HHH>@NX^L`~G=kyNkO-Z}&k9-)Z3| zBt`eRz{0P$@JB6tkAckdveLcZP-k z(!!f8{Cf)@d`k3oi!FSeh5yyUzq9Zmy`r}}%ff$S;eWSqw|8{^5f(nr!q;2)8x|gW zYV>wTS@=Q=f55_9EWGP!(c2wo;Y%&N&cfff@NRvgw>#Ft%Psst3xChTyQW2NH^;)4 zTKHxQ|G>gi`Z{LP$A^g)zTCneweZ~*e$wgD+s(7^6&AkL!auR_)A~hk_fiY5vhb%Z z{0j^3+dq1{(=2?og>SR)&n-OdjOguNYT>t9_|q2NZsBK~8NJ;rEc`ADf8N5svhYjK zir((67XFllAGPq|>Cye?TKIhy{)UCS1ETwnwD9>B{#y%w)52p1TH3YnpIi9-7XGG% z$DVCz*TUypc&&xMW#PvSir(&M3twd6zqjzWEj<35=(ng7GWPtNvzq<)5le{A8y zM@9F!&cdI!@UJX9{YTOLr(5_&3vajZe&@FzvOc*{G#)s>wjh8A6R(C*yuj%E&L4&j~N%;C(FW1Ec`wT z|GR|;#z${A)57Ok_`MeXx`kgn!EbkqS2XiqTKKCL{`mRPeZI5s@fSqb-*jPgzSY8q z=SJ7hvGCtm_-ht^)WU~NjNa~S3$L;8S1tSp3m=*nz1>+B{%Z^Wn}r{-@Qg{(+ns6Q zzq0UGEc~#A51Aaj-5D0%A^5{yRWtwb6yHbkatnXxqUidA7C!po==zuQqw^atiOwIh z@Vyq^b82*-JPW_U!s{)3kA?TRG z-6xJ>#_tw=OJ#gX68w9?PgICnyhs>PEJnJWuej8~}|D@2rKxNinPWm^5zCq|)lztBB_X_<}LjSqa zFD5;Y4UC6lLn(iUjpMnI^!PngoKXL?S2Xi}#999fS{@?w+l3y#SBDepe@)91g#Is{ z#LTBC{YF~mJYhV~2>lGDuczgO^osgth5lNl-%iV`guYSe*C>4xE!PPBb3*?+rGJ~2 z9~S!Oh5pYX3jNtipGM0gg}zDXbCjO{Uv#q2zasR-N}o;33xxh}LVu0YPoU+M zLjS7J->&qR(DJW^{xzYmRr;%Fd5h4$F7$s=`k&MC^Fsf3p?_8Bxj!vJ&&L+5_PNq? zKfe?DX5sI;-U5$@J4wg?7m4HHO`$(o>F*=`nZ!~551}8T^!$ISqlNx0p+8^gx03%< zq2D3&KU4Zf(w7MR+d|LZYvumFM*16t{vDxTt^7If>xBMYp}$}0KP3OnLeIy1toDS` zA0U0B(En5TzoPU%kp3N^e^2N?Q2In#-Y4|$3;kD0--DN9JrQo-okHJ*IOp?p(x(dj zzl6T8()0KjEcE{t`jJY{<7R@;e<1Wzls=c@xkBh$g?^^eUqO2Q|4QudE}>th^rfV~ zRrv1~`n!~#$Ju(J-y`&YQ2Mpx|G3ca75b-@p8wC5|1T2b|4``PRQf-Y|G$O*M?(Lx z(l?Qw|DO^4KNk8UO8*||6N8=z^=(3r&y&Q7#}ALoG@<{*lbHDcrN`%f;xt0&KlPBA zpQrREQhfaXi5SmkLXXcm#EIkSPx=|cf1f8Y^J|rU1nK$z1ksG}T(G5-C+|3js}oAgH%=kXd(H!z&f z&7?nG@!t{eq4*2L`w_=@4vKijD18g*Cn)|A@kVQ=QGkhDfHNGZ>qCL@Ot61pE&#cmf|_0ILDKCoL3q1`L*yl zi8%XkJZA_!w#)HcDEMQ-hyU+@eIBNGij_advrzbaBYg1r(m1gX$8(#|W4j#BUzENF z<^Ki62NHip@$tm*dBr$!yZnF1Z!5l(^zSQvC-Gg1^Z%24toSpe|6K96i62yaAMtM$ zkE88S+OGdn zoc~Yw6U9f6{wu}LB_5#tlE?WN;$0OVNBm^P&nJF{;**FERs162V-)B7PgHyw>G}V9 zIL=dv&sBQnWs3ia@_d8huM_`;;%^ZDwc>9Q->CRo#2-_fk5|tq{yFJiRs10F7RA3M z{-NUE6F;E1L-{$XcpUMh#PH)lSK=oto`@{d;>=WwO(3GLuCQgD1fmiMCz1;_V?dGdb8 z%Jau|`TFy6p+{az*IhFdA4Pn=;z8o&ioZ$M|2HVk*A=%a&iChcDbDB38pY?4|L+v% z=T>Z1Jd5;CD9+Cx*{*ni^sfkx`OKh%{zGug+cdi0e_!#{#P=%xI`IR7qkkFse=j)t zzeRaYNb&?Y{!!1@nkNcw^mIMYOYu>}`zyYI_%OlIzujxjIZttZpFdY{Y`kB zee!AC7731e@As?V_mULfPv^zOihIA)<~aO+j+h7Zxs3ETD}7($cPRc-+8=+V_&z#r zY*4&_jtg~)KS}z>6n}>F+Z10(`WF=c3&r!A;!{ZfPr)&tm6Xrjf@2;wQ2swt{2#;* zDV|FHF=-;2>JXvsz$D#3jy5OikgYs~;;(T7uRJ@)1#|e)9Iplw_ z;$_4O1jlx7r*`KGjy|=dFB2T~$+Wyo@$t00Qt|gGkGCuSAn|pIFCl)v;+tsskBa}8 z^p7gOxf=uvQ-k7sTzF3Ln!5@e>6{e}2Eam*D7s4fzfb9QFBh+#V)4>aV5ca~0=)PEdRtEl(93 z{j15pP;q`=xI}Pl_g}Qk?eqTCPCk`NKjQ?b1k-Jb|C0FKil0OLKE=OH_Ix%f{u1$r z75|=m{;YU4>7P~nFnyrir1;NB|EA(Ix_j}wr}&wq-=laj`R`MFKaJ;a1;_1@M(4*E zTF>KZJS}%o{2E$LQG7cspDsB17m@$jg5&mWqP&d~9QAx1HBNBUze4@u|10M>2NR#B z^y`Sv5FGtmDV{}&C)0VnLU3$%2<3mZ;OLV>`f9;Zzx5=T!Sox&KPLWr#a9r2NbyO; zw<_L~_+J#C(!*=_WyN==c>E2;FY4*>7R4VX{YQ#d5dTu~C#c;H#mAFANaK|E-!jTu zH^DJ)zob0(RJ@6Jn&REapPvK3{`@}jNTol8;yhn)+>Y%O&qab`JiRDCKUKVve2NtR zi1Hbh_Xj!0(_uoUQm-#4{DYiTuY2j{c3beJ2Ty{%7@q8BEg@ZzTUK6+b}znlCu| zC)0Iix!~x(mi%u}{7mw>Rq^ShUne;F^YiuiITf7e?@9khp~rUDkpH8KzfAhS2#)^M z6#w58ZzTSf;OJjW<6$>(-Y@w2^PtlIh`z^lSaJS-SCGyF+^-<%yD2`Z4>S%_PsN*0 z^>~`%8%RGu@%u(t|#Sc?HO9jX6(oXqb zDmdoVv9ObiK@$57scb*X({rP?H zzY322?~=Y*@lx{tr{cdS{l|i%e?7(DE;#y+rS0;q;{PE37&>3^cuOLEvfw8F=cVrr_A_gXEJ%oc9Zdu7@vB`pSM#38sq`|A=^j;**FME54$?=flr?;ePcX{Su}B zko3zH-*vj@bBp5J&h+@5if{ocz-jZzKN^f}?*jy$^7n;OMiO{BspgC7(+apGx{d!A<_jzf|!`;{2Q+?r%Nu z+k_tDnRFJ+V7goJ&#B!F#Cd6uKHCFM*i03K(4esjnUsg0EB*@Qe~IElNPm;y z=wDC%zYrY#kCOf##fMOS)+_!h={F0G{``gaCj>|TOxiB|Tq)jOuaN&sO8-mZZwYSl zL+^vNDqctK9OBvZQaqmY{S_}G{W*&7 zILGrDq4zg==qXb8vBGQi&9Q98OhZ#(h6#t0$G{tWuex>4*Gd-UZb&zC!UHr04ro z&d(=Vp8qeDe%COM*C@V)`0o@?C7;cTUrYKY1;@NqQ{EZ{$Gq*NJins&@#OOl#m5nE z72J#;^8Z9|^j|@79#H&b%G>vfPa=Ins+SMU8~XG6|0fEL{`n(3T`$E~kbi&0dy{^c z;AUJM@A;f7cn6?cNIyaG56ORu;#(>Hp9zlswd7x-cr)?kit~>k-XeGh`22XJ7w4}O zZ=g6IAkNoU{C>h?iqmfDysUV(XYahHIDcO7h2nLtSK&B%ABEf9PW*JmcMu<|_+H|d zDelC2{tFf7?|fcR^QZzJBO_^ZT^D*gfS zGw6L6ZkNALIa2YscyD|ZD1I98a>a)cze(}&#P3vm8u87F^Y<5@P<$cjpH+M@@mCeU zhWNXR^Y>uju!lT;Qal%T)|QQH_}fQ9QEAa0>M##LN?4`nl3o%`FmLKt=YIZ&U&H$4p>gIx8e_iW4nu~-A5GvfZ~5n z@v}+)hT!O5M*jT#Pu%Y4KkY|eySs!Q`RC;GrQ&I%kD>QR(Fgtc^P4V$qtD0Zdj2Vj zw~^0TiVq*{>9Yh!|5l3s$AY8(dh+=Ran5s*XXDIO`d$=Inc{Pa->CQ##McUr@g$$% zHE^%s7|(qa|KozAK8N&g3y%7^q~AlFe1v z|I>;;MEpg?x!q>Px!s+LbGx4?{uucmP@IorKPb+}tHd-ffqcCE8~OB5oR7DsEB*%Q zhY-i@@{ng~=3|upXLMYeC^(L{J+ytN2#(v4ZGxlzPSW2YIQsK({x^c7{$0}FFF5KyrTlCX z9QEmAVFuH~Y33yq&ljYBN^w5UHxlRV(ir2_e_e69t#J-1KH8Hzz503u_Q@wcPVpk* z1;ly(T{qTSF<)@p-)m`q|ApfGT>eeOx!qdwZ&tjX_&3TY`9yC;kUk&ac>X%pm$=g+-%6X$qx0$xBJLXYj9 zGtT2(`gyOc=kKrfCC+&$B7LUd7-w2{ul_i}(f=OOUnV%}i%7p%@oM60iE}*F6#s)l zkNz){|2CzsC4IBfe@ps3f@3_5)b4)4(SOi*n86g=-+RS8puU~-eHBkj@pL)FIsO)k zXRhLH#BUHj*lr=UTdnkmNdKhbPK?*?>&oYD@@ZB2BGT_y`j@!B^tlknpX%8=y#(Jv z3||Hi$Nb=Nsf3O*S%PD~E}VdB_};YOsORJM`GTYV4$@B)9QAzMzD#h`zd-uS1xGy} zw`U8E`pxIV45oR4qn?l3O9e;$0n#rM9QAzMzD01{F#qSXXkn=URU~!q(7uMkKJBp zc>?ZN5ykT(#jA< z`Mjv~NpyU8PwBrQ{pU)bO8S&^(~Nlz59TI~__@S6KN&qd-4%)#5ib!O;~Y5A(_b$* z_P3Vww+W8=D@nheIOky&#q)yV<;4G~e5%Q3pVC*7zWV?#F7~e?{v*Ztyi=@r4e6^C z=kv~^#5r&6)Zf1=p4QWgW2fMlhZiP#{7b3LrK{CP6_^ZzR?Q~J9|zlJ#LXHh)ASNi8k|0kvA|I65^cm?^mgS@!dzmoVs#jA*4 zqIfm&3dL)PZy?Tjb5gzbo>BT2NxwtrF>hZ{zdly_9i%^^^y!m4|77|cmHX97`jLva z5x+|DcH*}v-a&ke;*RUJ`#fbISKfMNfew?==;@QNxUpeGc zsCYi{rNRgEc_+nFrS#KD|ES`#h`%FzFwT04XRqMs{~Y;$qkJmJrz?H#%K14&`ZU4O zzm@z43y%J0O@iPP!tKg_FB|ZO+ z0PFes^HimO;3Chrui)s<*PrJIj{cvKeyHH6=j%`Y9szIn%!@t$u}aU^pHl=!|7Y?& z{Uw5`OzEpgzg+QZ;twcZL;P=w*Am}P9NWeII;VIml81S(9RF+H zqH`v3j&su`-ilF5zmxPuiXS4rT5-Ofd_?$TJQ)xvffvx=x54 z?ghZ{A3xPw?n#{c%fE|!j?#}KeU8#kCjYsLPa}S(;?s%$NpZfO+)13bOFi}Xd&OIc zC(r=qel4Xqdkg*@bTzq`*WYuAbAS0clQR_GN^#z%d~(RAPU&AG{Tqt!ApW)DJBgo~ z<;BJE>?J-y@qNVSD}IRh-NZR>WfbRQiq{fs(7%82lOz&fBZorJioQ;Mi_PZ;#JVKKwq(ZHkwWf4$;-9r&)|d>!~XagJv! z#p8?&kDsp(&mzuwE}}U3cQ=?<6Q8Yo>M73ag%9SloZ7up=^IJEQRyEf{gZ-Y-WsXh zca%>H`5aN4uMhiYhxeDS4<{+k*N4T#IdAV#JmpHy*NyiHJ;uqOD{oW!{&c;xOYuzN z-w2-$@aa0ui#u^tc>EJcKUDF_#0wOkMtmW0?pF@^-z2yhpQn25)hb>@{8{CHGx>j{ z_&VZ;g%9>?3AKCtkHY&^OZpLt^Y?kKRJ@+_ONev7{z(3}3jQ55RZa2#LHXQ2l=0NZg_wBdqn3G=lzTSpXgG-F`o0te~#eap(TB; zd5iMTpzGfIgdTkslg}ec&)-LSQR)9c`gfInGWq|Y_%z~YjK<)+=Pl!P+H~UlyD+@H zTFCz*(sLd%s9)0s$N0Pa1YI3xk@Bx1|6eIyLwt+!`7!xCD>&wpKj(g3aBTN#(zh!A zdh-8T={J%-fj&Rv^GE~fGZb$megSdL&%5MvxzeZ8b??uWKJllR9eAHp=~F%ItP}hZ zV)*iV;qyH#ucZ5$M+C<_Y$gB41xG#K*F2~Ae)4Hn{2=k2f}?-G0+_+nDmeP{eaAk* zQC~{>cEM54_d$mh=lh6w`rH+_3+AB${&4E6c%z~4JxAiWUC{rncyGmJihoS}YT>h$ zJn&_O(!WD_xLt7U*V3PPmF^N8+vPmpCphZAA^iryQP0l>dPs28|71GMV0u(=)E}XE zo)#SSFOmLP!BHPfgc(e)3Xb~It~A(rLvYmdbGY6Y9QD_d{sX~Led1dAy|yj{4iLf*DMM1V=rOw`|3EyiFjE;|<3{1De2e zmEyhWy7xxKGl>6I@dn}zil@?bQH$b(h<_#c<6bCc?&f$4oVV?i&*KHhJUmh0>ADM! zdEoJRy5hXOhAPh6WsKnHKk0Iq!8A6*w>r^Se0{rP=>K8hESel&63UdK~@ z3KZ{0+;jJ?i!k<50yHelctc)6JegiG9^}huIaTrPv`lYbg?!jQTj|SbIY;rEX*pN% zDq7B0d>t(pC|*O$Wr}mV6^iq6rQ+N!zj7XUKdn~!^|Z|GvwkD-dZp)lHYm<{XjGir zZBm@`(5yJO+oJduT5eaIK73X$a6hB1zR>fm!xlQpTT6SW*irg>GXT0K^hh)XMUA|smAI?LX(sR4% zil{F>Y`&22;V4-XH1|A5C%AE1pBV zLGeoB&5E;si{ja&Z&f^(c$?yUo@!UTfb<=TPbZ#C?@#b{=XO&S=l-TC&h4fvo=^T6 ziWd>jR=k8bf6mGAa6Su^p7T(oIJaA(IOm~Eac;Ll@iL01T5-->jpE!dejkhDFDD;< zAB%Yf@kZst?KUaSKFx}=PmAI_-r5ykL+y4bUPGMUm*P0r6OWG#KhEqVo~Aharz^gW z^!&aQ`)?$kt@L%o`F$zYZzayZBf-3Zc#-nqc1slJ{_^+N*oWJ#Q2H(8U#a+Z;#G>j zNW4~Y&S#zCoCkhCiR0mR`F$hioQFo`!|gUH{u;&8syOGZO>yp5yW-8{)1mkd;>q;B z6vxT!rYg=pX^OKCzrV#kJl=AYzKz<=Rs0a~e8oG67bu=d$Hy|o*}p>ZcJirI+##PT z#rgY7)ru#RzD9BW{!+c-+-`&7+}}pUx!oqknQrIOmOj=YjpXUpY$8?}y|noZcv=_)~GnQ+oU+> ztyytyw?*-N6i>V2oaYY3InNHg56AgwC!cu54-x0*?XjNQO;>vM$xxhqvK2o}{`{Od z_IK#Iyg=!bi5DrJN}T@>hJAVyuT*;WsZu=icc&r_$$C%sFpqigUZ^igVsF z6z6vNcW2n2zweQ+^qgn@T?N*2o{N+|pYmLy_%!1Dygl~ecB_=0eX12_pBlvr$iH6k z3gQilFDKrpcqQ>B#jA)nE53$!i{kwKgm%SC=su@I@p9t)`!$>&zHf~05`LcI`!Rm* z9qZXYUFrG0G(&N||IAkWW{M|A@ioMA6|W}F&&lI>xZM(^=l+%{&h1txUPbgK&9%>cme$^??{c2Qv2lcB-@iyYkiti)dqIf3V zKesE+{vC?%B_F42_&Dhx9ODs`!p%e@i!|zoqSppFCyNmcp33F#mkAeD_%vsL-94l`8kN3AI@j$@!{i#<4jYW z<4jka^Om7_1+|;4_;TVoigTQ~idU1qNO9gSC5m(2$`t2zD-^FJ|4PNV-73XvNMEZs zZZL% z6=$D1#W~J;#S6%%LGkIt8x=1j-lTX1@m9q-&Njul-FC&f-44Zz$e*7RhQ|}!UZuoS zPw)!N%ZR5bUP(M%@hal{Tru|He&s4X`{XNLLp}wHuP0un_&VYhinC9p;_OqUcrE$x zbBQqihk$YXbwZE4lJxb8-%Pwgan4V(;_TC+IQz6J&OU95uc3C^6|W}Vp*ZJ zeUbF3Cwc|uuMy|pVPU?5c)HTJ5YJJZeR36VCVjr*>{FolPSO`C-b%bg@x8>$6mKJ5 zq4+-H)ru$6=aMywrxLGKJdJpr;{Ay?D&CuTlj7{ttT_9$D4tF}?H1mlcn0a6?q0`v z`(_i5S9~;aeqI#orxQEw;{GzPQF{Jk8%QG7e`cE#DJLvi+TQo_dr z`@}2WNdElXEY1(}bfs@1eTL%A#IqIOL7bm^g#KF~v`pGh3xpndHt{0GbBLEHK7lwt zCyD*@iB~Co0r6_Z`TSd>coFIA6=$CY#o4D(arS9ad=~jPD_%mpMe$PN?TWKchvMwx zoa9yH{IE~F;(Yy(tav%Ko2qyP@eIY;hkwU}+hv~|rDva9#Vg65p9{r4TZxw_{dVGI ziZ>FkQ2a&W)rzxEjpFQ6t2q1ADc(f>^@{U(vqAA4q;FQ7eOeTMjr6UGvrn7iJ4w&a zyW)Jd5|8iU6`1cOo~(Eq@l?eR5$ESru@9fuvX!3CUpb0r(s6@-e}sLqiSzTWn6pob z#ivYh_Nh>u&ySUgPoQ?I6wf7It2q1ADV{_6dd1nNLGj6?Z&W;=c$4DOh&L-BQR=uOr@}cs+5aXZSeb^HIFwd_LmmZ1MJDpLC^XpA5y>CtGnoPw{iP*q^`eSD^Gw z6n~N8uMsa%yoESF2aEmt)92JxNc#bzXQVUvQL@PvrmQM{5gB2;{17cmEwb_U)759=ioJp^XJ<2 zikFg4gW_ex8x=1n-lRBx?%b+4f4y=~ zS9~4$XDD7nJX`Vg#Pbzrp900%r$}-3DN($Z{L2*INW4PvI^xxevrmoU>{F{a`^ev0 z!RzfUil>r) zrQ*GbS1F!GyjpR7|Di_lbkf%=UP`<{@p9sgidPVCQhYh_R>j$;O>y>VSDbx16u+7L z`T0+r|0?3Cy~4-O8sce+R})WHd_8e~E)@Iobx5w#^L0qR;(Q%ap!jR#&(CvW|HH&9 zls=Zuo0W>k6R%P{iFmEz>{F*W`_wDWJ`IW|lYgV)sl=NU?@hc_arS9bJcab_inC9L z;%TIJdWUa!zJ7~WJe~B(iVq^5syJVd@$;*Adrc#Kw$c|6&ry6j@m$4=i1Tx&*uRQ+ ziPEnjUZ!|8@e0M)5wEuJ8pUf!U#s|f;&qDG5pPudHR4T*HxqAGdhP~duT#8;(RiXKP`Nmq>(;Z@&3e96;CJ5&uwD=S;VuIzLa>5;$_5h6)z{AuXqLV z0>zgTFH?LY@e0N3h*v7Ug?N?X^~7rhuk%u9=5>lsr_ZD71;@`fd1_F+l~yzgj-TuC z)TB5cXPO1a>t3E(6zBZ33Xa!xJhdraN1yMv3;qa;;k85YeY~!ZSHSV`C^LACSDX%C zPO{*9EsWJt6=!{#;ExIabj4YpA^77$pRG7wALa=DgwW?I&evD@g7Y;yRx40ElaA*c zR}k_e$IobL3%ML8(*>8~p+a!E-PZ{&w=d@w{pEIiP3YzJY89O8BI5T!(MRS#9+q)J zF7wRS?)oezC|#43seWA^n3spCHMO{nAkD%4ZQ!y!bD z-BEB@W+bGJSA-3Sxr-NF>kOVXd&bhag~c;wES`OhV@6S!Xu;Cb!g&kJ!`PCgGYlI% zbJ2nYv&BjXv=CgEmciMYz#L?6fgJl7S34| zmRi_orLz}?vN&_;;%jCP%gP!$s<5nhae3jQIfZIvW@dJjRVHg@i}-RsL*5qg*PzJUSqt?7V*`{ye;B0-@)4={u)$!TO^!$TSPIlMZ%f4MHV`Rg-gndXU;F2Su($H zPVv0buuOV`wA2~Aa8dc}!53b1**QiWrosIWj^1Gm$G&E`Pa+dT0FL>vBMlwAXyNRz zy{U9w2+S@ioU^!i!R(Mdjva3gp0jwikMaCrfb7rQrNxV9k+V7b@Y%*UDP2^I3hyjq zU5%$NZ?Kgvn(1I|GpLpfp6LvR9lN}E2D~m?U|u86Sg?+mzcszlhIoOz?iXMRgw&x)h;+3Q8LHC}Z78q+^>>QKx? z63)Cxik<$m29F$t^ATpAW#*Y?KHSWQnfXwdR}41Ak=aIW=2_WtnBWFB$0s;2pvIdI zH|1ewJ{0B^gH17eq-opCN0@n*nP-~$a5Eof=0jm#G1wHdN0>@xK4L`Fwjq(I@#dMP zJlxEOnfXwdR}41A>?~tu<|DE!W@c@cnP-~$a5Eof=0jm#F*tfv*lcL;%}1K@2s6(z z^Gq`zo*BK_VP>s29}4A)!3JaxHxZlp2s6(z^Gq`zZsx$8+Fs~Rq)XaxPH8UeW`WhT{QP-HUXF?ci`eWuJ%sk7?GtGQ>^xAOr z##%Us&`jCPvNMdCnU65@EHlqE^WkPb4CYYD%rm^J{r`UcFZfht>(TtU}g0rfRQZ9!izQvP1@0$|wB zcw7k+eGKaSj@qZ&UT-DL*VBC&eY_FkS~n5y)1t-SK=oTgHNAq4bpq7a43!dXx#AoIp~R# zZtHYQ`#DkC$6I3E{-c)m`Ts-s{UOtMl=e4U+AoOGeo~b7pu!R zZ?yJvJ6V5{C4VJUpRa#t_=Wa=UhZWXfBZS=vFgvVsa-_ zvE;9j>L2U)c}aZq@!vxAVRhJ~m;Y+Xe`_b}%VWwUs)&X2Q2lgJ6V5XAbS4lJ6S&;QVSLl*YC}ptp9@L{Mp{g z`h}MKC!g+Z^JATVzp~^nr<3)ESn8K`vi>qiUbOtxcCvn@E&rXYzu%I7r(fst_d84e zGpK%!XA_$1{qJ}H(fVK3$@*7Y@?YP{`p;PM-`>gkFG0_u#h=mN>vB%0=Uzegf4JrN zQ`X7)-RSoJ=^2NT&X`Q8h6V<2NpimWE|6HoC<8Pz-I$pip z&r-j=ll8k;>UVUq{!5hqPzSkihF92o6$9^8_aC354IxBKCG^G#k0X5lrV#$P|9oBd z;}~!JX@kA1JaQ+jmy>S4fch^rSYCXqM>dWNU!&_^3iYGKUo+iPw$AeEWBfDVPshL0 z5`T|Zyn1DH9qcVd_Vrz;AFch0=e+ilCwMineGEmn{{ywJ&l9({dG&h2`-^ho{`2c~ zmiqS}@M`@;R)#XyoGr<#vgJ^ORHTu8o;hIdzxYXCO$| z6`k&^T@eEu$|buipXxKkxf;G}KMg*1sGc9l`8F|FIW;M^a_Tuw<OBI%_~5pWvJ@0JLX=b`WUK18oUt4|d7<_Q>_m*EPC@ z?zbl|!T#k1tPb`TEk717+vw620*nCq=bc810YWPJ1-Fb84Rgut!~eOhc3?D^z~0Kgnr`oIDZrLdoAV_>%kx7!G$~|Z2IO> z%tIH*LlWd6CX@&4JN7xgHRq|SSSJ(mfA#ILUj7fceIP%52KG#g#g9-@+T5IPKZz;q zNDsu{-WJoR1IOCBIA`rQzjxMdh>8C!55`;@;W(Lhof7)JY!x`%vf$cd^Gbb$U#?V?<*KfFosip39pzZ?0Au4b zH+6Gq){0FFZyDFHA<*@+Pln%i$_JoX6WDNXUeMWJ1vw5JJv!~1IOha7&1HRh^k`46 zYZ&CIPav>=)#0Plo`mt^>~$9Hf;_{R*xc#{9&UBbSBlqt4LM7T#j)4Z#3NsM%%R4C zagFt3V9c=wc}@)0b=K~NKOB#|FW@>jUS!ol-*6kld+gKj^*QL{C(uWDYc%B=$P*lQ zQ&5W@|7kow2V0CvjZA4>`qgbM%FPIaVCH zI4ANi5gx6x1p3wr>$p$wxnT+%<*WNTxDC8E-a-wG@k1~^P}>)_ zJLY!}?f-pXT(QSN_a6M{Yh5d?i?+`{2V)PsAxD&(7XqO%eB}D=n-0Ty;_IKrz&`G7 z!t=$^@yT!U@eccf@nJ037mgG6eQdYZb++O$3&w;Q&t5Fv7>4Z!V+xOjeIS3{Ip>3z z^AmbS&CjatB0sPXz&^y= zxpkHMaO@)D_l7Klsy$$;#_UGt5 z-ubF+$xY^*Jm^^G&^d0`a6Z4Cw7HG?i0whFS-apI>m5TvV+Sw)QfT~`V?1i{99P>f@Fwp+ zU!Mfq8e-!5+=n#aZR5v|`sA#!qdq-r+^Ema9y@B^+2cliK4k2uFNTa8)!O~J(Yw08 zGf?D;=b!Wb$#`e&zfpz2=S#yNq=YZ+YMdfbLn_}Xt5?8`@2b^i~?x@X`V5HRNexE9zv7WVgpaJ_p7 zu2-;)@)+maLl=+TgxBVL4S($nXYmXtE$#e^rcJ##|MIl**-OfQl;)HbFIh5smV;j) zhnJ%?fl1iJZvX|Hd@imhLBN^G#f^kwor8h=4PgebpuPEKyOe~kbAofsN|_`sqt}2_ zK&8-&ZioGANYSZw{#Po+IGM-nkZvf($@m}FflUzVJr#5kcs*}Du_58Y#!TK;j?jBrhm?@oJ1J31C3cctmyrOrg zN5jP3Kug&sMC2E6smFw7u!Q<4qU^VDVAOX&Kz19deNQY73oxf)NpZD2+d{{zuH{5 zX94F@E*6Dc*pE#j5*(!p*V!jrB09+;t1%Ba-mlDVzzbYE;LNQihb^Jj=5D9rAsIL@z?scO4j7`Juz?qv{iEj9D4&ad&*pH?4uw>6xX7Ew3`g=0z37;VXiWvZ;%MQr-`fH%@($aX zL8YxBot+u<67FE)QOI!Og@r1!RYe%e_* z$2_tZQEl#yxbSEU86Wc+qbAaYNa#gxEnUSMbsPqFt`phPRb1z;_)gy_@W>N`uqD=u z8TQjQD(>@9s6SND-O3<-h+bi=1UB#jyoF*W=oODhKCA(%rL~ptP7O|gxX90TGb4`| z8hsrXn+O>lFF0<t2arH&UWeH|C8q>dLFeH|B@q>dN(+YY#`Dbext z>cvM3qeEL^&U7m7^ikxtI_9Wd?&Za4pjXoxl|wIj16R@--q$+urVab^ZrQ1J{#Pn> z=1m*jP-m_Qbe&k|uIj)scRKDr?+)HB&r2PYSR4jw(%XQgyz_J_p@+#dJG2uPsAeMW zk?~(yaN^4h=w@>#-q!p7SSv@hJO%Q+!7d;^y&Lo9Oxmm5PYYXg`0Kpo?Z*uZ5zD91P>kGZ9`Q?6g6SB#&_uZ4zN z@~92Gu)~Kx+Q18keR%E$Uf}1}!YCWPfftfOC&uJ48+aj^ASQ~-X}<8s8+f6}hv#kJ zg;_rQ(FR^9@!`1}c%jsXqc`wEnGeTo;DzNr{P6}}sPy4^p^eNZ!~etHyTC_TT>azE z?q)Ze5FkLfDae9Q140N0NGyFxNPrL!A_PTC3nAH%NJwHX2qF*xD~cCTZ1GY-rAiQ# zTC7NGrB++SOHph~TWb+-C|bcQsKD=gX3lwbcCyPw`@Wy||Ni@YlINNE&Y3f3&YZbE z&(5g2B%W-yJDeg;DHNYG_v8(BjlSF3h@U#rxPXSQnNnT$^_ytL7sueCD< z9{?tFz{A(-f)?M!YiWNwkFQk=zxD)LI=)t8+L31{!V-JJ`(G_uz!_9zEi_q@$3uLQ zyMxd92y8)gEn55+oGI-QbWUf-Y3WyKwaNf{igixsG3|zT4uPb#AJha9kJLeir%f_@ z9H(stGSN1W-RUPIIu8I{JHO-YNRG6wo&oJ9cbwAV(iWG1S$p7}2=9Qmf_QZFJ6&3n zqZ1r0$B`zk{DC!1NOmuA?U|Uv7{ddwf}n zY&${U)vVqo_pnrjA0qen3SG9o;k%rq7XT)|j+@s>_zNC%c~__u5@|mRh?p253OY&j z;j4EZo=JRM&e06J&{ywrb@dc_m!RO(4~BgcTE0bLKC&}6cf;WER8xN3s!{cGc1Ov=+2Y6$N0vD9;OOqXC1HYo1~0=?C0rwp`Qiw}amJ5u zldFqIwH(?Dxx7muU7`0{+$VZ(2|8WmIC7#;1xg{Ffkb*sf*m|jMZZWzN7+Nqqodd> zd$4uyP0c38NX+R$srbAeRWExWYD?0%uAGE9KJ*CA*;F}uD(_-NNru(ZCFh{JNRW!^ z78@0Wr}_{o5{m5@9=&c|lnj-GbR$Z9RaU8V9OpaQj|5>E9(>S-YUfh|o+Bafp9^=o z$^wFe9%>wWyTOTyJmU9T{($9A@=#OJhvNJD!lkcsJ(r4;Y$mnQ1Do;Qg5p3)pr9-R zWSpPz{;=fAFJ|zGJ36_$6ft&v5F5y=ydU_enW`_MHG6k)9ONq*&65&r&;5LrmC3% z6K2;5;yO{8F^U4=cAX*vMtF{mVSZ!Zf zYWvDk+gH(QbG&y%sp+U?y2mUv9#^K@pZWy3Xo}-+?QPxOQ+kp)R}5@wtGvW5QX{oL-G?Psm7&#M;spOL@;d%Iyd)lKtQPA|<&D(PA1ihd z|6N{^+xF`k{6}{b)}Ka>a;>6d?(_QFC(tr)v!SFy-4Wpbg3+YYpL%JzQb_urdE02| zspD3I9O}BALGF-vy|;xXurrdXhQ-dQ3?m0g{q=A1wo!w+lhoWa8m7_Z|Gb5wKlx}a zMUB>cE4MCkhif!AYd&s^8m?h-N`qRt$n5;Pq(Etu+q@G~bsWYn7d72vg3Wp{HRj`y zT}qr_-N`AFZPqi!XiRj^MwxWF#Oz9llPl2wzbNbhNOSd3Q;X)C<|f8ClveP#h3Rg! zFx|aW{Ua?-cW?9D&g@b_YGao8TTy9WY(qe2Naj|NVtfeHB&CWX>_he|4Om_cYxxVEmMx+*kaU`A%ffKYm6<(%35YHF)5 z50})31`Qf8aA--{`I(vFf#;u}IkaTJfFWf=%1YpvF{q@tcyRHM%;NCClHSh93;JJK zT|29Pd2#LR>Z*Cwb<^ksfd21p-1yek>)-kD6K`+3?d>OTedpf$`wz?=c)jG+^iY z;`-`Z+5o?{K3wY1DG~{QgzUfLo{U3oF~J)c%mT}4~dJ9X6! zwIyMA8<2wbIAzn=QCD$Q80kq=*2pvopH_pzC2CA!r@p*4TvuLQSqgz_k%MM&IXx|| z%~*u8aoX3PMJlPE>(t^DjEd5^PI#_ymImi5>NpL?qIT@Bf%40$YiCcpDqLHQ{J9b` zF)^3)8EUA3@q}?sOtTPGgmtk(${X=V7GPP1^% ze|&WH0E;T4yZqZ-ygYmTZgWsWMRDyo$Z8l)Lie3v`Ue@jcH+eYeL>GE7P(eYe;mgmfr zZfdVvd11AV0>`Cv4c(S-PvECPH6f8VbhI=|7t!V`7e6ifQVx@}Lh#RJjMfmHDJfmE zZ}YB7xIOUW;7?NSY4y`omCoHl!_N?&o7qikU9sZPr0!Lw!5Y6sle}7U#~>6zUo+h^ z^em)2LI#yfEVTjZ!lMY9oJXZ~x8_1L*-WE8+%ogQG?Y#$(E-BNWqI;gtRS^cYu>nrAj`=6IFFk^7Wkp6Y^ z>T0X2>-#s<)%Isr{fmohOUluk;INX0x&0{SR2)207pIeomtyn2D{e;^kHu*S?MTJV zC?|~;S60@~s|nY^2h-4vtPT;LQ?(+dvLdF^C}1i&=Ba9sFjWr@riym!>Pt(*W#E9N zdTxnuLP`R5FqgKzp}wM0rvTcDYB*`0li+uf-1)C>n8)8S`4hi?tUvUn|Ezq!f1E$n zx7#W3CjnXJ?-0!KC;1u*{2dDYp+G@k+*p5yaT*B~`a66v(m*}F3k$p{u%YM_R(d@C z)Z{b3FyMQ8;bOl(;Ct9p5b(XS5L^Sk2Rz$MCjN=ugk~&0b3Fc5$xr%|0tLS77A;1a zz9pUla4PV33rtkcj)5`AM8NkMxSkd8-H2e%*cj4$2x(d*-++ZrTh7N2l9cQn)Y;$u zNq@^gu->;Fyjll*J3WiX`ddx(pM%sl0qPO({RQmXjD?-}r=E%tW@d`7@mxy|1ju6Cd)@OKF;^|!jv-*c?LJ+PL6QU3Ph{Vf-&J4(=( zQ~xN9*!TJZa{HRR!MFVW-voTS7i{x;0=~^&l6TjFnDXv`R7uIf_XED4FZh^> z^Bqw8TaNR$UxwrsL;Vv}N!_$SmDFe6ZAdGBslVewf1C0Cq)~n+;JXRwBIcJAbD*!q zHYjT@G>5YE&0Xwoa|0NVr4%mlw^;)B#}F1~N9t}9xQHC}l7^&xDkq3?C%;F>+gLH_$>zQV&7&TbhS;P{xR6cHsE{l>W^dC${wG` z-zGWubCs~~zN?kUpZK7|n~)4F<1KREef7tv5OCrR_uZgL3i#d!4pEW8B=~(-A}h*u zVZe98)v5*@hJXRzva5r`VifyVNVj#ew`Zq-@7VmszQqY(LW)+Rel?%CT??!&a^?S( zKk3sawHf-}U$7VnETpUld@B<^Ug}T!wZA12-9P_hD%Cp@DA9N4$1K%VeviK$5=E7K z_o~IdJNyL!X#Pj2Qg2*^;tBYM7x+6KQVoT!ac2cix3vi7m^HnHZ#61QlJ8wubE@yN z`EYX!f$Dv)=VLSu+x#Kbzhs*6mRb)5iPT|I45DBY*pa|DUF48SwV(2&MHR3&7LyJ#|%qzg56@#6eX60BcEJ ze1pFus$6uFoaFlh3>QrW>fA$D!BA0I{sv3)J#ZCjeZcn*Kbcx^nD2fB#;6(hC3yV) zuv7qIKrzl)SaxrpzpdcCqL|*|# z-ys@=?;S-iqwz@a8wxkxeR0sA6>hv0Vf=Z88*9~!>(4A{;X3+yOwp?sTTuZU6fPtA zNYEOEyKk`F0R8SJ&Gn1pbBuqy?ny*?6B!EI2_y3A7ix-Bjq~B^qv#{@t9gT>!0I54 zzhYcIHP~t%;M3pbGz;*#JLE+N`J70)W{A&et~Uzz8S+QdH`kk{Z>~3uH`klSo7;)T zo7;)To7XRmH?LnBZ(hGN9->FH%csAJh=IEcxo+6CDBoCGz#c#`@hp^kEc(1SeEusA zA9|@0i_fAsIPEPTi@pu`w>9i)80YM1(6=@0O6J3~$8uYf6X@tlL%MAZ`%%>&_+3tYogpbfpbr(B2ANYS6cs9G~wa08c? z?F`VHy{fb@l&*RO&T(j+gD#TO#0xd7@|(+UdMq>Wkp{jt4!*^}^9=eO25!p#0^_!v zuQG1SNy`Itk$$9%G@|dMhmZlBt{ygWT;gx)bH9O`@_)d%E&r#C+wx2Ow&g!vIj0!% zgxF1wJ?tj_+3co=DSwWEA7nStn|A)Sft%$>?IB%6Z`wnqft&VIY2c>b=%ZP>Y`x88 z+}7JcgU=`(Ro&$`9=1MHna1Xy#<D^`G5BY*n{ZS9e8$@W|BgXFj@|7oyvX3w z-=MEIaP@Tx`b zvh{zE>23YXn)SEUztm09zsxkmK1Kh6i+xhMLPH{!vz&yR{oq^!H`|A0j8lHi{!a8y z`8Dxh8}w#>x1DjKH}MY`CwW5briZjYl;2(k-U)uXD8D8?m2u)@wpaCW@MQ)rx+T7M z8@Oo?n+@D-HyXVZOSh9IzC8{uLrId;q|fGxW8;l+@a=JMJ^yVkPh~;$^R4uyWTg$w;U#wouAI;y&FH1IJ7zL{~m-fd;vu6OdI zaN^(B;M0ZOgq!vsWSkaF%-LCK9Q=+r_zQ7xS&Xsy4?%i#+4$vg@O$FmFB`Zyi_B&_ zB>pD8IS&4&fs3w4zTRwa#HT9(d{xK6^?HTQmq~xXpcfk9Q=43{BWXBQ#qRvdgde>-T?-yH`}O^L|aLp#;|(m42|aqv*f*nDm=@Usp6`{Up_ykti5 zoAf`AgLhRQ25UW=^d)idAIHJ}83#{GjpVDRA^+?+cxPT3Ao)%D@p15L;^4oGgCB^4 zcT*pwYCV|gPKtwH9|wOW4xY#ZbUR-c#KCLg;19&XUyFmcX&+nv*Tlhp83%tq4j$?d zn}0!Usc*5%d9u&cT__!DvP<8g2qS9)QG=>~tUz7FAi44lo% z#V2zZXG`Jd8uZfV3ZMHp>^uA9d|4cPg@x0vk?FcyKU_Ye7+-JU;~3v!;l+%V5(^E&%w9%SS4K0)wXnLg9v^A!7sS@;h2=Ue!T z>@TwLzpy`S;rFqBm4)BM{&jKihb+7ukDng5@C?SEws6U>$SZn~{O+;nh3-uYmweF~ zl&1a%a=J$>d04g|r+O;aL<1-KsT}Zq3t!2& z?3^L#7BN1@peO#Bj4w2B;{RjL=ZzLVgYnxfJcIFjEc^)b-)P~_F#ZJNBIjzx|6t)F z=N^L(wUfiy|Gq(Qj?a%8^pvmXSk4|iex~vwd??eMYvJn|AIdn%N&JW6pRN%GZjSRO zTYUb`d}dhmGA1y`|HNmI;*RxXgAe6*67#v;!e=u6puyjqFZ|Y^r~Gzj|4s{^$^P9I zzKQ*N`AK>p{yf~mHU?T?!p(U{C&oq3I2%Y^-7UN~`{|$%x`ci)`_HrR9qb=x;jMTc zGTFjsGX6sg-_Q6g#zp?^N(y|>Y2i|jWIitRH!}U>7X3QL|6<`=89!j*FEH+9xkwLG z?y^48&%$rxa?iK$O^pALagwte^QOlV3uiH$+YLNq(BE(I*WVd9&Laj+c6BBXaDHLn zB){8kTX+s9{E~qapX->6aB$NP5-fh6TR5Y zF#{+1={%qGayn8jm#{o^<|bW&%WsU@Gfw&sA$%|X=?Yo+Dh)e17QUJBVhjI(@p%T` zoiTcd{zRT%bG^Hb=?SNN?c;p?#K1`pt(pFQ11I|LCgFzbK?5gx*(K>022S*Jm>FG< z8#vLYG5_CNxY)xh7B2Slx`7k_51Icy11J6^TrU4IaH7vo#tqlU22S*1C&vt&=wD-c zZz9Etly8NUyMYt^`8=O*Yv9Dcf$7gOaH3zu^gRrm=*12*EL_GFgBd5gqH-_AldcgK zF5`rYE&Mf2?$lVg*ws=C|CH%hTe!pNZnSV&Uw*;D2QmEz7GA@+PwE-`qz4%XbY`6L z+k<7H$2k`L%WPNY8TdJ%3#RBu=NmZj7rWA1??n2Yis<6`&?|{Vh`6dF8W!9ICTBk!et!wxP|9wa)%DcqD%PP zsJ+es3zzolYsRIWd4v0%wp=d--_LkQ3qQp8*%mJ4l40S}E@fG`v?qBME_y3uobq)x z=ZPLawCE49{akL~R4&(Xxl|drX+KvPIMMHA`h^Bg^kP3ZS-9BG9R^N(vUq*%rv`4? zLz96MeG}7fGH{|7dwasbiM~CruRUqtM1Kd{=ZlPs-ei3Kwn0yP{=$6zW#Qjv{0j@e znQ?zIBI6SNGQR3$;nI%vweT7p-O0A_jf{sad#uVp^pxA1w4ms$7%#;>sOMT}o<;ga9$EL_H84_f#w%;ymc7d`xnak9^z zTD9u_oJHT3>&u@Eoa#jiPmum<;C+CvVfyzhT+%&a;nF@xKPKgS7xPKueui*LH_YjF zGH^;)^wZP8iT(v%P)s*)qL*>VAOk1*8+rY7sDTsxgDg*;g^T{jGA{a*apM#Vmv-Pv zgHLbppN@aJ)*3j;(}ovHn=E`3Z%<8NB{ zo1E?k7XC2fUt0J)#uK^U5dG|Dc{;?w2QV(>ehter+`uVc+nG;=fm6PAGJUOuA7^|K z<06l&C*EYx6aRzE|HlSS{C~`LwZ_8lNz)P5TX-?k|J=emG5#9^r*uQGce;LW;FRt@ zey{LH3xAmLJr-Wh^1NZ;^O*iC3m?ez3Eba`{$FLhrG+OkpEDR2eabp%Zwr@tF~-8L zR=IVYA6U5Pzt+O1vwl`u_*}*xweTB7pBBEB@i#1d3**?;Rb7&=r97_dW#P{-KH9<) zxE-#r@I1zsTliAOH(B^IjQ`QXWs{~u7GA^cm7m*7k-w4gt_I$Vbx)6T8JBjrFVmlI z;ADqA_&v~f4V>CZ={H9kIML5y`mqL1^kNT}7&y`Yoaw)B;6yL|?@R+H`Y)J%mVpz! ztYa*;@S8Yaw_3P-r-G>JBE8Z2b|(9ITA;>tgcmW+Y+QT_&OSGk3+Wq*x@uVepQ3*XBA6&Ajh{gS@eoA8lv!G+Iyi_d=c zZ@2Kn?B8MG(r)jvaG8(qvG8oJ*9R?J_((b;r|@w&p5VeKXyMYHge+Y6r(3x2mvEau zeYZrH;KIMqz|HqBQ!HHcKi$C1_Xy<{K1?U))EIad#^@pKE6GE6K8H0L^yd2fG7C>- z`V|IluB)%M@C5ctzA0UEy?4DqPj~|J-)!I^#^|xt!sY$qb_4Hj(C@HuZs&Iycn^bq zkA*+OVS5eyY=eHkg@@RG(7<~d^oK3{1IaMUMfx$@^Pq(fVqQ|F^gi3PpP?L1xM?Tj z3|!(8RBqsAxnFJIX8Eo)aI+k@7C@EDR70Ppe%2VcsUP$Gov9xg7Z86_KQb>Q+|b23W9Ga6=2E1of6+Stbj`!khd zd!Uk8(-f>X`I$yrLjfu&pEZq+wmy+C(VGVuN|)s9EqnB~LK#)n_2G=s<0to1NjWvO z*wd%1xzMsnQkmMs#}q{P^X@{t$&slH>`)Ts7~%41Wwph##Y^VY%!cf3f{eU~E~C>l zwiG%6ZPeyZY#j>Gz7MF6CwLze0O{LixQTruv>e#X* z1D01`JOj^pv+3EhG-E)P({pYHZg37ICvI?_Pfpz6970aq;2ca&+~6EUPTb%;kDR!{ zIgp&{Hedib2SB)L+Hs0f9snC^X1vC`kl=^r%GPmYm(t2p_W zBYSM#wm&IO{@3#a(ab+Bwb}W9CQkbDorR2d^eE3;)H+U=bFdX7l?rzI0ReOiA9 zi)Qt2om6V**Szesia=*$L|;Bx$0{V|xF~(HB|H6aobq4C30W4BzF6^EK$dI=L_1~OxHAa zwPhmGnoD(rxm=Ey|9Uc3T!Zw(z1wLWh?D>QQ*{*6{>g2pPwzP?{{!6= zv|~M|A2o(W5UbODj^X%Lbmv8m|2=auV8j>tyg2sj{6JHLxEx4-G=H$=C%?#~W9WM_ zEpp+K@1L}8*&x_k7f@5)x>5I5++KajVSZZ>Xar{Org5+N~UKFSP>{_BJLL8s;M|DBs zOT8M&=?g!326MIRMTx)xmN-s!ob(Sa)e+3}$)tsyr2iw-A3N_9bI({EKgjim((Q|X zJAVHGSt0YvG(6g^??VO+QX%IL7%)(iOix}ka@;7dCz2zN^SBf7>GbIyq=t{LZ1v2> zNl6~(==>*}KEK4%^yvg|(@~$Z@-v@j1AWJx@@bxag&^#r}ZAj)?ZJY4Elx!p*(Z%U9o63Q*D{22*B+v#Uu+hVNWbD=j)z1$}0;#{<5 z7i%w4-K@%>AQD;s_LV0J5!lI54Xw-=A_4k0qsb9~UFR!$)u2a(4OBRPIAw(NQ#gN! zW8moum)aT$I9uVgiWGf?74G(8Zs1sjt8#QPah(31n$7h?yiR{l&E|U0e46V)gbg-+~8AF=v6i(@`V*IBDPU#jiey@QOz3hFonQ_tcRQCVYqW_rv zuUI%O%+U3^ez@`+W&fM}wC(MXML&V%{Mx`te#sXW64WJnlX7ff;6(oq_O~{0%CD3o z?R80)l*`#%AI>sxvm9kl2cfTEdfk6T>V=e}yz>zHN0{E+Yk~Mb$mxycr|2g{!r_{1 z$rE7zbPMmse%Uip^h0wex~{b7m$F~J@fG?z7}v3yw@Y?ADg6TJoGy`H`y%6N!KJ;H zc9_07GTYm1j!3xKzDao!ACrDWoOVn;H;MkpCi?rC6Mvr4?4uLon}!oljbaeG^DO-- zio|a=3$s5RImItOVt*SUUtZAHFR?#>P@g`ij~>+L4(dY(^@)S}xIul^pg(Ac@hQWA zf9ppKG(L!oHpF@yXEk>ovUi(=fIRA=F$7`Ke@S4rIIJhe`B4|O_a}-kb}o_Z_>&M| zV?-NdBVNxDY3xGzlzJrNqicZ0O8*&-C-sKC&C zP~0ZnCK1#GW6-|Em}O?pW{xl8Ibmb7{U-uq>2D~vKcW{Zzqa_7_)@QS1B)epP%XV; zwZan2rhO?+`tn;OGkp@tPM^kuRuZ6coJO9CFXKQ;m&(eHAFi#fuFWXPsO}$9*U8=i z4$K;mrC$P``a8fKmy<;L%2tnT>>J~uZ+5Q;7ByZL?B2QUd#x9@4SJGV1Q#Su>Nd}J z#d-|Up~4jyf2|B%T7H<`*WrEJ26|Gw_gXhjq`2=Lf20=iZV39Fm%F{}iHh@B2Q##EbWiKK0(Qhu_&k@B8rnu+LsR-@rS)Pw);9Vy=41>s;~J#kXJf%O0I; z@$L`r6Wh~L_$r9L1!`S^eQY+2z8ho?D*o`xPiosf(7mLnj0_K~CWpHc5F zDUC*N$K{j`$+W+fvvQR;xV+9Ad|u?74mn9ik0n!&KIx{O7cQxtS5r@C;8vG~X3)36pt_==0tc&xibG`$m6aNeM9FEu zd7oAF6%dA^(I>-@Fde6yhH^&cuKN#k*Du_}BvF*#GJJmMRTO=grHOP zaWrX)UPnZekls#S4wJ(5^`t@)ANJ5t*#K*T4bBW#MHk!1+`>4;MmA3$ER!Z2O-32k zXAYAg)mK-C>Sm)_5T%y5zS^K9GsY>dC#ZydLu9nB4U({tNF@!mbKH7c*HBYat&UHQ zNJ3{NM^$cBuH8JX-64i$Z@Kq0OdmsIH-;JcK$BhRx&6PjO{vR(Kvn zRrQSHkCFOaTQP^)1Z0Cv3bcj}SX*wpP)v!SU5LnDhN)2Xl~B@*c_=B=E%m-Cl1p-( zsJu1hgc>SV%1%X92Iq*tsz8 zl-o~58mqcT*^Q!#--fDS$X=zYdo4=eZ6i#}S7f-INDqZ0sr?yW9U_N5@|a4c3eKIYKrUXaQZkJkK(Fx>d`ER!n14Y=P~7I92ZOFtBo#- zzO))Gp6cSro>ax+_9s;8_A#z(Za*j;WZzIYV`c_4Tvrao^f#o%3dM{HI-nKJfX@6$ zOTBO`iXv_eRG~#U5jHft0__KWR)fURMWW3_R>^!gb#1f7RiTl&dC)i2EEV_E(xDU@DaRXHz2_Cf9K$lMV1 zmu_%x&7m+>3ECx2O8oW(PF$$nM)PFnhD4Wv$|;FWd?Fb)6=Sf{IUHG8S%G0qNyu%+ zn=5Jjm`O!C9Gz1PElsY9XQrgy(uz77$YF?w(jmaL52Kqp?S@y`25u*8YR2YH!uN); zM>|o?U!hQr;$dji7?kUrsTiZ))!~?O{DjJ7Q8;3xIoeR1%yvtX`Zt(N?xew|nmZz# zTqUiiA)peRLMOVz03&lKveF9t1`i|h%9+;4oN`PNzja2)C{Ce}G}$*9#p{@psxfJx zR+EPaq0$D`x$szv#~8)RK6MOgK=g2etc99<)ibN1K}G$%5K11?03ImI2NyajS7jRI zQgy~}54qpx;fX}klDU%v# z661H23UoWCqFRsc>!?+)#1AjkIGYE$7@VQA)fuPziJE~)lg7cks6Zlv*0|G6O?=Xx zOOst}76zNaYz*j%q2LR1a%Cv0iF0Vor$?0pV8%hi2b#pe8ODI2)X{__DcZv-jC1rr zv6RXi4Jh@n6Gkx=*fmtms;a)SDpaCpeQ{XTg)u&-IUx-@n6|E=q8`H#jECsG21cXq zsI#Q90%gf*V3am-{AeX3#;S8FN+AU7feMvGRTGwQgjUB5m4s{SBQ`3T!&J3;wu-9B zFqOqro=OB$Xf>)Pw#CtNW||^1{|ODXA(dH|dpNzWH;lSJbxAbG(S{BA>cTXOuOfXZ zF?ESBAJVSHM`{Ls9??$D;Z9m1=UenCh1QThkOh`u&7d~R)*Mso0sr6W-iM`Xt~r1 zQT!AlW}qsFVio7=?Wo>dH~4PErNp&fRnk$#1p}NF9nS7NPOQ zl4})GQLVpP$7i*iBx2pHikce4>mRBNm(kFWY)!3)#H*R;X3#{UrX&6SG$=9rQI$I1 zt@G${>Z?ntE7hozB!so#%j5pDi|2-B&@w@BZAG{)ZaIz*UpYx9SX5Cm3rm70Q6&?H zFc;F)YRpc3lO&kK0`;u7#7vh9pR$i~*b4Dm3e=z;x;jk&!)VQ!S)dg=oF1wqIpWR5wWjFNj59_8qPk_>*Z9-wBXI^!4{Q2pLW<8c7JR?s=4)j=jx zqZfBBL0`OM9lAl7P$=t{Hg19P5nN0*rMXAOV0v*elKezH8s+u4%IfM_b-V&fqck4Q z$Oy!cC3Wokks;yqG#vIKZZ^~*MCOJqQ5s0l$$eA)YGYhk@6E78=WL1-S@BjY3oj9(4?xcxiR9L+vLY{x|dQNEtO;M>aQgzm~ZcfH#Bg(@I zHJa`k{LF+gS*SqU9B<9d;C=E1I)k{1UIv^3Q?y5?L>GCl5zSOjP|XZsPoQv>vYKd0 zSDQj?s+=a9%Jkd?Ra&@ET&f!I30tj1n&iG4il`&Kx}uaOb|_aj`U&XkP>a~&R-~#zpZZ2$ZS_!5=$n`X0F5HX;Cf33V+X?KbFU{CcYa(jXOFukx;er~a z4UJa(sL7pKRdE%J6spL>`)s=TDESFzY01w7GvM@}OCVmTA!VXcne0>tV$-K2PG zsK*f1C914Tb(;*H@E&zwu?dj|}EQM=K+Y5h^5unD;u*FxqXZL~s6rW-o?SO6<9(#%;g^60aO zNE0ct#GPPpwnjAQWj^;6vl5$zEhIOH ziiS$`LXf1g5_lzz1EW+!N$NT!T-5lgv|>($YKf5#TFmWB8pE4(c-6ZK{hB*k@@O_J z41K19?@Mabm^nfp*JMVFn{dgfF_ZF9Y7v#I>TZNcnXCGxljX+3AR2+0O&KQ0C#=`G zITwx`H*QSys|A&u5fVQ+gD4lBFJ6-spE$YPc;D5~IE)NK=G{)NA~ik_LN8&g({rn; zspx*9Rw*|>2Y&-Ip;XC>)|&gx4pvDWgX&Zo)jDd_R5M3%=M;_+<8T-IF)KEB=9U+u z8bFAXOIkQ#+@+9}Y%?-viW+E=5n|{)yFz`N1N$Z!ctVA0g#ivH&8$wM#|yZrR?FY8 zSXp3pa*HNT%bPf2G)sd@R$EoQ4~ zM9vM-_hvNoM!hAQRO21h+0xq?Gqze4;|2_`ZB$zarKsOO=c$gDbZJx<9(zgq#I;A0 z()~nbG;(~=#0iB|K)KXjqNB&$q?ul*TZ>R)7OcL9(Tc014 z8DaFDiiqlm+GaDF7|EgwIrTWk&?s6vuh|Q?^bn}|3spx(p-D;{x%jZ^5GMY%^kdGHfu3gGv3|m{o{2(U{I%ute z76;5oW7KDkt}TVqM{)_8M%OzkN?g^Me96pW7y}CV!aRBnO!pJzfBeWIP>piG(?q3* z0ib|sz0J{~lm@R=&`KdUoHNzeG?-ao4uRD}S~ZcOr;av))*EP$sy|uOETc)(dV}iV zDl71<8)nS9q@$9L5b2IhH9hzVdo}HNUI+{nTZ4IOD65o0ENfJEfxLaJG`-l}?hYCyFP%d6|^X)4JP zdGyB3mivuhc{P>)o+CN2OAsT*|H&4s}oi&da3Aae}_tp!&D< z%?3~Cf1VQJM0IoG7|c!c1`MHLM8tif7?bjIXf}jLzX2z#_ECho8&u^&#*B|rspgLY1QLIsZSn1cKn1( z#)ovjlsh4BWGKB?=AbFPonCcL=zCtP4g5y~|IxsIH1Hn{ z{O{6$y``#1C%+lS{;1-VZGk-QhD$=+Z0B1c{7Buv=Xy`~o{=ZvyPM+l78#jVqI%r?CaE?1+Mme8m|_t5njWeckB7KC+Tl z-w33`BKLSD*_TPMwX8TJX_YijtE72aC6QFL%T7zwevk>hPUaeMA9m9(6sM$seQL!S zax+$Vs)^+riHW-?l9)J4U1(A{JL_HOq={uS>5XobveoR2Xt7MR7_p8r$ymfX$~d0; zu(i03LpJjhmMG3hS~DfB{VtX4N98h(yG?ITY=o<~%T0*8W3NAY$6kAjUOS$jHq{-D z( zZ{MKRo#N)(cIXXy6Xgt0#~BI=Pc@Nw{!AOxx_bqB{!E(+x*N)P_K?@X5Bv3H#2ewI zh(QVQjPMdE@B9G1dCKo33qc-2J+sN@Y4k;+HTo!;>8IVCO#c;8Y_IiEvXNw#TK*-9 zUnG37kK(s5w|Ggx2Eo??yIe%WlQE~|rJ!#0L)?568uX}#KcOW-t*^$7F7E{jPISf8 z@He>suichC^?q-C(>ejSdyI znz*{wQLjX%mC&y(h_AuV2#K&UK-!BJFTv;^Z<=E41-%k>;UG95xv6F5}z;_RM z_RU@FZx`_0PYlNSTNL_}mip7iQPh`J)JGB_bHJC1U|$_J>FoyoNd^A2z*2upI8y^- z{b!G-NQm()Vqk~f-y{}zd!~BR)&6y)l~~t8RsM&L+hK2!y{KJvqC<8noOTR~zMfLJ zSY;$^i^64x%m}_s;ch$b20Ws0w^woT4GM4G1^!IoyrGs$?Ko={PPHQXx=Z10qCxoR zys_wAKsCwx3Rm5M2Kc^9;cma`hCQorw?lPta{T-D=54Mw&A++cG~Qfq8gH&QjW^eu z#(Co{@)(ydhMiEb&)pd{Li{eAZFT3XKxx00DLkT2!Be2mwvhpfZpT1NdxOQ2awOonIaNIUciMfvGCoD&$aMlj5k_%JFXndEPM##D=hpH#`jqGbG!%NUJGBr_D{!9z6WdBeL zznlHp7XBOd=Uez2>@T$NL>_uHTKFigU&}1q&-e-pf02g_t1bL`#@AZ-4;f!?;T;&? zY~j1OA>3-=4>G>p!o!U3u<+50@3QbdjPJ4V7L4z;@VB{r+i&4bj32b{<&4YFMC_q$ zinfm+mxJJ0jHg<79pjxW{AY}ZEPOBH=@uT~4WTnFydUF3Eqo&5*%p2in;2Xy%ObYw(u7j-)iB@8Q*TEBr{Dfeo|Q!V^<#yeT~7REys{&&XrTKKEnKkm2iaf~0f@MIZ0 zGCz@1TP;?&ES!gFPO61p$PqeOcn#wr3*W?ex`pp$Jk!EcxxF1~;gcB8w(vjjlri7J zS2A8`;lmi8V&O6cnQq~~!)k7M{xZG7Eo(2Y@Rqd-yncp~FFEc{WP`tP#vm5lGP@Cl6XweU`i z@3-)O@Z{;Bh2O*YVGCa+_Rr&AvHvT$9Sd6cJ&dPX__K_6vha@?4_Ww`t+oEsEj)+u zObah#e5i&0jPYy>f0^-o3m?D}i$V*Z$M_Tr-^%!O3;&97IgeWO){mD)YApIv#^+l2 zU5qzc_-`3sX5j(aXd2fF3(sYIwS_k_zShE@WPH7adw7XrvxVm|zSY97WqiAZ?_hj~ zh4F3H`b>-dI;J0L;U6-6wuNtG`g{vN<7^EST6k7p4NS4{ z=}bS}!vE4!1LYR}Ak)`axVM)E=34k)n7+}%)0uvmg>Phqt+4P{7+-DShZ$dQ;YT># z%@#hC^R?B&+cCb~!dHYeaM;3Mk$D#P!_p44VEUkiA7Fav&xO7x(|5Ay%UPa~gY;QFd{tDaeTnoR9>Fs&< zs(xC|WfuL|b2Prf!sjr)+QOH8N7Jvh@ZU54^%lN~={H+=d)CiZ3x9{{w_A86)9qG4DFqccJg4#c)4bx{^cq_J(d<(yw>8DuuGmMv8_-BmIwea37Poss8 zm-foS$1(j13$JJT)fRr3@wFDdgYoqio-1}};qS8^wp(~A+w(39FJ=6&g>Mb%atZqM zQ|#d*#yeT~8QnEqx`qFM@u3!e3*-3~{s7}sEd2M3ms|LCY|nEo{2JE7G7DeN_zDaE zi1o1A!bfmDU2EZYFdo#|R{eM?yXi4L4t|Y+^N>yujXL^Uj#UAwg_{e)S!iheW>qDwV{~G({b3UQJn(0Fpz5YJH_$Uu|H~=2!C1ubmt}47Dl8$zn!vH$M70UH0*!M)7w)HZ${0Kb^*T+_m&|mwkd^T@^Ojt*S4JQWSnm z9A+R~K27bE79Cz)qQ7SQCdU>IQ0Eq^+W>WXA#SA^0|q!f=VlB*GS&2J&kTq=0A33D zcO7K-BiI`^0b*L}xu;xvpjaahj;%TMk5iQ-GWlxTMRdl6t` zM7w{Cjv@7s>M7+@+6k%u`M_eOKUYUrU)r)$J?yk{f!Y`mb}CThZaYBf`|)q5PxU)i z`kQrh_j?%jHcN}@f2{QLIenSWQTmB7(*F~uKTs0j=cgnTuA%+)Q|=5anF)Iy|Ag5# zlsSMx9p|uR7?OV->NvlLBbNNBJkVLzN>h^j$@rJ}Qht@dVx^zXhO^!hOyX;z{}Nx)uS4RZ6CFd}cYRks|74|a(^dh9mHwU?I)0ENQ2L|_JADea zc~Z=u4X1nLY-8KW5r*Rtz#^;0xhr86+kTc_m=4RdpQ3jKlOvQ{4~9_c~Z>8 z5p;K)Y;}*^Y+9O*#!7!H6)dh5`r%OewB&22Pi8_qrJaCNU86aDS;r7u(w8SK+s2CD zKTpTFSR(RM;>mL`9O5=fujTkAMsAz7l;e9X!etzPx`j*r1*Y*@EdAw|Yl?g(B>j=i zOMJ0^dcSAOL{av0`tMkQme&~%AXfS-Vx&)VE<6335#P=`rN3(w-61pEAEisLlI-|1 zOJ*Aag#RG^ z6Y(FwzaRez`1j%8i+>OPolSI(N%+HctBOQR~gYHzYL_>Hrjm2cwzEuXW}>(w;J7dcJGaZaU5Bgq;3 z-g((s|C*GYwZBF76Yrm&o%Lb6>?c0DBs=TCceAq&em^_wgW=g(ho)s`_5Nx3?w9Z% zOxk|gCj5`-TJwv4;Xi4?^j|!T|B9}2f6?l!xxes)zJ8^LH~ZFfPs)bpJZ&}x!#<(=DfbpD7Yl>bVy1Jd*H-;phNn!c{~HhnqM*K~MV0_gm(i$K%S z+=yLNBsed>|IwmHabD;KvWwxK$-MTx6eBhtt3oiesH|c;E=a@F(oY3BH_*ZuGB^_9du=jATD$Y=SKG~PF z{5fyZ^0Do+hxYYkX9fMvq2-U+}hEz6m_1Uz`2)HJ!fnyE3DK8s5 z$pz1Ok_z^Ff(0oTUsBL-$R!1>(k?0J?{qFO_4<%EkhLKY$ZARsWUX%%$lBO8khQ5p zAnV~X0$GosT*zkbzt3;fTU{oEXQR&k;!)?wCqZY+FM9-5K92uRD8E=`SLf|~V3oJC zF1r!Vp?L#W-#Hv*mu{5Z^(e37X4!QQtXu=XS#~#|+}=BdvYUZAKxKz9O%HVY0$`;@=t|i*6Lko8ItEfC&upn>u zESwu$0Dmj^A3<2(ipvjI&#OM1jOUAOUcBu_Ps^Pjey?!%rZ(eu!X|dU=xLmoQ9gU< zEuba3acy3>Z5Q~w1ph~%dkMVWZ&R?dbw$i?)rs4PA~ zoAoK$tj};JGWn^G!w-iJG@okPDvy3bu+KD4*rY4hCW=|j<0z1;iw=<}od zQsUcD@yzx)gZIPkF-}SY?aFSRGY^bFSv+@V&J)i$&fuM>W7mV<*zTjU(AN}<=^n@$ zGpl^)4Zz00Ux74sf_9qUxx#bocoET?v9NNB}Xahr@bIy7m?O}FT-}oJ98>e^mkALCV6q{;hZW_d;DekI(LU=J@>!M}lwH@lLmHeE z@*vu@Zk~1r(C-zMd(+TY1rN-Co5~FB-}9G4->@r1*8=_1IP^~_d(}UU<^GA<6zSg& zPa6SUl8&EM=Vh;1>>MInC4N{lOk4K;{9Bu51Xf-?!dZF17u*oKcG0F0H!a%K`xUa^wTlVpSTQ7%P72X!h3y_Cd zp5XJ@=<~Xx&zr@4UWog=ZXU!(JNg1_h0Y>BJk0}}h@3_Ki`{umThGou@&)SMKGeTA zF?M(hV~MwYfeoMg66uU`Wy^bEuUelSLDvCvy54MeoI#)RS>cDL<)F=cM&(`8rhyhV zVuhm|(vC0DM*vu24c7G)Fk=OKv)Qu&&z5nsC<6Hh2a1Ir7`C-18 zw&Tl1w|;>31ASSa_woNwz*%{tC;QP4Q6^P~rVXv`l|6I?o-6U(l;j+02M(1lhkKA`keQ{>p9q2fhV|pJ#0GirT<^*pjB)9l`57I8%lEa@^PGQreTNSFoIX^>-JbUh zXv}bmR%becul!=+?)8^HzLjjIH}aN@=bTR#?CxFh_|^jWFPk;z@Z^d)htE3`?E}If z!^+N`la^CD-H{I2{F}ZrP>(vJ9<^8Hv9_Nxm}u{w_4rnz?|}Fcw`1onD(;)mH_hMn zasPprkAsQl8$OSkr%}01KNt25Tipv{meOeO*dp@Hw7`S=#9A%#?~A1`#FzM ze2Pa;vITOJzRP`DZ=^HA4tLC^xu4dfn%|NxJGr_fU2C0_?x_r@ET~MVY^aQ=tf}^4`=W`r6cc3(J94i>@M*l z`rI2LjPxF9FB-u=mOgj%_`j*o?VYq<;@R%@jyjxlxu}J6=xNj!(@yuI4nBr*_9T$) z>#BlOM{0{NUWBvb-eN&rA z?H={-Was3kwv4cE(w@b#_w88AA)Qfw7|Y(bV@-#`rF`x~-|`9UUzd?y8#3E$vwfcK zbp~O{Esf}P`JIG5(HTr-N@Y1?ailEQ21Le4-EtHbUANW-W0xh?G9DAVpr_eZEyEat z+9v#~w(4`}xz6iZIX@Bo9mWsTCoMYDIkako?tiX%@puu9xy?8S9?C|4lYOKBL*A>%EH=>%eImdnTQA#*3bjvasR)*prIy3D@(mQ^z|mjrG9 ziDUmyhoWy$S2jO~#d$L9c;JwKFWmHAh^}}~^v~)NzU);G;X}`O7a1U3_EV$Z{QlPg z1A84_8hHC>mnJ>?$Y^ri@#-z%lzIA18%78GA!lx+sl(C_5Wk5o?{+( ztk=&k|M0U7E#J9hTgm*aGah+m@;6WU|5i-149PuZ-`6jFxiGVM$fB;7tb2FlWe-)2 zezorh?VkMXf|-xDz2wP%UO2VSC+ECa`as`LE_?Fa2fp0${pTk9dSLgT{e9J!?_Kt8 z+cQQFY5U5%_k1_;+KbP8qhRBGUq4@b_p=WlKi1;QQGGrg*5Qs_g)g4>=na3U`(o_c zRxf|j_L821`+s&*qc7{6hi?A#)hP{W2fw)~oZFn;Q>} zzUBOFlb@V@PVtT5*PdPU#~By&Oq%e*x|V~_JN(*bWygDW>Gi9v7vJ)`-E$uJ>!j8< zeD#NsL!M|V*>dQa=j)d5dU?l#cib`S;CH^i`mtAUc%t*>ReyW-uY<05@`E!9d(^!7 zLgk#Vt6pk7zGL}||6DfdSN$fRdBJ%Lo*MPwte_!vqy@P+d@a*0j@6G7`r?f|l%5Lkj;FilT+qiUt z|IGVaWL=)T@h9J#vUla^;g??fZQ_%x#e=^)EvmtC(UU9g>T|_}7k_{F z{Ia)?%&)9JyRNaqd23D2N6$@a$b0qrStG_=|JWM`HnvWDdicoI6#vG3V^+_&xcx7E zYtP$w@9?dwezUUe&wh7boAuki(`VSug?%6Nyw$Yst98Rxyztti*Svb;)zyDaZ+Kme*WR`z<=!{$UU232oZsd>+iPR-Pdn`>7(TkwzP#oA-|YF<7yfom>c&m` zF8((0N!Zq@pWX3r+Py^|_WVUvuYnhCeYUJ58+nBthwaqYrX$@=jd(? zzYpiU`s&|ae(t>sI{)nE<)eqMJvieFivP;OW#wJo>^Uqyv%_V#ymsVx*Z1z-^Ujvh zA60$v`0Dhss*%^cyQ1wQgZ}Z?eFx8m=@+y9Hd+_mkedyhS~cz4#Ibq8-B_wH`RMBjmxSRZj+$a;p`8AK^v5RhViNmML zm`6lV#Uydc7y8&mSAL8oA9Vvd8Dq(0ITI#0ZEjt(Mtt>*LK}_jR4pCcfb8UST=_y! zatT6?>OSo9$mWo7{6rLSN*W%g%#F?to6Azh*YcA#=@qxI@jAC~Xyjq@S;s*V=M*yV z8b{g7Pi)I9PWiCjLOc!U33thIAoe@1viLlfzo3Z@*AmnoSzBmWD&{T0snjUAG zI3vk_U!0Opk2AHoM3_te<)jtJseBcAOM zFky{&UX6f(HR3rf>7+~su>)0DoU8CAhc2|k8`-%z0_m{G-8Nte*~kv`99!7AgP#e` zC!UK=sy|^Q4K#Ky7iWZb`7<$iPdsJb(>XRe3vsS>p_!7*Ah+L?-*_=i{O)b4%cV%1 z z8U+=FRuEKtC02X{s(sMXil_zODs8Q$t+llEsX@`=qfd(p3M%qHXXc#UxpVKDV4wa! zzyI&^U&!v6@0>Yv=FFLw-Mc%ZVcfl>x(<`Oh3PaGJAVt)eOzqJ7N)~4cEJ{=2fNtV zElj7o*o9k|9_C`>wlK}#m(}*+dCgIKi$M zB1~x<&o>1y;4wLt;@UBTW+^#tl9^04yOmtMnaBq{h!gU)ZS{&-JuYxN`VW@QNwu3G zPfELo2u^}6h3Q?C1r8CdM3+)A&t%wG>6)f8+FECCT`u8bDkrhjmblU%{Y zOnQQ=q6N2E(}g6^lTsTkrOlx?KT1kXw3Hey1Yb?-&83J^y5_Yx0s6K{6~?ioa*{Ys zeEUSKEqN@5i!w%R478QTFP>#Ik#5;yW1JtaAI@o;Nk)d)==kx*!a3af2g2(f za5|iVG0lTJ4j4=yC4TI>nC59F@|li*CeyN9lC6#9D zFzE?)AE|nROWG@Vm@9ZTlb+xbCOyGXFG=`moaqX_lu4Ebx5!L-g3S+0eQnHRktOCZ zS?=aFpDVA~gNSl3rpBf&YTCk@O>zYlu~CS8*g_=BK7(x% zhfz{!f=qgX=SK@}^Cyse5;)ftj4vEU9A?X6Kg}a9)oM9ZNGLco%dGMsqTGuqo7GwB zCgH@sNmw0DBA-dP+(el9aH2elhZ;ZgB-|^xDcjDa&0!~6v3A!78vyzZS0f_)6sx0n zRfQb#1QoTgB)0=9VuY`Lve~<#<88YSKY}2U3DYz?#?3iropd#UE!`MwkZ__YN%2(5hTzLL1 z1)kJ0`MPJ1SLkWs>vRPLl58c?TNt4zHBLc&=n7mpM2__!d=(mxQV*&ja*YSABXW}m zwGjD)2l1-;&pS#c<%l5MY`rX3dE5dsO2Q42fMN_A4Vi=fNbmxtO8aNNti^aEv6eb^y+S&3~t+j7hj4A&>@3qgWPhts6H0cGw*a zUl}@TtKFc!)ourGzu*v(2?^tX6L$6`K@JLvj{`vo2`Cpnm`sPbKCrl1q9i&A0XzA^ z3QXGWzgduL7uYK}4T+=-OKusQfV&8XK|rzt0#Ftz*A;W(KuQ8QVyfB~xLXP&OK?=4 z-8->93ArGlhZclB5jIqqnxeKPh80R>I@A?ndbx}art6&oV#f9q@RhSQ1TK9Yx%Y6t zZcsc7_t(nc>5O|AhuxizrPc%7osVU3U|%aMCE4m4oSSf2!W_tG5X8&E4@O3`!dW>2 zFJ~uMv*DxCA>NkA>Drda=a8x7hRb7nV#Y%~NCD@%S<6kAhs97?i1X0+o?SCcCU-~Y z;cmI4v`o}nSrRKJ3u963Y^Cqr6M7~?4UO=0!hNB!PIIVErIe9Wr!p`~vyFqc8SO|* z>|rhfEU>F1bs5mWrU4K)4^BzK!7e9w1)T7( z*2|%#LnwryP=}6qxe@*Xy#iW#d>db;56W{`IQIY|lfu`fK#HHhU!aGcW-lNrjc{H8 zT5>yalKT*H7wFvoqj7%rP9fi~zlASJ#KY%kBFvOIT{=M;HPmFI5q++Ch~ z$a9)J_mt;e^4wdV`^a-&dG06A{pA^(r4R$;d7wNGlIOwle3m?)Ezd*bIbEL5k>{cE ze6BnXljrl~IYXX@%X6kYXUTK6Jdcp)9C;oo&!glS#~xTNQJ&A2=P~k(qlpk><@rK+ z#<2(5tvu(+^LTllAkP!!d6GO&mggz*e6c*|%d^^4uRzk%!!G|Al4iYSiG4;Ps zhC$dW`U_m3dx9fy3F>8G80a-HJa(1jtmmK$QDg~r5sEBAW<}1#t}Tiz_E3$~l1VZ} zrCat=9LS)+^?z_Plq8J#-v@1io8g22z$Jx_SHgudy*BBF)JVsd#aTv12RY}29YO`ivFGY2!Q=iAual6 zC@NK&4tZq%o&*N==v1Wp!=F47L04-rl7Tx=R2WG-0(W2o2um7+Ylq`3&ke5o2*x)r z_$1k6%Y6l{gAh&e!5**~)Gfh2ve0^{_31%STNp;8|J&_O51wJ3zW*XsLYl$?q!QziU^ zCD{?~iy{cVBjCYUgG#7$w^W=JsKj5ITsUh}PSzb3A`z(=c3lWxjU^X4fzre9Cy&61 zNEbR88T)0V3w?!78&)a7IlhjJJ%zF7y0Nx}Vb8-(qi8Q$SlE+z;W+3X^l-pJ>0Z1N z=Y=gPe#jjOoS}3PS=(Iaw}3aa6(3pMUdqTyw{JNTXj7KE353Xnrend{pJ1bX=gD#b zfrdU0oK~V(w)3oF8F&$U4$n?6qn*0Sm{+iW@M2y?3wgnI#KMvu~6Ym*#w}3bBv0-LMHbr>T=2Mg)f!ad*REBiZ;{Fja|`e zpfS!2;JFAY-E6lr1GiC3WJOA)U8CSzKxCBlhEdiVM%f@s;ThpBqm=g=?t70B-eg$m z?%1Wm&dPH_wI;NzD178-E&eOakFqd)go$HJh%OYB$V3_wgPF)=Vk{H+Oq4KD4#Z&0 zq7H~5y|FK$L-o2vpdfa>>DFwxTnhanTxLVZ2$vEtHe6FkCZyRD)aT)7XCg$ZuA$!js9Y|(O;#=;V1@=z}qrwFZ^Fd z{NIfDcZ~Q}BmR&P|E>}Lo-Bsjc0Vw@@_nhk*Eaty#d+Z)GJX`gAs_izj8ClOXtx~w z-Cc4ty5r~wSM>2k^tWQ=eK0LRUj!#a&jgo5Kdq1UMK$cBuN6TrA%>V5~05t@X;fSFw#YPW@sS^B$J&lluc4?~{9EyqkMo zMD9=d<^Fq?E_07mFBL=t-m^O@2a^m#4nm{i0|zlVI9u5`4q{_62FKa*PNF1mJ9HAW z0(Zcf1~j~Fp%jtBVzHd0sNsGVwnvxG=#udEVK9g5HimO@va)k4=a0_Jtj-=iIy1L2D{IvJ zQS&Q-n3q#oQ8BV&RAxnWcI7!@@|fXQ*EcL0UQ^MqxPHks^~=g|j|FYph<@DD@X^x=PST#?>yVs&3LaP~g(WGT2Q`1DDla zTMhDSS7;anqSCG~(p6Md)iy$HRMcq+0gOtCSY(! zlP8rF&MKQYwJ3jbaoHs^E}0yK%`Pl7F<5M|41A?*^27--qt4Ivi^?83$}b89PMk2& zPoPf}3iOGR0;f!Xi?2-ISSi*wR!S}@_7xjDO3I8Kg#uyqN#4G3v&Rmj?N^^ym>WE5Q|!g;{(%i_GQQS$yg< zGMDI@bK_+e-xBXry>5Ce#kW-?%8wC037TPy`aw8`*(LX+$$lv&LzI825#N$*M67fZ z3TMojGIdsdtaNT%jQqT~DHBHJm<_^^TZ;AJjKfc(%?W#DC8>8N39Ln^I^J%ZH%ox?-%JhqqGGn$bPpp5mw19uK6dtRl z(LiWipExPjCk|!CXiKiPesL(%FHY(iUD2-07*60BHby!cUS~}49bSE+P)VOC)NyXf ztXQoBQ^kmym_Hu=XJ?v87%wZDQFvL_h|G~D1Gl(ob7ICo#l?<6Jz~e8^3&!N`HPDg zrQ~^0(`P^*7cs|?h~8Wzp!>Q4w2F{`Zezuvd7A`uSCPQ1lH$qZy%Aoe(&}CUdMzjp zSqErnx9k$v%tT?Ym@|qd7mqKQI^&YavQC;jvG_9hT8-y?lP`%3(;RT>q{w6%9AhR3 z+)&%DOph5xn;7Vb*f95~F;Z}kA0rAo{Fw06@iAcbT6sf|3-finF&L2z1l)?0Ex;Ll z#k{&|QQ6oeDr=Y4R5z4qq})fj@tUR8g6}+t2QiSbxV|bX3NeVndyILtjkp8zl8VKU z0p47|{Q=%Ki1~FD3zms_b@i2t6fm!1S(G5eFpqiFRgHDa$|z@43DEkb)eRMR8{x*g z2*l#8!&1D_Sh7GYsBU!W<*@g2ePuN+ch2`d9)POWu5jhCHR_k(e$yZ{zfk1o3*@3Z z6CpK(d&mZHjhMH5zMB+HTdC5C8c~l)8enJcx_VJlD^}Eq6?LLkEEFXozZPWH=DP{? zGR|+PUtG4LqHcNhGBbXDLv@t3VC(PYOHD=qp&m?h`BJ!V^#n+58?J%-sfs04;0_D0 zj0+lTu(qhQqISvB46y>>~hSC0rp z6aWE3Q3*9xG&C-gZn}7RU1a(gC72JHEUSsgwqki>O&KhMk7bL9SXNy(U)~#%%e#?m ze=q|&F#drLFB5pTUWPRcCXv8Wu^gNejnE{ntrOSQKm{)r(iOl+WlKeUL+yex_7fRE z=E|CC@OZRaRqg!w(vT<>o=?oHhX#Oc2H6_$-W-YQCNP}%w>->9qNhF9wZ+0(+0W{o z*k8V6hd+DZ!JmJHfyU?ic;LH8q9n0z=ElILxVwY*gdUE62!HCuczinn4}94~lqdEr zXP$fGHz(fL`TnE_x;~itaCf<&D(2k`e|X^A5_qJ;-zG^3AwTelDMLvZ41D{D7k|YU za})a(MdX+CaMy=Y5I58GdS(f!x=T3M*5eWD^XsWM)M^4MC z77bqlJ>QDz;UhA#Ge%~N8ounBWexT9jl-8OYZzX;q_S>#RrTct!*p+b?fA z4^x&($Mq2%{piW}8P>n@7>u+lrOp9XYp$!qp=4P`4Hg`leMY4KCsXYZKyW4mCE<24 z%NuL!6eQvTqNDsR5>0CF6PDw|r#e<3Hzg1U7LAPlzGXQn@qxj;g7$yk5E^UWV-+|Z zgN07_>5d56@819+`vJh5;4Mz_YKYq7BnPL%H8d6od)JKxPGabM$0>A@rvX~v#0TNY z(X{E)rd)#mCSP)~ygJ?Ol$)J?_QHZooMCoqfzxNIlRC}m4GFpj^PN7^Ff@!py$dmV zn2PQhv^y7k;-uQk3!I*ILcz4DPLjPC>6C(LKrSkPxQ-Z3EC8AI3MAtd+dQQE7u=*^ zO4hev73TfyXF>ba4F!SRD3hE5lXQ!>I|tIOpndH6J@&dlLD0T>59EU30u00TX0VC9 zF|Y@UUF10SwFOR>LZ@q?)3LD7Nex}-bX*g(|Lgh!r&G{=GO))uGMpF>Sw1x=p=Oq&P@xAX)Dubt+CB%`0*f=qiyfq52i+tc zqfao9nIcm~;sTQHalq8S4TPQu+D}~{Ivm4KUxZ4DkGE5-=~JCvc6abI@TFBww;2#h zlBSQhYYLo!;1y060Q1q>y)SkWFLBPwcM`#>(}MP0;Le?c_S@jkXU}l@O?Ud|JKZKb zDaFn?Q=Js>COktjyAgz-mnPX)gOd%s#OXC1E1>{S+XX<}j8|~G&zw|H72OZ|jgB{ACU2}PKpmff_>Q4^3?nl* z;`Uf?F@1aETErh$tn(g8rrU1?z#?y5Qvlv$KM6$|`JB^rT4)Ry=I!eXRt4?PufsvfekND|ZG8VVdxG{0 zz~$JtUJFu^?JrR+P!a@4T`~SffSi<|y$=|ZkK1cy+k#Hc&EKsM`^&(m)192pV0@EV z?$)#XtITpMW_d_v`R+9`%ZGz9%Pq08JS?+xQl^8iJO%wTbTi3z{ms}@-z*zj6VO5X zIJVvwoN1RhqwS_oooU5RkEs}a3&;e;@91!|lMF-H@g^9Qe$b)7$$5@7{A#6Ul+7K` zD1UDP4Ic(B$9_y{_*bRjyHGW%0-<5MR(S+ClaG5ULZ6y!FTEKYRq3|317!MQ6Lv55 zOC8WTf36~)#)vmm#4Z`}I%F^!dUcT4qX-L>0^>AjuA6kPuJD^u;U9qvFv4l4z&Q(? z`X=zRjt~ON00AWr+Fe1Ne_pc(1{C`%z|r+@xfU8#(EhWO@E@QN484ase2Tr~<16=& zqkt#;U21k;6ST%aDzsIcC&fH&gK1Qp_~f)1xmNyQ-ra;nwZ!GeDiLv)NSyB?yr>H$ zEnHVkcK^%0iXG?sr8)l+|#LwoSdxib2;TYnEnRs8~=Wx)yzA16{ zZ7dgmS>k*r=fdJfnXmgQp&N0T#O0liiy^T=;!;=yzDVNo6oIRiCE(3J;DGn$jN=ojBHrCa9<36WZ`emf{8r-lB3R_{3A77Kcz(#9 zeFN}Y!t+D6)Mkl${?JTKZnVS)xx$;J-a>2#Bp^IH@cr;}GGDK~aK437j@Mo|-%b+u z{FC#2Ov>@v=|0jR4Eb9kOd%nfiF!-&d+mkut(NjR1h0$||3Ha*?T+*Psl>hZ6(&1i zG8^yfVjMQ~K(P*6MEei&*_z$-bhe20AH^T-KMIfbAB9KzkHVwAU){Pw)#fF4Krb@ugN&*UTyW+lpAKk_TE}$NM3E%yFK`O;J>lFp&HstEc{|0 z{*gZXA468Ll6YCC$AQ1A)_<;}BHu1?uf53UY!Fuh`gc`d zC`ryt;@=I|u3EbuOZXKM_u2(7PlF>@SFOFvXN!RSS>j%Mm(LRc3&?!EcFl{x?Dr`z zz*=b`K*x(d{6l^4UqZTA_U96fhIE&(aJX{I#eQ7J*&e+CpQ-WBB^vP}4X@JhSsIS@ zhzIf)D^i|Yh(^3b!{3H59;Tj$2{-i&ft~R{Inxy>&talXIfDr|<)A;{fpX-RJSqrZ zjw!;#^EF)8zfr?=IlN_osn1FpT10es*XfIc9l} zX}DhAa>x%4Q+^HMX1O*KZkDT1iIMg%BN{IsYq)ODTn#TJ8ZYdVDF1sJzJ};tfX~rz z_J33VKEz|{ueS?5U$%*vZw<*oT+eqY;by)~KKY^^c%Yms6)DfWY&PP$|ECfU;%pOy z(g{a9=yKQ}OnsQ&v_mGzK|j2hXuRZT_(Tn7yCMGs4bRi~FVJxIZREdD!}B%%$r{f7 zgZ$$(oa+VKg|6pZ;z3;3lj{_5UC(ljU)Qrr!*xBm-cgROXPw5c>-i?(sK5NAioypC zoM%*TYjSk{BL>d=dOIp79=wDgKRnP+aO~q_7~!bTMGV3+NINO2kTuwNbm+>l1&OEKWb%vY)6t~pCxji-+@|l0NfiwT}gqwCw zic=XOuG=|N!*x3sX}E6ZDj&R#aJ0{Ot-OtdqkVLom)}Hvbomcz^7VS$so{D(zNz7Q zJ+^ANUXLFWZr0;b!p(ZbWkT>kJ@tD0+K@9qvB8(KieUNd{~^LzKJ%vG$B6yhf zSft6HpjhO&M3bZAAeog#{Pu6gL6oR-u z-o?=^6WUFe6Vh;9PNIhEat0G_`Wr9KYU(+R_)R@CHC&gUqvfmXnXBQto?|s!m&1$1 zntIj{KjM13z>kmdKwNJZEgG)33tSP0`L9%@JntqP%d3wU&lApm%l+FvO^)6!-qhsi z^Pg5tj*fq<@ngPxZ+TSX*YRV7V|n#_!yQy%5Ul^N?bfKXGIcjTbJX1^ha`$A=%wkB7-$ z=YxOZgO3ixmUE*I{#hW^wKoBVJ1;F;9_nEYFP@CoE^$e*o> zF3%76;D>#1_A67)edG@&e%uGYfE>c)U*&_p?t@>^(W^(jTzC242Yv8K^ytderzXLZ zuiuaV#Rm^3#^#^zgTL>CkD%38P#?a>M9J6q;J^35)9BH;Dd$Qbe2))~YaZZX$|?21 z@ASd{=z~vA^5n~fTvSlJ=7WcmWAk6*gYWgh9r~#N%cbXgU21Ikr!{;O>4=xPaz#O9 zA02e6(ht1e(~R zd>yay!JqWOKli~e>gCx%m%qjbKjedt=^b0nVjujMKKR!@cvhd-@~eFCdwuX<`QWE~ z@XWrk^IhkIzvzR1?t>5Q7h8UVhUY34c|N4!=WF;_`pF9YM8{tZD<%`4Iv_T_)d&BR z4<0`-www!n@cVr5-}>OrpxE*&eDHgH@Zb30{F9q$9~#DC-5w#PDi!3Jh8>Ad({Snz zU3@mhQTHS9LXDrAk<0%u#hp!8%(npOFkJEAHy;qkd_R<^*C(L((fIZH-DmKBPT}8Z{163BoTm_*3crpMSq#{!GH>8T^HW z*BJOB!j~BM9fb3H3oL&-;ny1cuM*yD;D-pm)xb{?zRtjV(({PB416Tv_`V_@tj|os zA2#sCgl{$Q+X>%c;ExgRzQ05L`98vbX7K-&aQ|b_#1?OYTzFde$v2`sr`qjzhr&XrXBF6 ztAVQxHektb16NyOzy?AFt~RlN`LcnlZ6{zob_1u49_T%7&u)tnl;5cLbv=9~;kkyK z^@NWz@J9&eaf!?OG~opX|E~z=-`$v>pO>lkv^{-3B7XJ0x`)F@A@We~Eqi!Z!ml;* z9Y}byfuB$Ktp;91_&NjU=X7@&_)6m6Y~ULSf7rl(OgN9jY=>VGzQf>eC7gdBWd1J* zf8OBlO3(XvJZFB`kV+o zzJl=keDEI{_(-zzj}5$pT z{JX)wm42W2RKxSN{_}GUp9VPhlNQbIuw2N08KrSF9Qo7f_lzVBNB*aYpXa%3pNYiZ z-{9xxJA*VF_d^LrTcH5~aTlm1s}IP!0x z{$ja?BYz?BH)}ZZ{}1u6)^OzKar{mVNB$8ZIKi<|!;zooV_P&F`L84XM>QPzxgYqk zh9mzg#Q(I0BmWHQXMV2X$j|=wl7=JyT;k{ZEv~OS$Zvjc@Rt++-!vTMA0YmBH5}#7 zBmRGAIP#CB@TVG%{5(GlBtQTT_Rr^4Pz*G1ejjv#ffrJLMO!+$a`?I7T8&?Sf8ajC z+5dk<{_sNsXFvZ>17Aqxecr$?B{{EYING6{!oSw=X@IjG-ZF5WpC8h2l=FKEzpvrb z0Iwr`j%qmar_ue(F%3t4p68#|aOA&|_-(qfedk^~3lHNP~y|e$Ge*$@6&PXFvRa@|~{XsLzFDx0xD_`mkSpPs5RaFY#AsIPzDM z{KXoM{Au*Q3;QGM^F89f-r&EA_;1p1lz$WD%l8c^2jxFQ{2L7Z9}xdT8jk#@i2o4{ zNBKOCJgMQxzl`3qc}l~PpX=*I!m(b^{zu^tkH2ZS{yxknnjDn>1AqIYm@Js{0w1>*~d;?!j@7YW+@I1n&8F&KW z{9J*{^`9iag80#%XgB`t`91?LQR;}j2ELB)x3zq+zHp}>JU%q=EVBD?1Lt{~Md{dY zx&M?~!Gk=;d7jqO;OF_+Sq9GYt}FxR`PGF6&i(LI1LyvBwt;i|sxWZ3of;IC4Za2&vxFW;V8e9_;+hK%4hq( zqT$H@81e7daOCHDc~irY{~yGEP{Wa*>+7(FBmZc6@#KhxBR|*UF%3ulX5v4g;mFVR z5=Z?O+vm^3AJTB-=lV_6aFqWny%&|H;mFVaGg!lse>L&*^8of|_N&nvKgzk6!u&jd z^-L!@eBaM<*so@3axmY25dRzvNBP{ZR%$r%59|jgI2LHQQpEB@L!uJ^XIfTD#;MtV#>jwTJ;qMrDHR1n5IF~n% z%6k@#Z;a0+e6oSp5ngTJ{GQE9!nq!6$zOk<@#m5ZygZ`uqn#I0ef`+rr|v;KXW+v~ z)*m!ESid(@zJE1v?oa-1;2VkmsDU#-kN;?&^C?ffB+v_IT;8r^-yRx{<@z&~tG9-u zo3@11iX*lxp?+#4{ z&h3A-hNGPE15k<(Ycw3?a68>(;IEPX4-n3F-b~LEwi@_KDP4%CG&z{>gOu-2H5~K( z8OeXukn|1HTMl%g289}5gr;b8{;8sQfh_y)o!8Td%TiwS2t z90k9_qrt#)0}8*(!1+C>rwx2R@qa})>wo7UB`2Qdm5g6Tc#46aB0UEX&U)t2^UU!E zzJ~A$1Am?H>kYh=o;Th>IP3E&>GJ~($NK#_)$bNV&H<9M*TB>0IqEwGUPt&>2HuCB zvxR8B%=(-leG)ZX*QYPxY@Y{7&Nu_--xaPj@ISx;EnRvtqQ{1w8B4V>Rwy3xS-eWUFLo<#NjD+A9b{2c=?A^a-?=l2o@(R~2x zpF{ON+rUc*uQ%`-!f!Wl{(b!k18*Vz-x&Bo!rwLU!-Rih;Je7*&ZYs5^?#G_Sq9GE zb1pV;{(kZ{1D{L&w$s4t2>+ddZzcQ#1K&w_fabZZXCd{^Jq(<`yUQUQ+Y7df;nYr* zcd6%=SrGV|fDm0#KH`G>lanzXBAnEe&n=Ok=OJNC3kUNT5r4XZU7Xi1$TaY!#Gh;6 zyskl>fv+Tf93$}He47a`Qm~6ZNcda>Zy|iCfpfW<44li=Y~Wn3H3nWz^4A+U|Gu`_ z!1=qx76WHHY%_4S!%hQdJM1>_b)?Te17A=0egkK_9Wd~%#DCDh4-$S>Uc z;#~d~4bRp1w;4Fs%}x!+`sHJ{f%AG|eTcz(}?T!SfcUk^|e~V^?KQ?;kx}_ z(Qw_)A8WX7&s5SM_0jFd^^CY~AMPg**X=NkezjF=^VpMkhu-s{Ov5!cJxmBu~9 z_458j!}ap=c!>OZdGDd|2XVc;2Q*wS?{XTKkY6t^-%lW}msc#VUR=2}YA+MoI3%N? zx~?JvH)_eyHy+{Gs_J>mVLOg_^BSsG2+1aVQ}EUxJ`53?ieyyQFJ4>?J4$NIxOa)% zuq0X?xep5Lpt4NokI+}`dBPBHM}k}4=-a`l+*F|&V1rZGAtpnGmcd>$kb&H6$B+WH zfDK~iRW4pixvLa%i=VQxWsMcEGf8F5qO$oFwRIw6Nqu8=#>JP+K2JvY=}VigXr<>& z(F$_o6?apar46w2khe#UyPJc#VGI?Tws`Ro9TBSv0y|w)lb+QzU@qKrh_xY^a@!dn zi84;N!-C}%4OJ1Qg6)cEi;4`eGwhorGL~JlSY8|IaVyvi+`z@#p)`Zg7`vi!RE$kb zISMzAF*i8nIFJ~fO~me~%o(vIDuZfcpV%T`+nE> zOWpk$U%n6hGTk~wq+S0f6}*S~VUC1uG2*~yA&5~o>&E4|R3u@DlkbInTY8=ku@p1? zAc%;SekCQ~`H^3GeC%e*MBeZnD#cNCkz*F}g(#dx*FV5DR{m>fyyN*6u}9_g21LZl zKWVK>agY+?n29zv^M4euSo!mMHaxDAn5euShKN}CAEEr&$1s1)+syxK$UIj5OKE)N z`Ji9^UqIqm`KQrDZyP1V{P7hRGyhdS`6tqQG(5lb%OAhDjFtaB%3m*kVvPJB@yY)L zDhmgRQ2{ucd7*tw44IEo!hA}J<;R~A&GN4R3`9h=ztsrZ%6}=@5%W)lKQsTOkQnpFc>UOl%y3+)F76q5@!;!2WIyUIR3x0gr1bk- zL=l{hVf-ExF*E(XZi<8L$Na26hkxRe|4~ZM{T%a~w!-h>V&xy|-oE@l^vOS$(zliW z3ZMLo+L=FocNk0mW=h{|7~BYoH+=Nxg_zsY|4EQ{&RaO`!{pN z(bcSf$0z^YoZiUL2#WPS>2vA##J21=+$a5Rx}k119L~%if5$K}ENbomRp4_6Q^DzC z^5T2iMi!ED=Y1+c6OAL-zEKq0kLwlZC#FnHSveWcu+{^VPd`lFnE;p=@;{!hQe8~- zz%oqULI7gvpZ=&yaqv8KMg51spQ(ScPyYX?Q0WdB85%*62tcg-#qU&l{@x4oKPN{1 z{UJTdH2bNaSE}^<`?U&rwqiZ*hKN|{?`TvhF6D%D<#c>q0tC}KYb&MKF{Dl2bA8%B zr*AeAu>D!?*?#`_N5yfJ7}0(i@W<)d|9biOfB6cP@M@ZekeDd_yZPkb@|H@W=Z|${ z=6^S&hyPK>!Da>JQ~NIKyql^ONJ!+2!MvpOkSok!*5NO08XY~m=7 zzj1Qmlz`h~l@GNDdn_Uk0XPSd^WU}g~0S?S@HnGqph}` z1U#lrnC>1t#W+k}e0~|rw>MMTe7a&fv{RICFRGgFd3M{roi%Fos9fpY?f31x3rGpL z52C5PF>e=`-!sn?Vry{*nVtA;`UP$0~W=sAlpP;vX~0&gu%61UFaEi(5rS~JC_puolL%vf$-^trSk0^b^-=Mxi>ic)rSJqpH?O)f2wtu<6 zsK1vz-LcNFjwah;*Jn_V$DkfhKv_;gS&rKQs7GtZS6G*zE86Bu(6gnZDCq&VIUVTs z5%kL?=nEIw;**diHq^%d>HeP9efOvTrpE&(?9KPXxctdj=l1)zoVGuyh1b_H{e@8G z)`?;R%EaqH(Oi7U?k)595`7^kMz%gGHXO414}F*FyN@Gwov_8puk8Lia)BSy9Rgo@ z*Y39C#0dF_eN#9N(jg9M-z9m?wix-Y4Sps0d&)do!PjJXgvuNB$YTuBVtAh=M)tS+ zd^9g`@BJvR75oqJv<_m!vOtetW89`dkF{Tce%rq~UGgR93T-?U^+(yVY>@8Td~&?> z$zBmY`Q?JCP-pp2*B86KiL%6LIv@~naHnR8A|`PziH9ZTE5bYbNhu;0OU!H`a;pa& zA@ZmPF&RglU7YyLnz@DI-Amiq6}J$xmtApmcEz!>D{gmonUsemW-*!TLN!FW7eA#r zDbyO1Ij)oiZgL|0qzrSD%x3bS3srN`p()A364eyxUi<{76Ne=(W%5lIs)`m|&7h{TI!Z=!GlD$ zco37@2vTV|^tQ)%gc;oSfSItOUUjzVCq*R4GY)KQuP~NoMeLX)Vs!2lx;- z>9o~r3j=2$i$$@!LQlgaoAwNPnzS;LigqyaWDEDI8 zgd;o+ikW0hP8owaC?|h)K@I5{p_W z)@#a(nB-Sa&?$l-j-cS*nmYz@M4)l$hT_vF^(#?H{=FUBSgndV;H? z1-E-RndAzd#iS>=Hd-)D?jjFAQ{)jFcq5aZ;F=bSJ?L`PFv;~15O)f*HV`upKLy6R zqGvPdDNxlyv8^swRSi`+D}W9$yUk&T(z|bkz_^@Cn3r8;3qh@PwM1okjO;FLGrLR@ z@H|~@ku0`w;D9TAA(O{+J`Q~C@)hxr#V`6muiu9h8%$T6auUfu4+4}&5Wn#Q&|HGJ z)}(G6;06VJOnU8LAt~fu%u3~Aw-QG{WNu-avxR2PBv+v&7DVU2$jya__GH#p8tzQJ zI$zL2X}n^#IV)JnN$6^c%hnU=39f5lF1Lc}2yriFk=Pwti6bDgT>E*(s);sMjVqD} zQ*xM;U@6c<6WdCIPoeSP>WVSbv68K`I;S{x=cFFJJ11NC-gN-Ksj<6=sVVSW>}+{) z2E&)B;}R0!SGQn>Wp^Hva6!V5o>NmU>KO*818iF_Axsg<(E=TDy_op!AVV?0hc_t@ zJr+=R;#=0GOh9FYb2!@^;K9!T`S#7LwiNGtTj)EMq{`^^@l#3%B- z@3`3lt_>5?gy=(daL^88dtL-Z>gz~j_0uh+V*1CEQBX=aK^9Ml0U#NaKy09wMx_{} z*#NZ|oC0P~NI=62aaJb~H#G$Va^b!k;Za_ktZCKFL^+0x!&AV<79KYePV!ClkR_i2 zT3L?*V&RiLVP)Z+xgxXA^~hITa)gJD@X#E5G#!FJVU7ALoI5Id402FzPMrOpK*#NZ zQ~X|p;RvX;1ml0Jg2K*_nso@-sAVFaI{h6^d1^b_PzQ8Rd0=6!#YkFxQ2!)}${-d& z3!=haurI2l1-~`6Uu0~*$h7^j(8=)33of8We~j%KxKo7&q8Xs>)L{)k9aG10aBxC5 zoMLpx@GK^-1fm;`{oNYzbR(R4*l<^N2N2+NLT&YY4^pDn26#fkM{lbna2sr+Gb^wL z&P9P+;XE4^>BURpBBzQGz5W!D@=}>{c3>66mjqVBc~;;S;_YqClu}Y@ZKM=`ifW4Ga@T` zMr1|Lh^(xl$jT~;jGY-7I}_FMyh6r8RZ7IV>}qHy5K2cKt;-`Tb}s7V)$^q&*9(?J z24_VEXGaF-V6Z>@3F~Kg#v?4xaB6}-Pwo%UP+su+m{JVTYrEHr5tRnjl_YxUkNvSC z*Fr@XTUoL;A-cEh4^R|(OR@BWnbMn7a$YEp<1smSNIIvFjGq~}9pW)1$cnpDYzm29 zksLB>5Rk|MW<@BVi(VKJqtx+nOQ@!SsA1gaeTTwDI-a*{_)dVV#n=$L!=GGNLK3qW z!B!{{Y>AS<)+hcF{KZ_(SO+~}v`X$%YFDt|Mg@^zBi6;*4zWsxHo_&AM#`j;i>w`xg z9iE+;4ga$;hts>u!|Q72HB>ZQQ(7Z`%o3Bwl%k~4NJ*v9l1f=p>AdB&bya2jE;MK` zD(AcvxfNphl4Z3EmQ+`TBVHHBe9GWO`i6?iMggyEi^Wy$d(?~Zm1KAsy-_Tys8gph zcwt!7)h}5PcEw?$WwqB<16%E)#rP+gmNqOBOP1HwmC3YaW#fyB$6r=9YwG2b%StXQ znp{>UYATl1NLJPr@~c@~QK{#@pt`XPg}a#Vi{w(-TGU@Ejn~S?CV>Jap=DB8zXZP> z0EIPBy)dr3}yavnn%sGs)bsCL3r|ePp0x@HQuT9~AOh&~fvP1@;l(=o2hX6P$4(Xdk};jbX31_BcIuJ6#H$PScz&Gn`JJ1?>-2)Pq)m)9E><%S-@e)N@Xc z8BWJlPA~iNJx)pxOjqEf6i7*qy%xBIqJ#D`)}B>Cd;bl494N_i7S_P4Hv|S-fjG3` zw;cN+HrBf>17szqMy2c^aXHh8h&v^7=@@}w;Dp5Eqwvop9(^DB4~ch*;#cdwc8S6d zOaA02{2hsRjlzdW{lT@3qm#s8YGfP%iOZW^BL?3ciI#&*HZM+Yq_BB$<0w4ZZc0wH z-4q^eH-$&rN8!=-QFwGc{sbbpZ$=(Ia6hJ4_~*dTRkMS7z5qX<1AkYoys{4l-isx_ zXJ^@e1Gd0NzU_nW_QBr-S+Vpi^}#cJp`MREA!cF;XD^q@v zCP$ag`rv-SdaG^zT^c?}!(Z3%vo-vvhKDs=ua^NDo(6j0fp*sM zVLtd+4VRB6RC2+;N}wEUQ+zaQ{CyaN>pBf*+hX*3!cF^cCfv0D>zW+B9_2GfkcXpU zXB14wC3H3M7kqHGgUR1O`I`7{ADs7XG5HtDaVJ{OmwoVT8j4Igtv)#K*JAQF#Hj)! zu8$_Weef~Vm7Dy(_rcGlXEY}NY9IW+d~n`33gzhi=#OcrHt`Nr@g`pGgFowokD;O3 zl(XFjPop8+Poc&33k(-_5L5c6*#{6dtAFDF44He4&A#pzu@!$KO)$ zC{Y(zf8Kwx%)rkj{)GlUo$%!bK9lff1HX*$wFdq@!tXWk>j>xmpY79$@MjHv{@Hk+ z5B^I7pF(mD7ty6>IP!D7&(d(@-$~&) z8jk$8kbUN9IP&xD?tBeL{yT{ODh)^ed4w<5aOB@e_-X@xfbhEvoc;454M+JyY5aIZ z!%;r(yUFE4`(r!h;{}Z$4%IQbr&{u?Ge}&_C74fV4 zR&U&FB77v}&-|MSUtr+72*1g|dH!@4;p~TO-`5Nr?|<;%eIm_%^#gP4$o5s;R4M%?V=V=;_{Jc-d3=Kzq_H*8MmF@5-m1~i~|2X0J zT`C@I&mhllc|Cxp({|hAlMGZ&(i)mngRl|{gFYzBR@ZS>t7UAsY{A$rV2Hpy? z@X+@=l=VpY9yR2@Nb=#E2zjvG{z&|%H5~Qi`EeI*zKZiJ9`E}Y_%hNC`zB>uI8 zqkZr`WiIhQW#HV;zof}QKY5Yt!|O4!-FSbgw+;T^5&sbb|1;so47`whqg-`MF$D7@W{THPypnKLbs`lVK9Z{MnBnh2S%|8iy#Kh#3$&gfTY zDfsG)8%ZxJeuZuChSeEN?$u+p-x?6IsExFW|Tt!PRpQRSg z@?9b8e{WSRSjQXukER6dvhtdwKGqh)sNdvBa%T?8XA_7~ckAMLE)_}8u<3$Ff%>-e z+z)U9GyO*pVPeReH&~@W`FLRei{%Vq01gb}F&_S6<)4or96Qy;J)3#qcwl14oOzZ? z!u=ZNheMv3{|_LaSoxoz{JEb}(xUUa9r$A9e~|LuPjWDSymc}2?+W#cEZLj^UH6ky zP;xhx!+d=b2&P>oAbv^dL&i^&Chs-?V(H&9L`lmeIjBG0TA2D{*p!JWe@C6_t45>| z6p#C)zXvBzaI7*M+f4sM;EARGfuSd!I zQL*xGp$C7hlmPR`@yE>nR=|)Y6aMt$B<266Py1&*@VAIq>3@R}a9pY`?wQl^^%aO= z+GPS_kp3f(7Gd(@^FYK5H3jddvR+GzB$uDzxsW)P{hD(XM?Nv4{cxVm=`oB)A?2?^ z-g!6a|F)qR>Z%_X`{chrM*jF5*v$V=klx5bir*Yoxop$gG5)S&rk8_eRl~dmw17iq z*gF)h&b%(k$ea<`xss**Yd7S+rgXt`o+R@`4%Qm1zYuzNbuskJPeLi+&w@YkWT;L& zi)$X7UZvJF_;NuI)7ZG(;xYa1MgZ~u?M-)FEE0In5)>jB_;0WG(VKLN5f zy%P|h9Ou-T? z_7A0~@9>!q9A@O7VfkIfi{JRC?7+O>8O+E-gS>C?_rW*&9A}zj7Ws42Rz@E77!Dn)<3=7s;P-`rNrLNs~ zJTp(NA%JU8w1T}3(K-nGV5^m5GbTcw6F_F($y3+8vQ1yV0{I8v`Uu3Y(xyrqn(08l z)YB6?z`7Paw|`yM3uN{N{rW)t2i>(T%0%2J_loAOyiNq%ZGscZXN z!B1cx;S%(>RyzUKyNHLsj_?k-!lDTVT10d}|?)?T;_)?Vl!*V({yr&p1U7W9I8?hSl> zz)pQ5?DRR+C$67?wmNRd?f3%f_5_p-?SyRxW#!5GO_TbhL0w$~^^E!-vU@@q6u!?A zIq=vqY7LV|;&CmI??L{hpafOK7@bXE24$(aZCTXAKF?E@|G)BabBt3q+j#U1VD z;`FRF_xGP8uIdP$yWQSl^c2eeFx%jQ<1HH`pU54eC2qc?Uq=t#;bbmtjql8c6#V=yaz3 zfNiJY zubZOkJntmd``$p3T>s=UurZ8>si(o-=LAH_eGraS_VJyu>^;FRuY^3m2YHu*4p8Uy zROc_NIP|F@YtpH^1NpkE`hKWzo-+~5q)8*=&|-9Xsb0} zpZ-p5wR~LONp7dDj>zc=_4YfkA^g_2>kGNQ4f-+mHELa-lb~1lk*_7VDf?^So-k9H}CK3(~LFVFvFAC9tmseWIEyUQ@I>+;h;?~mRJ^j>=ttkt8^ zN9J38{Pf5gumSe**bh7odZIp$!S!0O1?voUgMOzM^dnyS%k3UozoK;52mKPJSN(~? z?gClZ&oGAhV41#vHEQlYar&o!fp`qR2jRo;2Xtx+*y_}EKi~ctj0ZRlpzk1$m4tHC zIEQ0)%@XnKXR?2PN%rrjZ3p`4l+<`J_bhn^*ByrcmQm> z1%2<1?bPQ8xwenkacB^%5fsLJQepiiSEo&oZfF?$C5Xp91bN;gUHU`+zaM<`n7yVK z>xX<6@Sxr>H%fie$A=GrA3|Q>!?Qqd9IIw-hjO_6Dvpa^8{^{XiJ{-Y97?V&h2sL2 z3vCo~%hk>6OG9E8uC)}Yx9aQB7OgO^!1CZY`yPz}<>05AKwr4+NZllTR`Cnyhp-%a z*?3K;bAXp=v?1EzU9cgRA8n_nc@z8@byjuIP4b}qaeO~CD30u(;$#0f&HgHFr2Q4v z3UbJwH4h5TT;IaQ}ZO(xDpSo@j^eGnfEdl6bZ0Kv^pnr4Z9Od+?j&5B*9Sm&- zJ7PU-v(;FJHs(2I>#D$$t*c;cUj<|QD(A@~d&RRGq0K-Zc#E(B^Xdt7E3BKP)_Y3b z0c%E`JPu)uYwfD$Xh`GS@uxU0LYzKV+?Omysxi)+KYo5i-br|8V|{Pl3$+f-&#(ipVkV^rdRd8wF$D=U0f6`-9!r_IDCL33U-AV_}V`P-b)Shp-;lJKs34 zmR0v(=UUy@zPoD8{V)bW-_w8S)pnn?Qdi)?`54bR9)$7iPcWWUKs@qt|Mz*I``R_o zm&kHJ8stxhGNX(ZuuZF!qx^3U_}FN$FJoW)NcAPk2GDNf(T7!={o*+lm)8+&CT$cM zkMheyx*w`|nQsS`25C%-{SMOIq0hna=TL8E9AcjtbqPFfy~=qXq~&_W`d5B{{t$Q) z(_>wu+!op2tG3e}=eAORtWRZ!7U=7}I;OS^bqpQp`Y!@dw`GajbD(bDG3xdms@oi> z+hb6-Yl1K@g}S{R##qx2!(eAQ=Gu{K#Jvb(F8DmOmC4W!CP90c2<>75w2$#HC;Wx% zhjTSQ*&_WU_1B}URPqxXqxug$9!S&t1k0w%n`Wo3y&L@G5X57Df@_zdO?JUNHe`3x z{3O-&lV;aXQg^K2@kaVh>W(AiBkzKJ%0%#!{U=VB9I*?x%lR7cw6019`zOI)7x?Q8 zf1Thj5&mF~z6$2(t6+}43g+mmV2-{j_$1E9T0TEL@)*dI^&)*%>E8O)X*s7>{^{kd z>Mw@>9Xsvoo6Vn{*7``#H}`$2(x6RHF8gLG`R1`0zKPf$4ByPNlux%pUEE4z@Tu!w z*nS+wnqxBpvTsWTf4V!M#!kGqwFKB7#!Sq6TOegEth*1q6Ce$)N!Wkrsq0>r^?&s| z(J)Vh!}-(4Pb`~MJmKPSdQoxs!f;8$^6GQKW5O|_rc~4|Q*lcxmMyEU61X)9Ttv$+ ze>C@#ci-Row{b7b_+s3HS5*D;;I9JfP9*0)w)&geA6@>B2|K1w=uv*(n^&gX`*z;+ zTOYmd_+=%_YiAz5U;OYu=RZF1P1eUxo&P}jP5HmO=b^JYjqSH7DQR=pjc5I8_t&qV zSF)_<(tSzSZoU1io_Ak4?H8i&jh8Gu_r#;tkES@K9slF1HJ?15_m9sGl?EP|^q=;m zYjPggyYjytyXNjWx6U8%%am2gQN*##Ul%M zzZqUy-zDcqH-3Ei+uINRYD~(wZV&#)6BB=N;)g#UxT>HqKK}GmovzyS$%~KucG zd$rzk$(wt-4w=$=+o_-aXEXPF8jA$_Kdk=1lV34!{`btf-uRC zi!D)A4#O)RRdfYN0p8h9Fg^2uv3@3#_M3^S#_;eybJtpV65H?BFH|BD4<5r96aVW>luBed68V@4Mz4)0q&r8DO$1c>ShQuk> zxJhO*=}D<(F24HdlIuz-X3~?w_G2MYtGJD&7&b=u%O3obG3iD}boSqvwUeFKSfFMj1>D}pJQWI62^4LIvO$_JV_lb)1zyGXt# zg~|0URJo1FR<~>W4uWU0;8Is`4N>mJG!;jryGe?fT<1dbw-L!h-x;jq$ZiR%6*9Tm z6}*52d*yD^u_&>&URnuP?j~1ob+q7iH$$#>OU!1{tEsAJ!ELt8e6}84RWmE3kk>~R zEhWgad=Y22lcK;0SCWscc73IWBHfEw%j^)1u9O-U?74EAQVvsU9xh=GI@aNBSC=;Z zHd;z`w3Ie0D_Tlbw3Ie$#*_lRi?zj+BSF`+M3@$4N!&uPyJOn3*L+iUI~o#8oz&I!i3spPCfB%71R;z4o=8d(`bz6 z5drgUCRr&k5DPAG3o(Byk@(gE9%>4HkV2DO4cZ)DRC4ciLKrEym+~~Ij@F<$I3l*S$TL zYtxsx+hIdmqK0kesmHa;1&W%ozD_Y=*UXii+AC3;y-2i_s%R-yt`bC;){U0(U7AO< zl>ggGB%6$BUkRS6g>i^vK|C5E#^)*i5&9WtBCXa*!8%ge_MM!Kw7^| z*LK{Hm6KXtvs%kqetOtwTYQoy~KrD07b z5r;NEVu4TvOtyGju0$eC!7Q+x;v@C0BD5X1vcxG@mqHpe97fnuw@cU$G~*HE4hftO)fN_$tSdwOz-m8m}K2B1B!Jo zW__?y`-ww#dmKn~4apVbE2o@dyuA7ID>q5hSjlNt5)0INGm%_kfViNnR6Bg*AW6~c zixBr>+JTdBk!j*X2H;Y)Bkv#0L(`}kb${M;VvvX)Yp`bK-!EO&~qU^Yh0~c$s$u&?B z@w*qZ9L*HN<-kV6V)l`k_B5n_mmF|8Q=N8rp{Y%rxbuLBDwjgZ0Pe-K&}NFsbdB2P zE!EeQgpK;IWN*s)t`+p}k^?=a6=hiox)vqEG%Rbx{Q{PZX|^2P5k*&jo6i7D$*Nhg zY;HKRujjzO)`|rAMu@HseASnAR-2>GZeo9)u1Zf1ar1+Q-Igg?5GS!kQc;_^GxNcS z+&T0%q3y_>Z-)8Kw|(uZj=IUEbXA4tP?Ot<7Of}pK@Wm=N#wEB?Zb<961m%h+OisJ zaF_(61M*P7k`ZIk2S_wx|0l>kgMr2@s;VNhunIMc+rH{-CL^*jq2;ppe78#4Y`MHh z1xxwg*VD}5f3wp6-;^!8Shg^Gs|3yZYgcFdZK^NT{GMsf5e8#3zjlnzW^StOXHq_# z2lWVqa+{akHU~U4zDozdpAfOPwX@rPg)~Z{>7vq;L+-i`@csZX*T;ViDL zqH}yY5s(p+`2?NWvywippqWgvKzLHYq;`kF8t~Pe_%P1WpmLZDQ(QZ4)RTyn6^LQb zSUcw6o;Pwo7AKGfpNHui-o$xZ=QwK1n;>s_(?M;n6Y_Sx=@HEOII@bC=FkMn0hbDwC>3MDDZ$ z3y$cU=X8(US_e1F(YDq})A#)884p_E)-=g5*}=_oXp5WP-aa~gw0(5?dOP3nK03UC zj<&TkV5Ixn6|oxz*^3`b2iPDn#NGTp6+9Nda1 zD@Sfcl#R9`juB?@z!q4%9JhE5R_sWdBpwF31smI-$3WrQBq_sN60j14J?pDrk7yxTk=uL)>6St&Br zMAib$G|4NS%5Ac)0M_3W4^SKzLncyJ@keNgs*6+i4~f*Wqc3ufl?Qm>tUyQV+My9o zBTj3K6w@Ij`D&0asPQ?CfCQW2lq))10~g61vO++LPzRalAs_>ZF%uOD$*~tXy2s>5 zR~%ACZ;hiPu8kLGkBi5Q+ zkGK{1?YC%-yG*Vz@;GMnJ+?kgiM)1o$W3R%mM4ja0qlUw-q^?Bgok~(T(QK# zN(eT?DNhy8iAzj|oRd)9WR#VRtL`M{0f$IL=B`NL5r#jj{ze!CQmmrea4blLKY3I^ zIpj<#dzcq7?%N2Uhtv|!2!HrULJ6D52y#1{||d_0$){eHvXS`Pwvf42uN6z zO}Hq^B7`J_MMb%65&}p-tY~SIkOY$&NSZ}K5ko+WVigf9RuEjOK+)QY6>*Ezwz#y# zrPVIBXw~9UtB4kUMfp9?%=4V{+~?jS`o4YN|MKZ5=gfTPnP+C6d1lUXPtFNXY6q`` zlyQ#mWHcuJNs|fTvrsSOgC|VHX8Ac25|Hc(|D3RQvft|;o~y!Ze6y{qqlnW7KDe_I zSpOt88$R;X2R_wvWk5cb>4RSaLLq2wO7Rt@_*Gu<2}$a0aVQycdY_+^V=I>VM{8KJ zX4&MHB+d90D(ozp)BOFqdkF28Ylb~10$fwrJjHWme4A}BeJ;uUy{X^z_FI7X2D3o4rDzC-2j5*pqC^&=q1Sxx)`UH@1RSP z{dGwK^!T248LI028(640kdMg5IK8DW;)q-Yg_6BsmT|vQaKE(Ds;jf%TV&{m=#r)k zjqfYo7@9%O#iVm0HZ6P$#zO;a9D8h|-^cDzGy$15dMgUsskU)$l%tz`dK=1~1pl1y zUrx4ycO)?BnB`?)E5uqu{>m``Dhw?=7yb-p5DHarq>dw(KxFW{!j8{_Sopn;M*LIY zL-18%CY8gH;~;Vhd~50i*qbxqVI0BNhz*+v8xDCKK{+Ek&EyUb&E*_3ufh7sPBk0G z3TBN+k(KELi23P~ z5Y{5om_G*onGl{~n(e2joBI58snPGJXBu1h>9bAxR8$uJPADH|w27C6x*KmyKeJEs z+*izKBmeL5UYH?rRy*EwFNF-h@eOuhlTHo3#0p?f4D4FF0$g36Od!+8Z0r8lu>1Gc z$80}GuQ$3jozEqCz0&KE%}=*dc{%<{l>_z()jtF~IHP;o>}KsTyV-w&-6^5ceXu)y z?G*=Lcftx9Z5;8m$J;)kIdIsm?-M!)cVb1vF$gW33p3Gr2}F8r1C<=qs!Hpv+Zm1_ z_H&Q!4|2_^$yh8AzTS9k=nP8W6yZ2d4~{1w|4bvZ*0{Zm-(csecUJo{NQ4&t9Zs)J z+x`znqHsbDhnH9v*bhZ5eK|4&BEv?(hQm0tAO~DZ!|kEmuAwTlXreW2O<9GeG>Xue zPH$yRdwvOB4x5pM^TZd;8NXF)k3lI%A1f|S@uKD|IrpzvG-n@dkHPZRY7a@PJ!C9m zE%i`n9CXH7=aEpU7k}6kuzXkO8^G8Y}Ew58hFJt%%9A^H4XC9FB^4!`qdDg?E2~7naMv9 z8x;OKw8DmQIPM%8AQJvK1ox0ClfA&bepUFt?go`fZcv%*22SrqxO!2*VZI7{LrrQi z%qd=h;@VS?>2-tGFZQl4s6u-tp8U)v&qPzCR*0vq=@lAzdwLq3jt55To0G7^;UYRA zEyAND9X$_-qvrwt==lkrmfN$_Pw_(8M*oRZ-$oDmhu1?1(AER~IpKf#=d6d3I+Jk| zJ~?b^vF?9z*k3>fLKZI|1H%cBweCMSjOy+C_``W2T6*%tBpPn~k0kD4iF=HMf2hZ& zJ;?u0HErPCVDIs&t zn6#>+JB4S2BZ<;vRrz>O!w{ayDk_lpd=@pqVji#XJQi2uRQCUuajHr)P7CZfRns_) zY3UELO73n(+_QK!Xiz+qCMam6^ zm9QQs-(X0(zhw*QBLrT_&O)={xgD-Tz2uUv*LQnijN7bYQl?x=_r1`Iz&{)XcB1~^WJjf=QFvV)-Fl?-reC1&csfXmN=sUWR zlaK5FPmBWHr@9u;8gpMqANNkfiy;wOh^x9eOhsUZm*07w*$9HnGNzz_YR2_Q4FAgR{bQ%fh$m{c$- zAHFPJh98kP-)Vp^&5Mr&;FlB1njQ1{Wg{}bx~jRZsSHchFT&3bK?;#N0Mrg_i-1 zFyDztBUrJhs(v9@wsFygPJK&rLrXL6jM@d2b@ffvPTAC%WoJ#DKH1aeS93{YZF4pB z55{-_ymZTHsA#Tn%tV>rvcOs3m|_d68yo8z)0D1V1ieXZlIeA2OH(tn3$2IN^s8*D zu3J!MCNXUIgyEpxO8{dTFJz$ho+>aX$K#^FMObu?IlDhZ4GUwi8;~ zH`F_)pZP`&UuDMWIEg3O=KLD=_&A3%FX#Bu8^h}|Zi;>{c60XnoLf45zw>QfHsVj} zsB}+n;t-(A9_?xgZSIT5>uu}Gff2Wax zZziN~%Ldt&H%T@|du-pqG%N>oL0~!TZ=4wZ3g?vP9AECWnfiQdmkr%+J9Z=53-y+g zd=A7hAUF1c{TKwLImgFu%(yMOF=oD7-b(WLI|JGzAN6mD-Il#E$B6^lO!;_gJjotp z4Q%7nBxC+q>?m!-yMX-6Pcg)?J*Li^Y@I)Zdny?YegQKS3jGV7k%S$pM=<%c;g{4m zUNjtz?F;J{EvauRLq{H7UjwnGs*8p%s%WmgxO(`Ayu!SZd839mEoo}3uWugS($qM- zc2Q+rOI7voii*a{no&i=>S`CYEFOj>=gqH$BSV1dzir?C=FY3%{@%lH?Yi-;$JV}m z`<=rJ^9$ksg8bn$`G(ik&Tp(}T=L&hL9LrdDuYygg^t2g40Uz50ygEDst0)wSWOt49id`HDO$%qhKqcq5 zJE6#^?C^lDQTOpH+T5Qx`y<^;B7>vTA_dX5NWbWJqVCQsN+R8(kW~`tR~m6V@Em}S zAk-ah%6E)Hx#$es!?x%2NUi~A1K0%_xJLmgxGOR&>MkgWL_mdODv7weK_$hb?%$kU zQTLWBV6)GOHAmg`SH#{-(}NG72RYeY)8rh2oZRf#B~f<;bnP>zEs}*@b32wqMo*0l zo)*bn9?63Cg`zHG^mZ?ejfK|ig0?>zj;C1aolqz;Jljpg-i*4xTNWGZZVT-P@v9@p zhKssG8PMM5KEKS^>fumZq>tOPB0S(DSK{u1=4M6RJHnu(r~AVz+DwgoqBFlz7sIg>v;HU?ip0S~(|YGa zka=uS<`a$OONh)E)YREr)jAdwE;beI*Q=t(UjqpkL!cXF9pF!UIC+);|E- z#oa%KOCp`Y{l`PG&e0W-lTGpB$jR=r%b@5V!46==Z8&UKM^3gw4;9#e84OuX8Ivt2~oEnL^P2eeR7i>3Z>4A;^*HWB6 z?$I1;KTIF=EbxKXLom+ZRuE|ePg_QA2JnM0Y}Q`hmd44hcSDg5*=|-SoRczA_ds42 z*gF!NG%f1>dg(6g)&nl+`qffn&mC?_8kG-0v177h??m0FmX^4Wxoxm-gFW;PCp*AM z2bkxWb_d3`&#;Dbvv#cj?NA8})E*Zn-Tg~r&1v+%X!M5%z+}1`6#oGgp&9N5#o)28 zxh1g{oN#wQx^vY1tJ@aoieuX5ZUh2``T$Ej8gY;WHw~x~C&VULyCUE|yU2Ya9o(JJsyMF1V=AO^-y1r$u@_0{z__Dw);}!hgC9 zmRfjd6btTL2Htc4l6Pm6xSOdN*!A2ejrFE3* zCAQG#$m)Xq{7yE5%*bKxjVQ& zH5Pl$vltvYf-LqBSnM$zk+qk#rJI=GSI1@_00V$UySdvkz@j+5DpiD3f%$_Bzf+$4pt;dnKY96mDb8IlYkwbyVwOHK~IF??7ugw*4P4^QFu8eWjX zD@=RfR8EEQhMPi3IbSy%{*Xh3(+&5YEcSAT7=E0W=15P&dvem-!#74Cz!wNq_@`;g z@ruGP(MBGA7*(O4;d~|JXLd5&`~idyA@-Tk&sRNu*87ITqdF@5(QxzpQBuychU1k~ za(LKq{B0*W48jW&`xLXuV9%IkxbL^-+6yGGg<<DKAYqyZ& z`#E#Gh7CD!lJc(^5x972pC-8GEIu{EP5Gjxm2tf*(d06&{ezWc2r1X}E(HTmwLeO^ z_W7@r0`Rx`Da^{J+TZe2f3`f;pDj=IXUkLl+459>wmj9JEl*wFERW+ZCAg07CozkENUEeHEUB@g>UB@g>U6(!uzfCua@Qs?Z{JJ1{xLQr8 zXHkIsT><5>i-vQjO)u=F= z?*xp?!~nhpN~P2DUI2%0HKvvSEP!7Q{Ya<()&TiI0rjp4;H?3AS_0~QJ3tTKU&AmO z%1y9QvyD@HjN%F6y@8)kaop7j{&m4y1^jL=p0RE`p7YIFj1fM7Pn}W-F4+t*x z@O;94l?y$1yvCsI!|yWE_9-WM)HB`|P1^PXey$)m?if(M%tpd{zw9TvzdK1D+fzYt+&wS2?C(Co%PEe#_bIOH#-Tn8 zSnqfnHCt|{))OZgtw-8Z+J6qoYx_$-m-cTad0p?)fO>Zb{c>D*UDSH&sK2`XcL_UG zkWSp~6kOW>Wx>mZJin|++cQowx;+Dk>-I={Nv3c~T|vM1_YRwd}O#dx8I?V$DWdZP8P|FeDIw8Vsb+OvI_ zk0p-n53+x+Bdd3Sqaf)j_1Bh!q za$bB>=qaZ-+l|kdtBAARnAZ?T`&3dKcXbp;J>Fkm09#7Dui`6-qaJy@TO+t!w|O3+ z{5+Du-J?Q&zTi(&9NRNe@ZEy5O%Od#9Q!Nf+24>$d44~j?iZhrVLN4eq(4+pUAUVI zau`rv@&@8sf3uL6^Fkh9%8f?5*&yU4-zm8C^OplSAD7XdrwaXhNgnMZ`TIi8L?M4r z@VSD+Z?Gny9m)mgHxeS3^6>!qp~Tsr&mdj-#Mz&j%j00RsCSIg)1UJAt^TZsc|x>D z&Wjr2dK~#Re%LSR|BHnl>HpUXF8zPA;PXZMw-84=oF@2o;@E!4_X&AC&Q78-?+ba! zKO~Ormv%cyT(3)f>p`ze{H8cdZeGcDtMJ>|C@r37rZmYv0iz6;qys7zJo{}`&A+I@Me|7WGs!KudRhbcF9LWD-HO$EW(V*M0sPYdzPN+mPWkKJ3jzF`ob>Wf1n?gG z=j>olsefeve>Q+0pe@g&= zB7pazKmF2reiXpp2;kl6Cjrz`V29Lfzb$y7;Lir|Q)z)lJyL#s0RJd}pVr;?s}Z8! z8w2?J0etzf>GeDlz&{J%U!$J{uwSx0R|oJH19*=f>DyBwc#-Jut^jV|)MnQcDc{!9 z*Dv|A0lZ7E^zw59_+0_~l>mNX@AUdF3g8a}@XrGHd41CB-yOh@1n}bH)9blBfd3+Z z9}eKl`li?ahX6jRUwZl40RCJ6&yA%bZ2z5Y3ZkF+9YyD@-&8o5){`@YemZPA$j1pz%eKeQ zr94`$3{MDonvS0QU6gk+?NL9zl!LFw_}qr;{Rhd7p*^m9@;rR9(1Y#l2>BTJ+K2W0 z%VOso+B5G)^5w))Ki7rmQsOM%kK~stjxQa-u*&Yd{*EVp6LHip?^kS7^3zEEAt8Sn z#c}sM#koCvALsYPQUB=_$KAUWXZdfF{tp#jPW)5F*APFf_$K107X$0RkJ5afiuvQj zJ1O}+l;&|@`8SB;eSfL{0Hx!KN9np{pyE}O#_NBn=RuMm7r>_|-kaplQTzhpWs1)u zev#t!#4l0&GU6)~zk&Gmir-HBR>glve7oY4i9Zm)A5r`SlK-XRY=@T==lfG1C_aSr zd=kKU+<4qCBKe`TM}OwE0>^KP;PQI;T;i<9J|_qF^aLMkJiuFB2T)cawaZ;HW>J7Fzxk3Ab|y@!OPq9`UV$qyGM6$9n}w{hO&hI~B** z^k8^OaMW`qrGF_n>KRA!FDkyB^uJ0R#|7=*huS0W8z7$q|1j)V@(mWl6SOwMdR7uY zS@HG6Co6tG@oL4}iC>}k%fvS+zK{45iXSBYd&T*A2)@6;O}Jm-Do<;ONhull{l|| zte@?6s*>l=w@gx;*Q@D@|CsbIAddDQLbk!(5+RSapG5x9rua3)S1ZoTgu+~2*XHIDNS#pA>eD?P`Oo-A>H679Bz zKjv>*?DSKd*Pn#qb4h-V;(Xk1RD2TEdyV4rh~KREqr@Ll{8i$=7JMkR z1$Q3`F8_+;bK<ZzvF&!`&W`Ywtu*2|5~Nz8EXG+f}=k-(0%zk1jpkeewYBmeS)L> zGbH~L!BL*ipLibdIxsB`~%8U-)^B zpDX^nZI1Jz(sK{#`LmLrL+jXkO8yTd{|~`&yeepX9hy(v9$ue2D9+bw{S@ctgvKe( z_fO7Id@;4NN%2+0zpMC8;`b_^L+9ljXT*mqUeL`d8>9Fd;**JUy(_J_Gh6XV z#1|_)?~tCWl>9uBzen+Fi9ez^-%of+=*RKuMaPkM6z@;`1I33B|Ci!y|4drH(XUWH zKljj8@vo7dev0#WouWA37Z|O$w>~RAi}YWp_&nnE#Bp3kkj-#+xsvDW!>a{HKPl{P z3w>8`>@VBl7Qs<|HOX%jT-s;5;%uLtf}@@{NzbE#qaL=;ZoyH03H?Cvyx=I$c79cG zlz)=s|0Fod*V1~sPjHm~gyi2B9OW+}`Gbn{c**An(EhvO9|rgWq6s`MuiB(DfH<#L zXVdSyqZD6Ge4OIX5}&U0^Yf$UEB+zXdxg@|nHI$BlswP7I~3ncdLC1J3vv1U1KME+ z@wb%x)5IfmoM-#IOgyeQ{|+%hasEBvYl`#rNIh|$zZEoJS{1J$zDjZS|8`-?#rgdI4aIq0{9W;l)c!+?|A2Uu&YRe7d_S#= z;ykbWD$ea0qWCXJ|7gYe{$oOMw&!%k50IYo6+c3JzT&K>o;dnj5&0VKE?4rMXue-9 zIIa)p(|q}^;J7|4B>9bsbG_RYXS?kb9QFT%^gk*%>SzCXo;bHZ0eKkS7xH+%y~a>j z&jd&PrSwDY=Za?&&!zKIUYCAG&w223LCh~Dexi~;NbMi0_y*E{s^HkpJ=D$#f@3>> zL-NxU?@iBb%u&3O_%{^)A@O>}KOw$Y@tJ*WgRUgbcHRK~g5f&F4_oZqs`Rvzo~=rr z*Rh`qd9;H=`uTY(v@>!(pMOutqkR(eT*v{%|4H?R>HLn{zk~D-QoNn`IO06MEu?>j z;MgAiyMk)PHlAnBx?rQ=sHdVIY#`jNcpmYG6@Rg>mFM$Z z?$^b{pHuP&sGTn>{uJqdU2trFDYf%m!LglLaa-@lieE(hu;RZY9-;GMZs&>pt)Al) zZzCR8{6pfyi1WC&({;)y#rgNYiAv8UC)j#tDS3XbW1)~oJMizI*C=`ZdijF^{9U03 z?RFp4`?2ELC))P#D+#z?V`-hwqVq@QT<@{O*`BjV&&f(YL3++m@+(Pxnv&=9?fFXn zS0vvcINE0q`N=B99oP2j2Eow|#}2T36LIbr=3)4W;;SrnUQ~P?@wXMTvLT`lBCl274ogOEp`oj$;3{y_1Yh~KC92gDyzyyzsW zhqu_@Qy}psff((Xmy=)7>8;K zl`6iI(sLE(b(QPqejOmW#Y&#<$F?fonbtjC*I5t$og}xHIqTUHpyz(YSr7Mv^$enV z_bB;E#9vjsnD}1B=Mdkgcnxtrf8=^uPmJ=JvmUkw^E#5_;|%jRiN}>5J}(-iI6u#j zuQ#X8n8|DOK`(o;Fu;Zcn-5+#a?E>*w|~D0yzrV#T>VYZPy$_ODlbCGpLQ zuOhxh@oS0SuQ>m`6*=kY;3C)=i*?HD1CJWhED!3Pq@(oqjX$wc^)`O@nTZchxQTBFa4iwg9-g!KHsbD!BB+eS%AWJ1n^LtIp6q4A@TTKkVqx8QQT4hk;E<#ysYzS90r3NG!xLadY0{u>3C_J2=sY5$9ae@gpL5Pl-;^b9T&u_V~tYZHB#_Ee5Q%q|3q7R|uRn{+D z2%n#^rSeim?U!w;7vg7z^5!=+fp-6^Q!EZ&PBG22Un3HYX92$x;tMnIfgb;>L#%>6 zMr3u^e!;h2F05|iUN$v1Lg(u7;}&^IU#VgUjlhpsnXgqbV?p?s6(bS@LSOZP=9usO zaGRk;_H#$`D;GA9J#B;VGdj+K`UdzCj2$B`;&)Sj_vQ<2Vn1#JU*v+$S6)a8~<}Ypd;l2RNmJx z_$yHh%omit*zeRAgt%>l=_5^SOvqK=E0RtD-zcf3%BpMNlTZ~4Ica7MEAdA}f8gm0 zEs^pup)ZuypII{LFY=7^pK_Ape_=~SW7QWM(|W)c%a{*PePP@6hn1l16ukOvI%^G&|l%5~nZ z!e4!hzmL)(E2;3FCvB4d-hne=`A-UGKnfWhHoUxq7fX)N;mdvRRKiXK=Ulve5pD%5&YP_wk3;!NaGZfxJ^{=6lSU=XS>+cAK)Ahd!^kNur6#L`( zdAj~z<$M-*b=S6e)vNIApz9hPP=DtowoqKyAAefW_16Z}zn278Qh9EIuD>dv{`^aAi9xgu zVE^$^3SECOuyppX!pRPSufJ_7)z%XsL$?WK=PtD+KBNN^){l=u==w1`UH$yL8MaRb zT^E+s4CRYg*iz+oXVx$L>0Q@<7R)o$A+N!($hu>2>%b=-lLN|P;Qh@IN1ZSXNntOQ z=lVEPr>BA<)J4O@Vh)$r{?GNYApYKvu6&QqR-%*zX|K!21IpJ>`9Vi1KQf^FnlD-Z zRWNwEO<3h#Du3Zg$qmr5%b|R_@!vw@-%5Ur{)ejA{=6>XHN4h|HBK3YTgSOa4Xl=3 z4?r_4_ra;Sb)4UGMK+ltdm|K1*Zx7**#i4cwtH+pj)iW2W)7ftip4dWYr3%r0=xbb_-J%cG zkFqlCE3>H|k^MPOxBs|+`b*nw30Xhhf712ibC{}&rr`QoTYe4SUxMWLH09w-mz8<- z!{Z$CIRbkdx7$%gMJA`{)Y17iR-S#uG_Y|Z|5(7k>b?fPs3mw*2F@IL-5$wx1G?Y?}M4USzU=kFlD?r46hgexI^O5XP5nK3-*^~ z|8?XDo>o8`5{C|o_$LsLn_y1-?8B`q#iaA8&~NzUCm7-|P0%i@>U+cj4%pUb)x;#5^XfHg@T@y|mij7R18ai~vOU!Y<7se8GhTPWK zXbWK7GNE&kNC)S$%bwVZ=npdZTkIXg6OOrvscbWM+1SuM)N5>fP3N~82WEy%zi=$D z-UnjNjstFJTLtVt1$#7yokM@Q&N+BRwsUAzwm&{G*B>940N(g~;)aLd7{#HU)Js_JJ+spgnRSdFhA5=OOi>Rvu7acaWa1AN0dR1Us@HbXn2FQDAs;n#FIFmnRfYW&vE zE_=$13BDgL7CQld?=yb91^2>t2fMZ-}{*XfBgOL?zgOi?ZI`y0c1y3%%4ZA#60?;m`D3ucN@;7z2LjA zyWwqbxG@|*&(4~k2)5QtrvFOz|FUwjtm#iQ`O6 zop29nTz{~R*WGTWU05&b3V|N1*DDV)n8rD~*^j0Xy7) z^XjmeS6JrA#PAEBT^8ATuq+C5E)&+L*w)V`hHlU{i)Y!nhj!TwYgIF>?dxFQ9oF@K zg55p^8$J;Zzjp^5N4Q<4y-~DNSMZTz!H&my{fGm9{Y2*mDGT>WM%KWw0(E~1dB+tb zPDTAsM$vb=LHX|6)`z>pa_+1{Ib4VKx;?gqK?d1*;JZgoa6W=BSQILgc-Pvg(`sABvKntNF1m z+lOvmU8Zl)#!$?T1s?lw?9z?F@+>a0DIp5hDK5q4Q!&$4Z zf&Hd%$M>Fx{Raa#_3GzlzxNN=ZwlwU_YUm;63%|_J;QU}d)K5pzK8w%b?BJv_aS}V z!OYQvLmjfG!hUKfCp!!FN7|f^=7SHQ9GqNq+xPBeYoD3m-0&{U*Z07t<&ng_Cw%vc zd+S2oSC=ezK1%e7FRJL%e^Gg4`Sw=I8@$}PfjNxPy%k`iBjMP4?VrLvdinnL14rh( z2m1EyzkKc0;SQ^xg?|@?V$a1xiOC$8%l99dbGtq7S=SE720Uk3h5K0IP%-RbjJ@^ch->}!)AOR>vzcjq7Uqu8aR7XF z6~u1>zd9H8$AZ6njC0=jpPgHqah}pVOF(=TjQQ>1V^dt_AB3nOO;iSy-a#;ItJ|8q|BCd_j4R{Xo zu^WN)F=N{&uo6C2jw8plZ=Vb2e$bbFaGtl@w4c{hYj;x~`hxYa z{gB}~!Kcs%-eW%6D4k8=vIFMqu|p2boD6-N1bv(c{hqKD`fTPGmiym4h9=Ng^Ao4y z`G$$Z@zjfhPh)(>q>;|-sil)=Oez?a@0?RSz5q9c@GBSYMvlVWh%qKLvY-%CP9w}? zFTk~g(>dWK9k7ejO{BqYNol+V-ACl(rF>kZ@fK}93tb%d~Mvo>+6)feO_H_i%j3NDRJ2syJj%1yR{oZ9RQa+Et_ z1vz!UFUZlIgsdPXyj@Ud*;|F<=6`iBjZ;0)L5>dfw6GD6+Ln2qmf0NL?4fFovI#=Y zY>xVMRg=883+ne6l7N15bSxn>VCg1KC451SPD&EwRIx9}(dkKooGSGNIXX8{0&r<#31jxJ3S+6)EDIF+$2Fx@hpJ#pQCIrtC3U9zDAC=CTZl{~v7VyY98C~HMYBEg&G7{}$_BH7oT~8!Im!mJ zf}C3H3v#rTkQLEh2(RL42ag^%-DUNb=A%|x+6>}Wjy8)C_ zL;DOTckLCMIMqrtkcDlo@l(UldpoOE{MRAsTzb{2GZ>JS=MjHR+zxsr0F@7)yf5F1=6)r1%>&)Wl z2CD?LEa2!}gm7Za+Qccp1q(RJkH~>Pr#5Na|EQ`|-H(KubdaJ7Iq$}O;ENs+hHHL}jJ{smELyQ{q76wz9E&Gog^ zq-v=-nigKQ_K{%N$={^aAUm2K&hJAJaD0x&3E9Pz1$nQ##XO%PpopWJJ#<7&6&lM>QN7I!?=9PF^)5eydtwW%GyFs4M%;&vpBljE69V$Dg*1v z_lnHsC|3aMB1gFbIO1^Buj{DmA~%8uKIELkQLX@1K#p<+AjMI?uA?5JxvpZbUvoIh z6~GX4lq-O{uEPp)%CGTDA352#g`1D{8u7n=H)~E()tvI@-T&5ImKe1ItU@tw7vv`Y-Xfvg z&`F)TM%+%FkL%qjH*_xik{K>?+)h)wj_Y|^htoTRd%!OeCp%N&X`YN@Vdr*23cpx% z4Y{2+_u>5gXw}qU7uDNiY)B~cSg044B=!vPG*FZ+N z#|;y}T)pzZG}x(uJ;xd)y(7jRebUrn+kZSZ!&Zy6^tGx{Z$Dch)e`qLPwi@T_a_AH zWpsj%#`TPY_26qPzVZP@Np+nBNoyd}!IQH|6e}NiJaiBZJGaC6k@G+iyspmeG#1PP zzx9WYL%R*}>%y*JZKs&=gI~0Udj0|lXBtRn80U_GYX23|1|@CGrNTHsZb_E+W0;Fe zV#Z7o3}1jMoz9_Q`0JVZJX|Q>{F3I}0_o6*nBgB{d{mAfKeeNi`CWkSTG*J06bohC z1#t}Fsafy9E+b5DY0pL&GF$t8dDq14HzOh@9yQxcvyGW;mQ|aXLE8P!oa1-Khx5|G z>U6L!9lSUlT;@X<4#&9$?CoCd!<_E{=y(TgVvdVnIx|g;WWd8Q5YId&<3V5;GEOr& znXybXWM{)*lLP-k^_X(+>kp%vi%|^t+hJ%S#@q+4g{r$?6odP~D%^R310X>f{+ulM zXB<8Ul-gjcIu&$v3zbg5-oTS`Htd8QRn{qVEK|2rXeNjq_glK&M1I^%&x;`Oj7)U1 z9%)J+$A9E*%G@S$ddNi2(5z5#&roT21<1kUbFdVCt@j&PUFP3lYy7eiu`1#(6 zjJ1A=e*zOZ!}{e!jGsBk$lw4(#??4ELjjsm2|F3+hZr(e`#9$0;4m1GgsnMxe(!lu z%E_!ig;?O#sQr}B_W?vtw>9I(d7@)Go7x`3_!*^M&CzjtoSeG>a?Re@uko?0xz*O3 zIj{Hcpp=vON7$O0=VtnS&ZIu$pUq{8K4+fUL-aGls)|+j?vKXKJQ=n|)x4PfUILmg zHr{pu{{k#F!8c!QVjrO@VpV08^sY0izU`^XD)dGotH@WCHPTm=HL8y-p8aX>tuPwB zjSc#sIWe@uKXSC0Asj8=*=8DN^V6lFlfiY58)|xiWg$^46IC+NDia$-!nP*zP2*O* z&%~U}iLiCi!HmmAE6l+6Hp^gU8Rnr2n7qtdGc>&~HsvnEJRBsG7i%=O?!DIJ-Hdr? zb(5Dh+ZeC+eI^gTbmgKMJv-o9K$G?wV~68IrPxFF8e@gyL+1JpQaGb~Sa-vGI5>u8 zhYDcIxNw>W(+74S>gmPX1!Uh_lznee_PxdE_U&!ukGtOtv90U4$7JGJnRrDe-V}+x zQ^abKJhf-oscnru)6O<);PjKI$0MR71(EN>QA_4x^kLh017d9km^o-bq|N|b(|Tjf zmWwtSitCM_S@R4vv(D>q6_lY4cL-y?KVluixIDA3bO>JwUUhtEHWYB&4&iMe+wWWE zpo0Vw*UQ8=g;y+{k67VWtyUiJjD$_(3EWm(e(?kJ_%AKKVi>D|3}8kBeMy zl@+_mWTC-yR@Q|k3(X<2(ivv7GR){C!;B6;il%76=Yc5nTP+i}%fv%6@hg!aQ>^w) zfoiGmYYjDh_i5%WhMI2sG`7`H(_^1zS&uNCHPq{;IX2rfgi6)V$}lbuzC%6%&U4`6T8JChe1 zkTx%l z^az)kWerUno^OwKcti_V+oPR{!{01s;@Pz~TKF&xExFHJ{gl^~7m{HWj>3a(Ntp*2Hq>nFXt~d&Hm~JN)mdQLBwu6wyans=}Kg$~`e9s>Z z)gx-C9x)4uKQxc1iS>vvE{u)ol>2xXPeT2%cubAW6J})ne4TC=W5sVjOk;F3W3tg_ zhrfeIvhY;_W=7MSp^2pqVX8JB6wFbB67HNZV*>s4t|!p4q56(+DKi*t+zTSzLbFab zyV-@X>n9uQPm!0goV~Kyuk5~G*?m7x32Wz1l${SKJAZ1#m8+E+R|EGh$ zbd0U2-5Bj_%J}`8=l3t$ToU?zliXHmLiq zu?4Mb?;1Ov2$>FK;3CR#JRtZ@bs$AU(Ni_Gr<;6i>E)stzbn1m3fg{R+Lyf0$OqGVx8BXqJgr_K00b zGw7Vm(yV2MdS`0BgNfT4^UbNE??Cg7gQXSymWy{Te9>X~Qq6Z@g%DO-19v`bA6Xo67KQd&B>>efyg`uYUV`55KkR#(rsG7tZ<9Q4dXJ@be&AhL#c}YXH)3T_k_QFNgRdIN6oik&?yPGbR-#CySDkBV`i)2BScw@$WT+div9iWP*RikxcLpIt20m41_xh@4CZo zlr=j|wU>(Cm=4Z|H?Un)W-^4lc{g6OXPCy?hU$e?@TVo#JS^B$Q&EsYpcAQVwo2#qJs%qi&jPNQ)G<{jw_}R0^pI>&))C(q;%{jkxa#@*ER}Ze4 zG(gxF=&NWX`~eKS#IL&AX|8XssB>CC*N8$iM{`AUwKKnE0lcKqsck~@t5TKqi|~zq z5@Q>UGE_6F2-MUz;h>0;D56U)tQu*Hu^a*|WDIJQvy>rP%pZ;d`or zV8!Z`9wb52+$3U~mV`tLk~oNBHTHF%^Q)_x>zc}d+2OAB&5M<2A@ndI;#ZM`v7~*w zXIUe>OjPu*Ab?|o(wD$yrOEMYPLoMJ6fYnZO+bZdaI1o~Q6+vIyY*#_2``i0=Z@SfERy`CiHnWGx_5pt52 z5lAPm2c~Fkv$3}*WZz#aL32f8@=JHgutLVVj%byLf-~0ns}R&`2FFe|DQ0krBKeYF zQ6UP;!f9-n^7>h*8kx2dGIM4C`MftWRWJrkjrK*RPJK%=x)B^zoQ8_#8V4PDfn(fn zkyBY$U9qU8!D(t)=v-921plGC)i%IuQR{J2>omjrfbopTasEe6zwG%VUy+3_o$Z8{ z_6_yU>1TfHH21JT1g{4$V0x&D*oA~RyspL|bu?Jy z;7wAg1NC1^dF{9_&N;sGZDI3iNYu3j83eebH6ae$M{U#@ix&i?ImhSU7+#lgQ}lbW z+p;%eomg%!{KK%)?hHFXalEF(fO7U{dB=N(8d)E@&@gRl0p(?jRXsUo#HS zZ!;2b`w{YArhL3v;Cw;-he=M_f!}4tV}|V3iXxY3;9{1P;VLZN?k>WDj3 zkKn&?qF=kHvaY47dLGT=f5SCHkc#>mxBzLYx@h>KisssjtA~%sE6f|2H)?p(lBUM` z`sU#+O^w5;HNz_^8Y^qyk^$Zh-LiNXmYg@g78bmKj(!Ez@bON3AGJN!n7TMy9;7`P1A z$)YiaYx4U-p-3dVYd8nSH96-2$jQonBsg`?3qd+d&76+8^AKaOV^| zzXt8=p54_Be+k%ghH2An(5Awu`+*C}yMtyZ-y6*1E^IT&k>I|FM@CoD{yVh4((K1X z-9<(+jl-?ZNL%BFm+b;|?$!*y#vG{Na-$ELQdeSPBcijZhO=;=M*l1oJi3<~K%ALwG>X$T2gb z?i-iJ#=5sfU{1iBa3BS93+5E0Bkn#Jg0`iMBIq7_Kr{kVH&XHl%%kTnHD0jOWbM8*)||$4k3hq^XNL#%Fzzr6 z=8S38V66BND4*s29NN_#1|93}4ogHwtlLKRM~(yMIq~dBd|71d%t&NfzM`(R$TACGNzcu=RIc4mVinA`4ZzR%fWJm)6gim*bauN=~)Q@R2+2=EitBA6^*?a zbq_89w@f_}Toc97e>}Mvxv*NH^W~etE{U89eplkY3+oeD{$`kfsmHtxpa&y4;OA5d(s;nP$2 zQ-;q-;ddK8GlgGmxOoUKDesSl^OcLAWgj6r#s?I;%(UP8J=4pdX?Vm-b7ZRF-gCK( zons8gtJ>u7Thku;;Je7W)$qQ8*yx3Z_fO%4M!$HVgCyz=KQTpqqT$}pw_ZLx@(y93 zm*z;8;e$Ep?cX=;ImJtJ080~G`yg*hj_ah37Yf0Z zR*J0Usr|A%)t@a-?XTsjer|cH9V}0^gXO8~u;r=#Z+YtaYC^(b^Cojly6 z1Aq3<=UL`qXcx!154e9Kz(2npQ190R_$kqZ(!;!%xYkojob~V-+Z?5bx%mwb^0b~Rr3apXG@*v}+%M)0#I>Hq z#JN3uhP_njVZJgz&$UWVe@d@WdYG>d(6gC1w};2?E~SV0_5eNi6CVx!a0kV4w}awi z6n~mH%72UExZ6!}l$U%Dag^siB6?ZKOa3Pzzl!3x+e>lOFZqYWQU6U8$K3&nqrBvY ziKD#vD`86GFN7FSUUL3D8|81aB4(Q-m z2K|$L15vr)w^JN!bc4qih@%}OuOg26zejQ0wNf1UCW_;ZeGK`9f^Vic^6v_Mzu;F2od|&WYf=l^zg5N3RW&5T4qeA{7A-_j(DbMo}+jE1E|1dzF z=NHOfE#!H=AeZ_FKpF$`MjJKTJ`_iPz;j>@af+ZnNX~Nv$7LZ4!=CMr{6@j&P#pON z!OH`9o!~zZ@;qNqkL0aFezlO7{TeTLoZ{Fo$z{Jb3VGSDy9F<$IJO7R**MIl2y*rr zMCF3>u?dlE=R}ghU7X_BPRV6EZzdVs$#!lQT(+}DaM{l51TUvJw*M-@yHOndWU}Br zD30xvd@OO)!()m_`omh1!5y~^yDaAEkBlulHp5rLbam?N!ILgdk!Uz?LXg&m@V61>*+%>TF+eK zs7KmO+Edz%`-t+=4(un$?-A|UE%Zy?1LQF1dW!^?^-dC;+koXuiR=E(C9eC+ujs^j zrQO({(f?(=%(Z^Dv(`Ty8wEkz=d0Rzl~rT($o8xkT-u-gS+{dL$?JCR5qhK@c%JHU zDJFSsAGU+8H^|@Shcv~W0H>{j&`dO^3tBwf|m;U3c=ZbP*0`cGk|X@DicF6D<_jFUc1M@Xdlx6M7B>@M=0Rqkbv>LI6LbyWf5(zcqk& zr$2Jm`oAOibkWX@^bKfnRFum8pUyUir^@}kJ6)QkL{Q1Hv1Us{|Dq_;67^3ZDW4OihIXO z<}T@JpnT>p5MQeJo5XKa{Buh4v4HhFLGt%1c|4wDc);#FJD)`SVa56U^$ErCcN7di zw>wYIY~s%;KA-ptiZ>H~Me(bMzoz(l;(t}#ylw*6yNdJu#E%sJ9qBo!c!-Wqe4T>+ zu!>}G*OAJxoqLdcPvR)QM#!I_zfj2Efr1n+R`QpUe4CJ;&BCzXpyaP5`8yR~L;OdI|CIPo6~Bx4&xoTP zMu>X%DEaktT>qnxm*+X}DETcUe?ag#LjOU*aoy-a=K&eiE^N<8A&8h!*Gj|Z?@RETXA0R9#DJ($+s)Mllbq5vz;HK^ghKuru2u3zd-53 zitnW~d}rJQ*8etf{Cyt-^S=|v=NTk_g?Opr*_58I_%KR;OL1=J#foz~+Z5+^UZ?m# zO8-#tzLb7e@kx~alj88*SQFk^=?x9Nz(sg;y8~^wWc!LCzSjLG_Ri% z9Ow0Ev`+m-aGckJXg&F(;3)q*$^S)glpjj+{~*rosewEUhZSFGv6CgPzp(x5h{G$n zO<+BD5r?;2C-EJ`hY@Fg_ygHzs^b43UafcrwQsrN#}ePD_+a7>6UTO*PHn;6FO~ce zvj1-t=k@ciim#(}^<$+!Ms?&;KGrL*i~A90J9MQ2rwESY_%N+A!v&Y?`RRhA{1KA3 z@9g#GBe!#!lAla=o+&u$&nG{zuQ0UN#n}GE@DD>B$#cKfTkI@Ryq)+}itiKINNPJjql@%pG*8X#cPSbsyNU8w-mpYu9j{0KF-X8?_34*3ys z92b1;GltHB%W;eoXZ`Fe!xZOhxziM%Yt=jQz6Z9miueUep07_9D!!EDFI9Xc@s-56 zzxbRJhMN@MMf`5XUnKsh;`rPWh8Go&(!BaBakNjuNZQRuN`4gC|1-hS{ylkqQa-nz z=QTb*iGle)XuOYC{1f8Ch;w^*yzEQb?R-gqJ|3?rN*>#UVUFVSEOziYPYkTT$|jwQ zh;uu6on52&8Pwk&Dt;dEUnsta`0I*aMf@;vY|jL03+}RMo#6Hqliaa_V_$jw>Ls}J ze?E?}o{=OshW1=9+j+9$Z0FgEvz^NnXFJy^&UU_-IJf6cvct8CKSulx#a|)5Q}GXo z|61`V`PG}mvA>gqo$cR|`TltU+4*y!2m3mi{XW|k=JxaY-$`(kznAoM5gf;b{U6_> zfC2TOy#0F{$2mc8l;?SoCpgNV(g8LQ?B56Z?dS2GK=Rz*gpr0c;(u0r67kO!KaY4nvJ>n77V*;* zZzVoaabCyHSA09kmk00~#o14q72iO5S{1*O_*&vPj%Sh0aJN~>SChYO7aaZMW=h{L zIQkX0=TX5?es~USAhZjP@(G#`&kK(7x0C!H!BL+5@Gpw9JwH%@-$`(kpGx|B36Ae@CEi_)A3yymJLVCjFciP`N36AoY&<{sl z1jl;We@-BdmiRKoHxR!`@DgIUyOTKg>rS%&j|9hl zZKHlYAh@*u6N00Blzv})N^q3tdHNf{QNEhwUlJVUd7l22INA-{KNS99_^0C2Ep|GQ zKXSkL`nk8_>^}n)=kv)Cit~A6f;hHk8r6xrvz7eAWX}r($NsLT{(e(%>@S}`d`obY z|A^!l36Ao--d-v=%73F9Y#=NX9Ob?BR&bPmhUBjk9Oc;#-xnO^M|Ot|gxds1dA83s z!BPHplD|)Il;`>QnBqJx&j^lsI?@lYzY-kvuwVUNab9ot66f)1hcX!ct~mQoHqCpM zUu?ylk&5$q$k~cFko+RW*Ath|384RMC%#3=?)T+(`TT7Jaqiduq4S)n ziua=H$1=tFep8F$=aKws#aoEqP8|Dnwr#rE{z%FHiR}D{;MmujjAi}msE45%MD+n?=(T&`n$zR%qAf1zKlOMD%G^2k}fRLGZNLnzEu zoaOsaegyL6`j9WUTnDf(7*Jl$_i{rmm-D(=a5;b12rlR8cERO*Y!_V4yEg@w^Nalf z+nFF4-0|N%A(!)o#}T=l7yNt^a_RqUPvp|iTOo}Bx%B6Cf=j>MDY*2{R|S`T=!AX! zJQhg02`>F=kl@mP#tJU|gr9ptzmop&A+-m&^oMgv4|3@bErLsbSSz^nhr#r_7V44y z@QUElA3hRX`oj$w);_35`h!dN%aJFnh}l*OK0)xO1eg90q4OQoBmLnv!KFXEMdvRl zFa3dkr$sLPVMEL|0=e{uHwBmeVBe!<*Ei`8zs&OWNPqa7;L;!L*N&|o=?_j`V|86c z9)2StPrP&-KTTj>m!4NuJ-_9`vWofh8>=sNj9fqw^CI`W%KC*1tKmx*X*GJUF{hW& zr+fe*3E0;HCx1Kv*ik;GP`wad>mJZV^WOEwY82qUQcKc&5CLC!p9WK_(&wc8RD<{a z;sAB{TK<3!5~RUYfBKw)bc+1?(-*?}(|nKt`=16={poWG(v|S*PhUuXRRJrOA5Wkf z6)H%Q@#{dbyvBNb0exQTM_AH(JH4Twi?MIOE3LhpbdyBB-9Nozepi1Q&78%R@yoN1 z`k@9i&leT`!ml`hEenE6`&Q%%Y`5$h&|rZ-(u+gw?b*IY5buG;fQ^TvBNhbXFhX1_&}W+Ehiq=ei%8KO5Q6A(j( zOMwLn`R-&z$??q59Nz!W!%$rV!-*dYOKUark&yIOGoLyM$igpGrRi_dM_Q=6Nep|N z1gNu`!C?-oV7K+z+VA8*!>LU~yid*%p{BYygij7`9b;1txByMWan7Y@v+V78qhSMWaln z*%q2@0c;oNnP|~SlL=cWX|@H1m`zcU$%HLrns|YUn`qGplL=eMG}{8RHMpqIWWp9Q zO&q?|hH=D21tt@=0L-?)Zau?-Jqq%SR8hW>g)PXMc!7!YRj4>I|B6w(4@Q>?NhP=3 zVUw-dN!WqY?xc_hDP(kd@8u=DSaO6eKRk%nGGA0a$CI=XT^_HsG(*WPl~$fDbPgo3 zpLCgEzH5ULeWBs$>gQ_(zK@5p7<64dp}b}&_bS!T&qHJVc*&&e$LAf>)nASf!T`JT zwz{sr2h?A4p)Df&kC$4y{<*-?)xVPJKbrj~g2Hs=*HHPLUdwGnxBpBiuNg|Nr}p!G zD6}8CqHh2BR6kudV^I_M?>p%7lCf#4mw?D@5J=blQc~D1g(0rniqC;+hDA2l*n(T^ z&b&hje3R8VgP zrHW6Yt@i@rSMIG3K&$v_5xuQdtF+oSShQ+ifLg&v`PQ0QYwtO8&W705@4L6Z4rI@o z|EyVS&6+i{A7?)pp8<^%`7cEJ`8qF&iPJS5+9%RqO8WVF9qPxQ2u%H@q~G-4A`*H! z|9t`t6WL!u?bos4loRZre}?uZhLyW6S1bpK6Ya;J5>5Nlz)z^(wEqJVdOG`?Jl2mR z)V_lBb7tCF@3DTYU#41YqlRcdj=5<+{tlPO{`qu$=ydkK2z-hBzlhqO&i;MCXZ8tA z&a1(#`_4eLzc>7u_Wz3XoBl_+m`-Q^M<6hf{rjo?ZY9Rqnzp_N?M)1s50d?Q{G186 zX+M7EJdywT{>9VTpXFiydR$l_<)LsbnYIq_uz%Nb)o2T~NB{SSKhyr96#t~o(X^Wk z=ifoN!qh()+M5{i7S^g3`I`O#0Gax~Pw{K&FQ((3kP_o;OOsHXX;-<`pxwxiSDO6-TV#1z$LOjjoP2?`0aI% z_L=Q$p8_39q<>&L+s}tM$M&PhPn_jZd;PZ&tV3Q*oIeEvf;6}>CRI`U^cd9jKf_Nz zdvi>&uDD)t=<^rPHO%pAr1@*=Z)&IhI*<8Vl|VoG!qh+4L;w1A>YwGIzd3>a`~>>_ z9{RVmQ$L;*CG!841o|f?(0_-=_-|{ce*8Twk^Wr?^yBYnrvLG|&qVRJyPf)f>7jpr z0{!@VovDAQhyVAtQ~zKO|F6;}-5CH5_a5UJvq34BP!U3%79ZLx#$EYw|Wj`$YZ=tW+&Z`>P!7 zFN8nS{(&C)yVH-(b%sKtDEfKmuew|54UuuEzbJwJQKX-bGgK?MkNRvyT?6BzC)Uq7 z{>F>6**@uf)#^gMG4UeA?RU}qGuXr>)ZWCo9pm^MG-Adui&ARO*D;u%{mNoo3Q1!8Mt+yKU1Z6-VZ(WZ)sI6bp3MyGWE}c@iF_3 zEnh{0AsswJ=hT~-bzrpWwOEtzO1m#5E%2UTk<`D=m%ikn~dryJ!+n4lRqRZ~) zWH9V#ZxNTU1XhVQ5}@C&f{^BB$$@43gG1Dq6pksm1#=!iXv+3xcewrO=5{)@cQq*L z4iliVX+K^YPZZl*h`&&4hklBW?J@s~ZRw)~QFPka2H*WFwkg8gxy3R1|39|Jey!LZ zJ#zF|wQ{$A-9EnD>AtgWkHQtk-i`9ucDX?0t60o2Br2Yb)3sfmU6y z++Tzr0q#e#vcf0&H&1!wtiZmr1JKTbcD{gW<7xmO4=7l=;o<-OGhvw!icyCQqW?~Z{Opg<2xMEsrevpur)Kx^4Nbkr3Z`Cd_sV(F zX9Xb-UTAj@zPaR%j5mG3;N8}^)Kyk@S^tHVF6%F{djvm=+?ny2uY2%nYkcb4z8FX7I)7P8q=o#!~k4v3oD?2WIaZBVg(Ifc9k!{h>fbTQlV|ymru05-s zTOT=SWd?gEKNih|er4Ld6WTSY^|r`ezMjFiw>=Y`0DKdGFOhw{d*2=z2Yv3H_sA*j z`{L94Bjc?e!F#Iy^OW{&5t+faH*D^5D%;-v?C!`Ot7q_@q5pYG+b$j05_waAZP8QP zwrbS3BNu`1djH^=Q`+|S73(8SzRcjHpFVnO-z8laSt-E2aogkU>jh&m$yTv(>CSbL zzrfhO{k%4|D=@}-1}ED25JM_PdRN^Mc?*2kJFwfe?=lr@zl2!%!lz)cF&?qPd?+?6}=;4lAT#3WA9a%tKhFycK4!*f7%6O3Tp|jDHqQhW4z=cqpMgmz-P|d4l~j|Az_fc{2S58B1u-7x(Q==%2ltKWVqp*_8~-YVxF+H>hA-;J^7 zF&NLk(3tIg<)%nau<1=-X3^c>*&Q8+`#s$6490aSGq@T0{g!Wh&OL?eBA)@zr0buK zJ_guh5F@Lh{s)(TC*vBB_qv^*bK=<6NIl5CxN=+cc3(!Y0b=1e%!eB<*_?4goEaQq zkIVVIVO`{R;>@DEqmM;5+Z}>;psw@O8u&}!IXUAyY>r^xue$9SX>$+U&*rMN?;#k= z6TS&KtMYG-{0QVtfc~#~cxUuSfd5GJ4*sa>hKwJ9U)F)nH^sP|1-IQ5dDGXU=sSo0 zGx`u<4~cHUhZbI+@sLOk{u$!y2{AtB2e;l2{YozS_^W54>tx%E;JWGSGS&%yaHKCe zc!L<6Gh{F7^B3K?YghEo7PjpW{PXZzGyZHP1GBSa$HI*2tU*V_KlzF6#O0_UIgF^Jf@4WlN`E zk<~eP)Eba;>8rO!M*2Dxt@`NcC}Krc?_g2&O&LWXFJN^FUSQ?sJbvE&kw-u#=qS4I zKc0v_0{A1awmx$4zhyjPr3U|xH6o|+qPrtMu~LgZz2u=NwhLI@f`Nkd83C(fu#=UO zGd_BEBpYOYAC8GW7@wN`-&V(>x9WZv&4&7H@Nf3;4H;>0Jd|Yxf^#h^_|brr?0^*v zb`DwDX_I}~Z3Dz6D^(ujZpLHEZEH)8XT$Lx{+(+Dem}($^FNt06OIv!;8<}695WWe zvE%vMzgl(Pc0AsMe`SkJi~Zu!fC%sT*!J!C z#I|;PYKtA2-NLs8tc;;>yt!vByy9qEa(GX`FFJ2a7JJ|wz+(b|=16xd^X1?8GJd}v zYw>*B$TL-FKkAHoM!7Lv{~I9|v1D`?}u@vH$Y5KIu_wp4djV3u}R6ykbIxanFh8`g+5G?{rhUw3)`@NiTd^K z|G<9DvsAyhPkMi_uh<_PCmnbD_(SNs1>@$EH(Y2+9o=)u5~1NjBO zlM8uw;2EWI$ukbtYJ5kEyVB1YsVf!93~+^T_9%Q>Vf>hG85( zTq`!=IKur$8~eZ?ymNnJSNQ7=e;?Z-=Y-vF2fUYe)4lL_3H-q~i8hUev4M9pZ)&rf z&&IKbYnxpsbP$`)?I(^lCyV*F!()d1JBZG0v^L`0YO}3J+Sd9WY0GFnyUpHr_DP7X zwzVyjS3->3xoYL{ELivRYXkS3+glv{Y=GF)AL9gUJ7j0d@&63sGL znwkkQqSjr>KTUpGZ!^*yBZV0~Z~k!Tl{w_+B57!1|;;Ym2 zld`Kd-ffDeA~$9?|QfTs=;L&t>P_{ zUz@Y*%{$IrlXd9Y=!s?3YgRvT`@cml88LFl(Xv;c|MK;>%5FO>)_gIe=D^ZJlYZ9l z@RrxE`o*UYmGv36b;^BPFZ$yr4-Wn9OAB_+_+@VY4v$}bk`k$RGFXFTvP3bHA%c>` z$5!!HDma;!psujOVFE!+@_Qq{o}kT24hWjdq%LS~yDiFc1Qj#6&w(n5ax$-e4Ro5! zWpbYb#Vs6OQbJCX2$TC9C~jh#Qo0gr6Xi*w^KI8|<rWmc5gWEe55rrZ)$+KE)>a{L*ytm}EQh23>C5}l~%4wbKC?-8>HK?N!$Df?|ZxGl- zyQg-o20R0Kid$kKlVeDp<$P;}0C)*LB?h(;;YQCwuHxKm!uWh5U^QT})PX8_*;`G} z*INyEsRP$D>B|0lW(j+(9rK>OILql&Em2Npx`vw+5{DXdF0~QbuHofIr7@yvsMJjP z*Am5^)SSARj z8JX(#)BlJq6za7@ce zIX9K>ql#B3x5QFr<=kwtnJRWsuELZ{{ESt*=1qK~ThmY5OK!v_EByz_nm%`ydv7*r*D7o_O0?WtovlHgGW>R@^d7xCb+#7tfcx#n2)omajETWXeqSb>3R%{S z47h8uznGCR9v*4(4+aA6C>#h}=LCa*bU-o~JO{`?cc`>GL0c%K;EkuLxuBv;ayawO zsXbN2ke=uE6e8#szDxz6xHOGzB$PX1H4>dRv{=^2jPFeC*%^ZSjGJ04sMs_W3`@_o zSm0zSva?@W)&-jOz@`~4!;Fk`dxpTIu6{5TtwWvN&XD}wGeAx-sBG@hkvkvE2mZ{y zpd0O97`!-m5db|kJ6SslhtGhbT32}QF){t?qq>28=$ipQCMj)a0+TegANri_3Yj|m z%4P6jVbb77^Uu<3^P_D860}pc4MaUsfowU5w8;WIzCZ&Zi$h$eDVJqoN6?+wsRDf= zL=LflS?pJMhQbv;ER_oIyp|u@z+JSCGo+3Y%z)DJup0|{fP-Zx#AR?rBuUPY0Mxp# z9h6YaM&1}22FTiIrPy3$1l83QY zZqO>mS}XTa>~|W{n9||Ts(k})lJ960zXMsPandicQk-GU^`$RVT*CfK=N|#wSz7Jr z7$^lGyETb*OhO$&3vVYE*5q@M*HIWktoA#=&;=;*0BVCV1aLau%V%{}w6s!o&7ah5 z4^#wRKu$93GJJ0R&4@MY3DnZo`tFiEfbG&)Jx7cm}| z?=3)Cq7VF$!y??72%3_K26K`=o9_pQN$UknPnGbJm?iINv@XWZ!0!kuSr?-aw|Ge> zh{4{zTLV~amEboa`^5RZ_zbHUS^5@Ri)5E(p!myFSFu;tWnqacdb&mzYV<7iUIu9h zMn3iL5cltpK3MOfVV&m7IFv0Q1d46AY+oLM2HFdc?J8os_(e+ePd*FqI;`AiG-xaEEpiaiTG!RaX=tp1k&Z}ZIG z=9&Sl9Iq=-H?l13ylZNf(UolL(hk}yOst`je;`Y;hFR#QL0GniOWLhd<+xG2UXIne z1f%HGh!6_I1b*arEU^aD3RNPF98AkcsWh<@K8DB149Ou_VU4DxV>FJI8>Veow>$;9 zDF>rF6K64z3q+RhR)H_}mf?CH5ZU$J(V&X_#c zOFjK%6KrvV)O8k)7pLzbzTWZ=j~Tn+|69iGA3bo+JjXLV^6+EEJXhsh->tZ-64q{O z0qi<3pk%V1Fs8XGkHAXnHIS-O9uI=`jCDq=^JVbU0EF5(ap0I*PMnVRt)Z=Q;^gs? zDJKlV?U^z$JCWEalZGmA%AhPcY2ux~Ud@eA{H(b(UCs@t@t8Fs*kMcuNBVIJxW^Ug z+OdT6w{qXVw*MFpd?U~B6-*p)Rc&L5pGqEs7Vkhy^WL z+*n;xQNr)`0|Um58GdDcnZTC=;=K?hiyN1S#ufF|OIK7@gvvoOyd`r=Br@gVl6f;O zDJYqLadAOONep`pyh*dBcE!?=(+u9WD(c~7lqK*cV3u3oxZIVC42`fEJqlQm$Vb-2 zl@$#&^(AqywB!nurCu2;-%g7{${U(QLv2G@jev@VN&(g{sf;?Jutj<83Vf?z45qy* zw|YfgV}pQOK2`{Pxh=eSu}0KXE{Wxjc_AVSMb_HJ25ef{R2|D4^O|L80eHuKpQ76f z$0X=UWpqVZO$pZV%VG6iC&K8poH|>AHxQ#ldgrLd>1dY5RMsq!V=pS;u8(@S5fh-W*d?dzGlFURs6YiX(buWpr_EeWj?Dx6O!e@|jm&-K?u4 z!diW%)jO@9Jb}ce9TVrsCl3oC=Qfy!;SUq8<)@n(?`)*(X z7Nu!@OKF)G6K{_gjo4JczL@xu{~OsI38BE><>=cn}z z>oV@|bRV`uz7Mb-(qY_q@P(i%o%WS@#4U=``sT5``%~}3eG$qVLp*E;_NkDtHlR_y zY8Q~Lu)d1w-$_uP2iSV5$0LB#`2s~e1t-!;@=Z~eWqr}9qks&X!k_i`uY|A$CR|Kw zt6*8JuUIx>MOj1jm6an#=Z?x9n>%hq{mS}iZEeGd#`@@p>J{ZRjTMz6%F3eURj>}i zi(4C;hGWY`i>n*zy+p?^ukq_NiC#o=PT+ij1snPdZ$HJi+1BS);nTm)TG!Z6T>}st zh$E*Y;3}hYDs1Oket&9)-wK=!NA2K0t!lL8Pk}1`Y`?WOu5z;FPm}H5i>rD;SpJOE zwQ~yQKwDqHkouaewd-53-m+7R;@baGa`*}}{hgEd`ZJPeL0fn=Ht@lAAOSZ1Jc#@fH>Z;{Hb>8v1I!d=odKSzo66I z!1`JKz7c;<`%38gtYrJZnj(MSWP6XV$Ujti!~XG_7DS$Q5b)1Bf65R2osNTFX8ThE z+aa6j@BE41-|X-Fl;2zg zpSZRq+5V9z3S0&Le%LBXwr_zU^C#OkgZUYD9nf|<4B4y%gOhCk0eUke*}em8Pl4Wa zPPPw=z0l(6H4s&W@Yif(WHqk|G{l*4gDuT??wdCQhirp1e zZWsAGCa;^BY(KvmmlElibCqK-Vjb5&<*8i*ix9Ztm~w@`uYI$<7bF)2CMOrqgkY#^ zk-Acn?XE2-_`g=SfCKHcZ`pyJ$@ccufy2sT+=(SfPr~Ay=zSYK@nVX) z<`>iIbGev@VlXUxDDnPr_|GJMRvf-n%6Cr0o%(AfE-#Ka7!oTaJ~#%$!nY)jSCnGY zEQ!l2G%*#EBrY$?#Nd9350AmH@QJivp4Z3JRZD*D5)0KXlz1S97Yh$dTyA3OZk7-q z*|=2?NnBplcR`@8mpHy7A+DCV{52t_ z?tF>E9qdNxC-I9;h*Dymk2rdc*!TkwiFzWK6QP@zpDA;f`-C?v8IPK0q%zw5=|} zI%Oto5x<^b9X!UuEHSw);@5{CK)m6(i<$0%I8B6)0{$-iA#!NMw}y{^(Ci}L>Z>Hl z^BEv#f}Ac|9O5|_rr$_8?s)OavI*+C$hR{~HX+ZqfLt%-FqdoFEXnWA3qCK+kn-Jl z%UIBVRyCUE*6Z&AFbhGq7fgX;nOvIB+$HvC^T?xGM|WU zhTer5uIpW-;kw>Z4cGPZ_@aEoIq7jen?cCmAR7J8eMjiHhU@D?67XR{{;;IfhOe)h z^8(`@6XJ6eDYvsU`~nSML^%2x?a!pTQo^}kj8|xKboqSasu@2G#Ba_=z9$#$)Z;Kf z`r(?6(9a6zYBj_P~#N;N$(OGbo?uJ|b&8aQ)k>I{yGV^)lsD zd*JtKIKHcr({T^{96E(V`8xkP5Bv!a9IiymWXhTCf#2?d|HuRX+yfs$ht8;X1a}tl zn?3NKdEh7OMx=-Bffy@ zQPaq7lUPLqh{Zt;T;p2fWrSeb>NBJL8nQcHn===SJ2LE5ETw>t7|65|pW1o<;ap1D`_pPEEdkJn)Lae<|_5Zr~RX{%Zs0{V1MSVnYA) zSESs2Of=h{Mf-^_4ZM})2Pj85XK8W<8#u=Y?x!)aeBOW0(D(-^7P-C1;GaPD@Nojm z`4i!I9*v3dV}!5NeJ~9-aPAj>)1BqeZbInaXwOn2({SWZrsI!W4g4=uzMpcmAMNDp0=o_VFRA>3 zf&Z1tuNpX9yp!o21NRaBfq^Fx&UT?a*-C`may^gBDr(=6+A+@l>1E*Thit-GJ{>-Z zsT!W6>0O}7K|jAub(a}oH4C5@Q&2476T6xek-Pm_c3@G|Lr#lYEbZyETz#Q&~=e?a&j4g8OUA2)D(<^hvU4(IXu3*lWoj$_X< z_&JVqG#tm}2J%m?hGT!ZUlTPP`QIh}b2J?JxxYmkj{N6Pe=g8)zD2>}Z4Dnr z7-lSw$MHe(=cmMvIQDl0oo}4baP%9G3x4Yd6Z7M@k1)ae;bda@eMo*c4M+KKYl2KY zH5}!091hZO3N#$$bR{_p2uDAo-|FBGQ>}sX zb%z@?e7Itj+s%gjJ>-Y`4V?YC)4eSm@U`ZmJAIj$xdILFEP2F~+wo`DY_d&&sM@zu{yYYqNa zi2o`L$9Nk;=hdq;9OonV>qZSn{NB)CGVrN{A2#H)q7X<&4Ll@K7(a?597mLY2FXb$ob4$je*88kCg!i8^ZAhm zekS1)4g7VIKh41JB>q_j{xad05YG0rN-JRhW8fU;w;4F|?=*0Z^XD~Ozi#j|!m+2)H-7r+kcK0Fh}QEX2CnYc5#mb?M>(}=C=3$C3+v4yIcXY>{0E3XUBgi? z&zC+1oQocNzM@FwE_v4KBA_|FM9?f=xk50d>n zpG#yOJNMnY?a*ePusTm^k>O#F$Pw%h^ZeOao{6>_6t;MSS@NKg$mr_&zEZ z8aQ9SDAn-(L}ONE;A~%=hMz?=W=#gp{cP6o0YqcA-oOV^d8398CK|IX1|FhvtA-CD z8nbN%-iONUKlEo7VVLbEnsL5AWS@p-6OGw^1LxzbS2a9`Xv_{8IG5Wrd??YFePG~+ zseDAkhY^k0aRYDS_@o^BHC*H8dCWN5&%b9Oj>lb`_&OisZB!A`zKECYXs`13S8 zkA*{?Z{XXg%;V;Va(|7V+aj*V;dJ6bT#vVf8m`AxjfU&-)2!ioob1wYJsw`raDCkW zpyB%X^87|S^>JiBAg+%W|89u5J}!K{5OLlAd>s#Q_7$3PHk2{pIQCbh+%D8`-Jgvb zuKRPNhU@<1>wYL-_vfn`zwS@G{|XcG>;6>tJ;wj8_mal1`;*U)QI76UK5s=__owA? zUb9}qb$@o&j<J>|BL3=GeeU=MP#W>F=;q_KjE<>7E@VOvLsrzoQrX>BcDUmd%3i+ELuS}DBr@fd-SkTE;zQKY%zT1 zZsl^!2Ug^coFE1^`&C5_mAnPX^+1{m@=`+s|Bhd>&JUokT0NM=YEy~5B*idH;{79OkH^04(;dPQJHTe z5ycEp&inx>MZ!`E=4BO9nHB=<>-w|pM;)ax)_E!LIV#xXd`L7fUkkEfA@W*=D zuYU$Ck$ygIBm!fQ~xkfo=899nE1F^mEv^`0lq}~ zw~_vh)DZiRr+lXVjvo5gqp^@o*=8A!drb`6<)4pR_r5FCe+K-S`X2!dyK2tgTS)&w zsMC|FYa3LW81fgB{!%PJLj9fL&(uH6WByd6VJmtbSdnsT>KfuPe|II&p8*m~{Wk-a zsQ-mHSdf~qQcI@(8=%g_kUhOnH7Zq^?0+|)P5t=0ZzBEs=zQOlZI<7F#wLa;>qtM( zGxR^+c_kNP5tu_^Ewdd!YxPsep`38^n&GZ9cJ~L9z_A`9HNBiB> zzK$6wH}&tL`ERg^ESxNm4pAJclG|@CKkPC8L$eh}7M=f~{|CSy+t2d?%cf1(GG!oc z;l2dJu_o`;)PKe8Ztoea=*6inhLqVJ&qou*Pho`G(Kw?0DAKflzK8y=@>Kg`L!nU= zbG-CdsP?50pO{d87W|p|7n6QchpaNq9;I?VA12u8KihFOR3L4(UyT=4Azi34XUpw4 ze*p-l9VQ@NqxL$6w8>jf@n;OPI7sbx8x6SsEEn&4Ni=@jmMRYRKl*Pt{Be7Zzs01V z<#E1|E`IMbcFcx3;#(g2k5?&4y8aOf^uGk{;eT8zK1V^#9aN5b@qTL4{t=_chxC-E z6%?(uDS=mH)Rx2BG7_A?nv+A<@ipjiz?;BI(MB?68nQIE%Ni`> zpAnKGENkO8=DfgA!uDo&!qoJ1b3L8f6T6e$;ZU)JX+MT^qFCQT%?c^UcIYQF)|c1e z)v20*i*&$RB6Av(cCRT zEaTt*))>d#*54cB4biglN)_TEj$mB06|J`Jdd?jGJTX35MnZxpYDbKd@4m?pm%j%j zu+CY>r%3zV%|Ba=kNG=ed_^_9@o(8x6yY4#>aZkXjE^7nwU1dsn$yE_DE?=ySwYvENQ^g>S5OOA4RB?SvF zh3_@*_g!|ppVjU6*THwGuS*S|c$dGAeDdVj{VgTOt9;@F_@!&Bzqt#3HyFQX?0h>o z8NRIzdio6#N89{je!q_5Xc^>zK={P=9cv>szUD}(65M_?+APcHm4uzu*H1r6MkPC?M;1U<7=tet;Y_e|K=F9I}zv)HfOaRgLVhtd%3US z_ha|NH)x$U;8(cDwFxelb%od?n= z?V71wqB?O%>T3hP;`f8A!JcfeXFJ$a9XfQZpOy0aL+~wJ?i*Y`>xzDrb~U#i%L%{g z`1Piz4u7+L?HE2mem#MH4MUvEIPENs9)h<}a(t#FwZeDp!+XH?Wu<`YV~g!^d|_;) zjIUNbz5U~$IDy}k$8VCuT-v-(eY<)`fb{8e<>MfJi~2eFjqT>nN`Ii6_*p-&;RA?0 zh>wl%?DD3Y;F9&w>Z<&rl;F)_tDlU;%U`@Ma(TEl`mhb(90vOWox>AU{056Kem}6} zEt?y0K6CsQy|^**@}3(bsW0t`$~GgzyKfG)M)h`uX#&1|+;0cBnepPr*HT{Eb8P#K z`;N&mg_y!|EDb6j#nnSxVLg2RMfxzV9%2jY+fqI1A-=Hw&=)7?gY7Z)V=Sh^oGS#I z0x#`4_QBK79?JrIvft3iA`c@eK2S$4jst zVSP+p%C)ay-FB*52H$y(si(FniQ4+Fk!?5lNv}s+xHm-VovGCa$gTkBuKMKUV|su8 zztNc;d*OK`#_}g~EciY+#w2L#O96^T9-EX#Gb$)_?|rE?mht5e-+pL zGQ}19V9xhT7gvORkSB>N`osE=l_uu)>n5()PjQ}#>*Ja=w`05)(VBV4C&uDhf%5?8 z8P>s1KV7rZRoiz#F4mcCAs%inguiSU{{Z~WfcY8ltNC6SwG+voXnxK#<|o)chHdBeU{B0GB9H|BNfB3UBmb~p(NEdcRmai4 zg^=U=l})}WH2e}ubN$kWegS`!1|Y}%4b5%kmp#XJELHm(^oiWx;M_*P^V$LR*==fG zm!&`*`3Wv#%YIjbpEiir=rGua!#;ga5Y{q%Uw(N&jA48h@Z`XLnvWBTw7MFjE=Q}A zZ8{4$MhND_;jqs~{6Gh#2iH=Zr~10M&34BNuGJ~KuV43Cb!qFd8RFSvVBd)##6>pv z0Bk?7EG7IJ$lL+%dU%xUYUJEcJpi`DdKKJpfa)-w9#;C`I3g&&L%$8`%yEY6(#~-~ zH;sm$AsqZ4d8{GhXt=myJ?!^B{LOWd>_Pi`Rl}{{Y!}YGuM=Bgn_>!Ls14Tym~#(6 zY^h@awLgoQD=9+GmG#}7VPUVep11o99t0I5LYVZc4#rD@M|T1 zkrr>D{{XCs@|YFYqPST5dyiA$oegvQ_5AzRAi--hjLQQaYjF{bJFYo+tPVboS*wfa zc(gQ89UPC!b};^N?ZT=K_XqAerebYIsXC6u_~m)P@$mQh4Axn-FUl52ucLXP$DthS z&f%5W&4-Q+E0yOv&RPO%x{L)_yH*ZumTQ-@mh4Y(PNJVr)!ZfEKR!NXP5Ab6t&HD4 z2xGlIIeengm+~^~$Bx2tz4PJzh>gF6{neYkl$-P6*zPl**aW{}bj|D_HubXuzke6} zRlU0BylPmdH^4b+c6C$!M|Mii<)uAG|JF{;dFij`j&HNO?>GeKuJ77C6q+YLEHrOERHRZx zZFFhbit4N3%OYgJ91Vb%0xn1jCg3cqS+JtILD~ZRAuNbF3q;Nhg*SZG(MqvI<#Kpt zVM;|sw6Y#PJ~A9jp)x8iNb<8)mC@?5nhP4?!IP+%Ckvq!s#LF6El5hI7In4I6Gw2d zEIEQ>D;Fenj%hTlwxUu{i*lqDyMz}cC9z43QQ56|jqnvC7>{{4202u@6h6PAhUt8y zLXzWrXy1oj&gN41*ROpNglBQ7ey86n-3izJa za#8G1E|zlJ;0?DQ8&+ZUMD~hW7~K^Rw{`GoDEN-mbXg8TOf!ICI-DdouBg7Ev2sQQ zaH@_&>;Mqbka(898Q8kKa`@u1`s(s&wJYGk3D618`%Fb3q$3OZo&5YDQZFAK~xEkG6Ag6f~JPb6&2tcolyo4sH|^Xe0gPg!;~5o?(8?G>7jH4FNN$QER#s^Z$3>hfxM zph#zTz@f?TfshWiRJE*bILs0FXw{U)hAJ_C*1XU~m5W0#i2w>Ah8_lOFs}u*^PxUy zS6)*Ml`-w6Nywv}T&A!c%$j-dH8lt(Sf?r~LtG&Fat;BXoczVn+6M3&s;Bv{A=E&w zPSBvCdU++RP0Q<0@_ZimuTW|r4TTOM@it@_PdDWFQ6`?6`>rV*A2){iS$~te#1=(WCij^Vh@s+%u zSxNX9(nZw`Rgrm93RaXySJugXK`C?#(=M_#F>9BV~_EDq8 zoSJ_)a5znZvdP$Sr)x5HoYN!?n~cssofhD5nsme_V@HlUjTYb#Lp#~NzS!_5XTux# zD$6VC%Z6VCei<%%S}<)o`-yuFd=SL3jM&3iR_Ze{`%Gr&o58Gli_EscjJ=9wrhX!G zlEIAqiDgEFc5GIvfH9vpZ_4oEdGj3564Cmy*sxH}fY%+sgsUtsZd?qr8WtC|%EN+H zFfFtUibJnUvgB%BSw6iG)FK#KQX7SOC`*Uhu&~rume-A(Fe*AyQs5S#sIr5C#*U*( z=owLCM~x&3nl5viGBtJ_P(ugWwl82=9Rz%e5xyQ+TU%2+O3HG|s>qB%jZvv`7*&xO zJ8F#JK(NGNR7H%L4x*y6e%e&{EMLLA;g~Bo+Y%pMSy4H9c=_UTSz9o@V6?{KlSdFR zDFseFl+_De4G}w1K#&a|DR5b?w3FboHwwpK!WzuEP7V)FKZqS!2RYZtwNgzQS%)FR zb#gsavqRQlgh0pDa7U}_DwkJ`9G52|Gl~mlPalq?>KJsmYI#|?oCSrmr%c270j5%A zfGg2Nry2{ykm4|aoi2k4d^qm%r7{B=>o8z}Bm|iOEp`~Npct$)%NBKuD{;<)ZBtfM zj2;eQJ0JQ~Q^|u=Jhecrdf1Op*@}vgWD1Q223Jl}tejEpkt3Ou9QUZ%JfCoDVyS-? zzV@C^{Im4;pQRt>^?=yubW82+uiN6(l&3u7LW>uld0oVd&$)4$%<xO!dR=pQ59y?@?- zW4=#g)}5;CH4bK6dhwZdd-0jqhrIaA>t9otZ*Qv2oSFBD|!q0h%of9l?e{Q^)aLF@s5Y6#-K0@Oqh_X?nO1aWTwayy}@f8wri zS2Kx#-ZNQ9keW}-$hqkg#(8yu6_3d<)mft5`|5P3NrXvP%4v@qxCbFeN->jp4zw_z zNM3#0G4Rwv-c61)G}%bl7Rr^kxO6X}z{q543?mhs%*(C2i30>N`BaP`F7bXA7@2${ zhS5<)gqKF%fq)<;C&vilQkYO+Wb$v@>#leA5=`C_vzOq~mo6idNi>Vw7pxqIRgUQk zQsmr!Y(6|#RRpl_rxq}TtQ6M#R%e3v&+cj`WQwk zIGO3GCaPIYc{`35Sr#8JKy)$5L#2AlrA2N~Fj)~3JuH!P)5v?NqLuP?82L9eVeLGp z{@+cn?>YS{W^x-r%9C9Bz-46eNDLztoXqqjSCkR~ePoj7jMB)ZW|xu4jRdtXq&dLW zJAzI-dx=w&I!zoSw>Z!eCIc~{#K$mMF(^yq+{-QQOrOhSx)Z$RrtGhAo;=2}JHjN} z4g21B!R&rEIPNr__u!?DV8=)694O95mRJ(6Yl)+T2-7>Pi(LW-5KOwd%9;GcQD1qS zNVlt%@#-s2r=E3H5o40*eA~5KxztQ3tOzcx=-sKa zwE%8o_KgvCrx_U&gOh^3OnBDYvSwt!?XUgCjEwPc1Eha25OAAocgXBc$OZSMW>~?X zA_E@F%+Ef@-vINY5D=@K~bg?uTjwurobSAQv(nD}k+N zE_kR*ayawOsXbi*=faEfdijN~huf-mUu$FrvMvl>9J~lx_QCp*AiVDwf!Ud4fuAkt zM;7?ef)H6C3;j){vJEOd%TX#B2S71X+8~Pq(S`**zyd#7Fi0~=0)vqqZ5c9#Y|BEz z6_CB5#gg5CPk-IiVgdK2so?LS3GD%|{y3fQi&kNm=ERjr$Rj*_HGq9zip`bwOrVn9 zgH2cAFNQ4nQmV4=>5ye_31F!S{_MNdFILYXeRoKt@JeFsgWEVDg{-|6^jHYwu%5Dn zEWD0|A6fyo=4mV4Ej(joinJdCk00j~JW~Weh*-(a_ZlZkq(eZy-!9NW_5g0+5cZc^ z5Af}vvIiZ6zYEaGeQ9T4e-1tP%~pQoS@tC5D(TqC>zCVPx$Pjg0l7_4 zz3z~dJXJaq9ABlx`b#9k*AT0^z6lL|MDO~2XeCBelJGwWbjtrBRrbT!^=(?$w^P?; zZ+BQBCGs$e{E05|2#ZV;{!dXP+*cu!{R)bFNfUX1MD_;``(+TBJdAjg*Q=f;H+|in z>JF52s@w+UHcf6jD$}>3*1D zX?hqP1B92O&wx&`=?7SQ3Wm`+S{R*6VIaOTBfR@jB*+<_3*+j|@pry?Omb9+G;O_~Wmm(z zeEqQ&6aElo)gop0wa~<~kj4aMlrzAZOQrt+6GKF!)Peh9LuF;$&jILr2seL}Rm!-b z7V0JAhDxC!*-TaFv}@Nw*RElPUBhDR8fKyEl#pRk)1XQ@FsK5)!3BTzFv}Wj6-NOc zg4i`o+$0&5m1A@($7oiniV!xm742F%9YFHlSi{P(F;kJN00z>OA+j}{h)Ny0BatV9tX`KqS0YO#ly4KY}mz8)IKZiS6r%sX*H$r*u}By z4Uj>0J!jbUoRq_MJtupuBt0k94eBj->mUHqqwr@xCxapj;J#yIoufvJz2^-z&&PEC zdFrt0{_~dG;pe4N>Tss-95@M}4rlt@HAGc}&?Gz4r#g&BR*ofj5tusM(-*sj^ptYA z!##aZI?nDX)eTD1PCV9GprNM^=W0)Y!I@*pde@Tih9%=;dOzN`4=izme7saS zC{^w>KnSEN__N1L5A*=I?*Lh+0&eGCDf7=)Bg@d96=PN3~zMHfDUT z)yC&qX#tJT!@hUmY>vj~VXgP7LfQN<^&SsV97~RXU#Ryx4NG>$^nRz-`<+tVpdH#9 z(py1}y;Ju734r@PkDH%L1~ou0`L2aSCNl9Q%|un9Oniw<#6up(#Eq_r2MiMr#F%(M zn#jR?zzC=V(tts;<$)WBgtQ3$>;uy1O91Y>1UFI1;AqdX!0P45ZNFt`f6MnG1jJcb zhY9NO(8nzwl-9W+{VU1umfx2AZuyr|zFRiy-|^wOsz}4r;I!wE!sR3l<0TDO^fXkT zhSNI@kNMJGf#Sc?H|&9L6 zKN$ue-dY-JTu~1XWcF zk4=e0rd(VyZ^k7BCG#&XE+{D>6Z0mNz=M+l{*;xdS+!O*AQy{R505gHG|I;>5z!uT zEUDvX9I*nr053^j3J=)HET&Jhrxr|y2OCRfPcOM(&IJWRE6<)jDz-Q#wg?XfxsBxm zH?d`Wtj0j#Iht4mADoFr@JSgBQ4jdw^F8ck=mm}*xS?*D><@Dn&y4K?l;KG-M;H_f zrp+w4I1VU*=fE@>^2szE03jt)X3aMsctWiNpHS0U&MBTUcR_(;D40ivYJ)(dN2X(i zB6(EH>q?eJ>jeCjR985{3#Jv9OfQb@9%1t!ho{dXBTZ(kfFbax7&|U;1q?{y3V7Bn zzG5mq%9aRDC}wIg3~oI4v;~n13r39{3tyXKXU6tzrdQuQD#nhBuaHW{jLCOK2cGu> zPuDg|KjSzkppFKjyt=MRep_Iv&`7p#+Kl4Df=KLmFt%XUET06*5nmp0!e}XRVYxKjJAiag~&rxC#ZH zKW(;`K#wXEn4oIfl-UKdX3d!5HAHTG;&F27QGS9UcIu@Y;z!J_Pdsc+y>!T_+G9i{ z90W%MtQ4nXky=h81r^1QOstku)JqkosP`D&82P6fNR*$T9v+@dG(HF?m=cnEdVyC9 zcv|)ptwx`s+2};=rp}sk(RnlG6((xu)FrUetvhe(ICo!43y)hH@9im(X=5OAJ6V{L+YChJh9SDmyoexMzh34*|pnW&C- zuXE1x+`W2Kp^+X{Xyd~9?(vv|3Or4#6VCaJJb&ZU1bH5Z zUt}(CjK-cn#mI?0kAlxBYdR91Q5h_B^d8$z9laZzn(tz{$#HR@bXF`H>oiRP_Zr=} zw6Z~+a{G<wDKn)(v%FP%@B(x{b3ZDqMU*YarOQR@z4oQ*UYJmf8}NYp^hlDOXJ6Cth{ zyuJ(G+*J-=FNcqfFBN!gMbzS4z;MTl6k>(IueDc;E6ZvcE5$eVxi`3cD3f({L|CiO zw0fuY6Cpt4Z>x~wFQo89O5eQOeVdcMlYB?u{?z;MNoqJ)7+%B2gnam2N=)2e#Ht88 zB5M@iYQi=WhSyy;5{4Ij#r(9sVfOo-saw+S?<9W!L-xlyfZbvia9Ni1MW>FKVG{)Y zj%#<-E6QscD=HV!1c0k|2`>ZIR>1|q`if;ER=}IHuB;p}I(Jm=*xYd=>Q~lBYik=u zG}cE)kf;%5Wzq5~xPk{Cy>Dz9jx850u7-D#d5Dg`Fz9)OQQ(4r-|H*#jpS?uIHhF!x4?d%&o|wI8yA80Tgc=K#L0h{<^LQSJPa&ZU0Q5KA8QW*ye-gfFKUNo z$?$s#Y~BE2J4rjxpdH`@+8<@@uRw!Geb6)el{GEN_G7*xzeu)UUef|iq2No4GkmL! zj)7mjlI^zD$ku8@8=z4e(1>E5py~axsg-OWT3uvs1=d5W_d*_M@D1!jSPMD=!~qA0 z10FD~1xkU*SV%-cWee2FhH`9RkYI$=b|;JdN9XXGB{O1LW$yx$(KEl1o_Roe<~On{ zKm&TrhCG319w5)aIQ)9GFUztYv;&iUdFY8>OHmJkCx9%1ilPL%pOx()TAu-yXMrW$ zg~+{u!%ShQKz*|PoDG|&f%7@L1vCH!z6LNspggAx!#@2G4FksK?V`OYsJbi3SA~-a zXiyGt0xR#5Iw7#$U$xi1JE;ir7R)g)-(MBj2@RpNH-WW}v$Y36)#K7yTakNVEDo%K zIq?Kq@)A@(k%Zm?3d8}Jz>cq2+FD@$N=aJ_rhG*m-)XA~)mi0$$%rM}e?=`V(Cn{C zzI^O2(4Yt41bY6e`irA--6}OIC!v2(D6)Y_(9ehcG%7#88kQSBtYfgqND@~YF9K@7 z0XyO5Gy4tT+38oN0S%@BoWQh~SkV*E;3Z&@>!uB*WcvULdK~Zrew-#qf*e2-tiK0A zPN!5m6&O>lKi@xgmVaV$kw0&*|BNF4#AE)VWBxN*?0c?m@u$G3`-}X&{^CzL&+oq= z*}j88F#T@O5K6W`^6&Ngp?SyT>-{}$@OJ?c#B@x4%AYYi*}my&P|`8k{tU&~^>S&u z0~#tQ+1>zjuVnj6sJ39Au@=~6$9eDKkza*31d5|4&FbF*uHBsAREOlymH0@f%)}sxkLIG2e~P!T$xkCWkR<*~;^SjMD9x34 zejNTQ+209qcrV#s^#wn@^0ok$Ch3r*)s1d^r0P~TN&D3oU0qa&1rk3;ha}xk;^8>_ z&(i*>arjP&^AVt1JyYW6xd2gb$^I6`;az2ai{kKGWPfMH;lGo1UJ!>zC0-nd&yl#i z^(dweZ?%L2&=?F0A4>bpuN4ciSmF!g_$`TF5{Lhr>@Po*;8wpZ`}HjsAZnV#OXBbc zrJbd5c#Xst$Kf+1&SxZUHQrwePs6wXQNyJF;ZV{@-;?&pPQ=s)dGSRIZaap83S4GKtF@T4E}ON<0*UVWE@6&x*r$%W)YPhhHS|!EyLWDMxN% z>TZ&d>~sviRN~s*a#TA~;__ak82+cF-t-s@3*VA>mpJ@G>H4m5_>*`7B;5JS=b85b zrzO80tD3ao$r7Z?k`Tu)2U8*(@A$X0buvu&GSF*@FmpTSlS_PvyX$Z(aV(T_raJs= zPrAgj99-U41Et{*Cq8wbvaI8C;2}`5guCAI`RSje9Cv*VL79_{r$7l3+{K*$h1-Wb zzJdTJMIQX|8X20IhPB6a|fBd*BJbv629zX61kDqr6kDqr6kDqr6kDqr6kDqr6 z4`CLUZ1+yAm^xd;&pTwWMf|)|xEm+BAo#S4UUX<%i*pAA!q(zB7LVWWW4$fhxQgX> z<1iN2=8;xmi+ru*lD3H7zhkW};`i?gkKey5JbwSK@c8|^!rk=&%baX&UNeTdE!_DV zi%-{!4sDC`99k!AQK%Ok+7|KqcdWEU{Qh0x@%wj$$M4@29>0HAc>Mld;qm)-g)hV` zF4-b}|Bg(yh~JMZJbpi}@CwXg(r8$B6Ri%zVBPKl8aVN~iXQHwtyerk-v&8dggdX- zQ^P(Ich?8L2DnPfmpd!T$=5Tl1eIOXJ+Bhy>wZ&UN$sM|_ah`9>$_<4T3*+Kx{u+n zi~E3ybKUf?)ElDK?lr`&uz%?y-1Uw7^_0Zjb+VOOo-J{AoqU7vA=3VVj{J>8y)XG) zPjjTE$bPx&JkPYJr5txZ!qnZH$X!L6(YKjV1MH74d~yLtc2@)-{q{A~9? zLq6kt&6(wMoaY(*jOQEj_bc-RJdG+7+r#(^RFCp61G<&UT#x)Zo}|e~oD=(v`58|) z`1er-`;GY-$N7kf?Fq?}fX9#(!TgN#d}97E@w4BUpYbt<{8Hj)zcD}KVS~S!_@^88 zFrG*CXb;Bu12jeQ2}k)lo=!N%?F^zZH7xjPsk{*dCt$%?3Z?9G_;~@}33dRI&3RXFnlct>Jk@WBlm+V>Ddn4-?LI za=h{W5OJJe`1=^9LY2kECm&g%UY);`_)*T~L}ON=;mb6+d^Vey(&d+*LKF>{L z<#9$iI=-6ZFhBD(6VCjMKV|T<-}f2(jHhY*+!us+d{MrRXKMWNnG`CAC`W!B$9*&= zwEtqr+0Ie~AtAqx>+2HYygqQw{9L{T+GAq*s^tET%KVIPG5FaJ_Y%(hjDOGI=k;fs z!O!?EgP-T)qXs|YPZ|8Y{_HdO8Q*X4w^GMmG58sO!{F!j=b*vQIL{~c=YEoZ*x+aU z4~G0B#DB!#XFNppD1Qafn6ban|2jTQi4& zzl3Pab`p*JI{ql(%+G$_ZSXU`&){c2zhLk){))lRety;9XZ)bS-%90o41UJ-{nS$8 z!K{jC?5~cqZ?V6KbHDWX*YSLkgZ#MPHyZdN!dne|IpMnu{3^nC8~Ck+?>F#P!Venw4#L|E{5isp z82Iai3m894><9L9z`)thy#HtZUyvML4;ep1c%C8WDB--mF~8M8*}>}-uiz}*7$L~W!&u7`NUsp@D~$a z<$*V8IJZS;y@sRSOGwT}54=^w%ZSEomxiO93X-$i1K+RVi;2eUpoXKI6(pz413#kS z&;Quw@=KAvi;oA)Uka(h2;XSncM{%e;9CjbW#HQh-)-PO zAbh`pKS}sO1Ame5HUs}D;YSSoEy9H{zP}>eoEIN4zab};%IOB)iOQJ<-jB*510PCd zGahmY&o}r-Q8{eje4bWl;IpV)Y~UAAxzxb<7quz_FQamuf%CPYCIhdb@_Ga3_8Sd+ zHI=s*cng(V4g7j4?=tWWRNigityJD;;Ezywzkz?B$_EYn2UKn|@K>q)fr0;m%0~>G zkNeFye4qHtIK|5g3mW-el;#mCDTqeh-y58u(T!Z!z%iQ@Pc^_fUD8fj>{>-3I;>D(^G!LsZ^x z;K!)^s)6HcX)(1K_z5b1VBmOP7p5Zyeiq@X);%s7O?Wz0u%E{ho@wA05T0e=rG)1j zcm?5M1Ft8%*ud8iUTWai5ng5Bw-erE;QvnedIQJ%12An=nR9&j4B@Q?{wm?S4E&db z?>6v16TaWTQ<4;L(7-zq-e%xK2q)OFb28!Pcoh(yX~?;d@Q{Hw5T0k?YY5Lb@NW|y zHt?N<7aRCvgfBGk9}`|`;BOFKXW+jgyve{nCcN3e{d65{qk(rKe2aniC%o0bM-aZt z!1D>;ZQ$_GhD`em{360%HSjXR4;pwA;RHM5-hqy9(+&QPgl8JKx^LUPp33vO5Ao+4 z{DTM&8~7-~33lxHlyK9YzY=cR(}51e&2^&-;if&k2{-K-On9+j=V-!94SX`;=DKk{ z;Y|kre8SCj<6DGpH2A9sZ#D2n!gm??HH7ar@C}3$?D+W(!c9LvK)C7WX9+j`{AQaQyJ~?SR40*Q-rC`TDbICtptv8FKjguxUSE?!=D$9uY7#KVN^dJ*U2cwH~z8~L~q=>N;!yTDgfTzkN?&(1kH5WoNd z!b=W<5)ncY0z^eUK!O1RBq1o&*btHv63B}rASg%#A1GMCN5v<2wF;^ATE!MoTYS_a zz902cYg<%AthQC8N~*}W*34Ra&zZ9ip{>2Y?|xtBm&{)CpEYZ(S@YPl_t|?k2CnZ8 z!WHV;!}n2jy=Xt*7uEG5&i6TWIdeDxM_mr$X_TkSLA;P~KCplI{--WSzn`hgL3{ZA zr0$1#EEJ9*qEUXihO=F)m+zZpX#6Oj?}OzSIN#R_8#vpaui^8F#sk+I^;T#&`UC^w zm5Pjt5y$5lIOzUCoa>|e2XWS?`v>u5Bq&5jmcND4ERS*Shq`}I4);UdKZtWb43j*T zLrLek8pd~12HVT{XN2qiLHRshSRV3Yd+~ij-9L!)eZOQX!2En4PxlY<^L@FH!O!>E zbpIef-#63!gSc}aOp}AZcXQC~)PJwn?L@qg3g~tszKrk?9kE`BZ=tkqC*r#a*X>07 zGs1OyatXr&-^W7vI?m50nD{$X7V$hy&JsvtF!3iee6nJZ@ks4DNXO^J!Ee&=^EEks zTGylAd=2O8Art583=_9$-HP}WO-^}0B}{w-{a$3^UupO>O-`5^0Qq(N>NxmIad2J_ zq8z?AiE8-%G2+uTy`5+sfjGA{W?!b^Gd2D{$H7O_x&!6t{L3|*`!b6AM8k_T`4@Ll z36!Jb8#J8np(3ZRtIMzBW8&b|8a_)EmGL_oUZUXz-CX&zHT)NG@Xs||e;cCWBv+1( zKN$z_mF&%bMI2mo_vSB+ga0fJPTg7F-)z?EOYWEW5)JP`G~N$IoPES^93Z|_dVh9 zT@?rafq^HIoI4D>JKb1m= z{cw(I5*a^W$hn;4Y&UT3hffzSomvGdJ>uL^vH~0g7mBapE`&n-a$z%Lh zN}p!npVRtjjDg=x>9Y;|5lXZFSpJKIpKtK*r}T6KKT2utM=Yl|*)!MRA4PbXflnr! z=L42=G2x30e!fq;*ueRI>?H>N0LkI|=q!I1;cE>3-x7YEfu~S=aXVo9M!0d|_?W>z zoYpJP7&y1@s|G%VDxjBq{=v;FTAe$3#1n(&k9yvO{n6R!4EbJrn^k2LrnC;l@H{3*io44m~| zXyEvjGz{M-9NRZnK{8hRXu0yL_x6uTzJJ6pfe?7^6!H{!+>if2Vvz`2&0k;eLjo&9=oZFXwFhhIt zNGBe;(Yk>7KO(>Jdjo9e8&u|GgP-jgVc>kfCC9+oKlvKY?{J}tA`M6X@biIH8jgNG zO8#j!aJFZafwO+D?YNNY)lb7w@7JW4*Tu}w{b9JlKbOuE=^Bo9az8ms!%;qe1^ZkLM}F=<(+EfV zrvc7kuEF0*_D3`v<^PrD#~KYs`D{NwU&G^q=cDBYKc8o>(r}c2IgLYp?uPxt_q%Q} z_<5Y)rr~-!ZX=xQ%fGWeq2UGW1USB6$k{}G_>G36odc44lW~9fX_q?9}iXnw`51Ij@kNZ)rH%X;FLZ)o{HX4;VQ6^RR() zdkMNO;dW$y^7R(uMSR{j_*wpG2F~r3W#BA7mvHpYOwA9)2LGqzhwp1R`k|TpFki#< z_G&b6zW=zwz`4EF6K>jbpT>`RKP0_BG4M0UzdJNJg<8Fy*Z9#+o5sr<8jkY0|Gll@ z$j|ogH*og=58VIm)o|<&Y|l>( zocqZy4V>qP7d0H^|BU?ps)nO{_S+u`H|@9Syo9*^{7iSkxn1s~dJWWY)cY~%9jxJ~ z_hsTAso}`a?UAYB$p1R=pQGW(zn$!!py9gT_&NsdMEq-`}9+ zyYn32F5)9G4!)akUXQb!!-Qwh5pn&#Q;vZzqjXrqb$jsI4Fk(B1bG+=)j{I=_5K_K zpF{lfG+e*#t~PMCwNb;_287sNvB+YxcSzwy3mh;!dT(d>W3_5Q=p2_mld6P_m! z*ZV^)q%k1QKE!mZhU@Knvxe*K$nSY$`|9m=J@F&1x7VLFTyL*MG@g)OZ?F3`TyHOa zFBbXr_Tu+45!c&`?{6Wlx7XPTSZg&8>+N;3hU@M1yoT%T#lNefe7(I|{H}bxy`Ir< zy}gFheKnM$w-^6Dg}B~cztZ^i_UcOa!;oKZFOgmunZIN~S^50=O_8M{y#+qJDbkxF zwdLvfQAecGn;O#bE0+AhPLW>GP*)eJXFe>FZhmpn^W&T(S1N2OuU`;pX7%tL$v9f! zlXvnHnX0U(F8ahKeJwNA`1FG2OKMsws?%G_=hsGJO!X@6sfQHIuc&KeV`Wup>Z=+= zdVNDnB>nsuvqv_!lvgYw22VN0$1{&pGwn;CvDHGmV;DRYQVr=Fq_L7t%t2AbJ@rI! znB6BT)3Z34NndDX7i+!n#O#bN@2M%8#k4d!*Hb|BS8zQ{#kzPhd5WXYw#K#$ilNNr z`bPNHYD?AedKM4SGW?ii9IM=~8S6~4Bf}>yxm2VYKJ8mx$4O7C%UfES%Cs;1dYcck zgZ2?$#p5Z?~Y_Lf^o7^GR}e+6v!Aw8nY>WGR}%+%7hG% zDzjyjJw~dOaTdgoDdRCQ^2cQ(=NK7h%XqYmvml02GM2!Y(b5nZkCt&3#K0os(XoQF zq~I*bFi*)R+R4+ivZW9ekCt>6#Gq8hEL)BO997)&-7jRbhrM&L=9&Mrf$F3RMrKOS z$au7jvmgc|RqS{M`fX-9sxulrLpmzspSDAtp1=+%NX4Tiodq%2A>$0Sdi&Som9XBU zpID=W<-Dbm{JT15!m=$Y;B6knXu0R)g&iuIpk=B9;&a5uE5FR)RD@Z6FaRcoob#3| zelA}HNvvm3!OnNNcL3<6e+TjL{SQjU=z0{&d+Fax`a|R})Q?MRQ~weu?4>_Q*B5-9 z6iF4`BC=-LJ3!jrUG2~lD`cp9h0rlfgI;Q?k0C?%&NBa5x5z4?|>Pmp}CWd?) zNdFdUN7Ro$QJDHqCH=&PMP;ZCs3TpD5vpu;5Bi=%%IU1!oXh9YDz zb!ElTU)`$sH>iWup8~Y0|5dQh%m4hmSuU05gQrimec^%_-b zo;t|-4oIyGj+Arw-EpA)rnDXUCbp z50n1Ss5~D`U1OoVi6QS^($D3w|D6K=rvAZk{LjB{^Y}%X7))IQ;`o2})rx`DD z1=`gA{W$%vrJE|q_m4?TjQ+WC`d`{Lss!7Q^*;^%P5n029}ZDr3ogtcWWfBU2QJUp zw{hmb9i)FN2}b>C@XzJ>yf7EaWB)Vtzec}%ZGk*JaCyc`;^?2ZPI2rdM$|tX{<%Es zNB?-~Z^V-YgngK)1uoAJsxkWn=H;wc9Q=MO>K_6BT%Psc7{~vGc(Q;H?m++bP~J;_ z;SH+%5h{=R)8XILzYPFn$x`f2yrGvOPosH=GuRwH;(Looo9(wFq)LR04A#%`-i>2_ z{zfWK=V7!z6aKk8`w!=IFa3LmsPd_7s7gBJDJig;UjD1zq&Oa?@~D3_{G0lVps<(z z&xWe8@ zJ1UsvcR+;@GxdLcg5__3_Vp@nou<@wqEA;7 zt5Gzo~y3RNPDd+F`&9p`-fabLd|BgR~KfUjK<8&(yyKI7ayZ)E3>puekFa6=uv6K+=Wb8& zUy4K5UknhJXZ`s8x0n7cq(6rh(UHqD{4A9B(!cCp#j%wbvHm6S&*fSFPw4yw(^yp4 zdxHA6LU}L!q5G6LT|fR_Zt6dS#$S|jNF?K88Nx(b2dk9w71MY;EzbDcP5OC%39SDd z_&4>V@2QIb<%Z(%iar*AD!+NYDiQUJ1@U4Im!ARz)2f7u|3>9?3~7_M4^$p8qnX7KD!;=h!1ZUj zJ)pdo|MtG7IP~>9isbS<{sN?*m<4X^QIl_vge=Sao5On=0($s$yj32Y^ zSgx@aW7to!i#np-OW@xu-&kH*+fcD6y&}C~R0u)_MidmS;<4G;5*<4(i*o06UX@oc z*=M;mvc%70+6T3VTow^V0OA00&di@VE0lJ6sG=4gf(b2+G&R>W)Q2*&(lgRCLus|O zOY259HZ?4aRJ4S$voo`DDyqh1WJI#YjmyZX$jlsDHMXh(i22zS<>h0_$7YmAvMOlW zlUmFu1VDoL{FsTKB>{5=1(2Qsavt+B9&K@a=k)`&IiO6XCy>S|)Wa&VkIJ5B$k5y@ zb1;qn0fR4Wq&W#)F)Co!#qwrV!o=0l*iNSM#O@q^=upvwX@3@Ed-d&2R4kv4SPuOZ z)3+maPQS)Z+fm;hos&bo`^5Wp>IO0b4q-`##USw7pcP`} z9k%^#f3p+X+9CaS+t>D$ZMA`_n|E~*+u`{=;OpD=p50GkgGB#NI&~5yu)h=FeI!mdzEP2W`>*W1lDqPW{0f9}f?2`*FcFZyc<9@KDl~_aFN7{qT{O zYu3K8^{PFG*8OPrq3Oead?@XtzZ`n8=HQ{O*X=p>&t*I8Zn1g%bO zL927y!GPHQcYDzAvqfw1F<}tCx+WYV8eUhfAm!d+6`^MH0#H9z`WMZBKtky|H>A__u0KA z#>az$R`)pU3nu;k*s(qb?fz|@R!+!SSRpo^2W|7QueJE}Uf14Uv#2I#D){w0@bP;i zMakN&Yu}jS7aOa${piq(zD_Tuz3}p(RTqoTcYpflLoY%bo{<^eHa+pmH?H5h^-%if z;UhNye_h+J4mI5WBk9+M{N0Bd)_!`M3jpkFs%x8Yd+p_)-STY8C-^qNIEuRbk`{yI?fI0p5wzdcs+s^3!SzGCrwSmNGr zh1mEB_~F&72=65pzY2O^_~uv%oN7`Ik6PX1CdmI?g7W8K=m$#!V%rY@TQx;|{-R~n zeQHuUN$w&(W|MT20R9qc1Yuz#IyiH+C6 zlK708>YS;alGcT-L2rKmePJK?(t`F~48EK)-Szh;so#OWVGj6L{rw}b3&-#o?Z--n zj|^`sfc`WB`qRkw!bj34U;Rcc__f;uKRPsG@_|G3(4Xp|KTQSSKtI~^AoyphmDDyB z`qXvZ#rBx;r(Gk<&w&0o;<A_bs0E{xO(iqvyfH4XbR@bB%FdyAeQ=d}?^U=dF zAHg?eHg@%0-|x>>*WoDV`kM5dFq{v%)-23<2|x59iKw649qlNCM_=jnUE-mjtE`hb2sPkpfGSjl0S z>np&1^qHtzydz$?6f$lFrekXYuOGdv*S2pK^oDa#A2=7K!rGzlwxg5$8+qLz&-M3; zjbFh!0oM@ib^@#yY*;t=VEteX$2A4&`@&8gzHbQjrJilrUq68J)P7nc$nz5PH(&F> zS^GfNd%%Zf5SRTBG1&)uK{@Q}DNbLPWg#E=Sw7O9=T?|kVO=u(@XWbTmpM?U3!!co zz&UmHHmK`HJg;KeqnG_++ZS-2!8H=Dg~*WLVu|CiS{%7 ztvx1zef=%5U9BJb%Q*vOw8E>M?Qo8ha|iTsWkVlW)AR?wD;u!>TVTAk+?%T-+4Ro;`-%%T2EeP z_xmK(?ziqt`2QN(qgNl1a}S)ixvokVmWdwA2VwjRSa%Le5jogzf+G0hY8b~@f3%FPG31@+tAL5+uA3I_9JDTfWI@e zaniP<&st6!%k?z0=a=Ai0CKb;uEXm6i zxp~t@PJvfN&I;w`%^I1Pn>Tvoq=}P87`OpV09K6ylW;@8EGXeKv%KJ}F=G{ci~`gy zD&$bg5`|1|qAOBMR4{p`0~PKiG6m*g48WxbH;$(Z@8n{zL=lra6avr!CO43R1o4Gc zw3${=LWS25eg-^WyCIaPp{ z?+`4pkV&{`l|eCbYOBl09+JN_UOA#1Jy9eZbb`bZRQkv z7Q`{hZdHt&`qXi94U_Cv#mFh%>=`67$!=AQoZ9U;xrWIM&3CglbIKh{HOd`s9M5t2 z!~&BNlk6=^M3{6PSHg~Sbwyk)ii)Qz*U>eb$@Px=E1A^C$82YO@SCERsAQ6jLubw2 z%qiE@*=%YWEQc{bSthwvRas6II!#x}WQjJAW^d+HsmsXCe$a)On}xaonBNw*hVz`cMQ8ST2jV^~)g zPz!R4Dn?Fm^MMj3c_1rBPVraP`6a*90)5?x0s%5-N2F_hA{ z@`;SiOtbS~3TBesglwjtfQ?<|e5L`|m}YO;BKg$KoM2}`StcJOuc8X3*;T;CB%fwL z+~CceSnGIbq3KE}%6{Zij4a9t_NX+E6WLC;UYJ89pM*dj_h~)@0o0MZ=Mcj@I>PFQ z$txXb5tH{h&>SXtv0{luOmf@63Wb}5AL9mynB);i^!4h+rblZ7>%5!6LSkcdc&ht>v&dZ3~ZLTVAF5!5+ikpj1 z9G0kxb#Ya!KdWM$SH*5|rvv<1Ix3iUbD!EpT%exGBMvl&DCb~G0jJ5p6NwF<=Zcv? z0kk%ob(5f3I|-WglOWfSTS$VASwxuDndb(dxFN_b@vbus-VkKkZJin>yHJB+QKtEm zL2!}5_B9nKP9YGRdxo{v|fE^KW)sQ^<}!LXhO+1p5uvMoh9F zBp)YuWd(d4dEy{dm-{1F&!k(&s@QH=$klecToqTF>j*=hYsg~`Ag&>gIDk4b@+BH1 zd!5;BZbwDlB38EC7B?i*lZkFob3Ah))+5&@h9FBm4dluI$`mu6hFm@!;p`K|?@=U| zSb6zzLgsQI)`R9U&4NzATpoG6fKL$JZ(OyRQ|@@|urHZ{PN4glT283mJO}WFgff^@ z`<$7fLxW90Ct$Ft<%A3_rJ1SPnV~v7@l_J*yL3DuJzR+OV25Cu1zAyFt&siF?7!Su z(};jMfysRiRCSn0_iWzbIHnTLzDjVK$|Y>SBe*(NaEI3(EI8~)DQ5Cr2daz}++h!) z!p`n-aK@zP6U9D9a3of6gbVU9o{w`JDJ4wKbD$a~*#V%QGMz&_!F)MpiP=nYZQ-QF zq${|@kw}CoIG=D{kg8F~DYyL=#Cl^vN3uCTnF#1{OtM$tCM}b>#D$ltg&j`nEIaJV zW-`?|*Rvm(Ic84h3~qhsx=g<0NU7RSB%f7J;M~T7xsfbU%;X41aEDieEM)`{&{3GY z(}8NX5c#AF?IO}`znaeoa@C*kExl|MxWyl9@jr3e zoW*Aa?t9?lSiv2347NDKvABduzF36GJXUarYo1&ZSVBkD<2bd$QCIyWk#0SzW7Tzd zp30!sA5TZ02ybRO-{~3n3vpDix?87q>*=?JbR1-a4_b-3^Nl>w8{b*ucdv ze5ndR?#}5J=T7Mf4_}HTKS)J(%sk%S0`^uyAbU_pPs7;q921F!@V1G5DlPKJ!GNDM;9AQAG*jKQc0)2DQXba!a5 zA=j?9q=(o{B+M6!wd4A$>pf=3@YUx z)^|!zRc?e?4)V}XBOO2a(c|gL)>|g_MLDB93MuzyI1ZG>#KB~Kmm?^c(9C5k?{~250&w$GFG2| z9wzBD8J{lW;W9o$#v^1rQpV{r9wp-p8E48kOU9#RoGoMZ0qL=l9w*}*8J{WRvt)d> zjK|CP92uW0z4P8{S$Ng#=^r`s*rEoVIXC{^_>}?6oJ12TO!t}>oJHh zB%Gz{8dR#T(^OsO%3r6EC|{cDTkqPk-qrepCUBy%<%WkHasvvMn~V7F6kS(JKf@$` zKF;Ez)jtWnC2&^?e;!Ps_&M<&+aL;wt~ll}B&>rm4h@mm9V;MngUZ3a`!%cYcTIgj zBVDVvx>j#>t!_&LKPanzJli23bgkYYx{j8v0u$9P8LgJTK$<-Ta6i1|>Y6=IxJIVR z%^uKnkqTYLg2#!Wqr8Wbdn1X#_a1f^Es6ahZt{Jsftzb2Kfp@4xgR_ZlKc2>ke2#B z`3W3h0$0KJ=`W&^2T`z_d;H{wSOb^&0IGG9M(#)06n*c2h{FmXe1omQ{SbHnG9>W` z5dDKsK|BEQ-9QX{6Qe&sxmQkAgc;zWhjPI>mVzF^P|kgX>PFZh8&!%;26TY-O?Xr zK%BA=A}92HQcKmMiY26CH)Mc{H|1f$ALJqOF&w0d!$6>lW9k^{41HLt=mo?nA?oQ; z%@7|v&BtM=RpMJKhFY_H*FaqCgP%^0lV9Y!*5MivC8f}JHLNbYuydpMX8W!L2_?R( zq#P`>Mb1>po}pGD)Ikh+Bnm5$WoF4TMOKb9Gg-2R#E{$NAm`#m;9VBNdrx8BP-`|A zh>9^TmX)0agNS*57bQg*anJ)ho?-dXhVdtYlzQDTSYSG#Bg4*);+2M-s(abX<>E9H zA1J~BJq!oxFg!a98wL$A3}*zH6afU&kTdbiVf`HVbVM*5fq$CZo0M)#=f>Goqb5gPaWR1h*FMQ%=T&@D)X$ zKxUyvlii7B(f=ySJ7w65>amN`*YD$9+gM_V8RoFm7j|5^00Y<)Qz#Tn=}{~*hS zB_+o!wyPSmNKw~WsJf0EGycWH{)Y2Z02eb#{vlZ$QCR=?%+kT(kLZ(v5@py$PIo!DCz5wE=v{xT=ltYs9a@U@Oh~ng{q3l^`P`Y z@Em2M%sak~!S%|l5oi&HT==JvbFVd0LJ;}xwQwO8HDjim%>(mxAxsHyiOIzdy2J3N z(j-^lPc2-^#ZNzC;n;KYAF&Qcr60AhA>I5(WAbr*m%*0!elGJ*JpD5%-{m*ckIDL& z`9ppXHKt4CY&pw!9Sk{G62Muq$o|4=06*bD9EZEew@waIT1+HUpA4KMn^X2?uXB;? zYMly)?LspGzk*oWGpEy8AVG*jkm@vE^|Wu1K1cPm&XC*b+*GZT`7|2tjX75qVb%FM zEt7UgHFB_YTI&F+H==dKdz+i(4!%yMWF&qmxa$&W9$Xhrk@lu`R@Xhq-Z@X%`(MD) zd9t!s;^!y3S8GY>u8A;U4nw)Fa=Ha0tY3D;F^3^o?XtlY6#554r?5QyZ$|%?ts3&q z8g)rS)1pz;4XMaL>J?vNE#ZFEe8l zeP3l%ZO#0q@}}jbjrfkg$UCbP1(ik%DvcFX%7RMgFR7`8Z%WLMRJPPMmw^Fevqvt? zDHluXVc+-qNM#7VF(IZ;%*!n)m{m4uN@0FpaoLQSGxB1v*#!kA2Ct!%!P_Zid6Oo3 zW}TT8FALsMiI;@};iZ^(0^?+%z&Ke_;N*#Lh$}O0t`r+LS4u7^jw{wXOUm@lLV@Q` znjTMJoGcXRku_<;^t^(CDHGx~k(=+`PEJ0`_h@1#U%DZ-#oT<5@6k3+zI4d(%43i4 zYy?L{CaO3-i_~&_mN@MhttGbQoP4R`IQem!*C~&+I9@}de2;v1z09k95cY7pcPM<;L{>rswQ zuQMmdJ-x=sLL=j3p^bA&W_gVcEaj0kDSra|!Bg)0lFn|7gR z4m6y14%*?JgT_z0urR(j&nzXc&|UIW!1_tZh}T7trly9bvhvDGfy<%lng!LOw&4;{ zRZ|-g@+(=e{wiA#X(_8&Dw+jEHA~BCBlW-p8+t`8rJ8Fljg+;B8h9mTk-$=w5m@d; zDw>uzwg{x5@cboJ_>Te_FR8?TBr&t1WtnJRB$j{`qq9IvS=of*;t6xhW=;8CURlZ9 z!o0FF!8S|&hI;&tk1V?=vRpJpT0~@7O$%!tt*ai5x}nr)sYVk6fGcM-e!a_4GQYez zGBz8fG*m_$w6V6lrK+K+uI$oCQv+1k$&eMS2mPA#vgSw&h(sAtuyjdT#r$ZrswomB z4vaSBjYff^JtRUk(95RC(ePz6O=dZ^0g9||5>1O7ix6fnuPzo-nYJkrwHVM2w5=)vRa*%-s%gSpPICZ9vAmZojV2Ctlismd4sjr0p3V{Pj zwhySpBlcxHf(9VfFl&;RUoaAyqvntc9X;+$xx4pWSQc+Ul)^s-yzwncy9_Lh=D#!f?jCpH9Wdlyi#!nUwv#C6GB9*g z!rg(pf>P&wh(W-+NFC`N3M_9SGX(jlRg7Mx^*|#2hWu;1FJ)O@ck7A=6pz5aaQR$Q zUs1cHGEzz%4=$kp)hqFMA{wgUvc9=;(Wv_JmYSuJQKQqd(#NEa9o4+Nxe5C8s3px! zqsW?3<>gHk)o>jSXO<<)Mq=JM74q=4P(o9Yh+Rs-9#!0Nyn z`9Ia)C2+OB?___M8GujKa#lmmOn;|5f66p}pBesclOYb+pRb(i?`Pitk~;bFd%*Km z2y_bAZ~0dHbFKm{mHH-7O+1C zWdrS7eN%y&>Q4^XcY@IVP}P%n`n&qZ_W)=H*5l;BRQr#>>krsx?+n;^Q~e_X_VZ$= ze;63ndnyRe_n%@f2igXc{PrcQ{V7C2W`VyCc<76O9X=GWpBAeF_AgfjTd?*Ap!PlO z9N1VYV86d&s=r&nzRLz9KL9!uuQDnca)8fLZSYk_vF=J<4~w&FDS8N zCDzTi+U^X;^(%M!#{}$ee4wQ#a6-i%TD6la@|*9hBG3wlEzr^X$^bYkP~gV)ufSID z(WhW*SExKR%1xja4e@~k-#}~cL+V}N15>|6M}Vbc0#C}Luv>vWGhly(b@1DFK-cVk zC3cYqWiRLyI0SvB!0!(pT;tEO|Hs-1OphOr2|WBfbZ6)WYwW270sHF}&<;1)&}5*t z?`nVARR0-}JvDG8*!q_h($-x*7#!66za*~($N$Ui?@zYZV70my(NGfhc91^MehIsD zpg3SZxN^0xOUyui9tN_%voEbrz}^l+_a$`wY2XAoI>0fLV0cK{^-aLudO3Lc9bkp- zba`;U$NX@wZTU~?{Dr?WI3f$g!ElBtVwyarqK~2d3VbOs<~$1Jz??9c^XnDC7W;8~ zwf`h2cS>NVf81(+XsUnoRR3gXH@Sk+P|J3RJr1Sm$>2e~x6Bu9) zI$#GM4A{4?fEmccZLbK`8erXzSFN^xBcQKz$C(ezR8^J$`qLo}1*Tt#WBra*htT$q z#cF@|nSOsB#+_iG$1A4^nBnjK6qKDBxC;8|F>Ks5vT=`crY&Ooo5ExJ&w5zOd1-BiHIo;9RUCX` z9K1aa{#6{k_zt+2-bdrexi}7fejFSh5%!WlCJz5~aqQU>hyQ~(_<=a}4abpxXB;^@ z$L#z?&*@cf8AM zH^6@q$3Fmj+J9#p{Hi!|zK+8m0vy9QC^uM4V%_QG_+01Y4F zphA2@Q)*9;?>uyd`E*L?W#GJ50_xS}-$@%LAg;^*OvClrEP+mS$e*FvGeE=jvuB2e zXKMT<8lJA<^E7;vhA-1_zTbh_8#G+kd!L3o51|16ZVl%L5Kzur8ZMvFK@bAJ7H|6P zQ;lEu+Wn*2jGT<7PlVURy0HL8fu6lQ;89<#sYQ(2UAnkJ`G!*&1Y;{wm=9JUaF za(E0P^q_{HN;DqyaisUFCyB?j|2e`<`wtTy&ku;}^4T`Tb$@c-F!3^pwbG#yD+(pB6 z{;-DY{PQ$i=Wo<-oqw5z>-?KE95;UDutmf5dTk}#Y?p@#H`_&@Z$m5`jsu7`-OYoxNc8@hL0v2@GwWi^>K>p5DcdOD+xFK&+l%cogrCLMM0wRW^gYJ=kaCY z+|Nz?8akhv_%2%sHSrM%-grLE|0e&fG|!uOfG)jE{4bro<=;yu)$H6C)ai*NjaqzBWw8=jq4!$-H{z@Et zJT10N`9F?>f3D&BI&Erydg;sHo(l z=||!xOGHI9EF63`xlAE&fS#9Yg)v~G?~NaAm;y)_|K#xiH3t3%!W#_y8^V_uIKJnE z;WBk_{EzopFkGPy4qiz3H3q(j@aqlyYQk?aaQN<&47VBhlZ0T>I z0G+3QYT)Yrsemu?sle@6O8ie5_zJ?GHSo=ZzhL0c5dNxxe@OUm4BSuahTj?Zsf530 z;CY09WZ)6P|7_q_5&ngN|A_E*1LuwHjv4ry#P6qm#D4n=;YkJ#TT;k?I~8DH{! zW8f1AA86ng6F$VimlF=(kcyIjE8(LI{87Tk82F2XpKag=2%li!7ENsD8#v$Bm~PHE6NYA5x&^K`F_MD1|FpK=t=|U`w?pld=l|r zYvA(BzjdVxf=3PfbiyAu@I1nQ zY2f9A|H{Bu5)R*2i_*J^@YfCeQNsVnz+WN!_Xhqk;U5@y0$nG3Y~TY3|EqzYL-^ke z{6fONHt@xSTQtA2Ki3hSXyEq~-qpaLCYDP zbd>_|cLWS9|07yx@cD{y`R*R@l^XniCHd6`?x*W6{G9~@%jrz`&m~E@XHN;#;-Q;HN=0ffnQB{n}Odz_)`YHoA4J5{I`U^ zW#H`RKN>ju`A-JUe*T+*v!D6*1#ZXpNN*CY7Z^WAcy9w|KMyu=_VY*s{}ai{j)R|L z;Oyu5gyVcdm$0&bHyZp$Xg;}2!|4)A@~_fxydL3s<~j{W{#wZ`#1Awa`IpmA=(lM& z@+Z)|e3ynJe=G5C)o|orMdR~94M+ZKi2vsrj{G~Q{hrWpQP{xGdWeyicgzn<**$iSNjKcwL(=LR~zf2rXp=Vs!!XuXF03i-dK^QK?Jk^d3m zPu6hcKS2E_MZ=N*G2(}v#AIOkchmi~AsUYSJBUAB!%_Zz;?L4>I{fF1@%-=>g z9y(J$W&HPq_cibybl)wLaF&n1>tiT0aDGIE_xWb|&yk%!FywC}`~d^cC!E*&te3AN zo-y>cQ2I?n&JwEE=LSBJ{Xl+VJKITbANC*3lYD(~s)4uCe3fV5@CdIAiwvAU#<0r3 zH&J`vWZ;Jhf7HN(RG(iPc!=;r2A)m0^QjQ3*BrugX#QY7R}x-e;C#I{&%kdc{&fbv zmGB=K_)CPpZs2<|BN*7lLV1pms|6a4{Era-A`M6W-x2>(4M+YYTI^q{;re`am4+jKCGlUY z;mFVH8T^1F2JYui5&tF)M}9sJ-mBp#zc(!w9?)>)=kwrW2L2q?>sbSTiSSo69OXBV z{5Lcl<@0?0djscn(FcTcJ8p$C7(O%b0tE}T1E0Eoi|t-bcm|yhSxzhAe0{+9eS|MH z_#YJ=X<<}KW*?&CBMC-;pn%IsnBa0j($6h&X2#-aO9te z5rjW#IP!BpiT|jEqkQgHJT6)Obh=sIh5W(txnK1& z@IF+pGy@+*_-GABQ|>4E>~EIO{c57Y--~XdPu6g>pVx0i2G0EuH)_Rz{REpNAC4F* zOZ#Qs1)rZ&VZ2thl_Zj?Ig#VdvY+wEN%C8On z5T$JzPbeS9(Tg-cCu%s33%>5-amn&S)PIH&KjXQCpQYjSQ=!bsH{@rMJtZ2B_6(yR z%I0V|+QZkCl^Txxb;Mt-;mFU|l`R^M{Ld5rG7U%m_sO0sH5~c7&>~{3h9mzc#DBAf zBmX+$-=yKl&+UGnh9m!n#J^R;k^c*lzg@$TA2vmjVTXnzKezXD8jk$868~-uM}D67 z-qLX7_fwWu%ZzTMHfiESz4_#mKe6o@7Gy~sCxZ3B+z3=x+!sicWAN&K%EIM3%F8aVr(np2+l zX-O?1x=e9!a)a~CIQA3${u|H9jPrBpAyR-iO#u=~Gw>sn&d_j{iBOJ#^E@2Za2i4q z$v1F*9==e+X-G(9j)89idoj@ROW^OQx_{VC#C1Q+lcivOG3vWs!}WS?)o|VZy&A6D z`8L^w{?zR`q~W?fPtf(Z>Hi*dJ&L$)&r}W9?U|xokL&h`x=39`<8qN+8JWLiL0S3y z`Aw0fB3*7;k=_)kEth0EZUUfhGmu`FsI02IrdFia!)6QV=g*iu zQf4@wh}qslubtcuMFEj&*aM=xE^5Dy=v^VOmE<-NajF%yg#|1fR`S5_HQGk2xK;p3h33?#Twj?gBUg}SWc4{e~ zFVdTr*Wqz!W%`*IiSFk{CQVNcFD_3Jqv^)M!wwZq zBt$30d`KU!JfE+)m|1=-6!t1#Kn3{x6|a0I6gFid@3K-=LVf%~-OEEhKA-Yji_e>( ze!9)73PD^+jDsCS5y-0t%ty@h-&!hvL}v!tv=z^5CWb{elwl0^l0sY~;?!^2kIxNw z>2Ia`R=Frd3#P6hls7SC-!xAZqJz8_iXu(@JwUma{^v+PpYN5lSY2JAu$TTLq<9|+ zhk*6ROI%a`70|!E^z(fVUO%7=45lu8PR+!SZ!dOi2)i}?xU@6%-$nYfB)1#o(mL>m zE+i=uCv8SxBekEwCf=d)rTW8|z{KU5e|?-MEmj9w`u>M0W)P{i7n@14EGDw z!HG@YgOKB;KXjcc5~2dAAJ=oHe!R{>7IP|3K2Mb&PS<8v@(-BH&vc08}c0Sm#uS-x>mdPRD} zs1Sz?Cg7-O6_3r%mO0s@Gcpu1uk)(Bg2_J1t-S?L*SaZCM&ZaEOu=&jk_`arfVWux3`k_qEI1^UT`R2$_bv>mqXw!hiFw&1XE`GZFNmozF=-cR?A{w-%1RuHp85wlzE~27#Xj z4Oex3VjJA&Za-4ygR(Z*nBdqL^o#9Z*nY4nq3sCS^%dy<5@f)$e`Ah7n*_Rt+u=E- z?fbz0@7cYFzi;n^Fk_i$*No3UNn zLFNwhhuyagu|am|lfjlK;q*aYxIJ}1_(s(A{5QuQ+xN$7ddND96PohrkXK( zE%Des=p)$1@KIRLcAxO=F{jG1?Db%klX9R$<|Mkm`)buR;D!IUf7V@mS`JN0m;4xvC$GN7P##GakKl zsJZ6cg?7@p!h$}GWkc#*LFdO` zy5|Pa85|jIPlKbX(|Pioa`dvN<#`9|=g?3`rniueYB&mixE<>b;|G^e8Y-oCe$-gm~ZEs%|Xf~*6+9z23%mN@DviE<9{suFUF6tR?S7h=*CT;WJ0 zqGQ2vs?LrGJL(FVtaYF&qMSoKb-7NFA|_oa3!LIa#FLWaNGWF0l@d8oDeN^%%wp1& za>6acy%vT$ldhBwo1v79g%K%(CFT(29O5}4g*c$EG0ELeby`ljJ+P3;5S9JMdN+Fs zG&1Q{bpeyhqGWUGNyplMqLqtssI=>*DkfP0R;6e&r(AU>+%>uNEK$rP>ws@|Gsy~2 zU9pF{6YhN@9EZ$eGT(u!S8@(1KZ;Dd8OA^_Db8PzjUV#bIV*lGUQ@5|7$3 zUx(_3I_hRK$z@@tXHr);+e2N4!zYK-gdKHNER)>?UoWRj=V1D%m2%e75&Aciu9O<5 zI1#24&gY@=pHZStv;P?-u*_3|y9gh7XjtOkI!ajG@q1?M!1<15>R7=Yj!3qcCt~k8 zIact$Z}w%2_!zHAd2)s20Fyl1!8{vlF=w*ef3mN{3jRMicjl8DVD4mcs{<{3n8=}Y z57QD0nam&vPh5qYIhE})^5dQSa|@JpTuwy1Ce3v$aMrA@Q8jGTYYtZplZOdHqlz}i zT5!Url&~Yam`T@yO12=?scj{b>C z52Gq#jp}gT%O?*NI-csV%f}Y!aPpW#((j}reB$%QRn8o+iTtlnPCe+f3fo47Ma)@Y zg(2P&HL!B0O$RV0j%|q{ETJMYJ*DxPl0C0B{lR&z9)0dvX!(ZP4*f zREt~WKOT$rnb|J8Df=}#!l|7}w{<)0srVEPhEh7(V$My$d6cN7qhH(`yg3y8!znzio2r6Nc zr$m^Mm}IpmyJRz`+}fS+vLeG#H=9Y;0r!TOWCf^hwuib7r#;f*d=JVJ7x4LVnPY)- z5uvNQz(ZXni{oRwu9D`+zK}^*T?Lc6x(hwjbvSqO04Q+ORkKX)1hDpDWBF(ry@@im z&=E#2ldhCSl<6EyDVz}|;y-f$->l&#aYxC2<^b7AGMujRpE&?$xPNL6ARmgb<4mt} zFZV%rKzF!6V8J}eSi!8+Ha;=Jttck>OaXGRX@BoB;|?_}8cZ7n{aI z16BY`@=#ZG^LC!CwY&8lh+RP~y z53?f`aSrijk?*eQ992Zb(>Q?gp+%S+L6C9_r!rhdCfO5;kyBiKkjNxA)<5RxkfX7P zNj63~no}(PA8>TCBfF4E_PsKaQ>iW^lWfdCRvT6WZaI!@ZUb-GR(I>vZaw{Wx8y$k zyLGo_!>gaZ1Zzsqq@=Tw&Q5|?hth=IZ2-K>n=llJbCZ$)^W&?%fs@1(c>XrAHyrG4 ziaFTR;&Pq30{fJni043&&b>h9FnCWf$uEm_IZYnA_O$G7T%?;!_?4)WwDNv8_h5rgn!L3@JccnLTfr*cVg1 zu7ez3>c)xC0=?702-G^P?|3P+kB71;JyBh1Hq;7PQCZ*YC}sV$Qkjt5A8kQm0NRMe zKr)AHIN8-ZrDq771dpA$(nCEVF&=ad_6sb0%0RGwcAq&(bN#pl$PiSH_)x4D)RBaq zs;Y@~JWZFcYBr1@|FFJTAyk@1O8r=+(@%qz9o`Gt2HWb4UKSok^d_@}7>Pz;L$Dd? zx(+39l&%9cWN40&^&{;kq=h}309dcGi7Ya*e7FK#tAa^%Qzt8L?u2kL6!HND^c}c-3gVK{6QIa5@f`K zu|kAD@ETZ__&c)QZV86$`c9bI1OIlT`T$un)Y4uYl=w2Fo028{JEWUaMPh&H26!ND zUjXl?cFu(;2_+;+Y8oczW7Le1yz?ym=T8V=BJm=KFeIEM;lyBI0U%xQMx6wLRsiWl z-n`iQAg~tFnx3CQQq%YvCM!Uqt5yV_h%VyVlE}B`eNz(gyKxw-j{=_{KiVe+i@?`F zcEOi35|bd3OwC>K5VVxfP^(2g!-`vr6GR{r3yh}%ezjdjq2;fW9z-sGgYq(J@;56l z_kp(ZFHv5W^wKoRFX?4rmtL;+?~?eXjV``otxK=m;?kGzaOu|9Tzd6ExqpI`vqo5M z;;K|Fadn1DNVC`GYl(FQmPkBB^)L~5Ub-bUuuCdH?!Yr{B?Hf@O3noKz;nqWPy$3E zjS&&p;C6=%e9DopxmXS8?8I^1twKdS6@a6|5{86TCv$icJm8*)Og*hRh+{~3n~cOn zFRRE3_p%CoYar1Zk>HoA7s(#!>`O2da!7mKUqD_DWW|tJcV{9T9L5qzkPX*hwOz(* z&<-t$Vl=Z{5v{I>r=mqX6)oZ^9AK`*UnEEA`y~!kH+R?XASqA(iO-^Hm}gZ;eC9K%@$*jHr3?2&65QIlz_E3vos)C*{8#+NRtHgID#It;BAuje^1#yw@Y9US? z1u{8che3?DL_i#|YrQdX8Z!9She1TrLZkzEKz70UtE_gM+>$U~48#1y-j;Nyym*2H zw!5PHSm;|tr&>6rGL5r`qWfxiU(3b&S)T_{Iqoo-_%bSkV5xoUlC9lxsAAW!_Nbw{ z2eV%c3iv=cSbGFZ+1S|;epU|fdG;x?6pjJ=R8{H$q|?*@-+}ZQY8HD1>GV{|{|BTq zLy}Geo9wY^l0FORf((}~&XIH-;&Z~1UXAoc`I26b^!E!Tjr+9QHFHGbaAl&fssj&# zo-RLyh)*I<0j*~A-9U-J%MhO)coR`{c#<5+;dVp2N{g= z{31_%&dEsx&WkQ0Pl{5k%Po^yktU}I8l9vpzXrhJXkGx`t`ld_8R{-cOSWx5ioin< zCq9lO1nUVkEn7d69yv7d;vfXzki^Ts{#f0_Kz?Z-)uT`wy8sqfJ&NTEk zGI19Z+n9Ka3Ecco4#t;(7>Pri!<|4RPPMwq+<)Vc|KA$(=~%JEcePpZ-N{gAH7mZW z`q?x9y5MLWCYk&Bu;r~ZN+7!!g$b)kj$)Mq37MnHOx7og$=XCQS(_-%*CvGXwFx0# z!}BFhmQ3`afn>=*EbtjbFO9$9GQSuNH{kaw|!PdQAvi7i%^)M~+H%E))LGBCV^ zb+xbS;EyC2r3){p6IXic!n`P5Vk8bo4y`~WUPq(qUmKuO)OR>Q2Ut}eXXL1rh_)#C zSI)nlXZdS9&+-Y{%kjOe3*`BKwptNPR2PpX!(A4gBa{Qa(m|z~kzoXCYD* z7|BUqCM7c_MF6h|0@I<0b^?*-0J-vXCfUQlYt?-Z*5k6{EMTIUiB(LjW8zjO?q%Y? znRo(-!M}#cT^`+ayyejx&@MwS>q5Cax02=W#1TM&8C#%lotevugQiOV_hioUV{}eUh_EBcTahmUHc8Y_D9+EVU%4TM%i^B z%B}-Zb{!y2W!Fbhc6}7zu2L|V{PneA*Vl6W;C3>V*01QC$tNVG;JHmsK6o}8sQe5W z+KE3G`P7y7FdxowuJmDY^`NJ5VX9B0P8)|%N&`f2iSNV92)EQYwFYqvlc&7~Jb_BX z)JYRd{wMs$1OHb&Ff)JVtWetNp^94AMliHA($rkjP#?<7O3z5o45ii9F0C8c*wnBv zQqdC1&d$ursi+#4krBxnH!dTmA~SPr)!3>EAm(RRl$VbwADdAg$*MSAKf{oH#C>w4uYdTdho&hJFY$O!^c0|dDDka-FV=hdq-tuWWir%#wgkyZ&Yo~ z{HF4z<)yfz49F=(Ii=BZN@L}evYgWSOKNH>%XqIn&_6bN29xiLUlZhkbD8(j*7lualo(Rl!x1!&={ zSvoqia6-{+SO4_fXnP<%JvYlKAd}hA$uW9zR{n%cBb}8MRRB1$#*8(1M(3D3V_;K1 zb`oeUo>G`MJvVb~h6947kDQj^Xtpa+0vw>pcqOzvu^0M;Uma-^O*uZ5{C^vsyWm(JeMwG;eR@P+) zqsm~%%ILBhr)NH!P|;8?w->EjP?cF$UEW+>R#Pb=%Nk+CL@LXg(MsG6GunV=u)ndn zxvZhF1%_L*fN>{~YldhR^{`vl5^&4dY|ZYv#+ot&9XSAqJdrC3;Yae^LXle}iV8*X z3{ebmk+`5nTu>z%%PT8u>K6#MifusC9kb_0DqCus%VIX+g!*GS^h*iol)7j8#z;K5PI}!YIPbNRZ?w<|^R7;LA zy)~=KnxI2A%2+chYRgj1h@c1|!NRI^c+kJf(L&S>L#x6~|+j2fMul|CkY?5O7D%}osrEu)q+H;p1u zqsq&hDym`q2YW~_SvC?&mcq%QIiBd)Wo6vuDeS1ZD7_l1Tvw@%a*}F^G}V{aDge$U zIOLll1x|!9ui*KxNLf8snt+iM$wMuJHTBFz&_!8nptO`857^O|L6Za-#1S(v-fY- zUVH7e*WNR8&YYQ03b;FQ-*c87PEBhQZgC=<7O4rhkBkcUi4=rW3&P>Z=&&8V*r&`t zpiCIb*iM`1j!-m7=gqbqZkM(L_4hg453Y2V-JGF99C2RuHR28JheuS4J4KvZRzUx4 z1UENx4%^WkfSoU_f-&KYTf)5}U}=|#^SHf-q{oE&f(M#Gguy!E9Jm3>u33)Wb8dE^ zW9zRk2se*74~A+~1c8gk6olK}1pB|GBe^e}XP1X^>~Mc@e<*r5oa!8aUg$I?+~0Zl zhJqA`W#`Ti*zm=5ds3Q&p*5d}3c@We3pWe($P9OJwtz5pEJj9x;RhjJTPF3--Hr;8 zM^x_|hNkEcISl;^(W*4{@j~Q@8$$UFg~&cA*2>uj0o2~vr;Txb3yL8`_Bwk)os&#> zL7Cu8hK|4x`L7xQA@UnvBMvAdGF5}yLxa(U*}CD*L)!ZH9Ps*s*TYD13Vf!S55Gaf z?OMZ0)Nm_kfP{~RFO`ONDvX-L%$9n2xP4)QMV%t6)Ns#@IH@(^OH^DspDa_(y*mYz zA6Zu5KmvqDzznraO(c-_sq8+8q_$~o63poV4hn-2mUBSc z@Ce%Q>arRK61?@%^@OUsjjY=q6>**isO4Z9}K;G^n zil6HNO1-0apCqo|Wqn=}zf#q!3MK5jNO84F;1doyYFYTJF9! zN}kWET?}_7W7@q{%H8p)GSU4s+U2#1tB<5zhKWBYZag?0cyFa&+yz0UIw&5coVS7J zBEzC?-tZu#K3DqTJ7r_}yW+`rr@pDU_^y-6y`VUrfhI1y6?bnYOW5i7zU=`{l=MwE z39^`RtmO7;p4?u|liRC#a(gvTZm;Ia?bSTFy_yHLH#y$4d~&>Lo*ZwQC&!!S$?>Ln za=dAt9B-N@$D8KrhCNIsERMc6C4pha@tIFF@17*9dGfrWdGfrWdGb7PADqqm^~yy7 zyexoshtqaHJue6FM?p_(^;QSnw3yyl%@z0hi?8kQ!Pc$48yBtNB)=ZEt@Zt+ig3%9 zDelDs^BZ7%wHD(gu1dkX%vHT!Jj95%Q1V{CGoPgF@%o*w6?ZD`jk_MC=N;I#7UP#k zU~g3~=jby6kbO$Yd*iVh^0*vO^4_>OuCX;)+3AfV<~TxI^9%JLtv)A!ZHeMukMVVL zw$kH`YnDGhpdZJAJ)Ra&N((%L*O%k{KYsH0RIVeG8_P;y%a*hO?tV!rbhI@%`}=(0 zIzqE(@0qvCb)CqaX*Ml4`C_i2&)f&eO zE@peTYOJ`_^JD=3PwB}Z{n)=bl*UaarLlh{XA%7HrI0hQK3~9}04~puFTi7W`~2qSk3JzHmW#$qNJcJpue+0O#Ke znEEHec;|Y%>!e!0Bsh;L+%YIc3!xs#e;U9u@aAt=O!<`o{IdW)jiyvn&(8z+KLkHV zo1oTH;d4A(P>6FpberW>_Pc^>d4zndlk zlkX4UUk32+w$hC^^=uB{uLtl59jZ+|7X3TxAC_>KY-5;;12}w*8+G7 zP4s4a3j+8(g7*^f7N!?#q8`Z?1@I37coAJfn0lTK;5l?EY07U3;LYg(W6Bo?@cRVM z675Z;Q&Q9;`H}$sVE~`h(d&1q=fwb?N2k1Iy$=QO)^q}F%FhnqF9h%|bV_aNxi*0R zA%JJmrI)Ga#sL0K0FTj0fT?GO;OC0|vSXf~dkel%@IHc z_!xomdBE1f78kaG>ph{ddoITu-}Q^jrF!G)&mca+;O7t@W$+7#^Eor?FCaeIkiUxf zRR+f!qj4$M8`qvX$}cqdO(eh6;CB;WVel=)Z!$PuSL1S<-njKXM|_>Z|495^gC8c& z{lk91pJ(9mklwiZqjcW6&EOr0KWXrO#Gf|!2;wgo9Ny=nmNyNaOXsPz2A@yzpBQ{0 z@lyu>9q|-uAGcTkU>tvRs0%Rv1<8*vcs22f2Iup2eo7+iSw-@54f*?tFE{vy#NRad zo5X7k-irJaru|%RC2{_)+vFLB{N*GcGx#LpgAD!&@rwiacMSdmk}op&t;D})@E;Pt z+TeSMUu$sv`Mzb<7!Sw$Gs&Me_(9@nwB>dkrhI3E@1%V90N%&oYbk%e!SAH}FoUnB z{1pb@MEP=q-$VJ?w8i5Z9lDhtmm2cR=zvyZ@CWI7mE#EY&>>yv*=We$MtU9+yuXsv ztDg&w$3fP=i#Y4&bFXI&KA3d<$!t6{h*&V;n{N`)Pu_ zuqR(h!}*2aXA{FsnW5)5Wam7=(ayW5-UWio{#q_L%7P9mtx60t@l)uB^T>c(| ze@uCJ|Djs2U3i|%%dZ4SJFlSlf5zaOi2sf_w|5CC`rP2v#G6t%mS0c2tHHMr&mqqK z=W#pA;Pc6EQw_e7_$-6-e6rZ!949v#d=0hd4uf<2{K(+zN&cq>-$49V2H#BlC4*m2 z{M7*dmcjY+)AtR&nDm@Bco}iHD^4x!XXfb!f0+E4X>gtwdKmmwlFu>tpNS7PcrEdf z2IqOK*x)=LmKyvM(lf{4^~9GLJeB;g%HWyA*BZPh@dpk528l zQ+I{1SufCzM#$DB^4<9~Y(?@+&A`Veq#pub&3xomb@2=iuKr z-(v8=O||oWEI7`$agD7lf}=n0CizDU{x0!nh;w^+zCB{_YSMqk;5^^9 zA$wWR7LxBloace3DIRhR&hzI*2Iu%3Z}0=8=X(ZcJ+lq|camRXaF)Nx;PoWW-)pe_ zEdPKZ&-46tgY!K9xWRdzf6m}M&%bJLp6A~+I3NG&49<3*FgPC!ILdSX-Xb{4m(lk_cL1_7V@a)4*K5cC4=uH{+i%8pX@{>u)HNW>N!U8 z?+A|etfc<>yWl8aMBg)gEI7*FO!8k4XZx>*eYmuvxG;Ghag1BEvl@kAxma+lcW8#f zR)L|X7|P)?!{8f<*97nf4bJ{~ggDxR^=_c{K4tLV5r4tpUlaem!E;+HGp)A_UQYZy zgWpU16XNVQw)34aC1R_)g+s znkUeo82`C6f0hx)cJ-nD#IA4G6 zH#lDpzDXSYmPJ0m%?F133DW;B!Lh&Yq<%RjIL0&k=ZxSeZ`1d_PD{wZ!hUAIwGbTT zt4O|$;HaPd*;R0qe~;w53y$*a=YE2t{8;*;Z-C$^&;GwuaFqWw$qy48<+)$R36Ao8 z>3ir2f}=e5SBc;#|6`Ib6CCBa9~Tnm{^|_-a9JhfQBNA};Nv{c+hxS>G356W-(>K% zU6gujtHI|H|CPaCA`TA=R14P|qYuBIH~3QGZwij{Lm|x%e-#|t^+%Hb#Ne6qp?E!U z_Rm^vhLualRpvZDj4(LQ4_6p`FX_2j@Ng7*>r*=p$NL;bQ#@ctmbKBfyjDLDG)VUmAAaFn0YP0Q~W9Ody5sJOgE z9PLDV1}h5ZUxN1~hMQwTPk+eoBK=<*^4#7iov)$(^Msyu#5o>@kUeJ$j{1Azhx)h` zT*gCx!BPHMk{={E%0EW>hZAReVz3XFv4Ur7q}EdnJw>FaQgE!d3w_BjM{sH9QlY<} z(0{v-M?Gsu4~w9kcnz0NfIhBL;|qD5I8A#lUqYPwf%R-59-}Sut(50;0OmX&#)bSj zkY;;E8l2?{4bJvVF*w^(YH+rv(%@`QwctG=&DU|O4bJy5@Nod!h4Q7a#btxuD8C`c z$1dZtQ*T_(c0XzGjg;SKa6W$RH#q-(q1NE6x6a_7Q2waFIe*IF$0^U}*Vx`(z=jjg zr1mi%O+03B_E(m{`8b$k@O`8Qf46`O>wiIK-Qzj(EMRQU6d{kC?cx4mdA6t0kY{_U z48D)*U1D&yXRYA!d-)9pkCL9vg3IsUw;DW7@;e2O5yQ=s2Jb=p_6goi$aB1)ACMQ* zz5_y@raZOhZG%^ne68Seim5YrjO33B&Nkw%QwD#V-c+ev>!R^lD~J5=Q&e^9^@=vD!4rE zR~mdO8CoTHUp5}LOAH>Pebs`?p!}zl;YS*C;Rh{VO3a`?n?a7s|_ioK5l= z=d!5=_aF1YNk*94dSWjFEk$o?85xa_YR1eg6~WiP0hGc6k* zZkH_{)ukV!Wo7FJoK2fPeL=;wmXdOxd=>m?uy0aXg3k_1s*WGNm9&E&)RkQ}f9~80 zcru>9ZuNXH_inIe4_7dgvE> zkRJY(2$ftpJUI{_rzfpRDw+T)%F5wUV!DvoP4qap0H?r1h?3hSo)?!rZ~mf+?90YZ zJP#hkS2jCYHt|ts@MJ(NocJ`qInx%+n7?3d$#oSA=Hp}jl6>VpWX|76Y!^HTj-MPz zZh_~BVk&#V{Os(}3%@^WQCVg7B79Jwj8UT~`yR|R_K?zw>5JiMd$Z<&kt*gZDxqS0 zsG!c8zI7k#=D(XBG$$W>=P#J_bUc4C^)NiWOUEcYq!6D!Rc2*Fd_v=4yL2vYdz5GA zUSRcDk_{_J=3^38<=Oqu$7HTr!wSG41=Jc=00t_c*02JQr+`|+3cvsb)EZU*`YWK; zumX^)fL?>|=HpXe(Z<|tV6Z<&?N@6)O7rac?YDUUDNV@11k5ce+Mdog|9<&F1fD9V259M z1z}$`7o@Fe>rUV%L(wTd_NM|j?SDAH{%SM|mY7<5E3>Ywfd1c1<@q{>HJIh`K6I0z z>}s-qBo##er^CN#KlTY$WyU|B|2I@Wmi4RufKUC+ed@m=p#DN=7cP8VrgO=4VSM=2 zpINF)&_59`i&@uV*y&e3tC8iSP}r}0A(iLrRJOsazc!#ezJCjs zm|A-)vpoLZ$FKfZsQhrRs7jgTQv>3sB?Vfnf%15tx~UV3M5pP3a{k1x?9BMZ&jxx6=SROwUmdj`=-&8_Kqbx4GT~GBxGZL050qtk|S$Ivr@gsklmMA4b zoWHulKbPm@*Ind)5_308NbpE^7pVl>%@lv{;^+SjR6jrR3hVC%|7QJo4QuK|-DPw! z_9C=TE~YI0p3P(^pM@2|!uPZ2T(ayEDC}$h)w)FO*?NoWdcePF|G$9w)&KNRU2b0k z_J0gwe)TW8gUZu9hV}P^f3yD6z_5Ofb4aS?h7o%E6pcf|uB~kI&tZpO`3uJA5|g+f zZMht8@$(B#OVKq{UNTIZvR{CIkQr{W)>8SHv4h*sdQZT9KmX;g*Ao2sF8U9z`?);F z|3_3m>*MXtaXR(O0ROSv;eh(C z!L+LEvh4Z&VzA`kiWZ&L>p^*WiVhrqEMfGoRt(Umk z#4UKLwRL*gGuuu();d7zt)t6dKfUbPt^1skx4NcS*VMJ&)Uj)(bV zeeb_J?Y4jDWGG$Lpa;vF3~6wDAk=Q?OI}w5!$e$RQhi zr+kKWXF%QUxBm_5)&6R;{hR7G_tmyo?Y6BUyXwKNFTk#2VAtnh*Gb0)AF^E?j>H|S zJ{4?Bs$+#$M=jW?ea3dT1G|%L#yDVqX`em4?HI%##%v6HY4@%!!WcUS^>4=50v!-T zy&;BrBggzP6&KG@TzKWNj41>847kQw3&;GmS)l)1+gg_vx7NXDw(HV2TkEncYxlWZ zt!-JE*6uzzp=~%OtSRw&+(wslZQV7M#!X8-Zen&+jhizoBd?ua)^6KZCG8As8R; zL;QW9VxW!MU$^3x)?KaWY#b-;?dpywhvl$sTUVBxIv47||4Z%Y5tu$8j@tJ=KJE&z zZ3@^pdE4n_leU4)>s0%o+!?2dw*M)s{)?HJFs?d)Y)5EEr-XLk7}D)%LhXn^JHikn zdT!vcme?jemY}R?QwQk7OlVVki0gI`*KHv_GGI*U_Mz-IwF$;Cw5cPs=}NHkyI}7X zFdsnMp29f-+U7KI+lGC9dYKm&Dz5r?aaBrjh5q~B#?weQmQvgpk}*>Yb1dfJ9=mHe z&2#f17-R24EPMbyJPf`>J7oV_(7!xy|F_%1Hbv9p^_B(y_N8x`#|_VZ|2eqwtJ2r& zZ0j+M71nc%<~*ERF!piI!?^{IBUlH#dEwKT6ELrcd3hv^^|%wS_vT|fhTweM{+s7x zyDJ>q_ClQ45HBH!YeyZ|a9nyeh9QQ z80Z@cdWUT5rsn<^w(hgKz9qSydx1m$pI-LsZC_2cq5hDn|IG6(U*kCf=c^M?C(aKz zezL&-=R!Z!I??Sh@X>KK_VoCOS{W~Q{WSg=#BOozrK?-Rt;8AezuDtp%sjlcdAxpe zNcSE3RUL!Dhs{6+b!<)3`{DVu>ppzQT8GE1a7uL%ADa*3+zRzo+g6_6d@{tbiox!6 z$HxtYwhV!}}g64jF>(z*1@P}`<8ZiuC zX9egyd`k(wxnQhXkFeDD6xrjG&xN7>|LEd(UiqJ_08U;1tBc=x{eQAT`iSa3sWL&= z8Cnt`WbkuDTx@vRi%z+>9i~{v?7~e1-HoXT2DMtaG$?XqDPb1j{rDLcE>MJ%d@0np zx^;2yf)f<+wdZEqXIn5UBrZYb&{aN|GoF(hT`iS~IxH(lOO{)th?5&!G^4Rv@bVrP z+nT^h&z6~bpSKROB}O7Jr*o1nML}`7S6-)rwD8AHwl$HHo|dwPwEQnRgo{*@?i8!l zohvqRZY|M91X@0cdL2+f#N7lnnu|g$oGf-LzPgl>p5m)rjg)9u@%UuLvyv4zI(*q{ zwpGN*LbAoSDp|4DbB&H@9t;qRoE+^cp23Q}ZfSIo^Z0=9EodlAP*E}%15cqe3mbLi~vr0C`>nV0hpn1H5hX9K@NYj(*3wCbPjy z9JVpV)lP^PDdlib*Er-+*a(+(%SIGD*vFXrGvKXC~f62n~!$8&NYA+&IO zqkT5mRaC^u9WI)&my-KDL@9R@WT6*h6FBK9u1Hqg=&{AqES!~ca;s}zd9vbi*HlUb zS=`svGLe&>;<9AL4UU~SDda(`uah{p)2(i1vhD_F^C?uiindxe=c--Z99smEXBOVU zO@>hAWT~sgy`W-e!r_h!@;1n=YylME%w)w4b{1DS+*Mr6$$c)Gk*v7US88!r%S2A@b5TXI;zkd)!LF7` zoaA7IPbiWVmy^7^3Gy)yUAUm)q^GznS#g7djfWNYvK|ne+wZpH>SWywUPyGN(mAe{ z2F+myv~-L7=Z~A|o^DQZb>HqV74;Nxk`;bCMeHb;L^#R4`|T8Q^)P90QYvcv@r_Hv zr!Jgi%f7`N#%_g=SUBlv!S4bRmY|r=ASpOvdoRrlSH@dofSJ6aH zPI1vJu8!jaKKbLMtZrhXtIKnBPvWFkT?JRi9<;3rPRi;gHM+VSx4Oxk^r|c4>NdDi zWt^1NO>VHdOj6LpRn*9FNAm8b;W@jI>ne5YnmLD(OFTp=cN3(TI{}VmoSf=vnZZe} z0H=lVn>fervn_WNtfI17(5;;kK}K+s;26tE?k)IcCY>7#D?OEGM&E zEsZ|y<)ZNUD<{3!X!LO|->rBOC#8cMKMc4uoGf!vDrz{uGsu!m*P{P$9L7AwoIK#7 zGEN>Oqz_M=%b~kU;d3O~?{0!3&I=6ptKed{x(W_^o&;bT;<}D{Qf?)bFzezvSg}4+ zV%E zl|iO?vr~gUp%NAs1)p#-M*Cn4agr7Lp9|Wp>~os82|LYOw(r!ul|8XN+*+PzIn6I` zb7_YQn_kp31XG36)4CiUWt7qmHcoS-@a%*(w$r?6Q=Neai((1PIW|(zzUl61nZlFsMVq^0Nm5Et&N*j!lW>o z)LK;^*44KW)raApGS^PXv~>j`)6NwPqn+(V7WQVkO@d5^Ha54QV>URcbtIm7@6Zmp zU}mSV6>5)(&UuvRa!ZYE=eB7DVSU!EHMSMXTsIVq?3xWe0u#f%I$YjnaED8wAu*v# zyAt=o&szBgRTh5tOpR9A0iu>L){^J8TkRj{QwhB14P0g2H8c|)bw0Wc(&V>%&r!O;7f^$n zVuLTF2CK|PXc@L-aM@U;b`7kX zUJtAEI^3;xhEvj3yLbog!ygc*pT?C^>87maDNh2$CFOG6h?Gl|Y5F%fjcSCFkE(U5 zm4@%`ahkx2Tha#7+Co25hQQu*d@ou0C|se4m4?OB(9$&g<)J97q}9{W((pIoVvpOT zbWfvdt5A!tchg1Cr`oY;`0lV4SZ&%~NVOyj_N%lKQ!oEX`!j$P{2dc6_ERb-GwsJ! zK;Y}%>?ggTw0G;EM6EVFJ2Zvg?`8jr0%b?CkF8dySq+B!ZErMq^f_PpO2|)kq~lRt zWrTjKs4D)}-Kt8ZsdZDePFL$@R@$e~cIPClQfxiuttRW?r$_kA(j?H(9KQtV&<2ho(v|(L+$BmrhZ7RQkFqFMa)LFTH%Tm%iaiFI|1WOV`xF z)CCU*#d=p-wwJjnQ)GUSqch6v)gwjbw$Zkg@*%Y{`Wqbr(S51{l#V{Abt&9=0Kk~TU76qr+k)5`BM)eZd6M4k8R0dlR zdDK1yr!JO-@9>H2vRm3#2EXno(#clWJEtNky7YLIiOAAT?5L+IYR9}xnw_sQN^iPd z=Zr6 z%+n~AY1gTYs;7f})JjOKEI%OtEsN@sMS0f|(-9XwU+W#uOOV9r*{aB8bhOZpb zV}A>3NW&dzzjPs1OhX?Vp0*!W4)#gfA0d^3DO^&=rs2DSoDUIx1}j`bi#o(Y^Hc^K z6ROf?^lAd>YjhY~iRlG8)_;WQg_%}Le@NhB*QT8hNimtJ`CLtkYFhJVy%c_Poc%%C z?8GweJeRIYs~I2rLr?pt!b;h~HGY`34NI#D5^c89utofuSaqYdJ$E_87ycUDx&;!Q zF|i&JU5=9y1ZUZW4%~|kXMUJ#@`#OxsdRO4OT&r6!AT*8`*6XawC7_gJOqvGhDlt) zL+Wtj*1r`p_S}vjuj=o~iCj($=EP;3zz<-Q@Kumd#@@h*N=|^&{mt+49@xsuS@z`6 zDrniH&<|ieF?2Jmi$klit)W{$NH=wPigGjllr6mjuF#Fz^>{>0_gs%%Xr-Ye(#`@w z(aow~)qy?6m2ZKBJr{G~xrr{CixqTZx$s=65X`Q&rND?g;kAj*TAS#sJA<7yKb_6SpqixOh9e0_VxosugRmZt3xYkQ<|J&I zIyLnC0wa>AqmAg79ypP~z}twYeLZY-pNGzL|5t)lYR-djhVBI+U4Oc+AE!P&|HV)j zE^+v$Sp7+&8@6D!%P{y=7%w%Hk5alwg_O1z)gQJ%5C4FdUPyUG0fny5B|wp zpCy{|8CKX0WpD|9mN=;%OB@f!65D$`aqn^5+b6U}Yx*2d8@x&MBv#wECqA2q7Hod_ zs}|=C0CwJ`u*$Y)j8dD5$!b%MFHgy~%jUyI9nY3Q!s_xn{IrM`j25V`%U=`Ncr}yg zJ^aE7EP!(i&N>s+98;v`;_+&Z*0SfcWWDORu3DnPCbck>{%5Qr4bM+ixTjvG!yR$@ z3AOJFSUaA;X&alY%IVq38-;3$(weUz%{mxX$Y59z@`7PS$P0#Q(dpHy({(W17{d99 z(>OWlbWI4SB2J@D?@^%#Awz-TD0^`{s3q*!C@S-4f|pORvHN8n``^olZ8S&b(IhV) zvC%A<$NF+Peo}1=p#H8oQDxqM0WF#60Tga-w>U2jFx#FrT5T$)sLjlBwV6?+HWk;a zP5ElIDO(Sl#zoSt5HC79dZ~*#T{|A<_3;bOlP0Q2Dprv+fsSH$L>sS;{K2uM18ISX z6LsQ*ZdFGyeIc(7Z|(_}*L7m@u2w4YX!fqQaURN}>09Tz|4)MTKJ#}ZJ*?stV_64u zKlXG!Bq&IJpn}5dmDMWWC9Ezb**AIySMePwqxc@k%EZLI*3MxXUaJ+2OH?GL?#T6~ zCNaO>V{_y0Nof2%wwk-$mSDHjl)Tpn_r127lwDCg-tp{hh`y^u-IMh^6rGE6n>zo- z2~8z%Qd0?>)>Hx~HkH7sO(ha0w=RjZ74=dvcwr*UTCgdG!#`{$=tFOjxM0xHfTJVZ zF4W^;ydDoldOS?f2ocBp*POpeEWzc|?y^5SHdE^18GP<5ejMoe|cWWIVU=c~6WNDQ*4 zz+S!hb@oSU3ic}eD5T=T?d+XU)SkPUbwA9B-JE!l6R&aNFP!*@6DK%GTw!S@ck-fBsMafsxC0R_M|$A(|VedIE|+{iPLyfCvh5Y z>LgC%O%3^UCvjR&SM_;)-`v^N#AxayG!z#IYrKYq{^^9j>G)gg~g znEn~UxlW(-91Z;iju`q?7U9dV74`+FHGCP$T&R+le}W&R=!5MEd9Xbp4z?%6!Swn()HN_@D+4wK!m~_+;oYD(Uq*_969qzA+LnRC#a46{15OFC2y{u`d5| zXFxShRgLNxLDy<&C-nzF>fH8H{Qe@|9FK4*))4eaw25Lvk;M@FzvcgC4~!c*ZbB^U z+*sKhcm#Y59^$=l*8F*~-2T})*}1W-IdiU^dtTLo`BztzEsEvk<@V1nn{j?lPDTIo z&(Fy(%gr4$W6+E;NKDTwn>KCWv_U!3D*Bh5YmKf0|zDVP?hB6<>SDz z=2XnH###%lc~+IR7)INmJQ#f30duQnl^~SB8UgR>Dukc#4KK8YkH_ET6^*ruU_IWN zG|QSa!>XEAUOsEyOsjI*LU>0;xmy-{vuyr6d_99Tb3v6Qc2$&BmCRf)e{mJc53zSVt9c(A;b@#wv;DAgRv8+w(_r^B9Q3PD9N2rga?|!a^t>ALV zaqh%EldNiX*}~isJx%)TKx=$3zmg?c6Tihp?xCq@@pN$ZtZNh0skgF7S@jAGJ)UXq z#z)6mWs82koELTwhk43{CMiKQyTWdzi0*KZswN4cO{sNfWe3ey|1o%UQ6db7&40mG<-c|x; za3_m{AtALZ5xdf!*(fZ%i+LFsRpuLAP=JoAm`v2f5v@83ck^+`1>#ubGJPy^v+7vn z=JZQv^z<)UqX8MBGqM?)c*c=ZLqYi>F&v3$C^B z$huJ5X_b@=DJmLrMahKAzdNF&_=>_2B_)>iUpWbeJGkh=!oCikzI^>zcBk~N>c#`U z>{Z*5>0Mer5V{{fHbi;+2oo2U!B1)NavPVexSEpQrSPuM`jopP_eAea+mQaFmJhVP zKSO;xf*iN|*b;W644(@{m8Gf#UOH^+Zt0bnb{(++|{3r&OeYk@5 z#XX;GOn;#H{irJo{`q}z2T`sxy-TSl2fhWLZOnL}-Tj%Wo&%&)w(T&nd@OIY&4O!h zT>RSBnf9^GXip9?Oyh#v;l%h`U-ah`Vk%aQ_*q2zq>cP8I6oV=ki2Ol*0YcH#UO1N z^&F&qY!~|SD6yR={|zyPb@6?Ot5CK$p?@}T|HNR|aQv7M7WD%akjv5ivoZQW+WlBJ z+F405XoIv9eY;BT6a9mtFTLEE;!Y~Bnv*qsRejZ4^B^UCHdF0YtM2f?7L z;rW$tUA(Y-c0V}8&bqdu-+=7?*#ol&^;@`f;ez?|7xi1ba6vy()oX1~BpB^~yrXLC4N5cg66~1n=Pj z&%$9^Q<#}`Vmh1;ES{^=>I{KO@lkZ~qFJQgN(o!36fy99?Ms#&Zk4tw+#*sC4i~`9 z%C?;-@GJ_k>cC1pWX5?b1RyZNuGfia6U>>!$Bvd5v>hD0-uN`ho`4posJKb$i0yowvg{U(`5%T?!41I6sAHpo25D28|52EP!33BF@)P z6@=nVkv(J^cE{P#!x87tPzqx3F>FUW=Yi{B0Hof6vyM9(p$eFd;FmBDt*8lQB#q`L z!Ln9qE5oUKVYsjI>D}i*Ae{EpQz|&|h~~faP{+AX&zO6g;}>E2o3MmkpW?T7`kSr< z{)XZgB{0l9q4>o~{657mP2wvRACko9C_XHSPgHzF62C<8?5-)UNCGpWpKb>%hy)nh{TfoHSJBq6t%oBEWR9t-DMte^yd+>}Waj8{Y zd@V$~pI4mEFugKAQ(V4{Snpe-c+3-|)Dp$dPU6!PS7(k1`wA34CxKzcQSDMY6ZXXw z@0q|blcBget4rATxl*CN&Q0L&DBd@LVdmG0XD9K^io5q7xchHWJjcy*Vu9khoOQQX zD(-&s>hj@=^A(+ot-mWC^#G+VRP7y<#DA;g(~|fO#rX`}+kLm&$$N3j^`58d^~MWF{Mkwm=e%oD_^~DE_u`o)ZdLkYWCdNfLGGtY zzc)^~=ejF-Z`>WEl2cW^-Zd-EH&JVnWSaR_2+ zi7Wqmam5?Py9c7O<53@a!lsxwyeNF;pmMZ-! z*p-H@qz5++Ugr2Lj^(vi?shCsPa^l~P2^sC6S>#kMDF=Bk$drz$UXlga?k&X+>7%> z?v1ZR&fb+2{pO7exyR9WSxKbQj^&MOxzn*?GV7)tF@9YL2}gh0B9TfvVqTIv9Wl=& zavlwmqW5}%Ns|D+#A1%oJWJCsNWmEa*yNP0VFZVd-I0e;aJ{yPvrSB z>!uxRn46Xf2fn}ZTO9Y(%EY~nRgefM=UB<-QKw=2`bG1XFy#DrGZ=Dy{A7T9T>$?I zZ1U5S0rs>~zlYUEmy+$j3y{AtKz~^Pp9@n=E6Y2tX8pSr_s*-CR0cd0`zO97>q{dckjJVc4QQxR~;r6@}YkLH})(#tn}+Q+|n%zoilK>xKNSLY|XY z?<&r~mS=vfcd_7oDUE!!;N0iPZxTF4Y1DtM;GAp&9DhKFcc0+`-J%xe-6+pTy0(Tq z+sT~e`G|8q$S)!txZ(3Se1d`Gagss%ucI_>Mhnh9M>I$9Wt7GZ`w;bfUvT!7Y0p}c zG40t)9Q7;|dSa9|_4FWa>M15}wyRWd*{<6K=NLw`L2%iwjl@lRwh%Y%d0Xg_?INt= ze+6e?%l(V?%Q)orBEM0{%Q&nSJVxn;;;Hp!vemRfrByQ??lDMg-Hb75H@Cz>JAC4u=_Z3|ByKJxQUv3xb zsX+y_aKD>=;QqodXK+5@h4mvJ%MiBgALR1vB1SUE3x#}^;P5L-cgYdF$fe%Ajd~^s z9vAY(f{zq@qTp-;>X{_?6d^xZaMKSdv`_kh%i=ES2lsAh;4$0@3)cHxom6Y-hbsk- zQyS%`3NG7qmEf{n-xHi|Lp|`VyStd}QXhlB-o~`6)YW2HaZ3MxWhei-wJ~;16L!Xg zozn%E{x1_eF64v!UoPaO|0@Jm zXA3Ud#m8ve9ToC&9^kQz^-8`<$jkZR_kwd>i12&`7t|y96#;xx0RLM6?*pGp`02kU zfb)0urak`%kdMLnHtT1fV18);|6>5}LlX|xEA^}j;C~6=gW!4r7gNug0FKvde)2=$ zx{tY>pY`_+TEFDS0_64Q_Q~=;rHKgblzP4n;FBp3P5GSxJT=wd{&9lK5iQw`$m`4*Y`kCi6tZ}*E@_6?f z!R7I;Yje*|$twf+vjMzg3x7Qe1NbWeJgcR@o@)e`$K{s;c=uMG9w~o)0Dm)pXSep( zb8`T%4d55h0R{U@+H<$y^88`H;PU*T2c0;go>Fa^TF(`Hn&6KME|0Tk0{Fy5Ok5x1r6<;9aDQsQ&pU}RZw8eU>gnS>t zvEF}B{(RbEJlsra++0p+)PwT;47$Pq&c{TS|C;1@Zeb1&@ly-i#(XdF>ka+2#8(^q z2=Vm>e>SASW`qBZ_zr`=P5eoN|Bd(y20uakfWcGf{Pm#0@%vO<*x%gV&1C;qdbit; z{CNk;;llDU%0~^}kMhk89;bYU!TDZh{JcZzub@2F!}Ts9-qVo(A?43AxI=mTURdgX zg7SR*!utPAyws3?iSo-0{vqW#j#$rw)GyB(@}EqhIOY&bCypVX5wyeL1@@E$eQf z*E1g&diZ+mgpkMU9rjnNs8)*g%Fpe)5@$d3Pt|h01xI`MdL~F zw}PYm5z_xQaqizr*oVs}2H&Ew)swzo;C}Bw?YdHY?@&atxS3_hk0QN`1V=kBp!sKs z;Akhu$x6Xd{!Ws=S#XqphVpj`j`I3~=lz)x#Y!~_sm1V{O;B!5V7l;=44L~xY1 zsb7u?j`AEQXNY5*VE+z=e_S%e_e98f9v(}a<0OaLyIRQ0@3ZbPfG=LJW3j+0jfNBJW1%O3?td5)962#)fE@EuDReS&vDX0aMa&|@?8W+ zd5)95#4%2=e>qNu7<>cl!==j5Q$TUDS;!Y_QMLZ1AwQS;>nVdDBtP#rcrEci8Tx73 zwvHO|X+X;r#Hu1yz})=XP&{?KXHTedC_Qt^ZCydgY$V#xxx8-rpn-a-g3Rc z-zGb6A&&l$-?QIq$p41?^Ao}6fgheG|NKmF>Hl8|j`Hl^#{@@t_QO8GQNEP&F9?qE z?4Lgfj`F)H|GMBP&wl%>;3(gkzVCluaFl0%{zGt-pH1?g3XbyZ=Q9TXnBp8>?Wh)> zw_l*VdaWbu;rWOAr3>xne&Mk(!O#1-e0lPkmvLGy@F%B&7%B1!7<+053dN0^3PHJfZ!<4 z{y8W(%6Do7D_Cj;M|t+!CxWB=B9cEUILfm>zY-kfe^2u8qY|~4eohx0<$Jc)axDeF z1`zwdv*0Mdg5+a@qdfOZU%^rSZIaIs9Ob#cE;Trh-%*029(?5`F5?78Jv@F(h;zTs zQPOb!XmB3a<R%L_VAzw%H{8EGS`550{ z#QOPs>|R4ZpO5V{^em$B{*sWtO4#$JA~=W%hu(4R$hM5r9w zzlQ9|Adde0p0MX^Lq3h>^WK7^J^Lu1Ex5Gj65_0%&&LW4dA{!Zo{*RKW6v?`MhYa&_7M+f7y^9NcO)aIO?w; z{qG1a^?xYzPZ#>X5b~(!m!!v`E%rO|&ncg7@HpK!*4E%ZAbys?Um@Ph;H~L~lpKRk zA$~D&j0d#8Gqqv1;AO;cv&Y~(zD^6ya|X&cCA&DzhmxP$3yywxknHIsxQyFA#L-UF z&*NyY;1yUQEd_?22~=;9;8^b)RPQ9gWxX>D{nSiriQqH1QrO-m^q~G6x_@rH!Iu)> zWawf2+XSB}^gki=pq*vZuIB~EdUufimjst_EALCJ6#73D@~8(N$&brXgO_J&UT^T% ziHFFq9OpynKEI|0{}pj~DY#l#K1Mf8busuF;yn%iHSvB1pG)`oT}T|`2irSZS7(hd z_)g+W1)oI>H#ZCY=+6b@|GNZ7zx{^ly;pDx%0{#ug%P;ivz&zFt~j`Dj+ z{&T@mp3j#YiaU;n@L8}EmL`IuJfAPM5ghf8CHeM(qx>6moIQs)#sl_mKK$dt^9YYfiy-eB;9q~}(Hv!1&R&YzDxXz+iLo?jZA_3SY?pNId(;C#OQ zM}zZu^9L6;ZFuaQXF9}158*+0hwNBQF<|GD5O z&wg$~#|`#RU)YCBAA`pgh3g}O^Et{~;yll+is=H^8+;t`pBQ=$lKy>${4cxd9e*(R zQsVC!{0Y)uXK;(;KQ;Jwh@U3Tei%&lq|xz^`AFiO4PHgOm%(=sA8qi%#7hm%_pPoJ zd^XAAW*u=J@AuJh^M1jx-w#o{9uyq=oyYYrg?^r!QU6{;{$bMpg5an><7||M=N$4;W;NyjSzQMOpJ}!6>rE$Y?g!LldK>OGRKqvWrkG;W?WIGv_h`vm_krE#<0;QJ_lKydl_-rEM}`Kng%sg%Y|ox$1vM+KLk zlbkYmKIJX&3oht~@9Csk^ZoG5+5dbWJ#zUuL#EJ!oc+W1y`y}o(4Qsbk+-CM{G2nC zpC;t-xdyl}PuE%Zx#Gy>b^S;ok35g$3k8?g%To-_{^a}TQGYq5#_-xtu4n1ef#SaKYugH%0I%TBTag5nRq=9B){!oUb?@kjr`L z4WTDt{t;ZxGx(f9Tu_gkPhx`0d4qrFf%2uQq+X2_^3w#LD)@B4mk2J$HUFLi^~>?Q zRmjV6`hwtcJk|;>$K7$k<@ky@+BmFNjwAlP1#&rF<_LK?E>;UJ<9`*D#|7sl8RtJ0 zT*mot1ebB%oa{$EGS2b&kgQ+E`E+oB zJn|268RruOmvO#Ba2e{wu+! z3y#mj#0Bjv(@C{HE_k`%ZNoZ)@-ohI1eb9>S#TNWiv^c){=DEa&QA+2$SC$r`@Ht)H<D zx*6WE^w#s4qaEkE_?}^cw3TBW#6XJ&~tKm>8d%^r{9thf_>aChufu9gJx&bkz3tl%R#VV#Ro|yoAY(Vw0jE{(J zkrt9eLBGo?F$~HiWSbHoR+s>^dP3|Pl+rT+#*dyrXb6fIdL`B^cO=H3*dr@IjIX{b zDOtE^8ocDIta5hAjA^sxSlRRDFRIACZ0yAI)DAh+b)V^1e2HF1do|<=l3s$wJ9K-4 zU+{*rmhmb%iVoGE@IIRgGN_^wUKxh3HuY2+Z+hb$XdaFLA;~WsOKAPf#nTp)!wXRH zMW0lOp2#r|Z@Zz_*kr@BxoFySD|_M6xw!37o;~0KtH+Y;{%Q@ckc2d>0Ou>L*12j8 zE5PR~tk$_|4J*Kd6jtk8wT2bofeNd2u3E#YJUcH>?SwT{tk$_|t#IA|wG-B`Q>}B= zTH(C@YA38=r&`0SR57j8=Bk~r2B6ltdJPVluSO`eJ~vxQ<>jE%0JZL~*12k(BTfze ztzatjSAQl#ShnbmyEf|@1?5eK!kc~S$GXk>--mkq>gVTGY;bGV39~Nz zU6sjD@_gMNZLjoyx=;OI2h{%w)o-@V%-09hpF{O? z{9*q$_o=@(1U0Bg8h`xWw>a#Ri&;NDcfe#QKhmfDErFZ<-y0Br`2GZ3dgzV2HtTvK zApVy4)ZZGknDt)>*C&4MFQ)pr|JVSt{((^5WGK6p>Mx~&=>H7(H|yU7h5hR1cigc& zsY$AsNApqtyF#=7o@G(R{R~L$xt-9P#1Wc%3=F47P&nfmt6w- zzmk+5r1HEm>&gu1|5~5=@hc&-{>}mI=jRrf^_lth0quX1J~-rdV*9Z#%=&Sh`T3up zkC4v|r>$B4k%0Cep!zv}vHr7s>R%O5e>GjV_h_L06#@10!=GjSF`xRo2aLZhRDVP9 zdse{s%UP@qm-V0RQ~x+{sGtA$QT;8o8h35_A3x9WD}R8>&ZZlsV(Em$(>d*42e>luDe)VV231LI= ze<_qVZNm1i_38iKKJ~vD(Eia>e-Bh97PGDc0qx)CQ-5F3WBUJbQ0UiweqKRL)Qw5A z{tE-juO<5%ioXE??cYe{cQ#P}b6~um{iEr;e^mqJ^8?EBeIxvR5vwuVKLE;`3}ug! z|MyWrod5d6zv=()#aM|ExyVe_ufS?Wg+X z{5Qy_{&S$8u>a6Eaw(+x`$-6Cl*NU&hsl4iNm#0>d}#vp+RymC0RNpL`=eA5_TL5Y zZ~Ct^p#IuM){oDrGW%57wnSU_w%(}kL@x5Fe@8(5alF`orBtoG72D6`=K=M(-Qkg5ZgZl{<%E2zXQxu9E&8XHlIC0^s9gMqq-EI2Vwmq;oq$PQ(&l*=P5|4rI^0V(PU3>J<#N1j4(Dl{mZHCuUm}VfrtB^%Z@9_YN#!>i{m<=ZmHz|f{rop& zx0a|Q#pu5=@XzHr{vQgkzmUG9)bBgx+LGJ)KtTQRy~*|C_sC}bgJAraZO4+aa$P>3 ze&>sR!%H%=y!s5ie|A~+{C+W9a@1O{bXue_jU{L<~{Z*@+gCrf>Q9wqY&$u*?Y86N+HE_%GG!guxi)IY z>rXk>_FBhUcg%@w$NUK=y#2V7vi+pvZ2#N|ZQr`G>nTvVeoLA4+KpCqQ8-jxRO@7J zf8S}p{R5}n_P;w_w|@x#D032DG#9c4qP_<~J_NGJF@MNu3uQ8(OdD5rGsxIN24&%} zwsz~vl2hk`E%<+_9X-;`wu)<=cD;{}n*?o`xb0L)F|;XOe|lNbHfZCzeNM?+SoX}y z2(&k2+gJ13Zu??pJCJJ+@|n=)4%<#UVYkgItk9>}R&3jue%9_;FdfwXYh~+!_z}io zYyO!P_O>%^tok!$p`~A-e^%NL*RBk~zXSg%@E?Z%2>dsJ|LDUbTMRjsYQ=Y7`mA-$ zv=pm2H6>pE@i1%MDez%E_^^|mdfN%d?me`dwQeQ&u-56g{gBgX`!S~p_&Nf<4uh{# zlwV41Yv4#HUjI>xc>Vj2TI*1@4s3~n4lFa$vFfp{7Q8I4?hh+lL&Wtt1op%8&~|lg zVtsljWEIyzf1C|%i5*1D;+z=z78XhT=K z(~>AGiM6gE9Dn496W!kT(~|u2&WY#4^NT(meW+{x zm=RX~v@>UlyV{vY;?QqLKt9!p{;szZy{$4Fy$$^S$f&mQe0VdaM44TDv+$@X@>?FVUaL4W z?De00V7;dMzeDf$poAYoLomj8UulXpaQeb7t&u+nx?t?7 zdQ>^b8u)(4_-?fi^mCbgI2K7C%Ecl7_<(plvcug`e+G<6^i?~zo*2YmT@x+yKFB;9 zir$9$y22x@>YiEI`h>H(<7TMePSIm~Gt}pfVX6z}%ZwB6`N!T6HJ01LSRMy{9}E5; z1MxQ+`UA&v!L~C_iaVZ9FWUogX~X^y$T=XN0{s+*v23k7voh^9p2IGM@mvr7$9~%C zbUhV?G4MHzy%m=IDctW>`~~#kGmst$>93q7y}yLMJO$(Om}74r3jOze_`fn_J$7Np z+J$=5m~j&4phF#S4(iYw>Roqy+z7B`IM_4{Y#RzT4uP@ro2@txl{nU?^-VT)JQK1$ zt%Ge>$k%qV>Q6#?1*V-y@47zL?h}wlzruCcuH!hzd|<7s@1^4#)4FfEsy?oVzAOFm z%)q)n(8thc$6HwS`$N&Ry6)EQx?b_!k3kxBMLS!qQ(IOSb-l^DCK|0S!udFqd&_;B zhlO4{-dnLHpFa^uE(s#lvHv&POhA zI^Sl)7(L!SzI(k}CI!m0Kk`Klm%-yfM=H}1%5+p^+BCOzVO!8PY(s4`Yv3=+;=AjH zh1Pup^?p1oWnHJR^;+ff_+5WGD}Lu-NW*hBU;8fn*Zq&R4KCd>>LHFc!q}C1HaCTM z2iuW72yH|CwP_Hy;EVlm3oP$D1a&AM!@f5Xc#7ijR2Uzi z3B=&>6K7oc0z>|CLw*bRydL!8SXO-pzO*5>l&_)RymUyU?R7T9osyw`Kac0#GkSr2 z2}>5`Y^#uyQ(aWa$toA&^+>`(de0<4$ng2SZH?#TQIbiqj@jcknFWFr!K|(p+bZH@ zsf%WE(z6hopRfcej+2yaP2gm?i)L`rQ#^rox|<-ygIz7foP_XKi*1#ELP_=pAR_K2 zNO3+%*w#c&zU`ulWW^P(MoI)J&T+L&;-qJBS+e4?h7^w^fkm`Uv0B}^ViV^)qh}=R zp3#tQ-XEs~gf1tC6T%29+{C#Zo**Y%(pkM0g9bR2U$#uaAc;XUN*Lt_E37q5# zY^#!!UR@KouKi>NNO4knc0!|PgMF?A#hm17ZEGecJqwE20D4tUxvoY}BfH$XCUcT2u&pvqdUZ`suB*Wb zAdl*}p0*A=XlD~=Sarx+)0cJcqXTb z%J|m|fM}z!T*J(mVTOA zHaPa!1w47e^!RNnx2>zqMgVF^3%in?0Tpvdz%_khejKD@g#( zsyNA7@K9IO=%&YAMebRY*YsJ*O>gwEX0)r={j7Ms+s?{l#oP=kW?4Z^=cx(KqBuF# zt*fGxk{dmg?B+%vocV0Zw%ik|+ucT#CpV&;YIQe3jp*x|H<^>3;<9AL4NlnXZVoRT z5}eK=lVNU-ayrj##uQEt7h;u^=Ac4#Zlfq+wvA1wrv2)e!I=#Nq1Q~^N{)8B8&f%l z#}ZdhAtzZMoEmVF&2Ge0$AN<1G~)uNZk%L?fEG@21>fQXkIe)ve7Jr^R|Rzyax$GJ zMCc<9IuZ&V2^?)OyKvI0tc)u=;5Mu*g(~5@zu6X!e&W^%IH(N$={)s$l&Xv$XdHpp6U zrYYv6XYFjZw$8P7HYeFWtghI{+Sz{A7H{&iwz$EO$gSWJ34@N4p0!uAwHsY)uiipQ zK7&JRC;C|1;Gv%_@T!}{)g7jNFsE{Izv!V!jc(l(SJ7lndezP0>bwyu$|L`Lu^^RMQ??$;B1yOLk7BZN$3CYH4@e#CeXT zsI{iY`V`#5!NZR9_PFLy;#*mDfC?$AVq{GZ*QzDTD$Wb5Vu4oCo^NZFK5J)ZrIQ7k za?b1MSv=*jNpK;}N%oX3i?@g3($_s5oyEzxiwZ|la*BsaDOu^EDoU>P&<09w^^iHB z;Sj(x5qBO~`+t~w7x*fQv+;lS?AenOLLdp@4(4!C0%{K#S3>-6kCW|wO$HpTM5-y+oBb03s$Yx+P7F+FRj&ZQG?iuhzN?!?|EjPXLruz zEVOUm_y76tCz+l3&NI*4FS}=VR;9`_&06D*^D&8l7Pbzc!hy?9wsPKKZt25zE(Zw7 zR*oOVyr`AUOn^BE!`#bic(?`BIkRWHcrT#jm$}&}Wh*Bg(wE7RX=%Tr7KCe=2t!TxEQ@29&=+G!aUdZ=q;{95v>xD{(oB$MSel9I0jh+c(iK=L zsT#@tZCx^K7ilI*v#T_drP)oI-KCi#%~WZsj}Z5e_H=3Xl&0FOqPMiG5w)+h_mgIS zX%3L4`dsT-(hfg~!x53@AZZSk<`8KPmFC&fJV%<7B%&3M;A;Hx zjpmH?UGsQI_g#ap`*^}@V|~}g`mV!o6?O@<$hk1M8MoHz64<0-ZHYh+#h$91n=n?{ zNrMkDOuj+pM>)G$B^WfBKQD^3n>8zNGnl1;Tfi&{Yyfk%742rtv~s#xWf*bt-H-%6 zKvMdG2dn#ejQ6a-I;n0wm@@-6fvF;WCq`-}Dk+iL{}JOMg$2%Y!kM130aKs)Z7?CH zSW(V+7#?9mT*#?&q44Y%1*QF2kaQ-5MLO1A&zCW@C3<0qFz;atV>S3uHI~IzR9S2_ zmW_v4y^5M0TT!!PE9!ErC{OtESl>CZzH`tQ>Je%aTF;d;p!I-DE*XRK&W)+nD=>*( zB^%CfprSrsQ4t2KQ(-`d<_r3yC5rR(t#DXQC8e-V9vsZ zP#WBnG9)aLpY|0i4Qx73B>yqS|8iOXvt*;1DVte|Y-V$;Y;19m;nN1dhEx*3hBU_- zO#!HB)XJujf;EzYlaEOKDOmeswGTk2b3GQD62iW%B(V}iDhkO47CN4SE65bt`Bjs< zQZ>1Os3SNEby)bq9oVsHC~LN6y#;876v)N2DC-yur>r@*V}Yb%1t(mIRyYzKir}eF z!u@XhO?XhXWvtDF?}sJF#3pP>5viyx6a`cqBnek&02`z1DoWXonX4v1kSUiA9{C} z(R=Q0hC5`qdsvH8_3)`OdtP|c-BlK+zrQJ;U}1CiI#n>o5a=&jT?&I0}g5#|?&Z@fd$j1!IP> z44aaQP>y4ncfmMjifr0!pIIbeiu^SuK{IVA63*Gt7%!e(aV(pq#H6%HHl{^8Wwiw= zY)H>(`~s)(vpV?&Qle7jUMRvI(D?bFq`FV@i^rgS(Wuah!-qGUwZ=}2hVS-2!KMVB z@b=hg^T)B%=8thW@Pr?W^?eL|&$V0HWFmu)<5&c%pSkD^KA8`x2Ume~{e;#+(DuOZ zXEVUhn^eGtaJ*V_l3#Y%KGCW31!HpK^=(J+OWlbqfYq!ce$C>hS zNSa(T%@xVLP4Hiw)P;}1R%5A+iVSrOx- zSYr(1^&QTps)v;YHibF-y)m*dC%ZmI%M7GMFbq_M*=A`eS0Ivi#3+-AQS(vYeha^4 zmvRkeKJ}Ym?LQxk^UygekZzri7Hmah@V27156g^UhgDJByH*kr{2DYsLJOS<{X%eOUZA@RG)m8fZ4#j3r zHuj;TgtCF{I#5O_$95c;V~vtwq|Z03@zNoEzGW3i2d-lRl~##J-36-p?*=0aOBj#9 z1y<@_0NE+nn^G{GG(_qLKu61kg6H!UFp-KvauGcS7ttwHi?7ScQ06>Eew$D(HUhWF zYc7ScJImEb%G02N!aZ#Y$Q73g{JiH!(qDQ+t#D9Ur5)EgB-PWF3CCK{{8a7irrOB? zX%YO8mT(_pCe;$|L(HGDwquIPid3!JK0;Y#J&aVXy{y~Mf?+*n1gcFP0@nVSV2ng3 zmYT5cPPq`r{nSgrj3DV_mCMB(E*h-)YLSO^W!0!fp0wA(BJXMt=zk3u38)ee>q@!a zv)+{XM7=38c63s5PU6}?QdKBchN>W$2wA+=XpeY>Nz#{Tewbgv^Awhm$?9~=pK|#_ zmCFRYF2lpQ#Jk=KSRz4|4{)o{YeEr`gF$;lo)zG}g^QKM=` zj~h2?d{uV#*ac%3RDorFPE}=PZspifl{KTQhKtD;j=Z+ManZ=y%El%2ORuYMD#yLQ zMt=C%V+WtP^@F>2zQ60v_kVfE2M;|ma`dRt@RvPmB<;2~a&g`K#>&R)=JCsSplcrL znis2UUT0nNSl7Jy%jy4F8{*YeN9tfx%xM!RPbw>(RX%M} z`ScmnC+qHMlSaonb7Gyjx^q@RUbf*L4Lho7>Oo?3?pTA28E?wu!aizRsM5lc$8uR=?f1J8;{bhliEUdQ=3IXn z#cBL~s@DyVxj0=#qW(Dklb{>MsUO5~id{-in(P;1GI;ri8grUpW8#IISUh9Sl)_mB z@xr-&apLp*rc4~`jbk(zdA^-XJFhf92b+A{PJ}JVzkm67$!hH!%B!~cT0MVkoTmxz zqd%|IzwatP&>N@Tr620_^YiJiuFg2s;p+7BlRD$}E>Eq$w=4mFZ>c<9O=AIJ;rjSV zwLX5RGfrP}Q|sr4I{o})Iy+ait20g`@Cr6gIGSE(O!1vweY`M{K3@lOfH46#w@?h#5GpO`|ii_`q>4@)xiJv;B#9v)p zFQw1(nl=N*xY!jL61}@f5xuP|pjCtfdKoJTt+h#@Hx&tHm6cA;^JaJzN~?Pb^jc67 zvJSAI-MmY#6%)Bjgue8gQ8KwSudHy!^w|7Pnw(#HMM;^fYw~pE<^^qiLrr64Gc41~ zo4qA%6|9fN;(A!a$EaMRrF^G0NoLNO>V^xmY-hDYde&N8^%R9UU_%Nr^in`+7%=EHv_ zY|Gpv=+s=fP~bMxS~N{dv&-i%TOgWX*LYFaOl8p|YL-@u#u_j3N)*Ixs!@lVafVnA z46EuIYHJ$hR^G7FbN!O?=Ia`2gft8hWLS*#)!uf{6dDzXmmOL2Q?Sub_h zz*g?p*N6p+D;GA2`LH4MA_eAGHg!^jOsgtAadDDd*DN#%;kFG?SzQffSzTSXbfLgf zVEeMAa6MO5)6`T`Ew9R;33&jMU3U#@tZH6vmJzjs&gqM73zQ^)P#&fZpyd#WQM8RU zz)iTU0WKUnmCyqCFhNtTDXTZ91$B!TV{16v&cl zT|8#*a_(->(VA*2v&(TDfN>l4C$DPC9xXdybxmX4H8thfkhNO!1YF&Oq`VxDu<;8l z0lgnzTP+%{t;Qm*U)J2PtXb47hay|Hv<@hiSWGt~x9Uf#F-ntLq!g}4R1Il_dld`n zpfYhJD3`qoqas^vWmBzgrP#4GV0a88RaeUn=VTGXQNHSnTY6?~29 z|KcWzya~j&maXecg>~auR{yRU@|Q1u2=)j{&Fea_EG}5AnMD6{|1uBA4THJD`~v>`vA$}&#Lid zJ>6Rzyvtk)S}n`^s#`LiFbV|!!QG&`rB#cURoBd;{@{0GslFC&F*Q{$8o3nO;WafQ z$7GGp%FP-(vgx{}#`^l^k;|GIN0O?Ml`!|z!VMw#7QnLQ=VQouFkUzLsqTEA$@iX> zfaaW4i&<8~pR&XE0I=0IfeUVHsy>rdC7?`k5>ztoJh`m7ZZQReiAvc-Feno7?x;NM zb(ZBgUF?)VrWLY3Ub)u3%L+F;si9&gF%-y5bDYpjC-pPO2`_&(WdCjDS_i})1(A^b z_R8=<*i+B4VimqAEGMx`AhVCt?I|a5M#z46RS{^h_lvcK>zqt`7P##5i_jK6=%m_- zMG#YwJ#nowHe~-=$jFQAU#&U{j$ID;b`MQ+Ql}O>$*Y|3R429A2^XM=fu31a6tWMB zwT?4AWZ%1L7bfnM2n>Z3*fYWhL-td^AntY$IV*J385o-CoVCX3FHHv&+`DQmcou=j zXHJho^l%ED;nSTo(R;Crp`d80FU2Ro$b-==McyJ{YN}S4C zAF!O>UFwHr#Z<`e7{-&f-eS+hU{k{n=b~|!Wjx0^7rciC{_~ad=V0YP7n*(FQfWrKz(1R zSIkUk7kEOW`>A4kiS-Okmw_Gw4C#IgRQ6pD(hx)MPywJKdmDH`vv?OmK(k1F)=8e` z^s#TlmV75vt#1xL3haVz;6zlL6!v$aQIV%R=^dFhgIW@XbniwY}EK1mSavoC}Mb!5}<{gt3O!LOjrgZnJki z`|Pv7fbzd_t!(-{g2X-JW1m6sX@}|Af@8nvX<~7+~XE+?vK!}XQSlFuA41O zB&VPB7{a+$a-JPMk1ENvpZm#6Js>K7l=6hZc8`>oMhw4QBAB#{V~ynadtB^sqvY-n z{I2J4um#kUn34^32Ws5+v~#>DWNY#=5E-`U9Iuk^9IxV?%USWx<*az;@>INYc`Dwy zesNFmcv}9BKiOd*<5&#tc>I?>^3VCmPxgs-m5=eE38k zj!)snE1wLXboTX05A0bMSI>(+dLH+Y|JX+!pDKu#&Y$?CAK&YaC;y3${74`D&7ddE zd$2}6;s+|kUqC)h>o0OW3mhNhPSg6`5fsM5M?a{Ko6gsLxcu=N{Ki2*`P3NL@rXzh zzOid?`A`q|^#{&jQ55?H9?11_f(OFnfm}YWN$z_!E}uyw_co2g9+>X&q{j7adiga* zGyT6Hc{BYVYkK&a1W|;zsb?s0Q_mjam@oMN0=e5YE+1DQcRI-7Ve04C3Qhe7Ngnl& zRzaoN2kIRUlSefEpX94rsh9c(lO0cYX;*D#I0N_I^DIT}Bxard!G zV8=Ahb%CglRz8^|gD32#c%c4>v?-%l<9fTA>%%KFK1kEEn7CPw*st+0>v5Z==Rc{J z1M5xMp9%p!)Tpq5Vgqzw6;r}6VN`7(`<)A)@VAFJ^vefY~7 zAEn8sXzf|&nHta5-Nu>|p?!#@WFH_GvAO4gN*S~?Rr)MFRr>XyW zjqBsjwD@DMH8O+C{!P7j62d_L;KMHlHU%R!ef^x+Tt@UMLMLb`;&bn5!| z`0&16%(VKW=uUF`tXEwul)6L*xwTL7m+6e@t$?e#e8$;SrL*Nnw}&ocKnA|BiTz!9O5=kHIaP7xDTX5000& zt9V3VmyaX)R)d!kf5PBPh(BfUjl`cdcq{Se4E_@Fmkhq2`0ow=HF3Od#e?&uUhNj* zZG~N~?w1Mip25{?%tE|x@H$!_95(o^#6LB7EAcN3{#)W-8~hM)UN3R_6KS2n{eby! z;@zp9nHLl9Y4CdDxW2@L3ZsjPc`^z;xi3?Kk+#Rf13C=4gN>sRR;eD@j8Qdp#int;O7uuX7EYGZ!mZT z@ihitPW%>w-%0%22LCVOcN+Y+#J^|oL&UcjJdxIgKQuUeH$xuyOJxnJ46N6V0 z=W&bWR}lZDA^$z%&l~(H;=eWcYsCLx@FT?kZ1C>1PW`LFvxx6AcoFdr4ZeW*-wnQ& z_-6+HKJk+V-$lH`;BOFjXguR`J4!ss;N585oNDk9#CscjGI9L2t6q;4#D^IC2I9jF zem8NvZ>j6~3GrNm|Cabg2LFgS-e=bJ1Zll~nZeH@KF#3ciO(|lEaF!fd?|6>LyXJ$ zR^m$y`TL3U#!M{#81d^3`Ck%WZSemlezU>fBYwNVj}X7Z;1*q<+-vZj#J_LwbBO=I z;NysIH~0+VPa3?O_-=zY6Mxa*8;SqU;P(^%qrn@9ziaRx6Mx^}yNMq$_axal2==`c=8pbe}*Cd70J)iIIf?oNuKYAuztQzH{X!oPuG*`_ewAQ zkJI>dwITlqUH7Wr4L$h~)yHZ>ei5bTI|iRd`~ic{B>t$zv3&UL&mU_X^ZVbFo~I4Y zFV+5nIM@4D2!jW&*O(V8EdFN5HxN&zbr8#MAby^~`PrgUgFi;{iwwSl_>IJQ{P_p9 z+wT~>ALaKRgY$Mzj~F~a@=q8%Nc^`34-wx>9P>+6B2)UVA)i2=hcu4$^(?iAziS-p zi~Gw7jidbKRPLuVj`Ax>e*&%7xINQ8L?TJ!D9`<+m&Q?l7U}J$ag^u&a<;}%{z;OD zZ`{a(>xJ8Gj>b`b0J+C&9QE@H+xZ$t`3>a0Oyek@M*Wf3%bee1BzL(X4?B*?quSuR zs2&>)el5wb&^V^YU9V~!)3clO+^%ty{~@hg`2HuC5BEo2r*r!MN%HtS9Ud(ILrTwo zX`F7!NI72Dv!3%v&u&c~)3cw}hc6raUgEDA`~az(N@t$NQT_z+ zX&OiQt;A<)9OZdl_@>5D{uIeqY8>VHM}Q?7NBNa>|N3f;qdd3gH3ol%^tTxN1>z4G z{13!`V(_<#KWFfR#P=G!n9BJbjbr+MM(Jq4ZA^!l$e{9Gv zB>685`4?y%*psezv3yYfUMjbd2JcPz@v0r^d1A@O5-V-DT9$2Jtlz)cGyrT>t@@p&;kY^qPrZwc{%2IuE{#u~hu@P5RvGdTD6n+;w<@^>2i8^pI7yoUJW246yam%*Eezhv;0#NRe}2JwRizmWLn z2CpFAh1N%0ZtIAr`S9Kbe}d#k7(7DpjWIa)m#D$HJf|7_52XJ}gTGCDp~2rL-fZws ziLWtufYSLLgY)=vzrnd4w;7zrr56m&?Jb$-C1|fW4qQO-4mJ36;*$+tO}x_J*As6t z_$K1tGx!gQKV|S|i9c`fKM?<&!FgVI!{8s1{62#pA^x$!zaajF!Fin=pvj)wC$ERQ z89YqoKHT7giDwx+hj`TB^N1H1oUbFw49?d_6$YP0dTuZ{r)RCfuO|5i4ZfE6e;NF4 z;(H9v?eZOi<9>g5d}i=hiKo-`7MJsz#LqT(KN?prHu%j{e`N;eabUT@xtvw1yyp_j z2+-xA`@G^@;uMX`mlN+pXPie+hUcS*!TCAtOoQ|DIZ=&M5lB*C@FV0d(Kx3K5vP~a zGnCfV6`DL%g(S5Ge~jj}28~k@O2YX@{mA7z#c<|#A{^j)`X`Yd$R-uv_A z@n5j_woJg+?z5_E<}X`VUO9h$V-2`E@4ZnKv(bjT*9C5CkyTZ{WJyiD{Vi~>g84Po z&5N7L;Z1wkMZt5+9XS-KSrTU_hS=>HAT;eupt7h^+X!0-)--Y2o0=Ql*u2bX8-}2g z&O3-Gq^qr4x}aV!O3p&({Rhf1Rj{{4Rqdkk1(kJ+Mb^^#=9;X_rq4cKdYI|yv~PmB zlY(2W`W_;X?oJyuxNmS@U(;BRTYYdMDd(N{Y%mDPVP3U8NLY)ktr#D@fZ$d38Y-Zg zS_qB%j&MlQ8?y-nXp3=syRm2umKAsn7j}v9ig)3%O4uZUgRZWX$;SgFci*6@biFNpJ{P6me4)KNl1){ykTy0DI|oI*cE0 zk(lw%1!n5Rke@`*6ynD;Un*B;S$xhgUika4VZpIVpRB=c%HldFUivqe%iyA5s5)c% zacOR*KjagC-?1v(W_5B+Gk%=!?fdYn;P#vtCK@lbCxtLh(OB?Uy~w^k3%_|Asj6TS))VD@TaVA_*LrM5|JJY9Ir!7u=CBn# zd8=4m`c+k+1?}6`Wt`Z(uIGtEP*!1m*|HKMPTxUuc|K+As6ao`cFWuM)5`)77&`!U_6I^62= zO4wQX$4o1{y;g`FZGX5aZ3%=wv?#i>{nF@3OjGSFadKZ*QFiE}=*f=`h?a?iM9bDk z#B2Q^UF#rk`|N%)4HcHit(_G;d1y%VB>F#mXW+H=VUS0VLmAYAX@z^roYr&UzIWMb z(1AR1s$<8Ow%9K7YC~T0RbHjv$&TDMVEe|17Ig3V65QRRJEguaJ9a=h?mRRry7MH2 z53jIi!H(cpZ(G;%nMz1^`^f0Y;r*jKGpxkJ`;tUiTfWkuY|UF1+>w*&{pTP zetpB`t=DcZ)hD#6j15-yLq|KxSZ*uWrJT&GlH2-e zhsyiws$ARt-XYro>fI_t*;Yv3TOA#}+n{~Ef#-3m-nJg;c&ZxQSRNg=1AVC*q^~=q zGX>I{3h7RRzSINylI`}T6HvdO*$L40LnE+1eQrA=jzb^7{<6)^H~~HMk+nLSqA z@e#DY;d!Fv!i?x0=OwJT;}G=ILU6Y~VYjy1;oqGaW3_zzsAxU@NT5~e?+yBU$#|pP zMD9NDUkhys{VKGF)YjO=^}EOVc00RS$A8a$h|Z}G>U(Alwm$I28pZZL%n=tXKX(Q^k%G4 z?!(}Q-zw7Eq5mE_H?K8%)2hb@e|y#AMQcP$c#ZfpIv}#Na=@Uak((}kd^j+xqoWLE zv7RGeb(DPs_I4O|4%=O}hXZ2ANBv>EgLEE(JcX^Kjl!)Q(Nlx0=+{Mq#7`mv zB3Y4}#HmWq^-)IjWI5>Ca{}~27_5)5)dj+J*;r(E`Q5oaqvN|;(F2TMF%XCbZ`gXxB5K-%W>p=g5AC>FTg;X!9ZPO8}WL$R z(fsilwo@DG0NOjw9~jmhGs9xXJ{&W_AIGg6_?P|(A{XZT&9FDcX1E8m8Rq`Yz2G0_ z(9Or7p5bGTE&ZI;r8mGCuCZF43W%0B;2+*+YQeU4S4gyM=_fv|2#T_w!8iaqH^YC+ zK0AE`>c92)%GWm>UGe&xSJgc;cv0<%_3-~gu&Xpf+vu6Taoy5>_hY&~tP(9B*u7=A z2#krMclySCz-A-8A8k=kh>|yi~V0^P-pTm&$!;g z1FxI(L+<6M10VbUh1{&X;xg3hcgCbNRSMX-_J8l->l5=ll%g<}$Z`!S*R&}h!2e)P z*Z!ezy7yhXR=nK(?u>3%f7bfc&?hR=LL=M8{Rq6>)l)F>Q;$N71vomuPM0iSC1FIea;ty_SXDh_;YSxuw0z=@r;85*5AMS<+sMp-*d2N zFTn{x1$BOVjzjEwD3w=fEcxf?R?)43MX>|`MdAFfgGoTBgC+0im!kK7SkEB%vO%V7Mq^5Ox+TmNjYoc z8>W`1V?A8?fXs3NbSA~Olfb=hs!Pmn0S%4Yqnx}z5)eOXRN&Td$zrlLd*~op+dahA zuv_U@v9+skp); znB0@u>bRu1Sb}0xyKvi6CUrnXT_t2WlP+i}<2$L6@ZZ%G#6hi-Dn%1}BTDh3B-nZV8mIm4^#Z%p)BSbAWh8EBMzd zrGesDPiL3|y0U$P7yp@(%%b;tLD=dI7j>PJe8v%(Bj))8S|eNEajUPEYxJ0hI3S05Al*D?DfNRvJR!QjDQ`Po*Y}Fx*R)rxeeVf&gjGs81vEsq}a;uKFCfcWizOhkw{WR&;^8v8nl#qZ8Lvm!ej_nkEVs@$ z0911|xPjoB%gqp3%zTxR@Mbz&;*3SXD$gSe)CF6c-O8@oOxC+R!~ywiriDk9Voxz! z=ecMmhvu`Xg+(jeASG;lfRJn|Tgky~Ttar7B2UO$gfcLm&QgwBtC!*G&KW-AKu|%k z#H5QI9Iqv+IqCwpEIX;TQmwPQ^>FNNDZTr5OSNXh&p3e`cz(aI$Aw83Ie|X#yo+TO z!tV*eL87n+?gQeS0~UBxXDCQrl9U7_0j)_%mw+|g3q0*^5EdMXK?s?Yq#Ru`L1+Lx zT$m&+@Zfe=e9|yE%TnUQ`WE(xK%j08$YBtSq&p^s9Vy*q#Hl?X1Zz!81_7DYr122A zM;7EKEfno@&&0l-+DqX!UAiLzy**t$b3~wz=j;Ve&9`?KiZ&GruFpU#yT|O_bCa$} zngdbvMMc?=wtlDrE&VYtS_a&@)&f}!H1M{y7I?QzgaSMZuuwRIa_eAjC-lXHMI4!{ zL3%kTpTRvK6%#;Yh?`@$M>*8Zv4c5=odv1D!S5VTiBd7li%)^fp4KqXIJ_s+3|dA| zP9042xn}9fWMU%Eb4$;`YB}F6J?Vsp%&7FFQ#_Z#PlKqzzAH7?&L=r|M1fluTZyzZ zgcgTOi{Q7w2uU*{9K2HsKN>&-v+(&N5l)anZvd-xp&s-WAS$SEZb!j;z`!GLp$wl8 zmH~GFu?qEoMx2?#i(rZ-C+SfPU8+(0pFlWT+?*}k4GcU28&$MHFW_t~prlcdv*v0v z5km*?_TF((EtI0n!{OO|^+rhO|edIY^p= zr8z{JL#27PG|!RdFllB=bGS62jl*%SG|!Xf`O?girg~*`l(c6{bF?(aNHa&8xzZdf z&2iFHFO*&&?H5Y(B56*L=Ec%f)px11!wib(wxB+{cGv`AGQ`5Hm0IQBK#l;A60q>1{rt&O`7uAH({xs=mfil ze?xsX*d|}Zv2rntg-@6XE4MnR9ySx!*dKdV+zLerjMJ=70hJG)TNf^Mtrws+MKAi1 zODDVtR*_N%rh~HK>(C8{15e$+(Z{(z4bK?Zc~EVmfFptP{jlVy$$^bdQgBR3K@BM= znz9RZZ zr@cvCu3F8QRB*1ANpzj`zy3aPx!_wW1QD- zg60S-6-e(NRmz~+k3rJ#u)doLGZq{WowOver59TUu?6>A>SwpKtsDmy_>mntCtIem zWiD96fPUJ~rvt5-fm_8uYnBc73ie5Dsn{ zKO`&$TxIA(u~NI`os~*Z47fQ)pv21YO~YQ5hSgpgeiRdSW?)lSnLKDYXT7R<4R}Be z8JJYiQG#t?0B^6+P4e*$CVM+GYkefH_BIT4^qj-JYdX z5tbyjQ1=fQ(D{vE-mj^awLY&yB-7rtagi&euWh_&% z`_#o-Ze9E?CKP2K!(stIuNuJb$6@9$>zlB?rSh}%dQ{)^a7F~M8$~XHs)*nS5Q(A< z4UvMKBn3ybL8#05#E`5(Nn|1g7d9DEsJCTE$?c}30{ixRFoYb|QXT-S^AH$=F_;V+ zYEo(WB}%;nhDiA}N?{68ZibOYN(Jw?-bDcfBIN)Iw1Y7O)r<%1*MN%%?!4}($RoEXIm+r&$(6~>A*|`v#kN1PmUFljx`u&oRulUG6fJ>aCf*K zO98EWQv=X|#cW^FA11EJ&&B%3*j4?yw^N1TIo=QwCWybAy+tqQT)R2zB6P za}t%tA+E(8rtl{<0e;7SH+D*qQJhjLh?W=d`|m!}jF~zl-Z{ z&58Md+3ra-+a18I8(Cu=qX>Tou|<6H=I7(lrN;pg0}O3~U6m1jbP@V3gsn21p!d&X8AF44y zb>`jFnWZY{;&=l#4WI?u0QygyCsJ^*9RwC(pTt%o`-Kv=Z&i7b-9;uEQ$l`QPviHr z=7;H~ATN7ZWg_8t1iO7isy!EVMB zJ+fTsr528lp1WRZGu^7C-w%F(=q$c_L9wJSbAI4E{eq{!c!h{2zQ%cyZnQ#>&R) z=FzJe@ZsNi@QC7~d9{^|OX`KF2hv3W0^GZwet|*^Xc;)2svMWj^mzRqM_|UW# zU~&D@g^^`TDHOiXi(dqXFJj|kg_>MbY_PiK@~Wk}e~gM{pl8fz^;vEF+_|O)UhG{4 zit%&bUaF@}oII(lcvkteN#)aLOrIvh3sKQBnF zpBF03pP28b(8miE`glo&QzqgE+PMZOPcr?G$b4U4sn*w5YA!4FRU6++>WuG&3NOo_ z=BLod3l+xk%FmlNxwyD6&##I+|M>Of`lJ3hRqXo9V(46Bo{xXWw`1@3^8$KHf>U0%}`s4Udf^Hb6eh|kgb}2n+vR{bF z;N>4`%xQv+i5G5S@r*fB3TG9>3+MX9iO=(!GI6Xoj#0<;d^?wRUTJ;~Hu<=n2*(!x z{^jE(tF?0|uiD~k_588@pC-JI{=8EEzN`G=_gm?QI^(nnS7)3ecXj&t$#iz^r=HHZ zy~|VU?=3a^d;9cDPjkFh0EH*j`uO?uMOSB>ekT1;r=OopXXlD`b;fA~uFiOVG`-H4 z;yb@lOfHH$vILUdE-#ET6F zyZAnsj`%*9_^ESB{ME(vQu;ivX)|Dqi(Qc+(YuQj(ffe{T17~pm$8!2TAKuVQ;}d+ zS?T0FZ-!T)v^FDwUJFV>)&Ul@n|H~zVj_2mz|}4uB8%Eb%I>+7mTV@R1t+TW?k}c~CkxTb-Dzmw7d^uGTg=2{heVJ;mX_34dpRX9 zWON-dzpfdJWGQYpBd>1it|`ZB6|rD(<-#U0e{nr*#UsJ|%BD_=kYOCOACaCokIJ0m zE=9Oo5$pm4=c?xAqIOATm9%hZE&m!x(EuzlIm zhQ|7;8hn+Gui`v_d4?UDNFyePQ^BZHN+5Z$I~|dvAH=<*Orp-TSyChWC3{i#*L;a!!Q%!*JWN~*?@(S_ zjWv$<1f+qE`en@x%bGX$)_Y!ui++!rJ9Vqf5;yEnE# z%LPFkVDQR(VRJ32FNYxs8V&ZQI&qa)27N_Fwz#HpDQux7H%LOo*VHu5uZPYh_l-g- z#Q(|t7QAc3H;=6AONDjgSyun983J#($y;i0#-EZ!Mc089cLweXem8V?_?|BJcKu$r z`%>;tdm#P$y&gn4l;`I(@gDk_MlOZv=bD<4W3onPqh~V|{(|$Yo89 zBkPt{EnZe#GqMtP+^U6pMzC?$vgPMv$ayfBHu~39~HZt-qW3~#ZJ$ePC}^2=^3&Ui=0HT3H!v#wN7ftzTFB>2-(M0h9`h^t&>;; z_M(t|hqWsd$Vs#Rv9buIE?MhDE^`v6Iq7JI?1@FrxRCvdKov#y)2oWW4vKd<-9yuz zl&MZ?v6H;YNsyL=0(3&8_7kf>^LMSaA^R|>?H;lpuprP>M}+JHDxR$fLXe`8&@N|m zXqwXl(wZ2W>hzykjAFkBv2#N9Pe5!!vD38x&HhuJky5JAaW<@ThOBoSaHfXVhwNXk zJnAIczXIvYK-W-6PGQL24S5Cn9MDvV$KJVe7dT%6=OrKn`Ee%fa#A5z5Lcr83h*Mx z6!OIIW1xHYx{&=C6rL5b-?RclEfD&8W%!_s^Cn2_(a;{vJ}tB>1O;~Asv>6uW;omo z885OAt}KGh#i0Xeb@#4iIpewn3i^cX`$7Le`+ciO+MoiCLNXkCIV7wUqF4*bD2BRQ z3AKe9dxip;y`1FGQLs(Z&b!DB^%|OXEM$MVVy$zoeRBZo+36d)8FFhU~Xj?81859tbyw>^D|GZ3TixsUHqlj?*P@ULPm*7{&!E zHiAMZ^RFNls80JPa1ILDYwW-T5QS_fht^MZEmee%flgS}|rpbsOsRERdoduv2l z|13GrI-a-shCP3Y+2gyV`~VNIO{Rx_IA#Xt52QT(vZC?7N{&An#~ynn?-~oi^`hkR z`LP(kU6SK3YO%*tl50OGlJ^XmPU#sFAXjpj?2KcCfjGPQ z{IKL+IqV^A*GcY`1J2QS43ykU{~k$&m@2tfK1Ybpm)t8K)`Q+Q&QNgXGw{A{^< zp8>&XciJ67$=K>~!cGBf^(0^%?xkP%w1t=cSl+pQ(cg~Qh1LsU$LU8(zH>iPymNn1 zymNn1ymR}%5|#!j=xH4I?aX+5gpd3kK0NBfuY&mE>HoEl{A?e2{N`vpJ%fEXJZ=zI zKJ3GTKI!?6kN$Uk3Q6Ij?M}G>8Gih2s zmFs_q^8m=FY5i2L^MPLs|7lu3@m!5pXdJFv-J@CK z<6J5Pzx##yM{At-O)%^6F4AMx<2#yuyZ1*pKkQcrR2|X{LZ159E3~nV@k! zUcH^``sZr$y8gLZz3BRXpz+Bn3DSJhhwmV6mh&%&o9%&Le#CtJC-ud3gnIOT7o{{K z*ZccijqClZf_M**kB}Wt)nrFLNaM8{AFT1k8Xux@Za=68Ij{GcHF<86h;Ag_6XYXg z$J2VUBOj!39w(9O>A78#*VD7v;GCYjG_I!y=S@5?{b#|MSEx@)3Re;ae}*`g|7B#y z)1SzWdgSA915tV(^E*Ycsftx z1sdmm$NJ?1e&CPmE<9L2^GTW>T|eF_!voW=kGEyS&3?qM9-IAWv!+MyM`5KNuZGpD z2;{Ex;d^{Iu3PXh^)&kM-}&&NG!B@0R`_t97fkv8vg4q%w!#=#-hv(6ypqZZge7JhGOqGKk?{vC^HudngpiKU$kNi0)@$+?s z#s_NU_ER6u-<-vGb@@l+3kE9vI;Z9-zg>Nfrk{#U@=T5M6)t|u2RUBv;lYocBOk7i zH2Dq>%Wow=jte=Cd83H)8lL436CY1!%$GjS&n3?C|0H+0!Fk=kz~B+khewk-$?+;e zc09F^o%QFD{JjPrNqmdJ`K9;Ah-3N(ksVJjk)8F=Aw4|bp}amX|ILtJK=L0EM|pj| zR_{K;8^FM^zW6$%JB4F@ExCIc{M+OnLTA?BhvMV;j`iRk_IO;N$?NNZBH}E+gWNo? zG3V=_%MJP0$<6Z`%kL*X-;n>5+OAYxR#G4I%Hu38XK92ZmgBKFtWbkhh z|E|FsiQjMVn~6VU@P~-weE>W-U%YO9+~9AL{Lc)2l=x1AC)0en+u)hRUo`j>;yjOY zda8-PX2`E4{-(hnB>p#pKSTV0!CxnS$l(7V{)xd8XKC!TNc-xKHd&U*e%e1;*POcTy*gAXPC4TE1qywc#86JKcXtBEf$__v8S8N8J^ zetSaiM=ugzW$=B(Z!&lX@r?%WPwTc8gO4G8kHM!Cf6(A{#2+#Edg84H{{itQ4E_Rf z*rPipzXypwYjFNZ#&ZTAK?M{2dJsZqFAJw`p8qeg$#fH-z~z;`mJ>BtL-FUzBc$wlE2j8i-}J*_w-UeG;P(-S{qg0& z?c~SA@%KACnE!(KHiPda&eyXnzmND1L;fgn^*g4gzY8t!_Zag04bDFpoWC)ye$Vyv zOd&n$_g0TzPJF+i=Un1EKXdvQ5dYkezn-{7^C8RgH@3SP{ArT!ZSZG_4>mY|qx*b= z|DNQ>8~j7!`3C=t_;iEwH_NXu_!lJKWbhvnzut$hHTeA`{~d#GA%361IX$}#&fgyY z9dTUe%dIF>vlMR|@+0W_lh-L&FK2`76(rwo$UjN)pJ^QB`S?QPnE-dub$Ec*5v>0i z3J}sb%0El`Q#FqIaYrdUdTJcy@x^aEVB;%!u>Pw^eyGM#{x>8)QsZX>f1c#=IW|1F zeeySrFVQ&451@HvqQ+7G>!g3C!5fHI82m=!^#G5DLrU(@*6kl$rg4u96TtVe3MZ5l`UQzU;-<0#Ml^b?Jv{EuiH`Ap-o z9!dW{HIDMN-2P}C$MyIZDhFP-ayxm8ocMDFKTP};ga0?J$KE2&`Mq7K7iz;e?>;L3-jGS@VtKqzk4K@w`Toc}gD)oe zn+$#<@vR2mK>Tro?;-x2!Cxl+hQSXK|J>keV>_5TsGK-oJnoG(_ylSXa|~Whe51ja z6W?O+)x>ugyp8yu4IZZP;kd#35KpE0@=q9i z9`T|8BzNHjDIpWXN-S_|)K6lYEfY`>ba_@nnPZxZTg-T))E%-a>kE z41PcHJcB<#uQ~r*P9)JTf$%iGY508KH5MzmDXyG>-B?lD|OXDBn)<7i%2llS#fn z<0zj;?qZFjJg@iWXdLD5BlkBnj`C@wpRdob98kWEn)1+1&w38yzcsg#xb2! z==Z$WHIDM5DPQjzd_3_(8b>|Xk)FS69Q8y={)EO+9=;zbk5d{)`H3W-K>6T&okiu4 zq;Zs=MDo21UQB!-aqbrn(0n?=;QTw>ID_+ZDsv3JS0!IuYw&}_?=ko>;y*RGpmoS^ z3?3!^p}~0_6`+34`QqP`dKr8hA?rekqp4`(6evsVN2LFoO*BCsN+TjM` zSpNF&(RUm2b4i}l%k6n4@gEuT-=uc?l)=l0zhH2_&fTkV>|fhS|DQCD^;<)F+BA;x zM@XK_gUgx6jU$Hq{iNrZ#!)}_cYc_b_3-sn0>#7SR!r?Y-QW{I7ao}gpQNz3$l&vc zml>S7v6W`=buQ8EB^xZNB;ep<@tBX zQHCCJy3b^?JU{;&)#UYgzrf(fDBco{>+P1uKdzU%s9sp7L;0fMqL?hmSq9OK8rSuI zlk{==Nlf&m>k{O;o=tRrg44tDVoA-Cs)kN)EW^vq_&RM?bGj&GnAe}(SDW!I`K+q?B};0w*X1cl-BNrTmtHT2muXG6 z_C_+i%-f`kO0TBo%0|E{ttu0Zl}i`a08*}|=0*V_<*V-;55*n(VmH3YThk1$?ar@S z(h#Fiz0^)=baUmtuw9O?UBgTCRke%C@sqA1YiWIRP1a@8XP+-UI;Gio?^@UB%JSRa zlvI6(09PKjBxq=a(p}&NgG_XKIoy3m^!l2{dVE)zivfgX85*yLyEU_*9^PNCU(#tW z1^F7Y=cAWByenHnWmi)Rp>fv%j*j%ky#5YJkZ!#U7cQ%8td6Mw*rUMJ!UaQ#Cpm1e zMk}SgB;;G@{F-eRw1(!&`68?7x+U`5SdXuaLk{9>uhwa^wk(o1_IPtKy!)-~&c@i- zIgZ{Sk0%J<;l5u z7&OP6uCVYmev|}rd6u$fqcvMsmkmx78ihVQ;<_Wu|H$INI7UNRO!#dyAePa1#-21B zvQs|Gi;Ql+xjgFHVl9R`(FMTi!t;E=TFmec0F$9?#S9gK?|b4i(3nr2?|2^j8_X~9 z;=i2=h36lot#e#&LHKy_@13baJV^zH@jG$i$7hM-#lM;gl;<<0t#e%Xjz_%sSI<%* z3Md~KKi)Dl^M4@(#`yJjMKB~k-2{rEhInI{x2p!*ibX}!y8Oj&$Cgww(@cz*eEwGhQd|ne&bUGR+;Yav)DUcWe|7Q4x zMX-%dQ%zP?R{h8b9HY>nL)n!%HYZ2Y@ndtc$4Xm8msOLCrvxl7N0#_`r~1K!?VaMu zL=lK6yt8SEuW$H8>laDl@Cf#2c3?XQ-?cR)c1#qj zOZV9s+u=D8$=d9m@|+PAKdA_cvg5#!q0D|e1G9P;{D#*OfpFIZ#7T6ohI552b_@cx z-|n^j0O`0k5IxD^m0a{>C9wAby${3lhh-VHgT}80H>V3_A_1|Z7FZj^6?Q}meEaSs z+>%S@bU``0_O?%MNrPsP&bsm3w)>W}V>9wwkI$J1We`32^$jm<+hdo%(Xq~Y?dux? ztzY!VatT7YIIUl=6ZrVp=HXWKWIL44=TI(~UUcspB3kz6iXa;3%cJC3#W=w`WO@j1eo+h?Jep)bJ7_K8f0C@|xo;+8aJW(D3xdg~x z80y_>f%4iM23`2S4e~KKN$mIx(+m0g!VYdfVcXk}LB2nS{G+b#g~V&yuDWhK%#%4- z$DGEBu42bNs8`G%mJz3WALLQxxew&8x8$;%WZpS{y(EXPHsrKXUio~y{+6_kK(9p= z$(TZ3C;EM{Jstn|Vc9Ph)tqu#Byr}y}lThd_tmyYck#t_-(CPKf%GXG$m zXuVH zJxrtN$DxnFbe!JaUCF>gv}~*`a^sZ|>h~+BeH){#SXP3{2xTjTmmf?w<`MFej`bC< zomM7c{q=%&S^(|uvepyjQ=mO!Tb0|D-L$xm^-5Fn5Xjqv=#1K-viy4?v8vlo*kcKLthVe8q46jN!xJ@!*RqM z$Dseqw($91G0o}J=Tsj>KQ-PfH;-}g>Us0wklXg^1RRfWZc<|a%wHoS z$s+ey4{?&mg1ZB~Hk#u>+d9#LV^)CLI)l-G! zW7h^)lN{2Sybb(L!g^G3s zZNsQ;*L_RQp&T#w84UZhBXTibjBhKkn7EJTPYk~m%FJZng|*`~z~6v!z%u8tVl}#9 z?pz6HEE}~pv|B$PB2LP6;q$_6SGXp8IA6TR?dmfao49RZ*ws`Ia0QSA_hHhpOj=>> zq3WW?VOU3$ZH2Ol*X9O=MH#N^J|BYfWWKwm!}#)HTu|k%#<#Xp9l2{j_rstY$K(Sr z7vXvm$CnS_|3moiSS8$cSOMv3gZ8l>@`!7pTQRJrH`5A3+wHM^1FhlPPIk!p#I&pN zU#|D##?$^N#AB=Wj_G3k7!LKaP62*Ae{6;MTD6xRhqpm_wAmZ_Jxk^P^$ojPPt{wk zUoH$l|F&Tap!K;eS~~I*UklS37Rw#WU#?~Cj1yr2eWow0#h|_KvmMz#uuj@ip^sg9 zOWHk9A8oJ(Mt1ANFy;+$TK0byY{Bsh*R_xj*=J=P(%5hgglWGtZzo)P%*1wF2fA@R z7eQSZ9^%2a!0TdeyN8C9DgEI8Jk(up8HZXAqYR8cx$TcYe;Ft~U4#Ao(dfykFK#Y< zb>}UmNx$9Mm}o_JcFB%Db6#X?<8UjfsL1MCG~DVkqO}|3W#lbs$GbrLhWL-eKjsJj zG5=U58^SOaKt5lYA87gQM62b{xpr&PLsrXxL87Jq8qv~kpJ?e@8E8q&gYnV|wETIn zXnAw3XnAYDXn7?NXgNH@YJK@(tL39%f!6i}aS|?l(>F|yKJ&5zZHVH7wzre*QRw^a zH^6wfmZCaG~C9a<`M#!})`cwL$ z?d@#Ow{|`a;{n<;EOB-FA8t+SWo_xlZR8qU^Ml{M{Jfppp#Nl8)}jikf4G+cZAtY- zj5iV5B({6~T5Vs7nnR$?w(#}ZiSm4C*At&#^cbQv3_vPhH(m56JfpK`aACcv^&rZ zEV!>Q*b%SEyzhfNfDX9+ZP^Na z0Cic3$}ig1k-HW82j15}**)*6{C*DoOx0Vu9PjkH+w(WC?yw!Utr90wd7gP5*X+U8 z&tW}$Y(^+%EzH;CcrA|O8(xp&`UT^CD3HDp*H;f$sd?ygS}#VRz2e%e73OK_KSsR9 zV;hERv!JYC>`M1p^Hlc2_L>gst|^cvx>kE$t>3rhmp@Yrb$9HEThczo_6G6qAA)OV zb-jyg#VF|KYeS5uH4skPJ-BaUj53kYuWR+^vAXua*nU9Mg=NO`KI>}xEWWM?atO<1kM}+*1_xTO z{5h;R8b56G)7Y@9q2E=kjSU+)5p-$Pa5~yE6{0~FF;sPqu$NQg{H;hw_ zeQLaqLfhX5aX$=wx_Li*Y?k^Pq$x+vchs-2zr6wdtqt;f9Qx?HaNY)C@H!30SX`Im zTpkH|@!07&#?t-W4OTYHG~Az+n1q^AutZE+9R$$&_nF3fO%(CA93|_ zQ2t|a{LU9G0hqrq{X8yX`sn)V+&s8;hR5d8kN^0VG`vNluBF@W|5WY&zS?XS} z-dEdTJjFC}JIC^R8tSkf!l|)Bjjfn(X#Y7Zw-EdVl!v;{8*2UhBAh?q{_Z-nv z?N`nrP=4~B&-3b981G&0gKN`$a37nmg=PDOb<`oamyG58@SXA7x8J-mNZzZ(d7}W* zg7d}{_d0po^WTh}H&FjNxMr@xdWCD{Re}G<-n&3YRb3CpR9XB-l$2 zXoWeR?}>dL_r&jj?+$`4^O-4@g}uq}t(Z33Ru6~c-zv==zCZn z2jCtKpV|G5#{2=;AMExQp4sOa>qpQZB?G|rcaz5Szkh>U<`9&556ZxJRq=fI>E-&l zunqGR#F4&Ncjt{~p9)9{7Rc{46Z#vL$ zU5`!F|4p;4L3oTAf5C()*=BnBjM3TQ=@Tv-T{1p<;`ob|l+GVNWn8v*uGTbu?6(y5 z%+zJQYmJ{nHR>Na8b9vaD(*l=Yf^2SIcCy?v0e?2mr1tA%R+~RMaF<@i(Wbho@&DD zwO^+AlHFt=#rlR0n9-w-estxt!komX%XlPMpZUW4O;{Si*-H_>h3>PaaWa7v`K&6Z zI3+sPGM%;LP!XS1*^w4*L4i{w%*n4D6zNC{YzWj5rdMzcCs#YDdM_pSIVgO9l1Cj> zO)2NatK9>gB4JMMc2G6fvEN0GMoM@o&UcDT@@KvEB80I89!e^CIrt{)e z9ru9Gn$AhL9g)~}bl4ee3-^HES{35-Mlz=pkr78tYOIsK&o6vN&X}vw0#q-aCq>Ct2*HhUBLZaAQ-gV z2)C|CY+aGqx;pGZuFH+4>6~=ys*0_vDz>f;`-kf)q=e6!!AZBSn%KH(V(Y45UHt0R zUp#iAfs9Xf8ZnJk@v96o z_Ww~*3=?3sbTu;eH9JGeu~K@Kx;ZbToH3Q^iq}8mp$m=wLO4PD^o-;49a$m2D*8I<}IC z^Wx>$T#|qugTkE5py}m5SR~wzn8r!20CskqfwAIDKJHF((S0KRuY@#%m>_?T;B6euaG35BRR>lq@L7UNnjnlYRXsqn-dVyl<&NF zH6@26U<`B8ZAxV;<+@Gja2jQYu-$$ucLS?oJCSkvMXCb)pS+jSqo|LOaoUaX@GQ!% zaifBR=V2F-F6TvhfDJ7q2|caw)g+?O#jTWF>!Pic+~J_=RH~Wng@PPn8y%yn+0JYy zHmVCKInG64N|v~YDso!hbfA2+V%RyRKR(W z7I25MX6;YD+Ue96b~I4JOA$wgZLLb(z@gDjg%tb_nv&ybO73vEr2uq{9}(7U^(?j4e{rQSWnp z0VRyty468dt0~#)xUNH6sD%3`^VT%3!&O`vtGL6tlND!E0w!fnu5eH!R&j?8XY)!( zi{HArk<;87jm5<(>RHL=86a0gmCgGA-z}NEB^k`PTZ}qu`3-#c-O^O{DWoi z1cG(*cb@9L(gwL_=@ahDwWQv*Za%t%FSa=CnI^R>IajStN#(Oh;6Ly#7vY8_pgkL8 z?V5JBdR|YpNBAn&iKXgRYA09voxRDy(@Li48u_Y?D8wDF%n!S0Cnd98ySUk@&SRBo zPVzSaf-e5!Z+PQT9bkPOB^Nu$c^bukvJC|{Qtnn)ihsy}pGtw$e#(XSO-Owhf36Xa z92X6wWT}f@q~u-~>0<6#222%Yu@4fgRXeRXy^qw@qElYF{)6D-Rn09@%E=W}9mIY6 z5}w-HOvqij+k|}KPH&~0Y&Yfjf*THZY25kk&LAx1DW?E zmJm|y;0rf$N;%nL%JBt1(S$psm6X5Esp4WzwmGPjlMkEP_<~~%wC$w)Jx8=BK& zLo;3+LMzB*4nAl_oS-|pBsS<~@VAF>r1`8GPP##NF-I6jP$xQ<-R*Yn9PZrSPMmi5 zE=xaJkhajPZKYWo_+p>4T7^q#R&t+LggMCzEG$jb^UjNm_CiwV7O8S%DItq+6l6PX z>aZ48nN0~;=Q!!^S1WmSu5l)kN-oH+(iY~tC4|Y1lZz=29uTqOJuc#c{OYB+pHswn zC%VQ#9lEN3L`OMABAhHG1WzEcIqhmL|4wU zfiG@yCWJ^EC3l)~eBn+Ukt3APPnA`@eBr*!7%89$h9?>&#}|#xHYu`#l6)JZ)bHI0^2!}t%ekY3XNZ?`6i6T5Gctmuf2zNp@ zC5)B!CI?lnr{q3o)KwC3USv#iMgb*YrR5}R(GOi%kYBwNjdB!C=cK78$(b262(VEW)>J|VQN zfYN&mwwKcT=@p7{GJ(1ai*h={>B3S@ay+9Lr$;$r(>b}=&_=CsUSy}SuM0^+KWX8s zFi{A$a!Rsm0kLNvcBOVua*vDH$NOEx$s-P`X7^_}&I!jpU<&6_Zn+~>-AYNGQDAGl zn$TKT>P1R&f8diTLSH#jVNSBYVOaJiUluuT4p&i<-3*>sN2tw};^bBbML4<5LE&AL z-0h$ax7<7`CXw@CQLEu}x#Q4_H&Jr8A;xL$61Y+Sin2Mbjdng2yr$82ia$c0?gbz%;>Sc>fL^xSn#kZ#yy7N-el; zU^Q)|4jHF+5Ch+F7`MBKQqGGUfyv~*z0~qf?RL07TBxudwtU511Chx|?j2P;3iu@9$SKR`>Ds|!|Tuw<|!lCs}YbYUo&-po& zfFhh+>!8Ywl+1PN>hz*o=xA|13&C3cvqd%6Q8b;CrlO7))ofBwN3Zzt1#Z|@gK_$p z!&W8pBr%D?1=gQrPKVtPs-xsW2RWaI*SXp;Hb*jp`J}Sy!^vRD<{P5fpN{v zap#Z@gR6kF6w)iqA>$~?!2^wTJ_=s$h&lDQ5JE9F;3l`VshnQ#IAz)61wR1Y#$sGn>=h@sf6aNN1>X2iM z`;0po#u!`2z5~Rr+eW$o?Wg1+2UU$CBRTj$idQ5y7Ve)o>DnFUq#GJlQAWdsw7Z-H zIKW`WpT$;gqC8}r-a`z$L@DP*s@_UD$LLjk4ul6;HnmYfM+GH1(gdSG>gmLS7ssCD z4N?!-)A2`4;%Lf>rzxw$n*i3tZq?I1UmYfYKmc^)qA>ZhlwP3-CwWbSQQwgk&d+x% z=HyxjRdRBjgTlKg>Fz%|y?7KjTAVvFu0SsyeC1X*O;-1xtulp9jng^Fb)cf@8~Dnt zaeBNOJ6?{cA}iOaaRw*34hURMy4B5))pa7gxvnCot`bgi1u$!H(ygl`wyrAH#jkQe z=1@j~Q6KG2yRIVh2Js4}?ai z;Du``xyM1(oILCxHlJ*Wojkeud}9J5jN7-;@l5qDO0xZ(cw2)NvjyNK=R-g|Q^Rd~ zBWdQ!P>gG1*C6Ax>!z8~O(+)Yr;ApQGgdoJnJ!(2C1ZUz({UOlWC*d(N+};EEN)qg zi&ju_wTrlcFS>}^#f<`8jb!jj$M7(BY`cp{h4UhfSiF1>ZfCb>v3Z7t1NVmIbsl@JZ0e@Y7x_ar7?z6ik1$0)|6eu?# z9WM%?Ec{fLa~XhNmQtcrSBj$&a=JN6;G(-zDu7DhcPL3opa62y93^nkqbFE@Mlbk6 z@_;fXV=y$aN3byKwlTf5xo7m6kbWKrz^^C!Gc`ivPsoqD%)EY?&zF~;20fW|!!n=c z&ssAk%d&a_wlqF*FfW?QKo{l=4uGR9Yly3i-IUvvY(nqm z848lHEkpASi-)<6oRE&~$*1-tp|gf}rM?)!8ZB!i6;}cUgGra$N7kR=XBQIG&g-o%Tb&cs8Gq^n28B8&YW0Z;y1aj(qLw;$s=Sg6sdE=~ z?yAm7>a5>RO0l$ZyI#Tnv2vxen>u$_=Tvo0Q|BJ)oUYCp>fBSEPf+Jfb}{X0%4 zs`N?f+*_SbR_E`jb02liR_9aH`BZi8tIj#$l;CtMmwU9;wa+>U^d;pQX-ctMe#zK1ZF;Rp;~6xlo-) ztMeFj9;?pd)Oox*pRdjrsIz{TcY;b6tMf#4*6#&QR_Q6~Je4{+L09)3JK72ab>zY9 zjlW6)zgH4U#IM&6VQ(rB@+D%AgwXK}FrA1#3hHJ;0>3=gvckULysnry5k!LxmP&sC zH}k>fkV>C|e158%UZ8*UL-B?B2Xa+R#*JK$N*XHUAW%kM<hIy(sV??nrRl!i>f(L8=;_v~fuZa=UtbZK2PO@HS z8D-V4dRSe;$}x$Mk&c$7&Rs|nY)))V~n_$t*ANEj`pj6Rce-RntxRY z9BRW?cv!tcAuxuHOw%1Gw*vYi>|YMq^dmZ!bqwkx+jk~l75IB7>Im&jKXA*Et zGq2G?_xf3p|7-&0_W|orUubv24p5h^bmR3dRh@hNe8K||_U`rXRPj?-J`4#rb8tUQU;|EesMS_QINDq0Ik`SPPx9U8y1~H1Mlk#&xM!43-ENc5_A{uGt`1yE*9^+gj`sV z%k|>zEa^iNaGBQBBV2VLu1d8so0M^AAja4<6&DcBvs8>hz6@tvDma|il(STtnsi(( ztCCfqms_HKt$&6NbjOHZ=6ch)<*(d|UTI<$XQ+Bclu>#x#F2|$7UC?OdZ+9ABnKAz z^a0q&#Qu;B;k-KpFMa)e7|tr((@~1><$jb-zX(a9!1%KTmsACJQ4cRpVrrg4-8|;zP>6f2iKtu9hLj~JC?KU z?^a)z?^y1n?^rJTJC-}GQ{^&uU~kZ&#w={sUrlxqw=$3X9m1Af|;R(^Mg@3 z^{o>uad@KzTS+VP_fh%4pw2f0TW(pIhXg~pe+jl+%}tooQLUZTHdER2ztUFnKh=g_ z{NJ?{X6x^$?X;-<2j4_5hxf|9Q#W|1Yy01-+Xm_ms7Z-KTkqXJjl<%FXdLEF+57y? zlzpk#!dz(Vha-yTa*g1C8-o!mTDnCTgc1nIZFQ2QPicO zpV+(n<-gVZKmwhyG0cvbJ(`1J(**| z1yP}F?$|H)%vl-LV*R87+YJu4m+!&p)n2~ZAKx>7j4Eq9B#Y-qy<1AEQ9B~M(@e)l zdisQ$m~?f*$AjsOc)yy6NquM9r0-0fr-mCLn{F6xM|JLF!rP;t8s3goxDNvF91wN6 z9`{Oa?$1zFhmQ#}$0(b0M_>eCKkJ|f!!48*^ZZK30X%(ipBzqdXNz@#=ndYwK=cjI z?SbeG-t7U};3)$__XMJ!4E{{1%huMxpu8)9Hz@A)diC(ny}nzib8jcU2pG@zoTq-z z2Szzh{bHZ*;jod{sXL6`fzjg-LT#hxMk!69o(0z8V@Tt0x<4F&jHp4em&7h4|=DMiq zNxzvP=R`eQcA}tM&1JHKl=GYjX(PN zLqyz9RSVzN`f<3r&l48X{nY<=&l7I+_s3@h;(5Xv|6u3If%_K0t$z1;!l}*zf2%)T z^(HRxDuGM9N_^`g&k?k$AB@YW2>KAp^I=Z4xFx_habSB;Ze@BuX^6LK;#7?#SM{^L z(?f=sv8vx)!1+IBWP@?hD?iK%u;#~;lM6V$PZEY_@m8i>z}=iUbAy$G{tAs&(WW2u z!UYa{^=vsbMn$nskM$=ye5^kc(nD3@^HnJ8^mwJnO2p+e5hFUNo_2touO<;AK6nP4 z@JP8E;uogjl%J_5$GEno-040!PPxl{a-6au)f$Gv$s172m+z)yl5Mz-Yubjw)WDC` z;}vS)$3C}#ANz1l(+xc8!~M5z$fv4+-if4qjGEH1kluRWu0y}asUF^>3{b5$1d?+= z08dsTwpU4YJE9-)^uxTNDsK>+Lnx4lUedZQ)Kbxvxzja%Ll^B^&N zBAoa*wURDETYdV0P6Gf{`U*&>Lf3F&H794Ie;G--I>rC0t)XYJk0_eTg5cQ#E$u#EFm?e!60;C3CECiDL$b_cUlF>|D#D zv#{wN4>9ajJK$pmVSCkXC??k*weskv`l#1aPQAD38v(ORlvs=vP)Dy@4bw6=8yAlD zC*r}Eq9AWRZ-QpY96e3k7$*ncd=2|=h{*~2uSeGYE)KBmY6^0CrLhY448F^PxXOJ(WnW=?}AJ6P}!#KPzz_T*F5kVE)8U^{DyNU#i~2)AB!t zd@J!*ltKaZ`IF$+YBGN-N|meh+f!B|eoReO6wJ{RH7X+VrX~qEXC-!la|oqzrnf>5 zt2|nO9#%88UUVMu{SYMeqO-+^AJfw5M^%9ls_>IOEAe8~hbw3z&f01@45@WVFNdLz zaq?FSU+80;_eZLdpI~Ek@>5)sb@B_Bezwn%{T%NXwZJiSvXQhB(XbFw-JDjlIjz1S zFvN9pT8-u`H=46d70^vv;X4!Lb<^&Grscy`2rEcD7gN|iy<*yWT~#aQ4bYanW^e9mf;^O0c>mmdc)t}zX3?%MmU9BP0gf9$IlORyrJ%Nl+n5q zFV?2KhZs**;s>Y&Kgg%bC0?Q{R|4vjOWLNMa%*rZj+{id+)AH%kfC&HO`mH`DCkBb z)pA>m^i)F{KUqZ`^oXjL;_VS*NB47MNB5{7Kg*^&fvL>?cqG1@;rT71DwI1O}i^Zo~bj zj?nEWOi{7epS~O)H6`LFA$5m7ZFH!bK$J;1HKhLnMCn6&+aRew-iIHLNXN0FKY*r{ z)El#k+g07J*6mjTYQgPYdH_yV;ucVm_&Z1`cXU@D{8QUOwP|!a)ktB5Bwnt(r?!wP zg^JQqr6KN2g33}|Fjaq$P8p*Lx%=2rLJ)1h!+u)7{@?lkJn(-W_&*Q)|IhA)V?$IROaQ4s2)*W35nVHl@%4k zD@Np2M21%Ox5l3}M+R4dvRSBXR{QBnFIrWjM?ArPkYx0=!<4PvYC<{+4n=*CEc=H;5 zFw?voKNfy3GzOH7D~e|0qDz62veA=DOc_8kfQDzxFzM9r=xHPRhmntd#a6}rF6#6LWLKM zo$RI1BMTMA$r?L)^7u)UCXDv#A~!#NKRNlRKTa1r`N|EkJ?7?v{y2T(2c$| zN{ojr?^46QrP#1|<;F~!deQk4W)#IM=j6qy&&@l3%!qtBAl%$oZ;zfnHXlP?mf^{2 ztoQix$Wq-JTgvS=44ZGu$Kd>yd=LGjr+bfGofm)Hsyx&gCng-7aa```^vY9q#*R~0 zXWY@{s`buRn!U5t1QV~P(Lv~3k36N;BhO{Z>87BxFo$>N$ zd7XN`=kn^2g+_X0p^c>_?!JnacN`s9Do)neqS5gG&|Ep7n3sj8PP#a6SnhBsz$0$r zMR9YWXATIB-3A+)ziUx^$-;b?LSZE@u>tb~j)8 z8upZCd60lg1%d6KAh7c@$@B@~@sr2pjmWj?8sHuyY7^dEdqt$I#j1qOy}LVCS8yw0 z;WoW4Qg2PMnyq@P(V7onL_Wy#)_z`NZ5cunSmUj6@V!mbtZ`v$+%#)i*qT1Ynhxh_ z)`hj!h1FJLMO9U8{T!>NqPeE5w#q5n)Lcpe2p7Yg@otb*{1IHB>cPEoF^O5j;0Ex4;YD3t1&rNf|ai zN`tBbey*OIhg#=G7ByDXHd)opk;q)DY{JyC^CwIiuU(1tRkuXy>a6O@x`t*~Sz}#A zOLarjys|4IO$}x(jdRPOnO5Um_`j^SzPiDwi>|@Bkg9B1XlAfi*e;NWRJsC@d7!Gc z#hN|88vkLBMXLsZI4Y`}B8J6i4(KqdKpkb(O%3zPS{5}%Nj67X<~N$6b0RH52&!y~ zR8*CLJ=G9Nj#}WVUT6Xqf|rWAIaZ{;3Y(2dM{=&xi2kT(s+iYowN$v770vZ|sM>-O zWepG$O%d1hNK;coQyB!ARZ}~s272mptGc!>V%62wN3a&G7kYO7Z0K4G|8bQ{t7?j@ z3ZZEnRB4(YqX46?r3r$(tbRU32j@FcO1`PBhg&HsGZl?(9}}a zRB^c@ugA;0#=1z0+dB%HO0dB+a&%`lH%2OJt7{`wILL53Rn|o+>Y+a!N!91B7<5h< z$k$b2Hl!NDQH+yR<-Eo+cy%-&!%l^ca+qU+6a*n0Q(QZi)v+Djf5@Yz6a;lJRxC$z zeM3FY2r;Ha4LvLt)h_JQD1Z{!BGXrHkVF|;+0eMi2zot~xFzT?n%|-;z>InGqXU;h zv#EB0IcB(*8|PLw=M61uoE?c8CsmLp9s??ikw!qDItVT2(6*UhvSQ&OHgdvP$ zw``euMukoA%!rkS!BtmV>0QXpk1g9ge>ROxnn%FvE|}jO!HGrt7z7;aV44H(lvTk* z7=@c7m2oHv7nIGfkJMK-Eoy9uRK*t5B0`{|r3QXDMy*aN3~>=@yc{Oh$UL0pFofX} zU*HNB1PBbAKFMBaiA9eeEtrEW-K?^z2ADKq+z*9?RdubJZZS>esv=~iHLohF>){gD z4cuMSHr7O7MmA=5LL^}Qzw#7RJq=c$Z-kWZis_bb@%MZuCHGMuLgGI)$8W^2N|H}5 zyw$%p;U~eLhHgu~tJ|HaN@f&2Pu`EOrLi(OfXgut4*XIDYgY2fVMkBbb;-A<-qqvI z45bS`3#X2ac!v6NS?;c`cj9|o+3@dS_=g96%-XBIJxT(qijjf(l;!%v=j|kiAE`8`|CNj?|y^Sf6p%33sBO@Qv3ZlE=UCllrm&)lfeE zL5Z6W{-pMy4*s&-+$b3>fxdj0bXZaOt_~2fK7g-+Nw7WvNuSU6uWl*$g2fR07mvMb z>nrQ#S4C#g+~V~Fy`cu4r8ig29a3M>QoA5BWZ2-LgNF|uF{F7>b5lb@%aHlaO+!f4 zkcx_?${Kj^4cm_S3kPAzS!z@IUsy>G=l=)RSuha|u0gNCgryUDNb2;wD*akfSBFEi z8LpsDV2aRqHax|jKToIKHwqv!np>)B8-T;x-Od(xeoJi~iAJc5+M#KNOQTM~N*J5WM3mAoky^Pa)4vUKYrn1Omm| zK@n)aQDuH^6$kCg?Lm9fRm+0*LA<&PQy*B%0-0E0vHcSe^abs9tJt3bu^Daizrp6T zuKwH;gZA;I+wJRoP$SxSd?^}Z-vHNxrv$n`89EE={CsI>6q>%;x9q8){qfResCca} z)DpChEDb&EPl(a~Y!_dkOIN##e;`P1T~G|)?PR~w1+08@!7@l}4`c+Vpq0e|u;8EI zk(A(exK_UV`TS+j{8zgc2f7EL<)KHPx+V~qygX>%jTu4v9mq*q8R+s^ATV`#p!>Cf zE>8spgNIKEPE7CxQtVrdT>Xe=Tm`E(5OMA z{k|*Ns=T1RKcQG@-*_cz?`gl40L~BE8^BTEuUnJ+1>ipWou#2e5FFiulY{p4s;Vzl zRa1iYHBi;R;6hcjLsc}8o8eTH8?@i0iteO}4kkd%v_duDnp?USv-S_?Lqm|=4!#9L z{;s+JFNQ;(^qdg1-_yR|?3UTfWwz)tdsG>`IGf76H2+h7C?+&+_o>j!fsX&n(qj7_ zUopHc!&eN!K~Odc%nAfU=R&OQ)3NrDinZ65hFapp+U-dy){>zKLHo}wSk`_h31aQ_ zmSvcLSep!OD^?lj6bE`j#Haze24vHM_NO4y1$rtG#0KdQTD=JSrLTQ72x@LO~k>NhliVvOEyL&VdjCUw#F8lWqtkZVMz$f~#f~H;*Mj2fW-u z?*0{sfV=;I1#G-XgNW}nF_1I?&nckNvVR9w_6*ujLvD&P`xyYB{3qud9SrYoH1nRH{ZV#kkDo_+iTcPBC1>v0xQ?0$(r-$py zcCkHkS#Z1kiz}f4ufg!@3+D9-E(cfO>r;U)MM3)!s0Nh&3$kJEwy#0if5SyLkVyt7 z7u(COTo!;~v@Ea;`Tz-Z$iHEpfKt~$G(gw{rvUFCT!A4np5~qI!Rz2Muml35`_w=W zJB3Tzhp$)`I3sAU0)2ybU=ce7V+toLm{gkeoRflW=x#SdFD(xY)Da1Nsl^5b?LRHm zp{E-=+I|BD$?%DRvoGt>P_Mp9du?mwr0}ycUUa`!d8Z#1a0t3>zh7Loq(8Kn} z*!rI&Y&Tl}A+#R4VOs)pK$<-p`UfOO!DKsGxiJkY@aOcf-vu|qh`1X(7XoLbp#e_> z(%^gno}oiQd`e)1%0nal1A9P$DN4EvM0}_y&}Btn0OWTGPP{q{0r1BwKaDfeciU>} zC^$jsObM=l4t@-p2?PFd=%Z|VCwL-lS|HB`H>ZUI8TKMDXBtY|*DZzSedUADfr}MO z!711HvD@LxyV8PFY?!vv?FATEkiu@A9JoN)3+vANO90uo`L_o{&9KBS0YzJFsMVeh zlk*N`cXzlfw%fs$0rpDUABNsXHLz-Jhp?O+=mWY=D-H}=7C5UoP>92CdEiXQ!@**_ z+8==i7@D_&`ZI&e?0@LXwQzY3n0-WF{)8?+)R(uxWj=H~lv}8lkxv$@jm8Fhd!YLY zz_TPk!O%y0XbfXjpSV}?`1;L>j)!&|A$_Pr>Q{Cc*4i9LR%CL2nJic`yJ2^8)Bjw0b=#I>SB$ zdIl5+hG3RPuq*nLHp;6p!c5$K*sN} z(_mf15DvWy6Yv;JoHN1li@%B78@8cL3<~70>;JeAf&-7arVo94XTwY z9lV-hH+>rD4bv@7-MEp6-x1fq)B_#yr$p5e52%iSny-N(5TC=KPjNoX)dK;y-d`;& z#t^yz3nW5T7m$T0?*jX;snAbQ$g)3z0S+77M4V732fEr1K*vH%?Sg49J!n4zTc{L> zl?&h;w0A7s9w-RfFZys?g1YVY)}`($iK_@MGtkekz~(BDJ~7aJLLdae{_~}u!UAdk zG!e>u0uJg{45fPpSF#O%QZ{S`8*pEh1)04d0#9fS^qK_PmI1?+5`r|X*nSygM+fa= zFgf!A1#^E7YVxVhYy1dw*6|=o~A><1rcD0jm3F!g>c|Vu~^UXeJ zbDEuj?E<@S@W9lSq80!gO}Kl&9Q%3@hXJ&`3+|PZ>_QOk5{7>77Q~SB7xsXC$kaej z2zFS*gEnmVi{Tc~uGt&Zd&9OxUFvkf?X&udiH?TX`5 zsOaOziaUR%=wvQe-1rN9%2}xRDUKW`<|*EnFP+!fisRF*=wqbfr$LsYvR@p(QJg-0Z{%%Iyo*6}a;@S?G5mVPQ)2j1 z#k+OM9c0>{IK|Kc6C72980KGy%5$NFFMSpRDt z>wnE-{ja%eKVI`;8-8PkueSTeB_;;$`pwL+EyK@7hONJk*&sS;>%aSn!(+!O3fWfd zc+@<0JZc_0zV3pq;`a(rhL1l%SHix5aJpQp*JU#b#*!j7K{zD!dpOnYbk1JX{KE>CEz2fP= z+M`|1dD#C05BqQN(6iQ~-c25SuSdPG-?w_ejKYU{e-JJX!@nMuJ3p)U`+)re^!G64 zbM;;!aQv;69+o>ltM~MPrz!pJe7+GF9xd>%hvm-O>is=n_vspze6}F7%N9g@-+JJp7D5%@t37kw?819)2kDh!cK)Hy!GMKdy8R-U0R$JclGs z0`yo%EJ(r)nK2G64ONbp0h!P)->f)|nu`t1jXe5t|b z8hoX}FERK!gPV4?8QipUBXMabzZWm<+-K-fe~e4l+%BmnoARX|jB`A&y(K!S&gGOw zZpKNA!POsv)AdaT??-8TS#NOD58PhVZ~B4b3i*YGo^6Jniw(Zl;Aa^8fWb{YhYfD( zG2@E+8b!Y{Oea$(n)phXYkVuo^No|9{%Y()MMH+&X70l2^+lJ&|hV6 z(;mM6K>ep1^86VH>F0H%hsQPV)Yl8nG1o?%$2-e!6rAOE5XX9F8usu{b|W|2n+@|S z9>~j8N}mc0Znl@#Hy~NRe({EoH-1J+BCSK_`+(+So-1M9N~$Eq`^ei=Vm#AW;x5XXAWb%*C<2RzVKX%oYTlTUXYvfY9nUCA?;bHu_f(k zBaV8^cCr0Z53f5?&nQC=w*^ty;O4k1H8`gc)fl{-()hBH(rBj{&us?pOKE)ZT3_}U z@@0nnAxd++b%A>D;B|yK&-+Jow#D(r@<#<{dEB4lf%cp6KhWT&AI$ZlT$R+PStQT) zjHl~z!TFlk3$~NxYe=3s%eNAjcJgQCkehxp=XtY#4;XsP{%SY4*2m3v~!xllMTO}X>c=6 z%=npP$d?=PjRrUSWu?K*e%WboQ+}Vpa}51Q4Q|S38U7z{$PYC5xdu1;%Z!IoL*DGi z|7IRG`>~2_kp0N>t?b7(lE?ls^_cTatFR&41UCef91iGjW{&*m~n3M91rq!@UcRzY+s|Vh z5vQepc-}*9j_bvwN5;H_Gq`C_f-&ArJsAc!*UcP* zo9m`|Uu?!9-{+$JCZA>K`ESM}&rztK)9BV&zm{+jy}a~?Zj z)H{~a_+pMP(@t|gY4TlQHy&tzj!vqxxz3vM=DKO_Zzmc3ZqCoM3~ufl*BX4BQLh=F zX1jR3Lp#qgQ(&~~h{4VK3oMU^ zw8xw$OSOnP&obo84c=;SbN|22;HMe#yA5v2A27HXKkWuL^!x}@KDjzwBp{W#m;=DJp4@S6;Oo?&ovJ*qUg zxgR$D79tt^43+cC&%ijwB)`o={%sH5m+X{!@O^MRkei>@IPAeMqJEe1{9IS^FFoYX zwd2=&hr#=35p@nGxbh}%^5B2*;P6RMb)cQ5p3gn_H^KPw;}hfa$2@onbuiYOt&6I2 zwFiIQgZJ*@)@$mi^x#h${1l_!?{{_enEVkBK7`&HNBd3rGn3=%dBKC%-|xXs?Gay3jR*g^2mjK84@i%% z|56XW+TeY4QFVUbgOAB@^_%iP^WYcuj4z*ag3HZy>M{@hrUx&`jIZY>9(=b4=bz}t z_%!XgHY>jV-}Z{ndz=`bkN4nj^^PxJK#PI2XQ>D8Nt2qCzr=(8-h+ST!G~nKcAEQ; zl^*;Z4}JzsB50?n=SvTME)9Mu|E>prk~&YyXHaF5|ImYP^xz+P@O;`lN&Ry?_#Gbn zj~?8jO@`Dz%!5~Z@Y@YeRjH2s)PtYhPi3opf+@ekgCFf5U;du&$L9|XjL#DW#pg{P z`~eT%YjAu$Wgh$%5B`zC$yG}61+W;-5B^YIeEI1^e=hT3rEJ6zkqH+ zq&;mOd^z2OOZk5EFhcU>9{evJJgCjI{NNuNQi{;FOK}@o7RH zKTnLuMf%0jKb!caf-fXqCHOz+x>@iWNPdyv@Jl4>xJvLRh+iW(KgYaL@b^i6jo^O2 z2Db@*67f3)A4>dQ!6y*kEI7X}@~Gffko+$Nzm@n?f_-Y}46Y-x4elPL$f^R2&kKnHp-z4}^;y)Lhf4OC=;QbPHe{C0h9PyokmlOZ3 z;7f_WDEJ-3Ulsgu;`;>uBk{ioewa8vXJbFxA#MK$LLPn>TOCIQA4~iT!7GXL^E%dl z6>*-Ang5JUw+Q}A;=Jy$o;}1{h5U!auNB-*((!ha;5o!^5&T@@>jW<)ewW})#QA+0w)1A< z4+{BB#Ge%WIpR+X{u*&!w^{!|;x7pKPl&%FxJ4UM{JTy(SWhZ(UjLb&O8i|RpHKXK z!OtiDvEZe||0VcU#Qn4mbG`G3rwe{9aem*EZ@rjWN&bUO<@_yoakCp|L-*S~LT zS@?G}cyPVAJ`?;X$>UernST3>c#7cvB7TzK>PsF$!Rdnkj^qb<@Zo~v?`-2S zTJX)pCky@%@k+seMZ8|{M~E*K{3jHL*Lv{Pf@hNaor2#={6WDvPJS);)g=GC2Y*TM zlSuw8!8tw;3qFkGKNoyBaX;EjCfec zR}sHd@XLtf-__#5dVWOwa={l8Um^Gv#D6OI_lVyu_<6)PdGIZQpGopN1V5YjZo$tX zokbMQ6AsN#^X|hqx^*=&-VxHAO38|RV2@R zoYG=hw+dcP`~kuFeetIR=lklH1wTxB^!HKd_l2>)_&)g`B+vb|IYk#pq5U}XM~U|k zd>ipzfR@&vDD|NAtKC zLF?r&h5QBGp%5Iqh_gRA-rf`ZCM|A#D)@ThUFbdr_0U^MDkqaT$H^q>7rsAZJ8vO7 z&k*uor05EU865raZ;~HraP&hfwTtibSpQ|Teq12r=TN`QFgWUegXAwVIO^wq>*fBs#o#D^4)w=R4UY21Q{V*0JqAbl%_M)n z!BL*~pN|vgek?^La6E0uqnaNA^wHn$B1|7suSEU ze*So};2AV8qW#r6x% z&znMYf64lt&pQgvpI0+KuY&W>D4JKt3VD7W5f+@EhgS*C&leU7zK`^86x^bD=?TI4 z?*U#AobNOLD)=bUb42h);>pR;ak83tw&1&n7Ycra_@%^g+~N5BJIx!H3C{CytKcWn z{^~jpzDjVOmwqOAI_cs29=69v{MSOB`Llu#BKemEXZ!aH&Yw5>Nbp&t=L^AkUG|fo z*v>G?!#CcmgZV|o`Mw9^xt|tM=l(*zKh2-c{SC+u0LfH(zmxalte@L8-q3^ci%EWh z!3P27^>L=bQT`*6zu4d?&+B8v;3!{C@2A!p9OZd^oNsWHf05)D864$#eOxK{gXD+X z1pgKBdkv2I3+R2^2Mj(4INx7y75o{}v(wVkHJxX9m(%CILh;S zdcfc)e6#NVLT}PB%fe#ls`oBsRl>+H%LCi z;3&^=o_F;4J0jjhWBUqO78;Jj`=DmcIY^t#}U&^|mq7o69T?zHb?I}elm zP~tpZ8matv!CQ$>H}ssLt5oN5As-}v))^fA`M1HkP@}=opFB<%8yw}&8=~cTT(X^f zeUp%1N%E@=j{13=ZVynh&+;P}SiD1S5c zV^XThcAh`{Azxp2H#o}k`qjta1A*t#dfLz6Sns7&Z=T=}5I;-se-Ixl_(-y+MDVML zR}jbe$GGM3wZ@P~JIl$=2L$K+!>`?AoZn~NE;zq``I6xLzT-i``TfE#1n2##ZG2uA`=uZ4 z8#9RWxLZy0&k(^MB!0f&PZ6JO=s%5oi7$;p{>^lqx!B+spJ!xi-fD1+^Xq9`++=W+ zZzcKF21j|GuhttJ<=-UvHiM%)&sUEM&d)iYGC1n#a|)c`c-r8ohv$$QAIpIg9N!om<(>J5`iJ9T zIgP6x#Bm&9|4yRu*vF8^aot97)z9EqZ!!f%p5PY}KTGiS#K#K$H{#QXvpsyjd8Lpa zcsf)L$Mr&be!uosq5u1|S-4xs^WVSmevS42kmTPK^0b|_{vmi+dBL($dg=t*-$;Cr z;4c!NEI2<0t`Phf$)KL-qx|9iaDro*!BL*qogW(<)LM&j`EjbCLGTi9MSF6FE1G! z;QXBVYr%Pb&N)#Ro zg8!ZPazjrx`50f;2>A+{XVx1W`#liSh1v{`A;tTNhYXJLKP34_4UY2se&Tk6qx>I9 z{x=3kd44|gdxN8V2EDKFM}wn0zdyLo;3$6y$?rEf%JY2kA#seKY~Z8dA0ElQ^(*sI zeQ6C8yoUH#gP%eSU#1b~{<@m{e5t|F&L_yu3WKAa?B{s~NBO>8;RMHz436?VpD!^u z%HK!wR~sDVc|Kn)IKO|l-r%U`40>MQW^mJ=4;vii^OE5N#}XfWdKo+X?^h_(E`t=7D7TFbDQK_G2Lm!;vj`iN;pG z;IoKdAb1_|O9a1(c!S^@iC-`HR^oRG&hzK51y81Sy)Aey@uPwl5>KEHAFv-*5YG{O z3-NOW-${JB;D?A;3;q@HR>6~LK3pq!2J!n0-j{rXFTWtp<8B*`yQd9~@w1Zna|So# z?PY_b{5vH7n!!c!VC_jbnD{T5u z0=Jjvw{+szkLaIK@DGo(1?PAx7o6j&MeqdbuiFJ5Mf?%LONl=tcop$i4SuRNQJoJE z=XTvm{y$=H^uwQ1bfKdLN5ApB!GHgYdQg5Ct&di=F30-0ACnD^^7oN^s=-k|Klkn< z_)_Zk?;9NT{G0R)F*xes=h9~z9OWON=eg$@9Ob!xCmI~(=hJhQsRl=Ro)0fEILepP z^O`b)qdd>g4F<>gljnzp21h-6>G|N*f}cqGZxH+jlD}2(LgE_*|B~AE7;%hejFTK-&W+0L6texTsH zh!+aJpLmJj$B5Sm&in9Xg6H~myVeUniTESLd0e;CxZ5r`&kw&9oacd81?O@47s2`d z_XEMtqw)KN;5>fQXwhOj(@6dl!3PuX=fQIYA3*Y>1m}66NO1PUOu;9To(jP)C0-}^ zY~q&-UQK+N;B$%pSa5!S@n?dwoev1k{q+mMc|ZKL;Ozew1z$n-91;9>;yvg&H}}`i zi5Cd|Jn<6ZI9@2J0(Z8M|2@qQ^#;dzrZ+uDYce>_&m3<{4UY1&Nq(8ZQJy~!|6_xr z{3|4Xi@{Nz{d1SWQ9hTRbKPTblwVBq^Wz3r>xCaO;dsj6sOM(VvrF)u#NQA+nVxsN zOPu}LO8So)@>p*p@#6-^db`s7xu2f*V?QGQ4Lx5-5}cn;@%L=7{5hoOWFh|=-B+A0 zcrNX;hX}rac!A(4w2v7r_%Y&BiL)R2(fqkY$j>18YX#?h*sVejzh7{V;9>9)9={g6 zN@MF)!CQ$R6MP5p-t^Fu?LR<#tl;_7u2RAI^L`P*H!d5_kMg@W5Ouih?rZ{qI=K8*Nhf)^3* zj*}f6TrYpFqPO6@zVs8E=lOiWd3`AqoY#>_g7f>oRf6A0b~Xym_FO4A*L$ttT<;pe zdH=9paQ?f+2L$JR#p8nWKI+$k-%IxI7W@(7e-Zo%;vWjm?fO!1_P`aj1&A-(qAt4`^1|Cx9C1@t>8V0KPdPh;@botNBm{MFCl(Z@CM?E zxCt=gd^z!cg0CZfmf#N&zfkb!h}Q_t_rF&O{vOHSBsj<6I>9;KHVS@bif+#q!MT5b zE%-mF-aiPQME9G261+F@_XHnAoZkoIcpFXpblm*G!Mud{If6%sPY|5_P$D?{p-ga| z2l#z9u9y9=K*-OhdaoD!$HZR}{4V0}3BHYZ(%|U!{)zZmg7fznHVfXB_W4@`pGMD% zo)Mfsr~RVfuaf+q1pk=0wo?DS8*TwZw4Vu42Ch@cdlRQ&tiBHoc@A;fb~~K+nYlvG zERrt}oSz#M3eKOCDH41!=_wbS@Aqp2FQolUqu}F+FBF`g53ClP-``&+IKRK&CipjQ!xrfYs> z{a+D3D&+aTrd{w5jU&Flk$SQypE>Kv7M%6;6P(8{zoMQT=#yF0FGYqt@|AQQ7W^1p zmkQ3mlhG)673p6ncs8}aRdCkN^|PIzyF@?%tAw!yQNq(1c%d?V%M8vGPPzCdtZ-wO?Xsv%z_I6v#!zZpM;1~=oR%HU=^++^@hP>Hdy+IBSl+V#g zb)IB!)Bkk_H~q}>0qQaRxy6t-{l?=GMH~qtZ$A|Wq{#ixOtB{-i$)fvCZWWO44i##&Ea+0Y1rk$IK)VrZ+ZiB!%lYiz1rFgLQu z8r&4As~Fr8S=cg|g&HBZqNzDj);xc9DEz=m8C&1k3Yg8Il z0s;DXwxI=CU2_Dgbvq24G9S7L>aA$1nAc2My7^5N^>ZT4R&z@e{LenYBzq0b(jhg! zx;g?PQF?U%fS1b}=T&2MAn&FRU2*Zr=Pl=i2Fg5C_rP`Z;Cw z^XuxY>Xrzc%gUNtDqs***32!duBZjv9Er@e2G=*VL%3Xbrmhu4NddPu81@>m>Fu! zHq2|Ri?l?n>dLx?W}}dv0a_L{MltkvS#?vxyfT%e<4Ff&U2T1Y`X*8XG8OaqGXBH^ zaaUbi_w6$7MDQ)5bqz3Qs(iDfL49LIZ4($0aa-Vy-YAU2BpN`Mo8{1_Q2<>R1#krE z9*PQ_IrA%;s+^v1t4EtHPypx3in_Xn%BZNu>&Cficn*dfh|QLY+3>n(9=_&O4bD5$ z%2_!0Oh>U>ds%Z$MP6A`Wqw)S&;lh2=Y@lHawI0<1PVrA5>AjDj!8H{G9Qz0g5)qv z4vVT`I0j(zP?Zhmg@e^8FAtM>(13=jik1qrHV-aA$Ix7rqt3Z{DgCd`X9O*aw#rd@ z4x9%ID;ys|zIkZsk_iBi2{EhC6^TmGw$EYsy>Q=F-nmbp60&?Al$Q)e_dKf$@ID&f z-oSR!cE!rl+1B5oaJ>3U5W>Ot9r`M^u7glMUj5-+y2Mc`i1p*vO4ff6SiJgq|IGI> zq$Z}Ww;>~5{e{o#5-YJ%IIw=)!pZuRAU|IHIn<#Wv9NK-x`I$%G8Eta2VH0%mBspT zODOBd=j!q5-%a)NeHN*Ssq1UVh*y8x3%Ue9hrs%i;Ge9&9$38k`SbsL-=?+2)>R7` z@#Tg72;b^7u`YN`rRge*{{xCi0%{J=Ct+cGak3W9> z{C%K&U+Gmpe&2Gu`Ws)-CHOf3wja0bvVQ#D+j#BYNBeuePxY$*MUVQ6Ue_h~c?#B# zZ;8nIKl7-+kUsCs_q|^Af8I#mW4 zeh(%ymciG*(9Lm|vrQT+n*!zI#qS=RSmDT}`&En|G)dZjHdG$3{=b)EY4~0T@Q-;& zS^WD=$x!~!m*`S|q4(Wbhm;)&<>T3JeV|K(C+JtSAD@p%`_H2O*HZ3z+YLIsQz)19 z5BKQ*@GvbI?yB`*{inb`SwDWyBTCA>%tD;l;0Vw-)K{*r*p7Q45wHA`jk?5zT##P5 z9KYiCFLT-yeT~YS4AW9}ANU8E=w@plmER)@aQj*BYfv8kk2%`T(FL=qJo@i+_{ZgG zda!;+^-Bet?$_iannyWbm}5QbQUA_!W9#o1r~V-@eq`IRu65gVjRn;IsBH-RllC{x zy}YRwZvH9rtHGb0hexKVSpY=pc|DY8$Kf$v; z3e`&?JUjDQ-z>LZ`TEMPo4>roI{w8)$(xT&P1*eQa{n5zadpU7cpSbX`@sXY|H04U zA6_4`eGhJ0-lrW@tnHIv{pjult7OyZg_{qIwbmRy!?zjv;qHaUF%Ma$Z^IqP-h=c3 zJM+PJ>^=`3gn#eCzeDg3^I%h!|G8}q_yVr646>PB+eaR-(?LE1qwYeVHN3`Oc)W`*jC?^)ti==wf6@f;lJ~Ip$}oRTQUst53087wxCXIhh?{qd`I!jD1W>MKKR1! zIRNF_EbW)4zWF8-%fQ|#uC6unn>lLoBS>X_viW`TQ@SZRLLLg9Ay0PwobtsQVk+5AkAeKHk?l-d+}f@+<-hSjUu(@lyVrxCLHxk)Zz$h>32iD5wvRjvKJDU5 zf8o4<^~nq1v-j=H0r>%IP1k_+3YL2Z;@}{}!3R*T&nJBf&<^xRA(X}Z*;eaxltKOl z@SOpSonGo1-g6m%aZmwz`<)RRryK{^-VnrrbeO_quUw8i@Ro8k9>9q)oYY|9~Pr^^58n~^Ia2127p+?X+Xr1ClY zj%_~h&u^5^a161}TA>|>{TWG_Fn(TEc31=c$o)Mw0s1>>^H&YYoBuf{1?=wz?dT4D zo(g^L&J(K7?LO@XGp()I-`LM^-}c~PTlY222Niy+WF^iO&}WAqu=HF3ZBcVYrM0Ff z%@yxL8pklt6=-`~cPk(CsX1aLjyZ@2vO8_Uz%N1`1ZAGnTu0d2wZSNa}&XDqBiuy#J1aP{=hA&qM&??YOB(3cP&oBZ|*pby_NUG2X;8|_@V#2C^bzFcgRuj?*^u|va7b8ZcDw;kz zSXeai;?c$9qa{5>v`RmI?5UDRjXg;Y>>1{IQ^*p9O!EDSCCd3J72Z_=C@eJuVhPT3 z1y5tr6I>A~xZ-pL(}U1(KT^cx1~;$DH;7yW4FsJfDmkw~bl(M#iu0~!A#mAq#k(l+tF0=4?DEb0Ve8ag`v#tm^<3K8bv6MNH?p*o^_E zN4mx;;{MA=?nB2v-Q0pCMYSvrd9n*xc4v2NXtUdJNjxd;Xy$c3HkzwwEPHrT+`-n9 z(q`STE?hEb@@|eXDuUzlh=3$aX1F%5X0o$uz%Q-BZN(I-@)()?B#e)rAU~{KSRY94C3@F~POL z3?^p~_|rLh@UPsE7L^~_q`W5}^Y72Ao$0OTeo z!j#fNI9Dn*=hIE|1u?4j#37ah^>(^~yd-T7xGf};lh|OX(^mKsN(`0NmTK=4!?)!7 z#PxMd2i(>){dC0~bH&`4%Csk@&FQp?a$HM3w2xG#Z##W$Sj^R~nCt79_QbTQ4Hr5@ z1k7Mea^r?kiOJiD3kUeZZ5;BdqJqgrcRh`a99rZq3@Vsh8pg<>jUFSD{4Scxy2e(T zjDsgY&?!{W-qq|N95a##OH5;u#ly5{%KjcRC66w!s$!A_t2xn>tx(pBeN*pjir|3~ zJ9ZtJh;0kYWhS>%6tXeB&$a06cZfXdLX}Bm&Q$WDQ!$z0LKRGA6NK^`i9Q;qbcEqN zKy?DYBuIBU!w{EnEtOOaLmcAf2aS_SZhO!;nfxLwEr&vGm#Sd0(1i+lf?DK4bC}%a zLRC!eaiIz(pLd~ZCR<$Sawff1=v*d4uJtRJiH zT(gGtYEUY3l-)OIm3l2m@IXnLVlNJvkO%)xz&XV zcM*BOg({fDALr45$@n=Y?irvxlU>{a46Vqa-h=`plbJ3whsi-MRKaAn3so`6-4J9k zIo##CoXL?cRKaA(h2}EJ!!5{Ch4ZfFm^GZDcpQWwnMhdQt6kL0{Rm7t{RuR)LyG^p%%naGg+)igUL< zS_IPp$}UA*9d=*JIQJg7FJ+Q@3e3$DD0P9W^b98Xh6A|%-R1Bqy3!O4{lm1-_vkXb z2!bU49>KiA+DP_MJ%K~JT&uM?{528lR`Rj4GQHgu)8;(~i{TYLi0RCyvTq9JIdBFsVBcrD&c)i^9$+~kN~2mOhYAS=!?Mt34Hai3?Rk3U0FvvfxZtN)eNu;PObpZB|!^ z1a2oEtBdJOwRUwC1(rFBRn@PZ4^5GtqDAzNqI5G)088?ZQ zX7x$w;MggtXPljqW?ck7o%`afi5(IX&rAFPybWMy3Ol7sd$`f=4aE70iGVrn#l#Nq z@=Yi3>=eb?2`@w_WX^zw^9rP6)vOptH!RdGA#127_kl}y?1W@^oeI;k74uFk> zlxGlkB6GtkN|g<{&&<;TXC+WTh_fxo7#`8?0m9COEV`nR5);n{vRf9IHr*fUeCwDq zl^~Qn3bN|%2;Ui=>|kD4ut!%br^7{O%t*X6@e&Zz6PP>W=f8SkDkORXzeM_ALPYu| zh@1{-&_VlMx5|RlNM^2EWdYx&F`b3zuUlf|nW)16ueb^r=m8TuC}@zYiG!M)V-`pn z7KLTG1(K#6>=sA{vlC^jf;ZB9ojv>Kk`WzLb_nK#)`C*Yyz=rym-bk+p->_!+%Rcm zsBJMG9{-DzEm*C6lHAs85t`?RT zSkqYxT$8N=Qth=9w7_~;Zu<8_YIJeu$@*&-@V`lj^VzUX|LGMGpg7& ztXQ1=sqoF|`F30QDwLQ7F}?>Z`CgPPj_*NB zou7RHRE%$rl?o4K&gbN3TR4`8V=ySn)IUHTzn;3C1;ZUUw2Uuc1-(FmHCzUy+$5{e zi%GU_lL4$zUy8Nc3$(ZP%0M|t^rc(-WMDaF+QE8W25!bcM@xOmSOz*-Z^@YZFy;)a zMFzHGptIE~12Ug8tuKWCa#R(ZZ>@hCa7glDY5EDiU%9pIdr+BPmT6CC4}U0IIIAID zDppY14Jg4uCg(O6#EjEW72#mP)h7_Gt9|%tnw0?;0fFZ+zT+!!^}mHAIO}DpMymC^ z%nlx77S@YO4U}fR6cEmLKyno@sO?t4kG8f=H3e!t z1!_G7>M*Iws_{LLs>lXUfqE1n&c;l;d=8g2>cEXaJNNt%T!LHkkjuXtnehc1>HNDf zOD%}mdcj|v3FBsvc!hrt=II3=L{UBdn<~TqoA{o-8&e;{V2=(U1|5LC(1$0?gd_$q zF%*d2z#js?53)>R;$k5Bmchk!J+7jV|7n@WwHWNdTWkPI(anHL;+IVP8VJneDez?; zcnGZ|{s@HVx1pVzg~+rDZTNjU0)*tE-}Z1ui9Kpy*Mf+PWX$JA3`+Pm3@h?o1KiVm zS7Wxm)u755vIQ%3^q5Sm$d{TOsnwcD^=004Pr$r^^Z6#(P%4~O@6o9Qg4cmB{oL5wo90St4DC|foU*B<`O!gx% zTG|}E$lwB`JSomB2zSKs->E?gM@a|eEAf{bId1|U;oO3pSU@!ltVbpqht_+;zSmcfeUqHSz9vngeUXMT24SKv53?B~; zg%1E9oHFSeh{~q=Mj%D?jmts%w96sKH0&0_!I~S0C2F@08-UiYFh=z|*{K8Hs7@`%0Z)KR zyERr?B|vqWJCKPw%^hB+xx?!;+q_P5S6^7wsh)Btrc>n4u?efmd#5&qjuGboi*yql zx37$l3cD}5`bSvUTl6sItcOwhV3y?np%otfft2UPkF+p-HuC5AZd5Cgi54z8Jf3_D z*CV;e)9=8 z>Wi|TrG@9QI5`162Mt?aY2qG*oIKl2Qxd#Y>!-*nSGCR&AUonJR<48Nzn1sb`il2S zV|K-$H{&%!fL4ct4Emhcg^ZUa2V2KiHQA6Qnl*Wy@$UoF&Eg z^T#8%aGmYu%hN0MZHjp_liEzhbo%ke!1F|Bu#Pu zAZZF1Wyuugv~mq}{Ak!IO(rL)HK4bH+bWLSRgsMaAgfAlB@Dx@guVf_D3XD}^l2XUiaZGk9_dx%^&>crVsDDYjAFMF8t5Q9!#el4z8)5 zRS)OI&UB9_0bw&y*vxQYGb4q~WMMOBEv&AoDB%MXL5X2`=Ug$oOe~z=P(5dUWknEA zL!CTk{J7$R=_Q4eN~TPmGF}hEdy{%_{8)G`GXf|XHz6Dw7oG})l#DJY)_DM$4rt-@ z={h>KaP+i`y!^+HEi4&V7_Jjx)4|Ufkz17GCf6czbMs_9dV#x3qDTe0eM5Y*1 zm>W&dn8K)H#uN_CiK6J(i;6BDpF4CYocYN1*NOmTn-r^TF(QTzi;R$&>A;P$qlscs9DZu5n*}_($i+j9 z&J}erII$HJh2uKmKb-Ij$I&u3g~2>Pl{YTZBg$)4xgbWKDTFdg=&WVe;^okP;SAfd z`bL3S)WgBRmGdh~YG;>JF2a+Lb%B+5VkpUib8<-(ptBavh7(Cg7Zr`Zv}F3k%f^=! zUs^c6q(o1PXX}O?^orFOc33fLXXF`iB&s}&Rux7+bXSA*Q)=A`BAtyhueDT=QFzht z9Atq9=3+MB3uz~|I-jJA{;b7(W-!NUaxo>tMk27JehROa2;f>c1F8y6d#-?Ep{r+C zLthCqJRG@Q2FK|(&Z`r%7B^O+l5-lXMCBswoM+FRCFNQ*qD_?|X}Q;yH$qjZ zql(@5n8*8S3H2_Chux}NplRTt&};;^7}R)T;PNo%h&a$VdV~^I0=Y(Jgo!W$iz|;T zh9hrft;)t6)+9kW3}a_nI7`+1!p6FVaDFzl?^*d!g8k$eEFo?jHIrin|+((e&W9+aBI>XDYvJJ-Viqu{?OspyO^2O zwb12BxGm|YsduE`o*@Q7R0T4D!)-@Vn$)#4j4$P9saw*wX57)~cFZ#ffBe8sGti22*Tf9_>+$EcJT7Eo2QO@>A55YKmzC9* zSHbE8&YNDi=p0NrQx5L`f|j&`f-mIG&8os8Lr+u$^i)N_At%7 zniGG4<4p0}cdp0>1@plNF@F0uR-n-le*2l_`A)!ZH(}73d0 zKXFolDk|hZ+;1NO1+aa^A0Zpw=|da(J*M7%yA_xcCp!aHIN89Oh_-&rNi1-jz?D#< z&Avw`gW-hz#8O$9N9^bgboASA_#SnVq49Ps zbW%T8*2%Z;Ri?QP6RZYyzy0OXz)1Ug6bGct>V)tOw~X!pHUEko*yXn$Tnb$n#s3Lv zh{Pwec)%w~uu~y;3!F|Mf6KCbzx`LRWlG>Yr_(eS-;DTYk@)q9e-(*egZQ_R_{pV! zuLk{5eteOWe1Q`W&FGt@`8Jdi{8g&+LF@7Q9vJv;5Cs-|d+91)?}#S33tCqi3|41B zzdsl29fk;JEDRD^;HN^a?Z1YSU)UW-UC4rH?xCmj-N?~@qZ;<7Q zTjihPUuEC71RC0(1$fD3OPmiV_VAe!mycO_AW)Y`JS7an zK#|0G_2ETNmUx;65H&&K+LkHdTO}?pVQE%L2p1gT?n;Tb3kM;jUWw8+ZHc2y^22X! zQJgIz^F=mWo;Dwuz?P@LN5doYRdQnG8);|7A8BWWN7`B8k@i%0WIIuKWW6WAL?2E1 zS26HUK~OaQJ7VDYmPa)HfidKdiGjC+s){BD-zANP<61Eqo*x5$KZcwqV(>4HQ7(Kg zGg`iI#%xr4cMSeg;7`}un_PQ?E{7$qwJQjt%Z0ymtv&M_E+Ztr*N@~{A9!DsxYur* z0Yi6d41F3QE?T*+je!Sa;5;Io3;A~e9(GI*H}K)aa5mrrnHl`T7&zanAb&rNze(dq zTe0JN73A;BAo$yfM%;b&2(Wz`-iv7T-qLVg&o5%&T|h26l#lmf>?ROy+NY3k(>`^Y zoFEGUpWm`V`FeRDkHLRH!*x5n69aD{+|;v`a8u79v@3L|Po5&>mER{v9M14`9k&Nl zevmj!`4b37Iqq+RfL*QOdOdE{aJ?RPX}DgG&&R-9H9V7O^y0`4s83G~=Xy8G)tmUu zay4pl`fGAFYd9U(FJt#=xL#hpe)aNxqVenY4^mzcdJ=BxIgW5FuWq-QG4MJK*ZZkn zUqgroJ-xnk`Fk`uI{v3eR^!*(!`&LLw}*Wi zuFHQ*!*%)JYIq;5TzqI5maB(`XKMW}N5e;Ixcdwy#IM!xpvKRqGN63DUiNDI`nd73 zhU@ZMHC!(*PhBWqFE1a~VYb8Jwo=Y)hfRc|99{or4cGPGqv1OLI~uN!pI>OW&fhss z>4W*|{DU-H=P%Z9oxe)Mb^eVSuJhlm;W|G)R*ufpr$xhql0#jNYPepHyc9+`Iu5U) zNr$*Tp7W6ei0k7?2IXbeBd-U{dK^joD93#w0k8tXI{>b)a(O+#co*WEK|Zd(bbcO} z7-#+(;>UdX=>vp#yfXD)MEs`yTQxbl9XKCTPB4a?ahjY#M59-%;rh5&N;uo$5(-xs z_%I4rk+-#o#!f}&1m1y+JV&IR)!23dabf%okV&I819-90cV&K1^@yF!Nj7zFlcj zL^(QsMGXA+G4O#jp_+0UW8nA3z-gEf_)SHsBB>{J3yG6SB+hLZ`4PWJqC!wJk^EG2 z8N)R5|D5>yl8-o6T{DgQLo^)a|DD1k3_JnSp&O+ zJ~$WyZ#D2kBF&-g(DSI0;Q@v(vXNuO^FJV1Cd<{=C@0x&6#B@c$t>wJ~r$=#}$bMEq+Eer~rn z8Tdxx-)7)95zhUahZ5rd!m*KZA+U$T4M!1s`x76X5j@J|i=al-#@;7<{bzrX1A ze~!W#2L3w=_b~83P#AyT)aCq+rv}dVZvm3W`35Q6J_ep)-~|-s zbS#Ja??8he-=RS_%)lEdJlepyemNhO&-2A420!0_&NA?&6y|(bPATC_4E}W#UTff7 zFF!Hx+bDdefwLWU893YFVFSkl9nd{(;QvkGR}7r(@RotI9lkK|2Ppgv`MAE-_az*< zzh?U!papEIhVxn!_2m6J=I8RlF;3DUj{KLZARg4@;<)}~JHRPPE{^;UsG!KzaO5wd z`|uxXIP!O+`D3((BR|`xK*N#0i1-UN9QoO9B^pk*J`gJeJia9zmJ9K06%m5M`3slNjk3I-%{A7_QH4_l`F}>|A+9i2xt9Al0NtiTXc*UtDqQb;8lcQV&GR3 zzQDk5BYcg4?;`vj1K&^hvj+YS;cpu_uWLUw@F3Moinfo0{f>W!%QEn-#6Q8n_Yq!Y z;BOGV)WBN^zn*Zc7i{OhCHwC%@IMj$n1O#x_!kEL9pNVoygjuCbvlwaKlUYj2<@A( zKHQ(LH1L_kztzAS2;XktJpMdr;5^PeVcE zT;5HDw~Mh)*wNr`rS=rmaO|hYNltGK*T>1h8jk$SNzM=rM}D4P&ew3{$LFQdjnQ!A zznJQKvW6r7Fv6#4IP(7&;WITH`S%iDs^Q4b_MfZa$Um3tTdU#7&-HSZh9m!N6ke|3 z$X`zRUZ>&6KbrPiuh($ouOxn!$K%^Mw2`yb;OF*muZE-iM&kdahNFCLCy#14j@vEp zhwgxZr&7OuTf=Zo=0Y_{)UfVc?$-zSqD5WY5V2;XSn@I7kjb{RO&)2|wM8uj157&woUtp?8H_dTl71`0u4ug9uJpkIP#Yg|4I!2u7$dB5g_hNC`*_;(blH*Rk{zreY;(y@ICF%h^l4M+V~ zQ2Xhs;mEpxHtBn4IP!D*&(Uzye>drWp@H+dOC4+J)z@0m|5A+~^Bqk1ECcUM`ZO5$ z`Sjz)QUl*d_&UPb{!2+u{@so3^CHQA(vZ^u3kOb}s_E%}8R2gl^4}-pclf6u_X5FU>= zE#SDm1`*!Nz(a(OF>rqVV3vXNe&tdFf1KoOH1Gq2?=82I~y&o=O5gkNRgakM^JPdJay=h6JW%fP1*{)&OmA^ezuUrTrb%}Xr5 zneaY@V|j^`?RAL3-<8JyQ5ufpa914c!Hv~$gn0chRl|{gHt|o_aD;gMP@>_;|0MC3 zYdAu@eyBI_Ye~=L8jf;0(+|I^G#usJMEo~sIP#Yg|4kZ>{JgICIpJ)#5X7O|Z{T$b z7KaQu50m{R4^E4d!JJRp>JRh=rwtv3C zKcD!gXt-|w9~n5?zgojF-{(lqJPp_FzgWYOzZX3puuQ{s`(LNw$X`SJ*K0WP-%57- zsfHu}HsXg@tEFQ*Y$5*p2<${Y>5S~rGDQCEWmr^)n;4FvrVmWURU!loQ^CsJg`FXup zXYjXDc#(k%lG9}1afGimaK1lnHgJ}+-N0GSZUbjIdkuUf<-5Iy{4K)2AfNGfD16MoTPV!?9L&#hI+MPPvz(xTvm9QRF+V>~5YqT@swt*? zCm47Y;e`fXL--5>=XOwM;DyA``wFNJ=DUILCWC(|*?+BpzeD&&18=1D2JcU>`~c0% zyAA$bl{w`!6zVBpwJC$p=A!i(gd7aDr1%yv9`1!ekLIa;cVfI|E$v({*o=UbsZ@YoB9d~OuEm38vy#~(hV4sH5(oga~ zZ{QP1p930BOA^WdmVq}*6!ud!oTf4v(`w?>{<=^)2f})JLmIA^i^mD%*Y&?mRbN?C zmW4-FWknp3V;rj!e%en~Mdhr8b4to)&8n}wLP!a2mfmqeQJ}CBgp4D9vdU}c&4Xi# z++^;-PD)ReXFVKaSJ@y)12|pCW!J<-J^08iqIslH+h&l51)Yk`JW$9uq6yBp!ZX42 za)ceerKygG1Dz@-?S!IJvGHL=C2#;!Svj2ORW-L{c3E|e$eLfYRmT z_1=M5dLiH(tuV>8czTmM1gBhNL3?T}n+5*jdFc19$Qpr{;dnV0FT?OMRPdg~e*Lfd!(qIjAtOxGzD+84rx8iRk;^+D zD8y(Oaq*B#g%fe%K`{uzr%KQB2PZSr_k#!%L*7L*REkU*&vE?5q68G|o?kTtGLM#j z9i`*>h>}I*l?92T<==dnO3{SE!D0S5RhjwYdpptcFD0Qozo86tW?mP?$Uit!@fT78 z%pY&X%=~d*Fk1fG>G!^7CC0s)`9B#W|GH9@B!I%fVg4x6%pacvjh6oe`khTiq5yJc z{vXE3e^HrA!0TVkAAhnk^S>4v1?Hct*xl;{`h9DUizotl(Xro)(ks-veoN_J!;Ce@ z=@{w;>CG}>TxvOSP{%?sxRq?`UkaEh6Cm-sOuP!QhuX0UMe=Ti#L?2P8mLlCr2F|; z>2HO^QT4B;6g`xW`r|sq)c*~@qUHZm2qMsdeROB?{vINu=D$v*+NaqM*F9$b?*fK0 z%>nhLu`2zY=Kh6(U7a6_k-lbzBFOQ z_<{?3mRBN6JRDI!sKr_y%YY6c0M`uQY_Yo!*k_l#iGSutNhKRxxNhLPvrKXkqJI`R z+NVlmev{G;|0ZQz6h{1XB|HqOf0fejedM&A`p9WO|2}EF{?X9{?SrI=P@enTGO3v% zi3=LxyS0ktwQ4cms<*BJ&m9sVyb^J?j3kJ4spVLO7-=n4OtK+5aqX@FEN~OXfb%V} zvlN&QSy#CS~O4uoluzaS7b@F4epIkcv&wN~azpY^Pgsz-eat=rCoMV&9p#~uI{q!-Rzk)p z50-mT+9UEzIn{e;g9dom*>cD?3# z`Uz0tDCaH&!Sz+1#JMjcG>~vp&k-6w%K41K<29Tf(~!tS4M+Z7pcgt`%b|R|bycWn zSI>Cj$9rRRTwa#5M8PhOdxYrLE6>Gq3BNf8zSY3{5&upDKZkIF)LCsxyy zo>cCt#o%^lFmnq`7Z7cyDJ&lMizt5>mQR1fs6uTR$*m%}QzZ9@*tle~f5!U*B#Jg_ z)ybt1ysvJyA0rd&`^duM0Y`_JFnn$=437ljROz`rGQXMr@)+qSPy&yej`(a<@^xXcieMQs%80miu;&o^8{tP0c;0rV0 zRn;z(=)8)u#S*TS@M751!QhnyFDAdbp#nZORZ;>`AhUM%Z1r_5+!&JJRkiSYto)Es zqxPX3UY1`~SzimE-g1AT<@GYkQu^U%aPWujM);x?BHnNQ6oibC=l|6n5|7x}*auOo z#IDWmH_(3L#B#Wv_8!vzl8?s3*q-_x+Qs@RPUQFcB0v5YvBRZ(s0NJbHWcbZu&luL z0AHYiLEeod2Bk+489VaU{D?GXtqLULkopLjbD)=8LJIZ$!CdhFM zSDfMQe2GWy`HYab92CP6sI|R2<+yQ!CBJ_6t)kSqT>37D!f`?ff1*j@a=HlHy-_%x zYZ?9ok;11)9E@zZu@aBmA@oc|t2Cj00y)?ji zpN%o}aqk6|V6J01i0jtidwX+_j$0bya$+Y*ypPBDMTD~si0i#T-|Is;+lgP_>yrx? z!UvMi^1r0;x#Xk%x_v4Q{*x50GjKdF7TuM~lY4Qfk4^Y;!cF^ZF!*mG{+}55vxGNm zINlSnyPF6u*9*k|E5bQnzB71C!`(F`U@sVQeo1oPH1Jmlf6u`2xe9bglqcH>%IEf% zNb#&^7Yg(Fw2a?KI6fzXj&U{a2yvc)52Ek|29D3^per))A5i$m2Cl{(Auc!YdvFCqy|~@7etaGs%V+%5d%W}HIyUU_ zyC_?|QJzWVg{8ZG)OTdnmap+tqhbhuvX!Oq@>CacI@`X)j}P>Lj__<>mMV~1n7hjp zTD$yfJH!9xCk3&;d$W{VTVf+s_H?RejxmC=O(4ee2=j%QFnn%r4Br66snT=1WPUUK zbr4}<$h#Xi6v1)(#n+&*oZMfyA4~u&TK+QuM`y}5!(*fHV7eB{pYy@|qwNvD3pnO) z)9*dGcuBKQX>-8F7n7`?&2)NXUFnM2r_-Og3(o&4`!Sds( z&CDO=nKA(qPvHfe`b}2Rcr|(FMZu8ocf|OWk-!KFEN3+RGfDsLR57SOu8BA3wNhR)>e16Z{D56~c7iiyBs{s@`*4+jion)!T5`G0C;$U*jTtrjhP3oXen zhIrj^I`$VsB-1+IFmphlNR#&&N^kBH52y4YT`168eukd_BAWfOY5Zclp#5;2$?3UW zJ^+}h6F_1S<^PlsX#}zOJ@ran6wJ zp{M(tTkg=@A-O?xr@u#Ds0{)k&;g%w>jPG^5}Jx2kWmVI;PRIex+x zn=(acasNPQ#DJvG2xyZ#GrOh^nUEa7yrQo-{$*n5I6jAWV#(9n zl}^9e@%1Ivj-yk3J5aBle%Rmd9XkG{?c4bk?C-;S{5zkw#GZJNH_QsWwAL3`f6&+A zWAUokbe$!N57`}ezH4{biSpO>4IK|y9oDafe7ZyVzqY&YTrox*ej50ojx!W*C&|0& zHLd`I6Q{)IC)UPKN^Eyi$=(jHmF)GUhxX?9?8Fa4eb+ztZRzVDg!-(%M|4>K z+ohqK9)$37OOv*|u{3c@#hBjfUtgNA<+n@Yx7-79_jXC%vZpX<%Yy}pTkh$cu*F{# z+Pg~l){lcUYeSjq#{f^j@~3LSlmOh=@Z^`VLyk$(&`1OI6W7hj2P0m?KXZKz1o8Iq= zZt43&z1LqO+O6LYd949`?*{+sP|x+Nz@Gql=lDgs57P92&6*saFEMqD*tGK4$zp#- z9N5MI+lWVwPJPO48(%?t<+g$C0^7rv&@SLTgFQb1+xLh1+i`j3aIE`}tfnITJt)Bu zo0@$I>w7|bSx0q(b&d7>F0_~TfJe2LasAh2jqkr9H}uF?&@PiZicMK7C$FEna?1L; zl~dQJeOLPW1}iOb!!qCW!*}#K}-bzdu z#2*Yj6S1Y9K6_{E5M31S3%cVR?zx)_lOJcEFzKk!TjyH#}pyqg$tc~3E7 z0>n*(xO|A4Yb7UE^@X?r5SIn%mj$L*FH4<%`LfQ_Yt9lQ=H>!64C2p&`18dGY@>Sn zJh|HU>WL-(9pC&w9RK=~0QATB9Vb>>n_xWH7=Yi}urGcMwr}YrHendYl`m}@`loN_ z_SM~wp*=C~kgfU`oKv)?bztatEA`!PAP)O)tL(oSvj6UIxc_FzK8gGRD`S1@Kye)A z1lfPLQD0n1eG&7({wV8@`r>Bji$|d^wn7|^3#vb6>^ur`JiXKyf$3>X+zjiUjoVk3 z9P1C|!M{;f;Nv@eqWI|4iO_#1fGtADPb|4W+6nBl3CAma40#vYAIjr#P`X zE8)fdR^p2RD}E=enI3|9Ee~a49`LuBX)FVW&HUbN@8!2MbM0#%cUk$`ivmrQ|O+LFM565mqXTG6ZiE)UtBoijHf~a zo8oVOapvQ}x`q3;`@24sJ#E-;pB}jW{v@m4j`5>s|7`ir&&vK9cxUP3&we~>Z2jW8 z#@adcWp!26<-rST>le-o7F9ODuQlaW!3*na;UV4sr0Z9FWm!XTR(*9%P4%2X!Ls=k z!N#h}U_(uHW7XndW9=1{4GH6_D}r+t*H_BeIo0!K)l>$n=S#jT%Vt%cmoU1fCOEHp zUc=(xm6gDT0%q0L*UrJzgAzuQ%z3r*DueZ9ja3c7+J%i!;#rkhv3_mmyF_@Jp2@Xj z21}Hi28ktwO$WcmGl}gM9X^vkZJVOKYb-&%i3QYQ@(mZN@X{+PmXx5IWEzv66yEnF z9wA~$VSB(+2TXFIz%)#5B{^8mqBhH!O57|^lRbl?KsJ*z3G#{TZA^OwX|r}XvrzQWDrWjUKlf0Fp0CJNPVM=Kxd^h<~p6@V|5U2a2A|%Pc zML)P8`QNV*4pNC>onADYNL^6dwam9wEC}n51i7AB3g+dUEK%a}5@9CEB-~5#nX3g6rZU-thsd|YB}^8&(8XU6$u$YBg-Nah3qIXM z)xkD_>R>XJqAby-dGaW)0yq0|CTm=%%?31_SU0*!ig?uHqk>={ph(v@GyW$jKxNgxQEmU3S|u z`r{5|?pX9YjX6 z#Z_&~sUkVMU48!R9U_l=J5hiuUk4JaEqs&#Oo0;oD89Pn!84 zzJpKK&XLx}EPDJOOaLdu|{ zN$ugqVq8!4@d`k(=F*SkfT>2EiIOrY7ip;eUMw0C;|EaL zWc)xVcV}5t864!AK?cuBPzpO}=q#<6QUS3BwkP9c^9;xao3C_SdQJLsY6%(v_1c<@5wIfSiHgMUkVu#f+n>h0hWQ zE8Xe@?CD6OgYf;Jh8ON&;n~t147IF~I)_N6X~lH&_CT@>3_r!hD@@>5r8;8N2TUAh z;sg`%n9D3_Y2?Jh7y7QomrJZ1umfI-d{^hi^$9^jErTc(XRrz~N^!>?KFkhAIcbF@wM|%7O zVSfOLHXhb&L>EXNQ=hFV4AHxFwYu~GMAAS3GzEX+5?w7zBxea3B{D$f|^Wg`6 z`8s1s$>^e@(U+D?pLp5$lHyAX$Cs1{$&2T>dQ=I%ycqK}Oql>47w}}`i<1lCG9(vX zbwpxV9udQ}cOTtH$oUENc?)ZX<%u#eOYj4LC2&S^-NMGo5)_Xoan*|kQC40q7A&k> zSgEd3IrnHUG9M(IkB`F(Ob7|G@sfj=T)YgyOCIcT&B+mSa>bk>Von~gHq4cmlIrZYsX!aA^4rF>PjdOm0?-~o#HqP}uo8Su}aBj9~fc%PM&on2p9 zDK(xytERSmZbM`y$PtOc>BaSp4W41@>TAm@8=@tLOdF~q1)w1!tkh6hGrI)qPe9`k z^D8SW8cOQQDk@Oz`fO33BkFTS{SZ;#08|5z4MRk=sK^!-Iiez0R6q=rth}bOY(6}r zaYbeQtlEak|JZA+vMb{~5W2R`Lqk3uRyhsc3WVSf-DbQLBy|nm9CwHR_J9aNa3*5l zTJcht)HVBN-{!cV_-_f^ksv=|hZ9~C#(|T2L*r6Xkp<^T-tfU?l$Tbe3<9(l{?OqB zFJ>fl4YBN7lkP~lJyo7L%NuHPD+lst-7wuJFo(s7n{lGCtbe2=qlcmpi1C)|>Aa%a z#yM`^<3-uQW%#(xu)K5N<&uSq&cT#3XH`R+{TH+|U!Wa--png&>*vm_DyyGYJAZL) zLx~)y+-{*xj?><93R*vy)mE9T7v z`^+q_fkW75=HzB&XXVUfl^Pl=Dk^8gySlI_g_XQ}OKY!=aX8&Nz~d7-IL>6pTCLv7 z)l%IIv1tiUI=TM9NT+?iljffUbpENx0;fGNAfxGbw-fRmM@HILfs6~Bv?-2L=wwWC zoC04ez8|M${UBuBCE@Q*Uw^*6f7vQ0-hSM-3aET%nBRWFm+uI_{WOG<{q{Z;+J_+w z_@_Eup77fbFMHI9_uGH*tpd2=Q73aBFy}j6{Cl0`0_Tj$PW%+7>($PH0^rJb&h|g< zq=Mf8G>@M=#pwoge7@7!KhcQ?1t64v-VD|CSx=Hqd<$;lCIXIvK>coC? zIY=&Wf~xuSfYfJ!TB(q_!{pVVys8-8KO1<0sO{NU*dQ2vl5^%1kkMy?6C4kM!R~!N zbU%ZASgp-(|8yC&ijSckhc~-Kdl=Z>{%rZ9e*5q;xZGn08llF2 zxgxMDT6^}}cP)D~q8I-I%9Whp>wPBl$)iqu-~qocJ01E$!6bX(qZ*W-Zy#Oqr~_rc zB@X06qdfwZ_XHO4(4)9>f1E#-7dpo zqU49YcEdd;aoa$JfM=G$X*Y<(af`&Y+c3h{OC0Xu4A&%acdOQoT`2J+H_XK464&2K zRWT(J=M@Wc3-KV3KH76yP7O<3 zkc;jo@RzQgogvrVfZ@CD>FNL_WK(Ny@G+Su1!I(}0WTUp3KB%a-;Ke)CI&8-aS(@R zPsmL%pwY?AGw@A(sf>l60uBBN8a|Y0^crK}8#G)W6?etJ4`{e9U(a_K@u0`|G^nR8 zpIhv?fDh96@m>bqa03rXG_t$}8a{+*^qPpqe04o{Yq+k@TN}GP_f7>w?Q*s9%0OUGbt^;E2;N-t_wWdL&x)o zAM-s|%XhdYNB)RF;gK5NN8=9>jq-K=aT>1k7ZQ&7!alm|HW0=7_n`1b@>zezHxrI> zMi7nOZA7yij@n8D%VGR(B1}7MCmiKqxq=klrQukv6%^i0KHDKk;XN9z^Y0_vv;(&* z)}QNJ4rGvq^=F(PTs7^G1bU;3Xg`FT?FYl?INu&BC`J;_`7$0N+{{;R=iHW1RI$dd zxAOqygDcc7M58w)27arC>$BcpV&J_fUzD%&uZV$v5(B>s<|%ZhoaPw#>l&_)OI>Km zh;nqiG6w$B82HOE@RKp{+&E8vJzxIzv8m6iG57~K(dFPTc<4+yhhpITEo_tjW&T0P zuunQIolX83G4Nk$xctdisV9=D!J!--ua1HLDh7T$20ogW@}~Ts#lT;Qf!8M}g-tp4 z#K7N*fhW=u-;{%oU7<7a1u^iuH9RO&s>_KO_{B*o9_8!&_s75k$ApDqt+|&j!r5*QQ&{b%dHtI0tM=c#a=k?S*BNqFQh2k5qaFC$ z$y^T3_hRC^N8`tOXa3z9j&goP^~>MnV>xq)?@5gx<@6-}7Y)1*;rQ(~bSx*6@D>9f zNchJZj{0mO{BsS*e6tAuyM`nGe!{=gaOBS=oS!*GeUSef!js8oJ%>@avxX!809tSH z`jGi~J=)LUuOoggAM+ok_R0CMJ}(ged72#5|7+qOui>aqPg=K4)Nthg2k{qcIP%{^ z{4+Eh`8mIG4M+aBiGPlUBR_0PN>{Jp$e-(1_!SzC{39v6Qp1sdKk={8aO59F;f)%O z{0X#P+^pfqKZe5FG#vR0iT^GQM}D^B0~(I=DZ3{K$8iArHP4r?8F(or_|U*B2>-i* zR}p?D)icZAK=^P2-%fZj;oN>UQ~j12IG^=6*TA;Oc2{A>K7`o+myv@MMz1-(qAtrxI>c zKVY2al@tT-O#EjWcn`vd82InWp6A8D#~Ap-#6QKr@vM4uml^nDgwHl`{3b5CdINu! z@OurM*D((gj_p>zFMG=1f1b+wiiTr<+(G^ERSn1f$nEVf8jk!9Eu{GVlIK@beA)a=H(^(7bKG(pj313b)*JG(FmiU>*kM+`<>hUfE=lXicz|SN8rwyF> ze`nylKKYY@&m=h?8h9DuM+}_TC*K)(J@NCr!R?3FQD;zlWSrNBy$qb!VS@~u%Qb>< zv}cfPiQa_6`8y^bXgKngVjQ^7G#vTwqbS#J0 znb{hS^K2=FhZ}eeg+m5jN8t$u&c9=oYIqQ6*0ajM-=Q$eLp_l{6MS@wl;^e|mcLQM z^?j1t44m!Ntl|28$aVuyrSNVI*Y`vA8u(@k@6&L7U*dTKZ>8`74cG7M-!kw#vO|l8 z>+2$xhjv4}hWNkG_=7~FcZ_JZb1Cr)@)7T$@dpfi28G!sc-FaY|7=Q&xNc`2R}km4 z$XcrL>vp?Z!*%;?)o|Sok8604X!Kf$#(aAajb1Z^(P4RY{r76PuK$}FuIoRI#vzoW z>wiSUb^Z0WNv2;T({JJTN?YLcmpCa)u)*FFEIm z-ixx}0t~~DgbR>Ek%SA7c}T(qNca@%qAdA6)*SgkR=5BvKg*iq7NDWAJ|_z>h{;BN z9wqb!{rzaX-=(EoSi+6?fDyQT)c;fn`Z*Ki{q<=1 z&p;vIcwSVY$h_7;M6~?jJY4CxoV_80OJ+0wiWuepL?w5h`=Ve(UL`Tg-$eN@qJ)?~ zF44^V?*lAa`QJbg9M9V-6j|0DG4u~mqvm-$R{Ab6^gl-Wa}PuP@m9;!ANRpfRkQuW z8Nt$(Vx;B>b`jiPGck7~F2)V)059+8ts$}Z_0$`?0 zfJD1Kcopt>mMRpgMG_QwEE zwDha{%jDu><+)c*$9@tJOuI}#yiMtK3~7`1HcD?)vuL68#|!~neui&`^wI2>N)JBl zBSy4e5dJtl&nwqb{>0{bZw*l77u0?^0@%acsu=knh?0L#NNMJezXO|P#|)mQ3az93 zG2ekv($_VVm6Xf#t<~2ovV)#ew7L$<%aaj9vPX=_mC)&b%c2?2Tp$;cen{+xnryYj zq`;Z*(rnz?%L2h`)4Pkn-0Sf`&sHm~`$yJ-*3P0h9)8;HZ;4GX&!-Not{R>npSV6` zb$>II-jt4Kwg;Nm%5(*AwtFDBPSTU(fZlzbq(5l~bc>>sQbciUcf|v*9u&8>C;CjF zKff;heE7LJ(4zD>2W2!Vx&~$JCOR2-4=TDP73kk9x(Vqg2~QWr52LK?4N`|>Okb$- z+LZ)+gB9K^^-**a((Q@P5XJXm`a)H<`}~kTsOV1;fp4m!VQeXG9i`|dDOb_KZ%!7& zbB!5+Cb9vhxnI%nibiqkHlovjzEROl38ENm40)RfGA#u zX-bveub>Vkif)m5D!LiU-#UtLNM9#)Q@WmmX;vsY1a;V2tLT<^l%?o>pj$blX+21K zLmO%Ry`tfKD6qStL!i&4z!ywYZKL&mrDwAZJlhlY(TrNDuu#BS`JOwL9@+{_PcA`qz`iFvnyx5l@q=gR*_;hmdcrq7Olt z_OYyOT3K#X^dXR2O7YDkr`qn<&1ZBoFhrrfP+afOr{Kz}%Tj%f~;6)kxAZ}C>`M?Xm&lH!!_Z1``gs}~e z5&`o4hgX7LEpEJD;k^SYuTbFdO2~5-Ec2U*2fu%Svi4C}kPbl#hsbXtAHVx^bgCu4 zuM@}!9j}6KWrUz!;AfW%{Pqu~I||?TfMIuYX(w?U%D4yfXgo_Chj}9d+w0M(qj%`v z>~C=cZxg71Uiw|r1`GstcM*@xtJSUT){5ac6{d3pJa*@53;Ik7~2 zH|NBX@b3e?Yr}UwK)!(Q7kz0v@Qon#4U+gkM*7!~=cxG5f>Nv_C$s>5Un^dDWZCQ2 zeYfoO?a&^d65@EgPdpTVa$C_T5&!Xaush}t@&<$~F|-A~4TIk=c^C9kIM~1^j>GaM zqeax6i!!`#`vl+{MoP!{mY){Ii}-|u;M$^5R>IuTAeZI52Qoi^Zv$!Rc49h^pAp}f zo<2aRG(Aq7Jgqc=ks`fXTwT=Nil2*p4({EGKN_`4hLfP(^%sgRg|;0ZRI~sZ+sj8Q zR669lj%47N(Z5vThrT-r?b15jgzZ=O4u_;~9~R)lx-cU?q~u|rm`LeIgWj1z@oM)& z-4DaJQ;XApuewReYl3=+C))ZJW%~{{%l=~@E|q@V;XBa}gpNE9WofZhzuN~i>Z`Zg zqfqDAR-0}Za}4C}DLX49+fHdGwdysfVS8SINVlc9ECms%d(8p z1o)m7$U-?_g8^9HQ`Py1HiUBnICyE4*I^7+e&tZdG93Yvb{7x+len#v;||;SKqBTcV&9$krunt0QlaQtk-?;^Zm+B;aDlig>S^k zes&AU#kQ~l#(T5{rad}!EZBJr*bV2S{qmb+t=(a*5NfV}(ifQ9{Ew5xAA)_&ISSh} z&Ivdl;2afi#V7DQh4Vublp}tj8v9Fn^q&j2ImLna3>a%d3!0%U-DwVM2AyC(E8`ZC z@iEN*#X*>d6R^$6Z{DeP+w99&kKc-Vm%h6t=WQqh&o?|roqPuSbli@w;2Tv(r~0A( zy>EMQKOO_$?85JS-8ojg%HQ@{0dpqWL%>+pY?mC9Wy9|PqQ1~3TH9g$_P_j2m=n04 zpIqUCzS?nT%QHIBP*=TQg*B!R>U2SZZ%uZEU1Zp#=F zxxTGLoL5FlQb^rej@^54~&)f?Q?k8>w`U>cnNiU18w&vZ1oKM z?@L#C2LgMQxX?Q&KEArpTlhNq?SH{|iE;PXRxu*9YP@XZ)s zFjicCq5UxHr6rtw>vyCm*qS+qr+#2BAIUD`((((41JRotE#QGBFOFKynv=%;N%IWl6j;Yn6C;DN;*-ydGi;g6=;qTnF!#|6jzKOIG zW6q|5M<+p-n|sjL#73p=;rL}1=4ABICWe7elen=HZ6`6l^u%e6BjlDn@)xU%uFy^%<`fs`W+x?3@AG)5HUgSTWS&Z@v&y7o;z}cS@#n+{GiGQ8D zsA^L2b>6OjrGDPQx60TmV?S-U27aguZSercR*`QO;+syiKhAg_%K#_-B!zi_JX?x! zR(zne+kb&i7Tf8ET@S1aVjc0Rf)l^|Bj84gdBo33o6^rpUMce>w8PycfnSz;lLvJb z+KgXuW?;LlVZ4sGJk0Y;r~}&+ZBrpSH}yg)vfmB8b6&^x%Zq1_XEgsk{7mqBly7Yu z*Eh5_1=}k|+)|SFo0KxQq;8)Y{y^WXO!{lH5o;cXzJ_6oXOjNcUK*FV1vYs?>M606 z_y#kU&6n6abtA_aiM?l=zM4K!0b;l97O$OzS4l-xBLd=?1lYy!uPep*Zn`} z6MqXGiGRKLgJpgEJy7wn9_H@B+&}QKLURx{-zRgRgtu!Dw$oeW?RpOSIc$8D(|zX6 z;f1}%S52|Lsvr48&*H0&f$u@^|2k6YLY_UTeKh;Gj}gP1=tWsGCxi@AUe+JPUd1PK zu9rRklrob4B+6BQ59b0>7W;!0HI;}*(?JY+Mq(lOZpqVr|09dr?|&HoAHx3!@&5t* z@528-#Q!hi{}=FoAO7#f|NHTO5B_HsQ{O${*O^G4=z^~n8O2tDw#;6S$y(omoL%^h zPsAw4P=8~)5@)4>>jIq=QjP)LkX`I}AgD}`}V;xvhA&cGI5PI?Ct zsZ29@34fWlbcOii+tLdMF)mm673Y1de_*fkSa*^4>eKK!=TOf<%mHQob~)-k3u)I| zyZ`tC=*zR8;{R8RyaNyW>979`^T0oNb#48}uTIzRM|uG1*D#kKpBTRqzx%rqzwuj( z-}tSSwG-jB0`rx2j9KSF>%m0oJ6rtJL%sOT+p;O?`g`zyCFbQ%_+=y2`qh8YPQm1fzM(WpQ-O$WaZihZUi2i&Vemgbj&)M{3jw9or&`xF9=~HOW zrO*fP72>1&F?OJ3->j~Bhp{1hlfpn9sJdBPJew3?HKlDHQD{~^7NwJ_}ysn zOQ~s9ljQfJrA}erroW+F!8yencNL;P=FSVV`=g9Y(jPk^`xMB24QQfY*1{)jPh~P# z|J>932G$d>HdH$s>*q55zO3s(Vh7b2J0%wR*rXu75Fh6G{kQl}_b-ta^->?9lXzrV->2Xkm>*-a@sojn3+9+oKCBCl4I{N_ zu)ZQ~`a$%k+t8nK=aeQ!f*&Rgx&L3&p*L zXPiE?R>p#0Ek(*peDHE|s*SM*5MRieXg%Tw;eQp@jnAsh+dT}_@g(@CD$V@azl>P%^<)v+tPt~sf+J5ob7j5A zgm-$e*Aw)eGq-vNzS81-*TkB(?GRl0S|4*0-Md{ra`Z$>-tMT5r@k zOTUrWPI#S7Rvz&mSl0I==>Nx<2mK^D9X1opZG}b#{pl^(f{Y!11A7=uPOq){F%6YWdyGzMLSeqMuq&RzvuhdyO~ zUWoDLCyq1gzihpTwJjO{_dp*U|EHi0!{h${U&kB#K0V^9BKU)G@LehR z@?tYr!kWkaEzna*I@2ucv|HPzPLlf%VJ-Hx?Y$~}=|_mc&mzwNZ1fC#gRHw? zeXTaI)5&%XCfnX`=bn`u(L@@c+{Hi=q3H-<>+? zT7T*SSzk;eCcRL#r@0LHDy)Y;kGW~fl$Uum&YZRuBOmW^ zs1j@6nPyo#DXw<;gnn`R{Wf1e=%tcV7o7V;Z^4qQ8@34jDwHWh8S<2ND?=IH&%&7s zXoEh(&*S4$wEB3L*mYiF= zq`2bV!!pN0?BK%>4)2B!ggp(w2cCg16u*Xdmg`=|y!!bC1ssHGGz5#W=9erN)f2-^B@7UjyqPqf=%bJs79TE0m_B+|nUx&Zo z_$_;8Ls|ViyN~}A`(Eth7=v>9c$xI+tUjKRd-PrDhuM8RfxY!`KTnU+&xJ>JKlgAy zm~j1kDR>CI+2HX`eO=awvitf4`17&!^hOp=tC zWGeb9*5hrTP9QeP+CxI0rvI09G_eJV-z1g!68i<_J!T(iBs)25Vvu02JhWEh`($7z z(ocsIWm^VtE>8OC9;|I~?MU{H24S1E*vpo=uMgiN|ds^Z&{4}Fd27@To^m5uD*549+Z(hVfjYt zXOwODR_SNSzPCSKfU&g@{VmH^J>&Kh{tk2LnUH7ZK+nC>->!%3moVN+Z2Shs+c(h< zFPgE|$GYFlEi%^bhF&v}=~I~3h!0;2*uI@2t^7V;hxpNX@L+ygUfya|lE zqPJq%m)2cCPhqD%Dg*5L_y4q=`6sNfue8K1^s-F!mY>5p|STGp+k?t38PCE<%T8N85rz0i~YFQJ|i&tRTl<~2g|CnM5yV1u zzPPkH1D`5qq~tt{cjROKgVX!q8)V%I{`&;Zhu6tkubt~-y#QmyiPV%UCv{@2qXTt% z0B1@{GQs-h9<bbWY=Rsv>NVdD}(LVppP5)WfXd4gTD%v5n+Uo;LnO&gYE0PG{N&d%Cnoxeu?? z1#1k6zF*+X!CMCZk!5R?1n$;#2VEg;+fIxa-{knMvOOrcuCftW!+z5 znYT7BM_ptcdYRn=kUbOp21H#Y`pTPEc?YIvGR^n~+<{-9U++$qzq;%CKmT(VYX@Tm z>|x<&lhe+>nV9yF>}kjvq_mG&6MAcS;Tg~oS$W>btWRAceu~9|ubg{al=7<<{9n4R zGtwC}>ZDUX2@ajWkzpSSdp+2{!urg9SvQ>uxxbO{4(v{pzxt^KUxv(bPFLn=!TAlD zJA5K>`T2v1%Z<#k*3I?C?6X^89O`A(YhQ!k|0VPS|8Cks+FR-@@@M-9*&7tvqwNni z$eLt%uqH{{5MQu1?Y&wIJLf*HtUaRMx<96Ck0D;+JwDop?6qZJFP*Xm`>WxFZ$P)y z^Une2tv`<-(_zRYGKh^zD(j)y^x-3de)tY{8J17ZTjiVyhc4ke&D!%wI(Z8AA-v1L zoA3mcL(Wne{iBWpkVWb&c?Kip$vr#Xo0VVA)5_k7q^~0#zBP$>bR1%k6#7mv`cMh_ zQYq%nWjOEZ=6`c#&kJLM%mc*-NGvFR;Hl)5LucThaRy1o2*jpX)7{H>b1LSC!8)$g zL*l6(vxf2eL(VT2^bI_7|Kc;Hau!zOPx$;ZGS7q0@5A}ZbMX1a@Y}_FEQZf7 zhR>IKndeDt&U=|l7Q^Suz04;i4(>^UANb3DndX{VC#PS+n7brdX?&{0)6atj`i;!X7j?p4Ob712 z1BZF#{%@`GzWZ79;Y*0om%z8ldeY+SyWlHkz*kI%ub63UsvrJsQF7+_k0xh6^fdgN z#LwcJMNa}tTczK?+6#17oSgQZfxX^=$3a`xl)B&(WuE#Y#MMD;H08*-|J&;uOa^hI zl##V(p0)WB>`!$67S=9%Ag8f|*M=A3Aj+}Bpc$+)1%9^^Ydx~wp7N(X^d;mKd4e_F z!oEw`i_KZr&032b-9D>^WSo?B3fXhOnuXbONTh@LkgQ$GnuhS{#~6W^9LyZryz2m& z{{?L(&*1+?w3{<{FG}_yve&*YaUXPVFsC--ub%xjYjnCkCvmiyZ^7P|irvEAu@`0S zy((F3VjSAL+)Io@dzX8OacJ)nYvtnx2E--)#WbC&g1nUiI&Elx3UGR6%ve~=hY^hrCo^!o5ZqhF+7 zW822`KTqC_GxXwvdV0+M5&cg$c+El^NbJiq*mLm?ik!i&!JK)Ctl46%e=KLP-!Sth zw+AJDP4=o}4khQaYi4@)w!`m)&u2e}wv+QfJ!nfe=MK(8iOqXB<0Lxi`}hap^Md^+ zxA$AvCwox?6J!r-@8V!jY6|+7>`6^N@{8B}zPGVQ@Wx+xeTX%Teud`0q7Qw``1hIU z-*WzWhOuSFd}7BZezE%onRAci_m-k>#PNHkAO2@h`oj9Y=i#>wkcJ%Szga7dkn|=>pXx7YlpEiC6`vqU(zYV1&A zrqshLk9X=hgwAg+TO_f{?yn~n?LMOCFTR;rgu$hveSG>7{Lrzx__!u9Z}+JNhQxY zFmPi&cF?;Jp*!au=`nj-8w8oj8ZJpUI%nJKH}n_*aR(-r0!*a;_UZ zCcTN+_QL;$QiFuifmOkiAE-5yYL_+h?RdGaYL`(-(RRyOKC}UgCXY$?e|u zq2%OR#GqKW@b<5SK6|0h6`OX|r;3Xos)YO=^!XU-kLMMYs3-JP@fh$zyAt)3d1xi- zBlQwm=6q$M^lJl&68ta5{}ld@!~Y`uFU0?XuMO-)x>wR9{wKZ$T`YRz_TcO)K6KIg zl|NeAmn!ro4xmnQPPg}i-lF5n%uhR+b*_HtKP{MNUBVeGP30Ph(~12?~Rw2_MO8y+#e=V=jZyVJHEG|YkF65?n9rwGX2N?86R`>O7xRp zOq6zz*s?M?cl>vz~tbB+mZajB(%>uM95~TM#;82SQt9sRmwn zG$6jI1Ru)#66O=+U;XOv!Up(%Y5$ibt`D`p&}cw>EqXQ2v-B#otN#t>olu^7t4RiW zdkJMkZ=2u?MQ@X#FR=sB-FuAAmoB;<{aAFB?I3xjFG=}# z*02Ar^h@2&fNrmcEb<=851`-uzZ#x;4t! z?fWB~!^J%AZTO+SKf+wR&|7fgi{631{Yv7%xz`eX=aMt9##?dZTovBadC*(*i>tg7 zlgE3l#?nVmG z1>Ii67So}tL7biV%Ga0a89smeCdAxgA2NrPww1V7Qpqc4x6J$#@BBT5n4|=_KIo$w zx>)AB^L%eXpTf)ZC6!zFNtvfKj_E}lBfeK`@E3Uh;fLr;)64&S`k`dyLpNO_rWj^s^ zz@h_z8?de>F_g65lqpjR3dWE35=9kW!lb38r3D2gCBUS-gh`uy`FAD0ox9S<*oJS8 zR(psGkh=RgbNQ5snW~0{cYA%>%&M$Qmv701rq!C3TRPv>iU?HTZ|Iyi*di$J(6s@Xd9zZkBosqzk7{>xjxR}CBC zdm|aVGa~f}`h{CxmO9}~#KI*%@wUH=J}5l+9fP}Z&zNz^PyFpKW9;ae9lR^G*OABndl~ke%=ee-3tBT+o=@?k$w|xpDlwoHF!VpNAMrtEK3ee8|Urvp269pWdAKM zi)^=g2mbO_@4ND@kgQ3|-W|^($-0N|k@;`&IP-4Q`IFE~h1X^FON1X~t-#vQ>(E;- z+V~{eI{XfdhkcRoJ20Y${+|c$>vgHkhUY+?pd~T?Ow_Mt4c=2hJdShdSkoxpBJ-Ut zd6(J?=1GFX+PZm%LGsD{VexT4{DqYr=jrEgcK92RZ6sSiWA<6(Ja{u?ZGy~=@HZdEJ5vQ_O|$~%8H4wH%)5lO!=Lcr z*Aagv5qBmLcP0^cCKLGY6`b0n4L)Hm9@t!5{#tsLd8)+xr%e?etqH+P} zolisV!C!SZ4?gwOz0iB9#Gms1RZ8b4sa>DO+GAC1C+0l=r`mx#-&j=(-W9`p3!(do zeQ$4^gt^;f)TsjcpMtYu1y=thX!E)F#z^*gCutAveU)M!w;OBVGMBC`Of|`TTISMg zF~`8~+qbSj*;=d>%Q{sWGCzlNxFx8I%*#0Ek~Jh*x8nVP+*iB%!?>@I`4ebWVBWN( zuwXm%b!hwr)2#}^2uH= z{ON*D#0+v4N$84RA@jWh&}9kMv_1Vt9@8^ljkLP z-VVIXO=Le0HdGO;>6-JZmOsuLpk0G~o{{YAX?(*B{tb4v8g0^wwrN2dHN)1L@O_8E z;GI^j=K$)7m?YSDMBl|+=t%0(mB%Hq;4H&TxmknR9Kfd`XywW8mFOT(=%T$+00C&zo2Fb6#r_{V@pdkN;*c)u!} zZ&%{V1#gNyLf8GEhx5b-rY3iPJ@DhQUN_~)Fydv`@fy23-)em zZ-g!-j_X5T`2p&l!kkR@^147r`b7$JcK9Z@HUVEPV}DBH{uJuC2{zV=m|E(;8}YTA znUMWru^E{|i2i5Hm{DF{QQ?iBG~F9-QqSZ2=&w(fchvALlUuz5L7ikBD>(llr7lM6N_zRrNNbX?3Vr^jIS=8xe1`R(&gqB^Nqf#hACj{{vZtfx{$Ue=or!+sESd0^J~IIQ zWb63b&@uGAsOlg6?LPK;0q;s(;T`B6-*8^WPx=NqFNA};$Iyq&e&-<8Q=qf`(=zZE z3GcvLnE$TDK4;tYe}+9ynKMf48Tj@L;;@fm-}D=aN^>3pF&S(y(23|fY=d{3IhLHK z3BD`D`IWIn*qh9+sC%jZHzC`xD;Cp_i-t+U`S=hc3!wk~z|;4jEm?$2nSHfzW@ zb1~u?a~tupY92A-K|u7T~! zz7pnWW}p4{kjj3x%wcB%Hu*5F$b7=U^E1s7ZwS0-DbC;ko(}&w4SA*zMjl!7HTZO< zS!gN}?ll7Ct~))3HVrM@Yg4@kovA2)N8X|Ru} zXsh7NjL`-9|6$BaB)_aZNEzy>U3??(XVAX*j+U`!KFi?THe#Or`#iIEzW=}CjB1cq zY*4<16Zkvk_s|D=6YzVO-&I|<;{4t4d7>*>vye3+iJ8u58Oq)RxuiT(+7Z){{Kitm zXR@a^oGi&-D=_c%2WtgF7au6QtbFq2(`Hu9z8dZ6{qnPahcyKsu~z~ySQ2q@LGZoA z^7N%j*qqF(<=x#*#2cwneESG<*ml%IzS$&v*-sINnR84_Q8&Dwc&YbS!^dPUbPMil zu-g4E$w1;~#q=PQ~}|o-}O3^mjS?^agbF7IY+i{w~w! z`K`jK#wU7claD5+p8tMgs_FBxUy#}z^pnFe_=!%WU3brx@7-0^UWNWp(~j@>LEfj0 zUW0F?>|W-*D)Z^g?7+r$f6RMT=F=I(!9qjIN(>@CdZfCEFX8uoa`un*Vw^#JrLVKU z%lCek=sL(r#Ly|U1LnI&`0XjNBYAK9A@DP2#%>M11tj()vY7E{0{T1J-p4$DDg5aa ztoJ0Jk=RDgj|K7TMLdVS*U6fqlxf#*4DQiAxeV59h2Cy_W3U6fOdN`}!d~e0%Zc=^ zKgD{-Aij~7Z4*9xlf?8~#}K+bSm%3>l-K!v_xeje&KfcmXQObMMCTN_5qbp|^6VNrU!#3H>IZ%&q^|F{!-WebpJ@biIvoIzWM z<$oIGPG0FvOnoldBI^dP!)Ho5d}Vt36R?LG#8g7R8gsG+g%1Nh`T1l^sxVcWn(I## z8x+1W);GZRCBM9{CjCI*St8HpedG`Lq%K3bpLr9fd@lVb(ATBxIfkskWUx+y`X8Bs zGnd7hIZ7S- zOr4f`6D7{I_1ol6l=;%&mDoFmpEYYK&{=VHa3;L^4SYuzeL?2pfgTerDa<{e!@bBw ze^G@s?{<{)P#5VNBHy5_DWR;y=rx62pWtOphvyW-<>6mjF<0IH3HXWjW#y(Hc78EE zWMVCU$@h_eKmH%^|2pvT{Kg4z6^x}v`nHq!AL)y-_t%?9FRDp-H;Q~Uz;$`vH?$6y zYW(1gP%ZEe0$+kWD*@L6kG0AD--le^`Vl(HYiD_v0m^0~ys>m(dw~#|S!;vf|fdU&^#mD2~6|_(=J7O7P9V>^NR{ zO52NUuWI|R_53a3zr@C+edYZxd1sXG;am_~N@LxmKRAyx0Q#~fBx8Q|d!E$>f4|Mw zgK{gpsSAFJcXifYy#i}_Uh7XmdoF16T_mAh0@}P6+OkF?v`g?lDDgr&{7zFXXrBk| z-B+*N;^X;Gle22qUg6z)7&N)JBQdblNxq3A=a#B4A6WtTF!IaXM06#6V` zFQI(~>&lY;e_n`NE3%J;YYGuj}9^NLlos<+fsmrU{{_S+_Wg0;?uit>AV z1oye}mX&y3if87WKHiZl-5J2uh}GpgG4GZ30M3+^wQPKcSjGWUKkUmDrz$5sfV1d- z2cAMp@~#D+cI7GX8H^PxW~Tob0nvBY;``KJK^@OyjdF|EbMKa`|7rTQ1>TLD5&zA_ zdSgjCICn4W=W{WazC!qeXGu+}uloLjSWl4eHq-vJ$Y-}%F!`(C^!DDOP~5c-lf7zSR>#{Cd<<-O=(@Dlmuo#;K_ z(*>LBm3N-;zXAUT5yuRo&s3q$WH4S1CTAO1*4M)QWfpWR?QjNkYTHXDHQ@hR?4RC^ z-vPMRn>b1O%WglhS^7*rY)Irz?Rj8&!&1DP=1*K8I${42dzAU6(0dxTJ6GvRpFM;1 zRQ3nF_%z8!-BZTqgLjl_&>z}CKPCM^`UdE%1S~QL{{i%iD$q^sd2o7aN_mUC<4ykO zVP_&&FY17`aMMmH(+4pAqg-}>kv?9E{_+sMu_AMW+2eNJV0;SN_au1IudsYSaFlZ? zbXkKwR5D5*D#h3(eJG`UNaW>ulzcbW^z*E~%|0({(JMjs4$$4Lee(kP=2rC0hp+z5 z^ydq`8;$*fZrFa0gYF#|pT3>kd86M0Yz=zC+ z-K5~3QZlbcdo@5-`mQ5c^ZFEQAr1c|>zy+17MU=gUnFwL`%m)TlknYy_nyRW%KJ@M z3vKu@87I3?Ue^6n@M97e$a*Gakb2@f$8La$6DCY3C`e&Ly9is|CWXTd=4l0eui^Ya_Vw80~^R z@&%%o^Ao%iB^BNx(GTtMtI*FX=x0lDnbA+X>c^aegMLI$qMtI=kI@s_-i(iEf3(59 zkjMDuY&{he7cW38bfCE0#fOLqO{^^TG19jw5wF(1cCD<*;yX|}7l2w0PMkPVl~rz) z6@LFk_KoD-G5HRY>>tS<$+ zIrf0V?M1G4J)N@qa%4r}3Zn%+Gsy zKCFKLbN*nj=Fj&U37*87o%|JeulbGL0qm}$5t3Pq{DBa``T(PZc-O92WF&~i3-cFn zoO92A}1s7o_84up32F{yBAzWf~Rvb^6o{Kk>Eg1M&6xu83_*N zWaQlimyzHrIT?9((Pbn!l#`KnZ@Y{H(MslTY)xG02oapAsDKdfs$E8c%Pk74a=Cw_ zSyYWJ(nQcv>Byxqx`9(BSP{W$EgJ~UyE%$QMuKZBYP~`>8H3P{N^GI)EaPT^j!J9= zvc9NMwGw2_vMSkTdBv_IW%4~Mo}&^e-YR9tA_;GPY%fE*gZu z=;Z34T+ds%ItW@xAXl@Mi@w13ItXUV)f~HRoNcubbaJhyTvU?pttXf*SBsU4NbhSmaD^RqLm;GMHJuK&Aa_BBc&xrL?ZgoCZjb^wWYF}pi{#-5@wtD-a3NWYFKU6 zz&1fff)q-mU;QrBaOX&BxN`(G+(~K4(a-x$%)G#&T&v%yX_;4k?pLZSznj?mtdeY} zrS@|RgeAy*s#I(;TANTPxDA3Aw2&w>$`p_m}5$EU=syN|2YF5hy z?JQ_rMzcA}kuAZRF4v+EhSKbCD1~eimhUlra!Av$jAYeX2Al~lwx|w*X^WzGiWoiM zp?Ub84VxafL(jTn3clb_mZAdTTFzH|jTXu6g7Xx+Z^Wl$cWT6^aXB|=#$3*H4NvG( zXp-Pji|QcgjH8jm2}Or-Vyn*l-KVJxhM~W(T4GwF_0FMGG(2%ohQ*vO*H>bH&BZ?mY5D51iH zMW`?t!I9)PNBT(x`yDDSx6_)jz?=BTySsTepjhaVpsVkCf|bfH=}q*ksPnB1jawCT zk~Zc`+DM_Vo7Apz$1X`y|N%s~ZvEXvljUr|z0L7Rk?$W|pc*mJ(ZB4s9dQUeu& ztMpmm|9F?hj$mg_M&7ZSph)o9oQ%ACL9xiFkWIpM=7U4FNE1QUJs7I|Go}@{M$^C#@UC64$Vl*XPDZ`4 z$!NASPjh6&LF9orh+v1yMX=YRA~j7R>TMAl2ay3$L`#;n0%6V0QGAc4xlsYJq#48QlHl?Y35KhZ%Pw4n7z+-I zl}&m?cEnPc81j=Ki;N{k`E|k}%gx6TyqveDt9-KTuiYG-0AGe~e?^p0ei)th|U{QAA z`W1_6d|N@*5y}ahU5r70o>F0@vMb0MWN%-v2HCY?Uyyv%F+~xavam_m@LKf=l?dfg zL8tW*P-hh+HyKCO-gjENj~p}~Q!0ln;WmQLDoXZB2*2pEk-uw#HhpN5aK)$u$|p)A ze4mqfzk-Jx%92zdOqtK;D**pRu*ag-9aXT}5{@)@E#b|vRGJ9(SX2i=GLZh&)Xh7` zu0xC1WVCvuH3z&2K~fRg(WhPNlmJU(yuRet0EneS$#VD3=<=3ikxQxCBrJcJE#$X( z6&S5ZMxUeKQgJUhltMNMQ>oV{8BNg}@~K4jhI}d;@~K36Zi+pivWS@zF1Mx^sY{aK zJ}~-W0pXM-6S)C1s8YP%d506x<}ZfNB|G}wtVsfS zz$o$wM|NJ?GP|8L1mS(kRl+L5^n5V%9)0|TrZJYK+BNIrng$!O_Ri`f(h51w?6ABe zZAEk1Q-i1hTe%VE%H=O;o&a{&a6jUcIt9=c1bZxM{Y7SrUn!O#HFySsG-@>RHYK=9 zg$9ZRnT91Ml~&CljZC=9;vU&Xc)#MHBDVKMi`q=kQ$fT$>J+ZGwQZ!Fy%x2(UqL5& zWQ19#d`UQWQbislnEOhOR;pE#>+3W zAhN;3WnxXfS%@AnMjXQ;>?cy6i)?pm9nl7wPiMghbmG^W@|b#u1^V|=Mu%2>ho&*~ zM?0Xr?^b_@lqI`T(tEJ1oBigHHiSX4ahQf(MVL~d_h|W5`Lq;GDon%F=p!i?IuNCz z2aFN;yrASA6+5tGv~DqUO%KIGjPOuTYH807qmfRF-q{slvr`9oi=h8rj3Wc=d|4xl zaCCOniyWPQGu1mAYKl0XaqwM~;eb(|HKY=*ux8LPN5Od()ku)TObo*%Ggl-sOv^74 zX_7R&N(Imt2+pynbp&fHisLWK=NaxyeZrzKIvHtII4%TxEGkk7q(T9*W;z*5rHSA{ zMFpz~ynD=LRLCY_FGUH-E;k66r{(r(n){SkvV~O;qy)JItP~1_g?U)Q*WiQL@gdesdwT1ahHVSaaWmCu|;mWq@lTKSCvU&20L`GSpPNA_s zMp>P*HV~w##0iOZs@#t9dQvWr-{fH`!kJ`-l*7A`CW%?PB}91)Qi<9m+%9}DQ-Lgh zS*<8>5Ak39qo)TUf~<8wh<6#skzj>t^4)T58i`|5cRoiO;$(A-fA*Se&=(1khlt)h z0>|c&>KMI^qB`=Ni)tZAj_`d1$pf3P1X;ltu9>{*6~GxTf@A=HM34-Si=g8b>3mp; zHsvK=h42o`zm1glIg~;+2^(~yKB1iO;2CCi9hD1mPUOhhKzklx`$pxEK8m5_Fcs!LF)?IwcN7S%y^q#Yy7 zOKWLYByu>>5?-ZcY-e*60PRPx-sNIJreTX?jaU@gVpgW%BE)kHMiGJ>oFGe$+G~Tg z+t`(CRSpPN2(nL(LA}{bt%3_(=m(#RBu*yZm?9=5nN?aHu7iH zf@pzv8JjV-L#eYx>~R3H4Gffbu5ZTf_l~wb5kP7|zvrE!9og^8RNkGM=C&TO8Cxr= zMiKer3kfbBksz^@6i${Ph0c}0@=+jcEcJ>fl^A}D2FS{d!M<1&MF_U(NEuj8l(>9e zqX32nf*f3ZZ__HJN!mcMAk(lOh#$d5sB_=zWG<%BRP1SeDmunH(xmQWX(h-;juAQM zQ&~+aZTc)mW9L)3lT=zQmDrw~jqZDQ5o8-l``;D0Ex%lO?$=bpKf*m0_sCYdOJ@|D zTl0)!vlg&PxH-v<3oW@_i`Y3z7)DLQBd^>7mX89Xv7?#gmL~QIEsde?sDc9y6_y~z z@$*$$dYh(l66u)2r!D2SGOZ@7J%(HX)czDE?R3=6Jy$mRSf^Tf=T|7wJJFFnuhil!%V^fD?<&}d zJ;{w>yr{8Nvcp-UMMZ|Q`Lft|P1!DE7Fq`)35oq6O1y*1*oun-7I|*jfzH z-;Ohl1TW?c&%EQ&8VvmeEA@C!Fpl#Gc&9t`L-1%$#<-$2*lITsTyAM^BD-S_HFm2t#5?)QP-m0P_pKwQ9 zRm`)5?5`TRHX;MdU9HKA}&Z*Hk86gfCb!vBMR{R+vl^oN1}V z4*6IVGiid3O6-uY+%j$YH9=An z+N-;H=V-?c`L+Bi{@|bpz(dtrx(NvnY)wb&} zbh~hYWJlU#@QRLbGeJjqV?N>7(Nmq3*sjP9S+#A*CmcI^nr8{O5_E*u=M#>MMU>u1 zj*w9RX07>zV~1sPti*Q`JZV+2j)Z9-F;<$=O3(!fwxt}E$d<~dVhzbr=~PxW30o+s zoYETQMnJ@#w)Jfc*EhF-<)gr8?AR4^OB2gpDN!5YE++!D@1)9WgyJlf@MO{j({fAw%*kK#mei>+|q5^B<9c^(`v!s169nDTSlK(bbQcby# z=08NZL|=l2COD|xY;3_ztJV(AYZ-?5@b3W;Z>F}eo{C1a~0p1PdIW&C&LCycs0Q?tG*5SgkuL^%PrwM z2|B{-^9jcezS5TPT?E(IQF0RpOb*;J&KImvf&)q=cR(kW<`84pCBZ{VIF}%?FX~f? zJP2P@9F~=a6f77~Dq?5qQz1gQ*J@+)Q3ajwk;_VJlrK9GUML?>luN>9x=kOkZYHWx z+zXmQap5{iHr9lD*vM9{QdioFG`^@HTO&p*P$qhuF%)4n%**s)p<}&aPv)dl;FV_* z-CILB&D&^Oegg z%dL_9cArIUBIt~`@wh&H(&lP>7qM`MmhN;^R5qK070;|&;}_YcS?{w&Vh6ifc1n=d z{Iv(kAuG-%jz`WJN3QNtL2h(wCV0UTw$olmxPt|mh80XahcpbE1Xo$Yn`sJ9I1~#q z9gQ%DG@RTZ=qBoR4(lZDBtfR55niqtuoOzr5w=roM>zI)oUw%OBuFb5OCXZAWb7dM zidCOo`f&0^j=pP@;Im34cT6LeqQ>yGBuIahOOV)8%2xag;hDA~TL{*SC>613eJVr< zJ4v@F3!8-7oRU&ozxIfDQdvPu;R?uzNU`ZKk*!W^u-I1J{?HOtA4BEalrP=O7>ckx z%-|Om`dyER1vX}3on=HUh&*b@icl&9d10Ai#C=_=4oAh>(;TbkNb5MRRQfd)BO`p; z;vTIe{G#HZe2(H-an34byu%8xncyLdYCNjoF^5vBHVGSXt7dJBUxZoL#4pmWS-09E zv4_9KPA>#!+KI@zc?zy_C|gwp!Zqe|jwqNj(!JkjdD$NT+HX;9&nn2c1_eor>1e#> zTPn>2T_rm5E73uMOh+T^D$&A9WGpZHqA4ZE@jHU95-kKT+QwN=i5je0BL{+dW$Pqr zrbJGM&H3yj4S}sr!qSmQnGGg5!ek*XlQ63&`3RpshOnHfm+Q)k+)B zFr+Q2QOVjQ+;ptZ+e$chfFqCPN-*~+v94Vr=iOvS_2m+zA`hy#xlf6u8gXcaAhnoV zfLLcr8^RTeajcOMiK7zxmAUXO~R>Bs7P8%I$=d{s5p_qnkmpY};xvfuvbt76fvGrC* z8#$^uwME9mttwhZQrE?>fTv2hz4$ z!t3%0M|S20E$zhHKq_69aHR3H6Ld^@5maF%1i~om>~Nq{2sxy z%SCXFMcJPVaFvM7ez~R6#1>)~LzG02gvET~zxUy2H|Nu~tMb{jqa9?K%1he0evE8( zYOdU;#FAqSgU%=+XJoN8%ht?l*!fBg4NH&>JYpA&%`0sQ+an_M7GrBNN2r-#HlgVD zQ9(SG&U#fRn^62$bsV8qg4u-P{|Y8cV}XZYHlfv#bJTY>JsKow#xSl`UhwCN#BT68 zS`=nOaIr<%53$i}A{W7o%f)VR)S(ozNjQq&gH~I_?%H)KDzLXO?Xg**Bi~Fgn|!nV zs5M0w^6_o6(n{Y#@L`Ku9~M2vHyuc&O{u``yzPFLf!KD-qmdwM1!E!GLoQdZf~+N) zQ86|dt%2wWQH0=t77|@GcJuD6Vv&)NMvqQlf{gmyCZlnrF=NyqNFE4~2s(C6VRkXX zC<;NNz`+xOWPqrWpySn?&nq%kATO#sYXg`JU>O7*uNLxJqiRGhg4vpl?*W~Wv=Ss+ z*bPA^K`SL7yBMy>)4vW);Uo!?0d}MaI$o>uc~M5Clz+0859$=~J^Pk(g$;J?OPG&a zHAXtev=XHK$(jM-o%#%G2JH_kykAosbskWVHIt&;(RQyDAG4^)9X?91ZA1x(9nh!PMI=aNbQa@ z9f}L|FE|vJ(yCo;*jKh$)OvzDENU}Bsso*j;21QsTN~r6LxrLhEdd3>bOx0Uw-0@9E2UxG zfQq6rlt-nJRQMvu7=|tS4iq8CjvI_dyt_~3LPmmA!Ptha2204k^F|(Ucm&A-rU>-NiV& zy;zIT=){i@rs%S$O_>ZkwArb0C>P*92_UVJiG#$e_QJF2$NU+?Z+GZ+PZBdN`=O}7yvouG$ zkst{|H3Uf;RVP@J!;W`#ijARG&FQtK7IPsIUMrw2;q!BiU!H`EDfpXDuqvqGK#cG1@#&L_J*{aRbJncy zhF!as?Xc{&bZN&wq$&J~Yn%WIH&M94P}51TJ6zEKJ62j4!E3^l1UFVXLDPjPy}Jg* zxNy=7lQKv)-zlrlwy={m`NCe-AjeuItaFBih_UT@NJTqlMU3=I(yLGb>NLglilw<408~_M!&J~=D#K(1_b%wvk3gqBiq8DJS~Zf) zS*x2yg07;G>Z(`5i=DcnWNFo`Z2lM?n^|coFmS*7 znU%JS@%2<#XL(zbEcAr($#rNmwGHQMn){SkGK}FY$d0R>xdh3M1aqH;>k^L02DJ*F zGrXuG`G&bMstBL&Q~*{+aGyo3=R#K6F7T}HRq&`okrvZ%jfh`v2{#dJv#5;(+bybz z;4zEZNQpXi#u>xZwXi*phB@O_#dTT2>j;vUEL=Bt=d+8P^vqM5RHwLT!c?sU2w{d; z!z8zhNq5&TFY|V za2+JbG)#D&niv-(Vhp2iE3JAhD#|D9jJS~?jTw6`1f5;m7waAWNIjGPknJ6t2y#JE zP9zZKaYt+>ajA=Xit)(;?hck&X6!@MXr7;J)vS-(A|0&o^A1JO)3y>V5>DCnYoy3d zKaoxPm@=WZaRQS3NiD{q$b2dr@~K3IT(ogoq|}mdgRN!98U;HY%Boj^u;KD~r2=rS z1ZOHL*u&)AVwaJi>rLwp>eE9uSELitoLS$dZK_cm{SNwMKHfr5X{w6ZkQ(Ws;~18jky^JeRw)Y`cvlGv?2XbCqFELUp5E;jFW*j8*JxHBgsg*fRl z(%H0HFVaMCtD*uX_vzikE+fI}WFTRXk#{wU#g0G0_MD7bEt`y{SoR?_a=T`}peazS zyz5TQ`PFP@HQTK8&8*OVhob0XSjDIG^;V)5g48|214{I;)yana3LbQ*c?AKHw5BoQ z3bLPX*|!pO?AMe13%083%am=oWxt-aZ*wR%ScgM}*Y#ucaJt4$E96JmYBQ}RMy~VI zU7xm8+DN6|QfXr#(cw_6eZND|9O|t?+NepUVQbu}56BaK?~*$*QKz)2^xUV!-e)D) zNTH5uTjv&_5KP0u91jVDMj%0&HBj*ylx@p~mC%~-R@d$XDR7(!JYP)P6P%bE^2OXh zyZepzmwbsjsJQvo7CI+NfkB%q9OA^IT49R$1#`&)(_cj`dW?JNqcs zn`yZI`Mfsd^V&dO)O!p^n@_kYpKucib7aKWM@gAROWcu9xPye9#2qBaG)#E8s@tjk zH$&y!XfI!u-%xw+(@yK&SlmeP34N6GcKY4C>9?JH<0%EtT2vcV$uz9e7geQmY!MD= zERi>{9nvD4rXo5d=%_@lim_90)Q&Oeo>UoKk&jy;6$n?4v4AtONWnNNTu>*II~yQ& z$okR7uusV?5G5hmF=)yyP1=l~a-R}Q4;G`-lbw_Q5xr?=b|X(affMXe(^U{Q@+7izFE;5vP1ldvuFLA3&irRo)AWq=|`o`}l{ z4!DB(>^tJUb;xG1vdMi)ECWahpF)45 zvD>EkatRXqygrqlN|-7^-yk?JA`!|=)#S1umRgDttkH@oo%jO6hg1X@dzi0eHcG9@Zjasf2qi?$H$CCoSpLXBDJj$C!qava3_060u3RPCfeM zl%_H2L|U!3NF%`~ENT)vObQRJ}@@?t%p1cKWv;kJBUku!D@rZHg=njonm z3Mc3)(VSn2PSRo;)-mzyp!oC&K{CJ!3_-`MC7)O1T#mfz6u_&|1Q%OW>=1!P@zpJY z^_EKP(RaQrVn0_h$C|)8R|MM?Jz+Ev$ziwQPbsGT zu%_CmC~?w+x7uuxRz^WdId_a<&DkGvpW50hFq#rr$=uS!vc6JJ!mN942};9i<~}8M zn^nmCZo(O>kjU_ct+Y)m72`!$7GaGrM1@6-F=~aW=BI|-5jf+B)sfKP7`bi5+RRoXJcVagd*hTb~`%>F19P#ksa_pWpY$g9OowC7agij3A&m^`j4>0QZrKKI3YN~`|UXL z$Tq@6=SLRc(7U{GbIb?98dsgclWhIVuqAQx7qV)Q>HJ<_Q_dL4`p1ldf%;LE!UR#bb+mqG;@dDmuLMF&BK<(iS=XgZp@ z=U9%-1Suj$n0&eHSAED9xk9W)9nD-r*pFIfH$;ndn5?CI+BvTwBG*S)kC7)G#HOqU z^BOxh@{g)rS~IND6pc)^xe9j>q^-%uol4*&iS%XpylfMZ0osG0C^^Sn2ch39Ff1WlD=GrzkNM zEVwW`!C6KMg!ye%d`44*R8(D$MKux}vZ(bGhJuKogxjs6>n6=eXe$-kp8 z3s^^Rhc&n8POeP6GRrOROM`*(%QeG*%SiC7qJoUPn_~rQBv_-UAS3VG>R=70zbt8wN>aGs(9*1TKgGO`Vr zhApf>D_N;&iM$!6wm~J*ezKpD9@8-0GNm`i(seeMPuD#oJ*Hv0?6aLp7fNFj4mcD` zGmWOwlusqHU+qwa2W=gl?l|Ti*OtuI9UGqQn*Ho;&CjOHezsVfmCc*|j5TE%u5m_X zr0%o(@#D&qmYe-7Usl)ud3e^z>Yh;!reS%A-=+ZCk>CzR1vYK(T^6sR| zNRW;%$jG}FT}Fa5p&%pgF1U;oo9SrPYSj$6aVN3;tU%6-HI$3&P&Vte8**ei8s`@^ z0~AV-eLJWX2{0Xv&Tz3~b&GN(zAq$8XMxs@cw9CIxj#@^3h*)kOG`fhaQqbH zx@MZ^O(-<1%O^nWiGg?l|4H`7NIH44PyQ8-VQJ}QrDaBnDN}qQcexR?G!S%Z0hpBP zO=S(3&jg!k77J;o8|-DCH{*TK*QBC!<(HRDGb$*(W}0Zq^JW%$iKzifDt3j)CG_Ry z%5bSdma4L)3MFGTZYu-T%I&PIa@XO0w&WJzs`o+BqJV%-HB>dHFkootTn#m7h2Ene zYH^L#NTIYyja34k&8<_?wO9DpOcOlcYS`R~Zo@8?3z4w9peeb%-6JhJ` z1Bh~8S~gAY-v1yTBq|RqgYC@Es)Li+^RCk>7zHk#CMsOuPyyn4kwx@PY3f8jqJV`Z zT3cavL%>|X8?zN7YN=;N&s$XJ&72^GZz?rrelu!gh%GMBTHNAF2LgP+Ay!NdP)nqg z(?L4WfmVE}%P-8AO@@?d8bxh?vaC|{*7QC#*K4K))ofM- zENsa%$=%{|P!-;yhu{>9BMJOo8J$XAYNDwnKo@?xSR*#LmE}MbtPt#KEm82QU(~L! z|1aYNYV-ZCr34Ts?EiJ}{h=QVe6-x)4g9U(n@2wr{6ADWe1ElphXwy^O)(PhcTr#e zxdz|dd{S za*^73+Lx;J=w_vUaD)2LTx;^C;4QbJ$&rRM|SoCRAqxYj>i*^MW4g8s)rfI={ zw%n*#8o21b$^x%IP6texaI+Xgfyr@)fcP7C&?qofFz)kKf#Wg(*)Jf^xP1Xx(Z{&1 z0h4D)@DB`nMf;UV>ekDJ*6GwD^ZYrWQ#S`R1_WLln9Bu$Z)voAQcF&GCI16Rqxl5t zDOB*6*zeG(Ec?iKCGu%tlfA+#nxOVPZkJ(SGY-1KUn|h#J`u2&796)DsDiZNxK9S6 z82D4pTE~65+ACU1dRq$Q-RzNUV8Z7mPk|JlDy>yeyt5Lp7yN#^Z(td>VQuDGV6KJc zT4b){%r#}M#pYUKuBGN$X0Dfc(+u&F>jEmHQdc2L|G*R*HJf=lW+6TBaYOa;$I?Y_Co9hg7ooTLDnCq41T4k=)<~qwT4Szr&9&BCuQk_s=K5Z9eV@6$-(2UL>viV3z+A64*E(}uXs$Py>y74G zZ?22X^(J$@*<2T!>n-N`0drkqu4!{!YOXQ>WAriC<>q>uxqi@GZ#UNlb6sJsE6w!| zb6sVwA2Qe9G1m{Xp}%cze`5{pO_hFKQ2OF@k#@JadgkgY$Fis2nWJXAEYQQd6ikVX z57e$iyrO?A5~<*QKTsrM%3tE%qC(@afNd%&S1|F#z>g=2X7l0yEIJ*O@Dh6pS)}Ye zexZ1J`I~Ti7JRwy@>KXmHqQeVJ>mJR?BjgLsAEPz&+|^gHTdRDzrx*TAvz}zUg2&L z{|d=hxX;w&N|x~;jh1=9-;nXVDn2QEz|WvE)xKHyDSXfupHuBO%k#pAd_!gyGs^<7 zf6qL)zuAHkH*A30#35cKsKO5=L?++N{%|9o?Fr!DNeE@H;4WZ_J|+e5SH9-z`to{n z^AN7(HwErga+bGL8~hRsG3CEo;}w2c%anbI*-x391Spm*_RGx8d&lAC7I;+G8s93s4M_Q$aE)I$-VAZbRP5IX zuBuwEo33zhZn$xV@RGdJV>lxN0^@^Y!N=e0{kK9W_zkEXl=F(j+rt;pryb2ILZ zRvQSk5@-i7S7>boP%G^qe}!ukGe&3+&$hnIyZw7i)=twruJt!19>R^g-<&v!h#~u4 z+QQv$Nk}!a?{lATO~}aQo(K2W8r~mINNdd#SpEwCz{v96zb^^y<@&xivTok*uTJds z-tV_0zJP0UVjr$ei7z78#}TgbZ`54gd}g@-K&}60zL=+z?`OWqMC<=w#`?YMq~OF4 z{TSB?SA*4rcDW46t%=eMv{`U+@d|2jO}-x&V<7X(mIVeP7G1Vn4MZY@vIf8U8WiwE zXJsp3PX+6xsJM^@Y7iRpc1W~?*2COe4)wve-xN9xYSCG zn5_5Sy;->2mM~3RvDP%P1YZ+6C2PSw zxE6?444(g`c`nERG3C!}0q;g(UieHhtL2_eiedsk`;W<=qgVj{x1>0!0RHbuaZ7>D zpEHF6_@9!}>h*@`Pm`WeVZh?JQJ=c<69ucslhn5g9>MxaQ2fb)+bsMK1>zh6{NERd z!~y)231kBn|AJY#@8_90XU;kIT*UqC=l9Rg^MZS)KJ(1e z=9y>ao)ia+PzkW6r_1BKAmny=mj_mR1(8r$qCoB*nwvZ^QhqjdBi(o2S zg)31p(%c-r;#MRMHSXun$MDIf;sqp(KTtnCVkc2K5nA{?RpAjCq8mdBLKZlYj>KUJ zo6~#Xo1qj~iIG-f3=*S@@u8ohw=#5QNT9?-NZ6~eC29@9^`@dPUCn2)DtF~AwFCnY zz`-aw&{IaM&}^<*=&7OB8=+&?LlD-&7}Po1d9h?`;j|z{CpubNI9%;hcCV|f6zd`x zB*KpI9^?Y*gR1dI!ZY{$K-#B7i6F@p8=uVnB$#RB^g0&4G#W0Ljn5z{?QrCbF3+b8 z;9?T+!>Oe6boLn2=AfAC{637}QK&XGn7>Ofj8Nx;MH-DF;dMDafsr|v;BBSi;Dywe z24pKP!aQ!53j?&OrBOT8v$Lb8y=p7td6Lt3o@APc+({#OvPtfMOrOFA(+Gx9Ym(1s zFN_OV-AE;D72pJ^04GQbIN?$RmgTomHTn~LSWn>#gfkxTzM09L-a!E;KD83xQ4`PN zLjqm`mPpg<9!6PWA zdkB4ohY=e+^_!Rx(rG%&BP8dG99u{@L1MxQm!NP7i^`bSaMEWzW3a>3kF@iR`#}Y6 znXz&|TH1>BI>u4-delR&M?Hf1n1>#Zd+70mTQGNf1oN*RL43-Sf0_kT`v0E^Yx-JH z-}sG!>MN2i`6{ZyS&;QuJJWs3rxMB8`$6Kd1XNx9^Qchb?7KXtl;Mh@PK&(OmP ziEh)!Q4eWGKMOg`=;tBb^@|X7m8SEbAroOaDS%&b2ZQ}bo4J41p60ck2%xqy*LHGS z&Feb3LkZV+a$Ch4I?-6#tlZ4g(fM0=N;-cNkEipuGCaxMw{5peM@4pZ${ZP}rWn=8 zz+#S2jW|mYhNwb-#Jim$*a2RM;_+AGV}!Leqy`1lU~VU&wulpcb=!;nk2wYyP5s~M zge_*(i!{JH_yDX=@x`9Ncht7%Ydfw-JId08&0*eG!j(LgBY9|phiasQw;pNf#?FDg zCJ|dZ)F`^m)t1~q_a?lkhs`Gf#%q1d#uc6P`k${Ey_5w(3P??;+eRnTj}5t*zAQw$ zPkS&?8#*5u&9r)krSlCTinZx{BMWBXSOr0}hU8i@9R+OKjzogVx7bQFS&37S7;y^EDwI0XT%CNyn_RueQ4N_g#F!At&bM4# zl#-7k^$>l@|036{)F>L1Z&gUr(*kw4qpYaRk#YF&z@Dvd*XXaC1{sL5owqX0yh@Lj zR&~0$x06BDthEy@6mLKRjsPzfqNNjUb#1>uW;L&xJJCi?=UY1wqB?&(4=ok+EL%Zi zcV4uv$LzdveafIN?%f#nVY#0DRfCI|*b1T3Mpqd{ZHPtaS`@P{@+%_<8h!2y9!loq z)G~7pffVS?k`Ww@yh#CTX?ydWwzns%j8vyytRB+d_U1-1-6urhYnkpFB5%$Jo=q^x zGYgWvX28j70@O~f2gz##q>HL%X@GjEni@xqFr3I3A=>dJd9VPVL0WQT{Y!SeDtN~(NTZZ0J()|7MPC&GBZzV@_pRJR($>;J zQ&~6Pv8&_Fo+R+k&JEo!j%b(>Bzq)@9SG`ZSVB-o!-5?0P^`Mr3F#`wcJOMm2#O;i zUBg>O$)4*RakU%OmXUUgeQB=ZDCcp=QI6w~1srIX;Ev{_5ecrGJ1As2g&k{lr!Z-* z>=6#r`Yn4TawA9uYE3$7uor9kk&5!fI&&iu4}L`FuzQQpCG582xnWwIq55PA4bd~~ z-V*fS@wKXVXYe}T&6CgbwC@!r8J4DDCQz17;Z^xEA^L`;*}okHZ1#6pi6^YYOGxlS z@GcVCrwazBYNFZ~g)$dL|3bR5ecX6#1Lb;oB ze;@*Ah5D<*L_EW3UH3HSyro}!orCHg)!5r?RqgT?^nWk!aBfGW%^M@zZAW$9QQ=9i=Z&>t zXQ0)1BhOCfH-+6>-ZR5rptIK0&D>uudzXh%#m@+95|ks)Tl_g@GJ|er0#FN|nXN&g z+$(I;v#<}Xb>O-L?E-aGg^Iw(S&5Ua#OYSzd?a|pE0NGtz9TF=R30<|4XnqHFLy1{QM%SCHP4cq_Hl7%E=osSG$Uwt>^U4@;n*-)W1oKHHY3-0F_y9reKm?YFkp z%*zLYYUzE+!@QTmv|d;UA$!k*=X;E&wk_{_gzSCBRoDN+Q~wXQ5bpK};fEd} z{L~?YKWHJ05twh|3JlAMEj5UHIA}vbdSWUz><|Qq16UiE>6$za)BBT$JU@j8Y;<~5 zKeJA1QyYrV*2yKcY+54`xZ_n0sZAPU@sCyn4xPowsJ5?nGk1HV4=)u)Z~&4fEoQwf zFcXjn)a4IX3N;7`rplp63_8X!n%wSo?IgFmjZ_nC#V5qmFjfVUS2G((M3OhkMVt<> zk~alO{R}QYGZ^R+iBh|3))T|YO zzS@=Qt6V8_C^oUt@RY_tU+qivRlZaos+o=Ru8F!S=URlp;*L?(fBmd2hRp`ELxu@^*WtijJKB&a>) zD=-Z9!*MaESAzjGiUVm%7Axt4o|O z^Al$uNrsF=pc@=krxpkX>S`*K)md&O+N{J`NU$Bc1PPaT6%a}8WV@(^Yfz7oC{|C5 zh-icOy(Wi`!}&P?1nRE0aJa`xJZvSNu@bK%!RYO_5?>)P`rr7l9v9NYeDOsj8y=C% z!WuESlH0$>F&SEaobdwGE7ty7&&A`T+Fad)#%jUt@Ca;&$8PM6xHkjeurLzd{D|+l zzs`Thd1(kz6Rl>2mLU*niP`L-d8Yd`_mIt%_WF@PEj9^yvC-~{uMI9sqy^Lx+OkAx zb!XB*Vs@hRp-MS7Cy^#xdMOF}8TbtN|1$bH>_= zyi0)$rJYmD{y1V>eMVWtr=@dl!WsCS!wbf24ycuJ*liZVY9w8V2fL$P(sIfezvr$r z8BHx@aed&Cnq?IpmQ{FIw#dV>N)OAbJS?g9)Gy|Gdt+9U=-!we%hj3%OBo$W@>6V* zyEaj0gLq;^B87Nq3&l4f?JbnoBX&#rZ1#xdDQ+1&VvrZYY+dP6E{iSpb5Yl@Uruv@ zrf2UY_Yr-cBzKg*Z<5)JeWVXyBle0ZCKF8C3uBZJxPyKwZ*S7d5x2Y(` zylp$a&|@mfxo=!k!OWouMCU&d`Q$@O-+q}2EW*-MjM)!Upj(3W$DZVGvI-8rs-HFoUwX{JmmYKQmB$=>?J)-(9&@nQ zqwe2$>c8cBFqIaXyfA7iv$m*}v{a^d1?sA6!bsu!#SVcX24RVT%pCdH% zKNAX=3QH(X^(fvdRy=DTd>S*^+6SM;EVexFHWnBwUfHHv&L-?dn`$XN@727Zdw({fy1*JUOUCOiF zqdfO}l&9UJ96NZJrOs+N-NPpLY|_NTaR%unNignGsdqu{0WNIt)?AMDa*PO|v*-_*w@ zhr=}f5Rx5I1GC9j~MNUel zt8p?2mBQsRotnJVE>BB-f;`_K{SYo#hosqrkI>0fh$rR9&h(YuZxB`-!?+K{{f5er zD)s9(LWWddM_s?7WNyRhLsN|44m2cJYuq*HhosQ{OGwy-n!usqc~O-X`>7{IoC7)059n)?4FMJY|}zzD+bJ z`M2FB@?NDF&D@mxz$P31h&&M3dPsD|G07<-14{>>cx0evIKDWbb-0y?T8TMG#PKjo z&Gc0Xat9xKQ4-sfK}#lELwdYR*J|X-6s>ghq0JCoPNhrf#-K+WHG|%9WQx9WWN72h zafQGzqbNK@BVg^UwEJoda$c2mW9$4KoC`r2o9cX*{0$fVc1)Et$=iPPd$6<{fsp+D zG8>m4&`1UsXpu33x1lf5ou zUEeqo27L?q>sv`M{j~Q2Dy-m=v8wXOT*&H(~%o& znS=js6y+6LgUgT|o$k!xfoF4MTZQZh370nhngae5U%vTm2ewqRkSiUnHd*WZbW|&a zUw2zG!kCS6>c*!ygU;hqI!~wI@l2Yon2WlG4Dwucy~%mG%KRb4>Q?yg zX)-BBr^o}q2#_?2R%2-EvBLgw&jSZt>}c&4zX#*hsM}oMGFHmP`IZ@C1iJ$TF_7@U zle-PCh{Urrc`BZ*Gwb7mfu8crnvb)a1@~$KwB%NtU!SbN_Gp^4 zu*WhRVvkzs`&@$R9(C}Ou2t>wR`y?*Cx78j5|P&=+Y#)%W<5?`iyY_g=$5x4JZWAY z22(_=F#lE$icdXV5JO;B%@Az4V8qTVVq zi!w6;=>w^A4P{CKxtw{1`jk1|1Clg1FjUtZ6&S@C@?VpV2~6e;t!POVI1LYO!SLqA z_z>4x7#=Dy9Ga9ZG3-L4byXPlp-d0;S{hpYlKLog$)8N>uQ24A0~Llmt6_m2JT%vg zROk*OXoq0DP&h~vL++u_*Fq(q4-QAYc?dqlczn>46bbM)GBg=WEEl{NoQJv`xj@q_ z`1LsMO5 zsMya8Id&4*5c1Un8GLQP^#`JY2xXIX3zu+EpJxc%)}DKv<#FH0dx+u^jiDML3p4c8n7uMO2a?k)}02`P*f zJ_<|OOk;A*Dbn38M?oK|UWNom<=G!zfgC5+aEB3=fuok}Mz2YsPu^({FNMC^`tc&F+L?IXK5L*7bSgTXAAlU>Ii>Ecfar+<6K!asL>3Hro^CV5`&zk zS|7E_K?!YfhKGM=c=)$5#l3yq#0=03Ig9&ChFqr^Vi8u{^s6g}n~Ho@R%5z?=fs%a z=E3wf52m+!FulVgX?J=g@h(sO-7JZEX7@T~_E&pmE|JM63O?hS;X7r7tbDAs(a8i= zrexzhAKB3R2YE-;HWGILs?xd_JhXVhLyH$ZbA8D(*OxtWebq5n{elSBT$3@n_%bEk zQjgfm&r&k1%A#LpD;nU7+*tBb)h*mfsb2tJU7wulHeM;7`qWfuyv|ulvlUsXWV~R@@;Tcl)$NpJrn;T5 z48~RqT)HQp&7(=xqLSlT%YOTdZ~x&vpifc z^Kf;xhwF1Z^>Y>1)$h}4JZwJ7!{#GBY@N?}$<`G%TYb;`h%MF*(d9Z9Eui0qsE0Tq zw_$QGNN3Dtycwf&K+?N7Hz$tY4^G6>x?42;H+bm3!9)MkJ@h}rL;sB)`fl>npXsST z%TvGEQ-8LHf9H7W&$akBln5xU^zd(shhOJ2KV$e~?cjC9>`03ta%Zeh^zb`*W(hIF zzRWVzS2>>A50+@<(5d}k)4d)x-Roh~eI7P#^N@MFhm7}o>f1f_J3RF}J@pTG*z};M z{vkJ;p7XHjFCI4S+BcglH7dGb!GD2GFaCGfbO;MzN*b+7${|lp`-uJ&qs=Z?(K43&xs1}!K>y?)(x>F&-&}5 zcAh|$9Wos`2I=q6GqhF>nY=R#y>8=Pv=S!YAzL!|J0*CAcCUQpG^g*&$R;#t_m;dZ zn2?&Tv)hA#6xovQ*CgMc#gIAOE^mv|Mcw2b7ddWek1;~oK#ZQ`-Mrb~p8Qumj~69I zJn}06F29oI@tPzAWBqrDDP#SH9G}bI%;ol6{#HJxx%}+{UH;BcPBV`0jne54Rv4km zkizRp+ZhRKv)DP!?TmCz>$S|ewaMjrz5I7&F&OcILq78XUvy3D#s2(PR1td*wSSsi z{oPkHU6=h`Z-I=T@%$=6?PSdK8?fQFCrDdG6)>CSncyrIT`Oc(Cf_4&cO0oZF7$L< z$ds`)ns)Qx&>s&u11tzn_HS#4ly$&G7c8nI2LkK^8Q-`bo;Vj0~Mz0K@UtP8Ir&UaT}Q)oURcV!a!yDP)E5; z<1OouS~>jv&N;WI>EUVwt{%?-9#UZ{rTC_kGUZ_c?lRv}8sR=MH2%oPe%UMuh;4r)&Jmg{?w*_G{1+f5 z)9qJS@8DdAgL6JS)?>ScWP~Mcgd~Z+_?L5R@Up;P1mXcKv?N0q=`witfALcdCXSnW z4qBw8r)u(9Q(z&WU#vJ9W-1haT`_Wgt))Hf+_=;JkCni0wm7)C1#67;(7tdj%C^;5 zCA4i(FR~!fjrlc;EOh=h2QcCmQb3gNtp+z2Y{7*`&o8~=_KVZf^D7#2^OLl*B`838 zUqkF;e(tH1^3M-EAl*&k&o<^~K3)XFacSU2utaX$gPTWf!L9sKo*8B+Ha}`?3F56F z-kkG{i;&0&|iDDo*ka8<6hnx+Sf3@^K1pbW$=Y1XGp?`A5!t+yoUM6jttDNrqaSD ztL}TQI}zDKSM^y>r6abeI_e$7fAJ%?xs2Ns+(@-W&L1sucpqh+mp=0)QR%_m<#ZtL zPN%S+^m^`LS45`oWw%9oJjEaJdV}}>F&2Ee#A4??$F2S z^rj`9|B&I2aK6os>HS4I4qZz4ZFaHmFbZeTiOhfRHHr5gOEi;D0Yp>;GBU^SLLoaX z&mjS?f1(5ofww;zEvo_8O`yjY0MI?kh9JHH~a$U76(9hyrTVKySW5+xYLjalO|dojT(E zH|VI}Yv6wMK{7QtAcIV@qlxEjIQHA)VOPCx>DcUFrgqEO8EpNeP0f}}kq6zi{MrU( z0&5+wb*bamTS(G2a3g6|*Mt?!{!C-lv%iB812gCaLb7K8H`1a=q)?HOTQf-%t)F1s zmPvwWg*R@`q`&8<*S=B>>LEwR`|CVh`lg>@TR*9C$lN`!sY)eQ zFdllWm5hnbpWwme#7tT}bp1&l+)ifPvEK_E zg7G&|X`vPF600(?yRPKjb>TLv!|9oFtNbVm*pxm`J>Rl&d#uDaNU%g3txj+Kh77$Q z#*27qUjp0d+L*cmY9vJR*XT=Ws~}%>VCW6XEehWM#Ret7L-Hi}4GWk@3MNC3xI~em z8w!{V1FXbwD{(jyg;Vjt9j0f>x4O@>s;jI-BNAi-PQo`2w!unlL89Kg(^(R&IW!L-hSX(fo=i@zA@iM`Y^A;A96LQ&?#w zq$n$_!l|FLcYjCk0gfI6xrelHg_&1^eKLJuCWSj?`TzzbWAw%Ef-=E?8sY=zv_Htu z2<~=F??axRUL@&Haw~(C#*noEN@FZ_KHX!mGCT$OmNtLjZ^G{O>iYCV#gcIBod_-IOE4>e$+AF;;)m78|wrr%1afsNcW1z(PE`RB-} zxo!8%?S79jZuiV>M%wzuai9o}Ijp0E-xA;CuA zT_n6W14@H%e{cs`y|b7W8>7g*ELp2Ibk}t}?aIVN9mqqH@;o8S5on)~Ma!g=+lg6P zGbUx}{nHUyT1zHpX{TsvR{07`I*T3U)3RuRl2RMx!Q@I`k>xmH8mHHA{KX`TU5mN7 z7QMxcp3W~}6m@=Smiw+r4Wp{-k7cwp`|23J&ewYK^*n9O&Zey2_(PHrZyygrtB1~x z#PTfqn`57%7&84GzSy)UfO1$IQ}M<5Zb)E-$R2=i7LMUo;&3YwMPl?EeAtiYc-$#F zMp5|*c01Q1Ko{53$I*6x-avq#!e_@9FnLF%AFUzO%x(2y?osBAZtYVlwfR|-VDr3- zhv!{bd^8VpnI}5m)x+a%%wt{OJ&TN{&iC-t=Vj3$h`j{~0~0L}{j(OH=FAUZeBt;7%{MjwU` z>lslE#H^Y=;0>?mhOWaKEBL9{_UYkV=@^N@h zg9;sGu8g)d8v?f6ZSct529MmG?y)Urc;s%QN3J$`)WyHqPB|~MO(w7pWMMy9?Yhop>j|KXT^&UGVa$$Qva{?4ervJe% zl}vx&XtO(0AB}#T`T8nr0sAPE41(msC){49Kh0caFLHYriBTYuAriBU;1rBzPREBh zQYmoczQ8o9o)?JRA#d%UiJA!hmis^|roXxnxjXQ~bjlpJ3YmKX_#3X`Vyk=iKmk?# z5DCiOi>Xb>*&Ba-R)Y$w`}+(xQT@Vz;U))4bhDJeMVz4}J(3!@Lub+g+c`5C>JrHe zJj|IJY0#{|lbm^wGC6_gb*6LRbpDuy-IP(%U%MI+|43E<_@Rbo-4GT<9WJBnr zRh%*++xVWzeUo2lJ?gFi36qv&_)8B(-t7 zquFr}J2FjS`pW>SPcvT6A0)9jgo*}EO&|%9qKgc%l*MvjG5<+jd2usi5RD-JHs24F z(znmV@wX85`vOUm`pH(;26!B9 z#lPLsciZgWVX7g1kwg5Ephr$hNFxlifprAmw(xHrdQm%i#QE9o$o2*NGYDOO0ss2J znb#_LaW(}>w6VO1Ve6kDT$%k_uH(jrg|E*}8N8BwWcAQNn*2?{8pMSzj#uMe2fa~Q zbd8DBBHR^QhA7rB8aPw_bcL_!Y6cKLlr)^fT=J`DnG(yKKQpOinn_bv>-c3!JvY)U z3ql#ycIjyk%bxbI?3rx$;ltmu-M6cs&vqX^Jjd`f+g@NaZIzLB7k=`FEoJu#V;}ACgn)J5l@x zSC4VS)#)@9Ise!;Z7b!UOjwU$ynpL}q}BVk4yf!%*KqpPqV9pDfOb75u7I+DcRf+*|GE?KF?C_z~@;n5$eG& z0*=>a&O=F{uHObkAs%o{tOxZRm=l?Lqoa_5%i`-SfxkEef>}>diz7o(;?-w|jgkNX z=7+pd$fRetG}BD~A<-DK-qF{4yOu3!U|t}tjVgl+@xe7+^W}t|vnKSMoRFOQ z0yXsoJawu5Kd{TFrvC%Cmfp%QS)T&7OdIltWr@`=EBs2{pghqG@vGz&)a{3XwHAKK0` zH^?P(>?Q<0ma@icf1p^d{Um*kmoC_jhQV*0$zDR5%gL_2C@Cdwxbx2)jo?3I(vQd@ zM)Ds#kt&(|bU?}^67+|}xkd6b0hT6~@#MR$7I!;Z+!N5}>dEI>EzWba*b+Fjla0%> z&N%3^jyULZjyUMwWE@mt|D&_VkB%PylSvDgeAxDnnHol5B!Ta&T) z{rQ~&zf<6M3j9ui-zo4r1%9W%?-cl*0>4w>cMAMYf!`_cI|Y8H!0#0JodUm8;CBlA zPJ!Pk@c%;!%$Pi5R(`<&`IWU5^-J=XS2s1+G}Px08$NjG;9>a%wYAIZ1~oP{99v!4 zl0S0fu;HUB7auZoX!YreOSMti&|2S8-DI@ZH`gqwudd3k#Arr&`PkCZvGdDk zO*wL6dD;AuiRI-+Q+0E7byd05p{BmYXl$yks;O)N>B>=C1BmsN)kbxFOH)JR%JSOk zdZV@h@p}Xeg;}T3%6WR8%*YSGKG$>YI$FWf~jm(Ta}|!_j9^>tcH% z+`a+5SF{+5%hixZqn)xQT-nl8Ue&Z{3GkMUtqP)qvjXs)RZFT{6rt?m#pO-)OVDgd zZNs99TIQ`$Q(x0kQ&EdKRT)$(iHej>1!`ebR93duwboX&G&E6@rWQ1Jlo>4zEuaBS zv}hzokWet)#o$a$^N3L+Z6unPRvbKRxILTZhSsLaYRMEsWF;loG9sW`aEzXCM&uQ+)4u-J-m zCByvyjVtj5Gp+BO;RQ)WyrpE9jvMrm1W`4JPRPb?isiT~D;wM?Di{AN361mkI76_T7X>*>{sT{B(~J%Q?HA zhuBAb9QNA%VNmwTNP_Rf=m}6mAO29W581i(go*KbOhi@uUL*F=ZG>OHam6#{PMR`n zvR^;D&SyMbH)&kaNUuWZ+E{9jEge6SMBdxSGFIc`>sOpAW@~IO%{H=F`>H4T-$#8M z_+v}s>#nTx*ITY5m_9OL!}KA!4KrRH;~A@`8m6yyX|VCD8FKvUIC`le`$++a$6({s z#nD9@rjMR+9l?xO$9Tpv+J@;P1U5{+I<>scm=t$;jZ;NP#;GD4=atR!(+=w8Q#F3_ zSo|A4)Z4`>FE5!j56-tr!qZjLX28a| z99AxIstXr5^*|Ol7{LWj8p{?AY2yN?sBpooGI)1-g_pe?GQ$Nyl@FUzM)pCa8)Z^f*M z6DO3qxTI|I#3?AV zcE_}fqU~90Gd586mK&S8Cb@+kR;0FC%c@tFx2$ZWT{!JHM>&ccDG<`!QjKlAqqL%> zrKx67YYVpMi)$-r3ru4XnAYZsCC-*LRgTIdMOU#T9imwLn`z;}+HBa)(^r(oo)9+kkB|eGsw+P0yh5joO;U z)h#u3)i%mj0btcs+56Jw<&``kIe~`Sn#z?1PtE}9^nbVwppk3Ko4o~yLx4E4xU!+C zn&CM}*MeY3l&8J+0qos7dIieRENT*m0W*(4MdG5D0##Z$`ur1K`5%6$znGkkgfHx zWmVM_nOIqFi>RD9HTMNnemvx@Tr!J-9V8poO-&7me5fuo$;Q@2;B|TRipGX|L@x}K z8HffN6uX*kG#m9sqfMB)#+q_c7-s=~ygR`t!6o?#CB}rA#>^6y_PxX2kI+i@}5y(E=vJDxx+V&#?-qjjMoKRMtTpK^l(td1xeM z&gxFBkB2RQ_SV!RPWY z&ncxv1g{FFr@9GvR5W5d2Y7qh7Wvf3N=`6>s|9IcY>W6KIKWV&#T7NRJgLg2YRMUi z7}KP=8fY#rZ>d;RTg_ojXi&TgDG!UmOGp`!!3OAqi$k%gwz&e@>!VeO%GQ8xUONU| z0$Pj+=^YJbnN(LHWSyY9pjg_7a;q;J>6nIW-w{^!0ijnYuB>U6Logz0OoClq*VwX> z3t97>(g#{sS;FTmCmDux+Ox22Qwt*I&9JJ_9~+|EykJ7mFRYT4vW1!`6dZ-H$yjSh zUYl{AK*4faQ@jOofvKdxInlHZly5?0nY2nRZ$zb-dIQm9%$Je&NHv?BibbT%6j`ro zt*g`0OC@zx2iww&v~7=?V6p3}$OEy+W0%-%5QiRSS5wAWLtal!GkHT60JI=S*|K=Z zlGkI^(##m!2FRgv=~px2I(NL-(_CtXW5zZlri`a`d~(5{;^k?Cj~_8x8%ZJJR!jZU z1FAd?F6}?tBF4pMMQ^S^w4WAE$e{tpz^E~*Y8GP!iGxgKLtP_$viS9|#lE$56_w>u zEGWe|L5t}4$5@IIi7LrQ0~RkgkEnx9Sz4Lo@l`qD=&f_$O;v98xf@IFQJKW+SHM|j zn>rBM<#D-2Enw(t7Q=SN<1Dp_&scj52Xj55;TUA!jrPGYo(2mF&7E@!@5-gs@EWDX z0Kdz@s=DfC^1J;w&pr21uYlSkd8VSOEdWmT(z36ybkiHOUd}ON`#EcA?$o29 z0{a2-ZIt&^Ue{1nE#;C3QC9`4xVXWnhns8gd8GvwHEL(Gh&@OaZbv0`BeAVwf?5?c zB&`|bTsg}cmsK_o!_vzKvUZIcUHZAe*jYhP*lBTsaZJQ+OGDy6c2qo9?-*1qN3W`O zkM8McRTJeZYZ{lrf=CsrS&kLyxYin+&>Bbs2cxQbaYbt_BxpI!lr|JPCCR0VB_Kn= zV^Ul5QDutA%oa}-m4U>xhGA_dlG54?O_M33nUiSgm~#whD!~ojgvJS2SJ^~Q?b&Sn6AEE)P7L1CJrRa zo+*gh270tp)hl6%Z_!jcB^!=*ORDQ>eXX`mwi{YoU{VbEC7DD*15ZX~9JBS{NHSd` zy+D5?<6BgPU3^pNo~ECbb5GE(MFshImR9*pgX^8jL-Oi~NRVhPt6I!vqOzjCT#*Q^ zjLM3}iprXnmBvyufEx!x#AZb)Ps8HHOq}|1)+s}3R(&f33upOce@GV^g5ZKBtEY!Q-Tzqx`bep6+p=2%4gBuB}*9 zU2E{CRWw%m!SM%RjN?{I56eSTsSBP$uTFTXnI`11TO?B`lc!>FMHLZ2JiRr35(M*x zHuq%x_SxQ6m3rJTQLL=2t*)qV#mXdO7%Izf98N?{J?RvGTEwK0yp9C&29+sfSm`au z)ZRvbg#o;xsqv=4+V!##hC9$yaeTQ9BT+xZNl3!DIrc0hsFqEmDuP1QstVnen3p%V zHqyo)qG1U>fn#qK9h6th*_I~2kgffQC_NTQ0A36!yvGfhnUX#PTXUzec^O6V>Y6b_ zq8>?mycTM5Mq^#GQQ0cPIU15(3-~nGiY2&_ZG{7_j`S97$467hlxiX_nnre&3_7M2nkj^s9v9Y42$#Bg} zc4c&DHX0`wJajol_$peAawmYQrIrJat3uT^a%!Oda=oHcm{v{>oCNa>%-j+1B6bpT z`-(>qCg2moTN-tg$aNk;O&z4}8b+B{9VdBpX=Q73OGBM& zCh`)bn_)J}uEFe59)J*{YI!M-*&*jGF?EIg7z~w@9R~BuX{E1fpm4uDtzg|&7KOZ7 zxqw*(Y}=^2RUl78Nv3%0|^)EZ1R+MpBK+WzgCx)LPcCn6-?6>xdp%ITbFl z1r=vOElsVJEv;nGXquRb!@pB;brODp#hwotPW#Y@iyaYIZAj5vmphy3IH$wx>ejlN zJ8ASei{(|GYPh4A_Iw%|DTs#9mjB(oR@n|UGLnGa|0@X-FLLGgDCd; z4Q{K&kc(V7wV8D{QH2hNmpVGfcI4gkq6!Dn&fPtN-Zix?H8Mo%tdKOMu!xIM3JbNh zclCBxaer0hf?)6dU7hVxXFn#U6F~)!%DG)d^U6A$Q6XUJ^3ol}PUqacBOrZK98eW8 z1+iNn)zUV;YV)E2Slby@;t(BG;^3buaqcfvkrV5fJ;<+ZI`qbmwA8T)Af2?g9i*h5 zddz>H_112K&l-LDJ9aldwVJxI!@`xJU64;N>HlfJ)YDg1yX4Ea1q%J3Q(N2N;s)de z$CkQE*i&{5X^R83i(BKjFd<^FxMm4VDj&^I)L!0@R{MRv!Vie*q>jqlmIqgaL+?0SSqiD6GB8S{aOUglA8cQ!W(#x)GI3B+2 z^6FZIig3C}$MqBlu5D;+TQySjUhjz)81b!E-s8Z2ZE<1ddu2(Y>W zFHd__F`xe^plp8}X=`d~1bZ*4PE~ZQ8?kWfWP*6XPMLy(yqXOA5o$k2W)XKWu$I^< z*-K}wmKC+wpyR_rMwt?OM7lRX2SLk?`Ud)a1%FzN>3CT!haC3uI(Fp0Q@u&vH1d!ss8aY=V6dJH2^ zY#70&pNsJ6njDHRWNgb^t#Eqc@o)Y>fPR`3eFJVjY^3Y{rWT}23{?k)SA0^3o zL#h7!@a2h@B^&uDT801g;03*o`p^Zk1SgH$wc$E^ zGyeA6H5|fam4fpX(t0dSpFgYmm#IDuj7L=)p0kawhOt}KGpu>Zd49Oki`(hRr?xf> zH?9Y%Hf63havZ$9%_vs&cr!01pPW}>(qPR{u@=#`UGBUc>teS zdgXk31ko7JCi?KeA)H66dJAWgff7|Vk7%?H86Z4QQf){2(6b-vx2pOAs&~n)#*^@P zRJF@TnjXUAbydc)vJX6HoS>jyO7{0L&Oxdj;Z6_r9iz(nkxcEQ?^4xn19ikhc%NjA z%O$exY*n_(QFe_gv&KCLb=y^00gbybId7p?*DlT6ntgfa%Si61{T|gmc|Y0{Zn+_R z;IVj{kMu#RjP=~dMo_;JPe0;Cl`3l?KKkM+G0jKy*{bapq)ErLY)Z+b`P`%0jHWg$ zm)f>J@9gi9S)$)ps(yvt*KJ$U=?$28?w}9b-bx)OIu2F!*X#!!Nj?^;_HX&>gS3bQ zcY|toOI#Yc`MLc!w5NIRQSHM7-$NJTTUargaHfaKdZ;qC(a7`sRoPec?aNDzC(mEC zuO)iL=%JiH;kQAx+lsUoKZ0|E1&8o=>)BSzW)aTMt9F#8rvU$Vt1|ktaR9kv0 zJkcQD`bzYAUA3jxk$dQ6+jyo?BI@xBm0!FzXRES#ROZmHd}N2JI(kX5-~0(?nFUj= zGgP)zm04>fm7S!@J||dsNVm^cWw}(wzM0nTTT~tWwJoo1-u)-oabr3-90&ydm6}3d z)C~Uv|BD~B*VI?mwpLXyP_fH+zmIQNieJh%S1lWY4HM$CLq-f9KKS6lMMIibHa9gi zvL>#AfGowv9eS=a-F11-9Sj%IFLB?j&? z?DkbV>q@!bw0R$oU3EQfJJA_l3}_r1G@(wGOPC<;BJ90e>rjZaq94!IfvEeegQ)Mu zuUWygWOIR(%>_y}7tk9b7C>?q@Czgs$QMT}u;ie*r3#x`0EOS6$gT!d7fqURlvjfo z5coi26CY&6NX1NJs&PG2&d0uqDYM}8Fgt}CmNFe@ObR(SG~?>E|CrutzUU-xSxc}E z`cWVSg&-OZm0g1(j?hHB#hl1DjF4&O$Na?zh`hwkB4ujG{MRXMLYQjo@TZhSiusrkzC{Gg>~IT2_xe+#C>qfr zy8aL{+fRxT1|OMJcGIb#_g5!{ck80bD0%TD^m8^6UCqwnmXP^|?ren2ODIQ>D78P| zJ}5sI42Z169U>Bnns=NS6`e!oOTl)L9co9>RDn@$L1|9Nd@TsXZak66^Y>shAvtFD zZ!;*fslyGd1Hh=yeAIn;VnZ16R8UvtdxdqrD;XFULm#)4VNAB^hlA;TY=d z0^T(Het z8WmaQDrg6x@12ImM?}oMMmrEW^VIf`xeKU4X6}iQLOip)!$+t;jF29NKM9%VFK;tH zi?oT|0k@*&yMTt0$0AX%Gc`05>bO@V&A=zr4*&~8=9L&pHf0UG zCXr_URx4zrF9e(Lo*pu=Ngb|SvNe|JN^eQU4gv_g9r3aoSQm2V7lSPlUB6W%={7$4!5;@aF3WWTp7U1?- zClCOB$`;TSg1IIsd`rmucT0G*k7RC2QZw&pVJ4iN)Gqpm+RU$7+DxSBn=I71NzfXa z{Eero$-@F)j1ax6z*+olgm?^cX@&)K8-#(<|c5t zi}@88d&qQ=dW1;)TBJfs*H0szy#vE!o6i$)8V{Oq8z6QKnJ=Vuh}4-PvP0yTz}D0hL|HchEHdkp?LrXr2HQA2BaRw?oaYz;Oz4-P%R>Vv#wOL?#o$ z@#=Ay+$}`Omyc`n5sc51NlDG^rzZ3Zh-C9Qqdk}m1GQy&G$_E9%Yib~7lMe-#A%@@ z)rQOmRrOP_9Og4vSRp&NV?E0}rb_*oM&=J_d6q}qKZ@?mN~bW2P)D2u5# z3~Nyey61$}aXuw99VV_1tm&{4(RZ@QSdW!_wHUaXdEG07^*w8{NGTTGS98A%7@1Mi zMAj6M@cSex!Rc|mxgm{}b(?Upg6Ep)4Qp_wEBBksQyVJw8%CY!fLCKwB z;50GL{2v(Y(Ga{TVqEx7oSHOE^!i5R?}T#)dkM|nh~^nnMZWn2^)tW1>a^{nAvU)fzLZLY7S`^FlnTQ zxgc8C&}pJGY??}vuS8AZ+rWv+g$!nerpN{)p;Oq>T$};hv>kH;@Mm~#7oJKQK$Ep5 z#g)%zgj>RmSf1;3S(zt6qqLL1OmlAuIWFxY4{Fi|HbtkMAc7;?cp)S z)-)gbZ%^}an&w71%^x%1KCQ2pTT;vleo%e5#m89w3{1O20{SvFAO@#}%vFE^k=c|< z0)Wj7Y)ZEICKeY>GM_o0m#G!x(>fNUivc0GSah8tvWi9S6cKpPM^i4y3W$`%EFXw( z03t2ZIU<{VKJyBIh0=bSiOF41*MS6y{t+Vby~vm@#$&;qBD$PP?m-ub2pq~aB6k|R zd>EWuv!$K%enTB8pZPzT;9)TptN~0EY|0{;KSS*VNG@{MXv7Q6ZwzT1zOH3SIVTI2 zFVk$sCt&;=g$hRDG&Yc5*ZS>PE{i+WYfzIdH^CwJBd-7;DI$=<9J0-i9K?6v1#hU1 zS$t2HpLXBRK*M9;E!1Mx=7U-7SViGrfY;ffQu+>+U=&osx%)5+x|s(F0L4~|ZoGD6 zo3|kJWwG5cGR>OC#!~ntkQ7h}ICC|C5HXYR*^5T;bG*M{oX9Q`4%|w86Dv1ht{X8T zyg)dS5u|y=Cvk%Ao|6s3@Z~ZkS{*J9rI_CZ+6b#Jm-!9*Ms_?QyA(BtVS@}k@X~T*o4UexC^)BkaU$}PTw9&K?C#59MEg;u^p7acboN%ZCg%9 z$lQaHi%=uKI~;l1X{pY3Clrt{BTBRlB7*SRu?YtS%(HVkkixhj^S&G`Xfs6WS0eI* zNFuh;^kjoXkBDnAN;+rUKw+wEnL7cs2O=Hu3Rl@bPW%@oMn# zZSYZkx8s}n_<_wwkw1gkcR`JeFn-P4+w9N1A0+qw=)=8liF;=pn=l6ZM{^_1et#L) z9*=R5+%t){4sQD}Zm7*T2s+pnd03=PmrF_xEh)^h6k-{?SeT#hYuIX>53!Ay@Z~eH zXXvN_zEpzx&mh)?A@fq?z%!^i>OVjqFzyP_28{dXDWp_;{grBU7uws<&ITt4OL@1o zz6IKk$2!&%8^y8MI8PBN--)5q&<$*gnmYjjnukpjWbb(5o_ShV*uY;F zN0DfwZ}_0*(+DeC+s&cqnG-edTmq%VIB%kA*jlVEOW3lViEIJ3U)b4TD``HD_~I~h zfPZS3e_le?4t@6Kwuuo_ffJ&HQFD`=#dqjQ>t`3zUVKBI5O1)>>8Hia*EL;9j{dzE zkbG!)R#ykXcB97tb8A-z!KjD{hFN1vtO=Hcs6TIDU;!3`T{mKz)zd+-;nNTXCW?U? zXD}%;K+uCwlo2%_S`0J5R76ij#l1wuGeO0@pd!9$+Rp(fk?MA2u?Tob^+>=$s#_P+ zW&^11=}N)6xK!CFsq!6D<%~E~d8}JJH{mqY^hylh0oSn_`;v9t5cscVDOlSLo(wxx z=C>%J1rnCE%UXeuL62g@vCcY$HXCi`m({F`7j`3({!w({cuyDXBUY0T^n`O_cRRkhL4A_eOQN1*tabLMs`guCo{3BNmr;|Qm@o=H4#p#wkrc9D=wa-?VA!fbsxOFM=K*QZ z{`7)2kox<%)YM$vJqpJiJUK)212g%llG(JrJ1yQnR)H!o$OWM3hv)`p;PL{HCu^-p z`9|avi*yP-fG{}}n~#{!H-RHqvaypB*?UEIAaPo?U%+5J#1cmUf0XFZ2#|AogpSw& zfEiT-nVSk|IGhzFWXGI(eB0gLDVV2MX?f!i739q~8nKBx$)K_%AsMrW5hI$ z>;Z*2wasT|_%eh07GqMpwFFwwhAqCC4uIxzDPLOw9YXmj@C4QufF5Y@PvkgOCQ7OF zG|Ul1-AfpR#|XR7XT-C5kX1}5KuGq}N>B8f z`PSSh5^ROfg-g?Uh8TvR-Vq{ywMgegVfb#)AF=5i7%;XB4`LEv!ecaaF~T%-tWxQB zD)yQrZ$CQMVDi4rG=9i!fWc#rPrnMd&b0`T;W2f9E z3AieceWzowyf}D~3tpT@y!Zk4t>7NyDU629oz7=2;ZHH?6EJC5dPLRM zRRWct2%puJe!=u}^LX=fP%cgy+kxpS(Hm3zco8g@d2wDlQVA0RNCE5A5Jfo1D@lWp zy@Mw3lCI6eP#nofg>-@X>j;ZpI7lLzcl!pWE^0nc;9vvufChnvkl&q0HtpF({)_%Y zF08sJtlAl?$AMKlWA%6}R(DFQUfdt7u9jFmPFN9WVD%nj_2)QPUC@(gWv*=JLwYk2 z!u?SNI$zZjAMaE|DS_`ce79NO;y~<|<$_>#V6#Lff`c}Q+fPPRUIm;6m|K!5ND&od zu+HIdaHKp87(luGEQOL*u$lc^&nPtTj*1SS{mILiLpJ;6QS&A=$JzT^J=rE*gIpSC z0_5voh55YG)6ctoUxN_65J)GN;nE5=U7rvoE<{fxU^I{-EAcThh(5+%0(mE&33}(r z2}1*rKB(qP2_2#zLOmCj(-QVcejBIqupP;VW|<>Ez^RCp-Op?4yT>s8U*}`c&D0@e z{){x47lhiTLFdY&C~3ntj(76gAcJcVDBOE8Qs$Wnupz6;d6C#lXrBpW^I@~{6Gp;K zTP?<#Z(|whZeER0TmBSYKVJmA+wv0@1k4x95!Hbq1Xd*A&moI5rh5sKrvVe|`vdt9 zk4KPB$3byE?FV~-k8r&E!XQjyreb;e`4sfnwGffxkoi!rgkmrU5uTygu3#FY=w1ZY zbZnPX<%I(Tz+yeaK%q7HggP30##y=5z4uBIdT{DAG?N-QC=QwEvK# zLI9|y{2)%6hMSLY{|C^gGbCtdEeq6(Szt2-4q>Zar@$e?eqhXHm?ajH57E(%B+AwM z*8+*4)N0_LVt!7@k=pJQqe?h#_8mBKF_n7g#x#FX;sYw1%cD5=`kb+)=0nYodA3`T zcCmvRjy1pJh8J+dPq`s=ayNwM-I+s_n0C~BGz&sS=chF9ULo@no;S4gLg2u3Ak1+* z-HS90WlV|o-%1HE93fRiI{^WrytgNZm?}ERGyNVaUw{!$hh2co|JV~WUtiHq2`I-J zaR40CX`=TLbjWqk8Zi-)auAThr4RTi*lP5`kp&JqXOfts~@h6He2;bXW2UDv}ZuK->5rZaut(0`mu?yPF$jFhr{W(Y!l*V=vZ1G+8Yu z(k00Y%_!wzKsX(Z-c6LtTqnBWV$~Elcc3~jBF&(2y&-yV&JIXJHqWtSlN5n@f?gfW z7A#2D^k%33tz$^B7$}xwV!o|?NcpYnAN1xUiGy%+U|Nul$NyPD$Ky~~aE61wbVGn5 zdQtOC*ineZcfI*=o}CFgz>SzYYUzMj$o zv_4|KnlByU$1oTm_a?JJ>0}r_G{bp1X7#Yd2im)ftey(TK)>7aHAuyTy07uK+!Kh1cdJDXr*#oiV1_I{&K;{5kSCJFkb~G<` z&-H;txa(*?(Y>=j#Wq&^%=ITI0gk1s`3U5)qoN`)WS-qKJQ`~y5Pk_?iRP_v_ywmk za9t7lbyU>+vR@S6ydJFYPbB&ANQ5B!yS@p+CaleU%%1}Uq3skbQsLWSz1rZD;XWHw zIVXfG3VAG2dlv9jt`9)TjJ25lQElc&7zN*?O3$E}bpMZt5W$Ivn0K8THOW0)-A47DOWupNP3(j_~Xf>pS* zfh8+61N0{V+FntPmT`b1BZO+lfta*DfV8bIaCmA#6bZnjg<>7uvglb1wV)+os>ncc zCjon40R!9K55^n!zqVuHhLRu!UqnXs1ezz`PsOQpQ98(dJwD{gD^Aja!?(P>H_E}r0Ukbke!!+`K@SyNuGn- zN^GBrERXIX#>B&Pf(Lk$XToRV>N94EH3 z_2yQzTYhc zp#ET}xeMDB9CqtqC(ziHCuOcL&gu?(kQ|aieccS`-M0w)RSIQdJ>C>XfAfCY`RtIQ z_9{dT@th-lPpdv1z|n?-D71ykck|z~hqmYZ7!k^sxy`sed#2}VF27SS0WM)a-iZu>+@LhPA}kNcM8Y}3eIt8jw2C1 z5wKj|6{tYrLl^;~`^Z2jYs7qVAt@_%-rryLg))5WhtVOU=Wm9P=GaR7Mr+I+fyYF2X!Y4C zq*r!`5>_E52s*&LA^_s-LwdP3aR;?NU=}#1|S`SeAG*b4TXY)d|wvc?Q zb1@joK7m?h;nEuLin&G!p`pua&%z6$jnq1M5RY95_?;O(9C!Zb@?!sON?Y7Zm4aOs zTvL0xJBad)7y{SXeCbFcgY=zXtbTw3&_&&KbKA}TL0k<*$#liaVN{{V2y6T<}Ezl>n>x2X`!HMb!Wx_>U_=0fOK zFLM$3D4XZdLAAsqyxT{}E-EBGWnodnAo#(@Z06||pn0Doh~T?t!v{0BA|D8?_33{V z`U_lhL7Y^A2!=?(Z48vGJ)!MepZgBa@bG-C3ioAkRCqFxn#?8^Ncshd zOp2XBSf=@W&$PSwJ%pyKdE?30O_{GHL@{ED`OzFGF)q12K7f7mR};_?((sKyaE*Le zXrws~c7@O+;n@e82((Hn{JRh=%0tv1N_xg@KcDjA5S^F8$JmWS73jieG}ZIrSYfff zlG5+4>_DOo-);ErP~Vg%pjT0ochKZ2Gty8H)^=xoK0yVYr!P9)?wza2bGj3t9~WEmonp2-umpt)2m& zZ7ekL5}*!r@566#qEYj&`27o#q7do=8W!MkY5U5k`8dSC9SF*AR->J0mAj73*~2H| z$^!2EhM)jDF`Y-zdM9RxL>m(Do8i$EAS#-Tn;<6um(dh1xqT(yHhKd{2Tb_NgG?;e zg>=MTK-$_4K#zwI>7kU5k9)UZ+N1Bg24?!1oJPB7OPGvbOC`+9fy-A6*b$sF^u~8m zDEvpbGn2(+I`-*4QA~zII7v*NPP^-z4S@5Agu_a=Tj2K>vIETP2^hdbAS{&+1=@Cq zBOVmJx5@sw?SMTN%rgH3LMVjXWHKKPM$Ly$WMMf!1n-Pm0o1qjTcV98v{3@zAl>dwq^cuEE8;q(pXGu-$xBUa6xQw?QJ>Xzuh4?z)&xvmq~OFIH@LS!uWu z1>fUo#JeD`uVi9MHzSP(cT@V=I@}+~#Nt;6(M2TX!Ax>wcA@k^l&WuP-HL&ptwVSO z&FLr@z_10(G3nC9t~%&9ybaXQA>Xrr&!D)f9grvrzYCplIZi@VxWITGN5TL(CeVzN zk5uhNK)oL=y4_Y`*}^r}>NePwZsrZ$I*{*WKEnB2b5}RIE*~*p!f|M?sc6#Oyp@ZD z`5-re@5%YT=B3qS3vU@&+$_E7rRQP9=*6OM-if#qc@oy+b$NJ6sDN8iw`bzO_fTT|1OO4Q3t9F^B_ z`A$cPO!npS2V%_{Y5e5KXUoCG3ArF z{HB=lddC0OnDU!>+&f~*YqkINwxp65-T7k{{FF6N?ct}@CT!{zj*5BJlT%X_*D zk=w)g=f{-a%H@4x%A2^nUrhNSTs|PCd=HPSUP|Mry@=;aZ~bsTUAVl^U5MN(42Ry( z;(pHK^1<#xO+?OSybPOnDbBpA=L67UMrTru<4SkH(ZQ z=JMj0@&mbidQ5p0kE>qZ;;7xk^DS|d$Yc_im&TMo#c;}E%GY!GoS5=rE}s`up26iu z#+1Lx_%Dblzm&_5i78*m<^PYkyMeN)Y~#njGm=Cx2_cOLMT{syHI+nENKr|nBzY+! zA!WRUl8_McQj)xsyroc-N}_~HLL(}QCrPDJ{qJkv-)qkIxn|#M{hsyvt@Yn)+2@?k z`JQXv``-6{IcLV1?0kN1?04q#^Wx>6lFuKD*SAwXKQZ>s`TX6uPM3T>IQFjjyh-fc z^Z6;U-_JR5Q z;n*L|=UK7m^ZB~iC*<={u}{qBr^o(mKJOQM@qFGVUazV7{Fk_$&*k&iVxN)E z?~i>}KCc`53;F!5xIJ_7`Ow(s=JR5)&(G(V#-5(f55>!UC7-`rO1_h6QJ(k1rCg5N z)eA(a{a3$BvWvS!C=j_9Vbbr^EPtAKs{iBf&vF_0Ua|sFYJD?tiP1C8r^ZA4U0^O> z(>1+7lp0s@cWXHx>K0ibO094FeN@ixEGnMrH~l`VH{<%L^FsXnhc17C+jR>>ss7aO zx~d=7NuAf?@04`;=i)jo-910W-(TqNeii3a*BcqQbS_p<>ZkfS{%$On|JI#C3dG+~ z=@9)EA4yKNQsL+UtlFfS3gugF0slF8k)gzIqcg-p^vOpEfL z-+ey+`Odo=6bVyWlxinGofhRkZpia#@weG=(%(;u@{e1eFPT5=B#p))2h!qiE@Scc z)1v&>pYlvv{B5F1`TW?AEpjRy{-(RTlDufh-W?x)4yl9%@|?@n5j|2k8i zOiO(ea9-AX&Hs9=57P3!T~5W{rbQS2H{elPR5#!k2fTj3^IvC5FfB^$cl^S%DF5}O z&u4Kg?|z#5^EXLTT9p5KQgUfglcc!w)Nz9YX;J>`NnfW0$MWu{xxe?EG^ItU;|V{X z7PaPwdH2)&wNVl;-{dchZy=J&?q% ze*Wu238qDT1NnXd&wm~0>*T)<^q&7Z(0h*D{MUgJN{fc%%X%Lc@ch?@KA->k z(0l59%>~nFzfR>o=l7KUmtqUe|_jZ|Mj8w{MU!xQ`bxKSf{io|L0WlTpC^fXx4k` zI_JNA9zV>xpGMbLdFbw>MGN_1-u*PX&dI|#zla~^-A{}1f8HferbSEhGJGd3%Kv$n z&%e&Gy!&az!B};LAK({}fk?d96b!k$5eIP$4;I|h} zu2Uk=p5lS!%4KL$d;a6{=@DHAO3+OM0?VBcXlD_3X_!>Md7w_MK%KGyzcjF3N8F`q z(sC~>ne3kg>d5yxC)L^OuJe<8XrP@90_(fL^=VR_sp-l7bRfSVkgr@swqxozlPMd~ zP2F5O)1%aJMy~)?mPlUibpbzCAUXd?z<0QDl(fDh-TR{?zwY!XDiNhV4|m-dPi5U( znxy=cz;b^LEO$X*xg!JXTPolc-TSzt_N)qwhriuhprrgnx638D`+B%UKQoZOGLZiw z(EefZI7z)v)V~|D&h>UudwK`P^Ifhz=~3$XWC4yFqg{K_-QRcANxi$!hx);_q>H&$V}NP1EVRQO8xS zxPITf`m^15lBsx{@8lo2x#sV6os&-2dyA0x!gXajU4O>ko$sD|GxnZ&b@a+(yc_4~ zbUmppKE?H4dQ>GZAOCF*_vnha-%{_pyCZSFYgl?TD=!~^&$oM2DX!xV5}5Yk_WZ#9 zQs4EPTeW;s$H2I%>-s+_|79S5p6kz~e1SlImm8l+`AZ!p`Ix}*p|k7fr2H_~KS{nd z&_7KB`}OUCe4oJac|xGyngq^M?*;0t4)nvXfqtGH=!aE-emE(xzi$k*|AavOhXd_g z7HH@0K%L(M=ig@oN8!yQkCVPIWy;_q%9%bTJ;e<1Fq~j9pVvq@R}_cH=pnK1a$x{(IN| z=~2zRIxTUpf;(TQ)8|@q;UBwkl1`s%>2g1J&!^MpS2<{ZxwtM_&**v4m=$9PwM@6{C7KCou=+zdX(eleyWUH`8yKn^#0eaemvb1kE^kG zl=>T5pT_MRpXV*m{+r@DL-IWSJ0I@RWpSP1c^>~g5BKOC_b;732hc4v&2>R~G$JoQ z4fl@5>s3F`8{=N}xc{5vx$CZYdO6;XSLXRa-1{c3-yqL5e^NY7vhrL<@Xt=t>GQO@ zSl_B~eQgE)){)DukFRGg%d4aH7sdTHA2tP`@RQ@~@ayp?iZs73&bP?(YFOV70{iJrf$Palf$@21 z+|CYp_4SA|AYQKSJyDc{#7FUVX_GJiR-A90=lXMvr(K69^^aWYrPDK7u`(*0?$+~> zylVdMzsSQg0$$GfHI%VUI_z*>RtJhyPugB@KE?A)cnLIbH=w}(YFYCqI_c-}x z+?N~fPxcyApWEM$>hSSoB)J^3boyV%ZD@S*epiR;Pow2>J9*r)uR-4S|9ZIX|ASON z7x(2x+f&xHf3(f<3lboa#IHPZJqLPTc-tF+W92z%gsP?-XFC+l9y{gop?KrQFOO@Y>_-4&vo00 z^KnMc1-AW}Se9*nPq@^15cg&ABguKYOe4>gAg2GD@$fJ$w<+pLd-ND3lue#Z`C)Lo zzB+#F`tGDUH&PuwKIbAMH~;H;b-`<;{d$fN>O;=wDIO>6yr1&$ zSVPM_hWm2EkGT^pO z8@SZr^Gi>19?v>XB+vWZQp#_^eYx2j@T25hpZ8PVe|fy|_R?dWw1?}+ddg(`L9YjF zKa53Q>hN)CBRLH7zI?6K{ z{^__rJMS-z+-r2waUyjtC9fN(!}*4k&kW>C!fpR+`)&X8d4cO^2kK{_4bpxdCwkl# z=YG)pwmqToz{h#6ug6%apNqE1jjnH5=MCIHoz(4eL;b+VbFNbyHSPN9*t7L@f3f}C znCj$eBi(I%+?V>7Q2SewYaa?}`z5b^C|*!zZjyeO;_t@u|Fs{o@mi@rg6fPV-%7rQ z{3>eyc5-g#QSt$lKL)q`86ji)Q?DPSolU5Y_LVr-5A}bj-*~^%*Gd!XQu}$m`jGQ= zsh;=k_S#7KE2;gwUtdk0O?h4}w|^!wa-;3H{h5J`?ayrZ|LJz$M)@nKodt1U>To~k zHGthNx_{YrmO&lc&Nfs(7j2N6lDMC*4&2sh1ef;A#C^Frj{D+#{Lyh}>+7|XtguBxzYB>@nm*_+xi*E z*!rWXJ|9o^kvGMCDWN~7mGd$YbJ$yV_MEP8- zyWIT0+P-{!+l>0>AeLp}qZBn1N?+Ws3abFg*hMd=n zulKm0wgN*n;ln;%6y-tvP5vtRj>ikP}Lj9b9 zj9stFaJybPaNEz@$n{txw2!oGx=dm1v5>xBE_zX)LJLViTi-S#6-$9;KPuP1H$haqFzKN4=+ zug5pr{@JwL613d8S{wrQ_LdFFoJc?WN~&yS;dvpGxiF<0toL4P>O9 z?9vWxKYJT;9=GktdE9m(=W*K|Zu_AR-1b91xa|iW|F$0{({lCNOx9-_Igi^#&UtOcJf>- zOKvi7-!3;auJ$2s*Gt+bllb|#FOS=h%Qn`Dk0;#D?#S5o^nu%c;Oog;E$(hJaNpMX zzge&IsQv$ctrzdtd|lBG>nr`AMeUqT&Y$NjAm=)($T`1`ob%hrIlq&f^LqZ0c5*%g z`Tx`H#p~OV)^{{5m&e;-xEwRycK3B0=y6Z7?AnK#$IBx^Ncv6NAkr@2J;}MwBJz^dZ->dbe&K?t<#L^NdyTA366!VfTCNGTHU57I61vw~2ZA{|+)q9d74-a&G4_a&G6ELa933Z_!C9=l0hi z=l*OF@Gb%0OwR4xN6zi6RyfrjUf=d`yMJ|p+vDmYs>AgUlIQwG#qkZ->#P)$LxC5#h91+-%y3J|W;M$a%T?K1kZb zzh{y`#{phne!ue|YD%-(P@d1HUC48({e5s>mirEQ8Qi!1soU4~XCtb^<5RbztuqsO zTjw~{X+-O#`ffp$@6(l$D3X5Xyo%Pm+J8Ghd(#q{hG(mH`E>;Ke{dC>B%&% zc)PD6=X@?X*FQ?m`7(4q;_C$cJ{#MgD=5$H*+|aotLHTtC-2ev7RC8UYOvR*^AsOf z7m?>uoszh3x0mi;c6((ZFY7ge>I@@aM?Qg^_xITW*W;ueS1XXW?OX%5?bKtS)X7Cg zZvNNxZHL#|_0{8s_=i+q+bPcdu%7DhIN3(d`%y03uCK0_UEktvc{0gzxt}GMZD;=LX+XrZyRu5Zl>YB z^c#C8yjJQQqI?edf7K_~_e61ha#^-cOUXIEf}Hc~;L;Dg9oNI9AJ{j-?Ks&C&o@rs zvc5lPBi-$Oa&C|QoLcg{pYnCik5s1`ofrN?o=MKvMfJ%!ukXubxt!PcWp=0 zcBzbv)X`(0l&Bl<#sM#b<=Xx%54Zi<2`woPZ@r$u6i7uc#j~_iAN}jhbUv~|` zYvqQI=MPf-YPc_T`1r=_E9<5ckHc>i-EB6F6K*G8M{zp`B5(U`7~J-o`|_4}l6L0$ zyZ<%U@uOG}ckDRS?WOs`$mwxX_jmQ8cwUw}nEIhOT+N#YYalPn z-KWLfZ6i}hpUT1=ZNGX`+>tuGUE089f4PX(t0dfR7wtE@U38q=eyD~zwjVO#n%91= z3$NhXBKy0#uCKI5{x7FaS-2zZVQ&n#b+jLJx!TVyOkQ34N0$2&GIG-n_hq^4?cusy zt&F!9HDMEFqS3l;r*oyT6<(cxCCuO~MkS~SHda-Y${HK)P zOnLSiINsX&`aaawZxqO9!EJsg+936HED7bpCC{Gi9?PWp)BVG|{?xp>jtje8O5$~P zyL5+3efhutI`zaIsn0IQD4Art@b5qC*b~=nC%OGHbCYe)VbAerJbQ3oZc4h>%Vf8^ z9$z4+X^obPkqaQ zyY9j`6d#0)+`JI*1LQfB*PjbW9ro!Mht~H6{L+HHsLc-z`0M0@sXdkOxw_P0cYhWm zo~++kDA|7u_^l@;=jD6MWU}=;V#8Sf5BU)P(s*9aeUE`mk{{~t#`8zWhmp(oe#j(w z_9E_k71W3OyYc+SfG-UAN%)Elsn2z;3;1C2$7s1b0$!)64@rH_FAVs##gg+=1O9Qq ztDTx$XLZ1$N7} zHA<)IaDH;Y%a%#bj|zCvGn4ZV2mIZDpH()w&OHI267a(1lIvVg{pT?j)d4S9J-JTvfImt;#=kV49}0Mr8mao6 zUmEbg1D<(7s?Jli-2MUI67cFZlk0pJ@GEO2=c{HW`|5ySQ9C)mDB$}7UgpB&I@bj} zC*bP?Uc63n{aXY6WWd)1yl~y*`mF;#GvMC^yv9Yz^&bfMivj;J;1w=TuHP!)!vek` z;Qs{t!g|Teoe}UY0Y9;Rs?Jz{H=cJ0_&D-$l>Z{&O)g2*=ls@y7iy5okEi-~1bk({ zOE*le^H{*&Ab*;co8Bl@hyA{QZwPpmOOxx|67bRF6R17k2E5Z{srsDX8}L?_C+CL+ z{PlpB$V#r$HsCV?et`TLUoxIwc!hr;?=L2j&klI0E0gmh1Aa8%*;ggkc{AXrH%`vq z67X38|B-wWt?xBgr|PrM4ER>^$yBFClT;n{JIJR{enr6l33%IUQuVpcqJYvj_Pj<_*KnQbvQpQ;J*gEQ;Xy}TLWI`x>SBT zwR2>^_XRxb`s6y}0v_FvoUaq`&g3(xov#MGaLZJE&R-w!2?5^`@QhZ;^*aar)qtPX zI=Rm1fT!JT{jJ0pAhuIyWWPc{1PyZ%)qFCx6~Y;`yTi zUl;HqZBzBRPRoE#4EWA~pVKb6ewTp15%B1iRGk<6-FV(4;G+Y+Kj4jTO|CyP;K#{l zQ+p=ema4;kIN;6NC+D9J_+J5Ub9-`~g#jKK=cKbPkEqXPa(z|Xidxz23?Ul8zL$mjTy@%)mzQuWyf1^lak*XxvA z=V|hnXt_1-PUYE01Uxt3mvm09Gd|!y2E6e-$#otN_~w9L-X*!tX92(R-c)|BzZ=h& zlD|y;XTY<%rs{BhTELG5yiK>{I*Z8XQG3qmp32WB?-KA=0$!v?a-Gfre}{YlE%%iB zQgzrn1$=(M3*Mhx=k|av5BO<4lk0Q|_!|N5+bg-w{D5EnKyvf--^CtrS zd%*8{I=Rj#0dF`VIsa0?qi2%y69azY#N_-|@;7`Wp4Xa`%CkQh@Rb2SVRCYvYXbgc zz_$kc%x9D9Umx(H0bddDs#B8d4<>)pN8Atv1O95je+_uUY032m2mFJ8 z9}jr#=aTDp4)|vQuQfeYXQjUz&qoIQ2)n84%g#0b? zvuCC9?1uy1{`utmvVfoTLUO)Az}E&mYj$#-1p&`^F*!dW;AhN9&fg#K=L5b!;8(qr zTz^`?e+_sWe7GRjhrGQ;1ib6Z$;*8%;9CP;2p<;M@GSu^gAXI@a<32g z;D9d;_zwZk#D@-cxt#<4S-{)kO{}f+Lco6vc)eGWx8qv@FNil$cDeNe-ZkJe1HLuj zCof8FXQP0R4EW}Nm&cnTyIxNO{Lg@2fHxtwPIkb*4)_SXIk9y%1^f)WX|eg+1HL@q z2LfImZ$fPS8v;Hg;L8JkAmA17Cc!TE$$%dSczL`@uyt-AU*m^ZJYN~`1}jqIkn=AG z{IWNa^HT!;OTeq(B1ziM%bgSO({V9j^GyQ&e!z?3BEZ&Z9qUY9POX{<)4*21KU-7mtYU?~m{w^(dWx!8Zld7|h^0$T@og&NS{J#Nz z6f0@-mC!ir_Xd1_z#l{-Y@PD&C9l^j0WbT0a(+y}&-oyb5BT>1&sv{c=h=XN9q@BM zOs?~2zz+ue>2% z=f?&7>TSvSB?12~;59x=t}`Iu3j_X3z^iqAUe-Q9L1Af65sroon#PDpuj|9BK z_T)Mn0$%*fLFkb|lwX8t{9+O3qIU_%{L1+?iabZ@^atyuhyHIu`}J3pozS zae*BHZ?QX7pYtmMUis_f{MdjW4|tc{`kuU zCE)J{{I`Igw=cQ=P;#8g;$Y)%Q+f6y0q^i#a(+|58-1UgpBwO!`;+sx27D$tPN8vu z3lF5~urCexOFty%OaGYc*Bngt0RcY{@LGqG>x>Hc-hh|-Pja1R0UsFfSIKcH5f`rT zQ>s2r=`q|K@FxQPR={f=s*g*67`FYA>@|)i`>=p- z2zc>dlk2Psc#Gdsd0cwLQ0ez%e~uiN0CDiUfY&;fs>Aty0bd*NbN@)y!6`k4!2!Se z&*c0Q0Waj^@!z_~sV|nI!8jM<4xdWjJJnRF+LbR$M`t- zV&j|OZyWytj?1oiJ4!$3-!#fK`LmJ7=^`($-x-SCH_!FE#xUISybJ2+w$T261FnB- z*t&iviTbn1XW&+S8Xng$z6_7AG`;|j^>3DGof+_fCVxf&-!T)7>)&yiZd||DcphBF zAugHYLa&?rlWD&GyT+Shxm%34f$KQc_IH3EG5MaT|BvxIkuQQKvc}-27vUq%p z@o%x*(Z*-s@p$7)@OZLu{a$1JJ|At*x5&*l`G4?up7GKJ{eHB_cqV+g@oV6#jCX*) zWBft*dgD*QKQ=xWzRmbr_zvSc;6E5Y0zYiL$ccV^e=}Yge%yE?cmdSYer^pfVZ1wB z`&IKf@Uu*Q0=$y(SK;Rw-vF;={9E`%#v@#SG&EigeueRi;kuo*{cYganfwFr8;y^J z-(q||{0`&q!|yh}2j0#2ad7~_8Z-fKfzBjUaW{;uVTi}gP(5v z3iz4E+r!T`{t*0J@#?Oa0Gu{M#gYi4zHyM8v zew*H~yKHT^{@F$E9g^x2n13t<4O89fe zzkt7B{1^Dk#!oHgx0jwDbljc?UuN=+;rcy$n!f|S*5n7kKQKNXzRCC!_*Uba;9na5 z9{#oQ6HfK(rROniXLT>AFKYZTc)IaP@G{2d!Ydem z176wq2Kf2Lcf&J{{{+|bv$j7v&G%a)lP?3m(s(s^E8~~I+Zt~PzukB?yu0z9aJ??j zc8-GgGx<62M~%M&A7(rk{&9<| zuQuKt{;u&y;U5|w3*T=1Mfh&xufq=*-wHo!{3H0k#*e{^;5tS7;U{uNdfuT0Ea( z^3%@uPrgWwAF0Jpyi6{iFTGaM=a(8kv9|X$a9Qr7p5pn(CjT0iyMtVo+YGPSO)ks5 zx~hNTpz(cJ-#?9?j`o~{>p^MHAk>zdvTzwcvRwWAr;_ohcwc-0xwPjEEVqI2&)`jr zzl0A^_3xeOxSb5Y$K-dQPH*E6B0tD@4t%Wf+u+X`{~Gn@8Q1=N-S`3I*BL(%^*=R! z7JRqyo8X6yA3=S+e%JmfjQmNs{#9=bKh1a@cp2lB;pZAZAFl5Mw0=!^mdQT_Z)$uP zyp8cu@Xl}4 z{Bd&0|8$0%xv4PTXUO)Id~=*vijv3eN4^ZX-xTDd=-v|8{yLb(hoWApG;p;UXJIPu}0AWa#`-x7ze)v>XgL$U9DdO zb*dR}3U6e*AH13IvG5z=x_{+hJoGj`1wPF9EAVHGe+YlxxNhH9jQ@oEo5uBe;CRe}B$Dw{cq3!ICd^eLOKhEF!$3_ja@MFerhZn@>0otG0@Dj%Ff>$u!8Lod{K zCBFsvP2`f-{q9S0$ydkmbQihgufqA_0J-G#{Bek!kNz0QYQoB_y%%mj~=h?AeTDX?w?Fu$fZt0 zJnm)u8?5IL zNSCX>BT^CXYt;`Tf06Oy@Mgw~qWw1;*Wa7zYFz&g)34gOKY)TA2z-NUKZEan*Rr0!}w`_8*MSc--WdLz@pkap#yi57 z8-D=4#rPBOuZ`>HAwL>_9{Jym>vhPfxL%O)Gs17ecwP~%`}+qNm**QVj()FW{9bq? zT~>A7Py8xb2qdpDao)>s9%%_u}Mo{M7AU!T4=;d|uC!TE8>A zKIP-%Ew;O!&viU3`q|gHg7UK5KB%MDN18u~yj}fa`UEwnsm2nQij=xzHlx-=dCQ&uSh0TxcuuGJZz7_UN?7)VToH z8;8hcef53H&*ZXRdj0S>x#aaa_5`#`+oS7Sj9l{L@%j?vQeXSwEON;8y?;@A{SmgJROJ4i=uyGx4$H}EmdKov93GLPKrq`=Q$t6D+`QqfVTz&sr zo?PHXfDp zb$Y{f{4Dhx4K|(yf5!M&_)6n5;p>g-b>kMeZkNBX{f<-qanz8TA{ZB%Z-en%id_1$ z3D&DDxoj65CsoKLe-!!i$tADHrHjcW-?F@$xv2qpyxr0MCghS|h5WVTlGpv^W^&0_ zJIl@7bSt^!b${thF8N`|cO{p+?k|0f>+$C?av7g9F+QInm->fMU;qA^9yczo;GT5T zER!DypJ)6X_!8rV&-QiJ!et!FcGq$BvGHv_9&M*Ovc6~Pc*1_H`*+$8I{u%bywoXMQL04Iv*c1okCQKwOTHWOFOy4NkCV&DCI8nsZsw*p z$R)4G$@h%w^~y%LZZ91VUs7JiZLZs%GJQiX%UzG<{%HJZ_)+6`!2dR09bO2>Q62v~ z&<`cy+RiL#jGL+%Z{s<-$hfZ8ZN_IJe>YsWqaNR%GCl<3e6n%v=h?<5BmbuHyz{&9 z8OXnH{8RW=f_ul;Zrx#Y*5>t=4! zzb~oltNq;DvlXASBaw6DKGnV@dEydttPLZ7acXO?{m*6=U=Dw)$1D1#&M$^T=(mbv0j}`z9rh3 zV_dJ778pN_{2Jr>bL36N`=C90jE{yNA%7CJ;~QLG=y;fn@n6(u-Czm>V&vP?3jWNCmKFRnc@R`QXL;GJg zem{IUT*k9(_qy>?qiCz~cJRZ-d%{n{b)42&1i!#|7QCtP7V!4QJHhWYo(s=`>-ao? z^Tn%_AA_vitTy>qvAsSdm;Uby-$c&a@k?^ae~bJsa>?sBKLD5hk@mEA|77~Zdz4>lS_U9^3}*C|5{03r!KkVe?`7Nx#V?!X>5Ev z+Sweg>$}gFk8UyE9p1xuKlotdIq+wUPlLZ~d;xs9@pW+id%?0@w!`}Bjru!{>*x6gj6Z_>Z^pI$Nf~}aXg}-!vp&`M7}Tk0d@lTQy1~&=lt7@>(4uKjq5l$Wc+%x=TGDM zxq6|BQ9Nls>-I`FuJ1o981IGp=NlgaZ)AJ|yqR%5pWb9#ub(>_*X!gS#?7+;Fz zjxetOZ~AHD8<3x2T8INs)xOTHKK z`^Y7~0{O$_lHY**QF6&|LOu=eQ+2yfg`Y+)bt=_#GdG=1E_Jpee>S<~cOzekT=M$) zKrM2~H>l-iZqmPpuIA_)Oy~P-h{zv}a8LUuQYF zwC8HndE0n#xPJa2{UG_B*uI~d{9O1BUF}ul$Z7&F5uf=4DYA4 zJ=fwwwv=(bz&+deWaO(E-wnSQuI1b=bFt&TYfKQ_O(*CS8-~O58(x1&P_WrW* zf$+t~e}lhG9*?&)UuQkJ)PL?G@1Gj)3g2P86zcCa{to;wc|5MteEmPjWx176zW_d; z(CxJso=z@xiWl^C%8^T*4fVXAXM7U;LgVMdv*5ZN+xarlZN~e+yBHq}*Uw|L&I2pPA-S~YaB-hsOfGc_|LT1?Ik)E>a>*}6{(W*@?iS

}l+=W{ZCbd1XyoDSFh^l$7(<&EE5U(!)@o~eV63!*xd zm-YIzOdOAz8DEXhXImN9{||M$@t;uVKI1Q-PJiRSAV1vrAMlCBA48p4#`U^-p>b`` zYU8@x4~?IQ`kxs;3%xGs0T@g`XA;()(tT$lU4ab4~fd0~*#d61( ze1>~Yrm4m;Orix;N7`8d+vNkwKOI-_vmKO|<-UgH>gVfvUMteb=MS2EXZWwi-+}*Q zyw#4!_v4|f}H4}ZY8 zj<-jRcSrtlk>|5h5Gi8}8ae;)p+asB@hJB`mq{(Iwd;J?77 zpC_O%<>mzJue$#p!sBA(vb~03dzB!U{@4CIi(K-%kgrHCdF^NY{YM>#?Jsjrx~aCw zYd>chKaBU$Ey!iLU!hJ*a#`+i{# zbv+KuqdKzOfmrVAzAMQx3Df_F2nb%q}q_1Qo!{kA7d z(oys=xols(j@@Zo&o4h1*Yn6R<2s%T;d4Z7j~+Kl8rSh$87}=S>s3Y?>86?{KOg&V zJIYV=(Rkk3caMcYymAx& zqMJ;e@}8qRC@<@E0L$%bd|)~Mf&3g+hTnF zL@wh{+xZu{u5mLrolP!z9k(@&>(9X( zkV~DpsB;;))X|@xUP~_d^P0Muo31C9y#74yR&vQtM!o~N?mFZTnEX!o-^P!@i{Ln|b!xcv zkg2rsM(~Po-G9fH^ZA;_b-Xn&uKn54_;l212bcD2^`+x^XOo|g@%jL{^k?JW{EPaM z%XZZ9In20@xADgHcsre3>X-Z7*MFXz$H^vyAFUf7WW| zpM1;sNcacF_rW(C&$`yv*#(#O$a1TBj{Y^C0WVtD-_d-1_*ro6=VR#S`jmeTS-ELW zd0DUCXippC8{xMbZ`j-y>uh`i{C?wy;QfrZZ{h0vrz~m;RUa z(&O992lW33`HEO)h!u|4QVNFVo7++*FlZ z^15B>kW0P;^7Y6iuh*GPjO%&7HM!Jz33YBJmpZj^KE9J&@@KSmGdFc6m%LtQK0q${ zVaWF-m%JVahLB7CFXSI1m%Lv0jyJByjc4I9ZfCmuPWMlyImUIr{=oPIACJB_z8!uh z4n$gC|G!2hxbD{-aC~S_`B|tTH(gEs1?(?<$)z7|y3xOA0J-#o?k|s#OMW`?kCRJY z_m_#}lK&q0DddvZ{bdfhZp@kNlhDlGpv^eR9cfL4E_dgNv zajaIX5Um-a8lxO$&lmYaFAf6)eV$?Ngq zb8^Y|MScgl@G$?Lc+)F6I3{(D=JZ;E^o za>?tsEk!Q*G02xCm%NVKD&&&ihWz>DaUSF6VsgosZRcigYCtaeZpdG2d;t7ra;cMz zI=7Nb9UX_A;WFN2yU%q0Wa?}3`uXz^a;g6s>OV#<_4V`TNv8ffDek7%jq5l+XzDzI z-{@91bJI9-$?G_Ij$HDSk)K5_c^yBm z!L^?=+;cJ=A)oEZ&l~w0?SK8bQBiVP?olkaIJqoWw@Z0)$v<_QubV+G`K9H(*C3bt ze&jRBC9m7D5xL~AXz%M}kxO2;V+(T0PeHyVx#V>_wkMbTFUV(;$9ZhW?&Okhal4zj zsVBMQbvq6um;8&!=a5TYx8qaB^*B70T0oln--!Hha>?udH4d)ZccyzzrdcMh=j(;!Qhzq;zec{> zxt_1zfopv|Uw>o#pe)o)r7!olI-bA9IBX7=I&*v^p5J2fC*$YA_ZZjnLT_?u|Bq<@ zL*&wa9S=jvC13llc(Kt4a>?s>c$!@D42-3+>v;G8uKkAYj84dsSGnIya{c*|zZ=g_%kmGj|I4F4%aO}+pTKg@CYR-EKUXK0 ze3iT1%uThj;+wp`ORLAFhUAhTg#6{?QeU@Ab8^XVNB#zK$?JBxja>4zJG+^i?#PO7 z^4g=@r5m~AA4mRva;e`D+vQ<$$?rve5V_=ayNofe$HOV)QfK`=Zsw-xS@BI?JN0}z zk6iNgy7=5H#-5&S=J z9dG*geG6aV>!`1C<58wFjIV>AV|+8b23*H&!LxjwY|78|6wmK7`Am%S0pzk?4es?X zdX!xHN4M8#<9eQ&VqDKhbB*hGUT$2Ex9g1SadnGv9f!HbyJ39(WL(GLzi{b)=^uO? z7!|$JueW+X|1c^A*M6>oe!jtY7JMYtc^Nh2W}?YALI2M-uE&!_+__lpgXFSY9sfg( z>-ZmMT*viu!=?Uw)R3D#Cf^lFAL-V;_HU1Cs4;eoQe>C8a8GjG?@y7N045u5{zYjjo z_#V_*YkUKIqw!DRTjA2r3w+nc^F1a%5aaU@xopQbu^oRVm+h$I_HS~@r`;Eqk4|Xf zZ?*q*dle&>e0$_ekV}2Nemjd?@-HA?kvtxUmHqNAAea1c<{B15HPA$rr2WW^U?1F8TX<#T@k_m;91S-X9^C zd^YM2CYQWkH$F)&`PYyiM=p82ZhVeh@-Lu0v&bc{*NqE}>*p{_;W`etyYVQ~TFUQo zk8@6pIod!j%dPi-_pQde!gm^93jfx4)Z5qjkMSn(W8~7FMQG38-QIxglj)6LO)bAo(<2UId_VjJ z^?~eRG#`XP0>88G6+Rt;5uV;J#ys>e8Khny$ zzVGN@JQsDkz;!&FSi!erfblco>x|cde{H-4{Ac6Y@ROVQ<>+$z!LNc#KP<$ylABg0 z|1^&Ox0B0w`&!2j`EKWW{O>_7`DzcknVWi%OJ0xvkC01#F!F=RC9lW-C&?wh1Nm{} zlJAJ)|8wM$uhZAf+%$_^@_PJVNG|!&$iGG|c|HEGCYSuT$gd@rydM8IkxRbDLvH4# zPst@;tYXa3E^^7|;0@Rwa>?uQ{}8$4hok<_p0Z?t2X83c$d11he%QC? z4deab?--vC|J2mi!*e3BT2NBltbW+rj%7 zZx0`AT+a(rj88-UJ>xUsTZ}J-e{Ebpk2(O?{bf=G-$4~x_*?bY;J3r2KVLy#%1t+u zpNHdcf8+Xll_QMnarhbIdc1uRuFEZqWp5yVmD;o2)Oi=}*+(wpa5u))esUTA+Rmfo zlCL+=FXR}xgf02T}3YW?~%WTT=IH6ypde;uRrQ$ZfZ*|c|AVgMK1X&gCy;~Kbc(edVKC} zT#vT{;IiFi`_?TWRovesqP!g6vT%GGOD@a(63d-#>a>v}Zdz=7tmkN>@qO5jzBGOu z{+;nmwDT9^S@6H%x_@o1;1^uvdVi~~<1oW`w+x@FX1onN)42ZsuSUlAV7bkWAA;X% z{3yJ$as7W-4;inI_6#wu|37Ptas7W`GmM{!I`fR{eze?pp|gGeykopL{A1(V{@up4 zoj(}Y?=3xUJVHAQ-r$$7+fluk@ycjVS>qkyRgLR-sB8QUs;Z=<{hc`0bAKp0N*BO5i`C-O~U>r^{{yh9`;~U`n;BvfOlVTJqiQvG&hua>?JF<7RGJOD=ic?>3Q3 z{;eE0bJM5flGpLPi(K+$2TR&5pIq{KoIGrNA+9%$lS`f6s1vo8YWd%16(yJaugDiC zm*whtq`YxG?^l9r|F<|nmgau1mhy7m?}_vNCFHW)2}2|uMOPYc2yaduRK($yT5Az*LIHd91S-<8UCzseIGH$cvGzJyKvpVs#Nrac2j;aYRk>fl$Z9m zMLYjA{v|x^M*m`|Fa59?{ZN=(>RgC7S|yD4gP#qTevtM|@MWX($d|z6rje=h7V0!J z`SN(pjpR$IPDiRE;*<{5W#S z>;Cl|x#Sx@=4Ni1MJ{>09$si%_lu=)>1XK&e2fvTrMzs%=p>oB-#a6h<<7%$x0^b6 zI};r=-Y2f&{vHeYGML<)(#Ai~@u}ZWQJP$qy9>)LN6!6Um0a@8M)rm4o8dX5%Q9a-*4qx=(ZntT@W9~*B6|C;JZJFlte zpE&s@e=F@-j;!32hU++~hW)e>xwNMN+EbNW>g#@5hg|Y+AYYGM^12B^Uw;khVZrVsL_4RX} z?c|a_i2P1+$?NAl`^hDL-&1bpri0{?*YSUhT=FBwO4@zyMJ{>0J}lfeemd{-eBED8 zgX=hKgU?mU8(-nZsZ1A89a-+B<6@33HvT)>b2+)3Pcv~oZA>n8hNI4P#y^6$hif~# z`^83&7(WPq+;~Z>*CgY*z8@Ozg#1>xj)zg$e@o#2F6~)?Wy(!uxaP0J{+mfI>sw;H ze^Fg>* z*E%;EUyuFwcDRnu`54a=DgTCFR6L(;^7_4Ii^!!PKAPxXw3J->LC5nNa>-Yn3Cj({63Rkh5TW1ss9J^N6DrBhsZ~_`sHZ-%P0HC z1<57hva;I=a6MBA5KxQ{2o=L&+tt`|s0m z*)QI3zF)#_T54Q>p7@<{{k@vQrv4`E7nk1V>q-4L{oQ!p9IpFOFC6FFl1uyhPw_9h zja=HV`^7!vlK%|(Zsd~J{o)~V$(NhzW^Q_zT=KeKj3AeMN93O%m%Q#5lgK6i67o~Y zC9nI%OXQM2g#3JR$?JacI=STQOmj0gtt6Mcj@u8&CEp+UkH{sj?s{_dU7fkD~sM?8EUp3wpzS6jUZ~q444t!X>dKhO~v+_OD_HS<_!O$1?1A7y1m{suE((t;Ih7} zeTjJfnaQuja`%wSa?hLTU-T_GFZUPYy4)z+zfRX{BF1?!<9eJt)42XWi*t?Z`^4JD z_5IzY#`XW9G&8Q__9o+N(at-K>-YITXnY&;LyYTjevENFA5Af?>ov!?uGeDY+COg@ z*Y(|CT-Wz=h{(3EoNNT_e|q@UO3mdw!gMu{#`W`%sm8UPbB*7J%Ux?+ zzi(=j@j~VNcKXt|e&5u$#>Zi~KO5I}{%u@8mnd{6#>ENlXXE~EJTD2?aq<<8Ga2M^ zoS8q;Bb}T=H$6cQd&qm%N_8vdJaC z5cy8zlGlFgXa->dc<)>wIUt%!}TCGF~6~W5(Y=drr8^ zzfQ)L)IWEze_X`)7x2@K?^)*a<;kV}W6=*4$)$cf)Tv1>`9)aYdgPKHw8YKalx6%q zcr)Y0mil~a<2S+YAeZIlV!2(&Ww|9^_jUApBcy*MUmWX|WAd+{{?o?yz-N(5oov*Z zM;WHSkr&2f*Jm{t8^b$3pjuK3LzhPJaD#yO&z-9~U(~9DXKT>tv$+Rg7;( z{mV?9J*d-?T>2q8*)R7Na_NUDbG+Ya{2q8W)z#*)Mm3 z$v2tr{W;_P;q%C4y|S=gOUPxt8ouP~Y%o3nzSa04_)g<3=K4C{8XpAzkMUZs`21gR z-Ht~KcrSdnztwS`gZ7som-at{{wZtxBX~7(>4#j@X-F=0YR~h_Yi#@<)Va=hC**G< zm-?ASe4S3@Qhx!q%R|P$fe#~>Iz3V6Nph)EZGo>p4X*u`mFE3zlb?ikt~b5`{u#L} zcP5s*n_QM#9PKLnY&z z;F)mkpX`Eud6ya=4R2@a97lWZA(!>dIK|f)LN4oD>s9Y#$tB+s`De)`e<$(_j8BHY zNgi(()OnX&>U@O!=f+Q1Zb|7>;R2T$~MnwUCAP^YcQ>-+s~#`oiR@|f`m`^!}0HQv-Uq(l z_)+-Z#*1RSrFZe`r~S|#ezEas@aD$%!#f)-c`F8STae@D*O)%txiy1!IC=Ij4v@}J`83kACR=QZCG`9kDU ze+Tks7}uXKR3w*nzJWUDl1m+ZUvm+;95=E{xS5+;86OMp0hjSC{hTdfH;psC({uEq z@%`}SRA1UNy|RDeUE}(5jZcj4Lwmk5uG{N-)&N>VqDwP+W5C;`1aiam+i8~Q#|is@_*IzPxdF5adHjb zcRWHa+eQ0r6uIP=Apaz}G=GFBAP~d?dVFcYjCoqv4GLew*>*$oGQl zabP-r_&mz^k7)mR;}wvfYW%X5egSjg+RpMgZ!R+)xp5@Z`=-t*sI$%Fdm?{;@^U=M zC>ocEj*v_LzlAz~883(r*NgPNYHa-o0mvQ}n)*rBz$t6Ds`P;~O|GEdR?QiGHM~|DleqJ|` zTxJk!Dud@Dex^X>@odcJCmi2Ay(?hp|A0}Sng2cTK_5I+McP#b-8ol z(m(I|E{NyLP5y>j{>gR5wf+|4JLgUQWhaNX|rVZE*;m*xI}06Bae@hXwNm|(w==E`sH>oUV4M~ZgA~4 zy?z)&`MBRue-gRW@3hg^nQ43;{AJ^1;fsxL`^eW>Y5X^|bDi+CkZ zCe8bArp_+3r%-SIylh8V-$hv8)5v9g>#z5@GRD9Dzg!~Y z%W}tIxy_7!0dH;mENu6?jQ53iH~udAxj(tICll=%MK0|bi~M-wx5J-@>vlQnS1bC^ zcpul_GVL`!4F0?Eqwvyw{Oh!SQC!DXH(nmwy@~O<@Q%he!yh!>2;*uzT#u{Ga6X!0 zT#wK5jq7oEh4BYa=RM>4doQ0F*Xy)h#&x*|jO%&uSL1rVJK;g!pSoUpygk+UV6?NG z@fq-{#4&9m|nR{Y(G!uRohy^15Et$t6D&`C8FNgWxwCuMNM$_`rWcxObm+Jn8yK(*8Y>Dy7$geRz7rx2( z3ixigj-Nf)-+#1zrhmcj#&thR!v_Ug=Q!$|X1s6}U#Fb$67Z_VE5hp-uLZx{xPFe& z+_;XDw#M~(yE|O^AD1$5LkF1rLhN6Uk;^#w7TfW0av5*Be@!Hpe5+66^3fD>$!mYk zA(#ASDaehBg#$R)4a<#Te$m)+`SZrVXEdEI}% zBbWRrFx+@6_!#4F!zUR(0-p`n_N+mB z78`F5|Jb;G-utI?=jW(=>9d&|9azcYVpFPTM*$M<+e(Z>4`EzbDr}K80NJdK@SR*X0iL@u&vnrOvi* z{1X=$9|OP4c-g%^e~s~`$hS0J0Dg<{ReOA$uEra{dmGQjat9j!4}7@siu-*1@o?>j z;sw0VFh1IIw8+$1iTdxEJPxPPm&Uue?IY76IO_ z!LyC;hd*ZgApB|L`t!Jj#w(-W)*9EJi+yao5%Sx~@sUK_0pG!OfBzWApCja7x#YQD z`2PBhT*kQ`e+oR}pV$3j9P)+8C9lVybaJWx1M;QFC9lVybI2usGY-U6$R)4Gp9{$) z{|@pOlS^KI&-_Yq$rt|8&D_+4T=K;##vHXKm;Cj}-%Kuf{k`-%$tC|1@}0>guh#<) zkW0Sh4mWdCUvkOo^~n%&$uB_uF>=Z4acR8qYjAv-jet^#4)!F5p#ESHu6zIh=5kAOsR1C~6SYfEbbxASl(t zO#`BY5EWb6BqV{PToRL@;5A&V@zPgNYiUbMwDvVnt!QbB)@rO;X|*l3_HEkown4Ft zm%gQn3RcUv*4}H)th3Gx(7xaQdA|QV$(}vGz4lsbUuVxbb7uVd|06^PoNbQ>D1JWi zT*di5pD~KhCiz0ext~u{ocr@a#owUvekO$1EB<+sZ&Cbp;x{WkKgX8$ZpB|A`LBlX zZz|5uAKt0>rKJByif5dXR2oy6Z$d^hpa)+g8JE5y%H z{B`0}iQ{>PzA7^cE>`lGXr^)TEy2;B{qI=2-%-4U_)~(To=(#9g5ap< z4^*xm!BKuM$?q2&hFx3z1)=cRUj(DEp?-D;p@r-dcf2rc95}&0w-w}&R}z0-alS8zpO4P<&-e4} zQ}TS@&YOyFB>f*K&iW&FB)2c?AE-F%KV9)fblqpQ*!#5G;ee(GCr$}C9+4;LnA4e; z5znPPb3U&X3XV&jb~-Lqyo-(#itnOhwuAan50C3=A&;kYmTyp;=aXi|`TA~+;(UGA zt~ig!4#jzX-lRBx-?T;Xy)-}URGjm3`LMiLF0P+$CC~ZyD9-E2y^6E{J&Lpcy^6E{ zeTuXHTz}{%o}#NsE>7iR&huWD;^lPA=`6pPc%hKTI%oZSJ&p3n?t&X| zm*lI3JWi$Ki8m--O1xR|X~fqkUPruLaqgcTig%NIr{FmB7ZLALyqfq<#kst@6@QrI zyA}8PkK*iSui!X^aQ*Zt&h>Lpaju`kiq9f{_bbXO3yO63h;~2oLQ}IITyY+6ixhu{$??$8i=W)GA z@q0;6v*7mt%Ok!<@iD~P70)N$p*YXmor0sya+2>-oacd^iu3tvx8ee*yaX#Oa zD$eJRa={-0n+dYJNO9I*t$3XJVT0m%#M=db7<9Lh{tm^r65piwVd7g9??>g`srd6G zzgzKx#Jd$ANqY7u&f~pT@JB#LGwJD5oc%wjIO{*Gcs|+9O0x>FKcN2Iq(4`2)|01r zg7oAo{uJ?q;E#fC?pI}s^LQy&oad`WiXS5V&4ND$`ni4ADBe!xYFE6Ec!%O8q`y;f zhj^FbV~Fomd_3{pinIQ`fp0#p{UoD&9`KPw{(+JN<10+jkd4XAzGpzKD31 z;x`b_RlI|Eq2NCNwvWnNs(3#dj|s)Ih?gnO_a9aZ{xs?*yA6sTAl|I_JH*#0&f~FN zaqh1jikHW&qD_iFNPLUp?-1Xqcn%%!R=k9cyA|I@diE&J`g;{;`98&aNzXyW4-h}B zIP2%uXA$S;XtJI%;-yNyoOnX%Uv^SE)bmQJnkpUd6dT_bAT(^eWE& z^eN8%@bgN!y?EY>r(4IE7t%bCr8v)fxr*yT>2_mMvhinBlMinBi*iu3%oNpZfO+@g3tvfHURKM$}=@iipBQ*nMC;BLip z`q}pDR{RE9H|$ZI*H68QXOZ1L#dC=tRGfc*eOU24l6Nwa`_&lYamD#Lidl*ml6 z{QK@g#kqY;73b@;gyIKCf0^QZ{Z_8{J0!nIac-Ap#re8!jp84Zo_56@YR3-6S%0VE z)ug9O@jBu=6>lKETk#dd_bSf)sz>o$^0Qa*k;MBH=j*G3ia$m2hZWyL+{sMtKiqHQ zif^TU&d*!rd5o{G@|FAmk}p&|i+HKxImG$-tgN5;A|;m~} zJk8r%6kkkyr{cVx+^zUD^0QlU{=8z3;`2y;ui|yYdlcu-qk0u@r*`R6oZE$;-^2Z6 z7U_=(5o3_4D(1SWh?kQ>x@&CZ16IRpMoe51{jVwctMim&aSTod(5A zi8m`gjrbbHd3?1i{vgSBD9+=qQ}7o-wv6Pv6mKTJQ}F>*|GO3E`Eak`dq4;K*`s&| z>F-sX`(dBr4_^ok9d~in~3Ks&ew@~it~9PUvWM!@O|j)PZ#Mg zQ}QnpFISxPFH)TK^ZmT2A9b*wYlOVfP4&~RIFGvy#qTBgPQ@#UcPYM@_)f+7I&rt+ zWi&4KD!zs4p-1tp#CsL*B;KcZH*vl}1?%UR!0sd-&$1Eb-0oS5v)x?9yGc)>;Cq2> zqMW`FrtF#ksu_ijSvuEK__QpI-#WM|{si$YN`4mcPQ@1y?^2x43*Ca>K(e^oqxc>w?_R-g67oHoQ#zKhlu6P#tlO_0iA)l-GJCv3u_y!@LuXuve3I*RN z;s+?LT<|Xl`9+GqO69E<{8k~~p!i~vZx)=_2$*e+;=In`-veR& z-zM~T2zlfODQ%PBw+s0#it~B4Q}8>4e3#-ql(tiFJ{MuqZpC@N>K6QqLjNAc^QeCI z3jQBLzDIFBkM|0GmyqvMoWFNIDEKBJe^~JnPRq6ttpCl-U>{eU*F{-^-!0^G73cXO zPw;z$e7@p5ehUS^SICzt-cI$I5d2F*zD)5vN-G!qJ|VwI@iNk1E%=v(e1qa#-e$ph zt%TXuD9-b3yWn3D`a2YlQ`#oMzbfRnD9-+O3jQ@A-=#R~-zoT3A-`L3o|Mv^|xZ))wpC$MM zLOxgVe3IwiqoDq83i*5?k35gk3I*pm5|c_5-$m=0gy7#I9k?q~oadi%!T(dpFH(FY zrBw_5kdSXsoIej~7M$k{%(h1H4${>w_;#VcL-9OH+a&l7A-_fOc1r6M{M$mlOK~pm zPQf1*^1Bu1>!xnO9})6<6zAvh?iKtyLcT|F?$5n~KPu$=6rV@^;h^9cn2?Vv-bVd7OYp~qe6Hg6Qd*wi-xc!tich1oLcwyZ_u#ET@dv5?n+4y^!mwYX_&%!7cEO(z@*RplO!Auqe^SVAQJm#F z1^=Ot?@~NY`gaQcl#t)8_!vs-7W_v-evjfMl(tuJyuX6C9>ot*2kjNSn}uQDr}zr) z|AId&Y`d>;87R3uGtyAz{2>C9>7g5?y!SVAb-gYa#hU%wV@VzVy`#p;D_wsuM z|CNyMQJg;?=oS3eLcUM&cgUZEg8xRyA67h<btUg?wD`ktEOO$rv2pAmq8e zk<07)StNs8Ucc7~-Y)cP6nvfFU4pL{oaZRiFR!on33=9u=&<1OdYS73^~meuX>g1i za(Vq*EqI3&F(H5chw}1zmOqC>F0Whn2tD%pv`=te3!?#EN1z^gy;(@(54pUqexKmwQG0;= z%YruxzD4jm1((-Tor25jrsoBh*GD~qZx#Ca{uJ~_Uhm}f^Zk_9H3`Ax^-HDTokD-R z;P(sODfk0|^L-!a&o>3%C*&U#JWk)|qrALc;QJtu%j*KZ9|5^s|E~~wcxY z;W-vbp5Su5S0cDv*VPH$ZB?4^PQjlQ{9(a=EcmN}KPNcfw~6)hyx=+M_5k@$1TPW% zMZx)gNR;0r_(mcBQ^EN@LzI{6oP9!Gu4npX*vu#|*Dbk%%k@c#;BpLHu@4{~|l|B2x8yg!)Q5#`&3o*Kc| z3BF(O^@86>^^AHp2>!U>8wEcq_$`8ejp_mQd_nN-nf3trt%9FFz~>!;e^c<=1fO)0 zFMqq>j|(o(`%?${@^=dP%Le)Ui-Hf&^0_?kzaY3g@2?!<%Wo2TwhAuK`yUE^w~(Ka z?dy@}{ksL1=l!M}UtXT~zbd#q@6Q_Q%ggire+Vwm`#%v}p7-VTqdf0FCf399y#JEm z^1Pon-1kSG_jd^{&->@(`ttI;KU?rlD`G--gfD-;;NK8jp7)2G?90pZ{<(rbDD*5n z#h3q<;CluCPr=_7{2{^L8|mxm61@IYpKlkuUGN=(9~4}k_cKrP^*k)(r=9NeM+C3P z^SM0luMk|G_g@<2%kQ*N6TTt1Jnw(w3}60nA^*PM-xYk^XkT8Q_csgvJt5yKxIFJy zjPdpSK*&FKrqAVh|7&OYT%Pxf&i1)H@4qPc4~70a@_l)E-v5Q*KN9k}V|{sf-fu1N zdAE>%XM)e46?}1_&wng*kPez)K+3i+x@zWg4+M^ETNsQt`gS*Kl8fsb_s;&X2m!>4Gtf>u2scmXri(YAEP&;ic zO@T>RX`*hLR<|{;ZVS?(1RGbe9M*6hRBn9>l((k28TR#SnwwezwTP5}e2pu;eB7`o zRbSg&6_V5f$s$QrqDV2;s2ae<*2dPh`c>9NOlqxx_6*>vV9V-P)wk3@n_?wv7ef=# z$)rT(W>Q)}wNRxsuU@jEu{O~3u_e%cs)TalxB@sJYF5=%t!S!Uj!smyu4rnjy0)>c zp{ltF99!!IxL(`X+yET{hh^h6x?7$|qE|PVy{>-A>Sa|mOO~|M!x4^etrF&fqT;IN zmZepugL-Y`SHUs7tXTrRR%;|D1Jl%)urdL)UT7WB;&j!Cj+xfFcIC?Ywif8ZoLd@iUS8W;aE5J#d|CX#?x)jDW zYvdB+Nw0P#%+{;GliDU|Z;T|L*;;C@HPc7UvX=V#AOSV1@X(iKOQ5&~&vuQg8ry<~ zwBgFK={QX`3+q9TjVy!u+Pa2hQrp%7C%7fch}N%!+02_*jCgI$idvZCYFi)yo7gl7 z)Ri|)wi=9fpn4mx^V_Rc*N!Reie*i(a%fnIXQY*lZ79@K2MY~vHB*x!k>o!18(0O^ ztPE72db(e-wyi$ZNVr_mVn{WYT^Lx6SQjnzIQg4mwZY(Dvf7$TQi1*+TjCn1HmHI6 zs-|XK!$BXd(c0|Ep`~WkGE)}M0M`sULp`9jY1PukWvg52VZO25sI_TzOD*QJT41>( z8-`UtcSkMtEiFx$Zrda<5yjNn!C$uF>2P(kG=SnM=>a;Dr}khyfimH`Xlgp9t`m_7 zER*URRwlp~EPHF?GP5=ht{IUUkl&m}13d^&F*Zd**p_cxwX{jM43@$!ajN`*2U8p@ zBkOCiJ9@JLx`wOO6-{uCY^iU?&cCY7Ty`YM;Mq1vMon0)Z8dfo4IQ`MYEcqch^26S zVI~!D&aBYTUm7sz9CuW7?nLBK&Kqy2%gp&!lQ*i2khwgmGF7}}b>oV*Ml_ZrVw&w( z0`?LIE}mLjYnI`8C0vb`;em&hi8IKGdcPsOIUDAKx~7%dEpJsx$yHTQ)v&CsZCGBl zw5D-|mM1Swn?q&mWLi68U4@Bw7LO&AvIY-Thg!UoVilfJg<*BB;Pb2&OKK=oC?I9(74yt2X#JPztF1K zh;jL_-zI_P6*X;3n_5;@U02`I6r#{HHVqA3>ZG)QR>5u-k~KBStSVv3h8inik4?8R z(2YC!qT7zxRpl*Wz83*4n}vE>yW zmnblJnrj+cz*R^Huw=Lxy{r&LX&IfQ6Z?4*Fjq!N#5*Y`Q5@t3pk{CU;n?;*kE^YB zYA21dqvf1bC?m@Smzbcv(#E&U+2K(87yI_vZ=Y?m`mhU(dtz!6#CJzS&%hA zUjuE)r&&3v_)>mt6+jl4QeY;6{o0jgzofObVA+bMC2%=|1JUycIw!6}p<3W`Wl%w% zWqS_S)>bWRXQ%pG7gp*8IV#0|gEH+`02_b;2r5Ki) za0-NL3MQLyk_k&pIMIZ~CM+@`1dw%#v1-C85Y`n;Ht|U&EHU9k6Be7W$b=9;*2yNT z38$EFvI!@du*8HDO;~KgA`?OYStnsw3gMc9DJGn3!bv79G2uiL7Mrlhgb+a15@Xeb zQ%ne7$$*+kCM+@GL=zU9u*hWNC^g)G;4gt$YOUt%dtBj+LK(N6I;L{>6}AGnB1TbR0hVZc4_~R{B+-2ISbNW z=dXeMnxW_>DnFMK%MYR{VBiJWzkviRQJL7Zt@k0nW+>heU_T4Ewtp%Z53;|P1P=(?7}d7$K5WfU zZVTBzhzGD?`$1Es*#8l9sv!Hju(QF&ziYNfskZPrfkE~=9<}w)zxzV_Iq?V4-BvwAEf-e)3)$AHJYJp*5j%D z59bnH{)fPLkbQn061QKN{Rbd(ko^SN@1cxXe!SI5+kYXX{QUf#SJ^P_wXN=u^5=dx zwf^x|C~bdwNc+zlWDTEc)!NCe!Cnkzb+s}gh znxS|({ou5e@}vDc_}BJ-1N|(>{_}%D7`D9Q*vIFY1=;WTo~?gb{xd+Iw*RM)@qYj( z3)uK~_4X*$*6%~cfA#mR{dQ6QF`z`-$NOf3%3q3;1#J9#411JnA2SD)zxM~$ey^~9 z7AVp7e*l?-?04W~0b7aPd7-xTH~`I1xcdofKbLZ1`{%>Iwx1i){!fwpF3Qh4Z7VyZ z{d>rMA!S7Sr)|9f`87k?ML$gKf5pJH{Zn9^1(lz#Tgr}8{$Y?m$bK`~?;^*s{5Y1h z{l*achv~lDQoeU&_7_qA z4YU6!qhgOzZT%S%g6vm6W9z?*GNS#t z@UQLv@uXn;4Wn$v{Nt4WcaT5Gew-dGD(%k;upb>7Y=6@k)_$Jdd7-xT&ye|lC)wwE z#`0eV|GNBN4r%|LWS^fK!wzWscZan99{kK17%U?(tvHvZCe{KIExXue| z|9N9=#yq?8LT$gdd+?^QQZ8e3Ie@{U97lR&ce@aOC z-y!?Q>wm=|zYAY79 z{%rWEH7xsIozTbpx)A%b$UZ-(Da`)r5c}<9KThW_tpB9}_OA%BzljDe*H@VR1tIo3 zewJGPh5-AoM1$LZ3)$!ANQK#d8S)3Ue<#`J=f`6CKObPfAY}d>fESCf-D`JVsBMi6 znST$yWXr#aa-#he@Xz(h?SB<03>tr(WPh4x*+#T|d@h7$DB1pUYW=SQuI=v%ssDW^ zSpG*t>VFH_m-Byffc-l|*1ydYu@vweEW7hUUDjJe*1vlK?6-gxUH;mv;QH?)`#U|$ zHlpo+4)SY;l84ED8Rf_JZ-akre{9J7yQRctaYR@;{Fs7Ql8q`-?)(Kh1kn?cV_Ubop09;|0}!GYx#6zl}2x=(cVKpc%@Ry^?DG zCg9rs3}8X_*U;}l$DlH?X4hVH0bzutH_fzD|V9nqkh~ z-`I>hQ8{er|1I#Z{l72d{M|MOb2-jdyYoVAYjeo?d(&^NeLhd2{afK*+dmYte$B#* zZP@s^ZT2X&tbYqxzjl#*?*C~2Hu%@}ucP*ZVVJbtaEU#H={afBT&VCy&+u z2=c#@^1tIr+KBcazn|6&B@h1IdUTNTqyL-WU)SGDVfSw=uo>qmhqWzyZj5G_v-c0y zejepV`**{?w!b69{+$)51)eK-9Q)r2vG4r1wcjA@<62VN|69oVGpEv+cQ&eq)n$Dv zWc}IjN1L&k@?-h$3$ULP(toz#hXt^~8we%OKO^uZ!{@Z~T8P#Q&aN>$n{M zUjaM1{_tb=Ap1FstlRt?NG^n~Km3|hGnDP!Z|%2>_WK%eZU3~4VEehBu@(#M&I`4z z5s+Uq6s~^V+OMXZ*nVG!e{H`$mUwkf&wm$|yQ2lq3 z{WVm7?0~j)I^@?3Wp^I14vENl| zExvP{_Io$Pe(sy8_16_(|4jP)P1oPO_16BGcISo49p}nn!S(kP< z8uGt~EMx!sHvH@QyPoW8|6g5dGaj$~`-5?GQO}=!lz-%L{EtBXApgtXvL4|%7dQ0( zJMgdle;WKprn;FEZvY6}nwZ^l$ocs=LD%nL`L(=0K0oC8y_fu#>#xVaDCcKB94Z*A zNY{T>gY|F=J4$=b&v+c%XAqRXi}IJTAnkQs7gPHyG3OxV|LI4`DXKZ0b3^*yVJg4* z(h^i)`+X1o*?%to|3JlSooMliT1%%Xhqde_H2yJ<+}>YiB|n9WUa{%?7ln-f!{cp_ z==#`ZM*nxizxF?q&Y!}Bi59qnh`+66ZM6`YawoR9avruCN+bMB`6nsYwp_vQrm-z}7X50p=C zTz+PEL4MUmY*MwQ{N8)4zh~f|^K<{(K=xT5@2lt7^8bLI6UAKne^ZG4!^=|bKO12G z`!Ig=*hgErw^>>?##%g}X)ZMW^>g;e1I8AumyTRG~UbO#?L(#MyA4X$4-jDX%(Y4|9!$)6tj`T)P zdZafx0RA)KKLh^L;Xe-l{oy|i{$udp5B{U@AAx`O5pd^Tct-I!c(3`S?@ve^dF!6U z)UGLsBXitgcU-v(6$5r48?Zdl503Nv<56i&<=fzUwR_{^`=i5lycQk0IDhX1Jx7b3zuyo0s_D+vqhS9Q=t(5$$pJmtpr=3R ziG!Z>9jF7QrX038%4x574eY)Sb`OBvH^A7rMHmRsV&$k8W^Z`Q&u8rgyU z>pkdeuV*`(d!sqy`uaOZru0j!9pxm}z6N!MI(uWzu6SpA#aEVO42gGkwp!1_Hk*uTpq0Tz4 z$Xa+h^yv9`t>;bXF#+ZYcUaY)rSk{mWr_Z{& z7UJDdPV86MHZ^dJcCf$pMNc2s3;zv6oT=Ea`uf{G#r?_!y@%${hJG>&`qND4H`t%1 zZ-;)gnfsKPvzED#uI8+$KWFWRaq|SsB{+9spW^we7y2E~T_4D~>klw@ZGd@e1I$|+ zVBXpQ^VSBKw>H4MwE^a>4KQzQfO%^J%v&2^-rC^8zhmaE4`J?dVD9?M!o<|0&ImJK z{T9kU6UvM8*r;g#mo9YdJT?X9G5AgkhI1J9J6Klc{0ZhSIJs8-3Ffbw ze;lnmnsBaO2l_a_&C7FFx|#nlZwC5EHvT+1)yAJ`enVMPew?qM{Q1%NOYx|41m}<+ zKpmVy`#vZymlMZYH?*^yqk6$7)8A;$!uh2S?DHHo1@yyZK#pWzc9Lxd%~RM8{`?bSkrHswIn<(b^p4SD_P4lPYX6!nWVjIVK zWTG6$v#6mXPGTE>DhMlkv!NWvM^fFQ9I5tpy1?w$t0a*;fS9sZ&|f$jC&S4Zn6j&o zfur1mlQS?q>~-RDhuqKgx=6X_K1FmX%7}NC1dX^4?C@4<~S6hGyX?kAJA1 z1c_~;Js{4=`{OHKz={h!Efooh`if6@Eh4mV6fSto_OGo)eA^2-DixjhT7=67YY~o? zQ~CadwFqa0wFpP&d0PIBY3d5r!krVQDbnZdj^B7!vKF2eT<5rJ5$?zLlAYx7&GbR9 zaLXR1Xt$4^r)aN_IGXQ`)xvG#DbAAyPI^4z?i6zOQoM`yuCt7zeEP<$9QP-hWjwRj zd2`Qk$MK!y^8n!h$Ju$;xr%+CC&W0;_?=#Ht_ms+`Qhz!bMK^-r)ck* z+u1#FjOZ*|Db;ViMs7V{OCz`50g`r|Mv8emt(a$GKa2jD`2>8qGS!zWQ+>J8bAlq; zmtDmD5-mv8a@?7aJ5!u`PSm+8%Ud&XcQR1>;|_Mu9GD%84$K;U%D}F>F3VL z&dfY7^ZZQsVk_T?4jhSh*^Gh61(}(^Vurytk7>i4IoZ*HR63m)W9M%1WN z-J)#Nx+wFi*p=YG8K5e+2)rA8+j`feInJ2d*SkPB&&YM0GXXo8#c|FG^v7||_S;}i z_Oub`U_PPP*&`T@^`)%LIA6wsb9^u-8(VWcwPp-!@7xk91|Ae>SBxRFJi)6PlMCK^ zM^$4E;b~Oz5FSxQHDyvKV&z;uoU5h;Rbkb@rzyCD2VL3YDbS;^yFwc|^@I5fnYfv- z2Ivm&9Y?ZZu=I0RMGY~bYr=>Lqb9WXzr;*D&4m3;2%i(dmTtlf6K0xlfC*1B;Xo4( zGGUep2b*w+3A0U@W5S^(9A?7dCd@VA2os)c!c$CW-{*L$iJxY|(@mIX!citX!-S(v zIL3r$n(!6OJ|EI1`>@Li@Gjxh7sxoujXvM8C8&$Gqf4Pp;#d% za5Avb(%LCo^gN@oe>~$(Aj8l_k>P%n%D}wCF<0*65X*AlBmwJ&{%Ox+Ds27BPsUxR z+kb}F*!^eOzLJ2x(tq|M!%h669{7~rapobvc#-QLlvUdUY{&j{8pOfeHR9ls4ts!} z_Mf-Kb%vuV^2{&RrnDu1af{3`J@H^9VVw9b;K&T?T(m#LXLcBlS|YQ0{P^r%6GuCd zi~3CbT9m)|9VhK+(jA{|ba%urH0f^xj!(C`Kg9TqgyC3$@tN(;a2)64>Tn!}CZ2H8 z27+ST(l0jp%G0gBg@DsZpNY@NGWx2J&&)INyTu+p7e=dp_{eBjONv7*pnv!soNfHWN0WsgO%~pn zoVqhP^|9pC$C6VYUj#$RH}tql#ol{bpa?bpV$Z+Oic@Q&Q$GUgs5OLs~#XjR_xYRG^CHIR<@x0@=z-7tZWPWn% zm1Do~>--9AF8{D1xkWDjEVPK9x-eO|5>FSS?Fg`5Vl84_mQ%gLTt2#7lm=5eAkSx$ z7}r16lSxmisL?kj373NbXY}n!3>yuzLP~Ph&LlBw`;jDeY}?M+Sgy4D&5VpcS{;g0 z_R!CS#mp>k0yDK|;E6b+8l;Ed%$<+QA_cC|_SIw^N~NdB$-pVpxY7UHCgW?E(Zo)` z7bAkooD4is7(E&PFu5^s#-dAU*AKYHQdR_ z2Qmat7#Wzq0Ml@5Kr1UT7CYOR#6_9eV)-r(MgMrLu`G|#x_>;*#lh(xpQGf@F`oG8 z<5l{2lU^9zyw}=4*QCR74 zp8#UFxG^IXGVy1HO#C+tLS1F<%yIHfzIpG=a{Q@%6$Z%OINrw>m{((H4hGrS!h zANa%L1je;DUC^Xbej<~K$z&!2JA!)r5p-;meyW{HilILYnF7I}nWksJl6V)b(=%t- zb$S~lWX_^>I&!lH!nI8;%O^C{w5)7ewYCY~(+ZEd zpYWH5A3m`Awm;wZ#2ZiE^Tv|p{Yi5Wksmk;3T6nI0+SAJoC~pg&|3(Fd%8>^h;;Yn>S~A zSQGi_!R_RwqyB&<_R>u?q_&u!4*CPy#!EL9a;*H=BLW-2Q&EH_jxA!W99tx$J(I1Z zww#x4OdKOUqn5r z7tL8%7L?CR3$W*>T{Htey;l>IpPE|R(<^3{V3*fl-ME~@P@Ud&tKyN_1n>5rJmKHKzJ)Hr~;pq%ZGdcrDm#;QF+0;OIvQZw?(pW)Q zxglvrZAcpG3>ZtEw_$0hGc3*cncC2v&VWwfS8PB&I=#-nDD?Cil7vo%B%zOsDi;Qg z4$KvhG_!0v{J}d-)F5PDRX%^-RYemECusp5ahF^fm;wzKoPvG?r=atfTv;BjE-=aJ z^OG)}4|8178pjYhTnvzX-2%}N2FNiJzcXeOFp(ui{`41k)*ZI>T%Aj zWMcvctRX=f`ibX>FAV3Y06H-k^IRN|gU=NKNqDLV#B-(xVD9f&!4r$C?CXy4Epe+` z;b66-{;N_Uffw4X4fu+6lq;G{x$#Y3_!>4kH1FXyFFp6)3E2d10<*6_t!;vr_JU@o zt!5d%@N-#PgRi_6E(wh8QqWb~w#KPjy>jJRr?z&bL$9PmNKx~mSM&NezAm5y@?~XH zo&Ul#N83LI#SIW%JH2 zpL(SRNq7OG_ZCEWE8Vg@uST(_kG}h#j2{NS5!>D zs%qh!PtUHZysCV5RTb2nFNCFOyhghOZ%W2@p-EqBSHkNB4Rw}5&6dqGRX(`{WXj4M zRD;gq-jouq7+ajR4!j!C(+$}?6;OBZ2d|%kb~4f8!YXVf`{qHYX?SN^ea*^JtaKZ# zGVhkIS`8)hH2PV|GgOGvvC-Ayv^q7lwa(S6>sQy?FzIEnzA)vkfw%W!0c^9I3cy3J zxjdh%s7C~(a2=WcESu7kg<7azWnQIc-r5U2I>XiAAh%vqORr4?Xy5}-A5U{5MwB$Qog%cuL z!1qSt?5&d99C$x7G>m;=eLcQZJC#t2feMw|cR^UB8G7~7rS&a#vNlnxWL49u+Iq)? z+%fR&vh-GYGgYc%7V|q7x#RUG>O5WtGqcy~Ry;{L^=lg2oTaN*tibM;tP0x0Yj!%r zm=?k^npSrHKlxOSK82)DLml_J3dg6=;yo*-ygWH z`;UPq;SRq{K=8l#AhB^(?TXcP^^0j_hkYj5)BvAOw$?45unHC$*VIp#SWsLrsbKPi z*0rrIO-*eRR=2iHAXO7;YFcU=;3GtM=j-Y<=VH#qrn&wvcnPB<%)`_VI72@*b!hf0 zXu#U@XL@@KZ$rg3PAeQilhC_dnZU=^W~AborHMasg>Uy@Ubnenf|F{C3+)k~L+J9w4f)z`j=*5SViM#hi5dkQ{Dgdfatm!!jb{b7BL(kQROMruDI5Y0>Yw@5Tm3 zN{7YLH>5>>a?{+{d1=vS+_|xWwDqy{xzT4qDjS4dI7*98gB%yf(l1SmK5^4rgs@-F z``Dzk=+7YMNojMV-@hp`#!ZX9;m(bwznd1l8?;PIiyorXJ8y~~h)qe0_JCH9h8sD% zP#!EqZ;PytoqtJe0$3k8H~PVi>tnfT(NZuROM5a}wmw?A-V0;rq(!G$bF=2giotuw zsEa;%^IT96eU=WNfkW_RQzYJ&7Cm@l`~W;=$90pdX0PMMvNNLTky1A{YIiJqUM&4b zY0+;&&Xdxjz0O=PzdqV|^LmIU?PH_Tq6fgv;Q49qf+YN1MTy(p zCu4&zjg7h(!{SSg&|na9(xU%!(~~Iip%Z^NHuzRhG9g9D(VO1In%U;APmAuqDc*)L zh^)swMxKnFnihQ!Q}+Rc2<)G%7VMZ_XtW%@!PL?1QLLj6 zZh*dPdYAPRdRJrs^e38zQ+8i~@z>A!`%#_nt{Io`z&5qnN41H&Zz%nbMjpSkPu_lK zIDEgWwpR@|w_GKq*hlH|*~w4(nUSaO>U`|HV7R&cPEdFzvf((%ByV_k0DMuM4B@EH z@ct%u` zlNBP5H)RId#fPj6as2*c)>FW$4fp%GS+@Zz57Eyz9Kv%J9DMizZ+R4f@8Fa8M&hRc z7xzLq{L@C{=B8AVTMWmzA*a{+m}CA$6!I~K*Z}(>ZpirtTmzuqa6@ixakYm|mf+qk zYLJ#E_?aY&yD`LddB+pirYB`R99BKmVJ0zLWey zJ+gm}5q|PD4T?(ty_+Y2cL@2>q!V|t-^%jhc*jlm&wir+$o|Q{T-5c${Z`k{BB4k2 zXPlqeuB^AX#pX;e&kmP`@Esxiy%0W)%8M%rsULn|Wj4+Cgz$mnzn16os^;`)wUlx_ z9ir#G5N?0NgIAZy{^L81ann4nUogK@aM|Df5yC5JDS-N={39Ve4etBIP0N2HgxAq2 zLCgOtgy&L6(efJwm*=1V4&jq&$%1;M{LLYJPY55F;g?tHsSM#?4dK0EoR(19&)aB8 zs`*nPd??%G z2g&oCj~rLg)x;;#p5<|m+f=*r{2504LdC}spRM?8;+H7S^YQ}4uP1r_Z7}^jpDz<{RQxUCO^U~99$BsUS;Vhbd^+)Uit~EnR>iL+`7bJdH}QKEe}p)$ zKXK!F*h74q#UAe?{w>ArZ!zujg{2;zA0Jcl_P2u$JZ;i$Y`1~t%^xY=LHs$zzfJt7 zivNQ6FBShg@!u#unC96(C|*Q-zv2ss|3&euiT_pc&BXaU$mM;E_z@+)hxk#&|3n;a zAT=B7`G|O?;zQ|tfWKA7jpd7o4_EwB;-@O!NPM*7w-6tz_&149Q2ZIo(iq9v0o8qg8-=+8$iGNA)?Zm&P_zT4ESA0M5hZO&W_#=vsp!5BA6`w@>3B?x> ze@5|@#9vVSHsUWS{vh#J6n}>JZx#PN@&8u*ed4bxo<-}AHxAut_z4?tmNktzf|#R;`q4`Zmg$`_*IJELcB`x`-s;o{vG1W6@Qxeb&CI*c)Q|n z5y#I(rJo-W|Dxi*B)(N~eAgpx4=8>n@y8TT5XX0f;KucXkGa5&UNP}-D)aO_M)LFuD38BPoL+6?asDymex?7PB>xx1htdMpexB@?tCaXBO1_YI zoX-DT50??QPlE9E%qDK1?BMfjh}-8i_G>#xM`_)}{oyUrlco50y1qJ9ac-}1if<$NDT+T&e3s&SiSxRW z{du4G=ahVm%C%ha=_J2Kaju_x6<!71o|%eQ5x*pa^XD_H z{|=JBPRaj>_&UYEP5irx?A6<%UlQM- z_(`PyF2#ou|C-{PNY6uxbGdda{(X{vCWODJIP3ql;`foBKPi4c@i?vDxxEe%9~8oe zE5489M=SnE;u93_C4Ro*2Z&#+IKC?mw;L26L-o9YIDVc+qDFqRlD~?+^2K+b;D+Uu z-vW0Ej-P{ll@h-#IHHR%Gi;9vj`F{t57M3#9OWNCVc4D)9OZvU@;?Gz*gsva<36An_lKfu;NBQeW{%yfg{%<7zf#4|LP4XWJj`AOqe2lJ>xIWWp z9hNRQ$`8N~1!2n(9QEhXd73{@=6*Pfi<5;PZk{Ie?lJ; zPZu2J*OB~e!BKuR=`R-?<>!%nrQj(43h7^>IIkc0x|ZvW*MCo#2iU;vFN*WCth4EQk@fTEvH0=^+?ezCwVzk~ zUh?N!#rgZNjf(U2?PkUK`@*jYPE&^QV>@x~Z!K7goIfZ&kNWxF z6zB0Wh^~XVTy-Qrf;hL!=c!XKRs0LYI~Ctfyif7xh#yhBhj<#TquK78#IqH*4?l1m z`^-B3`gaJ;hYOVa1mb+%%=#0=Z&LCLiQl34a^m+ZehcyMD1IODUnstvI9~^|KYV@t z7bVZx4Y6M4lo|je%j`9UGk6bM{%JVwsM!`{@=l6Ajqdd=JUlbhW;ay*5 z+blTB^E&72f}=dXV-L6c1xI;a=R6`f%FiSD#{@@tUgz+28`d+*-%aw*DtTV#yrMYw zll_WwKl!`jy#8@%QOoVi{b#V^y#C2koX=C^1xNpT$p1pYvAjIb^K})Mw}lNQc<87nj>xkd2_*Y0z zr{L&MAvy!wcEQn~KaudWTfFSGm7Wayq!k#CCl@CewN~VpU^zTdA-D+3$mU= zq<^WB=kJ|c73c4fZzRs`)gKE7+Yc4bBYsfv1o3G!8L^%x=(=E*;tvwPRPk?-o=+=& zJ;^Uq{ENibDqchU3ySmSSNABsgY0%H{xtDN6#qT(Clx9OFaA|ji;8OobG_PQN zNqrj@qe1;|Ku^?cbW=`-+va=)h}7Stg2?ol9u{woC5sirBl#S zzoN!O3;3s&-VYx6hmoA%|86Px7nPwuwL~A1euH@|tNb&|g4(8)E9>FM)B)yGev6s} z(3}C*j4gEwJVvX&)uB3o-#mGGlYX8nJoD0W@!bEYq^pH7#|d+SVcbus7hxXa!K2Z8b}rg4VSwaqn3V`knHax`L?=1f>{E z!C*25lQ1a3V4^c-O+hgRMR-_Lh*6$;yrJ;#M7F@VrXiPU-0TJ{>qA7npoo>j-++hYCWC6=~7JwPYsyk#hc@Vf$4|JwdW z0GeUG%c+4IXSv17xw^9;L3|8a@0{m1*{wNA|O^jHiXr_+Rfpk<3g z>~CtZdCDmR+Q+8Q_Gd#nis;GUbK`9OFX?rV#h%Z9gX5t5?|sS&UP1D_BX_*~_mh22 z=lz@uIF`KU{7mzx|EXqn$|?UQ7Nk9wpYbV>F|hqwtwb3KV*O!NaDE>DgUCLKdAnY+ zUrnEHa)S0hBgB3_&7aafc4=)N=Nb4**%GrXic{gxF5WY(^G_%$w69*zvs)qUacAQ; z9*{p55vUOaY0 zdPX9O$?ZJDC z@g35b-izr8|9D-0r*aSIfi-SUy5sxR2_O5W=lRFe!LKrqgG-N`^gQ3cPV_(FAG`2g zu)epn_)w?#Fes~hROZ^DE7aR25+XnA0pV~jM7T>kLKRR^W>)_*S(Geys5pj0G zeL6-D$~u|Oqw>xv8^aM@G(&d`PgDb>yC3FEeHPky zd(*%_Q3>YWdA{oo$AP1k*K;O50Zd)XMc{TP`>VtUP3wr!u#MIN> z$lLcrT{zGuQ2!^_Kih>e_Henyi zfO>u(-j{wP+K>8FbjN$ppFV(o)YsoR5_b|$9D=@*eroy<96xVDS~u9e?X<*^+lM8l zj&-x|7@PjHua3Pj<7*eX_8sYY@Gf*X-{r_TY0DYT=5=xC1JHj)j7mIlH0m6ACgL1v zO?P&6fUZ4JXV+MG$M}VA_S+qi_#M}+zwN8e{m$n7&@Wz#o^1LC%C$yLe(Ap=C*Kiw zPrl=Hu-9>#b7Vi%+Hhz z=XQ*{!-{dfuK}O_3;G$(+t~m1k9IcW`{uEn`2RuF8CMPOb$_*Hy7&uP$LtdC4#vPhJ3(7bX$_8U(re8L1To_+FE8=k8 zL_eQ}eCQwA!Mfvd;ea0;KRPoCV{a&>Hj`yQ!Fjit_{_Wimd8BuP3;)g|XcNZGxbBEk(wB{O==-$}{OSW8j(g+d zD2HvT=Z5KUj>ftB(ENGe*CpWJTqyS(D0kGfDf}L4SKmUM2Zp`v!ugo>?T3E<8qKBb zgY)sxN#BS01^s>l>Ke`m)aQonH~{j8(HHW!^P{7a`p!-qc^~>%cJ#)_8_{hsUL6_kwd)5^m$F^&gLcJvZ2RcMk+?hj z4)7zSU9C;b|0uNQFlg6DxLxUep->-5TMiw;yOcTVeQfJ2x`9&piU?k|iZzN`kKH+d z`15Lrn+*`(IsmRR8c)$eAC*v)KQMrd{9EdTFExvzWj?Y>{ZPLQHII@GdRZ3u!ZxO} zaQY!HO9e*{6FRY1HFNcG-9?;9+qkm0rXtSdZCqPiRS~Dyd-pll6-B zFK4s7*XEhi6{rKN6^`O3A-K8DLL2eJFfHRrM7${cW6!->j`HnR*u3T2_=q1$a02g+ zW=Cdu<`!^to`>M1p1g%QoggvSso*HzDCRm1sqQr-t4)3VF{e-S6ffi`R{^|cJ5_NV zXXJgD$EBX)N{;#-FH2Rtj1}@;D=wpi6|~3KTywmQ7_=!zd8EOc-gi;zZeNOG-Y(1- zYl*_W5Zn0RL0=E6eu|KhU2Ct0PQ0rh70BMc43afrIy*?J?*J= zTkmD3h}Ob0K-|;Pn5yN3J8M6(^1mCWxt^ACj*cN@2PGfn`+^)TOcJC6Z>LMo2_q>2 zU52A<11&Dt#z(9k1UWD7kFOg))iE1uvu6-K@^$0K8cAE2?pY)SJ&2?J6jPU^0uI8o zBs?t(IJ(b6OFOA+?)9e1rIhIH!W6SlFn4jZ$5ULJs<_tENRcqbrJk0B9L@FITb8Q$ zxKj)p_S>M6qgy>&jj4)Hcw~(Cv|P?nUQfWl<RmxLl!IsoVpctT+Ej_2q73 z${s@p;pp>$8JO~^95Qf&^I1LF0@oPtbyGD{!bY#)SFtGXb(VW6f#=6$gG|SG4P9PF z(Pkg9Zr*Df+?oeT0M8{H&muJu=PrliBR$oNcokMI#5i8(i?LZiUFRx}`nB4WP#;Z<%O*EgSKK#Hrr&X?k8e3y?n+Diyca-91L zC?n(EPESvZD1`;1&Rto@?OmLS`{oH;9;aqG?x;%5a@^%GcVs@H!bvvHajt1t32_Z~ zdDU6Z(VZS*^PyFz6(>)?Y=c`dIhARnz<((P`e`Sel^dA|KsLQ65T=k)y9t66)tT_W}^}3PcgzQarBM-4h!5oaz6$ zlgRT_%DuFQ4;GGB0S8H7t5=VA#X0WJ#9U%eo32M59NcKh=M1JiuR+7CA$wbBe*$fl ztFk~_#gBW!zkxFGISS@QuMiXoD+{}JLVcnk#m))W8FyP))@s+>!S0y@vt!YLS;J2m zIM}@$zI2TAbLV7dW}cUMKHO9i&3B>$M-GA;?8ZRkg3L@{F~i_TN@>HKIoZ*HRSZLFv#q(&N92f*&t^ekHLdUPXd4EWP@+9Qt&z3a~0BZ zvLS66s2M8UEdqVR&?}4#kAZo(Ll~XL$Ov%A^&C3+c5p9}yLm<~JXBez@JkFoGK5!g zn3_R9;TOvG0E=^4rl}*xIUNcu>LAbBK#@_l{1`pMFT5@K=%Mb};QE-M&`KCN(}f5; zdBOz$*^JS5(ifLZ&Gai1*YY1})&x^AKM~^Np^9YBiZm_Vn26P)Et`7HDSbr_-1xUH(|_#X(sG%!ng_3O_*WA zOcM?;;YlX6uZACF;#npfY{DTXv`-()F>(8gnqekB+=RI%#Mj=#GwV%wiU~)W@Kh6? zW*H0{UGeoxxFcc1M=;k{|U5ADa%eqY*;r~L%lm(aeH_7iD8iT0Ce zUq<^Ww4X}*X|$hC`x&&KN&9lz&!YWo+RyP4SecvzxA((DJ=*^W?d`GJ1Ad5FFZO%t zi?6_N@VujG@6q0O)+fdK7q(pt{N~vSc=3}{*uQa$otl$!Jp;}c<5O4^;pUWUE1+{z z&gme0f^%0a*Ga+WPhcGRbS0MP|4qvMM1ax~1Ga*yb|RM;h@B^h?mRvR&LjRjOi%3c zdl;861-LCScm;7# z`(6D)3@iqv{tmu-={1(%_wf^yg0ArU`?(ZZgDE@v`9aDMzb8eo2!FWme)vdvM)~g7 zjwfQCJ^jI6YBwwiHh)u!jKSb@oezif{PnPde{h=hJLAjU^YIP9T`nO6Qtf=GrFxZi zM~L{1C2;8OSCrFX?*4SBTmpw4_KXrc_$-!?QBTuL;0@7mJ9^1 z%WU@R3m`RU%bT!|1koGOr$O{)>?1++7pR%Oosjqdi^47asgELv^o^Z?%u77H8J$-o z@AyIn4v3uq%*_HwkX6P`hW*^w@sxfXq;G&SWRpA>X0Um&6G86L3`V;9{aG=uKWg#s z@beCaDtet8VNV@!fj{1LK&-l7${mn8(`4>*=p%o+?|vfN2P1R116E+9f;(U%Myj~a zp>O>C{bK5xl=2gQEJY~gAb%P~@Z{mw_!aP5OvsR*gk2XL8@Ty<`6+q*k^g$Pwcd3ez56J1eLLI!sZa$7tpC*~a5Px47buPTSkK@sW z_wdp6EuuEaX;1)ZkGscIy7}OA2g6EebsLWxKk~q@G877DyMRm||tVa+(n(CtCHXZ9H z_f)*ZF;rd<-$2zEey{dFoV*ej`-R>8<-Y;k-Cz1V9co{r!?M59q5exajG)><)hLiB zfnE?uPf4vHL&?K{!jvJe;=u@X7nnw50;-6e1mP-}zHl-+Zm^dzm24y9T$s~vmXhq- z%veR!oRoVkl_l9TGxDJNM_Au;Gs1)pP>Igi7t{Uy6(Ihq1EqH#EP*u=*dT$QLSSU< zjNFUhNDjId0;6t&ooq#aLjAm)B3%4tai;npOD zpMY#RYjgKnkkdwST!!SVad~if<{XM8ybn_OpTMrmw_Hs84j(2r7#_J3{Xz`v0kci+ zWIh?8V{)gd6HD%NSj=?Ui)JK98t?DjCwGj?h^Oe>v7GUA)UuZ!BbE53l-#{}O?5R! z_Tlr}eHa5!OC=Fms>y@xA-6*K1Ipl?tYginCG^0b?KNJ zcP4#}>XU2|dNDV}R!}6z&-DUDQ~jXaUHpAeed3RLUVV|~CC{a#bV?4TxY;yU&A7R4 zf^<1<(K&8aIc`&P@okjDX}V3#%Xj*}2Jg6O_YP9DI~n+_@9m6Tg3qNxol`vTEnI!C zB9S*qJeVHe^szez@wd$M`Zk#mq`%{%vx4}$Mt+Ntf6t`)4w+X=S$oY$(Xb7U(TCnEsvfzy`r#{KRDGbPv*JxKU@aj`hRZb+*YKQ zA~@&bxnV9Yb~DdL%js<9tj3cTp2p^paAnM$RB*DM57RJB#`&I^%qvK$l23MLEjQ{z zr*x1i((^ECJ{C-H6Yw``0{%9bfWHeS;C}`a@IQkIcq?}CU~%$NFnYSjP-W2jd&DwF zPtO=C4AOUqWiCE?#WF`vZzJEw$nO}#g;}6)CrS@SPv00WX40dhe=Ku!^dobF(J+9r z+qfGY@FO$cCg2(vx5Uoe_i!~#g96vX6v$o?XLkQ0%szG7qoXWxbl_E5Vh>JMql1bz z<71!y#Q1>4LNGLV9gkPY+ciSAV{9BpV*^LUw#EaF7Z?vPUgpOB{qb--II}a}8%Z6) zP3+ePX9;pCNc?yEKjwis)8@=88oX;!?MiqnPtltC=9Y%W)kVWc3@siyylC*sm1|b* z(bU{{aD8oS(Wp_wM~tmqx@U25{fIsHEFN1seE689W0uxJV9BW3nwrryV~T6)N7U~6 zBYdWPk^0hlExo;FXf3E+bZBGqibcz7npZWhUI$;Lud8XTS(N?t_eCR$N5H?~#fz4- zHLR?wmiOR5KKM5Mnz1!r+v=8vWvlD!iW=axMzbcCO|B}RS3PNZ#k8`@>e+Ki)@md&dMk5rdUni!h2*NCX35u?XMC85Ge6DLI}j7UO-5lN(Q%0xIs>WoY!wUMc$ zxvDZ!ZFmyt3{OIZQzy-eQW%kh3PX}6mChwk<-XY+EFvJu^$mZn<BMu4RuDP zMU2<9&XDFv>x@bxouQ*EP#c|09*9mRHKG_o_h zq0>4;IziyrkbHc4oiio!^csM%>K(LsOvP!c)+W@DwzD=KdAY>Ozy8z94DV9GK%W);L7;a3P@kx&x{q2xuQW z3Dw&O=&nLwUR7mTX>f*jxm4Q|(5>Jks14B3>ADkFZsK@QO+@W}SX$Y3?=jjFPoQkr_(yHlmW@pxUa@nNHg%wq4 zEoHMa;}xZoCr_U}wYp;FqU?cr z_{b5}t@Ikpnw85Mn;Tk}uY$Pd@b=EuwibZt^?J+l#%73u(C{&wc}4xY>eh8l^$?YX zzPn_ASC1}jgtuunuBu*Bv$74|If`OdNU}E8WhJcw23oOzB@L}B>sNcL@ui;d7SU#} zVNG>Q!(sK_(v>yKTD&FjLe3QqEU9V9QiLqRybz-sT0K<(ud%7Vxuz8^%hHyo3Fxe; ztE+B;UBl{SftSd_m5p#kmv$WX6EqmIEURx-S>W=nw!WpMzK*V@yz1)G%F5D()$^tw zP*z>Fu%fKG8uSK2=!J$gVqk6S+O$<{b8X{le4lN0b=}KbO%vI79Zu@TZ` zWV|6ZTU9k!MpuqbOYE#}Lz!A-yd756P2N%Kyb1#ddnDJ!^+t}=wXIsUj@v7(Tq(-vOs%cW4NKafPF`(e zbG-+>zJ(mhLjZ^3%7&%&tqm{?PzQ1W=+nA1ZKzW{pk+-hi4tsTT-i{&&TDI_Sr#av z803J8j7aNnlGT9;4BVuFW!Iz)uEv1~3aDmaJC&!BTfMr*RW%K(pnTfO?VO>kcdCNAwB9`l)F)wxmRWX$uirna_iRT~UL(8S35 zkK7icn|k?tYtKKd(({kl$?x5?i30h`5XxG5@z&zl0_YNtT-oj zZsKRD^K#E`e?i9!^DiyDq$}lJZt|l3Bbd=m_h}t>%)c~7&vM}(fG!Yuyf2%jH}4{+ z+5M^MQI>rLk5wIaEEXFsZBL)(z_PZm%s4!%vak*bt|R^_&|A=P#}dhpb+|O|60AGQ z?ap%eM~_T7k@CC)azUR5Z?*G$-~T4B6CO|;LD}BJ@P^^A%o~QovTqm;lN*M^xIYeS zSY5lat*(9%$D?j(HZF&|kS%p9hOLG(^qTr%BZrO{I(q1sVJ+)gnj0Hihqbjdi>hHY zHO;ll;r=7MC%kR#9+-0x&96U#l{k!lfSQ#JOPXt%*Lgh5hAv0%)vR2JgSG`?&?V@# z=Z!Rsk-#6GXrMQ*Yr>NsjZU~jo5;j44TCH~ImxxPHmr2&Ss~t_ZN*u+xnWfUx{$SV zGQ7~dt+v$_=p_0ci)(b zzjM?Emt_WKNDE@o7x^=i{)wshW)N{v5=V~ND7|ZHX0lUxtRr;k%&LFx`^ir2XTlS$ zHsyLq*{ywSU@s_lL;TsJHYU5I;&=LB%hN~AKwEBwa=Vr%`^`*tnVD>tJ3i^9;!i?S zhg5tcB(*y>6@Lt(yQJcqF#2V(b9u7eJu_4B`#@LcRQ$L82F!8?#K7!leen0KPV*ly zd=r=s0X$;*n||)NWWPC>;{qW4;#)xIvt*xNCwH8d>{FhKp9k`P1^M%i+Q>(V<1u%f z63_`7;Wq^59rbCl7YNNrc1q0x|AH0JE+6^1t*Q9gN9EoWOJsRxYoy;!iuuWY?T-bU zXC%j_PJm`awbPUS@geTt3c?-Q$0m0NakS*yBfwMfJ5<4Hnc1p#6e)Npw5GbT0v~gFEEl=iEQ0YTbv!KzFU12{J_h`{h zsRxqXrzJbjOzwm|BDvEv+z+0eESR3`p1V)7pd#60R{Pf6A!3pte z!D7-h8;047M{Gbh|1wUa;Q1p${d`;8PxfseD@F%FIjQpGnAFDj<3~`Rc{si?nRjop z-3hZGEf34N3v@zfc{)yA>rN1Zj{0022F)!;K+k<4j!k;=5xK1)P5L4f)uH|Ikbh%x zH<${Npwx?B39be!H=~Zrj@W>KkiqgH#2KS_U z;~(SjI1cQBIcR+X#9{-xCi}+kgnlqS{)~ssaT|m~9rkH5?{Cgw@q3(xr?6&ezd0)uvqKa}>&MXoN^ zHL#F~*gC-}FyZ}et4+QII6R9_<|6YnR{^s$!sfOK2}cM+$ZAUghnka}dFQ!ghD4}O^KXT;TGIGlb8arH9z+~|;$^ml#M2K^rc)n-rA`c=Gv`fS`-jmuu5&`Rxcezf zR!Usy(TVZkw+0%6_G~|(K-@hVnj!0WwjUhN_JiZuesDb74~}Q|TgS8et>fAK)A8*7 z>G%LVWNhz(|K*xUC*U`c!#KV;D~#VA!SVN5g{mFp`syE0SeTx7A~@D4O#bPJa^bQh zRQ{TX`r#P+@#6=r44?)_{=b(RCIaABO*h!2{18T{{6g4$3W5{g59z^e!g( zpr6n+8L$N;AB=aA-xcgBRA0$@1!QrX0RIbBe=a8Kc}J3bFs|i=XJaG$064V1pJM`S zz2La33(_9_j2m*@d!=XMw^DX?BD62!FqW@*IrHAY=^vHc=T3;nGB@$o_2tRC^d)l=uh$v?Yr7!SH1YCF$W^18lPD=uRZ(e=!&J-0Bo_PoU0 z)~iVIK^(?|)XVCZ{$uqoPpa_ z6QTXvitF)G#YEJD6K;R>^Qu8H9IkqX?b{I4Upp9+_ss<`xRlssMW z9b8u0Z;jwT$#FtxkCwk%@m@;LcM*I)Zg|wA<$o2ybNN!o%GX5jjS>8S_JRGn+|wiY z-y(PmUs_muu8rUyD4zbQHJCEGV_=WwS4Z&gBKUs11VnqZp5G}h=Ljru0{`X&<>~j- z&J6GP2);Rj@5Yx*R*(LMwATNZ2>G4!13zf_6%qW_2!1hNs#$w}AHm(v{oVM|rm1iw*neYN;W1TW{w7xioTpGEN3BKV#> znOZ$ZM({@>csrgbZ&Kci|)Qeh_|;<0BPE zd0Ch2Wq41>hZ|n!;wJj#Zo8!*6F^YxpzF8w~$| zd86U@ElJ$k+#zlMVCIJ#EX!ujiFEjkF%&#$A zeueuB!*}C#&#i{fV1BpZ2Q$Cl@KcySV))I>pEUeA=Fb`~>#+YZybG_l{%rV2=9>+l z$NXKxTbO@n_&Ll!GyHbuUmN}u^R0$&W)8n)rcK7hx6JWHUbqQ|7oE|Due!ob_(t zN5D<=oXY%Z!>?ujd&3`M{-WWpFn`tXub97Scp+a`yk|Im3=y}F4WG&U3&ZP~e`EO3 z%zd7BrM?$3&oTTC=JJDgk$;xC+_x0|l{3>DVD$WzndFkfi+iOj1FzkqqY;kPhfVfcg04>SDt%-0*f zh4~4FZ)JX(;obQ9@NC0}Fu%a?iOerG{6OYc8@`tLjfS7W{1(III(C!ckFoq?hQGob z|6YTe^dGtIectegSbnqN-!gyK@Iqd|erR|x^Un;Q&HQV_>zF5ay&!gOVD8?&7}&p# zxqF*pz%OFHi_vp7bNA-MKzyjgLSe~t63QM^B}I=)aiMsbvvb;j|Eqx>qCKilv%%r8+K^&G(S z;1!Cao_2iy;wHsWUjB~ko(Bm0b}sAR#PZ^|zq9@)l^)dp4EyeOimQV8f zOZt!4S!nn`*3;MUVa#_oTwbuVm*J%>KgIB=%w>Hl_Ea*jH}apc{Y{3$lby63WB4fM z=NY~~^GhT6Rm{=MR9ERtJwbGilclvxA$npQ9h6FH0no6i4~<*$=X=7r(*#oM}7N$lt^I&r=-r z-_G%i6i59sZ^-q5=>MAKZZPsPZ`@({-aKEyvskoAe~`ZyK4SQ}PRx73=(&>Zf78fU zu>4nsuVmhX*Y8s95zL1e{v7iOhRff*<{2)3e>#x4^pj(`U78G^#P?y>87}R3g5fg% zoMX83fB42dZBp(-T<*<=f6jcP;U3%bxZyi9|AXP9nQt~+=Dm*$$2Y>@)}F63#7>!? z<@!nZ&1~mbBQN*CCmH@B%g-?U&&-c7TwV)xtl^8;&Wj8`g!yBJpUC_b!>?ohA#?0+ zeCv_?(2K82u)a9%q@N99F7h&e&R3joF_NC;M$hr=_d^W-iuqxN&tv;eH2URl4Cfj? zkV^HuOO+m+AMWG&ZZ!OP=8qe`h4~AHf57}NhW~^4`-aoo?V)_R&XfL=$MZ~_uX}{! zEAw&dZ1@1?y$zT1@*u-y9xFC{0_&M-xQzD$4gZwu)xaFvUGB}IorfCvt~~D@t2p+b zUr9SEj_o4z!#Rqh{1+^LzTzk^{=Z6bl%LIhzfN(Kmv*^bag@J~7FDj1m((Z36j`Fv0{9VOSUi!mlilclbU*CPDILhD0{?Flb zX)ifX?ZaHg_3<2^Z1{T|pJn(8zHZu&x#+(I%EqnM$Y09x%|>4C&tGb|oWFiyxI8EH zqT$n^KjQY5;rB4l=kmqQ`T zivPc0ew>k?&F6))n4|q@&&60-*u<~Gmpkm;W8_ydm+NVfzn=M@Rk_%IYS|B88NQBr zJGK|~$Q+ES`Y@MzJ;wI$YUE{p9;xK9+_PDKso~c$pJlkr8w(7V^>eM^vQA!YxU7@q z`dj*gtcQPUFy?8}qhM&pu|1^9( z^Y(n+7JKeyUTFA2?hkzpm+`f`;ms_+m*FB`X1J`w=Nc~K;vmCMWBn@(7yXACF6ZlG z4VUxs8HUUG_veP+#^uVoSo|jE-`kD6tgoJ6j`N{@uH%nJekh-p-%uRSBYSfE9mR1z zlzB|nUuX}?AIWlG8hM%DVmu#+{L3ttQXKWmyjQ3=>hI6-?uw(l^g~G({VP~*7b7q2 zK0OD9P@{n zqo1)KKF0B9443ipvfmgU)K})uCL=$LZ=$yGgt<|Aym#Q5^Np=bImIDvtW&JP&+qxXia- zGM9dMJ&za3hxYUXJ&WN#ZXH>l*!eQotDE7iZ2wM%moneoaQEVO&)b{1*dz0;evTB! zi`co=$UjO}dftUb|8-pMb&6xX&Sd#p6i0u4$Tth`HGCuUhYjz~{(su=<5~U{!}~FR zkGa(MB=-MThRZxWh{v(W%RD^F@aMQ*(+vLu^ZAD7a=C{aF29TTx#3kTf4$*y9(l;{ zM_K;Q%w@dGxMj2GIe%QQj$**K!_vH*IiIG|d;xQA<}_c-yqJ&ZH`L#i?HOyhJcn6g zcpsLZX1JVp7AubZQ|y=fAJSf8f0L0H`_~%2nB!*}p3nANV7S!la>J!wa(_kak@k8} z$?LzfKVi819r-!M_1`yNGMsM-JiyxNevAifjL0thn~G^efb_{rQ2C7n>1D zJEFYykN6q6_QNL-#|{0X>x;kp7Ov}?nndpM*X_J zU#h>i>iUl0zdND4uJ1Jd`vY=aUvE|Ys@m*#1j75-;00&)HE8@oxS`GUD{F@0+Z2b& zd(zbF)kLVSeo5Q1>Y61>n(NniB<*cGqk9kCwq@kCZrhfUH@pq4ZCtgg9^No1X38tv zR>M0IvzU1)rz^tMq8YwI052aL>SFNrr*!U&H$QIMs?1j-Zd-Pn@5ys7&r=FAy$`R- z)3)Q=M&b3D@YYCp6=?1971c{?8diEkS2woS51l%D{vMQ&t`B>NU+|~O5O=AvzUM0= z`DK0E)|nyX+zl@#tLGZkFNgO7;=4}88Zo!IK8s;L(N$omP?#Wd?YfOT#gse_Q$gZVI&d@p(bZQ2E#;t_YcXcZMidCD-BfvjLT$Kdk(* zJm06+37pTCh0o7hhN2ZA<>QoX%g5)o!^)q`<;%K;i_a=+V?_DOxqLbQVg2zGV9P%$ zqWnc%see`fbrIz^)jEr{|M5?|w*0+-h1GvKmv6hd^);@SEyI#e;_@Xw)*t@_Xv;qo z{2W&P1yX-*2h@q1Evp&QEkn6`xO`c+Vfpx{4O>1wPaanO)jXhHL1k*QW$hGE{wH-V z(@UHe%g0-rw)|#bVdbyq^};yLF9%!xDoC&lWuK^bIduEuEiGIAdBDQTzmLn8b*s~s zUDjEU5LW){T>f%Y4ja}VFO6;a_W=tl|8jl~LDs<_Mw>0`ZlIQ-;53{VVbkT~deW93 zgGq@^Bzf7%bLS`N#ULbF+3zCS|CZ%W6Mpp=H>^LdPi^@Nfmxk^(l0rX=dp>w&dUB7 zfMqBv_Bff5Tv258tLgq04c}*_IJ*)@qM^{+;`$m-Ccf8BrWQ;RWdOuHC`S)Dt z@-K$=!41pDb+#>k4=!Kk8I;BCj0x`8o$trESWthl<5ft&u+4u>rOUCOWaOjdlOvuV zC9Fli;ryCm*vj6_^A8*{w|OpFVKPYlMfm!N{@3#oC-DgjqW}8Af5|WN!o^%Zi=_|n zT>#n+k_?<;%%SI?!`d&G*Dt#K0iZ+FN%^}%`)1W0kKZ227Xy$T5qPNP~07BfnC@ZG}8G88~0N_PDZ#aA#Am8>QQJ}Pc||N8SX>+AcOh%B zWEsVRF|YVC2~TDQ9+jY&?t4om2z`P!%qd~14v0xGsF`?z^F_C)%mz@t1dBM6>lzXh zgF#S&<1z#}l0H~3NWxeSK&elZogXo0_T zUYBG%FTY3cyaIndEF|c;jCgl%dY5?K-W~RVrFCMU7tb5tp#ubyLm@|Ds-)-n6L)aQ zgLas(16(8~y;u(iro(wLCq!&|7Zl7Ll_A)!Gn50*vZsrKNx4H8Kc3g21C$Msj-80K}~7Rv9`#g~-4T_~&fI85>hs*$@Qvez|1Wn=L%9EpvOmvYc=rp(C%pAOs!+kG!O z-Y3EVGa)zs^uI74rpJr=nIBrJp9Y!v#(Iy|5Or#qRLIolx1tM4vo%FeD`4*;R_{ z1}TYYei21bSpvUx-hK^dPK@_E^+}9z8L@r|xELZ?e7R-RQG`0E_>PoU<>iM5x+L{~rlPZ8W0mlw4Ar#itz`#zu# zx7Z-ReOj=)-+mPHL_1gYj)}Od0si7O0k@0E8vIOb0zQo%MDWw-fugCZ^pgXlcJbrq zuzr7UXGv~5e5F<%{_Zp`FPZS&ugP-#c8J?OhyvIy?a;|Tc>9lhMB<0P=0D@xsw*4d zw(XDmZB_iz5d2Sn+$sGLC%mKCT#vU4@k1cNhg9fxpy2GUv|u*;WD#b{PE~5?lQs0A zk@Q!Ow*9%NZGPS+tpn?m@wF;65uq1oXGD;g_Iic zogDm5ulYI^dK5pygh}$*75a!00s7L-f9xwP`8>4sH&}2vB1;ll;FWjWvFMz{r78I0 zd=aF{D&#cG3*S5mzFFeFMS^)3U>a<+E>Pb*=?1e&!kYvW%XWXG*?VG1pueaNDfHFC(KCprsyX4Mo70*e5`w;|1|pS z!6V)b_s0B;5+3*bWHW|eIj`}wPx_?#Q6bWl>+M#*ktqs z2@{C(gLDD*_9hMsO0%sZ4()5UCB)M!zjW$>#M6ttG{?aIy?3-{`^VXn?H|YWU%8RM zRTBIUlm15pM>mAYF9co~tW(|m18f8Fz|X}H#|@8#>K*nprvdAViLmvCg7n|sB_DEK zi^)!$OU!5&Ulvd~bF=>eqVYS^%H1(xXO3B62-y3aNBhLNlMwaq%s3X**1kTiGIi z6U*4&z~o;^>EZ zmS4@>wwK%-5&PxcUneR(sDBa1PgPv&KTmO#zmnq@DUR}OY|k}{qx=?*-=H|kx95Iv zhvFz-#d_{h9OZXr`9~B-`HNWoam7(y{&w&JbKBoG8+mz0*$0ZF{-NBDKT#a@i~ptl z(a$Jf4^}75VpAK2LGfkAIuSZ3o3s{|M&#-ESx_{u!ae%0l)qWXy?5dA&LVf-3FPG+M2$wzajgFc!=<0-ccG!3SFqf9M*dEYUu8I6 z#^ZL2;qvU;{f5`EJ5-Ppjfu5B|+ls_2<2dYbCTe}u~04ce2tzH3y@eNmu@Ag5`$gA2xi{*dn$4t7kaI6z?^{W!U~_ zIJ}q9BDa;$p~R~KPvEl*_-qFL-x4qRdQ05<8j|s{xod8sj%GaI^`C%~5Xt}40VuTYowuJYjM>La#^{-`?X zXIchx{ipd}6+PclS&q=t!gDMg%B7jrv z_B`w)6LLQ1O2VfF$L@TY%=w~>F$<*+QD({QKrl;!qVfBgCAq$5`BEz=UxIRy-M;dr zhGPA{T@g_v{_W`HzxPjen}3;5sV1a;9i&QLIa+T^)g<@#bkYy5+keY^05oU?IMcEHGYaCb9 z_i80rl13FAN+0YnlmziTJnJVx(T4S%dzr*aI0pzyUOE12-IZawD?@Z=JsJM5bF94xL7VQqK2VIY^~sD1kx=cI7lTMN6zFQxKG( z^k63_8s%u+C0vU6Z;9X$apix)t8&tYbDH>Gj!|tBm@`*`#hk}Y9il*vR*^KWHqdZ_K`T`N9%=h9s-3Dl!bwtq9rDCE(l6cdhqtm(eRton`x>@VU8=pJR4_pJVn6#5#@wGw`>Z_*=_PCvWim;az?ZTUEV1h ze2_hBBGkR}Q25~`{?c;L4%54gqu+JrC+SC)1@32>h3+SpUGxt$yJr4Cvs>^3O?ojm ze3eZ9Ftlgduq4{DL%KQ??Unv$$8;H#Z6~fRMf&PG6@jCR z;71WuNi4tLj^GLO;DQbdllwy|d@L>2b2y|7;CvkdUkr5Spx1WhT0)Lp()I6vKTsXi z!~H-Nf`hw2N#nr2UAy^%;ILaa=ouIo;zPjmcJBwi-4g`&z~9$)=rA6FLtW!w8N$-DA-1q2ZB4M$vvW?cGDhds28T?f0U+ zdq{sD3cHVA?n~kEw4XqG_h3pXg(uQ}6746`zKr%$Xg`(q(`Y}P_A_WdllJAbpGEuG zw4dW1$jC`>dp}H+p8oQFg!cAg_#M}T{|Y@}bhLZUi1xlKIGISv)6Vhnsq{x*n{)1j ze7MDP{FFQ|8@QM`j+ zfk}x~_^sd$KHUsWtlqaDM(FNkq7k2v>fp~Kv8F1DR8iy*Cq}=BNHjY!dJHJhGL;nU zPhzc<5<3ecUZU;Q0v>vawfJnU7=I{Q(+QrWNN;(5MI8Q!o9EAk!`wW-5)PGl{yaF$ z%k!(?P?hJ;hr|3le?K_vm*?*f2Pl-DH%(sYqf7G#f*L06d7` z55NOOQ&m|f2PW*|cTb_O$wK)Bc)_ti3h_-dWKynQfZ+m^OLtC8;m&!t?wt4N&Uvry zoEvrL{I%|!_vy}gzwVq5xD?kpH(`qO!H2L=IxQp~#=hA}KBR~>`JvtM@$Ko3>5dsV zr6_R9KheG(Xbf(Nt>~7XJZ3!~tJRYSt>_Y@U#%+K2b>} zreFA)nCEK;RAo4zD#HQuGaN8K!vXU%9Izj!IS1@VX;R~rrpBvWjqB6>7kuVwTtHL* zznFT0woX@8&Ca)*%HEMt**mEzcA{3go6KBQp%uxOk zcLF#6zm(z0m#E;N)&FFC@@MChb@&LcY|bZZRWC4&-4`WO$N4xV`b7}-Qpb};UctSf zsPF;U<=~`@Tl@|`?JrfOonqJ>gU-=6raMPbOplI!F+Do^$6TLxqhkQ4xzRB&hF!j= z??%VY6qD{Sh)N7xF*t?;px;HR>S%IeaBM(-zkZcb-X&Gj@M+=@tTY}UXxMB>rEYRh^XTYs*VTgD+pJ|>hD!YoH%$y zerW3WQLLOM;<@O=#K*A(YI6UCYvqdbD(m>vKsbmUN>fk0sq`>C9BDpW&ya8Gc%p;iu&perm|@ z)4>^jTH##5=iHUz39JyT%QHODXgty6Jn=3+15R0}Bj$w9DqUcLieCJt=a+I&=@=-%AzMaqK)nd?UFfXv_Pl20{EjDsSMuR12yP+MUH01;9^yNezBZ%J0L=daSkIpUqu^DLb=;lrn@Zq*@L4`;Y=k8O7$Fh5Q>qterQmY~heLYddf3tV8`k~!wZOu&V3%_V>`1B|WQQ$ znSI(%;A9x|*;oRnLmkJ$f_OZE-7V|$i?7T3;&WqR&@@<-TsjEqAZ^>}~dl}XG zYli#Z&v5?-RAn*kBPyZO{@u9paM=E9U7nrWO`uxf#IPObmtw5mDl9J1K8a%^=*}II zA7qTRj>*iil}GYJH)j}2H;BZNWn{@$AVBweyn=5bxby3|<7two6GMrc698R93o zgI>xl4Nd@)T-s7ho9V(2V|ca;r+Pqmt_zRH@O&5kDTWt9jZ%kzG;ZxnhT&mB`@Ko| zrGVRybHX=bc;8&&cVT#ZPj3j`wV}Byross|r@niXo@>1qqyp% zo0{EpxR{EQX}cy#Q}f>N$C>ozD*R+n_;yT(YmEi#oFmW9*86T+Z{RtaAsW$u#HmKn zX-R#la(ag6PS2>yPigLu+g@j| zn~Xmn%<$(!8UB1I!=Ddl`16qre?F4o&qp)-`Kb5=UE(Dk%k<}ClIr~Vn@oTHMpBC? z?{6~v`GoQ3lg^)C_C{IWoIij1Bm1)mwDSz|mGS4_GyM5=hClzoUUFCN-(>jn+YEnx z$C9pp{*wo+>z`Z2Csf6Rm%^$=`cBd=fR#)fM7C zRA5?tVq7Yxzdobyo61~Gk56T;rYEFu#02?EQkiG`NmPNLLKCUHfqzctNLR?Mrt$7) z_!VLjQi|951;I+7fL8+jA*EnO?(inRAXo|%@KT@@6U(5KR5^rjE7-FbB!|(t2#qZm z;m%iUP;!(zZ$5?LF`syJa@&%cN5Z&1O8vwMpAQ15MQ|d#lC>5#40^q=HZ50J=j1j) za$!Bl;;99<+(kq1l9tYU>ZGQc&ZHl2c8SoZ^~fHQmQ` zMsgoJj`~<+lZ2fqpEkz-mW-D(crP^SGJj!Yd zn+Gi}T#?pTxYCV~&5&FOmlG+x1%zAfx`Mv}%fa!8Ti5I31u^hxA<}}55X$KZJ4))B z9Er#Ee(Kn?;?${5G1fG7nzHlsgx|y2IUn+;ehRiNW<}i&7{1o;77X)lRZhoIklqc} z94VZAa4VSUj{n{N*8~5i2mXKXa`U?8hBfug)rU6MG&R*XxBR$oInQ`K_^gR#ldH<- zRZp5;F|Dk!diI>zWu9g8%gZe*Et^+8e8kx5vPly|llB@Bl{8}Xn5ZOFIBDXfD1{M8 zs4yal6i%54he(}~siZbCl{8mXMyd@@BAww$sBr3}Sy2ijl2Bnt(xlQ^W##45OQV`7 zNDptPbUNw}Y2tJ`xgop7f^^Uy(l+UIa>%ywV~+@JgtUs`Sj4tPsFZDsM6_pSDcLQT zPNyQaksi^!>HJuWZ8aq74@sX4!!V?M5Qn&(q$ig}9mmYg0v|U$BeQAB1p~lc4_6LQP|~e9+|8rMUStDBx=^|TtTy8|J+tOcFt|2 zN9ZrDj2^o#4fKYzJEft{sI-Xjn${W89BG|VX{0lBbOmaolgR_o$)r52rO`p?+=w(% z8t}N zufT8Dq=n{GlvS2iO`kJ6v%ZtdCRHwkFDJ?xuWYu9hko`Z``a;%wKc5`jjQ47C-i37 zhGna(SJk())GVv7UeeaEvbABg_v3!c28;RcS8Ey$t7n&+Z{@U@Z_}W=;L4$4>AI|T zNjKQ?nwI71)>0X=__F%d_02V{_0#~+LF$`V*Q}(5mp28=w}d?PEhA~M0I}%}tC|{{ z-N%qXSz~p}%0}0X>euRopcLj!ZA(@*)MgqXA9u&X_}l9BtLd97>F>U)q`LaZB+i8| zNp5TM8rH}MedHrQOW=LOD+JcIuJ!8LR;^m+xia}sO)oSSlh_>mniEufRbyS&XXlYY z5;i4#$7yB#YHu}uu)cPAO*2|RUl4NTx?oL9mWn07Q2Ubly4IB~;sUe-Xd_%R(lAY@ zrwOFi)YZvH?>%hCCIAhqmqABrYHqBB!CYTgOC*bHgR=1O|a4Ndi{>V}Ug zPN$|xTBc=r&G2+GMsy0CtGtGm5hF%v2|R&G36Np*@DcPuuQ8**sSPb7$7TpaYFb#k z&D9h>hL!0v!XdsS9^y&j*?z34uc@mJ8+?=yHuP52)PkMajz`{trxfS>Cn6@1MBL>0THj-U5TArY`Mql0Y-GLhVXSBR@u|`m zk?I_-D#bU2VA5%D(`V+*qH20kdWbxkz$a^(#7(};(?*yCX+WQbC35ztWI1EF5#;8$ z5F_;|C#;m<91@lqoJh8j8k|nTgwRf2$>13$OvIdTLTbSh()Xh!GS5EIa;%95MzkEy znb88=J);G<7e)(2_D3FUZdixpr*t=HqEc&Vj*3c+ww+W*TTaQ5c4y3AA!TPwV=lODBwb(9ff+FpWK%(-4ex}^Juj~K{t3CR>O%Ct~g*X z%Ok92O>0|oy_XI-Sy)54^+>>B@vy9QIZf|wj%R?y(1$R2b=0D4kaB2sLLXb?OcbWI z60Rw$SGU2G-ONK5)>8q)#Zg-;8tx9xJPxxmSb;UyAJW#)Twh14v3mH@WBt;aww1UX z5fk(|fk(SOWvB+=)L<=yX<1p^*C(@ZtMd(24f9b?)&;dRwl&w*2d68qwWb-Tu(XV~ zx^Z=Fz1xfNxZuO9xSEx2p=aVE*0iz)7yWDDEF&RFa)we`5OmH|adv2so9Y3b%yS*~ zFj$X3j}yPQfP!VKGtR}BoURHqp7JXuWjZxe*m*RQwR-=t4|BrbqTtV+wCQhiB9jNv z=(idWN47gj!s9%AL{`G#j*3-rSj#PER;1*P;INd1`p#sg^<5nzcTWiWZ3ufkgniCT z*Uh~j0A5?bX=qCy-$ja;p`FFd%8{vWmSS2tr%g6#sB1Z=$>R^mjtF6AhOnzc*ged| z$5{SvnH7hWzlGC^Fby^=|Jx9~_@Qdtw4DP(*jQ#%7RaN%@({L|SrMe;hIY0x3-jTb z5oxIZCQj3~Js86N5W=&v*29*qAZ>qTOd82 z@#)#jwLJd87MV+7Hua>PZ(LNXlxsskvbloHo{kl#Zt*ryZ_{ zo$cw1Ul+xT-E;^pYSUr3W_4j@EUvf!X4U{^a>uv=ViqpF8e1A##Vk%{hwvGqrP^B0 zVsLhAt^vK^1xIvPE+f-QY*}6+p}*++nCB;x?c-hjSS}2O%(Pb_&2Jy?;KveKXqf-)TdLu0JaIWVd*C_}*{4 zPgtRM#;MRgezJSKVMel3yvK|XvtI(KcI~?*laLI8T{l3eYnZxg5`F?6;AtP*F9U{u&?H8Y;UvT()zV-mjJHzJXpaIlH@`-680qTUx1y{;~sn zoIBq6(-7(3DCs+#^c&IA>pKRz|IxAmx@P=>j_AC8Vg30*l6L)hBS=q7#a{tw*Pmyn z;+MBjf8N{?y5VJz4n6CbPGPNZQm3Flf7-kuIT^-6C#C46W>R!RCs6bvq=TX-Llr#( zillv%AG?S7@e?IGG4Ofl6mxc7pm%a08>;tKB|9#V&3887$}N05&8?%h+SG3J)&qQm zI&=Fc$a~(@ObD@eiBHSo&k>)I#qlK(u;R?(=Tf<|viPCI=Vb8%h|kU9HxY+3tl7>W z4rh6@T}xd5)Xxc=Oq_qirShyK&QH`TK8Lve#f(cFOI-iT!SQ~?^@H(_w@R_QTtbj4^YGfA0xhV7H=l~$t-?3@j+SqSmL{8@ukFvWbx_5=@-2jX(Nc!lg1gm zH}T;a3?m8R^t^9I+J{uH(HRUQeF^y?SkIFXBp?~^5eB=LQ-_+sJ{ zviKz8rCEG;;*+xYc;aMiM%p0a`VAc}IiGl^3|WkPO)B(D2As$n#PMn@b9F3$?q!d6$Fs+~ z~ZaQ86L8>c*yw_h2q|f zELq31&zp{Cp9epMi}N?#{K!-|k4M>g2U={L4^OG zhxRJ;g7H<%J#Px}U_1&R2lXoSg84-5>77FI!Ms<*db)!Bg~3k-y~)h~NqU0$b1?G< z!OlW2m?x#j7lMBZ-EX!?Qp$Y;VufBXPYQnz{9NeuW39n`(T*e^%>Q^_6Sv#of1!Kl z3dM!j!6~Xxo$sJJw4Dh1LiIIvkzYtWIA1_B(Kejy3C>?=2X5=h55asW_TLH_3)OsE zMAC5Mi1ZBNSa47OO7c%I--@1F$p687F6}ss^at~{$YW0^R6R)Qg)fRNgqcY;sn>&K z|0Kcb`_I>rox%KE#1ae0&R|}Za+i~x!MrW)ehAqa%+DhKDD?9}uQaRNRrFM`ikTorHU7E80}vk!B;4*?Qe+S%Od!}5xib;>E}M!6U@3^`U8iS zU&eWnk5GEHMDV^Kha1WVXV2j8h{#7d5!&CXE_~e2h~` z`%W;=;D-7&cdzPpJea*fzmnJdQN_nPm9+1~6C>&mW_9RG5&UY!_f~p7jNtpgJcb+U z4`zFqyCV1}5xgAc`7k}#NALts{kGi72>y`b<6Kd+@5LPv^=Q5(f@S>NzEX zzZAiz()|SI&){t9dG{(lUfDl{PmNe^a5ne6OB63r@}2p_fbtU+pC7?5jo=?EK1u1R z;iVPo*Zh9PCoB13e9Hjk%M`yt@hOUT>FgpXKUMKX5&TBQrz!c*B6ulJe5ilAl0PMa z<9iHoLwS9*IJ_X7pB};Ai{NFvM7H{`h~OVb@PoPp_RMra+TR_)yYPtw%hmFY5&Y>0 zKB!xGxor{rEyc@~o%?kU^vqKH3B_kCzITs6evaZiop>>**IdQ9I}@L$IJ+~==W`kt zOT0?S%S%^KKkB)Y({|w_@=7H?QgM{;1nIcRTrGO~F_$qed^B?zJHjiNOWO%w!CdMt z`~>E*77~61b6IN%zmIvXGdJy@7nwI0{sr?!!}0YlxV5=MTF-FihZ`=>$Q)z%GL}El z@D0pQH~bRj=NNtu^9v1sfw``pEdkj=Ko`OA3opz*>Jqygxh9!NVnG_=I?%;`s`4{`!YY$@O_vcYxn`oPd0oV^D_*;fcei1zk~VD4S$Zg%!^X5 z513zPkXIdkQIhM$?}I8{u=Z3hJV5Q1jCaZod4xITH5PREPsKK z-;w37GQ1n}Um8A=`9{NcWBw3xANs)_&J@}|Yvk|Xh2blP59D>HJTHrShAKT@8u{O{ zp6^t-!<4-H5Lz(q-eP(8Nwa`gb#j^9$H@Xdgza&k84LIr=I(=G0f*<#Xmg+b3iuS3 zU&!kPX_s>5OATMhT-GllU(5U$BY!ya(+qEBexc#w=j)lHpV4o!j(^|CPvQ0*#_I*K z=U&b**6?bUFEjj5majDYWaf2-AISU=!|Pc8QHGz%{8YoQW`2R;4>G^T@VA-YX868r z&!dJP!}8A>zLxnP4R2t++3=q+m-|KH=bM@T-N--3Ji+T4k$;4FzTvyG{qQMB+C;uL z^L~bZzF<)!=<;+hu{2AsKF~@#h z?5a-t>y3P(i%Y!IaG4(-HeBY1XAPJ6!F`D@mbE=9PN?o=X({`{(szX@$(CYi~WBw{1Wcx z?;CzC^S?7k`$sAJQ+ypD?R7HSU#K|RzZml2)?IOJ|3Jf~|BNtP>Q!R+uh`CV#j)HQ zxZDcGv0Q2QMT(<*lGlri6-RmTTN88fLq4S8c9@ahS=!z33CyoIT;{h&46kN+_Z*|U zA3oX@N&A!5Y2V*4@50v&!lk|3bHBm)OWJFg zk(c(`*Kk><%`{xvYk$SDUdMC2exkT;FS%~R_R@YkiRFb$JDzRyw6gynR`UAqiO(7N z$Jzg{D2{gC$9BH1xc2`?hKoPHHC+7Jp4Uy{e`&9thCk2kwTt1>j-w10KbI(u_PdWu zd){QlwV$h)qd&EO4l!K(e7MnbI{W!rCBG+>E887L{%!WNtkcmCXs7#hv*$f(5ub9+ADO1p@kdm1i&9;i6le>`7b4OU$Hc`S4Ev-XevJ0o)O zbG6ZP4g2{NrAPl=`vN21p8x)Iwc=>!eQf9Tild#caDThYaPj}6hKv87H(dPxy5TZ! zd|n-iF2iL2M;#jXFFK~M(j`b4zWnLFOV*f}ZFZP!jF6*2* zhL?9nE8*E2!+Z1JYgZUPh5fwFaJeox$?$)&{P~6_dEt1i;RVd^FkJfWgNmcyX0zWO zRb2PmKQNbeDZ-sX0BMseLPuQA7V zK|jlN#1TlH_N=?|wVj`H8K{F#bt|6i;) z%FFfP<%*-cwC^p<#s32#4Y!R({vX_4TMQRFKQ~eGDJZ ze6Zn@neT1*&dkdUKY;C<6~Xs2d?xFuHT)#zO@>QAa3hD-l`!0=1B+@}qn!}{Mf{Arf|ID-G(aJes@&=oG`R;d190F7sWz;rp|Eli|(Gk1_lL=I0rHC-X}q_;rTA&+;D|KA79(OXfHp z^>c0s{(FM-p9^_D%vZbun&Mu*57Jd}9PiRUixfwBxeqc>ag>+&uvl@FU(MI;qZCJZ znGZ`8M|t^sC~eEqgX z@p-_-4__KC^-8c|(k@c3Lc^tA{h4FE&`zn>?neFzu2;E|F9CVk4lwcqxn4^Z$9l=% zi4Im=*K4ieGLBASj&_!S9*%lv8~Hcb&a0GssTc{zTaEl=wsVu=GC%yzaOrP-M@yag?9M^0z3C^5W0?6i4~H;jDOd`N`N z=La;!pHglo!)1NAqv5hX+|}?QtberOvd$|t{4kcEW%#+w7aD#K^A(0qWZoRX4>Noi z%b#F4exD1svkl*e`QwH!X8ueB|D)kj?i+?nxgQxW<#yolA?o2xd$6A<*qUO=UnbNhCjpnq6mJa;bPA(4HtVh8ZP$y z#_%V&+&2y1#5~3W5Xa*r*QIEm&s^G3=AAx@SAgWZJl=~G$MODKj_d^tmG$y9@*9!d71ByQylHNlkGW4akNLy%jX#`=ZmWim-EFP z%+Y?dhffpU14jN^w*O@%Una)G@m(XoiRZ`96i539@%6%2ifj9mJ2<7%j&lC$Vz`{Y z`WY_gui?zGUTCM(Yab)um9I~JqU5JI6KLOHe3V zwBzT@yBqFv{(*)UFdu37VCEAIAHjUC;ggszHheboM#B$cex%{D9ynQX^m7%jb52(r z{VdmOmoUeEi0wES{^NF?k)Oo<@N*?U&56=J*4stIpMCgzmZvz{b0ynTsJL$TBEzNK zhZ-*JKF)Ay_ZfyuyDuOS>OyxU}QhhD&>0VYu{@TMTdF_T6N-^q=1u zF75uZ;^^o1+0U;kuG{@X=GgAoj?(U58Tm!r?vwkt_C@*WE=c=I=F;xtxZMv@9PQaF z-(^~&xNi3*!=>GiGF;mIG{dFcFEU)tFV`C`=a;(-KbrmjsNu&lf5Gt6m~S>*+T}yV z(GMHg4}Vi!w~N1{^ON|QrzNigbMbSVw2P9T;j+@c(#Zcr+C_1+=Q(K?#nB!)U$0gi z<#*+Bn-$mXc$DHOe>}@?P#oo@eSfMr%5P@*vlT~qY4=MNNBMpE{>zn$qrCKoUn-9B z7qa|qile;DhYu)@^6#?z!-}K4wD0rGvAxj$a{uZTBQL*i?7*Mym39<6dl)X)UxN*o z>#tFUU(bGW<3WRp2vC)HT-LqKiY8lyZ)($OT8{O{4cEMI>V*D zw;O&J%Rg%P!^~e~j_ooN+C{dvjr@^3F8-!Cw)=ivT#hdk$99)-;rDgv*p4XwE0#|x zj`FgeDNr2cJMaRlo8l-hz9h7J+H7mw<(VH zNP9hKxSSWBFb3Z!z+-cwEGbKnOOJpXGwIFDP;m8Sk6e{v8!Z`)4!n zr?|F%nBj7s+ShP7Pt7!3&Qm{OE_O=2>W#eI-#=c-&-Q}t93wCHH7-*e>-8Yl>ng={ zy>2yJ>b1#mvHw}-Xg}H`_P=c8*K@mkuH@%{ylk<4E+p-e!`Jh9ilhA_m=`Lp?eEVV z?Lqxw&+bP4QnqKV;agb$GQ;IMxzX^Wc|mZf;WFPIYj|IlKilvj%&#zf1oN8>mwEdE z!)saoNyBB{{vX3--hRjM$*ku~!|!HZ&_A=iw(z=Z2gCosyuab%pP`1!c-hH2B7e*O z$KKn3S5aMi<1=T@IXU?th9p2hl%Oa9F(%=|peTng4Tur~Dq7kkB!NT%i6JNoY6MjL zXa!4^wkoLfmZ0|1R;yB5@oHOat+mxwdarGRqQ&aHet<%($h+3wYt5|LXNJVK@Bjb4 z&-3mlnc4fd*IsMwwb$PBab{)-yqxm5d(yxYRNf`<@s!8iZUZl(^2-80i}JYJW8j5U z?h^Rfl*iqE1LtG;2Lhi!dE6Z~@Tpt}et-$b{T!WDTaKr~I9*0rIfDLNL0@3tOkXJQ ziGse!z?r^8;7LJWZs1Ix6!;`TUt!=pU--Ke*ssZgex9I5yoBobd3>ao_n8|7J>rE# z-zsp|#!$Dyz*+wefy?`->kORf*9%7C7UJ9%p=N>0 z<3)$S<#A!7z~%bCP2h5!e_G&jJ%3r?a^2o1aJfG7dWHIz6AkXNpo|G|x!x8ET&}BQ z1TNRlN`X(%EY-GI;Br0e5V&0THVRy>Z#=(H&!phb->pG>lE8UhAU;{(??D+8;&T0A zzeSvV0O|O90*K4?g#8V1xo+_LE{MzZp_2R)ak&oE3tZ0k6#|#@dZWPQ{M{jNIZydJ zbtqTP$322x&b#*nF6S42q7>(yoJWHlw342WavqfnT+XAp0+;isRp4?SZ4tPfM=uCm z&ZGAQF6U7})YDVWqv-;d^Js;@`r_LTGJikPRToJT(t zxSU6S5xAU3ne_ZG@|W{SzE_*nqSUrd&`%Qh4FaDm@W%u`Mc{7=e5$~YOVb6^N6sVu z?hE4Q3Hn8XUe2R$2wcvi=L9b2(T4(;^XROEr;nURYXmOm5r1a|^_27IzXZLUM``IE zf8RVRZfj_+Eyk#e#Uco1-sk@3Bc!V!B($rq=<5Tb2K!&1nEO%oM1TkD`*rmc4AqK0J_Inc89wjTTjN5>bgS8AD3dFF zOMZa_z2fN)86CjWPjGCW*ewjs8la(3b!KD_IhNRmM&~jK@3G~aSqO{ zaHW!JOwj-(HHA7)Z4gx9EuQF14Q&t`SMic7o4+PyA@iz>m$tMw6rX?5#iv6U<+{ba z_ot8$@cy{X$F?vzOaLc;&9S+-gBrlctUER*H97%YBz|lTV(@#gr0Wjhvp*;d{jtR> zMLE8Aiqmq%v3a1$m{PKk_^~I zAzX>$`Vznwq7(|DKOZ2uL|Kd5~LwJ_<;a(PI5zQ)LMCF_jY9>2F}Vn|uOLem%M zo%%*GUJ`PD7|#rmKabj(yv;IxZ^gv0X=Q+XyyPkK>uu@HOCL{;RMNlvX}BlhREL$AU`KSKF<3f`FtO=r~YHxp#JX;kdHrkoBe+z zME-ujG4&+>yFe2pzbim~KG2%-@wfY+{wq+>LslhI7T&K9YM($5Qjy-dTeJNEpffQf zJ{+JwJ{n-^zZUK*2FWiW`Gv?#BvaN6(B8z5Jm(tSi0zMd8VLWU{GB1|Ki{|Jby#yt zmGwBZ50YOLARiw^HRWeRP!sD=LN{eM~zJRZ-%UYpY>AypF`IF)&TiK1LS9gtpEHwQ&0U*3t9iy1;{@+ zK>j%BCw3LrF`35D{q~;ZmqOzp`)>)5e+mdN?f>Nv`}6M-CU3JmFU0;&2FM>CAb&eB z4C?<}>c4rSY0Ag%p_&-l@#O&dBLd_<3>gB1C>o zfPDOY%as2>$o!v2@(WQ3k<7l{8#4b_1jxtV%S`zTfMJmRSCIUkj=x`q_NGp#?)m`v z;{)U`1vx?TInGv3@|&Q2ko;`{^6~dPv;T_$2$G*eOndTw{Jv+9{9OU^@%KSfepSf) zAJt3w7lzFLJpuCZ_eN9xPvN38sQ(qcl>Zd859@4C#J;B5p0~wv+UpwUubiZFxW3C|%D*6F{uVu}Tdf!N!{3Qb`ClRV<~qF|2OH971NEM_ET8woLfYT) zW!>TuZb*A>$NNs2KL(lg2DLYFZpZj%&>_SOGgeHFZMzt{U9JGgx@jMkJH=?GX9auXH0Re>Om-{O<#Qv+vk4=L+4v z2yc2oLb(^izuEqb((;l*kz_&V^>*BtF^X#RnWM`zQj>ARw3+8c@WBB}w)I4yEq33^ z6qc1#*`!qnlt)(X?EHJC)&1$BNax{dr}L9bqn!t5#X65T)`mfe{M-XhboRDr4+YogX;LmcbFgO0WR@PN&O5Hsa;MK%xG>kQofhEssIgEqnq;W2wb z*Dfc2yD9^Qx_3C%Skxb4r_9|nIl2Ms_kuoeIQ_T33A#$!!iY7N>k-cY9q;Mek$W8M zp8%a<*z-Fg$*1-LkD&HjY-^v3hJ*D&0MU%n)$?hX7f4*&(Q~ifS z&XAGq5v%)?qellEU1R_D$V$7jJJ0I&jm;Em1NhMTgq`f}2AdqDF~ahjFivm4IPHV+ zgYT4gA9bwmL=>;&lh=IW#J3-CV$k1&>Sqmn_WH1s><0JD$9q0&n~FLJnz9K>-VQ6yGMX7_&?E3ygL;9 zqRa93yE_m2JgF1f(JdUh<8f;>NZ6e@Ki1hjmXzaeOuY2G||Pe;@Sm zE$E}9>$0t}a0t!c{gq^Q;sk3$H*xPOB4 z0DOCYBzest825CTvl%d7GvPnoPS1e%YDeR^*VwngoEiZB)DPx{9(%M4wg;VQ-1RkN5BVta<>@6hI#bb{<(1bN%~c7;DxK{TqD% zbtvtvKyX3e(Xnj&aU6Kruwk-PdmnX zUIseM16?kKF}MVLGp>9S+g8Q1zM~>x+Vg4iotpj2OmiTJriK7 zbnpk;wbdb*Cx;ye{5Y~5ZH4Q=)+yF+yPdS{Xsc%&uotZb2VpJvM63nLENko!o$A9~ z4_O-;FV}wF5Bw8lcTLec?fmqHSE`+X%I`n<%dNQ;;L8P(IL%rAbFf7n%)2y@ zzZZDD0d2d$_xFLnyajWOZBUqIjfHy&`R@$5u_{qrkej}1OB)_9-h(-np6saNGR(cX z=`|gAiIJaPc%zFKDtxtD-U96s&VaIaZn4THo>H;6HVw){thR)mR@UXLQ^yRH&AP&| zXZ>G6*SEn(&{n8(kiPpJz1FEY1M2|VN3Zw#Sb_L1_ze4vk$$(Mop7#jACVUGY`?33 zZrf?eZiu%HexlbHZ?F9W=aK23c#J(bYdVa11&saq-~;D@e@+Acj41!?g1NAp{lq~( zi2_{==;PocX|RrZK7wm0A0x2e=pTo`Kk(RK`iNXJYGAw`L;t9=HmoE6C}96^bU%;A z3*LP;3Udi)_QF`hu~^vx=V2kNwa-QhZb!eDcnutn?^f%$_Kht8>-cI~$JeNJ9FNzU z7Wvk|nCt_2ZvkJu*5aJXgFbpRFh}zbJ#%X=>ZQg5X!TytJ$Y^r z3lq+vzuI5jhtz+*uT6_7*W$3}sAd zTtAgE&^69>xlq%4lx5w%z`UE_a+%H98W+L~C|?RwkDJ<76=zw^sCB@u+RUXIVh6tM zV+@5b-X&fW&hmiURzqsndp&`9oq+=+XJ2(?)u%G9@2$q%S=+jpvpm&cW%%M;E@3Wn zUG;ig{n^nDJ<57+ z+UrA6xyz-Jvs(y42dmu7rCo%A2An-ikS3&pyED7O6{9Ev2S3h6-TA$cvpEDI@7cYc z&BI*YRh+e4-u0{j@53}Kbh*sotjDF-ZZ_EEGMBU5IhbBl>F!Kj*nPZ#U$lvcx6mF| z!^zrouU9#43acDvStq^9amnM|>s5|@3>HSt zvejT1x=7i5wC}~p5T*P446JfRguUo;sqdn!$GF$-mvp&Y%-Kp8>e2nUNd+~*^@;O5 zz!B?C_wxf=UDiFW8O(Ys_cmm2o{cjw8^a}P1nD3`ii_U`%KK^Izhn6jU_P$lKuo!ONn)vywN&tco} zn(wb=beKCNJvtFD6YP@UM6PO-F*U3qd=u?q4P>=EU+8g$@C4(2io^9|F5@0`Axc+i z;KFVACFC!5$SrqeyQ_4K3;i>z^i<-aS7|PJy#JY1Ity+PV1g5;!Ib6R1ElM`tvQ}t zQ$!iDN_&hKr84euh?y~WHt<}uM-NTq5^yeB&s4k*>tvD$Z0l0ax?fqano>L2Lrm&dtB)YIlGoRtqHjVx3pD)qm*e1O-PK~ovFtPs__^#n2dUHmXahjrn>6z z5)vwyNh^BaWImC0xJ}GowL`By*|lIeIlF?me6huC6m>{kPt0?nUN3GQ7xy+%G>5aYt8@N=%NzI3SiNichIYy_?_PKb^-!E`{UfKG%w+;)Z0i!vKIuXW3rM}e zuExDyCCgndmvVNK3oS}z+~Xpiq}Dv=A}_4#n?Z%X;E=huuC}exJj~`n*4Ekl+W?IeY?xeNS^bJ_-Gku+Ck#YU{qq3G zjOk865Kr!WIcQoSieQa_iWGYRg+Xos2# zX^G5zP>M!ZXz^-mtF8WGtfTT#wT-E5Ty1syn}o`ztF4Zpo2l|yYTHLY1(X)mGGgZ{ z)Kc3oEW^q;TbT)70hpa}9%b#D6WE!wNX9&_tk1yiVzO_{Sjyazv-J(h`3Wt?bp7{dZqq(O*0I5Y*y?R4J_-YjZH4 zHog|NUd@@G`3T2O1RwEg$Du|*0PVhkTTHoyj?UmVFN(fJDc`P&th4g%*^yhJrqEYY z8CeTWCkQO>LQ%-K=R|ITrd5%f6$4}w(Bu|hli5m|BFo$6tMM~Sk^F*>STV5rVJD(> zk+fp$UUW2U`y({Zj_$Bwg|w`N07ZXbTdFVv>=gZ>eHa!O%eoH>kJ)gs8*3xuM32{> z_CFkr>egu3Xk4~VvlAYxgk9(rGVF3yP<*rOO0TAmy-5{tJfqq64zF;W{iG`F!PR$%Kd#ws}j?GLPsTYv^rbX~^9 zK!GXob9@HCDoE@)9{1>2iT|)v9@{0JOQ`&6AWuA>V?}R)OvYW@c)hnctk2j+X!Hri zvLgC@)l^$qvsC%V3OxMr5-a+j&`z&LDuQiP5xwt%*cY`u}S7#L;Dtb+By|yB1xI zMU<#ih|Y^DUaIB&P-R6QLINb!1aD~qr6@Y2V67c>6*;QAj(h-IXdU^ke;wJ@Cs(c% zo&JTR6Nk!MR<@VJaY7XRwGW@;t5rpBwfLTYEqT;iJbnQ(RLZ;4<}5rxV9$-*iId)e zp9x?EfL)c9$DgD^I;2FSC2^v~?9DGyvfLAG8*ycDlzl>dQZa!=qt6^;d z$#u%NFIL^2tGcZhGmnkY5T8}zgf>D;Rl+jrCnLYw6;Y0d-b%ThIe^@)Z@^O!Vo>GT+ zj6g^u8L`peLjX`I&9Tw1y>iq>$ChOrKCc|Jadc(btjF;!)Z9VcgpJPOmD7~`f69T; zb#aJbTBkTLPIb52MbJ~~_K8NfhZx;1G`dx2`@2`$NxGrcJjzURSA9In zfU^`?c_~ovR$RQZ3O{(0`oLcNXF5z6O`|TSSxGw?!fEuqfafkB5X~ zGs`PGjysQf@&cmQc+@$l9(n_sU*v14dzgX&ojEJk1Wz>`awhR|+C|ujC>{&cX;J1Q zwNTb)OjxDr)6_x4JslE964fT_WQ@C=hKoC#m_gQg5H@KWbyRlXnI9Elu8U8I$+h#^k-%n2h%tlkGlZ^4@3A-)GR@Z`9wf>S1=O3zW32 zJXuk1i;9J+faM2_$-2dutPdKK^&v4?UvwwyKQiqK0;U}};J>MhPOTrhy}qo(`2vm% zZG!5d23ndYWN;#sazdv0;3S&ktkoxEYhmW*aa13aizl5(SEZ);Y<1+uD@B~Qc+v`| zuAoQCgbKny19OtC1*tkNGjYq{S5dksZwiz!`w($*{o`e@tJnmSj)X7pxenJsa*Kx>tzV6?BcNPK&48 zMOKW%wr8JfpE5XmoNlO2vCFC9W5{K^9Z_6%Vc{%0stUit!r62U{3aGA*jcJ(6s+ml z=hy{SjPJo@=iAW_-SNhwr_X*EV*L}&#cC<=`$PvD&tk~mGF*{CL zr~+JxTOOnHZBOp0c2rpryBs|qxHvOmlYwUkn4(*w81dYxMG)68OtH)L{{N!wtcqE4 z3X4V*)-}V2ISb)~Zp)flmKK(l6_*s378W%(U$x})*0z=_8tU2$$BZd0E3aF4W=Tmy z*_mgSl-HG(j$1fxVI5=^jH#=w9a}rDq_&}~ZiF@MtTV1|XpWOBK0}q{1R#FCkr6p(3_vy}PZd%Y*+jh--^=a6) zYg*w`qYZVf@R_%1XU#{R^Zh*Mr}CW7Jm=$QD(kEH%Xgs5xG|?+RbFc`f->+Eh44+% z`j#aYe2UUqz7#)e*ic_s2XZX^k=5HO5^fK4P)HNA4$g;Pt%m3W@8tg)pH90Q!DbR2jH z`r6`#YpUC?X+;M@yqw^My1MFxwM&|sp%$HRbQx8^_e|TDFC%Ift!-Y^($>`8xCAQL zlVOS=_tx5`Hux}VQ@gdOt<`F(_th_IYgyh}4Pd3U%vuT$x}px_#t1G;TAQj7bejQS zO|mA#_wnahmsyv)IErg+LCTA))&))Nz)x)(ttBn>tyX(=Yg+?uTb8xM4(Gl#*P098 zw7s^$$3v-P)myWDD0M_&b=6w=mWBAqXi?Eh70oTRUT0y+Kx;R&wY9YQXqC#evuK+n}^(yqOE8ICOsgEsS0{CcNa#H4Z_51&5p-CcAa z7ehx-ZsfJC2aDp;=+V>*U2s&;vt=!Lx*GHa%`ISC-}o<~_QKoh)oSeH(@@8PtLtH< zhL5p(B0$MN6QcIMVL>2x)RDRVh^fm~xeoX@x)ihmPhJLJxUOx7!(s}J_fhPWD(@4= zVO8L1%}sSayR&Th9b}`qYYzN~Ye1d+ey<*FH8a&5#7%W`!_r0VjaDljRxP5qrX4=X z4H|snxTDmzVMBWp_#NX6KpjI( z^p+R^ma@+Bg$oBLs(4J)_^3(J z*3hoUhDJzzo4d_YW3Im5OQVQ05{?lt9&S!E_liWRTA>wb-r*jLb3Qnw=J zNxCdWh1dB{Dhl}KBJ%RlWZbK%^!FIMm=1qHPtgtfp|pc@mZ0|a})EtEe;nL z)=0b|Xxo3!?t?odhkrZd+`6R^&a#))FFphOq3NoIGe#Ge6^|_*cgC`7mbJCCw4bqj zS=$*+OY54K*EgI|TiaIG2)pQPFoqCF$dfHB`=hFe>UvLHR&#+)^ zV4lK{lg-U|NLg0gi1x#&yS%-r8A@PYEYXLh^+f>2Ilwx&V1^Y?6D_INdm?0JQD1YU zuES;vU`j4u;%fm%t+rY~{4H<|0#HeURb96b3gL{^^=iuM&*W<=(gZ$yy}Yg+AYg1o z)2wuKKb4%(b}T(3@x!b zUl{8XhiuzNap&n9X2ed8J3qHp$I=~W-`~lc5zD+Nmj2_|sm|rVFYcT_1G3|1#A0!$ z2wH817DaJqpEVqH zjfy*W*og_M#&Ql`kL{gJ_Rcji`(|YG=Jknvv8=eW(FRHHT|Xldg=yjM^~1Iu%g%^Q z7!VtDLu~3rv25t&Z?0eMeBZ`C-x3?*sQB}7wtrQ+<6Q%4AANo&%a;dBG5e;jacFu=+ob>TMdkyZ$_|Jf4wg8NIDS` z?+Xh2?7E#;d4F`=c^(mc5GPO`7i=g;Lhtlg3M~z zuSS6OFs0&=VR^A(7sS#phzmtK!oC@ol)$zoH_=Sn&npisY=KWPOV#mjw zyBz5J%r&t-Yvay4tCWQ|If?ezFy}I~5y%MW+x-rXoRbb(#hpFS3VQc|vpP1lO7(8f zsu|8U;G5DrFj#Dz(gHTnpIO-1)$y6}$f(>{W*p|+6RTi8fwsSPRJ`u` z?mW6G(XJHYMJ08A02Z&P_2E&o=5}0=^g}ehst$$oQQxatu5frb&q!A&T;1{a)l@57 z{h;8(D-|woAXDuH3Wqy&MmkU7`37oP8x#(mGt$ip$6wI>X{Ex`{2-KC6`r1gHz=I$ zB#PS074AOF;MVBJZp5!TZVlXl#3M*Ra;#K6k<77D_0)K(o*GZpQ{$<6YCKHO)N#@D zspFz?^$-?jeaUgZ;OB#(U#b4E4GxHW?kTC)gUN#M*F*5zLvZ-+PavPuVH|__FA1UF z04F9v^ev!t5WY49e=tPPcS7iY7D7KTM9+mG^!UxiAU!vQ@EISX53mX3gFglY@jntm zUlyWge#p4o5JLY_h}=s<fNUh0OObG5FbS}xObE{9p9#486Ec*U27W^G;q$32@;R6CxVu;2X9*nr z2NTjueRgPA;f0jP9gmBt&(lO>>hm7q$X~9yMQsB=Eyj0-31)damm%t|poX>nr zJF`EScAhKv$Z_8&a5?T<1TM#2`a>bn;O-I1oBFUnnEG@Py*ch*v|sZCA35J^1U{Vd zxND`nspks9O+8tE)N>Tk;Oj==k^Yttcv4a5ja=U(|6zh&&Qta`)1HOI)3oP&!ciaThireu#}W+dD6o zq#r8y@bSXba~1JHeTE78jRHSY;E#mhPYQgDpx+gOzbbI)C$9^V?A9_$p0gFTM?}y-h=#n1gNeiE z2>w(Eo=dk9kdM5IUmJpVh2W>sz?*!UL+~Gj;21lP`<1V=YCAgwzb6Dg5Q5Ll&`eQJ z$^Sbc_`4zad6~g{whO$U&|kkBsmDv=^RqlY5`R1d|9c4DLAP?SUy{%JA^1u3yqihi z7=nLK;PS4{p%DBWx+F&alKz_^_(vi51v#F5B%ci-_-i3}2`xsZKKF;);!Ji1hb7=5P zK8r)}r$g{!>Ws;UmNzQ`{grp2X}Ty}-i7A17wHkdnC!_uhB%+YV3m5l9rjG$N%W`E z9&w~8p)wzfnf@T*(*!-r#aLyS7U-SJKa=nl13!-NYYqGi!f!Nij75TJz23R}=Ma9k zfiEJQ&+}RT4#FQa=)Xz$HUo!OZB_c7f&Yr|#|)g$Q+FEp--&*gf#=e3{pSWgg76m& zdH0#Ke3C5I)SnM-V>Jz|SUptbsQY&gYrTznbv#4SI|< zgQ?2E@qR9*FB|yPgf|-aCc>8)IQ~w6>3ReI9^tnd_;(0jPdKhK@;vr_gFcsQiw=k^V5z9~3y!e?sNM0!RAKiQXZ9WIZ$J{4ZPJ$Y&k^pU!yX{h{D8t)(}0%$YcB_!WSF#R}#J~1Yc#~|3&3n4IF>}#&oxV z4<-H&8TiSB?=bLF2>*$J4iSEp zK@V|%RJy~!qg1}f!2eG44;ncB?u)521n28|)@L};{luUjLFE?={4^@ZXnkTn-zI#h zfj>t0IR^eK!Y?xLF2dIt_~(Ro8u$Pz|I)xmQF#yTaed%(X0*@S2L0)@&VMLyTyHZ- z?#BYh^|pxCRSwdNc0l?%qL0#XlI_FCwc`Yi^gK>^0!RLQTsu+VNY8dZN#ICdP4^2< z7dX;?h4d~JIMQE1^b-V*^iL3dQs78`Ez$G+8Sd{9qMv2Zmy>-i7dY~tLglXr9QpI{ zu}R=a|9vVi5jfKG@s48|vYq*OcRkVbxNn6vm~J=l8im4nj)89>{1pR#gz$X=r%PB> z^AX{!PX+na5rJdBG6=V6&-8qLl_hYbUq$5{flIp`FL0#aL**d?M|$?dkpf5h6KTAP z1&;K0(72BmIMUY>{W$_hdiGoHH~YzUqMvEd^EiHqa2zkR=LGo2)MDU`8n*5+@Mgld z8aQ7!zHHzdiT+OpzMJqv2F}-G@Uo^#JYLht|MLv|GQt-acoX4w891+Z-y)r4 zqW?_bNY8$lpnCR`sdT?GOW;V)epn!IUA`cVQ$dR~9Z1&;LR z(*4j00!MoG+nI#(c+G=4OiK-XlZI6=BFr*9uS?$%^mGeKwfLbS_a++mX9SLVK1g~# zCveo0$Ne_~M|y}6snRO~M|vLjzX%-Z=Vod8HwBLLJnruc9O)k=dcKd%^M#Ki5gG@^ z+5XuAM?MFLPp-gG?%gEsM1dpy3c6nmpD0v``SW-c3mobHO7vv{NB-X;{^trD=?BsM z;>iL>dcIz}NZ?3cL-bVwNBS+qe*xj>4><1g;UCl0241gWYpsDlN%$rM-$VEh417P~ zKR56X2>(w5Pk>&SJ~eQ@kCR4z#QO7fTmj*1fAyg;;4{X+-=Otyf`PL=D-3)$(a$yT z-w)rMM1Mr!NdGAL zt^N+CzWzn}DLJr#)Q9FPkNXdZexSgS{#K$tLEy;$r$j$O;7I=)qCZ{WNWYut#|s?k z|4KK#&Jj4$zee;k4g6ukzhvNi9k)o}$iImAFBUlR=XLCAfg}ChM88ttNYCriEdodS z!E~{5yTFm2*S&iLj`UlJ{@VgadcJ@4T?4mhK7WsJ_VdSRzCR)8@pl1EPYWF7{*C1B z5;)4;PxgFK;7ET0oh-jBaHRi`=wBB&(pM6Fm%x#}o9I6zob|7PI!t-ucSD@Ns}yQk z!wq~b;b$B8i-a#VaJ~<@(!eXoZtD!3e|Pw?f%E;h|1$6$#OGrJ=liPZv`%n;pC|eg z415par3SvA@X3VpJnci*Cvy#)uRqrrIA2dbWZ+j4pN9>c*Wo7&oUeDDGw@pC^BV(S zNO+fl^Y!On4SWsJV^CyF+~0c$A5H5V<3AvLmVy6@@cD$J{pIhHR~Ym^rQ^a?0!M#d zL;ifNz|o)ixNx(;k^V)ZzfIss&&P$k1&;K&bkXoFfg?R17yeD)NWYZmw+kHU`MB^S zfg}ABM88wuNYBTGp9>u6bLeFDmjXw6J}&%0;7ET7(f_Bwk)DqWZwnmh|DEXnCUB(Z zb-vrcd7V$t@r1{n*ZF*bBmV>){0jt*{CS-pCUB&$Bl;qNBR#M4V+4-$j}d*jz>%KU z`Kba&`cuj2Dg=)7yw1-xa9-!XL^%8HU|I(n4SXK(!gQN~w`LYO z_#=eBXW+XC=O3$B&-V!D<1OPkr2pk~TxFbp|66L{{5!&G10O?t`1s6xc%A<)(X*et zPV2yP27Zw6I2{j}o_|N+<2mCq==jCYV=z9J@Y4-Gqv<^DECc83hQwFZSBnD&uGXuYv=wCMQ<%GX( z;EjauH}Gc(|G>a^5Z-Oz{H@P8t;alGyiVpB_`}49pOazwdk8Nz==Tsl+ratyXrY1g zah9hI`YkRcuMkyKQMKS#-y_NXi#x|!-D0Ds%sZ4XluC2QXLiJ;eIEGKburs z*Ro^@e91`A7~c$ID|ugkYFM%iK18Fn($e578H?Z(KqMPJK;g0r{puEf5KFRA-?KSJ zZ;$oyCGV3^uI#$@w(9z}1&jDge%uo@E`EEfx*9%Z1RtQPYg`OpT5D>yikG&uHx!?L z(Z#2$3hH8juXrDbs#YK03Dw!Pw<2Q&(BbIABKR>S-}kZb%Y*7$SJE)>NtOoErlAqO zVufGvVrJMI_-K&&$Xm+ytrQ^pxoCN9oA*sLZ0mje%l82>$zFeEO?^$R4!)bxQs*0d zEQ=4608jYjNijG5ktltgg zAo;ITyAOz-cc!f8pu)tEwy{#T*rRvq-C#WAnDQS4EJ*%~bX?@)Cb3D8bstm&$xqJK zEoA@kR)H!1Vh|oAAHNTPX`kM?TT@mgG&V6LuBp;ZWdHF}!IY2p@q^^=BBp%4q`9Ta z$_tTSK1a9Mfy^P{_~R{RQ~se4|JzUJ2Ymj8JTRGk{V2r$_RrPy{G1-j$6IZt{Fg%H z=MW*E&uMO{^6@z~QzxWty;Qg0D4QrBZ&8@?_ro}oiF5VW|A5PNwCGunzAhZ4HA@)05t=pFq zAJiYuD^3011%@V1Y&m5dZY^tv-nm{qf{Hvy_oQxd2{)uYx8wa&U_Z`F(%F+_$;+Fx^U42!jW5lk_9aFG?mrV>8sdLl zYc$0+BE<2-`&Zn)fN*@i(h#9))=ky~Uo#GDChd74^4G1^?WKHt|Id`41%q$)9a|Pm z*X>LAdIX9=?cw`$C50l%g3jyhxG`fCRoR(kV>D8eal^Ek=SA>BhmvhQ5on9X8m8dy z8zkYKZ`;~-baU1IXP#+GSc%LbL#->JuXAD9SUsknOlXvht^$ z2QsbhBaQ{PIFe6wLfdzsEj(AcJ>5>voCxi$z8$&SAPh3tXng{B+ybuloRn}^|X^PtPf8zR1E7Hk&?#96@S{+p=8*Lm8L`H6IeALg9D}yEJgm=; zj%^2f1MiX2ejp>?O5_w2oH*=^vC8g0?L0Wkc5TkS!F~b9VAm&pDSQI$3bt3a?Eu@> zl7GN;e!eWjaVNhKUzdh)#QYYp4IB%7G~jc-GE7TfxiON2ehe82$MdHS&YIN8{?n&# zKa2~i9-lq3@|l!AB*3@PH{g8_cW&G!d;|T$D%5^`WaYEllx_amGV~L9DgVyO$%o?> z>GyQ!A@J`{E{%Y_9oBXH0ms??i4)llw_?#|90T(RaaPB+Gd>c z!l2ut)|pL_j;e&6RtA37hJLnxz~(^%-n#act0GqSkKkv9p;7d&{OxZz{gv+=jr4!F z3HTI(PGw-zZD2#PyKHML{H&XT!_qbu=Z8t31RuH@uAa}>rwkH@w(Lk@R2@khIy82m@!-+})K{M+zvJ-QWso<@5d20mLrXXLTh8Q|I; z@h;F=|n+9QiqMdjb4i9q=&YA;#sOmgi zJsbLjeV)|`ecXWlh3(=0Uy@**QOVrnc^4+$oArFJvrtia?-nMhY}WU-y&3nM*uiww z2|^=t7KUCW9T=QTMT7z&XGi%6so?IyBytac5og!Cyz4m2_iDdbbaG}0yji*VF7Hat z?sB0zzND+6GY8wM<7_iQ|ELDDS%V3#xY?X#8Mal=St)MzW@_T@Ok?t}uOJE?eVR)h zghEVm&U*Ijd)Ez{xwOS2i=%e4=3q zv-MzfIa{w;TQF{%ZFZqb&bAVyhjIm#cDRIflyi5cxw#@q8QYr8Sr!XJ$ypW$RH?F< zh*?@;vbc+)w-wY#_k&9_U8O2HJI_bRrTHEqXB&NlTw=R{XwGs+{3cxGapdeeA4e|T z;Sq9{m)b8jzmhH^cLXYg#Mzsw?P`d<~$|Ee0|#68v=xx}3Y(VXQT zYeFt{5E~%mEcaLwa>?sI-C?7KurvFgpsFP8^3LEpQ^YowzcSWg7~FhfV}oPXL4bqcw8#E``mX>nmfw91c!e0ESm&O@gCKF;8OKy9inu<&;_d-t5@N2>9uonQ`?%u*{Lp< z2A0KpbEFvOrf^}y*(BA$`3O_-zGp5MGnWZ2mmVitBa!Z)eU_E;&gUe`-pnXZyk7VL zGi(oJ$f!4%jj4mlEQkZ#7VT@FlARZGvU3I;pWWBK7=8(eMD6K$nVDy0o(=aroFdD~ z9t<~9qQf9_ZYJIbiS@Up=Q-J$AYKeCa^uN@dnOOm*zkeV^CrS)XVPL;WPpaI!wvex zt*dRjG_NoCefn*yZ7Wi+VR8YyyI5>Sj1ZPT@=v}o)`65^a2yMwZkHl;@_ z8oQq>Z;hc$Oc8$hRezEcqGUsg4%?pr1CLou(P3Z59o%NoX%p;pRN3eyS3%w*ytE1i zEm5sHtZCCBKI$5{>HK;C_GNK1o$0m(VEo+|q^+FhvS=LXQ_v} zw*wHHV5$61Fn>-$T8T6dN?6DJ9%@u|Qd>D; zgK@wdmu0FCiDdl`)GOh8;^P(L;n0Wp*;@EC%umQs_-xFdQ|StiPkh-rZZv=-Jcd7z zV~VU-BbJu%YNZ|>y7y`GGq1n~SuLP&CKmeAvEke5_y zFHsNFrL8~{X+Sw~Vu~JkRhyWvYLzFb+Vo5GSgP9e)v8tvuBwe)sAr$5jWw%U9J)-* zY2oo%dX6ZP_%cO;lSY#$G~@3IRc+iA=4oI+9K{AymXW`c@`{Tl-SBqL@iOj*sJZmV{ z;ku#f(wfwWWR|PCbFdDlw5m%~sR7EItLiSpI-H}bF1<|+PiCvCTaI-&>D;FPHhNYZ zWuqD4IIUCkbQ=xlm5XhBNzW^vVV?wLIE)j0sf`1acd2W6cjaAsW%+5Wg%Yj@NBs@%;ZQdMc|RC`=KGmWamB2|TR zz^qFDhN{8|AgWwzqjRm2 zhd-HH(fq5<7)4Co6s9(lY0`=v2` zeq{{ki^hQe+Ngg?4fx>5oocwEFWZ;G?DWR_cS^ih{;e2q40fSY0^^Ht!Ugb7T%?=> zcBPfL7MBQ0=@3HxX0?9Zq8tK*CiaU7mkxpE*Fa5`au^IWubEjXM=Mk}>%Ui-dJ zVn@`f1V+1D9rtrGPglqNanP5{5`El1AM>O2aUTaUb6l39QTg$GtSr1(>7Rs+I!Y$& z*htdao}Pt9i7kK)rmXoVbY-2Z8sk`GCA9#2cRTA#i4*r^O;UAuKASZ~*S&~!7wG(J zn7>Hp-@yEAoyT{fvo6;8! zDOrgu=nQI|m5aFnu!&($F-30lPWR5r!m2D>a{qr%|62lX{u3b_10t`h5QP8I(CdML z(*Mto>W!hU;optHts~ z<`lrg_ycJP^@bs6~4J?8Ad4Qr>covUCUB@SY5&pkz7kj4O;I8`fgf= zk<0}zY-I9UQa@HRVmbs&qPC{ih9&h7@Z3-8!Da(cywp#t5R(jL`65pv0M>46Uk0y9 zcpdfx`KUcOpp6pfBUeZ;B@UWNi&!u<+R>y&EPy)jJqb_*nb*PCdC&U;sK&T z;_z}$D+K3Oak5)l8`^Zd^1AjFR{ioNOCYj){aDL2nT7Vj4GaeEz{^rOx?I2tIP;dZ zEN`o8sCHosCMCYY;sH%dK?SuUmO~p=;>gx$M!?j&G0I5Ft|~|IscY-nm)ACH3vzI4 zcw=Tc#wEw_<7iZzPKf+}9;-SBP8RqabQGO9V43rq5Sy8GLgCk=_s8!`sBeGst$cOg ztTO9_5*3F!aeu~rS*o7zEaMfpZVR!mRckG49paGi+S01XIw9x&$bERKRtW!F;U5!T z3Hf7O>j=_C0PjWuNO*Fc5|jE~j!11;&2UK%eBorP*RiJmg#n@e4+&ch^X{LCH%+Hb z7ECjU#tefZVorl$jlj`x@qqK3P@Dwt8WjwIo{*Y>o|QTeb602F3GC98>YQLlQKf;M zKWa26MFJNrZ)$GGF!yauOPVlNI7Y_C3mSMFGM&!3;dcxSWt#!9mz@z1{x<>6;jezp zvSS4qKZXFZA35K>;Unjd7RJpzE$-y4#?Z#jMhN;`3Q=?+=rb1YgyJX&U95``Z22|- z^5f2W2)1m`jAW(ozZ-%k=VyGPLiD}`F^(bn?Hd@b`F@BC4MA(S*bue13-TawhYi7n zF`jf@d=19og^174%=r_rE_E(b>TuNyUeze4+E?|QSJm(OSh3Rtk$IVE@iT4~_+#{F z#eemMpa>Mo;?7GTjH%0f)DOGVv4RU?eJ+gTr}Xu0=<5(=%bm`q>vuZ)?MTvw+>F?0 zjO_doG@BlGZie#sxYH4tq01dm9s{s0$Ift0QUQ$jKqTekoox^R*^UPp_TM2`azVyT zV8oryuOZBG9}IO2k$|CN5P>+>2jd;b&Wt-%tHEg4DW`Zw>>OvFTP&IpD|f!)7D1}L zCSU*$gPfr%>h)R(p8OdEQC1WVDQS8+9pzpV#F)9r3Dc~E}>Kqsz4=p6LJnnqQ zLyw2CyfD`P0`$Vvk$DNCFQ1eV8I>2yz9sHF3{p>uJ1;vQL16A3v1|zcye5`C6GCa9 zgS-61H6RdZz&Z9hpxI`~LkHf*{I^z76m49NgVKF!9ZrpxTPB+Obq*}ieB9x5h%n3RX85e{pl`+iyJ#seWSv~eQ&~7 zDm>rM1WFAGPo&`b8%c1B!bsy4y}E_st2tTW>Sr<^j)i|+%;!`+HUCt5YCKhcji=gK z<+_2Kp_?HQMoxpKT zyLU$d;(TNLOzu`tG4WKrX6Iz<_UWCd6QoDceJ3dr@Tqu zOgQQ@Nzn6rG3i$c`U*k6mhvWjtDwJJ&~KqU+U+EPZ>2oiP2#%oJPe6N2s86xZs%@6QC4Hg5*$1$JoJW$rT+mMu{N?rCIAXuf68IL%BVI1>M+7d{haH5Q`aDUvsn2_Y&uNsG zJA9SCL;wlOBYv*Ha|Aw3;Jj`i{d9pdPsA@2IQJ3p*#b{e9`TC>F7+u8__cz5puqni zaCy}{5BOq2{u1ZdYbO3!#G}V=7;qW~=LwjQUg8f5e26Ad+b5&Cfb>2b&Oeud)#&Cc!DM55=p$@H@b=W`6k zYYG3d!Dkuabq0PD;Y|j958M9ouWr|AP4QdXDx-{%u6}fkBT?NMbsw zcWRwM{xhkJ$8St5cb+ax)$%!iM2HAK&T@@Fcy8908+2-CF&{t=aL zHt;N>zstZmX6*e2j?bWDdcwdDQ(4B+#Bmu&^nWtwrxO0YfnP)TAp>XqWo%63&-x!n z?btr7|M3RCjLPK(uAX=YeiIFR9+kgh;OnW}YTyr0d4++q{%Z}K^=E#j{+$NBdWahI z{IP-ax8j~NaF+WU182GaW#DYLg9iRKmGwI!@B=E058D4Q;n@xpATiEz@jigWS?;L@ z&T>Z+j{YytD<&EAf2R36Q{Xs%U((_%j+M*$@cjLfL0?IJ#xZx9{$iT%R~Yoq5dBht zqa7Y5`s)a1{dvA`FmS$Z`Hq3#LHa*s;2R15wShlEIDAJ$C6@ab;doyW6XW}I(MlKR zQE2DS2tUEV`TAj`fftY+&Nc8N!mA8CN%%qopGo*K1LymhYYFFZ=|lb5VBjYbE@M>U zxQr$I-wk^9n_ULpMD)Kl@RfxB*}%U}_`3%FUBYehQ`Y}k!m|zh_k<5K@b?KHOE`|B zJWrlt&~xla8S4_~#UnIN@qQ^L*5}{JZ@(;Xq{sWGm}&)%_S{AEt%S2am5Lg^t)+dL41A!9R=2-w^nzpx?L1p5GKW+LPC%?+6^}caYppfg}BIsrufh&3{zaVg==XLClgroiOIx7kPnBF$<3JqHa44nOefAVBLd|uQ?Tz?_|8sam^ zz#9o4Zs2@gJI28IJZh4GcMzY84168o^9W~uSWNc6&cJUXe3OB1Cj5s6{v*O)GVoUj ze}{0i&rs3@cN`Ov^%+L?brPBg@lzqo^3nt@{Yu7)MEY)$H^89h@jF@INY614h6^0| zA0~Y`Rs`$wZK6BVppTH;DFR3Sd#QZBz@;C~5jfJnlnxt6mkJ!|vx$G5z>z+mu9FuD z9O;J={W1eDBK%syd0hDTb&G*N54^qN20o7Ptp+}a z@STLC{wM3Msx8N0V|_TL@T-Ckj{DbX-1i841mJvLw@=_m|3{+dSYphd*V}^zeHq<1 zIV^DG&+BcJ`0>10LG=7BR_4$1j{TJBe@gTPf)DcNc{fbpsDCsIHjs)0j`Te5&NOg7 z?o1Il@|i(=&KEfH;h5EP1dj9^1MX6RBR$WrIs@nVbp_!(zT2P;CK-zo$DP;tyA1ku ziW*`&8TeMh_ZavN!VeM7_J5rG?eh>kPUFDzYl%MBz`sWLi3a{1!bckTcETqa_^pJ` zH1MwzKHtFk+q8=eoc(;6f!D>gA=Vi9BEs)9aE^ujZ3E|+FyA$BK2Q3gfp-x9XAJxn z!hdVvd>#F|f%A3lUk#kELq9Tbz8@lEOQL`BeTKp0?>xS*kv_u>{5`_Sjnws20T*CT z%dm@&qPiT~qo2$BQQVgCO+;5H=;ifqk%9B|QHj9ibwRm-KTYMN!126`Qw3#EAH?}Q zyi(vpnHcu-44j`!sS&tbw;K)o11j_HK^PN;ZGu(YFT|zYW>P!ErG1(OF70rKz-528 z30(H;MS)BG`Ti2xN9tKj*Ht`@)ZF@-z@?toI+_CMrJjEkxYTnNohKr_)H9#f1H`4C z9IM0^CnY3|hk7AFzrRu3)&eid)cQil$Z9j1ihg+8{}K?sx)StOkcpN0soclB3D!|q z_{|X#6!2ydiVJ}CqvRnqr9rr-Krp+IcX&{Kz)LqIKez_o2}^w$$deyXN&OFay9nh6 zz$8DorZlL9Ctoy@QCfN#1?N~^re6mN^)jx;5Jo!kjtZG$IDrq--nOvCeU%3~4zK%x z6ZtWCoiGK{@2~mk&?^Pv8AZV|)XWzNsiWqQ9#)7gqvu%h%w<h$}AF z5c3PHUmW65DJ?N-5X2r@p#u<=st81CQ>x++!3GE*8c{ulB!Vo&Bocv%>H`B4)$71S zWjZjC7oMmL!V~=qgB1Nc9Pj85$%k0AfB7<9JW3?aUQtFJ^{uyX*Vo154PSp5(XEo$Bog!1v!!jyj|U?`tXYapi+KaZEr0PT@hrVeNrq(9%s;PY8-W9qsR+M5{C z?jrp=NFeHux|{mnNAgYmR}s*Y{+EF8ApId0fJ%IRtxKu8&W83u`X|rUEu{VN62{aY ze;+~lrv6iDQuL&MUWoquI~kwvhv}akqW^xyI$~R{$NTkdhMTXsA)>k5Aj1`u~#ToA#fHlLb;w_Q&6Gg7lw9?fH60b4%6rZz1}( z(nDo?s3H1)KKz^dV=OC_4{Us?f)>OIAL_Md_)TaZWWS1unqnIfqI`T-$CUr=5c{ns z`Rl1Y@3=je?;`!V%=^MLojaPvh~Cq1y5Lts^#6eL=il*Bf4tsg`MmxjKa(diAA-h) zbeB2$aZC)`eIFNQNaa1~|1`7@vVYBF-Tr0L1NFyiYE%CUL*&0RRJZTYJ9lg9 zS`i|@gdSkx-_cP%KJRSG{}RdP;~WcWI!WiwqH$!LN?RXEd zR|4(dP3>h{%yT=&k0bwsZurwkT{Pz}_n(O~Lj12|o~GDFglNB$;h)>H|9wvDCy}|k z4@f@$9?KP`{@u_%$bX9H{7K3`B|!cYpnpo=fv$!IWF0Ata!(6re@0nZX`x6ZDS3@> zjH=P2OG?Knn%>8#T5&Z9rj%6sB>YBZLrf=s+^O9VD=INGBR9QuOBKcs!WcHS@G0P$ zH=GT2P6s}IzY*ru2HbPJD0nV0AM-i5yh6Mdj9YWVPOH0Sb;hGLtJC2>0sm?6ABX=K z{72#6f&U2n+wgBaS`+CwN5-An3-NZ|fH*I2I#C?O{G(GGh#8aKd1wyC=gEY4F;t=xQw1(k?dvp)t|?Srk+ zL;6@(zTsHi5s0;ufH*!7!zcIF2*lo+W?c!t5zU3$;Ol2V+^t{1>p?Ri?$+Y;tlRs8 zP11q32I3So={9YfBk7CN(>tn0*qgtFF=9S((zmx~SWleN7eKtIH&3=Uyan-X zqCf-jh(^9aakt=^n2}rhT4O(UlHHHn*5f#)*bZgGbB_7_`*?ibJaTj{JcIvO7x3ct z&zxj^I2mlUAL5$9@{x~q&&E5dINs66fFFX`NA*zm%xdey1@IaW(!zN~{h#U1x z{JM{JflQ>|_R)2khn;cz3_I~F;B(wiJ9%WrQ0x1^qj=~|)@L_T+a$IDd7Y8OuPW@s z?Y{&)GwtN~5i#q-#dgMw%zjom((VVE*CPFXW!e31*L@kV9sPfK+%(Xl0%o(Gaips(FH=qq`L0)5|-|ZIgyD<~T zO84(-nCD%PhuBg$2UXm&UGUh@Uf_keH>MCr2{2wCzTsG7>L8BQ6xj3p!*#?4dk3u} z7;_G;LI2@-0q2))d?t>|^eo8Ian)u*Y^Dof-N3j^(>q}uQE{0XVO}I4M%U&@LdEDx zK#Z;^#KyvY!V?CEMvp!Z(xF3>Cr^tFhh$m9ho1$>vc`?W%PMny!gUANOk6wFnu)Ks zCDl5akLw}Eg2J^{#&O#Z>lDToI|%C!%IyH#LOi%`IF_h3GLG8OH4#|-8E3j7waJF0_RtA2PBeD9iSLy7`tr$iB>MIeM6>OS005m??KS_9f)Pt z1hLFUoU(gRlWm;|_Nn4E4d_Q>zY?&n4TNc;Sc9~$=~!uq zcR(DkF#cOy-^BQ8IyT>4;DNr0_6_orp~_DRApYKTuxSOv@H!uCjJ`6h6Kw9r@H*;f z`+p4fKR7GRXLot**{#Mjvc1}}KkNjX{vOs%IA_ks;}JMlKH47jXZ>)!g|%z!*I^xn zb#NrEf4B8dmY>!yS-vc8eRu_|L-6tIk!p?t?{DOG;NzhAu#W0E2R07t+g^~b=fL@$ zA9J4^*{3w{se;bWss}>f2Z28w4>9lJu0P?iyvxD3YiZlDj|ZJN#9oU*EWGG;Jk}ol zvDMwRCgahrHR@%SLV>(irSx1F5qhUeJ3Ux77Z0F32tX{~_cqe{sh_Dsin zlfHx6hwZr?@7ELkI@-fIk4jI zy9?8R&#)md5oftG$h-HEV7N5|%it_C`T{|Z5^fLpF)H_+Z(!{9hB9HD;ww{FML6r} zBHuw&e8RX)b#|p8|M5U>uY@-MDR=q~L)B(G2b`?R|=3Lt55ptH_deMZh5BOo+SgUa;!B8H*Dk%@;(Kc z%oW(v;5Vljyq>$l%poL_$+{O&lG;-k)2%K~BhwL|q^e!Cx2?-K>-ob%s&scImu50I zI|MocnaS%>k3-C@c@QI3$z~o%Udj;LP0||Sj1?1N8!2BwViDs!A6#tr5h~pdwq{2j zqvql`>C#fhY{K>A($@bw5jn~x;XU6`g|kG?@&fDS z60=NMySRd{x?tcr%K~70ILiWninE@qI_AZD(}q*2g1O;x%WNK@I>b1C*v0O&I3IP* z=$?d^6ND!h6DaR#)#Gv7)C!^}vQi$GMcgOen|(6}$gyrpxSeA@3SC;z5*icji#kP>rW-y-Q1(o}2XOR;Co3^gW5;`Xb7JlW>;3^NTqN4+1y|XC&FQs`*fHTw5N9X2X6y01oYmo`wskRQ%Uv$LK8SHs z+q#6aV_YshIv49Q%58EfXE(V}T^D8HM>LgsaTUzEuz?-xtGkGcw=-QmNmZ+8@1KE; zzDl)lAnBqkAC>@O9a%6yMC9&*g1O3At&SJNH7Wz27G}aTf$$M?719+$lg4%M)ij7u z8q;B36aLVv=`t*9h8Mjw(~D`ErK7X<;pnW{UUb&uL~PYk5SN1yRWZ{ygQB$No}fa- z=Emn`UY3c0kn(_}07)o*YhM_#ej+vYbi_$vSAMN!7U-;M)1G&IMLu5=95w_4DAa*Er?cxE@u^4vjB&_{k?7a(kRmIge zzW3Q@pPXEP00Dxc2@)V6h9m@tiV_gYRpq8qr41n$5(y+GK|xU>pklS3SgDuRDy_a1 zkXBpKDr$@MhSk2c)mqxp7A;o1Rs|KT$hUqoYwbN}&N+f_-}n1J-~ajMN%mgzn>B0J ztXVUA_C9;hpkf2CJ1mGIqwb1jV1>~%gUHz2CWCo%S&~w$H?18KS^<0TqFsl|4z%>z zM#9##!*mRWJSlNw+7iivwBZ%hB=lO2X+kZzEO0H~amoXSpvZ{8S$yo%Tft62DNbXq zyrvRYeJ&?(UYm%FWF&HWq>4$m%>(5}BXa)`xi<1ONxV)aX6O|Iyc6*AoL-&58=$&a z>`Fo+*E4%`bVjQi9Uez?68%TZ^*cEafv$)vyoe-5N4>9K{@d&8hwLcNzd$qp0rb4M z6M2mYgjiG7?wI~Y8GNxi&370y4SkU;RcqQ1Y+m;6jMIa{GpaP-AWF`-AfB}|W1LEZ zjEpmM8Xj0=Ow%-02g*20(V$n#D6hDC*?=fl^d*m7^>lcO%$O4a~x5*cMSrfI4tg(TNtZ|`?tns0YEZPM&Qcr>rvd61@ z&Dmisv$>Xc5KFdE%k0yOmFy~HqaA%iJ*Y`#C7zr!l)RleCoA6fNJh@7T8|v6cg~nx zh3A7lZAKt3hc@ZW`IMO1f)UyE&0VLgl@Sk9V1~k)1!xqt>DOeKozfU*s=~R?(@?PUMN9+sImNN-w=5v^T*;KRlN9 z5~Scwbg>RbKhOx?SKQ;NT48*W+ej4&D!y|HelD&R{xkdya4LoOLSa+O1kK$|}Ha_4AoI)}E9 zqy`~foxEKM%-Bp6%-4`3?n_9)-jX_n8c*d+?WkXnl-`Gxzj#j@mxO2Fh`1s--m{bF zI8c$#fy0SyrnHExz!II7vCNHzV|A3r>faGlbZUGMT}8sdI?99fl_VxQ5eEqLh8QIe zT|tO0`9yfTCWpb%HF;8~&v0CU1}YI{V9;cFNREJDjg|r(ta$63*kXzlV;~8~ol}OW z#Jz?tdtn7tXOFH-x?9(JRm9f^m!3X5NQ&z7eSQ~Ee;~?x*w=Z1F=y6=`C@)D_$%iLcEWt)2yeE zcB0ugLMx4-Bp$@>um-U^Ejw*+u>wFi$bH|k%MaWJD!h;cs^HzN_qUIxK~VIyz7 z6T_$w&M~UEgO(c|^mpXiy4$PHuC(hmq>A#pN{?D>^&6Z`urAN&Im!?CNc@;hwl>*Sd|0-m%w@S((poT+?FH)koz^UhcLxO!r7 zfvTIP=c#&W`fI9Ap?Pq7&*pi-GS9EAq3=H}^Zdr@;xDS9FB}4XYw`ci;(y8Nx-VPl zzgI&BnIE-tyqzvClZ7gR_#X`Oza5(2oOTQY-#f0~(`~_|BlSd;8l+VTEy8FjL1lf- z?Lk@f*xI1S*7~HeRn2&5Y*kIG$JPctw$`h$)ycD_k7}}l`Ql7Hdz_``lC!_`RM{FD z^u%Z;&uebTP3KE`Mg*(I2GI4SxR?%Q6?8y|Y<0_VF7?N|BS6$sf=^zeBAAo=liflU zLGSaYxW!J{MV#3`-L2^7kJ1^RMn?M0L-D?b$jNR*MczZ?6gR3O2N5~djjISQQ2rP< zM@7y@H^5xiOgH|Aix1;QxXhyBF8g(ns_Y zPnmZ~OWUG(jWunHTb3+uX|KjwCi9Z_?VML$T26murSq^WWL>qaSU~wkRh)EjWes+{ zPP6m%lJ=&BOX}+i!I5?wY_&!MDW!MCr4=PQ>f4soG&_xism*Hj>I}3`ZBw0NY*)LW zzOJLWy&4Fuh~WH}cFvZ{s3jG6!|Y&%f?$=5015WErUenof@DO@6l|IMgK&bUXj3wN-%MX5X!E_iRp4rVQEJotD;`x?n$E zu}07$A*ZohadS;aLrdG@>Pzd}T4>K+Ricv1yBbqVs?}?P%z>dG7Y!YxkXF23Z&0LK z)g*L+MfJ-a`cJV*a5ZhE?leJtRk*zibCXlsTwk-q+D|!fGiO0fo!Tqd&|ek+QMzE8 zX1&5n5aq=^0#$kCm%w4sfgBt}+klhTs0ldX*-%9(-Lbe;Z(tl0#EX@f&Cy=dKrOns zesL{v*EkEDB~D#aLqn2jSx3Fka>D+~rZipl!X-ux6_m99G*EJ-riSIrnouGpwPe!ya!Nkzn z$epsp4%Mj^ENvjKGDs~1t&q6oHX;90J8JVx#c?m4<+v-3caO~}Q15=_^MzLZvS{p^ z4gLyFle~o#pUfDZNjh_Lj;m68X~%Ak-=g=s25&R-NIsl98N*!+0;cxs73DZ%a8_l9 z`)-48E2rZYK55_V+w{KKkh6>VUdDM&PQw1)knPZ^Gh%J9UA%JAfg%5a&e4Cg^=c+-;F=B0J@^EjTc=QcH+wdXdO7~O|a za(S91(fr%m5*x!)OM4RyOSC06W#Q!Zj<%(>9SIO$h4}*9p17HIm^0;G+muXG5)v1s z-8Gt8>lfFRjVjeq%r*jwrWyfFQwmMD$`yKPM^m$gw3b9CR+4uD$6ZF$Gk5mhtG3pD z6kBV@yxgg=ZGHjmZA{x#`?P&>5$&OkjjZWzTy4-z+e>4^5_vR~B5ur+1I@QngvZwkddVirE z!t=e)skjrpRa6>i%5e5Jzi-Sdr(9=k^U5Q|E;d=t-sX4nmeGF8v%GsC@b)VrV`y{h zm{&#{E>n(fF>fSoAx)yYP4#=M@w>!-?Dz6=NZc0MeH^KjY1&k8T zKL-mXzT(hf^U4on-pdZjB#a2!1o}h2du*D2!W6$d9UmdftfI6JDQzkx&~DJ2awSa4 zxsdXx-&1Aruhc5g2I;R*mL6npe`<^h{o%@O-k+RRbY6wCe?oi=)mxQRyxQ**!~WA# zRB=C~;{HT=`^MrwLUF~@D0wO;EBG|On1DVZmLFS#tp32*W3)>)Sv1$H&s{ z*(n49uZqk#A-bN~V>&PMDh$Q;D$W*-peS*XNfcECj%X*ynr+R;) z-M(q#?@hF?H#J|cX)*8jdhhKYds9<*Kq$v_kk3?LXjsJ!=(CDUsougLQb zbB6Cz@1_?1C%G@RaLn5u`A}IgP8+u0N=5aGd2d4JTUM-6jmKBgXy5GQdFW zQh5Ia43Xa|d_WSe_mnYzanLNom7eO5kOx18(PN+l43WMHPk!X%DLgBQU#}%>JX~as zca@%4-6}D>rf`{wg=v3Kc#jZZO0Qv@mxM2%3wcC8X;x`!PDa!L`j5y)3Ph`Uq2i#& zrTX0pj)f;Lg&mOU8FE5y;K_E@{K@vwc(Q#oo@^hDC)-Ek$@bBBvVAn3?B^O!_H&IV z`?q7~G3w|zKccg_=eX!FOUVh_OYRT8t>lFES95!kag~x2w!6q7_LTKHCk+k@OI{*_ zfIYlY;eSeFpB;bBN)8=@kfvcy+92d)APgv7i@;QAp;l)hjB%VVL z%M;r?Pj*GS>HIzcZt6b(>Q&@z{MtjUP^=arThqxWAaz0!T-a+O}l-b z2EUEQf01wU%btBG*Tj7uH*EYr)8LbNDrxh}ULQ98avJ_i>38r{dYXG_nR-s-sj4mi zjx_jh)8MkllP$;G%h)V;H#fY^-!n7R-`vY!UK;!dX>i$F2l7oh^g?-HAL&y7Hl)FS zZ{Wx2tm-%kFJw@Fd=tMb4gOgg{2abu*m9mSaI+tk((7ANu8H5C29NU;8S+j3JJR5L z(%>cX+qxyEBMrVS4gPK#ypShd(9^t|Yf6JZod%!OJ+zN0=iW5t2UpTlxCTloDf z=VuoFUB-W5;a_7p&s+F>#&=oxl`Q8C3zz$ZeHMNp%Zc(?+N+M`bhB`&FXjyh!Y}%q zXyH;W=1C_1#T-Aw!k^^0?0GHn-(dU#i{E8E7h3p0#+O_8eH`yhgRiylOF6#Y!X>`J z!oS1uM=V^*+iBt7=lI_({MQ`E^8wRtg3DgYVjs~{=0$>wo>^=U!9`EmyIb&gxIEdz z$i_!ma-`hx7B1zUW#Lk8wS{-(ctaX|iG@qKms+@#d$om2x!bpI0ng^wG}=!+tc0`3_tBr*k~U_sh~Q!x$fF;qoQY7{+mZG3V`P8~i8e zs;c8Wi+={E$sWierbsTs zM_K&mG5;wB4*4?PPGubShaGrYUo=DdBSCFenoUuWRZ^Lt$G4F-;K#ctoVaIw!l z1`atNvz&Vk+_cZn3>^G7M(9A{Q3D6R*ymXT2mbv{xZg8 z&r-BY5#bW{8~l({(%h0C757cmY$guiWId#<$b`x#$n$=S*Bzi099 zVgAh)zJu}SEWDBZ?PCjH!~D5yKhg7c#!D@H3**x){AI>v4@{A>i}7X5Fa0{g_!^yvo9_V0@Z|i#^Y^@N1dB#=`Xn;k4(hg;z8G z6&8LIki_$KC;=Qd(D`7q=!7XMSszu&@NVqAYnteM*eDVJkjH92z4sw0G%i^c?xmCE&!o{DrS@>tn|FnhE8q6yEmT{D8KBwAa@I(JW z{Cw)L#m~3%PA=CEb^!ma%s-5AkuPP8GH~;`)&xTi?6aHooMGUQ|7(^n?I!jYf0%Fa zkLBlLbp{UkGVf_MaLAXvfjbNw{4yWvG;r|mXZdRk9Q;r5xU zH{-Ay>{Cep2tPJ(^EumNmYmPnZsy+NDEBcg_XUez>}KvQ4*p_(-nYx*7rV*xPign{ z%>RzXFLwKkanuX?SJ6L07j93Hvx}b(_O|dr{9LcV!kZZ{wQ%`K`D6>fndOhS@Sn1r zX%_xE<8v7o{qZ{qLW6~GSE%D$Z{aU9{zD6Yhw*1ET%K#ZYT<=kZU+0E=re)we8#0; zbYXuevTzwUhFiF_?-4qjy8(l1t6_-HQo+ZH~C z@rNvYI^(~z@Os97ZQ%(qsei+$FUEQCuee7-^*XRRRz<=(~Re#gRJVSJ;7XYzyOhb;MXS^kR_ zzJc*K3^}Nmd|$cW!lhjt9v8))*RY@DSok*?@5?ysP{?KCG}z)V_jMwzKcoWW!w#o$ zy+#{2^pyF}83qpitC@e2frDS>KeG)S{J&xT^9&sPGXJSHaPa5z?*|JF9Q-o>X*Y22 z*D(Jj1`d9)+iC*`|2@oqje&z-?0J)cga2LTzs118Fa6>!0|);Ip6J|T;NX|>@Bsq{ z|MkrOGXn>|^rL4iT>RvB1`at-u$)&69CBnle9gjTJbaUJ@t;o0gYa=0yod37Tp{t@ z3T6sr7QRQr&IK0!8ROSl_%gCowMlYdw!k zBQ1O-jUs?Di%>R1}U&8n<3$JGU4GX`H@qHG47vrB>_>+uh@pVSp>mkN_TX;6> zf4qf%%KU>Z{BMj`Sh$Qc<1G9m=AUihuQOh4;U};@+FSH}E1n}&GQhV->i2r!GZ<$v z0saEx`Fw^ygJ1l-)WYX-T*?vt`HWZbS@1fJPquI=SM(D8JnlzQj^OefY`!IDE?=h_ zEnMDL>ojolx&2xTzm?` zw;Qp+`Nz5YvG;TF7F$-Id42*;V*OC;e4<|pX=GYNKv8qcRA8a1Aw;MeGl-<+H)0 z5Buel>@O%lSOVevA^I0&N#M{XZf;sq&-JZutZu;9&IuM@xU{CNju|*dOKtL3n=f0NlvRSH1CgUa(t*fPAn8ElNRV_OvH~O>h#Y~VI?$>Ogwlb~ zGLUp2vJ_;g*?a!WH1@3KTh#;^RUJB7VI@*`P6&8E379pFaHDT=DZH5`on_fR}l`8$~}m(Oyt%lZK&*cf={bNMnBqkIgN zcKN#qOI7|}!V%A zxFEigC}4K`FXQ}2vfrhYH(PgVXFE`Ll=vL@`Z9-z!N2F}(L<>MC8F8`!7zG>QDekYUpAd5*V zKQB%Dck+Y~{R08zjI}iOV?`&Q77Smp;o8Wtjo* zDcWs{^wu*q*9P_j=#TlLlrQ}Xaa$&GPUcD5T_oQOHg7foHU|E;`|DiI)&OAh#t2BI zf9`CZ|9+l?LVvvTYU^J^m@N}I&nw5#aSE+OE9%T6o>b*;Z&BHu7rFi@AF9~pgAFoE z>E8^OjL@+^Sp%b#FK4(}s{Awg#oTjEq09?N^5Z=>p-t9%*r zIe(!gTku!9C96n{rc0tX>MOHb5#CdqNOZz5!wC8Y?_DuFS9eUCU_DufRD;&C;_7KLt z-f^{Oa)kCwcGZ5#Bw{_%UiEs>{?vJ!|CW{4_I-L~;O}0+<~{U}bg~JCyY=|rPkRs3 zGvAxB)YxM`iWlK=`%d!LA)Sd_2EX6zu#MXj9_zU zPwRAL#i<)4`tD z6WwSJ(u@3M9qfO=bIAT4)q^mKe@uH=@1s4e_j}RJdo#2Sj#IT9I($NVg&!oFZy?>V zzdf*c>v6N=WtV?z2kGm0Rm*Abaa#ba>fjJ66aQn~_}l%d z?RI;8gZdn(K7(|}UgP6Z)GI=JksEbdZPux9=y{HJ9riUxo%T^(_EQ}{qW#@JW?!Ry zs}Cyu*$xHSd2M_D>}u>O!{|54vfC@E2G~2*y}ws;yH8v7Rh`2H9Ef< z>HR$IAx?GHd$4ba^uBHtVXxBu<8%*_hxU7o<%z8AhYpWI9`L}=fz$r(Lvg0LT;6_` z`Kt0UEf@Z#`6XU3^kTAkI=>K~fDI2_Ha^jQPwM`8pgKx^<5M4vS$&lJfpp$aegOM@ zMD|nrnUg<=FOc61ogZ^X?xQx`8R>Q1?po)@1KEi-g|ELxIQ9|W`y1UC)qdgbfziMC z%ILR0p}ol$ki8E_dc8fKZ0UM^$d=gWUi;SeNT2I|5b2|ANk1!+Eqk*K^q%D8OUh=@ z1$OJj`E}cA8KIqZ`~cbf7P8xJ_DwmbvLg+FO(cKgKK7*9$6_?r^`^bm z`w&k)*|P7ZL#zFue_@>4ul&woTk5eco>z5nBkjLl(B1if=DKs9>rr*^6VmN1s?%uN z+dl3)ADs8K{1I0kK0N0Z=fJ23X#Ak-eBLLkopSA;@SOrxf9cCKVy}BLR<*ppQ*|&x z?FPO*Y@<&7+4uT=WUDNavpqt6mD26Lige_IFQ&IiPqN8ZslIcm-sh2jolE`|OB#1R zU1;^uGr~UliRTT)nDeohq3p7c#+{GSj5}ywdcS1k-hwM%Eu0zyy(>&iXZQ^#odhZ z-84p{?lfj?#(CrC^IvMDpIdj5{ii}Mmj|5=N8*dNldO|{XDf|civJgp!neQw`QbSj zD`l)JaC*PpM0}OqJA0fA8S_J3I?3;$v(&*s+^EyI&kmCh_F=zIZf~^p0H<@7YH#A( zL;m`@*K6oMXuNoXeVl%R&3l;ir;6qECtk>VjrdSM(|3|(6(q@me{7&@+tw4q`gQ95 zq~yUa`&8Za*l+ePd%Uj+`j@_bVXXRe;dt_=aJ=75K7RY*!?;CQe^`xM5#sTvFB)Ul z>d>zaz^};9K4HK5i2MrU7_I?o3{zv2zMf%R-_Cw@O!a?{U&X!9ug3Y*mIbN(YAyTK zE7UIZOO7f>Z zPG=9gjmmq7${s~$*!YiRW60IlnACoTbod#~d4}$x>(%Qt_xK0-*c)^$L;GNS65VKb zj%o2s=b|-Kj{-Mu(JjARdkp4o7~`}L=93TVYo7SvM|6F`7#56QR931N(`dg>;gWMYDaApS*+O;%>eVKzS1SVLYzr10?hgdlZDsP|5PFQsT_IG&#fHV# zB^Q6hdfm+erA*p;TguuVlr@*B;AB@q)QSeCIAX!VO0xqMzC;^LU_Hnwg?uW28ee8o zZb4nAk&)nJt1k&Nm>}O1Ql!9%kA8nj$xXf{q$%j=_oo~dXf#{M?EzGuT-BrQ4OM}Z zIYLUiQ%fWZK4N>aJiVGKMQ97lF^q+RYm)^Zv4e=a zCNqQDik|6t0d|9WR)y$##!_q_X^WoAtUH1%P00$8l=lA;V}@jJYg?Jz z8bV_BmqUoD;AC4ztRn7%jxdM0=kwWh&KFYL@F*_H(s~J|Bf|=nVAimkF9A2)Q>9T$e2P zsJqUXKyWZAt_;+x7r|n)FEKe1uQn#dy914DMQ~_}qjs{=K;!d-3^i^L!J)=SoD@!A zfs^@c&bFnEF^94n8JIMnt1v%|t_f}C}hN8rasGw2} zy5p2u>}AOW$u&$ghXHJjfr<8G0+kz+&E0sk8cPd#&NpAQ^Eh@jrESE8^cX2IQOtFc zY^WJ+`L_7E%n;fs=+a^wYFVjl=(G#Jyx@9ifKYJI%|gLPyrypFlAq!;4Y^0sWd}2a zm267Z<%qX_^2ke^h5X0%l`rvJBgGYC1$)=OeZ?>Z{aaTIQ_z3Y6(i_|GJufHX7KPh zKNu#D*q5ZqtC%n@52ZmTJ?fElOdut=7R(Q%)GcFDtnnpoaZ_9iWcf0>q9hAGqW4R^ zEt;fgWw1$$ z4-2f_D9u+HKu2swQB(%~BV7s_MB}|dyEn+7BnqRlbJO-x9k!Xto(b=CXk_qs00JW}8vOWN`>dQ_I04RNmCK2p14|yS-jib9oV&}?{&@Xb8Oe{?m6@$YNW#Px=!hNO7^Kf zy>~vynL@t}N4u$$-8QJDa|$&+JAzWd+QHWJifP zJDYM+B&V1-`w>rdoGB{6j~qNGT!Vr2o{ODG?-7~FSC&q8AEK|3rd z0Lu0pM5X8TBBh{RuU;-ry*W#^Wa-0MvXLbpb%q*<^erK)^oUjE-!i_hMv-SM2|31h zB7H)}V=J6Uei-dXQ6u%ZES8D&+m1iZE$a!XbF;sieI99CK%(-?sI)?)oYP0}{wMET%u#fzgBq3T$8g8{(Dm?+XS9kAzDx`w54o`#0x~eRW?*)jv6K$_wM##m8C@cg zxSQ396bkMsahx*Z+1u$9jaKX8)zMW)+Ovm(r;br|^wlw@ju~2fMpWnbPgkg;jz^VW zaq1N>G96Z8OR^9rtDJ0&5Sy8G8k6qTTKPzpEU_9pJqsp4aNB&zl9A_TT_oAB&DyTg ziQ~HHm4s$p&q;B;V9g9SzF2*64oUGAy=n|B8E@AsTQ8)Bh%e1mJc_=!IHZ?Vh4k{d zA$@6UNUvBM(wA=t=_?)%>CP8JdevTxXO1dswd017tMZM=)ulS3)LuK;h+IcAy{tCA zsAoQt3t{=0^jZl8aA*E9tYqesx{`Mid*)NQPV{afvSdlo%yn6v$VI_jNAJ6l%dCm4 zAp5!azyOh#QH=LTWZDCgLi7byVs3PYD$(}{`jsvbt{Qzl?nJW)^t#a@>liv9M4wc- z=4YRvay>wB_CTHM=b($Vp1%QoqHc`WL6_t!{*OSH6)GAF(qxY+Rx}pp$evyr(z7ZR zeHZY#Rf>KX^aYa@{Y%hapP^_hq@Ue1*U7p@tLQ`W%iP)ps`JxXggZ85VF#2%VsL@AsqbjM}a-FOkaxInbCp1cuoXQFCHN0u%WSxw4 z8tD2%i#;=lE^hD*!;{tc5uRksETK1zaeJS&K_T za4;?t6tWg~?T_;ail0DPPN(w#08_w_EV#XEAfsq$1{if1=+1!tgRU{KK|eAhvZ5yV zi~eM!aMolj*BSJ&!Iz4msE6tzh7P$-QIUnMaR$0Gscz1o1Rc({*odKMQ3@#Xwc8kR6d4IxARr$4*357XigwuchMBTeIZ+O9{Y%nJ;cT=hfp{IDZjo!CvTPV6Sv98c4nkolU# z)U_C8!c-LvyUlgDpoGzHKn>lCHb7^DB3Xk3k%8`P@@MiJk6!N?=+2_kET_nHN4V`Z zl#IvvI8;e2`aY>1&Ce`1eFV{kxS4B|}gAN1|iCj&hHOD@fQ%MAo}qPr9yX+Y0U_KK^uSL7?Nppnq_3UmqE*;i8)^tJYo(XxkN zMBQ+ohi!QH?}V11@>vlV6KqYpE?AuCUn$i?`$f@|!+{~>g)P^|MH!_UCn@G<3iFz-w19GxS}lt8q>zGudA7S)_7$eJ(H(M1KCo|>a)&J z4XWu0E|%#kLEW>yqIfht$$g1%CyJSDbSIJCU+9pv7a#@y{9K%JyJ)jv2H&MrPyCRh z%LqO3TS7ctM&+nXiaxnZ=s0s}nBXq|b<1(8EytPf!eK*4nXhUP#%q-3W;~I<#^PUK zIpTt(bU0$@Y4t9KiZEWM^bO+;mS-+>VFldVJ6S)VoH~qN!`91cWv{%Efc{AQ9uXCr z=%C#4K_Q+XBE{%|YlL}m9JETcxGrVT_l!uLBw9nX%(xSH#>A`i?1=5eY&k~ve2F>grToM37iE`rixT*W(_x1JD>XS9dtz>Qo zrRJCDjogtZs{vCB3_Eh#Ov>t6o0Us(@7-+l-g{l#C@E8BZBc$(f}*k>P#HA+Q-j{B z=&;-2S1j&!KexKwFRX62-RgGRt#0y!)$N|J_@A)&e`%%vQl*F8=xM8)J!N$>JtBtu z&l=rKc1xirctJON@ym3xN>~x0nf}8v-c{xsF6a5)`pgi0c$< z@{~6Bzqi+}CHGJ4a5JdG(S?jIxf0OJFqb@6_1$w+-tL#w><Ln$W07BLNwc-9i;vipUhV*zpf?=8V(bQ~PC%(it&r&Zy*! z=Oc2m8&Mh0q^VfODQ;9n<|1;c8&{E5M8>!|D)I;-r@8q~_?UB>Uq>K9Y_RJGPd|IR z{tCu3GPV9W8J#Aj)Gty;L#Yq=e);NNojD__b)wI4`UCUypiB_Lm zx&+Ih)z=l)QaMg@3)v)qklx;OX?-;~3rcL~65>P#1aw0Y%F&7D`9yfiC$wSa=LTAjLZK7w-7&r5r zu>3P8B8C0|)F*?$W&YnE3%!<>(7&bC;l!c6_w0TC-5@})-Ds|SB857T( zP&TSG0LgL_CXPR6Qlh>AdghEN$*dF4m=QKZdt*x*wF|`J=7lY7O&yJkDS^6((_FvAIm>BxmN>17aa08*h)*nT zZK_6Y6L2Ov6X@-)na+e6&V-rxKy21o__}M>Oy}Gt=iCOTwWhAFX~{xIExOlK7vv@1 zudZ!bqLx&Y0$LZLOE|5I=&xF>IEZ=$SqS8MF2UM(%8}vaR59pXTeGCPt_9U-YFJ*~ zuyjdnkaKaJWUr9%mgu#8aI??FdZ6w!SarJQcQJg z2Zqy4Zf0&;(iAoq$!@J_Yp+LUlSzZEOBXaZ)h49T5QS3f+uB;%%nUGkLd!rSfM^D3 zOn6H|@nEW7)(ZbMdARjV2-XdFNb7_+#3TU3a0&UasumeOK~tSTRZFNcNeGouHO45e z9KMp;0Fi2phnk{FE$nD?T3gzkHd?7lY?2Wz z5*AQ7YHDkprl6LPm}ISm^-Gj?QY5)-OI>|6d$U8GS9dGcknjKkL2=cIR8xnm$mEL?tykV@kS+L^WthQL=;X^(NlBsJ6X~G*}q=h_YjQO*`dk zZEx3Uzz`ur(Y3k0uDZRZS$kF^+-ngIZ7penJ9C6X`rKU=3HvDu!)tp|)(R zZ*8k@r^c-5pqWAvPt#(!ZbJW%?AoiVQ}iI=pq8v}tIFI}Ep7Eqb5lcoM-z>WC>KM70My1b_6piW!(mWX`^Bo$ zS1Yi!g~ov8&eHapg`p4?qa5T@<$(;%S>0{}9Zo}Y&B724Rjft=iGdc-Rw-yChgUNL zOev_tQN!QTh6d{GA*sFFh;zSC=7W*xf=EURD9s;6nY|qz=KPOLA2Fd-PwnXJUOLNh zR~+vin^WKvQd~Wwr!#(4b>`$8S9()qee~P0o8xz6eNR0eC3p<|BkaUsUe0kdgy)v5 zTXSy9y`#tX^3><0bx5aB1zB@*j;k{H?&$hG=ukxe*V8`&9{qn2AD+S^;6by+cY6-Y z!;R!FFj2sB#bo`uen)Gl?;rKMIgX=V=}oFj$lH=Z_lnLSJTh_Jf6*&tbb=c6@1~iK zw=~kkyuEJGaBA_Ui|dDvC@C))Su$#P`|@@gIXZ?fZEqXiw4}CqXbpyqorIk8RR2mNI(b%}Jkw{<^LUi`Z@6jrcSMLb)a~fql;&n!xZ6t_VL$Z5r5#Pp z6eIJhe#ti`>b{|xhCHNsl(tCoEUwdMzJU>0^h|&eT6}nEZ3i(CL}Rb!UO;_s>0(Wr zrKsBT;Hb3te1u(TgumCfrX2?|H}d{jB)jn0NomsoslD ze2m{EHp|a^FgBHl=`ru#mD^(8PVC$g^ER%W>SxBhKRT<iG-5H(g z`>}1&EMTu*w$0C69rJEoxymnzdG9(ODxTYfC+7X^GRo#X7oAG);QZ_|5;@)P8o$@i zT;q440)I~V{FwK&Lt?xktNgBKtNb@few6VpmC=2g@1Gg-u3fn*<{fb29Wih1%6La4 zO8%c%#kH>Mcg>0n>l5=nykeVwOw7B^-R5^a6E*tq3M#<+UoPr(mVf-2ROeNGHesno;GZto|QgW`VfG(U5#pX*&p zCCu= zI4NEn^PX3lPmS#Z&sM5kkC^weOB!z>HQbo@SEcw5u1IN^ziY!3^`^!mab%c(z%bMO z%*XtpXZd}-GpJdqZ60*mRW8})6Gcj|IgSZhG`(D9Rvhej( zHmUlFQuW#^;#*SK__m1amt{pN`;t%8PNmXg-oDFM`Nzk+b&+j;&nbRC@`fqoNipxA zm%|yo9}-^pk)Pe^k3G}Rp5zx!_p>ManZF>viFq$kUTUQKBE%ZMFXsIx#Yu$+BWUL5 zFHfn$Yor3XQE`6EyM@@vTCYc_w{$(r&-{7JyNOCIjCs#QNV9F1e@MhCIyh}c$cHiSDw6RplEvrP8h`M| zez#74@MC_r$uaNB%gN2im%iz3^M`$egkeZfuDwDh-Qkf+udSHs9~blP^rrg9QejOF6jU#<*QuDNeq5#Iw}SQ8~PeRdg@c6D@>-{&eZ&c}eRkHRtbU&j4kM$eSz zZZxt-oevJ%iT{gm{-HY|X|=*-b`vHoQ+V+9L6ERm;pQ$7I%$Ez&D|a}K3n1H7n?u^ zh_e(wS zD9xc1uHH;dO7n0%Oc6Y_s(W&Rr&e1}g(vF?E-!_i8c)_!I4SzgMxs%fHk4PhbP?~z}NW)KX%KFYqBj>I( za%5y4P3h(yK5_-2U-c63N-7uOSi*;BQXS_q4P3oZ!14J8ej?L2)fxCW1Me_!+~Z1+ zduPZu@!OdJxcW7d<2wx8Ir6*><(mGVYuMBDf3d&aF8!F_ZkNf1oPVcXIt~4K+XaQJVI2CXSFAX` zme0_~#IHB_3z^1gJ=5SXWE!WtnTCBT4Sb7%k27$yUCeRD>=&k;cX3|Zo_iR#?P<1) zX-^q9Y&nH#{IS$Kp0eF?cKcC_Vc01NF zZntBj!C$Cy>O-@^Z{pW8j&jEs{2L9t%D}fUZtHVDtTZ$BktMf1%2$4=W6Q6Th8tlzW=NZ~B|rzAqd6RR;e~#%(=!F>dR*$KW^h z*=z8dcn;HJM-F>d?YWX7St>2I<=hwX21)&W2Am`@Kb zO@qIb2JcJx5o|eaY48uy;GaDfF=kf-OfrV6*Wj)9`2VBNFiQE3!)N zf;9M}Y4E%pl}+hm%IQpl|0xYViXR=?`ZT4%Z#QuBso?8r@RF{fo+ke#Y4DHJ;Aiur zALwby*_Z}*b5obAKhM$aXv*osgPJY>xit9aY4ERc=d|TKlm_p{oyX=Mp9Wu>2LDe3 z@1v`(j(xcEK)#93PlIntgZE-5v*lcn2H%_n&?xhN%=yS2j2UuWbR0e;};Xf=Yq z16=M|ki^9XayBvlAU=a1Jli=g&*(({e#R&AS@2Pm4`G2m1@f^cBtnZm1$Z~cFSYRD zj9+Qt$1%Rn!e=vnvxV0(e!GRs{No1}zMA?P_%@$t9{6Dbpk&OS?!cS&=n}siA{22>x zV*Ga&zKHR^TKHnd-?H!)#y__3Hpaz&rM;Fi-j(ew_%g<^v60!nmobhv)lB>f#z$EA zm5j@MlgMAg_?Z?zeqTg5-@m8_`5bg%Q|LH7ezlEvTPoX4ZF7EXJks&FRbqL0ioF0^oY#(jl_&*O5<=PmH7 zI>v9c_!}Aj4+~$$_#+lB^Wa}w_y*>ey~aiV7Z`uf;@{19#CSdfJwIc-pM}djZ-|A< z?McoDbbObf^JNQ8O|m-*JkjLSIiDfiR07M{ia@nZ|8;Vm4#ysR)jxW_zcEB zvG6*^d$OO3KFb&%XyMl~KEuLqXS~_M?_+$qg>Ps48phF%a<2#dzishXaeRY;!_U9X z{(QHAqd)H9_&h<;9Q-ma{o266-^u*HHE{6%g`dam zGH~$!k@13y1`ht~nE!JF2fvJ0nVb*p4t}iuhtS2q z!7taHd;P zf%Bs#m9mX-vBOpDpHEu&Cyc*f;ivJq^Lq8Ed4_$e&^LkpLFddR|M{vYS((o)|UET^Z1&tbgS!pj*S&N%!zk8O$5X%_zl z+z%%kIQr4;+`iKd9Q{bfF)V6~ApY<=^Iu@#;Focx!N4KEgv-6qz`-x$%u)jf|0T@7 z+`z#v_FrS*;FtN;S_22aw98Ef4*uTk_qP~0_@%vmVBp|yVg4T)IQYd+eq!L@{}uB; zXyD+Nap@_>rM+aFdCTC3oN?ke{D4yI-@$mcg+I!8U&clL1d@ets)f&2D18uU;VT$# zvG5leUv1$zJl|N)xcKv2_RkF#zJ&36ExeQQhb;US#-Fh84UGTV!tZAMO~zpdew40i z@QKBLIs2Q(zrTo`U2cyI14lbbzvyY;Xs`2`zmI`~U;4!W0|);D%s<$`!7u${gn@%U zhxHz9;NX|>`YRSL{yEFQA?J52=UfAa92sX87&!QAINo63;1_>xvv6szRg8=M$50-G zn+$%)FX8wm3tz^1K4!^Tqoh#3xA2XOzh&X~GyaK%i$5P{{9Xn>k?WEC?k4{HL-wnQ z%rE%Q7{AKGpJ)7A7XBLJcUbs87~gE+A2P1jK@Ok09%THN7QftYyk_CY@VNbE8vFwb zm*)wGEL^UeYUc#9m)IeT<@e&>69t!f#R+MCXDqe&zr+1;jDf>X^pflJ4vc}r52Zg& zH*oO(h1+|EfrDTA<2(Zg{~)gCd;4IJ`iKKGb`L;e%|@MgP#gTI*N zzhL0tpOs4o3NIQs_+?z$W#HiN#`1R?IQV6pdB?!P|1tBwZ{XmUaqKe#2Y;tbx>+x= zkMyq`3zz$ao{VE0Q$MlteO#fzkLM)w=^tT;fur1W_~x?Q!hg(om4#=po>MIR6voeE zT=bctN_Cv&7XB3DS6lcCjNfG8pD})qh0F5?y&ik`yT82e_#2CV9nS~kVV~%^h4BJz zH^JpSu&EaQKJ$Ow!arlY&BEn9u+@x9`wruA=?)8@$oTyh{#C}s-$l-1#{X#XU&VM= zZcpKtdG#3<{xI{;uy7eS=2^J(mqrVhaiGJ(f5-AWE&LCRUvJ^N7{85iw2S$>|2-D} zRvw=pFmU+!Gwh!~GjQ}r8K0jtaPW8Io0Vq`9Q-mqzhvOxpUeDzFmUk8`22SR2mkk( z{|y5Nzu0-7frGybPZB>daPZ6c>~a0jzTltD{L){g-KAZ6TKrp>zmI`Kem5RJ2N*cy z(+)-|3^s7^%XmA&z`=hJ^N%)g@QeSPVc_6Dh8ua3frDSh+t~&V{=YH*c?J%C8Ed>iAU&)q!!JZte^$q&n)H*nNfo`d{3jhuH3eyF&Y%l*j0k7fCvTliUwcVT}Q zJ!ilO6oy;4To=YzxLg;eSh!plzGmTaUAV}?TiHHWS@;IVe`4WsU3l8U<-OrO7B26F z=W>6N`WEwb`8W%&WW0oN>8G#qxL0f8pECZSh40||`o}H&0mh%PaCuJpl7-9t?`{j1 z``-^O{5F<<*urHVp2PiK>Lt%t`&#&Z9=8WscrMEyVc{bgud?vvjL)+0LoEMm7GB8w zO%~ph@ue2t$oSvf_+ecpk@Pd<8$dq~gyv_<_%r z`w;^-=WoRpzJmGtv7WSyuT0eyQf1(#-NaA8Z`w!N9k^+ShYdMqeRmtUSuc5x2sx(y zBUxYR7o6RZ_q?PX1()}jfSY=jMKuR-Q_o!nZt7XhzbAm-)U%eKy8t)!bQaeyu5Aq$ zpj7Mqsigs}<@f1d`p`){a*B3dE*cBs6hNPHi7v`gBP{OOPEJt5qt$ zz=B`2Jfme3tmc;>JH@J#sJON2D5Tg6nAUc*RoAsGSSYI~S69>esw0BEfM(`E~o*0j|nI2A2Pny~7e zS`V&-oU5Z|fm71Hd@;^as9OH5p@rn~+N4EwB_}&{sKjA3?MhZM3Wt%1(q^PY(t*ek zAn8D4IY>GXN$cn@E1?6Cr65aXT>N*>c>j)H8AuS-c&m=y#^b0Y((srNP9gvp51&C= zRX`;YmN@4)x(<9%e!1?86gz)D<+m~Lu03Dp*v$&#+dtGZuHj&Xo;r%BDt`y(lX(PZ zODe0H5>l1l$P*=*PoR8UdhGJ?jcuy(H}LhbiuE8i73{K3Ce+5jIQMIc-D%|fC?B^# zcKLrMELHit*(ri~juw|x)+>akDu4Ueb%tAw@-gMM%fExLROJuj>$J?9w6x^1Zli=$ z<-TdTDcuzfBbY|m;bjk{(mbo z%DgUJ`F~2||M_*v<>S%0T|VAlWfMse>YT^FV{YZ=5Rz!~9!^vLwGBE)C*OCY{+Qp} zFbN4#j?`W68Y#N|XOr#X83`<|L0GyDYq4pQ`=hOLYFKLHZ2+F~79+ zzb{Ss>&9|^t3WI2Y)(`DNvlROFqGW!u^k{DX`PX`Ae+~Qh#CGlE(k?Z_ykZnGx-W z=XR1mpYaV`K1YMot+DCr}rVV7`JaR^DFowJ*B zPqd^M=2j_)}2nXn4OUzT)`VZ)V(i3|+%6+KV$VH#6(apWS&(p&QQvAJt`D zrdxILZm(eI5Z5Wsbe)rdAG+-EO&?`D2lt;H*>uQrZlr6=x_w^3=JgTh#*tJ;XQbzK zy>gv{q{{mC*PI(yM*4kFbNKKak+=Ws@sz*n;E=urJs|VYWlwGtxgVeBZW6iRk5l>k zJa_Yc&)M9F^T*Csr--VKQp6q)>~fh%`^qb%l>NS zcNcZ9I=IqxJ~+p{^E+|hxv}6%=Y!p@GbfAErnyzir$wBKa}FPVka~F-Jnc3ur zd&#%PlE1<4s@?2GcacxR=SbI)yK_5x(6m1fWuYxm)=;P zm*T`j{<*w~+W$?;^D+HH&yT#gYX1}aX9ey5P~^_<3?Ug~sr?Hh&YY2yb}#wPb=3an zQu{NnYJcI|9dqVDCfXluG?Mg#Z1_R%nD{~O%{$l+J|Z94*hBlle6lZe9zwqI>KV?B zuMKc+6rWj2_Sy71XUO5h&L;E`^6jA;$Of-nQ?&^^g1x%BN~JeOst#7TPQ`928)MkpGR}M80<;`X^-UCtE;=-Hx+0Gq>vC zUh0>mUB;d>Z~r->%&V`yjqIL-#l8zZC_Ak+MeJUmkJX&SOxIy&1X=Qjc+D2lS&umyO#* zWvDuIP~Y0?ku2y>efCXD_xGrNsLMOt=5KL*sXZ&CAEEzbQv2?Xp#L~u(0`moHDAzw zwv&uz@)5dEJxJeXDjTBzXuCNVWzra(MPqoXzEdlGhiswhp3rBUMe|ei8T2u;ZO~U7 z>d(}k!5D$MZ6duo)!6XGbsOiW9~(AMy-~L=R0ir-Q0V;Z!dW61hyfG^dyz8Pjsm||t-G_D`<2>xW6wiL|a5DL{1^Rd!9nG8;L z9!V%E|F@-{K3gK$S_V3Mi^1(`JCoD^>s|H4WZkayqnL+DfD9@8&kpQ%P4St zAZG3tm9`~h3yNXFF0F#`F+rAwqs<~#ah)S(5o;}D*)WaNMJi&NYooy@v}r73^H6PRJPvj1rSakHol!8Lm%Y z6t(4Sx1ZpX18rvt8OpA;WxEbt7ZZamxQLUb(<#P zHDMKpBfl2!+7tBEBf7dRCDEcH@P(AloWgUCR%yCbQ2}lu^n^g`hRIAehmfeU&d4eB z#*ppbQJ^&t^VKgZ?e386NTtbJFNHytBQ~pK5vv@9Cy2G?aVapW)J41ln3!w5!6)>W zFyYIbeWxKt=)D1UL$1*8Ge#4m15C<5cNB9HDQ$Nkx%5trbC@7A2-z=y<`yzp970S5CwqjG1d(P4&gHZ(Hz}7~BuL1-|B|3# zoQnhrIX{5vnwh*igqR9W>8ctUESPrB52Vy43qInADC)@-E#lnZh#0vl0TX&dP}&ju zb}6%pXflRKUK2=}v5v|0A#^K~w}%i@!6}`6Dsa@8V6Az$Dm%_y-K z86`#`Uru0@*shRK$lVEy90^W#9dbCOn9pipV|t^3F&UiF$*E%w(p+l&R0yR|JCMjk zI>8m3o_O`N%ScQ;TG{{YO3&w##SLIpsrznD1IA=mIRhis~!E+6dXnknRQ&yFX+Ua%%#k#CC^_Lheaml-S;oQOI`^7$x?8$SCB2 z1V)YoC%YZuoKnPRGOLxX4aE!{*YU(t1bJ?WDWi&2o;yns%0>>UMUfqbO%Pt0a~` zin(hAXQ|}#(O6&w^NNNvv1BAT*{%98r@YK(*Qp731?uh&?Ap`!y5{ydwrh9y9Qp|( zQsH=Ar}R7}`_$}6KK*vv+nLhS>xwA-P~X$d_BH8u3D_zrB^E}rv%6&HWLMHd+6>p7 zLhp6Q`;&;##FRDk#tcJ1kUT~&5s>lQ>PCAS;N zr#F$no1J|+AwBR`RL>H(yW1mHm4D0lzGal2=R1);AbJsz52AMkBYjHf7MEFdT?hA_ z(sOKI`h3t3A}PT8BC7^a_A%M2EP5RU)y-8EPP6#qN=SR)5Im+YL>%uc zwF}IYLQ=laH$?Owq?k^~VmSk{RU;K0=a%(6r_bE%uV!P>mw||)1_BK7iQjPslL9J* z-uL(h=@QAmaXhu@5VOd!eNpJpEH2b>PRu5KhjE;2eG+r~gB529tLLMJ!)@~rlQvu_ ztgWi780l?TGg{7OQfVWC%J`^E#c`y2Shta(vf6H=(0rlf(V==M8I`Ft%%Mb{tQ+Fn zq8IPE#|0#Kaz$t!V48Pv_#SW5CM=$9`J-c%<1@@PE6CyP;N zrhmUwzwbdmvN(QO)GeUbH#3$|LOhQI6*}H(a8iiQ%dCu|3pvgfL{CxgnL59se9_tD zAQX0izM$C2l5Xyu?q>J%M!8Da97^>nU9CC&X6$$;yAhQ#5|LBfsEW)&Pvb^&tu&GSfSON%v~CVnaqGOA@_2*Q*l7Z5}F!;9jR0qgh{<#KCS> zz}VZ(k~M+7OjoVCkmGr}2KP_~kG?Qbsy%>6jFncA3^(qCf+iWIUmGel$n}0Nnw+9F ziL12+a--)dBOapE=vNKno*#E|u?(-*MQ*dNRQcj=cho1I;RTE9p6-_Vg~Mi`&g2TxC(RW z=q?87-vM`3!QTMy2;S_3+3;?h3)(n{5T_^e+DscRVNXUif6(A|v4AdzBc9Lo)k<%&b$vFo9wTS$CP?0QvdE;0qR??(!{i+?D!|EUmIH&@kv zhY&9b@mC?R7V8Q7=^$YM2$kzILW@2@EhzYp>95s2C_b<+jvO$(@}KJ7%RPUfLW^YC zX#bDh2dSk|2b(r3c4tJcqAaRvetlRqzX83b5K{ey3#e>u=0&KmCL6)5$qUganru>C zAQx=fT%$rW#zv{cAxfx$`=i3L6s$#68r=69n%$d8Uad9T5^DD2P@VfjCGQJ0Q|M4t z_Uk9=5*}5}=j5UwZGm@~9)!-RdTCGn`nI)(scj)6kZ^;#oX9Q1^*&>;vT&gPhZy_?y~Tb6U@TmVVEwzm;?la5-}=x0~HmorG2mks@AsJ5^GypeJs6MTdk#DT2!i7yda=}ihTby zv)0~oCg&*qo<86EzTf-IFF7;wpEYaNtXVUA_CEWpS)J$f|1rI{$bn~AFL7%@aE4{7 z-A!tl`VZ7Rb|ZcKfOzC>p^rzA%%i0`kJfp5m)6PoK#|j`b}TvAI96Q&^2nz~Z=%G@ zO4yk`d@NPfW&Zk9j1sr54hw}+(lS~xd;`r>h4^s7k6H%$s7n{s5w6;ihaYo)g*`}6 zk$CYk{(Gz9?^Q*8mRfkND%5iX88rd@);ACnJw4vEn7nCCk2l>n(0(vI-chWA{M)Mj zFzP0S@W*b4uI_Zz+5VRqpc41z3rmzQ+_%xRo{4UVdJr`0glJX= zGcywEsI**&xzmq4aHr4H^9A`YPuLS=ou}UR#edkJxFbagRD=edaOY6xeo7T(=CvRg z%!44}&gZKR1567gae(ioh1PLM{@8xK!&m7~Micx$ z;eRynKN|QS4gBA!f&Z4D9*rF}=*qhK%Li3g)X%S5u(YnByt1OPV$eH}JhF4ks<-cM z{l`;x{^O^2y#3Ap7&LV7Q2Y%UJcxhqJ*c*3c6~+t(wXLOifZc`%jZ`tsF+tpo(=E= zqp_oA691X${Aaf1KU4V6oV}=~wz6D)RSvmE3_oe{$O>m(ZQbmOS|y(YM-t@?Xsp4h zXoRZ+_2c+O3+UJRRh2~z)phla&Z3$HjYCG1H>w}76Fm_j3&#QtK1LZ}wKa3A8f)+a zdY=a>D-Oek8XSZSP)()Jqoxvh5w~ISoN{VRfeY(uYvwF<7BxU0KDo-FMn&yBg(0r1 zuW78Fud$&%p{`vX2+KgDGq<*4UI3E@YGyBLtZFEy0HLmW&2U%gfK0GUbem%cqW? zF}8f##goRCmj{ET+*{OC)S?}&K4VBxmvoMQU*+T*VG#|Fw6UHN-RMyp(*IlmUqh_n- zFKk@ucfyg{Qen{oEqJ-FpvHi>p{llOPGeQ2maeM4zOG*JRX#hc3ebL?rlX$I_?FjJ zEtuC>?Nlv+V-nIhyt_a=#a>&oHbyf|WEr@t>T~KA>W<8Z--~+K0u(51Qay4?VRyr~ zGu_XiYgB>!p=guxaXmGZ9aPlTT5!fuRHCUdfK;ji6snA>ZHce4IePT!7FI2wD!O~M zbq$Jv$}L<}KTqdmc_4{N0x}Ya3HK$76(uSmSq^s^wN>R1hV>kzWApK$-$!g(NS+K^>{5I|CTo&KN~~z$C}{BT8J?{j6gLiinJWEZc~>YHTPP zDlZ?j0F!BP)u3SmhYmb>;D|vDOB?Fz>KX?vYN#JnvtUl`qROg46&3Y!s&T1@Uz$W?HwmTGNO*<59MEan|M%a*Ng29=XzJI2qz-Z#!w!{JDu(>*A4fN6@2k&|3sfhQiLK6}1GbcJ)!M}1=gwOG=T%nrj9ciIT-Vc|jxK1iOVp6#C zgz!0$RK#1XsJvfYvm$(a#QTH0H{yN&np8M9;=Sai!pDyf=T3-tkD!T2xKqTt4OlK@ z?;5!t%ue!t?@&QkFyAZr@bK|rC*u7FnDp>o2Yu(r#EADz@b3`u-gch~7fcAd=Vnml z>mfJXAr|V}HQa3i8d>2zbT#CA--$Mc2R$7g?Zr~zK_o7vBHoS5pAwN)fI2$b+lwZ; zM!efy>L(=lPzl`?0F)IO2kK$orsbr#6DLw;i%Nw%de1s5BHoJSE4(k96yj9))QH#O zMn^;PRCq#Ux$5x==s0VCz9{nFuKZ}@zo7k&-kUH3(*8rxML66U=8(cb-vga@^gg{N zb#6GfC4911h%7pCeB`If9vpAa)oOfOywt>ShwCEVp=En>Jap2##aj_}&kyHb{Zp;M zkCvsVz+3I5!Y+;Chs%`R(KuoV?!yqf5$_HUBLsbauq-+nUm)8vWUc3hb7P5cCx{bS zfmZ|GS(XZSk9hYJQ!fvy|MRkx_gycQVd^}Fx-rysy`E2HDE_@FhBcMKLJ7)j2CN=y7ch4UxBf*}v3>4zQP}!e?QkzSTrxc;Cn&a~$T~dsO0M2);!U z{tc3;3HK#k5kjhg;h`$N1>NXovYZX*QkWK#h_}6IFD*SkMAhEBC}Kgxdih6f&E5~Z z6%*AG`Ev%I@lxkUo(dlqIS&RC?u;q&Y}1PHkcjtF@aQnnTk_OR;p48y+)-su>$3ku znR~s`u3Sah#x=OYWb$Rw8CN{xdwstm`KbzaU_R`8rmj@}(`~kGQDct|M%`fkz zaMPowF6yRm{HoXr?G;WtzVtwTyYN^&9YpRE)i3oTNm|)%g?C89D6>Q1dkK8cp3CS6ke8> znLOpmES-m@Z>tB5x7CBj+v-8%ZO2{XZO2{XE{57vR{+%D-=>N1oTB~VX|CeJ(3K!Jq|k8HTl zhq;UXx(Xl0rGGtvtFIXuAIY)LhvgxApkTK2^V{Yxzh1V-Wfs%h<08K_ zCqC+RFK$EZ%H|{EZu60GBtBwG#A*!lv-yZU+kDnDy)92K#%=udQ$=8;V=^4Rnb zSo~$&H(2}ye~s}T=&w1i#s2MfMSi>8HtPWMO+00yIq;5(yqw)w8cko;V1Nx zFSh6fmwNQ@OZrGUN*IZxQecVwZLb9!z1`TSB4;pW}b za|V8_?uz>C)Lv(ZUcD5{Wz!A3h%t)3p9PQcEeG*2>8rBfe>Cvk2LHQwt3-TE{PisO z2;REc^mk;zcW1$e@dd-?GdBxkxa^SWe4%~@A2vgE{-><@RLtt} zaoWdIP;X))CO+zwbcF^#E+CxvJjuAUMR^LIsZ@dV(3jH`jp4M= z>*o~sn#aQF$1N0Q>d2SBmDl~NEu8M7D6G_xPfz<$3Tt)b<71e9y@kVnqYB@*@KVO< zzKnv%Px~4QztxeCpTqce3%`W%e^~gfjPJGZA25Ez!ecBC{n&|u$V2-t3UXg4_#noQ zx9E#FKhVM_a$c_E!sjZ+$6EAPa9-*OJ>4f$xX7Y^kn?jaTzq-dS@BEf)SF=by1~y1%6$?MS;7jK6HrpU?Q~7Je(^|FG~{ z#y_&~8yRoMv9t@Hsw#A}@GCgq)xsa1`$GBfVvG^A;{WgpKJf`1n(GOtyH!b?(nf{=KpUij;$0EP*?_uFnIp5F1 zg?^}oU&i^+;`iT;S8!TMxV6}x$ z;rs&}i=6Uq!NUf!zvOn<+H3;*v}_&%opp@qjd|1%30z5Uw4ML#cDcn{A1-NHq0 z|FrN^IRCMQi{1}gxQtgPUY|tI6PT{2g$q4?MV>Y;a@`qX;nJ_s7B1s=j)h;%?M|}r z6^vhO;SVwnpRX#=yfE*hms<2^a{hV)KLItxPF5K>t;1p`cNsX*Kf>+aYv4pL>RT2J&e1|kL=_GU}Kn1%)&b{p0M!OIN#gAsa@Gm4!7`0ygr|4;M6WT6sIu3!uK#P z=NXHfNe#J@MJY_)8Wp`>@vyocM3&=OA*vwdm(~#y_;^Z)g0Vg_GM23Sri_ z$hn{8Nia_QNzO@p{VKKSH!%Ha7XBLJU$=1SZ@qMZcKoWqyeK?fAjK9E)DsU1;H7uzs$#aJgRG#5l=Qq`Rs< z<=iXL|D7z)27?djK^y{ZH1J~JvOdds_9Fi#mVb*yFYDB^22T7#{2XnYffIj`|0M$_ z`b(L9yMYtEtmpFlljP|SyqWD#&Q}&a3`QA+t~~Dv@2w&Ac|7BypY^PtK?Y9p{F>z% zX5b``^!IcNmwrt!aN_e8Ki50oz|DS@8#wh#?px%%XVL#n%xAGdPyBD?=Z|t8v(W#U z@s$?+K<0D1g+G@EW(W@%ILWhz^}N}_i+G>*0|O^{?qohcvGA`m{;Y+c$oQWam+=}+ z!XUhF;nf;;qQ>)Q8s8m^cQNojj8Rm?xQzQ_VOS&%jB}81va;;eTd5{KCS&#rPi>r*Wt88i{`j|FrNu8g|0GehYmw zeoW<7x~npAbcKUJ)C9Wq&In`Xq<@d67!h4DTXK92E$7Jd=qqb$6J z@v|*_5#v)VT=uD7w{Y2~US{FnVLm(z{`a#37>IIAc0$i>WM1&{ z(85KZ4)4FDU6CVd;lJbha-S;n!l&4x7e0e6{3Yfy(!xJyT<$xCe_y7P@ew@9_$-T$ zeBUSgDWMm>%?5oDY*5y*l@{L2_PNHwTNqzw;j)fAZs5H^+n(vSSokc)w_5l@#~)!e_gM3!fbpE_`-b_yf#e_M4>t658Xp4n!;Igd--rJzxX5l-y>;(g-c`9MMg&*XC9R^PJCSjL_Z|4HhIlPOe z+0S4uC)~7?F$QkhL#2V61WntHB&>$A`-o`kT;$6f zS_H>%r^}YXHH9TXMz0nIjp;Wb@F$@Ov~KDv7R-a67Se|q%~JJ=gWUaZ=Y;V7MInz$iUeR4Fe5lG!D)|A5!M@T`~|KNRFf=K9D?xlK4P! z1SRo-}ni4P=)Q4$|W4yB~}7&3&C_^2E>bg)XQPgz}!iT5ui>3wf6L!IU& z8XRdAVw$IgE0811dd%S@)2MbZoc33|OZA?*UFh zu2VYKwyi5skg5HH+&-Iu>OZw@x4#8gruOCgL)mX-YyXE?+Fv+c*VsYK5vc$4sMv1* zUSOHpe}FqxjB+#Becgo0nd(2wgn4FVr0x3jUTCKJ@;-{}?}UwApRT=`>dQWBgH+_$ zu1|Xg8za(56LbaBe&{P9TYn>fWojSi1*@<_NB*bX))17~7!mK__BV1(8bA6f!*2h4 zV42#lC1Xc8s3ZT=ZYzZn8zbVCe8Xe5PhUmY?USR>Ozl_lK4m*GGlJdL#i(p!L_YXj zU1>1arT){eSMBzH2>T(-T4tRj6PmwoCRS3P(iFbV_NQ~fr__&8qeh^O>sUT*+I0Xj$zM2C z*BHlwlKiw^w&h=*rTy&#xJB+i=i10h?`LOff7a!?hWvhp+9#FR?bG)*_)GiEAJyDW z6ANKiM91<;v=k(cWvRb)q^7%2NB*bOllT>`?-OvMpv*>eUh4U!Y=4N-LLt{rS{0=K zLi`!ZGwCn6SW^^nebQea{7ZeYzYkGvHK8g_AEoQddm%d4miC`n+Mh)iMg+6{zR26{ z--eFceW!ZOXVNFWUzPhNq)YK{*B>-&$j~Aq3~rOw$cW*?Rmsqyr<^iErDnyJkDYjS z$PIe$IzP^+i!GB#5*?B%N;byV2d(;w<^YO=oNZuiN=7__ar#(R}xxA4=oB zpLy@_@;96OiDw1)?DLMpnK@2Al~cQkM01y|@GejC2u8H~ygPfCGKnm|0FNDBqICcH zXKqq5Jrl^3d)ZBYDv7S&TeE4~-jeu^z00FcYYoo2AD@$K-Q~HP(Z=RkYn>y4mnzEWPh@;4lL);$mL>0HzOwzI9F%9Wn;4vNX zXwb|=oR@5^nWbYzQ;Bq6&{QLy2%1{N`Jh>-V@1=5^Z?K-amrFNlV!Pw$Guq7;vk;% zV$Dj5r@#277u|f>GN-J%*(s~J#i1FPf4J$Vn?AY7-K53>dMsY!e1zYCOv`nWhhor4 zDRgofbW#ePV0<>8?#6c0SgeXATYrty92|@R>GP9|&VWvz*+^r2cb{Y{;eQWBcVn6! ziXJ&KZQB>;zPRm+BTw%0ayEbLg*IR4I!_ci%~Rg+3e;Gx4>^aLL(UV|-r?N-CS#a4 z`9BA~vSYG!2gbfS;plU$1L43@6!hd6?`AlX{o5qJ;8T@W9OxWH+B^~jNK&7GUO z{1x$$vs`7z2g^f{(?ef#((LZfdCgtK-g?KJCk{ZqH*=jQc0uN9{Pgrm@WFN^e;;H! z2wV6BdeE{bl6SMMb1)`FOBwfmi`9)+twx78e1PK*@ph)V%*;SV$zGb7`J!7nEqle#wr)~7R7ky zVw`iY&YK#&x^QYYjAJgwJBl&I3#_-(oOl`IqUVFwE6s;rgvjm-AVZ?`P0XFQpi83d ziZR0C#Pdhf@A8tZ%Q0@dyt{hf`OXzx-R2%2W1Oiz)xlbve;4$D?N9y%h-uz|uPT!{ zm}{&DGWW0yL58lFdt)#LXKgxI&U5fA*IyS7H~nnWzPNMfFzgWTe{Y@z-DAEo@5JVP z@#LYyO~2d-Ir5J@Lt`4+bf~9u=wNvcc!n{qkxhrM3)ZRw;PDB~-Lv$1MRvFGy5kOZ zkCHugSA5aN@Pk-)2GaN@lC9>r7UeiksIfzRqCdjx9nr7%oRfDRukkma&o`mlw|HHm zweUDMvAY6#C)y-*EP5i_e#`5+c_(au^r^~S=VaK$p=!^0Vk6>W#0SBXbiIysU5K#~ z9#qfN^~USU50aim*A+_Fh0yic(92lpdJObLx;t|d^rrMZvP*N9_b@kz*QBXuI1|QR z?AV9dp-ct2mf~bSNz$c`fW|NrDKvLr!%ApIparmi^5)NAH`XKNoFPu9Yqys zUY>)ZiX>%Mhm)QqDLZsfNpdZ7IJ!;=?-s5F-fK81jE>@9X=!_m&t=j~PF4mGr~JrP zuoUD4RU|2ch*J*tbLl~!YO++6_^TOD7RE(B7a1dAlGWmN`BkP!Qe+{WPx*$=ffL!p z5v>`6m-Km8PUGax0OFJ%Wn&x+!(`#o;&YiS$@L78(38I*xeWo~Yn>^WQ*6>rmg>uDupa|u`m9l0h~+*kR+vN zM=||pa_ykUN4;X?1=^KlUmyC)F%pIL@~a&61xMx{227HJeI?8jB}@z;X-i^z38?)RZdl9aF6!Cw?4Z{7itoW%XX z7u;p{E3Y@>xVeczv(kr|0mLakvNb9by*8*K$z48FDM{%n6d}o=iCaJY52dXZ zZi}=o>GeLgIx6Xnj2*?%+09J4!LL#+$$*O(0@L6@T83k;{R61uc%U5|Go7OklMV+* zRU1cJ(~;C|4z&)BosQ8#*Er5vpV{1=zQX7boL)RWL1z|}LbbwbXo&Zi@i&GVkS1_wPC7zaIfGh5fEC*z1RlCisafOZd~<=~WR zIuaSb3^tFs?nROW;veH5>a32t#(~yaPC3$A9R_V4X|0ZX?rpc`pBdf9Z%q*%@3U9g zzUG?r)yNT^yV+UXp&oc&V=l48e&36FEy-4#LLJon#*?Jy4&r zJxC7c9&8Y(bGe7mli;BNQ#}O3GAMwQJzUP*?u@15!NyA_`r^u=h#0ulK%seE&2cxS&_*Hz@sKG)V7huhQ=m z{!w0#-rGf`=?Sd2FF&B)U!>CX;*s}pU#HzR5JX?04=3~@A`0%cN~EZZM>QyD7ZBwb z6+%Y3y-vr75ssDQh1S*X9omI*`U8op{*fm_3hvFSjdnThLn(%G25KnUfe5^jHNf=| z)ZR$?qQwa{GG(~fujH=jbTgx&{%$9^RE7%NJmNxuE;a6ac*)m}UN1nROK7z-3o#9! zLqB3y3HnuL{$%DxB{}%_>Pxzcy9&Yz=-gC%@*$k`h{OpuC-GTG9VtxE^ZcAbe8PaB zz3^bAa1ty$R1abq3d6&4oRCNx?%RWCDXhi6K33HGQ7O{?TUy?a;K1DJg|;bpPf-j0 zD_LGEDJ#fsp{i}W(rR~QQmBPHXR8al)UtLt+xw>@; z=&mzy>nVwTk{E)-vF_B-h`P8_&q1W$74zD=B(__G4+oh`$sBUX1xcK&v^T*NcH*B^ zl&@;^Q7}Gm<~dag@?G82p_d?E;I6@B4f5UG3!-Me(7g-g$NT(xx_wZ;FXg=+s;!{x z7?+0cgtO3~ghHb01Dowfh32)BeXzXTW=>1u~yzo!gNlvgExr3_A#R~ec*5u7NmGCQdR zC(5e~9d;R^6XipBprH_&+)0v=eAlhx7ji|*|H`cPcu`Uf|U{z;ZR(Os} zqaIk!cx9DAKIPK*2l)w#|4B53BrG9mE_TDmy45tHj&Gn!6n6;l)H zq#MCe!Ym}bOWckF>1W=@x|I*9Xbw5WpoQ=Wiru+CN2D1128ls`#)pK#w026MtDARM z?m%-HMQ!Z~q|JhHgTK7o)=oIk8ajm+p6h5O4c(AosR?S@3lmX4k;ZLuNb_ky6M8|O znnY4B$aKXid<^u3>e`d@LnQHT974NK3Qwa#bpaYi2n8B>9_UIp7}QENNM@ew$P#1{ z1QAPo*|5aF1eUm+R-FFSkoQ_(ey;}R_lh#<9OAA`dZxkX(ty#WWHj2kFAYq(BH%eI z;5j=WC|B%zlK>PZq8aY(e9NrotHm(r@d9h{tW%3;V73jGSzn>}^`%z4Mt38K z!ug|o8rHw{+)*5Gm-$%A`4#hO=43e~Gt)Vki|P2vx&^^$qw3gFeIBVkDO65eOg~=J ze_xtUb<~|KpIcXtLllGdtz%Eqj`pO(P}RAbSx^0>_oL}B)S5~hKUg!jrV0m8&edl@ zQsoiD`FPC+ZhetD;Z)8&)JOb*L|#l!KL?e0)0^t*&2u_w)Huadc+RP>qVpHkiIP@x zRE;5$vK~inF0OKLP9fe;SL0A#T~$$8Rj*GjRWExh^{B%fm0F=LylbvbOH)L0vZXpe zmMTym_>5S|^6{{eO+Wwj-+rvCG-I6D`jrQ|it5xEnUZ14Abx!I>B9P|28=76R+^>* zW3<)4C`|>RQ(vV|{q#?^Q~Faps^p|o|7cJemaB3oGjNX`H%=x%GAP{q7T+hKj}Z zVWX;E*53(GrA)tU5yhK5A#*bGR1ZgN67=78#HD}ZXP$9MH$wDJVLE+GY=2DNLm}lh zt{1ZE!jG8lb~BwBIgN0HgF14G5La`0C&m6*n87)gw9&YQX=t~ zr~f<8rp$cK_J8HnOF2A~XY*H|e%W^F;{0!Hx8xAenfegWnS2Q7%-Y(;^Jn4^@tJdK z@mr;tLxv65AN1{k>d>xgmIrmQ!MaI`Y0=tc=nTytR+ zI(Q#CZa5zEF2ae419AM?&CAv4Xb0#d$yLjrqLcAHrSlMPSk6c4rB(hB4y8opHOr%o z-p4p?kWSXaDR$4`=tZ0#xYb3)t=FtTA{CBDaNyrhBHq&|1Ji9T9d5Yg8k`ZRj>t@7 z`x)4VV+Y3Lh`}$eUJ*V9qJ&c6u(vc7{l~t2p}q?i#;T*s}UyXA$Bi{FL5MS3x zI1lbAoDw%7JOGCQMpE83h=C*GzK?1Jbn+xR`JdpF@BIWw7trP5NJWWzAYX{XG$(`$ zfObdR4J@`^y+R-BnI`P7AZ$S_Gytb~{@`jH=?QkZk#ivi8tfnOUJRiVk5Wqz5R#Dw zHzOO4c+H``6DM8gElEwB_?Q-Tvg5#r_a}@=Tpi4q>lHl} z?s$E~+XaDVT+@jC#OzYW)DD4>YKDY*tX>hh5PA%;h@%E#C9ld|jiK5q$62FPmP&DI0z1}*A zlnd8JIBpYN>=^NOLj3m4;f@%C>%tw+4R?z!ig@?nWJbu}jKc;29T$B(9G?Isr^3Am z$D;r`!BT1H7B4y)UD=0o3?ad49Pk+NK3W#tsZOPo3D71!f^{|1nS2}6oUwjzfZF#e zT;0~E@uGL9(|`4k2DRhQ3ExO%pdR)Kyqfjh}Gj4~4y zuCEPd;bw&!_kdjZ4TaN!ksj76+<3mh#j6yan@)_J_L+=tL#)uC=+z^Hv=Y1@i$Gt6 zwGG+Nz-ucf)%KjWa%#M-oEmQ{r^egLsqt)bw$;C;Z>xWex3wRQtB3TIObcGxuk>}% zyNLYn6bx$e5uXX)l?DG}7Ce>(2b_^VJ-g_lE;w44wJg)6sL;h27uiD%!nm7fys5np z>a0}sfqkm|8t@14pQ&HJ%7P!CMgH5f(9Z;Jo?WN*Tfn}rEv`?f!-%^$6r23@29|fDwU=2GqpJ|K}A9MAPc5OalnKmC8 z2V0&o27mR;j`K1;Hhm?R+wImeZnwL};BU&mpYa~(*YTXDsD;ziZV{&`TE}U^P5MH{ zZFyt`w&fvvpkVXgrD27e{0|zqIga^|g97nU-zey;Q*7WS{Wt?R^;~J-eV7MDwFchX zz~!|lyT41A-tO-PgO90y(HqHcwk!5Yw`SM+JOTf{VWyQW>4dYHxZw*HqGxJkdx zz(qEKo;C23I8D*#25$B%$Iye>uPEbozvK%lyIdSB3)5I^xg5RG7e?AL7ink_qyYsW)>$Bj8 zvfu;Qu!z68yQt5CKWyMK$4L=iWWg`W)yg9NCjH}C@VBzy-S|rio6mk-MCz@$#H^yJJ@RJzt%CU^gw>dAqBm}>Q@gWxd z)10UEor2JRkMmEIh>cQVW+eu39Yo1g2kO z;q=8Ug>{V6{1Tfd{JRFdc~>I(Ao&TeCt?KYpWqK`*!h#iU#=x@TX-?ke_^ysb~}pY z?9Q?1P0pa|ZQ&C*f0Bhy;{0hAej(?_a!h(KubWdX`aAhLr0=`6J&+!@v;5-IO5~Jr zTxjw617GKw44nAL*>7_8mhjoh^fy`b;wxD{e+cXozXep`L8g~}$(s0m3zz$f-&*)M z?$_TfT-KLQ7#BHPIN#2=j?0)6EA#9q>aU!ICTCF*AHoMPp8?EA@Os9_7&zIdNB71i!J)cczjnFILRYtaNS_w)b3rJzr(hoaq0;`uUTA6TSG@d)dH=UgUn$ z!aFnn4-B06l(0M^uh_{MGS9i5jEmT3KI20FU6!+#h0FN%w{WrJp%yOv{hEc#IF7S$ z>F+!XZ{mJ7TDYw5*IKw-A8)g8xz3trO_82EF#nAfyEj*9$c0B$vj{O+VxA0Mnn`cUq9ts#AYSEW6j&C4T5dIa6 zT{(Z(Tv~XFUD=b{r=UNMwb@)mPm-Tj~h2uBVDy+3|Y4;lzF7~|H!o{ASv~ZDg ztA&f4zqN3gr!QN0A&=kR7^nGY-Uq#B(Lc}h2MwI&JG~J`;d28w*BSk?cyQfp#~X9~ z;&^cV5A!EaCqg(~Y+1{q@1XiT_7@ zKQ__8iNEN1CgY+{*=MgX=!s7i^SRl=hcbSz#b*!dQ23oizmDnuYSGKjbmYt@kw^IC zaXrC5*X$khtR}LDLSDC17X1Lm#n+VZnaKDOi@uui)r`yhJ%;V-NeeGw{8t7a^FH^_ z7X8~yZ=T^qdhW~jw{KYVa-DtOz={4crk8ORIpsQw7m8J&{*pX2_7u7>F7#)zJjYtN ztOF$$F7`a!!ezdnZs9WDQx-0Ec!`Bqu{?5iyT~c>$a4e1Wj>l`J5gV+WkJp_)7&wh1yxh99{j2EbCGy11I`U{Cp%~;KX0_bDV|CIG$+W z#OEY_ZepGtMSMXZ z`JUj17X2eE|I-#OXO;cN;xmqfMA&KJ%QWnKVc`!j-q(5_wT5_`C<#7&iSN)oA>*oC*ni6&`&bx z&HG|0CwjuyGTkhLKA+PRRa^K$&M!1@^S*3}h418ivw@rYla&^}k;i3?ft%Nhbrvq; zvfjW8IZe?<3zzE}%@GRt%}LtxlaU%$cqY9Oy{R9ucfw6Qi2Q_`{oP{lH~aOHft&Il z%lmy9UnX-dF>q7P9~ihP=Nb~wyvfP zO8vsGNv>WrHT^zk^ez3RFOiZI{0gwiIinBibl2PZ)!58$1zWnx{_3nn_+_t|(yOEy zoLtYTsI7$u>onmlkJkRH?6xOstM#letHQx_8Cs~LH%St8L{+#cCe5Ur-G2L2@C9>Nhel|w5(}(C9TXp0V zA*L;k-99~+$<)5w&m83X64`Ch^Bx-`+QOl_hOBKx$kMHa-99~M&(yx0QM6OD@jvah z==%&CBjUl_J`aOa1dO&icKgGCWokdlMk&`(kf~s|H4vzc5#cOuU%odf0!CXmyZsW_ zcc%8`3=z35qpAvaTcjr&Bf@pmF$A;!WNUW&7Xr)F{%g!suJgo;g54H<|7K%Ew~gB` zBIXE1_@}qW?Di*f|7p)<26>Jl^isy`d_MaD2qrWX>)(0fc}aT{ZA(i&XEVvaYq+kr zgzcaRS&~uY5xZ^#mZ|-#xkJB0|IA?1zMiH2c-~yd8K1(#uD=}xndF}}QrB3*augv; zEN%H817`CC0BVI$gvUynd*Odg04aKZ3d|)@uw)1v`II%pP38NHZ8s9LYOto&N!}rFsQ0h(tm-^ zLgh^Q+cHs8Y-GYB#I)Cz`eJ{laQjT=N6G#=d0ZC#3E|Kz?aw+_Q<&}3dpvggz0h&H z?^JUZFI?5!Inq(4`h$iI8&PD0!EMqS5ueFJMh+XPy(b^N&*Vu-l1PW7ijt58K9kwE z@xBE7n3CU7_M43Fc6^`7M?CE}d6$%2Ps5uId#>N!e)u}YGP4GI80EKlAN-*H1O8BRKA-g>`9Lj)e_H5x z&6$pK`yBi~hyNW7&h5Ru<|!lxbi1ZEW0Y@(AKoJP=Y0!2cEImxZ}{#Fg*5GPN#`Tn zb4(+@r{YJsWYur>*2H$~JG;5xd- z_G9`@)Z2glSojql1OL&1pIF`J5d4~Y@Ndd}zb?@ACtj!&etJvafSghIMSb%u@+V7v zhdt&0^$2{-QlIesLg^0tCV5+^@Wd5p>)m*=74lwQ1HY{=!6)zm_?x{_jg9uznn}ht zJo0Os4_~WeAX&>lo2m5?&#;ah%p^u9WA9->&e6W7v6_k=b z;U9Oi_7AJuJI*QCt#klius{6l$PXKh$>Vx)!o3rWT6P-iK|E*yI)OQ+d zy!Yh$CoaagRAXGocX#o!=+s^3IAz7l@}};ZKyl&JUFX9;H1K_}pSPwuWxFn-eBRU= zl##uNP3?z%$)4a_w~TBmlO6541pbT5)oZ=9<)qgoXzL2w(Y}h;!_V!^6~`5l9#r3pl#|K&8a6oWn3u?CAJyM)7XEZlM|VjXxDRA_xef$XyHnaa18x!;pDRc#3?_rrImtlK@~~1 z$GoKQuNk)3APifQ>lGW?>s5=e!W$45`cXCs`}$m_NK)#;Po*$^$)}p@bL2!e#xh{8 zGgXog_*|-laUgNk(J~H9Ynmk2`HbhZW&D*>D#^9Sa7=Sv(xQuyvpTPq%hz-4I`gEp z$Nj3S^CTT~Z625Uk*%|dTr!Dccx;rU2mq&)hXSXRB1+KlN)crn^GNq%Dd-D93zFQE zv4Ws5FBM2Bl8!Q#-h_{G=~1|y+{H~xRZKQU{K!_76f|=JRV2C5hc1xs#EX1cj+*f@ zpUY%PikRq;B<1B`n#Gg9(YCqCgSlnwKvXyiZE(Z>i^5ntXEK)WbD1MaX_F+Fl0kwg z()R&DT}g^?x~}8`QRhf9$#pg1LeAY1aFpblG(zc##MuV1kqNLyNYd=q)C}F4D%~R0rk4(8eTX8{ISVR%z;)m5Ksq~?&yQ?{ zHgn0-9Mf!-v~&YAMUtXqICU0viok#*DN>@ME!|OggI>#`Y~}ctZ9 z?OY-Y7Nq^0A!AvQZua#}_bV5K_DmWm>np2>kfS*PStL1zA(}~({L9NYpYSWUY;vue z$yK1w_FuW1kyihOcBV7`S-xnKmT+=e0CCEXGWqMJhpV3NFBgxRa{{NmVcVl>ynlCc z;7Yy%(;V2g^Igg+kG0XjZEmjNHa7-XIoQP`?Tno9GthKTxE*|Nt;+8!ocxBmk+;@P zf$!Jx3GMwgPdni4to;mkNx&WOXb74JD9K|kUY`v7>~>|xu<_0?qJlWIL+)0)X*a`# zw$s^k*S@~D+c-Hd?&&KK&pmp%F1Z3ehP)P^g2H11PsYau?vIQ5(Xh~Ki8*R~^fYL% z(wRO&-Ux<6r+H^^(ydpO!#N)A@>Fp33$#&J6|~C%e;pPgVi$2uCnAlW>fkkfAKeeK z%RWL?`pQKGZ#j8`46@fy-RRp~N>MHxpsmKIa;2KlnL$!P*sd<)qQcX0DwWw;|z-G{tNJgf@T z@6mJ4J_99rD+%dLzXwo{yfJcU;(Rw>$0QafpC>|3e#j9n_I^bGg1bg5JKCAv%2(;A z3n_G<6^i?OLwcWYNbmEF-B2g!^UCz>s#35EN^g1;#L$S=!Rk-a#_ZPgF}sDD4TkVG z(vbR^zvOkLN!+c*IJ%*29iq4c?UtC zM_H|;aMV}Q+CWJ^N>|d4(v|e%bggXpL7L85`)I9bJNZSLojj9nCtK5%^2>CUJsapq zej#NT)o(HxmH+m}0Q4`=_TN;0+oL~MwA(sjItbPQustB<#r)E0DLA8DpgCKRz6j(=}| zCLN?r`>5F$G7sY4nJkrFY$Kn_>c@XHpzx`z(lmVJQ`wtA6bNuIP308AeLK_3>^pMt^TsKzbe_GJ(kb#;Xu$w z$*besIkj~Scs*zQ`Q>MipE%Zk*$GnCDp42EDfaMm=(Kg4_$5vesgtUvYI$x$Rn_I1 z0kz4mE!As^HZMvE08faON(5gh@pngRBrkgbrE-P1(D1D2dwW!#6cwd-sQYRci}0pb zRWaXD3TbGpXk65Q_m|F?GUbem%cqW?F}8f##goRCmpklkQTxCYS*Yjih>@H%!r7kU zwZI|IeLw;qgLQMEm&PBlc)XE z(N&7pQVRR&1OD)e$WPrv5%t=2UqI6cM^N`US$yFUpJj?lf1%(^Yk$mOIbpcIrz()Ni1fjvp726cgFgLuioIluBI-#`#KTo|D{trT)ZsT zcAvwwUB_7T%5c0j+;IZjzlA%F$0vNfeW6{QU8kJT9nS28?se1-$Gk<+N8o`CUh#?} z-plYu*2(JtH)-C&RJgO(CHhFXQ)DmPj^U+@ha>y&$jm!6D@UM0g+~9SLg^J-D?!#;L!h@c7EBvH& zJdeDgb%i%Q_&h6(OrqHP$2IU1_kA}-Ugsj-^SXOKMEAmZUL&N0JGyXg>M8H9*Pv<8 zg?oBS$VXo)68#$bMYSIVT8PSjx@LuPkd~9?&8-!(H1pEKvkLcj+J0fH!tpJy6&_P~+(O|U9eBv_A*QY+O!dFc z7hGFClSrPvOKH;wFN2;neOvp{cw76?cw2jT1O;+!CK?Ijptnr;VGv}(znul2k%iAs zv(SH%1y2GueZI-F%@&0RcBS?az}``KU=Qlr4y;7sf&FMZcAO7^XX+O{Zq0~rp+cD8V=P?wOTUC(_)lYc(hoiTksuF$rCrhc zOePRMf>$z5e2Rn#;$}`0-rK;paoX1Z3yjGY2cyAV-!He|LcfIxY&(3( zz>gOuh!1AL&2cg9LB2L3{w6M8k%|1$1dS5~kyGa!XEfu)r&vJ5NyhDQr|Sp>d)(#w zIJ@0OrnlQ&#yGW0Yq*3p25#D6dnT~u$z$A>N9_{lk15jMT}gt2ja6{v!Ziw_MOKb5~$AzXbgqN_V=v)~21Ww+_& zC3hQ_-}u}3WZt6LxcQrFQ=aazpkF3FF$?~17JR#bo4e@Yyp<$*OuQxw{y-L7zNMny zbenf=vR)Bx?$TwB2z~+UUt}O$)*>oW5AP8R{dbtYAIF3f%|g!0x+L^pFn+2*Px8>d zoWhwp^7-%OJpZ)8$Gf8)3bOtP|2X59=whF~H{-JzCp}Bw2@-jQ&*MzrWbl!-nxN$d zPV!G<`kM@#=*M&ZHUlU6PnrH+11I`BIRBu56a85{&t;!LauWUfO!tUIe?HUygmLMw zTt8m7@FeHyzJ>zPo9o-h8us=13zpyESmYVT`5Xf`_0!3~N&cmrr|S&`(ZA^DSOX{e zKXJZ~ffN5*xxa%g{CduxX5p7Hz4)>c`Nb#OxfcE1Oh41WWiF81l?G07p2+m`EnIx? zEirJCe<0^?v+$ESf2V~@f9|(%u|x40Df$#W{K%qj;Jl2d&|k**Hj92b=U=jLk^5D~ z$$rf1j($E9jPHv~x8LAHdiyKu?Vy31_TzE6j8`ANZnZOTqSt33V2&F&@fROx1qM#^ zk8|Gi%}DewF@Nz%Df)Su=?5Epi2fwLUJf^K;xE32&$MuThJoXpYv9D^2IfP*wWJ{J z$~rL9z=>YI&YxxA)UK=pmm4_I%j*nv22S*1=i)P2+WjNbHFGTEyN!4u$ovyr_K}ZS z^h-3k^Ggfg%J|Bm$Q1lP|E0T}xh^Sa!TaiRY^+f#P~Cp`?~3+6EfPI{1e zRBYfxe+$!_J|2l)?B^7Vz9a8fPBn0%7yCKez={7srcW6-(Z9_7pKjqYujg90tZ!Es zIPq`h4e}xbC;nn5%?3{N<9VOdV&FtCcDUNWiGB?4Z|*d3q8Gb*$il_0HZV^1L*rP) z<0U@uXdG$1mHkAk!H3%I%(gH?`UjcM>jqBpzs350-{K?B3H3W) z`npN-7qk3bjr}v>avw|I`%#eoHZwh5z)(T#_FIgfXW^R|uQd3`o{bpjm(zmzvYY9} z_Z9Icy}iKw)vvAv^kV<3t#-xU?lW-WvzGUx4;i>=Cy!ck%C+IA20ihqU_Q@T_yERV zviQtG9SUz)c(sO|0|puQ713ae~%axU3uN4cxqbiM%5JTAsg;8}#OU-(umS2N}<>)!&g! zPq^8y=>~4f-)!Kfoa+tTl;>lX*Vc2k=N?b8Jrcdy?itp4%gs6XowN!>Z?@}vsbeI| z3y-{&lL7u}cS+);XW&Hg^(mV_)cS`!Lqk#+R8mk7LbKV6f z;Z2@7mpcs$7S`h>q`8@z;1`qTURht$h{IX+t5InVifR^AamA|Y^11c&ZWO=9l%dzb z3rwb~r+JGi>MI?%EUKtvR+Uw=7tO<=nsfXYn)n?t+wGBZXM_*&U{pC!c`!QJ0XAf~ z(|5^0d>}cDlK4P!C?)X`_%0GnL(M}5!k-aJ{#~w&96D5+O-W2k#j{S+*$>!`rO?W% zZ&V4B=Pp8*l!O)YWyeRaLF&uu%Q_?#?D|VlU}Hp^JVDoxb%dUgQa_^__I(-A{c@)E zWu1|AjjOe3>qJz})c!7RU-mWBK3#(B_D2EB)cytn5oDdzxwdVcjDk$l zpSIR^`^N*z)V}QJW!+^qZQ7#mU^BI!EY>wv^14Rt(^k}O{|#W7+8@JAH)uBgr`^_T zD6ugj-d3ustYbY=`?Q6!+rJDLkyzUSXBRW&?K3EJV0MyqUIIYaP#@6=`V9evfjaU( zrM|>fT;C_)g!n*th4+0@F7+fo3qYp+i!T$I+|+-1%f#+K@w0gn??ZX?iRW=vp_O&+ z1C5PQy_N{~$%~4CV*7BtNmV<)`m8Y@SqeOd)*+XYuM>TiS^z z$khItQ+16U%$(Y%>$2T`IWQs_jDIua^TX$NEW;96C8oVZruv`JW*6Z?9r>S9PvU1# zB59upiOI6@F~JP9Jy4nITVguXx&9WbzVu&U`W`Nm{uX{sQ!HUZ(jTcr>htj6rv;hi z&!Y+m{Ve7rs~PA%)*?~GyE3#-Dz)3c5%ul96N8bx6&okY%&A=x$*x~tv#@G@<&Y7B z2hJH-H>jv+a8VF+T7QZ!pkZahM{4BgeE}`GRm(!3NtH}G!)VlYI(5$0meEeL`>50G zJnA^jUnBn;v*1(a+PLzalTZ2HPV!MuKU%c)+0lJk&Up0r=+>`My--vn?SU!duG&&h za>FP0;b@`Lx&yvwNamxVCAuSC4t$}+Hho?f-}LFc_VAC>0e*5i!e3FRO^2@w`TmMd z7`A%K*h$~57oRo#+9ykPz=zV?o#G|^qi2-76K`KKXyTbAAD-W#q_pU)l7AlGv1GRw zEiEoew(cI}wC-whTEC!t-(>3-$05JmY28Wr!DCBy4a+OpqteON_j;o2W~cQd$`6MR zqSa38yDEK7$uE}OKIM%3&Gqkg0?jF1NP$a%Rl%INK z#@&gRL&c?wLS5r8BVXu6Q%{Bp;v>Dn_>&E#FMk{N_-ab;t$MNoA|5SEnet# zLs_@@MP7btZD>^K6R39}RG1p><;Sl?*;>>)kh&+a_UmgC1#Y`|lN*g62u0&7@t^PY zLY;1@mqPjRAB9Gj7Ptke!b{dA7JCKpwP&wIJB29k0a@Jm#a<}hgf^a>aaZEyuiu?` z&gl^^^LnDJN4$r7a_NB?_at5k^+=UXy*Kd+%5DJPGOt(sey>yfIj4K7$&18icy4^g zMfWA57q3h-)!m<%f%1fxh%Z6^UPZqjaC*hpqFw!c@IWXYZ-kC^Innq$^mE1~_km}A>PD|!{AuX1m)k4VFyqd|J2P)g z962y4ULtJwmr<-;*GnlwEXh;xo4({t3pbo0p@;tUL5V{rPLC zdul1@KLh_J^yfgRCv@k=%j)h`x;Sv&J&C4J915;NSc=udmqpO0ZXSE4_pivzF)symu>LHedKAepIe zGv?iw_z86JxzjoRPN-dcoEMGXNBx72XP~|NAkWjGGNlXZ$BfJGgMNEKmfZMsjM=B? z&kXd3=xBVJ=G?DzL45xL8zMVu3U!Q6#Tb)~P=Clq4v@`&{|xl!D%4eayzm~Siy7tj zCGHP(0MM2r?LAKb*Zgo=-&gd4U&c0q&_W!ZO_BlseVnkFVUUm5Oi<> z?Bl9X{}|Q#Jfv-c?DBIbKSuhXahTzS<7E@>O^^+f?3chMK6eY_#n1=!^Qq7&Y8-pG zJ(RrnhepQ8J~1XSl7ZT90*@I}?^FG6y8Qk`8SG%Rn}}aXIzayu=>Hd9htl`G+|n1J z<9DHpVZi&lr^YHUo@93oUSW*p#y%$z?_GT@#bvzG_F=li^Z*gKUs zCQ2|bKEvFf2VHfAu1av!eSg$xb@SuZ-pR3&OIIam+{&PP8vkFbzL&*HkRRstiVZ{j zE_jwqUX>VyI^!YxJ9Wv{TsJqqYk9J@5&b1SUjn&zC9q~Yh4F^DcS6>lYQ4Gtk_QqO zVJwz;!@x5FJM9H~>>ewrSf$p964=d1^y2_{M3J73b%o|z59oa~`f~twLGz3BL-sd< z?8G}I7QJ*O*8X0o(>4BaC=vTJ=nLG!7}?L0;Po=b@5#AXdoR2@@g&v{vh$LQS0!FS zA87qv4EdTccD>w^*vlyYNvNB$Z%W@E%0-&iYK$?)_2nsd>$wJ7e;Me z-+uJ3EBf|^msh&S>s)#h>V169#1a}SvTM2)(0K1|=d|wjj>TNdDg809XG6ncJ3~2G z6T8P+FmCric3LxO4gL&zX@T9Rz?%d{4yhtHvh7P`J+oKhGk(!(pTyU||XSgPhG zb=^u~Y}YvnrLP%oH1>W^t)D_#2hc|0ymg5g=iHYl#Q4!zk&c@%e@I6^!gb;*%*&bX zDHto#Z;sM6rAN8lFdup-9y89z`V5`SfIV*`dpdU|uHoI|Ez?^PD-qx8jEJQ!z6rL} z9qUA4Y_wY%qcq8Tu@^%+9H;9}bn?o?36LoQ+aCx0C!qW7&WO@NtiOfm$Hr;bC%R)! ze(tp|C7qw(jVc|`_~4XkU=KUFsR6G(THg)4!e0CM!=T;bZZhtkP&-@R0=lLfH9&mxWqlBvH|_@LigX-HJ%_d7qZ4W07cZsxK;!%>^g1$Bh;rH|gt0$E zALh^;puHO8hJH_lehbUjCH?~aHhH<&=jC7>!Tf~%_JmGbkZ@ zccM?yU(DBOBECCLcJGyvEsH)Id|g6U;7_)z_1fOoYs1-hVvW?gB|VaUNrz3);g67~ z{R-)t){&C&tJL}{`aG5NnYugi6!hN2I;C|+bQ)1}N9$DS6W2%hEG-qC?r4{6_4PXI zh6L@YM6aek3!&#UebP0^*5~=_65TN0GwE{-Y&1=u3j%%a>XdBtbz0q$*bJN1c1pGx z=rUpJa(tjm@>?l(+OXix#421j$yVFw6E>Nq&vP^A6Kiu1*m5R)zK!b^*{ISbtut63 z$TpQeD{n~nx`e*o@_LmXVmo~ec15=NGHjFdS_u1m8GDcdtW6`yMzL1C;dLzi0PALx zn-l+=Gdf216;0Ulc7u)5JrLP#ci8PV%%w8eY;^ug%6%jONkG`|p`j{nq#EU&cB|*EZ~p z;)_F(8119)!Q9;7_QG0uO6)%9r0?suP1$hn_v*_qKlF7aSJ~=#tPMSJO(7m+zo&ZP z7+vEiP1n>{aV;!?oF94lusyzZ&c{5&8t@vf4<(TI;px|7U5KL3z2g5w{%NNqHUs;} z6xu%@Z?TwdVJ*8{Ibnq%X2Q~>k(tf79 zR~jSxp5f-=+Smiv*Miu4C+cek^@rM~dkAWi)(z4(>8%NCB<-KC#~d8xmc>2~^@}|W zU5vu|PO?(^D(H)3c^Gz1d>$Tmz23{>`tvYsf$X9u^tlXrr2WJe$TtJyLiGz#?-l5W z?1OlGhB-?*p|Yo)?lIz5h&1iXcf*%0>4MfP(L><`thcE5D*8!!D8yPqbAjsDU=1Jb zjf8&bo*}GwQF_K4*ahfmOh^yZ&yt!|iqHM95$dCi3GtzIPK^g-q45}vy#dMd9@c5f zlYU4CGA6Xvr!YV7$9$tcr(kEarpfpo!v3Zg#zX76m)fJtxR5TWKmM3pjxnhV#)S0L z1Raqc!mxW96VjJGCZwOVF`0RNg6xLwp=3->W!oWLY{8r~$3*m^#soG%I%zW|&?EJo z#)JA#{VtrU$Kw(>7^1$L<3a0u#_@nmWEV6ZVhgm7rnY}#%@LB}H#|T5vEXqbJ&|5$ z9H{@P$u}t;qJO%-ycc891G=Xh9k~S8(gbw(S*T}<<_28@A0BhP zum1+nkHq}A1apC|gLECB>ou+0pWzw6C(vON>Z<)T<^q-FKpwSLEx`RX^xZP6C9xg$ z@Er6s!p)1X!dg^``$d`q&pJ6NqThn&9~cMlDa7?0>)hC<&b0r<|3z*t z_6>z8(!nXPE3CJrH2)7wxhJt7_n-7E;(JafwPtri8}Gwk_7J)U2!&H0Lf=Es#*o>! zC+Hgf;ian+KZYKM;D4CgA^tAr^B=G;pt&?C)G760s8jsM4n5DvMcpX$)-C?wxvLW| zKp!8{9Kk&u-McnSxifJY`Zz4qzm)pD&rPKA6i@UuMEj^jJP++YSBrH3W1Kf-O=1|v zi}qJ}*t?HGp9(xLK4b>uaw4f`fqmi*DJ=*UsB0{ZW6QV}b^W93?_;Upd$iO`@@+=nO~JzsMh?1B0hivJq@yAAxGM|+=OZC-$97Y}2+ z9-ef4B5%f;#PbzI+c`cJ_h>W+K5zz?{xQ^9?ROq?I;IAKeu$fs8iGDu0sMLBM=2Z)x6Wszk8;mwcmw6b6N0EQQJ)v}so0nSSG4 zPN^O6tKJ(rd=xUB0XZJ6xHWOh#kVBrIl-fte|g&hzw}uA90X&jZeY zE_jPW;mAsIE(wyB*_?xr0l4PrEkp7Vc#SK}WsOw*_v;)Ok)v$k!>g z4RsfwUC41LTC+0o`~|lq9=%xiG3vI5PIKe$Khv({qZ4B#?;Rg0dG{Qr^@G!MOT3&j zN`~MW$BB5>xBFD5wR6syB_TX>{m}KW&d{}_GuAv8`V1l60cp~0$9V4GPzgPkju*Qn zJK%5I?Vx?q({pUwpZpo{>%IT{^YQ%oJUoX!7tf<7;<@w$_-jvXqUYLpR_*)8#)I|z z!%a_v&INr4&#U3j+jDN89fmJ;C)rB=(Xp3=PkCo^Vb|mxQ8#fSo{6_!hgUN~ z-?j6`h|`KQ;fF_~%~SAv;J1GdC3dfb3_q@iPwz8F-u#A_ul&8Et+nK*{0;UGe-N^) z4Hevswe7ddL+(eO@<&eP`J0KhA>{sX`4`SdcwT(_xFbiVy@>A$>+nNW25 z&p!*YpNT%4q55~Y>Di6+Og>Y;-u&ONUsK`locbkwGW$b)rT)-3nYi>(pAq10I)v{K z(#{FMSpf9i1%1yD>(o3Y-mZBHosB?woCmO({NhLZCQCY8am-Y_OIg<8>aj24{8Gf{ zzSte(JYdnv#QSl|U-07TZ#h@I-^nSv_3G%<%ZA+4F6g?5&x3|uLjTFN^R>D5Y^0a+)bG!c*?+LB>d8pgvc$fC}>oDf) zU?_ndlfU^c*2Zd^U55Z1w9l06bDg5^5zMW8cfhx!M5P$qR>;&HlC_DKx z>}2JcWo#$JQ~S+d6-u@iqi>~{{HOPJhTH@h$&OdSj&as_=T(q%8{E+x_l9!??EUs% zqAcV#Pr-Xx`IM(LzK+h%g`M96nMb(M-|jfG7;-ze(|HEkzDX|KhbZVnZo%#y;Ij*T z!1pFMuLQleUoF$h7@qS%AJrkJjM7o)xH^J#L2_wz4DrBZS#?Lm9h0rqU39Ey3Xnb) zG(8ZX2AX3LcL7Zw9V?oCNcRIxDdO`$GZ1kBXol)o(TqTPAZSJ*{yJz*L)-&2XX;qd zoQ?E||A)Qzfv>8%^2N`&HwiZh%D(^sqX~jFM8y0hiN*2euL(g3Aqcj%1d~9bAP8uo zY6%2tEOrD-Tienh{+TII?Kmw~{000cT*)xgF;04i$5}vms9N z86GO$@EH-*?$qYghJkkmo4>~A2#{|Nb_ekMY}oF1tLS`(RGcZ`o$*2T$-%QaibdqV zE}l2i*#Yw04(IVce&m@=GmqTkK7J&<>#F|lu9*XP{;I*?KJBY3>gLrm!DpgrXx}i}_t-P~9FvK79*f8RTk)R5R`MA-I|eae&!_N= z_FFiMWe4oP9ez}T*hv1=AMCn{{9$m=-93oCFFY#GC?Do*yLz(ocJDB!`77wtlZH8? z`niwN^XmR?_woK`?wQ#i3_jjJ9zGN7yXu1mJooMHo{8T$VC1-RnZrv&JzudI0 zrm46uyEOEztFxWA-!F3ZV=mK7W3j|3JTrQ65WbX&^CxJ$dJ4Xz$Gc1~t`U8!KIekU ziXY{!zTjKOzFV<-cu9Eoam@2VqY#ta;lIQj;Fle4XcpFpu5jqo`*dxh%apD$27V$B!qxk64(Q+;F2wbhs7 zHG`Zr?W@=1OunS;${c6q;?=9$@nYg)e88*?g8s_a;=eLKXYoxKnf{vB^7hrM7cXtk zY3p1HtNax>L&LWAB}+RxZ@y*O@>^G|ylvI$HMigKxwY#)|1p^pL*hwni8C=L{v?8= zkRXyp;z%M1CAl%hRa910*VJB9S3j#^_O;i|X`I_MuX+CU3l`q+so1*b7Zes1m&_-=BP?`%|^+|NOV#553?2nFl}rt)y9h`{2)?xaaLp zrJwms%DsQ8|DPYczG~lwf112&(Fc=mSTy7PtV>7k=$v-J^#@-${^@V$w*O$|mk*8Z zomVz%$MBw`$-T=iedXjge|yvM%bs{O{nmnUZGkWT@ydJt{|(t?ZsPwyx$wzl03QVxa2liZN5O?q(pZe1_ZSIyhF&zo zg<~pm1YU_CPZ#8A!227E^Ak*hQ$_^b$6QFo_{Zmn2&te|*FM9$U8p3DrOp&nWUhdH z1{Dz!V{yqbMVbWcGpLA=<>!LYQeE<<8@}E8!1|qXw~2G<8&f+U+lj+f9%JxX4`nzq5Q}lXVLVqrk8x`x(QpXIr6NV~g$W0%s ztx4rhDx*l_Rc9d+44CS4`nkJKXFM)9GJyoMWM{2YG-YR^#a=eTZ;TW!ybUvdi@eD> zVk!i~y=)jUNdob4djyyENL}I%LJ~~gGBx@*T()xQqnzsYl{?|B+E;$Fo55al7XM&o zCh^-*qtKpNrVhawt*QWBhS^Y%dEu#VHQbil>VRlpoFnoU)w)%g0P` zUQ(iLb`0s6awm)u>TX@kLJB3|n8jRVE2lU#&|e32%$Bbf{&tzk#YJrw?}_^^e-X)U zVF2?o0hbw6ySRK0qt0!xm)?y*P(Y7&TxVmEPL5H>41&1^6*ux0GpWSF1WY4Enz^X% zp>ih?DIu4TLQ-wbYArLqkJEEvC6=^|+RJcV8v&pd(oV?VQ$Sxf>)k;G!E=Q4VLL zL*MXSl0c?+eA;k}j1FZxkFp6kUmySW)yfH@(8eRI6W~UAr?Kf%+eYbA+i+aGKG@AV zu8j_wi#)PTAMZ8}zn3^aJstIh&f|xk#TI#Ro294LUQV%_NMgMTT`=_Uxh(G#y9>Q@ z+b;5ROTKgh83#WWX5%E&>2Eo7A|4rI5?2{yQlpFc5IRLTnVOCoj!I223aQ&mtTX76 z7oe)2h$37c$aksHU6srw@gCo)<{Ul6CeLdIZR5+RG-*36jSuL%oX^I?Plu-`1Lrtb z2!K&(DqfM1{xK}df| z?RJ3fFQOI-siJco#r)eu_iLMOH!zAKRv1nxcOS1oWeA z=NZxl?Fc3{bRvP9p<$(^s#^s$`PFa%BSJuD957B9ESB;&H z;)WgKGwu}1r_23}vXpoKStZN6U!?e6LI#oR5S3f(CVxBweLM?&LWI*^B3EOjs=lY{ zN?%oObH5pKoJ(=`CSC3wE`9!tx|O=z)vCC6zeZWjyT3ioy{4ZkmT@<_=?PneJSB(J zAm4F@Sa&-R?ibzk^W3&`cD_j4_9!3Q6vg|#7&AwEEXsJ!Lt1ht+ip79_930@tIFCq zRS2Yf`8!!2;oV}6tHtEtUdMZr@|M@3#grB23$R##cWI>3@T02m<%-ewU1ux} zHzqC&5c}mSZ@(26_WR<%0VRj(sxJ4Sl648Smt0Q(aDU_`Pao2D)Bpd{Zh!5DGa-xC z#%$p~`9hYyM~I^7k>kGO_6`YAZ~H=&zQ01z$~OaX5`r{>`=L8xsPUEaa|7fj*m2a9 z0v+eP;QjeKRmbsS9Ca8%C(>nx42#Ysc9$7Wm8C92yi})&G`@~pm~%w*n)@?V-#|`` zUW2L3*lrjynYw^C=^ANGv_clFrg>!3|GxgKSm6K2A(S;&Mm@yv505=|bl<(d|Jwf7 z4}9hIA3gB0Hy_$J~id|Po9 z&LJgMt!vggYgVjTybNbIF2*MiZ@PWSlJ-?m%C)Yzbxr%)HBoYIU)hF|%yH%I;7fHQ z0d%CSv#fndv{LvSVl?%r*oxcN5F2$0YGegEZ|#i651($tml`9fFBS*2T*f zc@|l@YDFtv1T-Xx*^19O^r|3U^lZD;xubp6 zO?2>Yr+VSj`9FA?tl9@ayt2=dC7c>bt(0)n@Q*GjLur^0xMWI0xMqbJO5ee_Tr2M` zhSghTEyFKtQD@1fd@c0#v>~gdEjZ~s z+OW;z@6P`=l_NTupV4)c{+xwwB*r?r)XNq(4!^L`=J$<}e>eKu8A_KjrW0LgxS!3q zH;F-%vvHSkzS6~)Pqw{}^VL&;IQHnkz?`H`kV^P0-N=v{GeRROM-B3FC~N{J)n2i9 z@v7DiMCN6kx8AV_P54r5EY^u=$A{qF$h{R`{`S7e=D>K1mn~bfZe{ywoN9~p ztqHKVujyO{RM4hZx7ddUoxXxs&;hgf4SVRSfI5cM$||PQR>veKUz_Z9M`T{*CJ$HT zUXRH7nd2spN$Z~Tt`cl+2ipH|;yraLw%cZUD2p8fMqmU3<;7T_+8+sq5PMhNpg1 zSASi7-R!!}PyMK&_S(8lb({YbJa1O;j#=v)>T&pQaLvZx@B`}atl*ki!QmT&x8v`u z;A-_3aQZBT0p&Y{k52Orm!e$IfTyBNgP;R|>l*4C8oC-94nB2ocGsr*?mFn-UAK8( zLjyGH?mh_B0USg8=}1umQLA2k8dJ1jhp@4a($XTC#Ej&NWV{4?Q0GhFPI+B+#Y(f34X^@$V|CH_jMhLm@>fl<04^hpv< zWgGT)lcps30Np9Qm10Bg&X%XRpo(0fA>}xas;;!v5{BMs=|uUqvLKmM0sDjLXwr?; z_;<`wWt7UQq8o#08+E0@7+h1{NjZ2hbma+Hg^Wbjp54_A4<{3)Kt7rX?z+F>1geN! z<@>7YWabTqd)^DymfeZ#gsr;hr+Vz_n>PWjy)Z}%W&?oTgQJ}J}#0<;BQZ`af zHx(xXgC*|C_`oWjl#x7kZt`TrzRMBDW+jhJX_%cnxgq&-U?!(r(*Ov4DtS!(>}!&f z=cWXIe>YC6-Vva~u#esynBqnR)`tQr+(+Oa2OeK1s7M}uT}tqu@1`Ib{9yp0_gWlT zK0A3FPAxx_5`6k@9Go5e3Gf#n#9pe7^M+1`=veU|-F*PZkOzMrnAMP+d|mR`P01sE zj3dfFkHgC6Bq!IPT>V?0N7U3*mcozfsU4+m%eU(f-nKoB&-Io!iH z1~PogybWcBrv+;QGhwda&v113L>%UwMzz6cIQ)yr$+Zp1!>^^|y@&sZ{-y?hxc)%$ zm_}o*O`f$5z*>j?0&C$E^2G;|C)T4el2flu9#dypM4h_+Gz@l(* zh6KyJqb-wsVel8h19Yr?V9MweIOT=G71ZEl!{FGB#QNPk$qRy8lQu&9pYBxW+iy>z z1L@zqGlVb5QHMCobvb60(axm*I`BhJht*8hDtwNKI|3u+K5%gCmJE+VddG9Ectj@fwsS2eYPkTr}Zz_8J;gps0 zZwjv-np#-L`K7|+eGK2F&uZcidRuwB6g_|F+QJ`E_!JAH!S5-2Y6Sk<3XjE~@A`tm zpXb9m&T@qx5rLnh@S`H|pTvU5)ek&WUYIG;LGS7ZsS4A}csiTRb#nO5aqvw7b-k?c zoOTTq=!FchchBkig2k@nR1NPB90 zq&+o0(%&>b(%&>b(%&>b(%&>b(%&>b(%&>bo05ntXtkrA8PreDY?Ok7mOt2;LCb%J z;-}cR1`axrafvd6Lr$kQ;d@{7mj81$py zvZJk2W@Vr0>!2TP`K{D^qQZOaD;~cC3XZl;1(qNC{8rHmm8Wx)qWAid?AOgu`g{H< zC23D;wD(?%qxPtPqsTv6eeE6qE_nlWwBqCSi(H-UtU)^3>PHgs*D5_dKR?R!&nkMa zU#NXL;J`kr{poDTXzfDJq@&^KY_Vu~87b(@gD_ z>C9G}UgQXW(aq0a_)04Lh2GC!=yF&&uwNgEe|~+W z9i>0!aCu3k-^u+N&iC7ShlRK8v&+KUdWt^~pD@!p#GFzkU8vJLEIp z98Sd!g8#2(hodpCO$=g#s95=p+lC%ejp)C0&3-KpD zk23uyI3@g*fP4A=G7C@if8zTxPRSqa^-hzIp7QCsK_^Df5sYu~;U_bGIpe9kJwNI3 z(bGN%U0>CSic9wV=Ld|J`hJ$_5BTu28UM5oPiJ}3^(&ny{`S1?KN&ClWxn#R5C1vl zBkMb%|1#r;aZ2@_%w;K|`3+q{zk2M@_ZrTg!OS^Y8e6jt?*O z`mB!+59`k7EPS5Df3uIzQ+zMqIwHAb=Xx%KZ-J^y^bxr-KNR{$nEnwT{WrON|H+46 z$9UNXApayiWq*qHKj{*=>zV%dKKus8zvIK}=TeUIXCHnu)2DGN{O{rWaX$RLe1EYI ze;?mZ_u=p7`zw9;2l&3$hyN!%hU@{>0i|C|qB$bSBk55Jc2|L(*8nDP2Krq-YMU&QVACm;P> z#-Cw4*@yI8%leG7)&+!rknxu@UfSJZK3DqiVz*i!{z9g2^5G{l{VZ>NxNE@RRud&p!N8z8}WxHHk~V zVEjlQ{sYEe#CXwjte{3Y(ZY~hLiDPH%!V&RE?FY|xX!qa?Ju6Hdw@mb9S zKx^_$1a-+F9sjzwBog{S{(-q`$W0QhVib zd;Pl)FLCL(4=;ZHp^razUnhgxLHun7_lqnaUijxSp7giZ@1L~j$xk-1eX4!S1@{P&pt*FOBKj6cG7f4%?sMGr52G=?i`MeN11^cxhjHPE6PJKD>-mH~H`~ z9^LB0i(h@-hZjHjq7N@|@&Od@l>w@t)lw-Js*7)`~MFuJoy_wGNY~o7M}Wx z)a&OKp6FLI{Vy#%(Mx^laCN#Qj_qgq-&%O07dyPcc+o$H3e&~$L-^c%zDAGp;R_i* zneoEsF-`8|`|vr8uki61WIgBj=*7>M`skZ^pJ=5Ie?H^a`S8!Mo*RAmdzgNU4}XyH z-(bAIUQhY(;^!~=@M4GKKD_vOfa41BFJ#+LGLrG)|MS^@vMfCL!&|Ipj)kZ8)$gUL zuj>#yv!0T6|D;7veCm0>>}m^7e8m47EIiSFh3V&5c%pxr_58FC{|w`AV!YH>o@cDE z=xH1e;~!mjTX>Q?iTB;U=)>=1{MUW>X2w6tc#)gK=Lycc8fA$?Xd{#6T4 z`ur!`;kXZ<%^PwjefXDHpO1X_CZ!-d-mibL5C0bHd7Te0^`+mD(ItFj z9-^_{e!lD#a(GbmG;awrAy?brw=zDHQ{qqb!av7{moNL~`tW@mSHl*b`h~PhoezJA z?;Cyim-&974=?(x^x^mM{aPPh_;>m6!oSCdmk+u1TKLHfQ?kp4&*b|jEc_IPDG|NM zo`fICd3~G`{t|{MIqbs=uNN$QF2j^aJ%|tCr*U3Cr-Yx%FeL*%yzqLM+^Qa=jB^`$ZzGM z=fQLlJ>lg&y|9J9LQ&{H_Wmm2MgK;NKHs8W=)=Fsc`X*cz@qQ);iWxRT6pR&a>>36 z=}-6|Gd$w74+nyUNylqce zR}mlEo(C;@+n)bn;ca`CTJvz*o^vd`ZO<1iylv0VhR7P8|LZ%)xzn1@*!KL2g}3cF zg~vOpmu=6dEWB+`XL22*d-M)0u;+t+-)qaOFU47Rbn_Ez^#ug=0S#^=`j!TiR-fLm8Fb#dWW`yE z(y}eGrEPjaxie+$^m4_P=IR5t#uovy&b5&{d1{wt?Y0JkiKR<^2GyD@8KX3m%z0d2%k;s=@ z=&$$QF4=zs{`uwq7&xk`zyFGZzl=Ql^2^$fOh1n3-)f=1j?<$4>h`Ct0KfcIG5XKT z>>x+Eyd-{E%VYH4#>Kis3m2sNkHJ5`{I3BQt^SAjr)aYNVKxzU-G&UmPDJ|z%kLuQ zxJdq3{PWAth*AG8UaL))KR$}j)-z(uS7CYCSj4&p_ZU)GT* zIHId#`Le#H`jbih^3%aEn*5dg)4l;>W?g>yDM0vfMBdn@3)%870Lm|a5^&MvFT6;X ze}OWs%P)(}D!ggJ#2kk=_)t{>5m;XM;Z_2l?+#G%P2^$Gm)RA->0D@VJp}sCh zgCbutq@3JS{i2nB`C?5G7D7%%e?bRXf4}_9$(o{92s!o3FG9g+^7nE1aGdh=zKWkG z6*aCG@;={+t# zj_Blk)5mGhvMxXEPk@M~f0zb#Tr2s71k(Rf{PXMI9Yg->)l?b>{rUv@Zk;d0kpIL+ zUH&cDmoAb&761J5A7lCXL}XpJ*XoiDJSV50D*1N zuW)%AN3fsvXEFTuK`y_~S3v47d};qTTKn~WQByQ>d9okv??`#^KiXIJiBJXQ6c%}& zs<}nd{$mXJZ{4Fy*z(E7e)$z>AFznH`W9%^6SB{OTlzhTzx=Azi>J3vUvWhaU-<$c z)v*3Mqqtb*6cm@`7ZnoNlD58Pc5T4*YVSHvMYTm2eOaHcuu8+ur$PDAoriXxTIBA2 zZ$V)9$vMH@9|fIl?*^0iycbN`^L{Y6=M>J0r?cO2cKDu$@CrstC7si)&&=)(I3@cC zcav+*?uH>so+8{&2{(QZL~UJ?OVg6a0IL!J7A6O^u9L8nAu#J$rmTlITY z>VrD|#?)~f&Lr3R_oALJ0sru2;nTXV+D`qb>qA$BPd@}%4;LX1byjx4>&;$$tD$cd z>RSo@>Ad@&sX9}=PNQCf&jeol=+5NbXI7-_{$S}a(1k#siu$GP{;0~`M(yK-$(GrB zdb=+=Mf@?Y=Ha(dx9RrD-g9RB&WXJ^-<|T_lRVW<*?Zm{hPfH;{-TLi>CTK8D|$;oSEN_Rx9ruLdW=zti(b zrG2>4-22}hg{;P z^n@JGZ)U*{>fsM{@QZ8UAGPQ&HM`+2+o;d<2gjgXR^G`uvFX4wiEIQWckfM2>4`!dMJXQLtCjTOr$z`mz2CLvD2Hzz26IsrSr3p>6CJHBt( zvCC)2E}tE{e0J=LV#lX~&Xag|`pMhzZ=bRw^+i2i^znGN0do4;9%w%`-fe)aeje|- zV528db_3*5e<3^fqn&<0ILM@as%%efr)(2_Jn;9^_t*{+`%j?$?{fXAFWL3)N1w6l z-$M6R{rll}cKus$PviCm^eL%Fi_`;sO6t)^^+4NiK%bI&^jc$EtiD9`{19UsKG?e= zyVp7G*17w!L-shvfBYMUe<}EvjDJb^7sS5+{<-+)JRX?s?k69iG6Fk@S%e#`3Zjn= zgU^NFd#UijH27jV`snc8AHn}H|JoXI!>1{>t#?M=*4yp8NcZrcJj{9WXwGvQc75;b zJ16eq@v{FlJ!bcJ>+}p_!-6qR>0lsmTX2li{FC#Y+nyWkG_O(qGd7R<8nq|hSZo(*ZJf_p8CuRbRhNsMt|oo2{TC;ym1rEv(llLZQTV4qAK33NiA7?L{*DK8WYr#ZqPlo*M&tpC5nDgOa3DrGTU1?5uCb(nbzfeC%9sKc2&0B$| zm}%Rf7xtm~!tLAL30v^zo0^t!R@rv`IVKM2~-7 z8mXgZdsiQGHsVpGt4y6gsMV z=&RBImwTAYK@Ww8PAa`Pu6%OUeoIM z2yJ>owm+E;Y(Gre);x~WBxPW=Wzk`nM2ZJfF@o2=V zF^E|i&|xfe83$XBhpm&0txv$V4R~+67}s3x-Sy{-d0YZ z;dF99;c1@MU#0uFiNitNhx;F4JldLgU~Q{XvN`b;n}0wyhd=%her)4goKvNrhuyKw znnB~;L#zwY=V0x0E;>m)`u)1GPQ;&dToeox3@qvyUHx46^L4>cx-;sV^f`#FyMjZ< zi6a+LdoO^EuZOMY!{*Jf{XDdL({8kdYWMx}<*LrE$Eh;XF{#tII>N`Vm z*=0^a&Y8jHQ;036u?AA@2Re_RS9iqXsC6g*co=&BPa4-hxW8w# z$Pt_W_CE(p9)`Wi2W%g5fES$1`G`;WkAo!-A)bly!^p(Z=}5> zum5+tjMmrl{T$$pzf9J#L;Qv6lJg(X0r(@`y5Dyp=6$fDXY}zu>v-zLC>^J%%u(bG z25AkIg1$ZseLjS~pNbfehB%v!IP0yUXbxGzjq&e0-4~w1F~_&{VlIJaGU&e=htmW1c3oG2bs#>21$YPgDfTf{`=t)c z*^-;;Y|C~tj}yPi7>jlWL&smkJm=Ugf!znNrxMBvKY%eXkKzW+%?B=UPM_g@$P?5r zF9@GL1N_eMPMMw?QGA%Nr#Eo*Z@Ms!4xnF+!TvM#F_IB&4179O&6lu$(Eyvwf^F(y zqdM5?8pOp~#6>-SroF)K;DjxD&T+w>6UUw1A7Fh>b$jDG6}vIN%yT{(EU5zx_Wqv3 z-rts~=!YLd_cOt?J*j`pE~EX1hq^y=3USH!ysQT()pMWhJmN`f9pXtbB;-!max7TB zXFSS17);&rC}_R85A9=We<%7b_=NC$7BNQCQtY9<9~#4TUsJrnhh)urpL{!G5B9-} zU%fxPo90AExo&utlW_#Pyb3=cS}ONFGkz!LSF|TU?S3Mt{puv|Ysj1l4bHZ3R?e-9 zvnJgd-hB1rvvBXC?9O27@vc*Y%`~?<1>2J^pF*GLhrVt|$N6Y}U7_ZSnQ{G^?DWx{ z2jK56{N6X;4br+v?`xhy+hIR0?K?p(~ti)VEu4-xJJy?t=527uN@za?A~jKcD7o%SBt@*-tsXJ-7ErHm#i}qP_I^ zIuI<|(-RDB`FtP*yF2C7hr+{Xp6l&pQeT*Xb+)wgYw&@i_-D^;KUi9cI?~?n&(+%O z$qxqilI%K`{mG98_ue_od2z?^t|l5k_4;R`iY0ZyaCr~b7CSH(38TKw;9zkd`sE?4 zFFplbKKqXZZ#fc{2ueBqwq<+mezfU{G~s;XSCX{1)W}##%}My;OH08 z&(xk8J!g9#?N84T^%^G$u`HPP0es*?_yFc<$`5D`z5#mWHdO4Vao`AiuLye$9hJ_D z*-wvny94(*b9fv;8^e$HywA^$QnRw>VH_B>9{uZL#QxI~r+stR#p5VWPsoFQ+hW<5 z>IR?8JBB!NBiiQZGqgWTd&+8W4Y5zh0O*|;MxV!{+>BQZjhCn9h^=~z?MJHDm^v=E zz|X0CCdv+=?8%G54@`8!-w(MNh|$G+uus43F7)%GD5v+CXpe(pw4Q%b*&MW=&ZoFc zW7fo>y3x8-P9az?M;;N145i`M_(r)al7A-*4n-{5x)83g0Ge1?md{U-SS5%RaB-TA8tA>pNg3EILES$Sr^~>NY>?3&zrT|P0geDO6?GG)3&@ZBE0|R%Dm?qQk}OQ_|lt*lW(A2e?&j|9?HEL9G-Uz z%HHRmzvn-L!yA6(u6y8D?(jXo`skWp|H=*j&spyITb_oV)Mu!i3!b?d;j*b0I-}{? zWC-#o&Yebo`X=m8&w`FY_Egt>?qYY$mPOc;?1Vi}ukRWC0P-7@T z9EUm(p7fzS1f2|uw?`*C+g?L|CLL%zAzwTK9QK&=^!$Lv{xOIlx<3#N%{j#fqm4Dx z-{F6G&>el#+iN+4HkD`JuY$)BOKuD1O0UMVMYm@Qibe0i78DC97SUYdUBn`qlTw{2 z?vQ`)!di@M^OF?p2f{v!;Rj@ge@03+cr7?K&x?^`_PjUG*-f^HRxiw1oAJJI#woOS zG<#zIp_uydYtU_oJ%Pg>D%*1$?3n?3>b*2&Pvj?L&+fC>6FiPsa&3EJJTT+OKrkim z_psUP!6ei>m^T^y{|^`^{(xuh+7Iy@uUn4`i9TyN6&#j#8g21mFgZ_;3&A|v2lKBL z$TvTL?~TRWzXx*!YNHn5@Qz`|eC#899dm&IG!;Qhf1Pn`}- zcy21@JyYGREhq3UODXm)`m>$WH1E;t7QN@0dnCI|tzBRfnkP)e+T}&`5t`4R{++WM z-&RyS^;&`ENP0}7bzTd`Gnx0(eLv=~$0k?oCR_mfC`DM0(ENmSQu)}+ptT6bCi6^! z@HxOAN!R6s7HcVf&SaHG+!)A4{KGi^NbobKXq^$d5bL?r@H+!|mt-KAyQgdXj&Dwa zT$&RZUZ|VsNinn^YdFgLBi2`Bk1t`abqsUBUAJ9WgqYiqd&%L6b$E}W2Xnt&kh5ic zR}+=L<>uTnDo69Q_rUYjG1MOPEFla1O^>x|?E=`|ceDcT&U!=H9d-^mVCSRv<;(hIV8Qt)6@^QpJ#Do;+r|m&=75Fmze?0uqi<|a4 zLnWBkehuYwU>n(c>_vZ~y-yn#1`hEZ>tx#N*K=b%57y83NET?+I#17&^}Yk)yU^wv zm5#Lku5}Az{rvtS^j-8P%~R&Kk$S>r8SlGYqkl#1i8de`()}-SuledVn8L$nHz-+} zPQzLkDJ##X7rZ}MOywsf>3%}xp9D|+-bR#nHW0_WxoZ;EoBH`V#VD#LjTM7~&Tja) zvN`d?{-mh^gV$$J@olzmIMY2C~-#(1>=HWbb|6N+^ z+=TmVcg*o)Xn!~+)~RkD*0*_t!`h}9YqmWdfzWf=mt#$t>@-in8Yq<0)${?{tL{=~ zt+(#cYxywt5wbI!vIQwl@jnML(?cm;O=)ACQP05-rcQ!fd{#6Ra>~<&JLTyko$}Nq zr#v&mDW`WgCS+1Qv=6+Gah>Xu8_e92Im+3#oBA03>G>k9i^uOtb)9u-sZRO0^VFwG zw}*n`x7-^TvnAV2J&u^%EbUKxsIJlC=|hOg{&zss^90O~XkL!JO8CESb9x5wrzri9 z);a?i(`cR32RlyXbq>ZVv&OOeDb3T)X>Ie&DEhp|R(ftafU)oq%-`@1PafUVI`<^{ zC)T-n)VFA?+Rgi2yLjxPHT8b@V{VmR*Bpk9Xon2KO$F|1o^MgVUqU{B7;y9vH5br* zg8Dn2&#QF@IasGsngM^L zIUB)U*sGwvFMN72{tS-Mv25UxaQVa}=f(OF6B?A?T=LHoLwL^nF4iq1XHk0iom8w} z)&;-u%{^ETm$^OPygHb6{I%1A&GPI+?KxuKTE-g{OEBJq;G@TaC3|Kd#!tdHOmj=} zE83UFJj>|QkN9#NdQ4q?;k-8x+o!q{8xE&HC+O0N_vEs%H*o9`r~G2rcWQ9#b5k+C zrePfTCDz>7-+3F)0Jd$wJpUB@fbfgZHj_ZRt2Mlz^3Xq?LwglCH2=Lj{1tj8PJa77 z=5103@)f#|=DSa$KT^LRd}h>H*OtWV7>^OEy)cJWw&`}Z(HJZCZ#jdxE#4*6cJpF= zFFjw!vjmOT`*6gk{{zkEp~?C=m9j5zbWgER-bq!@C|C51ejm>$DYlY4dmIbR#$Ey5 zok+!420iy@<6Xoar)Of+x!yBpfA?(+=FqbKKZAaOcZjj>m+?-o`)Ln=#yeW~ckp;u z4m;~{iN_Jl^SrSNdn5dQD2R zP0zP5PO0}bX}p<8ZH)9hq!b6mZo~`YEO^m-Hnbksy4m*Bc^WU{5WW99B=)gxdc2PP zPMm)aN7g63u+=V(X*B0X`(?yyv*lV6rKAPVT=xGu~s z=-tc>_$N5(_w;Tiy-OyzFyZh_X9K@Oq4Yx=w%{4g2K*B`hj4iQyaE3N*8rX^ZzMu_$N3$r!sAcxm6|J!JxIMez&3PAHpBC{Dbomy^F2(KCupuw)Z*MoocPc z(N9~QZ67>?*o^Ul<`N_i?X#8kLnf_<=5dICrzZCpS#=j)|3qFo{ zApTJrc)Wi^7yX1l#r`hLw`4zu_IU^&EmpZBIaYP2M#d^t$DgZrTbrw}K7>Bxzr?E- z{gd7^9`A%Mdm7I*X>Kfev=*Uy*mV%SS`f1apwHOFct=(7(|xbYI*1@4EB5=`$VP}vr`hrMNft=})7!27ZKU5+q(nCcUp6xf!uA+Rm^ z2))Nbaf#x*t{eHUUw$cMtmT;R&(m`nXWPJ?75j7CzN@CD;{7;`k>Pu~uG$@hpJE@Q z2V)hj*RsFtygeE31ZFJ9{4?CuwEMNdi@Ulr*5zcHyOi&`*ge&Iao0@Z zL9y6{9d{vb67><#eh2Hf6!qLW8}o$hJlT(t^;Zu3;VW48puDj^@sRS5wgzAPd+_^* z*PIt=KVum4Qf&ZVc(}XiR4?)#f*iv2!3S(!HcV^Dhl_$Qy5ON`u{N;t$?g}S&WXq; zTEzp;g#9`=@8FrQPgVO`Nm+48QT~jgYW&Wsx_Sowl+=`#mR6UR zm6g?07gU#2))tkNmdz+A&#$d0tSv06sjSK`D=w?3si>~5C@-w4m{CQAD~k%NimMCq z%PVX0Yl~)7�&=Ehx&bEU&7mF0H7lt}Q99s;w$5DJiL_Dk!e0sjR3hFRCajFDodj zg@~%++Oqr^GpY;0D!;b0s;I1@te~Q%sGz*Ku)LtOIKQa2wz#}_MrD3QSy46qtI02^ zsVOO~no(O)TQVbmMr~zDb#Z0YjH>D)aL+HxFQ_P~DKD<9EG@0fFD=P0Ei5Xk$giv_ zt*odjt3_o>%bhCdnO{>`T3c0JSXNS4SX2cr6%~~gC6(0`s8nH9enC}5bwPPeMR8ei zMOi7*qSDeCMWr>U2=uI~EX>a@sVb=|h3RUliYuz}!KAtZ+^S2<$uQ-htSP9ettu`o zE-S07EUqo6E-0#~D$1`YDRrvy^YdYuf{N0r($b2WvTCG7rTJ9_wY4QBl{3m~3JVIV z3Mmsg{?%Bm}76rrIDD{7s>Vq#fVQaqy!ZCqPjU6fyx4+9sL z)XXS`)-z^QRTP&NR#p`k16Nd#UszjKSzJ+GT~t|H0jri56qU_DElNwvi%M&2ii&D0 ziV7jKu&k`4q^t;aDyUSZg9gPVwWT#RWmWlAGm469%gX^)SECtVzM6dGlonQ%))o{N z6%-d1z%6DJ7Zw#)RiFV2;W?#cm1PB`MU~~XWo58?*^HvX!s7hWirRwOnri4>Q&?G3 zIinN>3QB5=YT!EsC513XX+a6hT~Je20{^J3$S*3W1-h!Dro5n{sJPlGKnoN&IXO-9 zDspaVUzc;o;$@v}i`R6nxb?~$XXWD6tJ~Ysa&j6Qs^(2D$Z5Z|b=A6+l$jGHx2@gI zHHE-!an9<_rMKopD};>cId`RhtUuyp7XLG5kMo`cT^11_GX;u>{vQCj-&=l`89 zjR6uJe8?pq?{J+)0e3Kg>$E<`;0qpVNNLMlxPHlx=KNU~^tw7zYIGHK-+#jIq%%^opf%rr|PQz+QuD zk7Udr9PpU?8BgOZnrG0JPV4p!PiDaCxkLMUJ*9+KZQ0rjC(T-w}q2PHvBre7@mF3lr18N=z$`3e>B4v-NBvZLD4pm1 z^)nVO^3_OfEzITVTE;1)?O^ax4@Do&pzE-Q8qR_oo^VNlg!UbQK=C82U>xLl4Yw=SV_Qm^$*A}T42<@+M%P;XHaZx{*K!n&M88%R-%!UEoCxZs!YL$6qsl%kmZ z3AoU3xp^p$*mFoJ>N@iU^yXfj=g#GN;nHYyk@3bbi(jJ!!ll}9i94`Mk>|OH3g~k4 zg5hI^p`$jP+zfbh0-mwyvz-J9=NhIThn^e?YxWlj%>Ea@~N#$;nVbr*t!3RB*H27W*wU0q*c+HNHCh=SP3C^(? z8CnMXMT!~k^+(!-A9BSn(l~@3H~u1$pTq!yl7Jyb(ek@7?o3-4P4gHDI4!7gG@W2@ zhli4alE%`o&M=-U;3hMr>wKQU7d(_Olr$FOYQwlmz%Ik3Ba(54FqAYFoGbV+b3CouskEWqCyeY%wUQoG^(Q^`t127VsRn zNRc%x=bZLva<~vg3%J*yS`RaL)I%|3lK7S}%T14QTO{Lzja6oJX%z4+gKC$aFDrJ} zi5r`wD#eD&TmhdjC^P+d!9z(wNn@Ep1|Up71bowQX^qr4uCq(Mw=ZX*lhFaz)&0Z$s#QeiwLN#k7SV~ptYW->#oNf~33 zSO%4@g5{EcUcK8yJA%}o6GPzEtfLOY#3seG*G^kDiXPfryXk^gS zD6a23$Qq3_17fG_8GHNLodRaC_<(c2^E|^j+&W3l{VzB><*v@OS=>z<@zp+V58c7! z?iI$m&dvP{-e`R9W@&@xJ(Q^bgsIWZV!b3|y_-V}4);)54AvQg-W+MrxbwJPpFvgp z5}l^7P6-7ysgo3j1>|``qp4eC3xmr%)EWlw@=!etZuL+*81(GaD4^I25(V^3*C?Qv z5LDt9Ii5AStxV$YW6f-3{Q5{;2mywc0e=z6m(Y!IUBGJ2JBQsJDT<&bVAybJ7g>_V z(xt@|X%cXyL3Ika#-N%6eA%En1(eZ}W}xgvGCFESqI8$(wI5@b+3XMRV_o2fkp_y}U!_Lg z7r0jWk#_c6m4 z4C7@23S$hgnZns?^7}Kngh~85AL5+nIUVNUq23^#;tE2B(^TjF{Ouu?B`A?Sj2=`{ z8NUK1!-!|VuZ862GXTp8DB%xg^4nK0Sf#9_v3Qpm-X?rk8`KgJ2VC+;njvG?#$Aj8b%R zvx||S+sojy9_lcIFL|h!8C+u&Z4}UJpbi1=Vk#w5Zk{kjJ0hzcHx@UF0-Oe%{GC$k ztp<1h@O=zRXhSy~&M1@kO}dP8ME!(&i72p^8K6saF(_TbbruRZ(imW=fYS_Wp@5=9 z0#QiBOZ_nv2)M&&)G46HSnA6(k^9}kSn5T_mKYv>^KN0+=zEm6y6DMO$b9w z`vkOk&x^u)p6DfMEWIxBE~bwLSZOre8%SWdXMpfNX83XxR@nFwNWo_po`SS z?7V~xmt{gFX?(kwC4)rLkF|d@znCQ+HoCOG!r&&e-IwsXDBo}~Z|3zF)KUR=FbebU zks_>%g%OUkO%lr((+ukc0`?kIn{aOA2%Es>q4X}{qK6-0B=K8g9#VTqbh z?q(W2It8pYs73+3F|JcU3GK9S;{w&DX*%V}d7FpoVDK&v#bz;y-=rO!BTa*iMya;6 z4DDO`E@^?ib9a_YLww!E96UxKZ*H zbF4F57Dh5&IE@*uHH_nqN5WXRsdW+yIms#ErZCG~P6=o1z<}QzNlYuxG+gJ#ctu`` zB3jfC66&R@!c6tK`5Ziz%-$7l+<5;!Fv+t3TR85yHg~d zG7{$sXiH4|w^1SnvkL)jiA_f0Nh7gIKwDzsKcWg7M)L&hH>f32K?yzQFbL!uF6NDH z>6r+Xk&N4z-X!r`Wqvdp%{MlZ#>bnc0@^m3AGaTfDiZxM6A`eV^RPOPtV+V;S+3!- zKtRt%t&xmdMI%Z5HVSh_52t#FkUMcDJQ5b(4#y`=D0gBedUou){1U4<|0t)}EfL)Bch9u72DR-g| z78L^8s?FUgs>v`7LIG{n{-UTM%8+VJQB-S+rdpFxt;|@hNkCh*#KX%>(@y49iYbP7 zyI8`TLnYjG$_!&OQ_V4qTO%3A?K;fQ2^+@q1@xMJK`-Zu`S4s$WQltL#Y86YcN)o% zXkrBx&pJzlv1gr+v14Wei)Wp-NXBiVk)(c&8#!Ycr|3?*81zihD2zQ*NIBsf@ur^; zc#P*pGM+1prJp3QV2@k!D@FGDZ<91;z{T!o$FqUqUz&36qD|cR1 zI;2%)Ii(5Z&eNmA_&Wps{v=C5&+V6r5}vrFBF@*FS9f$ZY7BNG|a!~>I8etuW z8GOk@iF|J+(;>Vh^>C{BY-8g5odSFBBP|q`lAa6eO_+7~dd_s}18D1YBrPodQaW;pIMYduAE=mW97}srC_Z z)0nqH8Ws%r{Yo1DQKL|YfSy9}Up-sN#pSKzVb1+!+e4Fw?G(gg><+2UN@p@DF(Tn` zDT5{&RKQ%W&ACm5q%?*k0c}Q!Plcp3RvQA^jQ*mjkj-e`$FPx^4cUwmADg5;m=FnQ zGfI5ZO-f^JETGNk`h=@ClG_^d8UckNo_xmhZ^_R$T+G{u%M7Zmi$Uo^*x}4&kM^QM z!c!lqC;UvnwMJH_$nu84&PZ7aKf|127@H3atTCt#k(K53?nqf3Om7l@jF1ee44!Wb zC^o_JSY+*Ba-fn}Y^D+4F5)HbB(Sa)@zU0q@e3&8_54dTkS05~S=o(7@A(4S?B|=8 zXKeO~_XpvL{ve>u{`#ow6YnKiMtk$2FVDYQ#WJ3Mw@O1uZ4!8XCw)ltrul|&-o^3> zC-4(Sr$zzABk&+XK=A}BDR8lI7_;l^=^1yzel|U2N3M~3! zXcExVGwvcs^lV}IdLAoxVr5Kyx|qN*W?3o50?TZ}*u3x~0h9Xh+?{gws3BY;;9~|gSHQcB21`V#!yZbM zku;W4(mELA1?)9k+J*7+9!eNW8jJBXCO{Y!aEIa28p$~B{8xKO~bp)$W%YBAi_26wjc&0U6Wq4-3fK{axnOyX~mL!5J% zQ_R5x6m{{gOC;mCGn(1VP&7c4kye-Pe-4kY#dWP%6=nf?(I9u#j0K^9qJbvle3SSM zA{m~M;r%hTg%@OST|@@@l8Esd zav>9$#P5Ll5nRN9&!I@%&=@Htu7^byiR(C#MdJEHWRbYd99bl8>qQoc+b&{#DT)Xq zU>)b3!|G>~DKhsy26uQU0e3Mk$elUmnneH}dX`>^W;Jmokap@g&1jttnEq zrf8})nKi;=MztmZZPl7~MpG^E4Hhvtf}4QSZs=@lSh!b#g;Ig7Mz4ip#eE)%A(Oqli7PB8wbt`AlXFV9~^H4Hx^BS&G#7jR!L8do}U;GQ4Biw?{{kc02an1ToWjjtX zINZ2NhX|JXtD=!A#P!pDR$+is1iF(9p7Brut~ENvb%Z1)9mzV=>|gX-Y2gGGvtdP$ z!-7rXx0|ez#R$Xb%hmM5XAvOGOom~_fS;pG;e{g>4}M+=JVy}oNS!g~jpP#7a;G9% z`v&3CW*p!K0i~+2o4=AVr(e^U5{)fj8KY?Q_&6Ul{IBwYg4D-apxaeTd{^FMMCXC4 z%Vw1LuDq1STvtGwQR2IhQX1i1K$}tG`;EC=pO5{v!4zg7YMjGfe%Q!v6tK|*mAC5U9N>Y-$Gd&xt+%-|~?iXoHuBeP^gaoW2K zmo@=KChaQ;EJ87p5>N(QA`=0U`V|mouQrB{JCzDEFPT=**e9@P1#JWrt%ywEkw#jZ zC?=_2L6IiDNo)jO$%PQ<1r(`RzX&KoK_#GAD1lXu$bXb&sn;#!MnqsTCSbo!CpR)( z0G)uI2^zVCN&F^|j5-ET5dmj2N)K#uCmca2pm^}PjesHs8$tq#3>|jlPQ;wU&XF+0 zF1CQejd(Zhlsk`i+;x4VrRGKBJueFHxElbGyqlx(ZjQpcS;|TpzlG;V<2^qL@3>nE zB2yS*fE7?IO!mG$3h%gk55l{e0gSl<+PoJ;;T`ww!CdAk%EFmNoTPp;Miz;?c@$YB zu9HO;iR(L&MdG?dWRbWn9a$u9144zD%(h30lJp zdh?OELlN_{4wEwP&v=a6A{n_t)8QkZgo@MZ`hw5igmWecC^0F{wmWN9-7<|w}?PbvVDr;_%u8Dlt9=y0} zCh@nsRCs_Xbi2!)WAuz4ikMU^ry0qeXS}$KI+)Q~PBkOB^Xwa!(Jp4NZwMo~JIvSw zqU->Zo*KeP?z~ottI;dmWZQ$<+DXor4}T%<+gJWlLFdaYaSI*wi3&J%=UgVCE*mK* z{;#6_Ww6^7zmV*V$d_WZU&zm(+t{QD>HHQOM?R{WKtw<3E25iDbdhfWgOPw`tPp10 z0?LoxLDkH;p4yuOaob09kV1*MkH1tx?sJB#D;31@Mrt9_gU+V)aaGRbdQRb#7Bd2S zzg#bf%V!stzmX#xDzWPea?`=c1b%V0l}S%>nwSZrl-e7=-@f3JmB3PAB#&raoF=AT zlu`+(x6mgmftiquBAE;zcFMdV*Nh+Mvf=14nmdIV*o+c?4LHMS)FhzCyEP{Y@Awa{ zhI1)lM83-?lenYYOU@sY96W#I_zTV-<<1}PIDsU$eoT7$mFb^^frGhD@cgV1IN5dz zfWJvkPj{STLx7tUm`Z11^HUgxMll}>n z44)1KMyG@`zg{_^0O<3Qoxpek&M#(Q#D#9b7@}F2ena{KaD%gCokt|2K$}Ux=wyeI zG52nC6)ld0|I$VmncFH+^|7o@GO06j!qpQTXI!!pK7I@oRTTx>%=4gR{TNcS47U?3 z#k|^3;fbW8SDy<=3-30I^!9EqOyjDL!q9tBv1NyBt?gGUCs0<7Z8NRpBoLrplzXvX z8C4fjX0lNxnXEd+NLRO)ut0V5304J-dZ}g8WU^_lXQQhpP?JsNCQ~Kzl%0}w>t1Hr z39P0OtNG*6IEvBb9;5m(n$>jZqz$B)T_I{v#qzys>q-}lh3{R8iWPc{bWTwe8;}Kx zJwokmB_xmhVMZF8uhcY=(x8ki|CP#2QlNYcnq(%}Tp5KuS@e_Xs!z<+jlr#Tl?yE$ z=Wiy#jlkTwn)*h1`rp8C;ZLADRCv`AD^#XKS`}P(1gTb?uH4>nYKoQX)=p>7@O<BBq=yq z{Y_DShpE3I^*7Z?8Fmds&=sgxI)&U}do;ocUa2s{LLovV?|cJ)-Bb^b0DIp?rpERX zvDP#>DeXPL=^qLrZU++?_O1Do)-G0;6SGN*@fg557iDRhs{ zdMirS7j;%&l&sBKRIW4TOGA`U;+?Uio*Qz>eB+8hFs_TJ(#r4`p&Vh&?Ni}jHO5aJ z1=AqlJ`+-KI|$upM>=UY0~mHY6{g&+UaM|R+YD?van#bj?(PAJ7KEOoFH{&ULvT_X z$(l$YT}f>}L0fsZ?ek%7>z0)9ZkG(rT{1Lx>CoJzLvuSQ_k!RyauUexpj_ONX1ML- z+jc{U^$GR zfSP`8fPI79W+(x>VX(U|A`8xeX^3vFcP-~28;qmYbJ9KqF#SP5rU_fn!rX+f4{gHN zsR=z}{eg15+kwCI_99X!=?!9Ifu4XjhYE;xn{c@?zepiz`ht0bC)^c|56S&^C?$~8 z1QE!-NF*6QlCZ~(g2Wa}Bqdh(V_qMkW>erxp0fnDK&0Qn2-(MQ>B)rvApt~zH6REmcR^86qkx1YK)5L?Y$hZDBDtA_ ztDqR}-T+0#6%`c~6igaL`?_di8!A5U^Pny5{s+ zfE~*i=!}d2v!VsI|FPW*X6r~L2(NUoWrMdi^(AdXe*3|CrM_e>WW32aTKmqiKsm<( zw`(mZH+kRzUA}X`Nq~j_P%OfD@FHTg6ixXAiVkoUR%Zs5B^*GU# zK15W#r_gr(t~q7wL4~HnALE)6>s@9<;F{CxUFaz=B7mxDs)^lDE!3gkt!mn+C}X(1kCT#mPy&ZXoW=%X)1R1faniQK-sG1}5kO+iF?dj6QgS79AdZ9bFV7Vlm%($gWV}hhCF##io#~v|E3GHU#&>mW$s#NxIWr+H}*cp+*#RMs@7o)FBad8DYN-|aE-PYmz=Z`NcJ-j zx7+%|I(z&dO+>NBH{Ey9DVK|xp#EqqDI>`$&5e{buu~flnY+#PGpCI^VxPIq(}G8Y zK<|4Z;Ypjq`EJas4d)jbr5~;@GJQZd+k4_Q!Gt0F4>yETAMZ+5x7CT#r=sggmWx$ zhr_t<$T$e&L?;_dEAp^$)+Sf8GZ6l!-=?g5&o9gIKz}ZO9c(03Vn1!X4Etvt#bBzc z&v0-PN?SD*Ev=fEnp%}5}z*+0qkP{oCu=|S2BY?`3&i;vhQ$%7cQUJw7n zTSKX>l1lARMn!yERtlQ?Xx$B%aSL_>vE?`3l-xKPw%B`V>}~M&A-?>~T_w%5p=tu& zC}8<5w&k}NZ#Hzxw0$F1hu&ky1~`S=6tPO70;srNRK@k88i2kO!f9T=_+AcSOotIA z7Mv4)%?vQRm<`;1#hCNAUp4P>^fB7cn}(1v0nwEHp5TBOe=qo52<`=cG>=#0Euil2 z7em?Vz=mO0u^OU-PrE(oJ75vKiTOFK(pbHQPFKn$n|ePT^H{@>4wh*<=XHYXq+I|<>(Kzt$oZa#e-oTMae^`Ad)fq(5r6wElNo>e zY?C2>d!ifbspq)XQ&;EU8N)>;&%NE%8!tB7CA_^#Z6CZSX8+2C&{*L3X{2AdA2-GJ zF1tO$?&n*rrp;`lp3i%2+_Rg0GpTWL?#kb;R@>*9vhnv%a8e7Es>2 z%!h1;A8{e5m9+=lDygKK`IvSbd<+b&o_HF3nn#%VoWLJwI=%!}O^fOvV1$buu<1H< z>wsd`Eyk2}JcI&|hfwNq5dLy|95gpE>fA2YQT)+RQ5wSiNCF09eEl%Ywrjj5-LCyT zv6DJuLaTF3i-$9)25HM74q`dPK`aLiO*trN%0V;CuVS`r;vkldf+6^}P&|XHQKb#8 z6aPdBZ^Flz=R$?%iPF9%U&WZmV*-1tj!&2LZLFQ3w$FDU&SWJ%-rsM7kM&cGsrGKu zhD1F6m-ff!e~g(R$DCtcaew0T`}vQ(+x@lc^GoKp+Sh#sdY!aldJ8m$v;Ddv6J4Nn zPF#<5m%w||0awT}Jr4nM57_b{ctSqxBZAn83Kp!g0vwG8*TI;i0%HxGU3r4L`rt)) z3Uj7H*SLNs)4OnGk2S-nF}Mqj7{&kWRG4QwJEG5Ids>|8u={njShuqSHdA!i+)Q7N z_X%2!I_|wmy&n+NB@AixERzcz4Hkqk2y;p~x~M4NSOHWj-h^nk#r*w(2`Wk(xoo6R zC19+p*cN>CRNs$xe){2C3E6WuNJ zFnwm?xrQpS?{09cw*Kvw9XQ=$#lF_NqYm5&He_f6LB*eSE29M!n!SrY-0#bvh#W7F!V3;tkq1<*_oWswQY~Y zvPkO!Yx}NOsK`wIpgV-7*k?-UxuG)qOv$9D!@FK*fuPxWuu8^E;1W7F+kCu<_wL57 z$%>gQbWXxuxa{z6LeEfb;0)uWej7PM`MlmgMC~6E{v$X&+@xmUiNeFex5c!9JmvFe zhBwFT&ow^o`}}a#W=5zsVYh9Yn9#+n;Lo&=BIZzq|@ zCJjJGfjSXVqz1& z;AEb!z>Lq4vCVd@eIkI>>`%)@VI!$>9$)=3PF&52n>le0Cm!X*vz&Mt5`#-b1$R27 zE7;|wsf$|dHg!=ad!NAWqgWC?*^BL>279qx)G1zU7j>#S{xmPPi#pAV?V@tL>%q_b z^PO(=eiwCyhn@r5`%RX@L(K8L-IZV3?Og9BI3Aj>@z(GN51TJ+ns^j0@M3$kVJ3H7 zny&6lW6j^r_b`N+G79H;IiU0R4film%5BVzt1R8wK?%imcD5VCJ-V~PZgs5bLV56H9w=cs$7zk5hipD= zcZ{9nc%#)FBOb3Jkejg(U;eSVR{JwlmS&HrQ;f4p!%a2p>+TckfxJgsYNjEX) zXQ&c0^_>p;Orjkpx^SW|CkAsOmlOD#Xy&LWBnHB0vjRR%Y?;G}#gI6D6|8tsRSQJ} zW7L<8Ygh?PyBk)$ zFfZYkOp~Drzn4rju#1_Bo3%=6B2Jnlwba|cC={l>+J4#(%7j=1E z)$vEG%k8Evx4XLB9_DzzUp>ZLZqv&@$3H9}w zZxyw@U)%0y?3pGMz9GWp8#8i)2nTP^M*gpEC4Zq8UelV-hPPPoN^C~#;EpG0Y?D}& zpr^&xI`nNN_KxKKEAf^qbovFX{uE3@%f9V$?V)2*V*hS3?c zsBX~0Obi{si5yN8aAG1SN;y%(iTRvZ4hhxb%@YgV*vHw%j%^+qJGOaf?AYd^u{XuC zHGY>fE;+W#7?&Iy%f=_i#iDyhV`JOIrsx3*oFum5swF z6gOO}Nk_HhM0-ed!??mr1|-7IB-^pte<98|gS(!rtLpgIR1DdjoCDeM-S~ACL*6iYf57mjvFG22?=gCK zM!w}@ysYrwlj+VI`(Y>iK{5^~;6@xHwiDi$jJN5&f4^m{`P+X>#zC^b{kDo&?_yS-~^aHoW5uZkqP#jZ}#ZfNO*v^#XePoifFnyx3>n*>a|IT1dc#2K9Ez=`gVFgN7`AdyvWqOD^VxGLz#3n6&Ihd;jmOiEl2V!QmyQ{XB^bG;%Zw#&cLZ2JvhbxLf5x+*1hNT9b@ zne*EQ@h87Q=pg{k?QnN*9vIToaPVo>cEz2H6IkJLYvnG2-;sm#=l?N_Fnnz89=rdDivx;en6%S~8|Kh;VPr|op}<#q{{Bx*$m{w>6{qJiE}tn#)%6!v49gRAkht51}|9c;eVyr zzUsf(Qk=o+xMm2_hq7e%i$S4*u?iJ(sBAM>saU+oT-`px|vIv7+g1+>xj^wHF>$GnA8~6DA9N zYLfQ*^JCGPlQt6$ZicT5+9Bm(a_aFgG4gPD4y zGrVk`?om*9**uN6N9;0B;%)ksFotTIe$^bnX$-M8{hE2QZqvKXBS0Gn-ZXlfe#1Np zwCO!UWBD0&$G^-04!vzT$FvX1-<(uGA9GSMoZIuwNyU8F!!I;xy1F~fAd8N^(~KYO z5gX0e(WdV*<3^jl+ZauhX}Z#T&A89<`^>0{&i0lJuy2U~`!^9_-xdM( z9T8yvE&}YkDgN2^iU9kbN&9gJf5ego%d1q}vD-~gg|11(@6X^$z3+Kb)S*LvkH{on2H|i$FQr+x&7@mrV4CK%Y;g@OHceF zA}-1hd!E>6E|H^3-7`ijgkj=a? z7nuJ9hVBY5WJ|%AOHdFA4BhjKhK4w3#h8mJQKy^yc0ehX(L<@JpzC|H`F=o8e1wZj z_~}&pJsy0NoB1C<#_fiW#(9~8_PTqm&1vvac_uz4AL8IM@(c$bkPm713s1-6ABs0U zFUP0jO()8R(+o3D$mav*1xM)NgWv5yrdoA`RVZ4}5upBUp<1mvk z9ES~Y@OEX0^C_$|oP)Ry<6X)S2X9d_@%AJ$=GFv8Ao>+rd_>v|0uV1S(n-pJF@kxz zqF?7kvF_sGnWq{O;PjiBEdq6-Z$bo~E_P%gp8);lL+J74FI|*Ai=9{e#d6Sx*q6cZ zkfJaboSnbN($HVe31T%(bD`$-D*6H}7|>tY!PD6vyy4e-{aH@^l_z^O_TC*;6TFpu zk1}7{!G!tR4klp0*{PeTc0D_e-4zac%?CIGmS$uZ9 zTseg%wJ{=j|3acfw&a}+$)p+k>^$i<`$CiXQYemC+v4=61JMEIEsjE9=1QA)u`;|t z7w^tt+%(G|SSM9tNQIu=F;UbcFpio;Oel?U0(dYFF*X@ryu&3_ZXSXU$A{oKP8!a* z`5-LPDI(oYq!)^`c+O?5|L^*LOW=P?;D1XXxCBP$jvklYy+?LQMRC=%>{(^Cb>-Dn z+5P(W?%TUxcK3>kS(UwNYOBvLE2+;OFrZ)mK_yd9=-aof{|P7b9aPe<-|Cg4NZzQG%4QD zBsMf@%FObL(jqcf1Q|GfK(ASYik+ENb>-8l%1X1#tLmMRXAB!UzF=I@$ifjt!-tJ3 zDjYjvBS@`^B7f?1;i)BZu}ozOTb2QCV74Kewi=sNOG$5-3)uq8jQw zrf}-Y=b?-bEUT@pt}QAqEp@Qurk78f4#&)Prj}QfIo3jXRauj|vZlPKq`GFVQ|DAU zHO@>p=J)}^8tz9Z50L31JbMhNEh{c9no?c`UJ=7fDr<_+khuV5v8ZxpMG>5;=>Tx2 zqSCU`nI&aKHMQlHWpx32W);_$6_w4Ysjey$c@#&N)W&4JXj)l4WGED$8i2 z4#YK3lI2y?oRa!E4m3BXqO8gps4O=!_lZjD__W=d5z)tf>wk zHNCiQdQo|4OzumntLn?<_*uX+l}s-ynSqx&YerdYv6WY;+*UxYn(SfqOe?Fhg%m^U zW=@GIQB=Z(WA@oo5Y^2tu89S3oUWZ|CH@uQL8axh;%t{!0jrMHLD9w8np#`t`wL$B ztm2At2scpC#kIwiu@&9453A8HCoaMAI#XoMl#22ytfZoTqCL>rjQ>%-n)>c=VrtYh0kErHS6OJLCec*kz^(Ji z7G8>eE-$PU@+2w=tku;Q*Vg-017v0m)|t%mRLDZz^d?eMQCvT@y0)@tURiCmj1eXE zMNsZ#P<1m(>iQMU>Nl`xW)-&=&MDT6R+W~O)XuGetE?_9bE?si%d2W;);rZR>-~?S z%HlaixNpkLsZLSR>0`&9eooQ25$6so8h=jVu%aRd!l2&*ATO0=mEa;x*{&|PMU9_R z<`z}@g-lthL!YUugSa;h?35N2S4?xTm7`hwbYMr5HFXTckMgO|yr)g=SCl9+#I$uh zw!E^YS_Cjew$#e1s4Q$ZjAa#9UaYB_fd^p(dRf_)RTaqyi!8?35l}FmIYld*cG$4Pmx{;K%!B|^5|b^A=CX~T4E}@X zR~MJn6mj){H-OXD&4@Wx=$hOtSX+)U2l$&nhb# z1x*h=3hl=j`!Uph45KaD3Eg#7QDu2u9eON8WJ=Xs(3CW$pi9TzW#$wo*BR~4?o1KX*<2!RqKU>35XcuHA? zUEBPliP+_9X6ll@Vs*6e?KPF+0DXuUb zeD&0+I7q02O{cQFs>s->teb)ZnDVI@p^EBZbOz@#7BSYDt_2d%)z!^}!{AEc9-<6( zfDxmDqwpLU&g-B^VO(Q+1*dvSU0Llcr8GxaXDP*&Y-~9MuqQXYIrI@Q)L<7ScZU8O zU9Y6PW_nqz*@>Z~Zf2#EkNKZcU03Ef|4(j%GU&D|Y2H{TY5wn$+NU3B9y*zaP_SC#*xKm{yQbrQ zSfU|ZrFV?R=vw?CT}DM>6B{&RNw@YsMl zL|sp;J6Q0ynoyU>C-C~llMa7L=hvj`sPlnc%8rxedZ6b{Ytr@twW?Y)4bw3F+c6_f?>he&4YXbkINz5&P4gX9@@2u z0ALTa6{IbMw9fl-+J~>E{#v=Btu3TaR1UjopJ{u)p&Y{Kr?BAbQ!-y2U^AQcnYP^& zhiuz1*H8P+pSnzRE{bYstAezg=WL8=rjmp3sweNVd{$YX<9he+J+Sxjed^}c)mB&6_nBE&+lNf` zDK4%pnGO?HaPK&CPA@!ik{Kub4{}KpYX61YInETgN10jKdped}WvTrvuBgCyr8?LG z_kx}lrtQG@&8(4CVDF3Fa&1*{MH8`!rklE%_2sk=ZYW_KP*q=457RXAI4~Ns&su;X zhE3Gfm%^n&8XOcmcuSpd*h!_327i!jmy_hRNelIC>kW$JdD(ehZiCk*lK-D?rA97_ zxc6L~7xui&hJyyt!=xnd*fcjS)FsKwfL!)J;2jI+HOa_`h`Z{dJlJr*N`hUGmzaGk z?Y;wv_FZZBeQoyT#U6LXMGa{48`{@1GSX{>r;ZGdxR=9mts?GsNpL+YAl)jF-3I1~e1RI2+{s1Z_)@R_p7>zn6wfz!jeyuJ;;oQy1vxa*-D4vV<^uza8LU71tv z6$_xU{}sy1$9!G7Ak;kxbM|8>FO(gZv7b%GQZ9s&pO5)k=H@}F5k4FL(` zKPpJC?P%{5$Xcg7FTcTS3l)%X3+g%IJ~Q7B0ulF32ni68BJPW>sr!fKA4m`ic0&%m zw8Nk!v~BP__xwCa9cC)St;-9A0&xae$K8Ozw zU)bQj5N?D#Ukba8CQ<Kj)A^4<{^vo) zBksrH#zoMS7Z-Rf7ejs;;Tl$6*obxTT^KU$uDCE|A0B&)2eIVcc`5af%7X;hhBJAP zuRQ=0w9M-~>>^T5gHvLW%pUnmPbM(0$r7+3}9YbC1DuZ-H~ej%Pfm5NP(1OA_SZ zWynFVH22To4-xkh=;B(q*Cs(6%JcgD@>Qdktq(V>zy^{E{@LiRgVRBw{@`I}-pZ|k zvwGm?;BBekPnXYYkmD22eKy>XG89}Cb9(8#yij^v3;$~bJ;LoC>Ir85J*UBKNKP4? z2Pxy?S0*@S*eg|dlMV2gDiW%x|yN5=1kJa9n+yITv{mjX0I%4UPrbEC> zXG0$uaUV>9jyTfbzBJoh$s;Ln36Q(L%(ji?{$vbHdvJ)b7(4=sy8)X&wNz}N$fol{UPjr_g0=b$ zlm!f0u1bMC=0g$AK9Hcz{FIX9b;Wo(6l&`0SrFyiD^hWs`SmQgd`LGUh2dOkgEwR( zTs#&^zSn9b7T3q1NsqW|;eZw+y~AN&mpu2wSx|W3VmGD2Veij60Es;K%=6N~?Z8T_ zC1Bxz`_8O{9nFqZbmuLz&=Zqk3<0KFjfBDmqwZa>0soRC1>W!Af_BepK%4ibLZ)H! zRX7D4aW9GrJa4hr3Oa?C;QSBT!#YPsc_%>@d*pd1fl*LF5QcoFfs1bgQ&3cogVIZR z0A0J~Xs>xL5HJb@v*)lKJci})XSf2m^2S*W3Eci!C`>Oc)cuHvyLonlyA!++#!x*9 zppek=k#RC8Q@AYp|GGmJe-!7An-m52SAf)6Dr^W0N+{SWfgcsp5O)o z?hn@sZR0~6Ps2?F_@4 z6Gk!lUVAuG2k@K2ABPM!K=KkWi$d@NJOo6Gj3^65`6hgNcq8bW%=5a!AQz+_c-`Nj zrXbXAfQ!gl2sc??r+m1Y1`ozWr<>;KMTTSk|6bpK&3YpomTvDHu<7PS#zx$i!9?qb z`)IQRHm2vf&x05W^oeFL!iSLXOg%W>Q*b2MdAdGPNA-F$Q@6dR-{z2rNa6Jrf$eu25;l3EktMnm(=rD-aU?(G1+=KRW-->E`?ezjXcwnkRYb zY2Yay4C&%K@Vg;<;Nz`Axp3<3byyNx)3H>x*FouHI`RZ|0?=@?AWSX7^^hg({dn0A zfDpXvRX7Sn>AAS>2pyl-39h$?xr2dmCfp{@g?nCbq+9Du)7a1)qVm!1){C)iV5@Q5 z^2rmh49xXjm(N%soa1*Q8P+!&`l z;+&Fh-2r+Vw18I7Z$P!UKi3*di<%pE`l%KqE^a^% z`4j9qF5)hMEu4=4@}m_m!~IaDtss11r}v%3t6}~Dis%cwbp?n{Txy!~iC_Sa#|vx* znb`+t0e`-xIRvzSf*K0++U5;j4~XY>ZV0Z}iyZXQu=RQ^$Cy6rT@XTP+}0cnyi*H< zr(59!aJs+OHYTX)XN)6!4Q3MUeXE7>gLJ%`qhNpi1?FPEXaNNPksG53_{edPZFd6H zT{joI$-{`Y6sH&r_#OaU-W4rj47ADIDuHDzp1el)OV|gs^?eJt-enh{ z3qT87(Gs@4t7(Ahcdu=Um5*NWNlhah=UxwX5gZHA2R(JyRD)2VE=QlAF}-@>`xm} zke@$%l$T+;Kri3xv%vEp66eDx@+pu(Aw2_D(;g{++bPh%q@HnKoEdra0uyOoY5^sF zgnKruZP5DL1&PKb_qD`e;~Kwez)sFfhecgRDAUj7a@}Jj^x8m^ z{}R?vg-`|Ho!>&8*pRp!0F>c(EscAxs4>0Q4^Ts`M??M^^01fWXwedSAXD&PR~x@x zl>zN}h35_Pnt`~$>yhhqDS$$U(#>=KQ4PL)V+M>Wwt<_?%PaJ}rM5qW2I{zbzywTP z-IIa&!4{V?(@P&|W@frHK&MpTwa$gMlLu|ggrXy1d4}oDQtC!&_N$@rJ1%!mVs~ZzcseGD|R!Ls#G`Bg9n)g+i9`>eI;11MS-v{)&hOJ6ge2rkw1x8iQrE z3F{1o7|me3yAuSk^#}-{H2zYBKJGr;%Jw8LR2f%)6n2^;!GW4JKE9;jaW83Us7u_y z>OIIBdmVPvPr{Vy@{9c|f~I6k?@+5m?so~yDzr)a&hxfsv!09OQ1TKp(Jkf_i4(bAN!MYwd2W zG&ig0M1RV}J3;qtIOU*-`v%PL)1h}?oCll6(RNwQTUPU?uel2}Z(7YORoCK0)Ph}1dbyI80)u)EQcTf167#CfhdypFouhkVCpLv>cV*N zKJevK_v%!bB7{yfe`^GXuzj#Yh0Dr=kyTpWlUvQq-N=Z0b%hzly`0q$3H6MXLHj=7 zUJIp_2{)uIu_}xgLm;TZ?hyLo?byA$_eJPTaKWD~z`mPwtEH9YKD z0WJ?s>PLtvsqPXN3KO#UB)Z*~Ga3>Ef`iZsytJob9A9b1%a>$9k&J-i9RUM(Gp>Xu zkcpSssrbC|tDp7WoxmL@Ph;m{!}H_#6^0kY@%3qlM#b@Z!^IcINO88|W8(BD89pwK zcQkx_9Cr+dA6!$*2PU5r6@}-}Mo$mY#oo&erw6`*KWKRTm!Os!-c~4WvfOZd;vKsb z7=A=7gsnb?@LSDXBZFF2B7 zli}vggP3C$8h%U+!;KQd@ePdFc2U9DmO6%s76t;aPEfZUnxUXx>1x zyZHU52#IP z+dJ-Zo%r@{dA$EyZY~a!F^lWOmoo}n`@PK=t>y9MY#^7wdV zd3?OGJU(7o9v`nPkB?WDXX8iQ;`%?@5wp(~ej<0cPJFz={jU9~8Ywkt*EuGRA#lx` zVez|MCq6D&eSBQ9-1j$W&9y(%B9TeEPJCRlc6@)92f6+aRZ0x`kB>jrPJH~aJSXOO z-f*4x_+$0)@yGJ`_+z=>e%ZF=d2+KU?ZR8Ki5Az1A6KBxO)##oJbwIOdHndn@`?Bn zvrLA#gztUoHkYXa=REmcDO00=#a>~ssTpBA963OMgY0s7_v z`YG`0Q=Bhr^H#P6`-o>6?)Q(oi9ZMSGaXpb5~UXf@y;mI z8Opfn-SgLBf1><ZmGb6gk=TzPp17- zO=f$!S;HTyFnWJnVcvy@ef^-mGT{&P@dAgNWtlmzKknK^e73Ozl}XDU`kVvTmFf87 zAMW8^0uz~{UpDVs!!d=1cV{zBlu}71KmK^WkofcPnJN0aNyPtQ>MNVJ;Cm00wNmh( zOvfM3n0M$wHPf8eA6J<7%7K4puD5fO9rJEHY~5`1{(Vq7m2)S*rjbxblb^m#oJSZJ0LgUxaRT!%O}%ibJC1p; z8??E`&Y4Yi%zM+YRb%dc2jA<>*ti#JQ~33130%cZD+I4FQqhoa803pvEaFsMlSVH!KHpq z0ACfrHwN&&g3qKhe#r8Xe0qSM^M?7C`t+qfWKW0Pi`0__49~ z`n3W2O@d4PR>7tHT>*Sw0LRz=anaWmH8h?FUDv_@{i*=IK7j8K{8CEe$6iWfJ|#aG zz%#^kN&QgbSnra{b}h>@s2xob=au@306sr}uNPd#HyM84zCxS>kiG`FSxAt?Sf1F+k(##`8g!`LcwL+me@PM6zEYeQ$6dIfec6xf7W_ghG3&PjIDhvN?MOY32a&H8b~0SMq5Z!d zaqa)5#L>SZ}_yF)I^VZ6}CoL6vp-gbh^a>x$g-2-^v z06r*y=LGQF050Q+%;&@aeKdei58yQcd?9h{zvOwdgvnY)p*_76P)iZz(7F_xpp9}3se_JE;(%)qNBJ;CL=p}DQT(`Rp z#C5yN5q4y~LO5?{?!R2-F_3G=|LwbE(?Vx;d!E&B! zlV;7&i;zqIe~Zvdf8ct@@{#_qU+Cqy>!9GWzT|y`5TG9%z@>jmJCjJS{jHR^_O}hfzAXRkf-j;n#E-WHZxH+&!KFT3 zj31;vNAP*V4&UcuIZH0bKhi$`#suo6efUEbW_9XHo#K z7o1}YTE1Lxd0u=Tfs3x+t%6HE|3(DrWj?fL*Y-8123U8esrO0qn%1hvqAjDXp(7s9xrf9_`3>#IXputgrO}_BRsO<#tHem)F}4?Bas<<@I(KT(%dq z%X-;f<_OMZg1WTrj*Exc z#IZa|D2*QrDUIbR%Xx#~(vbzOWdn3ctp zADvIW7M;)Sq}S!MUvODI^19e2O4*WxpSKHf zect)R@p@&u=5j+`K^pv66`)@yxYX|i$LY!G@G2V^^y zaX`jr*^lfKc4U8XD1giURO-8gZ04}sWd9<^=eZ*P6+$oL!yLio_1-VI)bAAhR$*Vx zLrTBeFZ5G{z8$48|I)7}3O-ior9YGjzCq|E4{Bd;3%$(eH-b+S_PbEM#Px%szNQMj zY)3M#%5j=(zueDaIY?d;V1G^kzg%$X&mAalx?N-w*X@FR2J<7^X_WNHFQYVma2rI< zY2=Slm`SZ9A?MVHh0DU^>a6x^&O`5fghcfO( zg4)q~XsES_12Udu6W8U|ow%;YQej8N)%k+UIJqW(%jYjrFXta*T$S?=rJ{U3 z751kH-ks7|p7#pQ$0C>UYQE4*zD{r%54Q<^E2Z&czu?k;98q5~zO@rvwy$i#WqgzE zSL(5zaKY=6diH;8M|W9?Sr4VOE+1KLa-MLo&`Vwzz-2j0{hRemP8WjmGn z9Rd2c1GsFb(oR^Er{uD}B=0Wt99!^|*>qmrzPMg=`;z4>=Nog#P8OW!JWAt7E~VQj zzK}SU=MqZe$11_)yeQ`x^_)g2`@hcr2C}2`zfahgb^(2|edZH|9cjN_aCu$JiF5v4ibouW**^2N!j7~r$Fb7> z4rM>=n&N8uz7E@Gz9+!`H-bz1=^}ozZ{QhtzKE|Yjn2#c1)rC>91lNivuM^mh5eO+ z%Xufs<-C)8zEdIWJRt0>68wI_*AeIZUr+g8Pn`45e1ov_sIVi);Zp?PqU_^)sJLuZ z_L<9mO_tAgVP}#xVb(i@9m(aq`WB&=^W?V)&hH6eIh-qa1?3mZL2@~Ne!I}~d&*p% zr*U}-I~bRkZy=8CQC=_4!|VKP5_V*M__v+W&P^gedxd@OYj8Jye*qWH=T)@*sj!dv zWd5bFBkP^#`Pt57(j8QGm>&{$hy44~+CMvx9?L=Iv%9b( z%dIDIUB89Gjx5ho!AnIx@qKb!@VqkrYl-W6Tt{4=S3Zx}Xib{+_5eFO1MJA>6mtB3 zNZ7&p<@q)KY9f~>^RQ<#q5X4^;Bve)UvN2|Tuz+pk^Sm&;(T7_tArg{k81^gM3hfE zN@G4{dru*b{o?ULUmU<2132az7j35^fd46g|Bm97w)2qSC)iV&bvm^d)Jr}gfZr6r zzYE~(=i2^V4?Pk?+Dm#y#z2wmV-mg<){pf6b+NwfZI0PlZvV*Q)|{$v0@tXpC`ExIS>=LhiH0(j>hiS1k%z~2;nggw-( zhaBVEk^GMVy#29>^~(bI*8#k!XJR`q1n_5iCDsq`8=|}Z%6X70DeyZ|0;l=a9m>hs{;7H1Nhkk65AOw zFfqR_fPWdl^XMiG`#V_&MOMTuM0epJ^@0gSLyt4xM%K^Om>51)J62RXI;8SQ2sjusC!AIFsnRS>3m#CL~ zWB|W5fWIBUJJaA&+rKD)e-^-xr$Hy$87=ZZKY%|Iz*A^YsO^jj;MWE4F9Y~w8fWsDij{*E&0lc0%Gi~R+0Dde5O|7pD;C~jpP}EmT3SMYO@`(Zb zmH_@q06&fzzqUU=fd46gH>1XYcE*VO&ko=p1n|-1tlG{?0lXI#iq>Bq!2cP*&!$Xk zJ3j~TJIC6K)cVomd`=PrHU{uh#wXTa8^FH^;JFhL+xbfXKk=-@`blRe<_`z(9|fmN zGzKas`gSCLK7e;UC$avL0RBz@Kk?kecCHEFp9k7zN^ECt0DmfgS4I=t`80r67bn*52;g0& zB-YOg;9CQDs3ftSNrF=oG{V~h_~!xqgi_zWw6idPKOev|%M#l;FMw|d;BN{}A;cK& zIMuf=`P=~hQ~>v;CAO0vz*h(GjOmH(tPbGY19<=P#C9GG-~-S1^%NQnxHEveGZO2I z0{G(r{IH6|cIpE7%K`k@%EWelAHY`!@a+Noy8wPnRpRqb4&bW-__G20TfwOdGAA5e z?VnfjjRCxOjjyLJ$be-5eEkK9^&bcD{tS&8kh4B&qX;6DcN-m??iFAd;-2;eUYPD2=D zxa}O@zT`y#{P6%Dv1XhQjOVGVHzZx~D5dculhUY*>T z6i*`lpyEdme^T+j#GhAuAo1ObpGf>&#fK38r{etH-XX^?wo^ z_52>}^Ma#(3F-NFoY+4{66fz1a5;RPX6=6FNl9DIO@MA z`$@E)^OGBfov?U{t{ll>zF$Nc<2`lAF#`zvU>zv9iB!A@9C zS9}?57b@*yoNaY&n9ceS)ll4;{4tz>vM>2QThVn z{C+9xx&3~o^z%vIg36Ee95;F>&iOovIQ!MLe;4WbcO*DJT>jT7{V~aK5G*$c9);~zRKIr!j`pXJ{%*lh-;VV7`?R>Q z-~NI0j|m=y{YR3X-wS2^tEAtd^hcBaHNi1IX;f}+3Xb-Bk^X(f2N3^E@xjCo3Xb;A zAp88@DVOI^(kGMua{lL$zM0^dpHZZ5D>&N!3+ay#9Q6}P-&OGv;(Y~2J4d9#3YGza zM`3#g=}!|J^l}$vs&qw6Td_84aDJ( z-6a=jPtRwwlir-KC zSjD#yKTYx7#K$YXpLn_A{Qa>y;#@BSsGKhqdcNmEQ)`v}@3g%^a4i2W)W2^OJPMrS z|7O8azku{x1V=rOi?$1n`Zq|wLvYmdxM;WFsP91WWRKve=W)?K!BIbj^!o)zJ&%jN z5ghd!Nq z;Hc;E(g49xznJuc1V=rOqlOBO`q8A%6&&?Ez8Wt$>gQ4ZCkl>w?%(lu_;KNK;CNo6 zIFGyL6UTOh{#j~{cAV=J=k~Zs@x`RKe>csxYqYb5_!~;kasCs77DJG2ma$SNpT*B zT%dT=sNuK$6|W(FgW?N`|50)F+vgSM`}ci{vp@f=_+GMq1hr$nu5XC<6MQf+{5Xv` z*9*tHe8I7tyJgseMhhMV#C~|5;HY0n`Xa$mzmnR;48c+VSJGDtj(Yyy(}jYg{>WCa zg5_etqp*Dq*}qJ1)R&QdrQoP%Ke<71_LF;vV|ik^-4Fk9*)H^G{}ZzRw$k@BYRCCX zajt_1wQsgxK>GHIPa@t|@e1NY6<-WPg$#lY^MWk;O9QFKnm;Nj`>fa>&Uj#?}9O{SO5FGU#Tf+*Lw*-&E_C=)s zSn*oo2Nka;o=p7%m%}XLS%TwvOX$3Z36AGoM*5=!NBv!-=l-q9K9$>XLXUQMe0vgc zuHRjJUo7G1ifm-%On2 z2lE}oPf_~4#3w86Q2j1Yoabj&E6&f??pK_jzr3tC|1Q!Oir3S5U21=v|MkRAP@I2n zB46=sq%T#RpIgjPd@t!QSA0M5^@@K(e6!-yDNgQF{Bq)LsQq!f`;d5N#lIzfqTz{KK?@0U_#rqMzQ}Ln18x@~G{0+s+i62m$=h?H`*nIJIT|xRjiu3cAeBxNYL+qhu zeU8%e{dt+-7*CEn%pO!OcoY!#7ju<;YW~ipLXURllAWs+e~S1W%1#%1TBlL*p~PQO zd?NAp73Xp6w~EgveHz6}E}vDzf2a65;{6rhPJ9G$t`~l;aF)=YL0bGMRr=x7Usni@ z<+h!+YXpx1=ki}j9P^L%JHUTju27uI^H#-sTDkM6;sc25@8J$6{+`lvy?m>90qN7I zo;jc6iT_UVNyORjSYJv!SLwNaCo5i0`dY;o6JJc6>kI#0ATAFn&d+1s5q3_uQnUV2 z=&`;g(DnbM^zG=FOiJK&p`Gr;k5!!g`E126C;bZIoc|vw|JNwaezIQiru$IE+tB#r zQN{VW&P&8G|3fJ+`0=*VUqJr6UvMm+Z>U^86+8<38Xl(!j{1?beMoTBUr+kD!nRBY*eTk1%JcsxU#pe*ePVu$GcPh^JzaJ^SoAf^kK8zTCG&{m>aQ$9R z<$0LkSUz`9xwIEN3Y_b`o8YMbne@jBj{4^G+~NemQ9qILce3E9&mw)E;x|&goFzEg zIh?l76&&sGJjqnSQGXL{pD#G-Q|P?26zB2t0^;ZoSf2cz&83QG!#-SY5O(mqTu&Pm ze}Ky2QDuk6tM4k#ZR2ajOU+pwC%L^%a6Z|u+AGfOy^rGD9}Q7_6WO1v_%`CR73XpI z2E}_q`Qfrfah{jnqxg8ze@vYH7XOYoE-k5JVm^|12gTWMyDQH3n*$W*`^p@}tH^$V z;x)u4D$agbsyO@AGU8ZYXWC0L>uZ$$W@@Lm2#$WWkNn_v!K1+WdLIxR^`}rdJ}fxu zxg4Gr9QD_d{!fCVp3CPI!BPJO>0cKd^&AJ@6CCveY5POLQO|MU8^t*eggb%=7OwZ3 zDL%AT{8r*!6z6&zp!n^iAF4P%j~lP}J)|#Dd^7P{#h)O4iQ-QYze4cIaD7+O^{*B@ z3Y_QVZWJ8#*|dF&;Hc;My?X^m{cW`UfZ(WSzkNb*)L(xjtYCRs@F;9^{CrVy_VeAu z+0Va0Be1-u_OBS!bl;QR2mlPbWT0 z@fzZnDbDeBz2b{W|FGg5ho4t`4e9@`_&VZWE53nvGSv^41IO+5if<+TK*f3dFk10X zNnft`A>tP)&hGw` zd=v34if7ImBO5JWBjS;@pon5KroA^UwTR;++-0 zkNBy?(f^0rL(RHC=^vtT)I`Ctf7wa#Vv^ud;5?3+E;#Blvtb2Gh2T-x=5f>v9Q=G>ew<^x#v}Y8LLOa7{pW^&n zm+~dy(SV#II6(F!4JSFChLjagH<3cs74;EB-d| z_Z0t}_yNU35o;%lCXU#CbK+eUA4t5H;_PoHD$eaKu|1`z(NZ&vl>m}D_ z-K_mbak5*+ofkp6zbQP1xWZ515##~ckSShfish3${Y z{!YPBUqkv`f}{R3(!VV@>K`HfUcph%<@|->eIxX9VRDKV}O(mOo$5LdE%fD-^$z zwy#n=>sWh|8x+5o_y)!QN&H^L&+cjMJfirs#Gg{Uv6t2FP`qbv%U@BvmiSwO7lAZt z<<7f;WBGhX`cH{-dDc+<9zoZ^ocp^|73cfV$%mll5^hy|8u5D+f0p=W#XIz~=Y2x)nZ*A>9LoXoKgi0RHx(}+{+{6Z#PH(_ z;@n>TmTGtYC^**3D|FtU1&;#f@pd!v7cQT}`dd3K1xG!Px7!Pj_9v76NWoFhZr03t~=23q|)f}@`AJ3ba1^(#sLnc%4Ban$#UbHC|P9AbalPj*rTM>{F$u!5zH z;CS9MjyKpjT<|C$?q|CSj`|x&-$QWJbH6!IaMXWC`V$35eLCf5nBb^C<^)*5GD7eu zY_}o(1jTutb`o)n1K6%NQG6>`d_L^MWtQTXTkI@S+#x&nE6&e}UQwK%6Md-oV6yYG z;yivhmf}6aDzfAG%#BWi27x9M`-$#6p;007R`0-ET>~Bk`zP?fX zJK{enUQPizLj4BY`5W<;iVrx^p1hsnR}k-{_|L?TQGDV_*3QX_KR|q_;zylq^<#)* zyjM@~_k|9L51SP4Mg77< z#Ib%yQk~$((@OsXjR#&79OG3v`N=DSM}c$szau#6!-HW3%X@-HVVmpaGr>`RGwHt) z9Q9mZKM9WdlTLvZEJ-v@VSnIyY%VzJuO@vf!K1*reme?|`cFyUNpRG2z4sCv^%GBp z6)gP(kHR+l!zqHJ{sGdTE;#DhPsRw2}b!8SIoOUP8P=@vX#pT#4m| zcG~1vI~OT^74cBQL&Tc_Eb^@3wLKSb9xNAM_cZbyp+ zNBtqvFBcs3+>X`=j{0FkUaQXF zcEM49#86nlvP1AFY~M)w-GZZj7U}m0j{1)2u!3cu;HdwQ^!o*m0_VS1bdWgKFVaqpG#*Dj+9I#;;|)Yp@Kn&7DCdaM&1^^K&T zEja4A9v2CYdVV=&nc%4BczCtos6X>eSiy3g;8ED-dcRF@)UPD{or0sD>-{0YQNN$` zj|z@@uJ>mJNBxB1u!7||!K1Lv_5P;fT)!VF&i6G31V{T%lYPDqe4jN|aMV}Oq{vx1(sQYM`4@i zdm98t{rRL{Dmdy-qVl{-ah|ulo;bH_{{F%pim#%0{<`7|;T*WUulRC{oi7w$L;R59 z>xrk*eJbaN-gzE)I zJ@;P=1xNj#NxxWd)N}u}N^sP7C8t;;IO@6oS}!>27n6R2;Hc;R>wdve{{iVY3yym3 zr?v@>`q5Nr+XYAcsp+tSWtZTn|Bm##1&;zBO8UKmqyFZxu!3cu;8ED-{_ab~`TmjT zGuW>YUTU%PxZ*X$UsjywIX@!K^?N4W@9^ItVm^_0cbcDL zUQ2wS;vAn(SDfSUNX0qco})O&)iTA|&o5A%{ds}n?6)fv=eTz*aV%$QDyHP_5_+t! zuc^KsRJ?4WE$GJ;f13Dq#XFv3^)D(um-riszfSyJ#rvIW?d(_l3gZ7F&ezq~%AE+! zlVLsLb$vwomWm&Ko;{$Q;swMzDSk2WV-$ao_;HGVNPMv3?I>^$Q#_yeIO6)cqKXfu z>pfp^3O#1e9AQ5Sgn!RyvEW!f7twi_3yymB^EHB_emm*c3XXdA{|$npz6e*aY!o~S z+uSZT3y#tsNWVpJ)N^~;E;vf({vKAa><~N(+uV+J3y%7yNWVvL)N}jVCphYl#UKaE ze!-)#&F$_R!BKw!=?@By`t1}?QmEoM&P=Dc-A-|CzugrtCjAMD^L_W3iu3&TSiv!$ zk5WF*5*+i%aQaG`-=1Z^~c09K45$2_u;=)d>!n=CF2zP$@(pJ(>X@* zy~Iydd_VDg#lIn5q&PpvtWZ1y@{7wt#d&0l0kD5(my9S>Nk=8HNjDTOgXGzc~kHxY(GKz4+Ka3 z-K77A;Hc+*>TAXMKKcjZ?1vnGl5^l-SeUOjTX27qV-w7`6F*P!Pl?Y~JWTQGI>kE> ze?aj8#CH(qc5w%d6JA%G{r^41+0Q>yoc;NG#o2GY(;c($dD%Z(Db9Y_QE~RS9*VPH z4OE=RKW7lfa;94jlaC2PkM-W`e4D@DD}FQaX^Q_yyhib}XIMM@{FB@DL&O`DzGa2g zU#9pB;%gLtj`%Ia`MSDWGtPrbe^jO2@wnn=5#O%(3gRy+zLoeJihn`;UBx?B+4JsK zd;;;W6kksK2gM&Jo^pn@r?0n-;<;1~M+#22j%H6U;_Qbz)9e8!3XcBpIi2?u!K1)= zUS)*fs2^SpD_BMf9))dwAO0M{QNNz_lLbdT$C+})InLA&$8x~y%7sr{7AW4+V&_uD zbBJ$HobTnfDNf#os6UM=8$sdn?Yr zOL?N={5z9F73bfX9IZJ2Ugf!p^Y2@hDbD_Rq2m9d{4ZCW^S?%M?nl-u&i%+H#kn8Z zqBy@FwOw(3Z)ca{{C>_minmO$_4JA2od0hX=lq9;#nvz9zlGwQ|05LV{2#42=fA(= zoc~i5=X%LgoSzq;r8wUgPf?ubU8@y8iOOez;-?e8RPkKm*DB8Wzg2Pm{nh&v=l5?P zSDb$be~02+U%M6O`r4~F*Vm_tbA26DoX0KUGh^$W$1NF(^SGsh;yiBYq4@t{?_J=d zs;>R7p`y^% zUa{4RRx7>r0T!>ZK1!?g($-qrYKs;tt=5pbg-gF~ zv2f{^xoxBwH&eM0mgGJ{1e8HGjP)XI@W)ffiDCuaeAtO6a6`t;{&P8z!#z{adDP~ z%lW`G#%Y};JFmeXr8x$DH37U1c3OBT;~Ok|A>%(WaME+*WyB2EQ;dt;y&85hXXuRJ z^1a?<#>t+<=S}7_+oEq|xwlyK#T}aOMvHzk)60JG!oQR0-?ZrWF#Qnzy^PRrXZm8s zMgMUDEqA6tPxh4iLURqA`qjHj(=W8}Uw3M}$-?htyu-rV8Nb@X&t!a+g$Eg5$GGVK z9_#-@i~g#mTAvp!d>Z4gSojp~*Bci8uZ;iE!h0Bh-@+eZ{)ZSBJqtXoPoJ1R+V~j8 zWxNhDpQ#r8>I~ifDvSOpj<1y#eiP$sEk3gU(}NcMey0DeMIQ=kxl#VTiRiiD3XKo3 z@RJxXVqE%L&U}_w^j~56t89AB-ubeHuVVau3t!Lp4=h~n-~OkC?_v5sS-9MP_|(GX zym~;TZYcelz;Rb<;R_g_Y2n?B*IM{pj4!ir`F+%#7XCWZKVspB82_<_%l+*)EWDKC zXrG14^X$R%6Z^heIuNKZPi6aFEV zFZc{@FZLE(_!n68%bC8^!iE0?3m5(}ZZ`iJ7QOJ7^GBf9**l z|7$J$CHCiy7QU15O&0zdPnLWMd`p+V25z^Z1Xg|Fgrse$t;q@tf-;n}Qz zxqskM`22Sg#q>UE-64P%o@OeUv<7NvNUAGvxtc}!ctA&f7^%(dC z2LBxvF817M;9oH4U$byo7k3%>g$Df|3tzx>dky>|gZ_|(%lV0up^3;J%=>R43%{4o zx8*v3=*{!w0)w7#>F*HMAqaYNy_;s>=DH^5WkfGLh*ai3!p(K6$KYeGM|%z2Tz3l4 zo)Ynyq_gUCl7XA+NR@$`>xIl`#K&A0x()hrgTI_V5dCBW7e6I@ih;}ePWV&<5Ai%k zxY&@YOAXwdhh<(QdUL*AZP1(Z>Q)0c=TDh$iH|u?7O-CtZqA3}4BVXe>I~eR-(;T_ z;$zNZj~evmd?j&2^ya)I{!F;UG}&he`zPV%JR|$D5N^&V?FPL$Z^*vnL~qUy+YNei z9+3BR61^Gkavz9rGpXPV{Cxx;%~)r)J#UZs2Cz1=-F-Z^qpU z?ib-^+znxU2sh*IF#|W_t~HZJL0^}dahKC8j+=2;Zs2CzeaXPhxLao6<(j4Xd^{BA zKiR-@vf}s@1K()iQw=;L9H*aV;PU%rvctIsK0FeqH{O7`PdCI}Q9|-Bf)x^TI~sXvUq> zvZ%hUtGTnfrM;>8ijJnP`szhZtu-B2CRB9P*VLuLYunndbV@qvn`=tC>btv2gjq*t zO|`0Psc)%GPXe+|P_}n=R$pG<(bSNZmk=(g?JTRlyzI22khg2P&tzHKSYNxOy1k?6 z@+I|YlxW2XeGpg&m+uJ(2syk|~NN1>~mZMSlYAAi3lDhguOBYwyELzl2 zf4Rw3nO*g(wyl*0#8Jayl9(eTR`tzat(v4BPJ_6!X>sdkk#^QMH&l1kcS3w>UfL$< zYPCJm)v`TnJGy)irEXtd)7(^71Mjsf>gwy3)@nG7HfUboS>0As-(FqcTHA4Dds@9U zC3_dV@F?V(@F+xv^t$@bCH*MmTDlO)xKo(dwzO9_wZ`p7SWR7B64tqNQ36JGW^+>9 zkhN(vTI<29q_(Z4g)*j~rq(6{AOR>R&lHJdP-by`7iJqYt#9e9H#nfG*#tTpYs#uS zK+(Rmt1~XSuDY|Uro%u;ao<7OYdUIL;?#+qYN_vJ$I~&^QPaAZAYJP0>L5|IjWrz! z((1dGw);SBS2fLgE$z-C`Y`R$c|}co0{f=chPHH$4#i}0q<}NYNaxR}7Lg{IKXcl= zOk(Xaib7!W4GcwdJrqcq;%S_y#w2cNYHr4C*IL)s;#AW>V3w_ITvFXo)6{JCp=EJH zbxTd>5~rlKt*gFd`m761Rm2I*>Y6U6g((3e@3pa(rOnA$TU`=HUT(J~FHgYgsvF>u zos9`n)e4C5Z)#oa;}~g}7;{H_Mp)X~4jDw0Y%O?hwbUYhTDuy2PAzrH=R2FOs*hu^ zd;-wkT+`Li*3nXZReeVrQKp&C5Q**0^<8P}IdZ+Hv)7)tyi}*O*!Ad2O9jThrX!R?A&s3;E@wkZE7K zsJW@uL61t%1`gF#vk1p4Tj)5Vu4L>)XGC|&81;!~nUS9e)@>M`nv#-AY5;)fCMY`f zS*AYm0r+$UtIsm^iI2LHapMUdt3Jo5&ocFi4^*C}D%Iy0^;xDq@qx;5s#1N9QJ-b% z6CbD?t18v!81-4E5mh-xRjSW1>a$GeRb`o~RG(wiCtf%P70dk2qNimjl9Wt~DVe~dr%+#bKE>BjQi;>&g!Fp=gz@E~Usvwu5;J^x>Vwxq z%xAUV=~L>A-Jae*Vq-+PI;J&U%kAl$pZdv{mkwWUIG3f-KSwurUgP$1uw^xa&c=wg zpdwj5U25C%pTTu7QQG#C`$-G+Fc3?XY+2jU-o}VTVEAm26o*M7@m>;UT_Z8RGUNpDxvH`Lj_^BzFJhJ_*^^Otvf{07Ig*?f)DTn)iN)l`a3`H2$jw8}xkpgqo^kw?74fQ_0Wf`#Pd;y7r}L zoT_~ux0mnj(zQPYjcuKXb`u9qH&2e_KXhwE^pW}F9bl>CZ{d#Lg?cmDvfe_ajS+pp zeB$aj3)QC{Kf0x2%U=l~mHbL_Hl)@1;D6e(u0?wrBjRqBKS8UZ?wL@ZZTZ=#PbL2q zmVY$=?S;mv?K%H8zqh>&t26w|_y)-^^`EKHWmH z<$no&MwE8^tl|55^1TDIN$TsxXm9I8v;`Mx`OEb|_5XO_w){8K#NXZ=Em6Lg)um)v zucLh``5Q0Nf(y7~)c->K+4A?LnZGXL`+xF%MmqWQJ!C5RTfU^_Z!!8mJcazuH1o$6 z4$vLkKAn8J&z(yC!iBn_xqgjEA%8ID2copcznh#DY3)(u4?z1=@*8V(!-a~A_WzTR zx9uNGBR|CVJEc9dNs@JL8u>d|eyJgUWD5ChY2-JueEFU{o%~DF$UnsLW&Fthic`q{ zY8v_P4b>89elnA7YxByoP0$Db)0W>aP5f=G*Md2W)cixfV9S35C$*{izntaE z?+io%TmFM+Z(~HeljWB~KT6d9G5E9PuTCSs`9x|J-=AHVl4Y$-BR{7xx&Pz9#FqbZ z8u{y4zWfd%o%|oCkw22Hn5XwS05_IU|MqKZA@Y?f9Ekq~*!)K6EL$uWzHV ztrOAiV);3S|4jmJ_kRhnRPx8sWPxdc5ExO@eZcF}GPB@oEuV+zCCI6*UHQ@rLmxC?qKTu&~M0<$ko8vzPxGjGM zuvGF#(qxHLd6fQ71x+gXBU^PtGybN5)|Nj7{*g+4*JzTC_g%oh&1B0u3+-);=)2pr z{BjmZ_CF7QwtTwIN+rMGG~#k}|N9sWQ_0_Yg_bYlO!8;o&z8Rq_lJm*=4LZhvHVR~ z-^`@B>NbSm%lg9%3283}4u75N*GYQ;W^sEd%Q0)B&b`wuh(6lwXQF+o{_o`eZ{hO@ z>VGBv?EXIrhBi-e>AE+ReTE?;EN7KkJ?5js~3*SE^`Sg1NTmDHbU*eo(QhGE?OUmTy zNR7sAEqc&>D$3jKpB$hm%-<3a4{0aI6<9bVFEZ$ulb;Grrk#fl5vA?F(w@#w%q0C6 zY!(2^#HwoNK+Vy-|3H0__7az)SibO+foBU1xE`}FFJ2mZP^_`sp+%m+TYu-5|zW``d5)N|LtENeq<`Qgi* z<^AZmdF9YUC%Dd|2fU02cf&m!L*<9}d)|YMj`P^+aQR{U&hJs8g*n!4URiyp2yN)^ z95?i?8+GRI@&*(im^}kBrbE_wka_L{pI$xf0qC%<$E$wzpyxjLrZ@D#Ltfy)4?X8W zsJVV!cpQiBRBjb0S z;H)FQyH>`JZ-UQTpd@=a?m@6u9`PmpN!Id^b6P zI{V0;3(?nMOS&hB>^DKX%Zoy1-S=I+oYQpQqpA;ukVmvc_tr{h-5)@=+sjjR%QGFk zh84C%oyaTvta%gOx!A}ZF7a0d&Wjz64;AQdy7S{=N)Xzc_ zVe2e#Vlw{(5Boldvz@;G1M;^nv_?`uzvUlyUhw>L`EYSy%b;M;8X+ z!>2OnnNeb!aJtL;BP@gTdr z>-(%8Bf=_xNgtFfvinN*L$(Q(X$;=D7Uv}jWVvmJnSKv}7 z_$JtvaPkT2w`s#3_&niyEVZvF*}$m1_#TZ1m1W*Ie2Q~8-Mq1%Y>f5?yx@am|AUw} z4#UW;&0?Z4e*hg@_5|Q{F&~zn%w3zfJIc@io$)_$j^N=bC<~ z8WXbB2Jk-(e{ueCTP}pZYx?{|{_y#f{CP~sjwEvv=7x{XS>5jh#PUadSN9u+;{nK` z{4a2PjOD%wAC|aP`tz9BbImSe4tmS*^-Z2LZV%-AJ`h@h>3jYj@TWZF&nNuVKq!K> zDDNY0XfgGZbR+%gm~vjGSheQm!>5!VHs@vHBmKmw;AJG|BX9MfJ)grD4ze#C@-me# z9EMNOI`Sd>VLxK;BgCZb4>)~!^f1<$$(c0w4}jeU!e{l^7s76xu<6D4)AckT#_N{{ zoN))C=dsveST5NhKVfaMZE#({*|(?H-GhFQmGr)FXj(n5Xw4Q@l_te~}d6uL6H1!8-Pm$-$9qERO55iwIf7I*r^&cH!8S%O7 z#ScY>jz^Ml3NWo_fAm|+rhYFxgtdqK1%I-Z5WeZ4UX#qZjqqI`#p!7tBR?g)P;iN_ zeN2abneuiWh_^T86%r19TAtQh>9;>lZ_3;Bf$-PyEPj3ve%>a2uGW{p1BVCGoR@($ zfY%xHRnC)oO1Y3Mu64O1S# zTC3JQY8&u^y&}DHqxr`TJ+bJN(Wjkx*3{`UXV1I1rhf5~mdmbNdGoDzZ1~2v?tl3E zk3Id&^FR8<@Bi@jpWfg1@exkokdUgl1XYvU?m-&*7GpA;99qj+ z87%npa}33;Nw+@}lHF;!f5%@(Iv(CIaMZEod*_b$OTa0;Tk>L)Onfz-;|{u8%5gOt zZHIClT;(MuTTS7z(YNKLhd3*CaGgsxCYj_?k%c) z`&t~5teA(wr|PK26m>@VjOIu-F0Nk03GdG_HFXXD*jJc-rY z;cI@(LnW3)I7n9Ph3Qjd?TPn`rTd3;J|My6I&&ralHZBiWX8uFz~w%dd6JE5T%XMN zm;*Q-XY(Z+*SId3aUCn-AJUmZf(zjw+4y)i3FAY4zm7S8OZ_HakZhcBqcE29pkr9T zWlHa2#>(HN(CtgBlI(huP6}}qsvhF{SNx`n4{%nrQX-_V(0AZQ$x8evIw|b-{jpK9 zaTh&i-yi8~<*zZH_)wkb6pyoG9`I>C7k`a${GQb(Gd^Y)E%zDEm28I3cyTi0V>X32 zys^fFe8x@5jE~txC-@rsYfRh}4atm;d6E=|H`bW=;MFEGKI;4;)1Qp8ayTh0_q)+3 zS#fhkCxu7jbdr@hMA1oMXPi#55+jOE3h~ixOzu)6Gw}~@u6tsiXwd7ElRvmmu6qIQ z(+2vY)*Il=jCy^}h@6QZe`kzvygp|~BFF|y(4t>vdBKJ$19kPu17}9h!M7BdK_`%} zp_x(qW`3L#D2NwBd@~bb%;hm7m4T|<@JV)nNccCK(G2UkI2ab zHHQJLLy!dL+kIA|ND#gR=57Q@;6T66syN8+q$&>X@6L?UW7$JoWU#Z+Fz9tUq#sY_ zjYQ5y*7*&LpP@!a2UE5`Qg$Zb(a)MFxi_j7y#hg9cAS?m*|{xL3Y`6^XZ*+~aP|fW z$P~K3IiFc9zbAoM6?+A4D^!eU(l2#U3aL_zN+G3D;0xbI9`}uP3QQpl;>GEw0FM`^ zB^J-6VwhS6D!&6ZWD_UwBz;oK{v&uv>TMSKxK)AGP9JxUTjum`(_g+K(SUjp$+OEO{{mzNVD4t6-!j_OsLjkk}%M{ zVbcM7KLwU(9GFFPN1*yiu;UW2xoohNWE|DsL}pb1RYR7Zn9y*3U=^CoQ_bh9zEN`# zlE}o+s5*hkT(*qg?(bGEwHvH-(v5{L(H=_bgV~d-6BSndHS0Gd)X!7q5~Hqy@!{B* zVy_5LWaMOE@Nyby1l1@8Gjg+#>DLDzm?bdDcs+S^Bx3J}>R}4!OjLT$h7^82<)6!O zyz`Kuse{fUjYGv{_HI z)^#u0b*f96)2}rrO?Z_{imLX^cCyh_bwU%)c9ngUG{sEA-}2(HvYnyC#i{DFs;V!V z!&8Pl#lhfSl!^oE=@@mE4g3Lb#)839@AIT*e6D>yajtzKvG}9J;tra6{kitVgt=Cg z;xp(^NQ|B*_t3ae`s{h~Mw#>yBeF{SF@?2Vu?jJBBSuY-0gF{vb(1hhn0smA}ZW4wyPkYki zhDXGG(RT*A_+V$)pXdzx6NlR>9!RXUiXSG{s-o{IhZ9^ymEx{)kdzoe1_(@mpX&5? z4=gPLGIFroacbGtJW-)n*wDi(snQs zDQh1FRR{bpZ*#v&G-C{@@C})UsUGhZ~^(mq*4)V2`qqNiBh;J!59kVz7()fWR zopaF1-&}S#HNgdP#yGt{i%Jg-Q61}`*uJ4TkhK5a;HEtbWmkre*#4m0GWApqe@%4~ zta;twB%dDZ8k*y6DQQ;<)pL?!n}p_5IpIEraIpj2Tr5(}8N3dN!EJp>;y+j;>ZwdQ zf1gIYR_xbng<2+P9?tm)9-KoF|g~_IVYzNKGc~|ZhvIe!W(k^5U2Y~9OBPe zA^w~dqIUUttNwYHPBh|E!V4+Oh+!3;fgh`oj>qs0BZhZw@ssIayfuOBMJtI;}}+FA?C z#*~znlogI_Zoa(b)b@_HOY3X93dfBr8#AG{;q=nd`Z1@UUOJ(+tZaP4_=Z|!7LBW| zsX47?d}&SnnA#%e+%raB(blnKG+tiR($;!qTW2-BRAlr!4?VPd>&<_>bKBcb-v0Je zU-{!b-x@upbPWENm5%23w~TIXTGWA8!Y!cpu;9Hl^&PD>&3Jvuxo0dOjtdewE=cCM zKsYW~w6v)iui)W#&Owv$<4(PNLXESumEJm3Usu@Kh_|IVOChCfe0AchpX9Yw^y;ck zr`2h0gK_+Z3dLJ-(5PLtA3x4&PfYz+ywDqe6ax!XFULxF9S~mglJtVARPP(I-4;wQqu%}I8$RJ}SmYt`SA@~qv_#3on#7lfnKb@;y6hLZ`4#D3;6+X5 zI~90Q^tsM7yiRqF)4H@p>)h$kd&1f}>gqe3ny#+;7QE#RFFWjTYMbk8TJicW)w52# zPH6Jnxsxxho;UN7bF1fHTy<`BHJ*E!R^?2aHJf|6thbX&oJ&) za~*ft@$TU4q0UHPGQHDnL1#hsaaFem)@R(2d1q)tcw_cg`+P0u-}-%nZY31rZyNq6 z(RHjdKl`{+q5Ze;H|S>M2>dnTkCOUsC5fNrMs#ZxmE)){TGG&wep{JNeQ%P6jz~OQ zSYqn0*8B=mv$@tNoS9W%^wRMeN z+SxI>skOFwXo}!J(PkK@`ip0S$VCDaoCk8S3&5TpJ7KW_s%teecZkGe1D>2Y@Pr zV~J_z%5A~kUiJ!&t2)Pf4UN#HwP@t+y_TrFZ@Mcoz299MniR-}LnRt)hf4+vj2MvV zeIG3cct3SlAonDW%3cJ*UVnkTf?3|8P?s1&j$4DlIfgmTC!44bSf?xV{7^ZJbH}wS z0-+?)A3}6692g1FH(tBK`>PB3ieT0a!QPd@tSaBYWM$Z;QrTs0+Dh-OYgEU-9rz&A z`wjB>aDV`y)d`%uov7-U>HQ!8`#gWm3d+!t2IgtPotk9Xk{5hP<^fqb%TRn1{A1#A` zXFT-WdwLn1F`DTe415sG+D@H@8s{((sl45Tmfn9{_hfK1Y|)!WKk8-2f_=6tpbwmu zD&ohACo;W5%VNazPHG!EJ6Iwuvu;T+i}GdP`{tyn^M1B0Rrg=;bocvbdXFz#;r#^N zfeW5r>2sNtkoCT`On2^051qf8Ebs?qfp5S9fectz!a36Rycmh67;j(JPtMI#TB>(K+uNbOu<9eKH1}Pk8##ZXDa9OS5l{pH}jRTyEC|unP zPpGR>xcW%I&sC6r7tXIcL*d2^K&~0BaQ`-$Pd`H8>ei}{NybyttCZqL&qws})VR83PuYazr5N{@;EJiZuYez> z!dHW1D!eNV?xx}MUuooSPD6iL8hm>id`}vEXivIS`jf>{;qRuQKb(fXC=Gr8H2D2# z>~L2a{`AazDn0)N^!*Hfli#nJey+|RLHh$mANO;0t_Wl2BpJ^r>do1po#|;jO?<7v$F$ED1E=$RNj(OBf`B;gG;ov8dj>wtpm*TU zl&D`OeV&0Ir%BZ3NCP+J%1`udK9vT&IlgrUZjMX0ft%yF#=wgVeQ5rnL~;vNPJiq$ z@WBS2$9X$mWTm$Kzntll`jv){#Fx!yRT@4U)8G%K!R0!S^fCRv$DlXyod#~&*^E0A zr|Tg~#NQm>0s}Y4#f+mu)lz>{8uTX`_(cXj+`t#6!5a~Sn)p0@pGFmBte zDh=Lf;HG_+8~CZ5r-M0;rhldz#~lVAlm9LQH~AkjaFf3|@0syiZrIHnFVp^}T$z{1 zJ|_Ro1|M_0%z4SgA7y%bT(&cAkIMmrzo~yHP5ge|aj!J&X2ylYsqGK#2K`B#r^DJb z_$C84?XWowF8*NK=TWA&?PHFwIgUdNyP0y$_0Ghn8T6)|O@A=w=dLvLtJC0j8Mw*k zp)~kw25#!}UK$+t6jY+|O0a{0oBlj54Q{SSrk^h~=uLg_>~BiB=6Ynxz1N^OadVwA zfTbvQ2*~-}12W8`I!CyiNde{V&s@DXXb){65=H;xj}~_yt@ecgzSk?}kZU z=-(gR^AiInxhJwcUp8=(dja$LwSg18zVGQcZx}ey`qJM_*j}4sY7c-v8b`n4AVw@gkpd@%RUzKuM&c_7b zq*^;pnME(>f3&9nC86J;i%y+|%Q||Eg-ic8Sh!q2e8MEGW{+K zm-EiU7GA*R0v>P{pTDUyv{}T)EVfuF%7rza2 zfB$CT$1~oS&mV;Ti;U-6_;AKguyFDF(H4FV)0bPg_|J3;KZ)rtv~Y=&MHW7p>60~S3xA67-&y#}jPJGZ-!a~c&&S06A25Erg?l`{ zXIOZYalBtkCE;^2(TyO{oM11EY}r}i2+(SOMF2MnC(Wt}}@;6y)*%O0Q5h<#+8&9!h@?}l3VZ5%(v z22T9%XZ|GyPWs4tH_^gn9XW?_vGaT$_eu+&240jdws1KQ=&PZ}ZVTVe z`1dXRImUlv;jb|MM+=wrC}^C|lmBFJzfQDpxvz1qh0FXuva{C+uC;sc$ZwDJV(Kj;vPy;9W_2TCSPV}^g6r~aaCwjc|Po+r~ zE^!pIaEYS}44n86;_}4?PW&Z~>MUI1XbIyKM>LMhc-*@!T+aK~SonOUz2j`M@MgxJ zw(wPq|K7qS?v7Zv#9h?54kbNbVm@Omd^h8BE&LP4J1ktz-)^+5mYTe!r_^A_I4 z^lw|Z+}As7;c`CK+qf>KejQ>y$1^T|dj-eQ83w(1{XWB@&tkutZ{Xx7@)LlI44nK# zuFL8Soamcb??wYBdRdRU44ml2F5L!B^s*kUGH{}oey%ofqL(;bZ{S3K1(!D(IMK`c zb+3UF{Z1}#HgKZ<8r$bl11I_-zVEQrz=?hn)BniAB~D+paEa5m44n9{VE%tJaN;j< z`hkT@oE~PJ;*`d{fc+%Xx=&JtI!c2q{2~oIB^KVr_x|!J z;d>c>%);e+nqOLYA;S9CxQ1IK@#T+v`jNr#O;%X}W~ z&hIRIA>*G~csJw6;XxKk!e8c}Nf!Q)CUX{8_zuRGS@`RWuVY;NP_EOTvhb_f-?*87 ze@4oDdg9}99VholNq_UYuYem0-punup@Ey{&m%27o8zd|z|D1kf`#v4`f>xO@sc!y zGh%01M}{y?TS`b@2oie2&3-i-^rrqYZbWbDx!s^Q^_jr-Abm`^P23N$8#j04`#!== zx!>h+BixkxaE5M4xG7h*ORrh9sH6UJy%VG z@RKIylOn`k9u$(tN(f8!e2hG?^V!^ayX?=k)jb5Nr+CtE_WQ<u7ULX zjGJ07{#=`an?|AMt`bDIsg1kMN8n6ydbTUYj^1j!ZnZhL+KO9kxvlosR$FKr8)h5Z zW6NgP*!}t+xYzZ^hY;$`R~`3`?&=!w7Fa6z-ONOWoL*z&)CdLrTF z4>_IWx_P_+d}MY$`ZF}NF{*r$uOH{|`HnQOY01A+>A&$@-D06(KRT7O^(THdPih(A zFRa&El~&Q|0bpa){_BJ3({X-x6#ajI#;No_G()%V;U5!|{pozh)}QtoP9^`!Q*`@< z`rv=sv^S@bzx7MH$zE!|o9!>S$d}{qQ9*gT{dJ>ti!Vq+ zK1w?|zJZM7P10X-dlRF)O-tW95@!4FYutVpH8PU)U!X;4{BLu$rjY9evLDTv(q87z zFR*;!C&#U95c$4Ha9jU5Y2+6!)GbW;g*uh;kq$bqKV`42vE#;1n4oBmeXlL&YOM=>maA;JGloWOx6|hIteWI3cOQ0^ zI}ba~^0R2)tA*I3;rfW$`zepg!<_PmLH%%H&vTQ8ubTYu389{|s9j){`>+?%Z4_Jn za8EdQ@y*})>HC67S&n~u{mG4&&mWUxmx@_z>Zw@$-Ue~OSh9VoIuLK50#<$!Y z?e>bo>jMKK1Kh0etAT>z^`Lnl@`|!xgH1n2`Dl$}T)*evoZ=+o_rKKYRi z&<8sB`oLb1fzW3I##7s8VC2`(2RbNyzU>|#BOAe9kqOZ01t$=@662)pR1hhEUN1P2 z81zxPy|C=Ys5zFuVSD`wHXRTBc3>Rugl-2gmav@~?~j$e#$gP}7J0sY8$mY{`sG2t zU#YRniwyKIcF<=e_Bq0~gpo$@C~Es^G~b&T9*lmj4h#$rar2A!xV>Y&1N~zmHzW42 z8^ke+V`gj+{PBrv{uTZ+AaXe#X#B50LFBZ^SEC_!h#I>B_{Ziz9_RrzPz)#Qk#9O)>{-aIgWQ}zc5IlF z8CwGR?_YCUwCvh-(SqjXQSyZ;POsS8P82lxu~klf>>d0KbNYg|Z|orCPVfpM6LEas z?H~Ci`jUq+dMx0?)(84W`g`HXm!a1h^eN}swb5bAu8(eQy(8*`mPcQ9L$N6InF5{H zxH-@_2W>D`0T;3md(ME^tKhdj5RTM3pj);g`aa_PPWaPf;X9(W=;wX-BW!#ifPOiV zO^}N_Bf!EmAH-^xt&HXX-_>$klzeR!?D7Ks2wRBbFo))%{;|iPe-7lVTDB@$MtZld zjlQ3C8*~hyzr?$La=xOvbi2Us}r@-<(M4g)r>bzL+kyf(T7^Gj#I1K+$z zm(wR!>-3HERkq0m7LF{r=GN$JV8ffQkCuhkMc2Uo2Ll<c0I zjqnCwEaLiO93v&@gR^XT^k>kA^nWZ+fUzl1d~-bqVUbvWI zi|qXq=yNA@zxnGM=GHp>p-Uk41;p1aZlt*B58vy!57_!^*GDO?wj$;p!`wXsd{7^z z*hXBTzj+wfyjUNM3&r9fH(Y!*jw9jI>o6X#U~QqkzU&TCvHUW{bRfI<#XuyCV|a-> zp!j9Xkrc1r0sSvwoA(h{6q`$Ej&bvfDJE&2`htqd?8rlC2RvNt^+n(N7hj3?WS>)L zJTdQH=4MAu@%j|!AlB|va{$d>dErs81;s1H;8NhV6t`}6@es^a6iXBzWzcu8GbFYc ze!d_6dphP}ng=N6)iID?{8tsbeIj2D^a+m(d7L`OPcz(a9|?0k2_B zKGw1P@P$rp7{}sT&`t@h!2AUH%`5fM2^1eh%)SpFTNlU;cR7J@8P?xbpsfw9j3VwM z*Eg?W`WLaSg?9rx-O z$SD3M{O&%-1FaW6A&?Pn_A;TTSNt(-c>?=7?+N6_Ud3AT7sT8Zk*`PZ z1>K356IVIG$cavV@olKj^SsEnpbN_3dMBv*O>^M$pt%wKzR$^w+~~N)f51F~H3{>5 zet3i9hWkT4^2Pb!jkP4Q7Ja=JGH(cg-fx#v{0wMsbaKKcIhn=xp`L8=NASGA8RL%g z#rvI%VpxvS=!R%7uUF*N<{J@X1ECAfJD~4f zn7bc>&!6UHM4p2^frVE&1K_(^krzTYM(Z#q?{B^deU3)rcGwNaZo@p) zV7yR}h2G7w17f+4Du554?xI_CZX(it+2j9D`SPM1BR^J`xxd+Y6pIp{@%&?f?&3 ze{oI{xe#(G)?UOpQ8U)__c4DLc=uWkoTHezWf#%Bc1BhRng))9lR=fWSUABY_sdq?QpG1tqDjDXJu(O;aqL`re~ zLhCHek&7XZ*6^}G@5px$2jsUg(2RiH-t_`S_~A;V$jQQ(X5hL2>mPKFxxFKYBVJLd z=i<5o^=LmCF+QaQV~q2IB8+PYG_kB(@bjUpNC0cV9JDP$9i7t^p^oPJ9IQXXp?f*b zy~1dd6Tsq%>!lp%LV6eDJS2eggUfJEioGbILjdw}aO{oimbK9k&V@;44P<1Yzqafm z%pW9sIbxy;?MQx(A-@#o0K*{vdss`fd@R6*{4nIZkpJPCnMF7UWF4r_aUDitU6~9W zdLT>d;Hv&p-^m91Ap6I#(JZvdfi6X`EuBw_4QTBtgbwcy4HeOO6zPHA-YPv_Mtfxk z=+}d_WiR@x?SShn_zl^C){Z^UZ8mhc3_3s-?9exH41kmD{bRF=aJ~Rt`aph;I>#ej zXe>ydHpnjt^ievLLMO7t%b>dj_)Dl??w)*n;c?ls+>EnFJM+)(`(>=Z&X9Zh#K5!9 zr0hP#YbNMuT`xxa_pp}zrC0f3YEQcUwJoFQ5A%XWA654%+Ort<2A&Om^6orm+n?_b z7rj_Ex#*d!@=t$?>-Akzopmucf<9zNoK^SqAv?Ob5Au@}-J+f>=hGbnoo%>9k#gVK z$=J5)!0bxgGpNA5gBb21%*4Hf8Q4#J`U7+?0{0jE{VBmC@6)TdgU$tg0QVR?><#U# zTNHF24LRl8X#d#**njpz+-oT4U;Y(b^PGbF7~59jt!bMx%eRGsPVVMRXB&QNKQ0tn zK6ijy@Z#?S(RWuvhbKC)SLc)ox9WX;^`5Eb-mA37CeDd&?Fx_&Jx+p1ZVHu-?1$!0f5eeG2+8S@rMJtDoCU z_fb;y>#hF_`!x@Hmr}o^PiB9puhbtJClinN@hSA(#kd93xY0O0{=(#~`!Qw*kPqi9 zpSxo~`B$6&dl(m!KjEh#d4vV}JJ@Gi zV|ssFy{9VOr^9vI!<)j(&w6^0bNJ3c`L@;YgCAepf8NcD+=)NFw)ecy(mSI!H&8w} zFMLhGyqhmYzT>!gx6E}XhOfz)xB5%&#LzXNdBXRWFSrv|U*b-@xz(LWI;<`!pZL** zdMq0Q&cxLN%CBt9#4!wiLp%H)P~{u@;COcV#KwL&9uJxUIQC(hK|0@fJdU$KGaSd0 zKywm~{g|d$=Nn6K{1Rx!;8+5h@i-1(nlp61@oXGhK{Ex%@t`>m$3aXJ)A`0(&cp+= zry$OrRsKg~c4TEh-OKxMs&n|j>@0Qv4)L=#g!^@LAFmMi4JpQ`?83IR&$HY^e6yGH z@SD%Bn)K#P?!#|JmY=n2b$^T1zea7l5 z`sVj@Pv3!`e0sHuIW>T})x*4F>~}oXS$AY=zn__79L6{g!#L9z&%iz6zk&w)zZV~- z{hKl7gRfaW_Y*I$E)VnP1)Ve=%g@^E9e-%ovo}oIb3kV+`iA7*vnaW zPG4tVPsEx3eY_$EKDKsPFZFfOI*OfLUe8(QM6iGL)W9dZrd~e@&un0y;=sCL*~{k! zActu7Ag*Z-^sIaO<_^85Z`q%sdOrVCe)+Z{%oBggceaK4JN-6epYDx;P{oX?BYDmZ ztdsraX?+r3+u#-4+U*s*h_4^=u$S|?0?5(zdQa^F&;8lZBhJ2q?2B8~zRP+KZsGT8 zrjz^oZ}z=x6a08jw0zsIv9GkYA?BhhuRKJtGP2k5xwyZ&ZrI78uhTm67W7tqCSAVo zs{Rw*>VT#j3A#T$d)}cxPn~`!`?T^0-n|a-nu|WV*+0Qr{F6p?4ibJ4=MxWNy?Siy zhewn>!Bg=PTR(H)$oz6w+ipMXhOdM3ZfDyI?N~?mIU#<$FC8kvnA6`mZs^?_6{AtC zzx~#k`$qqD@l^N{%^Q;+*wbtJC$x4^zX}WI&6s>@Sz%XwXIJ3~C)S-&=(N{#cGlN9 z4K+>8IMghv1>N6~(6A2w>+!z<{}}f;J{CVq>-;LdKcuvvV zZ=ct`Z`^|$CcX09Z|?o*_;*kF?ZYRR)sJ(r^|(&V(m#ykoUuddD26`YmbUUmrm=(W zv;;;{n(s@zNU{qV3OKigB)>6ECfQf|YK+JvKPpFKuESs4ax)y#br~V05;m)pY%_ED zeA{rRuw9SOyPk9YA)PuS{3dfG+v7uZesj*G<5K81nJd{IA4>9kn@b*(cJndA$^FW8 zcS~s%qX~P|Z8ky9`v;qU71szSYzpera>i~VUbu|wvG1g`?ukR3^A9!`src-n>S3~- zeEfW#KZ0AqpCr57hw3CN%6~o=EA$!p!zzqE$M)%;-Fp_{AJW-SI%o8AyRTlI-<&h) zxD@(L{2s-*{6FTX&-s0A8mr$82Q!)deLCm1N^wj%wsW)z-ng z?{(6%fs|G;ny|wp{Tzmp0(Cb2Y4=s!Q9|5xE|M&rQ&4jK7ft9gK5Z@=xhC#C7x}cD zv71Q!Le5~Vl5DdN)k_CgGxYgpg9SdLIg*X@KIQ=|^tt#^B33(wxECvmL0tS^#7eel zq{)1y(_=2B_ZU5<;gv?x?Zm}o&ELaHED3*>>?Y=O3{fG$7jJUZ#d#rfmnH$H^lpay zgKffvT(gOfo|994)J9C}Eac4py5tct$!EKytkuWllEO-y$M7TZ(qr(W|8;CVG@r|{ zC&e9GvNL?>s7ui_CY9HgsL_^!yt4$Ld$$y3@UQwXP1bQ1_r+8?hM803En~S#o)q5m z7vd&c1=nff7XHDW9%L30Zk}^n&QYg_EzGWwMPn}A)9a|MdbrgNKB`_wL0BEbIk+^L z@2~F1pt3ZQUtniAIZ#h2*EXM96ts1sOkohb*V{_iixUf406Uc0s=bPZR0AVMjL0YGRgnQB*X+M-+Sm>moh;M`B|VVxm+SO@hc+nMp5!h6McwGNq^iD%J; zec0GiyDW;ILSiHB0?N>S-`M2)jwu6k(YxNpKHq)pJ-YkqUA}V+R(cchlhr2Rxx_NQ zt9U=!s+%N4<9ul2@XqdSJ zy6(|%?vWxqfp=F|g%Q3&s(7N&l^}KHq!hw+S58jc&U|Ftj#_3B^^No?4)c!fr^qhq zjx#C<3~$o$`>&*z2muZDXj0{ZeArYeQc63-3jG{JlmhzAHoY=Jqz0wH^|(2%6Qa#=+g=YL zO5Cd5IOzS+sWL}Z{RJjL)kipFm++iGwY{+sW6lC>b4vy9qrNZT&{t_o?Nl0pPgh+p zxKnc7D#F|;4}nLnJ4Y3!s&^mwx{Olv{|bVBRQ*+whLJ(5S@$9D=IK0f(AErQ^#2|T zq3whqWt=;J4hu5Q$*1F=0B20rFJt_W@>4+VmE^?BbCs-kd7k2XA{j)|c4~Kl z8~pnW^!HilBoTfWwB>FrP~DHKy1?qnzqm_#8CyQM)r$UP;p8qoA;B{@DiyO25Gg0yGbyee_Y9s~&Y;nXd+U2t*Kz{7 zsRpA|GLs}T1DPW10XiSYLJ&I(ktuG*holqD>0umD_YpT&aZ@uy!pK)r^}pk{RBqd` z1O~-JA<0p%Bs`I3YDpuIaksgch}vl8PId}y&)ZOwXq-8Lm1+#ACTZGPpr#$L8%A>6 zZOM6D+6y+jG+pcb{i^XPiqTfr>3<<|elYDJ_ARRJX(O1Pwt}Ze z$)Ucg_I3GG z52yHKS@#|M@Czqg-fa{iDDT0Kj!~9n>rZN+PgZqQ{YPtRIJPo9S?svSK`Whfd6-{5 zkxpAAl_KN5%d@6Bkx7U=qI5rmmL4uVRpgD9IoJK0n}5u6trc^^gS5yd5y1d{Yzz?; zzoTeTi@0-XNh>X|ELs=S&+T)0W9&$6z02%1ki! zQ*Ljr>1t@}XsN!czM~DhF8i-{QOr8KYC5_)t7*qw;!@ky?R2$u)igV(=&E%zo+Kw%%>zPmcQgEY=5Zi{P=4Pk4zQJnH&{1!xqIUgV+C`1) zyPGWXgnga08rT!s;-EX@Yl{x4{jc%L6buNq;jXRkjPG)s9@KsD*(kyWDA3uc`j=n~ zjVI716skMxn;VofICY)a47;Nids)}QzO=8gbD=ZYnc_^v7Qp8^w8gixlzvjv+;)XS zKY$_YJ0zV38(WJnYU`}WjZmOu+e_6?Z=8SH*2ex-p1HR%U4YTmF(o+?HcBD!cNY;> z&X}Bv5Qd8=l}!3Z#?&&5Jk`lvT=mP5h1tg~ls%DU|KzXtyDRVC27H5bAifXbj}omQ zlt^X|WsvCViuP45H+lS9pKnk*qT56DNW1AH4P7CsOYZ@j z<)34DXSl(va5NY^Kj^MZs(cnFJlWv^X!v$g-OH$phHset*zC$+uu|NE7s`ffo zC<52ZiY0M)N0Vd)rn$ks-U+eFN^H9O#aQLs^D4c|u~V=&3j6DNi)cez@Az27%nFp| zKUq-;UOidOCQ6-4tnK4(pTY9?A#&X{@r48^`;m0|$F z+bUMhtoWhV9h+%4=N-j%TmFKY!3mDrV>%)7dB zy0Tynm0^tlzY5Gjd*SIw9SWh&4?*csjEKz=|B@~cEh-`I>Q zuNC3gcLib$F$e>;#=PD{eHp0xqW7~a$%HUP-imW8DymqWh8QeJ@$6k1^YT~Vh%u-D zUvE&%LuG#|b%15R7+O&P=Md5my9GijAcUd|LEi648ZIK6&g5{C?bjn{&tHysLdYTX zW~wkw|M`Oo#Z1Ne`70jkOMdx*ex+-VQs>H-mg-H!_YgF~b z&nhs}+kXulkiQzv%;Zi!R%R?-Y>Aj`k+kjp}>k@ z^n7gcUKt!vfsM;Ey%(_?dY1PX@WGj@f+uIvrt`u6ncIU7Hb=ka$zWgXdme~k@|+dy zzbe@GKQRAY6$|#A9Soj}cAz~O+%i{SkNT(Zt)1(d)B7)!2Hpjjoc{-OfGQ9KjoeHx zvO?_=Zz}VKGLzREyVKu+e!&=jLZ|ydF;Z6h}n$|DYQf z(La!F8EK>1yghmN?gJhTdyia0+uncYx)qt;&mDNecduK4%!B#6?mhR0KzO-*Z2J>{u{6)7x_Gir^^kH|~nym~9xU7f7U6Pr)`AOuQa97Cinb z5PuLD*)OxI0_uMeBS9XQ=@qS@@O$U#6;$}Qj1>_5=G9c|odfM?obJt_3E}mt10#7t zpflmr=|!B!WjOo%A3_OLG44nu?kcToA__0m1>^It>U?mRf#~d83Ll-sK*XC@M(G+E(zy2ncTotC)xvQn<1$J2~ixh~(L@VFmN@>}ATCjO;Lo___MSnKKUmJ>mgJoWaDm*>2Q=ep-|&c?oYrj#GFEyQ-UbvR_fH7yt4)POR``ztZ%{ zex>oD3GJoe8RILMrXOY&{k*5Yt@X>2@$?r;QuL3WlRVE*rROBiCmK(lPc)u9Kl}&$ zjqZWi=>hm{D*O!4_cO*Ps86+Wj}^x52&_MkKAg{ANpon?H4zwni#@E3ZUzt9!3 zfYTxOOc92o^kssDk7R~}ftz+1#kkF99OE{hMuX28hFr;#oy|GEkt;}Ug%IJ`W#A?~ z#RVmzH}UNnR=COMAI1MA=1=;Y{3{K)k|$_k8ob%SP5pPK!5MZ)?qn(8n8$g0TqN%8 zaT&t&;%|jqmZSKUl+)S&E^cR!*JcAZ^?cO8O~2a8xUGK=F4Xxh(yb`6q|*aeNf}2)+2Q%x^-!hUtk< z8RzM+p7Z@Jd?Vx3FIvkaZRZT(W_+my19i3^W`m9r;i4OrN2S554BU)s`M!hnA4?24 zH8VZwZ{l5y6a5$=#&MZJZ{lkhxAos>;FAqLvi=i)84Ieum+46#6Mvm?vA?Xuy9|07 z7r}QkPWsF?&YbrIO9R(7?_4VFcs0KaXPE_Gfv{ zgZP_q5n{b?kIONyQs)@B#0WujoLfpGI|^OiLD&NTP{*5BrHc^aI~OGO`3 z?)wIQiY8H?6?_Uv{7wA+H28m|!N>B6h|TB9H2BkLaQrx3C7aLOG`Q^5O7t>E5rf|u z^d>%nFMVx#*@M8wf0Bm&Qv+AOR?=!a7xS$I;$z}>r@`M&gBP$P+I(u$;NMMyA4r3r z%%|Ws|1YM&=_TBhh~B(PdM^z=CY+jH_71f9d?yY4M``d$k<|QeN`wD24X%F6m7-tc zvQzUn_mGpdk0>88=uLbmU+PnTP5i1f_#>cH*DZo>_n&gUoz zF5^9#anYxp%aaZI6LeGcIoqP2%Inre7Vh#oRBz$>KCk0kX7Cr^AOWikdfv7{$^Ei{ z)40=KAC$gk;q+hurEgpKJzRd=!nbo-_COaq2>!f9{{WYNX5o);nfCCYBzzv@avx)T zr+YGzhA=Mlw1)8~_!8ka&I_nRzS9?H6taq>gbQ|?D>vFQ6UpY0Z&$M_Bl*WW8(Z$t|(VESDaK8W%6 zEPM##hb;Vf#xway`WLYc=pcHD-BxpZX(zbYa}@ItT0{sfn04@j~<@z3Y;{>Lr)7~{_|E_!y8l1RU^@QoUFJ~Z%AjM2ek zelqUgWBcQ2VwFUnwOo!GIN43cMXq;*{#B+s!J?P>dbEL4e~0i1*H{B5{^Ez{7&y@{ zWBREEPV}-D?`#X#-yb{97Y&^F{E+!n8#wVP;qh%_oa{_?YsVj@n=Skm4Lh3*{8Yy1 z@Lh}lkJ-*!EnMvRf`yCS#IB?d@#kT6-nZxj%>ST;3xALMO?=Gjy8(>LIDW|Gp%y-e zulGh;_y)!&T6hjGz~?b8avx$F&9m@A#_KFTZ!rH3i+(=S-(u0f$8vAC@NYAImxX_k z@%t=%C|@6b*TUy9zMXNqU%$5SZq{?Zg^L|}bN__TR;C}pxWp-a4@9ZV!e!n&%fe-T zn`zX}K ze+c6eckRrl*rFFdpJLHJ&-Vo?Ec`mg=UezV#{b2_4>8_g;iIy(A-WhB{iR=DvG8uT z+d~#E^eY0 z4V>s_GW}HsPV{du{j~;8^i@oMi-qgo72yTAjFUf*{pICAU$f|Cez?b?msb~k*TO5o zi_+5uAJVgf_57(tf3Ko;9J!B2<3;yRBzbZIZubp7XBKSw;1>-oTtN93*XJ<9s?H}5VXU>#jkc6_^F(ygUF}xB3$&} zMU_Z|o9CZf0i5gNY2w?i-DW|@SK60<1Th0x#sxhp-hQza~$b=M8VDR zsx)wOT;%&-;$zxhzRx9GY(;#}VLoK%VM>zzxWvFsdtPDSraf;raMPauZs4Xpe`(;R zJr8DT`J|6&&%VZanrTltFC}`@p2vscd`x>jZs4XpUp8>lp4GhW5P#F29~ii4Pp756 zrMCS_r=+fa(bC1$HH#K?)L-tDsAqjkI_jHiRJJ7H@z?m%ttGW>EiLtUgg6D2et5UO zr4x?>r{xrX5IG%*@eFP{65}!CbR_hcF`hB*Jc=f1tK~W36#P>^aI6WnQ9Ei{7uQ3y zE_HTwkSglIaFeR3wV@62+vt(t67~48JWWmy{w7z@^TE~Cc>1|^Np)@Gl4^PU6Jebxo1s*1Gz;U}1rxzf|e?H%Y-ga1Uc|L~+dOP<0AN?(42I)yLPs>im?-ZnSk zIc^QqH&!=v)U-&ETrbhz)KlYTR~Ij>>8Rt@+NgNET0Jz4hd)bT;I5iQI9}O8#}RcU zWfPqd-6a!!Bi43yO;9*KyGvAd%;^fiXLpIpju~%~myK7|`0OrG*)gY4woHBEqpoDk zI0fLdu0(x|8LI$%)|IG_F=G^?0p9!&S%!i*h z`*U2!@F{sh(+OAT;t#D#o(_Fl`aY5{o(_Gy+|MOuWW5%2Ix?TtzCZ~1Xt!Sn{ZqBS zi0N~V(tZuv+dQesYW`u1$fw`<5FJmy{`2tj(#UTlCP*Xn;s3DrCV){D*&1-&dvlvk zXD17UwF3c?2w5ONK$Z@h&|wJyMpVWSl0X81KoSsT3lN+@7$Ja)f-H&((I}(f5Cja$ zAR-_P>M)Mu1VslG*~F13%70GXI^8#w?g8JM_x_pxe+B6}_0_3!PMtbccj>-$U7xZp z{N4lYr|)}-akU`Q2@pB;hw^WPez|>};3xY@4B1clG^p_8zw4rb`Iv-|Z2x2r81iiq z{+oyeNa#O26p>!C>pQ?a>5oPbQjC$gK4txvp+?3ybB57mqLFd^en89mlR=Ls{dC?! z=hH$=BV7s5*pvQ=LjP)${s0g9@qEgY{yiZ^Ls_<54)UV^vd~X{M*ribqTK)A0p>~n zKB51NVTS8d*8d{Z$QUwP#~4i}8X5OLij?*D@-lzciGV&Q+EXU$!tZ5e40-cB=nn;4 z*8d1#p87u*nIX~jh*4^+YdKVS(tpH*{&3)x^`8Ufp7e(yGbCBIT>cw0mN9G>BW~=O z$G;iivVQ!Y!IS>xLjMI6W=gWI_n=P3kli8l)AbR?A3h}^>t86=Kl%9KBYx;|9)+2b ztm{E&FJs6)bez%1tRJ7+k@ZIb=BfV|gnqi7Go&@vh1YqW^r!#IXhGkDWB*&jpR6Ch zw?+M34R+V(Sn)^++GkG4i;41|fj}CjL4!0~w11%i>TXByDlhHr;s-?(Kg3V=Q+d0W z_9>#h`M1N^25mK`S~3647}6!8eJUO31cTiEb#L?k9;1Ond|!qBZx4TDKlKaCvP^8b zTU@+tksK@YE(Jiwu>Cl3(bf(RI;JG^E(E|+{A}mDjxlywtb=HONBEQN|FswW52P4M z?UF*N$nf_=p7gJuC5(pn#Dw}|;7`^+P3TWVCR2L6mr*dDUv*cIe#-kn71DD1iz0Bu zG;#@`c9g#d1ko-gAO@L#1Z}F2d6$UzlZKfM747#(4XFPla)FolTVG;uq>J|GKMVt04;Dk5%J4>?Xo{{uT%D_vVFRIjYoA-Hz4vRZ3a4%1Zm%YyZ%v zozH;k_WrefvAyb}R%`yHeUX=o7avJ}wKqe;$LBr2sy=7is2>h2$_O02GEd*|!k?G6 zjXYj=-Zo)BC$o&;F;km-{RCNA9oe zk2RD-N zAEk6Lyo<7J9FEPuN*>C(safFtsG&PhiEOKS&VWqRJiRy3bt_H>R%+KEQt?#PPWHre4TIXZV&zU7|JYXGJxNS<0 z_nfEU9qI2+KIU8p?-$Qu3tsvA`1hQ%)h2#x)nG@Sc2CAU+;57{!dFfx7QYVpQ}!HG6nO7; zu;1BG1$?2@3<6u8W&VCEl_=X~Rk8W2{&6Q2HSVyYg03JNyayiavcw&R_iL{NzUbzQ zLk}mPaF%sG=sY|g@|=UtlkooVmGEBlO4uuSCCI)Kq|{t!tJK^D`Yx+UwrCb&TMd0G zQv&0jWlj7hGry|Glt5ba|CWGB&EF$hP-<6@yc0T3&u*WgyvpJC8dkp*P zcL?kVQiH%(ieCiKi7deu1@$p2DK-CSsnnE>|Ij%Yu*FRAiw664!+1Ok^3je*;oa@$B3Ff$b$$=}^&aT;@$-Rq zv8$jnQH{1;QG9IYz~7&O-xJl~xY1y5DvPisf$qUzf0C-irNUT6CBNy68vmv<3FIvX z+1b{GuYjF?i<_5)c7qs+>U_uD}Fe}*R+7R>CiU?-UEM0i3eW=+Mus-iA;^d zF~YG*0$&BI5%3ohmjv&o9}Ko9^*HEEx)=Un>`z8M5*i$T!ijweo_xajG7AD(!G4$F z-QibYTrR_S;JB<}iMBr|!M1^52k^vo0Gm6)xIYW>{adUKeHP-lBfQ&wWtWrA!^x+d z)r#h~G8gFaNC)}-0pj&Jka>(n_`L_T2Jb}u2G)cN;9K~CQXoq#zM1pZ1~K0kJJfTO0m%Q5Fgh>I6LjDcR>5DL@FTtF?40HMl z%=LpxK-?uov2FGJE$9xgMI|41b{T)%c^1|H)O!imgkaU*FADsEvcP9H;Ez+l7g3#0 zI^%OrI$wnTUWPG04t~4<;IBZx1pjo%L;TQpBjA1Q+)h}FE`qI>z}CxP>lLu!EZF-dw^g-04Ys09Xzu{9 zH%U!|xDK|B0K3s;y+XIrld?GlH!z6UmB;hp!RQ|HHy)X~n{^l6l^6UP&5y#%&i#@Pula-TxHa-T+lPx~&29SL&{=hRLZ`(QEl0gc99 z#A&Rs6UP&5y#%&i23xOyEne+}e&Cp6tfIXbuRKnnZwW9*JjN-+C-*7DEB9#!^eNa1 zbL+O_w2QD6{BaTN#rcfK_bXtJS6iVk9&LsGCBPiB5(4YJ5(md&SPui?_!sE6=&$Swt+jAJg`d~ZIn6XUUx{4|=PmH}?9VrwT^z__ zeXWifrPgu7_Tqq8r30SV1o_#^wgkevul=UMy5?&In`#-J8@W_{lfgQG-0J zR=IH={0Q&H_OnK_8u&eWC7h0Xd@p2` zIh?@EtQn!o!uHT3Ip(Et0VS!LaTl!~)jSk1bK?+8Du8Sfy! z4z{dQBPxp3h<6vM$`y^jiyQ01IB&74oLclVy8`DJl|$j2@ibh!YzKL4E57F(WrlLT zYoi8&?E|0>sl0zb%{#Om&tpCH>(hV3evMI#eo>#y{lUIse{h`4xVw-0q3;Teo65)S zJB?Mn_V9o`-)ahs8>_Mfmu4J^aIEo#accWlHp|x$TTwMNCgnVg-&dB>3_Hjlpjgw+ z!dT$=1b`mI)NqzTSRMG9-YbvSm2lsudW)^J?;9;x{bQ=5rX1qnorU3JmakEIy|XZ2 zjCJ;7q01jbS|4Lu(0t7DCxI?%JqF&W)yuXZcue^tN-ygI>ll)|;$fv%`3j}i@=Xff z8Ch2z@8|{h7JHRPI3CQiKyHIL1O7alLFWZR-Vb=1Lf!^=A|MYGJS_}5uMOlQfu|kh z9f7AK0c7kWBLFdhYe5#{nsKUCJZvx&TD31i* zIgoc0ybl?4-a^*v+Nc3A_7wAP@tDUrx%rj~*KgJx-=(qoYolxs7pm*J4bKCk#Pua! zx8ZdoUTc=-PbQn@lCtlX>*GoHCx;_nXD#Gfn$~( z>~019N-A$rZsD6otyZBu^o<`|&xY3ab!byImA7F{;rGe2?8$XAK5dd(&3vpQZ%$z~ z*WYC|I1fJab5x&Q`kOuzTTPl#xAfsYXLU9<%D*&2g?`kD_&pE(x(0u~TZ2N{ZVgKM zGTS(gemTWa6AQL~3G%Grtm$^Jt46h^l@E*&$GT9M50QM{)PcXwieu?qHL{{!jeHkw zLx)9zp6j5;sBg}Bduht4{x{i`=9+Q*tbsXJ2W`)4&0X@=L7z829W<*J=I8lrN6nva z-fV{B2#?xj;a`8n`gJN_kHX@vjT#5>J{IDB48(s1%!AQ8 zewvrQ|b_&dEcAA>UAaL%01hb^k4JA{jFYDU)AJ{ za^KRX2bLv8zqP=BT**r*Q?zevW;iTbP4O?dW zeW#SDmhm^HcODTMkTPa$u`Ty?+tfMn@4UHqS?8iPThG7oblT(=+hgB9DGji0?jrV<97@v1> z$*PjV>}ThO%{@|PRo`Cu!_5P$zb;7M_Wd*U2d>VYb=YnnGc>hJha5Zp_{!eCLr!ly zo0(ONZ)m_DSV1;`za7I48_dHi9ZK>GXV^tW)}(A0$^SxvhB@#*7yeI%|5M<99{h)w zLF7+`|I^@q0sNm1|7XDeLij%u{?Ga^sA|vz<`PfhDt>-{UwyuRz;SC40{NW0vB!1&0auUs7Y_v$HFzjtoL8>^J}zDiAXeDdp;+O^-Q zWj*s)vxheB3ci_jm4#PF|8{EDA1x_+KCkV#*1zAxUeEM7cTdjEs44%r@Xh;?f3X}q z{`QOsPlWxrX7SdyKP~%HzbRKrpB%dFaeJW8^j^o_4(WVSe)lWt#5CN<;2VQ_chaP^JcS^Y!6f~Mhv!Kzm zWrJXYXKF+uV2~haknokiIRe`va>U*j@k(*4GRJ13Q(V2dkI3Ny(%3xfW-5$#^AS10 z%twV%0is@_%UoF3%|z34W-9Bpndpr!z8;&2-tNMBZYG+%q_UJ-`bfCJ^}8q-wHSfb zidw?Jj#N24SsKV}Ql0jsx3u?4B%C>|F*0~}#UL#GVGJ)b= zubbD4!gez#Xjdl7r>RboZsT3uorSRZB8QhoQ|nqcBq&!VE2at>AJ0QoE7(qo{FlwS zXweGh9Fe6iD2GTg9%bKp8jAMJE(nFWhLr@}#@pXX%0KTtaZ&EghtxS!Kli!J%c0hk zdy`^!HF5RGE#?1XfqKZ**F16y<+pZEx}A8%Zvzx|+fHsJn!->KNxv|-jj$obGldjm zHK02C_m(x7amUtW#m@AX}O5sRT99|($B%ZHhQrJBP;r^7R&_d*np7CyGgOZz2 z{YpW=YCt4OgN1visNE&QyJU|h(k=V82aw_g<~@<%6P{oI=>eeTZb)c#W!}1; zA~+N_hRAdQ!RgaLQsy>!j7y{-WXU9^k4X&C6f2}ADZJe#C4$k2Q!0^jZYw0$ z2@%IcejCT{Qo%~DGPG|K=pK>ZmUa?F0Rz*PNVh?^j2#MPYJ#Ur!U|U=51!mcW5JGF zHX>=%_&;?T(et)6oo-`kq^?uY|JzL?GK{7ZPHLhlQvctWjW>knZfib}!88d>^TFMR zTh537o70BRf6<)oEXE1uG?9B;P|h}SDzfMHPf2JjX)`k(08}_B*`cCkw;um z9+4+qP&SdI?lv4qx(*2`J}emeMJ3XquzVs(hrviCx5oTi4H;?N=h7ImX3=IUks2Ov zR3I(J8Pmt2A?f6-x6-;!G}~~mNP80 zf218O4A;R}>;f`I1aYy=LP4FMpV6`A0WM#p0DmOPa<^#F8Z5@{jQ6|8?{27X>A@t_ z1^dS(H!!L-6itHK7@fzSw+&VNbVIq_q#PbQiIRouowz&Nx%#VPH`=3U>~FN_FR)R6 zJBa>r#*R2Vpotecxq8NnF{YmB*t1v<%8j1Ixw^tz-r@GL;p5KObF`<6jiI+-KMk8u z3|kB6fWgxm$m2F9i5QT(E1EK{8Mv4m(k+>_3c@zYKm;JcUIqJncwk$BA7YBro<8`I zpg+{8i+sgRUkLCt0DLCFhlA;O0cp7pJ}@a2{Aq@abQn_yeE~9>Dx-N}@H$lHQivQ%A+Dl0SPa)OPMk)yVF;<| z_}HNmZqO)7kO&)&)O{kphJxiEh(PigfKMN?0-xU4Rh9rF>(j@0iuz8Z`&v1E7t;M= zIL#kz><_PMMuWKXR1A(wv zs0D9VSzCCY;ZELn?6Ufb;U9zc;rJ#PCG{1n9p$0l)K_r|MPU&W&MMJ+i_%VvwM9V_ z+lj$$qM(HVRnVAHppveAtE8h9aDUho31?8;^ftiH0|56T+1_IF@#f&22J|d<7 z(War6(duuYtLf@84>e^}V>~ghhA8M}g@3OI1?+)AH|6#lbf|I&bmL=jObzD^3_8Mu zH#58tf%DMir*lvc!#POlgzYiGTeeY;yF8fda+im2xiRPvO8c0>9Wn|1}TA zl5)KBDY`L=ci(O5D5)#y%HNupb}&{mIDZ^TQpa#N8SWd)X?LAbZZw$7_>h%(7))1< z+vDgm5t*x8k-4ftWUl5W2GA3mXqp_EcOa5HM8d@vp%;z=T& zBjObxI>Wp>067oeqd;`|5I!iyn3so%fT}x`5H7ai3eg}IaP3iFR6_if!rO@ioFQC0 z&KVYiD?FuWAk z9oM;U-M%);iE1Std6;@bse+?UqPD6Ii%k8A550SN_<=Wfmw%L&8oB=V%1K;TAJ<{Z zC_7x`7(7{`R04!*RgG1cpFVY^MOtmCHoNV`S(=h01J(GWiuP)#zYq9fGtTb>JPi6P z8F&!v=D6uZK7cjn?9Fca^*# zRKkHhoe!Sp6~P$Sh$mo-b)3`g(=CVT6w3}B`oHu)>VZ*1M~$(^#M-k9VBawNoZO;f z{E=Bw*Z9QvBzsIj!JO$`U^}v@x!EQ5x1v#0t ziyYX{Be~0*lq`7lMgfsM^lGcr=|$s9B6-ocq;?@1q= znTh**!6W9Gv@4psCErR-s>MCiVAHWF_6G8c^B>9u>1JNsMh(@b08aKb+VPAkL_^qH zt*E3p6E~GZtFueyvXa7*tO5oVCAkdtP@9}v#PW-~!lqzS)9k_-d~ZDoHf>>-KLd7$ zWAIbM84MLn&Mzon1-X;m)(Io{u4s}NY*0A61O?>I&2QAi*phEjZca%-ai$PsY|SRg zF*@k79Xgp?G$X5k+R$!zQY$a8*cMJ=Htp-@vBss`uv02#y7wT=DTV-{$dZ)*Bf7`J7c;KKtLCTzQhQ)2JcvHqcb}bx1LCP(FaciJ{i2B>Bg{45l_)LJZ!})>K@QaQIsD81297o z2zXgn3-e%wEzX&iFav%fJSR7yTYT5}?(sbmiXSX4Dl9BXm|a|ykUt~4V0KP!LRMB$ zb{?#UuqEQ`xm~d3gh~0ZRizivjh9)kOZI<9gs^Ucn4FBk51vaNoS9o3pNAbcW+iO5 z2xI43E@zkI7eF<*RaA2t_wM#}ov&%#6x#9n>I0r^SlLI>eQlw-K0;TPdZ_*b zgKHsMgs!MDp&qJFLUoWW(xPo&v_w0@mgv4tAe}%u^`NVIutkepq6cYHoOtA2M>twc$h6v0>J^L;f*DjgEkd&Jo%} z&N5`O&M7T};*f`jSRF%#UoKOJhC#n(suRKb>V-~=_IG73Dt-bK`&zUw6{k8gY^Zh4 z(Bb&c+PiG%a5X)w6vgZrzQ-utMs?X`iP>|Rn=&6pRSO1FmM>hwEzn!-;eBOb)n2`s zMf(Zdq3_q5-KDp%SkLLroO%nu0kbT#XrB$jPa&}uYJ6?h zLAw7)i&nQ_3CPzrtKjVsX}a%lJt9pH+-K3wEC9c2+W~KBDbqXQC^+?S%Rcnm`wRB! zK^E<0)tRR2BlYkyJ?H@R>LCcJQMx`D+5vATkOpI@SoXs=CUQ_8<~C^KtbP7BtN>#` z5!eLd@3%w^Yh=zz?kp|fszrMm`UVd97&;z49R1NcLyy$vK=+4Rv@PJ2))wtE)v4dX zJ)%7Y{sZK^3jrUM>Aw5*!0X&Mw%5Qzi_;eCA>ZlxqNRGsa9vMVqeG?tdY~E|2L5td z(qJY>hkLLQ_Ji>9O`+&h%jX=>*x(h7}0utx_RXtS8 zaq>y;tL;}H7SBQVU?T3qV9*MI)d7+`0(_BAYB_5*rP?B3NS zmh?1m!>=GBT&{tT(c+ijQgQ@(4Gvl2vjhzJX&wZxMcdB{Z$bfr@gQ?*i+!N+0pJAp z{=o;M>h*bQw894nPCEWc`W_ClKJ3a(nWYrZb66W0W`!JY+X(N$aeE`&cn4NgBiwkG zU%N*5CtObZM)(1a^LvR6>Z&=;?v+TNFdWYlgIII=?m}wry z%fK6tmw`9-n}Iiu2Lo^HPXll4PXll4PXll4PXll4PXll4PXlipZwB5t-VD5Pycu}o zcr)~Y7ka=OuP4ZakA8bf zT7$PK7#x3wc=I$WCm?P;;j6vy*LmT`clmje1J5SIL)-57q36bWd*L4r^Q)=r&CteI zG1!BLfWN6}$M(*m<2uLPaY8fXNvLmXeDlva`E@%`dpSRGxosZB`T3;h{1jm^+T(}9b zSHXi>bD;;13ue5Pz|jw*P5gN#Jl%x9Xu{3&agPainE20l!EcywvmAQB0qsvV$!P`W zOPJ7pGafB)c!;=lf_9qa-0cPby%+o|FLQ&!RL9wcbf1-LnQz74R*^nY!ww9MUHq1&@)B(4ik?27etwC!+s?R3^USC@_!U{bX`FBMS*9FoNynI zhiR&jx%$;y;138K^>!09W{(S+!^Puzew==i5&aYPPE0$e4fzWgbybSj@p~n+{bc7@f#bNF z&krX_{3W71O~T0!b4)n;d9|UA-*5M%ce&t~^=^^mP<+2&;y0hK)|mKlyjF-Zo#&%} z(4IEJ4|JYSek1!&o8%xr#p|C;ILaR(;_Y(@?CZhC;h}fOyE>cc$&aTKkAJIy_6=3dg7<2*rrN2`E9O*lYhzu zPV&X+H`{8$<47swyG(M>Z|@6#?U!)ldw0eTOE}s6o`gRq%5*;&`-So?!l1Jfe=mVw z6gb+CcFu)AOjc1(I9+$O6*&3rb7+UDvxJl1QY4(_`5+0$@1-!MOSnzo6C^xP;CT`r zD)5H{j`q{B73G&p{09a9Y7>rrTO`WsOgP3f^=pd>NB+Nv@-`EW{M6r_CLH;DitDRg zCLH<64~GO!_S5}`4@~?hXMvFOiG;r;@V`sAuQ>6!Ea9UBUN7M<3tScQD6T#gI6U{y z6WK}e6DQ#mKdC0Xv(c1)jxxzdKhSz~p9#nQ#)#{^OcQP%muV&(`DY0JLKBYs{l&P? zGvUa;OYko;;mA*MSYg7EKTKR7t}@}sKUU1E4HABjz@InaDCb@w=LHjva(*rN;rFFH zp`X!jbl&)ZguidFu?r@=i@-4ZL6Uz(_`!$98RVm0iu0xtPJU}AaI^>Ii?CsLO8m`* z{DBfq@+t06PCObY(j*f<`scU8Khq@qOM#b2c!IdzULfJ+0)IrpCy49k4FV^7&Io(p z-5@*>ZWnlsBqvtLc~ina6?#ufa!Q4q^Ai8_Le3Ql?;x(je~|Ex1ivQYm*(j-!S65O zn+4uN;M6bbZ%+x|ChQz7;lw{p!p{l*B?718MQ0HYt0bJ($qf=t>*4bfPI36Egwy%n z8xl_O_O67}y#AAf4-s~LE^zcug6I=w-%9*V#611cgk#*kFZ_Jdgya08{`!gdrSVD> z7Z^b%9Qnx)EloJepCkC&nsDSN|KLk*Fp>QC1b>1FM}G2Ke}Pkf?bsO7I1@kW?Jn+* zWJ~x=asQ=6!oL#uVo5&5&m$6UN2QQ9OLBfMALpvXUo3DY<~{k7`rAgrX@1d$)-pf7lmZjsG{5o%PV*~G#O*8z zr}$rBl9OnNL1VUF z!ttCN(-!_|_`jo|G21TT)X$wJypy0Y+auw_MY-05#|Rp;BN9%(3q5JVV+D=b8433h z(S2y-N1W`Z z-%}tSZ{m+J$w8djCz^2c`CE#F)9;5ICOpw3f2f4h?^Ig}9v$k<@kwnFH^<>16MwWx z{&*8^j;jI_ZjPT)6K;-^?IzqD5Bp5GdE9B-&`$IC`iuS|ZXQSSC*tPuqV)iA^SI=g zNWfG330qd-0V-| zISykTF#8kt3&Di^W`7UqFX2Q+>OcB?8DBtYQizeLcPc}VwdiKl*S$t0J zq}fw4vnEX{%ALdF`91~lMY#o8oQ#(q(|13CAD>+~eR?izgy50S*mNLwdNJ%x@K2<< zw^Z=XWZE;pJCkWE1@BC_Q3C9eP<%^^{s{wZci=&bw+#~vR>RFju)9Yt7+{o&ON!7S zzLmwK?CCRwUZXO9#^gc(3UM=oc(HE-ZG(Z^6?m$`-3>A`VIzm^X_?u1(=z#%2Jtfr zOLF7y8ab{DulOgOGhFRaGVGDSW)?vgC%ZOfa6JM3P;OBn?6L7r1dH7uJcf#~7lqkL z@Ju`j%gxK2T$DAPiWr@8Nb)T)%$=SxJF6&%!M+f%IfSsu@Foz-LZ8|LEG41N;*{fFp?m#-~dg^eQPHFsM)D_58EJ z#5dNVU;GK{omlc3G%a0Z6fa4YunaXw5l})*EJv<7hl^@Rh-J|Q4g>0+wQug?Gzhu< zE?CDswWs52@GaWE4DDr^*d%z2(UA1xck#$)HDK3sY9(Iu=LtUZ+K-T|D+~OK_KV95 z(aL?^>A*@;qW(}`2z8$NUnkn7o7y5N>!0cYL%tZ%|5_|S!v165<^JPw$&>y>aeN() zjZI0`e*@}d4B5|n&~F1=){o~Qp7hi2HtD<>Wnz+b^@qkXhJ4${;wNL5jg0r-A81*B zJ1_e4kQtIJTQ0ZuqJO>k!G}5i0zsavzXmW*{Vx#u&!7>eBVnSe?1C^g#JfcWc@?L`X#UbV?(f&`}stp)L4Hiw3lr{-qP_#3$uRwjg_oF z3NTOohj(oAMAvObsj)7+p7W%?`MpL9`d%FSkG!(}V9|fE+!>AFb7i<7h5x8R)`j2e zBTH9e5cx_RY)IzcPGgzGQQlI_KUx3VqWufl$dsrZLC*nznB0DDGlPTTkNBzoR6gjX z{c6#^mKa4Y>&M@Z%NVkz3&rPf(wUOX`*&zB`xM#j_ZyAoionG2YY%^9KlKaCvP^85 zEG~BG_cn-Ol6jv5K*o^oy0}>Ty&sm`N#=bN08jR>&oSEU5&cK|JHnrAKmM*=mWeH2 z7J)NSs+5XsDgd7Jr$2~N;P*}tpO{d84E)LZ7eITInFxR86eJ$5px?_-9qFgs0TrIw zKaLfU#4={uK~JyO@CZ#$hhGX_@y~5r1<0Ul#4@cTOaM`cGy2U6&{S)y+3J z=sqa=4?~LDQ~a$H`bi$;TLu`^3ThxKWcycn(Vw``XkgZlAxYv$zZJ$8L^Mi?X$Dj$ zzQ;tp7*cY3xbW%@+gWDE7be&-CGt<>!=R1N9?8iZ?A9YCsRySf+7=BSK15aAJyO{3 zJ&tAiQnz^yPC8({gm&=$_O^Mfo|Wp=tkeho;JxjoD*P$%$Eq1C?OUs5emD_+=ApFY z@8%A}aujpm&lanr*nsNx)>NR?YR#%Zc@UHbLfHq(T6IjGqduy1aCN(w+P+rMqktYY z#*m3-OxvIO;|qUY+V;Vyg`tth>+U8G)nQ7WBJgWuCs_j_d1wF8X#xpDR6D zXZHSX)U(!i_I*3$3*V`CK7X`q*-KMie|}YcPC&f>U$%|<;Xv!5yYEW!tGzj;W49?G z;p6juXWElpQ~5tn%hkzf)*GzT^I@PE9J$Yi+BL-m$dpbyk*It*&%bf7zZ@ z#-_5$)GMp{eD!xrr33TlEtLZ?pJJ&T0C}80t4vd@71K^-UY{0F`_UcwG1sk8tg@}5 zUP--qb1cf>vQyQ{IN(cDGOv&9K6l6P#S=JR;fQzFUi$9cqhCj+9er6pzV=eo@uSle z|B7!~kAOU|Vww_A(N?iuNmF1g`1$78v(r-RFK4FKU!0O!ev?QtQuyJ{%M4R#y2XD_sM7eN-M&5?6FkgIBCo{HlJV_^sH+e5yWILRVjz>1}_j;&2neX4vQMzYI~fvv}mqMZX%-UOe$c@%tFk-hEBqpLxW2C`=| zzlv#4e|eNr|8=HPpTrVZq_SYp6H=wSQhNvcv2r3O?y3**oQ^o(XvD^yikF&gAP4gN+y4`BZAXZRR> zdltsy8yFY#?<8oa`8w+1ooW@a5U2g4lq;7Mt)e~nDO>pF68Idkix7X86tyB)jR(5} zxqq&}IH2Dzf&V|l@lgF%d^+nr@Qqfb1vu&ll)ra$z()83`%m>cu{Ozh;^;F>t4Mn8 z#L=0cGZ_3G!u_sRv|~vt-cmwVz$TzoOO&9hWl9j(9RPoN)iUt+v*70|Fa{T3ES?2_ zKMl6)A&&aQ-lx_EJ5L=Ae(u!KGNxB71^L+^+o~v)hTqi+C(xI{?_Y!ewevT}epbPD zSff*S*sKF~SQWpDSeRpei34{yA;w0qfQlgNpdHhc;EI*dcWbn=1N%M-#>1AZ?(j?0 zb_DkE*--~`OSzXH)7RnJv3+UgbzC#>ufJmb`XKxy6W1|VTPkmiO5O3(yf?Swx&w!8 zyk!vf)4Y8t{Wj zhK${AanxINRtdiktcTw^CR>9`Ga{7cX@65gzb;qU*xwIOD(eQMRGihqsy@{ss!(5@ z7G8B$YsTs8VADD^qM}%hcz2PiUeTb9Q6I+Zi&gd1qMwy3>r}OJD6Cnh;oN0A$YZHW zr6Dtv^IaP?5Nsa+eMsGb{rqX(A>Kbv{rdFZuwP>oqhHh~bAPa}*dH7xGw$x=e(1Xb zMW$~er1-gBetT-8Iy7z#_y|u(hNJuAD~#% z&Vt`?eBf457-DK9%OI={#_ueQ8`k4_CY(YMDDC^0>ZmV=Sa|2>*{7Gc z(|W!0^Yqi!?>=0+yd%=Nr)@vYJ-s{*>0h5-p=!NsKg~S7JRZyAPOq?FIq&rHu2>#% zdW8+k6HhPif#t!cR|H~t{ORSrpAR6TTifE8`uR-VC5BUL*Hwp6lLEdD@BZR!EK*xi;8H9nnBBDXw9HK$q zLk69<5b{qz-V(@XfV_txZz1HZ0J;ardxS8Mw}xnt_ZZP2?@5Es+XVT~An$3&7lOR! zAa5h&RRP@(a`sx}|z`-BKU;)8J2qKL!3+b)8n)ci_M1{1=W%)n`HOXQx?BvdVUChP4^i zlKS?1eP*!s8fyWp%cnNO`n+4L&+o(fd|qRf#`+u%Yre6L*8z4`GuCRP#r3DhW7Sz$ zm#&RU2fvJh3H>jeq$c}hR1lb-^@OP9a(qWC{%X*Fhzx9qz3Wm12Lx? z*Be@sQxtbF#&N8)G$V?YW?3;I+l4WR*Hd+x4Pwm~{;crV1pX}W2Qk^H zwC_Z?zJjk>R--)l%42n1XldV4z!c-UYc(8OR@ViU_T2*Ivu#WHb(sw@Ke&$oSP;-> zTbA}s1-hVNKimvRQRabSPV@uV*VYXLU9<%D*&21)J+c{Npv(HRy-$)}YF^ zTZ4Z0Wtwp=_2noyUxRb0FGsO@E1YL-2YYH%Yg+lh7;(N63iBzFAA{?_Cuha^)Lb>P zqF#-B7j9jJMS`B|pvS0h&Ut%j>Z$%Wl`G9P;~WaUBimI6ZO>}WUGmmJUpGG;G^-Zo z_xUtO{hx2%Y=-BNutu+mh3m9-59VFRaf%Hr&A{t6CDwNX%J>v)=Y9cuwhmNIA#KDG z@Il0QCIG%f{edVB@vl8wcapAomYj^Ma%kss~{$=-J@oXf9*=hm3uafihOz7lKyL&FP{F<2luynVSuVVv%adynFED02P^k2ZMyQ6 zb0ZHdON#z<*Ub;!THrsfaQVEeCBHsU^t;C*?)>?8pOkiQ`gVusEgx@K*D?RSk}Dey z{?U15)4}`==RWH&D&^t34qV#(!ODumPaO=(-T2}I$F}-M&sOiar?B&vU6!7EZbnsE ziSzv*Q}=(oW9Nk3V?vgGR9-*lg}+U{m@&HF`rxj+x=cTuw7q}SkL!h`+u1=u@EqDPum#ez{_7u`PG|D-ZN}-8Oa37cYHtSNuC~F21w- zlCWi+i`L|5SB7sr|Hjiw;(&c=lUr=BeEj;!nH6boCLS1Td1iFM+s!jBeHeLu&8grW zx#OZOPkb0>pLO@L?t$0#oO-?M%q>%ckDUDDo`{3nBFDUtI@(&$v&|DyZ7x(&c64ZKfLPSs@Jnhh+>es*rr3zxTs%{@|fp;t}|tNQlJm^Rt%f4F&I^_TmXeDZZc`nK=~55MyL zGxZ1V7*q7w)w#0{Z_MiW)ro$cjy8F-HtOv?51(rDb=~m~7ku>9+*30yE*iDqyS;_Y zimIkuwmi4~$kTsVkZpS@p#Ff*`u-s;?`jp=-EUUQvIRcvzkA>>F>9mWcFcR>XxDuQ z-U+uI*wkluK=8&xQ(6yvZ9u!89AuH zZXYu=wM&N_JN{0}-o8UlZ#$crRgABJ!Cyi_Hh{mS$IgEn1TX1;S1gH&tV!7z!T);+ z6z1eko{}fBe4~^L?mFK$GU4qd$6MYtCZuJvJMYy0n6Rbv z;m>w{-}J`YZ?_n?uuIM4x4!(LvScD&^E60L1vdAcl~eMrb;i<>Nj7JzZ^AZhWLJk~ zJXmz%4>O0y-PdH#s~@LaIP~>PkN@?|qQ1+QHE0ZlzrNgk>)Nb`_8vY(2&e9ks}=fKXNKk!z|ui3^4orhJ$kF0*BS@p`=4L3!S`!zuT3QH$) zqJVrDyd-wB+`yY4dWahY5jkIc`Sr^L9dTJSnn<&t(YLfHMhL*;BPRZmcRX>!Q~+P@ zVA9xw*3DF)4J~v4lcF|L5zh5_Lbz+xW-8LphY;=-wV8?_(#4$|wV8@xCb)al=5$fq zXM%e~ZKmRN6WlXuGZpD;M6fz|GZpADd)_}P&@=V`s++0MM+^jjKAWlFaD$f3R3J|S zr}dVOHu~%SjWi5B`My@vDJ++`DEAgX(XJ+=iL7-&In$xo2GrJ%Z<{DNKq_A5K zD@pn1y(ccpz4_2XKli!J%c0hkdy`^!HF5RGE#;Oy`p*i~L$1EwcA&c5lTPF|u{J8~ zww>I{rFb-vZYj5PGAX8W8Dlk|Qn`@LR|EPf-7aAx2L*#GlS6^Rk*2u9#uG`$E`{CW zYAy&_%0^-kM>dc`2<37U!pQ*BYOqJt{r47bx0Kr+D!WUuYd+XrJ<3iNWQrT2PEhWx zlWtqaP#nH5+Ta>A=9Y&!8jBZQ7LFmEl*_ssHz_1m%Dpw&E*OkpqZ0M|w&IE!QO^xg z)cG?)!EK46K3@=xRF-&4f5~lpSa7Lw%U0x<|D2el$KNP6f5Cx>Mn+-(!7ksrID93tr#q#9ebQlSEEzYNDYdeYnKI;;R6`HOPd zZ+%1sHRj_(g=^xP20&#q6-fMT99bPgIISkoKO)I~ma3bL*Fi$Q4E|r3iHAf4zvD{ z!O$-%kq(9B6G=MY_z8?ua%;@L)p(G`k6jw^YL-f*hR+WwkQU>V;f82PIyvjDwC)m( zYDEs`qjD$lEJD_J8>g-NghUbtzLJemLX-}Hp}H0r+^l6_h%yeIG*FY77C0=lx8I$9 z@Xl7IDax==_+54s8y4CVzQNNw0s+q`MnI+oA{V@HDjJ&f^Ya7Jilm=kKOlWwf^-yQ zgRke9Up#1RYH>7wd_ZIpi1F8%+8l|1Fc!Ojj1fUxY_m{M z=jUg1ta*UT7b(CW*&0kl`^Wp;<99azEj-wO!r`4AsMamKRdNHPT0_xP+s5cT_PlMV z;-?$R?Iz{$)nt^cOYg+p(azOh9lOyUMPq-XMSp>f`rASDmos+6;Q>v&(8*;kFUFWU zs$)lEJt#Li8t3W?Z+VB?%Z86TW6#kZ*mVb;2U{H2gkpFKUk3~xct9SvF|e<@Q9$ml zXv(-|;Bjt9w`A5T2-_qB5r72S4)*!*z_tRvdz)bnHTd9bU4MYojlSXx0RlV?0G~i3GNJ%0Dd+iU!D7SkUCgg3P+yv?iF z=4W%8H(YI)j^_hzoxORB&#{H3deUOyS{%$~80TX_ZJ3nB9MOHiA4bA!1EugDkm#?Z zXQ5zMRWPsW4o~zzRbR*gCUEB&4Fi?YTJRYFaLzLAAHm;47R>z;VsJ1v2ndB=rm16^ zD(E<-j`=dQ(K&WeV@T$3o?zar$9b;uW za;rzMaZ75b9zntG;yZ=F*-Bl-gHJt)_r+Vgc;CgQZ5j>PNj*?W$0lu0s_HTB1MIGP z!tjkjTRFZK21Y#*Y)6skGxfdI@EL_gOrV>3o}jc7!<(R>iS5MrCMsxQ06z6Y3AAhQ zB?yKO+^sYX{uvZEJrel&;CCdVD-r#GXpdr?MEr_~NkFt|sAaVJ8-_iFubmpzlu?cG zJ|wlbg1%BZpl~Q)4-EQFZofhIQ4T>hJ`~2(e!PJ}_c!4Vq-yUB3hd>%ONI-}fZ$d>UTEAudzt{S(;(Pd&zzV3?5*BeCUK5k;b zojMr_XB1Lo-howWnpkeqFe=Ijc< zV}8BEN5r6yn&#JWPMnK`IWqdsRr~?cL=8YQq&quD`u<64$lNb#yYy^iBbo zDtKN*3Gbb$qf}$@8R>M8a*RHg7tCQ7cy#96$YSL^a8EA$-nlN1r_4mQM zHYhB?nDiMq>ARIGIKjIyl#sk;5gsNR&UW5@g{m9vJx}&}a=VcUMV^0gfXs zpS+pp<-i!)h(}PzarzJ)<~(%8c9`JM6T@X2VC1w}|BzcS}ij$rH`83uo}X<|JvRjok8Qz}{#KezrG* zq43H11qG}ice2|uA&GAQCW*lYg|kagKfdqS>v69^BGn4pd zS9Ui`WfRA8QjB7}7l#N>n>pbH909-Nt59G{0B zH)dr#JPr$cK^0_`OfD>%o;kZDzW}Pit)iOK%tvLuu2VMc5L0yB7OpF5bg1eBzHC_i zE>!#4LUnzFt}OLX|31|F+ajR3!&CFWL3OB2^93QpE!v}toO&~hc9E%rl#zO{*31cV zRcj-ql?rclx7SvR=I8Wa%sbF7%%<6`CAzLfT3^(|v?-v1lM%!9Fw0&&)G}1pEl%yH z1xqYixw=FLJb0-tdLSMvo)YD}>1yH6by zG2|aZhVLnRc!=r<0ZyEddu9U7+g;q_{CaM=MpaD=W8gXU2E#pN>K zM_3P3qr-LIyY#?i_^HEosut~U3%GZlQ&Ev4+@k$y!Cs5@f@&?XXdf)F_VLi+ohlBV zC&%xD8ef}rklt#9MccDriSDl*f!>B%M(Dm}dPJHYxX+^P1dYDhNx)lL%JfbaC^_|T z%RaQ`#RYryAh1Dof)_^W;bnTz0dVC*PCaOpt`9aG(kV^%wJgyU%YOL!K@OdZ+yw1c z);|9WMmY6Opa;xXESldEHLQ^}*TEWpo91`bqTQIkS1Z$&Ku?E5Sn91a^hj+E^c^Df z`h2I}+M-oxPQ5dChxXn4C5WtcA<(Q$_ua1tS_g2?*j@wwEKXazRQ%IJzSH$ZOZ5pH1!DT=%v1g`O;)?}Qn!NG(+q?FhRHq!V(dey2rS z?sF9v1O3h=5b7}c)$^<`!d&xl>H)veQ_}RouwVo@^}$efYR}GF0xr_NW-yCjJrK(o zOp!XDC3*lzftBr%`A)H}1!#ZLoWu22+7}D1>Y*^pha0V6>RGf`U~UCkVB&#gI0s<> z{>TRaV{)G!v>$l30}gAzCn`+CMiVbhkJf%xu5z`lEZRAk-|^aWFpram>G5fL@?w~t z^{80O#TnibL}|YT4fg$dPwdmxCEAL4p!|jp%n9DID>@jRJh zG9Ld~8yRNfINr7q-h<=zMtBE~M>WEYchM+c&}waGc*zYf!hA1@$mHH+h}doQkvi5%y5fLs_7sT}Xp0K-Be#}gXik8m7Lilp=v$N5Ktnxh<|GdXwF zIgW?90YM$&ctj)I*khc|%G}lEoS)t>>&748IG*)3Of?+GyQdA)0*>REaKmK0%f;3Z zgwlPSAJ14Dral}O8*G}YjCVNV*=@sQ=lo(rMpIRDz~Qcr3n>*RQTR?zh1p#=>=nV& zOOPw>+pDfUc<~*kifQ-wQo)anG(21LkTlm7K*LI{(N4xjy=Htl+K?Ganrlb2hE*DC z>`&y-TyK<>`5XJw;BV|t18?k418*E}2HrT{47_o?8F=G(Gw{aoX5j8|#4;s~HC|`1 zPGfdrX^?BC@ikXyrtxivw>KAEv}Sx^<|-4RxvoA5F>-ti+*8sT?7DAo;CCOMM&$&= zttT9BA$!8>yzsx{1$Tm+rl$Cz2YK+TP*3vlXYftk-{LZU%?Mq12>6?t;(Uj8%S$#qJYC?VlkkZGrZxCKqAdHL2Q{b}yO9k!_IoV0_W&dvxe6s&Zez2(T3Gqp~5F&r#dSS-T3x4bu zeuHKg8I?_86dJ56$k#Ch$Y0_1suM!mRZQYsMy z;tm2KU*`qiXTr^L{#Eji3HfNhS^jX7-gH4@Hc`-MzZowu;SND#76yEn#TdB!9JplYELp;wSm*C4Q1$D{y&y&zo>_ zTwOEa=5Z&xP)_Rq!``_ER#9CGeIo!}7Z8)6QE5*? z5(x50ngj#|j7Tl0y#_@^u_iv+62(t?s}&!uvGv|dtF5&5L9K10VvRyu6sq8r@~yRJ ztvUOwa|TkY_ufC;keR)Iv-a9+KW5L&K700%4DMnnAF@3p5|{0P?}Jc}exClT?W&8? zlkMst@hY;J+hI3x*{+Tem+gx6%XY>3WxHbivR$!$*{)hC-Bw{|8*$mLI*7}5wU4-L zSFB&QE7mXD73-JniuHGqo&Q(bRR-l-wkto`Dcff%aoIj+Yx%mE{J1M1Ker$L#)@nw z%(3LY#!}|9K`9_l8C*)bre!*ED>j@o}PnPXf+W>LAuh4lOacmElYV!D8fDU=7?N!^C zHLmxEhcq70P`u#(l(P|C2;q_CI-=9{u|0 zBc1r;us&MLZ5w%-mM)GPpp*P98%OXG$`{J(qcOL;aOWjTA%7m(FZFD8;oo)PA8A}4 zRW6UUGl2Sa{bW;937e0+9M@so+F8m%Be%OUir6DJ&zs7~%qw%SB zR@C-SE_^&pMMQ`Cb@|OM{J&iI$1Z$IVs!oMUHGFe{6iOxix#4j_E%{-B|Da^KE zy=M}`9jDLw4LFW&iM?~|{40fP1dk*6s|Ckz@1eWK-l=x0-_P7loYS2`^7jjV5%EVg zJ^FprPlWtJl0PW;V&Z?$^yv3Lr-XbR$@B9s+u1}sf%eR=rSL%7V>yo{ow(!tAs?sl zVoe@7x0^2$XZ@QgjNha}hk8xJ#X-_g)v`JnvmDr6YH)Hup7p!U!$_zdDlG>&?HPkR2Qanw^r^8X-?`Ne$k_^&AJ_C?x$$%0e!;nZUl5$1f9!b?p?Vxba<2;cbrgPG@JOA9E+_H+B0t?|jW zh}sqr=W_Th)yriX$8y_6>0YUEygpdokt?sq}nxt;SKF+u=zJl7%U4mah{6USQo}ZGQZ)+U&e3|6GPaMk=%dHXq&>a*!h0d>cG_KFi z`n%BoK9$26!TJ2{OXbJ)!sRxKINF2ysd*UFg*<%6N4bjyXZ=N*o^)GOZNIF^WBHt> z@>wSMTzXz@5PUmv{zfUpJHh`-oX>AA|FJXUtq^Xq`d zQ9g&piC)$?%C}Iuhcu4zuaP|Wb6jrxywD@$3us*FsK!zMdeVPV#!VQT|$z z_tAOD?c`n>S4z}4%5Nn36v6qve>8DyKUj~iQ@y7NdG3GoaZZ#!LGrVOo;)~)Zh@u; z^Yt*58~68Ue~yy0H?>0ENBLSUcm?t6G>&@ECUjdhj_DpG`ELmBrE#>o1aBhVF8E>M zdj!9d2FAWC_!GpRC(h+uLFINva4yf$)UUAo>rhVUW(ocY@x_9#BK=<#946O>Io4lF zdZ?RG;|5rk{7xYipTk#?dLa306pr*X~` zqWyyNyx%U3Pb5F?4hSAg;e#5VM1I^I5}d=`8oz-2xa$%8Foln4oUgHnP72QRhj|#Ev-45=V$Sv_X&mo++41uP$|J|$Gtv1qdHp^rO>mwM#Pc_}-P&40`k3=Pr4!Iqnd@3u4eWfO^x2she*V|94#`Sj6p>e%EJfU&D-e1?aUcY?5fOhKj z$mNDyudmqVY*D+I zn_yLwIxxTvHMcaOL2C7mr8TP?DP8;EiZ#m`05sqt4(YUB1+V;p%QQqggsVCPgRp=_ z&B|a+{mP(P${~GCLrY!y{Dq6Br~_xooL$sWHN)BvMq?9XahbCih4be7wRKGmu+Yd^ z6w@jgQJYGQT7yF`Bv=c8mDSY;mo-(d<{-9C*(B9cAbO^kudQyXHDEmqSQLY7vP%@h z&a3cYYzS6y!hdAykqLU$A9hCm1zbw|#zfa44IP&enm zLhzj}zTP)uBpLq+=*OeQucs7}XwN$t|8a;f8OkPIYR5>Sh?%fQIUj|Yx45Lgp5*dq z&pVmcd?38o(pe=_|%m-IiO^!dISb)l2#Ujp$Z zL%FmH+!{ug+S>U~1iwswtV{aqNl@yRVVsX387A37>2o{7{P&BJ{?oufMa22HkswnB>IU>{F2`pOv zbFi_1bDlfwU_@HC0gsk`SCsUVK~|=Z?j)B0m9m|Kj-X-=kf z55$)Y#oH?FNP7A>=SZeM23WNG^ZYG-ZnL#TriIUQ(bDg^(vER}4r2aMR;G{hX)%4# zO&fa#+3{un&GGG{hVcr;&tgFPG^}iJ`dnNLb8+&11f72}{Thm2&Vm>joCq4<27pY) z-#=7|JMGU7h4Rng7hK{Wr1-5OK@l{LlKrfY_oc&Z-#g;MDC55a@uSt>zMvg{KRrKT z{f&b^E`RPdHQa3! zpO10+ybr*EXz{P7$?Vh(adgLij*qK&vfmK`&#(2#@Y(?>`z>mJqMD6E6n~$H!1-sD z9WL#!Yojf}<&Wiu&-)yo+uu$~pY`#6TdwVUhhvgK}##gKkHE?Lf+=8(|M{DERnK{`u?|mE3 zxR;E8T|jvQu-|-Q~Dc!!~ zmhlMN^#a@mc3XoUVSBp4t^x4MmTphacLJSPrw2L{H?@{wI`5sj|Cd)^{oDtSw7mKO z+HiBq;SVNmD%w5i^!z&tPZ!=|j8EJRj~H!x!1jq?H~w8>`i?vRQ=E>E2%JLObvsXA z_d_T{v-7lN?7*_y851}K_1y+`P8tJc)n&GpwZ|CvIJFaOorL>lcomJx?&%YYa-lqa zvC6ABa zy=_b4FGl}8{{4qM(0*pAS0a^7<_tR>NK1uNAzifZP567uN`B;RYxJZ)gZ~})n?^QC zTY75;$3uHCZyeUkXs${>S*4HsG1EvsewOmYwrZGx)2yre0^>Bs>v+g;%K52xHg*0t zl+|@mR?k9Nr5LTZ4~O#E4dvAheGb=0&-rsYQ~DS?CYr;b?OmnLMV~qJB|IN}wQ|Hl|xnXsq>cva}oyEIPL7Y(iB&z!H zL3xZehaG`c9xL804?K?3l@5ZWpe5~bT+tA2-d~}w4d>odKp;|tMA6Yuss5qtaG3fEq0 z!?FtXFPHCrkMbe=mpMa>itmll&XZY@=ZUwrwX9E8TXoei)n!*X5xq zuV}Lm?8kEu^Lj;ccwVu5u&-lzJhxEZzE;3_l{@pugMC8h)mw0VxE=EQQUAcHk0H-@ z3=HM@hX2JpPgMN_w*kA)!Ti3K=$2pXPZq1b9{Z?JerFwd=;WCS>_=gUDVf{cnG5Vb zWIvpL!=T^5b58bsGgY5~=NtDKDb#1c`8LK<=i4c*&w#l^VdvX4U#Ki!_}@HV;GE}k z9M5kqCoCf@(@8G<1oiKqAeZT$Vmmo~v~5N$B$YR9%Ifllnh7K7c`hy5fb{+9RPob{Q>w|rdCxr`#BKV??un=8yc%!Dy##S@>3P)XL^}@jqD-EG zGI@Pzlrs4}^x;q@vOIQr@qPjO0eEh} zvcPhPvqI$%wG0xVjN*QMFWy5~aR2*mAN#&|4?H(K3AR2z#CZRKkIq#1pl^Uyh2 z0&^#V)vMrhA^xfU<=}5wvAV8l;w-=VKm&X(q`JkAzm)sO!<0#X&4!v)b2P`=gh`HU6Kbu~73Jn-p~TAUg1rSYId2` z4;$cTKGrs;*Qwd-(eA z!}h_@G(4k*h_iE3oIw(%aVdN40UsO;g0Ba*b0{w)$X;kw%GrVxaCS1qG&;fx!EQ&E zJTeL&=PYZvXB$8ZdrL?h%_(i?xV(4M4PB0MPyp;rB4p=_L-4%Dg5+~{Zn`Iv1lY~q z`y5o$LEeWQRLWkxWJ}vQwAT?lXUX|Vl#}hX1)m}d6pPpo}(70&`QY7UXNibmr=s*AjPow3@QMxPxqnSOo%DI0{gvP#&Z4zdV8=FI*K zQU{-`ZnN51c?v1FX-Ko}`;_`SywUUn?XCW7vQ>T5noZrO!`^BtB|$6+_K&1I#~7Kt zw&;MSXFnO@yzc;d*zdf%U}Uwke?R?>Z5nk4$@_W;og^=RN*APhn>j8f%$zJGWdBoo zDyg|~>$i;C&YgHi(V&1_Gk z0q|7XTgJASb87dK@J1(6FG}oFMdB3pP)e8&_CM#OezV#BD+=K6#^@~L=5yzxhlKMi zj?{~Me5y#C0>AEr`CxymlRDJLE(+`m!E@(hFA4MHrd~D1PZf!;L3`)|)T@*tBlY5} zjEvNay1A9i;_G9t%==W4_{zJJF1x)-DKb(o3L-L6FA9S10=CjEK(EY;jMNMBA|v&} zyqC$W*B$e|QF+c@Co)nmI>N|EpCTnZTiMiOj>+52b|2kY`Dt$%+s}QrvPm2XZj%n2 zyGI{MNn|)l^`e|VRV2P$JoL|`6d9=(Z6`8PFY@#vnU&()x_w@e4pRyS3{0WJX2AYr zVwQ2M**=*9B_Vk3X25TNCeghbYG;2cG0WI$w)3l&OF}SGyE(ud-*1q|>X$ThM85&% zVi;(M$u_Khg@Y~`HY?$x1o(uQVO?kx!f(T|slYEzNPs(5k1fIi-a)3-FChVg@MVR* zDmn&oAm|$ck*$9Au{fN?7vEp0OE68;nm7hRGeEE}s!vF`7`*+`!K{JaK+4^7hGl|G z|7;^B1wBdIx0puepaF0vG61}$?HzbC(3q4RbHLU?>0k;bcK)!!L9>TlG7QF6JSx4x z9wTNbDj5RWlxJvyN(Lq(W`k107)EhDp}4~bo9Bay5t>0tJ&3>%0ccFIgP4<1wncZ& z8HV;q=+5# zN+>uLi!~I?h^PEvVPrxE`eO#vm*wq?tq*u;9WeBVJ9UqB2{7|$9NnitQ_KUP;(KD% z6|@QkUJD7RUN$KPhGfCr0Dmz(hVtK`{652XD;@zC^JQC)FGQ9qm6(M2J6_ln#@)=! z^D@S^$HjNS0b9QrP&%tnat^fU*TCa@8#d^ynMx?l%2q>UI+@kF76Kn5$IGbC!4%nKjy8!o( zxy|=7?2~x4GCV#&4-7O*K}OXIlxspB98ZRyfQ{s5P&B>@Hjdss5HMH6AgVDKe8yYs z!KJWZh!y52f`_JQ+LKN&{bZ=S6dzV#M8Y>lVQ7q#VhO}DSD%5%Dn%b;Wk5Y7!VauA zFE$3;5{_a(uK~>!x~U=N^>8d%Wea^q{8rcwSHMus(OZh;nXC$R1ja#!qhDqN`poI( zNK-wlgAdh=66sqo@HUjS!JM$ z#|GmR0gi#04f7%AW6jc1*r}3OqQYhMuU(0zs@G zW4vDfp@e>gaaIrJ6vl!_RcbnTQf9$s0;gcsnghq0HA=H#Ypy}f=VS6*3&;FsnTM< zglVqhnCr9}SZ`v{+tSyX&qAJU{{}lv3u|{0SYnv3tBSrr`TtmjJ0A8ka6rdgt&Z$g z8Nykb%9(aJ-P*DLdIV;NN-sU;whR?~(8O*8CsitEKArD#|}@#-+kECh&&o3gEHt znS(W5c58BU$-X25`x3n&?l=3o$L8i3E!J5&FcEDWo)PR+_94-*d?*N~M5?mhu^BO( z43xSt4o_ir>ZE?rjLYos;+dSeFAmS-&(~n!sn5`76_- ztT}5Xg}MkhpUz^u)+PTly`bLJL*HSTubQ4rL-q6qcJ$%>q`DaV+Kf|ngq22ELE!Zy zNg4(#_+e3Oe&|W9rXWm~|-9$6#a_{Ml^00eQ-*D;l3z=FG}Ex68NG7z9@k&O5lqU_@V^9D1pzh z1U{E#4f1DAy{4gQ#3;GwBm z8Cmc@Gh-?(5;=9%ilt4}O&gZL1bp=#ypca^3F=xBu4_r8t|hE%$CdXun+cN`2@PjI{9%?}2piL3=o39fDq#YfZD!e&|)7y?T!;z7q^a-1qdPVyKX z-mbtLG%TyF-e90vkQMc+h*adfH)3FJ;iV2(0<*;c^)1!Lnuco}apzqVgUZM`LKZpi za~Rkf40!v)pf^LJn2*|27L289n>T>Ks=B&H0~Q0VG1QwS#?{6OnSfIhSe-R%n=o7T z)oW^3)ip`c&?2Omby)IpU0u`ChUPkBsZp(JR4sc6sX@8&8!(1?E5@*2lTkuJe9gQ-22}0L_o6^Kl{ySoJ#@_G!rVoO6EC)Hb zJ-AWF?V~sfhGWF&O4KGiE~eLl930A`L$*!%;FodQV;c97|5v!z(!jyk{d7#tXRk^e zRfYE5>AlN$cl@rzd-~m*w0q!v$@dTWCh9?V1`Lli@at)&Y5sS=zPQ8RAQAlQT?_Om zQG2I`dg!N`YgbNP11~?VtD8D4JuCgf^yyQZH#9djG_*`z+uSsD#hRK`YisMKR#!LG z)I+ZVFHfyqKLukhS-JvNg>_LK*;z$)e585_oyKme{s}9WfaRZo8fXLD7efWWlBg{k z8tatX5|AE}3_(W<8d3gfeOZvuXpGP8EgisqJD+iw_g&QHhI>!#_6i}zjQ^|g3Q zyw?4jKk%e@t+&h~k7t3`x_9$4o*`cA9SEj*0r^^Be$+jieX~6tfLp-3B_b@wLU?3f&3;%-ZoQTFiSA6Tu|KLd(}Jmc6~>=|Gk zGqzyTUhB+eEm^zVMth&e#QQ^8rh2WLplyzIQ!j94pg%1KZ;9T0etheZJ;NEcW!Xf@l$BV4-He?@KBYln$5MXeT-t190Tm zJbkS{f|@w%jm=xI`F!v{ocNn6@juv!e}*}CYcP=C_lzxe{rzckOpdC*xEnm9w?bLL ziKdlsoVUO;v{;=){k&Et)*gHqog&MGL!j3O-cNzZzQVhwHa7OPV4Pc77w{53DM z$}QLy4p>mb80DQ_r#za}h1o?(V#~WxwhOyrp)0@>1JZoif|Fe(`c|(J9c`Qc&!wkQ z^IChL+X=O0Xie%we&*A*Wa~R{?tqHl^~!M7*?Ef#;befi%Er2)Zo;l0?hm~;Mzjr8 zjdo}940e#;h>gjH9>Xe*Nj33&eRw0Z%x)7x-Ywn|PYRrvU-JxkR&~-)-Y*znB%L}g znZ+avi{X3@owIS)A2)CDoOdatv!Mu-9tWlNB_Iti0bAfoP~a%Zy zjsp_xHhp`cV9sudx&rjJ10iF!d*K?R8cVl{HmQuJJ!_j%q)eG&?TGQs_F7*DQ4t zdt!9);ECav2q4V&>Ud9X+EZCkOx?RH4{R*FWsBl0ylIQ#EPIl2#1TtNS3hVOk@>~r zmJyj>n@858%_Gaf=8^Sl^T_(Od1U*yd1U*yd1U*yd1O1cd1O1c`B>bAIsD#rv|Rnr zh2wWiqRAJ6)@Xbt$Pd)&OFi3x?5}|jaGu(*53yYa>;`J}qMqS^{aNu)dr;4hz}6`J zq4v`O4BcAz8>m^t?=Ry#l!01%;O9o1Y#h!0!7d!1BcsXV_obq7W;5Wpnwtyp(Q*1Y zf^&@z0zSqTRa-uvkn6SSCmFO?=aY#K5qh$TOFcO*dIH2pfF9O~sDQZCU*RHONnDmg zJ#kqM{49^@P9z!J{j=qnL2;%1c`ke-acSpP;?mBCH9fkW*xt~go^;!*wroG@(K)vV ztQW3pjKF@ZU-lzU!woph*9_aMwt9Zm{BP|TdZj&l{z-d$6i?d2_Dg%X-3}M_a5*5? z+YjrJ<;>+E%bDA)tjG0ar_|$CU-yx`Y*%|-^gKaa+T(YTPj!*!^9##!9LV5{H0WmA zI|Iv8=KfIy61%-51jHF!A$XuXA2fLY8NjreALlJuaNTzbN%=Q}?%#^|jB1pK#$NbPFQ& zx47{AE}UgAk7ob_t-MJM?&;%pD+>jZJOhxsR(9z9?DNWgm7e)}!UQ28*2S5h5&bUhgw*Ym}z5lH** zbCEwxob6%zdx*Wj;5wx&lfp8#>z!{v}ioXeSct&5&UjqByZuj)(tyItf*(v1<@ zv(>H+!%v*;VLq8S>eutd%Mr=@mf0jP?>AaRy4-K`cb7O_=KMV*OjqyETZNv(WdBy; ztcUqF;?n+|njZbR<35d#A>Fv^(Ddu_yik>Vj(AZ^SFf*^iA(uIF7n4*xG&B&PS*Qu z;#j}B{Q=@KU0xai<@J1(l025D&MRHgt#Z-7%0<4BxJ;qP@zUPAJ+oJ)yIJ1aDKy*zpG2$|niF7~vz=x=qAKdPmR*Wdn7pXiPe z=kta6CqkajM;>}$dFH&58J3TJo+c*P=^($*_NpzfL5F;z#;KX(Pi@9gBB z7viHsd3}^=smAqDCLAwf`SWbA+6H3m0P4~CUXA-T`Ag}(2<3JDT^BweHl$ydzsiL_ zRnG_-PlOMb}NKf4K|4&xQZOg?s5bCH3=lQ1W|R(NV^_+H*&!Y2G$}e}}_qp(2xNt9>zfwQ0K!Z;5Mi>4q z7ygs_qy;mT=%9RM-hd7V(pdS6YSuNyoDHn7r?445%d|ktFb#$Ds2_%1$jU7Ik_%{T{>p8kz z_Rf({C*Cgj9O91>NBhT+A9pX1pY6GvuR*ucAGcv;OPq zwSwo_YK*T7&h3oHg*dBH zH))T0Mv`vaJu2k?K;b6^H|hTAKZG9E^;;o7h{A^j=W(=Sf@e_p6Tzobm{-2y{Bk)C zCcBv1zc)i)s@?DD_nC7vc`W}cslLA~-VJ(3;o|G{f`OG_CK$2 z?%T0mUKczAAvpf7IMySko1-XfVr>tX!yGO*!R_DaVYw8+myrB8!R`40uw0Me_B;&u zwxQsgNl$^`+lgN)IP13;DGT*)-==a~A>_F~Tq`)+vqkU+DP4OJv5@}%NBnLf|2^V- zpU>s_H1WrU{IkSg5c~(keC%g6-#g4H2Bn4Ho574&_mQA+^5=8b|%STwIpMQNEMpr)wPL2NIv7ag>iEyXR>f zUs%O!8Yaj`Hg% ze3QmeK8xgU7kno1dx&$rzfSl44+{CYB;P6IeRRM6eZfm1ZFGMYe2I;X7_aT&bhi;^+v(FDc!pTPoneU8Nma@eGnK<7F8nG@ zk7{q!u4*-o>E27>O@hy+@XZ=WJ*A}Q4vnLpJ`}!B@Ly87d`s|e691mYQ9rl;UkSdC z((NJ6<#2#_yclPLZ)++yf;hK-4~0_&KS+8rg&w}{7P#t^_ zBRF5bE)%?i7SS@2row+qhCMc)?uAjv-?cn|TP3vMs7ZWwP0-a`Gxhl1}T z9#211aJd~OexBe5=)BGn{B`2<1n1xFt`t0x&bu{&FCl)N;5=X9Ho;#f`G*AO-$$Mj z+(*~_mjoY4{7-^65Dz{^GedwCiJlWU4paz z4#8Rf9>H0Em*A}DfZ(j>px~_Mkl@_k9uu7PpA?++8wYoPhlPpVEx_1Ip55W5w8+@PEeSyGc2D-{dud9XZ_m*XZ>x0v;JLzv;KX8 zr&79{Kenfoc$bjpaqk0y^Jfm&Ue?3pv;vS$`7Q#qw!%y+{#!HgUh; zdBoEM=lP~QULy4u2zl1e`Cxh0Un%5Sf1}{6XT9L8r&Vy)vrX_e$`_Bjusy7QkC12m z`vhnG`vqtH2L)%nhXm*N-GVkH<4-{YiBH!kqP|2+sO51V2jY z<_OO51A>pFaDm{gw@Pr!3{#xqaCiJlWHo;l{F2Pwpk4v%sePqvmA>U2B zOYprJzejM^e@t-Je^PMPpG5r}+n+;nDT0>}_X}P@oUa?Khu@>%@iykH zzd-0={iTAl{z}1Ff1}{6hkpm-bXiZUkY_#H1n2g_{WR;jmGZkw$UjVcpWtlIe! z+6mApz7=?EU&R>|^Cpf3OUvSpX<;Uf~ z`Z<5hS%0_CQ%}#uJ%Vo}&iYu-R^lgxJij->IYCPo>~Io>?XMixlR3aJs)D-YVqTo^67&J#B)sJ-Y;FdpZPXd-e#<_HaD5 zlfwsuJnK0qIO{niIDdunnBXjTQt(eGZ20U4OSXr@KEV?y%;UZ+&-&AZJnPR8ob~4j z&iZ-$nDy@?xk@3=$oW`?#`XD@If5sXu7JjIoReLF;J=~+T;6DppM_!1<;|SeX<@rO zAg`C_Y>JCqFSkmK>*cdv`-${(^(P>Ef=iiOk0Q-l&jT`b^R;WENh6SGPI;{FbL}^*Q^ZI)UOQM zOY_<*7HesU5_a-rq_1gcsY{=~aPbtS!)R=R^^cc@Wf0bJts_uZA6(W{y}HiOlU%;G zx~bMKIFXE6G8q<;*0Zy!p@vsRtufM}xLT^0!hXYQ+^5#2XU@d!Oo-EfD-PX4?V^@5XaTe7Qe%hv^_F@ z4Mdggzu$w`hGCqH}8q?Grr_byl zByhI)GCdjo8kK(*E95=Rui^LK7;}Dj|2}xw&oa2bl;*XZAw7Id${qzEZ9>`g)piUX z_e_N#zB9@B=kmV{nAC|eOX=o@f4@S8PRfo2AQ{Sa`Ed)jiKQ5&>?i=y?C)4+$4{c0 zIJ6({^Q8Sh0w#50%onHO7JhH1`(is3DfXU{E~SwW++Fd@l@2Z;I%8zq5y7SI~XPXt!1rqJDR$z;BS2Y^|i9X|NL56nzy5= z(EFVxUxu+CitcH345t~I#ty^m`jTO^ehFDtdR7kH3gVrtzoMkvPhoR_IlkW@kJT?} z=!kv;%*8{YbkdCh=0I;C1T zhSl%lgao*JdixtljC8j7(c%ct3Y)pQI+f8Rzb#n6}M7klS!8E zZ;=IvVRJ+GB>ctNPdJ~)H%#z*HFn=)_Zr$~Fh-ajPyC>Wk5l*&ANQDBBfd&8K}GPG zC+s82eAmr;Dqrv8t$UaYsB>A~iNd-Eit_+{C<L+fH+>F_0~00lSh00Lg743 zUT<|}LLT#t?kany)}}x`Jl3$BIHpUF0g9{@@)@LOv*4`fX2JQ|Mz=;zy1aG=iK{VH zJ-^)2xE#1Xu-kC(oa>C^;h3{-PX@^&*VE+#DGz ze55kUxM%3f5@qO8ja;e`N;NjAMkUpFq#B7-1CeS7@^c+`#Hu?1f04a4yo*Pd4qRhj zcOt0T2r}+>ST?{OvFCn^@oey%Ek2(oEHC4Cy2LM`2;BbN;y1g*ucrun9=XL|0|%r{ zD9dv;_&h^B*t>H-z~^@+WFGUM1%JBRNC9|w2y-ZlPT#ZNK4Ne0paA!Sd`!wNg#(hI z?8g-0o3!Vhl>IUsh?f5(x=^)J1k67+DVhIqz@$z<#@z%17|@)Q#UYkx>GN;&Z4?*N z$GaYxekL%~$@K(Y<$g;E@f>;PoIdXd!+~h=r_o7u8Aqf&$KyRd#j#%(-5%|vj3V1j zEJlwE{x*tVDmdq#vD?_WpU(dR62$ULfQDquW9Jh=|;BXt1H8$HFJ7bI;Z&-tn?QDhDv0HBn zoNPUF=1Ie79e83jBI?u!!mq6EGufzPD`7R<@dgYnH^LGESw!QAo% zMi{6lT#z40f_b?WAw0LRv>?AMxL{FUesJ!bxsG@kpEoBuuPBSk7rDq+R+LNm(%ihf z!iDpLrNwj0XSf|)v=B14FfVvze%T^d4eFp0E6HEzrYT%QS^k1WSZ-x=vx9bi%NG|` z zF3ie2y9O|__*_PwL*T;c?gDd4v(A=>Ii+XK!JN_yGtW|na~GFgmY;Rug_$$mN?A!{ zXXivczOb;oBDkm&&Izq@@(O|_`SWwms?U1EMHt&x~MGF3b0$s3|Gq2)#xqR(W{|Xv4q! zvWnn>{PObL`C6}nhs*NkE-K3l&MnBFTMYeQNEsZXrU<=CSz&HT;gz`+g^NNx8ph6F zIJfMI(u!b3LH@$vg4|HcR0pYS;6ORFUhJI8^23dr2iDEWom(6%pId%eSlY$;`K7_q ze26v|Y%iQwI9I<|pnAASu=VAoC506g()_agh57RrRTM^=y&$(TIIk>s{(}646>#1y zoL^B8mUwB|qKZX9xSnZ+3n_+h(Dgu86h(Mt48yr4rQzkMuAR9HD+(b;r6swc7K0hJ zFRb|`C5wWWK~2nya&&GT&QaD%$&17C-iH^$(A!B(k1wzw zFE{aWW{HRAoFu^9lA&sDi3e3DVuFyI3K%$`ZjYUvZCVKq%c+sIOTc4}au7xp>Nf!Ma_c(? zl@?E|7t{HCW-{c@ntDw`)5@tZ^L=&0nhg!jL7ZJa^_{(Y5AWap=ewSM`ZT1#_~)W!b=56vo9dd=Yd*{QBCOR=(>a3hXjztf zMX9Y)MZht?6egLqM z+GfDkw5N!vaFsUj?>^TfvV1VI`*+m26{#egjr;f2Bg?_oADORf;DA1-L$zOEdGMEn zk%Z&^ALrcYrN`|bIsRtO7V~eFIJZHU_mf`ax_lb(5y0`c4e7AG=z2IE=A1*eo%uLY z#C9^DMchw&<~%op?O}d3$zi>tW4^@>I^PdqelPI=?V0~Og$o3Kg~FwRpP+E1;KQIi z&{e5z$e!uM>jmdI9gTvoC;9b)-$T4raQ>djHo<>S@@;~DLVTCtqv*G+4#D}m6MF;? zlKeiwTZ!)%oZmC*68wiGe?V~lUdKVf&yf5f!ADb<&@K3M;yr@%yzgUzuOa!9g5O5m z?#)B>`vh^GyTk43_r#N^yqVMek73WD3+Wj{{gq$H&m*2D_-f)j$B6acMLb8y|B!e< z@WaFl1UIQ`mx!kc{uc2J!M#5F z#LW?W3~}c-d&nPNzh)6H5b~E3FBNwgr#{_?a_({RvCk{7<%5nLhA?_1=0NolV2|k8+ir`a; z`vvE9{?i06Bl!%$`TGw!g0Cj|fZ*2=FA#h?@lwHe6R#BfapF~i|Co5a;0K8}3jP-H z^@4v$yj5`ij^sAMhth+7o8Xg(?-Kk=#5)8pBfdxQ2IBh!zlr#M!S5yBCHNlV2LykL z_(8!B5I-dN?}&E`{ukmsg2R)ga>oQ8O8lhY6Zuhw?iaZIUqsv|_yXcdf`5g0ir|gJ z{es^}JWX)^E_6vsJb z?AVWU+tH6BSLpP)@GxHHxZ&hu`9~>CuYIcL9sOzg0wMn)g=f$n%R!$*t)1hAl-`V09IFhzU#$N?kGL-bE*z(-o@m$4x(ruYD?l=w@rZ3BY+kKT#&ha6N za&B{ucTxI2YSfrMKC*CpI&36C;+TGx(iYnAdW+-3P6}HVr7#XUm;mbd6`)ODJXyg_ zw|CB#<1xUnWO!^Y#lM{eX)k3zoz()Q9RyB*E5F#pD^cmAz+;o|F*VT6Xk5zt^Bx|8H6=n?eP`}%S_HcKS2j3$8X;}e zwaDzBkW|^Y|F4jq&+J#swltVY324vH&HhEVLOMlY*F-qJ67~;3dXqM#lwYtZseJM# zU-^neV`dzL`$D)Mgu5Y+aL+PxWvnrCmCu;DBFUJ!I@y@HCdHUpKhl_q<$C(MXFE?N z7^hAKV>&;)+=BV?v1-12&=>ds>Y$=KwsqiA$kTDl^T?0>E>yf`(F^`)Y06|lfgMqXMt0vulo=6e!>|m z<`<{0i|PFD5yq*Hm&d|!56F3;F8g$zzR}nL=L@W@5I8jh+CB79ZNn%$0`_qJt-q!nggbq*)OIaG4hs{K>o+obQY+zRJs zUpVJ(HscdYu3Ei+fs!c#nRq3$*GyFB?{0``H z1O8ruF>?~|cSjpDCn6tY%zSUCG4tIK(EhBzsTGjt(PrF{YSXAV{^6PIZYx=p376Lc zAD*cQn5s|Pc^t|G?(dSZ{GiRX!QT#Sd(({8vTi7M>ic%W&`R5$8-ph&LjB?2C8qC4 zF6i&J20?q65A{3`>N~&l8_#(sIt!gY%cGscSbc>DO`p#1vw z>wnHL81c`z!cE5yHdRl4@}1kJ3~HI1dx-7onCaPma{u4H^_OuouG}*G)+x--kmEG? zy2;O57QCh1&H;X40%*2#AdR8|jA`cp)(JX*Ryzmyz5!rtyL~*gm4-M+=;{vhRrsdB zPbk(nZkB#3MUHaYBh%&w@Dn6w8dr!IhK#~R#I~76<+-Bp@l+?3QucB&+BxJFVL&NS*s z$l1B&gIkqpl(RQf8nsSz^0;ZqpySXbus7hKg0bx!*dKzPb`Bf}L2o+;4uxQ!b`FGUVSukanR0Be<)Jzs zqn!h@>7X*610^9C)6M~Yr4}Tub`GoxNyfHwU}Fe++BtA*2zuK&a9;@aY3D$wX25vL zowJiQ!<`>TGL03EEO{cL5HFxTbfN5Zep)nY*!vurX!kiBa(+8BYS=rH9)Eh*{gzVV zjkH%SiUZt6O=DSPg6HhfST!4_RCC}H$_`9wOd*5W@F?>fWzn&L8_DVz<2GX#`H#^a zt_m%bNHV2>Vlp*k(#ho7NZ<+DtDJCvPXK^1&e_1t0pPi>rL6uwQg0epp35Rmbf?pB zZ##Dzjf?~x#pjaJNzz*7)bcrV#C`O7C(1c5>RiZN2&U0+uH5t@ikMTY)?e%0oZ8T2 zS~aiMo=oe*A(XfwFzeP{jxEZ}T3F2u*KEUiwc46(iP{9*Oc;yli-*zEZ~GS0%p7#* zoM8i?toq-)#e@Sp=A^&~NV;h!a{jQ{O635Ln(aF<8)occ)Im6P7d^?@2JQwYsO96} zHwutY%7<#HvMzh6xfEyGZvsyH9fmq>2@DRmjY5k?gsiw^m_Gp)p!L`@gjKvzG+kH) z&a)Sz8$Af@PDsEx%ZB0a>r7zIf#8^sHnaovjm4RdhL?vGcX`Z>Mt`$RZ7+@42L95Rn_Q*7 z&d2TV9+)}iNKDGi!7Pv$EgGfhEKJ@wuN#iV9l zrmA?yaEop{o(Aa5Kg9L5;JS+j8lj4R8Sr~8I%W42j%&v zP6&Jo7-Cl92?3oOp4;ruQuBR}vIAQCgn!UCp_418a>f2IWf zuP!xe|H|=MzBhsz)i*4HjV+;-MO|Ma35l<)+hBx3HCkkRm1He!rey_fPY&#Pozlit z)h){!npOv|t!rvnac!Nks$tD?f7B&Sm3H_{#o9)rre(dc($S#~)HJNYrQZy+V}*Ks zg_E!kH*IKa3D(stHC8v&*1>W3Hipr#wgq?VGK_VZM)TU$Ms3}ymg;c5%bM!y!pVv? zD?;{b%4?R^gbOy;@%KPh)va0HQg1Xv1|jb&))_5zFaZJP0xWH4t}~kIT8yP@ml<{I zLGkDFzLIL}c$XUkO#$31MWD;SU|h!F>P$xEy<@j#ZE!ZwSy~=TxtJ&{HC- zOdM5;@9x~`y~}rZ{I0}%lI|b)&154D4z-b-dM2z&990!2*YDn>-O2Y4`DTi-2kzox zjV#dixxDM+@-A0HJ-pS`T)T4Wn(CGn>*}UXOV3KbFn#*e<_*nF4Gk?**ETmzU9qNS z)!N#+snyj@HTBc8r@-Wowd9Vmm917N0GSSeAAQzR5Jm<5}P_Z;UvYgV6?i z1~2psf|r{H7kLJSZ%uDWM4SVL>4}dY>WN$6iJxEWi7WA1k6&Np$@N;lH9qiMcLMJ1kLaNIdK)VtY}w9peb&ucw;{T9!Bul1(k z+pFow^_F-h7kIKD(na9SD)1zse(;WlJ*c-68S0(q8L+^URO}f#&*QoI_;d50rB!&f zB02$fC&l~Ld*a~zt*>8SQ27XkbQ>X9OSo zbbd&q*pm!dw$_3EQm=Jna}gM1{lnPe>05H6C*606XBHTc?1f_=!m%8$wbg`VZKGxZ zU>iOYKO}uE7*YlXtuOKzUTX_fCA`>nzgYxtpPHuL#$GW^&#?HI#uR)54oYilv1i;5 zJ%g>cFbmdhuyU~V_GT#8K#|pD6nWykR=+KtK~~ciPrTI+k2V1$hQ9tqHx%ChQNICE zHz%z1Pt%+{9;jB|+QMSEllsW;wRpF9t+*}4o?+IiEy{SvcFGpa z?(LhmKohmzG`B#y-`xBR9JR6_3k#p|TE|U@X?B^5G#szP~80o(RH@ z{X=o*G1579TyZf`36AzCuFqn$qr9a!4yA;L%dB}bYv$M4PGQ+*4l}|X2Z0ELoWIMNcWP7%GWP7%GWc&OJ z9Eg_cN@#DHAHwLaP&`zRtn;gIOn*m|YiPRS zp?cx5@}DRks&~Hs!u8l$Cx|%iS@1>UyIeS@KOFR>Ia=V`M&us>e3HhKAdF6OzoLdQ z1CF0he%z&!KSyxB$HaGBc|J6XW{^B`HL}6+HSQ-r?q-u8<#F7BTT(!93aYUt^kY5i z>GHiSay{K86cM?f{J5(kKXN_YTEQvk%$de=o5~RO_dysP@=V*Sw)-^BWr7E~h;x2< zoI~Aj!*RBU`2kIjuK$q6^?HAuxU9#+#AQA5uPtc*1ZBCs;dTXg2%)hUIJARgkn2~O z*IamCN>|DUTzIp_)o2pweba^WyRoQWmw!ZEFYu`&oa^rz>GEHtOO%xFLtTL6Fz-w` z$$zDBy*Impx&V~d`4cX@KV1@}{AL&a2N#}16)E-PyYOpW_~S18O&2~GFR0*Tx&MJ#)MdKsQm-!+j@m&IihmK|roTljpX9hn5p(`RyeCHNk&L{NDuU`n_9l z?03<9i}sjbOqbjA^Mbc2X~TF;<9dH(--pBCFdRo61F8IvlRVqc<@1roQJ(81hT^e2 zr{~o;%D+tU2WWf@@aYsDtZ|eNP}r|=lz))I_H$6k{)NQt=O&w@JijwKP1A$=e?j(e z|IhZXpniOgkpC^oFVHyZKST1DY8>_B^B%e-8b|qisDH20ILdSU2I5%1SYNNhAG$jQ zPbU5UF7#|7{*2&UU;iQaqa@Go=yH2t``;Gwcai*27k)x;{^@=ol@sg#F6kL2_>;uP z3(odu2+r;5BEh+S=LydBc&XrQ=MusHNcJoj{0-twf^)fT7M$;&whPYZ;ax8L0l`_% ze!>4r_H+r(<@PdhY*+gI!)ro*BGup98Xp7g?`3MY?`j;|?PVnYk>H#z42&qp=hvll zq4sJV^>Dcj&^V^Mm*fX)9Ob`4>H0N}@_pz&CRO7ozm(*s3cif^g~Yjh4njGho1@8( zvys}CYaG-4HKn^m@O8wm);Q{^Qd$h7N#m%eiSCE46Z}iWw+bGh`=M_L-j_J9CBo(J zBR%ax{yW5Ryd53OzefD~#JPM7DxZUbbGiLhaDJ}vQ9I&(U_O<8X{yiIVnvrTZebC=-V6z&lGFoiiET>e|BopfpP`h6g$gYw9IBzI7g zPa!|<4hfz_;ckuV_isId=TP{V#`XKRlY;xnes1q*r+y#hqvOn9q;QhP_5L5)y+pH9w+F|y&|!Xcd)8@Ox91U! z>-KPe%;jclHH?SoI)Yrc$9dUV{pgCXg9P!{UV6Ja{A*$ABVl3R0#lJfKgq(&;kaaD zdPo=i;GOP#WGphO`q?)!7W~o;zack=y-nU!y=HkGAp0X_@VYsQsNc}TzZga);V;_y zE9B~B^kA^Lr5YAwtf_}Z8R0z_LwY;V=V}Y-jh*{qC8$yUb2^A^bdy--P&^*L*6> z`JE6i=?@8Ley#D_0eejNek>$Ha|E7sz)$^={Vr@Jea&P26lVJAS~r#cw@guVB7ewrH06K!;`??f|HGw3j5sjleA{V&(Ydd~Hqg7>i_{-BG` O_&=l6hwfr*&VK=dm~gEC literal 0 HcmV?d00001 diff --git a/openharmony/arm64-v8a/lib/libmbedtls.a b/openharmony/arm64-v8a/lib/libmbedtls.a new file mode 100644 index 0000000000000000000000000000000000000000..08d719bbd56906291feb0e5db43a87fc8b5585cd GIT binary patch literal 1163702 zcmeFa3wTwsp48wC}$4;55UF#ok?*4lf{oO2A`d;j16 z|K0EIFWGz6Z`Q0?vu4ej+54O`d+_8)b7jrhX`@52N0COVw0;hS#*Zr|mc?m8h*yLd zaPl|*zdc@vZ~1Sv+$j?NKm8+N_3-bT|DkYBdL!|F^c~^+|L{Mx@j}7>!L@sY`Ja*b zg!sSz{}nc?xRrm?Qd&1(QOQdt>o@&qBYq_!cJr?RfGB^pzzvaz8d zS{Ylcx;YxlRNGJ+%hA+WR~I9uIa;|Q4hXl_)<+xLVvDv!4V|z>OX?acm&KGvw4t#f zKBKLrE*kah-qKPRu8dUHM8h#!d+<`txE>nQA`gaIT`gkJaD8NDINH$KTpMjk!eKU6 zmalE9i8i;i)wZI3jrHMLuRjvzw?GXIo|l+BZ7tCj@QPRsv^r#dQ;TOx6aW?oS87a# z4rX>kq~7cOMCDs*mxd#Cu}Ydkkf&)`99vy&ON=hDwycRXRJGJZmPNyrb+usZa7(M% z(~XVGY9YHOs=13alFEqp0fonRx5DLUGMrQs2ia|gtEqBVG((TZ^a8|=>L~VI0zX7; z!%g7#aa}8OVC*zD8-5`((4(4TYLVj?#zkvw^{SYRs%T~Ns;1Zwh7FN1t~uIN7g?3S zYI-h&6vO%T+_t8wh|%I`L*go{qpg)S;o62KZQ!FS)pfN?Yg*&YLwIX*q@kr=i!-WB zTT4wCLWn60{cXvrRu~PD6_Hvm7GWXGQ#K7pS2lsv+Qx<$W1*kbMZ@*cmX^rUXt;G% zQ*2*0MVedC$s!Gqt42<^rO6m}O<>hXb2RKZZGwJmjz(fT76DQ&MkR@_fKXxTih-3) zSJ_zKR2OZHnj&LDDq2AHC3FE=F5J`za~nvGsSk_5=!`bEvKivDt0S$EI<0-xVCc5y zSW`(k)PsrD;~^I7$g;Pq8=LFn{Xw~!R&Psdq_r(ped2)@CTtyLCvAQF@RdkUU9OnC z4zJhdb2PikPv8bBBT@Il^job4X{C%TvCZ_VYKb;O@%Vs<)}>%6P1@85J!%B_*4oNt zz!n!936G17gv(J7;}w(<9~CJ>HZ!J#4AkLDbh9=bYl$-3pk>MMFfP%I<|vss!PG=r zyyX#gfV5_$t_j?txv{mevav4Ko+`h&vLxKn)`X^ttrzW<~B!{V>LKS#%rcc;R#x$=Z0Zmg_C+) zB^o?|gsLU6Q@V1^nlSi5q&{AqD$2n{<~QV4wysQ+TOY26!MmikwJw^dGT!l3COV|QdJ+R1aq0whE$#Br`DQi11#T+MHBW2#6TH7;>E+ffdgq-bX7~Za>+O6 zM_0lSOvuv;6-29`Zdk{_*o7(Dm|>-!)secoC6T!G4Cv<#|AcExY(iahX{2%$n5iMU z6jlY1R&)N4Rp8>ax;e5G*b`VAbCY@tc2m;K#w!}+;Ep$txdxSL0GQBHa`H>s#2(rf zlMP)8zF%p~kh1bvz9v|!HO9`PipyMlqmg0Jjq|d)&xmg;XR9cfU}PB#32ngfEYZkp zY4GkR-7x2d`*?*~o7);HVYyZnu1VwzxdGUX^!w z2?q*_hG+l_N?I1ySB0@FAPmKcGWmdKOt?6XE$N`dx-b)$FSL$rimZyWCbFrO@i(j8 z6oue}Q*fLHa)1A19kG)J0@`!h3B zN)Fewgxv+Fp#j`p$QyI$PxGEO&aoAb;*VQNMdCWgU_d9n53{Q<21Yoc{^jnIwD+oHyT zL)}2gm6q8O4rY~&O|kPbXT%L!&WN)oXT-TSXGk?-S`?E5cQ~=`$GLF<2A9c8Y8wqv zFmFfdDsg&)a2T$Soer=F-1A13!s-XsK$XkPMIAEKG`6(HJui_NuzpFjlBB$ZYe~vW zIH^*eIjtgWMl;075OM95PZZ4g2MZ*a5&$*^7tT>~ur$R!VAAloLB#VKs05+A%CIpl z;$z1I%Eas0}swjT>y z+dse9xBc*3d;4))baX$L{@S~D1-8FGR~+r?B_4UFxAh2?30S2^59IkCd9T2J1k;^s z3yzdJVrM{<9{t=FI}Z9GeLCQHRs6d@v#n7DmbEP1FDgFpwcq*?$WQ(Fub(cnd>tP> zl(GGTA-;|sw$(8*B03HZu{%C|D7alXrH>r4?NNtq-;S;a?2i3weH~V5d-*%Ie@9m@ z=aDY}gXU~0IMQo*jSv+xt@iSRvqLLi^nrem_qN@4)H`Ztz7y?&@}+Ik#nBksObfimwqP3w z*&gF4{beQ zJEPvU1EWwE**3`gR&ARW@YGzPo)b6|CT3_FnkstE{koQ}sy?oEJp$)0mig{D6ww4FR+%#ZyiumN<17cDH z{9=S?FP|br?gw_xj$?UZ_tD{E_awjufxHjGV*4Se7wh`s0nstePJQ`q@awO7i=%y@ zjJ<5t#Kpb=Q0IV`-?0bnkaYq!sh8;3?(4td(&s`O(xBcj)Qfsx-BTQ>`|>jW;CCBJe?GzvY#0&9dUC*x(_YU< zoA(yG57`AfzJhXtz^C$U(Q(P4t6xun@fEhkCztjTuT2^vUOQw5c02-obug{;=&VCm z-@4e&*>J6$^KziJ_Q=Tet8abB&fgIj_R^j9Ng^9{smT-_1<#02_QUvE40U!+QT}RK zIc|JFKi%KEboT+$8TG~a1jpAw(5VZ?&mqV^D8%ErpijVmeR*mM%t1rMst?W=lWIhJ z`3F!ojmARA3T!yX3dG1~*$L;VMB`vB_I*#|;2ZjX+R3jS=p~K@z_vJV$+-)Bpfp$c zz!99kA;y0RKJY_~_22_FGUiME-Cx*h9)CF-Y`s==dH>dfU!}nBI?Kdf!p&U@V{=FCBXhtR+f!Uz#O$?uYn;{zj|UB~)Q!xIZeiskL#Lp9yq zGpv-Tm~T{u2vQ#qutg z!wMX+{Jvu#1Ijw7rAHrxG9l`lgU7nnS`DwtCw3QDdCN`({#F=E*dJ)42e2OSW9$#C z;{ae?Fs9f>`(ds1F4zY1l9jm*VjZ?UQCTeaJdCI0@&Du#@cW+Q{})=!Lf^-jhHKWR z17bO@WA~>bva6y+j4ZDQq*wCbUmn zjGyXH8so8C!ZP>!JFt(QfH_IlPjl1=ZH_9ipniyXJ=VX(`S$fco4ib-dFfiv+|c z6IE^SJ)MT7q2a??hKEKBYYWNGlOZD%8rG5~kn4<)2n{PLUI|c0fUJch@qEchu_98} z77aC4YlUlDTSkUzTh2%mP_`vBWLOm>1$=er^s_~60~DyO3YDE7qGzDUGpt3xw|Ls> zszUIAeyAqW1YZ$I6EmhwpLs@T9$%X%@vowr4ro`*F^4EilyUN)3suLk0+CEgm0M&U zCp{_A6P2>fl~T@0PYTO*g(cJFZdb~DPI^)xgvB1oq&($Hso*3_@ry%N#nxCc@un#y z1}+VA&aJDrGSx-7V0KEmmt-21cttqb=|U&mQw!Z9^El~AIpLn-&agx|Cp{^Q^w^>% zSC{#m^rW0{PpxyMRB)1|oLEn>p6gvf3pl9@TF_&cv!KbYpfXNk{Kmr)C)`sNsst37 z$H^jk`eKPXPKHRZPi)Gi0`4W5CvgX9y|>Vnyo{5YWS9VAk7SbTh|Lo7Ia%ULuH~dA zd1$QM_+iBP?XKhsPO?qET`#kbSYiPuS&$`axH`TjYv^KPu*5~2oZ~ihDJQw1sNqFD zx=#_wJV;lcDB8;DfGa%8$$c(#IVX=1ge5ucHSThf>t4*pJxV!)G%=iBlL>YmWIN`BBku-)d%E?z<=!8dFnOkHYCp{@A z91|D0Qp!2$N#P+!Jjwl>8DRu*(vxz+cDc&crGk^5loNLHm9CTpob;qDb(=y7)0;Sd zvMa@nhR?gMd%}IhCWUCoNl(fN_fe~>OF1V!DQs_6Jn3qu$(7>HTb^AiIl0muF`I&% z-sm>`gu9aCD6C~U`HEYA4JWw*6$_d2sypF6pYFCkzN|?pB_Q5$@+miJo^T&8cBRbYq$j1vKBmHg2N0|xIO$0_;c=Z{ zEO}B+cw7&4TU5cxePkC{7zGYf`iO>cGx%zDF5@#@(F-`a&V?@DNXbX(3bo~PdY8xc z2TEqS-hDYIxwTl5xZI1WQwim8t+wbRwlcAkGI1ryX-|cU=P7$1T_K)uQd1$9a@~um z0@wDiE2gHM8pUExU>OxJr8-_pk3JMHWof*W9{o99N;F-7F;rtRxfMT4S>_R;{SiF>ZEM=lArAOCbDLgqsz~tn5*9cX2Q*xgN z{f&|zdl1XwtLamWpGFB-Msm`tt1`Z>%J{lYc!e^;tqVTQRL5pl|-r}k4AkZ!p@wPb4L1^>Arj+?4dxOot~a9gx_z? z%1KYh93h+$fDh^|M2d?#Li7Sa1PVcHc1mgf?Nj^PnaDo8|CIhhq&mWvuYg(bnMGQm z#knC6nC^f;WX8N;Z-JMLQ{*MHA6#T6RM9&JilsZi2}D)~E9*=I8GSSoajkA&18@UpIG?vycUK^VvI2uNG{SNvh2?y55f){LmlX#nTtu7B*vygJtflcV4iVazfb9p1;=aZ zs$N$9GQqW&lrqt^m?S5;7L()|>C$`8M70D#|jHnbKFdA8))C(pJ# z`{mh@=M;JFCC>qQP8CvCFOp@4CHgI7i4>`Xf2^uAX-T1!byj}c3Up;&FU3EA$VX1SdEyn#->_jDuHH)Pc7iE&a}XT@cI$-7bP)U zB_|Js4{0drp=Ti~f;h)zd=6Y{jU;YHX@i|6Nj!kWaA&1QjBwgL zVx+U)BStx!B_XvQ?c5=W-6&v;vrQ6jB2nygN@6bRHo>3O-mB{>z*qMadRdITJN1>Xd3!wKG$rmN{h_Rp%_! zsCs9yqGaujPK}~u8=9OZjau%kRMeZO%L=DmQL^o;ob`%Ig|CYE+nt*fC1qakY*bVh z=52H~D+&jRzr(phQL;r_oo$MewQqAe6(yxS{k=V+(4XZI zWBh$QqQsvqiC3}NGyE!mNMfcx-^-cpR{=zteXc(wb7Y^F`G-nE#+e2F(>&r5e~~2q zfua}tCrZMPJzVKuC4F%EN<`fI$L8h?`{sxfDof2AZI!Vp&PZ}-?5{Ocw0 zYs_i(Z}xIp{C7w~hP{>kZC=hQf2UXG8vmnS&T9WIN#tjOv~~Wyk~jy68~iVNY&ZH} zl|&SCZt?Gv#P^Ws@OOD^xB3rC;^&xiyZ>WJyotnJeibI94YvA)a@GQv3;YlH1B$9g zs?(pPsB2;N@o)F%D{3v~?eK>b^(ET)DgOvX{R*n_@AVfc>UE@^_fOQQ7yM<4l0)ou ze~qH#5c`wANz40B|4J?I9e=x`PQd{7ksofh5Mrr-G@_$Nloq7Mw#=XLcBqa0Cj~nkEoj7Fz%(FA;2qbLK|k_5auhi)JCV`G2Ryg5TRh_SzgY{~LBd z5^@~uv$H(nKWsI2qz(UU=gXX0Ec2!vl0+L4Z`q}ike%6OH%UT{w-4-NYPut!oh0`xC@xge;FZccLPs7BkBfkp`naZB~tzbN)(=n6p_UF6dN58J4+luSS%0 zDMB{3T=-CzB(8JR%3MxWMTbQK?biTApixeRhT{KY<8?n;M$`o-s68}=6 z2z21I@Ipo0k2#UWK9PMgu0!DnzMp+MCDZRa36cEtyQH~L!Ss7n*Py4Q->bR?T_}BP zmdK8>h)=VdSj4kZL}~gjqzJ4e{g+CFO#doh;@c5_x=5z6P3e0liXh6!-c5pn-Ab3> zm#!|sV@eR}6+GtGaHW^Tj|V;cc$SvV71@2E@p#y;NZDETi!y&a!1iyIY&4erazF&n z1Tdo%PTA*kspr0fg|oj)bnuJpYD%U*Aq9rgeix!K1O<7!Fjp z%Yn&31Ti86PlBXY;bb85WSrB)A{{(8meI}D>%Tmf2esFP-GZ`J)u?Xpj#zFCmWo?7 z=E>M>S)o@e@=&Y0PK;40DkbFL-B9MsWPAUazTi+mGDgBFy9D##Nb6MYk+xO#CK@a4 zKGmBteZO)&nf{@2J(>PdPz0MnM&>mn$iLGkT_(65#ea{`jIfM=+pLV~Qa%pjjB}NI znLbaA5p?H_S!#?(e6|+>Gv<`ZvKZYmF07GhjA$8UonCt0UYV|f7@jeIpNu(D&Vo`e zXk}cyP$L#LDFTB@#wF_&fx#r>(v6D1@saUeih8?I@@02eBD+z}6F{9UO;?jqEUT8) zm1s>HubL)Rov1bKjG2;uCkmXrSOigC5DgZ54k26_Wgn8A0}mh8Xa5CgJTiYRtIN++ zEk%oEKC7xjFUfpP^-el0Co-SU62UA;WaHft9+{inX}s6wAg&04MaVdr^8FY1wBh0U zp9o%rT)05M!yokpmm<)@#a8RZ$2H``|VOk6zcSC5lg8Qmh~@b8_$`mq|hVftfl6LEl>Sn6@q~ zAPkcD7(ye_$R0Tt?WU2jxn-CevNyd5B0y^S=949PP?7WBg!Ry1x1tIxd-9KEo&wQj ztr};DRs9&CL#*hpZhdTSJ?4gdn`DhvBQ`X?W$R9$Wj!@aR^hhm z6?p1H?YhBh*A21lx*=Bc^|6|-|Hj-KaTs`#Z$!_A{@p8$Z*9PKLaRq0X>EKTdV8?U zLGotgHOP3I-09h*PWARO)!Vh$+X;-=*@xZ3w<%Ya@NLSMMSPovCMol)R4!vBs6@Gx zVfY)RM{STEwNZK0UU*!syB#>$UdWm6-!ycKANcZ)xkb-pjLJRvQI zCJR7ot@?vt&yh%e%!#i!kph#5%<995L7W&4iBaGf#c(~fvLBXL$8c+b?*>#cZh(~e zuE$29HyI_qiC4;lr}M7=3D5uj?0LzbWBu>Xu^#qjtpB|koBLL5?pud2g7`Mc_;39s zHh^@+de~o)jQ6mAdLEV_o`}=fSdT)&bJruNmYdfUlXna&IvvYdUwO&nxDYFh3ulhy zI&5q_^KA-BcTH3%)ABqvfzrxjPp!jGQ0N$Ll|fgVUKbY^(ULJv91}GmSNd}>-hUHH z5~H#9%=H%D9_L+y>IB!qIRoeGBFwXL;X@iqpjU7jt*g>~E$neldw4$$?`M4tQj4XW z{#F2ngh~&vE_T!T7IuXQ+JI!FLDb60g_NA~Y>{06X*}#-s0D=mgj|2j0odN977(b0 zy<06HV9en=d(9Moa?^J6%nSQ)Tz?R4A!0!#wE|wOZi2O|x2#Tvo zFITQC!Ou=TTi)lPzG?w_6R^#*v$}g>90n)*#yXUgpg6TQMoO7|(?K7K0k`^Q0m7KG z7s#cr*%VY|Jdf1l$PhiF_(v*rsT=kju9g-jOqrf;GBU^FeIy8 zrC8em&AUl5T!#$!=p~3zS4{(L94p(jSh+%ri7T{Nd4-0rwEhm_)by~*x*^1|@+ygo z;HOyG7jVk<6@Yed^xh;rxW?DJM#lKnfcIXeVm!vE-gQUNX9UK$-t}4PHdhi2bZacR z8n>w&G(_*FT^if+y&BO>kMLxf7WguL<_6Nk8E8TCg*f8S2R?XH>!euf@vn@Qy)5t^tN_MVgrCp;(5>XO77WXrb>NWU$M%%IMIt(qi5M z{5Nd&ZPl0Iv4XBbLF-RU&^|*@{J=GrV%}OF*5@{8@~w-&w|?WoL-Jb0*=8t7%nQ0~ zgJ%%gcfnMPN1x0o4^pxe>5v?r=y_S?YIv%&w*<>7_a5kGm3vRgvS6bRZ#~vW1do8+ z4D?5dsudD^9@HBa1{wHi#Qz=N(gJg5&Yd5E-|<$~!G_Es*r^J)mkW(4E-We>6BCM5)w;FDkG6`k?}>5XmRC8 zG2@KUS2Q*+8(kA=u5WBu)d+6_fX%)}zyI*V2X@`~-uHLEyXSlF{_@uM?t5T#aZxe+ zjVT&UuLc-hSG%M+(!6RBZOjCs7NMv`v7#2mi(15@7A=;e}CNItPM7>UWz|oM&g30Gp1L}nIFDjdicV*7tYY>3#J#xk|nX^IGvn7^PDjT zT?}6`)5HTu@wo8@G8Voy7RxhkOiZoiv&v>%Fn!GUBA2b~{8&waE}wsno;_pQ`79)RWpS~h>aj?OJRXWjzOQuF7}38Mwe%Fm5eOwWMySXYLg z0VO@V=^0=y-8e>;Zpj(b%EHsjV(TVsK3vC4DlYe`&@!NZl4Oh{CP3THPu8|18RN#sXUIxQN+!BhOrJ4z z!Fgf)<$QQvLa;0mdZ`P7Pbv{HW6DJ@D4P|}3eBS7D)&;Xt8Iu1*wjtH5By=fIoQ6l zK61I*hS?jzuy-hIgN}K%4U~ub>w27$a`W8%iQ8c4PYkyTZ_ihEb3xcVxbcd_+W^Ch zg-XIzwJnh)b-1ZyHSUiM8(YWiiwt|U(niHCLf>?`GSRlyB+uA!SnfEhcAMor7*=Q@xP^trSB>RtmMFrQGmTZH?N(5bfw24xdwAe$FM~ z`Liya5w5tTY(_XNV)luys)^ZqTH7~U?Yj-zvBO5#vZtD4vO3%hn*!H0!rT)Rid%5A z&sNbSv#ZrxHt@78anEzPZM5*V zZ^exv)oUh1bL0vETT=?$&)IuHMWm%+Ow3DcR>EF@5@=o0B52|iu$6pmq)yz=YjfD+;TU{hl2k)GLrnCtCO+d1REx1W)L#4Nks%)Q&YCA^4 zuDNx!mH3(%+yfckEzu%iyHD8Cy}1pF!{Bdd-tkAN*C#Pw3UBdExg79 z&ChO&`&II;qPQbA?wyLx-b7cxV3+D9d9DtxXomNbG^tB<7 zD;g{1_U<^&Fp2{j(@LtoPQIpS73@3%DRgc%&b|GonNQ~6cB|;1_)dV>_YT0zt-?#2 z8{3-j{Rv`ei=4t+{ zBjD!njO4b_d)CHq zdiz?tDclv@E8wNHT5$;ByM@$9R%sqBYNSK>K@MpG+-W?X$3=k$-{k-=PlHQkYcpPI zs^kTG9;n(Cc*fVIz@@ReS{49OMmUv2oOMx^8EtB;tnn63uul>UBXqMd0@Lm1=N-#&!O)jExfgm^2az(lfSQvi6ugk^y z;k8c?sK8**Ubm3Wgm2|rC@v9~y15w2Vqf&(hH7&iAqBYwHL>bte7NIyw7CHmMDo>q zOPiZu_os8jRB@iTP&9!hAVkVDyqBi2s!8ArU!r)1PJ|0~1pHXGB8+QCw-z_j!jEF- ziFr-pUxm~bU*l3AX%!dMii@g6*xUFT>vk75kyfogl)^G!;`(Ap<>AcjJzwB{)EX-N zI1#SDyhP{M*Gf8$^FSgwN#3TY3=Fd%EKTIQ4I|Ar?7MUC?T4R0 z!hYaFbizL#_ze-UD0ott&VP5-z1jEVO8s7yTyQ!8xw1Vd4-UD#Ll1h40KOvP$7lG- z^gwyH!N;(EF%`71EbFVx47^|w__zN1PXPZr4-sn{D(l*+qKjyRBooyL@jl#AwQO_) zto>F*M~^KmE*w`less&KmgdIB*3oS(&7(=w=m@?^7#<`-bZlFBI+k1{V^QMglR`z- z!b&toeN|x%_Epm|b%iy6N3XacIA>7w`xR=6Zv!a&3c_+Qo%q7Vp^zhO;9XO@RO)^hr$cKx>M9`|3bzT-AS9RgdUPRol0$o}FSJ5^%a1DuD!CXTx<5 z($2^fdyNG(%z~O``i5HZbzNs+U0+?3pspJ&+03H2X8!Y<*>;Du$NuLvvYEGAYe45~ z0uS4ea?(=lpRd*$m16%vtXb>i+F8JCH_diapQ_ZzGPwRLSYWPm3K-%{NX>Tor>t`_ z+MQu@ph)c=r>~s{675=OIrdr&vi0@y-&)8&TzO+h9q=Fihcj;Jx*52r_d8lZi@Y`SmX2wOmcFsOR;|sElo|a zcUghSDfWxk%yv#nvG+j5snF@a28}R1D&>$f1;pioxHaGovnUsg^GmQx0c4dx30c!d zs41@7_sXu=drja#T(`fVy5cnMcGu$`hss}uu6SH^#cLLr=%?5fm^wf36K6`G4QsN0 z3_Xm#^@glu2e8Cd@|Mxx_C42tv;!#eZm0$lblu}*rrelf-*(L!`y*(X1D%y-zXc+_ zHlejT(JwZEv4*7BN6A<>T(bw#fywp_AQ8byvz=nF3XX`m&d~FmAs0Fm!BRP3zDaP+ zfRQz9mNWBw>ap|ZIK$UDlOYGX%~OQ{$(wyfk31zs7z1&$4+qD`S10I^KlA|aKV}h=G;3|j7 zektsptEB_H1kU9;0D9YxP}dH~gt)OEr641;;eFq1XDT!|b+-M3t3Q=w8jJ$TNZKOX zeLk@D_pgR7=#ygq+PBBa_@&eD5Ohm-45u;;RPhXm?FW$yg3i-d??DOof<>H}PO1GG z#3jf6DU9LNbzm^83Tk`_VwtCK4m8zLKtCL+py14u3qTC^W8kOG$upgdInD)#AViO*LAmraR!;C36rS(;tzn+!bxgA)8(hU2(e zK=1W14&FumQvxgGkT}_H1;u34HkC@mE>c*d2W+X)e_jQqhWN74hH4@A@KxZeK+T2} zFsQM`Q%T}$Axt%X@kzIt`>>pX{}jLE5!IDBo$I3f~o>s9ke`KN0?L5`JJ$ z$p26hIX_B*gBW?_K)xP5cpRK$;COF`#{|HKsiZv1dqhZ0H1LJQW6EDdxG8@Z;R8X= zSW4sNAf?TEKPKF)Hy_I5fpUhbq&#z^HRZ6!nsVk)SyTTq!cF~aG=BJon0qu)sxRoH z}Q8iSDGUspq4Fn|kik21V79kPAl0?q7Byu>OnEE_V{AT~c&O`Dr`{fwnD2MwF898mr z8KK0)&F|cgX8&?OnEkt%H{HBYZF6TrcAX4F0=_AAg{X2g|uuk%Hqq z%VGW_hJ5DN`(0meOr*GK_Tyy2&3>Gt@$2!B=LOb>O6EbUze^|1-Zi-q{Yh#Bb_Zq~W?9N(eXY!100Y&vuxp$tfnC@lvJX zy8If#O}}a)-1N`8lkh*7gnuXDtpD?*(^G`A{)}_{836gZo_`~Lb6f;S9)6go{l*+V zgja`&vmcuHpOf&1s9ux5HVOW74cDJ$aGXRrI(|0A0TW-B1pjRkJck|um~s|rcs{ie zFZU2B4!AH`gG*kXBli;P9iR-;S3I0kFJewZ* zne{GAf^SHI?@fXa%u1~1g-P&hli;{_5gw+V?`t@(C6MoQdZdW_I^L25|7#Nb{A`q_ z>eb~unFKG-Nz6~fTKGVpkYbT%atDc@tl=cy#TQT>&jl!Fh{n%j1aXwJjq*;RE8>GS z{8SA`{*Q>BKv%SzzOE=GoaKK-^jrfELODEGU*;b~_;*#d+pbdyj~MtFgfBJlS%lXc z_$7q57&tzU#$%Pbxbhmfg-Zbzq@xN{0D+zz!z&i;4yMe3E z`5>+u_-}|G+ldFa_f5hB2F~{tnFgLg^F6OiS2KZS5!7cu`r!cQ^y8wo$n zz^^B~*ud{0oY%K3|4G8nHuzs9e7b>uK=^C}htFK)ajAh1Abhcbk0!j@z-JKNX5g0+ zex-po5q_ZV=KyTCJ4rsT!x`T}_|t}*)igi- z*1)eLoW~!_xry*DgMSm@JpPz}8R0(7e@}*%G9EPWpOBvY4V+&faEgJa&_prTz;g-b z=gh3n2*NKg_=^d@)W9bbzSO{fM(eXy1K&mXwFW+u(Zt}x2a_r3U^J!j~F2+p*Qae?$D&8aUhW76bnW@!w_O z#|iH=aJJXu23|n)vj%<+(Z4hB3yFTqz%L{E0|Rd$`f~$cMYK)Nm$)BS6P{(@_Y!`R zfj>z2C+gs(LCcN2cSf&Y^5Ee8Gq z;rAQ(?+NGUqFnEO!k;$ydA|Iufz!*k#2*cu49Yoa6Ze2L33?f7HPLNcb-e{B6R2Yv6w;{7(jcnD7Gz{srNm82HzO ze{J9w5S>o`$oBj$;rv{h@g;;0Gx+NXFE((VU#1v1&v)|-oIej(WZ+Me{*?y)1mPPD zoS(nnngqYgzymb?A2RS9!XGp6X@oy*;O7zkvVqSfoZ|u8^CH6c8~hxv|7qa0#Q&9n zw-Mfp#vjXnn(!P0{|(_G1OJ-v(+!+oICqADXVUmQ&%kF8USZ&K36B`~rGz&ac!cmP z4g3MZ*BkgQ!f!M1X9>UGz+WN!rv|={@TUy?9l~ES@Q(?9!@!Rd&T*0Z#iH@@vB5up z@Z$zPmhd#XUuQY%sJ{jocroF_4SX=+g-P)72A)U!{J9U;JCN`T4gLbc!v_8c;g=iu zZGyg%V{lHdyr{AS`` zY~WWAzBCEmXy7fxf2DzQ|8^L7fX2(+20obZe7a9%yG^2aT4>6whgm)S^>-ld6 z&hxa|;McSBLnP;~20!Ec`8C`BM&dtY@NXcz+rW8#=}VuJu$=D`f5^aZCVZTM&!u?! zT?4Nryw1Qk5PrLXzfbtqB={o+4sYO=$Ky%x=M0?Va<_1QuC z4AXGbhx@BY!;$}E;xEx~*ep0u>Ra%ml^#0 zd00flQ9jR4bsCQH)9Le%CJje^w*NH-&i!~Z;n*)|XZFKq47?Na@Hn91`uFQTHRNv~ z|2eARsAmP~d0fL$PwtmMF4m&rE%M(<{6P&ze(sk%4M+aN#6M8Ok)QkJ6b(oI3+eNT zQ5uf?+%Mxa9Qiwmf0BkHKljUY4M+Y@h<~PrBR{YA=4&|ePoU?+7i&23^ZiJ*fpb5$ z8aT(1)f$fSzen=dYBo`$KCT9j{N+b{6!5%{;{;)dc(kZ9KEgKDCZ(tZ@;VID2K<(#~P0OUladf z4M+Y6jW3%fGwgTl$2;I3k0JwqO2OhR!r5=9(|Ye54M+LBo}6RI;qPNzqVc1iSCE{` zG#usddZNa_dEL-r;A^Q}YY69d@%Q_mH1JLuzyC1smDFDT(l*Q4N%&BjY#8U?3CuR| z=ShA&;XE$*b)q*K_>U-#-D==GF77pO_WvCQ&VK%cfwMn9YvAm+|8C&?yz$QlzK8UD z&%oa#{8Izx_}rg@AluoZH)r zfR6sxxFVDIJb9%fpa_@Yv62$3k-Y`>0glqUu57czsA7Fk(^copFsGvgyVQ0 z$gu&g>h(n4{rE3vzPnwMgYoSr6yNUBaExzk=Z7>L`41ESk2M_m+5S&zIP#wngcBUU z&~W7Ee))}tBY!*bzpUZN&;9i$4M+Z86aSkUj{Mw@?`t^n52pLyk2D0GAm4S2r z_9El*{PH--N!M_c!|^0f!v_Oi3jcT%XgKoo`gXL2BR?PN<;>nXezpt|OfNir1?@H~7m)&R&C`=dZsT{HsX*R|fwGpK5XOAa!Ls zKTQ0y31@xYA_HAz;C%o73q#IY((`!(-$nSp8FKjh(0?}gb4Z`}4gOM^PlwWv2UyRC zNzbVUeuVH^1LyB;uQ%{TB>$%deh1+%8TgBYe_-JJ``AJFqenPc&s}8yDTH(UJfGTo zxq(Lr-)!K`g#W<6IiCE`z&URG%)mK5{L;WV4!mUGw^6-+H1O|G+xaDJYW8n{}JK)4V<4}e{A4C zA^zhA&cCxt3&r;D6U3iq;J+YzsDVF2_!t9Muf`MNYy|1TPj{5;-2)NtgVM)UPQG#vRk4t%NM$p2H~|60S5pW{R3U?AW?yJ50P zQgFYi;V5S|J&&78INQI1_%|5%9|-@Wf%E-Z0F{7)<&;>8KGVQ!2w!U8{5$H~2T>oKUa9t!2QJkoPlQ${yPKjNBElt9wJ<|+MADfy+Myl+aWAICNKd%J=2?|;@CIQzpk4W~zI66rMXAkmL%I6ab)$Swot-!tyjaC$@`krxg8 zEuvr5aPA|7_8B9UczUquako!4lW)yimh+dtRmCy4`pjpnTmv9B&ZU?ck^OB98vg z2ge)4S!c|fOYO#X>H61dxUT;J4cGNAqt6*oj;{Zk^t>N&UH?*g?vA*we?2{iMqJnb zpY;3~ab15=AFZ!!S|tkAiwh!4mcV;g@_WsE==Q_+}P*c>}A+@9^lMlzi31Hw%_8Us=)8(9{fX-l&c-qI?O6 zDjltX_lm)byZChxvZYJgBF$CFHHdu?M&Xi{7U~Y~4HQba>ax1VN_WHjLg=y9$P!W5 zvZ@}hL#qlW;b|hC#!L`HR~EtvlH)N6CrFONB%B~wf=M_*ax5m{1j%Ad!U>XNFgXTP zZ^RddU~OZ7#GE3`;o!i7^S^M#&s%B8#gq>HLXl6>IOR+jHZcc|X~bx_xp}2-DmFpG z*ahE*!rxS$=Nm3ymVXBdn;7!8U#?29iG~1)?F=Z`jV;k6_0J(bp1+8Ut7~zR`X8nG z_fkQuA48Q{{{?_0YCq58Z&7)^m~EX28779j@ZueL@H~h0W9T#M$MsI4`lnOB^Zcr$ z#n-hqN&6SqsS*cC4%Uw!HJSC_0$8H@vna0fe66I#*MB2qBx?W6Mpc6Ci1nw#zgd4U zN&EBJp$-2x>*|%H{f{=O`n#}kaA5uT2+*v5Fkr~S)j?7o`NYWU3C7L(aSk&v^)L2HsuVqMeZ|0$7Z1J;q4Em#&is4a2k8EdbGRJSxL<^+6Xxw(sW@IG zKSulGy2xxl(xyx-**F-_@OpB?FedMBfXBqJT>DTwL!DT$c9^`+LS7>MJFiiNMod&! z6oczAQ-5@GQzn+U?L0ht@8?leJTHc+MD@S=gevhW*cT71AJ=zg{ir6^&v71-@_1pU zy54NwFH%11JO$`P<;%aT7%w7zzHm9denI6qpRb)%o@u^vIi_)+6U3;Q3=1y5&?vy| zXU1nBKau^m?N%Ini4pCG&m*`zudN@a`iafET&9vg-~yCms3RUtQvc#Ts=!_Yyp+Pbtt`-`Jsb4dz1I%EfiOzKIF9YX zSZC7Rw(qs$S3282zc^+4;kmuGAD?D*K>5u9tMusSwzcDsEp}|P+RKq1EZWNt+xDo> zY~PN~wFO5&9R9>^^VSrx+_FmXYsQb@SSO*WB(A*(Pj7B@wVM}2Yilv9AzzruZonUwP(Y`|f#Xgm8rE+aw zcjJ~6xrgn7QC%P(%fkG>xpQs!$Vg}({!g(2AH5Aa2u^sHx zK{nmeJx$r{i?QP9=NI<^y9MIx2H#DKvD+cdZWF+cSU1`Weq;NsY=^dj@&EW2IbyeI zN0hl3+C2{J1+gdhb7*5fN9@GgJNJV9o+bOWll>kTD_+Aso(li# z;Qz^K1-nq@da$FE3*}+H&V2^#{4ChH%MOg6 zI0txgp>O(bKfc!Q`gCemd-+Y!w$Gt|(5DaE{vDs$Hu$;n=?@>WMha27`wQ^>{qse~ zfw7_kZL$RZu|3=1Yg-5NN_VF^Vjk=-u>2*^DU{ltoyd=@3{i1-?gG%G0`!>=epJ4_ zd#xk=r~t}7;}aEo!7ld=@x6w9iSoO!FYF@|uny$8)-Ng!rHGxKYcF0|kP2l|M8$g0 z<>_qk$$FnS`W(=m&t1F=>^Q0h%KoLhJFmM^OhUPDSBj1YLH4^K`(!9HjoJ`8-aQ`c z!m*tTZAIP)|UFzXbmug0FTVKj}4fvo?$Cj=-2Xr_Y_)*qgkiYGC_XLb5*iY=cvYunzKI<;o2C}z+EToTL`K#@R(#28OQ=}tDC_8l7Inu9vD|53keJH*3=(QmG_?6Fg zLYdreEF=0BCo0oDjr{WB9Pr897@tHx#CRHj`d<`BCiK0!^m|W#-Fx{XV28b+>vX8I z9j;U1it#n|__Wu%*7ka&Yi$brJMiy+WUwX1kBVM>>qjsa>S`}Paysby$lw?69K5n1 zd!v=Hqpo(;k*>8i@cQ82f`0*J0^>(QnGc~~&abUKavGFbFUx!WjpZ|g_czbHs`IYYt6@$!Ui~`kaWdvZuwD9%sRJKN5q)Z}P91pIzUj_` z!^QTuK^N?Ew8wrJ=LhWE9cc4{EU_Hobw%iC_k_-`r@j6G@CDwz`qq)PHAg-I{!ySu z4Wwre{^Olfth5h5=(Tmgsa8R80i;9L2K;$ST+Dt3Y;|}pjI)broJ~{X4D0KDPC!iX zfz5>*2Ws!S{`W6^zUR|fufF*y+P}8);HT+Vy>wUVRkQ9&o4LOHwBzO9`_S6feB<$1 z8#IeZyF>f*OJPqSI1XqmFPp=Wn7i0eY)^h0IiZ1A1oEI0v_3+%O zpclr~=Q?q|>z-zV?b5b?_FdF92sVVi0{f%QbiW&S$Hy1rHti%mlx?{HllVLVwNxUz!cRgne)N=$xA~25!7MV_-e_!)hUx ze>hfbM}IpE@%l4}(c7(5@T;5dd>hJgU)0u)kZTi&4JBQ^BNNbeA-LjN;~nxrz`xPH zrM9xK1@RYc2)CYc3_}0rc6D!*a~<{*j@eqUTR|VO{2=fN>&C?X39HZB&Z~h6VPlu72%>ju_?f5PfU+p!dkPQmWb{o$*dPPpFj0<5}j&nx1 zCCfOu&XrQd-wciXI2*Oj3{AE&Y%Q))`zD{O~Daeco$aDYbxG1pUlOek`KO zE+)pR6L0c*s)mcAcXHYj)1!BCTUdMO*u5l~wFhW=oPIra|2~rPH@br5tgTG26@236 zR<;Cx;SVt?<6e^aRw;2nVCLiz9FRRrr5Jidj~&QT?x$UIKo?LtdA$rbp;A#2`N zro8HwQW5u(tR0hG+3pxw=|YvRVAne;xu;Kao7ST%vl0_s!R{FGZ03$fuMsCa_)1*C z6`b@MQN@k$X347fMpUtqd^HVLN*U}SYPMk6dns3;O#OjSa1uXRa420BBU7ij_AO)8 z>O6>~xR+$A%_I(3Pj2Nj2Rs<0K~|P6jF>Bw63JwH&CY7KT!-69rThX>rnuQ4Ka1NP zblZ)bOf?aToSa_iHoP1^VZ(!G5LFFRk7|XxD4kDUi2^wtay=E7VKIlMqf$yv_aIKrBuFXA)LxH~lh4O6GR2+%%@$<8T-U1KrrDmh^Gc~EPxibc z1nIKpov=wg+2!%F%a0|HUEZVYp;U@xs~F1S*^UZjiW?-CPaJmg$z13-lq{vICW!kRAh$RrOesZ# zPj{u9@B(h4TcnJWlL=A|#uO_7>Tr?=H8>E5DxUoST1-QDn>&ym$?wrUr_U1i2T}n4EF9TVpvV54cbjCv_#tx5g{sE_m4t%4@k2z9v&*r(5HE zPUI&)=G;<@0-tR70tt4*hYHiq(Rs$gUCFp zyO|1k=>MvzD2v(!e!Fz`OIg5udJrTMo{?Jt!{AKrfoWal`-m#+Y&B>iHLJK)AOmW2@f#^I(l7L@Innh(Eg09bOutH}z% zRA?JiWwKQEI|NDX6jb0r3J9G7oiSK1i_JLMQSEZDkwZ!}VyM|bSsylVnA<>E>J+zu zk{s?fP?96krG4SepXt&kMx7*ECmZZwgHJ_6kAd1x!-AMN9oj1jl^t%I+8<3Z+G~w6 ze-Y`Oj(WojEU;X$BL-z)Vr-7v*(C{Dfo&M4;aFrmwh0pxbPG-Ck2ac!Dlf=`9+C=A z$^gefS3oBdr}g14>jmVr7z8Zw;jH)-MWB}-zc(N?%d)fN zw`frs{2o}Q_hUNSC(}nUoul6PgU^TT+!moqohggqE68lvW+1b_ zGy)JAnQp5#q!s}xH3DI05{GpyHQ#?8AX3^O`(#hKA)0bSm2xQD9;TGri0M-xQotec z;rZOcJPG28(jFvwXW99Z# zQ=lL@!8unTyMHru!)$8w_>y$_q&z zv|X?K5yFqd(T`R75t4f`_}VQLrxbTnly|+BR|6&b$bsa?w;nkd7GxU(!@Obz0E%7{ z`k;94hkE!ln*5~;c|8Z|iuISSSO+mlEbIEq{#bu`2Qxi?*&pjK1}T|i+-E41cHaG; zbe{o#gS7-71FZ_H1f0w&CZC+|>u42&+@FB}-+&VQaxWdob%q$!gVXuGul0}H34O9b z5cO0ZBtxp7uhV$FzEpWPXn80{491f)LBiI_L@WnkLu7iA%n<$+fH)X+(0ua1&rPVS z7f7aIoZ~Ej6$H%KE`5E|K+l z^b!llhDS#X`clb1g3E^>af)w~bRlPz<%hb&NX&G>Ek=d6DJw`OubQ7*Kg3c7`jj;l z27wrLK3I&8iI8w^vNBG!suu!$8sb%$Ki~y9vm%W_tlSz)UQ^-Q6qErgR}A2-{fP&{ z7cfcV3<$zkoA>~Bbh>g3gbO571u_9IwspYSF|6~fv0{K8_FRz*V)!svvIIS3Vm;?T zhE*(ja{o;MF+g{J5=VhYnbrtOeb7Jpe1x{~V<1w#yI%H!V#NTc7*t+|g_ESplZ7Wh zGfY+phY+&@GM1$d_J$FrPNzyXB&@{sdc4&kuYW~ydS3gA^m4<_Wxlm?avCcN%?^Ml zfw|g{(uDuX5dNqCs_@ZJfp9voiB^%9){@?kzRHW zrec;mnsFF=lD@WZ18$whmV4Y-znAOyV!0ikMWLXF0G>)5{SqIfp z@gLYJ@D?I(6?hrnZ;LG;pS*E|&+Cj4K9mmDmchk2-G>##H44{4^X)@cBeY6g=BY~= zUf^zpEzl`z!51`)M`!{krg35}BxFp(muJcZ?iwE7h3ELvPqoTqCkok#F+nl}vYlBz z2$GetL2?kkV*+b8#uvshTAUOnhyVg_d*HrD_A5Vh7bD=tLx|*AWp}l}=-I9=*gDJMk^?;iz&)QB-!EJ8G(Z zIEXy&t~zlz)$EEZU-s<#g;p_7#(zr(LuNPaK9n1gKm)>7Rdar< z7&Qg2m4RCY!c&o1hP3uz-Xz@1Dwr>Nw+HhlJ&Wo75DYzIr&n{`KEU&ArXaoZnRJar6VEY1WCiB5~eM4n^Swkh*y|A{d z##va|goYV2%c@Hk)RZl3bTDF@24Yy*re*b&h(Zr-sw=On!8jI!mgFcN%gbu(YHM){ z8c5VuHa9u0Z2LcD2P~c`6N*&VRyQR8>>oazu=d6q5}^7@2Z=|0^wBRM}8lSySqc7U0xUGs?lCtOh!9 z{B&q+s%t1)SPAW4URGlzq3=qu%aC{x1+CCnrPxqTb$ux|8g_FxVl2&b>T01kLsuUI z9l*3Xbecvu!JunU(;A@R64NozSEZ%%VXJmbZ*l%t#(j85PG5?FOJ_NO%TEfN0F$jE z#t#|Ig$$&#VKcWkaKtC$PD#6-!*2?1Ou0Goqv)M!W{E%K6vKuApN2Yf+VzYv=azPN zw!fo;x#4ay447{MF3J))X}4RJ)qgwj%%$4&c0IFiO1U#~N7UH1%O@`z@K-4h@9Bk| zx3isCw}Zslh)0m!;m+V4c&~jTZ2am7UOYR+Tu)mX^G*HXh<876`SJV`#36Wgo@*KtmiMTs!2zi; zw+efU{Q`wJbfxNAIEEba-Dq(n!D)cwHUs7G_gDIshfH{K3z-%3Z4@p*8k;I?+c%=#!&Yx>8Waruo*ty(9Ahn`$0Z2GbSR94^o)UI&x+5Dx zErCEdBW+qZFfEt@XGCJ=FCa6V7Agt$3q(R+{ovEk)qz!TEDHCEgdPhNg}XthO8FI0;~QUh&Dw+cmE*Tv;Q@2&2gI9nb)&p?TbgcTS(7&%RPWn6$ z9S>d_1XX?eidCV_zz7#X)Kqh85Ucst7113Y)qFh|2p^voN)5&W;a;;MpV`TOh0=;5VB3kS!riAs zixh=kzI+v!7t+@cwg(9IwrdwTc`>zHuA$c%8t6X9-WObe$^4-c4zCWH$j zSAsu4A=vR`2s~sAiG-d)8zP~nL#xoDCyYf;gS@ek(1oi&R8jcEJ>lsQ5Hc;AAMOcN z3r{k7LT_BYD%c^ZtG^HmguAD;8h^z0Kqm}lC2?Lq2F~As(u3WrUkdAn7(jXbi7AjXh{i#yQT$mx`zAD2zQN+3-`Y&9KJf-A+!v97d|@@ z`VHuTZt$oP^896cJY+luGKQu_PlqbJik=TW2#!si4lVmB^eo%5vOU8mMnX3Qp{@^H zwh9~N`IJwwQ69Z4`ZrYdW(xG$WRJgNv;_Ng0W~`=Cr^O~K8Dia72zJ!ao+`8P+;O` zhI>FwmWTUCW8v_b;gK`L9nOUF2wVaK%)e8L5P=>CsfWYqGhz6d5gr;k15X4|hsTb& z4lBao%*?wRvEXg2CIzQw)nd3J#^b!mm0U-7B+5s z?^5fwpM^c$_7G@kpY|CJk5E_WID0QOXTqK^wCl8ByCkz(6AOepUTMb9J+|21crpG? z@HsvSUm7XSCr5PlS@89TIXd(NPhnkrwvppLjdk%!1~<>PT?`|o1~FS)pRg$9RTXH*z#aCm`Bg&_vV z*LV`cX$FTY1{Fpc9KOv}IN9KEajU|K2B)W*BG1m{XC9vl6y^*weDMgGa{pueiBI+u z!@CBD_s={+$i66+loRskCrAq66_Q5?**D6PazbVn&mD|@U=dCoS4Ro|6e|G7Wmk6k`JEggXjC`o#&$$-b?Ycb1CpM zMgQc#2wws6Gev(k_xHe!7(Ct|%snmOzcg~<=LO$0;~eLiVm9#@@GxwGEfab!2Y&8w z3D}t_`nkEM2NKR>nd!v)v$@v>3}61rjK7p+@6iGKvC$jv&&+?x$d8|QZ2x@*kB>8q z;}=M#IKMVR8pC#w@73-X`1tuHDC5OH#|IzpBj?9H_%XuK0M5hoQtC9Og5=hH%u&ZGup%z^73h z53dS*guwR+e7L~B7C8L89uJ@ogZ7Vo2|3w6_y#Tpw3DBkVVeD^<=}HA4BF3AES%(L z_9y$9`%*FS*>8-qKbg;V%vF5GHwnGc&o2mE`uU#%XWJ0szlWh8h7ku3Il@2YMFq;k zevSe8vR&p0T((OE;o6@yglm6p5_0}K?ZSRTJI!kX)@-Mlj@q6Tgll^qBOK-AQXCK2 z!p<`UF8wxG;L>mSeklij)`;?D|KB3yyKlQdp??Zowr>>1Hw-98w(p4om+i~5f*{|^ z&xlJqxvhIBocrUk^0Ta&N#`lc(f;T27v-NxW$`c_(in6*^0QqnrUgj{yLG5-v<~p&f}-X@p{jTKf?#VN8s}A;D`@iK$n21SMq=1 zgQum$?UDSS`rse>;8W;QRqMS=;M{ho@hcy^8eeUOfN~`N4?cJ<-4bj5tv>i@YIx1Z zNiMzgE~i^-&CkRaNg-&w&t2S z-jgobv0jqD+Xw&12k!@euEL<@oacjIFYs(r((YatcyEFCq(>DfU*f#>t;Pc#Y+;Qr z^}!$W!9NmsA7RgGdSrm|C7zlY*DLYseee+7l4&_V^uZtV!9VfA$I=&%mVc2CeuoeK zwGTdw9))Q6^99~l_^rhU@6jdhH_5-&2M^G#De9H{Gkx$&1o@cBC^2==3#dnj)J9TCUxvX3b}MBvE(gwm%e{Bued zDje60!BA`uuAN^|dalA}5x-L5_-9uP4ff#58AJGLh2vT+7_PMkmyh4i7&hC3i=R&T zeF}ep@P`!seZrqqI6f!B@Edz@<*y?Ab%ozg_T?-$y;J@EqcQrtmVtzf$-d!qe!;^{S_I zM<2Yq!WUC|Bpq>F;(I8xKc@JpbX_%7;r4e0$2mvgt0~R(K>0j|p!_<;??Lh}6*!MA z$p3-B(a)?GpVMMMKOp}+lX9Hv1djZJB!82@k^dm^Zx=Z74-@}hfg?Yi+T%WfBR@#j zi@O#6DamCc{e3Ea zU(gToFr<=xZm*a@;TlHaJU*VO@Mno%qVP8eFH`v62(MMRL-lPYocsBDs?QAyzlHGK z3jc!erxd=G@ZTzY2jPEI_#=eBr|_o<|3u+05)O0eo51$}k#Ihr7=N4a&eUHR|2N?y z6wdcoGZb!rCxe%26yBcfSgr6Z!Z#3(?Jn=LHY-_&f{$|eJUt+Almjmy zn84!)%i;4hMD`+%{M(6toWM~&pQn8OG5=lSbG=zU^Lh(8C?9^}Hv#4hF@gCfQ96%~ z+>UrnhM`d5e7!YK;kR45bG5=>Cj2Ia^Yz{%3hzMY?=uP?LilS6j}iW^!g-wh7vWrA z9*??5tYM7X->u;vehME!{b9Po^9ess;oNU46+WH#mlKYDmd^p!DgFd%-yaEl0GRw^ zs?V(g$9}Su@OuP~e0cf7gzW-H{&K<}5jgV8D7{DE$X`eN=LC-Y-%|S50!RKv;=d+v zle11hJAKMrCL!+>RkS1{C|CHo+5jgVK z62FJQkk_wp+1}XmiB!3Ly-0msVZ_iNte^5V}EpR>;QU3P@j`l1f`3nV( z_BYb=mqh|c{x0G-3moMShYiCO0!KM%Bxj|-QO<)T=X!yooO!TexJlqB=M|E3i@;IN zV-x)gx{#}cJ%%Au)?zme~xe-mw3(YPZa)r>L(egwt~#J)8WAHg$iFp{0R!bg7EJt z{7S+b2uHuk=XEO-e-@2b*9silt0z6bTQBf|fb%%Hg>aV7VniGQ8Ik^c_y zZ&&!!gzr%JuL%F8!v8?{e+eA*cBbdBzY#d<<#GOXg|nakK{&P-`ZEVM3@PL%#tSX% zbR-ivN1>@9HQ|AYAae4G2jzllFm>0M2FCnz~5(sSX-0+)Jc3LN#G zP5jvcM?UMVAe`&l4(f+tjpA>me)x#Ow-f%V!k;JnO@-sUP8eWqJrmdud>?g4;d_X0 z{~2xXE3<7;vu{uRj^*4){lAOA(GORXA9@HJ{lM2h0~OBwa~$F5pKRdQz=pxjA7<_8 zZ6UK?Cgh;rmq_m_g?Fas_}3`>hlFobIRDGt{9y{@azCu?V3lttKH7=)@H3a+D!iYi zJMSs^J4w!Gil0q&f4)NPHJJK4x65mU=PR7Y)hP<+>zrbRe@JrX zDxA;vDuwg;{sV=7L~^bo9P8DG>k7x46#s7OSDOWH&TI19R)M1*xLywk9Ql{i?et-9 z?Eegfv;TV%&VJ_c_7uTKY&~okCI}q$E~nphCJP+v#pBpafg^t>@n;Jh`8+;X2psjc z!iHh7z){ZoBxk9@htcmq%N0JK@HGm*neYt?KS21MgtLG48fzTqDTTjD_#c&=lj--Q z{fhq>@xN9$KR4?leow^ye}MP{1m2f0JmeA1?fwLv7cqgO-_9p{rU)GU&*w$4z>&X& z_$2~IKA#u!1djYn`a!8e;K=9mqF&(0Urqcbfg_*$?FxY-{}Az43mo~}pEnYY?S=l~ z@%B-L^LYD`kc09k(C=+;DSkHOVfaAdJl=jK) zUdiEC@9$Ok`FuU8@F9f%Ug7W$Hxu?Ld=}xKDtrv#J!rgV|G!8$nQPt?I1v*3JSs{V z*p7&|z!3w9clrAW=YGe0UQ%bcE#~s~Q#xPa2Pqv>_}7#!R5(AEn5Xc^$et>Nze;$$ z!ufZ%W`%RT)(afRrFoRzq;S@^Md7TkMd7O{-Ky|sDZN+WT;G=!K9B14hQikq{;|Nj zQ5+8k6;791@I`MkupQ;^Sy6@adujX}6#4SGdN;vG{B}xb3mp3u2Y!yi{fFP%A1?Uv zzCK^!c_b(%aCzTdsBq>N3tZmM&QbW~lxBaUo!M+W9IFH$@r{&MFYw-k;h|aK+&@+b zTwVvRQ8+)(Sub$;{kTctEPso@c??5)S`^Oy`MJRRBay-`g~tfzHVs3*>~F&jIZd^a@p zj#XuA)&TQlRW@=x8=D&ZWYF9-awemMiG`$4I~@~G#Zy`eGYQq!mEwdkO*kbJ%{hc_ zGcyU6)6#U?!pRDws{Eth$EhRq`o=^Ypkg^0dLRQ}*Q6)-_e;o_W?e zLyZ!eNyw*|orT9{S`WfJ5|!k%%Bs=@4LC6qwX2x}$w!cxyhqk+;gYh33P10g*@=84 znVEvjJV^;=)s?G>DsrK9o66=pxsA&fj=I+v(l1vH9&bU{ljP55}UAc5Kuo3`C32L)2se5YInZg1DXk1*CIeQhQz&e z0U_(33b@w)JSg|lUysg$z}GuAm8|PoDD0(w`1fpy;ZzXopAMVWkMGfW>F3{dkEVZ% zkN$Zc`tebj)_<{&{x_)pe0@vRNUAITpTevD>q-B5Dv0&RM*~{_A;7%qUqaUh8>u`W zw5|h?p)urUpKD7<{dlXZ^=AR*rGG!^Z?R(Bz1D?w(ioC|PWlU}B-S4v)oJ}>0Q1tn zo``%Nl9(i2BOt>||3T9KF%?Ap_y|kuzscwP&!gX;TBtl9w65!Y&j0;$Y>7fDi2CtS ziq`M==zo*+AFcoY$EW`drxzl5oJ0Ni|6Hvf-|O`9e}{A+Lx`Due5dO_#i#y-q+g!@ zcs;K5?;D6khfh*iUu2HQ zwtG!5I;~eIx@ho`BPH|O#}4hyj2$XJ^izE>-N~fE z%)C5j#jJgytU(86P6m4>fn5`~9lq?@7PNEkg|S2MAMBmkzzNJ)F$=k9+q_epL-W2l zveU+6hn|j1+lKKiV9&f$Vuvuk960YEInwn&sMnzVa6Ek3o^Ah0cMg5EFbFzApeqIH z9`>wz3)CI!4DYAz{3X=?5XkrfeDf7-mw+D*hN9bl3A&;oTleKq_w=w+66_Q^6xfRO z>uT#4cJfj~;ERy+$p>9G_lTCq4owL3`0&GfH}@zCqz@_$I2VsQ&gpnc$6Igh(&sG9P3;qd_Cejy ze$YMz;Ik>sz#64vETh6&G_fUT@dQkGZT0in#}E z3uk0g1lon8tu9pgDnAU1Pap+l!#vN14Q8op9l|}xDccCioFKk=Dsp5Wuk617OWFzstHj<5#y@jod z>#yP{_Ymv`$qiG*wy+_`(p%VqRx%RKRn``7^6zp+v*7WrH!9d?RdGn0d<=`8vo}** zi_hk0I~SV6EIw+_GtNa}z~Sh3kiy@7FlunL(6yzUqa_5TILER^br!L+T|pHb<*zzu zERM2{V{qV!B#?`G6!BWqIt3P^=B1=VIk4*OiEzD_5?|yxY!|tXuWp?VPf+DD)v%l> zt!`~r5KeWMsfJt5G?xg8beCwB!ER@l!Oq}iu-nI%!9Ly;3*(~1@JfeUEIl8jbhN8& zXLbUu&h|7a>6^oh{%&fpKFv zntCB2k^6#aNZJy4DFmGr{_OxZMSe$fjiSEDYoVygK?@^qgzO_dllWsO%jDo}UXeeA zx|zi3nD}!j+a%7$#G9d*NnC)5eW7}jSPSPu;Q73H9-KY>kPZ z3T8(qZHdPx+gHzSK)fK^&g)_lXXM+2ky==66F6T{bZV8znbs^4)7Oi{j24?137(Ih z)hZIj`)mUJ8=d9AeAW<5Vs?s1ltgU;&#~zD+S!DWHm8G4pr@nf54Qz7FL)Io!li zRBCI!6Gj=4TUq82Yf#!(u0d&ETR~`C+Se%px5gR#aJx8uxPypiIgu|&cJKuwyF+lV z$%g^n3I5v3Mvn!56LrETLZl=9#W%w5GX|eAzo2%CoCc_=_LmXFEPI+jY~^2R?wL zF1W*R05-dZUixTs0RDnuLi%W|i%9+zOyf%xCw(lE~x`jT}8xwO?azmoujpW`~#q|E5!-ivV z{Mp9w#X%SsPyEL8R4SZ}$7mt>s}G^(pF-5{h6Vak#~T(vYx*%KeVFlU{4XEvAcqQ# zbqkGEg~qBvC0J-N%1l2!5SM+rDb^ox4C%1|`bnpIykgEaLxJi0ii4{mosG%J@Q$XF zIAQZu{yyLxc^)E5|Nm+Kzp{3e&(c80vJelgo-l#z+ayu{>anVelXafC{b9GOr67$ZlIQJhivnll<+91=#%np#{i zW6Fpz!(Fg=TB4C;Qpma)MA~q$l6bLDuIK4!20GbVG@$A_Womo8b z>~jim(M4F75La%4x5gIN$5#lXh3xnRK}t4OHsVs0&f*2|OHW-zrCRe4WWaKY<<<37 zuw>;DT*(d>8-$nsU?D+Uu)4ymnPwIuOlU${1FyOQmP1QkzHxCGtnb(0)K^wEl$KY5 z4pks(5$2vUzM(`v33M9+{NdbM-LxofTsD44lSt(tN1lk!}5Hv zzF}z{sIG2oTml+UV&jtexW1-|Ti8JcF6L(zE5u#t;>w1FmGSlMj81%8uEH)l$IdgV z&0BON6~%xj%xi#;K4d~i*cpM%JM|Zu>q)9Q=L=4$QV|?2xI0w zMb<@WSoscOxPqO?;H4d@nou3CCDv?IDK5guNLdZMdM~QgAnwVS)j@(FDr%hq#Bk$@v`R9`m&}fTupCL1wK(qb#T6zCs*7z1{$NX?_GX1Xn*ndBHo95H+;Zqd&UrSET3uJii<@yK}Ul6*VRIhGA#`bgSJt@3V0<0Lv`xH5Vh&~z&piB{+pgz4cfCd6{kZ+D9d66Iv&$Xb%>Ry7 z5ErkJFyLL_MiYa1+Ub}L#};0HdhuPJMS#by_q6T}kSQ^QT#$bWO~ zJ-BV=L4XW_FHRdn+*QUecHn~=JZm8XZhX)v_=<;RSIcTF6(?m#g&Nop8W;#?rOgP# zEos*DFkCmA75owyqXXe?Y0*oUVR#rs#}tM8M6Sdo*kFCXlL0tBa&|Za)?&LC3c`w8KZMouP6}Os%VI%h z4y@NV09MWGh%(L&kDL}h3($_Rl3xxi>V^ya^@F9@V2Po1%U1=X(CHKFu@2Vh12g}D zj8A{CC)_P`y;7Zn{Na!G>U_q|P^l9P2q107oA+l6lx$Zx(@)vmPzF<+fOQ;+c z_QGYm#^XYFusGgFR}_UdKu!;EamMuU(6hs-Q^O};6&^Z0Jf;v9RfE;Ta9KoHg%F}n z=pB%i9f5@bO(kKCKzJUcJ^27E1(=%F$@B+W(J`SvJWBc9puc$KKLPofX`jQ2de-n~ zL0Q%eT;UIG7!WxNj}hocKZk|=pkkPx8Ok(EkD)c(HGPi%1cKKZV(>Hz0zJ+WWzRP_ z{qbDjxCV}W%T$06#djpdlK?k!oWb3jc^Aib(h~m-X0v)3oc<{8vVm!E^XyNcaO-XG zjtLkh?3|r&QmcSZTH)?iq3~a5gTq~}3U-cE^AtKE2j7W<+v)@i6ZXHa{Ed{D{q5K0 zO12XvhU{~(MBxTcw$t*H?XU{AB-IJh`7(9N$Jx4xxm90owdN&_BJT|G@{x zcRs!NPXM0jUJ=BvF`ff8nWEjzwFzKX8a&=lvaC7I-3E{M2mXQj9fQaH$sRn_;Bo&m z4(52;d8?28t9|hKK5`0u`1pT8FaOm0@PTdu&WS9~Cicup3eP4!&K*63;&^BhIK9?u zkktYoKyf@gCUE&5#JvK?cRD$|N)gn{kAe}}CvfwmlhQc?mv+_*T-wx+H*3+@xXQ0cIFAbl*2tA zzgXnieHQUGzR?HAIR`LkKF`^$@jv_U+nez=ShPZ@y!-3OmQ z4UcjppVXQ;pUe*zSQ!ZI?7`sp-vw{WS{z74bJH{58UFQTPXh-=XmT5WZF6eBR=V-5A(@ zdz}Px_F34)_tJUN>Vxl9_!v6>Usd={lCw|YJeTJe3csEBhkfuc)sO8TPkQk^5)6!2 z65dnce|NF!IQB>cz6d&%~OyK^@ z{Id!FQt{^!ox1D6A5A#V`Ob1;gcm9PnS`IK@U?_jDEv;sFIIR9;XhFLgM?qBaGq0*=YC~7dG31l zE90+`oClR0o&)|#h5v*2FDTsnfgL<5*C@dL)1CVB-xZ(7&w~o@M(GggVLR>1bnyC% z51y&;!_+_cI*{eqm+jylMDgv5dyd2H$^4tho@t7I8R4^h@beYUb0;rQ_yUsCpm6rj z4-{TU{EZ5Sm+MTp%?IDA@Lj}zK;e%Q{!4{FMfiUy{8xnkUg5tc{I3dsk?@Zd-i^{< z`rt=(0$Q20!RK=#1E2w=7))& zA#mg`r0a=}0!Mq&iGQNNk^g(*!~gwEVEOFN!2(BqgvO;|0!R7Bll)T@-jVPa;oL6k ztvY9h!ut_EU*T&Azg*!j5WZI7ZxDVH;asnG$iLeZ4!=a0@RGv$(H+l0#d5k3FGTgj zddd5Jt~c}9z7vU$IQp}c{FyCq^e6YX!2(AT+6&0PkN9%!1?2Z8{!$?a`8}y!E)_WPxj$be zaO6Kt{Ivo{{>hZyC~)LYp?2IPaO89U-zsqA-$DF)1&(~~{|_ph`@wF)xu1-u^X@r? z^YgMlD?E?*pDTO|;r6B5`1R*dvNJ;;NB#X=7H?Qzn3zQS4l0)eAm`|7{rTqJOm!{^B*grlG3bEK;j|F5L?I)S77 zRpj3d0+;>a4uK>8FT}q~;K=9xdB4DsKbF$=b>nz@asPaZ^4b0zD1+g5LJrEGO!k{h z*dbqjZxY?bd2Hfm^T?Oqk7yeP#t+z}lTAm&Sq4IE7vuap#c;uw{ViYN{QNE^aM@1^ z70&!(fy?%tqwo?+^RqsDjw1cTb|NnQz;Y0m^<7Q!5SR7ZByef}4uMNMPp9!7{U+_P zzlX;CPsQN}XB%TbGtP5|ATI5xr|}hWY0r9rOM4PtBuab%s&a8Tya%P`I>c!X)pUdI zn-uVVR{RwtcWy#{Q;A=TurE@1%vu+hW8Q{plYy^5wMoD?rxNF6jEmRrLdgm8l4m}g zUk>kaN{V?uP)`q-R7?9}m@H?e1T-(5S=5~uFsW?POJdwGCc~Cam~S#(H+qY!2BuX^ zFdEY?D;M&Tr~ONw@Xt*3XJ+~{bNnSv><82K@x*=*jZf@{Q~JTger8@jn9Q#tmrphB zy5H$|5c)Hn3JK+NCfOukZ*wNl6T&b^A*O~+Czim9C+Ku>febirvAjHIF*Alc2t3}} zR6Nc26_DYjpT{{l)}Rcnzu5yrUP}({<8uVzc!yBkjjj5cQ*Ot$#FNUi!1B zQ}Oo;iAmD+rce3oV=RyJD|qQ2Lgo4U%1{48P}r;f_4H$OAr-{>V_kIp-zNPmpN}g@ zKVMHVj<(A1rjPzzq`w249~e+SzQv*S_XbSM1jzY-UTMJdTLzVMh5(>3&x+}&^{4pg-%mdfW>W#wkEUq-T}i(l zOefNpIo}Vm8LXd==RpR>b@_UF8Q^02<6i~oCz^X$-^)h-sDuMOA>i*=iemCNdFaRA zi?x0SDz58}0_yu2F-|@SN4-5^)8&T^&rS$3Y2$X!bAgQ-n?G)hDRJy`fkoF^TW}vU z(HOkH5kOnkrv_r<2BtV;Qy~s-8{uD%*TZ?f9)4HcPz2lYH~)CnA~+6#xtlVsZvEYh z5bp@s$D#D?6N1MtS^=*_b&O2j^@}4%@Rl*FL-4{~y|z0SuK|30@0V}w70mbmTv;-# zz}Yo(Mr_xFK>H6TLHeV^M@CNwIJ*aeTsQ~uXLfAr4LFC>{*ZYU$D~t1*MvaS=t*ri zdDk}3gY%Ig@9}OCG z=NUUN6Xz3q+RW*M`mp|JLmKGAx}z)GQhK=_C9Jj*uL)fl??F!f$VY>vjXB}934Yms)UIyE2*rviZ1GWO#2E#TCwmTii z*?~vc`oeZHYzrOyFEWgsu#JNF&*1nI*sg|c9c-7w)&Sd5*q(6g`xkQ|J`c88uoc2K z9kwa3?SMMn58Hi?_!u~v28ZKqu-yXNeXuQt?PAy#!nWOUoO|Fn7Pbc= zJ{pdu!@%)Ju-yvVcGzlQtA}j?Y)4?b!+{Nsr@;}gRYpR55NyZ8mJ8be*ut>g1>0q? z!N*w*+jS6G2HRTLmcUjDTRCiJ!!`}JnXsJ(+wBf)a2yZEVX%#W_(0g&!!{JQ{;;LM zwgt9JVcX+4&P3R*g?KY;YhY`F?Lye*!&VGi5o~9{HXgR0fxqr|9GGR$ac+j~Ccu6S zTODlGu+BxL0ArH?t8JLfD>oUm0b5jQ9qn%!SYzG;b zkG}EZ<9Q+j^P@g|Jf~z}zE_=*hkZ&0<{t;3mp!Sik{xeT_7AoVmqTV+EAHa~)nF+C!`@em})Wd)Ou^o8=Et{0>Lq->>-CZ`-oxfp5Xb zKD9&f2OmZL&%Om8%(TZrZSYY}r&i13J@!x8H+6lp6kpq}`6nwr_kUSWj-w636rcM)bL0{E zIf{?=;3jz-2iRP5;E@COf9A*|a+bC-(;m71Fi+R_62<5KF$ANvBH zkAD17iqHL@`Iyah$2eY(%7F6G4}Sd3t&$DbO^|HMo~_@4k2>*sRt6qF*&enXj~IT^ zY7XwMEk4S4!e!bB_kTb6&niCl|F-H|p!g`iEq|_2e3ai7|MJ$v0(^e?*?)!N^ZDh+ zNBuJNheTWU+#$&j=krCLhumgJ#cOaG_9|SvL3QyS@b<+Ys+(WZ?eqCx6Sg;G=xJ2aS^U;OwJ6`#)+=3_Sd2;-}9Cjy@@etf)-lY!3{=Cf?}|7D8L=ZhadO$vuNpD)bE zY}SEs>{~M6_YvlM@sW%DQ3n40^5eH}mF)QSe=5LI57+m2#pnL)#~-Npd_FRt>&o)+ z9$N-J-~IT56d&!u&5u7)@p=65H))UNU#s}s-&nr(&vlB= z{mqY`q4?b2n6K?=r}*4|y!hDPQWPKC7x6UM&~`09+zOxw+<*M|{aXbYqTGL&ul+Mr z@wxx_@dqeA_a8rguHtk5@#8lsKKCEyYyaT$C>gl_`0>{$KKCEyYyYfOeC|Jf{E*^v z|6#tiKdAVF9RL1+{iFpp8MwW$ou%y<$FR*F+&%l>kN-25X(PzP>jCC#`yWtz?hk(a zYZV`PSTE*dHrE5=*WpeC?*D%LyITbrqI^BTe3tF{=Uedc`}(Jf&({Nf@>{+IALVaU zeD41&U;7`QU&_G!-;aO2;&cCJzV^=ziqHMukAICc2IBo;YpZ?NDL(gqmXFzN6Uy1H z_}u@ok1~&sNWD+-x&Qm|A5?s_1G&uC{(ngEx&Qm|*DF5C$9gdzv!(qT5DGPuhksfU0ZzYpZB!7R1@L;? z#pnL%#~-8k+&}&Jw<&L%Q@%j8^zH9@u z!Q?501w&zO(4pr}Eh!v2xo{$UMh+iZJahVaBSsA$J(OlTjdP*IF|m(bZt?7C$E^L> zxTyQsm{{{;V_Hv%+D|N)J#@s#{GpR4O-3&XcPbLh6nk`%kc2bKdit9+o;i6&o9%); zp%mw(^_7P_l6O?zuF4-$C z3uUQu$-5dTuB~3-+4bB`=hLqe@;yvR%2$p|$QKocsHt;8zIIzerYM|T(qvK}NG|2} zorEl-&8rM$P@i$jB(#WMHC>W0H>s{J$+yBTLx@SNwaY*ms(&P#jAB&Za7k_V3m%MS zOc|YM0B6XrocM*H-#1PoL)Q+kkrElgL+nOxl5#;ZN$8T_Hi_yy{FEpu!R@LO_%M&E zI6-Ec^>CR-wbQdv6AkoiK%nr|xo;CHj;NpMAx4Yh_%)*k&C3CbCNw5Ar3X!QdSDdd zJqy>-b?7k|=yH!iz037DJAG~NYgA#cf3pgbZdmvJgj-a(I3eG|h=hC(Mu1 zqU%YwrG)vOZg7c5^My-9iK>GnnC%i#q8iTDvqb|ZYn+6N>ax}-4GKX1w)Kc)_J%)bv0F^1Gn0wGg zIHOy<2uJf=sDfF1)KX5QjChf9rt(o2VVtWeY8;nx)EcuCwplD_9HYErSckn0DREnl zTBBqq9Mx~*NpsxRqZVOXSsT=tquG>a*K6ifKSF`XQSMU5wy-mmcc%>ge_11+K~P7I zW+ix)oxw-1m8bJ~-RN)-`en#22c5#pL5Jf@P)Fh`Lm%fBO2s7Gdep=Mk&Iva|1f`vD5U1+oDau%A#iO!OY)TE`S z%@WYKlylc~a84%t5FKB1+Q{n;i#Xf0t4*>;&%lUINSu>?Uie&)ctV~tq7(d!K5Py> z#X`{t!-CVnt{CZsYe8cqJ8_NZ-nfD^;!ZF4kt@YCR1}A5cfM=`CG2qIcVe&wu8Q*P zqtJ5G0ZEw+yN%}kA19oGKdZws!G@2yfvck(@FzVJHU>tVG`!Dd{AtbnH!m#$2di z@P`4r9y88!9b6l*>oHe>dBJr7yB;&n7#X}KVAo?d0y3hriG|(LhEs#4&`PY+nXyQbM)Zx!~WMxC@wl(CkBIpJMi~ z2s?y`*&k>2QL|4q`!uspH~V&GpJDdx&Hi|^?_l<(BRiQUZWc~=vP`_Q*>^Gfu4doO z?7N$N53@hP>~VE?_}jVJpJevE%s$)fdz*b9v+ry6{mj0<*$*)Llg&QI><60tAhREA z_Cw5msM+V5{V=m1ZuTS0ex%utGW$HUA8qzy%zmud=bQaFvp>b`Pc{4TW`CO5pKkUO z%syuJ6U}~-*-tk6DP~___Gg&=nPy*T_EXKi$n2+?{dBXRVfJU4{Y=~R$E9R6(kYNK z)i!;KHQ+loy_5PZ$qNn(bTEA>*vEFD?cOrE-U{?DMBfiJEcHA>%F(Yt)wC4$CUaTIgL{>Y@`dKvdL|jN5 z1HP_c0$w5n>QKx{n67{bzM9||87`|3kig~L4@MSa;+9{ihLmK;uCp9BAk(!a}OYM`2 zwTMgYqo}5ht&2x1>S#-ChmOwZiMBupSG7Zd|JR5At5+b7uSweovxya);dH4o{w1Tv#wGagAZd&Y3=4^WeEiDctUt7EGSxnKf>tUl!c^`(>d( zcp~K|&?gH8`eYe_XH0^FuT0-uBi1+9NG_S>E7m*9$n?%af$;3aPoPg03iQb0M>l>= z6wmi=CpRDEdo;0|Z`_dFV)1;C@6k4HzHvxf<*`S2Hi9c+1gdD8VzjhP@oCRQEy*qC z<{K4lG#$g6!2_HeslPbu�q-8QQEF5h#YTCRn>2mqxo1qB zUFcQL&GWD_o_EHiG4XZMX)ucCCVP7#JQc()?|BkoPx3#%e6mclCYOpgo43?>K6cJF z%KONlIBV)ezjN2-fn1OC(&V8`zdWDw)s^Yd9Ii~iJR{Td?23!^&o&LVbK)M+mM& zDPO|(9*s+?n<`7I8%rB17uPMV1X?4^mc5|Pb+D&6n8~@icA*qmYHn(zw`!^zn-XuR zWG+mWEi;pgYXa1ut@4f43rp)4m6p{kbZL-mT2@~PO?9+_vXrjx5|{|Pw6Z)whHz!6 z$**r*>oRJ{B76TzyE0WdwXtr@9`V|e%IDvBZrTK&xql}s3Q!ksh;0Z*02m7B7A2N z)wSg{ODZbol1P|Rvav??XnaNiRwkiU_)~=KK)EKqxWXRm7uh5H2w{G#!0LzY=!i?L zca5wHy;X}#%7^~YF_;$!cU%GMqQj!-kP6pVqFzHR6BXaZk8?Xc;W(J~iAf zln$%huMUT21l!>v3qtHmAT}fIOP1q=?g#0CNa)RuMZpxsecYJvI4naCoL-U8bD$y< zlxN@)^@YX`C-j&t|63?;R%jQx{$g~6mPVUc9VqGy#!uzd;iY9C7;T~N?K!$WsQqUh zSD_GHy)QvXCs?2!eFVxfqdS68RjcbV6DS!Tl%E`(@^B(0eUJ4XHl26CwH3V9rhm;m zf;Z2v6AC_JaQD%!n`hUgbDv$ixLr#JehpNi$;j!UQ0RyTKOqU9V{rbZJDxqk;O+xy zHzUvB=3%spVPv4evlB2(yln73N%+qV-Y*H?Z1Da``1J-qISH>d_`oE5n8A5;iD$oQ zaI=ep5PQr(;`ub?-e+)l@~pzG2FKYx62qkiH^1p6WK+;2Dra|k(9 zm;pM5>~B8`g+a~yTQms^F-i`_1C<`eK?xNcfF0 zJcfkd67l5o)bf+hQ;R2`rxs5>Pc5E&o?1NlJhgc8d1~?G^U>nT=cC1w&#xlrFPWm< z`5K@*beK%h?&f*}g#6v`=Mn#^g0Bc(gF&?D|+rzl@58BCr{h;~WV{z^C)0qrMt(X1DdeI)fPR3%am*q2`+XZni zzOL7|wUhOtoT0*gsaN8XpX;Y*zTgBRaeUry&!S;o2FR4IHur8g;@`^{d3 z^Smnu75*1W=YSm;Sg(EK$Z_T?^k#_rMuCk80#HDc%j1ig^Xr}n_v9FF)a#j zAvydi0?X$$dZXq|w0M8}hWPmkA4qbm6h4FSO$z5V*7quWJ@F4JoYy+cp-WG;lkMiU zG8zAx&+!RU*RQ$S1J4o!Z#`W9>Vu3d@tb#70!OiF)s(k`$LrMo}=&_!q+IA{k2QsmBin# z@KuD{R|(^KZzH^rE{WJbj}YFh@Rta0QTPXhzoGEsss7P+iQ`Eg;rR;x9^q9AZzg<` z!tWq_ufm@u{Gh`35uQVrZd~6(gwIiUCi!uV!t)5a z@Lv($tnd#AZ&A2?Uli6hQ~2rB9`-fOxZWzl?dyqg{6@m7=oX0We3NrcZ)cs1c`6uzGDT?&7c@cjyZm+)?MtH64Xr*VPbK`I!WR&pL$|E#hvkIN zQTVNduTl6zgzr-Li-hl2_-BN7qYF^h+l~51p~CHpv9OMd!sipeMd2$5e?#FvCOk@y z##ry;gy$>#ZNjS*9;W`ZN#O$t->dKej(w_3jZPDEehX8_!|m;j_@emz_8wb5}vQ{OzN*y3Lj1Q zCWX%-e6PZbSle@1u?Jvw1~en#n-%^H;VlaPC*f}>yfd8-QF`>ldQT@jU*QW0uTuD0!Z#`W9+q#v*39>sd^&Wh zz_Tfihm{mZd$K8xhn*Bhytlx=^1+7!4+HZ1*r?ez3cRntcl+Q+eDINUe}nR+9A3K> z@qR-7>w@23;8W?o1o;C5{!4+MEO5Hab#RUH5dx>LF@uj1ICWDOKZo*Y7%+IA;8Qno z`S(#C+lG2a3jSb+Bl%o!X^M4u%8v z;QFDSaI^yh+qr_S_u4BwmTr0Ydx~;R_WG z>nNJgpzw>x{*?+}P3a#hd=sUwQ}_-_-=y&WqV$gy{tl%#EBr8}?^ZZJm$^^jqv(A8 zg~HDw{85G15dOHr*Af1V!udJQ^9p~4_%A8^FNFU=;fDzSv%<4ze0f{p_IE7D`G>-b zi2pBzUqtw43SUR~A%$-zoX1t}hrcE~O!hMV0paNiPow7~9Th&5@U9ByzhU=Ocq8%q zD*PtG2P*s_!iOoGpXZEL_-DjFRpIc@OcN$5d=%klD!hpB8452We73?bC;U8x-$Hn) z!XF}>zrWc3FA=^-@joQ|Vuc?^Ur?7Qyg%VrD10K}S1SBG!q+OiiSQc~egok*D||cQ zw<-MBgx{s`4+y_k;c4{T=6;0_Ap9YPPa=G`!Y?HJNrhiZ_^%ZHBf@{9@COO!=dave zuMp1H8;pNU_*+WO@$`J=U4;)O{C$O=N%%(!FDLwSg)b-kKMLpPO948++0I9af1JX9 zPk4sHd9CbD3Qwo!Hr*9Ifbd=lpGbIrh0i6NpIft?mk>Te@oyx2tirbwewxC6L-=Hc zzehM7qQ)b|xWllb!$ehH1&ixr+r*Am1@mC1nqU66z_&o~$obVkAKaT44pu)Qo{yS?eh1-ySNLOu|5M>_5&o&dzaX4{XW{-!i_K@D7T99pPOSo?Dz4ZzY(etr82*>*Xc^`eB;>U>p zsN%=$<%aXD;14GZ4|@fU_i^@b=#KN6!s#F3&O1KxKT>?Q|A-I22VF;Sz4$&bPvF^T zAcZptNB^V!e6L%q@MXk5U&!grLg2Vq@pn+(QiXp?_zEGXkC1b{;G-=UlK*cNINHhg zt#=9>`7wH~xLx7gPxcUw{z1L;*vk2%;-{0|zbkwg;h!p;SYNb!A4aFl-m*||dC$e&5=b)Ask-$=H*+Z6wGl7FwjQT|IL|2~0B`MZSt z0Yd(BivJ&y|2u)B{E0Nazb0@g|6Rh-&nFA{pD4baRKsx&3moM?MDhc4UCHgv{^_dl zUy+@xiqCgW)8(D}oNyCmbf6>hvzZJ>J`Whrp*-dw-dpfFpYcMU`A?#*sQzSFNc7j}S- z#pqbD(l%{*W7CK+CIj}(xi&f)qp+*Ug@1lxA=o$P=DCGHSso-Yf0W6GeRHmfjvQ$K z*f-~z=*STUfPHiB2q|F%BvHa}lMnmmTpo7C2=v{e_*?`&Ng?|x3%#u}X_#~Qco~Ek zT^6`_%#9^RQWBF+8Km1P&*MKA)8*$vhQ^S)A2T52lfi=_j#Y^w2%(!jI8$K!^wR$Z z<@5I?C6jbbfbw4YvoEwIxS>#g7&fgR-@o%!lCG=}72($D2lKVFJy z{Q;l)7ot%R_Uxon{||c9KixzB zB(NW=s{8L=s(%hErla=tX+HIjmD&Qb{qa$NuK$BR`aeEK{rCImulLZ8=c?Af&By=z zd)LwGkM9F(pJ2_mc<9GhI<)@R0mG_l|HnWs2EP8ZsbpOzK?cfH!<17(<;jg)JjvGO zP!Kutw`?SH`Ir*Sb>$-tlV18a;>iwyujgzk+5WMRf%=siXA_m@|5I^!_8+IwZnlLn zJibi+-$&1%@chG9Z@4^{j-<;d@A41r#!yK&h08wC7s^@M`Kv-0KHh#7YBV2H1|2k^RnNmvxQozVbK0; z*tGrk0H$RE)#0&Qh1z&s0ojf{t|jl z!#Ig^ZN}H{yvnD~wk5vD1?i~Ee?#RJ%_*bu8t3wie+mF%(2Wv86_wwYfX3_3F#Znj z<-htXErYLP(0_P;sQvdg>1TO-EG)6Hhm~Pys|;`Y=r3GtSyKN%fVBSJaDFKjw&1z; zu%E_3)H~Xvyt%@!sm?9Wts9mNVL0w6*tp$~$;&h7i2RXbhnwiUwB-fU&j<$MH3~S7 zy8XgxxBKDzvIQh#28ua7fO%wc$}5L2OW*c&UAt{xEzH<tHw<+x=wBxj5F>DT(IC4t*AKw(sxb?1cK`9PL`1cvRm?;yqw^QSygEc z{&byW-`3u7`+7rJ*12z}lgE6tm+OR_zI|5B%0JG@g6qKbEuqqb1Hmu2O$bCke0x&B z*nMDTG5ByM`0_09=?w7g^lgVPo3;&ny#ah->|^;TyK_eD5c}+zRV$4hM}|3v&~Gh0 zV!KoOJ7-TwbuJDL1wW069m*OPJ9MDL*}38;VdH1y#TGbuYwr2pwk?wbue6+e>NZpM z%I_bn2EV37owG|boQne^Hs6~4cFKl6P!G&^E_d>dG^=Wd|m_wr{R~KPX?l zVix>QC#fy7L|abYWqpWsTLbObYoK#+wAd*b2sY&O-rM8(XI9MW6-d2k-b|+iea`*Q z8RoBd>+Y4a;QvwH{V(^}`kzZ#Xtx1mnP6FlMFP4Cfq- zO_Mr08$wsu@o8Rve|!4=W96*Zz#g_8>%J80{Q>Ab557}+gN|Alk6^r+(9yZL48CKk zLFYAK%ODsxs&9-PDuwT!b>O#YfopEPsJpWPZ2RyhMdr3C;kyF+l|lHPh3|vj=Q$;CYqWl2(AkgzN4B+Znr+8-U@XM3OXf{hdDxCiKt6KT zf?rS%%enF(jBntRHQ-~k5#@CWti2UwV!4YhjU9TQ${-K>a1`=;K|8FiPxd3$ck7`Q zvtA5BKje1KroII2xeoHLK^gSDa8Y30t=Og$!4K77BYaPfn=sC~_^E!7hU*E`3I9dy zSPkb4euuChz1r{HmsifZ8NLI#U$;z89>?K_vXZLnC+;rHaq{r|E9~p+OnqzOp;R~y zf@_2i`Z^Dviq|J(`%}t*HD`bg;A8elD)^)dd^7>-ya@c#E0F$S^_fn|QqWx! zSpMLzFItp;Z6NKMUV(NWzCYh7Sq$gzlh8-XQXn3PJ^02&HTgRr{{=X1>e>8I*HGFu zHR0HU*9N+pGHW+GB?p7f&MM$wpMram^@rfQ82i?rg3)W>8hk@xsQWcxxDJSPjEyUU zwhBET?`MAtbvAu%TsoYGp>7{;{pN@nBiL^EPv8c$9s3xzaW(j0Am|zt=yFX_$5?aG zX~n-U%4q!)Vgoar4e-7C;g-|A`_Q|;UODS;(1&z8WB+;=uJ7P^M;6ApKg`SaABVQC zSvhNGN_pjug(C4lb%r(fC-figlVCAe^ zK~FEZ4ty#V`VGj5_Qq@S6Ao6x7#clX`1_oW&bXEkT=PLXr?WE-IZp4uhO9uqy~e@3 zt-yinx$S5}9~k%Gd(`;8HP>H%-#@IJbt&lg^4a9&abIP9a|B;kP8vVAUT%GXemJoF zy384P9>6sso`Y}qg!*K{c>w)24f_8@na=Kky<@xAo_cUBwBw>_r+T+z=(v@$;L(7m zP312NeSf_^^P|H@y6&SsmOaGDLtQzK#}4i9;q1(L3j7GiK@Y>21jm89VXS~-Dt;$) zjD3PWe!kh;hQ1#OJrl0W`~&Fms(<;Om9yaY)g)UdLSK0Xt`p%=M^Ya4!O1VhoRa{?9kd2JI)lraSi;)b^O_#mzmWGlr1Ltj?NJ3fqM!qG zJ&a>b6l`c|gugd|uG@X?7q%WB{~pD$55Kp0%)8phckf;i_rZb9*JVBdzQXJOH9zUG zArOe+Ys{vucOcLW_=&BX7A}O|S-sL#=n{yEEpDu!a2lpd~22XTeSw7MEWG#&S z>)>AHa~Q8KfHq1S?BroQYcq@^w>jhf12VpZb7YwqyL;zApM|m0TwjcUK0Lu*U*LGl z_6&qESK4F7FBrS9J-P%^ulWM*@$fq2%Ij_Y-V1fvo(1?V!7jh~d#I~9C-M6xwKLrR zLE99rbxMw;IiI90aZ27TUpedk|Btnducx-b()NJGbEw4@T6;vXJ*b>hT5U^PPm7{8 z7JH7KQiXcq`>i#z-g)=C_h!fQ_4)qa^ZeZp%)4gI%$hZ8ty!~X-b)~3(g*cN{fOT= zc%my-4L-zwJph>e0>xU-V?UgY{~`Fzmh0^O%|EnG<2|8r(goEQU68DZuIzu04YEol z4j{X1>~nkUh7>xcvJIiG*cs@E=J^2Vbda6B`A}BH`Vf3{A$;^EAFVUt6OWFyYJcsk zNZOmzI7SsKJHh^wLA`a-RP>f0k$Oi5&d&ay zOSSB*X)~2wVay|@`A&~`WSU}u{NFE zGyuLIagfMGbVxGZ(XT5u8&~T04ZTJY{f?#9wk0uZ8`&nElN{G&Eht+)sAB&ZoUNR( zf-5e^Ugtc-RhuxE2BeU~NYJjzF+P;WnXrybyf^=RjMd8dI{Xixn&y!e(bJ6ZP$nkRUju<`ucV^^io*M>Y}?H%WS~cq5fRj8`{|`wjdUm zgL6rWJ0G8$I_5k0q0tTIG5fNRJz@&QO3z?T6JJGZs#~|RwvsQbgxwtfo*6gAL9J%RFVv=2s1nmuZiifufto?t=w)Xe<)p|$cc{XJFJ^8bH^7Ans8+P6S z9xQ+1X3_zTk8Jp>@P)S(RJ==eo6~RxXZo8ElMH(iI(c`)61Deh8QQsjJ@$ixux||I zhBpsCr{Z*{A8|^^D#d-^t$%~eC{BAH^EHRYhq9s8(6LYUv9{4ZGIVQb0p?pd;qmRL z^3M4c`-oPgFFz7;U*{Rb5YT;AgyK-^u`tG554|78-jmL&?;cyRpYn4l5C2Q?8=Vu} z^+ZMau8#&^i2WDezvu#P6ZS77c3IaS`|u3T5tJQP*lG_R#y+Fu!!vus*k`=;0j}6* z?7}sKeMU2`Uj%=5^ig^z{rT@#a)fPddtJwYLi18Bv({@wWt@Z9WCgdNsdDq96z4X{kBNoUQ4}QHfHU@pr znnN)S+LU8YSx&a+_Syb!Q%CmaGR`gY5_$0>p9Nk@K=%;*a5msMW2~}E{hEk%l>KTP~^uwB$<`k;+E9)Gq{PG-YTR7J$FTr_07GmYgaUB7< zjTmB;hr^Hs_He$DR(S*UGe*U0-@)AR@->p|7iKNLH-9MXjrWPE&K_U~ zRA%3G%`TiPb6iLQJZi!L+gAt<}v*7Hrj*ZdFZ^A>#tk4C7io?5ZZL&p5D{g zd-qSX&uHAz6?+5w3%cj?B>X-57xZ~Gc(pM0GZ$E=@u)uH>=BQ30Vj3dL;e^Z3+uU{ z;`Eag?x?^;7WE4`zfSr82enpMX=AM`b3|`dK~on zd~NowH?Zy$V}BLE7!bRSeGT!z8NbDPjld^}ti7@E@!_|}MuJ|?L?ycyd|!Bir68?jgFzNqaf)@Vqa)`A@XRMBgpg+hys!ovb}1BkEuJCVpgI zkj_VqP&$|Uevh6$L$AMW-Kf{B9VjnLvrn)3x2{+}tVz$GSFx@Hd%Y6u_3p-A7C!XE z*aEB8-_#Xz&tIZReac)V-lQ+WAG}wsH8hW}f(@L3-OHKLqd1o&`+sX#;(AFm8_?E2 zSkWy-+(&e~^DExnLiZhh5B*`SDX|M*#P^aAr-x1)#9lsx_35okJ7eTyum+X4yf(WW zHngq5*LNG85!0M%p|+SmOK~NdM2l$j3|4k?23Pifw3Z^ycx%VZUB&1h--$Y1IViO+ zJU-maDQY|Te*C}8+ItLZ^#PpW(is0#fN{dcYCtO+aq6G)t!*dzTc=l?>Bjw(>=U=o zvTCnrY1uap_fFpO=RCIZ%$aE;aBfAu=`hN&Fy6ah4`}})`HxY+5pS^b$EHJ8#h@9& zxkJb<+B|TYwe16+TC1PJwHf7|FO4YMbbLhF60B1+?#{oAD0{$fl`rXAvHw2s()sb3 zX(#$a7TddGcYR#*(%rrhQy#?rxr5FiAuIC+$a1sk2_<}Bfcfue+y?SBSzw^WQgm&(%+z*!f8$ed-+QcEuKs!xGkyW` zO=z#rg)4@qZeNM<9-M31_n`gzu$dm%<9mqTZdz*ENuM&{(OWz^u*HXR&D3(ihWPQCL*xuZXNp^ z242OB!(k5tPgEh#^A7z`9~Fzx2mHc7^ik{|yqWBr?B}h)-~-peuy>MMsIa2^E!a5T z@7`8iVwH#TD$0w;Tjkr)r-lCZL*9Rb@7_59aU*=7>k-{$z5eDPC*oU^L! zeJUOo8x4;fwk^~!Y+JR;hRRA9gTbFgX z^G|1-^+a?q5^`-^V)T}Z&hZDkVjrYAE7=zrq(HVOKeuerc|3Y#sI+c3g zdGN!oSUc#nz-9-Jw6@_)|MXbgFRF)c+C}#*2BaQi<9l7P3lLk-xlk3xqUQiW%2rIDWjmCY9d5D)PFdvp;-Q55`NB5M8w57{c+V;qG! zrtDSSW1I#3_~5IEAGaJ2o)NoN=fo%faBu$D_s{%%yoPW5qqH` z_(w&n^Ln)BdrnxJ^)nCM*=nCo^qjgu>om0;bgQpqFvdu7pz#jD`Edy23*$fD1Hdz? zSYPn}QonV5ksk9HoW;wWtr{ugE@D6Ip068RWw-}7minMM;I4DfRfl;%tWM`sbS{PG zR#n{55BHV9dkAqy3FI-t3a_Zd`7+hVK5OqL#PngDH6a#!4Eqi~cY7XZOa$LOJGE_Z z7}FJ73frPM(mk(&h$U%kBVk94HyZnQ*OBrK-KIQg&eq?XU;Lh#v!yswnW^J)ve6y? zq}tM%cAdZQMH6nqwPM z)S-0?arw3$_yOVpXPPUPyl|#A)p-4ncEz5L357Q{^O7Xog)yBH52h1eeqW_vs^)haz+P`!&{B849`R>dgldDrdp&hWFmG@hld^K);%BT?S?T|75| zc!T5O3hdbs|2F%r^~G3U@y+aV+H<~$xLDfWjXhn*V5__Xd&rqC+o+nX{8vkV?C%P! za=O1o<9-@@?cEnhjE+6qKsAol$Uks%xMKU7vEbtY>=DDZwLdGY&JDw3D$3{h z)t*=ScK5eqmg?_i-A_0A$q7n7h1?ImMWgoe8$wfvHk~n*fG+LZn*r}azo1=6`{}HU zE6Pg|FTQY=J`dKYKHXzGj95kOKQOid*1J`dr*U=i`N4kbhxUr_O)1ynQIB=TCc>vP z4<*Dy;pVa6fzF@bf?p;1ryBpkdC9zN!LvYaUi_3NUJl$&XBiGJ&X~u4g8rh({k@Gn zw7b7X%2R*G()9O}iqqv7UlyK8NjI)h*Q$O>^}dYc7e>2c8~69oj^dK(Bk4J%5c}>! zcT}9(<+C9kP=Bg$c*U1#JhES?xU=HaCg0%AgE6MRv` z`JRKdO74Gk&D(JpAL;jDoa=;aI&T?rVgts=I$p9dM!o=cwVuyHaIRB`bDh0@YwvaF z>+(wc2kh=s`Z|8K>WiM|pnW;XgZLxAPBO63mT+(RhtTKcQtEQlzaT!;x-3OJpR%7P zOg}^q-^|_nr}N=c!FLVLLVHGFZsPe9;=7pElk=_9Jt*gMY`f@1dLBm3Q;Q*^Vtsx} zenjGwVw?eu(D#BQ){-k;1S%E2yfNm%Cp%-i5JyV+Ozlg_&USnk_qj1PwjH65`zO7k z`~A+?SJKdJ{B~!oFokVbqR+-3Kvrq??xP;>ifv3&w&9=6nniTn&zsQmS%oLnINbNl zp2t12@czVmW{31Wvxof%WmonV@dD2&O!aoA%gMPy2 zEeIlZ-xmPxnA@hM9L=OLLjL&m{eBn2_A>rG4?t8J_!Kd%^m)X{1#; zr-1HZhgK~4fbKzAg~hlxhrQDZ`)_CXyp+apa9lDij^higQaaZro3A-_+xJFPmY-+wlF?{#~xN2g{P%{${9EO8kZ4GcN_dmDnGK@*oHBHx_YZ zJm*@mfUctqT=6FPgiz?!xR`-&RCj_e+`_FwCw zQ8g_M4a5TY8yuyJ@)eB`VA@-;{BgfB%&P4Ak%OVa>tcsxWPF?tc;55-rkw z7xX#mH#j?g*SCKR^rB+rL66ZKnuvO2%QnuONSB8&9_nB0r{xKI|M{r13Fk}nT>OR< zzHB7wZ+J8HKAXx${Z_3BG+!%`Cx7(}_B_O22>ZyIfK@7f_88(Y^4qC=bYrEGf!rHo zTDT`V#&6M)19$@OC#Tdzv_&w zPB)grov{njtl9n}ow3pB%6`}x`$zDC`RS~gB0rLCV@+4AEX8>e>-1T?2askQ$B(7A zg{qelZQ>?(Vh^&^B1#rB2vt@fWSdg1+D`;6V!hi^kfk-?8YhS0&_ z*Z!F=DtX%a=;nXL`?~h7k8tiG@8lMiSK{1Do%Mn6-e4dx7NohyGQP^#A}`Q*V^m-9RZ(Z#)Tyt7w{_hFyi zN$=-_8&-0E?CCPjLF6?@@l;UDB3 z&*i0wD|hHR!i$Qaz`!1(~q zUeuZXcK9yQm6zAXwyxMO)7a&~R+rqM%l}AIZ`3MRJ;Zr*#)4-l#@3xWQ@T_0tDaRT zEu&`dS>F=Z6|BF8=um3LnMCY}6tFg5OUxbU`J82zF7e&Uz zt>%VR@%HA170AWg@Nu!0RW~%Ww!~Eps&MfoksH^vbTmbD)8?ku);4QZTO@YnWs%iu z+HPoxH^r^SwpGhomakpY6pyTIScm`DwXKQV(6pw#rEOKDr9Gm_j*FmTJ6f!XtZi>u zwLIefqMV{pk8jU4tZnUR$9+b3m*beQCV5fhb7SHcjfsEWqMGBC zJyu^ZY1E|Bb&=vR?cPx?Z|fj7+_l>y#ZBuPTi3=(VhgGkT#ZH` zNV)1OqP2_aW7StyUpBvXPG#+!`B&D@xpMaWda5RsW>?OeH?y*8u0ndbU5O9DwYQ4^ zl1HP<@hLhIP@E;s7E#~a*4{y%m8++(4U!@hdJWWpQM5F4K>40Bd_-?mLkH}n9`xE^ zSIsNiy;at(Ufs5)qbXhwOKVx((b8DoxOUAAP3h~cZfjZ9QNOHh&B}%jZ!K6OeJ5`@ zeF(80N?zX4?CGy#&DvFsu%38*^U8)sPhr!l#x?6#chq+@H?68qQM|4L27snXqiASd zoiui3ZS@$@ilz?kC{Y(3Z5<7*5eTyha|H87v8$}oJyEpuW#*#u<(9jAS!>JkX7CKl zZ(rHcVa>QW)f7(b8zP3@IwBn{E6Fjmwt5Xg8(e!6RIw&PYB!vsfp==@>It@B8YIsS zGUimq;cBDA0av2ta-?k;wHV*r(B3>A)?{j8Vzxz=wk%K6OFH{91RO8OhDSZZy2*91 zk7K*GRyMSf#lhj3FKc=X)(|8Ts(B`!5^UKJNZl-jac63hXziJ5d(A&%eP=#2w0AVE zsc&y;T+`H%sTIwYOm)OntI6Z4O&*wyNBeSJ0mh;2g?u^|vDFQ0+MD37*?iR^=AJWa zni}HuYnmF{*2Jwuqg~T<{n{psCO$5*bZtij-x`fHx2s+fX{@ZjZD1Sn zSlYH03`WLBA}d=~IVu86+SIfP+Gt;kX=^n= zX&&N@SkX|!#TB>&H{NP`6cMu~y7Y+%AQhQ*50SGudmebA*|;oTm7aa>t2${XyDC1* z?A8@BO=ne2i&!sgNt_!0n9jK=G9EXucGZeiZ8y3cgR%!`WNoAvVFaRwRm)2f7Cyw4 zm_YR_n%1{ltxd}t8rLTZ5i=O`dDDb|T1JIaqN#Z#uz@{ayy%}+n zn3i)!uwYS`aXjTQaG{DBlvWAvcxT)eXdE?JkPtONzMQC}8BrR_VRK@coEm=Gb$kl;O&}eOH#OlKS5L=9dLJk{N zu54SCII7Bd(JNhJNz7gZWr9KIlEjT2T1Q)BTdT1$?JO}#K%xckZ$ zp@!OLA!==mH`ik!YCy!xAJJ}Xg3Yh=}&*dDLyXz5sA z4+VB;`!;?q-nt%9XlsG0gxeS_A zqpOZ^U|eD?P-4S(yW^3ys~krkseuYAWrN3?#xxZd$bK+wZ7-=vM>A&4jabb|QE=l; zh{O^YNlnwus+Xpj9BxIrA}`nENL7PF8_mX7)Jp1wVjs_6pRjYJ%_BSsdyFp_5& zHzsZjI2E0g5w1GYaj8_fXFBL{cuN^qs)pX9AGgUm7DV>A66Z(ttJf}VZD~}NRwtHL zmr$>g1urZhqij5!E9N*vfWx%zh)ISsV>7I z3LWcLLpv?)?7|)KtZ8qkU%jHSeR92~K{l&1+23b&bAr_?9ixy^%pzZExDt(XGuR)6cBgB z_@^pLj&6+84;2NRq*1D(V9=y1t?l0rT)E1pT<4WC}GB^#qimb3O0i8L8-))I0nh zT_k^#01`XWN8#of1$>yLP(`>cL_gGu>#tqk;&9)11UHxH_qM*GR!IMi9=wvozg{Rr zI4X3EdBB%%>z3ST$Lga38rI{&`Xq<-Xfo?jVST$E0wz^5>-sL8Vw+O0P@|;mjE$&UyZ@0dp*5L?atV!ppD^UAJDRB5`2ekzs zBcNaDdFqNn!-x1)KO(rK%?EbSG%gMSHTJ^I^N>wI4U~csCBF= zN=`J-Q#)DrQLpZ~o@jruqy1>I_M=O*bRTh~96zMNBMvGmpwUHKbP;iM5jR>;kXILY zD1v`7b$r&OBux-b^dRCToL9bt^GcU+BHLTEYzZgu9!K8G1e9s!x9&Y^i4sKI)YdC) z!g<9_IIpw`=M^{Myt9ovJ{(bkd0Af>Ic}sv&eK=hx=uiumt0R~rln^lBV}&(=sC(r z$%LElqo+Q@_-4 z0SoIiC|-fl%PzS$?$Be$?E}t@|qn`UaJGjYji+~&51DqxSiERKSmSKE$lh}pPca!MbsJ2N|EBXX2uO5N&Y7r=}!hkYb zQIJeDPzi>8{xc)Bb;ci!&z+&?OPPIz&g_dPD>I{q-{bM{SfG=qP^z#;M8Dg_IGGGb z`ub4!sg_J9=Y(g`fCk0FFj_BDXIrg>wN8h%j4|Q?&C(%#MWmT&H1FuD!oO`@m8pr0 zr$X=QAne^b0)1Iufs((XEkg!M!cFm8Ky?(V-VT`<{(z1f-ge@L#wB^Gg7 z(VZIHXHWtjc2IEvdo)TjBUxh<8K;*Rh3J}Gu~*rI^QxL~qG*{eg!9f9!g(hQ;k+}3 zaAFei5lX~_6S!I9Y^zSdj)+vdHzKgiHfk!SG(($`&$>4vu-K7pEfXs$)l-m~iV2CW zP*bm|ps5(jByAf&3E1hN;sORHDt=K*z$FeUF5oQ=YMFq|lcZr>z{3uzMZg{h6&LUw z2h}2A@nnaVfJYrvi+~SJky^_I-0PrP1boUtEf-L19~0bb^R~5I>|HDxwZxK*$!1(j zy(Y`k(`&Pg^cpQAy;jReuh}xvYqyLP!#%8BJ|kb&nLT(-kAB#a9MRxWedT(p)TCY) zeT!a^Wi|$_O`V-~(nQl}FVherwZtjvGF#7hFb4=4G=A<8@8`i83P3&h6 zSzd)O(yJ0idX>URuUZ)CRSY9VHI`mY87Y~7v+C9f7;@K>OrELd^?XcE9G$GusuLw1 zC-s{AUaffv(h@_qhzZ#o3L5YddP)-tII-Wxow?nTGlVia-&ZuDkkj|VOnr+p+vhZC z>>wY9YrV7Uyi;DK{$b1 zH4c+%rv`WHtKYiQ*DaanOg-UM7$b5b`aN3Sg!9Uta3cIoj_|Kd7CwDkKH>Lw9OVDM znLnbXOrjFl*!;DBPv)r$ujmPvAb4cFvai*qEp|(3txQbHjn>Y9s)-3LJNbPf2PHRv@H z1)wBCl4B{NHA<0}V=15l`e0d(rGSz%#huRaa^uVT3|ST_)XLL0ea7i4P`foK$5KGa ziLcxQ0!nWBe3F~IT8<)56~yYZ5s@e(y)tE_SE`H@xxTIC%g7uZYKX8I=@mC4y#i;X zSLBTJ3Z0Q&u`|*uct(0f&q%NE8R->2BSit@#w*n`QdBT{nhPnJz;r<(sF6(EK@PCH zC9|>2RZ}uM9VBW>X0Jh7-ID2Xkm%?`ooT+vMN={x9VBQ!@jWOU9@RHI+4()Vm%m)~=z| zakWta#aqB(i~fc?-Z$#i9-<(xp8!g{M6naVMa4%HJKK`zBYJjh*H=2JT4s}isvOQ) zoarRJrUE6)(<^3~lF;ipCtPgoZC^RMFBMKoZn(oiR6xU2T$svpn2IJd6&0p-I!r|~ zF?CdTJE@N&02#Oh6(j&nu*2EJHcE&u5d><B)_d@5kQR8S0 zN}PdOz2!Sc^G(Lm{e^DH4tItV70`?@o;<>+jL>pM7+tJEGw5jYprbPAkRB=Qa5eo& zdi*-|6(|Akb5L;szv-Z&A8OEuCY~&sj5htYN2L@~dPht+8M2IzaNYqDPDUtdC7f5U zOiwGeR*!;k0zag2SbvUMlG*8uyl#&MpED={Uv^N7lvqvboz32nM^oa9)EW+~1r38G2?hUmBL#hNVitzqetEX3&LzA#Gg5iNJ*puC!a=A_s?OdNeF^ z8szTND4D=OWs+GyH<2D-OhQ=H0hCu8KxHEQf7+OiYNH~N3M}IGSyQ?NmeEo@fz8O5 zC69brrjg6^Ip8?|MtSZ^?kmtLr5AD8AOm$kAH+)Z1C(q(T7^z* z)F@tZoUaC<6 z(UMZ3h~#!V@{0;+L>d>7#?3>7TQvBHK?%6WLB$2k(F)MW;OmPs!swO$JKX=^Xm*B)Ip;2gHZFbMCVE>PanTcE^2xlYH$8(EJ3&KPh+b@z`r z0?F89w+^7*b^@vReGw&s!}^MGC$ra-%w9$hc|^0-(|h*n^hr#LQ<9_FSN6hC0{VuH zxy7_B`Tol?ITxvQj!c#*L73FLrF>npXE}F-G77v*SAE23(wy9Jv*}Vn-j3(#)^b~u zCcD6fa!V#Ma@X^i!%Rm0KhzOqkt6<$2L^|ARim+tO{8j%(@RFiPU@<%uf-wA5zD(D zXXJC*Q@*0FjFgOQoJgVqTY4AC6(wV~lyw5i28-)Obt5^af@932j!8+obmtuJkmKkx z3L>hh)aomi3mLJYQkRLB4|VI1vp6jhu+WJ}CUpy3WU9%NMjM@T>qUDtctBtMR$ioA zGUgeZrdzc4m50bk2?EQ5V{k_T$}?nCZJvI*CgcdJNgk9bjHtn)WrqgE1p_5d&d8&* zKn>T+p*;Esl-!WKuh^lb0F!#>sP~m2I4W^1DPEm>S##D4cjhG=pyNL0MFF9$u!l8S zA+NB8X$56wJua+wINs5D4?$@6;ylL7x;{`A;=;Q|dzshhOxza_P&MR1d^};9sY$cm z(3&R8l3(>)CblI38A8`gggZ3hQq2=&luS4-gl9O$8_z@-e@KsiqaDIg0nH$qgz#vG zaK?KTvvi!a#EF+OdYtF_?QbPaLz!*J3P}jQ_T2O(>s$mypA5zNW6EC zGxm%FiRvh*)`^DdlBr~LojtnsJNk;{;HdSX&P1H!hq|p1HL6GS72?P=%w*Eoy+}Vr z4(W{R>mHBTZL8HQb)YhFb3pst=k%3U8Vw%OSHHE+?v~8k8W{v~l%4Uwd-xE=z&L%i zt&HQ!(^ZRl-{eCriX5j&RKSf6D&urK3zdDnrxMpyJDnz(EkeswW;)G1S@^`j2q(*& z>}m)n>zo{u5YD^M5zhN`DB6Zq7*svZ_(F+B;fs9JAK4^74L ztO*Xa4>c$+ix4$=OGF+pCY(HE{7H;9XN2lzhQ9W~OG}eN(?r0CM!|ah-I6JG>O}>V z-grJJ22AP=*Y@i6PdUVI?$a$9QBGg$-lF?Lqxv{v?$DvEQ(!t!P^NBd>vPh{l89=8 z7lMiej%!@dx;Ze)*Dcvrjm9(YzHZ3~lRyTN7$l;Kyh%R+Z$g{Mh>6MAdqY~@t2&^i zONJ!y5l73B)^!T~;{B_opRMGzhtshHiPuRLSNC|s#NW+a^V z+X95UPaCrw5))3I7?tIVaPr7#&jpGu;pA0j`H%qN1eSN25$X#lPdZXHc>+y*5~_)B zk!K%!u}L`Fzyq#<3oOEbOnV~>RQsf&kg=kvfP2Roi3u#CK(%B^EKin1#(kK4!{Yyx z3CMs_>6UQbArVfA#iZUTHc1Ok1c^7Cl7-dmrQD16peE^gB47FF#jGq$;w3J;EE%tc z(2HHXbSPRv$6f;iN~YQoJ=K5`5ggEL^nzn=U+MtE+nvICdsJ9&r@cG^(ZYR4U%{$8 z&Hnl*kyOSFrASDqsJ^{~{_tc2*Lt*~D5y%V^%2h0pFd7!+sdoh26a6rey zS_hIXbi(AQfa4t0LSf-PM|v4`utm3)y`OEZkTr2riP-WAS;H1ParFx0)D+}(ZJ&&A zjv*{yp+@E0SQOR~C%SB#nwB zF*{$V5aO_FFX>*Gx)2urY1I+FCp`r=L9lG&+|K_DTlLpm$_FKREawOUs-0&B|C+X*AErex_fB}=C% zSvpM>(-hCm`ii?r$pUMVmr~4Y6;1JS)$o+QqM^K#^v#PzAWhzvk5DU1b}h?8`U(bR$0eZ|P!fj99#wUH1W^nU<7yq{$R9nv5PP`J+=A zC%`yOz0B#QPQY0j1z+LoUZ*qi5vyKUg^<3*kj^ybhqU+I>v-XeR-dC|BndO{!6*qT zdg0SV2{~G} z?y-13OW-c^el);cmWgxevrhNP!}WH?NHIs*BQVn2b+4r5?GvK$_6U@>KcKw5^+Kj% z#bUy4*~qLq@V~GfFI}+WCD#k?WI`QCq47+bleRJwS@iOLy~vZ1ULV6qnJ|;|;CrPx zZ=V>Vw@0A7{Q>3etrxO6qGfVaUxS#P2smHS*|+r-w;}CrFB6Q+BtYpvC}KJ8(L_b2 zKqU_*<0>OQQ5+(RR@NDz$4IffS3ZdnyyPKEFL9u}q0t)9N{Ev|JLZ>Y)oC5xBaWyoxq_rGu% zUb@hTms~HDBulBRqi*hmD{-CfvP=T?(giDCa=qYAR&|+>ZVtrAPyR1t=cNl)yySYp zoyee2132#!aIb@E6!0mHQh(-0+RD{?ucAm7Nb6qQr-|q$v-B10EYaXC2BjhA;_X-p zA{qb{0bh1djXfGXWh>wlNNb)$#Ke< zS?BiXE0ipt8Q?M*V2-2Y=sXQBHYfpCJE&y>ZgEgi`DVOuj~;d3&c$nq8+D1{Xt{7? zsASxekJD6+=_~d+$y73Ke*#J4UiOeiJ>?8?nGEtdgVMb^7khv`re8tO-!E_QuzmyV zg@Y~27qI6PWM^NL{n>2%ZLDI;-*0$-%L`MR+9cUBjVGiHG;T2WQcXkPyQ&IHb%pqoYm!kLcgO+cw8DMc~Lbl`_ zdvd|T!FAb-g4bXOW2y3F5Wj$`5il;xnp`jd%#24-5n(2j0%KVdsU`I(Z6{^3olHhc zt~Vvf^`_o+yUjK6H>&Qw-A3WInOHWaDfIm_hY<1U$mxDAq=K)^EFyH75x|TgG?;Q) za4vFdP~ksoPzo`_w476*P#32Zk!4-Ncd9lnf-$rGhtM&Mkl|E`uMOCMeTkn7Ikh?U zaq8z(eeE{La34j#?G-I6$V~XBsy@@Uv{VOyb)U2YH?s_9 zahlC(4yU=AcyJYG)AGQjX(hp>DTp(^AE*5}&Es?cr}>-~a9YUeKu!m7I+)WUPKR(h zl+$6Hs?Qsr!|-P~9l>dY(~+E>%jqaiM{_!c)AKkzpVMMaOE?|N=>?psKWH(Y;R&2h z6M($*VfkOTxFYo2ThCVJj)&Y9SAa=9Lx7AfI#q- zJ~TIP<5YcA$W}8h7|;`^D8s~IdVgo5)r0P<^s5K0Wg8llLbg_4_DCT+^nh|rR=6wl zJq>0}V4!b^FTqgwrvS2kp-Thbx8cq$tIiJWvDudevA_hLu$5zbi!$G{Pho+!tQn9~ zV6UBLTUi5ur(a;0-H)!P0s+p zi2aTg`ZbLPzrd!@Nj=8wpHgUI6=fgDqbpfX_Olkl)GqsAh~beSnEhOy6+RC@XfhJ| zWp8y95#AcQOk)E-V3IX~?{ZTmWkr(Vy+sE9{uynWJ1$Y0cfU+nWh5w^~vI)+d38>F^aK;Me zaU0GAgM}v3Cs@Q88jU|3R9{f~O+GUHg372!0{;HNVy<=^!}I3{CvheWe*Fc(GR_R8 zOkuEsGu&oyu!b{j7>$2;FlsXA1nW%ZGr=V$Ga}f`nQEdoGPs&EPYy@s{NOs1DGqj; zOi6H)$&3wdSt|y)D?Ray*9B!PTzZ^}%(zCPwMMA=s&MJofd$O)8f?5@nsiyLC;n z=sSX2R4$*&wgk7T+*s1uw%|i5$0O?fjZ9cT#g5paOSgAvOLgiN}2=fvC#y6niPqta3cXejQltD*MmCI#=0iflihCJ@s%RfIoUWn5IS1pTSee z!cG#GzJrMyMg^>J5O4vRO}Iaxp}g+qQ$C+2yMe6mM5*}utD`!D}i z&M*i6GPY?GN?rZU_^O;lw*rfPGVT_tnZxia&%x-wVnRGC?rto^S%;L1dgsSFP`X8E{N z&MXMHGPNOo79<4R|v&QiFMqvXYAOzRKbv2J^nAR6~}M_jRQjGNHWgJS((FNc>MI zE+n315*2wrViMFz-j5XthW}Ls$6q7-)04OkjVbRynH44)p~p3$0cR911ODdlGT=i+ zi1-@tVZen~d@=r`9E1NT&jlA+p)dwdKi^@do##8mNy`X55uzW9uF#mxpC`A&w zR9YS6SHDB^b$-D6p=&jm_kAW9$x~Yb9_jZK!JAPfZ*P$mrn;fAiUG@>6S_fzzUDB^ zjWB(o)8$|I@8pD^1hRmS6w*cNI0G zMBx-#SXuv~h3)^WFC4~NRnQMfXb2Me_20?r%j*xL#*c*6|52qrhQFa~jp1)8TVwd! zIac@@(8y}kg#3Gzi!aJusa!niA-7Gt`1?>RceQr$w3_B#@5h#tTuk`u$cA=lGWqrF zBe&c6vzQ^8==rl1LkwT0W)T^D{v0)n7=O9(k@@qY+?M=b{*}!Plh4bK?lkaK2N=Ey z>u3G~^)Y0ov#`Rrwft-9T$#GnDnsrjf6*qDA$OC1?G}~c)$w!MFaC@ue;&6dLSF<# zzx+#B*3J1-xNGjN)HSr}YG}-AnQLel)o}e6h~SJRR+#98NnqjM04kuPi!iO>;T~kO zP9mY7{|cYW;vGY_!u_!G%c3QnYc=`8BM5N;5=PwSZssiY`J{C#d^uIUTB?3m#q4?6 zx!+NzC=?3kepjEOaOMfyRq{Ps#q3smgWAZts;h*RPqN~1qmNe=2d-kGhiq(ui3@CtWT!QaeESHE~Cur`cS8f zGH==y9NP_nG3LHw>xk`9$_0Jf{ai+($<6WYR5@lM*SAOI*un?+_PKHez5^=9^PfAcB`YR8#%D37EVyEyij?|bDb1bYQ{#S_N{Z}F7tJ&98;aJS16lx@Di6)G^|uJ{wg_a!Y;g&@E|B z_PJAA>Fa3H=PqrfM6=J`wu)>2n@ToolVt+;*k+U0=S$jtx#V73ZSpv?RU0#@rO%h` zaaO3*RwD{NouzI7pkSgMwqVmk^S$flAjY1LRINv}a9QDT$QRJTSa`Z=MGE9K)e6%m z^RnuY&@Xqrt$d8*Uesp7WVt0-pB37o8x`EjZtzq=8@n|sEVy2|LE0e|tWnDh!|f5S z!*GZ4@C>h29-iSFl!s^d#!gdz-9rXmzsJBg9WwCE$E?t3UU6_I_g)5?eSH-{I#BMr z!Z6mi^%QK?;^XALEAy1gr*q4`tMoEKEc9*Lu1ZKneOK>uRlELxE3-xiyxgWe>a)V% zM)%?GASs}a{)B$S++Y*-O%_*P;OopbA5?EwT+#dpJgQb`hQHB=>yY6Ec7&|Z8BHU6 z2Wi0S>l>VpA?O_;Dgn;Dz=!!^Sv)Jp<0kkB%j72@{~1?)BJ$@bSHyFAlJ+Rx>?5r+~^h^6R>N!Rd4&)mwdsG$nl3n?x#X-k6LfA z5kBE^j_PU?4ZEHd z`0qg5OO=u-sIZ&VoM0H%8U6(-6#N=V=ry5mEdyD9(fMGza!qx?OO$K64c}l4R%+Ko z%mrs@*EAjq56-dGX?7W9=4(H7C1s-8HIaCNwb~nz6oc331(ZuZrx#Ez`3GAIj;b}- zQ7gO=-51=2B2Srfy;RY zCu`@)C8e6(e4=)tU5uLw7&-ldN5X@FEEtX?s~8C*!!U3BLO+#S$HEt*Y^aIYbu_*J zSmpX050}pl)Tp<@3f-pZ7Sa(1ZdMgu#OmD*bm0u8-hBjLtkg?JQg}&`HJFxGo~1q) z9I!$^)AR;bGrh$FFLme*tW@+qM3sRv4ZVR?!(B9jR;VCCtl(D2Os3H~$nZ2s^E5Al zVi!+?E-B`I$Z7^%+U%kSAJd4+^c!5o^o|ZL=emzXfcmWBX(z!m@)*CD;ER>}CVGP} zJz@=}V|W>_1BYBwrBlHXI^G(MrT7=1lJ$Ee^z%RL)5lpPHyx>-jG%^v18DmBce;XF zb*$CL4$~3WU`n{_91EeCW##nGA-42grv5qRF4F)m;Mg~(Fo)Ex;QSm4I^B5gHRqAs za}}~DhZL*eKjqNcuiz6ow0ltSf925JR`8#5Xbvg(ZC6LHyYO!KogCU;!E~7a-(NjfmgP+zDHxHWY zb#AWLxwyW`#of&=E^hVn)Kz2NpX(a){#-NWA8~=|@5i}j%>SAOemd9i`cy8BUzyD3 z`)QLI)z1()zn>9MG2^uk`uxf^{2)U#^*HlGrX(jnWH>#C3lyg#TyUWa9vm_q4h$Ja z2DxB&{UW}7uV_X>W@L(v9?>=7HgKmZEo4}DZR+RZwW*)sbvYO45!L0nYSrbLTK|wo zYo{W7Emu}{8(F&$}-n#YX0Qm^rdb6wbJ*u^u6aC%pra!wIK7h!{ z%cfH{1rNwJvMq4Ap~7qmTXlbPUDljC*Zz<5bnD!C2{4Jx3crNX0@@BME*^8w>+i59 zP(APVlVlbAI9GDRS^^C&2{e$DlrWYO(+X@P$ty5U%lsIY)-tM~z~#)A66j7Bxt)gG zE<^4yL+(3<+~ZV1v-Gly#>gXThDd1p66^ZlEYdvsgWfj|*LPmUE$P_$affZ^cu& zP2yGXMK;M-QJTSZ6nwD@zQm>;6u!cy`+f?()TV8n9>Za$Mlia$Mlii$JNKxDShmw^s$T585bqMj{NPusbODVmo65&sV;U={k)6nKe+k0(cR)kSBrJ77VF(D zzU*%CWmk)@xLVw&T40S*KY9(_UP*AyExcq>^@{%88=F%_cjRE<5 z=j;U_E+EXW1b9t={}SMD0`vjNlDpaAgT&YY=P-!}8BsDyZ;EpEY0{H`VA3-Ls1cx6 zfF%INwIY#U$#I>@Db5+lj}XGM6Q>^K|7~a&nn^JrE465a31tOnn1@3HKtgN^a4D%=xiyb{7!b?0x|r1;EW7 zr@AFSq!hoL`*n+dlZr11@CN|g;)DS21F$Ccqg4MwxaPc;6CQ6j4I}gdb_%1Fip^pRzV^U5m)YXY_gs2|&hq+pW3rYs*nVS;`DoLLU1XmajU`iP!RY;ii zD+O2tz$$5?6u+FjAdT>PWVz)n0H)kY$(NCE%dY{jN_J6-U(PVy*^@wUlLG*zyhzEf zkZ_Y%1$bM4_XY5g)=L57wKwB;4d-Dk%9jrTFEv z>L%X3N-)|^$%07r49<#L*wI=LE!np&9ZLaD!$h5Ia zdZ-k?oIQF3f0cIjXiXqj0KA>1NRAO;vH%wgFbBYdg_3I!U?qT(Z_0YOAf)X7yFf6H zKNjG50e%T!!mCKkXbFJv>i$U}xSwYP_;;#O@>{96LRWlK%Ksw38LpT!jg5 z`kYi+u8K?UgRGg>0d32ViWVLxEjZ!Wjs1o(aUG8RP@27@oBbOQ967us?f)Ra2?5?0 zz%LftUw~l(oG-vs0LfFjBQFcViki~@g&NHI&3WfCZy!k8zO?L39OqgUX%n4ud!Dk` zaw;g1;+!LSrQDp*teon^@?Ck6vzEV>Hz7s2RZ=1R{Y=Z~3gK^&08Ij1FTkw;lGpPU z{Z$yC*7K>Kxr)ZEex-KQx4|m47x?owj4HLSvZq*6FHb7BrZ%L&rJ-}rxtdOUQX49m zY)!j6slZCd)B{DD*dqyTz$ZBOZ|w0|Q-7RL5~cXln)HFG?F|0Z zV8vTHKHluB`G~|sba?mGUVsNY((>MoXA`cnr&`l5cC|^@!8Yz-s&%2gNIF1kW-?~a zOWVh@!!%!Mg}uPlxf-xFttlCoj<0XzW#}MX!w=Y;Aonz8^49PSgs0t@%;mJZl5y!e z_#d(7Gz`2R(F}aG_cR|kN4I%Ap$%qF59v?Y-unqpcxwHkSGAt&uLUu+_gwygZFQ=56t%uDV)z~| z4zYEhZaTZ3TA9=_i{jbO5MyY#CZQY}>I_-azvehxXrC6j1Kj?d3w-`J9tuO#XY1K(yK{6SbbsEP1&9EyD@cCY$Kh zzPt$6+Nu0oslCv*sSnsosC%{VPISG{cL!2uC@0yQLpiCGw~%}~^z?ht;G_hCsTlS+ z@n?ADfy15YYMGGn_zI8Fy`$Stt#!3m?5EYv$0Dk;E-#Pqz*FkbnmT2nTgV=s9%qjO zk)5^HKTEB;L|Xp5Z-%U?8xoL88&}z-m~_fvrLv4fZ7$?Fs#;#H_4HSE6yWTmtKIxB z;HqlnLW9Col1pXFsp_#k{FwVma&F2VQqBqcBITSew67J;$id`AynU!)#S)G5b-ipS z88o>mWpSPsZ=`Oa#087~Vp#j6WI^)?H;$z8G$TxIlS+C#KD}~y7$PhHl1-W&wpeJldb7){yawN2;hfep6<#nzwogLFirW!0a`#Q)$PlhO~q5J z=_9TYeZ$3i-EOjbuVo+QaJf^|G}%RlxJ+*8o)1v)52R%p{tsj*e=&8r+Z8OdC$rq& z%Ul%k&KmUop)P*c4TdZ{(_T30zWq#2|G5z|c>=;x%C^wk^{duH(a;t)$+0+OXa zMT|RrrmLPuc8)^dWUWA-K$!EmRhNzGB}f0 zM=0a*4AZ@?pw`EFLGaXagz<6)A3pKy7W{ttS!_*R=8@wRSpw&Q@9j~Y6i+?}6B@?;C1x?57$_0;;3u9dh{ zCVLIfx}Lo5dR@WQt_Ts<@Z+JH^Q{TuRr`Tj9_0ep?lg9mor-4!FL1z}Lq5O{-%I^rCo&L`=lz%&QxyN1o zpjWjX%+|c*IHz)QR+Bn-`2^>rCt2O;gREle8g}lDW65bHPFVK>jJfw@YEO`Iv-5MV zi_qCk@$BSJrY7%U;*U~ms7G?-MXw6pd%(I6JJZC%s{;3y5!THMS!}|}*Hw_xJUq32 z+N)Zx_Nvw+y{h$CuWJ1ubuHySQXNDlhC&`A-Yfw|qQo4J@)7q26H6|~hZt$E6xx|z zfpc;5DGURZTj6RH70}0`E~2`*1p#_`Dt|E@q=yaqm~Awz@`l6uqjKaOnGR`Tt2-dXC!)Q$G9}^6GUQLYj(}8rI`}7hV4{eoCA%`Si3j zCwer)TzsjvuLM+E&V|O?DdpIVW6k{a%+E@I1*8Erh;Q{~5L`9;L7T_+FLXp2-b-ZY zQ*K;V&{vUpo%(U~lJAuTy<*Ar`)pVBKVVuGj_?ZTomFKDM^X-fUaL|c4q9Q|G5 z;KoDVQy-4uIv1lJ|DHmspKrT~AG^hqC+e4TQx-jdtsXl9D(BWLdV|sAZ^@zuWT(2f zUljChOmghbMBdC>Lo5cLP4K49DO>uMcgm(RRd6qd3J-9lsUoa5(hG|frPOntOFcAW zlxEmyjj1}~I%PZJx`ZFJHsZR3pS3pmOS9>@M|Yl{<2CsTE;r(w$@ENq7C)nH@>QPt z)%+q*3ZKY3tLJ4C>b=urlY#u9I89IqPa=BG)d~}+X3ax3O&H}66{g!Yj~J7? zG{8P%A)QNvjdLE(&jIHXnx9xQQ%QNFL|ah4OA%~V1c?hh>y`)TF1Xt*#RKg6`P~lH zYOR`?ykPM?b4K@754Y#@im(HtV>XokF4)dvW*5RAK;hAIvp}hDY#l298r|aiF8~YZ z^<#E}nKmCB|#y^Lyxu&}ijJ^IbJRaMk2_U>d2t(B!orybL(J!d9bEV#IbE}8`V>F-ksd@6xYCGe>PK9#_y68KaCpGx3U34AJnPbKiF1U{9(rxN&7 z0-s9Y|6&QuubICfQd|;gY;9PzJaR+Rn)a5qRguY4CQO=aa%B4;5 zj@I^xtu0H}G^|;_xV^o#zOl7sLL-PRCSr>di7iehwpfTQUb?oWHD0et)`N-ZrQ>fX zYp~X?YHwM-swp06S=C`(F|&GB?Ysr`SInxva{iUo?)(+_L-elVD`u4@W~aHc3u-DS zd-7AJBs4&cDbuEV>P#*3)|oarq1V`)X!RAdCQqN_G>pzo?gF$l za&s3zTyEibirkW{u8P*riYE50aSL#rTs|dcx^NXhKWPf4O;23_hEf+yn=(1MU}h9t zrb4GAGcyX!C)ci87`wW9%Cu>d%N_B#hJdlnO*ghQ1=FS{7jP$~rDaYRRdb>>)v-j8 z3U1-NdER=J)eGw373!<2W~MAEpOUT!5=vJ@1gmCNr6ZW8hzO=BVuG`0;*yqT+EON) zwv;K?#?q2aUBom~7ZJhBs;)>!FijB=Oi@%-c}4ZSd2=e$smPS4){|3C^i!zVDQ7Vx zYs{2`ehS?<6sRV}vCPbzx+)D;3)KRi#5_>sIId^fE@-*sApno<+68#kA zvoH-)=!eiL#Ll&6Ri|rFjiU6erk^Tc+Qnho+QuJraX3v~%)=KS+ zOlh*TD`QoqWb!E|5h*zR{7O^AYE5os)Rvm6DJSDROZznRD`V;Bt}07CZ@G+UrmzWz zW(tuzG}DzapULyo&`deI4B7O>OgViqJD60OCIOLf)08pUG-YY#qQh;9dB$Z#GhG?; znXG7sW(p&4Xr?OD%j^8vX_wbDMZ{#9BI2>G)&zEXM$uAEtx^Z)E8qmnBKPiP-qFxMGgLIIIYTS!5C+Cs(BS&Pp;9(am7jYH0lTiqll{3O^z^aC8Dl@`84;itbHdb9}!Y9?rH6a<{ zHgQ#h4V~yVzLy$ZcZ}8Ef;-9d}O1xqwU>b=K$*8-CUq=Zw^bJSulWy*FWa z$o&w#;Lxr~zHGt7YNY-T&aIA>mdk!ogAJ9clG%lJA-Jk7WqM^rtfU}jdohLi6}i(Z z%WEof1&)tZ#mZt8f#jfpa;sU*tSHIVbiyEZdhCqY$k^oA`LPS?xyn_PtL4~O#k7)Y z(F^`9j?FADsEAePR#X=1zvWfca?njEc{X)Yu6o))BXB8J5S!3|&M2H!kyqlfJfOe$ zr<+n0d6iX#xn+fy1J7ObxHn=!r)>ozr3s{HZ!j_cV^zj<(0Xzo#xI;%IvJ9 zEPPGR>aP`+6}Y@qSLT&fRg_m&$MR~bizO$8vAojK^2>5d3#aGh&&sVVEGwK|UR{z` zEy>67D)R^C7L-)wO)D*wKo`lrnch)YmR~umqB^&_xKNYKj}_KdOA3XuFIE-HE2}OM znTpc9S+V?S`SLcuys{v-s-m={y1JxndJKA$RCQ%dS$=M@sx{1fRjf!noR*hABbHxS zSuM9+lAE8GTUsJ;yjn5UjET3k@TkgAMPX%0c|j~U z_wO$vCQEtJs>9L?9R|Id1aw{df6~Vtnxzh`)#qa#$!dO*xp2WYt8ms@I3X0Q^ycGRR zscb=wkP0tFRVGDWRV_83qOhRFa=3^`xS_v?RYoL_|8bdRB$Jld3E= zxw1xXm#SHjS6!^dCf!4BO;z4>X=`G6=&Yv4ym&e_|NqQW5jCZJsx+H9;y-dR1b zKz$chRwC^{|1HYBw6bWHoCJrW+=?nGv*6z%>08QYloaM(Rw+$N3~?$gMw-581y_Z` z4Ku@O(07WNI~B9STJ7dEcG81{&w_F_-{o@w>BvPiD2$4*o$GGo6N;jeQuLDA!xcyu zr#+^;ub6S@eSS^lrBa-gRe9k~!jiEVOIl7&i!^Ar!9Q|VUmP0ELs#>1r9+VhAk`$l zvNTp*TvC-=Qz6Z%&^0-{FD$FBoFyIFrR7r3bl?aq0@@(E@S`->-5`>|Wiw zP>qW7s*1IyY7Sjjr(NOrphFxP3retRMo>fKy$rshT~aM&96AZE=9N~Ix%(|F!6z{? zu4zTC);yt?){~n04%&?%RZ_Epj<0_7s~_FaO$XPt0+t1)kx1JA3tf} zt76h7a_dLpMn?Y1!eGRf@h8_sNDCu3uXK7))nbMD1yy+s9M+-?Y_uJU!!xURunPLe zp!;=WO#SWd)cOe>iM1XU)=CX5lb*;5Eey@Ls5DPJGK-*CL&IZr%vDpV%hHx508*Vx z^K}X%{f&EHR8m$VwX7h92H8N%8fpHtpw4MGK5}wwWatBQ5hkKm(%fmYstc4x2VsjrG;;^VGM z7nd()xdl3PD9}0(5P92Rf`D@=N@o<)DQJV4f^t_i>Wu(vb6?W(7Cn< zXl1|*Qk)A`3)4!=^Jm~~Ue#eYP7|gnqaZ`+2rZY{tDCFa^?D*#^9p2;l7F;n>HO2) z*ObXPlrJ+%o0^4z3m@jU4I*JVu8)QRiLHiN))oap-K}?4OTE7QWZbOQG89dj)m7I> z@kuo+IMLO5w1WCu<$}dMFqHnYU;RZr;j6L{C+$E#AGc75mF~`2U!che($B(6s`O*v zke$GKJDF=^dR=dzjmP?MU8d#9LZ?1oQlUa8T1o3K9eO9rI=8MW3??ZuRh9uM=%c04 zNH{{xw4O={x^;s#tcEsPngJCX$(Bw^<)DF;LvcZH2nw=HnujuNYjP+rDhh6p)1Y~} zE3hmrbQfKJp!0h45PF+)5A+O;Ux zXavj7+=B8lS!}rHGlB)0jKAucj=ZwSsHzTz!(e`rFQ<~E4$#u=yF=iFEJ0kCX$7eZ zWORr1y{)doLd>nt!XRAERxhOojg{6K!c?B=rLG0%KAW)(z+CkfVfT9VQz97SV@mnUp*xm zY3F)VF#XoYXf%$+g)$=!mMW@UBNHGsD+#ZWt74bLq!#IN6|31;xf(kM%Cr}g@krX3 ztO0`!4@4lme3GSqO`$CNmARRRDip}1QiUXk5`ysidbc$Z*H^jqdLW=137E-C1(r3V zS~Uo}%T|LekznwUb}I=U>JWWQ@Jcfi)Tt@ zRuijVy73fRatF?aCc8oHN4u>T3upT91j1KcgAX;w!!OE=7Oh%mx_SB4H9BW>yHcTy z)KusKSVnkhoFx^qF4hiN)~G>l8Zx&kW2TMjP+aQe!jou(rrt{TFl<_?^=f)`u?t?k zMX=8&#a9sQ_0dJ%Smeuxwi)S4&~6?ayZL2Zt6R1(Jf2UbH}{M29A7qLE>8X-XDtH?}@Z@TS4Ga&XaFXhGq$8rdlvc}c5qS6{!bjpxgp%d`XOa&AAV7jAQq~UA9-mF`?H{j^8f;A=Duxt+NBpt%K zQI{t>7!5Y@g85E(JrT4JH>V9|V|I5qA3CraKU9;YKh?c;+2E3e_~Do9SEAudE_|V} zsF53^uDW|0m6Z;M)D9HcnwjoBZ6YJ73HCIawxd6r6x=3`t$>@gH^rElfrS=&s!RNCK7C;M`SP5 zrOWoGbXB^!WO)cB9?TYvA1c{H(a~w5U6)THs)OaD&P>Cf&V&WU&H5XH{R7>gpscv~ z$R`d~gDeHT5OzJ7K*?Aib=@XN;p;lQ1ot)EwAB$r3MCl#^;4Jzn!!F#a1&;MVL^wS zrkg2-8m^lzx{H!T1Jz)YM#{|XBh_CDN;qiLQlWMIV~J_F8squ_S}@|cIaA;#HdX9a z7g1gB)b9-0C9O9Y(+sJ#w)k+U)lJNO!)7|AK;vqBH77gZ@}Z7=sCZbymP&XsC9Bk2 z*$C>FduWF=%1pVK)<;L2a}&78QVg1HWRsK6TxJ%|%%9n?sk<@?q8m;L14BJhXAU(A zOxERtql#c)M?p6}<8a+H1ZA|AjYRAK2g9G7+M-YfDYs)4i~axd#DDM?6u}Q}%eyAC zC&rr0>C&Wg(or$}Rg^UReTDukU2JO7kyHQDbVHa0=>j)L%Q4%fvRfs$fPRnX1YF(q};L z{=HA^J*ZFBtg6cL^6EY{Rh4}p)hACr#4VOTQYbActEoLf@0=p-sw(1dAEHt`{7)hx z|Gpwh;{SuwF_~cZF4kaH%y37k$?lExD(;Qz1?sPcdxa`9Ehu*Hf}Y;Jl@(v`S&y7a z;h9fUTp*_)kW=)JQ>Mt@i%bdrc4dnDo0Tb6I#tyL1%*YTAm4K{O*-hBnNC}qn=~@{ z!xH(TBR!GHRAFUV9$c>eGwEyH8`&LmZ*(WD{+;Z0 z)xVb=E%zR&$yZg?J5W%=eoX7P1?a(t|xDp!VO$=j>^j`Frye6-(gf!{K?I?+Ehp5^VCQYV+a zTaHfLWhQZfS#qm)+tFFR@BKJ8%QWLTek|_&_d-d_ySZDIyh|MFw~2e(j!vxhlfCuT zO*5PL{usaG)B11fUf<90JCBiM)dg?#I=`zrk>wAFkM~=Q6JF=1#K$Kz^;>$6%#^g^ z>k^XuzM|JAOQ7#PG&4)UDRREfZ>_i1`7!VMV$FzmphH&NTUZ>V827$BLXwb-YlbC( zLgpOip^9g=yuenB{&She8 zuFCGs2x72ej^-FK@H;1-ros2VoL1-ehtw#C1#`q_X^t%P`TV5S_ z_)1=#RE&Rg39|K^FV>RRYf)djNitFf;#R7AcWPEbOFeyPdY#k)4X~VSPgB~=TRB}T zQfE0|Ck47dg|=QO8I*c-ds^bI`El>_=@KZZ%3o`~n|W6j1Tnv*)@A)~DfP)^NF9uO zPn2slc|$@jm7!&PempBaziDP$b-|lAD{+;icC`1cFLipXuvG8H+3Jz+?em>OH_q0o zuIF`ugAK1Ii@iGB-#ZZ4r+N#6`;XCcae7^RzNGU&OL19(pozx4Pf8^P?}4_`Dz42} zQE9;c66e$)$sZ!ssI9bgsn6o-Xup*wZK>H9ztu>;*#fE73xXQ@c9GVW`Wh;#zh+3- zkFqqDOVi7cs1FFT-7h{)l$&`UbdYlJ-kt42)GF>Zuk()zno6rH{7zSC1vpk4fq(2M z{kMH$r5=)lmgs!{Zl-ws=%rF{>avJR%8yAOphfqV_5pGhg#9L%l&#)fzD%zQAvr?VmI{Xrry9;dk}gY7da*AFD+*S~OeM#l7|U>%5KW>$LFv zo=r1T4n^|DnOcM3##M4}3+WUBU#<@Nqk-P2@%oF-X3sFk><*G3!Ti6i`Wa$j%hrH7612WI<6XZ!6&i91=+IZ6$C zB&hxW?vf?%vD9!kla$B%o#iZ3!=j!) zDQ#Gl+r`DDoWP}pc~0e>&ilNo#8uv!CW)&OKbMXxf1iZ9qvTd9s8l?;FURi}l!o{& zRZXsDcuS-r4v>o?-!Fbmg4V)sr53jHq(Mskm4f+EUH$qZG4XEgn&lrE_xc7kXq})w z-aiFN&53#IE?OsoQhRO+>Rn6k=`?LS8Q!bY>r?0$A9J`TUv&uNuF7@U_-}{ARdMfT zjbyvH_h6z9#aS|Xh!fjoRPeo(iCOW)s%&W}tt8#J_o|FDUA?DetVodzHuGAoi+gK@ zof`L^NtEjOvb=8|_deG5_sV;5@m1}-g3NizL0w17|Fy#PE%&twn!Wc?{kf~PA5~~y z)4^Nb%H7{Z3dzs*JN!fc?fk4iTmvcn!{y?_t`bS_!!GjA{drnTyGuoszPx#kfAm_v zefDVSpL6`yK`-5UzVDBh+CE!CK3;M#J1fV#xx)3*>&vCCbclP8OE=wZoS(Kna6IO{ zB2x!H?!C}WB%5ZolRBd_0I4(MwLj=0j`TsHO7Ae*PnTM#&bgM>E!)o=9uF z+VSpfa}h`#SmcE{O+D~*xGj-EBY-*`)OnR?%96Z(Ne~B zzI3UrB@S(Z$;&FK+`YW5(h#J&w~+2gYP(i@DM2ZUd*rG#s81!S7NRC;cZ^>d6t4EY z>Y*4&jrt@pYfRIDZ6zLUwc1KRf*#p#Ghdp%wso2Cb(GnRgsijo$}DX#nchF-N*lc@ zDb;yD$@n8>{7knx@71|3`UfwPED3wi4f^j%V;2D_kDHq9v;L>i-r??6b>5erYYSg$ zeh?dz`!GNMOGOcmFwRkB#+|or*bMjJ>Ek^U37)CJ~>$@?_^B4vq_d$n|0k;BNuow$7`;gs4u>(uuaX%CX}wu@v= z=RG7=?c%cd8!espML{iEB}lGs4UPCgQ2 zkRs6@VaePqZ%>oNq4Fm1e7{)s@T4uble&DPHZLi0sdlMSW9Q9X=gn&>|Er7FG?l*Z z2kExz;@P9K{j$Mq(p# z-EXA}OOYBVH~TVM=%8sICnq|M_Y=Jhaf$J8@4cpS%a28Mx;T<{kf0r-xG$AK>iR3~ zbgWJG_Lghy=;7TVgVT}Oaqllh%H8TqF0}Dhq$p_S?FbB8%DJ>)Z}sIm+-S{Q7*xw* ztvRbYNFDXI76%pfX*tm?l9>0Z07>yhy&CtPE7nd(PNW?Ad5_JN(LuK(hPv$tDONRF zc(LjoXqP4Lq#Kt_l@C(2vS#_GG_bpGhT46Un&sU$L+qpk?`y zGgse8c%mrb>18i4W7`^Sv%Q=~y;=ggN8ZJSQ{ zMyLaBR;J@qP#wkRJA+dCTuM;FD|5qY@3)v(x1aC#l1-JCUb0pgxhSLd-e{>@I>{Za0c=0oZ!6)uIta&xARHT9I3B4<94eD%nNUj; znW0_0WaXYtS>6k>XqEwEYS8OTC)P?DZe4|*ogr(|);ij0W!q9F6Gv$SQu;{(q&XyK zjnUEckuvEOrI|L7x^bO02Dx;%jC)1SQgx74PwD{+lho(C^?mFJP>GBEyII}@2GecW0~y1BH} z99Vo@qU$mqP*=Y zAwNNmt#u|N)!du4PBsu_;5~MXR=13+{9|PYMGTtBxO2?q+Fnl>>GzcSFBNM-)8XxO zI`aKY35G=G);9aZQaZgBQoJ&H1rzc%*GjXvR{Cji_V8)efMCvrnbXhB>%1E^5MugI zUE#{q?pGOp<#a)jghPYXNwA#1RH(hlvz;`fFKL+FNlTgKwv~mite^@-M;gbg9kO&C zlGrpeRa(qiY5a-aCh0x&eVx=m*;TqMag|(^Ii)M#rELOVch3}6sRyrgl4HB?wDL;2 z|0oQ~?2}G)(lsE|vQ|1tW){ghxdFfVW&JFk`Le6v$)1q-CKG4h`=B<krmAa2b(5&dG48!4s>z;i z{M;i_Qh0AS7y5Ut%M$HR z8T#whf7iRcEB(OHFGX;;cl#khy()qWgiHDTI$MLUXDWDLcAdA-uhXM6X+eoW&)P`~(~YPel2(@Yx7k_VJ3>>XarL-Tm+acz`|;7b zm|fsYS`SDNB$HC#o9mmKH6|kbuDInrEKa>EPRUW$L@KgiKvC6f}7k6e5naC!P* zwydPQ2PD;)_rYwfSaKmgR)$*f>LGuf9%TpBuNx`7l7{3_xvy`qoO?rr`g%{ut@`26 z5w`mwQ+FLUdkW6-UJ)Cq2-47{MQEnQo5kv=?CZ!jjeNXPEt+=;NqI(BRxMr~6$=^Gp!ZsfEbl3~Ia4;5f=FfgW8`|D>|jq#CITa5 z#;>JzW!rWB8QvnK_kC5CoZXNl6MY>(brI}+UKPy2UzTjN@&2oZy7uW2RAC807n-Ncr3^!(OttLff2M1jM~|;`OzfxsNZ=*_3ymq>~{_y{r6` zYyB?LpU9n=@#|EGDe08QIJHIiEGjasB4Dsdg z{r)|Yos+yzl7gxzGQCCeW|y6Zf_wgD_YAMUXMS+c!TNh-==FY-d`UV_%RM>X$B5O} zm3nroY#bbl)ebR~k#wU3pyfD!z?1rKd+*O$Njs|JS>6LuJhHL(MGGnOJEVZ5PrX`( zF5i1f#)n(3kSs`K{$44yKsxkmQiB_VP-|x;QxS>sPcwpCU!SVmkKPtp|J*CpKki*s zDx<92bz5qkKT_hLTVO%ZKbiSMQa%VzXzxcV!gy*2~@Aqms1O zS(0z*y{+3@Io^ATa`3%QV(7i0c0Z}zpW)({>Y~Kt!xrLVTkj1u){2-MmzC>w@lXGGgO!_TLGNp0e{ZT_6hv@~S$X|H?|g#Kimx9?)9n%A_G{^sY4B~wz( zZfO_HDE@P?&irH*dwaXArb&m1ZfGx`(Kb)KRMryvWW6v}E0cWs<~>~^D&1vu-#$=T zRgxv2?{00sE}k9KlZWM8($K5zuMW15rKQVCP>E9B@fAxhw$guk{4;M-DPUiZH!ELNBMoF?Tzt|8x<^I&XBTc{j{36?cfE0 z{I9am_h#tlFL#K;aqqkK5`mk7w^w#pC(G)@&zq)5rtL%i!;eQDq0hH`_d8!%B0Lt8 zX9?)FGT`!iPV~Al;O&UUVpj#c!(n`4z?&b&#{|5^VSH4;TOP*G47mQ_Tf^5M0&Y(e z9lACo;B5{8yn8g@`g=wVU)Kg)e{-qf>%4&L(?ktlsS@j^u|xL3^G9Oxp8Vf5cE~<> z?g+Pf`g}4$Jz12{xMba35A%fp68E(w}!3g`A5%%*V^3^ZG z{{;~`-$n3c5&EMe^jAm3^Wlhcyd)x?g%S2AM)>*P2%QlT{`8FCbrCvuM({-u<@HX4 z{_hd-OpefbDk8t~%a@JTAAOdwv3m7$g#NUMa-1UlRbx8+rCi#C`k&zWN=ft82%U_G zxRpov^KnGEza63TendPcM(|T3bXG?Ae|1DT-W=iQ_Yw9RBkZR|*td)DzfVNm^f%ZV zE3YRbbWV!k??vce7U92yt zakC!<&T(59;^&%(9G8G|9F`LQ756Ly=Qu1UZuYCe*`KW;9{Q!$*bZ>^XD9K=(*Npf zH#qyVhq&1%NPnv@_9p|J)6FE_1@);HIH%i}xY-XU9p{Do9R%@$*6vCU>6rZ_;$~j} z&iPs#;^BT~DLChM8FA}3R)BMUR}we-wcy;(YyjteW-qw*Gd4zOp7%%S9E{NEg?gbn zBP?ig>EP^72640R3(oNw49@W>2G{yL(YX-(TN#qK zvALWYt^~Jyxw~UA*|rQ`#xKGJU2p1(^Sg$)*>42r`0pTnry7gxB%X$Omwen9yg1!G z#LeEeU^v}GnTP93dGMRf?lhJHZutd{r4m01TQce3>`w-9vmZ!0razeYY}E6iq+|BO ziJSc-aL(`25I^2T|aRN`h|0nY8c7M$Cu+rN#)w7rjXNd^C| zf<61Wn)ofaXAL;}xt6%uZvyAI*_I`zn}DrS)=vaC`>&vzME1rrz&YJa(m4X>JxRy- z&{k*u`;=zRLgQd-VkN2I7EjYjBc6+P znhwt8l0n?;7n06ooG&7KXIcC-wf{a;Sp?018!KYc>!CMLNP<;R403OL6zmH2JeuEE)#4B}?rmvk)Yfy5uc zg~6m__CtxAeGa(h>u58U<0R6zOOuHwVqawn>6`sj;$~j~&grfsebZS*yb|NlYSK6R zHN?$+Bk7p^CgP`~yf%}L*>53k_B+8jUwcFRWD}8Nua@qF>rY?et?^OtKya=?66u>ulZjh@HHGxeekyUZuOJ<>uO@ya`p;U@G5a~h&3+N-nEhhnRxV3O$LyC9 zH~W>~9JjS09-e2@_^IZi@8IL?!a@5lX9!7ZL9RY2VA zmw|J-8%f`EHj$3;ogtm@xR!_)#IgH^jsC2SYq; zpMw5L)9n({=^5hZg?L|ZF2{l3T#kduKHkoW4JCWylfXF+Q%L7{=u9OYdK6F(CB z8nxh-uG!BaZuU#S)t|0rEXUO$o)h9*!P%ef#BF@p0nYyHByRS5!8txwDV2xYdlD)u z`;$Wa0gR8S;Ovj>TN^j~Ua)6>hLXO8Xc+Mo==X+4q&teZ*-r-Nbc;hg9ETK)8ytsJ zaLbqZnMU?wB(C~OCwt=q!P%d|q+`!33?&`olS4Y;`Zk|*oHw$cK>R-Vxrp@5elc;g zUk^liN~m2`|(kiF%%nz;41wWMSAbBLS$B5?L|S%`<*(JF9` z+iK!{u`jR&oa45ZxY=(3=X$t1#KZk<1|AV+e=>=m27h{jvp>CvoBdF5j?Yxmw>TFN zAJxiTDJFfhuO@Ex^T9dYC8TdUONnp8c)X1C&3*-OvtI+Q>4xWT8%W=DHWI%U{m&-S zH~Y=R&3*?s=QkZ++{xveL3{wl_e^ju-=4(HemFR%J1NA&^}jU4&$CR)aV@y{`849N z5#0PSejubXIHWVVqdQT5!ux59z)jz7Sq5(U##e-N!uy}ALVSoB%W*q6>+c}`3G%fQ zoYUP!-0Tm4bDR@8IVU*XMB?r7yi^i6r<+3D>@&bQ-KnH+p(r4J3eqhmeX}nmZuWD) zIo;KyZ#rv8$M{;Z9}j;vk-hQV;GFIr(y4&XUeYn1*x7l&Iu+ntUe&~BVc(_}oXcwt zakF0p&gm`*@yQk(J>ubDwGX$)L~!;qiTFOuD^kGO&s5@Op9#)>4h->dzfm0GVL#`A ztDo9s+Zuj8xcU?3D?|2}@&wUXMSLUX)vH4~Vf!`2&3-eu=4(Qr?Ecvs;(bHB^hkH2 z_5(t^8l2-_OS~5Gp9jwIpHJNE_kwG>=Y-PTPx^N0An6!Sz~-0vY5R(a;O39u_XDD%-rwt<=vmZ{}>?=se?5oM%crDp)#=KFVy({0=t}IaY-D=n$VD;wOdp5^zh`E-fYgJ@&zufpZ*|6F2(};Ob{D z6PM#Aa87qK@pF*wR&Y*tJ8`q$4X){i`x%>*EAJWdC$XD5VSkc{9|3<-!P%cQ;%46y zoc$R_`sUJb;-~oT$|%w|`yAqCKLuRV4fivPLi_|1k>h~~-V---e0qU%9Qu;|6eXh_H~THb&3-31$88tso6c_HHjeBeeY4+7-0ZDUaeYWYV>531If>w0Pm+k6 zeLCrwKN-XyZ0fFLl8)K;ByRS@z%_1o8{9GqC+5HDd+9!R3+e(LOeV_DG2egA^p-29~0sg;O4(wswTby`KkrC ze3|_m;%2`DT=U!8jODnJ^zG6r;zyz1SVQ_|zm~Y!ZvxkJ(ZqvWHj}>TY$0y_z*f>X z`|ZTdem}UT`v)_YV;Vk;{8jL=z3I+ouh#I1i`O8REMjJVmaCLOb1L-xiugKON- z6oN}zBXqVCUxa>UM}+=P;%2`eT+LCq4`Fkb~eH=NKNsHg5JQ;H;lY-1^Tn(lJ-liJN_2 z(lPsi#FwGp7)&~5Ka{xH=a7!sk0)+_k2i^Q%ziR)vo9tcvo9rn8|rxl>6m>rakHNf z&h=pt>6^}C;$NViFCl%iUrOBUSAuK0*m4eT*%0F4&ug}a_*o_{#~t8Ye|CafeY0D3 zv3)alWjEV{$BuK?IX;QtmhRE8PXf1ejrR=cbTwz>SRLZnIt{Ka4)OCt_NzlYJYQW8 zZvNQc>1-fwe~+_~xFxX(-26A4&BRS-D{<4=PWnR;pPgiHd_OqH`2gu$2%UqZV>}g$ z7S>4zxA@G5P6oK;*Z9B)oq`Y#*Uv?yZ*f>m-1?;@;Fhl0FC}jFt4PP}R}+63{n#4P zG5htz&3-dD$88Jgo6c6^Hoj~peY4*|-0b&&bGipZJUs3vVsp^S(e#sur(<6|6`bRo zM%?WCf~!B_b~--9hgqU>oC41NOeKB0rGV_aKFS z&&CiR7~(rZJRHxR;Oze{;)CG-ZgBR04{@_k$0i8tXApl2^P;}stUr*r*^dY3@>)vz z7K&xW<8gOoIq94I3gTwJ7M#;f>f`R@{H72ef^<{CIlpPd&At~nr#qGO&Hn=813h=8 znDouQl(^Y1B^|S0Mtr)(lXT2}1#z=q3(omUMCImqCK104>85~lJX49AeNS*sw}SM| z|7zlIAl+KhH~Trn&3-XBr@K1D!_ReW2In|zA$~5(cPlu@VLNfN-%C2?|9;|C&_6&r zW`B^l*(ddL7VLit@jpX96`cJ~BX0J^;2O_x+~$XPcpknJoc-BF{5zEIZgBQzKXJ29 z?C6rZ%;`;rq z`r1l5j>_|v#La#;>6rZ<;%C7By`*FI`-z)<0wzgZ?uo>0e>e%8%RPm-*=LZB`IAZ9 z=G#3<$LxC%H~XRBT>o=Ie4L5MaZ!k$9OCQ2ISw1ZIlmjp-o7_v6WJTz0nUEzBAr*U z-rqwy#*b#my(XzR}eS*dEgx96{K%E zD~X@f!d+QK`ewhHxY_R@9kbs_ya4*UNXP7V6F2(6m>rakF1YI%dC!xP4FEV$w1DCB)5s1?iamO5*mtKdVT`>{k;v`wgUH z_8W=E(LZk@9kbs|-0XLdj@j=dz6#~Li*(F>H*vE+0M7kJB06Pm7fHlFMY*SdTl=zf zQ;D1XP|`8`VZ@(6zcHM2%zhMcv!6^lW!8> zzvtF2*}T=_`D`n91=}-+eIF*K+x6V+heMFd%huG&F=Y!Zr^4RS#c8a7xUG+h!MPku ziJSc#aQ0^r>EkrEm~@P<#2eM=ZcvVxJ{%TLTT@%Uo^I=I8isq>e~X)Ov!4We_J3iB zpNsc;Sb_JJu3a+!jlU0nR>Q#3HTyNh&3+TO`jctKa!itQeJQs(qvxYS99v(CW8=Zi zp8(1~lZgKheog^rKc^Bmd;2~B)~_agt0%RjWB%Ch9ay?%zXK9fGlDl8*|>c{1V4RL zz9PGE{#yj^o71@cr4jto2!6qs#&woQ@I4W{|JcTL?u+2R zM(_*qAr{x4ry_Wd@r|c@MFj6Xp>g{gBKQ{(eA~pvbyl9;IBznkasH18-sYUf?azwf zgU)T-enkXNIj?d1b0he&2>xjVKV@>``b#2s!ugHcXGQSKBlzkF{#gV+z^LMt0VY>5&ZoK-f~Lg=}wB^cSP`=5xnh%jq5)Y!FNRPRu?s{b8!T} zD}rx{;O%o8*MBC0Up=*P`;Q`c&%DO%%Od!v5&Ya~jqAJ^!8_$QZa+1GFN@$Q1&!;> ziQpeb@Ii%*>)aB-zm4EsiyGIN6v6L^;6Ft0G1D8@|4Rh_PXzB*+_=uQ5&W$X$JSUN zaD2%joiM*Bg0BeiRCjCe?{5+Oii;2FhwYopXq;C?@ZP13+gC^MbrC%7WMWO5#9|%r zUJpqj-Z8}W84P`?y>bkHvGxIVyc6E*!QPwweYn;GN9AeqerIb3uq>|E{{?nKLiU<& zbGc7nST5AtcLYDnU9RW$JFl3&)pPy5DScsDQO`$$V>qqn=YymBtmiYp(X8wF<>06e z_53FA3YUC6{|4t*5Vw8I1;lM1^LpYhLH}mrTfuK5z8m~5;y;7mPuzaz^&#TjnmX_g z;`aNj&l4X5`g> z#Lw#g2ym;v#xDdhCb*2ANjx2V zG;#Yq(Q(AHVSf(sBJe*FzY;u;xc$E7bmC9LekSpMfmadV3qFf@vhVVH1@T_s3y6;d zzn-}Mp1QtnCVn~iZN!&?-$nch@cW6s3H}iAZ^8dgJQ*GTlf-+2KSO*h_zT3#z+WML zBlsJ{9|M1f_*U@ui2nrsG4T#ZxOjd}{3P)I5I+z6JK~pt|3v&Y@ZX3(4ep_zuy*t& zcr)UkgSR4XzZck!c;`fyug=6z0`E%vZ17`({w48W!M`Ei9uwQ|iT4KonfN&H--(xi z`xrkhzgK~`AbuBkYvOCcI}m>d{21cjg4_JU(oJmX%5ebMcLg6p{14!#5x)@pEaLW@ zST^z7U_XKQ8u0UozYT8l9rJ%Lcs|)D<8$Q_;=RFZiD!e)C4M3JeBx!`*Ac%0+vPY{^0wF&jdd}{2K885nm3TfO(nu{}1ry#J7W|5I+Fkp1A!^ zn9W;Fe^82RN8QN&9PpmRYruOGUjjam_&V^DiN6azjJW-7)(GNhSTE-g?+-qa_&D&% z#4iTFh`9ak)J)>f!oG_5Ti{m_{|x+E;`X~uHxW<92E%Q{j|RVwct7yJ5zhu+LwpGM zGsGu?zfL>_n?UbG@DGVkh0fQ+lc4hx@nrDkn5SDk`~^B~B6w%w_B&ENiO+$~iNqfU zKZE!x@NvW+1)oBE6L<;n*T63&Zoe0G74dgrznHlFUesO0KZO0m#6JUnn)uh?8;O4h z{x%dtpNXu>>maHk@!>K30Qxd&hy}H zi2n;bgZNHx+ix(Pufgqmwv2xdo<%ypg4_3gnSDw(SMEh*e=K-4@qXZS#D{<{CVo2j z-NZ+OuOdDkd>!%0;G2jSfWJ$;9DEn?TJU|uk3_qOVZXuRGavTJ#P0-8C;lM#al}`H z4<^1Id<5~A!0qox&7U{Hr;+_<;1$Hb2cJva!?~Fz+WL= z4!)K6<=~$XzaIQs;`Y0ezY@P2_KDa>vA8`5-j4W-;N6IC0q;ZnJ@BE#zXl&o{73L} zi8sZEsQJV@fL9Pd0sL~}gTb#OZom6@8}SLSUqO5t_+!M&!Ji{O7yNbNH-K*^z8w5> z;xB^lBmNfn@5Da>Pr`nZmG6JSI}-l|ya(}EJJ;_GAa1{>JdAh}?8gw_k9pSx#Dfoq zC5h?86EQ!jCY}s_C2^bQ+(_K!Id>B82A!3}?f2WBB;FhL_VaV^z&-4rS-Nw;Q;1&&ekAe7!H*}t0elGYbo~%sUL%R034RXo9PoVN8^JFj z{ucNZ#NP+Mfw=t++?~X~fc-G{v7dhz+WeB`wZKOPl5gC#Ph-T5nqk` z{!ZN1UrE@vGyiS9){*!Y=-Bu6nZ5P%1IXUSowJDdhM(h!9|L|K@h;$35WffhTphu0 zB0dv3cM`7!e~|cJ!Ji=hF!=Mt9|wP(_&>n65q|;vGvb@U|4ZC{XZKg)-S9w={cewy z%W>eT*zYu+2i}$V#o)b(Ujlv#@s;4Ch(8W)`?!|wv*6Rnej|7}@i@wN4)M<5*Anjz zek<`l;P(?h1$;H}v%sGvem3}P#HWI9BW}M7yNmecu>X$ut>FJ7{w3-|3ifv`p0|K^ zCT_nQ-7SJ2M|=)+1`(eJeg<*dA3K|P3d->!;`Teug%Nxv@sE-2EaIPmFCcF5xtX~A z&h&%C$HC7>BluIqPlWx8#7_o)llULN-zRhrwHDS_#4paP5eFZlZk&0K7#mu@F~Q5!=Hi(K9hKN*v}?@9QZZF zEuQxie**RoNAM?z+qn5WaT_;ZCvM~BHsUruen#BJM_VUZdDV}DWPdjNKLY)P+2?|{ zB|ZcEDB|~l_ago<_z>dO|BoPU{r}m-t^c1&-1>i;r*{i5Y-KKN&3 ze?7SM$7bIm-No%UvhNJu9Q~--9|PWj_=(_|#3zCGBW}NEd>ZkmVLyhrtsnnL+}4jJ z#BE)C8S#W8U49o3Zw>wz;$6V+C4MaU8sY=MUm!jT{7vE$z&{{a0O3;ccJ#o)V%F9!dS_;*Lef>#3iODnInuVvo)12O_;=vvNAPLHZU3R1_%i6sA$~8oeUFFb_c`!e$^J#~`-$6r`)cC0 z-~KFd>*rr1ZvFf=;{QRqUlCskzMuG8;1e)jS-wt1KXx_o3h)~u_$|b(UEfRGo+tSm zaeF@GAH?nXftQI-fj@5(&jtUG_%!gZh!=qWKzurQ6U52lb1`^J;xoa!5Wf$+dj#)I z+@AkAnYcawGlIB1|8q9+8<6f);)}s&68|&!Y~mJ&YlvGMmJq)OI!_Y+27G-4-$?v9 z*l!{JGWZVSyTEr7w|4zA@eg1h!_mrjGtS!*Ux5BUo%kg1Uc@g1A4+@%cn)zJAI~Q~ z2lm$f%unCO9kMrmC2`x|xRJQEQ~SOk(~m)aCE442_<7>LVqAD7g1=4t9O!>UdeB&G9J>kElZ{;-rJPAkRzvKR{#0TU2*a+UAcp1)T z5g&wk>AVQOkod8%UqalTyIW4Y5A3a8TfWW)-$M4rw-dK?cM-RA_Y${sTOu7xcNWf5 zBX~M-OSdO+OLrh~OLrLYDx6!RqB*5N`*5A90K4 zqr@#f&k*kiolV3|XDe|VcXkpt{XN7j&IgEFeNI6779SgrQi$8QmQH*u&U+F+ALj#! zTl+bk_*9&mp7~>OxPa^}zeU6?UzNn?;@pm=e=Yd+WPc0Jml8LB9w5F7=Z_ON`{#&T zfA|`4Tc5s5-2SfQQ{u1V{J+HQ{)5ELpTr)n9atRf^O1JM|AYIx61TsjIf1x`^OK2N zx+92Nx@Qybfb*%uO{bK&#j}>Ujo0&uTm4x~-1cqmBHj<@4-+4a^QVYgx-SwRgY)-@ zPsI5b#H}CON8IA@KjOCU-Tat_Gl-j?V~JZFE+B5>P7!fi zPhC#@IQVlNar5U^;^xnN#Lb^aiCe$%4DpdjcN1|-cPnvAcPDX6cMow(_W&miJfKhGd;`5H@n8T`3`_-gPX;`TX3C2^~VR}g;*I*W)~ zewPxr{H`Ew`CU!i^1Gh6<@Z(MU%{VuiJL#45;uRoC2s!wLfrg`AJ?$l&7Zc!TcF-# z5I28%5jTGZ6E}Z`6E}ax6E}Y@B;FJLTuj{jxsZe=+gfk?u0$=Kn*)?}q(T#LdqaiJPBq61REd z2gEl(e>ZW{-%s51?T1!ves20Ldo?Wg524?Qxas#GZurie5H~*$ z5H~*)PH0%Z=4Wf-Wzg?J-1LtlZu*0WoBo-^7eaqLanqkd-1Liyn|=*=lO_#+zv(Kn zpWVmh|E3Vfqlm$Uzl69xdSm|F6XI$=P14cV{UNUQHjjED#PKLrV81@ZRVS}$fMYKc zx9=%?lX%Nho&7fA!@zeEza9K5;`_jV3~}|d!pX;e4{`PL#ewcZa&LFkenah-yVF>Q z5Lf#nfN#0ZxSCj)Y)$% zz7qWF5LZ7_P+s4MxTZUCjMF(td?~n(_N4Ve?RSAE6F+XO(@76;O?Md5?H=N)a|i5u z6aOCkB;x0cbNa)GKMFpY_+yit{dwS4e^RpBv)p=gXrUzlQj8qa9yN zd{dU=w-aBM?f8Afd*(R)2=Qg-I=+VZqREawOZ*`CYay=rnuqwm6XKe$AK=d?A+Git zVE=W9t9=>#{GRyx;BESfk-V(m*noI;4sq4#o*bCPGKmju<@gE2C*bdt1`$ud-(#Fc z{A2J@#1G={1SSywMxBz^1;i(w?07!$xqooHlz87^j@J;s6nrl6D^GX!*AV{&d@=D$ zhdcYbz^y*7L4Wcj+5cAyQ(n&zAB^WsUmwgI5s$>lw~| z7V(>5e@%#Mx)~VPZVPcu_m5{eorj6v2);JNRmZ-c>xB?kogwIdUL)RQq|^V9`2V2) z1@XcW&i=o|r$FZb@joNocz<`Fwd>W$Z>tbjKNn1Jc4@@BjCcHa;+KIBB;Er$rxO1N zd<5~gCOZ9b#FwA#_=O=Jl-CiC7lpX`f5!QamlLl6Ulii1W8crUEW}l3CG7uB`~&c3 zLtJ&1!=HbKxaypIf&3${w}>wX|CIPl@Vz0f`a7ZjbBL?{JFss$KvQx3w(=o=3{GS1 zh{wT?4sq4*o9OI&g}CaJ!u~|!{{kOH{2uUgLp+Ex^m9X8^>e1Ubc=~^2mcdsAACOX zKZD;uyv2o1|IQFse>T9M6(O$vY=!;bh)=u7>1-f=FYI3>egy2dhq$I2!#w$u5Z83q zbaeV(6FHzW?aj5Lf%==Qy3)LR{@D zpuarC)&BkSoc%+@6Tu%Rz6AUk;$y)#fm^#Ap>~BFi?h0}Bb2;YcUxm2(nVjqV z+(-Ng@ZUpRbv7WsiG$pI)}LhLx%1Y<-<|4sC*pI#dxp5`?}dK95N|Jh>@=ryGV%A3 z?wQ1kz$b*b>JP(u|AG*2FT72@(=R5z4(VPR;;K^tohw3IbrK7l&O+i#pno&*$>4Vo zuZGV3#QzQcScnJZ0)N(pczbc>hC=7hOT>GFZzlc)_`ivFEOI&@5zhhtlK7v&e+Y5) zGX?eVe<9vp_*v7Pe$q+qX!YtF=yVG4pd6udbcn0YXVB?K{Ce=yLOdu(=!^<+)w#0R z`Ef4sW5J6;JjfT;x#c0QI(KI}om%3}yF0!h#8qc1bZ!iB)p=l$v%f3E)qXMT{~F?I ze-HH656V1Jru$F$ zZ@+(S^*QNe=jXhTz3ME6&b1+~I!!P>{+akl@Z}+{Ivb$#P>8F}wln1)c|A_N?{LRo z2yxZf3!T?OTyTE@UMyQ0RNr%LGU)H zN0#57*e@DPJO_L-@kQXJ#BJYc5%KM?znyrZ=i>7;@pSMl#BE)$m-rIcH#^1YS-$pz zA4$A#g0t&Kd_4FB;#0scCcYf}I^r?k=|4<73H&AErQq9$uLS=O@lD_@hBnM^LfoAn zPdo|yG~$!NbBQkl{}b^|;5QK;i2a27i4O;Vk@za`cZqKX|B-lRqRUtMsSWdM-^YCh z@mkmy6Hi6|KZp2M@MXjoV;#4NcqY~tpAatvZ-VuK)x$;L?TPOJKbp9GPwPp<$DSe@t!Tx&U`@!!ao`do03F523-yyypd@u0?%!}G!oUu5}0q;S4HTVePd%-J- z+waBPO?(&TGcOTO$9S}j_)75Kh;IdNKCEGV+YjD>_~h2k?o{IQ!6y)334RIjE#S8i zx8F;Bgm_AuSnztA_(1TVh}-w0C7tf>vvOGm`(DJ;+d8{p#Fv84Aif6tdgA-R?;&oV z*E~VIZ>mf89pd&qWnU66g}rx1!+fm*??8NTJ7;$$ar<7=8saNpe+%&>oz%$dN#X;+ zUnRa6{6pf)!4DGO3VzI)E*&ecJ>a8>59{FUN{BB6zm)h|@LP%R1b>S7s5GblF7e6W zKM+3%-gJ0F|EF|x=k1BF1RqM=zK3Nz@q@6p&%rD{nVp>etzct!CvxD;rw}&_?U4(jMGUT-7vq4zy}iF0zQej{r$si;zN5n-8+cqfd7NIJqP<9@h!0bhPXYi-vrN( zSUt4o=-LtAc&zj1SmHatPbHpkoU<<>ZqIGsNqhoKf%q2i(~0i|A4}YxbDc(fU@w>6LgJIa*At%y{weVl;E6d6{a*{7PCSPFjWdX+ zfaeh(2wp?no{wBcd=czlBEAy*L*kpj6UH?3-<~5pn)syN&hAX&_Pkm?@xFbW{Z+)* zgWpfQS6^rU67ePApAk>O=hoiXhW^h1KbH7T@NvZL^X7cw;|Dn1%ZRT8zn=Ioe4g?M z@$ulV5nl}c5%Hbi3F8{(E9FFY-k10=@KcGe1hvUBvr$d(E8LGqJwj z_x^dKWX}1Wwbx#I?X}ll`{V49__q~&zr+g^{27U_Q}91QZ-p~Q0)e4E5?l{odYLj_CoZ;3+xsH-TrmGb62C#>+%EP?ecrC%hb6wl!Y5wxpsz<1`eU+OKeyndhbN^Tp0?mt zJ^#{z6aD9s{zVH;^n6ajzgTdhzq<^7@OjOG6FtB8^hXO$^gc=d?-rcs|0?DGUlyF` z%ggZxpZ6>{(ewKepIC6BpHxBAn)ay$CwhMWYm_ zGYWoG;$KOe?XzQw;Ggte@y+-diO*DUeX5|Fui)b({yhcHlKA5aeyhZvQ}8N@A5(CC z59fq}KQHOuQ}EwQ{3`{2SK=dO#c_GBNPL!pkD4aRo2%fnBz~)c^Lr-i6?~JVzhA-k zNW4+Oe<|_bD)^rz{$C1yP2z)Y53a}2(#}UK_*{wKq~OaXev5*ym$=}Lbz<04EN;3b z;E>;pXG(h;qTnYZ1(2ZNO9luaNx`p12_Qwm6QTu>uHb8BhM5X}9|?<(%lsRV|Kukn?O({eGP1>naugAIb98D0r{Ly$XI+;`Ivdkosv-a9;myQSd1? z0UTCv*7H#X=Y7a+3eI}&Q1Cpd|C0({Fi-%e75qMlcPjXv7y)!E_)&>pQ1JA@0_aun zqY~Go-Elo~z4N*{?@1r}c;1!bosDjr>{G@^(miTD}XaClz;N0H36`a>=E+{y+_g)46 zQ7v9gs{JDQwrOjwMG9UZ<0!X+bGxWiaJKUr z1#gk@l~=*p4(k=1?XXF~d4EWYf}4};D8gX{=if0ps^E^1qP%SiK1AXj3Z5YGlM2q~ zMxIvi9g_Zng7fdS^eXsTxj#gc<3F~~3W+-uob4w`!P$ON6r9iZPgn5w+1?a(lBh4Qg0ubCD|p6uLBB`A*`D_* zcr}j~6x=2G998fg5^qy*KBv1w!MQ!2RB&!Drxl#n>pK;k+e^2CkCF2~7ZiMg#CsKd zio`YPcex(tOPuE$7+)gsB!!;yO;K>pH(kNgC7(AebmRO0mt{*lC+`oUWiT$?WJ^RR+PNc^aRr%1d_!KX;PL%|Cq z-q{b{t>8tH{(^#gCElyxJ0z|-L^=HWl(<8|`TUU~3Vu}5Cn$KQ#QD8&=FfPhLVrop z^Zst8@0EC-LeJ-htWfZjbWxsF3cf<(mHptnf1LAOE9t!oy<6h-3cg$7dla0{@7Sy0 zZ%O(l1)nlQ$ls#iZ%MqZAG|}s|0L;8D)?!MpH}dQnIhj#1$RiiTfz5AoZm-hy>Z;= za0c7eQ5jDTQSfScpP=A8Z=9sy1%m|N6b0Wcaem*6$q~IJ+v?zFiq(7|SMG`-%;BJYx zDLBU;9SUA8={ps?M&jKHexJlIDEJPE_bPb3#D_>f#Pygd{Yip?yCj~Z;PWM(qTmG* zcPTix$2mdWH46PD$=|EstEC?56`b|9N5T0VfV~RdE%`JlIM-u~f~QOQ+Z24r9BDra zo+9y+3O+^Rrxkp!#5)!Ih?KKi!MR))6rA_ze~Y+UvZv-C&_ZHP;ln6O2OIAD;1pgC)X%A+lg1fSr7FJeo4yD=kBn6CP+Wf zqR_99_+bSvkT}nyGaqihZ3;ctZ-;`jeV$bCJoY~dzFXp*3eNtjTfx~sTu^Xszr701 z{$a@AVEf_qh6Dvqm-Dkp3eIs(ih`%h@d>Xpu--Us&s6CDD*dTT!Fe2-r{J&4_Q31R ze*Uswb}RHep08B!KS_FCe`Y>BZr`KO^St(61y7F@dTdg0sfQK?=W+UB1?O@dRq$$A ze{BlRTfups&jkhNeK@@e9xun~njD9*p80o+ z9SY9lTs~KZ=~qd8rYQ6kY;OwA`pi`DKS}%H^JAEQy43S3g+5c_MGAhC#N7(MTH=)o z&ibiQ@D90uiO->7d078@6?)cxlY;Z_!t;Ci%%@xOZ&Tmgpo|3wOYyljtd1)n1EN(J9DLg=wZ z!Fk=*tKcqaC-n;6!uF})yiU4T!Fe3oq~JVn(4yeHFXga;^FD;53eMx!HU;N>2ptN} z^9-E|F0_Mvy9&vc9l*&6=vxyR>Q5 zr8U*shBc*Yt1C7aZr)r`xUOQ$W_RJHE!CA<0uL(73rjbaRBf%S)~1zg+OVN?W8j%c zr1N(D~qd&fh$Q%+@&Su zkgw{l(yBs}R?@Ljs0>x5#b7GZGj7s`dq4tFeh{>cY~Q1`_Zl7+i?vpeXav_E7K^vJ?*ooSZ-M3yIo8#b@^;{go^s#SeX zW@#-hl?-(S>4MmhB%;JZ^q_}=UOYy6|1+yxYqqTO<5Z2CQ5$}svZA;A-Q!)>L=` zxam^EJ+N4SaHqnE3pZDm22vA|G=#4wvbF%T!GnpZ!wSzd2n}b0%EtHB4fH)>?X)cV zlSzN((4X1#XBPd*&?eMOyTM;BViL~t!|Tr|oJk30;BU<|aXG^T{O%Un&X^{!bRtUU zp8mi0or?Voa!EOeQO$2eVDXaN@4ydb_`}_XOV9Bb zCs5O0Lt+&p+M^9p(jt+PwxLlu<*;8%5U`de^Os?iL~#zhoJU>mN5q9n7lUlV$sci( zp!dgzl8-8@vp@NJg#2#tWp3*u9jo%60v0a+Hkm)in=<0^;`y(}>4 zkMdUY{~7FqC}-lI^>g&w;_l{QR#eauB8#PMMWOiGO4)adxQpIkMMG(;kv^RKEq@bS zFUa_tW-e7 zE^@j!U8Lu~0u9KKhX>)(KVB#(Z{vjWTTOp68Z~29(jJ-KiqW-7dmZLC2@|CaP+ySg z_XHsGip$UNNTd&^zwTEAM=BqENPpB6I6eCxhs>X7tRHWYko5QCt!SwHMnCzdOaE=n zpQZ%V{AZy3s%57f^Xf$Yyv|B@qr;>(JH}0$$~~piN~Ud^o|K*x_=s!qcXmdG`Cvxo z4VmJqC~Dh+CEu~pKvaHo?bjjoLyz{jBmus}rAr$N%4_%jOY3LRn(vySHGXDj2l4o^ z`T^d2cZ}xyEZXI}cJFH~ZARfc`asP`-{I&xjiCpLR*&%J6Fqpu_vPwuU%S_6{VW;0 z+qFh)IoPvEclo*v+re{&evtB_`!mT}qYddg4adQQb&0)6`n-3NY}%|Q&6`iMoB`c< zTvHx&@6xqdfiwbZ(zIEf;6wQnO{bBVhAGWGEp>&xsmO!=&C?w{2Q;nVvt%k$ZY$(# zr1B7bU%QaCw=kmh@^|g6mzGDilFX>*Jr1P31Q|LLABv;v7RU&HdE~NT98AV{istfN zL76^7nL6h^7?-CxdP?kCL1L|TF&W>G<>2Q=gekk*=JGkOt~!PODob3iIOVkSb>1nb zQ(S95bF1=~_nTwg=Z@Joi{$RiJ$}=fI`odm zy*KH)cP?R$JB6Gd_4QE`d8{wjhWfX+Ub#W@UH=+x1A4LWy7oqlf7XJ>?V6bE4U1ukxohX#1DaorJSPPi(n_BoFh=q;U*o*HS0`spqykcoprC>bSAg` zrlL5l5%$!$-5`7N&OOuar5^qTbV{;u#{bA9m)In|k)2TU6kS%`x=>9w2hps+{t-i-P z>k}WO4f;@@K_A_JV!M`P0tA)tWr~C%w9oVv`{j-QOS10s1M(sa?=kWbc=P2y#(RRF z(F(qN(hrri$jd_kNM8BB`V(6ArzrhOzLZO-=tn-&SMKLKs$Tl&ni4{2T7SILMG7Rz z=S#U=!sMO5pYJ#i)Cyk)vRfs&_`lTb)FcsF>?7OuGlThlAyzOacL1u8m(>ACUirV& z?DzrK1BB+w1YJDTwY5{^WkCSqg#6tf<2*@#D&fnkeyD^QukbT2VTSzOALD>3^7%5r zczr12^~{jJ`(w;Cpli4AWq|RzP{!++A%FMBc&#MRwF15jFfI*cT*?gjTVP&<4`XDhzW#p`9~}?l*>QTfI_+W+jl^_YyE1K7it~x^Cj{E)ykKz`=Pab+2My) zu$iU%oBTJlx?@KrX^htaf$ZKV2Uf27z|rPcshlA{zZG-?Q zlbD^`b$!OrSd?V&uI;*JOK8kVz@)@9WJmn3A9<6REY@!35r@c?|N5`*|K zSuPw(nGVYcN;Vv~78ynmmq&9Fh(|&ooNqXd6TH4E;KD^97;C_l;fxtqNBf!%kg7Py~IVXioQMiy8tkFvn9*` z^#r>%W-wh$B$8W4Fu^2JE#cQwap@ujCDVj%A+{_CqiN6KpY2;>e&Y+eo|m9SzDQ5-(LE+@f?jCSzDv*=LF=RI zQiq9~*Vxfxe;=Up9R5UJ!XNtRcSO-wv=GG+IS{&`k5OwP4n2}GrBB2(zcx~EtD6&; z_V37jM`$zOxeIX2D#?J74Axf|82E@8HckIYY$-jolk|RGB%n^p)acD#l@z^q4+} z@J|-EWD2S-kZlQN8@OG24%HF3EhS#VY!91tV0V9oq{D%jANzXZG(x|ffx&vdDcVZV z3%%uQF_$sqWc(2YK}vmw7IQhfXPGWJ=EZP_%x8F}0=;p30`~82zwYc0yxrs|J<|X*j=fA8C5Y!T5bKjo5jw(a5 zQ{%D|t(}BSq(4bfF#IHK9A)Yl;I{!9en}hHOOga?c`wy+;Pz)Eh2@sG2X6O~G?rVE zC}0y$kvRo!pQMZew?8MHj=vokf2fJto9)T^s&zmoB;8NXCO$4H>@P)=che5w-n=-( z7r*9<*ZAUp@CBVKb3IJ33*Vu6{fP5Q*4I~oV!{|ROD*LkOxN-!hR;wSfJ}4;+`@Yn zg2DPqTfKZj#+#u&&bR#tk5}3r@F)K&C^@mD=YHdL%z7OJu_uVi^jmg^osf|vg5D7@ zPKh)HkXWh_VXlJupDoX*@&enQG6FX6TCfeg7Hk9U!L{5@wH&DQ*MpzFPEX+_NL0=K zdjkzJQ0H%uMF^AaAYlSe{t#>&Z<28Yo|?C*CdaSnFMR@r@fT;ZzLv})SuY`@NF#$t zHXa_cp9}(ZOXiTQuam}*LdKw_SgSRpKI^`|KB*>G+J5}^>N7=);TPRWVls{;W<{F` z>mowD7(HG=x(l*E;kKNqq@vg^_+;@%_#}EWezN@&{GDPxr>cu3-NsTySe$_AcSwx? ze?H6emfw<;lA2Uffelzma_3RfjG5EYr_D%8si?SX!_>;EO=YDe)kzr{GiGL%tecab zUOIEmob=3+88c?Do4u|C7i%&~ii>9z&rUBcomrBqEx2*|-J7b)r@M=*Hf-9sb<^fT z+DA40!$XJOKf3dSpBy{;%A;q0_s9nany1f9pNaoxq)(SSBBob()>IW&ZC!0$Z2`a4 z#BX&lzty4qRx`iVYqoeQ))w+U3&=4$W9nU*#oCsQv|XiiZ4x%tX-jh!%r97SOX1S_ zh0B&NTVTCkI)7&HZAS3zEbHwpdD%0R`v#SQS=c!yq;XY1nO~Z7ju}97}m9t=QpIsbPB`Z5R??g|wB<Z&&%V9zmW6jLC@i>r#e%{@p|5bFn49iG1l&>yI}hw_LNQJ5VmFYVIxY5t|n zsMv^w=ha$O={mE7T8X(XD!)v%3d9tdDn?wC*1%e{|0ga-cw{qV$EAKxzNX)Ioj!VC zqUrg~pcOa`6|^M-$0j`*@$<;19A>tDtU zqAw!FKmEVqTs<30Dz>aGT`di$KR><64UfHfZTa+##nsqoJpG1gGpEg(HhcQ!t(&Vh zZK|HWWpmYZ$!dCWaaD;Mz7^XDx719fl&i5-b#p&1yT2SmJ$b)9Lw_v(4}{j>E2p_h znE|^O_t>pR?r1aapnGPyTIgZ5)Wd4(6<4F9T5Wckt3_wInw7h`dhOcMb>M(HwD2#X zFx2l6w^Vy70wTb}lvZslmIyU-JVUSw2M(Wy?Z^@$6Ns>DPX8Ft_`Rmv?NOga8b`M+ zvd2XlZ)uC{`f}Sq7)&tXDGHFBvvI`S2}Gx9g~=%se&XLkEiyB29QY-fm z`iMxQ^ZrFflfKAqk6apQ{MY@9A_mw;M;d>$y%J%!+l@cpzsNrFcXs=$c86`sP1WglRh#S#NE$LoIQHr@uMbg&Tj=k zT!}4U{u!m9XNH)|3&QBepcWeDV}$Gw6-0)=hY3z(Xrb~Dg%Ow$3rb*^yW@f&^TrUf zS0N9KptoWIj}3E|R^Xnm3^6ssx90aqm}6+|YTCD;&v5um?uY&d{qVo5A3nSL z!C&l$&l~;V>-ynywjX>;KYV5ZkF(U5*{_4gP?R^$Vh?6K0el($#aZl%ahm&zv)C0| z@LML%cQW<>_A@izfc=bx_Qc zW0?v*U#6pclQ~m-7g+F#7Tj&Y$64?i3vQLiD{)nxdWoy@v{?9<^NsSJJ)z2n%c$~M zYvD6hUeni63!Wse>5J--KBR~7;?n%vDX&%hf(1{M*YtH&UaN9OfG>SiIe96W`2Tmx zyF{=z9++svaojqYuer ztuJ0IRQ2N!l7_z8$MNjRL(v{&hGfj?n-ZfkUZ zs2^M`G>Lqz^gobYEb+JEH0wtn6(1529>1+0{N;Xd>zU5he5c8-RL!@#AN-YmaCWsS zpYKG5mw&efw?<9Yvs113TFepBhxl9ZclyDnO9N8rpXdi4fQ^jd_^<5;|7kzCES5&U zbtGSpHu(+|>`mO9+m`oi!~EMww@RENM#8PpAYU{6vyy(2g+KYyB6)v<1*d$k$@?q? zAB249Gf#Z^<>dAM1qwb{(l1u<8zpY87vdSqxk%#QRp?hs{QC;NQQ{>E?v=Pl!5@)$ zrGm2`_bNDzGU@YU@#UA3aj^stkpDT!{|SZu1Bo9}@V6!YQa|`_6#THH|AT_RDe+SZ z&hmVs;729>=l$ScDmX9GM#^+tUlXN%*e)0!A@Kx-eyYS1B~IbIvV^gopTj^j1r z&o)mYQvX38f4dQ*NQRj)t}>^t@2FUBO4leCZt+t30D6{)B}; zw`HPhRp^h%@^U?Mc~_fU@h+G`&-u11{JFfR6+A`qk*_5A^)_GX;i|%)-U*^ljQl2j zTKmm05@-FtCFQ@~f>V8QyhY;+`Y=7qKih&6J?;0P&y5zG{L)0J&jl8o=r>6Eg%+IX zCrkS8D)=~wud(37=dY5_ItxyGW=Q(Y5@$W!glF`jjqdbeJWt$e&nfsSiMJ_ug~U4* z{62|akvQvZgS?NE`eyvc5}&HzV!lArG8FttNq>ieza;VX3VuT3n-%=uB)(0-Pf7eI z3eLZ!^R$Aqzj{Hz`L}fV%waC?$C7`$LeKL2QNjNv>HkB)dDq7K3NAJX@n)NV-9|~e zIB6GD@7(67%913`a-Nm+Y>$MKy)BmVOjqb<$@?2EIMF{N>A!8k$v#;R3oSU&Uz7Ap zEjZD$epXpAn*CNRapPulK6A-o9m0mOK({CP+Y{Hw=FpF|F#U={-=U>%KI(_ z=iik0NWou}@$u&hULoh!LO5c^0tCsFYzt~pDXb`1uu~J@P5Vx6C}>^d?o3pTX3q!9rFGL z3r=>$?T+i2+bREsLykiK9a&FHEjaOCEyo)xEjaP#cDUMt6a610eUSwxdTw{+7M$p> zm*bO77M$q0-ThF(=Sn&GH#xXmk4io~&SJfBd;F=whyBdc7M$eilYD+*!ATx&r~hQZ zP5sDm(aRQ`=-D5&S#Y9%Skk|4!HIsYEZ4s&_y&ppS>n`QXgqiX|LF6cg`V1bx`}Gq zI9U%&ze3{E6nw43mnwLT#5X8-y~Ka4;5;7qg@U(9`d1a4=a1fyIM-LXv~!uvKR@t{ z1Z4I2@m`5@?9KjUij05Q2Qtp{Q>-V}5Btwd$&c~JFe_d-r>SLL$~MzP80g(XCr-m&Ow`Tkg<7h)sQ&Y$f`s-Bq(UJz&AR4 zr-lySsiDJnaG=f&;s~D5vvq3z?;oa9hIXTL31$=Qm@8W1>#|*OyF@bz`V7V$VX~X_ zKXdu7f-huu>j(32^>yjlzj6XKeJ&oT7}3^G5-AeIm$|k@<#fn<#>ppy%b)!o)5~Nb zc@2Vo!lkd23I3k^4x|q!f0L9yUGgD+PC90JSpMGw3zz?1nU4Ljyba0gI39${|D??S zv`k3(Q{HO+k0SGM`Oha1AMU@zU1(kpfi7JBE!T?_7i2=ppH@fJ{OQP+aQXY^F{B)l zO-Np8{p7zlMWjfQ=_&t#Ve-$H_0RnIo9DM)lkq6yia6TRe(L{dsz`AZ&*?+?hdWD$ z_^CXJ{vo+1oqyw#F#4#pG#{&CME43cYuKp^ghy<(T788=+8eg&f zwg3;8|C@5Lj;}I6dpHTjnpx{9oyE^MRo-SLN^OC;v>@|5)>J zqBDM|Ohn7&&Bb#%gNSI(;!K?npI{RjrD+_UbMprVOJ2MpL?hFH+IG@J_oXd0B z(9*0rY#%Imo;8N2QGT6BcSfdrca&>}7u{9&!@J|&wK>YO4V;Pd?(R6)Im#WNyFB=z zIQWtH;%~cr2XNNRdr}7CmxMEZ`pdg(h&TTX&YcP31${C-%SpN^85+<%x{r`^mCiuU zPLzSq47zsj{8rRO;C!VzI$ud|^$pd0y@dwO%!z=V*>N5aow4Ndd638F<{3)bLDFTS zUAxn*d-I+8&V7@dTI0K#t;Z9_F3fuSU2XmYNKbl4y`;^7E+%TOtV=jg=rZcJCH}g& z#Fg5erAb=Wap>@Lq$_LhBrWSNQLe0?rfFH_sJ}AgS%^HT9F9aS|D)@){JyV@JC}lQ zf>VqAwSD&}_i)#-M8i>j9B2Qy?XIjo)CuNnLu{2~%KbyFlxIX5#)|RbbZWdVXsDj> zwsBaR+}|^wgtQL~hp>@(55-+tz5qI$kF%L_p;J10D7&?j_duNH!@Sd;EVS)i4~&Gg4~-FN-G-pApOn)&Nq02-WR%|O`J#``K=P%?x*Zp# z6}+nr>si=Oo#y@K|yn)ETZUC(dx% zi8|dCRepbe$_};n<>=JY(H2mF;r*c8;xlsda44OR0Ly z!G*fBXASIve2E*pT9IG4`f5HYWcmPYkM!XtdF)#3tFVJ&q*v2qlYZV7X^6fP?f4P! zo~P>XlXB;(vd}W*Re%TZDrv&?amh14cg2etbI3PJTYX0 zrz~@~b5O%<*qc{Rd}rr-uGV>aLQgj6zC?YYoMGEn`|rK^e})cU9iv^u{BlSgQhAd1 zdh;XUix5}E*U!v8wl~t{`!UY-A|K^w-@ngkI2vBnoITCtJM;k!u!+W3aR%ILW5V<6 zdQRvE?M3Kl`a^NQh78-mxAr})@q=dSLq;6zLfd=au$yg=bm@u@`0^{3euQMqeU$y* z2-8P2gP&uZ*7$6a_V$gx9;=?M*I&|Y4FZ}=HxHtieF&%kHAC(GqFTv_KH&CWu9wI=~Shx|s0 z?pW0QsGfE1r`cKV0j{hau)k*w{q0(m!F={pJbMDqqFq_JPkHlyfxO9<%x6#F*?v45 z?8>4%Ol&`}W?(~IS>}B+?w`Z`2zmb;?w`l~XnFrU?tg{*M0x)!J*x$NX<=X9sTN~Q zZwq`}OWl~vmPcGQtuKwqe5D=NkB+IK@;!k1Vc&NaWhI$&e=g+XGPj^@kdB$|Uu}*C zqN@u-w;OcNr)9TNy`Mv!KLFd!(}$mM=+O;lz`q%KdB!aN2-5~WL_MB+No!^QiXbxs zu~*ps+Gt{Xh&Sz_yKr~he)y?w)aeNQu~DN@uiYbDzE;Sa2>(|*B-B>3A$RkCSnL7y zJqYP24W%{DQyh%=1ZUl4f>wK9+tgWSywF)^!$186_+j7k(Cq|0>clg!ljot|R_J%v z)x1-!&~Yntd=NT*20Ctqj(4JM%|n~&8Kf2bOmj4(7!eo0xS@WZce~zr0J``PI(ZuU zpmuTA7=`$2q-a0TLDHZ=+hCtI4l?DQWIc#>QGqtR?;h8&!U5Wy$K$mEt8J1k79&kb zYjB;?8GcmegD4BvD{Soqev8s~P?jm`THYzPV=i0s^8x!M`=GK?Ia^R(vZtTPa#5K& zWm$Sr7S!vkr;#6Fbbcez67HgN4WR=oZ4;e)X-VsKXc@JT7y38bs zXKIsF*VHcCUkI-22SCep%x&EGWiSo#BzdVW+Q5rsYqP}JRyo>bT2+3kmm49UwM^8n zQs2_zIK9vDc)}BT=zqhNE%!ws5A`2E0T1ev5}n$ei{aC~@WtZHPtmuuAO?HKme2sd z-7pcpoB9Cq*WAajzgGJi>$pMfYf4`B=9ePhCdf;EAQ63?j#$i;1MT-M^n+$!mJ{K( zRibrh!y86iEX<^~_r>+vG3uMoL~4!w#=igT&Hv;Y$_HKJ?9&Dv{VM5^^TF{81ymPK z&GpE+!4%t$*yYs8XYAb93!hYIIC|y`&>C|f8{LoAN1W({&7Cnun{BG2?4Hc480(P^ z=GIhr;!YM8Ji1XLGjyWJl zD*OY*;jQoy*?;LP$ozBP%T(vTLwUm0Y4X2%^IyU<;ximCs9^)SxqF~j9$MwV1O5>7 z75-hrKgMV-fj;1Eehm3dU-XP{!ukw~6{8SmMI+uCh`4JI;;$IQii2CP)!F>9qR)uH z*h$2T6f07j=*4*I62?a{3hjV%h z^~fH)yBF3U87sZ{SRRfKr=vRL#c|~q99Jsm`<_`qapfq)mCI4CWhmcLlyeEnyBKlh zqE?jOj4Oxf&IUCP@&{eWUydWqI;HrtJ0`E!jTm?|;!mWB{}TP+J_9lEP}jxQe&Q(O z7Q~ENz2r5@evjaNWmWbF6JG_98rMDZ4R~Y&#WY*acl3v_&=Kc~Ub|kq^a0p1!_)M(2+^ZDla{rbzCTUt{yK$B5554v&@dn3@y2)&GyfiRyP!*lJ`6Flv*8TN&re&=@Q3k7gNwiIX$N{^WWml|3N>tmwT@_|2XB3Iu>!Eh&rM%jG8y;xcPn|v(FfqMrnx04x}TS z`k-BmN9kf&Xa^91^)6Nu#--W+dh-8w|eAV0hfeg5`-{EhJ=%u~v;m@y!1u1Us#W-Nz$ z(v4{+;Kg!03mUF#vXQ#dfQ?X|JE3dp6K;eo``|Nl*bArSbW~66>-~B~+e{3qt6Hin zdEcR{|Ri4^l5E#>;t+`Ub1EO0o2|*@?BebE}iDW9nQ8p96ua# zOUn(SA7MWJHvWLMjSD~U6WKS3v5&w=Hh=#EzH0wN?HhB%KI_qOh1DDUO=4o1GddXVVl$+tGdsI?v34nI{N}?JNt>{N<7~DcPMT}orbd! z!pT27biJWo&Xv+R@MJepPd)XNM*rb+?cU!YcF_^T*bvJYh|wamOg+n++gs#pZqT705Mi)dDu=Vy>Y>dIe9I<6m;ry(q&1X(4~J31#~3Oc869# zwgqMEp)niHSJRr!75t+)B$~VS+~)G_v!NX5gNv5Ad`WWMhntL^PpU1&`CM+Et=%=B@c5Qqkbw|k8YrKCP%uYO$?X~$?kWba?I6N!)C}5-X`wBCu%;41)rk;sc?!^Fo5z6aE{jPx=I_6)< zjnL*(T)!jE0ME(P-Y95H-Um~xO@b)Q-2sI5UymzK{*JIF{PWADrheZnP0v%NQ3E+NRAkzCfM0^Wj&}j#S>o;7#ko)MuQP{ZrA?3tK66eUI)TlN-88 zgia37`VHwLR;>4(L7(T2!Lvcyowc~;7z(jd2IoWN$+5(2#x*hi`F#09ad(scq0=(( zbZ(h{Z1Gsvv3YuQ`FQx0MI-4ts@&QRcFyzWGcPJ%Zn8K3N5Cjw=St^R(~p85@gkm+ zws)6o^?xVq@Z}^kmEnCE)4D;o2K+qWU4(X~>$Vd~uvwY|GwTFt18Ha; zTFfi=MQV3G4?A-s?KxnPy0gc?{M5RCK`eK*&$RQhpM!4>>>X>Miw9|qORzpeYe;#s zaINp&SFZ2cw`i)?ST=rGYx&IhR`-jV?;QME+KlXDg_z&NNwEdzFprhgk6$VoAY>!m zT!HT&7lw|?kn5<;NBG_2Ke7;|eh4o}Cr0rXP_|4RBH-|a1U5>5~8i55F0A2QaJMQa;H z&hWl9Hz}Yu@?pf2?A|#y$LGwpnZI9^Is^9$Y{G_?=9ud*Nw6_)lf}?mdxGFojcY2C z=?`IZ&*PqS=|nnD4)nLw=5wyh@s+&>n|uxTD{VgV#ph5LWuW7jkJ`h7ww?RPZWrl~ z?Q1~24AciTM4>KdovPw#%}4f1_K=FXKeko83vbp%6zak%U#^soWTUlj)uu>Znpbg- z)v`ur=lE{FUbJg!&%-gFM*S?d5t=-i7q#CV(3Q0gJ11$gh!^q5ng|=oh5m0xzXG{Z z5r5zF+Wf3E9eX~oFGL6CSdfD~1ZaoXCeAbwjaDF`1Vfp{lu$X6DXOPo(tDA)izR z-J1RYcDm3B-DSIcX^?d><{2wSYAg4nA8dwAZ-Z^SFdp5Oin+fDkY9KCuocbJ0kygI zWKriWo7!YDAYUV02-puuI@wroWAYjKGS|_t`}`F-m}g1 zNEyXyitp7>FT0Lm19Ut@^iIV-wdCW)A8ZON* zPeNJtV}AZWy}S4QRM%eKW<>Y6&^}0RvbEgF!M1i5bwIjJL7VbG*HKQ_RtMr)qNj4> zNBFj;=-M$io}K$@#i`t>*sDeMH4?vbXJUD$xId*fPnf4~#VKmfBgTn)=S0Tw`*^A1 zdh}E+s}!`9H>Ejaj6pw+bse-}6T1QZKI)m;y;7C8?x?a`(k|#`dS*_{oaff`V9IV!HCu?lPNxoM0_{^@nK+JC+C6r zkTlqyF9)_m_Cw{MeVikXx_r$mE&Z{Ld~Z%_G_@W0VDd9(pkp(J(4!Wo4%(Va9S)uO;6L*a7vu|3>uGrqG_QU@n*Sa5vf->7pB$ z2l_~XK0G#*7yTURI2F3a{;?Cc=_4A*R~5rQZ$Tf*cF%n#>5P1(BYhY8%wgy=hxK$L z-(fR$jv6++ch0*xvwA$JE0P8KzT$~D>4D;Yiub84nsox4Y@irrNG__)x1+C*#GcIo zPFI%jH^UAhruW^A=VY^`pr^EyrWRNo(lFfza?a5Md8yB%IO!w!+Ejgb!y^3iAjU8I zh2|rBqCR&6{M#?_kLr=)u8(ZH_r0M1bl(Z|i%Z~#mm+>zBx9!yX~SB};1?D`|C8a5 zsjn|X`8bZ9jF=lf>ICBM2J+j{;2VW}&Kc2Zh2Z}Y;*og^ru3l91?6^aWtlCyVTt~o ztlij`xI~Z4I`q}ebBLa3yG`1Zo?_5)o8h)Xb)CG%QrDXvj4ObC_g|+~6(jbb^mxD6 zALCHnneh)|GKz2FQBOP3_kGj)bf7*{F#kpNQBHLTz1^xun{#?;*;v;>I|>&EwIP0{ zIH(q~P#iQ%AJ%ZIqjwJMqrGkKkgqZiMfkQ7&qUFu@d!F&NH!%v)6L%h@RA zK>k~EM&~gvg!rBOw0ooJH_bS&nC_tqlsz6XOqvIBTv{&X7E;h(2Id!(`3#ipPne^m z@_8raVBSzWQlFON+xbbh>7VOA(aqRm|0J8Q8a(TtUY^xq)8^FMR%GQx;Cs!AtPVTA zUt5t?k3GA!<8yrVNb9{W$M@)KLuhXQ1oI$_^tebj!HEz*9G?R)&` z!NF;PQQB9L_En@cWq}Nis{>}&M#(%Qb9|56lstijq=U@$Um)FZnJy0L)+p(Kg``6n z9lil`{@t7xvb-On1<&o$WWCFh(R>vDzxdEu7}>#VYP^UhGwZn+N}K0RDq;59}&cj{RwzX)QOEnc8u3POZ7Oxbzk5b-)TTlW`2$M>hDB3>GvrUZ;Ae zanCx)6Jd#0niZNPq|^Dg(9!0$fF65=4-(Gns$QGs!@EgGsC@hz;g3gZJ}Sq4{Puf& z4q`ZzKL!531M`sQFdyi^xV!`YKBZV|9N&-ql?*|=g}k}^1N))Njpee7{RI5Gv$V>S2{Mj*~X{msLB zXer>68oz&(L)R9c!C1hpA;yo;vS==`$Z{RxSKt@zHSh^YPyGwerO`ef2gc|0Zory; zd_h-@klU1L-a~PBL3bYXcUJk+5XVkN96JTJN;b0Sca^8g@Gi?Dec-{HF-Nlg5zRLV zzN{GecWn*uv)b%&_%Py|0$x)_y0X&1Zz}xMWbm9e&XwhuJLHz#_?I^};f6!_hq=DA zU3v`0S5f87kUec8Xj74PD&l&X|6=67O?Q;Hpgok`gE$#&xKMZW`<_Vhy#d)Sp{(CR zS=~tIc?9heV}RHCc^{)|yCvP=hvIP7ZalTqZi=BX|4F(?|z;R9fO(tty+aMpsQ5{KI6F z7jskeY!Tw}MOa5LX^O(sXEyZTUTcvR@Bg44-`96{big2k}qHK;?=H_#d*`eJT(wW#0Cu#a2d!|K6Q*Wp-={s?W7`lD#9j}AoN zJP7TS-eq&3o$|YEQT2g$+0a)X#9UL)8t8=HWh0)6*R+c?Ue@rwEZsYIqs>q3*q5lg zKJ7I2-(k(S1M7?bXueK8s^<;lGY|Q-!Uj`Ow~h&-T#)Gm$Zu-DNPwNJB9H6N~wuzoBO_zn{GIV@*B<2QT`&8%jO>GMArSIt+ z?VZcmk=)ToX>Ou(L;!md>qb8KgU+D>>xIq7@7W#q#lHa??43({TB%L_VW1XE`8LOh z`88^n)KA5NQ_|Rv>n|zw5isma2o4%&K?166`5Bu;SzAU2lau3!fCLRxNoNSoD(sfPwxV}Ya3PG^kpBu z6UvM59RZ!aYa3avzp547g?9N4-VNol)J28n%Q1f&#{4w5pN)MnOrIPbN>BZE$M(Tl ze4x5XEn84X{5KlJi|=wsZtzZ){l8LjzcFnj?YxI^mN^f#DyC_;G>XCOwvzNhZ( z%d=AAv<#M|{fjW^px2!?j7QFE$EZzsAdeICWEczjXm3p)=+}OO{=)b*=0k>RcRu||U%^(?H}fhPygfhV2JLOC54IWXjaXFVi?#$5?at#2nvn8b705mZ4pe?bSoKqf>KyBW@4m zmpm&pKY9n7>WbdQr#)XJTk`Bsx}r76`wonIX+2igPSE~G+UMK-6y8C?{I0on1iK-B zbgyii!{ImEFgMhOc%vgN$M=Su8|sj;!Mm6nqIXp&&*m_)v7VAML**f#L~D1XgJSrU z0~i~iPl`W)vak>JB4#2#N_J!926()WwJts{f_!S*$-aWOB5?i#%1C?n=)FP#BP)=q_eqx^YOwU<9c*`KZZ zelNF28pC*`U6cNkZwlWIzo(;2NJsMu2M`yK?=6Pkn@3|HSzpCSU$P`nz8%u%(wP=q zj!ug%x|VLw{~c_R^h>(wS{R&`{3`iZvd4K?Tchh|NB^*u=xa%r{}I}*>Ff-=!*=91 zDEreE{b4_{sW;9m`LDrgxgMGzE9si&+S^bzoD&oO3-H@!M3yI^?3{ne|5AB~HPja4 z`@OBB@Au2u1v)$I)at{jOf7Xk=So!=5=O;z#U7$ng9Cej7fC#&c5; zKTd_MEkf)#4KZXH&Ox9#sa-e=p?nwCsc;s;oA6oi-3Qb3=$>=1g+jz@JHd})weO=G z=kADlBGs4eD?@(}jlKhM+Ob9WM|6&T{?Tz5-fHo;M3+yc_ZP zRP9bLz8zCt$2u^-<+%=fEg;7{jN3ieX~%Nz3FMVq5L^$|cI82x(!1pE!tb8>&%T1^ z48*~(F%NtY?dd9qKchC^jdij-^rvOm%Y{DC+`~m@UF6|Rm$Ih^wvzs-PE!yUnD%e{ zpqG5Jd!yzfJNK-E-$q?K@P4&PBQaWEEQJj2G|bCF{zR;sdC(pn{7}S(E0hZm@32zK93S&(Zj_`;LfX{|vuLebePMj4AQF6a7sm_9q;GpJ1EshF^AI4YC`3 z5|yD0`tO0x%{@G*kGsH+`WO$sCu99_C+44)=-9V~I#>!lw?hAiP!|=@_l6e-wo;sW z2s*BS&KG&gYZf8aT!dKj{8()k@6)Xv3p+ypkd1FMF2+2|8Ju-NzCAHZyI4op=xZIb z#C)=jd$!;9cS3b&)=4q+KT8F_`VOk+&_2uwr;$m^=|N@^tDu{PX?zyYm7y`F6bYtHj(cKHWZy}Z_x<1FONB3mx#rvCBZ*u=ltT%1D-sbDZK1nBH+HA|}g`vGIXhZ(I)qGz=U%+LgychJBcZtkEZ{FW->bx22gQW95%q5Y|zs&Y|ng@sK9QZfQJ9(ug zZ%43QjYofR9`g^W&_&DDKrEE|LZ~gX{LME9^I-W~;AejPv-7Y`Yg_3`2&Un7BGw+nyY~*n5Z!k;p1=%*uPIMELgUdl)<9pAqMrCxtmdO} zr{nnGMtV<+;tj+yTPfyn7^M4^rD~zb?3(L10h|D-8Oe4p8ruFxESZm=j-ol(`|zymi53k-m+g8*NN)`V{OZFb~G_Ks(k z9iM+-F@r5*W5%27U8i^bXTZ<7pb21hJ|eI6{o{r*Rq2051HBL7;* z5dpsAAxG_w=8YuBNARJGu+B$v;2nydY{*d}CYE-T6C+~~zW zE#*K=QObd3B$o?v=@A2CG^EudBF*pUn`|*Oz9ZY~DND_4MGS@a&8zUc#mk$ZyHwlg zhSY1hr&x#4m;)Gy*o^f@ZL1vm^D6qQ-SITbod&s0{Xy;!{cT6OdvjAxsQOdojDno! zAzx?A%7!(4xu?z~iv37rCo~s=cL@$UAm@3ky>+ASH`g()8Fyx5Zf22PyNKAWu^8{0 zp93x0$fquhGrG&%h%XZlo;RXSOdhMnMo&C3>V&4v2JPF0=tGFU9`;M)P1-ZzggvHi z9UF)EEDiG`Sv)s_c4p3x@Vv-Go)<|9wtMmc|MdmUx1hgATtI6O-8h3S1!o3y;~X}~ zJ*#^e&Q+rCd{>s6zHf8U{)r4~d(;OTKM(a==a8m*rmN;W()57-EXj#@gyz2%Voi$D zMj|%39`jPfqb>}O%ZU%u&)k?}kGfw5=fPt)ny;n#Sf&g0lj3Yfnp2$sU+en>WxGOq z#mAWE*HO9$u4pSshUWch9wXDhKb~m5KpmzSBO1*vjLJ=Il;&)@;aA3dF3M-h7?NfT z;v?rlAO2BVH{!@H*pt{(JMy5jc1i2|@L}{GOcTb#=LhGsc0ST}(-~Xa+>XBe`FV|c zP2QbaqpQ(-Q#RH*ZkvTzzHW3c@yUsGH6BRT-=_3V#CV!Vysy~_-*y>$0O*}LDi6t( z`*d(wNEUjQO?4YmcjDb=dOi-%jeiPFOE~q{#0UGvg2wSB3O(Dx0@PJY-S>LwOhs$n z!*S+9N0qiRWs{cGu@2uQT2@Lf_B&qPpWmI>RMlZ~MAJLaDc=MBErAOR`x6R*&BK0! zulDErvFYG5TU&W{Iqic8%+X@bHjB$m@+bc)v|Oc#i&;1aX6GOw*#_svYk&czPkLk-EoW)HV5?uzY+AVqABO~!Y7dIRIf9jN1OvQ zt0nh)N6opPS$GEu<7@H{*|_FKN|JS0NTUc!FainujS7I${1=ggNV{K{~)~J?Zzw#2C!70v{ z3CF)HKcJ&``;$Lzd;Tx+>@xN_s640~C33BY%6A%c9f)lx_WA(+A{@PeSZsitAMZAV zZ@E10!MJlsOFZbj-_P*goq67Gx9b?KuTmWyz?>xOt0@k9Td3}CrFUS&8Vv2fEWHQ& zmGDFHXRs%eVjbFJi+l6kO=|o8^;euNXO0uGe&R(sT0e2&o5oEkLqgvnC41^B4(N)` z&8$W}n)x}ji`kSG`B}@$`+Ij_?vV79yEc%XXb~@(bFH07OZ&WwA+sIx_EsL0mh#Rm z4W#Y-+e2};B5x1M!+X1Q?5Rq`oY6S=V;=vu(Yg@$o`HRs@33ObT}#&}V?E}!nQk2B zyIHT_2H$Y`Cl^wkg@4vuVv!B=KGXW4Gm3)gCVvJ@zGqm9?(iLJzvAFmxv0^%gqB9M&_NRXL~*O04ydx#~->SK?!{oAFV6 zxc5adUw*`aHFUCJ#2!cJUCa)AlfKn=5MlfAv{y~+!w7vpk=`MtcSp%*UNUTHI49b_ zx1oKLC=2=3??NVOM@085_6|RQe`H6+z`HDTL_>SbT4^m1d*^At{4k772&3|njPaP$ zB0ACs?WM>8AIuw@F%t14I^#}}H}97?3B6F>^qlllBA*kVH}K4Qp0}!JqOYsk?th<_ z_RrPR94q9bHB{Pf2R&wy?UH;nFXfKXj{Q9u+cyWx$ZI4lV{Wz87HAKkI4hj?BK$ph zOSS~$WxbI+sQZ4;!t6pClAm?99Cc6rjPyY|rZr_=J0cm2QTE)LfQ+6+m{*&Pc@_8o z&$l&SS(@fwyQxK6^4M~=Zo5CW74dbf$7b8Q(D2SybxpDw_XK!e!n`5vTjIK-=goHo zo@e7e2je=Do62|TUGY9I%_ZaaXZ>s1o;6~=mFE1YpQXB@xxW{Xelh0z_#N8a`h)ve zCaOn%pEecmBajZbZc2VAWGKh{VA(G)ABcHDuJgdYr9gdAdvg{AWFVhU`I9UyiVPv| z@vg>ur%eM}9Tj2^h!eb`o>15R?@Lo(PWOwk7c?4J55{&5Tra`< z)AZi7qX_RuG=XROu-1WxHPc_yTr|&z&Vx*?icB;g8jbl-@jk1wAzG2iQHgrTxJ#>X znePx|U(G>br>~mts5_=$&nNim=nGiCtWUBdW6$>d2_!el=I;+d>$nek+ac!koc*M& zYuuiX{Uq^@J&*x@%n2E24lvxAEtFT+Bir*4v&5S+gFdW0k8L;o70tz5yZ5;HepNWS z+{XnS?IU8kYxjyWM;*eP%rlVRg)u68txJzS@dnn;(z0O($ak?l^!-(=qnYn*&{}5- z=4)tePtBLwfOw}tym#J-IFj>rU~l=NapJvD(s!Qaols5JqM7d6z5TzZjk8e${R6J) zym^*EJxizS=|Eew#xloISKKCXc4QiU0LOgK*nx7>zAUy|D-FgvIHOgxk7NCurS-aYq8u;TiA-ca`S*7wG@0+5e4!{|%faufBW7`pJ<#g6b&wx$XIHB0cqy z2qOLG^x(HFLeA>>0_D9IW9uQHr?o?@ZDlRO`Xuow`IXQy^`r00bHA**9*6gpsm!&# zc)tW^ywt0Tfpy>P`YC9y6knQgC+z+W4ev_DxsEM{@5UTXd3l_6 ztPE!dQXE=LYmBfVnlmLk@}PdnPDwZQu*+hLUWBemCt~~@ayAQO=XIWOmoR3N=dm3B zEHGv(`m8U*i~6Lsvhqh@F&c z@dekfs!r88_ulTFZgAi4`M&2%KgqpSb?VfqQ>RXyI_KW*fxKa65&bTF($*gE{Sls@ z7n0?B+{Onn`FA!xv<3DD`+z$B{F`_6;@@j1BoBIBg!wBmY76vPba8(V@m1rsg>ZgOaT=cQ9)Pt z8S1@7EW>`{_*@Knerbj^`%d7&JWyoFcVduFbYIE-h&J{8vl%CRXUM+4fU^vp59|iG zQ2n1jZ|aN9VjTNX2l`Db(DTT2`;VW<*r<2h@%u2vz9&U~@Gqv#LOFLQ_=f%52KT%0 z3(xdU@RqGUb%)WX`A&l1f0o+AImJa!oVPEHi;8w2|W&#`)g@LpgL zp05r2;dvO~=fSgv9XIx_Vz+l?#sV>A!lT2j0t8zZHc(j(=B4=>_M3Fg9Df zr!M=}J32q`Qwx6M5B&t!8P4-@Ep^)-V@dp3Z8w_7XtQRpT_N6|e^+?bS^X>Uw}|jN z9j{q|M&vL&}=CPtPF$0kNIV>>e0Xd;%2E&1g`554f%J-_(S zS6=+;2VVTz`+xDVPb_I|ZiRm>%}e;Ns4hvTwob$*b}Z3 zON}Nc!pZI9sflF5y7H>9{0&z6o1nwV_(*gj8P7~4EOiTSog5rYPSBqW9gj_9lUy7f zPR0^Iw^vUj;}bi^b5W>bEx)q3WN0-xMyx2^8q0)p@b_c0gPDoZ@c2Y#TPl%EpvKHZ z^0vkjVb&;{o0yE}CMS}`nUf$ZDfO3yGn2XT$y|6mwj-U1C9GcRU^t!`%O%Hh;RUx( zLTj0DIyNzsTofLSZBLC(jw0DwNu4+CfLM_VDzZLfnVhN%MVZN=VQmxnOR(FwZ@03; znaOk_JeJ%B<{yrYk0-~hcxDvT0zsp(xV6=#GyKuFbaE_wCF-##oEnR#Cljf$Asoi7 zJ95cvI5P+xN+3-)7*CB4Cnut0T5HY5@MIQ*H>IGP6JxRTLPH{ZkEU|a_(BVXn z2&1p5TG-PS-7C7v)~mUsTCvI8aFoZ?iVcENV#{UWTx`g?Arp@D-f)evw#^0D)Dtk0 zsj+0)O5xCIYk@&xV+k5=O%n@FX3@6dmAPTCJPykBD^^_u!;{R#7Ncpb9w3C{v2=Vg z9Yd3a@h=d=JOXc*y6Dm1;5-+|!AttCed6%AH=*ha!^?51rc?1$E}GgFMTfwGg<;Fa zhFoAjTOkj<)xY8z8cnx@&`5BjZb{(&P2towkVY-xe25#-7l&IwtETY9q*oXkT4;?X zv)R~CGE5c&b(3-NX(<5_;Y0>}7N^Q+EEhL(g#OGlP7p_j7A#OIaBt7QGTdzXkc(m^ zw7K2LVDrHwNQS8blge5N@nVwHf_Y*OQWz7rrZPY_Z8Z$< z_}9G05(P*Q%+u)%lvBSgB_6s6L3Ruxhz>bhA&6$i(mQAl-IfH?a22(b45lZu!yIgJ zcpSL+0{GHUZkX%?#+u9-3rXKd$wByw;4oQB=%D5?X#(sy_j<-12370>%~aRgH<(Th z4d*`35?9RdZM0(F zHW3>qb%r2tOe9BRFvw#=QO+fzFvT%E;M}+Ra;bD0G~y*Ewhb1C*w%CsLQ*(BIWd6^ zYi7Gg(nN_WHF1cQmDm*dj)P+e`NRZ=k~{{o55{ax9&Dx>&T2Y%_%`tGgl(|d`=H@u zY8&|R;3TD4c@1Fhk;Py!7Egx9CZQ`6*zG2YjOfr>g82I2L}nC{q->5S6O53uHcazd zc^I>~*hDUx8Duvis+E|?jF02!fOQsU1{dpQxjytYPmo@N&^@d{7*6O4PetfeVGp;Q zelPrLna6c2J2^fMHdmo;0FZm&tqn>*t+6Dum{J2r!c6}sVT?FGSuu`z z6>)W8Y6lUBg1Do3%SK8=>Ylz5+?;y|AP$s`LxxWWvpAVMtkUvu7Fu>JzA8BC*@b`S z+06a|bwMs|!NLW~><)*%BaVoW zyRq)FwwIM-T*LGFP zO@?9bgv!GS1g0D?YZmZ^+?pJR8KN`qFhu1^z<>cWcgPGNm5f6IKav^`+pYRP3UW~Da0VtM&2V;d zl@K^;Sd(KTW0~8=U|?wyQ*r^Ja5Q!c#0p8pAWf!y-m)-8e@xPJ;6>gP40k!akeK2U zPFp%@kdqWUZMuXov1~!Yoe*Nc$BfOrh641FE3}V8V?-GlxK>1A! zXFHy1;I?3yy~m4Cj+(&W4c4m67_Pb#A|0bFoEyM78%Dp0aKYS`<1X#Xtkt|FVONJWLd8sQ6=i-pnFU{wy@(tx$-d4ZP5QbZ zi$k7H=8~3$Gh|0H7nZ4@jHkVQg)ugo*Gy8DMJF4>v2AclkhiC`y6LQ&2gq!7)w!;W z7JI777df1*HcjC~$fj|Dphe9#;usN)`SgJ1MVRu`&`x7!T^7PD@8$J_03Gff*#RBX z!9E{P6-|bx5*Ny{$HpMKT8UIP9-E*edfP68mxm^aW;QO_)wx+HW2Mu^%ozF*t+Jf) z${KFrvOO9b!+j%`t9%x6=|mV#sO`GATY;0)g%bRnkx@zF8Lw9#in6r2$q5Dx<|Wo@ z+7oEYvYz>z67g}XloyR1ZK5}r=w|mBB>x`{abjrdfNEREYi$f`JOdjPJke3ZPnBr+ zVUEH92L@a^4#tB5n0??`nUNH5!y1YEoa`b1$1cjjjtm~O*=o}cK9$?ya6GjGqJ$ip z8-@c~CCfM`S3`I8idUWiNw4EPNQkB? zF=AclaMS`E4aEmiXk|ILb9O=1cT{C#lvA6m<;*i_M5QfsUHelSu?QYQs*oqoBAWO? z9-LXg=}UrT@^PV)7s{yJ@a@To%wmq_635l~2naChXC@~wR>3v`o`OMC#+6bZgMe>o z@9fI-g<&NHkAo&)IY4I-xdl!)F>FY&(gGXB9l9{9!~p^_*gS#z_rm*CJR*gZ9Zxd( z{6Wr1Eg5(9q!b=VLnx>D0*8j`xCS#1Ifypg=4k=C13Z$&5B#lb`VeBfbTI6(A_A_} zq=bO|O!8a5^F*cu+oBmG4C!03=HPD<(#K=17f{;pSaAWR0c>u4f#%lhb{Ht#Ttu1^ zRiU|ZrHEQ!BLR1LRArE|kHP(hRIcE5W&~>p2rpXD$73b)1w($~{1odqyyih4kJT%n z(KwMWIN=nV?=I5seaz^yW?NH&9AqNcN5B^}X;8qEOoBHscYfg=Q-Z#3mncY;wnC(q zL3q20KG2AO?V2#VoprIiPs~`*mCKG=rOcitPp5R?Vhr#cI;`hXyozft(o*8mpxoUJyQTQ8+3&w|N(6;jkfMqVxw~a; z&eLc>1R0G6q_*7MQXXU}2Xwzm4lcZmOP_jvlVE|y#))g zs4m0v;0u%Zfk+_Wk)R?W+tUocWTW}n9Ps)seISMjxRXg<>%K;T4{NrPu_nKh%>_Ey zT%eQ9Q~8~2o{}CN*4j5u2`s(zSVPju6E-%1rQ^UB=8o*s9U2nwkS3L!{_Z|fawsDi z>`W&99PLP0x^FA>F2#Swt$$ukmhij``4_=zaUxFJGyM#O1|Qw(~Dy@rT_ z95X~u$%Rld)h4~H3`!0vVb)^}x_b*G>8qKPgUUSS>W;WCaM3Bg!&n+-1-Yxd#0)R% zDmRs?QqMh+9(k>fDe01|m`HOEE7GK&GJr_y=K+v`Kw2psB&`q~Apex+n%IlLgaXQ< z?6F4N3INI7K9EW^FWub9rtn(LQv&bR16^{8Jj<-2Iz*GE=XfDmuH)K$O#+M6Jl24O zzwI_Qfp;+t*radb+(2sQ$-h$vf%}>S-orFtbH@rGm9ol7?#?M~frx<8L-5E`+(EPc zLbhTueqZTyB+JdLpDsRY^1JZXJPl_^0+W@;VQg z-@5OFRdQxZtw*>vP7Q&NXy*H-0?@~6!Dfr$T1{)85?HcYueEea;AYKt z>6E~ons(Wgz|yO7qRm>a|2*G))_Xgr1QCDsS=q{x*4e@m#I3#7l~XUUKZ_G1?Gg53 z6BDnT68Dtl2l+}3>>-x@oSrkuQdN$-)bUs;Y594cAV4Z5wX}ulqVo%E#FU)DBIclOxum6}inQjj zN>-6H&$Lo9!RX90NxIY!_H&g1-IuaANSj$UY>)($bOm-pL0)AJXuV1&W6AxVpJFQ!qa zZoW^zBbqcU8Z~lQg2hrcvL_5_KF^s>J$Hr=GT5%WGTg&UWTWoNaDG>Y^Se@VHn6(3 zt!DosrkSp!^1G6ft~{ct;zE zj4RzNeaLD1-z?x^O&SsKq$b^*KT0>tD4Dr4B6H`c_Q4T9`=A&KQh70p3?PssRyOMC zbhFGXu|^qtfGUnZVz@F^6nPHOqZ8zk`!ivEU0ZrY%qp${x{3{rr;p^@a73&kCV`4# z74Z`wxxJ(eQ@p_a3A2*wlu0@$pg0RSn>8hBZPq#VEdoBoB;pfil)Kw0UuG>t zIOaz?ISmnOAWg!UxD?XFhs1%9CVGjvkS0mJ*b8Z5FmVK=iH>r2>-q}oD*GcJd|7`= zkoh_gytk*MBstMM?y$W$gvCLP&wUxI)uApTpcn`SN$it0T+$7>ySpQe%j8$hiGzwV ziYjJ5;ZRL5_~{?|fF5fZ+^k6v0ZkORMWVn#!}Sn@GN_P0$hgXW4oC-hosv)qEea^J zg4`}YG~6OlLPoqS_ms_z*a$Y%VxY7ReI@tUQl*EhV1_AhMAKTP`WYV9qD!V-Pc!RD zzWXfL1fF8V&!gqD?kjydBa)<2IeRR39XP%bZ+-9VT!7tGyw>uPGfe8(G9uAP z?rzPVWvj`oLIcRO68}e-bEgKBw77Zk~%O#_!*S71cHrZAF`A{NRpLALJp9`!{qMvwCA~H5e)t95XrK^Lz=**wN3f0 zmF%yyV%x5WVsdvYxQKh6<~t4TUPd0@(<(n1FVU>yPLdA`B6u!%t#^f&O_Y`zw} zUO>N2yAqPlSh}r*wAE!uyBIuXNTRpg-4>Egh{ge{_V4d1{a`_=HF7GUeD8o@TJfY? zam6UQi^7U3m@L_l)Jje%M^=hause9>0weqaCVd+D4&x)B9Bl#DDK1^BCtgwvBX_rf z1q(3kPWspoK63baFqh3PVkh{CBmw2efBxP&__OTHj)24c> zfO4wkvEUbyoga6@!YU@EG(?d4^6e|FnA3}hfYSLgW|36sVsWI6Aj3>7!#2}sbAp}w z4QL}fZsoNHS$MM+G$de7CJwzfA(%`jcocAu8RVf2kVI9vy9ek&E;ztrfYMwU#-7IlrRtlLB0Z77W{d9$ zUggTrMQRT_##1mES8~q7%yNY9(BMIy%aQ}*=GU(j^Ya}@GPmaGITn$8V~-|{2xwA_ zh=7*v&qzCi9hwvoPIVpervwqx0VuI#rc+;h(Z##bEjuYP&v|pO}~KqbcU85=BRUs?;a~H z!z|$eNad=qmIbRNPcYNmh%~obH#Z{SgPJrT8Z_&`RPync7{Rm^m$nXR!Eq66x)v|h zwR-MSleSr;RFy@{D(`-jnN_>1!J1I2rA}8%WxOe|pRHlcy-7e>fk29Y#&#t~KzdtX z1Z0R|X?PPOAcFUDXYt%gVAI$p8SWf+5ZMGa3T$#KfNZ7AyqQ~0@V$&BPO6Bau*r8T z2qaNvk#_Ww`(Qc8Ha#B@!KRmb1{uKvr8;?-J15ehlagde7zL7SPRz1Uat57b!9gCF zGFE$GH3ya@6NGsz-KPGV&{d=)w62>(N<=S&CC8|rYyWvt_OKM0u{G9qYfkNX3!1~{ z)`sVwU(#!bd3D*Xm#vaU6xRLaS2@6}vT%Wqh`Wg8%9t)9MP5jO5F}D$TU0azdeT&qcOhV;#y>q)^PU1hz1 zMoLLtI=S{RCqQLAhe)%Tw(}h}Yod+Z-P(3>K}2V!Lt7Y>NLa>hSQb)|!Yi^!x`St0 znG5w6*2$bKY}(1BU3`bw&XB&jd$xs3#`z9maVLXDO34}9%*N={_K656orQxB>F6%Q zwU@!i3@ONgx=}B4Nl7B*AP;288=*3oK-%e7itpt+IHrIHH7UuR(>J$4j3dRVD zd=(OG|Wuy_!JZ$Y|_;g1YaQ8?0 zA;SzlnQz-S<6t6q9_xbJ6@g7-o7{~dn~Y?H{R?RVZ_z$iIyA81Ue*STm$Jr5W)($Y zH53Ksn}*%`m9b{N#DY!F^(-vSWlqVW_(toCevJ%( zV+;7KCdCDm!_e}MlE@SnOhZmh(wT!e?SbMk%&OL!8IO2Ez1Rl_Qty2Pv-uP7n z(ONtJFSSB5KtAK~OtPERDBc-c+DKefrb(NB{TpI4sRrI?L`^_9W$e;w$a(cv7 z5?aazkzzI_C7(o#TC$(vr>!h=JEy{mD%eh)D@O!8s7VO{5AkB7>I(KOQ)$C1NyY09 zRlnSJ=y{Ahk^tf(AJ2v6n%3K)?-|;~rq~PxBq#$Pn4%x{n)j49dwZa6QJP6NXFoi~)BCPcr=# zzL(*8Qsre`MdAt*@_(;KURj^7dsK33_!0{{rCTX^8Y0~mlhY&>q^W%SOE(&I(>fiK z6&uVX;Bn?EFCD9A?&r1alJ2mNS!KDvbyVP|xr}~EfMLlDaP=2hlq_fUcem%acAcD= z*CJ4N2B)NbX$PqLgL$n2^>DD{i8ZUQpL;<_6C3w)nX<89TbK%r0*WyeqhLA1DByM` zl{ac#%-y2}4KSo{?ujKzrpvD)t%%yNS>468_m?kaEwhS-5Sm5G9xbKhzE5-zJC(6< zX5od#@4#8A5T?x&3?|_3%i^bufTI{KtDOPc@00D+q{JZx#T8*;6L2TD39o=Ya;GQ& ze}k7kMC7{q<{nLP#GTB+S%L6#SX0yo8IyDde_`ycEa*ul!?~vf`yhub z=9FFLe12TWWI@g2@<9Rj@b`?E^I1lB)+oK1ylA#U_wt>|htE*t{bxG3pJ4QelPsuT zkMv-e!7jeD+#W_ZJIOLEC!A!9M`^xxmqDeDxw^*+T#7znV^J|~mtGhL#kgWsu)CN` z>;xn+RhVr9Br(&@IjR{TNvEa9K$32V{y>s0Y<}Zi>C|0`zrdjBN<6nAa?*7<|rdR0KF82kLg3nxTxD+A#o&LN^qJ5pX57f zBZ#yH#5<>?JwLZcoPq=m@y;nh9x+5q{|bb>=uI-+3X{xoRTk~wajocPY%$~(UB*LQ z*@2qP+<<`60RF1Y9(D?80cq|Thcx$uLz+x2i9AS?86`6YX{Bu7_bZO&e8*?K9N$cw zyGg+3Oz0~mSUTFnf^ioha75Eurv%=oX>EGkyLjBOuE4uBt#wM^eVSJKcPOPDc`L+k zy&HBAB0)S&QDtCc8YpV1o*&_!NDGjjilCQx#LLK7#RDaUf{E%*oq!~o$(RAj9aVtj zjwwKrh%%s8E}i{~YXMiOu8NZKRXvqt3icAeK*Gt@D~z6UlI6AUpnlUVBB1HJP8&N7 z*IEYq4N1VGnlvcjE1IOgcNPq){=putiotqA60k>;1_d0O?U&@#?L1q;NAXd8@FC%>W^Q4UAODXvp)k|!Q?OOdod9&(>A&Foa zVQ>NE6Xxn(!bPA+E2GLzZqQUIIkm-vGKtF={&AjSGUcF(IDNBr`jQR1rNADzbIL7; zh{i+;avLg_r_YdEP8r@HlYNhl-8$+v@#Ke&%KVop52Q3tcxkf?3%c8)Zc2=o)`;kC zkBIIT%d%2_oAC1!`E3F*zfBK+|iBLd1Vbb?nu&86}S1Q4f732x^> zDlk|BCYODgLCcI^DZ#ls!JEWJ9a`|Fe8HPa3BH2`@7C^hlSnzG1>aOkis-ObS1H-> zK4v}4cl?_D5r&WR-DkbM^mlHzv!Czgdl`PdlfyxQw53O%X6UpiYl0>PAju0?{8GYsaOSD%T!_&q@Ri4`T}m( zq(K2sIRpwOHX?zg9LU{eFs!@3K$6Z%x8B@{EaF{+n3rD+6X9KKNhXWcN>l{_HzFc>kUH{RAzep^G*mh=ynBzND+Sf%p&HIm=fNPb%* z`E8ZVY^1Gzy&FskC_{={Pj~xBb1Q%}w+7{GTSWzF&*q!rJ~rPprj5HB1FknZjG$k* zK;Oaz`WALKhjmM}cZkjUv^MXEfN~B8VjAUC;2{o}NGn&g$bsIw#gt)?hgh*^wSofz zieONt)-4%nr4*C{hErN}NpGy3rG)O{JA^ymlpuSV2pc9}%e*N;Emj10y;FizF%fvZ zz$@q-hSxJC$Zo^y0bW5*8D48j5WjhLVWAF;9^^aeTgoo&+>adJVU!Lt__84_;^xzQ z2d+a5o;0LVZFS_eHS$PaTO-YRZH+vX*H+2F8|DWUC-ei0lGAZNv-Z@hj+Alc{vcO* zLbtL(K$*zp%%0jh)#84>!-n)AgAuLFKq>RS!b;@$8CDs=-Qrf(>Q+VsG!5S*;M0cd zB?c|sR>={OwsvuwXc&P_$72F6;ueribb4JY5G!R2Y0W4&RH{lND<&GiGvxeHD4G5C zvyMjBk^`6EDq_?!-YfF6-K(_y2L#;ABrsf4sV<9k>UACX1zm=_Y_w8x9^}l*q%|o? zYjQfRNtKe~XV##uG9X}wCT+?Wyh++H%W+E9$DO=%mGL9Whq;ZXbz1{R89d2%*!Mnm zr-;6TMH5kweY(Ap!#=kj>tH@=I(hYU$7%H4gUAp++! zgW5p|wuq@^?31N|u&E+oyC%g2>|&C7A!Q3=P3FNbQ}oTPw-od+0B=cbVK8S%0vf?d zF4VWuf_t|x^Elt(kFW^%f+i&x(l@u@dM*)-m8G{ZRRk%jU`Fqf;-y`g`Y>by9^$ex z5;3VFYB`lOg8nRZ${%G>r-OT-)Df&x_bVdcuqGu0+^b2Eml^bH4I)g@H}|M5V%7t? zO38F$9t)e#cYK3QRNiN!={6Z~H|>@KBkC6O2IeInrC{U`u$CKElTa}6Q(zRZ(ZN_s zZz(^*00C=&;QPK4*qL4JNwMjR5s%e7$rH@1x6gn-R@a<0#BtL#wKtlQGRDlZMdS9b(7 zZT052RdRI^vy1nrfF_uXBODGLU}X+#r6K}8qDkqa3?A2{h=9*)QrfM$YE-mOYvZLm zIByux`9owggWC=1X$IvbBbaRopK2}5cOX5@;4woIP~O0YZdUnK#d^L&MFHgpgMh1x zOSfpQw1C5!6cI3|Noo1={Q*M~@M%qo9Aoe$LlUr7yKK6V!FElG3^SNBBms@D%M9c3 z$bVg2Vx0^VbXfW>9S4%G&VYMD%XhpN>47R)MZPDoM-NfFR4Y>6!2pbxfcrHmE}kmB zSjL23%e9S^A(3)I3of~n+ny(7P^6goQ1Wr;o;)df?meq@i7=#Z?g5d44pT)yX#ni< zAeZjbv#{(jn6Cw|7jUm84dx3j*>A3FHEJon0ve6=x5A9Z38^S|w<)CGVlxgv%)W*1 z;7bDT)TE?ogmOXpL=&*4W@Q4Fw>t=3OaQx70n=J=Vw}PKhV&qVX8kESp%-zL zVJ&5&NI76g4C$L&V~JWumq7tVn(bSthqYiG(~oG9-eEkaN!o_5Yto>A#;g$mP4Dxj zx@Wd$K}}u2S5rIp?3&r04R9vp^?TOTRaP#myrL5RkYl@BJQu+^Q(b@<>(2m2#Lu8Mumd2aK{p5$=IRzI zvB5?g3an@9dQf&&9W=8Xq@7*oA!7i;Jk1}dtgNoAA|dCHVo-YSC1A`sGddd|Sb1g( zXnbD4^3Fvde9v7TPfOiw@b~lYy~|^H8}DBU^Wp*|e_&NByl(-6?kNLpb?h^{o~nmRRXtC$4iD5S2xfRXIx;YKA_+j*4WYgm&? zv~!OsSEXxghOIaF0h>BBy>)Un6*b6a3d)%6WH%;Z#L^o>htURvw!gz!OuDhSQMv?sXG#hU@D-*c5p z+Ue?{tCy}mx~lIF1PGo%*O_!xFQ$i7Q#1WamN!ae>L--Sl4S)*316FPvuI6AHQ?X= zMjNmzOK=5UE9t7fjJv|1zj(qYZF};()BHL zy_l|x=(?D$m(X`wtLWNA*KWG5rt39y?V;-$x?W4y>*%_cuGiD`2D+|eZ<}#}^3DH&krvl^ ziW>MI5J+;WEbq?%@CVfI9Nwv3k)^9g&A5P{Cr)FDi9_=Khn?1%85~z3#+rEv0W*Vi z3wnaLaY68%nkTq7^kJY@e3FZN4|yR}TGnxo?^QpAr|KZ&KBxRDR$;fujal5jbX$m4V|1Srs^;5FC>3z)3=qXvEclmkn}F;1s>Ucn)@MZNTynMts)? zf(p9_YpoB|+OXb0qm6SzAgnMN@*4w9Hf&R1k;2}AQf>}3a~bwH5$LdC$v~$K8w~W= zu#rH-hNS}oHf%Jog)!`ECNQip>cetZ zVGjkK^;n@fFtcjr!lmLuxZub4w`%t7_4xkiqcOxO>kIJgBV>l(V@hCgH%QR0>d-*c z`qlI$WVSy*Y=q45&oD^6f2Khicw!UVnf{O|ndh%C$a(%sgIvJ#pXw~|SDTV1e~m#d z_RliNCH`82wD@Nmq}@M6+me4*7?I!LSr8BtGCT5&TQ~6 zq7p(j`I`yZiK4goI|%s@B60r!AvBj0{w;)j8%u`#!=_}|KTgOmuw=x)osf$#gpK-l z8n!Y2ZbDXL$%KEeDarcx6OzG_?fwI%WQYHdsq+s1VN-Ia|1m;7fOU5Hj}Y<%BJcJe zHEj3zj}dYLOWx-{PDl;BDdxN1f5Nc6-+z*j#aQxy|7AipBJxqc3KL|5DZizh^&?pH zX@5{*ClNd3uT>aceV_3+Dr^b7o#gwhKdi7lXrd?lO$xgOB~>}h|84SU8P zQ5c2EANYqAMpNvE{&8E`PyE|$W&i5msjzRO%wPL=d#oUiHGYEcnT6A(b_b{uv_NyX z&76gb5y@|b?gzLAJt*{1facU;*Xt0k!+CEYEA%*W9)SyRfEZ8cS%B+_RaHWM)Yb}N zo1tGji*YToLKYaiLamjc?B~4n{>=g3_igk1|MDS|Wjza5-#__+gpiLP_thHYM?N(# z$UZ;zHB!m1u+BgG!i4-6BG3Ce2|*M2PWZ+Np}F)c-*!UC+%Nfd5<=4c-M8DY{fBR_ zV#DC}Ti-r|yz1L;1%F65^z7o`zcLuSnJg3t8rz3012V+YqFIR6R5q#xO? zoxqa?>ylYO?+$wmvbsYdB(*1^kb9AB&9JTHy6rY(?Oq#l{UL=M!#Xz{u_2KY3Zc&S z!Zr~#Af(T4L;8aXL4U5;Sfvn>Hc+b&bhV0`niWEdZthSBzJgkDb3`F?5qVp`LeO0+ zq5}%K083(9yjJkz{Mu~QFN1%}VCBbPHw*_ul^-Q@p@Nlvt%e3YrSfmo(4Y%dPSsk$ z7e&NxgD;DSr$|I+<>Mp*8>#%75<&3S8;QOUOjP+~Gr`!W$|D_C2xSB>hZ6i${YmLk z^}n?)Rj(^Ss8`kN>eVs@vtCI5W0m3mW33IYw}KyJ+1_VKcCGg)l|Kq(?{}4KG?w>! zL74wQtT_Ug;P<4~H|cwp!GC7F>i5B4Fj)C02@F?0OaiH=UsM8Tg25{vX|zJf8+?oE zoaI>)+{U1HID~T}gfHaU;>&VCtI-ibKjXDyC>4 z(O4B9Qv*rx$CcL+{7L0?1b?c^3jI6CsQ3d5@;#!0ePi{g3idb-)fo=mmLvC~)}} zD}?ewXs}QQNjbO#f2f+U{JVqq0*;?q-=gLkXQ`f|#b!OFnnT~3^-VRLUk3JBPs3n5 zfpTz{M3wi3FhL0Y0}v~I!V-Pgdu^Vq=Y|#fJ#t~bfFEDd8w$dfv!Wg@M7YylO-(y= zZgeCo)P}5A3+uyPl2Th){W-M*z?8fCVGo7`%Od0p9$U#5J!)@2C69Q_-k|z1kJ%ek zKjATZgX$w5wKu@%QGL{-_6Dzk-&OzEqtX$yPxVhcDjm5PtY7_8kIFz^K;&nhFsXx) zy82%|O@y2UK2-g4PctFSh`iwGAmkQAe(C9?gun}fQvI@rGsEvfgsl#E5BR7IO;cUv zJ)|&FqS|{{VKixGdmpo5b>1Tiqp4Q!J*qIwQmfDK9#hx@kb+fT;XUp!E64*aiw|Z5-k73Qrz2j#$R=2B)q~E1nk)&M46*Dk6)g4}#4Ac=quk>zF zU*{+6DsMtzB&5?jtS}mbmELiMp+{7AdvglA54BnC-EPCK@$OU@N$K(KRv5Lg#=BQx zc&br-op-;&aK}`Az4w5^aF<-Y*?UM~e|;`s3GYJ+`**~WUVni4&;sWi)oJe*g}oE8 ztoNA0?nln;-b0w^S=O(xY=`&c469-$cm#fYUr^C7Se;hRib10~%Wh0a&I9Q=&hnb2 zaH&|qHD}!Jp`^Ka#x7M8=k1KUxhBrZ8SiE<{d=e~;~w@>lsV&Gk4l=4W668iWl6w$ zJ!UgG<9+PERC1q3Z6*oX%g&6$GUNT8MOILr2M3<4P$#`mu*4Jk6|^v?&b=uAiKw;U z?`ny|wa^Nk0eB4_z=h5Oh-={h(lTv@mIAe61zhk`y~Cqoj1Dhqr(#g5iQZ=gC%IDX zUs9+$Rht0?EclIn*Z|$CLLKhJY9~~vBRCr-9)fdf(I9wIEgA%G8#X+*?KJTA{RZA~ z*ub|RHSpU{Six#i2OeJD$GQJ(CGcLL&mJ*~%}$@99>gIG%pR>(s|X=uyz-zrvoi-& z2@cWh@yBdzw{p@=btX8QraIY(*Q)ps>)}6JIn^mYpR3@S;h(`yh5Y`R>{NsV*+B@Y z;4p@5_^Uh-ifL3*?b%NV+S^~_Ic$(wp2rBmiRqu?IYP)sQ9zyNC?SUtIm2_zAPt`5 zgy1UbpX)h6$TP^+=s8IUwR5KDWh*!aWc>KQOg-%Jt2~sn;yje#N7Rx^@Rwj`b^z)r z_xc=42w_3!OPYwS(H7YXVQ)j<$IEkYsreCHf-k@YKmLQ%YOVioXxPb^2h^xyeDQxw zB~1i>dq0YAaJ(Sxm--dR@wg}3W8^Bb!#_RhmHifW7D`TTk6C({YP z1n_fh_!7X+vB*3W6Pr0Aqphl2AR>qMf&7XC+^p}*Dlmnscc`_JD!rZ4G^%t5r)dCgS7tVDDFQ+++np|!-2)GZHvpx_BG-+c8z|^iwm{%J8z>N*XmciVM4wD zeXoAis}@y4e(&v|lCNWl$Jb*JuWt(>I5DaNyy34s2apQh@Doz$JFeDOWUKP=84U&T zunz*9*}TIZ?>l6B_z&qC}&po?eWMp$41Ydq>CC5Fg4j`O!665-H}<_Yxk zWJQw(ZsY`nO5VydmrCB|QHDc>12Ip;3jHlKU-JdHRD4}Dyqp)GK)uosmzcnrtYI@Y zJ&)5WbjH91tS)+YU;%4LB^TQkpFj&QK2*}q>Ry4;F7q_OX%_SxKY?SRP9WBF!=++9 zT!BT&R9kAj-PQk@je6O zGpSNX{+z3d2H5{}}m7NMc2hSeoLn`wcNU4|^rjA&? z4}1Bn5$(pA{y9)su~0Y;*)|30%yEV%gy)a5@Ip;jS!`U(+5&PtqrdNf_iO;N{v<%f zl-Q`0u<)G_`rvObdPWg!NT9VZQe;FiaWZHU z-PoXmIE$M!^Dx$3NMhb6L^^D_*n1y6XldB7dkGY{^y>BAt&EdGy;{!qM11fI>sI*h zE)XH`){fBns)p{*Evi4^A2}-YQib(YL0CbJaCU)R>;`Ha%dPN-9VP3j zegx`ISMoVW9o0@Rc6SB4_N z`k3~=M*S&{AFaj-z2rN(2awi)@(t(IR5$%9j&UswDms@U$HOE-GoO><>8%@RkAf2JC3?iw5I6U0~hSLY~&iYfda zDsOd5(Rw|=^*NqBUfhY%NflS)tLhmLdGw`ZP`Dg}A6R0KPWqi5o%B0BdeD#iYdzEr zLw@w&%e?n@qOgW>|C~GR4m|2dhv%V#ayLFg&6)CyA192#Z}DT=Vephop1c07RNnl6 zt^sQa>h&&v6*vrPXASZb*m?F6v=Hr z<-&%a_(RmtNg#Aoy#iN4Eie)RRRFYlMjGMP5u6WKa`k2atmZ56%AfggZ}_D@)Y1#Y zR!{P6aBH~*F2ui$IH@1pFmRs{KwG;ywf<$5g{J$OfYrOJBY!2v za+GLI7Y%!D4R7>Z30ak|_TNI-dONlUQ{ELm?G=Fcx0;vc+Vsq?C}t~sjiXyPQimjU zK(+fx6KEY2QF7gB24*kXTsy^F`G%$r{e3ld2%_wJ9PMtTHDH7HUXZ1X+KcVph%KT~ zvH6H^*9pj2+|7$^N&HRacCVOtw~c<(F!|@ z*Ryxr16u#AKt;Cask|b0iWMnrc!!_9vl0ypJ+EjX7o`gfAF0?!h82BaK8BkeT%-w( zA{IH5#e%dl9PB@o;ij`O`0UHtyh>yNwcKN=UF}t>3q5uztRxjA7N5gv?ALQDBJ1zjSa%VBTBSl{jDx4^T$vxrz~d&|+Op z$ojcVT|f662*rxS31cdu=)H6C1lI~7MG1~qAH}qpu^n(sDh)EdApi zmi}>%k^Tt}o@OYC2R)c{Dfp9~45*}}e3kgE5N`b{_EC-iM_xm|vzx20SLc2I1;pxg zeBMV-&2HrLJ`YU#>H(j6Ar70Zej6YDVXvyA{0RyL2x%Oku zF@19FOtI7{mtMl}3!s3!y}rr=71u_8?arNWegw_!CvI5qooSZjUpyohQ$LhpS%Zp1Y4pew>rAse~BXQ)C^BU`$(Pjyf5OU3^G*r762`+#-Pwx zIjyW)erQHX-vdK^ow&eI#r2Eu$rO50p}soKbbYm-4`RCoHXnC$FTiVf_xCWds?7(C zsMD<@w7byG?=F_(;k&^zoj$KBs?l_LJc!Ior;GSI&Bzm^AnfJ}*qw8V%0DZoSdGrq zunw1N4<3R5jH{=m*1lCtTZJ@Lyb4cDIkl{y?0}QI3J)@=b)(8dT%EuPr#?ZFuF|_- z1`XG*sKBi0cfgqiAKUfM#5!h8?w^U(?6_+on(4$hQhgI~Z=`b9A;CZ#4g z;U~fZ;%ST8#X2UEx0WCFbeqRQDtcP^6qh*Fem~7yhfrVbzFMVAUW~zb)K8JfRpWzF z!>O{0NBK0GH}`Un3+koq^1;Gf#UxMjfJ{9xV!_&SuGSq)zS=JoZha%IPqIYty7n=$ zLEf>8i|gwovCTO?D#l~mPC8Kvj)Jz&w+d^h%m3H3<@%AO{kh_`6b6**$(mAV3^({{ zU-!{ae#FZT<79Ig^AK@C(4Us;*RxqxtfU$)`Tr?3-Ag07Z83)-{r{1S1UsLV*z4+W zfVM`PQGw7WA*kss%^fp!_hLtPNdtrv&(h(DfRgLto2LfqzyA zB6sa;VVd}sjqO;`)fjHliI(QPXCYe-ZBlG7pnU|&_G)) zt*9_8^LhB@0fC0^A^}+H3; zNe|28f2-*VQ&YVV;EW17fZa8xU~JLl-y$)2QAL+ORk++0JD!?tg)6(McXW|}G2hm0 zptRxk>(W~32<6oowU=w=|xJV=hfe(2fr#k2L#WP`K;Shuc!^4dd#b7F>LVG z<2f0p_NVAIH0Jt49i1BMmFi{l(oc(PrD}1lRBcplVt0FxPKIRG^N$xx z(@>)Jx#NYou-xWBIrN|mF5Ru32rk&Ip7pp~H_LJj<@Dxk11#H6rfj4g5H~BH(Y@ER z1AZ6)T3S9Sz{3FWU_VZS#Do2~ZHM-?Ai9KF+P@ye?;cod;lI`JPqq!?KcQoxFstFm zxcV#bIC3cPC%D`z@JEJ$K&u7`O6Hdk*h|;4j(eU#!PtX=SUxAL#jnk`(yg9(v@m5{rF5 zuAy`4XTpFGrTU71q3FqjzfI~H#TpIouE0(#Mi@VUJ9oM7uE1vxX7b!a{04uItNh*y z?2IW_{H|>55f{^87ykJQ>}~UM8Zgp}-qUONN`*Sc?S=x1Y3l)Ko%wdF_D`O(rfx>W zx7{<9!g|ysyq6Hf`VHTxzy~<_62DVX-Gb6uNK)Xw;DsSo-DB$o<7o}>*_js15CwQ zKrm{v%ufe7mVY{k-{nv-`!hE9vjkf=$k0Cz07u;ep~XUNI1s{!+lVve&RT8fBu4QblWWz^HHz2HMa501ubVr# z&W_KSOHsTFi1G;o(9k#+^}HU)*Lo70u(WN2c^b~1t0G?x2o&3P0zlz*4*<*eBi~Z{ zL3Ei2zXtI3**s=%pN+b!G5gEesJB&vzv`skML1X747Jc71@tItd6I2RC3OoayK!Yu5GucYujz<+U?}@>y&9eqGo_OUxKeSNPkb# ziz~*PPEwzZH~pGUV3eGfLipnZrtIISZrgh!$~X;!6=zV-KLP}DmQMko-=&0MRn#vM zziS3SKK>tS16IT`YKqt%Q68-4{g~5&%;&3pH%(c|McDbr3?V;fV#9aJ+>sQG} zt+p)(4xcB3nICL9oOzz7mohw0ALVx{Jb&N5zx=-1U#fSG96{;@IxOwDV!CcxGf_}}ouN_>>G5y&((whAyN!0iB- z1~*sMN`r0hh7$ZV++0~p6Ko$5n)4ncy;_<7AgTFdTpJ~HqLivC)a37oT+Cy>J$IVP z1s?T%DldK<_M;N@A84Fj{`;uBxX1pIkU0Ba3pX=9~C&> z<2}W;GV9Sv7$)}8bE}Mpo=fi%8dnQf;fkpP>@KKf3KvzO9~yjd6|RiUvcy9fIby?Q zRiPGK<~uB0<7sKX))U8N-u0A-;-h1oxAYMM?(RI9o3a!x;&3xX+o=e@<3g@m;-`49btbBnCW&H5F&pL$s8Wm*4l#0+FFxktgA(vso-)0F|Eg1 z4YOzSV!5R@1Gr*{+2DAsIUd+ri?-wncTs_0zpCvYkm@IGRTRusULz)Kw+3@u6%Wsx zZBzM7N{qPVR(r{<_L4_u+3Gwxi(;LU_N2Y!Nh(o&`X&`9_#3l~F`k-*eNx6atCki0 z#Vj<2^zDDoLKBF-pQ9}*M|Op%SpE=2K-I$E5fk@gkG&szY^mP|XB*qTkJ3O@`~KNx zEcV)X?wgHfQ@S3R&C)${Y_{;sF+=X3gNF`EqK}wVjq1njtJY)oRqI=JO}|B&s=j@D z_FV8XCF?sXVGYd#N)0xlEdLb!EFIhBsT$Nn)%|7-zHO-LK0{1)m@WQ%4dz&kEK%l{ ztGI~7R%Z`j{we#-Vr^f#-_+r$8CTRm-~1FY%K(5uqQp3gYw z_ztns=VNCk^rXw zSnh{dX_#gM=15oYaZ$rx)y|c4r8%VET7e(8!@`f$E@<`M*VF*?mJ8r=ttWK}^0a;X zt#E};!=tt86z(}7klrT%AiZA_;1mGO_Wf}aR(wmX?2n1twL`wL*6fg5^vX$`YV9-& z6y}`E&x5{E>BRzE27pQJep5Toq;`?OW>Vg2_-*aHWeT*c-Ch>ag*DF;me*_5uB!)zDfojNm0U>f0$yW0_>4uC&< z8Lj5;*+jvr0bi7yvyjH*I2N?M$i)rw=cp35zv@L}T$sMa!)>;V!Qs4#wZW3Tn zfC&NKA;7%=w0sCI)cVH-_&Wi<3V`w7-GC6|MMwrM&KFH@pQALr1PG+XG60BmwE(>U zkZ&xH3PcQPz?RsL@X6fGv(9mx>(@hb4NGS=kZ^UbZ?$1Ai=T!SvsB0^E32IkHK=8k z)!N4Bi8&aTXpHh6X2Z_x#dC3I)jI7d3b1|dJYsX7GUy|N&lfItZH@j5jx6XahR(AJ z7uN?aU@rIRh-0(#BjSS7kxx?MK{hLLTqO&hJJ%rKw%=tXX8~DZfY3=_XWoi2lWpR}!t30j`a-W^w)Sb2~pSiFchkN)! zw_n@s2=@EiQVidacD7!w91*W_c5gp&ldmWDd-p)OX~uH>kO)sK`s!-&9@>WZXQDxI zZs^F*=c7H~9Hx+-)7Jbx)r4clX(#1T`XvUKl!bqyrv#XbP(Q+ga?N&Zubb2ylIkqD|g;t&8hh9FyL_g7EF>hpXUP`>Lu_VvV?4vX

<|Ja=+Z2o?3#MO6~n`jG7J2Jb^X2+a& zt9uDA=&=O{<2@q8IT&wBp+8XP@>bk}>&$D~+IkO*19~@P{L^Z(ll0A-XLNQSj%{=s z!aW>1{eP6AJLuY0z<9l$F0^0~7gcRJhepeNpzvy@%k@^FQ2iV6`>84cJ|fe8qyN6f zeel&dPK3>qzK6W}#Op;m^ff13FVf+#IpO*xm4_dvCt}J(lIj&w1LpI6f59$Pr2OMl zUT_#_GJRI+Uq4aKkQ5!Jog$}*9uJq$No<+#{Qt-~K^HF%D2Gg{lIeqZUglw4mP`|rYiadG{LxFD@5`XYdH{yARQ z@YU|VXnMzZ50%4{_I@1q>b5`~ef>w<3EvF#(Ehh!g!;Jwe#8(yfZ?HgpL06)dTX0# zCdzK#xc^}kG)h(Xx(vRTL>Ys=pUPbc1vvRWrK`vee}gnZkr?{bG@sTOe^bI39~Wa> zjUpR*HWU48kqt1q9S@@9MzDIYK!e2t_IkJaeOq&e;Sah*C=qqCI! z{(sKZ|1ZkYQeWVUWmdBsF=Fjbl#s56V=UEx z8Rkw%iHw(FFVdyKz6tQmqqiITjUIUd&K#zE5}Qacxu@&r$M;nCCDNx z)B|r}2Q3uOWAw-j|Yoay}wvPL1pST!@38GZN zDC4b7U~!(JI*5I35s$JvRN^s!T1lKr=$h}6n)&5LgW7RYw#Bj*iCdfmfP=-$u3+&p z#V<1reoJx3;J+h&gTF$!dCUK|_3(r$@~-Ql1(zS`KD?WUvG4YL>Uj4D>5dXv0USf(fGg%*y&06`64H z7>TpvDAIvD!pT>ue)Aq%7x!b6KWM=3p?(<1@Eb&*q+8-)xM7&Ez6L;k*gVjn9+c2m zLfuw{(EY?>@+R;c^_9*-A;Ilvvc+t!{w`ekd1OTG(K6nZ8MmCPR?xWoomSv5<*%R=pN*@%0& z8jKt@tB}?Mmm2)T9X0qC|LM5ixTW=y=1W?_P3iQu(Z%BvnOlIx_&9k({(Q5A+_?f7#mP?y;#mIF|O#$!i zTVXHmUUgmfraVHltH(*}a@GPN(G_d^?L0v018StN&rV$zS+RbDu~c8*+9+Bu(!1KJ zn7shtHZ8+m05y%>>;+&hyK!7ac1w1zibT62&bFD>2ltlCTYF6twgMQRA_Yq?EnEN! z6)srX+LB+eG6Gr_A{P|1G6Ex?&%J6x@5b)drAu2b*XFZz0s01i{7rn=Rsek~Qn2*W z`~qsEy}d(ATD2z9)7|Sdsn9m8UF+ss(cKq?s1WU5wX$H*<*mhvz(U1}P~fVStBMIM zQiKAF6p_HyE8$jDX359M-&_cEdnM)DHdv_gcNKje`K7k zOjAxxOjBNDcpdVm8%UI2pu7vFVS({MasjgwcUO0@8r@J-yjI&Z)!GWxTe)`KjjPx6 z^%Sb7%L=q-%2uzu)U1^pj7(|1wO916YDbqZIEiq8i_fnjMKrAWwal;;mTJn;Ij5;# zME;82;&WG(6`r?LhB6EIgqB&r zJS0M2e{c5+lRl|hwh2iDyNfFha&YuwZF!>Ge30>oW#2oli*)y{=wGw$24{b}x>xmX zikJ;m_YF=Qw=_MFnXQZVcEg6M&v0VNsxLacZ}Eav-M#&5RNPh&qS4*uP=K}P$zDtXa}|`ZdhG^CUsi5dy}G;CgiUN0wCaNG>UG`G8+%toHkbh8 zEL;a2E2Ps6-8aIZ_Vu9y^{;`wyVDUIc2~BM@qubL^jql+oY^=IHL|JOlhK?x=!nCq zi8To>+ksTLU)l~pJTo?EjmEY|M`O2SCZcfaqp;MNV5u>C8DhFDIhGjD;3UXR#KyAY znTebgo6HT5W)ev&mQH7Gi>8x9vG|VYL~<-Sl*y%HIXF_XViWQ9Xd;!3ZA~W=*63h5 z8pj&RvG~M}@mw@FoWv&MR&sj|T1dk2P1cHy9SmCL2Z zhAfunYAQD|ITnu&qqJ-?iw9cKTq-`2%w?@X&~R%kK4Qg_6FI1MYcw8FRHIa-Z zfNeCHnN*f)YXwUUXN86qaGI{ zk?v^J+8RrMX3*$pDrY5zM^SKeYbuvcj#=^4_%Iy7O{Q{5rPW|Gv31CzQ5+|5FggMK z9;fSIbSRmF4#bC(RyG%dfgp#Vv4M_&`f>z@{lalK;=u<-$0w9^tW*NVYz%JT2H6~V z!+0_|5k(VOncG0Q$-zM&PQ-4ra2oEQc(R~o{>mUX8z_G!vCnljf_~&>mH;e-}lH3uU%*KXb<^iX{#ZCnvVSa86`n_DCVkh>f8wB@Ty_W-eU-)5C$* zG^Md9L=~6-;3n~jw3Qo9WuuehFrAWW$}yZA%T4TnsJ1Nweuj~hIEd=#F6)twstO>I zih07fY9)k^+-NwK9Y#;Z9;$dJ-AcyCqeBy!$?+)67z~mTD{GBuDWl`5D6VF90f7Q(d=-9Lwx-~f-vq>k-s70QA?!hEu=pn8Sm z2v6ncwqs@*DUTk5$po$gg0|@%UE=7crSRvIfd( zoV12xV~Ol=Yy>-)orHK7Pp5FWvKGvws9w#-lDEn96Yrl$(y9+jS5#RDhcFuZzsdXi z_$sQaj~hN@GN%b9frJ3zO#%i98XzhvDk`n0Aqf}|6)OrzfS|lY2#OXJLQqtyv|6PW zEh<*5sI*dx5iM0zT4_sLd}*r{6%~~#B34vt@88<9e#y={XRgcVxjy$__i4?{d}qzt zYp=cc+HZ3XGpD->nwUDJc3x{Zc9})Aa5B<*VeqVZwx4rR)dlUSduqvVbjj!Gs`!w?(`HVFMU-&G+S>KOjHq&>1t0>z0cZp>r^qk}Q7Ss0He>b-)Xmz2 zHsdzB*tDly?CP8Z{~G)Y?&A|@;{WF-suE*s66elHoI5R1KfdKbsl@CT;HEm)XH1`4 zkAIoxJBjlX-)#|;svixoMkneqEH}Onu_2gi|?j+MKzwCO0G|w${kV7VWS!*1#-jcal#WS_YW&>SVAd?e3`K z;6zxJnrhURU71Q;A)&^_99|&qL}LpX%Qehtm^^dh#aA{=ou?xXxL?}PMERAG zx_RhLC%W!jPNvPBJbe}#HbihGW0{##(O%tXK>oM}?w3CXaypEeHosy1+^ITXOH8ew zGo>zp<|4a|sO^_we%ErU{g!qRZLVAbUTfgUaoWro)9X+$i25z1A@wif6VU;ow#}a_ zN$@zaUeZ(nH;!|5$iTogHYu}-(x5S3al^FB zVyz5rYNe(*g3~rb7`;YOMnVZ0GPfDa2#=~pi;z>QO_PfCGEy$1dU{@O$lL%5q%!D0 z7sj~?d-2RUQ!drh$>?UygBOEI$~x}z(gB@=L3T8^;QbbYyOV3tjpC0~Eg2^BeEw|o zlv6P9<>1i=k^6L<+{P2kaf>$y;9GGs=0dfu?zR{!rQTA0=-C^j451U_&W8CYK2)>X zW20KHt)S&m+@Rl`AY%1VEjQ)D-o^SB+JS64(-n}CMK4AiNe)Q1m}ktB-BnKxutg5B zMW+BQ0?0;7e*rJfos5ZDOTJK{ybGzMEw@_FCbsrGGK|7t9-W`-58Sz*QVT^1M$?-} z-j|WmbQChkmJFM55Xa(BSL+V0AZMd_2$Qyk!<=c;+yl6D%`>{Ak~619H=}qUGY^dr z@))cV1y{_NU5n{$!yMOOqbrxD>(gdmJn^cjbLXIzPsNyW{#=Y55L8gnWU$SNs>G)0 za3LHyGaVN}v^KY;LJHup=RULh(jPNcXLcj(&=4l@8N-!>t}!D0N$+vRhe#Nv-$MxMUznz3AUu zpQn=@i=$CsiZlkzUX?>`XHA_orT$85wBDH2x>f?>7U&RSFU8tTi(>MN=gh&h>9Q0q z@~to`dzVM9p80u{5_SVy4Ykaa@Rsn3YCRLnUQ;o$5?(uJK9=QBPOcKk=$_*lnFH|L z*CakL^O^`vtec8SEL36b0wYxa83{~?ZLXAkuA_0e?MA6+f2KxDoo5x68Z9x;<>!jY zm|4pZ4t>%rbS|{dxcFP0|JW>pfa zB=t}!;Xu+8Em%#NF>C&;mItHJi=@RGOvx54Sh1WuWonz$qH(S)HDI~3jh7-zT?A=O zyd`7e1~n+1JG~g;4Xu1r&KaL=xds!ae2#a<9ch?gW9Ur6xeO4Z}4;ErypEn6}JN zoOG1EmeIh}1&GAR{pHfvNvLP&@EHUqW0X4U;+YsVBR0;vN_qnq3M3EcL1pURT24CB zkb9A1#TZm@*fSlji<*=_u!(NB)PH%zdbjPwPOQaf76Vq!^`b#87LDAHXpX!g z3h$?k0kms({jv57^Xg_`bm&(o4O!w|*$ZLBit3P#uq3CmXJc*KRRI}8BgA6bK5s@8 zYg_K3#!9trlR%`&*#dQSh^RUX#ejPbGMt#>9HlGwx}r(nsY7OAg(nIslyoGUtEKV z+OWTJC(pIcFRqw7xgLvtE(k~qZHec;GQWhJ!Zx03QPze=`Dwc)n_xQ9GO#RU#G@v9<>RZl#$|Fba9mlp`7`ex@(aaTH)V zR@0}{Ap{`Sw~?PVb3PXBqE5ivkj0D0>#{rLClWbCt@UpJUC!{!g_zdmC9yB6jtuT? zw8|jje||Vhx1~_q%nqE>w2ik)q_I((YpaYbUSdVJZ9Xs{Nb{^bgodlZFg0F8S-_yx zugB9S&zOlRQ=0^w;N+RI@yN*PrypfBTHKtdRc&6qw>{NbMgA8dHZoTMTjGN3;j;VCmQxtur~`@vXa^|iLN z@u(q5E?L*G2Z*{OF$(3vkl)g0NEd*KgV%RD5kdYVI#fx^v}dDs=?mJ(IbejKn@P%Y z8OCE0;^kC!O|h?vnLhy5o5YG}Dk5`m+2$33X0V`&UrUBGb5u3Q#xJ9I>><5)-@l0^vrI(i)AkOnxWW!x8y8YIZeS}9v7zA7?f zx=bAECSy-1iX7;-W=_3)DypfDade~!he}~j!3;}6EzcAGuY9KkKe*>U?XDV|Xt(gt zc0F=>CwhX&4=l@PlKiR8=~aAd#%-B*C-0JfY)|eD6^_p&`Qz?KcZ+d3P8dEb@gtRq zaXG!p<=G!4Z_m2B{aragCHQXv{*%vyK>po_-xO{ zpGi5rCbf~vyR+j@3RV@~-Q_N^Nq)t3JN}c;>Te)lDuQAoJ`0ohGv3+({mznv^GTV? z*2@Dm%vY4FVxVfhzgP1;yv5d>yYueqm=Isrt4ssVjox4QEnL7? z|C0}jA+kf|>+l=Uk|%42q~J{+Qtd=uuShbvEQ%cW~66WdnA}A`O+a`#3i`nxVW@w_aB+`Jvj9aku&BK#z?nN3B znOzdu8sQR&;MqjGFt7cSVRo`Ic=FoHFiZwp6P026jFL{_;3Tdq!*9zERW2 z4W?(5AdNStz+61Ez9&4B47ST9@K1ZenBcx^Vc=m)!;%~1-i9gAn+*O6$#9f_pHFEF zD^O?xs>6znVb~OQ*^Be)uvam6eLH6*`va|pkpNqCO5eZ#k*_@(hqwlgT=j& zr(|>3Ga2mu9(+40EDVqXxI&6*dS%!HGTlTNN&a^l?%=W+_x?K#(#hbHBJs%&GaJJ} z86`#G@pvxZRiMuhIvLywDO~*v_j2XJo%KrwD^U|pMQs`x9$pm=3ecJkuL%#U4o?cC zuqC_6v3LR($S>;a+w+=(yPykItZT9+$ZJHToQql+z2x7~=w=Xz=(3qXfdZfm6EZJyV($UEA7=*O!R*aVQ zTG$x&s|k+^5NdiO!G6h_G2#V8rbB|OkX$#H`k82zkbv`-;99(dygq%kgpKg{;1?Ov zSv&Ul)h>v13Z4gRk80;yM{6wU6g-O?`Ay+*Xb6kL{7s0^SIX1Dtx%BvWHQ(jUEVI2 zOTy!8Tx$7A#NM4(!X9+lFTuRvp(~~01aBhvs=d7=g0BmY#e*kRhKGrnRbij&^e)`? z!~!Q9Jb=!>UvPgr2xpH>2ERg4!xP)kex>g`EV)>`1hh0PdPY-67hB`TRnp0cQ&&qP zMBsWUvl%h*0*RFU5E5I?`ULl8>`MkWATv&?O(0)*XO!Td-3oFLKMy-I>|H%799$9h zMWbkA=4B@t3leG?Yd;#hqvKsshx4K{~Bo)B5y*@!MGAf0O znE7znACV5{-BG_q2Yiw-qC5VU!>Wj0aKXlKvMuBA#yMj-z zXhyxtstg{IkiI1MVQhfAW^vJ=5 z5?_Olq;Up6{GKbG+~5OTwhwN{xGCyyndrPInqCVHG6=3b8h z%oUXxSt(QG!Yqn77o{epu>SOs5-SGypc z$oJX77t-81XOv>BC4ESe1y$mUIh7LLZ^rmlvRRDr>_8mR6AeM5?lDpd>Ql(TBR}j|ne|?n zpY_P7uwWEqy31%g7~dFn4@#xf#!K78;5|Ed0(D&;y!$d_9%eLk*caww*xVb>53CA% zV-$lT8X5LGO9s!qGD^EimZe{HbCAE)N8w`?9)p%$a*5!*u46MspZC{8w}g#i89KTA zq9VKo7enNaaueg9pLT?{H|I#`?T_;5(CC7dxOC7WSP~vuA%Ed8jHZGu;=5$f3`ZUb zy@}v?0Oa>+fG$#U(mxypZ%CPStqgus??&@maC-pAu>$ebCKL;vdLB3*PhlilUm0x0 z6($6*`}2Afm)I>sJ~w*|ae)cPvJR;1IK?~w!+<_GJ54T@gk464y_TZ*WJCZr{22N> z2k&*L#2MNOYQW8?u`)hH*Ki`-E&~$j?U4u~YOjov{4l#J>^aKCr$q2JI*iW2UFZ~0 z+0jCw@^8{<1P=gVEOg~QJTEuLgr!e}VO1a*JS6K8nf4q~Ayc5v!3S4oH8^8X3ep<{ zpP-0}Mj;zc#bk8D46mcriE7;efvyP?=10Qf zr7*n`#fAzT2A5#k6Ck3&AFJn7hUJ(vp)nK&SHPusGyy7;#hrk1-Y8{ub7^I;!%eiF zMA>IoLwo|om!d_$tmckz#`ANsb|r&n&s<8t z(VVERf7G!#qbS8Sji}Fg?F+@!ug()2mzKgbJcvs?2VK{fHjlyd4<(msR7$GtmZTXk zJ>Uuoqr)8-TVv9?J|9I}0d-Xvdd)_CK|=&;C)1SFMUSuC)9|qrUN^WeTe|U5T!g`Q zD#K%fQ=%$2S~Lo}8_S?dv*evR}`NCv-0qd*4>`EWEkCY05$ zx=6ty<5D2vhiv%472F?Z$i**l-+9Ot)&JxX6w@>LD5j@p!+Xv>GTCyi5`~f%d@!Ri zJOcedPc&Jy*5K1w&@a!R{UHVS7^2Ph3nU=GcCo7_JPxOYXun5PhaD=yZeznTs6gg( zD}!CLL}74y0TTTH%1*c$(8u{;bT4sVt= z5d0lIe$)bv!C<3z)B^6DjK=}NV_Ds zS33PXF<(X*GCY-MqHXELC9@>}#wXAR(P`bpbV!~;gL&ZASM;Hv-H!!SJz1I9l0u7#6qd9|9^Q&8gIHv`@gs2GW7ig zjTn3`#i$-_YmZLv5!D+5%+m{++yo;RVY63&@nHdaT-cn8z}_psm?C3 z-Vk>S;G<$3F(#2yH!MQG)7^#2urC6bW#pfMw2rx(K5_~?*nT7ySkadcyttH6RcTm|7CVF8`R5EI$RKH%(6%DWlCYwfv z$H+MSv!XOAdj;1`N5mKd-6-8-$A;Z7xI)BqioWIWg4|;XZfEDHHyQv-a*_06`CIU%3pH zV*#=tsISyGg*4X`?i+>Ji1ZQR4^OcaJi#{I}01f)+B?MXUMVxx}8T6g=IA`A5|%Pu`BIAioaak4U-rGp??2f zGJuis6J2EZ@xlzmdSvd60ca^vZND2@x&+Ogvex|%p*I<cHv>|_lJW} zbulow0pYRd=ybz{_Q3&!X_<=jLhv|gX&BaorDui%&Xkk9;0|rBZN|o^HXop8mF_f8 zvWO}>G8y~<4IcSv?&RhM&&w4q(oMit48rm$jLSwv|8R_S1Hoc(FZ2yajta}La{p9# zL>21Vomc_OuW@%!_b{&T{~nK6R)%MegyC@L%g}@f{NNx6E|IB>*i{81Fg!m#$ldo1 zWQPRv(I}(zzM1y_(-UdR?Kdd5!R>>OXJehCDm?ZHU5mzg`6mMMf*+wIQ{pFbzwugG z8F3q6$*lQNU+9K#Um={DlG+rN)QeF`{R$zwUGQSslG+V(N-;So9x0LZuthT2$jiDC z4NqpJK|Uh-rZBq#cA;!!|7&!p}m1rHaxNt5h$$W$J2T25uSiupH&8$~!nZ#D$esDY^2(SFM_PA8(#vO?E$ z9Jn+Zs((?~43*Wge1XSM!H#neOFhqj3O%SS=F9x9OY+}tF46@zWKPl@3kdQ=chqeh zlb=f`A^RU^M9;gwc@WYJp9DFSz+K3}Nx|F50YZ6>OgUw<=m((4?kB)uaHFhJx@2Vy zTDr|L^!<4D3k<0XgX>Yd(XQZ1OwI9E=AqKSx>R9~G&0N^tpj(c{QwUjnV(2|fE0QW zVK3VB}gh;R&WrhTI&W7hhTp^af9JpcmjhAA6n7UfB z35_)yQ=5WiPe_L;4GIO(@l5G6qEL>JLB;})$!ADSf zIvyP9I+KwYW@8Hp_h6y(*_T(!N{U$vxE>3_(7UWoDqHGI@a`gszMrBFU~q!*^}QIn zpho;tuG~d8j1`9<(Qi8^=OwRaMR&n|WY~2K?EJj5D@+WjzDW@78vGE$jqHq}UBY%x zrCEgd3v4PxC2LoeraFCrn|bZKu+;s{S!5oj+s#=t1?;^hgD;{S{Crw- z8vQ@)Ci*+K>i=MxTlD#HH*qfXzlZDW;K$hf%}rue@hzxDd98=qBeBj{9rj#;s))&` zyl~Kj4V}4_E+D*)$DCZcHuC17GF;6ll}0?dId})d`#kJ@h@r_~O9JsK>m9^g%qS+I zDqv9YNpZ#`JQCcCT7x~E3ng-5iwM(USop^a#X`A|)z7|x>{p=#d!T{z94Sk@633uy z?S&G4@!Z>eE2Y8Z2M520kwNegqC_{@Ek{(2Sf>EnN`T)t3N>MFx($wlx?LdMH3Ks}B2HzarwAbYeZ$iqXjTGta%RV>U# z{L9OFH0)Lp7CnjZJIYOg!r)|hVb?_D5k2~w#TX*gM61~-g0p0Z z_~<0K0~KKpv~j4__XXm{U~zAB z;Ddsngw1Xp90S5cu>zfRIfgzl<)21*xYd3sbAmK+E2`VxgBPRAb{6Uxb(N!+%A5240VFfyEq>_3d zu?pG$Cn|J#5|z5KQM$0z7a@ai;B`^E`BExNwp^jU;fNe5z=lU<|50l3k&->w zI}(1xfUTgaLWXjmUgJihcxR>)a(l-#2%}X$f(kh#`1~5_THwSX!7CZAm#In@Mle3c zBL1-`MAX-8(OrURet0bWfjt;`17b+U(4 z#>;(@pGt3s;}Uo5o7^7`*@Q%Mo6)HENL>i-K+ljL9MX&#!7B}wW6&1IRLLCW(26nW z$8mDF9MM8?%n$B?^ohZIX}I#z&>(DfLO*)tW94sf1MI+l))%ltBESGQ9V-YvX=uh$ z`?5n&YnDO+S=-;G8E+?HHh~W43oJ#Io{5IVONd>MbBHbNihBB0odopb5q2?TkXIA> zHV0qU!6z7_Hj2R47*U`fxUMU7eu-@-==@6bFU1Vyt1gW=iUP#qgKmLoUwCA5(1eAh z!vWk-6<3&=VZ@6CJd8X)hdv~JBa$0Xjp;;XusXdWM*7!8{byPsP+XAs6CQoKS_^ov>6ICL0}x%zd~a zdo-_OqIMr0thXz}8=n>Hkbc6~ab&cTq2WGi>~Fsz^Zp^6vZa3IX0J zlYy0l-pa;cA0EK1NAN&i({*qRs$AZZ@LL#oRLLGYTq&KvVCbu?3|^dyG=A7!21#$p zy9C)7EA0w9<2{pT)bM$&t6DepfY@iXGFI6nR&9wALH}2J zk0f@u&~)6XETLejMhqJj48~^Fn0q%}~`#y|D;gZ)UHKIMqMXrQ~zfXd%e~PPondM5h{*WPK*xzHg zCH3aI-hkrCNzjOz`pe$p(aym;C<kh)h8y@e+yH@bd$gq$u3N8nx;%xxst7YqWLIO9Vm4yLbF+jvRe_!zR;qL8syfo1z?6N5AjCo6Y85M_}-OC)|Sz-R^ zA^v8cj)C%l@li?M)E|ZS+4!{Yr?2RbcGdnVyk)Q(3NZ}rfOl=&ZY@Ukn2+R3YtnfM zRKBGu?}b_IvaU$8u<(E?%y+LW$b#Ho$GcK|RIK>(crCieT)sNsPH>sDMZA}CC{|H> zV#Re-*!2wLEG&%Nk&BvxmAcDNKY}mvD&-vzba3P0e^iZM^>56Yk6J$7z3=rZ-Xw^Y z@PeHQ85_yeg+n#;Q!?V06#tZvrQ65w<$w;0q%`kiv@|SS5|&_D z2zLtc;(Um`f@&!akwftW&!4?d+_1S!TFDnzOYD2$9Fz#QI}aQouWQPhFjgM&VLHrO zdQLRH{QVI)ic-mv3~WlG5eHs1$_oy_EJ-5ae`g2}`}-%Ka{EMPNmx^nu2|x>jLsOh z!*0u*gTS#Ij=li3sSD~?gDl{Lr@(r=!_mbJSCgoEU4wU}dza;9*@_n#3^qF>cr;eZ z9<^>zZNplhB;ng&B)={p4?MKQtI^4@;(rdA}bZ7PP3uR@c zD0rZcRKo1wZx^`<0g0*7=?-8*gfcgoXX&<4|0QXM(`LOM6qos!vGJ{zOfi;osC+IoNYM* z&e()*MW7!2=WOX;ZYV>q`1#pUk-l|ABNkqN zEQOCUIdG&?vuvERA$avj^oMK5AvG9xHw-`$Z=Ef>>vyB(K>mkV5X$J8^2Wek*M1Qw z@1K-44Eq#2-P<~a!D{!m&e6EWm}yD)ZS>&s))2P2p!mjf-HQHy&@_);g7tljzEQ8F zT+5Q1!h(vhEc&WLH!S6~`vS{xbMa=|J851S+c;3VI;^X?H`KsDT{V+hE5BcMX*8yxPs_ z2Pc;xoa6<2kq=S9ZwlRj4CTq#CekabR!|{Z0Y{8-Uq3)~#TOOwF|ff)XZb+`O6PSL zg^udgfhgd$V=>-HeaU|(a@iRjy33z*hZv~3u9(JSJtp|kSl0wT7Ck>0D_t_Q?#Ejj z$iZ^xl_2o>z;r#`7f_##KH~7K5w2|j^@{YVSf_v?f)oE02$2Ye+NL$TbDo;Li zw)i>t2Wnyg-li9o2o+d@J6rOJJFi3)_Ca@zQRIhZvbHJi!FMoN6>dUx&J8|;611^g z6pTzbx+fQ5I)OQmTVjk1{nAx}>s+1rGO9Dn2kvt(bIO;1|A)_O_+5d_#3%o?BKNiz za+bx31&-IG@KKJBN#W&=pPj-xIX*6h|66|NAaQOAU*Y6)Q~2?R2pXTlL&wig;cq!T z7o_mtIDTOYpXYd93O~~E{1kqUOIN>;?%h4ias5)Z$Io)S&?C`lFUPy2@Go7u@{RDe zpI033))wMwgX8ie0Bt`vI^L@-#MLavd#CX4INm3P_jCNP6rSaHzZ9Nu`H~-gX!{xI zc>lH#S6v-Rd{7EM-|@jIe3;`$rSRU4 zACtl}96vUNzwWrJ>}~Fy=JI=d8zvX|j-QaiKXQ8TWq$K{(eYu1CK78MKRJb8wbqpwFdHi z{xqK;ks2RFEJ&obmx#Bf>#GZ*M&=`T9wbuZXQU@JzC}FMKM_xjdl66dTf|f2Tf|f2 zTf|f2Tf|f2Tf|f2Tf|f2Tf|f2Tf|f2Tf|f2Tg21EH{1vksc|flPmN;{KSB;EpTPZ+ zOA3bm)Ho(mK_WGdMLac*MLac*MLac*MLac*MLacLMLacLMLacLMLacLMLacLMLacL zMSQp%Qa%Cx35Rr_z-!n3{UDJVujGD^NR3Mouk;^pIS&%4aVe5-jSnrtI0@2>yCV59 zzF5n7kVqY0Me?cRsEDVImm+>)i%y=Lgg7R@F=Ic=veNT&5R%f#??wnq#}`6zIzAzW zXX0mB(#c;PqkmhBJw*t?>GaHw(T_q&D?cs9Ki`S5X9Gffx^$n9(ev9FdtQ&x|7eV! zhhp^1M8B5Ko^3I9K7(`%5`9{#gZn)#T;WSl;H~Y^{q7R@0Vj_?`f3I@exka%&nV=#z>AYBm7nkQ zxAu4L_ttRlMf_KQ|MBB~R}B|aUA|iTBSx+&mu_o+X z{CebHKEvVgf<$R_fxqrI&~O~#u%mEY^q zJxs3>iA{Re4Sq_O?i!aaGOeFUdOQgzo%||iPiwzJPwjH`uytIqTlGwE`dj;7${*)A zYhNPKpz;S?yEsFy^f%0Kb%iU()_#AzO1$stbH5gO{?=Mg=ZDtunENe1NKHn*3cT^s z5PkBnnEXohO6P}nU}ri$J;u+>X(!yD-ePU^yM1y=&K|m0WjY)A62mD!RCy1`FVu56 zlodj5t^Fm2Q+}9oYv%}~ zpC+;Yr#;Lke>>EsTVv9t{3I`3zrEBdxAk_Wa$9fRZ!E$%v40kg#IZupX(w;79+H1o zyZRaxu=d+}Ncq=d^zStM9o4@pM*nWZDWA~%(oPjiWEy_2>d#Vc?Pt9rr+iP97r*)b zXFaj$vfm?rLenjaNw?f^%Cr91beE|-^)tWAjUIB2D=FVu29o%!GVvTn;wQ@D}3?^YyB>LmOu( zKSb}-&y=rLPCb;bF}z)7bZ4B=L;3NBQ=ak1>R)a2&sF_vj2`M=YdGaMDYxaa%j5H? z1jjwftv!rm9j zmu*3wY4Z55s07E`JpP!+S1YGIytPKTwP&r7pQqP0u9DY!amMd=W-4d8r>h_8l`~!P zWifhgGkQj;o|Q%q`T7_=`#pXcoghcmM>}~d)9`ckn!m$M`zfEJ_sJ<=tlZY03ZtKT zstrFv*Ar@te#(zCobt8GZ96*X@%dDOBY$7p`XNWtC-1J;9reikQkATm$%mZsrOK@z z@P3E;P=9oVm}&Hok1+CAXu0C87WZMg$ft)cWZf`YKY;KuTXBwYn;(f zJ>v~$e>B19r~D+tDPM2&P`<%%$}cc_D9?3G=9luzjULLcFr4zY#pqvYIOR7h7r$LW zxAxQ- zPWjc!tvy?ee)?gn;jFjYjDE^*H=Oc&luNo-Q5eS|SO=Dmy=x7ZZMp7Zd7jlxyf+K%l@Ez#D0IhsMyg&!p>_-ln;eG*D?i_E4OwIHGG#|kI5G< za>{Q}Zu7NGx%K}J<<|c>nm=o2N5fCoYp$cx9#xxQzR4-i`KH+Ek7qa^wCRpF>DKD? z1U*te)172EbQe zw#d^{=jrj|{7mJvpO4fVzD4bBP;ULne~*cr@+&<(r%^eMt2{kE=RD5Zv)R)#9naHm zTRc6&`PphX<+d#Sma?1BqZtG8}(N8^go$XciGuPRupYlUY zx|Fx`P|9;2YV)@XW{p+DUsxD7Sv# zyi)A(uHP`TB!$mrpELX*)$zB)$FTBGL&YR@{OhkUcA$M1LidGTC2 z2ggjEuUWs@`SLbR_nXd(DPIz!pYvs=%X(O*^0vIn4W~Tk#ni*BRhx9V-aX#vp*-i& zOqcSUN89pUX7p3fa>H5wSHz@yo8gq_dloidYmNS|SRafY+Oytp%I{S!`D)YdbY5oD z%`*IOZO=K%={Kg^(QwL_D3^5o`svTd=TQlcH6~r&vh#F~x4-FpobsG^i#`7O=NivW z-#_bO>{)L(>*ogL);}8!r~Ecg&$pRb9Jeb!5_bB0wY^J1~b z?-$k?{nW$xFa7WZo|Df8m8brQCK4MBr~G#1wq5M?xZf`1Jw5p_-RKJYGKRCBXPS8; z<+BW@yuAM-AL{3NW3iDZuQ2k_)A*+mjXe1zZUo%~-sW-N&#OG{ zuLBgRVe~WY>}mK3+W(a(rynR^YB=S&K4AS*XY^CgOv9Tr-Fl;+@(qSley!0%c{{JC zKfmd`p7L8`^mATMfBr%3-)`)rJ)G~;pOoLN0@iN_V$wZmIQ1knzS5pz?YA-wpQO)c zDW^S(6FG)cKi3~9PyKfNf%+>{kIh%yJ}><(^8R=uQ^#@47wyb4e7E{PM>*}JJoj_S zDPL^#P`%5z`X`k}_?XS!TxV1Dn@bjKV0l%HTY`jhfpmmsJ7Ixk&+d~4SqsE6whw1@R$tLmYC%5O8A@~_3D%Xtj- zQ_miiCucp`YxGlozu}bUx`*}uaP5DnpL#|pxB24xJd~fL4^$g@@=3~Vy0s?V&$V9F z89n3+WAro`J+yzB;Y}KUmK*()Utu`q*DAO6?=kwRXRqPenl9H*tUnK!bSck$e4B2C zS!ZCncE6tS@SE<}Q@+kym+<2r*H2jPOxLcT9H;rU>nD_7ruyjz%CGd&_1oi`nEcxH z7QP>D*IStGdXp~Yx5T8Isr6C(e-D-5n4{eKp`+nb)DK0H6)i+URGx ze2(^Iv;9x8r%17svCICok6rZMy!r-7m*sDo=Y@ zUL%Y>m&|C>DS*TZtuOZm{w=nDJPhF5628mgS>Qhu1>l&@B9?HO`l)B5;k1+U6zk8;CSA&J zk4cyHS?sB2qBxf5x#g6npZQ3!o{(Rn{-GXgXQ|4QQ{Hdy3#lAOTmN~B^`Gh9py}HB zPkCGaDPN}owp{2F>ZhItJ)!;NtMr8O`?MciZRE)}D7WddT~N=Ps%N+nHgN)kAseUmcU~nwWIgd3*(xkcW(1I=dI$0A9|egINGyT%Xh7r*O14} z<2Wy)9{T@PqlY|hUbfjA|NHA*b{tMU<1?eou%3`}ztWa_LgOXv{DbDV(2P&WIc~Ii z%8j1SR8PIpL(XxX=<(NM*Qva4KffI{z6xLOl^4f3w4e2-Oy%hZ@^Vj)-`;CI?$@8S z%Bi18uQQzE`Sr?~F6B2EPWi3Mtv_Eg`l)B9;k~n>JG+d2%5&d`_E7#nOu9K*ZZ^Li z4SyBoAfH0z)E`lN|I~2GmnygU9cuJb&oIN2n&06@KjlXlPWkc5C0&19QKS#r_mSA| z428V^K3K8JTmP`%A^%+MELVB!pCN`*p8byXPnr5#_;P(#4tD&*TVl6-XwSEF9o)wA zNDANIS9#h=`SD)5zTfJMe(ITNILp1>=%+l#KTMbMO zjl=X$SM|?O6Q9W^DYxZPXY_ENW2VtV-sI`=rRp{zkgis$@_jDq5TW}MmueP#P>3}E<}4MZ`Xw=U#t49pSk`c+>g&qG4^ns zhjzZNep{jP)}Gr8r~H~2{dWB)`aQTr;+wAjP(JQGoUNL!jZ52=OZ)cY64#5EU-~)A z^vi5tTt~8g=xF+D$`^b6vR{8njee$EX87&ue~uGux00y$FWq;h1YwW z@z(MQp8OI|zE01r-)0)l{+el7`x{iAobt<*i#@*I82_!E3q1KoJ(t5GJ-6~3JnqYH z@;Gf4w8!JV{C`z&~ESDOipYr1kr#$O}O_%mlKlSv~6Y^8CB4G1H`BFV$ekmW9-zKA zF5B;Nqo49C45$1$<h!{gmIRC*+jhrri2-htW?xuNqD}UsF!~l;3GM z`?gkpwYCd#%1`pzi{IYuxQKRgT*P!~ryUnjet}7s^2=h<-K5*8AWC6}(L=u5)8miRxW6g-=g>$TbG-4A&x<|o&u72scyEx}`Ax@r zlyC6T_3I(`G3ifcVUfy{QxEqyZTWJ4lbrIaV$xmX@p>kTBlkC%E^nyX!KK0A~QOpA70b^W-4dC zD4%6G<%^WtblHzkKlKdL6Y_%g5g4xAraQuL%8yfS)2&rb{d$?GGyE7$m;J0wmvxw& z@@rz!<+#PBTdHxA{8CMq;~DCwo#iS|PI>ktHop^$e(GVrz;v(DpFFHJ`YF%(HPfX$ zUFbn>L0GxTl7eKiuHP%9+@w_OmO}} zJ(Pb{1*oT7uV2$6_0XQ(%BhF)3HU`m%-5}*qw6B&)I;7=x%G3g(Q|H5q=)Ot)I%=q zK|WRw`zhh{xyW(;LOU-}KXaZ!{p8C%{r-4+qsMO-#roN!ocin34+#?w$unc(VNd1M zbB*dLH+sm2#OSFvdO8(GhBg^J$mhX{b2WV z$+@3PdHR9tz4Rw}iCNdBABLIrTk_$`t)1hH9@@kA51B6cBqL9IxIRpI@;W0=dlo6D zJb9CHYbW=q>7RV9|JwLDe(D>?4y`#OxQ>d)!~&Smp70FP^Mb&U6=Ry7qgH`+cW zkiQzE=b*>G@7Y-#vtP`8XYr^1`@?Hgp85Jr?b)Q9_K_^5}R z-{Z68%kS$6Zhn(Nbv-#!s?5O9@s;8swYtbI^ zLghBU>y%T^hh3vgZ#H_!w|IK|dcxngp`KrBf3ef(A>SRNXRmVVc~A9Z>O7VCBF|B7 z^Ht_?KMph~r~ZGb-KHxijh?wZBL8ePddRoM=-FZP+^l+b z8$INEJUxE9&dH6^m;AO_5BIoVPqrziKkwFbcPghp$#;2r+SHT0C|&BQ>#6lbIrWg2 zDYxZPZuBftJtK@B@^PLX-w%_Fp6gXlgV962z|-UBtI6oOMaR#pj2`keF?!Y+Ju`LQ zx7p|+-xi~1ugCrVy{JQ5|G%aB%aqgqGA#is>l6wcY54UH>YFz{FW%U>6R+D`5otRKivr)ulM}0Ou5bPD&;oaHJ%%DX{b^nd&mh1STNIBCbFEjElYP%k8)-i zU(f4|9k5zm%;V#X{)<(AozYKT@9DYP)3eCvVZQbn zJ>&;s^c*yLO4Oc?8t>^h@t{|9p>^{Tua=5B2o;^`XY-;krYea_S+U>FM$P zQ*ZRJ{Wcgqx+YPwsL+jO@ZPWhe6ZMt?pSH)8P{jbk8-7NS^J~rJP!zmxP|GPlt#h#Us zO80k>a_fgC!wc0OyPr!{+|Q+*lwW1^P=2-HkE#AO%BhF)YYnITM&;JeTa13{*=qRF zn(j8EpYq!cr~FRkHr<0pKlN~*nttx4>sj2Vw)y4zUF4K6%7`@Dbjy@eKhx#DHu*W4 zF88&mpYlUh4>{#4V$!wmeNoSNW6v>~?gXQs@{W0`L6ekQJ8PBG&wAPN-VWujRKGPCdGh7Tt(~-i zdTvoYtBfA<^)Y&0^*Ch&y{4S{^)j(bPi(&S7W4e!MzB;Nr z(S%yl#lc05HDY} zP0(=V^p9R9Mi@R+?Ws`Sl3%^9Hk|U4lv{t&|2Exvqem}Wz9UBYIcm=$BTv3Ux%K~6 z<iEW0jR{h(R+x+e@obqhfHr>5Oe~s$jZ}gD+?b>gTgXO`29|CW+X&A`ACW3LvUu513rM!JF_gT$vvC%_$zL(4TMtT0O zg7w4jm~=-N&i<$(Cf#boDL+BEP1nAcOZ#Vmm7Yy`g4WR zL;2ebr@Y@U|B}KuHtD(K*XQe%vmNn~4TfK@?|p4l&T^#uCc`Pu@sIWME|r({ho4dj zjzxNI?dfSa-_IyfZtW>Gobp4JTYIWKK3UJ@V8^$-HC|6>C;R0|%B?-MhEsllak0icR@42a^@s9t^@sID?D6~MNhV#rOt3!Co;tOM<5=dG z@@&`SlwYI*w*IV8PW{w#o8i}Mx+|4aKjl{$PIC#PD}LK1|Q$P^R{ao|8Sk zG=~2(h99r<3#*6UI~IP5r~d|>7g&BsW+Y^JZ47@mhV$Qnw|YkFc*F9>82)$+{~(4R zs^4?5`p3rbhhli9es9ICGluuq?>kuivpjyPS0A2_ z;YaKD6hx0Ne^U&v*Y_!`{J5Ofdgbf6K=&D}{0lMs%NRaT*CVZ-U&L^}k8S0z&~+5c z&*+%m{yVkbv+{q4;R$`e)XG=I@ZO!$r#mBt|1E~+6sFfRHioZ^;cvz8&icNn%~wSX zza@r06T?4?;idYXq)qpN7=E+IzZ1E{{e3Tn57+lZM87Zpml%GR4qU7}-+!~bT;HFu zobRhxK3(54vHZ>$&i5Rx{Bt_cvHY@Lt@Xsu?~^fnxQ;ulp4#5&_53`BhsEjT&x+wo zV))}R{QVf-t53pxto=1Hd|eC=`=-}3DuyqL;lGdJLk~-@zd44NmZX=zAco)X@e$FZ z?(f$z{OW$K`hEEgG5qes)64%khM(L&y?lKPe>{eN?eWtimG19|(pLRGU+(cUJo&%G z@bd<=>ha}o^mv7*=dUsR)FWE;`0`6VKGM_kVhsQ7k*#`s`Ta4xe_49@@5b=eG5p;a zUN$hj{-rVepE3OSLFx6Zh~e+Y@b3&xujjcKer9=k`PDJ}uQ9y+QR(%Z9K-8l`0rwP z-=ov(UlYS$iQ(nPq}Ovp41X(zcOH^nPelyBIfn0u;oXl-um8I-{QEI{a|}-&mtKE$ z4F6#ae=dd}h~Y;b-G{bq zygr6M5X1i-!*g|VF8#aj&*3rrx){DKhW|H)AFY#oo9@&Y{&Wl==HJ$47g5zKr3+ zbKNWx2SZkVaSY!O!{3YH-8Hya z{i9;|k32rcv;UJAUZRy)^!xI+#qb=h93p?Vr~iQ%{`VN3tCdFdjPvxI9m9Vd!?$_- z98XU_tpuXq=WAp5I4x`|-&>tx`71H}+_8}nR{qf#{0{FNR+*F}*DnK&!3W>zZAp2U7KG1;TYa+YI^xqF+6Kpdie!0{I4;*+w}B$8e;eZ zF?@MldOZhXcS#wx5w~|%hStuS&*Jjh~c-y@Mk=(A=xSJab>H1pHGhA z55(|)d0a!gQ+&o%t@?fb(-?jrhQIc`^m;}wOwXG?p#_-?8@DA6e*OQEJBBNa*p&{9k9FJ=Vbfmy=9d;(Vcw9r8Bi%hNdhXTh z!#yscdPTPg9OH43|5C3{FuXnNmCvcs!PzhJ-IVKevxS!`uQKxTJ$w1+Fuz6qOyxT4 zZQkNxGLRXB{BFS~-17ev5JqZ!P-&<*Z30w76RM8kJwF_o-)t@|z5QR{0MM z-=X{t!*?sc%kVFh-)DGEMg$%-ysz>n4Cj0BzcGB2%0FlLH03WEey#F98-AzqoreEP z`MZYyPWc|g-%`HM@UN5~FuX8`z}JQkRGz8+V|ksSob{LdLgjpqh`d307o+DUe>MA7teBDnHq9zW0Bc;XN}W2aGhlT=`jsS1CWo@M+2~FnqD{$%d~| zKHczNE1zZfUzE=?e6R8=4bKasd|hjJnR32oMSq^D{3auRvGN}nezo#D4Cn7D-(~n? zDu18he^maU;U6h~)bKnF{J%1Mkn$%DAFceihR;_1g5ftS|AXPbQ2tlL`Fq5FGyHRv zf5Y&u--^oR9m9`T{-NRLDgVUqE0lk3_#MjsWB9L?2O1Ap?tfICZTLINI~bnGitO)f zcn{@03_o6ZAH&a9-rw*!$_E;Llk#H>e^B`ehCiqLRKs6ae!AiO{og9XJ7q`t9b@<) z<>whbTKR>B&sILg@SBy-F#PAr=NQiS)#e-imdbz6@UN9GHoSZLC|}nbew^~}8-9-R zTMg&$|NhwUTUGw2hCizOe#2i>{*dACDgTAx!6A|Tzc#$L@}~?xN%^yepQoJtD%-_8 z<$p5rw1O3d<#>#d@1y(#!%tCus^J$ZKi%+alvf#k zhw?FoZ%}@o;eS@n@eb|Zt9*))&&!MQHN)^h$`=@3rTiMhFI3Kdr;q8*R(_+AzgGDQ z!&fN3-SB&q^WXKO{$DD;*T_Gsod2#L_o|e1qX%C~r1AzeD6Vey@}I`zZgD zkv~rPONNh9{tv@1RQ{IXM=RfF_$=l8_x@bQ*ZPbhD1IDe10qu~cs zzKh{S9V7p6+)Dk&Der6K&r#0rt5SZx@hCij8-;79> zzEQq@7Q@#Y{+a4|%J3pxXZXG0hbn)?@G|AQ3?Hui6T>T&e{J|U<%j5aoc{TpE}ZcD zt>oL4_cQX7RL{|dU#0w1!*5ewZTQp5&o_LF@@aYsC*wV{50kKcVVc1jPlY`zZpJV`Fn;hQvR9Y%ajK?KcnAPD9<;1rSjf} zuU0pdpJ#YO@2DIX8~zWKzs2x<%I`A#Yvm6a z{w$rQbr0GbJ&6kl|lye{quG zS-Rj|VR#qi{Js^_Em3~4kw02F=jD_?N%=w}&wn5J2E#|I{OyL%P=24`S14a^_#)*` z8U6$1zc>6Y<*yk2pmP2@LCn|F%0DskJCuKI_#4U((RnuYe5}04@B_;G8J^uKs{cnD z&hJ5;YWN_PuQvQ-<>wn-qkNj-bCu6C{95IU48K|V_YME4@;eRxx$*}LU$1K%L|IzRVb-eKp!+)im|1J{C?F^$allb>&=N zq5ij(pJwFuDX%fSUDv3dTxfWE<(C-VP5Bjumn!GK!%TaQQvL%Yf2#7k4WF)jo#FG9 zHyi$EL(hO8IodyJ$VJMczc+U->Uk{ z4gZ(&lMVkud8OfDVN{Oi8P4x#)*9YHpQ`!2$?$o~R~mkm^7{>6s{EIR zGyea^aP~)kHvFIJht~{$Mfux?|55oNx}L;x8K?FX#PA-57ps5z8-Ap6{?0D-U!eR{ zBR^4jmEqHspJ(`Np5T=^Ws7c2js;onz&z2UDYzt!+Jl&?0tOXsM*J#2Vy<;{j4 zuAJY$rhhI}zQf2*SN^8qbCrK&_?61PGW<#9S-Kv^bhj(-Z1~@m_cfgV&dp%M_p1Cb z!@pEM((o*;Z|54`S@{&hyD6_X{AlG@8(yXSM#EQWIr85-qaP}jKValfQ2s~^=kI+| z&tR2*#>gL|{EvnoulxH$41Xhs^=@iS-$zYZc07;cc*$9 zeuB26TXp_N`7t_Um5-9DSyWBiOT6)1+xdA$ zp6gV#hW}U7z0B}r_bAq34s$X3K$?< zlpvrXQUnAEigLJ!0dE*kqoPR&frM*-prN9Kiy8$rv1n0giG^yQ@)j+&V6nuaHY&E! zqD8A11Z)uO8!g(zqWP^g^DMG?$nov}Kc7#|$$aOTwbx$zI(z1vvmX3+#4EsGCH@uo z`^5hYevr7$8*P4V{(EN!@oXf0OYn9Ww@u#>ygTu;!TS-n-!~ja{4(gTAU+X%67fRt zY~oA6=MldT{BGh;g0CW;hxPm?h}$~(c9$sm3|?Bo(( z4ZeW*Ch(=iw}7uEZubkGAa3^yo*{1i{BMX`KVM1weWYvOD`oNd3HZmPe+m2&jBln- zM*lXCcsBSQQTRQ?tzADz{7Tq)ocMU~Ul6|v+{R(^^BVA%NIwz$b>fr2-z9zn_D~(d4e4(OZ-w#J^bO!=MB!bC-vfPb;x*tG68{u@1o1=Q^wsJ&)`3e!tM7l&AzqMEu^>l^Ahppu>U9GE5Y{?xB7N~_&VtS zN&M&F{~^8+JdE~a{%;2FMEp7MbBR9>Zu2Iy^E>bnr2hl>c;c^t-$?vV;CaL!1h@H@ zrEC07(p!66LHs`0d4zZg_6UvzXG>@#q`_2b4mY4aGO_}-sVeIuZ{l|`X|WF6wDu4@znjO2| zvHE4)`t4WA&P}lY4spAVt0kU}c|u(j{w?w6V80deXa4*KJc0NQ@Lt4U10O(q54hC} zv;SA{G}3X6J%)g89!p(%XHFCB!d={sH2{5x2*Q+jC_biQ9Z^H}TG} z|7H~aF7ac?*M8zHVdrz=?ZD%3p2guf_S;6`orotPzcx=dJI2o={S`>}BI2{bBgB6X zehu*tz;7Xb7<>ltFTriTZ+^zW|7E1_2>vkfJ7MQ3;+>%X9r0g6zbgu_B5v*UJ>u8H z&ZopJZvRW%`pFZ-&Hs4VvpCrN)9Rh^rO@>z{e##aO8iFbPaysX_S2*ATZzAh{a+A& z2yxyNh1>UniNA?`J8t=^2e)!y{utRYf9(3z^ybeN(p!2vh<}BB57((?X9f1p zCH^e-hZ6q`&&6E>9+K z4L#+cqgQ|SE0pb@N&cJv{qw5FuJ<3}X@Sh^f_$r=mx1Y9UvTqh-j9NV10AmE_L1{+ z8{+U;vOlr6kG+u&SG|31dW^$WZ})w!b-3!^4+VDY`B3x6zGw3`(q9-8=(8QJ_NT(1 z*~Az13-k-XEe=CM0l&-9&kT_Ny29aVe|ewa;7`cTM4YpOcp>=b#MgkgNBNsSmEbAF z_kfQjejNOE;`TY@BI1!yaKfX+r-A<(+~WUJ?0@L!FGrgCR!jO4)Su%H*YZuq=R@ip z?$)0cC^t=4^~<0SJKU{52@Y3%ES}d-bhzqmKHSIQs-FUVvcui-9pZ4+?}y&LhuPxu z>_9mv+gQ?f#B=9q4p;lXgMPBZ)&4l>GaRn^H=&>AaMk}9`aFlL{zK>s9j^NSfxgJ$ zs{beSD;=)-PoXbyxa#8u$%|}j9IpD#cs_fr!&ToI`i%}({RHSM9IpBl=(jms^&6ny z?r_!H=Qv(X;Mz{L{x9*V=Y2X+2K*-CSA!RVTRXLW z?MdQ)LVxs}V`pSw+JAkC^yTQ^UU#_0GZ*oB)8SfwYE^Ww&hP4Q)!z(#Ux%yy zYCO-^&*7@if_|vORX+*Ofem-K>TUhx3WuxyE9l2NT=jN+bc4fHKM&8B-0X1G@3=r- zWXpB9>Mw8aV=v#~s<(N?B8RI!8~2YFJ6!dP5dR0jwLWXT`bhqCd(zRXon6S+Mu%(r zwf42e;cDNmPj@(6?exWSS1&tU^_Re(Hyp0|P0+vXaMfQ3{m0&)wsyGMUx55}c6gp}yHDTE z;i|tI`tuyF`UvhHr#M{o4?ush!&QGj^p`kX^*@1roWoWB67&-suKJ%sf1|@y{{{57 zI9&BlLqFZ&T8$DU`K=Ww-S<#Lz9Rd4sLmpWYa&m!H29j@t4M7#K@!&Ptf z^BLl4u=4`(*T8pxTfO?Ir5Ka#bw{u1)*-)p9iAur9kj<{?g&< ze{0ms?;Ngrd(I|=>pUCxXTtxpz|H>*IY+l4#McGbOCw&1_BfZgeec$j#1jyQZN%+& zqhBGOhd6vid^LE_l)y3b-@ZrS3gY(p{5y&FX%U?NGvayRFB7-l@%@IleQ#2a3r_VX zD=yd{O?*4}LgIVCA0>VW{5j(F;C~_>Mm_vH@gCrH#IFYLjQ-E!`6~Db;(NhwB3=tV zi}-QyV&Ye~3gYt&@dEI_5?={kOS}R+jCrW}zYY9s;#J^-iBAp({!AlY2R@&8YJ8wy zMch7jx1M+*^gD=`fWHZD?X>3H!2aKee*=Dqcuem={{`{x;0?rkfyWI9&a-sw^P3%r zpAUU+;unAqByRKk5yU4$pGMr~laq;0hkiQoJHQtbw{({hx9js&#Mi^lTH+hPe@Xn0 z;5&)G4*mvlyMC!5UI)GXE|0~(73P^=ll~0w(1oX#S6A?M#LorqO5EnLeTmzAco6aN zuyZ-_tH7@$Zr53ph}-->lek^4%_45=5_b~cf^;7u{&VmriQD!0v&8Mb(l+8&&tD;K z>$HC+{vgu*JMl-sYl++a?lT6ST8_^{pGN$3@YTdW1Am?PH{hQVZ`U_SuYq_U@HUti zSUtQ1d=T+T;OWG3!SjgQ@1os9{4wYs0oQ(ebl{@@`ZLmRNB_0S;X2Q`56|t{^@RCv z{lE^=+w*@fJA9VdxjxBH*0bM}Qafrt70;QyO?s=hA2?j~Z$kgE!_~fhuK9?=RsR^C zyZXZ6s<+QOpCE4SD?C_4vYDUuJt}P-u6AslA<^NQZZe)b>EUqI??-yc4p)7DJm1jY z;i|WFiByNH{!!>hI9&C%E|KPN)xX?BUSzx4;i|WOV+y#{lYy9j&T;f=Cll%3>F}At zD`VwFwxteN`}W-9Du=6`Vesb>hpXPksi%nBb-^#d&Ce;AZ~WTPt3So?=M9Hzy7{<2 zz1QKYx9{`($l>abt$WluTSc?Ii-p(zdb|T?n^!IaJ5q%Coi)7*5PU=75Cj=a=2T*uRC1z zQxLZ|9js{aM_A39w1HXr!R;i~^5^7XmHRd4Hx-#FZl5AyZB!&PtXvGowy zk)$(oTl-pr`SUrBUhPLKF;B4$G(T?Du=6`ftbHt=WzAk z`iEN`uKE|C&vdvOp8{~pSC*WkTN&}H0DHeAZvEj~#FvDE6B>y3hzWStp~1VQYu{@< zlz1BS*Autv_Zh@zLw^_XB((QOh}-wLy+XVg?dS{Q8^O=H_*DO21s_Y?uHP3CFF-x{ z3Gt7>w-8Up_3Yck?K--FcoFnx4LjA(Jd6wH6JG;}e`e~ber^NrN4yGr4Do&7HxWMuK8tvoT}KmN3%(BA`hm@T1OIA>+kK{E#BCl} zPyAEZ@rDQX%)aT{5U+>63-Orqg7f0V8GTMwK@`u~A`p~E#_HOSWzhikqb zN4&dqf{|Nd=h}(UZ z4a5sD?(8PM75oVC8u0IkhcQl_i9lJtQo(x=p9VgPxXtrt5PuH(pAc`4`tv*D{lWi2 zd@T4u;9(7;e3P>NqdfXC+Yx}wz{aCTXwcoJ*bG5@& zzZ?2ehr9h-xx=+xS7LnM*lyvX*f z!`04(@N+Bibj;&-5Wg4vb%(3{a@hZi!`1$F==Tx-9{jMw{rZOT{inm#j$J1-I$ZSy z(1#7L5b^OzZr91(h_}Oa*ZB@t`&(gupu^Rl2=v2=-v>U<;cBOSYk86F zx`_XF(w{xhXF6Q<5$N+AuIY}%y6}ABmtg(+$HZR-UqO5=?5rkk>%xx_?}+mH1-SO- z<2`A27?&$aKNRbeZ%5G|BK=$N=L_O7uyexU8lO_cr^P7QkB@WkeSqD35;1-{0h)*8z*_c;P?J0+={W`SwO=Jht z3GYqfvwbU`_c`(H;H^go|CpbXL&1Iu@e1&(h;IeYB;GzIu(ObOfAIT>+k9^eahvb` znRpiFIsZ#M3GJC+q(3H4!yE34k4O$q${;)Fe!Qi`tzP|v_!Ol5TgSeRJ6Y!i z2X+&;`BgRXBIrLLZu-N-?Y_@f#Mi=3BXQHWMXg~FCoWoUrT|aq|ZGyv9Z}%~8ak%ym?NLwW5s!c`Azlhz z3T|<*a(|w9i8>?O--(y|RN_Ru61*FNYxXCif4GFWT~}ri-wXYGhhGWX`t~^St8r|r z!_yr7Zg6WC%Ms^2#NPsckNB{Zz}P1a*K&F3ynr7gZuOy__?ytTKxVAI?E~*X{1Eur z#La#(aeJ=pBH~uxE+=l!vyLa;`TQVXlZhvR=Mql=pHJNUTtYkz`umC7_sRT(_+;qU z6F2*ti5EftB5||-3i11(|1)v3{~_^bq5q7y^)p`)|2_2I6SvQ$wn1gJ`tT>{6N&$^ zcTg^Ui64f381eYzKtCQ_+v9`)`L8#T{%p+ua~z&0%HCLap5bt}-&^Q#)#pQhr^8im z*L^D-uKHg?f4{?3e;n=ZCk|KrA?SbVaMe%4ylaEQRo?~c$j>@l^|s#l8;7fY7}gDc z=Wx|qJKF7V?S~_6EUoc&d~QI z-UaI#1BmYdA4a@yB=BRr!!_MHq?_(=P4@}d$pW|d*zfHY6Hki^>~A1GF~Hud#O=QJ ze&SQm-s_2%fG1uZ7&Lzlf%hkF*U{<3OVGaVA#T54{Bz=K&|Y33ZqKE^PCTzg;NLOg zcE8)Z=2ZXfzIGDvK8WXK;5P2}O%Bc0obXO9$ z`A-?~bm*TXZr@M%3~^freu21sZ_h4pEq7E6KM-$|{$k8e-gCIt=kFsy+&*ylEJ5b~ z5whPSkbB=cdbRVLQNe-OYlC-d*SCPTCH@(BH*oVmD>&V|EDFD#_-g3q5?=>if9B}5zna)i)t>ji4p;jRkMXfrPkb+U=(^yzmDd_v|0jT3x=R9?*Ngae z@Bzea-f}7NWXXqaSAbjmXC?>yTH;m@Zy|2+oK1WM>?|T~c9s!;3i^kLoBbzeU4f*L0^tKOEfr9|8Nf5HA3~n|Lw!!{AmQUPauVB5rYemiYV7ZzFE~ z=O4kOj zQn3!w*5PW$uBUo9T+6Ex<<-~W>d#Tw89;mxuB(TETYPLjJeKrZp`S#0EB8X;)j@W= zb;RxaMs^cljsD?1;#XsSa)fvhcuabbkojK)o=p50__f6CcZds#mt&suB=KtSXNjKx z{}b^ZnExDdIGU#K`1jye?gtU)&Xa2rv8gMJ?IbHVQ-Zuf;th}-8dA0uw*{(`uDKJ(YaO}`Ud>jRpapRqSd|03G^`wrLk z(l0HD!-o!c+xzDZ*LGKjcK2`MNoNFh!jpq{El1Ty&J6b3Ib73Si*!3U+->h?J6!d) z9?{F;s(%>q9|Uf3*cl}2jd%2F=ehC0fpp@ZfZs~I*H@oMn<9Ioju zhW*FD%}={;wT1LoAl=`S-o97l1L7Hhn_dI)3h=Hs1pipNW6}Q%C%y#yX5z`{PZkrm z=dzw4ZujYS5V!n(Li_~m$K80UpZ5JHU5WQW|1*;K)!JN&^`=z5-J9hoQ$>D0p=E*NQT=lE3k{8)_ zI9&BMe|rPm(#=w_Y+n<%aV`F);JE2m2D{!_4o4U69~t0qbO}Bm1#bO(3tW^;Aif@a z67hGzZ*%Nh%rt>JNgszvWwFDxoff12x!2(ux2vFkgzRU@G2PaY-mY(-b-2cPD*B&o z#I1j>ByRO#4{@94>?6Ji_74#MG58n6tv_raZsS)RItr`*R!=$-e+u@Kh}-cqaIG;ufD9 zh}-kw*~BeAbBNpbk}W3w5YoMuxZPhUBX040lK5k=^DJ@m|2M?V{x0HH?t6%Dg8dJO zoBhv-S3>_U;-+sTZvM2n<+CE^!Azni$FTTOfd^dA#9{So3;pT8lV z3p=s5o?4D(=S<=j=kCPqeq}Q86|jFX@zvmCh+DeX5x3t@zm>TCe)V zd@d!v4f<8Y?eq9QC2r44Zy^2$*!eZ_*TH{J+@AZbBK{8a?-95793cJ==)WLt?XiKl z_2(_8oLcVx3p-~Kw{(+;$Mz4-??>FeXK5&LOLr7;t3THePlWxOiT4JdPP{*OA@NJW zmlGck{s?jN|0&|;=d;AEKiLMZ^H^MJ_yPJO>A%PP|IZHB`QfXWAHM7GS;8&;`yHmxJe*>H5LQT zCT{CEDc~pL(>+M3zizaZUF#BIH40`bAP-pFvc+OKRM*uTx;YX4*C zXM&rbcAxHk;>U2^_q=0A?MGn$C5Nm1x26Z_?j~LUzK3{+8G-&i;_Jab1vfu!9pGEi z&xSsHdtlGXw*Y>2aJc%pQeR~2L%a@rAh@NQf$|zn`bY8uJ693^BY1|x{c`UR=(8QJ zNlt-&p2JmN3Vji{`Ev~Z-0SGo&UJc{Y>zrzQ620&<#0b;Z5*;~B>qp>*+P6d_-~2F zgYP2#9_&|voB!?43etU#^p8OQ3F)UK1o~s756=$xe@Gwh6!5b$gLkbDn%_&I??HSy z_yC7%mbN0!!yK-5{s$N3S2)}c0rGV%@$xQ#ACnxecDmu>`zD8L2%Z=m=x2ai-0bt? zD;>S2YroU^ki*sf+pzyQ@$=AmuP6Qicm?r4@SxcYN3 z?7Z!8)t5v6uESM75Z7Y|9IpCm=s$P3>hFO5Kg7FZejm;fk!;pKOhmovkmci(&t)CL zJhB_{6wEVv6E6bqPyAQlLy3P0emU`B7`Lthw>Vd}^!zP@xP9(#5xC{682P%#;ToUa zuzx@CQt-#YEnRzl{#nw01O1B**K*m4bpPORO}8KV>pu~n2VPBl2l#%6tNj|-{}=K0 zXzwQ+uIWz7mKWLL@NWIUF6?)7xZ1bh-R$mgwR3o?T9NUB_*dA!*x`O0;Lk{htDQBu zz8No#cn9$7iT`q1pudIqaPS=BZ|4O1*~C4Jzl(@p5B&<_Z=ye3O}zb_!2V;z9|2zv zZuRFxVxWJH^o`K(bhyUNzSs0Mhilv#Q6K(Hd=~oszY(|bqlUQkzegOd>6Uj6{QMX3 z0`Pi=t3Q9s3iNTP7na|xtpnbT`0Ta;zX06oVG`_K>TvbPen)ex!!_OK(63!XJT6O5 z^1K@zu680AcW!mK+POVTUS!J!H~)vg{{^JqnB~j8_0<16?_lz)!<(de-%6t?b7_T`z)6e zpAs9SJCpc`76C6Oz6Sht;w>=#9wR;$yd(M*^QQznmAH-Lw-c|1eirdQ7>~+`+xNP> zK-|W!zY@3crGdEDDu_cn^jqeCAMlHaj|IPm_^aS|5%xnM`e~owr_;PZy|2$4EGZM2>M5f_s4bX%fvIl-y~iEUPpW{_;`+z@AJOaLx_|@R=5ibM}%{?`4 zHXl2mxc#2mHN;1B4bH!l_(bqk#0$WmC%zs0HR6ZBKOi3I7NpxiJOjMTyi@a43_ggs z{SNr`#FM%Q=g%i@zjyqM!*2|v{_8eyoxf>S?R;Tyu+rh$r45GPuR2`yw$54YaMfEJ z_c~nlwr+U{T*afu|C;`Bet-B{q*DesUf~{1Eiz#O-_Y zDv8_kcs0ZeF^}@*pX&cc@Uy`!{e-`UDa~-bwb9q!hLN5QpxHNRu!Pq$}?mj>9| zLwpTn>TtJQ4uWgk)E|VwYq3yvWHWAc zG?DnqK;~Ueyd3;iaEo&V5|~EZ;x^y0gC#BB(o)iIKzvp?T=RPn`F+IUZhW3{xa#|% zKCO4S8=qf;YaG;{?Y=jjx5v@zR3#}fIPjjs)&8$w{~*~p8Rx>_JhPt~?0RPtp9VgL z_!{sW;m@L;Tq5LP+u=1z8`TO1+MW_e!`*sy zpJN|OJih%kq;EOU$6mR^)&73i-{^4H{x-5-8JO{2A#UZq&*4~t@y|Hw*w=I?qFx>+ zz7zaA;xQ=imUjdWX!)ugt7nN0*K({xIratDa#4Sh0hr4lp#^I_z7x~}paMj!QZ2Z>Ys(%>zmmIEoyHEYP!&Uz+ z^lv&`^)`=s-{Go1qexz4`_SR4e-3f}+~FGkI`DrvTdU{-;ZH_+riD(IIJPmK%gKTbRg{5KBI4y69;E8y0y2cccR?QpH1 zFCm}rI9%I>jV~WNT=i#R|A50)|KebIk?jkItNv!}f9Y`5?}Yw4hpT=)_Cr6G9ofwP zKSAHY;o9!(_Z`jy*K*M~RO`vIjU!$gVDBc!j{5UDCKma`KLWpt_zCcbh$s9gNZ?80 z7SCshTYvZhaqIW~K-~Jbx4<>OQ;{cq`+)RUq1+EUT;qHgaX#X3x7@#Wxau#*euKkR zZ~n*KB|EZdd8z)V(8W7k^_H(r4p)60^j#gUddqJ=aLeyrIi}lnj$ZBT#r_o1*ZXSE zn?w3>xKXi$^dq4E8S#nW&l86k?=9k6q5p)qeZKX3;`X_cb70W&J6qza+vUXVKFF;O z$I`X0&j+`5REGMn$l)5d-`?%Zy~Pf9>%+YcSN#d-A8@!^A0BhK>TkFwu>XX^-TLrL zhpYY-=r=iB_4fTsFFIWHt(FG%cQ{=2R)5|A*LZ4tk^;H6pSar6tp)OD`ZWReQixmm zUQYZ3^fwW=a-Zw)9BB1z3AmNlZ78o2hpUfE;P+~WYksYtS?h4szX$y~hr9844qWrA z{)~`6-S!aA2(WjU_)73LC^xfX@kw_0G-&nhVsOjv9mwzH4p;xLM0%qguKr)2Brme1 zll>k6_A-h00WTzu?%aET_z>uSPCO0#x8UZ#eJ}2-#8WXYyyMuxtuWtG2=&+Oq(P5l z{Pl#(WTzM)jCYN*@=ENtCw>C^iNuG`?h;5Ednz-x)`1Fs`~2)v&7ac~dyLd!+-TMusQAI5E7 zokV)Oj<9~t^tL~c^fun561VX#LOc=vq!FJCK9RVUR|fI47C`{Ah)-@A@I2xL;KjuA zFb^*wJ{#P|XN$uU@U^73`}O6-OQEkIz7~8d@e1(m#O=O+HSrP9?;~z;s3G2?RS=(A z;`aNY9?HS;+dn?g+w&L3uLf^V`ibCH&Zf@*Pa=I5crx*6;1S{{!ht_ERI5^oEh zLA(ce7V#wTJmU6yrUk@Hp)Vr72E3HGwTrdHt56>0#0OgaA#UZnmAIAfcH(Q{PbKkn z;8nyof>#sY3cio{9`HKicD-Cryd3S{mDM!_B&8@#J6I7edx*D|i^j+N3lq0>9{XJp z)0^Lkq~8Pk1BqL@sl+W^TL&`xmTns9E!~O4E!_;_AHkn2;)lTVh+A9=h_}Ul5%C1< zml8KSYl*kOemQZoQ$ait`&)_k!TxsQ{jpz3dFCcEeCtgI{elMexcoO;to9|e@tluanz2(>DL8cF5eA!C++2GrW+qhOu z+{%3)@kF${8scNYYl&MusUvRXUQgV9ug6002P4iKMr9CK0!I zCKI=K4kT{zOeJpdoJjmR_>)20(#>Ly^2#Hg3~uvu%dgERi%4&NmO6Z_j2E`fvzGX) z!L-pUCvNk|3gRBheJk-~@a@D`f>#o^@5!|C)O@L*Rv&6epNMh1mUs{FI^s#-^~5KG z+xOpVy5l6>DTqTN%FXyRaBHu|3&4{}UkDx{ZtE3RAI**je;v2z>h;IWgC2nzEOWf?26F2)6#GixxN{5e^m{~llh!-KA)x=kW?<1ZE`*p+* zL0?bY;&0DWYq_XDEnp{%{@(Zq@b<(rz^#3o-u$s~#&|OHsbt6OM~It!8-L7B7VOwK zW4shRkL*-{7ZA7kMiKGa7D3>OiKn7nl@Pb*=gW!DhMfxH1>jqW7lLmmUIboAycE2O zxLs#e6Sw)?KH`?&8se7UTH=;pyUw=w?}a}$o)|a#?a{9rH~WdiBZ%`r;#R(?#I1ZI z#BCm%M%?BBHlDCQwmxCp@>@W5Y(7~;JP-YUG4UQ&e~4QgN{L&#Yl&yU&Q{{ba9y^Y zxLt==61R22D&ls1UQN6`^0kln$@vm-TaT?JZt?hChj|gZ66N z>?aX7`^m&@{ltDZ%CcsUThgf3^}gf3_1hf2xU_Kl_Mhz|R`u_S{GpSLP- z_yoz~)*zc+5%G!0S21xLH%o|bhrXQnPVfriuYzwSUIo6L_#W_T;-x6}eZ<#VeIQ-| zUQ68Wv(ypa4t+gwyRX!~ZBsqbcv}CKNZjr>B@wrNFPV4}+Kc_piPjUfKN01XMtUo+ ziNvkEGKep+{(<;v@FL>&`NU%4EpT00LfqCPN{Nq!el787;9H5?y4H5$Nj9G$ZvIpe zH-D;$n?L)An?H5L&7XSWw$A3YJGDO4BA#L5$H49PK&*T%{>h}bdEh|emfuw3=D&Tv zyV}26TpNMKzt|kdBiKh3y8l8UPQbKyqNeN@Dk$H;HAX( zg0CfR_sh$Pe*}F6@fz^0#1DaQCteF)O}r9(A90IA4RMP@EpdxO9dV08J#mYJcV^&# z)d!11n7GBEJ@Fd&pGe%|kVM?#kW9P|b|S>LgQpR{8vV&c;w!;3h$o|6XA!scw>;t# z(SC~^u6@ka@TY|M6!22wE5X+iUjuHR_tp5{pbY+Rcl635;FZJ=fmab9i~Lp-4_kjl z-0pYO5MPb!qFUm6!0U*wL_Mn~p40&uZXdi`e(ig!!o;_B3Uuv>x9Aq|MB+){NyKZw zlZj__5A4|YlbJu(&eKS5{!b)s{@drR&CYYkZvpA;^Wa6q3lXnk;#NOOh+EuCiQDJF z*AkzN{c_?J*td7{zZSfb^o6KDRm83SR1>%Qu#dRKvxd0E)6zG8CU*?VtB&+mzV*aU zpxix_gW2hWat{-?`e1&U-oDQ*ne^d@boM4&}rx4i&^L4qJ&^9JUj;I8+k1I8+h0I8+n2 zIP4>Cai}AH4Ee1mUI*^s-Qwe&71Y}>bM$XX%+a4G6HfvkNZk7KRN~eiBgCygPa|&q z`9$K@elv(CA^%y#t$ySYxBk3yY$a~~Zzpd4+xHQg{}zXRr0;|Ey&B>J!E1?IyRIW{>DCjs>nJZF zh?Du#AMH9!+}d?};?}MciLXTcOd@XWI+?hAU&lb=J28%@61RT9zL(Mbw|Hid-qtg- zh?_ro#M6*&G4VpXpF+F{yp(t`_*&w&?z)wD0m^qfal2nzN&LCCLHSh?ABgpZnkc-M z_%!J2h!=p@6E6gBk8#Z6Z|ggW%yC_iMBM6IGI5&^4J2;$EtR-^|6YXn+Rj0I(uiCA zwC`~=|7(%2JkncxDIjkC7ZErAi;0{6CB)7DQsU&mo=qff-}jh7+}gF(3-f;s?n@Psz7D*YxY;iu zZuZNG7a~3t#O=9(t;Ao2emn6YSRbe)o&i6rh@1b_#4Voth+8~sh+BSZiCcc{`!X$_ z=4ZG|P%n&IeP~bI>O&%N%U2R{%U3dS&*~5HC5T%Zar0*)akHO6-0a);Zd$(V{+WG0 znemU{Pchl40WTqb2)vxQ&0{Nw+x&1VahtzwCvN$zB)$jnsUmLuTQza(pZ5{B`AiLQ z>kn&*TYpB9Avv923(T@Prw+iA}IA+(`YDYgOYuk25uiUP?D;=(%W3{b{ z_!N|HwZrxElD6$5ZqG&4IDE8;<-L}8xvkGT-0HrbR!@8hu2VepTbkc19Q$G71vu8; z;o}^AB5|vS)?cdqD;<5ZqgP&tV*?$Y=IB$2TUkaNKHkyW^_-@wd-9 z!>@Dn6~wK--Rf}bBlWcH#4}KzD;<8lW50@cEsj+?Jl)anBX0e0jl(B7`dZ>eI9BKI z$&S9B_*y%L`vY3;HyD%mF!5>FZ}0FM9epBkdtS)CPgL#SeVecmo}t;pkI| z+dLuS@S7cd8u6_-Hqqg?IC}ejQ}t81tq0n=sq$MLeV$`Sxz+Uohfi_zMa0+OSh2%z zbMz&|ZM-OT`0b8to?l@x4x2oP9FP1oZ zcU-XNB~|bC|63is+s{`!-0jZ~Io$2H?YVEY@Al7aF`g)Q`{5A|cl%o#e^l@Gt2Vz@ zZgok^x74xY_LEy3?)Hb(4!>0mV6*4=)czEM@?P)g-F~cXi$J7$x4%kuxZ5v{b$FIz z-#)jYcCsD5*3nOO_)drCIQ%1rPjk3^URCY8{XkpvbIRTJZuLR?2e(}xLAfh;+x2;f zk8-zNTRfG!?fPD%tK4nZ1z1l~KHBmB2-ZQBk9GLJaeqU(+pc>#_t)HZJ;J$f;E=#NBq?C8>$K?RtX4 z-F98ut4Z&+>m}zlakpJR;c&NIH#ppF*K>O}*>T%-)xak1w(G-#nz-Ap8y)Vp>y?9> z^lrO;&*5&ne)FOxz1yza4Qb+TyDoLO+pb@7xZAD=4Q;aHw(Dw#X9W`f^~=;IeYV5r z4R7L89e%?lP26qQ+Z^t;>*Ef0+x3-bv|8WXcJ0l{os(0r*c-4QcXsxG!rY?50duD2 zPAi%)H#$v*%?l$eq6^cVUwNe)qLsNIdx2Eu1-Uu%7HAd7o+ehTa!83R%>Qw2=G1xfW@qNkce$3-oB}u$IG8_o z`n;18H7!wGpmCp@J44z^cA?akWyaCxz_X?x{D3s5P6g6w6DG z^Q47kpVEt-dc4_=*806@Cfwte6*sqfo^k0j3bhO~f1JBuo>Xe>edf%&Blicx;U3h| z3o@QlxWK8^V#ygBnrgdPK5gW1%QEO9PM&Oq2kcZE*Sz0RPnS^6c6uwVXNwj@&50K2 z>|E(v7cR`6k(*h#xWJ@AtY+uWHISR9O=HffSvpxI+-RKURQBv#Y3xYkWUk!0EsZdm zh3Ub_pbf6+)L?-0S(Iq_BZ*(AKctdcFg;g>fEj*+K51V9{zGR4MICf1(cHGitbJ!R zO@Rzo*$dpk<%ezh-5n%uXEI|^cJxGo5j>g;V(pGhgjj~?g4wx+xl#QMYFJPnO=7pW zwae2^R0p@fQ5i%Q&z_eZ)u!gj%gL7MMGkyK%{#e&T1yE+n*9LH?_}$iYmdJCUgXS+{e%AN;EN>$L2sC|uyByi^mW<*|7FNf zU+TXO_FrW(EeD6XXASX<%B%S5zYg|a2l=n^BJzv$;1K`yBL8);|2iljzGSd3@n0|U zUkCfIgM$Bk$sk|izh30O4)$LM1+OPvl0Xg`AWYI7=%3-gUgW+PaAl8`nm+c>3=2n zk(!I21={WlMoa$-IiGz}Z6(sT!qsa>k)D?Rr&031HgMmw`;2N+H%{y0DEY6vC@_$U z6EuCPYNw@thXkd${2$j~$!7O0gT2$!pD#N0NwxLEg7ocklA69&Wsbi-x2x$RyYgSK zy^7D%sL$@ET6fEo^&@3i{yBNbJ~!pAjp)JlP}uuLQSzSzf!&8S!<^RvQSx7RMUbN~ z>}dWqOPv4fqvYT2L;qj-e@$#QSAKiC1|FZhFC6TiR#uh5IZrCBzaj9y9Q}{_uQ6u- z*9&Ma{j?+z%T^G)oqXlAo|N;Msd#O6kp4cLsp%)kAE*Dcu;$X=o+Jlkv-{S;-sx$r zlLO7AUoaIlGU$f=-`?pgT25b^d2{JkoExNAXbIz;)5?s}|Mch`oZzmxD&g~QiPHZR zF3<$2|5;dX-DwHqo%4D)O8zG< z4AQT|d76K%Qk?&TVz9aL?}2q)d+q^dPRsv(IiGz}ZKNAU@hHc3wZ{wV2h!+Nyok^E_C-6e@P=l@QeZ}Z1!=U*uk-{#IA zf{t^oorrhN>r8R5x%2nne0xsB%<%cSay~QF)+2t!+URA|^1D#}EFOspW!o9W|A867 zaeMA0*gHL~-^uySrC+o@D8DKk)bzDW;q*(Qr2o+^L5giHVZ3u%E25+y!548@J~e%9 z(wzR;QTo4Hq;Jo~m>ZmaVwCr@^3#SNO7wrjCW3dww%vQ zrQv6S_}lXan!a`koc_~M(yz4i)j4P5wDfybnW;SE*&zMu;LWdpdJBrvzfq1im;VCX z1at3Qs$EV?pDS(d{GB*|jh^Iee12B}&7D6{116i*pJ4Cw^v}TjS*qbFTOQ6oehNMP z{CGK^ebQ5sHwS@h@5JwN;T*s9QO1ucS!zYTk0y9K`O0ZMDd#g&aVi>q5zf@?MC6at zzdTC)v4;xmxh9x7Ev?~E>d#iBUo7oQH%))E{BincM(IB`PS>;Kxz^zAN z;I<&}l{iz=A1i;H{#Q}TfAx&uM0@TEW=_lh7g5T;4(Ugn@*mes`ucIR=IU=!evsm; zmN4Eq|C%3WDjoQ{AmL&)E}P~*P5wClk4Nc04E9Kl z{tuifV%fCJ+>P^ky@2N8SBUc?$iLa(^Y#1OnW;8;N8o?5Q-1oq1^cg`1Jfih-PKe5 zZQHEiy;n~FyqP=p{#fhad|rQe@4?^%_RY>So{jcJv`9`NiX}=SH zA7s2FDNt(txnBM_|NVurO+906>wr!(M-|G(+6z(s!O^DI6K4d>XKB>7ooDas#d-VR($@D1obNLIpSAVq zza<-|Y<9kVkDeX0{M-J&qV(TM`-AxH3*P+r-6|*9`8KZq1L>PRd$0a9@bn0-1B|o( zpGHZ){=n(!>+?RG{y(MtaNaeo%5wtRzC)0*raMRe_lY4uef?#OsFYGA@6smm5-)gU=LHu{}Bc9+EbL@-SzUO zuiJPH$FGao^j)l17WN_y;SQ1EJ>$Ijy<)t{$78+CUUj75U$HTpzm5%UmJ`<`dBy1m zV$bsbFMii+ND6t|4#ala{3%#XY|oURyzezgwMwYz`EW;xLPE_ak90hK-DpWG((v6~ zyDKVVGv5z|+ir@@^BVO3#xX75`R=Z>Hl3K4u<6?woi^2HcHZ>OO4J$eUaeEBj{$`%g=kVdts7c&s-xx3#35=FJa} z@${!C#4oRGlPn9jUYuLhFTVAvLeAmB`q43dB zBSXI39bly@qhS#=f59IiEZ+AP3c$~S}q&Xn(~nMLZso1nBw#Yh3C%p77IZ&9S-+CSMN4cJYsu z$g!R`d-I>ZMe5UZDHG9+c{$KYyIdUDP23#5to@|8_)5L{UUTm`kyO=ffbPDQk>P=^ zt8Y`ww`N7C?7+fM*+KCkMts!sYICGM$9waClp$$3?epoIWnc1}ceCX0_DDl~C^9^L zyf-vHE;9U$Gz4Duaa_A+##Qw1i2rR?e09a10N<6~}UI`_SffzO(L)_tS<9hCC4xY;=x^Mf}oOCKliL769P zK8$*mFXts^OTE3t+xFf$UfI{uCX(`{e*Zkukkj#&O`H3bq#uyBc5bNkDo@&0WPVfI zvU;s?^J97Qvh=C3UP9wV61yMht9JjnDQ?zR)s71Ks(#W}P1swUJ~GsLW<*%HuXnxH z&G7V~FV6G4ZQ+kcHI&FtglnF|4@4Sjv%GByagm0WlD4M1NaAJXrG2DZW;rXH($15< z+i$aRUI+R9^Bu`L*0uBIXG=ft+wK|}{($tQBc(5`NcJYDNc_h4dZXK$(wC}#vVc0d z_Iz(hk)#(6%dsSBSKYng@mkm9yv{wnGPU>gAlQ3M`m0c6M~(D<|BmgsxoZcn>=Lng zm;A}>A|dI@$o3>TrggAq4{t$nW226_DWM)-M{CP9-!~4ejp@AV-%{=}m<;dM&KtgW z=CIW6(%;lYsi(1jZ_2awZ6%VP_EA;RzvfBbS|$C6tcwlzZ4m1V{dE9N3E2>aT$lT9?C}*5-d;3TFXA4uleqMd(-*HWp351ekF>ZlQCo@KBjc_3*acDfPqeN6@bv?id;VS?9=b?!&ZCiOmn{mGxmV*YoR!jJcb& z@2Ln^-tx7K7urAg`k77oin-qQZ&I52uH~^hkL6pkC z%YS^Y?q%WZ?qwE7wR>>ZvhO(lN5*$O;*&Lh-YnZXx|uXW73$*zYC#QVxE64y+inrB=?jJS~gy zwj5Y-#g>Ds#%{5EEsKfSvZ8fpOH63&meARimmL~bd0FfsZ=U9N#nd2<%VSz>S=lmn zOKiIqTVl^HzU<(cEw>yzGfw_mY&qDoDgQbLjF-Mb^XBJE=d==&it*kMoeOGR>m==~ zMCzc{Kh=~^_<^=Ge_48M==3@{O48|l-?H=^sjtn|#ZYa~kNi+wl(ZB4z88JZsCcLE z2}k$o;K$3-cZ*MYuFe_b<@~(4GQXB`e?aopFZAG(p-}v)12Vqle=dEx%w4kEd6RX{ zFmjYPKQzpn{D$<|{o=gqNA~sR*WTw%p805`L6&n$XUUxYIhoVXS)5#tzWSo&>32y!K9@Y4h|=yiOb^Om z%jx)1xu%L@YsG#?C;dqM_ovTedPzD5D~r>2N}4ub&~iK|bJGDDPaPvAUOFad%(Q;I zB4whn^<#ILH($$0+tN&_OBYDo$IG>amcdeq{VIulk;MK;hPQ2|#COQkab=l0#x9a` zB)(l^m%cDEHvVY5#M|0~wE^|5_lV``sZrw4yY=#PxgX+>`F{Nsy^d=Yl1|TF(%xm< z>e*G&lIu9Vp4cSE^W}I?nd9fZggJbiS2k1U>-ov4dR~0!oWUdIoL6M-q1OjmpW=Th ze;0b&;-8mmk^$Z}o!f<^%wtByl_iCOHkFj#RQ9LMi+;5%y}Qiwo6BF$#ZJBW^&=f0 ziBd)zWDY(_^4gq@gMTPam+yHw?UIlW&iPCrY|(Q6X6nJqSZzu7boDA8*Z zse8SWqz{&Bj0ajrhCg^laGqX|B%hslk=FINQ0tS|hH7KXTTM3ZmGgc%qNz+r%NVBP znEHRv(H-ykNXK)dmDx>B`&;@@$3)TTysx%(hS-!b>FA1BiHD@E>Ha&m+veKyyrN~-X_wf&}r!mGN+HCSO>ga)mD@>9v19xIkL22GpmqSlX`Cj%ekI@;IDb$hdIbHh7LzG^?Kb3N^6 zwU2#Bd~eqF6HVtFU;mJsvU~>8+M$M;_HSlr6g5a;>Oo=zLAS z3uJhqFhAy4TX|EiO|FtZ-;YrITQlW4MeE2AxlWmdIZEZ(Kj6o$%hGo>GcNk^arz2v zzk{R2r^1P~%&%n<>W_yy&$V(=pLGu9#mT%v`p14U{^j@dhJ>?aZY%S(uSF~4jr5b= z7S(<8bFZvM+EG~MTeVNhI3z4a{tqp~Tv+zqxwh&oX1x~%{^)#L471zaxBicv3hv@Y&yQ zh5tLru{Oc~p6K)(wX4?w=2uQ(lkaBJ($+NN#Ks2JyfA7{zm5>wX$BJ>FRn$ z>)u$;5N30V@DoxVvKH`w^w$qc|1;s8Q4Lqgda$ko#9tHHzRB-jT5tYUW8=1Cv28XV zk8QnqwdmK&wMC`$VXGgG)UR%AeDQ0fDHS0>#=Qn9pKWon7Q(R_CBEdm&=f1xYJClf z%_PiUYcBnP_Vk-&>7O?<$I$k4@cAaY$LBrV@t}_F>I>%Zz0UV0S6nP>ld`UM5Pggt z8`a90-?#jM^rtLKe@n(swR^ve<^Gs1X{#NbV;+lbwYmSyq2@d<$sQ!=5zO7 zn&t=EZ}d6Q*rk(PcXnzgZD0J-HXI}SDRK=P!8L5wipHVQ=I0wEPl*zb<1#nsAhvXV z<@J&=2y;r!tFG6~d`Yf1^_u#zahndx7^Q1*RyUI_iXO8u&n-*8TgoC?e6JYn70Gva zitSEsX`iEW_wg}J=Z?nwM%!Y}h@d=w8qF`3(k5>{17z2(^XHqSlPX1KUGU2W=Gl;{&`#fDxVKEtoNnV4{1+3N>Z9nd-snh?aJlp4@kP2zVtx}dcNkN zr=+QK0nJBiS^Ja0eMr9ebRgW%}X3P+>leO}+*l1id z78(66Q=+r}O=$Ij6gY>c2htHHg zxrNukXJ-lPCajCRpCj+GZkny<%bKa$(AeqNxlPh&E7P;Q?-N;DgmE=!*y?Q@y0PuTno)=!FM-tqou zuk115Kb1Mk=i;m0FL+Mcu=#qvTw{zzo9ZRH*tdf;W!(1XgxY^3{3mGhdX8!}wk@PD z?%iQ|dS5@yV6D~f2c%BL7Rzzz1GK;HHOebH_v!9_tg_B&s`tF^(7U5E$6NnM$A5p@ zC+`Xx)x^V={Z?)&qMR1<2#=d z+je>S&CQ%64^u}yXH3HK^sAdWr@T+}a}J)pJbmQ<$8&afU7oIULC#O*52UlYhT6QPerX!s53Ie9*>eS8NGv z>NTa#+10k@P4z2L&*NmA+u-P$)hr8@?f$Wa$D?(mvOPRJP*;fZ)AA8ev#p4$i3EnGKU&3{hiFI zhOd_Y+w_VIe@^z>{U|bA$EH6EyH@rst-hf)DfflirTi%rPBFihsn72=<=AZeb=j@jLYM8`8uV+=4bzbwj*iJ#LxbF~s)P8NnIdcDB zY#$KYVw`a|_wc}}G zOY@(te_I`PWlr~f5qRL`X)_B(~vS=rM~ES`h18!8=~v` z(w_bMml{K>$J$oZ7aN0;TG8_tA1q7%t+oTPrM7Ei+-n@>$(m&RsxF~~xBNay^81an zGrf;HO6Hp1NdNA~J+^a-*DIK-_Y_# z*W8n&{ADd9>aho;e#grkG+FNVS4kc7MeQo`-s@c3toP{KlWy|_lD?w zHMv$wiI@4&u8zUF-Nm7jCp8~QX9f4&>tnlazFW${`caOLA3N!f|EX<7(rPWw7)+4# zBbvUvKOl3>e&W-3c~25%*JuYNHZ6ZPZqujYL$X|>wUGJe;T7snkpJ?}8l(0F2j5zj z-cfvFUwUadzR?udy*9ig(y)9b=7e(1*h}Vvy(Qn8*Ba+u8TSLRXUIJ! znX|kiWn?kPdONyryE`vWKPIs_*$2usdvku~Bn3LxZuy(h?XKvtJpFx*vE)PTjYhwt zW8Rp)r_O<0n_g9Pn+N5*SHxy>{*8$&PyeO#`Ierw)wob>)7(X3V=*~T;_Rjyc{O^v zV|p!5-w-9;oKefu@0WD_{zS^n);>z4Y_;!7mioCPCj8dOpL$=0qs&Ws|E)OvuVR0# ztV40$wC%<2lV`W&U46IthSrfq>0VjkR9$lno(s}@HwQ5v$(8%l8jCpTJEu!sXen#! zIuAWx#_?nsTX%V_W?dlueBy;?9hEhwWV!C&CI8Qney~EW8Ixt~KTFyn`=fPs_XmM5 zwXwndWNlM_lxJitw#WbSP{+OhZtS8q)V@4RKeRmY^{B*ankgTtES|$E1_r9!>Ioj_Y^~xG!x*pAw|2sb->oU|gtIgi~ zEndz#sa$94x~)EopzAtbDCDo(>Kd)LENELA*Owla`4ZN*Mzxmblw!Ndec{OPZ(};G z8n1KAP}igRQSN`OsA-CW#YGmsn~h`6$HnPa%CXKeW;U0HoCBxlLCY{XSFR_df0`-l zU9GXsqw$pa@DLj#dPxjo4;QCjCiTjg`m;iql~Z>~Tb~EhXTdZkdTprp{L~kR^P+8BDb=)uI(d}mY zn}h#oN=yA7-Lh$4udhc){Yv}3)v%Xhx~;lV)-yhl`cU;<<4IeG<-VBa!RpxV+TeV> z=Xtodl)dz$a&Kx?%O6Ej-)P}o-|uX%<4C#RohRe=`!Ow7slBlLud&b=#7P;s_Qo7- z@<-R0M#gqN+Ow0lL)P6US4rA>9kN{RKiT%rQIJVkh=1%Twpghvgoj=IOVxex~DOzO09brA{|C#`UXxHnizHDWmvV zclg&l{p6ZQ=UVFH5lN@=L{r?%zWTYlt~h2t}eLzH;#F>8{oC{GQBJ+ejJJ z#>S=03VCG@$nzXC7w7rUXzTOYRt6fgF<%EUvwWWHx5vv|_uIy8r)b-puKlE?H-FQ; z@Kx5C_5OBPuOTJ>BS&3)^l3S!`H|;UCLfXf^y})CrN}kS1ksHV-ORSqw}e_B?Jdu0 zUm$(Ttij$8nQwn7*Ey@IzHgjd@=fEm+vRzJ{c^g{+wr(lA2prbt%7-p8>fd@ z^WEvbXnYP7G^H)~$L8nBzOHd5%UHC8Y{WL6Zlm)8Jga|MaIgQs7mfZpu;1T2=Ixlp zHoiUGhF?zbqr3Fwe_tqTs8SwBWKJsgw}y9@{wGiRa;;Yf7I>2%m-%SbyQ3P?3gy|; z#!-J=n(2M1Sp5=Pj8yqjsg->#&*|w&EXtNjA3Az}$ zt;Dr;y!Vc-OKBf1&mkY}RTac^yu@>Y#Pd?=w`=8o;peTq26+xHb!Ke%E$M@g9(=uV za=#np-n7KNXQ=zpUeXWOwvjb4x$pQyYwyKz^8B=$m;cA!+rU{_Rr}-5d4qFi&cHCB zfS?}47f>9AVZad)hnGQ6l*0_@VANqa=L|D4Z_NvWS>j8INs47kMGdC+Mqa&fi%QFW zVVal9ZdTr+8}~+Og{l3psI)Zy-?jE$d++m{b2w9<`}zF;pU>Z;JkMHduf6u#Yp=cb z+WS0no?8O>`u(Xz&pVv`(D!Oneu#J!L~QxN+jX?Y@%+R0D0e!08IBdfd|8{X*0OMh zL$aRyzLK^5`)~6en`PneF1Gk&g~Iu= zt-DY3ib3xUUJKSTC8qr$_U6o2m$SkB*5 zdf3D5h3Z9KU1JB03fM;U^0Xzd63q4A0h^R4wPHlhB;ajA0%Z1>7Fs6K#c*xEj*l!_^xe#Z{n?6(|znxlU>yV6ZmThZV z2KhJ(dwdzrn{EP4@^tFc>7MuAm&OmBGG*|zW{FLdlacSKIDFE}XCPO2346$MvB$gi z?YHMl$9i$eTcP&`;D=%Z(YqD$r;fHd(0rhIx)5XT=bZxHr@%Xw{0Pr&5Z^ZRi}oVZ zaejLV&I>Vy1?#;q=BB0y>d`aUmrxua9cSXZ;E*?mZCINZx z8#p5^r03M*+nRolGMXFhm>1v~cM#tlt8v-(c(fvRC;sM-;^N~+kyox=fOQo4DQtP} z+mpOEUP4|PMV;TCv-oqgUee$BT?pRa>asWRUC-;tf&W7JaHwG`osUn)T8};9CY()S zzAIm8IL+HXB5ZT_zambM%|o~4`mFd?$5g~4_zn5Y4(yjZ&QmY~o3Sg^f6!N-e2)5x z-+sI&6*}qVMSppl^UevtN$;P~x`uJ0XQs*i^!FYeU&M1ve;a>6bc%}2H(~7B$71|H zhw*U6k=jdd&(-%u$U736#JSJ`eO?;H^DWaV@x49PnxmsBKC1F<^nDq%y%yh@SK&Kc ztR;NbiZ+Djh?YU|ht^*4Z4c*p!m}N@8I_O!#lknP(|;Q@{tm2bC+EiR7q;Z;O1Ak) z+}lrkDeMo%iN8?4UbsG=_s?YwZ~VCo{F}VTe+9i={&WHUqu^nk@!T`D<-PTG-4W1U zco5HVpp9Q>J0zU%ak%Xpa@(e7>Mj|Jza@hIkW4xorPx^Zz*V1{3)}v7s(ohhJ1EEB zH}G?dQ9QF)hQG;$-5>w<8ORTCPr-lI!@lQ!u;KL&A=h*J@WT6Z+kFb{@|a-$?!Y+* zwH;lx=yA%~J;Jg7a_i$cve%9Vw||1ZtESkrNXJ0h*X@HWmv`!&xja{)oa7<4(d!Cw z#v;8nmzQkm%6egEZuw%!iam*39(i@_>-5|T?q5RO#Xb5s^7vPB`+duf-1@V9y54eE zZn@0Ka~(eE>lB(3AH4 zZ&qznpOGgUdyCA4;CW$^jnlMl(_V_keA*a1w}Un&;Vg@v<)`sG!QXfBSmWIOrYbxC zyfK)gkb&4`=bmH#2>w1zbYb5;P3dwo#;~2*L;PPB$Jsn$I>qxRpU+=w$Yu|YyQ%3G zXWT_5m4z;{HlY6gGP14dg9X0ZAl}8b+nTN~QWiR8Thp~g+IVp3wx-S^^LO)Nt=QI-EK(La4}VWsr0l^dIO{4>Hg(3fri)NUHVPtNko@5I z&+o3<^83R6_|({&@VtqgZ?4^+!uiHIMcR5QzO5-ypsW>b-*US0fnQ(-)`J z>!QFK2eb6cy!L>X_nQyX@S6|E@!Jmc`w0O$ukwOLpOtvw$W2Z3w~B}}TW<<_Z^++q zO!H2{{xbOTx1Bt}9jnkU?N}YTG5@z9DAuTRX7#)a^2oZNK4Z~I zMl2BgF7l<kwkl{^?kUzWtV6hg=&?ecQ1S zzVoYsoaJXW@Y(Df?E7y}<8tqf*HdNqU5s-4{zn|YOA<7{|8YDNdiYQJ zw@4_jq%qoi%jvIAtjCzWJw#{ATi+h(y|ER2oA&eEzZu^S+V}|aL*$AP^pXB9rx4#V z@R4j!=WiXfZ^Ltqcc9;&qci-#$wlYK;+OGvUy%JUzRxIs|K&eQ1QCe z{fmF}$58BHqET)=;jP6#+Kcmn(;@Ew{+>?!-Svskt2Z^_=e0~;lvDPK^_M?lPSG6d zz_`57j58{n9|W-1JOlYXjRVdq9)Bs_aN%#88!mi#W5b27T#e^wB9ohz2V$3D3@{F{ zbMFY0U*_RX{IrJCGY${D;Qb&t0&)0(rJwsU;3N2shWunt(3?Zgg~d_!q2NTEJ)QpW zOQAXEUWV_Z@q31Eyqxy#dG^}&`mT<4{0v>Z?9o81?2$nH+!gr#zZ3P4kKD5(hW%?G z{_;~e8zEnaVZQIZCH4Ar*q;8;vsY8_UCHs4E8q*4<2O<+gKyC9$1KC|qlE6EzhRyN z|DwNTBAqE_klrt#?H8wd_e7u@eK$|#>i22XGg;KHFTvjm+548)9GhYe;#qwD4!3dM z%89T~+z z3>Pm*@GBh>>CO(kQYyhOr!w#EAj$6Atki2Lz{IaFa;qdZ&z_OcZzW04t53N34Xv3R z!NTDct%{cgRddxmj^4hWfu3|vXF|WiXkOx7XJzJ{m3g!r+e@QsqTUP{DzH%tk!u=TOOlcv7SNq!Nin{6E$8b4)C1^=AwM5{_J~M+BCds zDVxTtM8G}WqgN`?%fIx?yDo+pLxOf22il2bAa5~`>oR)hm|<+CS41W7cB4f9U~g|v zAHAl;?eq+>u~2)uJGTmNe*#{S=Dkng_0)~@>S*gos}9inct~^R$Svw^?e8yA)W4~tw>PiD z>eVOxgLp?)X9r%(mTL}rK?~mf!mqn>OA>gKT$bO0)$g_S40dM{%{&9I#JhcLnJ%)g zEF$Zhn!2>VV`Dd7hK4uTw03Un!MnQJyZZB)WVjL-&yL=Kj&uTVzT2EV5huSrEkSSZ zX&uPt!wY7NTWGJzYjvP+up1_a1Java@{08frr-)$xI!TYGExTB@#ZbO$1Ty1*X(5n z^5lpMpjVp;6t{Nvx>g(P-qhW5okKwvF#u}Dz?Lv!_r~co|Fa#N(e~1XD^@I8xcKr^ z^Wx^K5C>ZkPw>JzbSu#YSKfe^iCN~=E1FY{S0q=jO*J)M*?8&7)yo&IUcU0m)bcBr zu1r|AoWcYNPGknD-9*k^$gp)2G2=CS2@_%<-Fc52-uKtmV=aZ5 z1}8+7X|N%DWqLu;JhSO7K-a;|PbiL@nxg(RrQviBFOW+(Q=vc6(Vd{T4fb?H-@yS$ z?#@DA8tbmaV1Mg|&MepI?kQ3YOH!u_UXEA{Qh`WZUl*Y=`z%%=T_?{>6pXIkof^oU^>Bc6Z=KawMP+8g!qJ8I*3%8(!F` zt%u9$m1i=Ea_p{Hav}$> z*$}|hKw#k-z9vQkNXT7v+~9<`pj?GVTt@-5kb!djpr=WF*=yOO=D8CJOT8}c=;t=* zg`aTkj+H zDc{mQHqf_~1}WFkr`FVMNlZJdf4b+;X&$p(=h>B(U&F==kW<>1t}9ZHW*kpU-%?PV z9h3chympg%vMIZ@I3MXi6MOhGZWyxCcx#xcM zVDx#2O0DPDCa%NMPSo?U$RuV}*Cy0Fass6_RiU0CW9OH)VY+a#uQK+W$#@+bZXjXi z04?4W0t-}xft#+p6bkih?!X!iHLO&av>mVD?G`7sDYuVHy?qyRql@zX&Q8CWoW#$a zeRvBhR_7F~-S2BzrXn^gI_X9P$ZgiLcxNFi)pM7;Wb0n(4$twW?xO+Eyod| zwqFBD`X~frPg1kxteV;upP+#rydu(BpWSd}28u^W<);)))O&w*SM+8E2?@3+{m49N zIo261y~&UA66BUCMN+Rdm5i5`?wnYrUgl>~33~rtPPu+Jp?NW|@rWWCmJEjJR=mE^ zXA+f}xUo4W+sz$9c}XnqXq54+HGP6xGrR^C%|>%2Ywi;yr-k`T<*Eg1iSOwp$maIB z+-A3>-b0+qPs(%obsv10ukkC*Ora{fMZJ=dU%N;zj?AVr?X;-1cJ<@+n>}4A3SJZf zX#0~J2Xg8gmna}SF-^aUcDmPv?VxN}@&ZeaKt~RR!^Xu+mL<}yy_`8pBw%GpYo##e zYXV%1;1!yEG`FpzXWF~4H6BQ9?CTlqHSSH+E_$W37O`a674s4;36JkdeZN%hE!2d` z=6DOm2_o%EP0xBa;pNa9yXmAxg>QEml4z1Uu!T5y+e_)m;)VV5kjvA%S`!03J(MfMGqfP& z21~BA16oLs(Zlssb-Ltt9u-#j;0d+R=YFi)>YORZN5qnpkGbzlt(sW+na@dQp9M@wDVhq z;jFTF!b>qFXw$@#O0{TeN>QdK+uwc8fSTu=9Qx;#Rkf&=#@oBI*C7n46;ba2#3g8` z^frQLsGUCrD!r{gI9Ja3oT;&ZmlSZlA!P*27*bNec1;R zmH&XZO2G9-N>)H=09*pvwz8%X4HRo@h7sH(pfnKh(gI2Y0k26w+g4hOFt=iDEz=yZ ztbq72ME;}frq9U(qRoAZ7?JS*sH&HGDKT6O9&5E3<>gxCI-BWfc07t<}+GpRhamq zMvm$`Dhs$8PgT>0`2<;~i2<)iz8Xd?IoJgQ&d!FCbk6-@-6fa~b(j`%R2 zAnP>|d;;Epr!EbjAo7+r@CkUU%O}WoO$48S?Poah1nJa7@Chic$od&)obFUUs*zXp z9hC)KHpAf)WQ8VzPr#N-96mwTX(IRpT;1UC3DTm8;1h6%%O}WA%O{{rD(;*TZLj`m zCE;MV4F@s_!p7gzJ2W^BPb|=ff`$h9MY@VquU`|qTHnESO#9I5#+TANwY%&$Zj;`B z8cX$#>pLnUh2_ti`VP{HDT>st?;uUXUtQ5>hrWZfM2D93HrhO)K^b*$scQCG%q&~9 zS@6);wxJIU3A)`_D=DBgpot=4KwUZCh)FTxF=N-H--x<$z9Exh$X&*eNipPO#*oRw z3Drw$$V_{l)k?0J_;qXk*g{C7_!8;$BmbkG{}ouqht8)n?CTVExK7zV;F8GQW~@r{7%S6ZX6OU zX=En_Y&WDe&uh?XkjdAeWIyV)lwN%gd3PW61ktZ;MCV#mFYVPoLLx^Lgq&lZAe~xx z(5o2|nFlm&7_y~@_l8ybFsv-V(qpo?3VZFHDRAw8`#P=jKBIfuGApQ9mBXe=Mi$J;dci;<)Tu%Ikr97Dnyh!JvbzOImWYhq zNJ`k3y(74!o3c#=NkYEt%s`TWf83<&nS|bQ$r=#w+Wjj4NToU)*U5q;4M<21d;YY6 ziPC>b9GIBDV4`~df(fGE8eH8!{Hh^ezQ9EB3dtClD29@pfr(-&8>7&=|KlHbF$4X6 z2z?;w2>+M}AqkUEwfK!NjI>NFdjO9B(+63MoU`n;r$2F>qtxj;xFj8WR=XBRGQY%_ zAnn%PCG!oW8l8L9+Z;^NF>yd}NjfH3JxIxkN=4Z+fh0!;J5N_dASu9J{kHUXSY_+d z=V+O#si=aj*HpOrt=cH}8sj7dwD!vQ?WM%|O{S=Rt0}7AB#Qd1cE0EJ9SR93hEj|- z=LJ6PH-8U4v)> zzpiPpQROMB%VHIf@;#@dfhzSB*{$!&(tlsD4W*su*L2Hin}5?V+fClPId+DvIhijG~HdR_LWnQ3aD@bwn;XPPazP_>HLQ ziXB&N$C(ki zYJvt6hScI8ByPYzAWZa+2NO#T#~~f2>P^VV$Y?xm&b2c#7D*E_%(qXwOi0X#(GQr- zRYt5Ewu^EpjV5SKoFFF6KW~~h5lbd1g2mq}Soy2Sen`t!RKXrGEhYuDN@T;I2(*LN~-4K$%5K;Go=Rk%rT1N34ITE9S1e|iY1kjlGH|h-559H*BoI{v_4|CLM7GPp#?ss z?<2h}Ugg_?Q-=KFO+hJD_iIUZ1lvU~YqpXbZqesiEiL424-W}qMYoA)e1FfMfY&Bq zyCGdG;2uNTD4^Bp+EP6eou1G-1-;rKfkmaDH+x8Q6468}C0n{C1568vz|+iJ*f>Lj zHToX%ZVwI#B07K=GD?Uqkib$(9M&C^hOtZt_@*v``+B-<+uR*DloTD-l`8ce`M!W6 z2M%0HL18^;q@?9}koj>{8F5z*2Ugfag5e5&NDJ0MS7ZB4b4dZM1{u*{oY5dTL4(sQ zNkFS-CST8zdmwp|W?j_uRs_mdm@t5Ru`UZINb;`Vys@X`$&qh;-^Y)k~JD^up|Ln3~7x#oU+Z3k~=iG+mZy_XGj?VA2X!n z0S!K9NdmrTNErcNF{I>i4TeuM+6y?rkTL=$3@JHHgY}jq;0i;^2)NpilIt|sX-NWZ zGo*}w+YKqXQ-gafNkHqUnKu)vBa`*lp$I24G-!P{lkdCcnVqN4FqU{$gNH3iz+;A# z5%5hzN`|K@8RPUFN(ea3kTL?+8B%h-23J^;fObx;kvUa=j!|`q23K2>fbE8~M!;S} zN)Bl7R!b6ammy^YJZMPCXEk`(k_0?vNErbu&0J3=G+1Lv0@@&vksxua<=UY^{7xEw zVAWk3+-pe!+UQbp@t6=*0&UP}lb~T^XIp+aXp?YYV`rO$1M8A);*!??+VcIcEkAa) z$v9iHw24`4@7k2^_UhlpZi}fh$=d?nMmZ_jZMHuf<)lP*p5T(>OgZ2INlr@aq3uT5 zc*>p=Tvita`8C?EHQJ%?0k8R}2469xtblQIwB074bOrg$+2+Ldh~C~YQIHuYDHV|Y z3HXR1wF|gklaNaW%_**Qo8@iCZ-mgtcD$tBpVnPDX1cUS$*@UD;eRsdM z&S7JvlBvQLEnTb_@UjQB?GEWX<%9xP8Yjv6JtE{)CQ2rFOZ1A`X;#*>wSa>Bc37ub zWu3-D(K7p{nXUdRnSJeMFVR3{R^6aMSz94X7Eqa^IDR*#0?NoLP@_XWw=0OO2jG)nFwF$l776DP!;zIspx&*ySehUQ zY*mS+5vZ=EuKmDQ9|K zC;Q?-_)=HCiIOuPkYr-Z_oN_67mk~Rqdl2Wt=+5d;1W=JiG7d+dg&!davoW8wi1Af z0@fSS+WaRbI~2RU`lpIKglK!0$?r-gzbhH(%3;%$OupV3(OWdbR!l}ih5{s6jqH=J zCF7RtK%CQl|M4ic3UW>-s}o4FKn?F4Urwh{Q5GoaIPFCAoO?vyLGmABg5*EK1j&DZ z36dQm1^EZc-{CNQL!Ngetf>BOE2_WeiYh)VOS7Vi&r1Il)o%ht^;HaJo_iB!B-w@^>C2>G}RMO~oS`JZ4E^ ziQVSQhmw(KzOTcDz7rstbXiWPi6*dTzE3qL)-v+MCOzDzJ54l!t>b65!n$8qQQLjN>}h{eKpREOX}{#Ss;>BlXHNH% zGc-8gk^~fsBD9G?4;n8jnO}+aq7;pR-?51%I!)FJ5KUmwfY)!)VYk*nE$SM1-Y9lW zsgY>Ud+aLvx+ckY&TxO(%*Z#uAjy}&_DQU)gkSke7+mr#x@3tU$!aQz0!VUPBd1dMtK{M+2fp=VlxfJq0^4KvO#;gCJFy9DkK#9#GVf&FN_?^bW9R3-UpWt;gXB=1Y0VVtW<^1s_`0t!7HCEh9zwhUuA z6u}Kfa8|%2niTRr7#tF$#S%k9f~+@{GXie6eBmKMc3D0FZHHPUxsYWA9=T3WN!y{4 z-%m-0tl(?`!TFXd84M3-Aly(@v8ymRt_}ec~Xb6%?(ACOSp6B198dG~mcDcJ0(UFj0`*MzNC1 z!BOoJVr=XIWnkwU1D5prEfbXUJf!aduk=OU7FR*{^A9c4K2`JnoL{7f@6q%Wc(PHZWHb;l30;N62;5@DN3`^)`4f)zQtr81v+mP(9L=6NB#5NpL2t>Bb2^ACeI z`VWK1cjaJ6jsS4{?>`_SHvb6`(f-~pQJwrA)eSwN&*u)BbGoE}hYTs}?>9-y?{+r7 z+ga(h?PAv7MI>PU9u6ZX%Rf47&u_jx-@+xGVZR>RBW8^8*S7wTKN#=PnS(tHE4kEd z(`N;8K%kN6h$I+)Du;=IE(_zSr5;dJ(}TZeGhn7J)u<;mGQ;aaP<-$=u0*&(3)kVm_<&+ zhw&xby}H9za9h6MwtT@Q1Fam3J*FFgqsy_Fv_;1CH%2snYeXw$ps2QK!VJGTecfY8 zrKHFq`w~+nDPW5st;(O)C0E^hb#1H5HKlZUQ6F=7(-r417KHidD%L0T9X5YmgX7K< zDcMpDOKqtNDN_6O;Y$(LaWkahYvpKWwI!9(yB-e{Aulxxk@5Pt1nRCE`291 z4L)s2+v^qAUVSI|0`D`lyK4k~Lem1?H3G_??b4sz9-XhmJ$tdb6HWepUH(LuXprGW1kwQw9MazJqJK2BnuENk`u_9bR+8Y^B$3 zeFxV;4dQh(`~hiPodWCh9VA7tSHE$^2D^=tZKC8WM#(nOXulEM7N4Vp%Cy2xL)<}p zfi@p{fb6KW`TsN>T;lf81|<`u-5QigK(c%ve^>VCVU#h12gnaoY|+Ysl&@quU!!z> z^CfrF()_bpji`6`bKbqtsd$uIQ=ZfJkhdi~B#3Bh+5Jk}62I=Y#NP#5;_rzq@tHF( zu1bdvYPHL}+wizNKBG?=lJ@S^v&}6Vu3YK4%ABRwy?Uq=RWLh%Nxu;kqbMXnM^UBo zk2NTz6jiXNH5E_Y33%9$O3s`^GR`Ilw2afB^bG5X7)bO2$*&YhN;`Y?yY`E^t>b1W zv~Nuf4hbz`^jPb+C5{XIRs+d4ryzf$o)%~YH|Gm(7Qrv-Wo;N61PQL|bOWyQ_6+wf&6lzieKC?w3ED{S1--3cDHKUKC^7E6-6aCa@l41U1E}>lCxi0mu$d}jlUsV za!lJwaxq&X3dnEN*b?7B=dD71JzzM$0wDQY2Fc&#Ff9J8w&oFI)lDyI(9_9K$h$K* zBuJ&nkV<}&zE{iHukV-{fgwS}#sTkI86hzgNTn=vK#M%6?^wETz7* zA`+1z+@OVu{f3b>$gV-Q48us=59(Hq>-#WTIjmWa>AUNiLYrW=Pn!gstVukJ1+kiz zoW-JH+=x!j&|sY<31|hEe5_}_uD!%c5patkT`S;DLrU(}plz#UyqK>yj4RB>vE*X# zrfx;Hq3~JR3W}?Nw6j6E*lv9vhG!?V4$F)#C3E2!nzhbUDXD&gX0<)OMnLHiPFJG- zE)mV&C!&>_NFuw}XxJj6pSBz5=QVgp-$}B-)~F?Sy-Rc>(vg6-NgA_KHu<{&u2Q{7 z<_TUaf^9F_MdKGu$J&o-&^BN4+nr9`mRJn7s1$g>T2VmhE3t`APgpZn3VgsQ)gquM zMOFPqAzCS`?AF@I>5ID>$!XN{|3J#X`%dBf1cWAOf~rs3h_aw+b?#iQp4ZP9B&~&K%`b zor(K&t}Ad!^0OT@J)ROX_;N_sa&!FM1e*v_cD(ZsK8%e8C$_4fQ~t zdL^q!gS#ACKcwLo9h$(>bC|32<3sg&T-KTKX%le08ON<#h6L#}d}~W}RYdoiDkT&B z7R_p_l$?}1bqw5XVqsFihYV?zMCWIRe=;Ps_ZlfBk8#8zlQn>ZPQdMkl)hJkl>r3| zBYNu^-UK6Mm4H@oCSP#L=c`1pew+ip(rey8wM3WEo3xsS1QUs16i}K~jDqbpsx}EI z9afCewA}qmp;+!#&7gm>OXNS4OBQs$Cd2dsK5Iy8p4VX5n7-tguGUqy7%AC%H7NZV z#xsMuh9{kJJmWE}4jI?YsByIO<2mZTwb^Q$Mi9MK#|hCS2GxE^#Sj?+k;OEhvd z;1|DF)1TLOdWKGe)`lgY=h8L2`9?}oz{x>HLrAF8;BHHjigNd>C-fQ(;O7SfJZeb8 zR z(hpTvRF%8m(#v$g3Vo++Md08>H-#+cSM5-bo z9nd849gw8oR=tu5XTIRH2;Qk17)B?zYt|j6O35DGt66uMDoG8Qo8JikK$YWKn01c! zd?SesiZ;AXyVecX#RRl#L5qMp3|HwMY1V}HO1Ql@B%>!$k%>k(4ft*Itd{hgzEhME z*oMHoQ3;F*oHc4}Bs8jW{G?H10&B*5UN9V3KDNAkUin4kcuB-GFEonY2oXLLz=HB} z&?1H*;&~&Op~CY@6P~8l~#SMg#G@GD8D<`Pe{cRCxppK=2ZP(5U5O38{zN z3I|2$C}t%+fQ&W>7%L59In^6;5)?jXqUTjbxWTd2=vCE-h6(pCny7R+XX5g)mw;hh z#0!pBB+~4p0*u6VGT0_qw(-@_nbaUL2{bq%0=~7jmZJ1<$0%0 z0d@guokkWcFJA!g^pgUlZ^9S@v?)%f(BU)2f_pxgrj8BpV1Ra}VTqKNSCq%O_h+$u zl%8Ft74f`ttj478G>w)^2d3)|l#_zz>JBh+p5G+gX)?+TV>|Bl`E_DSMypQ^%o@99 zd`tP-$kk|ZCNa-~@EWj9AYc~p6HrT>G(N&Ro2*SGb>%#6o;Rn?BYbWdZew833(DCs z>my9Q@Kh#S0rT#-IlwYK@1hUg9DuZY7ESQH`HK9pMH5NJ#e{uy(FB4Q0M?=}v8I_n zk-FJ{n%+WdzvW{UeUT+8!eU!fc$O42p64}^5v<27J)7q6NTmB=0=y_x!epRJ!B4OU z+>)X1=s6-+S|uYkd4ShBnbD-oKl+ALbr zQw@Z-{Jjk@zgCvvGQO7cHO|)xEj-fAXi*)ww5TPxw19A?kK*fSzE<*e3}37GI+m~F z_<9mwPv+}*zE0rlM82NF*GYVx%-2)-dKzC(=WBwmQ}}uYU#If*OunAQ*R%P04qvD7 zbvj?qny(3@^v;}>-ai{uXFi&0blF+dLduu@%19U&gbjJ zd{sVp3BwJ1UC7r(d|k}fC46n<>r%d6%GYIlUC!6b_b-u|B{4WS(IdL!e3jpDW`tju(NAL{gYe3DoNLWvt2_+^D%llt;THWc9YJ7F4 zwQZv(7qG22GWvjuNnY$W21W*>U(}ScYDJ00z5$@@yP6#SasUC}^I8JoeE|+)e?v+5 z3jr0;eu?K`B1@>8FbU^)NA;+_-zyU7lBE`lA)GrL*Ovp)r=eUHC zlLLns`4~wXA2`Cu{lqpQpnhwQ+nE?R=0$%(y}>8EJ^HHdWBD_b8+jAT4^+~fT&Db+ z9>Y|x{HZ9zr$Au&)0JNAbO6zFaiLH7PBQ|rozVtO4S$72E(`w~S5;P4A{pL4!P37} zqTYEivSswM#6;LlM8gWjw}`x=!1HbZHPA(6@!2GH z9D($S&;IpD7p?mWR&rZ9hdS(?#H_@Pe*qc^FWz`^AgO?#Y(NSY;ICohOAj-`-(SZs zeU*`BW?RPUB40(__jA_*v~&|f8el00eAAdqVFv}@$V>{pdCY9sPr=*AoO_DE+s2T7 zivFQ7H$YDX-{R13AM+k`Nzq;Y502>o{S;L&y^1^P#a@OkWq-znKA}f~JXa0{LVpUg z6QzKMUJtV&*fBzHg_XCHRYPxwj|6B-ps zFha%(jgCxXn(D6q@9uTN!pZ1FC%xJ3gn!~7K==aY_rJp$aagI8`;SSYdtfvi;)MXK)|fX9!9=J zNNr>{;X&sk(qRz$o2hdJiEA`(>?P2|w3NTq`{MJ70$Ya$7Sabs6Ura9Q!$P9(;CMoZZ z)F_O5oQc#sST@q&U~Q3Q4z?+hbg<4yi-UDV)+>x#?}@Z4jQh|V>2;i*^aO5$Cy-G6wC33*Q9*JNx9HSrToz#I#*&xq3usy0~-_Ahjtq_kPg}G2f z&pt**=v9ajq|25q8di09AS%OZ`Z6*m9AP#_s=^~IGA=yQA}8yK&1@6HF%;Yo93>9&Y=fb&r=0Z_D*9|Vs<3%jY(jg(l?rRdvK9Iq(hCkKH&NNc;e^8ehs^p! zc$&hVp!j_tT%#~r*F#T->mBS{;iSTNiv1|ut}vcrKMD6bW&a)C;*|X|yiH-xPzx`I zal93!fu~RG&dD@GPW>)aiF&6IDLQg8DaNF*7kdHlB=VrxtAI}D@>hCS0Q^4xR$+#Kzu^~5=5Jxwr4*sVp$0~HppJxk8R5C~ zQfLb!Z0=V=+ZbVKuZFf;w%>(zGQt}CK6I}|{uJ8fMW>??`iwd+TBpI-yV*jKsI`5< zvoNx}7H~$>ntgOSK?2%?qm=+^X!Kl_Bfc~SaJ@=98NM*VwV3CkdWM-kzrn&6lX%Z# z`X#*^x^mbW`4mv3>96+0c| zioFWKA(=P&$^#CPJfaZpNRt=jMj2@iJILy&LVBRz=&RxiVQDRu3L#e;eNBx*SkZO$ z3Zd+8^t+P^p_Fg*dsZui+;w!SMIi%J(z-tAMUTVS^cnM;=-V2se1KhbLggpfT%=&- zr_|7pr&NAg4Gp3rtk1eGm8a zi%Q^HuvG4!;KhhHdM-)8C$K!aSwUW~Jw|gQ_5qYT@#QWO9s4M*lPHSBK9yTcn~5sg z#ON6G1Tk_TdM1~VB7ur)M^NC!C>X?ko68eJ$X5Z)kw~K)8;cT0DO2n=eL*e{Deee+ z7s*yllMltRx!e>d-B@~SZZS7#TO|p)!;cP+Q7Ot2j-ZBD_IYjg&_%)6YoJW}6E4w! z-usQ-3wGYNT7pJ8dCwzg)K#m1;8g~a_k>H*X zmyu~I;=#QNVgN+RyP#DjPalwNMqm;7Zq~LQ3yAMYv6&D2$g{E$= zn5t~Wg3k(itSK9AT2SRohe@5QqJ6Z?3M$QZCRHdoYp}^+7ll zcZAW4gX_ZFz0<#wl#QkgjY5K9zmbb7gXqqR&*+7r5Rq)uicoD0i3+W zW`ciG9WG@Jy5@-M)v0OCh+9=n3QHqy(=};Mj<{WWDg6rMh&!~GlFShw3aAYCCscB$ zc3Bqi;eg%wjkrtuFPGdMP&+?Hc4}v)VHxp}zzi=cPgX^~QKr7=K*7vF>?m3|y~@9W z{*9@l;qPiaqJ_(g(N9lKqSLb2X@GPs8bDrCy;vQnWevE{r($bB#TdI{@wURET$8-d ziw@{YW8V*HIB6c+!(ojI$G%sELE1Kr?NiGP!~F^7VR%4Ac!md6glBlOitr3yx6Sfz z*=6Ca`z(C@K?}d{h!>S#n;dy}g7j(+j#L8a{CwmltJuiS*Lj(sli877l`7;j(yf;X zQekAz9#uj^G_v%vGp)m+Q81*I}g$%tD#KgkUcg1|E)6Is@QJH|Pw21IhdK zc8?>+2SUggcapf>B5t2rU9cB^*$IWm+=%v?tI_XuDCCy@5L8P5Bgcbk2}ogwT=A!% zS^^mPbFiKR>n17*gqB$(7+TK=4P!+_?U}gz0Ga zh1fo9Ms@lGI(SGY1X4U)4}u)npoWxEh(K1&0EXdaF>QEUOr!=I17@4Rw{BKfsvQ7fX zIU{Fib;*|_XK4+&M!g1|H!l%VJIi98p36~sxu$EECVxG*sm zP#c_QgzHFbY=VNGiCQ}Mo(`%Cbhd=Ur5)Y|FS-U?^cmLxo$*cFxOqIhHzz=vuZH(7 zf-hFXyMW*Y6THc^kn$`II&j#F{u3DJb5bMATX)hWM&3yamAoG&P`t>>J8AJ`M@Gbp zz61vPoV$;noJjNBCdYXf5eXiq?Y>13J9f-sw931 zFL?UPtV?+HRNpBr>FQ1FpulV*x=$KOJtm>Xk zqZ@xLqVE3_)nDOVH=>6MGspZ!8XO`Qsa^XZd9d_pPtGc?ihsvDR9xAh~{WBM+ z+Mg}6E$n4j*X|nS)b1K(Yxi)0s@*%v>e@HT`ud13yR+cS&MX*l&@DOWlvLaqrcJ%J z+nr(4V#SBUwEfX~JsEfOdNOXf;!kmb((CCsiPAO3yEVo;H6}VWPLDUjO;qhu;?}FC zI6SAtt*u=6)VQ^R3r~(y4y9x!;+Gluimv@{W1QSpBi(TdS@=w%gg3SlRVKAyq*Vxb z-W`(Xogw)#7ig~PO2kP&ft1`-K|5Qz;P#jSF&sK1RP`w`U7uV1K;`n)RckrtwJ^-0B4T?{qgDYkAe~oFY|7(oKP8sC$ zG3vO2_rQKx3i zsafvUTq!kIIyI9{%~ej#W~M7Uu8vvXToa?bQ(NYJBJq8W#2Xxm?{_5L=<0Hx)V$BB zdB0P0ms9f-Zp}YP%|AFbk2^L0=+ykPTk~R>Js0!rQDe7&L#)7@@$n=XG0`2niE8Y~ zF}!#aPv_|hCXY~HGermmt|s5-bMg39#H_%pEwzPs9jd1!Kjlb%%1VCPO8yqlDiwWx z=s0xzhXL!GKMGI<)u-nJPK}vPpW-uvwnk0R)|iFU81zlGvD9s2snf=#P8-X(4dpAB z6@ga-Yy`NR>ni>g0ooMn*6wgyyTfViLr!aVIxXDgNcynqsj}ps9ZUY%TJm*k$v5n1 z{Eet;H2!L-ZxK}~83@>*;srRUDD!;FHR!h-gFfRJ^cgm&l6264zs)>~UJQ2mzZ0bI zhg~@`NUj!39W5?(v{>d2>w34wdZ$LKQ)7c$<9fHo^-hiV1#KX_!Rg(NLAxw{fGcZl zPYd(dDEB;#vkHN!K*6Vne{{a|bxPQVpR>X=5*`O6HPXABk={iQdFf`p6mpvRQpo!H zmqS+EVZil;0DwzWx~pelSEwJKlNt$DgAO z$ga8wjBnu`#|$PboD_x$)F*yDmsc+Zkv{S7RE?cUKr;w6p}UWHDFCyGvPppJ1h_?j zy9M~90G}1$ivoN@fbRmReM9fJNHCq1#P1qYHan0RL7VF8@^gp`;#bDRW(U#}2(4oZ zE@TPT=Mdz8c`Wb4!TjG<<5}|r2+S};fO-Lz5O4J=y5bYRU-$JrQhu!fn+3R8fV%|v zgaH36z!wDgKLUIQz?>fo_DcbNN94ZmeBxi#!uEl{!oDWJGtBryVLYZ8e=g-O3-D)V z4D0C^|BGfE148|&xUksiR9rn*n0~047EAd`0p10G`>;`fegSS2;7$SV2Y}Ad6`%Oe zwA6nCfm{8$0N)0{QvXwcUjXo`e@9n*;!o?Ue*vLBf`GyGD*09}(cw0z53hmj(Ey0RI8NtNs~X@rjSp?HmQ6 z{x~k&7{|Bj3LWL*6ExE)Ak?3Y3p3SHarGs_bcSYHA>}OsWB_m|>;=H8s~1Ta-==BA z^dFFSSKk3P`oy1!PUM#E6G@)|Q2(zY<*Ncb1EBg4E?jFvIL5VJBtrEuA>XRWZ-Kz& zv1;AwNdim};Cult6rd46brUY!#H*o-`V< z)AQ%(uEk!V&ZFWUIF$KZ|&2(;ZwE71)xrAc?7}gdm!^*{uBUf^(z5h12Fe3T+F9>o)}?YxeA$! zLE!dR0;qo%E-Ygs@m1eNSA638xvBesGVg-`>OYSQ^L~xEst?i?pZMci@((~@?*9f* z{}L|D{YT=f4s!Yr?x!?&IS9->9zgw6T$p>N02c{xDFCl}HC^$EAJp~V4FcEi08l@O z3)jDi_^R)sD?ah>Y3}<$P(1-q|9M7zjRX+gKzl4kG2XR#g zC7Av~`XMoNJb?PCTwMJm4In=8&ub6*4;kA365!VY{2oB<+qlRlP8Hub3aVt{X92!& zB3<<-jC*|BsEX>fni#)%l*)J7Kww4t1o!}e>e<5gbbKoJszHiZP>G!-&&AJhW=Zu~ zlEOSNYBblY1%ZJD0Jx#c1h@)7ExvIuA3FYyH&m!FFp3K7EK5tR9spkTfUXw5PP5;X z%l>|0ze9kJ3Ge_3sIAc>0@#b8==6 zQNVPyVp?jMd)zYWZ1@ium_F5ais`?oyjWeZ7=FqswoX@{bBI zB*4E2@D%_y`C3t_mRQc2ym`y7;+FYxQ6L$-#k(lb9IAZ#%!>l60=3?}!Mt*B-j00Q z{7>i8ipkzFRmJhLijnXivp`@>G9_MG*24$?q^(c zmN)P1ymG%qnt~sMIAfPDm22I{TrF+lZ;y5Ps=yp?-n5*8HNjg+o8WD@`b7OFi>mWC zxH@=yKJPD>cXmGS_I%#o7UR7mpZ8VaZO+lUnYCUOy8AGyBtv%}fhh-bILIJ=ZG8RP z87EW0$VFW2pHJ4N%q?%?wvE9b85Y;0!{U1QB;DfeIelry5a*8@4ZEw$Re@Ueov*Nv z+1|y07V!W`RqmGC6Vr!3O)l6|Q~uxtRleXMN3VHbb`a%ZMNN6=RNcV$3e+j!KR9}pZeWZts7$G%9e$1Lz_$6NG6yzdfH;D5fvC-r*|{N{edrCDy3m%=Z?2(iNKT zbKbmfISk_Wxk2?Rj>#&t8Z&%@!%bc8yi_4+l?f?DRsI3j&I_$WdOjktTe?LVYZfcNqeRP}(dD@zkQJ zC3L>wt4>>yHGx?iChnM`wLjP7`jjMKY26krl;(T$*5okS+|--*#dWfblL%Xa7L-@q z_U`}J85TVH9;-vaRPY-PgVFr&38HMhf04}bw>jdPc#SeM?G+AsSeH)7_3E&=em5+x z|EsxjvTUVKliK0wv8qg2JHcIov>|HNTPTXDtMoEJD_>y;Q)&Hu;$Q_5rec%zV-@6- zdH!w8_HiypP%G(i#hev=p$M9jh!yGu=E0*JK`}x)t52_9*b7n->ZIaW-)M4_daz38VBy>nM8-$Xwq8g}PMR$OY^t2Um6#yMBA>6MZB@f?}r0d_sr?oz}! z_wf#GHXk3*xq-V8qew>f_-alINwUX+XB}FB@aN6@ABRCL?cTgsa%jpyacpsfg3$?= zrSG$r@TV#3U8ipfRX&6uxFUy07Aj0DPJpo+N0}e*{4@Su%IBe-RJ(51C}?y#7;guUtyn;UFtl6Rm^UpD86cfCT-#vfZF? zVtW0Ws9i*@TSrm57^~cN3(C5ad0~PgvL4~`+QM6#6HLopx?VB4pDJGN&C54u;l3D) zJfnI+HoQI0hKB3E6j#2i9P92Jt$nJ9MIJt3d9d=D6IcI|RKGFDXI6#pPTU*CAdgfp zrHgnA-1du^@pmH4Wp-TU^%CXJ>GB189Bqm;%7t^UnL%emvhEvRj6`L098-8fIKGh zinRBTl>76@oU#39=0a#IBISE*dxYE~| z5A_Z3K1^|1ssyN4n%cf!#tTRrm;+8G6C{#1!n@TXKHuZThZePkhp>U<69Z)Sd^ znSJSonwi<0I;+qLtbu9^MQ;i5pZ%QBS-vX`DRg9B@q-r$R0}9p8r*Xpj1J)WYoOV2wJcI@bNyjwZ zsUp=64YPXgG}JZ=R(^n_<6FT?$T_2Xt2W_VEPfu(_X|4>UaS{Iljuk277}m8Sbo;A z>UR3tD`v?@9I|4ZkVlDGN>vXDQ;Z2q*7|&{s6MQtt~c7LrzFKKrHX%fQg!dS;^OFm zSjD=C6sq`AxT+W5JE#jiZOOk(;l&74ZTwobK?d_woiB!!<(Qo>^!TV|Zx7R7Texap z>nKUwTFTGD%BHH7lP!}LG%1gAhC@-BJQ`9m7DK8xVGjLtPgM;a!Nv$=p3qrisunYe ze(*?Zd!{+A;d0WNv%xA-2Ppsr+kl@nZDH z)UgA=C(*B4DxH7h_B(i8a5L1c`W1Na`zORnzXqckz0zs490xsB8G5K9Rtazt{h%mw zgSAKthbY|_e&QDvN8KP0F+DZ+5fG+fRqF#(D#cl!a z{7eNivISU$5xW8pQw0*@#Xb*k68-5tmqk7qc!tXOZ{B0yr84?kQ&n$Bb&x76O7Ip% zA#+rbVU*3H=LZUUbOPs9Ra;rjvj9$_;b6%l|H&~O_sFR1^lb?>Kp*<;c>NIX{iCTD z`k6O8qjCS}Un3G&eAj52K^FhG5C6nydiuOEc=tFG9RKv_zilA&o@I;ek;^_cnpC!B53pd1e`a(K_$G|fAUEB@;Jtt1Vy|8;cvOah(+fr0M< zsQ)QlekG*W1b7PoKSB|M_6(dPz!U+_2VkE(Sv2|_{X_|~t4DU`frUQt#iP&RHZPUR z%~VpoUdoq@uHy18CM>v7)2VKO1R(z_OjvutJx-F@jOGn#)M?L4Ddpr>r~H?+|Ul;`d+ z=(z>*gNZVP@$6tV}}P4WG9?Cq}PjO=``GAF#S|qt3y!5#xOnBRmFdMxRCfq zo-&-Eq*m}>6^wTr=xKS;(ehJD;6*94!;P8M-Cd;2f->Th0bXouysfw`#PvEz0>|4J z{oD$xTk%)B3aUS~_XSd_saaq1vzl6p zfG_3B;Y)&Fpuz{>z+UVt04LGUgQ)ffRePLwvgK5#?+8^HrE;8s8W>5s?4%pbsMwxfM02I zSZ6V8nX#|1W!UV-1@+(X%;Wj3|N3$s2M4wIUBrPv!SfyXVqW+ZeZgq@Yd!^E!m&;* zjtiZIa?xn|s~tsO?7&NyUujWsf0%yINofIu)^x5>@p0$Rpo4w<=Vyuw$n_h@JoKle zY?)w(%Ahz`<9<(?Nd|FJ`(Pdal~fhaNMi|S_Rx4b8AyzNayRx1v{OdEeMg_rFQc*F z6M=r?jtPHoe!?=SXzyI#vA{bPc*g?oSl}HCykmiPEbxv6-m$eI7k&25|8mIkn)F5TKXr*&>kYqmB$-D{jT^SYkCO*7kD z`?`9%xAyd>GOYuxGk^2QBQHL7$FJ{u{8wN7=&!#1kzYUX;LO^ZTKqq&W@guhY-XUd ze`aULhQ8Lmt?T;xJ5&9Ao2%0hwvL3Y%N4dRU)VYkwr;~La!o3H?ut*ULT)GIiqB4t?ve=@fEO~WPQL%-K zSZ3iO5_sw2D~bs$QbYm^6fItOMdOMU%NG_KB3oW~oJ={%FEGTWoXwCwVzwOe3yh5^ zXM>!mK6ymJK`F38rCz@gZ^n zvorUS#$q)ZQB=Iv>=RU*U8vro6)Ue^y1aQ=p?apQKzp`q>7u!It<=HDmgZY~VbkI| za`}Rjhz7X${3=q!!v1oex^U)WT9?y9oF^OnmU8AVGu)hbZ5c-cbyUu!c_T}9}rJO6BeJiKZqnn^=({yS#sg!c3W`8 zN-Q9`TPmWsv4~mRAfpJ5move2V8!7~WhS`ukO|GJn;I9|^hwonCL|MF7grqY;N-=| z@=SMpP~%C@-8-&KHa0C>y?o`Bx&2+zxVUL;(r&04ugt}1OS24_*~(N?BQ{jcmXk^r zuUOuAGH)3SKGmG>bbs@BiE@{P$9S7)Dm~E?5OJq z$rY}8GpxqZyX8ym5V+FSRMlanIoW7;2M*WLY6-Thmp7)aZd#aJV*^ZX;YxI@kWN=NUX4L*ZYBp>y&QY@Tt~>U zyRwap52{^hnQ3~bR<3cBW6J7fjmsU{lEy`AE~SaQEVasL;}Wg<4)q#)YSQ1{(>LG^ zVgk&Xn;P&sdvIcubEMMWaeWpA8~b{_j*KVgFWGc&YGYr|U~dYoy7I_5a*R%?}m;6$m46f*VU8h^#)SCeObEp^bg=h z2T$H=Z*_`v%aOqyxTP3_YeRc~uwe>RoQ_6>Bj zb);JdvMHRQb+m1zLNDFZ-R5<*Zb@~uUfa`0B?{~47ObP&EhEg7WxF$~n*)8V-Tl2} z`qsgLc62i9wRU#)T$k$1Zfs3&P4#8Fvm1K`I$8&Cbmz79rR!3ej{epSomq@QTW2aw zHL~65zOB6jse$$^HJSFZTL#cV7RO}$UTgP22gLMtwr=&(8`1#NJ$;!}e{W~Uz(7a$ zMo-K0H8s#T*qu(bleGS9KOG#V20GH4vKW#!Xt<#@y~!iXpxS#=>DE+d2Zp3C+nNDe zSGH$R`O@rK7`DA%Xk>vLv~>&WP!FN@7Oh&pka}V4o{X1DEo^F9xHi?i{F=tp>b1$n zRLa}Xnt^6$w5wyl%d~fq;1oQiGu!Q@J9^u3)H&FJ@nWsoQke}KJs#^`2HR47=yxw) z+fo~|1L#1yJ?r%kv|=EP3s6TKC)TJV9zM_ohh*zuQee!w;RF2xaE0D%wvRo>>$wh^ z4Ysv`*w=cUH_*D#V?K2znriLuo<-%xQMb&gxsVA18~QzcW{V-{>uBxtaKf4D!9?rm z?;nJGlGi`DfevsPR%DMjHiNqxZorpRSGI2>IgHz8cWW0Mgr|_uxoM({R1$-Jwe|IM zd0VrXD>(7>GH|5!oHcJh~?^JC0%Wx$Lrn1iuGM=Ru!4r_&g~kgg|s^ zU~4ZR_%vL)ZxGetn!T+9?KEr%A*sRs){U5S;IvqGKaV!orD5Ws>ar&9!n}Z3beF~u z_7Iz+_fA1iFXopNvASt^q>4J29{q!zh|AO=7dmx8X<5H^i+ z5Cxl7yA7j9@s4bVP~u`duA)1>FF>$|P#%n4mrunVd~?y((W%2Fg}Mx49feN7y_+nY z9_-tU;q2>gb%TU7BQ{1`N*oO-c?LH^!)=CxtZ7SIQwS)S0C1CZU#B4#@= z;4{mhS>|+@=5lhtZaX2AZ+2r^zzHB|v*{w05W$ql>QR70Ej1KG5dC}1O2vUmEn2h^ z=><&gDOpmpUVCeIroX*)6LqkE5Roh0*+GWy_b?|?W=ZbOUI*>nRS^8VbYuNVDGSkH zq*^;Sva5O7bf&*GM`0RD=An5Ag}eIwixtO54!>%RG1V0+ae|g)^26*Fcwjdokqnwk z6y~3*axSd&t`C=$@t*SfI_lL{=rC>iL?Vy^I-N*9$7=tY-ok4#9X0&Rl>gMC?@@p#$Z zo^-nhS4G0M5uWy5Y(x#HqrVQbIT$zKcp^oAa`?8+j*abDDG)o2@u_`9Pa%wBqzC(` z3Av|`)^`g7Cqk?TEwAk8G&U)cja8oM!D569xfbP_0uOd$y-6dYNDAf>l=*ZX zn_~&-v9X2_U|TXXHWL~4U85|Gx*0#Lj{`J@kcsSVU=YIxH_OaXUax0?sfq%zJ2N6q z&N79B_)BpRhj~EXkBce5MW=Hz=czf6=)3Tae)<~N;RDg|A*a@9v|*shBe9zHWv$rR zn0~>b9E6=$gsGzXZXeg z*^TKzG@5I;^|ZBd1)w}VRf*>8%&I~a4=8`v5rV2gD-v*BM|TGM!+{>2unOZgc|Gag zkh(tG*8?xlA~PH8!@7;20!O2iRd#w5n>NCPFl2fYxhDAp^+0@s?$igmlWKHFFX%?y z(0A5f!@|WqpwL2evIg%nQ<PI+9Wdr< zdn-mN-oMgd!F_(@8c7IB?) zwPVC&@hlv93}$iMVNJprgTwy+(Dpv?U5))8|JvF4*w$8Cty;Be)nX}`8j`siQfpf* ziZFMRsnDOLrBKvbgi#1#7{Uu=E2*3AruGf2Ad-XZr$K&_- zJ$|3ZqduSWJg@V*-q)XVUDvtJ`FsX5cSaU8f0;eYsBf&@c${pFpEiAb#l-L#+bo%e zjyJQS76zu(OIkqyreg}GO}3W|F5VBUM5xNPJoge) z3)1G#vI=mZjNB5$8P5&3Wr4_E(^jWkD3v$fjIy#Ug;{nm9j^!$y%beWt&kd)^&YqA zWJcvyrL=3w_Jv{-RA!6h%B3aPF34Un#Y{5&OK|NZv(5`9OGjvnRFAsyaa>cMIQ@0?X(uHhwNcj7J$(=5z1XCUa#4f;Q`jjA#=6Pz7^ zf$i<=E;BS(=b%!9O|!0No1+dMw!uo;_RyAP-`wHao&Q(KT1807BCO`zOE-LxG*X$a z+C_!~VafU!PM4s8Q2;ZW9a@y1n{_P?(|Jvog_p@wQM|T43oh4f3Z{pX^n>X$&PN+( zbNL5hnG;$Th%dS{STG2ROM;v!gZZVlyEheQ4~*V)4(yK7XizdOu92IYgWJ@DQ%zRy z%<8P1fA|m#h?0+BN?`(#p?RXYTsA9E<7Gizt}ui6q&3>kELhnMl;+aaUgDXemj3C$ zQbPHK6K2V3+oiIgA52`_hB$G`EE()&no?mdYMh}P7fHbs(kw5#`wr?hTkLg)trpxC zPV<$t8oJS$*@tqIE1S@Pk=#tX-2JlBcfn*C^WETGKQo(i^+9MdzL|ym7CX#?xiZw6 z+XHqLpv7JrMzrICsghY3mJ5i323RwJc2*KZ(!$j&1nH%wUNyH=*b;MwrxwR!uawRt zofF9Y3}+?!KnWgH=w{b}Vx4{I`4zL|zLH!5v`9gFKUw@}SueU{;-we1JVNFu7s(7o zMx2&|H(E@1tif0vR8PgM39<^^9EVvgF$HPwWx18<)*03rb+?Q`!Ig=77o0DPsR!;SIE`NxmE8$akc*%-$`u5kXSVU$Ns?*O%_#&&O^uQ< zC!z6D8qEhtNcK9TnM5mJ(^-p>XQT!PXOyXMX|o5)Nlo0Tj5+1xv^{G4z=P6anK@jf zEp#Tapva>HVv*e~x)#S_t??M%)Lv^ILI52_?+kHJu(W!-$V*`+Wz<7C06d8c%Y zmBHGVxvX|?Gaq!63|TTMY0-#+M4k24pczZno866oPeBuk+dkX|XC~hV=P0K-P`dV^TRwQjlf&p%`csC8fJg3{4+1}vthhH zOVB#AQ(oqG_+mnxWv9o z`?epX8@C_q(BHh*ok+}7Y58RPDd-;UM_FGpvj`)R%F~!iZ9$fzAWO~n-b&@GXr;l| z;!5q;;Yzi3W>%KV(vdiLF>-Hd(zIDqt+zP|?RVDXca_YBbVnCnI_-Rf-aJg0siZwZ zZ!Oy`^F+b{e&Cb2du+F)L$)7e;oW{Pi|oyxWFfuzvn-a|&qz&v@iQ2GJ$SOZQ;teT`c*CoFUq1Mq zBgKBFNQ3P3{m3XkCgPpg;CG048)8J1U*)%oc(24X#HPsE)6#fTOe?=jV*6shRZ(o* zL3{URnRH`wI`{)6Hu?IXRHE=6?OiCJL?XWL_KC0bJ9>%6)f|y(%E0^YRfT?H{5O8be-?Sk zh5n(%BmLBoeunHnw$L9CDK7F;M@X<$krLzj(7DF-<1CYp_*o{nR4>t#?PZ0r+3m&X zO23PDMWGaFp`R^>q!#{gP7Ic$_Ek+@`o z_s=VoJf?Uxv2w7NSSU2j`*xnmxbNK_Yqk?)y8+t`UTcXh{wcBXBa36RJNUVhEh$%j zh*X9t@Dlkfz6n*feME}=)QB7sDe&8kmShY4o`t^TOiDqte)1weVTAl2DHLI!_$T}> zMN%nGUTuQ;I#KFW+)X=cS*N37v)cRJyx*>hUujCGPy7t?*3C;Q^!tnqqUjwe^8Jy; zew)~=j%cXTN=N(0R{KX5`TdF_Uc<#wIT3GT2dM)o{*k6=qyb6suf5n5|0day6!Gd0 zk$UYl%J?7A+(KTKqBY5Qo90$Uyf?h~JSm=J@7d0#xY~G2rd0Wv67(R+qd6N!`8{MS zS#o%k9JBK>Q{qxYcc&Nn{ZIA%Q~l1~9I4*Z{kHL!`E5q|ZAbW>rCj8g&XH@(v8Gu@ zyp@-jLND}evm6oeo=lf8QoQzZR=qgM)T_58y~=`HpQx!S&RKMHsqES+e-e+;*8o$HuIDg?n zzpWH%5Mo*oqMT@{=0lYjiOZc6Oxbt? zM+L~22Gx6=?-%*$3;aQnRuE3H^dW_QM>+8e{nqB#V!xfVE@8(Nis8cGqv^T)>;064 zzQ4#%x!U*F2mi;PQ0%8jJ6tF&C9z0)5NS7(NE`2sm@17-V#<`(Am@d&kv}FEN>pBT zCn3e={FBtAJ+m4ibWd#r^(plGR@t-r)r*3&TauRs`!6ZCcEx^o zkz^P8c|mtMFygh9(vW`O!b1O;i1(^^pI{J*E$F-IFEqurO?F9veH<^DmjnJ?DkUS^ zU$x%twToZr-PuY0yY?az@%5%Cq-Pu@{YX~{px950?VlDj)DEUYH)Ry@Zk}fvk$6h! zM7({m4MC6bkD1~i1^!6V?rJIVY}rbP%`!R}8sy_(2`o|^@gA6IPTBPxf?9gzVu?je z-cOf0H6@cGwK39fEhCnE7$IfYM!K%yewv)9;?yp3z28mV7)FvGU$3!rR{t(vBC8I z_jhiHc%My_c9aOq=quq`o?>L8$M& z9Y|A+R5C5aWb~%O-s>#KJ~1)q18?jWRQ^w*=LeZV_xR}e z_)1%WFDC4kBs+ND$5shQ^KOv}mEsj94e5tinVpRc$|^YZw#+nbXq616eIs6Ng0vyY zdB33B?ihcm?^pZj#ddBJ*~adW^SJP7FEdC+RSyE#GLif{mUL zuUA#jyZCZ8<&KmpH0MH*KTO`GnA=L9C4u(}0zbqAUR)&ehSt>$+A2{ldV= z0#mWlr1q9q$tmRBC_4-=ldr>LvpV=kjx;0Fke0pg4iP7N%Z=e|GdBEKE|n$Y%Ckvk zvLBp|M@sSbk&n_nJdDYnOwyczqAq9vO&!pO?4B9Sk_x<=rHltl+mm)EZ7-N&4;N?} zW&*Ycn(d$|nR%}i)2-4ZCHXzlCS|K;rfCCvB$gQGbB^Rl2JuL>l$i85et#(p=|;O3 z`6o!2a&F74Q~pmi)$Z-QD)7Dg;-J6wKIu~B4=eJsM*5v)td`mNVdfASg1Z;{9ftdv zqx=psOV#=Ly+J4YMVCVF-V3E_qy*lUHqpAsZ)>Jri895Nqor^1ZQpdy6iLMQzHDFU z-7`f>^eYjkmiSrH07WZDKOk2JlC7VnR>{zFqfFhTGV7%UCwSZJlwNjzH#IQ1wOyfn z6qDQ9$$$ToBjorG+69?;bgDVz137-6w7VnBq(%OyY=3(_ zMSF`)=zB@%7L(8}F>m9|vc)A{1HG@rN>a@*mGDZOl#{pq%0ho+&=!Ku+#hWc-fOeH zShBs>Wcvomb{jJtm3`Z%G{|AKLL{qCh)06=o_NUBi|qW=9{7M9_^CN?g_+*siwFW4vqR43jEekQT)J*Cj#0El4Z${<=hr7N#}$ ziHl_d`j)iAHr{{bNJ(?UB_@Uq(gCB=8th@O$zcuVu(xHGGzK$E^dr@NTQis3BbO(C zlflfSja`M_BjO~P`a%Mg8NCdMGVQ_`x6n^Cm7-&e-+GbXQN|Y;WpsQ=_Wsk_oNrH- zR(bFCE;J*vjCdnEev-81D{PEPoqRsIpNS)Ki(hX*J7An7*qhx>zz z{OlsXLxF@*Xj|Y9!DQ;@U^4ZColJeuYqyLC=S$fnM|RsD`?d2-**5eFW-cqt#Ho2# zoy^aZy(TlQG?(%2u1^E+2gF-;z1d>d&B3l8?5^|NgPsodyk+;i+Tx)91yS54QOF7Z zp3F@B!>au;QpPdf?NSbhd*Ajh^iPuyQp{$kN%z*wmRxim;ine`r)_tESu*qeQhLHn z8F6J=BbR*c`TJ?myFDN~V!ThwgSq93ZoB>D>muHNCP>fGP1C)gI zE&*gnr!Rec@9#`!EFU_{n37<}l&to_%0cZ#W*D*KdyI784KkVVmSk?9%DCrKv8`}N$QKYb>vp<3KK zdmooe+i+GijJM3^+M6Lg(|cKx9wf&}M`zRR=e;KB4iS_q1L{#Sln(a?75k?M=pd^? zvJxfhGSUU#e}U;^KFg3$DonYoHf1G)`1hGrey;7{21*Avbhv+5k$WbBvRmYmlMgmyh_$;;`3#& zpCQ)^$I6wKoYwthfGzM68ob$6r%Eq6OWK%e{MX=fFj{meERraS{El)(evOIcC1Ws9 zrtoc~DarQ68D{>nu1%0r$w}|n{^{nrrK99=^^D!#+mevvQRbYoe%nD>qnwd)*mZJP zviGa(JXB&0=9rR?ai->iA0ny%(pOuEcveMf#5y0-fljB zTTx}&+CAp;mlX|WYH*(m{}`JkBuH7xUO*&#kVWk>cXzsvKoQ5d;i3}nA7fwcByfx-7Cij5~% zp2=RV6ltp0)^s4Z%8(LRWy;BC*2;1Uy=Sfp>^8TOEx80*Bb!;WEYZr)!bpLv=g16L zVqKroV9NWI=@PPRe&1F`FmFe&eDK&@xuEghmpPj>tHj9lQWb^X19OAJ_L{=?p0AXI zgXyfRCzgc~N$lVAOlKznJthkuZM+9( ziFr`sl5moQ`^Xh$_1kNbzDiu{WUk&h;(ab#nQ|GtP}-{Om!tpZ%L1C%Efay9KtIT) zS)(=W%+K*=nxl6n>Wm;0HmcnSJ{%ukx;y%D}AO z@`+?_(bY2k$g-f^WHYm!Z0XUHy-AYGMsbj?#vK2VS=^VFAr0a%(a8#$e}qIOQ%Tdy zJR$v?r2UobO+MAnUGFE4kQO*px(6u+Z<+LRW?)P)ow8|x)lxE5eixH%b8d;B?Qz?9 zrY9RA8dKRpi;Ik0+|L2ke6us=+8{AD|J&XyNW%z zF6(TrUCkU%uIW-`q0pC}^Ob3mH*bBaoV2NhvSnJu`ruR0>|T;PBIX{V_swO}{-k7r zE7f;q8`)Fwrmv5GDmc?~&1cgV7n#=ornxl9m#$n^9ZY6lmLLmc%k+b0tze(HnVd)q z?qpkVT8Wg5Ib{M5FI8&kSSgMasTXsBD_1?OP2(&u_cR8}jzeXut+#fLZBx>Ry?2QH zm?nkSccDM9$i%T^wiKuLqXc?FP_A+&dT&URYIBXBFx>BK*IGNs>?*j3mewSbkzyt{*rZqZ>yX0d7Rg*}j+wkgylwH4di`wEj^8|_ z!F#@y9NN~qV~)I;?m@C6Cr?|+f+?0Pvn6u~Njq7Zq8xMMY|}%E&*M_C$=<)DbRynO zS4$I;dRP)4G?ZTdG$kZ!yb0!h*8S7W5s7jlOA{~`EPc&jR%8aVpfKsqn#`z7PtixJ zQu^po!MbXVG}Lk49yvbSlyI?JTRbeMXscl4YGVe|uSFqe!UG~nSmgb~OeLl6>gP&a z66-B;w^D+Y8zU>F5quRZXUSdWRC(rV`EQfi>>~em&r`Hjt^~a{CTBO#lUc>Rsa4(v z8K2|Vh{Kgr&h3?|aM&X*XZYr3y{gN!P(b_X5g@uqJwM+F7?t@y~Dp6-R-w?-T< zqi%QUi;DgD;IdjWvR#%*V&e~rWOt8N{-KG#$S_=HYR|h%I%iW|^6_hl$~4X(vbNsc zW}PLpMSa*^n$@*sQiL+=xJIsa;-5E@QoEidRWA|zEGzjY8;@n0Db|I%ZTBbL0Zsy` z*ES7um-TWppEE6Mp-Da>ZBGVrd1gTR`|-O?)*cai@%wOmp&u_Bg;5IlF3DDp#MnGp zo&8cWCTGp#JqnBB%(dN@7d2no(OqpB@#XHmNk4P6UjC6JE=gAAy$5AII95)w)#Y+l zOJ2U{YPS1(_XgVuX4_=mT$9L9Af2kY)RiGQS+Zn4Cd-1hWZ*%mwAQwqrO3_s;hDZk z_SBh5>?3#ado)NlR$wNaa)R}fb5O1|Pq)3OEPn*Wn<&?xvf!I2*YoC0?33hVPcb+6 zlI%QJK6R8PY94x!020l8b^jVa<9nHYOWDZyxub_XKOhIn%JR{{=`5pM7rD+g)zC-8 zX7IhUEO_SSf9A5MwRfMKXyVo&Q{dD6)&>6I>*Rl#8kX5UsiudthCR|6f~t{cZ~m{> zQ3>XGv>*Rs&1T^-G5BL{&d#R;E`OT&fXg4tqgPSD)n9Mb6NCS8*q6Bie66yT>exoy($78 z{MTa7g#nU3lSi*}0-j7XCgw`XYHZ8_pWvB9QJLo(V`C2Z1kWN0TOiN8#l{@)37$cO zt7o1!i}Lbf4$ha6c`*m)%kqQE-|_=-nr(e~PMpfjyXVB&k{?`;R)26kT7GanT7Gc* zwEW=qY5BqJZG{wBv{YNkpInT_UzLa3qVcn($fEJ>QpC}CP6+=;i2wT`ab7J|8_j>Q zWH=h{EDz~L!Ueey8>2D0t{}__)>JXpXL(1)*ka9=}@wqdEzaGM$3`uutNV->t zw1+!F%70);ebt4O&$S`?jF5IRJ4A2(oOQJNst<{CS&09oA@%z}NI9fR*AOk;XF}pk zk#cV5^h^3Y_mGhK`d^68OCkBH2q}mEgz&RM_{@;<=@pXh?;+*(MM%Ephm_l2LHS7H zcm>b4%jfwa?Q?iYJYz%R`7=bnGvvJJ8Nx3J@hJ|8^S>eG`S+0eeL1APtq$?o9-`k8 zqBqa-M{Bo7h4`E+yqz=7&PDxv7E;c6A?0>dh`xPDx~GSc#w7=V;}2Pl$eeNcrcW{JKj14#j8lmgn$34li-I`D@1d%EX6b#izGIdC$V1hmN8q!0t8ln#4XSgv#%9o3a1)O^yEg6Cyi7bU zZ?rgu%V9e>mqVHyZ(d#G{bKtu_&)<&%RzT#5?_Zu`hr+4d@3DYs)@?` zTyTzOKJhqQ%IJKVdE^+lAOkDko!A-u35Q}-McDU)=^;PHaBNWQ}))2lYgeS@PVqPZQ^X$jq|5AsK zba*+qmh;IdpE=-KKFa4hK5m@L$VZb{PW&iLKx@fg^>xHmzY3h&$rkcgpRMGhd>iRU zAf86jE8hjq>Fyz)i{Z1Ee3U22{K34~CkP%T4uTh^xLFoYRew`KNgqKGuE={!e%K1rE;x=Q#6; zuST51z&XwW;;J79&T%exc$pJVox`U(ydIq6TuEHVmo?xV=UU>b-vrL{hb`bde~6KJ zxOtiRgSqz9S3Ee!nMC{>lxGS!$C*xC_1WNDp1BTp=UwLd#k@G4eBwHfDgftriixYf z6r9Vg9GuH-8MrAooqL=3mWTM%h4^f7e5M!!ytaaKezy_-JM@j=M`y*){yg+PW%J-XMuBmvx%#|0Nmv3 za1CDGs~tYU;k6ETuZtTUe!ipM0nYL7Bz_mh&HdmUzb^eNSA79)U2wgWI^2zCzQYTg zI2VI+oHfLEqnww4YdmVToVe=i$w&1oi4RAAyNY~NzlON#H-htdv>BYwqy6Bff4fA@ zeGrpf_%_Uv@yT%b z2I5O_{k{pDr-2smO4)WJsJBe?@I>s*YSN$I1s!zhamCHYc_+Ycell^@&mo_!Sg)8% zdgXe3z~#T6eD%lqQHRP{8Yl$C%eqkN?t9}D<)o%gkbhFU^X*;UvzO;q0Jl8^4H zAs^*+j*ol3Yzpz&Onfrp+!ErymALA+gL64#!q4!j8l=2ufou8bu59AVu$_ZUADu@-@IocPshp zu5HApBHc#vSA7$4)$ao5@{Gs)g7ce1yb0;1fOCG+h^syeoYU=3{u+M{@zaoQF8Ql| zFmcrvgL65LA%FE5M_lJorR1;rGUBSQ0O$PHI=o0tmDxu zIB+iKc+w~0`X`0-%KL+JoH^uk1blMIM|p|k1DrXX7X3wj*{B9+G z_1Q*zF7nk#{;F>xuKKvnR$pIRR@>l(4;;L@~=X6u>6%@mVsfoO2IQ%e&=Yezi z=Myi)y2dbYF8>1JsxJlSIG2&XhP0gc6-c+1{8e8^T=i?fIo(F`SDz;0tB~$?@>l&1 z;;P>d&go`$wMTNjWI6m4HJA5%aITkO#6Lxx1>jsS#l%%#2F`KTkiUkslz1Cl2Q4Fi z)h{Qm`jz0E?mCB8sEK*UO%$V_?(h_FE}t~wt1u5q2j}w1Ag=lxaE^0|!>2m&RDg3l zmBjUVq`BZ6&wS#luLU>p9PgyNj{J4k2I3#eaptv&{4JIBPvWX?0_SqrMgHouhkTSL zb+ez0&yfn{y}!eA9i9u$7r{44%tio>a(BtOGr1ayH#-g#uHb47C5KdADr7&4srDvO#T{Y9&y!=1Lt(h z$X|WRiL1{P@>hKYan;v=bGpmOUwxJnSD!laSN#g&s$UCk(mhkf^1j94?sIh8z`6Vz ziKpYbu?d{(eLHd0XY{Z^n0StH;>iN%bhC*!V4j%+>e7SA7AvN!RU9#*x2blvOmI`UVa738D5p7dv-9M+Ov`4(`KZhtkA_if}e9zKoaqkK<@ z&wlcm1fQ5po0!&%@^o;HClg%jeL8%y$VYizh|gs5iNR|MalJ2G0j_bXzLL1=w}PAa z^HnVGP2d{8?%Ga#2F{lq;GFJG;;N77X&u==4xD{5z)hU)IG*Kj_qnDVaQ4q7uFokA z2IqA1h^xMsd~9yy&)E>yavnoIsvk#O^;5`4^%cZVz_?sVKB}KjT=myT<`W3`gUr#=&UrAi`o4`%J+id&#C2ZONdBsCBCdMa^nB7QUk+~Kbo-?Z zAwG@7pT+pQH^hHGan+|}*$7O!?tOs*hfmcY<-Hi3>uU@+*Gnns^}bRW>6I@AH}RA> z>8^D6WQVUMf8Di?xL&_(0OvS25?B3Ja1)Q)|Lh`vO?MCR_b^`XC4bfLC$9RGK32i$ z_ILQ{Y9jA>;94)QpgrV+YkrlNkY26E5Z8Fdk&o(2iL1T>oa3)?_-Hke_d0NmUw5q_ z{tL>p9$fRK`jy00zX9CD!nVqP={obx-Exazlpn>dF$={AzT?rI|58P7NDAb-{GB(D1Xq&<>_7*FLStCp0(gyo^`~veColuJXaD|{W|i|_%{$g9sT4+@=^UJ z;;P>UZt{z%t39NzedBz^5&r}U#DjCbl8CE5lYBJJEaHn}?VfD%QGI{nsvib!^5u?q zAj+MqKrCz&YJohfh}%dEX4q@oXWk?P@DHm%}#Vs^0<5 z^|F`zHKhH-)hDK(RdBj-#8saT&iTq9-p;eWndGDKWD!?=9ypit81h%2apa@CjPx3R zIq8*GlKwozKZo?n7lU*8uOJ_dr=EP2uOj_nNOukCm2U*+bhnYuN$_bTALTnke9|y@ zaQ&te*K*4M=k}9HT=hBN9DlyU-TtHuoZ~4cemU|x1)SrlAg=nw;N0F;k-yg08sc{# z-F4)z`VGWYzXhDr-9`TDvxm5r=U(zx{eI%APeLco<(WcU^=aT-p6SF@pG!U(&tT%K zQEvIbDVBeIq!h8;6T$&Tl;NdysBAIOjKmxau>(Io$&C*Z7NxABJ>G$zSzl#8qDo&grgm zIF@_@t6dI1PR->#{V2P^<&!~tG~(hKwan-K? z=XCdyzxwPa{y+2sNdv8d^P56k^=aUoZnneSb+*9{ckkC1JN#q~Qr^dabA62?-VkpO znhehIPa&@Qx#Xis&nKP(|E1)k`enpbzY^S(&qNi=`zrF+U2BNXM!FlxU-g@at9~mu z*GnV$t4|a0-slf^k-zHq5Lf+Pa87sbAbTX&<9y=l(EgW#b3HC2uKMNRobD#_*Z4OR z{{-nalE3Pkh^u}(IH#MI8$G}2#N$xT+2EYt{=`+E1J3CVcK8GhUf#!nbNQDN*WbIT z0OxoriK~7-ILEV;{57Oy#QP=KJuApx_4UM6zY?6&-Q@5JHIeuI4$pFU+R=7{%O{=q zpEw`0!MS|;6IXp5xQX+8C*5`Aue&x7FGTrlA%E3xC9e8y;9Nd?96nu5a&;lWk`2F z`Kw-U-fO+9J_R@RIo%wGyYqnphfiuYm-{u~+z#gwuR)yi!8IPWswS@bW#Am=3i4N< zdgA{;x+}?F^{a@hzL9)X-$Z;n{I`>j>UR)VecE8F;BreRo*J>b3~(;DOya7~As>w= zm$+VE4<;Yg=Mh(ZG5M&zgt+R*kdNxe5m)_oa8vKYR4nhi$X|EuA^s-%fp}bmaJeNB zSA7~dx3^qyuCKwwzeTzQl&v;;P>SZqmila&X8thr7>L>~i=?YA)}4 z!MR@c6Tb{`Cc%{JC55=^2ZNh9|K_Ay0nX`G5`P@&R+GP4Ehet|Rpg`kHN>~Te>3^0 zehYEcHi3Y3>h}^)NV0qOlaK1-Pq3e~9jZPZocpUx zaBk;W#G5cL$|iqJw?A>!=Yey5&2jkO)kNNF9PW;Hbq;sOyA=)}>-f}zbG}v*--mpy z0oQUczny$kzk_%g{CAR%>UR-Wy>`|de;hh-<)6SP9-QM(BCh%jaITmBl&};;JtoAJrEV*WcGJAs^L`A+Gvz@=^U{;u_Bs@=<*San;W!AJtbASN&r0 zQGE?@)z^}b>g$NBeg*lczMi=1*OHIw*AZ9!2J%t;M&hd9N%Ot3C-2q3Zdi`V``-PXp)kE}gjQv&l#O`x94v4*94)m$>Rnz|DC* zUd8fW3eNc|BR&-URXI54Ycg@w&mkX8dMemrh{T6WUZ?}@a`fMXU3F$VHzv`Qat9}>xsD2M|{d)s@$w&43 ziK{*--zqp?nc&>svWVY=_LdFK?X5p?)#rh8y2TD3A9LU}4xHmDCH^wvDFf$t%89GK z5}f0ycDNf)EjY(hM_k+I3UH36p1A7Ql1~g?>xk>$z1RrO{+o!aejB*Sue*Mm9b;dd zFFc;p{C6KR+FKoNUmx^)KDd3+%vE0&;$Kc&^*UGNd`*E~x$5VFb3N8M9Jl@gQV-7g zT}k|$Gz->%Yr5EM{=00-Rlf-WF6V9FoNgoWOOb99xcXx=W*2eQ$4R}Kmq}Oa&TM1Z zuelx#GcR0@G;=M_{9y0Fzt^N|j2e&XE1~Cn%^`jT@}>2qK9I%C#|P!AUkc9kyAGVw z-9TL9+z77z*o@KoQm%TfFHTqgo}J;@Y9jCEcl^zZ~JGT?JzNV>(yf222(f4(DOsw7D z`ickV`pN@0K3Eb94BWrdm*@CbK(FPgyDEu4g!6O`IG6KW;;OF!=Wnnb$oiS-(e;BmN9T`(@W;DE*B7B9=5#;m7G1BuZ^QamyGPfL>Jgpa8p1ye z;R7?H`#cuHcZKkgJ)`^F9l}2k;j_?La5=ma!q4m-J>AtI{MQg(k`>)Yzh}+yyx%9f zJ{N;D>)Z8N{X=9sS!;re_&>wDw5apt##@K;0lIe5O8ecIu|fVn>J%Df)W zc{0BflXd2g4~kxHwYkyxEqGpteO?XW3-Npi>of3t0`ug-(bK&$gl`Su3Am5U{-=d- zy|2ys%ZEgd=iLyVj!6Uiyb!`~!DNE<{V-W%J|l$d`akQd{uVv{XF_<|(CGRRA^eIE z{zM4Z^%;({eSY+G&ko^rA^f)xe#D8<{mVl5ts(ri5WX*j_dh9my5mFmEg}5X5WY8r zzln#axSUtwf|I$AhcK8A3E@*ic>3_@`CS#l6GlYWPYB`fgz!!U(S0gH_=6$*{Sclp zGP?hS5MCd`zYpPe7e@EbEQ-$i6-VbWqoVV(L-={8M%QQKrX#n9M?(0VlIT8LLiin{ zqwBrXqw_f-{GAYf${Epp{vE=P8xviBa|llx8(n`+2!A?+?+xLXof+N#&k%m`S<&^c zhVaaB(e;;y@XaCouMmFx+0p$U4dJopMAuIa;ZKI}&qH|HxzYV^2;tj9cu8q=pM@d3 zF@(20FS^f3A$)ZR@Ba7bKC?skmm&Pd@zH(03gP|AqU#ri@Yh55`R7OXSr)=S3gLq$ zMEAKogl`DpRTo6}*&V`Xl}FddUl^UAAHthL`1py@eI5$oe}?e0CPnvI6~YTAN7p|X z!v7n>GcJnmb9o5g8p02`IJ(b}5PoY2f6d{Yt!40kk4p~tyL?UvZ$Blv{;m+-*~!y$a9!@D~1oHG4DJTAW>gl`YwCsaiDc`Agro)KL? zKZL&#!qYB|?o%JazYpQLGo$<57{cER;gQPdKF5XdDIxsn5Z-!LbpNp-JYwZBvC@9J zv-a10C0 zd>%Nuv1Yym9L>L(e}_1(rg&CBzliu6@EeG~0)8{`t>AYM-vNFP@qOSA5>JY?;8Ehe z!2d}+7yL!yqrhJ!J`wy);#Y&eL;NoACgRV4e@*;#@SViJ0N+jgcksQ$(>x3QBz^?A z-e1%9KO9`!uX6o8nG}?_@=EAC62Adl@4Kn~A@E+Le*s+21J!>3K7jPQz)v6^A7?Xq zGVu)Xk;HSrPa|FgK9=}I@Ny6nC#Jk4Ze03#$EO<}iXMi6@d^-3M#BTr}MEp_kn2P4LHwe*?anxYydo{~Yli;OmJW5B>^q{oa|5 zt9o9{g#K;PF9H7#@yEbFCjKh;=fs=9zajoR_;_1$3f)N6Z|;he*+&%{5 zMEnl$(Ztt)pGEu~aGmdH{JX#}Abp!QHeVMJ9{@gwcoFzj#Lok-CO!@Pdg51uFD1Sd z{C48^gVz#&8vFs``u9NViGKk7lf-v`uOYqVFJ)FVc?% z&n7+#d;sxf;JL&bz=sfjA3UG9{+;yU#M5!TTugi*`02z?10P5HV(`BcUkW~z_Ci>xl0KUqZYM78vd(J`nr?;=RG2AU+Cw4e{f_HxiF)Z`;G>5dJ>#G4T14 zcno~>dP3V(EVzgHxbpAe(>jEw5g!MAPvZI<*Z|`9LVrB*I`9JG4}gy)z7AZkV>JF3 zz^9XbBluk6Z-8G%d^7m%#NPpbkoX7StB8LJzMlA3;BOHB2E38@x!~UrzXe>ctF#=H z|3dmpp^wFNjOr`F+YrADJd5}O@FR)O0UtvAG4K;Z_(b*Mr|r{7|&> zdgAHePZ1vg{w%mz$L?TH#o+&qr2lrH-TAh|yE*#z9G)rsZ1{ibaHFrnF<&^`=$H4l zJHB(c(SL7o%#RMw6n5VryWNRbBG@WUQPT#+%#B9JP-O>;(r6z@2zUN4F_LC`cuI- z5FZP^nfQ6&9}+JI-$h*iUeVqV9*gT;jZ^EfE%8&Z5S~H22)r-xv%!xcJ{A0A;Pc;eBn z-X(ns_-Dj>f$t>#S*AU|_7UF+9>I0Lru!SXu4gFMzgL$@`t+XG{|Mrl;6sQH10O+r zGWZzc)4|Utei^u~muQ^xz^^2IHTYuU*Mr|i{ATb6h~EkR6!8_{>xe%I{yOnz!9O7W zBKTLt-v$4PcoTRltbb@Zd<))|_)p;7i2n}Wk9bNiTffH!+0@`_(1ey`a44!r}FuvpMY`s zM&cFVcM-n|{1M_c;A@EA1^yE82f^PW{sj2P#GeJoQT4fa7^(~LbHTHTmxCWe zyb*jD@o&ISC%zlJjQCz~UB}fp{{){)`dIYO*Aq_!UrxLe_`}4r!T(A8Dx6=NiN6Nk z9_x`BXEM%RIBI(7!_b zO7JbjHzB{D5Pu*1TjHO9|4MuZcpTPKwVbv8PbIG7QE%eI5$6EnL&1+Gehm0|#GgYv zU;P()J1N>3q?|?r;{6p}Uh;Ik~H}PHI9}*veMUk(F zp9H>}_~qb#5w8MI!uqk+?{(mviEjWul=vIqgNXkJJfC|f$O@y#{VREBkBJ_y?;;q3GjWy zYr*w_LiJZ3kM%|6%b-sqz8pN0xUQofMLZkzm`6MX{NxZ`MEqBzdlvEE!7m`L6U z{eI#PgLlI9fyT28yn6^gjCefS?LgwY;d5LFKau$N(2pXn^?L#Fg-CZA@mlb&FfY)2 zt--wOcj8?!pNU2LQoZs-;$Ok1Bk>=>dlCNwd;swzq&tlGaPZ;~uJa3x^91N8kp3j_ z>BO}>Zy^3A^tXiYyNT<#`3P|xH~&Fg$ITas>-hL4aUCB&Ag<%!m&7kY{67$%4X*u% zmfJ$`L(uM&H-M)Re;K?daqa&H5ZC_yc;eds7ZBI}e=KpWFYUK9&Ib|CG}0@-jJVd9 zj`QlH^Ol=Pe;xeqB7P^h_8;n_aq2j)d>Q8Rzmw0C;7K@NRlf!NSmG~Z9c*X_A4y!- zf6gSX>pvF|?~irt3gUyn=Mm2Xzn=I=@H>d>I?M{Y?J{9~0;$1e|v#hVVk-y8dt$@ip)-C;m_H8N}ZQzl!)r;5QK0b@=7Pbshd8 z;@ZzYO(NsNL-&2 z>qT6j6B|HWpA$Qt_(Rw(AYPAct!It%G4Khb*K(LnT+2brPko+)?jF*AhwT+1d?oSs zvAve~C)nOdd^@(c5ZCkizr+`zKi^G!40x=*x3b?`JP+ILh+l&3Uc`00JCgWZY!4^y zqyIlOgr7xR*DK12>v=bWxPDplD&ji7y^Z+q=;!YV;g1j>i}=?NF9m;z_yq8`h))Cm znD{L49mMB?|4e)#c&xso9ok3jJd;1dq4BN*L{{rQv?}(R! z|3tJYkN6qbemI0bNnF!yAg<}YMqJbVlKAD={x*c~ zCa&rJNnF!S#B)hn&YEsV;xlplAmaCf4+-HX5!ZN5C9d(DLtNvTNc?W3`vmd+*nXRM z3AVo=z68(b{6>5_p3gZ1`?Y-Z`Q9|*_dws1xIQ0y1aW;1R-fBa{|5M+Li$(0Pba05`fWJxn z81N5>4+Yofur%FK;6IRl9Qg0V%fSypIjPT7@b<(n1Mfk+3cMfj8^MnyejE77#PvDn z(}?SQ?_A<{!eunuOkac%!G*st|ii|u6M+Rt|({yer1Bd+>f;-6q!%T?3We2pT#uJ@ip{6}n0BCb9& ziEH^>O}y=)_PnSe-U<9p;_CkparIwK{Al>BC$8oHI&pno^gqP4{eMne+tqi(k3+iq zi06a*c-QhDf$db{W3kY-3y_cKzc3bX~eahuOz+z+lz^- z&obibQ%79uWhHSf=e5MOeqSYiAGY5juJL?C{55QUO}2A4e$66&Gt#XhuK8L*d=2!=iEErIh-;jyh-;kd zh-;j$6MrA+zDr!w{gk+-`z>)z_ZQ-tuGhC^z5j%ClZb1&>BKeNEaIAO4slI4k9a%8 zS3q3vH;g5o4*lPWYn&Go*ElaDu5nfo*Ep9DABc396W4TC5Z8295!ZCr5!ZBICw>~z zeV4eV`zdiv_gmtc?k~hOUGMOg?Lp6pziy@|M%+nvO>L;n!*AHi1>*Z9{F*ZBWMT;qR_cpKDf z6LIz5NnHK+5?6n}U(5EO=d=F(4xJCEe|OTW|KY^d|5)Oq5dSdZ>R&=!{Y#0f|77Ab z;9p7nO7Qu_^*NIo;#%*^iC4qtA>!JPJWX8l^#XCt*Bit&U+)vwc)lR6`Tc?TYQ*_F zag8U^zh%8^JgLMro($qTk3Ed|R-`+SxW<11@vosDN&I{8Gl~BUegSdK*L32VuPcdb zzOE%6kMrbK;yHL;@IKs`yC4e?R%?@C<#4BbNnGPk9MH1fHO`L2^?R4S zi0kh*3?SZ!bcYbv>-you^}g5{#6O2m8F9V7m_l6p?K#AMhEFwdeg5HQaPvDMcyuu+ znEOcIe~>M&#~p5NiJv3Knb%Ve&y;N~=jR=6^n+vNKY6|A@J!j(cKEi#af{B#W41Zm z_$=`Q9P=&lha;B%MEu!9EZ z^0}LMa)R|=L3|1L6U6m*6P|atNw);)ZgjXwcTl4B|2OetTU-7<@rq>2KO_ET8_RbP zUySc@{YZQ^z8CZx@yYleh==;ub}}8`qevp2cC1ae1M#;|zrBg4jkNmy#LodALc9)q z6!EXY&m?|pq4gh6JiW;B$;5jXTRwyM+6k6lLHvpfEMG|cTksml-;j!&cSoTUBIgFCjK1H^4A@1;(zrF z%ikq_0{F+oUx)vH9d7*R!+*EKjepWu>;F6P>&93fH_*OodpHWbox_d)D)@JGxbc4s z{(Xs`4t}h|jZYJN@*Qq`emPVAlh;V%)4)$Bz6<{65}$CE^(iO59(*eC^l?^y8Sxq5 zR}p(cvb}Er_#+!%du5mRkR8;sxMG z5#I_vg!m!nS)Y@M4*@SG{wVlZ;vN5Pef~~-I`|~wAA?sA?>E8vT;*_64ms#2uXVU7 zhfl^^{cXe-fj{VQ<5LEol@2#PSC(0y2I9TJH#yw+EQQZI4mUnE=gWWc`iS`1;9nAd z7yM`9FO>y0F)_LJUB{_x%tMmFwf)RMxpj58iL(Op=PZYtIAbofzDE#08~k|U+rWnr zzh|QL8SQYB?kc2vj>Ap5XF)&N;YQyC{S1d2{V&j8LHx8yvQu6QiPwYI5IomzXblj65jy6-{B_R zffvhv^74po`_*L9o;#A{Em=}vdJ$=9lQ%jY=UE(s4=K z&spHdIC>Lj3fk>ZhZ~>kp)Vl59=z1y#-{{67dqVd+=ugS8u16a$WD39CVn!$&oiI+ zyT(jjH-hW=yA$L7W5km%e!b}Um^d?&0-Kmk4mZ~2-7SBI_IGje;NFD zIo$Z4Vs^@FAMqQ&4;gItYyB>TPY>c-z_T50{PjBUDB?F`zB`1t&cjY7z6|453AmQ? z9IW%4PkQZtFLAiZ(o(D!RXE(lxgP!9<;1T~*wgwfCw?pV{lq^6e~kFlUe@Oy z#9s$rN8CsKy-Iv0_*=v`gMSRJ%TiMV5l~w0#aY<=OoF70wU!iNUDcH&xe1u!;SwB&>uy-Aj|p;b-3}F51#^u8y|f>d^GX5`dFWHi1$C-@(YNs zKf>}U#7{rc^2;4=;>k&|yvpGw9=$(zGq{%96f2KeO}rBPRpKkaKO~;s%I^4%cs_VC z`XNns4tP)E+rW<|9v5r<&mf);KArev@Fm1IgFi@I|L)=I#7nR~_6709;A!YbHD4>h z^NDW*pF&*!e#~;>`gdO%h?ik~<}Kp$!S@i?zZa5rf-OIda}V@Gh^Jt_QARu${2Jo= z_crb#J_Y*MiPwUEN?hkTe-fXJ{-HbO^%{R1&i8)AGr)%uF9jb@Tz{{BCh--}UrRg= z*Kv0f?+^Yw@xkC*i7yA=L3}Ite&Tz;GlsUT$0S^L1`1Qm$fZst} zuXmm&9*24RR^oac8k65L{>9L@C%y(eo48&VVW>mLfflXyDj zrB4vo-!E<;-UR(y#QS5u_dW6E-}yZ;CU|K(UxRr?TjG1cdlN6kcyuiB<>2QN*ZWor zi05M*xu1A7_)ElBf`3kYEBMdESESl}9(Gd8{O$lBK|HIS)tyVc0DL-e{T-Es#PvSx z9mE&IXC-m{eUA;qw?O|j@jc+b5zof@RhN@n=C=eqmv|+30r5KUQsVo;tB7Y~ee8DP zQ@|f1z6|^g;;X&j$ENESwaixz_;JK5!OteX z6nsAMjo^E5PH5TjpyU_@Trz4zs%9#D{^OOS}?% zI`Pfm3yG&?TmO3Enc(Y)>-Rw#iR<^Tb`jU_3w0gUGQX4i+U?_s>+|R565kH}6~y&> zEDsZ(d${#~m$-hvVmI;pepcW8)RuAT_X_feuYmqc;+w!PBfbm#cH+7HZF-Lp9|ryc z@fz@NiEjl@JgsH?Wk=ZU9OBCcSYASW1Nd~}V~(`?CB$pMR}o(azMgm!_$S1(a;*O! z#PvD9ZY6fV_HTQjKb-hrJm*wMydL~w;^_me?`-1z!K;bqf!|EL1pIO0tH56+z770G z;`_l-dEnO&uLfU9d=>Z`#4B*$p^^A9@YvH^#=io* z6Y)myV~NM${zVb-eDF!c%fPQCz6|^k;_JZwO}q*GJL39$Z1Nc`^OcMHPlpmO1|LLx zIrtgGcVNAG67lroY-o8B_w*;tocLwqIpN5u7c-QS4kpJ4sFjBS~(x!?nc zF9kn|_zLjTh}VOc63_gbO|OFZn4y+0A+GCRwZv2Mt$r2peDE#AOTd31J_o$*nbuGH z;l~QBGiPSboVh%g z9R$CT_}hYikGQ%DG6x&y^C!fU1^*-Qaf1Jyc!}U=h+ivsDvj4of=?y>1Hp@k|3dK9 z#9tAd=Lzo!{$rB=r{FIWS4(=^;S=J?g7>3&MY`bQh))$fllWZ0FC~7J;5=`s5_}!W z-yryd#2*m+=fr<2_{+rK5d0|dV}hR{KKSb1_8CI+r3}GyiC-f4e4cj+zLfa)1#ck! zl;Avn`;*{LlKc_DUn9=n5woAaNBqKTdY9`<;#U&K_D+vTv|xph=kHc)9egB6zPHBc zZE)~(K>T~Fpo63Q#WhBLi-V&)|NgYu!BKuQ$!~LTl;_`XwmLY1J1jh_E;a7;I+*6>3Po(_nANA?fFKPCM=4vu;rCq1Vf9QE-0 zGwvI30UN)M-q~QT6CFGq&`Hui)WK1|-Du=TIylOILGt4q9OW01{6!9q^8B3PVh6`Z zFwIG@gKdt3qn_3}jnyK-`w?Fz`15Ox{3^lM5pNLOCVrFP6Y7ngTLhm(cKeRt6~rHK za4c5`mFo!y$8vo@`G4BMQT`ao?{{#N|2F04Wx-z}{g1yq=l>34H4vzA7lYFv+qdc!`H<~!s7uqKXf4EH*{4s;oJi%Wk zzEW^6)#I%WK8$4Xa4&JTe-+vPVFw=xatA5@KXCAL;B5b&IylNtS`9nco^tSXxMur5 z=in&cO7g#PaFl2J|H;8oekP4aZ#p>2v;7Y_ILbdn^6xu1%Cr4XI5@V)Qfk*a{5v7`htG)LC*%jweCa8{FCzZD;M{M#A~^RCZwt=- zzz2f!Jnd7#c^>tp;7ch#@ymMKjr)zkf>)9JXu%taX9~{iV0>NhAjuaB&UPpfoY&7R z6Z~G%vqo_K{b5k>CrJKo!JjAosNjDl{(<0+(YWxr;Lj2_)-?U$5V+v)`n(i?{Uq`S z;D}q2Iq3cqc~?IJQU#AmG$38@JBZWkjgX#{{zj0RUx*(ho-6dIa}4kao=dz?@Dk!h zf*+%dFA=<(c&XscBMb-#zK3|N9DdNq7FBoOOcEJP0TLsUc z_grm)-$8u0;Jp6eUcpN<4CoM?*Y7(Z_(78I6nqc)Lzm!ti60Z3|9|mr!8=G^k)N{P z9w5&1DdukwPZ#p<(RGI4$6O{s9_LxlI?|IXb5GH)PWDD(u0mkQ4Q!1s}?XAAj5t&ndb zzE1G%#G3`@`r0mdI@MRJ;1h_q37$=Sx8O5~?-hI&@mB?J%{2BuD0s$1!#f3EnqzpE z;QYJLV}idt!^n3F-bGwdJ+PhE%{1~}!FLl+68r(5kxvzz{f*bjVEz2wIakOxQ+a)Y zXH$6#1!p_(_w}s5@Dh_B_Fv`|#7l*qV^l8oUzYb$x!6yc^ZV{5p(iHGq}wdGqI9H9hnBZH8cMG0M^M6I-4BLm(^$Pv~ z<%fTl!1Bk4rwV!gU2VGH8B|{xf-fcR6TFb}StxiD@gl+dk-sewoc*v=@ClUvfZ*(h zLBaXEg(ksYp!_roet`IP!QY|zd8^=T=QhFjQa*PJ&UW4_INSME!TEcJgMyEkV*I~T z@O0u`f@c#yCio2E-GbjpT)9m;>_2<6&9zr>u1Eeo3d=Y9jC`t)e}H(FJ6?#u|OhxxDFuXHdEsf@cxW5HfM%@GQEIULtrd@lwJ0zB?c|-^bMozMJl|)(Otf z<${8j&`ZcB!TGsdv*1l>ro7t)ZzjH5@FW_C_6pAa&>=Y2*8#z~zFrla>+7K4Twk4n zvpu^6XL}wK{0*{ax8Q6~UcZO^gnw6+N`B3}ANfPN;7P4_Mo8YWxx8SUYe~-)d-%I*C zg#53F9}xT<;;#zcN&KMT-NcVY;oXAw)9^k zSx>9rtfx)zH%R|(!4DGOD|k2Y4#7_mKOlI@aN`G^f=?jcCHPX}#{@4W-Yxiz#Cbg@ zwoj0FDvh_yw-8Skyoq>*;BCaS1b>2fuHgMfnDX+vP@FE03%p($^BFY1irIf^R3z>oltuC^CCs}0h~{6FJ8g9y(9_F?Il%kZZGMAb9>1UoPXz=B{;X2T*0}$_yp(n zQYiQn)Q*Y-uRYJSizR~d|A$p7c+vSrJ|H-^$6CR;J@WffwllZKW+C51{quIg*&kX3 zXMboDoc&?9;9OsO1?T$e5S;CQKyY8Wu|uce9W+1h68r%1V}i4uZo#>JdHp%I+dHHu zmF&cv{W)E5_U8=2*`K-nu^#r%Tp{nH`!%27A%7E`e^1Tpz_EVs1>`?MegyGa!9)Hd z_yZ*0EI9k~cEQ=7TLou-ZWEmSdAH!4pS^;!KffwC_uB_0r{^7=g7diECHM<8{v8wi z9eOU&Ex3>RTVB_V?f(Xicd7I}4)Yn5pLD@HNq>gm-Nb!@vz|i1`T0?i;EMX?C4$c& zUMe_0w+RTofZ9(`a9%&EN${m~f8H!Or@LKn9&cI&=kKQ41ka-S;Prmk&LuSN?-la= z9=}6y{?6fm;Cs$B?dVm(Pf@>gP;mZEsZ((NPN_?9{*L09;QSp$x8U3l@CRyKUTzm& z@)zd(T~m_a{9RM3;QU<^ueZl~xW00Qd?ERdPw)lA3k6@o{^sC#>qX{N0l_nj`Bkmp zCB)YW-ax$B!SPmS0rBmE`{?_XR>8CByM#8u`TL9x!CC(S!2^`;tAf`OKPWio|Cr#c zr(1B=qXrm-SYKFP*5ehtnbPIobFln2;u%7IJMk>RA0VD9cq{QD2OmTX4@(5Uk-|zH zoQ7T<5)ho+N7Xtw-I8hfb%J;KOaeg%r&}x?&?I;g`9rgV)1v_`zg=+to~+fu>DF4y zw+a3L`4!z}D>tO)w9gEaUCo_#C~|OTd4mq_ELW?8JM-V+;Ld!Wc6^89%+HmM?<<`7 z;qRxoe;~E$dYbnf|uG8-z_HDuP;SNm(r>gp@~<<(V{ zYa0Bu^{f0<6>wJ7uwJdMTwPuZhh>!&4b}Dj+ExB*E96!%Z0H?O*-#$vSFLe!qpP;A3X(6c3(G@t6_w?6>uVcSW_iu( z)sU%Py6P+I>#J(kfVQgM0n4kaRsQ_6$DgvwhPC7%2rkS>l?}%8tWq)y>g8%UuA{A zc6C^d&d-WUsEo3@G6%=}uSS)EYxzh4m`~ILneKiJ<0y>ZNl?{!xz2bz; zbX{Fpts@Z23gZ41bu|uJ-rz@{TwSY{;m+a6&O(Hh)>qbn$3hiUqHqn=Oj)nuMw7($ zVG3EbW_e90$Ka9WWo!HuVS+ZhuC59y9MVB=49Q|hU1eECp8!x&U$r7E2-jFg%c>fx zE7vG6DjxjkHsz39V3mJ)Sygo}wdGZ{0Z6S8lWl}nfQ>dJ048e0mIU?>L(Gh>)w;^s z>az8qwz7Pc%3M>^P?>q@WmjCJ6AP(uy8Y_fst`vlkah5FXxvyi;4SqH`m&b{cvxBW z3jgxDn$>*+bubX?jIp4*U0!2KqeD#_G=-_IT2rYSs#aH0 z%d8B5U>RIGTc@=98Yy5r1oI5uUACfk?E1c z6}=kQipDY^&iwWA@a0u&L@0U${ahHp`Y3jUnnN#s>QVyQN z4o7>vo1{s+Im#8)iL$Y|5_`g4X z9p2Z{l(d(U?Jh(4|5N2an$Gj3x*X1s(c_sA_l3@SpU~%?A$SEmzd2iczMtU;GJX-n zmkec_e`<1CND=X|1D423*YvrAiidf6r1XD9a(sV8mwnRuW0d#@C<5OvMT`G?h#x8c z2Pyx#t4&PIKiXL4|8q(o4!ySBdFFCcFABe37uSuTFjD!m^Nk?izi~8~*II}#8OkQ5 znUp$BH7LwKei|V2k7bIK{;UEBfQ|15%~jvDFm9yukENUR`S&!KK0b<+>E8efBBlTG zER!PNUz)4FXGSbt5P;`>;%_h#S8_x;ay&l9 zLFW0~DS9i#cQQPevQ^N4k(ttlrJE>zXBg=-En!6q%_NBS!{;0vpZo8{ zls@a@V<2d9y7mGl<|y-jS(Nm>H2yi$$7f73{Q_vevh0{r=MPOvq3>vbjgAl>=K~E@ z<*O_EWR7b-$38j4c z)Cd3fJj8oX)uaVfj|#eXsbCEJ+3@FrKMVfUE{J(?hwXps%zo=nr*E*^KOdudPG041 zKfcJ*etN%Z0b4YCEnm-Pw%Uouw#{kXR#U(Bm>1N(PTNM$-{!N_9&e0q-{&BcHcG86 zRjMRys9L)bj$QG-eQ8$A+7B&Nax(3%WH4oO+h%|FIM9WEGcE7YL-DGl(;htj_@X)O zC$E|fdGPg|zM-HU^3;NPYaFdwI_*I_57|R@VtOZSHNNBYnVg14EZ`}($C4!TsIbdh&hDyQkJ z>89v(QP!DmBzu;D-65ajpEz>{AA4>)W4mWHugaM#`daTuG<~397@m& z^;zNTfwXpJzuh1b_SH|Xy?p3lOK(R`n^qkQVvJ7$LF?t=Vx}z&XcyK^VsT9 zIZwL^rnmjpw=b?=uy~UdES|d|?tb{4+JS_ub9=Y{nmDAzwO*`XY!|92b)d% zIx$A|9AD&)XnXGqzJ2gpUSmDR>jSqX~nNv z2G_?S&to93vbwXP|0seZN{1Mw++i2f<@5M#04^HfO`@rp3*F%mz4E5LM z^6jgFKdAdvT@Vj!QG&;~#5sF+0`~(~=o3G=Gx==3Fv^3z5V`;Q1^D&D;PVRn^SAlN zN87>2*+-8+8+sr7^zZP8{t5k)_RkLZADFxRcO<7N@2av>XG%IJ-j#d^{HYCmHq9D* z6y_D+tET@u4DAJNm=66H`_641Ur!hI$tvzB=70Xb&uG8#T5FZd1}xgjJd|srY3Q;2fLM@zt!5A1(hX zMJyViC`J)q?F}ia{3=Bp&P9g0=2Msy>CIA=>*zEXMjVlkvZ&0f=>$BTPs56r^C_1H zr23}ymDb?2xRNYY%%_}yr7HL|oK|t)w77m*Wgp+*fLWn(E#_19M@t3xl+(mUy?6&- zg>$f2=D-MYB7BTy+(0N3C49P* z_zIZ=Bgh5iqb%?f6u{~&RV5Vx;@EtYS|(5cJBO|6l6LR~tG3maq&^wfk}^dt$!YOX zrYQ{rwvu`Pacn+HEi&i-FFl;o;(p-&T9?3zYpIl`)8eaEqLAEUbh8S6jjgfl2jF0URG_=59jt8XXm;9PQ+G-S*1QTjqB z1@OxZmOT-- zaHh^l1cA8&Q9c(UCs~kTr3Q=w$!Tz%j9E=cxCBlIhB61g-A@VWfQvyP9d6Vy_yV2G zkbw|&24pyOkTn(#L){t=8w4rf^>E6#d+bn?@e!19H|AhugwoF)h~+;Q%0DDr!nEvO zm+2#|NdwVtOA@Y5xC(MJ3e7bMG>&$w5$E8^7>J?Cc^DPR`Pm8&7u>eV(y^5qd;2B} zq+0S*mC67N;RC?C#-YSL`Kfq5-kJXyx@sTyi+q;dIObOXOAs1A_x<=YG+J-q&zcw}6aB9egT5wv(hWawsVM90C zaC(AvMWwzLK_lw>y0P57`9sk%Gs2cJWmbD3+cCO5d377@M{TR`!8H&b4aQh&Y#pTc z=GB&Y!DMR^qxWvT_vn4B-h1^vPVeLOK0)vM>3yQ!_t*P#^gc=N2k3pW-VfCK6ulp$ z_k;C*h~B5_{ZPFhruW13euUnS)cbSwK27h_^?sDzkJkG!dVikYpRf1$Mi=}|@8O9n zY~%EPyxw1^_Y?H~BE8Sl`-ys=rT3HcezM+A(fe$@&(Zs-dOuC?bM=0@-hWN+zpnQ) z^!{SKzeMk6>b+0z^YlJn?+f&Pmfp|S`#E}lsoodr{an4Dr}y*qeu3UE)cecyevxs9 z*chts=QUM&|9_#rmFo`eM(;qAP-=tT!)p=PER(RC5_Xy5{x1_&Cik}gzs)^Gv<^EW z8e<1d={qdt(G4cn8*6L}tzx4lUMm*c2yQW3V@)N)K$7V-4EifLv1;(jGd|AJ(?ZYq zmoTMx4dK{NI zjJ-tvPzYX$s92xU=cq0=&-~B{D?PU01n@F*qT^Md?i{0A>zf**`E|&rc~uf7sCC4sWXzj4cHm}GWz}0Lh?ZEFSo#Z* zbHEuacH}fwV{;5NAO~V6{FQ) z?OUTMySp&te9EB?xsYCbA{y{Qt2uY{YC#?!&<7Fx-~-Q>YJ__t+fI6gV8ZY>fFK(AO2hV z<1o)g%m{uUp*PP)Yy#oSP3WJFOUy<1ax+#-_;L$6Vp>SmEvPwsc`JHZ`mG?sTLYYU zemY>3Relf9(dr@Ck8yp++YZO`P-qXFoc}EB(yzdR(1yP2xq9>{t8$s9eRVz=(rNv- zIxCFM3wWs{OmnPNWW#e}b;0pauY&M$*R2@j`Zmm!B8O~&?k5ReSn@W`x|&Zh`euk; zY-Ou)R%m7pz?GDaf#30}3odfRH7Sj?7F&}zcuB9|%XP#ej2JypNDgA#n>%4({ZCWf z0@?geQdPSBSod2WftiNti^PAy>0oTtChT=fyL|#=d?-q(MC_9;M5B0fMj_3>G691= z+?$BRM7&-5^-vx0GL+MLbaP8w4A+CPVNJkjaVLlBrlN-e-6-Pc>r_pnfQtt}UN?~V z1-;I(@u|dzQ5#MHLXBlhxUn4Q-B=FvZVoTr4->m^bND?r{_y2XnD6lA%h=+>mw)&v z#0@u=H!*Jb@{Qh?ulK%ut@q`t*o4Dz|A=`uW7eN=%nFCRg(Vi37oiP3=UC}0A-B9? zO?lpRkFqMR13JnIY=*<=(ceLl3l`}C(}+@Y=;d0bnG{7y6=6SYqX4>zM&J4n`sL8R3em>|IfnXp)I2 z7cOpf@7`)PUS@IkYTsFo=d0wAJ)^{)c*HtfEn!nps5;kvi=WYib|os^xu)B zVy|QspT?H4is!WoU;kfffQj^f#;DNezfRTsKIG44>2oYo|BhV97F@>e)C{t9#^mLk ze`|nwIp>s7WX{c$+nk$x>GRY5!t$q+9Oo%2)&qsd&3;+yPO=Z^@UejH-y7X%Ec+!d zOzQv+o&>wt860cBnP)Db>vKMjy^2oz|6D6f@BdS+P?z*)M&UXT>AxpcC8BKXJx~nX zTytaj{}ZqSiP$z0v2!rvZ9)u|#4+CLenXGE;tXqIXsB1wXJ#(y8E)ZlV}@PN2n)Ml zJ?wf$TBs-+GvP_I(Do_^FK}}VwioJQd#d3edZC4u313gJehy=1`1&FX^Af(!w9sRw zh2l@u;o<8Xah)x$r-uDlAb8U(_S=-_w%!}t{EB6pp8eV50E3$CP z`cJ?xt^GF~&ch(j0N72(Gu*P^FPvJvg?)41;de8z7xWz;#xWx(&Qq_@v(?2gTOA8` zYG&*lYhCHOB?(8=Z^x($c-1Zwt5}c7JjdN4X0qfa1^-8GqFpV)GDFmPP?tkP4yF=u zVEURa0qoF-biZ=D6|Ujib&X`)2~l~wzw$Dm4XQb=ziAH zzOE8mLD%3Pz-}OB0Jnr6xe{@#N<{kqyKPb7qQ&VMBk;g@jf^poWDNs}|PGAE^H zR99cS`l8ypnw6F14e8n0lP2euFQ1l`RXKUuw5;6nNt327pSrvpPL^etmzCv|P0cE+ zoLoLm&HmcN>uTy&O$?OPt*%+KzNX%fzoVY`_a~lsZ|`j%e0SgbPv7(YGk1UR@S_ta zXHABGld>k#?^|J{(`whg|mzOmo2(%b{}@df(4T0&0g#WQ}|~W z*@2>WenB*aQG!rmlpw8ePCgu>>Wmty)kY1~noEkKs*N0^bw&67@$2p9Re@Lj53) zV0JA%Yj(64vmq#YtSM)SHYHNL`~{1ynlpECVWfDWun6ge!{+2q&6W)!9NO2~dBp|U z=<+fScUA?_+gFqzU9Ej%g{uwy^K9YhoM#D-qCc-VdfPQ&pf^Ij>oC+AEi6iV4e5+f z9U-03!nDqatt+fHda$-Y^kA(#Qca_Q(6~{;wAv_Ps53%a3gtFh80w4`rt{giqC+|( zI6>I35#rJCx@b<+;WbJSW->|;=5a~M;z+FnV?_umD9nR@le1(L=Ki8Z3$C6tB`Ze? zaEqINRm2dexX2-xkH{gI`T18BMOPOw$mk0PEnEbBT(3EfCeG%ffz#Iwa8!f_P8%Bu zhqr0qbQKL2mlV&=3y<(7mZR=9aMps6&~<=@4wYSVhneWQNI55Ti;89!=atM|bXo86 z&YE3Ne05PtNZ0JkdS5S`)mt8}7tWd-64#gEPFY`uYacEb7v@cJO2hT!$-N>V$(br- zrsPVQoJqY>EuLF6d*Q4}Q^USkG{1LF;ktNnUPv!o&MufgJ8U%u{#k{+g=Y1R1xoyR z3&IvMdKUvNS{!aXKo=F|U4BJ)whU?c7tFrw(vrg7`Eqa=fI~_5#(o%l&k{66RoB41 zNw1lE=mM6gs#CapQLev1AE!))6I=}k524@3!m=4_a8WB&-mp&T6}a>wGJbzvadF<& z{>5{zne8vRx@flFuRyZ0uB-vq3DXPHI2N%{kyf`s25GIXsR*whLvfHn5H6-gi#6%& zR$XhB>sel1wxV7wgB4J4fhSnMXIWW&A05b0J*}wb$PLh%TFPoDJVYQAR#<^0Oe!j> z)~tY1;o@NCym1ZO(v`znIIxNs-k8BnQ5fJ_QdQR~N(ap)l7=OmaAg)po*ZUI6PJ}Y zz&dBJst^7!*eadwF3?kFmaS7&6@Fbiuvm{-Dy_B>mMX(#k5tWdYcMCv zVg0navg=es*$RcC;ic2c>eo!_wP@73oUG{@G%TxEyc8L%epXdh4b5kTzXnzfs;aMV zgcML?ed98G2%ygmRw!{TNUs5J&^uUPscwa%^g2y!XXIvVX`Qrgf20-FK;dw)BDKB} z8Z%%h|0IyBK5Y7{I!g_*2fg=caBHtiA(7~=G1yfmK7 z#f0K;DY0ZzU;#YnLa5wj)eU~ka(K->UAp?pwT-YOU%1uk%!R0987+Tp4J=xO>*MLh z1D!@aEPv#$f@OIcA$r+5Xr2uLtTgN{%raIe8NOOmuj|^cJ0YkdT}`l>6q^-R5~IEd z>kn+f0Z>#&Kuv8!xDYzKxP&4tP6e*kSdD&(Z8y|}AybgcHRb-m>aue1a=iqhzaap9 zDgsUiTQhlkh*6_0YitPkIij{}xNEMjtVYkmRu^75&KZx^bky|`AuWG(O>5Xd}8SKy~H>&>C3w5PG3HT$EEc4~(Es!0=j6 zE!LfuSN~6*`{C13ezI*{4?hFH@myZ@!R`-zyEzn4<$c{FEH`d!j15U8@>ou zCH+QbX<6?>@elUX={=xBNmqpQFpnK1qo3O^=r=O`o|uO`4|>%|c$X2Qir}q?Wm#YJ zPs9Tz1Ao^4!Sl|lHRaWf6_rcL^P)XEtqH(G)cT556W74Z#l8<$qdu&SrsBWIw4w<| zW&jPky22c5SD7QM5{DgFJzRnPS?y9|i=||XrTDOVDLg-3s-I;qHP5h@vVrRxDk>_M zg9dn%A8wVfLK}Q+;<(o7W1|5{c$*X&{u>*rs!e8480HO?b!*DP!~}(;NdXjvJ6I!t zV}?0HZq5{Z4i-o6Bj&&pf;9=1p$PWAC-RPoTg75XkY^k6GRZ_W;j4cig9V z89$FN#(M154G{a=?qQd@2P^~?-Wi~4A%(|S?*1P8&KQUYkB_kia-_I)>RvOlmkx#Q+R=tB3% z1?~a2xck}HL%|og-3zc#_kf`Wc)MKB}^>Ot)_aJ-hJoiQRmGj(VA%{;w{CN8nsJ3C~F;vS>hfhDXp8$~z zUA0*E_HAdY`je)vpbV!J*435`-i8R3^{3QNdE37FowO)wF&I;yPKe*;apoj zVV=kS)lHl17vK`Cbw1=S?N{3E5?GIw*Ln5pyJy$Ry!2-iyOhKb3OK7K->A3 zdF)3)H`F0sf*-$UKYr6ZxR?jWO&E7;P(9zEIH2& zCWNZJ>FEg7aJy}}GvYsk3P*g8<3_YYH8k-U^~o6-en2;U{Xt8wpl386 z+>7DGlbZ8r8V-J3bLVQ_Cd{mnufGil3&WZD41h=LaL`>^559Qrz1^mH-&dfoXbzpK z*!F9#zvSx`vR88$OvScKbFZLEJ)(JhAO4``^p4gM`XHRUR9KIm3sAU?oqvSQHeVd} z39bC(`G(`Ti~f?^`b@WQS%^y`$KwuldMzLJbC&-gN`AOSPlNE#r>CF?=e4-u zZzi2Q*I+dq_$WHZLx9euo?7BkPaAR6GltIb&_U;tzv|#Te@DbWT15HLB!h<;aE%*s z{ZWg#RD}-i)bp5wJN4{waHpQV#ASIqh|BUGbm(E*VwU(^>Pe^kNXag!Xr_l(Hfqwr51+&Svary(5mJNYl7@G&vrbe-~TQ8@k>2{)<#`%(D2Q8=zG z8c|Oa?uNCfBgua&3Xh|Tm-#G@!k=+)XS*0oA55bjCtn(c>yQ2+qf-9)DDnw3b(8X! zMB!^4+&QcHeH1>1etv-Zo$@zE;YXwJbNhwu@6>Zs6uvtOkE4&wWqy`L;iG5@DCJi~ z;eU<7bM$Awre2)+4>-86$-(WsX0o#%-oKgz|Yl@!5iNe?4FDZ;<@ug5#RpxLsuq zA^k1HzbW_=#LET$9q}r`-zQ!pxJ~_Cqu`^6-yrx5;u{6OiukR9*Ac%{@H>g$BX}F} z?+b43>)^)=f*&Dyu4k?<^BZ-gekA10Z@-oLso>@})e2T4HXG|Hr~dsJ!8a4%FZd6M zzbN>N#Q!Mx$Hd1V4x7 z0XGSLA@R+E&m(@D;8n!GBX|?>dj)@t`2B)+5Pw+kcZfeOcsKD~f~U~D{w{G`kR3O+53E(Kw=;sr&;;46 zw-c5hLOg-y5v=DT;%0@Mu>4Ho=|cW0;ui?MhPYYxCamW+;$~%=F#iE@vtCV@|Ax3( zohHnGL42`D_YcIsCHPy!D~aR%i}S5Py^#MOx`DV+@MEN>N$~$6zD;nJ-ywJl-52c? z{CmWo68wJR9fI#5{-)s95`QNOe^2n^l>cLbFD5;w1iyy3m*#8iKP!o+2wqEklHfCl z=SJZ^!Fwp5Ja6T6lj(kSiI8XeuNC}D(sQHWV<NpSq(FmAUCekbt<1cxQs^!B*mml5A9cn$GC z2!1#5H>2>s34Va&ucY}k+y7Cj7oP7kXFtE5WP}LrhWi{(BCN z&qi4PBMy%8S5urHIylO6Kk!orNBKuc{wW7XdF~%N93173lKcw}j`B71aP*H3j`EXe z-ub$Nqx`ib|2GFmd3^7M+hGSsdG2rj;ovBLhU7nSaFpkMK+$~z+y7+t}|KMVc>@lOPQgZL@IKPEnq z?lag9F=V%k1kWPQ_em_z&%u@pd46xPR`3eabDQ8d5`R?iHsa3->=XdZxpB9|^Pv?6dOfr@FnIgJxL;cS8 zS>Gbg^*)yJS>@nZ-lwR%s~y}~FY6q9D9H1B*_#|3_4KFqu+hO$&mSq>I~*M4OGv)i z!BPGllHcLrm@aRRJ2>jG$zHn!zm@bqC-~FEUnkCX>!1XV2>Gd`pYM-ZK9@5@_W{g< z#1jPHPJD#myNOQ~yp#AM!TCAWa^hUSyf9FU;In9+cAwxi+;0oc{ox+Lw~_pFg0~WX zMerwx|5fmx5$_WG=fqD4{tR&!&1bp1UMd$XVXZgjgNct2d?fL4f^&a6RqzawFA#hR z@hb%XHs!Na@SBPA{RHRpb9#8NS;#ZLL-5~`p6!CaM*K0sT}j3+y9MV3nSLdBf0F0> z2F~Xo;%^A~k;FR%&mjJ>;Mv5x1;3ei49#me-CKwc5d0b9=L-H?;ui}32jaPc$B_MJ z3*Mi2vEW0A`vp%YUM={yh_4sCp7FbcM1L=@uvm<5%J#%zL)qL zg8z#6A;I4y{!hXGN&E}J3&{Sk{Cux=`Uze0{FLjxlX#ktXFgW&x9EC`;BV9QOu_#~ z*F}O?Q$D{TcnR@kQTR&1zfSVk3OwHzXX4rIDhQQ`T2x+EFC33NAOqadbr>p(e+fp57PC;QTQCe z3(0RU7ko1DB~f^(;QZW`{fNuO^}9*P?m-0xz#DBnQx%Y;1l4{ID8<$3;B=isQH=M^_QILZ&E`N}2-NBQ^3 zK6g1d$~Thy-42fOe4q7@gQI*K$v@)YD9`sad6}3 zqb#3ou)0g=f06RPQ*gddp=hD+Eo%wTZEA>fy;JuV;_FDB^Nabx`{HB7v*^g2uX6=2 zrE8zy)pX7G_pFEYmpbIhg*6EXob zww+Em|L2h(wmP`8|8EnV_3w6YryuSWoc)2n_r~wGoc75gdE`zzlsLGvyg>(dmaEml zo%!eID5&3=PyYS^?cmJMP4qmH?N4geUGy9gxidfb{|(^A_B2Z*@zwReZI^4OoKqf4K?4ArM$;<16gcYk>z!MKh;SRy3B? zg_nlF+Tz0MH6wauqo&;XJMeOq33b&_whWHzSL5-#ip=S_%f;O^+)Y*It;@{8T{d1$ znu4dWgVV`)3OhKRgr~5B(=0sYhRqG)e|cOF?U9;ZFAZ%$bNM>8R}O^c)@wT-u8`4V z=unt1bk_TXnsW#?z}ea2bAQeeWc)uzi65W{+`mVQ{~82HohaM9(8LH*fw6x@Ij_N? zZ`~UpJW~E=k=?jIr)YiBs)5Ln(ob4sVsubMOdoA5)Bhf@Na-J-O6Bo~)bvT~ZU~5! z{;QP!L5hg!W7;zP?NQ4AF)973^4}As{B1=hVQ2byOC!_A_r8(JUrP?j7)plJ{Co$|2tqPBD>SrOn|U`9;N)8k5wQODgKvv zIy#%dT#zhYaQutlgwI1la8i=*yb7O7*<%!+x|@*T5{l35hXc6$e0>z+N3vhj1|!i- zf@r@~_~ZC^j@#RmzPSqTvkJ`lC^0a|{J$9`{nVg|?@S->qh$IUq2RLY7<0*76QA1; zri*2e@%7ZJx<0c!vu0vCY+1OY&77P4)a-0cr({i=G&L7bOXD}pUNFaHg-c|?uT8>N zCVkwe*M}|a)7Ymz1Ig1jJkx$6LG>J8A&AF8lEbg=i?nEB+%-Xf7f5EQO(ZP$ixO}@RTxwS^Id9juhvn}oyC8V+ zvi|n2(qwB_&v z{4=)wr_(oh+E3NQw*PyDx4qjR*M9P<`1a$A653C1wp!pBR1f%3v)A(V^gup4A5|^? z20eKF1?W8m`cFbS-H=|}=Cp3KVW&M<+h&LwzV&#qY5{xhG&W1o9Lt;TQG4M32nA$tT|4>vXjd!yct{%X%5%EM@4UqD@@_g6XISk*G(bl&Tj zzeDy=h&w{Z)!~UM$M9jmhlF@(Kb6y%4C(7QCT)~&O;9;q=lFWiU*WegdrpkWYyU7` zwVbrmc6t+icXy3d?eJ+q$`??-kg*h$JqdZ;V0({licuw~5AzE*i8+UF^|kYLaFEHz z!}aPv`w^Khh_2z{KFW4a+?YQC2WX>o0`61i*Nh^eJ zgm_pMZvXJ=y}50(zk3|`AO6j>yhp7Bu(>@P+Sz>Y-Fe`{bHSGj!KW{6KYhcTcJT2Q z^z|>GT|Vm?di0LVRm;cV*UL_w3Ds4rH(Zv(lztE7zcbcwuCr3Q#yr7ycDjBx={hqu zDD{N(=zP0X&c{$MPl2Cf+FhHzd*1=5tF%$-lVvdUeF(OI-^!=Q!)eyLW=U zjzZj^)p2p2`?(pbKqtgq6LfE!QHF7Tme-DPIzB&B(se3r+U-?Uxe2SPa#vdM^KP#i zmpjg_S}+{-KLt9mKJSAgmZJ;W-QRWpf&B>fC)lsJc6Nea9oBt~7u!`zG`S8TcV@o} z`kmPJ&kIz~$*ba^zlm=@z29o#z6ScwW*AAD^Wn24>}$5bF%NXu2ZP1f&v>D~#C{|t z(TowRhWYkg2mSblM71^^Y!VM~(N|F4Jm?d#U-ZHs6egu`|z+9<<8q>$N6@3 z#=3SLNw9Xo%4)k%=8&DYD{j>A7H`?`7G(u59tD3`KY<_4XKx-NHNt ze?}FmYqSlfZ~rA&{66*zkj8O1P5?P9KiWs3eIWlbULK}(D4bS0=|1tuuog@!2I3xy zhrare;Vm8y$_)k|9t8dj{SA~MJw|22^R;HQ%Tq3phjY$P`I|;Bj!_^#9@BS*7rfm! zJW^lvoD2J^6zHqwL0>f&{2%89m$pND(0$YgkUv>2wBeYyjQ;m&Y~8rUooj6591Cm>>Mxjv3!( zr*+%w)V|m(YhOo9-md5S`F43nv7SdjJzouVumtMjDyWkyp>D2#F{z{- z>Ppu)`U2YJ6qGFmYywWL{qB9R4f-C|{Shc1=z_V685h~_FwDLcY^HtLguf5%1@*Da zMvxhUGGJTQ!9K(?Xn&L|K)Lj=9O~(UIcJ>Pw{PY+wbq-WN>bu{`!Yb*JL<(@@omB4 zG%J3k&!bA7?GOFRlhD^$!QxxtuM5U8zm--O4`bszYwLX&|2ByCp}Ot9$A75W=UQJzZ6o4=2F8whncd_0UZx(_?!QES1c zN~Xaa@M&l}T~L-d_lT`itl?XSSR=N62>snP@QLEn9$(Ko*YK^akKp_;6>K?d=W&q5 zGPWL8El>$5wAm@u^#?F zNBTxz&wG%+!;n7ann1 zZ1}zeSvri9EQi-P4v%X*ckwK+jjVIDVZjbl=h$YWw#Dt#7Gazi34LKyxyQnColq_- z-CQSO9IEG!pj;zH`0nCTZ&ln&Xycg)YAyQu{;o46<8DYx zo(cDEhoJrZR>f{b?gL#_piA2Q@6aE9h&~VY-{W#Yf1CpIWOFZ*ZiW31>l*viE%1l- z+y9ebu^)6kwakV%gF zQ=FILu?yO5D$G+;{+!p-0M7^p{WY)WP3VgP(0)>$fA=V5VEP%w?Aeh_349k{ZEgUZ;z3~{GEh$ zJ`v>b-Z%cy;VtZAad92jj05|`LB6VBuIRPmw{lxJ-?H^sYTHK7kT}!#4-k4#K9Zg? zY)kHq#pfN0X_>A4ZQxGU;hi#}1^zqxm!K_w0?&v`+M%8>A0J+z)_JWVN1@*@NwWqW z#rwOHG+*d~_T;>Wg=gz9UljrxFi*&92VbLk!VrC5%yo=&;SZsn;hDtv zahCU`aSspwQ(TZhBzy`~^sw!FSyB(fuu$|ead0>Zv_c!VK!+NQD z62<~xfu~i^0T}mjtPZTS_RX~P|H!!wGQ9ya~#Iep&^6!?^#+!{bwNx4|`xzs5Jzo=D;C5Pm-NFL3XgB6XuJ?GX+; z{N%3WH6ZuCowifTmVxYkhb;P30P^C6yfjfi<%RsTVLt`wHNvqA;{5!~t;Ks_9`mBh z`_c|q+)?;_UkTRz?OztXJ|q#J9i{9XUzL$-SmEn&Fcyw?tLb=+=h<=Q{NeuaEY%vK zpH)3I8PaqO*?Pt4GjQt#Z5z@-`S_9QPxDU~y^g+g;Q$kF{^`QkFC1jf#}8H0(cc0f z`y%*U75G~fjN5VGa{(B)yx_xucr#bT@<;Q(BcqMY*#AaB9-RJHJ|=8acs8HnwNkdS zJ>5{|eDE2pTeN?9+Qwp!Y6`WB<2&xcpN99TEA+83L&AD7zv#D|XXC#G&>!T3-{O7Z z3)+v**!b+k1@{s*+*8CrU*QHB5BPK}JhSaP4)ODnq3ECIsI_I#AECbv9SY9{z$REu z&Ohd9{|ZN*upfms;f47R`hOcdYeWAZ2mb$i@PBw7wNe4A0)6Ai|2JZP2XiD}yej!i zoXSRzVY~Ve<{REYzUftWgP(yc^i%N6 z8|P>6e8%m25}%9VT%hVBn4et@WyJF}zMk=xZ@T{?m}5bnGGJ~UXZhB9<9yTMe0T{op zbyOa3)Did%zH?x|f!9%ed`;VT^~Pd1yaVC7Ks~Pb@HM`#$c_@Xd_p)qjF%7PVLd0_ zy(@V%#JjL+WiG7kk~81h@Zg9Kbw8`JhHZuWtD|{fBR@R5 ze*PSozknaW`?Y3#Hv5)KwWPw_VZ`n&$vIK-v3a7%hrahUzI9?IzHc$}Q$FHcNkIq{vl zl8?X`+<2bK!MeX8R$Y!|T?X^ItIkm^XI${ielYoF)%Ce6hp3!+cHCBYMz?O>#YL}Q zk=XI}vo6;sn}?{9r=dT@xEXMMKRlmDzw$y`$iVad;D6v(&)KS^4EU zGNjm)an&Nd(8+aGm0Qxu9 z6V^{R++$+>jDk35W1f#-n@&?BRxRj0Q_}XEEy>TiysH$Pcb)TXeg0fJ_&fL-d^^|2 zH!=T5W|;izXK~Q>rk|^_aXdN+{l*aJe-8A|?+(DYC+kGVo$II*xJQmOE~4C{^Bi(u z%fTC6E#8M+EjY%;!ua-EU^(yS_1p{n0NQ$7-Z}UzM)yI3?u7QZF{Z`-HjI(bHb;Ye z#qZ&nE!e<)2=A*0?L1?f`*fV+`W*Km`Hrz+|K(gxGv5t9;?{Ew>~Bip`D4=$uWaue zqguKiSMA6!A0I-!#eW~_9^duhJ;J0N_l*Zz%(dV-HoUL&!g1aJ{oHyLyjv`pJKMLn z{mhvh%%{^{aqE5ic#PU#vaxual{6XKF#0a0^{xx%H_(O#Ti+dq>8^wL!@%FJhcqmF zHUhTjf_V`1Gnc2G5BJC5d)U74o`2L|0(Aoptr}qX^E*Nui;Cm8W zHqE>f0C~(a#u;Tbh2+r&tRKer$rwLUo(rxF`;pUT*biXehBkZ`{2%*dA3U4tdUuPy z?u0q?VCWy=JF*mf4zLkq8!d(NojzmX{w3iwPX6((WROYut{2(_)X53BPw+xrLcLEr zU?ok9Q{O8dr&{ZvZ(Z36bFpP^7&kzEH1v)5p0evFrae9k>0{V=!1Cdk2W^7;aMbGt zowFnOt!`uA4Ce=R%RHk@`M1I{Z@%8w|Ii;W%|{#I9&)_|gmCLil>}sh>o>_D?s4zH^W^8wlkZNOQ5$Cyl*IlTEowH)%U;E6vxo z*;eYZba_h;$C%@5c{&fJZ{_LvUfJ8>Ys_2eVZ#S`OH!2=`1&wdH*lMdcb5U>|=PZgy$!~Z!jLuebMeQaGme)rTu%u^&;&p)69ds zKe{h$=Q8qDv*I3+d!Rr!LHhFpdanliS>-%R)B8! z>_3I?Z6W_Dg~0G0SC$2Rrr_DI{ZL;V)Wb~BR|aEuARo#DWm@U-v}7!F^#q;=f4SV% zQ|N|!rbM;gKT7RIyB5N|dxpz5HQ<^v9j^l}&-6CSH&v#G^=>~OPVacloyk)me;b}x zSVwvuRR#9McjHz0s%K@U3i(ADl#lC{k1%e7E1R*A@7vKYFr7z#W76UK^`WGn{S3!e z*5mZiK6-w;vG|`6#tHO;g5NpHV&))l&(Ql@t}`}13#R8uj(cy;cRu77#_7;ArScbz zZ}GQMSSMHqho+eK={Ub12Y%(URB<}^6qc3Cf%d@sJ9V=?#=O+q9`I2>3g4r`^H@FK zhkM`YGcSiZ56nrlAKz{6Q^%1{px=&zd(;czotz);Q8Au^=QWtOO%R4{pf$p`44B9A zSHiYJ+bx4J73(BYUXM^-Q6I`W?X7gA%(K-dY(LO0yN1AgdcUuG<>c6w!Z@{Wt_9DPu&;8oM}Eeqz`tM) znKKvS!e^f;RnQ+{U5Tm@wZiQnj9E~64LmAL+=DW^FWm1Lko{i=|SdKUDn$x`v^8DY7$>@Ut z(82j^fIjp%T)zqab}#6{@C+F9-*Bm?;2Z4}w2?K@v{&?#(s>HrF~NJLFV8%s!{8fI zv=`1hJD_YjK8L{^2E$5W-UiS0_8gCgbl?x|(CUhTvfJ?Ifoa-0Kn#qJp9U7xnNaHM$;f^n0f zo@76Oc{y@8+z*t3K3x}JV||2iQ`-jobOY4syEiLnKYe{rd}lo#^P~F>uel!%9QL$e zePUiWd})o_@T9eGLmiaW!uDytwcPNL+PC3))wAIi_;b0|BM*$9GkpWhQ#Rb3+`i%F zA?=0mTwud^&va}nk3c)Zba1TSaI?F8!Dg8@ty_$YXzI)xtX7u`sVrRhRKl5E2?K3e3Mc7nvvUZ^RRX-lXHxQ_$knRPb(`t%q$Mo$Iov#!-#@p_iVeT!R_g+|ko$&5(AlT~= z*s>ISAqYqGMf9^as0$3o`zU_jh2;$5b0DxOKC_4SgVVdAyw(=G-P&UEd`~0wF{}84)lbYCzDSAj5|i6ze1ejFy%_5;B1R z5kiI5Y7}Z?r4=n&+IkJBw+&WrsiH+|+o;@L+S=Au+j3jm#%kMG?Y&xQg;p>B-`abv zz0aJclRlFs8|y0!kQ$Y`Xa^W zee*)MmoIkqjg2_8Cw?4y9e5RYBrt{^$9nwHNprEch5E)Ywo+UkfG!9C6>C~ zWy)Uu`TEEj#6H|N9klGgu>X;=X$|K7-aQ_8)jdvarEr`*sdkG5Sg$Ac{R3x-e{T(7 z|2T+oAcVdcR%eRX|9ikWKzfEA_$%(ol6~lY{4cTB*9Ut%^@R4=~OR@w^$RF zQyJuQ{p@qzvD=Ll8GrN6OUf}Hq4yi;j*?N9aDepW@HF@a-<>wD(Ts5q%H! zN7$BdN~b5r8Q91lub+gyT-eQ?NsmC8G;UKY`zw6tZ}6eF*@sBZF31zvdc2|b*LQ(% z4^!zx>E3rLh^}?gwzB!D-Sipbu@y9z(PxbQxlF1~XcwOzd&lYZ3(;x+yAO8RdlS*L z4Tv^)`E=(Y)h2GWj<@bEjzha`9P+l!TWAxqlZ!SdJ5br=Ph;N+zIh9+C(+(x(BAaE z!Cl|Se!t?=ZGw9qmSK@&NHfP#(?EB9&c_)1C+I z3DCN*5dUcZpUw^FJf#TuTEL5Nc0hZ*jd)UiN`tM7%;t-E|5-apFJ(YkE}%@*QSfrHm?+L4Fy*U4*et$o5GE$w`Cn7p>xn3QS|6swC`0;)4H=3`K9Kv7q>6>JI&t!cs+q(83-5a_W`cQpf zpZY4KEhKqp$2MR7D&(g&m<%3jhc#Q*9K^liwNxLP6OgWjR0q&*!MiC+CelbI=}Yz` zU4@tQ^uko;E$^Io^v`-tje6)g(*R;rB!c~WY9qA!DplTCRUVD`(Ca{?cF|VwO)n^& zzqJidyc@E%YHIh%Mn32Q`{yb&UcgV(8Q$2^_?xtMK)RJzcYhH!oxyu}s_bppo1l4G z68>C>GS?t|&G7kKzmNIztAJ^LLHP&kNoODM5!^$;-5l`$47w%3--{>Cc-M}cdgsa1 z_M1VI*yy;&&L6-SRB&DVa}k`we-HKT!FhD~jl1ZlJxUxaK*ahlp#zq6>{BZ`B^LEk63ylbT2 zGg51~a=OdqA2;6$hAxGXD&*(Gxz;1zI9POo*!eG4H{mw+?_eE(Y<{i+L-#!d6*B= zT&t(TdGlrH7NOVxKUO}1^V~&Pi!7{n4)(JClm339{(1PXdIu5j_f@WQZyy^he=UOj z^urhvzV}}XpI-?5N%v*Yo90URyC}C0z>Y4?&oMv47^cU&-vuh@?ov6;8G5k}DhNhy zJ^vKCn^6ARLf9jM`&J~2(w0F+1oy2LLN4J8A$u>@Wz?4U0+%tA(teJ+?7bhHH}h%i zbsxrFcJIWwTMy^qc?bF!?0dLS!-q?pnFAPSsa=w&dv7267H^G~Qz`W;(62_mID#ugaR6 z&aE0#)}LnH1iydpJB3sR`QQM`#Y@=rS31F4U&URy$$01Q8Jy1+VO_LhrTgYu_~KgZ zGn@`uVOf0Zq#NCzAhx}E>Fm-am*Ot#8r-`qoD`qArUK8i@GQYR{i&yBxli@YT8aG^ z=cz-0pP3bS>gic4ZwfrLYIxV|!VlyAIdrFYpBF(!+sB;8@%LQo3vQe{v+$F1XBOQu zcjm~?xVKOGR>$*;a3|+Hx9EYNV~sHo82JO7S-*yMQ)>lt=LxcCA4qJY*9_W^`h$8u zT5KjyDxcy5wbc#fc(0M#4t-qO$$OWrfaCW<2X`1s<1^2M?^9fexJ8%Z9g#~BrzXQk zruYB$*5Pl!|KSt2KZxg}@L|$iTG)T+1(meDpoU%?Ao_uVNBxdIB=q?rRPS&)esCV)%oWbFp%U--kx9?QCr!nfa{@|{YlV5Zmr}Ji7 zkI;FucfB8nz7fPo@}&Xzrn>h7U#0i9={%?lV8=vS zF1+7*%^t)S(yJG?mOTp^OGwA3{_8~jU&t0bk0(CLulCR=9c}z4q?0{y7irKjs_7-G z2l44KO}~pz_+Yv>y=?R7G0oezt&IlDd-|(4ne$lDn{@8yyIQh8Nb}A%+}EOc%V~fq z#?x3&bJCTtaly*a<8-z;iS}q(LXSsaV+ZHCB(pKkd6)c=$|u?LFz>_~7u#y~-NfMQ zx(;#{Mt43Wo!Vy`r<0ubs$-wW50V5!Pih;|U)pdlVo4Hv6>X5)R^mK<7(PLIN=zi* zGH27smtq&sJ0nz&?f6G~o~OTcQ{5EG$9_WPdGk?y{q|S+{&G_ty*o{9>#vuepX~7e z*Io6O;Fn%|d+(~#JNQF+UxenP)K}(`&EX@|SNwIMx<4~=o4VUGSla1G6Z=topcp&g zd*8r4)v3?)u0axGc?5e$N$k%aMjRqpw2wvmAZkyB{3t`4%pbL_j_fg*UfU|R)sa2O ze`wx17|+Yd{}bXt|Cj!A8pfnH%*Uwz>?IiI?5Zyzp0q*N$(Y~ZZyoHP}oVuLk$g`$li8`zP@JcAWF(+t>@a z5B;6`cLZ|)!Ut}4j?td>E4cSc?fN^cUGXlIS~m<}zJqn!TK6v}>W^W+ErRpSv2Mj{ z-SCY_QQy@AmpBJg^NvDZ{k~%38z*KAAkW*FlSR(OToL&OD4tW>{v>p}>+1K*U&1`% z<-(gDjNm;J;z^ROq-Q@GHB3}gW&9$ux-A;LvphwIw755Gxb6^~vkU20B^v_b>YDU#jxgb(2oQZzy2BG?`>3DZb(E zAlBRT=Sz0dSWA07wEsbO30v@9Lo56N;~MSbPW~PC;a?7pnvA>MlmCFa((gD71oe3y z=^p>Xwfr?& z54U~Vp?AEGR{>6b7W;3AH{BKSnnl6#AIyQBlTU|co=!CEIVu|7b4xz$9N+dPXcOaG zB9Kq-C6c`4aGY?P5@*DpRBKX$DeTlBv5SO@pg z)jTzI-@5O=PRzLWN6zsi`cC9OP8?XN#-^^i#*j0N#-(H-=Hc_)ca%-hUNnbl3k0?v zrhbNWqI=gR-Dsz=?#Zw1eeFa&-Lv=z^-ZjAyz^ndU(bciXO?XD)0BL(X5#()X>Ip92Pp={Fb|hLD*dwxymLa%HEYf; z-bcT0P=LK?oX2lXVw_4|>dag-&cRq0IM`U?yxX?S*}50wBgvwD%2@c4hXxRz$3;Kz z(6w~0Ae{G5EW7}}rIG*8xah?X(LRk64uLigv@mG%A0qwwKNSEi{?PAk3qCY(t~0a$ zQx5RC5A}aa-S648MV$%hvHvB=55y>T=)Of~Fa4a_Ak@WB_&ka%f-MmxKG(-0U1*`|xlq zi!rBfgk58MHsU_THN->f9jZ?f^8n>LH-+{!-W1#yfm~`Eu~XY!=<|?6JS0ETg+Bj9 z(55-+?!W(T7pDgxhuvLk|n=;CQom_S9?P^dsBMx znO);!*yBQoXx$=mnQ9M6@b8zbK zsxM5leZjl_r@5fghx!-VC`^>(O0ix?e)99D@N^tLcPXX0i-tuG z@%AwihNp~9m=sg&R&x%A}ubs)p^xHNL?2J7XHD1xXHj@D_ zg3MP*Ch8;a*YrcKykA3dy>=)0?_fLu|MAG3??KlJ8_XqfhXwES;YoK&$k(V|eW*h+5P!S^`qDcx)DMYA^(*8j z8L**xC+0ior~Y?h_N3%5SNU~cOFg$OfNnHzd zuQ+$5y$2fCPyZ9GxyseqzTC;}#~hUGhCM;`q%oRkuID`pN^|*L3QCjTgWQYth2*2T zeK+obQ&}rf)-$hl)!hu7`Y)CFd(7hw^ZcH8MW>g+Cp=0IpFY%H{`g0I^yn2Igbgmo z8UA9#JpG$@l>fxG5bRU3@12j+yYHp2Q5nWZYa==KoGbVsq&a-hDXPi==iv4efg0{%v(vA*M)Q3E;h0 zmw%`2z4A4EeOujS$fx^|J)?TBJi&*z)m>!r=r!hh@!tpjX~ZAYc6=}1rbo8bogwuA zf3Ed7{lGSL-<`_PzpbTnET&UT^S;wP zn9sOsu0-dzSD;UP5dJ}Z1~DV(=`(6?!FRW98}=2r-{^5OJo#_I5c^ILdxNR|L%;7v zekkjL2=++k!Cxd6G(Dy3)6M-~>Y;5&cbfEl-S@I#@R{7(_CD~wpSGQU=zX*;@=)9A zx@aGzw%vm>GqH!*g8I+4fAzI3`)V%jxzeM6`I7egH)Y@G85%DO@Vn`*~J$4^ku^4S~8QSJjjN^;UI8MLAcMSaj@BThO=d|j#Yq@@n z*yGc6qj`n4RUiFkFVz=%kPdOil|HERan#G^IZ4^WZ;L&!1C{$&;G|or%taVyk7K-k zoPKKJNXImw;-+2hwXc(wG_TqhL|%PW6=ow-m9I1 zU|y!y=QRG1uhAGZ3io!d#D3AW*o*Ma<0yVmzj*m``mQ|9rKtQph*<~mPt_51KhE}{ zF^SSr=5I)o`5VnU!l&!FbR)^V6Tjc0?s@8Y8p$J`2_BwpcimWbvyX>jBek*2rRm*p zDwo#X=ixo`V|bD*cRuEbD4$?8USi+wWu&>77e(-Ut=ln2xEc38XnsX=M0&T7%HPg& zsMB|&Y^2K^QSos7rS9qpnKwcf!IGcs7W_i0-3Ikb#FV2~EJ0hw%b=ATs8@O;~zO%I?w(HFJ7bRH^a@5}mkxCy4Rq%H0PUD_gqHnD91 zKl8W6L*BOF-;$-aU>Sbf-v@rL9+_>w6!xr#?U%s5G(Oj2PV2Qj#qdI;7lE%Bc8_9C zpAx%=X7|(C?s#Uhds9!U?#f=^m$|R9J8<$-)sObT?rOeE{fO<3^u717-MK7dchHU9 zQ~JOlcE2}+-ATqEK7Swhv)Ns*BQA$M7sIZX!QU^1&FwnMf4`6J2-5n2)=lbMbdY!V z<$e2J#2|T}-{G}_mv$8Qcj+#je)nF#Lw@lE=UlsCts&uzu@?O)HvLcCI|< zj}Jch%E4RyaM$C%f8uk$|JEIU*n8hO)2gT8|EbmI@E@Q$r@d{}#+4hlo@4&xgERZ0 zSaZw9wvV>N@VCG=slVHVznirpxpIB;rsT@CEh{=UuGVDyNw1F0oh>WYt=!bvvQcq% zZ0OkBz7n)f{B5pHt2b<1=ggX&DlfTVb9-}aealB%HpY@GJ33m{o4=UVoLsk}X=Qs8 z{*qMF#+FWJ!NSWgh+P&l=`Bso$rOh58)EGn@HfCV#=uS`u50V;Y+K(NOSZJPZvgR{ z%`KZcsY=&wZ0l@^HMMN)Y+K#d1Pw{AO>5ga21#k%&>4ed4|A+@Lu^ya`etXtwd=if zCzS`7+gXDLbRyHMDV$E%6ZkTja=Z1|fFyp38Z5!4*%Jw8#HJ3P73_vW!cl?Fg#)NWh zo06!{rfb_eo0234&9uJdS}P#7siUPS1~-gt*xb2l!)6Glp5ZL0U%VvN(y^f_8M{`w zBUL!1tyZ_UwI(~Y8^ft=JDE~VBN@u7mCa-^rBrMk>bbI2xtTV$q^QC_Iu(DbjI;nS z&Dp$u?RxU8DxyqsmMmHP(Q}cmljVuuqDp0VF0WsT8dDdzR@G5Ad#q(k2YLe8_^J(? zW9v3=>WppP)DrW033X`tvv3<%G_9(FU%)_AG}+eJo2qOPq-<?YlD9o0kO7C>(A(nZ9r&n78;k(L<%3dY$aqPFZusgoWi%j)!H`25M7$dG1}H6KLM)w(~{vGts6}873uw$ynh#=pVHoSSAR>QAFeZ`T%yQHY`tq9)GGTKBE0_jsspi|4)i z<@5i%w&=w2$ByQGe|;|`OxgAo$C(nZTe1l z_b(ToH)iScUu>(G)BEoDAFtTf^5N58yzimA#;kg4S?rT_-@NB%lkz+6x@%o)@r(~% z`sD7=o1N{E?^m97-L#z_x#aBgestl>_gp)rvgGFAm(JLB@9X*Z-uCFfe)x?Ii|fAk zn=^m#w>uj~RnEL~(RF{ibItEZ{&ZsH?!SjiM{fM=)t`Rwfuz*?%s$7Nf`9bM!#|vn zs}Jr|J6MmZ5B3=pozihX-F(=F27g}wHgna-TNn{aHQAwbN+Tsei{a7b`3F#aV*DgF z`X}{cvU%XQQq{+G5&}A|keWErJTghaZkqbIPOX4eO0&t%fL}@%(|h?Da?0+wp+~U& zOofI5_8C$OL+0U^EeWC)qzE|6NNEyqA(KMRTW+F9u*HTkA>!njskkvVi-0vu(y|4U zlA)J?@f1cz%p+5YG3G!M2qrs6~8p*C3L^f>_rhGEV zu3|3NSt6iU_L4zlFG&#$B$MnZMs~e`UfK17$ga;-cD0ecR6wunrGv;`nyc*TM)ooR zy|R}LB70e`vMZS};8gbrEW%x&+M!2wm&lysCy5RO)1;>q)dI1j^(pnK5HyW?y zMDxhhF{Br}&Qbvf*suZTw%F?oSB11Bq8XVCWD+e7loZ_N!<+Y zw4}Qkyx)=@WblY3McDG<=1@&+(9cOAi76bKmEaR}%AB4EBc=RAFC4>Ql_ga(SYt`E z7+hdU2?iT1sgc1Ln;+r@6gPopS|9tJsX>~Vg`$wa&zTA~O9icDVKSoqlDBY*mC}?h zrO9Mxz%NDmt#yrdaS7Wb?IKuQ(RH$R>Fc;aE4WPrO9ST+Bg@%DI9XL64E8M7Jp471 zg70Sz*J%;Z>e4E@TxSHgN`0+*t)>tL{AE4J^aG}>gn)g9RQm?I`!VbG0)|ZSwduu6 zXJ$$1!+s?TlzNeKNyQeM!qy7dZ%C`9LEDYLXPsCc=G-sxlM3tP?D)e^>O(Yv$AmP^ zb#SdI_2W0AUo-|RQBZn3MrtX{3T{Xhn{FUUXH_soPY5`k(;!$tnU3Y)WFk0bq|^#% zrQ|#%6rE6S0VUF7h)q{7=lP&WgA@VFjmGuqg6lcaJp3&s2_g-L+ya&w!DfiHrpS3F zDAF)c3s`IfFB{LG6`b=lP^4j)7BFH2Uzsi#_a;(5*-i2Pe9IX0|M`|N#ec`Q;zmkB zz=ejCb!?X`FLD+=#}llS<2c?4=<2<`M`my`M{}KK0qMRSeV9|wq#3)K1>BX&Dd--< znGn!U?wTuk@bJvgbb0pM-}e@ClGMSY>;W^#H5YTS)u#AnD^f##!ClO-i=P-B7%~rk z7GY>KSw19FkbX;I$UOW~Uf~p}QONmJZ?s2RKq{rF5w4HaFNoDj&lV=$Z7SO$hLy=J zW z$_>HK{H@|TO@6&V5~XZeO;VOMeb(NZURG;*S*_`1wWgPqb>1reB*ukxM6ejnV=!BZ zto_Gd2{=I9_|LQ4H5E~i7tD0>wn~9zc8sz5I(9EJK@hsCi-UtkKZ7tq>xjo3J3Y`iAUpf&p%F?+A&>I-SP zc->2VupJ{Uah)Y?XYjBkr8mwR*3djM86?gen7<0xZAk3`My%7v1fF8Ns$IYi51Uw_ znGa}&vPC6LgZ?Do-KMnFB00&DU1v3GY#y0vE7Dx&N&#)dwTWQcN^R0g4mS<90Hl>{ ze`!l^rMC1|YD;gWtXr;rC274XTJ~|IA=2lh$GCQHq->^XCj7C0mVsS2mz&`RaPqjI>rWwn9!IIaEu|f3pn185>ptATathchSV-#(vTAE z3|?nR0*Y;+mxStrmg^9MFIbX*uNzXkfO579AeKxwZ&G^HVap|9N8$>^r&~OkZt-Ng#go};mmVC~ibh9F z$6hO%j5ovTT4{Sx12crfoGNO7ByBGS&tV=BVnc|nupp}Ld6J2*7%Mfu!Qd>TW^=ll z&DrW-%u;0DjSWr#MFBWTxMqWP5~n%{Ut^IMN-e)AD6Ta8Lt zMNuCUK+)bYrfL#UG{xBMR}>ljdVonoD zR=`rOsg}qknuou#)tn;ZC{4@+mil2uC!h!?wip*Q%b2!BtZmoXEv94!GAR&eDI_^v zOmj9d<(%Dahc#r&B318Z#*ouJ5bfE?*!}#(f`O!CDju|PE&(yBS^mmTKZ&l)LLrAx`GON^~6hR2_6?h!a?EZ-pD z{f5*kpr_XhC{3n>u{jgQ(haPzdH79Q!-dElgd9#xBut0~7(Ast#c4n?B{JYIIKc&5 zDa|59HjRhSNv3lt=p+Iz=J_6)H_2c--ZrLB4lOQHp42%UwM`<3j14GFz}J}%H5bsc zFnon8D_ucJlTmCux0WIAU>SDG+1FMnm+~Sm;a8K?LRiy{QeUCE|&C7aTfY)V%$tFQF3uN=@e~I%Hzj)dCI}(i#E9-(2TvscJ8~ zAT0zL>^Gz}0@@*^RY2R2Ys5yfrH=DE0d3p1rkkxb-E6JtX3M$-B$H&RrR#i1^p+tJ z<6gQ(E$L-t9rxrGU4wDstoK}}GwX7bC7CVGh;7BNh*o0AnCYuc3mKFV9bBc{Bcx_I zL~?&wW+3sGXcGM8ngoC8CSmCHZT6Rrc;PP>B!7t@4Ye#9nEizj&0iYP{KXM1*YfTU zYfcsG1+fjhT674R23{?oZSxk9&=1Y5kZ=oO`{kqU&GIU zQ`3`RSR@fGn;glrob%>zQC>Q`4J_FmpJULACKhGQB8pcsfW?`Bvka+4xa8??IH5~c zR8PPdr{ypZq)Vw2DPxS3to>4?uniE969N`!0pU6G}+ep2?6gn#Wf3fAVs!dhYX|CiwWtkoQQcuAoLa~2aS}h&ELta z*O@E{0lN&TMZoQblvTYg%qm$istY&-DJ;a9&H%hqzBazA{YtDb%eI<;2Tk!!hZvMK zat`YVks_U6Z$tPoIJ2^jyoWeXKRYE0H*2%~4`tI4 zK`JfJOqGu?1Ds93QYPi*Y*K*aLemRaV`MkQ8Emj5hRh?AhSN=!+Bky?EJ;8SoSV|( zoFZG>%r9P3{UxA+T)cT?QoYjXY3AS3<#O0Q5b>fcnn*x#!5qS?NU^$@`S*CEUe?%D z&8%^gCF|*I6|*ikS+d$qOf8H#yerMZ9qBx19Ra0!I?Mcw`M~mPO5` zs?7p=WoM7vQX5eg@9GFB0x?Jl=#^cUHN5;E--Iz^y@Y^cOf+9Drjci+J||hxTLhfW zd2kC@a?3Njlsb_j_8Y=nL$cz1a{*=UK7{@+S@Euyfa1A1^nc0nf}=k=s0sEWQ`LTu zAOk6^f|YVxOAtQ$iMV!M4nNrLT zyF{2Yw28CW674Bqd5R#xtg(&Dk2gw4rJ0bv^DGG>4aEs4g0<7eDyN|PE$0CSpG@Us%sl+6#5hG9wZz%t3@^=}P#rt9 zG&26QtgAHXm;gmjpq6I|CE0)BNdHAJBLaEInjUx7gU;)Q4*U-kv zn3XM{IBcr>R#`>?tC=*k5~Uq6mle<}DEHmUh}DQ8^T=e$Vw0s-K(Q#+xF$OT*`?6m zMpYjxCFfs-wCXPrP^6JTm-Gl`W!H0Q=8;K5X+pS%fbxcA4zqO;FK6dyDFGMoZX9V? zYkuWa4$r|TdF7c&!|BWbvma(~z>*}lJTplVpZDw|$U7hJYmHVfoykhcIZifO^#yEZ zQqb8L=nv3vqL<{Y<9K>PL; zD#q3@55K2~`%hsGTGI-=fN7YH3Yah?6ZT&>IcM|;e9W*lgjnZ#qkB@oLx$8U;B$u5 zaD>5EEa`OyW2Vv#T#$MA>sP}mvy4VrPsk22tMohU47|f6X|NnN3pj^o^U<7uHF8=G zBeY1VG+E3xNz9OP4$L-E)(I$rDPYx^zdT@NXARflK#fM7W`@ke-zJhEWqStcYSY+F zaR%je$st(lMWaitfR!vw2j&=K(!&v$rMN9dgIWQvOUWzR%QI8$`i&BG0(zCG>q%Fl zE?tSb!Ia2;swm1y$ru0x^eVAr5G9tRE3srSC6;83E#hP1A_$gMtXQ0%2rZ2aCixk3 zwiKB?g6k}?c#yciWr~UW_cLe6+47=|`%+nq>hEFhPSfUf0!odcpn&fft`-Tga=#BJ z;sRQC&AP)b#t_XgzDQYCO4jZ5I9L1tKk)((L+0Uk(L zZf>r;Xh>O`Kyue`7Tt*ivx0I~r_z*dR=$f3sYyWbLfsbxJ7gJ;FxWhFZ))eP+z5j1 zFv6P!yg!vwP^(6>fQM5#MY|f-j*F6cwNE5>$0d3MQJu z1=D3W8`T)_Ybfbc7(mbv@NPqD+RvbUJu|EOiD2;nOoRlKZl-5Uf_0eUY6a|Ml4cYo zp0kVs9yO$90VBq}Y6UE1k`^bJym~r>W$OY{T%CYY3zA*eBUqzl6wq6zx*n<1vzAdn zsR&jC0v@wm0!l4(xq{g`WgTl-r1_n9%;y@ICbb~hOH7@l0$>#Fr4NB5ps0-Lk$}af zMV1IC`sxw{v)X5!=!ma&vC3+k5w&V~F{g-v$gOiYy8O=7i$R?`hXK=H9xZC6IC+tP zXadV@i{361xWTS5w==lYl6o0DU`a1BXkWx`kYC~5V^nXD*US%C(vu7xwj}v=Kx^Y9 zo6bD^Awt%~uN#e81>DJkgU+WSJ%WTnV$N0p%b5f|?1(T@Y4{SRYzF))G_va?jSF3M zguxdrDVvn>T!DrBq#w}|*t$hh!0SA00(Ti3NGCCc`gMMVZF9^RKjAk=4h|>c$1{K| z0vEH6n;$v69DNR z7e9yW2+}w~XM3clnrpPv)NHkYo_%lurAJ~dJe_-1-1aa5C2+#|1gvK+Ea@XX(qTJI z)@JFa-IlbQ!K0Q`!>w<r=5)_j8hf$PwnZu+?VQ6o$CI3Uz(`3*#pLO);C{A= z3_U~GD3w7Qp+LY6Q*e`j*D;CaB8eWsx(s7h4Mp=B22h-U<;LflrZ8A-Ns>{X{;CUI z=CSCZ0ycP*&i(vO)Itmq&}!J6u3=X16Ah~vz(i2MN>k64birApxu_>yDYaus?coao z9yJD`SKvf1dHO9IV(zMxT!M+r99&HVNfvssRSK17rotsp2sd{EL(Y}M`cd{#q#*oE zbZORdMC%X(@MZxcOwv6?80G1&rqCt#e_K!~ON1Z+y9}vGz#UA=O-b?a4kIWbV5cE9 z3%JFQ5)7G#zxEmml0V331d#M2j;QnLOQl4v3A{(qYb#7tGqwZj93)GW1=r{Bgxk28Sw7Eo+R z9RN3cn87xN`DFyaS})ru#aVEMn=pdlWO8jm>mjukTc~lwHNW?#h3~TXw8&$ zcOu4Oq$X-@B8a#)YAU74(_bf%BkiK(2-3m1K)j(xkWNcy&~J2-zIKXdv0Dao^&^W6o1)4{F}F*s;HIOTY6WMFYMjFvZv-2!usdN*a#AtNtekTe zTw?^+3Rq>Nw4@8p*~Zr0>I9V4JnojH3(k7CL`)$*hG9ZLtMTe|!C8CWES8+$XUfRY z$VALJ1ne{8kj&fZyDdq;2MwuN!2O1lc#^?qElI$BLuwY#x>e$JPL(bURRy#m zsaZf-+Jmc-gNW>2fF$576JMGIlnoVdB{;Rwa3uunG$ivoVOtC-v7NzPmLy=WAvFuQ z-;fdq8MIE{oZiwochf<7lN5ll2T%9gBYyXy- z*xTi=FVB>mpE| znFKF3QtAZUWk_x5g4;x(JTnOv!(xmSP+ArXG7&6c9HeF*^V{v%FJ;IxQ(3mdm_J3` zYueNNG0+YpxLpLwGn3#rGkE?mw0J*$Dnlw^hoz*nfc4azeP@;_Yngx@hSVycl!$qlnA8Zkg{x0&2N)K^5{(6$MYSWscBoD>fU64EP1tGhNJ>dK4+) z0LB$iDye$2AX1>tEtpgqxuwp}aotsJL5>*TNW8+}>y~ts!FMdlVb3Wx9+aqLFlI?I z1+2HEV8@#)jW?Ih=Y)+>`fKx~E7;tdw1S(&Gp*pPQ@cGZ_%J_VV*zbhYtsdQ@j0mnag3W4Pj0R%~CIW^GMZCu`4XU^T?~ z&~wtI~( zooY}(nFmGcaK%dH0U2QsFqRv}BFZ;%BosU2B*&=;s{%)zjWQ_P87Iv-DF%khFv=kU zsdJLi04XPXB%zei6P185Bfvik0#C7$NY1He!?45i;+3DDcapZs87D0oF$aue!%kq7 zCQ%u&Q{1T|h_#{Us-i2A^E9MaPDRQ%PfD0lPA^h29cTRX6cH0{xyf}%h~rEIsN^}$ z8J`9J8!RkGA`2bJnL(~-*~WJV!37in^yt(4T^d~da= zU1~T&SEKOtYvjh(FAx7Fjw9Ev4GyqA;xPICDrP z0^(F70_Ku|P#02)%^yFzk$pl7?3hUnN76gSOxEN4q3BJPk51)verylu=pO)QjQ{`a% z5l3;{K^zlDdpPa^MM(^5iQ$lCJj=tVs6V0XGd$GbuWk1H0l@SLbVn|RVMBo}`fs|a zZ&!T>)OS#Qhtzjiednp~eD$sWmTQ563)Od#`Yu-AQLSdaR&y1~am&35nfinstwr!6 zmCsS%L)LbzE4u$C#&z#>U)g(K1F?>s=mjn@0j{NO?{73->0kZ@#=em`ktu1 z&rsi0>U)ybqKfPgUR3)c3jSd%F6bp}x;k-{-6E8udL> zeP5uyFI3;N)c0)lt^H$;g5&CYuKJ#*zUQm&1?u}^^?ix@{($;ksJ<7e?@QJ9W$Jse z`o3I!e^7m2!48o>PWxa+hfv%(^$KyFr&X5!0f9O|GbKzm~Ne|fc!|55~K7d z_eu_MTHrC4rd>{h8`$rb67)x;1Ri$vZI3=g-@qg8u`)^-kq_j6Tk1L`Z%Ovi?r=&v z76|Fw6fOgK-rV_aM9Ed6B5uqgg>H>Pl-y!hUn)^-QFpgW*+IILxce_vx4o#?v&@*|K*pQ4?{_60lhPi1Q08%pHDz}Hn) zZCWi-!3QcW{n2VCN`EPCBo$ooA(9X!rf7>HQUxlgN=}pvnEy#)!l&TFM03KCe6kUJ z3U0+*9>d6#N>?o`06av@(TDL}@@>u+{%Sxq<(}}5gUTr6Ea9I9wIf^~0rK;pZc0)r zd?Z+^*c9^b!E$5B@Gpav3b}>y{3@th{7yn%48~Q;UPAhV9Xbyb2)`QKqL6!_eE9WX zmrfz%&%tiX_8-BWnvFF0OK_J({ubQrfq!>V6K(fMD;7k#2lm_a#C zG7z1vY)^HGo~PU7{6fGrx|tO`GiG@%tWmI{&x%`kc7uiIbXYjvt>BN5%z1k(Jiq^B zQs75Kzc}VvUD2SC zrzvG+W5CIu2LsS&*dOyRXRu_i?tvv=QsyEBOa4hW4fVj1dvw!~!<6)t!v96YU-EZ~ zh^Li^c*!@F2r8uHTUvyIzpZ=R_lW+TYQ;l!D(S0nq9h~#-&xSG6Iz#He>b`edq)c* zy@tIL^3Yi?qQ6^g>F<_$;BqH_1}aaV(6dT*Y3Q&@Uj}mM`&u>`EA)ei6a5f~qZ{#+ zzgBWRqn7gdA7^~n+xa&$Sn`+>7%S0nM%DBYE$}N~DLGK-M2R&ftG zZqpu6$Nd}YOi2`*+-a4R_M9T0PE`8D@ozi<^l=YUkrD8eCuzd3Jc#~njOfB(1^J;fiA0tDO@-77HFQ=HB|4YWCoAlHmr7STD&B@L z%^7_M;ONCjIg_~PLx{VMsy>C#thG(4&snMUQ8m%k!ZMr0(I<|7?goO~PXtM;a|osn z@T;&8viS8u($$Mo7qa*b!F8j(c$bgAE11fEW01OCwR@#1?M9V4RTWL8ZwuZ7V@`7$ zgyNhlP!$%3>^ZxXC9Mv-+*BQRxv6E|>89#X9!tKqXTXqS$ygD~7S^UDRI>S_qd~ZWdAEKcK zt5jVen~5k?>70Y<9W?TULFn%bA*E+8>*?ups$RHww$swnwCVRfoPomPMx&Tn;7 zLmgv-cU4RwXNXS4w`zvU;0iVNQ5OiVvSVMcMUSO44hEB$WjBFgbP`|roA5=S;MHmz zJWs(pZUMDI4QtWQ5-V}(q+h78P32Z7CN+krkRH56hjf)@L%L4e^B!rBdD1Ae*h3(!o^ z7Qa7`8sql|Qe*tr1F13oVITj)KK@4nsWJW$l|DUq+hOttOh*Do5#ABxY1-kq-wdP% z`6rdSHs~Hy*)9G=AT=mI=1c#ED&F!x>Pz?Y502{~{$KAA#H-VSIJ&MgVS#dOsu{vT zYDljQ+^qVf4(!OE8rae4K}!w4b%9%vrIsTMrDy2JNJ)!Sp!wpFihDE>OHV0{BUGt2 zN{>~8sHFoa2a$BONRW!4NJUk5Dqb=atn zKkDNz@page!8`1E@1w(>Pk!S5HB4QUC-#30{|H+HdQ;$UDnY|(dUs`@>_h- zC;aumFnX32m3>uj_S}f5SN3(@>`}GKMFC#@e5W&mdaBEzJ9V09p*b`J31)8$rK(EG>64AhZjopdG zNm*Iopa&Zf=+hW&b(EC{4r}a1;v5-xPGjd|_o3{#20ciHLMR!Z=MfZlXbwyFx~ zO_$5Cv?!Yv(Dm-1oHGL*HI-%4bw;J%d7M#6IiEAq0=}$N8<$*mKyNKFid7xKgf2R_f0}pEKQmmrNS^}Z4()zQ6wFeqC_8Y=B1)kFwMf|cY zf!;jDdC6J8wgv|BoRY7ojSl$n!+N7DQr51Wm3+Ny6T7iOI^B>HeGdGie}=D;mpEts z$MkMzb^dmple$v=&76~luKZ82mtIfEE$pQvGyl`B-Xgn&Qf_6JRRTWaj?s=u(mu=n zt5R-r$J>;h?99|G`FFTeoajb~8htIkX!e1lvV8dkj=b-byc;AMIL~pTUj)m{im&2Z zuUW}GoalbwB~RjuKH&#-=RV?w|EBxqcr4??$MAy^luX)$-wkO`RLF@?u}yKp+AUQ| zIIJtGki4+&o8$%Ig0QaWnA3rjgkwqoP42?O!n&hQgnNXChjmA#gUj%UaE)U7Fd^mP zxXm*vyig&u zIlNOLO6zmNyA?w7yztcU9)*k}WLmgaA=DMZ=ZE)Oq$YgOA{U1HED{eNw#eM@a~7Ew zK4Ovi;eL%!lUy7gPzbeX_>%A&7WqI}Z`xC*3NH>jI;JVU%fk_k(SCKfHeBk#>cW*C z&ZXg)##CEg8LskRSB0l&jG|Qd!{KU9Bdj^hF;vyRB^>vptqw2rU~9t(57r)T@L=o0 zjf_!MH-wWKQ+4PFcX+UC!do=fL7X2AcWF%3eQUT|V+pcESNPK!Q#HCdyhCGGQreF2 zPK{Ad4&NT$&74%Dp70)xsnYj^dpV8D`$~AfC+&goL5(dZnO_a}d9Vk=&$>=@5_;C? zv+-4O0lw%Hen|Jeoo@JD&*poWdmr`qa2}tqC~|)MHU&y{a>+72t{p5Rj9-wXNHDZi$Xo^Zv$W@_g zg=`%Mw#HD6LT)3ZDb%14)t8$?jSBf1rL=~UHYFMAP{{WvWo>ASLViQYx=@#8TOaCH z$h(xXF|^aBYzpmGhzfgKLVIk=)=;m_bA4#PO}Qa-P$6*&mD@vo3TY$cQ=!9_?UvAU z3i%ABd^U7MA>SnA_E5iNyCXE9kY7^D=R|a9(jj1s4 zd?=|g)x~}h>hPrfI<&=;_PbD*#!jOWUJG@*PLPUL*E}$Ce;V*;>fq5`fM)6~UBWA< zXIB`=i5@_@K4T*TRFEDORJ;@YQEH0X0FS<$N~GOwCwdIuqvZ?DEOcCwvmFrTled?Umj6178NNat9qw_5FHj26`PcAEv_cC0fIeIzXB)mqA1*2SrS|A> z_~L}hOUHu4KbTZ79R&_g^jf&KPr=`s0Q!<6Y9^}WERE}9JcV4@;6WNXG(ywP;a7EQ zgihgxU%f*k8dGJYdlrE zV4>oVlE7JwPL$+D$zahjAdRNG0a5CK(KCUToR2U1gf9>H-9`I(Epbr~Ra`BB=qe(t zmuxq9vzeY-L9OmYKSQiv5Z3*Acts3(&9lsU!@F8~lUGYrblG2cnWd1o0+lLWD&%M& zrjX@lfbDOADvP`ws8I-QF_pQ&g%$|}8x=yXP!{Hc?oGs2$OqjDDGDA@OBTge9OSU6 zmNT*7bc8q>>{W=vX(#QS(kIwfaswpMCvTHpoiyZKq*o`nS?lD@<<$vE&0D~$lgBA# zk*jC$hX}cXmny#`B*Ci_s$^b0FG#5Rc~|lpTBUr5*U&2EBd)G7xmMmvH{nD}A!_tU ze3hJrFZ$%octxz>nD{m zoz=aEq@C|pIr&$Fxb)|u_klRN7hfd@@I{}z0#_fTep$Hsqu)c?OdI+*to;^L?Wfk) zD1>_2CGJGSnDmvD;fp@uF9dk-A*W=|JcBsS6^>qy6Fd2fm|So(tcYL}P>(z}N{hT8 zeW~_GNLvTanHAULTPvzGiEaZvn$~sE&!}`Y0x5N=`JL!}pq6|MU-T*4>gxK~D6WP_ zi<*i$`7d*(5uZ?@;n;``s;g7ekGMvM1{&Z;Y}BDw!JA@=N5P#s>M3}$j(Q6IsE&FH zzP8KqZ`p0(t@|zfvBMVrc)yeXact7ir~Ed)$x*Ha(k-U)wN|n6_G2n^(p8!Ab)`BC zDr7x}PEw(K!ycVN<|^+v=wZ92&x35_yAdkSrbGbuf1pP+a3;*3kFWgU_@YnXem!ah z?on#1+fjS8RvWoO~W)mX>k zX9GXggP#NZ6i3G$*rKf38{eiP3P$%se#w)pX!sj?RE(8v)uSS{ec8u(R8*nwIvy1% z43&L?Z~v%$pzDK`PJVa_>4rWMS5}Km;wlq7TYCt_wUHN9Izj3hs+s{0 z9CGrPvb>6mmAvH@bBw%-xmw;$V5yjA{-K;kXy(kpSMdy)e&i+s?|PmeSj{v-2n*%u*RH z$-6Tm@UlGW)0#d%?}yMz!*i5S4PTi@jjZ9z^T-LE(L^!V4eEm^f1Q&3gvw`+b)Lwh zKr@xn=;J=A(k=e2ynp$q*Mi3Ox zF2EK5a{{-;w&NKm-kk#6EkLgT2L$K?;83_$pE$m8EEFTe{be3GqcicsYC`pgPQpt2 zqBtsWr_pHz9eMc}^eq#xyOswQ%Oz3mGJZPLh}K0X-cSEen+5G~|ht(lu8dbI}nD zs{2)Cm8s4IFRxGSrRx02DF1bpCCx$!#f94~_rq1y02Ar0_%KXmmuME6=R{W_X*BIv zo+}1SqBF5mKIJ=^c`8Wzde%vw_N71LJBj(OFa3Ky{Kvs-@9@fd&X@luioZH|d%sf7 z{b`WmH1Gk9|2#;Y)0{=V7+eE!wvW7|4tgwpM2WNbD?vKzu=wwTG`+Ls@05P}tn&AW3;Hvk9y(|&3Q@RlX7{rPxpm<)RKNW*5hngU z#j&VE)jAU@JSUhFy!TX6e07P(nU)1hy8<|$4p85!h0CfAF^J>R%@sK7!x3_RItC5h zR<$eQOz?K{iPJpg(;4FSv?!pjN+i@p7>N6Z5(h_4?WIfAsiBvbdXrM%V5S`EfL8TF zEgd;fC6w{F%7M!#sb!={*H!@Y6Pj79;H@3e=t$S}!eHSFec6=&j2WY7W%yr5je3-0-4$eS_yNTc@AvLARmj>ug(Gq1I)(=P4)b6*Y zH4&_ENYyM;EBj)lww*o#_a32>rMi83T&Y}daBZB4OH07mngjpleQ)z%li?j4{=7g;9s!Z)Rqt`3Fx%t_sqQ z4Npd{Qn&r|<(K^3ZZVWpLEDLz0UZ4jqL!MY=Y7eoqBM0z6+Mg6XkDn%!ha5{rH3j5 zDOl_rUyN^cSBJAdukY2glME8%L}}rxMSogdUDnZlAIXsjV-=x-aAx;HvCnAYb$}ef@|SR6w?Q3)QPG7B7mZ zAnoHC>*I=Pu8E(kQKhLbx^Pf>FQUzoz-{DS!R|j{P)`KA`{0?sOJPKZBt}eUz*uJ( z4+hdB2L(ZjPlHWfoQcC{ddoL)Y3o~g47%@?M&$pqdUNF-Q z-->4lJxpJ;ZQ(>|l^dm$=np~k>`JMXu(}ki{Hgq(wYVr0&_WD@R~#))b-((3=6+Q} zm59#9_h@?g1YH70xo5e9W@w}Go+7u7uBQxCfbwK_;wbCMK*$62uw11QtmESC9hos* zp_<(~>J<^n=JSnZ5$cFq*3yXDTpPEEROZhPJl&Q^6t36>a-7IJC_U3``GK>k^`VOgH9j!Esre`OdR(ck;2p5=I;}E+%G(dV<_=As<~bPIS$l$gVJXU zm-~l^UdpGYr$~t*gZr0A5gI*}%h%}WhmV%2=B7~b)_bg>`V|}6_Ly=t$j3*=2G#a| zQ0eINL-v}_4<`jOd(D?rI{a}kuUQr&6vYA9Vj*;K}jl0?NVO`C~QzX7Bv58q2tpE4_KH zRC#nM4F%-Tx|HRLNyArr;Exp0h@t6Tctru7{4P-1{-%IS8t*M>yr-lI1$LKWqDNv? z!TE4!XEZr=bS}O|)B9Q4IJ3RRne8#oMJhp8VNM}cLBsJvisD+;c^(7KR|eGdi#_xY z6w-;TrY}@^FV;wh5~|^A3h9W`;gq`z|3>;U_G}^90Gj`UG^aBnrFrP?zHw7x~y2IyvPWzxU?&{TMQo&i#im1HUoGHtK(lQJXzxX475(1=pc`$E_|RZS4S2T}1w7gV8jVZt)pKbn<-tQ9cMDJ?Kp+EL3bN z>^ZYPByz4UDp2$!2(vc}HNP;Xs5dD>`m0E-MR*mdS-pxh`!>mRZIRxUx*G(QyBB~` z>3{%z0z50g5dmHSU=>(XaFSJE_Hm@q$30L`hPaxChE}P=0i5QxoQg-B(kBB*eQ}ER z8r{AE48g0FwjX$dMG?C*`x454kGq|9Ujl*>y+VMs0$d9qPR!c`xJ`gB3GfvF3m?Ik znkgvmK1q8PfZb)=4Me5?66D#=9H98P_ZFUcTHv-wl(xr{%8=L>H?(+RylpJ zQrTaYL2=OR?gbfhJA)MHO!U@_2JP*cjk%+I(BZgVZ$fx>dSLiRMi4IseZTx}$p2Nb zZV25NvPVfJr%oaC9;TTD{!wIRu*{E@eke0T`p+c&Pbr3%SDmPQzc}f2xd`js2FSXB6zWbxP0cS8bhn>UWUS^%}9Pz%B?XXzx~&!>dd00j$;u6^jX? zFP#>BOz$hu3#9s;P`XS}F&>83SB=gl=v?}uk&suJlYoz=do58aC0Ya2v(!|wREd;X zmlN8i*PCr5NxiEZT~9*j9b&a04PA?0X+Rn=uxgcR1G$3cou1l6Cws_hVyafPi>ONU zN#LKmfgtz0Mb((FYlz1EYV6n&_HRXMK6)u3^jV01JYhJw*iIHsE~ZQtA6-n_9A2E} zAQO|6oj>Rqv@cAX26zj}IjcJ*&F(4kOI;(om6^7I%d?RcrPYhtE2+3srQhdEr-MbK zJXDhUR(q7MR?16_rz+K}p%QUVEhfd!$~QKn!5~F(U3}$Ds`zo>^QuQ@h=UbB-c$Ve zl;S6(6hA>1e{;6tM}1rszt>kh9f_K(smT#{v)@T=Hd3x2BG%Qgi-BQMS|FFn-o>qO;L@y2x{VK8>3d;jZyM6Ux>u;ar9(T z=UlV&{7s6YYTIc-;bJORf6hvcQjpL+S|rdOm9^U;AnfvAA7vH!y4rWK^V>&8(K#(< z-7BBa?%|ktg9qU;KK(WIotTy=!#Y(|=dzw)MJ45n(p9WUL>jrgf;y~5Dq1R( zH>i|R%PPoObxP$`732U~%!qT{3fj5TN#!RhXy1)Xm>sV8m@0v8GU!5Qh4rQmMCVZ_}`_4Hr0|2`a|>FS!g*W zH-nMil8hPBe=F&O%{}YhV~M1u`LAZqopw)zRK+YGCfJoyhxhc{JN`fRzB|5-;@W?& z#(R-ut4pr3EsQM;7~66I0|r;QNU|+AFvKqxS;Z1oL&b$|*`|kHOgDj05)*o}DGntN zLI^KFfCLf(rng`q5K8!c&zYIs*_~a(d++o6kNdH8XTEdh%$b=pXU>$}JD4;RI>N5b zfPHw*JO}yv@*noZs_%X75rxjctd z)z|9hDOq|f^*KSUu4htT%Nug&5w>}MzzZ%Z(=j>Zwt3Mej+RjpeG-k#Z6b#+$zcqC zN(a&{EcKyYf*VjeG6IWIqNTlZQMfc9YAElmrY7$K%SL~cejFO5AM+@+r=-ubf7p~X zj9OWLXm2nvA_qHK_1x;isN?l#IVF~IBB_Bh?0qBgJWAY~66-z#JZ$9QIveh*QQCvq z?w(>}`ZZ-p7?ud7=3OXcY9Gh=C_|F%1g-4vy-}D6z>JusWBQ=^wr!{X@@1!QFXn zGwu)BjQc}2L#F#y;Wr^Gu_F}U&iw2#Iv^Kgw0<{kW4(OERk)YPRYYIlt1a60Jah!L zocxdi!5;k&1{13hzZPr%2qUI!)L3Psy!J~+acWQCK;8?{#`(ZpGS2&-9a2A|4!+@+ zOrAN84gZV$weSsmg(?0iDgG@f+~Yyv`SFGz6}ei7irmtazd2EnOSj}Bvn=$oEDU5> zn9G|zUMaLpQ`J4v%W@=FRc{C!70O}=mh!Ts0;L?COK0bL4?)Hv#a!tzSQ%ijlAAs< zON*DKC6J{xmkzjenQggz$-%3qA@pjG!Ri2mHM#USq-L--p20~TgOdUbPR^w#Ej5Ev zLJY|LR4sj~$KcdJOP|JBG=tM~=>hSv37&uxXXMfo;$ss_z{W|OnM;p|N4C#}9`g$W z%rDG6jLb(=i(KYqxhznj%eWi;EQYdN?Pa-|OYuFCYXX(nl1qk8SK``SdSHD2khM1L zfM1x=UR%Awwg%+8B~a9_bLpW~UDU0)^wg^FOD&^jlfKk_tX#gt_l0V3UoJg7=-b6@ zOh4jPGU)o_HKQTsGoF~w1jPJfEPsAJ%? zJih+nWYL#rHKl*e)V=e9o@(zrGFg6W_sOGD{CHL#m2~Ls?!*5 zXZ)E;X|E&Tt)NL68T}Y2K3ys-gDV-?fE8Yria?gi zJk!`#<*~74KPSz-6 z*&6DNts&LAh1vMMa|^TbQfRaecVCZCZ+`dD7ZVaz44^BCG6)30kf136@i{!X{(@3;^ArrAPF zrA_;5sA>Mnq<+<3303_SuKKVQM}vj>u!uYJJ;EOy(+BI32m?{rf z7CNEyMSSwg=~(GMi}gd%ig11lV?ue{)cZPlLY0eL{xcg+7F}uFhZyyKxi6*p?%rlZ z5-s^~@J3PkP#xG$2M*MM89J~4fvH6N69g;)X=xrM^f!Tu=od25op!mL52v$}tPY|# zM(~U&N43M}Mmx|5mM@6)`uPM%ull(>)X(LielE|yD7Y;r`!!s}7;#G9uBDceA6ZrO zf7<C5Ka3GtxGd*v%KiTU9mPs4CxL^(?G0-z@ir!}7pz_^1A0N$kLb} zbQ+8-9bT4>K$gyYzDnga|6OPg)%?eWn*X@`;5>F54>NyQotV$(mF58nHS4M17*+3^ zJc(`!NOW_+4E!qI4BQ!#?@ngp5Bodw_k_Re%Xd#GemBeOr^~o+DUH^9CS*~b$)}5H zezlAVb9jNaZo>;q>o&ZAjFz@;G8V~TUys4Q0S5a97|58>WvGJv>@v^K5WLXoRraFb-z#AFXZ^J%3~6GC!M2+4VXEf*JjNMX+IDqfOMhVMP8KXo6q8P8|C?o)g!#7_hH?ZJH~Rcdn~T?zM9 ze{-nmctIvfZwNKr4NU51y|IwC`xgW@b-aPz2a+o-zPpe%gZzAVhl(upN#Ev+ZCXX% zE(&IRr-+^k@EN^Z6dcCy715J-`=8oM%_cuerPLm|TFlUitN+?+K8x$GG8b2-)6`yXy& za&eXSOLts%NS60Rwy!6ZBO1Zw}B)>7gD^JpBk>M8%>SAaq;A<8#*cJnDCaD#sr`J0Y#A zVmUwZ=vT2kbS-Z-r-zD$@V}Ex^{f?n&VP>GVb*=`!2OihzNaQTt(wr!8LOJKglf_f zs!1ECAF7|nOswyhH;Q^K_$223Q)w?+eU#>vMpfk44o&sFv(*3UDb856(NAtF-7hfi zGx0WQ-bmJcsp)z9h-Ru#*0K0I=x102dwRYM-id0ui~0xsgp2wIm-iR<56(T8^bgKG zm-eT*#~&A0GCx0lIn(>`%b1@Zzk<^bU8I^m@qB;jqooK4*`E0WUWGRv)jCe;&ThL; zf)gUY-eL(JwsuN`35(S;75oBydc}Yw3cgn2a3%^pB=HWe*YTSLLPxt~vt%E+XBvKq z+{!+40JXTXMrRJ7=9b&nXAL0xEyHIIpk|g<>Kw*p_(c29Zc2v2#g z9T-%eYX=6E=jQ{1GtzYfsaAgH|AO-$`Y+XYiC+wqMpQrm9-uioFbILEB-7qHFkT0y z=s+a`f!TZl)#0T9KkSOZp=*$xK8ddf6kuC^qh@;^;jD>smT9bxX+v)wIh?PbgjD1< z+^c34`ORA9&VRIV3HlN8Ekk;TIrJcunMj?7XP$$*nG5;CS_~SvW)jtQ0fHZTsq2T*g(ThW zBW9ZpkhQa~r@thWhWhsg(uRQiubp}_$ zkIxLHN5_35Hk;{((Ul$j;l+Q|ARPVGnpb#+(WM>zVVZeNBQNpP@g*K_$lL}(Ts_Vu z`ow92UdPPm-9$cP(8q`#N{2$6eD=Bppy*_r|pwA7X(@J@n_IGNc66X z8ryn@hOV(4nnPQN`t6^YYGlj3SMHW#RDxxw_M3rL0 zA}6YtjV@wdpon?0h{06P#P$8u5V)QnevvADgBA8i=h>7?F5urDwv#^gNDnD{OP3Q^+rDXv1q7r9R{ z-RUR|KlKT(Og+aCOi_zydWnf}CoT3#OF79Gq?EJzq%^=3 z*U5ZC(Py~9V*N44!a_c z{EU6+|Kz!3zea0GkT(2r5>p0WjW55Erwk@nT-QjZ`p;9A_+DGZ9)6~ZJ?K2Zk5}?5 zwfuP19<4&5VXrq)Gr za4zk$k=gSf%1x!0jtqjlteY9Y)T8E-{HQ<@o+6PuRG7Mg%e6!(gq#gH#nRh zRrwpsZ#{%<(xR4sm$kH?Ph_b>&nI%jp~dmIUlZTv?mL9!%-Rco2a$>9w7wmDxx4Sd zoHm8h=-J!@INxQ|?J_UTUlQ$mGo#ndp-U!&RuCwc09|A ze!q7Q`Yox_@Qr-xtl$G4axo+C<)d-7=O};r@=aPExr0JE?+IYu59}c&+(oo;WODXi zBKZjOkLV)#Y5`gUL5fGU6rpE8{od$b!R+c4ANj#>;nyPM z!?V*LbOB#-k|{r+ZA-Y-&i_Gedx4fB^w2FyA+@>RPx#H<4N| zaXY(b6bwHF6K}mjkHJX7;M4qg56M)|u!WQ4Ub=k$C)<$SSh?`yH8iZkF9%RBTaHLE zN}{1q8gDbhZz*K#=BcEt>GD;GY2 z-c)=#u0QTB1Aass8Se5koPi8s!*niQ#a_)VX`7OV<9({k@3b9g#Gq^uP8;Qhguh`4;Shx17QxMAd1Gj%&`uuKv5`*r8f z(Yzx3ufQt_^lSCWNNIgw#o>2`qlrkrBK1Lfh<>d&H@fLv`KptMZU$fcEc_h1n|&t8 z|DkFczni=KZhpqFGk*-(nLmc?4B}{6bn`N5;KXx%Fo39=@fXpT`;ZT)y7|9DcIB0j zUHOx=D?h|x4AkXorLv__4&!dSxrE2oX+}3=^oL!{^OtcqBPGHW{N8Rx5qj7&qyJeq zpC8-J;EQfv_C4KvvDMA()Gcy*<3Gk5fd0d80P;ukcfErLUf=a57h`uXZ?gO|z7zrn z9jBCYNg3pa%%YbPdZ&_+;tZlUj*BW};@?Oqlwtmj6kHC=Iswy__rpes8-!1Z-%6t2 zc+R?-DCh_A=;MC4N7k(b?9f1Ede#mC=vVHTA|pNPzX_mUvtwYN^g(p`D89k0sLSOD z3uOL0m&zgY{rLCC7WlCRer$msTj0kQ_^}0kY=IwJ;KvsDu?2o?fgfAo#}@dp1%7OS z|6L0#n6qGU$;f?5YMX0XSC*`<@91o5Yb_}oH+t;ovXYU_&8u7XZ|`V3roOhTWWt29 zag%Br4jenSe%yfvj-6CnR(3$c0S&bXte8++Q!}yVfU!08<7)SD$`2m1rmbVun8uop zmbTV)ZJnvQny#8LZ*SeY^S(3Qy5#;hw_W(=gBQGY?R8_ujU9)7Wn;&*tf;T+YVI7< z+_a*jreodm&d%l(;-hQ9Y&kJo9%Q!MX0}{2TfU;ZsktttSf(Jv0TcFLJ*mbark(X2 zO*PF;$JN&%*h#fbHP+YE)pt1Et({FPTkGpeYEhJvN=;j|Xxfpf#dD7;Pc1pJx;&K% z=dW#R?W$kfrSlW__Ky0_`mR)GcT-pWid1b=dm~zuBArfCYZo&Jk~G$IHX<=1Z+FLP zBzQtm_IcCGXD+E)oGPDDotjyln!jLvc^F%aw6cT7Eh>vj7&mT0Ov1ziq7%kXipeo? zT$!C?diA&{M$@Y!*-WpVSQa7ZjHQbXFCRB?V%b4aRY2V;1VUnYj zq`tO2wX&nFyFJxZXZA*2eM3!mGx}KelkS0eGlQ*<_`I3pJb^hnAsC%#Mi0gh;>9MqpnBTErM{jnUR;$T9j;z9D=3(mfbe*ahnaw!e!H0oXh5@Z zLP=&z&X`+0r+iVcY>h3gs`83e*tGJ+DcC)Xx#^Kf2aStMLZNX<#Bj#+8F36_l89kU z5;L4N9bd6LV^f)JY$|hJvM82qbQ1H7P9lc0XUvOZ7?VT{Ba&uJn^#^{HFsKE7y0SY z{p6(+|A;R3(zzMz9`n<|Kca8EbZ(H{;#VmOyBpBa4Fxzg$lBJCRoaD(z%G; zq{nn`fdB3~lK4lY&%`i{=pTY3nw_a@3J}Tezss%^Pn!9*TR6Z{) zqC7us*7O5>!>$aEpK7=Ev_&%}kjh66BI@Ay@fDNA-D>CZyDgflpH9lToBT2Sr!9&f zyD}|$+;ST6jL->>XGD{GJmb<>PJ5jCJR?V!&o(}pImainfr;vAY9MOdm^5Y^lNK`; zJ!vDx8K)7?xHOj2?r4u^gc5i>qtev$x?oo9^cs^yLdGPKjLVkzUWhT3Q?7`l8FQxL z-#FiGQdu;fs$NiaWZC$!z7uEgq~a=%h#ZUPxabs;BRWNLtBz+EnI!r7NpR^><;x)c z{MqF}Unh`ax`Kg(nRChmeqtc8e8vw*29e=02J%-guJo!GNFcVciR5v{CQ6ZZo4ot_ zz>>tuTRx+rdRnFL!_HfP2_&%kV#KsX446hn0*00|U@EYrForS%<~U?v@sdU5(|q?y z<}wB(1Ez{g3RZB^Vz1>HH*`?NeH~g*UA}1AlDP}!2kSbse8!?9t9{SEe10%KvwZr} z+0>kKQVYGpOwcdEK#%fB$#WD?ts+aoR9!y+-ibcsZzx)Vv&f>+SfJ^3Lks4HlK)cJf(fxyL^L^s#X)|Zeoj*HO zT{&a%fnGrxMTeyzXX>c(MGJiKbtF}$g_!wJcPHkHYZI02N9GWK8 zT;J-n)O2=XYp%V%z9UszkL+!0T2m{!8yWz1)U0v3YF0W-C$|q%HJz=9V_eW zydt>F)|wXVD01uS9^|44*IbDW>ebNE*5a(I#~vd#N1eKwbxvbjHzG}~5Ukc?%h{=w zRJN`*r+pO**1n2DO|1=W9c1OF`wIftplWOYh>gY!HnzgC+ znyyCbHfUF>yR&9xJyZIz)=uti&P(0IUDe_@c}pE9p}N$EXb;`ys6CaZ6584^8gvqi zTMHF}7Bn@iOF`4Hu?KywT~)8YSmz{?YHn(%=jMmht+lDfmYP}z_3v2Mjyg5gx26ct z%nj}5-NV{u^l!>nTTQ2hfD&McXtce#rmLZ?qa}4*eMg%)EjyrZ$m#AZ)l_OTF3f9)d?sH;c7qIFG*)3m6e@g6oifL?sl_e=E_T18z5~bER`C*8s=Se6O|T)x9@2$wzaOav1Sz%t)rpS@uI9+Ej7oqb)?Y8 zGS<|pV$|IjOSR2Sr102rZ*5A|bayqvNY-OmuklU;ltO^0zO@cxx~0?UsPF2iY3*!j z!p?pdRfBeeQ#H*ik-LQ4Cci1@aX@gAic*v+$ zWl}U68}(~J+ls-Wi!wovxQR5=YXgdTZP3tM1Ce!Z64Vq4Mx8q;Rohr!y9%uZgWTEx zov)MA3%5ag8%B`VZZ*x#ZEG-SR@T(gfNHH@+1Axm(?tfnrlWR3s;;TCW<@h>Wld{W z69}N_>zvvZwFuU>b>IZ1y}7BYtEqLRqbNg6^a+jZlTN1r1+J*6UFDFq0qwCV*p+4& z7IaY!YyzxhTX&b!*r|h5`9QR0El5dDG}2ln26Zq)?XV1ObKIvO3#P3Ul^uCaxf zq%fz3`;ZH6NY$-a>9q6ThExZt($0SyQY+E-wKZr=rvb{P!|guS+5}qYA<|cOG^|5} zzZz2Qov`ryw*iB)ZB~QQ*pGX)+aM0|7Fn(+yA|>cA8f2aRdQ zXi#{XfrB?1TC7r?$ZqE1mdBA`LsN6T!~IWVq^{Eox3BWUwek=PgT!n@t$@BAQ|w5e zd6wrtht^9`iIGRs9$OowofPTzbXAU^PG}apNydOz22W`*r;`G<`qL+yC;%``P}%z0 z)m{}Tg#a%_52OeRIoQa&VQ{o*e-D<;3({EBLs;7e_@ZP>dAb8Bh87L0rq%Sfp=m9Y zNro{334((s)6qG#Aj52jS(oQ9MpTecWi;XaaEglZG)O)Hxx>EcRH=la2BcbQfTIX@ zjaM|c)vi*(nocX@3Sh{n`^+c|Xd4WPw1PU_Ly%fiR|f~Eu8zze*$5r(ZpE;wh5xG^ zNfVHbVAL^Ov_E+p?Lf_f)~;Kzj!vMpFx1IjCm7v9-4%uVT}PG#-Y>L18qMnOY%70x=oYP&k+wns+wRbVX~GvI9^Y8wWM@fE}bI#%r2d>oALTwP8V~V-#xSNxO9gdu33OdYIep z4h+UFtN=RMYt^$B`TZ+9YFf~jwX3LK(Ue>>`lhPUH`R^4No4v)?dXfDr@pyfDy*rv zW+*pBII(K!>UMbEOx3luVr^mES%7mx($VycHAQC^`xk6rY7s@Tmm9S;&9y2Q3^l^i*Ml>lrk9{Tswt;-1zS*B z!pvUg%s$eobQV=Rhc`KgH#qIfyewpEbwO~y8rhXy*zO$Xu&W@&qF$bxk#=}Nd>yvx@wwJJn~2tuwq5k z$r`6>YvHuwLP%$d7lagO=%`uQg1!R@Vzdx$uE%^&J-~ms8_ZUQizAsj4c%R`2g##y zpBp%nZPc!*F;QegF+;vu96 zcqPE)(yG!kETqVA7P>rzhF-vdm?#@eHK5ngNbowE2;ujad5IJWr(z=1{D`W4+++jhWsaT9APOq`5o6b|Nkl(8Es=RdW` zVqyK8NxUCH`mY(8bD6#HqulJ-8XVZp=8Y@O0G(9~Z)e~bXFmdbh z$-~k`vNa$RBiq%(<(Q91FxwCtZC(Zghj$FS!ad7QHEwxfu>(ViT@b7{bkQV^O7~W! zG$71$StY&(hTV>O_-q}krJoyEqZ2FI-eTuh=QkvRud8m5@v@)D^o9#YbO-ziTAC6U z=1+^bl$sG*+bDCY6{|Deq9G%%OP~y}CYYUA1t}``6#@lFe_Q?qr&{a;HenRgmK<^R zb|O*@HCPzPD^$ElQJWy3!7d6fUorn6Myjj6xm>wd5?e!Qtgzf>OW#B2ogj;m%4!#f>ytNXjiJsxLf8wc7Q!rD$N%s)9BGby38Cmz>g@2;k&uV{?GG zX+J?{^Hw~{_F_|lHbrTT?6IH?yc(=k0-Jm6G_ez_2C>IUR*~i3Klx~59gUPDkz zRU$VH?Puuj#U^)4eM@bNzk?@r8f(8;e#$lnHX~&&k{+}3Zse3F16EeQ%Q%U+g{N3B zHst2EGPl<-uXoD(nV4@;KN@>M`%4RXZ#OQ$j5H$vux5l2(u^=hni0TAGXel>MgSqv z>5?bzFcx*ulz)Eci++IskdJBpo{ndd-A& zi{_)#)LIPtOV|>yCM9n|RkIk5f`Z!WYYI+uU{YZh;wi#O4b9!y#D&JfYYPbGt0Yg> zHPjcT;CfnXj1SDN;QPGheJhD zFMCr{Kp0A4iFs$%O2X2J9aU^^v^v#1)6V9<4GpB?><#80Bx{DioPb4Au(SvwIiJc})49A^oK`+L!I&vLUGN-ap2$Q~ z1dc&W5}NF-9WRrBOYz%E?8AZI*ifInTfHOfrBG6 zmAJ@#O6*CQ32Mrf9Uu>Q%w)=^I>63mECqcdOMT5u%~aaLqU|$lT9lNuy3nUEX6c-2 zts?yr^p=&Gha|>mh|HzZysfT?e389K`Qkd!T)LBFs*EtqRUso5)&6>3vzu6_@IuiP zm-&&KW*p~P>DpHeZI{bNm#0}~9u{5iw3-Q=fzI|Uko^I4T~}LeTXRqe$XyB~+qvn~ zGFB_7VzG(d*{LNFFMQ3zREuJ__a3;a-uhB*f1yulhs&0qkA*wC+oQb|svT{GS{@3Q z!51+w-^nWlHt)!TWveccr_~l!a6^3e$?(iDSZhNzpG6L^!Bz;LFI(KSz1GLv-$xKR zB8)@Y?@g!ejL@he-ID_r{uSShF{NNf-rw;Hw7tq{87jh?TH#&uQF~;!5{dM{cTW?m z7sP-PY2m3B6YVwY*bfhjZ(qhC+d~YZthIsbm3N@hy30DT6UCEt05Hqe2`rQ}cXH~m zr1WOYU`ez?gvyx*G$wyP#qg`;jKYf&me9-q#q?JzW`gDJkP2h%YrO)JLv8Qf&nF%tsA zD2xtBXc<9`6(Xmk@REYmoYr&tY7t6GQC8w^)-#F@G-auA-hyQ%G_<3s)-PGRyUfg! z$3!h*!-*s=D2l$vk&$hNs=MSU}$d*h;I2d%+DN&C%p6mCp4 zIbAL7JjLMK!2_j>$KlSbbBwbJ`@Gm{LW8VmmfI`TZG003CpWd+Qp5rT^aYDc_Z;aY zm!d>LmlTj%Mt^W|1PC3$<4yss1Gz{fptYUjC`Vme_ljn0#Nbi~T^FGJaNZLKV_ZVT ze8TEQlw{vf1LlB9UI*(tI@)kM76yXuv&sug@=lgMh=y_GE4yG|-akX{(j76nenAY> z{Tt5%#885qbRtTHlN9iW^ocSH!43?zFWTh66_lLe`mPqI9;ae7&EqZsw*2`_g06YV z3qqix%VO%rmA))SCS00tTsM-FB=%n5e$(B|peCxDP14Q;9SoHu7hAz3b8?JNp=lAR z5QeJFD+Aim!hTx^@5t$9Z{seZ>wx;z0l2dv@1#+RGO&D*-Ohh;DNL@#=v-SJzbeZ} z8OR3krX`q=kI7po*vXveV91s^d{q`9>}e2Sj$xwl#wpRt*_6ACIAb`=vp;#A8dptd z9FW1nh{5&74#)Zb@&*X?G7A1}CWI5mEpiek3`q>?Gt{BqSLv_P`{3QMPIaHbV=qj* zsMp2mS7%<;htnphbb3uErI%dT>+0lH=??K*qSB_SZ@dTAX;k5ny%0FM&)}n(U-FXl zOEWk3xh(tg+$-|0EWEn!Ra7qV*sST*H(^^tSP9}g6t+Ylu&mGEsUF`xS7%?9%fD{2 zQ_(cyUDn@MHoefZkm`)j^>|@_kSAnit`4`+WJQ-t-&NEGXd`X~$0-4{T%|ure3nGZ zM!!8rpXLnw`2p>6o1(AgTvCq56gG#jP+w8I?NsS_n<;+?`!a-4yZ0eE@nPOvA6Xkp z8>!MZ5`mFMx-wIxJw|Dv@+rMerMFX=5$PLsx%3^8&i#O-qgA@u&cy#QmA?z&a6fSU zRXWkqhwHB}ZZlvd_}_w zgqBY&8DNA7l#^V;GCf(!+x@v`)x>grKw>APh zTVbZmTSELu7w=NoG7{a;MauVVh@P;W3JdhV!gPHotqr6(?h&RqP!~=HkR~gd6dnR7PAD&Pb%6i2uJBImH$Dgj1rXuml0SWRe7@wN>s#bg9#CIb0X-LM_}y{c{eJogery))oruF%rU!FVRcL;>2@gW z0RwwpVV@b;I|@_7p3C?~VQfc0OJ(KKJWQV$+dWpLn{v%m*jSm9c`s9#*={_?gQif? zQD2^-=t^iliWyr})=i48k@80P8c(Y9DvOWwSjcXEplF&s9&&ys{^^+nVysiWL;NXy zq)OjOL=ow8R66~lc{rWw*{IU#XS?Hks*y-KPtnmYG?UG%_WU{JCtjU@6}2D9^njve z9}4!y^b1IbUQy|j5vC8x@lS=(kEvSxugqocl(#>AMu$F1MYvB#g)ov~s>04D;!wL# zn;)&x=XmM9pL~K!qk7Ya$~{kE#G5{ZU9YfFj7aQ0g-tN9rxj+({F=f_47$%0W|onz z6m^oKBiV};b~IsJH(&NiA^H*~AwuPo$Ju|CZ>=PCO7Oi=VI`zH7z1*x;m<)tbCaUs zacTPbS4#aRnx_@bmk7u4`KO|xAL9z@q2xn4QkX>ypg$y!Sr)BTl>a{pNs|>_JMsD+ z-<|rnS<%z)`dGSmS+>$Xsi&J2E&T+GMXM-D)*XtDe#0Y9))FMWqh&?dpF6c@>o~_8 zhM!w-HlZeoMB?l0Eczmr_@DT{zbx?o^1i{Q*4pOoy87j65go^>4VxdS&bn1&aK{p7 z@MFf09yfa8=mW-duIub*YwH@*-Ptilu^Ll@&5uUBaS%H@-D~%!oXfG1(i!t2Lx(rG zu+M~79ilmKjbe18gNACUli%&DeG!2!l~1)etOZjrpbr&j5dR6_bzqKwgF z!#*C$)ZNvjDnuK6IKi&(XsuC*e$Yy0!I7N|(2Xh?!nTJD(Ef-Q!p4Xf#$JgGV>1T3 zg}6iQOX)ZnG^Y3?wj~m7MyB|5bb6PYFLoSV;btT&l2vX=B?a8#WTkj)Xoc$noF_Ie z+~($`jVf}pt2uRGa=zO?xy{W=f_k1itI9n9d6rhVMHOyVh3kmhPO5NAlH$1p;*y)2 zE&BFw<}oOxAHX7+f3JCrI^w*OdfY@(e4f~rR)~RO3cGbI30uH|rcWmN7)jkk`k`sP zLb=!Pk#OD2A~#D6Mr9M}Z>FV(C@vL5A$q5cg#fRf&?BxBpe#fo`NgDXb$eIw z*XSyML;{|7gThUUXG9MepHP87+Q@{PlicWLZAgk+k(z_X1jDQiZcde(wcX8`r^BC0 zBq^?usk;CsM}PE&H9FY|v6Ov-&00Lc9n$^EGo zo1}-t-yL5e*7vHQZ<74lUTLEe8@E4@6n{A$b-1w?nhyoOe0KCIy5ulab#jF}sKOnboXaF` z1`-j4qG$pnxsxm1L7-Jss3TL2PHqpfK;0{-ptL?A9l1Q2aI-SgyVG(*3FpKmY|A38 zN`KeQPJi7U0Nrq*P$TEhMbVF+RFM>4cJ{avlj8BL^sR1z_ydN_I0#sfHYeX5M}z32 z&I)%pv?6Pp+ee&nGPF=+Qs0pB4-#KG={qs_PKHMHm1A~4Bvzn4BNvF=3ei@9zwRO8 z*oyh?c#%=zj-Kc4g_ytq?Tv3pQLw8DJU=-JjL=z|QCx<2r%y%l)bzvL(P9$m;6SwL zUpuy;RPkgMWWKM1dK6N912&}hWFvqV;QuGbg3-*R_(c|)elMiuP~W9bts?F(bRZ&r zgkb-_NpV3o)kR!&a{AV^k$scm4;|aAG5TkW;yp9PkhD3Fs>*fex&3z} z#VKp4S;bd-^tk;`cQY!XnQJOYh||;2lxXveB(N`lO-_pQfaSn!G4?SqX!otaGSWsB zkT}l*f^>JJLxrDNlfE-4Hl$ai4Ic=j#IXxO3$hOpA*tW#jc->xa{_9U6i=<`5%;85 zB-2I~rVTH^zohu>8mcGi^Efh&fnIH2(*q?GzfVWCht5OZuN)XbaVq*YPZVr(M{ajV zEu0~uB13ua(RdN zf_PwZliRP_XDEKQdYAYV3Rg)2pABL(-T9fw_;Gg+4eyIHd)x!7&H*%S>;Za~kC2mO6$PS~hx&?6xJ2bv%ckqY;~ zBn{NPl0D)@U-LNucYpD9f(nEoLVGdg6HIwOQ$7Jo=!g}So1H_waE8G#_Iti7f0a^{i2m}>{MpX2|G>_KW z18sX*JG$+I9Q0JyCO2cYo5kgy-_B~b3znrfW}%8?j~>Ku1p&OAPt`7fOL22eQSFKxR> z#5;2_vBOTaNgca5ch{zqA9Qo)xEYw$(>w45^U#KB{4%$~OgWfSo7j<#ParnFU=k6YJsH}&OsRZhbOvRvlpsmMh>ObZt-0aK;F{aRU z)Xtb(Ns}iC*qv&Wl!0EXo=q-W*6GQL3brRt53ax@^^V*36gTfwx9{vqHxJge8mfF8 z(&6vn8?||6A&G=O9*tT(wUGKHDPE&Cfmvyj2Jx-j3Tt+}C68oEpXRz%?tuI7x7Qw+ z?C$D7FJSt>!0th(qdy+b1470C^5!QW0C!AtP?>D;(i)Upf)uC-5{IG=SygUXlC%Xf zJd|F+WDmkT##8Meo4%zreP=HWf-ME{${$)>7QsL?Q7)U&!>UCYmOp10NT_ z@S~&*>d``;CP+EN-I)Yrh~IZpzYRfr8#`^;u*3&}p1x@y9YpQV!Q{v8Q1Kc{%NM6X zjgg49_m?&p7GJo4w^I{b0#VQjpQC}Z#RqUZi52xLeILNel@#y7)MHqYIPjEMK=?|l zNe2%>9F}?RCKUD<8P@Uac8Cj6JlH?jgce5o+|iHh^|q7KC#MZZ-7aXtRP{!FPx_ll zab*j_|IY7$^fckkVGV#ygqbadF77qkEx{sbE;Kd^TKrWr8D{ZKK8gbWjnut}Kh!UM zD;5jCX=I1!k$!}Vr^q)!wVq8wSB*(-6W2F!=BEpK+#(3WUFPN{A4Iii+zCt%P-~b| zp2D(V4l!4~*4!hupl`5}z@(5b_3>b$#~_$669N z1r-Qz1>Z&uGQ=AW)eo(3&noIO@dqr_5WACN9D#oVfzscCqX&#M4ix>;-=wBSarpv6 z6dBG&;$ZPvA!^Uf0EtJ!M^1_}C;^R)T<~a-qdytc0(NP?Jcemc!=g85mRq{O%_)aS z8E~q{ifocAYXMw=9(TWFWv^bS_cv{%F4^Mp3EL2N#aopWFGRe;h-Xl`yEnW;ZnDQ` zp^wCNs5ULO_g>F1I_lk@0I71v-)H>Aga>D-(jEPXyMLuSffgE14@V_7fya=f_|HMq z_ryq?ePsGpk%|A=Qi=Z7jBm8gH3wHf;9Rs>#v(UYti=e0F=sz|Ob>Pg#6v|OeB_vI6oBG<>1JSYxa}Bns-G%?5-o%w zQLT;H<(6YW{X!A6`&Y;gL7py1hr^D(#^Mzl1=$a~dqQ&RO$;68@@Y|pxG({=&J=s0 ziRQa|r?UeFVH5KsS1jHC12HAMSf5 zT$ndj_PArjRsDOYyN9ET>3hsBEUK&((Cx@mn%S4;BuWlDTEEzR@*Akxa5x8J(Cn%x zEJ?t~Eln=sQpOk{LQJ}((1($} z;(Hi4&^OF0TxSXmK;A4Y08c?t(5i1y)DVG*nfUD^%S%?C=_W{@E!X9&K?%1XWQFH4 zj64^tPNoo7@ljn5*}{vk>5zRUm$PSbftwAl6KtVq&tL%qI!NVDIsR@MwqQOuhMa#A z4@|3Jg)m1IR-?vbWq3XHr#f0O{2C>UC4UDd8F)6_G@2i$QnPPh&p9JGcm6|Y!#WyR zkAOU9BT1SAc{iq&gc|>MsF0iaxjQ!fEpCBKOy^U4K_y1ccXRJ? z-BTd}V*{~?;?e>WKFGFYCB%`=JM3XTWF#jit3q5{w~c1I&jw-So{cbO)~^QjK=ij+ zbP$hAp2o8cEj{;xje^68mD?yYYud}SV!yGLXJ2e7 zq9p2X2!siiLgSTR@j)|u3UP4(dpzQOp4w?vI0)-!%zl{kM+#a9Co8Z5OMg?W+D4XZ zOYJVq0L5?~NcKxm8?@EMgJFH&Ux7cDV4oA4dn;hQ2PVbWR83NzDN*B<>0PER z!2WBuWx8G&LVS>xHnYG=d<%&=w1UW72t}hs;{up?8bBMM2pH)3a!bc`7rJ@a1A>?H z@zK~0!j8#MZ0M3Wh)D7Bpw~Gx+VU{!HelT6^jO{fF$Bem7$< z4C`$1U<(gx8mS})_4k6n_r6KmeH$)T^}tq6-fLMHn?Znc5xk*S-iiV;_NYeKPcjTGeLkK*g0woW- zd!30X{yNx?67d2|kGsen&K)TpSiug^bF`EZFFHK0{keuVXnr{a%|XL?BPv2Iv(Vj7 ztV6?N)d}Hg?=^!r7ybZp7~e~Wz-q$sP{WX`XMBq{K{5=h5U_;FOo##YLh}Bhq$469 zN}YQ$O)#0&v?+rsEQC{reU_n6k1BT{FIyLqmsTX!LC#8dFgBsk{qsY0y+!L*_9g6-6gK zg`|GbN&k(c{?SQ)LDC2$VNVNI(k}2dqz|O5RhBGoBPmAAkCDW(*tx#cx$LA<_EZe* zq%)B;AhU3;o0xCOaUs&Oqic5=l304XV%IXq0@q#O4uEFNv)JAWf&#GZ2eq{Yx(}&E znXtUs8+mr8-2h(UCShqG`)LJDIlteN_6^rbWyyp~gY6xwv;PQ22W4X25mCs?NTbs+ z_e)x%ME1{HAc^VPpAAd6xtXG#){CE#r9T^DVFLJK&kA@|^T5y%8v$XfZ^JNFd7Abd z@$G-nxDn?L+htkMi@=h*9HY=`u)B~rl04t1z#um%K1KEaHwE7lQSbxcor#thPBT!{ zz<5*<42x-}r;(mVN@92AulJ&9NK})fwf?_)#COBcW7u26aHdf_Sbg`ycMiFwydUd48`z_#$fbpA!S|x4r0~^5@GT3&P}w(&jWx zbK_}Bn(G!df5ioGY zLnA5>s-SOZag{q{6C6l)h&(93p1=_CC{p?+PvpjRh?cC#?*Jy|S<3PZ*yocKOWHQ$ z`cks%n8YLIx?k=l?RKOU(r~s7`~65Nj!xPUpY#NhVrI{0kOUc{%6b7w2V`P^-+UxD z{A;D?ge^z1nSHeskUg#JM3xvGdLKz8(FJ{iq|)f5FOalnbka9S8WNq{W3N_ukB6kxvWAU zV9EJ9a*{7Zd#kW#lVRZcAV^+J_!`K2Tu33$(2lqe%rnG?;JuLs(D}>g$Q3i*w|nz| z+ORCb;++o?+CHKa7_6kpc*2^F--OZfGxT@1_@Wf+OsWL!S-9df2G{S+yKgjTUpj)Q zZW@VUOvl(n^X)R!?qxcp$Hv{SMk4aU5%%%;T_|}}W`Ev-fRG*sU@9(MnyCEc|w8z2D z6|W;J(jg!ps%ipI_AnuA7!hJ`!)ot8Lgqg3Y{NTQFLEo&en2bcLLAyzal|i<*hYry zZSc#cJvRT$M(aeDoLH}bw2H7VtpXt676>gNtGxG6UjIyyfjJ{vG*GV>(*g(UAcWA7 z6v~w{WG5doN`-3=60DjI5GhTu=zd5I;wjaC_dUvcL%) z0*MSK6d532)_QAYe>bx5jjMT4gZRDuXi2i&>d-s(rCcJ5cU^ZZg{u5{Ura(9=~y)L zOgCfUMmLw7VF*E6$8yU)xG>@7(@8$LK=UxlmT=2Fxo^cr?Cvim?^JR_tNn5* z&IPcoy&oNkp@qRJcOzC%bFnGa7YDGs4~`23bm)+i+>Y%eFvCvBZTt1`@fB|lQXVBq zrQ5sG&7JGTNUpwMO8IHtrSCzQcXRMfN2s92s3wKMSjMsD2F^*YJ7S~E7)<^W+D{iR zq3GW8-RxQPH&JbQG=JHjH#u-eUjDB3&On^w++^WA+386+?@6T!Yo@e^t>+UA_c zt8DTz>B@+ktbEX&gw2@#i`=4WcM|P}7tg`2KT5!&_+^wpYY=QD?}4$=Z!VvNV%L?L zt#m%Ol!rDs(Qoc)L4D4%&mUU5Qg2a%X5;m$nNA%;T$M8R+nSvuKk8q&&R<7;q8+d*aj% zr4Yr?lVC6x*(V}YE@7ix>ukjp(!Cx|#g5&v8W#l-;n46L)nUbx#ii`*{c6)@(c0AXp| zoO`MKoY`(6w+ab|3w)!|;{PIMm>I4Z4fB~uf7_Dm@zLZ%Jm}`}-Vf?QCk7}(?P6mj z^=DhSbsW*wO+l9bnT0sxq3aZIr|CL{Wwb9XBUeJ?$n$!#+H_G9mLMtq zG@tf&Z^j@4qZbjO^4}lFo6X`0nuuv)#3YH%uEveA`90#kvL0lm8znefqa2u)9|QyD zh`r(4v~Fdi6{y~-I2;$9jvmQp8O# z$%P9gS2|xL0WX_R!{+TWGGfENqB{@b-1*QI@Yw|kuz@d)c;!a76e@oO7)ZM$9 z93spyINHXBH-gzzAf^D3i(OuUyN;MbXcd@)gLrJzxwP^{VOg{Xl!ey6WS;GPT{n?C z>+=&)=JmGX5J?#O5VV3#!P@irdCxET)abqV4xp7-u(41WF|5 zz!k(E_mfq0UqC!URA9Rw)MG%k+wU}N!b&@Z?M!TS;(%oV^}?^g6h`ue@#qX(86C+7 zCN}{@H~e}mwEuhVfaADy!8W>$xDy<}?@DCd19#~V>!(g*u)ZvJvH6x!?e>QWgs#q~ z1z{!z1$N-YrUcC}-=4%uN9WNS0Aw)GTkLW$+(ZE>`yTVa5e^vDiq48~>2Ms{h1m8b zrw=F76Ub}XgLZRaYbW6T4A_HWEZul56vq);q>TV0X~XwQ@}(zi0rz7oi{@p!jkPK+ zNWmnDHDr6h6y|ME72EE8fK*`S;L|sEG@n%$L50VndyA4AK5v0-7JLPjsrpJ{Q}w&&sd1lQMsK#o5;OI4cYffd-;7k^oY0eKF65kt#TY#sGQ_% z%I#+#D6zg0p5Wu zF=p@kZp9;8&T8yM8M_yBID^KeZTERN7>v5Kf6f7F<(W3gULZV%L~KQT)08#|CLK0F z{ERLV-7=R>dc+F{;Jgq6^=3qIO#2TkAqI*8J)*OsaxQjt1a?dYibk^5IAI$gunk#^ z0|(6S=zpA@4x}EWv!wa%2yAMI+gf08Mu=x|C&Wc$mkg)BHHV|{3*xq&FgUTfg^|4Z zK=?2M_j{(D9KjgkTwN6*Zuz)%reKr*d*j$2ag4w(-NKZkFY{`SBgcTb#* z0@((-5g3G^8@|w;Hdm6K>XzKIh}hhSlKP4F-u zxec&f_&>zpZy!jT1fNl#c{^=6s&{D*6f&HPLNmlCkZ>^R8wh!CQfkeilIAp~`L{t+ zf`lOp(3Ur@!MqBW5c?!ARHLn7^2Wdw#trQ7-rL#e^^D91;H@Pv6f#aiz!4wLw(sm; z210CK;11mEZQ_ba+$I^jtUBMoWZU6mW^JOskaD)^h(yQo#41fzko2zX#Nvm^kq z`zS`K7LPwD9(_OOnFTyxo_JwO6AcZt1P-&vZsR6`o&9xW&yC&}`ABh2h(Yin!W$ar z9i#>kQYTxfcOf+!&&BY81g#4A#19s2gSuxV=<*SS-Ek1tZwJLFV%6_)aLUO13@aZz zb`a+0Fq`llCe8b4$@{KZ_N4m4_sVy@l>~e?DMcWF|GmA#X zH3#p4HK(O0y6^Ah(kZ$5;0ohU@M6U? zKyi5pVKm~~xLPGHE3cpcEtOix&!zOOO#3|3QdrWGE21fGWQv!Wg2Ix*s^!z!)Z6K| z;jY`UxGeYI*|_xoYq?Tiux12k}b(iS{0Ge-3%b`{HgRmqyMC&R`xg_+k&Ko!LH#TiqBf?GaAz z2V4bcD-Kz{1lQAl0M`#B*Grk}yX_IeeuxfpGt-8{mHJtEkN6b5PV+zxc~0u;$k#K; zY1niK&G_k4>2CZ!xLX2WhNdXej?bCkED+=+v0p(q=UHq1$@qCbPR#)N_Zh!f;#2*C z-emj=;A2!ln4`^t{>}u~`V4Wko*2H&_>I8JR7OmwGU>UQP(0YnI}X`~`F3uAp9~hXSi}UFdkX!{PCpo5bYG6Itf=a~GlSY` zGZxdT8C3hd!T43cQLQO#<@UuCh6#bR4C4Qd34ZQpR19Bc{6-6Zeuk{m?UUh+Y{H^t z2G{6b$SGGbf1F{jsqb`IEAg}ehR7qw^@xYu^quh5=;)+J>^P2=HR4hDCjB>Jg9ld? zc$K7|?7JW7xI6d^h6xRrf$GV={NxU-MvsGW$P_QQ6$r8?{SwG7Ssa zEblSDv!s+?5(p_Xk~k|m6&O67uYsYdH^BierU*h6*1^|>0}}2&nQ4;-V5W8Z!*{8| znBDFU$35~GD*?Xmn*1oQb!I6y}jo&qJMYj*YQcC(inOH{C?jmHs{Z2GM`V=tU zuo2?j*C3b3zZ*bxzZWsfo?MB0h5KZRK4}v$ldxRbwD;W~t)2~E4NpJTbAgW!#Hn=1 z%0ND39G-aC&D<0r0tC3QUJCHhKoZ~r#4G{+$jt&i^r)#XzyKCtB?QSuloip|;lb!@bt` zY`m19m-ESY;e;te2zfpXJAWBW&q&J?-u?CuGc>-{3ndRZs8Ymz230!JsIC=;iqwZ-?H$3 zmJsx|g`dUvyEe}Cdf&qPGyZ{vkKp=#WZ^rwUjMZ4M_K-TE&LLuFS77gnI2Erhdxb= zs}~~~Y0om=*Fa?O&x~JU;VT&5Y~g?A_PpG}%NW1X!k;c7=xQ71cH3g%D;fW}g*R|} zUT@(E#&59jbGhAavhd|xul^SPJH~Ie@TH9Z%EEug_1$XW!x_KD!XGXn=vEu&`rdBg zM=^efg&)cFz0<-!o7CwjZdoBC{=5wEg_hbBi3%{d; zpzSu!^?ks?r!fAIg;#Mq?6B~+xxSBBcsJvZS@?b|XR(Ff%Ju!Ng&)HBlNNp}^Lfg` zGZ}x{!hcah&@(p9^?laD$1(mV3;%5iLEIRDwBIs4CkF5u#<>y!{Agw|Jb+Q;Yi_qv z3qON#dJ9bO^D5U@y^PC9TEIo_XCN~8DAVt6;X@c7W8wFg5L9O4T(9vKK8tbvRv|xm zG1qsZ52(;bT(1Ky`~=1ivhYbPr+N{Uk$Ml;_Yeb-!Rd@2YT@@VpTjIXkMSuMzO{s) zsq`oC*~;~u7QiTS5aZJ=d=|IE3=97U*LS9cw=rIB;m?&2q+Y~iq~6T+on;_0IFa$$ z7JdcScaDYkVtlTJUsFO*g^hE4t1NsJb>8)tcrwD6&fA7$aAxE+>T_!C^;pIZ1*##0vF z%KURI{9LYYjfD?lyw<|kb34>q_Ex%F@B^9N(eg3!r$b2oo(TrjGtrS z9bB(-Ej)|y^DX=)uGa+?ekkJ?S@7-=_x&P% zUmWn6%x4Ee@>7zK-xo8V$29DGsY3rkebbyrJe=NiMxUSHf13B^ZU23Uq_JtvuZV;{ zD2_kB>_xcm59oJ0zW~#g=J?~9-^Gm_>){F{jCFLO;f-0b1}K25|9gkWio-(MwZlH^0^Tbkid&QUqv z;C5yuWkkz4vxMmJM}0KDHB2e0B=f?;In)cA0pT2GM!m3brg&j9Ae^aY)C&t|nin<$!kKPH zy|8d*cwsXjoSA0S3k#>*3!4Gq*y{yK7mmGNkhr!|CKsZg8w6BLM64GipQ;%8c`^8c z7~EbjNd60B=-4F9eeygLTB z{d~#a_VXo9UX%S1j_uDAm2hl-UgF2wOqkyG=Oz7#G4vpO^HuKQD3LKQtK%=MppOg@xf~dLRPAx!jC; zVc}fqh0TD7I4_`d;cPLW4#c> zx0+EeESy`suo(~$=K_>2oZC$@FD#rpys#M%&Yfn|3k&BiFKh;cbGI4w!os=73!4Gq z+-pX?uyF44!e&4?_nT2KEF$**DN#5Ncr<1}I1iaoFD#rLUf2u>bKPeo2c8TG=#`G*%a1HyUTjCx_= zyy1n-fN*x2Q7%8bU3jFEo;maZZ!Qf{i5;Ny`pguQ*NJ_erb#0^F~bjznzFKw>74JZ;z4Zh8TJN5hKt17(RvA zB8lq9?3i}$i7EH87=0*-;d5h5e_aqG&-I1Ta!!e9w+Ca|p(IA1>GzGI+Tntja%qJg zMgMh-zMTJ-a=8xC#|;f3)2H_k(KxleF^`THlD{#w@m29J-X|2MaTzdxq&Be~rUv*^Erznbr?w(vWE ze;9TU6QltcjVg`^V6)hdxB{d5`V$4IckfKu4c`+|DgBg1@?b z7Q?T|ch-A2x{p5}#LP$KtcPcL^vhJ}Pi!|fdH4e=REvW0jrA}8ju_JB>`C~O9zFkd z7{z$po#El=4*pE$_Sd}xNY(2)F84G=lHdveR5TMR&l+CYuKyT7qA0S{HMo^_l_8O zh;u%6IP`~qXB?5sdA!3&s85ypPUrp_uVL@x^#UG8mw0%i3jGW$@{M!AbcHvwo*(4V z^KUdGR>19Zfrlf?pF$o-vprmom&bVC@%P#EjJursahgZ3+v+*kpM39E(D56_isB6( z7uxFh_Z-Hs9XP_`^C?wI|G ze?cMhjdMU@i|O}! zW9Sz`AENk_#mF-sb&R6_uNZ&eeCU4^J=qQV41!({S8Yad-Oq#{h5!09Nd?0AOanj7 zpg-Nfk2LU$419!9?)3&x*H*A6h?E8THj|UlhW1xd#G2!k{0i_)H4n)e0y1Pc-PYy&-&*QQvlh-fW-q4BTv= zEiw2_2CnbK5%hq8pJd4Mih&JCOH`~9zft&RjW#DGLCK)hKFbZ<I!ewA5_#^zj}DOO!?B_W9rE_VO-Ih_SV!BJ!g^rn07$# z6A=E076#vEBTgSr9vOAc3*o0K{33-@JD75A4&j>q`4At)#lUAm%ly4U*me-(emhWw}j|5uID37|5Mfe zH-+dmzC+>EKJ`XFKBjQZr&AU1WQdQ(UyI?hQ{iDd|AE58cD`86JGxw5uaXeHLe*=y z!gc#=`jH`A(@$1-Sa0>dV^~kB4SI9FD^Uf7>!s(xaJ{rWC;nTEc0OJ4A^ax>zQw>z z|HrhqWCxy8?O@tf6W^)$gxm9-5U%y%1BHj%Q`=RIYkEh?O!AxhldkY^x!Qheyi>`q z_j@#dC5BU|_-I_ykB#9!A%tJ7_)~w-NAr;}e-6^Pre7A~qv@B2@H-U$qht8%v9I}S z`gTQ6?WSp{jI|06>(wa=59`%^2A{vEF!9-;!n&Oaqt9as*YZfzah?p(|3lU5*$}

ZtEU5-#Wid&UfYZ_3Idf;xVC8{_3OS!lPqYNs*{yuZ z1{c+09%Qo;A0w20XB&u6kBFsUFjgRr|we;5w$& zFsF9ulA7?$rE}&~*Ly>i8nJ5OY?yfFSBFopuc}*Gmtqu5znr)TDwdMOr7f(66)JVD zwmqBT_tYg0vMp?InwuQlq{wcmBbqQfnRN*#(iVnP`~q6q;IucM)fo%J-pt-ZA)>`78AnHKG6>gvSOy5Uq2PB;np?ZtRkXDs0~b|+feJDZ{o{&e43*hH;r zjI0mGq8-syor%`Q1Z*dr##p30+|(LxT-g?Fa@w2m%W)w`v?CH*-<1d_TB2BV#DO1* zgp#67;r6)G*pX-jHL&?x??hHcAQKo?O5foK2=mA*4+^ax1hFoG>)6u zaH5s=mQFKRxUw;_+KEJC3CMPKIMN8a(Rjj%MH`zytUcP2Ou)K!PW&dSCnunY=qZ%sH&E$yf{ zys|ZcThB;qR|{;vyIT`cV^wpwY2_-1TB?hJ&EXi-yR8#8>M8rwcnf9)jahuZ$yJj$}6&kEDo`BAi{OL)jb1hii z-P{Z?*0|P5G=fzi+Lct@81E=Ui6mGzxpW$V#LBqCcNx$?vDU^m2X@@yPAH}|9`BCE z!l*Icy%KLZC~UBU5^F%Z13C$v!tK%6D(p`Doy$~a2mD}V6WwhjITejuw4xfQTyw0m z-B};SaR6Pk3A$NJXE#KkspHW|YIbxLXG?TCU8~8kuGJW#9}E>6IF606Ivh!?OKQO= z-e!R9TurEs)DmkpDU4}C8ru?KG&%0rPNW*fqi1)+z=f(c;hM#Wn?u_QfTE^BTT3?W#fG`blDUuk_nawmY9xvrFKz`V%!ASLNIo$uRq6z zAxbV-C9xElBn26q2w}p2O9Xz%7cMPLbfGz@Biy$Ap!V@>D18Y&s+SZOHSi};YT_icB+!$ss3be$rl#Z3* zbE2_M7&lSqb=@&o3lcCL#c2r1x`dBBR)Oci|B=1*jD5QSnv zAPh5*xsV|+{dLEp;2mjgT*G;|Vy%p|um)JntPVD?JA=%9T{JeE!(DNhJL%jE^J3@f z)@XQb3>H4g3s!3IE~NtJ=|IFd3Vk~s1u>pJnqd~jT?x)%amZxFXnqx&@H_gu zVxW{J#V%XU><-|W7yWWEZEA2s(gZsa+~7dCYqb{!N3DTrH5PBQmvSja<~k_LsKcoh zXXunskc2QfLzBVi#6Yagf#+HAaCaBDJZkzYhoL=V>tSwN(+Sf&?r=zgXi6=)__nag z04gb&*V~CnBSem7@s`GT3oaB`F|!Ym+C(E=;Z?ED?k?;uxOu5_;*K|!w0E_Jad;)w z0wA$d9cu3QYU(!-hWubrYXYWKD?+K%F=SDj6}NIyW!C#EGo1QgRP3ioJ3~=4B%Z6YBYHI1kDT1@E2}mBPr6h#AU|N9TW~6Y32;B*)-_qFz8xQaZOh`Jf5k_mF!|6n; zj^VC$N4hrb7@)5vOdNO@^k!sq#S;p{1^~Kg+=;hzCt!Ys4vu30rWt6IHPJT8?C?*4 zlVbc)c?!@kg;S`lv$4rA?}ytd!Q=z0on^SmTu|LmvuHL;8b(HiQ70KhIw?dtDdZ`s z!<$uB5?uq66xIQhSD#iF#xyfO0HEi8JiE@Sg3gKe1h6H>%^A!+a2rCuTaLwIAEr`M z7G}apmry@%!|f=B@Q%c!<9-7P{K`lZt|A!5wH0pgFo;Vi2a#fb!c{_&Qa4#bO$#qd zy@|y~h}D#loq<)rnxmL;NO;cDg|lptlvJ1?yE<^HOLXD{3E{{}Gj9>Y7@I@)i%rqy zM%ekuA`+3iGit>p4e-bvf6QL?J+zmA(Jol(NDJRK z*HzV5El73{8&X}M<)oTeU<~d!ac(hA;@eJQC{YTnHbK12W=-W-lu%xCic(uw;4x$s2y zj&Kb}U#p%{ z3w|x@+R)c~Z_m9h|E7W)3+WGjDp{@;ueG^Di&5^TtQ+BNAJVe|IUM-%x6_b2w9?jd zQ{IhOK9;o^{^PL>Po&3a!L(bE!I3U)FQxErLaBWC0v8@_cv5Kxkil^@o@#Q3=HKMM zF$h7lrx0z0BiCGrk^PEIXE}Kd2X)DhW_e|L{=oDu&QpiFmA^233#ZqlNyqo8?&5TO z-!PLuQIGr~ex`B`9HyK>{1)0P|E3)DRVB-buduxun4!J4Z;K(?#cAs>tuA+Hsq}}N zdf$jTF#k4|A=|CCDTcJWIBhzFwf_+P1>SlOIuqd4Uie#tkMsKA1*;1GegB=8PX3qQ zWohk*v~@Q{C(y>N18x96kJaW?7MZ7#FR@I3ZDdz>0(6q@_mxlS`&dh_8>wIy(~+y5liXHK7qcxoLq{W!hRhy4Rh6IhVty74Zx&;AAS% zdN1emy!RvZk@tTbUg1h2*xtBY;HO9>Ee>>=_9nPOx9D1Ju8?X1@X*2paBItN85saO zUwZrlF_;>}E6a^nma|uu;~P-R;jN_Q^n%oK^J3I;F)f~Gg3T&ufWONTGwDvn6hW&X zY+ATL_)x^-UI?G{nAl2q_o%zwgk_g$V(>`91bCZiBIZE>hru6GA8-h*rtl;T65&-# z_`)|HS@2D9zk_c&9o*YLYG792rVHN?9-Fn<&8u~@FLwJba-FQemJ8>(g@L!7 zd2aSRiWFxB-htSFTGw6R4mcIh!{@th);#yPEMRaQm31*)NAh(zUvsiHx!IvR+8BBZuWe41cbBZ1>U(Jln7ky+XI1jA$wql&tKyU&2)1+mePLPh#r?E2>WbCsU0exEy~ci_~}bT@B-J1I~B<-K|SJa>9l z;3ZHwqsFaT;AX?u8)XG0ZzC0zkF^Ky6oK-5xH^HagDqh6TfRN+QRqH& zu{#KoheK@qJU1VOwt`T0R^S8B0!puh*nq6S_5O{JljQqm1==>ceJ*wTRZ}r1W(7{z z=uW70XVtiKL1Y5x8w^+QS@uSET%a=qwmx_MyKY`qV2^*JKcs5-2-I*=?}xGi4@0$1 z$O^y1Q`l{G&r@ZkA-+}y0dlYXf7{g4iYJq4!B%G&78od?B0`!DL@v*$@;pl#3p zSZAR3ydGMAD|X%jc1+9)><2rK1v_)dRJTuUR^Z0-H=?zFLTkSPQqZYh_xIHFwrKkD z`5^cK=s8aG1o{IxaNa!EpB1J$z$o0o_p;u-FZozC>fmb00 zUGr9mO`q=`NBu1Dl2LYNu&1N%0$t@e2!9C~3$g01OPgq@BbvY(anM?Lia>>Vr_>)a7fl3w+~!L*3n>sk(3RS&@qchw-eY6M!JC) zp#1(IG>Sawjt4JcPj|E4bF(+Oqv}a`2v1%`*#Eafp)io%F!lf1xuNMjU7zBxuRsPE z;vbj{S3(RN_AiLdnD36R#bF<~)Hv+3G!EO~`rOIru+PpRhi!6|!@wwapmA6~urtks zbv3C#hrMNVe9hg6UV@D5uE7v2`uFa7`5biDcc651*D&L*u}OD@y3t?5QvC&zFi}96 z;I9WEC-j$}oRh|1kAQ&#diQsI7x(Dtk3-U=-j}!&O}k(dyPJDB{3Vbo?fpLVLntgO zEAV?LY#5Zi1EPHc`yti~G6rZ)z7Z-C2>cP)sH{aWsOPx@v*x(|g>GO$R^V%p2us83 zkP0b*?GOdq{{iDSU(JzkLy@^K!f^_Qe>1=nb18_m1!FIA127}z>~RA<2f;zeJ0IKh z641Xi@G+EDIL{41Hn6hyeDu>r#%mk1I5#fZ84vt!q@eT8AuVtpaQ*|`l%$)9m!>d` zY$l%k`+#J6EAiyt1tj@0;**kb3D6%3Ig=%tyiOtc2 z>r2Gxl)`(HAFMwx7x=yLPS10I{S~H8d@iI9{9cN5{8v;Mbt1h^Mt5cF-`-jDS>g)bRCd;D-YLNWl(0 z?}k_v{4el(>rNd@;Eyn*^UoK+{sQww^dz~Auf65TW96@`F5yRf!|wa zk7xPgp<)GoZ=D*&9DjhQ!0+uV>UP+Z!fKX6$aQFIK;4^X^; z`4Hgea2PKM4x^r0i=W5gp^9%{j(S8VqRkojHj76&jF%l8Mm-BTjF;OjzQp49TU>mG z=pp9lw|WlaWiN-(Z#I99IhHGJg6MsVM>vd^7LdaO<-;aOXPh7KK)!-P=5!u&v}cjU zH!w$gY~x?#b1nWHbKO5* zVXpgU2>Ll5D1Vv>(mB`SOD&$y9QD}pg%-EvM=?h`ajeNvZt*z+;W~)JC~y0r*y6Sy zWE`Qq?axw6zL~>#sj#^1HyN8azU-#~l`N0r)aJ`AJrYK=&f;fs7%w|GjCMA17%z`o ze6_`2w|J|?ZU21X2>8*Ko_0&#=4V?x-;!^!cp-<;KlD{H92a}gKQ@SM(sR6} zXF7y)I4KaOWv+; zLk2E$BkEsc*|W})Pgs1j#k(!O&EmHGw_4n`^LC5d@<-yg)2(v<6TjJd{u_Q zdabayEpLyDFIswz=P<4d()SR_IK}zj=H)Dpe!y{^%W<(^#wmqvX zK8C|s-^(o?;xN9%ajeBRlUz&k$wz$kKsNvZRJecF@Kfwg) zj6V>K2l}nV1nImX1IHf^!vp0fm>`{x<%vl1Wf}NY7MD2?6+NGUhx(YpP`@pIQU-oe z27Zsl%Zy4of0Th&=6U7X^4DeHPg{JVrGHFcPmj&NXmR^#GycdK9#~(S_s>tyFUi24 z%D_kUORwiFi_02>l6Pg`A7s|?&f(9=K71nHc}z~9TjYxz+N_8(i%_6$60Q2KJG zS={~baNW$634z!ZO#4w>Zil;`mg)V!diPjF(Cdi~hclj>jT%N!ocdbFo+C$1#^Z zr0{a)jY>}g^HqwsGH+LW9rL*2`1uDO>&+!;=Qo*OsJJ|TxkT|NS^i4J|G<2!;_ov5 zy5g?ifEyJ*iutz`AIp4~;?tRbPw_hD(*EM-M&=JH`8CWRRs3@1KUMrj=D$$<`^|JJ|O>ieJb4BE|7@9Xu{m{6XelR{R&t zuTlK>%&$}Y9p>`@bSzC zD2|_d;W0#Ue9r)n5sI&2K3egsnV+EePUe#om;1nJiod|}GZcS|d9~ub_&#vH;>FAt zD?W|+>5A7g$Inmk5Wk(pyj}54%;SpR$Q(cawe^_y{2b>(#h+*SOBDZr`IU+f;QP<5 zicezxb;afWR@ND*SB&MqrR29V-=+8unSW35-!PYN$rk+wnLnuH2k?FGql!;p{!_(k zng2rZRm^{*_?MaQSGypTSndS2ozmEA3 z#lOv5)_>8nhq*lW6aEbInM%)ZnJ-fO4d${h5IyfRZ&mUxKbKjf_z>n7D?X0-7R9GA zr$5fL{8`ImB^CGaaJ;J@(sd#ouH;U-3UO zk1O8F_MDS}U#$3K_K*41POn`mnak%gVrLig+mxOJ^B*XF9`i>OznJ+`ieJh6Ma8dW z{zt`cVGh5to8r$mnSZSK`^-Z;E~Q@M`SS+ZFAFz6^b5Zzs^sN!4%tVGe2n!>SMujE zpR4#~%uiGNE6gK`Kf}CB@jo*^U-5r3ze4eY%)hR<%l+q8#rrb9Tk)aHA69%E^QROq zVZKlCQ|PQT#rZzd`ZA+#hbqz;`Qti1pm3c#!oxrnr1w z_)EoeS^j0k`!UDwv%o{zaRBpwDIRA2Sq7fP^QGuHh2>?v6~2u52}*tr^YRS*WX1Qe ze2wC_GGCN|pRV{0mX9bd?Ymy_$vj>*DZY^Ti;91N_kq99!2hPW+>d{#_&(Mj;C>FD3FID^|<|`HdHuFx!zsp?KXDRpl%r95+ zdzfFV_)nOBOYvVZzf18KnLn)f0p?FDp2MH(zpVH%%wJdhc;+7}KACxt$Dh>qWab5m z*E26xd^K}f&qYt1`E(_JF7tVcU(9@&;#V?nR{X2X6N+EYe52yuVZKH2yP4ml_#WoB zEB*xYJ&OOF`ICzOf%yxHzs3AdipzT&?<(%+`B~;g@pCrwJRaY|3z;9S_*mxS6raYt zLh-rGFHn3k$L~~p5yu}<{A`ZPJS2Ahg892jUby`6i^%_rM@#mRe$XBuRAMDSsDZZ4ShkPRgzg6+!EHCf>i2m`+A5!vD znLnxc9OkbozLxo4GVu2m|Agf~&cK6QZ?RMEEAthX`^uvgm;1^wip%|Dx#DvFSgE+& zC)O(d4Yq%o;yal)DSi+0F2&zqe!k-GF~34_xj*{4;xeD!s<_-A-L1IXA3dzN><^z& z{5iJg#SHxSic5RFp}5@F|4Z>btUth4Y4@LVyszS7XSw1d`FYw5#g{Ob{ww;0FI4iU zu)MsVCi0cco0YuW$DOD6OqQ4DnxdziKUca&$qSeMCGz*O9_e4gf5cq+m++^V?^XI= zWB#<_|6smP@z0q5NpX39?j6O)alQI-KCvg4`M?Z(xZ+tXKVI={=2I1y`<({G2lMBN zU(CRp6hDLYcPZY^{5-|K#eB2kcQKdG@x%{TG2fx&h3`~+J?p=JzRH$NVwHmok@ni~jfcJ;*;P`8S!rskp3D2NaL8{vcmPe>=zX z6<@>gqZOaQ?}?64d@l2H#joIarQ!u_f34ytGhe2-+=n(P-ofvcb}9ZH)^ncX_c7nB z_`}S%DK5|FcPRcemwUV7FSDNe6@Qiaw#!f_wx zlXjPWSfu!VmLI10KIX?MF5^Y)68+Nd3zYoRtfxWoA2B~u@vY3yQv7=6YZbqh`6k8h zWd0Y$$8!8F#fNhI1I1-r`?&peeUDbWALk#bxS#p)ivOAIl=rJe|38?|QSt|v%X`-% z-<$i}%}V|d$8S?y=8YdHF75Y-;xeB+rMR^Fi;By9@<+vGKKZBOwH*Ig@nszE#r2c= z$~@3t@pD*yxZ>YrK3?&=nNL;xA?C9bmwDhzidV6GRPjm7<^6WCU;Mvb$;*2(mngoB z`_B%=rJvoVcs`f=J;i0bJ*aq;_5W1y4(7j6{5b}3lzVS`B93?_&HATi&%c5;+HaC%G?L<+a7D0n$8g=|E-}WvBTmsEcuwl zX9Ab^05>T9$uN`YN{geOIjrkyi=!UjaFcMo#ZmqomcPm3C@=HyE{mi5L6*P6;wUfs zkozr;^7Z`w@k16z`J1`@erj=)f0*T;vN+1iJobXcQT`p4f7#+FFZ1D_74JP965)7* zxwMyjAOHJGzKG>NQu6X%c!1ke`r9a$&toq7mziRnk&16(K2`Cnn9o;yJM*yOw=$0_ zei!r06n}{M4T|q$zE|-B%%4-djs5?Y;^#5X<$fxDkl#f(PVpTqf1={IGjCA*e&#KT zOS_z>xcuGF7RAT-O~r0wF6}7m%KeIG@%;XC#fzB#PVouM|EajF6EZHP+%K?vA@?KU ztC=?_ei8F-#cyQ(WySX}|F+^UGXIg{Z!&*gaUYN04;AmvJXmb}D)x_OUZ8jt^Wlo0 z#{3-S*nf^QD(Spg$=}KS?`n(B07>~ftZOWe^MlN*H(4CzZ|DASi^Wl1=C`|Cei~VJa%l*i7 z#lOt@PgVRH=JkqS&-_fqWu9+UT=pMp6c_t9DlU4iW{&Kf&(}|H9%ZFZTb=;#I)q_>09+&q6NupNjvK z`2od0V(vS}XvF@5dQM<_dMmzyd4I*PVLpPn_<65U>r7Pgx%?jObR{qA$Xq4g!14<$ zJ`;4ybAT@?JuA4}nBwO#zf|#CnP0E?lg#f_{7vSMFqd(6FZbtPD=z!mzbpPXmd_b! z6pEezPY^>DAI5wZbM*5VwgoSzS@PJ9@*Z|r@jtRZTNEG2@7x7pNmHbmY5BNtJ zAsH7xnReTn|k2_8AHOyx!{n9Rrl>D3<>#^dwH8NtdCq@}#Zmqmmj8~$ zQC{9Z{JzCe{uP$L&*CUA{p2x=qkLa}pYjQdqrCK=7nox^qJN6vKOV0u`9^kV@K}?M z^5adA&IQb6T>pvvIn3f{&rG)G7>lDl(yvM^j`EvXexk)uUi^8A#ZmrQmY->Hlox+4 zv^dHi#qSZ;TO8%ZpI@>#$}eE~l@>>N@n?*=_@@}s@Ytl}&K zV{x=+1Kabk#nB$|=g%#U@;_twUs~L*@2kwwezb=_u5w;i@|(Cnd}PU=0P=E#jx!#D7V#Vd}?@APxebk8-$9jFj^*Y7kcD?2^$9k2Bk#Idj$@k&=kf_B`{{(&y zven|YpVulbc3y08)U%HDTxN0G&TY)m&Iy*Cw1SRpIRLCj~{L{W%H(1 z)~R2xd>@OWysU$REspx-Ck2LD9OWzcIsaITqx>X(ukHkkqr7~6Jd4953ad}R1CUf!UY|w>Ax02t%nmeiG|>ojLje>m_~b14|zDZ)N=l zEspxjSWoXU5P?JV$UfmHi%&EnbRNT8=COI~w^EB^xsP+XNBQ$vevid%|2$!Fl>afy|J>pzKWjLg;CR8}D1S7+ z$M&+tQC`OBUlgxpJ#R6`c0oVyfd6=WsN`k*%1=j#{P9NI={wd0grCR!XvME$K1K1J z%ui)5{qt$=4@(t)jrrM@9(ksMsxDOWP25kev^e^0CHw7ai=*Gx=djo8p`@C4Z1BFvF6c z!m@Z-pybbI`_HgA+LO)ihn;D0+x}LIqkKKfw_6ag=|Q<@31(^%RKOa;xZ5HWsdEFewOk0GbJzc z!1GF8=7HA~KM!=_@lVCK8SG^9O_!8=7xSZ-%RG?H`|Z(+4`#l=(leEH;N^=-{tE6V zQN?B79#>r2af78_?%h%USCssXtp9q8W4jFE_p5HQIJS$FyW8R@-^lWJS{&u&K5mc2 zQGOfCKWuTk-G6Rzl>aHq|I*?pFYhnC${gDT>&xBBd0okuu>U`@Zkb!SWRrNBLHkpKWoJpUt1w z*H|3orM(&~j`CYrewoEl{%qFYWO0=LjOAM_j`GsJ>zJee(Vw;OACGGkZ!*~VuF_M> z?edr;@&k05V>va;#;$;YP z=_h|?dq!HE{LJ=@wzzH2B#Wc`ODsRt;wXRaa4Z$(QH!Izy!Uge#Zg}7fh874d3j&w zbc>_>2G+ldxzx89((pK2$zQ_$F{x%hk6V5jcOgzdJ;-H!=WQbG|B>@!uH^4Eh`h|_ zvcEvik2***j&VGM%kR!q5;dG}VTsfzUd!=1i}NiDk!6aHf%5TKL1&|X42SX3qPXPm zvN&&Hh^$jw_%;@stl>{MLZ>n@9P7a(%K;<+5( zYjOKI&y$La{4*A}pSSE&Tx{KM@lp=s<#ol|IR3W9%Q%de1B%y48n-j{EBih)q<9U> z=UW`_N8}i!_;Z|4Z1HjthO6{1EEl=hQ)cPptS=@8eJ1E}yPvdM-0mlfTuz($M(WXROJRFa=g(Gd9@o2cCGtt`YC3LM0cQwXU3mGO8976vX)Ko1Ecln$G0Jn(l@XM2*P9_(i+Ez~1* z<@!W49&TLI*xKfV!LyB#)nM7`a5I7u7~av6Qx`5hff7uhRFG?tXq#@DtcA}u9}#+7Z+5_Xj*CnYA^ zm}aAtMs92EKz%qhMO(tnvBvgPW3VsbbkTtcJ#9+%!ek9(#5TvGo~EP$L@hNk6Kc*? z(O9~1igJ`q0Wi)};^J@^=P5kdRZ^%(ha0;SE$y96(Ugv`s=G1Pl&mbyIdN#-G@db- zrhBdoy0RHWZH8@y%v&3lEUCqQT539KJlYnGB%)r4Nt@$QpjJNdWLsxr3Ky4Y&PK(e zATIp`837EyA{RcVv8}B$;$h&>2nurV^ktoB&LLN}Apti6_dYP%@q21j&;L&>2omC6met!x;*q zGl5By2*VjLoe4~uh+ra}%S@P*lo6(LnK>t|fLfK60E41RNs7*8bhbB3vZ?tWT#ti& z6K_RRa_=}~qC@{I{yMl& zf9?M}GW7r3x%|Vm|IQ5k-}yRP;r-4pmR|(_b@?s8($ydPB_4I=l056WMj%Bq6kf;W z+v9&Qa9uvOQ@Zk7xcnMaW*xe$PROqrif`faB|p}G2>jROD`svD--^n%R)txpd_pV8O%9KPw@By7FJ=^6l||Y?|_qgTm95ALQpsqp%Xzq01TpnKeW4LD!p1 zcKeS8r0ahxuyo~*;quoRHOaFs>t;yN424U%e92!0Y%KiO{KNJCCm?^i z@^^CiTOb_|EFYh1>he#|(Er}%@~2~F>(FK4_ttBM;uSZTOm_R@b5dPC{$35%-+q>f zIgjV(f%da)=z_ zYf@-WU*X@6NL_5v`#Jx1Tr{jh%O1$!{}%TDW_EZL=)mW~+W+SO(>k%Zx>0zB_Y9O{ zwJiQ#j%Jwe8#vhDxXFGv4sk8}+YIaX+ux$>&Ruwe1VxqRv8CYR&<{WKHW#Gm^Mm-6L`pEqGx=kHi!aGoZ(88M za%aPTou3}TbjA`Tk&?~{#l^*?@LvuSHs>kj<%B0qnmo~@ujqYYb?qF#&#RHo`C*Ut z!Ls*Bp%AV_0Ox)n`RTb2?|OfcZ`Y>*XX|?bXE!8lgWo0Ey~Ah{gdhTO8_Xff*pcXu29`iYM5|k;|=R_nZt3c3s&sT>_UdkbDDbhZtDJ2~u zzJ9)A^ZL7iy!@gedHs9^Fl+fs02X9b4*L4c!GXLJb56<`J$P>a88F`kT*qHz(A@se zy~6-FRxv|;K%Om*C>4!pqOKM^_)6d!UH)ht?4JZ5ZhqzyiJDCXz##bpyqN=wR$ z$F#MrX+Hrzs5lEAFBX@VmrbmQG*2xpjZU08wX`BqRyL)1N^=APE6XE|jguRvlr}~u zM#ehTCr((~8CyM}r7_mt*|EMe9>xdJ6A~@0u_pN7Xk~ojgo&jS;a^$l1c~3wNV!d+0 zVAz!M6V_BT(vwK*A!fYwoT$^*3BKs=h_|llh&C0s!e>>8!wIJgey;Yv;V|jIzH{mw z-+9A)Lvn{Z#n3>~KdBej<_;~s#=k9iQ`U_#tg@h|1fADF(&zJioYx00*m>Z;@4wRs zncB7!9{-2qO{*t#G$vZtL?=utnOHKpWXgp2`gp9fGcln%9-GkG5ozmgicV;3j73_& z{qU(m_qr1>=kk@U@Hv@zDoj%n)&L$SC)RgG<0UPo$IA~tLO(C`xqW-T=Vou3@4D~% z^XW5dsCLHVMo0-d?;O$sW-@^rA$2@UaTx0Ac$(rgc2ZJ)N-^GeS}BiFSSv!llqz6ns{G=2M#)$Pczt&a%HK+br=uiIOoez!vT@chjcuam`hT=mgA>e9PKP& z`4+|Hw|_eom){mXnmNAXV%z^u=DJ?;xir68z;6=B2l_CL!lzdvgP&d7p9Pr@iq(gs zwm`ZM8Lf}5GJM+Peb8hr4{1JCqR)xw(;)f;$b8;IANSyiKE5gCTK~^4J0Yvr%RM~@ zc*@xCAqsJ`B`J;pWYW(ip;7|snq1+Tr}+oEgJ9|3`kK=QMLko+Y1Ls~|<`rJtbxaL$(e!m)no?BC4x_g0B2>MYJs{{A%O zbW^SrJ$34{e{7ivf4;jvFdXj71`^-l2RWZ}&*rSk zgRg;%xo7LYJJhH0;2%-OH{*r(dsQBUM+j%X*X!n^zH#0NlmGeIxjZ~mC> zH$`T6(7AiXXNMZlC&*CWYjB^6W$gI$(Bw>h!t#%y@(1qzBbNud-gy-2_W|U;7JT{Y zp+iMWLFN^>?(kP06kS*b>VF>iziVHt?|aa`ugwCVg8%*qzQs1iywFaQKYX!rm-yxu zs`miWTj_VorL6sd0aPc}MaNmG8vO!-q=thpZL$2X1AoDuZMbdl+4>kM& z;;#h;jstzTHQV-jz!?`hzw#RB)8jUS|GVM;_nMN8#R;p{;YF{4v?SgW>a?T`1rC{>p zlz%hyO&|0%WM=`JyVW^}`Nw{C=-zjrFMWFMgS!rb9}a}AIT?IX1pVv%fPWnN;{%wp zUWEB}-JZ&W>+9!I-^BR^=FJE82a2G*vELTb9J3$({Nn@YZ!mY1RYBi)(qH+&@H>2G z!~5b5Epui*Q0QzZ2>Fhh*fPie0Nf`OnmNkkmoa-FJQHj}-~NPr`+VTQ)Ru=U4?;WK zlYJ4)y;YO1%)ZDuD0AK;{=(Id2AqZ!{;Go;0yHMJRR)~$mb|Ki@Hy|jExoG_j)5z- z%h*WhhB4rm;lBQFz-RCcV=oGBtpUCL!Iv$0zJnL`_8pw$a}L5DsSx$8fOphc(>@qJYi4Tuybt-YU*kLqOMD@Y$KfI8>=iH{U>U>v zIA?!QbTi)8Z7T=8&qIIP0e`NIX~-%+JXDSx*01C`WBUl(|14;m)zCJ7gSyyljkf&k z<3so2+@0Dl`oB>HbJhnmpLlZ#>cV+M#)esozz*;O+5%&J9Ilt}{tnp=b`po*^Ei7i z_(g1nxvpHsW^br7wv~(#&{HUK#g?4R@i?zzStFp%@N}RM`;8C6(r-`?tfS-PS?i$y z?kRk*9{ORO4ea_9*B6*KaE*cWW*qD%#zCK?J;m#=cR<~k?(>;B25u7W8Tbt9H0#at zFRwTNbL~Alq0fart$JX%ukft>&{pp+a>nlbW#z$d!TA3ZjFFWguoLzM*#G~`YasZe z{89ggdOx+7(MNMI>@)0r!=tdiyuWA`*gO-~@Ty%<2W!uupF2bQaKCOTm^%&jJ>y!O z(y8J@>=#%kiMK#sxX=%C#jcqTw1R(o-!b!n`L44V*0R+(claN`va=tZH?9BkVAJ}e z3bG&VJ?%Z1H*oH;=g#<@l?UU84&Bq@pZUPfLx;*&+*f&U1;ouh!R#siMRUkQyZ!}p zNYei}r#=L}^UZwVNm#o>6?3OyKMDAe0@n+y5Bg>E?wJp4hIYC9 z&Y2Iuy8VCHdlUF5tLy*&nRzmkAsLk=EG|GmR1{f7M5;C+2_zvTAqksOhmZ^;B^y}) zmn!0hJJx;2r7bRXUy&-cYSF5-E^TeC#agTFS6i#Lb*;b8IrrRo?wrX~{e6Gm|LgaE zy?)ONp1J4!oV%TS@43s&WLD!nj|Sr8zsRqUFY{i(8jo!l`glVg){KbL0^3m>tOEv7 zyt8gMw%hbr<>8n9lIpkjv`vrY9lpr-?jze`Rx&g1Xr;V9S0M>iA2v!?4f4xObgImT*`NR)VpW1Zk?1$d=#~(C0GPL{0IYvJg+GiT+jzw9i4aoj>3@-)y3FZLH zsa`9vULjlKvvE@k(H0nY+<&W~yYbrD4~=1anKkc8s28<8>Bq1p7(LNjgY|!^{b*d< zeoyr(hF`h_ZF33DgGlc_*lr=_&aIfow|+64#|-u1`+sBF8-K6#zh1|Bx$hD0W6HY` z<+Jk&wcY43-kK27+{9%XeGs)7%?;!SDc=p^7imnA5BxF4)>hQ_W~4)9EyrsC+IrLR zBL|O;cxxKrN64R9Uq2K9MeuJ{De9S65S)sII9lbHt;|>S_{oWep4K zsvWwxxVizfxKy*nbrlV6bXF{>sje<7Y0$dGB_(CG8FUGKr>Lr?X5PYDCqn(w`jXjOTj-FN6q0($mT;kHguHqiygG%N zwn*@%0Bx1vZ2^){>P6=@MV?sOhP^4**|05g*gLN`m4F0vI@WHr@*K@&gBPbz^A-u( zf5^cPyppH0VcSY*3Y&7X*!3&4PCqFR%uG3%nevy;PPT1qU;GN=*k-&$s)<2s zGu|2?8+N>CVM>sY4Q@|M$Vxi`MH{5;6kT60$5IoCytNHh38I7+TxTU~awyuMwU1G>(y|~$ z8*ENX(Mr~hAw?VPN>j8_FyI#0;N@wGR=PUK+6He*Q?!!pcgWfX?@Uv)(!D{7Hn=@a z(Mrz*iZ*Dwtuc?4J_;0V(DrMiD9=+bdfKoLW~LIVvq4)J_%|Ee8EDy{&F*V>!Re_~ z>TS?wfDahjpv?fYtqlfw*;cp3&scQW2RW&{QiCZbhzykZk;iNX+9ycJ2Fp{Z$p&lx zx6&?3B~)vJrD+LS$z}uBV1rd@iXx<5bZz4Dq)=W%-cp;kO$aCzT>?548{0y6ODRPuE;Xv=|7vq7E)mT9(@IU;45<{}BU1gK4d z7Y9g}v!74>YWvxSvCW&dxV2_O1KMCv@}w=fEiOm3LQv484cY>uR5sX^Dtoe5g69S( zvpQe8M42Miv}Frc?JnLWhVTk$2>)nU{xyNFEy35$Cgx-FZDyBnfi>cGXMe)+GK<4McoXpO(NZy zMs14rRU6Ej{X|iKm(>YcH(e-*yp5&y8*PK~m+wfmG6<#3dbQq?R zkbo}FM;YZ=snhuiCnNSljxVKZRcnpik}`VjCJEB}!gOKiekj3@0%U_ZDWfj1-^;Y0 zDg6q5n?9>V*VUWaD3sE6l$_T+oz2$w9*lQq79Y`>VHL|zTLJEA0!J;$9K}`>umJJw(tmi z&^!2&T24-gzPy&7k7p5lp=>-<_raU1QQ}PTt%lr`0F@Z4;5!NfoTyOBqmR$#yWfS2 z?}0DI;p-biLdYOuGQc;Qs4OJRM5H|&5or$$#Qgl-^5gk40SE2R$qeRXq?|*BqId`F zi8p>D{BUS0Uql!d!bALtjWKw17%~|_)y>a83c)>7i9pyZm0LcQW$)omIrrhnNNi+E zDI!IJ>ZqY1%6#-NBuqy2JpN6sF~dXFkYf+!a_u_=8b?5N+)&6AXTM3vg{n{AFf2sO z{Uauk2$lJOtY1VNpZ-O}1Jl2Vcu<~{WDthYcThJr+q%T8GlcMHRQ4f*l{8dTwe7aM5 z%J5L+Jc0roFX~6*r|RK za_ETx;<@AtEfKRn;%83=&vGu3$T{I}M$rFp@jb-%FyHZ|SX?=LH#$*|6VJ_YqURgs zwCJAmd{EkR_emsc#;#VpA1&v(f3YcMTK?IJ&pem!_|!430esKndp_UeeBX`lyYqby zz7OR4AimQ_@H}q_-{F~X4dweVz7Oa72)^&h_r3VOH{bW+`$)cz;yXSAgR7A5WB5Ln z@B8w79N+ijJA4SP1NaU{feW9*!gUbeC-5C^0M|smPvZMzzE9!%RK8Z(+U(#|`xt1e;i8AX%`Tqa2W_G*u?xqI+SJ%}o?{AE)Hx{ztjlQ8t(yHrPlTOePy_v{bxQ#8k{w)D1B&mph@q z+KgI{3-=}N@Bhn=<>ipirYk4>=U9vaC-eOzZ$Qd<`|oBH+Ze~#^GmHSmNeS=ZkvAF zxV``D%)<3GZWWHinP;Y_%`>cKNI%oq*K9}A9siH{W-l-QkMg~?$RsnN#^UdRa5xr< ze}*u9JJ@?Z9RA4X?>WDUkCKHymalZP@QEJ_o_y*LWZ|!*_L)C|g^x)1+%F7-aLxu6 z{uIZPoSa>>miPAA2SOyLHpJ2o@RjLsLCzK6!$`kI4Z>q`b{c6hJsX?zyz^||oL?JhJQZbJ&MqU}fiK5|_serSV1$((zQbS2reE$2a}JncE#jg*hh5$?>{;YeLMk2%tsoW~uh zJLgG9>dDz@q>`aXr8nnkN9xOY#z@ytYp=_BF6`yMh2BY5^jqBRBeD1gAcLsW4ko_b zKXfQ})^A}+?avr$zVCk+67XjaHC?}ogwmm=>-Ul{cc|(5EL09PUH=YxQayA$r$!^h zUodou7hi#Nhn$F80kHz=h~_p8A#dm=JfX{7W`iheTKKWON|-calF{T<<Bp&(@dX4MaVy|DQ^*_IPIp}XpG+2Lh2uz% zBeUK`6ytKbQSrSv-Q(1Z`CDce9avniA&ZUT!3wAm-+7aWv=VZgr&c+&dl3irfc{#0^uOyTg%ca(5bu z&AcG@c}J?x{k4(q-w(MTle^1E|Dp+ES?+sA+E557k?R@f@)&6@&y5+0>(`h&Fijd^ zq~}PpBe&2<+!uOs#~F#+vNw0UBlYDTY$R^VT60M!8@Ez(^OI0QzZa=~c;d%EEC+??=m7n}i&VJ{I2&NF3(f%;4Ed zAkPIC0Ss`##Q-rETmq2mg6jaHF4zJPal!QfIWD*Xz<0q`fUpa0#fiy2EI?_|Qi;To&c{+Eo^X&QDC64rB?$R*-O<=Dj z6yD#suNe9019Hvu{^>9X6GXV44z&+Pjo9HK#?lBoJof6xL`)1G=F1{6e!_m_TM@G$ zpx?_4Cn9D+z$3RYQpjo?XGO$J3pAmHn<8dfV4*o;rUjb+!pTSx#~DT?Yl)Qea`SH_ zv_?GRg|39}4!1>$jI@oU_DHFbIKhrcxg&K(Y8|O7vc!?rM3#rV_-8N)*Lib(_;2B$ z&hLetI{!Uv>il2S4v2-{FqP+8{ZT4ElM;S2oWo|}bpI5N2Etq6TrZyn3|-MP%=Rig zj1(np4(~(D6ffrG(_~9mw0#&29@ZJ<#c7bmPeU@?4uu8bLeux&quj9*WZQgB!dTl4 z_z@262JthNaJVrzkZ_1Mgrz*{J~+%P2&4ld0}DJZfhk$Y6$ToC%Qn#1=D~1OQ^}d(3C@VenI^~O(L2c<@sr&VKh+)ahscP3iK;R^ zGL94YgoHz-#=Pg55jmKju$MSYd;!<^@W}L_z_TKUvcMkr8<82Na|{fHe`q=&d#^j9 zrkFe~?~EE(!U^9ME#l~0fxDySfpAZ>mIWT9_ePhn@Cps=`=ZNP-~{fEwy^M9+Lb>L zZDZjr5*~_nvA`vJIQn@YY>)ms5PlT>g1elVLZafoSb8)XGJc4qA4kKE^jOq)q@UnT z!yuK%qmfXsnSGL;VXB9P&F=Q60K2~jW&!>5^T5FdQNlW{w;aHhY3TY!&lF7c%ud9{D3FS84; z_Am2gcG*gYCzt!nP0Mi)yuxoW(s*(qSNdI!bd|r}NbC@<@i!QWcLLY>n~Zb=?F+W} zn~lUrH`n`@JJJpQ79;VV;YNR}k#3`S-}CQur0@F=8fn`YJiFQ7VWeVOr{Cu9G!pM1 zZug%z5|`{w|JOz`1I&Nbk?!+%IhyzTe{`e={I?zHLH`{`ddPpzk+%6CI?}`bM~<}J z|ICpd^JO2xCHsk=oStV&MSaTOlxIrC!nt{- zR4kmIXG%o|_b<#V;?!8UD6fK6VbdF4pQI3)jac#_fPr^)%@6_7_c@|BQBR+-{c ziLcI^9|+gvRkOf_ye_Yn1=^DOx8&hO>0X2eJ%k&Zq0nzKX5g~o3(l;~Lee$EO4kgl z@WsH3xQ2z&7u2Fsw`aN{&*`hPZ44VU0AGSzhBvHxz=n3kpu|L;*_S{D8pHKyhI zei1dMr9Av-t}!jE#d4>3@pVXQ=&88T<=+r7Cqd*d3iiT#&;=CD+$fG0Cpk`!<98ua z{&tBOE8)|P<*{q{6oc9XU#$$n*PGJ~>Q1p6W6aw}BmBLA9R3cxKZZyqwo)>aG2A-VNApAfBhoj@5^AK9E8wD7& z4!8V`xX~4x&b1gAdpn5r7pE5Qnp)fe_1NEHXn#uKAxhzKo5Eq7LQCv@PNAz1nje}J z=1{)>G<9eGk*Pa}KQVRZ@Mos(^o_sRzfF6!QP>Nap>Qq<;gA^$SCfzvGDG2R5~87U z?sz{XAr>-y_SYojg_iJ>w@HYHmV5C&l+U#I286u$>A2@_rXa4^9Infz*!I90kD9u0 zJO0?z<(s7XxYLeLI_@2m&5y$1^%#}!_=c=Z*K778`1Id&%=$b zSOr&pM65fA+-oY&9dxa!{6%A-x_+P+f0QCWZ6jAnKl*l%L%WImUr>p4qVK$iz@UFn zEDvdLmJ5v=iR}^MW;%+}#s^MVs3&1a$PD=e2}46>$e&8W@X!b^UV@NmO)6pm-Msh` zz)=!zPFFY%VgWUu7e5KXL0jSf;+xWRy!hpi^KZnBu2`K^tSP8i(p2nmsKi#GVoxD3 z=sAk@ijB2|D>fpwm#J7DweCJrvC$-ql8Q|rp%BZb_#OzEx{!$r=;p=80gjUJlyrrl zF8Q^1LRV}S7d93E_Ij{}9jf zAGC3cIPQqp*&LVq-?=6(htD@%g}cpWRP8T_XR1cUDENeuiGP9nXi7g;m_G=;lY=#! za8B%^paPdbcLJV|DmVgnZarzjV#tF|FU0eC{Cop~UVJga!3Z~=+%)-`^e1OPl$6dv zurPjM>N(})#jnSGQ~{;x=K4UImL%{@x~dod9chsyHPaDDZoR|!;LQgtfCidMy zV{-fp2Jt}t1km3+$c$=!SBd`MU+_NAqv5essbQpN6Ws?VhSW>E`2Gl)s)e63D?xrA z_IX(e@_zCc@}3Dfw(tu+sMmpH#?|p3=CX!Z3j!UQ*)Y9#WWw8r(pyM2Oow6;`+7I_^+Wmnssr$pulI15 zpGg==8QRaed!dok4vt98=7{g$?_mYvC@RN+CP^eXhTbC!#IaQ3K;-HLVj-3FAc`A0 z#HKLeI<5%N*HIW-o&+O za6$MqJgN&{*y~Nc%y}~LW=EJ5S`a=1e|tEzgfqcyQm7t;_^FgK5=nnr8>YWIGL_W* zV~4ImS_NcK>^?Cj4ZfV;0CnCP{VwGgr@m+uI{5v`0)Cs6N%*M&!RnA!1pIEQ*I#QM zO|3Z%|Gm)B=`DG5dP^Ri-jc_pw`78n3EJvge@C+i;<2!%qeyNrJT$s15h1ub|Di59TeBhib$0hxy}_pAYPQc4nQ z0qat%z=$m&*sPtRht4DYR5u8nmu|@O(hYfDx*^X`H{^xX%TrYjZKlB*h~K4*0#QBf zPc&A4go;Vm#3xe4G=1}e7YNktj(_T+(Mp5ebgZmTr1B>Y=Av@FQ)6u=|B+ly zF$echCj~>{&@4u{#Yi@E64wAys9+ZpS|FziS4BCR!kwxLcWQ___fhC6q+^~^{k_oX zp`W8MizrN2=!_7}%S9{%GXJqWX3Gh7UeBGO_7=Pp6TTmT8IR%S%_cFllM;t-;4md9 zLBb_WpXTgKIeb~j%zmNEICE35E4aued?gpsi_-@kQq`r;Ws8CDQPsVN(+P}zPly&X zu1x6`QRZ}o9^m*Uultoj?&ES4v0|WGMslbCMKISK8YlLmBhb(*q1;15O=i?2Y1DXg z$!c_khK9{F){p%rmP|HEbf-~EU3vk=Gj;4U@q+|S|KT}#-jmaw^I({Kp2H@(;atiVe;UQDtrE2s|P%{jc(6BqFko4SBp zgpj{vkbgKN)!b~MYYYeWX$;fO#g)_Bp^@!V8NPta z7fOaFK)1*g76~?o$q5B=6Ptfx0s97{g*x*pZu0&PoH*AJ$SO3sElp!)fYgNtmP`sY zQ2rCQrah-P=mX%4Pn|f&Dnt(*o$Yt&EfE&q2^}^&;5-&3|$`f zVN%a~3xES3Ai%T37o;-TZNG9yR_{0hwJ%oNlRtOZ#Jtp^#4I||Ag0$}zzslt z$$`28@Td{s}P^DQAn(9q#NQ+;Oh!8CHKpRpu9%v~P`3FJ@$ zW({zke-w86B;V&#;c&2uejNWNtUZ+Wg>*&BL-AZJ%6B7SN60_Ioc2=5{3B!L#E5o3 z{_L1}LT}Id6)|%TOs7!({Fr&`hdzPt*TxF@oQLDo$HoW3l9+ibfuAH|=B)%4T4F_k zT6?TK5PDSYQw)ewkZ&1h9 znM2T+f3`UU<#L}RhoCH+>(k)-f7k!Bz<;p7|Hx0o{ZlbHZb!}sBl7Hzp(c00RT<_5j=UPSj%k(7;OZrnw`=Q;c#r1Xd`0MqF;*y4n zMP-S);_A6&o}sgsHk8#T$`*(?r=qUDLBjP7#dQr8)pJEGt1brjrB-)o zbwlwIubcnQdQUG3-Q$%vG}I;*mDSZ()Kn*?CZ=dGH62XzT6%lC67qA&=9&C?d`h6C zs;0gygU%}}t4$PFp;jh#@VDa=^gFlS!n%su`b0%(Rhb0q%gU+~^;O07%w_*sBTGS~eX7eE7T46xbJ{dL6H(*R1nr)#BQ>rrTa2N>cCDyJ z7piWkD3)Ov7(Uf4Y8q-vYTz`?uTErCuBNuEnw&~iO>t?WY)M01u}vGst(dbkQBqdd zP@i6oe&R^czB~>_%bc3J`8E?uog7BRoQjg-hK$llHH&LeO7zC!>eBl1;(29>a{Smv zSzUUmP(!$~`BVv1iTp>+ykgbZ!N5|g^$TljYw9wrSX(FNtEjGE9~l@p^{5mBtFA_6 zw79+^QG%ZY!OwrBjTGYjMwnaHkZ35U9}$6rNsm)pT8fcXRh5{d9+Z|<_5Yv*mYQ3Z zm|s&`*1tkk4crfMRdzi^IkZurGe>WWmCUI=H*qx{5`pWMW=fh5-__Wf-1h zIPRX}&6PE%wP27r#S5!+FDsc_kzP801YF(xit5bnPS5HaFk2-`iyMkF@t9 z2ut&i0yW`xlU6h~txn)~f_geTdc67da}#r_Y8EFJR?}$5QX)mnvLz*=KxK1l*dGKs z-4q75)x_ia zx<#VnKCKN=ON*|E`3Q8KSAEhBc*j;5|? z3H4Ac1i4ZvJwUg>i^=(>7tLrS7S+vJ>c&dXZgHZToG<$jM@yHXezDlpsc3zjTP|z; zl%}i#Xp(TOkH?wT2Xrd~QCCJZs4Z)jfdjBDsp5)>nNpe5b5+$>-q2M*Goo4ZhwZ%gGSeT;|tYLU6?pH^p!z+&eoJ_we z|2g}9ipDcb&Adbd{Yo0PIaogO9?mVkql3Ozi+u*w-YnVNdb-ObF^`}`arM#!udp0P zCMx!kGpDT3BC>^$>5T)ibVpDfU{m#Y=e+F7uQ`Eh(<1A-aStsWydf;ii@!?TRw=5}1)w zlZ^YkqP~A_%aC4tOVdk+d5~s&S-iQa%aeLIJIA;}(O+rp?LMh4o{#!FvFHcflIweM zHiBP-!!OXO35ODu9xjonzF3bY7U5igQZjoQYccW*nQ`jpRn*#KVC9->>_Dm#RF-~} z(U&p7K`B9#ue{KXp r8}cBR*p7u7uRRM(`| z;ijLaE3zqQX}+*w&dh$Yqk5E;l$u#SJt``&u)hk_m6gKCC76%smL1mg$)|MS=@WV0Vm#QD$E^TTx?aZW^2+n#Eja zM=wTNqO*&Be6fe3(#(Y}=$sgE6I)zdi=C}?>Mo>poEx7MsU+-x^n(n@fYz*79ag1f zm~vn=LDDL~DP!8RvN?19({nc-^-ee<`W;UAu=>QDVyxWLO0PA{&vSkiom4lm#<5A& z;{c;nwjuUeL&f~EnuVq>TSiS^QG!{qx}lEyuX#X~cP%_yTXuHJe7w1<#Y&usW6k++ zoT}=!VsPYD=D5UU2UW5zd#rvQ)!@+hKPgZ)m}OPW5_2d}RWTpqzPKEZt1HrN%Kptf zH)kd33iTC7OaG>76xVX`g2Pd+oY48$Bd~vmEi-=2lumT}(A{yWg4q1JxVR3Z8vu@# zqEOK6vJfaOo4pXH;t27g!NjnqP@tHt`Kg(5I9LVeTU~+%#ADt(QJ|z|A-2LazqNI) zO0*@{Cfj;Ec$(DO!1M=C$%*2{#k?t!wE$KpIBUh?C99tFZuFTfnyCd+VsS-7xlDxF z(-VJ`HMyXGv~|;#1 zQMh>YHV41UVcu}iI&iFX+Kz1n9p+F06PTScEuXGOr;L0^ualFyR@B!o#F3#{iDr~5 zWf_{2>l1V9%F1Y?jy{GZ@0V!@t@;&|ix;9x_Mhy$iYmD3#O$T)$#{V3$^#_WsU5vqpH}9J9!^er<*7js)UoTBCCG*YVh<&(u zGen`3Zx(fW<3`rAoUi#AXp>aHMH#?)m{eZVcHymmgVknVPvMUmK zLW(XjyHc~pFvsptq@HVXl!XZxt$^qd3>&o)d1%HO57tbgje$y4C9JEH9wV{R9+@4H z=^)lrh-tcS;1aSwn&ze|(P&X?-ycF<(lUg-+!(fqDX&O<+R4p6&v0t4lI@k)e3Vw; z*c$II(Gi}jV$O+0W8hoSr+3Y&;Q}VqY{a8AF*1V^6RY$V9kj+E+ z&cq}0i|H#{Jv_8o^~ihri9~T-T`_zZ)-#EQrPy2~ybdhHS+A?Dv6pLvWqA*qDM4su zXLq}ij&JSqx_V)@9uF&sj@}-xr=_!-3S%VmtLI+#`b2YgV`~Ss04?&{T6=oEK7QBS zYi#k>^|X4;jlGS0!&;n+(~xa%E2vF>NhPW>n3oGoaK#TBd>s zv~zhHdyGXm1*voQdX$LT(MIfEPmRSN0q9QlppU@lEzRAD-p+0_8?QH67^V*ZWEuGC?>&nKaBzi+D z>V!(H?4-Bxk${sV*$pkXE&*#A14~!*=#@Jo_bT%_2`T{E3G;@>=Nr9Vd4N=np2 z&Brpj8oPVY`d)iqTW>3b-ULQE&Q&mc>7x?e$u)gRjAi=)495-d^WOC-ed!(!=}xwz zZ&4?+X^M_RL?=Nd;&vwQf;SG(o0HAd)?OcaILd%wyS}%PT8TOc230MYkMnf zW=qjjm;`n5DXQHFC16{kf1&@pll?-iS`jTNNOR}+pDuOb=#-?6~Vf>@1oUDP! zx1x7;^tN{NHPTrEHDpgKTGZ=YhY~fSiXE6fXtLm%G$&Uk;pQCD)!vjuUuwtb>ghq0 zcDyvM;?dC4lB%;Tx~MtahSLoxqk;3Ig2EnTVRBXEp-d+UK6Yihq*~IUn^E864i4wM zmYoH6WVnj;$0bspgeAD8)}};bA3ia}E{x)JaHs4+@w}F)G*aO3ref4K;;^L!lM@Fp zI{La+k=)qU1%+vep1u|QoN#yY+sP&xFEomrB)K#Ro;BLpEwFz#!GLyk(xe4zdrhn0 z$JS!THAg)i=oub-OdqCuBy4?O!X#_8FbKLE6YZGO$s@4uPIjY(V3bv@b`jt;HKH98 z?Tzab)L?7@9uS6iC;NJ6Y>OIZDe`RO=*)8zFxlOnY;JArZbcTx8K(+_=^8$dtHI;I zu`>417%1duy+mIJ<^p3Q@id6#wZSc{CEx5}05m6zL$_6hqmiR!V_FdsEBiW{$VOP; z!>6DZQg^1AGC`{#>UlCOS%i;9&fU}j#Xm51ZHlQzW)@hN*E1k%J3TvJ_0S;YCuaUJ z6A67VunGOfdgpG87`VkImSOoO-Hg~SWFiT>R=}9)hUN~Uz)*m|M zaK0tF+RZCz6UBH)CQXQZmI+~cU&phZ5zSnPZtN|g81u^-%4^CRy-6o2Cf9Z)_%U)STZ9iU;2GD1vgY^pWFjsp_Q)*VZH>pl>=@P5 zlV}~5Xk=I1oowptZcgxHii;!bn!3^iPPedkVeR(d&1O36!UqYlzTklhZ$;KLS`@j4 zc1o-?9~R}Vz$;wZ@6j}YK7vAU9O)>C#Bt0gBB=FRS00z(WwnG;y^amaCkgbSPOp2N zsSA&X?!GQs(wG^PR&ZuHDM`RZVoIlZudyA2y9)~$PE6i<#lE+AJ{3O$ddco?IC(5( zQl+56quorssq7r&h9j0*dl?Pe$LJBw52o_G4CWNjHCfU6X#?ST4aP#p2C=5(fkcxV zY0;zf>RD>c!cCFd+?ht8tt zVI;wAHp0%fSb@o;t*Hl4PvG9?%+*wI^if+HYFtKUB}u(^J&mQHL-T5o{0vq?aKVUIACYsUXBX58l~ZolJJY zNw39DPO2!c@P|!37-(3;!0S?_xHIv_0}}uiL2!l%a9){P?1O;7@q~70*b!vC#aq#fAO{@kAK%bKCZd_;D4eNJ7WE?YPW1P^W z-_+9D2FF0#AX=JGx<=6c7ZcoCFT*SIq-yQJ5nTbfBa*2bCIWbpu0|}cF)8p`mUmj+ z>sPkHxyp*Fx0`ybS%)@a#(}j{4UZn#)XTdzo?OVF((o%o^~USWgPZkXg->0o3Z8PnOrJDLsx>dZg(ogQ?-$0 z`)CA;(bUq{K_4HY{R1t{%qoC77H|J(F;7iHOTo4zZxrw;akD1sMYY2G@*!kG|H`lk98mH1nzq2aJ-SQP{xUSQ)or@n-jpY!^5mtZXskw>Ng6ui!bY zDBQ|obKkKF1ELcvl5W~g@+OljVApwx=FSegs-aa+(p%ZMwzIDrMWsDCR=~7L0EsG*Ka&|a>IR^*-Np7Q;NP$PJrP)12rAn2&jQlGVt; zVxqz55Gi2>i`Qg4o$+ikT)fs~@5)3^7ZyJlj;-WU>AZ(`5%^jK#;ELG$T^_I)Y;&# z%o<|7v8(K>uxNCA43?<0?B&gyEii2=&46z0ZEx(7j?GD8VZtAeORQK)PTII*(=WO5 zbVk80#67E^K|^g}TP`(*W#3PWf1LHuk`^w+Ywl}rhjClG&>wIVM5B{!L1}k&!VOAt z5RHxGz@!&TRvekEhEt`516cwo^ZUTG;_Yprd>OZOcCN-ropH%rT=CA*i`gsp@nYH3 zrmL-wmgKBT=^B}QHr5>&1+=O#Pn(eknivZxv#;d*()9R69}A^BO9C1q|@6?CwqnnT1?xJj7;&JIL=)pEiQFA#f9@hl z-punlyQvW#rWK2T1nmQP|3q6JvOPLbH%(saTCw>v;}7SL&E6{fhbP4@ueq~bT9HnQ z0^eg=hBi|@U5)E-h)DWeC2~f#G3-RcPO__)i%xyO>`15-Jlfn2*3(L-K5%B8eLXzM zV$F!^o1Kk*n5sJRR}=13n2V2zP`%ag1MZ-}85?^%n!{IN_QuF;LZ5;qvFpUKuif>~ zIUe_0GBsIa+GF&*k7U#gU1%3?Q@fD_o{YA;byV?GbO(xkbvH;D!zy%jU2!;o~QWIH)6gDEi#yiT)F z?CHR_%Q|{j@(P*0MaFA<-Xd^_(&3g&#e(nT)QMug?t~Af-n+89vt1T3=oCEIDYul{ zAoZrkE}Cu_VrHgmQ6?-!F1*`<=r}_+G^0bHhboOW?S?_J-#*X87m4KuDpi@z^CwegjTP?RgrJ(ICTFG=1OVhWzmIkBJ z`UzuO>zZtbrS3&`qyeLgZtH3}`2n66=)Em!JUS>_L2IIw9)CFi9xRC?5^oJ3MBo!B zR5qMw(|HZ@vETlrBa|+@heFem**Q`(Q|kPlg;q^_&_qYAj$%`5R|^`HM=AW~TD(<& zrKZ`5QbM#FO*S=SjnD^oDRVtnLfk4AXY}6NsvueRaXmQ9&YX6z6i1rUKdB3+$>zYo z$-LhRJJ0DPE6CS*;6_YU*Lm(*!Nra-XvDw?r5)tDj9aC(OD1EyVU`Nhc_PiX*pnoC zX?1QKy6p|TlQml=G%h(z-hv_0IcoL6y~{$f z=lzd-BU-+JO@Eq&uF&yyUg*S8p}pgyy+X(%2;zE=ZVmB~Q!WZ$oO4O^(%7|m^eZl` zWB*JY>(utIvz+4NqCc6~UpkaO{!|ZN^v43}!XK>nF6R*bUI@jjijOR${I88(Lw`Dm z;yftN?H?2%_KYynp^NIUivqalFX@?dOe&=R88KW{=7rN8NcrJf&UgHwRlJT9#y{e{ zBtEj%+Tyaj%i~uJyms(41su0Z^eAn*D1ZEt5MOuFo$F!pFNAoaJbRv=^8uecWb9*#X;IAv7gNbv8p`F&B)IyK?K|G0J;R^-y zVVmnR)1b?wL6^0)t!-b1*vp#QaE!BT>a&Yfjfz4iyO8iVb^1E6iD(uTUR)r|K52jqHvC1EQK87- zyzrEQNTe#VXGLU>=(b2SS{?DC{?V0@SkynTGBV(_NNzNC1o*rhKQhSw?u1JGS`IWG zYp4Vm;6E~V@K9hks*-RzKHnalMqHV9t*{8qZ}V0c@WARs*L1RLnPwQz(3JD6;SN$he0i2mL7GZ;$M`o$}gDwc8KYhn4sLQDi^FxCGfB z8O2ZHY>P}sp>rxD(@}2x{Fs04N$*Drqy8t*MbtBpGVJt4Xj?e0a^Dz6PssE0@l#6b z$?fLJ_)tcPe}gBvc@I;S{F}bBF|u3K-vxs~L_5xl>^?6t4#7zv2JALJ^(^G?nOTNY zeKOIoNce+DY(AQ#GBPAu9vNR1nS9E;ib(EhQU8MzE2#n(`>0#ge}^OzGRl0Jqy(iu zLTO+BYQ#7U4O=P~t5(5Qb4(|M6m)sfIVO7VG8j{4X5=z?z`jJ|L!bfOz5osDQ* z|0algqGX=`DkZ^bWEkci&OUY=ItF4z{fB&*AK^;sv5!EAp_MR-F=U6lPx;=CM+5v9 zkoE{Xpww?iMC88BM`K6*QQ>i+NWMRUa;%JuM9lDZ-~k&W@zWUPqEFGI{M2g|$^IuN za3waOGenW6=YMnp_xf`IrlR6i^CBbWMdJR$Xg=s8_E`ViFlzt36Sqa;QP_<;&Q~-d zYVr%zq%i9Lp2|G~ITpg88~y7+a{((OGcjzaSL9auR|BFkFQ<+g_1``LgV(iv7Gp>K zUmDYxhRNv2SHY#l^MMcZhfHt^Dud1&Z<08P=#D7VfuNI=qZtLxK~8>@gIis9y2$x&-_UE%&31G zIty~XHiACmZ$BB{&_5o*d6B`0xhJ(5IxgJXEhlWtu<4Bv@&$gJx+`k42WlOTZuFl$ zejAON^P;go!uyj&VZQf|Z}F50p2CxtsDuPP>lV7#Zeo!Lz}z z9PUv+e`92LRb+5^Byw70$h-*kgxwKoz&y-7BcoN39RKW--$&0n9=FHP4zbvJYE=KT z6EP+q`3_C#yGQ-g5zViN`k%p&SQ^|%In+iDf-NzB4#5I|o>QsjQ@1s%h+9z@JUttY zh@$;-JtP)(L-r$~zh7kpON=-qs!R;sW8mqL-RsEy@gGq#{@aLy%&*Ah%Dn{%_IL)y zHjZPIe=Zty3{F!pG$2H7qKxiV`F4r+owqF8kiHk zZ)+~vV2oda`%I)YPE_V+IN4isLy_I`KH!1Q(@m9{ZbA=dIEVWX2eaJXGRx8SC)@QP zR(d(!-@nk$_rmhd^9nWgwlJsNVfuAEbNtmub+t0zUs2Cn!u)^?K9_mw@BOEq&tT4f z+CRl8upje-(-;W_%qL}VpZVkrj`;}}|Jly8XIHZRA!&?++06NmW2Qa3jX7;f)2}m_ zb0%pIzR!F}8Y5u?b9*unJnm$UUrkllvCL`boqo+{zE?VgbOdwSX{TQknB%Wqs%rrA zF^YQLM_i?SGk72CV^^TAX66GF^}KrK`5AmFbN*wLY0nCo^Iw!q<9jf-ClSG;e{(qp z2fzvWv<>R#@@X5?&*jr@r=QFBGV4WZK7LlKzsom&Ts7m7{OQPkcxHV`$>&p;40Z5q z_08;WCY{XwW_V_QGd#1u8J^kS4A1OuhG+IS!wcyp`~|0gQYU%n%8 zM$jL>C`&rngZ8Umk0XKp(n)5~pOGcsm09@SS<+daCEww20sWN+Kbzezzc!2hCn(S0 zFe1tIp1i)oJn$QQE{tbqXDNSI7QQA+`4d^nIX+7{2W8}BiqPL^~I z%TgY)z~FG;$LyK)sx0~TX5m+7Nq_Gw_W1yOuow6lJ~u{LhG$9tz%2If;_{ENX7EZS zl!P4yhXa3W&(=>uIR|@zU*)rO#QA=fa@Mk)1HXEwq<>Zx{f(?2_*JVnd%=9PT==>y^~K*+c1kbGczFQ-2Zi@b0bBm_nD3v#<5}AMsVsa}mhy~4%C;`4 zOc3}@7H;i#81k9#M6fMBQ}OAdvp2YHD?&vM@0KvV)H=M!;Y%bu1nC^=aGT~(#aoOn$F+s@M!IsDN0BZ+Z9?QwjbdeqEO_1+1B}|<9w!O+FK)lXE zytX-fk;6AR+)Zb*a9d8>gD)0t%W3%*Cmq*r4?4U-!u0a0gl+m`MBXK@Hhs(A7EbkY z)3^52?PBez+hw|wPK|`=rAWfIJa)%bD%_UGa<{*&7ae+8B4L}3Ex+z>mS^j4U6PKj zm(5Gps~mQri|n)11o__VaJL`EM2CKTrpVE^_N4L$-ov~{OKM~Xmme%~ZG9t>-%R1w zZk87*{V5`AJ6mqcY}2=W)Y{*sZ@IRAtE8{(Z+WvS&#fZccCqPOexlNUQsfQtYV|EY zS2(rH3JKH8YpU?R;6$Gol5@_k?&RdmTy=3ln-4y z_-@*r%47LX;Z(1A5~i2u9lp-tFG<*z|92w4DzDaVmcK1r+wDV@&IclYq|&iGN9sZ8 z949*TGETz8@iPah%l2E%Z9k;(Qkl~BQonIW`mP|j=r0(&C9m? zeo_u=AKUJhFPC(vJS`HY7aOL0ZJNZp=!VOtUn%ML8k`zOmai9X^{0!z9oM!zmY*j2 zly9|!>7_uz+CN*nY5(ln&5mhGV!EV5<*{WZWc%Sr#g7nuDvu2lvi2liEIRbENy5aB zclgx~Z*=$;3F~@o6|U>`jBrZdmVuD9gD%g(j{Y18(~GqO=`V1&tt0WH9B#`){Ah<; zeX=L*1?*KM0cu~DFBh)UX%TMw$$udpU2Wzi)vqkKcDDLQi~hNyZ~1EBn^ihi|6;|h zzS~}IKfG7;sr;`0+3E1v5~deg|Ib#b+|h&mN>l8sc*Bx-Tu&p_RR{^})%yZPE9 z60$>)Q=Tg9Tj?V1&I`?1_C*b0S@;84_+esCozBTw_!C+9M_Kp;v71i+*ev|QEc{7_k2O{2dpySol)lUB zvhd5Z@PB3DO*luQOQ(Oc!}m2Rd^hiB8GV<3BWjc=9hYC6g};gcLbZg7x}%P-BsV{&jr<#hGGk%f0Se6o}8y;=Bf1wnaS z{gqkx6g+GvmhvZ<2?BJ#|*Wpv0eDBG^rwtFv&;`f zTd#!aWx0f{{`W=So)1}W*TJ1izfSaR*{pt}@Dr4NyYN#Kx8DsoQ*pb_JWuf}B%O;D zpDg@3#qD}`tK#>F{_ToCF8p4_Ul#tT;$vm~u~YHCi~e(p=ZgL-ik~9<4~pA$(%Xv9 z7X7~}PVckQ^`Uu5_1hNVUnp+ZRkk15cDzvZcb9rtezkD>{*UE%2p_HVFOvDyp4(V` zyPlq;^xu_q>^X$hAMBfg&rO6rUn|t>UwV+i_#dvsCy-rGJ9(O^RP5{Cve95`MAbyM$k< zc#f<`?Kzt*&lKU-uUNiBxZSr}ey;GlRr))GKdAUWg+HSBSaI-n9NYBg2!C4XuND5h z;ui}4rQ&x8xBF|G{!fMfLFw-j{OuL+|^p6t0S@AmImnz;W+|C0w{nLcsp!Ba2zE$xDgx{|C^TO{{{5|2@ z6pzdNvP1E)!k<)pj__v`ZxsH5;-?7zgW_9-zpeN-;eS>9Dd8U~{+jSl6#tuWd%k4t z?8!oP51CIaA1r*R;)TNZR{S90V-&9xet_Z$;S&|_5Ppc_rwKn?@ympNQ}J7bmnr^; z@Og^U_c!TUp!nOu7c2g$@NX$TQ1;bLijNlFs`xbFb{%2uKSy|<(qAn61jXBgpQ8B5 z!p~IvBH`yLzE$`|itiMDh2p;xex2g)2>+hqUkJZd@xi+r``@Mb{=)70$lAxAQ~XHj zmy7;S6kjI%DaF?a|GDBDg}BRTH$*teva_bivK|Pev1E0_yom26h2k)+<~TihbexL z@FNwk5MHAAD&ZB1pC-IU@#}>zRQyrl$0+_=;f;!aB7BwNW27D16`vx!NAX(W$0^<- z{A9&X5`Mbk7Yjc}@!N%8sQBZ;FH`(A;WsG0T+WGZReVo5*tlEq`NAJm{CMGyD*k=p zPbmI~@SiFEJK?`j+?R8=Un_pF@ZT$5CHzl{uM+;Q;wKCLQ1Pw8KUMr$;r64wc0B$~ zc%JM(EYB}6^ z!mm}lR`^YdcMHEo@k@o@srZkC->>*9!ttHwH2c3R{4vF&a;~~l@nOR0djxb@I~*YV zCB-X+|3>jX;ky*yEc{Q3-zEGV#h(^#--oj0`HOJ#y`i9-`Et%{zMmEFD&cY2AKP^H z6h2t-$-+k}{u|-u`(i=*O~TFho&vsFxcUB3zqcl5?-SCcZF9devR-N z#kUGyr1+h}zoq!Y!p--sg7W`V_-dv9yl{K|VeNeVKBhmNtn~jZ`ll=YnecNIAGfDT z$DX6u^s9wmru2J-U!(Xn!f#akVc|C`{<3g;PGj>OAP4jJDgDX9A6C3l_>UD|CET9( z*z_+D{;bl!U-*lPzbyO}#s4h)_lobfx3TA&iXSTczZ734{O^jNBK%*9-y!^S#a|Wf z%XyEjZ&dop0L2d!zK7zK!iOrJ6u!6O8-yRA`0CNd4pS7rOY~cZxn9N|7`hx zDEu^~zeD)hioYOyv*Paxzf|$qC}X#)6+b}u4T{eezE$yKh2O6Dal-Fae6#Rvir*=G zhvF{_e^T*}gg>Krq4dKS6rU^nHO0>p{-)w52>-j{7YqMf@yliyd*;gdrESM6M881s zM}&`2{MW)KDZWd%J(soV=Z-P?mMi_C!WSw&O85%JAKTxg)1~;yhZug6;%5s#SMf`P zU#a-L!nZ2^GvW6u9-40QeO&Re!e3DQzDY)Zm*Q2T|5wG27XF#y-NN(ayw=+JLg6D6 zze)K1ir*%Dy5c*8&sO|#;kAnI6n?DYF9^5i*|wa25`MhWUwnYE&nCq`68%dRj~{CE zZ&G|u;dd*3knkOfe^dB#iZ2uXs^aa!-&H(U+V|gzuNVD2*8 z{B^}25dZVG;Ws3hr>UERi)^FdX_~)Ykh~m3R`ae^AhVWl2K1=wUiZ2!Z zFU8-Le0@20xAh$_`uU0v5SS=|3p^X2ow2zFqNW zg+HPAQ^H?R+}d-O;;)MS2a31IJoTC4V`M%ZAm{P6Ud6(PDV`kX@wKnwmx_OzqWH7Z zjQ){|zb3p=@mXVyzI}hgmgi5R->mdM5xz$8xYYL~#YYG~NAWSjFIRku@b4);OZeT2 zR|tPp@uk9_QT$uNf3Nr~vHx3&+j07V;`@odeP6}eZJO}7yl-In!NNx<{*>5rtm2DA zf3o7evhF%k@w0``Q~bNamnuGQl4_b>Sg-pTxG;yTbQS{0reD6^~Cg_MD*jK;efg zK3e!(#b*d#sQ7&0O^Tl(e2wB)3qM)$9|%8B@w_~D9wTX?17X9+(>@hgS5DSnIa z?Hk#tCdHocg`U!?dG z!kZO;UU;|SFACqF`0K*YS9~|A@70RGCHl80{tw{~D(;ItpHzH|@RtqR-7YM&f@dJe4toTvFw<%sK{AY?c2!B=aCgJZY z-Y5Luif1B2NeH<@Fx`ii|`i} z_YO4mdR_774mSL6ivLdd=Ze20JYPOPZLDHZ1SKRI|4pIDB8IMJZKQDZ~;=dMtwBoM|U#0k8 zg!d}`cj2cf{;}}$6%R?hu2MWE{2s**m43Tj@fo83l;Xw0f2p`#hrgkCmFT~xxLu!r zu6V8J=gH@EY&)JVe7NG52p^~Tb;9lEn`}C_3O`EeKO}sf;y)37jNze;$8;u9sEg^J%Q`i+Y3JHeFyM8y}0{;7(W3qMD3YyZm>-&^cfpHTYy34d1c10|hT6hB_-Wk26x(?3=C-O zK34HKr0^pY|Ap`h#a|V^Nbz@sHz^(#yPd80TG78y@lN4aC~n*Ldy3m}beG~& zrColcxE)7NDQ?Hn%Zl$U{rPpp?Kpi`@zJ9HvEmDbN93H$w&R7u2PtmH<4DC{5d8xc z|GV%*75`Yc-LKnxhl-u&D}6g2mnyzU^plDoEqsmQEyB-KJTB!qU-2B_mn!~EX~!EB zuMlp}M{T`s5&pQ+|DN!lDSnM`dwy)wsTTfwrElB)6U8qS{g9li*>pAv&r^Jn@ZpLl zgpX6aRrplJdxT%3_@}~eQv7eiZ&UmZ;SVZq>-(bOZ-~A<@3i%ON%$K|{{i9l{Lh2nNS*{S$&N#_j3|0Vg_b0%A!z2$Qn_MFM` zF5$aWI(5R|RlHUB7m6jw@%u#o3B|2n_=Vy#3QhX2DZX9O`7gz7z8?vv zze^^rniGo3KE~R=`f!uJJr5u*N%MoDO5dKd*>g3kUtyB*#wq=KW|;?*9Zu=rAo_08p=*J|Nq<%$QT%3y!%6=R(O>Rx(%&xSU+r+x zpB%;wSEs{C|8dbj-r=NAznenWNe(A{+rDQhzEjeEgm zk0jq8D*m4E`xW2UH;Fx}_#)xYI-K&Aj~96_JDl=8OZ4q|fGxi*t33~}ywqgt4VL|= z#@T;dY;GdFZhJ#oU{~M_FBs z|Ig%^jQ|?90I~%^L6i^>5ch;6kU&U65;o22Fquq9B*}!C35#pQ4R@?!)oR5Zw-&9t zR#8!LEiSccZM80~OI!EW-QPLqo-=djWYWIx+u!f=|34pi=AQ38_uPGXZl1;1dBTc! zZ-eOkva%n>%7^1k#if7AKCbkyhqyfduJomUeQj|}qSs62o$oDj|;Hfb|FP zxKb6a2U#0&s>rb&brsp|s=d&!1_K)_#366s;j`}aNewpIZ zUluUO_JieLhDP96rubn7JI5+s#r!12yO{q(@pGBqp!jvn?^pb<%y%-EavR9y_O9YX zn17)7Xy)H2K7o0EUe{nbOyD^2XC!lpx1HPJM2lnjU(Mw|+2W`w?ejp3qyC4ie~`sd zU)twfi=+O5emKD~&*G>r?Q^lkQU6@lm+MGLzqHSlN?)G8ZMHbtpIrbaIARt@`$q-{ zI|+-U{wv(xPO>=aU&i_yEspxq{?D^G>dSM9a=k0*f1T}Lq4XC9ArKr}Espl(dPCO5 zXb0`f^LW2h`fsp(Szk-M(qDG4zO<9&7%3djDK6vo-xZf}IEUB2Vn^QFIFh-rt-_Wz>AQU52b|BA&?U)u9~%(472 zzcLU0sJM(j`3Ha!98xcfxZDn8j&^uTC%qD-|1*pnj!H|PryAnRl>V<+KVosr*AJYp zRTf9p_qd#smVF-T$o@v9znkr!ZE>_ee*mdF=UW_A<++KUGspa*eaVCD*9w>U;$Ed+ zYs@>3D*H!qdA_XpD&~K->~NPNOJ6Acw>V!8U(ZQ@zjlC$*lTfAmGOD7;&NZ^SjFY} z-zgTyavL_#*e|p=+Fv=|@Ix$)`bV?A{9RYt)stLs3t1n_lba+NiYhzjvz?^HG2S&? zZas=idd^W?#^Fm8Kb`GdqxhN3Z&6(A%inb+UsBGGDSau=-!jMia+Okk-%kqLw>d!8K6CC3#j`|&Y z5_Tq79QCD~rztMwaHz%6&S81R&XE>JJ5rwV+>(^T7S^v(`cjWaD=za|6LTs5Vki$h zVv3JuevxGd=em`s4967~$MpZ5({sJzGx@&%dzF0|A6`{l)`wpyzLR2w@8Ix$iKPEk z<|7q9fYU!!@y*N+QT#gQWz3~L-^T5~S@FA>_bC1%^Yaz|l=)W0zh^GbAxXUbd10}W z^)bKPv?<3gDm$aNzx>hSSTDzM`M+&(Y**4>K2!F2_;kLrI9CP5E6*oMI``*z^NYxv z=1q+EF^*TBTM~VVcVDGHnx89}VsT8T^wZfENBifq{vj4e{n-U@f@7Y=QC~jUy1?S7 zFa30>#ZmvjAs7h0QDt$|m;QAubF3FEADJJ|S9~-Yf#YY2^R}6@P4P0L?%bt#GxMhu zZ)g6B;+vTNnYonzUfixc(~W}giOk0+Uc$VHIp&v}1{pX)>vMaUXK^gg7B0^P7RU0G z{=C%UsDG=Jzr|7iC7w51EROoVp>TrZSc{{+tTQ(#zMJiwZgI484BI)&;%G<4;Vl+N z{R>(DGK-_Wv~zjxO3F>@{UO#DUJPOIct-JBgPk`OKbQHBif?5;Y=&`2{Vw2ooTT_s z%qtY{WPX(58<^ju_!j1mD1JTj=M|Udi+`{9-K_t<;!^%!DE=htJG`GQ`F)!CK;~G^ z+!d%`Mk)Pe+-@gX9P4){*YExox9j&Hi=+N*ey-q9i=)1bGYgqZdL&Kq+&rcqlfD`L z$k+>Se{4bn|RADZrAT(i=+N6 ztiQzKsQ+gkPr{1JdauLcXlKfB6Ym;}qaA7ICt4i!SBx3_%iuQC_? zBHr))lhSuN-uIRMa@POS(#NK=!z9!B!QxoXr*gdnW*G%6H{?$-&r^H|m-ATWlFnlO zJHnxg%lF>um7Ov!|FF`RdH*=Yx0>WR=PCXy^UD>_gM8re3&mxf|ES_}T_Er2k$g3> zosX6NY0Pu5u;38=?aYTM{ucAS6_@W!OjCR`m*-r?=P*B7ars_COz}q6-=z2^=35kh zkoh%=zsmdp#l76#b}3%V{I`m?GJjj~6PW))@omhVgG@O~zy1OnH5`K!|Bm@2#RJ&6 z;W$F^3Cx!$egyNiikC8%eFCg^9>U4~7NvhGkHc459J9E4B&j=BTO3Wxe$?&E#r|lc z?mVP8XV=+faqi+2;uU58XPln56qj-MTg89F`azCJ%KtVVuLdjrA?uG*T%M0OKyi5v z;$X$)`GR?h%X{AH75|vyU8#8RP*ZRnitokzIK>ZSex~B3%r914o?E$EaoPX+h2ru) zw+9rL_rL8@T<+`pt>W@`M_Ct0y~uMAA1i%%4nq2e=*x2u{kUBVujl;cD=zPIlYS%m z@*cAyr7!O>J6v&jzuW@F<^6KY6kpBhX;yqK^EHZ}!u%w~-+IwsXDW zmovXZae1%c!-~uM@t#%uYPR#5;`cEBv*J%O|6Fl-pPR$|KD2cDz&O15*E;z{N=DlX4w z-KDrZ*YlX-@*L0$il5H*-&FiU=6_TC=ghxVT%Kz|Ui}MTe^(^NpegexQ6qoBYxqcEm!g=^f#d|S_FIINsx~W3(2U%We@dLmu z>$FzIn;{=~beSKD7xi~Bm;7Nmk$ZVPBk4tsd6D(!rIsD!5`L@VvhTD_@$D?{usB|? zeZulC#l4))-HNYd{;J}en2S9re^zt8vh>G;Tl5?bhx&VqGW-S=7kybrqy7X-e}tuv zyp`nwi%+!lCo4Xb{faDZ|9y6j;zL=M`p5Lxf0wMV^pShneyznPTj^P@c#!?1ywSe> zcSgyd@J80}vh3J@zgw?(73=p{-2VI5CdF5>{$`6~yOrZo#ic!OwYa^1zD@BwHniR1 z_P+PMif?EA9TvCuMRzH_oAq~FyhsuczppAT_TRF&y}$9k;&<|O!6z2C*Wq6&UM6vK zzsGvysg8Vtic9+$&Eb5YKVEFWZ?VPge$;GnyT5F*_(XQ&&lMK8+rNx|7_Z&VrCgEQ z?fG5Hj@@n@(8B}u?e;1C3Ax=4CtLb9O?fc5<*6A$Y^F(gf*G8^r=`(?m+x4~5;&y%g(c*S}$#*o+ zj$L2!T@2)QeKqm@O~~!~y4B)#eeEAer_-*l8+kxOJ9d3NZE?H4ru0kOvFqz>i`(@z zHaD$r*VpC&X>QloPK(?1yw4;>k^?ztP|a#w$8R>D3NFnwYN3J!|@GHA{piDx}u#JZe6q~5sR#jCPQ8E zwzc78G}IhUh9P0i(e+NDttn=*=yfNe@lYh(-rf|BtPZt?JDc01q4@fi_SiZHgLOvN zIfc#9rtVdta8pw}y4HzDBWq129W0Lo#Gh>Ih{n2;D(mrRM{I30v@X#WYKg}>LQUN* zEzx+i8A>dXB;(;oB-#bRBC(E+XlIh_tpa;3v91IOUF~5gWFVZ;SXZ(w)|uc^G|7sG zJ6A;$PFpABBuTNca$9FI7HVk*ZKDVkfRz-D$7Atq^?)%OPt15)%B(G@zNT0lOWWvT z8N{J-!xVX_tF3cYs4E61EEI~cGt$wOk>a+_mKfzf(b}DCj;-r-LTIcr7HW@0!k9w` zN+8-vMXQGC#t=(x!M5C*n!p>MSS~$OY$yD;r zR@PVqsb;6zO}KMIQ>=LdG{!`_%}`#FiMCXkVEwd5J69!JoeYKcdqls9rLpH+0QL3V3c)g6vEQ(Z-1Oj#9$F45lJ(rj8i_Hg6G!Urc9 z3L8MhMUrl?s$G*MQZyZqGQtVxa*0J8=oN(#rx5Be8E%5#4ITI^8KJ6QPopL=l-bXj z*jzZ{U}xg`!s&E|6M#7c=nN+S2jO`-oYxnUbH;4apfj96V-^88Hy6@r#!Lcqh7)KU zNPy080x*LBo#6yvIstQrESmNUd754bthw;OBGQ60q?XS16lf;8|K<51STFEWCBs5N zJxthe+|Kj8cp54a?0W-1rqojF(zK>=@iHfc?*j0z!he#|%pQI_gx5AvbNgdPKgbEj zKbv4adD-ENFy0P+*DqWAMI7$m#gESsWQ+gaohAZVuVVbTG}H0F)JOaUIVOB7r^86S z<9fc2_=8WF5Ob{j;}T8B|2yzU6<{!6egSxBo2Xm-vTcrv@8E!# zf9wl7|M)%LZ1KO$*F#ul_Mzj-0iYS`S3F}vNjYQu`S4%IkIzYEi~n7Yf4ec0I_tQ~ z`-p!f$6tWP;lTJYEjs?vKI;EsR@{w&twYCuL?8XP=UEfTj(;yeI{p*-$bU0;+<%w< zb$#T2>vJal^_+IhKkmWk_@9JiSU#uge5=M?7yrd;;Zz2gZ-D zpwaPv#PRF#OTOc+ZF6;^Nji>&bGG!$cPz?SPkyw$D0pawy1^Gsh$8bt=^u}rWog$3 zfSfJBFKT|DIX4sc_dxR}w4j)FY%tK-x1CQ$oN z!r#W@mx(QXmiXm;fZ`+R7I|AA1Oi{P^H4~zEjrqm&W0G|Gw}3%y6GPnGhG)l-b(E2M z>u!d?+2Ze6V5}BH`Qm}`V_VhnKg97%J4anSo?dN!2l4$;MoPyoX+EZp@W0sx;>_XjdCEibFBY$c@Y%|5M~#VTJ4cA+hx>C9 zUi$wQj$iD_Z^bRf_4@%r%&$&AKKGj~{;tKn=^yvp5G@D#2b5Aa>nwR5A=g8ySleI48 zophLzVm!fl6ljhMI%~E$P6MQAGhF9f=)AV_s~v9WmABk+H{z6sM2bczqgbi4)W#xy`S8ep$~mIG{axUCumB&(k*f7yduZ+n|Mtg|x3#F%W0B*ko%xFp6Xid3Aon2Mbp|2`3Q*%DEARqsU9NqQt&OhnyPBBc{i_uox~ z!~tb5PAOVbNg|c8MNkxH10$m-Qe#?CoYJ(6;(s@3>1MH5oRSzcwD>BKDpD~n7N;b} zD2lW)ttd`AX^VReCZ0i_efAjQbN9#_K5CCao+ZO!Ml1w4*k3&2r*lWTdmPgL(EgJ~ zRt`CGB&?HtPR?+HDu=-Ebk;_XXZnyqFs=B`-so|1MqD^|1nedidL-CkBQaRO=b(CU zPx|RM1ibtAN4t)bJJ50Ws2qaA91#0^Jg7NfJZK&S^1ys>7-NnDZ{v6OIHG@l;CrI8 zfBz%EnU{{Oa)^m<5Twg7=^DH*#W^GuC(QUmQ*rt*&SAqnlp65K-xrE+_?}pXdx7Xh z2j7%3fZW+mFyWb_0De3%bbIzW3&N%r&z^mL3PqG&X`G8H9i%uDebS0EFU|-@zFrpt z^WpQ<=9~&CJ0lDGc@{P2d(WG<#=E`Xd8 zhurvrqnx=xawpJTI@;-94UPdTQE~>ZfFC^EbLi46;H5$i2GUACr~knxq9FXWql|hz~*c;kD#Oo8BXL zJN>@|ha^+#$lYv`8BF^It@QQKZkXduP{J?~0d$!X^DPSCb&V6mt0PKQyYCQ+5=+c? zm`PR-c=`@cmzeK}$*E-dj%>9`FK8n3wNqqh+C+wN&`||vZceLEC*7P@Wj3c(`Ov5> zUu>j<@=^eVS+*c|&r>9(Cbm!-ut5a&2h{+TSFi}2gR$~R$!n^MN+qpCUcTegc}RPu zGO|9MkrOjBa$;siP8^NBbCl_ylsswMv$L?$ENn#<){=$c4wD=lhskBmP3fYTj!Ho+ z0BV;xQPWmUY5aurs5D5=G~E@Z>6%hGCtWIO72i_Rj0Q@Z^cMy%gNR^wbey*WkD6yM zKLiqZ%tyPE4sJUKp7I5Uy&8Djcz=lmu5yM_9-zivkq>jk|K+2mqNcuJ@_q%8cKB;z0sK)q0e>Ygm_DPhsBn70 za4a6rFL zTO!h!ae)U08_{56rol$bV51mpZ0c@nr&!WvLy(TyGpDYd6Lvb9qRq*6xVxe?Je_Ve zagwoQxZUaQOth`)j5Zg*ADEqPI2|}6l!U*-m(7A;8lE6d{DFjKghb^wxF-efOM&}cy4#bE^Z%q*(vSzkhv&FD$8*A1 z&!_?8XhemDBOL|&i?XcOalzzN4H#2!k@x5RD}(g62w4Z??B`Sr7?bz&oGW3pqkZ~j zWN_ewVuwR97bYvOgLh_nJf3g&7>GYO>LK{gM~wf`pku}eX;!JxVH(_P)zzJx*47zm z?{1DZvO-^`W34cx6rY)<<SU96_R^jYvi4BQ(ES8+sorsI6Y2k1@(h6e` z+*H!Nekz7+Y-&p;`WV^ziqRVI{>2Ciuc5NH$FP902^O~Ega-F>U=vM%1odH>qwz5< z)VL*UjV5c2oV7-r5E@~SZlw95(aaN#QeKHEI@O}7}o*egy*FHEa2|r@#W+W z@p;_bU@|8NZNc`O>GAE6`+zTJk#E3!JdgUq=lU1;PxZTH8-3&a?qkjZ0S}&hzi*7+ zJ(7XX@w>(M`#gU4UFZIs0m|-Q9FK3$+|ztH{sq3h{lO#9h2&!)Gf?kHcCqoZr7{cUzf6_*@b+#v!zAu4*xif_La?Z}l!({b&Y=m0!I-mZi z6<(utfmu-4e$Nxfzfxu%j}e#No%XwrI9z|J<4)oO6oq%95~pQ(hTqM^>2e~2Ur&5c z218*haau)X_`OLS8lyU1CQj`p!{;gD{0A1x=ON;>?zgCMy6M$-hM#NNWd=jRg%x(T z!|iovg3)s6E{EPBT&H(=qLyo}vw8(^o!;eU^m~_^;l1k@V;pRylg46TIBpNN@_Q~C zfCI1D23zG*Kor)WP@aRWa;RcH1oUMtVMISGK|dQm1$?vdC;Q-`KJ35Qhdw?Noz4D= zKJ+i@gYVx*ykGaBU)4vvxWAAsJ-7A2%ln8o2>N(ndE2!wEebCgY+hv4ol(HYu^WHp zSiFGU_#^W;>hEW9+0jBi#o{uzBcEvTE_Nf|$Ks-ce7wc&bnb6)*>XdD+zyiC0CpfB zBM^RPTAV)Z*@(z6WIbe zO4*TnNyCauI(ig8lI1fMZ({jU#gAk8D#cG?`F6#B#qxcMOF2BQxRk>Sic2~CLGjyI z{zh?mcFM!!gOuk_Sg%0wr#tJ$CFUn8F74)g z#RqeKE?0aV^J^8Cb|CjqOTL;||52si%=|Zsw=sW1@h;}_4u7$K6!UMCzRVXszJwEf z8E5homvNP=joOL59tg4rwjbmLEX!I8xwz3w)+EBuW&HyFMQ)EX(qDzkJS*)Kx!sSX zoeE#ic1QCsKAUQ%U+f^a(<$*Fx6>o-6uBKQUYFs4@!IzHwzzHoIE&l%&Hg~TKN_oW zR!<1Y?x^f=Wc~Ki=)OlaTG%I8{k{FP@52?dJ3Teuiaux-4`1Qa@z|PiE0m zWAvmLJsn0*gwa!A^!OJ&?FF0c@YohT=QW+5@PdHVjJHPW9T(oBn=SrVIfBg`5aY+GLdXAOANl_)hm&!Y#a?mY`Z`3!)A+rJI8P5A9po%{4a9;RWozskH%6@62F8O z8NWq^Y0$?mh7YU6Y27%4S1M$xm^T1+uwfJjz<-Hf(p3OV+XUpC$sJ;Z@>HU8IRMQt z{8hYlJC@fM$nem*TL5HBKiuR?$5u`-rXS~7o&FR0i2v7^SvYFVPwK4WU)M+cTPK(x zJ2)i9kMp*U|7?z5`YEeB0|y${7Bx6Y{PK&}A?ViOugNpvmztl{S;EQh4d4)WN(mfa zad?}dTk95b`_t`L!uKcxl7GSb_0j%TPBa=TSrN+*_nRcVw7)SNKdYsF*7G81k3Pyz z6i4(C|Bfv2W1KqvOCdb`>ve3xi!V3|xN%~+;gF!i!!y`Z&5H!+7Wjgqg7jhB<}CNX z&pdec%sHg;-@gaG=+~GMa}?80G3+^eobQkS^-bR`^W5}BO%B~({-c}w0;CV_hcEv6 zbJue-{%$*U+*iTo;`=r^D-Zet?jt`rC+9xcTN~PMMDf?%Hy3{m?_|NpMeYoGf-^R? zIQN~EQ+yx1cV#;K9igFLctm|0=x=g%90d8_JRV*>4u7#4x^ds)uiu6+!g}C-cSzR7 ztvPe=+x5ebGc|uJ;#`y{d*NrcJ^{8NO&I2p zoSwR%ulVbC;GX_>;lJZK@|8_3#rO5|Y^*!dGx^vs+($nd;%@cl+;>X6_-l~wT={zO z*OHbBzccfcy^6o~_<=)S-!647d}o5W*M0}YwGsU|Uj<-iCg%f|4nwnX*v}t|_W#ts z_`bK{{&1(CL{R=64Ikb+73BqrrL1xpg} zMu-CR>429c8?2lB z8z7H(c${W&%A1AFeaj-XrxnGSWMmXYO8xP`X&%jk$a4OLNK9#e zw(=_fVo-6vk&Z!}?^|k8(D>I#JTRznrO%RXNi>wSM7}d^UDkb)7|;@<>00bnMd~(o ze6dxI7w#qJJI!H`aVNtq-8cK*5e1=0R4F&v|s5@%ut5_D&~J;+??AO3FmCM9G@~^!v~N81en^(B$Pm5`T>Axv*>Ywq9Kr% z!yr@Bhk=Z_b6($1mgzxitGv2Sw{CLb=#V?_eo%(L?c?h+Vq0rK7A?nz$@k_I|94U@%6zBze&iQm6PUjJHHh)jui`=8=Jetm9 z=scFrR8IfPx}mW9 z(0N}vPonc=I`2nk^Orh&-T>|>rSnueBMi{p={$qZ2hw>aoy}tr<}Y6d z5t&2hgXw$-oe!n+VRSZs%fh!?z_(85Y`Rkkx#!Zkl+I;zE~oQ6I=>GORis7`_jS{J zHk!6+28>NcFx|npjrkrkM)a6rp=To5>oMJ|$KSTtL^`-p7-0Sqo!6>+Woa8wzPC_danfgfY%1(I9PKq;5C#4)S== zQ_-_L?eI5|wALoicNy~89yI0bS;(6~7;T=X)-y938nnXF8ZB>`I1Mw?o6noS2&Cb4aH9Dx=%IRng;*3&{;}v8gA-1DcX0ZyZChZ7$DgUCXw|1;A3FK9RZFN}pS)S>?$!8HFWFYW$j zMB4pb0l7O+{|9)49*#57?RbhvxDkaM&m0o&LBZ=OCgC|0{GJLD-bNwlF%NftjzX?y zIr+FyWBvi2l}>&Wq;CurRtL85{5YIPorq32{PQR;oBR(_dZ;uWHhIA|>wm=Lh4@aB zmo>L$l652wbL8F^NO* zwo&^6B>A%Z{lS^;$U|#D9NK^b;jDWC z>3$8^f0Cu!1G*oWXq}uz`Td}~j)KRh>F^g**b)A-DJ+%cxh5>R&o}i(-E%Xvop}&$ z+|XrkHq!#;*2!-Kc{mPt`7Pwn;~%)KV#Ffjo^fub&($EZ&kf)lpMPu0A7gUzAB6L` zp=i~P^~DS=Ht?5BRVV)|)WW<_s-65GjMrm^z{$v?Qnx0q-5X29H+35N;Y8--V@sbv z^l}e2Li^VWJu+7r&6q28@V zI=TR);ofbQG{U>xNFSo+NbkKy`U0iBygQ79HRc)b-DRXHkSovL-rbhp1n;Xx!XD(A z=zYsb!y((AeZ21*X&Hvw*ZYZ))?+#k@_uC`EIrSB@A@2w*DMh{3%w^;QkAzSLpsfp zs=b>msn&b0B`x-DHc}JV_0)MUwxoLRrIys-y~2`~c()pfQnu84oh2>vZnLE2-dl5M z6-6 z84mZ)#;`A#{|D5gp@{VUi6QVJW+*1w$;Wd(*4ikXtndh&GI<2Z`yGabYYHdNEi#3J zrRc(@85KB&a%T(+n#VVSfyp%z%wvLec}AMSZ8o+$*pQ)MF%-u0;6}pUJh+iCfd@Al zVW#llhEug?f7etrsU6@Jku~a!Q(d!2C!c9?wCENWkgXv(T+2;g2|!)wpJn zPJMK-yOMmc7Cd!sGYQmN8r)VAuyj02++)+iQg^kJe<)gL?Fqro2o3gIP;+G1zW;mb5M~(~{N)<`{`=9v3*w@;f0= zY>nn81z>nDv%tv!#@e60KW~k0`S@3Y5-mvTm!(h!8QOnHn=6=^^UHvD*JZO z7{%ZamS*vkfY0~lFhnh(vK_XQRhiH4Mi0#!z$nR7>Ak&$o%#q&s@+L9g()L7DE zfm%!28CYydj|b{3>4`wSB|RBvu%umqC6@G5V5yNPEl&rQS$?|%%Pr}pz=|C6L{+QD zv#%MxqBwj_3YbBDIXpt=fzQU!!1e;LkZ z`Tq@EZ-jhi{->TB_7#vCg=zAcX#r<4PsC@Y1rnNlW?I0B&lB|(Q{r4C=2k;q`DufmdIzFJG_@-4TdHNKS|Cw~P@36$r}{XHM& zn4IBE_DPPF=TCD?o{z+AewJhMT!zBuIVR7wD14POnv!fT6mq^YwQ(zY{g~sp3vfyESQGDf@v5mn1;bZ0Toy=w&jJ~8K@4ceA~!p3KWTFk?&R#Xk@AO zZMTKnZQ%}E_?0c(X$yDR!rjhf-1nu7^;nrKHkq8`+288%Q|%sKX!rPOc8{NK_xJ<3 z$6t$CndzHIkw1mPEY2~l)@J(-ARihf4&t$Za(u9FW;(%#_-2tnBk-XO`gYd zn`wJAdi~OG>Vo>^cE1@)$nfp{VhT>f&mI1XwD2o`EeX^~@ANMxVNL-g^Dh5N63D>a z{#Fu7(dQn2I|(%?+~@Bifl~H>|NFG?p#O)o@N55%)a1+*0z1}e>0!Uek{*E#?6lvb ze%F#7gZ=EZ-%h{JlfGzu0{r&$THr|ld)QzXfPpr63cvsxJPn|~4W0pzYlCM2^s~Wp z0D?An9so?B>4g0T0Q^gX-5|lA7t-Jb0C07j1}_3|ZSWERxO*h6@iG994Soy2vB4_< z#s#e)zXLE9ZWS0sTRzZw`V~&b+Mq7rb<*zhocxtgv!;dRcuq4{M6}m&244}8aHiWs zl|j2Ta8s?R8d~^Y;_^g83;&$R4CJE2XD3tHew0Ap>i3&0q@ilLtR zwA;^2+ax{X=H^&qWseyvYdtHtiQt3)PrXsEr;+|BzG$W^+oSoSnFTW;uuwo@SeR@J zMYdpuG*WA{FPaIX6f?B%G3)mljUV zHK`(>({oL#uuZv}a!sm8I5*d%iiGoXO{%cK-3xPz$r=e4<(83v&BEQ1TQL=W9TF~u zL1kQ3TD}bAv6g%}$YZJ~Fc!RfMJ`V2jzhwgxz!|4BCpD=B>}Ha-J5e^FKINmhL496 z6+?j=F~vY>ZRTPiA!-*xi(L$>az{9mv7yu0kmKZcq0MfwImi9L%sP~U4|&#k9lYJY z`AyN{4B~$3H$_XrKm4X>DgQtEP0?Z;u0LRkmehiQA}9Y%Fg58TIN{-5<1@QKI9?3B zEeB2*%$zWclaF#fdgqVa2NF6KPL%l(?gdstH*-R3z}vl$6G~b5i68zN&;WSSN;u)+ zp5-@@(r!4807EHy{JxHkelmJXNnH-^0<_@YchYTQ>?eZ?z3v5rsG^<&=x!clnj>x9 zT?mW)^k&<`In%I+CZnDh{TSRuXf*$8aG9)mo;RKD3m~4|_BQ+r-084XJTJPCwP`SM z44(-n3VOHOG?0?A5QrOrKPgPc1uI2%v@n+|#iwPs39__G#!%j^lgK zMPUAfKrZ}i68pVl{L%{amnPa=&A$%}QoZi*xQCghf_m=ZK~o@99dm=m2M2n$GH4nR z7P7l2Xc`f2-@COz(}*Zceb6)_5|#%||0E$4H2sr=)?jhE?{ow!(n2z5Iuft0#B+!ugSa4U`=keff5-2&lg0H59=YwyMfc5LX6nrZ!{5JSL3D~&Y-vvJ* zfl}~J@GGcIXp>mMe}R{rkwm5V_h8USl%s#Z9V6sN($~Qemh@e)z>;$MO|~R&zak^i zc6h&jbBshe&g)lfX%6mJVI<1guzt0c=7fF?mQ>hpxurR?U!##IcL()bX-P-+YckT~ zSoZV!H5=&#l$Q1Dfy?Y2;2e&5nv9pV)bj$?hzom*4`TVi@vQlA8e!nUqnUq=ls+H8 zT=e92?f03>?a*?^ayq1O{XcoL;(zw`Lh}qyqy0EfAFl=c-@NcN<4vMf%j)auL)A5* zlG29CrRAZzlIr>8j-hi`G?dqe$``XZud=Sbf!*~DC3Ovz)$>^_uP#dqr8SFctI8Y7 z%S3lYbwkN=hdv&Qk6kC>6S5Tz4Yi@A<#qLyHPxZ%p&|{YXM!0{Yckmt;+N4HztWoO z>T*al7$~i(sW0zE7nYaThDxd+S0*$(_R$G%t%bMQhUk@?OX@0X>qC`gRppLx)|Z!8 zhw7_J>MMGIP+3hwR!AP*@wQM`IN2(>19MPtVi}xdxwgEnw7idHl`S?H9pM`>NCqP(iA2CJ)b-ilCN`Qjzz&=Atz^>s^G$AYEh zb+!(Q5KT$Ll6p&NVfl(s`SQ{V3y~tkVIi_#R#Tly9VDr~yq?-lLuKj0@{EWos0F7} zr!!i*4BAU|gUM7X7JznwmxX#I&1i&{*3DaChsum@S*W^vc|)kSuBM^J($Z zWwgG|PM4H^N;7-ugLm)J2WV#oM4cJdz`B%FiY2?8F-cabfY{5B(a0zjQ0rX?Xey(q z0AwkZ?A0pC&1^qNGfgf_n}iVzT2@1-bS^ZNIw-slj28_=YO3oS>Xww!P$oL1Rh7^+ z|Fw>?QwE*j-Z_!xY6XvXRu)Sw9cX*CFdSme%B!)D z;4m!tq!iVx$bv#8)hj~F>MO}O59Sg|ydcLVbF0j-VHvG0!9EzOTMq5Mytbqc#^T<- z@HJ!bt%sQ+yJuMqR8*!XRBl;)Mae>#mC9=&+YQU@p!2Gh)K`RR&D5j(DDP$EWue-V z6;(AQWso*IXlY3`cG2Znl2Y$Hm)L64D~_^79{55q;oxXm4n>iX(aQSlT+)!4e4&{s ztEr_4t*m@r$&#v!7Ro;LFxXjz%M{u+%+8B!pX!oDkbf%_zP>uTJ_#SR#~CmJZ~dk3 z(8Gg~3H;7G8ZCv^H5V!~q$@h*(W|^dW;V(Q%}Vnss~Vu+L9M6lWk$n_{~|VM$fmtm zDL@v&1w^K?y7JO;oa-}^!Z1`@W7aC^EOOjgLuLB)9XPWYq>{)3MIXMsQ%;Maxiw{` zTc*sUFbqqyqLRLxsR6}Y{;xIqNC?+Yb$P?Gn!1HJ_StCkysl@>(lpd)n%1g@1>y)nPo#_!7M)ML?*=&zHvZY$T zq_(!Ej#ty^=1VIKEIwQvW=5CtvIqNAbbfnld| zDP$5?ESaWYoU1K|aS00!7tLi*<9PX?N`vM;9*0#cE1h4NsSO|mL*1gvYP8qeuf72m zKAusmhWSWo7len#|P9hgH#1 zydcY{c}ipLBBg7UotorR9ZOoGj3csK{MX}1UCA<8oTMxv%hDzh_c4^CS4kO6_L+G} zVOSUQS|uYASg~dINJZ0!Kcy~JyR*g z-X#@Z($G)>mx~!SwggI=KA(|wO~ci|3n3mJLQ7#^09Qw5ijlz=uXWILW|;bgm9>Ik zATVFd*j?VuFGvfv*az_aL9Rn9G6nuV8D*5leTR9U-p_P_A1!37&# zpqVD0nQ9v2XcDWgfwj3A7EOQ6RHUN7k#b4Hyg6B-!+eyNmYG7&3w$dyY zGLyMr3GA~#YlTg=WuY1v-?D1WlSMdQ@0Bdek}hgD(t|RipbTXXWm+a&y}@N+2rjE& zv!{1kFQt`%DQT*jQn+ftD+hjON+{Na8)ylq3TAy+`qS^Sk~+vP0BC8IrC=7EW)uKN zS^3;0uuTXqx-v8&WR(OIR(9lT`XD*0pfy&PLXChob#8Q&)+~WB1C!DoTNP@Lu8p=Q zoDj?O=_LB#672h|ogRYMK1SoPTNvtyCR=08j%*x8JDa;=_?e}a?#>9lwbp3na`QMoqgtk@mJ|XA;I1`e;!++7gXNJ0q}Zi(QqigxkA1L-2B)WGn&S zj{$e2$?1fvOT$otB5!Ni5W;u!IPeLWFnq-b_ivHOIBjxT-vIlLA#7)fXo9XylWiSQ z`0kEF^?|ho*Qm{*a4VdR(|l?R>Y~%>3dh485J6Y6)tKXjJ~XzHMXA!XAyqqkVF^7k zM;LRwJ-i_rcjB}=4RJ(b_*pV!s0Bk=OOBG^EnO-~3ALrsB>NY%_;Dn;`&x z4J?L@%jlws8jOjQ7D+Z8$tM0fT~Uai!f+vQ>UjAg#hEI)_&O606i+lB@9s)Qo8ePg z9btGAY3HiYx_BF;fs30zAq8sCOYNqC7G0BS&);O5;DvUyqI-0d;kmcB3%K6 zNP84MZiX(b8siUriyU3xfHW{nhFT0>6-_ze-AEy9QGg_pj>GG&b_ z+`_RlVQb_u?gU)d)MvzvDUsd}8zQkts4LnLO2$IXQ1kdID5pJ~NQStk zLXp;JWOXP(HHRMrLq8ahy0FN*;3I9B3f)~!OROsa!wcjSN&&|zwAs>Z{{Db&_%Kuw zV#K#cIbG0~sLA&pha@PdV7zFrJ-jNB{wy6S#JWO+K?S-UrP@S_9vnY8K_Su}OF+d& zqpL%a?zj~%_BV+x)`HPd72^l+@Y`jkWwo@yN6}V^@dONG&C&H)zm1230_kmds*aV)x6OAFL~dSEt@VK%4F z2Bl8aG8qI%2c;(r!xMfHkSuVX2 z+mdZztA9aHgAd&`g%i=)Gr>314MC_i!a&j-!eI~Idxn`<7jEMWcR{6ez?;oN5I=O1 z1mv-~8RAR8fCw3ekBKFnSiEf&d_|5%=}4^IX=@2b;6rp~bf=NPgtTnYkP1^GwCXlf zvRGr7J^ZD1XWA0|F%M&g3c`+08;eONylNGE2eBDCG=2`z_=nbp+uJ|`hDPIxB;)wz zHJD<^O2TPwgT@-)09jA8!EBL0RaC-eX#Q#lqddOt&FO$yqz#0mS&x7T`b%Csx~4k{ zeGvu`oIt>O=3n|?u&4D4=yQv(h#57pT`3)lunsLZsA_RqgRu`9Ff<3KUZ)!xHKYOh z=6ZUSGK>ca2YMDvosdYX`}VdD_-G*ijSp%JG_W>d{D#H=Ie>3YVm@ik!70SVMzx=c zYFz>o+Kq+FzaeTV4rHizx4>}=#ygyrafqVf3&VAVBdcNLq6rK|0_kyb78(cGpy%WwwOUx9d;WCwB^p4-*RI zfhCNC6pl@%t)xD0nrbd=JvD)uCP?iZhUK+1Oi+7DPI&|JJToSax_fg3K-L|`H70S3Y#NR}B6Zs>KNAcUSP&e4U z(E^*K)KF`M*$YPp8rhALW)X6lp~GLcKbx zqtPy?-nH=ISH2pNMIc-SCg5TOhCQe+%oI(fv`B%b1H&d1V+c4+;p=c@LMg;QloTvz z=o4LCP#kclqBwZ-w-%sn$kmi+$Vw!%;Euy9N#hlvG;iAbyY z5;Cj~a4fV-c}D4N8DAFMW3#bH$l%cfWe+xZM! z$#-H~>qH84q#1j5;mhwXyCvBo){1FlXZGjxvX30IfOP zj@K6(LbwQw;2a)wCJcc3iNI>cG}v`*u+nIXhQg-LI?XW{ zjZHm59(Y880tv4Tx3!B*BT!QeGRG+~%VgT)pmA6*6i*w(h6_ciPG|;j?M>YiOO5tI zqG9MAEQL&Gao};dIad&arqREy}q6_w_pgXqFdYCq0VBGm3{%AjR0& zV7#JD3lPofiB{E8e5nBtrXOp};R%$Mf06-Qoth5bmh1?3aYLslV0VS?Gzc}d;Gk`W zXVXsU;ta2EXh^ZIb7YAsNx`OKv`n6{-NAJtPL8-fZSL;qfWmI;g7yKIk=R>F4{dkF za6(F551R0Nv6Y0$54yr?7-VrD2}=enCvot>xii^{@e*#2#a6?0y&0k@xjb5PtEN%9 z+uUSG-d*k8IJuJ>?HU=!aM+K5UV*zU#xPeX z!=wufbI86~BWcf6)}ec=33xgb7hP{c_Ey8VV0Q{gB#nS*eiin&FpOzku$R#c+s?2_ zggd6VGQvFoYPVS2*!(d4?1tJ*niaCn2DV`?Gt(wv{bkx$%CKqgOjDC7cLR(hRp~TA zVT+`M;qFyx@ncuJbUkdrFvZZI%;u=B+wAV*$i^BB;33>pZfk+&0mV>KUp+m;vle!| zz+)k7Vw0cU=df_7LNTqdkfKd;8tJfD`AzHCNTFdR64+AB;u1HpX}Jd8=1u_8o~u@G}7FPdu40kas!)th}t`sG>qT4dABNUmX`Yo zxI*sT5@EImn|x^k8HJW$$!2fWiacwEEq~g)Pi4pQumfiEw@bkaW)}u74Cn&Dx;nHO z)k<3z_fOb=OS$o4g_b6mL7c$N!d}Kz^Fn@FRl#3CXe+qOfgv##cRC&C|H(c1=63%) zzW?8IT%F@NVXSA=fN@R%FnaeT{Nl?@orVEpiZ05z*t^AlMeygjSHc4x&Jr)a0q{xi z^>{qr?lBO5@CgI>@A;4J_J=$Br$HNDJ*_ny?}&A7fGu8J9881F4E!TRTT^1jv>8P+ z;NSG3X&|Pq@)IaclW%OTi^JL^8lTqI8ENlsj>0cY(70#vpP4s9#(!v}k2E&o&Nwvv zzO2Wfn}rh1tEY9s474^n?ZCnrg|iB0PlHYKcr2Ej)}2UaHyn;fT4&Fk3NvW;`l%SQ zv8fHl-9B>vKQIj@8nJ#FGwa8JVV{ODh|;Q)!d7e%G-kkt7)a1yvMZ#%)B2EYe)5t~B*xtUjqY>h3jI_gAy>a@C!lJ_Ijoc<0 zVbu!@3a|jr-#A{c(+}G^9qywZk1vp$GkJv1?_c2FbJ7CeV88n`yyRejJ7A;F@w+zz z^1H8iHu?tn7y1UAhI+oC{?kBjfiK^`$nRbQ8spqQdhYiH7WllNw8s~|02sRpc#hxw z$n%+Rz~{cP?miH%ih>0|X`s8q0n1<{*I$hhZ98#+&vjqTS>PMK(dVMq!~Xl-Yk^Mm zyKe#>P(|uvA+QU<2KwCr3w*=CH5Qaf3mg#f{XWP2;si{JyCo-hE870(#ErhGe)l5x zGv91bJ#2xmAF3|&1#8Hb4->Qq1N-(tibjh3i+u+J$Xx*P!aBeEBHM(t1>KSNtAOtF z;0>?xc*BJ#_jIGdBqlgm;T!GW=nH~9pMQ}Xx!>=;cEbHRUKmBB3i|jh1O>12>5tm` zRtgA>LLHsNp^2!YjW||(=3ySIg6FQ(5h8tjwlVWKia5VJ)bd(F97oE`qn0?l6H6Tn ziOXo5_S``nx|>-5eqYPnAD{2Jan{h0jT6doq+ zgC`(BHvJ3w-~;>Mm-J!(+dlX`eek#X;Q#1@9|wG}RWCGu0-Mr@K0NP92Y$q9B)joP z=HEGrx3kU=;PAk%c?k^sb}=8Ocn@>YXVE!L=?g!X9izYwyzeJ?;ei|;H%%R7%q9KH*{6cJ zq+fW0WydZDd8|_G9Kv>1Dm%j4`>@kvas2k09P$MkOg}v*%O2Y-eLG+GT6~xof!|%s zC7nt3dzQK6SNN-z9XsB?GS}_%3+7nfcDpU+IaK16PwkX3mw1KC2XsXLY))sb(ibj| ztz!8|AHg6pvf($B?Qj0d2#g#auTLHDv@IRNm#{2#fn0RZOWJ_w-^lvXhH>JOxX^1F z`-^@n_~S9h{5ZmYVEG8ehq8W|;uDxJP<$HmTE&lGzEp8D-@y7_@uOKkqWGsQ!_^2K zl79TgAs*|@Pby#C%uiJO4CbdQ{!`}XEB-F?pDO+<=2t5I6!UG0mvVc$U2*)#93D9S z<01L-vi`3PPVr&PA5(k^^XC;mllkuyuV?-T#gAeBj^b;Wf2Q~)%)e568*^!2lCOK1 zdpY02pJkq__#c?(DgJln;}n;vZy&|wTao)KZoY&A>jA~hS4BXC7AiuP|Sw_y^286#s#FLh*rc5roGE#S569 ztoTgkrz>90{2axPVt%3G9n7U)N`6maex=gCg!#3K-_86c#h+pROT}MjewX5ZWB!2R zvebPK&$zhORH@v%IS;u+E_P4O+v zXDNOk^FtMXn|X=iUoxMs_z1qFTcr3w%w^n_d@W%PF9pp=f1G(p@e7zo6~B%7YQ>*o zF5|bv`#y90#xx$n_vCs!QSq_NPgVQ~=4UCsl=%gUw=>_O_(tYGQ~V0%S1W!8^BWa^ zmiZluKf#Ny2NVzVGx>i+@dD{mpmE()=Li=G$ax9${|2N0#RB;#E4#H^|cbVdmz$ zV`=_5^Mxv%`|+ZCvEoaZFH?L2^Z!!(Cgu^vcQS8N{B7nj#lKlnH;TW^{I`mK$^7?y54D-J!eiHM~6~Br(d>@4l z>0kFT|55Q5nfrLXBl>@3-e2(?-YgrW_z3316+e{u7{%8xpP=~Z%=c6L3g*)kzlZrO z#h+(>sNx?oFHzj(`C`7}6PPbj{7B~YiZ5ZlLh%jELyBL_JgWGe%-1NsH*dNer}*z# zU)IY~k9+c_!kJ3{Fy`kg-pc%9#e0}vuJ~2Vw<=B_*?<;!qvC&O{a+})2XD6BrTBi# zA5^@A`D2P7%lv7@FJS(H;1L@ducXQv4O>@H*}cJKr*&q4;gwt`1QgzBxljvEoNCpQreI=2eQ< zF|SknXy(fmk1{_-@h;}giXYE>wc@8Tk1KvY^9_n$&b&wQYng9iuJ_+AQTk_0HRX1- z#d%5~kLxXt^?nWOZ?`z=|IC zINCXl(=*26sDB6RkGDALpT+u9Espw^^ZIzY#Zmu#-t?WzTt%~np z-mUmf<~@pk!Td7CM{~YzQ2a3FI}~5e{3XS^nEzSv)0ls*_^r$b@^z$?!-LG_I#~E& zT%OZdU*@9+xgX6{{Bh>>ia*8tD8-*=-lh2K{KtXyioeVHrz!qd=9?A&lKCx)Kh5^< zQ2ZX|_bdJl+j&Cq0j&R`;=`E#QSk}PKUBPk`9BmlUp|EE8NNQ2@;6_bguhuRZoUf& ze*;o{Iosb)@d)$Tigz+ERs1C8wTfTNe4XM!<|ircVSa|SZF#kdEWgKrV?*~Zz-oX0#ir>wA zZ^a*CUa0u%%nwogA&z&R;xbOwDgIZsbByBOFkh{BE|>rDiVxs;H!ALBezxLM*v=)2 z&txw9F;Z?fGrw2qU(ftu#jj-kq~ZrNe@Ss^4}VwuLe~FM@r}%XP`rY9f8H;V^e<*U zLh+-S@1uBv`Fh2p%r8~^Tjp0O{xS0#75^pkUnwr-@Vw&hu>Nlqf0_9o6~Bl1M~d%Y z{*~fSGhe{_I#O=mar;@U_@~TQC@$knRPk}FzeaHxe@;|f%Hb@t{(<7ZVE(1zGH&GYewCE}6xJ_LypnlR@#C2v zulVK6&rtkL=I1H?H1jQr?__?1;(POWb(`XYnct;&f98)UF6H*3;!)OrP4T77|D^bA z=6_RsA@d&;Ka4rtIZKC>|K-ewDSi&~F^X?szMtZ!FrTIP8O%rEA{!2g_ZptZ$0`0k z^I3|2!MsXw^JQhni7Q?*)x>v#;$!*7inA0yg!v_kn=fBG&b5j+vi^3(yZQR-*NUIY z{AtC{W&S(Gr;Io0e^2rKrWpRY;xn0h_B8%d&POueQ}JV%k5Rmv`TmOE!u(*xpJhH@ z@tS>1I+iH@57v(;?%m($uTgw7^OF@nl=*pzS2O>a;!By|r1-JS?@_#y`QwVmnZKm? z3C#bb_-5uGD=zcG_ljS``u+K$TI%s`<|7qcJIhcjEtbdx~2QuHH_*~{UD87Wb?C(lBv@m~M=^w}ZCB@HR{wKwM#{6T&w=@4< z@rRiA$4vn^Bt0)PAF239%qJ=SJ@Z+L58?5uRPjTYFID_N9)DIT9^vt%OYt!4pQ!jh zn4hiqcg%mP_;|K|o#KVeZ&!RK^M@2ahWW>ef57p6r}!V4`*{CY%D;vAV8vy89;f&Q z);~b;vzQ;O_#MpWDSkKedc}XsJgRsb^EHZJ$9#k0=P^G`@yD5OR{TNcPb)rz%lSpc zea!v5pDpFNFY}R#AIf}h#SdaWO>rr=!xdk^`n8G==6PX-;uo-fi{igzo>2S=zCp4_ z@gkm&&QpBdex^TPuJ|VAH!5yEXX7|`D!!TZA5r`|=FcmBH}l^s{wVYJ6@P~Lmx{m6 zJcsx7r5@j9zNg}!Gas$E%jLhH;sNG|DZY)%zf5uIkF|+F3)Dg<@#=o;&Ok&Ns7P7^?Q!uzhi!>;-50VUhyfM zo?j_`AoE8QKZ5yh6fa@^2gPfcf26ovKYp$F64noJdZoT1%!etyhWP}=FJL}h@qFf$ zioe71eQj+6qojFKDe4rkIaMbDgC3_&S#3RV*aDzYnTt< zU#XXFmPabSk!2ZQMgMH(2P*vwSze*|Wju~GDK7I%OmUfCPEcItm$MX?`Q;MDWq!F< z@p+t{?TRm8{%ggnnLn-g(ae9Rc#QeGif>^4sp97{|55SB3(Wl3kNu_mWq!|Bd^^h% z6u+0{BE@At=WxYkKS#<#;{84AEmQiRu-vS8aGXj18pVe(KS}Yun4hEg{>(2`{4nO% zD_+k04#lgO?@+v!`SXe&!~6}!*D?Q4@e`PTrT7KR{roHCc>~MC6~C3`$%;S7^1+Hf z!}0>f|G@Imihsy*yW;<3`9#Ho+z!uId@tr#DPF{UyW)p3e?;+l%wJS|IrDcE?_&Oi z;%6}T@voHgB`oJFegn&s6u+D0!xi^%d|}0Z&(~S26?gdWiR%>~!u)i_li-UK|VB5VAB_U}@AS59R1Vx)H9TLe#78cit8#*o^s5ma5<0vZ5;J%^aI*jAE>p0^wxQ^?L z3!~uZ@IU9&Io;JK9i9I(@Ao|K_dVZz;P$OwoqMY4)L!@I)^AwPKNWwFxrg`}QDeiE2drk2a=I<+hF!QezAI1ED;>R)X&G{+$DC-G_D888Gk5asy z`E9zT%av z=S#)wng6KxD&|sO#m<*7AI{}k__J(>qZOC={#3=Koe3!}?R=@?PqF@$iVx*@pQX6y zxmfWhIsR8G{vPw272n7FZpHl^?k>fp9sZ-@2eJGIia*Ethw*a>vFD>KKT2^)*CfRy zU9%Lwll3fCd;{}q6u+0<@*GCulfvu#cPshN*}Y3~56i!-_&4nSQt?yxdE)nqU(H>(N%0SvAFueInagt<(SJ0*C$n0~&*%3sHYt7z^M^DaXT}>( zDSivfzofW~bKX&0#xtKOF5`rKipzUhK7MW>>DtcW_EY?6=ED^K6Z0{Of608B;!dVX z?`+MvUd!_wiI0p=mMVF9|EfuGd0*>P#igCOKyj(3n-rJv%ngdmc;+{XOZ)h+;%S`T z-HOZmSFb59?;X9TxV(4t55?tuupbnc_ra3+IfK}96vyXa#gAb=Lh<97XKBvu#&L?v z_-(G@b6L+K#TPNJRb1W!T%owU&vvHbC$pYkDBi(*v*PD6|Fz=s{?%QI%Q*ir#pS)k zKPoQoL%yl_l^pITir>flJH=mM?&Iezl8^sj-e2(~Zcj24m-n5zMa;J-ej@Wb6qoS{FDp7eSN!+TUU!>zNd6wp zxZo_G$i|%~GixK&oy)>i)z!FlMkao7-pPbLgJ@5mrbrWh8(QSyTD}=A_tEB9?c#!u znLC-dClza@&t@BdiZg%e6Wd|j0RTRLUsJz4T!&j2WHz^SL^9_TRg5K%*iM^v2=uvn z10wajB?EoP9lq2azl|PkDrg6?th1`E)=9iuC&wSY$d8}HjeRFK6H*9UI5?T@Ynt$P zWNqd&JWa*Z6g*AF(=hew4gKeRo`}oA86>aQApHX$yXj83P{=&XKD# zv!Z$VUtAmu<;9cW{`!Xvd>Z`iLpkYNkI0g2A-K*~ZgG0$f`2>U_owcc?|8~>`u-O1 z&x|KfDYW9Q}sjoe(&NKY_XYT+8+50RjArvUtcZeiu-#jgL8(bGYBK z9`Vz%y)9iLgTHgxpjAI}e@zef-_8krhuaI$t;0VVJQCS&N0Yf@-F)+l_CuB0ej#95 zC*E-(8?+T2)}dv~zz>-&%=`KNjoj{u3b|i?GkUoH;%alpLb;KDxP0q)B|5Op=U$LLym*66i{ikyM@)qM0nvnI1;Trevb zJIu8?Po6lDJSI<_FmWnfEloKqR5;u1ilyEKUz3cvFm!XIdtx-3P_{D^Bo934e(A^4 zl5gExoO0`rx$X@RxAg&6_WpNAI2+t)U8V1*bd{nTzAbaxwsVHw8t~xw)Z^4$c^_db?59y z{ir+eZuWlA`PIArE%@Xe^yTcY8b0emyx!v(HX6##fIXi6x4jG3q!0C+p1l#TF`n;1 zI2ccfBXY>aevpp!+s+B^I|}T8|7W@apWOgE6YMRXd+U#<72FCo+_1|N#%i$X$I~9W z^+%7h0rlDG?&5S~Jbpaw@ogxN*ZBM6X^-3re(c7g8$jqY;x zO}WA2OvJdsIET`K;SCEoD|TUAKxSAkXT`g4jcG)`kG)-`7)Jf{Wc*W|0rjN?(~|pi zm3Ez(y)jUce2wdBV|R?}`&QcD^9&&Spbor$Z}BXMU-teVPkWN$t>YVjxF(krOiKaX zsZ$H4Vf;sBq+Bxq^q+N|v*K)s6Xpf#3wriViC(*%dob(_u({Yr{Qe0#UQ2Q&ZaZ~Y zzhMQ=3g`pMv0T)90+Zz)`11)WU-td*sB!?>OKgBP$@VzqXea!A_rQTc+m3J+4D&fF z>LFgJGvG;|^4Jk3o}wFGPKZM$90J$oU) z5|-CgEEfYtgWe4o_77Hm2C}pFe+;j&Hw@38R{su^L(nnGt8*o(>mS2yxZ$@?pbq*e_Zff?eP+m#*()XPGdpxFmSG@=A8N`3-JF)Vf!DUY3vIpYp zF6=6mwgJOMc7q$*K+yT|3xjU0eHR$*N+yNixa?O1GCJ5I~8^#6Ww1w?DBV zMKf-87VKyV!fw1l*`FzecI&}SCV0aa*i0{MHXfv5GE7Q>IR1~+P7fa5o`U1=V14`e zAnnXDCP-V;FARrDOM}M+4`&(Nx;zNmw*_I!5aiu+g19M73hinxsFs=85eYVg3ARTX z>&BWbmC27c3rc~V|8UbJ6p5^Eg`LsNtx@k>&>d`O57xD{GzB~ABf+}P4%lKYGcyyz zs)ls03BsOpLD;LPW;xQRK5#&qXcwd-+bK+pc=M4RLEP9YxU8k6wx>jb;>Ji*(Ck}- zkq66|&BcRoff4%A7ztK&{gu#p!9fO%UCyRYE%hf4zQz#iR8^Z*}F zxZ(~OFuI%)xy**bh=V1UqyekmTl~_GkQyH zRF*IFE#fazcu0|4@*l}LUgsNE$rcfm-<}jfdrXJRSs<6Tq6Po4q5)Aw@@Fj0O;J=M zmpd5!XOWbF>qx%K1E2faB90kR?F-~GKZ;7^vNDQl>-qB97~-qwkG7ITKyu3EM53~M zp>H{zc^ChJVfiZh^FMHl=n`WoKMN=R~lu#X=0x2?*5tLEl z$d2kMku114iXvP2@}?*%k<0B-v_LL*MNx@drbW{mN#{%X;1kw&MtLzQRuTQ_DKTO_ zms1;+<%|D;Tk=_z*cRd{R@uy6fPOAu@fU4yixj}EF)ecWDjVTHD+i)GFREyPT*iW{ zk>Er(G^lc;{Az2BWDn8ecCxmJnyu`IOs=;vgT(#7mw{+@{;Y|{@GVoLS}NtTFp6p= z{Pi((Enn`7Aqif-90o;03f7C!82xN%d5#r|Hn($`BWk43A(QJ^$F!i5Ls=3H?Pt@U zAhbY&&;s2C@L$0i$HM*HzHp(E zaHRAGJq7*IXDT>Tk0AM8QR+k5dmw~x=1D^~Rq~CFdXF%%l!_Xtp_^GMK!{ta~Aai&(mEe0se-NAjkvVc8+=><& zHHj>E)F78+>1d96>XCy@#E*ugIb&i}5;QiJMkAP+X{-&2Heg&rbHgHFrqe?WR_3@S$^(4uedN28S&NIMYaQN-7oLsnMJzIt{aOg%v={$hW<^$^o)Ab-ao2^U+)AbNKn~$v@O4ok}kD~KvIv-8vF?1eF=S(_}qjMIW$J2QNosXgOL^@BR^JF?tp|ja? zWg1;ir}MFNo>Z62A-T-D@=b0UknmzYWCr zzO>l&_vx|gAA)p^--7f0dlU_=zQSwAl|_!eII(cMrjjEA9bQ*9Ii{c^$(2uzLUaUN zCFD2>9VxC#ax|f%musoxe-7f;8XJ;!l~hyovl7la_QCS$lVzwA>EidY>IddK%%OzxTN;x=zJ(JwKJMr{MKV*>sKj za(G|Kr)$#xS_xf0iTD1gGRFVBG(B7|oz|Gl9#{{D<95{l-fFro zz<7Sx#Usvue-F@rd{ER|K*mV-w#9UGICM?vTWM^tA9buwbNq+FMPL-1@bDJW&1v3K zVgWUooACpr-j;xKkiQtNQp@qSu-sOWhIa?O2e~M_u0vTEiId|lbo6%x$nhvT2D;4G zH1Qjp-a)Q($A2SSnOwy<_Q8|mzaP$h`TEItfj3YJ&FuK!hRf9V;6$T)s2_ii6LtLm z26rHtLIwX?V=8Ai zm>N#y`&TA!sl5K$D&MzQ<@?qk=~;>8?DkP~eI8!lVahk@{H-b9RCe#oCK)QDcjw3A zaIY!fB!7Q7aVonHRyzI_pfDBNDgSA3lEL@GW}4;VmZ9dA%EB(Y^v=aWK>+ z@;4ue4tURr`JZQ*7WN(q%o5q-NLRpnI?2{xbv)CO?E+cZOVTsn-wytPGv(fFx;Nc> z5#39syx81J*O!`X!&2{E4@C#R&Dpol<8Y=j&ISD$aHnE(=YNs>x&4D{%Zz9;mj5>1 zCl#7d_DO@w{{DmEZ0^L69RCsE?n|wz9qNoYDORu`UexhdqZFovV(s|b(0vA+j63j} z+gRMQQWmxyTu^g0A@uMEjXlS` z(PR~xrVpCHC?Zy@`r)#X=p}&UCf`uQ~bbr11TkeP9FKb=L z`&*5xc?7s-`d1qls&{4kyDV3Zf1Tx;gPgY#h3YLE@i2Z@7iZ~=gUHdqH>fDJAL(BB3Z0qAFgUjXQ9gNp&A z+29fY2if3K0DWw58Gzn4SP!6=4K@HswZY{8Qf#mhK(Y-s0SMUO3IKi^YypsDgRKC3 zHn;(R*9JEN@YrA*0JjZp_j|pE=3AM4CrBK^;7?c>?*%Z#2KNCNoNtQHAgt66`sW%K z_K&Vd{e{Lg6#aJj=NlLHyspRnMV9Lcf3f9y(qCe^p7JlSTu=K;E!Q*tGRyTlf4Sw_ z?XR$0zxOXRE{e;u{zaDGi~dT>^@@M7+o8V-uXnkQFwNIX*nA!7Hv_B(4gtr}>^K=3 zI@cI@+lCrExMQ)88a(`dzUxGvxr3_t5+4sau^leRqxBEmS#Ifv%%+>R;U46g+^btab1Y6 zCSRU$k-}zQzU6B1l~}G;U!~<*;alo*{7*vyDb4FsUH@=X@Ra5+-By~va+@?`58?XS zZPI)@HeTPjO`4xT$3FL=v5sNCd!NaTW6?GT+>VF*=Ag^tInlVv(Us&`l1hH$@_SA; zE@~VDo~4#6*;8v=)a0dj>W!-owergbDNqf}@~N3!{PqOSl1Wu zpM`RCGs#_zcU+GrG?L@Tvmc9C#%}>qE_sX@(%f0b3>ZK6cs2uyx+e?_7?}rL1*T|W zwz^;!ZZZ`+OfIp*^+i|Du zxXX6jZ9DF<9rxOf`KHnUqbpQyt6?G60VaUI75_PsAi% z1>my5YXBS@ybfSkz`Es60EWV&=m0L<;Nj2AKs!;Okz;EH_;|g0C^z384i2A} z$0Ibe8{pk)a++p~gSu$u_J-}Sz)~!XHmCw{m<_4{9BP9a0EgJ17Qm1lR_r3)dyMN+v}vRF0V_UD z-krupO=638m*r~pK4H05c%QOdZQf@rSG#w&anVGj!~3k|>hwNmTr@sg<$d1mWNe2r zNQK{J+Wc16U{lmLVtItO0;r@?lbOLqogBltsFPy^7j-Icqq(TlF!^ZDsF;E=o-A@u z){OO-rkNCs^JJ3`)=F2%W141KiJ0dxP4m+jonnt^nyE}I@GPZ!XdGPXsU-*5uH0kV zX=)%VJg1NkITm`BJO0g}3KlD1C>a<=tpLU+5Hu@;s34GG7I*1-c#@Ox65K&Xa$Ccv z$IRZ=C9cKBVAQL_Q$-4m9j0xdRGr8MV~1%Q*b$_A*kKID4r4HO7=w{xiEXeYo_xoT zcJ#NyFq)dIG`H(q6D_K*=X12kae=2R*5X{@fm}vo(E8Ms9&UfAjk(Ih^P#J-&TsZC zHIkHLS9|J>i&~CfdRi^lHJ;VRMHzjar^~o#?P`l>opEhA5_E3$tT!%dac=Nzwp=%Q zwi*|;g}?G_GcJ5WmJfB;x2R&a}u7^B(E!V@IeU@vd=LgI6gvT*; zlVbLy$7?l3PeC_0EMS4(VZUgD-2e^?7zI?&pY>n3lu>{w&8|2daW?aKgiVqt9Bf{sag;%`qpu$MK^Y|1}_=ir=88>`!-J zX2o$m$MGfbc5mP~QtU5Jf~O>}0}e(%M{;432@hM3K3L)UVC&Flrzb(kY0&3^Ss?f! zaAiVvJWQc6pQwCpy7% zf#Tu5B-wuMvF7JDk*L_)E(vD5PdwpM16lhAm zp)V-HoWc2-ObfB|k$Ni8sccA!#Q*E9~~9Wuo=+qW3o7+}j;f;1 zsdmJ|_$EG#Z!p5Jnqdy#x9A&l{u4{$c=YoPfJa^CfR|9s0YN**;HB>n*GKRO3*B`1 z4x?1Z+=r6e8FJLoA_6H%@K7mzx+U-*JZLJVr&sh0EbeiWDLG}B7*jeZGu&sU5y2!o zlO!hPv1fQQUFbhqe0(!qC>l#fjtlK!k~~W#IYjryWb>2>a>+dfb;pF(y0DXtx62Uu zN)d`C$nGIKDRtp4EQlyj5q35gQAI*R_Vi|C^%7D9FpFz2bWyn1)97;`<$Ex?c_Qd7SeXid_ z{>9AupbP7H%>951>!Hd6uN&8~VnQA_Eoluo2||`*NSozIko@#>EPrEPe1wZnZA;yk zC9pLGQn-?NzIoglV zG>%8RNeyX7>iF^P3qQ`H{9nRdH2B`-a?dbbI|{px3z*&mgLTge7#|!Ay9)xQ)5jjk zJwISNeVnGdO9H0Tr+dl*rqd@!Wx$N5$Po^h@f11g1KGVGMh-ce0{JmVN5BkxXgskh zP)R-%w>5z!F~@0vrQ{&7GXiEtMZ=D>0`)Pmb%EBH;}?OBnB%g*YI5Kh-Mul;MGl-r zxvveZi#fIg@P!;6-rXFyIOfK)#o+zGKAKOF<8J}SjPc2ee-8wVi&FG$AkA{^52RbJ9|A$kwERwNgbX#}|LaF_esNiF)KS5j#wz&J zbNEZ`cKk!`@e?w$GRFr;H8!qn8Vi4WeoCaKBRFy5_z6>M>ZW96MJ7y{k~Otv{P@Xr zlj~~WqIzOYRn?@b$yrsA2{lJKq3PpRwX`iCS6|iE)Y81Br9F(_xf<6|-_TYYZfvM- zpD=Dh)&%%BK5HB}S4FDZ;qU1q9qs5EXZ~t@iTxQF(6|IOE{WH;#L~D#G%l&`Y-prl zVtT_6k;xOsuAExsbT;#M0UDY+oWezArDfrw;&4uGdBMU^xHP9|PKfEO#pR*0aA*NL zXBU)~mGgC3c}{70LD3v`hKllHj@;t;C555#P@c#xE-KHdbm)U>_$joGNV}6?US1Mj z7%D9*C@u<*4`*pGJ|0YP>N`4G!<;$BFSod;C zGZ;=Z!zF1h36WH-0hziJ;aBfav;jEn8dEpS4dsbmVS-!Dp%pf}#RyBVz`RdgVdIDlJw4Eh;Mr=az;bU*Z#l zJmC#E-BD;;3!9F^^+#VUXbA!RT=z2u))T3phDe{OyVaz7_GH&j*@E-jdo zuPqO1$uGZrzA7MC6iwYzO+p#y!YWr#G`l!HHgh147h?Yym-7_IlKD#3vRzN@x|Bp| zN4VknnRcW!XHmGcGCm5(%m^bcW{7)e%F!z)ued~|C5pq?NpugSw6X_}XfQqaQ|uD> zVSC-((7E{qg?T3G;e`b`;gX!vZe}+!sF%leu}Xk7NHRXBygVm2KRzWDU}^diRt?ADfgLil91GEzZPMsK*z`T@LiYD967$wUp;OwTzNW@tM#JU>+RmGVKKmw~I&Q^(T zeEC5duX0gLB{n~p6S=dXsL+^Jx>@*zu|-9$X>eF3Hin_DIH8QvLnDr#R+CWVr-M%r zHR@T4=Y`9QvEM2zgyAF2;jAQ@-p9y5*(-s02BzK&*{I3kblStDcofblS{$Ykmer84 zhRM_*`s%%C5{9-jwqws!U@gT~G>E>kG4IQF)EigM;d`mMY0v+MBr^$4tJ zz^uMohl5#PUOW$G^*CyVS-BGHOMg-M0AS)3P8kQ@{v;xou#_l zgc=SN<$@0A^Amd)!tA9YC(eWvyOPqJIrDS$O}Q{s!Krx>%))GYnFLjo=R=;IVCI%8 zxZL96c?H^nqzPAFFc-_ar2xZ0-}1#J-R^{`M>l2`-c-P)q1mBQ7*547lm^QM9ViwT zi-^f zHg!0i3PVwbiLoj)3v)`l)nk~?X|Y9%U^1H6UQnlV^Hq0OQlYy=SUrN(d?iL!ffR*v zO5^$rvc8T&B@Obz1trP@7ye_3ie@_W7?Ayz4^$8Ab1i~v3o1rX5@@VvI(!}k!SIV` zF3=v8B@m#sCs?h3@{q_I#|+)I(vYA#=4Pn72e+%;Jql*$#C43h#T9Y+i~}B=pW8_< zn^#a$65l5Z3YXzhg|QrtSwRZQr+FGf#=~hhkBH`1R92K0(nP(ZWqG7I+|XPbSq+b7 z3Sj{ersMPrRS*_h0TjVx9Ab)>W`k_FsBHgMHn$O zKy*%oE5(>YWIUQhh?u$Ew32ydje@=t9p*@iVYW7RT<%A&H|`SgT?fp|aWQtiNhlulPDqO`Rap4M=tYD^<%lb^WNHdM@L>mJVRTy5BL#s8| zbyH;)TUcJE>86PhE2TRN%E~HWDPLwzKjAeYfge6;l&3k6s<^mN(IS(_V`G_a5s@TB z$LWa@BeOS{kmVKNNDsz2u;6CLO!Sn&>UvptPH8BFLvLs#VMf@q92@TE#IUVr8S9B> zQ%h|GRZA`5NfgfiV8{?&2+v7zW@Vo7$P5zKNxI(?SJ`r43=iEfv=Go#B@i}M4ur58 z<1`b0ut!WFTUanFv@ijOff+v4gZ^XT6HibM%04dsE6VLU*!2G%_A*DQ?3E5HQza-kt#h^<^AHL$)~8OFkuDEbNSK+}d7PA)EjB?%hknWr@Iv9pE1 zN)?InyJ8`}OaQHOS!m8e{GD9_EjaX738FH$0;k~6!ejfwooDyrHXDi%Jq5?LBGaBJ zgHXA_0aEvyDM5+vG9}Zreqnf82n)sC?>CR;jHM}Sa$&{8-t4Uf_ENyLZG4xa2HwqZ zQ7pD)D|Eoft{OoYv)$ zHFUyI(Lu4N3kr^|C^))`X)M9jRMr?-*%~Hq2r0A>o-*O&6_bZS(;_TykC2<=)O4(N z+9Gw4wn%dg3__|JTbsl1+D%6bU)NMS&9KsASQuQqr2@5UwUN52&c+UWKct~`Z| zB(JO-o&kh0-`XSXv`*B~&=hIu>~JU(FpJ;;MQymM9?s^ny0Z>q0vXWkzy=UiO-?Or znNe@l@tQRZd2;4QO=v@h1`!>r(Gx2(hTPUzwIvf&EE3TRS4P@EoV9s-YRS4hgSnYk)Ygx!WS`V0;I}pcd4@mM8q& zhk}FRV`7T7pi3%0$S^hS^;OFwMncLznXfSdRSB;!Ym7fsD7t{1HEJOa3_HSg2E$G) za*4Y+Visclp$_zlkE>9VMlxP>cwx*)H*&GY8jMCp8=ImXo?TItYm3DBQUg(6+XlnR z)-_Hiy?x|V)l&g>R<$=c_%0Zou!t>#lGO=jK4wC=1ElChv2a7}YH-!H;rO$qt`7IA z#MDGv45-o2O5kndCxc)!N|JLb-bTY#Y^4z6ewXb|7$$0^Ig6o1J|RSFQsJ;u1=V3$ zbEK9^3I}JV0Ztp##?`G*`Ak3(PTOj#6Ts^Bf(&}=Z@3T*08Jrswg%SH7$)!LtRx(#NjrDilVvG(nWO|TFx+Jg9!+C zfWd@PW6-@>CMy~dv=CgO1?pN_v9Q5E@vo~jFO`80tggXWppTj%a%FSowZP9;HS>`hgViLHh=^)KIW1^%@^De2d(NDOeZ4KmYdjpI!+ffvSFhuj-A8w?BwYCYGiUx3W;G7Ep+SfK7<)r(jBDy6HOuk#R(RMBO&uGk zz2Vdd=CcWmYMIki)xO-Jn_8>ZVE2vfWIVv)jbhjYK|!v;c|%+KO8gI{4SKL}Q~NSg zn4vJ57+_<|{bgrI-BeRyp=MJNHW_RuglZ*vw?eUP2BSeU1u1H14_AW|iV+wjd}^ev zCEVNsqX7rraiyjVWH4rsU#6V#uDCVOSu|6F4_&OJ3+^x#&ZO4#8B`asY{C9lowQ*S zW^#K2rcihoQLqPESek9KGjQ}J-e?(O?Nq^GAOl4O%OzD1(Aii8D!B9Km_w;X zh^+>e7-+P)*o50ncp@?Cl9+}m(nRoprIE@nFa+bKJ+@UjTjZp+Rmn?H4y362(-753P=II zC>?EWYayGlA;Pd)TUr`LJvfa%?rl1t{lXo~!e%6gde~gBoig-Y_0;5I;8b6j?18q@X@n;=03naA9w7DS!V;dU%Jd=rctA-Wj9sIY@Y2G)98ar9`FJaU@~BPnQimRFe( z1pET5h8%+{%0tLkXL%&j3fa37`WT*0Nn-$W*LIjqK?ef)g^8k}7&RQ!exn(2rIm(& ztFVoybyxnOsGy;tPPMjzIbg;EI&gl-oBMIejYYINf{j`&j33%s)7YpPpsB5D zRWzp

e1laOIL#iF9?EzZIZb*4o&KMUbv3$H|Q$!L$dWh?5%QTMOMi?cL5j5oJJ} z91XSFpx=WL@v>!5k<8tYeolg8jW(bqvW6ZQwB?2Y3mFQ^BM!RSV3GsPR~vRDrV)Zt z-L|p;IxLvM!(Wd;3kvNYOg~NE2eW8Y2!kLT3D7!4O%-GZY-R|9cW9xg>A>2KZ7&TK zv4d-X772zq&=0_jqt;ml|DipGhOxG#iHC(ax~5SLjjp(5hjygBwQ3bkI6$8IEW7cw zix2cV6m_hCrZQqIx^*z^4LF>vYKGZ7^b0gw#N?Ywtv#bjhwxR284u>7@h2p2c|#+N z;&@5{#RMiKwJpu2ATNXDgw2MRU`bfrfv(h+q&z@#V|OE_hik~#4$~#*WMH4gHZy$? zG#I9+MHQR=jcK$dbGH|l>C|jOhQ|8%Xl=E#T?#q31vE@zb(Gf)R4TZ8G!+AfwV2;E z_2v(YVDg2dCNuz5iEa%W6tb00H%h&f9x!r*X)e@S?3!R4LX!sQG$`UYisnn4Mpy};Ofqhs*c%7lQB&X9 zjIYb`G7EQ`*q+i18|M~iavXg&LWzQT3;b1-8GLj=>Y88M$E4@VVqjl z;3S|0{-llKO9i&p!LfGbDM3T)%E?@2p?_?{;YJurgDJ(377nU94B3a1 z6flh3Q5wFp;3qhPu!XcS z{3~v1$EsT(aU2sf`KGl=8h!`{^S}83^>7*@9nhAx!oo7txdxhL)8Z+#>(Ht}MdS$+bqP4efr%{7V<7=%ibj7oC+3Ux z`!MQ?wpP^QfHEjFFn^Q;;GEY~=!TA_s#Y%O6a=h_((B>j>N;$9%#;TPd=9R*;Tkvo z!g53w#t4cyEm_;^t&sa2)LWTluY~^NNq|(Lv{?*{I;D#9QX%cf?7$=NFkMNHigv+1 z29^w}TiVcOMiAqNh2KIS0xv}P^Hlti=Xyu_CEO1A!aU#ZjQ=|i1X)|eo0zzfN zZ1hcCCuFW26I0%t|405N+x#Irewzgk*QuqB>-3?nLwXIP??Aw(0qCGTOiOwl7ToCG z%aQz^Z)X1 z*PE&%wH=M^(5*tB7-<{V&|K5lSsQ_0nEc~n-+vW3{?quLl(azW5^k?uKCT&NI4dLL zj>(*mIVp4UI9M5PYia2i*V!J6P*qi1O+EZcJang>tHuFsqFm@hfx^LSQ1l;qiT zR-nV@Px9;o&mkqg4Djzg*Oxlimy|Tm*V~hZ7vKhmr_h(04`=xC4Ex&WBzgXL=3HMt z&)u$vd?4b0bFHsmlIKJgA=~+{)sEFJ;`&`nP0=_ ztKplraSgM&i3;p`L;WH!ZrfzldG=RMzd$Q+;dyufcz_^)s; z#B`^7E`0b>2ltp8gZsueYo0Il0^i^>eM#s0($9sk<|dW+GCjx4^`(IU{7HpAPq8n< zlkzo1YMpQ5JYS!kK7YQ?JKs|e#{bvpU;6?{o)0s_G#&zqjPzQLYk$lns*kWybd z$Y8N>m->tE<|=lc!@G51{0rqd|rHhLjz zzc}q{Dj-tcyZ@dIb;0X=bwK-=y%7g!?3gW8VgCbl90b+Z`s7;F_g$)M@GT{EyiT0H zpA_fw9PvJJ3?0}5IS%Y%q>d+u_f^z!9wAO&@r&~_`#Dl%fQ$G1ng0A0g4< zF<-as=H+p^#}kD-@D;j5hbKY482Rq`VtDs*Wq9{;Wq9{;avRu9##ksL$0u;n5B8Oi zLsEV{*gugxewHZ_zn}*m>>=DeJ@8X{&;ws0OBill5Aj6HCyHlz5AvZNkF13#_@KC%Zs9m4GgZJHc3ZUqP6g!Xxceyi zeDNKG+s_@Vzcg+Jzwh9GBKyD81MljAi;gJ}udyH_ht!Cvif6IFA;2e!F#Im%>;AxH zPJyUaar*WguzKbLm3*V(BHzIr!-Y@SMUQnBr|-71`&x^Sh)T!i7pTYjD5mp(B|qAd ze~Pa$U9b~<^w`Z;7=N3;!5sCEib^}q2Npll;`=N<&El{}03E0YKZz@c*`Xf71deu= zk2t2Wyx3ECx~0dq8|+X?2kM_H%Hek;b6p>M@f;527!Ro_!jE7s zeByZ7*~#7Fp-%u$b>k9(O*x`u*39zU2L zNAw7ndZ+Eyi|<1&d50?O`em1^ES8sWcX4H>|A4vZ z7jEafZMXllT`gn%x?L5H<1Rcf{&u;N_EX}yn&qVZlz0m7DSz#DHOmA==SnMF_=aWl zsJD19N?{3vxy0uOcDM4c#7Fq)mLA(~7h9Y@Y0F{kWG?#OVfQZn75&0@TY7B$uUb4& zKjH#^d-hbt;cI?N5Bx6{xBKf694_jyx!4VP^wZ&>L*lP_0rz8?pWXxiZ4dlCi`%o0 z<9W!4`fa|V2Y$TQB)FS=5B#Pc_@@?!FQrD0**rx={Wjmy1MdxsUU+nq?}7LBCzh}8 zfwLON4e^2RPDc+JZy-N3N@Hb7cm?~3ZIRO_a+!-xk(Y8NV@~8aD{N(XX}d&T>ZkM( z!vD?k$Mdi70iX|$Jo7{8!uU&hmGOnhk7M}~C4W5gg^JH(zC`g8nb#=(6}y`iznSG% zDc;Ha48_l9evaZ-F~3yt513!2_}$E9+#z=OJ#!g92+!qub*Iv^pXKjY+{^NhC_a$+ zlZuaK{=DKBF#nU{Wz64J{AA|uE53sH-xaUG58cD@o%xBDlPg*NN5!Sx@o>7uKCiNT zvf@87KS*)dbcqgZ-|-MVX!E(uGZYUqKT`2E%*QGYTLIB=jN_-UT*KCen`3wVZK1gAIE%=;$h||DSjIB8pUs9-k|t1%v%)ynz__7iRTb*e@|2L zMa<7u9M+ZTxIpm-m|vp!2h2Ar9^eM}YQ?8A-=cUK^It2zg8A)=U&#DU#cyPOzv7QD ze?;-unLnxcKbTAVA@)q;{^kWG4;v8E@tWe<%->YJjrqHZU&Z`yir>Th3&o#i{*B`A zGMDyD;{PM_14@1SF7rW(-@^Pb#sA2BgyLT?KT7f5$;Qs( z6whQnN%4H<$0}aMJV)`{2JzGD1JHfa}>Xe`Gtx<&-^mQKVW`^;sNfDu2Fmh^BWY;WqzmP zr!c=?@za?K}VqUNK z7Us>0|Au*o;*T>wRqng^SMf`jf3Ns`%;8~oT>O8}JW27-nfFpWHO<`LPw}Ierz<|2`B24c zn2%KaZ04gCzm9p9;yam7R{VYDGZg=t`7FizalYp(KAL%v;@Qm06<^5w1jSpKFID_} z=5>m1Wxhi3fAhk?sfxeJ@?DC5!Tfy1WpV3b#Si91ugeubocU(Or!&7^@j~XZ&Lj2i zB<8m%`6lK&6hE8!eTrYne5c~SX8wfY_b}hB`0toMulO6xUse2L=6_NAJLY>7Pvb?t zj}$+G`R9t~Gne_6*sX#2J|%xX^M5P;Yv%CQR9t<3ig}9Se_@`c_;<_?R(t?I5I9uv z(aeV{p3i)g;3W6vqe}j7%%4*H0P|-RA2i6s<3+`% zGk;z2Ma(G0#%`E9R3G_wg%rGZY`he3s&4nCB~=$Gk}K za^~fVH!(j!@w1pORs3q^b&B84yixH-nYSta2j;64|D5@mil_28;atTtm|vv$ROYbJ zaa{RX!2C+ZPhozo;%k}9I+>Ki%b9Oe@;5X8jp7e7zen*`m_MZW$IPEr`~rS;?vIM6 zF@Htzbmo6nJcIdP6(7U=L&YaC|4i|j%)e56F7xjcuVDUf#ZO}Hi{wtY}Rr0@PevIOeFrTLQ2h8&nf0G|>&sRKyAEuQlK9Tui#Y>on z6>nr7QTz<%%N4(b`3l8vV7^N6`SU|KVklo;_?#2pA-*r z`FUIM5cBsHuV?;=;_I3JL-G5Wf3Nt2;U-@^ysj+i`i$jM6dyLs$fqe@$b69EtC=6B z_hioebL z6ve+`-llkZhC|1xiqBxaR`Gh~7b$)z^UD?A!TcJ<|G@kv#Xn+xhvKPRe(qO%HuEPH zpUeCe#q*Ca>HUl1)0w}gcrokwyW)$Of3Nsb<^%cpgOu~ptp8BO2QeS1c!c$2Dc*Rv ziT@16JDJP#776zp=H*I$J@ciC|B`v5;=f|PM)B>;&sY2b<{K4%lKED}pJ#rD;_onj zNb$YQ-&MSx`NxV^G5=C=$=@FoZ({og__>PM^8)7byh!+Z=0PQY`UsO>V-!E1`BcTX zvz|P~YeyPAC5m6he2L;OF|Swreh#-o@g%lSm*NLAzgY31%r`4Oo%v0Q59RpmP&}XI zcPd`Ue7E8!Fn>+)PPW^Jim&4Iey(^6^Sz2+!Fn8iUL^Uug?TT<2eO{wil;F@O7Q^m z@rvKX`j1mw%EMyCe_;8gihsepLGinpuT*>|^K%q`hWUEM-(mi~;x97y@be#PZpS&tzVp_;BV66+fDJjpCD-->di%F3&p^U%>n+#igBj zQSpmdzu7ZBwk{#EcuTu$sP?T^FHorFvK(@XIyINWr_Z(u%BacMWQ6n~QC zXDI$D^L)iUY@c$)`!HXsxU?Jcd{5GKE9-wp$-l|`L&d*m{-xqGIb3;OC;CS-KcM7C zGEd{@S0cZb`5?vHm=9BYIrF0x7yHam{ArfYRs25Y^Ax|5xjYY)c;3#uUddm}e6`}= zGe1l5&zN7J_@9|?RQz4$TNM9@`C5LSCh>IhxadOW_?{|1LZFWDDkcBcbkjfHXmMWp zA&;9aj#I}L)_;%Y#~MA4Sse8&HrRR6;;3ge%Rg^%l;6VgFIybtr98jOT+%g><&*jO zoAA}l4^{kP=JH%olHtg z`JIZ(d;AYGm-0}?`Sq^iznEt9f2R0SmfxrN-D8Y=5+HO#M7{AT8ND87^Vql!Pr`~}6| zVZKN4ZHAC?rKT-Tb?oYo}{7UAYgX8n@M&@aXzsLMA#lL1gTJZzSrzk#VlnF0S@rleADE=Mu zlNE1fJ2WbO9`jQbzk>NX#edEGO2zMIev{(AXMUIBZ!&*I@l|Yx7ZpE+^XqNJWgPyg z;_WQ|o#LyRdk4km<2B6tD*iq5VTz}4JjW_NkomESr!y~5d<=7W-$B}k3Ctr(elqiR z#q*e-t#~Q(%M@>Aex2e^ae8+sehKrPil58;1;yWB{)XZ=F#k~TZOp$`T;g*;@t0Y? zZ+d(_KFmB_@$Jke3IfGw%cOGM>1ck_)zAn6@QWWTE(|9zfAER%&$}Y zUgoze{t)vA6_@$K?-ZAHq1P0Dmi6=*9B=2L+|C@VxSx53;-50lRQ#{Zrzn0bb9sM6 z>O~Rr1xo%I<|ivI^=P@`Qr=c8F6HVx#b0OrS1Eox^IH|ahxuKKmoa}#@p|UZDc;Qd z&x&tk{*mIFnSZ1B^~~juX~mw>u1@CnJA_xVe52y$G4D`(74sd6|C+hHZzB3{VE&Af zmwb6u@g>|}ysh|;tmjk3JuLs7;(q2{em_Fu(}#Iq#rrWIs`y~$M=LJnZK~oj-U}&y z80#rj{3zyO#gAd$sQ47-YZT98e!k*`%r`1t#{5CWPvr5{6N<|?>IKDR9QBssGLHI0 zaT!N_tGJA#Jh=D;hvZj)SIj?C z+k7S;y_$1~t6fa^vSMf6Dm5SFfuT%UC=BpGx zhxt0iH!{Ck@f(@nruaR~A6EQv=FchqJoC2||10yqEB+Pp1B&~(+@|sSHIgs=m}e+{ z81o5=k7J&z_#Ectil4+hqIeVYm5QIi`~t-M_ddp?>n+8D%s*9p z6!U$G&tRSuH2NgJvY8K1JdgQs#fz9{DPGO|c*W&;ZlU5GEPsOH>zLOoeg*TDir>uq zT*V(|e!1drFyE^9C(Q3u{0UyKdqVNOEdPq)zKISUA1FS6`9Bpul6g{wxli(CD)Rw~ z7cw8NcqQ{J#haKPulQQ#g^I6deuCmRGne<^B%Y5jU#a9@V1BORA2PpO@m}1H-J$qi zZa3~zd^qzb6_;_vi;By*;%&v{`O&9}7qI^C6hDEvm*4vkJIJ`Puj17#KUDFR%#T)l z9rLM*Z(<%&{5s~Pitl6|R{R;}jf%gmUr>{5u#@>^FE4aFh4}`(ac9FehhPYk4E%Q zXFf~G&thJz_*~{o6kou+L-8NDy*g9zvsnHYieJurv*OY(->kSiFTO|dTUpN&ir>Th zMa7@y=Tq+}zK7*MS6tR}3T}>ms!u7 zir>Y&FR!zT-Ny4g>k!44G9Rh9atG9a{9i z&Ew=9N`Clc)2}_E_yFe5Dt-v_w-vu^n$h#6;+vVL@;a-;XDjpJivO1RG{s+FUZMDB z%-1UZJ@d_q`=*3t1M|pV<_G#u4&mj2W z@v`DG40b+JT+;Qu;$1B7=k-p}znOVZ@oSlnW-j@d&E@%6#S59wxAgF<2c+plC4Vg2 zXPL#(K7V2REVnq?N6ODCi=+Hx52<%fvpC92dALAv$wyg-#&n^c2G(1X--EspY%?@wC%5TlyTyDg4-u4O&XSseAqd*E*~$NWY6&mb-E zJvYVknSZDF66PtqzAJianGaI@TIQn_-_HDa#rHBVRlFCs8_N}!@0G7sT;6lOSn+Ju zBhQ_r+(x*3KEm?C&t(3*rH5a&pqRd;l{3R?u$KqISdAQ^hTAbp^;g(n&^~iJNB^IZ6a=1$^j`H$+d6Pc6{S@EG;RY4In|Y?<&oQ5&_~*>$D(>O-q*8Ht?p&w1JlE?`dhq-HOj+{<`9o%s)_E)}6Q;qx~sx9GJ}@z`ruCTf*)%#V=+z zzYZDIvz0j)hv@znyO~erU+LF=V0X6SdE6h#I8@}NUn^1avM-CwZ$w`9S!uQ8`|&mY ztX5q5*)EIQ^Y?X%^YF}BZ*hAby;*Uw?^cW3^XP4g?_jt5O1?0T?&BuBob9&D(qoTT zcPst|%OA?z2X5OwT%8=`wjIRI$nEqtT6*ksNqIqed)~L*lDFe&_9r#_r`YkijOSsP zUOPVWJznH?e4eu8?f4wS<8iSYN5gs9;&yy!v-|qmws1{L>l&x5tPuBf51W1M$(dVT z8E%fOqHFxktc_H6E(=#xSGPr0I+?g3x>GqRYg%|=sI*}A;&4e$Y0i99GCmA@Qg=9+ zH7!j|k>(Ckuq>)O+!kr?Z0vBFB2Bo7JO&Kgt2ak#deBD7>KdzHEB4H`NMjX8qphlW zSp<-YRC`Aor3bfz#-Pl0>=eh$P-&^f8dt$a+aLv+s$1HsIwB%#>27GQYmr!IgLU{WaBCz2 zc^ql$XsBzbf%L{%5%v%l5UCH>K|&+AXLd_XxUQiwLMD~?gkjtJRc#F&Rn_28*A|Jy zrFB_nRa>o7URWl^Xo_^yx71QBuw2#E#)sQdgIjmU_Ug`rq=9NDvwcky{-Ry509Mu3 zipJa=r*=X^7>k@UvNn@WQ}JpFo+djZS7%PbtML=@5>9Y=3|=1d69(g=H-V(#ygGBj z&r6RdX*jQjPCT=%rM9Z03KK9MoET~r`eaE3{4akmh4mq>@^PAW957D#uDN(Za}jsU z1Q#-%jz;~mqgU}4++0NAF1Y!p?w9^WZqWBX3^!|rva2sMcU1EF*J0qqbV`4cZoHk- zdkB9$MhXt;uZ*jESgU#n|HTdF4(Ts3d|X=4;lB?IgVOes{#oQfgbtn7VUVaq_dmt) zmwvFP`-i~&S|`fpUvBQ$WqxR{D~yZ8N9^|%*f&x5vW_eLE34@i*5`14qVNM7%^jnx z{7Xp?{zM2oQTV$tv*D2b+PJ!hH4bi06n@qf=8li8@OuH$>Cb2TPmlokSH7zo;`_xL zJMDb7GZ0@k_cMu>Qe;n>=op|RO6o$jYb~LW; zvIF4eME9T0gOGvBFk1E?0EyzC{Yw*KcD4D%`hzNU{2u_Ob>bZx^6>09d*~cHY1zBM zD^d7eJkU<#{KN2ZoTS5l1{mtp?eU5bKsYuYXMW`@;mdCocqF>tdyctdq1?#7a-aMz zgA2K~MNi=SZHCuc_8=~QoXn{BQojHHu=g$SRTbCXv-dvFB;-NDOArnZH6Vrr1LXKT zAqgfBNJxUBQV$_HA(6byNqAJRM!*&yw*k@CR(qkXZNb`Jy|tBC+oHABTWvqB&)(1b zefVfgYi+Tjg;vV37ZK!RLmayLhdbX%6$kfMnL7_zVoRX6I6R_PYzb!e*1TY6j zlQMPK(~whI9M0Mk3Hz&y!*Bi|bLz0?BH`EX^iK6HFAitl5(&R~VQ^~3zDW4D6Vj&o zJB!1<#^Ugwf0i*dOB9DQ_D90M`=;pkcNd4>x?1#Sd7#7Vk?@~OM1RJCNcgP_K?@Xz zy>-Rm-<~1*ea*$;-+c}IYm39D+z|-}?}~&+?udj_?u~@U?}EJ#N5VNzz~-kS;n6Qe z!oyyUg#UDr=pVN?5>Edkg=zkmfzot06_Y!e1+YsTslOyn}2&Zfp;ne#?IIt14 zXrw=Fw+Ih=T7-kSk*R@ApxqhiPt7l$IxI8NZ{-`|z%8I%9_gQac3;gtYr;M0d(id{ z(7q7q&k_d4$$;;{cNb`vMEXmrzt#1Y6`c0El`<``1GKG?{#UKkX@9cPrk!#d+TIIV zZKQwX-6A~x0TIr5476RK^+ozeKPSTDUKinveV{!IT2-Xq$TY$ua*Xh(Dd^(~&~A?O zk0~_5V@r*&w;HskKwA*$Kef&X`<5GFepln6C4P`gVuc2Iv@|!5HL1_(}7Q$RIXNxS~ zB$4GszV)Ywths5CTOY^&-{JpP*RI(0jkQg?zPWbguCw30_SyTJmB0VKw_);geUY{K>yr}`hOwIHmmm68B6Kcd;S%#ImKCm(S zb<3Ex*UFd{L0|Pp{eL)oc+}lr{9;We zUi;W!_SS6tVt*I*F*6m=w4^`+KG_pJYA*8=4^Vt+iL} z`Yr6}4v4H6Xj?)1`u=O5eS2+u*E6uAX`C3o13CSj=Gd;suetlq$KPA=?Bi+I-dbR0 z&-Y!~w5t#{6__LD(|SQRH+ZC7Z#AE`>$>e^n=iE6<08 zvL_z9FLQ#3nPCHc={r>nzuWXEUw&;!Uv3oAmsm5mkRP`Q#7VL7R)HyfnQI2|Dp*P? z-n*WP`H#IpHFA6va{VIY{DsKOH>Rd#ihkUH z{x-H2-^N<8h1QWnSN~w=LF_ROL`}%CuvU0@uVH$`18-aAJ^L-=o_DZz{1v%qG~#Fs z_5s+B<-BN)y7{n~{l=rFsN1o=INV~6dh&YEXf2;+1)hu=!8a~0xbaKE3f%mvHInxi z#J4j&axh?wOr1JxBzQ&Fj`i3lq>F>sA3BUZ%LwNCJ>q+RRVnl-fn9To<#q4S z)jxuc2J84XblVTzXb-X}JrZsDDzNWfO00vb5PDkIUD6UC}*O)0OcZ-b5YJmIS=JLl=D%} zMY%|X_g58TTpnc`pf4ZBRG?-LblEX66^yt-tImZ~VIb<%h@iz3|A2 zpC7g?tml4=YXE)-!XGKHJ$2`ypBP)PPu(0aA_s#gL&om&X{-o0FxERZOgIp@;I5kT zPw(nFe6~3Fir@V9D}LkKd;H?td$UFVM2zk4v7gjq`!|g3UhL&)jEk<9V@%_CBgWJ{ zmS4db>+#&Xp*UQTG4kf$X9yls8qd8OjBq{gKLy<(xlP7N&Kv7NBmTc-L=MvU?m_=l zzc&NxHEf`<+nWksVeIz$QDW@&S|~AgSVMU1ux9YsA*b`$?afAsvBMg`V~5<&V~1SN zV}~`E#|~=@j~&()9y_clJa$-1c4$YPK4> zMY(Eu))8CwJqL@np2CK4bKR^`H7_{k=6ywwWI_YoRL9uagNW$64UShPJ9S71(T(er z9GM1$^h+7YB`Y0XO0ier~*Ue04Yq{3Qcs}eo`1c~k|+-hiL^XuHRd z>z?mW8mu`%8d!b3G@VnA%@0sSD{z-mJs}hH@kG8`JFV3&rQMbf zM>{KuF!CQ;-g2v`ReM;exb-Acv2PECK`XagDS5}qsN`1blC6f;@G+(7ohPHFnA2NL zD65rxLMi*@4@ud+_h>4;p8)02*Xn9DpHk|6^+Q$Hs)x?j`xs@Us8(S^GQ)0(^2dEveNzD4_)`Z12i!|Sdg>Zp}p36 zkJA3%KN{^R+|3U(OSJ)7@z<3B|M8(1a0Tm236WL(+3>)JY(w8}3Lx_Y zTcNf8qq5?`kHQKX4&wwHq7B%m4B7S38q#;(37Z_+g8j;pAAIzd&@3@d$V}Hp98kvm z=#yg15*|<55%Zo%XD)5Wd&-_4fAZ|bBX)dw@Mod?u@%p&hRe$0cY zZ3`(IpZ&l#;^81a8kEnHP6{KnaZ{9$FPvB-8+l;q`NYROnA*NvW#@}0+|FgN@gy)* z8#rAV`d=Teq0KzNbpQQhSR=KK`O4P+{h`~6havn#>tirh8%ci&NXLJFWXASk8%#G4 z=!VEgw*S#)7AbRaK_%abj%DQ*A~|)%YT2;TfP`ppAgfv$xD^#ct7+cA9SbbD>(+Bv+@4! z)@ZAjDeK?-q*;%*r}>rM_h-H~d$}?n5%tL$e5d&>91HXU>2chy)0Q_X54`mW_dqSI zKTa2D)0>qGu$q3NgTU#6RU8xa4&c!iKW%-h^1?g+TwcH{wfr9I(cGZT?^JGh_n*@Z zeYpq>liwy9{5HO}zgzj?;6JY)+IWu8gU`WTpl^+w-a zh!X9G&B`B!@jo^?*dKT{tX*-pa*0TC$;>JB8J#7hybN9*t7w)sgH8`=pED`(JFl>A`2A0Ygb z`$5~kTls;m&)$b0;HAWade`IKK^~%x}2}h2Blihl4^&VyY8=oBO;aYuH2Dc>M&q}F{-mi>@I2w9h7*6JK z|KOHui{De0HC!O-#9kqNpJJx)LZMjOXqI++b2$%PMn_Gty5R*K>SKSxgHoINNIwtCo|(Dy@EQY-h8QgZWg zD9K^^p=+o$+oLqZN3f37jXsBRP&WB}z!Px^r*+z^bo=aa>&8Aj@rr4M_9?~i{kP+E z+E&xn3QC>`Z)s%?D5ZMeuTt!^6QPmTME{E1r{AYWmaPnQdw;hBvE@M3coDw52p^E?o{KC6tg-qd{9rgKn)$x0KPUqDYlAsWfbh zS*e@r(k(_eDOC)HXj-m7TS}8|txLC*I#toCN(8rN)up?MX0V%Frdf6AZldWq3cw(0 z@ZkjMnBAY5XtG#?wv?l~KTWmP3Sgnr;BiP%LPT>ymud~ZoFE-@SZdRuiw12enxeZD zLwQ%v3tA`@bACdXqx$7M#kwrfq(ec8!rifsgliNBMY4upPKY^bBx^C+(D&zsUe)3D zM8{gLB8UNw+ccobQ6qV?YGRu=V2T-8#%bxNLB;9BPk^`%3!R7KBf!@eI@73- zaTI)K?LrWYvY=Yp5fuwS@LWPC;jKo&7Xp5dAD{^M84DNz+O!2zh(<>~L>X-a8Banv zc^FUrUyu{s8^6qhS~mI%LWiwp9c6=bquShX^3yT~(OKvvK+wL{;GAVNXBp%`VKgT@ zqW$$Gzg$U7wqK45U6t%pSKGmA`M2fS-}jMfZNJ3GQ`m?XH1LWBXoJOz(qA<|mkCV4 zk77z-*kFTr1H{o!*z@ri&PH1peB8}k4J-n{vMvKKY?b1s0&!sBm;Nw~2{U#ZBV|cm z6ajJ`l9>?A##H1FA?UuWah4d9V@zYb8`>IY3Wj?Lo{o7=j1vhd7(FInvGnw)Ggr6-LA0@a@G14qBW-k{O0X%7Pghj*2FtR{`9uU^uXvuU# zobvC0=`c6T=@qa!BMu3ff_}+e7;h>Uyh$#Q-gt8g+@?SZf^p3FmJRN+!9UyJUkDU| zsW^K{xr8QG9{q5=FnoqFUIEmZhOY!|0@DKqZzw{9&_P#6YVJ?us)>>g>O_N-bmG*z z6DLuV%sy^mOg3n2CqIdkJ}@G}IL$CQbe^S($rP~q*a*Nl-7u#Z9TdK&9U*j+B9`Nh zuX!g^VCrKx0OJf6M`1d}Xjp{ebfbYnbYQN6+U~ejrf7j5Qdw1ARU68k8fs{*Z(kW& z9qWp>bhL*GX6EJR6@+qITUWQ8)!Ef?Wvrn)R9ILrv#6nIPJVuD=A1eCMGXZ7vzul& zH2_#q*ic_TtA2KVeQajKR8e-$j5Qryt7bIUceQo2uj`0M8|%C4XLL8WbTvj>TUNwp z&X}1$6aNbGX8>IjTM_SQSQYDz6E>r*CElx+XHU0ijkSw-%co;t?r3TfE9*Ps-Su7F1W;8&N9Q_JO95T6cu#A$Xlz*- zi+AU%QdV`=H%cJh9qSaWYvR$`^5OykvJ?k^#C5X{^PIj7^)s35K&F>S(#Wt-9aO zyBeAi{H-nRJ!{XRmdjSObjOF7Qi9@$ryMM(Z*A>f*BOiFH46-n?sS>#beZaO8D)oM zn6b+^c`TDjW0~rHS-iWkG1deLoMeNEOl&=A7+y2wU7tC9xObRuqc__(-#cu+^_^?y zdwo9ZIb*&zy~68T;7wWJwNMrG{lIHgdV}RaH+a(*cyoN~y&0$vR(elIy*b|-@NMv# zHQq_qT7u`J&b-kV==P3TZ%!HRHGLa=R2~`g8eq!tj@f7CU?_z{-@StL4Sd&UZN4th zZS52D0sKXk^HsTi2>c;+u`Yal;+Aqk+4A${Zf=;(h-dEe0; zy-)oEmEOsf&|K>8O|Mzt^;dX}8@=g)js=*bm0tfm)K_|q4Q9YK>E7fd5x5571ZCjr z>rFV*q*zJc;2pcrI|+$ko;PEGcUYx2b%V+j8@$6QQ}DUMJA4C1#_Pf0^kP5^pS8i9 zkGmDgv->k9&+dpfeUUc}BQSNo_YCxb9CCcvwE5oL`J9)ALCTpdh_V!6(-A{<-O(|_ zS81lX^!y6+^ru)~xz5amB|n5gh{Z=K+J1EHdI0O;q`$&JGe9Ai4fk39Ky;?lY#ST6 z(3?@NJT(alSrqotS-lvPjc}6Jj~uGpJA5&~Ve7r=pMewBpA;^Eu~~s`pY`Iu;Hu3- zz8T`kMvX_jb=Y0q$1V6WFsVv@5rVINlISt!*Si$E>N2LEViOd!gz1Sp7K!==OixeX z8Yp7A-W_SG5N9(z%O)r&kLi5zl2ms)(;XKws`e(P;|7lFSjBX{1(Q^>oawT)Sn5uAyN}}E3_rogTvHMmH_LAbJWn1djSHI4$HystgysDJ*nOj1ND^jf&Q2D zf%;4Oz;TguZ4F`eVafXrHbFs_yuC08ePEp21+KxQ|Mw8|tKsM2_B|cBF9k0R%V2WO z8-m^n`f$_s=Y7EG_#6HYH|_Z0{Wxg(Ot<~a`(@A~_)o`JDBz4nl1~TGCrXgd8x`#4 zzuQ4~^6UH1Zhm%;dOP)GF1ni(bEv_UxsbiUJ~>O!ideB-1~QFN`R zLirkqV4B~~tVnT7hg;9xOdaUwJr254&%KK7)>Ds*TTlIp0`<$cl~jAWUZaCng2W9% z;Qz|hf%IpGppQX&I!KOl9P{f3r$0Xgy>7+e{ACS;(`PphPXGQ8^l$R5vVnS@(=@o8 zeg|F03~?SFf?l@LmgD5Vc?kNihMm0anukbdI_T8z9~3@Em1LJQ@9B5GwEQ;} z-%?d-I;}%=L}kJDlKgbYqeHJRBwyP|^iR_XhnDk@;=f*!neN=h-Qb{;{4*54&bK6o z_%+{cF8&u3|27Am_@7kx*Bo?`|9=(#e<-@vzf|FmyXcz~{$DQo9)uzU#&M)F8T&VU+SX&T+!=Y^h~v`TkDE>EH^y!Lz$VJanbp04#$6JA- zkF;2=M84H=e!7dU<;--^Y2Qc3g)aKVieBZSYdM#@=vtp<7k#Ocv(rUisOa~(=;tc> z|8mir75zmQUHkb}7rjgIzv-f{RrCWc`UXX}JklT9&!1KFbQfLc=P@q&7Zm^5F8Vc! zevXU2P0>qSbZu9ai~cRef4PhPT}5wJbeb>D{nBa||1T8(dIz0iyj;cqXB>2jbDa-w zbYx+*@rOb`>*ed~@Z*NolDK7d#MaLURd}#jvQuJ{yx_(@Ymv)l)BWfRcwxVnO^>y_X zF8X7#x#)7yUsrTpkR0c}E1)VgU9bE4dY93NU z9sJHbT;!r_yCM#{Gd{~*^xbOQ_1@U)viCg2PjshUdS6O(r~Z1~Ai7h}2OM&o`sjS7 z{i)c*D`-!L_M60nxY#jX&VGOFpga3r>60xX+VVqiw?KY; zEs0W2OM6oX9?|0|cEhS@L-VR=Q+-RT$ZPNDj^$mnXvtYzp=8Szc+447gjjR5sjI#% zmLyw+Xjy$2ydKD+xm4OBOc8ReT+@=Z1n$bJ&(?*Dvr zPW?OA4xl2GLT8kGwojP~)MbxqKOp{8``skmakzEuM7^6v?4yB8 zb@7zu6y*BNd;O7vQz4K3UuXp0cm(x(tn6uTXGabmy1IC$Q&%k$vT_b@Aio$poqDCD z_tw0UEw)TTe+eCTMGgk5E5e7fMR-EUdOmkz%AMl;;(n#iTiekeJimFO5L-e@&%yM% zp8W`YHrT#9Y#FS>JMho`Dl17B-9Po4v$1U5w(+8Cxhd+9Up9}}=h+fB#TLYL4$;5& zsIjHj5Ov$lNWa$qHXr|~Gx_YTJ^wgdN4mXYW#2=3zkT@dsKIn3-|ep|+4+w4on<7( zIp7hCC!8v-det)S*$X~uKh=QEzi!^8?T73fg7=`WiSP&Ehpv8T=XU%Q18KC&6cQOzK$d4TuLuKNmTOKYP8W2yg&n^0sA8E3eMI^Bv2Ww))!0 z)=}46TP6k%%-Qs#x&67Om__kyR+4=arjdR7e~j4rnT~Ugqk970$ideT^RMH-FfM!{ z7drMnWcF|Rk=ajivB%1}=T*cFwcl=tS=8@KHGw&z2VuXM4$}UliS(n-*F3geeL`BGO-OMf$&o7@Hsh ztBMhOuV4&l-mp&)a}vLFwQxokM^-J56mIo?e%XvWwaGoum}A;f8cOoF655( zi>wJ&U{%R`hwC0etdh(C`kas@uG(X5yX;}6^$vdsrL=KELN3X9K(!&5@(|?_$jCX; ze47Q`DdyfrjOn@ej$iZ#_7?YV@`%FMkQZp&CmFpp8&Oh@p?cD7w;!?ihvI(Xc?5Oq z@n7>G&oNK04?KUddA>Rb&vGw#{$%q!ItWk11D^HJ$qsTjMs|(3WKpeuVVl^Z z`(M7oZij6E@>cQALsvh_anEf{@c@k{WE`x&Ldu~ws_uyLv8~Qo0bY_xed~TnKHBH3 zr}?1hz3_wXo9gs>xE*mqV?q5<93Hw_u89ru0-B5atLCCl$_+nZ8?^p3M@a_p6YnEfE1bN%j+e-F>aSR*-o3=a_<54nDq64i zTPDpN-c!)pPBP!IA_s5BIJ}EEB;8+t-$nv|F+Fnd!NZ3i*zJoP)N2xSpM^ZLj^coH z*kkTKpW?dL>^+}kkq;4XIXc$Y50|l^+tc2Fa>GzDxxcCud9q~ZU-jBnVy|tvSl@%l z-vJ|dC*{MGt0D)_^op#CVZobIi;eyZhlzFM2RGkTuUH&Jy&O}u54vV$?A$vca+VheMS1KM zmE*`a@b!b;>Ea;etQFvQ#<h@o*|n{ zYLCyqD+hD+ZM4TeA!o&>=k`1OtoP~}s3SV%veyucqzC0R$~T$^_fwdM>YQ|1Tis(+ zQs0gnuc0+vE#0wDcSoqPr>$*WsI#RrCQgeBRofM-Zwxhcb+kFE^Ta&dw#6S@q0x$# zb}k!Zt6Lgkq0{0i0ymFWwltoj;T{dw#=1kDT`jBQ)UGEU>k6H5TKtR@u`<@(xrVuV z+Ur-evMx;|7PQc5jr{jdO z{h#iCxj$C`5+9Vn=x}_6f-dLj@Cf|*>oy77=c5Zsd_ux0Xz?)%%2a*f%MBWI3aU9~ zLFXj|Rcmm$A|0D)A;qm*!$*peD2DPzL~)>r1~)3wvGtv=xOHp#oP>t2QFW&1^YkiM zODCElC5oYxEL9v(vQB~ek<_s%IYqV7f=EdXYgds%TDnv5gmwyWE9sW)5uJOCqmI3H z+j1q<5*x2ee1_u=Cy`ciI_{MPCJ;CkoG9E%>56d*faf%rt4Pvw8q@lKQG-QEj9Q{D zhw4$?GR8bztU)aZ6GgYy&ko@vHPpm{pfP2{?1bj5Us%o zRu?)9(Wu`uSc}C*ktATBhZ3wcfIBqkNeGVVK1vg$#k#Ls5~P^ji-d;it6VX{&l=Pn z7@|Rgc3(BRFWat$qxGeItc`%9IvQjZ63ilx3nu!lvO7&=^mTg3})_7S$ zV;vPk3fBIy?T%?F+F1BI(Ody;_4X?D(p1ODc7da{(e)k$U~*_sw>`G>s|D%caU_{e zr59#duL3vPB;8P#ZmTpsR{@x18ngvBXi#@RN-y4~F}u5C4t~8%AXJTQ8d^_@OgO4RKYV0MOQGR6icAl#Bhz-ZE9T}&%^Ap`S zYH+C{@xDV_t2Jk$TleGIp-f5iSgpZ5igbL*WqLx;Vh!rq0sp?NYPD>T6eUr(gG5*4 zD!}oDHd}DxK*8Eay8V!sG(`!)wHn-`NMw5LQ72uY;?}J(xkay{J*7&l4Fgp?>T;na zmn$i}Qs1kPJqgj(3Q81iAD*Xbv>a$tsYtplK7p8Mt^l_bU7w}^OjiwRMUO95JhmVW z1{CS|1WmC8X>dn^)VNE558EUKC5oX;)w2&Png;bK!+H&tCIl}{NL0X3f^!p165kut z>XGTke$}dVFhnAHZPOcescy9FW0-H+7&|bkHMl9E^id;sxnk{2G|@s7Vdz^7nRXKm z+TLo=V7}rywm=!JxOHnRD+xUmFw{utrWkJx_NpfErUq|Oq+?S@G4t1F2u65KS2U+x zi??Y^4+dIcDqi2*7#`Rv*6RjnG@Gz-v@_OxsC40c<(d+g1B}Rf$ZZ!QBZ`t%4H8U>}0@;LES- zBdA`yft!nunU2Hr2ao;fS1+;XZ=w1e{CMrjpQuA)d>9t*kjk&arkoBqb%b%o7`&G0 zQ&Wefrll5vcxGaZfJ`5Ofu{jHYZQGaS4qv| zkwEo~0RqrT{z#>@5C!TBx?r6-izDFdY*d~Hfq0unN}lC*8h7%XmcuKhjV^PHdIJwHz=OtB-!aLWtTKzOM?@xriZtf=E6~*l~nJn@ebLs zlPhfyE=Rq2n^cpZZ;7L*&pP_~9N=@1&nbLP<#QUJhw(X`&l!BqoB!q35Bu2O#t%q^U< z2T4mG<$w#k)P};GnW+5?_u%oSbL(_! z4JdOA06M(GG82P!b5=g6!{_1@5SiyH4$t+<5WIzq3V+5DRbl?tl(tE$y@4EJpkq1y z%kL@sLQT+Vgef0v_$EDqwj;lx1Q6>ed@#K)Fv?hr&t-SWzXTBeRPs;S!(dB`kx4;n zCOzfZ%XYj9f@iPv)SC=L<7EKo@O;V!S0t38J-AY8D#^!kE)U<-;b}=I_35Z3=8<*u zK7=}?wz!(4J&*|GQNKK-tZiBcv9f3Uwo5jHrh1=|-203#WwD1ymhcte-AwztC%&0f zIr91B&JFBP;5D$b0>RVRUHibqeXHmqLF}_Ya02^`xPl?+vq=HK6JS4T5u zJi)$N`Vp6rFGE9pKqlF|*u?7zBmbIIQEe3HahPF`LobBMahO0d%tLZ`=#K|N*y*E~ zNc|;Lq-zkR;^nrAms4EWDqcZNZ1hv4rj2s#v1+~8+(3~}x+ipiH0|z{whk+kgJmU| zV0YR=wUho1nm)!k5$a-&`sjJe1x_C%2KgE@Vfnu#cl9sHv%+0V%(f!E$>?>-zH!yM z(Cf*slgR+zE^WpX4MYGW(#LJv5HsR5W2vr1Oc+%%g@}>wVjHgyM2vK?xe<mV#$O{#6?VJN(L{_acpo*%2}Q?uz#ZR<&CjSv8Cjmx zi*276x<;H%`kMK2=xIPDM585wqkx}53{RWJ0bD`jpuB3}{YD%4n-#E;zgwA%{1pks zc+VQmh=I#z{jp_V?4Vgb{Ao%cy>#SGPN<$^Mu5HMRk)rPdn-+dtQmrp1T~_63=#tu`U;T?sj08cy>6jrJj3D4jJwt>hTy8?sE{9 zgD~Dns0ZOxCt(E$*j1j#99WmBV?e52`L>R1AP%87mbjC&dB@`GSJsh&7u*xERE)axp>4< z5nKhi({I2jjc92UcJed<{32ruYUnWYMg%_(n3c*mPnAmj9TaoCQi^4Ulu{Jv<|L(* zpSqr+lw#y`rBpW6;= zEU}t1M+8LHcQwBu`8$mKR#$&hIpYOod_zNA_ zT7QwmSmvkw=Q--G@kbmf^;+Cko>1x_TnEBm1k< z{v{6VKm8X=jCJ|B{}M;t)BdFn>{VbqRXO3I#id?Oc$}Os_d2rsGH-xuIFEeFE7#+9Cfa9UYXr# z`7s*2GP^U<=#|->Rx2asjc}V=aGhl|d&@CcLc~bT7O#+5s09?G)flpJ}S4fPLW58POz=Bqz z#5m=pSj`f9oumx2S|!Gjk!juJz_P5HQ$=E1VeB!p)}sk8|Ch_3sf`3Ez?DbHN z5t5PCM1zi>Dr8T@37Mn^ovS9}j{v!jG5kp3a2q?#E3z5urFN%#MUIV~;mynutbx?b za3Yx!VcjyNCw3VXN+B|Sz6yQXo&k|zpb!}b3Xx%;5E=THQsgdBq0b{$>D|HJqwT-3 z(0eZ*zUIg#&+EV`Y-hV?p(j7TGkj58hc`z+`D&U4Q1 z8P54#;GExQtNHykGNsTvg**RGLS`w8d5bmMJDqDdC(KbZpDhl13vGqZ@y=p|^X<9b z*)ljX4ddG~+&EYLyH8F@o`v`MWa41K_xohx;AHb3zH*ku$aj6!jPR6vz_*l<#dKNw zJ>POhSitvv&5SIgng@NYj5HI{@9SiQHT!|@kc~X-`-hGE&_`FRLdXTfr?M4eKgRFg z*>#WjOb7O;&vIZt!P9V?^D&>-u&)yzM_q=;LHHR6=}y8EAPjR7{u6{WC*kKHq&f*t zf{@}QJOx6~N%#c_0Vm;?AYi$)75iTx;Ga!+8W^7O+k|I8zy+yI_!S72lkhAErjzg- z2!@mJJP5)`cmae70f*2RK^Tu`sF{497ekSnmqq^PDS$s}Pr&~wg6lA{oPIJ*W23x` z;oA$JQI|1{eAepa!QdMtw_9pRd7J-vOD!wB&HsX>mX)a?1k4@Qayf_`e_ynkC6*FI z-IuIR2X?2mR$`nRzHIeMj4uJUS(_v_c@o-fw>C?RZ;*Tizf;7TG4@sbt`K8cM_fe;Z$|a!gKTIR!}a|j6G?kn2uc8D|2PFaj6UuPVSef5K)L+5cqQR za&@Jv5V;^IL@o#l$>p@6kbEa1QySMSb6)8#v&uy<579O8Y@GP!M6-EK3OAh!iuo@o zf)R=`^STtN6(iTDWZE?wQlwT~b3=;MilWHelp?ia1M7-ErDbkLVoo2%mL9IG(quPAaCtXV`i20UJx|Wf5ebTjT|6!kWE%jmg{L;0|7Vzhb-~our z@Ju3iq5i90d25IAMcVH{k&mmWZ5p)^K>~wR9h`|qndhsPX(jv|X?fb0aZ5|y1Wnr} zpCi%uq5 zFw6Y+B8HogJ=5-wFwBp4zFThde6QMuAFN~ev&7$z(R&*TOgunVSo~-K+oc0&)>n-BkFD3kp`h8d0&h!J)c832Z zZD;sBY5TLp{|`A{ZxSpFITh&oDa|zGR2W5w$B5)v?E%+?Z;Vl3sF z213$|8TbByETj&XcK z+CnQp+Rt-Y4v+g&avUE&9rRzyar_Ix&qSDKD%tyNx!v#cavXWAUtDU_f4$s>|ErN< zj)9k(8RoJ6KbDeoZ_Mj4|;@G+3(XtIiQ62V{NoSG)#-y}2q4QLt-p9mfXIFa&S zFbHwB5D^>$JaY<8bfnSu*np=s*oMWVVP#-RTM5JF1DIGvtuE88ma<`^(@v3w-At_G zlwsQm8LtexmynPFe{KdO)nFIXNd&)+b84D|?@wm1ZOMFwcyXki!^#HIHrPXWgH)Dd z_Ol+5c}Vk~uXwLv-tiP4*E)E6!Mnqha;=5IJk)1~aiSwF!fi*V-NbD<{%(RkP1Xy-PxJ>7A$p4aD!_UKIO&WqswxK>ma2)W|G;YrtORkwoTuO zK7#6rkK-g`&Fpimo14|T`Bzk%ThzMAE9$L249I&RX9RfTiuxOUvQvH(N*mHNUJW0% zRDaTkyc%XvwO+XALVz5>(=(Q6VYg-#c+9>munExvqPaOs&S!p(vjyv@{p97x=1ejw zi}2zXxS}jTrSiCa;m?vBqL*<>Q)huIKmiT@!k3 zXmR3|lf+vM^jEU#eU9HJ_y2pklCss|TKhGIH;CCr|9E#1p6*{UUFuF}de?xS`_~zT z^ioQg-z^wr)bg7tM_>f^Vq^9(FwQzwMhF{HVy$^YLem}1L>d!QpO0mXfQldE*ejQF=Le6T)jZ>Xb1loxzS?& zQ$n_!vAM#2WA9J~cZt3{CN>E;GV@q9%70QFrUp7~g~P-~M+pCwx3f&DA9-FL(dEHG zLoX1WuSPd(r16===n`a)n+J%R?qkh!)N5j6O`5|t(|yF$hLiAxOnY!c%w~`0B$M79 zvhm5RT9J=0@~Ab&deTtHBxlWlC@9dm?mziTN9KCo?UK9H(8`zT$Q>f#sXaiH>gTgM zw)z8clI5(w6{2kX0+SXO+q}8v46G|Q9%1=5Uc&Vw$ME6c75?dJSOsa)kgmuUXEq~?9x{2YV-XwcWkgDZt?aS1CVUF7t*(=k2nWN}4rAa?ap zL%9ipn zLn39~OW5d8?tZ0CHMzp4F}caOUnwp}>VA_VWnA*q8AKh26CQ?4HGmJA^qA3}^beZ! zGLI8aP7=GgZ@Ye%NpA~Xpx>H)$ZSS**g4?`Y=(_L%-vz&Vbn7w6?BZ8O(CTY+9G8> zU`dxQ79$rX)#1fjym;u$os?s4KwI{5`XqL6!qp*3&Y90-J~fcMAgReYqj!YC)42dk zJASZ@;qwT#WX`yVV2{ihH3WO*%10~W2%pR!v?7l1kF(_jWG4jy4qq>t>g)vY9*_YW+khUW+khUZm}A!ciIP6@ zR%?Pq8)MtriB|I7X%e@$>m^>)g+}@)a%PE5eUOdSAS87G`IOvi zxwl!9IT*e~{qcookly>Vce7U+!SA7t?oi;D$IbKPtubn2o*$4G*_4jVxdB;2&$7&l zfV^o&7w+c5fV@vmF9n;`fe@|r`1>0mwSin4SsIY{UAZP2koR2~X%0kewzfdIjdTa( zeOH>Y=9+-K@5;KZ3oK(cMy?JlXN1}QB_Q7iq-DjtF3@bVZ3=YS$jyOn8|e$IWrS|9 znp*?Cj7$muxht^AMz#fRVubtoM&K43*%8=mBliYwV}y;nKX8YQd^fP2kq7Z7qUM8v z9gOg!jfVpFF~auzFtE#RvpcYxk*OiH`AOgjyXL2Xrx{^&o(Q~TBfkv1%m~c|^Vz^2 z8+kskml3*QVZIpH#|UfiTHpW%5Z6*Pz`qL!`G}6a_@_WXVrFfiJIy%z{M zFf*9zz&ycxiShfk!C;ZZ*y7A!#KAc{SS~TPY(%iy!8tit=fLuUOC6kr!DSL->*fTP zJFp9bDuoQDVO!?2=$F-Wz%t;6$=8i{8`WyE%9nh8)0ffSmLHkAEf)RFzlN zhH|Hd8d~w2cA?d=t~kE-8!DKYm!DS<%5803-F8-ISI3q33UH{fuwZ6UL(`o6{MgJn zbMlKC3JPX7&2DM{u%fV`zJ6By?EL!J%!a9=?3@{EI=WWPXs+*S>u6us5s%Uj$j#_( zZs}@_wzjN@&zvzceVDZ*8q{r zNaV6)k;@z+muZp9R`j&AazD1@F9(*_)m29?E~}}ns9F>)h~~Qq1<8b&qPe@fGpa^M)|FH( zT2uz5A)utPs{`($DE_x>+n(QB{db*wb6>w$}$DkmX$4v)>anR zmJc9AORMSzC2~biS4*_BzPnjl2gz`pmJE<3SC`e4lr3U0E>g6-K#+`Byg`e=xI{~e zD=X&~mn?{u!QFE!D{9N7Pwk45$_hw~I$Tj!Q&Uw#jvv4@ucET9tR`ArQ)bH>l<^3? z!Oc9XPT@q0(s(8dt0^lfBiARXqKMJzDj7OXIc&+Gt(28VZG1^hMO_&jK8wogE~% zkFt1C*(I17?AMA#2%$xF6~$^=+Kx|zMO9r@Nmb>L{Z>_%Evl`pj8;|^mqyE$*3}ei z*>G;fyi21cWi@rR$$AXZMyYo6Hkd8*s%jSMPDnZ>jEZ>`CB-!9lY3HT7FR<{L?gZl zUt3lwND#gUAsd9C6No_^6q^1nxl57ys2W@asSzWZQ94$(bV3OMumzH8?RaQplxhhJ_ zDhID9fu}Aii!Q7xEgPJnvI^;kWG45tWYG{6dc+Z#b?|Srrfl(&iW;Q5>Y9p+VPtec z*#HMbtIIGw$#EQ>Dw`+e4Wu)YR$4Z%cuA!@%1SP(NY)O7C{o?RibVs%o$6}quv$e+ zi|dL9wv%;9OPD>Bj?Adza$x%4#i(@XdY#5phz%k@ub;;y1FkN14ZF-(6_^k@29xdO z`qG-J>LKb&%F8hN#U&+WwYAZjii^tKo`+bjE3aGV3J?lKIrm&Cp%$`e%2h0ySCy>I zMHu6YX?;u@dDgLdp^MkyyP@*BjzpbDRN^^G9;qq5BwDjHSp}lW9Y&I7L>?lQQ&n+k z6+YEJpaqkov`7rBt64fkMWUM_>RG!%>L_0ibaY91MP;c}J$i9PakRR)W`Nrz56M;g zI(rh(4AKK%Tvu0IQl4zd5_p<_VxytHwRHvkurq%AB933s5DRNBiq5O7x+J<}5zTgN zB@z_5ZAqX|sO+LD&IdLR1vqJw;3Bsq5#~WGZ<6XNvFECb&Mm_dQYI8uwLp|Au%rgj zSy@>nSCmURO<{6tPE^;{T&#E;L<$}kif)SQmee|^$Z$wj@QU3R2OUzOgT(Sns}?1+ zqdwK#sH-ShP?ppYr)fuPx1l8zq1XtrQ3*Z}oeEz<$v0Uw$q~J{X5OXFR>|F65?w^e zmve}N%dJE0CCaA`Lu+fCdTH+`IMptI772&NZAk&{%3MwIrvXNhOC@ zfDRBOIg-2rwt-F{QAw@>VGyqjKCD{ZD(qIlcL3oE{*aI%aO`94=}w{5xbDJE3n>{FOvsS9zI5oOYU{YR z7F*82D@&^|P|1}TT(vcYSeRWW7aOJ2yvilD<=7AL<+Q5~ETH3BtGf77-h``lN;NGh zUPM!LDS6U$QRq~zp!_l?s-|8PD{^9yan@JV4o=rPB&)Bf$(msuq!nLn-kj1^O)Zk0 z!?}uzc%{9!vu088LfG$UMZen=TiYGO9gU9m=zs;M5_@5+EP~2QifeGq0ALZ;l@g35 zK)E&oC@q`21otuk@leYa`q}|h_?T;@YZ-f~e1HnXVaC69oTswLRK$X}CM8EuWN zjq-FpyS_3)O$K7jXcF;XlGfiE~Spl6RoYT;43~iTP?2j zO4W`{*VR=lEUQ`~_o|vkc@Co<#YU%wFF<4k883Iu8h1HyZo+-M4<>Dy;_&7|Y&Be_ zYr_y%mGa6`iU%vnr&|<*RaN2s+L0Kj8zdx`&=Pt5R9UgGqAproj_O4f$$sbSD_Jiu zE0Y;&D=sS&tsS`g$)}{-gAKUdDCj<6yrn(bRNvNuACylp#G5<1P*bleqLQnVh&^ai zFdGy!BZ8`{Z*1%m@hBI>a`sHgLIfM)&OROM>ae?FJ*Y(y*rL(mnwsKEqojDW?$YYA zXjIVsQHrm)#-_lMNqdjh*#}Q$CQ&-eCi#72ULATfWgrwWPvbz~{zU3ZmX=sBZ2Ye`c*MN@#g4?`gjaaelZsiQ397m9Syh(-WY90FyVm%DZ8e= zMH$wK5NpHF9!AkW?v}@43uZ?w9v5_rSu}UR_>QiYl?Ze^nCR|k=x7yfvF_%MM$yt# z-w?w^L(F0XjR$Mf;AcVTs!4L74MhX?M5)*}> zd^*rskH;_VD@9vRYj+Ef?kMIT^(*7ID|S^+40A$12XNof?_QhWS7G3wbj8{bLljI} zrs8o>6c5i)9%n>71|o*Yj5X3&iylNPbihPe+f6@Ci76Nti1#j5k^`Z&rL6@%llSt; z`xr5}x;xf|$bbdNB4lT*OWy0389|0ZqN_C=^*!Wbs7Ga#!$!cMfpdXpK20r|6*wVK zyG~qv$I!Q&67iN#Q+Ctxs7KLOA73S8Dyd)B+EL#ar7n{Q6cfb80p8Ks0FQ{S_-gu( z3ETzS+Ttta>_^N=4Ircm_EFQG?xrFc#|U^%fpRRJhH#WpHIi3LJN$zgicH)RkK*S< z>k%=qJxU8gw7sJp5srsm$mz^Onqg>UNJ$!WiPg80AlZ>1;#hZs=&kB#XzATdc9AzN-aY$efIYRp(?fj?LhC;P5h* zecDYS-->8YJC+3LBb9K_O0?3BfKs%e-_woCysjl9->5rl(zObSHubdgPt}S}N-Y>) z3TIjvqcrm=^3=3s6sa0LcToVUG{IyVEW0BO!MnU;z#6o=L+E8IPLq^tq{(tUiN{-! z)z=E0q`NR7gYCSF~7UY($*7|jDJ7zUS5^X1=^_+^k zu-Bxw1E`wX;yFQ8O=%Pt5V)Vp+->%)Pr9DKV{L3Rc%mX(kvAn5HLjv-1!h_Zk8&vR z7M8Y^yo>9MK?!c70tJo!A8l^}A7yp@|35R6875(e0AbN2AQqy6ECJ%iBp`%{f*5z& zBqV{v09n~YC4fs5tweFd1<=|Cv~I;ExPe<;+N!lxTWcE@+o0CEfFvsB|2g-bGr2jL z^!NR~e!u_of_a|j{hWL5z2~00KQl35>>4DMUg^SBdDQ>Ob=2#OLC?#@(rVr`EC5uk zuz4}{p=wzLjcja3N-eA%^|CrNk?7f}`zu(2%3Xo+j8Vo5ftadho=wT`1nF-(qmjpm zCYlOLJj%`Ho6>GBO~Db14#BL1_!vE+{=sJ6jOL97xTX=5cG^O;ycT1;BbWFy(xxI& z=SEWWsAKkoTCq3aOp3 z^M&Ybw3ON#B@To!I2?~!nW(Tw9RLQ2!31<~5IX`w3qF(SqIzMq)c@&jKfq6#Ya6Y&EQQ>&KaSq z%a=5KcQRzUYJ1PKMSDXb3QLwPrOhmwM$pjAjsnQB%q)<`^i(u76kJ?v<_mad$&QI? zklQ7gJ1nZggb$OT@;vhM@o1Xi_wcof>f&WZ<+fkt>VR6(UMR-ERTvpB#^6n+kH#)& zd@!;_kH4f~DSQRbX++^>7E32f7okFwV+vnIvr049G#QX_US3i8QW@3IsHfOlSg^c& zSrw8>YZn*+(_GDDj%)yLE?7+EwhI>6)e z(u(Dis1KkiQ(-|Bjh^!09ZbX%3KvlAqwd2F!Z2>D#yDYFjhzXgL};FGENG?%7NC3z zF*mUeyP_2Hh6Pwxv31rfD#w`0mLu}OjtPSlEH5aHI;v@b7L+4%(icR%+m5CL!#t&k z4RcdloNxp5$EJFc)yxV`aRF)v-{slL;uYGK&bDk^UA)rbnuVx<82q3*mQs^SD=uah zQ3DMqI6Hfx#sMiNXG42s#}F&6U2Uxp^FkPmpkg*}^A;?mM%ylaSU)w!prs4bq_|5MREel;Bq`CV&dUKb8NeDD4RO(=cty*W zEP=60E8rhk?V;LgY(u&$%F7pvI^0^D@j6NkhOk&kDMKSm0|~MWG}oZCs6OP?lu*0| zFD@@H!@`(tqD^wSwPvq2t@JW8c(%EzSiFpe=th+E+IwolF%Chkpizc>T7)=IZ@MC>_H7NiGNT~bV&L#-Dlu#%`O<~Ua9)w z6PWIbP?<;(Ntp1sFws-vA=hX*&|1}?wKqOV=0WleU0PF)zeQxYgW6X)5Rir2nHiwZ=|7c+V105^5U~!oNdvwTsJ8oK_qS%o5rw!7{krI-%~1WS7tboKZ)YKm{*xn4Dl?qqxkJ%jLFM zsM)vsE@*F;lonQDm;kp#TSSFNb1QCitdn8BYdVU;5;T*xai`wZw8ijq9uA^~D=fxz zm>WhoA%*Tp31K-F>tuPn6Ju6=&Ax;L6t6eXE&@{Dg=$VCOLPV0b}HirGEp&rYFG_< zkYy=KhIv+0g;jP8OVGBIF2_R9B1~kW52Y8wEEVH9)97^ZOnQ(`k7>a=+P~0K(@N0x zfEke$v`2=OQ!KkkLLpXedV;9NB5Vpk7iVN)Rr!*R&&5{ga!bpLN(D@xEwm=O!QmF3uA!N}ZB+({8l-ir&1 zFoar$-h_ujwgt9*5gJywU^$k=MXgzqt;X7a=Uy320(7!hBlk96a&OmHoXBHl*m+J1 zf9>%)58Qy!bUDvmE4bJ(1{DG-U59mVmzh#2t>Cc=wiBb*wESwOX_P^l%-AX_wbM-e z?F^F&7wx<;r)l%)gFK*gAqLQeI2C#or~?JqFvBf+1`n+$nn>&<&uBPNzC)o+_dWdV zVLIpbIOgPA{hQ)$3*VP;Zx5sIIew0BubP9t%J>dn(;r*%@_QVUZ^DFb58sh+XOFvj zZSHeV;(Y_}O)}wsU|IQMAEmL6&q868j^mioPaWxW(DUj1yb0HohZKs_ zbH`p3AHH{J4zevBq;C_m#|XfNZoX51cDnIh)Z>^)G><**>veA*leZ69hHOFy#q~Ke zih~YQ#$+cPrc71ZhVe781?f1MnWUH4bj3*jMa-VVbu62$v$MT`@f5C47tS6}e^ zzx;aOk_E*@HH)jUG=c#{an;z;rG<-^6&2%*$vq8wyGUF)rh9qSMP*}`V&t~Gc^WgT`<6$_|F?wb*#R zb*B03O!Mgrv-6Rp`R4ny^X>O&=d+8>hf=JKKm*znN~ELxPm6WLcYDYkQdK29)H0+#TWD^gs0+VI)5Che8*s;eZfHq>w{xMIl*{@$noPl@=9c^FW5UF{CO}G z$_ZrW1P6x#r>+Zzt_{XNh0jn<=$cUAg*EGf`1=sAd*PZ;;F&ey(_+N*7XEx&d_sRe zeydhR@GhQ&62dEkC;lgxg@kkqofYgc8}aSR2?j#zLxJsUz9#h_8ublpcE!;C5p;A* z@E?~LJO&yPDf6>KfvszD0!>~{uxBW|3~F|h94>2ogG3&}q_*yo$z;Ik27 zPVo3$!ML2jKd;&qObP|=!QW{}JuBF4E(E_0e0)_-Ff9~#5HJ8W6GG2H6-==!@RzIB zk@&-S(i^3_XULV>O43eFGgA{i|e7>A# z&kn5%JS2MXS0}6@Ka^751FLr7`AZNFgaSK(@cegIeI29BKlYJX`^Rv%{dhut(%BIY z;zNv2e9#TesZ5zt_;`2@XL4ozF?1pBf&l< zvCkUo!n?!&Gz6iC>N z=F3oMkiPTESf;JV-!X3utKW@BKG?Q%JFpc`dM5A9--O6!1^zPy}vPqw-g2Kmh<0N3V5g)cWEw zP>z6fg|yvFN&;WStqYDuQBj@9*%i2UHAF*!ALGdD*R76ON~kNr(-Zm!Lv_JH(2swE za)Lw6=ZGAX@mVn}c5{0es+YddvoVD3hEVT>tAis*Yv`=CLHs$D@LI}5jM8}!!m;bb zLwG`UqI0=D-sO{L@T3Q|h^XyspB)^0PO#t1V9&FHy=Djd%!FNGP{=-VxoKGb6eOpA`0|)d{RbxMZ-N7nYqZ0` zgtLP2vtzizKFIY=I2;^_hGsOGJ+K+tj|l}12GNF}9Za2Roa&lG!QN*D16K$A;T8D% z!n*rtg_a~}35C{$o(=Z8mQwj6T)0c>1isw_ z{?rEE95e711n!g266`-Cn1nX>BZQk0co5;xNDo9GiL7^<7aVYis%`*H7MkT%rkQ*J zRb^c;F*MgSy6ij0NvmU)fFZ8 zA|Chx{ZSTV9UAJ#JeFff6z6@_rXRir?))xP^zoC1M}Pk*%5TFs1V5u0y_bt}!%vah z==mbU@k2D~m|(d1VZjbhh8b>tkgfv{8XoDu=;jNP&a6)S1H-3x;=eL_Xb9EuSZlZm z)ZxK4!v}U?bhFxUGvn;=tjO@_?*K=iO*NcmdL55ZhU0fV)zR1RWJNviJCnrJPMrSc zJN}+?C;mIbM|9%P8a}cUzs$r-KhfCnxZCjKJ3`zoGhAln?T>$EIR9{TJN7aRKhYuf za=77RI`Qs?n^|>-XNOGsou7QWtmaRLFF+Qc{lo(a_HNq}ZHF^&LDA7UH2(kEYx{#+;hkjnW z{l&6xBHn&Zc|FGo=#8q|&;A_%L(DoKuEIvXy}WK@`6k5M&ucFikUJ; zQw!hEtfpH92yTwI@Y%2Z?+$n=7JK6iZ*TV=WBxJh)6W?vNILQB*x>E$Z4=8EoAeyd zcQl5y$K8gvw^zcy#^Zj`9Tlw6v;5OWe=6U3o`lRXc4+SxB){{G-9|*^r6oGW=xOgS z%pL}$-ZgsK`@0?-G97wi`NMyVe0#sSk>x9JjwS!IF8qZ4{6{SL$}TwmL}*O;`yt=Y z>1SnxJ*EqJS}ctf?_W?ZvG@SwHx>_ekzA6P^@~o@v(C|z&(~T{33ILIM&>%5Qjdoy{r_8gMjZV&@im--k6jLvVZqes#}NbIcjNQ;P%SgV4@_h=QC11j&zL1|#8zP6) z7p>=H7SMXco?1@|%WFGGyxI;GEKhb`!`F0r%;75?{yT@~I{a@AcjbR@xLfa15FZ^B z?`nH#K2LV|jy&I}88PNsrt9#GxIggY>(8 znCS3TR>XYD9y`gOL^`970mBiM!=4^_uwg9F|TK`C9UI5#OK2XUUiF>C8!wo3A2=&*y78 zx#gSh@LIkmJ=Z$C&f#wQH#*!+|0d>=eo2S;kECC?v@;?v@$FKan}&uZ>0!Rs=@dWF>6G%N^oY$#MI!4VUclFMl5!+|sl!j^YqGy9FCxT$CO6KR zxSM{7SEpa>uhSo4U6h_$NAFyRU+i$#f39-4_zCH8{pUuO(dpU5T&L$5=A_59r=*|w zg-*OD^0oF`2}|+|9Qh)?7JuHu_a%H5e->WDob=J2Uj#C-m?3;vzMBaZw9eeDgU)8(&r!CM@j z>F7D5U%MWcZ|;IOb-|D4rFKe>tLI{eXF2h1>4JaX1qa3lx`i78#$2 zp7|_asN}!q`=yHiise@*zMT1$ieJZkz2bK=|GDCyFuy}_S@*eD@i$ps%181g>ot!n z`R`c%X~l!wPd~5tK;|ziPV4)0{K1~0_OE09f#SK$KUO@C`F_Q#n17-81>AoeQTz^; zKdSg+%mbWnv5)+{`gp~EWcl8T9~-cW#ZN`gc;+--q(k^w%u^N5XZ{n#FJ~^}Q_*uf z^9f4+Y33P<|Czbe1JUyh^D~uvkjF`9DL#z3jAup98O$$K^7+hvs`wSm3l)EWxwI3a z|F_J`mHao%mnlA!$8D<>pTm5u;_I19y_9$xnct-3KVg2W;_=)7-=(;HU&`~gD4xsm z4=P^8{2|3}VE(w`4={gP@fVmsulNVdUsn7}=5Hw8m&cuND?W<(pB2w!{*mI<%=apO zC-Z+P{v`8%EB+euZxr9hyjAfZnYSsP%;RHe=cL@HGw;szUU(7nzKUPNe30S|%#Tt0 z56nj>{sr^ViudAi`B=rrGEY~07V}dTU%)(5@hh0mRQwj^GQSf$G%!C;$-l+?V#R$t zPmp$9^bBB5?`U*1jspP3&} zoW7Sx$ES+_n>oE#Lx+@mPacqdtN3u{KPWzqxor81o|(+U+>Z&rgn2K;moQIMd@b`K zif?94?>V^Xe~9_A}lvK}Jx@jNe`uH=U>&ry6V^SO#= zF~30Z3z*MWyo~t*#Wyf7QG6@&rHVhwyhibtn9F!a^807zwMzaV^J^7vVSc0H-Fw;c zyG8M2=65PSk@DuVi^yzmj}i$NVWJe<$-jia*cu=QkC9h~?i= z{B7p%EB+1hzbQVD*Aez9p256X@pG7eq4;IY4=Mh0=HDs)G;@!~abll0nTHhrH}f8f z_uzGkeu}3tPf~m)^J5h+Vt$zJo0ejoFb6@Q-jB*hOfKTYv(m}e>8pUXX4@e`Pz zqj)CsT*WVBeu?6h%w?P|_P>s~tfLCw#=KJLIgb|-=>1!_o%|ciuTlH}^J^6UH*{w;<1lM9 z-(B&1=6w~vn)x8bA7Xxt;=g51?_s)r@)7gViXUP=R`EDqr=#~vT|EPspQ`v2=9!8Y zGM}mVRm|}ny$<@fFh5W6XP95C_=n8%6mMm|NbzpGZdk4OvCJ=5d<64575^>st&0DI zIljZ%Azx=Re@5|A=C3HeiTR%u&tz`D2h?7F$1`tM@_Ed^QTzht_WM@tdTwOy=lQPq zZ58wWimzjStm3Pfrz`#t^V1Z+m-#fsf5ZG7#rHD5K=JpO|5Wk+Ft^`dv-=C9Y!R7H zSyzz!UOm=6tW|nK<1N3LIjyUc9?@mLf7fo$7LNBNrROKSko>0NLFVr(-kEqha=8s>4a1p3yPV;lxfEY_NB- z!%6-Yi@k{sC;483?1O2{CH-8jz4Mj4tov6eK9TLP!qJn)ank7;CEvhy*ywOd=SLi7 zlfx;UFL65WS9}ZeUpt)i$ol-_4ktbF>{q*)Q+_F(bMc>!_m%t%&eyk!7c!T19Vy?l zm?!W$ituxo4^;e8<|7n8pLrT{O6LhSiRN>Pl7F7R{DPIi{{)(sAK%j~NAlmGu`noa7gT@PVVm;Uq79SnY6< zZ(#Wq4kvl>!*vcPc^|j4*E*c!Pv`X1JDlWavixlhCwZwyTNR(mdVa}V%JB-WzmF;| z_2NaP=LFXCdnGULhy7FWok$ZML0*rPc;B(u8?1N}^YMy%oX#1FOMjQI_(Yb!T=6>Q zn-o99{MU-p_e<$`P4Oh=?)x)TFDjTHVR`ZMTCPV)+yM!1;m$|aUxnYz@?(|!W6V!e z{7vSw6#pah3lzVG`%iuXUpn8(|oc++Uh?^66T=D$+>TjozHJ|NBN zd0FujnZK*}0_Oivd_D7jD;^qY^?$GUuUTH!eWhHUWj=`4JB7c;e5B%EGoPS%@B|xg zrs6%B&rv*;`A-!e$z0ZnB|W2=uTt_8m|v&(Oy;*K-oWMifZ`Xk{Nsu*Vg91xmoxvp z;v1NMr1)0mvfeEDdY<_aCI1KJVP0ny`HPOTb{?$wUsyg(@lTnbs(35&*^2i#(dz%H z;>R#AQ+yorRf?a^T-K*0{qvaLrsNkfe?akN%pX^L1M?RZzn}T<72nDHBgNljeo*nR znEQKMdr11LxjpHw_y^oBB`H3Or$wip#v?*NRI!yi4)V*$%%|{0HWLQe5V(dlm1;>G?wOQOxBFw^A;DWBsyzFWh7K zBwiO6p2YlW#q*for1+)GH!Cjb->LW;-2Th@y~Hc?+&7i{1FZi8#UJGt@Tx#iugw&g8YZ6n}yFR>jkp?@;_1E|;ejf0fsBRFcmiQ?}vPgh+0YMSDQSpHnaWxSE6cwZieEK&S8 z=BpJS&-{AD&tQIs;&YilsQ6Er|3>iw=6e*cVE(q^*D?QC@%xy6ruYZUTNVE|^KQIv zAm!Dk8KUe%p=JH;& z}IK{IAUSEB+aC*`JYkzh@rgg;3!MKe2WmsQ8FuE&qw)6Pe4t zjp!N3dS)s4G-@tsg;tkB-Rs2Qf`xO5( z^KTUYoOv9t--~^|W>{7Q>l>4m{0QdRiif#fx>)g3SpG7_XER@|_)nQf z_j53Ro&{H^V!m0)uVUVy_;t*mQhYP>R}?>k*ZKdb_!gFLQv6ZoUnu?(^B)v{hj{{z zkHpThj+CVM0hT{r@$Z?-{($HSa=)3S(KY_lMG9 zdA;I^%w-)y(*GjsZ&30wE_zb&dhTamQXGGB!5nWZet@}*PbJ<%%nvGgAN#|%ipMh# zaC${gU*>%jPhx(I;?D_$Pe-j^ZIs&)*gA&HQu4hcN$6@ne{W`7G%_ zf$s+@F7u}26d%X;;}xIE_YuX<=KFILFXQ|9ihs@NE?4{m=Ia%2VSc0HpE18nahW&$ zQgMm*H;T)A@b8L`;QQ|t|0CZA+3&>84>0ei_(RN76n~8Q7{#AtewyMk4$o2iRhGX< z@!v7ON%8f3f4kzx^8EvfAIJBPDL#ttpI3Y=-@mE&1it@3aao5ypt$(wSBgu&_M_s{ z`Mx{XdnuQ>%##$qg!xFtf5v>g;$_UIDqhWew&IsFuTp#+->+6&`inZnrN6jMap^Da zS6uoFncs^Yq`!Dh$&cmxHx!@1_wOq{neX>2KArEsRQw{oKdSfwzE2ox`!`AFGUiE& zKf?3e;fhOtJy!9%SkGySZ(}}7aakw1Kyk5Sq2jNwo(jeP!u(3bzhZua;y*IKL-7FL z|3dLZzJFZtk$nGx;$!&!EydIM{x6DW@cq9OpUL-!70>7U0GE%HV=?o-imzmztoY5$ zPgeXk=9!8=$b6pSJDC?M{u=Wd#ouFojp9wrZ&&;)=D$*0^8bwDgZcgq#gF6rzbZbK z?>|#q^8bV47xR5j-hUALmoq?6;RIehbf=u2%dY>#0{< z@^hc!vS0SF;<665OYus+e_in_`2KyxZ{vCQ0mUEV`>z$3{?y}eV&^S<-%Ifwd_PR_ zW0Gxqm!|kw=2H}(z6i*&uD94D+iLKb`rFihs}dn-yQr@(qgL z%={_EWxwnd#ka8h9~FO;d6VK#Gyg*IJlI(a{657Oupj?QahXT#R9xDNJ&LEYoxA?eISp_c)zL6@Q-fOdj5`Tn2Ibc820T zn9orBV%9%T@dD;QQ(WwSnc^~UU9R{B*0WCW1?*=(SNsXS->moxeE&PoRs2_cAIJ8Vc<*8^6ix zieJzAXDBY^agO4bv;IpIe~a_AQ1L%8uTp#;^Q#p95Az!oZ)JYF;(kv51B!QN{+Qx} zm_M)haOQ6+eiHK!6hEE$0maW_-ktklDX-sh`ui!qoB0sMrF@T9TweavNkAoh{^c%PCV!S>mqcoy@g6whJ) zlHv=Q|3Pu7kAGGCS1kWe#UEn+wc?G;!@Tb*`T8m6x3}WwGasb*MlQz@if?8;Bo#O8?-=MgRJMUEdF_wQ&@m3K{)?NE4{v6AXQ2f`-Cn(;X>&q#M%Q!Mi z@lRRLIf{SH{1U~FFkh?q1djJc#cyMNtKzlH?^gVB<|}#MQtVT}?SGx(uQC6v;>)=I zkbP9qBjd@BmAs56KUKVh_4s)IQ}kprpQiX?u2<(MzK6NIhb4L*U|yo+cQLS2=tJBv*H{fz~;E7Le>q{@l?&&Wf5($+zSy!uq!> zJ+hwml;ZOJkyn-eFvszU!^b=Eexvl9%klo`aLU&!oG(AWFD&Vl_u1tAZsH_=3`g8o z$;*4B!yHcXH?n++!^v)Eb7D_$ILTMX;{(T7hm(9R%b&rV%8}4TB#dK`;#XMgZB%?K z^G3yAVZKlC7Um&-Us&QDhWP0itGN8G;2g!}_XG2oi=8iE|GY-=0_OKPdM4N?&F2m! zzl6*835SzC<$GUGIh^cS%=Uaq=`Z3q-ge|kk9;5LJ%^K?nGb_g-baetN7I{e}dvtj%O&|#PZq9#r})<{$jq5sU-WNrILQy`Zsi|vILXUmuKddJ{aNOc>lK&~o-{)|WU(WLPJDlVTSpE@*ll%)T|AfOyzKG>t zVlMWdf@gHRueg-^r;2Z~;@*#n|AP4tE;sRqX7-14#V=!jI$iN^Sbmn`KQKRE@gVCd zP`o#D>Gvc(6PT}3@>7{#ulP*nw<&%;^ZOMqV7^oFH0IAMF74o(iVtV`1BzEM|4Q+z znD^kpC6%v~EfviW=3<8<9R4`PrM()jxQt`ZP+Z!pvzSx78SD#mx>(5%;`>6yCEiNK zCEhiPOS`v0aY@ge%qcymIO+MNlAp}?k2sv_QCu$@=n02YJ(6_3#9Z_zaU5?eK8pF@ z6zA&beXjJ^aXI>V{3Yde6Z4+TDc)0AH=Twm`EyzCPaID9I-Bz)-+LDQlCKO$p7Ja9 zpQ(5WXF$f?l%CTlA$%;*@|>Ou#TT=ls}wJ1exu^m%r`5(g82^SlAbtD&$~)~6WjAE zNB(q4JkD)Oel@4RCl9j4Zj%0?ic9)OD=z8JU{2|zcqN?|JNyhMJ&Tl{pL2Su9ZuzY zJD2YYhf_Jq_x090oaFz*^4B?>3xdd!Fmodr*a|t*Wy1N z-zq-cVy_>E6Zu@`$17gPd@^(KANk(sIf~!M{#mMcDfhdTivNP;uT=bT=GQC!0`uDx z|2^|2S9`zVC37f05Tr^mb)-+3 zOL}-X<9+Y&2;}96=SiLT!_%D30S>2lzvg%cJKRm@NQaaBIel#mqa9B2^4@#8!%1F# ze>KD5B!3V4@hs+)uL$^D{HJ4q;wvroRw_L*pSjhM&tzFTZBz0xUir1dDV<+(z8-hD zYlr6@PV$rbk#@|39ZvH1alU@KpIPV&e0 z#|MtD98U7`dpJIxe3G5XKF5(Tjv)@uvdDanVlMu(pZ#Z|!ztc#Io>G_r+B5`neK3s zzk}to9ZvFMw_Jyl{5LFrk;6$|>{jG(lFvxQ2aXbllf2li#^EHthUHf}oaDuBbd0Dso$l)ZvXaGKN z{KMfSFY|@Z98U88VEO+z+_l5^4kvl}eZn?}lf1N7y?HW5b|d@na;P^Rdo1?mD!!X}q2eDhuVya(T*K}B4T`T}zFqN4d3^ko;wN!^->vv%EdP7O<$c}1 zDlYHk{!4Lr-}R8<@_RTwo_tEa$~oR%iq|n8s<_N6Mk)RqmQPpwW#(Cm%X`#w6qomG z=PNG1dsC{o{7%kt#pOMd^@_{;W*Zfk_j2!5T;9vwp}4%4`?TWkaeiM>Tz>cFUB%`1 zUjDAQ{NBrFieJq8D=mu4@9+e9GB4%(8Kh)R@^tiR)7-~m-o6e6qomqXDBZ7 z!1ELz!usyTyBcYZo&*{Q2c7>qvJ7qGInEEHsl$_oA`dW!`amgd0p`ozJJHz zJhd|9L&f9xzRBS{^fshfaY^@=4(FkhAuWnG@xAq`1iEJKSAA zEK&S9PEUoy-Ff{=#ZPAWT8BrN(Wy@H8~NErhi5wScPc)gpKW!xJO64>T;v~fxI6E7 zM)A*C|1drW@mzd_koXdDx1G#&z~UU?)vA=4tM?YJ%_vgd1A0VJ+6P| zINbHm^`Ulo*FW!dxa*%!JKXipGJfxj^6UEN-yQDyXRE_q|Lo5VFX?gp^Gb)i{@FLa zJ^ikKp6PJcKi%KocK!1XN8a_%#~tqar~JJ;N~i0epE&Zaf95B&r_=S%I)_KBi23}3 z!!sS;y}P}kcwPU@cDU=G-k6%=l{I4)uc*$eSX@w(S6IH3Kwfb{)#6ooMa9)MRpqO^ zF;&Hj3%Za*sN$&LqT-sG(j~>^3yTU6s;GFuvPF3X3l>xrFSikS6j60?)$-E9;=F>Q z%a&EwyoH5JYZiMI<%<`4Wu^GY%Y!3OZc57X z78aB)_Nq%4EiG8=Ehd9_W0scJ6pxvC&iN-9DOYcM?Bd-u)ukQ0ePK~v6jd+ID_FW} zL3z=typn?Iyame^E-bDpF3PJaF0fJ^Q@l8@cu6S=c~$k|@{=m>*Q@;;MxOXfjc~s|&p2ipGr3@QzzKW}NxN z2f!2q%qKpI#!Q$@V7&PpXFl-(Jjr15InI3I132Aa^Eu9Z;sbc1!RB+E`NRkC1cS}z zIP*CH880s?s3{mzSY0z=yb;1D5@0^Z*=vKx8Eihs+0STLm|@%)FvM`Okusm-%%?m0 za5}vI<>j>)=kSoML&&+)(P83vn8z>j&{DbcyvuM&Oo@4sc99NOJPeDn+Y$J`h0l*l z+6x`N9)UF@$+=Hk`Hl8u-rc8s@~|knK16?qHCFsvIh@R=__kAApCEj!_?tNXBn~(O zXBtxK_zxm*toWbfaFTw$?G)DmgpU<}ON{)}5K_ngRu}Qh`}#d3Vm|A*Uh5+Mx@T+v zH~%!$)A8R87AyZ35yWw|Jw-ot{I}zYW+c3o zr2v|d?8-(P!i~QtkdFTzIAyH(>)=;(OtGivr;h6mgx8FO=kBsWcH5Kj|K7OP@n>}r z|89=|3O=)%PH~;yMf`o9wIQ0g9LfHDW5iGM*;x5MjptvI-mc=Gj?BjjKmC6gek#Jp zvfr0n0h2glN`GRk^ds_E@z3V?WnH1G^p8d0Sn-FSw;^gtISz_{ApVOzBwb6pi2t1s zg~H#{F`w-pI&&PPani3`ULdU-wSTmBGOAl~J zJ}Li0@L$JIamR}P9gbh?*7vk_5G(wjIQ(OH?jAb)@pz~i$(QV=PrTP*PxiZGxYp^v z8-5Zi{;OHAiNniD$8|fxYeuq>JvPLb9FXjnjQ=|R#}Rp~_=|X6K8nN3Nyqg;7vXQ@ z@c*a&^MWq&-@xJBH4sXJj{n>)@_+J6HpSVTaLWG({MY&44u!Gu|2K|b{#X3!0SOLn^@aFbo__A=)Y=TwqYbZ`46op>iGR# z z&nW+73myMoyRiT6|6%-p?!x|~V#H7Dr#k-6!D5yFupW4TgPyyG&i}vgP&1N`aQw3W zLiwk*NXLI|$j0xk?NazK4fb%zeuKTUvUE*prXz>L_p`Ur&x&65G9^mvg``#Z3@(2q z=56HgwKQmO4vAL~{e5Q9DU8lvzH0BXkv=*o|5NZ^=b!vb>jd)pjHFNe{Y#XuduZ9K zx&F8^be%iOlE1o(%RoB(nl9RpDZjJf?_6TflzvjB(|;)xYMm5fOc8y0-aG1{y7evq zh-JTbGOT0-_N9a3r*&@~Kkf67q_i`*G{=v{_WYpg0407o(=;zu_y;!I@E6!q^i#sg z`6RBtQ31YaKF^Td#ijt5Qba3rbnm;BqO_*=0EAIpAyrrMacvSPAd7XC|k zX_t~Ye$glAr2FjEzqlO|uG2rHi})YQ>>U4eDADo%9Oc_7?-bb%8{=GV2T0pl_^-p$ zQdn`-n8GpTV^ioj*?ig$du=}_O`K@pxXBrlCK{BVu;$F!GyJ~x9QnMbWBT$l54Wc< zVv-fX-=+0=ZR>sS9$oF*{@o(~_LjWB_HQqY+kR+HaQo3|UOm#eG3<-9j`nKj(Yd*s z*Ltv<*ErCNH2$NPHxBzSxsw|rt%m~Mj&B0K9WC!iTBr2zo@}}H)m6#eyvhynUM`xR zjje&?wDo_{J$Fi(I=bdyL+@uF1cZ5 zMxAfUq>>$x*6=mZ9q(0k_qB)F2fY-gDPaEc;HLauEt8u9{der;`*r?EM zEt6~gUSs}WeT{W^=FP61w>L0wN68CbE2Yaz@ODys15*5r@zb*!hfImj2tVVsmb?ag z_=b%iJU2e0|8rhz_;+4w{B(cg5!fIf@_Pe=sMI$_61;Q@@9R@LFaD;i#?e8qZ~RUE z#uZO_txdzTXk}niZMT-m8Qr|T$$`OTnMc}kzky9KWZT%>jpDHXr~1O56@ zoHJ2A(@{>-P+nQvkFL(#j`FMD9msoso6p;s^eF6qsBLHXqs+!+-@vl9ZEd-?A#c7H zk&m{voj&}BjZFHs{@9kj9C=@c{Q94T4B}12SD9*IM@k!|<>R)tLBdnOC-Acmy5M5} zx7BmfhpvdG&YS%39akqYveO!}3v9=>I+tuk&qOE1-3YzJj;?+d`S-yNe%K=be~sII zG~m_4XLd9N{5uZeKm5`7&$nQi-N-i*O}?LokA}U(w=fU->O+6s<|9FG=fE|QTMr{{ zG*gLBJ`!m?AGU1xE7`EWvEkNTRIZ6T_Q5|)nqa%(kR24~?Zn?gJ$LgWuN`nmfIXiNec(U-Rs^gnUdV-Rc3@W@X$bwxm;TNwqkWWyWT41xItDoDB zzirz3?S+2WD!{h#!A7Qq+C=sDNyPE=kVxy6fnMdO=z7s4CLV!)y1xwfO}M@htgfGT z?lOOPgOp*^pSpYW=Ua^r3Cjno>*bxhyn{U3Frl;j))*|m1G8aMIxy?cDe;KQtL<0k z4|k6lUpPj5F<5>KmJ)+SVzF*+95$_6LoTyv-3@lf;kKQ(T@|_YP(q}&&L7E0-tJZA zhse&>PaFK+TlugX`5pOOZP1%|#7{nzyko_WZBLFyS%7cE|N7&d>k-a%igSI8bB#5W zXjoLJ=rt~)*I1{EUUS_waiJ@Xa`H_{1G>QIHF}!Fre5e5=1hZMX2JI&tw&eCVtkV7 zZYz9I*WK`Qk=CTgBdsl{kKY9RY2=fK(Wg+~@h$R9`o9e%;eJqBQXta$A?n_sQ!_K# z{Qb*rM7{E%%_P6u2cJipHZ`G+He9x1N&|-M$K@Zq+QSDA`>7M`4$k=)a(YywLj z>{UjNwi&zc*WQ*;9O3?v)&`WvN06a( zQr&gyW2?!#t&d?3<-E;Tx!3RIhU0MkuCH<}U5D*;DqZ)$^&Vg49@O(@*dYGw$drUc zuYT(9eU;av4IDk-`pxkrrBfoly3JD$dX;ODhw!k-6w0HQSi3nK_UaD?Yv+ARbvw?h zKg$=%Sc7K;(AORD({(DYKMRC+%<_2|i}8H%SIJY#f?oZ@ZEfj?kdHFtKaBhT;2Qpx zMs3N_)w{O;P#$BPfOfYn(Dz;Vf*C824XItB@j^o&xn=M(k=7w|XJt^CpiI-KkEec^ z?zi~8%52;p?6ze{c)*q+Xp<{5`T0bj`Rfy#42!p6Hib6P@}FU;F<3zimYUExY-S8r z2i?g*_z7%Nhu6QPEn5!1D?!<3_mZ-=Y2V$`n`p-qb{vDYIIT9$OPBnmBOjF3rhu0& zc{-n2gczswe4I%RW88GfQ#vyYD$^xT%a|d3>5`{(4rWsGnW z_fGTI?*l7zcoP`u$%j1Iww?WI}H^NbO<&9sALL z9H4QCZ|eJ0MwGudP_IicKFMU8`tP;l(URe_GU|dUJa(q>jvY^0jOBOIQb+eG1;vcksaNY6gxB^7ly6#v%4ZRuk7wQNhWyKD2>Lv88V{&v4>LL6-$_%m8@CLNKu_VV2aCVA7oE51W* z=*37&Jn}tjQT*LgkZ-YbJmzczriJSdBJbN^FY;lu!?%p~dG#Y!m9!kdSOY$@F$?+j zrBFWYcw{c@m@?F>-!{$vuD`dnZ6wq(`FoTR)>hM~O>YVewf$=EmdUMPKY%qGo}Bjm z%L(-lAuQFe%ig$R3i^(|Q+)|#KMcBONV3l>qyA+#l=;v<-Os^2`g!vl_6eVtosn>1xIP*Ed|ejm?|{0^@nt1b!smtSvz@*^{+P%V zs$b@LyjTAz`g-cislTSad<&jYU*ChT$@ZTI;&)tzzWye#o6y(a2-#nAU%wb_0_LWs zukYyp1CYM~J0h^#DX=B%8?`0*=)QpUhY&cG+jnSxrED)bsoke*Axq^&?ZUx+kyaXS z)pql8OS^eb4n}){iiC1VGQKtSMcZy*O#tHnFSi9_$mSW5#?l#CjR`1&9F%QImcOxi zJjQPU?<*>o>ApKRhkahZc;A2tr8Dd^DyJs++umeq2Yu(o`x2wi!ts9G_c!-Hpgw$m zEaE`DOWK3=4qv!_e_+^-wmDv7%LuQv`BvX{O8Yjnr{ZfZ7`tvoopqV`7|9--6KRA$ ze$|XIO~NtZ^RV}o*o=7c(RN@t>noq{dRkT6lt0AVxtIH7x{thvvDYBPnGD_!`V{Iz zhI_5~127+*nwgOuOhOYJX{2_8@{p43r8lgf-!cnfN1fy~ZVz1aOf&3}(KE4M*cTc< zwST0t8EL|}CU@!yk;-j2n{tBv_f55a;tlnlq;e&`ADqgN%Cqfd+aHEu&jT29i;O&{ za-%dP_x395;5$=CL@L8rTk*BDU65{ zB^tk2AB9ZXUX+XYLu>CyYlOx)4m0J7v>W~K?-D=!epQc*wT>TAzwX|(SM}*vg1T@j=13&>9sW~V zD1XDS#z5;Ft5HU$2E3iCFh4=PwYJ0B#Mzij)djq_A_1CvTD}$YoaWxBhw$M9vzF2y z3dP<*Y@{zlK)E@$aZ_#p0z!_ z^yU$f)`QTqztC5|4f$;z>$Q&Zh0khUguGy0N8=jtee(OJ?g%p$^%iyXTI6LP>X(!) zm8*>5Za&(+el>^WU{Bxiw(RzE-fH8$^#5k-+Ay9YZF><`%Df5VV@h)iY!~Qj_4$2C zZ%Ll$SpfHIcBg!{7yTFcR#U*%FR8ntYj@B~k05Q$r$!pXSTo!|Fw!~#>rYbWePVCa zd8+#+|Btt&ry`$G9e-|{Nb(0y$;=>I?Z6n2;#u#H-!R=5|CWqR{^r<&=JBr0sBA`vr%|jLnU3iABN8$J#S$BQPQ*?N9l_51!(DglXpdO|CI0A()XiZqc|`QG<96sgV(`H?&#_l zwts`Rp4Jt^SpOa6^Crhi6UovX8ShmkHu%DmvwhD@4o}Z)q&YCIE<>X*#if$A~Uvo-g{ty=SA;`Z>WWK)-iAI@xS<}qd-#yfihc79B4OE&6p z$-r3|VSm_+-6>73e^C5kUshun^A2j;{N@U=s8W+MG$`!lyAKV}`hInZ9GY3D3#QXhZC{gI^t!F*N0rTwLiwA&_neG?-ta@qg;F#JCc6P0n;LAvrGOO$-wV{ zzngreuQCc4P0&{C+&?%Gv-|Dxo#hp^!0C-YV=jU^=^L3qJGPso@7d$@J^K-#^gmdOP8a*SX-swOap6Gt0P;+2e?bR5 z1EB~0iMBswfL)J(T})p@b)IZP^+u=s`6AF`M*-%&*_bycAf6lW>`2I~-*Oo1qgO_5nN>DsN*($UivKf|IrUw6WuvAv zWBeCC0P{hgS9t_`SxMiw?WA?c@6iVbp{Ha-r1i;=*LO91WYl-)tKskY*aO@KAECT@ zm;<_VWU={9=y%K2`?l>#V^fslfRWi5VfYOB%d^Ad?2-@u%|p>9u8-h;_vw`0k|7?#cnD*kQ{VZz z7rXDIF-5HYBNJ^3{10n^;s3f8Nb$G5?3q3GLv#Ec_SLr|z0xN%ck^1~PqXa|*)Tjf z(pZ8%jr!~GwyZ|0e3q=<4UUAI8|q*du^;9`6vOVP8KF_c^Kv@cjc0DXDRHCu*Yuj1SuxIQU3^O+ZY-OIi}y+U0o`_E6d3~BTA zx@GLnKjD99q~QA3D*zD zIP^8_pYDVFr1*^5e!io1s28-iP3zCne!A}hki5(XVvWb)d!`<{_NH`GyGM3CY{rc* z|JQxBfw1k7Kpe&&0kbbobAIfr+5Q*)LiUAWcCL5{b4R47GKq*QR-#%yaUQKk_;03*0@?TK2WU@Rw}#Z4Lf#0=>5Zd*>qZ#8JP+*e~Qw z9(@AVy|{l!#h8%tCv68^Pl2AX}u!a#NEC_;$DIAMai4!E0Ldk`14lW zlN{9@`1B6aFZYxOVN|c_8Qy^~bDFO9^G5%~ro9FAgT}Ko@1=e7C%Yw0#yhQ5Em#w4 z4Wy?{?dDZ&LtS|3zN|)Rqe%aY{^Y9Hk@r$suOCo11Z!HAgZf@SWNNqMsy#dwqH%i( z##8jH8MYV=TaM~mhqX3JZ(?+8l8-$l>MNf?-6p+tkRzQmcA-7Vy^yCkJ?PT*qIyiv z63EWnXIuS)(#Su>cTJy-ImG!#dQW0|89P0N_PT)DEYwNjCGZu}=jN3-G3+r8T6wq| z?=jfDvtNN>Zl1Om>4?UKw0M7_GVaW2Zgyyn&%DP#GT*Ro$B^A*-`nVq`a=6NFJY+R zB~ttI?S($*Kzoe#hw4BIe4F;0_o6P)`y=<`yd{+KRRH~WSN3vk(C#Z)&`ojKdb!*m zX}ulmFuRxbgwN6bwB67D(+dMvVZ(eQ>4p>H-6uQ8rRV?HHE>WdA{zKHDSMS!6{jdH^6?wQ8zvv+-FkB7qIW7tVXhv&lkUe$|7ZO%Ot!`nz$h$ zvg$JQ4OmZ~l+(S>q|4BEBy_KsBzdmox@6kURejCey>3V(W7MENlh)!H>6CZhw)W|4 zdkOzI;-Yaixud+%yKpqGvu*nzQ>RH! zOJGo1Dz916n9ufONoMRO{ZX zlEdD(-Cwrl=7;gVBIdJiycAcTjC9jpC$*`C`y#E!!8bpFoym3!(C$;4+=Tf8>1z6- zZ4wqM63tu~;kMCQ7>Bzbvix4pCJ*cF$tR*Nqko`q`d*mq{R<^@Q{8=JC*S#_)oH1 zJsMxx_TS#i`vY<%Mdt4900?(vQA zS%jgqd55vi%WEa5-?^h<(^09f4=Kgm82*2m?@(K=_%X@fgEZ5*EkNyO2zKoT`-WlX zc-T7u?PvGxN7uKn+kG2|OZyIeX$#s%YDbUoniaLDq=(v3stZ3LJ*XpQ{f^e|4)yk0 z2W-u1L~M<YJnQ7q-54LuecLgFCTVVfl zBfj5UUwF&(?Zsmtd#h*mwD$3Soqg}f#yKkBZ3yp4-$3C9KgfL(_MSwaoDU z8EBqkuO%1sq&Dm<)TtcQty!pJ*{EwX(T2^yx-z$6v_9{fGFg0y_SW`u8nD-ro`ABD zv>PA58s>f{9h6q@hqm;>tgOaDv=63j>vqxPB-j__%}u*I-?y1Z!`U*Li5W>b(4D z{%Bu@`j2q>+3%rUtRIf|S;VKQtXuG3%K8P!(lct;scn{ad84$4)9iO1j$pqu`u_N| z_U}7T+t=L9qkf_F{&?(<&!2_&JLtV~yN2Hk`>#cNZS&jSzft`hfOrSu|B4}T_1MU+ zr|&%kz)OCHbpzT*4Ph)8IC*l(r`WfFjZ4O$Jkzoo{aE|U^8#fH#$b&BZ9An|_R>mb zU@h!ilpSn^G#NX~c%1a0-s~)e9_lYj5uSX>wsD*`v~T-SXZC;J_T*qn3&PYPZVGc5 z;-+_Xd}b^VHgjNEMEydy>W< zR94MuJt!4%$Xxme_U6p@7qD+c@0U{D`i9GA)W*z=I;{D7P2KAE+V_zXNv3T*?K#Dv zZUs@tLa1xqQ0Kzv$Ko-MYwyQsK1XF}_MF0z#&{3wm0{2L|7g!^J)w`6`yI-X)>1Q4 z(0}2*h!%QBrdI?u3~wkq#_KyY5PoY7?DAN@3%RV2gOjC*XND_R@2PdX4d^Ud9E`bqH%;|2PBh z9pfFX`4b|IThNYuhBo*+_}nFfXm4{cz4yEW@874-6#8!$}%zjK7_TWLHORp2;?<8Fwi`Y zzz?z@Bkv8ABt(!`>WjR-WSfidJP&p#g)h~iT_GE$!QRP%gwNJNXBp(Tzy~PI5u9g1 z{xZl?JSo0G8&V;g-y*YDpXU#e1Ja6v#0GYYdvc2hN&OS5uOmEtpbIv()TCSIUX6AG+Wmz?TI4i~e zW>iXbSxpN4NLtGBlJe@Bl#$i{AA4^DAJLZEr;ly&BWE0}VCW${3$1#aX zBulcTSeDlMuw`(&UTas<#*$X-uKYn$Fc3n3lq4iT3IPQg+5n*#2#`WrQb?&w^Uy%) z)3k5eH+>sQ+J=WfDNWn7y#I5~oI7*xt}KW4d7r+&U-xI#h_9{Pl-cgBovO}E3pd%4Fn3jMx_GGI$rs5e2c@j4tn*e?R#o^y$bn58)46%5vsx;pr%SVwP2SdA zr8w>}ai&<|emy{>>$oGiS>Ym_F2w0l>EQgF-=9uOZhX8jSEWuKoy{GXE}+WvL~%Bs zo|~SZEY7AcUsbuh$pfKqM0C8Wf-2{(OZV>?9?tfTjAXJ~2fO#C=~IJ+G(K_$v%rVM zsA<_8e>o4Wx-Olo;2p{8b!mLKF1>1+Oo}q$b9I%e+(G&>AH6^s$T=|D-=EH5#8B}A zxqKSdm!2u*3v6A73kSqpJ%n8rRj98nl|4tLmfVq?AO<&H;UTQsS7oyxCH^GKY_nr6)?|^lafUCxQ$}gd{nfQBW!$4P=$C1&Y-8%3i6Ak#!~7k)F$y zxz~!b_{!rPeYw!lR25(DtBAVr%|S`ddl_xjs!AFk=}Q;5hw|yttTToO2Y05c<)bu! z(RKK|97cVioaIJ{7&Jc9@<~N^n3JAzd3@ZFzH`aLuT;*mZ(x-djufku9hDsb0}+-! zAn8ry4wdGqU1|DIU1=U&?sjqc$Xuy{PP#H(KEmB?dRx?|pKBxxpUXtabk27~vuQC$ zW7PP5B#g?Nn?HaNkDkE?3QOgJW2of0jD@l*n3 zu6*>h^c_5pQXt;+^!!zHSw|NkdgD{`v-Iga$TX8Xaur+`1evFb$8-1|q?hFn4W`TZ zl3#ficC#uk4wVi1!2HY{Xyqdl)1|{{`S>B*+(fRNUX85lkbjMQU=S9VPh&jtC-COL z57v>Vj~q6!IeV+dPHXaZnqfXV)Q5~|8fvKe4fFVVX_F@{#c-V|RHsV$%8kZDAV+R` z=CzlgrH3n*c=$Zw}CUzb4{XbDI+zcGfHg@o2IP_6K%oMW+(=;)#FCxF>419dW zkJI5x=8y^R@U2?Ed3t(`u45iFH(NS9o1VevJ*!9OWc(1T@{#O3w4p<0XJIDI-x!1k zhXs|7sH$kru;Rdxq=yH(w~lTj;Z{+fTt}Iq2=a*sicpmpulf8Z$xqc#zHwAQ%#Dqa z37cf!p@g!C1?LO+U?m$ic_wB-4hS8Tn}KW0mXCNCZ3xc)zxe&k{K9qh8bZX&D0m0r z5c);D{0Rdd$5Pag1hCh|7-KVme-Uq&f|l{PGG6I39#=4JNOA8UBD)q8TW>QexH*tf zF}z%1>K#{bERaz#eE~k=jVq|ll&Xb~y@p%5-XzVLdkjw(FWhesZEMuKGp>!*ws1z3 zSL>vVwl0CfHDbqse@>0wf+Dy0-B#2OjHwV2uUJP0&sXlWuQM!Fg1^N?7&F-*qrGM8%4jdl*}9~dy@nYtHw^nNV+AeaNwxUAWvq2Q z;FBh8Edqt>(sb{rCs(735KCTOB6D zK68(Fllu**Wzo5}8`AwY*8>K8&?gmMG$6bt|G+D5z!pndZNMunNx}6#X-OTfH+89B zjd{0u3p!9zKA$PA&9Yu{xGC!qQw6g&uzw5p#uk%e^{B!uTI5la@|d~Dyg6?{k>?B% z7UnZBK)7m6Uulads9&jsf7e`kUyRFgpUW-@$)+%U42ga)C;{v>+zhSle%}Q0PaCl6bIIHC0)@F~y2^=OQ1BU(hOwpKvp(sR z`$}yLk%5BB4JuX8GTvpX@NbJrY#qpug31j>prB<;54i+>Va93%TTCuYcHV*_)-om) z)G9FFD)_8hG*B6krRpPdsjY6Rwz`RMbyRYx+R`S2vcsg=Ye+Ae`zg$$Ca3>VT9}KP zvsy&N8&fdvGtN{E_?S<^Gs?kVSU-1|2xNYyXHB+lJ~-+s4t6BDb3oAVwDyx!)3Fe(-qQ65|VsJYk861x22=#N>h^&sk!_ zf+DoLNI%q`T2Mr12o_$EEjDLlL6M9lMi&&xTViZMkt3EEUrqtL5bICt=+YSRBv!uHW z_^>5CYrtFav@iWo@KFOkVM#AHNa~~h=gkTy4A|?BtHQ$ue8G~Wn7uBh;wOxX$+;=4 zx~9cy$XIx?HClMmS4>_N^PsPoyeh_OA+K6E-Xd~=|Dy(c(QjY=CkCX?SdD$xFB!n-0_8!|lT^RLj~E(;bElvZa4fYyVs4l8*_u1%_+CmMFZlPXk2DlFNh&QZYcS@Qn8K(_aHFwlbF9gu< z0doiGelwnQT*bWg>4h;fqVOIt|B&yy27J!krH&S3X)Aq;%ZwTDR!h>+sKy9(Pny*4 z+FVkVy@va%HPjObi^AFjNyotb{z#b$YZtk~ss%}vc)zc%DFt8fNh1nwF&e~%QCeZE z)hPv4yOd2~)ijA=l#ln`_($0kRX#gsD>N!Q`@3k%x>%9`!Y|S2c2%KT+>}E;No$sR5_PdMN=lsL+9d zNJ0hF{sKvZ3LO|AEyWn$iQ}Jgs>o_zge51VlZv4AVs6AY0|R;hsjdi;%U;9wdeZui`Awd#%Us)MRXlBL5@@md z(mv~hVb=I^&{AAdq1MN}UwQFO3(82v5$dV(YV{?`C}{h)sJvTkSJt+E$z64wS#L2T z69%u~y*_E|K?Caejd-tLsu7QwB2V~SmMrqLX^GA)*mw%hDIkUC50Juh1xPwCr2M(| z=LrjIB^s}lXuMXU@mh(-Yb6>FPgJL{T&tC6S|xh2S^6a6P1i~^T`SRatwhrrn&{LC zUQ2bfN~BQ&9!XPBJCY_~l~N-DqJ_mIT3Ak^g#{&ASa(EQO4MgU21Zf7%B6qegJ=pr z>W7SbUov2;IW@)1^`y7OAUIp)A6(uY27Jhpw3Sboz=w;zQc>Z8R8rL-NXlB{Cy>JW z11YRNkiyynX(@@GGsM4`>h5Z_Y|obB9wQp0c{J%w1uiX zVyEyqCW3@QANLfw(h$LJy#YHcDXbl0r|NmxWv2={Zu|$=p~wl}sf_7>dESziQe+*i zEmy5+%OTftZMt?Y(dx**T;*3+NBLCz7mQd$TS~4ML!*NO1{F+)0uvuK#{HNz@}-#n zB*Yw{dzdvyOL2MGaM^5ZkOr&5YJ}LDRn9t&Dch;CwrqS?uWU}iJ$D$v`u#yNreMY= zEqSbCQx=lO=#6JYBVfzMYDK0I>(VXz7zp1AT*zap*O2u04`+_O;6x}{4qeDqu0ZdXy zl8$|lbof8%kNJ$cfoCj9LF*ZoRO|gl?uY!QWE9lS#z6L`Ln~!QrBpd6+fs^C?I`P0 z7=M?V=ILr1n@~&DqUoy*fF4zFqao2lFPR0!x@|@U_xq%AbrI7(DRabtX}b?@DE=)R z^BcSH_M05+)xxZqsLUU9b1L$XA>usIK>jUUqb6u8p#}v{_*}-HHemeJo6>KJJn3^O z)N)yJ5vyEuw84J-k*6xaE`WmCaLT5&=|LdT6n@bcYRo|XEvz7|*=i%NoUJzUesKeY zxu}45nRILvsthmrB(2J47UrS}TWk>p@%3N+VJ^7TfVvz%h3P>VulE`I2hsX821cPi z8uO69V?5PwHfN{&P1-5trT4`eaiw3^kb)2Uq=M>J>qH=^bv)$Pbx^mBU$i9MBYGw- z%uXSKR2?c~9$;bCOdK;zr_CM2$U?YA&Z(`}dsqu6t@8!b9Ok5mZDT%es@Gjugci#U zX}`HgynPDl7GlD?#d}p`L3a`#ux-G>nn6@+T(fSo*KFegu9Ij?(nT< zLOWFz4tE_^H%MWbPQj_GyU^#muxp@o9rI13P+QlMjTkYF==Hhe)%2$=Ng1E8B<;25 zeTC)KB=jCO4Rr|iU}jPqVMpHNl&Qn&a8j$+I%x+Y)UP0EwR#U%-(h@wukY)Z^hvKl7(4CtX zw1>2NPN7>)7!9a9IEB4$?cvo1a6%lM%kmF%LyG}hElCUNJ!~SIO+tscV@<20yw{Qx z)Q*S5x0uxX%pG%bT;YfOl1s*;Ca3@B;LtFgx%Bx@G;F3_{|H7 zRDA)LG_E>)ygGcwv>|#AE4r2s4g^&mbtG{0T3+vq@zIXMvmTmN@8KfaTC31PtwNVn z#2tpc<&v-Eq76||YMuhq1dS8W-wKZSR$HtZ&_3)}JZ9#chyA%{$;F@6r3U3Zlb84F zDk!LR%JcDxJ?>Yxq=K}%OAUa)P{C(>($upCw5^@ex{momP3coa_gPY{0;UWr{}%3e zO-LI6`=$!o>L<1OC;hr6YwKEau32g7P{!<0mG#SpH4{@tr7h;p#BhyFG%WpFxP4lu zb|JzFt9&VP>;|73M6Vs z=lBv0DR`w%$}6b6UxBsSVKS_sj%Es?O&yl;DUUy=>4u4a3lFvylky6RC@*V%83i9V zY3T2l47l7zWD4s1CjF_{3pQiQthjp39qe?if2$!GTQIZBYI8?M1@{?}WK`^Sn^D0n z36b=bS=UCtrMnb-&X;!FGu7ymd9T3JjQEU)6trvWyfRjyPhl;p;;l5k2cbrCK@rba z`h!+Em{aDCIYdE~kk;%*Zk3Op*Hom% z?}&^(p4;J*CTrzKt+nzKG4u<|uOZ-w5fu-E9*Zm}rXtcxTP0I5h!$dAv-Hw;kdOIY zRAbvP_plX%v=rm}48v!A#u;tC4jw37N6eHzVlqoHe$FtoBRP{dde`9##t$0OLw=WJ zbW>LwgIv#=YV8i_lGUqt-39;`1*iPF#&0!Xs~PsMU}#!Tyi38C{kkUOruEuyr?9i6 z66-)fgr}e`!La$SjMZ>K(ndV%w`=NAqp-)#9l1^z@Oewp8ucDFX{GDrgV0bxJN@6R zpcQgLg|w}|SwU-O6AId<6tpS2zkLb@tU~J4i*>SsDj8ywT8WliTJ{>wbLI{U(z^5> zR@i=%(BZqQyn?!%!(d;ou+><;R=&JyOw~grRX;%4No z^hYqhgc@Qd&Zo%BHlKplDwhnBRS#MP9A&u4cnIdw1+C3G zCT*s#j&KicHs+zW0biy=ddhaag5NbHjA);u0%6X2D61OA*{X7W+UI;wOY1$%G-Oq-dlW;GCH1A z3}{~^vDIh#O|`bJjOxvvA!H0!|F)RkT5Rc&FC{Vz+${x{UW;*RBpt3 z*Mee}_kZNkr?fvGj)&iQd+`-<<nR?!&+I8TV-!KD&+xM`cA2)ZN@4ssh?I$KG zvfP(_$p!B#XRc!rYdF=Boq3l$fjOz%t9`kP+H=}%6p5Hr?GBJ`G1|Pt*SVUsQBQ3= zrd~xiPT+$Sv~^8rUHv}engvqi%*d+K&rZZnZ$0n))6a~I;*=7khnYUyH|76PE$-yyO{tYq%8IZ)k2tLW;oV<{JPut_A0_k{!!G zu(d6AIyfaRZzGLvgd1K9c6MInonZ$JiGM$CLw1L~%#D{=$nprN-Th`2tJ(udEg!702iL5M^g9WFw zz4NURPV>AK?|N$l)VsGr@big$&(`Hs`%1v5hrkO6G~^3yQ$6pZIJ8LWA^ANoy&BT5 z#2-GpnCMJ}+?P0+fWFF4Ly1c-gE_213GcGABbL$Sr-4!5*~E1-imW~ty&_8Tyfr?8 zlvl4sDauAYfiL!ZS0o&5UK#GNX6>-6{2pp1wXgNNgwb`T7n-T@>m4OFQ$K8Q>)g^t z{okHov$>kvkPu~TblQNHUSrYb=F^&6nm2>EX&Ll%IT&2)w;mO2_Omuq>tAyoX~uB9 zjtv$?uU{6Sf?Lj&_9EYF&x>eB+;9!cbK}`a+=5&k%Yak%PM>wcNP&V|O@p8vX-*eR z!RxlvzO#kiHQno z#CO)oO!^);4ef!NSwDlO-Kaftwx|H0*N=!djyr}h7-AICrS6YC$&E;gEXN;aH9!92 z#_=4ml$Rjil^n$-L7&TMz<)61**DeDNErR-(>IYBf+DBI-gz;+0>Mo%?#THu%a~;2 zA9BrH1-W8(-o*k&&WimIUb-cE=W0rioE`hbc22%klFyC(D<#M7d{K&@7i*aEJoC^$ z@~_}ZE#4Np3qn}@oY*B>J^aNC;(bQ!3X~N%T<*-+pCLN3<(7x|w#NQBkiIPTod7QN z(wO!lx<-X(WBgmvBY*{e$;Vqi)k8T@1|NSvlYmD-IO_?zJcSF)&GVj7;CTS}b7tm8 zF}9WWmtsE*v^$L7!s#CVu7F$Wu~4b6gm6i3J-SWmjQnXV#!}t}f-eY-8y55)$;Ne{ z$Bs)6J{LP1T5pNn{oj7{@ zTNLP3U_^oa3QPmQwZ$jnTVDf0>qj{=D*vr`lI#3U5E%Hf0^d;JI{?m& z-TAclmkgj;e`kPOekw`FBT?8eOM1EjD-^g)fp!IMP~av7b}Mi|fmsFKsK9LiS_k^5 zeUSSjkro#B^&oJ?laz8^)udCNR?7GBNPKzZ=C{-&QfEd^kNSyz=aQ8%!w;c8r_(!t zSUrAK^w_rFbRuP45y`~xYRHPnF5F69I4$}%vfn-)#!TQp_IqA9x; zO&MA=WmUbDdbI!gEqsq-A&@rucIr3uO}I5~%Etp`>g6Wd$=V)mUA(In>)r_Z@Jlr{ zuZRpscC3gDMFvqHPbzIs2QvvVWSK_38y91FBe8r9v&2Ny_P0Tnte<SBp76`mg%)2dcPMxwVt+r!aYP2W)kTfMed*RAU+)ZMT$g_Fz(d9A~FgCp$@nmSHDZz(T>=ikAq|e>ArwJ+7*2VLXt0ft2zWI<@pkf{eP)z*J*1F>XdtEf%c_|z98ifgB-~__l8Nwo4 zn}Vy=o~C-M)vZmmT5Z5it)2i88@n%;l88%OVK3a;Y% zL-?+y_g~@W&oFx%hcAWiXbP^52SWV&n!cIS74r5bS}j}NySZr=A8oqr)o%J=(@z2` z&|#MCJYAwt`)O-Dl509`d1U+~3l(0Aytyg1JTlD-m9{?{ro!?g&wy1$*q@8j7>eR_ zpuVGvoMdVVSf+5ooN-RjnYR5VG^0OQAbW>hGBfh{2zw8Wq$w}H-%;Z=Z2E8n!QHNC z>skus7Rx&1yEf#F^lR4I$do3Y)(7ebI3ee7N6oMv66Z^9A?)Q`dAkEL{82zN68Zc^ z9a?Y-9FnLY+KTxgLj$C(UYVbdHc@gBepl$eTKMEhm*i$`xvq#5FC zgs)M)#`qfNtK>;a@rJllyje1PoGrrFsOO}g8Ax|i5{p*s=4z>v%e$DwkHTJU(e?2IecBl*K_%L z9$%O9wT-VU_&1M%gs-pS>!ps);-^asmQW0r`#;uJSKfQ2 z!~RRl%i8)m`-aP|;_GF6y_~PB`MQR$ujcC&e7%ydSMhZ%U)S+9K-dP zsP34QJ!ZsEIaCmpL<=30N{(qUznovtFX

pD1^n-$rSo$FfBDDwKeSV)`o`h|-jc zx$Gr;HI9JcS8QyK)bUwybf+Y>Tkc2V6i=xfOZopZ7yI*RmP`HD9LC#OwqCyW@%1LY z?%-=bUw86#fUkpm&G2;>Ux)ZQ%-0dVj`DRkU-$5JjIVq7`Z~V8p0E4(`U`yhMZRYF zy5F^_IkBlcr<{oJ?Mbh!pZf4SXpJ4Bo+Xv)! zpWJ>`ZXcA}hvas@+&(O~kH~F7ZV$-qqjLL+-2PE+Kb6}*$?YY%{d3H1?9CEG{8t`8 z@cfQ{`$y@5|Lp>Mui}6&dcSn5)EYI^_^lFd)k+~VMoRM?l)$StpY(;~mT>cxdgK34 z2F~hPCC*ae#atdTyb;wM$eW0`ah;|FZqs(@r2K+1`;h1PreQ}fm6wkBIPoow!!%txZ$>Td(0U*b@N%Qi$~#D`Z^r+aJOr^y3JT41gAF5%o>{CiQ! zo?4@!QsUi8xzuDz%rGSp#pVqj5!)J}ZLr7{4&q%Y>^$$0D3WFfi>#(>S7}0I^&jS4 zbj@E~isy;^)GH~oMK=V|Q0ls1*|pbnx@AL|*VA^~I+p0Kw7T_In5Ge-1^**&!`@M0 zGf~@ahhX}nl`$6ld{p;ffIdPi=Aj7o3^)gNf8t(SFpHdzn2b0cbTWQ3z{@=;UE8H~ z^I?H=x;hw2p%c7Jto2#cI}u8H2b%HAK^h$)g?CPQ&$M=NUT=Fhe2Vk-ntdQX?5V@- z(SRHo>=xCY34xopf!dus#>Ul7-ES`@?fv!A+TTi9*?5^l^b;vAOeVq{yyV{iyqdVT zMx(dJE+^>UF{q-q#bgvQ@{ZWCjg-=a^yvFy9?qojqrKMX`(vai{D^1t1Fo+gPd#BLXC4U`pqAa<8vU+o0; z(b#}bicd%cNJu29zuSeP^Vvh^?1W&qlPtd( zdrB~t?0D>H!APgk&&Hl{urI`(b#i_&_MC%#DfYaBJsNw#!G0_DqJw=o_7eyDO6(;E zdo1>{gMBSVPo(0m@$~ zoQ?LWX!IqK=$GJsqX@=0CnNt76Nwo4S0fSau}5Eyi9~l1@^3Mbh>>Xg7&GXF&yL39 z&$52m>J#yd=$>usoVZ#VS^ar&V`)4FmdA~y4UvVm#f_!yBWy+7SQ^{b#rT`VT*G@Q z?UJ~$G){X}+*lfqmP_Ntw%F=d#f>#J&?vhsZtRDL>a}s#Vz$SRI5x5)ev5o3XD0rb zU^MAROYz4YY%cya2YW;O2?s03zu{n&_zA%%9En!r-*m9~_>+R2MuvAd{;jAJmi$8U z-7wSy87PN4`{UOvV=MhfP~w}GiOv58VvhLMWn%M>5z@U(M&WaWY+oie&&W;7#O9Zy zw)ns@8HF@7;=7iOdC7kPwCNm_YA0GdS)g1#2Aa1zO;`NlYnLTg0cN4r$1f0}-UUkh zLL(IOOdFxduH%;&q3CcceyI_Pk;{xwbR-vFZG>uo#^bMEcBRJw6W989bTv^K{(dw` z*^>|BvWe`f{Y!wnBnhAVT_S!Pmv(LoLEh@WpeugyzmecBkxKq8<>SJfF9xNwr|3dr zc}cn^sbAKRpQK;nEwM{Ub2-2<6N1LqOY=!t@eQW=R4U%SEak=MHEqrxk^FPfHt}26 z)6{r@@moAkUTpjpBbOMz#mK9S-(m;xYU8(t;0U8v#H0^7+m$i#q&&{9iis!Xly$Br z?TPiW710rCbVn@1$hJ-(gRwD2c!2MU?Pr8^9vzD18R3C25}RU#r;pLt%@)}mJLn}l z(6VbuU8#nPHq)KtX-LbTC?y6B7sr{-@FhtvSw;zV>-(e8iyN5ThIZ6?RfETFl0Er# z4O8MYIsCYxVa~W^a>O?_91)CL+tF~$!8#jmcd)GucL~NJ#wl=CZxv zA*Wn#!*M5PU&EtwxWRcu~?S zgk>AdB>!(6!1gzo8Ji``HMEM;FxYaz8mS9s8`6TY5mXv36^uKv+OXQe<{PdQjC=b~ z!+Hlh+_2HXjx=l*jCsDXVT+S?OGAg_q2JU1m)-3U-VDNpF5wsm7r2DCfUwdfycLA= zUBcTySm6?G1)}tz6e5F zub2dFrEz`Z`dgqt=Xf$+c4l@Uuzh2u&*~{9PEjPT@Lnp4MPt0 zjfPR^A+uv;*e<(mzAoV2GJ#vJUA8}>#$jAzfAibO9H_cc!L>+%Mf zp>Ny-WVhZuh^8fUdI-@l0_E%JTDENf`M&@XXYjB*&J3}2U{1cV#@_SS`7 z@&tIY!qewO(_&;BslP8y$gJ8)$R*m}ob;-McP2`C9%Gj#yt6E}DnTy|;x|C$E=zdl zSnTpd>p4=nND^_8R!6K>QNp9qJ`sqQkT)5tH;7n(LBs+KA{Jl}vHHu&Xm=Q^=g#U+ zJj9Co;5kUynRu8Hb|C|a<1X@97x|oveBMPKagi^$$QQlXDD=S{am;CChct3?^a^Ka zbxMxvhU4VseU+S5wNDlGBWABILJ{bBwTLUrGL(MIKB3yG4FG`7<^- znJbdUQ8D(_WJDYeW51h>I@s5eF$ep4GVWkcBoh&sv)MiQ2GY)mJA~f{;dGa90)*3C z!XJRp;u5|ILbFTwLlBx=!jm90x`h7$Ldqq43k1xRR1Y|I0a>=h-U5-zWP2bA(}Pf8+O#;k*U{uQ`Sb{TlnY@yi>_ws2J% z&kZ{yjeiTCgKazl{eO-M|F#zH=fbUxH`^L!r0`!NOJgbJCI1>g;(03d4_a!JyFJ}_ zhMXvEAl_%16Qym0oE;G}9U^2|M9lOJgq#;y?j<(?l71%<+v(yZcYt`kf%gP6OanDr z@${r$@=zezOWp>2&E2@ruW`te_bU`Z>aX8yCUX+_p@*FLo$NPI}GLNTOfkuO|P3vXX4vsP;$)AX;Fx zvmw(&!wvJ2L`*g#S#ooc^MQKFG_Eu(Fk;rU1Eyc&Aa`@T@g8d^??cT)9h~enUdQRF z#<$t@w>yUPj<~nxO`7+$ChskrcLC(aH#vEaA@5#o;m+h|kiO>2TDF7BE^mAnmu2(6 zL&`Gz9x*reqIY4qzkqVrv)0^Rh<0iVFI&9~F#Y21J@d8k_?>66_0ZXJ{H`-SMtI}* z?lUn3a-UP)uSRbmRmM194irppdr*e^A(;ato+@yel7aN_<_^7_RoV7A3qJ1(fY_Nijq%I=0DKP>G(LE<#-;QqQvt}A~z$2Ch_V# znNKu{S7&6hX}P!h?5$J`g?^9T;*vXL^klh1d_tK@8&!zGH8%)$0MLI>L(6pKp#O?Z_Zqoq_P(M5oKN! zeKA;;GsAD2AAR1)NOT2W#qpf?p=xomtJAb(WNn0u!Qxl3vMlSDk<+jqiBi#KzvxJm z^y1>dsz;*KB+GhF2;a^8Y`WkzZwuXuCmO=9J8JSN)2J#5kDprs342t^ z$4LGXeJ=xk#q&<~oeZ2*A@2`a$_O^M7@;OA{Ey(O@V@{)o%8&N3%IbCq(yI%L=v8d zT%L!bq$c4LgsFh=ITEF#Sb>i^{7)VB&|);;>u$|okCI&5h3$73Q3>C|-ELa_mWXZj zTOw3OqO>LxY|7LWO;;sdxTC31%7{o)wzd~?KCd+RS9GBSa z+XN@h;r!1KoRm22`vfqocl;_MNc0rza#9x~yK4TwWd%%Ke3;x?`nk(p+h(_$=aGzX5 zA~E@VOZ^>=ELsyk;EHLlC-DOtStNdd-AA5zawupXA(73%s2NUkY(K_W=h#@Kv&)>$-o-kU@qr+fl3W|U8 zbk0IN_^ByLgKp83FQ>RlGqrrq)+W&@XNrIP43TTqh2X&26H%Ua7;_c=ddY^KhV$c% zRtC21Myj5E=?D}uLr~-jp4plSrXO&U`82_RU&ZM)&#K{50(Cz9Q0L1QukhO&*9>UQ z`d%A9(6`t(GoUL`%PnVdTe)-maG=X1e()SlBzN2Hcb`o4r(I%`2+{~(EiVQ*%?~jQ zw_iG&$&Ptk+(7D;IE5-P`v0>=e(1qI`9Nz;srK}nmIXGR-jZ#pX$x0vg{9`0 zs%MwcR&{%tT(7iyei;oBm-4TUt&)YxI)rQT*CwX$pF3HZO*q53jd54(SAXCLDU$lBS*IB3B8*D1;w`Hd(Y7Rl&+FdBTn`PZW~9axhL;~x*D zKg3nld^CVwlf?_TcjE&Pcmg4y8gD<}#n&{xyUh%$i_@z_(qAhaCJD*@9?>2|u z=XCSliOA(7?{o4u1nPY;z!QJ*1@RZ+1^h8ge;?V5;j0tW6;`)bC&)NmoI20NXKnz`UJ%s_$=6?Z|1JqlAx}!>c56-TO7YG5$vwlChRPHZ6esUn-UZ$ zFV1VJx^76&c(&zVlb}=2Gg$8LKtb{oe65e0DazyLscqp~6BLPiyb$)a@xjFUDYu6E z62Un6gDiom@)r|YW&Ky5BDrw{Q2*;Dln_)CKk-~w zvd9)1eXVaksa*6Wi`ow^)t$aVFX5YJ-B5oDyQrowXr@ACi+xurzr z1)m?8)VioU`FVSJ5uQF<6Rs5>^XdvHWEbbn;DbqC+v`Fp>V&;TT8dFJ6Dab^b!ev2 zZ=c1x4S!FAHu)m133>#L{dasMB2UlTi9Fii1bwtYVm$q<@$^4!1F4&|(!#;36In)| z3U6-6BymQQ#EUc&*a^5b;!hG@Xp-=FlCa({%IR$_qg1W@=*0(`B3G_(h@rPH%zGE~ z$pm_ZgI~}HSURh8rQ40Bv3JGYF!&E-E5{GEq{&zlpaFluOK6GUfsm#pQh1gVYT^Go z$;%Lbt{kyy_#vOu*}3qCNpkvD4L@d<7XK0FKW~$xf&C=YkCRPjl5kx}IGcb$1zxYf zB$a6kzE2`=l7tk*yBLw3wZ@K-=qe8Vfyu(|$vhtQd-rY*+ikP%ZlGql_-iqyE&kpH zdbrQUDd4pDJ)vd5eY^~?YI$EnaN>SH=a-)NKtphnm$EVmcXGH#`V#zlA8)IYy39{4 zug(2}5xM!>q0xHIC9I}J)+hBHUd^|T%-22Y&CDA^qrn{->M6r-@sMk(oq}k@zybZ$ zm^NDGdHv8w?dwJ~OJv|5>lsDBqRfZ7*lWKOU@!iy-pZ}MW)^Xf&3j#$nW^}}Xrr^{ zWLG5K>3a?0omQt&kXJ6z&p0lSbNX9#iQqo(v_F1`)nwhNzzrreQ%6vf4nD-1#-L}5Bt5bMpPXk^%p!{t=6wCZ(6 zjCKWX0B{}&sXrF`b*V-p^jRcuKM7k`+LMSm=88F%qJbu2j-^OUJN`R>m?gj`xr`mZ zpX6dLPDL&LsZ?;he=0>m`gzn${iOj!KAl>{+W&c)?X}hErF!k&aqa81QW^t8GW*kv zZfCM;#BXah)Ye)&*tRUU&HAnbDOw~*Z|71$Up1bh$LPg3{hIYnVfO;ZTyJ0nvkl3Y zJMnN($ct+NxE$T*ww&Hj^xEo-t`GwbiG!YpJ`)Mn zRAacD_o+Z$?0&>)Vy5rAg8$B>j{Rxw^;Z7KsiZBI3paun zq{muOaqR8?7e4V?Uw(|Q+M-ws1lY;?0n5nxtFQ1}jyAQ;1{lbkT5r(SRurD@rEEP{ za;#1r;f_Q5>SepXPSM2{rDif-?M%kBd&5VnChdfi#!iH1Yj!Ki+xb+5ok{!sRPF`p zH;%qJL-Z#S50J|->>^Htz*Sjx(Kkp{H=zL%FN7Yn;}ukL5Xtfk1x@GShw+r3-aw50u1BiLiMorW^ROCpivnxp=UUNB+OeK%MRRaxZ$)!(XKzI_P2<+3tmN`-E5;$D`Du_EG$!*o zP>Oi34`jBVpQefVPFVlGK)P6Pa4w?#2(PVDCtsbiMtMK5C+yNQAybP^+3t~(jy=Rb zN!=}`R&X-#np(&ow)W=jR3%7IM_44=Y}K1>rU}yG`mxO;bAUryL7%exaAp6Kh#Xo z&obg=3*8oCBDhQ?_xPd&y)~^O>P8gFr=S!>P@eaAB)-Kt4Sj7&&Phpt_|}x9(9uY| zFD1{x@Z+&NQ}U3?dpnVmNy$ShTxK{W52-LRmXe257|EvOAr(fZQu2@rBQvR9^cnux z3RPN7${al zHO^S>4IVpV`9Oi-HZODRjJC~`?=Heu$YJ`22tMCDhCtnO#s$dXzx;E?xmKn(dG`GN z4G~Lk_mcEvNAeHA>N4Wr5&xv~e8i{B^AYqOPyAu``G`-qEN6pZtN6{9G$Y?36@I2= zH6z?d$6MAjvbKnn&$Vp!R$m8*e({G|k~ae0ME&eMA@FTLV9j1_pZv zhtsRqq{pXovyt1>noVzLU%P(ohV<&`=|eMD&6P_x7sjjUjT<+#ZyukxcK!N7 z`?c4u-#ory!={N%6XO65Y#h(!uE}j$pDVPFukm`WTX(orKDcfwSDq=&9xYX}`CK)( zt~ymL=d;tr1C{o5?d#j|Z^Qa^Ko1uVR7&Fq3)Ko?>nepZf<#Ty4dFPrTg8tUAe9qxNwPj+N) zrYD>AN@#G^E6!F6<(Wdhn5!bQl&pC3vz6lHY$2cK(msaFUjLrqq2cVnV79Ysq;Gdm zcBpe;dyk=R-8<4VobB0V&~1G~!y^VB9_bt!=^NN?(4K*Ai*ya{%=Gt+^mJ?9y#phi zV_q3uRmfJVELrc!NG7|xXK1)@a3H%OyWR^CHUtUn-c+?Zmo*(NXID+0K5nN=lEHW@lj$u#{}|=v=`Y9qP*rXZyPQdki?-(=(7A?(ZD#ts!K) z2S@4>IbptB%+BSiQ`$OkhT@bnK<1q38S3g8U^XFAws(U^JPMU@WwCR3dv;s@;GXR0 zK;J+gDbuI)3=ItqS#+ppplAEwNMGkjk4x<29`Ot98S3Ny@(J6(cDNUONBSY(NOo(_ zw!xtu#RhkH-6o-HDBIi9-#}}hfq}0IWjuz zWZKcQH`_DT)$5QrBkFKS%)fhZz?Tjp4fhPQ?Tqww?dSO9 zkzA{N5Z%TA4L8Q*puSWom6NMy63NjD&>BXPBcK&zt5pKA3aAQ%I$EjUttxKNeux@m zxyQ1EUxQ_hWV^P)RED6uEd0d?Qw9fyM}|i69DCR?4_x2BVc0)F|XjkU|4bd^ur1ra+OWbT5 zdSBW$DV1_5O?w)O(qx}I3H7Ubzc8+ol6}FAp zd8eB)(76-scS=nku4D^Gss+RXm;uLg)6)lX;|H_lLatJpt#HvUSl3o`W;Wc>enO4D zvN9WyNa0M|`uayO?qCy^U$7d(?Ig9qki}jc=0wXiwAn(l4V5o!O3_q!%T+5zz+AbaunT4)*tFw}leAd;04q$b_BUIoRD(KSTc@+z;^#)-*b> zNP_k_6vwkWIqAM3#MhajzTIdfMJz#9@Kl)|_$5*t1)aaulvw83+q@xvi2>)PHI z%nd>ou5M@F0P(9$8y-P0p6%`&>0B%=ux7Ho?081C%Ubur;!`VlDyvObH@0X7zw%ea zgMyJzTg7AbVL+%22HVT&-H1;XN$=t?rn9RH!F_h9Z+mZee1k2g^^WWe83>u8jJ;52 zX++sKux&6X&2~hHyJ7kNcj^A-He=16V6}VYmYn zQ2})KY#qg31|SY!rG&b2P%-^*s+a+T{TS*4UGObPW(f%B8XQH#NS5i+WOll6s4y*& zl`#erju|JF-HqJ|iqT}EGd9L6E^1(~%iLSqo+u{MI45yxTc0GYDX zBj!faNS(a>eOr5W*P(a!4O4`h?aS=mbduyj3jBDPC<8Aj2zy$dN}+aIZjy5ruMy11 zsvv(oI^}(WOz-YY&pdwV(g_S;SHevNd_j*Fo(gW1Au9*tiL=D<$PSaulmS3U9TmLSz;cW)XTz~Tl|B6e5m6m>H}OQZGr zdvrH#;SKj~AMV+{o9^4NCpetxlb|Ii=1rs6?SaK&t8Y(s5MH)!u5G#$pjBt*o;q@| z-RL+DR>2LbUrHoJ2+wcK|ZF6^Q*XLboncF`Ijh&^ot=lz~Q(Z{*EE4aNPY zJ4tZBST6HA+)eHq9v19%nOprj##`2s@!; ze_iV%?64TqshSaE3kIP)VVFdrx#wMht4Hz9>1T59U@}= z4MDWsL7`q=aXKU!3=RQPCSn6y4UMG`N~3>-jKZy%$6O6JLq(VKmbo9G2Ki_Ewu$%e z!&(I4PmKVS0fO~pcXo~-_z9JkTC)g7FoR&1qkeKfcEv|K11e~*p#4prARIJl!PtU=~P`>WK8BQ-7HwHs3DBr9AQjnXhp&Zt5a z5A|&88G@^{WLo)I3>yHv8EPrR*!JMr&yrXrSXCopGOZkOc{s^Cd!U4Fhrg4S>8#gA zVmb`9B4Ddqq1oIHrJ3Hvx*6N5?x5iMOe!m+t~p{IWqJ`OVH6YAZ*m>O;Ow=MVwH`a zLTm`9fJp<}A|ZjbGZ(W*O<&9){q#Yz?Xn2}x<=45(pfVA5V#=-42uaWZ4-pa+lB^r zhG{fB>kT~6>k0w-=m3Xviw3SK3rda-@uL<+9KN6*@-3G;1Cu!-8F5IDVyvV zT}GQ&HHK$%EIOVste~cvAv@GFGPE}fHys#pY?CrWhZ_Lng(cSW4LI@WLy(UBy#W{% zof7tRVg9Kdc$@=+d{I|N%djj=8B4H`(d_OVsu{;viH5W7*@IqM)6lW1~a;95z);2Me>= z;%vTf1kYE9z4M_qyV<@0tj=5_j?rBdYc%8D0%Vf951n2wZRg-_^fC67c6JV+gZlRd zN^Zk`LwA6JCk?WL81X{^DlNX%BLxz+(%G0f(03&r9ne`Gt93U4$5uPZQ2eF5n+Q|f z+SlFPGY}|3mDdU?9ZkD2GBbthVLGqd_?XSD#d@v!QfRa_(zml`aC9Uf3sk%f%lII1 zJ3U(9)*xX@eePI2f=M^eec5fD*jEcG2(`mOjlh2)o*vBhW6%egQwH(|oJz-1Zq1_u z{(gTJ=XcmF_kbF~^ zjqI&rKcObYFXu0Q$Yq>dboT1T!~3UHHJoL0f_6!2lDJ<`4aI#miM~Wy1MOPEBWauD zjDC0oPZnWmLnmeOn337u)@-IHu^%)#(ml9m08c*QY~Sai$+YGT7h&<}NiTlTOP;w3 z=b;lH3^XkE=}8I}gJ*@4=c9En9~+0WnYPN-hdIWtk;~VNY!HMt62dG)xoxlFv4^Et zlcR>|*2}r059?;=98U`JW)x09!Zq70n1$+fv6y3^SG7NS2m5KoneD9YDh|aE$qZxB zv$Ye0Z>}(#FV0S8tHqf@X}(JP9mD>Xg+N)-DDl&c4nua1bqq!KjE1ps4_8Dgmd7G+ zq7!^X16`MiZPiJDh zi92lFkR8y>n{At#x#+OqY&sUKrrL$2wg?juheW<6+uio@E~mdyQ9qBcrcq_~R`u~n z^N=P=;cSYZLX_2@Lr^<1Phe3BA3)L8BzGVkCi9M@q0>O63Jq%e%n)RGYIgk$jRr1T zWgj2M(Fz$Is!k7!Pu|>8a%V;!Ug8~Pmq?w$Z8ha7BT2%iT;YToA`>{WM2r@w(4Lav zDKkvVE~`LV&o(R-7f*M~(LgoENbS?P8{%qQ znL!?Cu+H!B6If6AGEw7Q4Q~x=cB`*Ge=nXX4)dLuIYLd>hQX5h<#7p-4OvOMd^lAn zX%J5-pDY7agM-gd$u4;)pucY?HsU*bkvxFayKQ42omL&;4D>8EWjC&XL>;9Es|Bc+ zf{@-EV$<^n=Hb}v_Cfdt%m;E5WW291Lp&po%GA~iRFvfhg7WL&UP3_}qS{PGGDChH76~*@uaDXX$b8_y(eieQr-4m3(G)wh;@&& zj2`V?D&6H?ue>W;y>zE#`ur;%nCQbpeta;1=PY_VaXbzGM5C>I1aDQ8&44S=yDi>y z3Ge$5P|0N{ax=y0qxR*N%2cWBBxD(;S9m;nPbZhpmx;w(wTu+z!JhETiuDJslr7onyh^pRrX$G%<6c0=nvg70-yoo&5S%3(5KM1wsz?z#hH=V0y zLCeakL;gWFFL7}icjRc61T9o5o?r)ZmEw3dH;mA{DQE#H$|hrZ!}W zM)xY-v8i}d5SalqW`1sx@Z9tqGPGwa^9MMc$mIgPA63Zv!Jpv@W^~5xP3J0A4cD{d zQw2OLT=6J;CxuWN*w0Z&KZiaEW|*JzCQ5S^ypvRzW%i`giM+gaLvZD2rCOMQ=O`ZX zplfd$`6i}wlYpoPN^@DpP!kSESqPgT0&^ZDd7|)2p>QxeK3{e^maIhkvot~diASCD z+^L&^u$i>@e4^_Zpu4cDSB+8bio5dvy;^+(D}`?Y%zZX zf=-l4FQthIm<>zMCO1oDksH7aSDmZKYhGN$G^Kom^jkhc8fGJdZK1bd1li8a zAHm2dR*Sjm>{M^KM zr9nyciqV$~Z4 zVZa#T=xc8t77Q6M){azj)JtR-7&2uRk_}w2xJo+dSD>I7md?%7Ujwz`j0_fM%!j8lj1;Nb0PtlOccs& zYxC8K&0@zecnNj*y+OAjY^9V8k5`<9elRTIA&Zsl0iduLv_1RALb;TkEzQEh@%ktH z8|NX(&^2OGLW3-Y+$=Q&GC)fDl_|f?X6J^q?|QOuf0{wT^8^VB zeUOI9O_6sJTk+p-_01);F9d5N6FkJe0=7ma$EW1&Sa=U=A9+&tqVz(nr_X%yP*fy4 zF+a;MdScrNwu)wve%Qs5DN$2QKQoH45ARl{78$!^G7Tm5Qxyap=+{G2J_SJGP%V|G z4ztN6V!DVFqRO%rRE4gZ%fT^Fm_wtGXM*yPiRsc|HG*mxO)(=Vhc+E5*q3-@wq*Af ze5c26zHz9SJkUI9kDu8CGoFyR<(0~`r>;q#t*cDUSM#OAu%QBlRfTa33Ovv19l2)x zYxt6#n~^)5vH%n1LO~!JkOCo6I?NtjQ1db~`f?0>aK^!pQ4mk~6sCD|2Mb5}LKP5_ zr3x6}3K-%F7_uBQ6v7&gg+p^$P6pSW-FV=fo(7?oP&NFBt$-bs2iH2~Q$sBGFiKYvt=ui?O28WO_B`HXuA(qr`P~bo;n`1XlO47kdjmAjG z&3O6390CTm5cA>=_5rang{(D1ZVS3ln@JUxr*lVP@o+#i$(IY`C3=OQXq1ai@P@i^ zG`APWq?~2OzBx_%HF#khVGy!XX?Rt1A%Qbgm^IFsc51sgDyB_sY9Cw`ug>rd*j>0RM&B@bAm>M(zWW%(97|G{B)nTxRq}16ON*yScysg+h zRX5A(ChsYpsFuwBD~}L>7cekT@*1>Qal?0qEYYzhVhTbS315rp6ftp@0}Z%a_Gr|- z2Bgr#@oYTZ3U1HrAQ$VO)KL$%wQN&<5?x0%23Z_gEF~`Z=0A0Xk^QBpuz^Fat0;=_4 zjz`J%B#|wHKk85}!aq&q4wdH1Xb>$iFvpX7VHJ?35K-i&sh5vtDQF$1n4^S`OK__= zjL3Twu~PvkL?T(<)#9kcE6yF-M1zo~qw!psD$K%$3`Ol_{6H3+Ot#5w9-k~?Xyh>j zB-TN{(K?3p%)yTk(8_T{Ut$f1i-?R46tcOwIYj+=FJD4nFTD-SIA^FWcPLk!R-7Z- z10^(0U8z5z$@H#dG&hUUfT5o+qEMzoiOUqMUMDRA4uKpplgm@AzVu`0=1jYphIU)xvauAcMbQChn zq+hJg+Z2PSAJ${J2gR>B3Wz&ILmS7I7BYj^ph-ZY3-ABbr1#S(J8 zUVeUN1{y8S6==}XViv;*s~=k3&6P^i$_}U~#4HD^2%HevAIyroCQrc&6pH5IX{%FI zFFTOwQt2Qz1vsn|aRpQX;czhG<=Y(Gnz`wDEE6Rw@f95N0%mD4eVU0SHIF*bpYXd9 zE^~c>e7pdpVT{%6x(q4_NpfFgagzcD8sfAdo(ISRpj`1A4QxV=hOK~vAxidK! z6V0mP2Bag2$k1ft4aHdf^C5^O!0y6CqNmmWvXAhZAXP=cc3n0|oLzrW0!M z4bU&In$g^Y@D}bU!j=PjPpWPbo)Y7B95Dk{>WJL1C1ti3Fy645(EcHNbzsz7l^w8f zv&iU;4#kME8z%dkm@nTKS>XNDp7 zeUYuij4v~ic(Rr!`FYd`XsHs$Vla5<_QLET8VTiGb_QVzxuy!D2;+_@gKqYjS%+$+ z)gbRZ@@m^oRqXX;E63M0d?9=WSIJFwb}sQU90df}rtx^9L|>E1n|%uMG}CNnv>S$X zb3QBEL8@%t3+3%1S%4J}fpVzii4oRWnz1s-G$^v?yKF2G%1aF!`}&{fGPp`{d%xan8TJ5rWK8N-C>2u7v3MbAjvq6<1IrzC87NS ztd}tSc_f(|iy(2yyiAvzO3fLEk0pO#{HgywheqZqGAhC|i`W}G?01+UQBQDb?h~^w zO})VQ8`*)-E(NWf$fKAXXl#i+lBiAA_vmO0+L;ns?qr=Pmu4g@bvkc5R^i)Bl;B$e zt##-tNECX@^2M9uFDqfAjR6V=5fJj!M5VC7K|wmXVzfoXByTiif0e+I%Du=9w9i;y8v&N(=qH59vHXKFEnC7vUPGpiwXC~kX zTM9=IREk}27|Yq_XKAA2vngIBQm+;{AeR$|^&8h;!x?M#+Qj{E8U+`$y^d<_j7r^R zcH;};uv9E^v@q=|W)?VBfKq{(pfOY+I*oaX-?W=}nIu6X%}6y3&sE8)n4Zfcq*IqD zUi1)-JvbPF%d5%b*G~1(s@d=_Rw~#Agm>l)X7Ol_kc1m25QW2DgsZv;r)e%X$2QLK zwygA^1^&DbFL!ADN$U&0cGJf^Ed3o?YNsEu2YMPN4F6hpFv$T4lHpyM0WEupkJ^UG zz(EOR2pb^V4Lp@&)w-<_SYtACStW5CBKj~}BfY)F>DmZrp&mslO)-@?*pkM&qN&muvk2RXeEgiA|*4e@7Q!jogtuXn6vb>Pql0HAF>(P#PMT-o?`ZMNZQyu-b}UT`Xd>nmF;&{y zDHrFeC}GI8zS_oH$@9$Ig}M|L({bEs9?FqM<_l48R;>LvWH0>eMaZ66q5#X6K8~4 z2!gV+^Efg`b8-_{QDJWr4`P_H4p&H9 zBe6vFV6VZW<4TPhxLIazlLkLU_RiF54$3{=g7QZ#&%gBTQ*)5TAC<+1BBD4Q!gH8c z(6{^;3d~NQvdLojlxGXr3D*a2IO^mRt1NaI@O@eTF&pTugkwKC-NK3-%vet_4BSx) z2kBT;$>y6ZDb*os@37FNDvdB*;{`BoJM=0KGK^yYkbbaTH|~|Odj{t^PivxTiIy44 z6qzV&lKF@p0iZLn%3)q`VaEo;QFcfeL>xO!=X0bv<5k4Pa2QF)AoWwwSJ+e`vzVg= z2iB>Gun*!P5$}J?CyQIn$CD#(9P%Q!To^gOKB zyA;7{-a_)zzeewr4 zq(GWv?{B#veNX%&$q%Qzl|WY#4L|xb)+FnC=9T(L(}!F5PX})?>GY?Vm#T~SO`H6! zbk9&-&?(o3xU-JHIsi-C ztvqRvR#H9q(cfOP^1udI10r*W$+Lwrvi>X&>W}>6)>FuzMt;@> z?(|18|}Azz)Y;5Y_nDTVSn1X9!U`2y~kis+e?MOs)w@SCmV53ZZV2En1i zx~tc=uf1mNrgeBYuUsls*UeWfuUxJ?K85d*V=+2^WqjEkMq>gcsKfaT{MsoGX35bXwg7;^-0Eb&gu|P!$Ph<%UV;L~ zh@nXl5d4vL%|7XxeWq*n(Ud<&>&)HHIM^KZ=?!y zn!*54)=iPMv} zC1X7|C8EjLmMew;}DBzDPL6J9cQ?9D)8$09e~l#HE^ zl5b0#2L=r{B~t${XZIdp)x7_Ye>ZE^p4~Ln=ze9o=%x~qB&3p>rmN7$t;^|LI@!g9VZDPgwUxF;(TAPwVp4%dd}?MAHRK$*?T?qYrocez2EQk zey_FmnkhLmnVKjm2874F5S}EM%ulWfD;I<{3&PsH!&E_7b%y>-_73ax4XgJKbNhuk zJ;JIz!@7OK+&*EYo?&Ido_%yRuV0fNwnzpqSCBNx{F1O@vQL=o8y?*wtiC3!Ew3ec zZw-7-0;SlS6ZyKNC9aSRzN(N~5gr|UbWLifYS(zn^218K!z?LSZgM8LR&ZK=*jO@E zlmgBO>+}h$^$x=*@e9|cI){PeN|Ypnd#){&7y0rmn_W^NKQkjdF<4h2)j1iwcy&o; z1r2a zl*qrBnxCAdp*LPrDw`PmB8f6yN(Qs9$q)Xhus5tFC2cGlP+K-2mCO%jN|C3b;LU)PO9q53~AhZWrL(re$2>NTA@OjrraXkASXLDRjc8VY0;;) zWy+@>o|YeM%gkt6LAIcGc(l|+!?^jvQ%j{4dxx#Ha+0gVoVn6K`O?+*haHloQo4R& zD!4K~JnDrooEbKeeW`cYG$@iL59;M-G@#~qHPoI|J**}vYL3i z_6jqe3vx=!bcCCd6~e6SU}Q#%3SsM@{@$=_w8CISeloQ)zchdE-~W@MNH>waq2Wtm zYGx?goHZ~R{CQ<*FjLy#P@KGyowWD9uxgN38f}qeOavcasR@E7WZy4I_7C%})3Kzz zycNjv@ls{_oLrp@HcG8ElCeSFN*2JIq)r#p1bxC<^TMn(VW#Xvf=wh!1~1u9q^hMC zWJ&LMToTAG{jkJKYi^5|{tEZ%Qi)WJ^oYF`OJ>SmJ9)2mi9ai*CMJWKleLwPl3`0~ zuxj+tmGaT7Wbly`xm2o92AWitu+8()cq8k}mcmp_?hTg6mdWRK%K9qx39Iyu3YC-^ zuc@1mpWL4e?vzZ@BKssHqgPmMrv8*z83?8H!I2WSFRU3B`A{D z!4dh|drpwxtmInVink=>h~U|*e0f!(&oU9r4l4z%WO$EK_LIocWWUsDT2JzU1yf7H zBa^`&vhSv5ht02zlBJ~lI@Y9QY?he6BqkMC>S@_->B+B!y4|w8=BoU#nk>q$TN>@UrO~b{W2u&St#tRb zVR%-U)%*YVjvHnLb2Cb1M4u{?v~=x1GiA=0IZZ06s?0C4;*6lSY;f?kjMhPa=?I_7 ztS=?ITk7oC;A7#kDsk2O zhIQ76>=daJEY=EH6E@x-wh!LEQbxvu(ZazWn`9Z&zG?&Q})nci8Q@z`WI4!iotzBiN2EOeAz4e zN(Sw?pH454vF-t}Z0$k?VRlc+n3);Y2>#bxdqRF#PoDB+PH2}5W)04lKCB&7j(vKC zC(Fw^GS+GbD;N+qnk&z8j3ZSc2VOeAq0&Y(bla0XQ(cq6qUoi< zE(xwK?`9?U%Je6ja-xLGr=^B#=oF-rb~NrbmhpUr)P6tRduk6z2A@qU3GSDjDI+;o z>+2)go2tmDo2iF^+L8?lB%d5#l|%Y`I>M!7t#t$0CytsG z=Jg62^^3Hc?q~(_c11a+)Imw>xoNL3Yj!etWtx^QSf>;0I!Pvb>MN2gdxmbIuBno2 zk&Jj*z2pc@VjIfNChzP1l$i`3)y{v*l)b@EseE~s9FIyRq=NSnrAaxa>nnT4^wbI& z>NV~!`M3-~vvpN}$f{EMGR%|0>E_Ok)|Sebrq7n+#O69}MuUMhe#;|lXjiJQlR!aOtEU_p$l;P~NlCJwRDESBe_c6b?iFUs;qzHxwE{UpJu3`@ zSFe(ZBzPvXRIB{pl)bt$-;){bt6#|~WG^kPxHrs^eITlZg79b=iDyg3TGDViJ)@3a zwO5oZ8Dy8ro-T7kT)T6k&*&^wEwwTk+%Z`X+=5*)`8Vz@JG3mGmJBv%ovfC6h+c+W zWR3)NM@g^`DKoG9*B;# zf{Jo-(K^tnMvr$IN~$B*=)t~p*6cvW^JIUSxcj6g$yt%K=-%LMF*#I_BcByvgWyW} zoR;rM9pj|~=sfo7RV8Is_H=fIFfTi!a}7CZlGCC|x>dot?2<4qm@KaY8GeGOy`pSd zl~rXV$dCh&XD3NRZImsm(>u&52qw0@mvzkJsU#UO-p`i$cw&;Q zv925zYH207l8l2o%{;GX(xqWDp^Rj3e@3Ys7(P0FuT)*|m4wPUU{+AER1U?YtIF^s zeOtCNSTIqiqu})%t%1E^OBoQVq)wIHXu@7Sc-xpGTRSss*+W*dR|9{bXO5A-S@G8I|Rbt+MuR8H#FO8)nO9T&pdd zsRQQEvc0)-C?y%BB_yd1IWjcK*5wA3<>lHicSiJ6_srmhF!wC|nblACPTA=3rMh!` zR9T1JN5;!>bVeqf;LMOcp|Z4W%`ig_{{}_{OiDrJ+*8Y{y+SHCGj)nS>Ao&+4h-w{ z(CY>bq{k%lqp}u+l~Uc}59?%GAdPcYGWd8>G?3mVyOV7253(esS(&Y+*)(ZynX>#; zxkA`9dw*Ctg&dtXn-R7s2s3)hUMo{uj!dJe zQ)MKO8mg+Nc}GOWY;;3dJ&?ob`ZA664;%FktM`ctTRW=C3^_KE_b)Gz@lPfa+0Y}U zEo5`g3M=;4BdDVTnI0;xiw3xi{9wBbn9>M8OG#w2Zj?5Xr9UdmX>8DDZ<#aL+p6kT z$%qwvFPoJkms6_hC>4#)n?z*fSzA@sFQ+FmImuS(_$kK{ayVY?1-$@piWEjzPCw6nOax06YF8x$|PV}BE$$b5Zq^cv$ADzWz_L2eV-eNgGeOrQ3!LJEDBu`D! z8qmSIs;o(eOC8`cqT}=Di==GQNN?xL2p258R^z41)sjQg8o?x)m4fP}Qn9k%WonJr zC=HvZrfDr4D3Vbyn47DGltcKS+Flv*#Ij@}l#Wm&KW>yaK4Vg^aASg_-hJU73?I3wp1Sqwit~Oa}jw zPs*+uyi-(Krfa>MtC#0$m1&%<;w|O;zM}M%GH*V1guWR(ajlf$VL9QGL*ox*8*+nf ziB#t@(Vs~wx#)C;95_gPnY3IuOb%?8+x*`msbJwO(J8A!{G9$XCqCs+GCewzT`b%dyUIMaYI;fM> zs~OsAGHlkCQD}J|5IIOq!yC2 zuB=7!SJsn99FQC#q+^6W%h5=sAV+6++0l>CLdei9)joSnz8oM1v!qXEidK>Ok`qrk z8|*2gLv$$GSVn&-a8;QWM3VH6j#y954^P!;ab`4a z)s7ggOFiRE@V`c3#2lO29=}{bE1oG z56Syk!N>BsmXf}b9K6WNj+R3<*^y-9l0VCYd#pB#2I!R*36Ywp7<`t{$*V+4a=q5t z45@y-R4XS38G4mgNG{jv?)*q~=>@Ve@QM#ckanxZ~PVIUJQqw_;FJ z`grfK$_vrih6iiD{br zP0v}S&h&(`rhK4cFS*37myvXZ(SerqRf$+9R}u99zIWJ4+UI3im5e;EREw@zk1cyd z{%VcrK(l*|@Kl*}f;!p9$rc2Yw2Op8O>aI zOG-UcDo$GB&&%|5e`d{+Xa}n<c|Db zZ!VMlP^P}$r7&6hlO^%l+9Of|I$KKwpA6DnEcmL13_15)9t}pp63JI-rXvXOD%$5O8E=9a?nI35cYh@bLHcCk`vgME?H7nZjdT_$d0Re{{bJZbFZHCR>H%(2_UHPkNA)^pe(;E7mL7L!EuHLwvt(oC zf|)ev9J$ac^)?`yD)mxeesKF`lKR)0az3jE$x@?H*(G|XyzHwNK=eY69DB%-dLW1B z;hHe{LNfSm^j^Jkc7xQ6jv`HTP?6ClKBtznKaY+selC>vYn`Ph*csA*yGLui1iNd> zDi=x-W%l_=u4Cy1RT;%{^o0LbG{AiMptR(E`9u)Ng1jo*74NPkLv?nLozYrO66M(P zKbk-IXD#_^N=hQ*U-02*y*@6aRUnlp$MiSo3)!gNI>S_tu0F;;<+MdkO7zW?Y-ib_CY72bc;mM)|Fwp>PNDl>w7HI~^+ z_APl=P8DvIv8|;ZRW*|cS*vu9$~tPvQnt4I%voXeXh@f8SJbgX_OakI`M3;qkLX5x zG%70XLYeY4M2D!OT(l=J@D zJ;PjS4=LlPvJ#nwACkm6x6092RqfjPQjWtb%h_pxoZU%>k^)FWKPz$48Q+qnYSBXL zXp^Kr%?{<@K4Yd1S@KiPFeL2N_(Lz%&hHs7Mtkf_wdIiOWqC{b(Cf8JddLhT3o?LQ zS6c><|BZ@HBsSO1=qw%N$x*4Dal7j`vgsa$74?3H|Nf8PubQpWmN{`i;uDEu%lPM! zA6Ld-j{Jl&zB2L?%lMMWPb%a8h`eJNzdG_xWxPjJ{^)L%!`{n_{M5rt7b-@6dKupv zZmYM6<~C z&Y;5|nUO~;IqZ!eBC2$l>B9ENbISPI$n|Ei!yk`Du6GX|{+qu9&tN3oaPk7Cc$r!tQqQFcGlpdh--u}rvl+5ISv zFS{SbUUq+pz3l!Hd)aY2_Cx(pm+cX_erTr8L89#V9DCXEIrg&SaO`Er;n>TLt5?a* zM&UrH0-J&jM1U8}r2HDtdo&)-cG|Bmd6 z<;Ay_UA;WNF-^VQm&U(OQ~oY#%DF`vtlHmq3m>{4bA!}dwdk%^ZP7#b6PHT;S4$k) zkGe$fCK7kZbG5{w{n19c1yTH={m6PuQJQue?Y>wQ2zS1sevI2_$iEuXno;;UsG8n2>ze#IxHDbH_d+PA;fbH<_Z z`5?-3jy#vwALdHGs^-S|=ss+TeJv{Iq474lr&(Ommz!r|n({PC(=Hv-c;7T$FHQeH zGmSr-W{;X47wZx%$Do-mw9y_CYZV@lY&!zC!((FekOH6t7 zKQ>MI-%r!-kESW-OKIX~r>Td_)0F4-H1S8J8E1N?@oj1P!v$%|za~w+ot|d9eo9mR z)#BB3@Wvzh9RxMWQ_an%(f#D&qta~eSJ8fPXg;+gh6|!RO)Y(*3s$u$P5D=(83(3G zhVuHuA8Go({0c(3@h#HSe}0;+0qbm!!$xFim^|w8KeKAHDEepYrg!Bl%Exb#Xn*o{HsBc&htWO`h-n-(L(NCMV)z5Z5)x{5Tz5vekvk1=h zv)|=;#N|oJeyR_vH`^0(;8t(udYq{bEoXlGGWwZEdHUnMrj*CLU79={DbGmc=}dXd zd#1_L-+4b*&cT#_Cf>V{@|zdBJbrt}I6uqfpGf&{#(PsKzxfQ8$LC+{{C<~znRCBg zE1mar@h$LL+v}gsJ34>Zx%FXv;?1(a-5)Yy6b3Jmx##oM%7W%2N+{4p1I*D;MWU z;d7R!6_#`GY~?Zcnm#zsV9GNE%NOF=@|YK<$z#7`YUQ~VamAF!d}^9JGvJnI5te6B9&`KM zRoyA^KheJZZ5#CBS*xt^El!{T3!7ytf!SF1PkJrutg@ixy|y!k&!WpkUCt^Ao-UmePC&hxePd!Db&TO*I<*Xz#uuzB3dZ_e}h zsfg!!+`K#G?}K=o-z~qn&F@y8>4+ah+iPy~yTuPh{7{NFA4TQ47x6alTY1b215;|0#`SWDMy`<>?LtAK~?FPwjFnmp^A z&$1-)ya8_gBs&?uxe;#t#C(g(fCSdEVym2_2ap4+g|epE{|`=RnGl-H#k3RKZ4tO-$VUuf!lh`x4S&c;!TWx z9&kR%xm_33cDdNOUFWm){(<%C_dEKq^_mZYbNgNhw>%Zl|AtZ?^D!=uuea&WXT?Q` ze#$RuM-N@^Waq2ky526%<<~BwhnC;_1{bf_VLrz8Zglb9x59P33*wZ~&)v>1a-NC( zUgPg`Uf_I*^ZCwwKUw5_s*7I==j~k%=j~nX;&r>~qFvUyc<&qGT7F-itfE0%%%J>NqP=EOe)EMC-y7Szg5u2&z{}KI#kk(M-Rn5_ z?bQHo^;{qOLmu4f*}SRCvm#zq^s~VEoz5?G?#HW*&h@)gd&KuO#p8T`LwPRDju&*h zmO38;xAKohy-kN(`ORm!JboNlKzYU>&tl4BzAR0i^_1so)Z%(u8a`EI+mJ74I0 zxAWVb?}1xA+>G@efLlG7XW}bitxrGi)Nt;{jTX**|7q{spBEQ6_jxXK?(>Xt?(@ub zevaGTMb0mCzRvkSo$pBF2b}x$w#$h>to1X}<>~I+_wzx{eLr6cw|2P*yaIS~-&gZ#$*aElm=zSjg*iQM)ce*^j9(FtL8K;PT z*1&7a{}_(%>yU4P+x2|gUW?B|yt&1V6zp>fDb5 zE8txIRd6oh#2#? z;X~n8pBB&cZ1KLH{eCf>^6x;wQTGuFZ@WG~ORK+I1nTw`1}7jfl7UF}LeN zTn{^4{=@n+=4Xu`>B`f>xsR9Mx``fEo*pPq0o=-C?yn2^b}4rG2fFpna6ZTRGUvX( zt#^LBi{Ikhx7QBmzP)zAd0yB9=Xs$i=1HwLKfmOn44lX2YtGXe@tS9*D}MoATRpGB z`Ub(Rp3R5CHBSj%>(hMa4>-3u)biW)8XM;=zxgJ7*5d6t(H6MHo9}>Yd3?L?gmeAu zhI9So$mjLJ^*lA^zrXjq3jNULM=Ou{EW~RbfB#Y)!CL)yQwhEtbdJ+E?qr?|0gd^}%_p-8oNB#B-kh&i(bqmCpS-$4E9;8Pm8zw z<`&-_d9*yf-}ZOz>vM+ld+=JHczm$@Ha=MSo1mNv@L4X8jT`0`zYOtQ&Q);B-vjwq zQ-1RuY4YrG{tvv?C)?k3y@$2CEbGJ8djZyK=PBk^4>m8@c3C{n3l^VlUf}U$GSk-psk@m9|tp+1|!tv=0LyZpZ1Iy?9CojJiO-mX$t51=?>RC{(9Oh z=l=UUn_o2EU&mPH;>Y5(K3Si%`n2yES0Kjf)7+0I7Nen=vOaz2daVq)Y~#QBH41q6 z@!4Nr9fdqx9vg?bJhR+-{dLr3&i`pEmFIQNef(DER=4`G9nSsr(oBpGR!;lg$F74} zIn8Uh@x=ExJ8snadCZm5jvFn19{Q7wW0v21kjwA4YmD<5F8@U5*E*jLxAk_%dS}3G zz2=Kto&_$CKhE^^zuLw7^{#jB%em3HkKYaFa_)h1IS;x#zMOu1_Vt#Bam@1nAL@a} zXY(#@JoI_&Iv(%ucD;`G_r)&HxvoB!Q+bAt61Mq^2P8`a4WyXk0G~sn^SbXe!DgxUR{4T)*id@ zLVdQOJU5kPeW;hjFQcFBocDI_uP69Cg^1^Rv-ybYZL!Pm>pvIk(({4=ZoPSU&H0fgM(%j3sq+b*p)?<-uq-%oA6)A+@%Ja(N#-N)PaEY^SQ zIuF8(;&x4Tt|{^MV# z+k!l&@Y)=^`QN`&YhDp?w*Q(R0nej6HL=`+ygruOkvGP2NAgx!wkKQfndcF6?de~n`<90ob<5!|TuvbL;vQJ9m@22ri*gnnU>vBdK ze?5)cc+Pp&qhGThh3jYRgVOk%H2$9RV_dt`#Pt%*?|obv-=4-BqeEz()-M0FG`=N` zx4{m=dG1Z)m9pcNar^-1ZCrU?NaJ?DpXO=n;(Jv(l;8W8IpzC+%H{i=X?#_c^5Y+= zTE5Fakr_R>oCnhQF&J1les&r^v3mLW@2gS1x5EI%`KPAw$I|$xY5e3`<*)bJG`=;B zpIE#6Jgd`q3k=Y_U5nEAr)j)Z-SXFaM;iYrjW@=hM&k0UO5;5+L2&%mG(HmtjvU`s z|ImXx*w>};ibs_ne}5YPD~)&0D?iVYH2zf@Kc-Rnd1j^YjcL3ZCRVP8!D+lnlk(Sl zOB!FF#(#BwY@9OsIlt+l{NDd^ZpQ{1dEU{7;=SLS#*b=Ne*B0u{+RRQ;*Ul@Gn*gE zUtL{4~G!r=6eR+A9Z>oW^?}l*SjQ@ttYBHaaWkzbK7A=)AovXH|4!&Ex%= zG@gsj!SU16_?|T00hL%LPa6Ltjh~Ck)jTJ{Rc~)UT^LVd(N*u&KGL0uXmmj|_jURbx`SDZI_@*@8@3cdCP_zh^ zr|}9ndDiXn@wcV%j$O*ne@hx)pT>8bQGT9gUCZ}{Y5dr3<;TC7#wT|#KYnu>KjzHx zK+|4JG^qt~H$bg>BTP2;~gM;D9Y z2j(Bj<9$UMKc;v2@s$e7_fctlYa0K*KIP|0#+=BI{*NvbNseN(du4`R8QbM1O|eGP{vQF%1}2gKQ2p!?~)FnziJueJOd|2vj1A^#tiN8?%Z;LsqF zDHMOtz!+wd>-9x_EQp_?^N}uitxtF1wU$SB*wd5nw zt{ce<5Wk)LBKR)nTArIL$FSSEuD2!P4>;HO6;)z5=v?C)AwGrrud2>X!fZ+&JFu_p|t?FfVp-`L+Ce5O3F|E&eLx?@#efj)?OQ za<1in8Tp4g*Zfx_zRHDllJTE{Exa3C+zzX z>sRZtVz=L4xBC1B@v~hX&A%fKPyEBVmgjQxtNX}{;QIH3^=^y6C2yNZ937k|E&kY_&mv<7jW+sT_XjQu|H)$m8iE8sev-9Kjad>8zAivI=v3i))@ z+uP*p;akYF8^`7RguFleYx4R{;`n{ewf^%mVz>Jrto(Q8#U5tH&*q)s)#0|E#{Z6p z+~-W*8RKv-@-7%}&!znHP|jf#UkCHWIEr73`0>ttf162py2qQ7SVBGszM6b0d^7oc z`1j;X;b9oRu=-gAKZ<+<{ABX&@UzKtv7e45&x2n_uHWD4<8JZ-_|xP=;qQ>!@xeFb za}i$w2ky4Lf8QTKz7p{#lCOjJBi{tKzpG*Scf;-PTbSFtdk5vQ`E@0^_5ZiX?f$bb z$@^n}(Z9c~4_ohGcti4Hcn9+NaJzrp^4R@hMHFwxS9ZU)#qU6#J1Bk+{7G`VPiq5t zA;yL8$?g8C+|=RQyA$y($!#3zMP7*ghUb%~kar}x)#EhsQHZ~fd@lTD^5yXF z$+yBo%(qtl9q?-8_I>|R8$ope?ANgP`hd2)UyZrE@ z$QQ#qlJA7~Cf^MoLY~6%mE?I?zMi}tmhU6C^Zn<@=VN&j`35ZiLB0#iwQ*fX>%m_q zKN_ybt7pnM_^-30;V^L=d0iYooaXYJ5r;-U&vNlyMb5%S)85WCzg;&w&$-4gMf?TM zHNFAPH!pRr@xLMda_1WVpY!C0Jf=9;_#01;I5Ew+#_vS@9OoL}u1g$$qjQbli}<_A z--JKxT=UFBo=2T)o(oTuAM$wCxyG;UqMAsQI@fr+PV%~Qjo*q!c+0uQXAYJh^7zoX z#viFaxq67_tEbB(XmLw?9(q;rjb0R3dVbB!N>_{q*Sz9Gt4;#}i5A^v*j8h;An z?||F*Fkjx&#}h7I^Q_bl$zv_W@51=-5qZxzJnTzCrCUv0gM;El+a!#k4ife$3N z>)J!e?Y!?=^8P6Q5^_6Vdy9NM;(sRJ4$s9GEw)`d;f=`;!aI=H$%r?sAGw`3T}f`| zO*fHGMV|Y~7sFpBUkm>?`3Cs6=od^7wda=V`M8u3x&Hfn z`uLLk|KQ(}kAeS0ZohBvGx;ru|AYKtcm;glV*8i<-gFlEJBY7L{sp``x&70Nb;*}zmdEFt}EU`Zr5|~Bp-tKd&y_QA0&Sg{!jA%z@H?q zgzJaTke?1;Lp}-qGWq@RH^^Uuze8@2p4&SfsI%h@lKM`M*{8(I9tVuoyUZ4C5cq8%>cyn^Q9@>Vy6!9mJ ze+)mFJb~*_r<3Qw&m=zs-kZD-K7jlN_<7`Zz3(D&yG}Qp{CngXO&;R9NfG&x@JZwy z;nT?b!mlGQgwG+L1HXy<1^8{`o8fnn?}9HO4{+V&A@X|g$H+UtpCa!Ee~!Ee{sQ@p z@K?$2hrdbw8vH%-9q@mX%Rd$#Jw7MD5B@EAbNEl>$HIRm?+E{cyc@g%?pLz;x&WR< zelEN+`7n5O@-gswXcax5)d$-zOgr|CszH_)hZW@E^$Ef&W4N3ih8&-0x=lOA5!q z+2r-%x#V`gxl}o+IlC#TTuL5cw6%O;O)sDhj$`>1Kx#v8@vbk9(V!y z@9=@-nK;fEOm4^h7n8R{d?9&v_+{in;Kk(Ez$cU61)olC$BQN8n-D*j{2TZ`$g|LY z7LvDy-%Z{RzLb0l{9*F@;7^gChJIX1{yyT@k$(n%o%{#*M)Kd`?~^C7-mTj{JeXECl@B)e-0v|{|4nCNC4*X*Bd*OxTFTpP( z-vKWs{}Vo$-0FQg`6*Z~As>L{x#Z)p{15UQvAmG{ek|Wj{t}j#l7Eclhsl4!@(S`y z+(-Q{^7`=A^)7Wr7X-4Aa4WFGuOihmHko%|*E7vvwqcai@F|B<{F z?hoHjeg^z^@%&u!;|Fm;W^|h;MK@C!t0Rlh95~@@yK`_Yf9b_-irJLcsufZ zcn9)};ho7R!@H9I1KyMTDY*3utG9RIgDCzB`1$0&!-taB!u|Op$veWwkY4~FPd*+# zmHa07HRKP%XOX`Ezk&Q~_yY2*ytp0jAa4X;OnxH#0rH;k<>aH_PmoWCuOj~kyp;Sw z_&V}6@Yl)ThHoU_34fpb7x-54+(wD$@hN#@_)hW@;op&Wh3_FB4*!L`1b&cw5j+F? zrS<10;VJSB@G9h=!)uWL2Cqk65yvfgcJS5|pASEtd%Ry2 z9K;upFNU8@{uumx@>k%)$UlXTB0mT(BCpaUF6U(OrtquDPleASKL>sz`8fEk9mPBjg{#pCJD){2B5in#S9^mb?x8Rr0Rzx5&?iZzeB-ZzaDO{u%j7_}Ap` zz<(g$1K&?x3;pd6@)O}1m-`<^CsTaoW^w%KH>g?YPF;{RjAS z6ki+tA3{we%;^4)MduC(pSK|P;F z@$KN<$z5B@Isf8krmYqp8EcN=+U_zv>Ha61pM z{xb%?o8o7~_mbZZKS2I4-2M)s<$n{NnTP$dLi~Fc`{CK-RoljKx#aEOwa9zH8<3BN zHzvOU-iCZ)yF~QpK)wj^oyq?N??(O>JfHk4_yF?Y*hKUgOx^-MguE+!B)R?Fx3T0` zBYq)<8iU&7~+XQAE}khg)~NuCdXkbLHGiRiI{d^Y0$MZOTen*1U7i{xwJ z>&f4SzeT_=n_w!MBsw#CCl_elmO)c|QCn@=M@<3yQCDd|b}9iARAo&jXVDi7<7n3(Y{TGsVf?q~{KD?OxD)?mbyW#ft9;}{A;WtqH&+t3Qe}g|j zer)@=T^=LPfUhQR4u6Z>{(j>7g-s4&IvlX86hEOW{4>`uh|(B#kO`5XBE17}v91=g{ry8dLOhIK>||D1LLCbB+H$ zd}h4!GsSkC62Eb^bB*sN>(R$`&NaTmxe+JkJJ)#od-V&PYrOp(n|qvVe8-G9&l2Yv zA0q#w&NY5H;-7G?@r(P%d7gK!@fCvDUvM6k=Zx4lIM?{Gh~Ma3ae;T>{dl&=AXCc0j-0FWS zx%Ibsa2rn^#Qysb`J?c+$)ACLLtfB3uIT@gZ$`ZR9cf$dPI#rG(Yf@IK`8;1`hJ1|Lnn1U`lQDY#wFv+a5vejCL%>K>Q>e)4UIf0BGZd>wf<_Lt4% zub&m?|AM?R;`flB46lUia8~|4C&qbdkSF1d$ScCzlIOrrA+G`NN!}2C4tX>9CFE`3 zMdT;Kr<0!wpGV#uzL@;yo^d@qOkRlir^#o)*OA{1e}~+DFMAvLrz)pFbzB*E6o)pUB(7|0M4Ouhi=BcIgMNOI`?XPCg!fBKcgnT`#wGUjiRM@lU~r zkiP*ROa3E#2Kkj3mu?|1#5i*|`6GybguD{sSCJn9f0?`k{9W>H@Q=xR!FQ1lf!96e z@OJqNzlVGq{6q2< zsGm>C>%ptxy14bXQ{YFF_lLJ7FMyvyZrghf`R$k&E+$`qJeQL{3ZF{8>g2e+XOl0% zd~qxJ?>O#SLS6~wSwTJz$L-IPS4aHo|SL4GFu2lBq~-^nk6XW@Fkwb!Na z8swAVjmWQuw=cAjO$Aa$&Z6SK;9F+l6(mKMe;@P zjpR?jw~;>&-$lM2{tNjQcqYELvG)2LUXA>Fcpmv5@V4a1uJJf_I(Y+lfAZGwVdSU5 z$CIB8pGkfpd?ERC_(SCPz@H^w0e^#hEqp8a+wgD6{{#P>d>6bDz8A9k{}bMTymGg= zKJ9xmi*E=&jpEzD`;ngpA4+~c{0j0R@DlPX;J10K0`cFIuY~_b{sue?-jnlJ9!q`Wia^^)Xyd4cAiy4Zr|@rCw~X+JCFQ*_#NcC;SZA6LV2DdKMMX5xm}-p zhrAWyKPGPn|CZd&<9;RYfcOyKGgy0dhgT;b2yaAQ47cx%El&o#E5(0``Z-l zdl5f|+|J9cB)9cmPj2U@i^zXN{x`}0gYtYpz8t=Td?oxx@@L=&$xGqcIN!B;v*YkO zxeJ^tX#m~k5V%K*q-u}IqD=6On{^vF1ZII_i^7imWWeDV|Ecae93+rRH=^>Z5B#wYUv_^Xs>1l-0Oi@yy18O2`>|ABlV z{4esm;Z?CeS^h`idF0Q-k0XB@-j#eS{A}{C;DzMBz$cNX&_AyyKN5Z?c}w_m^7ioO z$$P-xBEJ~^G5JLJZt_|1Kgk!utDv7+JuibdCI1P_eaJ`Py2`oacK^U|@@&KxledIl zO@2E32J*h}JIU>P`DNtiB7O~db@-p;C*t}~676sGW7}1o+_o!^yan={M4p1%{$cr# z#C4Tf6ki)YpL`JVEF!n>(Uy@HB7PG1o>KY>3-z7_r=x&1rDuajSg`1i@J-R*j_)#rM|@2B`@ z;D3_OgWLXOd2WT*#{O!)7~YipVfc;YZBd`Mk~fCmP5uS)JWOue`!abg);1>a2m z9rAxlz7PIA`JeDp@oe=_2mP=+d1ZJ3xs4lx$p@mGHcnW68&8TU-s-{noyFUDGMD0Q zJXuJ7KK8GrhWCO-pS zjoj-0Nb-xY+=_f8md_+V4*3hnkAx2*zZ}a$$tPfW4Eb~{PbI$r%d^Pu#PS02`?0*3 z{823bll*BcKTG}+mR}`*3(K3x|BdBO$iKq!cjSLy`4!ZkwQof%zfV36%Z;#~S^QFX zYw|zfCy;*)KZSe;yny^PET2u@7RwiqH^=g&a#P5U zL;NiAj__N^d&2J{9|(Vp{9^cO@-gt&$S1@9O>W;yenoEIOa4qg8+kJDeVVn)?eMDP z%is;jOX0_opW8cb$NuCa;g^zM0l$WPKKyp_+u+N|?f$Ok$rmI3ZMgpa0&dZY3Tod& zT0LAgFfRX2mq)Ac_{`XMIoDm??(5j+T;r!A{#WN3-*ix%Cj;Mi>3TK(MZ_naYkZ}1 z<(;j%&z=BK{3>JD&M~+{Q`!{QxWHNaXpR;^)DC zCAaT41Kgi(c}Dk%`$1K5`}Y&;liRr0oZRZ|1akXc@^tcvSZ{A~`+oC0a{G4%hm+fV z(M9C;{qi(&>sNEguSI!oBe&lVT}*xx;_degtUf28{-36JtDkk`R?c_GFGrqj zK>iCnz;V5`dlt%Hg}gDmCV5wQL-G^gEy+8<`;jkzUr27_=P2@r5kHB1IlP42?vJ{e zd=26sCVv;cntUhxBl7>kza#$@ZomI(^<1TIJl@vGKYac@8Ga1;0C+d@VeoO}6X3Jq zdR&BCS)&!&@0D749>Z~_{a&fM9_RejBre~Bl;7IrN#`0rt7#nnv~xZ5u<`a)Do^V; zJnmlXEy3{3i+*YJ5RNE`@N(` zDc*k1=r!`?$nziar{O=6zYEXCer)Ug0)904E_fI6|H227XZDNh$BsKJe_i;^6yE{9 zl6(MsBl%_UAK==_g*d@w-`sCIFI7L zM!OGpuJ!OB>fuu7S`XIlHvU<=97OySinsnS)4Ap!)jTRrVvcjoZ^vnOklTGt50O8E z^V4U@UxmNyT-R%VfATfwy522_-|SrD$F-0j^7yxN-yc4AuJMCgM&XICoNN5I$Zz9; z)!TZ+|4i{eBEACJ)7sbeqsq>8y$xH%>pjA`uGg-oHFU1=^AO+2xyIXg)W*5S|8$J} zkjHV(HU1Bj^Hk>=-?+6#ClY5k*LXV*?c-eI&qKV8XSThzUtdJ=_IrK9oNIo&Z*VO6 zO(>`BAG&|(eqsNv>(vyWI#1q|$1J$Tx6X+DCh`WD*Y0+Cbh}chxBHxHIqkaQW6rya z4@Lf`oooDNl>a5?n*S8!f7Q9h??e21&Ncoz#DCyi<9|i`4)W@#hi~9k5BB$A_LFy! zT>7ZkKYq4&8xI?kFO0(yCz3CP_afg9zlhxaKF?(Gc4(KI$-BV+NxlreiF^zEJMum7 zzsT+1XRkdVF0j=@4%)XJd3Sg>@(bak$j891BVP@_oqQ|&5%L4@m&r4OxZM9H&xQX; zZvQ@ei21~}w+rHrAuoiVMm`sAfA`DsEP{`r_?7S(Y zBHzb+G~fA|;&%MA$hpQJ(4ed;$C?@{RD|ocM+1 z-wCe_xBCAT^;4g`7RIlW$ZfptPHx8){mE^9zmVMOVHCNI`;*{W{u5AkeVR$}wb0LQ zcCPjR80!Bv=UV?Z&n|JU@l}tNAM$w6xo@v0oooC#h=1C-#y7_N_$u7WUqh42V~dN| zJloqwocM%16aF=M0sJR&`~B)a;kMqnar#6q=5up9@3!xk%v)go>P+!AKNdJ|kKFon zKHU0MJG9G4=eoW3px!QXuJvYrw{Ws^jkmvxdzEvIZ-sik-nquN#m;?$bB(v}Bkpjn z@sqLR-R)fC&p`f%oojsRIQb!uN1bcD{XKzaoooC=#FskPc>8_%*PUzpF2uj(T;py3 z`p|ilAKSalxyD;R{F>a(7xp^WJo}L67w4MC_R|d1hqbR=pRWkl{-gcD&O@tFd|xcr zrFc7TX+~~+>lE^dvJQRpBcBy>VmSFC_+)Y$CvPC%iueb~ZM)Wz+kW&Oc}MI=+sO;y zd&mdDGY7{7u=-pDZ%CfVh~rKoZvh`bZpV|CkdH$Abn@x&1>_6i%gF8TM!rC9=LMU| z*CNjsaO+o{G4K3Fem*?s|Kjbo__6RNaILo!(T4hTs*CR`%Y8AK^dP?zem3Q)fn3+R zc-=2%W4-gqZ5&%fz69~h$ZcGD3a;hvfOYEAdKa(de+%V&hunVebQ|TtVQHem`EgRq zUngEnG=p1x+WF53Ar#rL*(!MSeNh1lUQbMD8z$<8(YUBqAI zT;r`g*E`qv+UOKFIM?{Iu^-;yT;q!of46gux9d@l!nHnidvoMJeXMcun&(aASx;US zjl7xiSiAg2j>FGHqYI+dBy7E1;>AQq=N)1C)B|qqTZsA}=v>R$73DeCxo+>9@JpO) zy!}0&kn#pVuefk37ec=SaEq(T&`W z-_9lPjQGpQi{V$nt)G-)yt>21pB%3;`ninauSCCE>0IkSL}y&(TZ~$+pl*x*Z4iiztg$K+kU+tuI-}RTSNZSN6tm@v(}I1vES#d zNj@Ew)C6vMaM?I9ki2u8HZj_HCzw7>arw2Ji%`!qoojiX#CqpA*LWMZZ*#8kE3lF~ zool@9?+-fH`0y0@A&*C#YrOq^uxH7KVE=l>x#qFo$9&zn=6MA1?>pCc`@35oI@fsX z4_}bmIPjx$&9fR6z1O+sS%LNbMQ-zQ_Qet;4{P^Yr^d@woNFE%m+Cp!^%f!iNaq@F z{jHUAjo*Oyw$3%)j>9{V+i~?7aP4o}w5xIbDxczC!1fNH_;vCbeOyf55qYMO+wu0z zf5v$S1;oCtnP&J0xC_)x!q(3FLO2whMXZjQI1HklXR_ zH1b7=znOd|{Ga6QP@ikb?YihDa=R|NlYA=j93Wo?&l!4nJ*s<`Ni-j$*+fRBEJLvDY;#j-$VW!;*YrG@a@_LZvxl;Z*z-A9!K%7V;(ux zc~^<+hx^seaIWKz%?o{;Yy5J=4{)yW_C4=K&NaRQ4y1-T*LWKb$2!;eQp8{3T;uI~ z$?M>@y@TXEecVpIGUmh+%*-d?n8TZ zCeIugfBqu!=J1K+$HA|M>v}PTM2Qws{7$s{V&`2Y@?_jcwbZ%RvmHOIaIW$8`z$M+ zYrOq?E9>A^9y^ZOOz}NX{%>6TX_ChtKT~`X4P2oxj?ntl^86R&51ngy?0(%NoNK)O zI|VhJYy6Gp$`5%oCGR>o_IA!S&obN>)!w=0xf}6aoNIiO-f^Dp&Nco4#P@fu@tX?b z_(9G!-i`-`I@kCCxWA;(xyC<={Kd|@i!aEKAM%*wT=N82@0HFq&qK&F+quTu{nhiF zYrI|mzn%PXa1;ayuSaOTGi;-%RpKjkuV`}Z}bklWv@ zpG9te-~JYI`@O~c$nEcnJVtK+9>;2O`}a6rBe(k|-zUEb+xr>0{k{6#CJl&#z8ye?LEu{2`R54f#rVC-OD$v&ii}|3Tz-pXf01H;`u>`4;#za{G4^ z=91gr|G%C5W8`^&{J-!g$tz<T5<#ul`MPyHEE+a{K*|o#giKN9-l9j`b!kJ-i)H zfL9?efHxo?18+rc-#d0Bx8H;4L2my(!XWayk^d6%C*Z~8_U{B;LvH`R%zSeD_h{}W ze+l`QlfMmrmV7IGJ-Pi}YS&SR*YmMBugoXE1AZC#DEMUZIq;d}|A604J|4b;{Au`G z%H?f0R6Cw~XmOS48FUO)DIObzmLk-ri7F!%}Nqv3IOIi8mJ zQoj;z0Z8H5yd#!#$-7{=4*4d`zj@>vFwfe0EWh1H)P>?3WW~^vJP(f3v%kyV6mFYm z`FFyLDbK<%hN*s$gLhWkXt=$BDZ?jN^bSAgWT$27rC|L9`gODw*%y+smz*FSA;d$f-Q9munTcAI*BX14wNN)Ang?t&}dy+4={^tBR*(B>9qsXm2ipfU> zaXm~WxBHXryiMyz&zn}D+U$Cyx#eH#@@TxZ_j2+rXpfcT)_$wW3$VP&c}tW6usn|<&qe-X=O?)MspNwYKf`%@7eAML9olPw^AlbCBJvt|Z>e(}az*bf zC$EF}mCjFc`B#&7!F%hRcXaU^$nE=xP0s!Iq+7}Dn(Pke{`sKW6>h8GoInV2wf{J7!r zJa)ubeVR03guF3q%$Q4t4ZnQIsA1y@$BY;>53YU1dzBZ?+T)c6r& zhDD)m^{rurMa2_`Oeh+Dxx`E!RWzYY#Do!JMhs8$Ui|685fg@wA6-1LXgo4R>l`+A zge(pz9$z%EXn4_>A*091c1}!4S#)i(*2J*k!$-(dT%y8Z6Nl-mw&RPUf{mIuv3SU^ z;S)y}jcZ$^Nx0-AM~^EUGPY>aIC*Dy(b%ygz9m0Lq--( zNQ@sbwn*AmD+X_k9A7jxdQ0{x`M>QU`cnIX?s5}Gk1dwAEEWXBxe%ulqqI>6rQNu1DA@!pz6|F_O$;4sfwZVoIM@?QN?XLS<{I+z|VPi&Lg+3X# zo_=o3kWnM17ET<mPUWKaIol@L>~1=*zf-@oqnQ+{mJ6eUrvXa}1d%^)+F%woI8q z9@=&OAA4^C9#xU`|KIN0-Dwh*ummEqggv6{VRIuP2_z7bkOTq6X+jc6BpX>+6g7ei z?%*;mGb7B5j(|FYyErO{>$s2lx{Z#EqobparGu+`64^ClW!8>l-4q4He}qTU*oIQdRFXG~$GOYjGhm#jAwN8XGfgT#wc*JUIFlu%C@%18^OkadmL*IHlR3P*0LX-2nN zR^D7w5h1|IwK3VT>RTc(_6iZ9en*412a&V3G_;i0#zF6RRNjKRn=InSsmdzmY~$L7 z6~=f|G9r~#6%CbWla?m9rLI8xkso7IdF8U!<^NW)1DQBYHomzLnYJu9=B$?hW<2V_ z4A(T(w3xfNx?seE;o%CVQaldRnAU+PoUx|9W4XrirsgV#TUOVGtX_xC*|M&&O5#la zf)|-gY}?dfn4)ehQdQM7mmmlYG*QwBrj<*l;Ay$MzM;Mb^Lpgp3dcrHwn}szfF4d3 zqWW`$SrA~IP*L4kuJK)wQ&rVBw>DKpc!|-Bsi-Qh1FdK+Z>nTDNlHD=6axd@3JjX) za?1^&+lU!F&@EV~v3y-^LwRKcQ*e!S+DO&f>he|$F_qdhJR|d-l37=jOoW#IAh`Oup6%H>gYPWa_q$E&hWKkC-503 zfN2c)j1$0A27JZ|UT~iE;D);e_^>qFl@Z8o>{=-FS zbl*?(=)BHGdd*0*@d}gw=h85gKRqJq{O3Tdqx^SCy6;Ju=g@iOBC%#9zVup?zugC+ z{NZZt^8XBpJIeodd7gcUlz9%FS7j&ZtEHlLpVF$(=_3G|k?eLUf3-XhQ~A5%zqa3Z z03DTokvyNK88eVdK6GARBfVxMnEV@)Ff8dQf7)`@`Tqe<)lvRy#lh`<5b2~t=k++! zYesUZx0;NndGaSy==}G%9p}IPDAI!Ww`yR}c|C~qno+vq?Iz=;9{=qHuJa#^e%ev} zZyroqU`Hvx3AN9wKhk%U|E}Mfgw>Ls>`z-AI{$T@*#Dk1lcU`?Hlg-;(f1s5lz*yh zsJ$TxDSz4`(fPjs)=~Y#Lrp@v4{bv2^ZElKI?DfZ$$u%@hYrf0TuSG^8LXrHpB|0~ z9I`!R0yyiuF71GkaPd9H@Z!dte}8bD|2~Lyl>gh3zfDg%>CpKy)z;@{|h?FzxsYtaBuy|rFH%b06Mb&`;xzX&tOW^ zKL28**JUEv>m`5tUV-XA9RGFxT|3EtxNO=+-&>GU96GOrPV(ROdsF|lun!%SKUGQR z|7VDGRR0XwyxnHhkP1F@{%;~)GZIXtj)kL5(o_EF_^inl-eM};fT{NfTWE1-$ zS;yE2QO9YB9hUN|VmkKsj52LPx!U|K{;reqZ+^n$v{wYlezgB@(_6a^g&0Zd{13|J zHqH6o!=|@vAQEevQe5$qCVy}LC6~16ZT`=8Qva}Qq8};$Cp)QsTL<~m`w5-@Vk}Bc zNvYJaBUSR>IWNZOPRo`deMj}*CHbfKH0jCy^u9yqKf42+lwu!Ej5tC{xz7J&#A`ux-0f0iYJ4lZW zq%qju8e1{8VO$!H@pO{I+?(^1j0~nz$4`*ErHSX}7R>VdVm0zP_jl;aZCzqAnJ5Fi z+8GMT!y5yC{Nb!_JHB7heaFE_j~(AEOx|&zsOOF!vfVAH=jO04^UxvJw-c#1f9*Ou zDLlk+wm6AxB?sK#&Vz1X=Qpl9`dimOdi%z~2ch_yuOR32a_(vA?;LvdoJ{Hkn`a`; zes}QBzqoyNuIcaWUOmUzz4mX;4w7Fw$T_sPhjUNZ>2oRNgTG7s9_mmp zyk==HT)R8>tR0kjh-A17v-z9kuGt%=v{Y7SOP9v*7UzAZ;Q-2zTHx&Ho9y2`xQ~B# zIMsJ3&FB0uI33|kXZl}UXN&)+wvvr*TgiSmW#_jjC*?CZ;H;XP;FN8@qM%gZ&UuB((E?evb6@9B8p_+^&pfng^vvCZgU%|rSJ|fiS%=y}nTIy^ow@tG zna-Bs(DNSJ((%oBE!Mt$(7uCrvYuX>%2_#6G7 z;R}B<1mz&P14Z-Ur^WEsBKU3LjvvmNw*!8>Wv?4~jq?8CtOs}eE6F+Z-3mWsT*wCC z)4?4-z}8>8{+)g&^UzoDS@Mx@;M;j!^QUd{IT@Q!Ka5rPwDr$C^lQ}r12-`GFK*wR z@4LN6Q#~{N2eBe*>xJpC&kg-Ech5+0R^5g&-I$np=v$QeApW1=?0q@&thEOz9hGGp z^rj{_TV}YapM2{-`ci5e^n=j{igHn|9F#A6$9F4cqP&@hemLvN?NoN6bY-km7h=ymA_ci?)-P}t|uNte#>C4S=fJ7t&j z%{&zT`kYtr9fs83M$fIOeqg1qchcON^apN78_)1L(>EdA$L^%jU3$*keT*+LsY_4) z?zayg?nnMW?Lq!96aUFqs18);R}oKk{l3A6^0v3@HV1uheAe`Izmq}vqCfW0`qDi5 zbp5|?$U-}s`hSJ7sbXQZH=@X?0N2hc{a@96LF|17lO6zIWkhi!RipR)yz7Jbrv zZ6({$hpq`ZTbe`8{NCRm&e%R^=I$N6X72tq{PiO@eKh)I(z#A}WjWewJA8Q?+WIeU z>dyDj_uq$JZr^_$o_s&#|BCRQzW&|Y$^S<D4I+c9XvZYs}Cf0s+=WX+mB*q2B@%U71@ zI+Op<)5)NEk$-hXo8N{pXH%EFIbq+qSC#w1m%@f~GansxssC&F%d{bpdiq&hzO$zfVnZ$1WT zk6C=?!E~fg|HPC#lH{zSy6)MBa<3c6KJ?4p7-Nw))xQYkzX5GD9 z{yR~I^eo?Wirc>L82GDi`Z!Oz^FBCSb_~K)R@QZlv+6JJA1>RD{DupsD~&^E1dM;~ zM4P1lVc0ZEGZ1mMAK0=|f7I>S_U_@y)RyFF8^oX>|@kMzCja5p&xUf z_YE!~ANzpP!3Xo*+-YDVevzBO|($qjzgfv?jTWc-Khy%%zWsf}Mh zTsC7P#uv18&Fej;gwM{rDo#Jr-V52hqmd_Ua5w8mS;Rl$Wqq--JnEZHW&e#w{v+fO zCyzFwvSZ2L=Oe7GxWDg9zm(F^cz7MslAXv#c79n8<|Oq=8(V$-j{EVf7EaCFJ=o`4 zc{y~4`(z$+-YkEB=0%!U=o%NF%<%^$ekWajIO`G2_dcHQ`|w=v?9A{x_xyL(GqjdU zM;)ps`lcT!%GyC?`Qfa6JYReBqqQ&9PtT)&#kz&sp4L@;{+nf4+7~*I$2ERu3$3kq z9R}S?u~vu+4~h@lHI|jv^}sWTga2vx_(6GHbL=+Fe$0kGW#WuzK0d8*K|w(pL=(+B z@5b`zr?My(pQvkTYFI}CX(JkAGQ#n}9ef~Sd24MNK3Zcw8ja%bV7n6unCuHKKV`BA1|QZADd8WmRQbGd{RizM{(H5>*&M-jRxBP9Z+! zkk-=BkXDONH6=Ryp$Gb09pA_YTgFt@G&eSw4vL+_E3S#DG?weJ6gmgViW9MP2R%Tm=| z%MpFEy_V|sT8`KtkBh1^mMk`fV|3a0DW6+;DMNAV5<#09ffNHTW#Q_7z}Q; zW&0=w16yrt*{g0fTe`PJ03F-j#u~EHs*W|}5k2S{DaCfVLb1KI_4GN5ZL#cC7jJ<0 zUz%Lmcvje6bt22@r2rks+TLzA1gLVa+%Ae1@Q8Ji6ww_?3|4j&ygjOTxxKX+1e~vY z^S9biEW0CmvCS?`ZhTIOy|sB@gxxE#F~vu8Y)KLQ3vLWy>B3?Ls%WqHh`rY;E|42M zmD*c7qWGKz*3NA)smtVcvs}q$Wk+;gdh1Kaapv+r*U+}GOJj=n%B?lC>uhq4SU_D< zcHcJ9v`wx)=ZIs7NO~G9I{oHEwG`XiJV9i{;;mNs^)bPhXXm4ZXvex=9l%T}+ziCm$CHB@^f|6(nYGZ=-Hdca)?Gk&tT*-tb zM{H)RU?S+vF(viM_SI<>GTrv$wVg zNEppoZjMv{zcW6X|3{Jri@(q1Hl}&Sku+DzWYHqm?oOlAD>-4r__RUE;o(EJTD~?q zsVveHp-y6F#oMDQ*T$*Tb1#n}b|MZ$9b?fwa%&ggEN27zB@)oL)dsAwS<(iqxdHuK zZNNGmpu5$2o^?Bh*7vOAF+7qrv2)9ZEhQ2;Tf^cFHgBJEs=dvKI?7^Qi2uY|!geBC z{r^M~TY)}ugO!B6O%-GYSsSu55(MpSTAZK+q8IJDHo|7}|7wnQ%)nCK-rDiXRNI!; zUUhA>S-63%u)XR;mM6;%Oki&xilPcDWv^O`ork80K!;iTdiq9m?;UizC-*zLdr#j2 zd@|IZ;ke!Ndmo>4LXscFcYVJ6-gpl_#L4eHH3=US9*G;g`|rV*gy9fAIVlMdVY*F9 zIvKZJ0!TvvQiAViOh?QB{IO?}hhu#1NL`3!eUK}Z8jXbHQDadY zk{fkYe(yBo(?5tJ5g-#BO@^|80nySS-N0!6LCSehEEp@!;C@t9stzR5qV+~5L)wW0 z4o&eQKV z3l1DN77o!Xl$mV}g#qUo6$wjJV*qMA6t2WBB-iz6re-^jnm)IJgic zpFk-mAg75zhc1(lG?i{LNC(|arUaC)O)>>ZSY+zO8+;sx4|rU%!3Vl!CVX-_FmzF7 z$CJd>GgImQ1aC!8Jc^2aVyp!XIEi}X$sJbHab`$0Q0h!uBm68)qU1G`iWRd#c7`*c zTP)~&I^KRem=W=4)8h1=MbM0_#EbQ7o#>IkQCMDAJ?6u96pOeCl>F{ zFv{ZMS+;`=z3GxnvEtHs<9o)%dt-u~=IE8`+JTfO-hYiLUtIp3m795-p_nA{If>6* z`D}I&jm3H}N#=7;KKJ5tZ$9_oa|)mP^0^RD9>M34e8z4nj&wdB!{^a_K9?rv)Ezq+nYY^d`8gU#z5q|ESS1|!pR(pV;w z&uvDu&5R6fM!3yLCwUF=h3Sp|s|~?5`v3d3>D#l}8hL!q=kpvs&*gIgpXc$pkk3VY zHeGu@-tULm~(ws`Wz0th!_99&Au=P$RT}Oe90WRhGMSrrE=gI3S8|=<3JY@yT+H! zfxXc0yVf_J180!fb-rn_!1caN4zRWxe0dz8`QP_5Ux5>@v-|U#j*RTjeLI=$xqwdi}Y-w`{|o~9N>~1pX`qXPUzza zoS5nfoHW1_I62Lag`MNviT}RLfN$_{PdF>!8{`eo4EP3m!`T7ffZ;}2HKor@H-Vo~ z(PoeLJ0UWPODA40rJ4Ia< zqmvUN!>0a;ZgKc?yNCAUUMJ#|BxzDUK(ZlP#Dz!+7N020Ty~)T=KdV`g4|Lvxg}w_ zr2?7T0;(%MBLx-3-H)-i^GVjwLQ*UOq|6Czgm!-9Ug~#;B(U$y#MvE_;0z>1ub`>j z;}fcV9IB*8yOR?dO{gE3J0oGO2~j!S%!D>iC@W!;Cp0r*vk6_92FY0o*PBo;(lR?? zn@4hX!gfz6FJYHQGC$z~6QXLng$a8-p`wJRO=tjI&z+y}k|$J}@P-LJk&d|2684+W zMk>pagwIVVVHiS@1jo;{{Ub>(O$eJ1*RMPwIWClHLhq1deL|WEk-gpKgyAN1Dp{~4 zA>9*dO*qbk$kE-^3FAGXH3=D>(AtD)Cd4|=OgPaKw>}}$Pk%tg-Nij80sSS%1I`5) zAPX!G)0M>jf79q~{uJAE@@ZBhB#D zLc`an1T*=bnu5Tw5}-dfb&tca!2=#rEDrL3SAqG_JuPTba5rBPG}ASYBc}(=bUlOy zl}OM`*W7c8X3 z8HMOCeBIh$rU{LwP+c&`gjivHFwYZe2o`%njlo5p(5m24pA(`#`Q|!rPICY0kJb5e zzo*V$_)VQ@UU0wkn>rVgH+WQnviMV||IiUUk4e~<@@GpDl5L8mu|wo__AHB%oz(lKu>KEV2^fIZeb$dB_5@)Nv+{3IFV z>3c=ojNouq&`5#FQe*1F?v&th9CIhtc&ZHlT;u7%j97t>4^HL)Pr4@rr~rrh z0}W4D_!D{-;-Pp~$jlzB_|8x!$8ZJi3gyKDcZZ5Oz~k~gp+y`xp4RL4hL&=G72Fr9 z=0E|(+#jmtz#XivyzrXCJG8uEKW z`$DcK^jHW>Q5ec$$;U%MUu+@!B;tBt=}OUD0 zvjB-+@EibMIK?EM2MBw?3jkO%#Ux$?z`q!H38A1D{1G7F1up}*UhoQl-wR#^@Oi<1 z0AP7=)JvDYjk4|!ZW=4#fIra2fqXnvx`DucZqy5rl^YDm zs)V2K`UJL_2IptSegS#D<4|f~mx()xo}!Kl$n)K73iS`{HF5m3HzXj>cV|=F(7;Qc zxM2Z#zM~P(9Ujph`@ zKwDhsd{3w_u*nlD4qWC5%@1rgA@=5yz%`ywY2bQKs4VbvPiR44n+b7QP6^!X2`vn4 z_kuD%K!#=K?T6kUQh|pf0w6pRe^gL_ zJavJGOo&IuhQMA=s4=k56IvB`+!JaFJn0EF2c9+|T5`E9foD9S*1&Tn#IxU;zzbM< zE`SfR^ZU%u-{>A?T>V7y$ARMNJaP^ZSLeV`adi$16IW+{8!fKR4+zJ)>Fnw(cAPt& z1Kc!YTr)y*%s4lbW2kewxvm+Z`8i^)YewjLDo&AWMrihl`R-CqLkk?Y#I582+pf$t z!!?hS3*0j}h6AU#E1eMjX3T+u<27HxV5G&T{^8OIX=ZPa6eJ7@Fz5TBA;&!vDcDGU z&njwY)o3GH@2_k##RL(7`gi~o8oI|diT!Z*+|#1p;|;eiF5n5ygldE&fS z;1`L79NNZCUzvCgNEn6L-N}oY)L${t9CTE^DQjfdf@uGc5O-VMSspZTCb6 zh0rym^9HMPn*Z-+UCJf+Sk|RKBHI6tkTET-G5ueJjA=RWO~{y*jd3_+OiOwALkY&T zEEY}}?}S`fCbb8f2l2lOnx`G=m;E;TaH3@9L}{E5g+tRIpOP(!!r3T|<17vT0_HO# zV0fz;0jX)izceEtjWyw4n>QT?kTiTtGRp_h(ZaW;@;!CB@QyUTzho5dZ!=$ZawXm0 zF+QgMchmU379XYw-U4~Mjfiu$R zk{tdhmg-|qE&gF@F$Ln`e}JiYM9Czs>5HhhHpvofYIMOc;$GK62=J`JNlz-M~FbP9yz?NcEI!an1!5eg*w z7O^8YP@t=CsT2AhOzBT_?dLp!|nc@X~*YAfWKhc@gUv*F_UG+QGH*@i{<+trX9JhUtbjCZ!V49 zzg5Zi>;rFC^F6oqpBrN``&;<_4$}YLTD~V|4u8<*gu1}-Qu^RTM>s!?E~(+BSmG8_ zd3Mm%rtmL!%^I3Z&9GPyukb$1ybY%W+D}#pD)!3Jp*i7lZx1nPEP1uoQKN&C-DLfQt}Hh zClthOkcPfc58TC+I3fJCy^}H;Cpy9>^rSHvn-WhyooBHodh6016Vs}v>%?Eq_6nCZ=Wa55w!d45;L*@Sdc!5}5QeG!n9O2{B z_!8b2Yr+dmVcBOd3OFe)9D#*SO5;m-J0@Ge98=)Hj~q) zhA-i??0=V;w0wVsaTRu(&8XTcq%&2cV)Q$Y)Pyd?nfqNhE#-QvxQG=8!dJ&Ca4lr- zLj2HvkKycn@%c2uLF&MvmpR__=s)A$WJX~#h*P#s=wN(IHw+5m483qWJd}#FNl7_5 zp>%|Y_G2wvZlmSoI4Mz38ZV0X-y}uG;8HuG77Cw>lL@D+x29bkqB$<*MnusOz9F=g zL^(sw`Y}pGEBSuh;&(!bD}}WxVCZ>72Vcg?c%1)A&&0V|CQcX6O8zY}aq^UURS3-z z22SmR6CM7GLnc#N#`dF?Uq7A>D*}?AcRHMjMC@~+0^FIL-51PqnIE8ElI1c#)c;W) zduZHoUv`o62BZpJWRu?KU&bG(b#4OjSK!+cTzdB6=Y`Xp)cZiWgqL>-{T}xt$u^_t zk`$ zA7$VhO&KFVFR+j0`!_{paIzv|c%#$W4AA;7q+EE>*Gr0%w}9)K@UgSK=l= z?VIMCk3u_BUx=6TWyGsK-nYn<1s@sol_2M7zB1ngN_>8@E?6-a%v;#$-hiq`v40~p zpFrB(=ekf^_M>G5Z{`dBgTWoe`LFKAg97(T+M+c>VQmoV$heOG2SccXpCoR))$7Jv z*9)cpPKLAg#P$`wAoZ3u0>)gxF2<UJ+ZO2Ors2z z2hA~lx80zrOnl@)DprE0Vm`>Ir*i<1V}Ai^JfH`6jNvb^X{N*_s6bI9E4wWJl-x*3 zR^jYip)(hk<(5Wr=Sy%_en~0kh6JT$StVupg|j6pw=gFb$S#^!T##Fqniwn!L z7CHRmV)WZl^rK{XWo5;YQ*uj6^NR{26C&d^m=F&pI{e!;;&&zv)i2CNp`jqVpr|yr z9i5w-TO7$MK&?z_d?`*n9F%{#i+*`%K}mkGZ8N?t&CM;0lon*+D_%@o3`BB@$~uG` z(b`mlUzuyEwzWfQ7|wVD-?F0O+>&f+FB9uUk-Q0L=$Z(A#m}msM$XPED43a*JvWjI zbI&ZuFU>PHjYVV^%IfNp4JEhl2kmH<+1Q)vKIX zgxWJ+SxIhoE}1^AC;}tJMaFf!dblPXrjlA7G4aBZ{IXmaN@ZG_TLMpubQ0UX zi*gpnmpzJMZgy~ZUI!8|bMC*F=%gUhK83ku3yVtTdfGHT6A|Om#M(VxMrvG`yAWN2 z?V4W*7b+~v&ysE#Gknx7ipq+zi+KDHUy9dB<49>~0YFTXI~jL6Z>8;#0A$0{jO z87(Z$k7SqRqFv%EM7+ZUvvVQkbiZJ|;&iK+TDC{J{dI`@>i^?J;x$_s~mtZg~F3CRym5j{IZD)W;aW1+i8IIjk zM)SCF1H&0w3kI2$wV*(IS@!Jw_|gGHFx1V%eAup`D6X^&vsEM~t1PR1IujQ+g~j@c zXJoW~*?#!o$tb7ucsq=Vi*=yD&Y%A!9WZs4YIZYX<)cGbAB?Xr$LEw36?YP!otKN& z&&tluEiH|dC2mWNu7%PX6w9E4oa^gT5sltLGEx%|ReMe(JXjW#~Tu4kgXhs#(z zPsw_0*V(vkJ<*OMGVmN>94X0K7%5p4Uoc{3g%RhIggY6^DJmO3qJ1VM zi#myjX46SLm#%|28n4?MIy*1FAjcFva!P(yq&Tajo!N~H>6LX|tP@ZVvJIbAR+g2W z7hjVFurx0?qd%mGAEa!iU$324Iy*9}plD%aK_T^aEG44EEL);M6exFg5swEk8FFwc zO;n1^5(lsXHjAXP0$QR*X69lF$;H=Faj0mnlOwm;CGgIIf+91cEaqVfo!d$xy0qjJ zk?}xs9u=gOaM^-V55)+F!3tK1<;6~iq0oa^e@;`fJ)-NHyA4Zb{vc%*b0N*9VvJryl2@s`V4 zKPoA!0GcE`)<<-E>jQc#gP^XANKjkaQd&)3J5!N7Rza|xA|nxJ6^OMr0;!5K6+j18 z>9|>KapV1mXuQgWF_kp@P)lUbgsbqH)=smyVr{V?+YC4&6I;WSG3iJ~>ERW}zgN?t zNJpw;*>_Mho>}l%TvkN$RzU%lkNgbhsiK*Ej0}9Q7|$70d$VNYAxG-zT_(k&NLJzE z2(Pd_1DS}}D9@bkRa%VaF08aLB;$bzBP5Pd8j%Tgnti`+tmw8H(W@i;r7hOb_R1byT!cE9K)f<$q z7r~4ion*Z6`K29mTZZ`JTN+<7%!4%J%i_(eU1CZx*m;aA6h2LBZ*L6ko8&}1spw~G ztJdPzv}rpEzgb&byNrIC+D0liDlonIJpm=r(9(O!qMOd|A&nYI7Q<60+PEQ^> zUoLI=#AMjfXpvUxffytw#0MvOf;>0i>CuB|*@y*DOl@INAOHE)DMynjJ)SdaGjql7Mqwz(uh0=-s4xJ#k zEUR4y$X!&79avoxPY2x$Rgd z)|i)t$FZUk%o{oF>S88Z@?*3IZAi6qyqH9%{TbZ~W@^`EOLEIf7Dq5l$Mrb&NwZqh z6@c@?6FV9ku<**y#&!{G38%saT4`=Jrj_;`k0sE_J9RCZ;UaKl%x=nQPRS~1*N^d3 zsl^s9#3OOX_ClY|&QsG}@d7<9Vh;=N6qFcS1vSDunz%WGt*?u)h?km?{9+YBuODKS ziZ(iC3^czd2Hl6|To0iYf+`U_fmfVn!k48O7J>5ogaNR$0|DLv!=4HJp`&P83bfbC zOM>=ThN1QmGOo6d$e)!JH!+%3Ow1&-?4pH{x9X*H^NWk)=R}JlrLJNWnkN zJ0Uh6J^agxXx@TF3-DF_w2o_OSXoscsj085T8kG%%}zsWi^IR6z`t|QQdQUJ$j=%? z=w}V00s7^GxIiTO;|O&%byX4j6AYvfOR{>0UfSWe5*)nZi_}!E#oIooxwS6#^9>RD z`38O!3DM@7%Bsk!)`pfU2rc8HScSCAtc_GO)h;)`20>C_OI>emmE5daT*$1 zY%KlcgXbk3((n&iL@48C)Uvg{1#g=8r!Bk}s@IB^YSzRylV6l@s_HA9y7IMntHi%B z;ViGIFR!gRv#OHIg4}eOP@gKip>x(W*Ep^G-pnblcIvUn=EkrYwZe##CPrEi$(ABR zBD5SoV}X`izPz~#c7Uy;Z%Ui18=6`iN;Y8%1nWsM7Rzs1DRLSqsU;<3D-x=!s&8p_ z%A3s_SBHKBgI~M0P}`aujngqw zL&0oy%WA74CpH#?OzP}j6hx;QEbQ4*ru z%&Tg2u;!Zj6`p}1Zv1JgTGfgliHX>k()#ss%i4&Qm)_|iO;vT}aD}FJG9Dr_5h@Y8 zFN_2Ks)7O0f9V4Xt*{`XI3>eMCu#r(ZBIA6duqZLnT8C%H+c7P?oCl`iLn5TEx@~DNOe> zm4l0t@u+9=gjZAFTFxJ5K%+L-p#7bOH7F6yAock03QQc~np9RT$Cz%6Zb)NYMHRfW z4ns_HGm>C(X~qu_sXAjgpbT|0J6_epFD{gDh+ZZ{t$Y&)G!1O0;u#=c$=J zmAedd)|NvBjRX{B>HYh2 zjnT#inqAqm2gB`wR2g7=+nH=ma8ZpJN0`SMC@(3;bXpz{APKKclZjOm; zMU8bRr=lD#g?_j;LSE0s<59)%rmEIv8cszF?n09Zt%^)M>#VD)tSN7*K^A6Or(X|~ zX`SlDHQ>R-V*+dnqA6+4b0V$vSXG$GO$K-JfLeAMT6|#?sf?JVfz^z$U3NH4+e;v_ zytSS`*5r^EG@~oiW+*KKBQ$(c_m#1YgK#3`+(f-tMqkF%u(6En9jwa}GnO%{8yvgx zX{M2mV@#Ee6ErttH4K-t6JisF9n3@(FcAh4)1*{XhXk>h!8)zArLtiS#;PjJ=FL?V zuorerowbw4Pv=vlvCdpcnkWX9sw#6w1HZY$a&HZtgRbX)6n#XTwUB`#6St zvZj%u#6|SZmxboRqU;KGfa5EC1cl%<;wVVOY0S$msz)u=i1~V}q8K;hkzE z8$16^YfN3ZKQy&A(&E@GT4;PW3qetbc?Q3ZXC7wIuW9&VW%33PkBM3HsQB%mQ`OXj zPK-ryv=mf$w413nm7Q<7;fO_7@kYY>7)8+}YbwtpC2N3dvY?&p48-(hFjkfJ7SA-? zk!XcLQWO$*x42*>R}ZSy^r#3~&WphCu~)?0FcS zot0HpjTod?W3gz~4A$u}9#%9*Fq76)V$`Kdu`}@sfEQvk7)HSP0dEa0)+iK_3m1ik zOH7W9jW7qgow1c;9+dHX!P8)@pv$Vr`{j2cF~Zw6u@Wc%wm9%0vnD#;3L@jMHkl>u z@`81>noq9sblF(jN)rj+^SI4n$_c#%MWnu9Vkx&|vx zjJWuuHkLvd2{8JZMXcoz}z+C)jiR!Jasl@}DtSsOr z*lwt7Ky#84u0VAnJxoO>KO^Qdj>1xp8Q*34ylc>6J zwWwmVP!$^O$+CWpYjj@x(4vA1MvL`mZ}m32b#fUC_<2Xvaa-4T*SV%+&@@8rT~Td5 z#E&tQ9)Bnw?h@^mCvdXWPCLrWP20|t5axqiLt{CtFFs|S0h-n>uf-a}446(!6Aj$# zP)<2o7lTgJ5Ez&%TKHL**H|>J$oRLcroow+UxfMBJjF$y8BDJ2F&7Vg5bGs=Sm3=9 z*$yFMHc{+D1RepgiG^NE3rsvv@O}W6eq3;xvE-I^2s{TgUFxQ2B=zjEw$IW2<;l7 z$6*-6pO0{P*j-?Y8s}(3BHZCIw@%3fva;)jWpJ{|4xKajJc-W}o!Zt)s<89_$lsLFU+N{xpX>R~ zEOC762lX){h|*fNH)ia z@*guhkX;%tdt>s?`rOp_7peSrk@QEIbns6Lb|~BH=SJF;Z5vC=cc9^(%6pGu__6_q z{?w8V)?d(dU>cR-rqD0KU}^aO5&qM`aw?wq_4q5~fO9(jRNv?G{i}O7y3pVC)8A+R zPyFrOfA0_Y{(Gs%)h(;4Y^iO=fQiwrs%czJeFYq=3Ri6SVCLvdeFK(~k><*k~F~+s79YZOXEUUp{tK+{k{2$2C zp-wagy<=!VemzY{F zky-v+xD1%nshTZZw~zwRyP&Ixu2xvx2Mg5Bo^ zyA%Yw<_E*`f=P3O-R1^E^Md%Mu5ITcYj?jhXAW*RAf5X@q!U8^yk5bhku$`PzMszB z+JZ;t2NMf|;kk1|?sd?d5OP0u9z-}erZ9N)tdM&xVAqiQITTRA2ZVkf?4B1KgIg4$ z&3!P~!#(fp4Z&bh@TdoZ!Gd64e7X1>j_*q%xxv0g!9HB2g5cniU>Em%C`2(6H!>bK zC)gjk&I$TM54+zw;S<9rhfk(De1BH>#Go(aUK9x59&!(z6@K3zKxg(E{tg&EDKY%_ zko)}l4XE(l?glFBTvTFC@F-kEs94)0A@?a*v0uo&+1-F_=D2S|x(6By4MZkQ*bp2U z%BPrMGRi?Vej5pp_p2^!?AC^F4|aW+m4+Tfq2~sBQ7R}u8rN>94TUaZ1&N_TD*T-$ z!)K8`@eyuO54$GWoD=LxE}tLlIhS>IL-~eX z!p840Cpd~dwC{t+9P((G14z(ic5v)GK3@>*H8rqd4I6`ykO6B`8+$A^e{a8L8u6JM@ezBAqYJP z;v9x2bb*1;HPJ8U&I^5sDj{4DOq_)hp!1zi{WiQ0W#|H%;zH)=hil>-_pP(ZC*8mJ z$>d!_7eHhV+-xH|!_jksgXf^|Fa+oT%4-uP3++WlxakhLB=>ss_yo6M12+SWGd=U! z=!x*ap!*BNk|$6%>5FR*T)X6>koY=%7z=s-+V^0v*M-3VB9S5d75x~v&jxn;zEF;a z?28(>t*AB}Z8tTIM;9rdM|DhayO>g-hrB@ zdY~?F@SS7}_cfTG3QL9l`KxT>cu(f|R#SCkGsmJ-9bK8*ReLNlfqBmukh^B) zy!42R!>_8~pf5CvKMI-im$$@4Ok+-8H5Gr1VV)EZ5gN+8YdhYLdG~hwJ+!0WQy%(a zBsw0$f1mljI}UqW!lkua2M2y9wF8Q8f-+x9(=N_++S{3gT=Uz39muz@uaR$GU&Gti z*YNi3Xn6Z}G`zh(8{XcZ4fk4$h&f#I)k`)Qy}IUycA{arc@O_PDkc4Rdq*7Kyx1Wh z--#Y-=8p8-*@>Pi@LryFx4)2{20gvZ*W=+X_B@!+^09VlKoG~LN{{6SJ$gnNQ9ggK^z@Lp0FSq^cDLNjBc?pwcFz%cTQ56fnfWoM z$MQ0f*X_Qf6Fo~+d90r5PV_W(qNk-3J?lHs)7FWe^E=VAxf4Ct3)lT|n{eG9U-IY~ z;c2f;a!+=f=1#{N8>+^SG5?+le0A zU$mZUI?;b~C;XmHxL|s!<8_7g^RPr%Zu^C`zvWbKI=u4Ur>$}m&HBCk!A>~&2OXr} zD{tpz&F|_&-p;35{#fa!ny>1F-`@%Up%b1h{aWk)ODFvJK*#lM>xAFy;okL3cj>>B zua}?Q34g5x3uEBZQX!i9CvE{#+;gu!nnh8&-9T+0DD#@K+DFV;4!zkVjC;*UMWx z+>S9M|6nIvn$ht?&kz!nLyF0Kn1#6Fd(-(KdEyHsZ2K(n;lk)*>uBX~mbj5}B|a4Q zZ4y4#!%6>V5}qnos;_t6JWa`eE#YN~eA1*TqVf}kU#|Fc;a4k8zgb9!eLk?|EEP`Am2_Bsn($i;j`9lOw<%sP{4T}2 z3x8PgJ;I+<{4(LsDgJZeFDq`x>vt44`(lpsH^tu+J)bK6PvKuG{-f}NisQG3`1n!r zqlDw9`}nZ-94S0e@hQUXyl3Ul6Fx}E7YiS*c)9S=iZ=7)9~AzO;$3B)-lzBo;ZG}W*8wjmUMBLdD&8pkEycG8 z->>-Zg#S(P=Y`vS3F|-a3jb2cebgx{$6L&EL8jn(sp@ZTu;L&9%Ye2}ac?^66^;dVd4>W>J2 zM9FUuZub+c{C45bDEX&_zohs_!e3Loi>y=MR(zQ7_Y^--_(zJLBK$MOYlYi=4_p2X z!oO4Uw+Ode`BwfI=h$RLxiU)K25lt->m*J;lq`Do$%3$UoPD4 z+gLq2gilfOdxW2;_+N$3RQyNbd5RB``D>Blxx#;<_(I{8iZ2&_hT>-lZ&ds;;j0z@ zh42d$|DEtl6@OUx7R8?uex2eU3jc-T-wXe>;z{!SvqSMA!tK0m+bcu(y-I$z@ZT$b zn(#*zZxQ~K;ui>iUh(UNzoPgZ!rxTr>T{-W>?6t~ZTpD2Dnkz=t@w5Fz`aWG3q*d6;yZ+&t@!i8 zH!A+Q@QW4iEgODUDxNOGqvGc0ARXs*#jg|jcNBj__+J%&UijY?|A+8@DjpPn_*(I! zh5t+O3BrA{F1G!8uJ8oK%Y}DS{4C*iy>Io5>2215_WgzB_lf*SrRNdh$0`1l@QI4Q zEPR^ce-e(*i1K0c{Xn>VuVMM;!toigIQf4GpRc$p^;)EOci|Dm`wL&L_%PwC6pzTJ z-IqT(kAPgZ=9@V<(-3Ll{OrNW0QzC(Dr;!g-4tN5G3 zGZgbt5f1>#1!YdWuA^Z%*pAg=t z_+N#uR@}a{S+Dr9^73SZ;wKB=qTX{2Il7D*Q&p?-RaF@z;d^M)9wN->!Iq zyv(^v@qxl0P&`BUBZ}t&b^IOIH3%^J44B-zdo-h0<#b1_}nJ+26O61>B{B)83Sn)H3f2;U~!UM7|X#3sO z!h0%yqwqnB-zxlA#disxruYNGa}|F`c!}aq3$IdqmhgJTo5en7D!xYeg^I5iewE_q z3BO743x)4g{A%I%DZWkkKE>}7{-WZK3x8YjmxTXa@mGa^qxjpxUD;2y?fb6qWX1m~ zJWcU$g^yP}AokBxysPkH#Rm&NUGWjZuT}gx$#T!% z{xRW4DgL&Uf0W{Hiu`27M~*f1%2xank)N;lkHRC0cb#DL*nM|f&Q#%NDf!XDFIIf2 z@aq&mLHI3-&k=sN;^o30ReY`R7Zv}d@OKoyU-&1A?-PDV@#lpn$Ue8V!#l!L6#rQG zFvSlDpP+bPqOtP~#d`=ZR(yo;a>XYLZ&G}=@QsQu5q^#0Rl;vk`~ux$ne{3FF55`IYW$Au@# z{<^K#tHO^~{2#)PQ~XcI8M~dNctFPULdE+Ek0?G$c%$Mc3O`5jY~hzFK418aidPEX zuDG4w?^C=+=YUj}m^5 z;%&nBDSm_SmlVHQ_@5QORrsfh|6cfaireRxa8FZS+m4Tld|$<16h2(>cZ5$={9nQ| z6)zTEs`ydDBZ?;rZ&JKT_*sgN5xzr%1|GnbVgg>cxrEvS6 z&D!}C;cqDUtAxL+_{GBAUh(a9x9~*8?+`vp@nz!w_Pv}f&m`d|EBOp?zOx<*mPsQu5WJf4br?NqOcfK1<}w6#qcv?fW{L?{~uMmAoT* z&Qg4Y@J))37JjYbvAp6-1dK5RMriJrcScM)Eq_*CJiDLzSfwc@s2 zRxAFo$e*kDmBKGm-0r8{p!l^S{~N`BF8prAw+Y{?xZSUKUUBPhZz*oqf%g5LwdZZ3 z|A3OeU${@+k6HOgg?Cr{3E@X8{<83N#orP>S@FLJKTYw!%RFAGxLseZQrxbu&QaX1 zuk3q8TQ9r5x?aiK_0=tk|5VCzm*O`H-=p|V!k<(8HsSXDq%F@L;eS)|e-Qqa;%^K0 z$@@L4=S10WNmAUdZ&MZLKZ0=_$G*?Bdcs2iaZFV5eTC0Z{8-@yif0O6toQ=q%N0LY zxP32b%X69VHYLABxP4!0<$opoMkRl@@LLssNccU9KPG&i;!g>GN%8*>{%6HM6aJ~< zUkU$C@z5}1|FFF0wDlS&{3ykT2_LQaB;hA0K2vys;$^~5SG-(!z2f!4&sF?f;hPoT zBK((%-zxkr#qSdSnBor$e^v1pg@2&ig@34co3z*0ioYZBuDq|d_5DJ4PsM)}Zr|ry`5xnpoyREo;lfW)JWF`K;w8dQ zRs2|K_mzsDF7oRYuNQ9L|J!n&E&L`WzghV26#u30hZVn9__K;XD*R2wUlabJ;-3ir zTJb}|U3q_Q%ilxBnVyP|6mCC9VCAO?AEV?8g`c2!tMF44zedJ~h~oQXJh7iUu=(2c z#yTZ$*BciqZr?Xut@z(X|2DB>Z*7pB4VT;&%M`Lh)BbJ}mo8wp}(0KS}YAWjxGL{9WM%iXSKA>LSH6gjXtV z?cb=l?QiQ9|B2|?r1<1x96qj5`~oTGHpRCHzg_WtUTZP+w6kFeWg`cnF_X*#u_;bR4uK0fl-=X-Qh2N+6$HMKtpe@hW!e3JI zj@aQH#gm19toTUbJ!N0Y>c3I+rz(E6@HEA3`yQvb?MKrTUm)$0qqyxy#fsa0v_$b4 z;?LEJ+kV=jc(%y5DZWnlWs2V`{CdT0f4o`oZ$y5V;wfUchZG+u{AtCf3x8E{+aLEU zex}HOs`xp=4=R3{@b2=QWZQkbls`rBbm4YC(#lszJ07Ft>x55M`~~5275{_q62%`C zeyZY4!j~&<+xgN#fly4gCbYF7ZtduhB99$>mR^8NAMeXeWb^8E&mMjc|u;#t9AdR<#(`rqmX}``Fg>7^S<#0 z!8SC9^7`+U&NMj6|C!}i z8yw~J-!WZmaFkDkbl|1ix6TLscSbh~dHvnDTMdr-_5RcrgQo!3-&4Ea;3%*E9_p_K zNBOTgK93n3kN%>vZYwteq?5SF-%&LcUa~vF;Fj9rK3;-^~0;!JlOQw%|!ze~t+LEAt-Q zPwV*W@5&7lJeTurn&7&g6br8F!zqI6az9OQ{r$2tnd^3!%=P?A!G|;dli=f->-DJC zGmZHNLO#I!E5UX9`bBU(PWgD8(fTV`PcP<}pZw^aN@kdl-^cQ)22TM={XLfqgJXNw z@9~~saFq9Y;0D)pgQL8TXQ9DUfVZ%G(BLTlU+4(esRmC0yZ%mu-pAGH)$gIz3;B^= z)M8nBA6Luk_dw1O^4GGw-rv>oI{z;d@?Ww1l?KQ7>-@i+xz7J8ij8GGZpfzqo9t5# ze;4u#SpE~ii@Cl0WazwE|Z zuK!N3Sn!Kk&&h&c%Dh7Go0uz{}&n@^Rs}*i)##y z^7`+MuQxc#>-^O3Q(*q1y#9OLdxX5s=bZ*02J*%5AFsUzPXYVjPDm~5Il<>Le@*ZY znZGOexCEu=UxNRM`B#Gb6P5fS!RK{W+~#?rPVbYH#h9c^9{r0 z<&hOIKQDLOMBCHQ{k9R28d79TO6BINaawbfwr;q0gC~wAdzQN6S;^E(+>Z+ztWkcgCt1etu2|uY#;o9=l=J3kq zRCI>3!9!KyNOM!eDyy=(yeZV&5ULKZv{I|W6)j6cwT=Js?n zHZ@d+BN1?Fs48zRkLr$b3|1*^Dz9G}j#v;V{L>+kk>W=F!33&O>l!fuC|X(9$l)p_ zHT6pxtWYS@Twb{>R9U?&w4}VI)=I5!Xbz{&EG!#G4l3f&$Se&vhib$1OPi~$5GKC1 zVQD)O5Lit;IJC{EB{gsme9al*_S`C)!f=jyTomD$cMZbTp(Rb_b>X-eFKsDrs-i+V z15Q_Os3aq(A+rizrIp?IAa@b5mZsXOa3!46PGwnHVWmO>n#=KbRUQ70s7jrRw<&l_ zpKOg-nF=>BPC_Hxz&H_&a06o|8sP@U33#VldInOs0Zm6^I;2#UG=!E8R&+^2mo#0y z{~!PU1ofMnQk)LI4;h0Y(W37Iyq43)s{%ikQ?_LO8$Av}d zrU9|N7GRU?U|JFNE3!EE_9Ryq$f1Ibu_-_Cvbpo>PD8@Tn!ckbQOF*Q(@bj=? z!==yD7z$=AGa3Hfz)(^o)4F3WK)6aKsb789;p<Pwr#BGCi}l)_OI7ZT3)AL+s^~f?d9JNocO}EnFWW!FU}XWe_j7qftZqH zLH=2Ap)%aW^G)q4Wt#!C7ye>C_|Oa=tE3G72>6$2$FL4vsX{!&$}!xd;J@@ge(IDI z^GY);%B=2_GBe3#Qrg4}OjE^mmN!yZ9Uv>UTphB#RczKWXyuLY+Fa3aKHT9 znO*MrwV~@hKQHZe&!JG#JwMLxe$V$sJ?{A}$JqdJy~1y29sbU-@BQAf?mgi2ycg}8 zogs%N7Uxebw_1as?&>{VtW4Y88bo)rX9@cd%XRwamQ@Ndy<(_kZO8(Dt|a9*WLdrZ zU0Z_>1^qX^enZw_QxD320O6va15R(!y$@y1%DU?ItL&E#IDTS#fvvrL`p!+j&UGoh zoBW3+|KM0-beuN%t%;bPXZE@`K%LxhETqG>v$ndrOyBzH5bJQ()6RzMweGE!Cwr?O z(lY&W@7BBz?NwP9c(x7&Sxi^otce$&Ysb>L$z^3$zmRnp^CZt@ZHM2feqbu!tPR!! zd#2g;p5uQw&DsEU)8y|3UYMVlmze*U9?NR&0nOuz%}(ghXz+voPqh7?-!{T3{k|v&bzv^liDIZ5MNmfy z@A>V_Irl)F*|5h6y@9%?4X`plb%u=j4E`T4`J`eKkf zagfzi4!^6^X9z6w0I5A&7JJqfmYyL!CZ+Wcy*LPopo-I+PFQADn*oqP-i)VR==2kahSD zNb^vqHR$(b9maa~5%{<46W?fsG9T4#`k~Rot(TR*PWSqMI<*Rar#o5tM2N* zxZgL{;fGzS9-{llYwZndA-(TIJkj0#xNpM;5T}1ZoDR57eB&nw8v>bjFP^=HRA>>p(Hz&zaqy7M|&nM0s_Zv*p8)NkbXFB7s3|1`ildk#`N(4Vpj+-E_K6Hf+y`QMkkMYpyKIw^+i+_grzXs*=Go;}s(2enNy4oxV8o;3$wiI3(-vgW2Z>;eCKrM^ddR4?6=6K|izeLg)kT1Rb|~ zu?}Fr+$qs-_np1@i2*yXzE(ng{TS;f)Kx6EO$Uxl-0Ylus5Hm5;c@OedfV2jA>*tm zz3pDlec<%E_e1VuVQ84>u+00wKVbgY-jvVF-#b#e8PbOJ|9xnO)hBeCx_U;ZsThVH zBaovV%8&YA)Io8ut?f=Ph#UOsHf8&iE^Je}JuQYlBL%{E`}ZS#4}h*W;TQeq)Yia` zPRg?Is+8u2hLqZd`lTsHRV7$QMKUH%31rX6o;WTrH9d1&=H%S$aZ@MeWRJ_4m_0o$ zH)qPk>97+py*v`0l$jE)#|?<8lg&Um%{2}6$EL7*mxPjV<+!NK zxa`WxaAWhaDVB85s=?`~2)MQp2&`-l*GE8i1VoNY0U>?q*`jR~Yonfp*jCjvsFZl= zGX?-@qy9|0+xpHf<|UF6Ht#s8$IG_nYGVrPw5>|5ejBe@0V(m=eFqz#HncBvvGK-5s zAIZ^9{!3qOtNR}NR_Reu8REt^c@UN&Hwh63mZnkddd26mF7I5*Ikb^~k!kZyoK-$x zSG$MXw`!o%g~I=hknLOF;tbi(zYrb!){oe7(1cRmOPr9`_}8`;XrrzI5Q`LRt4(wl89Q8KZ+mX3v%7R|_Fj=9T9yH%TCVg?b_ss1{KwDJ3Bn%CR6YKz{Y zaIE#NTeZa!d|&+!sUI_)hX3>x`LX-k^S;}rhsFD2Xr7n zk;F{H(zz#yCVEtuUAllveowUExtCoHE5xW<%$k_kC9!kj6o5&64gcNyKpZF_aOn}X zfU2H0#2luwLqT9N*n3m3oYX#;!o_!81V**#|`ZfiQei znWLMC(H#`EdN_Un2luwo`;b1IX3I)B8ggi8Pq0q|hhe=zFG>ubNCAxKYwHp?Diunp zhc_$vy6OF5*@+*LIoe~n`o=O8z5(n?j#)>6)o>l1pn`@(jTvO8_bltXAaS8*KE&-9 zRFe*=gu}}4XB_H513Yq44&yV)AuZ7^gBdD3j$*|g%$tl0*Vv%1I}8XDE?Q%Q-wo4Y z+bR?BRnwD^PvnZ=!HO`gAI5!BtZpbU8T?q*OR0LF%1;AKn~@QPES!?LD#!@p_K6kY?yB=wGG2=ssLyS9PgKHctYGh^`tEV=ri-V;fK92+?MNB!uB%lv z5AuIw*-)JS|I`F$Qi{|BFQ3e_=suh7YQi^%%!PC>qPuE=bIBZ}dkNjujI)f)^XNXG z?hEL?knShZ{bahU>F6nBK9%kvx-Yi8(NW3uZ$f5eQUj6dw^eVPLNZx&Z&jkLYP4xp z!mUa=(X6a{Re#=5<5HtdM_ovKSTI^gBW(YmBG8du6`?=Y{@)sh%rN`JjjfaqinKFy zlk5NCPSJ>qYkWJMmYObj+&+9UjHV8L+jmdQ?5F2$?t%Ca$xgr-iF@EWU~J476*Zy+ zOtwHEWeM#3E93CVAfSwc&w{CyG9DF^9T798Y>a9c(h~JHGDZyn!`smqbES9K7cl2k zMnhmI{;jj3WVC!2LIP;wwb*43_0bddJb1otkMq&H1=ib1U^&)TZPP<{jJJJ)uTk0X zLtplZzLm;`Sz%}SS`AyaZ@pog?z=+S@Ikme!?#h{#-Ns&zDwPK8MinID8=-8AF$bG{qYPV%Z>+LmgS40X(hS=Q zU#4MO>6@Z#r1K2lG{fyIUzQ7(UKVLN$LF?(gLf;9jJm|!h{ z{w7!lpq~lOgXwi&6PynceN1oxfZirp51^L`E(Fli1Q!A5VS3UiwUj((AfkV03@2=N&pEaxC%fg6I>0zZ-Q$8_)Kss0Ivx)0q~gMHUMrD z+z!Ao!Daw16KwIh-2?NC!hQfG1~3?hmGMCU{Y~%?fPQ(Z`s~3fxzjgG*|3YVAN3U| z8=gvT@A1u1HtbOB$9;u{ZLhD$usz``Hf&G&<{GxAd_lwZH(!Zid)ilO*!KC#4BIol zdCEp{dDb`IaC^zOz_7jQTj;VN!j@HS+efSJ>kRC^M*1x3%bKA3wU1#-GQ3%3kA=sC z)Zu}Tg&q>BfmURn>`^|bnJ@DA$%XonQ#?sz8P*-dLY`!@P@60Fq>zRDRCq>_WhaVN zdeUN+D$f+MJdZA654=kN*QKzWwyQnZ*;*Ek5_XNpQoT?O5WCisrEC|XtFz48HZ2iz8DvHbEZc(NETk6Iwk7riA|0~2V1_8;7SFT(#uX! zmGvsjhoK%dI&VVDFkNrRX*fJ_rHm%q2#?hxW;@Db^(5O?^aoo?y<)bJo}^wD1+L;| zo0cSHp=c#p-Jb&Qc)1|2@Ym<>9zApNa}DZE**Coh2oLV9a=8#KDZN!~ z!%^HdthcIdSh-yzdaK$-mZN*8kb=+Az2g<%=H#`GR*b;l}#murv9R{|o*3*bgU zFLq5-K|g{%Cvng}p=CM;-5FY-E0=@LM9WMLnk=(8=u^<8kb|bU&+Way^6dpx{jf#% zN7jFT^hU>g_}&M5G8Ux|qaLl6E~rDl0_cY^@9zWEmJgNqx`VMFY!O=hNhg}D?&I(d zm+N0DpFMsb9@?QilUxbQZhXwDDY>{GLch^t=gXC8A~oSR7~apfl@rxlNpQfv7U)!p<(zq&m`60lWcpd z>UwAhyWgwY4t37kylOll#SeJ1$UF7nfA;3ZEPwG9lZATf?cN1s3E~X?LGNO+kb;N2 z)nutcmxsNzWNAdpPH!VwC}w~4{uZp-0L!I zd%ccfdjg&<#I!u=_1Lkg?cczy8~lSDR&(8_QP>3g0CX|IGXOf9;8_5PCU_1&f(f1n z(8&aU2jDls3jkmi6^qA<0N`H?yaYCQViE%{18|$*6#$M2UIhTpVPalh17MrrbpWvQ z9g}ziz!1Ly-UKihHqm?NqZPcV+%NaUjHj01wqoW>E#J9Nz%;VFH#^kn(PQH>tEJNs8hHG1rC?cbafQa~1$yOk{E@ESZM{Qwo}Ed#*faq~QdR(!qO zn^b|*DzdMeSA1kkc5hQ|<+uXt=jIjPGPLz~?@?~F{u}D%72j>>Hq8B!;WpgOD?aS; z>=Et*$}NN|zN6d+l?^{qX&>$WTGzR9qaxi={r#buuRPQy0ez1grWaNlRF z4nj}`hio&zVgQ3pP!3>_2`T^#G(jbR0Vb#d(0`i|yRdt^vVDYkTI=3n#HY@^TiK{* zY;f-}Y>n={hV69slZLIy{WrrFaqm+$oP^oU?q>~Ki~D(Hqj}p3_X{qoXC2f*s{FR< z`Wx+js;ZY_eT2svR8y(v9LiOlEW@~}lVvzpb*gV;xT@3i`50$ZOu<+ujVx3&;~dpP zlY;S17P(;Kv;&Unp=o6?+fh9W#|}DGWTCt(byRmvJ!+YA z8o7{Vp0mvIEd*8Y52v9+U}FVdal|=Diu!{^RNx!xCQjyIUaRMoAWoU&GUii{xo8$u zY%f$9MuR(Si&AK8QGElY>SWF^wy3^=Eh*%OEh@vs{%`N*(6>>M;~JDe{J+fL_e!?w%$-mv}EIb_&&JHHyXy^f{YCdKRt$8B^)Pr_(8 z#BYG70Sq?5J^+LKN&!{$XPr)l?Kvj_ntF8A)N1)off7xwfE(4}YS&o_R0Xl1U1!5P ziP$V?7Q8w^)nT%no1n%wvaC%|b(k#YC8#=#<>*?Upz1JLE=f>zm@Jnis5*>^bZtn; zqHxG^RYERVuqa&DB;?Uw36o_bOhJYe#O&9DeXwD_0qlbc$TKG0byLEenC0e#Lb6aK zZ%t5r32tb*?oEIdN)?!rYv4xNkm9OT*+6lHS4_z(S;A&EEHSfTX+pBq6Dt>Y5WXF# z6F=llI;XfkRdZB|!Dl>29R`)y^>44rTAXjXzVWK8CCiUqm9>=qBVLuY7>3L1Q&~%5 zeqS1_e?e9E32?*9b-PEce6Wr7{}f1n^rmj;$MT`ww2qw~Qk5U(mcY zjm)I;{wZX>;waz`WRV$n1pI%=i^)7#95X*$O6CVpekT;%Ac#QnFu3&?2RBMZCZ!_D ze=z3jGb0uMR;f4%WB!%j@`X@C6>4bE8YYv5YX7&SVZbnu{9b9m^CA2{swx$UOSKKToYRSwyLgc(UM>< zAeXDq(%D`N0~W+j6*g|kTfQ{7_c#uXaQSCYTGsn_$8zH_l@=<;$5mRWES@yV@oz>s z?o(;O4%h$eDAGga{=6#3uSWoXL6ze`Oz+ECBvXRsSMy@wzOKrV%KFU(G5+@AnE9P5 zGE*JcUrlBz>-QRCG6$N;jNe%Gf3T9wSegAFw_3h&Q1N<9fg4`_d`f(>zbWRqStXt- z=yH|#6EFcQlPuq9=($CEF5r4}S}cS*<@s6=@i#!-xe*M>o6y%5?W;`nApUMP71O6E z3h(-m<#)97v{h?Qz)*YJs0wciMAB)fO z;m3xPvFr0qh?B8=IbiQm2sga^K~7j@EMZ}lum%wEFNK6PgCThp`dX)bEue%Y`}?be zJ&2+MIbqMDWiTh~4YZ`d3Dv$`U{X=VEbfmt%l9JO2ebJf@dB~5^!Np3;qo6#k@fr6 z#)|Mf6!j_e-VX4 z_3skpm&})`szTM~3P{>D;7=tDqtX8^RO7oB?$F<3@_X#oii=3G+kaIo0oQ=+8{j^; z|0i&#(&Hk;@BJoY1NQw$?y5z*pslOG(5^ahRpbNXUDCnInkIoU#WyYLjv-mT0Fw-N1kz)jhEysoo$xev#<9*=?(UjFNSPoO9T zNI~Q26#a2l-=9jn0)!}0mJgxt8*om>lPXk=b6su>oLBI`ITF@Qt_?hJ(vW(k7m5YX zrRY8dZg{ya^r}E{O4}c2f&FPX-0g69=5V+KJW>DeYXp-D*?vJyooO-s5>K6Jf&Vfu zfw14PUvVI0JP9Isi}w1Es{-EEgljJlS0xyG;yR3`1}9tH-vNr3>(WlXe}Z`!=FM=t z^~7lE8N|=vr0Ubr-J@RwzOwrWx9jrmq#f5It}D8$-i0=fH^8!GIA*91x4$SEDXxH# zfipM*F)-ImGXwK@=0Ps`Ug(Q(P3T)a3KF&sZlo;9HO)|VJS#gLm7U=ATUg2H!dDUP zIyAaJLWPhjb-6#n(lD%8BqN;-+g78y`;!Y($$FEr9()?C>LL8U@ZmoEQRTC#T+E7@wkT$7sVOZOGP!0&T!=;gHt~ZK%_Rm0(bR6P}L2;^m%aV>OT27uc8s zG5bOrC+$|ow_{13ZWHXe_Jj#`v1@G`2V~&vN=lJlOqWjMOl3hQsnrH`c7~NPFwVvF zGa=3;=xl(p%qWV3bM0JEqg)!}T>c=c_B1PFjSxN$(}1z+AQARdE8|w-2h&}G4)KY@ zRAt)Hm*rKiVFu=dIMvULJ#93BkEJ??CfGsF(+eqt%n5dxbNKjnQ+h=z^78b=&k!mq~lfX*7S;vGdSU;VTYAp-iwr@7Nw6gAY+|R`J2f6#v^g8`V=G#FCw%H`hz{?&gC zqFiJ5qP(J#lu@HoDr?~*UMb7NP58HzDd`!hY4B&BqiSoH*NuZuew_w?znPMmnVvDF za>?Yhv~b4c$!Sw6)6*v{nY5%53>BG`<>eF0C#98#Gb%@0fn&$7XlPnC9=<#HKw z<;%jUm7sSK>RlACcafoYk=DDYqNS#m0*h%6L3Ac%j$1yZ+-iZp8C_Z*u1cwa&z}{{ zFA0`}3X4M7Ii>mY0-<1b;miQj=?hB(C85Avw$8{8mXxx&q%=ENnqN4Rt%1Vam?fuZ zPH{n?G?1%h7Z#RgFMvPOhcBh!H_n>jdujOBw4r%{U`c*aVJJP6CP8{U$grxLn;S!1 zM9M9vsIV{qkp=}h1w|!+Hgt9%P#nrGfK(~pmC?V&4K=T73|nQv{Nj>Oer`d4jU|CV zVW^}ayCkm-2;~-)whPIjrKu*=Sl(Q%QwN$MY9I4bQ zpj<*Z*#!mDvvX#L0+8L)3-U|yRG!8hatiW6W5~#gKrmPo#EfqvG$X&DG!P6G2LmyE z?F#-uXpqfRs-|*eAuP{$Wx+sB0JA6DLKP}3&Clj$8O!)+wJ0hr$|)-7Fx;ZzKw(KqL8zc8J2wD(XDkfm1cId{@$qQK4@d1k`+?RnqbN8>2ZGwM!^oeJpOcM^K0YK)W_B^e z5^7_1VQxuY_Uu3?FOZ!ZknN$U5W2ECmV zeqlcKk+BSpI^{yc3Kofg=9lD$a)JRUm-qxBZ`Z@jKxwEn4}9c82NUlnJ2w|vRzX2% zhH%IY6twS<135J_5Smkz8)#pkpa{Aj)EOUASz!kby2PPomO}o9f`PeZ`9bLJii7#{ zAd#Wjfi@WsDh@#N#Ehfr$-Q}8zX9DDYRe7G$Sy08wJc|5ethfzgrKXNlV8}jx}#f3 zDU4R3-0afqw*Hh`+z=KkN~34g^|EdEL4#3l$L_it<0{sU0zH2IZ|Q)n&KAY4daQhC z5V{V=rZJel*LmfZ46=ZFe|RZ+D)(Iu3CE^Ko7 zg)@rcV>1)Vcpi?AaV1Z2ES@7|jlAoqU)MEJ_aof#{D*!dm_0ufTo4}xWNL;H7c;~i zbmi!jom*5a(h|iX93tc-nTaYgJ?9$TgoV@syltE6@*Iz5)`1V$CU;8Jba0G(S{U zh^-x_5>cY2Em12(C@`~#`h%DZR&b0>R0^{t4$J_xG)XEgfH_xbXnFvKkbuRuqS;n1 z8*_qCI|~Ym)QGZ>x+!SfS`wT~g7a9$fLM8i6@tkwEh{l7^l;EwL9WEYqDlu{p@B$$ zZc$-0b{HnNjne#_*@3u#sGBx?%Y^1&4TXsyB`PWh(2VeW?0n;+rX)i1f-@GHzT$(M zA1cJom--MxO2(mNKIf^C(2}4TFP-~QNuCAZAYtS_IJeDxfM#OADigyJSe81LT9cX2 z7$qZDz}iNUl8DO{5Nn$Ws46b20JM`U?H8+#ZhZYg8n1GGOeJO^QdM?81d1nqe6o8H;EqV@x-d7Q?y=W?IlC!-5HVNLXJQ zabwp~axH-=XZw!1MNm-jj!?KfH3hYh>{2z@aHM7wl$GSce2A9Q!VN@#!&<92dm&B2 zd7NUeIoXBSL>FLAibbIrx%9k~Oe;6N5RAytLB@2?FKM6aIK)R^)A*RdIEW)YPu@)J z>{0@qosqdrp}ykW+jJ?+o&)JOeBp=B;p^|}D_Eg60}d8_Y0+$0)#I!gR^?WVKz))( zDJ~I$ut`*E_=9Niwu1r7if0C4p<$3Bm@nlQ8Xz~AJtIy}9#s1PZnnhYL`96#qY?u` z_mm!Q%`mLgE5o|YKsaH8sYgt0VNqd@84OK1W6o&JfQnj*gQ*!Z&Ar-aW2(o@=rk{0 zVJLqFE-PTU1|UTXA-KX+)(Zkgaptq(=qFqgyQgDzmAE;z$Sms##M_SIUrft0SyNxD;V~59gEZ zC%K)9LE>%Gr%Ea}zXUo3m{P`NC})8Z>8L*H!tSU-M%{~e^Fm~Zc5k;51WL2pG=RW@ zV%YnXDFKR$ZHZ?Di{?m%&9l9R2fW=#052>2;|2{Ir=`(0FT*RyFPzzu^MS1IJv0;NF6W5!3{l>!|^sCqXd%;*|^ZMj5$SRapjB?9$cTBNiUh5UtAnNCTbKa!L16Fb2w)ODX5?7 zX$)l^F1vX~G^cDqS+IZ>>dg(y!u6q=`l|3scr;T08;GzRr(bA-u+a*j5EkPQQ#7g# z1u*0WrkBA3ATZJVSozQ!u0UZnL$0bQ$XEdFwJ-;E0Ku8|3DBSt&1cxanKsMAwGazf z>(Go8cJfe9)H)q@^`PFz0QQ~vg=Mi#VdV`gs3Ao;7V{K+01*?$byl|8#xkI}iPaX< zIMhzy@H`E)8Nuhl1gjKQIj9;Vt7-nsLfEJXEhq{?uUs;lN@Yb;O>;N|4gS#6W3Tun-!!+OoE#M zvsI#LQH04XDTPde*kb@{Ye%V3VkLQHrMX4(Dc4o9Gn7i5B3Q^#bBpF=hM9O==fx($ z?aQcuaK9OAtMNRMpK4C;g%8#6NV+{6p7{atP83vHFAb zf~%R{$)*dwc%PxV7hQq)acCp~ugM$7-~QfIc%XyQ~DaMzMx9 zt%S$QO%Z--Zb3%~qb;qPv^h7Bqm8h7h1Q)z9$`%!YG}mIPDkijcf`VH{dgu??CC$* z;up~BwS!RfwF7HKq{eEYr{`9AwN(#lEqt4SZu<1G7EnDQBh(BM^r}OsrfMbF;E1rL z5vyUzl1RAOf`iIp0Y|DEnwl;21{JW`sz*t(PC;+A=nbQV7*A-6z&T^t!C>}6SVo={ zp!HNJWR*wMOAHo$<3oZ7egu6sZnX&_}|-HPixL=y)@Dp`i-SnS)P%H$^ZLR+QJk(QGx5 zW~&i)zUwM#!%&cL>>GHu%B!j%yoiNw3s}_+Ak)xPv$O`Hqx<=~aC3D-l~uE(yfSQ6 z(ihDkIZGPw#Q;!XsKf$*GFcIVQc~e9si_TPx+qWR7Wb|P<*E|Fi~MDvAVV%Fhou94D{C7d^^tHGj;m{FGQz`x&}tf%peSTPl|^G2glIvb zX=M>EB@}P0EpHBCgrL?&C}xpWk>+q641YDtt-1z?5R|U=iP4S52%OZbC78odufp|J z7HtVZg##UQ_t=7C4JA`p$|mTF~1k%`2nw zPzrdApFx_!b>&bgp#5u|EMpLsp~L^EB11MoO@pHep*~_|wpt)BAr8>`R>IkNkhxel zpuCzWk~Hb7t*NVlJX7zTVD*A333aJC+yqr0QczwCRTX-mCiPy5I%-hW^=MElA{fyY z%wqlxsbl}ZR@DUQfLy{|I#ov@mF+-myV$*i8d12iI$XI7l{LcSqu4ozZEJJ{4lu;> zSHV*wv~aAoNKIq;s@jI~su0F34q&yXAsMd z^$qpV(&0TW>heGaV+JLtY91f8SXmn`ug8Qy9H2y0y1<8Oh$?YVMKSZRjY3_nZ?36t zDaRoIi#<{U54SgRfeJF)j?+yiGY_n_$gmX zZ6{J4O*3>17$D|;G}%yuSdZiEs_jsC7*WU%%wgTVt11Lfl5ksG1wKrpaie_QPr$! zsjFKBk!}n_$ELP(6S^iGTN)c0YPEW>Dt$Z{HA9aEr)w^QGf*3$JHeic zvn$jHHMhB%x?&8R8Z+d|N~<~@W$N*_8M-wX5@94K1Nd%fT#EMc+C~t_2t`^d$Q^N0 z7+;HoTFRklm1wPPXjle$y&Q)(m2Ap27~xi~3PlG%vcYItQyD66fmi2f{2P^zAKbtk8pMNX11L1SDQ!m3Ykq^?Errf^FH`&1T#I)ft$4lv3cA{cI}3s=>Y zH`PE8YLt(y<|sv!4C+yge1LOYp*(Rcv_dWQFv(DP%so6-gIcONI5mT=q$;Fl3OcFK z!SiExRWxh~EorHzV@NEl3K3|}*fC%Y4q+dPZJ0YavO-OQkeje6a~Dh)OE(sfHbL&v zI1RI!lV1z!fx&QdTv|f@WYX zKp(t6L%x|=jc|+%-7o;OP;|&Z0g#CTAX7|ZF|H$6V|aOEh@3%dU>>|@gWLC*5)7Ii zL-PzTC)>hoX{s$>1=$Y$Bi1D9H_9Fh`h}N>ih{YJg6xH`S4q-!vG*cy z(;ePH4_6fMM1Ir@3RrqIOIC$& z!lBL4T1Od5EA>zgJRNLWq0&O_p{b=2=gMm4f}OOQ7qU7SY+x#d^NsR4Xx!L`kurWu z05+Lm`vhXr23p~!CKxVZjvS2zMjpydr5oc;Mk+XDu@w$U=sJcL9BEbJsk`+6(X#z^2Q+)C?RoOyC5ql=AN)AQ1K4DwHG-K|oIu)7$n=hn0 zR^?)@Fs*2W0Us9=uogjcWd*I<6hj+yo8^$tI$E(T`-xR(=w|tNBI=5w)@UikIwkf5t3{}I*vmwPEgS$~cd`-JjK(-Zb~XIzekfus zD_83T_yt%2oeG$!=0WdlEenSmp_5(?Ge$LW(3Kwg!^%hqhSQoV=yfqsRGDZRK(jII z3`4+ay|)5qY-kJd4@CvLOBf*=8zDQO*{Qs;)Ir*?$e^(>7SW0@)_y*#9C~({nI-^`oDWEKxme;`a6M9_udk2^gK~Dg^pPI=+^+koS$iaC%4HT8-P#iT-i$j>l zGy%Xd8)s6`#G0_bfy26Bgeu2n59~8kSxezR%&uUXQ`Jz%%RXE~)2fA5Pdrb9*#Mj= zzXJYN0_7=n=2S}046*va9Fn4rtzQkP7>hR3#Yhb<7t8Bm-U{c{LoI<$50bBjX6YDB zI)pE3Ogc1AT38jva1>f4kK9Ja7r8fDGcw88)RJ15WAGBKxd}UNs!&!rlrD5S(TsqOxw4rS#5Bi(V$%CO6*Udk z^!y?if7Mbhx^PgTw#5`ZXoE0cq7?&eo$&4m61AtIR}!!eggq^2wK&0qRRwJd=!oNp z#c9B80wV!bNXpLJdCG!5Dyv)S@dZ!Zu7JGd$uBhs+)l&21I%(R^w84$XtjmIi7q8BhzMyN5R27zwvjHK^$%j{-0_#JUg4Q0$ayVO3EJ3mW`^#oedM+I%sJ1&ESp`X_~Eb3SsXP{}`#c0rr-faC?q6?I;0yd8FDskH}oP%u4)H85=@K#AZ+66K%)pnNJ} zb3;|o70_FRDxgzPLltxiuw+){2x;Jf7&4@Md3jB=Vp2a=(Ey3#n5Zqb*djt>$etPq z4c6wWIAOsEy(~35%r%H9>_(MCYhWAnP1rcBN;SZ%ewUkvRTFN8zO)hM{LtoVFfiN- zq-_X#G6s7Tv=0ffRl6&+3#0QYI>^I9DcUtr_kv43+@*#-RK*rIuvF`xmuPz329|+Nco~33v3_K8|@u$40)mUcjAX*nd7X|`Q%4#YU_gB8~;Sp$0 zv@HcPZp+fiU!;=1h?Bnv|2laQgs_PIczKcfqvb_hGK*kPfC)Tk@IVZq-vtxYEeu_& z#y_QYyRA#*6T<gng5<#EmOBzYh43R?d5-crzkMF94|o?**P-=R%Im zg1FB1I-5Zb4tRPQ72XeK$duR6eBbI>U|55{sQD9XmM0nf^nf48D(CvuyU^PgfH5z+ zLZ0-2UuTVTrBb-o-sMRs@c8q<8w3p+JMHrHaVjXEQO0q;w03z0gGb1-HIU(025yM? z1>o2T(hae|oH^H%;tc-Q)8|o-dxmE`pe|4j7}gN)9FKpdr~7V?zt!t}e9kWCMtcqX zLQtFG)7D*}X1saMF3f~2_8PDA`Z<_Q&Q@?rfl^F>yjug=fT8vTZT;4GI(z+FL3|d7 zt@AohpM&+r*#+{*l0Xxt^E}TmuyuxLC+_ql?DPzV$mDyH3Ot?Wcm~e!^o7KBhlq7r z>*+hk)A<}v;(4CV4|{rF;OYDz)Eq4Lxu9i@C-Gb7L5Lm1=oR~0Pv?9{=`82|bJjr8 zoY!stN07tcdMPuZh~I|HbewBeL(;BXP4)GD*BVc!b)LbqJsF@B>Y-=kPERfvyUp^9 z1Y07tfOK@5H46eR@;dvVDuS*@p?14kJ;~>Je9#ymCxCUDN9 zH%FvvH)`zAC5X!=&L2xK+nDcOoKXje#T#nTdZ<`P3-NBBsoy)P><^zg3>cpZpJ{q?f9yd1Ly+&m=R#q?H1B|4FXT^qdd})VKUSRfv*2X{Cn1;!`1v(L%&(>Zt8E_*4xg^WxcKDE*RrK+=%~ngVVPU zwVPWRbUY6*hxsa9I-Z&j6!JRX#tM1O)0oTryvg9v@6>rbu0>D!d7 z>pp|Sfhf_7vE>5&bg%-u=#d?H_oy_CQEb*6#}B;vs2|d!Wf1i@IO^HTcAXZS4(YJa zX*|1Y{q^9E*A(?b`cV&@1VPscg7;^hEBI*Uvjm^WyjbvD=JN!f%Y2dG<;*Ju|B3DO zg5SsTD+E82`PqW&eq^oSH?#a@f`7*RI>C1`zgh4Xnd^RD=YKx;3l9kSBP{>0;0Y}M zh~NX5KOuM;^A`lal=+*2!!c)cy(@SX^A81I!Td|XPv$A@PlDgX^1liGAajS)t@Gy{ z=A8srM|nb<5`4I$6k|Vvm)4_>Z&v-j$<^tt@byw5A7(ux1z*j4oZvSypCCAXJ`S&` zg1^K3M8OX+4+x&X{poDMhceggMyEH2`FtTCW`2s`=Q6Jpd^7VJ!JlW|AowBXErO?T zf34e}j%O+JbA|kR<`)S5DDz7N|BU%nf_LQ(_~_zLD*1izg51A=d6 z{;=RrFn>hw{mh>b{0HW0-50CReR#>G`xTv^xS1YgQLTkvz4&lLPR=5qw!%DhDImze8*UFWBlw<1D9 zzCZJ@;OWel30}bbbipf`>+wN{yPEmgLVhFjwSw}+ z!-<@6@;!Kx_@m$>ng1&IB<6ZcMTc9!TpckUYeymGU3q-d@=eTp34T8F{(|4iJVo$r z%#RlQ3Fc!3e~WpB;GZy`BKXhDPY@iQMA4Ni_z>pm1o>D#sPp(NOV2xWKFnl!by9px z{$%Frbodx=WL_b{y@I)3S8DxtF|QZ$>U2ZPY8L!ymOn%AcbK;d{w4GC1y^VJS=J?j zCv{c%cBSAWm~Rw(D)UZxj3y<_`&eGxNs<-^+`(X9eHJ@-GSg z8uK> z@MD;76g-RhErJJ`-zj({^Lqu4FyAKl1eGaui(3w?-Ts*%wG`vJ?5_o z{w4Ew1pkfs0m1w5rqRCyAItm;!3&vxD|iEQy$;j${}SfE3;8X~-MoI%^3O6)5c~l1 zB*A}U-be8Mym_zp{j~lx=5VGoU78m%*ZY2&pT;~@$e+VJQ}C;pA1nC1%(DdF!F-0` z&oVC%{9Wcj!GC4GKyW+~9xC1V4>=qu}eAFBkkS=4T2167w~Jf5=>~ zzjgi}Vt$#BAHW-vR||d|^BV*|nfWHc&t!hL;2W9WC-{BL|19`k<~sy`o4MXU(CPX& z^CyM8r>`onX9XX`{3XG&n7<)79U1_t_6vSG%YPvFh0OK-wvOjr%)b=!Pc#2s@Xwh4 zEI6E!r7qrA(E0~5_X?iDytCj1%zFsl!aP~iu-fF>r{HUu4;K6eez-SM@S9j(??>uzw=ka|i$A7-yW0{{KxH^T=vML2HXZh0vU&Va6;K%U; zy48YjW%=_2f0+5jg1^9ggWw04Unlri%=P}RE*EQ%8W!#l^4*!=BX}zF`vsrD{6WF% zng3Pri#%A1=6uA8wBpd^q#*f@d?IC^(+) zi`Q|2pUpg5@Ee)W6nrQ1IfB2*yhQLHm@gE(cM3(v3JE@ud06l==F0?cVZL1OH<+&$ zd>ixg1mDg4V!@wgex=}FFuz6cubJN~_z%qgEVwh&qU%w?hcSOf@XRSn{x!ir8m{<1 z1)s$7p9y{<^B)BN%Sffi;^z{&{@1g7qTnl;_YwScj?YlRJB?EM#|nNn>zOS0YUa}g zU&nlo;O8@6Ao!)sD+S-cyk79Dn6DCiEAxv4Ph)!W|CQyt3*IAB$qy0yXfEGzf{$YP;{ zS93&ishr1DSW>=SaF7$1)!v_*CZlIh&TxVLn;NmoN_qek${Mf;Tf? zD)>6)D+Rxn`GtaSVSa<)+nH|>{59sg1^U(8+nd`#!_XUz5UL(SnlRk{WX`9$Vp1@FiFSiz5Go-a9%vn7I$V!l}L{UcO- z>I9#8l;UR!{uIlfC-^wlf2H81Jf7YvcscX?1g~ShQ}FG~|0ej8%wHA!W#$J2|DE~2 z1^06O`C0I1nEUwop)SW6oDaPPKZW^l!Rwf(3w}2969vDV`5eJ-V}7#We_^hlqw080 z=k%@;@@ZUN=L@dq+xoey)-#diHwpP;nQs;R6z01G-_3lV;IA`(L+}I4KN9>y=K8s= zj^|Iz^&fp`{u}eI{Jd0ioAYO&;N6&y5quEyDS{uze1_oXbGQoyFJc}RdXYx35o!~FBo;wBC`x_4k{x-`$D)<5B&k3&g zZQc_6bC&;Da9!WN6*?GpKA&w)Z$H5knIA29H|7%rAILmQ@Da@C2!0In zh~N`=-gTDXdVY1G;Cg;_t>Aiob%)@3ezi?-J->QH@BtmH9b>Kg0ZD!QWuMQSg5-*Y8c}a`}S!pN0Hy%pVind$h{m=LPS={2jr&Ge0Q! z5avG$K83lvPkcEZ&%B4=#mrL#U&=gP@H*zx1wWg4iQtzouM+$g<}HG6VSc{gJD6W5 z_%qBm3;qx0I|cuS`Llxm%KRUK`?#KeA$ULLzX_hsyldb1{GZ8uh~V>?rwP84dA8sy zn9mn{FW0wI1>eSejo{BsQ1QD&@V~PD>ji&_`Q3tl#{4gW>-o$c!M|nszYA{h{_Q)0 z>wWuA1pk5Me-ON6v`Uwg9H0NEGVd<6CHV8q9}@hZ%%2wgYv!*D?&kLXq2Ni(zY+W>=0^lSmU$O`Uq+Wp z9`gZ$pUQl+;4RE23w{CffZ#VXFA@An=JkTV$Nj?!!8viX&$?CcS6E)ZC#Ca8@ALds$Un|{ zo)P?c=5Gpq;xTIc`dIL}%)b-7jJeJ48R__(!n~W{5$1yg&mOPBJx1_i=2Ha^F`p^; zAl6?d_+2btDfk1-PZwN|%c}){oaHYS{AK1h3jQ|pdj$WG`NM*L#r!G3ZLYVk3f_nL z`-1D|ZeIzW!ScTeUckI7zbB>3v4Z&!!S%SGCiq1xe}dq*F|QPSGuOjf!SCUEzDn@z z%+D8G@0VUB_+u=;NpQW7x>fKeSbmq_hnPPtxS!+yn&3T{zc2V;=3fdvmiaG&Phy_P z?|JER(a*sL2(F)lA0zlO)-y%$GnoejzleEI@J-B56Z~DypNQakf3j6@-M%grT=#D` z2>vGPe^l^vZtqVEuJybo_!}Jm_XYof`Imwxvi@HL@6X(yqWUdeF1r8eE%-2&A1nAj zIoxu=r*c0~EqE&PM#0Zy{bvcjmic3WK6RXu-!J%&EPqh&uAC3w3%-ftWASqvT`q%JzO&%ha=0S}e}=vpR?-YC=^KF8=Ila3D z*X?ni-~pC@P4Ft_2L!KW{)OP{nI95dw?{WWSJCNxhUNA1I?eyie4vp32lEWUS93m0 z6?_HrY{CD`#)+|7FK6Z{9(^Pu3* zFyAZqE6nwCIi1h@neP|!|6-oU&tbHDJ;$d=@CxSh1s}$|QgEH#a|EBq^5+RYllf(W zk70hJ;1if{7W{bT`uUPh*I$|cD&)5?ck@29mcO2PlHhur8Y=i9mLDbfr_9p?*Uu%V z3H~0-&k_7Z=BEfgj@wI>;Dedh3f`IdO2KNy6@Y|U`CHPIu zH}mrio&RgO|JTn|G(X7vCn0|w&l4=(zt{45KG{WZJ)i6^_(iNoKPS<8PGhd0duaYC zua8a_dXjmc`3%AJy!ryceJp>q;7QEy6TFJ~gMu$${;J>)GXF*JYckdR&CB~wI$iHD z?-QGU6Z~e@bD7|}KHMnyMwY*a zxoyXPfAV1=fB96EuDu5Dsu11(X7KJn^#0Pz21of2`+42qD6ikU`$%y8cOTygzMJFo zyWslyRHxA@AS_=DcQc3E#o!pO{`-++gQNU=EI-iTDE~NzJJR4NKN7;h>llNhy#70# zNd`yx7g_#TgQNWOtUn<5r_ARXJPG9Wb&|nRzxs~3WmOA4%B6g)6VEJnV zw;iQN?+faD*56CIPsr=7!B@ML{-*`^coct0@VA)1E%;2YlK(*PE17>T z_`A%1FgWHjcYD^)2FHBXpH%2Yb9p83x>@JXa36YtI%#l}f0yO^8yxk|V0pbC zqx-9mS$;gr>-L+6%Hhfre1XDNh2Yi9&k}qc^J@j)#C)6J`ER+>-DRSkNytSULl{!_4ZxC z_cQ-WaQ%Ij-aOyY`p0s8P8a+O=0U;rcO3NkKu_Mz)f)CrHUik_kc=RH=!VOoE5cvfmvxT0lgsJx;A4;w_^=CNC;&3IOr zI6NyAj@YZi0}t6R9B#Q3&Oc=vgh?JS62|#p7?rw4I485I9)DBeT+MR!fhVA%10JCj zf&;_K;V{9TEDGE^wSv zm?Iai=JWC}`Ea_dIJ?Y@>C%?+CUx3a`{$5xLgC=R_6}l7g|x#Vdsb>>RUQ70s7jrR zw<&m=jJHV~B`l3padsIvPehqayiLGc24xZ*#s;=@@Y{f=Z(}g&U>&hCRgaRpxajJ%7=T+|6sNRRktv+$}|UR@4-4;BGkz-v!TqrG_3}yA-+ic+ep(FoWJMjMnPIBPV`|ZlsHmuFy&|dykU!;6|eUkdc{KLGH`Bw+5 zz4-6R0tdJj(>->RvS)%5GFg*TvX!4NxnI>9w153u)q(%6s2Hw!>L+^F{`Bw5;G)e@ zAuv?2f0LnE%FY6SOcaw<&HnR*0-b*v+n*Zwuf@26w<^4iAX zA0yh2l+ElQ{Kj^|$9cI7e>eD-X~(!6I9J7J4|gsYZcq3x{X<8n4*X87Ol=sSl9HAZ zyOdeoCuL@m!=&`gOhpzatPT{+aN)qomu)@VZeFw=)Do7JMaC>R)55m)IHCW=+?l{< zRa}36?sK0l2_UO1vIIm7h-|W2D+x&;VM#&~Hl=+Mk|!jRjVvs#5jPa8;8L|4xK*H9 zwXV2SELw4CtJS)66L++&t%?>@HZ4}Ic? z#vJg2J3saPog}BIw%*$>7zCRitpKL3BKcaS};ITf7k^Z+I9rM0FcuaFx zt-dC#wtVTQ;GF(r+Ip+f*L$ng(IZDn-}jFmgKpY$-m04Eb5qhbWqQM2zBG_IgY3>c zU#;GE_(sk?b;tzlRtpo-;l?p5!LJOe!rcRCx)xO zchuBOU(iEMj-KP;d3dVVSNJQA7uJ=FOMd)I3MYHoKIz-{C6KZQc8L6>!wQ2Lp^qfRq4!ssMT%s`l(u74*vd0ZM$~#PT4d% zC3DyNX=?KOC=>Z819mQho&3ku!kNdZ)o8-ffTEODf8Y(o#{Bjvh@Az%w5!0#J&$-<0H&{DbJ}$-*V(g z|9^8CC=X&=!N}$tC^waFI@lWgk-x6TF}DsgLuxgC!>^RufR0y3G7s(Z2kzY8M;$`w zUGw(MSv%gjS#9zCw&FMZV|KoYWAFOIb}Db?%M=5;4yYHNhclV#PkB)sQ2yKgd89N3 zzrKMwtVg~S52Qo+5O4bs$Kl`Mp2@!vI#e&RxfpgnI7#g~{~t$6|3vjcyOhJuJ{(8? z?W+)@h`r6*FNhr+jW(vgnO^j7Wa~iTT=a>2^o>09kvZrqvv(XmD|ZL_&KBxJR4)}B ze$v@U96sw|=y=c#;2aM>wb#wX;*eme(+GPNIvLmv4>=Ak#i-a>4@ z}s`;0kIn1k|Vqnxu)-YnGT z$?a4ZD*vH0bx4-~abMk=@kr*OPknD^HPZdx$vlK-XWY9#oOx(}K;8QZ#skz1eOm3L zdfk9J?emY``3A~l%Gh_z+x~!^@A!RC&VjnURp8(>_+$*V0pfeg{@$5~{=GtNq55Zh zb>u!OFCBBsdMGXPkS!~<*&)>J$Q}=4SOE3#QJ)~{6@uTxI}Tp}zbD2m^1FvJDm`u; zJs`M+#;rFnwtdn^?b-<6N6|i1c8dQS5-Ouv`#Rlzd(Z}J)xoLwm_%Q)`v&^MOx5piZHT?Sfy`ae^@Dov4X9mj_G#ONwbtZ) zuu1V$2H)WLjQ8Q6Vcs!K&4EjQ@NYhj-;O$j?_2HCdhpxElV|OUetslz?#9`WJ%7^1 z*@0cQ&AWFD?(`_={$$EJ0C(F0rDadW6BaqqmEq|L!=*Nf ziCS--s=S7iDv?(uh8eweOCqaeU%SeS-vq+iZIMl8B&<|)tVD%1XkVpa>t$QafSRz? zrVsK-o~pLVQqM3_v*|WwP_xM&Ichc?MGvM8YBrg{h^*N(`lD6L;p8nzbQdT0C6P@Y zWJJbnI_dOkV>P+&$`SKfh0NG=5i?({_qHx&p)m;qTREM0>B_owEm^neZG4ueYHjlN z1X^a3e@~#=e{s@!8zXnQ)`n?B+xROO!~dn`aS8rTFx=?^54|&M~RXz zwaL2@Xr)cQoj^-%{rVNMwdusOVvvDN+pZT-lRD{!Rb0Wui*%SBXl#R1 zAlo*ybs&~7z=^KxSob;6Va)*9ir7K}eVt)@JcAR?{F-dgxJ_;%U+Z|zBJu22PZf`3W;4KSW|KApXxU^kuS#pnzRJe2+|I+8 zlI{4sk&gw{Ctk_cj@gyibM33NJ(v$z+diJ6xz!5R9_ApM+{XG^&kD)9*mAK}$3@XM z%&+1b=J&M|wyjDjmk9B9At!AXKpiVml&AqGq~q-I98SQBO>R!0Dx0*E7qo8YqxUAY zIF)$mDzA}=Qx@8!%>WCqj)uQ+kI76JF1E>};YyoKR-(9LUX^Sj@zPZ#Y>PMxOPhhG zDr_>DS4qdbzP8nEA?9-e7Y1dVY~)w!F{N8OW>?C`6ECtJ1Nexwt$TvBqhZ1XC%%y- zYqo_?Lf^BU+-3q~lh#c-zmAUj+U_`(b4lj5(k3tDL%zCXz}AkYzjiLK?O?jdnr`Dm zm_MxHyAr5~Q;8SpHhUl$NJTc8lbGo%mvgc#iR_8?_3I5Uw1)E%R^lBEf8%bJ!8v0Z zu*s1L!(SWJwk$bpMYs7&EbLF1{#yUp^R4T@QLNgNO5Mz@uq~1K*G9!RwDYxro5xw& ztbJUhf9)#gLU9sCVRt}xJ_Q3Kwn!HYj{H9 zl!Z2Ftzms*lS#u1?TPlas}g4<3@75#TEk+-CXI|^90N(iTDMSs_`7 zBAfiL3X$HSGT%5nrzc!eWRv?6sNx_ezf2-dC0@E}?3~0Y3vJT+9O2o3pP!Uv-;XA?b{jZG7B1 zqtn3idU?n7=o9jL^z463k6zv){DMm$=;inEd!(hEoc65{KB$nP{2qgk!aKtwkvKIi zElsHqsb~cVVMiY#ek?Q}Z>~mhhDtdaX}<>y;Xvv*WY#;JIpDfk0}VTV;LL$arG->r zfB|%3w@%dZ`;cOHDE3b(_L$u6yrUpGM|-BCw3Kl#OoF{G-Qal>`%tp?Wg9%4w`JA< zya!D9>RAJb_Z{bH{m}6P^ZT5l3)U~BYjSiS97ziqZ}jgDv-y2Un2tIPa76fOU{Xv= z>z>vvZ93qfQQFKg+6+5&a6dTkc+_b~!b8v;>VYaXY&cG!-`q|okEf-bisbOb*$_q~ zvPq*t9NXV1;7ENkj2)Ly3UOJWI;x*XxgLKsJ4dOEQD~>p{XN^iB7vrL@Du*w?KbNj3>uaVgkD`ja)c$U^?=f7~+hmUXvy}!bwAPgY*tBO z1geuM49LuskQ&^b5>uTVlWjwhFf9=YAu>EY(ezrJkq8Ves@eD$Ur=|3s9q3tz+Tj1|@@hZ*58Fncdz{{zCqf^u)8GWj1pQ86u^&an$W1Ft`GxYvsz5kZp3DPrl z+H|KZot~xl*?Mo@;mOtM*?PY};x^y-PQp!v6C+HJ-*VDtb`p&$LXSh$<5tv*ru@!~ zU@BCg6QOA2PszinRC3zrnAf0F;WSS#3WDLyqcO>PdLC(AtoSL)?YaPThZ(&9jG!DGlF zNpaABBMzho-u~xvdr~gJHth7)E1Rm%TW_x@a4A*+-qIu~2I=iB3~a)_#LMgLEz;%I z>v8{u-sHW0{&CQc&_e_D?+rd5@DBR=m+wx-8^_)uUnPal{b*A7!tbetTvGeeAE1Ro z5)S+6Ng)ty)55ngDSE-+J}gv}YQtx?yil;nJQ^|$KaAq_4Q?|M{hXcGKe*kI1_bXi z(pe*MY+&#~BheR8y+Og0vrHBKW*>?AYL|MxyrgMh5p8sn1|Y#|8Hr ziGK9d8x{PQky@yn(}D+$L=ErF39bw1I%sKL@N7q#A8czUUFb*!!Hteo6ujJ#76vyP ziNeJz4qoF(CBf?*sWkW_M_LrzW+Yvf#lc$~X-ROqBP|Wy9>7XNDV;+s81#nS<$yAP zp)M!~7~+Bz0E1mn0dR~9Dgg%F<&-WSyw^xykxy%b4?5+k3qHb{=!jlJaJM5h27l#9 ztAkHCQd98Pj?^67Yos4w+2pkZpK+wt;B!X$f?92D@V5b#9Cf}EnTtRjMA3Q-d8N#s z(oaX}y&(S7ekSIx#hL!BekSI3l91ES#Qg6`nA6Y1ycXv6Gcg}VnEM6&GPE`78veq5 zOI3tEd^q?;?D`SwM-gatn~_pOUI(PjAJ;GPHqyFK6Z|2jQ2CVGP%f0Vna+ixnD<9; zp_Y@{NG_BXMscAU=tu?^>MRn*;7d9~C~9=By92O8*Fi(7EqceGNOTD4)8@YyNTKMV zEwm}J33w2V=@GIX`2lu=$zZ=*u~QMMYvfLXj}g>Wr<5AV^^2->IxQL* znr~0@%xR6@Kr`A+pg_b@Og9`&58iMd?X)n0M>{PX%cGqha>npzSAfs!cqjO#<+a*a z-~99{)yzB5pPn>5-p|y+bQIvfHNHvd+m_fW#BaKGVqxj6oIwNU!WJcN?DJ!zkk!D3U z8;O40&6^#$-bi|8m=ocdL0g#<+3uW|7rD#P%#S>1B;7Ct5qD-NjO;bXw3`=3o_C~@ z$g4&gL|#8V!ZX9^RF>tDf0<)%<7cA07}i9(?xRSvED|-6E?Ie`XFF+tktUI5eI(sT zIu@EEBaNinvL%w?NUf2vM$(PGCNja1)ebeE&=H0f{g%uU2rKt z9~WE((Ax!@0D8ILa)6#L_#VJfF1P}qhYPL*=#-V7>Ndd@9{{1BmF8;=tz4aMUM1DWT7KH87X$8 zUq?zD>8VJmBkheWa-^pti;bkq@=RojbL{!ZQb&3*vMivm>cddQg;mWQJHbUluICu9}`FVF%c7BUM0-E+%B z=~_(>4J$%sTA-QCs|cBCK?{{3GcC}>=fy*r`kZPk(7ozVo*rqksAM%EWk#VI)W@q0 zWg6*HlIlV^M$!iBLwSzW5Grz{#?VqnS{=e0evuMPTY8Y+oaX&AptIL?#;0zQ<^L#P z>ihsT`NsiM=NVMzPXeaSxg;D6m}k11D~G^A(;7F@p(6q1>+0M=lJB2xq=!ff`^(ex zF)c;>?;1%Dj#0nNky89hBk3V8)vq?vlVqj4Uuz^C89n{W9I2PTDNQ9-GTy$x(1kcf zFCR`f>wu{DmZ`k1)!SV8E6FgHLfRAB?z@3-Qg|;AQ7P16XbW8o=U|}{7)pw4Tc=0T zG6i4HNukM>wou(r>O5L!sEWJ{3%Uu?`+Dgn>}F8}3=f%kwvdDoHUjjaWAPme?J_Nm z45{8p>9~;Uqow6^-l&l3o0N_Z_3W#3=B7}dEA%viE>=(DmIu9jQy^LxdichQt~?7S zCRi{r!Gehi7EC{wLSa0Q`+;u0`JwIF+8B7mTM)Wk3wlr~2;Johce}zbT*3S_JfCx~ zd*nV>xL*yW<*Ke&n^Vb5Q_1Px2~KA}(e3Qx+|EAU?d%iX&VCYi_M53HlS3nQ=1-F_ zg=Bs}&S}n{Y zVOO|O3%XPAeiil|X%F6s(SfTq zp9qJ%V)CIo< zpt&`e-bU zFGqUFKj26Y`v)EA5&ug^`jyWYCAwsL{GhY=djg>~Eb4%#0EW6?FTfDKj?rE189&8L z+**3pPYpOjW}6u@i@aqfMD!SsZ(8ck&w`m3^tJ8jeA&!`nHN|{*XOX1;R+L6!HjHL zZMl2dyxh-IkzR)s#vLm#3OiY2k`gQz~+}za=$OThqeTsX1Dpu<)-<&7+&EdWiC`$JjD# zep0>x@=!qGmeCfYbg&u95JrdYSG9975NiP4S5ec+WebB=6(>37ya%CU`MB! z9i5{hBuD6Qq#t^9N;-D5MYHv-jFN03Nuf)6_-(>I!19TZN{o1>b)fK#Kl_S9+m zjpFES19X~3gy@cRonDFYAo{Zmovx+y9TRj~+rM+VPUmAEy*pE<>HUr9J$Xr;`-+n3 z2TFDN4D6%3(0VVU0E7NSwRqRoVzRD9&*=W-SsysH_=l-QAKa3N{xgd9M`F+r>{2qY zqb)j3Td0nHtS!)QWk(Mf3p**_&rIDlKWOT%)1RBV>-3kV?)Q`aSEjw5r?m1+SNInR z0nc;=y41qlXu87DB!s;@9i}Ic5cN#VoPhJEzKJe}6||4^jUx~*SXn&hvQCDVVb)M*_9f3DVP-PV6?OzP}w z(do;ukG{E1rzxVN@3g7Ny9mORkFcXHny(vjK(r}&a*L_F4$w8G^8ZeUDxNeNITneO zaoEuoov%;s8KwM{(mB+blMB;vxB;AJreq3UW(j?lxa;WVn5p9{XgtSae6P(j>2Cc>No6E2hGWuNN~^YmWT7@3j9#sQF7&m~y%OT6e%r9u zt;bDxE961cfg^Y7vysH={fN*3M%Ksp|onX(>Fbp(zN5KA*Uj(ja}7ibkM)Dm+r{l z1@t%fGQC>A#k2)?$C7UfJr)>4l^RNV)@U2jCy=GcWk{K-dA~I)LH%y*^Slz&SC}vG z8z?mFc)#~iwcR*t5IuKXpL)N)qPs2%J=xK(z#H&G>1K+~>~uBc04Qz#_fjHJ5#!~3!Et`5jBZmNrVqYO~J_w~pT*haY@E=`{xmNY%Cbov_2@T6;IfP;)zORxdL*LNkU8d`+$V92 z$+reFP_%x!l1yA(I`L0Z3PEsD{QH#4WHOF*wHqM`@?R70r@TfQR z@s`;$sB2L?%C1F@xCBaxLVpQ?3q4B|dX^~kERV+3WFfOVm1o!(%Jt~uJjpW8*5=!l zu~?U}#GA|Qs3O;n<{KxwJ^vK5E+S9*-;SEGRgdhmqUH$Q$nf){X2nFk)L#%a7fJMq z6~8E&-kv*^}GVo|f`)AdU;aV9^IT2ZjWB01zowjqt_>ed!pO4a2*=Se;~SD3;MeDq3B&&(DivV z`e5>$-O=4z(6jFG%jVSqd7Tcxsi13rlpiQ(#(_vUlI(jJG^L0jD4O-~xsVE^y7 z!o0$g^o-Hz6}9+v(DXI&rskT4`t*sD#!VPEF+HQUc1_)hjZF<_#4B3TCr_R@X?jJ~ zvY~HG_4w6UEWmJP`|#R zIYvKhIliU3rl~SkTeG5h()dXeCgK0Y3F9HIjjw2Ks8|(mX(nkrelu>l^Sg1dww$aj zZ*Oh6V{N&$wtPivO|8x%X)}gGOr3n_#vD}3$&dx6`DdluYX;yJ*e!(0Ta|?2kLU!STqWQU{xj9yM zSwU&mQl)=*m3}a_1wX%;kG*0R1at`-&N7nQ{FbLQuAvLrXRAXYLz zt0b=jh~*TPb_(@@)~1?RV|h!ptsN}Gan>@D+Hz5DadvKjHX~3hZ=xa_@#YF^VnNBA z*zEa*OJa)(@(c3GnF*3xTwGY36pM2Ua_1D5=4X}Wx-d((NaCa=#re9u5@0sWmgK>1 z>3o#0G&U=Dc42X@l?vyn96pd;9Lvj{KfjQgD}VN~SaI&cMY#xs&&Z%Oyql4Hh!f;46%PpWjLc_4F zr!G<9vQAJet6*7dNlCso&V#u<%N|0Fvu4dV!-iwDD2w`FtavHnKDQ{V7-MnAqow+2 z31*7U59So2q1qorDb zw4B`8S&Qbki%>pNg2B#lE>pxdX6FU&k%FuRsK0ZT{$X(YL$tAq^4i)J^xNf4@$%+| z`euD(Hw3bY7soiU7%d>$ z8!OJu&ZW7&T~QduiVDqIr9&Y*J&VirwI{a^gG3Q|py=Xg$CB&C(5%87(=8Kb5*Wjh zUQyY;++G82&i&6CT@-}dry#dP@rIgS?1IcRaZd=TEyb03exBFeJo$~qpm!&sLJiOl~i8?+b^bu}YaK01Vr!S?ml$8)eg z>EgIq#$;t@V{soV&YzPf`!~$$V|k?uM1W8zn!YC*%dRN%3uYI#FU=gRiWbuaS-Y0k zWh`1CbRFM`Nj}lBY$V!o#4Z>A^EgtRwZtw?5|)T{5|f0x7|Q8TRt_fn_H{{Mtc!WA z(k>IM*g8Lu$fk?qx^$f!qw%_eO`=~QY>TKbVYr5aTa1xYtvD(=$uRW)6gJt!R>;k<~W`?V{V63;I59U zZNR-Jx+jCb#+Ig7OY%;QIW8V|Q(NBL5^Jfci#N2k;1M)&EasXO$v9IVgMMR8{mNJ) z47XQkZB$hajm@f|5l^wHs-zrs0jp|i<5iXB_6Vh$*EhGs>tc8!%^KC%&}@pR%h~QG zl6mA#Z5%3;H`%N$U)ii$VfUm-gisV@7}FSXT>~;fNs|Z618KAl4ylUThUPdPKNH8p zbz0dq3IEva8mcHeEMO~jPSYWnXXI4XDBR+*#+zd`^_B5;cv??ZadFnNSV{hAxv|n^ zMY*w!^A3-L$57 zGa>_SriUN3G^~o(QwgA1(^6Aj8%sX9r@FkkI<}&`IX-nVj>hnSCWWhqh6>!ttBh5{ z{kUIBl~`L|!xe5sqtvZ{Gm$?+ycu<@tVDjzif)ss>IOKap{ZtNO})Z>)s}{ehFVn@ zZ>erTC{~qM#L@mWs1qtt)j)j&1{{;*H?-W^7`$m5Obti1q*on&6l-VZ(QnYGC}4q=@bl}NWUIvW}SPq0FBQCq84L^#TTj=By{a6&7Q>(I@bbRl&h z)YjD1z-Q)uBzYe#23NPln-CeOL3u4&GC6`Nlba5OL{@8?si3XoVt$S3uu-T`$3CJ5 zF6xeE%+li-o!5wq)Hw1sU8UpL(_C{V4R|&O3P)8}-n>egp|5;>Z9{owj0({XP?V6G z4*7=03iwDhHLsyR3$+9baZ86W z*w)m;W9YLOoNJn6DV;lLSUeC9fB-g3x ziPVKK5>7;SF30_kYRpqQfo{{c(8mck#pzujv<-DH$D}SzOiw3u zdc4pBzey%(V*|~!@V2U0i2-g6CSbkhQ1yrmg~6xQOo?_-j2W|53%#SMJXVK^lZFyK zsK=YoLYOaC)>t>GigL7Ltgd`rj2cXPKz9hko8qm_)ah9b(-#eSGy_}> zEn@`YTT;fgEX1l>>-Bp!s*#pUh(db*hNe(FukTFs*>&6{jEKRTo*zg7$ODJgqQ**Q zWK;02UfN(*TGOEHMAl55R39-_HZx3fb1laCb;=IgP3SQgFDu|8^a0bZR8&QZn47RV zXlGb?P85}=9RQHsA`JGO^U`Wlft~eR!@UQG?OI4 zSS=+J3vx^I3UgS~Fx9v!zFzMr0}^y`bV6sKQ#u2kN?I(UoBM1rzNRsz4j{yyHUD@Sk`Lm0JcO|p(oE~M)Vt+W6h)uEslyjTG1SHuVkq0iw!!AbfY z^KKEfUQN~d7|n<_orpT^(2`QT2^P!7t=guwrU<$}G_^L;TE|SSG{Ty7CY!?$iMgI8 z#PT|H?nbO|v@yQtgv*_*1yuYFP{o^?Fvw$#lPCoh9_?o8O=Z_f-EhPbi!!5OV~h^b z{9r1tSH#)^LQ^Z+aoRwPyav<5GdYRHrtU~IxsetfYF|A|jazh6ByW3}mLnC8C+Z7S zXY#&@so3mA1=-qmGUSp+F&Q>unx$a|Ye`C1tkA1-!$`ugSq?wjVkKS1ZOxZLCitRx6{K|JVRTlj;_*fd(rd8JF;{yw=rJBvG^3+o5rYAp zDy4%-Uy)z}z#<5PVGLZa*VocIgQOV0=%UbYi5af35$-^@Grm$4h#`u2GyfzDx*|@| zUx@{5Q^R_U@U~5?1`0rzT219^O}k-X&xo93rfl>REHttFFdtGtkkHbE?CLqQ!}yB{ zZjI_d^`y%FFekbKa>q%gZkPzL?rAK?x|=S$X_2ch!J5`p)nahv6;(?UMXXt%mSe_& zw-XJIh^%PQmvee@A%}9quc&EIv+@fu@R*gC9{H#mrT`tWE;js!i2@(?K<6XBm}K&@ z+rj3V)LxTg8HbBAG#|~hmALxVGdWj;x-KVaLGM&ZPt``|>q;Zg85Py7_4Fj*Q32~oK_TWWpPIY*LKJg_Y#`u zI#XYL>I&F(UaYdA-mYqB)e~1$tl40S3xWC z27HW0msc;cD-~Vg(g~=lx$>ji6udsKXcD{shm^0O zM-sEFN1zoAsGOY(647l|Qx?NLHOLKDtEM>-2AGd^_av{;REvoQy@REg=`5d@NNTpjp`eM5U7SM3!>V-N1N=(6q@ye_r*73EFzG}AaOALTm zL^@**maMc4))#ZO0(A9hI(SV>U3nu1y3PU%75%PfY(*9IKQla=I5k59hEzQkxi>Ya z6H(jPq9nRH-yooi0o)X#B`$^(RoPls2WQtbB0g}>hLqcx93dX#Q8A9&J-8*5u> ziLTRR*T^)6V;zECL8}aNv=VvfhfDKyrp~XOp1zkteHS-|R<6W_hB+It&65K<58YAH z*K8P!l7hD7$i`=Sb=XAx*IZ$te>JVC!8Irru=v~?JP3avF3sgERs%X@;`-uVue&SC zG2+xD!v6R8!*3gRKACoTDkS$F$ z=1NB%OjI5DiwSrl+@s-dvz#VFw4{z#RAOLjMH}+~rF$gD0%jOgtpPWxtXX}dq#1YQ zI`$Q;Ct#DkM^$boo2wot^G+-59M>1IiF};{?unfpcfH`8<~oDcar#Dsb2rLmx>af# zc?7}R0f{u-6rn)^3#)hwEip{f+mT-{$IZI0szEiB^L?Y3cB*lWv&^QLV@RP6k^b~T zhEBw2OgEx!9I|H-H;Jjubgb2_4RlvX-_5d0Ytck471g-7XryI8BgTpre6$#uR8{F| z&)jR{;T_9M%0)|kXf6SM*04{fezB>o%n9>cBO@Ys24jS1bbQF8lwgaP+bJt}HZQVG(PtTs6KP zi;y+(@h6R&G;YecspIh`X;VW(%lOvjWNFIFn<}dDd3!9PTGyROXD(k+gPzw#;r>1I`G!z5?2n3`65imSw!t5TAJ6hnn;VK!s(aY)J~xy$FBB{Y`+0Li z-NN{`SW74k*+jyA&$*$XziMtM<>Ao41))^HUUNgKb3+5de(Hu$FUV=(c`(#%1Co8h z2Sd?=p~A>lAzk6|4+naO=lVy^eF)V%-=h@jjDlVW{|&xSpQZfI&xPOoi@mwwjbZ=5xexi5 z<0xEy1yxFy7`Yxe_ha(eYo~2i`JU!{}HX$-~Xu>y`6mDZEomzzXi=esen#h5IP~eAv9uc=mfM&c;38FBriI% zC^YZ_%I|k3zX!aB0)sn*&_l>4Ej79>)E6FwjlSUpq3-iT{U8mU>py~wk>itI^pxnk zWNR0|(6Il6r)xroheCjxp{i^361?Ky4zC69{W1}*uOP3Usex0D4)vXf`s7n6n#v)M z+hDSjN`(5)HWh7OWi%r4LrFeC<`ES3nD8Z`qkb8RUT|SiDDpX+jo|I&ubUg{hcH|i z8UYpfCNekVBSO*qh?_s1^ANSe&Or3-u>bNooi@YI1G*Vz>5@Ksjt<)U1Bi)Z;j75p zaABxNUZ{VxG3?X9fPY_rd|}fR>CYk;^tfLJ<_7w9@W>vR@0%K!-k%ESKcG!K4HG>P z+9@dViHJ(_Qhq2rKQtmQ6uvm@-*e6e|2NR-6}~9c8$AG;^X6X=8jjbz&?uagGS~mv zIUiHiUPVd6{`PaCx9bSA!%63_K8Bm1`sj!}dWIf`@Dq$;i)pUE=G*Q_spdzwVb?%1iC>z@*9$4}B+f0M2qKTUHCnPMBMdE)ETiKD|b@0E~kqET~N$h6<$n%h-R z@>rqf`1wt-nJ3An2&&W!t&i^+ifx?c-2}xWVKh&Cb-dkipC+G9Hb1dCYk$zEDW#Lm zR~^ewYQE}Ne#1MK-|&v*H@vIzcWf7<-?3c`?-*BxcZ@5;JI2Wr%OFDMDy$k*X zc<(^6UfcMDtGm#D499yr?P4RQT-!}KLlJLtnFLc2R!(s0{K=wwGS}LjO<~_G#@++ccb)u2W`5>u1`g3tnw7zCO=i z_-DC|U;7DOtK%QvodrLhb?Akk+R-6j^CX*&`Q~s}Av?nyJC&T4_6IYU^-5(!N= z=N`Qr5nme8-*o0*h0k5-e4F8D9I-~+k7(oRzsoZ_E0sXvY5P4Y~RAIX2x1wWTN zzSRFdt_wQL_bDElrT$SoWJq4^aQr}RVtc6zp2?0TJFfoiUGOLmNm74Z7kqygJd1}O zvg3}@cXYw&F%+~({iZJXU%TKZ^N=m=T-XJV@Q^3Dwb&ewWvE!SCsU zf6)b>z*8ob)3v{@3%c?u^xu6|V){IM?hEM8(t zJ5P1NKX ze??Fq!Sj6dX7z7od6dKL*iLA?!ztfN*rRQ_c}bM#bCypPyeI4D2tJJYT)|IZUL^R* z%ohtjhq;|!Y`vB+x8uL%|KRiMg`JyNf34uFnV%#02IdzCPU|_^t}rhN|LkLao#1ye z|FPgtGT$!vOrBTn7W`Aze?V}$^F-UD<|R>{Ud;ChK8pEo1;2p#D}tNr7N!0oxVer} z>Mgc7~9n4n=J5MrSE%@8a*9xA-?RbvhgP7a-#J1zf%r6!C z#mui1yqfv7f}hL$hk{?v{6@il&ippP_cH&5;J@Pa<->yeeBJW6;DebzC3qI|-w1vN z^A`objJci1tlxgZ{B@!K0P}YQe~$Uz1b>(LM}pg1KK~Z{SibH$EV#W+<7eF_=DQf{ zn`aCs<83u_^IYL1-^koNOE}5tDTK6{XVfP7bIgbH{A2yIpZW2EAH~;u=J~TpJ0~$W z&zw#27<2QS*(AS&xp}s1l0VGcJWn>s|H*uwD9>@cz+Wi%Lgq^ZZ)N@+!Ea?=A^2|Q zHG=<@d4u4eF>e+8D861jOYkww?Rv!eKb!d_LVr2)?+Jbm^Q#5FhWQPG-@$yV;IA{k zRq!BR5C2T?;mq$Ad=m2q1TSFzsNiQX-y`@Y=1&WL7xUi<{yg(P2>ucCKMCHKufyLE z{AA|u34R*$e+Ygi^G^i-A#*$qS8uj`?_+*M@ZT~I@w&$9?`NJS_*cw(3Er3Q3-lL! z8uKB7*D*g<@bj6E7W{hV;|0Hm`4qvQVg4<_-(_ysr?$RFn9mXV!+0K9Ao#bKmk7R) z`7*&?-sm}`J;ljF@IX{E0{ko_(jbBEckWI-(pVpc^GN`e=}%$(*Bws!kMZ@$TMj4v z&qrg2?L&u?euUTmA3L1%zhwQxf}hO!`karA=Q3VL_7vQ_kB;}S1izg1bC}z9xs^NL z>4HDa<%tV^AL};>{sQy!1pgcJ%LV_0`3-{iJwTPi2k|Lg~%=VIK3If-h%2RPfcz#|nN0b9-HG?Qdm1Pw0>4 z_FXRcPS&pz{9)$ydfnQ8hPipBLGrrkFU+?IJ0CK)*YVa)fcyI+Lca&|X9Pc%`Ky9Y zXa26>vzZ?dd^vObQ4Cw2X68Lp+PBw5%!dm8L*`=z{}uC@fBZGs?GJi+#^~^sM{4m$+3&HL99Oe4~ zwq5$NoqmFkWIjT0yM7oiI6Y36wo?ReWL_Y6kojW4?c%On@R_V%BX|b$7QxGyw+X(4 z`4fWwoVmS^V*Rs?x#Ig4mOswCkKptuU)lx>{(I)51-Jg3Cipw7KUeS{@O)Gv_!yoy z%LJdxyiV}?{-&H~3jQFEWA?s|t?!ZJjQ%x3zbBXHM!~cB!x29hd;sg)`$N|LSmt|$ z{;ACWAoyJ7Zwg+*+}>xh_E#|fQs~z*Pw8grXZ7hBFti;l_$KDZ3VtQ?se)&-|4$X% z_S3n7k7NDCf`5y7h2T?|HwgX(x7T{XW2}F%;NR!<)ir|K>#v&xznAsz61<)^O*lp@Uu96_6vSF>)ZQtw!Lm*9_((~&2k&hy#;@g_0t8n>$Gu#zsdTi2>vPa zxq|y6OgWYceiZX6!G|+%5quo;4T4W%zFF`r=06d9Df8O}Z(#nA;Mye6z1O%ynuPV z;1$fz6TFuBX2CCKexu+&WBv=lA7Q>n@aLGnB>110za#hoURQr6c!)n-6XE-g*8lIZ zodJUXoB3$LBO{HU?R{2jr$6&~LO+A~a=~+$*9o4_{9M6LXMUyN>zQv8d^7XA1^+4Y zUkUyw^A`o*!~AW*pJi@84`%)FC+2vrpWZCD&$jC?_-pA#&whT)>ZkE|K11jaVLn&z zam?-K&8(el<~2fpF7vg5FJ*p_;H#KlE%;#`w{H}@k@fEsyp8#zf?v)2S;22){+i%- zGk;I;`cT_|`Fw--J7kv3be<;;H~_|43JCip$f9~68y^Ct!0%l!9( zKhOMi!Czticfm{951$LZig}c;hitvhVt%yXo0yLj{Kw4geRpf;PUe|H|8eG}f=}e~ ze^+pO-M30`d!Koo;C0--_I|uAPZRU2g#P8sw+j9w^E(9pE%S#3e~tOmg8!NMD}sN( z{2jsVb)~%?wdMa8>wA3NWBFIij}p8a`*VokW0;>H_}y&hRKd?>UM%FSvQArc%oU{}t<33I03g&4RzgyiM?Tn14_3&zS!}@FUD`6C4kI)Z2Z6r!wCo z_yFcF2tJYd>w-^Z{tve&eiun+(hi#WN%*P3S5%ZaXU&p*i@LQOd z3w}5ACc%Hj+_t|h&r8hB6IPSu|A6_e!p^76?-$&D`Qs_UdvpAohp8s*k7544(9dN4 zx!^_2(>Q-y{xar+1#e_NN$`i+?hL_qF#nF=6?{KurQi>-{T9K0!~A@~?faEi3U2SG z=^t@%*4wlAI{jxte*yDdf>-hN`%{9S&-#B5+>Wzv3Es$dJ`(&a=0^noka>5mw`~{2 zUz#~a@F4Tif_Gy+P4E%Sa|Qnwf7!7_@FUF21@Dn=#*GHSpX2hMBX}w6ZxXzW`3-{G z_bYD`ypi?q6TFT29>F&yhgO|0mb~7QsJeez)MCGykRF zKFiMv-i_r~1@FW1JAxm>^2dT7%kmMy$FSU=-zS#Y~z4{{*Yo9qH?e-b;I}ciM6oq|8j{1L(JIQ+EWFR=bT!LMLGh(26}&H8yikN?93 z{|occf{$UlQv{#HJWFuv{{@2E>)B<3FK0V(!B1j&wcrI@W(r@H3eIQ*i75F9iQK`z^xx*!G>xe1zbq zvHj74&tX1M@OfZ#1b>F*^@6|1^2LJxndPem-_P5t5JYVnwtp7d1`>?-m5d0YCwjW!+ zO=Ety(6{~3_HV1dj`g1w`e!r$gW#7j|C`|BxcnarK8pG0f|qkUhST-%oEV>1G4Cz- zbIdaYe~S5d!5?EjP4GtM*@D}4|E}Qouzpf}hXauHUWyH!;6f=-YYJ z<8`jpAHx2O3f_x(Pr+Yc`-26y^_?boi0zyz_-AZqj^M8`FBSYv=H-I_o%zoNKZEnV zPw>;2KPq@0^QQ&3^VA;&zm4_Z5d3=P?+b44$J)I^~3!60?W^3ezf3!W-?1em~#ZnZ*5hwcyt= zzf17h9N)VHx9iDY3vSnwFA6?`?R+5kK;~ol{c~GR>#u2oU&ZybpChpPEzB1R{Y}g( z1V4-U`GSAUpYPfv`0(SE-mVecuIFzQyeI4bT=0R+e=T?&^WOp$?~V{*3L6a5&kq{yEX%r2h%)Pjoox$JzcV4k!I|{(MiS!%5%zxsbW_ za}JKtR_o}Kod@}IU1tfN!TdtO8<~Gk@P9D>A#T?<3I38UrBeF@|C0Fu z!R_z+gffhR?WbRHzZfofH;${51Ru^kmpPT6-wM!%ON9OntRHhY`Ll%ErNZIVE;c?J z98UVTvwpL~wLZ7|c@8K25P$CH0*90SD%QW!;iUgv*1y`}q;LDR{eF*){|8wAW}$E6 z_D+YB{ge6gF84T`?A!6-F^7}>W30c&;iPZpofnu}|CiwyZJ#@wZ((a5<#x91eh;@x zUx!n^A9KC~98US#b{Xk#(x1nl3(0Ue>DRHJCp(<1 zxV;bll;Azmjs2Gdx8EOpL-3b5Upp^ZfBuvC7ee1V!Pt-TajQRwc|XC&FdrefecyAu z;ALF?Qv|o)6U-Ofey`AeKiiha-WRG6`u6^Cqu_0v?>T~RWPX|8S24d%@RPZ|w+L>( zCwRBu_WN z!CP29N$~So&J^5!Uv+`t_IsD73BHl#m4g3-Wt+b(|IeA*{4KZN6TCv$vF|VcP;mSG z*&Tx0@9jPy_->Y;6nr1cFA9E$v)| zlx2H8Vf|x2A83C^!E!sl2Y4Q^`~cfY6Wrd%7$EpRS$~w^r?EU<@VP9XB6tzYiZ_~% zcuLkJDtM4(ULJM$y=A*LBRe#e+TS@(ckH2UY@ zB~S1&l#8|^^P=;$WhS&#@NF!YIow_6R10p`!+bkZg@iwCy@>NtLtC)+iM#%}ob3~L z{b1`&+^z3EN8hbi6neCgzFU6#`*O0~Hw28nZAT;FcS1M-h`Z%{(&277Cx()C+;YC{ zaJQV<;iSG>PW>dU#53a5xXSp7)|IjH6)WgLxAc@PdSbJE^xZgmUZfg_hql(yqjt48 z&OY$Veem44rg&|6@^Hew`wTjvLyrfxD)czR<~MO~wEmFOwQ3=+mWeHLDf9wv%sX;xIPidE6mP{-BdnP%hW z6f8PXACN|@R{VHyyx<|n?ALpyyapquT=*7BxGrv?7g)BNzoH&J&*daNYlGq`65+$)i zauV(JZsJ6u*nv)@t@9@`cgixi}Q0h13SLk{N(v(;(%nN+jxmNW4C$Hzp+GmcD}J=!Vkfy{K8G@ za&{^YBW%U!CIlqt_jNm~zx`d_-L5jyvaE}7vSf71gpKAzTTZ&Ri{MX|{}iy!@-Jnh zb{sd>I_7nH7w1R0;$>vq*<@K4<{ZezrWxQ;+B)b0bmqTxR~Y?& zm6}&7Kdt*@`S*c!unG3geC)8b>3wo1b^nAzo#kKsmN}=0PoVt!;!o!PAsDI1!8pDE z5ZflXel<8z=93_IcK*L;V8TZI!`*E8?dxnLY}(bEeU>XF(^B_RK3_Dm%H#7Vh!br6 zt;Gv*yfgnj__op5&WhweS})o2?YOj#^Jlfh%eu2o@*y#?h~g;v{qWB6FMG$F@8*9D zkj%e7DlY3zXHLJsoIjn7Q@#|^^8E1=CrwCqHdiodv!6P7veue1ZOXK%I#rf>Uhe$a z0WVo2Pd(6STV_y@@|LMzGqI+o^Nup5ao07KafFIiVi67kgsUO&x=?!~%`)@N3rEHtEE80Et z5PskOqYQ83pkZEM^`;C}id;4iS89tI-d2nZuTgKShO&TuJkuSBJp2Xl=i@JkzYzYy z_>0^ztW6!d29N82zcyoSzhxuN!Ec4`Bw2Zxhs(}YhbiA34`m)oMZTkNoV9DOYAcQ* z|IyxMgXSWQIi%OT;d=+o^wL)CJaVLT*l}w0`zNW=t)A*z)|7b&{c-a(0k!1~f7s49 z{k}V?d}V7g54m#npqv>SRdnh;zmGmna|^0w|zp- zsnPXAdRGq$&e#}$kG$P8^1Xvo&v-X`2A&%*+1eo8=)hr)UgnH3-BoY=_Tj=%^WtnQ|!ZU1HFp?uV}{PXM?m0xAgh`yG!3n9OmZ2ubN8iw;T zZoTve)q&`y=o{HH0$y8jq(@uvJN~dSZ~4)Ax=m8mG>d&%gjD}CG?=ldF(Q`7d_Ew`W z=r~h{cK1;CQe13AoL8T$4sA@$+*N(1+7&HDADj&tF>mcqduG8N*{Qxt(X#iNVNo@) ztUG*5vDPzvY7O!{$^pyMAzQ(mey^-j1J;+)l^P=eAGE zJcQr%z4tTto%`Du@NRYLTD?K3()XkA(Q$hRZ4atxWG}-v=kE`g^J#qAAK5x+ zZy-7*F903n9qp?oM-gu{&RmMJlAp2_`0(^HhOB>ROo6Oz18IE9*Af7(e?@3 z_SCnioJzIzJ|D*~MLWC?pHX{n{Ori&8fs_cbN7)W{j;H41f7l0N$ICv(0)XlrQAJi zdNukcotqI-@D-<1knX|h?nw9MbT6dgx2QK%w`KM0OteYnt~4)Y-X`RAznU#DdzjYAG+II}{&WApYmt%cZx(eraL#)&y7FQvjR`p69vkGmJ_EBv5em`|gs@G@J zyzapnXQT$Vtb+aSq-*t|)2+MOvNfbWnpcwn{q8&e{?(CEs&f=&*oZPzBY(8V>V3%n zTgblx`QvTCzWdR>_3*_7kh?>^8Lw%0b=ye$o!jRe=JR-H z|LvSZeP9^+Ao4A({@9;^v1H7F!daMavvwRlYtQ!Ge(Yt6=NiNg^#Qc)3)Sd9qv5}~ z-jGSu2WpNE>UM|Uo+ZE4oQW8CJYy5aibGQ|k5s>zJ>xv2_bM8zlJit_{ZKupP#mc4 ze#x8g6Y8y=^`7-k)ca?>Tz(~H{w-I{cp}sWbrGH|)EsYG6K{&uH`rTGv6k{x@dhwe zQCow1Pn{m(v+By%#n#r;S2nDT>4#(U84@?GqbJM9nrqICs}?7XyIYM-@n*Uq6041` ziPx&ScpayXYd$&M+@4CujiHm%@nre*<0{9dAJ;rKy*6HtbgI5-h8sTS!Pm(fIgNEO zJg&O7yd|z0>nhXfvD#X-swo~<6Y95(5Urgb=`52d5r zTDP!pfjQQ)E}f0*W901rVnYnJ+oX&*Znyona`NOOM{K&96P_xv$=ewP)hAxj)&ndZ zOe)$WE$(PDidH(CDJdyZ4yJbleLvDOe)%>eU7HF zh@$GP8^0QQIp1rrzsYRqM!s^`%&&%C&(ijG^a++;ZAVRB9rtC7Jhjj!U7s&Z_}o5p z3W_#qy-cN9xYbH+30E$(N!RBKw_2a?O)A=?^|G;Or3ndFF0@JOWus`N%ae*W>H2)( z*3NvsaBF8iU%0h1pD*0nna>w)?ab%Mt&5HBQ_<$BVwCMU#w$rQo_#VZ6m8Nr7kRLxlg2CQtno?`jrV1u@k(scHkYwzrLl=NDX~f0Tt?AK zMM*`QEM>%HWNC9!(I(wiF6p$DOFC`kl1^K>q|;U|Nwl*49cELkj?H4o^hD#7+N5n9 zPgU5V%-RC#*zgry*`~`1+B~($CciWUsM03gCSH_i;$)~*cFeJot#o*?@#U$-Hfd`^ zZdlw&s4ea+)D|boVdD!HZPFbl7AHdO!9=Jnwn-aYo~p9R>4~UVY?C&!OaZNAV+Q%! zWG3I>Hi}lVg9S3NNq4MX+-XED-fBl~JAUAFn{K)+LpqkWs}J$_$F~@v$Mh0dED7}OWOV>5jKFUaxc$=zUrm6S|P~OA)IKF zxFXjZ^t`P(EEFa6Y_dA3r?xh-V5dr*i52YVtu0!ik%wQcX*-JjMRf`ZvDs?aVOyUk zbW|RLQhxQ+GMlt*<*B9DbHM*75%{Os`+Cttloz#ek}el$(-~S}dlGtEt?)<^2DVz^ z`6TqWTEX5aht1$tD;!K}hPGP4K1&>$;jLCk=l%p3*=hy*lnB7+Rx8-P2B@}L!H(t# z*9X~>?SMcw8BNBEw{bNh1J1C=wjxsKYqmDZ246oyYI*#kO zjgH?rr%rWO4q@i~KkxTF&-;I#?>*w6|(ucN_+`YT<=Abhc{YjW`T$&E!4WG5puDPIb2Cu}~X>>jQ_ZQ&1!)Wa zG@-k+phq`ox-qNrLR>SnRSWy$(A%nq`u^DV1C9W?UT|+m*Vp_PMlt(he_mkU8~hgv z;ceBz+cCJ_KE$%E=TW8y1FUDV#{tQn1SE|tAh}rsq^Ea$-92Q<>&eZbJH@t+kJXDk z$8h6R#Tx057RctHV*X1lpoOv+?4||mzV@iz{avSb;-DeD``Z1WIDx5_)4Q<$tieZx zj}8aG)Ht?X2w!Ol4z~*X<733#(cppe>i)LVI~)cr7-jHUZj6M&Oi=OrkV=n{K#vQD zfg}VWk+^<%EQAb&57By}N;rHRsPxK!()0^uCto#tu+tlJA2S%sVOhOZk#vFjxK?10 z(!hcwPVFN0O|`T7V?s;9OT&vH-F~2+oCS*gQ4u`@&fR2_5`5R?yiGO)UosmiIuNjh zap9{sSX`;B9mK&@aTiMizj2CHJd70|Vu;WzL*rsN+$-EOJQE;1S`C{*#UB=H zMTngi3jwuAe`uLwp!UO)pe$p+lkQThj=;|zM<&^bMrA-JsHTcQ0;64sgCe%e7;H5y zjExlp`<)Kj#so}fRof)h))dZKg4g^ME1>sb&K z7^Yu{2;;a2KoB=2JuDXu4b8no`xy03mJT2`yuOsC%ULKK7xFFt6!5vHfzt#2TfUue z3;u;GXipA7<>4aNCO4qeydag$hiSnVmdb8IA&@%@RO#m@7sHAZD2|s9JC?3M?ysR` z;$mK(ai*C67Nigloihm%kBf8DyM#)y2txH9%L)|sfO^HnqUJ84^RcM$(0?zMESYeK za^G7a0e#^OXkeSu&#uF#_V=@EcETSRAMh=C?Rg2+4~?|?KSvs{5YNQwFmJV{!9$3~0az~OoirmrUjv;p}x$5m9e5|n?>#va*rT)D!J3holdTL^9U}E@GDqyk0KXWPk5gTxyO==n*hr~ zlVe%gf{eQqc1;5I2c_aq$w;n#eu73d#k*(9KWchg*ZD29+Q+_t@tA*b7R$dpIewrk2G zZ98bnqiowT<EO)A^NLklK%_zugE4p+Dosdfc$8Qz1lMJqkZyLs^{WS zzV%ha$=^_K`FBAgX^((|S7?i!hAl__bL=!d%0uVcX>Vzr^K7cF=li(P^#2Atf)P@G zWDReDkK6T-+70?xoK&5+pAlci zePc;?Ex#Qi@fP`mp0q2*X0t!+skX@24)(#GutmlK_&1_c1lf#&|5jj4{h!h1tWJ;y`XGVg$rUc$00_dZur$w-i*o~7QhmyDWKp06aT zU$vLmMM_rENYrfhB1*zWcG|s>N_wOpNFCl-Lt5iaR1%I#XRViMNb9_*hP2+BsU%AC zRPPugY=f5_fPCSZ6`0CtUeHd z1p|Xja5iWRG{HFll1#7}zyK4R3!uLV&I8cT1m^?jYk~^^B%0tt0DVkw5rEz%xEMe$ z6Kny{(*&0Q2%F$i00}0z3_uSPTn@lD!4&{J6Kn+#GQlOc~5Kiiy-aI9tU2-1xij_1B!*+Y~m4tTD zdD1H}q&;4#AwA`l8Pe0<0z>+pS8hnpcol~9tXFABd%cB*^m}iSlBg`td5ev({oWEo zdc|8BuqNOfsJETb%6z?y=4*_njOC7jAWUH4MEEv}GZ8E*89a!w)Ftz}8@>eOEOS*1 zn&!)0pF+rvoZu#s(1tA&b(2Y;IalpQNT4_?+_5C|7yxQDZf0Dlb!U<=6hrFVY!Y69 zUwb+AuKHd4-B`>9*HTvKPuL-iZnlzsK&i>iQxc`#>=qbOi(6($t?m*-I@ztVEgxUf zLUrB}c0LPG_EhK314f;{2&g*aV&i-nP<6fwjn`KJRp&h@d>0rRUl_g*e5ZQjXl$FG z1C~Q!b5U}fWlE|Nic%(vfmH%z`vfKHddpIB!3e4Y3Gt@rzTM& z;%imxVM(fae}zIMNewexzU}lRHOz2S+ar_IFe71fQiKw~_v_eWlhoA0&b7xUO|;T* zY~W?@4)`}iWEbDBLRnYY(^S^IFy?g5`dAcZbJpc3#iy=ySWuh79pvV3%X8k@fXNWJ8!W=OO%RWo4uY$#N0Ov6!@ zuXJ`eg=%PFw>t3cZ_;5w^%4uJmsn7}#DeN2_+~U5^RfY?d0Xt>PO065)@#0dHwmV|C!1D2%e3-G zu$3PWgsMz+M^ffTp)ieWjC0wU?&8wIyRjK;|Eb1Dx>Mr?KFXa&0oTNxyho(u&H zX-~*8q^CkbLwY*o+VP$2GZ5A%Xn0KH7`djLI6@Em}!37!W4pM}M9c>zEV z6TAq(H^DvtuxW}%c?kggi-Y|jxh8lSK+pt#0N|M56#xMfyb8cJ!D|5ELymYZe*}=` z8{l;S!{DQs_#NbhmVXCyA*~qu1I~92br+3ip!WX-z^P*h#6K3#SoIFnEAE{~7pwl;Z|@<3YD@1A^OBm(p$FpdjDEk(3A9xhEy56-jEgsw<(FrvMBg#Ls}fX-H?_9?>4skQ5a-t+YL|!V3-N20i>E>1%RO@ zr~xp<1hoKCwi~6Z3qGhM4+f*t7~El$rzyBgNo4z4g1Zf=HMqx+P7Xe8NNvGq45>Z1 zS4nh7(h+>lkk$lWP!g?g>w^1WcZpBiB|~p3l9U>SP;-^H3)torgLJ zBY3FOcpJ|{o%X{MoUt_2No}H&Ndk4vBuCj`3YiSY9BAqBEXT=rlntg^g(64U;Crz+ zrH-<}G$t0nK?2614R5(qO9HiBrK1co+02E`NfbiDB4@SbpAJb4!iVC<8g2+;1R%vq`$jF#`?xxrXawt;H3Og9)-aTzxlhbY^? z0ymgaQw_!;++Y~8+-$JrPJ!iPJNnC^USzTo1J0SMSTtYH=3j?)P<+Oo*vT;cF? zLkCe;I&6Q)#$4s_jZbF;vb@@>8(@?E$3ZTYfJ}dO!2^I;sCfFMj)EFk=^aQoOk#I(WTHi=GD?yE6 z>_>ZZf*QjlT#%r~FbNkWs4rhG`aEFq5s>>l#oD$+?t?l37$~ecP7A{2ficSy#yR;hKOCGnt{p+ zKNg{=B-EMBu+nUXRq%c_2L~4$2>$@4`Myqbru~uerHqex7dj6HvHfXCH7)Ka?Jq*A zX-W7dq?(o*J(;B3iV<2 z@}c8Kg67vMg#lRpZ&clhf2ZnB{vTA`$^WCOdj$3WrF!Wo^jo%?0LP;cu+;=O35B4o zCO{_&A-jNv+Z8DIwi>CoqL5%Op^%4B=xJA3elCO%eaq^b+G^V3E@K4bLbUR4*gwc+Q+QaaS{FQ|URN7;t=seYV={+F{!XD#|) zDTwF$n(9aD>(`gW`I}X7|DS5fPh;Tidh%0W|G71;bD)F#Ut{|3t|vc^>+t)XmR|+~ zFLfC>RC)DwlH{;@>k?J6Lsgyz=vr0z>d_E+eWK-Gh>@?>k&Ag8ofOZZNk!fXD&ZCw zJCB3MeF|gk)3FvR;}Py-dsqZ~9&{MKc}K!<6#Cn0qEA90$yO760SbfcWXtahKGmC8 z#B_8le>A|6?4QzAVJ?X2SToBn2Cs`&&tKF<$MRQ#oO&`ic!hBZg>N*4)w`~!>FQL) z@M+HBRZy|3z~f$zv2N3`mV_`?ayUg*3?H-{9?BK_6op}2vF}lc*wCKufKSy0n>ZaE z%f}}xk7WP9x+=u$lB%DB96pK)>xa*X_y1X{u+*LB1g+G0Fc9zxtC!UH;SHp_8pp?J zhHfY54h|{Z;Cvq+Rh)XZj+;&SB!|@t(`fu%pyHDMA~jTK*ldBS?SOcyYFLc)y_k&u zBDfh;l1S=bbi$>Sa4>vXyaHE%?)MNrGCcuiG4&pIVIPoPoWTBI@QqAYGkO&G<1<{@ zZ`I|qx`tGO$SExa?_@t33&)%+zXe>Cs+sFqU9>oXYrCq#=f9|hjX|Zh{Krs!1{@`) z&e2V~*2e`l^}iqpukbbg2dGL7g%wIqfW25cZs^mg$8P~8s+8p;^zrc29Sja7m~3Bc zteIQ%nhC-7CA?$!=R$AIpUu9kB zEEwNMpM?#21S&f(^q>_VO+6i=GXA~7-G#x&vD8u5Vtzh;Ux8BcR@-r`$oHWbi4P{} z!>&;SN=5ofMv5y;#S(izbWN0V-xAMVr8W(f?VnV3n8tK^PK4DniQ*%%{1Ya`_Hy~g z7=nRHt%sWSTyqQ+@V<*e3h^Dfr3IxGk+I_GBr zm4DRabuDeHC)ZcEHMKOK($XHq2l7qssBdVijW#x{XrD59O6C;!mz6mg#C3Hm+FNQ? z*LAd`G#P#by*&0q=t-@0ZB6j2>grW>llZ5~@VL4Bqn2X^%e!W<+{j?L&S3e9H4TlF zYdo7MlxzCbNo!|T>t9_*<3F>G>gNbHS2xvJHIRkXaY}2QwFaJbx2n0W7Jg0LVdXEW z%qgE6Eh#O@*Z#cxTyI$Y< z^&K6pQ65PuEVs0zBp(V53FH=+R^%T-i}Lf!qB+G-D-|0a&Dab>4u48dZNIR*u&g3l zm{*){DQ`u7eo3^VIH#iE5D?8Pt?U+3z?!xOcwA&hy{;W32MwoF1}~*tmS3KmUqZZc#KJntOI}VMT#z(|AB`aUrA_HJT#7yu7p=8~zZb zIfccQ`Q_2F^89#u-75Z@+@P7MSIxwcMX^7-CRU!Gn~zQ3r6>%eWuq(u)CdT7aMY|bvtTiUhkF$~R30~|(PHyY5)`Tt(yFa_cM zDao%~Tv}da^l8^jSdB^(@As}cT;r1b#V|FfT?kImK2hWj5lyBC=Vu9d8x=~aYbP?w>%&ErE7(dcN<}Der2?> z0Al2Uf$172Cod0XR&jB3jtI!hFYZ1d7g}m=esq3mUVirq#id|=FwL$xEi5@qfbMY^ znU&DK(enHS3k%D^+?ACVE`mx%i}DX?fM{7hOiye$8lG&;yVwmdXP8=E{+yhJ#d4J8 z&MoX(Isj2Hb@K~L4jt|oR#6G7RWvWBGUw2EDy+*A7Vk>KGU{=8sQIA9DDUv$+KllK z>m~uce*Pb&0ZpAFx?NeULYNSG40f$Ah3A!*mK`QMw;&&SKPNXgzoH^qUO2Zvwmc+D zVFi`*#Q?#fsOFw92^EkQPPxL8Ii+1oGZ*@J5w4G2dY;NyHecu(ZFe}ku1BJ_BW!s7 zgB>Z)SsX22(zOW4)DELd$q*mLlw(j%9&FeSO^9$57l}i|%9k7_AePNx!l`uKgrU7Y zw4rkg3XAhp(W8qBbE0KA<%cx8(!q3jUl*SQID>S@=Tuhaw#=MS~7Zp@As&hYj%sHC1`xfh8SA13>AyHO^u3Hl$+(!tsm3mT>vf;M(acHp{)tg1UB?g7u1PMA zCyC|+)&V-Rxh*g7xoqlbCtnio%kMxmf~)8L^`zN`1i?ltMc!&@1|(9vXmA@ zD@$?RDlUfYBi+LpRaC2w(t)v82KO0Qd$naFlf(5iw@F=5G^b=~ly+E#A!8LCWUT3C zqGfR31v@P;$#BC27833+jk0lQC52YNmb3f7yi(|>u7S|GyfuYnq1u&dvEf3^DPCAn z0Q(`jofcuB0vztO%5s*{CY;wPj+&cOf>U$}wxqZzGz*tiaJ(t<)QiH399v|}@WP7j zxh_N3;%nNqWUvn6iqD%jGj$HB0Apt~E>jqCr@Z{ysUI=Fy;G?cqG4#CyP-tTcRZUCYV%S@j>HM4}(Z#Tx zgB5gkA?(F4VUF2d5RBc~3+F`37MD*URT!;ZWZdLNi($`IOu_T>=Nl3pM5)?Tx2=l8 z0}Sid!?6wa5{(nsUt^QR#M!XdE>}By6^_*`ELj-8RZ}>&+f`zj-d(V$j|Jk&X#H~3 z=F))X*78tHZQM=f(7ceEQR;#zuzZ94fqOxor7AIQ)WW$XuziRwDJ_rAS)eqGnr z&`}qK)60&QnwCaPYjH(sS?(cODoTcTPB{$QxTb2VsGudK6=nIk(dhhzWDqz}Z4;HK zTZ<)ZEF5aFBS<)8tZAvOYma8mu-evJ&2ZicJ!j261s?N=&PuC#Et~)%TT=+5cv97MJIl2-mjZfE%LJn=K z+VLTq^>vN4&`#Ysv&`vl`G-#p%!Ky z8v^b1Ep0FeAX?URP;5p`5@%wxMvR6PLX0opX}7B35v6#JZP8G|e(Y#y!p24wXi+d9 z(1xuo?UqVfr`)z4^F>Yvyim1PxKpUJ>TBDgs!^b*Fu)o*8en|YS2x$T*TchC!Pj0N zT~Xa$H+?FEM%O?T8fY*aYoSA{YvD5otnIq$h7R~}puNL_$Ea2}t!S)+L4m`zy>d zEk0V+!joI8z6Eqz+8S2DIEl^frn-*$mRhS}Wpxc4+N)>1;(K{;phE&ilGJz2b?c(g z9V)+-@UT>@7d6PC6O5WqsbDLC4;x}-OKWsxtp)#d_(~X6_(1`LKv%)QQX!~^-2icG z8e5?D?R9nV3ZOM@Mt;}}I+>Q0s0vL`Ymo(m9AP@F(uuWm7omD9JQfzF3$zqwiJtaT z+B@K>vov0tTA)DCwK^simolM}V;=Z&BWz(9Krju|3w>bZty%?>v=(0AgmYDe^Zdb? zqvlmj2Ru?&&0I{S-KuTCNp%WzaeG58RuWWE33F7RC*XUSV5(V7YZ^NmK;ZX7!Q`iA zYpVkb)7}yLRF$n8Ku|zb4p@CqG!5gPwB;qi( z)<7#l8DN5~hnE;Zv*M_Lo@&D<2lK>lXadv2r~f#xU@*cc0;>vx9%@kC2!pf@EFxQ2 zl^c!nSXS%Wv7l?Partjl* zym*TnNT-go%xbD`Uu}_gYxOCOE!DO77~`%0$2F><(SZ?+E0opNz83$(Fl&RF;z~lJ z7)Bwy9160AL{>s=G3uI*l{3|Zg_*5ZU+P)21~eTpxE01LEJSE^pehaR@XY1rY8XGz z646uZ+FIaA&CM{C;UhgVUZ8^|gN{-IjNf@x(^yyC%w>RvSM`DzYNn~$vW3S<2t&5H zqoH|CHGQ-Meb?Rq-E6h2gA!HK!b2??rJ8^duY>tzkk+P}Iv8N;InNMZieS%COG0~K3u{Ad(a4E!81y)eEm$xDV7Y@af&-F9J-lPBu^N)VNsmFQ z>^GO+VTDH)jQ-EpM^{~`cKpUsDlqG>mz|j-#CTM8Zu4!sIMZJLxOM%lC zKPHZu*;?pkv_P0wYfDR`P98*+92PyJ;lt%lho6(<%Br%^>7m%z(y|&F zdMz$qs?OA8uzsySB^q1aNP@Mpp(a|r20o-Do5PWCwp&ePa;asNH%?nya20_;Yt^iR zN1d;Q35=t>-2#IRTQ@9(UM-`l7+L`mZmW(q!KlIM+72@e%o(hhFsxQJ=+R`=RKs|J zNeEjgST(44WKtAwt6S5KCX>}*tl;(wx11`R(rl`$ZK!T*fGpJV9V?Kk7uA3)iO~db zcLx24Ynv5a(+s-@)x2!LvHKfo#Ng%%Oh|21Z2@#u!G429SpjBI^$H8LtHtJl4Ir3m zer!8!Z|TAAFn8Iokq9FQa)vJg#4IdfvrS=h!gm_by0icTS=(ai9Zox%ISNttBWe(| zw>QEnx!%$rm$!kQdT}qatitU{AKD1D;UdY}M4ks@+~!1MP*+nqNOH z^GI^wn+)nNY9j@U0#Ax3A6k9ogRR{*K9kZjOb`($-jg z3f^MCssSU3>_s&#W^HvfE%;p$492+dNlj^aUbHx8Dcq)$c2oTD8PDzDiv_SFr3nu9 z9$QmsVdPRgd?%&((4zDNe{J39FN_f=1jXTj0+A?=`h)~~uVLjWQQS{xe{9rIgH}}H z-Dxfy!L+SYb)ostwx$&~!D?fI##wFnI62ty!cGad6V**HuhDiNsSv-MZ4yV+@0Eg;kX&Gf64H&?H5@(kTdQm%{k! zPxj(#FmWQ`_5igosB85!Rn0SdvR=$A?@z6t)ws zuu;L82{#$&uUVn)m5HGQ7PA`KSr;qbWZc)h&Z*I7>~^qJFh+H0uyYBidk-AF>v1l{ z2Q-*jb%UtZvX~g_rMOYzNN~Rg0}riCOxZ%)4>zE#c-LnvAtbA1Purn(Yc<@ggH^}B z09Sxf0UwP#u+G-%y1G^{(re+~Pi+|Vpa*+c(;kIov;l7LsZunUX!)mI7#hPURF-b! z*5OVKr6~WQqM*5i#j&*&nggbtYAdS-#t@Epwf@8lx}pw8Kb(hjw6&Z97GC#>*5G@d zw(51UC4&(*4yDGcq~2RlT5Hr-h-kTNZCry33HixxlZ-jRY=I)tSqFvI!nTCougd#L z>VPhKbf-keC@bJ*36?_@8|u$h(5D2rH-lZ4Ix?V*8fI4;E@5` zCaK*7^hMj+2H19j#f7iD!9EBq0a!n^gN5OX3BukG_w%$+)Ko)vG{7j1;#Pyc!-i`% z?x0|bwPEY8Yk;i^jt_pTIwJlA2SBE#pbW=h%N4!6S-9US5^*TH} z0Dandnp-HnBgEkYdq*ld&VKc-6fDId+r;(;yc?`;hW#q+?qHPY6BAsTWnir8kiQr) zSY5s`rqGhGV}cE_sY!i+&5fHz-Spsx zj_pu;J6R3fd2*Ynog`FU4YgRpYM071Hj{bt+NINJ^8+0k->JuDtJ&>(kh3jNH)JXo z>gxuz*MWN-$W2WQTt=|JYwFdvA;E^?y$?134f;d2Coss?T8B{DZt8xRX0N%Q}JL9)>!IJfzCwu*aL|=EYWumaQ_E~RWNIDg9&#Nbk7gBZB%evvDk~J z07eC2*-^y?bf-5@cmLa#DP3vBi@GRZgd)lRw#B`q~=h3vk&K7)oWYUpy|XLLOiqO z8*OR>s9JR+cFZYJJQ;!+2WAkyhfC$90Sm`laN>up0aaD^!gxG}H^8uDHMFjs&SMtV z$2Poah{9-4qZsO8ZnjS?x9knW>>)kV=%*X-b$z=2hTrZl>zSH)S>W>E z6`?ErUnSgt&#fK^JZRk?fN%ZV_CI^~!ap`}_;3G@zLNhx|3d%&FomWSb+sLh@cCIA zetgq5xuLnHaZPO<{8b-k9WMD6*aJn|YgbQhhW*moy2(et`_iUmOrH$L^jQ zQadCvZL`55KvM84xqq8fy#+~~3f6rkC4Y$|0eo(_QWL6lggRuG=R4kc2T^Q>jNfrKAI z&i0Lux;;bA4_08L?Isqw1B+ZQG%s|Pn{ck{{KFkk;5x;w7Z{o3PACdF|2XYYHzVX+ zZf|nK&W#&46}m}9?tsFOQ#{WNg`8>gLQc^pH!$O%Exubt)}%7; z9}PKMH=>U7nKjRy0;*nU7yX4+S@9)B?h%>~>3-?@#3AFl!&Ty@ebJc0o zuAke`!@mtV7oPU0^A-4^Fnu?v9F;0|@dz9>Fe(b%q%zmvy1mL2X#N|9dio2dyuDmZA8rboh;-#PC8OM0%Bu2Y*ZX@B;+n*!mms0R~atFNyQ7 zN{!GDiPKN`3~E{L68F0>6y6~YKY83qV(ZNNin~NVucSs2TShX7-&({oe;L!x#UCv?NM&iU@ z%+V#9V;$O$_kqTtqrtN9QH|Ykd{IqzJnu04-ox-m50n0phtc157@i5~^o4n%uPyBP z7XJ1#`i1tLz~H^>-Il-fFnkfj>8`%?cyb8q5An=d69I--lHkh~CjI{4|1--~{1^32 zUeA08@R97tKi9J#^Br#RZS2Q%Opg7C7wVh!*sicOOz`iRqdu1BLzaK!zq*{7tGD97 zONc;!1nc0RWRUTae5}FKlnS{s4X)c31CC)X%ahGqmZ#WA$1KkVgPZB^7wLb_Wm5J> z^&_@}=06(gzz@7*SA;i!x|~{nBy(L(&8ITQ_KCz&f%=Mca2(^6Ez;4vQ|K#g%Q{o& zYkmQ9%oiVDp)dVnJzai!7C!`DEz;3^+hNkt@8Z+xOy>;l7U^jI;9=6yukX|8%;$7= zi*z*Kdzf_e8~=1VwVckYA|1`&K1@3Bm|VJaI<1_}L6MH;@OWXmWIOBk3hHz=a5_JV zbTkk05-!uxuOigxT*T=lvc4W~nkOG7ow0}E%bDx+C-S(j66tH+YNRuQ%YuI%G`Jo+ z$Vc*$snbv7^v5#S<=1>Bb8H7Q{aps9hk0P)a0TIB4lhjKT=jhBn7+v)%rSj4oiZaG zv;!j`9Ir|v9g{B+`n#06wOr_HUdtTwg(qReF8y{xS^m3u%O%TyfVpnZt2w3j1lRc< zG}6KHYyH0ouJylWF3YK&)}ZV>Jw%1`-OpP<)Hm(Ct|0DfF<*TpvPW}0Rw9CHyOAll zwgcIM*RotDxSpp~f^T41hwJj_dBn|N1)%%`Sr`B49Vv2n)OzgFdjriEa)^$LT%V0$ zkZwb*|1j(8F^T1Y$B4u(c!~yHS|2vAbj?tI=>B0i`|-~L_G|ri)<0fw>^HntsXtU- ztk)>!8wHOrKTq%zm|rIN4CdDep38iz;3dp&6?{DNdjvm&`Gd@5yX_JB&(gDjEbB$V zui|vxG}1Bc#=C}o68rJb2L{J>dzLo~Ul<(qJ2?G+7##IK;_~SJ#Qs8kz24||)a!n1 z#7J=U;qw zsDCl*-(hgnKc3Uy!Ca639T0}s9}Rs>XFK0w{zdRtn13qLnaJ%N=6#Fq-}|{d0|bAK zc{+1lo<=H-Wz7)0C+Alr_)z9i!Sz0*U2r}AHVa0B>(C-eIRw^)8z@R=-sB6tVS zJH6l2_0=zY?#JPpAH(x5P4L~!j}Uw$&!b|&^;^NCf`7*gSDWBL?#GRSzsmf2=6amp z!0mIJ;7MHn?SkLM`VR~KB=cQ@>-#Zy$|_wt-?v$Rui&3B-zWHY%wHAU=W_l<@CxP! z1=r*C?}8t}`daFWl#k@E7v*v4=4;EbCSELJmE9>k1vrb2k;|!s{ zhxMll{yOtnf=}i86bP=5#7YDYvwo%E!zeERl!S{|4Hz6<_84d%KQVtpJo0x!T-tpOTj0zefv)E zI_Ccp{1WE+K2g{AA?693kLK?)PZV6={|pp-7~9XGf=_1-@2}}%-%6S5cGdZw#5_aj zpTT^p;MX%hO7Pz@&lX(U`8k4r%KF8Er}2KKT<|>R`u$w7coCc z=-ktWPXw0r!v1>@N1c0EBK?#w+a3h^IHYi zFQdF$@ZS6p!To}dWxhl3WY^siz4YQc9h zUnTfH=1qdX!@OPaub7`Ac&L|Z$BlvyW`367lbD|`_#Eci-s^r@%={{$e-iT>1mDQ~ zX2CCFeuv;UGKaSrbr}y2G1u#iF3&T}9~1g-F@I9NDUJrHoo0)$i^iOC0h2U2(|5or{Gyh5ON0_UJ{>I1c^UQnjdZo*AfO#Lm zzhIsuc#uCL9wK-u^WlOY!5m(;*rk8-m`@SBfe!+Y7JM=5=Lr4_=5qz#%6z`ydze=U z{yy`ig8#rAUijLj`~wq}TqpQZ%vTFu!~A5y*D_xx_%+ObDfkZNdS9da@sG^U75ZN> zzgX}@J{-M5@C@eH2|kbcje<8YzfEv>pfg?f2)>p11A;%ne5c^AGk-$xPnrKtaEHgw z^Ma=`e_8M&n7=OgeCF>8{xkEB1>em4bHTST|3>g@nExpFubJzQ>UIC#!`$cnn&$Yf zAiR1Dj_={bYk=S{G9M!NYs}LHKfrvP;D2MDDfmB_A1(Nc{2@lJ;Juj_3Oso=%T z7Ye?L`7*&bG1vQR-ENmMhZhCVrTI9Ml-y(Ph^ScB;mic{xmotAv@CN3;75qZxPYI4Mj>GFY!5?P+N5N0R zLsq!{BKXIw|GwaK*bn-j2tI(*`9kpV%)b?U7W1D3FJbQR{f8bW%bE8Pygwc)!<8)f z8LU52@F;)4l_~fN=En%$#=JoAP0aOum@en9m{$q?o0+RO%f|N!cQM!ZZ91I?n4c%o zd5pQfpVRtJF~3vj|AD!_&(rz`m_H}<|IYkRg6j_tKNEZr>whD75%Yfuem3_@0^e`x z^59!k@fs-jZOqdJ-^)Bh@Ryk%CHPy+=Lr5j^K!vIVt%6F|6+cU;DflnYXu*}e3RfA z%r6rB80OasKAZV=!7t=OJU=6eOdiTSI7?_vJ7;M(9~j zeYtK2{rT5_3H{OxHU2*lyp_xIo#6NJ=e8lfPu1z`&vOR|{?~CT{dB=UVxB4Z=gf~2 z{GZH=1%HCSEO5Nw{&F`AKQ8zd<}V3;6Y~RtKf?SA z!FMy)=M%b|2blNg`*O{HWYJ@ zBIef#zKr?Zg0E)&TfsLl-zWIh%>N?z4a`3m{5Q;PzQ5P)`6Bavg1^Ungy26gpDK9Y zNvhrQ1s}wGk>F{}R|!6u`Fg?C>m)7fT*0T0R{35lc$Cw*OYoDK?-G0y^A`obiuqfD z|BCrXg5S;jTfv`T?(+GBZhyVc=`Z-xtUp}vSD8;1{6pr)3jPn~MS{B-s@;|f-h=rn z!6VGq2tJf_sY3r-=Hmqq@|Qhl2%g0}Pw*p|FA)4k<|hi? z&R-;K6kNSR4}LQ#__eIRS@1iVUn#hHWu;~PTJU|Wf4|@dm_H-<8g8Hcf}hI$^^V|r zfB3QB8(IHb!OvtKw#_n5yS_&v%}{Q2bg~>xOxRFe9u?#o~$3_^9)_i{>=LdK8X1+!G|%Q zAh;fH`W!{4ulIZTLO-3;DHlA0xjr}5>8MvXTUMjcKZf;B5xkK3*@7=%ewpCvRnL~S zQ}8O@U+ocG@1tH4T<@da7F_S6J`!B-qrMSb@1q>HySg2Ead{F2@5?+@@FeEr1y5%_ zL-6U$^90XkzCiE_=25|~<@2Hj!Sz0Nt>Ei8oihaA$Xu_tx*aZLeuL1ziTRy^Kf?SG z!CzqhwBYYBe_8O4nQMEg%kvrYPlUcTRNZ%cCwO1xF0V5>ofPK%1Ru^kBKRog8G;|d z{20NDna>k^0rMq-*D_xz_%E2R6Z~}Mn+3mw`89%XV}7UL_cMP?@F$qRAovT+-x2&B z=6@IbGv+@F?((=zWIL_7TETz8{2am0 zXRg;Do$u>>j{2a`e~I;<6#PBr`vm_NbGFfQ;L7^YwA8h?Y@Bz&AI;PV}W!{JF zwB|kd$8)KI*D{|Vcnk9*1%HmuPv#2#5%YzDTYTQD-a{Y%9Bn%DlZF0b<{Jgq=f)Qb zegW%WC-}9@?-2Zc=8p*eGV|XF{vPvJ1pgcJ{}S99tL)Whf(M!ZB)HE!%=S1%f}# ze4*g4Fkd0~UzxWE{vq>Cf*-;BJi+z-@0Eg&Wc`~2pTPVH!S7_QKcCd?xsdJ5exa|= zuig<{--moG_yA7lTfv7i4|4uG-%-r_3ZB7ynBdcx>-y<*j%7Ym=;t%f7rdDH34-rt zd$mgNQ(0e+JDu-^%ug5kdR@L)aNX`V2>xqM=Ptp2!+fXUPesT)SkDTsf0zB5;QHJ~ zk4Ihp7df3Tg#H`Me-^xGxXQN|mrJK}0`nn)S2G_ccmwkpf^TH5`%R}mf0W9%Lg+7N zUM=`)=6b)Q)6u_E{-w~rkM++N{I|@n5nQj!w+a3t>pvv;JItRF{C(yx3;r4NzX<+M z=AR1Qi^uIh1y5(*gZoprgZ{j1kl@F${wTqhFrO}XGxNEE>veyL;8(K#O2O}8e!k!j zvV6JVk8(Y46#RG0?-g91e?BJoe%9YBxIPzsP4HJ)|6Rd@EPp2W0G59gd>G3;c)aU= z8P9y6;4_(z5PUZCBLrW-JXdi2`E`Zh>sY@^@N<|q34SH>Qw6`9`K5w?#O-#S;QGAr zcER=hdPs0>-}VUpS5E%}!H;G6Gr@H_KMJnEe9T-%>x z1PYe6|DU3w{*y%LG4%)88ui#mw&#T(|!tg6q!(o)UZ~r}L8FTUdTe z@B<@N`+g|+-V~b|Fhr$u5Xybb$_KWA0+tQ9Dju1<5_>Q;5V^6Pw>~coC^eh zmibb_b^F%|el54#$%5a^`~txr;q)&P{MXE{6I{=$+XVlftuIJH4!MAh&o-eqbM^_21=h4lAU(4h9H-hVV`k3IqVtqYMb$hKK(>vbwm@F0)dBEkQ`=~M`= zKWB^z{xR#f3a;1bPQj1le9sYlJoAeMPiB6d;1TAx2|kMXKEbP*zbW`r%nt~DFY|+f z-_HDbJ{Q#eburtiw*>#1c?zGaY5kjde2)-Z?_2*0%39i3)!N;+d3-#i!&QZos z22}p~`BX{*H>0+0#hO*o>J=;Sk0(JY=7_3@1 zubAOR#`oL*+c#mSrO}xadmuM|7Kv_M$9U2&NB-wno8;Q8-t$CY$wUME0+tRw3B zn^lbcW$G`sA67-SUlA}Ylbp?$=L3Z6C|+lj6whDR1HXRPUHp9=D#jumk^ky=`tS7| zU#M9l*GQsd9Z!c&27pX7vo)6E&(w)^YUY#3Mj$3$QV!k+}WPEs$=Bm2(jGBy= z$q~FV$yJW>D|h^NZ&M?0AiA>yd8TBKr|l7Id@8n+;{Lt#D-F zIGAQzdcyyY+|GXUZ0nK>;D3|VSzcmymQRMiW$@pH$3JX_zy96U&eg8fH+;LbGi|VS z^1F^de)G>iS62Tr8y+`cpWpY!>?3am(^=54VrGr+pMTIv8((Fm{c&?c^~_lTfAy0+ ztjdi^*2(Z}y~+Yk?=JZJ$SszKIe z_IJ-dvOWN&`RUn59)!PkF#CHLM+3$}{O2IPnIAk4v(krf%I|3-zo7L!w#DP1@1L1{ z$5_k%jg!|9kNFfU+Ne_TBA7|F{?9gAAjpAIb$*kDe(dCGZuR-G4~i3uS}0^DC|I zvHdXor(ZmN$5&zN`=1=^lG`EfSB`z>Ea@0uE z=`4p~ad}$MI{7ZBH&WAJ{LH0;|lwfji*_6G*~K)gYY+&E~E)_f4~8# zGt42FUY-5E3TJ=+(=Ybij`dh^N=IG$vDVLg(a1HNU-QVftupPsol(&G$}Zcgr3d4R z+PkBRqLC76)eNbkP(LRcdM8FpX0Uno2Is@a2`-baOx4v!gJ*nbw7Drc(Y z^e*g=2u!qV1qP|`Lih!Pi(wdoLTI#wf4n~Q#~%qn$A!ZXsYlQ*?C<^(j<-WZjgo^6U1jT+f zqz{j~9}WeY0rCJWQaF4Zc#~4Cto~TxCE=yv#Q+AT+Fik*b2r(9;Mp7JZL*;-m*8)I z26Jg#Y@TBVV*{nQRN*015?9r6s8JHAa%x-*hkJ#4hGzmCHVBK(5z+=iB2+C1iNpjb z*>Ea8(DWpz&KSs$elt2UR&mf76-z&i6(1cFUCs{Rm?Rq`j~&RZ2hSGAvybupK|Tfo zCL}=#P-EgWs?VfBwr*GJJ8| z?kI9clRJjovEtT@OKqUoy`6-OkWXN~dp8MK+CYiB-4yOK1@+T$R(rq~{ck(^(!{Q!{?FjaQXg49WAHrhBw*e2O!YP#@VpGM%hq3BO z*s}VJcu{DXHE6s}4gLZQ zoBCit5jxYkpd96x%4}RYenB}ck5+)zW_BstI$J=a3v%M`!s)qx+z#Q*tCH)0c znd@ycH0OG^8&ZL{-Ow!bb|@(Yw#R`IZ?_?pdV7`h7?yg0x8IN|yf>8eE7%VPmU#!1 zv>eN_-1}Tf2O=QB<4prp+dEOS%JY>(^{e(0yGY4OdKfjEy@--%9JhNTmGnK_Ed)Be zv4*t9o2VpQodavVOha1dO*N$T-b^J?nx}fl7-1W{>;QeEno>E<3)*RU2G|H-mwyE z;CujmO>hB#L=#*HppOYI0?^w87X#>Jf-L}gn&1)uVG~>mAi)He0q9|Z%K`W%xB`G@ zf~^2TCfEkRHNlMlf+n~LfMbH&0R&8Nmlq5UEigL!KF}D#;9VSy4*^Iq!NULs7pUQb z4|WOc^yVpPHA;_r#Y(C|X}33DNn}x<^hykAk5_6)PkCjA^t89YkbdWt8`3jgg&{rb zRT|P>Z=oUm-dm(3D$8@;Vk2z7x5SWM@s&_&h21DxHY!YxW4b-~@WNC(A$r@ZsS)s?#Dm1#;O8PTOO>Ul&D8Xj8 zz>r$pGDB*0ml)E?Zk26$aIB%~yd@m?EI`>)o#DkWBvARk2&g*a3K94+pz8c7HqBQ7 zRp%f!z;}V6RAgEhzDE(tXPt>bKL;#_q%9~p&N3z4fKtd=u6|xclINVLBr=Y^Q)Ng! zoLVK3$xCqRmGm1-rI*vFBpMls&UuE^*Ev6IrD1}21r7uv*hhG|=l4s5*tEhgv%m-U z<$=GdcAyHvi#k=GU>@%Wf+SED9|S^i;lqGuMf5|F+_Pzs_5u-{KX|#P6Y=fHFEu%V zi0k*m#5jNQ569gG>^~y6YgP4-T{qAVryQvcvph`N`yDtmVj}|r5jA47piqI~u3Dmx zLm^!c9ts)(gPD4Qq>--GFD{L8t^OnxVZ70Aqz@eG+4n1?n!ve>Kq66dR zT-3+%rd$p_%fqPNuMpk~P70-jJ}d1}bm4M7P>;QKeeW66qsXL(kD*S%XXB(`BUv80 z9uBa6-vFfUaa1!TI+>~&uzXGyHv_6VQ<8jZM0~7es|Yg#6Vw1B^DxOYi5aFzoNSuJ zEYl<&!6xxL$T2Y09f>8R7e)uBv3f?$hG6!zGon;5A5qOn2P)?fZit93!s+?eh;9h37!K0 z=h^Wzo(GU%f)@b5NqAi2MF74D_5pw$MqJ}10Prsk_Jib_;AH?o6Z`>yV}e%z1WfQM z0NVtw0kBN)M*wNQk?rdMhQY~iq#tw}ULi8Qmgo1w=A`KowBr5?EpIw#lEK{{2z=*I zXR6iCQ3H*H9~@=ENcg9tOc)x2z>khHVQ7s4KRFRffP_G>lZ1hAQXL2e)$d>{@czdQ z@)}NeLj!`_REN_Y)}SEY4Uv=_+^)g~;x=z^kne^fD5V5?G?xc2H>8T-)rM3Vyxx!&2Dd4R%Cac&QTbGY1<7@1z?y7s&SB-UB53CFB3t0WqVGPpX zx0UH{4GdO8y$6oRR37SNIfwI5Cn24OIte3qsMB~G&qJNojtP!htx0X7lS$*Ax@MB2 zEHs5ocCsl1CubnvQ5KqZ-9?VF&_`o&N*!gPX-q6|swfWa9m}0s5~%Ge9c8Y`PA+s# zq7V`mIjb$NHzYL@O@QyEjl#cJ9xtNaX^#nb!-K@h4{v4ahfltsMhY0ajVA)2YFTB0 zrK-W`bnAF-Fcy?;pjs{C24g|l1{RcUU_mt)3#!3bPz^@Haxys>th+a77uXd``oTnbU#;I2l zS&nO+RzteZS#MZ}8=Ouh(Rt5SXS0$#_*GtDo3lkpWN~hEt~R8boNY=XTX?f`yOMfh zyjz^@hIFg5LrE#=5O#;NTS@r4h``;>UJk>1t9zaON}?gS-FZVvG@kBr-ZrF%oCAjD z!_Iq#^oVoNkajqKGo+o)=Z5sC^R*#8=6q*JyPO{l3BIJE<|dWwDJN){qNiasO!E!! zEP!Dq*o*6>uM(hv{+!dpke+uEV5;L*ibip#<@JLe4GjW^#&Er}A%P|dcC_=$1d9aP zEpALuW0-`~6V&=f!Wju_43ltHf*QlvkIv=k#aG8d6P*`%UMIkZM{Iz6q(OrN;O;$Y{Q(LPdL3)=E;xAkQ>hk-{=s;xkBwSQ4S2RNcw{V}x|>NBw`P zu6hCemaS$1{)W{L*lHI1h(gd-v!EYD^h0(*Un~m#gw6MDHC(Z&`~-Umg<$*mJ?$#X zdkxB`IvbCxE$@ABBcG!eE`JWBZCRWBU7)X4IR6P%7wX3+Rb8kro;LdN8KWQfs=A=T z^`9F{=}^DFp!)Ha5y1DUeta4IFK3eud~3$?U%_&6zOSi%q`rQANu0k~75D$Cmi#mZ z-mWJ<_4S`y<2naA$bUAb|L%J7<6!pR@3g#kVGu?>1qUy`kSd?-x5XoOsLIm-U8^dO zza#e7Ct6+_cp~G$p~%G)Inh5UoT5Frz$oQyANLbKgZ zgsMZiVjEEy#uYmsg@_I9*#bUQ7i{7bbS&>ofMeLdrK>``E|KjJf|q|371sC9h&k0(Qx3%uEtgC)di9ZwePcw8oLHDPCN;f#)>jm18WQqcc+2l#~&!c>3{9T~p zlK&z#RA|`1ai%v9)K%567%9hNY!813JeEowiJVO7LBgfv3Hq1CD{uwq;*WaAq+AcK z`uI(C;f)}N-j6`|T@usqr*AZI6y}Y2Qgf=ik*p~hnHgD;v5k#unz_Vg%O?CCO>gk!)byI4_S@}mzUf0t0|8)1}@ljRx|Nou2xx+vLvV}zyA|L`n zLJ-;95|V*Tb|#5{ro9ZwgbZYJCINyX6gMnwm0IgwwN@+Cw${4g(z;Y@t8KN5)wZ^1 zYsIRyS~pse-|KzO`^?;VPg48&em~!Te)o~gJ?DAe=Y8I1KX>0))E-TAc6ar6CtZ3p zs;IX;o@jMD;_H(0i{{UpkH6x1MeuHptxI;dY>f3L$ybz&C16LhxxXCRnn_!8rnY8} zwq~QPd0k(;LnV>c>B5MG3+8TG9JSWP&aqmc#_H=z#@BbnS_|TM6s>wyL!`m2t#eDu z8pCIX+(>EdiV)LfYZ^lhZfGTYmxm(_jqGk{ER8gVYge#0R9l|*l-1SLSBDxy3DpAF5Z+}nBYKnyG8{BYtb%>n}p-`>cP+i(kkp*_8(Q5MDK)xLxZ&k%+_F%l zu_4or0phS}pB@LjWqDns#w0@8X}}0C50{lvr_W4@vsqdXE72NDYs(udN~=O{MX0nq zB>O{MErzlh$^^1R<40Xpsi^F9#}c9qP4)G4k*rdzk8tsYYr|@cOc!t}s2m+DQYR8x z)ev^eA|cdEW`>9l7-2=I(QT|ijB*SxnQ=6)KX8!yi=|EAJifY#*Ru~<^w86~$s_^niUHu^8WfdXRerZ`* zsG-4)gjZC^l80IqR?%1^8VEH--S@oTobfjT~u=EsbhS2oty2w6|r z4K}WumT1Ni9(X=w9Ep^!awDrVO(3RM7#Wrk9%Lw|pwjZXdXbkDc4?BxP9(B=kbqP& zgM=&V1_-0^I=i6DD#F#}+I08KaH(5g8p$elEkk;FU6<|z)PqdLmo_$*mQ`ftqzNT$ z(F6ObHxMLZ(PVd5(yD1#;V!SPTje&@Qg6pnB1QDFCFO-dp%ry%JV?t>11D=zQdBG% zU^&#PMN(rm)?AJ5vJj?_kj1{bDyy8GWf8Q_>gqZ@qpVTG6gsz&L~ujoOqTILYCOV= zWJ(*G8axyu90n_tN;)mo=r9y|kkVgXSDUhq(&WC;7%r;{WhA7AX-{mK(K2eGSO}_2 zrQ`s;2Ct&QH`6pN;hq^;zQ!9XGr3i6Ee*bE4Dm=w8yZ$|nR+tX5b@e&NYRt`S zKSVQCu1c$<;fHFXY#Ex0TGN_o7JIBMn#%Nm!!qeLjGBrElo5K=isL`48BpXuCqIB` zYG$dcavSSt-m0#~@=+bbd9tWyA1#BnSC8Wi%DrB)sUe5+>0KseBDb`5jjL8zo`H-- zOps?z_bRQ&aTiuv7?N?ogb@PKz*zfa6%JzI2URg!4SbQOinesf(_rk`xDpUgL@@&hmP>>$#YbQJBKu2u=5lyQ?yrFdwWA_OKXsSPpm;+d1EFVs`|#d zDje0*su@S+R+^waNu(7w2tk}9YV^c|S$x{T1DonsL~x+tA$3?Ug=;;aJW{$mLr(>o zeTYuBq-|1FOv|GN55(|PoavqK@v2c7$88=&3pOl0(rRn#YRkOIs3m7Qn7s4RP#bA7 z^`@-WURm0hnmIGI%*#~hhL_V}1rFCxV^~CF89)Ls3jjhHM&Y@Mnbsx5;K%=rTc zSL5iVsWhVqm38%z(iJtOGEy0qDs*UGi=!}adFc!_HCCX`&eF%0BDu1F>&aT#q^0cp(GMo9*ST&mBwfd9v>!9YAznqfRhKJ<*EFk ziJ%Xb>RdK@b$EhnLMViCk2X(Oed$1XB&7`~)|#yR=mdFoOWUstTeVP{=`gN(TdFry z707_i5l16ji#WYU>&bz$JV3)x;@SDrHB}yNz@UI7Wk!K=5onRY+9R2xn!+FrG8JCO zCoe>SnD7A`L8!4bs{@2q*W=u$%n2wRY)ia6Qdc7xbg5M z!*oWEQw>0`lVk?ac+nCE8XK_W374Vsqb$*=aO$cdREGH{yW=Sdbn-!mIy#(k(Ufsu zEE>(3rID^ewrUj)Mh7l0^y#t+G2PWS$!QU1k8n0$h^bORj@;5n#+;!_Uz)I5 zE%MxOy$GNa|LIJnDjhQhs^1fW?m=^|htRnNVG&w_TI=ZvpBF(`e({kD#-oM-1k|}F zoUK567$}(54B1-Mk{}!NFq9p@<7#$5czJ2Y#8_6>lu^&L;GyGlZ`K>C!u9o;bD}|R z1D&eSB}Z#kNTGe|t1+tZ=&+ktL^VyTnrE4(%pA}LQ zq3c>b-ATNCua{Kz#Te|zYdf5=GHQws>Ci)RE8E-`_5+$LO zt+@Pxi+5e?6=`oxxGmj1{Z^m4@MA^WtuDMD(Au1gTXZc>{kR>muJyg`Rv(NxX}$~F z+tr0SH{QAhzP3bkebVY~Yoii?X!@#Ivb`H+LD7mALa>V@)1mqb8v+-Tk`7WrMv@S{ z`Y~xmlltnLE=?+l-gsw>Q`D7UCAQ#?3QDJCl1gkLL)4Wp)JzXfsl+VGE7xD^7L-rC zHy-V9+oN5r$@b{R7+lGAcU?3YTetwBZXcpVJMh9p6n?AQ9*ef(q9lI>QswH4_lExN>IwRc0NI}u+W?}BJ|Z+A;~ht(PDZSQWi;%(8E znAOq|M^2HIwr;wb1qB|JRP3mY%`PfKr`Hzmh*4fuF=;oI23#cC*4^W_wOaTy;caLN zbomY;sGuIms1TB);zrz-j&5W#8H;UnTl&yQQq7i1+o ziWWf4$Ld3-U;|qD7Q7l0xun`a!6lTDYHa9;cgA}yzC1}4ibjCi>y0JQ*pP#02O38L z*RJ*DOG~GwT30Hm%}Fw}kH!VwyQ(FUuN5yQ?Lzle??6?p5V;%xQct0-?DmjwOM48j zFGchoyv8&JgLDC9k5I|@R_b9US!(uHXEeFdQfhjl{T8^#il8&OUbi;17Ht!hw4oR%YF}^LV%>w#)l?hPRqoB2>K_!`gLc)0V#Gj! zJjRpmI(RYSp@`hAu|&7q)!l`@h3o!mFo6tNh8omEBELPgr6U&YqKv=>)QHX(V(1>B zGl#L03XeJq2HCFOcvoLkT@**9CgZ4ot9vsniXw|$xM2WA?5do!#@b@&2OiSX*%CwR z>_qoYCK06*yXbl~s3+S~c}5SV1Z6c-JNDKv59%sCG8E-OC2R&x-K0`CHl$h=Ygaw6 zyN?FC&IwYtreeS-$_>d)>XEn)Re^r4dVO1WqEq{}#(S(D z3`?y^E4E1uI+V^yKbfC+dR8;F#9Zip}YEq#QRt0!RTGL)l7HBNeQhM&Ap#W0= zZU|9Lv$e0YvmZwH#4y6>;gW6~NezdssAifoDXpIF?hd0KUagOZ|6WYBm;g4qt+5^q zCp1)Xak)KcxxMXbOr*qBXGW=PvD%AC26Im_rr{{8YR8PJ9Ejc5v!49XjvfficaweV zR5;;8jBcJmE9F#-O7eDecW*>lZ=wlBXIqsT=9De{ZfeR=KFnY77B||5J1o>($C1>e z-l^6Js&KV4O?$d&z(>2aTGnGq+Jrt#4Lxafp^sTuboA*#+e~Aww#7(coJmC8PP85x zsnx0_mOxua^I9J_t;%YNqFtdgZgHvUD;w3&qIn|Lm!vV3#n5JGsY5Ft9S#FyiOyJS zJer6j2|cf3UNQ43Wlm*7jVPXSz^j^3pEN01ZeJIsbzR0h!c#NoP%VenJQzw^T|GA& z%^2V@vaF-mKdY)?kK5MQrS6cis3|1TpXqKHS~IychEgBq0Zw_*l8|zOx-t*J3X{fk zLdJ#CRTC!G5u3U#v-C*PaHm3amUT-=COfdc+hUm;ei9gaFdem^h%lPydL>gW62xi( z3#Go^*6z(1uwq!8C1WipuT8NIYs<;=mZ%@R23zk*nkYt=SWLTU^w%z|w>GPVi}vbe z4Z4A~nqu%WUd3i+^=ypws~<{$Jjxv9PzflPNTy*tw1&>a(Xg`V_<0G{sHEu-Jq?U-abkkjC6ijh(t+_5z?pBws!6B`Z z?o3}kqjNL3H3~~b)zLBTQ)y}`id;vR50y|2N>nukGs>ww+6atLak!x%l8U3RV^QtJ z+xlHva2R*0)u{q)XvF0?w+ttd6PtBjRDVeH_0Z~6uUu%5)(bRNhsg#@DOzttJJGpm z3{%SZViJyfN^8jcENI0N2~3w*m8Ps9<56!q-(W?G$jHC!qU zXqrmU%y=4N4$~M%MaGGP3e}NlnLtt$l$kw4b+M?bNMAb8HAf=co~SQSo~iV8n{t;o z)s`vU=_Z#B#j>IY3l^#RXp~6_TQmXSAhw5&%{=pn^6Tl( zj6+FlV^lBLu?Jj-K?N?=@-RAE8)LB^4APshV$=%<)95iCwj^Clr}0*dx|Au^nA9>r zt;T3DbivgT)@E9FAUEw*jprk#19FVAj z!mL6Ea&${98dQRog?dSWx=3t_WBG{@7x%|vJ%o_}qn}>MqWO|S9OTftUQHA&QB+49 zt=OgYhFSp7oJ}h!bg=}L{^mH=7Z_Hss>9)ZtF<2gSY2V6)7st1=OgH-RUNgcqbFXc zVKtEKiEhR%wIr`{=Uqyfl_51BtRa=@)cf_6N>*eo7n5;1T#R;M-I`Rb1cM&3ucu}i zn94fR7cHh3#ifofk-d%a4jiTN$^y*<$NR0__y7Yn!u80G8*OR9Xo`}=vIz@gucWF2 zDsEalnxcmr72B&9crqKb0_8H(D@tTtH?@>vy;^0O>dCx_&8T#>_(6rHSL~_Y>aBLu z$aySK2R*D#)pcC2b?ERL#|FB4aDBJ5>szNWhSD(*6@cmzS<4eNvQ1VNRclUD&lC~G z2f6N^C`zB(ls*thY-#Jj8iNnfdJ{Bos|IC7QM(v)QU!s5xusVf5UVv7jVnCQi0G3W=12m^fjEnVUP}v1995{30$BPf z!)eB1C!HqnWI$Dt_VZ~o?V%Vg?R{Mv(-S%`epQE{6IgWafQp=sB|Fffa9#qpd(T&g z61~V>C(cocCNjIrF8; z0dp=6jj_<}L`UoDMK~>_)oPt{h?9AE%{$V>NuC6q5L2hgXcS5v9_c=mUhLyMQgl;y z9}S&!V2DF#I$5bQM`eJlMLVdz`dvDwi5`bx5I5~BdsTzQ=_s6vqX@{VKG8|1v*cvwkqS;!p*+;m88d)7;iAsPnc_>$`#5$=jaF*Jfig52oDDJ=pmSQf zL&tkNqdnZvRT5aAtNY&Eb!{~6=ov|UHb9-i^7?5oruT>cKY1QSKj?#JWqeyBmhZgD zzDan>kskh;z|YT^m#Pz+!_0)yzJ%FRw6D%Pw&04KuLW)hTI2AHQI6G&r_Fpm-@iu; zr=1TX`1k#9JOuN9_ax2#UF@RHb+OjojwCt}dO$2u6z^*3=xdE(j{|l(Q8!2qyRp1* zldT(zy08@46e~KZaDL&*g$s*t#yHX4-CNX`OzVn96D{p{ItT5(Z_8YY*}N`}33%XV ze*PCywDh@Xe7AxsiOyc56CiodLr8_~7AkZAq}HnFRuI5La2QF|NfG$a3QVS(b*7s+ z)6Mh*RWo!os|T!_^@CN-T$IfilCXS)1_!pF*TWUC)N;hAR!`dv<;NNE7}(>M&lxjp zLcqRvyMK<)IVxcP&8l>U*^4S2+y2(}odNsq?GHG^1NQS)@Gnj$VbcR0U92ItkRyo6~oDr8gLm_cg zV5Kt*`{9B5fc@_IJDo8ByuM-Q2hLQ$(TIL**vUim5dpjH0q58nXVL}E$gq=tv2zRr zEc?UrE1mHH`%At`XVi9QXpJ-Mf`I)F^!NhyExzDi0`^Prz{uaiNT2#MMj7H?;PF}U+tILwPSIOAt1WzS_(bXuKyh>nVNyny{A z>=;_@_+jxF7(cqo$%UC?0%2!rl`}^D5*QYEBw*ipeq{i!qo{;fjgwd5jJ9V~I!7ZE zfBry?GyFow3fSM$d3oOVfIp86|Bu@dgyvZ9&@N-ER`Jjn#I{y(yyr`7%M~}@WJm{| zqBy+(Aag5L94`wH+Z@G*35thE6;Hh}I2Arsar!Dy=60;&{4zdI&;-TR!;BuPzoCRi zox#Xcs^rlX#I{gzysB`3%^pAxiP_Y-2H5PZFMnwv+Zs%NcDYduTfdh(D+N3Krsa$< z+sZBZ00-+XlfgS zguLnC(bW{kGqI`7$m9!o(=v&BF`c@|1NR-;DJzTxmhW+0dgd2OPzj;e_E6Wr2 z_L|2B;X@%uo0K;tL*J;(*COiI^a$ePJ=~;acoT=28YFJYn1b+NuiA|KE$pA+;U+Gj z6Pe5WF7e2dJ)QG4C>Q)K_Sbp1sUt!S9!`2@a3y?J@Gr9de!<^i|Am5ga`}EyaGUuR zg44IHXuC%5EK@!+ncpb*0_L|0UdH@eg4Z+up5S_%#jDN*|A76b{TO?`#d@9*@>`kz zQt;i(Ul9Cy=6@Fab>?phZu;-Lg8!W54+~zw3y1)R8~Z*Zw+X(C`5l6{GQUgk9n4MpHTC#S=06bfPc#3K;2$#oso+z1s()7S2IkKT zehKqG2>vkhR|J2Z`9Z;l^F;A?!B1oUp5UvQ|4Z;q%;^AxHd8)dVjd9uo6PeBe~kHP z!GF(ug5d8lpDZ}NT$Q%zg3n=2A3vkb*coCzPw>sm7Ycqo^HT-i&wQESKV@#lGn4LL znb!(={W4vAuukx4yl^;6@CxQ@1#f5GCitbyI|RRjc|!1CGT$QjyUfoQd^9gPFBJSF z=ARe5hWX`!w=w^!;5(RKFZfrPe_il9nBOk=FPMKvaQ?QGWyW1oU;4XEmi2&;*I!Yx ztVaabA5O8XCk0=}hb+$sem?VG3Vs#y7X-hL`5y)U6?42QJfoez&irqJ59j#^uUOBJ zpUM0K!7G>tcsw@c)6G0j@Xs+HE%@ckCkTEk^T~qW%Y3@vKW2WC;4d;?BKT{}&k+0_ z<{`mH@xr-E@EOck3Vt&4Rf1PB|BT?DW!@tAIn3jNU&Opy@UJoN6a2f(&lUVJ=ARS% zx6CgQ{IATvDEJ}fR|r0w54Eomd@}PJ1wV=Tt%5ISj&EgVw9m7ce^2mk=JyGH8S{q) z{|58N1^+(tp9uaW^Ir)5BJc~bCp z=KX?S%zV4xUuS-i;EyujE%-s^dj$WG`Bj3C=X$?E@FM272p(d-SMal$e^>B6=JyD` zoB4x+-^%<+!EHW2@C(5Yu>5ZXf0z011$Rd4dVE>%Nz7jpd^Yp91V4lMKLuaO{E*=5 zm>&^5!QA2XzUjXgGtU+LI_9GU-^YBs;QN^$EBG_a@g)znnRH)bK1=Yom=_8DG4qoJ z&*zhH^if;djQ$gumkM6Pe1+g$%xeVS&Dm0$0m~R%mhWR$Zivi1^+Vh%LL!c{7S*^V}70BKVg2e;D2ELO~L=o{M&+$ z=aZD*7aSh}QQLmOYncB~@Hq1)1iys&(}I74`E!E*g86R+e}(x=f`7>T&w?M#Cqd2e zw`o^PnZGUM&tm?*;9HshTkxxx`}jE6=>Hb;A%Z{3+#L5C`4^av5%O;`pD1_^pFEx- z_%Y0n7yJz7Cko!oyjbua=8FX1#oU~qF!q0gd6|%Zl6hG0*O}J|ZccJH2|kHWexEIP zG4rV4Rm|55-pjmG@GF@o1^+Jde!(ASzFqL=nO`LM2h4X1K8!D7>=FDJ=2r<`%=`wy z!_03Hd=2xxf+v{cV>oIv^>`ukdj$U)^9KdLllh~9KhFHef}y z3OX8wZU^~~QC{C4JtnVb6h73X&vpLaAo z&gC{&@B=KrRPe`-(+N}v{vz`;1wTAj%eM+{7iyjmd>C_cp4Hfy&-_b5z62lSpzV6W zr?UJ$!51^XU-0UwTF;Y$*RuSt1;6e@E&qz(Ygzsuf+v}OBKYT+^9RdQ#}{8@el(vq zHRW(4^O=I*!F-|McQV&sy-y#%{E)f+Y<8MI&wQ=W^A__i!N(QpayU=$Im|yV_#)<4 z3%-o`ZGuOb-z~Vy{4v4f%%2s!pZOmJzmWOcf?vzr;`6em{P!^*CHOJmwDy-o$#I5j@8HCBgfc z|6TBlm>&`RtIS98`CU`~cQHRs@cWq07yKv8%LIRod86Q;Fpmj7wpf?XCc#f+eu?14 z%&!)F3G=;zhnYVh_&VlK3tm54+w%v(`&s@i!FMzNMDXjGAI0Z`O*wy$`LTlE&-_He zpJcv7@E4h{5ZtV1ngstN%hRU;XfyWwo%uO}`*{A^F8EQ*zbN<==GO^6jrm@|momRk z@N(u)2p(bnE5TjnuLy4D**67$h3DTxg8QfFatVykds9B0%*P7;27mZyvf!_={u2cc z@_cH}>l^*~%tJ!{IOY+-+nKw9Z(-gc_(jb71;38@#e(0${0hO_IKMXu-ogAkf?vS= zA;GU;{!_tkVg7>P_b~sf;6G;mp5QMs4<40Sj~}Qn&*2_C!T-kfHAQf z;2$wxF8Cx)w?Xh;=25}F$h=$dtC?>T{5s~l1^+JdYXmpPLEjYo9+tmH@W+`yF8FiI zpA-CT=6@2rocX(g4`=>~;5p1kjm)gaHs(hQejM`?1fR)#f#AlTQo+}&{+3G*SNGV9A6N9gZBr{|q8%TE*X^~{?E|045t!PjtqH`kF&`P4E$U&!xcJ?8q7 zk$;%^)k6Mc)?=?h^8*z5P&d)2^NoJjD9{DEPP8o_`2FjpYvs{us*#MrW4) zZ<&t~{3YfEg8NzjT)~GhUn=-;<|_m@A3d>zKr z%Sh(K1vm9FQ}8uBzZVN`=JC@7H}iOv;AS3QEx4J-V}hG`JRx|1?b$B)Fy>znd<64r z1fRtGHo=RSe_!w=%pVcFn)%NKzk|<9ydbz)N4+X|59@hX@GZ=b2!1j1JU+2w>i0V4 z<~p0=H|Mb(eEqJ&Fw59KbrY^!KX3r6?_i!&k24K^UDNZ z#QX-qL(IP=_-C2#7rce}j|Jbv{5OJsk@;T*zk>OPg5SbC$k)wGx!uKlqToMbK3nkT zn4co}ADLGR{xikL2@v?Sh;6v`_E} zEWcCm8O$#eyomYrf=`;J?cXPOKlA$qr>{WL_N3r{;p6>Z3vQpN`DZ7e@i@Vl8W6#NC3;qwTug3(Bu>7-vw=w^t;7R6h3VtE;e+hmK^B`YeHT88b z^KpXznE45U-^A@|vEaXC`LN)BW`367?=s&gxWoPTJi*5?|GeO{nO`mVLgu##Ud8-w z!Phc>Ozl$kXU&H!41>eAYtKeomd5Pc&mj8<27c;+E@T-}BNAPbje^BsmGk;3( zXPEy+@aLJoBKWJ!-xmCR<{t}wi1|@`UE0)Ri1~QI&GFha!56Z8k>IB>uNM3v=8b~W zXN76|jNs;c%Lc(`u>5Ah=>x{JT_|`l^F4wuW&Sn6%b1(%|E7E@ncpwuBg~%={4D0b z6g( z{VbiXIiGFHVH5Me3;Bzfe=K+z>mSDFhm4-5S$=}xzhyo{a5FD25d1ZkUncm6%59M~)A$UIXt%9Gxe3#&-GXJXJ=K9Vz1YgbacL|zUq zC(Hj+@E6h8lCxXpZ~;O6|8IlpM+P5)XZ8onIAv66-P7XN;Z2%Adz6}*DwUl!b9K8}xHO}Z|R8^;RX$ozQ0 zZ)QEkg70O1n&77V!-AXh)lGu`iuFVV-#0_oi@APi?ElwH&HIIXfbG9XaQ6f)zen(6 zSpEjV7ck!|_>*kUJ%X3B{G)&># zS@7pr|M7zVfcad(A7edB1RullA;FJfzEben%s(UeBIa?yOPTixUdeo?;0??#6WnEf zz2F;|?-jg{`MrW)#Qbr=uVel+ty@Q;((}jS~E)TrbB8Zu-$I z!A(CpS@65LJ(mh@`e}{e_p|&O!T-)YCirY_|K|v9`lC5-XY#v|hHP(NI;HKWs5_~r6i3&c6xj8O3_P@>gHw*cXm|rNkpY`k! zJdgQd!N0=XoS!i1?qZ(D^SR*_%qIwL@_Ult=drvwzBGC|nVaKF!|R#X3q5O?e@5^Y z=KBPHnfdnwe~!61&NJ!$koglr-po_a3qG0K^Gkvs#oVlCjec_<)H^~xhvoge-ZAp; zvpu5)Z(#X}f|oNtPVo86=L)`*`4Yj;V7^xHbD5j-PUg^6zZyhb+1yO8OFVb;KL)f;28G~zAc_&SM>q0P`AahZ#1t1#K$ zN&D%og-hsXG5su}pM~^uGW{&Drf(@ciCo3=$%!90i`6d@)MWyF#f6&9BOz14rlS52 z_d&D|uF4Dz&)%cG8@U~uK;gBh{SgZo0p6Dgzwzc62k&Wk{7>;sKQhr|e45@RBiWnQ z>lkbGPCbT5`8561^taQ%D1C1JENxjIaYl!vh;}ee(SEoFvfn5)>6i%8)|NryPhf*g zKOZdqXAvNED%o}&qkel#!1^lt$popLz& zJg0w|Xc#7avu_$C{=~Hiz;>qIrG8C3v;QGNj5{R+NB3Hht5Rd#&w-RKT?&-(>FaKD@jbV~mcs6$f`Wp1_&1w&>)(Y77ASnu zyoHMwE7#g#+e6jM{l0XLeAayfmc@Z?Z43RDC})XP0Lde^{oLVmhwMF6W*z#-9lG~} zRm1kaSC_l@@Z-Kcu=DbuujCNkzq9Xs+qds#|Bf${|2^A3`}PZ_d}K{1IRsT-x#_5n z?pu3w$sxS&XU{9stUZtWcSM3YC5M8;5$-$V`GdAKyTsZNd1{1p@l`IMRhRzO> zu2bMYL;H6Pw@&`>gpz*f>_6fUZuB9pvT0JuezNhAypQhtFwa^ral@sNuby9W1=j3) zmXzF-AQ=j8$A0YwE0u?#PRXIiogI+_c5vS;iR{z1elK%GZSpB4b?PTi^^4Q;gm(~9|Y&tllWPf~WaMtV7;GR}? ze|+lDSqI0L>~D`)``h=G^uOLv(m%yFc4PcrtN&)d)p+Ap-#P6=I8R*8f40Z%%PMCd z?6cWE-?%r9v#rJh$m`2?{=O+27cN$|IMxC@gS~Qdj2y(%bNzlKzeNYTHr1 zyMw-A_|M(#+i&fmIH<#YH<9iSj@*mBGPVHafMz{*E%rmvPHw-z{b&~22K}Gm3%+q2 zY<;h;3hk+K??-MJ?W^R_;d58)MSI)xi0wYV1M%KHa%B8X*#86jN1*%f*dKuZP3$fB z|Asx4Wwch;;aXd?Gkbt`MmGNYh;C>7sGolyX>3P)%H!X-ZjirRJEgvc zMZ(>>?^%0Zw-@ef51{S%hwdJ_t>lU+hyCvy9KR#7_iR`*(>PV-vm?bAAOYKto`K3eeJNB z+98e^l+6^6!VaJN1GGEe-ov)FXRM{i>|K;U*t;WTFX}3<>?3b|QTC#o~UlT^+J66 z25bNJ`PQNBpA6f(J)&(we^YJTTR#{m$KHrC=^Ja^-A?+Cx86C3wiQO-pXCcaJq)_f zfPGk7@40X1rPr4Fg1ZmEM$^5n&U4oWluIt^pc>FYk?Ym=p2r z>D@F3sJWNs1D_rvvtIr0=z6^-Rj)VwOOM%`P&ebL%ur8MUoWFQQe6f|TBD{MYn=l-8p9_% zb@Wfre&VpDeP_vjyf6ObgO;@bewE%Vw4EdVp>NE>*mE<+|J#?%e45HV-bLfpl-bDh z?sk*`)d{s7hN*2mDw0~s6N-h4f&_TD92&GF}so8(^TH~?A=^7jDmD)|dYO|CU=?VJs zJ!$3degXZQIN5h_h@NN7T#Mx&=GqYYVmbO`8T#fjjGLtxH+^c{r1C4o`m)F>+z?IR zcQgH}ZwiAJsE>yCb=nLir#E(x7!)N3T#>bai3-sqa3p%5{_&!4~)#&^KYBtRVeiW{4Hw+f!ZmK5D_{Xn(=X z<6CD9vx@O$8k~IjKieD;?bG~Ib_aC~oRIkV$dMz5@&AeVCuTOG-a3_m&#E`hwHR+` z^I0uh*jYlSJ2cXc^zUGb=dg&+T4|iEDaA44GzsKb|MacA(fHEI#nK6B*I>!ff{-?! z6*10qK3cOC^C69nM88sTH3xO@-fvxIVGvT=4&M8$)p?lgXrqCbHWE9P-4(ot*i-EM zwMXm^?0(N9#wGM?-jlXJup6Vc+MrE4(!Yb*ZZe6=O$%$6jPfiCyvci?wca>UrfRdT zOSa#*gRQ{$p*F~ANBUQ)ro&3w=A`qfLHbulF(LEVfeaYuohf8;XN0q=&;-m(MOkT_ zt5deLb+9v?qc#)K><2TiJf%2doXsi4>$4SqYEhX4OHzs(j5BR}dR}ztO}sduicF4luEO)~EJ?IUHp%@BfRTz@%!nyvU#OUo!WrH0wWI2Wfnc3V9=??|J&**P-R zcG}F_+DE4H)i!~h=cSQJ(d-Ay>daJD&0R*;mK4ILiuJZ5g&Hnr=L;!|Vh7k+pGrPv zEZLDp951z#7X9y3p=rVsQf0W_lwsQ9^~PdTmjA_U^J_NT3=`;VMzNWM|BGIX!&0@S z&0AxftJ4^zV{G2=8t4#u#VrgC_nV~yP5yRn{q>0zv)f~zWB zi>r;()TYn+)Cu7$Y>X)zT4|Uu(~Nq=jJtyk!Ro_Q#(RuN%(zVp_gQOF4Tv4G9c|(0 zKT2t?H`V=S8c8j_QNH6xjB)G{Bgan~G0NA3lLr0;mOUao=8TC;b5C*n6L1Z3jL#mC zn@e7t5Ff5W$+I}uvYex=@EBZT%=d-IoG=mBu^iFC#p`#3)jwq++=0bef3>BP9 zmpky7Cd(jTxDN^}Ys7J2i{L+s;^gL@4(CX14|L^{HKTGMsjNZR=$Q~Z2HM6DWh=qQ zj`8I>6a!xbOBtL?29F!>Gm*!8LXfiwX>V@s@Z7xI#efr`h;ojYN2iJbo=Ibn@Tth~ zG5J2q_pya2Bg*ax6T@S0!oix1&nYTE*_y(kxhAxLLvtzgILaWUL7u6FsFKlvk_lHW zo2V(pIRi;db1eV(wBU3c$4^LmkB8S2I^$Sh@fcFHI(JR(D%f)Z#il3uXTmXo9J3tj zn4`!s+p%bO;sUjsGmH%%g(f}sSTL^|ToBi>@e+(wh(ig?yL6{dAza{t(|5(P38Z2E z=Yjnb_AEoyo#ZW~QzufU7Rcu{_y@QhwFTO5nAx^bh4x zg|FbR^_`rrl-!D7-@<&Y@kSWrTb3VGAvALM%JWAm4;{<+R^(4edn)q_lxI9r@zv(f zRGu0VTbaMwa_A&M;79lwLTt#TsUP+6sNk~*q0LvA@B9XPW!*gAvD&Dmq-HW3rF0gs zQL89qDjP*3wQo8br93m(D7q8DH0(Wk( z6;9fGujYN1-0+ee-l_QrY|PF7F&liz55x=LhwN4}(L{m@KP>Vr@t_k>TA&*Dz}s#TZ4I z&#^m3leGReVvcg_SC|BqdzkvoQ@Xt;9gd>y6SI^9v$ z7}GLxeEQA$-XwKmTD6X#vt6Q8?9ie+w0S$U@D44VYdKU6dH>>`>%UmHJAYoDs!3E? z%ozpe*dCwVkWUq(dQzkQ<|MTr`^MOKT>U4I6emRA5hx3$-a#xN_yQ{{g-PIG6`)w4KU2{y@ zU5jA^o8ol^X?OipE3XknL7Sr=9PM$=RN)RX<*d@SOeObfZA&4!*XZ<>%-K3kCDW{R zE1A#CRC-ED-qkg*oZM@54b+o+U5S$U9JyO6l)I1It@X-Hh3T}dR&J%UeQnwu$Csan zK{z-LKeXjs?hBd$A?FfbFx4P0^#zw2na}%l`w2QUWI0vf>bb)_^ICOhrLz_=Kz0mK zKa{f}^kW5AAr5Uh*ZA_jKm?l;arVG@j25OC)^Hjv)F>3RhEs(px8K8eSb4^zfPOH} z_h3F{*EgAT!b2_BxM={??uYVe95ik<9O4=aYWwR{x4r^6;U+VWQ_gSvjrxri*+-W6 z3gEZweQA+9l*m-Vw9#2fUnjZjyU3tv0@zRLu@sjX#|7AfXd(ScqsmH5$ z6!mVhH0`~YWM@3X1xQi_B=un61ai}h&S(0%>HX!i#vLZ18N)m`RZ#-=(}CIJz)r-4 z>w$uw88nzWo&B?1Z|u1qeHhj*RW8Fj#LHW={vRUmS7*1$oUbRA$f3 z(tKb@Mpjg6uO2hgxhy#Cm>VfWh1!{&EhYNbd?h+LEjsx|B|6tzKuYxWaoMT=Eq_Lq zMQ==0D#zYPIaaBUy;0>mTlCFIN_0Y6bi!bwZ;ex;v(uup2NV7K1SOi67R_VPtUSG~ zOR6B9{Q{l+qAbyozTA25;i{k6ihZk%bH1;^w|u@Yf~Gp(x6*$Z*2r`WWVU(cy}bmA zeQOLyH2=uL%y^li-W2>7TbZI6Nq9ZNvf9C;StpS#zKil{#WaN0jziSiN#kt;Arh5fu$$Y?S{O~_to1YaSkA(dg}cbqFNjLm*uFI6SS7r(-4u0 zveJJE!t4DPpiNbKlw~QgmU@E`#aFEB-CF8;;*k*-9Drq;G9Vga&j1<*LK#h4H=rTU z45h(;2+cq0h{QUDGT=Krglb=rQ?;ZM^ed#^wCm71K{Yk!uwI)JPRCKMbaSCozT8}1 zRrQr_4zK#C&86$}HC4YE^+ji3?KgdXHL$8W%PN-(58wbX-K*0nQ(T|Af6jj2_Y4YFWrda&ZSGENENYJ?I=j32yOSZh+O8DHOpJ0!gEA>u+CDej1_PvQ;?k5C^ZPnu8Ro0Bf`<|-NZJG+r=yfc;#X!STD z(1L8^`eJu7W+h{>jc!X{!efcofbKRjAQ6kUrqfojDe=V!+MI~@B7boUhM7c?E^ZIO zwe~wM{k4LJ_y2u{5GG z8Ln*%MQV{t6{)nbF%n+Z)EH`D?SqCzLe*~F^5qR7q)=Ce_!S`(YlNbeha;h~#=6Lw zRNA3*MQ|hw6<8ih*+bqkSWCs7j_xs-1Yo*LGT~5z+gK59fMi3J2pCwAF4v4CJa(KF zuBZCUC@ol*m5XZElj*WL6kIKe(B#}?wt7{AyZkIS6hR?}LRGN19P!HPa4&)%p1)U)=*j-Zd~IHGzCb>4#X+Vfq1qi)yf*{>QJ?{E4)!ufYh&GmU3M_ zZnknRIaNAd-3?`>wOO#X4t=h!sW!v#v#P_(+%U55jjl@6)QYF1RVAdmlT}?^O_ihe zt4bra%7J9UWg+DZ*DkM9j`Gm5CS)Gs^`(&pG;MNnD_2TZBYmK<>M%6~a#o{n*OsAD z;BGQe%3yw@8p%4k*Sj6DO|cHoxSMS6PV`zd_!Te2=%+^AR=T%M55TP$$P#Lx?}~QD zTs*P}>6Szbh7P*n%}vI)#xRhk-Q8_%^iU*?gDM6M^%x-&QL8i7+uq%(LR`qhlCJdl zN(s_4oxPZC)V+3UT*a_!E$hc{Oh0W_bQ5m9Bi0wjl+@eZ8&$sS*`}`=vyj%%-PgUph|nUMmsw2nB}JKcxw-mB#+yM99mo35;05+_|g9Ep6EG! zF^i^cJtsz6J7Nh;EoyQ`8A2iEnNByEa-z(TSXVEXV{A*0%VkGXXP<>)Lb)Xt8wW}` zv97PpLX<>53at;>ZjG5c4XtQvtGk{`j?_l+>?kHZJ#!{q!o8Tow#Kj{x(O4Xnw`|# z7wuHaNcs9$uiIC=(CWe6ILeJwGa{%NHP)r4+>{zcsj7`^Z>*yu&JKbbUR5T&AWXVWy02|UP1aD!fVxcB$ z#jQk-MfvQB_O@G_)Gt~AT8Lh=bXx0BP4m@nv85Y49@a&Z#3OlvZ=zvGrH@zmjuh;H$x_hFzU^ z&B(8f#!IJXQaJu;Q+K;%$&I*POX8$0WIB{2Zd9gyb>6WBr1NWm8|XYE9Zh_JI5s+x zqK)+5L=J4~Zk}xY*Bbp7KuM1E77i|aKHtAb45uAD7J>h(74u;0?e2CgNRzD_i@Kt{ z@lCO!lW>>r$%PAxu&hmVclQ?cB@;#Qu9l9z)>u(AnrLaqA{kF<_idR=F`L)Ldy|8y z_AI?WeJMYflK+8ygB${&!n}tMh3!|OJ zAYeanex?1OuQFig?sUcmDxL8=o#QK=nLC{YmCmA_P~qeU?6o_cW8p#^giY7%>`KFC zR5}a6a0dSTO6TZ+eH$fBl2b2r7TL|@nO+G2f1oyC?}N;ofc;zFyUs+gDS>Kde1)>` zwOM50PMAkVC?kgi?CZ{ik>7-oFGB00fZepy8Dh^zI`;CNPO<%{1!sj_TIr0jAAx&v zm2(W#!ipbmuXM)RkAp3;LzMiOfPE@?%E>b^V4qH&WtGl26>(GzRNjL)L+q!OPG?AU zjWhfrX9!6@;7mbC*=w!Nj&Ii|{)ibN}%q6o#b-`KV@U|;Qj7YZ%=;I>L< zLcso-9|pg&ZKppEV?$=U`Kcd`W0;)>BLeo`Z9DDX`YW-2z!@E|pYfv_>|E5}1+@qvrrd?4_kV^=v=z`h(d*!Dk= z1q<#6P}RdwRwq)Cp@L9V)FADb8mUp*0sA!w`t1)aC`9C2&QoQEM~&`qrrTF;5B>%D zp{P~PNIU-lC*SU%<^?qi>=8%-@eyNzeT`k|%njHhE1l!%XOZ25v=9;1epID1tkyZ^ zA!l5e3a`LE^8pov#$B}2DcI%Y*{`EQ$J$q^W=!t}$@ebn*iB>rh5To{wZ;hAzPUCy>gWy7W+TNc8E|s;2za{*hTa@vN>hY}gpb z|ByeJ75E7Pk00hgb*z(D;~c-j3Dnp>M)S&3ou_!YGmf$ls8uCDE3n*|scM0u|VMS&cxsnXF`=T4tlw;0``x#z3b!#?4RdU)}o?nFZNuX50sYMtN;XG{(M=0G41%_&&z+~zX%03%6@*v1FFIC$O04BpaQNu7xfgdA3;Mm^)x_1p5g{jzHI>0Ly*=<%i+&t{im#pP&1HGcsWR9RkADHa;$fb$Uu4+4|nfLY;9HCtc23Rbc+UV;!6W|=?7rU zsx2M7M#UTmi;ew6ljewQfj zId{xq3ltyak<`v>6{kgL=C(s|tPaH1r?}@@5r=P3T-}k75yMs7bN!M-zex*6ebbU6 zMq&ZDANNR^O|50&xf}m}TCMPAp8oiwk~gt=9SfOe{QLEdTq=gQrul{{)|B4a9{p*G z>nk36GI@4>Dcn|XEAdKdw{2zDua?iQN6oYAQSx-)zrd1@g8@oj_fCkNqBKcF5u?xSrH1ZHTb`YmAhV!=z8PXaGwH|_r7 z;YA*vLkVLe`FYx@e$CC5lAAl^iK}a@9A~;32eclq{&MEhesgcTwEy-&^b~N_Qo3IK zr+WDD9{c~NK*EKKkOF}#Fj63wZ^L4irG!O)$ArcMkgT}uV^DZUT%)r zDPO6pw2*s7N$c`7HW2!Qhf^Cio2g%8zqx|@CJPw*4gZKarK_%8vwtl7v>81G%7^nA z%#9wyr!$v&=6Lul)ie6Jr9M1oW{XZA{3HCoP_4N{8`CP$2WWH2zQ!f>Q8$0R*Kbie!^Pa{B@A_ezkT>hd3j`0b z|5CwMv;Q)|^?4l2x>E2x?7vR%Z?Yfn1XP!VUiw^KT1z^LCW)3;s6y_X~~- z32OVH;O4>QCj>8K`KJXp^W}4bpT+XO6?_x(mjwSZ^FIszZRW2F{wQ;kKT|%xVgA05 z{|obf3+|Ztn8S^p$;^icK9~7$!B;RJBlu^SPZT`Ke2Uy3w?&T9*HYkUx|8KEYk)cM86N`MrWC znLi}>Hs+5BzKi)&f?vV>7lL2M{CUA|WB!uhcQH5p&y>T1%<&FQwHf|r=KmJ_*USUl zevSMcyj~nH_?s+0P4Is*FB1F{=BEhW#p_zrzfHPToUU2t8@`6QEA+H8?-qOm^K%7H zGT$ZmHs)Uud?)jp1^*KB?+Jbl^CtyAoAdje;C|*W2|kMX>w=GG{=VSqVKmgZkNck~ zH}lxpaKU%-dSIg93t0d0f|oKc7JLQs(*&<&UMsjcZfO#H5trL%1mDDZ;(}kwyif3} zn14?2`!+jGy{1-f&UJoZdrXKJ1aFREVshjb@4;8!yr?Kyu%_L%dPCkS3n#$%f=c&o6LVO~~KL@^^W70p!+jeckKf)ZWbb>c>2sv?|=d3;wzZAQ;x?X^aGxc7Qc0drH%k8^(Kcz6MHn05I) z5BKKxbipTcf2m?l_8h~u&~A;8f05ITd3XWjT6w)2_i%5zeI8Eo53_u~hm*WncU|P+ zBu}qcq3u!+Cwa53yVAo8z;9>yYdoCf&HC_G4=4GhJWuWQaFRFU*gYOj@;g|5zlW2& zneU(QaFRFk+D|;3{&^#RKNnw$ zzsa1{q`0xi9E*`Xv~Drub^#|~_*%ASrreQ_y~)G9^T_RjH?sdu5BHA4_X|Fj z{f~IKcl>-xaP{07n2~Xie{X)vS)RBzUp*e~wcnHj$$RbmhDY9{MaZlRsD8caF5q>U zsdtWU{g~%5;@))4JVV@@?qVL-iF?zIzvs!yntg#-|_`m&q z*>MvG!bO{pCLdp zlHFCNW6*taw9!3xl+Pe}u$eLBJ8%z_{thk_GY+dr_>pPt9e|PSBjxmqbXX6iPeYPS zzYvKJlzxy4)Qsz-i#C})-FG4x$-S_Ge$)4YQ~I>Dl#itM7Nu4Actk5w&BIVe~ep>oT`!7QKBoXhulki$Id7ZeAJf4l!sW^l$ z#Xm8wCPHd^f#a`bzuB4ejsHS82D0DWKy^C{lKpf@W#XImr(XRGF1ndTuPCRD&CnkF z8v70SF#s_czntS|%w>?vvX#rv=rjAZ9RDd{fJ~q6yUEfCCAU{Nou(Wy=sWQ2HesbR2Wup3@w3sU*f zde6i+{jZwSXR*}oADsRrCIW|$t=^69#~Ud9rv^x$?t?b!O!{FIPS Publication 197: Advanced Encryption Standard and + * ISO/IEC 18033-2:2006: Information technology -- Security + * techniques -- Encryption algorithms -- Part 2: Asymmetric + * ciphers. + * + * The AES-XTS block mode is standardized by NIST SP 800-38E + * + * and described in detail by IEEE P1619 + * . + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_AES_H +#define MBEDTLS_AES_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif +#include "mbedtls/platform_util.h" + +#include +#include + +/* padlock.c and aesni.c rely on these values! */ +#define MBEDTLS_AES_ENCRYPT 1 /**< AES encryption. */ +#define MBEDTLS_AES_DECRYPT 0 /**< AES decryption. */ + +/* Error codes in range 0x0020-0x0022 */ +/** Invalid key length. */ +#define MBEDTLS_ERR_AES_INVALID_KEY_LENGTH -0x0020 +/** Invalid data input length. */ +#define MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH -0x0022 + +/* Error codes in range 0x0021-0x0025 */ +/** Invalid input data. */ +#define MBEDTLS_ERR_AES_BAD_INPUT_DATA -0x0021 + +/* MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE is deprecated and should not be used. */ +/** Feature not available. For example, an unsupported AES key size. */ +#define MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE -0x0023 + +/* MBEDTLS_ERR_AES_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** AES hardware accelerator failed. */ +#define MBEDTLS_ERR_AES_HW_ACCEL_FAILED -0x0025 + +#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \ + !defined(inline) && !defined(__cplusplus) +#define inline __inline +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_AES_ALT) +// Regular implementation +// + +/** + * \brief The AES context-type definition. + */ +typedef struct mbedtls_aes_context +{ + int nr; /*!< The number of rounds. */ + uint32_t *rk; /*!< AES round keys. */ + uint32_t buf[68]; /*!< Unaligned data buffer. This buffer can + hold 32 extra Bytes, which can be used for + one of the following purposes: +

*/ +} +mbedtls_aes_context; + +#if defined(MBEDTLS_CIPHER_MODE_XTS) +/** + * \brief The AES XTS context-type definition. + */ +typedef struct mbedtls_aes_xts_context +{ + mbedtls_aes_context crypt; /*!< The AES context to use for AES block + encryption or decryption. */ + mbedtls_aes_context tweak; /*!< The AES context used for tweak + computation. */ +} mbedtls_aes_xts_context; +#endif /* MBEDTLS_CIPHER_MODE_XTS */ + +#else /* MBEDTLS_AES_ALT */ +#include "aes_alt.h" +#endif /* MBEDTLS_AES_ALT */ + +/** + * \brief This function initializes the specified AES context. + * + * It must be the first API called before using + * the context. + * + * \param ctx The AES context to initialize. This must not be \c NULL. + */ +void mbedtls_aes_init( mbedtls_aes_context *ctx ); + +/** + * \brief This function releases and clears the specified AES context. + * + * \param ctx The AES context to clear. + * If this is \c NULL, this function does nothing. + * Otherwise, the context must have been at least initialized. + */ +void mbedtls_aes_free( mbedtls_aes_context *ctx ); + +#if defined(MBEDTLS_CIPHER_MODE_XTS) +/** + * \brief This function initializes the specified AES XTS context. + * + * It must be the first API called before using + * the context. + * + * \param ctx The AES XTS context to initialize. This must not be \c NULL. + */ +void mbedtls_aes_xts_init( mbedtls_aes_xts_context *ctx ); + +/** + * \brief This function releases and clears the specified AES XTS context. + * + * \param ctx The AES XTS context to clear. + * If this is \c NULL, this function does nothing. + * Otherwise, the context must have been at least initialized. + */ +void mbedtls_aes_xts_free( mbedtls_aes_xts_context *ctx ); +#endif /* MBEDTLS_CIPHER_MODE_XTS */ + +/** + * \brief This function sets the encryption key. + * + * \param ctx The AES context to which the key should be bound. + * It must be initialized. + * \param key The encryption key. + * This must be a readable buffer of size \p keybits bits. + * \param keybits The size of data passed in bits. Valid options are: + *
  • 128 bits
    • + *
  • 192 bits
    • + *
  • 256 bits
+ * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_setkey_enc( mbedtls_aes_context *ctx, const unsigned char *key, + unsigned int keybits ); + +/** + * \brief This function sets the decryption key. + * + * \param ctx The AES context to which the key should be bound. + * It must be initialized. + * \param key The decryption key. + * This must be a readable buffer of size \p keybits bits. + * \param keybits The size of data passed. Valid options are: + *
  • 128 bits
    • + *
  • 192 bits
    • + *
  • 256 bits
+ * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_setkey_dec( mbedtls_aes_context *ctx, const unsigned char *key, + unsigned int keybits ); + +#if defined(MBEDTLS_CIPHER_MODE_XTS) +/** + * \brief This function prepares an XTS context for encryption and + * sets the encryption key. + * + * \param ctx The AES XTS context to which the key should be bound. + * It must be initialized. + * \param key The encryption key. This is comprised of the XTS key1 + * concatenated with the XTS key2. + * This must be a readable buffer of size \p keybits bits. + * \param keybits The size of \p key passed in bits. Valid options are: + *
  • 256 bits (each of key1 and key2 is a 128-bit key)
    • + *
  • 512 bits (each of key1 and key2 is a 256-bit key)
+ * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_xts_setkey_enc( mbedtls_aes_xts_context *ctx, + const unsigned char *key, + unsigned int keybits ); + +/** + * \brief This function prepares an XTS context for decryption and + * sets the decryption key. + * + * \param ctx The AES XTS context to which the key should be bound. + * It must be initialized. + * \param key The decryption key. This is comprised of the XTS key1 + * concatenated with the XTS key2. + * This must be a readable buffer of size \p keybits bits. + * \param keybits The size of \p key passed in bits. Valid options are: + *
  • 256 bits (each of key1 and key2 is a 128-bit key)
    • + *
  • 512 bits (each of key1 and key2 is a 256-bit key)
+ * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_KEY_LENGTH on failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_xts_setkey_dec( mbedtls_aes_xts_context *ctx, + const unsigned char *key, + unsigned int keybits ); +#endif /* MBEDTLS_CIPHER_MODE_XTS */ + +/** + * \brief This function performs an AES single-block encryption or + * decryption operation. + * + * It performs the operation defined in the \p mode parameter + * (encrypt or decrypt), on the input data buffer defined in + * the \p input parameter. + * + * mbedtls_aes_init(), and either mbedtls_aes_setkey_enc() or + * mbedtls_aes_setkey_dec() must be called before the first + * call to this API with the same context. + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param mode The AES operation: #MBEDTLS_AES_ENCRYPT or + * #MBEDTLS_AES_DECRYPT. + * \param input The buffer holding the input data. + * It must be readable and at least \c 16 Bytes long. + * \param output The buffer where the output data will be written. + * It must be writeable and at least \c 16 Bytes long. + + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_ecb( mbedtls_aes_context *ctx, + int mode, + const unsigned char input[16], + unsigned char output[16] ); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief This function performs an AES-CBC encryption or decryption operation + * on full blocks. + * + * It performs the operation defined in the \p mode + * parameter (encrypt/decrypt), on the input data buffer defined in + * the \p input parameter. + * + * It can be called as many times as needed, until all the input + * data is processed. mbedtls_aes_init(), and either + * mbedtls_aes_setkey_enc() or mbedtls_aes_setkey_dec() must be called + * before the first call to this API with the same context. + * + * \note This function operates on full blocks, that is, the input size + * must be a multiple of the AES block size of \c 16 Bytes. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the same function again on the next + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If you need to retain the contents of the IV, you should + * either save it manually or use the cipher module instead. + * + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param mode The AES operation: #MBEDTLS_AES_ENCRYPT or + * #MBEDTLS_AES_DECRYPT. + * \param length The length of the input data in Bytes. This must be a + * multiple of the block size (\c 16 Bytes). + * \param iv Initialization vector (updated after use). + * It must be a readable and writeable buffer of \c 16 Bytes. + * \param input The buffer holding the input data. + * It must be readable and of size \p length Bytes. + * \param output The buffer holding the output data. + * It must be writeable and of size \p length Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH + * on failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_cbc( mbedtls_aes_context *ctx, + int mode, + size_t length, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +#if defined(MBEDTLS_CIPHER_MODE_XTS) +/** + * \brief This function performs an AES-XTS encryption or decryption + * operation for an entire XTS data unit. + * + * AES-XTS encrypts or decrypts blocks based on their location as + * defined by a data unit number. The data unit number must be + * provided by \p data_unit. + * + * NIST SP 800-38E limits the maximum size of a data unit to 2^20 + * AES blocks. If the data unit is larger than this, this function + * returns #MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH. + * + * \param ctx The AES XTS context to use for AES XTS operations. + * It must be initialized and bound to a key. + * \param mode The AES operation: #MBEDTLS_AES_ENCRYPT or + * #MBEDTLS_AES_DECRYPT. + * \param length The length of a data unit in Bytes. This can be any + * length between 16 bytes and 2^24 bytes inclusive + * (between 1 and 2^20 block cipher blocks). + * \param data_unit The address of the data unit encoded as an array of 16 + * bytes in little-endian format. For disk encryption, this + * is typically the index of the block device sector that + * contains the data. + * \param input The buffer holding the input data (which is an entire + * data unit). This function reads \p length Bytes from \p + * input. + * \param output The buffer holding the output data (which is an entire + * data unit). This function writes \p length Bytes to \p + * output. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH if \p length is + * smaller than an AES block in size (16 Bytes) or if \p + * length is larger than 2^20 blocks (16 MiB). + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_xts( mbedtls_aes_xts_context *ctx, + int mode, + size_t length, + const unsigned char data_unit[16], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_XTS */ + +#if defined(MBEDTLS_CIPHER_MODE_CFB) +/** + * \brief This function performs an AES-CFB128 encryption or decryption + * operation. + * + * It performs the operation defined in the \p mode + * parameter (encrypt or decrypt), on the input data buffer + * defined in the \p input parameter. + * + * For CFB, you must set up the context with mbedtls_aes_setkey_enc(), + * regardless of whether you are performing an encryption or decryption + * operation, that is, regardless of the \p mode parameter. This is + * because CFB mode uses the same key schedule for encryption and + * decryption. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the same function again on the next + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If you need to retain the contents of the + * IV, you must either save it manually or use the cipher + * module instead. + * + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param mode The AES operation: #MBEDTLS_AES_ENCRYPT or + * #MBEDTLS_AES_DECRYPT. + * \param length The length of the input data in Bytes. + * \param iv_off The offset in IV (updated after use). + * It must point to a valid \c size_t. + * \param iv The initialization vector (updated after use). + * It must be a readable and writeable buffer of \c 16 Bytes. + * \param input The buffer holding the input data. + * It must be readable and of size \p length Bytes. + * \param output The buffer holding the output data. + * It must be writeable and of size \p length Bytes. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_cfb128( mbedtls_aes_context *ctx, + int mode, + size_t length, + size_t *iv_off, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function performs an AES-CFB8 encryption or decryption + * operation. + * + * It performs the operation defined in the \p mode + * parameter (encrypt/decrypt), on the input data buffer defined + * in the \p input parameter. + * + * Due to the nature of CFB, you must use the same key schedule for + * both encryption and decryption operations. Therefore, you must + * use the context initialized with mbedtls_aes_setkey_enc() for + * both #MBEDTLS_AES_ENCRYPT and #MBEDTLS_AES_DECRYPT. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the same function again on the next + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param mode The AES operation: #MBEDTLS_AES_ENCRYPT or + * #MBEDTLS_AES_DECRYPT + * \param length The length of the input data. + * \param iv The initialization vector (updated after use). + * It must be a readable and writeable buffer of \c 16 Bytes. + * \param input The buffer holding the input data. + * It must be readable and of size \p length Bytes. + * \param output The buffer holding the output data. + * It must be writeable and of size \p length Bytes. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_cfb8( mbedtls_aes_context *ctx, + int mode, + size_t length, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output ); +#endif /*MBEDTLS_CIPHER_MODE_CFB */ + +#if defined(MBEDTLS_CIPHER_MODE_OFB) +/** + * \brief This function performs an AES-OFB (Output Feedback Mode) + * encryption or decryption operation. + * + * For OFB, you must set up the context with + * mbedtls_aes_setkey_enc(), regardless of whether you are + * performing an encryption or decryption operation. This is + * because OFB mode uses the same key schedule for encryption and + * decryption. + * + * The OFB operation is identical for encryption or decryption, + * therefore no operation mode needs to be specified. + * + * \note Upon exit, the content of iv, the Initialisation Vector, is + * updated so that you can call the same function again on the next + * block(s) of data and get the same result as if it was encrypted + * in one call. This allows a "streaming" usage, by initialising + * iv_off to 0 before the first call, and preserving its value + * between calls. + * + * For non-streaming use, the iv should be initialised on each call + * to a unique value, and iv_off set to 0 on each call. + * + * If you need to retain the contents of the initialisation vector, + * you must either save it manually or use the cipher module + * instead. + * + * \warning For the OFB mode, the initialisation vector must be unique + * every encryption operation. Reuse of an initialisation vector + * will compromise security. + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param length The length of the input data. + * \param iv_off The offset in IV (updated after use). + * It must point to a valid \c size_t. + * \param iv The initialization vector (updated after use). + * It must be a readable and writeable buffer of \c 16 Bytes. + * \param input The buffer holding the input data. + * It must be readable and of size \p length Bytes. + * \param output The buffer holding the output data. + * It must be writeable and of size \p length Bytes. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_ofb( mbedtls_aes_context *ctx, + size_t length, + size_t *iv_off, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output ); + +#endif /* MBEDTLS_CIPHER_MODE_OFB */ + +#if defined(MBEDTLS_CIPHER_MODE_CTR) +/** + * \brief This function performs an AES-CTR encryption or decryption + * operation. + * + * Due to the nature of CTR, you must use the same key schedule + * for both encryption and decryption operations. Therefore, you + * must use the context initialized with mbedtls_aes_setkey_enc() + * for both #MBEDTLS_AES_ENCRYPT and #MBEDTLS_AES_DECRYPT. + * + * \warning You must never reuse a nonce value with the same key. Doing so + * would void the encryption for the two messages encrypted with + * the same nonce and key. + * + * There are two common strategies for managing nonces with CTR: + * + * 1. You can handle everything as a single message processed over + * successive calls to this function. In that case, you want to + * set \p nonce_counter and \p nc_off to 0 for the first call, and + * then preserve the values of \p nonce_counter, \p nc_off and \p + * stream_block across calls to this function as they will be + * updated by this function. + * + * With this strategy, you must not encrypt more than 2**128 + * blocks of data with the same key. + * + * 2. You can encrypt separate messages by dividing the \p + * nonce_counter buffer in two areas: the first one used for a + * per-message nonce, handled by yourself, and the second one + * updated by this function internally. + * + * For example, you might reserve the first 12 bytes for the + * per-message nonce, and the last 4 bytes for internal use. In that + * case, before calling this function on a new message you need to + * set the first 12 bytes of \p nonce_counter to your chosen nonce + * value, the last 4 to 0, and \p nc_off to 0 (which will cause \p + * stream_block to be ignored). That way, you can encrypt at most + * 2**96 messages of up to 2**32 blocks each with the same key. + * + * The per-message nonce (or information sufficient to reconstruct + * it) needs to be communicated with the ciphertext and must be unique. + * The recommended way to ensure uniqueness is to use a message + * counter. An alternative is to generate random nonces, but this + * limits the number of messages that can be securely encrypted: + * for example, with 96-bit random nonces, you should not encrypt + * more than 2**32 messages with the same key. + * + * Note that for both strategies, sizes are measured in blocks and + * that an AES block is 16 bytes. + * + * \warning Upon return, \p stream_block contains sensitive data. Its + * content must not be written to insecure storage and should be + * securely discarded as soon as it's no longer needed. + * + * \param ctx The AES context to use for encryption or decryption. + * It must be initialized and bound to a key. + * \param length The length of the input data. + * \param nc_off The offset in the current \p stream_block, for + * resuming within the current cipher stream. The + * offset pointer should be 0 at the start of a stream. + * It must point to a valid \c size_t. + * \param nonce_counter The 128-bit nonce and counter. + * It must be a readable-writeable buffer of \c 16 Bytes. + * \param stream_block The saved stream block for resuming. This is + * overwritten by the function. + * It must be a readable-writeable buffer of \c 16 Bytes. + * \param input The buffer holding the input data. + * It must be readable and of size \p length Bytes. + * \param output The buffer holding the output data. + * It must be writeable and of size \p length Bytes. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_aes_crypt_ctr( mbedtls_aes_context *ctx, + size_t length, + size_t *nc_off, + unsigned char nonce_counter[16], + unsigned char stream_block[16], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CTR */ + +/** + * \brief Internal AES block encryption function. This is only + * exposed to allow overriding it using + * \c MBEDTLS_AES_ENCRYPT_ALT. + * + * \param ctx The AES context to use for encryption. + * \param input The plaintext block. + * \param output The output (ciphertext) block. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx, + const unsigned char input[16], + unsigned char output[16] ); + +/** + * \brief Internal AES block decryption function. This is only + * exposed to allow overriding it using see + * \c MBEDTLS_AES_DECRYPT_ALT. + * + * \param ctx The AES context to use for decryption. + * \param input The ciphertext block. + * \param output The output (plaintext) block. + * + * \return \c 0 on success. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx, + const unsigned char input[16], + unsigned char output[16] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief Deprecated internal AES block encryption function + * without return value. + * + * \deprecated Superseded by mbedtls_internal_aes_encrypt() + * + * \param ctx The AES context to use for encryption. + * \param input Plaintext block. + * \param output Output (ciphertext) block. + */ +MBEDTLS_DEPRECATED void mbedtls_aes_encrypt( mbedtls_aes_context *ctx, + const unsigned char input[16], + unsigned char output[16] ); + +/** + * \brief Deprecated internal AES block decryption function + * without return value. + * + * \deprecated Superseded by mbedtls_internal_aes_decrypt() + * + * \param ctx The AES context to use for decryption. + * \param input Ciphertext block. + * \param output Output (plaintext) block. + */ +MBEDTLS_DEPRECATED void mbedtls_aes_decrypt( mbedtls_aes_context *ctx, + const unsigned char input[16], + unsigned char output[16] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_aes_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* aes.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/aesni.h b/openharmony/armeabi-v7a/include/mbedtls/aesni.h new file mode 100644 index 00000000..c1d22f59 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/aesni.h @@ -0,0 +1,136 @@ +/** + * \file aesni.h + * + * \brief AES-NI for hardware AES acceleration on some Intel processors + * + * \warning These functions are only for internal use by other library + * functions; you must not call them directly. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_AESNI_H +#define MBEDTLS_AESNI_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/aes.h" + +#define MBEDTLS_AESNI_AES 0x02000000u +#define MBEDTLS_AESNI_CLMUL 0x00000002u + +#if defined(MBEDTLS_HAVE_ASM) && defined(__GNUC__) && \ + ( defined(__amd64__) || defined(__x86_64__) ) && \ + ! defined(MBEDTLS_HAVE_X86_64) +#define MBEDTLS_HAVE_X86_64 +#endif + +#if defined(MBEDTLS_HAVE_X86_64) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Internal function to detect the AES-NI feature in CPUs. + * + * \note This function is only for internal use by other library + * functions; you must not call it directly. + * + * \param what The feature to detect + * (MBEDTLS_AESNI_AES or MBEDTLS_AESNI_CLMUL) + * + * \return 1 if CPU has support for the feature, 0 otherwise + */ +int mbedtls_aesni_has_support( unsigned int what ); + +/** + * \brief Internal AES-NI AES-ECB block encryption and decryption + * + * \note This function is only for internal use by other library + * functions; you must not call it directly. + * + * \param ctx AES context + * \param mode MBEDTLS_AES_ENCRYPT or MBEDTLS_AES_DECRYPT + * \param input 16-byte input block + * \param output 16-byte output block + * + * \return 0 on success (cannot fail) + */ +int mbedtls_aesni_crypt_ecb( mbedtls_aes_context *ctx, + int mode, + const unsigned char input[16], + unsigned char output[16] ); + +/** + * \brief Internal GCM multiplication: c = a * b in GF(2^128) + * + * \note This function is only for internal use by other library + * functions; you must not call it directly. + * + * \param c Result + * \param a First operand + * \param b Second operand + * + * \note Both operands and result are bit strings interpreted as + * elements of GF(2^128) as per the GCM spec. + */ +void mbedtls_aesni_gcm_mult( unsigned char c[16], + const unsigned char a[16], + const unsigned char b[16] ); + +/** + * \brief Internal round key inversion. This function computes + * decryption round keys from the encryption round keys. + * + * \note This function is only for internal use by other library + * functions; you must not call it directly. + * + * \param invkey Round keys for the equivalent inverse cipher + * \param fwdkey Original round keys (for encryption) + * \param nr Number of rounds (that is, number of round keys minus one) + */ +void mbedtls_aesni_inverse_key( unsigned char *invkey, + const unsigned char *fwdkey, + int nr ); + +/** + * \brief Internal key expansion for encryption + * + * \note This function is only for internal use by other library + * functions; you must not call it directly. + * + * \param rk Destination buffer where the round keys are written + * \param key Encryption key + * \param bits Key size in bits (must be 128, 192 or 256) + * + * \return 0 if successful, or MBEDTLS_ERR_AES_INVALID_KEY_LENGTH + */ +int mbedtls_aesni_setkey_enc( unsigned char *rk, + const unsigned char *key, + size_t bits ); + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_HAVE_X86_64 */ + +#endif /* MBEDTLS_AESNI_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/arc4.h b/openharmony/armeabi-v7a/include/mbedtls/arc4.h new file mode 100644 index 00000000..f4b0f9f3 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/arc4.h @@ -0,0 +1,145 @@ +/** + * \file arc4.h + * + * \brief The ARCFOUR stream cipher + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers instead. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ +#ifndef MBEDTLS_ARC4_H +#define MBEDTLS_ARC4_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +/* MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** ARC4 hardware accelerator failed. */ +#define MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED -0x0019 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_ARC4_ALT) +// Regular implementation +// + +/** + * \brief ARC4 context structure + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers instead. + * + */ +typedef struct mbedtls_arc4_context +{ + int x; /*!< permutation index */ + int y; /*!< permutation index */ + unsigned char m[256]; /*!< permutation table */ +} +mbedtls_arc4_context; + +#else /* MBEDTLS_ARC4_ALT */ +#include "arc4_alt.h" +#endif /* MBEDTLS_ARC4_ALT */ + +/** + * \brief Initialize ARC4 context + * + * \param ctx ARC4 context to be initialized + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + * + */ +void mbedtls_arc4_init( mbedtls_arc4_context *ctx ); + +/** + * \brief Clear ARC4 context + * + * \param ctx ARC4 context to be cleared + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + * + */ +void mbedtls_arc4_free( mbedtls_arc4_context *ctx ); + +/** + * \brief ARC4 key schedule + * + * \param ctx ARC4 context to be setup + * \param key the secret key + * \param keylen length of the key, in bytes + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + * + */ +void mbedtls_arc4_setup( mbedtls_arc4_context *ctx, const unsigned char *key, + unsigned int keylen ); + +/** + * \brief ARC4 cipher function + * + * \param ctx ARC4 context + * \param length length of the input data + * \param input buffer holding the input data + * \param output buffer for the output data + * + * \return 0 if successful + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + * + */ +int mbedtls_arc4_crypt( mbedtls_arc4_context *ctx, size_t length, const unsigned char *input, + unsigned char *output ); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + * + */ +int mbedtls_arc4_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* arc4.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/aria.h b/openharmony/armeabi-v7a/include/mbedtls/aria.h new file mode 100644 index 00000000..d294c47f --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/aria.h @@ -0,0 +1,373 @@ +/** + * \file aria.h + * + * \brief ARIA block cipher + * + * The ARIA algorithm is a symmetric block cipher that can encrypt and + * decrypt information. It is defined by the Korean Agency for + * Technology and Standards (KATS) in KS X 1213:2004 (in + * Korean, but see http://210.104.33.10/ARIA/index-e.html in English) + * and also described by the IETF in RFC 5794. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_ARIA_H +#define MBEDTLS_ARIA_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +#include "mbedtls/platform_util.h" + +#define MBEDTLS_ARIA_ENCRYPT 1 /**< ARIA encryption. */ +#define MBEDTLS_ARIA_DECRYPT 0 /**< ARIA decryption. */ + +#define MBEDTLS_ARIA_BLOCKSIZE 16 /**< ARIA block size in bytes. */ +#define MBEDTLS_ARIA_MAX_ROUNDS 16 /**< Maximum number of rounds in ARIA. */ +#define MBEDTLS_ARIA_MAX_KEYSIZE 32 /**< Maximum size of an ARIA key in bytes. */ + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#define MBEDTLS_ERR_ARIA_INVALID_KEY_LENGTH MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( -0x005C ) +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ +/** Bad input data. */ +#define MBEDTLS_ERR_ARIA_BAD_INPUT_DATA -0x005C + +/** Invalid data input length. */ +#define MBEDTLS_ERR_ARIA_INVALID_INPUT_LENGTH -0x005E + +/* MBEDTLS_ERR_ARIA_FEATURE_UNAVAILABLE is deprecated and should not be used. + */ +/** Feature not available. For example, an unsupported ARIA key size. */ +#define MBEDTLS_ERR_ARIA_FEATURE_UNAVAILABLE -0x005A + +/* MBEDTLS_ERR_ARIA_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** ARIA hardware accelerator failed. */ +#define MBEDTLS_ERR_ARIA_HW_ACCEL_FAILED -0x0058 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_ARIA_ALT) +// Regular implementation +// + +/** + * \brief The ARIA context-type definition. + */ +typedef struct mbedtls_aria_context +{ + unsigned char nr; /*!< The number of rounds (12, 14 or 16) */ + /*! The ARIA round keys. */ + uint32_t rk[MBEDTLS_ARIA_MAX_ROUNDS + 1][MBEDTLS_ARIA_BLOCKSIZE / 4]; +} +mbedtls_aria_context; + +#else /* MBEDTLS_ARIA_ALT */ +#include "aria_alt.h" +#endif /* MBEDTLS_ARIA_ALT */ + +/** + * \brief This function initializes the specified ARIA context. + * + * It must be the first API called before using + * the context. + * + * \param ctx The ARIA context to initialize. This must not be \c NULL. + */ +void mbedtls_aria_init( mbedtls_aria_context *ctx ); + +/** + * \brief This function releases and clears the specified ARIA context. + * + * \param ctx The ARIA context to clear. This may be \c NULL, in which + * case this function returns immediately. If it is not \c NULL, + * it must point to an initialized ARIA context. + */ +void mbedtls_aria_free( mbedtls_aria_context *ctx ); + +/** + * \brief This function sets the encryption key. + * + * \param ctx The ARIA context to which the key should be bound. + * This must be initialized. + * \param key The encryption key. This must be a readable buffer + * of size \p keybits Bits. + * \param keybits The size of \p key in Bits. Valid options are: + *
  • 128 bits
    • + *
  • 192 bits
    • + *
  • 256 bits
+ * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_setkey_enc( mbedtls_aria_context *ctx, + const unsigned char *key, + unsigned int keybits ); + +/** + * \brief This function sets the decryption key. + * + * \param ctx The ARIA context to which the key should be bound. + * This must be initialized. + * \param key The decryption key. This must be a readable buffer + * of size \p keybits Bits. + * \param keybits The size of data passed. Valid options are: + *
  • 128 bits
    • + *
  • 192 bits
    • + *
  • 256 bits
+ * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_setkey_dec( mbedtls_aria_context *ctx, + const unsigned char *key, + unsigned int keybits ); + +/** + * \brief This function performs an ARIA single-block encryption or + * decryption operation. + * + * It performs encryption or decryption (depending on whether + * the key was set for encryption on decryption) on the input + * data buffer defined in the \p input parameter. + * + * mbedtls_aria_init(), and either mbedtls_aria_setkey_enc() or + * mbedtls_aria_setkey_dec() must be called before the first + * call to this API with the same context. + * + * \param ctx The ARIA context to use for encryption or decryption. + * This must be initialized and bound to a key. + * \param input The 16-Byte buffer holding the input data. + * \param output The 16-Byte buffer holding the output data. + + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_crypt_ecb( mbedtls_aria_context *ctx, + const unsigned char input[MBEDTLS_ARIA_BLOCKSIZE], + unsigned char output[MBEDTLS_ARIA_BLOCKSIZE] ); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief This function performs an ARIA-CBC encryption or decryption operation + * on full blocks. + * + * It performs the operation defined in the \p mode + * parameter (encrypt/decrypt), on the input data buffer defined in + * the \p input parameter. + * + * It can be called as many times as needed, until all the input + * data is processed. mbedtls_aria_init(), and either + * mbedtls_aria_setkey_enc() or mbedtls_aria_setkey_dec() must be called + * before the first call to this API with the same context. + * + * \note This function operates on aligned blocks, that is, the input size + * must be a multiple of the ARIA block size of 16 Bytes. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the same function again on the next + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If you need to retain the contents of the IV, you should + * either save it manually or use the cipher module instead. + * + * + * \param ctx The ARIA context to use for encryption or decryption. + * This must be initialized and bound to a key. + * \param mode The mode of operation. This must be either + * #MBEDTLS_ARIA_ENCRYPT for encryption, or + * #MBEDTLS_ARIA_DECRYPT for decryption. + * \param length The length of the input data in Bytes. This must be a + * multiple of the block size (16 Bytes). + * \param iv Initialization vector (updated after use). + * This must be a readable buffer of size 16 Bytes. + * \param input The buffer holding the input data. This must + * be a readable buffer of length \p length Bytes. + * \param output The buffer holding the output data. This must + * be a writable buffer of length \p length Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_crypt_cbc( mbedtls_aria_context *ctx, + int mode, + size_t length, + unsigned char iv[MBEDTLS_ARIA_BLOCKSIZE], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +#if defined(MBEDTLS_CIPHER_MODE_CFB) +/** + * \brief This function performs an ARIA-CFB128 encryption or decryption + * operation. + * + * It performs the operation defined in the \p mode + * parameter (encrypt or decrypt), on the input data buffer + * defined in the \p input parameter. + * + * For CFB, you must set up the context with mbedtls_aria_setkey_enc(), + * regardless of whether you are performing an encryption or decryption + * operation, that is, regardless of the \p mode parameter. This is + * because CFB mode uses the same key schedule for encryption and + * decryption. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the same function again on the next + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If you need to retain the contents of the + * IV, you must either save it manually or use the cipher + * module instead. + * + * + * \param ctx The ARIA context to use for encryption or decryption. + * This must be initialized and bound to a key. + * \param mode The mode of operation. This must be either + * #MBEDTLS_ARIA_ENCRYPT for encryption, or + * #MBEDTLS_ARIA_DECRYPT for decryption. + * \param length The length of the input data \p input in Bytes. + * \param iv_off The offset in IV (updated after use). + * This must not be larger than 15. + * \param iv The initialization vector (updated after use). + * This must be a readable buffer of size 16 Bytes. + * \param input The buffer holding the input data. This must + * be a readable buffer of length \p length Bytes. + * \param output The buffer holding the output data. This must + * be a writable buffer of length \p length Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_crypt_cfb128( mbedtls_aria_context *ctx, + int mode, + size_t length, + size_t *iv_off, + unsigned char iv[MBEDTLS_ARIA_BLOCKSIZE], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CFB */ + +#if defined(MBEDTLS_CIPHER_MODE_CTR) +/** + * \brief This function performs an ARIA-CTR encryption or decryption + * operation. + * + * This function performs the operation defined in the \p mode + * parameter (encrypt/decrypt), on the input data buffer + * defined in the \p input parameter. + * + * Due to the nature of CTR, you must use the same key schedule + * for both encryption and decryption operations. Therefore, you + * must use the context initialized with mbedtls_aria_setkey_enc() + * for both #MBEDTLS_ARIA_ENCRYPT and #MBEDTLS_ARIA_DECRYPT. + * + * \warning You must never reuse a nonce value with the same key. Doing so + * would void the encryption for the two messages encrypted with + * the same nonce and key. + * + * There are two common strategies for managing nonces with CTR: + * + * 1. You can handle everything as a single message processed over + * successive calls to this function. In that case, you want to + * set \p nonce_counter and \p nc_off to 0 for the first call, and + * then preserve the values of \p nonce_counter, \p nc_off and \p + * stream_block across calls to this function as they will be + * updated by this function. + * + * With this strategy, you must not encrypt more than 2**128 + * blocks of data with the same key. + * + * 2. You can encrypt separate messages by dividing the \p + * nonce_counter buffer in two areas: the first one used for a + * per-message nonce, handled by yourself, and the second one + * updated by this function internally. + * + * For example, you might reserve the first 12 bytes for the + * per-message nonce, and the last 4 bytes for internal use. In that + * case, before calling this function on a new message you need to + * set the first 12 bytes of \p nonce_counter to your chosen nonce + * value, the last 4 to 0, and \p nc_off to 0 (which will cause \p + * stream_block to be ignored). That way, you can encrypt at most + * 2**96 messages of up to 2**32 blocks each with the same key. + * + * The per-message nonce (or information sufficient to reconstruct + * it) needs to be communicated with the ciphertext and must be unique. + * The recommended way to ensure uniqueness is to use a message + * counter. An alternative is to generate random nonces, but this + * limits the number of messages that can be securely encrypted: + * for example, with 96-bit random nonces, you should not encrypt + * more than 2**32 messages with the same key. + * + * Note that for both strategies, sizes are measured in blocks and + * that an ARIA block is 16 bytes. + * + * \warning Upon return, \p stream_block contains sensitive data. Its + * content must not be written to insecure storage and should be + * securely discarded as soon as it's no longer needed. + * + * \param ctx The ARIA context to use for encryption or decryption. + * This must be initialized and bound to a key. + * \param length The length of the input data \p input in Bytes. + * \param nc_off The offset in Bytes in the current \p stream_block, + * for resuming within the current cipher stream. The + * offset pointer should be \c 0 at the start of a + * stream. This must not be larger than \c 15 Bytes. + * \param nonce_counter The 128-bit nonce and counter. This must point to + * a read/write buffer of length \c 16 bytes. + * \param stream_block The saved stream block for resuming. This must + * point to a read/write buffer of length \c 16 bytes. + * This is overwritten by the function. + * \param input The buffer holding the input data. This must + * be a readable buffer of length \p length Bytes. + * \param output The buffer holding the output data. This must + * be a writable buffer of length \p length Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_aria_crypt_ctr( mbedtls_aria_context *ctx, + size_t length, + size_t *nc_off, + unsigned char nonce_counter[MBEDTLS_ARIA_BLOCKSIZE], + unsigned char stream_block[MBEDTLS_ARIA_BLOCKSIZE], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CTR */ + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine. + * + * \return \c 0 on success, or \c 1 on failure. + */ +int mbedtls_aria_self_test( int verbose ); +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* aria.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/asn1.h b/openharmony/armeabi-v7a/include/mbedtls/asn1.h new file mode 100644 index 00000000..5117fc7a --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/asn1.h @@ -0,0 +1,616 @@ +/** + * \file asn1.h + * + * \brief Generic ASN.1 parsing + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_ASN1_H +#define MBEDTLS_ASN1_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +#if defined(MBEDTLS_BIGNUM_C) +#include "mbedtls/bignum.h" +#endif + +/** + * \addtogroup asn1_module + * \{ + */ + +/** + * \name ASN1 Error codes + * These error codes are OR'ed to X509 error codes for + * higher error granularity. + * ASN1 is a standard to specify data structures. + * \{ + */ +/** Out of data when parsing an ASN1 data structure. */ +#define MBEDTLS_ERR_ASN1_OUT_OF_DATA -0x0060 +/** ASN1 tag was of an unexpected value. */ +#define MBEDTLS_ERR_ASN1_UNEXPECTED_TAG -0x0062 +/** Error when trying to determine the length or invalid length. */ +#define MBEDTLS_ERR_ASN1_INVALID_LENGTH -0x0064 +/** Actual length differs from expected length. */ +#define MBEDTLS_ERR_ASN1_LENGTH_MISMATCH -0x0066 +/** Data is invalid. */ +#define MBEDTLS_ERR_ASN1_INVALID_DATA -0x0068 +/** Memory allocation failed */ +#define MBEDTLS_ERR_ASN1_ALLOC_FAILED -0x006A +/** Buffer too small when writing ASN.1 data structure. */ +#define MBEDTLS_ERR_ASN1_BUF_TOO_SMALL -0x006C + +/** \} name ASN1 Error codes */ + +/** + * \name DER constants + * These constants comply with the DER encoded ASN.1 type tags. + * DER encoding uses hexadecimal representation. + * An example DER sequence is:\n + * - 0x02 -- tag indicating INTEGER + * - 0x01 -- length in octets + * - 0x05 -- value + * Such sequences are typically read into \c ::mbedtls_x509_buf. + * \{ + */ +#define MBEDTLS_ASN1_BOOLEAN 0x01 +#define MBEDTLS_ASN1_INTEGER 0x02 +#define MBEDTLS_ASN1_BIT_STRING 0x03 +#define MBEDTLS_ASN1_OCTET_STRING 0x04 +#define MBEDTLS_ASN1_NULL 0x05 +#define MBEDTLS_ASN1_OID 0x06 +#define MBEDTLS_ASN1_ENUMERATED 0x0A +#define MBEDTLS_ASN1_UTF8_STRING 0x0C +#define MBEDTLS_ASN1_SEQUENCE 0x10 +#define MBEDTLS_ASN1_SET 0x11 +#define MBEDTLS_ASN1_PRINTABLE_STRING 0x13 +#define MBEDTLS_ASN1_T61_STRING 0x14 +#define MBEDTLS_ASN1_IA5_STRING 0x16 +#define MBEDTLS_ASN1_UTC_TIME 0x17 +#define MBEDTLS_ASN1_GENERALIZED_TIME 0x18 +#define MBEDTLS_ASN1_UNIVERSAL_STRING 0x1C +#define MBEDTLS_ASN1_BMP_STRING 0x1E +#define MBEDTLS_ASN1_PRIMITIVE 0x00 +#define MBEDTLS_ASN1_CONSTRUCTED 0x20 +#define MBEDTLS_ASN1_CONTEXT_SPECIFIC 0x80 + +/* Slightly smaller way to check if tag is a string tag + * compared to canonical implementation. */ +#define MBEDTLS_ASN1_IS_STRING_TAG( tag ) \ + ( ( tag ) < 32u && ( \ + ( ( 1u << ( tag ) ) & ( ( 1u << MBEDTLS_ASN1_BMP_STRING ) | \ + ( 1u << MBEDTLS_ASN1_UTF8_STRING ) | \ + ( 1u << MBEDTLS_ASN1_T61_STRING ) | \ + ( 1u << MBEDTLS_ASN1_IA5_STRING ) | \ + ( 1u << MBEDTLS_ASN1_UNIVERSAL_STRING ) | \ + ( 1u << MBEDTLS_ASN1_PRINTABLE_STRING ) | \ + ( 1u << MBEDTLS_ASN1_BIT_STRING ) ) ) != 0 ) ) + +/* + * Bit masks for each of the components of an ASN.1 tag as specified in + * ITU X.690 (08/2015), section 8.1 "General rules for encoding", + * paragraph 8.1.2.2: + * + * Bit 8 7 6 5 1 + * +-------+-----+------------+ + * | Class | P/C | Tag number | + * +-------+-----+------------+ + */ +#define MBEDTLS_ASN1_TAG_CLASS_MASK 0xC0 +#define MBEDTLS_ASN1_TAG_PC_MASK 0x20 +#define MBEDTLS_ASN1_TAG_VALUE_MASK 0x1F + +/** \} name DER constants */ + +/** Returns the size of the binary string, without the trailing \\0 */ +#define MBEDTLS_OID_SIZE(x) (sizeof(x) - 1) + +/** + * Compares an mbedtls_asn1_buf structure to a reference OID. + * + * Only works for 'defined' oid_str values (MBEDTLS_OID_HMAC_SHA1), you cannot use a + * 'unsigned char *oid' here! + */ +#define MBEDTLS_OID_CMP(oid_str, oid_buf) \ + ( ( MBEDTLS_OID_SIZE(oid_str) != (oid_buf)->len ) || \ + memcmp( (oid_str), (oid_buf)->p, (oid_buf)->len) != 0 ) + +#define MBEDTLS_OID_CMP_RAW(oid_str, oid_buf, oid_buf_len) \ + ( ( MBEDTLS_OID_SIZE(oid_str) != (oid_buf_len) ) || \ + memcmp( (oid_str), (oid_buf), (oid_buf_len) ) != 0 ) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \name Functions to parse ASN.1 data structures + * \{ + */ + +/** + * Type-length-value structure that allows for ASN1 using DER. + */ +typedef struct mbedtls_asn1_buf +{ + int tag; /**< ASN1 type, e.g. MBEDTLS_ASN1_UTF8_STRING. */ + size_t len; /**< ASN1 length, in octets. */ + unsigned char *p; /**< ASN1 data, e.g. in ASCII. */ +} +mbedtls_asn1_buf; + +/** + * Container for ASN1 bit strings. + */ +typedef struct mbedtls_asn1_bitstring +{ + size_t len; /**< ASN1 length, in octets. */ + unsigned char unused_bits; /**< Number of unused bits at the end of the string */ + unsigned char *p; /**< Raw ASN1 data for the bit string */ +} +mbedtls_asn1_bitstring; + +/** + * Container for a sequence of ASN.1 items + */ +typedef struct mbedtls_asn1_sequence +{ + mbedtls_asn1_buf buf; /**< Buffer containing the given ASN.1 item. */ + struct mbedtls_asn1_sequence *next; /**< The next entry in the sequence. */ +} +mbedtls_asn1_sequence; + +/** + * Container for a sequence or list of 'named' ASN.1 data items + */ +typedef struct mbedtls_asn1_named_data +{ + mbedtls_asn1_buf oid; /**< The object identifier. */ + mbedtls_asn1_buf val; /**< The named value. */ + struct mbedtls_asn1_named_data *next; /**< The next entry in the sequence. */ + unsigned char next_merged; /**< Merge next item into the current one? */ +} +mbedtls_asn1_named_data; + +/** + * \brief Get the length of an ASN.1 element. + * Updates the pointer to immediately behind the length. + * + * \param p On entry, \c *p points to the first byte of the length, + * i.e. immediately after the tag. + * On successful completion, \c *p points to the first byte + * after the length, i.e. the first byte of the content. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param len On successful completion, \c *len contains the length + * read from the ASN.1 input. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_OUT_OF_DATA if the ASN.1 element + * would end beyond \p end. + * \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the length is unparsable. + */ +int mbedtls_asn1_get_len( unsigned char **p, + const unsigned char *end, + size_t *len ); + +/** + * \brief Get the tag and length of the element. + * Check for the requested tag. + * Updates the pointer to immediately behind the tag and length. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * after the length, i.e. the first byte of the content. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param len On successful completion, \c *len contains the length + * read from the ASN.1 input. + * \param tag The expected tag. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_UNEXPECTED_TAG if the data does not start + * with the requested tag. + * \return #MBEDTLS_ERR_ASN1_OUT_OF_DATA if the ASN.1 element + * would end beyond \p end. + * \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the length is unparsable. + */ +int mbedtls_asn1_get_tag( unsigned char **p, + const unsigned char *end, + size_t *len, int tag ); + +/** + * \brief Retrieve a boolean ASN.1 tag and its value. + * Updates the pointer to immediately behind the full tag. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the ASN.1 element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param val On success, the parsed value (\c 0 or \c 1). + * + * \return 0 if successful. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 BOOLEAN. + */ +int mbedtls_asn1_get_bool( unsigned char **p, + const unsigned char *end, + int *val ); + +/** + * \brief Retrieve an integer ASN.1 tag and its value. + * Updates the pointer to immediately behind the full tag. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the ASN.1 element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param val On success, the parsed value. + * + * \return 0 if successful. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 INTEGER. + * \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the parsed value does + * not fit in an \c int. + */ +int mbedtls_asn1_get_int( unsigned char **p, + const unsigned char *end, + int *val ); + +/** + * \brief Retrieve an enumerated ASN.1 tag and its value. + * Updates the pointer to immediately behind the full tag. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the ASN.1 element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param val On success, the parsed value. + * + * \return 0 if successful. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 ENUMERATED. + * \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the parsed value does + * not fit in an \c int. + */ +int mbedtls_asn1_get_enum( unsigned char **p, + const unsigned char *end, + int *val ); + +/** + * \brief Retrieve a bitstring ASN.1 tag and its value. + * Updates the pointer to immediately behind the full tag. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p is equal to \p end. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param bs On success, ::mbedtls_asn1_bitstring information about + * the parsed value. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_LENGTH_MISMATCH if the input contains + * extra data after a valid BIT STRING. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 BIT STRING. + */ +int mbedtls_asn1_get_bitstring( unsigned char **p, const unsigned char *end, + mbedtls_asn1_bitstring *bs ); + +/** + * \brief Retrieve a bitstring ASN.1 tag without unused bits and its + * value. + * Updates the pointer to the beginning of the bit/octet string. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * of the content of the BIT STRING. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param len On success, \c *len is the length of the content in bytes. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_INVALID_DATA if the input starts with + * a valid BIT STRING with a nonzero number of unused bits. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 BIT STRING. + */ +int mbedtls_asn1_get_bitstring_null( unsigned char **p, + const unsigned char *end, + size_t *len ); + +/** + * \brief Parses and splits an ASN.1 "SEQUENCE OF ". + * Updates the pointer to immediately behind the full sequence tag. + * + * This function allocates memory for the sequence elements. You can free + * the allocated memory with mbedtls_asn1_sequence_free(). + * + * \note On error, this function may return a partial list in \p cur. + * You must set `cur->next = NULL` before calling this function! + * Otherwise it is impossible to distinguish a previously non-null + * pointer from a pointer to an object allocated by this function. + * + * \note If the sequence is empty, this function does not modify + * \c *cur. If the sequence is valid and non-empty, this + * function sets `cur->buf.tag` to \p tag. This allows + * callers to distinguish between an empty sequence and + * a one-element sequence. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p is equal to \p end. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param cur A ::mbedtls_asn1_sequence which this function fills. + * When this function returns, \c *cur is the head of a linked + * list. Each node in this list is allocated with + * mbedtls_calloc() apart from \p cur itself, and should + * therefore be freed with mbedtls_free(). + * The list describes the content of the sequence. + * The head of the list (i.e. \c *cur itself) describes the + * first element, `*cur->next` describes the second element, etc. + * For each element, `buf.tag == tag`, `buf.len` is the length + * of the content of the content of the element, and `buf.p` + * points to the first byte of the content (i.e. immediately + * past the length of the element). + * Note that list elements may be allocated even on error. + * \param tag Each element of the sequence must have this tag. + * + * \return 0 if successful. + * \return #MBEDTLS_ERR_ASN1_LENGTH_MISMATCH if the input contains + * extra data after a valid SEQUENCE OF \p tag. + * \return #MBEDTLS_ERR_ASN1_UNEXPECTED_TAG if the input starts with + * an ASN.1 SEQUENCE in which an element has a tag that + * is different from \p tag. + * \return #MBEDTLS_ERR_ASN1_ALLOC_FAILED if a memory allocation failed. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 SEQUENCE. + */ +int mbedtls_asn1_get_sequence_of( unsigned char **p, + const unsigned char *end, + mbedtls_asn1_sequence *cur, + int tag ); +/** + * \brief Free a heap-allocated linked list presentation of + * an ASN.1 sequence, including the first element. + * + * There are two common ways to manage the memory used for the representation + * of a parsed ASN.1 sequence: + * - Allocate a head node `mbedtls_asn1_sequence *head` with mbedtls_calloc(). + * Pass this node as the `cur` argument to mbedtls_asn1_get_sequence_of(). + * When you have finished processing the sequence, + * call mbedtls_asn1_sequence_free() on `head`. + * - Allocate a head node `mbedtls_asn1_sequence *head` in any manner, + * for example on the stack. Make sure that `head->next == NULL`. + * Pass `head` as the `cur` argument to mbedtls_asn1_get_sequence_of(). + * When you have finished processing the sequence, + * call mbedtls_asn1_sequence_free() on `head->cur`, + * then free `head` itself in the appropriate manner. + * + * \param seq The address of the first sequence component. This may + * be \c NULL, in which case this functions returns + * immediately. + */ +void mbedtls_asn1_sequence_free( mbedtls_asn1_sequence *seq ); + +/** + * \brief Traverse an ASN.1 SEQUENCE container and + * call a callback for each entry. + * + * This function checks that the input is a SEQUENCE of elements that + * each have a "must" tag, and calls a callback function on the elements + * that have a "may" tag. + * + * For example, to validate that the input is a SEQUENCE of `tag1` and call + * `cb` on each element, use + * ``` + * mbedtls_asn1_traverse_sequence_of(&p, end, 0xff, tag1, 0, 0, cb, ctx); + * ``` + * + * To validate that the input is a SEQUENCE of ANY and call `cb` on + * each element, use + * ``` + * mbedtls_asn1_traverse_sequence_of(&p, end, 0, 0, 0, 0, cb, ctx); + * ``` + * + * To validate that the input is a SEQUENCE of CHOICE {NULL, OCTET STRING} + * and call `cb` on each element that is an OCTET STRING, use + * ``` + * mbedtls_asn1_traverse_sequence_of(&p, end, 0xfe, 0x04, 0xff, 0x04, cb, ctx); + * ``` + * + * The callback is called on the elements with a "may" tag from left to + * right. If the input is not a valid SEQUENCE of elements with a "must" tag, + * the callback is called on the elements up to the leftmost point where + * the input is invalid. + * + * \warning This function is still experimental and may change + * at any time. + * + * \param p The address of the pointer to the beginning of + * the ASN.1 SEQUENCE header. This is updated to + * point to the end of the ASN.1 SEQUENCE container + * on a successful invocation. + * \param end The end of the ASN.1 SEQUENCE container. + * \param tag_must_mask A mask to be applied to the ASN.1 tags found within + * the SEQUENCE before comparing to \p tag_must_value. + * \param tag_must_val The required value of each ASN.1 tag found in the + * SEQUENCE, after masking with \p tag_must_mask. + * Mismatching tags lead to an error. + * For example, a value of \c 0 for both \p tag_must_mask + * and \p tag_must_val means that every tag is allowed, + * while a value of \c 0xFF for \p tag_must_mask means + * that \p tag_must_val is the only allowed tag. + * \param tag_may_mask A mask to be applied to the ASN.1 tags found within + * the SEQUENCE before comparing to \p tag_may_value. + * \param tag_may_val The desired value of each ASN.1 tag found in the + * SEQUENCE, after masking with \p tag_may_mask. + * Mismatching tags will be silently ignored. + * For example, a value of \c 0 for \p tag_may_mask and + * \p tag_may_val means that any tag will be considered, + * while a value of \c 0xFF for \p tag_may_mask means + * that all tags with value different from \p tag_may_val + * will be ignored. + * \param cb The callback to trigger for each component + * in the ASN.1 SEQUENCE that matches \p tag_may_val. + * The callback function is called with the following + * parameters: + * - \p ctx. + * - The tag of the current element. + * - A pointer to the start of the current element's + * content inside the input. + * - The length of the content of the current element. + * If the callback returns a non-zero value, + * the function stops immediately, + * forwarding the callback's return value. + * \param ctx The context to be passed to the callback \p cb. + * + * \return \c 0 if successful the entire ASN.1 SEQUENCE + * was traversed without parsing or callback errors. + * \return #MBEDTLS_ERR_ASN1_LENGTH_MISMATCH if the input + * contains extra data after a valid SEQUENCE + * of elements with an accepted tag. + * \return #MBEDTLS_ERR_ASN1_UNEXPECTED_TAG if the input starts + * with an ASN.1 SEQUENCE in which an element has a tag + * that is not accepted. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 SEQUENCE. + * \return A non-zero error code forwarded from the callback + * \p cb in case the latter returns a non-zero value. + */ +int mbedtls_asn1_traverse_sequence_of( + unsigned char **p, + const unsigned char *end, + unsigned char tag_must_mask, unsigned char tag_must_val, + unsigned char tag_may_mask, unsigned char tag_may_val, + int (*cb)( void *ctx, int tag, + unsigned char* start, size_t len ), + void *ctx ); + +#if defined(MBEDTLS_BIGNUM_C) +/** + * \brief Retrieve an integer ASN.1 tag and its value. + * Updates the pointer to immediately behind the full tag. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the ASN.1 element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param X On success, the parsed value. + * + * \return 0 if successful. + * \return An ASN.1 error code if the input does not start with + * a valid ASN.1 INTEGER. + * \return #MBEDTLS_ERR_ASN1_INVALID_LENGTH if the parsed value does + * not fit in an \c int. + * \return An MPI error code if the parsed value is too large. + */ +int mbedtls_asn1_get_mpi( unsigned char **p, + const unsigned char *end, + mbedtls_mpi *X ); +#endif /* MBEDTLS_BIGNUM_C */ + +/** + * \brief Retrieve an AlgorithmIdentifier ASN.1 sequence. + * Updates the pointer to immediately behind the full + * AlgorithmIdentifier. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the AlgorithmIdentifier element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param alg The buffer to receive the OID. + * \param params The buffer to receive the parameters. + * This is zeroized if there are no parameters. + * + * \return 0 if successful or a specific ASN.1 or MPI error code. + */ +int mbedtls_asn1_get_alg( unsigned char **p, + const unsigned char *end, + mbedtls_asn1_buf *alg, mbedtls_asn1_buf *params ); + +/** + * \brief Retrieve an AlgorithmIdentifier ASN.1 sequence with NULL or no + * params. + * Updates the pointer to immediately behind the full + * AlgorithmIdentifier. + * + * \param p On entry, \c *p points to the start of the ASN.1 element. + * On successful completion, \c *p points to the first byte + * beyond the AlgorithmIdentifier element. + * On error, the value of \c *p is undefined. + * \param end End of data. + * \param alg The buffer to receive the OID. + * + * \return 0 if successful or a specific ASN.1 or MPI error code. + */ +int mbedtls_asn1_get_alg_null( unsigned char **p, + const unsigned char *end, + mbedtls_asn1_buf *alg ); + +/** + * \brief Find a specific named_data entry in a sequence or list based on + * the OID. + * + * \param list The list to seek through + * \param oid The OID to look for + * \param len Size of the OID + * + * \return NULL if not found, or a pointer to the existing entry. + */ +mbedtls_asn1_named_data *mbedtls_asn1_find_named_data( mbedtls_asn1_named_data *list, + const char *oid, size_t len ); + +/** + * \brief Free a mbedtls_asn1_named_data entry + * + * \param entry The named data entry to free. + * This function calls mbedtls_free() on + * `entry->oid.p` and `entry->val.p`. + */ +void mbedtls_asn1_free_named_data( mbedtls_asn1_named_data *entry ); + +/** + * \brief Free all entries in a mbedtls_asn1_named_data list. + * + * \param head Pointer to the head of the list of named data entries to free. + * This function calls mbedtls_asn1_free_named_data() and + * mbedtls_free() on each list element and + * sets \c *head to \c NULL. + */ +void mbedtls_asn1_free_named_data_list( mbedtls_asn1_named_data **head ); + +/** \} name Functions to parse ASN.1 data structures */ +/** \} addtogroup asn1_module */ + +#ifdef __cplusplus +} +#endif + +#endif /* asn1.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/asn1write.h b/openharmony/armeabi-v7a/include/mbedtls/asn1write.h new file mode 100644 index 00000000..44afae0e --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/asn1write.h @@ -0,0 +1,370 @@ +/** + * \file asn1write.h + * + * \brief ASN.1 buffer writing functionality + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_ASN1_WRITE_H +#define MBEDTLS_ASN1_WRITE_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/asn1.h" + +#define MBEDTLS_ASN1_CHK_ADD(g, f) \ + do \ + { \ + if( ( ret = (f) ) < 0 ) \ + return( ret ); \ + else \ + (g) += ret; \ + } while( 0 ) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Write a length field in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param len The length value to write. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_len( unsigned char **p, unsigned char *start, + size_t len ); +/** + * \brief Write an ASN.1 tag in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param tag The tag to write. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_tag( unsigned char **p, unsigned char *start, + unsigned char tag ); + +/** + * \brief Write raw buffer data. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param buf The data buffer to write. + * \param size The length of the data buffer. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_raw_buffer( unsigned char **p, unsigned char *start, + const unsigned char *buf, size_t size ); + +#if defined(MBEDTLS_BIGNUM_C) +/** + * \brief Write a arbitrary-precision number (#MBEDTLS_ASN1_INTEGER) + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param X The MPI to write. + * It must be non-negative. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_mpi( unsigned char **p, unsigned char *start, + const mbedtls_mpi *X ); +#endif /* MBEDTLS_BIGNUM_C */ + +/** + * \brief Write a NULL tag (#MBEDTLS_ASN1_NULL) with zero data + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_null( unsigned char **p, unsigned char *start ); + +/** + * \brief Write an OID tag (#MBEDTLS_ASN1_OID) and data + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param oid The OID to write. + * \param oid_len The length of the OID. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_oid( unsigned char **p, unsigned char *start, + const char *oid, size_t oid_len ); + +/** + * \brief Write an AlgorithmIdentifier sequence in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param oid The OID of the algorithm to write. + * \param oid_len The length of the algorithm's OID. + * \param par_len The length of the parameters, which must be already written. + * If 0, NULL parameters are added + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_algorithm_identifier( unsigned char **p, + unsigned char *start, + const char *oid, size_t oid_len, + size_t par_len ); + +/** + * \brief Write a boolean tag (#MBEDTLS_ASN1_BOOLEAN) and value + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param boolean The boolean value to write, either \c 0 or \c 1. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_bool( unsigned char **p, unsigned char *start, + int boolean ); + +/** + * \brief Write an int tag (#MBEDTLS_ASN1_INTEGER) and value + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param val The integer value to write. + * It must be non-negative. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_int( unsigned char **p, unsigned char *start, int val ); + +/** + * \brief Write an enum tag (#MBEDTLS_ASN1_ENUMERATED) and value + * in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param val The integer value to write. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_enum( unsigned char **p, unsigned char *start, int val ); + +/** + * \brief Write a string in ASN.1 format using a specific + * string encoding tag. + + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param tag The string encoding tag to write, e.g. + * #MBEDTLS_ASN1_UTF8_STRING. + * \param text The string to write. + * \param text_len The length of \p text in bytes (which might + * be strictly larger than the number of characters). + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_tagged_string( unsigned char **p, unsigned char *start, + int tag, const char *text, + size_t text_len ); + +/** + * \brief Write a string in ASN.1 format using the PrintableString + * string encoding tag (#MBEDTLS_ASN1_PRINTABLE_STRING). + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param text The string to write. + * \param text_len The length of \p text in bytes (which might + * be strictly larger than the number of characters). + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_printable_string( unsigned char **p, + unsigned char *start, + const char *text, size_t text_len ); + +/** + * \brief Write a UTF8 string in ASN.1 format using the UTF8String + * string encoding tag (#MBEDTLS_ASN1_UTF8_STRING). + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param text The string to write. + * \param text_len The length of \p text in bytes (which might + * be strictly larger than the number of characters). + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_utf8_string( unsigned char **p, unsigned char *start, + const char *text, size_t text_len ); + +/** + * \brief Write a string in ASN.1 format using the IA5String + * string encoding tag (#MBEDTLS_ASN1_IA5_STRING). + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param text The string to write. + * \param text_len The length of \p text in bytes (which might + * be strictly larger than the number of characters). + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_ia5_string( unsigned char **p, unsigned char *start, + const char *text, size_t text_len ); + +/** + * \brief Write a bitstring tag (#MBEDTLS_ASN1_BIT_STRING) and + * value in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param buf The bitstring to write. + * \param bits The total number of bits in the bitstring. + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_bitstring( unsigned char **p, unsigned char *start, + const unsigned char *buf, size_t bits ); + +/** + * \brief This function writes a named bitstring tag + * (#MBEDTLS_ASN1_BIT_STRING) and value in ASN.1 format. + * + * As stated in RFC 5280 Appendix B, trailing zeroes are + * omitted when encoding named bitstrings in DER. + * + * \note This function works backwards within the data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer which is used for bounds-checking. + * \param buf The bitstring to write. + * \param bits The total number of bits in the bitstring. + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_named_bitstring( unsigned char **p, + unsigned char *start, + const unsigned char *buf, + size_t bits ); + +/** + * \brief Write an octet string tag (#MBEDTLS_ASN1_OCTET_STRING) + * and value in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param buf The buffer holding the data to write. + * \param size The length of the data buffer \p buf. + * + * \return The number of bytes written to \p p on success. + * \return A negative error code on failure. + */ +int mbedtls_asn1_write_octet_string( unsigned char **p, unsigned char *start, + const unsigned char *buf, size_t size ); + +/** + * \brief Create or find a specific named_data entry for writing in a + * sequence or list based on the OID. If not already in there, + * a new entry is added to the head of the list. + * Warning: Destructive behaviour for the val data! + * + * \param list The pointer to the location of the head of the list to seek + * through (will be updated in case of a new entry). + * \param oid The OID to look for. + * \param oid_len The size of the OID. + * \param val The associated data to store. If this is \c NULL, + * no data is copied to the new or existing buffer. + * \param val_len The minimum length of the data buffer needed. + * If this is 0, do not allocate a buffer for the associated + * data. + * If the OID was already present, enlarge, shrink or free + * the existing buffer to fit \p val_len. + * + * \return A pointer to the new / existing entry on success. + * \return \c NULL if if there was a memory allocation error. + */ +mbedtls_asn1_named_data *mbedtls_asn1_store_named_data( mbedtls_asn1_named_data **list, + const char *oid, size_t oid_len, + const unsigned char *val, + size_t val_len ); + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_ASN1_WRITE_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/base64.h b/openharmony/armeabi-v7a/include/mbedtls/base64.h new file mode 100644 index 00000000..cf4149e7 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/base64.h @@ -0,0 +1,98 @@ +/** + * \file base64.h + * + * \brief RFC 1521 base64 encoding/decoding + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_BASE64_H +#define MBEDTLS_BASE64_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +/** Output buffer too small. */ +#define MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL -0x002A +/** Invalid character in input. */ +#define MBEDTLS_ERR_BASE64_INVALID_CHARACTER -0x002C + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Encode a buffer into base64 format + * + * \param dst destination buffer + * \param dlen size of the destination buffer + * \param olen number of bytes written + * \param src source buffer + * \param slen amount of data to be encoded + * + * \return 0 if successful, or MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL. + * *olen is always updated to reflect the amount + * of data that has (or would have) been written. + * If that length cannot be represented, then no data is + * written to the buffer and *olen is set to the maximum + * length representable as a size_t. + * + * \note Call this function with dlen = 0 to obtain the + * required buffer size in *olen + */ +int mbedtls_base64_encode( unsigned char *dst, size_t dlen, size_t *olen, + const unsigned char *src, size_t slen ); + +/** + * \brief Decode a base64-formatted buffer + * + * \param dst destination buffer (can be NULL for checking size) + * \param dlen size of the destination buffer + * \param olen number of bytes written + * \param src source buffer + * \param slen amount of data to be decoded + * + * \return 0 if successful, MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL, or + * MBEDTLS_ERR_BASE64_INVALID_CHARACTER if the input data is + * not correct. *olen is always updated to reflect the amount + * of data that has (or would have) been written. + * + * \note Call this function with *dst = NULL or dlen = 0 to obtain + * the required buffer size in *olen + */ +int mbedtls_base64_decode( unsigned char *dst, size_t dlen, size_t *olen, + const unsigned char *src, size_t slen ); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_base64_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* base64.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/bignum.h b/openharmony/armeabi-v7a/include/mbedtls/bignum.h new file mode 100644 index 00000000..dd594c51 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/bignum.h @@ -0,0 +1,1063 @@ +/** + * \file bignum.h + * + * \brief Multi-precision integer library + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_BIGNUM_H +#define MBEDTLS_BIGNUM_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +#if defined(MBEDTLS_FS_IO) +#include +#endif + +/** An error occurred while reading from or writing to a file. */ +#define MBEDTLS_ERR_MPI_FILE_IO_ERROR -0x0002 +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_MPI_BAD_INPUT_DATA -0x0004 +/** There is an invalid character in the digit string. */ +#define MBEDTLS_ERR_MPI_INVALID_CHARACTER -0x0006 +/** The buffer is too small to write to. */ +#define MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL -0x0008 +/** The input arguments are negative or result in illegal output. */ +#define MBEDTLS_ERR_MPI_NEGATIVE_VALUE -0x000A +/** The input argument for division is zero, which is not allowed. */ +#define MBEDTLS_ERR_MPI_DIVISION_BY_ZERO -0x000C +/** The input arguments are not acceptable. */ +#define MBEDTLS_ERR_MPI_NOT_ACCEPTABLE -0x000E +/** Memory allocation failed. */ +#define MBEDTLS_ERR_MPI_ALLOC_FAILED -0x0010 + +#define MBEDTLS_MPI_CHK(f) \ + do \ + { \ + if( ( ret = (f) ) != 0 ) \ + goto cleanup; \ + } while( 0 ) + +/* + * Maximum size MPIs are allowed to grow to in number of limbs. + */ +#define MBEDTLS_MPI_MAX_LIMBS 10000 + +#if !defined(MBEDTLS_MPI_WINDOW_SIZE) +/* + * Maximum window size used for modular exponentiation. Default: 6 + * Minimum value: 1. Maximum value: 6. + * + * Result is an array of ( 2 ** MBEDTLS_MPI_WINDOW_SIZE ) MPIs used + * for the sliding window calculation. (So 64 by default) + * + * Reduction in size, reduces speed. + */ +#define MBEDTLS_MPI_WINDOW_SIZE 6 /**< Maximum window size used. */ +#endif /* !MBEDTLS_MPI_WINDOW_SIZE */ + +#if !defined(MBEDTLS_MPI_MAX_SIZE) +/* + * Maximum size of MPIs allowed in bits and bytes for user-MPIs. + * ( Default: 512 bytes => 4096 bits, Maximum tested: 2048 bytes => 16384 bits ) + * + * Note: Calculations can temporarily result in larger MPIs. So the number + * of limbs required (MBEDTLS_MPI_MAX_LIMBS) is higher. + */ +#define MBEDTLS_MPI_MAX_SIZE 1024 /**< Maximum number of bytes for usable MPIs. */ +#endif /* !MBEDTLS_MPI_MAX_SIZE */ + +#define MBEDTLS_MPI_MAX_BITS ( 8 * MBEDTLS_MPI_MAX_SIZE ) /**< Maximum number of bits for usable MPIs. */ + +/* + * When reading from files with mbedtls_mpi_read_file() and writing to files with + * mbedtls_mpi_write_file() the buffer should have space + * for a (short) label, the MPI (in the provided radix), the newline + * characters and the '\0'. + * + * By default we assume at least a 10 char label, a minimum radix of 10 + * (decimal) and a maximum of 4096 bit numbers (1234 decimal chars). + * Autosized at compile time for at least a 10 char label, a minimum radix + * of 10 (decimal) for a number of MBEDTLS_MPI_MAX_BITS size. + * + * This used to be statically sized to 1250 for a maximum of 4096 bit + * numbers (1234 decimal chars). + * + * Calculate using the formula: + * MBEDTLS_MPI_RW_BUFFER_SIZE = ceil(MBEDTLS_MPI_MAX_BITS / ln(10) * ln(2)) + + * LabelSize + 6 + */ +#define MBEDTLS_MPI_MAX_BITS_SCALE100 ( 100 * MBEDTLS_MPI_MAX_BITS ) +#define MBEDTLS_LN_2_DIV_LN_10_SCALE100 332 +#define MBEDTLS_MPI_RW_BUFFER_SIZE ( ((MBEDTLS_MPI_MAX_BITS_SCALE100 + MBEDTLS_LN_2_DIV_LN_10_SCALE100 - 1) / MBEDTLS_LN_2_DIV_LN_10_SCALE100) + 10 + 6 ) + +/* + * Define the base integer type, architecture-wise. + * + * 32 or 64-bit integer types can be forced regardless of the underlying + * architecture by defining MBEDTLS_HAVE_INT32 or MBEDTLS_HAVE_INT64 + * respectively and undefining MBEDTLS_HAVE_ASM. + * + * Double-width integers (e.g. 128-bit in 64-bit architectures) can be + * disabled by defining MBEDTLS_NO_UDBL_DIVISION. + */ +#if !defined(MBEDTLS_HAVE_INT32) + #if defined(_MSC_VER) && defined(_M_AMD64) + /* Always choose 64-bit when using MSC */ + #if !defined(MBEDTLS_HAVE_INT64) + #define MBEDTLS_HAVE_INT64 + #endif /* !MBEDTLS_HAVE_INT64 */ + typedef int64_t mbedtls_mpi_sint; + typedef uint64_t mbedtls_mpi_uint; + #elif defined(__GNUC__) && ( \ + defined(__amd64__) || defined(__x86_64__) || \ + defined(__ppc64__) || defined(__powerpc64__) || \ + defined(__ia64__) || defined(__alpha__) || \ + ( defined(__sparc__) && defined(__arch64__) ) || \ + defined(__s390x__) || defined(__mips64) || \ + defined(__aarch64__) ) + #if !defined(MBEDTLS_HAVE_INT64) + #define MBEDTLS_HAVE_INT64 + #endif /* MBEDTLS_HAVE_INT64 */ + typedef int64_t mbedtls_mpi_sint; + typedef uint64_t mbedtls_mpi_uint; + #if !defined(MBEDTLS_NO_UDBL_DIVISION) + /* mbedtls_t_udbl defined as 128-bit unsigned int */ + typedef unsigned int mbedtls_t_udbl __attribute__((mode(TI))); + #define MBEDTLS_HAVE_UDBL + #endif /* !MBEDTLS_NO_UDBL_DIVISION */ + #elif defined(__ARMCC_VERSION) && defined(__aarch64__) + /* + * __ARMCC_VERSION is defined for both armcc and armclang and + * __aarch64__ is only defined by armclang when compiling 64-bit code + */ + #if !defined(MBEDTLS_HAVE_INT64) + #define MBEDTLS_HAVE_INT64 + #endif /* !MBEDTLS_HAVE_INT64 */ + typedef int64_t mbedtls_mpi_sint; + typedef uint64_t mbedtls_mpi_uint; + #if !defined(MBEDTLS_NO_UDBL_DIVISION) + /* mbedtls_t_udbl defined as 128-bit unsigned int */ + typedef __uint128_t mbedtls_t_udbl; + #define MBEDTLS_HAVE_UDBL + #endif /* !MBEDTLS_NO_UDBL_DIVISION */ + #elif defined(MBEDTLS_HAVE_INT64) + /* Force 64-bit integers with unknown compiler */ + typedef int64_t mbedtls_mpi_sint; + typedef uint64_t mbedtls_mpi_uint; + #endif +#endif /* !MBEDTLS_HAVE_INT32 */ + +#if !defined(MBEDTLS_HAVE_INT64) + /* Default to 32-bit compilation */ + #if !defined(MBEDTLS_HAVE_INT32) + #define MBEDTLS_HAVE_INT32 + #endif /* !MBEDTLS_HAVE_INT32 */ + typedef int32_t mbedtls_mpi_sint; + typedef uint32_t mbedtls_mpi_uint; + #if !defined(MBEDTLS_NO_UDBL_DIVISION) + typedef uint64_t mbedtls_t_udbl; + #define MBEDTLS_HAVE_UDBL + #endif /* !MBEDTLS_NO_UDBL_DIVISION */ +#endif /* !MBEDTLS_HAVE_INT64 */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief MPI structure + */ +typedef struct mbedtls_mpi +{ + int s; /*!< Sign: -1 if the mpi is negative, 1 otherwise */ + size_t n; /*!< total # of limbs */ + mbedtls_mpi_uint *p; /*!< pointer to limbs */ +} +mbedtls_mpi; + +/** + * \brief Initialize an MPI context. + * + * This makes the MPI ready to be set or freed, + * but does not define a value for the MPI. + * + * \param X The MPI context to initialize. This must not be \c NULL. + */ +void mbedtls_mpi_init( mbedtls_mpi *X ); + +/** + * \brief This function frees the components of an MPI context. + * + * \param X The MPI context to be cleared. This may be \c NULL, + * in which case this function is a no-op. If it is + * not \c NULL, it must point to an initialized MPI. + */ +void mbedtls_mpi_free( mbedtls_mpi *X ); + +/** + * \brief Enlarge an MPI to the specified number of limbs. + * + * \note This function does nothing if the MPI is + * already large enough. + * + * \param X The MPI to grow. It must be initialized. + * \param nblimbs The target number of limbs. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_grow( mbedtls_mpi *X, size_t nblimbs ); + +/** + * \brief This function resizes an MPI downwards, keeping at least the + * specified number of limbs. + * + * If \c X is smaller than \c nblimbs, it is resized up + * instead. + * + * \param X The MPI to shrink. This must point to an initialized MPI. + * \param nblimbs The minimum number of limbs to keep. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed + * (this can only happen when resizing up). + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_shrink( mbedtls_mpi *X, size_t nblimbs ); + +/** + * \brief Make a copy of an MPI. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param Y The source MPI. This must point to an initialized MPI. + * + * \note The limb-buffer in the destination MPI is enlarged + * if necessary to hold the value in the source MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_copy( mbedtls_mpi *X, const mbedtls_mpi *Y ); + +/** + * \brief Swap the contents of two MPIs. + * + * \param X The first MPI. It must be initialized. + * \param Y The second MPI. It must be initialized. + */ +void mbedtls_mpi_swap( mbedtls_mpi *X, mbedtls_mpi *Y ); + +/** + * \brief Perform a safe conditional copy of MPI which doesn't + * reveal whether the condition was true or not. + * + * \param X The MPI to conditionally assign to. This must point + * to an initialized MPI. + * \param Y The MPI to be assigned from. This must point to an + * initialized MPI. + * \param assign The condition deciding whether to perform the + * assignment or not. Possible values: + * * \c 1: Perform the assignment `X = Y`. + * * \c 0: Keep the original value of \p X. + * + * \note This function is equivalent to + * `if( assign ) mbedtls_mpi_copy( X, Y );` + * except that it avoids leaking any information about whether + * the assignment was done or not (the above code may leak + * information through branch prediction and/or memory access + * patterns analysis). + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_safe_cond_assign( mbedtls_mpi *X, const mbedtls_mpi *Y, unsigned char assign ); + +/** + * \brief Perform a safe conditional swap which doesn't + * reveal whether the condition was true or not. + * + * \param X The first MPI. This must be initialized. + * \param Y The second MPI. This must be initialized. + * \param assign The condition deciding whether to perform + * the swap or not. Possible values: + * * \c 1: Swap the values of \p X and \p Y. + * * \c 0: Keep the original values of \p X and \p Y. + * + * \note This function is equivalent to + * if( assign ) mbedtls_mpi_swap( X, Y ); + * except that it avoids leaking any information about whether + * the assignment was done or not (the above code may leak + * information through branch prediction and/or memory access + * patterns analysis). + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + * + */ +int mbedtls_mpi_safe_cond_swap( mbedtls_mpi *X, mbedtls_mpi *Y, unsigned char assign ); + +/** + * \brief Store integer value in MPI. + * + * \param X The MPI to set. This must be initialized. + * \param z The value to use. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_lset( mbedtls_mpi *X, mbedtls_mpi_sint z ); + +/** + * \brief Get a specific bit from an MPI. + * + * \param X The MPI to query. This must be initialized. + * \param pos Zero-based index of the bit to query. + * + * \return \c 0 or \c 1 on success, depending on whether bit \c pos + * of \c X is unset or set. + * \return A negative error code on failure. + */ +int mbedtls_mpi_get_bit( const mbedtls_mpi *X, size_t pos ); + +/** + * \brief Modify a specific bit in an MPI. + * + * \note This function will grow the target MPI if necessary to set a + * bit to \c 1 in a not yet existing limb. It will not grow if + * the bit should be set to \c 0. + * + * \param X The MPI to modify. This must be initialized. + * \param pos Zero-based index of the bit to modify. + * \param val The desired value of bit \c pos: \c 0 or \c 1. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_set_bit( mbedtls_mpi *X, size_t pos, unsigned char val ); + +/** + * \brief Return the number of bits of value \c 0 before the + * least significant bit of value \c 1. + * + * \note This is the same as the zero-based index of + * the least significant bit of value \c 1. + * + * \param X The MPI to query. + * + * \return The number of bits of value \c 0 before the least significant + * bit of value \c 1 in \p X. + */ +size_t mbedtls_mpi_lsb( const mbedtls_mpi *X ); + +/** + * \brief Return the number of bits up to and including the most + * significant bit of value \c 1. + * + * * \note This is same as the one-based index of the most + * significant bit of value \c 1. + * + * \param X The MPI to query. This must point to an initialized MPI. + * + * \return The number of bits up to and including the most + * significant bit of value \c 1. + */ +size_t mbedtls_mpi_bitlen( const mbedtls_mpi *X ); + +/** + * \brief Return the total size of an MPI value in bytes. + * + * \param X The MPI to use. This must point to an initialized MPI. + * + * \note The value returned by this function may be less than + * the number of bytes used to store \p X internally. + * This happens if and only if there are trailing bytes + * of value zero. + * + * \return The least number of bytes capable of storing + * the absolute value of \p X. + */ +size_t mbedtls_mpi_size( const mbedtls_mpi *X ); + +/** + * \brief Import an MPI from an ASCII string. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param radix The numeric base of the input string. + * \param s Null-terminated string buffer. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_mpi_read_string( mbedtls_mpi *X, int radix, const char *s ); + +/** + * \brief Export an MPI to an ASCII string. + * + * \param X The source MPI. This must point to an initialized MPI. + * \param radix The numeric base of the output string. + * \param buf The buffer to write the string to. This must be writable + * buffer of length \p buflen Bytes. + * \param buflen The available size in Bytes of \p buf. + * \param olen The address at which to store the length of the string + * written, including the final \c NULL byte. This must + * not be \c NULL. + * + * \note You can call this function with `buflen == 0` to obtain the + * minimum required buffer size in `*olen`. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if the target buffer \p buf + * is too small to hold the value of \p X in the desired base. + * In this case, `*olen` is nonetheless updated to contain the + * size of \p buf required for a successful call. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_write_string( const mbedtls_mpi *X, int radix, + char *buf, size_t buflen, size_t *olen ); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief Read an MPI from a line in an opened file. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param radix The numeric base of the string representation used + * in the source line. + * \param fin The input file handle to use. This must not be \c NULL. + * + * \note On success, this function advances the file stream + * to the end of the current line or to EOF. + * + * The function returns \c 0 on an empty line. + * + * Leading whitespaces are ignored, as is a + * '0x' prefix for radix \c 16. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if the file read buffer + * is too small. + * \return Another negative error code on failure. + */ +int mbedtls_mpi_read_file( mbedtls_mpi *X, int radix, FILE *fin ); + +/** + * \brief Export an MPI into an opened file. + * + * \param p A string prefix to emit prior to the MPI data. + * For example, this might be a label, or "0x" when + * printing in base \c 16. This may be \c NULL if no prefix + * is needed. + * \param X The source MPI. This must point to an initialized MPI. + * \param radix The numeric base to be used in the emitted string. + * \param fout The output file handle. This may be \c NULL, in which case + * the output is written to \c stdout. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_mpi_write_file( const char *p, const mbedtls_mpi *X, + int radix, FILE *fout ); +#endif /* MBEDTLS_FS_IO */ + +/** + * \brief Import an MPI from unsigned big endian binary data. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param buf The input buffer. This must be a readable buffer of length + * \p buflen Bytes. + * \param buflen The length of the input buffer \p p in Bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_read_binary( mbedtls_mpi *X, const unsigned char *buf, + size_t buflen ); + +/** + * \brief Import X from unsigned binary data, little endian + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param buf The input buffer. This must be a readable buffer of length + * \p buflen Bytes. + * \param buflen The length of the input buffer \p p in Bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_read_binary_le( mbedtls_mpi *X, + const unsigned char *buf, size_t buflen ); + +/** + * \brief Export X into unsigned binary data, big endian. + * Always fills the whole buffer, which will start with zeros + * if the number is smaller. + * + * \param X The source MPI. This must point to an initialized MPI. + * \param buf The output buffer. This must be a writable buffer of length + * \p buflen Bytes. + * \param buflen The size of the output buffer \p buf in Bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if \p buf isn't + * large enough to hold the value of \p X. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_write_binary( const mbedtls_mpi *X, unsigned char *buf, + size_t buflen ); + +/** + * \brief Export X into unsigned binary data, little endian. + * Always fills the whole buffer, which will end with zeros + * if the number is smaller. + * + * \param X The source MPI. This must point to an initialized MPI. + * \param buf The output buffer. This must be a writable buffer of length + * \p buflen Bytes. + * \param buflen The size of the output buffer \p buf in Bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if \p buf isn't + * large enough to hold the value of \p X. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_write_binary_le( const mbedtls_mpi *X, + unsigned char *buf, size_t buflen ); + +/** + * \brief Perform a left-shift on an MPI: X <<= count + * + * \param X The MPI to shift. This must point to an initialized MPI. + * \param count The number of bits to shift by. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_shift_l( mbedtls_mpi *X, size_t count ); + +/** + * \brief Perform a right-shift on an MPI: X >>= count + * + * \param X The MPI to shift. This must point to an initialized MPI. + * \param count The number of bits to shift by. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_shift_r( mbedtls_mpi *X, size_t count ); + +/** + * \brief Compare the absolute values of two MPIs. + * + * \param X The left-hand MPI. This must point to an initialized MPI. + * \param Y The right-hand MPI. This must point to an initialized MPI. + * + * \return \c 1 if `|X|` is greater than `|Y|`. + * \return \c -1 if `|X|` is lesser than `|Y|`. + * \return \c 0 if `|X|` is equal to `|Y|`. + */ +int mbedtls_mpi_cmp_abs( const mbedtls_mpi *X, const mbedtls_mpi *Y ); + +/** + * \brief Compare two MPIs. + * + * \param X The left-hand MPI. This must point to an initialized MPI. + * \param Y The right-hand MPI. This must point to an initialized MPI. + * + * \return \c 1 if \p X is greater than \p Y. + * \return \c -1 if \p X is lesser than \p Y. + * \return \c 0 if \p X is equal to \p Y. + */ +int mbedtls_mpi_cmp_mpi( const mbedtls_mpi *X, const mbedtls_mpi *Y ); + +/** + * \brief Check if an MPI is less than the other in constant time. + * + * \param X The left-hand MPI. This must point to an initialized MPI + * with the same allocated length as Y. + * \param Y The right-hand MPI. This must point to an initialized MPI + * with the same allocated length as X. + * \param ret The result of the comparison: + * \c 1 if \p X is less than \p Y. + * \c 0 if \p X is greater than or equal to \p Y. + * + * \return 0 on success. + * \return MBEDTLS_ERR_MPI_BAD_INPUT_DATA if the allocated length of + * the two input MPIs is not the same. + */ +int mbedtls_mpi_lt_mpi_ct( const mbedtls_mpi *X, const mbedtls_mpi *Y, + unsigned *ret ); + +/** + * \brief Compare an MPI with an integer. + * + * \param X The left-hand MPI. This must point to an initialized MPI. + * \param z The integer value to compare \p X to. + * + * \return \c 1 if \p X is greater than \p z. + * \return \c -1 if \p X is lesser than \p z. + * \return \c 0 if \p X is equal to \p z. + */ +int mbedtls_mpi_cmp_int( const mbedtls_mpi *X, mbedtls_mpi_sint z ); + +/** + * \brief Perform an unsigned addition of MPIs: X = |A| + |B| + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The first summand. This must point to an initialized MPI. + * \param B The second summand. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_add_abs( mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *B ); + +/** + * \brief Perform an unsigned subtraction of MPIs: X = |A| - |B| + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The minuend. This must point to an initialized MPI. + * \param B The subtrahend. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_NEGATIVE_VALUE if \p B is greater than \p A. + * \return Another negative error code on different kinds of failure. + * + */ +int mbedtls_mpi_sub_abs( mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *B ); + +/** + * \brief Perform a signed addition of MPIs: X = A + B + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The first summand. This must point to an initialized MPI. + * \param B The second summand. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_add_mpi( mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *B ); + +/** + * \brief Perform a signed subtraction of MPIs: X = A - B + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The minuend. This must point to an initialized MPI. + * \param B The subtrahend. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_sub_mpi( mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *B ); + +/** + * \brief Perform a signed addition of an MPI and an integer: X = A + b + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The first summand. This must point to an initialized MPI. + * \param b The second summand. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_add_int( mbedtls_mpi *X, const mbedtls_mpi *A, + mbedtls_mpi_sint b ); + +/** + * \brief Perform a signed subtraction of an MPI and an integer: + * X = A - b + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The minuend. This must point to an initialized MPI. + * \param b The subtrahend. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_sub_int( mbedtls_mpi *X, const mbedtls_mpi *A, + mbedtls_mpi_sint b ); + +/** + * \brief Perform a multiplication of two MPIs: X = A * B + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The first factor. This must point to an initialized MPI. + * \param B The second factor. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + * + */ +int mbedtls_mpi_mul_mpi( mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *B ); + +/** + * \brief Perform a multiplication of an MPI with an unsigned integer: + * X = A * b + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The first factor. This must point to an initialized MPI. + * \param b The second factor. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + * + */ +int mbedtls_mpi_mul_int( mbedtls_mpi *X, const mbedtls_mpi *A, + mbedtls_mpi_uint b ); + +/** + * \brief Perform a division with remainder of two MPIs: + * A = Q * B + R + * + * \param Q The destination MPI for the quotient. + * This may be \c NULL if the value of the + * quotient is not needed. + * \param R The destination MPI for the remainder value. + * This may be \c NULL if the value of the + * remainder is not needed. + * \param A The dividend. This must point to an initialized MPi. + * \param B The divisor. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p B equals zero. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_div_mpi( mbedtls_mpi *Q, mbedtls_mpi *R, const mbedtls_mpi *A, + const mbedtls_mpi *B ); + +/** + * \brief Perform a division with remainder of an MPI by an integer: + * A = Q * b + R + * + * \param Q The destination MPI for the quotient. + * This may be \c NULL if the value of the + * quotient is not needed. + * \param R The destination MPI for the remainder value. + * This may be \c NULL if the value of the + * remainder is not needed. + * \param A The dividend. This must point to an initialized MPi. + * \param b The divisor. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p b equals zero. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_div_int( mbedtls_mpi *Q, mbedtls_mpi *R, const mbedtls_mpi *A, + mbedtls_mpi_sint b ); + +/** + * \brief Perform a modular reduction. R = A mod B + * + * \param R The destination MPI for the residue value. + * This must point to an initialized MPI. + * \param A The MPI to compute the residue of. + * This must point to an initialized MPI. + * \param B The base of the modular reduction. + * This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p B equals zero. + * \return #MBEDTLS_ERR_MPI_NEGATIVE_VALUE if \p B is negative. + * \return Another negative error code on different kinds of failure. + * + */ +int mbedtls_mpi_mod_mpi( mbedtls_mpi *R, const mbedtls_mpi *A, + const mbedtls_mpi *B ); + +/** + * \brief Perform a modular reduction with respect to an integer. + * r = A mod b + * + * \param r The address at which to store the residue. + * This must not be \c NULL. + * \param A The MPI to compute the residue of. + * This must point to an initialized MPi. + * \param b The integer base of the modular reduction. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_DIVISION_BY_ZERO if \p b equals zero. + * \return #MBEDTLS_ERR_MPI_NEGATIVE_VALUE if \p b is negative. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_mod_int( mbedtls_mpi_uint *r, const mbedtls_mpi *A, + mbedtls_mpi_sint b ); + +/** + * \brief Perform a sliding-window exponentiation: X = A^E mod N + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The base of the exponentiation. + * This must point to an initialized MPI. + * \param E The exponent MPI. This must point to an initialized MPI. + * \param N The base for the modular reduction. This must point to an + * initialized MPI. + * \param prec_RR A helper MPI depending solely on \p N which can be used to + * speed-up multiple modular exponentiations for the same value + * of \p N. This may be \c NULL. If it is not \c NULL, it must + * point to an initialized MPI. If it hasn't been used after + * the call to mbedtls_mpi_init(), this function will compute + * the helper value and store it in \p prec_RR for reuse on + * subsequent calls to this function. Otherwise, the function + * will assume that \p prec_RR holds the helper value set by a + * previous call to mbedtls_mpi_exp_mod(), and reuse it. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \c N is negative or + * even, or if \c E is negative. + * \return Another negative error code on different kinds of failures. + * + */ +int mbedtls_mpi_exp_mod( mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *E, const mbedtls_mpi *N, + mbedtls_mpi *prec_RR ); + +/** + * \brief Fill an MPI with a number of random bytes. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param size The number of random bytes to generate. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on failure. + * + * \note The bytes obtained from the RNG are interpreted + * as a big-endian representation of an MPI; this can + * be relevant in applications like deterministic ECDSA. + */ +int mbedtls_mpi_fill_random( mbedtls_mpi *X, size_t size, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** Generate a random number uniformly in a range. + * + * This function generates a random number between \p min inclusive and + * \p N exclusive. + * + * The procedure complies with RFC 6979 §3.3 (deterministic ECDSA) + * when the RNG is a suitably parametrized instance of HMAC_DRBG + * and \p min is \c 1. + * + * \note There are `N - min` possible outputs. The lower bound + * \p min can be reached, but the upper bound \p N cannot. + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param min The minimum value to return. + * It must be nonnegative. + * \param N The upper bound of the range, exclusive. + * In other words, this is one plus the maximum value to return. + * \p N must be strictly larger than \p min. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p min or \p N is invalid + * or if they are incompatible. + * \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if the implementation was + * unable to find a suitable value within a limited number + * of attempts. This has a negligible probability if \p N + * is significantly larger than \p min, which is the case + * for all usual cryptographic applications. + * \return Another negative error code on failure. + */ +int mbedtls_mpi_random( mbedtls_mpi *X, + mbedtls_mpi_sint min, + const mbedtls_mpi *N, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief Compute the greatest common divisor: G = gcd(A, B) + * + * \param G The destination MPI. This must point to an initialized MPI. + * \param A The first operand. This must point to an initialized MPI. + * \param B The second operand. This must point to an initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_mpi_gcd( mbedtls_mpi *G, const mbedtls_mpi *A, + const mbedtls_mpi *B ); + +/** + * \brief Compute the modular inverse: X = A^-1 mod N + * + * \param X The destination MPI. This must point to an initialized MPI. + * \param A The MPI to calculate the modular inverse of. This must point + * to an initialized MPI. + * \param N The base of the modular inversion. This must point to an + * initialized MPI. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p N is less than + * or equal to one. + * \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p has no modular inverse + * with respect to \p N. + */ +int mbedtls_mpi_inv_mod( mbedtls_mpi *X, const mbedtls_mpi *A, + const mbedtls_mpi *N ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief Perform a Miller-Rabin primality test with error + * probability of 2-80. + * + * \deprecated Superseded by mbedtls_mpi_is_prime_ext() which allows + * specifying the number of Miller-Rabin rounds. + * + * \param X The MPI to check for primality. + * This must point to an initialized MPI. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. + * This may be \c NULL if \p f_rng doesn't use a + * context parameter. + * + * \return \c 0 if successful, i.e. \p X is probably prime. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p X is not prime. + * \return Another negative error code on other kinds of failure. + */ +MBEDTLS_DEPRECATED int mbedtls_mpi_is_prime( const mbedtls_mpi *X, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief Miller-Rabin primality test. + * + * \warning If \p X is potentially generated by an adversary, for example + * when validating cryptographic parameters that you didn't + * generate yourself and that are supposed to be prime, then + * \p rounds should be at least the half of the security + * strength of the cryptographic algorithm. On the other hand, + * if \p X is chosen uniformly or non-adversarially (as is the + * case when mbedtls_mpi_gen_prime calls this function), then + * \p rounds can be much lower. + * + * \param X The MPI to check for primality. + * This must point to an initialized MPI. + * \param rounds The number of bases to perform the Miller-Rabin primality + * test for. The probability of returning 0 on a composite is + * at most 2-2*\p rounds. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. + * This may be \c NULL if \p f_rng doesn't use + * a context parameter. + * + * \return \c 0 if successful, i.e. \p X is probably prime. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p X is not prime. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_mpi_is_prime_ext( const mbedtls_mpi *X, int rounds, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); +/** + * \brief Flags for mbedtls_mpi_gen_prime() + * + * Each of these flags is a constraint on the result X returned by + * mbedtls_mpi_gen_prime(). + */ +typedef enum { + MBEDTLS_MPI_GEN_PRIME_FLAG_DH = 0x0001, /**< (X-1)/2 is prime too */ + MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR = 0x0002, /**< lower error rate from 2-80 to 2-128 */ +} mbedtls_mpi_gen_prime_flag_t; + +/** + * \brief Generate a prime number. + * + * \param X The destination MPI to store the generated prime in. + * This must point to an initialized MPi. + * \param nbits The required size of the destination MPI in bits. + * This must be between \c 3 and #MBEDTLS_MPI_MAX_BITS. + * \param flags A mask of flags of type #mbedtls_mpi_gen_prime_flag_t. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. + * This may be \c NULL if \p f_rng doesn't use + * a context parameter. + * + * \return \c 0 if successful, in which case \p X holds a + * probably prime number. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. + * \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if `nbits` is not between + * \c 3 and #MBEDTLS_MPI_MAX_BITS. + */ +int mbedtls_mpi_gen_prime( mbedtls_mpi *X, size_t nbits, int flags, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_mpi_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* bignum.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/blowfish.h b/openharmony/armeabi-v7a/include/mbedtls/blowfish.h new file mode 100644 index 00000000..d5f80992 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/blowfish.h @@ -0,0 +1,288 @@ +/** + * \file blowfish.h + * + * \brief Blowfish block cipher + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_BLOWFISH_H +#define MBEDTLS_BLOWFISH_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +#include "mbedtls/platform_util.h" + +#define MBEDTLS_BLOWFISH_ENCRYPT 1 +#define MBEDTLS_BLOWFISH_DECRYPT 0 +#define MBEDTLS_BLOWFISH_MAX_KEY_BITS 448 +#define MBEDTLS_BLOWFISH_MIN_KEY_BITS 32 +#define MBEDTLS_BLOWFISH_ROUNDS 16 /**< Rounds to use. When increasing this value, make sure to extend the initialisation vectors */ +#define MBEDTLS_BLOWFISH_BLOCKSIZE 8 /* Blowfish uses 64 bit blocks */ + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#define MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( -0x0016 ) +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ +/** Bad input data. */ +#define MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA -0x0016 + +/** Invalid data input length. */ +#define MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH -0x0018 + +/* MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED is deprecated and should not be used. + */ +/** Blowfish hardware accelerator failed. */ +#define MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED -0x0017 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_BLOWFISH_ALT) +// Regular implementation +// + +/** + * \brief Blowfish context structure + */ +typedef struct mbedtls_blowfish_context +{ + uint32_t P[MBEDTLS_BLOWFISH_ROUNDS + 2]; /*!< Blowfish round keys */ + uint32_t S[4][256]; /*!< key dependent S-boxes */ +} +mbedtls_blowfish_context; + +#else /* MBEDTLS_BLOWFISH_ALT */ +#include "blowfish_alt.h" +#endif /* MBEDTLS_BLOWFISH_ALT */ + +/** + * \brief Initialize a Blowfish context. + * + * \param ctx The Blowfish context to be initialized. + * This must not be \c NULL. + */ +void mbedtls_blowfish_init( mbedtls_blowfish_context *ctx ); + +/** + * \brief Clear a Blowfish context. + * + * \param ctx The Blowfish context to be cleared. + * This may be \c NULL, in which case this function + * returns immediately. If it is not \c NULL, it must + * point to an initialized Blowfish context. + */ +void mbedtls_blowfish_free( mbedtls_blowfish_context *ctx ); + +/** + * \brief Perform a Blowfish key schedule operation. + * + * \param ctx The Blowfish context to perform the key schedule on. + * \param key The encryption key. This must be a readable buffer of + * length \p keybits Bits. + * \param keybits The length of \p key in Bits. This must be between + * \c 32 and \c 448 and a multiple of \c 8. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_blowfish_setkey( mbedtls_blowfish_context *ctx, const unsigned char *key, + unsigned int keybits ); + +/** + * \brief Perform a Blowfish-ECB block encryption/decryption operation. + * + * \param ctx The Blowfish context to use. This must be initialized + * and bound to a key. + * \param mode The mode of operation. Possible values are + * #MBEDTLS_BLOWFISH_ENCRYPT for encryption, or + * #MBEDTLS_BLOWFISH_DECRYPT for decryption. + * \param input The input block. This must be a readable buffer + * of size \c 8 Bytes. + * \param output The output block. This must be a writable buffer + * of size \c 8 Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_blowfish_crypt_ecb( mbedtls_blowfish_context *ctx, + int mode, + const unsigned char input[MBEDTLS_BLOWFISH_BLOCKSIZE], + unsigned char output[MBEDTLS_BLOWFISH_BLOCKSIZE] ); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief Perform a Blowfish-CBC buffer encryption/decryption operation. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the function same function again on the following + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If on the other hand you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * \param ctx The Blowfish context to use. This must be initialized + * and bound to a key. + * \param mode The mode of operation. Possible values are + * #MBEDTLS_BLOWFISH_ENCRYPT for encryption, or + * #MBEDTLS_BLOWFISH_DECRYPT for decryption. + * \param length The length of the input data in Bytes. This must be + * multiple of \c 8. + * \param iv The initialization vector. This must be a read/write buffer + * of length \c 8 Bytes. It is updated by this function. + * \param input The input data. This must be a readable buffer of length + * \p length Bytes. + * \param output The output data. This must be a writable buffer of length + * \p length Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_blowfish_crypt_cbc( mbedtls_blowfish_context *ctx, + int mode, + size_t length, + unsigned char iv[MBEDTLS_BLOWFISH_BLOCKSIZE], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +#if defined(MBEDTLS_CIPHER_MODE_CFB) +/** + * \brief Perform a Blowfish CFB buffer encryption/decryption operation. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the function same function again on the following + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If on the other hand you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * \param ctx The Blowfish context to use. This must be initialized + * and bound to a key. + * \param mode The mode of operation. Possible values are + * #MBEDTLS_BLOWFISH_ENCRYPT for encryption, or + * #MBEDTLS_BLOWFISH_DECRYPT for decryption. + * \param length The length of the input data in Bytes. + * \param iv_off The offset in the initialization vector. + * The value pointed to must be smaller than \c 8 Bytes. + * It is updated by this function to support the aforementioned + * streaming usage. + * \param iv The initialization vector. This must be a read/write buffer + * of size \c 8 Bytes. It is updated after use. + * \param input The input data. This must be a readable buffer of length + * \p length Bytes. + * \param output The output data. This must be a writable buffer of length + * \p length Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_blowfish_crypt_cfb64( mbedtls_blowfish_context *ctx, + int mode, + size_t length, + size_t *iv_off, + unsigned char iv[MBEDTLS_BLOWFISH_BLOCKSIZE], + const unsigned char *input, + unsigned char *output ); +#endif /*MBEDTLS_CIPHER_MODE_CFB */ + +#if defined(MBEDTLS_CIPHER_MODE_CTR) +/** + * \brief Perform a Blowfish-CTR buffer encryption/decryption operation. + * + * \warning You must never reuse a nonce value with the same key. Doing so + * would void the encryption for the two messages encrypted with + * the same nonce and key. + * + * There are two common strategies for managing nonces with CTR: + * + * 1. You can handle everything as a single message processed over + * successive calls to this function. In that case, you want to + * set \p nonce_counter and \p nc_off to 0 for the first call, and + * then preserve the values of \p nonce_counter, \p nc_off and \p + * stream_block across calls to this function as they will be + * updated by this function. + * + * With this strategy, you must not encrypt more than 2**64 + * blocks of data with the same key. + * + * 2. You can encrypt separate messages by dividing the \p + * nonce_counter buffer in two areas: the first one used for a + * per-message nonce, handled by yourself, and the second one + * updated by this function internally. + * + * For example, you might reserve the first 4 bytes for the + * per-message nonce, and the last 4 bytes for internal use. In that + * case, before calling this function on a new message you need to + * set the first 4 bytes of \p nonce_counter to your chosen nonce + * value, the last 4 to 0, and \p nc_off to 0 (which will cause \p + * stream_block to be ignored). That way, you can encrypt at most + * 2**32 messages of up to 2**32 blocks each with the same key. + * + * The per-message nonce (or information sufficient to reconstruct + * it) needs to be communicated with the ciphertext and must be unique. + * The recommended way to ensure uniqueness is to use a message + * counter. + * + * Note that for both strategies, sizes are measured in blocks and + * that a Blowfish block is 8 bytes. + * + * \warning Upon return, \p stream_block contains sensitive data. Its + * content must not be written to insecure storage and should be + * securely discarded as soon as it's no longer needed. + * + * \param ctx The Blowfish context to use. This must be initialized + * and bound to a key. + * \param length The length of the input data in Bytes. + * \param nc_off The offset in the current stream_block (for resuming + * within current cipher stream). The offset pointer + * should be \c 0 at the start of a stream and must be + * smaller than \c 8. It is updated by this function. + * \param nonce_counter The 64-bit nonce and counter. This must point to a + * read/write buffer of length \c 8 Bytes. + * \param stream_block The saved stream-block for resuming. This must point to + * a read/write buffer of length \c 8 Bytes. + * \param input The input data. This must be a readable buffer of + * length \p length Bytes. + * \param output The output data. This must be a writable buffer of + * length \p length Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_blowfish_crypt_ctr( mbedtls_blowfish_context *ctx, + size_t length, + size_t *nc_off, + unsigned char nonce_counter[MBEDTLS_BLOWFISH_BLOCKSIZE], + unsigned char stream_block[MBEDTLS_BLOWFISH_BLOCKSIZE], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CTR */ + +#ifdef __cplusplus +} +#endif + +#endif /* blowfish.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/bn_mul.h b/openharmony/armeabi-v7a/include/mbedtls/bn_mul.h new file mode 100644 index 00000000..31137cd4 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/bn_mul.h @@ -0,0 +1,978 @@ +/** + * \file bn_mul.h + * + * \brief Multi-precision integer library + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * Multiply source vector [s] with b, add result + * to destination vector [d] and set carry c. + * + * Currently supports: + * + * . IA-32 (386+) . AMD64 / EM64T + * . IA-32 (SSE2) . Motorola 68000 + * . PowerPC, 32-bit . MicroBlaze + * . PowerPC, 64-bit . TriCore + * . SPARC v8 . ARM v3+ + * . Alpha . MIPS32 + * . C, longlong . C, generic + */ +#ifndef MBEDTLS_BN_MUL_H +#define MBEDTLS_BN_MUL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/bignum.h" + + +/* + * Conversion macros for embedded constants: + * build lists of mbedtls_mpi_uint's from lists of unsigned char's grouped by 8, 4 or 2 + */ +#if defined(MBEDTLS_HAVE_INT32) + +#define MBEDTLS_BYTES_TO_T_UINT_4( a, b, c, d ) \ + ( (mbedtls_mpi_uint) (a) << 0 ) | \ + ( (mbedtls_mpi_uint) (b) << 8 ) | \ + ( (mbedtls_mpi_uint) (c) << 16 ) | \ + ( (mbedtls_mpi_uint) (d) << 24 ) + +#define MBEDTLS_BYTES_TO_T_UINT_2( a, b ) \ + MBEDTLS_BYTES_TO_T_UINT_4( a, b, 0, 0 ) + +#define MBEDTLS_BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \ + MBEDTLS_BYTES_TO_T_UINT_4( a, b, c, d ), \ + MBEDTLS_BYTES_TO_T_UINT_4( e, f, g, h ) + +#else /* 64-bits */ + +#define MBEDTLS_BYTES_TO_T_UINT_8( a, b, c, d, e, f, g, h ) \ + ( (mbedtls_mpi_uint) (a) << 0 ) | \ + ( (mbedtls_mpi_uint) (b) << 8 ) | \ + ( (mbedtls_mpi_uint) (c) << 16 ) | \ + ( (mbedtls_mpi_uint) (d) << 24 ) | \ + ( (mbedtls_mpi_uint) (e) << 32 ) | \ + ( (mbedtls_mpi_uint) (f) << 40 ) | \ + ( (mbedtls_mpi_uint) (g) << 48 ) | \ + ( (mbedtls_mpi_uint) (h) << 56 ) + +#define MBEDTLS_BYTES_TO_T_UINT_4( a, b, c, d ) \ + MBEDTLS_BYTES_TO_T_UINT_8( a, b, c, d, 0, 0, 0, 0 ) + +#define MBEDTLS_BYTES_TO_T_UINT_2( a, b ) \ + MBEDTLS_BYTES_TO_T_UINT_8( a, b, 0, 0, 0, 0, 0, 0 ) + +#endif /* bits in mbedtls_mpi_uint */ + +#if defined(MBEDTLS_HAVE_ASM) + +#ifndef asm +#define asm __asm +#endif + +/* armcc5 --gnu defines __GNUC__ but doesn't support GNU's extended asm */ +#if defined(__GNUC__) && \ + ( !defined(__ARMCC_VERSION) || __ARMCC_VERSION >= 6000000 ) + +/* + * Disable use of the i386 assembly code below if option -O0, to disable all + * compiler optimisations, is passed, detected with __OPTIMIZE__ + * This is done as the number of registers used in the assembly code doesn't + * work with the -O0 option. + */ +#if defined(__i386__) && defined(__OPTIMIZE__) + +#define MULADDC_INIT \ + asm( \ + "movl %%ebx, %0 \n\t" \ + "movl %5, %%esi \n\t" \ + "movl %6, %%edi \n\t" \ + "movl %7, %%ecx \n\t" \ + "movl %8, %%ebx \n\t" + +#define MULADDC_CORE \ + "lodsl \n\t" \ + "mull %%ebx \n\t" \ + "addl %%ecx, %%eax \n\t" \ + "adcl $0, %%edx \n\t" \ + "addl (%%edi), %%eax \n\t" \ + "adcl $0, %%edx \n\t" \ + "movl %%edx, %%ecx \n\t" \ + "stosl \n\t" + +#if defined(MBEDTLS_HAVE_SSE2) + +#define MULADDC_HUIT \ + "movd %%ecx, %%mm1 \n\t" \ + "movd %%ebx, %%mm0 \n\t" \ + "movd (%%edi), %%mm3 \n\t" \ + "paddq %%mm3, %%mm1 \n\t" \ + "movd (%%esi), %%mm2 \n\t" \ + "pmuludq %%mm0, %%mm2 \n\t" \ + "movd 4(%%esi), %%mm4 \n\t" \ + "pmuludq %%mm0, %%mm4 \n\t" \ + "movd 8(%%esi), %%mm6 \n\t" \ + "pmuludq %%mm0, %%mm6 \n\t" \ + "movd 12(%%esi), %%mm7 \n\t" \ + "pmuludq %%mm0, %%mm7 \n\t" \ + "paddq %%mm2, %%mm1 \n\t" \ + "movd 4(%%edi), %%mm3 \n\t" \ + "paddq %%mm4, %%mm3 \n\t" \ + "movd 8(%%edi), %%mm5 \n\t" \ + "paddq %%mm6, %%mm5 \n\t" \ + "movd 12(%%edi), %%mm4 \n\t" \ + "paddq %%mm4, %%mm7 \n\t" \ + "movd %%mm1, (%%edi) \n\t" \ + "movd 16(%%esi), %%mm2 \n\t" \ + "pmuludq %%mm0, %%mm2 \n\t" \ + "psrlq $32, %%mm1 \n\t" \ + "movd 20(%%esi), %%mm4 \n\t" \ + "pmuludq %%mm0, %%mm4 \n\t" \ + "paddq %%mm3, %%mm1 \n\t" \ + "movd 24(%%esi), %%mm6 \n\t" \ + "pmuludq %%mm0, %%mm6 \n\t" \ + "movd %%mm1, 4(%%edi) \n\t" \ + "psrlq $32, %%mm1 \n\t" \ + "movd 28(%%esi), %%mm3 \n\t" \ + "pmuludq %%mm0, %%mm3 \n\t" \ + "paddq %%mm5, %%mm1 \n\t" \ + "movd 16(%%edi), %%mm5 \n\t" \ + "paddq %%mm5, %%mm2 \n\t" \ + "movd %%mm1, 8(%%edi) \n\t" \ + "psrlq $32, %%mm1 \n\t" \ + "paddq %%mm7, %%mm1 \n\t" \ + "movd 20(%%edi), %%mm5 \n\t" \ + "paddq %%mm5, %%mm4 \n\t" \ + "movd %%mm1, 12(%%edi) \n\t" \ + "psrlq $32, %%mm1 \n\t" \ + "paddq %%mm2, %%mm1 \n\t" \ + "movd 24(%%edi), %%mm5 \n\t" \ + "paddq %%mm5, %%mm6 \n\t" \ + "movd %%mm1, 16(%%edi) \n\t" \ + "psrlq $32, %%mm1 \n\t" \ + "paddq %%mm4, %%mm1 \n\t" \ + "movd 28(%%edi), %%mm5 \n\t" \ + "paddq %%mm5, %%mm3 \n\t" \ + "movd %%mm1, 20(%%edi) \n\t" \ + "psrlq $32, %%mm1 \n\t" \ + "paddq %%mm6, %%mm1 \n\t" \ + "movd %%mm1, 24(%%edi) \n\t" \ + "psrlq $32, %%mm1 \n\t" \ + "paddq %%mm3, %%mm1 \n\t" \ + "movd %%mm1, 28(%%edi) \n\t" \ + "addl $32, %%edi \n\t" \ + "addl $32, %%esi \n\t" \ + "psrlq $32, %%mm1 \n\t" \ + "movd %%mm1, %%ecx \n\t" + +#define MULADDC_STOP \ + "emms \n\t" \ + "movl %4, %%ebx \n\t" \ + "movl %%ecx, %1 \n\t" \ + "movl %%edi, %2 \n\t" \ + "movl %%esi, %3 \n\t" \ + : "=m" (t), "=m" (c), "=m" (d), "=m" (s) \ + : "m" (t), "m" (s), "m" (d), "m" (c), "m" (b) \ + : "eax", "ebx", "ecx", "edx", "esi", "edi" \ + ); + +#else + +#define MULADDC_STOP \ + "movl %4, %%ebx \n\t" \ + "movl %%ecx, %1 \n\t" \ + "movl %%edi, %2 \n\t" \ + "movl %%esi, %3 \n\t" \ + : "=m" (t), "=m" (c), "=m" (d), "=m" (s) \ + : "m" (t), "m" (s), "m" (d), "m" (c), "m" (b) \ + : "eax", "ebx", "ecx", "edx", "esi", "edi" \ + ); +#endif /* SSE2 */ +#endif /* i386 */ + +#if defined(__amd64__) || defined (__x86_64__) + +#define MULADDC_INIT \ + asm( \ + "xorq %%r8, %%r8\n" + +#define MULADDC_CORE \ + "movq (%%rsi), %%rax\n" \ + "mulq %%rbx\n" \ + "addq $8, %%rsi\n" \ + "addq %%rcx, %%rax\n" \ + "movq %%r8, %%rcx\n" \ + "adcq $0, %%rdx\n" \ + "nop \n" \ + "addq %%rax, (%%rdi)\n" \ + "adcq %%rdx, %%rcx\n" \ + "addq $8, %%rdi\n" + +#define MULADDC_STOP \ + : "+c" (c), "+D" (d), "+S" (s), "+m" (*(uint64_t (*)[16]) d) \ + : "b" (b), "m" (*(const uint64_t (*)[16]) s) \ + : "rax", "rdx", "r8" \ + ); + +#endif /* AMD64 */ + +#if defined(__aarch64__) + +#define MULADDC_INIT \ + asm( + +#define MULADDC_CORE \ + "ldr x4, [%2], #8 \n\t" \ + "ldr x5, [%1] \n\t" \ + "mul x6, x4, %4 \n\t" \ + "umulh x7, x4, %4 \n\t" \ + "adds x5, x5, x6 \n\t" \ + "adc x7, x7, xzr \n\t" \ + "adds x5, x5, %0 \n\t" \ + "adc %0, x7, xzr \n\t" \ + "str x5, [%1], #8 \n\t" + +#define MULADDC_STOP \ + : "+r" (c), "+r" (d), "+r" (s), "+m" (*(uint64_t (*)[16]) d) \ + : "r" (b), "m" (*(const uint64_t (*)[16]) s) \ + : "x4", "x5", "x6", "x7", "cc" \ + ); + +#endif /* Aarch64 */ + +#if defined(__mc68020__) || defined(__mcpu32__) + +#define MULADDC_INIT \ + asm( \ + "movl %3, %%a2 \n\t" \ + "movl %4, %%a3 \n\t" \ + "movl %5, %%d3 \n\t" \ + "movl %6, %%d2 \n\t" \ + "moveq #0, %%d0 \n\t" + +#define MULADDC_CORE \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d4:%%d1 \n\t" \ + "addl %%d3, %%d1 \n\t" \ + "addxl %%d0, %%d4 \n\t" \ + "moveq #0, %%d3 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "addxl %%d4, %%d3 \n\t" + +#define MULADDC_STOP \ + "movl %%d3, %0 \n\t" \ + "movl %%a3, %1 \n\t" \ + "movl %%a2, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "d0", "d1", "d2", "d3", "d4", "a2", "a3" \ + ); + +#define MULADDC_HUIT \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d4:%%d1 \n\t" \ + "addxl %%d3, %%d1 \n\t" \ + "addxl %%d0, %%d4 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d3:%%d1 \n\t" \ + "addxl %%d4, %%d1 \n\t" \ + "addxl %%d0, %%d3 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d4:%%d1 \n\t" \ + "addxl %%d3, %%d1 \n\t" \ + "addxl %%d0, %%d4 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d3:%%d1 \n\t" \ + "addxl %%d4, %%d1 \n\t" \ + "addxl %%d0, %%d3 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d4:%%d1 \n\t" \ + "addxl %%d3, %%d1 \n\t" \ + "addxl %%d0, %%d4 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d3:%%d1 \n\t" \ + "addxl %%d4, %%d1 \n\t" \ + "addxl %%d0, %%d3 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d4:%%d1 \n\t" \ + "addxl %%d3, %%d1 \n\t" \ + "addxl %%d0, %%d4 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "movel %%a2@+, %%d1 \n\t" \ + "mulul %%d2, %%d3:%%d1 \n\t" \ + "addxl %%d4, %%d1 \n\t" \ + "addxl %%d0, %%d3 \n\t" \ + "addl %%d1, %%a3@+ \n\t" \ + "addxl %%d0, %%d3 \n\t" + +#endif /* MC68000 */ + +#if defined(__powerpc64__) || defined(__ppc64__) + +#if defined(__MACH__) && defined(__APPLE__) + +#define MULADDC_INIT \ + asm( \ + "ld r3, %3 \n\t" \ + "ld r4, %4 \n\t" \ + "ld r5, %5 \n\t" \ + "ld r6, %6 \n\t" \ + "addi r3, r3, -8 \n\t" \ + "addi r4, r4, -8 \n\t" \ + "addic r5, r5, 0 \n\t" + +#define MULADDC_CORE \ + "ldu r7, 8(r3) \n\t" \ + "mulld r8, r7, r6 \n\t" \ + "mulhdu r9, r7, r6 \n\t" \ + "adde r8, r8, r5 \n\t" \ + "ld r7, 8(r4) \n\t" \ + "addze r5, r9 \n\t" \ + "addc r8, r8, r7 \n\t" \ + "stdu r8, 8(r4) \n\t" + +#define MULADDC_STOP \ + "addze r5, r5 \n\t" \ + "addi r4, r4, 8 \n\t" \ + "addi r3, r3, 8 \n\t" \ + "std r5, %0 \n\t" \ + "std r4, %1 \n\t" \ + "std r3, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "r3", "r4", "r5", "r6", "r7", "r8", "r9" \ + ); + + +#else /* __MACH__ && __APPLE__ */ + +#define MULADDC_INIT \ + asm( \ + "ld %%r3, %3 \n\t" \ + "ld %%r4, %4 \n\t" \ + "ld %%r5, %5 \n\t" \ + "ld %%r6, %6 \n\t" \ + "addi %%r3, %%r3, -8 \n\t" \ + "addi %%r4, %%r4, -8 \n\t" \ + "addic %%r5, %%r5, 0 \n\t" + +#define MULADDC_CORE \ + "ldu %%r7, 8(%%r3) \n\t" \ + "mulld %%r8, %%r7, %%r6 \n\t" \ + "mulhdu %%r9, %%r7, %%r6 \n\t" \ + "adde %%r8, %%r8, %%r5 \n\t" \ + "ld %%r7, 8(%%r4) \n\t" \ + "addze %%r5, %%r9 \n\t" \ + "addc %%r8, %%r8, %%r7 \n\t" \ + "stdu %%r8, 8(%%r4) \n\t" + +#define MULADDC_STOP \ + "addze %%r5, %%r5 \n\t" \ + "addi %%r4, %%r4, 8 \n\t" \ + "addi %%r3, %%r3, 8 \n\t" \ + "std %%r5, %0 \n\t" \ + "std %%r4, %1 \n\t" \ + "std %%r3, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "r3", "r4", "r5", "r6", "r7", "r8", "r9" \ + ); + +#endif /* __MACH__ && __APPLE__ */ + +#elif defined(__powerpc__) || defined(__ppc__) /* end PPC64/begin PPC32 */ + +#if defined(__MACH__) && defined(__APPLE__) + +#define MULADDC_INIT \ + asm( \ + "lwz r3, %3 \n\t" \ + "lwz r4, %4 \n\t" \ + "lwz r5, %5 \n\t" \ + "lwz r6, %6 \n\t" \ + "addi r3, r3, -4 \n\t" \ + "addi r4, r4, -4 \n\t" \ + "addic r5, r5, 0 \n\t" + +#define MULADDC_CORE \ + "lwzu r7, 4(r3) \n\t" \ + "mullw r8, r7, r6 \n\t" \ + "mulhwu r9, r7, r6 \n\t" \ + "adde r8, r8, r5 \n\t" \ + "lwz r7, 4(r4) \n\t" \ + "addze r5, r9 \n\t" \ + "addc r8, r8, r7 \n\t" \ + "stwu r8, 4(r4) \n\t" + +#define MULADDC_STOP \ + "addze r5, r5 \n\t" \ + "addi r4, r4, 4 \n\t" \ + "addi r3, r3, 4 \n\t" \ + "stw r5, %0 \n\t" \ + "stw r4, %1 \n\t" \ + "stw r3, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "r3", "r4", "r5", "r6", "r7", "r8", "r9" \ + ); + +#else /* __MACH__ && __APPLE__ */ + +#define MULADDC_INIT \ + asm( \ + "lwz %%r3, %3 \n\t" \ + "lwz %%r4, %4 \n\t" \ + "lwz %%r5, %5 \n\t" \ + "lwz %%r6, %6 \n\t" \ + "addi %%r3, %%r3, -4 \n\t" \ + "addi %%r4, %%r4, -4 \n\t" \ + "addic %%r5, %%r5, 0 \n\t" + +#define MULADDC_CORE \ + "lwzu %%r7, 4(%%r3) \n\t" \ + "mullw %%r8, %%r7, %%r6 \n\t" \ + "mulhwu %%r9, %%r7, %%r6 \n\t" \ + "adde %%r8, %%r8, %%r5 \n\t" \ + "lwz %%r7, 4(%%r4) \n\t" \ + "addze %%r5, %%r9 \n\t" \ + "addc %%r8, %%r8, %%r7 \n\t" \ + "stwu %%r8, 4(%%r4) \n\t" + +#define MULADDC_STOP \ + "addze %%r5, %%r5 \n\t" \ + "addi %%r4, %%r4, 4 \n\t" \ + "addi %%r3, %%r3, 4 \n\t" \ + "stw %%r5, %0 \n\t" \ + "stw %%r4, %1 \n\t" \ + "stw %%r3, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "r3", "r4", "r5", "r6", "r7", "r8", "r9" \ + ); + +#endif /* __MACH__ && __APPLE__ */ + +#endif /* PPC32 */ + +/* + * The Sparc(64) assembly is reported to be broken. + * Disable it for now, until we're able to fix it. + */ +#if 0 && defined(__sparc__) +#if defined(__sparc64__) + +#define MULADDC_INIT \ + asm( \ + "ldx %3, %%o0 \n\t" \ + "ldx %4, %%o1 \n\t" \ + "ld %5, %%o2 \n\t" \ + "ld %6, %%o3 \n\t" + +#define MULADDC_CORE \ + "ld [%%o0], %%o4 \n\t" \ + "inc 4, %%o0 \n\t" \ + "ld [%%o1], %%o5 \n\t" \ + "umul %%o3, %%o4, %%o4 \n\t" \ + "addcc %%o4, %%o2, %%o4 \n\t" \ + "rd %%y, %%g1 \n\t" \ + "addx %%g1, 0, %%g1 \n\t" \ + "addcc %%o4, %%o5, %%o4 \n\t" \ + "st %%o4, [%%o1] \n\t" \ + "addx %%g1, 0, %%o2 \n\t" \ + "inc 4, %%o1 \n\t" + + #define MULADDC_STOP \ + "st %%o2, %0 \n\t" \ + "stx %%o1, %1 \n\t" \ + "stx %%o0, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "g1", "o0", "o1", "o2", "o3", "o4", \ + "o5" \ + ); + +#else /* __sparc64__ */ + +#define MULADDC_INIT \ + asm( \ + "ld %3, %%o0 \n\t" \ + "ld %4, %%o1 \n\t" \ + "ld %5, %%o2 \n\t" \ + "ld %6, %%o3 \n\t" + +#define MULADDC_CORE \ + "ld [%%o0], %%o4 \n\t" \ + "inc 4, %%o0 \n\t" \ + "ld [%%o1], %%o5 \n\t" \ + "umul %%o3, %%o4, %%o4 \n\t" \ + "addcc %%o4, %%o2, %%o4 \n\t" \ + "rd %%y, %%g1 \n\t" \ + "addx %%g1, 0, %%g1 \n\t" \ + "addcc %%o4, %%o5, %%o4 \n\t" \ + "st %%o4, [%%o1] \n\t" \ + "addx %%g1, 0, %%o2 \n\t" \ + "inc 4, %%o1 \n\t" + +#define MULADDC_STOP \ + "st %%o2, %0 \n\t" \ + "st %%o1, %1 \n\t" \ + "st %%o0, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "g1", "o0", "o1", "o2", "o3", "o4", \ + "o5" \ + ); + +#endif /* __sparc64__ */ +#endif /* __sparc__ */ + +#if defined(__microblaze__) || defined(microblaze) + +#define MULADDC_INIT \ + asm( \ + "lwi r3, %3 \n\t" \ + "lwi r4, %4 \n\t" \ + "lwi r5, %5 \n\t" \ + "lwi r6, %6 \n\t" \ + "andi r7, r6, 0xffff \n\t" \ + "bsrli r6, r6, 16 \n\t" + +#define MULADDC_CORE \ + "lhui r8, r3, 0 \n\t" \ + "addi r3, r3, 2 \n\t" \ + "lhui r9, r3, 0 \n\t" \ + "addi r3, r3, 2 \n\t" \ + "mul r10, r9, r6 \n\t" \ + "mul r11, r8, r7 \n\t" \ + "mul r12, r9, r7 \n\t" \ + "mul r13, r8, r6 \n\t" \ + "bsrli r8, r10, 16 \n\t" \ + "bsrli r9, r11, 16 \n\t" \ + "add r13, r13, r8 \n\t" \ + "add r13, r13, r9 \n\t" \ + "bslli r10, r10, 16 \n\t" \ + "bslli r11, r11, 16 \n\t" \ + "add r12, r12, r10 \n\t" \ + "addc r13, r13, r0 \n\t" \ + "add r12, r12, r11 \n\t" \ + "addc r13, r13, r0 \n\t" \ + "lwi r10, r4, 0 \n\t" \ + "add r12, r12, r10 \n\t" \ + "addc r13, r13, r0 \n\t" \ + "add r12, r12, r5 \n\t" \ + "addc r5, r13, r0 \n\t" \ + "swi r12, r4, 0 \n\t" \ + "addi r4, r4, 4 \n\t" + +#define MULADDC_STOP \ + "swi r5, %0 \n\t" \ + "swi r4, %1 \n\t" \ + "swi r3, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "r3", "r4", "r5", "r6", "r7", "r8", \ + "r9", "r10", "r11", "r12", "r13" \ + ); + +#endif /* MicroBlaze */ + +#if defined(__tricore__) + +#define MULADDC_INIT \ + asm( \ + "ld.a %%a2, %3 \n\t" \ + "ld.a %%a3, %4 \n\t" \ + "ld.w %%d4, %5 \n\t" \ + "ld.w %%d1, %6 \n\t" \ + "xor %%d5, %%d5 \n\t" + +#define MULADDC_CORE \ + "ld.w %%d0, [%%a2+] \n\t" \ + "madd.u %%e2, %%e4, %%d0, %%d1 \n\t" \ + "ld.w %%d0, [%%a3] \n\t" \ + "addx %%d2, %%d2, %%d0 \n\t" \ + "addc %%d3, %%d3, 0 \n\t" \ + "mov %%d4, %%d3 \n\t" \ + "st.w [%%a3+], %%d2 \n\t" + +#define MULADDC_STOP \ + "st.w %0, %%d4 \n\t" \ + "st.a %1, %%a3 \n\t" \ + "st.a %2, %%a2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "d0", "d1", "e2", "d4", "a2", "a3" \ + ); + +#endif /* TriCore */ + +/* + * Note, gcc -O0 by default uses r7 for the frame pointer, so it complains about + * our use of r7 below, unless -fomit-frame-pointer is passed. + * + * On the other hand, -fomit-frame-pointer is implied by any -Ox options with + * x !=0, which we can detect using __OPTIMIZE__ (which is also defined by + * clang and armcc5 under the same conditions). + * + * So, only use the optimized assembly below for optimized build, which avoids + * the build error and is pretty reasonable anyway. + */ +#if defined(__GNUC__) && !defined(__OPTIMIZE__) +#define MULADDC_CANNOT_USE_R7 +#endif + +#if defined(__arm__) && !defined(MULADDC_CANNOT_USE_R7) + +#if defined(__thumb__) && !defined(__thumb2__) + +#define MULADDC_INIT \ + asm( \ + "ldr r0, %3 \n\t" \ + "ldr r1, %4 \n\t" \ + "ldr r2, %5 \n\t" \ + "ldr r3, %6 \n\t" \ + "lsr r7, r3, #16 \n\t" \ + "mov r9, r7 \n\t" \ + "lsl r7, r3, #16 \n\t" \ + "lsr r7, r7, #16 \n\t" \ + "mov r8, r7 \n\t" + +#define MULADDC_CORE \ + "ldmia r0!, {r6} \n\t" \ + "lsr r7, r6, #16 \n\t" \ + "lsl r6, r6, #16 \n\t" \ + "lsr r6, r6, #16 \n\t" \ + "mov r4, r8 \n\t" \ + "mul r4, r6 \n\t" \ + "mov r3, r9 \n\t" \ + "mul r6, r3 \n\t" \ + "mov r5, r9 \n\t" \ + "mul r5, r7 \n\t" \ + "mov r3, r8 \n\t" \ + "mul r7, r3 \n\t" \ + "lsr r3, r6, #16 \n\t" \ + "add r5, r5, r3 \n\t" \ + "lsr r3, r7, #16 \n\t" \ + "add r5, r5, r3 \n\t" \ + "add r4, r4, r2 \n\t" \ + "mov r2, #0 \n\t" \ + "adc r5, r2 \n\t" \ + "lsl r3, r6, #16 \n\t" \ + "add r4, r4, r3 \n\t" \ + "adc r5, r2 \n\t" \ + "lsl r3, r7, #16 \n\t" \ + "add r4, r4, r3 \n\t" \ + "adc r5, r2 \n\t" \ + "ldr r3, [r1] \n\t" \ + "add r4, r4, r3 \n\t" \ + "adc r2, r5 \n\t" \ + "stmia r1!, {r4} \n\t" + +#define MULADDC_STOP \ + "str r2, %0 \n\t" \ + "str r1, %1 \n\t" \ + "str r0, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "r0", "r1", "r2", "r3", "r4", "r5", \ + "r6", "r7", "r8", "r9", "cc" \ + ); + +#elif (__ARM_ARCH >= 6) && \ + defined (__ARM_FEATURE_DSP) && (__ARM_FEATURE_DSP == 1) + +#define MULADDC_INIT \ + asm( + +#define MULADDC_CORE \ + "ldr r0, [%0], #4 \n\t" \ + "ldr r1, [%1] \n\t" \ + "umaal r1, %2, %3, r0 \n\t" \ + "str r1, [%1], #4 \n\t" + +#define MULADDC_STOP \ + : "=r" (s), "=r" (d), "=r" (c) \ + : "r" (b), "0" (s), "1" (d), "2" (c) \ + : "r0", "r1", "memory" \ + ); + +#else + +#define MULADDC_INIT \ + asm( \ + "ldr r0, %3 \n\t" \ + "ldr r1, %4 \n\t" \ + "ldr r2, %5 \n\t" \ + "ldr r3, %6 \n\t" + +#define MULADDC_CORE \ + "ldr r4, [r0], #4 \n\t" \ + "mov r5, #0 \n\t" \ + "ldr r6, [r1] \n\t" \ + "umlal r2, r5, r3, r4 \n\t" \ + "adds r7, r6, r2 \n\t" \ + "adc r2, r5, #0 \n\t" \ + "str r7, [r1], #4 \n\t" + +#define MULADDC_STOP \ + "str r2, %0 \n\t" \ + "str r1, %1 \n\t" \ + "str r0, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "r0", "r1", "r2", "r3", "r4", "r5", \ + "r6", "r7", "cc" \ + ); + +#endif /* Thumb */ + +#endif /* ARMv3 */ + +#if defined(__alpha__) + +#define MULADDC_INIT \ + asm( \ + "ldq $1, %3 \n\t" \ + "ldq $2, %4 \n\t" \ + "ldq $3, %5 \n\t" \ + "ldq $4, %6 \n\t" + +#define MULADDC_CORE \ + "ldq $6, 0($1) \n\t" \ + "addq $1, 8, $1 \n\t" \ + "mulq $6, $4, $7 \n\t" \ + "umulh $6, $4, $6 \n\t" \ + "addq $7, $3, $7 \n\t" \ + "cmpult $7, $3, $3 \n\t" \ + "ldq $5, 0($2) \n\t" \ + "addq $7, $5, $7 \n\t" \ + "cmpult $7, $5, $5 \n\t" \ + "stq $7, 0($2) \n\t" \ + "addq $2, 8, $2 \n\t" \ + "addq $6, $3, $3 \n\t" \ + "addq $5, $3, $3 \n\t" + +#define MULADDC_STOP \ + "stq $3, %0 \n\t" \ + "stq $2, %1 \n\t" \ + "stq $1, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "$1", "$2", "$3", "$4", "$5", "$6", "$7" \ + ); +#endif /* Alpha */ + +#if defined(__mips__) && !defined(__mips64) + +#define MULADDC_INIT \ + asm( \ + "lw $10, %3 \n\t" \ + "lw $11, %4 \n\t" \ + "lw $12, %5 \n\t" \ + "lw $13, %6 \n\t" + +#define MULADDC_CORE \ + "lw $14, 0($10) \n\t" \ + "multu $13, $14 \n\t" \ + "addi $10, $10, 4 \n\t" \ + "mflo $14 \n\t" \ + "mfhi $9 \n\t" \ + "addu $14, $12, $14 \n\t" \ + "lw $15, 0($11) \n\t" \ + "sltu $12, $14, $12 \n\t" \ + "addu $15, $14, $15 \n\t" \ + "sltu $14, $15, $14 \n\t" \ + "addu $12, $12, $9 \n\t" \ + "sw $15, 0($11) \n\t" \ + "addu $12, $12, $14 \n\t" \ + "addi $11, $11, 4 \n\t" + +#define MULADDC_STOP \ + "sw $12, %0 \n\t" \ + "sw $11, %1 \n\t" \ + "sw $10, %2 \n\t" \ + : "=m" (c), "=m" (d), "=m" (s) \ + : "m" (s), "m" (d), "m" (c), "m" (b) \ + : "$9", "$10", "$11", "$12", "$13", "$14", "$15", "lo", "hi" \ + ); + +#endif /* MIPS */ +#endif /* GNUC */ + +#if (defined(_MSC_VER) && defined(_M_IX86)) || defined(__WATCOMC__) + +#define MULADDC_INIT \ + __asm mov esi, s \ + __asm mov edi, d \ + __asm mov ecx, c \ + __asm mov ebx, b + +#define MULADDC_CORE \ + __asm lodsd \ + __asm mul ebx \ + __asm add eax, ecx \ + __asm adc edx, 0 \ + __asm add eax, [edi] \ + __asm adc edx, 0 \ + __asm mov ecx, edx \ + __asm stosd + +#if defined(MBEDTLS_HAVE_SSE2) + +#define EMIT __asm _emit + +#define MULADDC_HUIT \ + EMIT 0x0F EMIT 0x6E EMIT 0xC9 \ + EMIT 0x0F EMIT 0x6E EMIT 0xC3 \ + EMIT 0x0F EMIT 0x6E EMIT 0x1F \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCB \ + EMIT 0x0F EMIT 0x6E EMIT 0x16 \ + EMIT 0x0F EMIT 0xF4 EMIT 0xD0 \ + EMIT 0x0F EMIT 0x6E EMIT 0x66 EMIT 0x04 \ + EMIT 0x0F EMIT 0xF4 EMIT 0xE0 \ + EMIT 0x0F EMIT 0x6E EMIT 0x76 EMIT 0x08 \ + EMIT 0x0F EMIT 0xF4 EMIT 0xF0 \ + EMIT 0x0F EMIT 0x6E EMIT 0x7E EMIT 0x0C \ + EMIT 0x0F EMIT 0xF4 EMIT 0xF8 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCA \ + EMIT 0x0F EMIT 0x6E EMIT 0x5F EMIT 0x04 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xDC \ + EMIT 0x0F EMIT 0x6E EMIT 0x6F EMIT 0x08 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xEE \ + EMIT 0x0F EMIT 0x6E EMIT 0x67 EMIT 0x0C \ + EMIT 0x0F EMIT 0xD4 EMIT 0xFC \ + EMIT 0x0F EMIT 0x7E EMIT 0x0F \ + EMIT 0x0F EMIT 0x6E EMIT 0x56 EMIT 0x10 \ + EMIT 0x0F EMIT 0xF4 EMIT 0xD0 \ + EMIT 0x0F EMIT 0x73 EMIT 0xD1 EMIT 0x20 \ + EMIT 0x0F EMIT 0x6E EMIT 0x66 EMIT 0x14 \ + EMIT 0x0F EMIT 0xF4 EMIT 0xE0 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCB \ + EMIT 0x0F EMIT 0x6E EMIT 0x76 EMIT 0x18 \ + EMIT 0x0F EMIT 0xF4 EMIT 0xF0 \ + EMIT 0x0F EMIT 0x7E EMIT 0x4F EMIT 0x04 \ + EMIT 0x0F EMIT 0x73 EMIT 0xD1 EMIT 0x20 \ + EMIT 0x0F EMIT 0x6E EMIT 0x5E EMIT 0x1C \ + EMIT 0x0F EMIT 0xF4 EMIT 0xD8 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCD \ + EMIT 0x0F EMIT 0x6E EMIT 0x6F EMIT 0x10 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xD5 \ + EMIT 0x0F EMIT 0x7E EMIT 0x4F EMIT 0x08 \ + EMIT 0x0F EMIT 0x73 EMIT 0xD1 EMIT 0x20 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCF \ + EMIT 0x0F EMIT 0x6E EMIT 0x6F EMIT 0x14 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xE5 \ + EMIT 0x0F EMIT 0x7E EMIT 0x4F EMIT 0x0C \ + EMIT 0x0F EMIT 0x73 EMIT 0xD1 EMIT 0x20 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCA \ + EMIT 0x0F EMIT 0x6E EMIT 0x6F EMIT 0x18 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xF5 \ + EMIT 0x0F EMIT 0x7E EMIT 0x4F EMIT 0x10 \ + EMIT 0x0F EMIT 0x73 EMIT 0xD1 EMIT 0x20 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCC \ + EMIT 0x0F EMIT 0x6E EMIT 0x6F EMIT 0x1C \ + EMIT 0x0F EMIT 0xD4 EMIT 0xDD \ + EMIT 0x0F EMIT 0x7E EMIT 0x4F EMIT 0x14 \ + EMIT 0x0F EMIT 0x73 EMIT 0xD1 EMIT 0x20 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCE \ + EMIT 0x0F EMIT 0x7E EMIT 0x4F EMIT 0x18 \ + EMIT 0x0F EMIT 0x73 EMIT 0xD1 EMIT 0x20 \ + EMIT 0x0F EMIT 0xD4 EMIT 0xCB \ + EMIT 0x0F EMIT 0x7E EMIT 0x4F EMIT 0x1C \ + EMIT 0x83 EMIT 0xC7 EMIT 0x20 \ + EMIT 0x83 EMIT 0xC6 EMIT 0x20 \ + EMIT 0x0F EMIT 0x73 EMIT 0xD1 EMIT 0x20 \ + EMIT 0x0F EMIT 0x7E EMIT 0xC9 + +#define MULADDC_STOP \ + EMIT 0x0F EMIT 0x77 \ + __asm mov c, ecx \ + __asm mov d, edi \ + __asm mov s, esi \ + +#else + +#define MULADDC_STOP \ + __asm mov c, ecx \ + __asm mov d, edi \ + __asm mov s, esi \ + +#endif /* SSE2 */ +#endif /* MSVC */ + +#endif /* MBEDTLS_HAVE_ASM */ + +#if !defined(MULADDC_CORE) +#if defined(MBEDTLS_HAVE_UDBL) + +#define MULADDC_INIT \ +{ \ + mbedtls_t_udbl r; \ + mbedtls_mpi_uint r0, r1; + +#define MULADDC_CORE \ + r = *(s++) * (mbedtls_t_udbl) b; \ + r0 = (mbedtls_mpi_uint) r; \ + r1 = (mbedtls_mpi_uint)( r >> biL ); \ + r0 += c; r1 += (r0 < c); \ + r0 += *d; r1 += (r0 < *d); \ + c = r1; *(d++) = r0; + +#define MULADDC_STOP \ +} + +#else +#define MULADDC_INIT \ +{ \ + mbedtls_mpi_uint s0, s1, b0, b1; \ + mbedtls_mpi_uint r0, r1, rx, ry; \ + b0 = ( b << biH ) >> biH; \ + b1 = ( b >> biH ); + +#define MULADDC_CORE \ + s0 = ( *s << biH ) >> biH; \ + s1 = ( *s >> biH ); s++; \ + rx = s0 * b1; r0 = s0 * b0; \ + ry = s1 * b0; r1 = s1 * b1; \ + r1 += ( rx >> biH ); \ + r1 += ( ry >> biH ); \ + rx <<= biH; ry <<= biH; \ + r0 += rx; r1 += (r0 < rx); \ + r0 += ry; r1 += (r0 < ry); \ + r0 += c; r1 += (r0 < c); \ + r0 += *d; r1 += (r0 < *d); \ + c = r1; *(d++) = r0; + +#define MULADDC_STOP \ +} + +#endif /* C (generic) */ +#endif /* C (longlong) */ + +#endif /* bn_mul.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/camellia.h b/openharmony/armeabi-v7a/include/mbedtls/camellia.h new file mode 100644 index 00000000..d39d932f --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/camellia.h @@ -0,0 +1,327 @@ +/** + * \file camellia.h + * + * \brief Camellia block cipher + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_CAMELLIA_H +#define MBEDTLS_CAMELLIA_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +#include "mbedtls/platform_util.h" + +#define MBEDTLS_CAMELLIA_ENCRYPT 1 +#define MBEDTLS_CAMELLIA_DECRYPT 0 + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#define MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( -0x0024 ) +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ +/** Bad input data. */ +#define MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA -0x0024 + +/** Invalid data input length. */ +#define MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH -0x0026 + +/* MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED is deprecated and should not be used. + */ +/** Camellia hardware accelerator failed. */ +#define MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED -0x0027 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_CAMELLIA_ALT) +// Regular implementation +// + +/** + * \brief CAMELLIA context structure + */ +typedef struct mbedtls_camellia_context +{ + int nr; /*!< number of rounds */ + uint32_t rk[68]; /*!< CAMELLIA round keys */ +} +mbedtls_camellia_context; + +#else /* MBEDTLS_CAMELLIA_ALT */ +#include "camellia_alt.h" +#endif /* MBEDTLS_CAMELLIA_ALT */ + +/** + * \brief Initialize a CAMELLIA context. + * + * \param ctx The CAMELLIA context to be initialized. + * This must not be \c NULL. + */ +void mbedtls_camellia_init( mbedtls_camellia_context *ctx ); + +/** + * \brief Clear a CAMELLIA context. + * + * \param ctx The CAMELLIA context to be cleared. This may be \c NULL, + * in which case this function returns immediately. If it is not + * \c NULL, it must be initialized. + */ +void mbedtls_camellia_free( mbedtls_camellia_context *ctx ); + +/** + * \brief Perform a CAMELLIA key schedule operation for encryption. + * + * \param ctx The CAMELLIA context to use. This must be initialized. + * \param key The encryption key to use. This must be a readable buffer + * of size \p keybits Bits. + * \param keybits The length of \p key in Bits. This must be either \c 128, + * \c 192 or \c 256. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_setkey_enc( mbedtls_camellia_context *ctx, + const unsigned char *key, + unsigned int keybits ); + +/** + * \brief Perform a CAMELLIA key schedule operation for decryption. + * + * \param ctx The CAMELLIA context to use. This must be initialized. + * \param key The decryption key. This must be a readable buffer + * of size \p keybits Bits. + * \param keybits The length of \p key in Bits. This must be either \c 128, + * \c 192 or \c 256. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_setkey_dec( mbedtls_camellia_context *ctx, + const unsigned char *key, + unsigned int keybits ); + +/** + * \brief Perform a CAMELLIA-ECB block encryption/decryption operation. + * + * \param ctx The CAMELLIA context to use. This must be initialized + * and bound to a key. + * \param mode The mode of operation. This must be either + * #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. + * \param input The input block. This must be a readable buffer + * of size \c 16 Bytes. + * \param output The output block. This must be a writable buffer + * of size \c 16 Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_crypt_ecb( mbedtls_camellia_context *ctx, + int mode, + const unsigned char input[16], + unsigned char output[16] ); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief Perform a CAMELLIA-CBC buffer encryption/decryption operation. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the function same function again on the following + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If on the other hand you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * \param ctx The CAMELLIA context to use. This must be initialized + * and bound to a key. + * \param mode The mode of operation. This must be either + * #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. + * \param length The length in Bytes of the input data \p input. + * This must be a multiple of \c 16 Bytes. + * \param iv The initialization vector. This must be a read/write buffer + * of length \c 16 Bytes. It is updated to allow streaming + * use as explained above. + * \param input The buffer holding the input data. This must point to a + * readable buffer of length \p length Bytes. + * \param output The buffer holding the output data. This must point to a + * writable buffer of length \p length Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_crypt_cbc( mbedtls_camellia_context *ctx, + int mode, + size_t length, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +#if defined(MBEDTLS_CIPHER_MODE_CFB) +/** + * \brief Perform a CAMELLIA-CFB128 buffer encryption/decryption + * operation. + * + * \note Due to the nature of CFB mode, you should use the same + * key for both encryption and decryption. In particular, calls + * to this function should be preceded by a key-schedule via + * mbedtls_camellia_setkey_enc() regardless of whether \p mode + * is #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. + * + * \note Upon exit, the content of the IV is updated so that you can + * call the function same function again on the following + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If on the other hand you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * \param ctx The CAMELLIA context to use. This must be initialized + * and bound to a key. + * \param mode The mode of operation. This must be either + * #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. + * \param length The length of the input data \p input. Any value is allowed. + * \param iv_off The current offset in the IV. This must be smaller + * than \c 16 Bytes. It is updated after this call to allow + * the aforementioned streaming usage. + * \param iv The initialization vector. This must be a read/write buffer + * of length \c 16 Bytes. It is updated after this call to + * allow the aforementioned streaming usage. + * \param input The buffer holding the input data. This must be a readable + * buffer of size \p length Bytes. + * \param output The buffer to hold the output data. This must be a writable + * buffer of length \p length Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_crypt_cfb128( mbedtls_camellia_context *ctx, + int mode, + size_t length, + size_t *iv_off, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CFB */ + +#if defined(MBEDTLS_CIPHER_MODE_CTR) +/** + * \brief Perform a CAMELLIA-CTR buffer encryption/decryption operation. + * + * *note Due to the nature of CTR mode, you should use the same + * key for both encryption and decryption. In particular, calls + * to this function should be preceded by a key-schedule via + * mbedtls_camellia_setkey_enc() regardless of whether \p mode + * is #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. + * + * \warning You must never reuse a nonce value with the same key. Doing so + * would void the encryption for the two messages encrypted with + * the same nonce and key. + * + * There are two common strategies for managing nonces with CTR: + * + * 1. You can handle everything as a single message processed over + * successive calls to this function. In that case, you want to + * set \p nonce_counter and \p nc_off to 0 for the first call, and + * then preserve the values of \p nonce_counter, \p nc_off and \p + * stream_block across calls to this function as they will be + * updated by this function. + * + * With this strategy, you must not encrypt more than 2**128 + * blocks of data with the same key. + * + * 2. You can encrypt separate messages by dividing the \p + * nonce_counter buffer in two areas: the first one used for a + * per-message nonce, handled by yourself, and the second one + * updated by this function internally. + * + * For example, you might reserve the first \c 12 Bytes for the + * per-message nonce, and the last \c 4 Bytes for internal use. + * In that case, before calling this function on a new message you + * need to set the first \c 12 Bytes of \p nonce_counter to your + * chosen nonce value, the last four to \c 0, and \p nc_off to \c 0 + * (which will cause \p stream_block to be ignored). That way, you + * can encrypt at most \c 2**96 messages of up to \c 2**32 blocks + * each with the same key. + * + * The per-message nonce (or information sufficient to reconstruct + * it) needs to be communicated with the ciphertext and must be + * unique. The recommended way to ensure uniqueness is to use a + * message counter. An alternative is to generate random nonces, + * but this limits the number of messages that can be securely + * encrypted: for example, with 96-bit random nonces, you should + * not encrypt more than 2**32 messages with the same key. + * + * Note that for both strategies, sizes are measured in blocks and + * that a CAMELLIA block is \c 16 Bytes. + * + * \warning Upon return, \p stream_block contains sensitive data. Its + * content must not be written to insecure storage and should be + * securely discarded as soon as it's no longer needed. + * + * \param ctx The CAMELLIA context to use. This must be initialized + * and bound to a key. + * \param length The length of the input data \p input in Bytes. + * Any value is allowed. + * \param nc_off The offset in the current \p stream_block (for resuming + * within current cipher stream). The offset pointer to + * should be \c 0 at the start of a stream. It is updated + * at the end of this call. + * \param nonce_counter The 128-bit nonce and counter. This must be a read/write + * buffer of length \c 16 Bytes. + * \param stream_block The saved stream-block for resuming. This must be a + * read/write buffer of length \c 16 Bytes. + * \param input The input data stream. This must be a readable buffer of + * size \p length Bytes. + * \param output The output data stream. This must be a writable buffer + * of size \p length Bytes. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_camellia_crypt_ctr( mbedtls_camellia_context *ctx, + size_t length, + size_t *nc_off, + unsigned char nonce_counter[16], + unsigned char stream_block[16], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CTR */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_camellia_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* camellia.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/ccm.h b/openharmony/armeabi-v7a/include/mbedtls/ccm.h new file mode 100644 index 00000000..ece5a901 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/ccm.h @@ -0,0 +1,311 @@ +/** + * \file ccm.h + * + * \brief This file provides an API for the CCM authenticated encryption + * mode for block ciphers. + * + * CCM combines Counter mode encryption with CBC-MAC authentication + * for 128-bit block ciphers. + * + * Input to CCM includes the following elements: + *
  • Payload - data that is both authenticated and encrypted.
    • + *
  • Associated data (Adata) - data that is authenticated but not + * encrypted, For example, a header.
    • + *
  • Nonce - A unique value that is assigned to the payload and the + * associated data.
+ * + * Definition of CCM: + * http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C_updated-July20_2007.pdf + * RFC 3610 "Counter with CBC-MAC (CCM)" + * + * Related: + * RFC 5116 "An Interface and Algorithms for Authenticated Encryption" + * + * Definition of CCM*: + * IEEE 802.15.4 - IEEE Standard for Local and metropolitan area networks + * Integer representation is fixed most-significant-octet-first order and + * the representation of octets is most-significant-bit-first order. This is + * consistent with RFC 3610. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CCM_H +#define MBEDTLS_CCM_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/cipher.h" + +/** Bad input parameters to the function. */ +#define MBEDTLS_ERR_CCM_BAD_INPUT -0x000D +/** Authenticated decryption failed. */ +#define MBEDTLS_ERR_CCM_AUTH_FAILED -0x000F + +/* MBEDTLS_ERR_CCM_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** CCM hardware accelerator failed. */ +#define MBEDTLS_ERR_CCM_HW_ACCEL_FAILED -0x0011 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_CCM_ALT) +// Regular implementation +// + +/** + * \brief The CCM context-type definition. The CCM context is passed + * to the APIs called. + */ +typedef struct mbedtls_ccm_context +{ + mbedtls_cipher_context_t cipher_ctx; /*!< The cipher context used. */ +} +mbedtls_ccm_context; + +#else /* MBEDTLS_CCM_ALT */ +#include "ccm_alt.h" +#endif /* MBEDTLS_CCM_ALT */ + +/** + * \brief This function initializes the specified CCM context, + * to make references valid, and prepare the context + * for mbedtls_ccm_setkey() or mbedtls_ccm_free(). + * + * \param ctx The CCM context to initialize. This must not be \c NULL. + */ +void mbedtls_ccm_init( mbedtls_ccm_context *ctx ); + +/** + * \brief This function initializes the CCM context set in the + * \p ctx parameter and sets the encryption key. + * + * \param ctx The CCM context to initialize. This must be an initialized + * context. + * \param cipher The 128-bit block cipher to use. + * \param key The encryption key. This must not be \c NULL. + * \param keybits The key size in bits. This must be acceptable by the cipher. + * + * \return \c 0 on success. + * \return A CCM or cipher-specific error code on failure. + */ +int mbedtls_ccm_setkey( mbedtls_ccm_context *ctx, + mbedtls_cipher_id_t cipher, + const unsigned char *key, + unsigned int keybits ); + +/** + * \brief This function releases and clears the specified CCM context + * and underlying cipher sub-context. + * + * \param ctx The CCM context to clear. If this is \c NULL, the function + * has no effect. Otherwise, this must be initialized. + */ +void mbedtls_ccm_free( mbedtls_ccm_context *ctx ); + +/** + * \brief This function encrypts a buffer using CCM. + * + * \note The tag is written to a separate buffer. To concatenate + * the \p tag with the \p output, as done in RFC-3610: + * Counter with CBC-MAC (CCM), use + * \p tag = \p output + \p length, and make sure that the + * output buffer is at least \p length + \p tag_len wide. + * + * \param ctx The CCM context to use for encryption. This must be + * initialized and bound to a key. + * \param length The length of the input data in Bytes. + * \param iv The initialization vector (nonce). This must be a readable + * buffer of at least \p iv_len Bytes. + * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, + * or 13. The length L of the message length field is + * 15 - \p iv_len. + * \param add The additional data field. If \p add_len is greater than + * zero, \p add must be a readable buffer of at least that + * length. + * \param add_len The length of additional data in Bytes. + * This must be less than `2^16 - 2^8`. + * \param input The buffer holding the input data. If \p length is greater + * than zero, \p input must be a readable buffer of at least + * that length. + * \param output The buffer holding the output data. If \p length is greater + * than zero, \p output must be a writable buffer of at least + * that length. + * \param tag The buffer holding the authentication field. This must be a + * writable buffer of at least \p tag_len Bytes. + * \param tag_len The length of the authentication field to generate in Bytes: + * 4, 6, 8, 10, 12, 14 or 16. + * + * \return \c 0 on success. + * \return A CCM or cipher-specific error code on failure. + */ +int mbedtls_ccm_encrypt_and_tag( mbedtls_ccm_context *ctx, size_t length, + const unsigned char *iv, size_t iv_len, + const unsigned char *add, size_t add_len, + const unsigned char *input, unsigned char *output, + unsigned char *tag, size_t tag_len ); + +/** + * \brief This function encrypts a buffer using CCM*. + * + * \note The tag is written to a separate buffer. To concatenate + * the \p tag with the \p output, as done in RFC-3610: + * Counter with CBC-MAC (CCM), use + * \p tag = \p output + \p length, and make sure that the + * output buffer is at least \p length + \p tag_len wide. + * + * \note When using this function in a variable tag length context, + * the tag length has to be encoded into the \p iv passed to + * this function. + * + * \param ctx The CCM context to use for encryption. This must be + * initialized and bound to a key. + * \param length The length of the input data in Bytes. + * \param iv The initialization vector (nonce). This must be a readable + * buffer of at least \p iv_len Bytes. + * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, + * or 13. The length L of the message length field is + * 15 - \p iv_len. + * \param add The additional data field. This must be a readable buffer of + * at least \p add_len Bytes. + * \param add_len The length of additional data in Bytes. + * This must be less than 2^16 - 2^8. + * \param input The buffer holding the input data. If \p length is greater + * than zero, \p input must be a readable buffer of at least + * that length. + * \param output The buffer holding the output data. If \p length is greater + * than zero, \p output must be a writable buffer of at least + * that length. + * \param tag The buffer holding the authentication field. This must be a + * writable buffer of at least \p tag_len Bytes. + * \param tag_len The length of the authentication field to generate in Bytes: + * 0, 4, 6, 8, 10, 12, 14 or 16. + * + * \warning Passing \c 0 as \p tag_len means that the message is no + * longer authenticated. + * + * \return \c 0 on success. + * \return A CCM or cipher-specific error code on failure. + */ +int mbedtls_ccm_star_encrypt_and_tag( mbedtls_ccm_context *ctx, size_t length, + const unsigned char *iv, size_t iv_len, + const unsigned char *add, size_t add_len, + const unsigned char *input, unsigned char *output, + unsigned char *tag, size_t tag_len ); + +/** + * \brief This function performs a CCM authenticated decryption of a + * buffer. + * + * \param ctx The CCM context to use for decryption. This must be + * initialized and bound to a key. + * \param length The length of the input data in Bytes. + * \param iv The initialization vector (nonce). This must be a readable + * buffer of at least \p iv_len Bytes. + * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, + * or 13. The length L of the message length field is + * 15 - \p iv_len. + * \param add The additional data field. This must be a readable buffer + * of at least that \p add_len Bytes.. + * \param add_len The length of additional data in Bytes. + * This must be less than 2^16 - 2^8. + * \param input The buffer holding the input data. If \p length is greater + * than zero, \p input must be a readable buffer of at least + * that length. + * \param output The buffer holding the output data. If \p length is greater + * than zero, \p output must be a writable buffer of at least + * that length. + * \param tag The buffer holding the authentication field. This must be a + * readable buffer of at least \p tag_len Bytes. + * \param tag_len The length of the authentication field to generate in Bytes: + * 4, 6, 8, 10, 12, 14 or 16. + * + * \return \c 0 on success. This indicates that the message is authentic. + * \return #MBEDTLS_ERR_CCM_AUTH_FAILED if the tag does not match. + * \return A cipher-specific error code on calculation failure. + */ +int mbedtls_ccm_auth_decrypt( mbedtls_ccm_context *ctx, size_t length, + const unsigned char *iv, size_t iv_len, + const unsigned char *add, size_t add_len, + const unsigned char *input, unsigned char *output, + const unsigned char *tag, size_t tag_len ); + +/** + * \brief This function performs a CCM* authenticated decryption of a + * buffer. + * + * \note When using this function in a variable tag length context, + * the tag length has to be decoded from \p iv and passed to + * this function as \p tag_len. (\p tag needs to be adjusted + * accordingly.) + * + * \param ctx The CCM context to use for decryption. This must be + * initialized and bound to a key. + * \param length The length of the input data in Bytes. + * \param iv The initialization vector (nonce). This must be a readable + * buffer of at least \p iv_len Bytes. + * \param iv_len The length of the nonce in Bytes: 7, 8, 9, 10, 11, 12, + * or 13. The length L of the message length field is + * 15 - \p iv_len. + * \param add The additional data field. This must be a readable buffer of + * at least that \p add_len Bytes. + * \param add_len The length of additional data in Bytes. + * This must be less than 2^16 - 2^8. + * \param input The buffer holding the input data. If \p length is greater + * than zero, \p input must be a readable buffer of at least + * that length. + * \param output The buffer holding the output data. If \p length is greater + * than zero, \p output must be a writable buffer of at least + * that length. + * \param tag The buffer holding the authentication field. This must be a + * readable buffer of at least \p tag_len Bytes. + * \param tag_len The length of the authentication field in Bytes. + * 0, 4, 6, 8, 10, 12, 14 or 16. + * + * \warning Passing \c 0 as \p tag_len means that the message is nos + * longer authenticated. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CCM_AUTH_FAILED if the tag does not match. + * \return A cipher-specific error code on calculation failure. + */ +int mbedtls_ccm_star_auth_decrypt( mbedtls_ccm_context *ctx, size_t length, + const unsigned char *iv, size_t iv_len, + const unsigned char *add, size_t add_len, + const unsigned char *input, unsigned char *output, + const unsigned char *tag, size_t tag_len ); + +#if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_AES_C) +/** + * \brief The CCM checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_ccm_self_test( int verbose ); +#endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CCM_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/certs.h b/openharmony/armeabi-v7a/include/mbedtls/certs.h new file mode 100644 index 00000000..c93c741c --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/certs.h @@ -0,0 +1,250 @@ +/** + * \file certs.h + * + * \brief Sample certificates and DHM parameters for testing + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_CERTS_H +#define MBEDTLS_CERTS_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/* List of all PEM-encoded CA certificates, terminated by NULL; + * PEM encoded if MBEDTLS_PEM_PARSE_C is enabled, DER encoded + * otherwise. */ +extern const char * mbedtls_test_cas[]; +extern const size_t mbedtls_test_cas_len[]; + +/* List of all DER-encoded CA certificates, terminated by NULL */ +extern const unsigned char * mbedtls_test_cas_der[]; +extern const size_t mbedtls_test_cas_der_len[]; + +#if defined(MBEDTLS_PEM_PARSE_C) +/* Concatenation of all CA certificates in PEM format if available */ +extern const char mbedtls_test_cas_pem[]; +extern const size_t mbedtls_test_cas_pem_len; +#endif /* MBEDTLS_PEM_PARSE_C */ + +/* + * CA test certificates + */ + +extern const char mbedtls_test_ca_crt_ec_pem[]; +extern const char mbedtls_test_ca_key_ec_pem[]; +extern const char mbedtls_test_ca_pwd_ec_pem[]; +extern const char mbedtls_test_ca_key_rsa_pem[]; +extern const char mbedtls_test_ca_pwd_rsa_pem[]; +extern const char mbedtls_test_ca_crt_rsa_sha1_pem[]; +extern const char mbedtls_test_ca_crt_rsa_sha256_pem[]; + +extern const unsigned char mbedtls_test_ca_crt_ec_der[]; +extern const unsigned char mbedtls_test_ca_key_ec_der[]; +extern const unsigned char mbedtls_test_ca_key_rsa_der[]; +extern const unsigned char mbedtls_test_ca_crt_rsa_sha1_der[]; +extern const unsigned char mbedtls_test_ca_crt_rsa_sha256_der[]; + +extern const size_t mbedtls_test_ca_crt_ec_pem_len; +extern const size_t mbedtls_test_ca_key_ec_pem_len; +extern const size_t mbedtls_test_ca_pwd_ec_pem_len; +extern const size_t mbedtls_test_ca_key_rsa_pem_len; +extern const size_t mbedtls_test_ca_pwd_rsa_pem_len; +extern const size_t mbedtls_test_ca_crt_rsa_sha1_pem_len; +extern const size_t mbedtls_test_ca_crt_rsa_sha256_pem_len; + +extern const size_t mbedtls_test_ca_crt_ec_der_len; +extern const size_t mbedtls_test_ca_key_ec_der_len; +extern const size_t mbedtls_test_ca_pwd_ec_der_len; +extern const size_t mbedtls_test_ca_key_rsa_der_len; +extern const size_t mbedtls_test_ca_pwd_rsa_der_len; +extern const size_t mbedtls_test_ca_crt_rsa_sha1_der_len; +extern const size_t mbedtls_test_ca_crt_rsa_sha256_der_len; + +/* Config-dependent dispatch between PEM and DER encoding + * (PEM if enabled, otherwise DER) */ + +extern const char mbedtls_test_ca_crt_ec[]; +extern const char mbedtls_test_ca_key_ec[]; +extern const char mbedtls_test_ca_pwd_ec[]; +extern const char mbedtls_test_ca_key_rsa[]; +extern const char mbedtls_test_ca_pwd_rsa[]; +extern const char mbedtls_test_ca_crt_rsa_sha1[]; +extern const char mbedtls_test_ca_crt_rsa_sha256[]; + +extern const size_t mbedtls_test_ca_crt_ec_len; +extern const size_t mbedtls_test_ca_key_ec_len; +extern const size_t mbedtls_test_ca_pwd_ec_len; +extern const size_t mbedtls_test_ca_key_rsa_len; +extern const size_t mbedtls_test_ca_pwd_rsa_len; +extern const size_t mbedtls_test_ca_crt_rsa_sha1_len; +extern const size_t mbedtls_test_ca_crt_rsa_sha256_len; + +/* Config-dependent dispatch between SHA-1 and SHA-256 + * (SHA-256 if enabled, otherwise SHA-1) */ + +extern const char mbedtls_test_ca_crt_rsa[]; +extern const size_t mbedtls_test_ca_crt_rsa_len; + +/* Config-dependent dispatch between EC and RSA + * (RSA if enabled, otherwise EC) */ + +extern const char * mbedtls_test_ca_crt; +extern const char * mbedtls_test_ca_key; +extern const char * mbedtls_test_ca_pwd; +extern const size_t mbedtls_test_ca_crt_len; +extern const size_t mbedtls_test_ca_key_len; +extern const size_t mbedtls_test_ca_pwd_len; + +/* + * Server test certificates + */ + +extern const char mbedtls_test_srv_crt_ec_pem[]; +extern const char mbedtls_test_srv_key_ec_pem[]; +extern const char mbedtls_test_srv_pwd_ec_pem[]; +extern const char mbedtls_test_srv_key_rsa_pem[]; +extern const char mbedtls_test_srv_pwd_rsa_pem[]; +extern const char mbedtls_test_srv_crt_rsa_sha1_pem[]; +extern const char mbedtls_test_srv_crt_rsa_sha256_pem[]; + +extern const unsigned char mbedtls_test_srv_crt_ec_der[]; +extern const unsigned char mbedtls_test_srv_key_ec_der[]; +extern const unsigned char mbedtls_test_srv_key_rsa_der[]; +extern const unsigned char mbedtls_test_srv_crt_rsa_sha1_der[]; +extern const unsigned char mbedtls_test_srv_crt_rsa_sha256_der[]; + +extern const size_t mbedtls_test_srv_crt_ec_pem_len; +extern const size_t mbedtls_test_srv_key_ec_pem_len; +extern const size_t mbedtls_test_srv_pwd_ec_pem_len; +extern const size_t mbedtls_test_srv_key_rsa_pem_len; +extern const size_t mbedtls_test_srv_pwd_rsa_pem_len; +extern const size_t mbedtls_test_srv_crt_rsa_sha1_pem_len; +extern const size_t mbedtls_test_srv_crt_rsa_sha256_pem_len; + +extern const size_t mbedtls_test_srv_crt_ec_der_len; +extern const size_t mbedtls_test_srv_key_ec_der_len; +extern const size_t mbedtls_test_srv_pwd_ec_der_len; +extern const size_t mbedtls_test_srv_key_rsa_der_len; +extern const size_t mbedtls_test_srv_pwd_rsa_der_len; +extern const size_t mbedtls_test_srv_crt_rsa_sha1_der_len; +extern const size_t mbedtls_test_srv_crt_rsa_sha256_der_len; + +/* Config-dependent dispatch between PEM and DER encoding + * (PEM if enabled, otherwise DER) */ + +extern const char mbedtls_test_srv_crt_ec[]; +extern const char mbedtls_test_srv_key_ec[]; +extern const char mbedtls_test_srv_pwd_ec[]; +extern const char mbedtls_test_srv_key_rsa[]; +extern const char mbedtls_test_srv_pwd_rsa[]; +extern const char mbedtls_test_srv_crt_rsa_sha1[]; +extern const char mbedtls_test_srv_crt_rsa_sha256[]; + +extern const size_t mbedtls_test_srv_crt_ec_len; +extern const size_t mbedtls_test_srv_key_ec_len; +extern const size_t mbedtls_test_srv_pwd_ec_len; +extern const size_t mbedtls_test_srv_key_rsa_len; +extern const size_t mbedtls_test_srv_pwd_rsa_len; +extern const size_t mbedtls_test_srv_crt_rsa_sha1_len; +extern const size_t mbedtls_test_srv_crt_rsa_sha256_len; + +/* Config-dependent dispatch between SHA-1 and SHA-256 + * (SHA-256 if enabled, otherwise SHA-1) */ + +extern const char mbedtls_test_srv_crt_rsa[]; +extern const size_t mbedtls_test_srv_crt_rsa_len; + +/* Config-dependent dispatch between EC and RSA + * (RSA if enabled, otherwise EC) */ + +extern const char * mbedtls_test_srv_crt; +extern const char * mbedtls_test_srv_key; +extern const char * mbedtls_test_srv_pwd; +extern const size_t mbedtls_test_srv_crt_len; +extern const size_t mbedtls_test_srv_key_len; +extern const size_t mbedtls_test_srv_pwd_len; + +/* + * Client test certificates + */ + +extern const char mbedtls_test_cli_crt_ec_pem[]; +extern const char mbedtls_test_cli_key_ec_pem[]; +extern const char mbedtls_test_cli_pwd_ec_pem[]; +extern const char mbedtls_test_cli_key_rsa_pem[]; +extern const char mbedtls_test_cli_pwd_rsa_pem[]; +extern const char mbedtls_test_cli_crt_rsa_pem[]; + +extern const unsigned char mbedtls_test_cli_crt_ec_der[]; +extern const unsigned char mbedtls_test_cli_key_ec_der[]; +extern const unsigned char mbedtls_test_cli_key_rsa_der[]; +extern const unsigned char mbedtls_test_cli_crt_rsa_der[]; + +extern const size_t mbedtls_test_cli_crt_ec_pem_len; +extern const size_t mbedtls_test_cli_key_ec_pem_len; +extern const size_t mbedtls_test_cli_pwd_ec_pem_len; +extern const size_t mbedtls_test_cli_key_rsa_pem_len; +extern const size_t mbedtls_test_cli_pwd_rsa_pem_len; +extern const size_t mbedtls_test_cli_crt_rsa_pem_len; + +extern const size_t mbedtls_test_cli_crt_ec_der_len; +extern const size_t mbedtls_test_cli_key_ec_der_len; +extern const size_t mbedtls_test_cli_key_rsa_der_len; +extern const size_t mbedtls_test_cli_crt_rsa_der_len; + +/* Config-dependent dispatch between PEM and DER encoding + * (PEM if enabled, otherwise DER) */ + +extern const char mbedtls_test_cli_crt_ec[]; +extern const char mbedtls_test_cli_key_ec[]; +extern const char mbedtls_test_cli_pwd_ec[]; +extern const char mbedtls_test_cli_key_rsa[]; +extern const char mbedtls_test_cli_pwd_rsa[]; +extern const char mbedtls_test_cli_crt_rsa[]; + +extern const size_t mbedtls_test_cli_crt_ec_len; +extern const size_t mbedtls_test_cli_key_ec_len; +extern const size_t mbedtls_test_cli_pwd_ec_len; +extern const size_t mbedtls_test_cli_key_rsa_len; +extern const size_t mbedtls_test_cli_pwd_rsa_len; +extern const size_t mbedtls_test_cli_crt_rsa_len; + +/* Config-dependent dispatch between EC and RSA + * (RSA if enabled, otherwise EC) */ + +extern const char * mbedtls_test_cli_crt; +extern const char * mbedtls_test_cli_key; +extern const char * mbedtls_test_cli_pwd; +extern const size_t mbedtls_test_cli_crt_len; +extern const size_t mbedtls_test_cli_key_len; +extern const size_t mbedtls_test_cli_pwd_len; + +#ifdef __cplusplus +} +#endif + +#endif /* certs.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/chacha20.h b/openharmony/armeabi-v7a/include/mbedtls/chacha20.h new file mode 100644 index 00000000..03b48714 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/chacha20.h @@ -0,0 +1,228 @@ +/** + * \file chacha20.h + * + * \brief This file contains ChaCha20 definitions and functions. + * + * ChaCha20 is a stream cipher that can encrypt and decrypt + * information. ChaCha was created by Daniel Bernstein as a variant of + * its Salsa cipher https://cr.yp.to/chacha/chacha-20080128.pdf + * ChaCha20 is the variant with 20 rounds, that was also standardized + * in RFC 7539. + * + * \author Daniel King + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CHACHA20_H +#define MBEDTLS_CHACHA20_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +/** Invalid input parameter(s). */ +#define MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA -0x0051 + +/* MBEDTLS_ERR_CHACHA20_FEATURE_UNAVAILABLE is deprecated and should not be + * used. */ +/** Feature not available. For example, s part of the API is not implemented. */ +#define MBEDTLS_ERR_CHACHA20_FEATURE_UNAVAILABLE -0x0053 + +/* MBEDTLS_ERR_CHACHA20_HW_ACCEL_FAILED is deprecated and should not be used. + */ +/** Chacha20 hardware accelerator failed. */ +#define MBEDTLS_ERR_CHACHA20_HW_ACCEL_FAILED -0x0055 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_CHACHA20_ALT) + +typedef struct mbedtls_chacha20_context +{ + uint32_t state[16]; /*! The state (before round operations). */ + uint8_t keystream8[64]; /*! Leftover keystream bytes. */ + size_t keystream_bytes_used; /*! Number of keystream bytes already used. */ +} +mbedtls_chacha20_context; + +#else /* MBEDTLS_CHACHA20_ALT */ +#include "chacha20_alt.h" +#endif /* MBEDTLS_CHACHA20_ALT */ + +/** + * \brief This function initializes the specified ChaCha20 context. + * + * It must be the first API called before using + * the context. + * + * It is usually followed by calls to + * \c mbedtls_chacha20_setkey() and + * \c mbedtls_chacha20_starts(), then one or more calls to + * to \c mbedtls_chacha20_update(), and finally to + * \c mbedtls_chacha20_free(). + * + * \param ctx The ChaCha20 context to initialize. + * This must not be \c NULL. + */ +void mbedtls_chacha20_init( mbedtls_chacha20_context *ctx ); + +/** + * \brief This function releases and clears the specified + * ChaCha20 context. + * + * \param ctx The ChaCha20 context to clear. This may be \c NULL, + * in which case this function is a no-op. If it is not + * \c NULL, it must point to an initialized context. + * + */ +void mbedtls_chacha20_free( mbedtls_chacha20_context *ctx ); + +/** + * \brief This function sets the encryption/decryption key. + * + * \note After using this function, you must also call + * \c mbedtls_chacha20_starts() to set a nonce before you + * start encrypting/decrypting data with + * \c mbedtls_chacha_update(). + * + * \param ctx The ChaCha20 context to which the key should be bound. + * It must be initialized. + * \param key The encryption/decryption key. This must be \c 32 Bytes + * in length. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA if ctx or key is NULL. + */ +int mbedtls_chacha20_setkey( mbedtls_chacha20_context *ctx, + const unsigned char key[32] ); + +/** + * \brief This function sets the nonce and initial counter value. + * + * \note A ChaCha20 context can be re-used with the same key by + * calling this function to change the nonce. + * + * \warning You must never use the same nonce twice with the same key. + * This would void any confidentiality guarantees for the + * messages encrypted with the same nonce and key. + * + * \param ctx The ChaCha20 context to which the nonce should be bound. + * It must be initialized and bound to a key. + * \param nonce The nonce. This must be \c 12 Bytes in size. + * \param counter The initial counter value. This is usually \c 0. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA if ctx or nonce is + * NULL. + */ +int mbedtls_chacha20_starts( mbedtls_chacha20_context* ctx, + const unsigned char nonce[12], + uint32_t counter ); + +/** + * \brief This function encrypts or decrypts data. + * + * Since ChaCha20 is a stream cipher, the same operation is + * used for encrypting and decrypting data. + * + * \note The \p input and \p output pointers must either be equal or + * point to non-overlapping buffers. + * + * \note \c mbedtls_chacha20_setkey() and + * \c mbedtls_chacha20_starts() must be called at least once + * to setup the context before this function can be called. + * + * \note This function can be called multiple times in a row in + * order to encrypt of decrypt data piecewise with the same + * key and nonce. + * + * \param ctx The ChaCha20 context to use for encryption or decryption. + * It must be initialized and bound to a key and nonce. + * \param size The length of the input data in Bytes. + * \param input The buffer holding the input data. + * This pointer can be \c NULL if `size == 0`. + * \param output The buffer holding the output data. + * This must be able to hold \p size Bytes. + * This pointer can be \c NULL if `size == 0`. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_chacha20_update( mbedtls_chacha20_context *ctx, + size_t size, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function encrypts or decrypts data with ChaCha20 and + * the given key and nonce. + * + * Since ChaCha20 is a stream cipher, the same operation is + * used for encrypting and decrypting data. + * + * \warning You must never use the same (key, nonce) pair more than + * once. This would void any confidentiality guarantees for + * the messages encrypted with the same nonce and key. + * + * \note The \p input and \p output pointers must either be equal or + * point to non-overlapping buffers. + * + * \param key The encryption/decryption key. + * This must be \c 32 Bytes in length. + * \param nonce The nonce. This must be \c 12 Bytes in size. + * \param counter The initial counter value. This is usually \c 0. + * \param size The length of the input data in Bytes. + * \param input The buffer holding the input data. + * This pointer can be \c NULL if `size == 0`. + * \param output The buffer holding the output data. + * This must be able to hold \p size Bytes. + * This pointer can be \c NULL if `size == 0`. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_chacha20_crypt( const unsigned char key[32], + const unsigned char nonce[12], + uint32_t counter, + size_t size, + const unsigned char* input, + unsigned char* output ); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief The ChaCha20 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_chacha20_self_test( int verbose ); +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CHACHA20_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/chachapoly.h b/openharmony/armeabi-v7a/include/mbedtls/chachapoly.h new file mode 100644 index 00000000..ed568bc9 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/chachapoly.h @@ -0,0 +1,359 @@ +/** + * \file chachapoly.h + * + * \brief This file contains the AEAD-ChaCha20-Poly1305 definitions and + * functions. + * + * ChaCha20-Poly1305 is an algorithm for Authenticated Encryption + * with Associated Data (AEAD) that can be used to encrypt and + * authenticate data. It is based on ChaCha20 and Poly1305 by Daniel + * Bernstein and was standardized in RFC 7539. + * + * \author Daniel King + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CHACHAPOLY_H +#define MBEDTLS_CHACHAPOLY_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +/* for shared error codes */ +#include "mbedtls/poly1305.h" + +/** The requested operation is not permitted in the current state. */ +#define MBEDTLS_ERR_CHACHAPOLY_BAD_STATE -0x0054 +/** Authenticated decryption failed: data was not authentic. */ +#define MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED -0x0056 + +#ifdef __cplusplus +extern "C" { +#endif + +typedef enum +{ + MBEDTLS_CHACHAPOLY_ENCRYPT, /**< The mode value for performing encryption. */ + MBEDTLS_CHACHAPOLY_DECRYPT /**< The mode value for performing decryption. */ +} +mbedtls_chachapoly_mode_t; + +#if !defined(MBEDTLS_CHACHAPOLY_ALT) + +#include "mbedtls/chacha20.h" + +typedef struct mbedtls_chachapoly_context +{ + mbedtls_chacha20_context chacha20_ctx; /**< The ChaCha20 context. */ + mbedtls_poly1305_context poly1305_ctx; /**< The Poly1305 context. */ + uint64_t aad_len; /**< The length (bytes) of the Additional Authenticated Data. */ + uint64_t ciphertext_len; /**< The length (bytes) of the ciphertext. */ + int state; /**< The current state of the context. */ + mbedtls_chachapoly_mode_t mode; /**< Cipher mode (encrypt or decrypt). */ +} +mbedtls_chachapoly_context; + +#else /* !MBEDTLS_CHACHAPOLY_ALT */ +#include "chachapoly_alt.h" +#endif /* !MBEDTLS_CHACHAPOLY_ALT */ + +/** + * \brief This function initializes the specified ChaCha20-Poly1305 context. + * + * It must be the first API called before using + * the context. It must be followed by a call to + * \c mbedtls_chachapoly_setkey() before any operation can be + * done, and to \c mbedtls_chachapoly_free() once all + * operations with that context have been finished. + * + * In order to encrypt or decrypt full messages at once, for + * each message you should make a single call to + * \c mbedtls_chachapoly_crypt_and_tag() or + * \c mbedtls_chachapoly_auth_decrypt(). + * + * In order to encrypt messages piecewise, for each + * message you should make a call to + * \c mbedtls_chachapoly_starts(), then 0 or more calls to + * \c mbedtls_chachapoly_update_aad(), then 0 or more calls to + * \c mbedtls_chachapoly_update(), then one call to + * \c mbedtls_chachapoly_finish(). + * + * \warning Decryption with the piecewise API is discouraged! Always + * use \c mbedtls_chachapoly_auth_decrypt() when possible! + * + * If however this is not possible because the data is too + * large to fit in memory, you need to: + * + * - call \c mbedtls_chachapoly_starts() and (if needed) + * \c mbedtls_chachapoly_update_aad() as above, + * - call \c mbedtls_chachapoly_update() multiple times and + * ensure its output (the plaintext) is NOT used in any other + * way than placing it in temporary storage at this point, + * - call \c mbedtls_chachapoly_finish() to compute the + * authentication tag and compared it in constant time to the + * tag received with the ciphertext. + * + * If the tags are not equal, you must immediately discard + * all previous outputs of \c mbedtls_chachapoly_update(), + * otherwise you can now safely use the plaintext. + * + * \param ctx The ChachaPoly context to initialize. Must not be \c NULL. + */ +void mbedtls_chachapoly_init( mbedtls_chachapoly_context *ctx ); + +/** + * \brief This function releases and clears the specified + * ChaCha20-Poly1305 context. + * + * \param ctx The ChachaPoly context to clear. This may be \c NULL, in which + * case this function is a no-op. + */ +void mbedtls_chachapoly_free( mbedtls_chachapoly_context *ctx ); + +/** + * \brief This function sets the ChaCha20-Poly1305 + * symmetric encryption key. + * + * \param ctx The ChaCha20-Poly1305 context to which the key should be + * bound. This must be initialized. + * \param key The \c 256 Bit (\c 32 Bytes) key. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_chachapoly_setkey( mbedtls_chachapoly_context *ctx, + const unsigned char key[32] ); + +/** + * \brief This function starts a ChaCha20-Poly1305 encryption or + * decryption operation. + * + * \warning You must never use the same nonce twice with the same key. + * This would void any confidentiality and authenticity + * guarantees for the messages encrypted with the same nonce + * and key. + * + * \note If the context is being used for AAD only (no data to + * encrypt or decrypt) then \p mode can be set to any value. + * + * \warning Decryption with the piecewise API is discouraged, see the + * warning on \c mbedtls_chachapoly_init(). + * + * \param ctx The ChaCha20-Poly1305 context. This must be initialized + * and bound to a key. + * \param nonce The nonce/IV to use for the message. + * This must be a readable buffer of length \c 12 Bytes. + * \param mode The operation to perform: #MBEDTLS_CHACHAPOLY_ENCRYPT or + * #MBEDTLS_CHACHAPOLY_DECRYPT (discouraged, see warning). + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_chachapoly_starts( mbedtls_chachapoly_context *ctx, + const unsigned char nonce[12], + mbedtls_chachapoly_mode_t mode ); + +/** + * \brief This function feeds additional data to be authenticated + * into an ongoing ChaCha20-Poly1305 operation. + * + * The Additional Authenticated Data (AAD), also called + * Associated Data (AD) is only authenticated but not + * encrypted nor included in the encrypted output. It is + * usually transmitted separately from the ciphertext or + * computed locally by each party. + * + * \note This function is called before data is encrypted/decrypted. + * I.e. call this function to process the AAD before calling + * \c mbedtls_chachapoly_update(). + * + * You may call this function multiple times to process + * an arbitrary amount of AAD. It is permitted to call + * this function 0 times, if no AAD is used. + * + * This function cannot be called any more if data has + * been processed by \c mbedtls_chachapoly_update(), + * or if the context has been finished. + * + * \warning Decryption with the piecewise API is discouraged, see the + * warning on \c mbedtls_chachapoly_init(). + * + * \param ctx The ChaCha20-Poly1305 context. This must be initialized + * and bound to a key. + * \param aad_len The length in Bytes of the AAD. The length has no + * restrictions. + * \param aad Buffer containing the AAD. + * This pointer can be \c NULL if `aad_len == 0`. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA + * if \p ctx or \p aad are NULL. + * \return #MBEDTLS_ERR_CHACHAPOLY_BAD_STATE + * if the operations has not been started or has been + * finished, or if the AAD has been finished. + */ +int mbedtls_chachapoly_update_aad( mbedtls_chachapoly_context *ctx, + const unsigned char *aad, + size_t aad_len ); + +/** + * \brief Thus function feeds data to be encrypted or decrypted + * into an on-going ChaCha20-Poly1305 + * operation. + * + * The direction (encryption or decryption) depends on the + * mode that was given when calling + * \c mbedtls_chachapoly_starts(). + * + * You may call this function multiple times to process + * an arbitrary amount of data. It is permitted to call + * this function 0 times, if no data is to be encrypted + * or decrypted. + * + * \warning Decryption with the piecewise API is discouraged, see the + * warning on \c mbedtls_chachapoly_init(). + * + * \param ctx The ChaCha20-Poly1305 context to use. This must be initialized. + * \param len The length (in bytes) of the data to encrypt or decrypt. + * \param input The buffer containing the data to encrypt or decrypt. + * This pointer can be \c NULL if `len == 0`. + * \param output The buffer to where the encrypted or decrypted data is + * written. This must be able to hold \p len bytes. + * This pointer can be \c NULL if `len == 0`. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CHACHAPOLY_BAD_STATE + * if the operation has not been started or has been + * finished. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_chachapoly_update( mbedtls_chachapoly_context *ctx, + size_t len, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function finished the ChaCha20-Poly1305 operation and + * generates the MAC (authentication tag). + * + * \param ctx The ChaCha20-Poly1305 context to use. This must be initialized. + * \param mac The buffer to where the 128-bit (16 bytes) MAC is written. + * + * \warning Decryption with the piecewise API is discouraged, see the + * warning on \c mbedtls_chachapoly_init(). + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CHACHAPOLY_BAD_STATE + * if the operation has not been started or has been + * finished. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_chachapoly_finish( mbedtls_chachapoly_context *ctx, + unsigned char mac[16] ); + +/** + * \brief This function performs a complete ChaCha20-Poly1305 + * authenticated encryption with the previously-set key. + * + * \note Before using this function, you must set the key with + * \c mbedtls_chachapoly_setkey(). + * + * \warning You must never use the same nonce twice with the same key. + * This would void any confidentiality and authenticity + * guarantees for the messages encrypted with the same nonce + * and key. + * + * \param ctx The ChaCha20-Poly1305 context to use (holds the key). + * This must be initialized. + * \param length The length (in bytes) of the data to encrypt or decrypt. + * \param nonce The 96-bit (12 bytes) nonce/IV to use. + * \param aad The buffer containing the additional authenticated + * data (AAD). This pointer can be \c NULL if `aad_len == 0`. + * \param aad_len The length (in bytes) of the AAD data to process. + * \param input The buffer containing the data to encrypt or decrypt. + * This pointer can be \c NULL if `ilen == 0`. + * \param output The buffer to where the encrypted or decrypted data + * is written. This pointer can be \c NULL if `ilen == 0`. + * \param tag The buffer to where the computed 128-bit (16 bytes) MAC + * is written. This must not be \c NULL. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_chachapoly_encrypt_and_tag( mbedtls_chachapoly_context *ctx, + size_t length, + const unsigned char nonce[12], + const unsigned char *aad, + size_t aad_len, + const unsigned char *input, + unsigned char *output, + unsigned char tag[16] ); + +/** + * \brief This function performs a complete ChaCha20-Poly1305 + * authenticated decryption with the previously-set key. + * + * \note Before using this function, you must set the key with + * \c mbedtls_chachapoly_setkey(). + * + * \param ctx The ChaCha20-Poly1305 context to use (holds the key). + * \param length The length (in Bytes) of the data to decrypt. + * \param nonce The \c 96 Bit (\c 12 bytes) nonce/IV to use. + * \param aad The buffer containing the additional authenticated data (AAD). + * This pointer can be \c NULL if `aad_len == 0`. + * \param aad_len The length (in bytes) of the AAD data to process. + * \param tag The buffer holding the authentication tag. + * This must be a readable buffer of length \c 16 Bytes. + * \param input The buffer containing the data to decrypt. + * This pointer can be \c NULL if `ilen == 0`. + * \param output The buffer to where the decrypted data is written. + * This pointer can be \c NULL if `ilen == 0`. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED + * if the data was not authentic. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_chachapoly_auth_decrypt( mbedtls_chachapoly_context *ctx, + size_t length, + const unsigned char nonce[12], + const unsigned char *aad, + size_t aad_len, + const unsigned char tag[16], + const unsigned char *input, + unsigned char *output ); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief The ChaCha20-Poly1305 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_chachapoly_self_test( int verbose ); +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CHACHAPOLY_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/check_config.h b/openharmony/armeabi-v7a/include/mbedtls/check_config.h new file mode 100644 index 00000000..be5c548e --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/check_config.h @@ -0,0 +1,936 @@ +/** + * \file check_config.h + * + * \brief Consistency checks for configuration options + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/* + * It is recommended to include this file from your config.h + * in order to catch dependency issues early. + */ + +#ifndef MBEDTLS_CHECK_CONFIG_H +#define MBEDTLS_CHECK_CONFIG_H + +/* + * We assume CHAR_BIT is 8 in many places. In practice, this is true on our + * target platforms, so not an issue, but let's just be extra sure. + */ +#include +#if CHAR_BIT != 8 +#error "mbed TLS requires a platform with 8-bit chars" +#endif + +#if defined(_WIN32) +#if !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_C is required on Windows" +#endif + +/* Fix the config here. Not convenient to put an #ifdef _WIN32 in config.h as + * it would confuse config.py. */ +#if !defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) && \ + !defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) +#define MBEDTLS_PLATFORM_SNPRINTF_ALT +#endif + +#if !defined(MBEDTLS_PLATFORM_VSNPRINTF_ALT) && \ + !defined(MBEDTLS_PLATFORM_VSNPRINTF_MACRO) +#define MBEDTLS_PLATFORM_VSNPRINTF_ALT +#endif +#endif /* _WIN32 */ + +#if defined(TARGET_LIKE_MBED) && defined(MBEDTLS_NET_C) +#error "The NET module is not available for mbed OS - please use the network functions provided by Mbed OS" +#endif + +#if defined(MBEDTLS_DEPRECATED_WARNING) && \ + !defined(__GNUC__) && !defined(__clang__) +#error "MBEDTLS_DEPRECATED_WARNING only works with GCC and Clang" +#endif + +#if defined(MBEDTLS_HAVE_TIME_DATE) && !defined(MBEDTLS_HAVE_TIME) +#error "MBEDTLS_HAVE_TIME_DATE without MBEDTLS_HAVE_TIME does not make sense" +#endif + +#if defined(MBEDTLS_AESNI_C) && !defined(MBEDTLS_HAVE_ASM) +#error "MBEDTLS_AESNI_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_CTR_DRBG_C) && !defined(MBEDTLS_AES_C) +#error "MBEDTLS_CTR_DRBG_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_DHM_C) && !defined(MBEDTLS_BIGNUM_C) +#error "MBEDTLS_DHM_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT) && !defined(MBEDTLS_SSL_TRUNCATED_HMAC) +#error "MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_CMAC_C) && \ + !defined(MBEDTLS_AES_C) && !defined(MBEDTLS_DES_C) +#error "MBEDTLS_CMAC_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_NIST_KW_C) && \ + ( !defined(MBEDTLS_AES_C) || !defined(MBEDTLS_CIPHER_C) ) +#error "MBEDTLS_NIST_KW_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECDH_C) && !defined(MBEDTLS_ECP_C) +#error "MBEDTLS_ECDH_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECDSA_C) && \ + ( !defined(MBEDTLS_ECP_C) || \ + !( defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) ) || \ + !defined(MBEDTLS_ASN1_PARSE_C) || \ + !defined(MBEDTLS_ASN1_WRITE_C) ) +#error "MBEDTLS_ECDSA_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECJPAKE_C) && \ + ( !defined(MBEDTLS_ECP_C) || !defined(MBEDTLS_MD_C) ) +#error "MBEDTLS_ECJPAKE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_RESTARTABLE) && \ + ( defined(MBEDTLS_USE_PSA_CRYPTO) || \ + defined(MBEDTLS_ECDH_COMPUTE_SHARED_ALT) || \ + defined(MBEDTLS_ECDH_GEN_PUBLIC_ALT) || \ + defined(MBEDTLS_ECDSA_SIGN_ALT) || \ + defined(MBEDTLS_ECDSA_VERIFY_ALT) || \ + defined(MBEDTLS_ECDSA_GENKEY_ALT) || \ + defined(MBEDTLS_ECP_INTERNAL_ALT) || \ + defined(MBEDTLS_ECP_ALT) ) +#error "MBEDTLS_ECP_RESTARTABLE defined, but it cannot coexist with an alternative or PSA-based ECP implementation" +#endif + +#if defined(MBEDTLS_ECP_RESTARTABLE) && \ + ! defined(MBEDTLS_ECDH_LEGACY_CONTEXT) +#error "MBEDTLS_ECP_RESTARTABLE defined, but not MBEDTLS_ECDH_LEGACY_CONTEXT" +#endif + +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) && \ + defined(MBEDTLS_ECDH_LEGACY_CONTEXT) +#error "MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED defined, but MBEDTLS_ECDH_LEGACY_CONTEXT not disabled" +#endif + +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) && !defined(MBEDTLS_HMAC_DRBG_C) +#error "MBEDTLS_ECDSA_DETERMINISTIC defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_C) && ( !defined(MBEDTLS_BIGNUM_C) || ( \ + !defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) && \ + !defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) ) ) +#error "MBEDTLS_ECP_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_C) && !( \ + defined(MBEDTLS_ECP_ALT) || \ + defined(MBEDTLS_CTR_DRBG_C) || \ + defined(MBEDTLS_HMAC_DRBG_C) || \ + defined(MBEDTLS_ECP_NO_INTERNAL_RNG)) +#error "MBEDTLS_ECP_C requires a DRBG module unless MBEDTLS_ECP_NO_INTERNAL_RNG is defined or an alternative implementation is used" +#endif + +#if defined(MBEDTLS_PK_PARSE_C) && !defined(MBEDTLS_ASN1_PARSE_C) +#error "MBEDTLS_PK_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PKCS5_C) && !defined(MBEDTLS_MD_C) +#error "MBEDTLS_PKCS5_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ENTROPY_C) && (!defined(MBEDTLS_SHA512_C) && \ + !defined(MBEDTLS_SHA256_C)) +#error "MBEDTLS_ENTROPY_C defined, but not all prerequisites" +#endif +#if defined(MBEDTLS_ENTROPY_C) && defined(MBEDTLS_SHA512_C) && \ + defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) && (MBEDTLS_CTR_DRBG_ENTROPY_LEN > 64) +#error "MBEDTLS_CTR_DRBG_ENTROPY_LEN value too high" +#endif +#if defined(MBEDTLS_ENTROPY_C) && \ + ( !defined(MBEDTLS_SHA512_C) || defined(MBEDTLS_ENTROPY_FORCE_SHA256) ) \ + && defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) && (MBEDTLS_CTR_DRBG_ENTROPY_LEN > 32) +#error "MBEDTLS_CTR_DRBG_ENTROPY_LEN value too high" +#endif +#if defined(MBEDTLS_ENTROPY_C) && \ + defined(MBEDTLS_ENTROPY_FORCE_SHA256) && !defined(MBEDTLS_SHA256_C) +#error "MBEDTLS_ENTROPY_FORCE_SHA256 defined, but not all prerequisites" +#endif + +#if defined(__has_feature) +#if __has_feature(memory_sanitizer) +#define MBEDTLS_HAS_MEMSAN +#endif +#endif +#if defined(MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN) && !defined(MBEDTLS_HAS_MEMSAN) +#error "MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN requires building with MemorySanitizer" +#endif +#undef MBEDTLS_HAS_MEMSAN + +#if defined(MBEDTLS_TEST_NULL_ENTROPY) && \ + ( !defined(MBEDTLS_ENTROPY_C) || !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES) ) +#error "MBEDTLS_TEST_NULL_ENTROPY defined, but not all prerequisites" +#endif +#if defined(MBEDTLS_TEST_NULL_ENTROPY) && \ + ( defined(MBEDTLS_ENTROPY_NV_SEED) || defined(MBEDTLS_ENTROPY_HARDWARE_ALT) || \ + defined(MBEDTLS_HAVEGE_C) ) +#error "MBEDTLS_TEST_NULL_ENTROPY defined, but entropy sources too" +#endif + +#if defined(MBEDTLS_CCM_C) && ( \ + !defined(MBEDTLS_AES_C) && !defined(MBEDTLS_CAMELLIA_C) && !defined(MBEDTLS_ARIA_C) ) +#error "MBEDTLS_CCM_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_CCM_C) && !defined(MBEDTLS_CIPHER_C) +#error "MBEDTLS_CCM_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_GCM_C) && ( \ + !defined(MBEDTLS_AES_C) && !defined(MBEDTLS_CAMELLIA_C) && !defined(MBEDTLS_ARIA_C) ) +#error "MBEDTLS_GCM_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_GCM_C) && !defined(MBEDTLS_CIPHER_C) +#error "MBEDTLS_GCM_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_CHACHAPOLY_C) && !defined(MBEDTLS_CHACHA20_C) +#error "MBEDTLS_CHACHAPOLY_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_CHACHAPOLY_C) && !defined(MBEDTLS_POLY1305_C) +#error "MBEDTLS_CHACHAPOLY_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_RANDOMIZE_JAC_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_ADD_MIXED_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_ADD_MIXED_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_DOUBLE_JAC_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_NORMALIZE_JAC_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_RANDOMIZE_MXZ_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_NORMALIZE_MXZ_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ECP_NO_FALLBACK) && !defined(MBEDTLS_ECP_INTERNAL_ALT) +#error "MBEDTLS_ECP_NO_FALLBACK defined, but no alternative implementation enabled" +#endif + +#if defined(MBEDTLS_HAVEGE_C) && !defined(MBEDTLS_TIMING_C) +#error "MBEDTLS_HAVEGE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_HKDF_C) && !defined(MBEDTLS_MD_C) +#error "MBEDTLS_HKDF_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_HMAC_DRBG_C) && !defined(MBEDTLS_MD_C) +#error "MBEDTLS_HMAC_DRBG_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) && \ + ( !defined(MBEDTLS_ECDH_C) || !defined(MBEDTLS_ECDSA_C) || \ + !defined(MBEDTLS_X509_CRT_PARSE_C) ) +#error "MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \ + ( !defined(MBEDTLS_ECDH_C) || !defined(MBEDTLS_RSA_C) || \ + !defined(MBEDTLS_X509_CRT_PARSE_C) ) +#error "MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) && !defined(MBEDTLS_DHM_C) +#error "MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) && \ + !defined(MBEDTLS_ECDH_C) +#error "MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \ + ( !defined(MBEDTLS_DHM_C) || !defined(MBEDTLS_RSA_C) || \ + !defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_PKCS1_V15) ) +#error "MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \ + ( !defined(MBEDTLS_ECDH_C) || !defined(MBEDTLS_RSA_C) || \ + !defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_PKCS1_V15) ) +#error "MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \ + ( !defined(MBEDTLS_ECDH_C) || !defined(MBEDTLS_ECDSA_C) || \ + !defined(MBEDTLS_X509_CRT_PARSE_C) ) +#error "MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) && \ + ( !defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_X509_CRT_PARSE_C) || \ + !defined(MBEDTLS_PKCS1_V15) ) +#error "MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \ + ( !defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_X509_CRT_PARSE_C) || \ + !defined(MBEDTLS_PKCS1_V15) ) +#error "MBEDTLS_KEY_EXCHANGE_RSA_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) && \ + ( !defined(MBEDTLS_ECJPAKE_C) || !defined(MBEDTLS_SHA256_C) || \ + !defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) ) +#error "MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) && \ + !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) && \ + ( !defined(MBEDTLS_SHA256_C) && \ + !defined(MBEDTLS_SHA512_C) && \ + !defined(MBEDTLS_SHA1_C) ) +#error "!MBEDTLS_SSL_KEEP_PEER_CERTIFICATE requires MBEDTLS_SHA512_C, MBEDTLS_SHA256_C or MBEDTLS_SHA1_C" +#endif + +#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) && \ + ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_PLATFORM_MEMORY) ) +#error "MBEDTLS_MEMORY_BUFFER_ALLOC_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_MEMORY_BACKTRACE) && !defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) +#error "MBEDTLS_MEMORY_BACKTRACE defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_MEMORY_DEBUG) && !defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) +#error "MBEDTLS_MEMORY_DEBUG defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PADLOCK_C) && !defined(MBEDTLS_HAVE_ASM) +#error "MBEDTLS_PADLOCK_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PEM_PARSE_C) && !defined(MBEDTLS_BASE64_C) +#error "MBEDTLS_PEM_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PEM_WRITE_C) && !defined(MBEDTLS_BASE64_C) +#error "MBEDTLS_PEM_WRITE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PK_C) && \ + ( !defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_ECP_C) ) +#error "MBEDTLS_PK_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PK_PARSE_C) && !defined(MBEDTLS_PK_C) +#error "MBEDTLS_PK_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PK_WRITE_C) && !defined(MBEDTLS_PK_C) +#error "MBEDTLS_PK_WRITE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PKCS11_C) && !defined(MBEDTLS_PK_C) +#error "MBEDTLS_PKCS11_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PKCS11_C) +#if defined(MBEDTLS_DEPRECATED_REMOVED) +#error "MBEDTLS_PKCS11_C is deprecated and will be removed in a future version of Mbed TLS" +#elif defined(MBEDTLS_DEPRECATED_WARNING) +#warning "MBEDTLS_PKCS11_C is deprecated and will be removed in a future version of Mbed TLS" +#endif +#endif /* MBEDTLS_PKCS11_C */ + +#if defined(MBEDTLS_PLATFORM_EXIT_ALT) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_EXIT_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_EXIT_MACRO) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_EXIT_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_EXIT_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_EXIT) ||\ + defined(MBEDTLS_PLATFORM_EXIT_ALT) ) +#error "MBEDTLS_PLATFORM_EXIT_MACRO and MBEDTLS_PLATFORM_STD_EXIT/MBEDTLS_PLATFORM_EXIT_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_TIME_ALT) &&\ + ( !defined(MBEDTLS_PLATFORM_C) ||\ + !defined(MBEDTLS_HAVE_TIME) ) +#error "MBEDTLS_PLATFORM_TIME_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_TIME_MACRO) &&\ + ( !defined(MBEDTLS_PLATFORM_C) ||\ + !defined(MBEDTLS_HAVE_TIME) ) +#error "MBEDTLS_PLATFORM_TIME_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_TIME_TYPE_MACRO) &&\ + ( !defined(MBEDTLS_PLATFORM_C) ||\ + !defined(MBEDTLS_HAVE_TIME) ) +#error "MBEDTLS_PLATFORM_TIME_TYPE_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_TIME_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_TIME) ||\ + defined(MBEDTLS_PLATFORM_TIME_ALT) ) +#error "MBEDTLS_PLATFORM_TIME_MACRO and MBEDTLS_PLATFORM_STD_TIME/MBEDTLS_PLATFORM_TIME_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_TIME_TYPE_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_TIME) ||\ + defined(MBEDTLS_PLATFORM_TIME_ALT) ) +#error "MBEDTLS_PLATFORM_TIME_TYPE_MACRO and MBEDTLS_PLATFORM_STD_TIME/MBEDTLS_PLATFORM_TIME_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_FPRINTF_ALT) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_FPRINTF_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_FPRINTF_MACRO) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_FPRINTF_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_FPRINTF_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_FPRINTF) ||\ + defined(MBEDTLS_PLATFORM_FPRINTF_ALT) ) +#error "MBEDTLS_PLATFORM_FPRINTF_MACRO and MBEDTLS_PLATFORM_STD_FPRINTF/MBEDTLS_PLATFORM_FPRINTF_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_FREE_MACRO) &&\ + ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_PLATFORM_MEMORY) ) +#error "MBEDTLS_PLATFORM_FREE_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_FREE_MACRO) &&\ + defined(MBEDTLS_PLATFORM_STD_FREE) +#error "MBEDTLS_PLATFORM_FREE_MACRO and MBEDTLS_PLATFORM_STD_FREE cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_FREE_MACRO) && !defined(MBEDTLS_PLATFORM_CALLOC_MACRO) +#error "MBEDTLS_PLATFORM_CALLOC_MACRO must be defined if MBEDTLS_PLATFORM_FREE_MACRO is" +#endif + +#if defined(MBEDTLS_PLATFORM_CALLOC_MACRO) &&\ + ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_PLATFORM_MEMORY) ) +#error "MBEDTLS_PLATFORM_CALLOC_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_CALLOC_MACRO) &&\ + defined(MBEDTLS_PLATFORM_STD_CALLOC) +#error "MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_STD_CALLOC cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_CALLOC_MACRO) && !defined(MBEDTLS_PLATFORM_FREE_MACRO) +#error "MBEDTLS_PLATFORM_FREE_MACRO must be defined if MBEDTLS_PLATFORM_CALLOC_MACRO is" +#endif + +#if defined(MBEDTLS_PLATFORM_MEMORY) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_MEMORY defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_PRINTF_ALT) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_PRINTF_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_PRINTF_MACRO) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_PRINTF_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_PRINTF_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_PRINTF) ||\ + defined(MBEDTLS_PLATFORM_PRINTF_ALT) ) +#error "MBEDTLS_PLATFORM_PRINTF_MACRO and MBEDTLS_PLATFORM_STD_PRINTF/MBEDTLS_PLATFORM_PRINTF_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_SNPRINTF_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) && !defined(MBEDTLS_PLATFORM_C) +#error "MBEDTLS_PLATFORM_SNPRINTF_MACRO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_SNPRINTF) ||\ + defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) ) +#error "MBEDTLS_PLATFORM_SNPRINTF_MACRO and MBEDTLS_PLATFORM_STD_SNPRINTF/MBEDTLS_PLATFORM_SNPRINTF_ALT cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_MEM_HDR) &&\ + !defined(MBEDTLS_PLATFORM_NO_STD_FUNCTIONS) +#error "MBEDTLS_PLATFORM_STD_MEM_HDR defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_CALLOC) && !defined(MBEDTLS_PLATFORM_MEMORY) +#error "MBEDTLS_PLATFORM_STD_CALLOC defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_FREE) && !defined(MBEDTLS_PLATFORM_MEMORY) +#error "MBEDTLS_PLATFORM_STD_FREE defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_EXIT) &&\ + !defined(MBEDTLS_PLATFORM_EXIT_ALT) +#error "MBEDTLS_PLATFORM_STD_EXIT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_TIME) &&\ + ( !defined(MBEDTLS_PLATFORM_TIME_ALT) ||\ + !defined(MBEDTLS_HAVE_TIME) ) +#error "MBEDTLS_PLATFORM_STD_TIME defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_FPRINTF) &&\ + !defined(MBEDTLS_PLATFORM_FPRINTF_ALT) +#error "MBEDTLS_PLATFORM_STD_FPRINTF defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_PRINTF) &&\ + !defined(MBEDTLS_PLATFORM_PRINTF_ALT) +#error "MBEDTLS_PLATFORM_STD_PRINTF defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_SNPRINTF) &&\ + !defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) +#error "MBEDTLS_PLATFORM_STD_SNPRINTF defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_ENTROPY_NV_SEED) &&\ + ( !defined(MBEDTLS_PLATFORM_C) || !defined(MBEDTLS_ENTROPY_C) ) +#error "MBEDTLS_ENTROPY_NV_SEED defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_NV_SEED_ALT) &&\ + !defined(MBEDTLS_ENTROPY_NV_SEED) +#error "MBEDTLS_PLATFORM_NV_SEED_ALT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_NV_SEED_READ) &&\ + !defined(MBEDTLS_PLATFORM_NV_SEED_ALT) +#error "MBEDTLS_PLATFORM_STD_NV_SEED_READ defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_STD_NV_SEED_WRITE) &&\ + !defined(MBEDTLS_PLATFORM_NV_SEED_ALT) +#error "MBEDTLS_PLATFORM_STD_NV_SEED_WRITE defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PLATFORM_NV_SEED_READ_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_NV_SEED_READ) ||\ + defined(MBEDTLS_PLATFORM_NV_SEED_ALT) ) +#error "MBEDTLS_PLATFORM_NV_SEED_READ_MACRO and MBEDTLS_PLATFORM_STD_NV_SEED_READ cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO) &&\ + ( defined(MBEDTLS_PLATFORM_STD_NV_SEED_WRITE) ||\ + defined(MBEDTLS_PLATFORM_NV_SEED_ALT) ) +#error "MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO and MBEDTLS_PLATFORM_STD_NV_SEED_WRITE cannot be defined simultaneously" +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_C) && \ + !( ( ( defined(MBEDTLS_CTR_DRBG_C) || defined(MBEDTLS_HMAC_DRBG_C) ) && \ + defined(MBEDTLS_ENTROPY_C) ) || \ + defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) ) +#error "MBEDTLS_PSA_CRYPTO_C defined, but not all prerequisites (missing RNG)" +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_SPM) && !defined(MBEDTLS_PSA_CRYPTO_C) +#error "MBEDTLS_PSA_CRYPTO_SPM defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_SE_C) && \ + ! ( defined(MBEDTLS_PSA_CRYPTO_C) && \ + defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) ) +#error "MBEDTLS_PSA_CRYPTO_SE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \ + ! defined(MBEDTLS_PSA_CRYPTO_C) +#error "MBEDTLS_PSA_CRYPTO_STORAGE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \ + !( defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \ + defined(MBEDTLS_ENTROPY_NV_SEED) ) +#error "MBEDTLS_PSA_INJECT_ENTROPY defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \ + !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES) +#error "MBEDTLS_PSA_INJECT_ENTROPY is not compatible with actual entropy sources" +#endif + +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \ + defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) +#error "MBEDTLS_PSA_INJECT_ENTROPY is not compatible with MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG" +#endif + +#if defined(MBEDTLS_PSA_ITS_FILE_C) && \ + !defined(MBEDTLS_FS_IO) +#error "MBEDTLS_PSA_ITS_FILE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER) && \ + defined(MBEDTLS_USE_PSA_CRYPTO) +#error "MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER defined, but it cannot coexist with MBEDTLS_USE_PSA_CRYPTO." +#endif + +#if defined(MBEDTLS_PK_C) && defined(MBEDTLS_USE_PSA_CRYPTO) && \ + !defined(MBEDTLS_PK_WRITE_C) && defined(MBEDTLS_ECDSA_C) +#error "MBEDTLS_PK_C in configuration with MBEDTLS_USE_PSA_CRYPTO and \ + MBEDTLS_ECDSA_C requires MBEDTLS_PK_WRITE_C to be defined." +#endif + +#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V15) && \ + !defined(MBEDTLS_PK_WRITE_C) && defined(MBEDTLS_PSA_CRYPTO_C) +#error "MBEDTLS_PSA_CRYPTO_C, MBEDTLS_RSA_C and MBEDTLS_PKCS1_V15 defined, \ + but not all prerequisites" +#endif + +#if defined(MBEDTLS_RSA_C) && ( !defined(MBEDTLS_BIGNUM_C) || \ + !defined(MBEDTLS_OID_C) ) +#error "MBEDTLS_RSA_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_RSA_C) && ( !defined(MBEDTLS_PKCS1_V21) && \ + !defined(MBEDTLS_PKCS1_V15) ) +#error "MBEDTLS_RSA_C defined, but none of the PKCS1 versions enabled" +#endif + +#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \ + ( !defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_PKCS1_V21) ) +#error "MBEDTLS_X509_RSASSA_PSS_SUPPORT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SHA512_NO_SHA384) && !defined(MBEDTLS_SHA512_C) +#error "MBEDTLS_SHA512_NO_SHA384 defined without MBEDTLS_SHA512_C" +#endif + +#if defined(MBEDTLS_SSL_PROTO_SSL3) && ( !defined(MBEDTLS_MD5_C) || \ + !defined(MBEDTLS_SHA1_C) ) +#error "MBEDTLS_SSL_PROTO_SSL3 defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1) && ( !defined(MBEDTLS_MD5_C) || \ + !defined(MBEDTLS_SHA1_C) ) +#error "MBEDTLS_SSL_PROTO_TLS1 defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1_1) && ( !defined(MBEDTLS_MD5_C) || \ + !defined(MBEDTLS_SHA1_C) ) +#error "MBEDTLS_SSL_PROTO_TLS1_1 defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && ( !defined(MBEDTLS_SHA1_C) && \ + !defined(MBEDTLS_SHA256_C) && !defined(MBEDTLS_SHA512_C) ) +#error "MBEDTLS_SSL_PROTO_TLS1_2 defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL) && ( !defined(MBEDTLS_HKDF_C) && \ + !defined(MBEDTLS_SHA256_C) && !defined(MBEDTLS_SHA512_C) ) +#error "MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL defined, but not all prerequisites" +#endif + +#if (defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ + defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)) && \ + !(defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) ) +#error "One or more versions of the TLS protocol are enabled " \ + "but no key exchange methods defined with MBEDTLS_KEY_EXCHANGE_xxxx" +#endif + +#if defined(MBEDTLS_SSL_PROTO_DTLS) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_1) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_2) +#error "MBEDTLS_SSL_PROTO_DTLS defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_CLI_C) && !defined(MBEDTLS_SSL_TLS_C) +#error "MBEDTLS_SSL_CLI_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_TLS_C) && ( !defined(MBEDTLS_CIPHER_C) || \ + !defined(MBEDTLS_MD_C) ) +#error "MBEDTLS_SSL_TLS_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_TLS_C) +#error "MBEDTLS_SSL_SRV_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_TLS_C) && (!defined(MBEDTLS_SSL_PROTO_SSL3) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1) && !defined(MBEDTLS_SSL_PROTO_TLS1_1) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_2)) +#error "MBEDTLS_SSL_TLS_C defined, but no protocols are active" +#endif + +#if defined(MBEDTLS_SSL_TLS_C) && (defined(MBEDTLS_SSL_PROTO_SSL3) && \ + defined(MBEDTLS_SSL_PROTO_TLS1_1) && !defined(MBEDTLS_SSL_PROTO_TLS1)) +#error "Illegal protocol selection" +#endif + +#if defined(MBEDTLS_SSL_TLS_C) && (defined(MBEDTLS_SSL_PROTO_TLS1) && \ + defined(MBEDTLS_SSL_PROTO_TLS1_2) && !defined(MBEDTLS_SSL_PROTO_TLS1_1)) +#error "Illegal protocol selection" +#endif + +#if defined(MBEDTLS_SSL_TLS_C) && (defined(MBEDTLS_SSL_PROTO_SSL3) && \ + defined(MBEDTLS_SSL_PROTO_TLS1_2) && (!defined(MBEDTLS_SSL_PROTO_TLS1) || \ + !defined(MBEDTLS_SSL_PROTO_TLS1_1))) +#error "Illegal protocol selection" +#endif + +#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && !defined(MBEDTLS_SSL_PROTO_DTLS) +#error "MBEDTLS_SSL_DTLS_HELLO_VERIFY defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && \ + !defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) +#error "MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \ + ( !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) ) +#error "MBEDTLS_SSL_DTLS_ANTI_REPLAY defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \ + ( !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) ) +#error "MBEDTLS_SSL_DTLS_CONNECTION_ID defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \ + defined(MBEDTLS_SSL_CID_IN_LEN_MAX) && \ + MBEDTLS_SSL_CID_IN_LEN_MAX > 255 +#error "MBEDTLS_SSL_CID_IN_LEN_MAX too large (max 255)" +#endif + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \ + defined(MBEDTLS_SSL_CID_OUT_LEN_MAX) && \ + MBEDTLS_SSL_CID_OUT_LEN_MAX > 255 +#error "MBEDTLS_SSL_CID_OUT_LEN_MAX too large (max 255)" +#endif + +#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) && \ + ( !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) ) +#error "MBEDTLS_SSL_DTLS_BADMAC_LIMIT defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_1) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_2) +#error "MBEDTLS_SSL_ENCRYPT_THEN_MAC defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_1) && \ + !defined(MBEDTLS_SSL_PROTO_TLS1_2) +#error "MBEDTLS_SSL_EXTENDED_MASTER_SECRET defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_TICKET_C) && !defined(MBEDTLS_CIPHER_C) +#error "MBEDTLS_SSL_TICKET_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) && \ + !defined(MBEDTLS_SSL_PROTO_SSL3) && !defined(MBEDTLS_SSL_PROTO_TLS1) +#error "MBEDTLS_SSL_CBC_RECORD_SPLITTING defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \ + !defined(MBEDTLS_X509_CRT_PARSE_C) +#error "MBEDTLS_SSL_SERVER_NAME_INDICATION defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_THREADING_PTHREAD) +#if !defined(MBEDTLS_THREADING_C) || defined(MBEDTLS_THREADING_IMPL) +#error "MBEDTLS_THREADING_PTHREAD defined, but not all prerequisites" +#endif +#define MBEDTLS_THREADING_IMPL +#endif + +#if defined(MBEDTLS_THREADING_ALT) +#if !defined(MBEDTLS_THREADING_C) || defined(MBEDTLS_THREADING_IMPL) +#error "MBEDTLS_THREADING_ALT defined, but not all prerequisites" +#endif +#define MBEDTLS_THREADING_IMPL +#endif + +#if defined(MBEDTLS_THREADING_C) && !defined(MBEDTLS_THREADING_IMPL) +#error "MBEDTLS_THREADING_C defined, single threading implementation required" +#endif +#undef MBEDTLS_THREADING_IMPL + +#if defined(MBEDTLS_USE_PSA_CRYPTO) && !defined(MBEDTLS_PSA_CRYPTO_C) +#error "MBEDTLS_USE_PSA_CRYPTO defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_VERSION_FEATURES) && !defined(MBEDTLS_VERSION_C) +#error "MBEDTLS_VERSION_FEATURES defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_USE_C) && ( !defined(MBEDTLS_BIGNUM_C) || \ + !defined(MBEDTLS_OID_C) || !defined(MBEDTLS_ASN1_PARSE_C) || \ + !defined(MBEDTLS_PK_PARSE_C) ) +#error "MBEDTLS_X509_USE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CREATE_C) && ( !defined(MBEDTLS_BIGNUM_C) || \ + !defined(MBEDTLS_OID_C) || !defined(MBEDTLS_ASN1_WRITE_C) || \ + !defined(MBEDTLS_PK_WRITE_C) ) +#error "MBEDTLS_X509_CREATE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_CERTS_C) && !defined(MBEDTLS_X509_USE_C) +#error "MBEDTLS_CERTS_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CRT_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) ) +#error "MBEDTLS_X509_CRT_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CRL_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) ) +#error "MBEDTLS_X509_CRL_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CSR_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) ) +#error "MBEDTLS_X509_CSR_PARSE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CRT_WRITE_C) && ( !defined(MBEDTLS_X509_CREATE_C) ) +#error "MBEDTLS_X509_CRT_WRITE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_X509_CSR_WRITE_C) && ( !defined(MBEDTLS_X509_CREATE_C) ) +#error "MBEDTLS_X509_CSR_WRITE_C defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_HAVE_INT32) && defined(MBEDTLS_HAVE_INT64) +#error "MBEDTLS_HAVE_INT32 and MBEDTLS_HAVE_INT64 cannot be defined simultaneously" +#endif /* MBEDTLS_HAVE_INT32 && MBEDTLS_HAVE_INT64 */ + +#if ( defined(MBEDTLS_HAVE_INT32) || defined(MBEDTLS_HAVE_INT64) ) && \ + defined(MBEDTLS_HAVE_ASM) +#error "MBEDTLS_HAVE_INT32/MBEDTLS_HAVE_INT64 and MBEDTLS_HAVE_ASM cannot be defined simultaneously" +#endif /* (MBEDTLS_HAVE_INT32 || MBEDTLS_HAVE_INT64) && MBEDTLS_HAVE_ASM */ + +#if defined(MBEDTLS_SSL_PROTO_SSL3) +#if defined(MBEDTLS_DEPRECATED_REMOVED) +#error "MBEDTLS_SSL_PROTO_SSL3 is deprecated and will be removed in a future version of Mbed TLS" +#elif defined(MBEDTLS_DEPRECATED_WARNING) +#warning "MBEDTLS_SSL_PROTO_SSL3 is deprecated and will be removed in a future version of Mbed TLS" +#endif +#endif /* MBEDTLS_SSL_PROTO_SSL3 */ + +#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO) +#if defined(MBEDTLS_DEPRECATED_REMOVED) +#error "MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO is deprecated and will be removed in a future version of Mbed TLS" +#elif defined(MBEDTLS_DEPRECATED_WARNING) +#warning "MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO is deprecated and will be removed in a future version of Mbed TLS" +#endif +#endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */ + +#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) +#if defined(MBEDTLS_DEPRECATED_REMOVED) +#error "MBEDTLS_SSL_HW_RECORD_ACCEL is deprecated and will be removed in a future version of Mbed TLS" +#elif defined(MBEDTLS_DEPRECATED_WARNING) +#warning "MBEDTLS_SSL_HW_RECORD_ACCEL is deprecated and will be removed in a future version of Mbed TLS" +#endif /* MBEDTLS_DEPRECATED_REMOVED */ +#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */ + +#if defined(MBEDTLS_SSL_DTLS_SRTP) && ( !defined(MBEDTLS_SSL_PROTO_DTLS) ) +#error "MBEDTLS_SSL_DTLS_SRTP defined, but not all prerequisites" +#endif + +#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) && ( !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) ) +#error "MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH defined, but not all prerequisites" +#endif + +/* + * Avoid warning from -pedantic. This is a convenient place for this + * workaround since this is included by every single file before the + * #if defined(MBEDTLS_xxx_C) that results in empty translation units. + */ +typedef int mbedtls_iso_c_forbids_empty_translation_units; + +#endif /* MBEDTLS_CHECK_CONFIG_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/cipher.h b/openharmony/armeabi-v7a/include/mbedtls/cipher.h new file mode 100644 index 00000000..6d83da88 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/cipher.h @@ -0,0 +1,1102 @@ +/** + * \file cipher.h + * + * \brief This file contains an abstraction interface for use with the cipher + * primitives provided by the library. It provides a common interface to all of + * the available cipher operations. + * + * \author Adriaan de Jong + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CIPHER_H +#define MBEDTLS_CIPHER_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include "mbedtls/platform_util.h" + +#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C) || defined(MBEDTLS_CHACHAPOLY_C) +#define MBEDTLS_CIPHER_MODE_AEAD +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +#define MBEDTLS_CIPHER_MODE_WITH_PADDING +#endif + +#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER) || \ + defined(MBEDTLS_CHACHA20_C) +#define MBEDTLS_CIPHER_MODE_STREAM +#endif + +#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \ + !defined(inline) && !defined(__cplusplus) +#define inline __inline +#endif + +/** The selected feature is not available. */ +#define MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE -0x6080 +/** Bad input parameters. */ +#define MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA -0x6100 +/** Failed to allocate memory. */ +#define MBEDTLS_ERR_CIPHER_ALLOC_FAILED -0x6180 +/** Input data contains invalid padding and is rejected. */ +#define MBEDTLS_ERR_CIPHER_INVALID_PADDING -0x6200 +/** Decryption of block requires a full block. */ +#define MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED -0x6280 +/** Authentication failed (for AEAD modes). */ +#define MBEDTLS_ERR_CIPHER_AUTH_FAILED -0x6300 +/** The context is invalid. For example, because it was freed. */ +#define MBEDTLS_ERR_CIPHER_INVALID_CONTEXT -0x6380 + +/* MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** Cipher hardware accelerator failed. */ +#define MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED -0x6400 + +#define MBEDTLS_CIPHER_VARIABLE_IV_LEN 0x01 /**< Cipher accepts IVs of variable length. */ +#define MBEDTLS_CIPHER_VARIABLE_KEY_LEN 0x02 /**< Cipher accepts keys of variable length. */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Supported cipher types. + * + * \warning RC4 and DES are considered weak ciphers and their use + * constitutes a security risk. Arm recommends considering stronger + * ciphers instead. + */ +typedef enum { + MBEDTLS_CIPHER_ID_NONE = 0, /**< Placeholder to mark the end of cipher ID lists. */ + MBEDTLS_CIPHER_ID_NULL, /**< The identity cipher, treated as a stream cipher. */ + MBEDTLS_CIPHER_ID_AES, /**< The AES cipher. */ + MBEDTLS_CIPHER_ID_DES, /**< The DES cipher. */ + MBEDTLS_CIPHER_ID_3DES, /**< The Triple DES cipher. */ + MBEDTLS_CIPHER_ID_CAMELLIA, /**< The Camellia cipher. */ + MBEDTLS_CIPHER_ID_BLOWFISH, /**< The Blowfish cipher. */ + MBEDTLS_CIPHER_ID_ARC4, /**< The RC4 cipher. */ + MBEDTLS_CIPHER_ID_ARIA, /**< The Aria cipher. */ + MBEDTLS_CIPHER_ID_CHACHA20, /**< The ChaCha20 cipher. */ +} mbedtls_cipher_id_t; + +/** + * \brief Supported {cipher type, cipher mode} pairs. + * + * \warning RC4 and DES are considered weak ciphers and their use + * constitutes a security risk. Arm recommends considering stronger + * ciphers instead. + */ +typedef enum { + MBEDTLS_CIPHER_NONE = 0, /**< Placeholder to mark the end of cipher-pair lists. */ + MBEDTLS_CIPHER_NULL, /**< The identity stream cipher. */ + MBEDTLS_CIPHER_AES_128_ECB, /**< AES cipher with 128-bit ECB mode. */ + MBEDTLS_CIPHER_AES_192_ECB, /**< AES cipher with 192-bit ECB mode. */ + MBEDTLS_CIPHER_AES_256_ECB, /**< AES cipher with 256-bit ECB mode. */ + MBEDTLS_CIPHER_AES_128_CBC, /**< AES cipher with 128-bit CBC mode. */ + MBEDTLS_CIPHER_AES_192_CBC, /**< AES cipher with 192-bit CBC mode. */ + MBEDTLS_CIPHER_AES_256_CBC, /**< AES cipher with 256-bit CBC mode. */ + MBEDTLS_CIPHER_AES_128_CFB128, /**< AES cipher with 128-bit CFB128 mode. */ + MBEDTLS_CIPHER_AES_192_CFB128, /**< AES cipher with 192-bit CFB128 mode. */ + MBEDTLS_CIPHER_AES_256_CFB128, /**< AES cipher with 256-bit CFB128 mode. */ + MBEDTLS_CIPHER_AES_128_CTR, /**< AES cipher with 128-bit CTR mode. */ + MBEDTLS_CIPHER_AES_192_CTR, /**< AES cipher with 192-bit CTR mode. */ + MBEDTLS_CIPHER_AES_256_CTR, /**< AES cipher with 256-bit CTR mode. */ + MBEDTLS_CIPHER_AES_128_GCM, /**< AES cipher with 128-bit GCM mode. */ + MBEDTLS_CIPHER_AES_192_GCM, /**< AES cipher with 192-bit GCM mode. */ + MBEDTLS_CIPHER_AES_256_GCM, /**< AES cipher with 256-bit GCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_ECB, /**< Camellia cipher with 128-bit ECB mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_ECB, /**< Camellia cipher with 192-bit ECB mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_ECB, /**< Camellia cipher with 256-bit ECB mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_CBC, /**< Camellia cipher with 128-bit CBC mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_CBC, /**< Camellia cipher with 192-bit CBC mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_CBC, /**< Camellia cipher with 256-bit CBC mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_CFB128, /**< Camellia cipher with 128-bit CFB128 mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_CFB128, /**< Camellia cipher with 192-bit CFB128 mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_CFB128, /**< Camellia cipher with 256-bit CFB128 mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_CTR, /**< Camellia cipher with 128-bit CTR mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_CTR, /**< Camellia cipher with 192-bit CTR mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_CTR, /**< Camellia cipher with 256-bit CTR mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_GCM, /**< Camellia cipher with 128-bit GCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_GCM, /**< Camellia cipher with 192-bit GCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_GCM, /**< Camellia cipher with 256-bit GCM mode. */ + MBEDTLS_CIPHER_DES_ECB, /**< DES cipher with ECB mode. */ + MBEDTLS_CIPHER_DES_CBC, /**< DES cipher with CBC mode. */ + MBEDTLS_CIPHER_DES_EDE_ECB, /**< DES cipher with EDE ECB mode. */ + MBEDTLS_CIPHER_DES_EDE_CBC, /**< DES cipher with EDE CBC mode. */ + MBEDTLS_CIPHER_DES_EDE3_ECB, /**< DES cipher with EDE3 ECB mode. */ + MBEDTLS_CIPHER_DES_EDE3_CBC, /**< DES cipher with EDE3 CBC mode. */ + MBEDTLS_CIPHER_BLOWFISH_ECB, /**< Blowfish cipher with ECB mode. */ + MBEDTLS_CIPHER_BLOWFISH_CBC, /**< Blowfish cipher with CBC mode. */ + MBEDTLS_CIPHER_BLOWFISH_CFB64, /**< Blowfish cipher with CFB64 mode. */ + MBEDTLS_CIPHER_BLOWFISH_CTR, /**< Blowfish cipher with CTR mode. */ + MBEDTLS_CIPHER_ARC4_128, /**< RC4 cipher with 128-bit mode. */ + MBEDTLS_CIPHER_AES_128_CCM, /**< AES cipher with 128-bit CCM mode. */ + MBEDTLS_CIPHER_AES_192_CCM, /**< AES cipher with 192-bit CCM mode. */ + MBEDTLS_CIPHER_AES_256_CCM, /**< AES cipher with 256-bit CCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_128_CCM, /**< Camellia cipher with 128-bit CCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_192_CCM, /**< Camellia cipher with 192-bit CCM mode. */ + MBEDTLS_CIPHER_CAMELLIA_256_CCM, /**< Camellia cipher with 256-bit CCM mode. */ + MBEDTLS_CIPHER_ARIA_128_ECB, /**< Aria cipher with 128-bit key and ECB mode. */ + MBEDTLS_CIPHER_ARIA_192_ECB, /**< Aria cipher with 192-bit key and ECB mode. */ + MBEDTLS_CIPHER_ARIA_256_ECB, /**< Aria cipher with 256-bit key and ECB mode. */ + MBEDTLS_CIPHER_ARIA_128_CBC, /**< Aria cipher with 128-bit key and CBC mode. */ + MBEDTLS_CIPHER_ARIA_192_CBC, /**< Aria cipher with 192-bit key and CBC mode. */ + MBEDTLS_CIPHER_ARIA_256_CBC, /**< Aria cipher with 256-bit key and CBC mode. */ + MBEDTLS_CIPHER_ARIA_128_CFB128, /**< Aria cipher with 128-bit key and CFB-128 mode. */ + MBEDTLS_CIPHER_ARIA_192_CFB128, /**< Aria cipher with 192-bit key and CFB-128 mode. */ + MBEDTLS_CIPHER_ARIA_256_CFB128, /**< Aria cipher with 256-bit key and CFB-128 mode. */ + MBEDTLS_CIPHER_ARIA_128_CTR, /**< Aria cipher with 128-bit key and CTR mode. */ + MBEDTLS_CIPHER_ARIA_192_CTR, /**< Aria cipher with 192-bit key and CTR mode. */ + MBEDTLS_CIPHER_ARIA_256_CTR, /**< Aria cipher with 256-bit key and CTR mode. */ + MBEDTLS_CIPHER_ARIA_128_GCM, /**< Aria cipher with 128-bit key and GCM mode. */ + MBEDTLS_CIPHER_ARIA_192_GCM, /**< Aria cipher with 192-bit key and GCM mode. */ + MBEDTLS_CIPHER_ARIA_256_GCM, /**< Aria cipher with 256-bit key and GCM mode. */ + MBEDTLS_CIPHER_ARIA_128_CCM, /**< Aria cipher with 128-bit key and CCM mode. */ + MBEDTLS_CIPHER_ARIA_192_CCM, /**< Aria cipher with 192-bit key and CCM mode. */ + MBEDTLS_CIPHER_ARIA_256_CCM, /**< Aria cipher with 256-bit key and CCM mode. */ + MBEDTLS_CIPHER_AES_128_OFB, /**< AES 128-bit cipher in OFB mode. */ + MBEDTLS_CIPHER_AES_192_OFB, /**< AES 192-bit cipher in OFB mode. */ + MBEDTLS_CIPHER_AES_256_OFB, /**< AES 256-bit cipher in OFB mode. */ + MBEDTLS_CIPHER_AES_128_XTS, /**< AES 128-bit cipher in XTS block mode. */ + MBEDTLS_CIPHER_AES_256_XTS, /**< AES 256-bit cipher in XTS block mode. */ + MBEDTLS_CIPHER_CHACHA20, /**< ChaCha20 stream cipher. */ + MBEDTLS_CIPHER_CHACHA20_POLY1305, /**< ChaCha20-Poly1305 AEAD cipher. */ + MBEDTLS_CIPHER_AES_128_KW, /**< AES cipher with 128-bit NIST KW mode. */ + MBEDTLS_CIPHER_AES_192_KW, /**< AES cipher with 192-bit NIST KW mode. */ + MBEDTLS_CIPHER_AES_256_KW, /**< AES cipher with 256-bit NIST KW mode. */ + MBEDTLS_CIPHER_AES_128_KWP, /**< AES cipher with 128-bit NIST KWP mode. */ + MBEDTLS_CIPHER_AES_192_KWP, /**< AES cipher with 192-bit NIST KWP mode. */ + MBEDTLS_CIPHER_AES_256_KWP, /**< AES cipher with 256-bit NIST KWP mode. */ +} mbedtls_cipher_type_t; + +/** Supported cipher modes. */ +typedef enum { + MBEDTLS_MODE_NONE = 0, /**< None. */ + MBEDTLS_MODE_ECB, /**< The ECB cipher mode. */ + MBEDTLS_MODE_CBC, /**< The CBC cipher mode. */ + MBEDTLS_MODE_CFB, /**< The CFB cipher mode. */ + MBEDTLS_MODE_OFB, /**< The OFB cipher mode. */ + MBEDTLS_MODE_CTR, /**< The CTR cipher mode. */ + MBEDTLS_MODE_GCM, /**< The GCM cipher mode. */ + MBEDTLS_MODE_STREAM, /**< The stream cipher mode. */ + MBEDTLS_MODE_CCM, /**< The CCM cipher mode. */ + MBEDTLS_MODE_XTS, /**< The XTS cipher mode. */ + MBEDTLS_MODE_CHACHAPOLY, /**< The ChaCha-Poly cipher mode. */ + MBEDTLS_MODE_KW, /**< The SP800-38F KW mode */ + MBEDTLS_MODE_KWP, /**< The SP800-38F KWP mode */ +} mbedtls_cipher_mode_t; + +/** Supported cipher padding types. */ +typedef enum { + MBEDTLS_PADDING_PKCS7 = 0, /**< PKCS7 padding (default). */ + MBEDTLS_PADDING_ONE_AND_ZEROS, /**< ISO/IEC 7816-4 padding. */ + MBEDTLS_PADDING_ZEROS_AND_LEN, /**< ANSI X.923 padding. */ + MBEDTLS_PADDING_ZEROS, /**< Zero padding (not reversible). */ + MBEDTLS_PADDING_NONE, /**< Never pad (full blocks only). */ +} mbedtls_cipher_padding_t; + +/** Type of operation. */ +typedef enum { + MBEDTLS_OPERATION_NONE = -1, + MBEDTLS_DECRYPT = 0, + MBEDTLS_ENCRYPT, +} mbedtls_operation_t; + +enum { + /** Undefined key length. */ + MBEDTLS_KEY_LENGTH_NONE = 0, + /** Key length, in bits (including parity), for DES keys. */ + MBEDTLS_KEY_LENGTH_DES = 64, + /** Key length in bits, including parity, for DES in two-key EDE. */ + MBEDTLS_KEY_LENGTH_DES_EDE = 128, + /** Key length in bits, including parity, for DES in three-key EDE. */ + MBEDTLS_KEY_LENGTH_DES_EDE3 = 192, +}; + +/** Maximum length of any IV, in Bytes. */ +/* This should ideally be derived automatically from list of ciphers. + * This should be kept in sync with MBEDTLS_SSL_MAX_IV_LENGTH defined + * in ssl_internal.h. */ +#define MBEDTLS_MAX_IV_LENGTH 16 + +/** Maximum block size of any cipher, in Bytes. */ +/* This should ideally be derived automatically from list of ciphers. + * This should be kept in sync with MBEDTLS_SSL_MAX_BLOCK_LENGTH defined + * in ssl_internal.h. */ +#define MBEDTLS_MAX_BLOCK_LENGTH 16 + +/** Maximum key length, in Bytes. */ +/* This should ideally be derived automatically from list of ciphers. + * For now, only check whether XTS is enabled which uses 64 Byte keys, + * and use 32 Bytes as an upper bound for the maximum key length otherwise. + * This should be kept in sync with MBEDTLS_SSL_MAX_BLOCK_LENGTH defined + * in ssl_internal.h, which however deliberately ignores the case of XTS + * since the latter isn't used in SSL/TLS. */ +#if defined(MBEDTLS_CIPHER_MODE_XTS) +#define MBEDTLS_MAX_KEY_LENGTH 64 +#else +#define MBEDTLS_MAX_KEY_LENGTH 32 +#endif /* MBEDTLS_CIPHER_MODE_XTS */ + +/** + * Base cipher information (opaque struct). + */ +typedef struct mbedtls_cipher_base_t mbedtls_cipher_base_t; + +/** + * CMAC context (opaque struct). + */ +typedef struct mbedtls_cmac_context_t mbedtls_cmac_context_t; + +/** + * Cipher information. Allows calling cipher functions + * in a generic way. + */ +typedef struct mbedtls_cipher_info_t +{ + /** Full cipher identifier. For example, + * MBEDTLS_CIPHER_AES_256_CBC. + */ + mbedtls_cipher_type_t type; + + /** The cipher mode. For example, MBEDTLS_MODE_CBC. */ + mbedtls_cipher_mode_t mode; + + /** The cipher key length, in bits. This is the + * default length for variable sized ciphers. + * Includes parity bits for ciphers like DES. + */ + unsigned int key_bitlen; + + /** Name of the cipher. */ + const char * name; + + /** IV or nonce size, in Bytes. + * For ciphers that accept variable IV sizes, + * this is the recommended size. + */ + unsigned int iv_size; + + /** Bitflag comprised of MBEDTLS_CIPHER_VARIABLE_IV_LEN and + * MBEDTLS_CIPHER_VARIABLE_KEY_LEN indicating whether the + * cipher supports variable IV or variable key sizes, respectively. + */ + int flags; + + /** The block size, in Bytes. */ + unsigned int block_size; + + /** Struct for base cipher information and functions. */ + const mbedtls_cipher_base_t *base; + +} mbedtls_cipher_info_t; + +/** + * Generic cipher context. + */ +typedef struct mbedtls_cipher_context_t +{ + /** Information about the associated cipher. */ + const mbedtls_cipher_info_t *cipher_info; + + /** Key length to use. */ + int key_bitlen; + + /** Operation that the key of the context has been + * initialized for. + */ + mbedtls_operation_t operation; + +#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING) + /** Padding functions to use, if relevant for + * the specific cipher mode. + */ + void (*add_padding)( unsigned char *output, size_t olen, size_t data_len ); + int (*get_padding)( unsigned char *input, size_t ilen, size_t *data_len ); +#endif + + /** Buffer for input that has not been processed yet. */ + unsigned char unprocessed_data[MBEDTLS_MAX_BLOCK_LENGTH]; + + /** Number of Bytes that have not been processed yet. */ + size_t unprocessed_len; + + /** Current IV or NONCE_COUNTER for CTR-mode, data unit (or sector) number + * for XTS-mode. */ + unsigned char iv[MBEDTLS_MAX_IV_LENGTH]; + + /** IV size in Bytes, for ciphers with variable-length IVs. */ + size_t iv_size; + + /** The cipher-specific context. */ + void *cipher_ctx; + +#if defined(MBEDTLS_CMAC_C) + /** CMAC-specific context. */ + mbedtls_cmac_context_t *cmac_ctx; +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) + /** Indicates whether the cipher operations should be performed + * by Mbed TLS' own crypto library or an external implementation + * of the PSA Crypto API. + * This is unset if the cipher context was established through + * mbedtls_cipher_setup(), and set if it was established through + * mbedtls_cipher_setup_psa(). + */ + unsigned char psa_enabled; +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +} mbedtls_cipher_context_t; + +/** + * \brief This function retrieves the list of ciphers supported + * by the generic cipher module. + * + * For any cipher identifier in the returned list, you can + * obtain the corresponding generic cipher information structure + * via mbedtls_cipher_info_from_type(), which can then be used + * to prepare a cipher context via mbedtls_cipher_setup(). + * + * + * \return A statically-allocated array of cipher identifiers + * of type cipher_type_t. The last entry is zero. + */ +const int *mbedtls_cipher_list( void ); + +/** + * \brief This function retrieves the cipher-information + * structure associated with the given cipher name. + * + * \param cipher_name Name of the cipher to search for. This must not be + * \c NULL. + * + * \return The cipher information structure associated with the + * given \p cipher_name. + * \return \c NULL if the associated cipher information is not found. + */ +const mbedtls_cipher_info_t *mbedtls_cipher_info_from_string( const char *cipher_name ); + +/** + * \brief This function retrieves the cipher-information + * structure associated with the given cipher type. + * + * \param cipher_type Type of the cipher to search for. + * + * \return The cipher information structure associated with the + * given \p cipher_type. + * \return \c NULL if the associated cipher information is not found. + */ +const mbedtls_cipher_info_t *mbedtls_cipher_info_from_type( const mbedtls_cipher_type_t cipher_type ); + +/** + * \brief This function retrieves the cipher-information + * structure associated with the given cipher ID, + * key size and mode. + * + * \param cipher_id The ID of the cipher to search for. For example, + * #MBEDTLS_CIPHER_ID_AES. + * \param key_bitlen The length of the key in bits. + * \param mode The cipher mode. For example, #MBEDTLS_MODE_CBC. + * + * \return The cipher information structure associated with the + * given \p cipher_id. + * \return \c NULL if the associated cipher information is not found. + */ +const mbedtls_cipher_info_t *mbedtls_cipher_info_from_values( const mbedtls_cipher_id_t cipher_id, + int key_bitlen, + const mbedtls_cipher_mode_t mode ); + +/** + * \brief This function initializes a \p cipher_context as NONE. + * + * \param ctx The context to be initialized. This must not be \c NULL. + */ +void mbedtls_cipher_init( mbedtls_cipher_context_t *ctx ); + +/** + * \brief This function frees and clears the cipher-specific + * context of \p ctx. Freeing \p ctx itself remains the + * responsibility of the caller. + * + * \param ctx The context to be freed. If this is \c NULL, the + * function has no effect, otherwise this must point to an + * initialized context. + */ +void mbedtls_cipher_free( mbedtls_cipher_context_t *ctx ); + + +/** + * \brief This function initializes a cipher context for + * use with the given cipher primitive. + * + * \param ctx The context to initialize. This must be initialized. + * \param cipher_info The cipher to use. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_ALLOC_FAILED if allocation of the + * cipher-specific context fails. + * + * \internal Currently, the function also clears the structure. + * In future versions, the caller will be required to call + * mbedtls_cipher_init() on the structure first. + */ +int mbedtls_cipher_setup( mbedtls_cipher_context_t *ctx, + const mbedtls_cipher_info_t *cipher_info ); + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +/** + * \brief This function initializes a cipher context for + * PSA-based use with the given cipher primitive. + * + * \note See #MBEDTLS_USE_PSA_CRYPTO for information on PSA. + * + * \param ctx The context to initialize. May not be \c NULL. + * \param cipher_info The cipher to use. + * \param taglen For AEAD ciphers, the length in bytes of the + * authentication tag to use. Subsequent uses of + * mbedtls_cipher_auth_encrypt() or + * mbedtls_cipher_auth_decrypt() must provide + * the same tag length. + * For non-AEAD ciphers, the value must be \c 0. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_ALLOC_FAILED if allocation of the + * cipher-specific context fails. + */ +int mbedtls_cipher_setup_psa( mbedtls_cipher_context_t *ctx, + const mbedtls_cipher_info_t *cipher_info, + size_t taglen ); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +/** + * \brief This function returns the block size of the given cipher. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The block size of the underlying cipher. + * \return \c 0 if \p ctx has not been initialized. + */ +static inline unsigned int mbedtls_cipher_get_block_size( + const mbedtls_cipher_context_t *ctx ) +{ + MBEDTLS_INTERNAL_VALIDATE_RET( ctx != NULL, 0 ); + if( ctx->cipher_info == NULL ) + return 0; + + return ctx->cipher_info->block_size; +} + +/** + * \brief This function returns the mode of operation for + * the cipher. For example, MBEDTLS_MODE_CBC. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The mode of operation. + * \return #MBEDTLS_MODE_NONE if \p ctx has not been initialized. + */ +static inline mbedtls_cipher_mode_t mbedtls_cipher_get_cipher_mode( + const mbedtls_cipher_context_t *ctx ) +{ + MBEDTLS_INTERNAL_VALIDATE_RET( ctx != NULL, MBEDTLS_MODE_NONE ); + if( ctx->cipher_info == NULL ) + return MBEDTLS_MODE_NONE; + + return ctx->cipher_info->mode; +} + +/** + * \brief This function returns the size of the IV or nonce + * of the cipher, in Bytes. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The recommended IV size if no IV has been set. + * \return \c 0 for ciphers not using an IV or a nonce. + * \return The actual size if an IV has been set. + */ +static inline int mbedtls_cipher_get_iv_size( + const mbedtls_cipher_context_t *ctx ) +{ + MBEDTLS_INTERNAL_VALIDATE_RET( ctx != NULL, 0 ); + if( ctx->cipher_info == NULL ) + return 0; + + if( ctx->iv_size != 0 ) + return (int) ctx->iv_size; + + return (int) ctx->cipher_info->iv_size; +} + +/** + * \brief This function returns the type of the given cipher. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The type of the cipher. + * \return #MBEDTLS_CIPHER_NONE if \p ctx has not been initialized. + */ +static inline mbedtls_cipher_type_t mbedtls_cipher_get_type( + const mbedtls_cipher_context_t *ctx ) +{ + MBEDTLS_INTERNAL_VALIDATE_RET( + ctx != NULL, MBEDTLS_CIPHER_NONE ); + if( ctx->cipher_info == NULL ) + return MBEDTLS_CIPHER_NONE; + + return ctx->cipher_info->type; +} + +/** + * \brief This function returns the name of the given cipher + * as a string. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The name of the cipher. + * \return NULL if \p ctx has not been not initialized. + */ +static inline const char *mbedtls_cipher_get_name( + const mbedtls_cipher_context_t *ctx ) +{ + MBEDTLS_INTERNAL_VALIDATE_RET( ctx != NULL, 0 ); + if( ctx->cipher_info == NULL ) + return 0; + + return ctx->cipher_info->name; +} + +/** + * \brief This function returns the key length of the cipher. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The key length of the cipher in bits. + * \return #MBEDTLS_KEY_LENGTH_NONE if ctx \p has not been + * initialized. + */ +static inline int mbedtls_cipher_get_key_bitlen( + const mbedtls_cipher_context_t *ctx ) +{ + MBEDTLS_INTERNAL_VALIDATE_RET( + ctx != NULL, MBEDTLS_KEY_LENGTH_NONE ); + if( ctx->cipher_info == NULL ) + return MBEDTLS_KEY_LENGTH_NONE; + + return (int) ctx->cipher_info->key_bitlen; +} + +/** + * \brief This function returns the operation of the given cipher. + * + * \param ctx The context of the cipher. This must be initialized. + * + * \return The type of operation: #MBEDTLS_ENCRYPT or #MBEDTLS_DECRYPT. + * \return #MBEDTLS_OPERATION_NONE if \p ctx has not been initialized. + */ +static inline mbedtls_operation_t mbedtls_cipher_get_operation( + const mbedtls_cipher_context_t *ctx ) +{ + MBEDTLS_INTERNAL_VALIDATE_RET( + ctx != NULL, MBEDTLS_OPERATION_NONE ); + if( ctx->cipher_info == NULL ) + return MBEDTLS_OPERATION_NONE; + + return ctx->operation; +} + +/** + * \brief This function sets the key to use with the given context. + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a cipher information structure. + * \param key The key to use. This must be a readable buffer of at + * least \p key_bitlen Bits. + * \param key_bitlen The key length to use, in Bits. + * \param operation The operation that the key will be used for: + * #MBEDTLS_ENCRYPT or #MBEDTLS_DECRYPT. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_setkey( mbedtls_cipher_context_t *ctx, + const unsigned char *key, + int key_bitlen, + const mbedtls_operation_t operation ); + +#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING) +/** + * \brief This function sets the padding mode, for cipher modes + * that use padding. + * + * The default passing mode is PKCS7 padding. + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a cipher information structure. + * \param mode The padding mode. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE + * if the selected padding mode is not supported. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA if the cipher mode + * does not support padding. + */ +int mbedtls_cipher_set_padding_mode( mbedtls_cipher_context_t *ctx, + mbedtls_cipher_padding_t mode ); +#endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */ + +/** + * \brief This function sets the initialization vector (IV) + * or nonce. + * + * \note Some ciphers do not use IVs nor nonce. For these + * ciphers, this function has no effect. + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a cipher information structure. + * \param iv The IV to use, or NONCE_COUNTER for CTR-mode ciphers. This + * must be a readable buffer of at least \p iv_len Bytes. + * \param iv_len The IV length for ciphers with variable-size IV. + * This parameter is discarded by ciphers with fixed-size IV. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + */ +int mbedtls_cipher_set_iv( mbedtls_cipher_context_t *ctx, + const unsigned char *iv, + size_t iv_len ); + +/** + * \brief This function resets the cipher state. + * + * \param ctx The generic cipher context. This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + */ +int mbedtls_cipher_reset( mbedtls_cipher_context_t *ctx ); + +#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C) +/** + * \brief This function adds additional data for AEAD ciphers. + * Currently supported with GCM and ChaCha20+Poly1305. + * This must be called exactly once, after + * mbedtls_cipher_reset(). + * + * \param ctx The generic cipher context. This must be initialized. + * \param ad The additional data to use. This must be a readable + * buffer of at least \p ad_len Bytes. + * \param ad_len The length of \p ad in Bytes. + * + * \return \c 0 on success. + * \return A specific error code on failure. + */ +int mbedtls_cipher_update_ad( mbedtls_cipher_context_t *ctx, + const unsigned char *ad, size_t ad_len ); +#endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */ + +/** + * \brief The generic cipher update function. It encrypts or + * decrypts using the given cipher context. Writes as + * many block-sized blocks of data as possible to output. + * Any data that cannot be written immediately is either + * added to the next block, or flushed when + * mbedtls_cipher_finish() is called. + * Exception: For MBEDTLS_MODE_ECB, expects a single block + * in size. For example, 16 Bytes for AES. + * + * \note If the underlying cipher is used in GCM mode, all calls + * to this function, except for the last one before + * mbedtls_cipher_finish(), must have \p ilen as a + * multiple of the block size of the cipher. + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a key. + * \param input The buffer holding the input data. This must be a + * readable buffer of at least \p ilen Bytes. + * \param ilen The length of the input data. + * \param output The buffer for the output data. This must be able to + * hold at least `ilen + block_size`. This must not be the + * same buffer as \p input. + * \param olen The length of the output data, to be updated with the + * actual number of Bytes written. This must not be + * \c NULL. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE on an + * unsupported mode for a cipher. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_update( mbedtls_cipher_context_t *ctx, + const unsigned char *input, + size_t ilen, unsigned char *output, + size_t *olen ); + +/** + * \brief The generic cipher finalization function. If data still + * needs to be flushed from an incomplete block, the data + * contained in it is padded to the size of + * the last block, and written to the \p output buffer. + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a key. + * \param output The buffer to write data to. This needs to be a writable + * buffer of at least \p block_size Bytes. + * \param olen The length of the data written to the \p output buffer. + * This may not be \c NULL. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption + * expecting a full block but not receiving one. + * \return #MBEDTLS_ERR_CIPHER_INVALID_PADDING on invalid padding + * while decrypting. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_finish( mbedtls_cipher_context_t *ctx, + unsigned char *output, size_t *olen ); + +#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C) +/** + * \brief This function writes a tag for AEAD ciphers. + * Currently supported with GCM and ChaCha20+Poly1305. + * This must be called after mbedtls_cipher_finish(). + * + * \param ctx The generic cipher context. This must be initialized, + * bound to a key, and have just completed a cipher + * operation through mbedtls_cipher_finish() the tag for + * which should be written. + * \param tag The buffer to write the tag to. This must be a writable + * buffer of at least \p tag_len Bytes. + * \param tag_len The length of the tag to write. + * + * \return \c 0 on success. + * \return A specific error code on failure. + */ +int mbedtls_cipher_write_tag( mbedtls_cipher_context_t *ctx, + unsigned char *tag, size_t tag_len ); + +/** + * \brief This function checks the tag for AEAD ciphers. + * Currently supported with GCM and ChaCha20+Poly1305. + * This must be called after mbedtls_cipher_finish(). + * + * \param ctx The generic cipher context. This must be initialized. + * \param tag The buffer holding the tag. This must be a readable + * buffer of at least \p tag_len Bytes. + * \param tag_len The length of the tag to check. + * + * \return \c 0 on success. + * \return A specific error code on failure. + */ +int mbedtls_cipher_check_tag( mbedtls_cipher_context_t *ctx, + const unsigned char *tag, size_t tag_len ); +#endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */ + +/** + * \brief The generic all-in-one encryption/decryption function, + * for all ciphers except AEAD constructs. + * + * \param ctx The generic cipher context. This must be initialized. + * \param iv The IV to use, or NONCE_COUNTER for CTR-mode ciphers. + * This must be a readable buffer of at least \p iv_len + * Bytes. + * \param iv_len The IV length for ciphers with variable-size IV. + * This parameter is discarded by ciphers with fixed-size + * IV. + * \param input The buffer holding the input data. This must be a + * readable buffer of at least \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * \param output The buffer for the output data. This must be able to + * hold at least `ilen + block_size`. This must not be the + * same buffer as \p input. + * \param olen The length of the output data, to be updated with the + * actual number of Bytes written. This must not be + * \c NULL. + * + * \note Some ciphers do not use IVs nor nonce. For these + * ciphers, use \p iv = NULL and \p iv_len = 0. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption + * expecting a full block but not receiving one. + * \return #MBEDTLS_ERR_CIPHER_INVALID_PADDING on invalid padding + * while decrypting. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_crypt( mbedtls_cipher_context_t *ctx, + const unsigned char *iv, size_t iv_len, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen ); + +#if defined(MBEDTLS_CIPHER_MODE_AEAD) +#if ! defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif /* MBEDTLS_DEPRECATED_WARNING */ +/** + * \brief The generic authenticated encryption (AEAD) function. + * + * \deprecated Superseded by mbedtls_cipher_auth_encrypt_ext(). + * + * \note This function only supports AEAD algorithms, not key + * wrapping algorithms such as NIST_KW; for this, see + * mbedtls_cipher_auth_encrypt_ext(). + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a key associated with an AEAD algorithm. + * \param iv The nonce to use. This must be a readable buffer of + * at least \p iv_len Bytes and must not be \c NULL. + * \param iv_len The length of the nonce. This must satisfy the + * constraints imposed by the AEAD cipher used. + * \param ad The additional data to authenticate. This must be a + * readable buffer of at least \p ad_len Bytes, and may + * be \c NULL is \p ad_len is \c 0. + * \param ad_len The length of \p ad. + * \param input The buffer holding the input data. This must be a + * readable buffer of at least \p ilen Bytes, and may be + * \c NULL if \p ilen is \c 0. + * \param ilen The length of the input data. + * \param output The buffer for the output data. This must be a + * writable buffer of at least \p ilen Bytes, and must + * not be \c NULL. + * \param olen This will be filled with the actual number of Bytes + * written to the \p output buffer. This must point to a + * writable object of type \c size_t. + * \param tag The buffer for the authentication tag. This must be a + * writable buffer of at least \p tag_len Bytes. See note + * below regarding restrictions with PSA-based contexts. + * \param tag_len The desired length of the authentication tag. This + * must match the constraints imposed by the AEAD cipher + * used, and in particular must not be \c 0. + * + * \note If the context is based on PSA (that is, it was set up + * with mbedtls_cipher_setup_psa()), then it is required + * that \c tag == output + ilen. That is, the tag must be + * appended to the ciphertext as recommended by RFC 5116. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_auth_encrypt( mbedtls_cipher_context_t *ctx, + const unsigned char *iv, size_t iv_len, + const unsigned char *ad, size_t ad_len, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen, + unsigned char *tag, size_t tag_len ) + MBEDTLS_DEPRECATED; + +/** + * \brief The generic authenticated decryption (AEAD) function. + * + * \deprecated Superseded by mbedtls_cipher_auth_decrypt_ext(). + * + * \note This function only supports AEAD algorithms, not key + * wrapping algorithms such as NIST_KW; for this, see + * mbedtls_cipher_auth_decrypt_ext(). + * + * \note If the data is not authentic, then the output buffer + * is zeroed out to prevent the unauthentic plaintext being + * used, making this interface safer. + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a key associated with an AEAD algorithm. + * \param iv The nonce to use. This must be a readable buffer of + * at least \p iv_len Bytes and must not be \c NULL. + * \param iv_len The length of the nonce. This must satisfy the + * constraints imposed by the AEAD cipher used. + * \param ad The additional data to authenticate. This must be a + * readable buffer of at least \p ad_len Bytes, and may + * be \c NULL is \p ad_len is \c 0. + * \param ad_len The length of \p ad. + * \param input The buffer holding the input data. This must be a + * readable buffer of at least \p ilen Bytes, and may be + * \c NULL if \p ilen is \c 0. + * \param ilen The length of the input data. + * \param output The buffer for the output data. This must be a + * writable buffer of at least \p ilen Bytes, and must + * not be \c NULL. + * \param olen This will be filled with the actual number of Bytes + * written to the \p output buffer. This must point to a + * writable object of type \c size_t. + * \param tag The buffer for the authentication tag. This must be a + * readable buffer of at least \p tag_len Bytes. See note + * below regarding restrictions with PSA-based contexts. + * \param tag_len The length of the authentication tag. This must match + * the constraints imposed by the AEAD cipher used, and in + * particular must not be \c 0. + * + * \note If the context is based on PSA (that is, it was set up + * with mbedtls_cipher_setup_psa()), then it is required + * that \c tag == input + len. That is, the tag must be + * appended to the ciphertext as recommended by RFC 5116. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_AUTH_FAILED if data is not authentic. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_auth_decrypt( mbedtls_cipher_context_t *ctx, + const unsigned char *iv, size_t iv_len, + const unsigned char *ad, size_t ad_len, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen, + const unsigned char *tag, size_t tag_len ) + MBEDTLS_DEPRECATED; +#undef MBEDTLS_DEPRECATED +#endif /* MBEDTLS_DEPRECATED_REMOVED */ +#endif /* MBEDTLS_CIPHER_MODE_AEAD */ + +#if defined(MBEDTLS_CIPHER_MODE_AEAD) || defined(MBEDTLS_NIST_KW_C) +/** + * \brief The authenticated encryption (AEAD/NIST_KW) function. + * + * \note For AEAD modes, the tag will be appended to the + * ciphertext, as recommended by RFC 5116. + * (NIST_KW doesn't have a separate tag.) + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a key, with an AEAD algorithm or NIST_KW. + * \param iv The nonce to use. This must be a readable buffer of + * at least \p iv_len Bytes and may be \c NULL if \p + * iv_len is \c 0. + * \param iv_len The length of the nonce. For AEAD ciphers, this must + * satisfy the constraints imposed by the cipher used. + * For NIST_KW, this must be \c 0. + * \param ad The additional data to authenticate. This must be a + * readable buffer of at least \p ad_len Bytes, and may + * be \c NULL is \p ad_len is \c 0. + * \param ad_len The length of \p ad. For NIST_KW, this must be \c 0. + * \param input The buffer holding the input data. This must be a + * readable buffer of at least \p ilen Bytes, and may be + * \c NULL if \p ilen is \c 0. + * \param ilen The length of the input data. + * \param output The buffer for the output data. This must be a + * writable buffer of at least \p output_len Bytes, and + * must not be \c NULL. + * \param output_len The length of the \p output buffer in Bytes. For AEAD + * ciphers, this must be at least \p ilen + \p tag_len. + * For NIST_KW, this must be at least \p ilen + 8 + * (rounded up to a multiple of 8 if KWP is used); + * \p ilen + 15 is always a safe value. + * \param olen This will be filled with the actual number of Bytes + * written to the \p output buffer. This must point to a + * writable object of type \c size_t. + * \param tag_len The desired length of the authentication tag. For AEAD + * ciphers, this must match the constraints imposed by + * the cipher used, and in particular must not be \c 0. + * For NIST_KW, this must be \c 0. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_auth_encrypt_ext( mbedtls_cipher_context_t *ctx, + const unsigned char *iv, size_t iv_len, + const unsigned char *ad, size_t ad_len, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t output_len, + size_t *olen, size_t tag_len ); + +/** + * \brief The authenticated encryption (AEAD/NIST_KW) function. + * + * \note If the data is not authentic, then the output buffer + * is zeroed out to prevent the unauthentic plaintext being + * used, making this interface safer. + * + * \note For AEAD modes, the tag must be appended to the + * ciphertext, as recommended by RFC 5116. + * (NIST_KW doesn't have a separate tag.) + * + * \param ctx The generic cipher context. This must be initialized and + * bound to a key, with an AEAD algorithm or NIST_KW. + * \param iv The nonce to use. This must be a readable buffer of + * at least \p iv_len Bytes and may be \c NULL if \p + * iv_len is \c 0. + * \param iv_len The length of the nonce. For AEAD ciphers, this must + * satisfy the constraints imposed by the cipher used. + * For NIST_KW, this must be \c 0. + * \param ad The additional data to authenticate. This must be a + * readable buffer of at least \p ad_len Bytes, and may + * be \c NULL is \p ad_len is \c 0. + * \param ad_len The length of \p ad. For NIST_KW, this must be \c 0. + * \param input The buffer holding the input data. This must be a + * readable buffer of at least \p ilen Bytes, and may be + * \c NULL if \p ilen is \c 0. + * \param ilen The length of the input data. For AEAD ciphers this + * must be at least \p tag_len. For NIST_KW this must be + * at least \c 8. + * \param output The buffer for the output data. This must be a + * writable buffer of at least \p output_len Bytes, and + * may be \c NULL if \p output_len is \c 0. + * \param output_len The length of the \p output buffer in Bytes. For AEAD + * ciphers, this must be at least \p ilen - \p tag_len. + * For NIST_KW, this must be at least \p ilen - 8. + * \param olen This will be filled with the actual number of Bytes + * written to the \p output buffer. This must point to a + * writable object of type \c size_t. + * \param tag_len The actual length of the authentication tag. For AEAD + * ciphers, this must match the constraints imposed by + * the cipher used, and in particular must not be \c 0. + * For NIST_KW, this must be \c 0. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + * parameter-verification failure. + * \return #MBEDTLS_ERR_CIPHER_AUTH_FAILED if data is not authentic. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_auth_decrypt_ext( mbedtls_cipher_context_t *ctx, + const unsigned char *iv, size_t iv_len, + const unsigned char *ad, size_t ad_len, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t output_len, + size_t *olen, size_t tag_len ); +#endif /* MBEDTLS_CIPHER_MODE_AEAD || MBEDTLS_NIST_KW_C */ +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CIPHER_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/cipher_internal.h b/openharmony/armeabi-v7a/include/mbedtls/cipher_internal.h new file mode 100644 index 00000000..2484c01c --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/cipher_internal.h @@ -0,0 +1,150 @@ +/** + * \file cipher_internal.h + * + * \brief Cipher wrappers. + * + * \author Adriaan de Jong + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_CIPHER_WRAP_H +#define MBEDTLS_CIPHER_WRAP_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/cipher.h" + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#include "psa/crypto.h" +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Base cipher information. The non-mode specific functions and values. + */ +struct mbedtls_cipher_base_t +{ + /** Base Cipher type (e.g. MBEDTLS_CIPHER_ID_AES) */ + mbedtls_cipher_id_t cipher; + + /** Encrypt using ECB */ + int (*ecb_func)( void *ctx, mbedtls_operation_t mode, + const unsigned char *input, unsigned char *output ); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) + /** Encrypt using CBC */ + int (*cbc_func)( void *ctx, mbedtls_operation_t mode, size_t length, + unsigned char *iv, const unsigned char *input, + unsigned char *output ); +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CFB) + /** Encrypt using CFB (Full length) */ + int (*cfb_func)( void *ctx, mbedtls_operation_t mode, size_t length, size_t *iv_off, + unsigned char *iv, const unsigned char *input, + unsigned char *output ); +#endif + +#if defined(MBEDTLS_CIPHER_MODE_OFB) + /** Encrypt using OFB (Full length) */ + int (*ofb_func)( void *ctx, size_t length, size_t *iv_off, + unsigned char *iv, + const unsigned char *input, + unsigned char *output ); +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CTR) + /** Encrypt using CTR */ + int (*ctr_func)( void *ctx, size_t length, size_t *nc_off, + unsigned char *nonce_counter, unsigned char *stream_block, + const unsigned char *input, unsigned char *output ); +#endif + +#if defined(MBEDTLS_CIPHER_MODE_XTS) + /** Encrypt or decrypt using XTS. */ + int (*xts_func)( void *ctx, mbedtls_operation_t mode, size_t length, + const unsigned char data_unit[16], + const unsigned char *input, unsigned char *output ); +#endif + +#if defined(MBEDTLS_CIPHER_MODE_STREAM) + /** Encrypt using STREAM */ + int (*stream_func)( void *ctx, size_t length, + const unsigned char *input, unsigned char *output ); +#endif + + /** Set key for encryption purposes */ + int (*setkey_enc_func)( void *ctx, const unsigned char *key, + unsigned int key_bitlen ); + + /** Set key for decryption purposes */ + int (*setkey_dec_func)( void *ctx, const unsigned char *key, + unsigned int key_bitlen); + + /** Allocate a new context */ + void * (*ctx_alloc_func)( void ); + + /** Free the given context */ + void (*ctx_free_func)( void *ctx ); + +}; + +typedef struct +{ + mbedtls_cipher_type_t type; + const mbedtls_cipher_info_t *info; +} mbedtls_cipher_definition_t; + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +typedef enum +{ + MBEDTLS_CIPHER_PSA_KEY_UNSET = 0, + MBEDTLS_CIPHER_PSA_KEY_OWNED, /* Used for PSA-based cipher contexts which */ + /* use raw key material internally imported */ + /* as a volatile key, and which hence need */ + /* to destroy that key when the context is */ + /* freed. */ + MBEDTLS_CIPHER_PSA_KEY_NOT_OWNED, /* Used for PSA-based cipher contexts */ + /* which use a key provided by the */ + /* user, and which hence will not be */ + /* destroyed when the context is freed. */ +} mbedtls_cipher_psa_key_ownership; + +typedef struct +{ + psa_algorithm_t alg; + psa_key_id_t slot; + mbedtls_cipher_psa_key_ownership slot_state; +} mbedtls_cipher_context_psa; +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +extern const mbedtls_cipher_definition_t mbedtls_cipher_definitions[]; + +extern int mbedtls_cipher_supported[]; + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CIPHER_WRAP_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/cmac.h b/openharmony/armeabi-v7a/include/mbedtls/cmac.h new file mode 100644 index 00000000..8934886a --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/cmac.h @@ -0,0 +1,247 @@ +/** + * \file cmac.h + * + * \brief This file contains CMAC definitions and functions. + * + * The Cipher-based Message Authentication Code (CMAC) Mode for + * Authentication is defined in RFC-4493: The AES-CMAC Algorithm. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CMAC_H +#define MBEDTLS_CMAC_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/cipher.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/* MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** CMAC hardware accelerator failed. */ +#define MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED -0x007A + +#define MBEDTLS_AES_BLOCK_SIZE 16 +#define MBEDTLS_DES3_BLOCK_SIZE 8 + +#if defined(MBEDTLS_AES_C) +#define MBEDTLS_CIPHER_BLKSIZE_MAX 16 /**< The longest block used by CMAC is that of AES. */ +#else +#define MBEDTLS_CIPHER_BLKSIZE_MAX 8 /**< The longest block used by CMAC is that of 3DES. */ +#endif + +#if !defined(MBEDTLS_CMAC_ALT) + +/** + * The CMAC context structure. + */ +struct mbedtls_cmac_context_t +{ + /** The internal state of the CMAC algorithm. */ + unsigned char state[MBEDTLS_CIPHER_BLKSIZE_MAX]; + + /** Unprocessed data - either data that was not block aligned and is still + * pending processing, or the final block. */ + unsigned char unprocessed_block[MBEDTLS_CIPHER_BLKSIZE_MAX]; + + /** The length of data pending processing. */ + size_t unprocessed_len; +}; + +#else /* !MBEDTLS_CMAC_ALT */ +#include "cmac_alt.h" +#endif /* !MBEDTLS_CMAC_ALT */ + +/** + * \brief This function starts a new CMAC computation + * by setting the CMAC key, and preparing to authenticate + * the input data. + * It must be called with an initialized cipher context. + * + * Once this function has completed, data can be supplied + * to the CMAC computation by calling + * mbedtls_cipher_cmac_update(). + * + * To start a CMAC computation using the same key as a previous + * CMAC computation, use mbedtls_cipher_cmac_finish(). + * + * \note When the CMAC implementation is supplied by an alternate + * implementation (through #MBEDTLS_CMAC_ALT), some ciphers + * may not be supported by that implementation, and thus + * return an error. Alternate implementations must support + * AES-128 and AES-256, and may support AES-192 and 3DES. + * + * \param ctx The cipher context used for the CMAC operation, initialized + * as one of the following types: MBEDTLS_CIPHER_AES_128_ECB, + * MBEDTLS_CIPHER_AES_192_ECB, MBEDTLS_CIPHER_AES_256_ECB, + * or MBEDTLS_CIPHER_DES_EDE3_ECB. + * \param key The CMAC key. + * \param keybits The length of the CMAC key in bits. + * Must be supported by the cipher. + * + * \return \c 0 on success. + * \return A cipher-specific error code on failure. + */ +int mbedtls_cipher_cmac_starts( mbedtls_cipher_context_t *ctx, + const unsigned char *key, size_t keybits ); + +/** + * \brief This function feeds an input buffer into an ongoing CMAC + * computation. + * + * The CMAC computation must have previously been started + * by calling mbedtls_cipher_cmac_starts() or + * mbedtls_cipher_cmac_reset(). + * + * Call this function as many times as needed to input the + * data to be authenticated. + * Once all of the required data has been input, + * call mbedtls_cipher_cmac_finish() to obtain the result + * of the CMAC operation. + * + * \param ctx The cipher context used for the CMAC operation. + * \param input The buffer holding the input data. + * \param ilen The length of the input data. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA + * if parameter verification fails. + */ +int mbedtls_cipher_cmac_update( mbedtls_cipher_context_t *ctx, + const unsigned char *input, size_t ilen ); + +/** + * \brief This function finishes an ongoing CMAC operation, and + * writes the result to the output buffer. + * + * It should be followed either by + * mbedtls_cipher_cmac_reset(), which starts another CMAC + * operation with the same key, or mbedtls_cipher_free(), + * which clears the cipher context. + * + * \param ctx The cipher context used for the CMAC operation. + * \param output The output buffer for the CMAC checksum result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA + * if parameter verification fails. + */ +int mbedtls_cipher_cmac_finish( mbedtls_cipher_context_t *ctx, + unsigned char *output ); + +/** + * \brief This function starts a new CMAC operation with the same + * key as the previous one. + * + * It should be called after finishing the previous CMAC + * operation with mbedtls_cipher_cmac_finish(). + * After calling this function, + * call mbedtls_cipher_cmac_update() to supply the new + * CMAC operation with data. + * + * \param ctx The cipher context used for the CMAC operation. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA + * if parameter verification fails. + */ +int mbedtls_cipher_cmac_reset( mbedtls_cipher_context_t *ctx ); + +/** + * \brief This function calculates the full generic CMAC + * on the input buffer with the provided key. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The CMAC result is calculated as + * output = generic CMAC(cmac key, input buffer). + * + * \note When the CMAC implementation is supplied by an alternate + * implementation (through #MBEDTLS_CMAC_ALT), some ciphers + * may not be supported by that implementation, and thus + * return an error. Alternate implementations must support + * AES-128 and AES-256, and may support AES-192 and 3DES. + * + * \param cipher_info The cipher information. + * \param key The CMAC key. + * \param keylen The length of the CMAC key in bits. + * \param input The buffer holding the input data. + * \param ilen The length of the input data. + * \param output The buffer for the generic CMAC result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA + * if parameter verification fails. + */ +int mbedtls_cipher_cmac( const mbedtls_cipher_info_t *cipher_info, + const unsigned char *key, size_t keylen, + const unsigned char *input, size_t ilen, + unsigned char *output ); + +#if defined(MBEDTLS_AES_C) +/** + * \brief This function implements the AES-CMAC-PRF-128 pseudorandom + * function, as defined in + * RFC-4615: The Advanced Encryption Standard-Cipher-based + * Message Authentication Code-Pseudo-Random Function-128 + * (AES-CMAC-PRF-128) Algorithm for the Internet Key + * Exchange Protocol (IKE). + * + * \param key The key to use. + * \param key_len The key length in Bytes. + * \param input The buffer holding the input data. + * \param in_len The length of the input data in Bytes. + * \param output The buffer holding the generated 16 Bytes of + * pseudorandom output. + * + * \return \c 0 on success. + */ +int mbedtls_aes_cmac_prf_128( const unsigned char *key, size_t key_len, + const unsigned char *input, size_t in_len, + unsigned char output[16] ); +#endif /* MBEDTLS_AES_C */ + +#if defined(MBEDTLS_SELF_TEST) && ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_DES_C) ) +/** + * \brief The CMAC checkup routine. + * + * \note In case the CMAC routines are provided by an alternative + * implementation (i.e. #MBEDTLS_CMAC_ALT is defined), the + * checkup routine will succeed even if the implementation does + * not support the less widely used AES-192 or 3DES primitives. + * The self-test requires at least AES-128 and AES-256 to be + * supported by the underlying implementation. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_cmac_self_test( int verbose ); +#endif /* MBEDTLS_SELF_TEST && ( MBEDTLS_AES_C || MBEDTLS_DES_C ) */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CMAC_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/compat-1.3.h b/openharmony/armeabi-v7a/include/mbedtls/compat-1.3.h new file mode 100644 index 00000000..40177512 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/compat-1.3.h @@ -0,0 +1,2529 @@ +/** + * \file compat-1.3.h + * + * \brief Compatibility definitions for using mbed TLS with client code written + * for the PolarSSL naming conventions. + * + * \deprecated Use the new names directly instead + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#if ! defined(MBEDTLS_DEPRECATED_REMOVED) + +#if defined(MBEDTLS_DEPRECATED_WARNING) +#warning "Including compat-1.3.h is deprecated" +#endif + +#ifndef MBEDTLS_COMPAT13_H +#define MBEDTLS_COMPAT13_H + +/* + * config.h options + */ +#if defined MBEDTLS_AESNI_C +#define POLARSSL_AESNI_C MBEDTLS_AESNI_C +#endif +#if defined MBEDTLS_AES_ALT +#define POLARSSL_AES_ALT MBEDTLS_AES_ALT +#endif +#if defined MBEDTLS_AES_C +#define POLARSSL_AES_C MBEDTLS_AES_C +#endif +#if defined MBEDTLS_AES_ROM_TABLES +#define POLARSSL_AES_ROM_TABLES MBEDTLS_AES_ROM_TABLES +#endif +#if defined MBEDTLS_ARC4_ALT +#define POLARSSL_ARC4_ALT MBEDTLS_ARC4_ALT +#endif +#if defined MBEDTLS_ARC4_C +#define POLARSSL_ARC4_C MBEDTLS_ARC4_C +#endif +#if defined MBEDTLS_ASN1_PARSE_C +#define POLARSSL_ASN1_PARSE_C MBEDTLS_ASN1_PARSE_C +#endif +#if defined MBEDTLS_ASN1_WRITE_C +#define POLARSSL_ASN1_WRITE_C MBEDTLS_ASN1_WRITE_C +#endif +#if defined MBEDTLS_BASE64_C +#define POLARSSL_BASE64_C MBEDTLS_BASE64_C +#endif +#if defined MBEDTLS_BIGNUM_C +#define POLARSSL_BIGNUM_C MBEDTLS_BIGNUM_C +#endif +#if defined MBEDTLS_BLOWFISH_ALT +#define POLARSSL_BLOWFISH_ALT MBEDTLS_BLOWFISH_ALT +#endif +#if defined MBEDTLS_BLOWFISH_C +#define POLARSSL_BLOWFISH_C MBEDTLS_BLOWFISH_C +#endif +#if defined MBEDTLS_CAMELLIA_ALT +#define POLARSSL_CAMELLIA_ALT MBEDTLS_CAMELLIA_ALT +#endif +#if defined MBEDTLS_CAMELLIA_C +#define POLARSSL_CAMELLIA_C MBEDTLS_CAMELLIA_C +#endif +#if defined MBEDTLS_CAMELLIA_SMALL_MEMORY +#define POLARSSL_CAMELLIA_SMALL_MEMORY MBEDTLS_CAMELLIA_SMALL_MEMORY +#endif +#if defined MBEDTLS_CCM_C +#define POLARSSL_CCM_C MBEDTLS_CCM_C +#endif +#if defined MBEDTLS_CERTS_C +#define POLARSSL_CERTS_C MBEDTLS_CERTS_C +#endif +#if defined MBEDTLS_CIPHER_C +#define POLARSSL_CIPHER_C MBEDTLS_CIPHER_C +#endif +#if defined MBEDTLS_CIPHER_MODE_CBC +#define POLARSSL_CIPHER_MODE_CBC MBEDTLS_CIPHER_MODE_CBC +#endif +#if defined MBEDTLS_CIPHER_MODE_CFB +#define POLARSSL_CIPHER_MODE_CFB MBEDTLS_CIPHER_MODE_CFB +#endif +#if defined MBEDTLS_CIPHER_MODE_CTR +#define POLARSSL_CIPHER_MODE_CTR MBEDTLS_CIPHER_MODE_CTR +#endif +#if defined MBEDTLS_CIPHER_NULL_CIPHER +#define POLARSSL_CIPHER_NULL_CIPHER MBEDTLS_CIPHER_NULL_CIPHER +#endif +#if defined MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS +#define POLARSSL_CIPHER_PADDING_ONE_AND_ZEROS MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS +#endif +#if defined MBEDTLS_CIPHER_PADDING_PKCS7 +#define POLARSSL_CIPHER_PADDING_PKCS7 MBEDTLS_CIPHER_PADDING_PKCS7 +#endif +#if defined MBEDTLS_CIPHER_PADDING_ZEROS +#define POLARSSL_CIPHER_PADDING_ZEROS MBEDTLS_CIPHER_PADDING_ZEROS +#endif +#if defined MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN +#define POLARSSL_CIPHER_PADDING_ZEROS_AND_LEN MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN +#endif +#if defined MBEDTLS_CTR_DRBG_C +#define POLARSSL_CTR_DRBG_C MBEDTLS_CTR_DRBG_C +#endif +#if defined MBEDTLS_DEBUG_C +#define POLARSSL_DEBUG_C MBEDTLS_DEBUG_C +#endif +#if defined MBEDTLS_DEPRECATED_REMOVED +#define POLARSSL_DEPRECATED_REMOVED MBEDTLS_DEPRECATED_REMOVED +#endif +#if defined MBEDTLS_DEPRECATED_WARNING +#define POLARSSL_DEPRECATED_WARNING MBEDTLS_DEPRECATED_WARNING +#endif +#if defined MBEDTLS_DES_ALT +#define POLARSSL_DES_ALT MBEDTLS_DES_ALT +#endif +#if defined MBEDTLS_DES_C +#define POLARSSL_DES_C MBEDTLS_DES_C +#endif +#if defined MBEDTLS_DHM_C +#define POLARSSL_DHM_C MBEDTLS_DHM_C +#endif +#if defined MBEDTLS_ECDH_C +#define POLARSSL_ECDH_C MBEDTLS_ECDH_C +#endif +#if defined MBEDTLS_ECDSA_C +#define POLARSSL_ECDSA_C MBEDTLS_ECDSA_C +#endif +#if defined MBEDTLS_ECDSA_DETERMINISTIC +#define POLARSSL_ECDSA_DETERMINISTIC MBEDTLS_ECDSA_DETERMINISTIC +#endif +#if defined MBEDTLS_ECP_C +#define POLARSSL_ECP_C MBEDTLS_ECP_C +#endif +#if defined MBEDTLS_ECP_DP_BP256R1_ENABLED +#define POLARSSL_ECP_DP_BP256R1_ENABLED MBEDTLS_ECP_DP_BP256R1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_BP384R1_ENABLED +#define POLARSSL_ECP_DP_BP384R1_ENABLED MBEDTLS_ECP_DP_BP384R1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_BP512R1_ENABLED +#define POLARSSL_ECP_DP_BP512R1_ENABLED MBEDTLS_ECP_DP_BP512R1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_CURVE25519_ENABLED +#define POLARSSL_ECP_DP_M255_ENABLED MBEDTLS_ECP_DP_CURVE25519_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_SECP192K1_ENABLED +#define POLARSSL_ECP_DP_SECP192K1_ENABLED MBEDTLS_ECP_DP_SECP192K1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_SECP192R1_ENABLED +#define POLARSSL_ECP_DP_SECP192R1_ENABLED MBEDTLS_ECP_DP_SECP192R1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_SECP224K1_ENABLED +#define POLARSSL_ECP_DP_SECP224K1_ENABLED MBEDTLS_ECP_DP_SECP224K1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_SECP224R1_ENABLED +#define POLARSSL_ECP_DP_SECP224R1_ENABLED MBEDTLS_ECP_DP_SECP224R1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_SECP256K1_ENABLED +#define POLARSSL_ECP_DP_SECP256K1_ENABLED MBEDTLS_ECP_DP_SECP256K1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_SECP256R1_ENABLED +#define POLARSSL_ECP_DP_SECP256R1_ENABLED MBEDTLS_ECP_DP_SECP256R1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_SECP384R1_ENABLED +#define POLARSSL_ECP_DP_SECP384R1_ENABLED MBEDTLS_ECP_DP_SECP384R1_ENABLED +#endif +#if defined MBEDTLS_ECP_DP_SECP521R1_ENABLED +#define POLARSSL_ECP_DP_SECP521R1_ENABLED MBEDTLS_ECP_DP_SECP521R1_ENABLED +#endif +#if defined MBEDTLS_ECP_FIXED_POINT_OPTIM +#define POLARSSL_ECP_FIXED_POINT_OPTIM MBEDTLS_ECP_FIXED_POINT_OPTIM +#endif +#if defined MBEDTLS_ECP_MAX_BITS +#define POLARSSL_ECP_MAX_BITS MBEDTLS_ECP_MAX_BITS +#endif +#if defined MBEDTLS_ECP_NIST_OPTIM +#define POLARSSL_ECP_NIST_OPTIM MBEDTLS_ECP_NIST_OPTIM +#endif +#if defined MBEDTLS_ECP_WINDOW_SIZE +#define POLARSSL_ECP_WINDOW_SIZE MBEDTLS_ECP_WINDOW_SIZE +#endif +#if defined MBEDTLS_ENABLE_WEAK_CIPHERSUITES +#define POLARSSL_ENABLE_WEAK_CIPHERSUITES MBEDTLS_ENABLE_WEAK_CIPHERSUITES +#endif +#if defined MBEDTLS_ENTROPY_C +#define POLARSSL_ENTROPY_C MBEDTLS_ENTROPY_C +#endif +#if defined MBEDTLS_ENTROPY_FORCE_SHA256 +#define POLARSSL_ENTROPY_FORCE_SHA256 MBEDTLS_ENTROPY_FORCE_SHA256 +#endif +#if defined MBEDTLS_ERROR_C +#define POLARSSL_ERROR_C MBEDTLS_ERROR_C +#endif +#if defined MBEDTLS_ERROR_STRERROR_DUMMY +#define POLARSSL_ERROR_STRERROR_DUMMY MBEDTLS_ERROR_STRERROR_DUMMY +#endif +#if defined MBEDTLS_FS_IO +#define POLARSSL_FS_IO MBEDTLS_FS_IO +#endif +#if defined MBEDTLS_GCM_C +#define POLARSSL_GCM_C MBEDTLS_GCM_C +#endif +#if defined MBEDTLS_GENPRIME +#define POLARSSL_GENPRIME MBEDTLS_GENPRIME +#endif +#if defined MBEDTLS_HAVEGE_C +#define POLARSSL_HAVEGE_C MBEDTLS_HAVEGE_C +#endif +#if defined MBEDTLS_HAVE_ASM +#define POLARSSL_HAVE_ASM MBEDTLS_HAVE_ASM +#endif +#if defined MBEDTLS_HAVE_SSE2 +#define POLARSSL_HAVE_SSE2 MBEDTLS_HAVE_SSE2 +#endif +#if defined MBEDTLS_HAVE_TIME +#define POLARSSL_HAVE_TIME MBEDTLS_HAVE_TIME +#endif +#if defined MBEDTLS_HMAC_DRBG_C +#define POLARSSL_HMAC_DRBG_C MBEDTLS_HMAC_DRBG_C +#endif +#if defined MBEDTLS_HMAC_DRBG_MAX_INPUT +#define POLARSSL_HMAC_DRBG_MAX_INPUT MBEDTLS_HMAC_DRBG_MAX_INPUT +#endif +#if defined MBEDTLS_HMAC_DRBG_MAX_REQUEST +#define POLARSSL_HMAC_DRBG_MAX_REQUEST MBEDTLS_HMAC_DRBG_MAX_REQUEST +#endif +#if defined MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT +#define POLARSSL_HMAC_DRBG_MAX_SEED_INPUT MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT +#endif +#if defined MBEDTLS_HMAC_DRBG_RESEED_INTERVAL +#define POLARSSL_HMAC_DRBG_RESEED_INTERVAL MBEDTLS_HMAC_DRBG_RESEED_INTERVAL +#endif +#if defined MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED +#define POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED +#define POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED +#define POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED +#define POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED +#define POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED +#define POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED +#define POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_PSK_ENABLED +#define POLARSSL_KEY_EXCHANGE_PSK_ENABLED MBEDTLS_KEY_EXCHANGE_PSK_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_RSA_ENABLED +#define POLARSSL_KEY_EXCHANGE_RSA_ENABLED MBEDTLS_KEY_EXCHANGE_RSA_ENABLED +#endif +#if defined MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED +#define POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED +#endif +#if defined MBEDTLS_MD2_ALT +#define POLARSSL_MD2_ALT MBEDTLS_MD2_ALT +#endif +#if defined MBEDTLS_MD2_C +#define POLARSSL_MD2_C MBEDTLS_MD2_C +#endif +#if defined MBEDTLS_MD2_PROCESS_ALT +#define POLARSSL_MD2_PROCESS_ALT MBEDTLS_MD2_PROCESS_ALT +#endif +#if defined MBEDTLS_MD4_ALT +#define POLARSSL_MD4_ALT MBEDTLS_MD4_ALT +#endif +#if defined MBEDTLS_MD4_C +#define POLARSSL_MD4_C MBEDTLS_MD4_C +#endif +#if defined MBEDTLS_MD4_PROCESS_ALT +#define POLARSSL_MD4_PROCESS_ALT MBEDTLS_MD4_PROCESS_ALT +#endif +#if defined MBEDTLS_MD5_ALT +#define POLARSSL_MD5_ALT MBEDTLS_MD5_ALT +#endif +#if defined MBEDTLS_MD5_C +#define POLARSSL_MD5_C MBEDTLS_MD5_C +#endif +#if defined MBEDTLS_MD5_PROCESS_ALT +#define POLARSSL_MD5_PROCESS_ALT MBEDTLS_MD5_PROCESS_ALT +#endif +#if defined MBEDTLS_MD_C +#define POLARSSL_MD_C MBEDTLS_MD_C +#endif +#if defined MBEDTLS_MEMORY_ALIGN_MULTIPLE +#define POLARSSL_MEMORY_ALIGN_MULTIPLE MBEDTLS_MEMORY_ALIGN_MULTIPLE +#endif +#if defined MBEDTLS_MEMORY_BACKTRACE +#define POLARSSL_MEMORY_BACKTRACE MBEDTLS_MEMORY_BACKTRACE +#endif +#if defined MBEDTLS_MEMORY_BUFFER_ALLOC_C +#define POLARSSL_MEMORY_BUFFER_ALLOC_C MBEDTLS_MEMORY_BUFFER_ALLOC_C +#endif +#if defined MBEDTLS_MEMORY_DEBUG +#define POLARSSL_MEMORY_DEBUG MBEDTLS_MEMORY_DEBUG +#endif +#if defined MBEDTLS_MPI_MAX_SIZE +#define POLARSSL_MPI_MAX_SIZE MBEDTLS_MPI_MAX_SIZE +#endif +#if defined MBEDTLS_MPI_WINDOW_SIZE +#define POLARSSL_MPI_WINDOW_SIZE MBEDTLS_MPI_WINDOW_SIZE +#endif +#if defined MBEDTLS_NET_C +#define POLARSSL_NET_C MBEDTLS_NET_C +#endif +#if defined MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES +#define POLARSSL_NO_DEFAULT_ENTROPY_SOURCES MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES +#endif +#if defined MBEDTLS_NO_PLATFORM_ENTROPY +#define POLARSSL_NO_PLATFORM_ENTROPY MBEDTLS_NO_PLATFORM_ENTROPY +#endif +#if defined MBEDTLS_OID_C +#define POLARSSL_OID_C MBEDTLS_OID_C +#endif +#if defined MBEDTLS_PADLOCK_C +#define POLARSSL_PADLOCK_C MBEDTLS_PADLOCK_C +#endif +#if defined MBEDTLS_PEM_PARSE_C +#define POLARSSL_PEM_PARSE_C MBEDTLS_PEM_PARSE_C +#endif +#if defined MBEDTLS_PEM_WRITE_C +#define POLARSSL_PEM_WRITE_C MBEDTLS_PEM_WRITE_C +#endif +#if defined MBEDTLS_PKCS11_C +#define POLARSSL_PKCS11_C MBEDTLS_PKCS11_C +#endif +#if defined MBEDTLS_PKCS12_C +#define POLARSSL_PKCS12_C MBEDTLS_PKCS12_C +#endif +#if defined MBEDTLS_PKCS1_V15 +#define POLARSSL_PKCS1_V15 MBEDTLS_PKCS1_V15 +#endif +#if defined MBEDTLS_PKCS1_V21 +#define POLARSSL_PKCS1_V21 MBEDTLS_PKCS1_V21 +#endif +#if defined MBEDTLS_PKCS5_C +#define POLARSSL_PKCS5_C MBEDTLS_PKCS5_C +#endif +#if defined MBEDTLS_PK_C +#define POLARSSL_PK_C MBEDTLS_PK_C +#endif +#if defined MBEDTLS_PK_PARSE_C +#define POLARSSL_PK_PARSE_C MBEDTLS_PK_PARSE_C +#endif +#if defined MBEDTLS_PK_PARSE_EC_EXTENDED +#define POLARSSL_PK_PARSE_EC_EXTENDED MBEDTLS_PK_PARSE_EC_EXTENDED +#endif +#if defined MBEDTLS_PK_RSA_ALT_SUPPORT +#define POLARSSL_PK_RSA_ALT_SUPPORT MBEDTLS_PK_RSA_ALT_SUPPORT +#endif +#if defined MBEDTLS_PK_WRITE_C +#define POLARSSL_PK_WRITE_C MBEDTLS_PK_WRITE_C +#endif +#if defined MBEDTLS_PLATFORM_C +#define POLARSSL_PLATFORM_C MBEDTLS_PLATFORM_C +#endif +#if defined MBEDTLS_PLATFORM_EXIT_ALT +#define POLARSSL_PLATFORM_EXIT_ALT MBEDTLS_PLATFORM_EXIT_ALT +#endif +#if defined MBEDTLS_PLATFORM_EXIT_MACRO +#define POLARSSL_PLATFORM_EXIT_MACRO MBEDTLS_PLATFORM_EXIT_MACRO +#endif +#if defined MBEDTLS_PLATFORM_FPRINTF_ALT +#define POLARSSL_PLATFORM_FPRINTF_ALT MBEDTLS_PLATFORM_FPRINTF_ALT +#endif +#if defined MBEDTLS_PLATFORM_FPRINTF_MACRO +#define POLARSSL_PLATFORM_FPRINTF_MACRO MBEDTLS_PLATFORM_FPRINTF_MACRO +#endif +#if defined MBEDTLS_PLATFORM_FREE_MACRO +#define POLARSSL_PLATFORM_FREE_MACRO MBEDTLS_PLATFORM_FREE_MACRO +#endif +#if defined MBEDTLS_PLATFORM_MEMORY +#define POLARSSL_PLATFORM_MEMORY MBEDTLS_PLATFORM_MEMORY +#endif +#if defined MBEDTLS_PLATFORM_NO_STD_FUNCTIONS +#define POLARSSL_PLATFORM_NO_STD_FUNCTIONS MBEDTLS_PLATFORM_NO_STD_FUNCTIONS +#endif +#if defined MBEDTLS_PLATFORM_PRINTF_ALT +#define POLARSSL_PLATFORM_PRINTF_ALT MBEDTLS_PLATFORM_PRINTF_ALT +#endif +#if defined MBEDTLS_PLATFORM_PRINTF_MACRO +#define POLARSSL_PLATFORM_PRINTF_MACRO MBEDTLS_PLATFORM_PRINTF_MACRO +#endif +#if defined MBEDTLS_PLATFORM_SNPRINTF_ALT +#define POLARSSL_PLATFORM_SNPRINTF_ALT MBEDTLS_PLATFORM_SNPRINTF_ALT +#endif +#if defined MBEDTLS_PLATFORM_SNPRINTF_MACRO +#define POLARSSL_PLATFORM_SNPRINTF_MACRO MBEDTLS_PLATFORM_SNPRINTF_MACRO +#endif +#if defined MBEDTLS_PLATFORM_STD_EXIT +#define POLARSSL_PLATFORM_STD_EXIT MBEDTLS_PLATFORM_STD_EXIT +#endif +#if defined MBEDTLS_PLATFORM_STD_FPRINTF +#define POLARSSL_PLATFORM_STD_FPRINTF MBEDTLS_PLATFORM_STD_FPRINTF +#endif +#if defined MBEDTLS_PLATFORM_STD_FREE +#define POLARSSL_PLATFORM_STD_FREE MBEDTLS_PLATFORM_STD_FREE +#endif +#if defined MBEDTLS_PLATFORM_STD_MEM_HDR +#define POLARSSL_PLATFORM_STD_MEM_HDR MBEDTLS_PLATFORM_STD_MEM_HDR +#endif +#if defined MBEDTLS_PLATFORM_STD_PRINTF +#define POLARSSL_PLATFORM_STD_PRINTF MBEDTLS_PLATFORM_STD_PRINTF +#endif +#if defined MBEDTLS_PLATFORM_STD_SNPRINTF +#define POLARSSL_PLATFORM_STD_SNPRINTF MBEDTLS_PLATFORM_STD_SNPRINTF +#endif +#if defined MBEDTLS_PSK_MAX_LEN +#define POLARSSL_PSK_MAX_LEN MBEDTLS_PSK_MAX_LEN +#endif +#if defined MBEDTLS_REMOVE_ARC4_CIPHERSUITES +#define POLARSSL_REMOVE_ARC4_CIPHERSUITES MBEDTLS_REMOVE_ARC4_CIPHERSUITES +#endif +#if defined MBEDTLS_RIPEMD160_ALT +#define POLARSSL_RIPEMD160_ALT MBEDTLS_RIPEMD160_ALT +#endif +#if defined MBEDTLS_RIPEMD160_C +#define POLARSSL_RIPEMD160_C MBEDTLS_RIPEMD160_C +#endif +#if defined MBEDTLS_RIPEMD160_PROCESS_ALT +#define POLARSSL_RIPEMD160_PROCESS_ALT MBEDTLS_RIPEMD160_PROCESS_ALT +#endif +#if defined MBEDTLS_RSA_C +#define POLARSSL_RSA_C MBEDTLS_RSA_C +#endif +#if defined MBEDTLS_RSA_NO_CRT +#define POLARSSL_RSA_NO_CRT MBEDTLS_RSA_NO_CRT +#endif +#if defined MBEDTLS_SELF_TEST +#define POLARSSL_SELF_TEST MBEDTLS_SELF_TEST +#endif +#if defined MBEDTLS_SHA1_ALT +#define POLARSSL_SHA1_ALT MBEDTLS_SHA1_ALT +#endif +#if defined MBEDTLS_SHA1_C +#define POLARSSL_SHA1_C MBEDTLS_SHA1_C +#endif +#if defined MBEDTLS_SHA1_PROCESS_ALT +#define POLARSSL_SHA1_PROCESS_ALT MBEDTLS_SHA1_PROCESS_ALT +#endif +#if defined MBEDTLS_SHA256_ALT +#define POLARSSL_SHA256_ALT MBEDTLS_SHA256_ALT +#endif +#if defined MBEDTLS_SHA256_C +#define POLARSSL_SHA256_C MBEDTLS_SHA256_C +#endif +#if defined MBEDTLS_SHA256_PROCESS_ALT +#define POLARSSL_SHA256_PROCESS_ALT MBEDTLS_SHA256_PROCESS_ALT +#endif +#if defined MBEDTLS_SHA512_ALT +#define POLARSSL_SHA512_ALT MBEDTLS_SHA512_ALT +#endif +#if defined MBEDTLS_SHA512_C +#define POLARSSL_SHA512_C MBEDTLS_SHA512_C +#endif +#if defined MBEDTLS_SHA512_PROCESS_ALT +#define POLARSSL_SHA512_PROCESS_ALT MBEDTLS_SHA512_PROCESS_ALT +#endif +#if defined MBEDTLS_SSL_ALL_ALERT_MESSAGES +#define POLARSSL_SSL_ALL_ALERT_MESSAGES MBEDTLS_SSL_ALL_ALERT_MESSAGES +#endif +#if defined MBEDTLS_SSL_ALPN +#define POLARSSL_SSL_ALPN MBEDTLS_SSL_ALPN +#endif +#if defined MBEDTLS_SSL_CACHE_C +#define POLARSSL_SSL_CACHE_C MBEDTLS_SSL_CACHE_C +#endif +#if defined MBEDTLS_SSL_CBC_RECORD_SPLITTING +#define POLARSSL_SSL_CBC_RECORD_SPLITTING MBEDTLS_SSL_CBC_RECORD_SPLITTING +#endif +#if defined MBEDTLS_SSL_CLI_C +#define POLARSSL_SSL_CLI_C MBEDTLS_SSL_CLI_C +#endif +#if defined MBEDTLS_SSL_COOKIE_C +#define POLARSSL_SSL_COOKIE_C MBEDTLS_SSL_COOKIE_C +#endif +#if defined MBEDTLS_SSL_COOKIE_TIMEOUT +#define POLARSSL_SSL_COOKIE_TIMEOUT MBEDTLS_SSL_COOKIE_TIMEOUT +#endif +#if defined MBEDTLS_SSL_DEBUG_ALL +#define POLARSSL_SSL_DEBUG_ALL MBEDTLS_SSL_DEBUG_ALL +#endif +#if defined MBEDTLS_SSL_DTLS_ANTI_REPLAY +#define POLARSSL_SSL_DTLS_ANTI_REPLAY MBEDTLS_SSL_DTLS_ANTI_REPLAY +#endif +#if defined MBEDTLS_SSL_DTLS_BADMAC_LIMIT +#define POLARSSL_SSL_DTLS_BADMAC_LIMIT MBEDTLS_SSL_DTLS_BADMAC_LIMIT +#endif +#if defined MBEDTLS_SSL_DTLS_HELLO_VERIFY +#define POLARSSL_SSL_DTLS_HELLO_VERIFY MBEDTLS_SSL_DTLS_HELLO_VERIFY +#endif +#if defined MBEDTLS_SSL_ENCRYPT_THEN_MAC +#define POLARSSL_SSL_ENCRYPT_THEN_MAC MBEDTLS_SSL_ENCRYPT_THEN_MAC +#endif +#if defined MBEDTLS_SSL_EXTENDED_MASTER_SECRET +#define POLARSSL_SSL_EXTENDED_MASTER_SECRET MBEDTLS_SSL_EXTENDED_MASTER_SECRET +#endif +#if defined MBEDTLS_SSL_FALLBACK_SCSV +#define POLARSSL_SSL_FALLBACK_SCSV MBEDTLS_SSL_FALLBACK_SCSV +#endif +#if defined MBEDTLS_SSL_HW_RECORD_ACCEL +#define POLARSSL_SSL_HW_RECORD_ACCEL MBEDTLS_SSL_HW_RECORD_ACCEL +#endif +#if defined MBEDTLS_SSL_MAX_FRAGMENT_LENGTH +#define POLARSSL_SSL_MAX_FRAGMENT_LENGTH MBEDTLS_SSL_MAX_FRAGMENT_LENGTH +#endif +#if defined MBEDTLS_SSL_PROTO_DTLS +#define POLARSSL_SSL_PROTO_DTLS MBEDTLS_SSL_PROTO_DTLS +#endif +#if defined MBEDTLS_SSL_PROTO_SSL3 +#define POLARSSL_SSL_PROTO_SSL3 MBEDTLS_SSL_PROTO_SSL3 +#endif +#if defined MBEDTLS_SSL_PROTO_TLS1 +#define POLARSSL_SSL_PROTO_TLS1 MBEDTLS_SSL_PROTO_TLS1 +#endif +#if defined MBEDTLS_SSL_PROTO_TLS1_1 +#define POLARSSL_SSL_PROTO_TLS1_1 MBEDTLS_SSL_PROTO_TLS1_1 +#endif +#if defined MBEDTLS_SSL_PROTO_TLS1_2 +#define POLARSSL_SSL_PROTO_TLS1_2 MBEDTLS_SSL_PROTO_TLS1_2 +#endif +#if defined MBEDTLS_SSL_RENEGOTIATION +#define POLARSSL_SSL_RENEGOTIATION MBEDTLS_SSL_RENEGOTIATION +#endif +#if defined MBEDTLS_SSL_SERVER_NAME_INDICATION +#define POLARSSL_SSL_SERVER_NAME_INDICATION MBEDTLS_SSL_SERVER_NAME_INDICATION +#endif +#if defined MBEDTLS_SSL_SESSION_TICKETS +#define POLARSSL_SSL_SESSION_TICKETS MBEDTLS_SSL_SESSION_TICKETS +#endif +#if defined MBEDTLS_SSL_SRV_C +#define POLARSSL_SSL_SRV_C MBEDTLS_SSL_SRV_C +#endif +#if defined MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE +#define POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE +#endif +#if defined MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO +#define POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO +#endif +#if defined MBEDTLS_SSL_TLS_C +#define POLARSSL_SSL_TLS_C MBEDTLS_SSL_TLS_C +#endif +#if defined MBEDTLS_SSL_TRUNCATED_HMAC +#define POLARSSL_SSL_TRUNCATED_HMAC MBEDTLS_SSL_TRUNCATED_HMAC +#endif +#if defined MBEDTLS_THREADING_ALT +#define POLARSSL_THREADING_ALT MBEDTLS_THREADING_ALT +#endif +#if defined MBEDTLS_THREADING_C +#define POLARSSL_THREADING_C MBEDTLS_THREADING_C +#endif +#if defined MBEDTLS_THREADING_PTHREAD +#define POLARSSL_THREADING_PTHREAD MBEDTLS_THREADING_PTHREAD +#endif +#if defined MBEDTLS_TIMING_ALT +#define POLARSSL_TIMING_ALT MBEDTLS_TIMING_ALT +#endif +#if defined MBEDTLS_TIMING_C +#define POLARSSL_TIMING_C MBEDTLS_TIMING_C +#endif +#if defined MBEDTLS_VERSION_C +#define POLARSSL_VERSION_C MBEDTLS_VERSION_C +#endif +#if defined MBEDTLS_VERSION_FEATURES +#define POLARSSL_VERSION_FEATURES MBEDTLS_VERSION_FEATURES +#endif +#if defined MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 +#define POLARSSL_X509_ALLOW_EXTENSIONS_NON_V3 MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 +#endif +#if defined MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION +#define POLARSSL_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION +#endif +#if defined MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE +#define POLARSSL_X509_CHECK_EXTENDED_KEY_USAGE MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE +#endif +#if defined MBEDTLS_X509_CHECK_KEY_USAGE +#define POLARSSL_X509_CHECK_KEY_USAGE MBEDTLS_X509_CHECK_KEY_USAGE +#endif +#if defined MBEDTLS_X509_CREATE_C +#define POLARSSL_X509_CREATE_C MBEDTLS_X509_CREATE_C +#endif +#if defined MBEDTLS_X509_CRL_PARSE_C +#define POLARSSL_X509_CRL_PARSE_C MBEDTLS_X509_CRL_PARSE_C +#endif +#if defined MBEDTLS_X509_CRT_PARSE_C +#define POLARSSL_X509_CRT_PARSE_C MBEDTLS_X509_CRT_PARSE_C +#endif +#if defined MBEDTLS_X509_CRT_WRITE_C +#define POLARSSL_X509_CRT_WRITE_C MBEDTLS_X509_CRT_WRITE_C +#endif +#if defined MBEDTLS_X509_CSR_PARSE_C +#define POLARSSL_X509_CSR_PARSE_C MBEDTLS_X509_CSR_PARSE_C +#endif +#if defined MBEDTLS_X509_CSR_WRITE_C +#define POLARSSL_X509_CSR_WRITE_C MBEDTLS_X509_CSR_WRITE_C +#endif +#if defined MBEDTLS_X509_MAX_INTERMEDIATE_CA +#define POLARSSL_X509_MAX_INTERMEDIATE_CA MBEDTLS_X509_MAX_INTERMEDIATE_CA +#endif +#if defined MBEDTLS_X509_RSASSA_PSS_SUPPORT +#define POLARSSL_X509_RSASSA_PSS_SUPPORT MBEDTLS_X509_RSASSA_PSS_SUPPORT +#endif +#if defined MBEDTLS_X509_USE_C +#define POLARSSL_X509_USE_C MBEDTLS_X509_USE_C +#endif +#if defined MBEDTLS_XTEA_ALT +#define POLARSSL_XTEA_ALT MBEDTLS_XTEA_ALT +#endif +#if defined MBEDTLS_XTEA_C +#define POLARSSL_XTEA_C MBEDTLS_XTEA_C +#endif +#if defined MBEDTLS_ZLIB_SUPPORT +#define POLARSSL_ZLIB_SUPPORT MBEDTLS_ZLIB_SUPPORT +#endif + +/* + * Misc names (macros, types, functions, enum constants...) + */ +#define AES_DECRYPT MBEDTLS_AES_DECRYPT +#define AES_ENCRYPT MBEDTLS_AES_ENCRYPT +#define ASN1_BIT_STRING MBEDTLS_ASN1_BIT_STRING +#define ASN1_BMP_STRING MBEDTLS_ASN1_BMP_STRING +#define ASN1_BOOLEAN MBEDTLS_ASN1_BOOLEAN +#define ASN1_CHK_ADD MBEDTLS_ASN1_CHK_ADD +#define ASN1_CONSTRUCTED MBEDTLS_ASN1_CONSTRUCTED +#define ASN1_CONTEXT_SPECIFIC MBEDTLS_ASN1_CONTEXT_SPECIFIC +#define ASN1_GENERALIZED_TIME MBEDTLS_ASN1_GENERALIZED_TIME +#define ASN1_IA5_STRING MBEDTLS_ASN1_IA5_STRING +#define ASN1_INTEGER MBEDTLS_ASN1_INTEGER +#define ASN1_NULL MBEDTLS_ASN1_NULL +#define ASN1_OCTET_STRING MBEDTLS_ASN1_OCTET_STRING +#define ASN1_OID MBEDTLS_ASN1_OID +#define ASN1_PRIMITIVE MBEDTLS_ASN1_PRIMITIVE +#define ASN1_PRINTABLE_STRING MBEDTLS_ASN1_PRINTABLE_STRING +#define ASN1_SEQUENCE MBEDTLS_ASN1_SEQUENCE +#define ASN1_SET MBEDTLS_ASN1_SET +#define ASN1_T61_STRING MBEDTLS_ASN1_T61_STRING +#define ASN1_UNIVERSAL_STRING MBEDTLS_ASN1_UNIVERSAL_STRING +#define ASN1_UTC_TIME MBEDTLS_ASN1_UTC_TIME +#define ASN1_UTF8_STRING MBEDTLS_ASN1_UTF8_STRING +#define BADCERT_CN_MISMATCH MBEDTLS_X509_BADCERT_CN_MISMATCH +#define BADCERT_EXPIRED MBEDTLS_X509_BADCERT_EXPIRED +#define BADCERT_FUTURE MBEDTLS_X509_BADCERT_FUTURE +#define BADCERT_MISSING MBEDTLS_X509_BADCERT_MISSING +#define BADCERT_NOT_TRUSTED MBEDTLS_X509_BADCERT_NOT_TRUSTED +#define BADCERT_OTHER MBEDTLS_X509_BADCERT_OTHER +#define BADCERT_REVOKED MBEDTLS_X509_BADCERT_REVOKED +#define BADCERT_SKIP_VERIFY MBEDTLS_X509_BADCERT_SKIP_VERIFY +#define BADCRL_EXPIRED MBEDTLS_X509_BADCRL_EXPIRED +#define BADCRL_FUTURE MBEDTLS_X509_BADCRL_FUTURE +#define BADCRL_NOT_TRUSTED MBEDTLS_X509_BADCRL_NOT_TRUSTED +#define BLOWFISH_BLOCKSIZE MBEDTLS_BLOWFISH_BLOCKSIZE +#define BLOWFISH_DECRYPT MBEDTLS_BLOWFISH_DECRYPT +#define BLOWFISH_ENCRYPT MBEDTLS_BLOWFISH_ENCRYPT +#define BLOWFISH_MAX_KEY MBEDTLS_BLOWFISH_MAX_KEY_BITS +#define BLOWFISH_MIN_KEY MBEDTLS_BLOWFISH_MIN_KEY_BITS +#define BLOWFISH_ROUNDS MBEDTLS_BLOWFISH_ROUNDS +#define CAMELLIA_DECRYPT MBEDTLS_CAMELLIA_DECRYPT +#define CAMELLIA_ENCRYPT MBEDTLS_CAMELLIA_ENCRYPT +#define COLLECT_SIZE MBEDTLS_HAVEGE_COLLECT_SIZE +#define CTR_DRBG_BLOCKSIZE MBEDTLS_CTR_DRBG_BLOCKSIZE +#define CTR_DRBG_ENTROPY_LEN MBEDTLS_CTR_DRBG_ENTROPY_LEN +#define CTR_DRBG_KEYBITS MBEDTLS_CTR_DRBG_KEYBITS +#define CTR_DRBG_KEYSIZE MBEDTLS_CTR_DRBG_KEYSIZE +#define CTR_DRBG_MAX_INPUT MBEDTLS_CTR_DRBG_MAX_INPUT +#define CTR_DRBG_MAX_REQUEST MBEDTLS_CTR_DRBG_MAX_REQUEST +#define CTR_DRBG_MAX_SEED_INPUT MBEDTLS_CTR_DRBG_MAX_SEED_INPUT +#define CTR_DRBG_PR_OFF MBEDTLS_CTR_DRBG_PR_OFF +#define CTR_DRBG_PR_ON MBEDTLS_CTR_DRBG_PR_ON +#define CTR_DRBG_RESEED_INTERVAL MBEDTLS_CTR_DRBG_RESEED_INTERVAL +#define CTR_DRBG_SEEDLEN MBEDTLS_CTR_DRBG_SEEDLEN +#define DEPRECATED MBEDTLS_DEPRECATED +#define DES_DECRYPT MBEDTLS_DES_DECRYPT +#define DES_ENCRYPT MBEDTLS_DES_ENCRYPT +#define DES_KEY_SIZE MBEDTLS_DES_KEY_SIZE +#define ENTROPY_BLOCK_SIZE MBEDTLS_ENTROPY_BLOCK_SIZE +#define ENTROPY_MAX_GATHER MBEDTLS_ENTROPY_MAX_GATHER +#define ENTROPY_MAX_SEED_SIZE MBEDTLS_ENTROPY_MAX_SEED_SIZE +#define ENTROPY_MAX_SOURCES MBEDTLS_ENTROPY_MAX_SOURCES +#define ENTROPY_MIN_HARDCLOCK MBEDTLS_ENTROPY_MIN_HARDCLOCK +#define ENTROPY_MIN_HAVEGE MBEDTLS_ENTROPY_MIN_HAVEGE +#define ENTROPY_MIN_PLATFORM MBEDTLS_ENTROPY_MIN_PLATFORM +#define ENTROPY_SOURCE_MANUAL MBEDTLS_ENTROPY_SOURCE_MANUAL +#define EXT_AUTHORITY_KEY_IDENTIFIER MBEDTLS_X509_EXT_AUTHORITY_KEY_IDENTIFIER +#define EXT_BASIC_CONSTRAINTS MBEDTLS_X509_EXT_BASIC_CONSTRAINTS +#define EXT_CERTIFICATE_POLICIES MBEDTLS_X509_EXT_CERTIFICATE_POLICIES +#define EXT_CRL_DISTRIBUTION_POINTS MBEDTLS_X509_EXT_CRL_DISTRIBUTION_POINTS +#define EXT_EXTENDED_KEY_USAGE MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE +#define EXT_FRESHEST_CRL MBEDTLS_X509_EXT_FRESHEST_CRL +#define EXT_INIHIBIT_ANYPOLICY MBEDTLS_X509_EXT_INIHIBIT_ANYPOLICY +#define EXT_ISSUER_ALT_NAME MBEDTLS_X509_EXT_ISSUER_ALT_NAME +#define EXT_KEY_USAGE MBEDTLS_X509_EXT_KEY_USAGE +#define EXT_NAME_CONSTRAINTS MBEDTLS_X509_EXT_NAME_CONSTRAINTS +#define EXT_NS_CERT_TYPE MBEDTLS_X509_EXT_NS_CERT_TYPE +#define EXT_POLICY_CONSTRAINTS MBEDTLS_X509_EXT_POLICY_CONSTRAINTS +#define EXT_POLICY_MAPPINGS MBEDTLS_X509_EXT_POLICY_MAPPINGS +#define EXT_SUBJECT_ALT_NAME MBEDTLS_X509_EXT_SUBJECT_ALT_NAME +#define EXT_SUBJECT_DIRECTORY_ATTRS MBEDTLS_X509_EXT_SUBJECT_DIRECTORY_ATTRS +#define EXT_SUBJECT_KEY_IDENTIFIER MBEDTLS_X509_EXT_SUBJECT_KEY_IDENTIFIER +#define GCM_DECRYPT MBEDTLS_GCM_DECRYPT +#define GCM_ENCRYPT MBEDTLS_GCM_ENCRYPT +#define KU_CRL_SIGN MBEDTLS_X509_KU_CRL_SIGN +#define KU_DATA_ENCIPHERMENT MBEDTLS_X509_KU_DATA_ENCIPHERMENT +#define KU_DIGITAL_SIGNATURE MBEDTLS_X509_KU_DIGITAL_SIGNATURE +#define KU_KEY_AGREEMENT MBEDTLS_X509_KU_KEY_AGREEMENT +#define KU_KEY_CERT_SIGN MBEDTLS_X509_KU_KEY_CERT_SIGN +#define KU_KEY_ENCIPHERMENT MBEDTLS_X509_KU_KEY_ENCIPHERMENT +#define KU_NON_REPUDIATION MBEDTLS_X509_KU_NON_REPUDIATION +#define LN_2_DIV_LN_10_SCALE100 MBEDTLS_LN_2_DIV_LN_10_SCALE100 +#define MEMORY_VERIFY_ALLOC MBEDTLS_MEMORY_VERIFY_ALLOC +#define MEMORY_VERIFY_ALWAYS MBEDTLS_MEMORY_VERIFY_ALWAYS +#define MEMORY_VERIFY_FREE MBEDTLS_MEMORY_VERIFY_FREE +#define MEMORY_VERIFY_NONE MBEDTLS_MEMORY_VERIFY_NONE +#define MPI_CHK MBEDTLS_MPI_CHK +#define NET_PROTO_TCP MBEDTLS_NET_PROTO_TCP +#define NET_PROTO_UDP MBEDTLS_NET_PROTO_UDP +#define NS_CERT_TYPE_EMAIL MBEDTLS_X509_NS_CERT_TYPE_EMAIL +#define NS_CERT_TYPE_EMAIL_CA MBEDTLS_X509_NS_CERT_TYPE_EMAIL_CA +#define NS_CERT_TYPE_OBJECT_SIGNING MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING +#define NS_CERT_TYPE_OBJECT_SIGNING_CA MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING_CA +#define NS_CERT_TYPE_RESERVED MBEDTLS_X509_NS_CERT_TYPE_RESERVED +#define NS_CERT_TYPE_SSL_CA MBEDTLS_X509_NS_CERT_TYPE_SSL_CA +#define NS_CERT_TYPE_SSL_CLIENT MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT +#define NS_CERT_TYPE_SSL_SERVER MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER +#define OID_ANSI_X9_62 MBEDTLS_OID_ANSI_X9_62 +#define OID_ANSI_X9_62_FIELD_TYPE MBEDTLS_OID_ANSI_X9_62_FIELD_TYPE +#define OID_ANSI_X9_62_PRIME_FIELD MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD +#define OID_ANSI_X9_62_SIG MBEDTLS_OID_ANSI_X9_62_SIG +#define OID_ANSI_X9_62_SIG_SHA2 MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 +#define OID_ANY_EXTENDED_KEY_USAGE MBEDTLS_OID_ANY_EXTENDED_KEY_USAGE +#define OID_AT MBEDTLS_OID_AT +#define OID_AT_CN MBEDTLS_OID_AT_CN +#define OID_AT_COUNTRY MBEDTLS_OID_AT_COUNTRY +#define OID_AT_DN_QUALIFIER MBEDTLS_OID_AT_DN_QUALIFIER +#define OID_AT_GENERATION_QUALIFIER MBEDTLS_OID_AT_GENERATION_QUALIFIER +#define OID_AT_GIVEN_NAME MBEDTLS_OID_AT_GIVEN_NAME +#define OID_AT_INITIALS MBEDTLS_OID_AT_INITIALS +#define OID_AT_LOCALITY MBEDTLS_OID_AT_LOCALITY +#define OID_AT_ORGANIZATION MBEDTLS_OID_AT_ORGANIZATION +#define OID_AT_ORG_UNIT MBEDTLS_OID_AT_ORG_UNIT +#define OID_AT_POSTAL_ADDRESS MBEDTLS_OID_AT_POSTAL_ADDRESS +#define OID_AT_POSTAL_CODE MBEDTLS_OID_AT_POSTAL_CODE +#define OID_AT_PSEUDONYM MBEDTLS_OID_AT_PSEUDONYM +#define OID_AT_SERIAL_NUMBER MBEDTLS_OID_AT_SERIAL_NUMBER +#define OID_AT_STATE MBEDTLS_OID_AT_STATE +#define OID_AT_SUR_NAME MBEDTLS_OID_AT_SUR_NAME +#define OID_AT_TITLE MBEDTLS_OID_AT_TITLE +#define OID_AT_UNIQUE_IDENTIFIER MBEDTLS_OID_AT_UNIQUE_IDENTIFIER +#define OID_AUTHORITY_KEY_IDENTIFIER MBEDTLS_OID_AUTHORITY_KEY_IDENTIFIER +#define OID_BASIC_CONSTRAINTS MBEDTLS_OID_BASIC_CONSTRAINTS +#define OID_CERTICOM MBEDTLS_OID_CERTICOM +#define OID_CERTIFICATE_POLICIES MBEDTLS_OID_CERTIFICATE_POLICIES +#define OID_CLIENT_AUTH MBEDTLS_OID_CLIENT_AUTH +#define OID_CMP MBEDTLS_OID_CMP +#define OID_CODE_SIGNING MBEDTLS_OID_CODE_SIGNING +#define OID_COUNTRY_US MBEDTLS_OID_COUNTRY_US +#define OID_CRL_DISTRIBUTION_POINTS MBEDTLS_OID_CRL_DISTRIBUTION_POINTS +#define OID_CRL_NUMBER MBEDTLS_OID_CRL_NUMBER +#define OID_DES_CBC MBEDTLS_OID_DES_CBC +#define OID_DES_EDE3_CBC MBEDTLS_OID_DES_EDE3_CBC +#define OID_DIGEST_ALG_MD2 MBEDTLS_OID_DIGEST_ALG_MD2 +#define OID_DIGEST_ALG_MD4 MBEDTLS_OID_DIGEST_ALG_MD4 +#define OID_DIGEST_ALG_MD5 MBEDTLS_OID_DIGEST_ALG_MD5 +#define OID_DIGEST_ALG_SHA1 MBEDTLS_OID_DIGEST_ALG_SHA1 +#define OID_DIGEST_ALG_SHA224 MBEDTLS_OID_DIGEST_ALG_SHA224 +#define OID_DIGEST_ALG_SHA256 MBEDTLS_OID_DIGEST_ALG_SHA256 +#define OID_DIGEST_ALG_SHA384 MBEDTLS_OID_DIGEST_ALG_SHA384 +#define OID_DIGEST_ALG_SHA512 MBEDTLS_OID_DIGEST_ALG_SHA512 +#define OID_DOMAIN_COMPONENT MBEDTLS_OID_DOMAIN_COMPONENT +#define OID_ECDSA_SHA1 MBEDTLS_OID_ECDSA_SHA1 +#define OID_ECDSA_SHA224 MBEDTLS_OID_ECDSA_SHA224 +#define OID_ECDSA_SHA256 MBEDTLS_OID_ECDSA_SHA256 +#define OID_ECDSA_SHA384 MBEDTLS_OID_ECDSA_SHA384 +#define OID_ECDSA_SHA512 MBEDTLS_OID_ECDSA_SHA512 +#define OID_EC_ALG_ECDH MBEDTLS_OID_EC_ALG_ECDH +#define OID_EC_ALG_UNRESTRICTED MBEDTLS_OID_EC_ALG_UNRESTRICTED +#define OID_EC_BRAINPOOL_V1 MBEDTLS_OID_EC_BRAINPOOL_V1 +#define OID_EC_GRP_BP256R1 MBEDTLS_OID_EC_GRP_BP256R1 +#define OID_EC_GRP_BP384R1 MBEDTLS_OID_EC_GRP_BP384R1 +#define OID_EC_GRP_BP512R1 MBEDTLS_OID_EC_GRP_BP512R1 +#define OID_EC_GRP_SECP192K1 MBEDTLS_OID_EC_GRP_SECP192K1 +#define OID_EC_GRP_SECP192R1 MBEDTLS_OID_EC_GRP_SECP192R1 +#define OID_EC_GRP_SECP224K1 MBEDTLS_OID_EC_GRP_SECP224K1 +#define OID_EC_GRP_SECP224R1 MBEDTLS_OID_EC_GRP_SECP224R1 +#define OID_EC_GRP_SECP256K1 MBEDTLS_OID_EC_GRP_SECP256K1 +#define OID_EC_GRP_SECP256R1 MBEDTLS_OID_EC_GRP_SECP256R1 +#define OID_EC_GRP_SECP384R1 MBEDTLS_OID_EC_GRP_SECP384R1 +#define OID_EC_GRP_SECP521R1 MBEDTLS_OID_EC_GRP_SECP521R1 +#define OID_EMAIL_PROTECTION MBEDTLS_OID_EMAIL_PROTECTION +#define OID_EXTENDED_KEY_USAGE MBEDTLS_OID_EXTENDED_KEY_USAGE +#define OID_FRESHEST_CRL MBEDTLS_OID_FRESHEST_CRL +#define OID_GOV MBEDTLS_OID_GOV +#define OID_HMAC_SHA1 MBEDTLS_OID_HMAC_SHA1 +#define OID_ID_CE MBEDTLS_OID_ID_CE +#define OID_INIHIBIT_ANYPOLICY MBEDTLS_OID_INIHIBIT_ANYPOLICY +#define OID_ISO_CCITT_DS MBEDTLS_OID_ISO_CCITT_DS +#define OID_ISO_IDENTIFIED_ORG MBEDTLS_OID_ISO_IDENTIFIED_ORG +#define OID_ISO_ITU_COUNTRY MBEDTLS_OID_ISO_ITU_COUNTRY +#define OID_ISO_ITU_US_ORG MBEDTLS_OID_ISO_ITU_US_ORG +#define OID_ISO_MEMBER_BODIES MBEDTLS_OID_ISO_MEMBER_BODIES +#define OID_ISSUER_ALT_NAME MBEDTLS_OID_ISSUER_ALT_NAME +#define OID_KEY_USAGE MBEDTLS_OID_KEY_USAGE +#define OID_KP MBEDTLS_OID_KP +#define OID_MGF1 MBEDTLS_OID_MGF1 +#define OID_NAME_CONSTRAINTS MBEDTLS_OID_NAME_CONSTRAINTS +#define OID_NETSCAPE MBEDTLS_OID_NETSCAPE +#define OID_NS_BASE_URL MBEDTLS_OID_NS_BASE_URL +#define OID_NS_CA_POLICY_URL MBEDTLS_OID_NS_CA_POLICY_URL +#define OID_NS_CA_REVOCATION_URL MBEDTLS_OID_NS_CA_REVOCATION_URL +#define OID_NS_CERT MBEDTLS_OID_NS_CERT +#define OID_NS_CERT_SEQUENCE MBEDTLS_OID_NS_CERT_SEQUENCE +#define OID_NS_CERT_TYPE MBEDTLS_OID_NS_CERT_TYPE +#define OID_NS_COMMENT MBEDTLS_OID_NS_COMMENT +#define OID_NS_DATA_TYPE MBEDTLS_OID_NS_DATA_TYPE +#define OID_NS_RENEWAL_URL MBEDTLS_OID_NS_RENEWAL_URL +#define OID_NS_REVOCATION_URL MBEDTLS_OID_NS_REVOCATION_URL +#define OID_NS_SSL_SERVER_NAME MBEDTLS_OID_NS_SSL_SERVER_NAME +#define OID_OCSP_SIGNING MBEDTLS_OID_OCSP_SIGNING +#define OID_OIW_SECSIG MBEDTLS_OID_OIW_SECSIG +#define OID_OIW_SECSIG_ALG MBEDTLS_OID_OIW_SECSIG_ALG +#define OID_OIW_SECSIG_SHA1 MBEDTLS_OID_OIW_SECSIG_SHA1 +#define OID_ORGANIZATION MBEDTLS_OID_ORGANIZATION +#define OID_ORG_ANSI_X9_62 MBEDTLS_OID_ORG_ANSI_X9_62 +#define OID_ORG_CERTICOM MBEDTLS_OID_ORG_CERTICOM +#define OID_ORG_DOD MBEDTLS_OID_ORG_DOD +#define OID_ORG_GOV MBEDTLS_OID_ORG_GOV +#define OID_ORG_NETSCAPE MBEDTLS_OID_ORG_NETSCAPE +#define OID_ORG_OIW MBEDTLS_OID_ORG_OIW +#define OID_ORG_RSA_DATA_SECURITY MBEDTLS_OID_ORG_RSA_DATA_SECURITY +#define OID_ORG_TELETRUST MBEDTLS_OID_ORG_TELETRUST +#define OID_PKCS MBEDTLS_OID_PKCS +#define OID_PKCS1 MBEDTLS_OID_PKCS1 +#define OID_PKCS12 MBEDTLS_OID_PKCS12 +#define OID_PKCS12_PBE MBEDTLS_OID_PKCS12_PBE +#define OID_PKCS12_PBE_SHA1_DES2_EDE_CBC MBEDTLS_OID_PKCS12_PBE_SHA1_DES2_EDE_CBC +#define OID_PKCS12_PBE_SHA1_DES3_EDE_CBC MBEDTLS_OID_PKCS12_PBE_SHA1_DES3_EDE_CBC +#define OID_PKCS12_PBE_SHA1_RC2_128_CBC MBEDTLS_OID_PKCS12_PBE_SHA1_RC2_128_CBC +#define OID_PKCS12_PBE_SHA1_RC2_40_CBC MBEDTLS_OID_PKCS12_PBE_SHA1_RC2_40_CBC +#define OID_PKCS12_PBE_SHA1_RC4_128 MBEDTLS_OID_PKCS12_PBE_SHA1_RC4_128 +#define OID_PKCS12_PBE_SHA1_RC4_40 MBEDTLS_OID_PKCS12_PBE_SHA1_RC4_40 +#define OID_PKCS1_MD2 MBEDTLS_OID_PKCS1_MD2 +#define OID_PKCS1_MD4 MBEDTLS_OID_PKCS1_MD4 +#define OID_PKCS1_MD5 MBEDTLS_OID_PKCS1_MD5 +#define OID_PKCS1_RSA MBEDTLS_OID_PKCS1_RSA +#define OID_PKCS1_SHA1 MBEDTLS_OID_PKCS1_SHA1 +#define OID_PKCS1_SHA224 MBEDTLS_OID_PKCS1_SHA224 +#define OID_PKCS1_SHA256 MBEDTLS_OID_PKCS1_SHA256 +#define OID_PKCS1_SHA384 MBEDTLS_OID_PKCS1_SHA384 +#define OID_PKCS1_SHA512 MBEDTLS_OID_PKCS1_SHA512 +#define OID_PKCS5 MBEDTLS_OID_PKCS5 +#define OID_PKCS5_PBES2 MBEDTLS_OID_PKCS5_PBES2 +#define OID_PKCS5_PBE_MD2_DES_CBC MBEDTLS_OID_PKCS5_PBE_MD2_DES_CBC +#define OID_PKCS5_PBE_MD2_RC2_CBC MBEDTLS_OID_PKCS5_PBE_MD2_RC2_CBC +#define OID_PKCS5_PBE_MD5_DES_CBC MBEDTLS_OID_PKCS5_PBE_MD5_DES_CBC +#define OID_PKCS5_PBE_MD5_RC2_CBC MBEDTLS_OID_PKCS5_PBE_MD5_RC2_CBC +#define OID_PKCS5_PBE_SHA1_DES_CBC MBEDTLS_OID_PKCS5_PBE_SHA1_DES_CBC +#define OID_PKCS5_PBE_SHA1_RC2_CBC MBEDTLS_OID_PKCS5_PBE_SHA1_RC2_CBC +#define OID_PKCS5_PBKDF2 MBEDTLS_OID_PKCS5_PBKDF2 +#define OID_PKCS5_PBMAC1 MBEDTLS_OID_PKCS5_PBMAC1 +#define OID_PKCS9 MBEDTLS_OID_PKCS9 +#define OID_PKCS9_CSR_EXT_REQ MBEDTLS_OID_PKCS9_CSR_EXT_REQ +#define OID_PKCS9_EMAIL MBEDTLS_OID_PKCS9_EMAIL +#define OID_PKIX MBEDTLS_OID_PKIX +#define OID_POLICY_CONSTRAINTS MBEDTLS_OID_POLICY_CONSTRAINTS +#define OID_POLICY_MAPPINGS MBEDTLS_OID_POLICY_MAPPINGS +#define OID_PRIVATE_KEY_USAGE_PERIOD MBEDTLS_OID_PRIVATE_KEY_USAGE_PERIOD +#define OID_RSASSA_PSS MBEDTLS_OID_RSASSA_PSS +#define OID_RSA_COMPANY MBEDTLS_OID_RSA_COMPANY +#define OID_RSA_SHA_OBS MBEDTLS_OID_RSA_SHA_OBS +#define OID_SERVER_AUTH MBEDTLS_OID_SERVER_AUTH +#define OID_SIZE MBEDTLS_OID_SIZE +#define OID_SUBJECT_ALT_NAME MBEDTLS_OID_SUBJECT_ALT_NAME +#define OID_SUBJECT_DIRECTORY_ATTRS MBEDTLS_OID_SUBJECT_DIRECTORY_ATTRS +#define OID_SUBJECT_KEY_IDENTIFIER MBEDTLS_OID_SUBJECT_KEY_IDENTIFIER +#define OID_TELETRUST MBEDTLS_OID_TELETRUST +#define OID_TIME_STAMPING MBEDTLS_OID_TIME_STAMPING +#define PADLOCK_ACE MBEDTLS_PADLOCK_ACE +#define PADLOCK_ALIGN16 MBEDTLS_PADLOCK_ALIGN16 +#define PADLOCK_PHE MBEDTLS_PADLOCK_PHE +#define PADLOCK_PMM MBEDTLS_PADLOCK_PMM +#define PADLOCK_RNG MBEDTLS_PADLOCK_RNG +#define PKCS12_DERIVE_IV MBEDTLS_PKCS12_DERIVE_IV +#define PKCS12_DERIVE_KEY MBEDTLS_PKCS12_DERIVE_KEY +#define PKCS12_DERIVE_MAC_KEY MBEDTLS_PKCS12_DERIVE_MAC_KEY +#define PKCS12_PBE_DECRYPT MBEDTLS_PKCS12_PBE_DECRYPT +#define PKCS12_PBE_ENCRYPT MBEDTLS_PKCS12_PBE_ENCRYPT +#define PKCS5_DECRYPT MBEDTLS_PKCS5_DECRYPT +#define PKCS5_ENCRYPT MBEDTLS_PKCS5_ENCRYPT +#define POLARSSL_AESNI_AES MBEDTLS_AESNI_AES +#define POLARSSL_AESNI_CLMUL MBEDTLS_AESNI_CLMUL +#define POLARSSL_AESNI_H MBEDTLS_AESNI_H +#define POLARSSL_AES_H MBEDTLS_AES_H +#define POLARSSL_ARC4_H MBEDTLS_ARC4_H +#define POLARSSL_ASN1_H MBEDTLS_ASN1_H +#define POLARSSL_ASN1_WRITE_H MBEDTLS_ASN1_WRITE_H +#define POLARSSL_BASE64_H MBEDTLS_BASE64_H +#define POLARSSL_BIGNUM_H MBEDTLS_BIGNUM_H +#define POLARSSL_BLOWFISH_H MBEDTLS_BLOWFISH_H +#define POLARSSL_BN_MUL_H MBEDTLS_BN_MUL_H +#define POLARSSL_CAMELLIA_H MBEDTLS_CAMELLIA_H +#define POLARSSL_CCM_H MBEDTLS_CCM_H +#define POLARSSL_CERTS_H MBEDTLS_CERTS_H +#define POLARSSL_CHECK_CONFIG_H MBEDTLS_CHECK_CONFIG_H +#define POLARSSL_CIPHERSUITE_NODTLS MBEDTLS_CIPHERSUITE_NODTLS +#define POLARSSL_CIPHERSUITE_SHORT_TAG MBEDTLS_CIPHERSUITE_SHORT_TAG +#define POLARSSL_CIPHERSUITE_WEAK MBEDTLS_CIPHERSUITE_WEAK +#define POLARSSL_CIPHER_AES_128_CBC MBEDTLS_CIPHER_AES_128_CBC +#define POLARSSL_CIPHER_AES_128_CCM MBEDTLS_CIPHER_AES_128_CCM +#define POLARSSL_CIPHER_AES_128_CFB128 MBEDTLS_CIPHER_AES_128_CFB128 +#define POLARSSL_CIPHER_AES_128_CTR MBEDTLS_CIPHER_AES_128_CTR +#define POLARSSL_CIPHER_AES_128_ECB MBEDTLS_CIPHER_AES_128_ECB +#define POLARSSL_CIPHER_AES_128_GCM MBEDTLS_CIPHER_AES_128_GCM +#define POLARSSL_CIPHER_AES_192_CBC MBEDTLS_CIPHER_AES_192_CBC +#define POLARSSL_CIPHER_AES_192_CCM MBEDTLS_CIPHER_AES_192_CCM +#define POLARSSL_CIPHER_AES_192_CFB128 MBEDTLS_CIPHER_AES_192_CFB128 +#define POLARSSL_CIPHER_AES_192_CTR MBEDTLS_CIPHER_AES_192_CTR +#define POLARSSL_CIPHER_AES_192_ECB MBEDTLS_CIPHER_AES_192_ECB +#define POLARSSL_CIPHER_AES_192_GCM MBEDTLS_CIPHER_AES_192_GCM +#define POLARSSL_CIPHER_AES_256_CBC MBEDTLS_CIPHER_AES_256_CBC +#define POLARSSL_CIPHER_AES_256_CCM MBEDTLS_CIPHER_AES_256_CCM +#define POLARSSL_CIPHER_AES_256_CFB128 MBEDTLS_CIPHER_AES_256_CFB128 +#define POLARSSL_CIPHER_AES_256_CTR MBEDTLS_CIPHER_AES_256_CTR +#define POLARSSL_CIPHER_AES_256_ECB MBEDTLS_CIPHER_AES_256_ECB +#define POLARSSL_CIPHER_AES_256_GCM MBEDTLS_CIPHER_AES_256_GCM +#define POLARSSL_CIPHER_ARC4_128 MBEDTLS_CIPHER_ARC4_128 +#define POLARSSL_CIPHER_BLOWFISH_CBC MBEDTLS_CIPHER_BLOWFISH_CBC +#define POLARSSL_CIPHER_BLOWFISH_CFB64 MBEDTLS_CIPHER_BLOWFISH_CFB64 +#define POLARSSL_CIPHER_BLOWFISH_CTR MBEDTLS_CIPHER_BLOWFISH_CTR +#define POLARSSL_CIPHER_BLOWFISH_ECB MBEDTLS_CIPHER_BLOWFISH_ECB +#define POLARSSL_CIPHER_CAMELLIA_128_CBC MBEDTLS_CIPHER_CAMELLIA_128_CBC +#define POLARSSL_CIPHER_CAMELLIA_128_CCM MBEDTLS_CIPHER_CAMELLIA_128_CCM +#define POLARSSL_CIPHER_CAMELLIA_128_CFB128 MBEDTLS_CIPHER_CAMELLIA_128_CFB128 +#define POLARSSL_CIPHER_CAMELLIA_128_CTR MBEDTLS_CIPHER_CAMELLIA_128_CTR +#define POLARSSL_CIPHER_CAMELLIA_128_ECB MBEDTLS_CIPHER_CAMELLIA_128_ECB +#define POLARSSL_CIPHER_CAMELLIA_128_GCM MBEDTLS_CIPHER_CAMELLIA_128_GCM +#define POLARSSL_CIPHER_CAMELLIA_192_CBC MBEDTLS_CIPHER_CAMELLIA_192_CBC +#define POLARSSL_CIPHER_CAMELLIA_192_CCM MBEDTLS_CIPHER_CAMELLIA_192_CCM +#define POLARSSL_CIPHER_CAMELLIA_192_CFB128 MBEDTLS_CIPHER_CAMELLIA_192_CFB128 +#define POLARSSL_CIPHER_CAMELLIA_192_CTR MBEDTLS_CIPHER_CAMELLIA_192_CTR +#define POLARSSL_CIPHER_CAMELLIA_192_ECB MBEDTLS_CIPHER_CAMELLIA_192_ECB +#define POLARSSL_CIPHER_CAMELLIA_192_GCM MBEDTLS_CIPHER_CAMELLIA_192_GCM +#define POLARSSL_CIPHER_CAMELLIA_256_CBC MBEDTLS_CIPHER_CAMELLIA_256_CBC +#define POLARSSL_CIPHER_CAMELLIA_256_CCM MBEDTLS_CIPHER_CAMELLIA_256_CCM +#define POLARSSL_CIPHER_CAMELLIA_256_CFB128 MBEDTLS_CIPHER_CAMELLIA_256_CFB128 +#define POLARSSL_CIPHER_CAMELLIA_256_CTR MBEDTLS_CIPHER_CAMELLIA_256_CTR +#define POLARSSL_CIPHER_CAMELLIA_256_ECB MBEDTLS_CIPHER_CAMELLIA_256_ECB +#define POLARSSL_CIPHER_CAMELLIA_256_GCM MBEDTLS_CIPHER_CAMELLIA_256_GCM +#define POLARSSL_CIPHER_DES_CBC MBEDTLS_CIPHER_DES_CBC +#define POLARSSL_CIPHER_DES_ECB MBEDTLS_CIPHER_DES_ECB +#define POLARSSL_CIPHER_DES_EDE3_CBC MBEDTLS_CIPHER_DES_EDE3_CBC +#define POLARSSL_CIPHER_DES_EDE3_ECB MBEDTLS_CIPHER_DES_EDE3_ECB +#define POLARSSL_CIPHER_DES_EDE_CBC MBEDTLS_CIPHER_DES_EDE_CBC +#define POLARSSL_CIPHER_DES_EDE_ECB MBEDTLS_CIPHER_DES_EDE_ECB +#define POLARSSL_CIPHER_H MBEDTLS_CIPHER_H +#define POLARSSL_CIPHER_ID_3DES MBEDTLS_CIPHER_ID_3DES +#define POLARSSL_CIPHER_ID_AES MBEDTLS_CIPHER_ID_AES +#define POLARSSL_CIPHER_ID_ARC4 MBEDTLS_CIPHER_ID_ARC4 +#define POLARSSL_CIPHER_ID_BLOWFISH MBEDTLS_CIPHER_ID_BLOWFISH +#define POLARSSL_CIPHER_ID_CAMELLIA MBEDTLS_CIPHER_ID_CAMELLIA +#define POLARSSL_CIPHER_ID_DES MBEDTLS_CIPHER_ID_DES +#define POLARSSL_CIPHER_ID_NONE MBEDTLS_CIPHER_ID_NONE +#define POLARSSL_CIPHER_ID_NULL MBEDTLS_CIPHER_ID_NULL +#define POLARSSL_CIPHER_MODE_AEAD MBEDTLS_CIPHER_MODE_AEAD +#define POLARSSL_CIPHER_MODE_STREAM MBEDTLS_CIPHER_MODE_STREAM +#define POLARSSL_CIPHER_MODE_WITH_PADDING MBEDTLS_CIPHER_MODE_WITH_PADDING +#define POLARSSL_CIPHER_NONE MBEDTLS_CIPHER_NONE +#define POLARSSL_CIPHER_NULL MBEDTLS_CIPHER_NULL +#define POLARSSL_CIPHER_VARIABLE_IV_LEN MBEDTLS_CIPHER_VARIABLE_IV_LEN +#define POLARSSL_CIPHER_VARIABLE_KEY_LEN MBEDTLS_CIPHER_VARIABLE_KEY_LEN +#define POLARSSL_CIPHER_WRAP_H MBEDTLS_CIPHER_WRAP_H +#define POLARSSL_CONFIG_H MBEDTLS_CONFIG_H +#define POLARSSL_CTR_DRBG_H MBEDTLS_CTR_DRBG_H +#define POLARSSL_DEBUG_H MBEDTLS_DEBUG_H +#define POLARSSL_DECRYPT MBEDTLS_DECRYPT +#define POLARSSL_DES_H MBEDTLS_DES_H +#define POLARSSL_DHM_H MBEDTLS_DHM_H +#define POLARSSL_DHM_RFC3526_MODP_2048_G MBEDTLS_DHM_RFC3526_MODP_2048_G +#define POLARSSL_DHM_RFC3526_MODP_2048_P MBEDTLS_DHM_RFC3526_MODP_2048_P +#define POLARSSL_DHM_RFC3526_MODP_3072_G MBEDTLS_DHM_RFC3526_MODP_3072_G +#define POLARSSL_DHM_RFC3526_MODP_3072_P MBEDTLS_DHM_RFC3526_MODP_3072_P +#define POLARSSL_DHM_RFC5114_MODP_2048_G MBEDTLS_DHM_RFC5114_MODP_2048_G +#define POLARSSL_DHM_RFC5114_MODP_2048_P MBEDTLS_DHM_RFC5114_MODP_2048_P +#define POLARSSL_ECDH_H MBEDTLS_ECDH_H +#define POLARSSL_ECDH_OURS MBEDTLS_ECDH_OURS +#define POLARSSL_ECDH_THEIRS MBEDTLS_ECDH_THEIRS +#define POLARSSL_ECDSA_H MBEDTLS_ECDSA_H +#define POLARSSL_ECP_DP_BP256R1 MBEDTLS_ECP_DP_BP256R1 +#define POLARSSL_ECP_DP_BP384R1 MBEDTLS_ECP_DP_BP384R1 +#define POLARSSL_ECP_DP_BP512R1 MBEDTLS_ECP_DP_BP512R1 +#define POLARSSL_ECP_DP_M255 MBEDTLS_ECP_DP_CURVE25519 +#define POLARSSL_ECP_DP_MAX MBEDTLS_ECP_DP_MAX +#define POLARSSL_ECP_DP_NONE MBEDTLS_ECP_DP_NONE +#define POLARSSL_ECP_DP_SECP192K1 MBEDTLS_ECP_DP_SECP192K1 +#define POLARSSL_ECP_DP_SECP192R1 MBEDTLS_ECP_DP_SECP192R1 +#define POLARSSL_ECP_DP_SECP224K1 MBEDTLS_ECP_DP_SECP224K1 +#define POLARSSL_ECP_DP_SECP224R1 MBEDTLS_ECP_DP_SECP224R1 +#define POLARSSL_ECP_DP_SECP256K1 MBEDTLS_ECP_DP_SECP256K1 +#define POLARSSL_ECP_DP_SECP256R1 MBEDTLS_ECP_DP_SECP256R1 +#define POLARSSL_ECP_DP_SECP384R1 MBEDTLS_ECP_DP_SECP384R1 +#define POLARSSL_ECP_DP_SECP521R1 MBEDTLS_ECP_DP_SECP521R1 +#define POLARSSL_ECP_H MBEDTLS_ECP_H +#define POLARSSL_ECP_MAX_BYTES MBEDTLS_ECP_MAX_BYTES +#define POLARSSL_ECP_MAX_PT_LEN MBEDTLS_ECP_MAX_PT_LEN +#define POLARSSL_ECP_PF_COMPRESSED MBEDTLS_ECP_PF_COMPRESSED +#define POLARSSL_ECP_PF_UNCOMPRESSED MBEDTLS_ECP_PF_UNCOMPRESSED +#define POLARSSL_ECP_TLS_NAMED_CURVE MBEDTLS_ECP_TLS_NAMED_CURVE +#define POLARSSL_ENCRYPT MBEDTLS_ENCRYPT +#define POLARSSL_ENTROPY_H MBEDTLS_ENTROPY_H +#define POLARSSL_ENTROPY_POLL_H MBEDTLS_ENTROPY_POLL_H +#define POLARSSL_ENTROPY_SHA256_ACCUMULATOR MBEDTLS_ENTROPY_SHA256_ACCUMULATOR +#define POLARSSL_ENTROPY_SHA512_ACCUMULATOR MBEDTLS_ENTROPY_SHA512_ACCUMULATOR +#define POLARSSL_ERROR_H MBEDTLS_ERROR_H +#define POLARSSL_ERR_AES_INVALID_INPUT_LENGTH MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH +#define POLARSSL_ERR_AES_INVALID_KEY_LENGTH MBEDTLS_ERR_AES_INVALID_KEY_LENGTH +#define POLARSSL_ERR_ASN1_BUF_TOO_SMALL MBEDTLS_ERR_ASN1_BUF_TOO_SMALL +#define POLARSSL_ERR_ASN1_INVALID_DATA MBEDTLS_ERR_ASN1_INVALID_DATA +#define POLARSSL_ERR_ASN1_INVALID_LENGTH MBEDTLS_ERR_ASN1_INVALID_LENGTH +#define POLARSSL_ERR_ASN1_LENGTH_MISMATCH MBEDTLS_ERR_ASN1_LENGTH_MISMATCH +#define POLARSSL_ERR_ASN1_MALLOC_FAILED MBEDTLS_ERR_ASN1_ALLOC_FAILED +#define POLARSSL_ERR_ASN1_OUT_OF_DATA MBEDTLS_ERR_ASN1_OUT_OF_DATA +#define POLARSSL_ERR_ASN1_UNEXPECTED_TAG MBEDTLS_ERR_ASN1_UNEXPECTED_TAG +#define POLARSSL_ERR_BASE64_BUFFER_TOO_SMALL MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL +#define POLARSSL_ERR_BASE64_INVALID_CHARACTER MBEDTLS_ERR_BASE64_INVALID_CHARACTER +#define POLARSSL_ERR_BLOWFISH_INVALID_INPUT_LENGTH MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH +#define POLARSSL_ERR_BLOWFISH_INVALID_KEY_LENGTH MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH +#define POLARSSL_ERR_CAMELLIA_INVALID_INPUT_LENGTH MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH +#define POLARSSL_ERR_CAMELLIA_INVALID_KEY_LENGTH MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH +#define POLARSSL_ERR_CCM_AUTH_FAILED MBEDTLS_ERR_CCM_AUTH_FAILED +#define POLARSSL_ERR_CCM_BAD_INPUT MBEDTLS_ERR_CCM_BAD_INPUT +#define POLARSSL_ERR_CIPHER_ALLOC_FAILED MBEDTLS_ERR_CIPHER_ALLOC_FAILED +#define POLARSSL_ERR_CIPHER_AUTH_FAILED MBEDTLS_ERR_CIPHER_AUTH_FAILED +#define POLARSSL_ERR_CIPHER_BAD_INPUT_DATA MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA +#define POLARSSL_ERR_CIPHER_FEATURE_UNAVAILABLE MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_CIPHER_FULL_BLOCK_EXPECTED MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED +#define POLARSSL_ERR_CIPHER_INVALID_PADDING MBEDTLS_ERR_CIPHER_INVALID_PADDING +#define POLARSSL_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED +#define POLARSSL_ERR_CTR_DRBG_FILE_IO_ERROR MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR +#define POLARSSL_ERR_CTR_DRBG_INPUT_TOO_BIG MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG +#define POLARSSL_ERR_CTR_DRBG_REQUEST_TOO_BIG MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG +#define POLARSSL_ERR_DES_INVALID_INPUT_LENGTH MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH +#define POLARSSL_ERR_DHM_BAD_INPUT_DATA MBEDTLS_ERR_DHM_BAD_INPUT_DATA +#define POLARSSL_ERR_DHM_CALC_SECRET_FAILED MBEDTLS_ERR_DHM_CALC_SECRET_FAILED +#define POLARSSL_ERR_DHM_FILE_IO_ERROR MBEDTLS_ERR_DHM_FILE_IO_ERROR +#define POLARSSL_ERR_DHM_INVALID_FORMAT MBEDTLS_ERR_DHM_INVALID_FORMAT +#define POLARSSL_ERR_DHM_MAKE_PARAMS_FAILED MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED +#define POLARSSL_ERR_DHM_MAKE_PUBLIC_FAILED MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED +#define POLARSSL_ERR_DHM_MALLOC_FAILED MBEDTLS_ERR_DHM_ALLOC_FAILED +#define POLARSSL_ERR_DHM_READ_PARAMS_FAILED MBEDTLS_ERR_DHM_READ_PARAMS_FAILED +#define POLARSSL_ERR_DHM_READ_PUBLIC_FAILED MBEDTLS_ERR_DHM_READ_PUBLIC_FAILED +#define POLARSSL_ERR_ECP_BAD_INPUT_DATA MBEDTLS_ERR_ECP_BAD_INPUT_DATA +#define POLARSSL_ERR_ECP_BUFFER_TOO_SMALL MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL +#define POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_ECP_INVALID_KEY MBEDTLS_ERR_ECP_INVALID_KEY +#define POLARSSL_ERR_ECP_MALLOC_FAILED MBEDTLS_ERR_ECP_ALLOC_FAILED +#define POLARSSL_ERR_ECP_RANDOM_FAILED MBEDTLS_ERR_ECP_RANDOM_FAILED +#define POLARSSL_ERR_ECP_SIG_LEN_MISMATCH MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH +#define POLARSSL_ERR_ECP_VERIFY_FAILED MBEDTLS_ERR_ECP_VERIFY_FAILED +#define POLARSSL_ERR_ENTROPY_FILE_IO_ERROR MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR +#define POLARSSL_ERR_ENTROPY_MAX_SOURCES MBEDTLS_ERR_ENTROPY_MAX_SOURCES +#define POLARSSL_ERR_ENTROPY_NO_SOURCES_DEFINED MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED +#define POLARSSL_ERR_ENTROPY_SOURCE_FAILED MBEDTLS_ERR_ENTROPY_SOURCE_FAILED +#define POLARSSL_ERR_GCM_AUTH_FAILED MBEDTLS_ERR_GCM_AUTH_FAILED +#define POLARSSL_ERR_GCM_BAD_INPUT MBEDTLS_ERR_GCM_BAD_INPUT +#define POLARSSL_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED +#define POLARSSL_ERR_HMAC_DRBG_FILE_IO_ERROR MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR +#define POLARSSL_ERR_HMAC_DRBG_INPUT_TOO_BIG MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG +#define POLARSSL_ERR_HMAC_DRBG_REQUEST_TOO_BIG MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG +#define POLARSSL_ERR_MD_ALLOC_FAILED MBEDTLS_ERR_MD_ALLOC_FAILED +#define POLARSSL_ERR_MD_BAD_INPUT_DATA MBEDTLS_ERR_MD_BAD_INPUT_DATA +#define POLARSSL_ERR_MD_FEATURE_UNAVAILABLE MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_MD_FILE_IO_ERROR MBEDTLS_ERR_MD_FILE_IO_ERROR +#define POLARSSL_ERR_MPI_BAD_INPUT_DATA MBEDTLS_ERR_MPI_BAD_INPUT_DATA +#define POLARSSL_ERR_MPI_BUFFER_TOO_SMALL MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL +#define POLARSSL_ERR_MPI_DIVISION_BY_ZERO MBEDTLS_ERR_MPI_DIVISION_BY_ZERO +#define POLARSSL_ERR_MPI_FILE_IO_ERROR MBEDTLS_ERR_MPI_FILE_IO_ERROR +#define POLARSSL_ERR_MPI_INVALID_CHARACTER MBEDTLS_ERR_MPI_INVALID_CHARACTER +#define POLARSSL_ERR_MPI_MALLOC_FAILED MBEDTLS_ERR_MPI_ALLOC_FAILED +#define POLARSSL_ERR_MPI_NEGATIVE_VALUE MBEDTLS_ERR_MPI_NEGATIVE_VALUE +#define POLARSSL_ERR_MPI_NOT_ACCEPTABLE MBEDTLS_ERR_MPI_NOT_ACCEPTABLE +#define POLARSSL_ERR_NET_ACCEPT_FAILED MBEDTLS_ERR_NET_ACCEPT_FAILED +#define POLARSSL_ERR_NET_BIND_FAILED MBEDTLS_ERR_NET_BIND_FAILED +#define POLARSSL_ERR_NET_CONNECT_FAILED MBEDTLS_ERR_NET_CONNECT_FAILED +#define POLARSSL_ERR_NET_CONN_RESET MBEDTLS_ERR_NET_CONN_RESET +#define POLARSSL_ERR_NET_LISTEN_FAILED MBEDTLS_ERR_NET_LISTEN_FAILED +#define POLARSSL_ERR_NET_RECV_FAILED MBEDTLS_ERR_NET_RECV_FAILED +#define POLARSSL_ERR_NET_SEND_FAILED MBEDTLS_ERR_NET_SEND_FAILED +#define POLARSSL_ERR_NET_SOCKET_FAILED MBEDTLS_ERR_NET_SOCKET_FAILED +#define POLARSSL_ERR_NET_TIMEOUT MBEDTLS_ERR_SSL_TIMEOUT +#define POLARSSL_ERR_NET_UNKNOWN_HOST MBEDTLS_ERR_NET_UNKNOWN_HOST +#define POLARSSL_ERR_NET_WANT_READ MBEDTLS_ERR_SSL_WANT_READ +#define POLARSSL_ERR_NET_WANT_WRITE MBEDTLS_ERR_SSL_WANT_WRITE +#define POLARSSL_ERR_OID_BUF_TOO_SMALL MBEDTLS_ERR_OID_BUF_TOO_SMALL +#define POLARSSL_ERR_OID_NOT_FOUND MBEDTLS_ERR_OID_NOT_FOUND +#define POLARSSL_ERR_PADLOCK_DATA_MISALIGNED MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED +#define POLARSSL_ERR_PEM_BAD_INPUT_DATA MBEDTLS_ERR_PEM_BAD_INPUT_DATA +#define POLARSSL_ERR_PEM_FEATURE_UNAVAILABLE MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_PEM_INVALID_DATA MBEDTLS_ERR_PEM_INVALID_DATA +#define POLARSSL_ERR_PEM_INVALID_ENC_IV MBEDTLS_ERR_PEM_INVALID_ENC_IV +#define POLARSSL_ERR_PEM_MALLOC_FAILED MBEDTLS_ERR_PEM_ALLOC_FAILED +#define POLARSSL_ERR_PEM_NO_HEADER_FOOTER_PRESENT MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT +#define POLARSSL_ERR_PEM_PASSWORD_MISMATCH MBEDTLS_ERR_PEM_PASSWORD_MISMATCH +#define POLARSSL_ERR_PEM_PASSWORD_REQUIRED MBEDTLS_ERR_PEM_PASSWORD_REQUIRED +#define POLARSSL_ERR_PEM_UNKNOWN_ENC_ALG MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG +#define POLARSSL_ERR_PKCS12_BAD_INPUT_DATA MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA +#define POLARSSL_ERR_PKCS12_FEATURE_UNAVAILABLE MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_PKCS12_PASSWORD_MISMATCH MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH +#define POLARSSL_ERR_PKCS12_PBE_INVALID_FORMAT MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT +#define POLARSSL_ERR_PKCS5_BAD_INPUT_DATA MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA +#define POLARSSL_ERR_PKCS5_FEATURE_UNAVAILABLE MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_PKCS5_INVALID_FORMAT MBEDTLS_ERR_PKCS5_INVALID_FORMAT +#define POLARSSL_ERR_PKCS5_PASSWORD_MISMATCH MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH +#define POLARSSL_ERR_PK_BAD_INPUT_DATA MBEDTLS_ERR_PK_BAD_INPUT_DATA +#define POLARSSL_ERR_PK_FEATURE_UNAVAILABLE MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_PK_FILE_IO_ERROR MBEDTLS_ERR_PK_FILE_IO_ERROR +#define POLARSSL_ERR_PK_INVALID_ALG MBEDTLS_ERR_PK_INVALID_ALG +#define POLARSSL_ERR_PK_INVALID_PUBKEY MBEDTLS_ERR_PK_INVALID_PUBKEY +#define POLARSSL_ERR_PK_KEY_INVALID_FORMAT MBEDTLS_ERR_PK_KEY_INVALID_FORMAT +#define POLARSSL_ERR_PK_KEY_INVALID_VERSION MBEDTLS_ERR_PK_KEY_INVALID_VERSION +#define POLARSSL_ERR_PK_MALLOC_FAILED MBEDTLS_ERR_PK_ALLOC_FAILED +#define POLARSSL_ERR_PK_PASSWORD_MISMATCH MBEDTLS_ERR_PK_PASSWORD_MISMATCH +#define POLARSSL_ERR_PK_PASSWORD_REQUIRED MBEDTLS_ERR_PK_PASSWORD_REQUIRED +#define POLARSSL_ERR_PK_SIG_LEN_MISMATCH MBEDTLS_ERR_PK_SIG_LEN_MISMATCH +#define POLARSSL_ERR_PK_TYPE_MISMATCH MBEDTLS_ERR_PK_TYPE_MISMATCH +#define POLARSSL_ERR_PK_UNKNOWN_NAMED_CURVE MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE +#define POLARSSL_ERR_PK_UNKNOWN_PK_ALG MBEDTLS_ERR_PK_UNKNOWN_PK_ALG +#define POLARSSL_ERR_RSA_BAD_INPUT_DATA MBEDTLS_ERR_RSA_BAD_INPUT_DATA +#define POLARSSL_ERR_RSA_INVALID_PADDING MBEDTLS_ERR_RSA_INVALID_PADDING +#define POLARSSL_ERR_RSA_KEY_CHECK_FAILED MBEDTLS_ERR_RSA_KEY_CHECK_FAILED +#define POLARSSL_ERR_RSA_KEY_GEN_FAILED MBEDTLS_ERR_RSA_KEY_GEN_FAILED +#define POLARSSL_ERR_RSA_OUTPUT_TOO_LARGE MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE +#define POLARSSL_ERR_RSA_PRIVATE_FAILED MBEDTLS_ERR_RSA_PRIVATE_FAILED +#define POLARSSL_ERR_RSA_PUBLIC_FAILED MBEDTLS_ERR_RSA_PUBLIC_FAILED +#define POLARSSL_ERR_RSA_RNG_FAILED MBEDTLS_ERR_RSA_RNG_FAILED +#define POLARSSL_ERR_RSA_VERIFY_FAILED MBEDTLS_ERR_RSA_VERIFY_FAILED +#define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE +#define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST +#define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY +#define POLARSSL_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC MBEDTLS_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC +#define POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO +#define POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE +#define POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS +#define POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP +#define POLARSSL_ERR_SSL_BAD_HS_FINISHED MBEDTLS_ERR_SSL_BAD_HS_FINISHED +#define POLARSSL_ERR_SSL_BAD_HS_NEW_SESSION_TICKET MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET +#define POLARSSL_ERR_SSL_BAD_HS_PROTOCOL_VERSION MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION +#define POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO +#define POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO_DONE MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE +#define POLARSSL_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE +#define POLARSSL_ERR_SSL_BAD_INPUT_DATA MBEDTLS_ERR_SSL_BAD_INPUT_DATA +#define POLARSSL_ERR_SSL_BUFFER_TOO_SMALL MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL +#define POLARSSL_ERR_SSL_CA_CHAIN_REQUIRED MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED +#define POLARSSL_ERR_SSL_CERTIFICATE_REQUIRED MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED +#define POLARSSL_ERR_SSL_CERTIFICATE_TOO_LARGE MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE +#define POLARSSL_ERR_SSL_COMPRESSION_FAILED MBEDTLS_ERR_SSL_COMPRESSION_FAILED +#define POLARSSL_ERR_SSL_CONN_EOF MBEDTLS_ERR_SSL_CONN_EOF +#define POLARSSL_ERR_SSL_COUNTER_WRAPPING MBEDTLS_ERR_SSL_COUNTER_WRAPPING +#define POLARSSL_ERR_SSL_FATAL_ALERT_MESSAGE MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE +#define POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_SSL_HELLO_VERIFY_REQUIRED MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED +#define POLARSSL_ERR_SSL_HW_ACCEL_FAILED MBEDTLS_ERR_SSL_HW_ACCEL_FAILED +#define POLARSSL_ERR_SSL_HW_ACCEL_FALLTHROUGH MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH +#define POLARSSL_ERR_SSL_INTERNAL_ERROR MBEDTLS_ERR_SSL_INTERNAL_ERROR +#define POLARSSL_ERR_SSL_INVALID_MAC MBEDTLS_ERR_SSL_INVALID_MAC +#define POLARSSL_ERR_SSL_INVALID_RECORD MBEDTLS_ERR_SSL_INVALID_RECORD +#define POLARSSL_ERR_SSL_MALLOC_FAILED MBEDTLS_ERR_SSL_ALLOC_FAILED +#define POLARSSL_ERR_SSL_NO_CIPHER_CHOSEN MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN +#define POLARSSL_ERR_SSL_NO_CLIENT_CERTIFICATE MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE +#define POLARSSL_ERR_SSL_NO_RNG MBEDTLS_ERR_SSL_NO_RNG +#define POLARSSL_ERR_SSL_NO_USABLE_CIPHERSUITE MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE +#define POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY +#define POLARSSL_ERR_SSL_PEER_VERIFY_FAILED MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED +#define POLARSSL_ERR_SSL_PK_TYPE_MISMATCH MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH +#define POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED +#define POLARSSL_ERR_SSL_SESSION_TICKET_EXPIRED MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED +#define POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE +#define POLARSSL_ERR_SSL_UNKNOWN_CIPHER MBEDTLS_ERR_SSL_UNKNOWN_CIPHER +#define POLARSSL_ERR_SSL_UNKNOWN_IDENTITY MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY +#define POLARSSL_ERR_SSL_WAITING_SERVER_HELLO_RENEGO MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO +#define POLARSSL_ERR_THREADING_BAD_INPUT_DATA MBEDTLS_ERR_THREADING_BAD_INPUT_DATA +#define POLARSSL_ERR_THREADING_FEATURE_UNAVAILABLE MBEDTLS_ERR_THREADING_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_THREADING_MUTEX_ERROR MBEDTLS_ERR_THREADING_MUTEX_ERROR +#define POLARSSL_ERR_X509_BAD_INPUT_DATA MBEDTLS_ERR_X509_BAD_INPUT_DATA +#define POLARSSL_ERR_X509_CERT_UNKNOWN_FORMAT MBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT +#define POLARSSL_ERR_X509_CERT_VERIFY_FAILED MBEDTLS_ERR_X509_CERT_VERIFY_FAILED +#define POLARSSL_ERR_X509_FEATURE_UNAVAILABLE MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE +#define POLARSSL_ERR_X509_FILE_IO_ERROR MBEDTLS_ERR_X509_FILE_IO_ERROR +#define POLARSSL_ERR_X509_INVALID_ALG MBEDTLS_ERR_X509_INVALID_ALG +#define POLARSSL_ERR_X509_INVALID_DATE MBEDTLS_ERR_X509_INVALID_DATE +#define POLARSSL_ERR_X509_INVALID_EXTENSIONS MBEDTLS_ERR_X509_INVALID_EXTENSIONS +#define POLARSSL_ERR_X509_INVALID_FORMAT MBEDTLS_ERR_X509_INVALID_FORMAT +#define POLARSSL_ERR_X509_INVALID_NAME MBEDTLS_ERR_X509_INVALID_NAME +#define POLARSSL_ERR_X509_INVALID_SERIAL MBEDTLS_ERR_X509_INVALID_SERIAL +#define POLARSSL_ERR_X509_INVALID_SIGNATURE MBEDTLS_ERR_X509_INVALID_SIGNATURE +#define POLARSSL_ERR_X509_INVALID_VERSION MBEDTLS_ERR_X509_INVALID_VERSION +#define POLARSSL_ERR_X509_MALLOC_FAILED MBEDTLS_ERR_X509_ALLOC_FAILED +#define POLARSSL_ERR_X509_SIG_MISMATCH MBEDTLS_ERR_X509_SIG_MISMATCH +#define POLARSSL_ERR_X509_UNKNOWN_OID MBEDTLS_ERR_X509_UNKNOWN_OID +#define POLARSSL_ERR_X509_UNKNOWN_SIG_ALG MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG +#define POLARSSL_ERR_X509_UNKNOWN_VERSION MBEDTLS_ERR_X509_UNKNOWN_VERSION +#define POLARSSL_ERR_XTEA_INVALID_INPUT_LENGTH MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH +#define POLARSSL_GCM_H MBEDTLS_GCM_H +#define POLARSSL_HAVEGE_H MBEDTLS_HAVEGE_H +#define POLARSSL_HAVE_INT32 MBEDTLS_HAVE_INT32 +#define POLARSSL_HAVE_INT64 MBEDTLS_HAVE_INT64 +#define POLARSSL_HAVE_UDBL MBEDTLS_HAVE_UDBL +#define POLARSSL_HAVE_X86 MBEDTLS_HAVE_X86 +#define POLARSSL_HAVE_X86_64 MBEDTLS_HAVE_X86_64 +#define POLARSSL_HMAC_DRBG_H MBEDTLS_HMAC_DRBG_H +#define POLARSSL_HMAC_DRBG_PR_OFF MBEDTLS_HMAC_DRBG_PR_OFF +#define POLARSSL_HMAC_DRBG_PR_ON MBEDTLS_HMAC_DRBG_PR_ON +#define POLARSSL_KEY_EXCHANGE_DHE_PSK MBEDTLS_KEY_EXCHANGE_DHE_PSK +#define POLARSSL_KEY_EXCHANGE_DHE_RSA MBEDTLS_KEY_EXCHANGE_DHE_RSA +#define POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA +#define POLARSSL_KEY_EXCHANGE_ECDHE_PSK MBEDTLS_KEY_EXCHANGE_ECDHE_PSK +#define POLARSSL_KEY_EXCHANGE_ECDHE_RSA MBEDTLS_KEY_EXCHANGE_ECDHE_RSA +#define POLARSSL_KEY_EXCHANGE_ECDH_ECDSA MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA +#define POLARSSL_KEY_EXCHANGE_ECDH_RSA MBEDTLS_KEY_EXCHANGE_ECDH_RSA +#define POLARSSL_KEY_EXCHANGE_NONE MBEDTLS_KEY_EXCHANGE_NONE +#define POLARSSL_KEY_EXCHANGE_PSK MBEDTLS_KEY_EXCHANGE_PSK +#define POLARSSL_KEY_EXCHANGE_RSA MBEDTLS_KEY_EXCHANGE_RSA +#define POLARSSL_KEY_EXCHANGE_RSA_PSK MBEDTLS_KEY_EXCHANGE_RSA_PSK +#define POLARSSL_KEY_EXCHANGE__SOME__ECDHE_ENABLED MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED +#define POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED +#define POLARSSL_KEY_EXCHANGE__WITH_CERT__ENABLED MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED +#define POLARSSL_KEY_LENGTH_DES MBEDTLS_KEY_LENGTH_DES +#define POLARSSL_KEY_LENGTH_DES_EDE MBEDTLS_KEY_LENGTH_DES_EDE +#define POLARSSL_KEY_LENGTH_DES_EDE3 MBEDTLS_KEY_LENGTH_DES_EDE3 +#define POLARSSL_KEY_LENGTH_NONE MBEDTLS_KEY_LENGTH_NONE +#define POLARSSL_MAX_BLOCK_LENGTH MBEDTLS_MAX_BLOCK_LENGTH +#define POLARSSL_MAX_IV_LENGTH MBEDTLS_MAX_IV_LENGTH +#define POLARSSL_MD2_H MBEDTLS_MD2_H +#define POLARSSL_MD4_H MBEDTLS_MD4_H +#define POLARSSL_MD5_H MBEDTLS_MD5_H +#define POLARSSL_MD_H MBEDTLS_MD_H +#define POLARSSL_MD_MAX_SIZE MBEDTLS_MD_MAX_SIZE +#define POLARSSL_MD_MD2 MBEDTLS_MD_MD2 +#define POLARSSL_MD_MD4 MBEDTLS_MD_MD4 +#define POLARSSL_MD_MD5 MBEDTLS_MD_MD5 +#define POLARSSL_MD_NONE MBEDTLS_MD_NONE +#define POLARSSL_MD_RIPEMD160 MBEDTLS_MD_RIPEMD160 +#define POLARSSL_MD_SHA1 MBEDTLS_MD_SHA1 +#define POLARSSL_MD_SHA224 MBEDTLS_MD_SHA224 +#define POLARSSL_MD_SHA256 MBEDTLS_MD_SHA256 +#define POLARSSL_MD_SHA384 MBEDTLS_MD_SHA384 +#define POLARSSL_MD_SHA512 MBEDTLS_MD_SHA512 +#define POLARSSL_MD_WRAP_H MBEDTLS_MD_WRAP_H +#define POLARSSL_MEMORY_BUFFER_ALLOC_H MBEDTLS_MEMORY_BUFFER_ALLOC_H +#define POLARSSL_MODE_CBC MBEDTLS_MODE_CBC +#define POLARSSL_MODE_CCM MBEDTLS_MODE_CCM +#define POLARSSL_MODE_CFB MBEDTLS_MODE_CFB +#define POLARSSL_MODE_CTR MBEDTLS_MODE_CTR +#define POLARSSL_MODE_ECB MBEDTLS_MODE_ECB +#define POLARSSL_MODE_GCM MBEDTLS_MODE_GCM +#define POLARSSL_MODE_NONE MBEDTLS_MODE_NONE +#define POLARSSL_MODE_OFB MBEDTLS_MODE_OFB +#define POLARSSL_MODE_STREAM MBEDTLS_MODE_STREAM +#define POLARSSL_MPI_MAX_BITS MBEDTLS_MPI_MAX_BITS +#define POLARSSL_MPI_MAX_BITS_SCALE100 MBEDTLS_MPI_MAX_BITS_SCALE100 +#define POLARSSL_MPI_MAX_LIMBS MBEDTLS_MPI_MAX_LIMBS +#define POLARSSL_MPI_RW_BUFFER_SIZE MBEDTLS_MPI_RW_BUFFER_SIZE +#define POLARSSL_NET_H MBEDTLS_NET_SOCKETS_H +#define POLARSSL_NET_LISTEN_BACKLOG MBEDTLS_NET_LISTEN_BACKLOG +#define POLARSSL_OID_H MBEDTLS_OID_H +#define POLARSSL_OPERATION_NONE MBEDTLS_OPERATION_NONE +#define POLARSSL_PADDING_NONE MBEDTLS_PADDING_NONE +#define POLARSSL_PADDING_ONE_AND_ZEROS MBEDTLS_PADDING_ONE_AND_ZEROS +#define POLARSSL_PADDING_PKCS7 MBEDTLS_PADDING_PKCS7 +#define POLARSSL_PADDING_ZEROS MBEDTLS_PADDING_ZEROS +#define POLARSSL_PADDING_ZEROS_AND_LEN MBEDTLS_PADDING_ZEROS_AND_LEN +#define POLARSSL_PADLOCK_H MBEDTLS_PADLOCK_H +#define POLARSSL_PEM_H MBEDTLS_PEM_H +#define POLARSSL_PKCS11_H MBEDTLS_PKCS11_H +#define POLARSSL_PKCS12_H MBEDTLS_PKCS12_H +#define POLARSSL_PKCS5_H MBEDTLS_PKCS5_H +#define POLARSSL_PK_DEBUG_ECP MBEDTLS_PK_DEBUG_ECP +#define POLARSSL_PK_DEBUG_MAX_ITEMS MBEDTLS_PK_DEBUG_MAX_ITEMS +#define POLARSSL_PK_DEBUG_MPI MBEDTLS_PK_DEBUG_MPI +#define POLARSSL_PK_DEBUG_NONE MBEDTLS_PK_DEBUG_NONE +#define POLARSSL_PK_ECDSA MBEDTLS_PK_ECDSA +#define POLARSSL_PK_ECKEY MBEDTLS_PK_ECKEY +#define POLARSSL_PK_ECKEY_DH MBEDTLS_PK_ECKEY_DH +#define POLARSSL_PK_H MBEDTLS_PK_H +#define POLARSSL_PK_NONE MBEDTLS_PK_NONE +#define POLARSSL_PK_RSA MBEDTLS_PK_RSA +#define POLARSSL_PK_RSASSA_PSS MBEDTLS_PK_RSASSA_PSS +#define POLARSSL_PK_RSA_ALT MBEDTLS_PK_RSA_ALT +#define POLARSSL_PK_WRAP_H MBEDTLS_PK_WRAP_H +#define POLARSSL_PLATFORM_H MBEDTLS_PLATFORM_H +#define POLARSSL_PREMASTER_SIZE MBEDTLS_PREMASTER_SIZE +#define POLARSSL_RIPEMD160_H MBEDTLS_RIPEMD160_H +#define POLARSSL_RSA_H MBEDTLS_RSA_H +#define POLARSSL_SHA1_H MBEDTLS_SHA1_H +#define POLARSSL_SHA256_H MBEDTLS_SHA256_H +#define POLARSSL_SHA512_H MBEDTLS_SHA512_H +#define POLARSSL_SSL_CACHE_H MBEDTLS_SSL_CACHE_H +#define POLARSSL_SSL_CIPHERSUITES_H MBEDTLS_SSL_CIPHERSUITES_H +#define POLARSSL_SSL_COOKIE_H MBEDTLS_SSL_COOKIE_H +#define POLARSSL_SSL_H MBEDTLS_SSL_H +#define POLARSSL_THREADING_H MBEDTLS_THREADING_H +#define POLARSSL_THREADING_IMPL MBEDTLS_THREADING_IMPL +#define POLARSSL_TIMING_H MBEDTLS_TIMING_H +#define POLARSSL_VERSION_H MBEDTLS_VERSION_H +#define POLARSSL_VERSION_MAJOR MBEDTLS_VERSION_MAJOR +#define POLARSSL_VERSION_MINOR MBEDTLS_VERSION_MINOR +#define POLARSSL_VERSION_NUMBER MBEDTLS_VERSION_NUMBER +#define POLARSSL_VERSION_PATCH MBEDTLS_VERSION_PATCH +#define POLARSSL_VERSION_STRING MBEDTLS_VERSION_STRING +#define POLARSSL_VERSION_STRING_FULL MBEDTLS_VERSION_STRING_FULL +#define POLARSSL_X509_CRL_H MBEDTLS_X509_CRL_H +#define POLARSSL_X509_CRT_H MBEDTLS_X509_CRT_H +#define POLARSSL_X509_CSR_H MBEDTLS_X509_CSR_H +#define POLARSSL_X509_H MBEDTLS_X509_H +#define POLARSSL_XTEA_H MBEDTLS_XTEA_H +#define RSA_CRYPT MBEDTLS_RSA_CRYPT +#define RSA_PKCS_V15 MBEDTLS_RSA_PKCS_V15 +#define RSA_PKCS_V21 MBEDTLS_RSA_PKCS_V21 +#define RSA_PRIVATE MBEDTLS_RSA_PRIVATE +#define RSA_PUBLIC MBEDTLS_RSA_PUBLIC +#define RSA_SALT_LEN_ANY MBEDTLS_RSA_SALT_LEN_ANY +#define RSA_SIGN MBEDTLS_RSA_SIGN +#define SSL_ALERT_LEVEL_FATAL MBEDTLS_SSL_ALERT_LEVEL_FATAL +#define SSL_ALERT_LEVEL_WARNING MBEDTLS_SSL_ALERT_LEVEL_WARNING +#define SSL_ALERT_MSG_ACCESS_DENIED MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED +#define SSL_ALERT_MSG_BAD_CERT MBEDTLS_SSL_ALERT_MSG_BAD_CERT +#define SSL_ALERT_MSG_BAD_RECORD_MAC MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC +#define SSL_ALERT_MSG_CERT_EXPIRED MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED +#define SSL_ALERT_MSG_CERT_REVOKED MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED +#define SSL_ALERT_MSG_CERT_UNKNOWN MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN +#define SSL_ALERT_MSG_CLOSE_NOTIFY MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY +#define SSL_ALERT_MSG_DECODE_ERROR MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR +#define SSL_ALERT_MSG_DECOMPRESSION_FAILURE MBEDTLS_SSL_ALERT_MSG_DECOMPRESSION_FAILURE +#define SSL_ALERT_MSG_DECRYPTION_FAILED MBEDTLS_SSL_ALERT_MSG_DECRYPTION_FAILED +#define SSL_ALERT_MSG_DECRYPT_ERROR MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR +#define SSL_ALERT_MSG_EXPORT_RESTRICTION MBEDTLS_SSL_ALERT_MSG_EXPORT_RESTRICTION +#define SSL_ALERT_MSG_HANDSHAKE_FAILURE MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE +#define SSL_ALERT_MSG_ILLEGAL_PARAMETER MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER +#define SSL_ALERT_MSG_INAPROPRIATE_FALLBACK MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK +#define SSL_ALERT_MSG_INSUFFICIENT_SECURITY MBEDTLS_SSL_ALERT_MSG_INSUFFICIENT_SECURITY +#define SSL_ALERT_MSG_INTERNAL_ERROR MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR +#define SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL +#define SSL_ALERT_MSG_NO_CERT MBEDTLS_SSL_ALERT_MSG_NO_CERT +#define SSL_ALERT_MSG_NO_RENEGOTIATION MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION +#define SSL_ALERT_MSG_PROTOCOL_VERSION MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION +#define SSL_ALERT_MSG_RECORD_OVERFLOW MBEDTLS_SSL_ALERT_MSG_RECORD_OVERFLOW +#define SSL_ALERT_MSG_UNEXPECTED_MESSAGE MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE +#define SSL_ALERT_MSG_UNKNOWN_CA MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA +#define SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY +#define SSL_ALERT_MSG_UNRECOGNIZED_NAME MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME +#define SSL_ALERT_MSG_UNSUPPORTED_CERT MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT +#define SSL_ALERT_MSG_UNSUPPORTED_EXT MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT +#define SSL_ALERT_MSG_USER_CANCELED MBEDTLS_SSL_ALERT_MSG_USER_CANCELED +#define SSL_ANTI_REPLAY_DISABLED MBEDTLS_SSL_ANTI_REPLAY_DISABLED +#define SSL_ANTI_REPLAY_ENABLED MBEDTLS_SSL_ANTI_REPLAY_ENABLED +#define SSL_ARC4_DISABLED MBEDTLS_SSL_ARC4_DISABLED +#define SSL_ARC4_ENABLED MBEDTLS_SSL_ARC4_ENABLED +#define SSL_BUFFER_LEN ( ( ( MBEDTLS_SSL_IN_BUFFER_LEN ) < ( MBEDTLS_SSL_OUT_BUFFER_LEN ) ) \ + ? ( MBEDTLS_SSL_IN_BUFFER_LEN ) : ( MBEDTLS_SSL_OUT_BUFFER_LEN ) ) +#define SSL_CACHE_DEFAULT_MAX_ENTRIES MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES +#define SSL_CACHE_DEFAULT_TIMEOUT MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT +#define SSL_CBC_RECORD_SPLITTING_DISABLED MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED +#define SSL_CBC_RECORD_SPLITTING_ENABLED MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED +#define SSL_CERTIFICATE_REQUEST MBEDTLS_SSL_CERTIFICATE_REQUEST +#define SSL_CERTIFICATE_VERIFY MBEDTLS_SSL_CERTIFICATE_VERIFY +#define SSL_CERT_TYPE_ECDSA_SIGN MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN +#define SSL_CERT_TYPE_RSA_SIGN MBEDTLS_SSL_CERT_TYPE_RSA_SIGN +#define SSL_CHANNEL_INBOUND MBEDTLS_SSL_CHANNEL_INBOUND +#define SSL_CHANNEL_OUTBOUND MBEDTLS_SSL_CHANNEL_OUTBOUND +#define SSL_CIPHERSUITES MBEDTLS_SSL_CIPHERSUITES +#define SSL_CLIENT_CERTIFICATE MBEDTLS_SSL_CLIENT_CERTIFICATE +#define SSL_CLIENT_CHANGE_CIPHER_SPEC MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC +#define SSL_CLIENT_FINISHED MBEDTLS_SSL_CLIENT_FINISHED +#define SSL_CLIENT_HELLO MBEDTLS_SSL_CLIENT_HELLO +#define SSL_CLIENT_KEY_EXCHANGE MBEDTLS_SSL_CLIENT_KEY_EXCHANGE +#define SSL_COMPRESSION_ADD MBEDTLS_SSL_COMPRESSION_ADD +#define SSL_COMPRESS_DEFLATE MBEDTLS_SSL_COMPRESS_DEFLATE +#define SSL_COMPRESS_NULL MBEDTLS_SSL_COMPRESS_NULL +#define SSL_DEBUG_BUF MBEDTLS_SSL_DEBUG_BUF +#define SSL_DEBUG_CRT MBEDTLS_SSL_DEBUG_CRT +#define SSL_DEBUG_ECP MBEDTLS_SSL_DEBUG_ECP +#define SSL_DEBUG_MPI MBEDTLS_SSL_DEBUG_MPI +#define SSL_DEBUG_MSG MBEDTLS_SSL_DEBUG_MSG +#define SSL_DEBUG_RET MBEDTLS_SSL_DEBUG_RET +#define SSL_DEFAULT_TICKET_LIFETIME MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME +#define SSL_DTLS_TIMEOUT_DFL_MAX MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX +#define SSL_DTLS_TIMEOUT_DFL_MIN MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN +#define SSL_EMPTY_RENEGOTIATION_INFO MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO +#define SSL_ETM_DISABLED MBEDTLS_SSL_ETM_DISABLED +#define SSL_ETM_ENABLED MBEDTLS_SSL_ETM_ENABLED +#define SSL_EXTENDED_MS_DISABLED MBEDTLS_SSL_EXTENDED_MS_DISABLED +#define SSL_EXTENDED_MS_ENABLED MBEDTLS_SSL_EXTENDED_MS_ENABLED +#define SSL_FALLBACK_SCSV MBEDTLS_SSL_FALLBACK_SCSV +#define SSL_FLUSH_BUFFERS MBEDTLS_SSL_FLUSH_BUFFERS +#define SSL_HANDSHAKE_OVER MBEDTLS_SSL_HANDSHAKE_OVER +#define SSL_HANDSHAKE_WRAPUP MBEDTLS_SSL_HANDSHAKE_WRAPUP +#define SSL_HASH_MD5 MBEDTLS_SSL_HASH_MD5 +#define SSL_HASH_NONE MBEDTLS_SSL_HASH_NONE +#define SSL_HASH_SHA1 MBEDTLS_SSL_HASH_SHA1 +#define SSL_HASH_SHA224 MBEDTLS_SSL_HASH_SHA224 +#define SSL_HASH_SHA256 MBEDTLS_SSL_HASH_SHA256 +#define SSL_HASH_SHA384 MBEDTLS_SSL_HASH_SHA384 +#define SSL_HASH_SHA512 MBEDTLS_SSL_HASH_SHA512 +#define SSL_HELLO_REQUEST MBEDTLS_SSL_HELLO_REQUEST +#define SSL_HS_CERTIFICATE MBEDTLS_SSL_HS_CERTIFICATE +#define SSL_HS_CERTIFICATE_REQUEST MBEDTLS_SSL_HS_CERTIFICATE_REQUEST +#define SSL_HS_CERTIFICATE_VERIFY MBEDTLS_SSL_HS_CERTIFICATE_VERIFY +#define SSL_HS_CLIENT_HELLO MBEDTLS_SSL_HS_CLIENT_HELLO +#define SSL_HS_CLIENT_KEY_EXCHANGE MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE +#define SSL_HS_FINISHED MBEDTLS_SSL_HS_FINISHED +#define SSL_HS_HELLO_REQUEST MBEDTLS_SSL_HS_HELLO_REQUEST +#define SSL_HS_HELLO_VERIFY_REQUEST MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST +#define SSL_HS_NEW_SESSION_TICKET MBEDTLS_SSL_HS_NEW_SESSION_TICKET +#define SSL_HS_SERVER_HELLO MBEDTLS_SSL_HS_SERVER_HELLO +#define SSL_HS_SERVER_HELLO_DONE MBEDTLS_SSL_HS_SERVER_HELLO_DONE +#define SSL_HS_SERVER_KEY_EXCHANGE MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE +#define SSL_INITIAL_HANDSHAKE MBEDTLS_SSL_INITIAL_HANDSHAKE +#define SSL_IS_CLIENT MBEDTLS_SSL_IS_CLIENT +#define SSL_IS_FALLBACK MBEDTLS_SSL_IS_FALLBACK +#define SSL_IS_NOT_FALLBACK MBEDTLS_SSL_IS_NOT_FALLBACK +#define SSL_IS_SERVER MBEDTLS_SSL_IS_SERVER +#define SSL_LEGACY_ALLOW_RENEGOTIATION MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION +#define SSL_LEGACY_BREAK_HANDSHAKE MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE +#define SSL_LEGACY_NO_RENEGOTIATION MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION +#define SSL_LEGACY_RENEGOTIATION MBEDTLS_SSL_LEGACY_RENEGOTIATION +#define SSL_MAC_ADD MBEDTLS_SSL_MAC_ADD +#define SSL_MAJOR_VERSION_3 MBEDTLS_SSL_MAJOR_VERSION_3 +#define SSL_MAX_CONTENT_LEN MBEDTLS_SSL_MAX_CONTENT_LEN +#define SSL_MAX_FRAG_LEN_1024 MBEDTLS_SSL_MAX_FRAG_LEN_1024 +#define SSL_MAX_FRAG_LEN_2048 MBEDTLS_SSL_MAX_FRAG_LEN_2048 +#define SSL_MAX_FRAG_LEN_4096 MBEDTLS_SSL_MAX_FRAG_LEN_4096 +#define SSL_MAX_FRAG_LEN_512 MBEDTLS_SSL_MAX_FRAG_LEN_512 +#define SSL_MAX_FRAG_LEN_INVALID MBEDTLS_SSL_MAX_FRAG_LEN_INVALID +#define SSL_MAX_FRAG_LEN_NONE MBEDTLS_SSL_MAX_FRAG_LEN_NONE +#define SSL_MAX_MAJOR_VERSION MBEDTLS_SSL_MAX_MAJOR_VERSION +#define SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MAX_MINOR_VERSION +#define SSL_MINOR_VERSION_0 MBEDTLS_SSL_MINOR_VERSION_0 +#define SSL_MINOR_VERSION_1 MBEDTLS_SSL_MINOR_VERSION_1 +#define SSL_MINOR_VERSION_2 MBEDTLS_SSL_MINOR_VERSION_2 +#define SSL_MINOR_VERSION_3 MBEDTLS_SSL_MINOR_VERSION_3 +#define SSL_MIN_MAJOR_VERSION MBEDTLS_SSL_MIN_MAJOR_VERSION +#define SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MIN_MINOR_VERSION +#define SSL_MSG_ALERT MBEDTLS_SSL_MSG_ALERT +#define SSL_MSG_APPLICATION_DATA MBEDTLS_SSL_MSG_APPLICATION_DATA +#define SSL_MSG_CHANGE_CIPHER_SPEC MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC +#define SSL_MSG_HANDSHAKE MBEDTLS_SSL_MSG_HANDSHAKE +#define SSL_PADDING_ADD MBEDTLS_SSL_PADDING_ADD +#define SSL_RENEGOTIATION MBEDTLS_SSL_RENEGOTIATION +#define SSL_RENEGOTIATION_DISABLED MBEDTLS_SSL_RENEGOTIATION_DISABLED +#define SSL_RENEGOTIATION_DONE MBEDTLS_SSL_RENEGOTIATION_DONE +#define SSL_RENEGOTIATION_ENABLED MBEDTLS_SSL_RENEGOTIATION_ENABLED +#define SSL_RENEGOTIATION_NOT_ENFORCED MBEDTLS_SSL_RENEGOTIATION_NOT_ENFORCED +#define SSL_RENEGOTIATION_PENDING MBEDTLS_SSL_RENEGOTIATION_PENDING +#define SSL_RENEGO_MAX_RECORDS_DEFAULT MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT +#define SSL_RETRANS_FINISHED MBEDTLS_SSL_RETRANS_FINISHED +#define SSL_RETRANS_PREPARING MBEDTLS_SSL_RETRANS_PREPARING +#define SSL_RETRANS_SENDING MBEDTLS_SSL_RETRANS_SENDING +#define SSL_RETRANS_WAITING MBEDTLS_SSL_RETRANS_WAITING +#define SSL_SECURE_RENEGOTIATION MBEDTLS_SSL_SECURE_RENEGOTIATION +#define SSL_SERVER_CERTIFICATE MBEDTLS_SSL_SERVER_CERTIFICATE +#define SSL_SERVER_CHANGE_CIPHER_SPEC MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC +#define SSL_SERVER_FINISHED MBEDTLS_SSL_SERVER_FINISHED +#define SSL_SERVER_HELLO MBEDTLS_SSL_SERVER_HELLO +#define SSL_SERVER_HELLO_DONE MBEDTLS_SSL_SERVER_HELLO_DONE +#define SSL_SERVER_HELLO_VERIFY_REQUEST_SENT MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT +#define SSL_SERVER_KEY_EXCHANGE MBEDTLS_SSL_SERVER_KEY_EXCHANGE +#define SSL_SERVER_NEW_SESSION_TICKET MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET +#define SSL_SESSION_TICKETS_DISABLED MBEDTLS_SSL_SESSION_TICKETS_DISABLED +#define SSL_SESSION_TICKETS_ENABLED MBEDTLS_SSL_SESSION_TICKETS_ENABLED +#define SSL_SIG_ANON MBEDTLS_SSL_SIG_ANON +#define SSL_SIG_ECDSA MBEDTLS_SSL_SIG_ECDSA +#define SSL_SIG_RSA MBEDTLS_SSL_SIG_RSA +#define SSL_TRANSPORT_DATAGRAM MBEDTLS_SSL_TRANSPORT_DATAGRAM +#define SSL_TRANSPORT_STREAM MBEDTLS_SSL_TRANSPORT_STREAM +#define SSL_TRUNCATED_HMAC_LEN MBEDTLS_SSL_TRUNCATED_HMAC_LEN +#define SSL_TRUNC_HMAC_DISABLED MBEDTLS_SSL_TRUNC_HMAC_DISABLED +#define SSL_TRUNC_HMAC_ENABLED MBEDTLS_SSL_TRUNC_HMAC_ENABLED +#define SSL_VERIFY_DATA_MAX_LEN MBEDTLS_SSL_VERIFY_DATA_MAX_LEN +#define SSL_VERIFY_NONE MBEDTLS_SSL_VERIFY_NONE +#define SSL_VERIFY_OPTIONAL MBEDTLS_SSL_VERIFY_OPTIONAL +#define SSL_VERIFY_REQUIRED MBEDTLS_SSL_VERIFY_REQUIRED +#define TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA +#define TLS_DHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA +#define TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 +#define TLS_DHE_PSK_WITH_AES_128_CCM MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM +#define TLS_DHE_PSK_WITH_AES_128_CCM_8 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM_8 +#define TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 +#define TLS_DHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA +#define TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 +#define TLS_DHE_PSK_WITH_AES_256_CCM MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM +#define TLS_DHE_PSK_WITH_AES_256_CCM_8 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM_8 +#define TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 +#define TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 +#define TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_DHE_PSK_WITH_NULL_SHA MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA +#define TLS_DHE_PSK_WITH_NULL_SHA256 MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256 +#define TLS_DHE_PSK_WITH_NULL_SHA384 MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384 +#define TLS_DHE_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA +#define TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA +#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA +#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 +#define TLS_DHE_RSA_WITH_AES_128_CCM MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM +#define TLS_DHE_RSA_WITH_AES_128_CCM_8 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM_8 +#define TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 +#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA +#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 +#define TLS_DHE_RSA_WITH_AES_256_CCM MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM +#define TLS_DHE_RSA_WITH_AES_256_CCM_8 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM_8 +#define TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 +#define TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA +#define TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA +#define TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 +#define TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_DHE_RSA_WITH_DES_CBC_SHA MBEDTLS_TLS_DHE_RSA_WITH_DES_CBC_SHA +#define TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA +#define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA +#define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 +#define TLS_ECDHE_ECDSA_WITH_AES_128_CCM MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM +#define TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 +#define TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 +#define TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA +#define TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 +#define TLS_ECDHE_ECDSA_WITH_AES_256_CCM MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM +#define TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 +#define TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 +#define TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 +#define TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_ECDHE_ECDSA_WITH_NULL_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA +#define TLS_ECDHE_ECDSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA +#define TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA +#define TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA +#define TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 +#define TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA +#define TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 +#define TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 +#define TLS_ECDHE_PSK_WITH_NULL_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA +#define TLS_ECDHE_PSK_WITH_NULL_SHA256 MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 +#define TLS_ECDHE_PSK_WITH_NULL_SHA384 MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 +#define TLS_ECDHE_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA +#define TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA +#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA +#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 +#define TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 +#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA +#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 +#define TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 +#define TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 +#define TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_ECDHE_RSA_WITH_NULL_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA +#define TLS_ECDHE_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA +#define TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA +#define TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA +#define TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 +#define TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 +#define TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA +#define TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 +#define TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 +#define TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 +#define TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_ECDH_ECDSA_WITH_NULL_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA +#define TLS_ECDH_ECDSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA +#define TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA +#define TLS_ECDH_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA +#define TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 +#define TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 +#define TLS_ECDH_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA +#define TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 +#define TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 +#define TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 +#define TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_ECDH_RSA_WITH_NULL_SHA MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA +#define TLS_ECDH_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA +#define TLS_EXT_ALPN MBEDTLS_TLS_EXT_ALPN +#define TLS_EXT_ENCRYPT_THEN_MAC MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC +#define TLS_EXT_EXTENDED_MASTER_SECRET MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET +#define TLS_EXT_MAX_FRAGMENT_LENGTH MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH +#define TLS_EXT_RENEGOTIATION_INFO MBEDTLS_TLS_EXT_RENEGOTIATION_INFO +#define TLS_EXT_SERVERNAME MBEDTLS_TLS_EXT_SERVERNAME +#define TLS_EXT_SERVERNAME_HOSTNAME MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME +#define TLS_EXT_SESSION_TICKET MBEDTLS_TLS_EXT_SESSION_TICKET +#define TLS_EXT_SIG_ALG MBEDTLS_TLS_EXT_SIG_ALG +#define TLS_EXT_SUPPORTED_ELLIPTIC_CURVES MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES +#define TLS_EXT_SUPPORTED_POINT_FORMATS MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS +#define TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT +#define TLS_EXT_TRUNCATED_HMAC MBEDTLS_TLS_EXT_TRUNCATED_HMAC +#define TLS_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA +#define TLS_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA +#define TLS_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 +#define TLS_PSK_WITH_AES_128_CCM MBEDTLS_TLS_PSK_WITH_AES_128_CCM +#define TLS_PSK_WITH_AES_128_CCM_8 MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8 +#define TLS_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 +#define TLS_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA +#define TLS_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 +#define TLS_PSK_WITH_AES_256_CCM MBEDTLS_TLS_PSK_WITH_AES_256_CCM +#define TLS_PSK_WITH_AES_256_CCM_8 MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8 +#define TLS_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 +#define TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 +#define TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_PSK_WITH_NULL_SHA MBEDTLS_TLS_PSK_WITH_NULL_SHA +#define TLS_PSK_WITH_NULL_SHA256 MBEDTLS_TLS_PSK_WITH_NULL_SHA256 +#define TLS_PSK_WITH_NULL_SHA384 MBEDTLS_TLS_PSK_WITH_NULL_SHA384 +#define TLS_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_PSK_WITH_RC4_128_SHA +#define TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA +#define TLS_RSA_PSK_WITH_AES_128_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA +#define TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 +#define TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 +#define TLS_RSA_PSK_WITH_AES_256_CBC_SHA MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA +#define TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 +#define TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 +#define TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 +#define TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_RSA_PSK_WITH_NULL_SHA MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA +#define TLS_RSA_PSK_WITH_NULL_SHA256 MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256 +#define TLS_RSA_PSK_WITH_NULL_SHA384 MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384 +#define TLS_RSA_PSK_WITH_RC4_128_SHA MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA +#define TLS_RSA_WITH_3DES_EDE_CBC_SHA MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA +#define TLS_RSA_WITH_AES_128_CBC_SHA MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA +#define TLS_RSA_WITH_AES_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 +#define TLS_RSA_WITH_AES_128_CCM MBEDTLS_TLS_RSA_WITH_AES_128_CCM +#define TLS_RSA_WITH_AES_128_CCM_8 MBEDTLS_TLS_RSA_WITH_AES_128_CCM_8 +#define TLS_RSA_WITH_AES_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 +#define TLS_RSA_WITH_AES_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA +#define TLS_RSA_WITH_AES_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 +#define TLS_RSA_WITH_AES_256_CCM MBEDTLS_TLS_RSA_WITH_AES_256_CCM +#define TLS_RSA_WITH_AES_256_CCM_8 MBEDTLS_TLS_RSA_WITH_AES_256_CCM_8 +#define TLS_RSA_WITH_AES_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 +#define TLS_RSA_WITH_CAMELLIA_128_CBC_SHA MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA +#define TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 +#define TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 +#define TLS_RSA_WITH_CAMELLIA_256_CBC_SHA MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA +#define TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 +#define TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 +#define TLS_RSA_WITH_DES_CBC_SHA MBEDTLS_TLS_RSA_WITH_DES_CBC_SHA +#define TLS_RSA_WITH_NULL_MD5 MBEDTLS_TLS_RSA_WITH_NULL_MD5 +#define TLS_RSA_WITH_NULL_SHA MBEDTLS_TLS_RSA_WITH_NULL_SHA +#define TLS_RSA_WITH_NULL_SHA256 MBEDTLS_TLS_RSA_WITH_NULL_SHA256 +#define TLS_RSA_WITH_RC4_128_MD5 MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 +#define TLS_RSA_WITH_RC4_128_SHA MBEDTLS_TLS_RSA_WITH_RC4_128_SHA +#define X509_CRT_VERSION_1 MBEDTLS_X509_CRT_VERSION_1 +#define X509_CRT_VERSION_2 MBEDTLS_X509_CRT_VERSION_2 +#define X509_CRT_VERSION_3 MBEDTLS_X509_CRT_VERSION_3 +#define X509_FORMAT_DER MBEDTLS_X509_FORMAT_DER +#define X509_FORMAT_PEM MBEDTLS_X509_FORMAT_PEM +#define X509_MAX_DN_NAME_SIZE MBEDTLS_X509_MAX_DN_NAME_SIZE +#define X509_RFC5280_MAX_SERIAL_LEN MBEDTLS_X509_RFC5280_MAX_SERIAL_LEN +#define X509_RFC5280_UTC_TIME_LEN MBEDTLS_X509_RFC5280_UTC_TIME_LEN +#define XTEA_DECRYPT MBEDTLS_XTEA_DECRYPT +#define XTEA_ENCRYPT MBEDTLS_XTEA_ENCRYPT +#define _asn1_bitstring mbedtls_asn1_bitstring +#define _asn1_buf mbedtls_asn1_buf +#define _asn1_named_data mbedtls_asn1_named_data +#define _asn1_sequence mbedtls_asn1_sequence +#define _ssl_cache_context mbedtls_ssl_cache_context +#define _ssl_cache_entry mbedtls_ssl_cache_entry +#define _ssl_ciphersuite_t mbedtls_ssl_ciphersuite_t +#define _ssl_context mbedtls_ssl_context +#define _ssl_flight_item mbedtls_ssl_flight_item +#define _ssl_handshake_params mbedtls_ssl_handshake_params +#define _ssl_key_cert mbedtls_ssl_key_cert +#define _ssl_premaster_secret mbedtls_ssl_premaster_secret +#define _ssl_session mbedtls_ssl_session +#define _ssl_transform mbedtls_ssl_transform +#define _x509_crl mbedtls_x509_crl +#define _x509_crl_entry mbedtls_x509_crl_entry +#define _x509_crt mbedtls_x509_crt +#define _x509_csr mbedtls_x509_csr +#define _x509_time mbedtls_x509_time +#define _x509write_cert mbedtls_x509write_cert +#define _x509write_csr mbedtls_x509write_csr +#define aes_context mbedtls_aes_context +#define aes_crypt_cbc mbedtls_aes_crypt_cbc +#define aes_crypt_cfb128 mbedtls_aes_crypt_cfb128 +#define aes_crypt_cfb8 mbedtls_aes_crypt_cfb8 +#define aes_crypt_ctr mbedtls_aes_crypt_ctr +#define aes_crypt_ecb mbedtls_aes_crypt_ecb +#define aes_free mbedtls_aes_free +#define aes_init mbedtls_aes_init +#define aes_self_test mbedtls_aes_self_test +#define aes_setkey_dec mbedtls_aes_setkey_dec +#define aes_setkey_enc mbedtls_aes_setkey_enc +#define aesni_crypt_ecb mbedtls_aesni_crypt_ecb +#define aesni_gcm_mult mbedtls_aesni_gcm_mult +#define aesni_inverse_key mbedtls_aesni_inverse_key +#define aesni_setkey_enc mbedtls_aesni_setkey_enc +#define aesni_supports mbedtls_aesni_has_support +#define alarmed mbedtls_timing_alarmed +#define arc4_context mbedtls_arc4_context +#define arc4_crypt mbedtls_arc4_crypt +#define arc4_free mbedtls_arc4_free +#define arc4_init mbedtls_arc4_init +#define arc4_self_test mbedtls_arc4_self_test +#define arc4_setup mbedtls_arc4_setup +#define asn1_bitstring mbedtls_asn1_bitstring +#define asn1_buf mbedtls_asn1_buf +#define asn1_find_named_data mbedtls_asn1_find_named_data +#define asn1_free_named_data mbedtls_asn1_free_named_data +#define asn1_free_named_data_list mbedtls_asn1_free_named_data_list +#define asn1_get_alg mbedtls_asn1_get_alg +#define asn1_get_alg_null mbedtls_asn1_get_alg_null +#define asn1_get_bitstring mbedtls_asn1_get_bitstring +#define asn1_get_bitstring_null mbedtls_asn1_get_bitstring_null +#define asn1_get_bool mbedtls_asn1_get_bool +#define asn1_get_int mbedtls_asn1_get_int +#define asn1_get_len mbedtls_asn1_get_len +#define asn1_get_mpi mbedtls_asn1_get_mpi +#define asn1_get_sequence_of mbedtls_asn1_get_sequence_of +#define asn1_get_tag mbedtls_asn1_get_tag +#define asn1_named_data mbedtls_asn1_named_data +#define asn1_sequence mbedtls_asn1_sequence +#define asn1_store_named_data mbedtls_asn1_store_named_data +#define asn1_write_algorithm_identifier mbedtls_asn1_write_algorithm_identifier +#define asn1_write_bitstring mbedtls_asn1_write_bitstring +#define asn1_write_bool mbedtls_asn1_write_bool +#define asn1_write_ia5_string mbedtls_asn1_write_ia5_string +#define asn1_write_int mbedtls_asn1_write_int +#define asn1_write_len mbedtls_asn1_write_len +#define asn1_write_mpi mbedtls_asn1_write_mpi +#define asn1_write_null mbedtls_asn1_write_null +#define asn1_write_octet_string mbedtls_asn1_write_octet_string +#define asn1_write_oid mbedtls_asn1_write_oid +#define asn1_write_printable_string mbedtls_asn1_write_printable_string +#define asn1_write_raw_buffer mbedtls_asn1_write_raw_buffer +#define asn1_write_tag mbedtls_asn1_write_tag +#define base64_decode mbedtls_base64_decode +#define base64_encode mbedtls_base64_encode +#define base64_self_test mbedtls_base64_self_test +#define blowfish_context mbedtls_blowfish_context +#define blowfish_crypt_cbc mbedtls_blowfish_crypt_cbc +#define blowfish_crypt_cfb64 mbedtls_blowfish_crypt_cfb64 +#define blowfish_crypt_ctr mbedtls_blowfish_crypt_ctr +#define blowfish_crypt_ecb mbedtls_blowfish_crypt_ecb +#define blowfish_free mbedtls_blowfish_free +#define blowfish_init mbedtls_blowfish_init +#define blowfish_setkey mbedtls_blowfish_setkey +#define camellia_context mbedtls_camellia_context +#define camellia_crypt_cbc mbedtls_camellia_crypt_cbc +#define camellia_crypt_cfb128 mbedtls_camellia_crypt_cfb128 +#define camellia_crypt_ctr mbedtls_camellia_crypt_ctr +#define camellia_crypt_ecb mbedtls_camellia_crypt_ecb +#define camellia_free mbedtls_camellia_free +#define camellia_init mbedtls_camellia_init +#define camellia_self_test mbedtls_camellia_self_test +#define camellia_setkey_dec mbedtls_camellia_setkey_dec +#define camellia_setkey_enc mbedtls_camellia_setkey_enc +#define ccm_auth_decrypt mbedtls_ccm_auth_decrypt +#define ccm_context mbedtls_ccm_context +#define ccm_encrypt_and_tag mbedtls_ccm_encrypt_and_tag +#define ccm_free mbedtls_ccm_free +#define ccm_init mbedtls_ccm_init +#define ccm_self_test mbedtls_ccm_self_test +#define cipher_auth_decrypt mbedtls_cipher_auth_decrypt +#define cipher_auth_encrypt mbedtls_cipher_auth_encrypt +#define cipher_base_t mbedtls_cipher_base_t +#define cipher_check_tag mbedtls_cipher_check_tag +#define cipher_context_t mbedtls_cipher_context_t +#define cipher_crypt mbedtls_cipher_crypt +#define cipher_definition_t mbedtls_cipher_definition_t +#define cipher_definitions mbedtls_cipher_definitions +#define cipher_finish mbedtls_cipher_finish +#define cipher_free mbedtls_cipher_free +#define cipher_get_block_size mbedtls_cipher_get_block_size +#define cipher_get_cipher_mode mbedtls_cipher_get_cipher_mode +#define cipher_get_iv_size mbedtls_cipher_get_iv_size +#define cipher_get_key_size mbedtls_cipher_get_key_bitlen +#define cipher_get_name mbedtls_cipher_get_name +#define cipher_get_operation mbedtls_cipher_get_operation +#define cipher_get_type mbedtls_cipher_get_type +#define cipher_id_t mbedtls_cipher_id_t +#define cipher_info_from_string mbedtls_cipher_info_from_string +#define cipher_info_from_type mbedtls_cipher_info_from_type +#define cipher_info_from_values mbedtls_cipher_info_from_values +#define cipher_info_t mbedtls_cipher_info_t +#define cipher_init mbedtls_cipher_init +#define cipher_init_ctx mbedtls_cipher_setup +#define cipher_list mbedtls_cipher_list +#define cipher_mode_t mbedtls_cipher_mode_t +#define cipher_padding_t mbedtls_cipher_padding_t +#define cipher_reset mbedtls_cipher_reset +#define cipher_set_iv mbedtls_cipher_set_iv +#define cipher_set_padding_mode mbedtls_cipher_set_padding_mode +#define cipher_setkey mbedtls_cipher_setkey +#define cipher_type_t mbedtls_cipher_type_t +#define cipher_update mbedtls_cipher_update +#define cipher_update_ad mbedtls_cipher_update_ad +#define cipher_write_tag mbedtls_cipher_write_tag +#define ctr_drbg_context mbedtls_ctr_drbg_context +#define ctr_drbg_free mbedtls_ctr_drbg_free +#define ctr_drbg_init mbedtls_ctr_drbg_init +#define ctr_drbg_random mbedtls_ctr_drbg_random +#define ctr_drbg_random_with_add mbedtls_ctr_drbg_random_with_add +#define ctr_drbg_reseed mbedtls_ctr_drbg_reseed +#define ctr_drbg_self_test mbedtls_ctr_drbg_self_test +#define ctr_drbg_set_entropy_len mbedtls_ctr_drbg_set_entropy_len +#define ctr_drbg_set_prediction_resistance mbedtls_ctr_drbg_set_prediction_resistance +#define ctr_drbg_set_reseed_interval mbedtls_ctr_drbg_set_reseed_interval +#define ctr_drbg_update mbedtls_ctr_drbg_update +#define ctr_drbg_update_seed_file mbedtls_ctr_drbg_update_seed_file +#define ctr_drbg_write_seed_file mbedtls_ctr_drbg_write_seed_file +#define debug_print_buf mbedtls_debug_print_buf +#define debug_print_crt mbedtls_debug_print_crt +#define debug_print_ecp mbedtls_debug_print_ecp +#define debug_print_mpi mbedtls_debug_print_mpi +#define debug_print_msg mbedtls_debug_print_msg +#define debug_print_ret mbedtls_debug_print_ret +#define debug_set_threshold mbedtls_debug_set_threshold +#define des3_context mbedtls_des3_context +#define des3_crypt_cbc mbedtls_des3_crypt_cbc +#define des3_crypt_ecb mbedtls_des3_crypt_ecb +#define des3_free mbedtls_des3_free +#define des3_init mbedtls_des3_init +#define des3_set2key_dec mbedtls_des3_set2key_dec +#define des3_set2key_enc mbedtls_des3_set2key_enc +#define des3_set3key_dec mbedtls_des3_set3key_dec +#define des3_set3key_enc mbedtls_des3_set3key_enc +#define des_context mbedtls_des_context +#define des_crypt_cbc mbedtls_des_crypt_cbc +#define des_crypt_ecb mbedtls_des_crypt_ecb +#define des_free mbedtls_des_free +#define des_init mbedtls_des_init +#define des_key_check_key_parity mbedtls_des_key_check_key_parity +#define des_key_check_weak mbedtls_des_key_check_weak +#define des_key_set_parity mbedtls_des_key_set_parity +#define des_self_test mbedtls_des_self_test +#define des_setkey_dec mbedtls_des_setkey_dec +#define des_setkey_enc mbedtls_des_setkey_enc +#define dhm_calc_secret mbedtls_dhm_calc_secret +#define dhm_context mbedtls_dhm_context +#define dhm_free mbedtls_dhm_free +#define dhm_init mbedtls_dhm_init +#define dhm_make_params mbedtls_dhm_make_params +#define dhm_make_public mbedtls_dhm_make_public +#define dhm_parse_dhm mbedtls_dhm_parse_dhm +#define dhm_parse_dhmfile mbedtls_dhm_parse_dhmfile +#define dhm_read_params mbedtls_dhm_read_params +#define dhm_read_public mbedtls_dhm_read_public +#define dhm_self_test mbedtls_dhm_self_test +#define ecdh_calc_secret mbedtls_ecdh_calc_secret +#define ecdh_compute_shared mbedtls_ecdh_compute_shared +#define ecdh_context mbedtls_ecdh_context +#define ecdh_free mbedtls_ecdh_free +#define ecdh_gen_public mbedtls_ecdh_gen_public +#define ecdh_get_params mbedtls_ecdh_get_params +#define ecdh_init mbedtls_ecdh_init +#define ecdh_make_params mbedtls_ecdh_make_params +#define ecdh_make_public mbedtls_ecdh_make_public +#define ecdh_read_params mbedtls_ecdh_read_params +#define ecdh_read_public mbedtls_ecdh_read_public +#define ecdh_side mbedtls_ecdh_side +#define ecdsa_context mbedtls_ecdsa_context +#define ecdsa_free mbedtls_ecdsa_free +#define ecdsa_from_keypair mbedtls_ecdsa_from_keypair +#define ecdsa_genkey mbedtls_ecdsa_genkey +#define ecdsa_info mbedtls_ecdsa_info +#define ecdsa_init mbedtls_ecdsa_init +#define ecdsa_read_signature mbedtls_ecdsa_read_signature +#define ecdsa_sign mbedtls_ecdsa_sign +#define ecdsa_sign_det mbedtls_ecdsa_sign_det +#define ecdsa_verify mbedtls_ecdsa_verify +#define ecdsa_write_signature mbedtls_ecdsa_write_signature +#define ecdsa_write_signature_det mbedtls_ecdsa_write_signature_det +#define eckey_info mbedtls_eckey_info +#define eckeydh_info mbedtls_eckeydh_info +#define ecp_check_privkey mbedtls_ecp_check_privkey +#define ecp_check_pub_priv mbedtls_ecp_check_pub_priv +#define ecp_check_pubkey mbedtls_ecp_check_pubkey +#define ecp_copy mbedtls_ecp_copy +#define ecp_curve_info mbedtls_ecp_curve_info +#define ecp_curve_info_from_grp_id mbedtls_ecp_curve_info_from_grp_id +#define ecp_curve_info_from_name mbedtls_ecp_curve_info_from_name +#define ecp_curve_info_from_tls_id mbedtls_ecp_curve_info_from_tls_id +#define ecp_curve_list mbedtls_ecp_curve_list +#define ecp_gen_key mbedtls_ecp_gen_key +#define ecp_gen_keypair mbedtls_ecp_gen_keypair +#define ecp_group mbedtls_ecp_group +#define ecp_group_copy mbedtls_ecp_group_copy +#define ecp_group_free mbedtls_ecp_group_free +#define ecp_group_id mbedtls_ecp_group_id +#define ecp_group_init mbedtls_ecp_group_init +#define ecp_grp_id_list mbedtls_ecp_grp_id_list +#define ecp_is_zero mbedtls_ecp_is_zero +#define ecp_keypair mbedtls_ecp_keypair +#define ecp_keypair_free mbedtls_ecp_keypair_free +#define ecp_keypair_init mbedtls_ecp_keypair_init +#define ecp_mul mbedtls_ecp_mul +#define ecp_point mbedtls_ecp_point +#define ecp_point_free mbedtls_ecp_point_free +#define ecp_point_init mbedtls_ecp_point_init +#define ecp_point_read_binary mbedtls_ecp_point_read_binary +#define ecp_point_read_string mbedtls_ecp_point_read_string +#define ecp_point_write_binary mbedtls_ecp_point_write_binary +#define ecp_self_test mbedtls_ecp_self_test +#define ecp_set_zero mbedtls_ecp_set_zero +#define ecp_tls_read_group mbedtls_ecp_tls_read_group +#define ecp_tls_read_point mbedtls_ecp_tls_read_point +#define ecp_tls_write_group mbedtls_ecp_tls_write_group +#define ecp_tls_write_point mbedtls_ecp_tls_write_point +#define ecp_use_known_dp mbedtls_ecp_group_load +#define entropy_add_source mbedtls_entropy_add_source +#define entropy_context mbedtls_entropy_context +#define entropy_free mbedtls_entropy_free +#define entropy_func mbedtls_entropy_func +#define entropy_gather mbedtls_entropy_gather +#define entropy_init mbedtls_entropy_init +#define entropy_self_test mbedtls_entropy_self_test +#define entropy_update_manual mbedtls_entropy_update_manual +#define entropy_update_seed_file mbedtls_entropy_update_seed_file +#define entropy_write_seed_file mbedtls_entropy_write_seed_file +#define error_strerror mbedtls_strerror +#define f_source_ptr mbedtls_entropy_f_source_ptr +#define gcm_auth_decrypt mbedtls_gcm_auth_decrypt +#define gcm_context mbedtls_gcm_context +#define gcm_crypt_and_tag mbedtls_gcm_crypt_and_tag +#define gcm_finish mbedtls_gcm_finish +#define gcm_free mbedtls_gcm_free +#define gcm_init mbedtls_gcm_init +#define gcm_self_test mbedtls_gcm_self_test +#define gcm_starts mbedtls_gcm_starts +#define gcm_update mbedtls_gcm_update +#define get_timer mbedtls_timing_get_timer +#define hardclock mbedtls_timing_hardclock +#define hardclock_poll mbedtls_hardclock_poll +#define havege_free mbedtls_havege_free +#define havege_init mbedtls_havege_init +#define havege_poll mbedtls_havege_poll +#define havege_random mbedtls_havege_random +#define havege_state mbedtls_havege_state +#define hmac_drbg_context mbedtls_hmac_drbg_context +#define hmac_drbg_free mbedtls_hmac_drbg_free +#define hmac_drbg_init mbedtls_hmac_drbg_init +#define hmac_drbg_random mbedtls_hmac_drbg_random +#define hmac_drbg_random_with_add mbedtls_hmac_drbg_random_with_add +#define hmac_drbg_reseed mbedtls_hmac_drbg_reseed +#define hmac_drbg_self_test mbedtls_hmac_drbg_self_test +#define hmac_drbg_set_entropy_len mbedtls_hmac_drbg_set_entropy_len +#define hmac_drbg_set_prediction_resistance mbedtls_hmac_drbg_set_prediction_resistance +#define hmac_drbg_set_reseed_interval mbedtls_hmac_drbg_set_reseed_interval +#define hmac_drbg_update mbedtls_hmac_drbg_update +#define hmac_drbg_update_seed_file mbedtls_hmac_drbg_update_seed_file +#define hmac_drbg_write_seed_file mbedtls_hmac_drbg_write_seed_file +#define hr_time mbedtls_timing_hr_time +#define key_exchange_type_t mbedtls_key_exchange_type_t +#define md mbedtls_md +#define md2 mbedtls_md2 +#define md2_context mbedtls_md2_context +#define md2_finish mbedtls_md2_finish +#define md2_free mbedtls_md2_free +#define md2_info mbedtls_md2_info +#define md2_init mbedtls_md2_init +#define md2_process mbedtls_md2_process +#define md2_self_test mbedtls_md2_self_test +#define md2_starts mbedtls_md2_starts +#define md2_update mbedtls_md2_update +#define md4 mbedtls_md4 +#define md4_context mbedtls_md4_context +#define md4_finish mbedtls_md4_finish +#define md4_free mbedtls_md4_free +#define md4_info mbedtls_md4_info +#define md4_init mbedtls_md4_init +#define md4_process mbedtls_md4_process +#define md4_self_test mbedtls_md4_self_test +#define md4_starts mbedtls_md4_starts +#define md4_update mbedtls_md4_update +#define md5 mbedtls_md5 +#define md5_context mbedtls_md5_context +#define md5_finish mbedtls_md5_finish +#define md5_free mbedtls_md5_free +#define md5_info mbedtls_md5_info +#define md5_init mbedtls_md5_init +#define md5_process mbedtls_md5_process +#define md5_self_test mbedtls_md5_self_test +#define md5_starts mbedtls_md5_starts +#define md5_update mbedtls_md5_update +#define md_context_t mbedtls_md_context_t +#define md_file mbedtls_md_file +#define md_finish mbedtls_md_finish +#define md_free mbedtls_md_free +#define md_get_name mbedtls_md_get_name +#define md_get_size mbedtls_md_get_size +#define md_get_type mbedtls_md_get_type +#define md_hmac mbedtls_md_hmac +#define md_hmac_finish mbedtls_md_hmac_finish +#define md_hmac_reset mbedtls_md_hmac_reset +#define md_hmac_starts mbedtls_md_hmac_starts +#define md_hmac_update mbedtls_md_hmac_update +#define md_info_from_string mbedtls_md_info_from_string +#define md_info_from_type mbedtls_md_info_from_type +#define md_info_t mbedtls_md_info_t +#define md_init mbedtls_md_init +#define md_init_ctx mbedtls_md_init_ctx +#define md_list mbedtls_md_list +#define md_process mbedtls_md_process +#define md_starts mbedtls_md_starts +#define md_type_t mbedtls_md_type_t +#define md_update mbedtls_md_update +#define memory_buffer_alloc_cur_get mbedtls_memory_buffer_alloc_cur_get +#define memory_buffer_alloc_free mbedtls_memory_buffer_alloc_free +#define memory_buffer_alloc_init mbedtls_memory_buffer_alloc_init +#define memory_buffer_alloc_max_get mbedtls_memory_buffer_alloc_max_get +#define memory_buffer_alloc_max_reset mbedtls_memory_buffer_alloc_max_reset +#define memory_buffer_alloc_self_test mbedtls_memory_buffer_alloc_self_test +#define memory_buffer_alloc_status mbedtls_memory_buffer_alloc_status +#define memory_buffer_alloc_verify mbedtls_memory_buffer_alloc_verify +#define memory_buffer_set_verify mbedtls_memory_buffer_set_verify +#define mpi mbedtls_mpi +#define mpi_add_abs mbedtls_mpi_add_abs +#define mpi_add_int mbedtls_mpi_add_int +#define mpi_add_mpi mbedtls_mpi_add_mpi +#define mpi_cmp_abs mbedtls_mpi_cmp_abs +#define mpi_cmp_int mbedtls_mpi_cmp_int +#define mpi_cmp_mpi mbedtls_mpi_cmp_mpi +#define mpi_copy mbedtls_mpi_copy +#define mpi_div_int mbedtls_mpi_div_int +#define mpi_div_mpi mbedtls_mpi_div_mpi +#define mpi_exp_mod mbedtls_mpi_exp_mod +#define mpi_fill_random mbedtls_mpi_fill_random +#define mpi_free mbedtls_mpi_free +#define mpi_gcd mbedtls_mpi_gcd +#define mpi_gen_prime mbedtls_mpi_gen_prime +#define mpi_get_bit mbedtls_mpi_get_bit +#define mpi_grow mbedtls_mpi_grow +#define mpi_init mbedtls_mpi_init +#define mpi_inv_mod mbedtls_mpi_inv_mod +#define mpi_is_prime mbedtls_mpi_is_prime +#define mpi_lsb mbedtls_mpi_lsb +#define mpi_lset mbedtls_mpi_lset +#define mpi_mod_int mbedtls_mpi_mod_int +#define mpi_mod_mpi mbedtls_mpi_mod_mpi +#define mpi_msb mbedtls_mpi_bitlen +#define mpi_mul_int mbedtls_mpi_mul_int +#define mpi_mul_mpi mbedtls_mpi_mul_mpi +#define mpi_read_binary mbedtls_mpi_read_binary +#define mpi_read_file mbedtls_mpi_read_file +#define mpi_read_string mbedtls_mpi_read_string +#define mpi_safe_cond_assign mbedtls_mpi_safe_cond_assign +#define mpi_safe_cond_swap mbedtls_mpi_safe_cond_swap +#define mpi_self_test mbedtls_mpi_self_test +#define mpi_set_bit mbedtls_mpi_set_bit +#define mpi_shift_l mbedtls_mpi_shift_l +#define mpi_shift_r mbedtls_mpi_shift_r +#define mpi_shrink mbedtls_mpi_shrink +#define mpi_size mbedtls_mpi_size +#define mpi_sub_abs mbedtls_mpi_sub_abs +#define mpi_sub_int mbedtls_mpi_sub_int +#define mpi_sub_mpi mbedtls_mpi_sub_mpi +#define mpi_swap mbedtls_mpi_swap +#define mpi_write_binary mbedtls_mpi_write_binary +#define mpi_write_file mbedtls_mpi_write_file +#define mpi_write_string mbedtls_mpi_write_string +#define net_accept mbedtls_net_accept +#define net_bind mbedtls_net_bind +#define net_close mbedtls_net_free +#define net_connect mbedtls_net_connect +#define net_recv mbedtls_net_recv +#define net_recv_timeout mbedtls_net_recv_timeout +#define net_send mbedtls_net_send +#define net_set_block mbedtls_net_set_block +#define net_set_nonblock mbedtls_net_set_nonblock +#define net_usleep mbedtls_net_usleep +#define oid_descriptor_t mbedtls_oid_descriptor_t +#define oid_get_attr_short_name mbedtls_oid_get_attr_short_name +#define oid_get_cipher_alg mbedtls_oid_get_cipher_alg +#define oid_get_ec_grp mbedtls_oid_get_ec_grp +#define oid_get_extended_key_usage mbedtls_oid_get_extended_key_usage +#define oid_get_md_alg mbedtls_oid_get_md_alg +#define oid_get_numeric_string mbedtls_oid_get_numeric_string +#define oid_get_oid_by_ec_grp mbedtls_oid_get_oid_by_ec_grp +#define oid_get_oid_by_md mbedtls_oid_get_oid_by_md +#define oid_get_oid_by_pk_alg mbedtls_oid_get_oid_by_pk_alg +#define oid_get_oid_by_sig_alg mbedtls_oid_get_oid_by_sig_alg +#define oid_get_pk_alg mbedtls_oid_get_pk_alg +#define oid_get_pkcs12_pbe_alg mbedtls_oid_get_pkcs12_pbe_alg +#define oid_get_sig_alg mbedtls_oid_get_sig_alg +#define oid_get_sig_alg_desc mbedtls_oid_get_sig_alg_desc +#define oid_get_x509_ext_type mbedtls_oid_get_x509_ext_type +#define operation_t mbedtls_operation_t +#define padlock_supports mbedtls_padlock_has_support +#define padlock_xcryptcbc mbedtls_padlock_xcryptcbc +#define padlock_xcryptecb mbedtls_padlock_xcryptecb +#define pem_context mbedtls_pem_context +#define pem_free mbedtls_pem_free +#define pem_init mbedtls_pem_init +#define pem_read_buffer mbedtls_pem_read_buffer +#define pem_write_buffer mbedtls_pem_write_buffer +#define pk_can_do mbedtls_pk_can_do +#define pk_check_pair mbedtls_pk_check_pair +#define pk_context mbedtls_pk_context +#define pk_debug mbedtls_pk_debug +#define pk_debug_item mbedtls_pk_debug_item +#define pk_debug_type mbedtls_pk_debug_type +#define pk_decrypt mbedtls_pk_decrypt +#define pk_ec mbedtls_pk_ec +#define pk_encrypt mbedtls_pk_encrypt +#define pk_free mbedtls_pk_free +#define pk_get_len mbedtls_pk_get_len +#define pk_get_name mbedtls_pk_get_name +#define pk_get_size mbedtls_pk_get_bitlen +#define pk_get_type mbedtls_pk_get_type +#define pk_info_from_type mbedtls_pk_info_from_type +#define pk_info_t mbedtls_pk_info_t +#define pk_init mbedtls_pk_init +#define pk_init_ctx mbedtls_pk_setup +#define pk_init_ctx_rsa_alt mbedtls_pk_setup_rsa_alt +#define pk_load_file mbedtls_pk_load_file +#define pk_parse_key mbedtls_pk_parse_key +#define pk_parse_keyfile mbedtls_pk_parse_keyfile +#define pk_parse_public_key mbedtls_pk_parse_public_key +#define pk_parse_public_keyfile mbedtls_pk_parse_public_keyfile +#define pk_parse_subpubkey mbedtls_pk_parse_subpubkey +#define pk_rsa mbedtls_pk_rsa +#define pk_rsa_alt_decrypt_func mbedtls_pk_rsa_alt_decrypt_func +#define pk_rsa_alt_key_len_func mbedtls_pk_rsa_alt_key_len_func +#define pk_rsa_alt_sign_func mbedtls_pk_rsa_alt_sign_func +#define pk_rsassa_pss_options mbedtls_pk_rsassa_pss_options +#define pk_sign mbedtls_pk_sign +#define pk_type_t mbedtls_pk_type_t +#define pk_verify mbedtls_pk_verify +#define pk_verify_ext mbedtls_pk_verify_ext +#define pk_write_key_der mbedtls_pk_write_key_der +#define pk_write_key_pem mbedtls_pk_write_key_pem +#define pk_write_pubkey mbedtls_pk_write_pubkey +#define pk_write_pubkey_der mbedtls_pk_write_pubkey_der +#define pk_write_pubkey_pem mbedtls_pk_write_pubkey_pem +#define pkcs11_context mbedtls_pkcs11_context +#define pkcs11_decrypt mbedtls_pkcs11_decrypt +#define pkcs11_priv_key_free mbedtls_pkcs11_priv_key_free +#define pkcs11_priv_key_init mbedtls_pkcs11_priv_key_bind +#define pkcs11_sign mbedtls_pkcs11_sign +#define pkcs11_x509_cert_init mbedtls_pkcs11_x509_cert_bind +#define pkcs12_derivation mbedtls_pkcs12_derivation +#define pkcs12_pbe mbedtls_pkcs12_pbe +#define pkcs12_pbe_sha1_rc4_128 mbedtls_pkcs12_pbe_sha1_rc4_128 +#define pkcs5_pbes2 mbedtls_pkcs5_pbes2 +#define pkcs5_pbkdf2_hmac mbedtls_pkcs5_pbkdf2_hmac +#define pkcs5_self_test mbedtls_pkcs5_self_test +#define platform_entropy_poll mbedtls_platform_entropy_poll +#define platform_set_exit mbedtls_platform_set_exit +#define platform_set_fprintf mbedtls_platform_set_fprintf +#define platform_set_printf mbedtls_platform_set_printf +#define platform_set_snprintf mbedtls_platform_set_snprintf +#define polarssl_exit mbedtls_exit +#define polarssl_fprintf mbedtls_fprintf +#define polarssl_free mbedtls_free +#define polarssl_mutex_free mbedtls_mutex_free +#define polarssl_mutex_init mbedtls_mutex_init +#define polarssl_mutex_lock mbedtls_mutex_lock +#define polarssl_mutex_unlock mbedtls_mutex_unlock +#define polarssl_printf mbedtls_printf +#define polarssl_snprintf mbedtls_snprintf +#define polarssl_strerror mbedtls_strerror +#define ripemd160 mbedtls_ripemd160 +#define ripemd160_context mbedtls_ripemd160_context +#define ripemd160_finish mbedtls_ripemd160_finish +#define ripemd160_free mbedtls_ripemd160_free +#define ripemd160_info mbedtls_ripemd160_info +#define ripemd160_init mbedtls_ripemd160_init +#define ripemd160_process mbedtls_ripemd160_process +#define ripemd160_self_test mbedtls_ripemd160_self_test +#define ripemd160_starts mbedtls_ripemd160_starts +#define ripemd160_update mbedtls_ripemd160_update +#define rsa_alt_context mbedtls_rsa_alt_context +#define rsa_alt_info mbedtls_rsa_alt_info +#define rsa_check_privkey mbedtls_rsa_check_privkey +#define rsa_check_pub_priv mbedtls_rsa_check_pub_priv +#define rsa_check_pubkey mbedtls_rsa_check_pubkey +#define rsa_context mbedtls_rsa_context +#define rsa_copy mbedtls_rsa_copy +#define rsa_free mbedtls_rsa_free +#define rsa_gen_key mbedtls_rsa_gen_key +#define rsa_info mbedtls_rsa_info +#define rsa_init mbedtls_rsa_init +#define rsa_pkcs1_decrypt mbedtls_rsa_pkcs1_decrypt +#define rsa_pkcs1_encrypt mbedtls_rsa_pkcs1_encrypt +#define rsa_pkcs1_sign mbedtls_rsa_pkcs1_sign +#define rsa_pkcs1_verify mbedtls_rsa_pkcs1_verify +#define rsa_private mbedtls_rsa_private +#define rsa_public mbedtls_rsa_public +#define rsa_rsaes_oaep_decrypt mbedtls_rsa_rsaes_oaep_decrypt +#define rsa_rsaes_oaep_encrypt mbedtls_rsa_rsaes_oaep_encrypt +#define rsa_rsaes_pkcs1_v15_decrypt mbedtls_rsa_rsaes_pkcs1_v15_decrypt +#define rsa_rsaes_pkcs1_v15_encrypt mbedtls_rsa_rsaes_pkcs1_v15_encrypt +#define rsa_rsassa_pkcs1_v15_sign mbedtls_rsa_rsassa_pkcs1_v15_sign +#define rsa_rsassa_pkcs1_v15_verify mbedtls_rsa_rsassa_pkcs1_v15_verify +#define rsa_rsassa_pss_sign mbedtls_rsa_rsassa_pss_sign +#define rsa_rsassa_pss_verify mbedtls_rsa_rsassa_pss_verify +#define rsa_rsassa_pss_verify_ext mbedtls_rsa_rsassa_pss_verify_ext +#define rsa_self_test mbedtls_rsa_self_test +#define rsa_set_padding mbedtls_rsa_set_padding +#define safer_memcmp mbedtls_ssl_safer_memcmp +#define set_alarm mbedtls_set_alarm +#define sha1 mbedtls_sha1 +#define sha1_context mbedtls_sha1_context +#define sha1_finish mbedtls_sha1_finish +#define sha1_free mbedtls_sha1_free +#define sha1_info mbedtls_sha1_info +#define sha1_init mbedtls_sha1_init +#define sha1_process mbedtls_sha1_process +#define sha1_self_test mbedtls_sha1_self_test +#define sha1_starts mbedtls_sha1_starts +#define sha1_update mbedtls_sha1_update +#define sha224_info mbedtls_sha224_info +#define sha256 mbedtls_sha256 +#define sha256_context mbedtls_sha256_context +#define sha256_finish mbedtls_sha256_finish +#define sha256_free mbedtls_sha256_free +#define sha256_info mbedtls_sha256_info +#define sha256_init mbedtls_sha256_init +#define sha256_process mbedtls_sha256_process +#define sha256_self_test mbedtls_sha256_self_test +#define sha256_starts mbedtls_sha256_starts +#define sha256_update mbedtls_sha256_update +#define sha384_info mbedtls_sha384_info +#define sha512 mbedtls_sha512 +#define sha512_context mbedtls_sha512_context +#define sha512_finish mbedtls_sha512_finish +#define sha512_free mbedtls_sha512_free +#define sha512_info mbedtls_sha512_info +#define sha512_init mbedtls_sha512_init +#define sha512_process mbedtls_sha512_process +#define sha512_self_test mbedtls_sha512_self_test +#define sha512_starts mbedtls_sha512_starts +#define sha512_update mbedtls_sha512_update +#define source_state mbedtls_entropy_source_state +#define ssl_cache_context mbedtls_ssl_cache_context +#define ssl_cache_entry mbedtls_ssl_cache_entry +#define ssl_cache_free mbedtls_ssl_cache_free +#define ssl_cache_get mbedtls_ssl_cache_get +#define ssl_cache_init mbedtls_ssl_cache_init +#define ssl_cache_set mbedtls_ssl_cache_set +#define ssl_cache_set_max_entries mbedtls_ssl_cache_set_max_entries +#define ssl_cache_set_timeout mbedtls_ssl_cache_set_timeout +#define ssl_check_cert_usage mbedtls_ssl_check_cert_usage +#define ssl_ciphersuite_from_id mbedtls_ssl_ciphersuite_from_id +#define ssl_ciphersuite_from_string mbedtls_ssl_ciphersuite_from_string +#define ssl_ciphersuite_t mbedtls_ssl_ciphersuite_t +#define ssl_ciphersuite_uses_ec mbedtls_ssl_ciphersuite_uses_ec +#define ssl_ciphersuite_uses_psk mbedtls_ssl_ciphersuite_uses_psk +#define ssl_close_notify mbedtls_ssl_close_notify +#define ssl_context mbedtls_ssl_context +#define ssl_cookie_check mbedtls_ssl_cookie_check +#define ssl_cookie_check_t mbedtls_ssl_cookie_check_t +#define ssl_cookie_ctx mbedtls_ssl_cookie_ctx +#define ssl_cookie_free mbedtls_ssl_cookie_free +#define ssl_cookie_init mbedtls_ssl_cookie_init +#define ssl_cookie_set_timeout mbedtls_ssl_cookie_set_timeout +#define ssl_cookie_setup mbedtls_ssl_cookie_setup +#define ssl_cookie_write mbedtls_ssl_cookie_write +#define ssl_cookie_write_t mbedtls_ssl_cookie_write_t +#define ssl_derive_keys mbedtls_ssl_derive_keys +#define ssl_dtls_replay_check mbedtls_ssl_dtls_replay_check +#define ssl_dtls_replay_update mbedtls_ssl_dtls_replay_update +#define ssl_fetch_input mbedtls_ssl_fetch_input +#define ssl_flight_item mbedtls_ssl_flight_item +#define ssl_flush_output mbedtls_ssl_flush_output +#define ssl_free mbedtls_ssl_free +#define ssl_get_alpn_protocol mbedtls_ssl_get_alpn_protocol +#define ssl_get_bytes_avail mbedtls_ssl_get_bytes_avail +#define ssl_get_ciphersuite mbedtls_ssl_get_ciphersuite +#define ssl_get_ciphersuite_id mbedtls_ssl_get_ciphersuite_id +#define ssl_get_ciphersuite_name mbedtls_ssl_get_ciphersuite_name +#define ssl_get_ciphersuite_sig_pk_alg mbedtls_ssl_get_ciphersuite_sig_pk_alg +#define ssl_get_peer_cert mbedtls_ssl_get_peer_cert +#define ssl_get_record_expansion mbedtls_ssl_get_record_expansion +#define ssl_get_session mbedtls_ssl_get_session +#define ssl_get_verify_result mbedtls_ssl_get_verify_result +#define ssl_get_version mbedtls_ssl_get_version +#define ssl_handshake mbedtls_ssl_handshake +#define ssl_handshake_client_step mbedtls_ssl_handshake_client_step +#define ssl_handshake_free mbedtls_ssl_handshake_free +#define ssl_handshake_params mbedtls_ssl_handshake_params +#define ssl_handshake_server_step mbedtls_ssl_handshake_server_step +#define ssl_handshake_step mbedtls_ssl_handshake_step +#define ssl_handshake_wrapup mbedtls_ssl_handshake_wrapup +#define ssl_hdr_len mbedtls_ssl_hdr_len +#define ssl_hs_hdr_len mbedtls_ssl_hs_hdr_len +#define ssl_hw_record_activate mbedtls_ssl_hw_record_activate +#define ssl_hw_record_finish mbedtls_ssl_hw_record_finish +#define ssl_hw_record_init mbedtls_ssl_hw_record_init +#define ssl_hw_record_read mbedtls_ssl_hw_record_read +#define ssl_hw_record_reset mbedtls_ssl_hw_record_reset +#define ssl_hw_record_write mbedtls_ssl_hw_record_write +#define ssl_init mbedtls_ssl_init +#define ssl_key_cert mbedtls_ssl_key_cert +#define ssl_legacy_renegotiation mbedtls_ssl_conf_legacy_renegotiation +#define ssl_list_ciphersuites mbedtls_ssl_list_ciphersuites +#define ssl_md_alg_from_hash mbedtls_ssl_md_alg_from_hash +#define ssl_optimize_checksum mbedtls_ssl_optimize_checksum +#define ssl_own_cert mbedtls_ssl_own_cert +#define ssl_own_key mbedtls_ssl_own_key +#define ssl_parse_certificate mbedtls_ssl_parse_certificate +#define ssl_parse_change_cipher_spec mbedtls_ssl_parse_change_cipher_spec +#define ssl_parse_finished mbedtls_ssl_parse_finished +#define ssl_pk_alg_from_sig mbedtls_ssl_pk_alg_from_sig +#define ssl_pkcs11_decrypt mbedtls_ssl_pkcs11_decrypt +#define ssl_pkcs11_key_len mbedtls_ssl_pkcs11_key_len +#define ssl_pkcs11_sign mbedtls_ssl_pkcs11_sign +#define ssl_psk_derive_premaster mbedtls_ssl_psk_derive_premaster +#define ssl_read mbedtls_ssl_read +#define ssl_read_record mbedtls_ssl_read_record +#define ssl_read_version mbedtls_ssl_read_version +#define ssl_recv_flight_completed mbedtls_ssl_recv_flight_completed +#define ssl_renegotiate mbedtls_ssl_renegotiate +#define ssl_resend mbedtls_ssl_resend +#define ssl_reset_checksum mbedtls_ssl_reset_checksum +#define ssl_send_alert_message mbedtls_ssl_send_alert_message +#define ssl_send_fatal_handshake_failure mbedtls_ssl_send_fatal_handshake_failure +#define ssl_send_flight_completed mbedtls_ssl_send_flight_completed +#define ssl_session mbedtls_ssl_session +#define ssl_session_free mbedtls_ssl_session_free +#define ssl_session_init mbedtls_ssl_session_init +#define ssl_session_reset mbedtls_ssl_session_reset +#define ssl_set_alpn_protocols mbedtls_ssl_conf_alpn_protocols +#define ssl_set_arc4_support mbedtls_ssl_conf_arc4_support +#define ssl_set_authmode mbedtls_ssl_conf_authmode +#define ssl_set_bio mbedtls_ssl_set_bio +#define ssl_set_ca_chain mbedtls_ssl_conf_ca_chain +#define ssl_set_cbc_record_splitting mbedtls_ssl_conf_cbc_record_splitting +#define ssl_set_ciphersuites mbedtls_ssl_conf_ciphersuites +#define ssl_set_ciphersuites_for_version mbedtls_ssl_conf_ciphersuites_for_version +#define ssl_set_client_transport_id mbedtls_ssl_set_client_transport_id +#define ssl_set_curves mbedtls_ssl_conf_curves +#define ssl_set_dbg mbedtls_ssl_conf_dbg +#define ssl_set_dh_param mbedtls_ssl_conf_dh_param +#define ssl_set_dh_param_ctx mbedtls_ssl_conf_dh_param_ctx +#define ssl_set_dtls_anti_replay mbedtls_ssl_conf_dtls_anti_replay +#define ssl_set_dtls_badmac_limit mbedtls_ssl_conf_dtls_badmac_limit +#define ssl_set_dtls_cookies mbedtls_ssl_conf_dtls_cookies +#define ssl_set_encrypt_then_mac mbedtls_ssl_conf_encrypt_then_mac +#define ssl_set_endpoint mbedtls_ssl_conf_endpoint +#define ssl_set_extended_master_secret mbedtls_ssl_conf_extended_master_secret +#define ssl_set_fallback mbedtls_ssl_conf_fallback +#define ssl_set_handshake_timeout mbedtls_ssl_conf_handshake_timeout +#define ssl_set_hostname mbedtls_ssl_set_hostname +#define ssl_set_max_frag_len mbedtls_ssl_conf_max_frag_len +#define ssl_set_max_version mbedtls_ssl_conf_max_version +#define ssl_set_min_version mbedtls_ssl_conf_min_version +#define ssl_set_own_cert mbedtls_ssl_conf_own_cert +#define ssl_set_psk mbedtls_ssl_conf_psk +#define ssl_set_psk_cb mbedtls_ssl_conf_psk_cb +#define ssl_set_renegotiation mbedtls_ssl_conf_renegotiation +#define ssl_set_renegotiation_enforced mbedtls_ssl_conf_renegotiation_enforced +#define ssl_set_renegotiation_period mbedtls_ssl_conf_renegotiation_period +#define ssl_set_rng mbedtls_ssl_conf_rng +#define ssl_set_session mbedtls_ssl_set_session +#define ssl_set_session_cache mbedtls_ssl_conf_session_cache +#define ssl_set_session_tickets mbedtls_ssl_conf_session_tickets +#define ssl_set_sni mbedtls_ssl_conf_sni +#define ssl_set_transport mbedtls_ssl_conf_transport +#define ssl_set_truncated_hmac mbedtls_ssl_conf_truncated_hmac +#define ssl_set_verify mbedtls_ssl_conf_verify +#define ssl_sig_from_pk mbedtls_ssl_sig_from_pk +#define ssl_states mbedtls_ssl_states +#define ssl_transform mbedtls_ssl_transform +#define ssl_transform_free mbedtls_ssl_transform_free +#define ssl_write mbedtls_ssl_write +#define ssl_write_certificate mbedtls_ssl_write_certificate +#define ssl_write_change_cipher_spec mbedtls_ssl_write_change_cipher_spec +#define ssl_write_finished mbedtls_ssl_write_finished +#define ssl_write_record mbedtls_ssl_write_record +#define ssl_write_version mbedtls_ssl_write_version +#define supported_ciphers mbedtls_cipher_supported +#define t_sint mbedtls_mpi_sint +#define t_udbl mbedtls_t_udbl +#define t_uint mbedtls_mpi_uint +#define test_ca_crt mbedtls_test_ca_crt +#define test_ca_crt_ec mbedtls_test_ca_crt_ec +#define test_ca_crt_rsa mbedtls_test_ca_crt_rsa +#define test_ca_key mbedtls_test_ca_key +#define test_ca_key_ec mbedtls_test_ca_key_ec +#define test_ca_key_rsa mbedtls_test_ca_key_rsa +#define test_ca_list mbedtls_test_cas_pem +#define test_ca_pwd mbedtls_test_ca_pwd +#define test_ca_pwd_ec mbedtls_test_ca_pwd_ec +#define test_ca_pwd_rsa mbedtls_test_ca_pwd_rsa +#define test_cli_crt mbedtls_test_cli_crt +#define test_cli_crt_ec mbedtls_test_cli_crt_ec +#define test_cli_crt_rsa mbedtls_test_cli_crt_rsa +#define test_cli_key mbedtls_test_cli_key +#define test_cli_key_ec mbedtls_test_cli_key_ec +#define test_cli_key_rsa mbedtls_test_cli_key_rsa +#define test_srv_crt mbedtls_test_srv_crt +#define test_srv_crt_ec mbedtls_test_srv_crt_ec +#define test_srv_crt_rsa mbedtls_test_srv_crt_rsa +#define test_srv_key mbedtls_test_srv_key +#define test_srv_key_ec mbedtls_test_srv_key_ec +#define test_srv_key_rsa mbedtls_test_srv_key_rsa +#define threading_mutex_t mbedtls_threading_mutex_t +#define threading_set_alt mbedtls_threading_set_alt +#define timing_self_test mbedtls_timing_self_test +#define version_check_feature mbedtls_version_check_feature +#define version_get_number mbedtls_version_get_number +#define version_get_string mbedtls_version_get_string +#define version_get_string_full mbedtls_version_get_string_full +#define x509_bitstring mbedtls_x509_bitstring +#define x509_buf mbedtls_x509_buf +#define x509_crl mbedtls_x509_crl +#define x509_crl_entry mbedtls_x509_crl_entry +#define x509_crl_free mbedtls_x509_crl_free +#define x509_crl_info mbedtls_x509_crl_info +#define x509_crl_init mbedtls_x509_crl_init +#define x509_crl_parse mbedtls_x509_crl_parse +#define x509_crl_parse_der mbedtls_x509_crl_parse_der +#define x509_crl_parse_file mbedtls_x509_crl_parse_file +#define x509_crt mbedtls_x509_crt +#define x509_crt_check_extended_key_usage mbedtls_x509_crt_check_extended_key_usage +#define x509_crt_check_key_usage mbedtls_x509_crt_check_key_usage +#define x509_crt_free mbedtls_x509_crt_free +#define x509_crt_info mbedtls_x509_crt_info +#define x509_crt_init mbedtls_x509_crt_init +#define x509_crt_parse mbedtls_x509_crt_parse +#define x509_crt_parse_der mbedtls_x509_crt_parse_der +#define x509_crt_parse_file mbedtls_x509_crt_parse_file +#define x509_crt_parse_path mbedtls_x509_crt_parse_path +#define x509_crt_revoked mbedtls_x509_crt_is_revoked +#define x509_crt_verify mbedtls_x509_crt_verify +#define x509_csr mbedtls_x509_csr +#define x509_csr_free mbedtls_x509_csr_free +#define x509_csr_info mbedtls_x509_csr_info +#define x509_csr_init mbedtls_x509_csr_init +#define x509_csr_parse mbedtls_x509_csr_parse +#define x509_csr_parse_der mbedtls_x509_csr_parse_der +#define x509_csr_parse_file mbedtls_x509_csr_parse_file +#define x509_dn_gets mbedtls_x509_dn_gets +#define x509_get_alg mbedtls_x509_get_alg +#define x509_get_alg_null mbedtls_x509_get_alg_null +#define x509_get_ext mbedtls_x509_get_ext +#define x509_get_name mbedtls_x509_get_name +#define x509_get_rsassa_pss_params mbedtls_x509_get_rsassa_pss_params +#define x509_get_serial mbedtls_x509_get_serial +#define x509_get_sig mbedtls_x509_get_sig +#define x509_get_sig_alg mbedtls_x509_get_sig_alg +#define x509_get_time mbedtls_x509_get_time +#define x509_key_size_helper mbedtls_x509_key_size_helper +#define x509_name mbedtls_x509_name +#define x509_self_test mbedtls_x509_self_test +#define x509_sequence mbedtls_x509_sequence +#define x509_serial_gets mbedtls_x509_serial_gets +#define x509_set_extension mbedtls_x509_set_extension +#define x509_sig_alg_gets mbedtls_x509_sig_alg_gets +#define x509_string_to_names mbedtls_x509_string_to_names +#define x509_time mbedtls_x509_time +#define x509_time_expired mbedtls_x509_time_is_past +#define x509_time_future mbedtls_x509_time_is_future +#define x509_write_extensions mbedtls_x509_write_extensions +#define x509_write_names mbedtls_x509_write_names +#define x509_write_sig mbedtls_x509_write_sig +#define x509write_cert mbedtls_x509write_cert +#define x509write_crt_der mbedtls_x509write_crt_der +#define x509write_crt_free mbedtls_x509write_crt_free +#define x509write_crt_init mbedtls_x509write_crt_init +#define x509write_crt_pem mbedtls_x509write_crt_pem +#define x509write_crt_set_authority_key_identifier mbedtls_x509write_crt_set_authority_key_identifier +#define x509write_crt_set_basic_constraints mbedtls_x509write_crt_set_basic_constraints +#define x509write_crt_set_extension mbedtls_x509write_crt_set_extension +#define x509write_crt_set_issuer_key mbedtls_x509write_crt_set_issuer_key +#define x509write_crt_set_issuer_name mbedtls_x509write_crt_set_issuer_name +#define x509write_crt_set_key_usage mbedtls_x509write_crt_set_key_usage +#define x509write_crt_set_md_alg mbedtls_x509write_crt_set_md_alg +#define x509write_crt_set_ns_cert_type mbedtls_x509write_crt_set_ns_cert_type +#define x509write_crt_set_serial mbedtls_x509write_crt_set_serial +#define x509write_crt_set_subject_key mbedtls_x509write_crt_set_subject_key +#define x509write_crt_set_subject_key_identifier mbedtls_x509write_crt_set_subject_key_identifier +#define x509write_crt_set_subject_name mbedtls_x509write_crt_set_subject_name +#define x509write_crt_set_validity mbedtls_x509write_crt_set_validity +#define x509write_crt_set_version mbedtls_x509write_crt_set_version +#define x509write_csr mbedtls_x509write_csr +#define x509write_csr_der mbedtls_x509write_csr_der +#define x509write_csr_free mbedtls_x509write_csr_free +#define x509write_csr_init mbedtls_x509write_csr_init +#define x509write_csr_pem mbedtls_x509write_csr_pem +#define x509write_csr_set_extension mbedtls_x509write_csr_set_extension +#define x509write_csr_set_key mbedtls_x509write_csr_set_key +#define x509write_csr_set_key_usage mbedtls_x509write_csr_set_key_usage +#define x509write_csr_set_md_alg mbedtls_x509write_csr_set_md_alg +#define x509write_csr_set_ns_cert_type mbedtls_x509write_csr_set_ns_cert_type +#define x509write_csr_set_subject_name mbedtls_x509write_csr_set_subject_name +#define xtea_context mbedtls_xtea_context +#define xtea_crypt_cbc mbedtls_xtea_crypt_cbc +#define xtea_crypt_ecb mbedtls_xtea_crypt_ecb +#define xtea_free mbedtls_xtea_free +#define xtea_init mbedtls_xtea_init +#define xtea_self_test mbedtls_xtea_self_test +#define xtea_setup mbedtls_xtea_setup + +#endif /* compat-1.3.h */ +#endif /* MBEDTLS_DEPRECATED_REMOVED */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/config.h b/openharmony/armeabi-v7a/include/mbedtls/config.h new file mode 100644 index 00000000..1cd6eb66 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/config.h @@ -0,0 +1,4127 @@ +/** + * \file config.h + * + * \brief Configuration options (set of defines) + * + * This set of compile-time options may be used to enable + * or disable features selectively, and reduce the global + * memory footprint. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CONFIG_H +#define MBEDTLS_CONFIG_H + +#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE) +#define _CRT_SECURE_NO_DEPRECATE 1 +#endif + +/** + * \name SECTION: System support + * + * This section sets system specific settings. + * \{ + */ + +/** + * \def MBEDTLS_HAVE_ASM + * + * The compiler has support for asm(). + * + * Requires support for asm() in compiler. + * + * Used in: + * library/aria.c + * library/timing.c + * include/mbedtls/bn_mul.h + * + * Required by: + * MBEDTLS_AESNI_C + * MBEDTLS_PADLOCK_C + * + * Comment to disable the use of assembly code. + */ +#define MBEDTLS_HAVE_ASM + +/** + * \def MBEDTLS_NO_UDBL_DIVISION + * + * The platform lacks support for double-width integer division (64-bit + * division on a 32-bit platform, 128-bit division on a 64-bit platform). + * + * Used in: + * include/mbedtls/bignum.h + * library/bignum.c + * + * The bignum code uses double-width division to speed up some operations. + * Double-width division is often implemented in software that needs to + * be linked with the program. The presence of a double-width integer + * type is usually detected automatically through preprocessor macros, + * but the automatic detection cannot know whether the code needs to + * and can be linked with an implementation of division for that type. + * By default division is assumed to be usable if the type is present. + * Uncomment this option to prevent the use of double-width division. + * + * Note that division for the native integer type is always required. + * Furthermore, a 64-bit type is always required even on a 32-bit + * platform, but it need not support multiplication or division. In some + * cases it is also desirable to disable some double-width operations. For + * example, if double-width division is implemented in software, disabling + * it can reduce code size in some embedded targets. + */ +//#define MBEDTLS_NO_UDBL_DIVISION + +/** + * \def MBEDTLS_NO_64BIT_MULTIPLICATION + * + * The platform lacks support for 32x32 -> 64-bit multiplication. + * + * Used in: + * library/poly1305.c + * + * Some parts of the library may use multiplication of two unsigned 32-bit + * operands with a 64-bit result in order to speed up computations. On some + * platforms, this is not available in hardware and has to be implemented in + * software, usually in a library provided by the toolchain. + * + * Sometimes it is not desirable to have to link to that library. This option + * removes the dependency of that library on platforms that lack a hardware + * 64-bit multiplier by embedding a software implementation in Mbed TLS. + * + * Note that depending on the compiler, this may decrease performance compared + * to using the library function provided by the toolchain. + */ +//#define MBEDTLS_NO_64BIT_MULTIPLICATION + +/** + * \def MBEDTLS_HAVE_SSE2 + * + * CPU supports SSE2 instruction set. + * + * Uncomment if the CPU supports SSE2 (IA-32 specific). + */ +//#define MBEDTLS_HAVE_SSE2 + +/** + * \def MBEDTLS_HAVE_TIME + * + * System has time.h and time(). + * The time does not need to be correct, only time differences are used, + * by contrast with MBEDTLS_HAVE_TIME_DATE + * + * Defining MBEDTLS_HAVE_TIME allows you to specify MBEDTLS_PLATFORM_TIME_ALT, + * MBEDTLS_PLATFORM_TIME_MACRO, MBEDTLS_PLATFORM_TIME_TYPE_MACRO and + * MBEDTLS_PLATFORM_STD_TIME. + * + * Comment if your system does not support time functions. + * + * \note If MBEDTLS_TIMING_C is set - to enable the semi-portable timing + * interface - timing.c will include time.h on suitable platforms + * regardless of the setting of MBEDTLS_HAVE_TIME, unless + * MBEDTLS_TIMING_ALT is used. See timing.c for more information. + */ +#define MBEDTLS_HAVE_TIME + +/** + * \def MBEDTLS_HAVE_TIME_DATE + * + * System has time.h, time(), and an implementation for + * mbedtls_platform_gmtime_r() (see below). + * The time needs to be correct (not necessarily very accurate, but at least + * the date should be correct). This is used to verify the validity period of + * X.509 certificates. + * + * Comment if your system does not have a correct clock. + * + * \note mbedtls_platform_gmtime_r() is an abstraction in platform_util.h that + * behaves similarly to the gmtime_r() function from the C standard. Refer to + * the documentation for mbedtls_platform_gmtime_r() for more information. + * + * \note It is possible to configure an implementation for + * mbedtls_platform_gmtime_r() at compile-time by using the macro + * MBEDTLS_PLATFORM_GMTIME_R_ALT. + */ +#define MBEDTLS_HAVE_TIME_DATE + +/** + * \def MBEDTLS_PLATFORM_MEMORY + * + * Enable the memory allocation layer. + * + * By default mbed TLS uses the system-provided calloc() and free(). + * This allows different allocators (self-implemented or provided) to be + * provided to the platform abstraction layer. + * + * Enabling MBEDTLS_PLATFORM_MEMORY without the + * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide + * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and + * free() function pointer at runtime. + * + * Enabling MBEDTLS_PLATFORM_MEMORY and specifying + * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the + * alternate function at compile time. + * + * Requires: MBEDTLS_PLATFORM_C + * + * Enable this layer to allow use of alternative memory allocators. + */ +//#define MBEDTLS_PLATFORM_MEMORY + +/** + * \def MBEDTLS_PLATFORM_NO_STD_FUNCTIONS + * + * Do not assign standard functions in the platform layer (e.g. calloc() to + * MBEDTLS_PLATFORM_STD_CALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF) + * + * This makes sure there are no linking errors on platforms that do not support + * these functions. You will HAVE to provide alternatives, either at runtime + * via the platform_set_xxx() functions or at compile time by setting + * the MBEDTLS_PLATFORM_STD_XXX defines, or enabling a + * MBEDTLS_PLATFORM_XXX_MACRO. + * + * Requires: MBEDTLS_PLATFORM_C + * + * Uncomment to prevent default assignment of standard functions in the + * platform layer. + */ +//#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS + +/** + * \def MBEDTLS_PLATFORM_EXIT_ALT + * + * MBEDTLS_PLATFORM_XXX_ALT: Uncomment a macro to let mbed TLS support the + * function in the platform abstraction layer. + * + * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, mbed TLS will + * provide a function "mbedtls_platform_set_printf()" that allows you to set an + * alternative printf function pointer. + * + * All these define require MBEDTLS_PLATFORM_C to be defined! + * + * \note MBEDTLS_PLATFORM_SNPRINTF_ALT is required on Windows; + * it will be enabled automatically by check_config.h + * + * \warning MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as + * MBEDTLS_PLATFORM_XXX_MACRO! + * + * Requires: MBEDTLS_PLATFORM_TIME_ALT requires MBEDTLS_HAVE_TIME + * + * Uncomment a macro to enable alternate implementation of specific base + * platform function + */ +//#define MBEDTLS_PLATFORM_EXIT_ALT +//#define MBEDTLS_PLATFORM_TIME_ALT +//#define MBEDTLS_PLATFORM_FPRINTF_ALT +//#define MBEDTLS_PLATFORM_PRINTF_ALT +//#define MBEDTLS_PLATFORM_SNPRINTF_ALT +//#define MBEDTLS_PLATFORM_VSNPRINTF_ALT +//#define MBEDTLS_PLATFORM_NV_SEED_ALT +//#define MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT + +/** + * \def MBEDTLS_DEPRECATED_WARNING + * + * Mark deprecated functions and features so that they generate a warning if + * used. Functionality deprecated in one version will usually be removed in the + * next version. You can enable this to help you prepare the transition to a + * new major version by making sure your code is not using this functionality. + * + * This only works with GCC and Clang. With other compilers, you may want to + * use MBEDTLS_DEPRECATED_REMOVED + * + * Uncomment to get warnings on using deprecated functions and features. + */ +//#define MBEDTLS_DEPRECATED_WARNING + +/** + * \def MBEDTLS_DEPRECATED_REMOVED + * + * Remove deprecated functions and features so that they generate an error if + * used. Functionality deprecated in one version will usually be removed in the + * next version. You can enable this to help you prepare the transition to a + * new major version by making sure your code is not using this functionality. + * + * Uncomment to get errors on using deprecated functions and features. + */ +//#define MBEDTLS_DEPRECATED_REMOVED + +/** + * \def MBEDTLS_CHECK_PARAMS + * + * This configuration option controls whether the library validates more of + * the parameters passed to it. + * + * When this flag is not defined, the library only attempts to validate an + * input parameter if: (1) they may come from the outside world (such as the + * network, the filesystem, etc.) or (2) not validating them could result in + * internal memory errors such as overflowing a buffer controlled by the + * library. On the other hand, it doesn't attempt to validate parameters whose + * values are fully controlled by the application (such as pointers). + * + * When this flag is defined, the library additionally attempts to validate + * parameters that are fully controlled by the application, and should always + * be valid if the application code is fully correct and trusted. + * + * For example, when a function accepts as input a pointer to a buffer that may + * contain untrusted data, and its documentation mentions that this pointer + * must not be NULL: + * - The pointer is checked to be non-NULL only if this option is enabled. + * - The content of the buffer is always validated. + * + * When this flag is defined, if a library function receives a parameter that + * is invalid: + * 1. The function will invoke the macro MBEDTLS_PARAM_FAILED(). + * 2. If MBEDTLS_PARAM_FAILED() did not terminate the program, the function + * will immediately return. If the function returns an Mbed TLS error code, + * the error code in this case is MBEDTLS_ERR_xxx_BAD_INPUT_DATA. + * + * When defining this flag, you also need to arrange a definition for + * MBEDTLS_PARAM_FAILED(). You can do this by any of the following methods: + * - By default, the library defines MBEDTLS_PARAM_FAILED() to call a + * function mbedtls_param_failed(), but the library does not define this + * function. If you do not make any other arrangements, you must provide + * the function mbedtls_param_failed() in your application. + * See `platform_util.h` for its prototype. + * - If you enable the macro #MBEDTLS_CHECK_PARAMS_ASSERT, then the + * library defines MBEDTLS_PARAM_FAILED(\c cond) to be `assert(cond)`. + * You can still supply an alternative definition of + * MBEDTLS_PARAM_FAILED(), which may call `assert`. + * - If you define a macro MBEDTLS_PARAM_FAILED() before including `config.h` + * or you uncomment the definition of MBEDTLS_PARAM_FAILED() in `config.h`, + * the library will call the macro that you defined and will not supply + * its own version. Note that if MBEDTLS_PARAM_FAILED() calls `assert`, + * you need to enable #MBEDTLS_CHECK_PARAMS_ASSERT so that library source + * files include ``. + * + * Uncomment to enable validation of application-controlled parameters. + */ +//#define MBEDTLS_CHECK_PARAMS + +/** + * \def MBEDTLS_CHECK_PARAMS_ASSERT + * + * Allow MBEDTLS_PARAM_FAILED() to call `assert`, and make it default to + * `assert`. This macro is only used if #MBEDTLS_CHECK_PARAMS is defined. + * + * If this macro is not defined, then MBEDTLS_PARAM_FAILED() defaults to + * calling a function mbedtls_param_failed(). See the documentation of + * #MBEDTLS_CHECK_PARAMS for details. + * + * Uncomment to allow MBEDTLS_PARAM_FAILED() to call `assert`. + */ +//#define MBEDTLS_CHECK_PARAMS_ASSERT + +/** \} name SECTION: System support */ + +/** + * \name SECTION: mbed TLS feature support + * + * This section sets support for features that are or are not needed + * within the modules that are enabled. + * \{ + */ + +/** + * \def MBEDTLS_TIMING_ALT + * + * Uncomment to provide your own alternate implementation for mbedtls_timing_hardclock(), + * mbedtls_timing_get_timer(), mbedtls_set_alarm(), mbedtls_set/get_delay() + * + * Only works if you have MBEDTLS_TIMING_C enabled. + * + * You will need to provide a header "timing_alt.h" and an implementation at + * compile time. + */ +//#define MBEDTLS_TIMING_ALT + +/** + * \def MBEDTLS_AES_ALT + * + * MBEDTLS__MODULE_NAME__ALT: Uncomment a macro to let mbed TLS use your + * alternate core implementation of a symmetric crypto, an arithmetic or hash + * module (e.g. platform specific assembly optimized implementations). Keep + * in mind that the function prototypes should remain the same. + * + * This replaces the whole module. If you only want to replace one of the + * functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. + * + * Example: In case you uncomment MBEDTLS_AES_ALT, mbed TLS will no longer + * provide the "struct mbedtls_aes_context" definition and omit the base + * function declarations and implementations. "aes_alt.h" will be included from + * "aes.h" to include the new function definitions. + * + * Uncomment a macro to enable alternate implementation of the corresponding + * module. + * + * \warning MD2, MD4, MD5, ARC4, DES and SHA-1 are considered weak and their + * use constitutes a security risk. If possible, we recommend + * avoiding dependencies on them, and considering stronger message + * digests and ciphers instead. + * + */ +//#define MBEDTLS_AES_ALT +//#define MBEDTLS_ARC4_ALT +//#define MBEDTLS_ARIA_ALT +//#define MBEDTLS_BLOWFISH_ALT +//#define MBEDTLS_CAMELLIA_ALT +//#define MBEDTLS_CCM_ALT +//#define MBEDTLS_CHACHA20_ALT +//#define MBEDTLS_CHACHAPOLY_ALT +//#define MBEDTLS_CMAC_ALT +//#define MBEDTLS_DES_ALT +//#define MBEDTLS_DHM_ALT +//#define MBEDTLS_ECJPAKE_ALT +//#define MBEDTLS_GCM_ALT +//#define MBEDTLS_NIST_KW_ALT +//#define MBEDTLS_MD2_ALT +//#define MBEDTLS_MD4_ALT +//#define MBEDTLS_MD5_ALT +//#define MBEDTLS_POLY1305_ALT +//#define MBEDTLS_RIPEMD160_ALT +//#define MBEDTLS_RSA_ALT +//#define MBEDTLS_SHA1_ALT +//#define MBEDTLS_SHA256_ALT +//#define MBEDTLS_SHA512_ALT +//#define MBEDTLS_XTEA_ALT + +/* + * When replacing the elliptic curve module, please consider, that it is + * implemented with two .c files: + * - ecp.c + * - ecp_curves.c + * You can replace them very much like all the other MBEDTLS__MODULE_NAME__ALT + * macros as described above. The only difference is that you have to make sure + * that you provide functionality for both .c files. + */ +//#define MBEDTLS_ECP_ALT + +/** + * \def MBEDTLS_MD2_PROCESS_ALT + * + * MBEDTLS__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use you + * alternate core implementation of symmetric crypto or hash function. Keep in + * mind that function prototypes should remain the same. + * + * This replaces only one function. The header file from mbed TLS is still + * used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. + * + * Example: In case you uncomment MBEDTLS_SHA256_PROCESS_ALT, mbed TLS will + * no longer provide the mbedtls_sha1_process() function, but it will still provide + * the other function (using your mbedtls_sha1_process() function) and the definition + * of mbedtls_sha1_context, so your implementation of mbedtls_sha1_process must be compatible + * with this definition. + * + * \note Because of a signature change, the core AES encryption and decryption routines are + * currently named mbedtls_aes_internal_encrypt and mbedtls_aes_internal_decrypt, + * respectively. When setting up alternative implementations, these functions should + * be overridden, but the wrapper functions mbedtls_aes_decrypt and mbedtls_aes_encrypt + * must stay untouched. + * + * \note If you use the AES_xxx_ALT macros, then it is recommended to also set + * MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES + * tables. + * + * Uncomment a macro to enable alternate implementation of the corresponding + * function. + * + * \warning MD2, MD4, MD5, DES and SHA-1 are considered weak and their use + * constitutes a security risk. If possible, we recommend avoiding + * dependencies on them, and considering stronger message digests + * and ciphers instead. + * + * \warning If both MBEDTLS_ECDSA_SIGN_ALT and MBEDTLS_ECDSA_DETERMINISTIC are + * enabled, then the deterministic ECDH signature functions pass the + * the static HMAC-DRBG as RNG to mbedtls_ecdsa_sign(). Therefore + * alternative implementations should use the RNG only for generating + * the ephemeral key and nothing else. If this is not possible, then + * MBEDTLS_ECDSA_DETERMINISTIC should be disabled and an alternative + * implementation should be provided for mbedtls_ecdsa_sign_det_ext() + * (and for mbedtls_ecdsa_sign_det() too if backward compatibility is + * desirable). + * + */ +//#define MBEDTLS_MD2_PROCESS_ALT +//#define MBEDTLS_MD4_PROCESS_ALT +//#define MBEDTLS_MD5_PROCESS_ALT +//#define MBEDTLS_RIPEMD160_PROCESS_ALT +//#define MBEDTLS_SHA1_PROCESS_ALT +//#define MBEDTLS_SHA256_PROCESS_ALT +//#define MBEDTLS_SHA512_PROCESS_ALT +//#define MBEDTLS_DES_SETKEY_ALT +//#define MBEDTLS_DES_CRYPT_ECB_ALT +//#define MBEDTLS_DES3_CRYPT_ECB_ALT +//#define MBEDTLS_AES_SETKEY_ENC_ALT +//#define MBEDTLS_AES_SETKEY_DEC_ALT +//#define MBEDTLS_AES_ENCRYPT_ALT +//#define MBEDTLS_AES_DECRYPT_ALT +//#define MBEDTLS_ECDH_GEN_PUBLIC_ALT +//#define MBEDTLS_ECDH_COMPUTE_SHARED_ALT +//#define MBEDTLS_ECDSA_VERIFY_ALT +//#define MBEDTLS_ECDSA_SIGN_ALT +//#define MBEDTLS_ECDSA_GENKEY_ALT + +/** + * \def MBEDTLS_ECP_INTERNAL_ALT + * + * Expose a part of the internal interface of the Elliptic Curve Point module. + * + * MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your + * alternative core implementation of elliptic curve arithmetic. Keep in mind + * that function prototypes should remain the same. + * + * This partially replaces one function. The header file from mbed TLS is still + * used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation + * is still present and it is used for group structures not supported by the + * alternative. + * + * The original implementation can in addition be removed by setting the + * MBEDTLS_ECP_NO_FALLBACK option, in which case any function for which the + * corresponding MBEDTLS_ECP__FUNCTION_NAME__ALT macro is defined will not be + * able to fallback to curves not supported by the alternative implementation. + * + * Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT + * and implementing the following functions: + * unsigned char mbedtls_internal_ecp_grp_capable( + * const mbedtls_ecp_group *grp ) + * int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) + * void mbedtls_internal_ecp_free( const mbedtls_ecp_group *grp ) + * The mbedtls_internal_ecp_grp_capable function should return 1 if the + * replacement functions implement arithmetic for the given group and 0 + * otherwise. + * The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_free are + * called before and after each point operation and provide an opportunity to + * implement optimized set up and tear down instructions. + * + * Example: In case you set MBEDTLS_ECP_INTERNAL_ALT and + * MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac() + * function, but will use your mbedtls_internal_ecp_double_jac() if the group + * for the operation is supported by your implementation (i.e. your + * mbedtls_internal_ecp_grp_capable() function returns 1 for this group). If the + * group is not supported by your implementation, then the original mbed TLS + * implementation of ecp_double_jac() is used instead, unless this fallback + * behaviour is disabled by setting MBEDTLS_ECP_NO_FALLBACK (in which case + * ecp_double_jac() will return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE). + * + * The function prototypes and the definition of mbedtls_ecp_group and + * mbedtls_ecp_point will not change based on MBEDTLS_ECP_INTERNAL_ALT, so your + * implementation of mbedtls_internal_ecp__function_name__ must be compatible + * with their definitions. + * + * Uncomment a macro to enable alternate implementation of the corresponding + * function. + */ +/* Required for all the functions in this section */ +//#define MBEDTLS_ECP_INTERNAL_ALT +/* Turn off software fallback for curves not supported in hardware */ +//#define MBEDTLS_ECP_NO_FALLBACK +/* Support for Weierstrass curves with Jacobi representation */ +//#define MBEDTLS_ECP_RANDOMIZE_JAC_ALT +//#define MBEDTLS_ECP_ADD_MIXED_ALT +//#define MBEDTLS_ECP_DOUBLE_JAC_ALT +//#define MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT +//#define MBEDTLS_ECP_NORMALIZE_JAC_ALT +/* Support for curves with Montgomery arithmetic */ +//#define MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT +//#define MBEDTLS_ECP_RANDOMIZE_MXZ_ALT +//#define MBEDTLS_ECP_NORMALIZE_MXZ_ALT + +/** + * \def MBEDTLS_TEST_NULL_ENTROPY + * + * Enables testing and use of mbed TLS without any configured entropy sources. + * This permits use of the library on platforms before an entropy source has + * been integrated (see for example the MBEDTLS_ENTROPY_HARDWARE_ALT or the + * MBEDTLS_ENTROPY_NV_SEED switches). + * + * WARNING! This switch MUST be disabled in production builds, and is suitable + * only for development. + * Enabling the switch negates any security provided by the library. + * + * Requires MBEDTLS_ENTROPY_C, MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES + * + */ +//#define MBEDTLS_TEST_NULL_ENTROPY + +/** + * \def MBEDTLS_ENTROPY_HARDWARE_ALT + * + * Uncomment this macro to let mbed TLS use your own implementation of a + * hardware entropy collector. + * + * Your function must be called \c mbedtls_hardware_poll(), have the same + * prototype as declared in entropy_poll.h, and accept NULL as first argument. + * + * Uncomment to use your own hardware entropy collector. + */ +//#define MBEDTLS_ENTROPY_HARDWARE_ALT + +/** + * \def MBEDTLS_AES_ROM_TABLES + * + * Use precomputed AES tables stored in ROM. + * + * Uncomment this macro to use precomputed AES tables stored in ROM. + * Comment this macro to generate AES tables in RAM at runtime. + * + * Tradeoff: Using precomputed ROM tables reduces RAM usage by ~8kb + * (or ~2kb if \c MBEDTLS_AES_FEWER_TABLES is used) and reduces the + * initialization time before the first AES operation can be performed. + * It comes at the cost of additional ~8kb ROM use (resp. ~2kb if \c + * MBEDTLS_AES_FEWER_TABLES below is used), and potentially degraded + * performance if ROM access is slower than RAM access. + * + * This option is independent of \c MBEDTLS_AES_FEWER_TABLES. + * + */ +//#define MBEDTLS_AES_ROM_TABLES + +/** + * \def MBEDTLS_AES_FEWER_TABLES + * + * Use less ROM/RAM for AES tables. + * + * Uncommenting this macro omits 75% of the AES tables from + * ROM / RAM (depending on the value of \c MBEDTLS_AES_ROM_TABLES) + * by computing their values on the fly during operations + * (the tables are entry-wise rotations of one another). + * + * Tradeoff: Uncommenting this reduces the RAM / ROM footprint + * by ~6kb but at the cost of more arithmetic operations during + * runtime. Specifically, one has to compare 4 accesses within + * different tables to 4 accesses with additional arithmetic + * operations within the same table. The performance gain/loss + * depends on the system and memory details. + * + * This option is independent of \c MBEDTLS_AES_ROM_TABLES. + * + */ +//#define MBEDTLS_AES_FEWER_TABLES + +/** + * \def MBEDTLS_CAMELLIA_SMALL_MEMORY + * + * Use less ROM for the Camellia implementation (saves about 768 bytes). + * + * Uncomment this macro to use less memory for Camellia. + */ +//#define MBEDTLS_CAMELLIA_SMALL_MEMORY + +/** + * \def MBEDTLS_CHECK_RETURN_WARNING + * + * If this macro is defined, emit a compile-time warning if application code + * calls a function without checking its return value, but the return value + * should generally be checked in portable applications. + * + * This is only supported on platforms where #MBEDTLS_CHECK_RETURN is + * implemented. Otherwise this option has no effect. + * + * Uncomment to get warnings on using fallible functions without checking + * their return value. + * + * \note This feature is a work in progress. + * Warnings will be added to more functions in the future. + * + * \note A few functions are considered critical, and ignoring the return + * value of these functions will trigger a warning even if this + * macro is not defined. To completely disable return value check + * warnings, define #MBEDTLS_CHECK_RETURN with an empty expansion. + */ +//#define MBEDTLS_CHECK_RETURN_WARNING + +/** + * \def MBEDTLS_CIPHER_MODE_CBC + * + * Enable Cipher Block Chaining mode (CBC) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_CBC + +/** + * \def MBEDTLS_CIPHER_MODE_CFB + * + * Enable Cipher Feedback mode (CFB) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_CFB + +/** + * \def MBEDTLS_CIPHER_MODE_CTR + * + * Enable Counter Block Cipher mode (CTR) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_CTR + +/** + * \def MBEDTLS_CIPHER_MODE_OFB + * + * Enable Output Feedback mode (OFB) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_OFB + +/** + * \def MBEDTLS_CIPHER_MODE_XTS + * + * Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES. + */ +#define MBEDTLS_CIPHER_MODE_XTS + +/** + * \def MBEDTLS_CIPHER_NULL_CIPHER + * + * Enable NULL cipher. + * Warning: Only do so when you know what you are doing. This allows for + * encryption or channels without any security! + * + * Requires MBEDTLS_ENABLE_WEAK_CIPHERSUITES as well to enable + * the following ciphersuites: + * MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA + * MBEDTLS_TLS_RSA_WITH_NULL_SHA256 + * MBEDTLS_TLS_RSA_WITH_NULL_SHA + * MBEDTLS_TLS_RSA_WITH_NULL_MD5 + * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA + * MBEDTLS_TLS_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_PSK_WITH_NULL_SHA + * + * Uncomment this macro to enable the NULL cipher and ciphersuites + */ +//#define MBEDTLS_CIPHER_NULL_CIPHER + +/** + * \def MBEDTLS_CIPHER_PADDING_PKCS7 + * + * MBEDTLS_CIPHER_PADDING_XXX: Uncomment or comment macros to add support for + * specific padding modes in the cipher layer with cipher modes that support + * padding (e.g. CBC) + * + * If you disable all padding modes, only full blocks can be used with CBC. + * + * Enable padding modes in the cipher layer. + */ +#define MBEDTLS_CIPHER_PADDING_PKCS7 +#define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS +#define MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN +#define MBEDTLS_CIPHER_PADDING_ZEROS + +/** \def MBEDTLS_CTR_DRBG_USE_128_BIT_KEY + * + * Uncomment this macro to use a 128-bit key in the CTR_DRBG module. + * By default, CTR_DRBG uses a 256-bit key. + */ +//#define MBEDTLS_CTR_DRBG_USE_128_BIT_KEY + +/** + * \def MBEDTLS_ENABLE_WEAK_CIPHERSUITES + * + * Enable weak ciphersuites in SSL / TLS. + * Warning: Only do so when you know what you are doing. This allows for + * channels with virtually no security at all! + * + * This enables the following ciphersuites: + * MBEDTLS_TLS_RSA_WITH_DES_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_DES_CBC_SHA + * + * Uncomment this macro to enable weak ciphersuites + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers instead. + */ +//#define MBEDTLS_ENABLE_WEAK_CIPHERSUITES + +/** + * \def MBEDTLS_REMOVE_ARC4_CIPHERSUITES + * + * Remove RC4 ciphersuites by default in SSL / TLS. + * This flag removes the ciphersuites based on RC4 from the default list as + * returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible to + * enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including them + * explicitly. + * + * Uncomment this macro to remove RC4 ciphersuites by default. + */ +#define MBEDTLS_REMOVE_ARC4_CIPHERSUITES + +/** + * \def MBEDTLS_REMOVE_3DES_CIPHERSUITES + * + * Remove 3DES ciphersuites by default in SSL / TLS. + * This flag removes the ciphersuites based on 3DES from the default list as + * returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible + * to enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including + * them explicitly. + * + * A man-in-the-browser attacker can recover authentication tokens sent through + * a TLS connection using a 3DES based cipher suite (see "On the Practical + * (In-)Security of 64-bit Block Ciphers" by Karthikeyan Bhargavan and Gaëtan + * Leurent, see https://sweet32.info/SWEET32_CCS16.pdf). If this attack falls + * in your threat model or you are unsure, then you should keep this option + * enabled to remove 3DES based cipher suites. + * + * Comment this macro to keep 3DES in the default ciphersuite list. + */ +#define MBEDTLS_REMOVE_3DES_CIPHERSUITES + +/** + * \def MBEDTLS_ECP_DP_SECP192R1_ENABLED + * + * MBEDTLS_ECP_XXXX_ENABLED: Enables specific curves within the Elliptic Curve + * module. By default all supported curves are enabled. + * + * Comment macros to disable the curve and functions for it + */ +/* Short Weierstrass curves (supporting ECP, ECDH, ECDSA) */ +#define MBEDTLS_ECP_DP_SECP192R1_ENABLED +#define MBEDTLS_ECP_DP_SECP224R1_ENABLED +#define MBEDTLS_ECP_DP_SECP256R1_ENABLED +#define MBEDTLS_ECP_DP_SECP384R1_ENABLED +#define MBEDTLS_ECP_DP_SECP521R1_ENABLED +#define MBEDTLS_ECP_DP_SECP192K1_ENABLED +#define MBEDTLS_ECP_DP_SECP224K1_ENABLED +#define MBEDTLS_ECP_DP_SECP256K1_ENABLED +#define MBEDTLS_ECP_DP_BP256R1_ENABLED +#define MBEDTLS_ECP_DP_BP384R1_ENABLED +#define MBEDTLS_ECP_DP_BP512R1_ENABLED +/* Montgomery curves (supporting ECP) */ +#define MBEDTLS_ECP_DP_CURVE25519_ENABLED +#define MBEDTLS_ECP_DP_CURVE448_ENABLED + +/** + * \def MBEDTLS_ECP_NIST_OPTIM + * + * Enable specific 'modulo p' routines for each NIST prime. + * Depending on the prime and architecture, makes operations 4 to 8 times + * faster on the corresponding curve. + * + * Comment this macro to disable NIST curves optimisation. + */ +#define MBEDTLS_ECP_NIST_OPTIM + +/** + * \def MBEDTLS_ECP_NO_INTERNAL_RNG + * + * When this option is disabled, mbedtls_ecp_mul() will make use of an + * internal RNG when called with a NULL \c f_rng argument, in order to protect + * against some side-channel attacks. + * + * This protection introduces a dependency of the ECP module on one of the + * DRBG modules. For very constrained implementations that don't require this + * protection (for example, because you're only doing signature verification, + * so not manipulating any secret, or because local/physical side-channel + * attacks are outside your threat model), it might be desirable to get rid of + * that dependency. + * + * \warning Enabling this option makes some uses of ECP vulnerable to some + * side-channel attacks. Only enable it if you know that's not a problem for + * your use case. + * + * Uncomment this macro to disable some counter-measures in ECP. + */ +//#define MBEDTLS_ECP_NO_INTERNAL_RNG + +/** + * \def MBEDTLS_ECP_RESTARTABLE + * + * Enable "non-blocking" ECC operations that can return early and be resumed. + * + * This allows various functions to pause by returning + * #MBEDTLS_ERR_ECP_IN_PROGRESS (or, for functions in the SSL module, + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS) and then be called later again in + * order to further progress and eventually complete their operation. This is + * controlled through mbedtls_ecp_set_max_ops() which limits the maximum + * number of ECC operations a function may perform before pausing; see + * mbedtls_ecp_set_max_ops() for more information. + * + * This is useful in non-threaded environments if you want to avoid blocking + * for too long on ECC (and, hence, X.509 or SSL/TLS) operations. + * + * Uncomment this macro to enable restartable ECC computations. + * + * \note This option only works with the default software implementation of + * elliptic curve functionality. It is incompatible with + * MBEDTLS_ECP_ALT, MBEDTLS_ECDH_XXX_ALT, MBEDTLS_ECDSA_XXX_ALT + * and MBEDTLS_ECDH_LEGACY_CONTEXT. + */ +//#define MBEDTLS_ECP_RESTARTABLE + +/** + * \def MBEDTLS_ECDH_LEGACY_CONTEXT + * + * Use a backward compatible ECDH context. + * + * Mbed TLS supports two formats for ECDH contexts (#mbedtls_ecdh_context + * defined in `ecdh.h`). For most applications, the choice of format makes + * no difference, since all library functions can work with either format, + * except that the new format is incompatible with MBEDTLS_ECP_RESTARTABLE. + + * The new format used when this option is disabled is smaller + * (56 bytes on a 32-bit platform). In future versions of the library, it + * will support alternative implementations of ECDH operations. + * The new format is incompatible with applications that access + * context fields directly and with restartable ECP operations. + * + * Define this macro if you enable MBEDTLS_ECP_RESTARTABLE or if you + * want to access ECDH context fields directly. Otherwise you should + * comment out this macro definition. + * + * This option has no effect if #MBEDTLS_ECDH_C is not enabled. + * + * \note This configuration option is experimental. Future versions of the + * library may modify the way the ECDH context layout is configured + * and may modify the layout of the new context type. + */ +#define MBEDTLS_ECDH_LEGACY_CONTEXT + +/** + * \def MBEDTLS_ECDSA_DETERMINISTIC + * + * Enable deterministic ECDSA (RFC 6979). + * Standard ECDSA is "fragile" in the sense that lack of entropy when signing + * may result in a compromise of the long-term signing key. This is avoided by + * the deterministic variant. + * + * Requires: MBEDTLS_HMAC_DRBG_C, MBEDTLS_ECDSA_C + * + * Comment this macro to disable deterministic ECDSA. + */ +#define MBEDTLS_ECDSA_DETERMINISTIC + +/** + * \def MBEDTLS_KEY_EXCHANGE_PSK_ENABLED + * + * Enable the PSK based ciphersuite modes in SSL / TLS. + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED + * + * Enable the DHE-PSK based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_DHM_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA + * + * \warning Using DHE constitutes a security risk as it + * is not possible to validate custom DH parameters. + * If possible, it is recommended users should consider + * preferring other methods of key exchange. + * See dhm.h for more details. + * + */ +#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED + * + * Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED + * + * Enable the RSA-PSK based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED + * + * Enable the RSA-only based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 + */ +#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED + * + * Enable the DHE-RSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_DHM_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA + * + * \warning Using DHE constitutes a security risk as it + * is not possible to validate custom DH parameters. + * If possible, it is recommended users should consider + * preferring other methods of key exchange. + * See dhm.h for more details. + * + */ +#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED + * + * Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED + * + * Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, MBEDTLS_X509_CRT_PARSE_C, + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED + * + * Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + */ +#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED + * + * Enable the ECDH-RSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C, MBEDTLS_RSA_C, MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 + */ +#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED + * + * Enable the ECJPAKE based ciphersuite modes in SSL / TLS. + * + * \warning This is currently experimental. EC J-PAKE support is based on the + * Thread v1.0.0 specification; incompatible changes to the specification + * might still happen. For this reason, this is disabled by default. + * + * Requires: MBEDTLS_ECJPAKE_C + * MBEDTLS_SHA256_C + * MBEDTLS_ECP_DP_SECP256R1_ENABLED + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8 + */ +//#define MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED + +/** + * \def MBEDTLS_PK_PARSE_EC_EXTENDED + * + * Enhance support for reading EC keys using variants of SEC1 not allowed by + * RFC 5915 and RFC 5480. + * + * Currently this means parsing the SpecifiedECDomain choice of EC + * parameters (only known groups are supported, not arbitrary domains, to + * avoid validation issues). + * + * Disable if you only need to support RFC 5915 + 5480 key formats. + */ +#define MBEDTLS_PK_PARSE_EC_EXTENDED + +/** + * \def MBEDTLS_ERROR_STRERROR_DUMMY + * + * Enable a dummy error function to make use of mbedtls_strerror() in + * third party libraries easier when MBEDTLS_ERROR_C is disabled + * (no effect when MBEDTLS_ERROR_C is enabled). + * + * You can safely disable this if MBEDTLS_ERROR_C is enabled, or if you're + * not using mbedtls_strerror() or error_strerror() in your application. + * + * Disable if you run into name conflicts and want to really remove the + * mbedtls_strerror() + */ +#define MBEDTLS_ERROR_STRERROR_DUMMY + +/** + * \def MBEDTLS_GENPRIME + * + * Enable the prime-number generation code. + * + * Requires: MBEDTLS_BIGNUM_C + */ +#define MBEDTLS_GENPRIME + +/** + * \def MBEDTLS_FS_IO + * + * Enable functions that use the filesystem. + */ +#define MBEDTLS_FS_IO + +/** + * \def MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES + * + * Do not add default entropy sources. These are the platform specific, + * mbedtls_timing_hardclock and HAVEGE based poll functions. + * + * This is useful to have more control over the added entropy sources in an + * application. + * + * Uncomment this macro to prevent loading of default entropy functions. + */ +//#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES + +/** + * \def MBEDTLS_NO_PLATFORM_ENTROPY + * + * Do not use built-in platform entropy functions. + * This is useful if your platform does not support + * standards like the /dev/urandom or Windows CryptoAPI. + * + * Uncomment this macro to disable the built-in platform entropy functions. + */ +//#define MBEDTLS_NO_PLATFORM_ENTROPY + +/** + * \def MBEDTLS_ENTROPY_FORCE_SHA256 + * + * Force the entropy accumulator to use a SHA-256 accumulator instead of the + * default SHA-512 based one (if both are available). + * + * Requires: MBEDTLS_SHA256_C + * + * On 32-bit systems SHA-256 can be much faster than SHA-512. Use this option + * if you have performance concerns. + * + * This option is only useful if both MBEDTLS_SHA256_C and + * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used. + */ +//#define MBEDTLS_ENTROPY_FORCE_SHA256 + +/** + * \def MBEDTLS_ENTROPY_NV_SEED + * + * Enable the non-volatile (NV) seed file-based entropy source. + * (Also enables the NV seed read/write functions in the platform layer) + * + * This is crucial (if not required) on systems that do not have a + * cryptographic entropy source (in hardware or kernel) available. + * + * Requires: MBEDTLS_ENTROPY_C, MBEDTLS_PLATFORM_C + * + * \note The read/write functions that are used by the entropy source are + * determined in the platform layer, and can be modified at runtime and/or + * compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used. + * + * \note If you use the default implementation functions that read a seedfile + * with regular fopen(), please make sure you make a seedfile with the + * proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at + * least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from + * and written to or you will get an entropy source error! The default + * implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE + * bytes from the file. + * + * \note The entropy collector will write to the seed file before entropy is + * given to an external source, to update it. + */ +//#define MBEDTLS_ENTROPY_NV_SEED + +/* MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER + * + * Enable key identifiers that encode a key owner identifier. + * + * The owner of a key is identified by a value of type ::mbedtls_key_owner_id_t + * which is currently hard-coded to be int32_t. + * + * Note that this option is meant for internal use only and may be removed + * without notice. It is incompatible with MBEDTLS_USE_PSA_CRYPTO. + */ +//#define MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER + +/** + * \def MBEDTLS_MEMORY_DEBUG + * + * Enable debugging of buffer allocator memory issues. Automatically prints + * (to stderr) all (fatal) messages on memory allocation issues. Enables + * function for 'debug output' of allocated memory. + * + * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C + * + * Uncomment this macro to let the buffer allocator print out error messages. + */ +//#define MBEDTLS_MEMORY_DEBUG + +/** + * \def MBEDTLS_MEMORY_BACKTRACE + * + * Include backtrace information with each allocated block. + * + * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C + * GLIBC-compatible backtrace() an backtrace_symbols() support + * + * Uncomment this macro to include backtrace information + */ +//#define MBEDTLS_MEMORY_BACKTRACE + +/** + * \def MBEDTLS_PK_RSA_ALT_SUPPORT + * + * Support external private RSA keys (eg from a HSM) in the PK layer. + * + * Comment this macro to disable support for external private RSA keys. + */ +#define MBEDTLS_PK_RSA_ALT_SUPPORT + +/** + * \def MBEDTLS_PKCS1_V15 + * + * Enable support for PKCS#1 v1.5 encoding. + * + * Requires: MBEDTLS_RSA_C + * + * This enables support for PKCS#1 v1.5 operations. + */ +#define MBEDTLS_PKCS1_V15 + +/** + * \def MBEDTLS_PKCS1_V21 + * + * Enable support for PKCS#1 v2.1 encoding. + * + * Requires: MBEDTLS_MD_C, MBEDTLS_RSA_C + * + * This enables support for RSAES-OAEP and RSASSA-PSS operations. + */ +#define MBEDTLS_PKCS1_V21 + +/** \def MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS + * + * Enable support for platform built-in keys. If you enable this feature, + * you must implement the function mbedtls_psa_platform_get_builtin_key(). + * See the documentation of that function for more information. + * + * Built-in keys are typically derived from a hardware unique key or + * stored in a secure element. + * + * Requires: MBEDTLS_PSA_CRYPTO_C. + * + * \warning This interface is experimental and may change or be removed + * without notice. + */ +//#define MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS + +/** \def MBEDTLS_PSA_CRYPTO_CLIENT + * + * Enable support for PSA crypto client. + * + * \note This option allows to include the code necessary for a PSA + * crypto client when the PSA crypto implementation is not included in + * the library (MBEDTLS_PSA_CRYPTO_C disabled). The code included is the + * code to set and get PSA key attributes. + * The development of PSA drivers partially relying on the library to + * fulfill the hardware gaps is another possible usage of this option. + * + * \warning This interface is experimental and may change or be removed + * without notice. + */ +//#define MBEDTLS_PSA_CRYPTO_CLIENT + +/** \def MBEDTLS_PSA_CRYPTO_DRIVERS + * + * Enable support for the experimental PSA crypto driver interface. + * + * Requires: MBEDTLS_PSA_CRYPTO_C + * + * \warning This interface is experimental and may change or be removed + * without notice. + */ +//#define MBEDTLS_PSA_CRYPTO_DRIVERS + +/** \def MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG + * + * Make the PSA Crypto module use an external random generator provided + * by a driver, instead of Mbed TLS's entropy and DRBG modules. + * + * \note This random generator must deliver random numbers with cryptographic + * quality and high performance. It must supply unpredictable numbers + * with a uniform distribution. The implementation of this function + * is responsible for ensuring that the random generator is seeded + * with sufficient entropy. If you have a hardware TRNG which is slow + * or delivers non-uniform output, declare it as an entropy source + * with mbedtls_entropy_add_source() instead of enabling this option. + * + * If you enable this option, you must configure the type + * ::mbedtls_psa_external_random_context_t in psa/crypto_platform.h + * and define a function called mbedtls_psa_external_get_random() + * with the following prototype: + * ``` + * psa_status_t mbedtls_psa_external_get_random( + * mbedtls_psa_external_random_context_t *context, + * uint8_t *output, size_t output_size, size_t *output_length); + * ); + * ``` + * The \c context value is initialized to 0 before the first call. + * The function must fill the \c output buffer with \p output_size bytes + * of random data and set \c *output_length to \p output_size. + * + * Requires: MBEDTLS_PSA_CRYPTO_C + * + * \warning If you enable this option, code that uses the PSA cryptography + * interface will not use any of the entropy sources set up for + * the entropy module, nor the NV seed that MBEDTLS_ENTROPY_NV_SEED + * enables. + * + * \note This option is experimental and may be removed without notice. + */ +//#define MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG + +/** + * \def MBEDTLS_PSA_CRYPTO_SPM + * + * When MBEDTLS_PSA_CRYPTO_SPM is defined, the code is built for SPM (Secure + * Partition Manager) integration which separates the code into two parts: a + * NSPE (Non-Secure Process Environment) and an SPE (Secure Process + * Environment). + * + * Module: library/psa_crypto.c + * Requires: MBEDTLS_PSA_CRYPTO_C + * + */ +//#define MBEDTLS_PSA_CRYPTO_SPM + +/** + * \def MBEDTLS_PSA_INJECT_ENTROPY + * + * Enable support for entropy injection at first boot. This feature is + * required on systems that do not have a built-in entropy source (TRNG). + * This feature is currently not supported on systems that have a built-in + * entropy source. + * + * Requires: MBEDTLS_PSA_CRYPTO_STORAGE_C, MBEDTLS_ENTROPY_NV_SEED + * + */ +//#define MBEDTLS_PSA_INJECT_ENTROPY + +/** + * \def MBEDTLS_RSA_NO_CRT + * + * Do not use the Chinese Remainder Theorem + * for the RSA private operation. + * + * Uncomment this macro to disable the use of CRT in RSA. + * + */ +//#define MBEDTLS_RSA_NO_CRT + +/** + * \def MBEDTLS_SELF_TEST + * + * Enable the checkup functions (*_self_test). + */ +#define MBEDTLS_SELF_TEST + +/** + * \def MBEDTLS_SHA256_SMALLER + * + * Enable an implementation of SHA-256 that has lower ROM footprint but also + * lower performance. + * + * The default implementation is meant to be a reasonable compromise between + * performance and size. This version optimizes more aggressively for size at + * the expense of performance. Eg on Cortex-M4 it reduces the size of + * mbedtls_sha256_process() from ~2KB to ~0.5KB for a performance hit of about + * 30%. + * + * Uncomment to enable the smaller implementation of SHA256. + */ +//#define MBEDTLS_SHA256_SMALLER + +/** + * \def MBEDTLS_SHA512_SMALLER + * + * Enable an implementation of SHA-512 that has lower ROM footprint but also + * lower performance. + * + * Uncomment to enable the smaller implementation of SHA512. + */ +//#define MBEDTLS_SHA512_SMALLER + +/** + * \def MBEDTLS_SHA512_NO_SHA384 + * + * Disable the SHA-384 option of the SHA-512 module. Use this to save some + * code size on devices that don't use SHA-384. + * + * Requires: MBEDTLS_SHA512_C + * + * Uncomment to disable SHA-384 + */ +//#define MBEDTLS_SHA512_NO_SHA384 + +/** + * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES + * + * Enable sending of alert messages in case of encountered errors as per RFC. + * If you choose not to send the alert messages, mbed TLS can still communicate + * with other servers, only debugging of failures is harder. + * + * The advantage of not sending alert messages, is that no information is given + * about reasons for failures thus preventing adversaries of gaining intel. + * + * Enable sending of all alert messages + */ +#define MBEDTLS_SSL_ALL_ALERT_MESSAGES + +/** + * \def MBEDTLS_SSL_RECORD_CHECKING + * + * Enable the function mbedtls_ssl_check_record() which can be used to check + * the validity and authenticity of an incoming record, to verify that it has + * not been seen before. These checks are performed without modifying the + * externally visible state of the SSL context. + * + * See mbedtls_ssl_check_record() for more information. + * + * Uncomment to enable support for record checking. + */ +#define MBEDTLS_SSL_RECORD_CHECKING + +/** + * \def MBEDTLS_SSL_DTLS_CONNECTION_ID + * + * Enable support for the DTLS Connection ID extension + * (version draft-ietf-tls-dtls-connection-id-05, + * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05) + * which allows to identify DTLS connections across changes + * in the underlying transport. + * + * Setting this option enables the SSL APIs `mbedtls_ssl_set_cid()`, + * `mbedtls_ssl_get_peer_cid()` and `mbedtls_ssl_conf_cid()`. + * See the corresponding documentation for more information. + * + * \warning The Connection ID extension is still in draft state. + * We make no stability promises for the availability + * or the shape of the API controlled by this option. + * + * The maximum lengths of outgoing and incoming CIDs can be configured + * through the options + * - MBEDTLS_SSL_CID_OUT_LEN_MAX + * - MBEDTLS_SSL_CID_IN_LEN_MAX. + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + * + * Uncomment to enable the Connection ID extension. + */ +//#define MBEDTLS_SSL_DTLS_CONNECTION_ID + +/** + * \def MBEDTLS_SSL_ASYNC_PRIVATE + * + * Enable asynchronous external private key operations in SSL. This allows + * you to configure an SSL connection to call an external cryptographic + * module to perform private key operations instead of performing the + * operation inside the library. + * + */ +//#define MBEDTLS_SSL_ASYNC_PRIVATE + +/** + * \def MBEDTLS_SSL_CONTEXT_SERIALIZATION + * + * Enable serialization of the TLS context structures, through use of the + * functions mbedtls_ssl_context_save() and mbedtls_ssl_context_load(). + * + * This pair of functions allows one side of a connection to serialize the + * context associated with the connection, then free or re-use that context + * while the serialized state is persisted elsewhere, and finally deserialize + * that state to a live context for resuming read/write operations on the + * connection. From a protocol perspective, the state of the connection is + * unaffected, in particular this is entirely transparent to the peer. + * + * Note: this is distinct from TLS session resumption, which is part of the + * protocol and fully visible by the peer. TLS session resumption enables + * establishing new connections associated to a saved session with shorter, + * lighter handshakes, while context serialization is a local optimization in + * handling a single, potentially long-lived connection. + * + * Enabling these APIs makes some SSL structures larger, as 64 extra bytes are + * saved after the handshake to allow for more efficient serialization, so if + * you don't need this feature you'll save RAM by disabling it. + * + * Comment to disable the context serialization APIs. + */ +#define MBEDTLS_SSL_CONTEXT_SERIALIZATION + +/** + * \def MBEDTLS_SSL_DEBUG_ALL + * + * Enable the debug messages in SSL module for all issues. + * Debug messages have been disabled in some places to prevent timing + * attacks due to (unbalanced) debugging function calls. + * + * If you need all error reporting you should enable this during debugging, + * but remove this for production servers that should log as well. + * + * Uncomment this macro to report all debug messages on errors introducing + * a timing side-channel. + * + */ +//#define MBEDTLS_SSL_DEBUG_ALL + +/** \def MBEDTLS_SSL_ENCRYPT_THEN_MAC + * + * Enable support for Encrypt-then-MAC, RFC 7366. + * + * This allows peers that both support it to use a more robust protection for + * ciphersuites using CBC, providing deep resistance against timing attacks + * on the padding or underlying cipher. + * + * This only affects CBC ciphersuites, and is useless if none is defined. + * + * Requires: MBEDTLS_SSL_PROTO_TLS1 or + * MBEDTLS_SSL_PROTO_TLS1_1 or + * MBEDTLS_SSL_PROTO_TLS1_2 + * + * Comment this macro to disable support for Encrypt-then-MAC + */ +#define MBEDTLS_SSL_ENCRYPT_THEN_MAC + +/** \def MBEDTLS_SSL_EXTENDED_MASTER_SECRET + * + * Enable support for RFC 7627: Session Hash and Extended Master Secret + * Extension. + * + * This was introduced as "the proper fix" to the Triple Handshake family of + * attacks, but it is recommended to always use it (even if you disable + * renegotiation), since it actually fixes a more fundamental issue in the + * original SSL/TLS design, and has implications beyond Triple Handshake. + * + * Requires: MBEDTLS_SSL_PROTO_TLS1 or + * MBEDTLS_SSL_PROTO_TLS1_1 or + * MBEDTLS_SSL_PROTO_TLS1_2 + * + * Comment this macro to disable support for Extended Master Secret. + */ +#define MBEDTLS_SSL_EXTENDED_MASTER_SECRET + +/** + * \def MBEDTLS_SSL_FALLBACK_SCSV + * + * Enable support for RFC 7507: Fallback Signaling Cipher Suite Value (SCSV) + * for Preventing Protocol Downgrade Attacks. + * + * For servers, it is recommended to always enable this, unless you support + * only one version of TLS, or know for sure that none of your clients + * implements a fallback strategy. + * + * For clients, you only need this if you're using a fallback strategy, which + * is not recommended in the first place, unless you absolutely need it to + * interoperate with buggy (version-intolerant) servers. + * + * Comment this macro to disable support for FALLBACK_SCSV + */ +#define MBEDTLS_SSL_FALLBACK_SCSV + +/** + * \def MBEDTLS_SSL_KEEP_PEER_CERTIFICATE + * + * This option controls the availability of the API mbedtls_ssl_get_peer_cert() + * giving access to the peer's certificate after completion of the handshake. + * + * Unless you need mbedtls_ssl_peer_cert() in your application, it is + * recommended to disable this option for reduced RAM usage. + * + * \note If this option is disabled, mbedtls_ssl_get_peer_cert() is still + * defined, but always returns \c NULL. + * + * \note This option has no influence on the protection against the + * triple handshake attack. Even if it is disabled, Mbed TLS will + * still ensure that certificates do not change during renegotiation, + * for example by keeping a hash of the peer's certificate. + * + * Comment this macro to disable storing the peer's certificate + * after the handshake. + */ +#define MBEDTLS_SSL_KEEP_PEER_CERTIFICATE + +/** + * \def MBEDTLS_SSL_HW_RECORD_ACCEL + * + * Enable hooking functions in SSL module for hardware acceleration of + * individual records. + * + * \deprecated This option is deprecated and will be removed in a future + * version of Mbed TLS. + * + * Uncomment this macro to enable hooking functions. + */ +//#define MBEDTLS_SSL_HW_RECORD_ACCEL + +/** + * \def MBEDTLS_SSL_CBC_RECORD_SPLITTING + * + * Enable 1/n-1 record splitting for CBC mode in SSLv3 and TLS 1.0. + * + * This is a countermeasure to the BEAST attack, which also minimizes the risk + * of interoperability issues compared to sending 0-length records. + * + * Comment this macro to disable 1/n-1 record splitting. + */ +#define MBEDTLS_SSL_CBC_RECORD_SPLITTING + +/** + * \def MBEDTLS_SSL_RENEGOTIATION + * + * Enable support for TLS renegotiation. + * + * The two main uses of renegotiation are (1) refresh keys on long-lived + * connections and (2) client authentication after the initial handshake. + * If you don't need renegotiation, it's probably better to disable it, since + * it has been associated with security issues in the past and is easy to + * misuse/misunderstand. + * + * Comment this to disable support for renegotiation. + * + * \note Even if this option is disabled, both client and server are aware + * of the Renegotiation Indication Extension (RFC 5746) used to + * prevent the SSL renegotiation attack (see RFC 5746 Sect. 1). + * (See \c mbedtls_ssl_conf_legacy_renegotiation for the + * configuration of this extension). + * + */ +#define MBEDTLS_SSL_RENEGOTIATION + +/** + * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO + * + * Enable support for receiving and parsing SSLv2 Client Hello messages for the + * SSL Server module (MBEDTLS_SSL_SRV_C). + * + * \deprecated This option is deprecated and will be removed in a future + * version of Mbed TLS. + * + * Uncomment this macro to enable support for SSLv2 Client Hello messages. + */ +//#define MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO + +/** + * \def MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE + * + * Pick the ciphersuite according to the client's preferences rather than ours + * in the SSL Server module (MBEDTLS_SSL_SRV_C). + * + * Uncomment this macro to respect client's ciphersuite order + */ +//#define MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE + +/** + * \def MBEDTLS_SSL_MAX_FRAGMENT_LENGTH + * + * Enable support for RFC 6066 max_fragment_length extension in SSL. + * + * Comment this macro to disable support for the max_fragment_length extension + */ +#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH + +/** + * \def MBEDTLS_SSL_PROTO_SSL3 + * + * Enable support for SSL 3.0. + * + * Requires: MBEDTLS_MD5_C + * MBEDTLS_SHA1_C + * + * \deprecated This option is deprecated and will be removed in a future + * version of Mbed TLS. + * + * Comment this macro to disable support for SSL 3.0 + */ +//#define MBEDTLS_SSL_PROTO_SSL3 + +/** + * \def MBEDTLS_SSL_PROTO_TLS1 + * + * Enable support for TLS 1.0. + * + * Requires: MBEDTLS_MD5_C + * MBEDTLS_SHA1_C + * + * Comment this macro to disable support for TLS 1.0 + */ +#define MBEDTLS_SSL_PROTO_TLS1 + +/** + * \def MBEDTLS_SSL_PROTO_TLS1_1 + * + * Enable support for TLS 1.1 (and DTLS 1.0 if DTLS is enabled). + * + * Requires: MBEDTLS_MD5_C + * MBEDTLS_SHA1_C + * + * Comment this macro to disable support for TLS 1.1 / DTLS 1.0 + */ +#define MBEDTLS_SSL_PROTO_TLS1_1 + +/** + * \def MBEDTLS_SSL_PROTO_TLS1_2 + * + * Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled). + * + * Requires: MBEDTLS_SHA1_C or MBEDTLS_SHA256_C or MBEDTLS_SHA512_C + * (Depends on ciphersuites) + * + * Comment this macro to disable support for TLS 1.2 / DTLS 1.2 + */ +#define MBEDTLS_SSL_PROTO_TLS1_2 + +/** + * \def MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL + * + * This macro is used to selectively enable experimental parts + * of the code that contribute to the ongoing development of + * the prototype TLS 1.3 and DTLS 1.3 implementation, and provide + * no other purpose. + * + * \warning TLS 1.3 and DTLS 1.3 aren't yet supported in Mbed TLS, + * and no feature exposed through this macro is part of the + * public API. In particular, features under the control + * of this macro are experimental and don't come with any + * stability guarantees. + * + * Uncomment this macro to enable experimental and partial + * functionality specific to TLS 1.3. + */ +//#define MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL + +/** + * \def MBEDTLS_SSL_PROTO_DTLS + * + * Enable support for DTLS (all available versions). + * + * Enable this and MBEDTLS_SSL_PROTO_TLS1_1 to enable DTLS 1.0, + * and/or this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2. + * + * Requires: MBEDTLS_SSL_PROTO_TLS1_1 + * or MBEDTLS_SSL_PROTO_TLS1_2 + * + * Comment this macro to disable support for DTLS + */ +#define MBEDTLS_SSL_PROTO_DTLS + +/** + * \def MBEDTLS_SSL_ALPN + * + * Enable support for RFC 7301 Application Layer Protocol Negotiation. + * + * Comment this macro to disable support for ALPN. + */ +#define MBEDTLS_SSL_ALPN + +/** + * \def MBEDTLS_SSL_DTLS_ANTI_REPLAY + * + * Enable support for the anti-replay mechanism in DTLS. + * + * Requires: MBEDTLS_SSL_TLS_C + * MBEDTLS_SSL_PROTO_DTLS + * + * \warning Disabling this is often a security risk! + * See mbedtls_ssl_conf_dtls_anti_replay() for details. + * + * Comment this to disable anti-replay in DTLS. + */ +#define MBEDTLS_SSL_DTLS_ANTI_REPLAY + +/** + * \def MBEDTLS_SSL_DTLS_HELLO_VERIFY + * + * Enable support for HelloVerifyRequest on DTLS servers. + * + * This feature is highly recommended to prevent DTLS servers being used as + * amplifiers in DoS attacks against other hosts. It should always be enabled + * unless you know for sure amplification cannot be a problem in the + * environment in which your server operates. + * + * \warning Disabling this can be a security risk! (see above) + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + * + * Comment this to disable support for HelloVerifyRequest. + */ +#define MBEDTLS_SSL_DTLS_HELLO_VERIFY + +/** + * \def MBEDTLS_SSL_DTLS_SRTP + * + * Enable support for negotiation of DTLS-SRTP (RFC 5764) + * through the use_srtp extension. + * + * \note This feature provides the minimum functionality required + * to negotiate the use of DTLS-SRTP and to allow the derivation of + * the associated SRTP packet protection key material. + * In particular, the SRTP packet protection itself, as well as the + * demultiplexing of RTP and DTLS packets at the datagram layer + * (see Section 5 of RFC 5764), are not handled by this feature. + * Instead, after successful completion of a handshake negotiating + * the use of DTLS-SRTP, the extended key exporter API + * mbedtls_ssl_conf_export_keys_ext_cb() should be used to implement + * the key exporter described in Section 4.2 of RFC 5764 and RFC 5705 + * (this is implemented in the SSL example programs). + * The resulting key should then be passed to an SRTP stack. + * + * Setting this option enables the runtime API + * mbedtls_ssl_conf_dtls_srtp_protection_profiles() + * through which the supported DTLS-SRTP protection + * profiles can be configured. You must call this API at + * runtime if you wish to negotiate the use of DTLS-SRTP. + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + * + * Uncomment this to enable support for use_srtp extension. + */ +//#define MBEDTLS_SSL_DTLS_SRTP + +/** + * \def MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE + * + * Enable server-side support for clients that reconnect from the same port. + * + * Some clients unexpectedly close the connection and try to reconnect using the + * same source port. This needs special support from the server to handle the + * new connection securely, as described in section 4.2.8 of RFC 6347. This + * flag enables that support. + * + * Requires: MBEDTLS_SSL_DTLS_HELLO_VERIFY + * + * Comment this to disable support for clients reusing the source port. + */ +#define MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE + +/** + * \def MBEDTLS_SSL_DTLS_BADMAC_LIMIT + * + * Enable support for a limit of records with bad MAC. + * + * See mbedtls_ssl_conf_dtls_badmac_limit(). + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + */ +#define MBEDTLS_SSL_DTLS_BADMAC_LIMIT + +/** + * \def MBEDTLS_SSL_SESSION_TICKETS + * + * Enable support for RFC 5077 session tickets in SSL. + * Client-side, provides full support for session tickets (maintenance of a + * session store remains the responsibility of the application, though). + * Server-side, you also need to provide callbacks for writing and parsing + * tickets, including authenticated encryption and key management. Example + * callbacks are provided by MBEDTLS_SSL_TICKET_C. + * + * Comment this macro to disable support for SSL session tickets + */ +#define MBEDTLS_SSL_SESSION_TICKETS + +/** + * \def MBEDTLS_SSL_EXPORT_KEYS + * + * Enable support for exporting key block and master secret. + * This is required for certain users of TLS, e.g. EAP-TLS. + * + * Comment this macro to disable support for key export + */ +#define MBEDTLS_SSL_EXPORT_KEYS + +/** + * \def MBEDTLS_SSL_SERVER_NAME_INDICATION + * + * Enable support for RFC 6066 server name indication (SNI) in SSL. + * + * Requires: MBEDTLS_X509_CRT_PARSE_C + * + * Comment this macro to disable support for server name indication in SSL + */ +#define MBEDTLS_SSL_SERVER_NAME_INDICATION + +/** + * \def MBEDTLS_SSL_TRUNCATED_HMAC + * + * Enable support for RFC 6066 truncated HMAC in SSL. + * + * Comment this macro to disable support for truncated HMAC in SSL + */ +#define MBEDTLS_SSL_TRUNCATED_HMAC + +/** + * \def MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT + * + * Fallback to old (pre-2.7), non-conforming implementation of the truncated + * HMAC extension which also truncates the HMAC key. Note that this option is + * only meant for a transitory upgrade period and will be removed in a future + * version of the library. + * + * \warning The old implementation is non-compliant and has a security weakness + * (2^80 brute force attack on the HMAC key used for a single, + * uninterrupted connection). This should only be enabled temporarily + * when (1) the use of truncated HMAC is essential in order to save + * bandwidth, and (2) the peer is an Mbed TLS stack that doesn't use + * the fixed implementation yet (pre-2.7). + * + * \deprecated This option is deprecated and will be removed in a + * future version of Mbed TLS. + * + * Uncomment to fallback to old, non-compliant truncated HMAC implementation. + * + * Requires: MBEDTLS_SSL_TRUNCATED_HMAC + */ +//#define MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT + +/** + * \def MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH + * + * When this option is enabled, the SSL buffer will be resized automatically + * based on the negotiated maximum fragment length in each direction. + * + * Requires: MBEDTLS_SSL_MAX_FRAGMENT_LENGTH + */ +//#define MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH + +/** + * \def MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN + * + * Enable testing of the constant-flow nature of some sensitive functions with + * clang's MemorySanitizer. This causes some existing tests to also test + * this non-functional property of the code under test. + * + * This setting requires compiling with clang -fsanitize=memory. The test + * suites can then be run normally. + * + * \warning This macro is only used for extended testing; it is not considered + * part of the library's API, so it may change or disappear at any time. + * + * Uncomment to enable testing of the constant-flow nature of selected code. + */ +//#define MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN + +/** + * \def MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND + * + * Enable testing of the constant-flow nature of some sensitive functions with + * valgrind's memcheck tool. This causes some existing tests to also test + * this non-functional property of the code under test. + * + * This setting requires valgrind headers for building, and is only useful for + * testing if the tests suites are run with valgrind's memcheck. This can be + * done for an individual test suite with 'valgrind ./test_suite_xxx', or when + * using CMake, this can be done for all test suites with 'make memcheck'. + * + * \warning This macro is only used for extended testing; it is not considered + * part of the library's API, so it may change or disappear at any time. + * + * Uncomment to enable testing of the constant-flow nature of selected code. + */ +//#define MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND + +/** + * \def MBEDTLS_TEST_HOOKS + * + * Enable features for invasive testing such as introspection functions and + * hooks for fault injection. This enables additional unit tests. + * + * Merely enabling this feature should not change the behavior of the product. + * It only adds new code, and new branching points where the default behavior + * is the same as when this feature is disabled. + * However, this feature increases the attack surface: there is an added + * risk of vulnerabilities, and more gadgets that can make exploits easier. + * Therefore this feature must never be enabled in production. + * + * See `docs/architecture/testing/mbed-crypto-invasive-testing.md` for more + * information. + * + * Uncomment to enable invasive tests. + */ +//#define MBEDTLS_TEST_HOOKS + +/** + * \def MBEDTLS_THREADING_ALT + * + * Provide your own alternate threading implementation. + * + * Requires: MBEDTLS_THREADING_C + * + * Uncomment this to allow your own alternate threading implementation. + */ +//#define MBEDTLS_THREADING_ALT + +/** + * \def MBEDTLS_THREADING_PTHREAD + * + * Enable the pthread wrapper layer for the threading layer. + * + * Requires: MBEDTLS_THREADING_C + * + * Uncomment this to enable pthread mutexes. + */ +//#define MBEDTLS_THREADING_PTHREAD + +/** + * \def MBEDTLS_USE_PSA_CRYPTO + * + * Make the X.509 and TLS library use PSA for cryptographic operations, and + * enable new APIs for using keys handled by PSA Crypto. + * + * \note Development of this option is currently in progress, and parts of Mbed + * TLS's X.509 and TLS modules are not ported to PSA yet. However, these parts + * will still continue to work as usual, so enabling this option should not + * break backwards compatibility. + * + * \note See docs/use-psa-crypto.md for a complete description of what this + * option currently does, and of parts that are not affected by it so far. + * + * \warning This option enables new Mbed TLS APIs which are currently + * considered experimental and may change in incompatible ways at any time. + * That is, the APIs enabled by this option are not covered by the usual + * promises of API stability. + * + * Requires: MBEDTLS_PSA_CRYPTO_C. + * + * Uncomment this to enable internal use of PSA Crypto and new associated APIs. + */ +//#define MBEDTLS_USE_PSA_CRYPTO + +/** + * \def MBEDTLS_PSA_CRYPTO_CONFIG + * + * This setting allows support for cryptographic mechanisms through the PSA + * API to be configured separately from support through the mbedtls API. + * + * When this option is disabled, the PSA API exposes the cryptographic + * mechanisms that can be implemented on top of the `mbedtls_xxx` API + * configured with `MBEDTLS_XXX` symbols. + * + * When this option is enabled, the PSA API exposes the cryptographic + * mechanisms requested by the `PSA_WANT_XXX` symbols defined in + * include/psa/crypto_config.h. The corresponding `MBEDTLS_XXX` settings are + * automatically enabled if required (i.e. if no PSA driver provides the + * mechanism). You may still freely enable additional `MBEDTLS_XXX` symbols + * in config.h. + * + * If the symbol #MBEDTLS_PSA_CRYPTO_CONFIG_FILE is defined, it specifies + * an alternative header to include instead of include/psa/crypto_config.h. + * + * If you enable this option and write your own configuration file, you must + * include mbedtls/config_psa.h in your configuration file. The default + * provided mbedtls/config.h contains the necessary inclusion. + * + * This feature is still experimental and is not ready for production since + * it is not completed. + */ +//#define MBEDTLS_PSA_CRYPTO_CONFIG + +/** + * \def MBEDTLS_VERSION_FEATURES + * + * Allow run-time checking of compile-time enabled features. Thus allowing users + * to check at run-time if the library is for instance compiled with threading + * support via mbedtls_version_check_feature(). + * + * Requires: MBEDTLS_VERSION_C + * + * Comment this to disable run-time checking and save ROM space + */ +#define MBEDTLS_VERSION_FEATURES + +/** + * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 + * + * If set, the X509 parser will not break-off when parsing an X509 certificate + * and encountering an extension in a v1 or v2 certificate. + * + * Uncomment to prevent an error. + */ +//#define MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 + +/** + * \def MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION + * + * If set, the X509 parser will not break-off when parsing an X509 certificate + * and encountering an unknown critical extension. + * + * \warning Depending on your PKI use, enabling this can be a security risk! + * + * Uncomment to prevent an error. + */ +//#define MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION + +/** + * \def MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK + * + * If set, this enables the X.509 API `mbedtls_x509_crt_verify_with_ca_cb()` + * and the SSL API `mbedtls_ssl_conf_ca_cb()` which allow users to configure + * the set of trusted certificates through a callback instead of a linked + * list. + * + * This is useful for example in environments where a large number of trusted + * certificates is present and storing them in a linked list isn't efficient + * enough, or when the set of trusted certificates changes frequently. + * + * See the documentation of `mbedtls_x509_crt_verify_with_ca_cb()` and + * `mbedtls_ssl_conf_ca_cb()` for more information. + * + * Uncomment to enable trusted certificate callbacks. + */ +//#define MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK + +/** + * \def MBEDTLS_X509_CHECK_KEY_USAGE + * + * Enable verification of the keyUsage extension (CA and leaf certificates). + * + * Disabling this avoids problems with mis-issued and/or misused + * (intermediate) CA and leaf certificates. + * + * \warning Depending on your PKI use, disabling this can be a security risk! + * + * Comment to skip keyUsage checking for both CA and leaf certificates. + */ +#define MBEDTLS_X509_CHECK_KEY_USAGE + +/** + * \def MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE + * + * Enable verification of the extendedKeyUsage extension (leaf certificates). + * + * Disabling this avoids problems with mis-issued and/or misused certificates. + * + * \warning Depending on your PKI use, disabling this can be a security risk! + * + * Comment to skip extendedKeyUsage checking for certificates. + */ +#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE + +/** + * \def MBEDTLS_X509_RSASSA_PSS_SUPPORT + * + * Enable parsing and verification of X.509 certificates, CRLs and CSRS + * signed with RSASSA-PSS (aka PKCS#1 v2.1). + * + * Comment this macro to disallow using RSASSA-PSS in certificates. + */ +#define MBEDTLS_X509_RSASSA_PSS_SUPPORT + +/** + * \def MBEDTLS_ZLIB_SUPPORT + * + * If set, the SSL/TLS module uses ZLIB to support compression and + * decompression of packet data. + * + * \warning TLS-level compression MAY REDUCE SECURITY! See for example the + * CRIME attack. Before enabling this option, you should examine with care if + * CRIME or similar exploits may be applicable to your use case. + * + * \note Currently compression can't be used with DTLS. + * + * \deprecated This feature is deprecated and will be removed + * in the next major revision of the library. + * + * Used in: library/ssl_tls.c + * library/ssl_cli.c + * library/ssl_srv.c + * + * This feature requires zlib library and headers to be present. + * + * Uncomment to enable use of ZLIB + */ +//#define MBEDTLS_ZLIB_SUPPORT +/** \} name SECTION: mbed TLS feature support */ + +/** + * \name SECTION: mbed TLS modules + * + * This section enables or disables entire modules in mbed TLS + * \{ + */ + +/** + * \def MBEDTLS_AESNI_C + * + * Enable AES-NI support on x86-64. + * + * Module: library/aesni.c + * Caller: library/aes.c + * + * Requires: MBEDTLS_HAVE_ASM + * + * This modules adds support for the AES-NI instructions on x86-64 + */ +#define MBEDTLS_AESNI_C + +/** + * \def MBEDTLS_AES_C + * + * Enable the AES block cipher. + * + * Module: library/aes.c + * Caller: library/cipher.c + * library/pem.c + * library/ctr_drbg.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA + * + * PEM_PARSE uses AES for decrypting encrypted keys. + */ +#define MBEDTLS_AES_C + +/** + * \def MBEDTLS_ARC4_C + * + * Enable the ARCFOUR stream cipher. + * + * Module: library/arc4.c + * Caller: library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA + * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 + * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA + * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. If possible, we recommend avoidng dependencies on + * it, and considering stronger ciphers instead. + * + */ +#define MBEDTLS_ARC4_C + +/** + * \def MBEDTLS_ASN1_PARSE_C + * + * Enable the generic ASN1 parser. + * + * Module: library/asn1.c + * Caller: library/x509.c + * library/dhm.c + * library/pkcs12.c + * library/pkcs5.c + * library/pkparse.c + */ +#define MBEDTLS_ASN1_PARSE_C + +/** + * \def MBEDTLS_ASN1_WRITE_C + * + * Enable the generic ASN1 writer. + * + * Module: library/asn1write.c + * Caller: library/ecdsa.c + * library/pkwrite.c + * library/x509_create.c + * library/x509write_crt.c + * library/x509write_csr.c + */ +#define MBEDTLS_ASN1_WRITE_C + +/** + * \def MBEDTLS_BASE64_C + * + * Enable the Base64 module. + * + * Module: library/base64.c + * Caller: library/pem.c + * + * This module is required for PEM support (required by X.509). + */ +#define MBEDTLS_BASE64_C + +/** + * \def MBEDTLS_BIGNUM_C + * + * Enable the multi-precision integer library. + * + * Module: library/bignum.c + * Caller: library/dhm.c + * library/ecp.c + * library/ecdsa.c + * library/rsa.c + * library/rsa_internal.c + * library/ssl_tls.c + * + * This module is required for RSA, DHM and ECC (ECDH, ECDSA) support. + */ +#define MBEDTLS_BIGNUM_C + +/** + * \def MBEDTLS_BLOWFISH_C + * + * Enable the Blowfish block cipher. + * + * Module: library/blowfish.c + */ +#define MBEDTLS_BLOWFISH_C + +/** + * \def MBEDTLS_CAMELLIA_C + * + * Enable the Camellia block cipher. + * + * Module: library/camellia.c + * Caller: library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 + */ +#define MBEDTLS_CAMELLIA_C + +/** + * \def MBEDTLS_ARIA_C + * + * Enable the ARIA block cipher. + * + * Module: library/aria.c + * Caller: library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * + * MBEDTLS_TLS_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384 + */ +//#define MBEDTLS_ARIA_C + +/** + * \def MBEDTLS_CCM_C + * + * Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher. + * + * Module: library/ccm.c + * + * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C + * + * This module enables the AES-CCM ciphersuites, if other requisites are + * enabled as well. + */ +#define MBEDTLS_CCM_C + +/** + * \def MBEDTLS_CERTS_C + * + * Enable the test certificates. + * + * Module: library/certs.c + * Caller: + * + * This module is used for testing (ssl_client/server). + */ +#define MBEDTLS_CERTS_C + +/** + * \def MBEDTLS_CHACHA20_C + * + * Enable the ChaCha20 stream cipher. + * + * Module: library/chacha20.c + */ +#define MBEDTLS_CHACHA20_C + +/** + * \def MBEDTLS_CHACHAPOLY_C + * + * Enable the ChaCha20-Poly1305 AEAD algorithm. + * + * Module: library/chachapoly.c + * + * This module requires: MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C + */ +#define MBEDTLS_CHACHAPOLY_C + +/** + * \def MBEDTLS_CIPHER_C + * + * Enable the generic cipher layer. + * + * Module: library/cipher.c + * Caller: library/ssl_tls.c + * + * Uncomment to enable generic cipher wrappers. + */ +#define MBEDTLS_CIPHER_C + +/** + * \def MBEDTLS_CMAC_C + * + * Enable the CMAC (Cipher-based Message Authentication Code) mode for block + * ciphers. + * + * \note When #MBEDTLS_CMAC_ALT is active, meaning that the underlying + * implementation of the CMAC algorithm is provided by an alternate + * implementation, that alternate implementation may opt to not support + * AES-192 or 3DES as underlying block ciphers for the CMAC operation. + * + * Module: library/cmac.c + * + * Requires: MBEDTLS_AES_C or MBEDTLS_DES_C + * + */ +//#define MBEDTLS_CMAC_C + +/** + * \def MBEDTLS_CTR_DRBG_C + * + * Enable the CTR_DRBG AES-based random generator. + * The CTR_DRBG generator uses AES-256 by default. + * To use AES-128 instead, enable \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY above. + * + * \note To achieve a 256-bit security strength with CTR_DRBG, + * you must use AES-256 *and* use sufficient entropy. + * See ctr_drbg.h for more details. + * + * Module: library/ctr_drbg.c + * Caller: + * + * Requires: MBEDTLS_AES_C + * + * This module provides the CTR_DRBG AES random number generator. + */ +#define MBEDTLS_CTR_DRBG_C + +/** + * \def MBEDTLS_DEBUG_C + * + * Enable the debug functions. + * + * Module: library/debug.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * + * This module provides debugging functions. + */ +#define MBEDTLS_DEBUG_C + +/** + * \def MBEDTLS_DES_C + * + * Enable the DES block cipher. + * + * Module: library/des.c + * Caller: library/pem.c + * library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA + * + * PEM_PARSE uses DES/3DES for decrypting encrypted keys. + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers instead. + */ +#define MBEDTLS_DES_C + +/** + * \def MBEDTLS_DHM_C + * + * Enable the Diffie-Hellman-Merkle module. + * + * Module: library/dhm.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * + * This module is used by the following key exchanges: + * DHE-RSA, DHE-PSK + * + * \warning Using DHE constitutes a security risk as it + * is not possible to validate custom DH parameters. + * If possible, it is recommended users should consider + * preferring other methods of key exchange. + * See dhm.h for more details. + * + */ +#define MBEDTLS_DHM_C + +/** + * \def MBEDTLS_ECDH_C + * + * Enable the elliptic curve Diffie-Hellman library. + * + * Module: library/ecdh.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * + * This module is used by the following key exchanges: + * ECDHE-ECDSA, ECDHE-RSA, DHE-PSK + * + * Requires: MBEDTLS_ECP_C + */ +#define MBEDTLS_ECDH_C + +/** + * \def MBEDTLS_ECDSA_C + * + * Enable the elliptic curve DSA library. + * + * Module: library/ecdsa.c + * Caller: + * + * This module is used by the following key exchanges: + * ECDHE-ECDSA + * + * Requires: MBEDTLS_ECP_C, MBEDTLS_ASN1_WRITE_C, MBEDTLS_ASN1_PARSE_C, + * and at least one MBEDTLS_ECP_DP_XXX_ENABLED for a + * short Weierstrass curve. + */ +#define MBEDTLS_ECDSA_C + +/** + * \def MBEDTLS_ECJPAKE_C + * + * Enable the elliptic curve J-PAKE library. + * + * \warning This is currently experimental. EC J-PAKE support is based on the + * Thread v1.0.0 specification; incompatible changes to the specification + * might still happen. For this reason, this is disabled by default. + * + * Module: library/ecjpake.c + * Caller: + * + * This module is used by the following key exchanges: + * ECJPAKE + * + * Requires: MBEDTLS_ECP_C, MBEDTLS_MD_C + */ +//#define MBEDTLS_ECJPAKE_C + +/** + * \def MBEDTLS_ECP_C + * + * Enable the elliptic curve over GF(p) library. + * + * Module: library/ecp.c + * Caller: library/ecdh.c + * library/ecdsa.c + * library/ecjpake.c + * + * Requires: MBEDTLS_BIGNUM_C and at least one MBEDTLS_ECP_DP_XXX_ENABLED + */ +#define MBEDTLS_ECP_C + +/** + * \def MBEDTLS_ENTROPY_C + * + * Enable the platform-specific entropy code. + * + * Module: library/entropy.c + * Caller: + * + * Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C + * + * This module provides a generic entropy pool + */ +#define MBEDTLS_ENTROPY_C + +/** + * \def MBEDTLS_ERROR_C + * + * Enable error code to error string conversion. + * + * Module: library/error.c + * Caller: + * + * This module enables mbedtls_strerror(). + */ +#define MBEDTLS_ERROR_C + +/** + * \def MBEDTLS_GCM_C + * + * Enable the Galois/Counter Mode (GCM). + * + * Module: library/gcm.c + * + * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C or MBEDTLS_ARIA_C + * + * This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other + * requisites are enabled as well. + */ +#define MBEDTLS_GCM_C + +/** + * \def MBEDTLS_HAVEGE_C + * + * Enable the HAVEGE random generator. + * + * Warning: the HAVEGE random generator is not suitable for virtualized + * environments + * + * Warning: the HAVEGE random generator is dependent on timing and specific + * processor traits. It is therefore not advised to use HAVEGE as + * your applications primary random generator or primary entropy pool + * input. As a secondary input to your entropy pool, it IS able add + * the (limited) extra entropy it provides. + * + * Module: library/havege.c + * Caller: + * + * Requires: MBEDTLS_TIMING_C + * + * Uncomment to enable the HAVEGE random generator. + */ +//#define MBEDTLS_HAVEGE_C + +/** + * \def MBEDTLS_HKDF_C + * + * Enable the HKDF algorithm (RFC 5869). + * + * Module: library/hkdf.c + * Caller: + * + * Requires: MBEDTLS_MD_C + * + * This module adds support for the Hashed Message Authentication Code + * (HMAC)-based key derivation function (HKDF). + */ +#define MBEDTLS_HKDF_C + +/** + * \def MBEDTLS_HMAC_DRBG_C + * + * Enable the HMAC_DRBG random generator. + * + * Module: library/hmac_drbg.c + * Caller: + * + * Requires: MBEDTLS_MD_C + * + * Uncomment to enable the HMAC_DRBG random number generator. + */ +#define MBEDTLS_HMAC_DRBG_C + +/** + * \def MBEDTLS_NIST_KW_C + * + * Enable the Key Wrapping mode for 128-bit block ciphers, + * as defined in NIST SP 800-38F. Only KW and KWP modes + * are supported. At the moment, only AES is approved by NIST. + * + * Module: library/nist_kw.c + * + * Requires: MBEDTLS_AES_C and MBEDTLS_CIPHER_C + */ +//#define MBEDTLS_NIST_KW_C + +/** + * \def MBEDTLS_MD_C + * + * Enable the generic message digest layer. + * + * Module: library/md.c + * Caller: + * + * Uncomment to enable generic message digest wrappers. + */ +#define MBEDTLS_MD_C + +/** + * \def MBEDTLS_MD2_C + * + * Enable the MD2 hash algorithm. + * + * Module: library/md2.c + * Caller: + * + * Uncomment to enable support for (rare) MD2-signed X.509 certs. + * + * \warning MD2 is considered a weak message digest and its use constitutes a + * security risk. If possible, we recommend avoiding dependencies on + * it, and considering stronger message digests instead. + * + */ +//#define MBEDTLS_MD2_C + +/** + * \def MBEDTLS_MD4_C + * + * Enable the MD4 hash algorithm. + * + * Module: library/md4.c + * Caller: + * + * Uncomment to enable support for (rare) MD4-signed X.509 certs. + * + * \warning MD4 is considered a weak message digest and its use constitutes a + * security risk. If possible, we recommend avoiding dependencies on + * it, and considering stronger message digests instead. + * + */ +//#define MBEDTLS_MD4_C + +/** + * \def MBEDTLS_MD5_C + * + * Enable the MD5 hash algorithm. + * + * Module: library/md5.c + * Caller: library/md.c + * library/pem.c + * library/ssl_tls.c + * + * This module is required for SSL/TLS up to version 1.1, and for TLS 1.2 + * depending on the handshake parameters. Further, it is used for checking + * MD5-signed certificates, and for PBKDF1 when decrypting PEM-encoded + * encrypted keys. + * + * \warning MD5 is considered a weak message digest and its use constitutes a + * security risk. If possible, we recommend avoiding dependencies on + * it, and considering stronger message digests instead. + * + */ +#define MBEDTLS_MD5_C + +/** + * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C + * + * Enable the buffer allocator implementation that makes use of a (stack) + * based buffer to 'allocate' dynamic memory. (replaces calloc() and free() + * calls) + * + * Module: library/memory_buffer_alloc.c + * + * Requires: MBEDTLS_PLATFORM_C + * MBEDTLS_PLATFORM_MEMORY (to use it within mbed TLS) + * + * Enable this module to enable the buffer memory allocator. + */ +//#define MBEDTLS_MEMORY_BUFFER_ALLOC_C + +/** + * \def MBEDTLS_NET_C + * + * Enable the TCP and UDP over IPv6/IPv4 networking routines. + * + * \note This module only works on POSIX/Unix (including Linux, BSD and OS X) + * and Windows. For other platforms, you'll want to disable it, and write your + * own networking callbacks to be passed to \c mbedtls_ssl_set_bio(). + * + * \note See also our Knowledge Base article about porting to a new + * environment: + * https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS + * + * Module: library/net_sockets.c + * + * This module provides networking routines. + */ +#define MBEDTLS_NET_C + +/** + * \def MBEDTLS_OID_C + * + * Enable the OID database. + * + * Module: library/oid.c + * Caller: library/asn1write.c + * library/pkcs5.c + * library/pkparse.c + * library/pkwrite.c + * library/rsa.c + * library/x509.c + * library/x509_create.c + * library/x509_crl.c + * library/x509_crt.c + * library/x509_csr.c + * library/x509write_crt.c + * library/x509write_csr.c + * + * This modules translates between OIDs and internal values. + */ +#define MBEDTLS_OID_C + +/** + * \def MBEDTLS_PADLOCK_C + * + * Enable VIA Padlock support on x86. + * + * Module: library/padlock.c + * Caller: library/aes.c + * + * Requires: MBEDTLS_HAVE_ASM + * + * This modules adds support for the VIA PadLock on x86. + */ +#define MBEDTLS_PADLOCK_C + +/** + * \def MBEDTLS_PEM_PARSE_C + * + * Enable PEM decoding / parsing. + * + * Module: library/pem.c + * Caller: library/dhm.c + * library/pkparse.c + * library/x509_crl.c + * library/x509_crt.c + * library/x509_csr.c + * + * Requires: MBEDTLS_BASE64_C + * + * This modules adds support for decoding / parsing PEM files. + */ +#define MBEDTLS_PEM_PARSE_C + +/** + * \def MBEDTLS_PEM_WRITE_C + * + * Enable PEM encoding / writing. + * + * Module: library/pem.c + * Caller: library/pkwrite.c + * library/x509write_crt.c + * library/x509write_csr.c + * + * Requires: MBEDTLS_BASE64_C + * + * This modules adds support for encoding / writing PEM files. + */ +#define MBEDTLS_PEM_WRITE_C + +/** + * \def MBEDTLS_PK_C + * + * Enable the generic public (asymmetric) key layer. + * + * Module: library/pk.c + * Caller: library/ssl_tls.c + * library/ssl_cli.c + * library/ssl_srv.c + * + * Requires: MBEDTLS_RSA_C or MBEDTLS_ECP_C + * + * Uncomment to enable generic public key wrappers. + */ +#define MBEDTLS_PK_C + +/** + * \def MBEDTLS_PK_PARSE_C + * + * Enable the generic public (asymmetric) key parser. + * + * Module: library/pkparse.c + * Caller: library/x509_crt.c + * library/x509_csr.c + * + * Requires: MBEDTLS_PK_C + * + * Uncomment to enable generic public key parse functions. + */ +#define MBEDTLS_PK_PARSE_C + +/** + * \def MBEDTLS_PK_WRITE_C + * + * Enable the generic public (asymmetric) key writer. + * + * Module: library/pkwrite.c + * Caller: library/x509write.c + * + * Requires: MBEDTLS_PK_C + * + * Uncomment to enable generic public key write functions. + */ +#define MBEDTLS_PK_WRITE_C + +/** + * \def MBEDTLS_PKCS5_C + * + * Enable PKCS#5 functions. + * + * Module: library/pkcs5.c + * + * Requires: MBEDTLS_MD_C + * + * This module adds support for the PKCS#5 functions. + */ +#define MBEDTLS_PKCS5_C + +/** + * \def MBEDTLS_PKCS11_C + * + * Enable wrapper for PKCS#11 smartcard support via the pkcs11-helper library. + * + * \deprecated This option is deprecated and will be removed in a future + * version of Mbed TLS. + * + * Module: library/pkcs11.c + * Caller: library/pk.c + * + * Requires: MBEDTLS_PK_C + * + * This module enables SSL/TLS PKCS #11 smartcard support. + * Requires the presence of the PKCS#11 helper library (libpkcs11-helper) + */ +//#define MBEDTLS_PKCS11_C + +/** + * \def MBEDTLS_PKCS12_C + * + * Enable PKCS#12 PBE functions. + * Adds algorithms for parsing PKCS#8 encrypted private keys + * + * Module: library/pkcs12.c + * Caller: library/pkparse.c + * + * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_CIPHER_C, MBEDTLS_MD_C + * Can use: MBEDTLS_ARC4_C + * + * This module enables PKCS#12 functions. + */ +#define MBEDTLS_PKCS12_C + +/** + * \def MBEDTLS_PLATFORM_C + * + * Enable the platform abstraction layer that allows you to re-assign + * functions like calloc(), free(), snprintf(), printf(), fprintf(), exit(). + * + * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT + * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned + * above to be specified at runtime or compile time respectively. + * + * \note This abstraction layer must be enabled on Windows (including MSYS2) + * as other module rely on it for a fixed snprintf implementation. + * + * Module: library/platform.c + * Caller: Most other .c files + * + * This module enables abstraction of common (libc) functions. + */ +#define MBEDTLS_PLATFORM_C + +/** + * \def MBEDTLS_POLY1305_C + * + * Enable the Poly1305 MAC algorithm. + * + * Module: library/poly1305.c + * Caller: library/chachapoly.c + */ +#define MBEDTLS_POLY1305_C + +/** + * \def MBEDTLS_PSA_CRYPTO_C + * + * Enable the Platform Security Architecture cryptography API. + * + * Module: library/psa_crypto.c + * + * Requires: either MBEDTLS_CTR_DRBG_C and MBEDTLS_ENTROPY_C, + * or MBEDTLS_HMAC_DRBG_C and MBEDTLS_ENTROPY_C, + * or MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. + * + */ +#define MBEDTLS_PSA_CRYPTO_C + +/** + * \def MBEDTLS_PSA_CRYPTO_SE_C + * + * Enable secure element support in the Platform Security Architecture + * cryptography API. + * + * \warning This feature is not yet suitable for production. It is provided + * for API evaluation and testing purposes only. + * + * Module: library/psa_crypto_se.c + * + * Requires: MBEDTLS_PSA_CRYPTO_C, MBEDTLS_PSA_CRYPTO_STORAGE_C + * + */ +//#define MBEDTLS_PSA_CRYPTO_SE_C + +/** + * \def MBEDTLS_PSA_CRYPTO_STORAGE_C + * + * Enable the Platform Security Architecture persistent key storage. + * + * Module: library/psa_crypto_storage.c + * + * Requires: MBEDTLS_PSA_CRYPTO_C, + * either MBEDTLS_PSA_ITS_FILE_C or a native implementation of + * the PSA ITS interface + */ +#define MBEDTLS_PSA_CRYPTO_STORAGE_C + +/** + * \def MBEDTLS_PSA_ITS_FILE_C + * + * Enable the emulation of the Platform Security Architecture + * Internal Trusted Storage (PSA ITS) over files. + * + * Module: library/psa_its_file.c + * + * Requires: MBEDTLS_FS_IO + */ +#define MBEDTLS_PSA_ITS_FILE_C + +/** + * \def MBEDTLS_RIPEMD160_C + * + * Enable the RIPEMD-160 hash algorithm. + * + * Module: library/ripemd160.c + * Caller: library/md.c + * + */ +#define MBEDTLS_RIPEMD160_C + +/** + * \def MBEDTLS_RSA_C + * + * Enable the RSA public-key cryptosystem. + * + * Module: library/rsa.c + * library/rsa_internal.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * library/x509.c + * + * This module is used by the following key exchanges: + * RSA, DHE-RSA, ECDHE-RSA, RSA-PSK + * + * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C + */ +#define MBEDTLS_RSA_C + +/** + * \def MBEDTLS_SHA1_C + * + * Enable the SHA1 cryptographic hash algorithm. + * + * Module: library/sha1.c + * Caller: library/md.c + * library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * library/x509write_crt.c + * + * This module is required for SSL/TLS up to version 1.1, for TLS 1.2 + * depending on the handshake parameters, and for SHA1-signed certificates. + * + * \warning SHA-1 is considered a weak message digest and its use constitutes + * a security risk. If possible, we recommend avoiding dependencies + * on it, and considering stronger message digests instead. + * + */ +#define MBEDTLS_SHA1_C + +/** + * \def MBEDTLS_SHA256_C + * + * Enable the SHA-224 and SHA-256 cryptographic hash algorithms. + * + * Module: library/sha256.c + * Caller: library/entropy.c + * library/md.c + * library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * + * This module adds support for SHA-224 and SHA-256. + * This module is required for the SSL/TLS 1.2 PRF function. + */ +#define MBEDTLS_SHA256_C + +/** + * \def MBEDTLS_SHA512_C + * + * Enable the SHA-384 and SHA-512 cryptographic hash algorithms. + * + * Module: library/sha512.c + * Caller: library/entropy.c + * library/md.c + * library/ssl_cli.c + * library/ssl_srv.c + * + * This module adds support for SHA-384 and SHA-512. + */ +#define MBEDTLS_SHA512_C + +/** + * \def MBEDTLS_SSL_CACHE_C + * + * Enable simple SSL cache implementation. + * + * Module: library/ssl_cache.c + * Caller: + * + * Requires: MBEDTLS_SSL_CACHE_C + */ +#define MBEDTLS_SSL_CACHE_C + +/** + * \def MBEDTLS_SSL_COOKIE_C + * + * Enable basic implementation of DTLS cookies for hello verification. + * + * Module: library/ssl_cookie.c + * Caller: + */ +#define MBEDTLS_SSL_COOKIE_C + +/** + * \def MBEDTLS_SSL_TICKET_C + * + * Enable an implementation of TLS server-side callbacks for session tickets. + * + * Module: library/ssl_ticket.c + * Caller: + * + * Requires: MBEDTLS_CIPHER_C + */ +#define MBEDTLS_SSL_TICKET_C + +/** + * \def MBEDTLS_SSL_CLI_C + * + * Enable the SSL/TLS client code. + * + * Module: library/ssl_cli.c + * Caller: + * + * Requires: MBEDTLS_SSL_TLS_C + * + * This module is required for SSL/TLS client support. + */ +#define MBEDTLS_SSL_CLI_C + +/** + * \def MBEDTLS_SSL_SRV_C + * + * Enable the SSL/TLS server code. + * + * Module: library/ssl_srv.c + * Caller: + * + * Requires: MBEDTLS_SSL_TLS_C + * + * This module is required for SSL/TLS server support. + */ +#define MBEDTLS_SSL_SRV_C + +/** + * \def MBEDTLS_SSL_TLS_C + * + * Enable the generic SSL/TLS code. + * + * Module: library/ssl_tls.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * + * Requires: MBEDTLS_CIPHER_C, MBEDTLS_MD_C + * and at least one of the MBEDTLS_SSL_PROTO_XXX defines + * + * This module is required for SSL/TLS. + */ +#define MBEDTLS_SSL_TLS_C + +/** + * \def MBEDTLS_THREADING_C + * + * Enable the threading abstraction layer. + * By default mbed TLS assumes it is used in a non-threaded environment or that + * contexts are not shared between threads. If you do intend to use contexts + * between threads, you will need to enable this layer to prevent race + * conditions. See also our Knowledge Base article about threading: + * https://tls.mbed.org/kb/development/thread-safety-and-multi-threading + * + * Module: library/threading.c + * + * This allows different threading implementations (self-implemented or + * provided). + * + * You will have to enable either MBEDTLS_THREADING_ALT or + * MBEDTLS_THREADING_PTHREAD. + * + * Enable this layer to allow use of mutexes within mbed TLS + */ +//#define MBEDTLS_THREADING_C + +/** + * \def MBEDTLS_TIMING_C + * + * Enable the semi-portable timing interface. + * + * \note The provided implementation only works on POSIX/Unix (including Linux, + * BSD and OS X) and Windows. On other platforms, you can either disable that + * module and provide your own implementations of the callbacks needed by + * \c mbedtls_ssl_set_timer_cb() for DTLS, or leave it enabled and provide + * your own implementation of the whole module by setting + * \c MBEDTLS_TIMING_ALT in the current file. + * + * \note The timing module will include time.h on suitable platforms + * regardless of the setting of MBEDTLS_HAVE_TIME, unless + * MBEDTLS_TIMING_ALT is used. See timing.c for more information. + * + * \note See also our Knowledge Base article about porting to a new + * environment: + * https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS + * + * Module: library/timing.c + * Caller: library/havege.c + * + * This module is used by the HAVEGE random number generator. + */ +#define MBEDTLS_TIMING_C + +/** + * \def MBEDTLS_VERSION_C + * + * Enable run-time version information. + * + * Module: library/version.c + * + * This module provides run-time version information. + */ +#define MBEDTLS_VERSION_C + +/** + * \def MBEDTLS_X509_USE_C + * + * Enable X.509 core for using certificates. + * + * Module: library/x509.c + * Caller: library/x509_crl.c + * library/x509_crt.c + * library/x509_csr.c + * + * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, + * MBEDTLS_PK_PARSE_C + * + * This module is required for the X.509 parsing modules. + */ +#define MBEDTLS_X509_USE_C + +/** + * \def MBEDTLS_X509_CRT_PARSE_C + * + * Enable X.509 certificate parsing. + * + * Module: library/x509_crt.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * + * Requires: MBEDTLS_X509_USE_C + * + * This module is required for X.509 certificate parsing. + */ +#define MBEDTLS_X509_CRT_PARSE_C + +/** + * \def MBEDTLS_X509_CRL_PARSE_C + * + * Enable X.509 CRL parsing. + * + * Module: library/x509_crl.c + * Caller: library/x509_crt.c + * + * Requires: MBEDTLS_X509_USE_C + * + * This module is required for X.509 CRL parsing. + */ +#define MBEDTLS_X509_CRL_PARSE_C + +/** + * \def MBEDTLS_X509_CSR_PARSE_C + * + * Enable X.509 Certificate Signing Request (CSR) parsing. + * + * Module: library/x509_csr.c + * Caller: library/x509_crt_write.c + * + * Requires: MBEDTLS_X509_USE_C + * + * This module is used for reading X.509 certificate request. + */ +#define MBEDTLS_X509_CSR_PARSE_C + +/** + * \def MBEDTLS_X509_CREATE_C + * + * Enable X.509 core for creating certificates. + * + * Module: library/x509_create.c + * + * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, MBEDTLS_PK_WRITE_C + * + * This module is the basis for creating X.509 certificates and CSRs. + */ +#define MBEDTLS_X509_CREATE_C + +/** + * \def MBEDTLS_X509_CRT_WRITE_C + * + * Enable creating X.509 certificates. + * + * Module: library/x509_crt_write.c + * + * Requires: MBEDTLS_X509_CREATE_C + * + * This module is required for X.509 certificate creation. + */ +#define MBEDTLS_X509_CRT_WRITE_C + +/** + * \def MBEDTLS_X509_CSR_WRITE_C + * + * Enable creating X.509 Certificate Signing Requests (CSR). + * + * Module: library/x509_csr_write.c + * + * Requires: MBEDTLS_X509_CREATE_C + * + * This module is required for X.509 certificate request writing. + */ +#define MBEDTLS_X509_CSR_WRITE_C + +/** + * \def MBEDTLS_XTEA_C + * + * Enable the XTEA block cipher. + * + * Module: library/xtea.c + * Caller: + */ +#define MBEDTLS_XTEA_C + +/** \} name SECTION: mbed TLS modules */ + +/** + * \name SECTION: General configuration options + * + * This section contains Mbed TLS build settings that are not associated + * with a particular module. + * + * \{ + */ + +/** + * \def MBEDTLS_CONFIG_FILE + * + * If defined, this is a header which will be included instead of + * `"mbedtls/config.h"`. + * This header file specifies the compile-time configuration of Mbed TLS. + * Unlike other configuration options, this one must be defined on the + * compiler command line: a definition in `config.h` would have no effect. + * + * This macro is expanded after an \#include directive. This is a popular but + * non-standard feature of the C language, so this feature is only available + * with compilers that perform macro expansion on an \#include line. + * + * The value of this symbol is typically a path in double quotes, either + * absolute or relative to a directory on the include search path. + */ +//#define MBEDTLS_CONFIG_FILE "mbedtls/config.h" + +/** + * \def MBEDTLS_USER_CONFIG_FILE + * + * If defined, this is a header which will be included after + * `"mbedtls/config.h"` or #MBEDTLS_CONFIG_FILE. + * This allows you to modify the default configuration, including the ability + * to undefine options that are enabled by default. + * + * This macro is expanded after an \#include directive. This is a popular but + * non-standard feature of the C language, so this feature is only available + * with compilers that perform macro expansion on an \#include line. + * + * The value of this symbol is typically a path in double quotes, either + * absolute or relative to a directory on the include search path. + */ +//#define MBEDTLS_USER_CONFIG_FILE "/dev/null" + +/** + * \def MBEDTLS_PSA_CRYPTO_CONFIG_FILE + * + * If defined, this is a header which will be included instead of + * `"psa/crypto_config.h"`. + * This header file specifies which cryptographic mechanisms are available + * through the PSA API when #MBEDTLS_PSA_CRYPTO_CONFIG is enabled, and + * is not used when #MBEDTLS_PSA_CRYPTO_CONFIG is disabled. + * + * This macro is expanded after an \#include directive. This is a popular but + * non-standard feature of the C language, so this feature is only available + * with compilers that perform macro expansion on an \#include line. + * + * The value of this symbol is typically a path in double quotes, either + * absolute or relative to a directory on the include search path. + */ +//#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "psa/crypto_config.h" + +/** + * \def MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE + * + * If defined, this is a header which will be included after + * `"psa/crypto_config.h"` or #MBEDTLS_PSA_CRYPTO_CONFIG_FILE. + * This allows you to modify the default configuration, including the ability + * to undefine options that are enabled by default. + * + * This macro is expanded after an \#include directive. This is a popular but + * non-standard feature of the C language, so this feature is only available + * with compilers that perform macro expansion on an \#include line. + * + * The value of this symbol is typically a path in double quotes, either + * absolute or relative to a directory on the include search path. + */ +//#define MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE "/dev/null" + +/** \} name SECTION: General configuration options */ + +/** + * \name SECTION: Module configuration options + * + * This section allows for the setting of module specific sizes and + * configuration options. The default values are already present in the + * relevant header files and should suffice for the regular use cases. + * + * Our advice is to enable options and change their values here + * only if you have a good reason and know the consequences. + * \{ + */ +/* The Doxygen documentation here is used when a user comments out a + * setting and runs doxygen themselves. On the other hand, when we typeset + * the full documentation including disabled settings, the documentation + * in specific modules' header files is used if present. When editing this + * file, make sure that each option is documented in exactly one place, + * plus optionally a same-line Doxygen comment here if there is a Doxygen + * comment in the specific module. */ + +/* MPI / BIGNUM options */ +//#define MBEDTLS_MPI_WINDOW_SIZE 6 /**< Maximum window size used. */ +//#define MBEDTLS_MPI_MAX_SIZE 1024 /**< Maximum number of bytes for usable MPIs. */ + +/* CTR_DRBG options */ +//#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48 /**< Amount of entropy used per seed by default (48 with SHA-512, 32 with SHA-256) */ +//#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ +//#define MBEDTLS_CTR_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ +//#define MBEDTLS_CTR_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ +//#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ + +/* HMAC_DRBG options */ +//#define MBEDTLS_HMAC_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ +//#define MBEDTLS_HMAC_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ +//#define MBEDTLS_HMAC_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ +//#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ + +/* ECP options */ +//#define MBEDTLS_ECP_MAX_BITS 521 /**< Maximum bit size of groups. Normally determined automatically from the configured curves. */ +//#define MBEDTLS_ECP_WINDOW_SIZE 4 /**< Maximum window size used */ +//#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */ + +/* Entropy options */ +//#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */ +//#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */ +//#define MBEDTLS_ENTROPY_MIN_HARDWARE 32 /**< Default minimum number of bytes required for the hardware entropy source mbedtls_hardware_poll() before entropy is released */ + +/* Memory buffer allocator options */ +//#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 4 /**< Align on multiples of this value */ + +/* Platform options */ +//#define MBEDTLS_PLATFORM_STD_MEM_HDR /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */ +//#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< Default allocator to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_FREE free /**< Default free to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ +//#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< Default printf to use, can be undefined */ +/* Note: your snprintf must correctly zero-terminate the buffer! */ +//#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< Default snprintf to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS 0 /**< Default exit value to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_EXIT_FAILURE 1 /**< Default exit value to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_NV_SEED_READ mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" /**< Seed file to read/write with default implementation */ + +/* To Use Function Macros MBEDTLS_PLATFORM_C must be enabled */ +/* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */ +//#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_EXIT_MACRO exit /**< Default exit macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_TIME_MACRO time /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ +//#define MBEDTLS_PLATFORM_TIME_TYPE_MACRO time_t /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ +//#define MBEDTLS_PLATFORM_FPRINTF_MACRO fprintf /**< Default fprintf macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_PRINTF_MACRO printf /**< Default printf macro to use, can be undefined */ +/* Note: your snprintf must correctly zero-terminate the buffer! */ +//#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf /**< Default snprintf macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_VSNPRINTF_MACRO vsnprintf /**< Default vsnprintf macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_NV_SEED_READ_MACRO mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */ + +/** + * \brief This macro is invoked by the library when an invalid parameter + * is detected that is only checked with #MBEDTLS_CHECK_PARAMS + * (see the documentation of that option for context). + * + * When you leave this undefined here, the library provides + * a default definition. If the macro #MBEDTLS_CHECK_PARAMS_ASSERT + * is defined, the default definition is `assert(cond)`, + * otherwise the default definition calls a function + * mbedtls_param_failed(). This function is declared in + * `platform_util.h` for the benefit of the library, but + * you need to define in your application. + * + * When you define this here, this replaces the default + * definition in platform_util.h (which no longer declares the + * function mbedtls_param_failed()) and it is your responsibility + * to make sure this macro expands to something suitable (in + * particular, that all the necessary declarations are visible + * from within the library - you can ensure that by providing + * them in this file next to the macro definition). + * If you define this macro to call `assert`, also define + * #MBEDTLS_CHECK_PARAMS_ASSERT so that library source files + * include ``. + * + * Note that you may define this macro to expand to nothing, in + * which case you don't have to worry about declarations or + * definitions. However, you will then be notified about invalid + * parameters only in non-void functions, and void function will + * just silently return early on invalid parameters, which + * partially negates the benefits of enabling + * #MBEDTLS_CHECK_PARAMS in the first place, so is discouraged. + * + * \param cond The expression that should evaluate to true, but doesn't. + */ +//#define MBEDTLS_PARAM_FAILED( cond ) assert( cond ) + +/** \def MBEDTLS_CHECK_RETURN + * + * This macro is used at the beginning of the declaration of a function + * to indicate that its return value should be checked. It should + * instruct the compiler to emit a warning or an error if the function + * is called without checking its return value. + * + * There is a default implementation for popular compilers in platform_util.h. + * You can override the default implementation by defining your own here. + * + * If the implementation here is empty, this will effectively disable the + * checking of functions' return values. + */ +//#define MBEDTLS_CHECK_RETURN __attribute__((__warn_unused_result__)) + +/** \def MBEDTLS_IGNORE_RETURN + * + * This macro requires one argument, which should be a C function call. + * If that function call would cause a #MBEDTLS_CHECK_RETURN warning, this + * warning is suppressed. + */ +//#define MBEDTLS_IGNORE_RETURN( result ) ((void) !(result)) + +/* PSA options */ +/** + * Use HMAC_DRBG with the specified hash algorithm for HMAC_DRBG for the + * PSA crypto subsystem. + * + * If this option is unset: + * - If CTR_DRBG is available, the PSA subsystem uses it rather than HMAC_DRBG. + * - Otherwise, the PSA subsystem uses HMAC_DRBG with either + * #MBEDTLS_MD_SHA512 or #MBEDTLS_MD_SHA256 based on availability and + * on unspecified heuristics. + */ +//#define MBEDTLS_PSA_HMAC_DRBG_MD_TYPE MBEDTLS_MD_SHA256 + +/** \def MBEDTLS_PSA_KEY_SLOT_COUNT + * Restrict the PSA library to supporting a maximum amount of simultaneously + * loaded keys. A loaded key is a key stored by the PSA Crypto core as a + * volatile key, or a persistent key which is loaded temporarily by the + * library as part of a crypto operation in flight. + * + * If this option is unset, the library will fall back to a default value of + * 32 keys. + */ +//#define MBEDTLS_PSA_KEY_SLOT_COUNT 32 + +/* SSL Cache options */ +//#define MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT 86400 /**< 1 day */ +//#define MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /**< Maximum entries in cache */ + +/* SSL options */ + +/** \def MBEDTLS_SSL_MAX_CONTENT_LEN + * + * Maximum length (in bytes) of incoming and outgoing plaintext fragments. + * + * This determines the size of both the incoming and outgoing TLS I/O buffers + * in such a way that both are capable of holding the specified amount of + * plaintext data, regardless of the protection mechanism used. + * + * To configure incoming and outgoing I/O buffers separately, use + * #MBEDTLS_SSL_IN_CONTENT_LEN and #MBEDTLS_SSL_OUT_CONTENT_LEN, + * which overwrite the value set by this option. + * + * \note When using a value less than the default of 16KB on the client, it is + * recommended to use the Maximum Fragment Length (MFL) extension to + * inform the server about this limitation. On the server, there + * is no supported, standardized way of informing the client about + * restriction on the maximum size of incoming messages, and unless + * the limitation has been communicated by other means, it is recommended + * to only change the outgoing buffer size #MBEDTLS_SSL_OUT_CONTENT_LEN + * while keeping the default value of 16KB for the incoming buffer. + * + * Uncomment to set the maximum plaintext size of both + * incoming and outgoing I/O buffers. + */ +//#define MBEDTLS_SSL_MAX_CONTENT_LEN 16384 + +/** \def MBEDTLS_SSL_IN_CONTENT_LEN + * + * Maximum length (in bytes) of incoming plaintext fragments. + * + * This determines the size of the incoming TLS I/O buffer in such a way + * that it is capable of holding the specified amount of plaintext data, + * regardless of the protection mechanism used. + * + * If this option is undefined, it inherits its value from + * #MBEDTLS_SSL_MAX_CONTENT_LEN. + * + * \note When using a value less than the default of 16KB on the client, it is + * recommended to use the Maximum Fragment Length (MFL) extension to + * inform the server about this limitation. On the server, there + * is no supported, standardized way of informing the client about + * restriction on the maximum size of incoming messages, and unless + * the limitation has been communicated by other means, it is recommended + * to only change the outgoing buffer size #MBEDTLS_SSL_OUT_CONTENT_LEN + * while keeping the default value of 16KB for the incoming buffer. + * + * Uncomment to set the maximum plaintext size of the incoming I/O buffer + * independently of the outgoing I/O buffer. + */ +//#define MBEDTLS_SSL_IN_CONTENT_LEN 16384 + +/** \def MBEDTLS_SSL_CID_IN_LEN_MAX + * + * The maximum length of CIDs used for incoming DTLS messages. + * + */ +//#define MBEDTLS_SSL_CID_IN_LEN_MAX 32 + +/** \def MBEDTLS_SSL_CID_OUT_LEN_MAX + * + * The maximum length of CIDs used for outgoing DTLS messages. + * + */ +//#define MBEDTLS_SSL_CID_OUT_LEN_MAX 32 + +/** \def MBEDTLS_SSL_CID_PADDING_GRANULARITY + * + * This option controls the use of record plaintext padding + * when using the Connection ID extension in DTLS 1.2. + * + * The padding will always be chosen so that the length of the + * padded plaintext is a multiple of the value of this option. + * + * Note: A value of \c 1 means that no padding will be used + * for outgoing records. + * + * Note: On systems lacking division instructions, + * a power of two should be preferred. + * + */ +//#define MBEDTLS_SSL_CID_PADDING_GRANULARITY 16 + +/** \def MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY + * + * This option controls the use of record plaintext padding + * in TLS 1.3. + * + * The padding will always be chosen so that the length of the + * padded plaintext is a multiple of the value of this option. + * + * Note: A value of \c 1 means that no padding will be used + * for outgoing records. + * + * Note: On systems lacking division instructions, + * a power of two should be preferred. + */ +//#define MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY 1 + +/** \def MBEDTLS_SSL_OUT_CONTENT_LEN + * + * Maximum length (in bytes) of outgoing plaintext fragments. + * + * This determines the size of the outgoing TLS I/O buffer in such a way + * that it is capable of holding the specified amount of plaintext data, + * regardless of the protection mechanism used. + * + * If this option undefined, it inherits its value from + * #MBEDTLS_SSL_MAX_CONTENT_LEN. + * + * It is possible to save RAM by setting a smaller outward buffer, while keeping + * the default inward 16384 byte buffer to conform to the TLS specification. + * + * The minimum required outward buffer size is determined by the handshake + * protocol's usage. Handshaking will fail if the outward buffer is too small. + * The specific size requirement depends on the configured ciphers and any + * certificate data which is sent during the handshake. + * + * Uncomment to set the maximum plaintext size of the outgoing I/O buffer + * independently of the incoming I/O buffer. + */ +//#define MBEDTLS_SSL_OUT_CONTENT_LEN 16384 + +/** \def MBEDTLS_SSL_DTLS_MAX_BUFFERING + * + * Maximum number of heap-allocated bytes for the purpose of + * DTLS handshake message reassembly and future message buffering. + * + * This should be at least 9/8 * MBEDTLS_SSL_IN_CONTENT_LEN + * to account for a reassembled handshake message of maximum size, + * together with its reassembly bitmap. + * + * A value of 2 * MBEDTLS_SSL_IN_CONTENT_LEN (32768 by default) + * should be sufficient for all practical situations as it allows + * to reassembly a large handshake message (such as a certificate) + * while buffering multiple smaller handshake messages. + * + */ +//#define MBEDTLS_SSL_DTLS_MAX_BUFFERING 32768 + +//#define MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME 86400 /**< Lifetime of session tickets (if enabled) */ +//#define MBEDTLS_PSK_MAX_LEN 32 /**< Max size of TLS pre-shared keys, in bytes (default 256 bits) */ +//#define MBEDTLS_SSL_COOKIE_TIMEOUT 60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */ + +/** \def MBEDTLS_TLS_EXT_CID + * + * At the time of writing, the CID extension has not been assigned its + * final value. Set this configuration option to make Mbed TLS use a + * different value. + * + * A future minor revision of Mbed TLS may change the default value of + * this option to match evolving standards and usage. + */ +//#define MBEDTLS_TLS_EXT_CID 254 + +/** + * Complete list of ciphersuites to use, in order of preference. + * + * \warning No dependency checking is done on that field! This option can only + * be used to restrict the set of available ciphersuites. It is your + * responsibility to make sure the needed modules are active. + * + * Use this to save a few hundred bytes of ROM (default ordering of all + * available ciphersuites) and a few to a few hundred bytes of RAM. + * + * The value below is only an example, not the default. + */ +//#define MBEDTLS_SSL_CIPHERSUITES MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + +/* X509 options */ +//#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 /**< Maximum number of intermediate CAs in a verification chain. */ +//#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 /**< Maximum length of a path/filename string in bytes including the null terminator character ('\0'). */ + +/** + * Allow SHA-1 in the default TLS configuration for TLS 1.2 handshake + * signature and ciphersuite selection. Without this build-time option, SHA-1 + * support must be activated explicitly through mbedtls_ssl_conf_sig_hashes. + * The use of SHA-1 in TLS <= 1.1 and in HMAC-SHA-1 is always allowed by + * default. At the time of writing, there is no practical attack on the use + * of SHA-1 in handshake signatures, hence this option is turned on by default + * to preserve compatibility with existing peers, but the general + * warning applies nonetheless: + * + * \warning SHA-1 is considered a weak message digest and its use constitutes + * a security risk. If possible, we recommend avoiding dependencies + * on it, and considering stronger message digests instead. + * + */ +//#define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE + +/** + * Uncomment the macro to let mbed TLS use your alternate implementation of + * mbedtls_platform_zeroize(). This replaces the default implementation in + * platform_util.c. + * + * mbedtls_platform_zeroize() is a widely used function across the library to + * zero a block of memory. The implementation is expected to be secure in the + * sense that it has been written to prevent the compiler from removing calls + * to mbedtls_platform_zeroize() as part of redundant code elimination + * optimizations. However, it is difficult to guarantee that calls to + * mbedtls_platform_zeroize() will not be optimized by the compiler as older + * versions of the C language standards do not provide a secure implementation + * of memset(). Therefore, MBEDTLS_PLATFORM_ZEROIZE_ALT enables users to + * configure their own implementation of mbedtls_platform_zeroize(), for + * example by using directives specific to their compiler, features from newer + * C standards (e.g using memset_s() in C11) or calling a secure memset() from + * their system (e.g explicit_bzero() in BSD). + */ +//#define MBEDTLS_PLATFORM_ZEROIZE_ALT + +/** + * Uncomment the macro to let Mbed TLS use your alternate implementation of + * mbedtls_platform_gmtime_r(). This replaces the default implementation in + * platform_util.c. + * + * gmtime() is not a thread-safe function as defined in the C standard. The + * library will try to use safer implementations of this function, such as + * gmtime_r() when available. However, if Mbed TLS cannot identify the target + * system, the implementation of mbedtls_platform_gmtime_r() will default to + * using the standard gmtime(). In this case, calls from the library to + * gmtime() will be guarded by the global mutex mbedtls_threading_gmtime_mutex + * if MBEDTLS_THREADING_C is enabled. We recommend that calls from outside the + * library are also guarded with this mutex to avoid race conditions. However, + * if the macro MBEDTLS_PLATFORM_GMTIME_R_ALT is defined, Mbed TLS will + * unconditionally use the implementation for mbedtls_platform_gmtime_r() + * supplied at compile time. + */ +//#define MBEDTLS_PLATFORM_GMTIME_R_ALT + +/** + * Enable the verified implementations of ECDH primitives from Project Everest + * (currently only Curve25519). This feature changes the layout of ECDH + * contexts and therefore is a compatibility break for applications that access + * fields of a mbedtls_ecdh_context structure directly. See also + * MBEDTLS_ECDH_LEGACY_CONTEXT in include/mbedtls/ecdh.h. + */ +//#define MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED + +/** \} name SECTION: Module configuration options */ + +/* Target and application specific configurations + * + * Allow user to override any previous default. + * + */ +#if defined(MBEDTLS_USER_CONFIG_FILE) +#include MBEDTLS_USER_CONFIG_FILE +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_CONFIG) +#include "mbedtls/config_psa.h" +#endif + +#include "mbedtls/check_config.h" + +#endif /* MBEDTLS_CONFIG_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/config_psa.h b/openharmony/armeabi-v7a/include/mbedtls/config_psa.h new file mode 100644 index 00000000..1bf750ad --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/config_psa.h @@ -0,0 +1,831 @@ +/** + * \file mbedtls/config_psa.h + * \brief PSA crypto configuration options (set of defines) + * + * This set of compile-time options takes settings defined in + * include/mbedtls/config.h and include/psa/crypto_config.h and uses + * those definitions to define symbols used in the library code. + * + * Users and integrators should not edit this file, please edit + * include/mbedtls/config.h for MBETLS_XXX settings or + * include/psa/crypto_config.h for PSA_WANT_XXX settings. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CONFIG_PSA_H +#define MBEDTLS_CONFIG_PSA_H + +#if defined(MBEDTLS_PSA_CRYPTO_CONFIG) +#if defined(MBEDTLS_PSA_CRYPTO_CONFIG_FILE) +#include MBEDTLS_PSA_CRYPTO_CONFIG_FILE +#else +#include "psa/crypto_config.h" +#endif +#endif /* defined(MBEDTLS_PSA_CRYPTO_CONFIG) */ + +#if defined(MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE) +#include MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE +#endif + +#ifdef __cplusplus +extern "C" { +#endif + + + +/****************************************************************/ +/* De facto synonyms */ +/****************************************************************/ + +#if defined(PSA_WANT_ALG_ECDSA_ANY) && !defined(PSA_WANT_ALG_ECDSA) +#define PSA_WANT_ALG_ECDSA PSA_WANT_ALG_ECDSA_ANY +#elif !defined(PSA_WANT_ALG_ECDSA_ANY) && defined(PSA_WANT_ALG_ECDSA) +#define PSA_WANT_ALG_ECDSA_ANY PSA_WANT_ALG_ECDSA +#endif + +#if defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW) && !defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) +#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW +#elif !defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW) && defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) +#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW PSA_WANT_ALG_RSA_PKCS1V15_SIGN +#endif + +#if defined(PSA_WANT_ALG_RSA_PSS_ANY_SALT) && !defined(PSA_WANT_ALG_RSA_PSS) +#define PSA_WANT_ALG_RSA_PSS PSA_WANT_ALG_RSA_PSS_ANY_SALT +#elif !defined(PSA_WANT_ALG_RSA_PSS_ANY_SALT) && defined(PSA_WANT_ALG_RSA_PSS) +#define PSA_WANT_ALG_RSA_PSS_ANY_SALT PSA_WANT_ALG_RSA_PSS +#endif + + + +/****************************************************************/ +/* Require built-in implementations based on PSA requirements */ +/****************************************************************/ + +#if defined(MBEDTLS_PSA_CRYPTO_CONFIG) + +#if defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_DETERMINISTIC_ECDSA) +#define MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA 1 +#define MBEDTLS_ECDSA_DETERMINISTIC +#define MBEDTLS_ECDSA_C +#define MBEDTLS_HMAC_DRBG_C +#define MBEDTLS_MD_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_DETERMINISTIC_ECDSA */ +#endif /* PSA_WANT_ALG_DETERMINISTIC_ECDSA */ + +#if defined(PSA_WANT_ALG_ECDH) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_ECDH) +#define MBEDTLS_PSA_BUILTIN_ALG_ECDH 1 +#define MBEDTLS_ECDH_C +#define MBEDTLS_ECP_C +#define MBEDTLS_BIGNUM_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_ECDH */ +#endif /* PSA_WANT_ALG_ECDH */ + +#if defined(PSA_WANT_ALG_ECDSA) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_ECDSA) +#define MBEDTLS_PSA_BUILTIN_ALG_ECDSA 1 +#define MBEDTLS_ECDSA_C +#define MBEDTLS_ECP_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_ASN1_PARSE_C +#define MBEDTLS_ASN1_WRITE_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_ECDSA */ +#endif /* PSA_WANT_ALG_ECDSA */ + +#if defined(PSA_WANT_ALG_HKDF) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF) +#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1 +#define MBEDTLS_PSA_BUILTIN_ALG_HKDF 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_HKDF */ +#endif /* PSA_WANT_ALG_HKDF */ + +#if defined(PSA_WANT_ALG_HMAC) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_HMAC) +#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_HMAC */ +#endif /* PSA_WANT_ALG_HMAC */ + +#if defined(PSA_WANT_ALG_MD2) && !defined(MBEDTLS_PSA_ACCEL_ALG_MD2) +#define MBEDTLS_PSA_BUILTIN_ALG_MD2 1 +#define MBEDTLS_MD2_C +#endif + +#if defined(PSA_WANT_ALG_MD4) && !defined(MBEDTLS_PSA_ACCEL_ALG_MD4) +#define MBEDTLS_PSA_BUILTIN_ALG_MD4 1 +#define MBEDTLS_MD4_C +#endif + +#if defined(PSA_WANT_ALG_MD5) && !defined(MBEDTLS_PSA_ACCEL_ALG_MD5) +#define MBEDTLS_PSA_BUILTIN_ALG_MD5 1 +#define MBEDTLS_MD5_C +#endif + +#if defined(PSA_WANT_ALG_RIPEMD160) && !defined(MBEDTLS_PSA_ACCEL_ALG_RIPEMD160) +#define MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160 1 +#define MBEDTLS_RIPEMD160_C +#endif + +#if defined(PSA_WANT_ALG_RSA_OAEP) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_OAEP) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_PKCS1_V21 +#define MBEDTLS_MD_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_OAEP */ +#endif /* PSA_WANT_ALG_RSA_OAEP */ + +#if defined(PSA_WANT_ALG_RSA_PKCS1V15_CRYPT) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_CRYPT) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_PKCS1_V15 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_CRYPT */ +#endif /* PSA_WANT_ALG_RSA_PKCS1V15_CRYPT */ + +#if defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_SIGN) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_PKCS1_V15 +#define MBEDTLS_MD_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_SIGN */ +#endif /* PSA_WANT_ALG_RSA_PKCS1V15_SIGN */ + +#if defined(PSA_WANT_ALG_RSA_PSS) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_PSS) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_PKCS1_V21 +#define MBEDTLS_MD_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_PSS */ +#endif /* PSA_WANT_ALG_RSA_PSS */ + +#if defined(PSA_WANT_ALG_SHA_1) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_1) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_1 1 +#define MBEDTLS_SHA1_C +#endif + +#if defined(PSA_WANT_ALG_SHA_224) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_224) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_224 1 +#define MBEDTLS_SHA256_C +#endif + +#if defined(PSA_WANT_ALG_SHA_256) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_256) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_256 1 +#define MBEDTLS_SHA256_C +#endif + +#if defined(PSA_WANT_ALG_SHA_384) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_384) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_384 1 +#define MBEDTLS_SHA512_C +#endif + +#if defined(PSA_WANT_ALG_SHA_512) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_512) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_512 1 +#define MBEDTLS_SHA512_C +#endif + +#if defined(PSA_WANT_ALG_TLS12_PRF) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_TLS12_PRF) +#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_TLS12_PRF */ +#endif /* PSA_WANT_ALG_TLS12_PRF */ + +#if defined(PSA_WANT_ALG_TLS12_PSK_TO_MS) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_TLS12_PSK_TO_MS) +#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_TLS12_PSK_TO_MS */ +#endif /* PSA_WANT_ALG_TLS12_PSK_TO_MS */ + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR 1 +#define MBEDTLS_ECP_C +#define MBEDTLS_BIGNUM_C +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR */ +#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR */ + +#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY 1 +#define MBEDTLS_ECP_C +#define MBEDTLS_BIGNUM_C +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY */ +#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */ + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_GENPRIME +#define MBEDTLS_PK_PARSE_C +#define MBEDTLS_PK_WRITE_C +#define MBEDTLS_PK_C +#define MBEDTLS_ASN1_PARSE_C +#define MBEDTLS_ASN1_WRITE_C +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR */ +#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR */ + +#if defined(PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_PUBLIC_KEY) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY 1 +#define MBEDTLS_RSA_C +#define MBEDTLS_BIGNUM_C +#define MBEDTLS_OID_C +#define MBEDTLS_PK_PARSE_C +#define MBEDTLS_PK_WRITE_C +#define MBEDTLS_PK_C +#define MBEDTLS_ASN1_PARSE_C +#define MBEDTLS_ASN1_WRITE_C +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_PUBLIC_KEY */ +#endif /* PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY */ + +/* If any of the block modes are requested that don't have an + * associated HW assist, define PSA_HAVE_SOFT_BLOCK_MODE for checking + * in the block cipher key types. */ +#if (defined(PSA_WANT_ALG_CTR) && !defined(MBEDTLS_PSA_ACCEL_ALG_CTR)) || \ + (defined(PSA_WANT_ALG_CFB) && !defined(MBEDTLS_PSA_ACCEL_ALG_CFB)) || \ + (defined(PSA_WANT_ALG_OFB) && !defined(MBEDTLS_PSA_ACCEL_ALG_OFB)) || \ + defined(PSA_WANT_ALG_ECB_NO_PADDING) || \ + (defined(PSA_WANT_ALG_CBC_NO_PADDING) && \ + !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_NO_PADDING)) || \ + (defined(PSA_WANT_ALG_CBC_PKCS7) && \ + !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_PKCS7)) || \ + (defined(PSA_WANT_ALG_CMAC) && !defined(MBEDTLS_PSA_ACCEL_ALG_CMAC)) +#define PSA_HAVE_SOFT_BLOCK_MODE 1 +#endif + +#if (defined(PSA_WANT_ALG_GCM) && !defined(MBEDTLS_PSA_ACCEL_ALG_GCM)) || \ + (defined(PSA_WANT_ALG_CCM) && !defined(MBEDTLS_PSA_ACCEL_ALG_CCM)) +#define PSA_HAVE_SOFT_BLOCK_AEAD 1 +#endif + +#if defined(PSA_WANT_KEY_TYPE_AES) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_AES) +#define PSA_HAVE_SOFT_KEY_TYPE_AES 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_AES */ +#if defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ + defined(PSA_HAVE_SOFT_BLOCK_MODE) || \ + defined(PSA_HAVE_SOFT_BLOCK_AEAD) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES 1 +#define MBEDTLS_AES_C +#endif /* PSA_HAVE_SOFT_KEY_TYPE_AES || PSA_HAVE_SOFT_BLOCK_MODE */ +#endif /* PSA_WANT_KEY_TYPE_AES */ + +#if defined(PSA_WANT_KEY_TYPE_ARC4) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ARC4) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARC4 1 +#define MBEDTLS_ARC4_C +#endif /*!MBEDTLS_PSA_ACCEL_KEY_TYPE_ARC4 */ +#endif /* PSA_WANT_KEY_TYPE_ARC4 */ + +#if defined(PSA_WANT_KEY_TYPE_ARIA) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ARIA) +#define PSA_HAVE_SOFT_KEY_TYPE_ARIA 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_ARIA */ +#if defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ + defined(PSA_HAVE_SOFT_BLOCK_MODE) || \ + defined(PSA_HAVE_SOFT_BLOCK_AEAD) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARIA 1 +#define MBEDTLS_ARIA_C +#endif /* PSA_HAVE_SOFT_KEY_TYPE_ARIA || PSA_HAVE_SOFT_BLOCK_MODE */ +#endif /* PSA_WANT_KEY_TYPE_ARIA */ + +#if defined(PSA_WANT_KEY_TYPE_CAMELLIA) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_CAMELLIA) +#define PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_CAMELLIA */ +#if defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) || \ + defined(PSA_HAVE_SOFT_BLOCK_MODE) || \ + defined(PSA_HAVE_SOFT_BLOCK_AEAD) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CAMELLIA 1 +#define MBEDTLS_CAMELLIA_C +#endif /* PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA || PSA_HAVE_SOFT_BLOCK_MODE */ +#endif /* PSA_WANT_KEY_TYPE_CAMELLIA */ + +#if defined(PSA_WANT_KEY_TYPE_DES) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DES) +#define PSA_HAVE_SOFT_KEY_TYPE_DES 1 +#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_DES */ +#if defined(PSA_HAVE_SOFT_KEY_TYPE_DES) || \ + defined(PSA_HAVE_SOFT_BLOCK_MODE) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES 1 +#define MBEDTLS_DES_C +#endif /*PSA_HAVE_SOFT_KEY_TYPE_DES || PSA_HAVE_SOFT_BLOCK_MODE */ +#endif /* PSA_WANT_KEY_TYPE_DES */ + +#if defined(PSA_WANT_KEY_TYPE_CHACHA20) +#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_CHACHA20) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20 1 +#define MBEDTLS_CHACHA20_C +#endif /*!MBEDTLS_PSA_ACCEL_KEY_TYPE_CHACHA20 */ +#endif /* PSA_WANT_KEY_TYPE_CHACHA20 */ + +/* If any of the software block ciphers are selected, define + * PSA_HAVE_SOFT_BLOCK_CIPHER, which can be used in any of these + * situations. */ +#if defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_DES) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) +#define PSA_HAVE_SOFT_BLOCK_CIPHER 1 +#endif + +#if defined(PSA_WANT_ALG_STREAM_CIPHER) +#define MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER 1 +#endif /* PSA_WANT_ALG_STREAM_CIPHER */ + +#if defined(PSA_WANT_ALG_CBC_MAC) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_MAC) +#error "CBC-MAC is not yet supported via the PSA API in Mbed TLS." +#define MBEDTLS_PSA_BUILTIN_ALG_CBC_MAC 1 +#endif /* !MBEDTLS_PSA_ACCEL_ALG_CBC_MAC */ +#endif /* PSA_WANT_ALG_CBC_MAC */ + +#if defined(PSA_WANT_ALG_CMAC) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CMAC) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_PSA_BUILTIN_ALG_CMAC 1 +#define MBEDTLS_CMAC_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_CMAC */ +#endif /* PSA_WANT_ALG_CMAC */ + +#if defined(PSA_WANT_ALG_CTR) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CTR) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_PSA_BUILTIN_ALG_CTR 1 +#define MBEDTLS_CIPHER_MODE_CTR +#endif +#endif /* PSA_WANT_ALG_CTR */ + +#if defined(PSA_WANT_ALG_CFB) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CFB) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_PSA_BUILTIN_ALG_CFB 1 +#define MBEDTLS_CIPHER_MODE_CFB +#endif +#endif /* PSA_WANT_ALG_CFB */ + +#if defined(PSA_WANT_ALG_OFB) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_OFB) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_PSA_BUILTIN_ALG_OFB 1 +#define MBEDTLS_CIPHER_MODE_OFB +#endif +#endif /* PSA_WANT_ALG_OFB */ + +#if defined(PSA_WANT_ALG_ECB_NO_PADDING) && \ + !defined(MBEDTLS_PSA_ACCEL_ALG_ECB_NO_PADDING) +#define MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING 1 +#endif + +#if defined(PSA_WANT_ALG_CBC_NO_PADDING) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_NO_PADDING) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_CIPHER_MODE_CBC +#define MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING 1 +#endif +#endif /* PSA_WANT_ALG_CBC_NO_PADDING */ + +#if defined(PSA_WANT_ALG_CBC_PKCS7) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_PKCS7) || \ + defined(PSA_HAVE_SOFT_BLOCK_CIPHER) +#define MBEDTLS_CIPHER_MODE_CBC +#define MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7 1 +#define MBEDTLS_CIPHER_PADDING_PKCS7 +#endif +#endif /* PSA_WANT_ALG_CBC_PKCS7 */ + +#if defined(PSA_WANT_ALG_CCM) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CCM) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) +#define MBEDTLS_PSA_BUILTIN_ALG_CCM 1 +#define MBEDTLS_CCM_C +#endif +#endif /* PSA_WANT_ALG_CCM */ + +#if defined(PSA_WANT_ALG_GCM) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_GCM) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ + defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) +#define MBEDTLS_PSA_BUILTIN_ALG_GCM 1 +#define MBEDTLS_GCM_C +#endif +#endif /* PSA_WANT_ALG_GCM */ + +#if defined(PSA_WANT_ALG_CHACHA20_POLY1305) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305) +#if defined(PSA_WANT_KEY_TYPE_CHACHA20) +#define MBEDTLS_CHACHAPOLY_C +#define MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 1 +#endif /* PSA_WANT_KEY_TYPE_CHACHA20 */ +#endif /* !MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305 */ +#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */ + +#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_256) +#define MBEDTLS_ECP_DP_BP256R1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_256 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_256 */ +#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_256 */ + +#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_384) +#define MBEDTLS_ECP_DP_BP384R1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_384 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_384 */ +#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_384 */ + +#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_512) +#define MBEDTLS_ECP_DP_BP512R1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_512 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_512 */ +#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_512 */ + +#if defined(PSA_WANT_ECC_MONTGOMERY_255) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_255) +#define MBEDTLS_ECP_DP_CURVE25519_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_255 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_255 */ +#endif /* PSA_WANT_ECC_MONTGOMERY_255 */ + +#if defined(PSA_WANT_ECC_MONTGOMERY_448) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_448) +/* + * Curve448 is not yet supported via the PSA API in Mbed TLS + * (https://github.com/Mbed-TLS/mbedtls/issues/4249). + */ +#error "Curve448 is not yet supported via the PSA API in Mbed TLS." +#define MBEDTLS_ECP_DP_CURVE448_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_448 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_448 */ +#endif /* PSA_WANT_ECC_MONTGOMERY_448 */ + +#if defined(PSA_WANT_ECC_SECP_R1_192) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_192) +#define MBEDTLS_ECP_DP_SECP192R1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_192 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_R1_192 */ +#endif /* PSA_WANT_ECC_SECP_R1_192 */ + +#if defined(PSA_WANT_ECC_SECP_R1_224) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_224) +#define MBEDTLS_ECP_DP_SECP224R1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_224 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_R1_224 */ +#endif /* PSA_WANT_ECC_SECP_R1_224 */ + +#if defined(PSA_WANT_ECC_SECP_R1_256) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256) +#define MBEDTLS_ECP_DP_SECP256R1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_256 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256 */ +#endif /* PSA_WANT_ECC_SECP_R1_256 */ + +#if defined(PSA_WANT_ECC_SECP_R1_384) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_384) +#define MBEDTLS_ECP_DP_SECP384R1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_R1_384 */ +#endif /* PSA_WANT_ECC_SECP_R1_384 */ + +#if defined(PSA_WANT_ECC_SECP_R1_521) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_521) +#define MBEDTLS_ECP_DP_SECP521R1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_R1_521 */ +#endif /* PSA_WANT_ECC_SECP_R1_521 */ + +#if defined(PSA_WANT_ECC_SECP_K1_192) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_192) +#define MBEDTLS_ECP_DP_SECP192K1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_K1_192 */ +#endif /* PSA_WANT_ECC_SECP_K1_192 */ + +#if defined(PSA_WANT_ECC_SECP_K1_224) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224) +/* + * SECP224K1 is buggy via the PSA API in Mbed TLS + * (https://github.com/Mbed-TLS/mbedtls/issues/3541). + */ +#error "SECP224K1 is buggy via the PSA API in Mbed TLS." +#define MBEDTLS_ECP_DP_SECP224K1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_224 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224 */ +#endif /* PSA_WANT_ECC_SECP_K1_224 */ + +#if defined(PSA_WANT_ECC_SECP_K1_256) +#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256) +#define MBEDTLS_ECP_DP_SECP256K1_ENABLED +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256 1 +#endif /* !MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256 */ +#endif /* PSA_WANT_ECC_SECP_K1_256 */ + + + +/****************************************************************/ +/* Infer PSA requirements from Mbed TLS capabilities */ +/****************************************************************/ + +#else /* MBEDTLS_PSA_CRYPTO_CONFIG */ + +/* + * Ensure PSA_WANT_* defines are setup properly if MBEDTLS_PSA_CRYPTO_CONFIG + * is not defined + */ + +#if defined(MBEDTLS_CCM_C) +#define MBEDTLS_PSA_BUILTIN_ALG_CCM 1 +#define PSA_WANT_ALG_CCM 1 +#endif /* MBEDTLS_CCM_C */ + +#if defined(MBEDTLS_CMAC_C) +#define MBEDTLS_PSA_BUILTIN_ALG_CMAC 1 +#define PSA_WANT_ALG_CMAC 1 +#endif /* MBEDTLS_CMAC_C */ + +#if defined(MBEDTLS_ECDH_C) +#define MBEDTLS_PSA_BUILTIN_ALG_ECDH 1 +#define PSA_WANT_ALG_ECDH 1 +#endif /* MBEDTLS_ECDH_C */ + +#if defined(MBEDTLS_ECDSA_C) +#define MBEDTLS_PSA_BUILTIN_ALG_ECDSA 1 +#define PSA_WANT_ALG_ECDSA 1 +#define PSA_WANT_ALG_ECDSA_ANY 1 + +// Only add in DETERMINISTIC support if ECDSA is also enabled +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) +#define MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA 1 +#define PSA_WANT_ALG_DETERMINISTIC_ECDSA 1 +#endif /* MBEDTLS_ECDSA_DETERMINISTIC */ + +#endif /* MBEDTLS_ECDSA_C */ + +#if defined(MBEDTLS_ECP_C) +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR 1 +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY 1 +#define PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY 1 +#endif /* MBEDTLS_ECP_C */ + +#if defined(MBEDTLS_GCM_C) +#define MBEDTLS_PSA_BUILTIN_ALG_GCM 1 +#define PSA_WANT_ALG_GCM 1 +#endif /* MBEDTLS_GCM_C */ + +#if defined(MBEDTLS_HKDF_C) +#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1 +#define PSA_WANT_ALG_HMAC 1 +#define MBEDTLS_PSA_BUILTIN_ALG_HKDF 1 +#define PSA_WANT_ALG_HKDF 1 +#endif /* MBEDTLS_HKDF_C */ + +#if defined(MBEDTLS_MD_C) +#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1 +#define PSA_WANT_ALG_HMAC 1 +#define PSA_WANT_KEY_TYPE_HMAC +#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF 1 +#define PSA_WANT_ALG_TLS12_PRF 1 +#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS 1 +#define PSA_WANT_ALG_TLS12_PSK_TO_MS 1 +#endif /* MBEDTLS_MD_C */ + +#if defined(MBEDTLS_MD2_C) +#define MBEDTLS_PSA_BUILTIN_ALG_MD2 1 +#define PSA_WANT_ALG_MD2 1 +#endif + +#if defined(MBEDTLS_MD4_C) +#define MBEDTLS_PSA_BUILTIN_ALG_MD4 1 +#define PSA_WANT_ALG_MD4 1 +#endif + +#if defined(MBEDTLS_MD5_C) +#define MBEDTLS_PSA_BUILTIN_ALG_MD5 1 +#define PSA_WANT_ALG_MD5 1 +#endif + +#if defined(MBEDTLS_RIPEMD160_C) +#define MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160 1 +#define PSA_WANT_ALG_RIPEMD160 1 +#endif + +#if defined(MBEDTLS_RSA_C) +#if defined(MBEDTLS_PKCS1_V15) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT 1 +#define PSA_WANT_ALG_RSA_PKCS1V15_CRYPT 1 +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN 1 +#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN 1 +#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN_RAW 1 +#endif /* MBEDTLS_PKCS1_V15 */ +#if defined(MBEDTLS_PKCS1_V21) +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP 1 +#define PSA_WANT_ALG_RSA_OAEP 1 +#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS 1 +#define PSA_WANT_ALG_RSA_PSS 1 +#endif /* MBEDTLS_PKCS1_V21 */ +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR 1 +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY 1 +#define PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY 1 +#endif /* MBEDTLS_RSA_C */ + +#if defined(MBEDTLS_SHA1_C) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_1 1 +#define PSA_WANT_ALG_SHA_1 1 +#endif + +#if defined(MBEDTLS_SHA256_C) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_224 1 +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_256 1 +#define PSA_WANT_ALG_SHA_224 1 +#define PSA_WANT_ALG_SHA_256 1 +#endif + +#if defined(MBEDTLS_SHA512_C) +#if !defined(MBEDTLS_SHA512_NO_SHA384) +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_384 1 +#define PSA_WANT_ALG_SHA_384 1 +#endif +#define MBEDTLS_PSA_BUILTIN_ALG_SHA_512 1 +#define PSA_WANT_ALG_SHA_512 1 +#endif + +#if defined(MBEDTLS_AES_C) +#define PSA_WANT_KEY_TYPE_AES 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES 1 +#endif + +#if defined(MBEDTLS_ARC4_C) +#define PSA_WANT_KEY_TYPE_ARC4 1 +#define PSA_WANT_ALG_STREAM_CIPHER 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARC4 1 +#define MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER 1 +#endif + +#if defined(MBEDTLS_ARIA_C) +#define PSA_WANT_KEY_TYPE_ARIA 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARIA 1 +#endif + +#if defined(MBEDTLS_CAMELLIA_C) +#define PSA_WANT_KEY_TYPE_CAMELLIA 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CAMELLIA 1 +#endif + +#if defined(MBEDTLS_DES_C) +#define PSA_WANT_KEY_TYPE_DES 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES 1 +#endif + +#if defined(MBEDTLS_CHACHA20_C) +#define PSA_WANT_KEY_TYPE_CHACHA20 1 +#define PSA_WANT_ALG_STREAM_CIPHER 1 +#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20 1 +#define MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER 1 +#if defined(MBEDTLS_CHACHAPOLY_C) +#define PSA_WANT_ALG_CHACHA20_POLY1305 1 +#define MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 1 +#endif +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +#define MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING 1 +#define PSA_WANT_ALG_CBC_NO_PADDING 1 +#if defined(MBEDTLS_CIPHER_PADDING_PKCS7) +#define MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7 1 +#define PSA_WANT_ALG_CBC_PKCS7 1 +#endif +#endif + +#if defined(MBEDTLS_AES_C) || defined(MBEDTLS_DES_C) || \ + defined(MBEDTLS_ARIA_C) || defined(MBEDTLS_CAMELLIA_C) +#define MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING 1 +#define PSA_WANT_ALG_ECB_NO_PADDING 1 +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CFB) +#define MBEDTLS_PSA_BUILTIN_ALG_CFB 1 +#define PSA_WANT_ALG_CFB 1 +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CTR) +#define MBEDTLS_PSA_BUILTIN_ALG_CTR 1 +#define PSA_WANT_ALG_CTR 1 +#endif + +#if defined(MBEDTLS_CIPHER_MODE_OFB) +#define MBEDTLS_PSA_BUILTIN_ALG_OFB 1 +#define PSA_WANT_ALG_OFB 1 +#endif + +#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_256 1 +#define PSA_WANT_ECC_BRAINPOOL_P_R1_256 +#endif + +#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_384 1 +#define PSA_WANT_ECC_BRAINPOOL_P_R1_384 +#endif + +#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_512 1 +#define PSA_WANT_ECC_BRAINPOOL_P_R1_512 +#endif + +#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_255 1 +#define PSA_WANT_ECC_MONTGOMERY_255 +#endif + +/* Curve448 is not yet supported via the PSA API (https://github.com/Mbed-TLS/mbedtls/issues/4249) */ +#if 0 && defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_448 1 +#define PSA_WANT_ECC_MONTGOMERY_448 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_192 1 +#define PSA_WANT_ECC_SECP_R1_192 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_224 1 +#define PSA_WANT_ECC_SECP_R1_224 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_256 1 +#define PSA_WANT_ECC_SECP_R1_256 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384 1 +#define PSA_WANT_ECC_SECP_R1_384 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521 1 +#define PSA_WANT_ECC_SECP_R1_521 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192 1 +#define PSA_WANT_ECC_SECP_K1_192 +#endif + +/* SECP224K1 is buggy via the PSA API (https://github.com/Mbed-TLS/mbedtls/issues/3541) */ +#if 0 && defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_224 1 +#define PSA_WANT_ECC_SECP_K1_224 +#endif + +#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) +#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256 1 +#define PSA_WANT_ECC_SECP_K1_256 +#endif + +#endif /* MBEDTLS_PSA_CRYPTO_CONFIG */ + +/* These features are always enabled. */ +#define PSA_WANT_KEY_TYPE_DERIVE 1 +#define PSA_WANT_KEY_TYPE_RAW_DATA 1 + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_CONFIG_PSA_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/constant_time.h b/openharmony/armeabi-v7a/include/mbedtls/constant_time.h new file mode 100644 index 00000000..c5de57a0 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/constant_time.h @@ -0,0 +1,45 @@ +/** + * Constant-time functions + * + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CONSTANT_TIME_H +#define MBEDTLS_CONSTANT_TIME_H + +#include + + +/** Constant-time buffer comparison without branches. + * + * This is equivalent to the standard memcmp function, but is likely to be + * compiled to code using bitwise operation rather than a branch. + * + * This function can be used to write constant-time code by replacing branches + * with bit operations using masks. + * + * \param a Pointer to the first buffer. + * \param b Pointer to the second buffer. + * \param n The number of bytes to compare in the buffer. + * + * \return Zero if the content of the two buffer is the same, + * otherwise non-zero. + */ +int mbedtls_ct_memcmp( const void *a, + const void *b, + size_t n ); + +#endif /* MBEDTLS_CONSTANT_TIME_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/ctr_drbg.h b/openharmony/armeabi-v7a/include/mbedtls/ctr_drbg.h new file mode 100644 index 00000000..e68237a4 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/ctr_drbg.h @@ -0,0 +1,611 @@ +/** + * \file ctr_drbg.h + * + * \brief This file contains definitions and functions for the + * CTR_DRBG pseudorandom generator. + * + * CTR_DRBG is a standardized way of building a PRNG from a block-cipher + * in counter mode operation, as defined in NIST SP 800-90A: + * Recommendation for Random Number Generation Using Deterministic Random + * Bit Generators. + * + * The Mbed TLS implementation of CTR_DRBG uses AES-256 (default) or AES-128 + * (if \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled at compile time) + * as the underlying block cipher, with a derivation function. + * + * The security strength as defined in NIST SP 800-90A is + * 128 bits when AES-128 is used (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY enabled) + * and 256 bits otherwise, provided that #MBEDTLS_CTR_DRBG_ENTROPY_LEN is + * kept at its default value (and not overridden in config.h) and that the + * DRBG instance is set up with default parameters. + * See the documentation of mbedtls_ctr_drbg_seed() for more + * information. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_CTR_DRBG_H +#define MBEDTLS_CTR_DRBG_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/aes.h" + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +/** The entropy source failed. */ +#define MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED -0x0034 +/** The requested random buffer length is too big. */ +#define MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG -0x0036 +/** The input (entropy + additional data) is too large. */ +#define MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG -0x0038 +/** Read or write error in file. */ +#define MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR -0x003A + +#define MBEDTLS_CTR_DRBG_BLOCKSIZE 16 /**< The block size used by the cipher. */ + +#if defined(MBEDTLS_CTR_DRBG_USE_128_BIT_KEY) +#define MBEDTLS_CTR_DRBG_KEYSIZE 16 +/**< The key size in bytes used by the cipher. + * + * Compile-time choice: 16 bytes (128 bits) + * because #MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled. + */ +#else +#define MBEDTLS_CTR_DRBG_KEYSIZE 32 +/**< The key size in bytes used by the cipher. + * + * Compile-time choice: 32 bytes (256 bits) + * because \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled. + */ +#endif + +#define MBEDTLS_CTR_DRBG_KEYBITS ( MBEDTLS_CTR_DRBG_KEYSIZE * 8 ) /**< The key size for the DRBG operation, in bits. */ +#define MBEDTLS_CTR_DRBG_SEEDLEN ( MBEDTLS_CTR_DRBG_KEYSIZE + MBEDTLS_CTR_DRBG_BLOCKSIZE ) /**< The seed length, calculated as (counter + AES key). */ + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h or define them using the compiler command + * line. + * \{ + */ + +/** \def MBEDTLS_CTR_DRBG_ENTROPY_LEN + * + * \brief The amount of entropy used per seed by default, in bytes. + */ +#if !defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) +#if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_ENTROPY_FORCE_SHA256) +/** This is 48 bytes because the entropy module uses SHA-512 + * (\c MBEDTLS_ENTROPY_FORCE_SHA256 is disabled). + */ +#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48 + +#else /* defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_ENTROPY_FORCE_SHA256) */ + +/** This is 32 bytes because the entropy module uses SHA-256 + * (the SHA512 module is disabled or + * \c MBEDTLS_ENTROPY_FORCE_SHA256 is enabled). + */ +#if !defined(MBEDTLS_CTR_DRBG_USE_128_BIT_KEY) +/** \warning To achieve a 256-bit security strength, you must pass a nonce + * to mbedtls_ctr_drbg_seed(). + */ +#endif /* !defined(MBEDTLS_CTR_DRBG_USE_128_BIT_KEY) */ +#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 32 +#endif /* defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_ENTROPY_FORCE_SHA256) */ +#endif /* !defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) */ + +#if !defined(MBEDTLS_CTR_DRBG_RESEED_INTERVAL) +#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000 +/**< The interval before reseed is performed by default. */ +#endif + +#if !defined(MBEDTLS_CTR_DRBG_MAX_INPUT) +#define MBEDTLS_CTR_DRBG_MAX_INPUT 256 +/**< The maximum number of additional input Bytes. */ +#endif + +#if !defined(MBEDTLS_CTR_DRBG_MAX_REQUEST) +#define MBEDTLS_CTR_DRBG_MAX_REQUEST 1024 +/**< The maximum number of requested Bytes per call. */ +#endif + +#if !defined(MBEDTLS_CTR_DRBG_MAX_SEED_INPUT) +#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384 +/**< The maximum size of seed or reseed buffer in bytes. */ +#endif + +/** \} name SECTION: Module settings */ + +#define MBEDTLS_CTR_DRBG_PR_OFF 0 +/**< Prediction resistance is disabled. */ +#define MBEDTLS_CTR_DRBG_PR_ON 1 +/**< Prediction resistance is enabled. */ + +#ifdef __cplusplus +extern "C" { +#endif + +#if MBEDTLS_CTR_DRBG_ENTROPY_LEN >= MBEDTLS_CTR_DRBG_KEYSIZE * 3 / 2 +/** The default length of the nonce read from the entropy source. + * + * This is \c 0 because a single read from the entropy source is sufficient + * to include a nonce. + * See the documentation of mbedtls_ctr_drbg_seed() for more information. + */ +#define MBEDTLS_CTR_DRBG_ENTROPY_NONCE_LEN 0 +#else +/** The default length of the nonce read from the entropy source. + * + * This is half of the default entropy length because a single read from + * the entropy source does not provide enough material to form a nonce. + * See the documentation of mbedtls_ctr_drbg_seed() for more information. + */ +#define MBEDTLS_CTR_DRBG_ENTROPY_NONCE_LEN ( MBEDTLS_CTR_DRBG_ENTROPY_LEN + 1 ) / 2 +#endif + +/** + * \brief The CTR_DRBG context structure. + */ +typedef struct mbedtls_ctr_drbg_context +{ + unsigned char counter[16]; /*!< The counter (V). */ + int reseed_counter; /*!< The reseed counter. + * This is the number of requests that have + * been made since the last (re)seeding, + * minus one. + * Before the initial seeding, this field + * contains the amount of entropy in bytes + * to use as a nonce for the initial seeding, + * or -1 if no nonce length has been explicitly + * set (see mbedtls_ctr_drbg_set_nonce_len()). + */ + int prediction_resistance; /*!< This determines whether prediction + resistance is enabled, that is + whether to systematically reseed before + each random generation. */ + size_t entropy_len; /*!< The amount of entropy grabbed on each + seed or reseed operation, in bytes. */ + int reseed_interval; /*!< The reseed interval. + * This is the maximum number of requests + * that can be made between reseedings. */ + + mbedtls_aes_context aes_ctx; /*!< The AES context. */ + + /* + * Callbacks (Entropy) + */ + int (*f_entropy)(void *, unsigned char *, size_t); + /*!< The entropy callback function. */ + + void *p_entropy; /*!< The context for the entropy function. */ + +#if defined(MBEDTLS_THREADING_C) + /* Invariant: the mutex is initialized if and only if f_entropy != NULL. + * This means that the mutex is initialized during the initial seeding + * in mbedtls_ctr_drbg_seed() and freed in mbedtls_ctr_drbg_free(). + * + * Note that this invariant may change without notice. Do not rely on it + * and do not access the mutex directly in application code. + */ + mbedtls_threading_mutex_t mutex; +#endif +} +mbedtls_ctr_drbg_context; + +/** + * \brief This function initializes the CTR_DRBG context, + * and prepares it for mbedtls_ctr_drbg_seed() + * or mbedtls_ctr_drbg_free(). + * + * \note The reseed interval is + * #MBEDTLS_CTR_DRBG_RESEED_INTERVAL by default. + * You can override it by calling + * mbedtls_ctr_drbg_set_reseed_interval(). + * + * \param ctx The CTR_DRBG context to initialize. + */ +void mbedtls_ctr_drbg_init( mbedtls_ctr_drbg_context *ctx ); + +/** + * \brief This function seeds and sets up the CTR_DRBG + * entropy source for future reseeds. + * + * A typical choice for the \p f_entropy and \p p_entropy parameters is + * to use the entropy module: + * - \p f_entropy is mbedtls_entropy_func(); + * - \p p_entropy is an instance of ::mbedtls_entropy_context initialized + * with mbedtls_entropy_init() (which registers the platform's default + * entropy sources). + * + * The entropy length is #MBEDTLS_CTR_DRBG_ENTROPY_LEN by default. + * You can override it by calling mbedtls_ctr_drbg_set_entropy_len(). + * + * The entropy nonce length is: + * - \c 0 if the entropy length is at least 3/2 times the entropy length, + * which guarantees that the security strength is the maximum permitted + * by the key size and entropy length according to NIST SP 800-90A §10.2.1; + * - Half the entropy length otherwise. + * You can override it by calling mbedtls_ctr_drbg_set_nonce_len(). + * With the default entropy length, the entropy nonce length is + * #MBEDTLS_CTR_DRBG_ENTROPY_NONCE_LEN. + * + * You can provide a nonce and personalization string in addition to the + * entropy source, to make this instantiation as unique as possible. + * See SP 800-90A §8.6.7 for more details about nonces. + * + * The _seed_material_ value passed to the derivation function in + * the CTR_DRBG Instantiate Process described in NIST SP 800-90A §10.2.1.3.2 + * is the concatenation of the following strings: + * - A string obtained by calling \p f_entropy function for the entropy + * length. + */ +#if MBEDTLS_CTR_DRBG_ENTROPY_NONCE_LEN == 0 +/** + * - If mbedtls_ctr_drbg_set_nonce_len() has been called, a string + * obtained by calling \p f_entropy function for the specified length. + */ +#else +/** + * - A string obtained by calling \p f_entropy function for the entropy nonce + * length. If the entropy nonce length is \c 0, this function does not + * make a second call to \p f_entropy. + */ +#endif +#if defined(MBEDTLS_THREADING_C) +/** + * \note When Mbed TLS is built with threading support, + * after this function returns successfully, + * it is safe to call mbedtls_ctr_drbg_random() + * from multiple threads. Other operations, including + * reseeding, are not thread-safe. + */ +#endif /* MBEDTLS_THREADING_C */ +/** + * - The \p custom string. + * + * \note To achieve the nominal security strength permitted + * by CTR_DRBG, the entropy length must be: + * - at least 16 bytes for a 128-bit strength + * (maximum achievable strength when using AES-128); + * - at least 32 bytes for a 256-bit strength + * (maximum achievable strength when using AES-256). + * + * In addition, if you do not pass a nonce in \p custom, + * the sum of the entropy length + * and the entropy nonce length must be: + * - at least 24 bytes for a 128-bit strength + * (maximum achievable strength when using AES-128); + * - at least 48 bytes for a 256-bit strength + * (maximum achievable strength when using AES-256). + * + * \param ctx The CTR_DRBG context to seed. + * It must have been initialized with + * mbedtls_ctr_drbg_init(). + * After a successful call to mbedtls_ctr_drbg_seed(), + * you may not call mbedtls_ctr_drbg_seed() again on + * the same context unless you call + * mbedtls_ctr_drbg_free() and mbedtls_ctr_drbg_init() + * again first. + * After a failed call to mbedtls_ctr_drbg_seed(), + * you must call mbedtls_ctr_drbg_free(). + * \param f_entropy The entropy callback, taking as arguments the + * \p p_entropy context, the buffer to fill, and the + * length of the buffer. + * \p f_entropy is always called with a buffer size + * less than or equal to the entropy length. + * \param p_entropy The entropy context to pass to \p f_entropy. + * \param custom The personalization string. + * This can be \c NULL, in which case the personalization + * string is empty regardless of the value of \p len. + * \param len The length of the personalization string. + * This must be at most + * #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + * - #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. + */ +int mbedtls_ctr_drbg_seed( mbedtls_ctr_drbg_context *ctx, + int (*f_entropy)(void *, unsigned char *, size_t), + void *p_entropy, + const unsigned char *custom, + size_t len ); + +/** + * \brief This function resets CTR_DRBG context to the state immediately + * after initial call of mbedtls_ctr_drbg_init(). + * + * \param ctx The CTR_DRBG context to clear. + */ +void mbedtls_ctr_drbg_free( mbedtls_ctr_drbg_context *ctx ); + +/** + * \brief This function turns prediction resistance on or off. + * The default value is off. + * + * \note If enabled, entropy is gathered at the beginning of + * every call to mbedtls_ctr_drbg_random_with_add() + * or mbedtls_ctr_drbg_random(). + * Only use this if your entropy source has sufficient + * throughput. + * + * \param ctx The CTR_DRBG context. + * \param resistance #MBEDTLS_CTR_DRBG_PR_ON or #MBEDTLS_CTR_DRBG_PR_OFF. + */ +void mbedtls_ctr_drbg_set_prediction_resistance( mbedtls_ctr_drbg_context *ctx, + int resistance ); + +/** + * \brief This function sets the amount of entropy grabbed on each + * seed or reseed. + * + * The default value is #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + * + * \note The security strength of CTR_DRBG is bounded by the + * entropy length. Thus: + * - When using AES-256 + * (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled, + * which is the default), + * \p len must be at least 32 (in bytes) + * to achieve a 256-bit strength. + * - When using AES-128 + * (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled) + * \p len must be at least 16 (in bytes) + * to achieve a 128-bit strength. + * + * \param ctx The CTR_DRBG context. + * \param len The amount of entropy to grab, in bytes. + * This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + * and at most the maximum length accepted by the + * entropy function that is set in the context. + */ +void mbedtls_ctr_drbg_set_entropy_len( mbedtls_ctr_drbg_context *ctx, + size_t len ); + +/** + * \brief This function sets the amount of entropy grabbed + * as a nonce for the initial seeding. + * + * Call this function before calling mbedtls_ctr_drbg_seed() to read + * a nonce from the entropy source during the initial seeding. + * + * \param ctx The CTR_DRBG context. + * \param len The amount of entropy to grab for the nonce, in bytes. + * This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + * and at most the maximum length accepted by the + * entropy function that is set in the context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if \p len is + * more than #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED + * if the initial seeding has already taken place. + */ +int mbedtls_ctr_drbg_set_nonce_len( mbedtls_ctr_drbg_context *ctx, + size_t len ); + +/** + * \brief This function sets the reseed interval. + * + * The reseed interval is the number of calls to mbedtls_ctr_drbg_random() + * or mbedtls_ctr_drbg_random_with_add() after which the entropy function + * is called again. + * + * The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL. + * + * \param ctx The CTR_DRBG context. + * \param interval The reseed interval. + */ +void mbedtls_ctr_drbg_set_reseed_interval( mbedtls_ctr_drbg_context *ctx, + int interval ); + +/** + * \brief This function reseeds the CTR_DRBG context, that is + * extracts data from the entropy source. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param ctx The CTR_DRBG context. + * \param additional Additional data to add to the state. Can be \c NULL. + * \param len The length of the additional data. + * This must be less than + * #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len + * where \c entropy_len is the entropy length + * configured for the context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. + */ +int mbedtls_ctr_drbg_reseed( mbedtls_ctr_drbg_context *ctx, + const unsigned char *additional, size_t len ); + +/** + * \brief This function updates the state of the CTR_DRBG context. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param ctx The CTR_DRBG context. + * \param additional The data to update the state with. This must not be + * \c NULL unless \p add_len is \c 0. + * \param add_len Length of \p additional in bytes. This must be at + * most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if + * \p add_len is more than + * #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + * \return An error from the underlying AES cipher on failure. + */ +int mbedtls_ctr_drbg_update_ret( mbedtls_ctr_drbg_context *ctx, + const unsigned char *additional, + size_t add_len ); + +/** + * \brief This function updates a CTR_DRBG instance with additional + * data and uses it to generate random data. + * + * This function automatically reseeds if the reseed counter is exceeded + * or prediction resistance is enabled. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param p_rng The CTR_DRBG context. This must be a pointer to a + * #mbedtls_ctr_drbg_context structure. + * \param output The buffer to fill. + * \param output_len The length of the buffer in bytes. + * \param additional Additional data to update. Can be \c NULL, in which + * case the additional data is empty regardless of + * the value of \p add_len. + * \param add_len The length of the additional data + * if \p additional is not \c NULL. + * This must be less than #MBEDTLS_CTR_DRBG_MAX_INPUT + * and less than + * #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len + * where \c entropy_len is the entropy length + * configured for the context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or + * #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. + */ +int mbedtls_ctr_drbg_random_with_add( void *p_rng, + unsigned char *output, size_t output_len, + const unsigned char *additional, size_t add_len ); + +/** + * \brief This function uses CTR_DRBG to generate random data. + * + * This function automatically reseeds if the reseed counter is exceeded + * or prediction resistance is enabled. + */ +#if defined(MBEDTLS_THREADING_C) +/** + * \note When Mbed TLS is built with threading support, + * it is safe to call mbedtls_ctr_drbg_random() + * from multiple threads. Other operations, including + * reseeding, are not thread-safe. + */ +#endif /* MBEDTLS_THREADING_C */ +/** + * \param p_rng The CTR_DRBG context. This must be a pointer to a + * #mbedtls_ctr_drbg_context structure. + * \param output The buffer to fill. + * \param output_len The length of the buffer in bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or + * #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. + */ +int mbedtls_ctr_drbg_random( void *p_rng, + unsigned char *output, size_t output_len ); + + +#if ! defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function updates the state of the CTR_DRBG context. + * + * \deprecated Superseded by mbedtls_ctr_drbg_update_ret() + * in 2.16.0. + * + * \note If \p add_len is greater than + * #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT, only the first + * #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT Bytes are used. + * The remaining Bytes are silently discarded. + * + * \param ctx The CTR_DRBG context. + * \param additional The data to update the state with. + * \param add_len Length of \p additional data. + */ +MBEDTLS_DEPRECATED void mbedtls_ctr_drbg_update( + mbedtls_ctr_drbg_context *ctx, + const unsigned char *additional, + size_t add_len ); +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_FS_IO) +/** + * \brief This function writes a seed file. + * + * \param ctx The CTR_DRBG context. + * \param path The name of the file. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR on file error. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on reseed + * failure. + */ +int mbedtls_ctr_drbg_write_seed_file( mbedtls_ctr_drbg_context *ctx, const char *path ); + +/** + * \brief This function reads and updates a seed file. The seed + * is added to this instance. + * + * \param ctx The CTR_DRBG context. + * \param path The name of the file. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR on file error. + * \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on + * reseed failure. + * \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if the existing + * seed file is too large. + */ +int mbedtls_ctr_drbg_update_seed_file( mbedtls_ctr_drbg_context *ctx, const char *path ); +#endif /* MBEDTLS_FS_IO */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The CTR_DRBG checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_ctr_drbg_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* ctr_drbg.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/debug.h b/openharmony/armeabi-v7a/include/mbedtls/debug.h new file mode 100644 index 00000000..4fc4662d --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/debug.h @@ -0,0 +1,311 @@ +/** + * \file debug.h + * + * \brief Functions for controlling and providing debug output from the library. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_DEBUG_H +#define MBEDTLS_DEBUG_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/ssl.h" + +#if defined(MBEDTLS_ECP_C) +#include "mbedtls/ecp.h" +#endif + +#if defined(MBEDTLS_DEBUG_C) + +#define MBEDTLS_DEBUG_STRIP_PARENS( ... ) __VA_ARGS__ + +#define MBEDTLS_SSL_DEBUG_MSG( level, args ) \ + mbedtls_debug_print_msg( ssl, level, __FILE__, __LINE__, \ + MBEDTLS_DEBUG_STRIP_PARENS args ) + +#define MBEDTLS_SSL_DEBUG_RET( level, text, ret ) \ + mbedtls_debug_print_ret( ssl, level, __FILE__, __LINE__, text, ret ) + +#define MBEDTLS_SSL_DEBUG_BUF( level, text, buf, len ) \ + mbedtls_debug_print_buf( ssl, level, __FILE__, __LINE__, text, buf, len ) + +#if defined(MBEDTLS_BIGNUM_C) +#define MBEDTLS_SSL_DEBUG_MPI( level, text, X ) \ + mbedtls_debug_print_mpi( ssl, level, __FILE__, __LINE__, text, X ) +#endif + +#if defined(MBEDTLS_ECP_C) +#define MBEDTLS_SSL_DEBUG_ECP( level, text, X ) \ + mbedtls_debug_print_ecp( ssl, level, __FILE__, __LINE__, text, X ) +#endif + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +#define MBEDTLS_SSL_DEBUG_CRT( level, text, crt ) \ + mbedtls_debug_print_crt( ssl, level, __FILE__, __LINE__, text, crt ) +#endif + +#if defined(MBEDTLS_ECDH_C) +#define MBEDTLS_SSL_DEBUG_ECDH( level, ecdh, attr ) \ + mbedtls_debug_printf_ecdh( ssl, level, __FILE__, __LINE__, ecdh, attr ) +#endif + +#else /* MBEDTLS_DEBUG_C */ + +#define MBEDTLS_SSL_DEBUG_MSG( level, args ) do { } while( 0 ) +#define MBEDTLS_SSL_DEBUG_RET( level, text, ret ) do { } while( 0 ) +#define MBEDTLS_SSL_DEBUG_BUF( level, text, buf, len ) do { } while( 0 ) +#define MBEDTLS_SSL_DEBUG_MPI( level, text, X ) do { } while( 0 ) +#define MBEDTLS_SSL_DEBUG_ECP( level, text, X ) do { } while( 0 ) +#define MBEDTLS_SSL_DEBUG_CRT( level, text, crt ) do { } while( 0 ) +#define MBEDTLS_SSL_DEBUG_ECDH( level, ecdh, attr ) do { } while( 0 ) + +#endif /* MBEDTLS_DEBUG_C */ + +/** + * \def MBEDTLS_PRINTF_ATTRIBUTE + * + * Mark a function as having printf attributes, and thus enable checking + * via -wFormat and other flags. This does nothing on builds with compilers + * that do not support the format attribute + * + * Module: library/debug.c + * Caller: + * + * This module provides debugging functions. + */ +#if defined(__has_attribute) +#if __has_attribute(format) +#if defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 1 +#define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check) \ + __attribute__((__format__ (gnu_printf, string_index, first_to_check))) +#else /* defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 1 */ +#define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check) \ + __attribute__((format(printf, string_index, first_to_check))) +#endif +#else /* __has_attribute(format) */ +#define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check) +#endif /* __has_attribute(format) */ +#else /* defined(__has_attribute) */ +#define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check) +#endif + +/** + * \def MBEDTLS_PRINTF_SIZET + * + * MBEDTLS_PRINTF_xxx: Due to issues with older window compilers + * and MinGW we need to define the printf specifier for size_t + * and long long per platform. + * + * Module: library/debug.c + * Caller: + * + * This module provides debugging functions. + */ +#if (defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 0) || (defined(_MSC_VER) && _MSC_VER < 1800) + #include + #define MBEDTLS_PRINTF_SIZET PRIuPTR + #define MBEDTLS_PRINTF_LONGLONG "I64d" +#else /* (defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 0) || (defined(_MSC_VER) && _MSC_VER < 1800) */ + #define MBEDTLS_PRINTF_SIZET "zu" + #define MBEDTLS_PRINTF_LONGLONG "lld" +#endif /* (defined(__MINGW32__) && __USE_MINGW_ANSI_STDIO == 0) || (defined(_MSC_VER) && _MSC_VER < 1800) */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Set the threshold error level to handle globally all debug output. + * Debug messages that have a level over the threshold value are + * discarded. + * (Default value: 0 = No debug ) + * + * \param threshold threshold level of messages to filter on. Messages at a + * higher level will be discarded. + * - Debug levels + * - 0 No debug + * - 1 Error + * - 2 State change + * - 3 Informational + * - 4 Verbose + */ +void mbedtls_debug_set_threshold( int threshold ); + +/** + * \brief Print a message to the debug output. This function is always used + * through the MBEDTLS_SSL_DEBUG_MSG() macro, which supplies the ssl + * context, file and line number parameters. + * + * \param ssl SSL context + * \param level error level of the debug message + * \param file file the message has occurred in + * \param line line number the message has occurred at + * \param format format specifier, in printf format + * \param ... variables used by the format specifier + * + * \attention This function is intended for INTERNAL usage within the + * library only. + */ +void mbedtls_debug_print_msg( const mbedtls_ssl_context *ssl, int level, + const char *file, int line, + const char *format, ... ) MBEDTLS_PRINTF_ATTRIBUTE(5, 6); + +/** + * \brief Print the return value of a function to the debug output. This + * function is always used through the MBEDTLS_SSL_DEBUG_RET() macro, + * which supplies the ssl context, file and line number parameters. + * + * \param ssl SSL context + * \param level error level of the debug message + * \param file file the error has occurred in + * \param line line number the error has occurred in + * \param text the name of the function that returned the error + * \param ret the return code value + * + * \attention This function is intended for INTERNAL usage within the + * library only. + */ +void mbedtls_debug_print_ret( const mbedtls_ssl_context *ssl, int level, + const char *file, int line, + const char *text, int ret ); + +/** + * \brief Output a buffer of size len bytes to the debug output. This function + * is always used through the MBEDTLS_SSL_DEBUG_BUF() macro, + * which supplies the ssl context, file and line number parameters. + * + * \param ssl SSL context + * \param level error level of the debug message + * \param file file the error has occurred in + * \param line line number the error has occurred in + * \param text a name or label for the buffer being dumped. Normally the + * variable or buffer name + * \param buf the buffer to be outputted + * \param len length of the buffer + * + * \attention This function is intended for INTERNAL usage within the + * library only. + */ +void mbedtls_debug_print_buf( const mbedtls_ssl_context *ssl, int level, + const char *file, int line, const char *text, + const unsigned char *buf, size_t len ); + +#if defined(MBEDTLS_BIGNUM_C) +/** + * \brief Print a MPI variable to the debug output. This function is always + * used through the MBEDTLS_SSL_DEBUG_MPI() macro, which supplies the + * ssl context, file and line number parameters. + * + * \param ssl SSL context + * \param level error level of the debug message + * \param file file the error has occurred in + * \param line line number the error has occurred in + * \param text a name or label for the MPI being output. Normally the + * variable name + * \param X the MPI variable + * + * \attention This function is intended for INTERNAL usage within the + * library only. + */ +void mbedtls_debug_print_mpi( const mbedtls_ssl_context *ssl, int level, + const char *file, int line, + const char *text, const mbedtls_mpi *X ); +#endif + +#if defined(MBEDTLS_ECP_C) +/** + * \brief Print an ECP point to the debug output. This function is always + * used through the MBEDTLS_SSL_DEBUG_ECP() macro, which supplies the + * ssl context, file and line number parameters. + * + * \param ssl SSL context + * \param level error level of the debug message + * \param file file the error has occurred in + * \param line line number the error has occurred in + * \param text a name or label for the ECP point being output. Normally the + * variable name + * \param X the ECP point + * + * \attention This function is intended for INTERNAL usage within the + * library only. + */ +void mbedtls_debug_print_ecp( const mbedtls_ssl_context *ssl, int level, + const char *file, int line, + const char *text, const mbedtls_ecp_point *X ); +#endif + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Print a X.509 certificate structure to the debug output. This + * function is always used through the MBEDTLS_SSL_DEBUG_CRT() macro, + * which supplies the ssl context, file and line number parameters. + * + * \param ssl SSL context + * \param level error level of the debug message + * \param file file the error has occurred in + * \param line line number the error has occurred in + * \param text a name or label for the certificate being output + * \param crt X.509 certificate structure + * + * \attention This function is intended for INTERNAL usage within the + * library only. + */ +void mbedtls_debug_print_crt( const mbedtls_ssl_context *ssl, int level, + const char *file, int line, + const char *text, const mbedtls_x509_crt *crt ); +#endif + +#if defined(MBEDTLS_ECDH_C) +typedef enum +{ + MBEDTLS_DEBUG_ECDH_Q, + MBEDTLS_DEBUG_ECDH_QP, + MBEDTLS_DEBUG_ECDH_Z, +} mbedtls_debug_ecdh_attr; + +/** + * \brief Print a field of the ECDH structure in the SSL context to the debug + * output. This function is always used through the + * MBEDTLS_SSL_DEBUG_ECDH() macro, which supplies the ssl context, file + * and line number parameters. + * + * \param ssl SSL context + * \param level error level of the debug message + * \param file file the error has occurred in + * \param line line number the error has occurred in + * \param ecdh the ECDH context + * \param attr the identifier of the attribute being output + * + * \attention This function is intended for INTERNAL usage within the + * library only. + */ +void mbedtls_debug_printf_ecdh( const mbedtls_ssl_context *ssl, int level, + const char *file, int line, + const mbedtls_ecdh_context *ecdh, + mbedtls_debug_ecdh_attr attr ); +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* debug.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/des.h b/openharmony/armeabi-v7a/include/mbedtls/des.h new file mode 100644 index 00000000..325aab53 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/des.h @@ -0,0 +1,370 @@ +/** + * \file des.h + * + * \brief DES block cipher + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ +#ifndef MBEDTLS_DES_H +#define MBEDTLS_DES_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif +#include "mbedtls/platform_util.h" + +#include +#include + +#define MBEDTLS_DES_ENCRYPT 1 +#define MBEDTLS_DES_DECRYPT 0 + +/** The data input has an invalid length. */ +#define MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH -0x0032 + +/* MBEDTLS_ERR_DES_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** DES hardware accelerator failed. */ +#define MBEDTLS_ERR_DES_HW_ACCEL_FAILED -0x0033 + +#define MBEDTLS_DES_KEY_SIZE 8 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_DES_ALT) +// Regular implementation +// + +/** + * \brief DES context structure + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +typedef struct mbedtls_des_context +{ + uint32_t sk[32]; /*!< DES subkeys */ +} +mbedtls_des_context; + +/** + * \brief Triple-DES context structure + */ +typedef struct mbedtls_des3_context +{ + uint32_t sk[96]; /*!< 3DES subkeys */ +} +mbedtls_des3_context; + +#else /* MBEDTLS_DES_ALT */ +#include "des_alt.h" +#endif /* MBEDTLS_DES_ALT */ + +/** + * \brief Initialize DES context + * + * \param ctx DES context to be initialized + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +void mbedtls_des_init( mbedtls_des_context *ctx ); + +/** + * \brief Clear DES context + * + * \param ctx DES context to be cleared + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +void mbedtls_des_free( mbedtls_des_context *ctx ); + +/** + * \brief Initialize Triple-DES context + * + * \param ctx DES3 context to be initialized + */ +void mbedtls_des3_init( mbedtls_des3_context *ctx ); + +/** + * \brief Clear Triple-DES context + * + * \param ctx DES3 context to be cleared + */ +void mbedtls_des3_free( mbedtls_des3_context *ctx ); + +/** + * \brief Set key parity on the given key to odd. + * + * DES keys are 56 bits long, but each byte is padded with + * a parity bit to allow verification. + * + * \param key 8-byte secret key + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +void mbedtls_des_key_set_parity( unsigned char key[MBEDTLS_DES_KEY_SIZE] ); + +/** + * \brief Check that key parity on the given key is odd. + * + * DES keys are 56 bits long, but each byte is padded with + * a parity bit to allow verification. + * + * \param key 8-byte secret key + * + * \return 0 is parity was ok, 1 if parity was not correct. + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_key_check_key_parity( const unsigned char key[MBEDTLS_DES_KEY_SIZE] ); + +/** + * \brief Check that key is not a weak or semi-weak DES key + * + * \param key 8-byte secret key + * + * \return 0 if no weak key was found, 1 if a weak key was identified. + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_key_check_weak( const unsigned char key[MBEDTLS_DES_KEY_SIZE] ); + +/** + * \brief DES key schedule (56-bit, encryption) + * + * \param ctx DES context to be initialized + * \param key 8-byte secret key + * + * \return 0 + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_setkey_enc( mbedtls_des_context *ctx, const unsigned char key[MBEDTLS_DES_KEY_SIZE] ); + +/** + * \brief DES key schedule (56-bit, decryption) + * + * \param ctx DES context to be initialized + * \param key 8-byte secret key + * + * \return 0 + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_setkey_dec( mbedtls_des_context *ctx, const unsigned char key[MBEDTLS_DES_KEY_SIZE] ); + +/** + * \brief Triple-DES key schedule (112-bit, encryption) + * + * \param ctx 3DES context to be initialized + * \param key 16-byte secret key + * + * \return 0 + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_set2key_enc( mbedtls_des3_context *ctx, + const unsigned char key[MBEDTLS_DES_KEY_SIZE * 2] ); + +/** + * \brief Triple-DES key schedule (112-bit, decryption) + * + * \param ctx 3DES context to be initialized + * \param key 16-byte secret key + * + * \return 0 + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_set2key_dec( mbedtls_des3_context *ctx, + const unsigned char key[MBEDTLS_DES_KEY_SIZE * 2] ); + +/** + * \brief Triple-DES key schedule (168-bit, encryption) + * + * \param ctx 3DES context to be initialized + * \param key 24-byte secret key + * + * \return 0 + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_set3key_enc( mbedtls_des3_context *ctx, + const unsigned char key[MBEDTLS_DES_KEY_SIZE * 3] ); + +/** + * \brief Triple-DES key schedule (168-bit, decryption) + * + * \param ctx 3DES context to be initialized + * \param key 24-byte secret key + * + * \return 0 + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_set3key_dec( mbedtls_des3_context *ctx, + const unsigned char key[MBEDTLS_DES_KEY_SIZE * 3] ); + +/** + * \brief DES-ECB block encryption/decryption + * + * \param ctx DES context + * \param input 64-bit input block + * \param output 64-bit output block + * + * \return 0 if successful + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_crypt_ecb( mbedtls_des_context *ctx, + const unsigned char input[8], + unsigned char output[8] ); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief DES-CBC buffer encryption/decryption + * + * \note Upon exit, the content of the IV is updated so that you can + * call the function same function again on the following + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If on the other hand you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * \param ctx DES context + * \param mode MBEDTLS_DES_ENCRYPT or MBEDTLS_DES_DECRYPT + * \param length length of the input data + * \param iv initialization vector (updated after use) + * \param input buffer holding the input data + * \param output buffer holding the output data + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des_crypt_cbc( mbedtls_des_context *ctx, + int mode, + size_t length, + unsigned char iv[8], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +/** + * \brief 3DES-ECB block encryption/decryption + * + * \param ctx 3DES context + * \param input 64-bit input block + * \param output 64-bit output block + * + * \return 0 if successful + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_crypt_ecb( mbedtls_des3_context *ctx, + const unsigned char input[8], + unsigned char output[8] ); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief 3DES-CBC buffer encryption/decryption + * + * \note Upon exit, the content of the IV is updated so that you can + * call the function same function again on the following + * block(s) of data and get the same result as if it was + * encrypted in one call. This allows a "streaming" usage. + * If on the other hand you need to retain the contents of the + * IV, you should either save it manually or use the cipher + * module instead. + * + * \param ctx 3DES context + * \param mode MBEDTLS_DES_ENCRYPT or MBEDTLS_DES_DECRYPT + * \param length length of the input data + * \param iv initialization vector (updated after use) + * \param input buffer holding the input data + * \param output buffer holding the output data + * + * \return 0 if successful, or MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_des3_crypt_cbc( mbedtls_des3_context *ctx, + int mode, + size_t length, + unsigned char iv[8], + const unsigned char *input, + unsigned char *output ); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +/** + * \brief Internal function for key expansion. + * (Only exposed to allow overriding it, + * see MBEDTLS_DES_SETKEY_ALT) + * + * \param SK Round keys + * \param key Base key + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers + * instead. + */ +void mbedtls_des_setkey( uint32_t SK[32], + const unsigned char key[MBEDTLS_DES_KEY_SIZE] ); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_des_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* des.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/dhm.h b/openharmony/armeabi-v7a/include/mbedtls/dhm.h new file mode 100644 index 00000000..c4b15a2c --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/dhm.h @@ -0,0 +1,1103 @@ +/** + * \file dhm.h + * + * \brief This file contains Diffie-Hellman-Merkle (DHM) key exchange + * definitions and functions. + * + * Diffie-Hellman-Merkle (DHM) key exchange is defined in + * RFC-2631: Diffie-Hellman Key Agreement Method and + * Public-Key Cryptography Standards (PKCS) #3: Diffie + * Hellman Key Agreement Standard. + * + * RFC-3526: More Modular Exponential (MODP) Diffie-Hellman groups for + * Internet Key Exchange (IKE) defines a number of standardized + * Diffie-Hellman groups for IKE. + * + * RFC-5114: Additional Diffie-Hellman Groups for Use with IETF + * Standards defines a number of standardized Diffie-Hellman + * groups that can be used. + * + * \warning The security of the DHM key exchange relies on the proper choice + * of prime modulus - optimally, it should be a safe prime. The usage + * of non-safe primes both decreases the difficulty of the underlying + * discrete logarithm problem and can lead to small subgroup attacks + * leaking private exponent bits when invalid public keys are used + * and not detected. This is especially relevant if the same DHM + * parameters are reused for multiple key exchanges as in static DHM, + * while the criticality of small-subgroup attacks is lower for + * ephemeral DHM. + * + * \warning For performance reasons, the code does neither perform primality + * nor safe primality tests, nor the expensive checks for invalid + * subgroups. Moreover, even if these were performed, non-standardized + * primes cannot be trusted because of the possibility of backdoors + * that can't be effectively checked for. + * + * \warning Diffie-Hellman-Merkle is therefore a security risk when not using + * standardized primes generated using a trustworthy ("nothing up + * my sleeve") method, such as the RFC 3526 / 7919 primes. In the TLS + * protocol, DH parameters need to be negotiated, so using the default + * primes systematically is not always an option. If possible, use + * Elliptic Curve Diffie-Hellman (ECDH), which has better performance, + * and for which the TLS protocol mandates the use of standard + * parameters. + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_DHM_H +#define MBEDTLS_DHM_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif +#include "mbedtls/bignum.h" + +/* + * DHM Error codes + */ +/** Bad input parameters. */ +#define MBEDTLS_ERR_DHM_BAD_INPUT_DATA -0x3080 +/** Reading of the DHM parameters failed. */ +#define MBEDTLS_ERR_DHM_READ_PARAMS_FAILED -0x3100 +/** Making of the DHM parameters failed. */ +#define MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED -0x3180 +/** Reading of the public values failed. */ +#define MBEDTLS_ERR_DHM_READ_PUBLIC_FAILED -0x3200 +/** Making of the public value failed. */ +#define MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED -0x3280 +/** Calculation of the DHM secret failed. */ +#define MBEDTLS_ERR_DHM_CALC_SECRET_FAILED -0x3300 +/** The ASN.1 data is not formatted correctly. */ +#define MBEDTLS_ERR_DHM_INVALID_FORMAT -0x3380 +/** Allocation of memory failed. */ +#define MBEDTLS_ERR_DHM_ALLOC_FAILED -0x3400 +/** Read or write of file failed. */ +#define MBEDTLS_ERR_DHM_FILE_IO_ERROR -0x3480 + +/* MBEDTLS_ERR_DHM_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** DHM hardware accelerator failed. */ +#define MBEDTLS_ERR_DHM_HW_ACCEL_FAILED -0x3500 + +/** Setting the modulus and generator failed. */ +#define MBEDTLS_ERR_DHM_SET_GROUP_FAILED -0x3580 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_DHM_ALT) + +/** + * \brief The DHM context structure. + */ +typedef struct mbedtls_dhm_context +{ + size_t len; /*!< The size of \p P in Bytes. */ + mbedtls_mpi P; /*!< The prime modulus. */ + mbedtls_mpi G; /*!< The generator. */ + mbedtls_mpi X; /*!< Our secret value. */ + mbedtls_mpi GX; /*!< Our public key = \c G^X mod \c P. */ + mbedtls_mpi GY; /*!< The public key of the peer = \c G^Y mod \c P. */ + mbedtls_mpi K; /*!< The shared secret = \c G^(XY) mod \c P. */ + mbedtls_mpi RP; /*!< The cached value = \c R^2 mod \c P. */ + mbedtls_mpi Vi; /*!< The blinding value. */ + mbedtls_mpi Vf; /*!< The unblinding value. */ + mbedtls_mpi pX; /*!< The previous \c X. */ +} +mbedtls_dhm_context; + +#else /* MBEDTLS_DHM_ALT */ +#include "dhm_alt.h" +#endif /* MBEDTLS_DHM_ALT */ + +/** + * \brief This function initializes the DHM context. + * + * \param ctx The DHM context to initialize. + */ +void mbedtls_dhm_init( mbedtls_dhm_context *ctx ); + +/** + * \brief This function parses the DHM parameters in a + * TLS ServerKeyExchange handshake message + * (DHM modulus, generator, and public key). + * + * \note In a TLS handshake, this is the how the client + * sets up its DHM context from the server's public + * DHM key material. + * + * \param ctx The DHM context to use. This must be initialized. + * \param p On input, *p must be the start of the input buffer. + * On output, *p is updated to point to the end of the data + * that has been read. On success, this is the first byte + * past the end of the ServerKeyExchange parameters. + * On error, this is the point at which an error has been + * detected, which is usually not useful except to debug + * failures. + * \param end The end of the input buffer. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_read_params( mbedtls_dhm_context *ctx, + unsigned char **p, + const unsigned char *end ); + +/** + * \brief This function generates a DHM key pair and exports its + * public part together with the DHM parameters in the format + * used in a TLS ServerKeyExchange handshake message. + * + * \note This function assumes that the DHM parameters \c ctx->P + * and \c ctx->G have already been properly set. For that, use + * mbedtls_dhm_set_group() below in conjunction with + * mbedtls_mpi_read_binary() and mbedtls_mpi_read_string(). + * + * \note In a TLS handshake, this is the how the server generates + * and exports its DHM key material. + * + * \param ctx The DHM context to use. This must be initialized + * and have the DHM parameters set. It may or may not + * already have imported the peer's public key. + * \param x_size The private key size in Bytes. + * \param olen The address at which to store the number of Bytes + * written on success. This must not be \c NULL. + * \param output The destination buffer. This must be a writable buffer of + * sufficient size to hold the reduced binary presentation of + * the modulus, the generator and the public key, each wrapped + * with a 2-byte length field. It is the responsibility of the + * caller to ensure that enough space is available. Refer to + * mbedtls_mpi_size() to computing the byte-size of an MPI. + * \param f_rng The RNG function. Must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context parameter. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_make_params( mbedtls_dhm_context *ctx, int x_size, + unsigned char *output, size_t *olen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function sets the prime modulus and generator. + * + * \note This function can be used to set \c ctx->P, \c ctx->G + * in preparation for mbedtls_dhm_make_params(). + * + * \param ctx The DHM context to configure. This must be initialized. + * \param P The MPI holding the DHM prime modulus. This must be + * an initialized MPI. + * \param G The MPI holding the DHM generator. This must be an + * initialized MPI. + * + * \return \c 0 if successful. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_set_group( mbedtls_dhm_context *ctx, + const mbedtls_mpi *P, + const mbedtls_mpi *G ); + +/** + * \brief This function imports the raw public value of the peer. + * + * \note In a TLS handshake, this is the how the server imports + * the Client's public DHM key. + * + * \param ctx The DHM context to use. This must be initialized and have + * its DHM parameters set, e.g. via mbedtls_dhm_set_group(). + * It may or may not already have generated its own private key. + * \param input The input buffer containing the \c G^Y value of the peer. + * This must be a readable buffer of size \p ilen Bytes. + * \param ilen The size of the input buffer \p input in Bytes. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_read_public( mbedtls_dhm_context *ctx, + const unsigned char *input, size_t ilen ); + +/** + * \brief This function creates a DHM key pair and exports + * the raw public key in big-endian format. + * + * \note The destination buffer is always fully written + * so as to contain a big-endian representation of G^X mod P. + * If it is larger than \c ctx->len, it is padded accordingly + * with zero-bytes at the beginning. + * + * \param ctx The DHM context to use. This must be initialized and + * have the DHM parameters set. It may or may not already + * have imported the peer's public key. + * \param x_size The private key size in Bytes. + * \param output The destination buffer. This must be a writable buffer of + * size \p olen Bytes. + * \param olen The length of the destination buffer. This must be at least + * equal to `ctx->len` (the size of \c P). + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + * if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_make_public( mbedtls_dhm_context *ctx, int x_size, + unsigned char *output, size_t olen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function derives and exports the shared secret + * \c (G^Y)^X mod \c P. + * + * \note If \p f_rng is not \c NULL, it is used to blind the input as + * a countermeasure against timing attacks. Blinding is used + * only if our private key \c X is re-used, and not used + * otherwise. We recommend always passing a non-NULL + * \p f_rng argument. + * + * \param ctx The DHM context to use. This must be initialized + * and have its own private key generated and the peer's + * public key imported. + * \param output The buffer to write the generated shared key to. This + * must be a writable buffer of size \p output_size Bytes. + * \param output_size The size of the destination buffer. This must be at + * least the size of \c ctx->len (the size of \c P). + * \param olen On exit, holds the actual number of Bytes written. + * \param f_rng The RNG function, for blinding purposes. This may + * b \c NULL if blinding isn't needed. + * \param p_rng The RNG context. This may be \c NULL if \p f_rng + * doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX error code on failure. + */ +int mbedtls_dhm_calc_secret( mbedtls_dhm_context *ctx, + unsigned char *output, size_t output_size, size_t *olen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function frees and clears the components + * of a DHM context. + * + * \param ctx The DHM context to free and clear. This may be \c NULL, + * in which case this function is a no-op. If it is not \c NULL, + * it must point to an initialized DHM context. + */ +void mbedtls_dhm_free( mbedtls_dhm_context *ctx ); + +#if defined(MBEDTLS_ASN1_PARSE_C) +/** + * \brief This function parses DHM parameters in PEM or DER format. + * + * \param dhm The DHM context to import the DHM parameters into. + * This must be initialized. + * \param dhmin The input buffer. This must be a readable buffer of + * length \p dhminlen Bytes. + * \param dhminlen The size of the input buffer \p dhmin, including the + * terminating \c NULL Byte for PEM data. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX or \c MBEDTLS_ERR_PEM_XXX error + * code on failure. + */ +int mbedtls_dhm_parse_dhm( mbedtls_dhm_context *dhm, const unsigned char *dhmin, + size_t dhminlen ); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief This function loads and parses DHM parameters from a file. + * + * \param dhm The DHM context to load the parameters to. + * This must be initialized. + * \param path The filename to read the DHM parameters from. + * This must not be \c NULL. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_DHM_XXX or \c MBEDTLS_ERR_PEM_XXX + * error code on failure. + */ +int mbedtls_dhm_parse_dhmfile( mbedtls_dhm_context *dhm, const char *path ); +#endif /* MBEDTLS_FS_IO */ +#endif /* MBEDTLS_ASN1_PARSE_C */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The DMH checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_dhm_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ +#ifdef __cplusplus +} +#endif + +/** + * RFC 3526, RFC 5114 and RFC 7919 standardize a number of + * Diffie-Hellman groups, some of which are included here + * for use within the SSL/TLS module and the user's convenience + * when configuring the Diffie-Hellman parameters by hand + * through \c mbedtls_ssl_conf_dh_param. + * + * The following lists the source of the above groups in the standards: + * - RFC 5114 section 2.2: 2048-bit MODP Group with 224-bit Prime Order Subgroup + * - RFC 3526 section 3: 2048-bit MODP Group + * - RFC 3526 section 4: 3072-bit MODP Group + * - RFC 3526 section 5: 4096-bit MODP Group + * - RFC 7919 section A.1: ffdhe2048 + * - RFC 7919 section A.2: ffdhe3072 + * - RFC 7919 section A.3: ffdhe4096 + * - RFC 7919 section A.4: ffdhe6144 + * - RFC 7919 section A.5: ffdhe8192 + * + * The constants with suffix "_p" denote the chosen prime moduli, while + * the constants with suffix "_g" denote the chosen generator + * of the associated prime field. + * + * The constants further suffixed with "_bin" are provided in binary format, + * while all other constants represent null-terminated strings holding the + * hexadecimal presentation of the respective numbers. + * + * The primes from RFC 3526 and RFC 7919 have been generating by the following + * trust-worthy procedure: + * - Fix N in { 2048, 3072, 4096, 6144, 8192 } and consider the N-bit number + * the first and last 64 bits are all 1, and the remaining N - 128 bits of + * which are 0x7ff...ff. + * - Add the smallest multiple of the first N - 129 bits of the binary expansion + * of pi (for RFC 5236) or e (for RFC 7919) to this intermediate bit-string + * such that the resulting integer is a safe-prime. + * - The result is the respective RFC 3526 / 7919 prime, and the corresponding + * generator is always chosen to be 2 (which is a square for these prime, + * hence the corresponding subgroup has order (p-1)/2 and avoids leaking a + * bit in the private exponent). + * + */ + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) + +/** + * \warning The origin of the primes in RFC 5114 is not documented and + * their use therefore constitutes a security risk! + * + * \deprecated The hex-encoded primes from RFC 5114 are deprecated and are + * likely to be removed in a future version of the library without + * replacement. + */ + +/** + * The hexadecimal presentation of the prime underlying the + * 2048-bit MODP Group with 224-bit Prime Order Subgroup, as defined + * in RFC-5114: Additional Diffie-Hellman Groups for Use with + * IETF Standards. + */ +#define MBEDTLS_DHM_RFC5114_MODP_2048_P \ + MBEDTLS_DEPRECATED_STRING_CONSTANT( \ + "AD107E1E9123A9D0D660FAA79559C51FA20D64E5683B9FD1" \ + "B54B1597B61D0A75E6FA141DF95A56DBAF9A3C407BA1DF15" \ + "EB3D688A309C180E1DE6B85A1274A0A66D3F8152AD6AC212" \ + "9037C9EDEFDA4DF8D91E8FEF55B7394B7AD5B7D0B6C12207" \ + "C9F98D11ED34DBF6C6BA0B2C8BBC27BE6A00E0A0B9C49708" \ + "B3BF8A317091883681286130BC8985DB1602E714415D9330" \ + "278273C7DE31EFDC7310F7121FD5A07415987D9ADC0A486D" \ + "CDF93ACC44328387315D75E198C641A480CD86A1B9E587E8" \ + "BE60E69CC928B2B9C52172E413042E9B23F10B0E16E79763" \ + "C9B53DCF4BA80A29E3FB73C16B8E75B97EF363E2FFA31F71" \ + "CF9DE5384E71B81C0AC4DFFE0C10E64F" ) + +/** + * The hexadecimal presentation of the chosen generator of the 2048-bit MODP + * Group with 224-bit Prime Order Subgroup, as defined in RFC-5114: + * Additional Diffie-Hellman Groups for Use with IETF Standards. + */ +#define MBEDTLS_DHM_RFC5114_MODP_2048_G \ + MBEDTLS_DEPRECATED_STRING_CONSTANT( \ + "AC4032EF4F2D9AE39DF30B5C8FFDAC506CDEBE7B89998CAF" \ + "74866A08CFE4FFE3A6824A4E10B9A6F0DD921F01A70C4AFA" \ + "AB739D7700C29F52C57DB17C620A8652BE5E9001A8D66AD7" \ + "C17669101999024AF4D027275AC1348BB8A762D0521BC98A" \ + "E247150422EA1ED409939D54DA7460CDB5F6C6B250717CBE" \ + "F180EB34118E98D119529A45D6F834566E3025E316A330EF" \ + "BB77A86F0C1AB15B051AE3D428C8F8ACB70A8137150B8EEB" \ + "10E183EDD19963DDD9E263E4770589EF6AA21E7F5F2FF381" \ + "B539CCE3409D13CD566AFBB48D6C019181E1BCFE94B30269" \ + "EDFE72FE9B6AA4BD7B5A0F1C71CFFF4C19C418E1F6EC0179" \ + "81BC087F2A7065B384B890D3191F2BFA" ) + +/** + * The hexadecimal presentation of the prime underlying the 2048-bit MODP + * Group, as defined in RFC-3526: More Modular Exponential (MODP) + * Diffie-Hellman groups for Internet Key Exchange (IKE). + * + * \deprecated The hex-encoded primes from RFC 3625 are deprecated and + * superseded by the corresponding macros providing them as + * binary constants. Their hex-encoded constants are likely + * to be removed in a future version of the library. + * + */ +#define MBEDTLS_DHM_RFC3526_MODP_2048_P \ + MBEDTLS_DEPRECATED_STRING_CONSTANT( \ + "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1" \ + "29024E088A67CC74020BBEA63B139B22514A08798E3404DD" \ + "EF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245" \ + "E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED" \ + "EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3D" \ + "C2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F" \ + "83655D23DCA3AD961C62F356208552BB9ED529077096966D" \ + "670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B" \ + "E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9" \ + "DE2BCBF6955817183995497CEA956AE515D2261898FA0510" \ + "15728E5A8AACAA68FFFFFFFFFFFFFFFF" ) + +/** + * The hexadecimal presentation of the chosen generator of the 2048-bit MODP + * Group, as defined in RFC-3526: More Modular Exponential (MODP) + * Diffie-Hellman groups for Internet Key Exchange (IKE). + */ +#define MBEDTLS_DHM_RFC3526_MODP_2048_G \ + MBEDTLS_DEPRECATED_STRING_CONSTANT( "02" ) + +/** + * The hexadecimal presentation of the prime underlying the 3072-bit MODP + * Group, as defined in RFC-3072: More Modular Exponential (MODP) + * Diffie-Hellman groups for Internet Key Exchange (IKE). + */ +#define MBEDTLS_DHM_RFC3526_MODP_3072_P \ + MBEDTLS_DEPRECATED_STRING_CONSTANT( \ + "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1" \ + "29024E088A67CC74020BBEA63B139B22514A08798E3404DD" \ + "EF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245" \ + "E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED" \ + "EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3D" \ + "C2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F" \ + "83655D23DCA3AD961C62F356208552BB9ED529077096966D" \ + "670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B" \ + "E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9" \ + "DE2BCBF6955817183995497CEA956AE515D2261898FA0510" \ + "15728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64" \ + "ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7" \ + "ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6B" \ + "F12FFA06D98A0864D87602733EC86A64521F2B18177B200C" \ + "BBE117577A615D6C770988C0BAD946E208E24FA074E5AB31" \ + "43DB5BFCE0FD108E4B82D120A93AD2CAFFFFFFFFFFFFFFFF" ) + +/** + * The hexadecimal presentation of the chosen generator of the 3072-bit MODP + * Group, as defined in RFC-3526: More Modular Exponential (MODP) + * Diffie-Hellman groups for Internet Key Exchange (IKE). + */ +#define MBEDTLS_DHM_RFC3526_MODP_3072_G \ + MBEDTLS_DEPRECATED_STRING_CONSTANT( "02" ) + +/** + * The hexadecimal presentation of the prime underlying the 4096-bit MODP + * Group, as defined in RFC-3526: More Modular Exponential (MODP) + * Diffie-Hellman groups for Internet Key Exchange (IKE). + */ +#define MBEDTLS_DHM_RFC3526_MODP_4096_P \ + MBEDTLS_DEPRECATED_STRING_CONSTANT( \ + "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1" \ + "29024E088A67CC74020BBEA63B139B22514A08798E3404DD" \ + "EF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245" \ + "E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED" \ + "EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3D" \ + "C2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F" \ + "83655D23DCA3AD961C62F356208552BB9ED529077096966D" \ + "670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B" \ + "E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9" \ + "DE2BCBF6955817183995497CEA956AE515D2261898FA0510" \ + "15728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64" \ + "ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7" \ + "ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6B" \ + "F12FFA06D98A0864D87602733EC86A64521F2B18177B200C" \ + "BBE117577A615D6C770988C0BAD946E208E24FA074E5AB31" \ + "43DB5BFCE0FD108E4B82D120A92108011A723C12A787E6D7" \ + "88719A10BDBA5B2699C327186AF4E23C1A946834B6150BDA" \ + "2583E9CA2AD44CE8DBBBC2DB04DE8EF92E8EFC141FBECAA6" \ + "287C59474E6BC05D99B2964FA090C3A2233BA186515BE7ED" \ + "1F612970CEE2D7AFB81BDD762170481CD0069127D5B05AA9" \ + "93B4EA988D8FDDC186FFB7DC90A6C08F4DF435C934063199" \ + "FFFFFFFFFFFFFFFF" ) + +/** + * The hexadecimal presentation of the chosen generator of the 4096-bit MODP + * Group, as defined in RFC-3526: More Modular Exponential (MODP) + * Diffie-Hellman groups for Internet Key Exchange (IKE). + */ +#define MBEDTLS_DHM_RFC3526_MODP_4096_G \ + MBEDTLS_DEPRECATED_STRING_CONSTANT( "02" ) + +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +/* + * Trustworthy DHM parameters in binary form + */ + +#define MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34, \ + 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, \ + 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, \ + 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, \ + 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD, \ + 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, \ + 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37, \ + 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, \ + 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6, \ + 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, \ + 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED, \ + 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, \ + 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6, \ + 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D, \ + 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05, \ + 0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A, \ + 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F, \ + 0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96, \ + 0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB, \ + 0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D, \ + 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04, \ + 0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C, \ + 0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B, \ + 0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03, \ + 0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F, \ + 0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9, \ + 0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18, \ + 0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5, \ + 0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10, \ + 0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAC, 0xAA, 0x68, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC3526_MODP_3072_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34, \ + 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, \ + 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, \ + 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, \ + 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD, \ + 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, \ + 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37, \ + 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, \ + 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6, \ + 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, \ + 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED, \ + 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, \ + 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6, \ + 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D, \ + 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05, \ + 0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A, \ + 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F, \ + 0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96, \ + 0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB, \ + 0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D, \ + 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04, \ + 0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C, \ + 0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B, \ + 0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03, \ + 0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F, \ + 0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9, \ + 0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18, \ + 0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5, \ + 0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10, \ + 0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAA, 0xC4, 0x2D, \ + 0xAD, 0x33, 0x17, 0x0D, 0x04, 0x50, 0x7A, 0x33, \ + 0xA8, 0x55, 0x21, 0xAB, 0xDF, 0x1C, 0xBA, 0x64, \ + 0xEC, 0xFB, 0x85, 0x04, 0x58, 0xDB, 0xEF, 0x0A, \ + 0x8A, 0xEA, 0x71, 0x57, 0x5D, 0x06, 0x0C, 0x7D, \ + 0xB3, 0x97, 0x0F, 0x85, 0xA6, 0xE1, 0xE4, 0xC7, \ + 0xAB, 0xF5, 0xAE, 0x8C, 0xDB, 0x09, 0x33, 0xD7, \ + 0x1E, 0x8C, 0x94, 0xE0, 0x4A, 0x25, 0x61, 0x9D, \ + 0xCE, 0xE3, 0xD2, 0x26, 0x1A, 0xD2, 0xEE, 0x6B, \ + 0xF1, 0x2F, 0xFA, 0x06, 0xD9, 0x8A, 0x08, 0x64, \ + 0xD8, 0x76, 0x02, 0x73, 0x3E, 0xC8, 0x6A, 0x64, \ + 0x52, 0x1F, 0x2B, 0x18, 0x17, 0x7B, 0x20, 0x0C, \ + 0xBB, 0xE1, 0x17, 0x57, 0x7A, 0x61, 0x5D, 0x6C, \ + 0x77, 0x09, 0x88, 0xC0, 0xBA, 0xD9, 0x46, 0xE2, \ + 0x08, 0xE2, 0x4F, 0xA0, 0x74, 0xE5, 0xAB, 0x31, \ + 0x43, 0xDB, 0x5B, 0xFC, 0xE0, 0xFD, 0x10, 0x8E, \ + 0x4B, 0x82, 0xD1, 0x20, 0xA9, 0x3A, 0xD2, 0xCA, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC3526_MODP_3072_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC3526_MODP_4096_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34, \ + 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, \ + 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, \ + 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, \ + 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD, \ + 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, \ + 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37, \ + 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, \ + 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6, \ + 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, \ + 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED, \ + 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, \ + 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6, \ + 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D, \ + 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05, \ + 0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A, \ + 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F, \ + 0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96, \ + 0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB, \ + 0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D, \ + 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04, \ + 0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C, \ + 0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B, \ + 0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03, \ + 0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F, \ + 0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9, \ + 0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18, \ + 0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5, \ + 0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10, \ + 0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAA, 0xC4, 0x2D, \ + 0xAD, 0x33, 0x17, 0x0D, 0x04, 0x50, 0x7A, 0x33, \ + 0xA8, 0x55, 0x21, 0xAB, 0xDF, 0x1C, 0xBA, 0x64, \ + 0xEC, 0xFB, 0x85, 0x04, 0x58, 0xDB, 0xEF, 0x0A, \ + 0x8A, 0xEA, 0x71, 0x57, 0x5D, 0x06, 0x0C, 0x7D, \ + 0xB3, 0x97, 0x0F, 0x85, 0xA6, 0xE1, 0xE4, 0xC7, \ + 0xAB, 0xF5, 0xAE, 0x8C, 0xDB, 0x09, 0x33, 0xD7, \ + 0x1E, 0x8C, 0x94, 0xE0, 0x4A, 0x25, 0x61, 0x9D, \ + 0xCE, 0xE3, 0xD2, 0x26, 0x1A, 0xD2, 0xEE, 0x6B, \ + 0xF1, 0x2F, 0xFA, 0x06, 0xD9, 0x8A, 0x08, 0x64, \ + 0xD8, 0x76, 0x02, 0x73, 0x3E, 0xC8, 0x6A, 0x64, \ + 0x52, 0x1F, 0x2B, 0x18, 0x17, 0x7B, 0x20, 0x0C, \ + 0xBB, 0xE1, 0x17, 0x57, 0x7A, 0x61, 0x5D, 0x6C, \ + 0x77, 0x09, 0x88, 0xC0, 0xBA, 0xD9, 0x46, 0xE2, \ + 0x08, 0xE2, 0x4F, 0xA0, 0x74, 0xE5, 0xAB, 0x31, \ + 0x43, 0xDB, 0x5B, 0xFC, 0xE0, 0xFD, 0x10, 0x8E, \ + 0x4B, 0x82, 0xD1, 0x20, 0xA9, 0x21, 0x08, 0x01, \ + 0x1A, 0x72, 0x3C, 0x12, 0xA7, 0x87, 0xE6, 0xD7, \ + 0x88, 0x71, 0x9A, 0x10, 0xBD, 0xBA, 0x5B, 0x26, \ + 0x99, 0xC3, 0x27, 0x18, 0x6A, 0xF4, 0xE2, 0x3C, \ + 0x1A, 0x94, 0x68, 0x34, 0xB6, 0x15, 0x0B, 0xDA, \ + 0x25, 0x83, 0xE9, 0xCA, 0x2A, 0xD4, 0x4C, 0xE8, \ + 0xDB, 0xBB, 0xC2, 0xDB, 0x04, 0xDE, 0x8E, 0xF9, \ + 0x2E, 0x8E, 0xFC, 0x14, 0x1F, 0xBE, 0xCA, 0xA6, \ + 0x28, 0x7C, 0x59, 0x47, 0x4E, 0x6B, 0xC0, 0x5D, \ + 0x99, 0xB2, 0x96, 0x4F, 0xA0, 0x90, 0xC3, 0xA2, \ + 0x23, 0x3B, 0xA1, 0x86, 0x51, 0x5B, 0xE7, 0xED, \ + 0x1F, 0x61, 0x29, 0x70, 0xCE, 0xE2, 0xD7, 0xAF, \ + 0xB8, 0x1B, 0xDD, 0x76, 0x21, 0x70, 0x48, 0x1C, \ + 0xD0, 0x06, 0x91, 0x27, 0xD5, 0xB0, 0x5A, 0xA9, \ + 0x93, 0xB4, 0xEA, 0x98, 0x8D, 0x8F, 0xDD, 0xC1, \ + 0x86, 0xFF, 0xB7, 0xDC, 0x90, 0xA6, 0xC0, 0x8F, \ + 0x4D, 0xF4, 0x35, 0xC9, 0x34, 0x06, 0x31, 0x99, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC3526_MODP_4096_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC7919_FFDHE2048_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, \ + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, \ + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, \ + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, \ + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, \ + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, \ + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, \ + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, \ + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, \ + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, \ + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, \ + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, \ + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, \ + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, \ + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, \ + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, \ + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, \ + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, \ + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, \ + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, \ + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, \ + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, \ + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, \ + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, \ + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, \ + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, \ + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, \ + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, \ + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, \ + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x28, 0x5C, 0x97, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, } + +#define MBEDTLS_DHM_RFC7919_FFDHE2048_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC7919_FFDHE3072_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, \ + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, \ + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, \ + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, \ + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, \ + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, \ + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, \ + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, \ + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, \ + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, \ + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, \ + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, \ + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, \ + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, \ + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, \ + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, \ + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, \ + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, \ + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, \ + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, \ + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, \ + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, \ + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, \ + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, \ + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, \ + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, \ + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, \ + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, \ + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, \ + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC, \ + 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B, \ + 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38, \ + 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07, \ + 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE, \ + 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C, \ + 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70, \ + 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44, \ + 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3, \ + 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF, \ + 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E, \ + 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D, \ + 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA, \ + 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E, \ + 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF, \ + 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C, \ + 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0xC6, 0x2E, 0x37, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC7919_FFDHE3072_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC7919_FFDHE4096_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, \ + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, \ + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, \ + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, \ + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, \ + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, \ + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, \ + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, \ + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, \ + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, \ + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, \ + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, \ + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, \ + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, \ + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, \ + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, \ + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, \ + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, \ + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, \ + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, \ + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, \ + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, \ + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, \ + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, \ + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, \ + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, \ + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, \ + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, \ + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, \ + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC, \ + 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B, \ + 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38, \ + 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07, \ + 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE, \ + 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C, \ + 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70, \ + 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44, \ + 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3, \ + 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF, \ + 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E, \ + 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D, \ + 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA, \ + 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E, \ + 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF, \ + 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C, \ + 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0x9E, 0x1E, 0xF1, \ + 0x6E, 0x6F, 0x52, 0xC3, 0x16, 0x4D, 0xF4, 0xFB, \ + 0x79, 0x30, 0xE9, 0xE4, 0xE5, 0x88, 0x57, 0xB6, \ + 0xAC, 0x7D, 0x5F, 0x42, 0xD6, 0x9F, 0x6D, 0x18, \ + 0x77, 0x63, 0xCF, 0x1D, 0x55, 0x03, 0x40, 0x04, \ + 0x87, 0xF5, 0x5B, 0xA5, 0x7E, 0x31, 0xCC, 0x7A, \ + 0x71, 0x35, 0xC8, 0x86, 0xEF, 0xB4, 0x31, 0x8A, \ + 0xED, 0x6A, 0x1E, 0x01, 0x2D, 0x9E, 0x68, 0x32, \ + 0xA9, 0x07, 0x60, 0x0A, 0x91, 0x81, 0x30, 0xC4, \ + 0x6D, 0xC7, 0x78, 0xF9, 0x71, 0xAD, 0x00, 0x38, \ + 0x09, 0x29, 0x99, 0xA3, 0x33, 0xCB, 0x8B, 0x7A, \ + 0x1A, 0x1D, 0xB9, 0x3D, 0x71, 0x40, 0x00, 0x3C, \ + 0x2A, 0x4E, 0xCE, 0xA9, 0xF9, 0x8D, 0x0A, 0xCC, \ + 0x0A, 0x82, 0x91, 0xCD, 0xCE, 0xC9, 0x7D, 0xCF, \ + 0x8E, 0xC9, 0xB5, 0x5A, 0x7F, 0x88, 0xA4, 0x6B, \ + 0x4D, 0xB5, 0xA8, 0x51, 0xF4, 0x41, 0x82, 0xE1, \ + 0xC6, 0x8A, 0x00, 0x7E, 0x5E, 0x65, 0x5F, 0x6A, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC7919_FFDHE4096_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC7919_FFDHE6144_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, \ + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, \ + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, \ + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, \ + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, \ + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, \ + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, \ + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, \ + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, \ + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, \ + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, \ + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, \ + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, \ + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, \ + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, \ + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, \ + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, \ + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, \ + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, \ + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, \ + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, \ + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, \ + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, \ + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, \ + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, \ + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, \ + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, \ + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, \ + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, \ + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC, \ + 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B, \ + 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38, \ + 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07, \ + 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE, \ + 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C, \ + 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70, \ + 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44, \ + 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3, \ + 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF, \ + 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E, \ + 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D, \ + 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA, \ + 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E, \ + 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF, \ + 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C, \ + 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0x9E, 0x1E, 0xF1, \ + 0x6E, 0x6F, 0x52, 0xC3, 0x16, 0x4D, 0xF4, 0xFB, \ + 0x79, 0x30, 0xE9, 0xE4, 0xE5, 0x88, 0x57, 0xB6, \ + 0xAC, 0x7D, 0x5F, 0x42, 0xD6, 0x9F, 0x6D, 0x18, \ + 0x77, 0x63, 0xCF, 0x1D, 0x55, 0x03, 0x40, 0x04, \ + 0x87, 0xF5, 0x5B, 0xA5, 0x7E, 0x31, 0xCC, 0x7A, \ + 0x71, 0x35, 0xC8, 0x86, 0xEF, 0xB4, 0x31, 0x8A, \ + 0xED, 0x6A, 0x1E, 0x01, 0x2D, 0x9E, 0x68, 0x32, \ + 0xA9, 0x07, 0x60, 0x0A, 0x91, 0x81, 0x30, 0xC4, \ + 0x6D, 0xC7, 0x78, 0xF9, 0x71, 0xAD, 0x00, 0x38, \ + 0x09, 0x29, 0x99, 0xA3, 0x33, 0xCB, 0x8B, 0x7A, \ + 0x1A, 0x1D, 0xB9, 0x3D, 0x71, 0x40, 0x00, 0x3C, \ + 0x2A, 0x4E, 0xCE, 0xA9, 0xF9, 0x8D, 0x0A, 0xCC, \ + 0x0A, 0x82, 0x91, 0xCD, 0xCE, 0xC9, 0x7D, 0xCF, \ + 0x8E, 0xC9, 0xB5, 0x5A, 0x7F, 0x88, 0xA4, 0x6B, \ + 0x4D, 0xB5, 0xA8, 0x51, 0xF4, 0x41, 0x82, 0xE1, \ + 0xC6, 0x8A, 0x00, 0x7E, 0x5E, 0x0D, 0xD9, 0x02, \ + 0x0B, 0xFD, 0x64, 0xB6, 0x45, 0x03, 0x6C, 0x7A, \ + 0x4E, 0x67, 0x7D, 0x2C, 0x38, 0x53, 0x2A, 0x3A, \ + 0x23, 0xBA, 0x44, 0x42, 0xCA, 0xF5, 0x3E, 0xA6, \ + 0x3B, 0xB4, 0x54, 0x32, 0x9B, 0x76, 0x24, 0xC8, \ + 0x91, 0x7B, 0xDD, 0x64, 0xB1, 0xC0, 0xFD, 0x4C, \ + 0xB3, 0x8E, 0x8C, 0x33, 0x4C, 0x70, 0x1C, 0x3A, \ + 0xCD, 0xAD, 0x06, 0x57, 0xFC, 0xCF, 0xEC, 0x71, \ + 0x9B, 0x1F, 0x5C, 0x3E, 0x4E, 0x46, 0x04, 0x1F, \ + 0x38, 0x81, 0x47, 0xFB, 0x4C, 0xFD, 0xB4, 0x77, \ + 0xA5, 0x24, 0x71, 0xF7, 0xA9, 0xA9, 0x69, 0x10, \ + 0xB8, 0x55, 0x32, 0x2E, 0xDB, 0x63, 0x40, 0xD8, \ + 0xA0, 0x0E, 0xF0, 0x92, 0x35, 0x05, 0x11, 0xE3, \ + 0x0A, 0xBE, 0xC1, 0xFF, 0xF9, 0xE3, 0xA2, 0x6E, \ + 0x7F, 0xB2, 0x9F, 0x8C, 0x18, 0x30, 0x23, 0xC3, \ + 0x58, 0x7E, 0x38, 0xDA, 0x00, 0x77, 0xD9, 0xB4, \ + 0x76, 0x3E, 0x4E, 0x4B, 0x94, 0xB2, 0xBB, 0xC1, \ + 0x94, 0xC6, 0x65, 0x1E, 0x77, 0xCA, 0xF9, 0x92, \ + 0xEE, 0xAA, 0xC0, 0x23, 0x2A, 0x28, 0x1B, 0xF6, \ + 0xB3, 0xA7, 0x39, 0xC1, 0x22, 0x61, 0x16, 0x82, \ + 0x0A, 0xE8, 0xDB, 0x58, 0x47, 0xA6, 0x7C, 0xBE, \ + 0xF9, 0xC9, 0x09, 0x1B, 0x46, 0x2D, 0x53, 0x8C, \ + 0xD7, 0x2B, 0x03, 0x74, 0x6A, 0xE7, 0x7F, 0x5E, \ + 0x62, 0x29, 0x2C, 0x31, 0x15, 0x62, 0xA8, 0x46, \ + 0x50, 0x5D, 0xC8, 0x2D, 0xB8, 0x54, 0x33, 0x8A, \ + 0xE4, 0x9F, 0x52, 0x35, 0xC9, 0x5B, 0x91, 0x17, \ + 0x8C, 0xCF, 0x2D, 0xD5, 0xCA, 0xCE, 0xF4, 0x03, \ + 0xEC, 0x9D, 0x18, 0x10, 0xC6, 0x27, 0x2B, 0x04, \ + 0x5B, 0x3B, 0x71, 0xF9, 0xDC, 0x6B, 0x80, 0xD6, \ + 0x3F, 0xDD, 0x4A, 0x8E, 0x9A, 0xDB, 0x1E, 0x69, \ + 0x62, 0xA6, 0x95, 0x26, 0xD4, 0x31, 0x61, 0xC1, \ + 0xA4, 0x1D, 0x57, 0x0D, 0x79, 0x38, 0xDA, 0xD4, \ + 0xA4, 0x0E, 0x32, 0x9C, 0xD0, 0xE4, 0x0E, 0x65, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC7919_FFDHE6144_G_BIN { 0x02 } + +#define MBEDTLS_DHM_RFC7919_FFDHE8192_P_BIN { \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \ + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, \ + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, \ + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, \ + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, \ + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, \ + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, \ + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, \ + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, \ + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, \ + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, \ + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, \ + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, \ + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, \ + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, \ + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, \ + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, \ + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, \ + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, \ + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, \ + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, \ + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, \ + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, \ + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, \ + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, \ + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, \ + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, \ + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, \ + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, \ + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, \ + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC, \ + 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B, \ + 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38, \ + 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07, \ + 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE, \ + 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C, \ + 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70, \ + 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44, \ + 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3, \ + 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF, \ + 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E, \ + 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D, \ + 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA, \ + 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E, \ + 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF, \ + 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C, \ + 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0x9E, 0x1E, 0xF1, \ + 0x6E, 0x6F, 0x52, 0xC3, 0x16, 0x4D, 0xF4, 0xFB, \ + 0x79, 0x30, 0xE9, 0xE4, 0xE5, 0x88, 0x57, 0xB6, \ + 0xAC, 0x7D, 0x5F, 0x42, 0xD6, 0x9F, 0x6D, 0x18, \ + 0x77, 0x63, 0xCF, 0x1D, 0x55, 0x03, 0x40, 0x04, \ + 0x87, 0xF5, 0x5B, 0xA5, 0x7E, 0x31, 0xCC, 0x7A, \ + 0x71, 0x35, 0xC8, 0x86, 0xEF, 0xB4, 0x31, 0x8A, \ + 0xED, 0x6A, 0x1E, 0x01, 0x2D, 0x9E, 0x68, 0x32, \ + 0xA9, 0x07, 0x60, 0x0A, 0x91, 0x81, 0x30, 0xC4, \ + 0x6D, 0xC7, 0x78, 0xF9, 0x71, 0xAD, 0x00, 0x38, \ + 0x09, 0x29, 0x99, 0xA3, 0x33, 0xCB, 0x8B, 0x7A, \ + 0x1A, 0x1D, 0xB9, 0x3D, 0x71, 0x40, 0x00, 0x3C, \ + 0x2A, 0x4E, 0xCE, 0xA9, 0xF9, 0x8D, 0x0A, 0xCC, \ + 0x0A, 0x82, 0x91, 0xCD, 0xCE, 0xC9, 0x7D, 0xCF, \ + 0x8E, 0xC9, 0xB5, 0x5A, 0x7F, 0x88, 0xA4, 0x6B, \ + 0x4D, 0xB5, 0xA8, 0x51, 0xF4, 0x41, 0x82, 0xE1, \ + 0xC6, 0x8A, 0x00, 0x7E, 0x5E, 0x0D, 0xD9, 0x02, \ + 0x0B, 0xFD, 0x64, 0xB6, 0x45, 0x03, 0x6C, 0x7A, \ + 0x4E, 0x67, 0x7D, 0x2C, 0x38, 0x53, 0x2A, 0x3A, \ + 0x23, 0xBA, 0x44, 0x42, 0xCA, 0xF5, 0x3E, 0xA6, \ + 0x3B, 0xB4, 0x54, 0x32, 0x9B, 0x76, 0x24, 0xC8, \ + 0x91, 0x7B, 0xDD, 0x64, 0xB1, 0xC0, 0xFD, 0x4C, \ + 0xB3, 0x8E, 0x8C, 0x33, 0x4C, 0x70, 0x1C, 0x3A, \ + 0xCD, 0xAD, 0x06, 0x57, 0xFC, 0xCF, 0xEC, 0x71, \ + 0x9B, 0x1F, 0x5C, 0x3E, 0x4E, 0x46, 0x04, 0x1F, \ + 0x38, 0x81, 0x47, 0xFB, 0x4C, 0xFD, 0xB4, 0x77, \ + 0xA5, 0x24, 0x71, 0xF7, 0xA9, 0xA9, 0x69, 0x10, \ + 0xB8, 0x55, 0x32, 0x2E, 0xDB, 0x63, 0x40, 0xD8, \ + 0xA0, 0x0E, 0xF0, 0x92, 0x35, 0x05, 0x11, 0xE3, \ + 0x0A, 0xBE, 0xC1, 0xFF, 0xF9, 0xE3, 0xA2, 0x6E, \ + 0x7F, 0xB2, 0x9F, 0x8C, 0x18, 0x30, 0x23, 0xC3, \ + 0x58, 0x7E, 0x38, 0xDA, 0x00, 0x77, 0xD9, 0xB4, \ + 0x76, 0x3E, 0x4E, 0x4B, 0x94, 0xB2, 0xBB, 0xC1, \ + 0x94, 0xC6, 0x65, 0x1E, 0x77, 0xCA, 0xF9, 0x92, \ + 0xEE, 0xAA, 0xC0, 0x23, 0x2A, 0x28, 0x1B, 0xF6, \ + 0xB3, 0xA7, 0x39, 0xC1, 0x22, 0x61, 0x16, 0x82, \ + 0x0A, 0xE8, 0xDB, 0x58, 0x47, 0xA6, 0x7C, 0xBE, \ + 0xF9, 0xC9, 0x09, 0x1B, 0x46, 0x2D, 0x53, 0x8C, \ + 0xD7, 0x2B, 0x03, 0x74, 0x6A, 0xE7, 0x7F, 0x5E, \ + 0x62, 0x29, 0x2C, 0x31, 0x15, 0x62, 0xA8, 0x46, \ + 0x50, 0x5D, 0xC8, 0x2D, 0xB8, 0x54, 0x33, 0x8A, \ + 0xE4, 0x9F, 0x52, 0x35, 0xC9, 0x5B, 0x91, 0x17, \ + 0x8C, 0xCF, 0x2D, 0xD5, 0xCA, 0xCE, 0xF4, 0x03, \ + 0xEC, 0x9D, 0x18, 0x10, 0xC6, 0x27, 0x2B, 0x04, \ + 0x5B, 0x3B, 0x71, 0xF9, 0xDC, 0x6B, 0x80, 0xD6, \ + 0x3F, 0xDD, 0x4A, 0x8E, 0x9A, 0xDB, 0x1E, 0x69, \ + 0x62, 0xA6, 0x95, 0x26, 0xD4, 0x31, 0x61, 0xC1, \ + 0xA4, 0x1D, 0x57, 0x0D, 0x79, 0x38, 0xDA, 0xD4, \ + 0xA4, 0x0E, 0x32, 0x9C, 0xCF, 0xF4, 0x6A, 0xAA, \ + 0x36, 0xAD, 0x00, 0x4C, 0xF6, 0x00, 0xC8, 0x38, \ + 0x1E, 0x42, 0x5A, 0x31, 0xD9, 0x51, 0xAE, 0x64, \ + 0xFD, 0xB2, 0x3F, 0xCE, 0xC9, 0x50, 0x9D, 0x43, \ + 0x68, 0x7F, 0xEB, 0x69, 0xED, 0xD1, 0xCC, 0x5E, \ + 0x0B, 0x8C, 0xC3, 0xBD, 0xF6, 0x4B, 0x10, 0xEF, \ + 0x86, 0xB6, 0x31, 0x42, 0xA3, 0xAB, 0x88, 0x29, \ + 0x55, 0x5B, 0x2F, 0x74, 0x7C, 0x93, 0x26, 0x65, \ + 0xCB, 0x2C, 0x0F, 0x1C, 0xC0, 0x1B, 0xD7, 0x02, \ + 0x29, 0x38, 0x88, 0x39, 0xD2, 0xAF, 0x05, 0xE4, \ + 0x54, 0x50, 0x4A, 0xC7, 0x8B, 0x75, 0x82, 0x82, \ + 0x28, 0x46, 0xC0, 0xBA, 0x35, 0xC3, 0x5F, 0x5C, \ + 0x59, 0x16, 0x0C, 0xC0, 0x46, 0xFD, 0x82, 0x51, \ + 0x54, 0x1F, 0xC6, 0x8C, 0x9C, 0x86, 0xB0, 0x22, \ + 0xBB, 0x70, 0x99, 0x87, 0x6A, 0x46, 0x0E, 0x74, \ + 0x51, 0xA8, 0xA9, 0x31, 0x09, 0x70, 0x3F, 0xEE, \ + 0x1C, 0x21, 0x7E, 0x6C, 0x38, 0x26, 0xE5, 0x2C, \ + 0x51, 0xAA, 0x69, 0x1E, 0x0E, 0x42, 0x3C, 0xFC, \ + 0x99, 0xE9, 0xE3, 0x16, 0x50, 0xC1, 0x21, 0x7B, \ + 0x62, 0x48, 0x16, 0xCD, 0xAD, 0x9A, 0x95, 0xF9, \ + 0xD5, 0xB8, 0x01, 0x94, 0x88, 0xD9, 0xC0, 0xA0, \ + 0xA1, 0xFE, 0x30, 0x75, 0xA5, 0x77, 0xE2, 0x31, \ + 0x83, 0xF8, 0x1D, 0x4A, 0x3F, 0x2F, 0xA4, 0x57, \ + 0x1E, 0xFC, 0x8C, 0xE0, 0xBA, 0x8A, 0x4F, 0xE8, \ + 0xB6, 0x85, 0x5D, 0xFE, 0x72, 0xB0, 0xA6, 0x6E, \ + 0xDE, 0xD2, 0xFB, 0xAB, 0xFB, 0xE5, 0x8A, 0x30, \ + 0xFA, 0xFA, 0xBE, 0x1C, 0x5D, 0x71, 0xA8, 0x7E, \ + 0x2F, 0x74, 0x1E, 0xF8, 0xC1, 0xFE, 0x86, 0xFE, \ + 0xA6, 0xBB, 0xFD, 0xE5, 0x30, 0x67, 0x7F, 0x0D, \ + 0x97, 0xD1, 0x1D, 0x49, 0xF7, 0xA8, 0x44, 0x3D, \ + 0x08, 0x22, 0xE5, 0x06, 0xA9, 0xF4, 0x61, 0x4E, \ + 0x01, 0x1E, 0x2A, 0x94, 0x83, 0x8F, 0xF8, 0x8C, \ + 0xD6, 0x8C, 0x8B, 0xB7, 0xC5, 0xC6, 0x42, 0x4C, \ + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF } + +#define MBEDTLS_DHM_RFC7919_FFDHE8192_G_BIN { 0x02 } + +#endif /* dhm.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/ecdh.h b/openharmony/armeabi-v7a/include/mbedtls/ecdh.h new file mode 100644 index 00000000..05855cdf --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/ecdh.h @@ -0,0 +1,446 @@ +/** + * \file ecdh.h + * + * \brief This file contains ECDH definitions and functions. + * + * The Elliptic Curve Diffie-Hellman (ECDH) protocol is an anonymous + * key agreement protocol allowing two parties to establish a shared + * secret over an insecure channel. Each party must have an + * elliptic-curve public–private key pair. + * + * For more information, see NIST SP 800-56A Rev. 2: Recommendation for + * Pair-Wise Key Establishment Schemes Using Discrete Logarithm + * Cryptography. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_ECDH_H +#define MBEDTLS_ECDH_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/ecp.h" + +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) +#undef MBEDTLS_ECDH_LEGACY_CONTEXT +#include "everest/everest.h" +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Defines the source of the imported EC key. + */ +typedef enum +{ + MBEDTLS_ECDH_OURS, /**< Our key. */ + MBEDTLS_ECDH_THEIRS, /**< The key of the peer. */ +} mbedtls_ecdh_side; + +#if !defined(MBEDTLS_ECDH_LEGACY_CONTEXT) +/** + * Defines the ECDH implementation used. + * + * Later versions of the library may add new variants, therefore users should + * not make any assumptions about them. + */ +typedef enum +{ + MBEDTLS_ECDH_VARIANT_NONE = 0, /*!< Implementation not defined. */ + MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0,/*!< The default Mbed TLS implementation */ +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) + MBEDTLS_ECDH_VARIANT_EVEREST /*!< Everest implementation */ +#endif +} mbedtls_ecdh_variant; + +/** + * The context used by the default ECDH implementation. + * + * Later versions might change the structure of this context, therefore users + * should not make any assumptions about the structure of + * mbedtls_ecdh_context_mbed. + */ +typedef struct mbedtls_ecdh_context_mbed +{ + mbedtls_ecp_group grp; /*!< The elliptic curve used. */ + mbedtls_mpi d; /*!< The private key. */ + mbedtls_ecp_point Q; /*!< The public key. */ + mbedtls_ecp_point Qp; /*!< The value of the public key of the peer. */ + mbedtls_mpi z; /*!< The shared secret. */ +#if defined(MBEDTLS_ECP_RESTARTABLE) + mbedtls_ecp_restart_ctx rs; /*!< The restart context for EC computations. */ +#endif +} mbedtls_ecdh_context_mbed; +#endif + +/** + * + * \warning Performing multiple operations concurrently on the same + * ECDSA context is not supported; objects of this type + * should not be shared between multiple threads. + * \brief The ECDH context structure. + */ +typedef struct mbedtls_ecdh_context +{ +#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT) + mbedtls_ecp_group grp; /*!< The elliptic curve used. */ + mbedtls_mpi d; /*!< The private key. */ + mbedtls_ecp_point Q; /*!< The public key. */ + mbedtls_ecp_point Qp; /*!< The value of the public key of the peer. */ + mbedtls_mpi z; /*!< The shared secret. */ + int point_format; /*!< The format of point export in TLS messages. */ + mbedtls_ecp_point Vi; /*!< The blinding value. */ + mbedtls_ecp_point Vf; /*!< The unblinding value. */ + mbedtls_mpi _d; /*!< The previous \p d. */ +#if defined(MBEDTLS_ECP_RESTARTABLE) + int restart_enabled; /*!< The flag for restartable mode. */ + mbedtls_ecp_restart_ctx rs; /*!< The restart context for EC computations. */ +#endif /* MBEDTLS_ECP_RESTARTABLE */ +#else + uint8_t point_format; /*!< The format of point export in TLS messages + as defined in RFC 4492. */ + mbedtls_ecp_group_id grp_id;/*!< The elliptic curve used. */ + mbedtls_ecdh_variant var; /*!< The ECDH implementation/structure used. */ + union + { + mbedtls_ecdh_context_mbed mbed_ecdh; +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) + mbedtls_ecdh_context_everest everest_ecdh; +#endif + } ctx; /*!< Implementation-specific context. The + context in use is specified by the \c var + field. */ +#if defined(MBEDTLS_ECP_RESTARTABLE) + uint8_t restart_enabled; /*!< The flag for restartable mode. Functions of + an alternative implementation not supporting + restartable mode must return + MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED error + if this flag is set. */ +#endif /* MBEDTLS_ECP_RESTARTABLE */ +#endif /* MBEDTLS_ECDH_LEGACY_CONTEXT */ +} +mbedtls_ecdh_context; + +/** + * \brief Check whether a given group can be used for ECDH. + * + * \param gid The ECP group ID to check. + * + * \return \c 1 if the group can be used, \c 0 otherwise + */ +int mbedtls_ecdh_can_do( mbedtls_ecp_group_id gid ); + +/** + * \brief This function generates an ECDH keypair on an elliptic + * curve. + * + * This function performs the first of two core computations + * implemented during the ECDH key exchange. The second core + * computation is performed by mbedtls_ecdh_compute_shared(). + * + * \see ecp.h + * + * \param grp The ECP group to use. This must be initialized and have + * domain parameters loaded, for example through + * mbedtls_ecp_load() or mbedtls_ecp_tls_read_group(). + * \param d The destination MPI (private key). + * This must be initialized. + * \param Q The destination point (public key). + * This must be initialized. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL in case \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return Another \c MBEDTLS_ERR_ECP_XXX or + * \c MBEDTLS_MPI_XXX error code on failure. + */ +int mbedtls_ecdh_gen_public( mbedtls_ecp_group *grp, mbedtls_mpi *d, mbedtls_ecp_point *Q, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function computes the shared secret. + * + * This function performs the second of two core computations + * implemented during the ECDH key exchange. The first core + * computation is performed by mbedtls_ecdh_gen_public(). + * + * \see ecp.h + * + * \note If \p f_rng is not NULL, it is used to implement + * countermeasures against side-channel attacks. + * For more information, see mbedtls_ecp_mul(). + * + * \param grp The ECP group to use. This must be initialized and have + * domain parameters loaded, for example through + * mbedtls_ecp_load() or mbedtls_ecp_tls_read_group(). + * \param z The destination MPI (shared secret). + * This must be initialized. + * \param Q The public key from another party. + * This must be initialized. + * \param d Our secret exponent (private key). + * This must be initialized. + * \param f_rng The RNG function. This may be \c NULL if randomization + * of intermediate results during the ECP computations is + * not needed (discouraged). See the documentation of + * mbedtls_ecp_mul() for more. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a + * context argument. + * + * \return \c 0 on success. + * \return Another \c MBEDTLS_ERR_ECP_XXX or + * \c MBEDTLS_MPI_XXX error code on failure. + */ +int mbedtls_ecdh_compute_shared( mbedtls_ecp_group *grp, mbedtls_mpi *z, + const mbedtls_ecp_point *Q, const mbedtls_mpi *d, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function initializes an ECDH context. + * + * \param ctx The ECDH context to initialize. This must not be \c NULL. + */ +void mbedtls_ecdh_init( mbedtls_ecdh_context *ctx ); + +/** + * \brief This function sets up the ECDH context with the information + * given. + * + * This function should be called after mbedtls_ecdh_init() but + * before mbedtls_ecdh_make_params(). There is no need to call + * this function before mbedtls_ecdh_read_params(). + * + * This is the first function used by a TLS server for ECDHE + * ciphersuites. + * + * \param ctx The ECDH context to set up. This must be initialized. + * \param grp_id The group id of the group to set up the context for. + * + * \return \c 0 on success. + */ +int mbedtls_ecdh_setup( mbedtls_ecdh_context *ctx, + mbedtls_ecp_group_id grp_id ); + +/** + * \brief This function frees a context. + * + * \param ctx The context to free. This may be \c NULL, in which + * case this function does nothing. If it is not \c NULL, + * it must point to an initialized ECDH context. + */ +void mbedtls_ecdh_free( mbedtls_ecdh_context *ctx ); + +/** + * \brief This function generates an EC key pair and exports its + * in the format used in a TLS ServerKeyExchange handshake + * message. + * + * This is the second function used by a TLS server for ECDHE + * ciphersuites. (It is called after mbedtls_ecdh_setup().) + * + * \see ecp.h + * + * \param ctx The ECDH context to use. This must be initialized + * and bound to a group, for example via mbedtls_ecdh_setup(). + * \param olen The address at which to store the number of Bytes written. + * \param buf The destination buffer. This must be a writable buffer of + * length \p blen Bytes. + * \param blen The length of the destination buffer \p buf in Bytes. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL in case \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_ecdh_make_params( mbedtls_ecdh_context *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function parses the ECDHE parameters in a + * TLS ServerKeyExchange handshake message. + * + * \note In a TLS handshake, this is the how the client + * sets up its ECDHE context from the server's public + * ECDHE key material. + * + * \see ecp.h + * + * \param ctx The ECDHE context to use. This must be initialized. + * \param buf On input, \c *buf must be the start of the input buffer. + * On output, \c *buf is updated to point to the end of the + * data that has been read. On success, this is the first byte + * past the end of the ServerKeyExchange parameters. + * On error, this is the point at which an error has been + * detected, which is usually not useful except to debug + * failures. + * \param end The end of the input buffer. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + * + */ +int mbedtls_ecdh_read_params( mbedtls_ecdh_context *ctx, + const unsigned char **buf, + const unsigned char *end ); + +/** + * \brief This function sets up an ECDH context from an EC key. + * + * It is used by clients and servers in place of the + * ServerKeyEchange for static ECDH, and imports ECDH + * parameters from the EC key information of a certificate. + * + * \see ecp.h + * + * \param ctx The ECDH context to set up. This must be initialized. + * \param key The EC key to use. This must be initialized. + * \param side Defines the source of the key. Possible values are: + * - #MBEDTLS_ECDH_OURS: The key is ours. + * - #MBEDTLS_ECDH_THEIRS: The key is that of the peer. + * + * \return \c 0 on success. + * \return Another \c MBEDTLS_ERR_ECP_XXX error code on failure. + * + */ +int mbedtls_ecdh_get_params( mbedtls_ecdh_context *ctx, + const mbedtls_ecp_keypair *key, + mbedtls_ecdh_side side ); + +/** + * \brief This function generates a public key and exports it + * as a TLS ClientKeyExchange payload. + * + * This is the second function used by a TLS client for ECDH(E) + * ciphersuites. + * + * \see ecp.h + * + * \param ctx The ECDH context to use. This must be initialized + * and bound to a group, the latter usually by + * mbedtls_ecdh_read_params(). + * \param olen The address at which to store the number of Bytes written. + * This must not be \c NULL. + * \param buf The destination buffer. This must be a writable buffer + * of length \p blen Bytes. + * \param blen The size of the destination buffer \p buf in Bytes. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL in case \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_ecdh_make_public( mbedtls_ecdh_context *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function parses and processes the ECDHE payload of a + * TLS ClientKeyExchange message. + * + * This is the third function used by a TLS server for ECDH(E) + * ciphersuites. (It is called after mbedtls_ecdh_setup() and + * mbedtls_ecdh_make_params().) + * + * \see ecp.h + * + * \param ctx The ECDH context to use. This must be initialized + * and bound to a group, for example via mbedtls_ecdh_setup(). + * \param buf The pointer to the ClientKeyExchange payload. This must + * be a readable buffer of length \p blen Bytes. + * \param blen The length of the input buffer \p buf in Bytes. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_ecdh_read_public( mbedtls_ecdh_context *ctx, + const unsigned char *buf, size_t blen ); + +/** + * \brief This function derives and exports the shared secret. + * + * This is the last function used by both TLS client + * and servers. + * + * \note If \p f_rng is not NULL, it is used to implement + * countermeasures against side-channel attacks. + * For more information, see mbedtls_ecp_mul(). + * + * \see ecp.h + + * \param ctx The ECDH context to use. This must be initialized + * and have its own private key generated and the peer's + * public key imported. + * \param olen The address at which to store the total number of + * Bytes written on success. This must not be \c NULL. + * \param buf The buffer to write the generated shared key to. This + * must be a writable buffer of size \p blen Bytes. + * \param blen The length of the destination buffer \p buf in Bytes. + * \param f_rng The RNG function, for blinding purposes. This may + * b \c NULL if blinding isn't needed. + * \param p_rng The RNG context. This may be \c NULL if \p f_rng + * doesn't need a context argument. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX error code on failure. + */ +int mbedtls_ecdh_calc_secret( mbedtls_ecdh_context *ctx, size_t *olen, + unsigned char *buf, size_t blen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +#if defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief This function enables restartable EC computations for this + * context. (Default: disabled.) + * + * \see \c mbedtls_ecp_set_max_ops() + * + * \note It is not possible to safely disable restartable + * computations once enabled, except by free-ing the context, + * which cancels possible in-progress operations. + * + * \param ctx The ECDH context to use. This must be initialized. + */ +void mbedtls_ecdh_enable_restart( mbedtls_ecdh_context *ctx ); +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +#ifdef __cplusplus +} +#endif + +#endif /* ecdh.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/ecdsa.h b/openharmony/armeabi-v7a/include/mbedtls/ecdsa.h new file mode 100644 index 00000000..264a638b --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/ecdsa.h @@ -0,0 +1,626 @@ +/** + * \file ecdsa.h + * + * \brief This file contains ECDSA definitions and functions. + * + * The Elliptic Curve Digital Signature Algorithm (ECDSA) is defined in + * Standards for Efficient Cryptography Group (SECG): + * SEC1 Elliptic Curve Cryptography. + * The use of ECDSA for TLS is defined in RFC-4492: Elliptic Curve + * Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS). + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_ECDSA_H +#define MBEDTLS_ECDSA_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/ecp.h" +#include "mbedtls/md.h" + +/** + * \brief Maximum ECDSA signature size for a given curve bit size + * + * \param bits Curve size in bits + * \return Maximum signature size in bytes + * + * \note This macro returns a compile-time constant if its argument + * is one. It may evaluate its argument multiple times. + */ +/* + * Ecdsa-Sig-Value ::= SEQUENCE { + * r INTEGER, + * s INTEGER + * } + * + * For each of r and s, the value (V) may include an extra initial "0" bit. + */ +#define MBEDTLS_ECDSA_MAX_SIG_LEN( bits ) \ + ( /*T,L of SEQUENCE*/ ( ( bits ) >= 61 * 8 ? 3 : 2 ) + \ + /*T,L of r,s*/ 2 * ( ( ( bits ) >= 127 * 8 ? 3 : 2 ) + \ + /*V of r,s*/ ( ( bits ) + 8 ) / 8 ) ) + +/** The maximal size of an ECDSA signature in Bytes. */ +#define MBEDTLS_ECDSA_MAX_LEN MBEDTLS_ECDSA_MAX_SIG_LEN( MBEDTLS_ECP_MAX_BITS ) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief The ECDSA context structure. + * + * \warning Performing multiple operations concurrently on the same + * ECDSA context is not supported; objects of this type + * should not be shared between multiple threads. + */ +typedef mbedtls_ecp_keypair mbedtls_ecdsa_context; + +#if defined(MBEDTLS_ECP_RESTARTABLE) + +/** + * \brief Internal restart context for ecdsa_verify() + * + * \note Opaque struct, defined in ecdsa.c + */ +typedef struct mbedtls_ecdsa_restart_ver mbedtls_ecdsa_restart_ver_ctx; + +/** + * \brief Internal restart context for ecdsa_sign() + * + * \note Opaque struct, defined in ecdsa.c + */ +typedef struct mbedtls_ecdsa_restart_sig mbedtls_ecdsa_restart_sig_ctx; + +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) +/** + * \brief Internal restart context for ecdsa_sign_det() + * + * \note Opaque struct, defined in ecdsa.c + */ +typedef struct mbedtls_ecdsa_restart_det mbedtls_ecdsa_restart_det_ctx; +#endif + +/** + * \brief General context for resuming ECDSA operations + */ +typedef struct +{ + mbedtls_ecp_restart_ctx ecp; /*!< base context for ECP restart and + shared administrative info */ + mbedtls_ecdsa_restart_ver_ctx *ver; /*!< ecdsa_verify() sub-context */ + mbedtls_ecdsa_restart_sig_ctx *sig; /*!< ecdsa_sign() sub-context */ +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) + mbedtls_ecdsa_restart_det_ctx *det; /*!< ecdsa_sign_det() sub-context */ +#endif +} mbedtls_ecdsa_restart_ctx; + +#else /* MBEDTLS_ECP_RESTARTABLE */ + +/* Now we can declare functions that take a pointer to that */ +typedef void mbedtls_ecdsa_restart_ctx; + +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +/** + * \brief This function checks whether a given group can be used + * for ECDSA. + * + * \param gid The ECP group ID to check. + * + * \return \c 1 if the group can be used, \c 0 otherwise + */ +int mbedtls_ecdsa_can_do( mbedtls_ecp_group_id gid ); + +/** + * \brief This function computes the ECDSA signature of a + * previously-hashed message. + * + * \note The deterministic version implemented in + * mbedtls_ecdsa_sign_det() is usually preferred. + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated + * as defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.3, step 5. + * + * \see ecp.h + * + * \param grp The context for the elliptic curve to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param r The MPI context in which to store the first part + * the signature. This must be initialized. + * \param s The MPI context in which to store the second part + * the signature. This must be initialized. + * \param d The private signing key. This must be initialized. + * \param buf The content to be signed. This is usually the hash of + * the original data to be signed. This must be a readable + * buffer of length \p blen Bytes. It may be \c NULL if + * \p blen is zero. + * \param blen The length of \p buf in Bytes. + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context parameter. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX + * or \c MBEDTLS_MPI_XXX error code on failure. + */ +int mbedtls_ecdsa_sign( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s, + const mbedtls_mpi *d, const unsigned char *buf, size_t blen, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ); + +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) +#if ! defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function computes the ECDSA signature of a + * previously-hashed message, deterministic version. + * + * For more information, see RFC-6979: Deterministic + * Usage of the Digital Signature Algorithm (DSA) and Elliptic + * Curve Digital Signature Algorithm (ECDSA). + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.3, step 5. + * + * \warning Since the output of the internal RNG is always the same for + * the same key and message, this limits the efficiency of + * blinding and leaks information through side channels. For + * secure behavior use mbedtls_ecdsa_sign_det_ext() instead. + * + * (Optimally the blinding is a random value that is different + * on every execution. In this case the blinding is still + * random from the attackers perspective, but is the same on + * each execution. This means that this blinding does not + * prevent attackers from recovering secrets by combining + * several measurement traces, but may prevent some attacks + * that exploit relationships between secret data.) + * + * \see ecp.h + * + * \param grp The context for the elliptic curve to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param r The MPI context in which to store the first part + * the signature. This must be initialized. + * \param s The MPI context in which to store the second part + * the signature. This must be initialized. + * \param d The private signing key. This must be initialized + * and setup, for example through mbedtls_ecp_gen_privkey(). + * \param buf The hashed content to be signed. This must be a readable + * buffer of length \p blen Bytes. It may be \c NULL if + * \p blen is zero. + * \param blen The length of \p buf in Bytes. + * \param md_alg The hash algorithm used to hash the original data. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + * error code on failure. + */ +int mbedtls_ecdsa_sign_det( mbedtls_ecp_group *grp, mbedtls_mpi *r, + mbedtls_mpi *s, const mbedtls_mpi *d, + const unsigned char *buf, size_t blen, + mbedtls_md_type_t md_alg ) MBEDTLS_DEPRECATED; +#undef MBEDTLS_DEPRECATED +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief This function computes the ECDSA signature of a + * previously-hashed message, deterministic version. + * + * For more information, see RFC-6979: Deterministic + * Usage of the Digital Signature Algorithm (DSA) and Elliptic + * Curve Digital Signature Algorithm (ECDSA). + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.3, step 5. + * + * \see ecp.h + * + * \param grp The context for the elliptic curve to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param r The MPI context in which to store the first part + * the signature. This must be initialized. + * \param s The MPI context in which to store the second part + * the signature. This must be initialized. + * \param d The private signing key. This must be initialized + * and setup, for example through mbedtls_ecp_gen_privkey(). + * \param buf The hashed content to be signed. This must be a readable + * buffer of length \p blen Bytes. It may be \c NULL if + * \p blen is zero. + * \param blen The length of \p buf in Bytes. + * \param md_alg The hash algorithm used to hash the original data. + * \param f_rng_blind The RNG function used for blinding. This must not be + * \c NULL. + * \param p_rng_blind The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context parameter. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + * error code on failure. + */ +int mbedtls_ecdsa_sign_det_ext( mbedtls_ecp_group *grp, mbedtls_mpi *r, + mbedtls_mpi *s, const mbedtls_mpi *d, + const unsigned char *buf, size_t blen, + mbedtls_md_type_t md_alg, + int (*f_rng_blind)(void *, unsigned char *, size_t), + void *p_rng_blind ); +#endif /* MBEDTLS_ECDSA_DETERMINISTIC */ + +/** + * \brief This function verifies the ECDSA signature of a + * previously-hashed message. + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.4, step 3. + * + * \see ecp.h + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param buf The hashed content that was signed. This must be a readable + * buffer of length \p blen Bytes. It may be \c NULL if + * \p blen is zero. + * \param blen The length of \p buf in Bytes. + * \param Q The public key to use for verification. This must be + * initialized and setup. + * \param r The first integer of the signature. + * This must be initialized. + * \param s The second integer of the signature. + * This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the signature + * is invalid. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + * error code on failure for any other reason. + */ +int mbedtls_ecdsa_verify( mbedtls_ecp_group *grp, + const unsigned char *buf, size_t blen, + const mbedtls_ecp_point *Q, const mbedtls_mpi *r, + const mbedtls_mpi *s); + +/** + * \brief This function computes the ECDSA signature and writes it + * to a buffer, serialized as defined in RFC-4492: + * Elliptic Curve Cryptography (ECC) Cipher Suites for + * Transport Layer Security (TLS). + * + * \warning It is not thread-safe to use the same context in + * multiple threads. + * + * \note The deterministic version is used if + * #MBEDTLS_ECDSA_DETERMINISTIC is defined. For more + * information, see RFC-6979: Deterministic Usage + * of the Digital Signature Algorithm (DSA) and Elliptic + * Curve Digital Signature Algorithm (ECDSA). + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.3, step 5. + * + * \see ecp.h + * + * \param ctx The ECDSA context to use. This must be initialized + * and have a group and private key bound to it, for example + * via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + * \param md_alg The message digest that was used to hash the message. + * \param hash The message hash to be signed. This must be a readable + * buffer of length \p blen Bytes. + * \param hlen The length of the hash \p hash in Bytes. + * \param sig The buffer to which to write the signature. This must be a + * writable buffer of length at least twice as large as the + * size of the curve used, plus 9. For example, 73 Bytes if + * a 256-bit curve is used. A buffer length of + * #MBEDTLS_ECDSA_MAX_LEN is always safe. + * \param slen The address at which to store the actual length of + * the signature written. Must not be \c NULL. + * \param f_rng The RNG function. This must not be \c NULL if + * #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise, + * it is used only for blinding and may be set to \c NULL, but + * doing so is DEPRECATED. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't use a context. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + * \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_ecdsa_write_signature( mbedtls_ecdsa_context *ctx, + mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hlen, + unsigned char *sig, size_t *slen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function computes the ECDSA signature and writes it + * to a buffer, in a restartable way. + * + * \see \c mbedtls_ecdsa_write_signature() + * + * \note This function is like \c mbedtls_ecdsa_write_signature() + * but it can return early and restart according to the limit + * set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + * + * \param ctx The ECDSA context to use. This must be initialized + * and have a group and private key bound to it, for example + * via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + * \param md_alg The message digest that was used to hash the message. + * \param hash The message hash to be signed. This must be a readable + * buffer of length \p blen Bytes. + * \param hlen The length of the hash \p hash in Bytes. + * \param sig The buffer to which to write the signature. This must be a + * writable buffer of length at least twice as large as the + * size of the curve used, plus 9. For example, 73 Bytes if + * a 256-bit curve is used. A buffer length of + * #MBEDTLS_ECDSA_MAX_LEN is always safe. + * \param slen The address at which to store the actual length of + * the signature written. Must not be \c NULL. + * \param f_rng The RNG function. This must not be \c NULL if + * #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise, + * it is unused and may be set to \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't use a context. + * \param rs_ctx The restart context to use. This may be \c NULL to disable + * restarting. If it is not \c NULL, it must point to an + * initialized restart context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + * \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_ecdsa_write_signature_restartable( mbedtls_ecdsa_context *ctx, + mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hlen, + unsigned char *sig, size_t *slen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + mbedtls_ecdsa_restart_ctx *rs_ctx ); + +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) +#if ! defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function computes an ECDSA signature and writes + * it to a buffer, serialized as defined in RFC-4492: + * Elliptic Curve Cryptography (ECC) Cipher Suites for + * Transport Layer Security (TLS). + * + * The deterministic version is defined in RFC-6979: + * Deterministic Usage of the Digital Signature Algorithm (DSA) + * and Elliptic Curve Digital Signature Algorithm (ECDSA). + * + * \warning It is not thread-safe to use the same context in + * multiple threads. + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.3, step 5. + * + * \see ecp.h + * + * \deprecated Superseded by mbedtls_ecdsa_write_signature() in + * Mbed TLS version 2.0 and later. + * + * \param ctx The ECDSA context to use. This must be initialized + * and have a group and private key bound to it, for example + * via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + * \param hash The message hash to be signed. This must be a readable + * buffer of length \p blen Bytes. + * \param hlen The length of the hash \p hash in Bytes. + * \param sig The buffer to which to write the signature. This must be a + * writable buffer of length at least twice as large as the + * size of the curve used, plus 9. For example, 73 Bytes if + * a 256-bit curve is used. A buffer length of + * #MBEDTLS_ECDSA_MAX_LEN is always safe. + * \param slen The address at which to store the actual length of + * the signature written. Must not be \c NULL. + * \param md_alg The message digest that was used to hash the message. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + * \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_ecdsa_write_signature_det( mbedtls_ecdsa_context *ctx, + const unsigned char *hash, size_t hlen, + unsigned char *sig, size_t *slen, + mbedtls_md_type_t md_alg ) MBEDTLS_DEPRECATED; +#undef MBEDTLS_DEPRECATED +#endif /* MBEDTLS_DEPRECATED_REMOVED */ +#endif /* MBEDTLS_ECDSA_DETERMINISTIC */ + +/** + * \brief This function reads and verifies an ECDSA signature. + * + * \note If the bitlength of the message hash is larger than the + * bitlength of the group order, then the hash is truncated as + * defined in Standards for Efficient Cryptography Group + * (SECG): SEC1 Elliptic Curve Cryptography, section + * 4.1.4, step 3. + * + * \see ecp.h + * + * \param ctx The ECDSA context to use. This must be initialized + * and have a group and public key bound to it. + * \param hash The message hash that was signed. This must be a readable + * buffer of length \p size Bytes. + * \param hlen The size of the hash \p hash. + * \param sig The signature to read and verify. This must be a readable + * buffer of length \p slen Bytes. + * \param slen The size of \p sig in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. + * \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid + * signature in \p sig, but its length is less than \p siglen. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX + * error code on failure for any other reason. + */ +int mbedtls_ecdsa_read_signature( mbedtls_ecdsa_context *ctx, + const unsigned char *hash, size_t hlen, + const unsigned char *sig, size_t slen ); + +/** + * \brief This function reads and verifies an ECDSA signature, + * in a restartable way. + * + * \see \c mbedtls_ecdsa_read_signature() + * + * \note This function is like \c mbedtls_ecdsa_read_signature() + * but it can return early and restart according to the limit + * set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + * + * \param ctx The ECDSA context to use. This must be initialized + * and have a group and public key bound to it. + * \param hash The message hash that was signed. This must be a readable + * buffer of length \p size Bytes. + * \param hlen The size of the hash \p hash. + * \param sig The signature to read and verify. This must be a readable + * buffer of length \p slen Bytes. + * \param slen The size of \p sig in Bytes. + * \param rs_ctx The restart context to use. This may be \c NULL to disable + * restarting. If it is not \c NULL, it must point to an + * initialized restart context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. + * \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid + * signature in \p sig, but its length is less than \p siglen. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX + * error code on failure for any other reason. + */ +int mbedtls_ecdsa_read_signature_restartable( mbedtls_ecdsa_context *ctx, + const unsigned char *hash, size_t hlen, + const unsigned char *sig, size_t slen, + mbedtls_ecdsa_restart_ctx *rs_ctx ); + +/** + * \brief This function generates an ECDSA keypair on the given curve. + * + * \see ecp.h + * + * \param ctx The ECDSA context to store the keypair in. + * This must be initialized. + * \param gid The elliptic curve to use. One of the various + * \c MBEDTLS_ECP_DP_XXX macros depending on configuration. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX code on failure. + */ +int mbedtls_ecdsa_genkey( mbedtls_ecdsa_context *ctx, mbedtls_ecp_group_id gid, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ); + +/** + * \brief This function sets up an ECDSA context from an EC key pair. + * + * \see ecp.h + * + * \param ctx The ECDSA context to setup. This must be initialized. + * \param key The EC key to use. This must be initialized and hold + * a private-public key pair or a public key. In the former + * case, the ECDSA context may be used for signature creation + * and verification after this call. In the latter case, it + * may be used for signature verification. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX code on failure. + */ +int mbedtls_ecdsa_from_keypair( mbedtls_ecdsa_context *ctx, + const mbedtls_ecp_keypair *key ); + +/** + * \brief This function initializes an ECDSA context. + * + * \param ctx The ECDSA context to initialize. + * This must not be \c NULL. + */ +void mbedtls_ecdsa_init( mbedtls_ecdsa_context *ctx ); + +/** + * \brief This function frees an ECDSA context. + * + * \param ctx The ECDSA context to free. This may be \c NULL, + * in which case this function does nothing. If it + * is not \c NULL, it must be initialized. + */ +void mbedtls_ecdsa_free( mbedtls_ecdsa_context *ctx ); + +#if defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Initialize a restart context. + * + * \param ctx The restart context to initialize. + * This must not be \c NULL. + */ +void mbedtls_ecdsa_restart_init( mbedtls_ecdsa_restart_ctx *ctx ); + +/** + * \brief Free the components of a restart context. + * + * \param ctx The restart context to free. This may be \c NULL, + * in which case this function does nothing. If it + * is not \c NULL, it must be initialized. + */ +void mbedtls_ecdsa_restart_free( mbedtls_ecdsa_restart_ctx *ctx ); +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +#ifdef __cplusplus +} +#endif + +#endif /* ecdsa.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/ecjpake.h b/openharmony/armeabi-v7a/include/mbedtls/ecjpake.h new file mode 100644 index 00000000..3564ff8d --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/ecjpake.h @@ -0,0 +1,275 @@ +/** + * \file ecjpake.h + * + * \brief Elliptic curve J-PAKE + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_ECJPAKE_H +#define MBEDTLS_ECJPAKE_H + +/* + * J-PAKE is a password-authenticated key exchange that allows deriving a + * strong shared secret from a (potentially low entropy) pre-shared + * passphrase, with forward secrecy and mutual authentication. + * https://en.wikipedia.org/wiki/Password_Authenticated_Key_Exchange_by_Juggling + * + * This file implements the Elliptic Curve variant of J-PAKE, + * as defined in Chapter 7.4 of the Thread v1.0 Specification, + * available to members of the Thread Group http://threadgroup.org/ + * + * As the J-PAKE algorithm is inherently symmetric, so is our API. + * Each party needs to send its first round message, in any order, to the + * other party, then each sends its second round message, in any order. + * The payloads are serialized in a way suitable for use in TLS, but could + * also be use outside TLS. + */ +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/ecp.h" +#include "mbedtls/md.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Roles in the EC J-PAKE exchange + */ +typedef enum { + MBEDTLS_ECJPAKE_CLIENT = 0, /**< Client */ + MBEDTLS_ECJPAKE_SERVER, /**< Server */ +} mbedtls_ecjpake_role; + +#if !defined(MBEDTLS_ECJPAKE_ALT) +/** + * EC J-PAKE context structure. + * + * J-PAKE is a symmetric protocol, except for the identifiers used in + * Zero-Knowledge Proofs, and the serialization of the second message + * (KeyExchange) as defined by the Thread spec. + * + * In order to benefit from this symmetry, we choose a different naming + * convention from the Thread v1.0 spec. Correspondence is indicated in the + * description as a pair C: client name, S: server name + */ +typedef struct mbedtls_ecjpake_context +{ + const mbedtls_md_info_t *md_info; /**< Hash to use */ + mbedtls_ecp_group grp; /**< Elliptic curve */ + mbedtls_ecjpake_role role; /**< Are we client or server? */ + int point_format; /**< Format for point export */ + + mbedtls_ecp_point Xm1; /**< My public key 1 C: X1, S: X3 */ + mbedtls_ecp_point Xm2; /**< My public key 2 C: X2, S: X4 */ + mbedtls_ecp_point Xp1; /**< Peer public key 1 C: X3, S: X1 */ + mbedtls_ecp_point Xp2; /**< Peer public key 2 C: X4, S: X2 */ + mbedtls_ecp_point Xp; /**< Peer public key C: Xs, S: Xc */ + + mbedtls_mpi xm1; /**< My private key 1 C: x1, S: x3 */ + mbedtls_mpi xm2; /**< My private key 2 C: x2, S: x4 */ + + mbedtls_mpi s; /**< Pre-shared secret (passphrase) */ +} mbedtls_ecjpake_context; + +#else /* MBEDTLS_ECJPAKE_ALT */ +#include "ecjpake_alt.h" +#endif /* MBEDTLS_ECJPAKE_ALT */ + +/** + * \brief Initialize an ECJPAKE context. + * + * \param ctx The ECJPAKE context to initialize. + * This must not be \c NULL. + */ +void mbedtls_ecjpake_init( mbedtls_ecjpake_context *ctx ); + +/** + * \brief Set up an ECJPAKE context for use. + * + * \note Currently the only values for hash/curve allowed by the + * standard are #MBEDTLS_MD_SHA256/#MBEDTLS_ECP_DP_SECP256R1. + * + * \param ctx The ECJPAKE context to set up. This must be initialized. + * \param role The role of the caller. This must be either + * #MBEDTLS_ECJPAKE_CLIENT or #MBEDTLS_ECJPAKE_SERVER. + * \param hash The identifier of the hash function to use, + * for example #MBEDTLS_MD_SHA256. + * \param curve The identifier of the elliptic curve to use, + * for example #MBEDTLS_ECP_DP_SECP256R1. + * \param secret The pre-shared secret (passphrase). This must be + * a readable buffer of length \p len Bytes. It need + * only be valid for the duration of this call. + * \param len The length of the pre-shared secret \p secret. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_setup( mbedtls_ecjpake_context *ctx, + mbedtls_ecjpake_role role, + mbedtls_md_type_t hash, + mbedtls_ecp_group_id curve, + const unsigned char *secret, + size_t len ); + +/** + * \brief Check if an ECJPAKE context is ready for use. + * + * \param ctx The ECJPAKE context to check. This must be + * initialized. + * + * \return \c 0 if the context is ready for use. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA otherwise. + */ +int mbedtls_ecjpake_check( const mbedtls_ecjpake_context *ctx ); + +/** + * \brief Generate and write the first round message + * (TLS: contents of the Client/ServerHello extension, + * excluding extension type and length bytes). + * + * \param ctx The ECJPAKE context to use. This must be + * initialized and set up. + * \param buf The buffer to write the contents to. This must be a + * writable buffer of length \p len Bytes. + * \param len The length of \p buf in Bytes. + * \param olen The address at which to store the total number + * of Bytes written to \p buf. This must not be \c NULL. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. This + * may be \c NULL if \p f_rng doesn't use a context. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_write_round_one( mbedtls_ecjpake_context *ctx, + unsigned char *buf, size_t len, size_t *olen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief Read and process the first round message + * (TLS: contents of the Client/ServerHello extension, + * excluding extension type and length bytes). + * + * \param ctx The ECJPAKE context to use. This must be initialized + * and set up. + * \param buf The buffer holding the first round message. This must + * be a readable buffer of length \p len Bytes. + * \param len The length in Bytes of \p buf. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_read_round_one( mbedtls_ecjpake_context *ctx, + const unsigned char *buf, + size_t len ); + +/** + * \brief Generate and write the second round message + * (TLS: contents of the Client/ServerKeyExchange). + * + * \param ctx The ECJPAKE context to use. This must be initialized, + * set up, and already have performed round one. + * \param buf The buffer to write the round two contents to. + * This must be a writable buffer of length \p len Bytes. + * \param len The size of \p buf in Bytes. + * \param olen The address at which to store the total number of Bytes + * written to \p buf. This must not be \c NULL. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. This + * may be \c NULL if \p f_rng doesn't use a context. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_write_round_two( mbedtls_ecjpake_context *ctx, + unsigned char *buf, size_t len, size_t *olen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief Read and process the second round message + * (TLS: contents of the Client/ServerKeyExchange). + * + * \param ctx The ECJPAKE context to use. This must be initialized + * and set up and already have performed round one. + * \param buf The buffer holding the second round message. This must + * be a readable buffer of length \p len Bytes. + * \param len The length in Bytes of \p buf. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_read_round_two( mbedtls_ecjpake_context *ctx, + const unsigned char *buf, + size_t len ); + +/** + * \brief Derive the shared secret + * (TLS: Pre-Master Secret). + * + * \param ctx The ECJPAKE context to use. This must be initialized, + * set up and have performed both round one and two. + * \param buf The buffer to write the derived secret to. This must + * be a writable buffer of length \p len Bytes. + * \param len The length of \p buf in Bytes. + * \param olen The address at which to store the total number of Bytes + * written to \p buf. This must not be \c NULL. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. This + * may be \c NULL if \p f_rng doesn't use a context. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_ecjpake_derive_secret( mbedtls_ecjpake_context *ctx, + unsigned char *buf, size_t len, size_t *olen, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This clears an ECJPAKE context and frees any + * embedded data structure. + * + * \param ctx The ECJPAKE context to free. This may be \c NULL, + * in which case this function does nothing. If it is not + * \c NULL, it must point to an initialized ECJPAKE context. + */ +void mbedtls_ecjpake_free( mbedtls_ecjpake_context *ctx ); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if a test failed + */ +int mbedtls_ecjpake_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + + +#endif /* ecjpake.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/ecp.h b/openharmony/armeabi-v7a/include/mbedtls/ecp.h new file mode 100644 index 00000000..64a0bccd --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/ecp.h @@ -0,0 +1,1311 @@ +/** + * \file ecp.h + * + * \brief This file provides an API for Elliptic Curves over GF(P) (ECP). + * + * The use of ECP in cryptography and TLS is defined in + * Standards for Efficient Cryptography Group (SECG): SEC1 + * Elliptic Curve Cryptography and + * RFC-4492: Elliptic Curve Cryptography (ECC) Cipher Suites + * for Transport Layer Security (TLS). + * + * RFC-2409: The Internet Key Exchange (IKE) defines ECP + * group types. + * + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_ECP_H +#define MBEDTLS_ECP_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/bignum.h" + +/* + * ECP error codes + */ +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_ECP_BAD_INPUT_DATA -0x4F80 +/** The buffer is too small to write to. */ +#define MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL -0x4F00 +/** The requested feature is not available, for example, the requested curve is not supported. */ +#define MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE -0x4E80 +/** The signature is not valid. */ +#define MBEDTLS_ERR_ECP_VERIFY_FAILED -0x4E00 +/** Memory allocation failed. */ +#define MBEDTLS_ERR_ECP_ALLOC_FAILED -0x4D80 +/** Generation of random value, such as ephemeral key, failed. */ +#define MBEDTLS_ERR_ECP_RANDOM_FAILED -0x4D00 +/** Invalid private or public key. */ +#define MBEDTLS_ERR_ECP_INVALID_KEY -0x4C80 +/** The buffer contains a valid signature followed by more data. */ +#define MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH -0x4C00 + +/* MBEDTLS_ERR_ECP_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** The ECP hardware accelerator failed. */ +#define MBEDTLS_ERR_ECP_HW_ACCEL_FAILED -0x4B80 + +/** Operation in progress, call again with the same parameters to continue. */ +#define MBEDTLS_ERR_ECP_IN_PROGRESS -0x4B00 + +/* Flags indicating whether to include code that is specific to certain + * types of curves. These flags are for internal library use only. */ +#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) +#define MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED +#endif +#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) || \ + defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) +#define MBEDTLS_ECP_MONTGOMERY_ENABLED +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Domain-parameter identifiers: curve, subgroup, and generator. + * + * \note Only curves over prime fields are supported. + * + * \warning This library does not support validation of arbitrary domain + * parameters. Therefore, only standardized domain parameters from trusted + * sources should be used. See mbedtls_ecp_group_load(). + */ +/* Note: when adding a new curve: + * - Add it at the end of this enum, otherwise you'll break the ABI by + * changing the numerical value for existing curves. + * - Increment MBEDTLS_ECP_DP_MAX below if needed. + * - Update the calculation of MBEDTLS_ECP_MAX_BITS_MIN below. + * - Add the corresponding MBEDTLS_ECP_DP_xxx_ENABLED macro definition to + * config.h. + * - List the curve as a dependency of MBEDTLS_ECP_C and + * MBEDTLS_ECDSA_C if supported in check_config.h. + * - Add the curve to the appropriate curve type macro + * MBEDTLS_ECP_yyy_ENABLED above. + * - Add the necessary definitions to ecp_curves.c. + * - Add the curve to the ecp_supported_curves array in ecp.c. + * - Add the curve to applicable profiles in x509_crt.c if applicable. + */ +typedef enum +{ + MBEDTLS_ECP_DP_NONE = 0, /*!< Curve not defined. */ + MBEDTLS_ECP_DP_SECP192R1, /*!< Domain parameters for the 192-bit curve defined by FIPS 186-4 and SEC1. */ + MBEDTLS_ECP_DP_SECP224R1, /*!< Domain parameters for the 224-bit curve defined by FIPS 186-4 and SEC1. */ + MBEDTLS_ECP_DP_SECP256R1, /*!< Domain parameters for the 256-bit curve defined by FIPS 186-4 and SEC1. */ + MBEDTLS_ECP_DP_SECP384R1, /*!< Domain parameters for the 384-bit curve defined by FIPS 186-4 and SEC1. */ + MBEDTLS_ECP_DP_SECP521R1, /*!< Domain parameters for the 521-bit curve defined by FIPS 186-4 and SEC1. */ + MBEDTLS_ECP_DP_BP256R1, /*!< Domain parameters for 256-bit Brainpool curve. */ + MBEDTLS_ECP_DP_BP384R1, /*!< Domain parameters for 384-bit Brainpool curve. */ + MBEDTLS_ECP_DP_BP512R1, /*!< Domain parameters for 512-bit Brainpool curve. */ + MBEDTLS_ECP_DP_CURVE25519, /*!< Domain parameters for Curve25519. */ + MBEDTLS_ECP_DP_SECP192K1, /*!< Domain parameters for 192-bit "Koblitz" curve. */ + MBEDTLS_ECP_DP_SECP224K1, /*!< Domain parameters for 224-bit "Koblitz" curve. */ + MBEDTLS_ECP_DP_SECP256K1, /*!< Domain parameters for 256-bit "Koblitz" curve. */ + MBEDTLS_ECP_DP_CURVE448, /*!< Domain parameters for Curve448. */ +} mbedtls_ecp_group_id; + +/** + * The number of supported curves, plus one for #MBEDTLS_ECP_DP_NONE. + * + * \note Montgomery curves are currently excluded. + */ +#define MBEDTLS_ECP_DP_MAX 12 + +/* + * Curve types + */ +typedef enum +{ + MBEDTLS_ECP_TYPE_NONE = 0, + MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS, /* y^2 = x^3 + a x + b */ + MBEDTLS_ECP_TYPE_MONTGOMERY, /* y^2 = x^3 + a x^2 + x */ +} mbedtls_ecp_curve_type; + +/** + * Curve information, for use by other modules. + */ +typedef struct mbedtls_ecp_curve_info +{ + mbedtls_ecp_group_id grp_id; /*!< An internal identifier. */ + uint16_t tls_id; /*!< The TLS NamedCurve identifier. */ + uint16_t bit_size; /*!< The curve size in bits. */ + const char *name; /*!< A human-friendly name. */ +} mbedtls_ecp_curve_info; + +/** + * \brief The ECP point structure, in Jacobian coordinates. + * + * \note All functions expect and return points satisfying + * the following condition: Z == 0 or + * Z == 1. Other values of \p Z are + * used only by internal functions. + * The point is zero, or "at infinity", if Z == 0. + * Otherwise, \p X and \p Y are its standard (affine) + * coordinates. + */ +typedef struct mbedtls_ecp_point +{ + mbedtls_mpi X; /*!< The X coordinate of the ECP point. */ + mbedtls_mpi Y; /*!< The Y coordinate of the ECP point. */ + mbedtls_mpi Z; /*!< The Z coordinate of the ECP point. */ +} +mbedtls_ecp_point; + +/* Determine the minimum safe value of MBEDTLS_ECP_MAX_BITS. */ +#if !defined(MBEDTLS_ECP_C) +#define MBEDTLS_ECP_MAX_BITS_MIN 0 +/* Note: the curves must be listed in DECREASING size! */ +#elif defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 521 +#elif defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 512 +#elif defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 448 +#elif defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 384 +#elif defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 384 +#elif defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 256 +#elif defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 256 +#elif defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 256 +#elif defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 255 +#elif defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 225 // n is slightly above 2^224 +#elif defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 224 +#elif defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 192 +#elif defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) +#define MBEDTLS_ECP_MAX_BITS_MIN 192 +#else +#error "MBEDTLS_ECP_C enabled, but no curve?" +#endif + +#if !defined(MBEDTLS_ECP_ALT) +/* + * default mbed TLS elliptic curve arithmetic implementation + * + * (in case MBEDTLS_ECP_ALT is defined then the developer has to provide an + * alternative implementation for the whole module and it will replace this + * one.) + */ + +/** + * \brief The ECP group structure. + * + * We consider two types of curve equations: + *
  • Short Weierstrass: y^2 = x^3 + A x + B mod P + * (SEC1 + RFC-4492)
    • + *
  • Montgomery: y^2 = x^3 + A x^2 + x mod P (Curve25519, + * Curve448)
+ * In both cases, the generator (\p G) for a prime-order subgroup is fixed. + * + * For Short Weierstrass, this subgroup is the whole curve, and its + * cardinality is denoted by \p N. Our code requires that \p N is an + * odd prime as mbedtls_ecp_mul() requires an odd number, and + * mbedtls_ecdsa_sign() requires that it is prime for blinding purposes. + * + * For Montgomery curves, we do not store \p A, but (A + 2) / 4, + * which is the quantity used in the formulas. Additionally, \p nbits is + * not the size of \p N but the required size for private keys. + * + * If \p modp is NULL, reduction modulo \p P is done using a generic algorithm. + * Otherwise, \p modp must point to a function that takes an \p mbedtls_mpi in the + * range of 0..2^(2*pbits)-1, and transforms it in-place to an integer + * which is congruent mod \p P to the given MPI, and is close enough to \p pbits + * in size, so that it may be efficiently brought in the 0..P-1 range by a few + * additions or subtractions. Therefore, it is only an approximative modular + * reduction. It must return 0 on success and non-zero on failure. + * + * \note Alternative implementations must keep the group IDs distinct. If + * two group structures have the same ID, then they must be + * identical. + * + */ +typedef struct mbedtls_ecp_group +{ + mbedtls_ecp_group_id id; /*!< An internal group identifier. */ + mbedtls_mpi P; /*!< The prime modulus of the base field. */ + mbedtls_mpi A; /*!< For Short Weierstrass: \p A in the equation. For + Montgomery curves: (A + 2) / 4. */ + mbedtls_mpi B; /*!< For Short Weierstrass: \p B in the equation. + For Montgomery curves: unused. */ + mbedtls_ecp_point G; /*!< The generator of the subgroup used. */ + mbedtls_mpi N; /*!< The order of \p G. */ + size_t pbits; /*!< The number of bits in \p P.*/ + size_t nbits; /*!< For Short Weierstrass: The number of bits in \p P. + For Montgomery curves: the number of bits in the + private keys. */ + unsigned int h; /*!< \internal 1 if the constants are static. */ + int (*modp)(mbedtls_mpi *); /*!< The function for fast pseudo-reduction + mod \p P (see above).*/ + int (*t_pre)(mbedtls_ecp_point *, void *); /*!< Unused. */ + int (*t_post)(mbedtls_ecp_point *, void *); /*!< Unused. */ + void *t_data; /*!< Unused. */ + mbedtls_ecp_point *T; /*!< Pre-computed points for ecp_mul_comb(). */ + size_t T_size; /*!< The number of pre-computed points. */ +} +mbedtls_ecp_group; + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h, or define them using the compiler command line. + * \{ + */ + +#if defined(MBEDTLS_ECP_MAX_BITS) + +#if MBEDTLS_ECP_MAX_BITS < MBEDTLS_ECP_MAX_BITS_MIN +#error "MBEDTLS_ECP_MAX_BITS is smaller than the largest supported curve" +#endif + +#elif defined(MBEDTLS_ECP_C) +/** + * The maximum size of the groups, that is, of \c N and \c P. + */ +#define MBEDTLS_ECP_MAX_BITS MBEDTLS_ECP_MAX_BITS_MIN + +#else +/* MBEDTLS_ECP_MAX_BITS is not relevant without MBEDTLS_ECP_C, but set it + * to a nonzero value so that code that unconditionally allocates an array + * of a size based on it keeps working if built without ECC support. */ +#define MBEDTLS_ECP_MAX_BITS 1 +#endif + +#define MBEDTLS_ECP_MAX_BYTES ( ( MBEDTLS_ECP_MAX_BITS + 7 ) / 8 ) +#define MBEDTLS_ECP_MAX_PT_LEN ( 2 * MBEDTLS_ECP_MAX_BYTES + 1 ) + +#if !defined(MBEDTLS_ECP_WINDOW_SIZE) +/* + * Maximum "window" size used for point multiplication. + * Default: a point where higher memory usage yields diminishing performance + * returns. + * Minimum value: 2. Maximum value: 7. + * + * Result is an array of at most ( 1 << ( MBEDTLS_ECP_WINDOW_SIZE - 1 ) ) + * points used for point multiplication. This value is directly tied to EC + * peak memory usage, so decreasing it by one should roughly cut memory usage + * by two (if large curves are in use). + * + * Reduction in size may reduce speed, but larger curves are impacted first. + * Sample performances (in ECDHE handshakes/s, with FIXED_POINT_OPTIM = 1): + * w-size: 6 5 4 3 2 + * 521 145 141 135 120 97 + * 384 214 209 198 177 146 + * 256 320 320 303 262 226 + * 224 475 475 453 398 342 + * 192 640 640 633 587 476 + */ +#define MBEDTLS_ECP_WINDOW_SIZE 4 /**< The maximum window size used. */ +#endif /* MBEDTLS_ECP_WINDOW_SIZE */ + +#if !defined(MBEDTLS_ECP_FIXED_POINT_OPTIM) +/* + * Trade memory for speed on fixed-point multiplication. + * + * This speeds up repeated multiplication of the generator (that is, the + * multiplication in ECDSA signatures, and half of the multiplications in + * ECDSA verification and ECDHE) by a factor roughly 3 to 4. + * + * The cost is increasing EC peak memory usage by a factor roughly 2. + * + * Change this value to 0 to reduce peak memory usage. + */ +#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up. */ +#endif /* MBEDTLS_ECP_FIXED_POINT_OPTIM */ + +/** \} name SECTION: Module settings */ + +#else /* MBEDTLS_ECP_ALT */ +#include "ecp_alt.h" +#endif /* MBEDTLS_ECP_ALT */ + +#if defined(MBEDTLS_ECP_RESTARTABLE) + +/** + * \brief Internal restart context for multiplication + * + * \note Opaque struct + */ +typedef struct mbedtls_ecp_restart_mul mbedtls_ecp_restart_mul_ctx; + +/** + * \brief Internal restart context for ecp_muladd() + * + * \note Opaque struct + */ +typedef struct mbedtls_ecp_restart_muladd mbedtls_ecp_restart_muladd_ctx; + +/** + * \brief General context for resuming ECC operations + */ +typedef struct +{ + unsigned ops_done; /*!< current ops count */ + unsigned depth; /*!< call depth (0 = top-level) */ + mbedtls_ecp_restart_mul_ctx *rsm; /*!< ecp_mul_comb() sub-context */ + mbedtls_ecp_restart_muladd_ctx *ma; /*!< ecp_muladd() sub-context */ +} mbedtls_ecp_restart_ctx; + +/* + * Operation counts for restartable functions + */ +#define MBEDTLS_ECP_OPS_CHK 3 /*!< basic ops count for ecp_check_pubkey() */ +#define MBEDTLS_ECP_OPS_DBL 8 /*!< basic ops count for ecp_double_jac() */ +#define MBEDTLS_ECP_OPS_ADD 11 /*!< basic ops count for see ecp_add_mixed() */ +#define MBEDTLS_ECP_OPS_INV 120 /*!< empirical equivalent for mpi_mod_inv() */ + +/** + * \brief Internal; for restartable functions in other modules. + * Check and update basic ops budget. + * + * \param grp Group structure + * \param rs_ctx Restart context + * \param ops Number of basic ops to do + * + * \return \c 0 if doing \p ops basic ops is still allowed, + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS otherwise. + */ +int mbedtls_ecp_check_budget( const mbedtls_ecp_group *grp, + mbedtls_ecp_restart_ctx *rs_ctx, + unsigned ops ); + +/* Utility macro for checking and updating ops budget */ +#define MBEDTLS_ECP_BUDGET( ops ) \ + MBEDTLS_MPI_CHK( mbedtls_ecp_check_budget( grp, rs_ctx, \ + (unsigned) (ops) ) ); + +#else /* MBEDTLS_ECP_RESTARTABLE */ + +#define MBEDTLS_ECP_BUDGET( ops ) /* no-op; for compatibility */ + +/* We want to declare restartable versions of existing functions anyway */ +typedef void mbedtls_ecp_restart_ctx; + +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +/** + * \brief The ECP key-pair structure. + * + * A generic key-pair that may be used for ECDSA and fixed ECDH, for example. + * + * \note Members are deliberately in the same order as in the + * ::mbedtls_ecdsa_context structure. + */ +typedef struct mbedtls_ecp_keypair +{ + mbedtls_ecp_group grp; /*!< Elliptic curve and base point */ + mbedtls_mpi d; /*!< our secret value */ + mbedtls_ecp_point Q; /*!< our public value */ +} +mbedtls_ecp_keypair; + +/* + * Point formats, from RFC 4492's enum ECPointFormat + */ +#define MBEDTLS_ECP_PF_UNCOMPRESSED 0 /**< Uncompressed point format. */ +#define MBEDTLS_ECP_PF_COMPRESSED 1 /**< Compressed point format. */ + +/* + * Some other constants from RFC 4492 + */ +#define MBEDTLS_ECP_TLS_NAMED_CURVE 3 /**< The named_curve of ECCurveType. */ + +#if defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Set the maximum number of basic operations done in a row. + * + * If more operations are needed to complete a computation, + * #MBEDTLS_ERR_ECP_IN_PROGRESS will be returned by the + * function performing the computation. It is then the + * caller's responsibility to either call again with the same + * parameters until it returns 0 or an error code; or to free + * the restart context if the operation is to be aborted. + * + * It is strictly required that all input parameters and the + * restart context be the same on successive calls for the + * same operation, but output parameters need not be the + * same; they must not be used until the function finally + * returns 0. + * + * This only applies to functions whose documentation + * mentions they may return #MBEDTLS_ERR_ECP_IN_PROGRESS (or + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS for functions in the + * SSL module). For functions that accept a "restart context" + * argument, passing NULL disables restart and makes the + * function equivalent to the function with the same name + * with \c _restartable removed. For functions in the ECDH + * module, restart is disabled unless the function accepts + * an "ECDH context" argument and + * mbedtls_ecdh_enable_restart() was previously called on + * that context. For function in the SSL module, restart is + * only enabled for specific sides and key exchanges + * (currently only for clients and ECDHE-ECDSA). + * + * \param max_ops Maximum number of basic operations done in a row. + * Default: 0 (unlimited). + * Lower (non-zero) values mean ECC functions will block for + * a lesser maximum amount of time. + * + * \note A "basic operation" is defined as a rough equivalent of a + * multiplication in GF(p) for the NIST P-256 curve. + * As an indication, with default settings, a scalar + * multiplication (full run of \c mbedtls_ecp_mul()) is: + * - about 3300 basic operations for P-256 + * - about 9400 basic operations for P-384 + * + * \note Very low values are not always respected: sometimes + * functions need to block for a minimum number of + * operations, and will do so even if max_ops is set to a + * lower value. That minimum depends on the curve size, and + * can be made lower by decreasing the value of + * \c MBEDTLS_ECP_WINDOW_SIZE. As an indication, here is the + * lowest effective value for various curves and values of + * that parameter (w for short): + * w=6 w=5 w=4 w=3 w=2 + * P-256 208 208 160 136 124 + * P-384 682 416 320 272 248 + * P-521 1364 832 640 544 496 + * + * \note This setting is currently ignored by Curve25519. + */ +void mbedtls_ecp_set_max_ops( unsigned max_ops ); + +/** + * \brief Check if restart is enabled (max_ops != 0) + * + * \return \c 0 if \c max_ops == 0 (restart disabled) + * \return \c 1 otherwise (restart enabled) + */ +int mbedtls_ecp_restart_is_enabled( void ); +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +/* + * Get the type of a curve + */ +mbedtls_ecp_curve_type mbedtls_ecp_get_type( const mbedtls_ecp_group *grp ); + +/** + * \brief This function retrieves the information defined in + * mbedtls_ecp_curve_info() for all supported curves. + * + * \note This function returns information about all curves + * supported by the library. Some curves may not be + * supported for all algorithms. Call mbedtls_ecdh_can_do() + * or mbedtls_ecdsa_can_do() to check if a curve is + * supported for ECDH or ECDSA. + * + * \return A statically allocated array. The last entry is 0. + */ +const mbedtls_ecp_curve_info *mbedtls_ecp_curve_list( void ); + +/** + * \brief This function retrieves the list of internal group + * identifiers of all supported curves in the order of + * preference. + * + * \note This function returns information about all curves + * supported by the library. Some curves may not be + * supported for all algorithms. Call mbedtls_ecdh_can_do() + * or mbedtls_ecdsa_can_do() to check if a curve is + * supported for ECDH or ECDSA. + * + * \return A statically allocated array, + * terminated with MBEDTLS_ECP_DP_NONE. + */ +const mbedtls_ecp_group_id *mbedtls_ecp_grp_id_list( void ); + +/** + * \brief This function retrieves curve information from an internal + * group identifier. + * + * \param grp_id An \c MBEDTLS_ECP_DP_XXX value. + * + * \return The associated curve information on success. + * \return NULL on failure. + */ +const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_grp_id( mbedtls_ecp_group_id grp_id ); + +/** + * \brief This function retrieves curve information from a TLS + * NamedCurve value. + * + * \param tls_id An \c MBEDTLS_ECP_DP_XXX value. + * + * \return The associated curve information on success. + * \return NULL on failure. + */ +const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_tls_id( uint16_t tls_id ); + +/** + * \brief This function retrieves curve information from a + * human-readable name. + * + * \param name The human-readable name. + * + * \return The associated curve information on success. + * \return NULL on failure. + */ +const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_name( const char *name ); + +/** + * \brief This function initializes a point as zero. + * + * \param pt The point to initialize. + */ +void mbedtls_ecp_point_init( mbedtls_ecp_point *pt ); + +/** + * \brief This function initializes an ECP group context + * without loading any domain parameters. + * + * \note After this function is called, domain parameters + * for various ECP groups can be loaded through the + * mbedtls_ecp_group_load() or mbedtls_ecp_tls_read_group() + * functions. + */ +void mbedtls_ecp_group_init( mbedtls_ecp_group *grp ); + +/** + * \brief This function initializes a key pair as an invalid one. + * + * \param key The key pair to initialize. + */ +void mbedtls_ecp_keypair_init( mbedtls_ecp_keypair *key ); + +/** + * \brief This function frees the components of a point. + * + * \param pt The point to free. + */ +void mbedtls_ecp_point_free( mbedtls_ecp_point *pt ); + +/** + * \brief This function frees the components of an ECP group. + * + * \param grp The group to free. This may be \c NULL, in which + * case this function returns immediately. If it is not + * \c NULL, it must point to an initialized ECP group. + */ +void mbedtls_ecp_group_free( mbedtls_ecp_group *grp ); + +/** + * \brief This function frees the components of a key pair. + * + * \param key The key pair to free. This may be \c NULL, in which + * case this function returns immediately. If it is not + * \c NULL, it must point to an initialized ECP key pair. + */ +void mbedtls_ecp_keypair_free( mbedtls_ecp_keypair *key ); + +#if defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Initialize a restart context. + * + * \param ctx The restart context to initialize. This must + * not be \c NULL. + */ +void mbedtls_ecp_restart_init( mbedtls_ecp_restart_ctx *ctx ); + +/** + * \brief Free the components of a restart context. + * + * \param ctx The restart context to free. This may be \c NULL, in which + * case this function returns immediately. If it is not + * \c NULL, it must point to an initialized restart context. + */ +void mbedtls_ecp_restart_free( mbedtls_ecp_restart_ctx *ctx ); +#endif /* MBEDTLS_ECP_RESTARTABLE */ + +/** + * \brief This function copies the contents of point \p Q into + * point \p P. + * + * \param P The destination point. This must be initialized. + * \param Q The source point. This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return Another negative error code for other kinds of failure. + */ +int mbedtls_ecp_copy( mbedtls_ecp_point *P, const mbedtls_ecp_point *Q ); + +/** + * \brief This function copies the contents of group \p src into + * group \p dst. + * + * \param dst The destination group. This must be initialized. + * \param src The source group. This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_group_copy( mbedtls_ecp_group *dst, + const mbedtls_ecp_group *src ); + +/** + * \brief This function sets a point to the point at infinity. + * + * \param pt The point to set. This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_set_zero( mbedtls_ecp_point *pt ); + +/** + * \brief This function checks if a point is the point at infinity. + * + * \param pt The point to test. This must be initialized. + * + * \return \c 1 if the point is zero. + * \return \c 0 if the point is non-zero. + * \return A negative error code on failure. + */ +int mbedtls_ecp_is_zero( mbedtls_ecp_point *pt ); + +/** + * \brief This function compares two points. + * + * \note This assumes that the points are normalized. Otherwise, + * they may compare as "not equal" even if they are. + * + * \param P The first point to compare. This must be initialized. + * \param Q The second point to compare. This must be initialized. + * + * \return \c 0 if the points are equal. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the points are not equal. + */ +int mbedtls_ecp_point_cmp( const mbedtls_ecp_point *P, + const mbedtls_ecp_point *Q ); + +/** + * \brief This function imports a non-zero point from two ASCII + * strings. + * + * \param P The destination point. This must be initialized. + * \param radix The numeric base of the input. + * \param x The first affine coordinate, as a null-terminated string. + * \param y The second affine coordinate, as a null-terminated string. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_MPI_XXX error code on failure. + */ +int mbedtls_ecp_point_read_string( mbedtls_ecp_point *P, int radix, + const char *x, const char *y ); + +/** + * \brief This function exports a point into unsigned binary data. + * + * \param grp The group to which the point should belong. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param P The point to export. This must be initialized. + * \param format The point format. This must be either + * #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + * (For groups without these formats, this parameter is + * ignored. But it still has to be either of the above + * values.) + * \param olen The address at which to store the length of + * the output in Bytes. This must not be \c NULL. + * \param buf The output buffer. This must be a writable buffer + * of length \p buflen Bytes. + * \param buflen The length of the output buffer \p buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer + * is too small to hold the point. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format + * or the export for the given group is not implemented. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_point_write_binary( const mbedtls_ecp_group *grp, + const mbedtls_ecp_point *P, + int format, size_t *olen, + unsigned char *buf, size_t buflen ); + +/** + * \brief This function imports a point from unsigned binary data. + * + * \note This function does not check that the point actually + * belongs to the given group, see mbedtls_ecp_check_pubkey() + * for that. + * + * \param grp The group to which the point should belong. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param P The destination context to import the point to. + * This must be initialized. + * \param buf The input buffer. This must be a readable buffer + * of length \p ilen Bytes. + * \param ilen The length of the input buffer \p buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the import for the + * given group is not implemented. + */ +int mbedtls_ecp_point_read_binary( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *P, + const unsigned char *buf, size_t ilen ); + +/** + * \brief This function imports a point from a TLS ECPoint record. + * + * \note On function return, \p *buf is updated to point immediately + * after the ECPoint record. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param pt The destination point. + * \param buf The address of the pointer to the start of the input buffer. + * \param len The length of the buffer. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_MPI_XXX error code on initialization + * failure. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + */ +int mbedtls_ecp_tls_read_point( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *pt, + const unsigned char **buf, size_t len ); + +/** + * \brief This function exports a point as a TLS ECPoint record + * defined in RFC 4492, Section 5.4. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param pt The point to be exported. This must be initialized. + * \param format The point format to use. This must be either + * #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + * \param olen The address at which to store the length in Bytes + * of the data written. + * \param buf The target buffer. This must be a writable buffer of + * length \p blen Bytes. + * \param blen The length of the target buffer \p buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. + * \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the target buffer + * is too small to hold the exported point. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_tls_write_point( const mbedtls_ecp_group *grp, + const mbedtls_ecp_point *pt, + int format, size_t *olen, + unsigned char *buf, size_t blen ); + +/** + * \brief This function sets up an ECP group context + * from a standardized set of domain parameters. + * + * \note The index should be a value of the NamedCurve enum, + * as defined in RFC-4492: Elliptic Curve Cryptography + * (ECC) Cipher Suites for Transport Layer Security (TLS), + * usually in the form of an \c MBEDTLS_ECP_DP_XXX macro. + * + * \param grp The group context to setup. This must be initialized. + * \param id The identifier of the domain parameter set to load. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p id doesn't + * correspond to a known group. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_group_load( mbedtls_ecp_group *grp, mbedtls_ecp_group_id id ); + +/** + * \brief This function sets up an ECP group context from a TLS + * ECParameters record as defined in RFC 4492, Section 5.4. + * + * \note The read pointer \p buf is updated to point right after + * the ECParameters record on exit. + * + * \param grp The group context to setup. This must be initialized. + * \param buf The address of the pointer to the start of the input buffer. + * \param len The length of the input buffer \c *buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not + * recognized. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_tls_read_group( mbedtls_ecp_group *grp, + const unsigned char **buf, size_t len ); + +/** + * \brief This function extracts an elliptic curve group ID from a + * TLS ECParameters record as defined in RFC 4492, Section 5.4. + * + * \note The read pointer \p buf is updated to point right after + * the ECParameters record on exit. + * + * \param grp The address at which to store the group id. + * This must not be \c NULL. + * \param buf The address of the pointer to the start of the input buffer. + * \param len The length of the input buffer \c *buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not + * recognized. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_tls_read_group_id( mbedtls_ecp_group_id *grp, + const unsigned char **buf, + size_t len ); +/** + * \brief This function exports an elliptic curve as a TLS + * ECParameters record as defined in RFC 4492, Section 5.4. + * + * \param grp The ECP group to be exported. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param olen The address at which to store the number of Bytes written. + * This must not be \c NULL. + * \param buf The buffer to write to. This must be a writable buffer + * of length \p blen Bytes. + * \param blen The length of the output buffer \p buf in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output + * buffer is too small to hold the exported group. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_tls_write_group( const mbedtls_ecp_group *grp, + size_t *olen, + unsigned char *buf, size_t blen ); + +/** + * \brief This function performs a scalar multiplication of a point + * by an integer: \p R = \p m * \p P. + * + * It is not thread-safe to use same group in multiple threads. + * + * \note To prevent timing attacks, this function + * executes the exact same sequence of base-field + * operations for any valid \p m. It avoids any if-branch or + * array index depending on the value of \p m. + * + * \note If \p f_rng is not NULL, it is used to randomize + * intermediate results to prevent potential timing attacks + * targeting these results. We recommend always providing + * a non-NULL \p f_rng. The overhead is negligible. + * Note: unless #MBEDTLS_ECP_NO_INTERNAL_RNG is defined, when + * \p f_rng is NULL, an internal RNG (seeded from the value + * of \p m) will be used instead. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param R The point in which to store the result of the calculation. + * This must be initialized. + * \param m The integer by which to multiply. This must be initialized. + * \param P The point to multiply. This must be initialized. + * \param f_rng The RNG function. This may be \c NULL if randomization + * of intermediate results isn't desired (discouraged). + * \param p_rng The RNG context to be passed to \p p_rng. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private + * key, or \p P is not a valid public key. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_mul( mbedtls_ecp_group *grp, mbedtls_ecp_point *R, + const mbedtls_mpi *m, const mbedtls_ecp_point *P, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ); + +/** + * \brief This function performs multiplication of a point by + * an integer: \p R = \p m * \p P in a restartable way. + * + * \see mbedtls_ecp_mul() + * + * \note This function does the same as \c mbedtls_ecp_mul(), but + * it can return early and restart according to the limit set + * with \c mbedtls_ecp_set_max_ops() to reduce blocking. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param R The point in which to store the result of the calculation. + * This must be initialized. + * \param m The integer by which to multiply. This must be initialized. + * \param P The point to multiply. This must be initialized. + * \param f_rng The RNG function. This may be \c NULL if randomization + * of intermediate results isn't desired (discouraged). + * \param p_rng The RNG context to be passed to \p p_rng. + * \param rs_ctx The restart context (NULL disables restart). + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private + * key, or \p P is not a valid public key. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_mul_restartable( mbedtls_ecp_group *grp, mbedtls_ecp_point *R, + const mbedtls_mpi *m, const mbedtls_ecp_point *P, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, + mbedtls_ecp_restart_ctx *rs_ctx ); + +#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) +/** + * \brief This function performs multiplication and addition of two + * points by integers: \p R = \p m * \p P + \p n * \p Q + * + * It is not thread-safe to use same group in multiple threads. + * + * \note In contrast to mbedtls_ecp_mul(), this function does not + * guarantee a constant execution flow and timing. + * + * \note This function is only defined for short Weierstrass curves. + * It may not be included in builds without any short + * Weierstrass curve. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param R The point in which to store the result of the calculation. + * This must be initialized. + * \param m The integer by which to multiply \p P. + * This must be initialized. + * \param P The point to multiply by \p m. This must be initialized. + * \param n The integer by which to multiply \p Q. + * This must be initialized. + * \param Q The point to be multiplied by \p n. + * This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not + * valid private keys, or \p P or \p Q are not valid public + * keys. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not + * designate a short Weierstrass curve. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_muladd( mbedtls_ecp_group *grp, mbedtls_ecp_point *R, + const mbedtls_mpi *m, const mbedtls_ecp_point *P, + const mbedtls_mpi *n, const mbedtls_ecp_point *Q ); + +/** + * \brief This function performs multiplication and addition of two + * points by integers: \p R = \p m * \p P + \p n * \p Q in a + * restartable way. + * + * \see \c mbedtls_ecp_muladd() + * + * \note This function works the same as \c mbedtls_ecp_muladd(), + * but it can return early and restart according to the limit + * set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + * + * \note This function is only defined for short Weierstrass curves. + * It may not be included in builds without any short + * Weierstrass curve. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param R The point in which to store the result of the calculation. + * This must be initialized. + * \param m The integer by which to multiply \p P. + * This must be initialized. + * \param P The point to multiply by \p m. This must be initialized. + * \param n The integer by which to multiply \p Q. + * This must be initialized. + * \param Q The point to be multiplied by \p n. + * This must be initialized. + * \param rs_ctx The restart context (NULL disables restart). + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not + * valid private keys, or \p P or \p Q are not valid public + * keys. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not + * designate a short Weierstrass curve. + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_muladd_restartable( + mbedtls_ecp_group *grp, mbedtls_ecp_point *R, + const mbedtls_mpi *m, const mbedtls_ecp_point *P, + const mbedtls_mpi *n, const mbedtls_ecp_point *Q, + mbedtls_ecp_restart_ctx *rs_ctx ); +#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ + +/** + * \brief This function checks that a point is a valid public key + * on this curve. + * + * It only checks that the point is non-zero, has + * valid coordinates and lies on the curve. It does not verify + * that it is indeed a multiple of \p G. This additional + * check is computationally more expensive, is not required + * by standards, and should not be necessary if the group + * used has a small cofactor. In particular, it is useless for + * the NIST groups which all have a cofactor of 1. + * + * \note This function uses bare components rather than an + * ::mbedtls_ecp_keypair structure, to ease use with other + * structures, such as ::mbedtls_ecdh_context or + * ::mbedtls_ecdsa_context. + * + * \param grp The ECP group the point should belong to. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param pt The point to check. This must be initialized. + * + * \return \c 0 if the point is a valid public key. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not + * a valid public key for the given curve. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_check_pubkey( const mbedtls_ecp_group *grp, + const mbedtls_ecp_point *pt ); + +/** + * \brief This function checks that an \p mbedtls_mpi is a + * valid private key for this curve. + * + * \note This function uses bare components rather than an + * ::mbedtls_ecp_keypair structure to ease use with other + * structures, such as ::mbedtls_ecdh_context or + * ::mbedtls_ecdsa_context. + * + * \param grp The ECP group the private key should belong to. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param d The integer to check. This must be initialized. + * + * \return \c 0 if the point is a valid private key. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not a valid + * private key for the given curve. + * \return Another negative error code on other kinds of failure. + */ +int mbedtls_ecp_check_privkey( const mbedtls_ecp_group *grp, + const mbedtls_mpi *d ); + +/** + * \brief This function generates a private key. + * + * \param grp The ECP group to generate a private key for. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param d The destination MPI (secret part). This must be initialized. + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG parameter to be passed to \p f_rng. This may be + * \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + * on failure. + */ +int mbedtls_ecp_gen_privkey( const mbedtls_ecp_group *grp, + mbedtls_mpi *d, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function generates a keypair with a configurable base + * point. + * + * \note This function uses bare components rather than an + * ::mbedtls_ecp_keypair structure to ease use with other + * structures, such as ::mbedtls_ecdh_context or + * ::mbedtls_ecdsa_context. + * + * \param grp The ECP group to generate a key pair for. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param G The base point to use. This must be initialized + * and belong to \p grp. It replaces the default base + * point \c grp->G used by mbedtls_ecp_gen_keypair(). + * \param d The destination MPI (secret part). + * This must be initialized. + * \param Q The destination point (public part). + * This must be initialized. + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may + * be \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + * on failure. + */ +int mbedtls_ecp_gen_keypair_base( mbedtls_ecp_group *grp, + const mbedtls_ecp_point *G, + mbedtls_mpi *d, mbedtls_ecp_point *Q, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function generates an ECP keypair. + * + * \note This function uses bare components rather than an + * ::mbedtls_ecp_keypair structure to ease use with other + * structures, such as ::mbedtls_ecdh_context or + * ::mbedtls_ecdsa_context. + * + * \param grp The ECP group to generate a key pair for. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * \param d The destination MPI (secret part). + * This must be initialized. + * \param Q The destination point (public part). + * This must be initialized. + * \param f_rng The RNG function. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may + * be \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + * on failure. + */ +int mbedtls_ecp_gen_keypair( mbedtls_ecp_group *grp, mbedtls_mpi *d, + mbedtls_ecp_point *Q, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function generates an ECP key. + * + * \param grp_id The ECP group identifier. + * \param key The destination key. This must be initialized. + * \param f_rng The RNG function to use. This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may + * be \c NULL if \p f_rng doesn't need a context argument. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + * on failure. + */ +int mbedtls_ecp_gen_key( mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief This function reads an elliptic curve private key. + * + * \param grp_id The ECP group identifier. + * \param key The destination key. + * \param buf The buffer containing the binary representation of the + * key. (Big endian integer for Weierstrass curves, byte + * string for Montgomery curves.) + * \param buflen The length of the buffer in bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_INVALID_KEY error if the key is + * invalid. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for + * the group is not implemented. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_ecp_read_key( mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key, + const unsigned char *buf, size_t buflen ); + +/** + * \brief This function exports an elliptic curve private key. + * + * \param key The private key. + * \param buf The output buffer for containing the binary representation + * of the key. (Big endian integer for Weierstrass curves, byte + * string for Montgomery curves.) + * \param buflen The total length of the buffer in bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the \p key + representation is larger than the available space in \p buf. + * \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for + * the group is not implemented. + * \return Another negative error code on different kinds of failure. + */ +int mbedtls_ecp_write_key( mbedtls_ecp_keypair *key, + unsigned char *buf, size_t buflen ); + +/** + * \brief This function checks that the keypair objects + * \p pub and \p prv have the same group and the + * same public point, and that the private key in + * \p prv is consistent with the public key. + * + * \param pub The keypair structure holding the public key. This + * must be initialized. If it contains a private key, that + * part is ignored. + * \param prv The keypair structure holding the full keypair. + * This must be initialized. + * + * \return \c 0 on success, meaning that the keys are valid and match. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the keys are invalid or do not match. + * \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX + * error code on calculation failure. + */ +int mbedtls_ecp_check_pub_priv( const mbedtls_ecp_keypair *pub, + const mbedtls_ecp_keypair *prv ); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The ECP checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_ecp_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* ecp.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/ecp_internal.h b/openharmony/armeabi-v7a/include/mbedtls/ecp_internal.h new file mode 100644 index 00000000..6a47a8ff --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/ecp_internal.h @@ -0,0 +1,297 @@ +/** + * \file ecp_internal.h + * + * \brief Function declarations for alternative implementation of elliptic curve + * point arithmetic. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/* + * References: + * + * [1] BERNSTEIN, Daniel J. Curve25519: new Diffie-Hellman speed records. + * + * + * [2] CORON, Jean-S'ebastien. Resistance against differential power analysis + * for elliptic curve cryptosystems. In : Cryptographic Hardware and + * Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302. + * + * + * [3] HEDABOU, Mustapha, PINEL, Pierre, et B'EN'ETEAU, Lucien. A comb method to + * render ECC resistant against Side Channel Attacks. IACR Cryptology + * ePrint Archive, 2004, vol. 2004, p. 342. + * + * + * [4] Certicom Research. SEC 2: Recommended Elliptic Curve Domain Parameters. + * + * + * [5] HANKERSON, Darrel, MENEZES, Alfred J., VANSTONE, Scott. Guide to Elliptic + * Curve Cryptography. + * + * [6] Digital Signature Standard (DSS), FIPS 186-4. + * + * + * [7] Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer + * Security (TLS), RFC 4492. + * + * + * [8] + * + * [9] COHEN, Henri. A Course in Computational Algebraic Number Theory. + * Springer Science & Business Media, 1 Aug 2000 + */ + +#ifndef MBEDTLS_ECP_INTERNAL_H +#define MBEDTLS_ECP_INTERNAL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#if defined(MBEDTLS_ECP_INTERNAL_ALT) + +/** + * \brief Indicate if the Elliptic Curve Point module extension can + * handle the group. + * + * \param grp The pointer to the elliptic curve group that will be the + * basis of the cryptographic computations. + * + * \return Non-zero if successful. + */ +unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ); + +/** + * \brief Initialise the Elliptic Curve Point module extension. + * + * If mbedtls_internal_ecp_grp_capable returns true for a + * group, this function has to be able to initialise the + * module for it. + * + * This module can be a driver to a crypto hardware + * accelerator, for which this could be an initialise function. + * + * \param grp The pointer to the group the module needs to be + * initialised for. + * + * \return 0 if successful. + */ +int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ); + +/** + * \brief Frees and deallocates the Elliptic Curve Point module + * extension. + * + * \param grp The pointer to the group the module was initialised for. + */ +void mbedtls_internal_ecp_free( const mbedtls_ecp_group *grp ); + +#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) + +#if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT) +/** + * \brief Randomize jacobian coordinates: + * (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l. + * + * \param grp Pointer to the group representing the curve. + * + * \param pt The point on the curve to be randomised, given with Jacobian + * coordinates. + * + * \param f_rng A function pointer to the random number generator. + * + * \param p_rng A pointer to the random number generator state. + * + * \return 0 if successful. + */ +int mbedtls_internal_ecp_randomize_jac( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *pt, int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); +#endif + +#if defined(MBEDTLS_ECP_ADD_MIXED_ALT) +/** + * \brief Addition: R = P + Q, mixed affine-Jacobian coordinates. + * + * The coordinates of Q must be normalized (= affine), + * but those of P don't need to. R is not normalized. + * + * This function is used only as a subrutine of + * ecp_mul_comb(). + * + * Special cases: (1) P or Q is zero, (2) R is zero, + * (3) P == Q. + * None of these cases can happen as intermediate step in + * ecp_mul_comb(): + * - at each step, P, Q and R are multiples of the base + * point, the factor being less than its order, so none of + * them is zero; + * - Q is an odd multiple of the base point, P an even + * multiple, due to the choice of precomputed points in the + * modified comb method. + * So branches for these cases do not leak secret information. + * + * We accept Q->Z being unset (saving memory in tables) as + * meaning 1. + * + * Cost in field operations if done by [5] 3.22: + * 1A := 8M + 3S + * + * \param grp Pointer to the group representing the curve. + * + * \param R Pointer to a point structure to hold the result. + * + * \param P Pointer to the first summand, given with Jacobian + * coordinates + * + * \param Q Pointer to the second summand, given with affine + * coordinates. + * + * \return 0 if successful. + */ +int mbedtls_internal_ecp_add_mixed( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *R, const mbedtls_ecp_point *P, + const mbedtls_ecp_point *Q ); +#endif + +/** + * \brief Point doubling R = 2 P, Jacobian coordinates. + * + * Cost: 1D := 3M + 4S (A == 0) + * 4M + 4S (A == -3) + * 3M + 6S + 1a otherwise + * when the implementation is based on the "dbl-1998-cmo-2" + * doubling formulas in [8] and standard optimizations are + * applied when curve parameter A is one of { 0, -3 }. + * + * \param grp Pointer to the group representing the curve. + * + * \param R Pointer to a point structure to hold the result. + * + * \param P Pointer to the point that has to be doubled, given with + * Jacobian coordinates. + * + * \return 0 if successful. + */ +#if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) +int mbedtls_internal_ecp_double_jac( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *R, const mbedtls_ecp_point *P ); +#endif + +/** + * \brief Normalize jacobian coordinates of an array of (pointers to) + * points. + * + * Using Montgomery's trick to perform only one inversion mod P + * the cost is: + * 1N(t) := 1I + (6t - 3)M + 1S + * (See for example Algorithm 10.3.4. in [9]) + * + * This function is used only as a subrutine of + * ecp_mul_comb(). + * + * Warning: fails (returning an error) if one of the points is + * zero! + * This should never happen, see choice of w in ecp_mul_comb(). + * + * \param grp Pointer to the group representing the curve. + * + * \param T Array of pointers to the points to normalise. + * + * \param t_len Number of elements in the array. + * + * \return 0 if successful, + * an error if one of the points is zero. + */ +#if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT) +int mbedtls_internal_ecp_normalize_jac_many( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *T[], size_t t_len ); +#endif + +/** + * \brief Normalize jacobian coordinates so that Z == 0 || Z == 1. + * + * Cost in field operations if done by [5] 3.2.1: + * 1N := 1I + 3M + 1S + * + * \param grp Pointer to the group representing the curve. + * + * \param pt pointer to the point to be normalised. This is an + * input/output parameter. + * + * \return 0 if successful. + */ +#if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT) +int mbedtls_internal_ecp_normalize_jac( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *pt ); +#endif + +#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ + +#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) + +#if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT) +int mbedtls_internal_ecp_double_add_mxz( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *R, mbedtls_ecp_point *S, const mbedtls_ecp_point *P, + const mbedtls_ecp_point *Q, const mbedtls_mpi *d ); +#endif + +/** + * \brief Randomize projective x/z coordinates: + * (X, Z) -> (l X, l Z) for random l + * + * \param grp pointer to the group representing the curve + * + * \param P the point on the curve to be randomised given with + * projective coordinates. This is an input/output parameter. + * + * \param f_rng a function pointer to the random number generator + * + * \param p_rng a pointer to the random number generator state + * + * \return 0 if successful + */ +#if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT) +int mbedtls_internal_ecp_randomize_mxz( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *P, int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); +#endif + +/** + * \brief Normalize Montgomery x/z coordinates: X = X/Z, Z = 1. + * + * \param grp pointer to the group representing the curve + * + * \param P pointer to the point to be normalised. This is an + * input/output parameter. + * + * \return 0 if successful + */ +#if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT) +int mbedtls_internal_ecp_normalize_mxz( const mbedtls_ecp_group *grp, + mbedtls_ecp_point *P ); +#endif + +#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ + +#endif /* MBEDTLS_ECP_INTERNAL_ALT */ + +#endif /* ecp_internal.h */ + diff --git a/openharmony/armeabi-v7a/include/mbedtls/entropy.h b/openharmony/armeabi-v7a/include/mbedtls/entropy.h new file mode 100644 index 00000000..40259ebc --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/entropy.h @@ -0,0 +1,294 @@ +/** + * \file entropy.h + * + * \brief Entropy accumulator implementation + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_ENTROPY_H +#define MBEDTLS_ENTROPY_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +#if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_ENTROPY_FORCE_SHA256) +#include "mbedtls/sha512.h" +#define MBEDTLS_ENTROPY_SHA512_ACCUMULATOR +#else +#if defined(MBEDTLS_SHA256_C) +#define MBEDTLS_ENTROPY_SHA256_ACCUMULATOR +#include "mbedtls/sha256.h" +#endif +#endif + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +#if defined(MBEDTLS_HAVEGE_C) +#include "mbedtls/havege.h" +#endif + +/** Critical entropy source failure. */ +#define MBEDTLS_ERR_ENTROPY_SOURCE_FAILED -0x003C +/** No more sources can be added. */ +#define MBEDTLS_ERR_ENTROPY_MAX_SOURCES -0x003E +/** No sources have been added to poll. */ +#define MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED -0x0040 +/** No strong sources have been added to poll. */ +#define MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE -0x003D +/** Read/write error in file. */ +#define MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR -0x003F + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h or define them on the compiler command line. + * \{ + */ + +#if !defined(MBEDTLS_ENTROPY_MAX_SOURCES) +#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */ +#endif + +#if !defined(MBEDTLS_ENTROPY_MAX_GATHER) +#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */ +#endif + +/** \} name SECTION: Module settings */ + +#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR) +#define MBEDTLS_ENTROPY_BLOCK_SIZE 64 /**< Block size of entropy accumulator (SHA-512) */ +#else +#define MBEDTLS_ENTROPY_BLOCK_SIZE 32 /**< Block size of entropy accumulator (SHA-256) */ +#endif + +#define MBEDTLS_ENTROPY_MAX_SEED_SIZE 1024 /**< Maximum size of seed we read from seed file */ +#define MBEDTLS_ENTROPY_SOURCE_MANUAL MBEDTLS_ENTROPY_MAX_SOURCES + +#define MBEDTLS_ENTROPY_SOURCE_STRONG 1 /**< Entropy source is strong */ +#define MBEDTLS_ENTROPY_SOURCE_WEAK 0 /**< Entropy source is weak */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Entropy poll callback pointer + * + * \param data Callback-specific data pointer + * \param output Data to fill + * \param len Maximum size to provide + * \param olen The actual amount of bytes put into the buffer (Can be 0) + * + * \return 0 if no critical failures occurred, + * MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise + */ +typedef int (*mbedtls_entropy_f_source_ptr)(void *data, unsigned char *output, size_t len, + size_t *olen); + +/** + * \brief Entropy source state + */ +typedef struct mbedtls_entropy_source_state +{ + mbedtls_entropy_f_source_ptr f_source; /**< The entropy source callback */ + void * p_source; /**< The callback data pointer */ + size_t size; /**< Amount received in bytes */ + size_t threshold; /**< Minimum bytes required before release */ + int strong; /**< Is the source strong? */ +} +mbedtls_entropy_source_state; + +/** + * \brief Entropy context structure + */ +typedef struct mbedtls_entropy_context +{ + int accumulator_started; /* 0 after init. + * 1 after the first update. + * -1 after free. */ +#if defined(MBEDTLS_ENTROPY_SHA512_ACCUMULATOR) + mbedtls_sha512_context accumulator; +#elif defined(MBEDTLS_ENTROPY_SHA256_ACCUMULATOR) + mbedtls_sha256_context accumulator; +#endif + int source_count; /* Number of entries used in source. */ + mbedtls_entropy_source_state source[MBEDTLS_ENTROPY_MAX_SOURCES]; +#if defined(MBEDTLS_HAVEGE_C) + mbedtls_havege_state havege_data; +#endif +#if defined(MBEDTLS_THREADING_C) + mbedtls_threading_mutex_t mutex; /*!< mutex */ +#endif +#if defined(MBEDTLS_ENTROPY_NV_SEED) + int initial_entropy_run; +#endif +} +mbedtls_entropy_context; + +/** + * \brief Initialize the context + * + * \param ctx Entropy context to initialize + */ +void mbedtls_entropy_init( mbedtls_entropy_context *ctx ); + +/** + * \brief Free the data in the context + * + * \param ctx Entropy context to free + */ +void mbedtls_entropy_free( mbedtls_entropy_context *ctx ); + +/** + * \brief Adds an entropy source to poll + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param ctx Entropy context + * \param f_source Entropy function + * \param p_source Function data + * \param threshold Minimum required from source before entropy is released + * ( with mbedtls_entropy_func() ) (in bytes) + * \param strong MBEDTLS_ENTROPY_SOURCE_STRONG or + * MBEDTLS_ENTROPY_SOURCE_WEAK. + * At least one strong source needs to be added. + * Weaker sources (such as the cycle counter) can be used as + * a complement. + * + * \return 0 if successful or MBEDTLS_ERR_ENTROPY_MAX_SOURCES + */ +int mbedtls_entropy_add_source( mbedtls_entropy_context *ctx, + mbedtls_entropy_f_source_ptr f_source, void *p_source, + size_t threshold, int strong ); + +/** + * \brief Trigger an extra gather poll for the accumulator + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param ctx Entropy context + * + * \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + */ +int mbedtls_entropy_gather( mbedtls_entropy_context *ctx ); + +/** + * \brief Retrieve entropy from the accumulator + * (Maximum length: MBEDTLS_ENTROPY_BLOCK_SIZE) + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param data Entropy context + * \param output Buffer to fill + * \param len Number of bytes desired, must be at most MBEDTLS_ENTROPY_BLOCK_SIZE + * + * \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + */ +int mbedtls_entropy_func( void *data, unsigned char *output, size_t len ); + +/** + * \brief Add data to the accumulator manually + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param ctx Entropy context + * \param data Data to add + * \param len Length of data + * + * \return 0 if successful + */ +int mbedtls_entropy_update_manual( mbedtls_entropy_context *ctx, + const unsigned char *data, size_t len ); + +#if defined(MBEDTLS_ENTROPY_NV_SEED) +/** + * \brief Trigger an update of the seed file in NV by using the + * current entropy pool. + * + * \param ctx Entropy context + * + * \return 0 if successful + */ +int mbedtls_entropy_update_nv_seed( mbedtls_entropy_context *ctx ); +#endif /* MBEDTLS_ENTROPY_NV_SEED */ + +#if defined(MBEDTLS_FS_IO) +/** + * \brief Write a seed file + * + * \param ctx Entropy context + * \param path Name of the file + * + * \return 0 if successful, + * MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR on file error, or + * MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + */ +int mbedtls_entropy_write_seed_file( mbedtls_entropy_context *ctx, const char *path ); + +/** + * \brief Read and update a seed file. Seed is added to this + * instance. No more than MBEDTLS_ENTROPY_MAX_SEED_SIZE bytes are + * read from the seed file. The rest is ignored. + * + * \param ctx Entropy context + * \param path Name of the file + * + * \return 0 if successful, + * MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR on file error, + * MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + */ +int mbedtls_entropy_update_seed_file( mbedtls_entropy_context *ctx, const char *path ); +#endif /* MBEDTLS_FS_IO */ + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine + * + * This module self-test also calls the entropy self-test, + * mbedtls_entropy_source_self_test(); + * + * \return 0 if successful, or 1 if a test failed + */ +int mbedtls_entropy_self_test( int verbose ); + +#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT) +/** + * \brief Checkup routine + * + * Verifies the integrity of the hardware entropy source + * provided by the function 'mbedtls_hardware_poll()'. + * + * Note this is the only hardware entropy source that is known + * at link time, and other entropy sources configured + * dynamically at runtime by the function + * mbedtls_entropy_add_source() will not be tested. + * + * \return 0 if successful, or 1 if a test failed + */ +int mbedtls_entropy_source_self_test( int verbose ); +#endif /* MBEDTLS_ENTROPY_HARDWARE_ALT */ +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* entropy.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/entropy_poll.h b/openharmony/armeabi-v7a/include/mbedtls/entropy_poll.h new file mode 100644 index 00000000..e1d7491a --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/entropy_poll.h @@ -0,0 +1,108 @@ +/** + * \file entropy_poll.h + * + * \brief Platform-specific and custom entropy polling functions + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_ENTROPY_POLL_H +#define MBEDTLS_ENTROPY_POLL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * Default thresholds for built-in sources, in bytes + */ +#define MBEDTLS_ENTROPY_MIN_PLATFORM 32 /**< Minimum for platform source */ +#define MBEDTLS_ENTROPY_MIN_HAVEGE 32 /**< Minimum for HAVEGE */ +#define MBEDTLS_ENTROPY_MIN_HARDCLOCK 4 /**< Minimum for mbedtls_timing_hardclock() */ +#if !defined(MBEDTLS_ENTROPY_MIN_HARDWARE) +#define MBEDTLS_ENTROPY_MIN_HARDWARE 32 /**< Minimum for the hardware source */ +#endif + +/** + * \brief Entropy poll callback that provides 0 entropy. + */ +#if defined(MBEDTLS_TEST_NULL_ENTROPY) + int mbedtls_null_entropy_poll( void *data, + unsigned char *output, size_t len, size_t *olen ); +#endif + +#if !defined(MBEDTLS_NO_PLATFORM_ENTROPY) +/** + * \brief Platform-specific entropy poll callback + */ +int mbedtls_platform_entropy_poll( void *data, + unsigned char *output, size_t len, size_t *olen ); +#endif + +#if defined(MBEDTLS_HAVEGE_C) +/** + * \brief HAVEGE based entropy poll callback + * + * Requires an HAVEGE state as its data pointer. + */ +int mbedtls_havege_poll( void *data, + unsigned char *output, size_t len, size_t *olen ); +#endif + +#if defined(MBEDTLS_TIMING_C) +/** + * \brief mbedtls_timing_hardclock-based entropy poll callback + */ +int mbedtls_hardclock_poll( void *data, + unsigned char *output, size_t len, size_t *olen ); +#endif + +#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT) +/** + * \brief Entropy poll callback for a hardware source + * + * \warning This is not provided by mbed TLS! + * See \c MBEDTLS_ENTROPY_HARDWARE_ALT in config.h. + * + * \note This must accept NULL as its first argument. + */ +int mbedtls_hardware_poll( void *data, + unsigned char *output, size_t len, size_t *olen ); +#endif + +#if defined(MBEDTLS_ENTROPY_NV_SEED) +/** + * \brief Entropy poll callback for a non-volatile seed file + * + * \note This must accept NULL as its first argument. + */ +int mbedtls_nv_seed_poll( void *data, + unsigned char *output, size_t len, size_t *olen ); +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* entropy_poll.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/error.h b/openharmony/armeabi-v7a/include/mbedtls/error.h new file mode 100644 index 00000000..50f25385 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/error.h @@ -0,0 +1,217 @@ +/** + * \file error.h + * + * \brief Error to string translation + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_ERROR_H +#define MBEDTLS_ERROR_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \ + !defined(inline) && !defined(__cplusplus) +#define inline __inline +#endif + +/** + * Error code layout. + * + * Currently we try to keep all error codes within the negative space of 16 + * bits signed integers to support all platforms (-0x0001 - -0x7FFF). In + * addition we'd like to give two layers of information on the error if + * possible. + * + * For that purpose the error codes are segmented in the following manner: + * + * 16 bit error code bit-segmentation + * + * 1 bit - Unused (sign bit) + * 3 bits - High level module ID + * 5 bits - Module-dependent error code + * 7 bits - Low level module errors + * + * For historical reasons, low-level error codes are divided in even and odd, + * even codes were assigned first, and -1 is reserved for other errors. + * + * Low-level module errors (0x0002-0x007E, 0x0001-0x007F) + * + * Module Nr Codes assigned + * ERROR 2 0x006E 0x0001 + * MPI 7 0x0002-0x0010 + * GCM 3 0x0012-0x0014 0x0013-0x0013 + * BLOWFISH 3 0x0016-0x0018 0x0017-0x0017 + * THREADING 3 0x001A-0x001E + * AES 5 0x0020-0x0022 0x0021-0x0025 + * CAMELLIA 3 0x0024-0x0026 0x0027-0x0027 + * XTEA 2 0x0028-0x0028 0x0029-0x0029 + * BASE64 2 0x002A-0x002C + * OID 1 0x002E-0x002E 0x000B-0x000B + * PADLOCK 1 0x0030-0x0030 + * DES 2 0x0032-0x0032 0x0033-0x0033 + * CTR_DBRG 4 0x0034-0x003A + * ENTROPY 3 0x003C-0x0040 0x003D-0x003F + * NET 13 0x0042-0x0052 0x0043-0x0049 + * ARIA 4 0x0058-0x005E + * ASN1 7 0x0060-0x006C + * CMAC 1 0x007A-0x007A + * PBKDF2 1 0x007C-0x007C + * HMAC_DRBG 4 0x0003-0x0009 + * CCM 3 0x000D-0x0011 + * ARC4 1 0x0019-0x0019 + * MD2 1 0x002B-0x002B + * MD4 1 0x002D-0x002D + * MD5 1 0x002F-0x002F + * RIPEMD160 1 0x0031-0x0031 + * SHA1 1 0x0035-0x0035 0x0073-0x0073 + * SHA256 1 0x0037-0x0037 0x0074-0x0074 + * SHA512 1 0x0039-0x0039 0x0075-0x0075 + * CHACHA20 3 0x0051-0x0055 + * POLY1305 3 0x0057-0x005B + * CHACHAPOLY 2 0x0054-0x0056 + * PLATFORM 2 0x0070-0x0072 + * + * High-level module nr (3 bits - 0x0...-0x7...) + * Name ID Nr of Errors + * PEM 1 9 + * PKCS#12 1 4 (Started from top) + * X509 2 20 + * PKCS5 2 4 (Started from top) + * DHM 3 11 + * PK 3 15 (Started from top) + * RSA 4 11 + * ECP 4 10 (Started from top) + * MD 5 5 + * HKDF 5 1 (Started from top) + * SSL 5 2 (Started from 0x5F00) + * CIPHER 6 8 (Started from 0x6080) + * SSL 6 24 (Started from top, plus 0x6000) + * SSL 7 32 + * + * Module dependent error code (5 bits 0x.00.-0x.F8.) + */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** Generic error */ +#define MBEDTLS_ERR_ERROR_GENERIC_ERROR -0x0001 +/** This is a bug in the library */ +#define MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED -0x006E + +/** + * \brief Combines a high-level and low-level error code together. + * + * Wrapper macro for mbedtls_error_add(). See that function for + * more details. + */ +#define MBEDTLS_ERROR_ADD( high, low ) \ + mbedtls_error_add( high, low, __FILE__, __LINE__ ) + +#if defined(MBEDTLS_TEST_HOOKS) +/** + * \brief Testing hook called before adding/combining two error codes together. + * Only used when invasive testing is enabled via MBEDTLS_TEST_HOOKS. + */ +extern void (*mbedtls_test_hook_error_add)( int, int, const char *, int ); +#endif + +/** + * \brief Combines a high-level and low-level error code together. + * + * This function can be called directly however it is usually + * called via the #MBEDTLS_ERROR_ADD macro. + * + * While a value of zero is not a negative error code, it is still an + * error code (that denotes success) and can be combined with both a + * negative error code or another value of zero. + * + * \note When invasive testing is enabled via #MBEDTLS_TEST_HOOKS, also try to + * call \link mbedtls_test_hook_error_add \endlink. + * + * \param high high-level error code. See error.h for more details. + * \param low low-level error code. See error.h for more details. + * \param file file where this error code addition occurred. + * \param line line where this error code addition occurred. + */ +static inline int mbedtls_error_add( int high, int low, + const char *file, int line ) +{ +#if defined(MBEDTLS_TEST_HOOKS) + if( *mbedtls_test_hook_error_add != NULL ) + ( *mbedtls_test_hook_error_add )( high, low, file, line ); +#endif + (void)file; + (void)line; + + return( high + low ); +} + +/** + * \brief Translate a mbed TLS error code into a string representation, + * Result is truncated if necessary and always includes a terminating + * null byte. + * + * \param errnum error code + * \param buffer buffer to place representation in + * \param buflen length of the buffer + */ +void mbedtls_strerror( int errnum, char *buffer, size_t buflen ); + +/** + * \brief Translate the high-level part of an Mbed TLS error code into a string + * representation. + * + * This function returns a const pointer to an un-modifiable string. The caller + * must not try to modify the string. It is intended to be used mostly for + * logging purposes. + * + * \param error_code error code + * + * \return The string representation of the error code, or \c NULL if the error + * code is unknown. + */ +const char * mbedtls_high_level_strerr( int error_code ); + +/** + * \brief Translate the low-level part of an Mbed TLS error code into a string + * representation. + * + * This function returns a const pointer to an un-modifiable string. The caller + * must not try to modify the string. It is intended to be used mostly for + * logging purposes. + * + * \param error_code error code + * + * \return The string representation of the error code, or \c NULL if the error + * code is unknown. + */ +const char * mbedtls_low_level_strerr( int error_code ); + +#ifdef __cplusplus +} +#endif + +#endif /* error.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/gcm.h b/openharmony/armeabi-v7a/include/mbedtls/gcm.h new file mode 100644 index 00000000..9723a17b --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/gcm.h @@ -0,0 +1,327 @@ +/** + * \file gcm.h + * + * \brief This file contains GCM definitions and functions. + * + * The Galois/Counter Mode (GCM) for 128-bit block ciphers is defined + * in D. McGrew, J. Viega, The Galois/Counter Mode of Operation + * (GCM), Natl. Inst. Stand. Technol. + * + * For more information on GCM, see NIST SP 800-38D: Recommendation for + * Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC. + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_GCM_H +#define MBEDTLS_GCM_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/cipher.h" + +#include + +#define MBEDTLS_GCM_ENCRYPT 1 +#define MBEDTLS_GCM_DECRYPT 0 + +/** Authenticated decryption failed. */ +#define MBEDTLS_ERR_GCM_AUTH_FAILED -0x0012 + +/* MBEDTLS_ERR_GCM_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** GCM hardware accelerator failed. */ +#define MBEDTLS_ERR_GCM_HW_ACCEL_FAILED -0x0013 + +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_GCM_BAD_INPUT -0x0014 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_GCM_ALT) + +/** + * \brief The GCM context structure. + */ +typedef struct mbedtls_gcm_context +{ + mbedtls_cipher_context_t cipher_ctx; /*!< The cipher context used. */ + uint64_t HL[16]; /*!< Precalculated HTable low. */ + uint64_t HH[16]; /*!< Precalculated HTable high. */ + uint64_t len; /*!< The total length of the encrypted data. */ + uint64_t add_len; /*!< The total length of the additional data. */ + unsigned char base_ectr[16]; /*!< The first ECTR for tag. */ + unsigned char y[16]; /*!< The Y working value. */ + unsigned char buf[16]; /*!< The buf working value. */ + int mode; /*!< The operation to perform: + #MBEDTLS_GCM_ENCRYPT or + #MBEDTLS_GCM_DECRYPT. */ +} +mbedtls_gcm_context; + +#else /* !MBEDTLS_GCM_ALT */ +#include "gcm_alt.h" +#endif /* !MBEDTLS_GCM_ALT */ + +/** + * \brief This function initializes the specified GCM context, + * to make references valid, and prepares the context + * for mbedtls_gcm_setkey() or mbedtls_gcm_free(). + * + * The function does not bind the GCM context to a particular + * cipher, nor set the key. For this purpose, use + * mbedtls_gcm_setkey(). + * + * \param ctx The GCM context to initialize. This must not be \c NULL. + */ +void mbedtls_gcm_init( mbedtls_gcm_context *ctx ); + +/** + * \brief This function associates a GCM context with a + * cipher algorithm and a key. + * + * \param ctx The GCM context. This must be initialized. + * \param cipher The 128-bit block cipher to use. + * \param key The encryption key. This must be a readable buffer of at + * least \p keybits bits. + * \param keybits The key size in bits. Valid options are: + *
  • 128 bits
    • + *
  • 192 bits
    • + *
  • 256 bits
+ * + * \return \c 0 on success. + * \return A cipher-specific error code on failure. + */ +int mbedtls_gcm_setkey( mbedtls_gcm_context *ctx, + mbedtls_cipher_id_t cipher, + const unsigned char *key, + unsigned int keybits ); + +/** + * \brief This function performs GCM encryption or decryption of a buffer. + * + * \note For encryption, the output buffer can be the same as the + * input buffer. For decryption, the output buffer cannot be + * the same as input buffer. If the buffers overlap, the output + * buffer must trail at least 8 Bytes behind the input buffer. + * + * \warning When this function performs a decryption, it outputs the + * authentication tag and does not verify that the data is + * authentic. You should use this function to perform encryption + * only. For decryption, use mbedtls_gcm_auth_decrypt() instead. + * + * \param ctx The GCM context to use for encryption or decryption. This + * must be initialized. + * \param mode The operation to perform: + * - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. + * The ciphertext is written to \p output and the + * authentication tag is written to \p tag. + * - #MBEDTLS_GCM_DECRYPT to perform decryption. + * The plaintext is written to \p output and the + * authentication tag is written to \p tag. + * Note that this mode is not recommended, because it does + * not verify the authenticity of the data. For this reason, + * you should use mbedtls_gcm_auth_decrypt() instead of + * calling this function in decryption mode. + * \param length The length of the input data, which is equal to the length + * of the output data. + * \param iv The initialization vector. This must be a readable buffer of + * at least \p iv_len Bytes. + * \param iv_len The length of the IV. + * \param add The buffer holding the additional data. This must be of at + * least that size in Bytes. + * \param add_len The length of the additional data. + * \param input The buffer holding the input data. If \p length is greater + * than zero, this must be a readable buffer of at least that + * size in Bytes. + * \param output The buffer for holding the output data. If \p length is greater + * than zero, this must be a writable buffer of at least that + * size in Bytes. + * \param tag_len The length of the tag to generate. + * \param tag The buffer for holding the tag. This must be a writable + * buffer of at least \p tag_len Bytes. + * + * \return \c 0 if the encryption or decryption was performed + * successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, + * this does not indicate that the data is authentic. + * \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are + * not valid or a cipher-specific error code if the encryption + * or decryption failed. + */ +int mbedtls_gcm_crypt_and_tag( mbedtls_gcm_context *ctx, + int mode, + size_t length, + const unsigned char *iv, + size_t iv_len, + const unsigned char *add, + size_t add_len, + const unsigned char *input, + unsigned char *output, + size_t tag_len, + unsigned char *tag ); + +/** + * \brief This function performs a GCM authenticated decryption of a + * buffer. + * + * \note For decryption, the output buffer cannot be the same as + * input buffer. If the buffers overlap, the output buffer + * must trail at least 8 Bytes behind the input buffer. + * + * \param ctx The GCM context. This must be initialized. + * \param length The length of the ciphertext to decrypt, which is also + * the length of the decrypted plaintext. + * \param iv The initialization vector. This must be a readable buffer + * of at least \p iv_len Bytes. + * \param iv_len The length of the IV. + * \param add The buffer holding the additional data. This must be of at + * least that size in Bytes. + * \param add_len The length of the additional data. + * \param tag The buffer holding the tag to verify. This must be a + * readable buffer of at least \p tag_len Bytes. + * \param tag_len The length of the tag to verify. + * \param input The buffer holding the ciphertext. If \p length is greater + * than zero, this must be a readable buffer of at least that + * size. + * \param output The buffer for holding the decrypted plaintext. If \p length + * is greater than zero, this must be a writable buffer of at + * least that size. + * + * \return \c 0 if successful and authenticated. + * \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. + * \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are + * not valid or a cipher-specific error code if the decryption + * failed. + */ +int mbedtls_gcm_auth_decrypt( mbedtls_gcm_context *ctx, + size_t length, + const unsigned char *iv, + size_t iv_len, + const unsigned char *add, + size_t add_len, + const unsigned char *tag, + size_t tag_len, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function starts a GCM encryption or decryption + * operation. + * + * \param ctx The GCM context. This must be initialized. + * \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or + * #MBEDTLS_GCM_DECRYPT. + * \param iv The initialization vector. This must be a readable buffer of + * at least \p iv_len Bytes. + * \param iv_len The length of the IV. + * \param add The buffer holding the additional data, or \c NULL + * if \p add_len is \c 0. + * \param add_len The length of the additional data. If \c 0, + * \p add may be \c NULL. + * + * \return \c 0 on success. + */ +int mbedtls_gcm_starts( mbedtls_gcm_context *ctx, + int mode, + const unsigned char *iv, + size_t iv_len, + const unsigned char *add, + size_t add_len ); + +/** + * \brief This function feeds an input buffer into an ongoing GCM + * encryption or decryption operation. + * + * ` The function expects input to be a multiple of 16 + * Bytes. Only the last call before calling + * mbedtls_gcm_finish() can be less than 16 Bytes. + * + * \note For decryption, the output buffer cannot be the same as + * input buffer. If the buffers overlap, the output buffer + * must trail at least 8 Bytes behind the input buffer. + * + * \param ctx The GCM context. This must be initialized. + * \param length The length of the input data. This must be a multiple of + * 16 except in the last call before mbedtls_gcm_finish(). + * \param input The buffer holding the input data. If \p length is greater + * than zero, this must be a readable buffer of at least that + * size in Bytes. + * \param output The buffer for holding the output data. If \p length is + * greater than zero, this must be a writable buffer of at + * least that size in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure. + */ +int mbedtls_gcm_update( mbedtls_gcm_context *ctx, + size_t length, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function finishes the GCM operation and generates + * the authentication tag. + * + * It wraps up the GCM stream, and generates the + * tag. The tag can have a maximum length of 16 Bytes. + * + * \param ctx The GCM context. This must be initialized. + * \param tag The buffer for holding the tag. This must be a writable + * buffer of at least \p tag_len Bytes. + * \param tag_len The length of the tag to generate. This must be at least + * four. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure. + */ +int mbedtls_gcm_finish( mbedtls_gcm_context *ctx, + unsigned char *tag, + size_t tag_len ); + +/** + * \brief This function clears a GCM context and the underlying + * cipher sub-context. + * + * \param ctx The GCM context to clear. If this is \c NULL, the call has + * no effect. Otherwise, this must be initialized. + */ +void mbedtls_gcm_free( mbedtls_gcm_context *ctx ); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The GCM checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_gcm_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + + +#endif /* gcm.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/havege.h b/openharmony/armeabi-v7a/include/mbedtls/havege.h new file mode 100644 index 00000000..7d27039e --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/havege.h @@ -0,0 +1,80 @@ +/** + * \file havege.h + * + * \brief HAVEGE: HArdware Volatile Entropy Gathering and Expansion + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_HAVEGE_H +#define MBEDTLS_HAVEGE_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +#define MBEDTLS_HAVEGE_COLLECT_SIZE 1024 + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief HAVEGE state structure + */ +typedef struct mbedtls_havege_state +{ + uint32_t PT1, PT2, offset[2]; + uint32_t pool[MBEDTLS_HAVEGE_COLLECT_SIZE]; + uint32_t WALK[8192]; +} +mbedtls_havege_state; + +/** + * \brief HAVEGE initialization + * + * \param hs HAVEGE state to be initialized + */ +void mbedtls_havege_init( mbedtls_havege_state *hs ); + +/** + * \brief Clear HAVEGE state + * + * \param hs HAVEGE state to be cleared + */ +void mbedtls_havege_free( mbedtls_havege_state *hs ); + +/** + * \brief HAVEGE rand function + * + * \param p_rng A HAVEGE state + * \param output Buffer to fill + * \param len Length of buffer + * + * \return 0 + */ +int mbedtls_havege_random( void *p_rng, unsigned char *output, size_t len ); + +#ifdef __cplusplus +} +#endif + +#endif /* havege.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/hkdf.h b/openharmony/armeabi-v7a/include/mbedtls/hkdf.h new file mode 100644 index 00000000..111d960e --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/hkdf.h @@ -0,0 +1,140 @@ +/** + * \file hkdf.h + * + * \brief This file contains the HKDF interface. + * + * The HMAC-based Extract-and-Expand Key Derivation Function (HKDF) is + * specified by RFC 5869. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_HKDF_H +#define MBEDTLS_HKDF_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/md.h" + +/** + * \name HKDF Error codes + * \{ + */ +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_HKDF_BAD_INPUT_DATA -0x5F80 +/** \} name */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief This is the HMAC-based Extract-and-Expand Key Derivation Function + * (HKDF). + * + * \param md A hash function; md.size denotes the length of the hash + * function output in bytes. + * \param salt An optional salt value (a non-secret random value); + * if the salt is not provided, a string of all zeros of + * md.size length is used as the salt. + * \param salt_len The length in bytes of the optional \p salt. + * \param ikm The input keying material. + * \param ikm_len The length in bytes of \p ikm. + * \param info An optional context and application specific information + * string. This can be a zero-length string. + * \param info_len The length of \p info in bytes. + * \param okm The output keying material of \p okm_len bytes. + * \param okm_len The length of the output keying material in bytes. This + * must be less than or equal to 255 * md.size bytes. + * + * \return 0 on success. + * \return #MBEDTLS_ERR_HKDF_BAD_INPUT_DATA when the parameters are invalid. + * \return An MBEDTLS_ERR_MD_* error for errors returned from the underlying + * MD layer. + */ +int mbedtls_hkdf( const mbedtls_md_info_t *md, const unsigned char *salt, + size_t salt_len, const unsigned char *ikm, size_t ikm_len, + const unsigned char *info, size_t info_len, + unsigned char *okm, size_t okm_len ); + +/** + * \brief Take the input keying material \p ikm and extract from it a + * fixed-length pseudorandom key \p prk. + * + * \warning This function should only be used if the security of it has been + * studied and established in that particular context (eg. TLS 1.3 + * key schedule). For standard HKDF security guarantees use + * \c mbedtls_hkdf instead. + * + * \param md A hash function; md.size denotes the length of the + * hash function output in bytes. + * \param salt An optional salt value (a non-secret random value); + * if the salt is not provided, a string of all zeros + * of md.size length is used as the salt. + * \param salt_len The length in bytes of the optional \p salt. + * \param ikm The input keying material. + * \param ikm_len The length in bytes of \p ikm. + * \param[out] prk A pseudorandom key of at least md.size bytes. + * + * \return 0 on success. + * \return #MBEDTLS_ERR_HKDF_BAD_INPUT_DATA when the parameters are invalid. + * \return An MBEDTLS_ERR_MD_* error for errors returned from the underlying + * MD layer. + */ +int mbedtls_hkdf_extract( const mbedtls_md_info_t *md, + const unsigned char *salt, size_t salt_len, + const unsigned char *ikm, size_t ikm_len, + unsigned char *prk ); + +/** + * \brief Expand the supplied \p prk into several additional pseudorandom + * keys, which is the output of the HKDF. + * + * \warning This function should only be used if the security of it has been + * studied and established in that particular context (eg. TLS 1.3 + * key schedule). For standard HKDF security guarantees use + * \c mbedtls_hkdf instead. + * + * \param md A hash function; md.size denotes the length of the hash + * function output in bytes. + * \param prk A pseudorandom key of at least md.size bytes. \p prk is + * usually the output from the HKDF extract step. + * \param prk_len The length in bytes of \p prk. + * \param info An optional context and application specific information + * string. This can be a zero-length string. + * \param info_len The length of \p info in bytes. + * \param okm The output keying material of \p okm_len bytes. + * \param okm_len The length of the output keying material in bytes. This + * must be less than or equal to 255 * md.size bytes. + * + * \return 0 on success. + * \return #MBEDTLS_ERR_HKDF_BAD_INPUT_DATA when the parameters are invalid. + * \return An MBEDTLS_ERR_MD_* error for errors returned from the underlying + * MD layer. + */ +int mbedtls_hkdf_expand( const mbedtls_md_info_t *md, const unsigned char *prk, + size_t prk_len, const unsigned char *info, + size_t info_len, unsigned char *okm, size_t okm_len ); + +#ifdef __cplusplus +} +#endif + +#endif /* hkdf.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/hmac_drbg.h b/openharmony/armeabi-v7a/include/mbedtls/hmac_drbg.h new file mode 100644 index 00000000..6d372b97 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/hmac_drbg.h @@ -0,0 +1,474 @@ +/** + * \file hmac_drbg.h + * + * \brief The HMAC_DRBG pseudorandom generator. + * + * This module implements the HMAC_DRBG pseudorandom generator described + * in NIST SP 800-90A: Recommendation for Random Number Generation Using + * Deterministic Random Bit Generators. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_HMAC_DRBG_H +#define MBEDTLS_HMAC_DRBG_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/md.h" + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +/* + * Error codes + */ +/** Too many random requested in single call. */ +#define MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG -0x0003 +/** Input too large (Entropy + additional). */ +#define MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG -0x0005 +/** Read/write error in file. */ +#define MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR -0x0007 +/** The entropy source failed. */ +#define MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED -0x0009 + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h or define them on the compiler command line. + * \{ + */ + +#if !defined(MBEDTLS_HMAC_DRBG_RESEED_INTERVAL) +#define MBEDTLS_HMAC_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ +#endif + +#if !defined(MBEDTLS_HMAC_DRBG_MAX_INPUT) +#define MBEDTLS_HMAC_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ +#endif + +#if !defined(MBEDTLS_HMAC_DRBG_MAX_REQUEST) +#define MBEDTLS_HMAC_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ +#endif + +#if !defined(MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT) +#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ +#endif + +/** \} name SECTION: Module settings */ + +#define MBEDTLS_HMAC_DRBG_PR_OFF 0 /**< No prediction resistance */ +#define MBEDTLS_HMAC_DRBG_PR_ON 1 /**< Prediction resistance enabled */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * HMAC_DRBG context. + */ +typedef struct mbedtls_hmac_drbg_context +{ + /* Working state: the key K is not stored explicitly, + * but is implied by the HMAC context */ + mbedtls_md_context_t md_ctx; /*!< HMAC context (inc. K) */ + unsigned char V[MBEDTLS_MD_MAX_SIZE]; /*!< V in the spec */ + int reseed_counter; /*!< reseed counter */ + + /* Administrative state */ + size_t entropy_len; /*!< entropy bytes grabbed on each (re)seed */ + int prediction_resistance; /*!< enable prediction resistance (Automatic + reseed before every random generation) */ + int reseed_interval; /*!< reseed interval */ + + /* Callbacks */ + int (*f_entropy)(void *, unsigned char *, size_t); /*!< entropy function */ + void *p_entropy; /*!< context for the entropy function */ + +#if defined(MBEDTLS_THREADING_C) + /* Invariant: the mutex is initialized if and only if + * md_ctx->md_info != NULL. This means that the mutex is initialized + * during the initial seeding in mbedtls_hmac_drbg_seed() or + * mbedtls_hmac_drbg_seed_buf() and freed in mbedtls_ctr_drbg_free(). + * + * Note that this invariant may change without notice. Do not rely on it + * and do not access the mutex directly in application code. + */ + mbedtls_threading_mutex_t mutex; +#endif +} mbedtls_hmac_drbg_context; + +/** + * \brief HMAC_DRBG context initialization. + * + * This function makes the context ready for mbedtls_hmac_drbg_seed(), + * mbedtls_hmac_drbg_seed_buf() or mbedtls_hmac_drbg_free(). + * + * \note The reseed interval is #MBEDTLS_HMAC_DRBG_RESEED_INTERVAL + * by default. Override this value by calling + * mbedtls_hmac_drbg_set_reseed_interval(). + * + * \param ctx HMAC_DRBG context to be initialized. + */ +void mbedtls_hmac_drbg_init( mbedtls_hmac_drbg_context *ctx ); + +/** + * \brief HMAC_DRBG initial seeding. + * + * Set the initial seed and set up the entropy source for future reseeds. + * + * A typical choice for the \p f_entropy and \p p_entropy parameters is + * to use the entropy module: + * - \p f_entropy is mbedtls_entropy_func(); + * - \p p_entropy is an instance of ::mbedtls_entropy_context initialized + * with mbedtls_entropy_init() (which registers the platform's default + * entropy sources). + * + * You can provide a personalization string in addition to the + * entropy source, to make this instantiation as unique as possible. + * + * \note By default, the security strength as defined by NIST is: + * - 128 bits if \p md_info is SHA-1; + * - 192 bits if \p md_info is SHA-224; + * - 256 bits if \p md_info is SHA-256, SHA-384 or SHA-512. + * Note that SHA-256 is just as efficient as SHA-224. + * The security strength can be reduced if a smaller + * entropy length is set with + * mbedtls_hmac_drbg_set_entropy_len(). + * + * \note The default entropy length is the security strength + * (converted from bits to bytes). You can override + * it by calling mbedtls_hmac_drbg_set_entropy_len(). + * + * \note During the initial seeding, this function calls + * the entropy source to obtain a nonce + * whose length is half the entropy length. + */ +#if defined(MBEDTLS_THREADING_C) +/** + * \note When Mbed TLS is built with threading support, + * after this function returns successfully, + * it is safe to call mbedtls_hmac_drbg_random() + * from multiple threads. Other operations, including + * reseeding, are not thread-safe. + */ +#endif /* MBEDTLS_THREADING_C */ +/** + * \param ctx HMAC_DRBG context to be seeded. + * \param md_info MD algorithm to use for HMAC_DRBG. + * \param f_entropy The entropy callback, taking as arguments the + * \p p_entropy context, the buffer to fill, and the + * length of the buffer. + * \p f_entropy is always called with a length that is + * less than or equal to the entropy length. + * \param p_entropy The entropy context to pass to \p f_entropy. + * \param custom The personalization string. + * This can be \c NULL, in which case the personalization + * string is empty regardless of the value of \p len. + * \param len The length of the personalization string. + * This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT + * and also at most + * #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len * 3 / 2 + * where \p entropy_len is the entropy length + * described above. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA if \p md_info is + * invalid. + * \return #MBEDTLS_ERR_MD_ALLOC_FAILED if there was not enough + * memory to allocate context data. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED + * if the call to \p f_entropy failed. + */ +int mbedtls_hmac_drbg_seed( mbedtls_hmac_drbg_context *ctx, + const mbedtls_md_info_t * md_info, + int (*f_entropy)(void *, unsigned char *, size_t), + void *p_entropy, + const unsigned char *custom, + size_t len ); + +/** + * \brief Initialisation of simplified HMAC_DRBG (never reseeds). + * + * This function is meant for use in algorithms that need a pseudorandom + * input such as deterministic ECDSA. + */ +#if defined(MBEDTLS_THREADING_C) +/** + * \note When Mbed TLS is built with threading support, + * after this function returns successfully, + * it is safe to call mbedtls_hmac_drbg_random() + * from multiple threads. Other operations, including + * reseeding, are not thread-safe. + */ +#endif /* MBEDTLS_THREADING_C */ +/** + * \param ctx HMAC_DRBG context to be initialised. + * \param md_info MD algorithm to use for HMAC_DRBG. + * \param data Concatenation of the initial entropy string and + * the additional data. + * \param data_len Length of \p data in bytes. + * + * \return \c 0 if successful. or + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA if \p md_info is + * invalid. + * \return #MBEDTLS_ERR_MD_ALLOC_FAILED if there was not enough + * memory to allocate context data. + */ +int mbedtls_hmac_drbg_seed_buf( mbedtls_hmac_drbg_context *ctx, + const mbedtls_md_info_t * md_info, + const unsigned char *data, size_t data_len ); + +/** + * \brief This function turns prediction resistance on or off. + * The default value is off. + * + * \note If enabled, entropy is gathered at the beginning of + * every call to mbedtls_hmac_drbg_random_with_add() + * or mbedtls_hmac_drbg_random(). + * Only use this if your entropy source has sufficient + * throughput. + * + * \param ctx The HMAC_DRBG context. + * \param resistance #MBEDTLS_HMAC_DRBG_PR_ON or #MBEDTLS_HMAC_DRBG_PR_OFF. + */ +void mbedtls_hmac_drbg_set_prediction_resistance( mbedtls_hmac_drbg_context *ctx, + int resistance ); + +/** + * \brief This function sets the amount of entropy grabbed on each + * seed or reseed. + * + * See the documentation of mbedtls_hmac_drbg_seed() for the default value. + * + * \param ctx The HMAC_DRBG context. + * \param len The amount of entropy to grab, in bytes. + */ +void mbedtls_hmac_drbg_set_entropy_len( mbedtls_hmac_drbg_context *ctx, + size_t len ); + +/** + * \brief Set the reseed interval. + * + * The reseed interval is the number of calls to mbedtls_hmac_drbg_random() + * or mbedtls_hmac_drbg_random_with_add() after which the entropy function + * is called again. + * + * The default value is #MBEDTLS_HMAC_DRBG_RESEED_INTERVAL. + * + * \param ctx The HMAC_DRBG context. + * \param interval The reseed interval. + */ +void mbedtls_hmac_drbg_set_reseed_interval( mbedtls_hmac_drbg_context *ctx, + int interval ); + +/** + * \brief This function updates the state of the HMAC_DRBG context. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param ctx The HMAC_DRBG context. + * \param additional The data to update the state with. + * If this is \c NULL, there is no additional data. + * \param add_len Length of \p additional in bytes. + * Unused if \p additional is \c NULL. + * + * \return \c 0 on success, or an error from the underlying + * hash calculation. + */ +int mbedtls_hmac_drbg_update_ret( mbedtls_hmac_drbg_context *ctx, + const unsigned char *additional, size_t add_len ); + +/** + * \brief This function reseeds the HMAC_DRBG context, that is + * extracts data from the entropy source. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param ctx The HMAC_DRBG context. + * \param additional Additional data to add to the state. + * If this is \c NULL, there is no additional data + * and \p len should be \c 0. + * \param len The length of the additional data. + * This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT + * and also at most + * #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len + * where \p entropy_len is the entropy length + * (see mbedtls_hmac_drbg_set_entropy_len()). + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED + * if a call to the entropy function failed. + */ +int mbedtls_hmac_drbg_reseed( mbedtls_hmac_drbg_context *ctx, + const unsigned char *additional, size_t len ); + +/** + * \brief This function updates an HMAC_DRBG instance with additional + * data and uses it to generate random data. + * + * This function automatically reseeds if the reseed counter is exceeded + * or prediction resistance is enabled. + * + * \note This function is not thread-safe. It is not safe + * to call this function if another thread might be + * concurrently obtaining random numbers from the same + * context or updating or reseeding the same context. + * + * \param p_rng The HMAC_DRBG context. This must be a pointer to a + * #mbedtls_hmac_drbg_context structure. + * \param output The buffer to fill. + * \param output_len The length of the buffer in bytes. + * This must be at most #MBEDTLS_HMAC_DRBG_MAX_REQUEST. + * \param additional Additional data to update with. + * If this is \c NULL, there is no additional data + * and \p add_len should be \c 0. + * \param add_len The length of the additional data. + * This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED + * if a call to the entropy source failed. + * \return #MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG if + * \p output_len > #MBEDTLS_HMAC_DRBG_MAX_REQUEST. + * \return #MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG if + * \p add_len > #MBEDTLS_HMAC_DRBG_MAX_INPUT. + */ +int mbedtls_hmac_drbg_random_with_add( void *p_rng, + unsigned char *output, size_t output_len, + const unsigned char *additional, + size_t add_len ); + +/** + * \brief This function uses HMAC_DRBG to generate random data. + * + * This function automatically reseeds if the reseed counter is exceeded + * or prediction resistance is enabled. + */ +#if defined(MBEDTLS_THREADING_C) +/** + * \note When Mbed TLS is built with threading support, + * it is safe to call mbedtls_ctr_drbg_random() + * from multiple threads. Other operations, including + * reseeding, are not thread-safe. + */ +#endif /* MBEDTLS_THREADING_C */ +/** + * \param p_rng The HMAC_DRBG context. This must be a pointer to a + * #mbedtls_hmac_drbg_context structure. + * \param output The buffer to fill. + * \param out_len The length of the buffer in bytes. + * This must be at most #MBEDTLS_HMAC_DRBG_MAX_REQUEST. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED + * if a call to the entropy source failed. + * \return #MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG if + * \p out_len > #MBEDTLS_HMAC_DRBG_MAX_REQUEST. + */ +int mbedtls_hmac_drbg_random( void *p_rng, unsigned char *output, size_t out_len ); + +/** + * \brief This function resets HMAC_DRBG context to the state immediately + * after initial call of mbedtls_hmac_drbg_init(). + * + * \param ctx The HMAC_DRBG context to free. + */ +void mbedtls_hmac_drbg_free( mbedtls_hmac_drbg_context *ctx ); + +#if ! defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function updates the state of the HMAC_DRBG context. + * + * \deprecated Superseded by mbedtls_hmac_drbg_update_ret() + * in 2.16.0. + * + * \param ctx The HMAC_DRBG context. + * \param additional The data to update the state with. + * If this is \c NULL, there is no additional data. + * \param add_len Length of \p additional in bytes. + * Unused if \p additional is \c NULL. + */ +MBEDTLS_DEPRECATED void mbedtls_hmac_drbg_update( + mbedtls_hmac_drbg_context *ctx, + const unsigned char *additional, size_t add_len ); +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_FS_IO) +/** + * \brief This function writes a seed file. + * + * \param ctx The HMAC_DRBG context. + * \param path The name of the file. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR on file error. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED on reseed + * failure. + */ +int mbedtls_hmac_drbg_write_seed_file( mbedtls_hmac_drbg_context *ctx, const char *path ); + +/** + * \brief This function reads and updates a seed file. The seed + * is added to this instance. + * + * \param ctx The HMAC_DRBG context. + * \param path The name of the file. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR on file error. + * \return #MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED on + * reseed failure. + * \return #MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG if the existing + * seed file is too large. + */ +int mbedtls_hmac_drbg_update_seed_file( mbedtls_hmac_drbg_context *ctx, const char *path ); +#endif /* MBEDTLS_FS_IO */ + + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief The HMAC_DRBG Checkup routine. + * + * \return \c 0 if successful. + * \return \c 1 if the test failed. + */ +int mbedtls_hmac_drbg_self_test( int verbose ); +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* hmac_drbg.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/md.h b/openharmony/armeabi-v7a/include/mbedtls/md.h new file mode 100644 index 00000000..84fafd2a --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/md.h @@ -0,0 +1,493 @@ + /** + * \file md.h + * + * \brief This file contains the generic message-digest wrapper. + * + * \author Adriaan de Jong + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_MD_H +#define MBEDTLS_MD_H + +#include + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif +#include "mbedtls/platform_util.h" + +/** The selected feature is not available. */ +#define MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE -0x5080 +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_MD_BAD_INPUT_DATA -0x5100 +/** Failed to allocate memory. */ +#define MBEDTLS_ERR_MD_ALLOC_FAILED -0x5180 +/** Opening or reading of file failed. */ +#define MBEDTLS_ERR_MD_FILE_IO_ERROR -0x5200 + +/* MBEDTLS_ERR_MD_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** MD hardware accelerator failed. */ +#define MBEDTLS_ERR_MD_HW_ACCEL_FAILED -0x5280 + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Supported message digests. + * + * \warning MD2, MD4, MD5 and SHA-1 are considered weak message digests and + * their use constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +typedef enum { + MBEDTLS_MD_NONE=0, /**< None. */ + MBEDTLS_MD_MD2, /**< The MD2 message digest. */ + MBEDTLS_MD_MD4, /**< The MD4 message digest. */ + MBEDTLS_MD_MD5, /**< The MD5 message digest. */ + MBEDTLS_MD_SHA1, /**< The SHA-1 message digest. */ + MBEDTLS_MD_SHA224, /**< The SHA-224 message digest. */ + MBEDTLS_MD_SHA256, /**< The SHA-256 message digest. */ + MBEDTLS_MD_SHA384, /**< The SHA-384 message digest. */ + MBEDTLS_MD_SHA512, /**< The SHA-512 message digest. */ + MBEDTLS_MD_RIPEMD160, /**< The RIPEMD-160 message digest. */ +} mbedtls_md_type_t; + +#if defined(MBEDTLS_SHA512_C) +#define MBEDTLS_MD_MAX_SIZE 64 /* longest known is SHA512 */ +#else +#define MBEDTLS_MD_MAX_SIZE 32 /* longest known is SHA256 or less */ +#endif + +#if defined(MBEDTLS_SHA512_C) +#define MBEDTLS_MD_MAX_BLOCK_SIZE 128 +#else +#define MBEDTLS_MD_MAX_BLOCK_SIZE 64 +#endif + +/** + * Opaque struct defined in md_internal.h. + */ +typedef struct mbedtls_md_info_t mbedtls_md_info_t; + +/** + * The generic message-digest context. + */ +typedef struct mbedtls_md_context_t +{ + /** Information about the associated message digest. */ + const mbedtls_md_info_t *md_info; + + /** The digest-specific context. */ + void *md_ctx; + + /** The HMAC part of the context. */ + void *hmac_ctx; +} mbedtls_md_context_t; + +/** + * \brief This function returns the list of digests supported by the + * generic digest module. + * + * \note The list starts with the strongest available hashes. + * + * \return A statically allocated array of digests. Each element + * in the returned list is an integer belonging to the + * message-digest enumeration #mbedtls_md_type_t. + * The last entry is 0. + */ +const int *mbedtls_md_list( void ); + +/** + * \brief This function returns the message-digest information + * associated with the given digest name. + * + * \param md_name The name of the digest to search for. + * + * \return The message-digest information associated with \p md_name. + * \return NULL if the associated message-digest information is not found. + */ +const mbedtls_md_info_t *mbedtls_md_info_from_string( const char *md_name ); + +/** + * \brief This function returns the message-digest information + * associated with the given digest type. + * + * \param md_type The type of digest to search for. + * + * \return The message-digest information associated with \p md_type. + * \return NULL if the associated message-digest information is not found. + */ +const mbedtls_md_info_t *mbedtls_md_info_from_type( mbedtls_md_type_t md_type ); + +/** + * \brief This function initializes a message-digest context without + * binding it to a particular message-digest algorithm. + * + * This function should always be called first. It prepares the + * context for mbedtls_md_setup() for binding it to a + * message-digest algorithm. + */ +void mbedtls_md_init( mbedtls_md_context_t *ctx ); + +/** + * \brief This function clears the internal structure of \p ctx and + * frees any embedded internal structure, but does not free + * \p ctx itself. + * + * If you have called mbedtls_md_setup() on \p ctx, you must + * call mbedtls_md_free() when you are no longer using the + * context. + * Calling this function if you have previously + * called mbedtls_md_init() and nothing else is optional. + * You must not call this function if you have not called + * mbedtls_md_init(). + */ +void mbedtls_md_free( mbedtls_md_context_t *ctx ); + +#if ! defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function selects the message digest algorithm to use, + * and allocates internal structures. + * + * It should be called after mbedtls_md_init() or mbedtls_md_free(). + * Makes it necessary to call mbedtls_md_free() later. + * + * \deprecated Superseded by mbedtls_md_setup() in 2.0.0 + * + * \param ctx The context to set up. + * \param md_info The information structure of the message-digest algorithm + * to use. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + * \return #MBEDTLS_ERR_MD_ALLOC_FAILED on memory-allocation failure. + */ +int mbedtls_md_init_ctx( mbedtls_md_context_t *ctx, const mbedtls_md_info_t *md_info ) MBEDTLS_DEPRECATED; +#undef MBEDTLS_DEPRECATED +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief This function selects the message digest algorithm to use, + * and allocates internal structures. + * + * It should be called after mbedtls_md_init() or + * mbedtls_md_free(). Makes it necessary to call + * mbedtls_md_free() later. + * + * \param ctx The context to set up. + * \param md_info The information structure of the message-digest algorithm + * to use. + * \param hmac Defines if HMAC is used. 0: HMAC is not used (saves some memory), + * or non-zero: HMAC is used with this context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + * \return #MBEDTLS_ERR_MD_ALLOC_FAILED on memory-allocation failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_setup( mbedtls_md_context_t *ctx, const mbedtls_md_info_t *md_info, int hmac ); + +/** + * \brief This function clones the state of an message-digest + * context. + * + * \note You must call mbedtls_md_setup() on \c dst before calling + * this function. + * + * \note The two contexts must have the same type, + * for example, both are SHA-256. + * + * \warning This function clones the message-digest state, not the + * HMAC state. + * + * \param dst The destination context. + * \param src The context to be cloned. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_clone( mbedtls_md_context_t *dst, + const mbedtls_md_context_t *src ); + +/** + * \brief This function extracts the message-digest size from the + * message-digest information structure. + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * + * \return The size of the message-digest output in Bytes. + */ +unsigned char mbedtls_md_get_size( const mbedtls_md_info_t *md_info ); + +/** + * \brief This function extracts the message-digest type from the + * message-digest information structure. + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * + * \return The type of the message digest. + */ +mbedtls_md_type_t mbedtls_md_get_type( const mbedtls_md_info_t *md_info ); + +/** + * \brief This function extracts the message-digest name from the + * message-digest information structure. + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * + * \return The name of the message digest. + */ +const char *mbedtls_md_get_name( const mbedtls_md_info_t *md_info ); + +/** + * \brief This function starts a message-digest computation. + * + * You must call this function after setting up the context + * with mbedtls_md_setup(), and before passing data with + * mbedtls_md_update(). + * + * \param ctx The generic message-digest context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_starts( mbedtls_md_context_t *ctx ); + +/** + * \brief This function feeds an input buffer into an ongoing + * message-digest computation. + * + * You must call mbedtls_md_starts() before calling this + * function. You may call this function multiple times. + * Afterwards, call mbedtls_md_finish(). + * + * \param ctx The generic message-digest context. + * \param input The buffer holding the input data. + * \param ilen The length of the input data. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_update( mbedtls_md_context_t *ctx, const unsigned char *input, size_t ilen ); + +/** + * \brief This function finishes the digest operation, + * and writes the result to the output buffer. + * + * Call this function after a call to mbedtls_md_starts(), + * followed by any number of calls to mbedtls_md_update(). + * Afterwards, you may either clear the context with + * mbedtls_md_free(), or call mbedtls_md_starts() to reuse + * the context for another digest operation with the same + * algorithm. + * + * \param ctx The generic message-digest context. + * \param output The buffer for the generic message-digest checksum result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_finish( mbedtls_md_context_t *ctx, unsigned char *output ); + +/** + * \brief This function calculates the message-digest of a buffer, + * with respect to a configurable message-digest algorithm + * in a single call. + * + * The result is calculated as + * Output = message_digest(input buffer). + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * \param input The buffer holding the data. + * \param ilen The length of the input data. + * \param output The generic message-digest checksum result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md( const mbedtls_md_info_t *md_info, const unsigned char *input, size_t ilen, + unsigned char *output ); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief This function calculates the message-digest checksum + * result of the contents of the provided file. + * + * The result is calculated as + * Output = message_digest(file contents). + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * \param path The input file name. + * \param output The generic message-digest checksum result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_FILE_IO_ERROR on an I/O error accessing + * the file pointed by \p path. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA if \p md_info was NULL. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_file( const mbedtls_md_info_t *md_info, const char *path, + unsigned char *output ); +#endif /* MBEDTLS_FS_IO */ + +/** + * \brief This function sets the HMAC key and prepares to + * authenticate a new message. + * + * Call this function after mbedtls_md_setup(), to use + * the MD context for an HMAC calculation, then call + * mbedtls_md_hmac_update() to provide the input data, and + * mbedtls_md_hmac_finish() to get the HMAC value. + * + * \param ctx The message digest context containing an embedded HMAC + * context. + * \param key The HMAC secret key. + * \param keylen The length of the HMAC key in Bytes. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_hmac_starts( mbedtls_md_context_t *ctx, const unsigned char *key, + size_t keylen ); + +/** + * \brief This function feeds an input buffer into an ongoing HMAC + * computation. + * + * Call mbedtls_md_hmac_starts() or mbedtls_md_hmac_reset() + * before calling this function. + * You may call this function multiple times to pass the + * input piecewise. + * Afterwards, call mbedtls_md_hmac_finish(). + * + * \param ctx The message digest context containing an embedded HMAC + * context. + * \param input The buffer holding the input data. + * \param ilen The length of the input data. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_hmac_update( mbedtls_md_context_t *ctx, const unsigned char *input, + size_t ilen ); + +/** + * \brief This function finishes the HMAC operation, and writes + * the result to the output buffer. + * + * Call this function after mbedtls_md_hmac_starts() and + * mbedtls_md_hmac_update() to get the HMAC value. Afterwards + * you may either call mbedtls_md_free() to clear the context, + * or call mbedtls_md_hmac_reset() to reuse the context with + * the same HMAC key. + * + * \param ctx The message digest context containing an embedded HMAC + * context. + * \param output The generic HMAC checksum result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_hmac_finish( mbedtls_md_context_t *ctx, unsigned char *output); + +/** + * \brief This function prepares to authenticate a new message with + * the same key as the previous HMAC operation. + * + * You may call this function after mbedtls_md_hmac_finish(). + * Afterwards call mbedtls_md_hmac_update() to pass the new + * input. + * + * \param ctx The message digest context containing an embedded HMAC + * context. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_hmac_reset( mbedtls_md_context_t *ctx ); + +/** + * \brief This function calculates the full generic HMAC + * on the input buffer with the provided key. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The HMAC result is calculated as + * output = generic HMAC(hmac key, input buffer). + * + * \param md_info The information structure of the message-digest algorithm + * to use. + * \param key The HMAC secret key. + * \param keylen The length of the HMAC secret key in Bytes. + * \param input The buffer holding the input data. + * \param ilen The length of the input data. + * \param output The generic HMAC result. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + * failure. + */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_hmac( const mbedtls_md_info_t *md_info, const unsigned char *key, size_t keylen, + const unsigned char *input, size_t ilen, + unsigned char *output ); + +/* Internal use */ +MBEDTLS_CHECK_RETURN_TYPICAL +int mbedtls_md_process( mbedtls_md_context_t *ctx, const unsigned char *data ); + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_MD_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/md2.h b/openharmony/armeabi-v7a/include/mbedtls/md2.h new file mode 100644 index 00000000..7f3d5cf4 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/md2.h @@ -0,0 +1,305 @@ +/** + * \file md2.h + * + * \brief MD2 message digest algorithm (hash function) + * + * \warning MD2 is considered a weak message digest and its use constitutes a + * security risk. We recommend considering stronger message digests + * instead. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ +#ifndef MBEDTLS_MD2_H +#define MBEDTLS_MD2_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +/* MBEDTLS_ERR_MD2_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** MD2 hardware accelerator failed */ +#define MBEDTLS_ERR_MD2_HW_ACCEL_FAILED -0x002B + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_MD2_ALT) +// Regular implementation +// + +/** + * \brief MD2 context structure + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +typedef struct mbedtls_md2_context +{ + unsigned char cksum[16]; /*!< checksum of the data block */ + unsigned char state[48]; /*!< intermediate digest state */ + unsigned char buffer[16]; /*!< data block being processed */ + size_t left; /*!< amount of data in buffer */ +} +mbedtls_md2_context; + +#else /* MBEDTLS_MD2_ALT */ +#include "md2_alt.h" +#endif /* MBEDTLS_MD2_ALT */ + +/** + * \brief Initialize MD2 context + * + * \param ctx MD2 context to be initialized + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md2_init( mbedtls_md2_context *ctx ); + +/** + * \brief Clear MD2 context + * + * \param ctx MD2 context to be cleared + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md2_free( mbedtls_md2_context *ctx ); + +/** + * \brief Clone (the state of) an MD2 context + * + * \param dst The destination context + * \param src The context to be cloned + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md2_clone( mbedtls_md2_context *dst, + const mbedtls_md2_context *src ); + +/** + * \brief MD2 context setup + * + * \param ctx context to be initialized + * + * \return 0 if successful + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md2_starts_ret( mbedtls_md2_context *ctx ); + +/** + * \brief MD2 process buffer + * + * \param ctx MD2 context + * \param input buffer holding the data + * \param ilen length of the input data + * + * \return 0 if successful + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md2_update_ret( mbedtls_md2_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief MD2 final digest + * + * \param ctx MD2 context + * \param output MD2 checksum result + * + * \return 0 if successful + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md2_finish_ret( mbedtls_md2_context *ctx, + unsigned char output[16] ); + +/** + * \brief MD2 process data block (internal use only) + * + * \param ctx MD2 context + * + * \return 0 if successful + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_internal_md2_process( mbedtls_md2_context *ctx ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief MD2 context setup + * + * \deprecated Superseded by mbedtls_md2_starts_ret() in 2.7.0 + * + * \param ctx context to be initialized + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md2_starts( mbedtls_md2_context *ctx ); + +/** + * \brief MD2 process buffer + * + * \deprecated Superseded by mbedtls_md2_update_ret() in 2.7.0 + * + * \param ctx MD2 context + * \param input buffer holding the data + * \param ilen length of the input data + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md2_update( mbedtls_md2_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief MD2 final digest + * + * \deprecated Superseded by mbedtls_md2_finish_ret() in 2.7.0 + * + * \param ctx MD2 context + * \param output MD2 checksum result + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md2_finish( mbedtls_md2_context *ctx, + unsigned char output[16] ); + +/** + * \brief MD2 process data block (internal use only) + * + * \deprecated Superseded by mbedtls_internal_md2_process() in 2.7.0 + * + * \param ctx MD2 context + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md2_process( mbedtls_md2_context *ctx ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief Output = MD2( input buffer ) + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output MD2 checksum result + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md2_ret( const unsigned char *input, + size_t ilen, + unsigned char output[16] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief Output = MD2( input buffer ) + * + * \deprecated Superseded by mbedtls_md2_ret() in 2.7.0 + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output MD2 checksum result + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md2( const unsigned char *input, + size_t ilen, + unsigned char output[16] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + * + * \warning MD2 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md2_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_md2.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/md4.h b/openharmony/armeabi-v7a/include/mbedtls/md4.h new file mode 100644 index 00000000..0238c672 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/md4.h @@ -0,0 +1,310 @@ +/** + * \file md4.h + * + * \brief MD4 message digest algorithm (hash function) + * + * \warning MD4 is considered a weak message digest and its use constitutes a + * security risk. We recommend considering stronger message digests + * instead. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ +#ifndef MBEDTLS_MD4_H +#define MBEDTLS_MD4_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +/* MBEDTLS_ERR_MD4_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** MD4 hardware accelerator failed */ +#define MBEDTLS_ERR_MD4_HW_ACCEL_FAILED -0x002D + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_MD4_ALT) +// Regular implementation +// + +/** + * \brief MD4 context structure + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +typedef struct mbedtls_md4_context +{ + uint32_t total[2]; /*!< number of bytes processed */ + uint32_t state[4]; /*!< intermediate digest state */ + unsigned char buffer[64]; /*!< data block being processed */ +} +mbedtls_md4_context; + +#else /* MBEDTLS_MD4_ALT */ +#include "md4_alt.h" +#endif /* MBEDTLS_MD4_ALT */ + +/** + * \brief Initialize MD4 context + * + * \param ctx MD4 context to be initialized + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md4_init( mbedtls_md4_context *ctx ); + +/** + * \brief Clear MD4 context + * + * \param ctx MD4 context to be cleared + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md4_free( mbedtls_md4_context *ctx ); + +/** + * \brief Clone (the state of) an MD4 context + * + * \param dst The destination context + * \param src The context to be cloned + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md4_clone( mbedtls_md4_context *dst, + const mbedtls_md4_context *src ); + +/** + * \brief MD4 context setup + * + * \param ctx context to be initialized + * + * \return 0 if successful + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + */ +int mbedtls_md4_starts_ret( mbedtls_md4_context *ctx ); + +/** + * \brief MD4 process buffer + * + * \param ctx MD4 context + * \param input buffer holding the data + * \param ilen length of the input data + * + * \return 0 if successful + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md4_update_ret( mbedtls_md4_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief MD4 final digest + * + * \param ctx MD4 context + * \param output MD4 checksum result + * + * \return 0 if successful + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md4_finish_ret( mbedtls_md4_context *ctx, + unsigned char output[16] ); + +/** + * \brief MD4 process data block (internal use only) + * + * \param ctx MD4 context + * \param data buffer holding one block of data + * + * \return 0 if successful + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_internal_md4_process( mbedtls_md4_context *ctx, + const unsigned char data[64] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief MD4 context setup + * + * \deprecated Superseded by mbedtls_md4_starts_ret() in 2.7.0 + * + * \param ctx context to be initialized + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md4_starts( mbedtls_md4_context *ctx ); + +/** + * \brief MD4 process buffer + * + * \deprecated Superseded by mbedtls_md4_update_ret() in 2.7.0 + * + * \param ctx MD4 context + * \param input buffer holding the data + * \param ilen length of the input data + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md4_update( mbedtls_md4_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief MD4 final digest + * + * \deprecated Superseded by mbedtls_md4_finish_ret() in 2.7.0 + * + * \param ctx MD4 context + * \param output MD4 checksum result + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md4_finish( mbedtls_md4_context *ctx, + unsigned char output[16] ); + +/** + * \brief MD4 process data block (internal use only) + * + * \deprecated Superseded by mbedtls_internal_md4_process() in 2.7.0 + * + * \param ctx MD4 context + * \param data buffer holding one block of data + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md4_process( mbedtls_md4_context *ctx, + const unsigned char data[64] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief Output = MD4( input buffer ) + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output MD4 checksum result + * + * \return 0 if successful + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md4_ret( const unsigned char *input, + size_t ilen, + unsigned char output[16] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief Output = MD4( input buffer ) + * + * \deprecated Superseded by mbedtls_md4_ret() in 2.7.0 + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output MD4 checksum result + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md4( const unsigned char *input, + size_t ilen, + unsigned char output[16] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + * + * \warning MD4 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md4_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_md4.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/md5.h b/openharmony/armeabi-v7a/include/mbedtls/md5.h new file mode 100644 index 00000000..73e4dd2c --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/md5.h @@ -0,0 +1,310 @@ +/** + * \file md5.h + * + * \brief MD5 message digest algorithm (hash function) + * + * \warning MD5 is considered a weak message digest and its use constitutes a + * security risk. We recommend considering stronger message + * digests instead. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_MD5_H +#define MBEDTLS_MD5_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +/* MBEDTLS_ERR_MD5_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** MD5 hardware accelerator failed */ +#define MBEDTLS_ERR_MD5_HW_ACCEL_FAILED -0x002F + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_MD5_ALT) +// Regular implementation +// + +/** + * \brief MD5 context structure + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +typedef struct mbedtls_md5_context +{ + uint32_t total[2]; /*!< number of bytes processed */ + uint32_t state[4]; /*!< intermediate digest state */ + unsigned char buffer[64]; /*!< data block being processed */ +} +mbedtls_md5_context; + +#else /* MBEDTLS_MD5_ALT */ +#include "md5_alt.h" +#endif /* MBEDTLS_MD5_ALT */ + +/** + * \brief Initialize MD5 context + * + * \param ctx MD5 context to be initialized + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md5_init( mbedtls_md5_context *ctx ); + +/** + * \brief Clear MD5 context + * + * \param ctx MD5 context to be cleared + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md5_free( mbedtls_md5_context *ctx ); + +/** + * \brief Clone (the state of) an MD5 context + * + * \param dst The destination context + * \param src The context to be cloned + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +void mbedtls_md5_clone( mbedtls_md5_context *dst, + const mbedtls_md5_context *src ); + +/** + * \brief MD5 context setup + * + * \param ctx context to be initialized + * + * \return 0 if successful + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md5_starts_ret( mbedtls_md5_context *ctx ); + +/** + * \brief MD5 process buffer + * + * \param ctx MD5 context + * \param input buffer holding the data + * \param ilen length of the input data + * + * \return 0 if successful + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md5_update_ret( mbedtls_md5_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief MD5 final digest + * + * \param ctx MD5 context + * \param output MD5 checksum result + * + * \return 0 if successful + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md5_finish_ret( mbedtls_md5_context *ctx, + unsigned char output[16] ); + +/** + * \brief MD5 process data block (internal use only) + * + * \param ctx MD5 context + * \param data buffer holding one block of data + * + * \return 0 if successful + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_internal_md5_process( mbedtls_md5_context *ctx, + const unsigned char data[64] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief MD5 context setup + * + * \deprecated Superseded by mbedtls_md5_starts_ret() in 2.7.0 + * + * \param ctx context to be initialized + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md5_starts( mbedtls_md5_context *ctx ); + +/** + * \brief MD5 process buffer + * + * \deprecated Superseded by mbedtls_md5_update_ret() in 2.7.0 + * + * \param ctx MD5 context + * \param input buffer holding the data + * \param ilen length of the input data + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md5_update( mbedtls_md5_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief MD5 final digest + * + * \deprecated Superseded by mbedtls_md5_finish_ret() in 2.7.0 + * + * \param ctx MD5 context + * \param output MD5 checksum result + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md5_finish( mbedtls_md5_context *ctx, + unsigned char output[16] ); + +/** + * \brief MD5 process data block (internal use only) + * + * \deprecated Superseded by mbedtls_internal_md5_process() in 2.7.0 + * + * \param ctx MD5 context + * \param data buffer holding one block of data + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md5_process( mbedtls_md5_context *ctx, + const unsigned char data[64] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief Output = MD5( input buffer ) + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output MD5 checksum result + * + * \return 0 if successful + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md5_ret( const unsigned char *input, + size_t ilen, + unsigned char output[16] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief Output = MD5( input buffer ) + * + * \deprecated Superseded by mbedtls_md5_ret() in 2.7.0 + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output MD5 checksum result + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +MBEDTLS_DEPRECATED void mbedtls_md5( const unsigned char *input, + size_t ilen, + unsigned char output[16] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + * + * \warning MD5 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +int mbedtls_md5_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_md5.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/md_internal.h b/openharmony/armeabi-v7a/include/mbedtls/md_internal.h new file mode 100644 index 00000000..f33cdf60 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/md_internal.h @@ -0,0 +1,90 @@ +/** + * \file md_internal.h + * + * \brief Message digest wrappers. + * + * \warning This in an internal header. Do not include directly. + * + * \author Adriaan de Jong + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_MD_WRAP_H +#define MBEDTLS_MD_WRAP_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/md.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Message digest information. + * Allows message digest functions to be called in a generic way. + */ +struct mbedtls_md_info_t +{ + /** Name of the message digest */ + const char * name; + + /** Digest identifier */ + mbedtls_md_type_t type; + + /** Output length of the digest function in bytes */ + unsigned char size; + + /** Block length of the digest function in bytes */ + unsigned char block_size; +}; + +#if defined(MBEDTLS_MD2_C) +extern const mbedtls_md_info_t mbedtls_md2_info; +#endif +#if defined(MBEDTLS_MD4_C) +extern const mbedtls_md_info_t mbedtls_md4_info; +#endif +#if defined(MBEDTLS_MD5_C) +extern const mbedtls_md_info_t mbedtls_md5_info; +#endif +#if defined(MBEDTLS_RIPEMD160_C) +extern const mbedtls_md_info_t mbedtls_ripemd160_info; +#endif +#if defined(MBEDTLS_SHA1_C) +extern const mbedtls_md_info_t mbedtls_sha1_info; +#endif +#if defined(MBEDTLS_SHA256_C) +extern const mbedtls_md_info_t mbedtls_sha224_info; +extern const mbedtls_md_info_t mbedtls_sha256_info; +#endif +#if defined(MBEDTLS_SHA512_C) +#if !defined(MBEDTLS_SHA512_NO_SHA384) +extern const mbedtls_md_info_t mbedtls_sha384_info; +#endif +extern const mbedtls_md_info_t mbedtls_sha512_info; +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_MD_WRAP_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/memory_buffer_alloc.h b/openharmony/armeabi-v7a/include/mbedtls/memory_buffer_alloc.h new file mode 100644 index 00000000..3954b36a --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/memory_buffer_alloc.h @@ -0,0 +1,149 @@ +/** + * \file memory_buffer_alloc.h + * + * \brief Buffer-based memory allocator + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_MEMORY_BUFFER_ALLOC_H +#define MBEDTLS_MEMORY_BUFFER_ALLOC_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h or define them on the compiler command line. + * \{ + */ + +#if !defined(MBEDTLS_MEMORY_ALIGN_MULTIPLE) +#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 4 /**< Align on multiples of this value */ +#endif + +/** \} name SECTION: Module settings */ + +#define MBEDTLS_MEMORY_VERIFY_NONE 0 +#define MBEDTLS_MEMORY_VERIFY_ALLOC (1 << 0) +#define MBEDTLS_MEMORY_VERIFY_FREE (1 << 1) +#define MBEDTLS_MEMORY_VERIFY_ALWAYS (MBEDTLS_MEMORY_VERIFY_ALLOC | MBEDTLS_MEMORY_VERIFY_FREE) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Initialize use of stack-based memory allocator. + * The stack-based allocator does memory management inside the + * presented buffer and does not call calloc() and free(). + * It sets the global mbedtls_calloc() and mbedtls_free() pointers + * to its own functions. + * (Provided mbedtls_calloc() and mbedtls_free() are thread-safe if + * MBEDTLS_THREADING_C is defined) + * + * \note This code is not optimized and provides a straight-forward + * implementation of a stack-based memory allocator. + * + * \param buf buffer to use as heap + * \param len size of the buffer + */ +void mbedtls_memory_buffer_alloc_init( unsigned char *buf, size_t len ); + +/** + * \brief Free the mutex for thread-safety and clear remaining memory + */ +void mbedtls_memory_buffer_alloc_free( void ); + +/** + * \brief Determine when the allocator should automatically verify the state + * of the entire chain of headers / meta-data. + * (Default: MBEDTLS_MEMORY_VERIFY_NONE) + * + * \param verify One of MBEDTLS_MEMORY_VERIFY_NONE, MBEDTLS_MEMORY_VERIFY_ALLOC, + * MBEDTLS_MEMORY_VERIFY_FREE or MBEDTLS_MEMORY_VERIFY_ALWAYS + */ +void mbedtls_memory_buffer_set_verify( int verify ); + +#if defined(MBEDTLS_MEMORY_DEBUG) +/** + * \brief Print out the status of the allocated memory (primarily for use + * after a program should have de-allocated all memory) + * Prints out a list of 'still allocated' blocks and their stack + * trace if MBEDTLS_MEMORY_BACKTRACE is defined. + */ +void mbedtls_memory_buffer_alloc_status( void ); + +/** + * \brief Get the peak heap usage so far + * + * \param max_used Peak number of bytes in use or committed. This + * includes bytes in allocated blocks too small to split + * into smaller blocks but larger than the requested size. + * \param max_blocks Peak number of blocks in use, including free and used + */ +void mbedtls_memory_buffer_alloc_max_get( size_t *max_used, size_t *max_blocks ); + +/** + * \brief Reset peak statistics + */ +void mbedtls_memory_buffer_alloc_max_reset( void ); + +/** + * \brief Get the current heap usage + * + * \param cur_used Current number of bytes in use or committed. This + * includes bytes in allocated blocks too small to split + * into smaller blocks but larger than the requested size. + * \param cur_blocks Current number of blocks in use, including free and used + */ +void mbedtls_memory_buffer_alloc_cur_get( size_t *cur_used, size_t *cur_blocks ); +#endif /* MBEDTLS_MEMORY_DEBUG */ + +/** + * \brief Verifies that all headers in the memory buffer are correct + * and contain sane values. Helps debug buffer-overflow errors. + * + * Prints out first failure if MBEDTLS_MEMORY_DEBUG is defined. + * Prints out full header information if MBEDTLS_MEMORY_DEBUG + * is defined. (Includes stack trace information for each block if + * MBEDTLS_MEMORY_BACKTRACE is defined as well). + * + * \return 0 if verified, 1 otherwise + */ +int mbedtls_memory_buffer_alloc_verify( void ); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if a test failed + */ +int mbedtls_memory_buffer_alloc_self_test( int verbose ); +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* memory_buffer_alloc.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/net.h b/openharmony/armeabi-v7a/include/mbedtls/net.h new file mode 100644 index 00000000..66921887 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/net.h @@ -0,0 +1,35 @@ +/** + * \file net.h + * + * \brief Deprecated header file that includes net_sockets.h + * + * \deprecated Superseded by mbedtls/net_sockets.h + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#include "mbedtls/net_sockets.h" +#if defined(MBEDTLS_DEPRECATED_WARNING) +#warning "Deprecated header file: Superseded by mbedtls/net_sockets.h" +#endif /* MBEDTLS_DEPRECATED_WARNING */ +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/net_sockets.h b/openharmony/armeabi-v7a/include/mbedtls/net_sockets.h new file mode 100644 index 00000000..ceb7d5f6 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/net_sockets.h @@ -0,0 +1,301 @@ +/** + * \file net_sockets.h + * + * \brief Network sockets abstraction layer to integrate Mbed TLS into a + * BSD-style sockets API. + * + * The network sockets module provides an example integration of the + * Mbed TLS library into a BSD sockets implementation. The module is + * intended to be an example of how Mbed TLS can be integrated into a + * networking stack, as well as to be Mbed TLS's network integration + * for its supported platforms. + * + * The module is intended only to be used with the Mbed TLS library and + * is not intended to be used by third party application software + * directly. + * + * The supported platforms are as follows: + * * Microsoft Windows and Windows CE + * * POSIX/Unix platforms including Linux, OS X + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_NET_SOCKETS_H +#define MBEDTLS_NET_SOCKETS_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/ssl.h" + +#include +#include + +/** Failed to open a socket. */ +#define MBEDTLS_ERR_NET_SOCKET_FAILED -0x0042 +/** The connection to the given server / port failed. */ +#define MBEDTLS_ERR_NET_CONNECT_FAILED -0x0044 +/** Binding of the socket failed. */ +#define MBEDTLS_ERR_NET_BIND_FAILED -0x0046 +/** Could not listen on the socket. */ +#define MBEDTLS_ERR_NET_LISTEN_FAILED -0x0048 +/** Could not accept the incoming connection. */ +#define MBEDTLS_ERR_NET_ACCEPT_FAILED -0x004A +/** Reading information from the socket failed. */ +#define MBEDTLS_ERR_NET_RECV_FAILED -0x004C +/** Sending information through the socket failed. */ +#define MBEDTLS_ERR_NET_SEND_FAILED -0x004E +/** Connection was reset by peer. */ +#define MBEDTLS_ERR_NET_CONN_RESET -0x0050 +/** Failed to get an IP address for the given hostname. */ +#define MBEDTLS_ERR_NET_UNKNOWN_HOST -0x0052 +/** Buffer is too small to hold the data. */ +#define MBEDTLS_ERR_NET_BUFFER_TOO_SMALL -0x0043 +/** The context is invalid, eg because it was free()ed. */ +#define MBEDTLS_ERR_NET_INVALID_CONTEXT -0x0045 +/** Polling the net context failed. */ +#define MBEDTLS_ERR_NET_POLL_FAILED -0x0047 +/** Input invalid. */ +#define MBEDTLS_ERR_NET_BAD_INPUT_DATA -0x0049 + +#define MBEDTLS_NET_LISTEN_BACKLOG 10 /**< The backlog that listen() should use. */ + +#define MBEDTLS_NET_PROTO_TCP 0 /**< The TCP transport protocol */ +#define MBEDTLS_NET_PROTO_UDP 1 /**< The UDP transport protocol */ + +#define MBEDTLS_NET_POLL_READ 1 /**< Used in \c mbedtls_net_poll to check for pending data */ +#define MBEDTLS_NET_POLL_WRITE 2 /**< Used in \c mbedtls_net_poll to check if write possible */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Wrapper type for sockets. + * + * Currently backed by just a file descriptor, but might be more in the future + * (eg two file descriptors for combined IPv4 + IPv6 support, or additional + * structures for hand-made UDP demultiplexing). + */ +typedef struct mbedtls_net_context +{ + int fd; /**< The underlying file descriptor */ +} +mbedtls_net_context; + +/** + * \brief Initialize a context + * Just makes the context ready to be used or freed safely. + * + * \param ctx Context to initialize + */ +void mbedtls_net_init( mbedtls_net_context *ctx ); + +/** + * \brief Initiate a connection with host:port in the given protocol + * + * \param ctx Socket to use + * \param host Host to connect to + * \param port Port to connect to + * \param proto Protocol: MBEDTLS_NET_PROTO_TCP or MBEDTLS_NET_PROTO_UDP + * + * \return 0 if successful, or one of: + * MBEDTLS_ERR_NET_SOCKET_FAILED, + * MBEDTLS_ERR_NET_UNKNOWN_HOST, + * MBEDTLS_ERR_NET_CONNECT_FAILED + * + * \note Sets the socket in connected mode even with UDP. + */ +int mbedtls_net_connect( mbedtls_net_context *ctx, const char *host, const char *port, int proto ); + +/** + * \brief Create a receiving socket on bind_ip:port in the chosen + * protocol. If bind_ip == NULL, all interfaces are bound. + * + * \param ctx Socket to use + * \param bind_ip IP to bind to, can be NULL + * \param port Port number to use + * \param proto Protocol: MBEDTLS_NET_PROTO_TCP or MBEDTLS_NET_PROTO_UDP + * + * \return 0 if successful, or one of: + * MBEDTLS_ERR_NET_SOCKET_FAILED, + * MBEDTLS_ERR_NET_UNKNOWN_HOST, + * MBEDTLS_ERR_NET_BIND_FAILED, + * MBEDTLS_ERR_NET_LISTEN_FAILED + * + * \note Regardless of the protocol, opens the sockets and binds it. + * In addition, make the socket listening if protocol is TCP. + */ +int mbedtls_net_bind( mbedtls_net_context *ctx, const char *bind_ip, const char *port, int proto ); + +/** + * \brief Accept a connection from a remote client + * + * \param bind_ctx Relevant socket + * \param client_ctx Will contain the connected client socket + * \param client_ip Will contain the client IP address, can be NULL + * \param buf_size Size of the client_ip buffer + * \param ip_len Will receive the size of the client IP written, + * can be NULL if client_ip is null + * + * \return 0 if successful, or + * MBEDTLS_ERR_NET_SOCKET_FAILED, + * MBEDTLS_ERR_NET_BIND_FAILED, + * MBEDTLS_ERR_NET_ACCEPT_FAILED, or + * MBEDTLS_ERR_NET_BUFFER_TOO_SMALL if buf_size is too small, + * MBEDTLS_ERR_SSL_WANT_READ if bind_fd was set to + * non-blocking and accept() would block. + */ +int mbedtls_net_accept( mbedtls_net_context *bind_ctx, + mbedtls_net_context *client_ctx, + void *client_ip, size_t buf_size, size_t *ip_len ); + +/** + * \brief Check and wait for the context to be ready for read/write + * + * \note The current implementation of this function uses + * select() and returns an error if the file descriptor + * is \c FD_SETSIZE or greater. + * + * \param ctx Socket to check + * \param rw Bitflag composed of MBEDTLS_NET_POLL_READ and + * MBEDTLS_NET_POLL_WRITE specifying the events + * to wait for: + * - If MBEDTLS_NET_POLL_READ is set, the function + * will return as soon as the net context is available + * for reading. + * - If MBEDTLS_NET_POLL_WRITE is set, the function + * will return as soon as the net context is available + * for writing. + * \param timeout Maximal amount of time to wait before returning, + * in milliseconds. If \c timeout is zero, the + * function returns immediately. If \c timeout is + * -1u, the function blocks potentially indefinitely. + * + * \return Bitmask composed of MBEDTLS_NET_POLL_READ/WRITE + * on success or timeout, or a negative return code otherwise. + */ +int mbedtls_net_poll( mbedtls_net_context *ctx, uint32_t rw, uint32_t timeout ); + +/** + * \brief Set the socket blocking + * + * \param ctx Socket to set + * + * \return 0 if successful, or a non-zero error code + */ +int mbedtls_net_set_block( mbedtls_net_context *ctx ); + +/** + * \brief Set the socket non-blocking + * + * \param ctx Socket to set + * + * \return 0 if successful, or a non-zero error code + */ +int mbedtls_net_set_nonblock( mbedtls_net_context *ctx ); + +/** + * \brief Portable usleep helper + * + * \param usec Amount of microseconds to sleep + * + * \note Real amount of time slept will not be less than + * select()'s timeout granularity (typically, 10ms). + */ +void mbedtls_net_usleep( unsigned long usec ); + +/** + * \brief Read at most 'len' characters. If no error occurs, + * the actual amount read is returned. + * + * \param ctx Socket + * \param buf The buffer to write to + * \param len Maximum length of the buffer + * + * \return the number of bytes received, + * or a non-zero error code; with a non-blocking socket, + * MBEDTLS_ERR_SSL_WANT_READ indicates read() would block. + */ +int mbedtls_net_recv( void *ctx, unsigned char *buf, size_t len ); + +/** + * \brief Write at most 'len' characters. If no error occurs, + * the actual amount read is returned. + * + * \param ctx Socket + * \param buf The buffer to read from + * \param len The length of the buffer + * + * \return the number of bytes sent, + * or a non-zero error code; with a non-blocking socket, + * MBEDTLS_ERR_SSL_WANT_WRITE indicates write() would block. + */ +int mbedtls_net_send( void *ctx, const unsigned char *buf, size_t len ); + +/** + * \brief Read at most 'len' characters, blocking for at most + * 'timeout' seconds. If no error occurs, the actual amount + * read is returned. + * + * \note The current implementation of this function uses + * select() and returns an error if the file descriptor + * is \c FD_SETSIZE or greater. + * + * \param ctx Socket + * \param buf The buffer to write to + * \param len Maximum length of the buffer + * \param timeout Maximum number of milliseconds to wait for data + * 0 means no timeout (wait forever) + * + * \return The number of bytes received if successful. + * MBEDTLS_ERR_SSL_TIMEOUT if the operation timed out. + * MBEDTLS_ERR_SSL_WANT_READ if interrupted by a signal. + * Another negative error code (MBEDTLS_ERR_NET_xxx) + * for other failures. + * + * \note This function will block (until data becomes available or + * timeout is reached) even if the socket is set to + * non-blocking. Handling timeouts with non-blocking reads + * requires a different strategy. + */ +int mbedtls_net_recv_timeout( void *ctx, unsigned char *buf, size_t len, + uint32_t timeout ); + +/** + * \brief Closes down the connection and free associated data + * + * \param ctx The context to close + */ +void mbedtls_net_close( mbedtls_net_context *ctx ); + +/** + * \brief Gracefully shutdown the connection and free associated data + * + * \param ctx The context to free + */ +void mbedtls_net_free( mbedtls_net_context *ctx ); + +#ifdef __cplusplus +} +#endif + +#endif /* net_sockets.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/nist_kw.h b/openharmony/armeabi-v7a/include/mbedtls/nist_kw.h new file mode 100644 index 00000000..7f3e64a5 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/nist_kw.h @@ -0,0 +1,182 @@ +/** + * \file nist_kw.h + * + * \brief This file provides an API for key wrapping (KW) and key wrapping with + * padding (KWP) as defined in NIST SP 800-38F. + * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf + * + * Key wrapping specifies a deterministic authenticated-encryption mode + * of operation, according to NIST SP 800-38F: Recommendation for + * Block Cipher Modes of Operation: Methods for Key Wrapping. Its + * purpose is to protect cryptographic keys. + * + * Its equivalent is RFC 3394 for KW, and RFC 5649 for KWP. + * https://tools.ietf.org/html/rfc3394 + * https://tools.ietf.org/html/rfc5649 + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_NIST_KW_H +#define MBEDTLS_NIST_KW_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/cipher.h" + +#ifdef __cplusplus +extern "C" { +#endif + +typedef enum +{ + MBEDTLS_KW_MODE_KW = 0, + MBEDTLS_KW_MODE_KWP = 1 +} mbedtls_nist_kw_mode_t; + +#if !defined(MBEDTLS_NIST_KW_ALT) +// Regular implementation +// + +/** + * \brief The key wrapping context-type definition. The key wrapping context is passed + * to the APIs called. + * + * \note The definition of this type may change in future library versions. + * Don't make any assumptions on this context! + */ +typedef struct { + mbedtls_cipher_context_t cipher_ctx; /*!< The cipher context used. */ +} mbedtls_nist_kw_context; + +#else /* MBEDTLS_NIST_key wrapping_ALT */ +#include "nist_kw_alt.h" +#endif /* MBEDTLS_NIST_KW_ALT */ + +/** + * \brief This function initializes the specified key wrapping context + * to make references valid and prepare the context + * for mbedtls_nist_kw_setkey() or mbedtls_nist_kw_free(). + * + * \param ctx The key wrapping context to initialize. + * + */ +void mbedtls_nist_kw_init( mbedtls_nist_kw_context *ctx ); + +/** + * \brief This function initializes the key wrapping context set in the + * \p ctx parameter and sets the encryption key. + * + * \param ctx The key wrapping context. + * \param cipher The 128-bit block cipher to use. Only AES is supported. + * \param key The Key Encryption Key (KEK). + * \param keybits The KEK size in bits. This must be acceptable by the cipher. + * \param is_wrap Specify whether the operation within the context is wrapping or unwrapping + * + * \return \c 0 on success. + * \return \c MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA for any invalid input. + * \return \c MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE for 128-bit block ciphers + * which are not supported. + * \return cipher-specific error code on failure of the underlying cipher. + */ +int mbedtls_nist_kw_setkey( mbedtls_nist_kw_context *ctx, + mbedtls_cipher_id_t cipher, + const unsigned char *key, + unsigned int keybits, + const int is_wrap ); + +/** + * \brief This function releases and clears the specified key wrapping context + * and underlying cipher sub-context. + * + * \param ctx The key wrapping context to clear. + */ +void mbedtls_nist_kw_free( mbedtls_nist_kw_context *ctx ); + +/** + * \brief This function encrypts a buffer using key wrapping. + * + * \param ctx The key wrapping context to use for encryption. + * \param mode The key wrapping mode to use (MBEDTLS_KW_MODE_KW or MBEDTLS_KW_MODE_KWP) + * \param input The buffer holding the input data. + * \param in_len The length of the input data in Bytes. + * The input uses units of 8 Bytes called semiblocks. + *
  • For KW mode: a multiple of 8 bytes between 16 and 2^57-8 inclusive.
    • + *
  • For KWP mode: any length between 1 and 2^32-1 inclusive.
+ * \param[out] output The buffer holding the output data. + *
  • For KW mode: Must be at least 8 bytes larger than \p in_len.
    • + *
  • For KWP mode: Must be at least 8 bytes larger rounded up to a multiple of + * 8 bytes for KWP (15 bytes at most).
+ * \param[out] out_len The number of bytes written to the output buffer. \c 0 on failure. + * \param[in] out_size The capacity of the output buffer. + * + * \return \c 0 on success. + * \return \c MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA for invalid input length. + * \return cipher-specific error code on failure of the underlying cipher. + */ +int mbedtls_nist_kw_wrap( mbedtls_nist_kw_context *ctx, mbedtls_nist_kw_mode_t mode, + const unsigned char *input, size_t in_len, + unsigned char *output, size_t* out_len, size_t out_size ); + +/** + * \brief This function decrypts a buffer using key wrapping. + * + * \param ctx The key wrapping context to use for decryption. + * \param mode The key wrapping mode to use (MBEDTLS_KW_MODE_KW or MBEDTLS_KW_MODE_KWP) + * \param input The buffer holding the input data. + * \param in_len The length of the input data in Bytes. + * The input uses units of 8 Bytes called semiblocks. + * The input must be a multiple of semiblocks. + *
  • For KW mode: a multiple of 8 bytes between 24 and 2^57 inclusive.
    • + *
  • For KWP mode: a multiple of 8 bytes between 16 and 2^32 inclusive.
+ * \param[out] output The buffer holding the output data. + * The output buffer's minimal length is 8 bytes shorter than \p in_len. + * \param[out] out_len The number of bytes written to the output buffer. \c 0 on failure. + * For KWP mode, the length could be up to 15 bytes shorter than \p in_len, + * depending on how much padding was added to the data. + * \param[in] out_size The capacity of the output buffer. + * + * \return \c 0 on success. + * \return \c MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA for invalid input length. + * \return \c MBEDTLS_ERR_CIPHER_AUTH_FAILED for verification failure of the ciphertext. + * \return cipher-specific error code on failure of the underlying cipher. + */ +int mbedtls_nist_kw_unwrap( mbedtls_nist_kw_context *ctx, mbedtls_nist_kw_mode_t mode, + const unsigned char *input, size_t in_len, + unsigned char *output, size_t* out_len, size_t out_size); + + +#if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_AES_C) +/** + * \brief The key wrapping checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_nist_kw_self_test( int verbose ); +#endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_NIST_KW_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/oid.h b/openharmony/armeabi-v7a/include/mbedtls/oid.h new file mode 100644 index 00000000..01862178 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/oid.h @@ -0,0 +1,649 @@ +/** + * \file oid.h + * + * \brief Object Identifier (OID) database + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_OID_H +#define MBEDTLS_OID_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/asn1.h" +#include "mbedtls/pk.h" + +#include + +#if defined(MBEDTLS_CIPHER_C) +#include "mbedtls/cipher.h" +#endif + +#if defined(MBEDTLS_MD_C) +#include "mbedtls/md.h" +#endif + +/** OID is not found. */ +#define MBEDTLS_ERR_OID_NOT_FOUND -0x002E +/** output buffer is too small */ +#define MBEDTLS_ERR_OID_BUF_TOO_SMALL -0x000B + +/* This is for the benefit of X.509, but defined here in order to avoid + * having a "backwards" include of x.509.h here */ +/* + * X.509 extension types (internal, arbitrary values for bitsets) + */ +#define MBEDTLS_OID_X509_EXT_AUTHORITY_KEY_IDENTIFIER (1 << 0) +#define MBEDTLS_OID_X509_EXT_SUBJECT_KEY_IDENTIFIER (1 << 1) +#define MBEDTLS_OID_X509_EXT_KEY_USAGE (1 << 2) +#define MBEDTLS_OID_X509_EXT_CERTIFICATE_POLICIES (1 << 3) +#define MBEDTLS_OID_X509_EXT_POLICY_MAPPINGS (1 << 4) +#define MBEDTLS_OID_X509_EXT_SUBJECT_ALT_NAME (1 << 5) +#define MBEDTLS_OID_X509_EXT_ISSUER_ALT_NAME (1 << 6) +#define MBEDTLS_OID_X509_EXT_SUBJECT_DIRECTORY_ATTRS (1 << 7) +#define MBEDTLS_OID_X509_EXT_BASIC_CONSTRAINTS (1 << 8) +#define MBEDTLS_OID_X509_EXT_NAME_CONSTRAINTS (1 << 9) +#define MBEDTLS_OID_X509_EXT_POLICY_CONSTRAINTS (1 << 10) +#define MBEDTLS_OID_X509_EXT_EXTENDED_KEY_USAGE (1 << 11) +#define MBEDTLS_OID_X509_EXT_CRL_DISTRIBUTION_POINTS (1 << 12) +#define MBEDTLS_OID_X509_EXT_INIHIBIT_ANYPOLICY (1 << 13) +#define MBEDTLS_OID_X509_EXT_FRESHEST_CRL (1 << 14) +#define MBEDTLS_OID_X509_EXT_NS_CERT_TYPE (1 << 16) + +/* + * Top level OID tuples + */ +#define MBEDTLS_OID_ISO_MEMBER_BODIES "\x2a" /* {iso(1) member-body(2)} */ +#define MBEDTLS_OID_ISO_IDENTIFIED_ORG "\x2b" /* {iso(1) identified-organization(3)} */ +#define MBEDTLS_OID_ISO_CCITT_DS "\x55" /* {joint-iso-ccitt(2) ds(5)} */ +#define MBEDTLS_OID_ISO_ITU_COUNTRY "\x60" /* {joint-iso-itu-t(2) country(16)} */ + +/* + * ISO Member bodies OID parts + */ +#define MBEDTLS_OID_COUNTRY_US "\x86\x48" /* {us(840)} */ +#define MBEDTLS_OID_ORG_RSA_DATA_SECURITY "\x86\xf7\x0d" /* {rsadsi(113549)} */ +#define MBEDTLS_OID_RSA_COMPANY MBEDTLS_OID_ISO_MEMBER_BODIES MBEDTLS_OID_COUNTRY_US \ + MBEDTLS_OID_ORG_RSA_DATA_SECURITY /* {iso(1) member-body(2) us(840) rsadsi(113549)} */ +#define MBEDTLS_OID_ORG_ANSI_X9_62 "\xce\x3d" /* ansi-X9-62(10045) */ +#define MBEDTLS_OID_ANSI_X9_62 MBEDTLS_OID_ISO_MEMBER_BODIES MBEDTLS_OID_COUNTRY_US \ + MBEDTLS_OID_ORG_ANSI_X9_62 + +/* + * ISO Identified organization OID parts + */ +#define MBEDTLS_OID_ORG_DOD "\x06" /* {dod(6)} */ +#define MBEDTLS_OID_ORG_OIW "\x0e" +#define MBEDTLS_OID_OIW_SECSIG MBEDTLS_OID_ORG_OIW "\x03" +#define MBEDTLS_OID_OIW_SECSIG_ALG MBEDTLS_OID_OIW_SECSIG "\x02" +#define MBEDTLS_OID_OIW_SECSIG_SHA1 MBEDTLS_OID_OIW_SECSIG_ALG "\x1a" +#define MBEDTLS_OID_ORG_CERTICOM "\x81\x04" /* certicom(132) */ +#define MBEDTLS_OID_CERTICOM MBEDTLS_OID_ISO_IDENTIFIED_ORG MBEDTLS_OID_ORG_CERTICOM +#define MBEDTLS_OID_ORG_TELETRUST "\x24" /* teletrust(36) */ +#define MBEDTLS_OID_TELETRUST MBEDTLS_OID_ISO_IDENTIFIED_ORG MBEDTLS_OID_ORG_TELETRUST + +/* + * ISO ITU OID parts + */ +#define MBEDTLS_OID_ORGANIZATION "\x01" /* {organization(1)} */ +#define MBEDTLS_OID_ISO_ITU_US_ORG MBEDTLS_OID_ISO_ITU_COUNTRY MBEDTLS_OID_COUNTRY_US MBEDTLS_OID_ORGANIZATION /* {joint-iso-itu-t(2) country(16) us(840) organization(1)} */ + +#define MBEDTLS_OID_ORG_GOV "\x65" /* {gov(101)} */ +#define MBEDTLS_OID_GOV MBEDTLS_OID_ISO_ITU_US_ORG MBEDTLS_OID_ORG_GOV /* {joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101)} */ + +#define MBEDTLS_OID_ORG_NETSCAPE "\x86\xF8\x42" /* {netscape(113730)} */ +#define MBEDTLS_OID_NETSCAPE MBEDTLS_OID_ISO_ITU_US_ORG MBEDTLS_OID_ORG_NETSCAPE /* Netscape OID {joint-iso-itu-t(2) country(16) us(840) organization(1) netscape(113730)} */ + +/* ISO arc for standard certificate and CRL extensions */ +#define MBEDTLS_OID_ID_CE MBEDTLS_OID_ISO_CCITT_DS "\x1D" /**< id-ce OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 29} */ + +#define MBEDTLS_OID_NIST_ALG MBEDTLS_OID_GOV "\x03\x04" /** { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithm(4) */ + +/** + * Private Internet Extensions + * { iso(1) identified-organization(3) dod(6) internet(1) + * security(5) mechanisms(5) pkix(7) } + */ +#define MBEDTLS_OID_INTERNET MBEDTLS_OID_ISO_IDENTIFIED_ORG MBEDTLS_OID_ORG_DOD "\x01" +#define MBEDTLS_OID_PKIX MBEDTLS_OID_INTERNET "\x05\x05\x07" + +/* + * Arc for standard naming attributes + */ +#define MBEDTLS_OID_AT MBEDTLS_OID_ISO_CCITT_DS "\x04" /**< id-at OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 4} */ +#define MBEDTLS_OID_AT_CN MBEDTLS_OID_AT "\x03" /**< id-at-commonName AttributeType:= {id-at 3} */ +#define MBEDTLS_OID_AT_SUR_NAME MBEDTLS_OID_AT "\x04" /**< id-at-surName AttributeType:= {id-at 4} */ +#define MBEDTLS_OID_AT_SERIAL_NUMBER MBEDTLS_OID_AT "\x05" /**< id-at-serialNumber AttributeType:= {id-at 5} */ +#define MBEDTLS_OID_AT_COUNTRY MBEDTLS_OID_AT "\x06" /**< id-at-countryName AttributeType:= {id-at 6} */ +#define MBEDTLS_OID_AT_LOCALITY MBEDTLS_OID_AT "\x07" /**< id-at-locality AttributeType:= {id-at 7} */ +#define MBEDTLS_OID_AT_STATE MBEDTLS_OID_AT "\x08" /**< id-at-state AttributeType:= {id-at 8} */ +#define MBEDTLS_OID_AT_ORGANIZATION MBEDTLS_OID_AT "\x0A" /**< id-at-organizationName AttributeType:= {id-at 10} */ +#define MBEDTLS_OID_AT_ORG_UNIT MBEDTLS_OID_AT "\x0B" /**< id-at-organizationalUnitName AttributeType:= {id-at 11} */ +#define MBEDTLS_OID_AT_TITLE MBEDTLS_OID_AT "\x0C" /**< id-at-title AttributeType:= {id-at 12} */ +#define MBEDTLS_OID_AT_POSTAL_ADDRESS MBEDTLS_OID_AT "\x10" /**< id-at-postalAddress AttributeType:= {id-at 16} */ +#define MBEDTLS_OID_AT_POSTAL_CODE MBEDTLS_OID_AT "\x11" /**< id-at-postalCode AttributeType:= {id-at 17} */ +#define MBEDTLS_OID_AT_GIVEN_NAME MBEDTLS_OID_AT "\x2A" /**< id-at-givenName AttributeType:= {id-at 42} */ +#define MBEDTLS_OID_AT_INITIALS MBEDTLS_OID_AT "\x2B" /**< id-at-initials AttributeType:= {id-at 43} */ +#define MBEDTLS_OID_AT_GENERATION_QUALIFIER MBEDTLS_OID_AT "\x2C" /**< id-at-generationQualifier AttributeType:= {id-at 44} */ +#define MBEDTLS_OID_AT_UNIQUE_IDENTIFIER MBEDTLS_OID_AT "\x2D" /**< id-at-uniqueIdentifier AttributeType:= {id-at 45} */ +#define MBEDTLS_OID_AT_DN_QUALIFIER MBEDTLS_OID_AT "\x2E" /**< id-at-dnQualifier AttributeType:= {id-at 46} */ +#define MBEDTLS_OID_AT_PSEUDONYM MBEDTLS_OID_AT "\x41" /**< id-at-pseudonym AttributeType:= {id-at 65} */ + +#define MBEDTLS_OID_DOMAIN_COMPONENT "\x09\x92\x26\x89\x93\xF2\x2C\x64\x01\x19" /** id-domainComponent AttributeType:= {itu-t(0) data(9) pss(2342) ucl(19200300) pilot(100) pilotAttributeType(1) domainComponent(25)} */ + +/* + * OIDs for standard certificate extensions + */ +#define MBEDTLS_OID_AUTHORITY_KEY_IDENTIFIER MBEDTLS_OID_ID_CE "\x23" /**< id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 35 } */ +#define MBEDTLS_OID_SUBJECT_KEY_IDENTIFIER MBEDTLS_OID_ID_CE "\x0E" /**< id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 14 } */ +#define MBEDTLS_OID_KEY_USAGE MBEDTLS_OID_ID_CE "\x0F" /**< id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 } */ +#define MBEDTLS_OID_CERTIFICATE_POLICIES MBEDTLS_OID_ID_CE "\x20" /**< id-ce-certificatePolicies OBJECT IDENTIFIER ::= { id-ce 32 } */ +#define MBEDTLS_OID_POLICY_MAPPINGS MBEDTLS_OID_ID_CE "\x21" /**< id-ce-policyMappings OBJECT IDENTIFIER ::= { id-ce 33 } */ +#define MBEDTLS_OID_SUBJECT_ALT_NAME MBEDTLS_OID_ID_CE "\x11" /**< id-ce-subjectAltName OBJECT IDENTIFIER ::= { id-ce 17 } */ +#define MBEDTLS_OID_ISSUER_ALT_NAME MBEDTLS_OID_ID_CE "\x12" /**< id-ce-issuerAltName OBJECT IDENTIFIER ::= { id-ce 18 } */ +#define MBEDTLS_OID_SUBJECT_DIRECTORY_ATTRS MBEDTLS_OID_ID_CE "\x09" /**< id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= { id-ce 9 } */ +#define MBEDTLS_OID_BASIC_CONSTRAINTS MBEDTLS_OID_ID_CE "\x13" /**< id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 } */ +#define MBEDTLS_OID_NAME_CONSTRAINTS MBEDTLS_OID_ID_CE "\x1E" /**< id-ce-nameConstraints OBJECT IDENTIFIER ::= { id-ce 30 } */ +#define MBEDTLS_OID_POLICY_CONSTRAINTS MBEDTLS_OID_ID_CE "\x24" /**< id-ce-policyConstraints OBJECT IDENTIFIER ::= { id-ce 36 } */ +#define MBEDTLS_OID_EXTENDED_KEY_USAGE MBEDTLS_OID_ID_CE "\x25" /**< id-ce-extKeyUsage OBJECT IDENTIFIER ::= { id-ce 37 } */ +#define MBEDTLS_OID_CRL_DISTRIBUTION_POINTS MBEDTLS_OID_ID_CE "\x1F" /**< id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= { id-ce 31 } */ +#define MBEDTLS_OID_INIHIBIT_ANYPOLICY MBEDTLS_OID_ID_CE "\x36" /**< id-ce-inhibitAnyPolicy OBJECT IDENTIFIER ::= { id-ce 54 } */ +#define MBEDTLS_OID_FRESHEST_CRL MBEDTLS_OID_ID_CE "\x2E" /**< id-ce-freshestCRL OBJECT IDENTIFIER ::= { id-ce 46 } */ + +/* + * Certificate policies + */ +#define MBEDTLS_OID_ANY_POLICY MBEDTLS_OID_CERTIFICATE_POLICIES "\x00" /**< anyPolicy OBJECT IDENTIFIER ::= { id-ce-certificatePolicies 0 } */ + +/* + * Netscape certificate extensions + */ +#define MBEDTLS_OID_NS_CERT MBEDTLS_OID_NETSCAPE "\x01" +#define MBEDTLS_OID_NS_CERT_TYPE MBEDTLS_OID_NS_CERT "\x01" +#define MBEDTLS_OID_NS_BASE_URL MBEDTLS_OID_NS_CERT "\x02" +#define MBEDTLS_OID_NS_REVOCATION_URL MBEDTLS_OID_NS_CERT "\x03" +#define MBEDTLS_OID_NS_CA_REVOCATION_URL MBEDTLS_OID_NS_CERT "\x04" +#define MBEDTLS_OID_NS_RENEWAL_URL MBEDTLS_OID_NS_CERT "\x07" +#define MBEDTLS_OID_NS_CA_POLICY_URL MBEDTLS_OID_NS_CERT "\x08" +#define MBEDTLS_OID_NS_SSL_SERVER_NAME MBEDTLS_OID_NS_CERT "\x0C" +#define MBEDTLS_OID_NS_COMMENT MBEDTLS_OID_NS_CERT "\x0D" +#define MBEDTLS_OID_NS_DATA_TYPE MBEDTLS_OID_NETSCAPE "\x02" +#define MBEDTLS_OID_NS_CERT_SEQUENCE MBEDTLS_OID_NS_DATA_TYPE "\x05" + +/* + * OIDs for CRL extensions + */ +#define MBEDTLS_OID_PRIVATE_KEY_USAGE_PERIOD MBEDTLS_OID_ID_CE "\x10" +#define MBEDTLS_OID_CRL_NUMBER MBEDTLS_OID_ID_CE "\x14" /**< id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 } */ + +/* + * X.509 v3 Extended key usage OIDs + */ +#define MBEDTLS_OID_ANY_EXTENDED_KEY_USAGE MBEDTLS_OID_EXTENDED_KEY_USAGE "\x00" /**< anyExtendedKeyUsage OBJECT IDENTIFIER ::= { id-ce-extKeyUsage 0 } */ + +#define MBEDTLS_OID_KP MBEDTLS_OID_PKIX "\x03" /**< id-kp OBJECT IDENTIFIER ::= { id-pkix 3 } */ +#define MBEDTLS_OID_SERVER_AUTH MBEDTLS_OID_KP "\x01" /**< id-kp-serverAuth OBJECT IDENTIFIER ::= { id-kp 1 } */ +#define MBEDTLS_OID_CLIENT_AUTH MBEDTLS_OID_KP "\x02" /**< id-kp-clientAuth OBJECT IDENTIFIER ::= { id-kp 2 } */ +#define MBEDTLS_OID_CODE_SIGNING MBEDTLS_OID_KP "\x03" /**< id-kp-codeSigning OBJECT IDENTIFIER ::= { id-kp 3 } */ +#define MBEDTLS_OID_EMAIL_PROTECTION MBEDTLS_OID_KP "\x04" /**< id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 } */ +#define MBEDTLS_OID_TIME_STAMPING MBEDTLS_OID_KP "\x08" /**< id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 } */ +#define MBEDTLS_OID_OCSP_SIGNING MBEDTLS_OID_KP "\x09" /**< id-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-kp 9 } */ + +/** + * Wi-SUN Alliance Field Area Network + * { iso(1) identified-organization(3) dod(6) internet(1) + * private(4) enterprise(1) WiSUN(45605) FieldAreaNetwork(1) } + */ +#define MBEDTLS_OID_WISUN_FAN MBEDTLS_OID_INTERNET "\x04\x01\x82\xe4\x25\x01" + +#define MBEDTLS_OID_ON MBEDTLS_OID_PKIX "\x08" /**< id-on OBJECT IDENTIFIER ::= { id-pkix 8 } */ +#define MBEDTLS_OID_ON_HW_MODULE_NAME MBEDTLS_OID_ON "\x04" /**< id-on-hardwareModuleName OBJECT IDENTIFIER ::= { id-on 4 } */ + +/* + * PKCS definition OIDs + */ + +#define MBEDTLS_OID_PKCS MBEDTLS_OID_RSA_COMPANY "\x01" /**< pkcs OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) 1 } */ +#define MBEDTLS_OID_PKCS1 MBEDTLS_OID_PKCS "\x01" /**< pkcs-1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1 } */ +#define MBEDTLS_OID_PKCS5 MBEDTLS_OID_PKCS "\x05" /**< pkcs-5 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 5 } */ +#define MBEDTLS_OID_PKCS9 MBEDTLS_OID_PKCS "\x09" /**< pkcs-9 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 9 } */ +#define MBEDTLS_OID_PKCS12 MBEDTLS_OID_PKCS "\x0c" /**< pkcs-12 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 12 } */ + +/* + * PKCS#1 OIDs + */ +#define MBEDTLS_OID_PKCS1_RSA MBEDTLS_OID_PKCS1 "\x01" /**< rsaEncryption OBJECT IDENTIFIER ::= { pkcs-1 1 } */ +#define MBEDTLS_OID_PKCS1_MD2 MBEDTLS_OID_PKCS1 "\x02" /**< md2WithRSAEncryption ::= { pkcs-1 2 } */ +#define MBEDTLS_OID_PKCS1_MD4 MBEDTLS_OID_PKCS1 "\x03" /**< md4WithRSAEncryption ::= { pkcs-1 3 } */ +#define MBEDTLS_OID_PKCS1_MD5 MBEDTLS_OID_PKCS1 "\x04" /**< md5WithRSAEncryption ::= { pkcs-1 4 } */ +#define MBEDTLS_OID_PKCS1_SHA1 MBEDTLS_OID_PKCS1 "\x05" /**< sha1WithRSAEncryption ::= { pkcs-1 5 } */ +#define MBEDTLS_OID_PKCS1_SHA224 MBEDTLS_OID_PKCS1 "\x0e" /**< sha224WithRSAEncryption ::= { pkcs-1 14 } */ +#define MBEDTLS_OID_PKCS1_SHA256 MBEDTLS_OID_PKCS1 "\x0b" /**< sha256WithRSAEncryption ::= { pkcs-1 11 } */ +#define MBEDTLS_OID_PKCS1_SHA384 MBEDTLS_OID_PKCS1 "\x0c" /**< sha384WithRSAEncryption ::= { pkcs-1 12 } */ +#define MBEDTLS_OID_PKCS1_SHA512 MBEDTLS_OID_PKCS1 "\x0d" /**< sha512WithRSAEncryption ::= { pkcs-1 13 } */ + +#define MBEDTLS_OID_RSA_SHA_OBS "\x2B\x0E\x03\x02\x1D" + +#define MBEDTLS_OID_PKCS9_EMAIL MBEDTLS_OID_PKCS9 "\x01" /**< emailAddress AttributeType ::= { pkcs-9 1 } */ + +/* RFC 4055 */ +#define MBEDTLS_OID_RSASSA_PSS MBEDTLS_OID_PKCS1 "\x0a" /**< id-RSASSA-PSS ::= { pkcs-1 10 } */ +#define MBEDTLS_OID_MGF1 MBEDTLS_OID_PKCS1 "\x08" /**< id-mgf1 ::= { pkcs-1 8 } */ + +/* + * Digest algorithms + */ +#define MBEDTLS_OID_DIGEST_ALG_MD2 MBEDTLS_OID_RSA_COMPANY "\x02\x02" /**< id-mbedtls_md2 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 2 } */ +#define MBEDTLS_OID_DIGEST_ALG_MD4 MBEDTLS_OID_RSA_COMPANY "\x02\x04" /**< id-mbedtls_md4 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 4 } */ +#define MBEDTLS_OID_DIGEST_ALG_MD5 MBEDTLS_OID_RSA_COMPANY "\x02\x05" /**< id-mbedtls_md5 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 5 } */ +#define MBEDTLS_OID_DIGEST_ALG_SHA1 MBEDTLS_OID_ISO_IDENTIFIED_ORG MBEDTLS_OID_OIW_SECSIG_SHA1 /**< id-mbedtls_sha1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) oiw(14) secsig(3) algorithms(2) 26 } */ +#define MBEDTLS_OID_DIGEST_ALG_SHA224 MBEDTLS_OID_NIST_ALG "\x02\x04" /**< id-sha224 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 4 } */ +#define MBEDTLS_OID_DIGEST_ALG_SHA256 MBEDTLS_OID_NIST_ALG "\x02\x01" /**< id-mbedtls_sha256 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 1 } */ + +#define MBEDTLS_OID_DIGEST_ALG_SHA384 MBEDTLS_OID_NIST_ALG "\x02\x02" /**< id-sha384 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 2 } */ + +#define MBEDTLS_OID_DIGEST_ALG_SHA512 MBEDTLS_OID_NIST_ALG "\x02\x03" /**< id-mbedtls_sha512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 3 } */ + +#define MBEDTLS_OID_DIGEST_ALG_RIPEMD160 MBEDTLS_OID_TELETRUST "\x03\x02\x01" /**< id-ripemd160 OBJECT IDENTIFIER :: { iso(1) identified-organization(3) teletrust(36) algorithm(3) hashAlgorithm(2) ripemd160(1) } */ + +#define MBEDTLS_OID_HMAC_SHA1 MBEDTLS_OID_RSA_COMPANY "\x02\x07" /**< id-hmacWithSHA1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 7 } */ + +#define MBEDTLS_OID_HMAC_SHA224 MBEDTLS_OID_RSA_COMPANY "\x02\x08" /**< id-hmacWithSHA224 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 8 } */ + +#define MBEDTLS_OID_HMAC_SHA256 MBEDTLS_OID_RSA_COMPANY "\x02\x09" /**< id-hmacWithSHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 9 } */ + +#define MBEDTLS_OID_HMAC_SHA384 MBEDTLS_OID_RSA_COMPANY "\x02\x0A" /**< id-hmacWithSHA384 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 10 } */ + +#define MBEDTLS_OID_HMAC_SHA512 MBEDTLS_OID_RSA_COMPANY "\x02\x0B" /**< id-hmacWithSHA512 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 11 } */ + +/* + * Encryption algorithms + */ +#define MBEDTLS_OID_DES_CBC MBEDTLS_OID_ISO_IDENTIFIED_ORG MBEDTLS_OID_OIW_SECSIG_ALG "\x07" /**< desCBC OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) oiw(14) secsig(3) algorithms(2) 7 } */ +#define MBEDTLS_OID_DES_EDE3_CBC MBEDTLS_OID_RSA_COMPANY "\x03\x07" /**< des-ede3-cbc OBJECT IDENTIFIER ::= { iso(1) member-body(2) -- us(840) rsadsi(113549) encryptionAlgorithm(3) 7 } */ +#define MBEDTLS_OID_AES MBEDTLS_OID_NIST_ALG "\x01" /** aes OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithm(4) 1 } */ + +/* + * Key Wrapping algorithms + */ +/* + * RFC 5649 + */ +#define MBEDTLS_OID_AES128_KW MBEDTLS_OID_AES "\x05" /** id-aes128-wrap OBJECT IDENTIFIER ::= { aes 5 } */ +#define MBEDTLS_OID_AES128_KWP MBEDTLS_OID_AES "\x08" /** id-aes128-wrap-pad OBJECT IDENTIFIER ::= { aes 8 } */ +#define MBEDTLS_OID_AES192_KW MBEDTLS_OID_AES "\x19" /** id-aes192-wrap OBJECT IDENTIFIER ::= { aes 25 } */ +#define MBEDTLS_OID_AES192_KWP MBEDTLS_OID_AES "\x1c" /** id-aes192-wrap-pad OBJECT IDENTIFIER ::= { aes 28 } */ +#define MBEDTLS_OID_AES256_KW MBEDTLS_OID_AES "\x2d" /** id-aes256-wrap OBJECT IDENTIFIER ::= { aes 45 } */ +#define MBEDTLS_OID_AES256_KWP MBEDTLS_OID_AES "\x30" /** id-aes256-wrap-pad OBJECT IDENTIFIER ::= { aes 48 } */ +/* + * PKCS#5 OIDs + */ +#define MBEDTLS_OID_PKCS5_PBKDF2 MBEDTLS_OID_PKCS5 "\x0c" /**< id-PBKDF2 OBJECT IDENTIFIER ::= {pkcs-5 12} */ +#define MBEDTLS_OID_PKCS5_PBES2 MBEDTLS_OID_PKCS5 "\x0d" /**< id-PBES2 OBJECT IDENTIFIER ::= {pkcs-5 13} */ +#define MBEDTLS_OID_PKCS5_PBMAC1 MBEDTLS_OID_PKCS5 "\x0e" /**< id-PBMAC1 OBJECT IDENTIFIER ::= {pkcs-5 14} */ + +/* + * PKCS#5 PBES1 algorithms + */ +#define MBEDTLS_OID_PKCS5_PBE_MD2_DES_CBC MBEDTLS_OID_PKCS5 "\x01" /**< pbeWithMD2AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 1} */ +#define MBEDTLS_OID_PKCS5_PBE_MD2_RC2_CBC MBEDTLS_OID_PKCS5 "\x04" /**< pbeWithMD2AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 4} */ +#define MBEDTLS_OID_PKCS5_PBE_MD5_DES_CBC MBEDTLS_OID_PKCS5 "\x03" /**< pbeWithMD5AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 3} */ +#define MBEDTLS_OID_PKCS5_PBE_MD5_RC2_CBC MBEDTLS_OID_PKCS5 "\x06" /**< pbeWithMD5AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 6} */ +#define MBEDTLS_OID_PKCS5_PBE_SHA1_DES_CBC MBEDTLS_OID_PKCS5 "\x0a" /**< pbeWithSHA1AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 10} */ +#define MBEDTLS_OID_PKCS5_PBE_SHA1_RC2_CBC MBEDTLS_OID_PKCS5 "\x0b" /**< pbeWithSHA1AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 11} */ + +/* + * PKCS#8 OIDs + */ +#define MBEDTLS_OID_PKCS9_CSR_EXT_REQ MBEDTLS_OID_PKCS9 "\x0e" /**< extensionRequest OBJECT IDENTIFIER ::= {pkcs-9 14} */ + +/* + * PKCS#12 PBE OIDs + */ +#define MBEDTLS_OID_PKCS12_PBE MBEDTLS_OID_PKCS12 "\x01" /**< pkcs-12PbeIds OBJECT IDENTIFIER ::= {pkcs-12 1} */ + +#define MBEDTLS_OID_PKCS12_PBE_SHA1_RC4_128 MBEDTLS_OID_PKCS12_PBE "\x01" /**< pbeWithSHAAnd128BitRC4 OBJECT IDENTIFIER ::= {pkcs-12PbeIds 1} */ +#define MBEDTLS_OID_PKCS12_PBE_SHA1_RC4_40 MBEDTLS_OID_PKCS12_PBE "\x02" /**< pbeWithSHAAnd40BitRC4 OBJECT IDENTIFIER ::= {pkcs-12PbeIds 2} */ +#define MBEDTLS_OID_PKCS12_PBE_SHA1_DES3_EDE_CBC MBEDTLS_OID_PKCS12_PBE "\x03" /**< pbeWithSHAAnd3-KeyTripleDES-CBC OBJECT IDENTIFIER ::= {pkcs-12PbeIds 3} */ +#define MBEDTLS_OID_PKCS12_PBE_SHA1_DES2_EDE_CBC MBEDTLS_OID_PKCS12_PBE "\x04" /**< pbeWithSHAAnd2-KeyTripleDES-CBC OBJECT IDENTIFIER ::= {pkcs-12PbeIds 4} */ +#define MBEDTLS_OID_PKCS12_PBE_SHA1_RC2_128_CBC MBEDTLS_OID_PKCS12_PBE "\x05" /**< pbeWithSHAAnd128BitRC2-CBC OBJECT IDENTIFIER ::= {pkcs-12PbeIds 5} */ +#define MBEDTLS_OID_PKCS12_PBE_SHA1_RC2_40_CBC MBEDTLS_OID_PKCS12_PBE "\x06" /**< pbeWithSHAAnd40BitRC2-CBC OBJECT IDENTIFIER ::= {pkcs-12PbeIds 6} */ + +/* + * EC key algorithms from RFC 5480 + */ + +/* id-ecPublicKey OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) keyType(2) 1 } */ +#define MBEDTLS_OID_EC_ALG_UNRESTRICTED MBEDTLS_OID_ANSI_X9_62 "\x02\01" + +/* id-ecDH OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) + * schemes(1) ecdh(12) } */ +#define MBEDTLS_OID_EC_ALG_ECDH MBEDTLS_OID_CERTICOM "\x01\x0c" + +/* + * ECParameters namedCurve identifiers, from RFC 5480, RFC 5639, and SEC2 + */ + +/* secp192r1 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) curves(3) prime(1) 1 } */ +#define MBEDTLS_OID_EC_GRP_SECP192R1 MBEDTLS_OID_ANSI_X9_62 "\x03\x01\x01" + +/* secp224r1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 33 } */ +#define MBEDTLS_OID_EC_GRP_SECP224R1 MBEDTLS_OID_CERTICOM "\x00\x21" + +/* secp256r1 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) curves(3) prime(1) 7 } */ +#define MBEDTLS_OID_EC_GRP_SECP256R1 MBEDTLS_OID_ANSI_X9_62 "\x03\x01\x07" + +/* secp384r1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 34 } */ +#define MBEDTLS_OID_EC_GRP_SECP384R1 MBEDTLS_OID_CERTICOM "\x00\x22" + +/* secp521r1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 35 } */ +#define MBEDTLS_OID_EC_GRP_SECP521R1 MBEDTLS_OID_CERTICOM "\x00\x23" + +/* secp192k1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 31 } */ +#define MBEDTLS_OID_EC_GRP_SECP192K1 MBEDTLS_OID_CERTICOM "\x00\x1f" + +/* secp224k1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 32 } */ +#define MBEDTLS_OID_EC_GRP_SECP224K1 MBEDTLS_OID_CERTICOM "\x00\x20" + +/* secp256k1 OBJECT IDENTIFIER ::= { + * iso(1) identified-organization(3) certicom(132) curve(0) 10 } */ +#define MBEDTLS_OID_EC_GRP_SECP256K1 MBEDTLS_OID_CERTICOM "\x00\x0a" + +/* RFC 5639 4.1 + * ecStdCurvesAndGeneration OBJECT IDENTIFIER::= {iso(1) + * identified-organization(3) teletrust(36) algorithm(3) signature- + * algorithm(3) ecSign(2) 8} + * ellipticCurve OBJECT IDENTIFIER ::= {ecStdCurvesAndGeneration 1} + * versionOne OBJECT IDENTIFIER ::= {ellipticCurve 1} */ +#define MBEDTLS_OID_EC_BRAINPOOL_V1 MBEDTLS_OID_TELETRUST "\x03\x03\x02\x08\x01\x01" + +/* brainpoolP256r1 OBJECT IDENTIFIER ::= {versionOne 7} */ +#define MBEDTLS_OID_EC_GRP_BP256R1 MBEDTLS_OID_EC_BRAINPOOL_V1 "\x07" + +/* brainpoolP384r1 OBJECT IDENTIFIER ::= {versionOne 11} */ +#define MBEDTLS_OID_EC_GRP_BP384R1 MBEDTLS_OID_EC_BRAINPOOL_V1 "\x0B" + +/* brainpoolP512r1 OBJECT IDENTIFIER ::= {versionOne 13} */ +#define MBEDTLS_OID_EC_GRP_BP512R1 MBEDTLS_OID_EC_BRAINPOOL_V1 "\x0D" + +/* + * SEC1 C.1 + * + * prime-field OBJECT IDENTIFIER ::= { id-fieldType 1 } + * id-fieldType OBJECT IDENTIFIER ::= { ansi-X9-62 fieldType(1)} + */ +#define MBEDTLS_OID_ANSI_X9_62_FIELD_TYPE MBEDTLS_OID_ANSI_X9_62 "\x01" +#define MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD MBEDTLS_OID_ANSI_X9_62_FIELD_TYPE "\x01" + +/* + * ECDSA signature identifiers, from RFC 5480 + */ +#define MBEDTLS_OID_ANSI_X9_62_SIG MBEDTLS_OID_ANSI_X9_62 "\x04" /* signatures(4) */ +#define MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 MBEDTLS_OID_ANSI_X9_62_SIG "\x03" /* ecdsa-with-SHA2(3) */ + +/* ecdsa-with-SHA1 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) 1 } */ +#define MBEDTLS_OID_ECDSA_SHA1 MBEDTLS_OID_ANSI_X9_62_SIG "\x01" + +/* ecdsa-with-SHA224 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) + * ecdsa-with-SHA2(3) 1 } */ +#define MBEDTLS_OID_ECDSA_SHA224 MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 "\x01" + +/* ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) + * ecdsa-with-SHA2(3) 2 } */ +#define MBEDTLS_OID_ECDSA_SHA256 MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 "\x02" + +/* ecdsa-with-SHA384 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) + * ecdsa-with-SHA2(3) 3 } */ +#define MBEDTLS_OID_ECDSA_SHA384 MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 "\x03" + +/* ecdsa-with-SHA512 OBJECT IDENTIFIER ::= { + * iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) + * ecdsa-with-SHA2(3) 4 } */ +#define MBEDTLS_OID_ECDSA_SHA512 MBEDTLS_OID_ANSI_X9_62_SIG_SHA2 "\x04" + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Base OID descriptor structure + */ +typedef struct mbedtls_oid_descriptor_t +{ + const char *asn1; /*!< OID ASN.1 representation */ + size_t asn1_len; /*!< length of asn1 */ + const char *name; /*!< official name (e.g. from RFC) */ + const char *description; /*!< human friendly description */ +} mbedtls_oid_descriptor_t; + +/** + * \brief Translate an ASN.1 OID into its numeric representation + * (e.g. "\x2A\x86\x48\x86\xF7\x0D" into "1.2.840.113549") + * + * \param buf buffer to put representation in + * \param size size of the buffer + * \param oid OID to translate + * + * \return Length of the string written (excluding final NULL) or + * MBEDTLS_ERR_OID_BUF_TOO_SMALL in case of error + */ +int mbedtls_oid_get_numeric_string( char *buf, size_t size, const mbedtls_asn1_buf *oid ); + +/** + * \brief Translate an X.509 extension OID into local values + * + * \param oid OID to use + * \param ext_type place to store the extension type + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_x509_ext_type( const mbedtls_asn1_buf *oid, int *ext_type ); + +/** + * \brief Translate an X.509 attribute type OID into the short name + * (e.g. the OID for an X520 Common Name into "CN") + * + * \param oid OID to use + * \param short_name place to store the string pointer + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_attr_short_name( const mbedtls_asn1_buf *oid, const char **short_name ); + +/** + * \brief Translate PublicKeyAlgorithm OID into pk_type + * + * \param oid OID to use + * \param pk_alg place to store public key algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_pk_alg( const mbedtls_asn1_buf *oid, mbedtls_pk_type_t *pk_alg ); + +/** + * \brief Translate pk_type into PublicKeyAlgorithm OID + * + * \param pk_alg Public key type to look for + * \param oid place to store ASN.1 OID string pointer + * \param olen length of the OID + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_oid_by_pk_alg( mbedtls_pk_type_t pk_alg, + const char **oid, size_t *olen ); + +#if defined(MBEDTLS_ECP_C) +/** + * \brief Translate NamedCurve OID into an EC group identifier + * + * \param oid OID to use + * \param grp_id place to store group id + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_ec_grp( const mbedtls_asn1_buf *oid, mbedtls_ecp_group_id *grp_id ); + +/** + * \brief Translate EC group identifier into NamedCurve OID + * + * \param grp_id EC group identifier + * \param oid place to store ASN.1 OID string pointer + * \param olen length of the OID + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_oid_by_ec_grp( mbedtls_ecp_group_id grp_id, + const char **oid, size_t *olen ); +#endif /* MBEDTLS_ECP_C */ + +#if defined(MBEDTLS_MD_C) +/** + * \brief Translate SignatureAlgorithm OID into md_type and pk_type + * + * \param oid OID to use + * \param md_alg place to store message digest algorithm + * \param pk_alg place to store public key algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_sig_alg( const mbedtls_asn1_buf *oid, + mbedtls_md_type_t *md_alg, mbedtls_pk_type_t *pk_alg ); + +/** + * \brief Translate SignatureAlgorithm OID into description + * + * \param oid OID to use + * \param desc place to store string pointer + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_sig_alg_desc( const mbedtls_asn1_buf *oid, const char **desc ); + +/** + * \brief Translate md_type and pk_type into SignatureAlgorithm OID + * + * \param md_alg message digest algorithm + * \param pk_alg public key algorithm + * \param oid place to store ASN.1 OID string pointer + * \param olen length of the OID + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_oid_by_sig_alg( mbedtls_pk_type_t pk_alg, mbedtls_md_type_t md_alg, + const char **oid, size_t *olen ); + +/** + * \brief Translate hash algorithm OID into md_type + * + * \param oid OID to use + * \param md_alg place to store message digest algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_md_alg( const mbedtls_asn1_buf *oid, mbedtls_md_type_t *md_alg ); + +/** + * \brief Translate hmac algorithm OID into md_type + * + * \param oid OID to use + * \param md_hmac place to store message hmac algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_md_hmac( const mbedtls_asn1_buf *oid, mbedtls_md_type_t *md_hmac ); +#endif /* MBEDTLS_MD_C */ + +/** + * \brief Translate Extended Key Usage OID into description + * + * \param oid OID to use + * \param desc place to store string pointer + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_extended_key_usage( const mbedtls_asn1_buf *oid, const char **desc ); + +/** + * \brief Translate certificate policies OID into description + * + * \param oid OID to use + * \param desc place to store string pointer + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_certificate_policies( const mbedtls_asn1_buf *oid, const char **desc ); + +/** + * \brief Translate md_type into hash algorithm OID + * + * \param md_alg message digest algorithm + * \param oid place to store ASN.1 OID string pointer + * \param olen length of the OID + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_oid_by_md( mbedtls_md_type_t md_alg, const char **oid, size_t *olen ); + +#if defined(MBEDTLS_CIPHER_C) +/** + * \brief Translate encryption algorithm OID into cipher_type + * + * \param oid OID to use + * \param cipher_alg place to store cipher algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_cipher_alg( const mbedtls_asn1_buf *oid, mbedtls_cipher_type_t *cipher_alg ); +#endif /* MBEDTLS_CIPHER_C */ + +#if defined(MBEDTLS_PKCS12_C) +/** + * \brief Translate PKCS#12 PBE algorithm OID into md_type and + * cipher_type + * + * \param oid OID to use + * \param md_alg place to store message digest algorithm + * \param cipher_alg place to store cipher algorithm + * + * \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + */ +int mbedtls_oid_get_pkcs12_pbe_alg( const mbedtls_asn1_buf *oid, mbedtls_md_type_t *md_alg, + mbedtls_cipher_type_t *cipher_alg ); +#endif /* MBEDTLS_PKCS12_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* oid.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/padlock.h b/openharmony/armeabi-v7a/include/mbedtls/padlock.h new file mode 100644 index 00000000..624d02df --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/padlock.h @@ -0,0 +1,125 @@ +/** + * \file padlock.h + * + * \brief VIA PadLock ACE for HW encryption/decryption supported by some + * processors + * + * \warning These functions are only for internal use by other library + * functions; you must not call them directly. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_PADLOCK_H +#define MBEDTLS_PADLOCK_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/aes.h" + +/** Input data should be aligned. */ +#define MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED -0x0030 + +#if defined(__has_feature) +#if __has_feature(address_sanitizer) +#define MBEDTLS_HAVE_ASAN +#endif +#endif + +/* Some versions of ASan result in errors about not enough registers */ +#if defined(MBEDTLS_HAVE_ASM) && defined(__GNUC__) && defined(__i386__) && \ + !defined(MBEDTLS_HAVE_ASAN) + +#ifndef MBEDTLS_HAVE_X86 +#define MBEDTLS_HAVE_X86 +#endif + +#include + +#define MBEDTLS_PADLOCK_RNG 0x000C +#define MBEDTLS_PADLOCK_ACE 0x00C0 +#define MBEDTLS_PADLOCK_PHE 0x0C00 +#define MBEDTLS_PADLOCK_PMM 0x3000 + +#define MBEDTLS_PADLOCK_ALIGN16(x) (uint32_t *) (16 + ((int32_t) (x) & ~15)) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Internal PadLock detection routine + * + * \note This function is only for internal use by other library + * functions; you must not call it directly. + * + * \param feature The feature to detect + * + * \return non-zero if CPU has support for the feature, 0 otherwise + */ +int mbedtls_padlock_has_support( int feature ); + +/** + * \brief Internal PadLock AES-ECB block en(de)cryption + * + * \note This function is only for internal use by other library + * functions; you must not call it directly. + * + * \param ctx AES context + * \param mode MBEDTLS_AES_ENCRYPT or MBEDTLS_AES_DECRYPT + * \param input 16-byte input block + * \param output 16-byte output block + * + * \return 0 if success, 1 if operation failed + */ +int mbedtls_padlock_xcryptecb( mbedtls_aes_context *ctx, + int mode, + const unsigned char input[16], + unsigned char output[16] ); + +/** + * \brief Internal PadLock AES-CBC buffer en(de)cryption + * + * \note This function is only for internal use by other library + * functions; you must not call it directly. + * + * \param ctx AES context + * \param mode MBEDTLS_AES_ENCRYPT or MBEDTLS_AES_DECRYPT + * \param length length of the input data + * \param iv initialization vector (updated after use) + * \param input buffer holding the input data + * \param output buffer holding the output data + * + * \return 0 if success, 1 if operation failed + */ +int mbedtls_padlock_xcryptcbc( mbedtls_aes_context *ctx, + int mode, + size_t length, + unsigned char iv[16], + const unsigned char *input, + unsigned char *output ); + +#ifdef __cplusplus +} +#endif + +#endif /* HAVE_X86 */ + +#endif /* padlock.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/pem.h b/openharmony/armeabi-v7a/include/mbedtls/pem.h new file mode 100644 index 00000000..daa71c88 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/pem.h @@ -0,0 +1,153 @@ +/** + * \file pem.h + * + * \brief Privacy Enhanced Mail (PEM) decoding + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_PEM_H +#define MBEDTLS_PEM_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +/** + * \name PEM Error codes + * These error codes are returned in case of errors reading the + * PEM data. + * \{ + */ +/** No PEM header or footer found. */ +#define MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT -0x1080 +/** PEM string is not as expected. */ +#define MBEDTLS_ERR_PEM_INVALID_DATA -0x1100 +/** Failed to allocate memory. */ +#define MBEDTLS_ERR_PEM_ALLOC_FAILED -0x1180 +/** RSA IV is not in hex-format. */ +#define MBEDTLS_ERR_PEM_INVALID_ENC_IV -0x1200 +/** Unsupported key encryption algorithm. */ +#define MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG -0x1280 +/** Private key password can't be empty. */ +#define MBEDTLS_ERR_PEM_PASSWORD_REQUIRED -0x1300 +/** Given private key password does not allow for correct decryption. */ +#define MBEDTLS_ERR_PEM_PASSWORD_MISMATCH -0x1380 +/** Unavailable feature, e.g. hashing/encryption combination. */ +#define MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE -0x1400 +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_PEM_BAD_INPUT_DATA -0x1480 +/** \} name PEM Error codes */ + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(MBEDTLS_PEM_PARSE_C) +/** + * \brief PEM context structure + */ +typedef struct mbedtls_pem_context +{ + unsigned char *buf; /*!< buffer for decoded data */ + size_t buflen; /*!< length of the buffer */ + unsigned char *info; /*!< buffer for extra header information */ +} +mbedtls_pem_context; + +/** + * \brief PEM context setup + * + * \param ctx context to be initialized + */ +void mbedtls_pem_init( mbedtls_pem_context *ctx ); + +/** + * \brief Read a buffer for PEM information and store the resulting + * data into the specified context buffers. + * + * \param ctx context to use + * \param header header string to seek and expect + * \param footer footer string to seek and expect + * \param data source data to look in (must be nul-terminated) + * \param pwd password for decryption (can be NULL) + * \param pwdlen length of password + * \param use_len destination for total length used (set after header is + * correctly read, so unless you get + * MBEDTLS_ERR_PEM_BAD_INPUT_DATA or + * MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT, use_len is + * the length to skip) + * + * \note Attempts to check password correctness by verifying if + * the decrypted text starts with an ASN.1 sequence of + * appropriate length + * + * \return 0 on success, or a specific PEM error code + */ +int mbedtls_pem_read_buffer( mbedtls_pem_context *ctx, const char *header, const char *footer, + const unsigned char *data, + const unsigned char *pwd, + size_t pwdlen, size_t *use_len ); + +/** + * \brief PEM context memory freeing + * + * \param ctx context to be freed + */ +void mbedtls_pem_free( mbedtls_pem_context *ctx ); +#endif /* MBEDTLS_PEM_PARSE_C */ + +#if defined(MBEDTLS_PEM_WRITE_C) +/** + * \brief Write a buffer of PEM information from a DER encoded + * buffer. + * + * \param header The header string to write. + * \param footer The footer string to write. + * \param der_data The DER data to encode. + * \param der_len The length of the DER data \p der_data in Bytes. + * \param buf The buffer to write to. + * \param buf_len The length of the output buffer \p buf in Bytes. + * \param olen The address at which to store the total length written + * or required (if \p buf_len is not enough). + * + * \note You may pass \c NULL for \p buf and \c 0 for \p buf_len + * to request the length of the resulting PEM buffer in + * `*olen`. + * + * \note This function may be called with overlapping \p der_data + * and \p buf buffers. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL if \p buf isn't large + * enough to hold the PEM buffer. In this case, `*olen` holds + * the required minimum size of \p buf. + * \return Another PEM or BASE64 error code on other kinds of failure. + */ +int mbedtls_pem_write_buffer( const char *header, const char *footer, + const unsigned char *der_data, size_t der_len, + unsigned char *buf, size_t buf_len, size_t *olen ); +#endif /* MBEDTLS_PEM_WRITE_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* pem.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/pk.h b/openharmony/armeabi-v7a/include/mbedtls/pk.h new file mode 100644 index 00000000..c9a13f48 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/pk.h @@ -0,0 +1,918 @@ +/** + * \file pk.h + * + * \brief Public Key abstraction layer + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_PK_H +#define MBEDTLS_PK_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/md.h" + +#if defined(MBEDTLS_RSA_C) +#include "mbedtls/rsa.h" +#endif + +#if defined(MBEDTLS_ECP_C) +#include "mbedtls/ecp.h" +#endif + +#if defined(MBEDTLS_ECDSA_C) +#include "mbedtls/ecdsa.h" +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#include "psa/crypto.h" +#endif + +#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \ + !defined(inline) && !defined(__cplusplus) +#define inline __inline +#endif + +/** Memory allocation failed. */ +#define MBEDTLS_ERR_PK_ALLOC_FAILED -0x3F80 +/** Type mismatch, eg attempt to encrypt with an ECDSA key */ +#define MBEDTLS_ERR_PK_TYPE_MISMATCH -0x3F00 +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_PK_BAD_INPUT_DATA -0x3E80 +/** Read/write of file failed. */ +#define MBEDTLS_ERR_PK_FILE_IO_ERROR -0x3E00 +/** Unsupported key version */ +#define MBEDTLS_ERR_PK_KEY_INVALID_VERSION -0x3D80 +/** Invalid key tag or value. */ +#define MBEDTLS_ERR_PK_KEY_INVALID_FORMAT -0x3D00 +/** Key algorithm is unsupported (only RSA and EC are supported). */ +#define MBEDTLS_ERR_PK_UNKNOWN_PK_ALG -0x3C80 +/** Private key password can't be empty. */ +#define MBEDTLS_ERR_PK_PASSWORD_REQUIRED -0x3C00 +/** Given private key password does not allow for correct decryption. */ +#define MBEDTLS_ERR_PK_PASSWORD_MISMATCH -0x3B80 +/** The pubkey tag or value is invalid (only RSA and EC are supported). */ +#define MBEDTLS_ERR_PK_INVALID_PUBKEY -0x3B00 +/** The algorithm tag or value is invalid. */ +#define MBEDTLS_ERR_PK_INVALID_ALG -0x3A80 +/** Elliptic curve is unsupported (only NIST curves are supported). */ +#define MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE -0x3A00 +/** Unavailable feature, e.g. RSA disabled for RSA key. */ +#define MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE -0x3980 +/** The buffer contains a valid signature followed by more data. */ +#define MBEDTLS_ERR_PK_SIG_LEN_MISMATCH -0x3900 + +/* MBEDTLS_ERR_PK_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** PK hardware accelerator failed. */ +#define MBEDTLS_ERR_PK_HW_ACCEL_FAILED -0x3880 + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Public key types + */ +typedef enum { + MBEDTLS_PK_NONE=0, + MBEDTLS_PK_RSA, + MBEDTLS_PK_ECKEY, + MBEDTLS_PK_ECKEY_DH, + MBEDTLS_PK_ECDSA, + MBEDTLS_PK_RSA_ALT, + MBEDTLS_PK_RSASSA_PSS, + MBEDTLS_PK_OPAQUE, +} mbedtls_pk_type_t; + +/** + * \brief Options for RSASSA-PSS signature verification. + * See \c mbedtls_rsa_rsassa_pss_verify_ext() + */ +typedef struct mbedtls_pk_rsassa_pss_options +{ + mbedtls_md_type_t mgf1_hash_id; + int expected_salt_len; + +} mbedtls_pk_rsassa_pss_options; + +/** + * \brief Maximum size of a signature made by mbedtls_pk_sign(). + */ +/* We need to set MBEDTLS_PK_SIGNATURE_MAX_SIZE to the maximum signature + * size among the supported signature types. Do it by starting at 0, + * then incrementally increasing to be large enough for each supported + * signature mechanism. + * + * The resulting value can be 0, for example if MBEDTLS_ECDH_C is enabled + * (which allows the pk module to be included) but neither MBEDTLS_ECDSA_C + * nor MBEDTLS_RSA_C nor any opaque signature mechanism (PSA or RSA_ALT). + */ +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE 0 + +#if ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_PK_RSA_ALT_SUPPORT) ) && \ + MBEDTLS_MPI_MAX_SIZE > MBEDTLS_PK_SIGNATURE_MAX_SIZE +/* For RSA, the signature can be as large as the bignum module allows. + * For RSA_ALT, the signature size is not necessarily tied to what the + * bignum module can do, but in the absence of any specific setting, + * we use that (rsa_alt_sign_wrap in pk_wrap will check). */ +#undef MBEDTLS_PK_SIGNATURE_MAX_SIZE +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE MBEDTLS_MPI_MAX_SIZE +#endif + +#if defined(MBEDTLS_ECDSA_C) && \ + MBEDTLS_ECDSA_MAX_LEN > MBEDTLS_PK_SIGNATURE_MAX_SIZE +/* For ECDSA, the ecdsa module exports a constant for the maximum + * signature size. */ +#undef MBEDTLS_PK_SIGNATURE_MAX_SIZE +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE MBEDTLS_ECDSA_MAX_LEN +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#if PSA_SIGNATURE_MAX_SIZE > MBEDTLS_PK_SIGNATURE_MAX_SIZE +/* PSA_SIGNATURE_MAX_SIZE is the maximum size of a signature made + * through the PSA API in the PSA representation. */ +#undef MBEDTLS_PK_SIGNATURE_MAX_SIZE +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE PSA_SIGNATURE_MAX_SIZE +#endif + +#if PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE + 11 > MBEDTLS_PK_SIGNATURE_MAX_SIZE +/* The Mbed TLS representation is different for ECDSA signatures: + * PSA uses the raw concatenation of r and s, + * whereas Mbed TLS uses the ASN.1 representation (SEQUENCE of two INTEGERs). + * Add the overhead of ASN.1: up to (1+2) + 2 * (1+2+1) for the + * types, lengths (represented by up to 2 bytes), and potential leading + * zeros of the INTEGERs and the SEQUENCE. */ +#undef MBEDTLS_PK_SIGNATURE_MAX_SIZE +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE ( PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE + 11 ) +#endif +#endif /* defined(MBEDTLS_USE_PSA_CRYPTO) */ + +/** + * \brief Types for interfacing with the debug module + */ +typedef enum +{ + MBEDTLS_PK_DEBUG_NONE = 0, + MBEDTLS_PK_DEBUG_MPI, + MBEDTLS_PK_DEBUG_ECP, +} mbedtls_pk_debug_type; + +/** + * \brief Item to send to the debug module + */ +typedef struct mbedtls_pk_debug_item +{ + mbedtls_pk_debug_type type; + const char *name; + void *value; +} mbedtls_pk_debug_item; + +/** Maximum number of item send for debugging, plus 1 */ +#define MBEDTLS_PK_DEBUG_MAX_ITEMS 3 + +/** + * \brief Public key information and operations + */ +typedef struct mbedtls_pk_info_t mbedtls_pk_info_t; + +/** + * \brief Public key container + */ +typedef struct mbedtls_pk_context +{ + const mbedtls_pk_info_t * pk_info; /**< Public key information */ + void * pk_ctx; /**< Underlying public key context */ +} mbedtls_pk_context; + +#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Context for resuming operations + */ +typedef struct +{ + const mbedtls_pk_info_t * pk_info; /**< Public key information */ + void * rs_ctx; /**< Underlying restart context */ +} mbedtls_pk_restart_ctx; +#else /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ +/* Now we can declare functions that take a pointer to that */ +typedef void mbedtls_pk_restart_ctx; +#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ + +#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT) +/** + * \brief Types for RSA-alt abstraction + */ +typedef int (*mbedtls_pk_rsa_alt_decrypt_func)( void *ctx, int mode, size_t *olen, + const unsigned char *input, unsigned char *output, + size_t output_max_len ); +typedef int (*mbedtls_pk_rsa_alt_sign_func)( void *ctx, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, + int mode, mbedtls_md_type_t md_alg, unsigned int hashlen, + const unsigned char *hash, unsigned char *sig ); +typedef size_t (*mbedtls_pk_rsa_alt_key_len_func)( void *ctx ); +#endif /* MBEDTLS_PK_RSA_ALT_SUPPORT */ + +/** + * \brief Return information associated with the given PK type + * + * \param pk_type PK type to search for. + * + * \return The PK info associated with the type or NULL if not found. + */ +const mbedtls_pk_info_t *mbedtls_pk_info_from_type( mbedtls_pk_type_t pk_type ); + +/** + * \brief Initialize a #mbedtls_pk_context (as NONE). + * + * \param ctx The context to initialize. + * This must not be \c NULL. + */ +void mbedtls_pk_init( mbedtls_pk_context *ctx ); + +/** + * \brief Free the components of a #mbedtls_pk_context. + * + * \param ctx The context to clear. It must have been initialized. + * If this is \c NULL, this function does nothing. + * + * \note For contexts that have been set up with + * mbedtls_pk_setup_opaque(), this does not free the underlying + * PSA key and you still need to call psa_destroy_key() + * independently if you want to destroy that key. + */ +void mbedtls_pk_free( mbedtls_pk_context *ctx ); + +#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Initialize a restart context + * + * \param ctx The context to initialize. + * This must not be \c NULL. + */ +void mbedtls_pk_restart_init( mbedtls_pk_restart_ctx *ctx ); + +/** + * \brief Free the components of a restart context + * + * \param ctx The context to clear. It must have been initialized. + * If this is \c NULL, this function does nothing. + */ +void mbedtls_pk_restart_free( mbedtls_pk_restart_ctx *ctx ); +#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ + +/** + * \brief Initialize a PK context with the information given + * and allocates the type-specific PK subcontext. + * + * \param ctx Context to initialize. It must not have been set + * up yet (type #MBEDTLS_PK_NONE). + * \param info Information to use + * + * \return 0 on success, + * MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input, + * MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure. + * + * \note For contexts holding an RSA-alt key, use + * \c mbedtls_pk_setup_rsa_alt() instead. + */ +int mbedtls_pk_setup( mbedtls_pk_context *ctx, const mbedtls_pk_info_t *info ); + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +/** + * \brief Initialize a PK context to wrap a PSA key. + * + * \note This function replaces mbedtls_pk_setup() for contexts + * that wrap a (possibly opaque) PSA key instead of + * storing and manipulating the key material directly. + * + * \param ctx The context to initialize. It must be empty (type NONE). + * \param key The PSA key to wrap, which must hold an ECC key pair + * (see notes below). + * + * \note The wrapped key must remain valid as long as the + * wrapping PK context is in use, that is at least between + * the point this function is called and the point + * mbedtls_pk_free() is called on this context. The wrapped + * key might then be independently used or destroyed. + * + * \note This function is currently only available for ECC key + * pairs (that is, ECC keys containing private key material). + * Support for other key types may be added later. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input + * (context already used, invalid key identifier). + * \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the key is not an + * ECC key pair. + * \return #MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure. + */ +int mbedtls_pk_setup_opaque( mbedtls_pk_context *ctx, + const psa_key_id_t key ); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT) +/** + * \brief Initialize an RSA-alt context + * + * \param ctx Context to initialize. It must not have been set + * up yet (type #MBEDTLS_PK_NONE). + * \param key RSA key pointer + * \param decrypt_func Decryption function + * \param sign_func Signing function + * \param key_len_func Function returning key length in bytes + * + * \return 0 on success, or MBEDTLS_ERR_PK_BAD_INPUT_DATA if the + * context wasn't already initialized as RSA_ALT. + * + * \note This function replaces \c mbedtls_pk_setup() for RSA-alt. + */ +int mbedtls_pk_setup_rsa_alt( mbedtls_pk_context *ctx, void * key, + mbedtls_pk_rsa_alt_decrypt_func decrypt_func, + mbedtls_pk_rsa_alt_sign_func sign_func, + mbedtls_pk_rsa_alt_key_len_func key_len_func ); +#endif /* MBEDTLS_PK_RSA_ALT_SUPPORT */ + +/** + * \brief Get the size in bits of the underlying key + * + * \param ctx The context to query. It must have been initialized. + * + * \return Key size in bits, or 0 on error + */ +size_t mbedtls_pk_get_bitlen( const mbedtls_pk_context *ctx ); + +/** + * \brief Get the length in bytes of the underlying key + * + * \param ctx The context to query. It must have been initialized. + * + * \return Key length in bytes, or 0 on error + */ +static inline size_t mbedtls_pk_get_len( const mbedtls_pk_context *ctx ) +{ + return( ( mbedtls_pk_get_bitlen( ctx ) + 7 ) / 8 ); +} + +/** + * \brief Tell if a context can do the operation given by type + * + * \param ctx The context to query. It must have been initialized. + * \param type The desired type. + * + * \return 1 if the context can do operations on the given type. + * \return 0 if the context cannot do the operations on the given + * type. This is always the case for a context that has + * been initialized but not set up, or that has been + * cleared with mbedtls_pk_free(). + */ +int mbedtls_pk_can_do( const mbedtls_pk_context *ctx, mbedtls_pk_type_t type ); + +/** + * \brief Verify signature (including padding if relevant). + * + * \param ctx The PK context to use. It must have been set up. + * \param md_alg Hash algorithm used (see notes) + * \param hash Hash of the message to sign + * \param hash_len Hash length or 0 (see notes) + * \param sig Signature to verify + * \param sig_len Signature length + * + * \return 0 on success (signature is valid), + * #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid + * signature in sig but its length is less than \p siglen, + * or a specific error code. + * + * \note For RSA keys, the default padding type is PKCS#1 v1.5. + * Use \c mbedtls_pk_verify_ext( MBEDTLS_PK_RSASSA_PSS, ... ) + * to verify RSASSA_PSS signatures. + * + * \note If hash_len is 0, then the length associated with md_alg + * is used instead, or an error returned if it is invalid. + * + * \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0 + */ +int mbedtls_pk_verify( mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + const unsigned char *sig, size_t sig_len ); + +/** + * \brief Restartable version of \c mbedtls_pk_verify() + * + * \note Performs the same job as \c mbedtls_pk_verify(), but can + * return early and restart according to the limit set with + * \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC + * operations. For RSA, same as \c mbedtls_pk_verify(). + * + * \param ctx The PK context to use. It must have been set up. + * \param md_alg Hash algorithm used (see notes) + * \param hash Hash of the message to sign + * \param hash_len Hash length or 0 (see notes) + * \param sig Signature to verify + * \param sig_len Signature length + * \param rs_ctx Restart context (NULL to disable restart) + * + * \return See \c mbedtls_pk_verify(), or + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + */ +int mbedtls_pk_verify_restartable( mbedtls_pk_context *ctx, + mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + const unsigned char *sig, size_t sig_len, + mbedtls_pk_restart_ctx *rs_ctx ); + +/** + * \brief Verify signature, with options. + * (Includes verification of the padding depending on type.) + * + * \param type Signature type (inc. possible padding type) to verify + * \param options Pointer to type-specific options, or NULL + * \param ctx The PK context to use. It must have been set up. + * \param md_alg Hash algorithm used (see notes) + * \param hash Hash of the message to sign + * \param hash_len Hash length or 0 (see notes) + * \param sig Signature to verify + * \param sig_len Signature length + * + * \return 0 on success (signature is valid), + * #MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can't be + * used for this type of signatures, + * #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid + * signature in sig but its length is less than \p siglen, + * or a specific error code. + * + * \note If hash_len is 0, then the length associated with md_alg + * is used instead, or an error returned if it is invalid. + * + * \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0 + * + * \note If type is MBEDTLS_PK_RSASSA_PSS, then options must point + * to a mbedtls_pk_rsassa_pss_options structure, + * otherwise it must be NULL. + */ +int mbedtls_pk_verify_ext( mbedtls_pk_type_t type, const void *options, + mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + const unsigned char *sig, size_t sig_len ); + +/** + * \brief Make signature, including padding if relevant. + * + * \param ctx The PK context to use. It must have been set up + * with a private key. + * \param md_alg Hash algorithm used (see notes) + * \param hash Hash of the message to sign + * \param hash_len Hash length or 0 (see notes) + * \param sig Place to write the signature. + * It must have enough room for the signature. + * #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + * You may use a smaller buffer if it is large enough + * given the key type. + * \param sig_len On successful return, + * the number of bytes written to \p sig. + * \param f_rng RNG function + * \param p_rng RNG parameter + * + * \return 0 on success, or a specific error code. + * + * \note For RSA keys, the default padding type is PKCS#1 v1.5. + * There is no interface in the PK module to make RSASSA-PSS + * signatures yet. + * + * \note If hash_len is 0, then the length associated with md_alg + * is used instead, or an error returned if it is invalid. + * + * \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. + * For ECDSA, md_alg may never be MBEDTLS_MD_NONE. + */ +int mbedtls_pk_sign( mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + unsigned char *sig, size_t *sig_len, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ); + +/** + * \brief Restartable version of \c mbedtls_pk_sign() + * + * \note Performs the same job as \c mbedtls_pk_sign(), but can + * return early and restart according to the limit set with + * \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC + * operations. For RSA, same as \c mbedtls_pk_sign(). + * + * \param ctx The PK context to use. It must have been set up + * with a private key. + * \param md_alg Hash algorithm used (see notes for mbedtls_pk_sign()) + * \param hash Hash of the message to sign + * \param hash_len Hash length or 0 (see notes for mbedtls_pk_sign()) + * \param sig Place to write the signature. + * It must have enough room for the signature. + * #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + * You may use a smaller buffer if it is large enough + * given the key type. + * \param sig_len On successful return, + * the number of bytes written to \p sig. + * \param f_rng RNG function + * \param p_rng RNG parameter + * \param rs_ctx Restart context (NULL to disable restart) + * + * \return See \c mbedtls_pk_sign(). + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + */ +int mbedtls_pk_sign_restartable( mbedtls_pk_context *ctx, + mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + unsigned char *sig, size_t *sig_len, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, + mbedtls_pk_restart_ctx *rs_ctx ); + +/** + * \brief Decrypt message (including padding if relevant). + * + * \param ctx The PK context to use. It must have been set up + * with a private key. + * \param input Input to decrypt + * \param ilen Input size + * \param output Decrypted output + * \param olen Decrypted message length + * \param osize Size of the output buffer + * \param f_rng RNG function + * \param p_rng RNG parameter + * + * \note For RSA keys, the default padding type is PKCS#1 v1.5. + * + * \return 0 on success, or a specific error code. + */ +int mbedtls_pk_decrypt( mbedtls_pk_context *ctx, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen, size_t osize, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ); + +/** + * \brief Encrypt message (including padding if relevant). + * + * \param ctx The PK context to use. It must have been set up. + * \param input Message to encrypt + * \param ilen Message size + * \param output Encrypted output + * \param olen Encrypted output length + * \param osize Size of the output buffer + * \param f_rng RNG function + * \param p_rng RNG parameter + * + * \note For RSA keys, the default padding type is PKCS#1 v1.5. + * + * \return 0 on success, or a specific error code. + */ +int mbedtls_pk_encrypt( mbedtls_pk_context *ctx, + const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen, size_t osize, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ); + +/** + * \brief Check if a public-private pair of keys matches. + * + * \param pub Context holding a public key. + * \param prv Context holding a private (and public) key. + * + * \return \c 0 on success (keys were checked and match each other). + * \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the keys could not + * be checked - in that case they may or may not match. + * \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA if a context is invalid. + * \return Another non-zero value if the keys do not match. + */ +int mbedtls_pk_check_pair( const mbedtls_pk_context *pub, const mbedtls_pk_context *prv ); + +/** + * \brief Export debug information + * + * \param ctx The PK context to use. It must have been initialized. + * \param items Place to write debug items + * + * \return 0 on success or MBEDTLS_ERR_PK_BAD_INPUT_DATA + */ +int mbedtls_pk_debug( const mbedtls_pk_context *ctx, mbedtls_pk_debug_item *items ); + +/** + * \brief Access the type name + * + * \param ctx The PK context to use. It must have been initialized. + * + * \return Type name on success, or "invalid PK" + */ +const char * mbedtls_pk_get_name( const mbedtls_pk_context *ctx ); + +/** + * \brief Get the key type + * + * \param ctx The PK context to use. It must have been initialized. + * + * \return Type on success. + * \return #MBEDTLS_PK_NONE for a context that has not been set up. + */ +mbedtls_pk_type_t mbedtls_pk_get_type( const mbedtls_pk_context *ctx ); + +#if defined(MBEDTLS_RSA_C) +/** + * Quick access to an RSA context inside a PK context. + * + * \warning This function can only be used when the type of the context, as + * returned by mbedtls_pk_get_type(), is #MBEDTLS_PK_RSA. + * Ensuring that is the caller's responsibility. + * Alternatively, you can check whether this function returns NULL. + * + * \return The internal RSA context held by the PK context, or NULL. + */ +static inline mbedtls_rsa_context *mbedtls_pk_rsa( const mbedtls_pk_context pk ) +{ + switch( mbedtls_pk_get_type( &pk ) ) + { + case MBEDTLS_PK_RSA: + return( (mbedtls_rsa_context *) (pk).pk_ctx ); + default: + return( NULL ); + } +} +#endif /* MBEDTLS_RSA_C */ + +#if defined(MBEDTLS_ECP_C) +/** + * Quick access to an EC context inside a PK context. + * + * \warning This function can only be used when the type of the context, as + * returned by mbedtls_pk_get_type(), is #MBEDTLS_PK_ECKEY, + * #MBEDTLS_PK_ECKEY_DH, or #MBEDTLS_PK_ECDSA. + * Ensuring that is the caller's responsibility. + * Alternatively, you can check whether this function returns NULL. + * + * \return The internal EC context held by the PK context, or NULL. + */ +static inline mbedtls_ecp_keypair *mbedtls_pk_ec( const mbedtls_pk_context pk ) +{ + switch( mbedtls_pk_get_type( &pk ) ) + { + case MBEDTLS_PK_ECKEY: + case MBEDTLS_PK_ECKEY_DH: + case MBEDTLS_PK_ECDSA: + return( (mbedtls_ecp_keypair *) (pk).pk_ctx ); + default: + return( NULL ); + } +} +#endif /* MBEDTLS_ECP_C */ + +#if defined(MBEDTLS_PK_PARSE_C) +/** \ingroup pk_module */ +/** + * \brief Parse a private key in PEM or DER format + * + * \param ctx The PK context to fill. It must have been initialized + * but not set up. + * \param key Input buffer to parse. + * The buffer must contain the input exactly, with no + * extra trailing material. For PEM, the buffer must + * contain a null-terminated string. + * \param keylen Size of \b key in bytes. + * For PEM data, this includes the terminating null byte, + * so \p keylen must be equal to `strlen(key) + 1`. + * \param pwd Optional password for decryption. + * Pass \c NULL if expecting a non-encrypted key. + * Pass a string of \p pwdlen bytes if expecting an encrypted + * key; a non-encrypted key will also be accepted. + * The empty password is not supported. + * \param pwdlen Size of the password in bytes. + * Ignored if \p pwd is \c NULL. + * + * \note On entry, ctx must be empty, either freshly initialised + * with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + * specific key type, check the result with mbedtls_pk_can_do(). + * + * \note The key is also checked for correctness. + * + * \return 0 if successful, or a specific PK or PEM error code + */ +int mbedtls_pk_parse_key( mbedtls_pk_context *ctx, + const unsigned char *key, size_t keylen, + const unsigned char *pwd, size_t pwdlen ); + +/** \ingroup pk_module */ +/** + * \brief Parse a public key in PEM or DER format + * + * \param ctx The PK context to fill. It must have been initialized + * but not set up. + * \param key Input buffer to parse. + * The buffer must contain the input exactly, with no + * extra trailing material. For PEM, the buffer must + * contain a null-terminated string. + * \param keylen Size of \b key in bytes. + * For PEM data, this includes the terminating null byte, + * so \p keylen must be equal to `strlen(key) + 1`. + * + * \note On entry, ctx must be empty, either freshly initialised + * with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + * specific key type, check the result with mbedtls_pk_can_do(). + * + * \note The key is also checked for correctness. + * + * \return 0 if successful, or a specific PK or PEM error code + */ +int mbedtls_pk_parse_public_key( mbedtls_pk_context *ctx, + const unsigned char *key, size_t keylen ); + +#if defined(MBEDTLS_FS_IO) +/** \ingroup pk_module */ +/** + * \brief Load and parse a private key + * + * \param ctx The PK context to fill. It must have been initialized + * but not set up. + * \param path filename to read the private key from + * \param password Optional password to decrypt the file. + * Pass \c NULL if expecting a non-encrypted key. + * Pass a null-terminated string if expecting an encrypted + * key; a non-encrypted key will also be accepted. + * The empty password is not supported. + * + * \note On entry, ctx must be empty, either freshly initialised + * with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + * specific key type, check the result with mbedtls_pk_can_do(). + * + * \note The key is also checked for correctness. + * + * \return 0 if successful, or a specific PK or PEM error code + */ +int mbedtls_pk_parse_keyfile( mbedtls_pk_context *ctx, + const char *path, const char *password ); + +/** \ingroup pk_module */ +/** + * \brief Load and parse a public key + * + * \param ctx The PK context to fill. It must have been initialized + * but not set up. + * \param path filename to read the public key from + * + * \note On entry, ctx must be empty, either freshly initialised + * with mbedtls_pk_init() or reset with mbedtls_pk_free(). If + * you need a specific key type, check the result with + * mbedtls_pk_can_do(). + * + * \note The key is also checked for correctness. + * + * \return 0 if successful, or a specific PK or PEM error code + */ +int mbedtls_pk_parse_public_keyfile( mbedtls_pk_context *ctx, const char *path ); +#endif /* MBEDTLS_FS_IO */ +#endif /* MBEDTLS_PK_PARSE_C */ + +#if defined(MBEDTLS_PK_WRITE_C) +/** + * \brief Write a private key to a PKCS#1 or SEC1 DER structure + * Note: data is written at the end of the buffer! Use the + * return value to determine where you should start + * using the buffer + * + * \param ctx PK context which must contain a valid private key. + * \param buf buffer to write to + * \param size size of the buffer + * + * \return length of data written if successful, or a specific + * error code + */ +int mbedtls_pk_write_key_der( mbedtls_pk_context *ctx, unsigned char *buf, size_t size ); + +/** + * \brief Write a public key to a SubjectPublicKeyInfo DER structure + * Note: data is written at the end of the buffer! Use the + * return value to determine where you should start + * using the buffer + * + * \param ctx PK context which must contain a valid public or private key. + * \param buf buffer to write to + * \param size size of the buffer + * + * \return length of data written if successful, or a specific + * error code + */ +int mbedtls_pk_write_pubkey_der( mbedtls_pk_context *ctx, unsigned char *buf, size_t size ); + +#if defined(MBEDTLS_PEM_WRITE_C) +/** + * \brief Write a public key to a PEM string + * + * \param ctx PK context which must contain a valid public or private key. + * \param buf Buffer to write to. The output includes a + * terminating null byte. + * \param size Size of the buffer in bytes. + * + * \return 0 if successful, or a specific error code + */ +int mbedtls_pk_write_pubkey_pem( mbedtls_pk_context *ctx, unsigned char *buf, size_t size ); + +/** + * \brief Write a private key to a PKCS#1 or SEC1 PEM string + * + * \param ctx PK context which must contain a valid private key. + * \param buf Buffer to write to. The output includes a + * terminating null byte. + * \param size Size of the buffer in bytes. + * + * \return 0 if successful, or a specific error code + */ +int mbedtls_pk_write_key_pem( mbedtls_pk_context *ctx, unsigned char *buf, size_t size ); +#endif /* MBEDTLS_PEM_WRITE_C */ +#endif /* MBEDTLS_PK_WRITE_C */ + +/* + * WARNING: Low-level functions. You probably do not want to use these unless + * you are certain you do ;) + */ + +#if defined(MBEDTLS_PK_PARSE_C) +/** + * \brief Parse a SubjectPublicKeyInfo DER structure + * + * \param p the position in the ASN.1 data + * \param end end of the buffer + * \param pk The PK context to fill. It must have been initialized + * but not set up. + * + * \return 0 if successful, or a specific PK error code + */ +int mbedtls_pk_parse_subpubkey( unsigned char **p, const unsigned char *end, + mbedtls_pk_context *pk ); +#endif /* MBEDTLS_PK_PARSE_C */ + +#if defined(MBEDTLS_PK_WRITE_C) +/** + * \brief Write a subjectPublicKey to ASN.1 data + * Note: function works backwards in data buffer + * + * \param p reference to current position pointer + * \param start start of the buffer (for bounds-checking) + * \param key PK context which must contain a valid public or private key. + * + * \return the length written or a negative error code + */ +int mbedtls_pk_write_pubkey( unsigned char **p, unsigned char *start, + const mbedtls_pk_context *key ); +#endif /* MBEDTLS_PK_WRITE_C */ + +/* + * Internal module functions. You probably do not want to use these unless you + * know you do. + */ +#if defined(MBEDTLS_FS_IO) +int mbedtls_pk_load_file( const char *path, unsigned char **buf, size_t *n ); +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +/** + * \brief Turn an EC key into an opaque one. + * + * \warning This is a temporary utility function for tests. It might + * change or be removed at any time without notice. + * + * \note Only ECDSA keys are supported so far. Signing with the + * specified hash is the only allowed use of that key. + * + * \param pk Input: the EC key to import to a PSA key. + * Output: a PK context wrapping that PSA key. + * \param key Output: a PSA key identifier. + * It's the caller's responsibility to call + * psa_destroy_key() on that key identifier after calling + * mbedtls_pk_free() on the PK context. + * \param hash_alg The hash algorithm to allow for use with that key. + * + * \return \c 0 if successful. + * \return An Mbed TLS error code otherwise. + */ +int mbedtls_pk_wrap_as_opaque( mbedtls_pk_context *pk, + psa_key_id_t *key, + psa_algorithm_t hash_alg ); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_PK_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/pk_internal.h b/openharmony/armeabi-v7a/include/mbedtls/pk_internal.h new file mode 100644 index 00000000..47f77677 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/pk_internal.h @@ -0,0 +1,140 @@ +/** + * \file pk_internal.h + * + * \brief Public Key abstraction layer: wrapper functions + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_PK_WRAP_H +#define MBEDTLS_PK_WRAP_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/pk.h" + +struct mbedtls_pk_info_t +{ + /** Public key type */ + mbedtls_pk_type_t type; + + /** Type name */ + const char *name; + + /** Get key size in bits */ + size_t (*get_bitlen)( const void * ); + + /** Tell if the context implements this type (e.g. ECKEY can do ECDSA) */ + int (*can_do)( mbedtls_pk_type_t type ); + + /** Verify signature */ + int (*verify_func)( void *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + const unsigned char *sig, size_t sig_len ); + + /** Make signature */ + int (*sign_func)( void *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + unsigned char *sig, size_t *sig_len, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) + /** Verify signature (restartable) */ + int (*verify_rs_func)( void *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + const unsigned char *sig, size_t sig_len, + void *rs_ctx ); + + /** Make signature (restartable) */ + int (*sign_rs_func)( void *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + unsigned char *sig, size_t *sig_len, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, void *rs_ctx ); +#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ + + /** Decrypt message */ + int (*decrypt_func)( void *ctx, const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen, size_t osize, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + + /** Encrypt message */ + int (*encrypt_func)( void *ctx, const unsigned char *input, size_t ilen, + unsigned char *output, size_t *olen, size_t osize, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + + /** Check public-private key pair */ + int (*check_pair_func)( const void *pub, const void *prv ); + + /** Allocate a new context */ + void * (*ctx_alloc_func)( void ); + + /** Free the given context */ + void (*ctx_free_func)( void *ctx ); + +#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) + /** Allocate the restart context */ + void * (*rs_alloc_func)( void ); + + /** Free the restart context */ + void (*rs_free_func)( void *rs_ctx ); +#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ + + /** Interface with the debug module */ + void (*debug_func)( const void *ctx, mbedtls_pk_debug_item *items ); + +}; +#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT) +/* Container for RSA-alt */ +typedef struct +{ + void *key; + mbedtls_pk_rsa_alt_decrypt_func decrypt_func; + mbedtls_pk_rsa_alt_sign_func sign_func; + mbedtls_pk_rsa_alt_key_len_func key_len_func; +} mbedtls_rsa_alt_context; +#endif + +#if defined(MBEDTLS_RSA_C) +extern const mbedtls_pk_info_t mbedtls_rsa_info; +#endif + +#if defined(MBEDTLS_ECP_C) +extern const mbedtls_pk_info_t mbedtls_eckey_info; +extern const mbedtls_pk_info_t mbedtls_eckeydh_info; +#endif + +#if defined(MBEDTLS_ECDSA_C) +extern const mbedtls_pk_info_t mbedtls_ecdsa_info; +#endif + +#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT) +extern const mbedtls_pk_info_t mbedtls_rsa_alt_info; +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +extern const mbedtls_pk_info_t mbedtls_pk_opaque_info; +#endif + +#endif /* MBEDTLS_PK_WRAP_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/pkcs11.h b/openharmony/armeabi-v7a/include/mbedtls/pkcs11.h new file mode 100644 index 00000000..3530ee16 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/pkcs11.h @@ -0,0 +1,246 @@ +/** + * \file pkcs11.h + * + * \brief Wrapper for PKCS#11 library libpkcs11-helper + * + * \author Adriaan de Jong + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_PKCS11_H +#define MBEDTLS_PKCS11_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#if defined(MBEDTLS_PKCS11_C) + +#include "mbedtls/x509_crt.h" + +#include + +#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \ + !defined(inline) && !defined(__cplusplus) +#define inline __inline +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(MBEDTLS_DEPRECATED_REMOVED) + +/** + * Context for PKCS #11 private keys. + */ +typedef struct mbedtls_pkcs11_context +{ + pkcs11h_certificate_t pkcs11h_cert; + int len; +} mbedtls_pkcs11_context; + +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif + +/** + * Initialize a mbedtls_pkcs11_context. + * (Just making memory references valid.) + * + * \deprecated This function is deprecated and will be removed in a + * future version of the library. + */ +MBEDTLS_DEPRECATED void mbedtls_pkcs11_init( mbedtls_pkcs11_context *ctx ); + +/** + * Fill in a mbed TLS certificate, based on the given PKCS11 helper certificate. + * + * \deprecated This function is deprecated and will be removed in a + * future version of the library. + * + * \param cert X.509 certificate to fill + * \param pkcs11h_cert PKCS #11 helper certificate + * + * \return 0 on success. + */ +MBEDTLS_DEPRECATED int mbedtls_pkcs11_x509_cert_bind( mbedtls_x509_crt *cert, + pkcs11h_certificate_t pkcs11h_cert ); + +/** + * Set up a mbedtls_pkcs11_context storing the given certificate. Note that the + * mbedtls_pkcs11_context will take over control of the certificate, freeing it when + * done. + * + * \deprecated This function is deprecated and will be removed in a + * future version of the library. + * + * \param priv_key Private key structure to fill. + * \param pkcs11_cert PKCS #11 helper certificate + * + * \return 0 on success + */ +MBEDTLS_DEPRECATED int mbedtls_pkcs11_priv_key_bind( + mbedtls_pkcs11_context *priv_key, + pkcs11h_certificate_t pkcs11_cert ); + +/** + * Free the contents of the given private key context. Note that the structure + * itself is not freed. + * + * \deprecated This function is deprecated and will be removed in a + * future version of the library. + * + * \param priv_key Private key structure to cleanup + */ +MBEDTLS_DEPRECATED void mbedtls_pkcs11_priv_key_free( + mbedtls_pkcs11_context *priv_key ); + +/** + * \brief Do an RSA private key decrypt, then remove the message + * padding + * + * \deprecated This function is deprecated and will be removed in a future + * version of the library. + * + * \param ctx PKCS #11 context + * \param mode must be MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's signature + * \param input buffer holding the encrypted data + * \param output buffer that will hold the plaintext + * \param olen will contain the plaintext length + * \param output_max_len maximum length of the output buffer + * + * \return 0 if successful, or an MBEDTLS_ERR_RSA_XXX error code + * + * \note The output buffer must be as large as the size + * of ctx->N (eg. 128 bytes if RSA-1024 is used) otherwise + * an error is thrown. + */ +MBEDTLS_DEPRECATED int mbedtls_pkcs11_decrypt( mbedtls_pkcs11_context *ctx, + int mode, size_t *olen, + const unsigned char *input, + unsigned char *output, + size_t output_max_len ); + +/** + * \brief Do a private RSA to sign a message digest + * + * \deprecated This function is deprecated and will be removed in a future + * version of the library. + * + * \param ctx PKCS #11 context + * \param mode must be MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's signature + * \param md_alg a MBEDTLS_MD_XXX (use MBEDTLS_MD_NONE for signing raw data) + * \param hashlen message digest length (for MBEDTLS_MD_NONE only) + * \param hash buffer holding the message digest + * \param sig buffer that will hold the ciphertext + * + * \return 0 if the signing operation was successful, + * or an MBEDTLS_ERR_RSA_XXX error code + * + * \note The "sig" buffer must be as large as the size + * of ctx->N (eg. 128 bytes if RSA-1024 is used). + */ +MBEDTLS_DEPRECATED int mbedtls_pkcs11_sign( mbedtls_pkcs11_context *ctx, + int mode, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + unsigned char *sig ); + +/** + * SSL/TLS wrappers for PKCS#11 functions + * + * \deprecated This function is deprecated and will be removed in a future + * version of the library. + */ +MBEDTLS_DEPRECATED static inline int mbedtls_ssl_pkcs11_decrypt( void *ctx, + int mode, size_t *olen, + const unsigned char *input, unsigned char *output, + size_t output_max_len ) +{ + return mbedtls_pkcs11_decrypt( (mbedtls_pkcs11_context *) ctx, mode, olen, input, output, + output_max_len ); +} + +/** + * \brief This function signs a message digest using RSA. + * + * \deprecated This function is deprecated and will be removed in a future + * version of the library. + * + * \param ctx The PKCS #11 context. + * \param f_rng The RNG function. This parameter is unused. + * \param p_rng The RNG context. This parameter is unused. + * \param mode The operation to run. This must be set to + * MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's + * signature. + * \param md_alg The message digest algorithm. One of the MBEDTLS_MD_XXX + * must be passed to this function and MBEDTLS_MD_NONE can be + * used for signing raw data. + * \param hashlen The message digest length (for MBEDTLS_MD_NONE only). + * \param hash The buffer holding the message digest. + * \param sig The buffer that will hold the ciphertext. + * + * \return \c 0 if the signing operation was successful. + * \return A non-zero error code on failure. + * + * \note The \p sig buffer must be as large as the size of + * ctx->N. For example, 128 bytes if RSA-1024 is + * used. + */ +MBEDTLS_DEPRECATED static inline int mbedtls_ssl_pkcs11_sign( void *ctx, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, + int mode, mbedtls_md_type_t md_alg, unsigned int hashlen, + const unsigned char *hash, unsigned char *sig ) +{ + ((void) f_rng); + ((void) p_rng); + return mbedtls_pkcs11_sign( (mbedtls_pkcs11_context *) ctx, mode, md_alg, + hashlen, hash, sig ); +} + +/** + * This function gets the length of the private key. + * + * \deprecated This function is deprecated and will be removed in a future + * version of the library. + * + * \param ctx The PKCS #11 context. + * + * \return The length of the private key. + */ +MBEDTLS_DEPRECATED static inline size_t mbedtls_ssl_pkcs11_key_len( void *ctx ) +{ + return ( (mbedtls_pkcs11_context *) ctx )->len; +} + +#undef MBEDTLS_DEPRECATED + +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_PKCS11_C */ + +#endif /* MBEDTLS_PKCS11_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/pkcs12.h b/openharmony/armeabi-v7a/include/mbedtls/pkcs12.h new file mode 100644 index 00000000..d9e85b1d --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/pkcs12.h @@ -0,0 +1,140 @@ +/** + * \file pkcs12.h + * + * \brief PKCS#12 Personal Information Exchange Syntax + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_PKCS12_H +#define MBEDTLS_PKCS12_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/md.h" +#include "mbedtls/cipher.h" +#include "mbedtls/asn1.h" + +#include + +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA -0x1F80 +/** Feature not available, e.g. unsupported encryption scheme. */ +#define MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE -0x1F00 +/** PBE ASN.1 data not as expected. */ +#define MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT -0x1E80 +/** Given private key password does not allow for correct decryption. */ +#define MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH -0x1E00 + +#define MBEDTLS_PKCS12_DERIVE_KEY 1 /**< encryption/decryption key */ +#define MBEDTLS_PKCS12_DERIVE_IV 2 /**< initialization vector */ +#define MBEDTLS_PKCS12_DERIVE_MAC_KEY 3 /**< integrity / MAC key */ + +#define MBEDTLS_PKCS12_PBE_DECRYPT 0 +#define MBEDTLS_PKCS12_PBE_ENCRYPT 1 + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(MBEDTLS_ASN1_PARSE_C) + +/** + * \brief PKCS12 Password Based function (encryption / decryption) + * for pbeWithSHAAnd128BitRC4 + * + * \param pbe_params an ASN1 buffer containing the pkcs-12PbeParams structure + * \param mode either MBEDTLS_PKCS12_PBE_ENCRYPT or MBEDTLS_PKCS12_PBE_DECRYPT + * \param pwd the password used (may be NULL if no password is used) + * \param pwdlen length of the password (may be 0) + * \param input the input data + * \param len data length + * \param output the output buffer + * + * \return 0 if successful, or a MBEDTLS_ERR_XXX code + */ +int mbedtls_pkcs12_pbe_sha1_rc4_128( mbedtls_asn1_buf *pbe_params, int mode, + const unsigned char *pwd, size_t pwdlen, + const unsigned char *input, size_t len, + unsigned char *output ); + +/** + * \brief PKCS12 Password Based function (encryption / decryption) + * for cipher-based and mbedtls_md-based PBE's + * + * \param pbe_params an ASN1 buffer containing the pkcs-12 PbeParams structure + * \param mode either #MBEDTLS_PKCS12_PBE_ENCRYPT or + * #MBEDTLS_PKCS12_PBE_DECRYPT + * \param cipher_type the cipher used + * \param md_type the mbedtls_md used + * \param pwd Latin1-encoded password used. This may only be \c NULL when + * \p pwdlen is 0. No null terminator should be used. + * \param pwdlen length of the password (may be 0) + * \param input the input data + * \param len data length + * \param output the output buffer + * + * \return 0 if successful, or a MBEDTLS_ERR_XXX code + */ +int mbedtls_pkcs12_pbe( mbedtls_asn1_buf *pbe_params, int mode, + mbedtls_cipher_type_t cipher_type, mbedtls_md_type_t md_type, + const unsigned char *pwd, size_t pwdlen, + const unsigned char *input, size_t len, + unsigned char *output ); + +#endif /* MBEDTLS_ASN1_PARSE_C */ + +/** + * \brief The PKCS#12 derivation function uses a password and a salt + * to produce pseudo-random bits for a particular "purpose". + * + * Depending on the given id, this function can produce an + * encryption/decryption key, an initialization vector or an + * integrity key. + * + * \param data buffer to store the derived data in + * \param datalen length of buffer to fill + * \param pwd The password to use. For compliance with PKCS#12 §B.1, this + * should be a BMPString, i.e. a Unicode string where each + * character is encoded as 2 bytes in big-endian order, with + * no byte order mark and with a null terminator (i.e. the + * last two bytes should be 0x00 0x00). + * \param pwdlen length of the password (may be 0). + * \param salt Salt buffer to use This may only be \c NULL when + * \p saltlen is 0. + * \param saltlen length of the salt (may be zero) + * \param mbedtls_md mbedtls_md type to use during the derivation + * \param id id that describes the purpose (can be + * #MBEDTLS_PKCS12_DERIVE_KEY, #MBEDTLS_PKCS12_DERIVE_IV or + * #MBEDTLS_PKCS12_DERIVE_MAC_KEY) + * \param iterations number of iterations + * + * \return 0 if successful, or a MD, BIGNUM type error. + */ +int mbedtls_pkcs12_derivation( unsigned char *data, size_t datalen, + const unsigned char *pwd, size_t pwdlen, + const unsigned char *salt, size_t saltlen, + mbedtls_md_type_t mbedtls_md, int id, int iterations ); + +#ifdef __cplusplus +} +#endif + +#endif /* pkcs12.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/pkcs5.h b/openharmony/armeabi-v7a/include/mbedtls/pkcs5.h new file mode 100644 index 00000000..696930f7 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/pkcs5.h @@ -0,0 +1,111 @@ +/** + * \file pkcs5.h + * + * \brief PKCS#5 functions + * + * \author Mathias Olsson + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_PKCS5_H +#define MBEDTLS_PKCS5_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/asn1.h" +#include "mbedtls/md.h" + +#include +#include + +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA -0x2f80 +/** Unexpected ASN.1 data. */ +#define MBEDTLS_ERR_PKCS5_INVALID_FORMAT -0x2f00 +/** Requested encryption or digest alg not available. */ +#define MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE -0x2e80 +/** Given private key password does not allow for correct decryption. */ +#define MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH -0x2e00 + +#define MBEDTLS_PKCS5_DECRYPT 0 +#define MBEDTLS_PKCS5_ENCRYPT 1 + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(MBEDTLS_ASN1_PARSE_C) + +/** + * \brief PKCS#5 PBES2 function + * + * \param pbe_params the ASN.1 algorithm parameters + * \param mode either MBEDTLS_PKCS5_DECRYPT or MBEDTLS_PKCS5_ENCRYPT + * \param pwd password to use when generating key + * \param pwdlen length of password + * \param data data to process + * \param datalen length of data + * \param output output buffer + * + * \returns 0 on success, or a MBEDTLS_ERR_XXX code if verification fails. + */ +int mbedtls_pkcs5_pbes2( const mbedtls_asn1_buf *pbe_params, int mode, + const unsigned char *pwd, size_t pwdlen, + const unsigned char *data, size_t datalen, + unsigned char *output ); + +#endif /* MBEDTLS_ASN1_PARSE_C */ + +/** + * \brief PKCS#5 PBKDF2 using HMAC + * + * \param ctx Generic HMAC context + * \param password Password to use when generating key + * \param plen Length of password + * \param salt Salt to use when generating key + * \param slen Length of salt + * \param iteration_count Iteration count + * \param key_length Length of generated key in bytes + * \param output Generated key. Must be at least as big as key_length + * + * \returns 0 on success, or a MBEDTLS_ERR_XXX code if verification fails. + */ +int mbedtls_pkcs5_pbkdf2_hmac( mbedtls_md_context_t *ctx, const unsigned char *password, + size_t plen, const unsigned char *salt, size_t slen, + unsigned int iteration_count, + uint32_t key_length, unsigned char *output ); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_pkcs5_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* pkcs5.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/platform.h b/openharmony/armeabi-v7a/include/mbedtls/platform.h new file mode 100644 index 00000000..06dd192e --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/platform.h @@ -0,0 +1,421 @@ +/** + * \file platform.h + * + * \brief This file contains the definitions and functions of the + * Mbed TLS platform abstraction layer. + * + * The platform abstraction layer removes the need for the library + * to directly link to standard C library functions or operating + * system services, making the library easier to port and embed. + * Application developers and users of the library can provide their own + * implementations of these functions, or implementations specific to + * their platform, which can be statically linked to the library or + * dynamically configured at runtime. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_PLATFORM_H +#define MBEDTLS_PLATFORM_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#if defined(MBEDTLS_HAVE_TIME) +#include "mbedtls/platform_time.h" +#endif + +/** Hardware accelerator failed */ +#define MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED -0x0070 +/** The requested feature is not supported by the platform */ +#define MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED -0x0072 + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h or define them on the compiler command line. + * \{ + */ + +/* The older Microsoft Windows common runtime provides non-conforming + * implementations of some standard library functions, including snprintf + * and vsnprintf. This affects MSVC and MinGW builds. + */ +#if defined(__MINGW32__) || (defined(_MSC_VER) && _MSC_VER <= 1900) +#define MBEDTLS_PLATFORM_HAS_NON_CONFORMING_SNPRINTF +#define MBEDTLS_PLATFORM_HAS_NON_CONFORMING_VSNPRINTF +#endif + +#if !defined(MBEDTLS_PLATFORM_NO_STD_FUNCTIONS) +#include +#include +#if defined(MBEDTLS_HAVE_TIME) +#include +#endif +#if !defined(MBEDTLS_PLATFORM_STD_SNPRINTF) +#if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_SNPRINTF) +#define MBEDTLS_PLATFORM_STD_SNPRINTF mbedtls_platform_win32_snprintf /**< The default \c snprintf function to use. */ +#else +#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< The default \c snprintf function to use. */ +#endif +#endif +#if !defined(MBEDTLS_PLATFORM_STD_VSNPRINTF) +#if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_VSNPRINTF) +#define MBEDTLS_PLATFORM_STD_VSNPRINTF mbedtls_platform_win32_vsnprintf /**< The default \c vsnprintf function to use. */ +#else +#define MBEDTLS_PLATFORM_STD_VSNPRINTF vsnprintf /**< The default \c vsnprintf function to use. */ +#endif +#endif +#if !defined(MBEDTLS_PLATFORM_STD_PRINTF) +#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< The default \c printf function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_FPRINTF) +#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< The default \c fprintf function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_CALLOC) +#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< The default \c calloc function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_FREE) +#define MBEDTLS_PLATFORM_STD_FREE free /**< The default \c free function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_EXIT) +#define MBEDTLS_PLATFORM_STD_EXIT exit /**< The default \c exit function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_TIME) +#define MBEDTLS_PLATFORM_STD_TIME time /**< The default \c time function to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_EXIT_SUCCESS) +#define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS EXIT_SUCCESS /**< The default exit value to use. */ +#endif +#if !defined(MBEDTLS_PLATFORM_STD_EXIT_FAILURE) +#define MBEDTLS_PLATFORM_STD_EXIT_FAILURE EXIT_FAILURE /**< The default exit value to use. */ +#endif +#if defined(MBEDTLS_FS_IO) +#if !defined(MBEDTLS_PLATFORM_STD_NV_SEED_READ) +#define MBEDTLS_PLATFORM_STD_NV_SEED_READ mbedtls_platform_std_nv_seed_read +#endif +#if !defined(MBEDTLS_PLATFORM_STD_NV_SEED_WRITE) +#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write +#endif +#if !defined(MBEDTLS_PLATFORM_STD_NV_SEED_FILE) +#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" +#endif +#endif /* MBEDTLS_FS_IO */ +#else /* MBEDTLS_PLATFORM_NO_STD_FUNCTIONS */ +#if defined(MBEDTLS_PLATFORM_STD_MEM_HDR) +#include MBEDTLS_PLATFORM_STD_MEM_HDR +#endif +#endif /* MBEDTLS_PLATFORM_NO_STD_FUNCTIONS */ + + +/** \} name SECTION: Module settings */ + +/* + * The function pointers for calloc and free. + */ +#if defined(MBEDTLS_PLATFORM_MEMORY) +#if defined(MBEDTLS_PLATFORM_FREE_MACRO) && \ + defined(MBEDTLS_PLATFORM_CALLOC_MACRO) +#define mbedtls_free MBEDTLS_PLATFORM_FREE_MACRO +#define mbedtls_calloc MBEDTLS_PLATFORM_CALLOC_MACRO +#else +/* For size_t */ +#include +extern void *mbedtls_calloc( size_t n, size_t size ); +extern void mbedtls_free( void *ptr ); + +/** + * \brief This function dynamically sets the memory-management + * functions used by the library, during runtime. + * + * \param calloc_func The \c calloc function implementation. + * \param free_func The \c free function implementation. + * + * \return \c 0. + */ +int mbedtls_platform_set_calloc_free( void * (*calloc_func)( size_t, size_t ), + void (*free_func)( void * ) ); +#endif /* MBEDTLS_PLATFORM_FREE_MACRO && MBEDTLS_PLATFORM_CALLOC_MACRO */ +#else /* !MBEDTLS_PLATFORM_MEMORY */ +#define mbedtls_free free +#define mbedtls_calloc calloc +#endif /* MBEDTLS_PLATFORM_MEMORY && !MBEDTLS_PLATFORM_{FREE,CALLOC}_MACRO */ + +/* + * The function pointers for fprintf + */ +#if defined(MBEDTLS_PLATFORM_FPRINTF_ALT) +/* We need FILE * */ +#include +extern int (*mbedtls_fprintf)( FILE *stream, const char *format, ... ); + +/** + * \brief This function dynamically configures the fprintf + * function that is called when the + * mbedtls_fprintf() function is invoked by the library. + * + * \param fprintf_func The \c fprintf function implementation. + * + * \return \c 0. + */ +int mbedtls_platform_set_fprintf( int (*fprintf_func)( FILE *stream, const char *, + ... ) ); +#else +#if defined(MBEDTLS_PLATFORM_FPRINTF_MACRO) +#define mbedtls_fprintf MBEDTLS_PLATFORM_FPRINTF_MACRO +#else +#define mbedtls_fprintf fprintf +#endif /* MBEDTLS_PLATFORM_FPRINTF_MACRO */ +#endif /* MBEDTLS_PLATFORM_FPRINTF_ALT */ + +/* + * The function pointers for printf + */ +#if defined(MBEDTLS_PLATFORM_PRINTF_ALT) +extern int (*mbedtls_printf)( const char *format, ... ); + +/** + * \brief This function dynamically configures the snprintf + * function that is called when the mbedtls_snprintf() + * function is invoked by the library. + * + * \param printf_func The \c printf function implementation. + * + * \return \c 0 on success. + */ +int mbedtls_platform_set_printf( int (*printf_func)( const char *, ... ) ); +#else /* !MBEDTLS_PLATFORM_PRINTF_ALT */ +#if defined(MBEDTLS_PLATFORM_PRINTF_MACRO) +#define mbedtls_printf MBEDTLS_PLATFORM_PRINTF_MACRO +#else +#define mbedtls_printf printf +#endif /* MBEDTLS_PLATFORM_PRINTF_MACRO */ +#endif /* MBEDTLS_PLATFORM_PRINTF_ALT */ + +/* + * The function pointers for snprintf + * + * The snprintf implementation should conform to C99: + * - it *must* always correctly zero-terminate the buffer + * (except when n == 0, then it must leave the buffer untouched) + * - however it is acceptable to return -1 instead of the required length when + * the destination buffer is too short. + */ +#if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_SNPRINTF) +/* For Windows (inc. MSYS2), we provide our own fixed implementation */ +int mbedtls_platform_win32_snprintf( char *s, size_t n, const char *fmt, ... ); +#endif + +#if defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) +extern int (*mbedtls_snprintf)( char * s, size_t n, const char * format, ... ); + +/** + * \brief This function allows configuring a custom + * \c snprintf function pointer. + * + * \param snprintf_func The \c snprintf function implementation. + * + * \return \c 0 on success. + */ +int mbedtls_platform_set_snprintf( int (*snprintf_func)( char * s, size_t n, + const char * format, ... ) ); +#else /* MBEDTLS_PLATFORM_SNPRINTF_ALT */ +#if defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) +#define mbedtls_snprintf MBEDTLS_PLATFORM_SNPRINTF_MACRO +#else +#define mbedtls_snprintf MBEDTLS_PLATFORM_STD_SNPRINTF +#endif /* MBEDTLS_PLATFORM_SNPRINTF_MACRO */ +#endif /* MBEDTLS_PLATFORM_SNPRINTF_ALT */ + +/* + * The function pointers for vsnprintf + * + * The vsnprintf implementation should conform to C99: + * - it *must* always correctly zero-terminate the buffer + * (except when n == 0, then it must leave the buffer untouched) + * - however it is acceptable to return -1 instead of the required length when + * the destination buffer is too short. + */ +#if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_VSNPRINTF) +#include +/* For Older Windows (inc. MSYS2), we provide our own fixed implementation */ +int mbedtls_platform_win32_vsnprintf( char *s, size_t n, const char *fmt, va_list arg ); +#endif + +#if defined(MBEDTLS_PLATFORM_VSNPRINTF_ALT) +#include +extern int (*mbedtls_vsnprintf)( char * s, size_t n, const char * format, va_list arg ); + +/** + * \brief Set your own snprintf function pointer + * + * \param vsnprintf_func The \c vsnprintf function implementation + * + * \return \c 0 + */ +int mbedtls_platform_set_vsnprintf( int (*vsnprintf_func)( char * s, size_t n, + const char * format, va_list arg ) ); +#else /* MBEDTLS_PLATFORM_VSNPRINTF_ALT */ +#if defined(MBEDTLS_PLATFORM_VSNPRINTF_MACRO) +#define mbedtls_vsnprintf MBEDTLS_PLATFORM_VSNPRINTF_MACRO +#else +#define mbedtls_vsnprintf vsnprintf +#endif /* MBEDTLS_PLATFORM_VSNPRINTF_MACRO */ +#endif /* MBEDTLS_PLATFORM_VSNPRINTF_ALT */ + +/* + * The function pointers for exit + */ +#if defined(MBEDTLS_PLATFORM_EXIT_ALT) +extern void (*mbedtls_exit)( int status ); + +/** + * \brief This function dynamically configures the exit + * function that is called when the mbedtls_exit() + * function is invoked by the library. + * + * \param exit_func The \c exit function implementation. + * + * \return \c 0 on success. + */ +int mbedtls_platform_set_exit( void (*exit_func)( int status ) ); +#else +#if defined(MBEDTLS_PLATFORM_EXIT_MACRO) +#define mbedtls_exit MBEDTLS_PLATFORM_EXIT_MACRO +#else +#define mbedtls_exit exit +#endif /* MBEDTLS_PLATFORM_EXIT_MACRO */ +#endif /* MBEDTLS_PLATFORM_EXIT_ALT */ + +/* + * The default exit values + */ +#if defined(MBEDTLS_PLATFORM_STD_EXIT_SUCCESS) +#define MBEDTLS_EXIT_SUCCESS MBEDTLS_PLATFORM_STD_EXIT_SUCCESS +#else +#define MBEDTLS_EXIT_SUCCESS 0 +#endif +#if defined(MBEDTLS_PLATFORM_STD_EXIT_FAILURE) +#define MBEDTLS_EXIT_FAILURE MBEDTLS_PLATFORM_STD_EXIT_FAILURE +#else +#define MBEDTLS_EXIT_FAILURE 1 +#endif + +/* + * The function pointers for reading from and writing a seed file to + * Non-Volatile storage (NV) in a platform-independent way + * + * Only enabled when the NV seed entropy source is enabled + */ +#if defined(MBEDTLS_ENTROPY_NV_SEED) +#if !defined(MBEDTLS_PLATFORM_NO_STD_FUNCTIONS) && defined(MBEDTLS_FS_IO) +/* Internal standard platform definitions */ +int mbedtls_platform_std_nv_seed_read( unsigned char *buf, size_t buf_len ); +int mbedtls_platform_std_nv_seed_write( unsigned char *buf, size_t buf_len ); +#endif + +#if defined(MBEDTLS_PLATFORM_NV_SEED_ALT) +extern int (*mbedtls_nv_seed_read)( unsigned char *buf, size_t buf_len ); +extern int (*mbedtls_nv_seed_write)( unsigned char *buf, size_t buf_len ); + +/** + * \brief This function allows configuring custom seed file writing and + * reading functions. + * + * \param nv_seed_read_func The seed reading function implementation. + * \param nv_seed_write_func The seed writing function implementation. + * + * \return \c 0 on success. + */ +int mbedtls_platform_set_nv_seed( + int (*nv_seed_read_func)( unsigned char *buf, size_t buf_len ), + int (*nv_seed_write_func)( unsigned char *buf, size_t buf_len ) + ); +#else +#if defined(MBEDTLS_PLATFORM_NV_SEED_READ_MACRO) && \ + defined(MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO) +#define mbedtls_nv_seed_read MBEDTLS_PLATFORM_NV_SEED_READ_MACRO +#define mbedtls_nv_seed_write MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO +#else +#define mbedtls_nv_seed_read mbedtls_platform_std_nv_seed_read +#define mbedtls_nv_seed_write mbedtls_platform_std_nv_seed_write +#endif +#endif /* MBEDTLS_PLATFORM_NV_SEED_ALT */ +#endif /* MBEDTLS_ENTROPY_NV_SEED */ + +#if !defined(MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT) + +/** + * \brief The platform context structure. + * + * \note This structure may be used to assist platform-specific + * setup or teardown operations. + */ +typedef struct mbedtls_platform_context +{ + char dummy; /**< A placeholder member, as empty structs are not portable. */ +} +mbedtls_platform_context; + +#else +#include "platform_alt.h" +#endif /* !MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT */ + +/** + * \brief This function performs any platform-specific initialization + * operations. + * + * \note This function should be called before any other library functions. + * + * Its implementation is platform-specific, and unless + * platform-specific code is provided, it does nothing. + * + * \note The usage and necessity of this function is dependent on the platform. + * + * \param ctx The platform context. + * + * \return \c 0 on success. + */ +int mbedtls_platform_setup( mbedtls_platform_context *ctx ); +/** + * \brief This function performs any platform teardown operations. + * + * \note This function should be called after every other Mbed TLS module + * has been correctly freed using the appropriate free function. + * + * Its implementation is platform-specific, and unless + * platform-specific code is provided, it does nothing. + * + * \note The usage and necessity of this function is dependent on the platform. + * + * \param ctx The platform context. + * + */ +void mbedtls_platform_teardown( mbedtls_platform_context *ctx ); + +#ifdef __cplusplus +} +#endif + +#endif /* platform.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/platform_time.h b/openharmony/armeabi-v7a/include/mbedtls/platform_time.h new file mode 100644 index 00000000..94055711 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/platform_time.h @@ -0,0 +1,72 @@ +/** + * \file platform_time.h + * + * \brief mbed TLS Platform time abstraction + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_PLATFORM_TIME_H +#define MBEDTLS_PLATFORM_TIME_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * The time_t datatype + */ +#if defined(MBEDTLS_PLATFORM_TIME_TYPE_MACRO) +typedef MBEDTLS_PLATFORM_TIME_TYPE_MACRO mbedtls_time_t; +#else +/* For time_t */ +#include +typedef time_t mbedtls_time_t; +#endif /* MBEDTLS_PLATFORM_TIME_TYPE_MACRO */ + +/* + * The function pointers for time + */ +#if defined(MBEDTLS_PLATFORM_TIME_ALT) +extern mbedtls_time_t (*mbedtls_time)( mbedtls_time_t* time ); + +/** + * \brief Set your own time function pointer + * + * \param time_func the time function implementation + * + * \return 0 + */ +int mbedtls_platform_set_time( mbedtls_time_t (*time_func)( mbedtls_time_t* time ) ); +#else +#if defined(MBEDTLS_PLATFORM_TIME_MACRO) +#define mbedtls_time MBEDTLS_PLATFORM_TIME_MACRO +#else +#define mbedtls_time time +#endif /* MBEDTLS_PLATFORM_TIME_MACRO */ +#endif /* MBEDTLS_PLATFORM_TIME_ALT */ + +#ifdef __cplusplus +} +#endif + +#endif /* platform_time.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/platform_util.h b/openharmony/armeabi-v7a/include/mbedtls/platform_util.h new file mode 100644 index 00000000..cd112ab5 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/platform_util.h @@ -0,0 +1,283 @@ +/** + * \file platform_util.h + * + * \brief Common and shared functions used by multiple modules in the Mbed TLS + * library. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_PLATFORM_UTIL_H +#define MBEDTLS_PLATFORM_UTIL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#if defined(MBEDTLS_HAVE_TIME_DATE) +#include "mbedtls/platform_time.h" +#include +#endif /* MBEDTLS_HAVE_TIME_DATE */ + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(MBEDTLS_CHECK_PARAMS) + +#if defined(MBEDTLS_CHECK_PARAMS_ASSERT) +/* Allow the user to define MBEDTLS_PARAM_FAILED to something like assert + * (which is what our config.h suggests). */ +#include +#endif /* MBEDTLS_CHECK_PARAMS_ASSERT */ + +#if defined(MBEDTLS_PARAM_FAILED) +/** An alternative definition of MBEDTLS_PARAM_FAILED has been set in config.h. + * + * This flag can be used to check whether it is safe to assume that + * MBEDTLS_PARAM_FAILED() will expand to a call to mbedtls_param_failed(). + */ +#define MBEDTLS_PARAM_FAILED_ALT + +#elif defined(MBEDTLS_CHECK_PARAMS_ASSERT) +#define MBEDTLS_PARAM_FAILED( cond ) assert( cond ) +#define MBEDTLS_PARAM_FAILED_ALT + +#else /* MBEDTLS_PARAM_FAILED */ +#define MBEDTLS_PARAM_FAILED( cond ) \ + mbedtls_param_failed( #cond, __FILE__, __LINE__ ) + +/** + * \brief User supplied callback function for parameter validation failure. + * See #MBEDTLS_CHECK_PARAMS for context. + * + * This function will be called unless an alternative treatment + * is defined through the #MBEDTLS_PARAM_FAILED macro. + * + * This function can return, and the operation will be aborted, or + * alternatively, through use of setjmp()/longjmp() can resume + * execution in the application code. + * + * \param failure_condition The assertion that didn't hold. + * \param file The file where the assertion failed. + * \param line The line in the file where the assertion failed. + */ +void mbedtls_param_failed( const char *failure_condition, + const char *file, + int line ); +#endif /* MBEDTLS_PARAM_FAILED */ + +/* Internal macro meant to be called only from within the library. */ +#define MBEDTLS_INTERNAL_VALIDATE_RET( cond, ret ) \ + do { \ + if( !(cond) ) \ + { \ + MBEDTLS_PARAM_FAILED( cond ); \ + return( ret ); \ + } \ + } while( 0 ) + +/* Internal macro meant to be called only from within the library. */ +#define MBEDTLS_INTERNAL_VALIDATE( cond ) \ + do { \ + if( !(cond) ) \ + { \ + MBEDTLS_PARAM_FAILED( cond ); \ + return; \ + } \ + } while( 0 ) + +#else /* MBEDTLS_CHECK_PARAMS */ + +/* Internal macros meant to be called only from within the library. */ +#define MBEDTLS_INTERNAL_VALIDATE_RET( cond, ret ) do { } while( 0 ) +#define MBEDTLS_INTERNAL_VALIDATE( cond ) do { } while( 0 ) + +#endif /* MBEDTLS_CHECK_PARAMS */ + +/* Internal helper macros for deprecating API constants. */ +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +/* Deliberately don't (yet) export MBEDTLS_DEPRECATED here + * to avoid conflict with other headers which define and use + * it, too. We might want to move all these definitions here at + * some point for uniformity. */ +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +MBEDTLS_DEPRECATED typedef char const * mbedtls_deprecated_string_constant_t; +#define MBEDTLS_DEPRECATED_STRING_CONSTANT( VAL ) \ + ( (mbedtls_deprecated_string_constant_t) ( VAL ) ) +MBEDTLS_DEPRECATED typedef int mbedtls_deprecated_numeric_constant_t; +#define MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( VAL ) \ + ( (mbedtls_deprecated_numeric_constant_t) ( VAL ) ) +#undef MBEDTLS_DEPRECATED +#else /* MBEDTLS_DEPRECATED_WARNING */ +#define MBEDTLS_DEPRECATED_STRING_CONSTANT( VAL ) VAL +#define MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( VAL ) VAL +#endif /* MBEDTLS_DEPRECATED_WARNING */ +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +/* Implementation of the check-return facility. + * See the user documentation in config.h. + * + * Do not use this macro directly to annotate function: instead, + * use one of MBEDTLS_CHECK_RETURN_CRITICAL or MBEDTLS_CHECK_RETURN_TYPICAL + * depending on how important it is to check the return value. + */ +#if !defined(MBEDTLS_CHECK_RETURN) +#if defined(__GNUC__) +#define MBEDTLS_CHECK_RETURN __attribute__((__warn_unused_result__)) +#elif defined(_MSC_VER) && _MSC_VER >= 1700 +#include +#define MBEDTLS_CHECK_RETURN _Check_return_ +#else +#define MBEDTLS_CHECK_RETURN +#endif +#endif + +/** Critical-failure function + * + * This macro appearing at the beginning of the declaration of a function + * indicates that its return value should be checked in all applications. + * Omitting the check is very likely to indicate a bug in the application + * and will result in a compile-time warning if #MBEDTLS_CHECK_RETURN + * is implemented for the compiler in use. + * + * \note The use of this macro is a work in progress. + * This macro may be added to more functions in the future. + * Such an extension is not considered an API break, provided that + * there are near-unavoidable circumstances under which the function + * can fail. For example, signature/MAC/AEAD verification functions, + * and functions that require a random generator, are considered + * return-check-critical. + */ +#define MBEDTLS_CHECK_RETURN_CRITICAL MBEDTLS_CHECK_RETURN + +/** Ordinary-failure function + * + * This macro appearing at the beginning of the declaration of a function + * indicates that its return value should be generally be checked in portable + * applications. Omitting the check will result in a compile-time warning if + * #MBEDTLS_CHECK_RETURN is implemented for the compiler in use and + * #MBEDTLS_CHECK_RETURN_WARNING is enabled in the compile-time configuration. + * + * You can use #MBEDTLS_IGNORE_RETURN to explicitly ignore the return value + * of a function that is annotated with #MBEDTLS_CHECK_RETURN. + * + * \note The use of this macro is a work in progress. + * This macro will be added to more functions in the future. + * Eventually this should appear before most functions returning + * an error code (as \c int in the \c mbedtls_xxx API or + * as ::psa_status_t in the \c psa_xxx API). + */ +#if defined(MBEDTLS_CHECK_RETURN_WARNING) +#define MBEDTLS_CHECK_RETURN_TYPICAL MBEDTLS_CHECK_RETURN +#else +#define MBEDTLS_CHECK_RETURN_TYPICAL +#endif + +/** Benign-failure function + * + * This macro appearing at the beginning of the declaration of a function + * indicates that it is rarely useful to check its return value. + * + * This macro has an empty expansion. It exists for documentation purposes: + * a #MBEDTLS_CHECK_RETURN_OPTIONAL annotation indicates that the function + * has been analyzed for return-check usefulness, whereas the lack of + * an annotation indicates that the function has not been analyzed and its + * return-check usefulness is unknown. + */ +#define MBEDTLS_CHECK_RETURN_OPTIONAL + +/** \def MBEDTLS_IGNORE_RETURN + * + * Call this macro with one argument, a function call, to suppress a warning + * from #MBEDTLS_CHECK_RETURN due to that function call. + */ +#if !defined(MBEDTLS_IGNORE_RETURN) +/* GCC doesn't silence the warning with just (void)(result). + * (void)!(result) is known to work up at least up to GCC 10, as well + * as with Clang and MSVC. + * + * https://gcc.gnu.org/onlinedocs/gcc-3.4.6/gcc/Non_002dbugs.html + * https://stackoverflow.com/questions/40576003/ignoring-warning-wunused-result + * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425#c34 + */ +#define MBEDTLS_IGNORE_RETURN(result) ( (void) !( result ) ) +#endif + +/** + * \brief Securely zeroize a buffer + * + * The function is meant to wipe the data contained in a buffer so + * that it can no longer be recovered even if the program memory + * is later compromised. Call this function on sensitive data + * stored on the stack before returning from a function, and on + * sensitive data stored on the heap before freeing the heap + * object. + * + * It is extremely difficult to guarantee that calls to + * mbedtls_platform_zeroize() are not removed by aggressive + * compiler optimizations in a portable way. For this reason, Mbed + * TLS provides the configuration option + * MBEDTLS_PLATFORM_ZEROIZE_ALT, which allows users to configure + * mbedtls_platform_zeroize() to use a suitable implementation for + * their platform and needs + * + * \param buf Buffer to be zeroized + * \param len Length of the buffer in bytes + * + */ +void mbedtls_platform_zeroize( void *buf, size_t len ); + +#if defined(MBEDTLS_HAVE_TIME_DATE) +/** + * \brief Platform-specific implementation of gmtime_r() + * + * The function is a thread-safe abstraction that behaves + * similarly to the gmtime_r() function from Unix/POSIX. + * + * Mbed TLS will try to identify the underlying platform and + * make use of an appropriate underlying implementation (e.g. + * gmtime_r() for POSIX and gmtime_s() for Windows). If this is + * not possible, then gmtime() will be used. In this case, calls + * from the library to gmtime() will be guarded by the mutex + * mbedtls_threading_gmtime_mutex if MBEDTLS_THREADING_C is + * enabled. It is recommended that calls from outside the library + * are also guarded by this mutex. + * + * If MBEDTLS_PLATFORM_GMTIME_R_ALT is defined, then Mbed TLS will + * unconditionally use the alternative implementation for + * mbedtls_platform_gmtime_r() supplied by the user at compile time. + * + * \param tt Pointer to an object containing time (in seconds) since the + * epoch to be converted + * \param tm_buf Pointer to an object where the results will be stored + * + * \return Pointer to an object of type struct tm on success, otherwise + * NULL + */ +struct tm *mbedtls_platform_gmtime_r( const mbedtls_time_t *tt, + struct tm *tm_buf ); +#endif /* MBEDTLS_HAVE_TIME_DATE */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_PLATFORM_UTIL_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/poly1305.h b/openharmony/armeabi-v7a/include/mbedtls/poly1305.h new file mode 100644 index 00000000..a69ede98 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/poly1305.h @@ -0,0 +1,194 @@ +/** + * \file poly1305.h + * + * \brief This file contains Poly1305 definitions and functions. + * + * Poly1305 is a one-time message authenticator that can be used to + * authenticate messages. Poly1305-AES was created by Daniel + * Bernstein https://cr.yp.to/mac/poly1305-20050329.pdf The generic + * Poly1305 algorithm (not tied to AES) was also standardized in RFC + * 7539. + * + * \author Daniel King + */ + +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_POLY1305_H +#define MBEDTLS_POLY1305_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +/** Invalid input parameter(s). */ +#define MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA -0x0057 + +/* MBEDTLS_ERR_POLY1305_FEATURE_UNAVAILABLE is deprecated and should not be + * used. */ +/** Feature not available. For example, s part of the API is not implemented. */ +#define MBEDTLS_ERR_POLY1305_FEATURE_UNAVAILABLE -0x0059 + +/* MBEDTLS_ERR_POLY1305_HW_ACCEL_FAILED is deprecated and should not be used. + */ +/** Poly1305 hardware accelerator failed. */ +#define MBEDTLS_ERR_POLY1305_HW_ACCEL_FAILED -0x005B + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_POLY1305_ALT) + +typedef struct mbedtls_poly1305_context +{ + uint32_t r[4]; /** The value for 'r' (low 128 bits of the key). */ + uint32_t s[4]; /** The value for 's' (high 128 bits of the key). */ + uint32_t acc[5]; /** The accumulator number. */ + uint8_t queue[16]; /** The current partial block of data. */ + size_t queue_len; /** The number of bytes stored in 'queue'. */ +} +mbedtls_poly1305_context; + +#else /* MBEDTLS_POLY1305_ALT */ +#include "poly1305_alt.h" +#endif /* MBEDTLS_POLY1305_ALT */ + +/** + * \brief This function initializes the specified Poly1305 context. + * + * It must be the first API called before using + * the context. + * + * It is usually followed by a call to + * \c mbedtls_poly1305_starts(), then one or more calls to + * \c mbedtls_poly1305_update(), then one call to + * \c mbedtls_poly1305_finish(), then finally + * \c mbedtls_poly1305_free(). + * + * \param ctx The Poly1305 context to initialize. This must + * not be \c NULL. + */ +void mbedtls_poly1305_init( mbedtls_poly1305_context *ctx ); + +/** + * \brief This function releases and clears the specified + * Poly1305 context. + * + * \param ctx The Poly1305 context to clear. This may be \c NULL, in which + * case this function is a no-op. If it is not \c NULL, it must + * point to an initialized Poly1305 context. + */ +void mbedtls_poly1305_free( mbedtls_poly1305_context *ctx ); + +/** + * \brief This function sets the one-time authentication key. + * + * \warning The key must be unique and unpredictable for each + * invocation of Poly1305. + * + * \param ctx The Poly1305 context to which the key should be bound. + * This must be initialized. + * \param key The buffer containing the \c 32 Byte (\c 256 Bit) key. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_poly1305_starts( mbedtls_poly1305_context *ctx, + const unsigned char key[32] ); + +/** + * \brief This functions feeds an input buffer into an ongoing + * Poly1305 computation. + * + * It is called between \c mbedtls_cipher_poly1305_starts() and + * \c mbedtls_cipher_poly1305_finish(). + * It can be called repeatedly to process a stream of data. + * + * \param ctx The Poly1305 context to use for the Poly1305 operation. + * This must be initialized and bound to a key. + * \param ilen The length of the input data in Bytes. + * Any value is accepted. + * \param input The buffer holding the input data. + * This pointer can be \c NULL if `ilen == 0`. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_poly1305_update( mbedtls_poly1305_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief This function generates the Poly1305 Message + * Authentication Code (MAC). + * + * \param ctx The Poly1305 context to use for the Poly1305 operation. + * This must be initialized and bound to a key. + * \param mac The buffer to where the MAC is written. This must + * be a writable buffer of length \c 16 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_poly1305_finish( mbedtls_poly1305_context *ctx, + unsigned char mac[16] ); + +/** + * \brief This function calculates the Poly1305 MAC of the input + * buffer with the provided key. + * + * \warning The key must be unique and unpredictable for each + * invocation of Poly1305. + * + * \param key The buffer containing the \c 32 Byte (\c 256 Bit) key. + * \param ilen The length of the input data in Bytes. + * Any value is accepted. + * \param input The buffer holding the input data. + * This pointer can be \c NULL if `ilen == 0`. + * \param mac The buffer to where the MAC is written. This must be + * a writable buffer of length \c 16 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_poly1305_mac( const unsigned char key[32], + const unsigned char *input, + size_t ilen, + unsigned char mac[16] ); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief The Poly1305 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_poly1305_self_test( int verbose ); +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_POLY1305_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/psa_util.h b/openharmony/armeabi-v7a/include/mbedtls/psa_util.h new file mode 100644 index 00000000..af7a809e --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/psa_util.h @@ -0,0 +1,512 @@ +/** + * \file psa_util.h + * + * \brief Utility functions for the use of the PSA Crypto library. + * + * \warning This function is not part of the public API and may + * change at any time. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_PSA_UTIL_H +#define MBEDTLS_PSA_UTIL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) + +#include "psa/crypto.h" + +#include "mbedtls/ecp.h" +#include "mbedtls/md.h" +#include "mbedtls/pk.h" +#include "mbedtls/oid.h" + +#include + +/* Translations for symmetric crypto. */ + +static inline psa_key_type_t mbedtls_psa_translate_cipher_type( + mbedtls_cipher_type_t cipher ) +{ + switch( cipher ) + { + case MBEDTLS_CIPHER_AES_128_CCM: + case MBEDTLS_CIPHER_AES_192_CCM: + case MBEDTLS_CIPHER_AES_256_CCM: + case MBEDTLS_CIPHER_AES_128_GCM: + case MBEDTLS_CIPHER_AES_192_GCM: + case MBEDTLS_CIPHER_AES_256_GCM: + case MBEDTLS_CIPHER_AES_128_CBC: + case MBEDTLS_CIPHER_AES_192_CBC: + case MBEDTLS_CIPHER_AES_256_CBC: + case MBEDTLS_CIPHER_AES_128_ECB: + case MBEDTLS_CIPHER_AES_192_ECB: + case MBEDTLS_CIPHER_AES_256_ECB: + return( PSA_KEY_TYPE_AES ); + + /* ARIA not yet supported in PSA. */ + /* case MBEDTLS_CIPHER_ARIA_128_CCM: + case MBEDTLS_CIPHER_ARIA_192_CCM: + case MBEDTLS_CIPHER_ARIA_256_CCM: + case MBEDTLS_CIPHER_ARIA_128_GCM: + case MBEDTLS_CIPHER_ARIA_192_GCM: + case MBEDTLS_CIPHER_ARIA_256_GCM: + case MBEDTLS_CIPHER_ARIA_128_CBC: + case MBEDTLS_CIPHER_ARIA_192_CBC: + case MBEDTLS_CIPHER_ARIA_256_CBC: + return( PSA_KEY_TYPE_ARIA ); */ + + default: + return( 0 ); + } +} + +static inline psa_algorithm_t mbedtls_psa_translate_cipher_mode( + mbedtls_cipher_mode_t mode, size_t taglen ) +{ + switch( mode ) + { + case MBEDTLS_MODE_ECB: + return( PSA_ALG_ECB_NO_PADDING ); + case MBEDTLS_MODE_GCM: + return( PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_GCM, taglen ) ); + case MBEDTLS_MODE_CCM: + return( PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) ); + case MBEDTLS_MODE_CBC: + if( taglen == 0 ) + return( PSA_ALG_CBC_NO_PADDING ); + else + return( 0 ); + default: + return( 0 ); + } +} + +static inline psa_key_usage_t mbedtls_psa_translate_cipher_operation( + mbedtls_operation_t op ) +{ + switch( op ) + { + case MBEDTLS_ENCRYPT: + return( PSA_KEY_USAGE_ENCRYPT ); + case MBEDTLS_DECRYPT: + return( PSA_KEY_USAGE_DECRYPT ); + default: + return( 0 ); + } +} + +/* Translations for hashing. */ + +static inline psa_algorithm_t mbedtls_psa_translate_md( mbedtls_md_type_t md_alg ) +{ + switch( md_alg ) + { +#if defined(MBEDTLS_MD2_C) + case MBEDTLS_MD_MD2: + return( PSA_ALG_MD2 ); +#endif +#if defined(MBEDTLS_MD4_C) + case MBEDTLS_MD_MD4: + return( PSA_ALG_MD4 ); +#endif +#if defined(MBEDTLS_MD5_C) + case MBEDTLS_MD_MD5: + return( PSA_ALG_MD5 ); +#endif +#if defined(MBEDTLS_SHA1_C) + case MBEDTLS_MD_SHA1: + return( PSA_ALG_SHA_1 ); +#endif +#if defined(MBEDTLS_SHA256_C) + case MBEDTLS_MD_SHA224: + return( PSA_ALG_SHA_224 ); + case MBEDTLS_MD_SHA256: + return( PSA_ALG_SHA_256 ); +#endif +#if defined(MBEDTLS_SHA512_C) + case MBEDTLS_MD_SHA384: + return( PSA_ALG_SHA_384 ); + case MBEDTLS_MD_SHA512: + return( PSA_ALG_SHA_512 ); +#endif +#if defined(MBEDTLS_RIPEMD160_C) + case MBEDTLS_MD_RIPEMD160: + return( PSA_ALG_RIPEMD160 ); +#endif + case MBEDTLS_MD_NONE: + return( 0 ); + default: + return( 0 ); + } +} + +/* Translations for ECC. */ + +static inline int mbedtls_psa_get_ecc_oid_from_id( + psa_ecc_family_t curve, size_t bits, + char const **oid, size_t *oid_len ) +{ + switch( curve ) + { + case PSA_ECC_FAMILY_SECP_R1: + switch( bits ) + { +#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) + case 192: + *oid = MBEDTLS_OID_EC_GRP_SECP192R1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP192R1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) + case 224: + *oid = MBEDTLS_OID_EC_GRP_SECP224R1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP224R1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) + case 256: + *oid = MBEDTLS_OID_EC_GRP_SECP256R1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP256R1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) + case 384: + *oid = MBEDTLS_OID_EC_GRP_SECP384R1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP384R1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) + case 521: + *oid = MBEDTLS_OID_EC_GRP_SECP521R1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP521R1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */ + } + break; + case PSA_ECC_FAMILY_SECP_K1: + switch( bits ) + { +#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) + case 192: + *oid = MBEDTLS_OID_EC_GRP_SECP192K1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP192K1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) + case 224: + *oid = MBEDTLS_OID_EC_GRP_SECP224K1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP224K1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) + case 256: + *oid = MBEDTLS_OID_EC_GRP_SECP256K1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_SECP256K1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */ + } + break; + case PSA_ECC_FAMILY_BRAINPOOL_P_R1: + switch( bits ) + { +#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) + case 256: + *oid = MBEDTLS_OID_EC_GRP_BP256R1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_BP256R1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_BP256R1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) + case 384: + *oid = MBEDTLS_OID_EC_GRP_BP384R1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_BP384R1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_BP384R1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) + case 512: + *oid = MBEDTLS_OID_EC_GRP_BP512R1; + *oid_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_EC_GRP_BP512R1 ); + return( 0 ); +#endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */ + } + break; + } + (void) oid; + (void) oid_len; + return( -1 ); +} + +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH 1 + +#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 192 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 192 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 224 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 224 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 256 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 256 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 384 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 384 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 521 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 521 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 192 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 192 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 224 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 224 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 256 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 256 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 256 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 256 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_BP256R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 384 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 384 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_BP384R1_ENABLED */ + +#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) +#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 512 + 7 ) / 8 ) + 1 ) +#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH +#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 512 + 7 ) / 8 ) + 1 ) +#endif +#endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */ + + +/* Translations for PK layer */ + +static inline int mbedtls_psa_err_translate_pk( psa_status_t status ) +{ + switch( status ) + { + case PSA_SUCCESS: + return( 0 ); + case PSA_ERROR_NOT_SUPPORTED: + return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE ); + case PSA_ERROR_INSUFFICIENT_MEMORY: + return( MBEDTLS_ERR_PK_ALLOC_FAILED ); + case PSA_ERROR_INSUFFICIENT_ENTROPY: + return( MBEDTLS_ERR_ECP_RANDOM_FAILED ); + case PSA_ERROR_BAD_STATE: + return( MBEDTLS_ERR_PK_BAD_INPUT_DATA ); + /* All other failures */ + case PSA_ERROR_COMMUNICATION_FAILURE: + case PSA_ERROR_HARDWARE_FAILURE: + case PSA_ERROR_CORRUPTION_DETECTED: + return( MBEDTLS_ERR_PK_HW_ACCEL_FAILED ); + default: /* We return the same as for the 'other failures', + * but list them separately nonetheless to indicate + * which failure conditions we have considered. */ + return( MBEDTLS_ERR_PK_HW_ACCEL_FAILED ); + } +} + +/* Translations for ECC */ + +/* This function transforms an ECC group identifier from + * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 + * into a PSA ECC group identifier. */ +#if defined(MBEDTLS_ECP_C) +static inline psa_key_type_t mbedtls_psa_parse_tls_ecc_group( + uint16_t tls_ecc_grp_reg_id, size_t *bits ) +{ + const mbedtls_ecp_curve_info *curve_info = + mbedtls_ecp_curve_info_from_tls_id( tls_ecc_grp_reg_id ); + if( curve_info == NULL ) + return( 0 ); + return( PSA_KEY_TYPE_ECC_KEY_PAIR( + mbedtls_ecc_group_to_psa( curve_info->grp_id, bits ) ) ); +} +#endif /* MBEDTLS_ECP_C */ + +/* This function takes a buffer holding an EC public key + * exported through psa_export_public_key(), and converts + * it into an ECPoint structure to be put into a ClientKeyExchange + * message in an ECDHE exchange. + * + * Both the present and the foreseeable future format of EC public keys + * used by PSA have the ECPoint structure contained in the exported key + * as a subbuffer, and the function merely selects this subbuffer instead + * of making a copy. + */ +static inline int mbedtls_psa_tls_psa_ec_to_ecpoint( unsigned char *src, + size_t srclen, + unsigned char **dst, + size_t *dstlen ) +{ + *dst = src; + *dstlen = srclen; + return( 0 ); +} + +/* This function takes a buffer holding an ECPoint structure + * (as contained in a TLS ServerKeyExchange message for ECDHE + * exchanges) and converts it into a format that the PSA key + * agreement API understands. + */ +static inline int mbedtls_psa_tls_ecpoint_to_psa_ec( unsigned char const *src, + size_t srclen, + unsigned char *dst, + size_t dstlen, + size_t *olen ) +{ + if( srclen > dstlen ) + return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ); + + memcpy( dst, src, srclen ); + *olen = srclen; + return( 0 ); +} + +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +/* Expose whatever RNG the PSA subsystem uses to applications using the + * mbedtls_xxx API. The declarations and definitions here need to be + * consistent with the implementation in library/psa_crypto_random_impl.h. + * See that file for implementation documentation. */ +#if defined(MBEDTLS_PSA_CRYPTO_C) + +/* The type of a `f_rng` random generator function that many library functions + * take. + * + * This type name is not part of the Mbed TLS stable API. It may be renamed + * or moved without warning. + */ +typedef int mbedtls_f_rng_t( void *p_rng, unsigned char *output, size_t output_size ); + +#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) + +/** The random generator function for the PSA subsystem. + * + * This function is suitable as the `f_rng` random generator function + * parameter of many `mbedtls_xxx` functions. Use #MBEDTLS_PSA_RANDOM_STATE + * to obtain the \p p_rng parameter. + * + * The implementation of this function depends on the configuration of the + * library. + * + * \note Depending on the configuration, this may be a function or + * a pointer to a function. + * + * \note This function may only be used if the PSA crypto subsystem is active. + * This means that you must call psa_crypto_init() before any call to + * this function, and you must not call this function after calling + * mbedtls_psa_crypto_free(). + * + * \param p_rng The random generator context. This must be + * #MBEDTLS_PSA_RANDOM_STATE. No other state is + * supported. + * \param output The buffer to fill. It must have room for + * \c output_size bytes. + * \param output_size The number of bytes to write to \p output. + * This function may fail if \p output_size is too + * large. It is guaranteed to accept any output size + * requested by Mbed TLS library functions. The + * maximum request size depends on the library + * configuration. + * + * \return \c 0 on success. + * \return An `MBEDTLS_ERR_ENTROPY_xxx`, + * `MBEDTLS_ERR_PLATFORM_xxx, + * `MBEDTLS_ERR_CTR_DRBG_xxx` or + * `MBEDTLS_ERR_HMAC_DRBG_xxx` on error. + */ +int mbedtls_psa_get_random( void *p_rng, + unsigned char *output, + size_t output_size ); + +/** The random generator state for the PSA subsystem. + * + * This macro expands to an expression which is suitable as the `p_rng` + * random generator state parameter of many `mbedtls_xxx` functions. + * It must be used in combination with the random generator function + * mbedtls_psa_get_random(). + * + * The implementation of this macro depends on the configuration of the + * library. Do not make any assumption on its nature. + */ +#define MBEDTLS_PSA_RANDOM_STATE NULL + +#else /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */ + +#if defined(MBEDTLS_CTR_DRBG_C) +#include "mbedtls/ctr_drbg.h" +typedef mbedtls_ctr_drbg_context mbedtls_psa_drbg_context_t; +static mbedtls_f_rng_t *const mbedtls_psa_get_random = mbedtls_ctr_drbg_random; +#elif defined(MBEDTLS_HMAC_DRBG_C) +#include "mbedtls/hmac_drbg.h" +typedef mbedtls_hmac_drbg_context mbedtls_psa_drbg_context_t; +static mbedtls_f_rng_t *const mbedtls_psa_get_random = mbedtls_hmac_drbg_random; +#endif +extern mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state; + +#define MBEDTLS_PSA_RANDOM_STATE mbedtls_psa_random_state + +#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */ + +#endif /* MBEDTLS_PSA_CRYPTO_C */ + +#endif /* MBEDTLS_PSA_UTIL_H */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/ripemd160.h b/openharmony/armeabi-v7a/include/mbedtls/ripemd160.h new file mode 100644 index 00000000..63270d12 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/ripemd160.h @@ -0,0 +1,236 @@ +/** + * \file ripemd160.h + * + * \brief RIPE MD-160 message digest + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_RIPEMD160_H +#define MBEDTLS_RIPEMD160_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +/* MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED is deprecated and should not be used. + */ +/** RIPEMD160 hardware accelerator failed */ +#define MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED -0x0031 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_RIPEMD160_ALT) +// Regular implementation +// + +/** + * \brief RIPEMD-160 context structure + */ +typedef struct mbedtls_ripemd160_context +{ + uint32_t total[2]; /*!< number of bytes processed */ + uint32_t state[5]; /*!< intermediate digest state */ + unsigned char buffer[64]; /*!< data block being processed */ +} +mbedtls_ripemd160_context; + +#else /* MBEDTLS_RIPEMD160_ALT */ +#include "ripemd160_alt.h" +#endif /* MBEDTLS_RIPEMD160_ALT */ + +/** + * \brief Initialize RIPEMD-160 context + * + * \param ctx RIPEMD-160 context to be initialized + */ +void mbedtls_ripemd160_init( mbedtls_ripemd160_context *ctx ); + +/** + * \brief Clear RIPEMD-160 context + * + * \param ctx RIPEMD-160 context to be cleared + */ +void mbedtls_ripemd160_free( mbedtls_ripemd160_context *ctx ); + +/** + * \brief Clone (the state of) an RIPEMD-160 context + * + * \param dst The destination context + * \param src The context to be cloned + */ +void mbedtls_ripemd160_clone( mbedtls_ripemd160_context *dst, + const mbedtls_ripemd160_context *src ); + +/** + * \brief RIPEMD-160 context setup + * + * \param ctx context to be initialized + * + * \return 0 if successful + */ +int mbedtls_ripemd160_starts_ret( mbedtls_ripemd160_context *ctx ); + +/** + * \brief RIPEMD-160 process buffer + * + * \param ctx RIPEMD-160 context + * \param input buffer holding the data + * \param ilen length of the input data + * + * \return 0 if successful + */ +int mbedtls_ripemd160_update_ret( mbedtls_ripemd160_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief RIPEMD-160 final digest + * + * \param ctx RIPEMD-160 context + * \param output RIPEMD-160 checksum result + * + * \return 0 if successful + */ +int mbedtls_ripemd160_finish_ret( mbedtls_ripemd160_context *ctx, + unsigned char output[20] ); + +/** + * \brief RIPEMD-160 process data block (internal use only) + * + * \param ctx RIPEMD-160 context + * \param data buffer holding one block of data + * + * \return 0 if successful + */ +int mbedtls_internal_ripemd160_process( mbedtls_ripemd160_context *ctx, + const unsigned char data[64] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief RIPEMD-160 context setup + * + * \deprecated Superseded by mbedtls_ripemd160_starts_ret() in 2.7.0 + * + * \param ctx context to be initialized + */ +MBEDTLS_DEPRECATED void mbedtls_ripemd160_starts( + mbedtls_ripemd160_context *ctx ); + +/** + * \brief RIPEMD-160 process buffer + * + * \deprecated Superseded by mbedtls_ripemd160_update_ret() in 2.7.0 + * + * \param ctx RIPEMD-160 context + * \param input buffer holding the data + * \param ilen length of the input data + */ +MBEDTLS_DEPRECATED void mbedtls_ripemd160_update( + mbedtls_ripemd160_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief RIPEMD-160 final digest + * + * \deprecated Superseded by mbedtls_ripemd160_finish_ret() in 2.7.0 + * + * \param ctx RIPEMD-160 context + * \param output RIPEMD-160 checksum result + */ +MBEDTLS_DEPRECATED void mbedtls_ripemd160_finish( + mbedtls_ripemd160_context *ctx, + unsigned char output[20] ); + +/** + * \brief RIPEMD-160 process data block (internal use only) + * + * \deprecated Superseded by mbedtls_internal_ripemd160_process() in 2.7.0 + * + * \param ctx RIPEMD-160 context + * \param data buffer holding one block of data + */ +MBEDTLS_DEPRECATED void mbedtls_ripemd160_process( + mbedtls_ripemd160_context *ctx, + const unsigned char data[64] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief Output = RIPEMD-160( input buffer ) + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output RIPEMD-160 checksum result + * + * \return 0 if successful + */ +int mbedtls_ripemd160_ret( const unsigned char *input, + size_t ilen, + unsigned char output[20] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief Output = RIPEMD-160( input buffer ) + * + * \deprecated Superseded by mbedtls_ripemd160_ret() in 2.7.0 + * + * \param input buffer holding the data + * \param ilen length of the input data + * \param output RIPEMD-160 checksum result + */ +MBEDTLS_DEPRECATED void mbedtls_ripemd160( const unsigned char *input, + size_t ilen, + unsigned char output[20] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_ripemd160_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_ripemd160.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/rsa.h b/openharmony/armeabi-v7a/include/mbedtls/rsa.h new file mode 100644 index 00000000..062df73a --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/rsa.h @@ -0,0 +1,1351 @@ +/** + * \file rsa.h + * + * \brief This file provides an API for the RSA public-key cryptosystem. + * + * The RSA public-key cryptosystem is defined in Public-Key + * Cryptography Standards (PKCS) #1 v1.5: RSA Encryption + * and Public-Key Cryptography Standards (PKCS) #1 v2.1: + * RSA Cryptography Specifications. + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_RSA_H +#define MBEDTLS_RSA_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/bignum.h" +#include "mbedtls/md.h" + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +/* + * RSA Error codes + */ +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_RSA_BAD_INPUT_DATA -0x4080 +/** Input data contains invalid padding and is rejected. */ +#define MBEDTLS_ERR_RSA_INVALID_PADDING -0x4100 +/** Something failed during generation of a key. */ +#define MBEDTLS_ERR_RSA_KEY_GEN_FAILED -0x4180 +/** Key failed to pass the validity check of the library. */ +#define MBEDTLS_ERR_RSA_KEY_CHECK_FAILED -0x4200 +/** The public key operation failed. */ +#define MBEDTLS_ERR_RSA_PUBLIC_FAILED -0x4280 +/** The private key operation failed. */ +#define MBEDTLS_ERR_RSA_PRIVATE_FAILED -0x4300 +/** The PKCS#1 verification failed. */ +#define MBEDTLS_ERR_RSA_VERIFY_FAILED -0x4380 +/** The output buffer for decryption is not large enough. */ +#define MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE -0x4400 +/** The random generator failed to generate non-zeros. */ +#define MBEDTLS_ERR_RSA_RNG_FAILED -0x4480 + +/* MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION is deprecated and should not be used. + */ +/** The implementation does not offer the requested operation, for example, because of security violations or lack of functionality. */ +#define MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION -0x4500 + +/* MBEDTLS_ERR_RSA_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** RSA hardware accelerator failed. */ +#define MBEDTLS_ERR_RSA_HW_ACCEL_FAILED -0x4580 + +/* + * RSA constants + */ +#define MBEDTLS_RSA_PUBLIC 0 /**< Request private key operation. */ +#define MBEDTLS_RSA_PRIVATE 1 /**< Request public key operation. */ + +#define MBEDTLS_RSA_PKCS_V15 0 /**< Use PKCS#1 v1.5 encoding. */ +#define MBEDTLS_RSA_PKCS_V21 1 /**< Use PKCS#1 v2.1 encoding. */ + +#define MBEDTLS_RSA_SIGN 1 /**< Identifier for RSA signature operations. */ +#define MBEDTLS_RSA_CRYPT 2 /**< Identifier for RSA encryption and decryption operations. */ + +#define MBEDTLS_RSA_SALT_LEN_ANY -1 + +/* + * The above constants may be used even if the RSA module is compile out, + * eg for alternative (PKCS#11) RSA implementations in the PK layers. + */ + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_RSA_ALT) +// Regular implementation +// + +/** + * \brief The RSA context structure. + * + * \note Direct manipulation of the members of this structure + * is deprecated. All manipulation should instead be done through + * the public interface functions. + */ +typedef struct mbedtls_rsa_context +{ + int ver; /*!< Reserved for internal purposes. + * Do not set this field in application + * code. Its meaning might change without + * notice. */ + size_t len; /*!< The size of \p N in Bytes. */ + + mbedtls_mpi N; /*!< The public modulus. */ + mbedtls_mpi E; /*!< The public exponent. */ + + mbedtls_mpi D; /*!< The private exponent. */ + mbedtls_mpi P; /*!< The first prime factor. */ + mbedtls_mpi Q; /*!< The second prime factor. */ + + mbedtls_mpi DP; /*!< D % (P - 1). */ + mbedtls_mpi DQ; /*!< D % (Q - 1). */ + mbedtls_mpi QP; /*!< 1 / (Q % P). */ + + mbedtls_mpi RN; /*!< cached R^2 mod N. */ + + mbedtls_mpi RP; /*!< cached R^2 mod P. */ + mbedtls_mpi RQ; /*!< cached R^2 mod Q. */ + + mbedtls_mpi Vi; /*!< The cached blinding value. */ + mbedtls_mpi Vf; /*!< The cached un-blinding value. */ + + int padding; /*!< Selects padding mode: + #MBEDTLS_RSA_PKCS_V15 for 1.5 padding and + #MBEDTLS_RSA_PKCS_V21 for OAEP or PSS. */ + int hash_id; /*!< Hash identifier of mbedtls_md_type_t type, + as specified in md.h for use in the MGF + mask generating function used in the + EME-OAEP and EMSA-PSS encodings. */ +#if defined(MBEDTLS_THREADING_C) + /* Invariant: the mutex is initialized iff ver != 0. */ + mbedtls_threading_mutex_t mutex; /*!< Thread-safety mutex. */ +#endif +} +mbedtls_rsa_context; + +#else /* MBEDTLS_RSA_ALT */ +#include "rsa_alt.h" +#endif /* MBEDTLS_RSA_ALT */ + +/** + * \brief This function initializes an RSA context. + * + * \note Set padding to #MBEDTLS_RSA_PKCS_V21 for the RSAES-OAEP + * encryption scheme and the RSASSA-PSS signature scheme. + * + * \note The \p hash_id parameter is ignored when using + * #MBEDTLS_RSA_PKCS_V15 padding. + * + * \note The choice of padding mode is strictly enforced for private key + * operations, since there might be security concerns in + * mixing padding modes. For public key operations it is + * a default value, which can be overridden by calling specific + * \c rsa_rsaes_xxx or \c rsa_rsassa_xxx functions. + * + * \note The hash selected in \p hash_id is always used for OEAP + * encryption. For PSS signatures, it is always used for + * making signatures, but can be overridden for verifying them. + * If set to #MBEDTLS_MD_NONE, it is always overridden. + * + * \param ctx The RSA context to initialize. This must not be \c NULL. + * \param padding The padding mode to use. This must be either + * #MBEDTLS_RSA_PKCS_V15 or #MBEDTLS_RSA_PKCS_V21. + * \param hash_id The hash identifier of ::mbedtls_md_type_t type, if + * \p padding is #MBEDTLS_RSA_PKCS_V21. It is unused + * otherwise. + */ +void mbedtls_rsa_init( mbedtls_rsa_context *ctx, + int padding, + int hash_id ); + +/** + * \brief This function imports a set of core parameters into an + * RSA context. + * + * \note This function can be called multiple times for successive + * imports, if the parameters are not simultaneously present. + * + * Any sequence of calls to this function should be followed + * by a call to mbedtls_rsa_complete(), which checks and + * completes the provided information to a ready-for-use + * public or private RSA key. + * + * \note See mbedtls_rsa_complete() for more information on which + * parameters are necessary to set up a private or public + * RSA key. + * + * \note The imported parameters are copied and need not be preserved + * for the lifetime of the RSA context being set up. + * + * \param ctx The initialized RSA context to store the parameters in. + * \param N The RSA modulus. This may be \c NULL. + * \param P The first prime factor of \p N. This may be \c NULL. + * \param Q The second prime factor of \p N. This may be \c NULL. + * \param D The private exponent. This may be \c NULL. + * \param E The public exponent. This may be \c NULL. + * + * \return \c 0 on success. + * \return A non-zero error code on failure. + */ +int mbedtls_rsa_import( mbedtls_rsa_context *ctx, + const mbedtls_mpi *N, + const mbedtls_mpi *P, const mbedtls_mpi *Q, + const mbedtls_mpi *D, const mbedtls_mpi *E ); + +/** + * \brief This function imports core RSA parameters, in raw big-endian + * binary format, into an RSA context. + * + * \note This function can be called multiple times for successive + * imports, if the parameters are not simultaneously present. + * + * Any sequence of calls to this function should be followed + * by a call to mbedtls_rsa_complete(), which checks and + * completes the provided information to a ready-for-use + * public or private RSA key. + * + * \note See mbedtls_rsa_complete() for more information on which + * parameters are necessary to set up a private or public + * RSA key. + * + * \note The imported parameters are copied and need not be preserved + * for the lifetime of the RSA context being set up. + * + * \param ctx The initialized RSA context to store the parameters in. + * \param N The RSA modulus. This may be \c NULL. + * \param N_len The Byte length of \p N; it is ignored if \p N == NULL. + * \param P The first prime factor of \p N. This may be \c NULL. + * \param P_len The Byte length of \p P; it ns ignored if \p P == NULL. + * \param Q The second prime factor of \p N. This may be \c NULL. + * \param Q_len The Byte length of \p Q; it is ignored if \p Q == NULL. + * \param D The private exponent. This may be \c NULL. + * \param D_len The Byte length of \p D; it is ignored if \p D == NULL. + * \param E The public exponent. This may be \c NULL. + * \param E_len The Byte length of \p E; it is ignored if \p E == NULL. + * + * \return \c 0 on success. + * \return A non-zero error code on failure. + */ +int mbedtls_rsa_import_raw( mbedtls_rsa_context *ctx, + unsigned char const *N, size_t N_len, + unsigned char const *P, size_t P_len, + unsigned char const *Q, size_t Q_len, + unsigned char const *D, size_t D_len, + unsigned char const *E, size_t E_len ); + +/** + * \brief This function completes an RSA context from + * a set of imported core parameters. + * + * To setup an RSA public key, precisely \p N and \p E + * must have been imported. + * + * To setup an RSA private key, sufficient information must + * be present for the other parameters to be derivable. + * + * The default implementation supports the following: + *
  • Derive \p P, \p Q from \p N, \p D, \p E.
    • + *
  • Derive \p N, \p D from \p P, \p Q, \p E.
+ * Alternative implementations need not support these. + * + * If this function runs successfully, it guarantees that + * the RSA context can be used for RSA operations without + * the risk of failure or crash. + * + * \warning This function need not perform consistency checks + * for the imported parameters. In particular, parameters that + * are not needed by the implementation might be silently + * discarded and left unchecked. To check the consistency + * of the key material, see mbedtls_rsa_check_privkey(). + * + * \param ctx The initialized RSA context holding imported parameters. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_RSA_BAD_INPUT_DATA if the attempted derivations + * failed. + * + */ +int mbedtls_rsa_complete( mbedtls_rsa_context *ctx ); + +/** + * \brief This function exports the core parameters of an RSA key. + * + * If this function runs successfully, the non-NULL buffers + * pointed to by \p N, \p P, \p Q, \p D, and \p E are fully + * written, with additional unused space filled leading by + * zero Bytes. + * + * Possible reasons for returning + * #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
    + *
  • An alternative RSA implementation is in use, which + * stores the key externally, and either cannot or should + * not export it into RAM.
    • + *
  • A SW or HW implementation might not support a certain + * deduction. For example, \p P, \p Q from \p N, \p D, + * and \p E if the former are not part of the + * implementation.
+ * + * If the function fails due to an unsupported operation, + * the RSA context stays intact and remains usable. + * + * \param ctx The initialized RSA context. + * \param N The MPI to hold the RSA modulus. + * This may be \c NULL if this field need not be exported. + * \param P The MPI to hold the first prime factor of \p N. + * This may be \c NULL if this field need not be exported. + * \param Q The MPI to hold the second prime factor of \p N. + * This may be \c NULL if this field need not be exported. + * \param D The MPI to hold the private exponent. + * This may be \c NULL if this field need not be exported. + * \param E The MPI to hold the public exponent. + * This may be \c NULL if this field need not be exported. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the + * requested parameters cannot be done due to missing + * functionality or because of security policies. + * \return A non-zero return code on any other failure. + * + */ +int mbedtls_rsa_export( const mbedtls_rsa_context *ctx, + mbedtls_mpi *N, mbedtls_mpi *P, mbedtls_mpi *Q, + mbedtls_mpi *D, mbedtls_mpi *E ); + +/** + * \brief This function exports core parameters of an RSA key + * in raw big-endian binary format. + * + * If this function runs successfully, the non-NULL buffers + * pointed to by \p N, \p P, \p Q, \p D, and \p E are fully + * written, with additional unused space filled leading by + * zero Bytes. + * + * Possible reasons for returning + * #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
    + *
  • An alternative RSA implementation is in use, which + * stores the key externally, and either cannot or should + * not export it into RAM.
    • + *
  • A SW or HW implementation might not support a certain + * deduction. For example, \p P, \p Q from \p N, \p D, + * and \p E if the former are not part of the + * implementation.
+ * If the function fails due to an unsupported operation, + * the RSA context stays intact and remains usable. + * + * \note The length parameters are ignored if the corresponding + * buffer pointers are NULL. + * + * \param ctx The initialized RSA context. + * \param N The Byte array to store the RSA modulus, + * or \c NULL if this field need not be exported. + * \param N_len The size of the buffer for the modulus. + * \param P The Byte array to hold the first prime factor of \p N, + * or \c NULL if this field need not be exported. + * \param P_len The size of the buffer for the first prime factor. + * \param Q The Byte array to hold the second prime factor of \p N, + * or \c NULL if this field need not be exported. + * \param Q_len The size of the buffer for the second prime factor. + * \param D The Byte array to hold the private exponent, + * or \c NULL if this field need not be exported. + * \param D_len The size of the buffer for the private exponent. + * \param E The Byte array to hold the public exponent, + * or \c NULL if this field need not be exported. + * \param E_len The size of the buffer for the public exponent. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the + * requested parameters cannot be done due to missing + * functionality or because of security policies. + * \return A non-zero return code on any other failure. + */ +int mbedtls_rsa_export_raw( const mbedtls_rsa_context *ctx, + unsigned char *N, size_t N_len, + unsigned char *P, size_t P_len, + unsigned char *Q, size_t Q_len, + unsigned char *D, size_t D_len, + unsigned char *E, size_t E_len ); + +/** + * \brief This function exports CRT parameters of a private RSA key. + * + * \note Alternative RSA implementations not using CRT-parameters + * internally can implement this function based on + * mbedtls_rsa_deduce_opt(). + * + * \param ctx The initialized RSA context. + * \param DP The MPI to hold \c D modulo `P-1`, + * or \c NULL if it need not be exported. + * \param DQ The MPI to hold \c D modulo `Q-1`, + * or \c NULL if it need not be exported. + * \param QP The MPI to hold modular inverse of \c Q modulo \c P, + * or \c NULL if it need not be exported. + * + * \return \c 0 on success. + * \return A non-zero error code on failure. + * + */ +int mbedtls_rsa_export_crt( const mbedtls_rsa_context *ctx, + mbedtls_mpi *DP, mbedtls_mpi *DQ, mbedtls_mpi *QP ); + +/** + * \brief This function sets padding for an already initialized RSA + * context. See mbedtls_rsa_init() for details. + * + * \param ctx The initialized RSA context to be configured. + * \param padding The padding mode to use. This must be either + * #MBEDTLS_RSA_PKCS_V15 or #MBEDTLS_RSA_PKCS_V21. + * \param hash_id The #MBEDTLS_RSA_PKCS_V21 hash identifier. + */ +void mbedtls_rsa_set_padding( mbedtls_rsa_context *ctx, int padding, + int hash_id ); + +/** + * \brief This function retrieves the length of RSA modulus in Bytes. + * + * \param ctx The initialized RSA context. + * + * \return The length of the RSA modulus in Bytes. + * + */ +size_t mbedtls_rsa_get_len( const mbedtls_rsa_context *ctx ); + +/** + * \brief This function generates an RSA keypair. + * + * \note mbedtls_rsa_init() must be called before this function, + * to set up the RSA context. + * + * \param ctx The initialized RSA context used to hold the key. + * \param f_rng The RNG function to be used for key generation. + * This must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. + * This may be \c NULL if \p f_rng doesn't need a context. + * \param nbits The size of the public key in bits. + * \param exponent The public exponent to use. For example, \c 65537. + * This must be odd and greater than \c 1. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_gen_key( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + unsigned int nbits, int exponent ); + +/** + * \brief This function checks if a context contains at least an RSA + * public key. + * + * If the function runs successfully, it is guaranteed that + * enough information is present to perform an RSA public key + * operation using mbedtls_rsa_public(). + * + * \param ctx The initialized RSA context to check. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + * + */ +int mbedtls_rsa_check_pubkey( const mbedtls_rsa_context *ctx ); + +/** + * \brief This function checks if a context contains an RSA private key + * and perform basic consistency checks. + * + * \note The consistency checks performed by this function not only + * ensure that mbedtls_rsa_private() can be called successfully + * on the given context, but that the various parameters are + * mutually consistent with high probability, in the sense that + * mbedtls_rsa_public() and mbedtls_rsa_private() are inverses. + * + * \warning This function should catch accidental misconfigurations + * like swapping of parameters, but it cannot establish full + * trust in neither the quality nor the consistency of the key + * material that was used to setup the given RSA context: + *
  • Consistency: Imported parameters that are irrelevant + * for the implementation might be silently dropped. If dropped, + * the current function does not have access to them, + * and therefore cannot check them. See mbedtls_rsa_complete(). + * If you want to check the consistency of the entire + * content of an PKCS1-encoded RSA private key, for example, you + * should use mbedtls_rsa_validate_params() before setting + * up the RSA context. + * Additionally, if the implementation performs empirical checks, + * these checks substantiate but do not guarantee consistency.
    • + *
  • Quality: This function is not expected to perform + * extended quality assessments like checking that the prime + * factors are safe. Additionally, it is the responsibility of the + * user to ensure the trustworthiness of the source of his RSA + * parameters, which goes beyond what is effectively checkable + * by the library.
+ * + * \param ctx The initialized RSA context to check. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_check_privkey( const mbedtls_rsa_context *ctx ); + +/** + * \brief This function checks a public-private RSA key pair. + * + * It checks each of the contexts, and makes sure they match. + * + * \param pub The initialized RSA context holding the public key. + * \param prv The initialized RSA context holding the private key. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_check_pub_priv( const mbedtls_rsa_context *pub, + const mbedtls_rsa_context *prv ); + +/** + * \brief This function performs an RSA public key operation. + * + * \param ctx The initialized RSA context to use. + * \param input The input buffer. This must be a readable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * \param output The output buffer. This must be a writable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \note This function does not handle message padding. + * + * \note Make sure to set \p input[0] = 0 or ensure that + * input is smaller than \p N. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_public( mbedtls_rsa_context *ctx, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function performs an RSA private key operation. + * + * \note Blinding is used if and only if a PRNG is provided. + * + * \note If blinding is used, both the base of exponentiation + * and the exponent are blinded, providing protection + * against some side-channel attacks. + * + * \warning It is deprecated and a security risk to not provide + * a PRNG here and thereby prevent the use of blinding. + * Future versions of the library may enforce the presence + * of a PRNG. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function, used for blinding. It is discouraged + * and deprecated to pass \c NULL here, in which case + * blinding will be omitted. + * \param p_rng The RNG context to pass to \p f_rng. This may be \c NULL + * if \p f_rng is \c NULL or if \p f_rng doesn't need a context. + * \param input The input buffer. This must be a readable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * \param output The output buffer. This must be a writable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + * + */ +int mbedtls_rsa_private( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function adds the message padding, then performs an RSA + * operation. + * + * It is the generic wrapper for performing a PKCS#1 encryption + * operation using the \p mode from the context. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PRIVATE mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PUBLIC. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PRIVATE and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG to use. It is mandatory for PKCS#1 v2.1 padding + * encoding, and for PKCS#1 v1.5 padding encoding when used + * with \p mode set to #MBEDTLS_RSA_PUBLIC. For PKCS#1 v1.5 + * padding encoding and \p mode set to #MBEDTLS_RSA_PRIVATE, + * it is used for blinding and should be provided in this + * case; see mbedtls_rsa_private() for more. + * \param p_rng The RNG context to be passed to \p f_rng. May be + * \c NULL if \p f_rng is \c NULL or if \p f_rng doesn't + * need a context argument. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE (deprecated). + * \param ilen The length of the plaintext in Bytes. + * \param input The input data to encrypt. This must be a readable + * buffer of size \p ilen Bytes. It may be \c NULL if + * `ilen == 0`. + * \param output The output buffer. This must be a writable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_pkcs1_encrypt( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, size_t ilen, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function performs a PKCS#1 v1.5 encryption operation + * (RSAES-PKCS1-v1_5-ENCRYPT). + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PRIVATE mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PUBLIC. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PRIVATE and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function to use. It is needed for padding generation + * if \p mode is #MBEDTLS_RSA_PUBLIC. If \p mode is + * #MBEDTLS_RSA_PRIVATE (discouraged), it is used for + * blinding and should be provided; see mbedtls_rsa_private(). + * \param p_rng The RNG context to be passed to \p f_rng. This may + * be \c NULL if \p f_rng is \c NULL or if \p f_rng + * doesn't need a context argument. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE (deprecated). + * \param ilen The length of the plaintext in Bytes. + * \param input The input data to encrypt. This must be a readable + * buffer of size \p ilen Bytes. It may be \c NULL if + * `ilen == 0`. + * \param output The output buffer. This must be a writable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsaes_pkcs1_v15_encrypt( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, size_t ilen, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function performs a PKCS#1 v2.1 OAEP encryption + * operation (RSAES-OAEP-ENCRYPT). + * + * \note The output buffer must be as large as the size + * of ctx->N. For example, 128 Bytes if RSA-1024 is used. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PRIVATE mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PUBLIC. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PRIVATE and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function to use. This is needed for padding + * generation and must be provided. + * \param p_rng The RNG context to be passed to \p f_rng. This may + * be \c NULL if \p f_rng doesn't need a context argument. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE (deprecated). + * \param label The buffer holding the custom label to use. + * This must be a readable buffer of length \p label_len + * Bytes. It may be \c NULL if \p label_len is \c 0. + * \param label_len The length of the label in Bytes. + * \param ilen The length of the plaintext buffer \p input in Bytes. + * \param input The input data to encrypt. This must be a readable + * buffer of size \p ilen Bytes. It may be \c NULL if + * `ilen == 0`. + * \param output The output buffer. This must be a writable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsaes_oaep_encrypt( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + const unsigned char *label, size_t label_len, + size_t ilen, + const unsigned char *input, + unsigned char *output ); + +/** + * \brief This function performs an RSA operation, then removes the + * message padding. + * + * It is the generic wrapper for performing a PKCS#1 decryption + * operation using the \p mode from the context. + * + * \note The output buffer length \c output_max_len should be + * as large as the size \p ctx->len of \p ctx->N (for example, + * 128 Bytes if RSA-1024 is used) to be able to hold an + * arbitrary decrypted message. If it is not large enough to + * hold the decryption of the particular ciphertext provided, + * the function returns \c MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PUBLIC mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PRIVATE. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PUBLIC and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. If \p mode is #MBEDTLS_RSA_PRIVATE, + * this is used for blinding and should be provided; see + * mbedtls_rsa_private() for more. If \p mode is + * #MBEDTLS_RSA_PUBLIC, it is ignored. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a context. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PRIVATE or #MBEDTLS_RSA_PUBLIC (deprecated). + * \param olen The address at which to store the length of + * the plaintext. This must not be \c NULL. + * \param input The ciphertext buffer. This must be a readable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * \param output The buffer used to hold the plaintext. This must + * be a writable buffer of length \p output_max_len Bytes. + * \param output_max_len The length in Bytes of the output buffer \p output. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_pkcs1_decrypt( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, size_t *olen, + const unsigned char *input, + unsigned char *output, + size_t output_max_len ); + +/** + * \brief This function performs a PKCS#1 v1.5 decryption + * operation (RSAES-PKCS1-v1_5-DECRYPT). + * + * \note The output buffer length \c output_max_len should be + * as large as the size \p ctx->len of \p ctx->N, for example, + * 128 Bytes if RSA-1024 is used, to be able to hold an + * arbitrary decrypted message. If it is not large enough to + * hold the decryption of the particular ciphertext provided, + * the function returns #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PUBLIC mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PRIVATE. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PUBLIC and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. If \p mode is #MBEDTLS_RSA_PRIVATE, + * this is used for blinding and should be provided; see + * mbedtls_rsa_private() for more. If \p mode is + * #MBEDTLS_RSA_PUBLIC, it is ignored. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a context. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PRIVATE or #MBEDTLS_RSA_PUBLIC (deprecated). + * \param olen The address at which to store the length of + * the plaintext. This must not be \c NULL. + * \param input The ciphertext buffer. This must be a readable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * \param output The buffer used to hold the plaintext. This must + * be a writable buffer of length \p output_max_len Bytes. + * \param output_max_len The length in Bytes of the output buffer \p output. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + * + */ +int mbedtls_rsa_rsaes_pkcs1_v15_decrypt( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, size_t *olen, + const unsigned char *input, + unsigned char *output, + size_t output_max_len ); + +/** + * \brief This function performs a PKCS#1 v2.1 OAEP decryption + * operation (RSAES-OAEP-DECRYPT). + * + * \note The output buffer length \c output_max_len should be + * as large as the size \p ctx->len of \p ctx->N, for + * example, 128 Bytes if RSA-1024 is used, to be able to + * hold an arbitrary decrypted message. If it is not + * large enough to hold the decryption of the particular + * ciphertext provided, the function returns + * #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PUBLIC mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PRIVATE. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PUBLIC and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. If \p mode is #MBEDTLS_RSA_PRIVATE, + * this is used for blinding and should be provided; see + * mbedtls_rsa_private() for more. If \p mode is + * #MBEDTLS_RSA_PUBLIC, it is ignored. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a context. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PRIVATE or #MBEDTLS_RSA_PUBLIC (deprecated). + * \param label The buffer holding the custom label to use. + * This must be a readable buffer of length \p label_len + * Bytes. It may be \c NULL if \p label_len is \c 0. + * \param label_len The length of the label in Bytes. + * \param olen The address at which to store the length of + * the plaintext. This must not be \c NULL. + * \param input The ciphertext buffer. This must be a readable buffer + * of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * \param output The buffer used to hold the plaintext. This must + * be a writable buffer of length \p output_max_len Bytes. + * \param output_max_len The length in Bytes of the output buffer \p output. + * + * \return \c 0 on success. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsaes_oaep_decrypt( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + const unsigned char *label, size_t label_len, + size_t *olen, + const unsigned char *input, + unsigned char *output, + size_t output_max_len ); + +/** + * \brief This function performs a private RSA operation to sign + * a message digest using PKCS#1. + * + * It is the generic wrapper for performing a PKCS#1 + * signature using the \p mode from the context. + * + * \note The \p sig buffer must be as large as the size + * of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. + * + * \note For PKCS#1 v2.1 encoding, see comments on + * mbedtls_rsa_rsassa_pss_sign() for details on + * \p md_alg and \p hash_id. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PUBLIC mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PRIVATE. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PUBLIC and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function to use. If the padding mode is PKCS#1 v2.1, + * this must be provided. If the padding mode is PKCS#1 v1.5 and + * \p mode is #MBEDTLS_RSA_PRIVATE, it is used for blinding + * and should be provided; see mbedtls_rsa_private() for more + * more. It is ignored otherwise. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + * if \p f_rng is \c NULL or doesn't need a context argument. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PRIVATE or #MBEDTLS_RSA_PUBLIC (deprecated). + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest. + * Ths is only used if \p md_alg is #MBEDTLS_MD_NONE. + * \param hash The buffer holding the message digest or raw data. + * If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable + * buffer of length \p hashlen Bytes. If \p md_alg is not + * #MBEDTLS_MD_NONE, it must be a readable buffer of length + * the size of the hash corresponding to \p md_alg. + * \param sig The buffer to hold the signature. This must be a writable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. A buffer length of + * #MBEDTLS_MPI_MAX_SIZE is always safe. + * + * \return \c 0 if the signing operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_pkcs1_sign( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + unsigned char *sig ); + +/** + * \brief This function performs a PKCS#1 v1.5 signature + * operation (RSASSA-PKCS1-v1_5-SIGN). + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PUBLIC mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PRIVATE. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PUBLIC and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. If \p mode is #MBEDTLS_RSA_PRIVATE, + * this is used for blinding and should be provided; see + * mbedtls_rsa_private() for more. If \p mode is + * #MBEDTLS_RSA_PUBLIC, it is ignored. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + * if \p f_rng is \c NULL or doesn't need a context argument. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PRIVATE or #MBEDTLS_RSA_PUBLIC (deprecated). + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest. + * Ths is only used if \p md_alg is #MBEDTLS_MD_NONE. + * \param hash The buffer holding the message digest or raw data. + * If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable + * buffer of length \p hashlen Bytes. If \p md_alg is not + * #MBEDTLS_MD_NONE, it must be a readable buffer of length + * the size of the hash corresponding to \p md_alg. + * \param sig The buffer to hold the signature. This must be a writable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. A buffer length of + * #MBEDTLS_MPI_MAX_SIZE is always safe. + * + * \return \c 0 if the signing operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pkcs1_v15_sign( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + unsigned char *sig ); + +/** + * \brief This function performs a PKCS#1 v2.1 PSS signature + * operation (RSASSA-PSS-SIGN). + * + * \note The \c hash_id set in \p ctx (when calling + * mbedtls_rsa_init() or by calling mbedtls_rsa_set_padding() + * afterwards) selects the hash used for the + * encoding operation and for the mask generation function + * (MGF1). For more details on the encoding operation and the + * mask generation function, consult RFC-3447: Public-Key + * Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + * Specifications. + * + * \note This function enforces that the provided salt length complies + * with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 v2.2) §9.1.1 + * step 3. The constraint is that the hash length plus the salt + * length plus 2 bytes must be at most the key length. If this + * constraint is not met, this function returns + * #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. It must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + * if \p f_rng doesn't need a context argument. + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest. + * Ths is only used if \p md_alg is #MBEDTLS_MD_NONE. + * \param hash The buffer holding the message digest or raw data. + * If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable + * buffer of length \p hashlen Bytes. If \p md_alg is not + * #MBEDTLS_MD_NONE, it must be a readable buffer of length + * the size of the hash corresponding to \p md_alg. + * \param saltlen The length of the salt that should be used. + * If passed #MBEDTLS_RSA_SALT_LEN_ANY, the function will use + * the largest possible salt length up to the hash length, + * which is the largest permitted by some standards including + * FIPS 186-4 §5.5. + * \param sig The buffer to hold the signature. This must be a writable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. A buffer length of + * #MBEDTLS_MPI_MAX_SIZE is always safe. + * + * \return \c 0 if the signing operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pss_sign_ext( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + int saltlen, + unsigned char *sig ); + +/** + * \brief This function performs a PKCS#1 v2.1 PSS signature + * operation (RSASSA-PSS-SIGN). + * + * \note The \c hash_id set in \p ctx (when calling + * mbedtls_rsa_init() or by calling mbedtls_rsa_set_padding() + * afterwards) selects the hash used for the + * encoding operation and for the mask generation function + * (MGF1). For more details on the encoding operation and the + * mask generation function, consult RFC-3447: Public-Key + * Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + * Specifications. + * + * \note This function always uses the maximum possible salt size, + * up to the length of the payload hash. This choice of salt + * size complies with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 + * v2.2) §9.1.1 step 3. Furthermore this function enforces a + * minimum salt size which is the hash size minus 2 bytes. If + * this minimum size is too large given the key size (the salt + * size, plus the hash size, plus 2 bytes must be no more than + * the key size in bytes), this function returns + * #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PUBLIC mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PRIVATE. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PUBLIC and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA context to use. + * \param f_rng The RNG function. It must not be \c NULL. + * \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + * if \p f_rng doesn't need a context argument. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PRIVATE or #MBEDTLS_RSA_PUBLIC (deprecated). + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest. + * This is only used if \p md_alg is #MBEDTLS_MD_NONE. + * \param hash The buffer holding the message digest or raw data. + * If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable + * buffer of length \p hashlen Bytes. If \p md_alg is not + * #MBEDTLS_MD_NONE, it must be a readable buffer of length + * the size of the hash corresponding to \p md_alg. + * \param sig The buffer to hold the signature. This must be a writable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. A buffer length of + * #MBEDTLS_MPI_MAX_SIZE is always safe. + * + * \return \c 0 if the signing operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pss_sign( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + unsigned char *sig ); + +/** + * \brief This function performs a public RSA operation and checks + * the message digest. + * + * This is the generic wrapper for performing a PKCS#1 + * verification using the mode from the context. + * + * \note For PKCS#1 v2.1 encoding, see comments on + * mbedtls_rsa_rsassa_pss_verify() about \p md_alg and + * \p hash_id. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PRIVATE mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * set to #MBEDTLS_RSA_PUBLIC. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PRIVATE and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA public key context to use. + * \param f_rng The RNG function to use. If \p mode is #MBEDTLS_RSA_PRIVATE, + * this is used for blinding and should be provided; see + * mbedtls_rsa_private() for more. Otherwise, it is ignored. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a context. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE (deprecated). + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest. + * This is only used if \p md_alg is #MBEDTLS_MD_NONE. + * \param hash The buffer holding the message digest or raw data. + * If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable + * buffer of length \p hashlen Bytes. If \p md_alg is not + * #MBEDTLS_MD_NONE, it must be a readable buffer of length + * the size of the hash corresponding to \p md_alg. + * \param sig The buffer holding the signature. This must be a readable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 if the verify operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_pkcs1_verify( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + const unsigned char *sig ); + +/** + * \brief This function performs a PKCS#1 v1.5 verification + * operation (RSASSA-PKCS1-v1_5-VERIFY). + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PRIVATE mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * set to #MBEDTLS_RSA_PUBLIC. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PRIVATE and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA public key context to use. + * \param f_rng The RNG function to use. If \p mode is #MBEDTLS_RSA_PRIVATE, + * this is used for blinding and should be provided; see + * mbedtls_rsa_private() for more. Otherwise, it is ignored. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a context. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE (deprecated). + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest. + * This is only used if \p md_alg is #MBEDTLS_MD_NONE. + * \param hash The buffer holding the message digest or raw data. + * If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable + * buffer of length \p hashlen Bytes. If \p md_alg is not + * #MBEDTLS_MD_NONE, it must be a readable buffer of length + * the size of the hash corresponding to \p md_alg. + * \param sig The buffer holding the signature. This must be a readable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 if the verify operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pkcs1_v15_verify( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + const unsigned char *sig ); + +/** + * \brief This function performs a PKCS#1 v2.1 PSS verification + * operation (RSASSA-PSS-VERIFY). + * + * \note The \c hash_id set in \p ctx (when calling + * mbedtls_rsa_init() or by calling mbedtls_rsa_set_padding() + * afterwards) selects the hash used for the + * encoding operation and for the mask generation function + * (MGF1). For more details on the encoding operation and the + * mask generation function, consult RFC-3447: Public-Key + * Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + * Specifications. If the \c hash_id set in \p ctx is + * #MBEDTLS_MD_NONE, the \p md_alg parameter is used. + * + * \deprecated It is deprecated and discouraged to call this function + * in #MBEDTLS_RSA_PRIVATE mode. Future versions of the library + * are likely to remove the \p mode argument and have it + * implicitly set to #MBEDTLS_RSA_PUBLIC. + * + * \note Alternative implementations of RSA need not support + * mode being set to #MBEDTLS_RSA_PRIVATE and might instead + * return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED. + * + * \param ctx The initialized RSA public key context to use. + * \param f_rng The RNG function to use. If \p mode is #MBEDTLS_RSA_PRIVATE, + * this is used for blinding and should be provided; see + * mbedtls_rsa_private() for more. Otherwise, it is ignored. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a context. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE (deprecated). + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest. + * This is only used if \p md_alg is #MBEDTLS_MD_NONE. + * \param hash The buffer holding the message digest or raw data. + * If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable + * buffer of length \p hashlen Bytes. If \p md_alg is not + * #MBEDTLS_MD_NONE, it must be a readable buffer of length + * the size of the hash corresponding to \p md_alg. + * \param sig The buffer holding the signature. This must be a readable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 if the verify operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pss_verify( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + const unsigned char *sig ); + +/** + * \brief This function performs a PKCS#1 v2.1 PSS verification + * operation (RSASSA-PSS-VERIFY). + * + * \note The \p sig buffer must be as large as the size + * of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. + * + * \note The \c hash_id set in \p ctx (when calling + * mbedtls_rsa_init() or by calling mbedtls_rsa_set_padding() + * afterwards) is ignored. + * + * \param ctx The initialized RSA public key context to use. + * \param f_rng The RNG function to use. If \p mode is #MBEDTLS_RSA_PRIVATE, + * this is used for blinding and should be provided; see + * mbedtls_rsa_private() for more. Otherwise, it is ignored. + * \param p_rng The RNG context to be passed to \p f_rng. This may be + * \c NULL if \p f_rng is \c NULL or doesn't need a context. + * \param mode The mode of operation. This must be either + * #MBEDTLS_RSA_PUBLIC or #MBEDTLS_RSA_PRIVATE. + * \param md_alg The message-digest algorithm used to hash the original data. + * Use #MBEDTLS_MD_NONE for signing raw data. + * \param hashlen The length of the message digest. + * This is only used if \p md_alg is #MBEDTLS_MD_NONE. + * \param hash The buffer holding the message digest or raw data. + * If \p md_alg is #MBEDTLS_MD_NONE, this must be a readable + * buffer of length \p hashlen Bytes. If \p md_alg is not + * #MBEDTLS_MD_NONE, it must be a readable buffer of length + * the size of the hash corresponding to \p md_alg. + * \param mgf1_hash_id The message digest algorithm used for the + * verification operation and the mask generation + * function (MGF1). For more details on the encoding + * operation and the mask generation function, consult + * RFC-3447: Public-Key Cryptography Standards + * (PKCS) #1 v2.1: RSA Cryptography + * Specifications. + * \param expected_salt_len The length of the salt used in padding. Use + * #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. + * \param sig The buffer holding the signature. This must be a readable + * buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + * for an 2048-bit RSA modulus. + * + * \return \c 0 if the verify operation was successful. + * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + */ +int mbedtls_rsa_rsassa_pss_verify_ext( mbedtls_rsa_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng, + int mode, + mbedtls_md_type_t md_alg, + unsigned int hashlen, + const unsigned char *hash, + mbedtls_md_type_t mgf1_hash_id, + int expected_salt_len, + const unsigned char *sig ); + +/** + * \brief This function copies the components of an RSA context. + * + * \param dst The destination context. This must be initialized. + * \param src The source context. This must be initialized. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory allocation failure. + */ +int mbedtls_rsa_copy( mbedtls_rsa_context *dst, const mbedtls_rsa_context *src ); + +/** + * \brief This function frees the components of an RSA key. + * + * \param ctx The RSA context to free. May be \c NULL, in which case + * this function is a no-op. If it is not \c NULL, it must + * point to an initialized RSA context. + */ +void mbedtls_rsa_free( mbedtls_rsa_context *ctx ); + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The RSA checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_rsa_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* rsa.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/rsa_internal.h b/openharmony/armeabi-v7a/include/mbedtls/rsa_internal.h new file mode 100644 index 00000000..d55492bb --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/rsa_internal.h @@ -0,0 +1,224 @@ +/** + * \file rsa_internal.h + * + * \brief Context-independent RSA helper functions + * + * This module declares some RSA-related helper functions useful when + * implementing the RSA interface. These functions are provided in a separate + * compilation unit in order to make it easy for designers of alternative RSA + * implementations to use them in their own code, as it is conceived that the + * functionality they provide will be necessary for most complete + * implementations. + * + * End-users of Mbed TLS who are not providing their own alternative RSA + * implementations should not use these functions directly, and should instead + * use only the functions declared in rsa.h. + * + * The interface provided by this module will be maintained through LTS (Long + * Term Support) branches of Mbed TLS, but may otherwise be subject to change, + * and must be considered an internal interface of the library. + * + * There are two classes of helper functions: + * + * (1) Parameter-generating helpers. These are: + * - mbedtls_rsa_deduce_primes + * - mbedtls_rsa_deduce_private_exponent + * - mbedtls_rsa_deduce_crt + * Each of these functions takes a set of core RSA parameters and + * generates some other, or CRT related parameters. + * + * (2) Parameter-checking helpers. These are: + * - mbedtls_rsa_validate_params + * - mbedtls_rsa_validate_crt + * They take a set of core or CRT related RSA parameters and check their + * validity. + * + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ + +#ifndef MBEDTLS_RSA_INTERNAL_H +#define MBEDTLS_RSA_INTERNAL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/bignum.h" + +#ifdef __cplusplus +extern "C" { +#endif + + +/** + * \brief Compute RSA prime moduli P, Q from public modulus N=PQ + * and a pair of private and public key. + * + * \note This is a 'static' helper function not operating on + * an RSA context. Alternative implementations need not + * overwrite it. + * + * \param N RSA modulus N = PQ, with P, Q to be found + * \param E RSA public exponent + * \param D RSA private exponent + * \param P Pointer to MPI holding first prime factor of N on success + * \param Q Pointer to MPI holding second prime factor of N on success + * + * \return + * - 0 if successful. In this case, P and Q constitute a + * factorization of N. + * - A non-zero error code otherwise. + * + * \note It is neither checked that P, Q are prime nor that + * D, E are modular inverses wrt. P-1 and Q-1. For that, + * use the helper function \c mbedtls_rsa_validate_params. + * + */ +int mbedtls_rsa_deduce_primes( mbedtls_mpi const *N, mbedtls_mpi const *E, + mbedtls_mpi const *D, + mbedtls_mpi *P, mbedtls_mpi *Q ); + +/** + * \brief Compute RSA private exponent from + * prime moduli and public key. + * + * \note This is a 'static' helper function not operating on + * an RSA context. Alternative implementations need not + * overwrite it. + * + * \param P First prime factor of RSA modulus + * \param Q Second prime factor of RSA modulus + * \param E RSA public exponent + * \param D Pointer to MPI holding the private exponent on success. + * + * \return + * - 0 if successful. In this case, D is set to a simultaneous + * modular inverse of E modulo both P-1 and Q-1. + * - A non-zero error code otherwise. + * + * \note This function does not check whether P and Q are primes. + * + */ +int mbedtls_rsa_deduce_private_exponent( mbedtls_mpi const *P, + mbedtls_mpi const *Q, + mbedtls_mpi const *E, + mbedtls_mpi *D ); + + +/** + * \brief Generate RSA-CRT parameters + * + * \note This is a 'static' helper function not operating on + * an RSA context. Alternative implementations need not + * overwrite it. + * + * \param P First prime factor of N + * \param Q Second prime factor of N + * \param D RSA private exponent + * \param DP Output variable for D modulo P-1 + * \param DQ Output variable for D modulo Q-1 + * \param QP Output variable for the modular inverse of Q modulo P. + * + * \return 0 on success, non-zero error code otherwise. + * + * \note This function does not check whether P, Q are + * prime and whether D is a valid private exponent. + * + */ +int mbedtls_rsa_deduce_crt( const mbedtls_mpi *P, const mbedtls_mpi *Q, + const mbedtls_mpi *D, mbedtls_mpi *DP, + mbedtls_mpi *DQ, mbedtls_mpi *QP ); + + +/** + * \brief Check validity of core RSA parameters + * + * \note This is a 'static' helper function not operating on + * an RSA context. Alternative implementations need not + * overwrite it. + * + * \param N RSA modulus N = PQ + * \param P First prime factor of N + * \param Q Second prime factor of N + * \param D RSA private exponent + * \param E RSA public exponent + * \param f_rng PRNG to be used for primality check, or NULL + * \param p_rng PRNG context for f_rng, or NULL + * + * \return + * - 0 if the following conditions are satisfied + * if all relevant parameters are provided: + * - P prime if f_rng != NULL (%) + * - Q prime if f_rng != NULL (%) + * - 1 < N = P * Q + * - 1 < D, E < N + * - D and E are modular inverses modulo P-1 and Q-1 + * (%) This is only done if MBEDTLS_GENPRIME is defined. + * - A non-zero error code otherwise. + * + * \note The function can be used with a restricted set of arguments + * to perform specific checks only. E.g., calling it with + * (-,P,-,-,-) and a PRNG amounts to a primality check for P. + */ +int mbedtls_rsa_validate_params( const mbedtls_mpi *N, const mbedtls_mpi *P, + const mbedtls_mpi *Q, const mbedtls_mpi *D, + const mbedtls_mpi *E, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief Check validity of RSA CRT parameters + * + * \note This is a 'static' helper function not operating on + * an RSA context. Alternative implementations need not + * overwrite it. + * + * \param P First prime factor of RSA modulus + * \param Q Second prime factor of RSA modulus + * \param D RSA private exponent + * \param DP MPI to check for D modulo P-1 + * \param DQ MPI to check for D modulo P-1 + * \param QP MPI to check for the modular inverse of Q modulo P. + * + * \return + * - 0 if the following conditions are satisfied: + * - D = DP mod P-1 if P, D, DP != NULL + * - Q = DQ mod P-1 if P, D, DQ != NULL + * - QP = Q^-1 mod P if P, Q, QP != NULL + * - \c MBEDTLS_ERR_RSA_KEY_CHECK_FAILED if check failed, + * potentially including \c MBEDTLS_ERR_MPI_XXX if some + * MPI calculations failed. + * - \c MBEDTLS_ERR_RSA_BAD_INPUT_DATA if insufficient + * data was provided to check DP, DQ or QP. + * + * \note The function can be used with a restricted set of arguments + * to perform specific checks only. E.g., calling it with the + * parameters (P, -, D, DP, -, -) will check DP = D mod P-1. + */ +int mbedtls_rsa_validate_crt( const mbedtls_mpi *P, const mbedtls_mpi *Q, + const mbedtls_mpi *D, const mbedtls_mpi *DP, + const mbedtls_mpi *DQ, const mbedtls_mpi *QP ); + +#ifdef __cplusplus +} +#endif + +#endif /* rsa_internal.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/sha1.h b/openharmony/armeabi-v7a/include/mbedtls/sha1.h new file mode 100644 index 00000000..4c3251b4 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/sha1.h @@ -0,0 +1,352 @@ +/** + * \file sha1.h + * + * \brief This file contains SHA-1 definitions and functions. + * + * The Secure Hash Algorithm 1 (SHA-1) cryptographic hash function is defined in + * FIPS 180-4: Secure Hash Standard (SHS). + * + * \warning SHA-1 is considered a weak message digest and its use constitutes + * a security risk. We recommend considering stronger message + * digests instead. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SHA1_H +#define MBEDTLS_SHA1_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +/* MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** SHA-1 hardware accelerator failed */ +#define MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED -0x0035 +/** SHA-1 input data was malformed. */ +#define MBEDTLS_ERR_SHA1_BAD_INPUT_DATA -0x0073 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_SHA1_ALT) +// Regular implementation +// + +/** + * \brief The SHA-1 context structure. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + */ +typedef struct mbedtls_sha1_context +{ + uint32_t total[2]; /*!< The number of Bytes processed. */ + uint32_t state[5]; /*!< The intermediate digest state. */ + unsigned char buffer[64]; /*!< The data block being processed. */ +} +mbedtls_sha1_context; + +#else /* MBEDTLS_SHA1_ALT */ +#include "sha1_alt.h" +#endif /* MBEDTLS_SHA1_ALT */ + +/** + * \brief This function initializes a SHA-1 context. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context to initialize. + * This must not be \c NULL. + * + */ +void mbedtls_sha1_init( mbedtls_sha1_context *ctx ); + +/** + * \brief This function clears a SHA-1 context. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context to clear. This may be \c NULL, + * in which case this function does nothing. If it is + * not \c NULL, it must point to an initialized + * SHA-1 context. + * + */ +void mbedtls_sha1_free( mbedtls_sha1_context *ctx ); + +/** + * \brief This function clones the state of a SHA-1 context. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param dst The SHA-1 context to clone to. This must be initialized. + * \param src The SHA-1 context to clone from. This must be initialized. + * + */ +void mbedtls_sha1_clone( mbedtls_sha1_context *dst, + const mbedtls_sha1_context *src ); + +/** + * \brief This function starts a SHA-1 checksum calculation. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context to initialize. This must be initialized. + * + * \return \c 0 on success. + * \return A negative error code on failure. + * + */ +int mbedtls_sha1_starts_ret( mbedtls_sha1_context *ctx ); + +/** + * \brief This function feeds an input buffer into an ongoing SHA-1 + * checksum calculation. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context. This must be initialized + * and have a hash operation started. + * \param input The buffer holding the input data. + * This must be a readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data \p input in Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha1_update_ret( mbedtls_sha1_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief This function finishes the SHA-1 operation, and writes + * the result to the output buffer. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context to use. This must be initialized and + * have a hash operation started. + * \param output The SHA-1 checksum result. This must be a writable + * buffer of length \c 20 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha1_finish_ret( mbedtls_sha1_context *ctx, + unsigned char output[20] ); + +/** + * \brief SHA-1 process data block (internal use only). + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param ctx The SHA-1 context to use. This must be initialized. + * \param data The data block being processed. This must be a + * readable buffer of length \c 64 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + * + */ +int mbedtls_internal_sha1_process( mbedtls_sha1_context *ctx, + const unsigned char data[64] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function starts a SHA-1 checksum calculation. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \deprecated Superseded by mbedtls_sha1_starts_ret() in 2.7.0. + * + * \param ctx The SHA-1 context to initialize. This must be initialized. + * + */ +MBEDTLS_DEPRECATED void mbedtls_sha1_starts( mbedtls_sha1_context *ctx ); + +/** + * \brief This function feeds an input buffer into an ongoing SHA-1 + * checksum calculation. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \deprecated Superseded by mbedtls_sha1_update_ret() in 2.7.0. + * + * \param ctx The SHA-1 context. This must be initialized and + * have a hash operation started. + * \param input The buffer holding the input data. + * This must be a readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data \p input in Bytes. + * + */ +MBEDTLS_DEPRECATED void mbedtls_sha1_update( mbedtls_sha1_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief This function finishes the SHA-1 operation, and writes + * the result to the output buffer. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \deprecated Superseded by mbedtls_sha1_finish_ret() in 2.7.0. + * + * \param ctx The SHA-1 context. This must be initialized and + * have a hash operation started. + * \param output The SHA-1 checksum result. + * This must be a writable buffer of length \c 20 Bytes. + */ +MBEDTLS_DEPRECATED void mbedtls_sha1_finish( mbedtls_sha1_context *ctx, + unsigned char output[20] ); + +/** + * \brief SHA-1 process data block (internal use only). + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \deprecated Superseded by mbedtls_internal_sha1_process() in 2.7.0. + * + * \param ctx The SHA-1 context. This must be initialized. + * \param data The data block being processed. + * This must be a readable buffer of length \c 64 bytes. + * + */ +MBEDTLS_DEPRECATED void mbedtls_sha1_process( mbedtls_sha1_context *ctx, + const unsigned char data[64] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief This function calculates the SHA-1 checksum of a buffer. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The SHA-1 result is calculated as + * output = SHA-1(input buffer). + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \param input The buffer holding the input data. + * This must be a readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data \p input in Bytes. + * \param output The SHA-1 checksum result. + * This must be a writable buffer of length \c 20 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + * + */ +int mbedtls_sha1_ret( const unsigned char *input, + size_t ilen, + unsigned char output[20] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function calculates the SHA-1 checksum of a buffer. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The SHA-1 result is calculated as + * output = SHA-1(input buffer). + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \deprecated Superseded by mbedtls_sha1_ret() in 2.7.0 + * + * \param input The buffer holding the input data. + * This must be a readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data \p input in Bytes. + * \param output The SHA-1 checksum result. This must be a writable + * buffer of size \c 20 Bytes. + * + */ +MBEDTLS_DEPRECATED void mbedtls_sha1( const unsigned char *input, + size_t ilen, + unsigned char output[20] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The SHA-1 checkup routine. + * + * \warning SHA-1 is considered a weak message digest and its use + * constitutes a security risk. We recommend considering + * stronger message digests instead. + * + * \return \c 0 on success. + * \return \c 1 on failure. + * + */ +int mbedtls_sha1_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_sha1.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/sha256.h b/openharmony/armeabi-v7a/include/mbedtls/sha256.h new file mode 100644 index 00000000..5b54be21 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/sha256.h @@ -0,0 +1,300 @@ +/** + * \file sha256.h + * + * \brief This file contains SHA-224 and SHA-256 definitions and functions. + * + * The Secure Hash Algorithms 224 and 256 (SHA-224 and SHA-256) cryptographic + * hash functions are defined in FIPS 180-4: Secure Hash Standard (SHS). + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SHA256_H +#define MBEDTLS_SHA256_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +/* MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** SHA-256 hardware accelerator failed */ +#define MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED -0x0037 +/** SHA-256 input data was malformed. */ +#define MBEDTLS_ERR_SHA256_BAD_INPUT_DATA -0x0074 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_SHA256_ALT) +// Regular implementation +// + +/** + * \brief The SHA-256 context structure. + * + * The structure is used both for SHA-256 and for SHA-224 + * checksum calculations. The choice between these two is + * made in the call to mbedtls_sha256_starts_ret(). + */ +typedef struct mbedtls_sha256_context +{ + uint32_t total[2]; /*!< The number of Bytes processed. */ + uint32_t state[8]; /*!< The intermediate digest state. */ + unsigned char buffer[64]; /*!< The data block being processed. */ + int is224; /*!< Determines which function to use: + 0: Use SHA-256, or 1: Use SHA-224. */ +} +mbedtls_sha256_context; + +#else /* MBEDTLS_SHA256_ALT */ +#include "sha256_alt.h" +#endif /* MBEDTLS_SHA256_ALT */ + +/** + * \brief This function initializes a SHA-256 context. + * + * \param ctx The SHA-256 context to initialize. This must not be \c NULL. + */ +void mbedtls_sha256_init( mbedtls_sha256_context *ctx ); + +/** + * \brief This function clears a SHA-256 context. + * + * \param ctx The SHA-256 context to clear. This may be \c NULL, in which + * case this function returns immediately. If it is not \c NULL, + * it must point to an initialized SHA-256 context. + */ +void mbedtls_sha256_free( mbedtls_sha256_context *ctx ); + +/** + * \brief This function clones the state of a SHA-256 context. + * + * \param dst The destination context. This must be initialized. + * \param src The context to clone. This must be initialized. + */ +void mbedtls_sha256_clone( mbedtls_sha256_context *dst, + const mbedtls_sha256_context *src ); + +/** + * \brief This function starts a SHA-224 or SHA-256 checksum + * calculation. + * + * \param ctx The context to use. This must be initialized. + * \param is224 This determines which function to use. This must be + * either \c 0 for SHA-256, or \c 1 for SHA-224. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha256_starts_ret( mbedtls_sha256_context *ctx, int is224 ); + +/** + * \brief This function feeds an input buffer into an ongoing + * SHA-256 checksum calculation. + * + * \param ctx The SHA-256 context. This must be initialized + * and have a hash operation started. + * \param input The buffer holding the data. This must be a readable + * buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha256_update_ret( mbedtls_sha256_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief This function finishes the SHA-256 operation, and writes + * the result to the output buffer. + * + * \param ctx The SHA-256 context. This must be initialized + * and have a hash operation started. + * \param output The SHA-224 or SHA-256 checksum result. + * This must be a writable buffer of length \c 32 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha256_finish_ret( mbedtls_sha256_context *ctx, + unsigned char output[32] ); + +/** + * \brief This function processes a single data block within + * the ongoing SHA-256 computation. This function is for + * internal use only. + * + * \param ctx The SHA-256 context. This must be initialized. + * \param data The buffer holding one block of data. This must + * be a readable buffer of length \c 64 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_internal_sha256_process( mbedtls_sha256_context *ctx, + const unsigned char data[64] ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function starts a SHA-224 or SHA-256 checksum + * calculation. + * + * \deprecated Superseded by mbedtls_sha256_starts_ret() in 2.7.0. + * + * \param ctx The context to use. This must be initialized. + * \param is224 Determines which function to use. This must be + * either \c 0 for SHA-256, or \c 1 for SHA-224. + */ +MBEDTLS_DEPRECATED void mbedtls_sha256_starts( mbedtls_sha256_context *ctx, + int is224 ); + +/** + * \brief This function feeds an input buffer into an ongoing + * SHA-256 checksum calculation. + * + * \deprecated Superseded by mbedtls_sha256_update_ret() in 2.7.0. + * + * \param ctx The SHA-256 context to use. This must be + * initialized and have a hash operation started. + * \param input The buffer holding the data. This must be a readable + * buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + */ +MBEDTLS_DEPRECATED void mbedtls_sha256_update( mbedtls_sha256_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief This function finishes the SHA-256 operation, and writes + * the result to the output buffer. + * + * \deprecated Superseded by mbedtls_sha256_finish_ret() in 2.7.0. + * + * \param ctx The SHA-256 context. This must be initialized and + * have a hash operation started. + * \param output The SHA-224 or SHA-256 checksum result. This must be + * a writable buffer of length \c 32 Bytes. + */ +MBEDTLS_DEPRECATED void mbedtls_sha256_finish( mbedtls_sha256_context *ctx, + unsigned char output[32] ); + +/** + * \brief This function processes a single data block within + * the ongoing SHA-256 computation. This function is for + * internal use only. + * + * \deprecated Superseded by mbedtls_internal_sha256_process() in 2.7.0. + * + * \param ctx The SHA-256 context. This must be initialized. + * \param data The buffer holding one block of data. This must be + * a readable buffer of size \c 64 Bytes. + */ +MBEDTLS_DEPRECATED void mbedtls_sha256_process( mbedtls_sha256_context *ctx, + const unsigned char data[64] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief This function calculates the SHA-224 or SHA-256 + * checksum of a buffer. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The SHA-256 result is calculated as + * output = SHA-256(input buffer). + * + * \param input The buffer holding the data. This must be a readable + * buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * \param output The SHA-224 or SHA-256 checksum result. This must + * be a writable buffer of length \c 32 Bytes. + * \param is224 Determines which function to use. This must be + * either \c 0 for SHA-256, or \c 1 for SHA-224. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha256_ret( const unsigned char *input, + size_t ilen, + unsigned char output[32], + int is224 ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif + +/** + * \brief This function calculates the SHA-224 or SHA-256 checksum + * of a buffer. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The SHA-256 result is calculated as + * output = SHA-256(input buffer). + * + * \deprecated Superseded by mbedtls_sha256_ret() in 2.7.0. + * + * \param input The buffer holding the data. This must be a readable + * buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * \param output The SHA-224 or SHA-256 checksum result. This must be + * a writable buffer of length \c 32 Bytes. + * \param is224 Determines which function to use. This must be either + * \c 0 for SHA-256, or \c 1 for SHA-224. + */ +MBEDTLS_DEPRECATED void mbedtls_sha256( const unsigned char *input, + size_t ilen, + unsigned char output[32], + int is224 ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief The SHA-224 and SHA-256 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_sha256_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_sha256.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/sha512.h b/openharmony/armeabi-v7a/include/mbedtls/sha512.h new file mode 100644 index 00000000..cca47c2f --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/sha512.h @@ -0,0 +1,316 @@ +/** + * \file sha512.h + * \brief This file contains SHA-384 and SHA-512 definitions and functions. + * + * The Secure Hash Algorithms 384 and 512 (SHA-384 and SHA-512) cryptographic + * hash functions are defined in FIPS 180-4: Secure Hash Standard (SHS). + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SHA512_H +#define MBEDTLS_SHA512_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +/* MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** SHA-512 hardware accelerator failed */ +#define MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED -0x0039 +/** SHA-512 input data was malformed. */ +#define MBEDTLS_ERR_SHA512_BAD_INPUT_DATA -0x0075 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_SHA512_ALT) +// Regular implementation +// + +/** + * \brief The SHA-512 context structure. + * + * The structure is used both for SHA-384 and for SHA-512 + * checksum calculations. The choice between these two is + * made in the call to mbedtls_sha512_starts_ret(). + */ +typedef struct mbedtls_sha512_context +{ + uint64_t total[2]; /*!< The number of Bytes processed. */ + uint64_t state[8]; /*!< The intermediate digest state. */ + unsigned char buffer[128]; /*!< The data block being processed. */ +#if !defined(MBEDTLS_SHA512_NO_SHA384) + int is384; /*!< Determines which function to use: + 0: Use SHA-512, or 1: Use SHA-384. */ +#endif +} +mbedtls_sha512_context; + +#else /* MBEDTLS_SHA512_ALT */ +#include "sha512_alt.h" +#endif /* MBEDTLS_SHA512_ALT */ + +/** + * \brief This function initializes a SHA-512 context. + * + * \param ctx The SHA-512 context to initialize. This must + * not be \c NULL. + */ +void mbedtls_sha512_init( mbedtls_sha512_context *ctx ); + +/** + * \brief This function clears a SHA-512 context. + * + * \param ctx The SHA-512 context to clear. This may be \c NULL, + * in which case this function does nothing. If it + * is not \c NULL, it must point to an initialized + * SHA-512 context. + */ +void mbedtls_sha512_free( mbedtls_sha512_context *ctx ); + +/** + * \brief This function clones the state of a SHA-512 context. + * + * \param dst The destination context. This must be initialized. + * \param src The context to clone. This must be initialized. + */ +void mbedtls_sha512_clone( mbedtls_sha512_context *dst, + const mbedtls_sha512_context *src ); + +/** + * \brief This function starts a SHA-384 or SHA-512 checksum + * calculation. + * + * \param ctx The SHA-512 context to use. This must be initialized. + * \param is384 Determines which function to use. This must be + * either \c 0 for SHA-512, or \c 1 for SHA-384. + * + * \note When \c MBEDTLS_SHA512_NO_SHA384 is defined, \p is384 must + * be \c 0, or the function will return + * #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha512_starts_ret( mbedtls_sha512_context *ctx, int is384 ); + +/** + * \brief This function feeds an input buffer into an ongoing + * SHA-512 checksum calculation. + * + * \param ctx The SHA-512 context. This must be initialized + * and have a hash operation started. + * \param input The buffer holding the input data. This must + * be a readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha512_update_ret( mbedtls_sha512_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief This function finishes the SHA-512 operation, and writes + * the result to the output buffer. + * + * \param ctx The SHA-512 context. This must be initialized + * and have a hash operation started. + * \param output The SHA-384 or SHA-512 checksum result. + * This must be a writable buffer of length \c 64 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha512_finish_ret( mbedtls_sha512_context *ctx, + unsigned char output[64] ); + +/** + * \brief This function processes a single data block within + * the ongoing SHA-512 computation. + * This function is for internal use only. + * + * \param ctx The SHA-512 context. This must be initialized. + * \param data The buffer holding one block of data. This + * must be a readable buffer of length \c 128 Bytes. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_internal_sha512_process( mbedtls_sha512_context *ctx, + const unsigned char data[128] ); +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif +/** + * \brief This function starts a SHA-384 or SHA-512 checksum + * calculation. + * + * \deprecated Superseded by mbedtls_sha512_starts_ret() in 2.7.0 + * + * \param ctx The SHA-512 context to use. This must be initialized. + * \param is384 Determines which function to use. This must be either + * \c 0 for SHA-512 or \c 1 for SHA-384. + * + * \note When \c MBEDTLS_SHA512_NO_SHA384 is defined, \p is384 must + * be \c 0, or the function will fail to work. + */ +MBEDTLS_DEPRECATED void mbedtls_sha512_starts( mbedtls_sha512_context *ctx, + int is384 ); + +/** + * \brief This function feeds an input buffer into an ongoing + * SHA-512 checksum calculation. + * + * \deprecated Superseded by mbedtls_sha512_update_ret() in 2.7.0. + * + * \param ctx The SHA-512 context. This must be initialized + * and have a hash operation started. + * \param input The buffer holding the data. This must be a readable + * buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + */ +MBEDTLS_DEPRECATED void mbedtls_sha512_update( mbedtls_sha512_context *ctx, + const unsigned char *input, + size_t ilen ); + +/** + * \brief This function finishes the SHA-512 operation, and writes + * the result to the output buffer. + * + * \deprecated Superseded by mbedtls_sha512_finish_ret() in 2.7.0. + * + * \param ctx The SHA-512 context. This must be initialized + * and have a hash operation started. + * \param output The SHA-384 or SHA-512 checksum result. This must + * be a writable buffer of size \c 64 Bytes. + */ +MBEDTLS_DEPRECATED void mbedtls_sha512_finish( mbedtls_sha512_context *ctx, + unsigned char output[64] ); + +/** + * \brief This function processes a single data block within + * the ongoing SHA-512 computation. This function is for + * internal use only. + * + * \deprecated Superseded by mbedtls_internal_sha512_process() in 2.7.0. + * + * \param ctx The SHA-512 context. This must be initialized. + * \param data The buffer holding one block of data. This must be + * a readable buffer of length \c 128 Bytes. + */ +MBEDTLS_DEPRECATED void mbedtls_sha512_process( + mbedtls_sha512_context *ctx, + const unsigned char data[128] ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief This function calculates the SHA-512 or SHA-384 + * checksum of a buffer. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The SHA-512 result is calculated as + * output = SHA-512(input buffer). + * + * \param input The buffer holding the input data. This must be + * a readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * \param output The SHA-384 or SHA-512 checksum result. + * This must be a writable buffer of length \c 64 Bytes. + * \param is384 Determines which function to use. This must be either + * \c 0 for SHA-512, or \c 1 for SHA-384. + * + * \note When \c MBEDTLS_SHA512_NO_SHA384 is defined, \p is384 must + * be \c 0, or the function will return + * #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_sha512_ret( const unsigned char *input, + size_t ilen, + unsigned char output[64], + int is384 ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif + +/** + * \brief This function calculates the SHA-512 or SHA-384 + * checksum of a buffer. + * + * The function allocates the context, performs the + * calculation, and frees the context. + * + * The SHA-512 result is calculated as + * output = SHA-512(input buffer). + * + * \deprecated Superseded by mbedtls_sha512_ret() in 2.7.0 + * + * \param input The buffer holding the data. This must be a + * readable buffer of length \p ilen Bytes. + * \param ilen The length of the input data in Bytes. + * \param output The SHA-384 or SHA-512 checksum result. This must + * be a writable buffer of length \c 64 Bytes. + * \param is384 Determines which function to use. This must be either + * \c 0 for SHA-512, or \c 1 for SHA-384. + * + * \note When \c MBEDTLS_SHA512_NO_SHA384 is defined, \p is384 must + * be \c 0, or the function will fail to work. + */ +MBEDTLS_DEPRECATED void mbedtls_sha512( const unsigned char *input, + size_t ilen, + unsigned char output[64], + int is384 ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#if defined(MBEDTLS_SELF_TEST) + + /** + * \brief The SHA-384 or SHA-512 checkup routine. + * + * \return \c 0 on success. + * \return \c 1 on failure. + */ +int mbedtls_sha512_self_test( int verbose ); +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_sha512.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/ssl.h b/openharmony/armeabi-v7a/include/mbedtls/ssl.h new file mode 100644 index 00000000..5064ec56 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/ssl.h @@ -0,0 +1,4427 @@ +/** + * \file ssl.h + * + * \brief SSL/TLS functions. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SSL_H +#define MBEDTLS_SSL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/bignum.h" +#include "mbedtls/ecp.h" + +#include "mbedtls/ssl_ciphersuites.h" + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +#include "mbedtls/x509_crt.h" +#include "mbedtls/x509_crl.h" +#endif + +#if defined(MBEDTLS_DHM_C) +#include "mbedtls/dhm.h" +#endif + +/* Adding guard for MBEDTLS_ECDSA_C to ensure no compile errors due + * to guards also being in ssl_srv.c and ssl_cli.c. There is a gap + * in functionality that access to ecdh_ctx structure is needed for + * MBEDTLS_ECDSA_C which does not seem correct. + */ +#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) +#include "mbedtls/ecdh.h" +#endif + +#if defined(MBEDTLS_ZLIB_SUPPORT) + +#if defined(MBEDTLS_DEPRECATED_WARNING) +#warning "Record compression support via MBEDTLS_ZLIB_SUPPORT is deprecated and will be removed in the next major revision of the library" +#endif + +#if defined(MBEDTLS_DEPRECATED_REMOVED) +#error "Record compression support via MBEDTLS_ZLIB_SUPPORT is deprecated and cannot be used if MBEDTLS_DEPRECATED_REMOVED is set" +#endif + +#include "zlib.h" +#endif + +#if defined(MBEDTLS_HAVE_TIME) +#include "mbedtls/platform_time.h" +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#include "psa/crypto.h" +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +/* + * SSL Error codes + */ +/** The requested feature is not available. */ +#define MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE -0x7080 +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_SSL_BAD_INPUT_DATA -0x7100 +/** Verification of the message MAC failed. */ +#define MBEDTLS_ERR_SSL_INVALID_MAC -0x7180 +/** An invalid SSL record was received. */ +#define MBEDTLS_ERR_SSL_INVALID_RECORD -0x7200 +/** The connection indicated an EOF. */ +#define MBEDTLS_ERR_SSL_CONN_EOF -0x7280 +/** An unknown cipher was received. */ +#define MBEDTLS_ERR_SSL_UNKNOWN_CIPHER -0x7300 +/** The server has no ciphersuites in common with the client. */ +#define MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN -0x7380 +/** No RNG was provided to the SSL module. */ +#define MBEDTLS_ERR_SSL_NO_RNG -0x7400 +/** No client certification received from the client, but required by the authentication mode. */ +#define MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE -0x7480 +/** Our own certificate(s) is/are too large to send in an SSL message. */ +#define MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE -0x7500 +/** The own certificate is not set, but needed by the server. */ +#define MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED -0x7580 +/** The own private key or pre-shared key is not set, but needed. */ +#define MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED -0x7600 +/** No CA Chain is set, but required to operate. */ +#define MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED -0x7680 +/** An unexpected message was received from our peer. */ +#define MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE -0x7700 +/** A fatal alert message was received from our peer. */ +#define MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE -0x7780 +/** Verification of our peer failed. */ +#define MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED -0x7800 +/** The peer notified us that the connection is going to be closed. */ +#define MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY -0x7880 +/** Processing of the ClientHello handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO -0x7900 +/** Processing of the ServerHello handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO -0x7980 +/** Processing of the Certificate handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE -0x7A00 +/** Processing of the CertificateRequest handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST -0x7A80 +/** Processing of the ServerKeyExchange handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE -0x7B00 +/** Processing of the ServerHelloDone handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE -0x7B80 +/** Processing of the ClientKeyExchange handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE -0x7C00 +/** Processing of the ClientKeyExchange handshake message failed in DHM / ECDH Read Public. */ +#define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP -0x7C80 +/** Processing of the ClientKeyExchange handshake message failed in DHM / ECDH Calculate Secret. */ +#define MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS -0x7D00 +/** Processing of the CertificateVerify handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY -0x7D80 +/** Processing of the ChangeCipherSpec handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC -0x7E00 +/** Processing of the Finished handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_FINISHED -0x7E80 +/** Memory allocation failed */ +#define MBEDTLS_ERR_SSL_ALLOC_FAILED -0x7F00 +/** Hardware acceleration function returned with error */ +#define MBEDTLS_ERR_SSL_HW_ACCEL_FAILED -0x7F80 +/** Hardware acceleration function skipped / left alone data */ +#define MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH -0x6F80 +/** Processing of the compression / decompression failed */ +#define MBEDTLS_ERR_SSL_COMPRESSION_FAILED -0x6F00 +/** Handshake protocol not within min/max boundaries */ +#define MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION -0x6E80 +/** Processing of the NewSessionTicket handshake message failed. */ +#define MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET -0x6E00 +/** Session ticket has expired. */ +#define MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED -0x6D80 +/** Public key type mismatch (eg, asked for RSA key exchange and presented EC key) */ +#define MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH -0x6D00 +/** Unknown identity received (eg, PSK identity) */ +#define MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY -0x6C80 +/** Internal error (eg, unexpected failure in lower-level module) */ +#define MBEDTLS_ERR_SSL_INTERNAL_ERROR -0x6C00 +/** A counter would wrap (eg, too many messages exchanged). */ +#define MBEDTLS_ERR_SSL_COUNTER_WRAPPING -0x6B80 +/** Unexpected message at ServerHello in renegotiation. */ +#define MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO -0x6B00 +/** DTLS client must retry for hello verification */ +#define MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED -0x6A80 +/** A buffer is too small to receive or write a message */ +#define MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL -0x6A00 +/** None of the common ciphersuites is usable (eg, no suitable certificate, see debug messages). */ +#define MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE -0x6980 +/** No data of requested type currently available on underlying transport. */ +#define MBEDTLS_ERR_SSL_WANT_READ -0x6900 +/** Connection requires a write call. */ +#define MBEDTLS_ERR_SSL_WANT_WRITE -0x6880 +/** The operation timed out. */ +#define MBEDTLS_ERR_SSL_TIMEOUT -0x6800 +/** The client initiated a reconnect from the same port. */ +#define MBEDTLS_ERR_SSL_CLIENT_RECONNECT -0x6780 +/** Record header looks valid but is not expected. */ +#define MBEDTLS_ERR_SSL_UNEXPECTED_RECORD -0x6700 +/** The alert message received indicates a non-fatal error. */ +#define MBEDTLS_ERR_SSL_NON_FATAL -0x6680 +/** Couldn't set the hash for verifying CertificateVerify */ +#define MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH -0x6600 +/** Internal-only message signaling that further message-processing should be done */ +#define MBEDTLS_ERR_SSL_CONTINUE_PROCESSING -0x6580 +/** The asynchronous operation is not completed yet. */ +#define MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS -0x6500 +/** Internal-only message signaling that a message arrived early. */ +#define MBEDTLS_ERR_SSL_EARLY_MESSAGE -0x6480 +/** An encrypted DTLS-frame with an unexpected CID was received. */ +#define MBEDTLS_ERR_SSL_UNEXPECTED_CID -0x6000 +/** An operation failed due to an unexpected version or configuration. */ +#define MBEDTLS_ERR_SSL_VERSION_MISMATCH -0x5F00 +/** A cryptographic operation is in progress. Try again later. */ +#define MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS -0x7000 +/** Invalid value in SSL config */ +#define MBEDTLS_ERR_SSL_BAD_CONFIG -0x5E80 + +/* + * Various constants + */ +#define MBEDTLS_SSL_MAJOR_VERSION_3 3 +#define MBEDTLS_SSL_MINOR_VERSION_0 0 /*!< SSL v3.0 */ +#define MBEDTLS_SSL_MINOR_VERSION_1 1 /*!< TLS v1.0 */ +#define MBEDTLS_SSL_MINOR_VERSION_2 2 /*!< TLS v1.1 */ +#define MBEDTLS_SSL_MINOR_VERSION_3 3 /*!< TLS v1.2 */ +#define MBEDTLS_SSL_MINOR_VERSION_4 4 /*!< TLS v1.3 (experimental) */ + +#define MBEDTLS_SSL_TRANSPORT_STREAM 0 /*!< TLS */ +#define MBEDTLS_SSL_TRANSPORT_DATAGRAM 1 /*!< DTLS */ + +#define MBEDTLS_SSL_MAX_HOST_NAME_LEN 255 /*!< Maximum host name defined in RFC 1035 */ +#define MBEDTLS_SSL_MAX_ALPN_NAME_LEN 255 /*!< Maximum size in bytes of a protocol name in alpn ext., RFC 7301 */ + +#define MBEDTLS_SSL_MAX_ALPN_LIST_LEN 65535 /*!< Maximum size in bytes of list in alpn ext., RFC 7301 */ + +/* RFC 6066 section 4, see also mfl_code_to_length in ssl_tls.c + * NONE must be zero so that memset()ing structure to zero works */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_NONE 0 /*!< don't use this extension */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_512 1 /*!< MaxFragmentLength 2^9 */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_1024 2 /*!< MaxFragmentLength 2^10 */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_2048 3 /*!< MaxFragmentLength 2^11 */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_4096 4 /*!< MaxFragmentLength 2^12 */ +#define MBEDTLS_SSL_MAX_FRAG_LEN_INVALID 5 /*!< first invalid value */ + +#define MBEDTLS_SSL_IS_CLIENT 0 +#define MBEDTLS_SSL_IS_SERVER 1 + +#define MBEDTLS_SSL_IS_NOT_FALLBACK 0 +#define MBEDTLS_SSL_IS_FALLBACK 1 + +#define MBEDTLS_SSL_EXTENDED_MS_DISABLED 0 +#define MBEDTLS_SSL_EXTENDED_MS_ENABLED 1 + +#define MBEDTLS_SSL_CID_DISABLED 0 +#define MBEDTLS_SSL_CID_ENABLED 1 + +#define MBEDTLS_SSL_ETM_DISABLED 0 +#define MBEDTLS_SSL_ETM_ENABLED 1 + +#define MBEDTLS_SSL_COMPRESS_NULL 0 +#define MBEDTLS_SSL_COMPRESS_DEFLATE 1 + +#define MBEDTLS_SSL_VERIFY_NONE 0 +#define MBEDTLS_SSL_VERIFY_OPTIONAL 1 +#define MBEDTLS_SSL_VERIFY_REQUIRED 2 +#define MBEDTLS_SSL_VERIFY_UNSET 3 /* Used only for sni_authmode */ + +#define MBEDTLS_SSL_LEGACY_RENEGOTIATION 0 +#define MBEDTLS_SSL_SECURE_RENEGOTIATION 1 + +#define MBEDTLS_SSL_RENEGOTIATION_DISABLED 0 +#define MBEDTLS_SSL_RENEGOTIATION_ENABLED 1 + +#define MBEDTLS_SSL_ANTI_REPLAY_DISABLED 0 +#define MBEDTLS_SSL_ANTI_REPLAY_ENABLED 1 + +#define MBEDTLS_SSL_RENEGOTIATION_NOT_ENFORCED -1 +#define MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT 16 + +#define MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION 0 +#define MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION 1 +#define MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE 2 + +#define MBEDTLS_SSL_TRUNC_HMAC_DISABLED 0 +#define MBEDTLS_SSL_TRUNC_HMAC_ENABLED 1 +#define MBEDTLS_SSL_TRUNCATED_HMAC_LEN 10 /* 80 bits, rfc 6066 section 7 */ + +#define MBEDTLS_SSL_SESSION_TICKETS_DISABLED 0 +#define MBEDTLS_SSL_SESSION_TICKETS_ENABLED 1 + +#define MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED 0 +#define MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED 1 + +#define MBEDTLS_SSL_ARC4_ENABLED 0 +#define MBEDTLS_SSL_ARC4_DISABLED 1 + +#define MBEDTLS_SSL_PRESET_DEFAULT 0 +#define MBEDTLS_SSL_PRESET_SUITEB 2 + +#define MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED 1 +#define MBEDTLS_SSL_CERT_REQ_CA_LIST_DISABLED 0 + +#define MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED 0 +#define MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED 1 + +/* + * Default range for DTLS retransmission timer value, in milliseconds. + * RFC 6347 4.2.4.1 says from 1 second to 60 seconds. + */ +#define MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN 1000 +#define MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX 60000 + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h or define them on the compiler command line. + * \{ + */ + +#if !defined(MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME) +#define MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME 86400 /**< Lifetime of session tickets (if enabled) */ +#endif + +/* + * Maximum fragment length in bytes, + * determines the size of each of the two internal I/O buffers. + * + * Note: the RFC defines the default size of SSL / TLS messages. If you + * change the value here, other clients / servers may not be able to + * communicate with you anymore. Only change this value if you control + * both sides of the connection and have it reduced at both sides, or + * if you're using the Max Fragment Length extension and you know all your + * peers are using it too! + */ +#if !defined(MBEDTLS_SSL_MAX_CONTENT_LEN) +#define MBEDTLS_SSL_MAX_CONTENT_LEN 16384 /**< Size of the input / output buffer */ +#endif + +#if !defined(MBEDTLS_SSL_IN_CONTENT_LEN) +#define MBEDTLS_SSL_IN_CONTENT_LEN MBEDTLS_SSL_MAX_CONTENT_LEN +#endif + +#if !defined(MBEDTLS_SSL_OUT_CONTENT_LEN) +#define MBEDTLS_SSL_OUT_CONTENT_LEN MBEDTLS_SSL_MAX_CONTENT_LEN +#endif + +/* + * Maximum number of heap-allocated bytes for the purpose of + * DTLS handshake message reassembly and future message buffering. + */ +#if !defined(MBEDTLS_SSL_DTLS_MAX_BUFFERING) +#define MBEDTLS_SSL_DTLS_MAX_BUFFERING 32768 +#endif + +/* + * Maximum length of CIDs for incoming and outgoing messages. + */ +#if !defined(MBEDTLS_SSL_CID_IN_LEN_MAX) +#define MBEDTLS_SSL_CID_IN_LEN_MAX 32 +#endif + +#if !defined(MBEDTLS_SSL_CID_OUT_LEN_MAX) +#define MBEDTLS_SSL_CID_OUT_LEN_MAX 32 +#endif + +#if !defined(MBEDTLS_SSL_CID_PADDING_GRANULARITY) +#define MBEDTLS_SSL_CID_PADDING_GRANULARITY 16 +#endif + +#if !defined(MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY) +#define MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY 1 +#endif + +/** \} name SECTION: Module settings */ + +/* + * Length of the verify data for secure renegotiation + */ +#if defined(MBEDTLS_SSL_PROTO_SSL3) +#define MBEDTLS_SSL_VERIFY_DATA_MAX_LEN 36 +#else +#define MBEDTLS_SSL_VERIFY_DATA_MAX_LEN 12 +#endif + +/* + * Signaling ciphersuite values (SCSV) + */ +#define MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO 0xFF /**< renegotiation info ext */ +#define MBEDTLS_SSL_FALLBACK_SCSV_VALUE 0x5600 /**< RFC 7507 section 2 */ + +/* + * Supported Signature and Hash algorithms (For TLS 1.2) + * RFC 5246 section 7.4.1.4.1 + */ +#define MBEDTLS_SSL_HASH_NONE 0 +#define MBEDTLS_SSL_HASH_MD5 1 +#define MBEDTLS_SSL_HASH_SHA1 2 +#define MBEDTLS_SSL_HASH_SHA224 3 +#define MBEDTLS_SSL_HASH_SHA256 4 +#define MBEDTLS_SSL_HASH_SHA384 5 +#define MBEDTLS_SSL_HASH_SHA512 6 + +#define MBEDTLS_SSL_SIG_ANON 0 +#define MBEDTLS_SSL_SIG_RSA 1 +#define MBEDTLS_SSL_SIG_ECDSA 3 + +/* + * Client Certificate Types + * RFC 5246 section 7.4.4 plus RFC 4492 section 5.5 + */ +#define MBEDTLS_SSL_CERT_TYPE_RSA_SIGN 1 +#define MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN 64 + +/* + * Message, alert and handshake types + */ +#define MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC 20 +#define MBEDTLS_SSL_MSG_ALERT 21 +#define MBEDTLS_SSL_MSG_HANDSHAKE 22 +#define MBEDTLS_SSL_MSG_APPLICATION_DATA 23 +#define MBEDTLS_SSL_MSG_CID 25 + +#define MBEDTLS_SSL_ALERT_LEVEL_WARNING 1 +#define MBEDTLS_SSL_ALERT_LEVEL_FATAL 2 + +#define MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY 0 /* 0x00 */ +#define MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE 10 /* 0x0A */ +#define MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC 20 /* 0x14 */ +#define MBEDTLS_SSL_ALERT_MSG_DECRYPTION_FAILED 21 /* 0x15 */ +#define MBEDTLS_SSL_ALERT_MSG_RECORD_OVERFLOW 22 /* 0x16 */ +#define MBEDTLS_SSL_ALERT_MSG_DECOMPRESSION_FAILURE 30 /* 0x1E */ +#define MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE 40 /* 0x28 */ +#define MBEDTLS_SSL_ALERT_MSG_NO_CERT 41 /* 0x29 */ +#define MBEDTLS_SSL_ALERT_MSG_BAD_CERT 42 /* 0x2A */ +#define MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT 43 /* 0x2B */ +#define MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED 44 /* 0x2C */ +#define MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED 45 /* 0x2D */ +#define MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN 46 /* 0x2E */ +#define MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER 47 /* 0x2F */ +#define MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA 48 /* 0x30 */ +#define MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED 49 /* 0x31 */ +#define MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR 50 /* 0x32 */ +#define MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR 51 /* 0x33 */ +#define MBEDTLS_SSL_ALERT_MSG_EXPORT_RESTRICTION 60 /* 0x3C */ +#define MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION 70 /* 0x46 */ +#define MBEDTLS_SSL_ALERT_MSG_INSUFFICIENT_SECURITY 71 /* 0x47 */ +#define MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR 80 /* 0x50 */ +#define MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK 86 /* 0x56 */ +#define MBEDTLS_SSL_ALERT_MSG_USER_CANCELED 90 /* 0x5A */ +#define MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION 100 /* 0x64 */ +#define MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT 110 /* 0x6E */ +#define MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME 112 /* 0x70 */ +#define MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY 115 /* 0x73 */ +#define MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL 120 /* 0x78 */ + +#define MBEDTLS_SSL_HS_HELLO_REQUEST 0 +#define MBEDTLS_SSL_HS_CLIENT_HELLO 1 +#define MBEDTLS_SSL_HS_SERVER_HELLO 2 +#define MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST 3 +#define MBEDTLS_SSL_HS_NEW_SESSION_TICKET 4 +#define MBEDTLS_SSL_HS_CERTIFICATE 11 +#define MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE 12 +#define MBEDTLS_SSL_HS_CERTIFICATE_REQUEST 13 +#define MBEDTLS_SSL_HS_SERVER_HELLO_DONE 14 +#define MBEDTLS_SSL_HS_CERTIFICATE_VERIFY 15 +#define MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE 16 +#define MBEDTLS_SSL_HS_FINISHED 20 + +/* + * TLS extensions + */ +#define MBEDTLS_TLS_EXT_SERVERNAME 0 +#define MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME 0 + +#define MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH 1 + +#define MBEDTLS_TLS_EXT_TRUNCATED_HMAC 4 + +#define MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES 10 +#define MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS 11 + +#define MBEDTLS_TLS_EXT_SIG_ALG 13 + +#define MBEDTLS_TLS_EXT_USE_SRTP 14 + +#define MBEDTLS_TLS_EXT_ALPN 16 + +#define MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC 22 /* 0x16 */ +#define MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET 0x0017 /* 23 */ + +#define MBEDTLS_TLS_EXT_SESSION_TICKET 35 + +/* The value of the CID extension is still TBD as of + * draft-ietf-tls-dtls-connection-id-05 + * (https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05). + * + * A future minor revision of Mbed TLS may change the default value of + * this option to match evolving standards and usage. + */ +#if !defined(MBEDTLS_TLS_EXT_CID) +#define MBEDTLS_TLS_EXT_CID 254 /* TBD */ +#endif + +#define MBEDTLS_TLS_EXT_ECJPAKE_KKPP 256 /* experimental */ + +#define MBEDTLS_TLS_EXT_RENEGOTIATION_INFO 0xFF01 + +/* + * Size defines + */ +#if !defined(MBEDTLS_PSK_MAX_LEN) +#define MBEDTLS_PSK_MAX_LEN 32 /* 256 bits */ +#endif + +/* Dummy type used only for its size */ +union mbedtls_ssl_premaster_secret +{ +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) + unsigned char _pms_rsa[48]; /* RFC 5246 8.1.1 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) + unsigned char _pms_dhm[MBEDTLS_MPI_MAX_SIZE]; /* RFC 5246 8.1.2 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) + unsigned char _pms_ecdh[MBEDTLS_ECP_MAX_BYTES]; /* RFC 4492 5.10 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) + unsigned char _pms_psk[4 + 2 * MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 2 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) + unsigned char _pms_dhe_psk[4 + MBEDTLS_MPI_MAX_SIZE + + MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 3 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) + unsigned char _pms_rsa_psk[52 + MBEDTLS_PSK_MAX_LEN]; /* RFC 4279 4 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) + unsigned char _pms_ecdhe_psk[4 + MBEDTLS_ECP_MAX_BYTES + + MBEDTLS_PSK_MAX_LEN]; /* RFC 5489 2 */ +#endif +#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) + unsigned char _pms_ecjpake[32]; /* Thread spec: SHA-256 output */ +#endif +}; + +#define MBEDTLS_PREMASTER_SIZE sizeof( union mbedtls_ssl_premaster_secret ) + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * SSL state machine + */ +typedef enum +{ + MBEDTLS_SSL_HELLO_REQUEST, + MBEDTLS_SSL_CLIENT_HELLO, + MBEDTLS_SSL_SERVER_HELLO, + MBEDTLS_SSL_SERVER_CERTIFICATE, + MBEDTLS_SSL_SERVER_KEY_EXCHANGE, + MBEDTLS_SSL_CERTIFICATE_REQUEST, + MBEDTLS_SSL_SERVER_HELLO_DONE, + MBEDTLS_SSL_CLIENT_CERTIFICATE, + MBEDTLS_SSL_CLIENT_KEY_EXCHANGE, + MBEDTLS_SSL_CERTIFICATE_VERIFY, + MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC, + MBEDTLS_SSL_CLIENT_FINISHED, + MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC, + MBEDTLS_SSL_SERVER_FINISHED, + MBEDTLS_SSL_FLUSH_BUFFERS, + MBEDTLS_SSL_HANDSHAKE_WRAPUP, + MBEDTLS_SSL_HANDSHAKE_OVER, + MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET, + MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT, +} +mbedtls_ssl_states; + +/* + * The tls_prf function types. + */ +typedef enum +{ + MBEDTLS_SSL_TLS_PRF_NONE, + MBEDTLS_SSL_TLS_PRF_SSL3, + MBEDTLS_SSL_TLS_PRF_TLS1, + MBEDTLS_SSL_TLS_PRF_SHA384, + MBEDTLS_SSL_TLS_PRF_SHA256 +} +mbedtls_tls_prf_types; +/** + * \brief Callback type: send data on the network. + * + * \note That callback may be either blocking or non-blocking. + * + * \param ctx Context for the send callback (typically a file descriptor) + * \param buf Buffer holding the data to send + * \param len Length of the data to send + * + * \return The callback must return the number of bytes sent if any, + * or a non-zero error code. + * If performing non-blocking I/O, \c MBEDTLS_ERR_SSL_WANT_WRITE + * must be returned when the operation would block. + * + * \note The callback is allowed to send fewer bytes than requested. + * It must always return the number of bytes actually sent. + */ +typedef int mbedtls_ssl_send_t( void *ctx, + const unsigned char *buf, + size_t len ); + +/** + * \brief Callback type: receive data from the network. + * + * \note That callback may be either blocking or non-blocking. + * + * \param ctx Context for the receive callback (typically a file + * descriptor) + * \param buf Buffer to write the received data to + * \param len Length of the receive buffer + * + * \returns If data has been received, the positive number of bytes received. + * \returns \c 0 if the connection has been closed. + * \returns If performing non-blocking I/O, \c MBEDTLS_ERR_SSL_WANT_READ + * must be returned when the operation would block. + * \returns Another negative error code on other kinds of failures. + * + * \note The callback may receive fewer bytes than the length of the + * buffer. It must always return the number of bytes actually + * received and written to the buffer. + */ +typedef int mbedtls_ssl_recv_t( void *ctx, + unsigned char *buf, + size_t len ); + +/** + * \brief Callback type: receive data from the network, with timeout + * + * \note That callback must block until data is received, or the + * timeout delay expires, or the operation is interrupted by a + * signal. + * + * \param ctx Context for the receive callback (typically a file descriptor) + * \param buf Buffer to write the received data to + * \param len Length of the receive buffer + * \param timeout Maximum nomber of millisecondes to wait for data + * 0 means no timeout (potentially waiting forever) + * + * \return The callback must return the number of bytes received, + * or a non-zero error code: + * \c MBEDTLS_ERR_SSL_TIMEOUT if the operation timed out, + * \c MBEDTLS_ERR_SSL_WANT_READ if interrupted by a signal. + * + * \note The callback may receive fewer bytes than the length of the + * buffer. It must always return the number of bytes actually + * received and written to the buffer. + */ +typedef int mbedtls_ssl_recv_timeout_t( void *ctx, + unsigned char *buf, + size_t len, + uint32_t timeout ); +/** + * \brief Callback type: set a pair of timers/delays to watch + * + * \param ctx Context pointer + * \param int_ms Intermediate delay in milliseconds + * \param fin_ms Final delay in milliseconds + * 0 cancels the current timer. + * + * \note This callback must at least store the necessary information + * for the associated \c mbedtls_ssl_get_timer_t callback to + * return correct information. + * + * \note If using a event-driven style of programming, an event must + * be generated when the final delay is passed. The event must + * cause a call to \c mbedtls_ssl_handshake() with the proper + * SSL context to be scheduled. Care must be taken to ensure + * that at most one such call happens at a time. + * + * \note Only one timer at a time must be running. Calling this + * function while a timer is running must cancel it. Cancelled + * timers must not generate any event. + */ +typedef void mbedtls_ssl_set_timer_t( void * ctx, + uint32_t int_ms, + uint32_t fin_ms ); + +/** + * \brief Callback type: get status of timers/delays + * + * \param ctx Context pointer + * + * \return This callback must return: + * -1 if cancelled (fin_ms == 0), + * 0 if none of the delays have passed, + * 1 if only the intermediate delay has passed, + * 2 if the final delay has passed. + */ +typedef int mbedtls_ssl_get_timer_t( void * ctx ); + +/* Defined below */ +typedef struct mbedtls_ssl_session mbedtls_ssl_session; +typedef struct mbedtls_ssl_context mbedtls_ssl_context; +typedef struct mbedtls_ssl_config mbedtls_ssl_config; + +/* Defined in ssl_internal.h */ +typedef struct mbedtls_ssl_transform mbedtls_ssl_transform; +typedef struct mbedtls_ssl_handshake_params mbedtls_ssl_handshake_params; +typedef struct mbedtls_ssl_sig_hash_set_t mbedtls_ssl_sig_hash_set_t; +#if defined(MBEDTLS_X509_CRT_PARSE_C) +typedef struct mbedtls_ssl_key_cert mbedtls_ssl_key_cert; +#endif +#if defined(MBEDTLS_SSL_PROTO_DTLS) +typedef struct mbedtls_ssl_flight_item mbedtls_ssl_flight_item; +#endif + +#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Callback type: start external signature operation. + * + * This callback is called during an SSL handshake to start + * a signature decryption operation using an + * external processor. The parameter \p cert contains + * the public key; it is up to the callback function to + * determine how to access the associated private key. + * + * This function typically sends or enqueues a request, and + * does not wait for the operation to complete. This allows + * the handshake step to be non-blocking. + * + * The parameters \p ssl and \p cert are guaranteed to remain + * valid throughout the handshake. On the other hand, this + * function must save the contents of \p hash if the value + * is needed for later processing, because the \p hash buffer + * is no longer valid after this function returns. + * + * This function may call mbedtls_ssl_set_async_operation_data() + * to store an operation context for later retrieval + * by the resume or cancel callback. + * + * \note For RSA signatures, this function must produce output + * that is consistent with PKCS#1 v1.5 in the same way as + * mbedtls_rsa_pkcs1_sign(). Before the private key operation, + * apply the padding steps described in RFC 8017, section 9.2 + * "EMSA-PKCS1-v1_5" as follows. + * - If \p md_alg is #MBEDTLS_MD_NONE, apply the PKCS#1 v1.5 + * encoding, treating \p hash as the DigestInfo to be + * padded. In other words, apply EMSA-PKCS1-v1_5 starting + * from step 3, with `T = hash` and `tLen = hash_len`. + * - If `md_alg != MBEDTLS_MD_NONE`, apply the PKCS#1 v1.5 + * encoding, treating \p hash as the hash to be encoded and + * padded. In other words, apply EMSA-PKCS1-v1_5 starting + * from step 2, with `digestAlgorithm` obtained by calling + * mbedtls_oid_get_oid_by_md() on \p md_alg. + * + * \note For ECDSA signatures, the output format is the DER encoding + * `Ecdsa-Sig-Value` defined in + * [RFC 4492 section 5.4](https://tools.ietf.org/html/rfc4492#section-5.4). + * + * \param ssl The SSL connection instance. It should not be + * modified other than via + * mbedtls_ssl_set_async_operation_data(). + * \param cert Certificate containing the public key. + * In simple cases, this is one of the pointers passed to + * mbedtls_ssl_conf_own_cert() when configuring the SSL + * connection. However, if other callbacks are used, this + * property may not hold. For example, if an SNI callback + * is registered with mbedtls_ssl_conf_sni(), then + * this callback determines what certificate is used. + * \param md_alg Hash algorithm. + * \param hash Buffer containing the hash. This buffer is + * no longer valid when the function returns. + * \param hash_len Size of the \c hash buffer in bytes. + * + * \return 0 if the operation was started successfully and the SSL + * stack should call the resume callback immediately. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if the operation + * was started successfully and the SSL stack should return + * immediately without calling the resume callback yet. + * \return #MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH if the external + * processor does not support this key. The SSL stack will + * use the private key object instead. + * \return Any other error indicates a fatal failure and is + * propagated up the call chain. The callback should + * use \c MBEDTLS_ERR_PK_xxx error codes, and must not + * use \c MBEDTLS_ERR_SSL_xxx error codes except as + * directed in the documentation of this callback. + */ +typedef int mbedtls_ssl_async_sign_t( mbedtls_ssl_context *ssl, + mbedtls_x509_crt *cert, + mbedtls_md_type_t md_alg, + const unsigned char *hash, + size_t hash_len ); + +/** + * \brief Callback type: start external decryption operation. + * + * This callback is called during an SSL handshake to start + * an RSA decryption operation using an + * external processor. The parameter \p cert contains + * the public key; it is up to the callback function to + * determine how to access the associated private key. + * + * This function typically sends or enqueues a request, and + * does not wait for the operation to complete. This allows + * the handshake step to be non-blocking. + * + * The parameters \p ssl and \p cert are guaranteed to remain + * valid throughout the handshake. On the other hand, this + * function must save the contents of \p input if the value + * is needed for later processing, because the \p input buffer + * is no longer valid after this function returns. + * + * This function may call mbedtls_ssl_set_async_operation_data() + * to store an operation context for later retrieval + * by the resume or cancel callback. + * + * \warning RSA decryption as used in TLS is subject to a potential + * timing side channel attack first discovered by Bleichenbacher + * in 1998. This attack can be remotely exploitable + * in practice. To avoid this attack, you must ensure that + * if the callback performs an RSA decryption, the time it + * takes to execute and return the result does not depend + * on whether the RSA decryption succeeded or reported + * invalid padding. + * + * \param ssl The SSL connection instance. It should not be + * modified other than via + * mbedtls_ssl_set_async_operation_data(). + * \param cert Certificate containing the public key. + * In simple cases, this is one of the pointers passed to + * mbedtls_ssl_conf_own_cert() when configuring the SSL + * connection. However, if other callbacks are used, this + * property may not hold. For example, if an SNI callback + * is registered with mbedtls_ssl_conf_sni(), then + * this callback determines what certificate is used. + * \param input Buffer containing the input ciphertext. This buffer + * is no longer valid when the function returns. + * \param input_len Size of the \p input buffer in bytes. + * + * \return 0 if the operation was started successfully and the SSL + * stack should call the resume callback immediately. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if the operation + * was started successfully and the SSL stack should return + * immediately without calling the resume callback yet. + * \return #MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH if the external + * processor does not support this key. The SSL stack will + * use the private key object instead. + * \return Any other error indicates a fatal failure and is + * propagated up the call chain. The callback should + * use \c MBEDTLS_ERR_PK_xxx error codes, and must not + * use \c MBEDTLS_ERR_SSL_xxx error codes except as + * directed in the documentation of this callback. + */ +typedef int mbedtls_ssl_async_decrypt_t( mbedtls_ssl_context *ssl, + mbedtls_x509_crt *cert, + const unsigned char *input, + size_t input_len ); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +/** + * \brief Callback type: resume external operation. + * + * This callback is called during an SSL handshake to resume + * an external operation started by the + * ::mbedtls_ssl_async_sign_t or + * ::mbedtls_ssl_async_decrypt_t callback. + * + * This function typically checks the status of a pending + * request or causes the request queue to make progress, and + * does not wait for the operation to complete. This allows + * the handshake step to be non-blocking. + * + * This function may call mbedtls_ssl_get_async_operation_data() + * to retrieve an operation context set by the start callback. + * It may call mbedtls_ssl_set_async_operation_data() to modify + * this context. + * + * Note that when this function returns a status other than + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, it must free any + * resources associated with the operation. + * + * \param ssl The SSL connection instance. It should not be + * modified other than via + * mbedtls_ssl_set_async_operation_data(). + * \param output Buffer containing the output (signature or decrypted + * data) on success. + * \param output_len On success, number of bytes written to \p output. + * \param output_size Size of the \p output buffer in bytes. + * + * \return 0 if output of the operation is available in the + * \p output buffer. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if the operation + * is still in progress. Subsequent requests for progress + * on the SSL connection will call the resume callback + * again. + * \return Any other error means that the operation is aborted. + * The SSL handshake is aborted. The callback should + * use \c MBEDTLS_ERR_PK_xxx error codes, and must not + * use \c MBEDTLS_ERR_SSL_xxx error codes except as + * directed in the documentation of this callback. + */ +typedef int mbedtls_ssl_async_resume_t( mbedtls_ssl_context *ssl, + unsigned char *output, + size_t *output_len, + size_t output_size ); + +/** + * \brief Callback type: cancel external operation. + * + * This callback is called if an SSL connection is closed + * while an asynchronous operation is in progress. Note that + * this callback is not called if the + * ::mbedtls_ssl_async_resume_t callback has run and has + * returned a value other than + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, since in that case + * the asynchronous operation has already completed. + * + * This function may call mbedtls_ssl_get_async_operation_data() + * to retrieve an operation context set by the start callback. + * + * \param ssl The SSL connection instance. It should not be + * modified. + */ +typedef void mbedtls_ssl_async_cancel_t( mbedtls_ssl_context *ssl ); +#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ + +#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) && \ + !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) +#define MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN 48 +#if defined(MBEDTLS_SHA256_C) +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE MBEDTLS_MD_SHA256 +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN 32 +#elif defined(MBEDTLS_SHA512_C) +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE MBEDTLS_MD_SHA384 +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN 48 +#elif defined(MBEDTLS_SHA1_C) +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE MBEDTLS_MD_SHA1 +#define MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN 20 +#else +/* This is already checked in check_config.h, but be sure. */ +#error "Bad configuration - need SHA-1, SHA-256 or SHA-512 enabled to compute digest of peer CRT." +#endif +#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED && + !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ + +#if defined(MBEDTLS_SSL_DTLS_SRTP) + +#define MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH 255 +#define MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH 4 +/* + * For code readability use a typedef for DTLS-SRTP profiles + * + * Use_srtp extension protection profiles values as defined in + * http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml + * + * Reminder: if this list is expanded mbedtls_ssl_check_srtp_profile_value + * must be updated too. + */ +#define MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80 ( (uint16_t) 0x0001) +#define MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32 ( (uint16_t) 0x0002) +#define MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80 ( (uint16_t) 0x0005) +#define MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32 ( (uint16_t) 0x0006) +/* This one is not iana defined, but for code readability. */ +#define MBEDTLS_TLS_SRTP_UNSET ( (uint16_t) 0x0000) + +typedef uint16_t mbedtls_ssl_srtp_profile; + +typedef struct mbedtls_dtls_srtp_info_t +{ + /*! The SRTP profile that was negotiated. */ + mbedtls_ssl_srtp_profile chosen_dtls_srtp_profile; + /*! The length of mki_value. */ + uint16_t mki_len; + /*! The mki_value used, with max size of 256 bytes. */ + unsigned char mki_value[MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH]; +} +mbedtls_dtls_srtp_info; + +#endif /* MBEDTLS_SSL_DTLS_SRTP */ + +/* + * This structure is used for storing current session data. + * + * Note: when changing this definition, we need to check and update: + * - in tests/suites/test_suite_ssl.function: + * ssl_populate_session() and ssl_serialize_session_save_load() + * - in library/ssl_tls.c: + * mbedtls_ssl_session_init() and mbedtls_ssl_session_free() + * mbedtls_ssl_session_save() and ssl_session_load() + * ssl_session_copy() + */ +struct mbedtls_ssl_session +{ +#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) + unsigned char mfl_code; /*!< MaxFragmentLength negotiated by peer */ +#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ + +#if defined(MBEDTLS_HAVE_TIME) + mbedtls_time_t start; /*!< starting time */ +#endif + int ciphersuite; /*!< chosen ciphersuite */ + int compression; /*!< chosen compression */ + size_t id_len; /*!< session id length */ + unsigned char id[32]; /*!< session identifier */ + unsigned char master[48]; /*!< the master secret */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) + mbedtls_x509_crt *peer_cert; /*!< peer X.509 cert chain */ +#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ + /*! The digest of the peer's end-CRT. This must be kept to detect CRT + * changes during renegotiation, mitigating the triple handshake attack. */ + unsigned char *peer_cert_digest; + size_t peer_cert_digest_len; + mbedtls_md_type_t peer_cert_digest_type; +#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + uint32_t verify_result; /*!< verification result */ + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) + unsigned char *ticket; /*!< RFC 5077 session ticket */ + size_t ticket_len; /*!< session ticket length */ + uint32_t ticket_lifetime; /*!< ticket lifetime hint */ +#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */ + +#if defined(MBEDTLS_SSL_TRUNCATED_HMAC) + int trunc_hmac; /*!< flag for truncated hmac activation */ +#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ + +#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) + int encrypt_then_mac; /*!< flag for EtM activation */ +#endif +}; + +/** + * SSL/TLS configuration to be shared between mbedtls_ssl_context structures. + */ +struct mbedtls_ssl_config +{ + /* Group items by size and reorder them to maximize usage of immediate offset access. */ + + /* + * Numerical settings (char) + */ + + unsigned char max_major_ver; /*!< max. major version used */ + unsigned char max_minor_ver; /*!< max. minor version used */ + unsigned char min_major_ver; /*!< min. major version used */ + unsigned char min_minor_ver; /*!< min. minor version used */ + + /* + * Flags (could be bit-fields to save RAM, but separate bytes make + * the code smaller on architectures with an instruction for direct + * byte access). + */ + + uint8_t endpoint /*bool*/; /*!< 0: client, 1: server */ + uint8_t transport /*bool*/; /*!< stream (TLS) or datagram (DTLS) */ + uint8_t authmode /*2 bits*/; /*!< MBEDTLS_SSL_VERIFY_XXX */ + /* needed even with renego disabled for LEGACY_BREAK_HANDSHAKE */ + uint8_t allow_legacy_renegotiation /*2 bits*/; /*!< MBEDTLS_LEGACY_XXX */ +#if defined(MBEDTLS_ARC4_C) + uint8_t arc4_disabled /*bool*/; /*!< blacklist RC4 ciphersuites? */ +#endif +#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) + uint8_t mfl_code /*3 bits*/; /*!< desired fragment length */ +#endif +#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) + uint8_t encrypt_then_mac /*bool*/; /*!< negotiate encrypt-then-mac? */ +#endif +#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) + uint8_t extended_ms /*bool*/; /*!< negotiate extended master secret? */ +#endif +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) + uint8_t anti_replay /*bool*/; /*!< detect and prevent replay? */ +#endif +#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) + uint8_t cbc_record_splitting /*bool*/; /*!< do cbc record splitting */ +#endif +#if defined(MBEDTLS_SSL_RENEGOTIATION) + uint8_t disable_renegotiation /*bool*/; /*!< disable renegotiation? */ +#endif +#if defined(MBEDTLS_SSL_TRUNCATED_HMAC) + uint8_t trunc_hmac /*bool*/; /*!< negotiate truncated hmac? */ +#endif +#if defined(MBEDTLS_SSL_SESSION_TICKETS) + uint8_t session_tickets /*bool*/; /*!< use session tickets? */ +#endif +#if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C) + uint8_t fallback /*bool*/; /*!< is this a fallback? */ +#endif +#if defined(MBEDTLS_SSL_SRV_C) + uint8_t cert_req_ca_list /*bool*/; /*!< enable sending CA list in + Certificate Request messages? */ +#endif +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + uint8_t ignore_unexpected_cid /*bool*/; /*!< Determines whether DTLS + * record with unexpected CID + * should lead to failure. */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ +#if defined(MBEDTLS_SSL_DTLS_SRTP) + uint8_t dtls_srtp_mki_support /*bool*/; /*!< support having mki_value + in the use_srtp extension? */ +#endif + + /* + * Numerical settings (int or larger) + */ + + uint32_t read_timeout; /*!< timeout for mbedtls_ssl_read (ms) */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + uint32_t hs_timeout_min; /*!< initial value of the handshake + retransmission timeout (ms) */ + uint32_t hs_timeout_max; /*!< maximum value of the handshake + retransmission timeout (ms) */ +#endif + +#if defined(MBEDTLS_SSL_RENEGOTIATION) + int renego_max_records; /*!< grace period for renegotiation */ + unsigned char renego_period[8]; /*!< value of the record counters + that triggers renegotiation */ +#endif + +#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) + unsigned int badmac_limit; /*!< limit of records with a bad MAC */ +#endif + +#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C) + unsigned int dhm_min_bitlen; /*!< min. bit length of the DHM prime */ +#endif + + /* + * Pointers + */ + + const int *ciphersuite_list[4]; /*!< allowed ciphersuites per version */ + + /** Callback for printing debug output */ + void (*f_dbg)(void *, int, const char *, int, const char *); + void *p_dbg; /*!< context for the debug function */ + + /** Callback for getting (pseudo-)random numbers */ + int (*f_rng)(void *, unsigned char *, size_t); + void *p_rng; /*!< context for the RNG function */ + + /** Callback to retrieve a session from the cache */ + int (*f_get_cache)(void *, mbedtls_ssl_session *); + /** Callback to store a session into the cache */ + int (*f_set_cache)(void *, const mbedtls_ssl_session *); + void *p_cache; /*!< context for cache callbacks */ + +#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) + /** Callback for setting cert according to SNI extension */ + int (*f_sni)(void *, mbedtls_ssl_context *, const unsigned char *, size_t); + void *p_sni; /*!< context for SNI callback */ +#endif + +#if defined(MBEDTLS_X509_CRT_PARSE_C) + /** Callback to customize X.509 certificate chain verification */ + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *); + void *p_vrfy; /*!< context for X.509 verify calllback */ +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) + /** Callback to retrieve PSK key from identity */ + int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *, size_t); + void *p_psk; /*!< context for PSK callback */ +#endif + +#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) + /** Callback to create & write a cookie for ClientHello verification */ + int (*f_cookie_write)( void *, unsigned char **, unsigned char *, + const unsigned char *, size_t ); + /** Callback to verify validity of a ClientHello cookie */ + int (*f_cookie_check)( void *, const unsigned char *, size_t, + const unsigned char *, size_t ); + void *p_cookie; /*!< context for the cookie callbacks */ +#endif + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_SRV_C) + /** Callback to create & write a session ticket */ + int (*f_ticket_write)( void *, const mbedtls_ssl_session *, + unsigned char *, const unsigned char *, size_t *, uint32_t * ); + /** Callback to parse a session ticket into a session structure */ + int (*f_ticket_parse)( void *, mbedtls_ssl_session *, unsigned char *, size_t); + void *p_ticket; /*!< context for the ticket callbacks */ +#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_SRV_C */ + +#if defined(MBEDTLS_SSL_EXPORT_KEYS) + /** Callback to export key block and master secret */ + int (*f_export_keys)( void *, const unsigned char *, + const unsigned char *, size_t, size_t, size_t ); + /** Callback to export key block, master secret, + * tls_prf and random bytes. Should replace f_export_keys */ + int (*f_export_keys_ext)( void *, const unsigned char *, + const unsigned char *, size_t, size_t, size_t, + const unsigned char[32], const unsigned char[32], + mbedtls_tls_prf_types ); + void *p_export_keys; /*!< context for key export callback */ +#endif + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + size_t cid_len; /*!< The length of CIDs for incoming DTLS records. */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) + const mbedtls_x509_crt_profile *cert_profile; /*!< verification profile */ + mbedtls_ssl_key_cert *key_cert; /*!< own certificate/key pair(s) */ + mbedtls_x509_crt *ca_chain; /*!< trusted CAs */ + mbedtls_x509_crl *ca_crl; /*!< trusted CAs CRLs */ +#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) + mbedtls_x509_crt_ca_cb_t f_ca_cb; + void *p_ca_cb; +#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) +#if defined(MBEDTLS_X509_CRT_PARSE_C) + mbedtls_ssl_async_sign_t *f_async_sign_start; /*!< start asynchronous signature operation */ + mbedtls_ssl_async_decrypt_t *f_async_decrypt_start; /*!< start asynchronous decryption operation */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + mbedtls_ssl_async_resume_t *f_async_resume; /*!< resume asynchronous operation */ + mbedtls_ssl_async_cancel_t *f_async_cancel; /*!< cancel asynchronous operation */ + void *p_async_config_data; /*!< Configuration data set by mbedtls_ssl_conf_async_private_cb(). */ +#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ + +#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) + const int *sig_hashes; /*!< allowed signature hashes */ +#endif + +#if defined(MBEDTLS_ECP_C) + const mbedtls_ecp_group_id *curve_list; /*!< allowed curves */ +#endif + +#if defined(MBEDTLS_DHM_C) + mbedtls_mpi dhm_P; /*!< prime modulus for DHM */ + mbedtls_mpi dhm_G; /*!< generator for DHM */ +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) + +#if defined(MBEDTLS_USE_PSA_CRYPTO) + psa_key_id_t psk_opaque; /*!< PSA key slot holding opaque PSK. This field + * should only be set via + * mbedtls_ssl_conf_psk_opaque(). + * If either no PSK or a raw PSK have been + * configured, this has value \c 0. + */ +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + + unsigned char *psk; /*!< The raw pre-shared key. This field should + * only be set via mbedtls_ssl_conf_psk(). + * If either no PSK or an opaque PSK + * have been configured, this has value NULL. */ + size_t psk_len; /*!< The length of the raw pre-shared key. + * This field should only be set via + * mbedtls_ssl_conf_psk(). + * Its value is non-zero if and only if + * \c psk is not \c NULL. */ + + unsigned char *psk_identity; /*!< The PSK identity for PSK negotiation. + * This field should only be set via + * mbedtls_ssl_conf_psk(). + * This is set if and only if either + * \c psk or \c psk_opaque are set. */ + size_t psk_identity_len;/*!< The length of PSK identity. + * This field should only be set via + * mbedtls_ssl_conf_psk(). + * Its value is non-zero if and only if + * \c psk is not \c NULL or \c psk_opaque + * is not \c 0. */ +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ + +#if defined(MBEDTLS_SSL_ALPN) + const char **alpn_list; /*!< ordered list of protocols */ +#endif + +#if defined(MBEDTLS_SSL_DTLS_SRTP) + /*! ordered list of supported srtp profile */ + const mbedtls_ssl_srtp_profile *dtls_srtp_profile_list; + /*! number of supported profiles */ + size_t dtls_srtp_profile_list_len; +#endif /* MBEDTLS_SSL_DTLS_SRTP */ +}; + +struct mbedtls_ssl_context +{ + const mbedtls_ssl_config *conf; /*!< configuration information */ + + /* + * Miscellaneous + */ + int state; /*!< SSL handshake: current state */ +#if defined(MBEDTLS_SSL_RENEGOTIATION) + int renego_status; /*!< Initial, in progress, pending? */ + int renego_records_seen; /*!< Records since renego request, or with DTLS, + number of retransmissions of request if + renego_max_records is < 0 */ +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + + int major_ver; /*!< equal to MBEDTLS_SSL_MAJOR_VERSION_3 */ + int minor_ver; /*!< either 0 (SSL3) or 1 (TLS1.0) */ + +#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) + unsigned badmac_seen; /*!< records with a bad MAC received */ +#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) + /** Callback to customize X.509 certificate chain verification */ + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *); + void *p_vrfy; /*!< context for X.509 verify callback */ +#endif + + mbedtls_ssl_send_t *f_send; /*!< Callback for network send */ + mbedtls_ssl_recv_t *f_recv; /*!< Callback for network receive */ + mbedtls_ssl_recv_timeout_t *f_recv_timeout; + /*!< Callback for network receive with timeout */ + + void *p_bio; /*!< context for I/O operations */ + + /* + * Session layer + */ + mbedtls_ssl_session *session_in; /*!< current session data (in) */ + mbedtls_ssl_session *session_out; /*!< current session data (out) */ + mbedtls_ssl_session *session; /*!< negotiated session data */ + mbedtls_ssl_session *session_negotiate; /*!< session data in negotiation */ + + mbedtls_ssl_handshake_params *handshake; /*!< params required only during + the handshake process */ + + /* + * Record layer transformations + */ + mbedtls_ssl_transform *transform_in; /*!< current transform params (in) */ + mbedtls_ssl_transform *transform_out; /*!< current transform params (in) */ + mbedtls_ssl_transform *transform; /*!< negotiated transform params */ + mbedtls_ssl_transform *transform_negotiate; /*!< transform params in negotiation */ + + /* + * Timers + */ + void *p_timer; /*!< context for the timer callbacks */ + + mbedtls_ssl_set_timer_t *f_set_timer; /*!< set timer callback */ + mbedtls_ssl_get_timer_t *f_get_timer; /*!< get timer callback */ + + /* + * Record layer (incoming data) + */ + unsigned char *in_buf; /*!< input buffer */ + unsigned char *in_ctr; /*!< 64-bit incoming message counter + TLS: maintained by us + DTLS: read from peer */ + unsigned char *in_hdr; /*!< start of record header */ +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + unsigned char *in_cid; /*!< The start of the CID; + * (the end is marked by in_len). */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + unsigned char *in_len; /*!< two-bytes message length field */ + unsigned char *in_iv; /*!< ivlen-byte IV */ + unsigned char *in_msg; /*!< message contents (in_iv+ivlen) */ + unsigned char *in_offt; /*!< read offset in application data */ + + int in_msgtype; /*!< record header: message type */ + size_t in_msglen; /*!< record header: message length */ + size_t in_left; /*!< amount of data read so far */ +#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) + size_t in_buf_len; /*!< length of input buffer */ +#endif +#if defined(MBEDTLS_SSL_PROTO_DTLS) + uint16_t in_epoch; /*!< DTLS epoch for incoming records */ + size_t next_record_offset; /*!< offset of the next record in datagram + (equal to in_left if none) */ +#endif /* MBEDTLS_SSL_PROTO_DTLS */ +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) + uint64_t in_window_top; /*!< last validated record seq_num */ + uint64_t in_window; /*!< bitmask for replay detection */ +#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */ + + size_t in_hslen; /*!< current handshake message length, + including the handshake header */ + int nb_zero; /*!< # of 0-length encrypted messages */ + + int keep_current_message; /*!< drop or reuse current message + on next call to record layer? */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + uint8_t disable_datagram_packing; /*!< Disable packing multiple records + * within a single datagram. */ +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + + /* + * Record layer (outgoing data) + */ + unsigned char *out_buf; /*!< output buffer */ + unsigned char *out_ctr; /*!< 64-bit outgoing message counter */ + unsigned char *out_hdr; /*!< start of record header */ +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + unsigned char *out_cid; /*!< The start of the CID; + * (the end is marked by in_len). */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + unsigned char *out_len; /*!< two-bytes message length field */ + unsigned char *out_iv; /*!< ivlen-byte IV */ + unsigned char *out_msg; /*!< message contents (out_iv+ivlen) */ + + int out_msgtype; /*!< record header: message type */ + size_t out_msglen; /*!< record header: message length */ + size_t out_left; /*!< amount of data not yet written */ +#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) + size_t out_buf_len; /*!< length of output buffer */ +#endif + + unsigned char cur_out_ctr[8]; /*!< Outgoing record sequence number. */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + uint16_t mtu; /*!< path mtu, used to fragment outgoing messages */ +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + +#if defined(MBEDTLS_ZLIB_SUPPORT) + unsigned char *compress_buf; /*!< zlib data buffer */ +#endif /* MBEDTLS_ZLIB_SUPPORT */ +#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) + signed char split_done; /*!< current record already split? */ +#endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */ + + /* + * PKI layer + */ + int client_auth; /*!< flag for client auth. */ + + /* + * User settings + */ +#if defined(MBEDTLS_X509_CRT_PARSE_C) + char *hostname; /*!< expected peer CN for verification + (and SNI if available) */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_ALPN) + const char *alpn_chosen; /*!< negotiated protocol */ +#endif /* MBEDTLS_SSL_ALPN */ + +#if defined(MBEDTLS_SSL_DTLS_SRTP) + /* + * use_srtp extension + */ + mbedtls_dtls_srtp_info dtls_srtp_info; +#endif /* MBEDTLS_SSL_DTLS_SRTP */ + + /* + * Information for DTLS hello verify + */ +#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) + unsigned char *cli_id; /*!< transport-level ID of the client */ + size_t cli_id_len; /*!< length of cli_id */ +#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */ + + /* + * Secure renegotiation + */ + /* needed to know when to send extension on server */ + int secure_renegotiation; /*!< does peer support legacy or + secure renegotiation */ +#if defined(MBEDTLS_SSL_RENEGOTIATION) + size_t verify_data_len; /*!< length of verify data stored */ + char own_verify_data[MBEDTLS_SSL_VERIFY_DATA_MAX_LEN]; /*!< previous handshake verify data */ + char peer_verify_data[MBEDTLS_SSL_VERIFY_DATA_MAX_LEN]; /*!< previous handshake verify data */ +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + /* CID configuration to use in subsequent handshakes. */ + + /*! The next incoming CID, chosen by the user and applying to + * all subsequent handshakes. This may be different from the + * CID currently used in case the user has re-configured the CID + * after an initial handshake. */ + unsigned char own_cid[ MBEDTLS_SSL_CID_IN_LEN_MAX ]; + uint8_t own_cid_len; /*!< The length of \c own_cid. */ + uint8_t negotiate_cid; /*!< This indicates whether the CID extension should + * be negotiated in the next handshake or not. + * Possible values are #MBEDTLS_SSL_CID_ENABLED + * and #MBEDTLS_SSL_CID_DISABLED. */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ +}; + +#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) + +#define MBEDTLS_SSL_CHANNEL_OUTBOUND MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( 0 ) +#define MBEDTLS_SSL_CHANNEL_INBOUND MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( 1 ) + +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif /* MBEDTLS_DEPRECATED_WARNING */ + +MBEDTLS_DEPRECATED extern int (*mbedtls_ssl_hw_record_init)( + mbedtls_ssl_context *ssl, + const unsigned char *key_enc, const unsigned char *key_dec, + size_t keylen, + const unsigned char *iv_enc, const unsigned char *iv_dec, + size_t ivlen, + const unsigned char *mac_enc, const unsigned char *mac_dec, + size_t maclen); +MBEDTLS_DEPRECATED extern int (*mbedtls_ssl_hw_record_activate)( + mbedtls_ssl_context *ssl, + int direction ); +MBEDTLS_DEPRECATED extern int (*mbedtls_ssl_hw_record_reset)( + mbedtls_ssl_context *ssl ); +MBEDTLS_DEPRECATED extern int (*mbedtls_ssl_hw_record_write)( + mbedtls_ssl_context *ssl ); +MBEDTLS_DEPRECATED extern int (*mbedtls_ssl_hw_record_read)( + mbedtls_ssl_context *ssl ); +MBEDTLS_DEPRECATED extern int (*mbedtls_ssl_hw_record_finish)( + mbedtls_ssl_context *ssl ); + +#undef MBEDTLS_DEPRECATED +#endif /* !MBEDTLS_DEPRECATED_REMOVED */ + +#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */ + +/** + * \brief Return the name of the ciphersuite associated with the + * given ID + * + * \param ciphersuite_id SSL ciphersuite ID + * + * \return a string containing the ciphersuite name + */ +const char *mbedtls_ssl_get_ciphersuite_name( const int ciphersuite_id ); + +/** + * \brief Return the ID of the ciphersuite associated with the + * given name + * + * \param ciphersuite_name SSL ciphersuite name + * + * \return the ID with the ciphersuite or 0 if not found + */ +int mbedtls_ssl_get_ciphersuite_id( const char *ciphersuite_name ); + +/** + * \brief Initialize an SSL context + * Just makes the context ready for mbedtls_ssl_setup() or + * mbedtls_ssl_free() + * + * \param ssl SSL context + */ +void mbedtls_ssl_init( mbedtls_ssl_context *ssl ); + +/** + * \brief Set up an SSL context for use + * + * \note No copy of the configuration context is made, it can be + * shared by many mbedtls_ssl_context structures. + * + * \warning The conf structure will be accessed during the session. + * It must not be modified or freed as long as the session + * is active. + * + * \warning This function must be called exactly once per context. + * Calling mbedtls_ssl_setup again is not supported, even + * if no session is active. + * + * \param ssl SSL context + * \param conf SSL configuration to use + * + * \return 0 if successful, or MBEDTLS_ERR_SSL_ALLOC_FAILED if + * memory allocation failed + */ +int mbedtls_ssl_setup( mbedtls_ssl_context *ssl, + const mbedtls_ssl_config *conf ); + +/** + * \brief Reset an already initialized SSL context for re-use + * while retaining application-set variables, function + * pointers and data. + * + * \param ssl SSL context + * \return 0 if successful, or MBEDTLS_ERR_SSL_ALLOC_FAILED, + MBEDTLS_ERR_SSL_HW_ACCEL_FAILED or + * MBEDTLS_ERR_SSL_COMPRESSION_FAILED + */ +int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl ); + +/** + * \brief Set the current endpoint type + * + * \param conf SSL configuration + * \param endpoint must be MBEDTLS_SSL_IS_CLIENT or MBEDTLS_SSL_IS_SERVER + */ +void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint ); + +/** + * \brief Set the transport type (TLS or DTLS). + * Default: TLS + * + * \note For DTLS, you must either provide a recv callback that + * doesn't block, or one that handles timeouts, see + * \c mbedtls_ssl_set_bio(). You also need to provide timer + * callbacks with \c mbedtls_ssl_set_timer_cb(). + * + * \param conf SSL configuration + * \param transport transport type: + * MBEDTLS_SSL_TRANSPORT_STREAM for TLS, + * MBEDTLS_SSL_TRANSPORT_DATAGRAM for DTLS. + */ +void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport ); + +/** + * \brief Set the certificate verification mode + * Default: NONE on server, REQUIRED on client + * + * \param conf SSL configuration + * \param authmode can be: + * + * MBEDTLS_SSL_VERIFY_NONE: peer certificate is not checked + * (default on server) + * (insecure on client) + * + * MBEDTLS_SSL_VERIFY_OPTIONAL: peer certificate is checked, however the + * handshake continues even if verification failed; + * mbedtls_ssl_get_verify_result() can be called after the + * handshake is complete. + * + * MBEDTLS_SSL_VERIFY_REQUIRED: peer *must* present a valid certificate, + * handshake is aborted if verification failed. + * (default on client) + * + * \note On client, MBEDTLS_SSL_VERIFY_REQUIRED is the recommended mode. + * With MBEDTLS_SSL_VERIFY_OPTIONAL, the user needs to call mbedtls_ssl_get_verify_result() at + * the right time(s), which may not be obvious, while REQUIRED always perform + * the verification as soon as possible. For example, REQUIRED was protecting + * against the "triple handshake" attack even before it was found. + */ +void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode ); + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Set the verification callback (Optional). + * + * If set, the provided verify callback is called for each + * certificate in the peer's CRT chain, including the trusted + * root. For more information, please see the documentation of + * \c mbedtls_x509_crt_verify(). + * + * \note For per context callbacks and contexts, please use + * mbedtls_ssl_set_verify() instead. + * + * \param conf The SSL configuration to use. + * \param f_vrfy The verification callback to use during CRT verification. + * \param p_vrfy The opaque context to be passed to the callback. + */ +void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy ); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +/** + * \brief Set the random number generator callback + * + * \param conf SSL configuration + * \param f_rng RNG function + * \param p_rng RNG parameter + */ +void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief Set the debug callback + * + * The callback has the following argument: + * void * opaque context for the callback + * int debug level + * const char * file name + * int line number + * const char * message + * + * \param conf SSL configuration + * \param f_dbg debug function + * \param p_dbg debug parameter + */ +void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf, + void (*f_dbg)(void *, int, const char *, int, const char *), + void *p_dbg ); + +/** + * \brief Set the underlying BIO callbacks for write, read and + * read-with-timeout. + * + * \param ssl SSL context + * \param p_bio parameter (context) shared by BIO callbacks + * \param f_send write callback + * \param f_recv read callback + * \param f_recv_timeout blocking read callback with timeout. + * + * \note One of f_recv or f_recv_timeout can be NULL, in which case + * the other is used. If both are non-NULL, f_recv_timeout is + * used and f_recv is ignored (as if it were NULL). + * + * \note The two most common use cases are: + * - non-blocking I/O, f_recv != NULL, f_recv_timeout == NULL + * - blocking I/O, f_recv == NULL, f_recv_timeout != NULL + * + * \note For DTLS, you need to provide either a non-NULL + * f_recv_timeout callback, or a f_recv that doesn't block. + * + * \note See the documentations of \c mbedtls_ssl_send_t, + * \c mbedtls_ssl_recv_t and \c mbedtls_ssl_recv_timeout_t for + * the conventions those callbacks must follow. + * + * \note On some platforms, net_sockets.c provides + * \c mbedtls_net_send(), \c mbedtls_net_recv() and + * \c mbedtls_net_recv_timeout() that are suitable to be used + * here. + */ +void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl, + void *p_bio, + mbedtls_ssl_send_t *f_send, + mbedtls_ssl_recv_t *f_recv, + mbedtls_ssl_recv_timeout_t *f_recv_timeout ); + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + + +/** + * \brief Configure the use of the Connection ID (CID) + * extension in the next handshake. + * + * Reference: draft-ietf-tls-dtls-connection-id-05 + * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05 + * + * The DTLS CID extension allows the reliable association of + * DTLS records to DTLS connections across changes in the + * underlying transport (changed IP and Port metadata) by + * adding explicit connection identifiers (CIDs) to the + * headers of encrypted DTLS records. The desired CIDs are + * configured by the application layer and are exchanged in + * new `ClientHello` / `ServerHello` extensions during the + * handshake, where each side indicates the CID it wants the + * peer to use when writing encrypted messages. The CIDs are + * put to use once records get encrypted: the stack discards + * any incoming records that don't include the configured CID + * in their header, and adds the peer's requested CID to the + * headers of outgoing messages. + * + * This API enables or disables the use of the CID extension + * in the next handshake and sets the value of the CID to + * be used for incoming messages. + * + * \param ssl The SSL context to configure. This must be initialized. + * \param enable This value determines whether the CID extension should + * be used or not. Possible values are: + * - MBEDTLS_SSL_CID_ENABLED to enable the use of the CID. + * - MBEDTLS_SSL_CID_DISABLED (default) to disable the use + * of the CID. + * \param own_cid The address of the readable buffer holding the CID we want + * the peer to use when sending encrypted messages to us. + * This may be \c NULL if \p own_cid_len is \c 0. + * This parameter is unused if \p enabled is set to + * MBEDTLS_SSL_CID_DISABLED. + * \param own_cid_len The length of \p own_cid. + * This parameter is unused if \p enabled is set to + * MBEDTLS_SSL_CID_DISABLED. + * + * \note The value of \p own_cid_len must match the value of the + * \c len parameter passed to mbedtls_ssl_conf_cid() + * when configuring the ::mbedtls_ssl_config that \p ssl + * is bound to. + * + * \note This CID configuration applies to subsequent handshakes + * performed on the SSL context \p ssl, but does not trigger + * one. You still have to call `mbedtls_ssl_handshake()` + * (for the initial handshake) or `mbedtls_ssl_renegotiate()` + * (for a renegotiation handshake) explicitly after a + * successful call to this function to run the handshake. + * + * \note This call cannot guarantee that the use of the CID + * will be successfully negotiated in the next handshake, + * because the peer might not support it. Specifically: + * - On the Client, enabling the use of the CID through + * this call implies that the `ClientHello` in the next + * handshake will include the CID extension, thereby + * offering the use of the CID to the server. Only if + * the `ServerHello` contains the CID extension, too, + * the CID extension will actually be put to use. + * - On the Server, enabling the use of the CID through + * this call implies that that the server will look for + * the CID extension in a `ClientHello` from the client, + * and, if present, reply with a CID extension in its + * `ServerHello`. + * + * \note To check whether the use of the CID was negotiated + * after the subsequent handshake has completed, please + * use the API mbedtls_ssl_get_peer_cid(). + * + * \warning If the use of the CID extension is enabled in this call + * and the subsequent handshake negotiates its use, Mbed TLS + * will silently drop every packet whose CID does not match + * the CID configured in \p own_cid. It is the responsibility + * of the user to adapt the underlying transport to take care + * of CID-based demultiplexing before handing datagrams to + * Mbed TLS. + * + * \return \c 0 on success. In this case, the CID configuration + * applies to the next handshake. + * \return A negative error code on failure. + */ +int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl, + int enable, + unsigned char const *own_cid, + size_t own_cid_len ); + +/** + * \brief Get information about the use of the CID extension + * in the current connection. + * + * \param ssl The SSL context to query. + * \param enabled The address at which to store whether the CID extension + * is currently in use or not. If the CID is in use, + * `*enabled` is set to MBEDTLS_SSL_CID_ENABLED; + * otherwise, it is set to MBEDTLS_SSL_CID_DISABLED. + * \param peer_cid The address of the buffer in which to store the CID + * chosen by the peer (if the CID extension is used). + * This may be \c NULL in case the value of peer CID + * isn't needed. If it is not \c NULL, \p peer_cid_len + * must not be \c NULL. + * \param peer_cid_len The address at which to store the size of the CID + * chosen by the peer (if the CID extension is used). + * This is also the number of Bytes in \p peer_cid that + * have been written. + * This may be \c NULL in case the length of the peer CID + * isn't needed. If it is \c NULL, \p peer_cid must be + * \c NULL, too. + * + * \note This applies to the state of the CID negotiated in + * the last complete handshake. If a handshake is in + * progress, this function will attempt to complete + * the handshake first. + * + * \note If CID extensions have been exchanged but both client + * and server chose to use an empty CID, this function + * sets `*enabled` to #MBEDTLS_SSL_CID_DISABLED + * (the rationale for this is that the resulting + * communication is the same as if the CID extensions + * hadn't been used). + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl, + int *enabled, + unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ], + size_t *peer_cid_len ); + +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + +/** + * \brief Set the Maximum Transport Unit (MTU). + * Special value: 0 means unset (no limit). + * This represents the maximum size of a datagram payload + * handled by the transport layer (usually UDP) as determined + * by the network link and stack. In practice, this controls + * the maximum size datagram the DTLS layer will pass to the + * \c f_send() callback set using \c mbedtls_ssl_set_bio(). + * + * \note The limit on datagram size is converted to a limit on + * record payload by subtracting the current overhead of + * encapsulation and encryption/authentication if any. + * + * \note This can be called at any point during the connection, for + * example when a Path Maximum Transfer Unit (PMTU) + * estimate becomes available from other sources, + * such as lower (or higher) protocol layers. + * + * \note This setting only controls the size of the packets we send, + * and does not restrict the size of the datagrams we're + * willing to receive. Client-side, you can request the + * server to use smaller records with \c + * mbedtls_ssl_conf_max_frag_len(). + * + * \note If both a MTU and a maximum fragment length have been + * configured (or negotiated with the peer), the resulting + * lower limit on record payload (see first note) is used. + * + * \note This can only be used to decrease the maximum size + * of datagrams (hence records, see first note) sent. It + * cannot be used to increase the maximum size of records over + * the limit set by #MBEDTLS_SSL_OUT_CONTENT_LEN. + * + * \note Values lower than the current record layer expansion will + * result in an error when trying to send data. + * + * \note Using record compression together with a non-zero MTU value + * will result in an error when trying to send data. + * + * \param ssl SSL context + * \param mtu Value of the path MTU in bytes + */ +void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu ); +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Set a connection-specific verification callback (optional). + * + * If set, the provided verify callback is called for each + * certificate in the peer's CRT chain, including the trusted + * root. For more information, please see the documentation of + * \c mbedtls_x509_crt_verify(). + * + * \note This call is analogous to mbedtls_ssl_conf_verify() but + * binds the verification callback and context to an SSL context + * as opposed to an SSL configuration. + * If mbedtls_ssl_conf_verify() and mbedtls_ssl_set_verify() + * are both used, mbedtls_ssl_set_verify() takes precedence. + * + * \param ssl The SSL context to use. + * \param f_vrfy The verification callback to use during CRT verification. + * \param p_vrfy The opaque context to be passed to the callback. + */ +void mbedtls_ssl_set_verify( mbedtls_ssl_context *ssl, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy ); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +/** + * \brief Set the timeout period for mbedtls_ssl_read() + * (Default: no timeout.) + * + * \param conf SSL configuration context + * \param timeout Timeout value in milliseconds. + * Use 0 for no timeout (default). + * + * \note With blocking I/O, this will only work if a non-NULL + * \c f_recv_timeout was set with \c mbedtls_ssl_set_bio(). + * With non-blocking I/O, this will only work if timer + * callbacks were set with \c mbedtls_ssl_set_timer_cb(). + * + * \note With non-blocking I/O, you may also skip this function + * altogether and handle timeouts at the application layer. + */ +void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout ); + +#if defined(MBEDTLS_SSL_RECORD_CHECKING) +/** + * \brief Check whether a buffer contains a valid and authentic record + * that has not been seen before. (DTLS only). + * + * This function does not change the user-visible state + * of the SSL context. Its sole purpose is to provide + * an indication of the legitimacy of an incoming record. + * + * This can be useful e.g. in distributed server environments + * using the DTLS Connection ID feature, in which connections + * might need to be passed between service instances on a change + * of peer address, but where such disruptive operations should + * only happen after the validity of incoming records has been + * confirmed. + * + * \param ssl The SSL context to use. + * \param buf The address of the buffer holding the record to be checked. + * This must be a read/write buffer of length \p buflen Bytes. + * \param buflen The length of \p buf in Bytes. + * + * \note This routine only checks whether the provided buffer begins + * with a valid and authentic record that has not been seen + * before, but does not check potential data following the + * initial record. In particular, it is possible to pass DTLS + * datagrams containing multiple records, in which case only + * the first record is checked. + * + * \note This function modifies the input buffer \p buf. If you need + * to preserve the original record, you have to maintain a copy. + * + * \return \c 0 if the record is valid and authentic and has not been + * seen before. + * \return MBEDTLS_ERR_SSL_INVALID_MAC if the check completed + * successfully but the record was found to be not authentic. + * \return MBEDTLS_ERR_SSL_INVALID_RECORD if the check completed + * successfully but the record was found to be invalid for + * a reason different from authenticity checking. + * \return MBEDTLS_ERR_SSL_UNEXPECTED_RECORD if the check completed + * successfully but the record was found to be unexpected + * in the state of the SSL context, including replayed records. + * \return Another negative error code on different kinds of failure. + * In this case, the SSL context becomes unusable and needs + * to be freed or reset before reuse. + */ +int mbedtls_ssl_check_record( mbedtls_ssl_context const *ssl, + unsigned char *buf, + size_t buflen ); +#endif /* MBEDTLS_SSL_RECORD_CHECKING */ + +/** + * \brief Set the timer callbacks (Mandatory for DTLS.) + * + * \param ssl SSL context + * \param p_timer parameter (context) shared by timer callbacks + * \param f_set_timer set timer callback + * \param f_get_timer get timer callback. Must return: + * + * \note See the documentation of \c mbedtls_ssl_set_timer_t and + * \c mbedtls_ssl_get_timer_t for the conventions this pair of + * callbacks must follow. + * + * \note On some platforms, timing.c provides + * \c mbedtls_timing_set_delay() and + * \c mbedtls_timing_get_delay() that are suitable for using + * here, except if using an event-driven style. + * + * \note See also the "DTLS tutorial" article in our knowledge base. + * https://tls.mbed.org/kb/how-to/dtls-tutorial + */ +void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl, + void *p_timer, + mbedtls_ssl_set_timer_t *f_set_timer, + mbedtls_ssl_get_timer_t *f_get_timer ); + +/** + * \brief Callback type: generate and write session ticket + * + * \note This describes what a callback implementation should do. + * This callback should generate an encrypted and + * authenticated ticket for the session and write it to the + * output buffer. Here, ticket means the opaque ticket part + * of the NewSessionTicket structure of RFC 5077. + * + * \param p_ticket Context for the callback + * \param session SSL session to be written in the ticket + * \param start Start of the output buffer + * \param end End of the output buffer + * \param tlen On exit, holds the length written + * \param lifetime On exit, holds the lifetime of the ticket in seconds + * + * \return 0 if successful, or + * a specific MBEDTLS_ERR_XXX code. + */ +typedef int mbedtls_ssl_ticket_write_t( void *p_ticket, + const mbedtls_ssl_session *session, + unsigned char *start, + const unsigned char *end, + size_t *tlen, + uint32_t *lifetime ); + +#if defined(MBEDTLS_SSL_EXPORT_KEYS) +/** + * \brief Callback type: Export key block and master secret + * + * \note This is required for certain uses of TLS, e.g. EAP-TLS + * (RFC 5216) and Thread. The key pointers are ephemeral and + * therefore must not be stored. The master secret and keys + * should not be used directly except as an input to a key + * derivation function. + * + * \param p_expkey Context for the callback + * \param ms Pointer to master secret (fixed length: 48 bytes) + * \param kb Pointer to key block, see RFC 5246 section 6.3 + * (variable length: 2 * maclen + 2 * keylen + 2 * ivlen). + * \param maclen MAC length + * \param keylen Key length + * \param ivlen IV length + * + * \return 0 if successful, or + * a specific MBEDTLS_ERR_XXX code. + */ +typedef int mbedtls_ssl_export_keys_t( void *p_expkey, + const unsigned char *ms, + const unsigned char *kb, + size_t maclen, + size_t keylen, + size_t ivlen ); + +/** + * \brief Callback type: Export key block, master secret, + * handshake randbytes and the tls_prf function + * used to derive keys. + * + * \note This is required for certain uses of TLS, e.g. EAP-TLS + * (RFC 5216) and Thread. The key pointers are ephemeral and + * therefore must not be stored. The master secret and keys + * should not be used directly except as an input to a key + * derivation function. + * + * \param p_expkey Context for the callback. + * \param ms Pointer to master secret (fixed length: 48 bytes). + * \param kb Pointer to key block, see RFC 5246 section 6.3. + * (variable length: 2 * maclen + 2 * keylen + 2 * ivlen). + * \param maclen MAC length. + * \param keylen Key length. + * \param ivlen IV length. + * \param client_random The client random bytes. + * \param server_random The server random bytes. + * \param tls_prf_type The tls_prf enum type. + * + * \return 0 if successful, or + * a specific MBEDTLS_ERR_XXX code. + */ +typedef int mbedtls_ssl_export_keys_ext_t( void *p_expkey, + const unsigned char *ms, + const unsigned char *kb, + size_t maclen, + size_t keylen, + size_t ivlen, + const unsigned char client_random[32], + const unsigned char server_random[32], + mbedtls_tls_prf_types tls_prf_type ); +#endif /* MBEDTLS_SSL_EXPORT_KEYS */ + +/** + * \brief Callback type: parse and load session ticket + * + * \note This describes what a callback implementation should do. + * This callback should parse a session ticket as generated + * by the corresponding mbedtls_ssl_ticket_write_t function, + * and, if the ticket is authentic and valid, load the + * session. + * + * \note The implementation is allowed to modify the first len + * bytes of the input buffer, eg to use it as a temporary + * area for the decrypted ticket contents. + * + * \param p_ticket Context for the callback + * \param session SSL session to be loaded + * \param buf Start of the buffer containing the ticket + * \param len Length of the ticket. + * + * \return 0 if successful, or + * MBEDTLS_ERR_SSL_INVALID_MAC if not authentic, or + * MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED if expired, or + * any other non-zero code for other failures. + */ +typedef int mbedtls_ssl_ticket_parse_t( void *p_ticket, + mbedtls_ssl_session *session, + unsigned char *buf, + size_t len ); + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Configure SSL session ticket callbacks (server only). + * (Default: none.) + * + * \note On server, session tickets are enabled by providing + * non-NULL callbacks. + * + * \note On client, use \c mbedtls_ssl_conf_session_tickets(). + * + * \param conf SSL configuration context + * \param f_ticket_write Callback for writing a ticket + * \param f_ticket_parse Callback for parsing a ticket + * \param p_ticket Context shared by the two callbacks + */ +void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf, + mbedtls_ssl_ticket_write_t *f_ticket_write, + mbedtls_ssl_ticket_parse_t *f_ticket_parse, + void *p_ticket ); +#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_SRV_C */ + +#if defined(MBEDTLS_SSL_EXPORT_KEYS) +/** + * \brief Configure key export callback. + * (Default: none.) + * + * \note See \c mbedtls_ssl_export_keys_t. + * + * \param conf SSL configuration context + * \param f_export_keys Callback for exporting keys + * \param p_export_keys Context for the callback + */ +void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf, + mbedtls_ssl_export_keys_t *f_export_keys, + void *p_export_keys ); + +/** + * \brief Configure extended key export callback. + * (Default: none.) + * + * \note See \c mbedtls_ssl_export_keys_ext_t. + * \warning Exported key material must not be used for any purpose + * before the (D)TLS handshake is completed + * + * \param conf SSL configuration context + * \param f_export_keys_ext Callback for exporting keys + * \param p_export_keys Context for the callback + */ +void mbedtls_ssl_conf_export_keys_ext_cb( mbedtls_ssl_config *conf, + mbedtls_ssl_export_keys_ext_t *f_export_keys_ext, + void *p_export_keys ); +#endif /* MBEDTLS_SSL_EXPORT_KEYS */ + +#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) +/** + * \brief Configure asynchronous private key operation callbacks. + * + * \param conf SSL configuration context + * \param f_async_sign Callback to start a signature operation. See + * the description of ::mbedtls_ssl_async_sign_t + * for more information. This may be \c NULL if the + * external processor does not support any signature + * operation; in this case the private key object + * associated with the certificate will be used. + * \param f_async_decrypt Callback to start a decryption operation. See + * the description of ::mbedtls_ssl_async_decrypt_t + * for more information. This may be \c NULL if the + * external processor does not support any decryption + * operation; in this case the private key object + * associated with the certificate will be used. + * \param f_async_resume Callback to resume an asynchronous operation. See + * the description of ::mbedtls_ssl_async_resume_t + * for more information. This may not be \c NULL unless + * \p f_async_sign and \p f_async_decrypt are both + * \c NULL. + * \param f_async_cancel Callback to cancel an asynchronous operation. See + * the description of ::mbedtls_ssl_async_cancel_t + * for more information. This may be \c NULL if + * no cleanup is needed. + * \param config_data A pointer to configuration data which can be + * retrieved with + * mbedtls_ssl_conf_get_async_config_data(). The + * library stores this value without dereferencing it. + */ +void mbedtls_ssl_conf_async_private_cb( mbedtls_ssl_config *conf, + mbedtls_ssl_async_sign_t *f_async_sign, + mbedtls_ssl_async_decrypt_t *f_async_decrypt, + mbedtls_ssl_async_resume_t *f_async_resume, + mbedtls_ssl_async_cancel_t *f_async_cancel, + void *config_data ); + +/** + * \brief Retrieve the configuration data set by + * mbedtls_ssl_conf_async_private_cb(). + * + * \param conf SSL configuration context + * \return The configuration data set by + * mbedtls_ssl_conf_async_private_cb(). + */ +void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf ); + +/** + * \brief Retrieve the asynchronous operation user context. + * + * \note This function may only be called while a handshake + * is in progress. + * + * \param ssl The SSL context to access. + * + * \return The asynchronous operation user context that was last + * set during the current handshake. If + * mbedtls_ssl_set_async_operation_data() has not yet been + * called during the current handshake, this function returns + * \c NULL. + */ +void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl ); + +/** + * \brief Retrieve the asynchronous operation user context. + * + * \note This function may only be called while a handshake + * is in progress. + * + * \param ssl The SSL context to access. + * \param ctx The new value of the asynchronous operation user context. + * Call mbedtls_ssl_get_async_operation_data() later during the + * same handshake to retrieve this value. + */ +void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl, + void *ctx ); +#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ + +/** + * \brief Callback type: generate a cookie + * + * \param ctx Context for the callback + * \param p Buffer to write to, + * must be updated to point right after the cookie + * \param end Pointer to one past the end of the output buffer + * \param info Client ID info that was passed to + * \c mbedtls_ssl_set_client_transport_id() + * \param ilen Length of info in bytes + * + * \return The callback must return 0 on success, + * or a negative error code. + */ +typedef int mbedtls_ssl_cookie_write_t( void *ctx, + unsigned char **p, unsigned char *end, + const unsigned char *info, size_t ilen ); + +/** + * \brief Callback type: verify a cookie + * + * \param ctx Context for the callback + * \param cookie Cookie to verify + * \param clen Length of cookie + * \param info Client ID info that was passed to + * \c mbedtls_ssl_set_client_transport_id() + * \param ilen Length of info in bytes + * + * \return The callback must return 0 if cookie is valid, + * or a negative error code. + */ +typedef int mbedtls_ssl_cookie_check_t( void *ctx, + const unsigned char *cookie, size_t clen, + const unsigned char *info, size_t ilen ); + +#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Register callbacks for DTLS cookies + * (Server only. DTLS only.) + * + * Default: dummy callbacks that fail, in order to force you to + * register working callbacks (and initialize their context). + * + * To disable HelloVerifyRequest, register NULL callbacks. + * + * \warning Disabling hello verification allows your server to be used + * for amplification in DoS attacks against other hosts. + * Only disable if you known this can't happen in your + * particular environment. + * + * \note See comments on \c mbedtls_ssl_handshake() about handling + * the MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED that is expected + * on the first handshake attempt when this is enabled. + * + * \note This is also necessary to handle client reconnection from + * the same port as described in RFC 6347 section 4.2.8 (only + * the variant with cookies is supported currently). See + * comments on \c mbedtls_ssl_read() for details. + * + * \param conf SSL configuration + * \param f_cookie_write Cookie write callback + * \param f_cookie_check Cookie check callback + * \param p_cookie Context for both callbacks + */ +void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf, + mbedtls_ssl_cookie_write_t *f_cookie_write, + mbedtls_ssl_cookie_check_t *f_cookie_check, + void *p_cookie ); + +/** + * \brief Set client's transport-level identification info. + * (Server only. DTLS only.) + * + * This is usually the IP address (and port), but could be + * anything identify the client depending on the underlying + * network stack. Used for HelloVerifyRequest with DTLS. + * This is *not* used to route the actual packets. + * + * \param ssl SSL context + * \param info Transport-level info identifying the client (eg IP + port) + * \param ilen Length of info in bytes + * + * \note An internal copy is made, so the info buffer can be reused. + * + * \return 0 on success, + * MBEDTLS_ERR_SSL_BAD_INPUT_DATA if used on client, + * MBEDTLS_ERR_SSL_ALLOC_FAILED if out of memory. + */ +int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl, + const unsigned char *info, + size_t ilen ); + +#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */ + +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) +/** + * \brief Enable or disable anti-replay protection for DTLS. + * (DTLS only, no effect on TLS.) + * Default: enabled. + * + * \param conf SSL configuration + * \param mode MBEDTLS_SSL_ANTI_REPLAY_ENABLED or MBEDTLS_SSL_ANTI_REPLAY_DISABLED. + * + * \warning Disabling this is a security risk unless the application + * protocol handles duplicated packets in a safe way. You + * should not disable this without careful consideration. + * However, if your application already detects duplicated + * packets and needs information about them to adjust its + * transmission strategy, then you'll want to disable this. + */ +void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode ); +#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */ + +#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) +/** + * \brief Set a limit on the number of records with a bad MAC + * before terminating the connection. + * (DTLS only, no effect on TLS.) + * Default: 0 (disabled). + * + * \param conf SSL configuration + * \param limit Limit, or 0 to disable. + * + * \note If the limit is N, then the connection is terminated when + * the Nth non-authentic record is seen. + * + * \note Records with an invalid header are not counted, only the + * ones going through the authentication-decryption phase. + * + * \note This is a security trade-off related to the fact that it's + * often relatively easy for an active attacker to inject UDP + * datagrams. On one hand, setting a low limit here makes it + * easier for such an attacker to forcibly terminated a + * connection. On the other hand, a high limit or no limit + * might make us waste resources checking authentication on + * many bogus packets. + */ +void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit ); +#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + +/** + * \brief Allow or disallow packing of multiple handshake records + * within a single datagram. + * + * \param ssl The SSL context to configure. + * \param allow_packing This determines whether datagram packing may + * be used or not. A value of \c 0 means that every + * record will be sent in a separate datagram; a + * value of \c 1 means that, if space permits, + * multiple handshake messages (including CCS) belonging to + * a single flight may be packed within a single datagram. + * + * \note This is enabled by default and should only be disabled + * for test purposes, or if datagram packing causes + * interoperability issues with peers that don't support it. + * + * \note Allowing datagram packing reduces the network load since + * there's less overhead if multiple messages share the same + * datagram. Also, it increases the handshake efficiency + * since messages belonging to a single datagram will not + * be reordered in transit, and so future message buffering + * or flight retransmission (if no buffering is used) as + * means to deal with reordering are needed less frequently. + * + * \note Application records are not affected by this option and + * are currently always sent in separate datagrams. + * + */ +void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl, + unsigned allow_packing ); + +/** + * \brief Set retransmit timeout values for the DTLS handshake. + * (DTLS only, no effect on TLS.) + * + * \param conf SSL configuration + * \param min Initial timeout value in milliseconds. + * Default: 1000 (1 second). + * \param max Maximum timeout value in milliseconds. + * Default: 60000 (60 seconds). + * + * \note Default values are from RFC 6347 section 4.2.4.1. + * + * \note The 'min' value should typically be slightly above the + * expected round-trip time to your peer, plus whatever time + * it takes for the peer to process the message. For example, + * if your RTT is about 600ms and you peer needs up to 1s to + * do the cryptographic operations in the handshake, then you + * should set 'min' slightly above 1600. Lower values of 'min' + * might cause spurious resends which waste network resources, + * while larger value of 'min' will increase overall latency + * on unreliable network links. + * + * \note The more unreliable your network connection is, the larger + * your max / min ratio needs to be in order to achieve + * reliable handshakes. + * + * \note Messages are retransmitted up to log2(ceil(max/min)) times. + * For example, if min = 1s and max = 5s, the retransmit plan + * goes: send ... 1s -> resend ... 2s -> resend ... 4s -> + * resend ... 5s -> give up and return a timeout error. + */ +void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf, uint32_t min, uint32_t max ); +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + +#if defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Set the session cache callbacks (server-side only) + * If not set, no session resuming is done (except if session + * tickets are enabled too). + * + * The session cache has the responsibility to check for stale + * entries based on timeout. See RFC 5246 for recommendations. + * + * Warning: session.peer_cert is cleared by the SSL/TLS layer on + * connection shutdown, so do not cache the pointer! Either set + * it to NULL or make a full copy of the certificate. + * + * The get callback is called once during the initial handshake + * to enable session resuming. The get function has the + * following parameters: (void *parameter, mbedtls_ssl_session *session) + * If a valid entry is found, it should fill the master of + * the session object with the cached values and return 0, + * return 1 otherwise. Optionally peer_cert can be set as well + * if it is properly present in cache entry. + * + * The set callback is called once during the initial handshake + * to enable session resuming after the entire handshake has + * been finished. The set function has the following parameters: + * (void *parameter, const mbedtls_ssl_session *session). The function + * should create a cache entry for future retrieval based on + * the data in the session structure and should keep in mind + * that the mbedtls_ssl_session object presented (and all its referenced + * data) is cleared by the SSL/TLS layer when the connection is + * terminated. It is recommended to add metadata to determine if + * an entry is still valid in the future. Return 0 if + * successfully cached, return 1 otherwise. + * + * \param conf SSL configuration + * \param p_cache parameter (context) for both callbacks + * \param f_get_cache session get callback + * \param f_set_cache session set callback + */ +void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf, + void *p_cache, + int (*f_get_cache)(void *, mbedtls_ssl_session *), + int (*f_set_cache)(void *, const mbedtls_ssl_session *) ); +#endif /* MBEDTLS_SSL_SRV_C */ + +#if defined(MBEDTLS_SSL_CLI_C) +/** + * \brief Request resumption of session (client-side only) + * Session data is copied from presented session structure. + * + * \param ssl SSL context + * \param session session context + * + * \return 0 if successful, + * MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed, + * MBEDTLS_ERR_SSL_BAD_INPUT_DATA if used server-side or + * arguments are otherwise invalid + * + * \sa mbedtls_ssl_get_session() + */ +int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session ); +#endif /* MBEDTLS_SSL_CLI_C */ + +/** + * \brief Load serialized session data into a session structure. + * On client, this can be used for loading saved sessions + * before resuming them with mbedtls_ssl_set_session(). + * On server, this can be used for alternative implementations + * of session cache or session tickets. + * + * \warning If a peer certificate chain is associated with the session, + * the serialized state will only contain the peer's + * end-entity certificate and the result of the chain + * verification (unless verification was disabled), but not + * the rest of the chain. + * + * \see mbedtls_ssl_session_save() + * \see mbedtls_ssl_set_session() + * + * \param session The session structure to be populated. It must have been + * initialised with mbedtls_ssl_session_init() but not + * populated yet. + * \param buf The buffer holding the serialized session data. It must be a + * readable buffer of at least \p len bytes. + * \param len The size of the serialized data in bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed. + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if input data is invalid. + * \return #MBEDTLS_ERR_SSL_VERSION_MISMATCH if the serialized data + * was generated in a different version or configuration of + * Mbed TLS. + * \return Another negative value for other kinds of errors (for + * example, unsupported features in the embedded certificate). + */ +int mbedtls_ssl_session_load( mbedtls_ssl_session *session, + const unsigned char *buf, + size_t len ); + +/** + * \brief Save session structure as serialized data in a buffer. + * On client, this can be used for saving session data, + * potentially in non-volatile storage, for resuming later. + * On server, this can be used for alternative implementations + * of session cache or session tickets. + * + * \see mbedtls_ssl_session_load() + * \see mbedtls_ssl_get_session_pointer() + * + * \param session The session structure to be saved. + * \param buf The buffer to write the serialized data to. It must be a + * writeable buffer of at least \p len bytes, or may be \c + * NULL if \p len is \c 0. + * \param buf_len The number of bytes available for writing in \p buf. + * \param olen The size in bytes of the data that has been or would have + * been written. It must point to a valid \c size_t. + * + * \note \p olen is updated to the correct value regardless of + * whether \p buf_len was large enough. This makes it possible + * to determine the necessary size by calling this function + * with \p buf set to \c NULL and \p buf_len to \c 0. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL if \p buf is too small. + */ +int mbedtls_ssl_session_save( const mbedtls_ssl_session *session, + unsigned char *buf, + size_t buf_len, + size_t *olen ); + +/** + * \brief Get a pointer to the current session structure, for example + * to serialize it. + * + * \warning Ownership of the session remains with the SSL context, and + * the returned pointer is only guaranteed to be valid until + * the next API call operating on the same \p ssl context. + * + * \see mbedtls_ssl_session_save() + * + * \param ssl The SSL context. + * + * \return A pointer to the current session if successful. + * \return \c NULL if no session is active. + */ +const mbedtls_ssl_session *mbedtls_ssl_get_session_pointer( const mbedtls_ssl_context *ssl ); + +/** + * \brief Set the list of allowed ciphersuites and the preference + * order. First in the list has the highest preference. + * (Overrides all version-specific lists) + * + * The ciphersuites array is not copied, and must remain + * valid for the lifetime of the ssl_config. + * + * Note: The server uses its own preferences + * over the preference of the client unless + * MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE is defined! + * + * \param conf SSL configuration + * \param ciphersuites 0-terminated list of allowed ciphersuites + */ +void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf, + const int *ciphersuites ); + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) +#define MBEDTLS_SSL_UNEXPECTED_CID_IGNORE 0 +#define MBEDTLS_SSL_UNEXPECTED_CID_FAIL 1 +/** + * \brief Specify the length of Connection IDs for incoming + * encrypted DTLS records, as well as the behaviour + * on unexpected CIDs. + * + * By default, the CID length is set to \c 0, + * and unexpected CIDs are silently ignored. + * + * \param conf The SSL configuration to modify. + * \param len The length in Bytes of the CID fields in encrypted + * DTLS records using the CID mechanism. This must + * not be larger than #MBEDTLS_SSL_CID_OUT_LEN_MAX. + * \param ignore_other_cids This determines the stack's behaviour when + * receiving a record with an unexpected CID. + * Possible values are: + * - #MBEDTLS_SSL_UNEXPECTED_CID_IGNORE + * In this case, the record is silently ignored. + * - #MBEDTLS_SSL_UNEXPECTED_CID_FAIL + * In this case, the stack fails with the specific + * error code #MBEDTLS_ERR_SSL_UNEXPECTED_CID. + * + * \note The CID specification allows implementations to either + * use a common length for all incoming connection IDs or + * allow variable-length incoming IDs. Mbed TLS currently + * requires a common length for all connections sharing the + * same SSL configuration; this allows simpler parsing of + * record headers. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if \p own_cid_len + * is too large. + */ +int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf, size_t len, + int ignore_other_cids ); +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + +/** + * \brief Set the list of allowed ciphersuites and the + * preference order for a specific version of the protocol. + * (Only useful on the server side) + * + * The ciphersuites array is not copied, and must remain + * valid for the lifetime of the ssl_config. + * + * \param conf SSL configuration + * \param ciphersuites 0-terminated list of allowed ciphersuites + * \param major Major version number (only MBEDTLS_SSL_MAJOR_VERSION_3 + * supported) + * \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_0, + * MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2, + * MBEDTLS_SSL_MINOR_VERSION_3 supported) + * + * \note With DTLS, use MBEDTLS_SSL_MINOR_VERSION_2 for DTLS 1.0 + * and MBEDTLS_SSL_MINOR_VERSION_3 for DTLS 1.2 + */ +void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf, + const int *ciphersuites, + int major, int minor ); + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Set the X.509 security profile used for verification + * + * \note The restrictions are enforced for all certificates in the + * chain. However, signatures in the handshake are not covered + * by this setting but by \b mbedtls_ssl_conf_sig_hashes(). + * + * \param conf SSL configuration + * \param profile Profile to use + */ +void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf, + const mbedtls_x509_crt_profile *profile ); + +/** + * \brief Set the data required to verify peer certificate + * + * \note See \c mbedtls_x509_crt_verify() for notes regarding the + * parameters ca_chain (maps to trust_ca for that function) + * and ca_crl. + * + * \param conf SSL configuration + * \param ca_chain trusted CA chain (meaning all fully trusted top-level CAs) + * \param ca_crl trusted CA CRLs + */ +void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf, + mbedtls_x509_crt *ca_chain, + mbedtls_x509_crl *ca_crl ); + +#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) +/** + * \brief Set the trusted certificate callback. + * + * This API allows to register the set of trusted certificates + * through a callback, instead of a linked list as configured + * by mbedtls_ssl_conf_ca_chain(). + * + * This is useful for example in contexts where a large number + * of CAs are used, and the inefficiency of maintaining them + * in a linked list cannot be tolerated. It is also useful when + * the set of trusted CAs needs to be modified frequently. + * + * See the documentation of `mbedtls_x509_crt_ca_cb_t` for + * more information. + * + * \param conf The SSL configuration to register the callback with. + * \param f_ca_cb The trusted certificate callback to use when verifying + * certificate chains. + * \param p_ca_cb The context to be passed to \p f_ca_cb (for example, + * a reference to a trusted CA database). + * + * \note This API is incompatible with mbedtls_ssl_conf_ca_chain(): + * Any call to this function overwrites the values set through + * earlier calls to mbedtls_ssl_conf_ca_chain() or + * mbedtls_ssl_conf_ca_cb(). + * + * \note This API is incompatible with CA indication in + * CertificateRequest messages: A server-side SSL context which + * is bound to an SSL configuration that uses a CA callback + * configured via mbedtls_ssl_conf_ca_cb(), and which requires + * client authentication, will send an empty CA list in the + * corresponding CertificateRequest message. + * + * \note This API is incompatible with mbedtls_ssl_set_hs_ca_chain(): + * If an SSL context is bound to an SSL configuration which uses + * CA callbacks configured via mbedtls_ssl_conf_ca_cb(), then + * calls to mbedtls_ssl_set_hs_ca_chain() have no effect. + * + * \note The use of this API disables the use of restartable ECC + * during X.509 CRT signature verification (but doesn't affect + * other uses). + * + * \warning This API is incompatible with the use of CRLs. Any call to + * mbedtls_ssl_conf_ca_cb() unsets CRLs configured through + * earlier calls to mbedtls_ssl_conf_ca_chain(). + * + * \warning In multi-threaded environments, the callback \p f_ca_cb + * must be thread-safe, and it is the user's responsibility + * to guarantee this (for example through a mutex + * contained in the callback context pointed to by \p p_ca_cb). + */ +void mbedtls_ssl_conf_ca_cb( mbedtls_ssl_config *conf, + mbedtls_x509_crt_ca_cb_t f_ca_cb, + void *p_ca_cb ); +#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ + +/** + * \brief Set own certificate chain and private key + * + * \note own_cert should contain in order from the bottom up your + * certificate chain. The top certificate (self-signed) + * can be omitted. + * + * \note On server, this function can be called multiple times to + * provision more than one cert/key pair (eg one ECDSA, one + * RSA with SHA-256, one RSA with SHA-1). An adequate + * certificate will be selected according to the client's + * advertised capabilities. In case multiple certificates are + * adequate, preference is given to the one set by the first + * call to this function, then second, etc. + * + * \note On client, only the first call has any effect. That is, + * only one client certificate can be provisioned. The + * server's preferences in its CertificateRequest message will + * be ignored and our only cert will be sent regardless of + * whether it matches those preferences - the server can then + * decide what it wants to do with it. + * + * \note The provided \p pk_key needs to match the public key in the + * first certificate in \p own_cert, or all handshakes using + * that certificate will fail. It is your responsibility + * to ensure that; this function will not perform any check. + * You may use mbedtls_pk_check_pair() in order to perform + * this check yourself, but be aware that this function can + * be computationally expensive on some key types. + * + * \param conf SSL configuration + * \param own_cert own public certificate chain + * \param pk_key own private key + * + * \return 0 on success or MBEDTLS_ERR_SSL_ALLOC_FAILED + */ +int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf, + mbedtls_x509_crt *own_cert, + mbedtls_pk_context *pk_key ); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) +/** + * \brief Configure a pre-shared key (PSK) and identity + * to be used in PSK-based ciphersuites. + * + * \note This is mainly useful for clients. Servers will usually + * want to use \c mbedtls_ssl_conf_psk_cb() instead. + * + * \note A PSK set by \c mbedtls_ssl_set_hs_psk() in the PSK callback + * takes precedence over a PSK configured by this function. + * + * \warning Currently, clients can only register a single pre-shared key. + * Calling this function or mbedtls_ssl_conf_psk_opaque() more + * than once will overwrite values configured in previous calls. + * Support for setting multiple PSKs on clients and selecting + * one based on the identity hint is not a planned feature, + * but feedback is welcomed. + * + * \param conf The SSL configuration to register the PSK with. + * \param psk The pointer to the pre-shared key to use. + * \param psk_len The length of the pre-shared key in bytes. + * \param psk_identity The pointer to the pre-shared key identity. + * \param psk_identity_len The length of the pre-shared key identity + * in bytes. + * + * \note The PSK and its identity are copied internally and + * hence need not be preserved by the caller for the lifetime + * of the SSL configuration. + * + * \return \c 0 if successful. + * \return An \c MBEDTLS_ERR_SSL_XXX error code on failure. + */ +int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf, + const unsigned char *psk, size_t psk_len, + const unsigned char *psk_identity, size_t psk_identity_len ); + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +/** + * \brief Configure an opaque pre-shared key (PSK) and identity + * to be used in PSK-based ciphersuites. + * + * \note This is mainly useful for clients. Servers will usually + * want to use \c mbedtls_ssl_conf_psk_cb() instead. + * + * \note An opaque PSK set by \c mbedtls_ssl_set_hs_psk_opaque() in + * the PSK callback takes precedence over an opaque PSK + * configured by this function. + * + * \warning Currently, clients can only register a single pre-shared key. + * Calling this function or mbedtls_ssl_conf_psk() more than + * once will overwrite values configured in previous calls. + * Support for setting multiple PSKs on clients and selecting + * one based on the identity hint is not a planned feature, + * but feedback is welcomed. + * + * \param conf The SSL configuration to register the PSK with. + * \param psk The identifier of the key slot holding the PSK. + * Until \p conf is destroyed or this function is successfully + * called again, the key slot \p psk must be populated with a + * key of type PSA_ALG_CATEGORY_KEY_DERIVATION whose policy + * allows its use for the key derivation algorithm applied + * in the handshake. + * \param psk_identity The pointer to the pre-shared key identity. + * \param psk_identity_len The length of the pre-shared key identity + * in bytes. + * + * \note The PSK identity hint is copied internally and hence need + * not be preserved by the caller for the lifetime of the + * SSL configuration. + * + * \return \c 0 if successful. + * \return An \c MBEDTLS_ERR_SSL_XXX error code on failure. + */ +int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf, + psa_key_id_t psk, + const unsigned char *psk_identity, + size_t psk_identity_len ); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +/** + * \brief Set the pre-shared Key (PSK) for the current handshake. + * + * \note This should only be called inside the PSK callback, + * i.e. the function passed to \c mbedtls_ssl_conf_psk_cb(). + * + * \note A PSK set by this function takes precedence over a PSK + * configured by \c mbedtls_ssl_conf_psk(). + * + * \param ssl The SSL context to configure a PSK for. + * \param psk The pointer to the pre-shared key. + * \param psk_len The length of the pre-shared key in bytes. + * + * \return \c 0 if successful. + * \return An \c MBEDTLS_ERR_SSL_XXX error code on failure. + */ +int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl, + const unsigned char *psk, size_t psk_len ); + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +/** + * \brief Set an opaque pre-shared Key (PSK) for the current handshake. + * + * \note This should only be called inside the PSK callback, + * i.e. the function passed to \c mbedtls_ssl_conf_psk_cb(). + * + * \note An opaque PSK set by this function takes precedence over an + * opaque PSK configured by \c mbedtls_ssl_conf_psk_opaque(). + * + * \param ssl The SSL context to configure a PSK for. + * \param psk The identifier of the key slot holding the PSK. + * For the duration of the current handshake, the key slot + * must be populated with a key of type + * PSA_ALG_CATEGORY_KEY_DERIVATION whose policy allows its + * use for the key derivation algorithm + * applied in the handshake. + * + * \return \c 0 if successful. + * \return An \c MBEDTLS_ERR_SSL_XXX error code on failure. + */ +int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl, + psa_key_id_t psk ); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +/** + * \brief Set the PSK callback (server-side only). + * + * If set, the PSK callback is called for each + * handshake where a PSK-based ciphersuite was negotiated. + * The caller provides the identity received and wants to + * receive the actual PSK data and length. + * + * The callback has the following parameters: + * - \c void*: The opaque pointer \p p_psk. + * - \c mbedtls_ssl_context*: The SSL context to which + * the operation applies. + * - \c const unsigned char*: The PSK identity + * selected by the client. + * - \c size_t: The length of the PSK identity + * selected by the client. + * + * If a valid PSK identity is found, the callback should use + * \c mbedtls_ssl_set_hs_psk() or + * \c mbedtls_ssl_set_hs_psk_opaque() + * on the SSL context to set the correct PSK and return \c 0. + * Any other return value will result in a denied PSK identity. + * + * \note A dynamic PSK (i.e. set by the PSK callback) takes + * precedence over a static PSK (i.e. set by + * \c mbedtls_ssl_conf_psk() or + * \c mbedtls_ssl_conf_psk_opaque()). + * This means that if you set a PSK callback using this + * function, you don't need to set a PSK using + * \c mbedtls_ssl_conf_psk() or + * \c mbedtls_ssl_conf_psk_opaque()). + * + * \param conf The SSL configuration to register the callback with. + * \param f_psk The callback for selecting and setting the PSK based + * in the PSK identity chosen by the client. + * \param p_psk A pointer to an opaque structure to be passed to + * the callback, for example a PSK store. + */ +void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf, + int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *, + size_t), + void *p_psk ); +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ + +#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C) + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) + +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif + +/** + * \brief Set the Diffie-Hellman public P and G values, + * read as hexadecimal strings (server-side only) + * (Default values: MBEDTLS_DHM_RFC3526_MODP_2048_[PG]) + * + * \param conf SSL configuration + * \param dhm_P Diffie-Hellman-Merkle modulus + * \param dhm_G Diffie-Hellman-Merkle generator + * + * \deprecated Superseded by \c mbedtls_ssl_conf_dh_param_bin. + * + * \return 0 if successful + */ +MBEDTLS_DEPRECATED int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, + const char *dhm_P, + const char *dhm_G ); + +#endif /* MBEDTLS_DEPRECATED_REMOVED */ + +/** + * \brief Set the Diffie-Hellman public P and G values + * from big-endian binary presentations. + * (Default values: MBEDTLS_DHM_RFC3526_MODP_2048_[PG]_BIN) + * + * \param conf SSL configuration + * \param dhm_P Diffie-Hellman-Merkle modulus in big-endian binary form + * \param P_len Length of DHM modulus + * \param dhm_G Diffie-Hellman-Merkle generator in big-endian binary form + * \param G_len Length of DHM generator + * + * \return 0 if successful + */ +int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf, + const unsigned char *dhm_P, size_t P_len, + const unsigned char *dhm_G, size_t G_len ); + +/** + * \brief Set the Diffie-Hellman public P and G values, + * read from existing context (server-side only) + * + * \param conf SSL configuration + * \param dhm_ctx Diffie-Hellman-Merkle context + * + * \return 0 if successful + */ +int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx ); +#endif /* MBEDTLS_DHM_C && defined(MBEDTLS_SSL_SRV_C) */ + +#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C) +/** + * \brief Set the minimum length for Diffie-Hellman parameters. + * (Client-side only.) + * (Default: 1024 bits.) + * + * \param conf SSL configuration + * \param bitlen Minimum bit length of the DHM prime + */ +void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf, + unsigned int bitlen ); +#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */ + +#if defined(MBEDTLS_ECP_C) +/** + * \brief Set the allowed curves in order of preference. + * (Default: all defined curves in order of decreasing size, + * except that Montgomery curves come last. This order + * is likely to change in a future version.) + * + * On server: this only affects selection of the ECDHE curve; + * the curves used for ECDH and ECDSA are determined by the + * list of available certificates instead. + * + * On client: this affects the list of curves offered for any + * use. The server can override our preference order. + * + * Both sides: limits the set of curves accepted for use in + * ECDHE and in the peer's end-entity certificate. + * + * \note This has no influence on which curves are allowed inside the + * certificate chains, see \c mbedtls_ssl_conf_cert_profile() + * for that. For the end-entity certificate however, the key + * will be accepted only if it is allowed both by this list + * and by the cert profile. + * + * \note This list should be ordered by decreasing preference + * (preferred curve first). + * + * \param conf SSL configuration + * \param curves Ordered list of allowed curves, + * terminated by MBEDTLS_ECP_DP_NONE. + */ +void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf, + const mbedtls_ecp_group_id *curves ); +#endif /* MBEDTLS_ECP_C */ + +#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) +/** + * \brief Set the allowed hashes for signatures during the handshake. + * (Default: all SHA-2 hashes, largest first. Also SHA-1 if + * the compile-time option + * `MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE` is enabled.) + * + * \note This only affects which hashes are offered and can be used + * for signatures during the handshake. Hashes for message + * authentication and the TLS PRF are controlled by the + * ciphersuite, see \c mbedtls_ssl_conf_ciphersuites(). Hashes + * used for certificate signature are controlled by the + * verification profile, see \c mbedtls_ssl_conf_cert_profile(). + * + * \note This list should be ordered by decreasing preference + * (preferred hash first). + * + * \param conf SSL configuration + * \param hashes Ordered list of allowed signature hashes, + * terminated by \c MBEDTLS_MD_NONE. + */ +void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf, + const int *hashes ); +#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Set or reset the hostname to check against the received + * server certificate. It sets the ServerName TLS extension, + * too, if that extension is enabled. (client-side only) + * + * \param ssl SSL context + * \param hostname the server hostname, may be NULL to clear hostname + + * \note Maximum hostname length MBEDTLS_SSL_MAX_HOST_NAME_LEN. + * + * \return 0 if successful, MBEDTLS_ERR_SSL_ALLOC_FAILED on + * allocation failure, MBEDTLS_ERR_SSL_BAD_INPUT_DATA on + * too long input hostname. + * + * Hostname set to the one provided on success (cleared + * when NULL). On allocation failure hostname is cleared. + * On too long input failure, old hostname is unchanged. + */ +int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname ); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) +/** + * \brief Set own certificate and key for the current handshake + * + * \note Same as \c mbedtls_ssl_conf_own_cert() but for use within + * the SNI callback. + * + * \param ssl SSL context + * \param own_cert own public certificate chain + * \param pk_key own private key + * + * \return 0 on success or MBEDTLS_ERR_SSL_ALLOC_FAILED + */ +int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl, + mbedtls_x509_crt *own_cert, + mbedtls_pk_context *pk_key ); + +/** + * \brief Set the data required to verify peer certificate for the + * current handshake + * + * \note Same as \c mbedtls_ssl_conf_ca_chain() but for use within + * the SNI callback. + * + * \param ssl SSL context + * \param ca_chain trusted CA chain (meaning all fully trusted top-level CAs) + * \param ca_crl trusted CA CRLs + */ +void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl, + mbedtls_x509_crt *ca_chain, + mbedtls_x509_crl *ca_crl ); + +/** + * \brief Set authmode for the current handshake. + * + * \note Same as \c mbedtls_ssl_conf_authmode() but for use within + * the SNI callback. + * + * \param ssl SSL context + * \param authmode MBEDTLS_SSL_VERIFY_NONE, MBEDTLS_SSL_VERIFY_OPTIONAL or + * MBEDTLS_SSL_VERIFY_REQUIRED + */ +void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl, + int authmode ); + +/** + * \brief Set server side ServerName TLS extension callback + * (optional, server-side only). + * + * If set, the ServerName callback is called whenever the + * server receives a ServerName TLS extension from the client + * during a handshake. The ServerName callback has the + * following parameters: (void *parameter, mbedtls_ssl_context *ssl, + * const unsigned char *hostname, size_t len). If a suitable + * certificate is found, the callback must set the + * certificate(s) and key(s) to use with \c + * mbedtls_ssl_set_hs_own_cert() (can be called repeatedly), + * and may optionally adjust the CA and associated CRL with \c + * mbedtls_ssl_set_hs_ca_chain() as well as the client + * authentication mode with \c mbedtls_ssl_set_hs_authmode(), + * then must return 0. If no matching name is found, the + * callback must either set a default cert, or + * return non-zero to abort the handshake at this point. + * + * \param conf SSL configuration + * \param f_sni verification function + * \param p_sni verification parameter + */ +void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf, + int (*f_sni)(void *, mbedtls_ssl_context *, const unsigned char *, + size_t), + void *p_sni ); +#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ + +#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) +/** + * \brief Set the EC J-PAKE password for current handshake. + * + * \note An internal copy is made, and destroyed as soon as the + * handshake is completed, or when the SSL context is reset or + * freed. + * + * \note The SSL context needs to be already set up. The right place + * to call this function is between \c mbedtls_ssl_setup() or + * \c mbedtls_ssl_reset() and \c mbedtls_ssl_handshake(). + * + * \param ssl SSL context + * \param pw EC J-PAKE password (pre-shared secret) + * \param pw_len length of pw in bytes + * + * \return 0 on success, or a negative error code. + */ +int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl, + const unsigned char *pw, + size_t pw_len ); +#endif /*MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ + +#if defined(MBEDTLS_SSL_ALPN) +/** + * \brief Set the supported Application Layer Protocols. + * + * \param conf SSL configuration + * \param protos Pointer to a NULL-terminated list of supported protocols, + * in decreasing preference order. The pointer to the list is + * recorded by the library for later reference as required, so + * the lifetime of the table must be at least as long as the + * lifetime of the SSL configuration structure. + * + * \return 0 on success, or MBEDTLS_ERR_SSL_BAD_INPUT_DATA. + */ +int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos ); + +/** + * \brief Get the name of the negotiated Application Layer Protocol. + * This function should be called after the handshake is + * completed. + * + * \param ssl SSL context + * + * \return Protocol name, or NULL if no protocol was negotiated. + */ +const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl ); +#endif /* MBEDTLS_SSL_ALPN */ + +#if defined(MBEDTLS_SSL_DTLS_SRTP) +#if defined(MBEDTLS_DEBUG_C) +static inline const char *mbedtls_ssl_get_srtp_profile_as_string( mbedtls_ssl_srtp_profile profile ) +{ + switch( profile ) + { + case MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80: + return( "MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80" ); + case MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32: + return( "MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" ); + case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80: + return( "MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80" ); + case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32: + return( "MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32" ); + default: break; + } + return( "" ); +} +#endif /* MBEDTLS_DEBUG_C */ +/** + * \brief Manage support for mki(master key id) value + * in use_srtp extension. + * MKI is an optional part of SRTP used for key management + * and re-keying. See RFC3711 section 3.1 for details. + * The default value is + * #MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED. + * + * \param conf The SSL configuration to manage mki support. + * \param support_mki_value Enable or disable mki usage. Values are + * #MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED + * or #MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED. + */ +void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf, + int support_mki_value ); + +/** + * \brief Set the supported DTLS-SRTP protection profiles. + * + * \param conf SSL configuration + * \param profiles Pointer to a List of MBEDTLS_TLS_SRTP_UNSET terminated + * supported protection profiles + * in decreasing preference order. + * The pointer to the list is recorded by the library + * for later reference as required, so the lifetime + * of the table must be at least as long as the lifetime + * of the SSL configuration structure. + * The list must not hold more than + * MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH elements + * (excluding the terminating MBEDTLS_TLS_SRTP_UNSET). + * + * \return 0 on success + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA when the list of + * protection profiles is incorrect. + */ +int mbedtls_ssl_conf_dtls_srtp_protection_profiles + ( mbedtls_ssl_config *conf, + const mbedtls_ssl_srtp_profile *profiles ); + +/** + * \brief Set the mki_value for the current DTLS-SRTP session. + * + * \param ssl SSL context to use. + * \param mki_value The MKI value to set. + * \param mki_len The length of the MKI value. + * + * \note This function is relevant on client side only. + * The server discovers the mki value during handshake. + * A mki value set on server side using this function + * is ignored. + * + * \return 0 on success + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA + * \return #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE + */ +int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl, + unsigned char *mki_value, + uint16_t mki_len ); +/** + * \brief Get the negotiated DTLS-SRTP information: + * Protection profile and MKI value. + * + * \warning This function must be called after the handshake is + * completed. The value returned by this function must + * not be trusted or acted upon before the handshake completes. + * + * \param ssl The SSL context to query. + * \param dtls_srtp_info The negotiated DTLS-SRTP information: + * - Protection profile in use. + * A direct mapping of the iana defined value for protection + * profile on an uint16_t. + http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml + * #MBEDTLS_TLS_SRTP_UNSET if the use of SRTP was not negotiated + * or peer's Hello packet was not parsed yet. + * - mki size and value( if size is > 0 ). + */ +void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ssl, + mbedtls_dtls_srtp_info *dtls_srtp_info ); +#endif /* MBEDTLS_SSL_DTLS_SRTP */ + +/** + * \brief Set the maximum supported version sent from the client side + * and/or accepted at the server side + * (Default: MBEDTLS_SSL_MAX_MAJOR_VERSION, MBEDTLS_SSL_MAX_MINOR_VERSION) + * + * \note This ignores ciphersuites from higher versions. + * + * \note With DTLS, use MBEDTLS_SSL_MINOR_VERSION_2 for DTLS 1.0 and + * MBEDTLS_SSL_MINOR_VERSION_3 for DTLS 1.2 + * + * \param conf SSL configuration + * \param major Major version number (only MBEDTLS_SSL_MAJOR_VERSION_3 supported) + * \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_0, + * MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2, + * MBEDTLS_SSL_MINOR_VERSION_3 supported) + */ +void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor ); + +/** + * \brief Set the minimum accepted SSL/TLS protocol version + * (Default: TLS 1.0) + * + * \note Input outside of the SSL_MAX_XXXXX_VERSION and + * SSL_MIN_XXXXX_VERSION range is ignored. + * + * \note MBEDTLS_SSL_MINOR_VERSION_0 (SSL v3) should be avoided. + * + * \note With DTLS, use MBEDTLS_SSL_MINOR_VERSION_2 for DTLS 1.0 and + * MBEDTLS_SSL_MINOR_VERSION_3 for DTLS 1.2 + * + * \param conf SSL configuration + * \param major Major version number (only MBEDTLS_SSL_MAJOR_VERSION_3 supported) + * \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_0, + * MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2, + * MBEDTLS_SSL_MINOR_VERSION_3 supported) + */ +void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor ); + +#if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C) +/** + * \brief Set the fallback flag (client-side only). + * (Default: MBEDTLS_SSL_IS_NOT_FALLBACK). + * + * \note Set to MBEDTLS_SSL_IS_FALLBACK when preparing a fallback + * connection, that is a connection with max_version set to a + * lower value than the value you're willing to use. Such + * fallback connections are not recommended but are sometimes + * necessary to interoperate with buggy (version-intolerant) + * servers. + * + * \warning You should NOT set this to MBEDTLS_SSL_IS_FALLBACK for + * non-fallback connections! This would appear to work for a + * while, then cause failures when the server is upgraded to + * support a newer TLS version. + * + * \param conf SSL configuration + * \param fallback MBEDTLS_SSL_IS_NOT_FALLBACK or MBEDTLS_SSL_IS_FALLBACK + */ +void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback ); +#endif /* MBEDTLS_SSL_FALLBACK_SCSV && MBEDTLS_SSL_CLI_C */ + +#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) +/** + * \brief Enable or disable Encrypt-then-MAC + * (Default: MBEDTLS_SSL_ETM_ENABLED) + * + * \note This should always be enabled, it is a security + * improvement, and should not cause any interoperability + * issue (used only if the peer supports it too). + * + * \param conf SSL configuration + * \param etm MBEDTLS_SSL_ETM_ENABLED or MBEDTLS_SSL_ETM_DISABLED + */ +void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm ); +#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ + +#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) +/** + * \brief Enable or disable Extended Master Secret negotiation. + * (Default: MBEDTLS_SSL_EXTENDED_MS_ENABLED) + * + * \note This should always be enabled, it is a security fix to the + * protocol, and should not cause any interoperability issue + * (used only if the peer supports it too). + * + * \param conf SSL configuration + * \param ems MBEDTLS_SSL_EXTENDED_MS_ENABLED or MBEDTLS_SSL_EXTENDED_MS_DISABLED + */ +void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems ); +#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ + +#if defined(MBEDTLS_ARC4_C) +/** + * \brief Disable or enable support for RC4 + * (Default: MBEDTLS_SSL_ARC4_DISABLED) + * + * \warning Use of RC4 in DTLS/TLS has been prohibited by RFC 7465 + * for security reasons. Use at your own risk. + * + * \note This function is deprecated and will be removed in + * a future version of the library. + * RC4 is disabled by default at compile time and needs to be + * actively enabled for use with legacy systems. + * + * \param conf SSL configuration + * \param arc4 MBEDTLS_SSL_ARC4_ENABLED or MBEDTLS_SSL_ARC4_DISABLED + */ +void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 ); +#endif /* MBEDTLS_ARC4_C */ + +#if defined(MBEDTLS_SSL_SRV_C) +/** + * \brief Whether to send a list of acceptable CAs in + * CertificateRequest messages. + * (Default: do send) + * + * \param conf SSL configuration + * \param cert_req_ca_list MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED or + * MBEDTLS_SSL_CERT_REQ_CA_LIST_DISABLED + */ +void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf, + char cert_req_ca_list ); +#endif /* MBEDTLS_SSL_SRV_C */ + +#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) +/** + * \brief Set the maximum fragment length to emit and/or negotiate. + * (Typical: the smaller of #MBEDTLS_SSL_IN_CONTENT_LEN and + * #MBEDTLS_SSL_OUT_CONTENT_LEN, usually `2^14` bytes) + * (Server: set maximum fragment length to emit, + * usually negotiated by the client during handshake) + * (Client: set maximum fragment length to emit *and* + * negotiate with the server during handshake) + * (Default: #MBEDTLS_SSL_MAX_FRAG_LEN_NONE) + * + * \note On the client side, the maximum fragment length extension + * *will not* be used, unless the maximum fragment length has + * been set via this function to a value different than + * #MBEDTLS_SSL_MAX_FRAG_LEN_NONE. + * + * \note With TLS, this currently only affects ApplicationData (sent + * with \c mbedtls_ssl_read()), not handshake messages. + * With DTLS, this affects both ApplicationData and handshake. + * + * \note This sets the maximum length for a record's payload, + * excluding record overhead that will be added to it, see + * \c mbedtls_ssl_get_record_expansion(). + * + * \note For DTLS, it is also possible to set a limit for the total + * size of datagrams passed to the transport layer, including + * record overhead, see \c mbedtls_ssl_set_mtu(). + * + * \param conf SSL configuration + * \param mfl_code Code for maximum fragment length (allowed values: + * MBEDTLS_SSL_MAX_FRAG_LEN_512, MBEDTLS_SSL_MAX_FRAG_LEN_1024, + * MBEDTLS_SSL_MAX_FRAG_LEN_2048, MBEDTLS_SSL_MAX_FRAG_LEN_4096) + * + * \return 0 if successful or MBEDTLS_ERR_SSL_BAD_INPUT_DATA + */ +int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code ); +#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ + +#if defined(MBEDTLS_SSL_TRUNCATED_HMAC) +/** + * \brief Activate negotiation of truncated HMAC + * (Default: MBEDTLS_SSL_TRUNC_HMAC_DISABLED) + * + * \param conf SSL configuration + * \param truncate Enable or disable (MBEDTLS_SSL_TRUNC_HMAC_ENABLED or + * MBEDTLS_SSL_TRUNC_HMAC_DISABLED) + */ +void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate ); +#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ + +#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) +/** + * \brief Enable / Disable 1/n-1 record splitting + * (Default: MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED) + * + * \note Only affects SSLv3 and TLS 1.0, not higher versions. + * Does not affect non-CBC ciphersuites in any version. + * + * \param conf SSL configuration + * \param split MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED or + * MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED + */ +void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split ); +#endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */ + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) +/** + * \brief Enable / Disable session tickets (client only). + * (Default: MBEDTLS_SSL_SESSION_TICKETS_ENABLED.) + * + * \note On server, use \c mbedtls_ssl_conf_session_tickets_cb(). + * + * \param conf SSL configuration + * \param use_tickets Enable or disable (MBEDTLS_SSL_SESSION_TICKETS_ENABLED or + * MBEDTLS_SSL_SESSION_TICKETS_DISABLED) + */ +void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets ); +#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */ + +#if defined(MBEDTLS_SSL_RENEGOTIATION) +/** + * \brief Enable / Disable renegotiation support for connection when + * initiated by peer + * (Default: MBEDTLS_SSL_RENEGOTIATION_DISABLED) + * + * \warning It is recommended to always disable renegotiation unless you + * know you need it and you know what you're doing. In the + * past, there have been several issues associated with + * renegotiation or a poor understanding of its properties. + * + * \note Server-side, enabling renegotiation also makes the server + * susceptible to a resource DoS by a malicious client. + * + * \param conf SSL configuration + * \param renegotiation Enable or disable (MBEDTLS_SSL_RENEGOTIATION_ENABLED or + * MBEDTLS_SSL_RENEGOTIATION_DISABLED) + */ +void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation ); +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + +/** + * \brief Prevent or allow legacy renegotiation. + * (Default: MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION) + * + * MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION allows connections to + * be established even if the peer does not support + * secure renegotiation, but does not allow renegotiation + * to take place if not secure. + * (Interoperable and secure option) + * + * MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION allows renegotiations + * with non-upgraded peers. Allowing legacy renegotiation + * makes the connection vulnerable to specific man in the + * middle attacks. (See RFC 5746) + * (Most interoperable and least secure option) + * + * MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE breaks off connections + * if peer does not support secure renegotiation. Results + * in interoperability issues with non-upgraded peers + * that do not support renegotiation altogether. + * (Most secure option, interoperability issues) + * + * \param conf SSL configuration + * \param allow_legacy Prevent or allow (SSL_NO_LEGACY_RENEGOTIATION, + * SSL_ALLOW_LEGACY_RENEGOTIATION or + * MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE) + */ +void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy ); + +#if defined(MBEDTLS_SSL_RENEGOTIATION) +/** + * \brief Enforce renegotiation requests. + * (Default: enforced, max_records = 16) + * + * When we request a renegotiation, the peer can comply or + * ignore the request. This function allows us to decide + * whether to enforce our renegotiation requests by closing + * the connection if the peer doesn't comply. + * + * However, records could already be in transit from the peer + * when the request is emitted. In order to increase + * reliability, we can accept a number of records before the + * expected handshake records. + * + * The optimal value is highly dependent on the specific usage + * scenario. + * + * \note With DTLS and server-initiated renegotiation, the + * HelloRequest is retransmitted every time mbedtls_ssl_read() times + * out or receives Application Data, until: + * - max_records records have beens seen, if it is >= 0, or + * - the number of retransmits that would happen during an + * actual handshake has been reached. + * Please remember the request might be lost a few times + * if you consider setting max_records to a really low value. + * + * \warning On client, the grace period can only happen during + * mbedtls_ssl_read(), as opposed to mbedtls_ssl_write() and mbedtls_ssl_renegotiate() + * which always behave as if max_record was 0. The reason is, + * if we receive application data from the server, we need a + * place to write it, which only happens during mbedtls_ssl_read(). + * + * \param conf SSL configuration + * \param max_records Use MBEDTLS_SSL_RENEGOTIATION_NOT_ENFORCED if you don't want to + * enforce renegotiation, or a non-negative value to enforce + * it but allow for a grace period of max_records records. + */ +void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records ); + +/** + * \brief Set record counter threshold for periodic renegotiation. + * (Default: 2^48 - 1) + * + * Renegotiation is automatically triggered when a record + * counter (outgoing or incoming) crosses the defined + * threshold. The default value is meant to prevent the + * connection from being closed when the counter is about to + * reached its maximal value (it is not allowed to wrap). + * + * Lower values can be used to enforce policies such as "keys + * must be refreshed every N packets with cipher X". + * + * The renegotiation period can be disabled by setting + * conf->disable_renegotiation to + * MBEDTLS_SSL_RENEGOTIATION_DISABLED. + * + * \note When the configured transport is + * MBEDTLS_SSL_TRANSPORT_DATAGRAM the maximum renegotiation + * period is 2^48 - 1, and for MBEDTLS_SSL_TRANSPORT_STREAM, + * the maximum renegotiation period is 2^64 - 1. + * + * \param conf SSL configuration + * \param period The threshold value: a big-endian 64-bit number. + */ +void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf, + const unsigned char period[8] ); +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + +/** + * \brief Check if there is data already read from the + * underlying transport but not yet processed. + * + * \param ssl SSL context + * + * \return 0 if nothing's pending, 1 otherwise. + * + * \note This is different in purpose and behaviour from + * \c mbedtls_ssl_get_bytes_avail in that it considers + * any kind of unprocessed data, not only unread + * application data. If \c mbedtls_ssl_get_bytes + * returns a non-zero value, this function will + * also signal pending data, but the converse does + * not hold. For example, in DTLS there might be + * further records waiting to be processed from + * the current underlying transport's datagram. + * + * \note If this function returns 1 (data pending), this + * does not imply that a subsequent call to + * \c mbedtls_ssl_read will provide any data; + * e.g., the unprocessed data might turn out + * to be an alert or a handshake message. + * + * \note This function is useful in the following situation: + * If the SSL/TLS module successfully returns from an + * operation - e.g. a handshake or an application record + * read - and you're awaiting incoming data next, you + * must not immediately idle on the underlying transport + * to have data ready, but you need to check the value + * of this function first. The reason is that the desired + * data might already be read but not yet processed. + * If, in contrast, a previous call to the SSL/TLS module + * returned MBEDTLS_ERR_SSL_WANT_READ, it is not necessary + * to call this function, as the latter error code entails + * that all internal data has been processed. + * + */ +int mbedtls_ssl_check_pending( const mbedtls_ssl_context *ssl ); + +/** + * \brief Return the number of application data bytes + * remaining to be read from the current record. + * + * \param ssl SSL context + * + * \return How many bytes are available in the application + * data record read buffer. + * + * \note When working over a datagram transport, this is + * useful to detect the current datagram's boundary + * in case \c mbedtls_ssl_read has written the maximal + * amount of data fitting into the input buffer. + * + */ +size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl ); + +/** + * \brief Return the result of the certificate verification + * + * \param ssl The SSL context to use. + * + * \return \c 0 if the certificate verification was successful. + * \return \c -1u if the result is not available. This may happen + * e.g. if the handshake aborts early, or a verification + * callback returned a fatal error. + * \return A bitwise combination of \c MBEDTLS_X509_BADCERT_XXX + * and \c MBEDTLS_X509_BADCRL_XXX failure flags; see x509.h. + */ +uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl ); + +/** + * \brief Return the name of the current ciphersuite + * + * \param ssl SSL context + * + * \return a string containing the ciphersuite name + */ +const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl ); + +/** + * \brief Return the current SSL version (SSLv3/TLSv1/etc) + * + * \param ssl SSL context + * + * \return a string containing the SSL version + */ +const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl ); + +/** + * \brief Return the (maximum) number of bytes added by the record + * layer: header + encryption/MAC overhead (inc. padding) + * + * \note This function is not available (always returns an error) + * when record compression is enabled. + * + * \param ssl SSL context + * + * \return Current maximum record expansion in bytes, or + * MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if compression is + * enabled, which makes expansion much less predictable + */ +int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl ); + +#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) +/** + * \brief Return the maximum fragment length (payload, in bytes) for + * the output buffer. For the client, this is the configured + * value. For the server, it is the minimum of two - the + * configured value and the negotiated one. + * + * \sa mbedtls_ssl_conf_max_frag_len() + * \sa mbedtls_ssl_get_max_record_payload() + * + * \param ssl SSL context + * + * \return Current maximum fragment length for the output buffer. + */ +size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl ); + +/** + * \brief Return the maximum fragment length (payload, in bytes) for + * the input buffer. This is the negotiated maximum fragment + * length, or, if there is none, MBEDTLS_SSL_MAX_CONTENT_LEN. + * If it is not defined either, the value is 2^14. This function + * works as its predecessor, \c mbedtls_ssl_get_max_frag_len(). + * + * \sa mbedtls_ssl_conf_max_frag_len() + * \sa mbedtls_ssl_get_max_record_payload() + * + * \param ssl SSL context + * + * \return Current maximum fragment length for the output buffer. + */ +size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl ); + +#if !defined(MBEDTLS_DEPRECATED_REMOVED) + +#if defined(MBEDTLS_DEPRECATED_WARNING) +#define MBEDTLS_DEPRECATED __attribute__((deprecated)) +#else +#define MBEDTLS_DEPRECATED +#endif + +/** + * \brief This function is a deprecated approach to getting the max + * fragment length. Its an alias for + * \c mbedtls_ssl_get_output_max_frag_len(), as the behaviour + * is the same. See \c mbedtls_ssl_get_output_max_frag_len() for + * more detail. + * + * \sa mbedtls_ssl_get_input_max_frag_len() + * \sa mbedtls_ssl_get_output_max_frag_len() + * + * \param ssl SSL context + * + * \return Current maximum fragment length for the output buffer. + */ +MBEDTLS_DEPRECATED size_t mbedtls_ssl_get_max_frag_len( + const mbedtls_ssl_context *ssl ); +#endif /* MBEDTLS_DEPRECATED_REMOVED */ +#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ + +/** + * \brief Return the current maximum outgoing record payload in bytes. + * This takes into account the config.h setting \c + * MBEDTLS_SSL_OUT_CONTENT_LEN, the configured and negotiated + * max fragment length extension if used, and for DTLS the + * path MTU as configured and current record expansion. + * + * \note With DTLS, \c mbedtls_ssl_write() will return an error if + * called with a larger length value. + * With TLS, \c mbedtls_ssl_write() will fragment the input if + * necessary and return the number of bytes written; it is up + * to the caller to call \c mbedtls_ssl_write() again in + * order to send the remaining bytes if any. + * + * \note This function is not available (always returns an error) + * when record compression is enabled. + * + * \sa mbedtls_ssl_set_mtu() + * \sa mbedtls_ssl_get_output_max_frag_len() + * \sa mbedtls_ssl_get_input_max_frag_len() + * \sa mbedtls_ssl_get_record_expansion() + * + * \param ssl SSL context + * + * \return Current maximum payload for an outgoing record, + * or a negative error code. + */ +int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl ); + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * \brief Return the peer certificate from the current connection. + * + * \param ssl The SSL context to use. This must be initialized and setup. + * + * \return The current peer certificate, if available. + * The returned certificate is owned by the SSL context and + * is valid only until the next call to the SSL API. + * \return \c NULL if no peer certificate is available. This might + * be because the chosen ciphersuite doesn't use CRTs + * (PSK-based ciphersuites, for example), or because + * #MBEDTLS_SSL_KEEP_PEER_CERTIFICATE has been disabled, + * allowing the stack to free the peer's CRT to save memory. + * + * \note For one-time inspection of the peer's certificate during + * the handshake, consider registering an X.509 CRT verification + * callback through mbedtls_ssl_conf_verify() instead of calling + * this function. Using mbedtls_ssl_conf_verify() also comes at + * the benefit of allowing you to influence the verification + * process, for example by masking expected and tolerated + * verification failures. + * + * \warning You must not use the pointer returned by this function + * after any further call to the SSL API, including + * mbedtls_ssl_read() and mbedtls_ssl_write(); this is + * because the pointer might change during renegotiation, + * which happens transparently to the user. + * If you want to use the certificate across API calls, + * you must make a copy. + */ +const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl ); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_CLI_C) +/** + * \brief Save session in order to resume it later (client-side only) + * Session data is copied to presented session structure. + * + * + * \param ssl SSL context + * \param session session context + * + * \return 0 if successful, + * MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed, + * MBEDTLS_ERR_SSL_BAD_INPUT_DATA if used server-side or + * arguments are otherwise invalid. + * + * \note Only the server certificate is copied, and not the full chain, + * so you should not attempt to validate the certificate again + * by calling \c mbedtls_x509_crt_verify() on it. + * Instead, you should use the results from the verification + * in the original handshake by calling \c mbedtls_ssl_get_verify_result() + * after loading the session again into a new SSL context + * using \c mbedtls_ssl_set_session(). + * + * \note Once the session object is not needed anymore, you should + * free it by calling \c mbedtls_ssl_session_free(). + * + * \sa mbedtls_ssl_set_session() + */ +int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl, mbedtls_ssl_session *session ); +#endif /* MBEDTLS_SSL_CLI_C */ + +/** + * \brief Perform the SSL handshake + * + * \param ssl SSL context + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_WANT_READ or #MBEDTLS_ERR_SSL_WANT_WRITE + * if the handshake is incomplete and waiting for data to + * be available for reading from or writing to the underlying + * transport - in this case you must call this function again + * when the underlying transport is ready for the operation. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if an asynchronous + * operation is in progress (see + * mbedtls_ssl_conf_async_private_cb()) - in this case you + * must call this function again when the operation is ready. + * \return #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS if a cryptographic + * operation is in progress (see mbedtls_ecp_set_max_ops()) - + * in this case you must call this function again to complete + * the handshake when you're done attending other tasks. + * \return #MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED if DTLS is in use + * and the client did not demonstrate reachability yet - in + * this case you must stop using the context (see below). + * \return Another SSL error code - in this case you must stop using + * the context (see below). + * + * \warning If this function returns something other than + * \c 0, + * #MBEDTLS_ERR_SSL_WANT_READ, + * #MBEDTLS_ERR_SSL_WANT_WRITE, + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + * you must stop using the SSL context for reading or writing, + * and either free it or call \c mbedtls_ssl_session_reset() + * on it before re-using it for a new connection; the current + * connection must be closed. + * + * \note If DTLS is in use, then you may choose to handle + * #MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED specially for logging + * purposes, as it is an expected return value rather than an + * actual error, but you still need to reset/free the context. + * + * \note Remarks regarding event-driven DTLS: + * If the function returns #MBEDTLS_ERR_SSL_WANT_READ, no datagram + * from the underlying transport layer is currently being processed, + * and it is safe to idle until the timer or the underlying transport + * signal a new event. This is not true for a successful handshake, + * in which case the datagram of the underlying transport that is + * currently being processed might or might not contain further + * DTLS records. + */ +int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl ); + +/** + * \brief Perform a single step of the SSL handshake + * + * \note The state of the context (ssl->state) will be at + * the next state after this function returns \c 0. Do not + * call this function if state is MBEDTLS_SSL_HANDSHAKE_OVER. + * + * \param ssl SSL context + * + * \return See mbedtls_ssl_handshake(). + * + * \warning If this function returns something other than \c 0, + * #MBEDTLS_ERR_SSL_WANT_READ, #MBEDTLS_ERR_SSL_WANT_WRITE, + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, you must stop using + * the SSL context for reading or writing, and either free it + * or call \c mbedtls_ssl_session_reset() on it before + * re-using it for a new connection; the current connection + * must be closed. + */ +int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl ); + +#if defined(MBEDTLS_SSL_RENEGOTIATION) +/** + * \brief Initiate an SSL renegotiation on the running connection. + * Client: perform the renegotiation right now. + * Server: request renegotiation, which will be performed + * during the next call to mbedtls_ssl_read() if honored by + * client. + * + * \param ssl SSL context + * + * \return 0 if successful, or any mbedtls_ssl_handshake() return + * value except #MBEDTLS_ERR_SSL_CLIENT_RECONNECT that can't + * happen during a renegotiation. + * + * \warning If this function returns something other than \c 0, + * #MBEDTLS_ERR_SSL_WANT_READ, #MBEDTLS_ERR_SSL_WANT_WRITE, + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, you must stop using + * the SSL context for reading or writing, and either free it + * or call \c mbedtls_ssl_session_reset() on it before + * re-using it for a new connection; the current connection + * must be closed. + * + */ +int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl ); +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + +/** + * \brief Read at most 'len' application data bytes + * + * \param ssl SSL context + * \param buf buffer that will hold the data + * \param len maximum number of bytes to read + * + * \return The (positive) number of bytes read if successful. + * \return \c 0 if the read end of the underlying transport was closed + * without sending a CloseNotify beforehand, which might happen + * because of various reasons (internal error of an underlying + * stack, non-conformant peer not sending a CloseNotify and + * such) - in this case you must stop using the context + * (see below). + * \return #MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY if the underlying + * transport is still functional, but the peer has + * acknowledged to not send anything anymore. + * \return #MBEDTLS_ERR_SSL_WANT_READ or #MBEDTLS_ERR_SSL_WANT_WRITE + * if the handshake is incomplete and waiting for data to + * be available for reading from or writing to the underlying + * transport - in this case you must call this function again + * when the underlying transport is ready for the operation. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if an asynchronous + * operation is in progress (see + * mbedtls_ssl_conf_async_private_cb()) - in this case you + * must call this function again when the operation is ready. + * \return #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS if a cryptographic + * operation is in progress (see mbedtls_ecp_set_max_ops()) - + * in this case you must call this function again to complete + * the handshake when you're done attending other tasks. + * \return #MBEDTLS_ERR_SSL_CLIENT_RECONNECT if we're at the server + * side of a DTLS connection and the client is initiating a + * new connection using the same source port. See below. + * \return Another SSL error code - in this case you must stop using + * the context (see below). + * + * \warning If this function returns something other than + * a positive value, + * #MBEDTLS_ERR_SSL_WANT_READ, + * #MBEDTLS_ERR_SSL_WANT_WRITE, + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + * #MBEDTLS_ERR_SSL_CLIENT_RECONNECT, + * you must stop using the SSL context for reading or writing, + * and either free it or call \c mbedtls_ssl_session_reset() + * on it before re-using it for a new connection; the current + * connection must be closed. + * + * \note When this function returns #MBEDTLS_ERR_SSL_CLIENT_RECONNECT + * (which can only happen server-side), it means that a client + * is initiating a new connection using the same source port. + * You can either treat that as a connection close and wait + * for the client to resend a ClientHello, or directly + * continue with \c mbedtls_ssl_handshake() with the same + * context (as it has been reset internally). Either way, you + * must make sure this is seen by the application as a new + * connection: application state, if any, should be reset, and + * most importantly the identity of the client must be checked + * again. WARNING: not validating the identity of the client + * again, or not transmitting the new identity to the + * application layer, would allow authentication bypass! + * + * \note Remarks regarding event-driven DTLS: + * - If the function returns #MBEDTLS_ERR_SSL_WANT_READ, no datagram + * from the underlying transport layer is currently being processed, + * and it is safe to idle until the timer or the underlying transport + * signal a new event. + * - This function may return MBEDTLS_ERR_SSL_WANT_READ even if data was + * initially available on the underlying transport, as this data may have + * been only e.g. duplicated messages or a renegotiation request. + * Therefore, you must be prepared to receive MBEDTLS_ERR_SSL_WANT_READ even + * when reacting to an incoming-data event from the underlying transport. + * - On success, the datagram of the underlying transport that is currently + * being processed may contain further DTLS records. You should call + * \c mbedtls_ssl_check_pending to check for remaining records. + * + */ +int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len ); + +/** + * \brief Try to write exactly 'len' application data bytes + * + * \warning This function will do partial writes in some cases. If the + * return value is non-negative but less than length, the + * function must be called again with updated arguments: + * buf + ret, len - ret (if ret is the return value) until + * it returns a value equal to the last 'len' argument. + * + * \param ssl SSL context + * \param buf buffer holding the data + * \param len how many bytes must be written + * + * \return The (non-negative) number of bytes actually written if + * successful (may be less than \p len). + * \return #MBEDTLS_ERR_SSL_WANT_READ or #MBEDTLS_ERR_SSL_WANT_WRITE + * if the handshake is incomplete and waiting for data to + * be available for reading from or writing to the underlying + * transport - in this case you must call this function again + * when the underlying transport is ready for the operation. + * \return #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS if an asynchronous + * operation is in progress (see + * mbedtls_ssl_conf_async_private_cb()) - in this case you + * must call this function again when the operation is ready. + * \return #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS if a cryptographic + * operation is in progress (see mbedtls_ecp_set_max_ops()) - + * in this case you must call this function again to complete + * the handshake when you're done attending other tasks. + * \return Another SSL error code - in this case you must stop using + * the context (see below). + * + * \warning If this function returns something other than + * a non-negative value, + * #MBEDTLS_ERR_SSL_WANT_READ, + * #MBEDTLS_ERR_SSL_WANT_WRITE, + * #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + * you must stop using the SSL context for reading or writing, + * and either free it or call \c mbedtls_ssl_session_reset() + * on it before re-using it for a new connection; the current + * connection must be closed. + * + * \note When this function returns #MBEDTLS_ERR_SSL_WANT_WRITE/READ, + * it must be called later with the *same* arguments, + * until it returns a value greater that or equal to 0. When + * the function returns #MBEDTLS_ERR_SSL_WANT_WRITE there may be + * some partial data in the output buffer, however this is not + * yet sent. + * + * \note If the requested length is greater than the maximum + * fragment length (either the built-in limit or the one set + * or negotiated with the peer), then: + * - with TLS, less bytes than requested are written. + * - with DTLS, MBEDTLS_ERR_SSL_BAD_INPUT_DATA is returned. + * \c mbedtls_ssl_get_output_max_frag_len() may be used to + * query the active maximum fragment length. + * + * \note Attempting to write 0 bytes will result in an empty TLS + * application record being sent. + */ +int mbedtls_ssl_write( mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len ); + +/** + * \brief Send an alert message + * + * \param ssl SSL context + * \param level The alert level of the message + * (MBEDTLS_SSL_ALERT_LEVEL_WARNING or MBEDTLS_SSL_ALERT_LEVEL_FATAL) + * \param message The alert message (SSL_ALERT_MSG_*) + * + * \return 0 if successful, or a specific SSL error code. + * + * \note If this function returns something other than 0 or + * MBEDTLS_ERR_SSL_WANT_READ/WRITE, you must stop using + * the SSL context for reading or writing, and either free it or + * call \c mbedtls_ssl_session_reset() on it before re-using it + * for a new connection; the current connection must be closed. + */ +int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl, + unsigned char level, + unsigned char message ); +/** + * \brief Notify the peer that the connection is being closed + * + * \param ssl SSL context + * + * \return 0 if successful, or a specific SSL error code. + * + * \note If this function returns something other than 0 or + * MBEDTLS_ERR_SSL_WANT_READ/WRITE, you must stop using + * the SSL context for reading or writing, and either free it or + * call \c mbedtls_ssl_session_reset() on it before re-using it + * for a new connection; the current connection must be closed. + */ +int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl ); + +/** + * \brief Free referenced items in an SSL context and clear memory + * + * \param ssl SSL context + */ +void mbedtls_ssl_free( mbedtls_ssl_context *ssl ); + +#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) +/** + * \brief Save an active connection as serialized data in a buffer. + * This allows the freeing or re-using of the SSL context + * while still picking up the connection later in a way that + * it entirely transparent to the peer. + * + * \see mbedtls_ssl_context_load() + * + * \note This feature is currently only available under certain + * conditions, see the documentation of the return value + * #MBEDTLS_ERR_SSL_BAD_INPUT_DATA for details. + * + * \note When this function succeeds, it calls + * mbedtls_ssl_session_reset() on \p ssl which as a result is + * no longer associated with the connection that has been + * serialized. This avoids creating copies of the connection + * state. You're then free to either re-use the context + * structure for a different connection, or call + * mbedtls_ssl_free() on it. See the documentation of + * mbedtls_ssl_session_reset() for more details. + * + * \param ssl The SSL context to save. On success, it is no longer + * associated with the connection that has been serialized. + * \param buf The buffer to write the serialized data to. It must be a + * writeable buffer of at least \p buf_len bytes, or may be \c + * NULL if \p buf_len is \c 0. + * \param buf_len The number of bytes available for writing in \p buf. + * \param olen The size in bytes of the data that has been or would have + * been written. It must point to a valid \c size_t. + * + * \note \p olen is updated to the correct value regardless of + * whether \p buf_len was large enough. This makes it possible + * to determine the necessary size by calling this function + * with \p buf set to \c NULL and \p buf_len to \c 0. However, + * the value of \p olen is only guaranteed to be correct when + * the function returns #MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL or + * \c 0. If the return value is different, then the value of + * \p olen is undefined. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL if \p buf is too small. + * \return #MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed + * while resetting the context. + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if a handshake is in + * progress, or there is pending data for reading or sending, + * or the connection does not use DTLS 1.2 with an AEAD + * ciphersuite, or renegotiation is enabled. + */ +int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl, + unsigned char *buf, + size_t buf_len, + size_t *olen ); + +/** + * \brief Load serialized connection data to an SSL context. + * + * \see mbedtls_ssl_context_save() + * + * \warning The same serialized data must never be loaded into more + * that one context. In order to ensure that, after + * successfully loading serialized data to an SSL context, you + * should immediately destroy or invalidate all copies of the + * serialized data that was loaded. Loading the same data in + * more than one context would cause severe security failures + * including but not limited to loss of confidentiality. + * + * \note Before calling this function, the SSL context must be + * prepared in one of the two following ways. The first way is + * to take a context freshly initialised with + * mbedtls_ssl_init() and call mbedtls_ssl_setup() on it with + * the same ::mbedtls_ssl_config structure that was used in + * the original connection. The second way is to + * call mbedtls_ssl_session_reset() on a context that was + * previously prepared as above but used in the meantime. + * Either way, you must not use the context to perform a + * handshake between calling mbedtls_ssl_setup() or + * mbedtls_ssl_session_reset() and calling this function. You + * may however call other setter functions in that time frame + * as indicated in the note below. + * + * \note Before or after calling this function successfully, you + * also need to configure some connection-specific callbacks + * and settings before you can use the connection again + * (unless they were already set before calling + * mbedtls_ssl_session_reset() and the values are suitable for + * the present connection). Specifically, you want to call + * at least mbedtls_ssl_set_bio() and + * mbedtls_ssl_set_timer_cb(). All other SSL setter functions + * are not necessary to call, either because they're only used + * in handshakes, or because the setting is already saved. You + * might choose to call them anyway, for example in order to + * share code between the cases of establishing a new + * connection and the case of loading an already-established + * connection. + * + * \note If you have new information about the path MTU, you want to + * call mbedtls_ssl_set_mtu() after calling this function, as + * otherwise this function would overwrite your + * newly-configured value with the value that was active when + * the context was saved. + * + * \note When this function returns an error code, it calls + * mbedtls_ssl_free() on \p ssl. In this case, you need to + * prepare the context with the usual sequence starting with a + * call to mbedtls_ssl_init() if you want to use it again. + * + * \param ssl The SSL context structure to be populated. It must have + * been prepared as described in the note above. + * \param buf The buffer holding the serialized connection data. It must + * be a readable buffer of at least \p len bytes. + * \param len The size of the serialized data in bytes. + * + * \return \c 0 if successful. + * \return #MBEDTLS_ERR_SSL_ALLOC_FAILED if memory allocation failed. + * \return #MBEDTLS_ERR_SSL_VERSION_MISMATCH if the serialized data + * comes from a different Mbed TLS version or build. + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if input data is invalid. + */ +int mbedtls_ssl_context_load( mbedtls_ssl_context *ssl, + const unsigned char *buf, + size_t len ); +#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */ + +/** + * \brief Initialize an SSL configuration context + * Just makes the context ready for + * mbedtls_ssl_config_defaults() or mbedtls_ssl_config_free(). + * + * \note You need to call mbedtls_ssl_config_defaults() unless you + * manually set all of the relevant fields yourself. + * + * \param conf SSL configuration context + */ +void mbedtls_ssl_config_init( mbedtls_ssl_config *conf ); + +/** + * \brief Load reasonable default SSL configuration values. + * (You need to call mbedtls_ssl_config_init() first.) + * + * \param conf SSL configuration context + * \param endpoint MBEDTLS_SSL_IS_CLIENT or MBEDTLS_SSL_IS_SERVER + * \param transport MBEDTLS_SSL_TRANSPORT_STREAM for TLS, or + * MBEDTLS_SSL_TRANSPORT_DATAGRAM for DTLS + * \param preset a MBEDTLS_SSL_PRESET_XXX value + * + * \note See \c mbedtls_ssl_conf_transport() for notes on DTLS. + * + * \return 0 if successful, or + * MBEDTLS_ERR_XXX_ALLOC_FAILED on memory allocation error. + */ +int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf, + int endpoint, int transport, int preset ); + +/** + * \brief Free an SSL configuration context + * + * \param conf SSL configuration context + */ +void mbedtls_ssl_config_free( mbedtls_ssl_config *conf ); + +/** + * \brief Initialize SSL session structure + * + * \param session SSL session + */ +void mbedtls_ssl_session_init( mbedtls_ssl_session *session ); + +/** + * \brief Free referenced items in an SSL session including the + * peer certificate and clear memory + * + * \note A session object can be freed even if the SSL context + * that was used to retrieve the session is still in use. + * + * \param session SSL session + */ +void mbedtls_ssl_session_free( mbedtls_ssl_session *session ); + +/** + * \brief TLS-PRF function for key derivation. + * + * \param prf The tls_prf type function type to be used. + * \param secret Secret for the key derivation function. + * \param slen Length of the secret. + * \param label String label for the key derivation function, + * terminated with null character. + * \param random Random bytes. + * \param rlen Length of the random bytes buffer. + * \param dstbuf The buffer holding the derived key. + * \param dlen Length of the output buffer. + * + * \return 0 on success. An SSL specific error on failure. + */ +int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf, + const unsigned char *secret, size_t slen, + const char *label, + const unsigned char *random, size_t rlen, + unsigned char *dstbuf, size_t dlen ); + +#ifdef __cplusplus +} +#endif + +#endif /* ssl.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/ssl_cache.h b/openharmony/armeabi-v7a/include/mbedtls/ssl_cache.h new file mode 100644 index 00000000..02eab96d --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/ssl_cache.h @@ -0,0 +1,149 @@ +/** + * \file ssl_cache.h + * + * \brief SSL session cache implementation + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SSL_CACHE_H +#define MBEDTLS_SSL_CACHE_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/ssl.h" + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h or define them on the compiler command line. + * \{ + */ + +#if !defined(MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT) +#define MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT 86400 /*!< 1 day */ +#endif + +#if !defined(MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES) +#define MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /*!< Maximum entries in cache */ +#endif + +/** \} name SECTION: Module settings */ + +#ifdef __cplusplus +extern "C" { +#endif + +typedef struct mbedtls_ssl_cache_context mbedtls_ssl_cache_context; +typedef struct mbedtls_ssl_cache_entry mbedtls_ssl_cache_entry; + +/** + * \brief This structure is used for storing cache entries + */ +struct mbedtls_ssl_cache_entry +{ +#if defined(MBEDTLS_HAVE_TIME) + mbedtls_time_t timestamp; /*!< entry timestamp */ +#endif + mbedtls_ssl_session session; /*!< entry session */ +#if defined(MBEDTLS_X509_CRT_PARSE_C) && \ + defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) + mbedtls_x509_buf peer_cert; /*!< entry peer_cert */ +#endif + mbedtls_ssl_cache_entry *next; /*!< chain pointer */ +}; + +/** + * \brief Cache context + */ +struct mbedtls_ssl_cache_context +{ + mbedtls_ssl_cache_entry *chain; /*!< start of the chain */ + int timeout; /*!< cache entry timeout */ + int max_entries; /*!< maximum entries */ +#if defined(MBEDTLS_THREADING_C) + mbedtls_threading_mutex_t mutex; /*!< mutex */ +#endif +}; + +/** + * \brief Initialize an SSL cache context + * + * \param cache SSL cache context + */ +void mbedtls_ssl_cache_init( mbedtls_ssl_cache_context *cache ); + +/** + * \brief Cache get callback implementation + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param data SSL cache context + * \param session session to retrieve entry for + */ +int mbedtls_ssl_cache_get( void *data, mbedtls_ssl_session *session ); + +/** + * \brief Cache set callback implementation + * (Thread-safe if MBEDTLS_THREADING_C is enabled) + * + * \param data SSL cache context + * \param session session to store entry for + */ +int mbedtls_ssl_cache_set( void *data, const mbedtls_ssl_session *session ); + +#if defined(MBEDTLS_HAVE_TIME) +/** + * \brief Set the cache timeout + * (Default: MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT (1 day)) + * + * A timeout of 0 indicates no timeout. + * + * \param cache SSL cache context + * \param timeout cache entry timeout in seconds + */ +void mbedtls_ssl_cache_set_timeout( mbedtls_ssl_cache_context *cache, int timeout ); +#endif /* MBEDTLS_HAVE_TIME */ + +/** + * \brief Set the maximum number of cache entries + * (Default: MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES (50)) + * + * \param cache SSL cache context + * \param max cache entry maximum + */ +void mbedtls_ssl_cache_set_max_entries( mbedtls_ssl_cache_context *cache, int max ); + +/** + * \brief Free referenced items in a cache context and clear memory + * + * \param cache SSL cache context + */ +void mbedtls_ssl_cache_free( mbedtls_ssl_cache_context *cache ); + +#ifdef __cplusplus +} +#endif + +#endif /* ssl_cache.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/ssl_ciphersuites.h b/openharmony/armeabi-v7a/include/mbedtls/ssl_ciphersuites.h new file mode 100644 index 00000000..93c32a5e --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/ssl_ciphersuites.h @@ -0,0 +1,556 @@ +/** + * \file ssl_ciphersuites.h + * + * \brief SSL Ciphersuites for mbed TLS + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SSL_CIPHERSUITES_H +#define MBEDTLS_SSL_CIPHERSUITES_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/pk.h" +#include "mbedtls/cipher.h" +#include "mbedtls/md.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * Supported ciphersuites (Official IANA names) + */ +#define MBEDTLS_TLS_RSA_WITH_NULL_MD5 0x01 /**< Weak! */ +#define MBEDTLS_TLS_RSA_WITH_NULL_SHA 0x02 /**< Weak! */ + +#define MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 0x04 +#define MBEDTLS_TLS_RSA_WITH_RC4_128_SHA 0x05 +#define MBEDTLS_TLS_RSA_WITH_DES_CBC_SHA 0x09 /**< Weak! Not in TLS 1.2 */ + +#define MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA 0x0A + +#define MBEDTLS_TLS_DHE_RSA_WITH_DES_CBC_SHA 0x15 /**< Weak! Not in TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA 0x16 + +#define MBEDTLS_TLS_PSK_WITH_NULL_SHA 0x2C /**< Weak! */ +#define MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA 0x2D /**< Weak! */ +#define MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA 0x2E /**< Weak! */ +#define MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA 0x2F + +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA 0x33 +#define MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA 0x35 +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA 0x39 + +#define MBEDTLS_TLS_RSA_WITH_NULL_SHA256 0x3B /**< Weak! */ +#define MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 0x3C /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 0x3D /**< TLS 1.2 */ + +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 0x41 +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 0x45 + +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 0x67 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 0x6B /**< TLS 1.2 */ + +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 0x84 +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 0x88 + +#define MBEDTLS_TLS_PSK_WITH_RC4_128_SHA 0x8A +#define MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA 0x8B +#define MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA 0x8C +#define MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA 0x8D + +#define MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA 0x8E +#define MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA 0x8F +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA 0x90 +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA 0x91 + +#define MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA 0x92 +#define MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA 0x93 +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA 0x94 +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA 0x95 + +#define MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 0x9C /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 0x9D /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 0x9E /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 0x9F /**< TLS 1.2 */ + +#define MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 0xA8 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 0xA9 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 0xAA /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 0xAB /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 0xAC /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 0xAD /**< TLS 1.2 */ + +#define MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 0xAE +#define MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 0xAF +#define MBEDTLS_TLS_PSK_WITH_NULL_SHA256 0xB0 /**< Weak! */ +#define MBEDTLS_TLS_PSK_WITH_NULL_SHA384 0xB1 /**< Weak! */ + +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 0xB2 +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 0xB3 +#define MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256 0xB4 /**< Weak! */ +#define MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384 0xB5 /**< Weak! */ + +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 0xB6 +#define MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 0xB7 +#define MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256 0xB8 /**< Weak! */ +#define MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384 0xB9 /**< Weak! */ + +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xBA /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xBE /**< TLS 1.2 */ + +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 0xC0 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 0xC4 /**< TLS 1.2 */ + +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA 0xC001 /**< Weak! */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA 0xC002 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA 0xC003 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0xC004 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA 0xC005 /**< Not in SSL3! */ + +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA 0xC006 /**< Weak! */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA 0xC007 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA 0xC008 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0xC009 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0xC00A /**< Not in SSL3! */ + +#define MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA 0xC00B /**< Weak! */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA 0xC00C /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA 0xC00D /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA 0xC00E /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA 0xC00F /**< Not in SSL3! */ + +#define MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA 0xC010 /**< Weak! */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA 0xC011 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 0xC012 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 0xC013 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 0xC014 /**< Not in SSL3! */ + +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 0xC023 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 0xC024 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 0xC025 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 0xC026 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 0xC027 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 0xC028 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 0xC029 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 0xC02A /**< TLS 1.2 */ + +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0xC02B /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0xC02C /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 0xC02D /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 0xC02E /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0xC02F /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 0xC030 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 0xC031 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 0xC032 /**< TLS 1.2 */ + +#define MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA 0xC033 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA 0xC034 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA 0xC035 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA 0xC036 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 0xC037 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 0xC038 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA 0xC039 /**< Weak! No SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 0xC03A /**< Weak! No SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 0xC03B /**< Weak! No SSL3! */ + +#define MBEDTLS_TLS_RSA_WITH_ARIA_128_CBC_SHA256 0xC03C /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_ARIA_256_CBC_SHA384 0xC03D /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256 0xC044 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384 0xC045 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256 0xC048 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384 0xC049 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256 0xC04A /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384 0xC04B /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256 0xC04C /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384 0xC04D /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256 0xC04E /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384 0xC04F /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256 0xC050 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384 0xC051 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 0xC052 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 0xC053 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 0xC05C /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 0xC05D /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256 0xC05E /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384 0xC05F /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 0xC060 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 0xC061 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256 0xC062 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384 0xC063 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_ARIA_128_CBC_SHA256 0xC064 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_ARIA_256_CBC_SHA384 0xC065 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256 0xC066 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384 0xC067 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256 0xC068 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384 0xC069 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256 0xC06A /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384 0xC06B /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256 0xC06C /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384 0xC06D /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256 0xC06E /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384 0xC06F /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256 0xC070 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384 0xC071 /**< TLS 1.2 */ + +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC072 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC073 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC074 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC075 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xC076 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 0xC077 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xC078 /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 0xC079 /**< Not in SSL3! */ + +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC07A /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC07B /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC07C /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC07D /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 0xC086 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 0xC087 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 0xC088 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 0xC089 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC08A /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC08B /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC08C /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC08D /**< TLS 1.2 */ + +#define MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 0xC08E /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 0xC08F /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 0xC090 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 0xC091 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 0xC092 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 0xC093 /**< TLS 1.2 */ + +#define MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC094 +#define MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC095 +#define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC096 +#define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC097 +#define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC098 +#define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC099 +#define MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC09A /**< Not in SSL3! */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC09B /**< Not in SSL3! */ + +#define MBEDTLS_TLS_RSA_WITH_AES_128_CCM 0xC09C /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_AES_256_CCM 0xC09D /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM 0xC09E /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM 0xC09F /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_AES_128_CCM_8 0xC0A0 /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_WITH_AES_256_CCM_8 0xC0A1 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM_8 0xC0A2 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM_8 0xC0A3 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_AES_128_CCM 0xC0A4 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_AES_256_CCM 0xC0A5 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM 0xC0A6 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM 0xC0A7 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8 0xC0A8 /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8 0xC0A9 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM_8 0xC0AA /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM_8 0xC0AB /**< TLS 1.2 */ +/* The last two are named with PSK_DHE in the RFC, which looks like a typo */ + +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM 0xC0AC /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM 0xC0AD /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 0xC0AE /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 0xC0AF /**< TLS 1.2 */ + +#define MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8 0xC0FF /**< experimental */ + +/* RFC 7905 */ +#define MBEDTLS_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA8 /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA9 /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0xCCAA /**< TLS 1.2 */ +#define MBEDTLS_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAB /**< TLS 1.2 */ +#define MBEDTLS_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAC /**< TLS 1.2 */ +#define MBEDTLS_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAD /**< TLS 1.2 */ +#define MBEDTLS_TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAE /**< TLS 1.2 */ + +/* Reminder: update mbedtls_ssl_premaster_secret when adding a new key exchange. + * Reminder: update MBEDTLS_KEY_EXCHANGE__xxx below + */ +typedef enum { + MBEDTLS_KEY_EXCHANGE_NONE = 0, + MBEDTLS_KEY_EXCHANGE_RSA, + MBEDTLS_KEY_EXCHANGE_DHE_RSA, + MBEDTLS_KEY_EXCHANGE_ECDHE_RSA, + MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA, + MBEDTLS_KEY_EXCHANGE_PSK, + MBEDTLS_KEY_EXCHANGE_DHE_PSK, + MBEDTLS_KEY_EXCHANGE_RSA_PSK, + MBEDTLS_KEY_EXCHANGE_ECDHE_PSK, + MBEDTLS_KEY_EXCHANGE_ECDH_RSA, + MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA, + MBEDTLS_KEY_EXCHANGE_ECJPAKE, +} mbedtls_key_exchange_type_t; + +/* Key exchanges using a certificate */ +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED +#endif + +/* Key exchanges allowing client certificate requests */ +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED +#endif + +/* Key exchanges involving server signature in ServerKeyExchange */ +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED +#endif + +/* Key exchanges using ECDH */ +#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED +#endif + +/* Key exchanges that don't involve ephemeral keys */ +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED +#endif + +/* Key exchanges that involve ephemeral keys */ +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED +#endif + +/* Key exchanges using a PSK */ +#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED +#endif + +/* Key exchanges using DHE */ +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED +#endif + +/* Key exchanges using ECDHE */ +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) +#define MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED +#endif + +typedef struct mbedtls_ssl_ciphersuite_t mbedtls_ssl_ciphersuite_t; + +#define MBEDTLS_CIPHERSUITE_WEAK 0x01 /**< Weak ciphersuite flag */ +#define MBEDTLS_CIPHERSUITE_SHORT_TAG 0x02 /**< Short authentication tag, + eg for CCM_8 */ +#define MBEDTLS_CIPHERSUITE_NODTLS 0x04 /**< Can't be used with DTLS */ + +/** + * \brief This structure is used for storing ciphersuite information + */ +struct mbedtls_ssl_ciphersuite_t +{ + int id; + const char * name; + + mbedtls_cipher_type_t cipher; + mbedtls_md_type_t mac; + mbedtls_key_exchange_type_t key_exchange; + + int min_major_ver; + int min_minor_ver; + int max_major_ver; + int max_minor_ver; + + unsigned char flags; +}; + +const int *mbedtls_ssl_list_ciphersuites( void ); + +const mbedtls_ssl_ciphersuite_t *mbedtls_ssl_ciphersuite_from_string( const char *ciphersuite_name ); +const mbedtls_ssl_ciphersuite_t *mbedtls_ssl_ciphersuite_from_id( int ciphersuite_id ); + +#if defined(MBEDTLS_PK_C) +mbedtls_pk_type_t mbedtls_ssl_get_ciphersuite_sig_pk_alg( const mbedtls_ssl_ciphersuite_t *info ); +mbedtls_pk_type_t mbedtls_ssl_get_ciphersuite_sig_alg( const mbedtls_ssl_ciphersuite_t *info ); +#endif + +int mbedtls_ssl_ciphersuite_uses_ec( const mbedtls_ssl_ciphersuite_t *info ); +int mbedtls_ssl_ciphersuite_uses_psk( const mbedtls_ssl_ciphersuite_t *info ); + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED) +static inline int mbedtls_ssl_ciphersuite_has_pfs( const mbedtls_ssl_ciphersuite_t *info ) +{ + switch( info->key_exchange ) + { + case MBEDTLS_KEY_EXCHANGE_DHE_RSA: + case MBEDTLS_KEY_EXCHANGE_DHE_PSK: + case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: + case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: + case MBEDTLS_KEY_EXCHANGE_ECJPAKE: + return( 1 ); + + default: + return( 0 ); + } +} +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED */ + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED) +static inline int mbedtls_ssl_ciphersuite_no_pfs( const mbedtls_ssl_ciphersuite_t *info ) +{ + switch( info->key_exchange ) + { + case MBEDTLS_KEY_EXCHANGE_ECDH_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: + case MBEDTLS_KEY_EXCHANGE_RSA: + case MBEDTLS_KEY_EXCHANGE_PSK: + case MBEDTLS_KEY_EXCHANGE_RSA_PSK: + return( 1 ); + + default: + return( 0 ); + } +} +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */ + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) +static inline int mbedtls_ssl_ciphersuite_uses_ecdh( const mbedtls_ssl_ciphersuite_t *info ) +{ + switch( info->key_exchange ) + { + case MBEDTLS_KEY_EXCHANGE_ECDH_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: + return( 1 ); + + default: + return( 0 ); + } +} +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED */ + +static inline int mbedtls_ssl_ciphersuite_cert_req_allowed( const mbedtls_ssl_ciphersuite_t *info ) +{ + switch( info->key_exchange ) + { + case MBEDTLS_KEY_EXCHANGE_RSA: + case MBEDTLS_KEY_EXCHANGE_DHE_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDH_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: + return( 1 ); + + default: + return( 0 ); + } +} + +static inline int mbedtls_ssl_ciphersuite_uses_srv_cert( const mbedtls_ssl_ciphersuite_t *info ) +{ + switch( info->key_exchange ) + { + case MBEDTLS_KEY_EXCHANGE_RSA: + case MBEDTLS_KEY_EXCHANGE_RSA_PSK: + case MBEDTLS_KEY_EXCHANGE_DHE_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDH_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: + return( 1 ); + + default: + return( 0 ); + } +} + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED) +static inline int mbedtls_ssl_ciphersuite_uses_dhe( const mbedtls_ssl_ciphersuite_t *info ) +{ + switch( info->key_exchange ) + { + case MBEDTLS_KEY_EXCHANGE_DHE_RSA: + case MBEDTLS_KEY_EXCHANGE_DHE_PSK: + return( 1 ); + + default: + return( 0 ); + } +} +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED) */ + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) +static inline int mbedtls_ssl_ciphersuite_uses_ecdhe( const mbedtls_ssl_ciphersuite_t *info ) +{ + switch( info->key_exchange ) + { + case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: + return( 1 ); + + default: + return( 0 ); + } +} +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) */ + +#if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) +static inline int mbedtls_ssl_ciphersuite_uses_server_signature( const mbedtls_ssl_ciphersuite_t *info ) +{ + switch( info->key_exchange ) + { + case MBEDTLS_KEY_EXCHANGE_DHE_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: + case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: + return( 1 ); + + default: + return( 0 ); + } +} +#endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ + +#ifdef __cplusplus +} +#endif + +#endif /* ssl_ciphersuites.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/ssl_cookie.h b/openharmony/armeabi-v7a/include/mbedtls/ssl_cookie.h new file mode 100644 index 00000000..2aa37317 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/ssl_cookie.h @@ -0,0 +1,113 @@ +/** + * \file ssl_cookie.h + * + * \brief DTLS cookie callbacks implementation + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SSL_COOKIE_H +#define MBEDTLS_SSL_COOKIE_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/ssl.h" + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +/** + * \name SECTION: Module settings + * + * The configuration options you can set for this module are in this section. + * Either change them in config.h or define them on the compiler command line. + * \{ + */ +#ifndef MBEDTLS_SSL_COOKIE_TIMEOUT +#define MBEDTLS_SSL_COOKIE_TIMEOUT 60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */ +#endif + +/** \} name SECTION: Module settings */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Context for the default cookie functions. + */ +typedef struct mbedtls_ssl_cookie_ctx +{ + mbedtls_md_context_t hmac_ctx; /*!< context for the HMAC portion */ +#if !defined(MBEDTLS_HAVE_TIME) + unsigned long serial; /*!< serial number for expiration */ +#endif + unsigned long timeout; /*!< timeout delay, in seconds if HAVE_TIME, + or in number of tickets issued */ + +#if defined(MBEDTLS_THREADING_C) + mbedtls_threading_mutex_t mutex; +#endif +} mbedtls_ssl_cookie_ctx; + +/** + * \brief Initialize cookie context + */ +void mbedtls_ssl_cookie_init( mbedtls_ssl_cookie_ctx *ctx ); + +/** + * \brief Setup cookie context (generate keys) + */ +int mbedtls_ssl_cookie_setup( mbedtls_ssl_cookie_ctx *ctx, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +/** + * \brief Set expiration delay for cookies + * (Default MBEDTLS_SSL_COOKIE_TIMEOUT) + * + * \param ctx Cookie context + * \param delay Delay, in seconds if HAVE_TIME, or in number of cookies + * issued in the meantime. + * 0 to disable expiration (NOT recommended) + */ +void mbedtls_ssl_cookie_set_timeout( mbedtls_ssl_cookie_ctx *ctx, unsigned long delay ); + +/** + * \brief Free cookie context + */ +void mbedtls_ssl_cookie_free( mbedtls_ssl_cookie_ctx *ctx ); + +/** + * \brief Generate cookie, see \c mbedtls_ssl_cookie_write_t + */ +mbedtls_ssl_cookie_write_t mbedtls_ssl_cookie_write; + +/** + * \brief Verify cookie, see \c mbedtls_ssl_cookie_write_t + */ +mbedtls_ssl_cookie_check_t mbedtls_ssl_cookie_check; + +#ifdef __cplusplus +} +#endif + +#endif /* ssl_cookie.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/ssl_internal.h b/openharmony/armeabi-v7a/include/mbedtls/ssl_internal.h new file mode 100644 index 00000000..46ade67b --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/ssl_internal.h @@ -0,0 +1,1352 @@ +/** + * \file ssl_internal.h + * + * \brief Internal functions shared by the SSL modules + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SSL_INTERNAL_H +#define MBEDTLS_SSL_INTERNAL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/ssl.h" +#include "mbedtls/cipher.h" + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#include "psa/crypto.h" +#endif + +#if defined(MBEDTLS_MD5_C) +#include "mbedtls/md5.h" +#endif + +#if defined(MBEDTLS_SHA1_C) +#include "mbedtls/sha1.h" +#endif + +#if defined(MBEDTLS_SHA256_C) +#include "mbedtls/sha256.h" +#endif + +#if defined(MBEDTLS_SHA512_C) +#include "mbedtls/sha512.h" +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) +#include "mbedtls/ecjpake.h" +#endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#include "psa/crypto.h" +#include "mbedtls/psa_util.h" +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \ + !defined(inline) && !defined(__cplusplus) +#define inline __inline +#endif + +/* Determine minimum supported version */ +#define MBEDTLS_SSL_MIN_MAJOR_VERSION MBEDTLS_SSL_MAJOR_VERSION_3 + +#if defined(MBEDTLS_SSL_PROTO_SSL3) +#define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_0 +#else +#if defined(MBEDTLS_SSL_PROTO_TLS1) +#define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_1 +#else +#if defined(MBEDTLS_SSL_PROTO_TLS1_1) +#define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_2 +#else +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) +#define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_3 +#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ +#endif /* MBEDTLS_SSL_PROTO_TLS1_1 */ +#endif /* MBEDTLS_SSL_PROTO_TLS1 */ +#endif /* MBEDTLS_SSL_PROTO_SSL3 */ + +#define MBEDTLS_SSL_MIN_VALID_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_1 +#define MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION MBEDTLS_SSL_MAJOR_VERSION_3 + +/* Determine maximum supported version */ +#define MBEDTLS_SSL_MAX_MAJOR_VERSION MBEDTLS_SSL_MAJOR_VERSION_3 + +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) +#define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_3 +#else +#if defined(MBEDTLS_SSL_PROTO_TLS1_1) +#define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_2 +#else +#if defined(MBEDTLS_SSL_PROTO_TLS1) +#define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_1 +#else +#if defined(MBEDTLS_SSL_PROTO_SSL3) +#define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_0 +#endif /* MBEDTLS_SSL_PROTO_SSL3 */ +#endif /* MBEDTLS_SSL_PROTO_TLS1 */ +#endif /* MBEDTLS_SSL_PROTO_TLS1_1 */ +#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ + +/* Shorthand for restartable ECC */ +#if defined(MBEDTLS_ECP_RESTARTABLE) && \ + defined(MBEDTLS_SSL_CLI_C) && \ + defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) +#define MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED +#endif + +#define MBEDTLS_SSL_INITIAL_HANDSHAKE 0 +#define MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS 1 /* In progress */ +#define MBEDTLS_SSL_RENEGOTIATION_DONE 2 /* Done or aborted */ +#define MBEDTLS_SSL_RENEGOTIATION_PENDING 3 /* Requested (server only) */ + +/* + * DTLS retransmission states, see RFC 6347 4.2.4 + * + * The SENDING state is merged in PREPARING for initial sends, + * but is distinct for resends. + * + * Note: initial state is wrong for server, but is not used anyway. + */ +#define MBEDTLS_SSL_RETRANS_PREPARING 0 +#define MBEDTLS_SSL_RETRANS_SENDING 1 +#define MBEDTLS_SSL_RETRANS_WAITING 2 +#define MBEDTLS_SSL_RETRANS_FINISHED 3 + +/* + * Allow extra bytes for record, authentication and encryption overhead: + * counter (8) + header (5) + IV(16) + MAC (16-48) + padding (0-256) + * and allow for a maximum of 1024 of compression expansion if + * enabled. + */ +#if defined(MBEDTLS_ZLIB_SUPPORT) +#define MBEDTLS_SSL_COMPRESSION_ADD 1024 +#else +#define MBEDTLS_SSL_COMPRESSION_ADD 0 +#endif + +/* This macro determines whether CBC is supported. */ +#if defined(MBEDTLS_CIPHER_MODE_CBC) && \ + ( defined(MBEDTLS_AES_C) || \ + defined(MBEDTLS_CAMELLIA_C) || \ + defined(MBEDTLS_ARIA_C) || \ + defined(MBEDTLS_DES_C) ) +#define MBEDTLS_SSL_SOME_SUITES_USE_CBC +#endif + +/* This macro determines whether the CBC construct used in TLS 1.0-1.2 (as + * opposed to the very different CBC construct used in SSLv3) is supported. */ +#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC) && \ + ( defined(MBEDTLS_SSL_PROTO_TLS1) || \ + defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ + defined(MBEDTLS_SSL_PROTO_TLS1_2) ) +#define MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC +#endif + +#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER) || \ + defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC) +#define MBEDTLS_SSL_SOME_MODES_USE_MAC +#endif + +#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) +/* Ciphersuites using HMAC */ +#if defined(MBEDTLS_SHA512_C) +#define MBEDTLS_SSL_MAC_ADD 48 /* SHA-384 used for HMAC */ +#elif defined(MBEDTLS_SHA256_C) +#define MBEDTLS_SSL_MAC_ADD 32 /* SHA-256 used for HMAC */ +#else +#define MBEDTLS_SSL_MAC_ADD 20 /* SHA-1 used for HMAC */ +#endif +#else /* MBEDTLS_SSL_SOME_MODES_USE_MAC */ +/* AEAD ciphersuites: GCM and CCM use a 128 bits tag */ +#define MBEDTLS_SSL_MAC_ADD 16 +#endif + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +#define MBEDTLS_SSL_PADDING_ADD 256 +#else +#define MBEDTLS_SSL_PADDING_ADD 0 +#endif + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) +#define MBEDTLS_SSL_MAX_CID_EXPANSION MBEDTLS_SSL_CID_PADDING_GRANULARITY +#else +#define MBEDTLS_SSL_MAX_CID_EXPANSION 0 +#endif + +#define MBEDTLS_SSL_PAYLOAD_OVERHEAD ( MBEDTLS_SSL_COMPRESSION_ADD + \ + MBEDTLS_MAX_IV_LENGTH + \ + MBEDTLS_SSL_MAC_ADD + \ + MBEDTLS_SSL_PADDING_ADD + \ + MBEDTLS_SSL_MAX_CID_EXPANSION \ + ) + +#define MBEDTLS_SSL_IN_PAYLOAD_LEN ( MBEDTLS_SSL_PAYLOAD_OVERHEAD + \ + ( MBEDTLS_SSL_IN_CONTENT_LEN ) ) + +#define MBEDTLS_SSL_OUT_PAYLOAD_LEN ( MBEDTLS_SSL_PAYLOAD_OVERHEAD + \ + ( MBEDTLS_SSL_OUT_CONTENT_LEN ) ) + +/* The maximum number of buffered handshake messages. */ +#define MBEDTLS_SSL_MAX_BUFFERED_HS 4 + +/* Maximum length we can advertise as our max content length for + RFC 6066 max_fragment_length extension negotiation purposes + (the lesser of both sizes, if they are unequal.) + */ +#define MBEDTLS_TLS_EXT_ADV_CONTENT_LEN ( \ + (MBEDTLS_SSL_IN_CONTENT_LEN > MBEDTLS_SSL_OUT_CONTENT_LEN) \ + ? ( MBEDTLS_SSL_OUT_CONTENT_LEN ) \ + : ( MBEDTLS_SSL_IN_CONTENT_LEN ) \ + ) + +/* Maximum size in bytes of list in sig-hash algorithm ext., RFC 5246 */ +#define MBEDTLS_SSL_MAX_SIG_HASH_ALG_LIST_LEN 65534 + +/* Maximum size in bytes of list in supported elliptic curve ext., RFC 4492 */ +#define MBEDTLS_SSL_MAX_CURVE_LIST_LEN 65535 + +/* + * Check that we obey the standard's message size bounds + */ + +#if MBEDTLS_SSL_MAX_CONTENT_LEN > 16384 +#error "Bad configuration - record content too large." +#endif + +#if MBEDTLS_SSL_IN_CONTENT_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN +#error "Bad configuration - incoming record content should not be larger than MBEDTLS_SSL_MAX_CONTENT_LEN." +#endif + +#if MBEDTLS_SSL_OUT_CONTENT_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN +#error "Bad configuration - outgoing record content should not be larger than MBEDTLS_SSL_MAX_CONTENT_LEN." +#endif + +#if MBEDTLS_SSL_IN_PAYLOAD_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN + 2048 +#error "Bad configuration - incoming protected record payload too large." +#endif + +#if MBEDTLS_SSL_OUT_PAYLOAD_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN + 2048 +#error "Bad configuration - outgoing protected record payload too large." +#endif + +/* Calculate buffer sizes */ + +/* Note: Even though the TLS record header is only 5 bytes + long, we're internally using 8 bytes to store the + implicit sequence number. */ +#define MBEDTLS_SSL_HEADER_LEN 13 + +#if !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) +#define MBEDTLS_SSL_IN_BUFFER_LEN \ + ( ( MBEDTLS_SSL_HEADER_LEN ) + ( MBEDTLS_SSL_IN_PAYLOAD_LEN ) ) +#else +#define MBEDTLS_SSL_IN_BUFFER_LEN \ + ( ( MBEDTLS_SSL_HEADER_LEN ) + ( MBEDTLS_SSL_IN_PAYLOAD_LEN ) \ + + ( MBEDTLS_SSL_CID_IN_LEN_MAX ) ) +#endif + +#if !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) +#define MBEDTLS_SSL_OUT_BUFFER_LEN \ + ( ( MBEDTLS_SSL_HEADER_LEN ) + ( MBEDTLS_SSL_OUT_PAYLOAD_LEN ) ) +#else +#define MBEDTLS_SSL_OUT_BUFFER_LEN \ + ( ( MBEDTLS_SSL_HEADER_LEN ) + ( MBEDTLS_SSL_OUT_PAYLOAD_LEN ) \ + + ( MBEDTLS_SSL_CID_OUT_LEN_MAX ) ) +#endif + +#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) +static inline size_t mbedtls_ssl_get_output_buflen( const mbedtls_ssl_context *ctx ) +{ +#if defined (MBEDTLS_SSL_DTLS_CONNECTION_ID) + return mbedtls_ssl_get_output_max_frag_len( ctx ) + + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD + + MBEDTLS_SSL_CID_OUT_LEN_MAX; +#else + return mbedtls_ssl_get_output_max_frag_len( ctx ) + + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD; +#endif +} + +static inline size_t mbedtls_ssl_get_input_buflen( const mbedtls_ssl_context *ctx ) +{ +#if defined (MBEDTLS_SSL_DTLS_CONNECTION_ID) + return mbedtls_ssl_get_input_max_frag_len( ctx ) + + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD + + MBEDTLS_SSL_CID_IN_LEN_MAX; +#else + return mbedtls_ssl_get_input_max_frag_len( ctx ) + + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD; +#endif +} +#endif + +#ifdef MBEDTLS_ZLIB_SUPPORT +/* Compression buffer holds both IN and OUT buffers, so should be size of the larger */ +#define MBEDTLS_SSL_COMPRESS_BUFFER_LEN ( \ + ( MBEDTLS_SSL_IN_BUFFER_LEN > MBEDTLS_SSL_OUT_BUFFER_LEN ) \ + ? MBEDTLS_SSL_IN_BUFFER_LEN \ + : MBEDTLS_SSL_OUT_BUFFER_LEN \ + ) +#endif + +/* + * TLS extension flags (for extensions with outgoing ServerHello content + * that need it (e.g. for RENEGOTIATION_INFO the server already knows because + * of state of the renegotiation flag, so no indicator is required) + */ +#define MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT (1 << 0) +#define MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK (1 << 1) + +/** + * \brief This function checks if the remaining size in a buffer is + * greater or equal than a needed space. + * + * \param cur Pointer to the current position in the buffer. + * \param end Pointer to one past the end of the buffer. + * \param need Needed space in bytes. + * + * \return Zero if the needed space is available in the buffer, non-zero + * otherwise. + */ +static inline int mbedtls_ssl_chk_buf_ptr( const uint8_t *cur, + const uint8_t *end, size_t need ) +{ + return( ( cur > end ) || ( need > (size_t)( end - cur ) ) ); +} + +/** + * \brief This macro checks if the remaining size in a buffer is + * greater or equal than a needed space. If it is not the case, + * it returns an SSL_BUFFER_TOO_SMALL error. + * + * \param cur Pointer to the current position in the buffer. + * \param end Pointer to one past the end of the buffer. + * \param need Needed space in bytes. + * + */ +#define MBEDTLS_SSL_CHK_BUF_PTR( cur, end, need ) \ + do { \ + if( mbedtls_ssl_chk_buf_ptr( ( cur ), ( end ), ( need ) ) != 0 ) \ + { \ + return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); \ + } \ + } while( 0 ) + +#ifdef __cplusplus +extern "C" { +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ + defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) +/* + * Abstraction for a grid of allowed signature-hash-algorithm pairs. + */ +struct mbedtls_ssl_sig_hash_set_t +{ + /* At the moment, we only need to remember a single suitable + * hash algorithm per signature algorithm. As long as that's + * the case - and we don't need a general lookup function - + * we can implement the sig-hash-set as a map from signatures + * to hash algorithms. */ + mbedtls_md_type_t rsa; + mbedtls_md_type_t ecdsa; +}; +#endif /* MBEDTLS_SSL_PROTO_TLS1_2 && + MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ + +typedef int mbedtls_ssl_tls_prf_cb( const unsigned char *secret, size_t slen, + const char *label, + const unsigned char *random, size_t rlen, + unsigned char *dstbuf, size_t dlen ); + +/* cipher.h exports the maximum IV, key and block length from + * all ciphers enabled in the config, regardless of whether those + * ciphers are actually usable in SSL/TLS. Notably, XTS is enabled + * in the default configuration and uses 64 Byte keys, but it is + * not used for record protection in SSL/TLS. + * + * In order to prevent unnecessary inflation of key structures, + * we introduce SSL-specific variants of the max-{key,block,IV} + * macros here which are meant to only take those ciphers into + * account which can be negotiated in SSL/TLS. + * + * Since the current definitions of MBEDTLS_MAX_{KEY|BLOCK|IV}_LENGTH + * in cipher.h are rough overapproximations of the real maxima, here + * we content ourselves with replicating those overapproximations + * for the maximum block and IV length, and excluding XTS from the + * computation of the maximum key length. */ +#define MBEDTLS_SSL_MAX_BLOCK_LENGTH 16 +#define MBEDTLS_SSL_MAX_IV_LENGTH 16 +#define MBEDTLS_SSL_MAX_KEY_LENGTH 32 + +/** + * \brief The data structure holding the cryptographic material (key and IV) + * used for record protection in TLS 1.3. + */ +struct mbedtls_ssl_key_set +{ + /*! The key for client->server records. */ + unsigned char client_write_key[ MBEDTLS_SSL_MAX_KEY_LENGTH ]; + /*! The key for server->client records. */ + unsigned char server_write_key[ MBEDTLS_SSL_MAX_KEY_LENGTH ]; + /*! The IV for client->server records. */ + unsigned char client_write_iv[ MBEDTLS_SSL_MAX_IV_LENGTH ]; + /*! The IV for server->client records. */ + unsigned char server_write_iv[ MBEDTLS_SSL_MAX_IV_LENGTH ]; + + size_t key_len; /*!< The length of client_write_key and + * server_write_key, in Bytes. */ + size_t iv_len; /*!< The length of client_write_iv and + * server_write_iv, in Bytes. */ +}; +typedef struct mbedtls_ssl_key_set mbedtls_ssl_key_set; + +/* + * This structure contains the parameters only needed during handshake. + */ +struct mbedtls_ssl_handshake_params +{ + /* + * Handshake specific crypto variables + */ + + uint8_t max_major_ver; /*!< max. major version client*/ + uint8_t max_minor_ver; /*!< max. minor version client*/ + uint8_t resume; /*!< session resume indicator*/ + uint8_t cli_exts; /*!< client extension presence*/ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) && \ + defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) + uint8_t sni_authmode; /*!< authmode from SNI callback */ +#endif + +#if defined(MBEDTLS_SSL_SESSION_TICKETS) + uint8_t new_session_ticket; /*!< use NewSessionTicket? */ +#endif /* MBEDTLS_SSL_SESSION_TICKETS */ + +#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) + uint8_t extended_ms; /*!< use Extended Master Secret? */ +#endif + +#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) + uint8_t async_in_progress; /*!< an asynchronous operation is in progress */ +#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + unsigned char retransmit_state; /*!< Retransmission state */ +#endif + +#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) + uint8_t ecrs_enabled; /*!< Handshake supports EC restart? */ + enum { /* this complements ssl->state with info on intra-state operations */ + ssl_ecrs_none = 0, /*!< nothing going on (yet) */ + ssl_ecrs_crt_verify, /*!< Certificate: crt_verify() */ + ssl_ecrs_ske_start_processing, /*!< ServerKeyExchange: pk_verify() */ + ssl_ecrs_cke_ecdh_calc_secret, /*!< ClientKeyExchange: ECDH step 2 */ + ssl_ecrs_crt_vrfy_sign, /*!< CertificateVerify: pk_sign() */ + } ecrs_state; /*!< current (or last) operation */ + mbedtls_x509_crt *ecrs_peer_cert; /*!< The peer's CRT chain. */ + size_t ecrs_n; /*!< place for saving a length */ +#endif + +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ + defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) + mbedtls_ssl_sig_hash_set_t hash_algs; /*!< Set of suitable sig-hash pairs */ +#endif + + size_t pmslen; /*!< premaster length */ + + mbedtls_ssl_ciphersuite_t const *ciphersuite_info; + + void (*update_checksum)(mbedtls_ssl_context *, const unsigned char *, size_t); + void (*calc_verify)(const mbedtls_ssl_context *, unsigned char *, size_t *); + void (*calc_finished)(mbedtls_ssl_context *, unsigned char *, int); + mbedtls_ssl_tls_prf_cb *tls_prf; + +#if defined(MBEDTLS_DHM_C) + mbedtls_dhm_context dhm_ctx; /*!< DHM key exchange */ +#endif + +/* Adding guard for MBEDTLS_ECDSA_C to ensure no compile errors due + * to guards also being in ssl_srv.c and ssl_cli.c. There is a gap + * in functionality that access to ecdh_ctx structure is needed for + * MBEDTLS_ECDSA_C which does not seem correct. + */ +#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) + mbedtls_ecdh_context ecdh_ctx; /*!< ECDH key exchange */ + +#if defined(MBEDTLS_USE_PSA_CRYPTO) + psa_key_type_t ecdh_psa_type; + uint16_t ecdh_bits; + psa_key_id_t ecdh_psa_privkey; + unsigned char ecdh_psa_peerkey[MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH]; + size_t ecdh_psa_peerkey_len; +#endif /* MBEDTLS_USE_PSA_CRYPTO */ +#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */ + +#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) + mbedtls_ecjpake_context ecjpake_ctx; /*!< EC J-PAKE key exchange */ +#if defined(MBEDTLS_SSL_CLI_C) + unsigned char *ecjpake_cache; /*!< Cache for ClientHello ext */ + size_t ecjpake_cache_len; /*!< Length of cached data */ +#endif +#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ + +#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) + const mbedtls_ecp_curve_info **curves; /*!< Supported elliptic curves */ +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) +#if defined(MBEDTLS_USE_PSA_CRYPTO) + psa_key_id_t psk_opaque; /*!< Opaque PSK from the callback */ +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + unsigned char *psk; /*!< PSK from the callback */ + size_t psk_len; /*!< Length of PSK from callback */ +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) + mbedtls_ssl_key_cert *key_cert; /*!< chosen key/cert pair (server) */ +#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) + mbedtls_ssl_key_cert *sni_key_cert; /*!< key/cert list from SNI */ + mbedtls_x509_crt *sni_ca_chain; /*!< trusted CAs from SNI callback */ + mbedtls_x509_crl *sni_ca_crl; /*!< trusted CAs CRLs from SNI */ +#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) + mbedtls_x509_crt_restart_ctx ecrs_ctx; /*!< restart context */ +#endif + +#if defined(MBEDTLS_X509_CRT_PARSE_C) && \ + !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) + mbedtls_pk_context peer_pubkey; /*!< The public key from the peer. */ +#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + struct + { + size_t total_bytes_buffered; /*!< Cumulative size of heap allocated + * buffers used for message buffering. */ + + uint8_t seen_ccs; /*!< Indicates if a CCS message has + * been seen in the current flight. */ + + struct mbedtls_ssl_hs_buffer + { + unsigned is_valid : 1; + unsigned is_fragmented : 1; + unsigned is_complete : 1; + unsigned char *data; + size_t data_len; + } hs[MBEDTLS_SSL_MAX_BUFFERED_HS]; + + struct + { + unsigned char *data; + size_t len; + unsigned epoch; + } future_record; + + } buffering; + + unsigned int out_msg_seq; /*!< Outgoing handshake sequence number */ + unsigned int in_msg_seq; /*!< Incoming handshake sequence number */ + + unsigned char *verify_cookie; /*!< Cli: HelloVerifyRequest cookie + Srv: unused */ + unsigned char verify_cookie_len; /*!< Cli: cookie length + Srv: flag for sending a cookie */ + + uint32_t retransmit_timeout; /*!< Current value of timeout */ + mbedtls_ssl_flight_item *flight; /*!< Current outgoing flight */ + mbedtls_ssl_flight_item *cur_msg; /*!< Current message in flight */ + unsigned char *cur_msg_p; /*!< Position in current message */ + unsigned int in_flight_start_seq; /*!< Minimum message sequence in the + flight being received */ + mbedtls_ssl_transform *alt_transform_out; /*!< Alternative transform for + resending messages */ + unsigned char alt_out_ctr[8]; /*!< Alternative record epoch/counter + for resending messages */ + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + /* The state of CID configuration in this handshake. */ + + uint8_t cid_in_use; /*!< This indicates whether the use of the CID extension + * has been negotiated. Possible values are + * #MBEDTLS_SSL_CID_ENABLED and + * #MBEDTLS_SSL_CID_DISABLED. */ + unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ]; /*! The peer's CID */ + uint8_t peer_cid_len; /*!< The length of + * \c peer_cid. */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + + uint16_t mtu; /*!< Handshake mtu, used to fragment outgoing messages */ +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + + /* + * Checksum contexts + */ +#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ + defined(MBEDTLS_SSL_PROTO_TLS1_1) + mbedtls_md5_context fin_md5; + mbedtls_sha1_context fin_sha1; +#endif +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) +#if defined(MBEDTLS_SHA256_C) +#if defined(MBEDTLS_USE_PSA_CRYPTO) + psa_hash_operation_t fin_sha256_psa; +#else + mbedtls_sha256_context fin_sha256; +#endif +#endif +#if defined(MBEDTLS_SHA512_C) +#if defined(MBEDTLS_USE_PSA_CRYPTO) + psa_hash_operation_t fin_sha384_psa; +#else + mbedtls_sha512_context fin_sha512; +#endif +#endif +#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ + + unsigned char randbytes[64]; /*!< random bytes */ + unsigned char premaster[MBEDTLS_PREMASTER_SIZE]; + /*!< premaster secret */ + +#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) + /** Asynchronous operation context. This field is meant for use by the + * asynchronous operation callbacks (mbedtls_ssl_config::f_async_sign_start, + * mbedtls_ssl_config::f_async_decrypt_start, + * mbedtls_ssl_config::f_async_resume, mbedtls_ssl_config::f_async_cancel). + * The library does not use it internally. */ + void *user_async_ctx; +#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ +}; + +typedef struct mbedtls_ssl_hs_buffer mbedtls_ssl_hs_buffer; + +/* + * Representation of decryption/encryption transformations on records + * + * There are the following general types of record transformations: + * - Stream transformations (TLS versions <= 1.2 only) + * Transformation adding a MAC and applying a stream-cipher + * to the authenticated message. + * - CBC block cipher transformations ([D]TLS versions <= 1.2 only) + * In addition to the distinction of the order of encryption and + * authentication, there's a fundamental difference between the + * handling in SSL3 & TLS 1.0 and TLS 1.1 and TLS 1.2: For SSL3 + * and TLS 1.0, the final IV after processing a record is used + * as the IV for the next record. No explicit IV is contained + * in an encrypted record. The IV for the first record is extracted + * at key extraction time. In contrast, for TLS 1.1 and 1.2, no + * IV is generated at key extraction time, but every encrypted + * record is explicitly prefixed by the IV with which it was encrypted. + * - AEAD transformations ([D]TLS versions >= 1.2 only) + * These come in two fundamentally different versions, the first one + * used in TLS 1.2, excluding ChaChaPoly ciphersuites, and the second + * one used for ChaChaPoly ciphersuites in TLS 1.2 as well as for TLS 1.3. + * In the first transformation, the IV to be used for a record is obtained + * as the concatenation of an explicit, static 4-byte IV and the 8-byte + * record sequence number, and explicitly prepending this sequence number + * to the encrypted record. In contrast, in the second transformation + * the IV is obtained by XOR'ing a static IV obtained at key extraction + * time with the 8-byte record sequence number, without prepending the + * latter to the encrypted record. + * + * Additionally, DTLS 1.2 + CID as well as TLS 1.3 use an inner plaintext + * which allows to add flexible length padding and to hide a record's true + * content type. + * + * In addition to type and version, the following parameters are relevant: + * - The symmetric cipher algorithm to be used. + * - The (static) encryption/decryption keys for the cipher. + * - For stream/CBC, the type of message digest to be used. + * - For stream/CBC, (static) encryption/decryption keys for the digest. + * - For AEAD transformations, the size (potentially 0) of an explicit, + * random initialization vector placed in encrypted records. + * - For some transformations (currently AEAD and CBC in SSL3 and TLS 1.0) + * an implicit IV. It may be static (e.g. AEAD) or dynamic (e.g. CBC) + * and (if present) is combined with the explicit IV in a transformation- + * dependent way (e.g. appending in TLS 1.2 and XOR'ing in TLS 1.3). + * - For stream/CBC, a flag determining the order of encryption and MAC. + * - The details of the transformation depend on the SSL/TLS version. + * - The length of the authentication tag. + * + * Note: Except for CBC in SSL3 and TLS 1.0, these parameters are + * constant across multiple encryption/decryption operations. + * For CBC, the implicit IV needs to be updated after each + * operation. + * + * The struct below refines this abstract view as follows: + * - The cipher underlying the transformation is managed in + * cipher contexts cipher_ctx_{enc/dec}, which must have the + * same cipher type. The mode of these cipher contexts determines + * the type of the transformation in the sense above: e.g., if + * the type is MBEDTLS_CIPHER_AES_256_CBC resp. MBEDTLS_CIPHER_AES_192_GCM + * then the transformation has type CBC resp. AEAD. + * - The cipher keys are never stored explicitly but + * are maintained within cipher_ctx_{enc/dec}. + * - For stream/CBC transformations, the message digest contexts + * used for the MAC's are stored in md_ctx_{enc/dec}. These contexts + * are unused for AEAD transformations. + * - For stream/CBC transformations and versions > SSL3, the + * MAC keys are not stored explicitly but maintained within + * md_ctx_{enc/dec}. + * - For stream/CBC transformations and version SSL3, the MAC + * keys are stored explicitly in mac_enc, mac_dec and have + * a fixed size of 20 bytes. These fields are unused for + * AEAD transformations or transformations >= TLS 1.0. + * - For transformations using an implicit IV maintained within + * the transformation context, its contents are stored within + * iv_{enc/dec}. + * - The value of ivlen indicates the length of the IV. + * This is redundant in case of stream/CBC transformations + * which always use 0 resp. the cipher's block length as the + * IV length, but is needed for AEAD ciphers and may be + * different from the underlying cipher's block length + * in this case. + * - The field fixed_ivlen is nonzero for AEAD transformations only + * and indicates the length of the static part of the IV which is + * constant throughout the communication, and which is stored in + * the first fixed_ivlen bytes of the iv_{enc/dec} arrays. + * Note: For CBC in SSL3 and TLS 1.0, the fields iv_{enc/dec} + * still store IV's for continued use across multiple transformations, + * so it is not true that fixed_ivlen == 0 means that iv_{enc/dec} are + * not being used! + * - minor_ver denotes the SSL/TLS version + * - For stream/CBC transformations, maclen denotes the length of the + * authentication tag, while taglen is unused and 0. + * - For AEAD transformations, taglen denotes the length of the + * authentication tag, while maclen is unused and 0. + * - For CBC transformations, encrypt_then_mac determines the + * order of encryption and authentication. This field is unused + * in other transformations. + * + */ +struct mbedtls_ssl_transform +{ + /* + * Session specific crypto layer + */ + size_t minlen; /*!< min. ciphertext length */ + size_t ivlen; /*!< IV length */ + size_t fixed_ivlen; /*!< Fixed part of IV (AEAD) */ + size_t maclen; /*!< MAC(CBC) len */ + size_t taglen; /*!< TAG(AEAD) len */ + + unsigned char iv_enc[16]; /*!< IV (encryption) */ + unsigned char iv_dec[16]; /*!< IV (decryption) */ + +#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) + +#if defined(MBEDTLS_SSL_PROTO_SSL3) + /* Needed only for SSL v3.0 secret */ + unsigned char mac_enc[20]; /*!< SSL v3.0 secret (enc) */ + unsigned char mac_dec[20]; /*!< SSL v3.0 secret (dec) */ +#endif /* MBEDTLS_SSL_PROTO_SSL3 */ + + mbedtls_md_context_t md_ctx_enc; /*!< MAC (encryption) */ + mbedtls_md_context_t md_ctx_dec; /*!< MAC (decryption) */ + +#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) + int encrypt_then_mac; /*!< flag for EtM activation */ +#endif + +#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */ + + mbedtls_cipher_context_t cipher_ctx_enc; /*!< encryption context */ + mbedtls_cipher_context_t cipher_ctx_dec; /*!< decryption context */ + int minor_ver; + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + uint8_t in_cid_len; + uint8_t out_cid_len; + unsigned char in_cid [ MBEDTLS_SSL_CID_OUT_LEN_MAX ]; + unsigned char out_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ]; +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ + + /* + * Session specific compression layer + */ +#if defined(MBEDTLS_ZLIB_SUPPORT) + z_stream ctx_deflate; /*!< compression context */ + z_stream ctx_inflate; /*!< decompression context */ +#endif + +#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) + /* We need the Hello random bytes in order to re-derive keys from the + * Master Secret and other session info, see ssl_populate_transform() */ + unsigned char randbytes[64]; /*!< ServerHello.random+ClientHello.random */ +#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */ +}; + +/* + * Return 1 if the transform uses an AEAD cipher, 0 otherwise. + * Equivalently, return 0 if a separate MAC is used, 1 otherwise. + */ +static inline int mbedtls_ssl_transform_uses_aead( + const mbedtls_ssl_transform *transform ) +{ +#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) + return( transform->maclen == 0 && transform->taglen != 0 ); +#else + (void) transform; + return( 1 ); +#endif +} + +/* + * Internal representation of record frames + * + * Instances come in two flavors: + * (1) Encrypted + * These always have data_offset = 0 + * (2) Unencrypted + * These have data_offset set to the amount of + * pre-expansion during record protection. Concretely, + * this is the length of the fixed part of the explicit IV + * used for encryption, or 0 if no explicit IV is used + * (e.g. for CBC in TLS 1.0, or stream ciphers). + * + * The reason for the data_offset in the unencrypted case + * is to allow for in-place conversion of an unencrypted to + * an encrypted record. If the offset wasn't included, the + * encrypted content would need to be shifted afterwards to + * make space for the fixed IV. + * + */ +#if MBEDTLS_SSL_CID_OUT_LEN_MAX > MBEDTLS_SSL_CID_IN_LEN_MAX +#define MBEDTLS_SSL_CID_LEN_MAX MBEDTLS_SSL_CID_OUT_LEN_MAX +#else +#define MBEDTLS_SSL_CID_LEN_MAX MBEDTLS_SSL_CID_IN_LEN_MAX +#endif + +typedef struct +{ + uint8_t ctr[8]; /* In TLS: The implicit record sequence number. + * In DTLS: The 2-byte epoch followed by + * the 6-byte sequence number. + * This is stored as a raw big endian byte array + * as opposed to a uint64_t because we rarely + * need to perform arithmetic on this, but do + * need it as a Byte array for the purpose of + * MAC computations. */ + uint8_t type; /* The record content type. */ + uint8_t ver[2]; /* SSL/TLS version as present on the wire. + * Convert to internal presentation of versions + * using mbedtls_ssl_read_version() and + * mbedtls_ssl_write_version(). + * Keep wire-format for MAC computations. */ + + unsigned char *buf; /* Memory buffer enclosing the record content */ + size_t buf_len; /* Buffer length */ + size_t data_offset; /* Offset of record content */ + size_t data_len; /* Length of record content */ + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + uint8_t cid_len; /* Length of the CID (0 if not present) */ + unsigned char cid[ MBEDTLS_SSL_CID_LEN_MAX ]; /* The CID */ +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ +} mbedtls_record; + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/* + * List of certificate + private key pairs + */ +struct mbedtls_ssl_key_cert +{ + mbedtls_x509_crt *cert; /*!< cert */ + mbedtls_pk_context *key; /*!< private key */ + mbedtls_ssl_key_cert *next; /*!< next key/cert pair */ +}; +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) +/* + * List of handshake messages kept around for resending + */ +struct mbedtls_ssl_flight_item +{ + unsigned char *p; /*!< message, including handshake headers */ + size_t len; /*!< length of p */ + unsigned char type; /*!< type of the message: handshake or CCS */ + mbedtls_ssl_flight_item *next; /*!< next handshake message(s) */ +}; +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ + defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) + +/* Find an entry in a signature-hash set matching a given hash algorithm. */ +mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set, + mbedtls_pk_type_t sig_alg ); +/* Add a signature-hash-pair to a signature-hash set */ +void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set, + mbedtls_pk_type_t sig_alg, + mbedtls_md_type_t md_alg ); +/* Allow exactly one hash algorithm for each signature. */ +void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set, + mbedtls_md_type_t md_alg ); + +/* Setup an empty signature-hash set */ +static inline void mbedtls_ssl_sig_hash_set_init( mbedtls_ssl_sig_hash_set_t *set ) +{ + mbedtls_ssl_sig_hash_set_const_hash( set, MBEDTLS_MD_NONE ); +} + +#endif /* MBEDTLS_SSL_PROTO_TLS1_2) && + MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ + +/** + * \brief Free referenced items in an SSL transform context and clear + * memory + * + * \param transform SSL transform context + */ +void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform ); + +/** + * \brief Free referenced items in an SSL handshake context and clear + * memory + * + * \param ssl SSL context + */ +void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl ); + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_handshake_client_step( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl ); +void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl ); + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl ); + +void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl ); + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context *ssl ); +void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl ); + +/** + * \brief Update record layer + * + * This function roughly separates the implementation + * of the logic of (D)TLS from the implementation + * of the secure transport. + * + * \param ssl The SSL context to use. + * \param update_hs_digest This indicates if the handshake digest + * should be automatically updated in case + * a handshake message is found. + * + * \return 0 or non-zero error code. + * + * \note A clarification on what is called 'record layer' here + * is in order, as many sensible definitions are possible: + * + * The record layer takes as input an untrusted underlying + * transport (stream or datagram) and transforms it into + * a serially multiplexed, secure transport, which + * conceptually provides the following: + * + * (1) Three datagram based, content-agnostic transports + * for handshake, alert and CCS messages. + * (2) One stream- or datagram-based transport + * for application data. + * (3) Functionality for changing the underlying transform + * securing the contents. + * + * The interface to this functionality is given as follows: + * + * a Updating + * [Currently implemented by mbedtls_ssl_read_record] + * + * Check if and on which of the four 'ports' data is pending: + * Nothing, a controlling datagram of type (1), or application + * data (2). In any case data is present, internal buffers + * provide access to the data for the user to process it. + * Consumption of type (1) datagrams is done automatically + * on the next update, invalidating that the internal buffers + * for previous datagrams, while consumption of application + * data (2) is user-controlled. + * + * b Reading of application data + * [Currently manual adaption of ssl->in_offt pointer] + * + * As mentioned in the last paragraph, consumption of data + * is different from the automatic consumption of control + * datagrams (1) because application data is treated as a stream. + * + * c Tracking availability of application data + * [Currently manually through decreasing ssl->in_msglen] + * + * For efficiency and to retain datagram semantics for + * application data in case of DTLS, the record layer + * provides functionality for checking how much application + * data is still available in the internal buffer. + * + * d Changing the transformation securing the communication. + * + * Given an opaque implementation of the record layer in the + * above sense, it should be possible to implement the logic + * of (D)TLS on top of it without the need to know anything + * about the record layer's internals. This is done e.g. + * in all the handshake handling functions, and in the + * application data reading function mbedtls_ssl_read. + * + * \note The above tries to give a conceptual picture of the + * record layer, but the current implementation deviates + * from it in some places. For example, our implementation of + * the update functionality through mbedtls_ssl_read_record + * discards datagrams depending on the current state, which + * wouldn't fall under the record layer's responsibility + * following the above definition. + * + */ +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl, + unsigned update_hs_digest ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want ); + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_write_handshake_msg( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl, uint8_t force_flush ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl ); + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl ); + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl ); + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl ); + +void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl, + const mbedtls_ssl_ciphersuite_t *ciphersuite_info ); + +#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex ); + +/** + * Get the first defined PSK by order of precedence: + * 1. handshake PSK set by \c mbedtls_ssl_set_hs_psk() in the PSK callback + * 2. static PSK configured by \c mbedtls_ssl_conf_psk() + * Return a code and update the pair (PSK, PSK length) passed to this function + */ +static inline int mbedtls_ssl_get_psk( const mbedtls_ssl_context *ssl, + const unsigned char **psk, size_t *psk_len ) +{ + if( ssl->handshake->psk != NULL && ssl->handshake->psk_len > 0 ) + { + *psk = ssl->handshake->psk; + *psk_len = ssl->handshake->psk_len; + } + + else if( ssl->conf->psk != NULL && ssl->conf->psk_len > 0 ) + { + *psk = ssl->conf->psk; + *psk_len = ssl->conf->psk_len; + } + + else + { + *psk = NULL; + *psk_len = 0; + return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ); + } + + return( 0 ); +} + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +/** + * Get the first defined opaque PSK by order of precedence: + * 1. handshake PSK set by \c mbedtls_ssl_set_hs_psk_opaque() in the PSK + * callback + * 2. static PSK configured by \c mbedtls_ssl_conf_psk_opaque() + * Return an opaque PSK + */ +static inline psa_key_id_t mbedtls_ssl_get_opaque_psk( + const mbedtls_ssl_context *ssl ) +{ + if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) ) + return( ssl->handshake->psk_opaque ); + + if( ! mbedtls_svc_key_id_is_null( ssl->conf->psk_opaque ) ) + return( ssl->conf->psk_opaque ); + + return( MBEDTLS_SVC_KEY_ID_INIT ); +} +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ + +#if defined(MBEDTLS_PK_C) +unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk ); +unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type ); +mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig ); +#endif + +mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash ); +unsigned char mbedtls_ssl_hash_from_md_alg( int md ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md ); + +#if defined(MBEDTLS_ECP_C) +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_check_curve_tls_id( const mbedtls_ssl_context *ssl, uint16_t tls_id ); +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl, + mbedtls_md_type_t md ); +#endif + +#if defined(MBEDTLS_SSL_DTLS_SRTP) +static inline mbedtls_ssl_srtp_profile mbedtls_ssl_check_srtp_profile_value + ( const uint16_t srtp_profile_value ) +{ + switch( srtp_profile_value ) + { + case MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80: + case MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32: + case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80: + case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32: + return srtp_profile_value; + default: break; + } + return( MBEDTLS_TLS_SRTP_UNSET ); +} +#endif + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +static inline mbedtls_pk_context *mbedtls_ssl_own_key( mbedtls_ssl_context *ssl ) +{ + mbedtls_ssl_key_cert *key_cert; + + if( ssl->handshake != NULL && ssl->handshake->key_cert != NULL ) + key_cert = ssl->handshake->key_cert; + else + key_cert = ssl->conf->key_cert; + + return( key_cert == NULL ? NULL : key_cert->key ); +} + +static inline mbedtls_x509_crt *mbedtls_ssl_own_cert( mbedtls_ssl_context *ssl ) +{ + mbedtls_ssl_key_cert *key_cert; + + if( ssl->handshake != NULL && ssl->handshake->key_cert != NULL ) + key_cert = ssl->handshake->key_cert; + else + key_cert = ssl->conf->key_cert; + + return( key_cert == NULL ? NULL : key_cert->cert ); +} + +/* + * Check usage of a certificate wrt extensions: + * keyUsage, extendedKeyUsage (later), and nSCertType (later). + * + * Warning: cert_endpoint is the endpoint of the cert (ie, of our peer when we + * check a cert we received from them)! + * + * Return 0 if everything is OK, -1 if not. + */ +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert, + const mbedtls_ssl_ciphersuite_t *ciphersuite, + int cert_endpoint, + uint32_t *flags ); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +void mbedtls_ssl_write_version( int major, int minor, int transport, + unsigned char ver[2] ); +void mbedtls_ssl_read_version( int *major, int *minor, int transport, + const unsigned char ver[2] ); + +static inline size_t mbedtls_ssl_in_hdr_len( const mbedtls_ssl_context *ssl ) +{ +#if !defined(MBEDTLS_SSL_PROTO_DTLS) + ((void) ssl); +#endif + +#if defined(MBEDTLS_SSL_PROTO_DTLS) + if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) + { + return( 13 ); + } + else +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + { + return( 5 ); + } +} + +static inline size_t mbedtls_ssl_out_hdr_len( const mbedtls_ssl_context *ssl ) +{ + return( (size_t) ( ssl->out_iv - ssl->out_hdr ) ); +} + +static inline size_t mbedtls_ssl_hs_hdr_len( const mbedtls_ssl_context *ssl ) +{ +#if defined(MBEDTLS_SSL_PROTO_DTLS) + if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) + return( 12 ); +#else + ((void) ssl); +#endif + return( 4 ); +} + +#if defined(MBEDTLS_SSL_PROTO_DTLS) +void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl ); +void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_resend( mbedtls_ssl_context *ssl ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_flight_transmit( mbedtls_ssl_context *ssl ); +#endif + +/* Visible for testing purposes only */ +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context const *ssl ); +void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context *ssl ); +#endif + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst, + const mbedtls_ssl_session *src ); + +#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ + defined(MBEDTLS_SSL_PROTO_TLS1_1) +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl, + unsigned char *output, + unsigned char *data, size_t data_len ); +#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \ + MBEDTLS_SSL_PROTO_TLS1_1 */ + +#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ + defined(MBEDTLS_SSL_PROTO_TLS1_2) +/* The hash buffer must have at least MBEDTLS_MD_MAX_SIZE bytes of length. */ +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl, + unsigned char *hash, size_t *hashlen, + unsigned char *data, size_t data_len, + mbedtls_md_type_t md_alg ); +#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \ + MBEDTLS_SSL_PROTO_TLS1_2 */ + +#ifdef __cplusplus +} +#endif + +void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_encrypt_buf( mbedtls_ssl_context *ssl, + mbedtls_ssl_transform *transform, + mbedtls_record *rec, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_decrypt_buf( mbedtls_ssl_context const *ssl, + mbedtls_ssl_transform *transform, + mbedtls_record *rec ); + +/* Length of the "epoch" field in the record header */ +static inline size_t mbedtls_ssl_ep_len( const mbedtls_ssl_context *ssl ) +{ +#if defined(MBEDTLS_SSL_PROTO_DTLS) + if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) + return( 2 ); +#else + ((void) ssl); +#endif + return( 0 ); +} + +#if defined(MBEDTLS_SSL_PROTO_DTLS) +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_resend_hello_request( mbedtls_ssl_context *ssl ); +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + +void mbedtls_ssl_set_timer( mbedtls_ssl_context *ssl, uint32_t millisecs ); +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_check_timer( mbedtls_ssl_context *ssl ); + +void mbedtls_ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl ); +void mbedtls_ssl_update_out_pointers( mbedtls_ssl_context *ssl, + mbedtls_ssl_transform *transform ); +void mbedtls_ssl_update_in_pointers( mbedtls_ssl_context *ssl ); + +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial ); + +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) +void mbedtls_ssl_dtls_replay_reset( mbedtls_ssl_context *ssl ); +#endif + +void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl ); + +#if defined(MBEDTLS_SSL_RENEGOTIATION) +MBEDTLS_CHECK_RETURN_CRITICAL +int mbedtls_ssl_start_renegotiation( mbedtls_ssl_context *ssl ); +#endif /* MBEDTLS_SSL_RENEGOTIATION */ + +#if defined(MBEDTLS_SSL_PROTO_DTLS) +size_t mbedtls_ssl_get_current_mtu( const mbedtls_ssl_context *ssl ); +void mbedtls_ssl_buffering_free( mbedtls_ssl_context *ssl ); +void mbedtls_ssl_flight_free( mbedtls_ssl_flight_item *flight ); +#endif /* MBEDTLS_SSL_PROTO_DTLS */ + +#if defined(MBEDTLS_TEST_HOOKS) +int mbedtls_ssl_check_dtls_clihlo_cookie( + mbedtls_ssl_context *ssl, + const unsigned char *cli_id, size_t cli_id_len, + const unsigned char *in, size_t in_len, + unsigned char *obuf, size_t buf_len, size_t *olen ); +#endif + +#endif /* ssl_internal.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/ssl_ticket.h b/openharmony/armeabi-v7a/include/mbedtls/ssl_ticket.h new file mode 100644 index 00000000..8221051b --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/ssl_ticket.h @@ -0,0 +1,140 @@ +/** + * \file ssl_ticket.h + * + * \brief TLS server ticket callbacks implementation + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_SSL_TICKET_H +#define MBEDTLS_SSL_TICKET_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +/* + * This implementation of the session ticket callbacks includes key + * management, rotating the keys periodically in order to preserve forward + * secrecy, when MBEDTLS_HAVE_TIME is defined. + */ + +#include "mbedtls/ssl.h" +#include "mbedtls/cipher.h" + +#if defined(MBEDTLS_THREADING_C) +#include "mbedtls/threading.h" +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \brief Information for session ticket protection + */ +typedef struct mbedtls_ssl_ticket_key +{ + unsigned char name[4]; /*!< random key identifier */ + uint32_t generation_time; /*!< key generation timestamp (seconds) */ + mbedtls_cipher_context_t ctx; /*!< context for auth enc/decryption */ +} +mbedtls_ssl_ticket_key; + +/** + * \brief Context for session ticket handling functions + */ +typedef struct mbedtls_ssl_ticket_context +{ + mbedtls_ssl_ticket_key keys[2]; /*!< ticket protection keys */ + unsigned char active; /*!< index of the currently active key */ + + uint32_t ticket_lifetime; /*!< lifetime of tickets in seconds */ + + /** Callback for getting (pseudo-)random numbers */ + int (*f_rng)(void *, unsigned char *, size_t); + void *p_rng; /*!< context for the RNG function */ + +#if defined(MBEDTLS_THREADING_C) + mbedtls_threading_mutex_t mutex; +#endif +} +mbedtls_ssl_ticket_context; + +/** + * \brief Initialize a ticket context. + * (Just make it ready for mbedtls_ssl_ticket_setup() + * or mbedtls_ssl_ticket_free().) + * + * \param ctx Context to be initialized + */ +void mbedtls_ssl_ticket_init( mbedtls_ssl_ticket_context *ctx ); + +/** + * \brief Prepare context to be actually used + * + * \param ctx Context to be set up + * \param f_rng RNG callback function + * \param p_rng RNG callback context + * \param cipher AEAD cipher to use for ticket protection. + * Recommended value: MBEDTLS_CIPHER_AES_256_GCM. + * \param lifetime Tickets lifetime in seconds + * Recommended value: 86400 (one day). + * + * \note It is highly recommended to select a cipher that is at + * least as strong as the strongest ciphersuite + * supported. Usually that means a 256-bit key. + * + * \note The lifetime of the keys is twice the lifetime of tickets. + * It is recommended to pick a reasonable lifetime so as not + * to negate the benefits of forward secrecy. + * + * \return 0 if successful, + * or a specific MBEDTLS_ERR_XXX error code + */ +int mbedtls_ssl_ticket_setup( mbedtls_ssl_ticket_context *ctx, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, + mbedtls_cipher_type_t cipher, + uint32_t lifetime ); + +/** + * \brief Implementation of the ticket write callback + * + * \note See \c mbedtls_ssl_ticket_write_t for description + */ +mbedtls_ssl_ticket_write_t mbedtls_ssl_ticket_write; + +/** + * \brief Implementation of the ticket parse callback + * + * \note See \c mbedtls_ssl_ticket_parse_t for description + */ +mbedtls_ssl_ticket_parse_t mbedtls_ssl_ticket_parse; + +/** + * \brief Free a context's content and zeroize it. + * + * \param ctx Context to be cleaned up + */ +void mbedtls_ssl_ticket_free( mbedtls_ssl_ticket_context *ctx ); + +#ifdef __cplusplus +} +#endif + +#endif /* ssl_ticket.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/threading.h b/openharmony/armeabi-v7a/include/mbedtls/threading.h new file mode 100644 index 00000000..d147c73f --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/threading.h @@ -0,0 +1,126 @@ +/** + * \file threading.h + * + * \brief Threading abstraction layer + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_THREADING_H +#define MBEDTLS_THREADING_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +/* MBEDTLS_ERR_THREADING_FEATURE_UNAVAILABLE is deprecated and should not be + * used. */ +/** The selected feature is not available. */ +#define MBEDTLS_ERR_THREADING_FEATURE_UNAVAILABLE -0x001A + +/** Bad input parameters to function. */ +#define MBEDTLS_ERR_THREADING_BAD_INPUT_DATA -0x001C +/** Locking / unlocking / free failed with error code. */ +#define MBEDTLS_ERR_THREADING_MUTEX_ERROR -0x001E + +#if defined(MBEDTLS_THREADING_PTHREAD) +#include +typedef struct mbedtls_threading_mutex_t +{ + pthread_mutex_t mutex; + /* is_valid is 0 after a failed init or a free, and nonzero after a + * successful init. This field is not considered part of the public + * API of Mbed TLS and may change without notice. */ + char is_valid; +} mbedtls_threading_mutex_t; +#endif + +#if defined(MBEDTLS_THREADING_ALT) +/* You should define the mbedtls_threading_mutex_t type in your header */ +#include "threading_alt.h" + +/** + * \brief Set your alternate threading implementation function + * pointers and initialize global mutexes. If used, this + * function must be called once in the main thread before any + * other mbed TLS function is called, and + * mbedtls_threading_free_alt() must be called once in the main + * thread after all other mbed TLS functions. + * + * \note mutex_init() and mutex_free() don't return a status code. + * If mutex_init() fails, it should leave its argument (the + * mutex) in a state such that mutex_lock() will fail when + * called with this argument. + * + * \param mutex_init the init function implementation + * \param mutex_free the free function implementation + * \param mutex_lock the lock function implementation + * \param mutex_unlock the unlock function implementation + */ +void mbedtls_threading_set_alt( void (*mutex_init)( mbedtls_threading_mutex_t * ), + void (*mutex_free)( mbedtls_threading_mutex_t * ), + int (*mutex_lock)( mbedtls_threading_mutex_t * ), + int (*mutex_unlock)( mbedtls_threading_mutex_t * ) ); + +/** + * \brief Free global mutexes. + */ +void mbedtls_threading_free_alt( void ); +#endif /* MBEDTLS_THREADING_ALT */ + +#if defined(MBEDTLS_THREADING_C) +/* + * The function pointers for mutex_init, mutex_free, mutex_ and mutex_unlock + * + * All these functions are expected to work or the result will be undefined. + */ +extern void (*mbedtls_mutex_init)( mbedtls_threading_mutex_t *mutex ); +extern void (*mbedtls_mutex_free)( mbedtls_threading_mutex_t *mutex ); +extern int (*mbedtls_mutex_lock)( mbedtls_threading_mutex_t *mutex ); +extern int (*mbedtls_mutex_unlock)( mbedtls_threading_mutex_t *mutex ); + +/* + * Global mutexes + */ +#if defined(MBEDTLS_FS_IO) +extern mbedtls_threading_mutex_t mbedtls_threading_readdir_mutex; +#endif + +#if defined(MBEDTLS_HAVE_TIME_DATE) && !defined(MBEDTLS_PLATFORM_GMTIME_R_ALT) +/* This mutex may or may not be used in the default definition of + * mbedtls_platform_gmtime_r(), but in order to determine that, + * we need to check POSIX features, hence modify _POSIX_C_SOURCE. + * With the current approach, this declaration is orphaned, lacking + * an accompanying definition, in case mbedtls_platform_gmtime_r() + * doesn't need it, but that's not a problem. */ +extern mbedtls_threading_mutex_t mbedtls_threading_gmtime_mutex; +#endif /* MBEDTLS_HAVE_TIME_DATE && !MBEDTLS_PLATFORM_GMTIME_R_ALT */ + +#endif /* MBEDTLS_THREADING_C */ + +#ifdef __cplusplus +} +#endif + +#endif /* threading.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/timing.h b/openharmony/armeabi-v7a/include/mbedtls/timing.h new file mode 100644 index 00000000..b7290cfc --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/timing.h @@ -0,0 +1,151 @@ +/** + * \file timing.h + * + * \brief Portable interface to timeouts and to the CPU cycle counter + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_TIMING_H +#define MBEDTLS_TIMING_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_TIMING_ALT) +// Regular implementation +// + +/** + * \brief timer structure + */ +struct mbedtls_timing_hr_time +{ + unsigned char opaque[32]; +}; + +/** + * \brief Context for mbedtls_timing_set/get_delay() + */ +typedef struct mbedtls_timing_delay_context +{ + struct mbedtls_timing_hr_time timer; + uint32_t int_ms; + uint32_t fin_ms; +} mbedtls_timing_delay_context; + +#else /* MBEDTLS_TIMING_ALT */ +#include "timing_alt.h" +#endif /* MBEDTLS_TIMING_ALT */ + +extern volatile int mbedtls_timing_alarmed; + +/** + * \brief Return the CPU cycle counter value + * + * \warning This is only a best effort! Do not rely on this! + * In particular, it is known to be unreliable on virtual + * machines. + * + * \note This value starts at an unspecified origin and + * may wrap around. + */ +unsigned long mbedtls_timing_hardclock( void ); + +/** + * \brief Return the elapsed time in milliseconds + * + * \param val points to a timer structure + * \param reset If 0, query the elapsed time. Otherwise (re)start the timer. + * + * \return Elapsed time since the previous reset in ms. When + * restarting, this is always 0. + * + * \note To initialize a timer, call this function with reset=1. + * + * Determining the elapsed time and resetting the timer is not + * atomic on all platforms, so after the sequence + * `{ get_timer(1); ...; time1 = get_timer(1); ...; time2 = + * get_timer(0) }` the value time1+time2 is only approximately + * the delay since the first reset. + */ +unsigned long mbedtls_timing_get_timer( struct mbedtls_timing_hr_time *val, int reset ); + +/** + * \brief Setup an alarm clock + * + * \param seconds delay before the "mbedtls_timing_alarmed" flag is set + * (must be >=0) + * + * \warning Only one alarm at a time is supported. In a threaded + * context, this means one for the whole process, not one per + * thread. + */ +void mbedtls_set_alarm( int seconds ); + +/** + * \brief Set a pair of delays to watch + * (See \c mbedtls_timing_get_delay().) + * + * \param data Pointer to timing data. + * Must point to a valid \c mbedtls_timing_delay_context struct. + * \param int_ms First (intermediate) delay in milliseconds. + * The effect if int_ms > fin_ms is unspecified. + * \param fin_ms Second (final) delay in milliseconds. + * Pass 0 to cancel the current delay. + * + * \note To set a single delay, either use \c mbedtls_timing_set_timer + * directly or use this function with int_ms == fin_ms. + */ +void mbedtls_timing_set_delay( void *data, uint32_t int_ms, uint32_t fin_ms ); + +/** + * \brief Get the status of delays + * (Memory helper: number of delays passed.) + * + * \param data Pointer to timing data + * Must point to a valid \c mbedtls_timing_delay_context struct. + * + * \return -1 if cancelled (fin_ms = 0), + * 0 if none of the delays are passed, + * 1 if only the intermediate delay is passed, + * 2 if the final delay is passed. + */ +int mbedtls_timing_get_delay( void *data ); + +#if defined(MBEDTLS_SELF_TEST) +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if a test failed + */ +int mbedtls_timing_self_test( int verbose ); +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* timing.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/version.h b/openharmony/armeabi-v7a/include/mbedtls/version.h new file mode 100644 index 00000000..44adcbfe --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/version.h @@ -0,0 +1,110 @@ +/** + * \file version.h + * + * \brief Run-time version information + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +/* + * This set of compile-time defines and run-time variables can be used to + * determine the version number of the mbed TLS library used. + */ +#ifndef MBEDTLS_VERSION_H +#define MBEDTLS_VERSION_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +/** + * The version number x.y.z is split into three parts. + * Major, Minor, Patchlevel + */ +#define MBEDTLS_VERSION_MAJOR 2 +#define MBEDTLS_VERSION_MINOR 28 +#define MBEDTLS_VERSION_PATCH 1 + +/** + * The single version number has the following structure: + * MMNNPP00 + * Major version | Minor version | Patch version + */ +#define MBEDTLS_VERSION_NUMBER 0x021C0100 +#define MBEDTLS_VERSION_STRING "2.28.1" +#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.28.1" + +#if defined(MBEDTLS_VERSION_C) + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * Get the version number. + * + * \return The constructed version number in the format + * MMNNPP00 (Major, Minor, Patch). + */ +unsigned int mbedtls_version_get_number( void ); + +/** + * Get the version string ("x.y.z"). + * + * \param string The string that will receive the value. + * (Should be at least 9 bytes in size) + */ +void mbedtls_version_get_string( char *string ); + +/** + * Get the full version string ("mbed TLS x.y.z"). + * + * \param string The string that will receive the value. The mbed TLS version + * string will use 18 bytes AT MOST including a terminating + * null byte. + * (So the buffer should be at least 18 bytes to receive this + * version string). + */ +void mbedtls_version_get_string_full( char *string ); + +/** + * \brief Check if support for a feature was compiled into this + * mbed TLS binary. This allows you to see at runtime if the + * library was for instance compiled with or without + * Multi-threading support. + * + * \note only checks against defines in the sections "System + * support", "mbed TLS modules" and "mbed TLS feature + * support" in config.h + * + * \param feature The string for the define to check (e.g. "MBEDTLS_AES_C") + * + * \return 0 if the feature is present, + * -1 if the feature is not present and + * -2 if support for feature checking as a whole was not + * compiled in. + */ +int mbedtls_version_check_feature( const char *feature ); + +#ifdef __cplusplus +} +#endif + +#endif /* MBEDTLS_VERSION_C */ + +#endif /* version.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/x509.h b/openharmony/armeabi-v7a/include/mbedtls/x509.h new file mode 100644 index 00000000..31b78df3 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/x509.h @@ -0,0 +1,380 @@ +/** + * \file x509.h + * + * \brief X.509 generic defines and structures + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_X509_H +#define MBEDTLS_X509_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/asn1.h" +#include "mbedtls/pk.h" + +#if defined(MBEDTLS_RSA_C) +#include "mbedtls/rsa.h" +#endif + +/** + * \addtogroup x509_module + * \{ + */ + +#if !defined(MBEDTLS_X509_MAX_INTERMEDIATE_CA) +/** + * Maximum number of intermediate CAs in a verification chain. + * That is, maximum length of the chain, excluding the end-entity certificate + * and the trusted root certificate. + * + * Set this to a low value to prevent an adversary from making you waste + * resources verifying an overlong certificate chain. + */ +#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 +#endif + +/** + * \name X509 Error codes + * \{ + */ +/** Unavailable feature, e.g. RSA hashing/encryption combination. */ +#define MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE -0x2080 +/** Requested OID is unknown. */ +#define MBEDTLS_ERR_X509_UNKNOWN_OID -0x2100 +/** The CRT/CRL/CSR format is invalid, e.g. different type expected. */ +#define MBEDTLS_ERR_X509_INVALID_FORMAT -0x2180 +/** The CRT/CRL/CSR version element is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_VERSION -0x2200 +/** The serial tag or value is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_SERIAL -0x2280 +/** The algorithm tag or value is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_ALG -0x2300 +/** The name tag or value is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_NAME -0x2380 +/** The date tag or value is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_DATE -0x2400 +/** The signature tag or value invalid. */ +#define MBEDTLS_ERR_X509_INVALID_SIGNATURE -0x2480 +/** The extension tag or value is invalid. */ +#define MBEDTLS_ERR_X509_INVALID_EXTENSIONS -0x2500 +/** CRT/CRL/CSR has an unsupported version number. */ +#define MBEDTLS_ERR_X509_UNKNOWN_VERSION -0x2580 +/** Signature algorithm (oid) is unsupported. */ +#define MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG -0x2600 +/** Signature algorithms do not match. (see \c ::mbedtls_x509_crt sig_oid) */ +#define MBEDTLS_ERR_X509_SIG_MISMATCH -0x2680 +/** Certificate verification failed, e.g. CRL, CA or signature check failed. */ +#define MBEDTLS_ERR_X509_CERT_VERIFY_FAILED -0x2700 +/** Format not recognized as DER or PEM. */ +#define MBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT -0x2780 +/** Input invalid. */ +#define MBEDTLS_ERR_X509_BAD_INPUT_DATA -0x2800 +/** Allocation of memory failed. */ +#define MBEDTLS_ERR_X509_ALLOC_FAILED -0x2880 +/** Read/write of file failed. */ +#define MBEDTLS_ERR_X509_FILE_IO_ERROR -0x2900 +/** Destination buffer is too small. */ +#define MBEDTLS_ERR_X509_BUFFER_TOO_SMALL -0x2980 +/** A fatal error occurred, eg the chain is too long or the vrfy callback failed. */ +#define MBEDTLS_ERR_X509_FATAL_ERROR -0x3000 +/** \} name X509 Error codes */ + +/** + * \name X509 Verify codes + * \{ + */ +/* Reminder: update x509_crt_verify_strings[] in library/x509_crt.c */ +#define MBEDTLS_X509_BADCERT_EXPIRED 0x01 /**< The certificate validity has expired. */ +#define MBEDTLS_X509_BADCERT_REVOKED 0x02 /**< The certificate has been revoked (is on a CRL). */ +#define MBEDTLS_X509_BADCERT_CN_MISMATCH 0x04 /**< The certificate Common Name (CN) does not match with the expected CN. */ +#define MBEDTLS_X509_BADCERT_NOT_TRUSTED 0x08 /**< The certificate is not correctly signed by the trusted CA. */ +#define MBEDTLS_X509_BADCRL_NOT_TRUSTED 0x10 /**< The CRL is not correctly signed by the trusted CA. */ +#define MBEDTLS_X509_BADCRL_EXPIRED 0x20 /**< The CRL is expired. */ +#define MBEDTLS_X509_BADCERT_MISSING 0x40 /**< Certificate was missing. */ +#define MBEDTLS_X509_BADCERT_SKIP_VERIFY 0x80 /**< Certificate verification was skipped. */ +#define MBEDTLS_X509_BADCERT_OTHER 0x0100 /**< Other reason (can be used by verify callback) */ +#define MBEDTLS_X509_BADCERT_FUTURE 0x0200 /**< The certificate validity starts in the future. */ +#define MBEDTLS_X509_BADCRL_FUTURE 0x0400 /**< The CRL is from the future */ +#define MBEDTLS_X509_BADCERT_KEY_USAGE 0x0800 /**< Usage does not match the keyUsage extension. */ +#define MBEDTLS_X509_BADCERT_EXT_KEY_USAGE 0x1000 /**< Usage does not match the extendedKeyUsage extension. */ +#define MBEDTLS_X509_BADCERT_NS_CERT_TYPE 0x2000 /**< Usage does not match the nsCertType extension. */ +#define MBEDTLS_X509_BADCERT_BAD_MD 0x4000 /**< The certificate is signed with an unacceptable hash. */ +#define MBEDTLS_X509_BADCERT_BAD_PK 0x8000 /**< The certificate is signed with an unacceptable PK alg (eg RSA vs ECDSA). */ +#define MBEDTLS_X509_BADCERT_BAD_KEY 0x010000 /**< The certificate is signed with an unacceptable key (eg bad curve, RSA too short). */ +#define MBEDTLS_X509_BADCRL_BAD_MD 0x020000 /**< The CRL is signed with an unacceptable hash. */ +#define MBEDTLS_X509_BADCRL_BAD_PK 0x040000 /**< The CRL is signed with an unacceptable PK alg (eg RSA vs ECDSA). */ +#define MBEDTLS_X509_BADCRL_BAD_KEY 0x080000 /**< The CRL is signed with an unacceptable key (eg bad curve, RSA too short). */ + +/** \} name X509 Verify codes */ +/** \} addtogroup x509_module */ + +/* + * X.509 v3 Subject Alternative Name types. + * otherName [0] OtherName, + * rfc822Name [1] IA5String, + * dNSName [2] IA5String, + * x400Address [3] ORAddress, + * directoryName [4] Name, + * ediPartyName [5] EDIPartyName, + * uniformResourceIdentifier [6] IA5String, + * iPAddress [7] OCTET STRING, + * registeredID [8] OBJECT IDENTIFIER + */ +#define MBEDTLS_X509_SAN_OTHER_NAME 0 +#define MBEDTLS_X509_SAN_RFC822_NAME 1 +#define MBEDTLS_X509_SAN_DNS_NAME 2 +#define MBEDTLS_X509_SAN_X400_ADDRESS_NAME 3 +#define MBEDTLS_X509_SAN_DIRECTORY_NAME 4 +#define MBEDTLS_X509_SAN_EDI_PARTY_NAME 5 +#define MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER 6 +#define MBEDTLS_X509_SAN_IP_ADDRESS 7 +#define MBEDTLS_X509_SAN_REGISTERED_ID 8 + +/* + * X.509 v3 Key Usage Extension flags + * Reminder: update x509_info_key_usage() when adding new flags. + */ +#define MBEDTLS_X509_KU_DIGITAL_SIGNATURE (0x80) /* bit 0 */ +#define MBEDTLS_X509_KU_NON_REPUDIATION (0x40) /* bit 1 */ +#define MBEDTLS_X509_KU_KEY_ENCIPHERMENT (0x20) /* bit 2 */ +#define MBEDTLS_X509_KU_DATA_ENCIPHERMENT (0x10) /* bit 3 */ +#define MBEDTLS_X509_KU_KEY_AGREEMENT (0x08) /* bit 4 */ +#define MBEDTLS_X509_KU_KEY_CERT_SIGN (0x04) /* bit 5 */ +#define MBEDTLS_X509_KU_CRL_SIGN (0x02) /* bit 6 */ +#define MBEDTLS_X509_KU_ENCIPHER_ONLY (0x01) /* bit 7 */ +#define MBEDTLS_X509_KU_DECIPHER_ONLY (0x8000) /* bit 8 */ + +/* + * Netscape certificate types + * (http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn3.html) + */ + +#define MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT (0x80) /* bit 0 */ +#define MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER (0x40) /* bit 1 */ +#define MBEDTLS_X509_NS_CERT_TYPE_EMAIL (0x20) /* bit 2 */ +#define MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING (0x10) /* bit 3 */ +#define MBEDTLS_X509_NS_CERT_TYPE_RESERVED (0x08) /* bit 4 */ +#define MBEDTLS_X509_NS_CERT_TYPE_SSL_CA (0x04) /* bit 5 */ +#define MBEDTLS_X509_NS_CERT_TYPE_EMAIL_CA (0x02) /* bit 6 */ +#define MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING_CA (0x01) /* bit 7 */ + +/* + * X.509 extension types + * + * Comments refer to the status for using certificates. Status can be + * different for writing certificates or reading CRLs or CSRs. + * + * Those are defined in oid.h as oid.c needs them in a data structure. Since + * these were previously defined here, let's have aliases for compatibility. + */ +#define MBEDTLS_X509_EXT_AUTHORITY_KEY_IDENTIFIER MBEDTLS_OID_X509_EXT_AUTHORITY_KEY_IDENTIFIER +#define MBEDTLS_X509_EXT_SUBJECT_KEY_IDENTIFIER MBEDTLS_OID_X509_EXT_SUBJECT_KEY_IDENTIFIER +#define MBEDTLS_X509_EXT_KEY_USAGE MBEDTLS_OID_X509_EXT_KEY_USAGE +#define MBEDTLS_X509_EXT_CERTIFICATE_POLICIES MBEDTLS_OID_X509_EXT_CERTIFICATE_POLICIES +#define MBEDTLS_X509_EXT_POLICY_MAPPINGS MBEDTLS_OID_X509_EXT_POLICY_MAPPINGS +#define MBEDTLS_X509_EXT_SUBJECT_ALT_NAME MBEDTLS_OID_X509_EXT_SUBJECT_ALT_NAME /* Supported (DNS) */ +#define MBEDTLS_X509_EXT_ISSUER_ALT_NAME MBEDTLS_OID_X509_EXT_ISSUER_ALT_NAME +#define MBEDTLS_X509_EXT_SUBJECT_DIRECTORY_ATTRS MBEDTLS_OID_X509_EXT_SUBJECT_DIRECTORY_ATTRS +#define MBEDTLS_X509_EXT_BASIC_CONSTRAINTS MBEDTLS_OID_X509_EXT_BASIC_CONSTRAINTS /* Supported */ +#define MBEDTLS_X509_EXT_NAME_CONSTRAINTS MBEDTLS_OID_X509_EXT_NAME_CONSTRAINTS +#define MBEDTLS_X509_EXT_POLICY_CONSTRAINTS MBEDTLS_OID_X509_EXT_POLICY_CONSTRAINTS +#define MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE MBEDTLS_OID_X509_EXT_EXTENDED_KEY_USAGE +#define MBEDTLS_X509_EXT_CRL_DISTRIBUTION_POINTS MBEDTLS_OID_X509_EXT_CRL_DISTRIBUTION_POINTS +#define MBEDTLS_X509_EXT_INIHIBIT_ANYPOLICY MBEDTLS_OID_X509_EXT_INIHIBIT_ANYPOLICY +#define MBEDTLS_X509_EXT_FRESHEST_CRL MBEDTLS_OID_X509_EXT_FRESHEST_CRL +#define MBEDTLS_X509_EXT_NS_CERT_TYPE MBEDTLS_OID_X509_EXT_NS_CERT_TYPE + +/* + * Storage format identifiers + * Recognized formats: PEM and DER + */ +#define MBEDTLS_X509_FORMAT_DER 1 +#define MBEDTLS_X509_FORMAT_PEM 2 + +#define MBEDTLS_X509_MAX_DN_NAME_SIZE 256 /**< Maximum value size of a DN entry */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \addtogroup x509_module + * \{ */ + +/** + * \name Structures for parsing X.509 certificates, CRLs and CSRs + * \{ + */ + +/** + * Type-length-value structure that allows for ASN1 using DER. + */ +typedef mbedtls_asn1_buf mbedtls_x509_buf; + +/** + * Container for ASN1 bit strings. + */ +typedef mbedtls_asn1_bitstring mbedtls_x509_bitstring; + +/** + * Container for ASN1 named information objects. + * It allows for Relative Distinguished Names (e.g. cn=localhost,ou=code,etc.). + */ +typedef mbedtls_asn1_named_data mbedtls_x509_name; + +/** + * Container for a sequence of ASN.1 items + */ +typedef mbedtls_asn1_sequence mbedtls_x509_sequence; + +/** Container for date and time (precision in seconds). */ +typedef struct mbedtls_x509_time +{ + int year, mon, day; /**< Date. */ + int hour, min, sec; /**< Time. */ +} +mbedtls_x509_time; + +/** \} name Structures for parsing X.509 certificates, CRLs and CSRs */ + +/** + * \brief Store the certificate DN in printable form into buf; + * no more than size characters will be written. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param dn The X509 name to represent + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_dn_gets( char *buf, size_t size, const mbedtls_x509_name *dn ); + +/** + * \brief Store the certificate serial in printable form into buf; + * no more than size characters will be written. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param serial The X509 serial to represent + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_serial_gets( char *buf, size_t size, const mbedtls_x509_buf *serial ); + +/** + * \brief Check a given mbedtls_x509_time against the system time + * and tell if it's in the past. + * + * \note Intended usage is "if( is_past( valid_to ) ) ERROR". + * Hence the return value of 1 if on internal errors. + * + * \param to mbedtls_x509_time to check + * + * \return 1 if the given time is in the past or an error occurred, + * 0 otherwise. + */ +int mbedtls_x509_time_is_past( const mbedtls_x509_time *to ); + +/** + * \brief Check a given mbedtls_x509_time against the system time + * and tell if it's in the future. + * + * \note Intended usage is "if( is_future( valid_from ) ) ERROR". + * Hence the return value of 1 if on internal errors. + * + * \param from mbedtls_x509_time to check + * + * \return 1 if the given time is in the future or an error occurred, + * 0 otherwise. + */ +int mbedtls_x509_time_is_future( const mbedtls_x509_time *from ); + +/** \} addtogroup x509_module */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_x509_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +/* + * Internal module functions. You probably do not want to use these unless you + * know you do. + */ +int mbedtls_x509_get_name( unsigned char **p, const unsigned char *end, + mbedtls_x509_name *cur ); +int mbedtls_x509_get_alg_null( unsigned char **p, const unsigned char *end, + mbedtls_x509_buf *alg ); +int mbedtls_x509_get_alg( unsigned char **p, const unsigned char *end, + mbedtls_x509_buf *alg, mbedtls_x509_buf *params ); +#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) +int mbedtls_x509_get_rsassa_pss_params( const mbedtls_x509_buf *params, + mbedtls_md_type_t *md_alg, mbedtls_md_type_t *mgf_md, + int *salt_len ); +#endif +int mbedtls_x509_get_sig( unsigned char **p, const unsigned char *end, mbedtls_x509_buf *sig ); +int mbedtls_x509_get_sig_alg( const mbedtls_x509_buf *sig_oid, const mbedtls_x509_buf *sig_params, + mbedtls_md_type_t *md_alg, mbedtls_pk_type_t *pk_alg, + void **sig_opts ); +int mbedtls_x509_get_time( unsigned char **p, const unsigned char *end, + mbedtls_x509_time *t ); +int mbedtls_x509_get_serial( unsigned char **p, const unsigned char *end, + mbedtls_x509_buf *serial ); +int mbedtls_x509_get_ext( unsigned char **p, const unsigned char *end, + mbedtls_x509_buf *ext, int tag ); +int mbedtls_x509_sig_alg_gets( char *buf, size_t size, const mbedtls_x509_buf *sig_oid, + mbedtls_pk_type_t pk_alg, mbedtls_md_type_t md_alg, + const void *sig_opts ); +int mbedtls_x509_key_size_helper( char *buf, size_t buf_size, const char *name ); +int mbedtls_x509_string_to_names( mbedtls_asn1_named_data **head, const char *name ); +int mbedtls_x509_set_extension( mbedtls_asn1_named_data **head, const char *oid, size_t oid_len, + int critical, const unsigned char *val, + size_t val_len ); +int mbedtls_x509_write_extensions( unsigned char **p, unsigned char *start, + mbedtls_asn1_named_data *first ); +int mbedtls_x509_write_names( unsigned char **p, unsigned char *start, + mbedtls_asn1_named_data *first ); +int mbedtls_x509_write_sig( unsigned char **p, unsigned char *start, + const char *oid, size_t oid_len, + unsigned char *sig, size_t size ); + +#define MBEDTLS_X509_SAFE_SNPRINTF \ + do { \ + if( ret < 0 || (size_t) ret >= n ) \ + return( MBEDTLS_ERR_X509_BUFFER_TOO_SMALL ); \ + \ + n -= (size_t) ret; \ + p += (size_t) ret; \ + } while( 0 ) + +#ifdef __cplusplus +} +#endif + +#endif /* x509.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/x509_crl.h b/openharmony/armeabi-v7a/include/mbedtls/x509_crl.h new file mode 100644 index 00000000..92220090 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/x509_crl.h @@ -0,0 +1,172 @@ +/** + * \file x509_crl.h + * + * \brief X.509 certificate revocation list parsing + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_X509_CRL_H +#define MBEDTLS_X509_CRL_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/x509.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \addtogroup x509_module + * \{ */ + +/** + * \name Structures and functions for parsing CRLs + * \{ + */ + +/** + * Certificate revocation list entry. + * Contains the CA-specific serial numbers and revocation dates. + */ +typedef struct mbedtls_x509_crl_entry +{ + mbedtls_x509_buf raw; + + mbedtls_x509_buf serial; + + mbedtls_x509_time revocation_date; + + mbedtls_x509_buf entry_ext; + + struct mbedtls_x509_crl_entry *next; +} +mbedtls_x509_crl_entry; + +/** + * Certificate revocation list structure. + * Every CRL may have multiple entries. + */ +typedef struct mbedtls_x509_crl +{ + mbedtls_x509_buf raw; /**< The raw certificate data (DER). */ + mbedtls_x509_buf tbs; /**< The raw certificate body (DER). The part that is To Be Signed. */ + + int version; /**< CRL version (1=v1, 2=v2) */ + mbedtls_x509_buf sig_oid; /**< CRL signature type identifier */ + + mbedtls_x509_buf issuer_raw; /**< The raw issuer data (DER). */ + + mbedtls_x509_name issuer; /**< The parsed issuer data (named information object). */ + + mbedtls_x509_time this_update; + mbedtls_x509_time next_update; + + mbedtls_x509_crl_entry entry; /**< The CRL entries containing the certificate revocation times for this CA. */ + + mbedtls_x509_buf crl_ext; + + mbedtls_x509_buf sig_oid2; + mbedtls_x509_buf sig; + mbedtls_md_type_t sig_md; /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */ + mbedtls_pk_type_t sig_pk; /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */ + void *sig_opts; /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */ + + struct mbedtls_x509_crl *next; +} +mbedtls_x509_crl; + +/** + * \brief Parse a DER-encoded CRL and append it to the chained list + * + * \param chain points to the start of the chain + * \param buf buffer holding the CRL data in DER format + * \param buflen size of the buffer + * (including the terminating null byte for PEM data) + * + * \return 0 if successful, or a specific X509 or PEM error code + */ +int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain, + const unsigned char *buf, size_t buflen ); +/** + * \brief Parse one or more CRLs and append them to the chained list + * + * \note Multiple CRLs are accepted only if using PEM format + * + * \param chain points to the start of the chain + * \param buf buffer holding the CRL data in PEM or DER format + * \param buflen size of the buffer + * (including the terminating null byte for PEM data) + * + * \return 0 if successful, or a specific X509 or PEM error code + */ +int mbedtls_x509_crl_parse( mbedtls_x509_crl *chain, const unsigned char *buf, size_t buflen ); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief Load one or more CRLs and append them to the chained list + * + * \note Multiple CRLs are accepted only if using PEM format + * + * \param chain points to the start of the chain + * \param path filename to read the CRLs from (in PEM or DER encoding) + * + * \return 0 if successful, or a specific X509 or PEM error code + */ +int mbedtls_x509_crl_parse_file( mbedtls_x509_crl *chain, const char *path ); +#endif /* MBEDTLS_FS_IO */ + +/** + * \brief Returns an informational string about the CRL. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param prefix A line prefix + * \param crl The X509 CRL to represent + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_crl_info( char *buf, size_t size, const char *prefix, + const mbedtls_x509_crl *crl ); + +/** + * \brief Initialize a CRL (chain) + * + * \param crl CRL chain to initialize + */ +void mbedtls_x509_crl_init( mbedtls_x509_crl *crl ); + +/** + * \brief Unallocate all CRL data + * + * \param crl CRL chain to free + */ +void mbedtls_x509_crl_free( mbedtls_x509_crl *crl ); + +/** \} name Structures and functions for parsing CRLs */ +/** \} addtogroup x509_module */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_x509_crl.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/x509_crt.h b/openharmony/armeabi-v7a/include/mbedtls/x509_crt.h new file mode 100644 index 00000000..0f2885a7 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/x509_crt.h @@ -0,0 +1,1097 @@ +/** + * \file x509_crt.h + * + * \brief X.509 certificate parsing and writing + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_X509_CRT_H +#define MBEDTLS_X509_CRT_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/x509.h" +#include "mbedtls/x509_crl.h" +#include "mbedtls/bignum.h" + +/** + * \addtogroup x509_module + * \{ + */ + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \name Structures and functions for parsing and writing X.509 certificates + * \{ + */ + +/** + * Container for an X.509 certificate. The certificate may be chained. + */ +typedef struct mbedtls_x509_crt +{ + int own_buffer; /**< Indicates if \c raw is owned + * by the structure or not. */ + mbedtls_x509_buf raw; /**< The raw certificate data (DER). */ + mbedtls_x509_buf tbs; /**< The raw certificate body (DER). The part that is To Be Signed. */ + + int version; /**< The X.509 version. (1=v1, 2=v2, 3=v3) */ + mbedtls_x509_buf serial; /**< Unique id for certificate issued by a specific CA. */ + mbedtls_x509_buf sig_oid; /**< Signature algorithm, e.g. sha1RSA */ + + mbedtls_x509_buf issuer_raw; /**< The raw issuer data (DER). Used for quick comparison. */ + mbedtls_x509_buf subject_raw; /**< The raw subject data (DER). Used for quick comparison. */ + + mbedtls_x509_name issuer; /**< The parsed issuer data (named information object). */ + mbedtls_x509_name subject; /**< The parsed subject data (named information object). */ + + mbedtls_x509_time valid_from; /**< Start time of certificate validity. */ + mbedtls_x509_time valid_to; /**< End time of certificate validity. */ + + mbedtls_x509_buf pk_raw; + mbedtls_pk_context pk; /**< Container for the public key context. */ + + mbedtls_x509_buf issuer_id; /**< Optional X.509 v2/v3 issuer unique identifier. */ + mbedtls_x509_buf subject_id; /**< Optional X.509 v2/v3 subject unique identifier. */ + mbedtls_x509_buf v3_ext; /**< Optional X.509 v3 extensions. */ + mbedtls_x509_sequence subject_alt_names; /**< Optional list of raw entries of Subject Alternative Names extension (currently only dNSName and OtherName are listed). */ + + mbedtls_x509_sequence certificate_policies; /**< Optional list of certificate policies (Only anyPolicy is printed and enforced, however the rest of the policies are still listed). */ + + int ext_types; /**< Bit string containing detected and parsed extensions */ + int ca_istrue; /**< Optional Basic Constraint extension value: 1 if this certificate belongs to a CA, 0 otherwise. */ + int max_pathlen; /**< Optional Basic Constraint extension value: The maximum path length to the root certificate. Path length is 1 higher than RFC 5280 'meaning', so 1+ */ + + unsigned int key_usage; /**< Optional key usage extension value: See the values in x509.h */ + + mbedtls_x509_sequence ext_key_usage; /**< Optional list of extended key usage OIDs. */ + + unsigned char ns_cert_type; /**< Optional Netscape certificate type extension value: See the values in x509.h */ + + mbedtls_x509_buf sig; /**< Signature: hash of the tbs part signed with the private key. */ + mbedtls_md_type_t sig_md; /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */ + mbedtls_pk_type_t sig_pk; /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */ + void *sig_opts; /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */ + + struct mbedtls_x509_crt *next; /**< Next certificate in the CA-chain. */ +} +mbedtls_x509_crt; + +/** + * From RFC 5280 section 4.2.1.6: + * OtherName ::= SEQUENCE { + * type-id OBJECT IDENTIFIER, + * value [0] EXPLICIT ANY DEFINED BY type-id } + */ +typedef struct mbedtls_x509_san_other_name +{ + /** + * The type_id is an OID as defined in RFC 5280. + * To check the value of the type id, you should use + * \p MBEDTLS_OID_CMP with a known OID mbedtls_x509_buf. + */ + mbedtls_x509_buf type_id; /**< The type id. */ + union + { + /** + * From RFC 4108 section 5: + * HardwareModuleName ::= SEQUENCE { + * hwType OBJECT IDENTIFIER, + * hwSerialNum OCTET STRING } + */ + struct + { + mbedtls_x509_buf oid; /**< The object identifier. */ + mbedtls_x509_buf val; /**< The named value. */ + } + hardware_module_name; + } + value; +} +mbedtls_x509_san_other_name; + +/** + * A structure for holding the parsed Subject Alternative Name, according to type + */ +typedef struct mbedtls_x509_subject_alternative_name +{ + int type; /**< The SAN type, value of MBEDTLS_X509_SAN_XXX. */ + union { + mbedtls_x509_san_other_name other_name; /**< The otherName supported type. */ + mbedtls_x509_buf unstructured_name; /**< The buffer for the un constructed types. Only dnsName currently supported */ + } + san; /**< A union of the supported SAN types */ +} +mbedtls_x509_subject_alternative_name; + +/** + * Build flag from an algorithm/curve identifier (pk, md, ecp) + * Since 0 is always XXX_NONE, ignore it. + */ +#define MBEDTLS_X509_ID_FLAG( id ) ( 1 << ( (id) - 1 ) ) + +/** + * Security profile for certificate verification. + * + * All lists are bitfields, built by ORing flags from MBEDTLS_X509_ID_FLAG(). + */ +typedef struct mbedtls_x509_crt_profile +{ + uint32_t allowed_mds; /**< MDs for signatures */ + uint32_t allowed_pks; /**< PK algs for public keys; + * this applies to all certificates + * in the provided chain. */ + uint32_t allowed_curves; /**< Elliptic curves for ECDSA */ + uint32_t rsa_min_bitlen; /**< Minimum size for RSA keys */ +} +mbedtls_x509_crt_profile; + +#define MBEDTLS_X509_CRT_VERSION_1 0 +#define MBEDTLS_X509_CRT_VERSION_2 1 +#define MBEDTLS_X509_CRT_VERSION_3 2 + +#define MBEDTLS_X509_RFC5280_MAX_SERIAL_LEN 32 +#define MBEDTLS_X509_RFC5280_UTC_TIME_LEN 15 + +#if !defined( MBEDTLS_X509_MAX_FILE_PATH_LEN ) +#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 +#endif + +/** + * Container for writing a certificate (CRT) + */ +typedef struct mbedtls_x509write_cert +{ + int version; + mbedtls_mpi serial; + mbedtls_pk_context *subject_key; + mbedtls_pk_context *issuer_key; + mbedtls_asn1_named_data *subject; + mbedtls_asn1_named_data *issuer; + mbedtls_md_type_t md_alg; + char not_before[MBEDTLS_X509_RFC5280_UTC_TIME_LEN + 1]; + char not_after[MBEDTLS_X509_RFC5280_UTC_TIME_LEN + 1]; + mbedtls_asn1_named_data *extensions; +} +mbedtls_x509write_cert; + +/** + * Item in a verification chain: cert and flags for it + */ +typedef struct { + mbedtls_x509_crt *crt; + uint32_t flags; +} mbedtls_x509_crt_verify_chain_item; + +/** + * Max size of verification chain: end-entity + intermediates + trusted root + */ +#define MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE ( MBEDTLS_X509_MAX_INTERMEDIATE_CA + 2 ) + +/** + * Verification chain as built by \c mbedtls_crt_verify_chain() + */ +typedef struct +{ + mbedtls_x509_crt_verify_chain_item items[MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE]; + unsigned len; + +#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) + /* This stores the list of potential trusted signers obtained from + * the CA callback used for the CRT verification, if configured. + * We must track it somewhere because the callback passes its + * ownership to the caller. */ + mbedtls_x509_crt *trust_ca_cb_result; +#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ +} mbedtls_x509_crt_verify_chain; + +#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) + +/** + * \brief Context for resuming X.509 verify operations + */ +typedef struct +{ + /* for check_signature() */ + mbedtls_pk_restart_ctx pk; + + /* for find_parent_in() */ + mbedtls_x509_crt *parent; /* non-null iff parent_in in progress */ + mbedtls_x509_crt *fallback_parent; + int fallback_signature_is_good; + + /* for find_parent() */ + int parent_is_trusted; /* -1 if find_parent is not in progress */ + + /* for verify_chain() */ + enum { + x509_crt_rs_none, + x509_crt_rs_find_parent, + } in_progress; /* none if no operation is in progress */ + int self_cnt; + mbedtls_x509_crt_verify_chain ver_chain; + +} mbedtls_x509_crt_restart_ctx; + +#else /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ + +/* Now we can declare functions that take a pointer to that */ +typedef void mbedtls_x509_crt_restart_ctx; + +#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ + +#if defined(MBEDTLS_X509_CRT_PARSE_C) +/** + * Default security profile. Should provide a good balance between security + * and compatibility with current deployments. + * + * This profile permits: + * - SHA2 hashes. + * - All supported elliptic curves. + * - RSA with 2048 bits and above. + * + * New minor versions of Mbed TLS may extend this profile, for example if + * new curves are added to the library. New minor versions of Mbed TLS will + * not reduce this profile unless serious security concerns require it. + */ +extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default; + +/** + * Expected next default profile. Recommended for new deployments. + * Currently targets a 128-bit security level, except for allowing RSA-2048. + */ +extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_next; + +/** + * NSA Suite B profile. + */ +extern const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_suiteb; + +/** + * \brief Parse a single DER formatted certificate and add it + * to the end of the provided chained list. + * + * \param chain The pointer to the start of the CRT chain to attach to. + * When parsing the first CRT in a chain, this should point + * to an instance of ::mbedtls_x509_crt initialized through + * mbedtls_x509_crt_init(). + * \param buf The buffer holding the DER encoded certificate. + * \param buflen The size in Bytes of \p buf. + * + * \note This function makes an internal copy of the CRT buffer + * \p buf. In particular, \p buf may be destroyed or reused + * after this call returns. To avoid duplicating the CRT + * buffer (at the cost of stricter lifetime constraints), + * use mbedtls_x509_crt_parse_der_nocopy() instead. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_x509_crt_parse_der( mbedtls_x509_crt *chain, + const unsigned char *buf, + size_t buflen ); + +/** + * \brief The type of certificate extension callbacks. + * + * Callbacks of this type are passed to and used by the + * mbedtls_x509_crt_parse_der_with_ext_cb() routine when + * it encounters either an unsupported extension or a + * "certificate policies" extension containing any + * unsupported certificate policies. + * Future versions of the library may invoke the callback + * in other cases, if and when the need arises. + * + * \param p_ctx An opaque context passed to the callback. + * \param crt The certificate being parsed. + * \param oid The OID of the extension. + * \param critical Whether the extension is critical. + * \param p Pointer to the start of the extension value + * (the content of the OCTET STRING). + * \param end End of extension value. + * + * \note The callback must fail and return a negative error code + * if it can not parse or does not support the extension. + * When the callback fails to parse a critical extension + * mbedtls_x509_crt_parse_der_with_ext_cb() also fails. + * When the callback fails to parse a non critical extension + * mbedtls_x509_crt_parse_der_with_ext_cb() simply skips + * the extension and continues parsing. + * + * \return \c 0 on success. + * \return A negative error code on failure. + */ +typedef int (*mbedtls_x509_crt_ext_cb_t)( void *p_ctx, + mbedtls_x509_crt const *crt, + mbedtls_x509_buf const *oid, + int critical, + const unsigned char *p, + const unsigned char *end ); + +/** + * \brief Parse a single DER formatted certificate and add it + * to the end of the provided chained list. + * + * \param chain The pointer to the start of the CRT chain to attach to. + * When parsing the first CRT in a chain, this should point + * to an instance of ::mbedtls_x509_crt initialized through + * mbedtls_x509_crt_init(). + * \param buf The buffer holding the DER encoded certificate. + * \param buflen The size in Bytes of \p buf. + * \param make_copy When not zero this function makes an internal copy of the + * CRT buffer \p buf. In particular, \p buf may be destroyed + * or reused after this call returns. + * When zero this function avoids duplicating the CRT buffer + * by taking temporary ownership thereof until the CRT + * is destroyed (like mbedtls_x509_crt_parse_der_nocopy()) + * \param cb A callback invoked for every unsupported certificate + * extension. + * \param p_ctx An opaque context passed to the callback. + * + * \note This call is functionally equivalent to + * mbedtls_x509_crt_parse_der(), and/or + * mbedtls_x509_crt_parse_der_nocopy() + * but it calls the callback with every unsupported + * certificate extension and additionally the + * "certificate policies" extension if it contains any + * unsupported certificate policies. + * The callback must return a negative error code if it + * does not know how to handle such an extension. + * When the callback fails to parse a critical extension + * mbedtls_x509_crt_parse_der_with_ext_cb() also fails. + * When the callback fails to parse a non critical extension + * mbedtls_x509_crt_parse_der_with_ext_cb() simply skips + * the extension and continues parsing. + * Future versions of the library may invoke the callback + * in other cases, if and when the need arises. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_x509_crt_parse_der_with_ext_cb( mbedtls_x509_crt *chain, + const unsigned char *buf, + size_t buflen, + int make_copy, + mbedtls_x509_crt_ext_cb_t cb, + void *p_ctx ); + +/** + * \brief Parse a single DER formatted certificate and add it + * to the end of the provided chained list. This is a + * variant of mbedtls_x509_crt_parse_der() which takes + * temporary ownership of the CRT buffer until the CRT + * is destroyed. + * + * \param chain The pointer to the start of the CRT chain to attach to. + * When parsing the first CRT in a chain, this should point + * to an instance of ::mbedtls_x509_crt initialized through + * mbedtls_x509_crt_init(). + * \param buf The address of the readable buffer holding the DER encoded + * certificate to use. On success, this buffer must be + * retained and not be changed for the liftetime of the + * CRT chain \p chain, that is, until \p chain is destroyed + * through a call to mbedtls_x509_crt_free(). + * \param buflen The size in Bytes of \p buf. + * + * \note This call is functionally equivalent to + * mbedtls_x509_crt_parse_der(), but it avoids creating a + * copy of the input buffer at the cost of stronger lifetime + * constraints. This is useful in constrained environments + * where duplication of the CRT cannot be tolerated. + * + * \return \c 0 if successful. + * \return A negative error code on failure. + */ +int mbedtls_x509_crt_parse_der_nocopy( mbedtls_x509_crt *chain, + const unsigned char *buf, + size_t buflen ); + +/** + * \brief Parse one DER-encoded or one or more concatenated PEM-encoded + * certificates and add them to the chained list. + * + * For CRTs in PEM encoding, the function parses permissively: + * if at least one certificate can be parsed, the function + * returns the number of certificates for which parsing failed + * (hence \c 0 if all certificates were parsed successfully). + * If no certificate could be parsed, the function returns + * the first (negative) error encountered during parsing. + * + * PEM encoded certificates may be interleaved by other data + * such as human readable descriptions of their content, as + * long as the certificates are enclosed in the PEM specific + * '-----{BEGIN/END} CERTIFICATE-----' delimiters. + * + * \param chain The chain to which to add the parsed certificates. + * \param buf The buffer holding the certificate data in PEM or DER format. + * For certificates in PEM encoding, this may be a concatenation + * of multiple certificates; for DER encoding, the buffer must + * comprise exactly one certificate. + * \param buflen The size of \p buf, including the terminating \c NULL byte + * in case of PEM encoded data. + * + * \return \c 0 if all certificates were parsed successfully. + * \return The (positive) number of certificates that couldn't + * be parsed if parsing was partly successful (see above). + * \return A negative X509 or PEM error code otherwise. + * + */ +int mbedtls_x509_crt_parse( mbedtls_x509_crt *chain, const unsigned char *buf, size_t buflen ); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief Load one or more certificates and add them + * to the chained list. Parses permissively. If some + * certificates can be parsed, the result is the number + * of failed certificates it encountered. If none complete + * correctly, the first error is returned. + * + * \param chain points to the start of the chain + * \param path filename to read the certificates from + * + * \return 0 if all certificates parsed successfully, a positive number + * if partly successful or a specific X509 or PEM error code + */ +int mbedtls_x509_crt_parse_file( mbedtls_x509_crt *chain, const char *path ); + +/** + * \brief Load one or more certificate files from a path and add them + * to the chained list. Parses permissively. If some + * certificates can be parsed, the result is the number + * of failed certificates it encountered. If none complete + * correctly, the first error is returned. + * + * \param chain points to the start of the chain + * \param path directory / folder to read the certificate files from + * + * \return 0 if all certificates parsed successfully, a positive number + * if partly successful or a specific X509 or PEM error code + */ +int mbedtls_x509_crt_parse_path( mbedtls_x509_crt *chain, const char *path ); + +#endif /* MBEDTLS_FS_IO */ +/** + * \brief This function parses an item in the SubjectAlternativeNames + * extension. + * + * \param san_buf The buffer holding the raw data item of the subject + * alternative name. + * \param san The target structure to populate with the parsed presentation + * of the subject alternative name encoded in \p san_raw. + * + * \note Only "dnsName" and "otherName" of type hardware_module_name + * as defined in RFC 4180 is supported. + * + * \note This function should be called on a single raw data of + * subject alternative name. For example, after successful + * certificate parsing, one must iterate on every item in the + * \p crt->subject_alt_names sequence, and pass it to + * this function. + * + * \warning The target structure contains pointers to the raw data of the + * parsed certificate, and its lifetime is restricted by the + * lifetime of the certificate. + * + * \return \c 0 on success + * \return #MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE for an unsupported + * SAN type. + * \return Another negative value for any other failure. + */ +int mbedtls_x509_parse_subject_alt_name( const mbedtls_x509_buf *san_buf, + mbedtls_x509_subject_alternative_name *san ); +/** + * \brief Returns an informational string about the + * certificate. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param prefix A line prefix + * \param crt The X509 certificate to represent + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_crt_info( char *buf, size_t size, const char *prefix, + const mbedtls_x509_crt *crt ); + +/** + * \brief Returns an informational string about the + * verification status of a certificate. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param prefix A line prefix + * \param flags Verification flags created by mbedtls_x509_crt_verify() + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_crt_verify_info( char *buf, size_t size, const char *prefix, + uint32_t flags ); + +/** + * \brief Verify a chain of certificates. + * + * The verify callback is a user-supplied callback that + * can clear / modify / add flags for a certificate. If set, + * the verification callback is called for each + * certificate in the chain (from the trust-ca down to the + * presented crt). The parameters for the callback are: + * (void *parameter, mbedtls_x509_crt *crt, int certificate_depth, + * int *flags). With the flags representing current flags for + * that specific certificate and the certificate depth from + * the bottom (Peer cert depth = 0). + * + * All flags left after returning from the callback + * are also returned to the application. The function should + * return 0 for anything (including invalid certificates) + * other than fatal error, as a non-zero return code + * immediately aborts the verification process. For fatal + * errors, a specific error code should be used (different + * from MBEDTLS_ERR_X509_CERT_VERIFY_FAILED which should not + * be returned at this point), or MBEDTLS_ERR_X509_FATAL_ERROR + * can be used if no better code is available. + * + * \note In case verification failed, the results can be displayed + * using \c mbedtls_x509_crt_verify_info() + * + * \note Same as \c mbedtls_x509_crt_verify_with_profile() with the + * default security profile. + * + * \note It is your responsibility to provide up-to-date CRLs for + * all trusted CAs. If no CRL is provided for the CA that was + * used to sign the certificate, CRL verification is skipped + * silently, that is *without* setting any flag. + * + * \note The \c trust_ca list can contain two types of certificates: + * (1) those of trusted root CAs, so that certificates + * chaining up to those CAs will be trusted, and (2) + * self-signed end-entity certificates to be trusted (for + * specific peers you know) - in that case, the self-signed + * certificate doesn't need to have the CA bit set. + * + * \param crt The certificate chain to be verified. + * \param trust_ca The list of trusted CAs. + * \param ca_crl The list of CRLs for trusted CAs. + * \param cn The expected Common Name. This will be checked to be + * present in the certificate's subjectAltNames extension or, + * if this extension is absent, as a CN component in its + * Subject name. Currently only DNS names are supported. This + * may be \c NULL if the CN need not be verified. + * \param flags The address at which to store the result of the verification. + * If the verification couldn't be completed, the flag value is + * set to (uint32_t) -1. + * \param f_vrfy The verification callback to use. See the documentation + * of mbedtls_x509_crt_verify() for more information. + * \param p_vrfy The context to be passed to \p f_vrfy. + * + * \return \c 0 if the chain is valid with respect to the + * passed CN, CAs, CRLs and security profile. + * \return #MBEDTLS_ERR_X509_CERT_VERIFY_FAILED in case the + * certificate chain verification failed. In this case, + * \c *flags will have one or more + * \c MBEDTLS_X509_BADCERT_XXX or \c MBEDTLS_X509_BADCRL_XXX + * flags set. + * \return Another negative error code in case of a fatal error + * encountered during the verification process. + */ +int mbedtls_x509_crt_verify( mbedtls_x509_crt *crt, + mbedtls_x509_crt *trust_ca, + mbedtls_x509_crl *ca_crl, + const char *cn, uint32_t *flags, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy ); + +/** + * \brief Verify a chain of certificates with respect to + * a configurable security profile. + * + * \note Same as \c mbedtls_x509_crt_verify(), but with explicit + * security profile. + * + * \note The restrictions on keys (RSA minimum size, allowed curves + * for ECDSA) apply to all certificates: trusted root, + * intermediate CAs if any, and end entity certificate. + * + * \param crt The certificate chain to be verified. + * \param trust_ca The list of trusted CAs. + * \param ca_crl The list of CRLs for trusted CAs. + * \param profile The security profile to use for the verification. + * \param cn The expected Common Name. This may be \c NULL if the + * CN need not be verified. + * \param flags The address at which to store the result of the verification. + * If the verification couldn't be completed, the flag value is + * set to (uint32_t) -1. + * \param f_vrfy The verification callback to use. See the documentation + * of mbedtls_x509_crt_verify() for more information. + * \param p_vrfy The context to be passed to \p f_vrfy. + * + * \return \c 0 if the chain is valid with respect to the + * passed CN, CAs, CRLs and security profile. + * \return #MBEDTLS_ERR_X509_CERT_VERIFY_FAILED in case the + * certificate chain verification failed. In this case, + * \c *flags will have one or more + * \c MBEDTLS_X509_BADCERT_XXX or \c MBEDTLS_X509_BADCRL_XXX + * flags set. + * \return Another negative error code in case of a fatal error + * encountered during the verification process. + */ +int mbedtls_x509_crt_verify_with_profile( mbedtls_x509_crt *crt, + mbedtls_x509_crt *trust_ca, + mbedtls_x509_crl *ca_crl, + const mbedtls_x509_crt_profile *profile, + const char *cn, uint32_t *flags, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy ); + +/** + * \brief Restartable version of \c mbedtls_crt_verify_with_profile() + * + * \note Performs the same job as \c mbedtls_crt_verify_with_profile() + * but can return early and restart according to the limit + * set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + * + * \param crt The certificate chain to be verified. + * \param trust_ca The list of trusted CAs. + * \param ca_crl The list of CRLs for trusted CAs. + * \param profile The security profile to use for the verification. + * \param cn The expected Common Name. This may be \c NULL if the + * CN need not be verified. + * \param flags The address at which to store the result of the verification. + * If the verification couldn't be completed, the flag value is + * set to (uint32_t) -1. + * \param f_vrfy The verification callback to use. See the documentation + * of mbedtls_x509_crt_verify() for more information. + * \param p_vrfy The context to be passed to \p f_vrfy. + * \param rs_ctx The restart context to use. This may be set to \c NULL + * to disable restartable ECC. + * + * \return See \c mbedtls_crt_verify_with_profile(), or + * \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + * operations was reached: see \c mbedtls_ecp_set_max_ops(). + */ +int mbedtls_x509_crt_verify_restartable( mbedtls_x509_crt *crt, + mbedtls_x509_crt *trust_ca, + mbedtls_x509_crl *ca_crl, + const mbedtls_x509_crt_profile *profile, + const char *cn, uint32_t *flags, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy, + mbedtls_x509_crt_restart_ctx *rs_ctx ); + +/** + * \brief The type of trusted certificate callbacks. + * + * Callbacks of this type are passed to and used by the CRT + * verification routine mbedtls_x509_crt_verify_with_ca_cb() + * when looking for trusted signers of a given certificate. + * + * On success, the callback returns a list of trusted + * certificates to be considered as potential signers + * for the input certificate. + * + * \param p_ctx An opaque context passed to the callback. + * \param child The certificate for which to search a potential signer. + * This will point to a readable certificate. + * \param candidate_cas The address at which to store the address of the first + * entry in the generated linked list of candidate signers. + * This will not be \c NULL. + * + * \note The callback must only return a non-zero value on a + * fatal error. If, in contrast, the search for a potential + * signer completes without a single candidate, the + * callback must return \c 0 and set \c *candidate_cas + * to \c NULL. + * + * \return \c 0 on success. In this case, \c *candidate_cas points + * to a heap-allocated linked list of instances of + * ::mbedtls_x509_crt, and ownership of this list is passed + * to the caller. + * \return A negative error code on failure. + */ +typedef int (*mbedtls_x509_crt_ca_cb_t)( void *p_ctx, + mbedtls_x509_crt const *child, + mbedtls_x509_crt **candidate_cas ); + +#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) +/** + * \brief Version of \c mbedtls_x509_crt_verify_with_profile() which + * uses a callback to acquire the list of trusted CA + * certificates. + * + * \param crt The certificate chain to be verified. + * \param f_ca_cb The callback to be used to query for potential signers + * of a given child certificate. See the documentation of + * ::mbedtls_x509_crt_ca_cb_t for more information. + * \param p_ca_cb The opaque context to be passed to \p f_ca_cb. + * \param profile The security profile for the verification. + * \param cn The expected Common Name. This may be \c NULL if the + * CN need not be verified. + * \param flags The address at which to store the result of the verification. + * If the verification couldn't be completed, the flag value is + * set to (uint32_t) -1. + * \param f_vrfy The verification callback to use. See the documentation + * of mbedtls_x509_crt_verify() for more information. + * \param p_vrfy The context to be passed to \p f_vrfy. + * + * \return See \c mbedtls_crt_verify_with_profile(). + */ +int mbedtls_x509_crt_verify_with_ca_cb( mbedtls_x509_crt *crt, + mbedtls_x509_crt_ca_cb_t f_ca_cb, + void *p_ca_cb, + const mbedtls_x509_crt_profile *profile, + const char *cn, uint32_t *flags, + int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), + void *p_vrfy ); + +#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ + +#if defined(MBEDTLS_X509_CHECK_KEY_USAGE) +/** + * \brief Check usage of certificate against keyUsage extension. + * + * \param crt Leaf certificate used. + * \param usage Intended usage(s) (eg MBEDTLS_X509_KU_KEY_ENCIPHERMENT + * before using the certificate to perform an RSA key + * exchange). + * + * \note Except for decipherOnly and encipherOnly, a bit set in the + * usage argument means this bit MUST be set in the + * certificate. For decipherOnly and encipherOnly, it means + * that bit MAY be set. + * + * \return 0 is these uses of the certificate are allowed, + * MBEDTLS_ERR_X509_BAD_INPUT_DATA if the keyUsage extension + * is present but does not match the usage argument. + * + * \note You should only call this function on leaf certificates, on + * (intermediate) CAs the keyUsage extension is automatically + * checked by \c mbedtls_x509_crt_verify(). + */ +int mbedtls_x509_crt_check_key_usage( const mbedtls_x509_crt *crt, + unsigned int usage ); +#endif /* MBEDTLS_X509_CHECK_KEY_USAGE) */ + +#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE) +/** + * \brief Check usage of certificate against extendedKeyUsage. + * + * \param crt Leaf certificate used. + * \param usage_oid Intended usage (eg MBEDTLS_OID_SERVER_AUTH or + * MBEDTLS_OID_CLIENT_AUTH). + * \param usage_len Length of usage_oid (eg given by MBEDTLS_OID_SIZE()). + * + * \return 0 if this use of the certificate is allowed, + * MBEDTLS_ERR_X509_BAD_INPUT_DATA if not. + * + * \note Usually only makes sense on leaf certificates. + */ +int mbedtls_x509_crt_check_extended_key_usage( const mbedtls_x509_crt *crt, + const char *usage_oid, + size_t usage_len ); +#endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */ + +#if defined(MBEDTLS_X509_CRL_PARSE_C) +/** + * \brief Verify the certificate revocation status + * + * \param crt a certificate to be verified + * \param crl the CRL to verify against + * + * \return 1 if the certificate is revoked, 0 otherwise + * + */ +int mbedtls_x509_crt_is_revoked( const mbedtls_x509_crt *crt, const mbedtls_x509_crl *crl ); +#endif /* MBEDTLS_X509_CRL_PARSE_C */ + +/** + * \brief Initialize a certificate (chain) + * + * \param crt Certificate chain to initialize + */ +void mbedtls_x509_crt_init( mbedtls_x509_crt *crt ); + +/** + * \brief Unallocate all certificate data + * + * \param crt Certificate chain to free + */ +void mbedtls_x509_crt_free( mbedtls_x509_crt *crt ); + +#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) +/** + * \brief Initialize a restart context + */ +void mbedtls_x509_crt_restart_init( mbedtls_x509_crt_restart_ctx *ctx ); + +/** + * \brief Free the components of a restart context + */ +void mbedtls_x509_crt_restart_free( mbedtls_x509_crt_restart_ctx *ctx ); +#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ +#endif /* MBEDTLS_X509_CRT_PARSE_C */ + +/** \} name Structures and functions for parsing and writing X.509 certificates */ + +#if defined(MBEDTLS_X509_CRT_WRITE_C) +/** + * \brief Initialize a CRT writing context + * + * \param ctx CRT context to initialize + */ +void mbedtls_x509write_crt_init( mbedtls_x509write_cert *ctx ); + +/** + * \brief Set the version for a Certificate + * Default: MBEDTLS_X509_CRT_VERSION_3 + * + * \param ctx CRT context to use + * \param version version to set (MBEDTLS_X509_CRT_VERSION_1, MBEDTLS_X509_CRT_VERSION_2 or + * MBEDTLS_X509_CRT_VERSION_3) + */ +void mbedtls_x509write_crt_set_version( mbedtls_x509write_cert *ctx, int version ); + +/** + * \brief Set the serial number for a Certificate. + * + * \param ctx CRT context to use + * \param serial serial number to set + * + * \return 0 if successful + */ +int mbedtls_x509write_crt_set_serial( mbedtls_x509write_cert *ctx, const mbedtls_mpi *serial ); + +/** + * \brief Set the validity period for a Certificate + * Timestamps should be in string format for UTC timezone + * i.e. "YYYYMMDDhhmmss" + * e.g. "20131231235959" for December 31st 2013 + * at 23:59:59 + * + * \param ctx CRT context to use + * \param not_before not_before timestamp + * \param not_after not_after timestamp + * + * \return 0 if timestamp was parsed successfully, or + * a specific error code + */ +int mbedtls_x509write_crt_set_validity( mbedtls_x509write_cert *ctx, const char *not_before, + const char *not_after ); + +/** + * \brief Set the issuer name for a Certificate + * Issuer names should contain a comma-separated list + * of OID types and values: + * e.g. "C=UK,O=ARM,CN=mbed TLS CA" + * + * \param ctx CRT context to use + * \param issuer_name issuer name to set + * + * \return 0 if issuer name was parsed successfully, or + * a specific error code + */ +int mbedtls_x509write_crt_set_issuer_name( mbedtls_x509write_cert *ctx, + const char *issuer_name ); + +/** + * \brief Set the subject name for a Certificate + * Subject names should contain a comma-separated list + * of OID types and values: + * e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" + * + * \param ctx CRT context to use + * \param subject_name subject name to set + * + * \return 0 if subject name was parsed successfully, or + * a specific error code + */ +int mbedtls_x509write_crt_set_subject_name( mbedtls_x509write_cert *ctx, + const char *subject_name ); + +/** + * \brief Set the subject public key for the certificate + * + * \param ctx CRT context to use + * \param key public key to include + */ +void mbedtls_x509write_crt_set_subject_key( mbedtls_x509write_cert *ctx, mbedtls_pk_context *key ); + +/** + * \brief Set the issuer key used for signing the certificate + * + * \param ctx CRT context to use + * \param key private key to sign with + */ +void mbedtls_x509write_crt_set_issuer_key( mbedtls_x509write_cert *ctx, mbedtls_pk_context *key ); + +/** + * \brief Set the MD algorithm to use for the signature + * (e.g. MBEDTLS_MD_SHA1) + * + * \param ctx CRT context to use + * \param md_alg MD algorithm to use + */ +void mbedtls_x509write_crt_set_md_alg( mbedtls_x509write_cert *ctx, mbedtls_md_type_t md_alg ); + +/** + * \brief Generic function to add to or replace an extension in the + * CRT + * + * \param ctx CRT context to use + * \param oid OID of the extension + * \param oid_len length of the OID + * \param critical if the extension is critical (per the RFC's definition) + * \param val value of the extension OCTET STRING + * \param val_len length of the value data + * + * \return 0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_extension( mbedtls_x509write_cert *ctx, + const char *oid, size_t oid_len, + int critical, + const unsigned char *val, size_t val_len ); + +/** + * \brief Set the basicConstraints extension for a CRT + * + * \param ctx CRT context to use + * \param is_ca is this a CA certificate + * \param max_pathlen maximum length of certificate chains below this + * certificate (only for CA certificates, -1 is + * unlimited) + * + * \return 0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_basic_constraints( mbedtls_x509write_cert *ctx, + int is_ca, int max_pathlen ); + +#if defined(MBEDTLS_SHA1_C) +/** + * \brief Set the subjectKeyIdentifier extension for a CRT + * Requires that mbedtls_x509write_crt_set_subject_key() has been + * called before + * + * \param ctx CRT context to use + * + * \return 0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_subject_key_identifier( mbedtls_x509write_cert *ctx ); + +/** + * \brief Set the authorityKeyIdentifier extension for a CRT + * Requires that mbedtls_x509write_crt_set_issuer_key() has been + * called before + * + * \param ctx CRT context to use + * + * \return 0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_authority_key_identifier( mbedtls_x509write_cert *ctx ); +#endif /* MBEDTLS_SHA1_C */ + +/** + * \brief Set the Key Usage Extension flags + * (e.g. MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_KEY_CERT_SIGN) + * + * \param ctx CRT context to use + * \param key_usage key usage flags to set + * + * \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_key_usage( mbedtls_x509write_cert *ctx, + unsigned int key_usage ); + +/** + * \brief Set the Netscape Cert Type flags + * (e.g. MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT | MBEDTLS_X509_NS_CERT_TYPE_EMAIL) + * + * \param ctx CRT context to use + * \param ns_cert_type Netscape Cert Type flags to set + * + * \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_crt_set_ns_cert_type( mbedtls_x509write_cert *ctx, + unsigned char ns_cert_type ); + +/** + * \brief Free the contents of a CRT write context + * + * \param ctx CRT context to free + */ +void mbedtls_x509write_crt_free( mbedtls_x509write_cert *ctx ); + +/** + * \brief Write a built up certificate to a X509 DER structure + * Note: data is written at the end of the buffer! Use the + * return value to determine where you should start + * using the buffer + * + * \param ctx certificate to write away + * \param buf buffer to write to + * \param size size of the buffer + * \param f_rng RNG function (for signature, see note) + * \param p_rng RNG parameter + * + * \return length of data written if successful, or a specific + * error code + * + * \note f_rng may be NULL if RSA is used for signature and the + * signature is made offline (otherwise f_rng is desirable + * for countermeasures against timing attacks). + * ECDSA signatures always require a non-NULL f_rng. + */ +int mbedtls_x509write_crt_der( mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +#if defined(MBEDTLS_PEM_WRITE_C) +/** + * \brief Write a built up certificate to a X509 PEM string + * + * \param ctx certificate to write away + * \param buf buffer to write to + * \param size size of the buffer + * \param f_rng RNG function (for signature, see note) + * \param p_rng RNG parameter + * + * \return 0 if successful, or a specific error code + * + * \note f_rng may be NULL if RSA is used for signature and the + * signature is made offline (otherwise f_rng is desirable + * for countermeasures against timing attacks). + * ECDSA signatures always require a non-NULL f_rng. + */ +int mbedtls_x509write_crt_pem( mbedtls_x509write_cert *ctx, unsigned char *buf, size_t size, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); +#endif /* MBEDTLS_PEM_WRITE_C */ +#endif /* MBEDTLS_X509_CRT_WRITE_C */ + +/** \} addtogroup x509_module */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_x509_crt.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/x509_csr.h b/openharmony/armeabi-v7a/include/mbedtls/x509_csr.h new file mode 100644 index 00000000..2a1c0461 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/x509_csr.h @@ -0,0 +1,306 @@ +/** + * \file x509_csr.h + * + * \brief X.509 certificate signing request parsing and writing + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_X509_CSR_H +#define MBEDTLS_X509_CSR_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include "mbedtls/x509.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \addtogroup x509_module + * \{ */ + +/** + * \name Structures and functions for X.509 Certificate Signing Requests (CSR) + * \{ + */ + +/** + * Certificate Signing Request (CSR) structure. + */ +typedef struct mbedtls_x509_csr +{ + mbedtls_x509_buf raw; /**< The raw CSR data (DER). */ + mbedtls_x509_buf cri; /**< The raw CertificateRequestInfo body (DER). */ + + int version; /**< CSR version (1=v1). */ + + mbedtls_x509_buf subject_raw; /**< The raw subject data (DER). */ + mbedtls_x509_name subject; /**< The parsed subject data (named information object). */ + + mbedtls_pk_context pk; /**< Container for the public key context. */ + + mbedtls_x509_buf sig_oid; + mbedtls_x509_buf sig; + mbedtls_md_type_t sig_md; /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */ + mbedtls_pk_type_t sig_pk; /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */ + void *sig_opts; /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */ +} +mbedtls_x509_csr; + +/** + * Container for writing a CSR + */ +typedef struct mbedtls_x509write_csr +{ + mbedtls_pk_context *key; + mbedtls_asn1_named_data *subject; + mbedtls_md_type_t md_alg; + mbedtls_asn1_named_data *extensions; +} +mbedtls_x509write_csr; + +#if defined(MBEDTLS_X509_CSR_PARSE_C) +/** + * \brief Load a Certificate Signing Request (CSR) in DER format + * + * \note CSR attributes (if any) are currently silently ignored. + * + * \param csr CSR context to fill + * \param buf buffer holding the CRL data + * \param buflen size of the buffer + * + * \return 0 if successful, or a specific X509 error code + */ +int mbedtls_x509_csr_parse_der( mbedtls_x509_csr *csr, + const unsigned char *buf, size_t buflen ); + +/** + * \brief Load a Certificate Signing Request (CSR), DER or PEM format + * + * \note See notes for \c mbedtls_x509_csr_parse_der() + * + * \param csr CSR context to fill + * \param buf buffer holding the CRL data + * \param buflen size of the buffer + * (including the terminating null byte for PEM data) + * + * \return 0 if successful, or a specific X509 or PEM error code + */ +int mbedtls_x509_csr_parse( mbedtls_x509_csr *csr, const unsigned char *buf, size_t buflen ); + +#if defined(MBEDTLS_FS_IO) +/** + * \brief Load a Certificate Signing Request (CSR) + * + * \note See notes for \c mbedtls_x509_csr_parse() + * + * \param csr CSR context to fill + * \param path filename to read the CSR from + * + * \return 0 if successful, or a specific X509 or PEM error code + */ +int mbedtls_x509_csr_parse_file( mbedtls_x509_csr *csr, const char *path ); +#endif /* MBEDTLS_FS_IO */ + +/** + * \brief Returns an informational string about the + * CSR. + * + * \param buf Buffer to write to + * \param size Maximum size of buffer + * \param prefix A line prefix + * \param csr The X509 CSR to represent + * + * \return The length of the string written (not including the + * terminated nul byte), or a negative error code. + */ +int mbedtls_x509_csr_info( char *buf, size_t size, const char *prefix, + const mbedtls_x509_csr *csr ); + +/** + * \brief Initialize a CSR + * + * \param csr CSR to initialize + */ +void mbedtls_x509_csr_init( mbedtls_x509_csr *csr ); + +/** + * \brief Unallocate all CSR data + * + * \param csr CSR to free + */ +void mbedtls_x509_csr_free( mbedtls_x509_csr *csr ); +#endif /* MBEDTLS_X509_CSR_PARSE_C */ + +/** \} name Structures and functions for X.509 Certificate Signing Requests (CSR) */ + +#if defined(MBEDTLS_X509_CSR_WRITE_C) +/** + * \brief Initialize a CSR context + * + * \param ctx CSR context to initialize + */ +void mbedtls_x509write_csr_init( mbedtls_x509write_csr *ctx ); + +/** + * \brief Set the subject name for a CSR + * Subject names should contain a comma-separated list + * of OID types and values: + * e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" + * + * \param ctx CSR context to use + * \param subject_name subject name to set + * + * \return 0 if subject name was parsed successfully, or + * a specific error code + */ +int mbedtls_x509write_csr_set_subject_name( mbedtls_x509write_csr *ctx, + const char *subject_name ); + +/** + * \brief Set the key for a CSR (public key will be included, + * private key used to sign the CSR when writing it) + * + * \param ctx CSR context to use + * \param key Asymmetric key to include + */ +void mbedtls_x509write_csr_set_key( mbedtls_x509write_csr *ctx, mbedtls_pk_context *key ); + +/** + * \brief Set the MD algorithm to use for the signature + * (e.g. MBEDTLS_MD_SHA1) + * + * \param ctx CSR context to use + * \param md_alg MD algorithm to use + */ +void mbedtls_x509write_csr_set_md_alg( mbedtls_x509write_csr *ctx, mbedtls_md_type_t md_alg ); + +/** + * \brief Set the Key Usage Extension flags + * (e.g. MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_KEY_CERT_SIGN) + * + * \param ctx CSR context to use + * \param key_usage key usage flags to set + * + * \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + * + * \note The decipherOnly flag from the Key Usage + * extension is represented by bit 8 (i.e. + * 0x8000), which cannot typically be represented + * in an unsigned char. Therefore, the flag + * decipherOnly (i.e. + * #MBEDTLS_X509_KU_DECIPHER_ONLY) cannot be set using this + * function. + */ +int mbedtls_x509write_csr_set_key_usage( mbedtls_x509write_csr *ctx, unsigned char key_usage ); + +/** + * \brief Set the Netscape Cert Type flags + * (e.g. MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT | MBEDTLS_X509_NS_CERT_TYPE_EMAIL) + * + * \param ctx CSR context to use + * \param ns_cert_type Netscape Cert Type flags to set + * + * \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_csr_set_ns_cert_type( mbedtls_x509write_csr *ctx, + unsigned char ns_cert_type ); + +/** + * \brief Generic function to add to or replace an extension in the + * CSR + * + * \param ctx CSR context to use + * \param oid OID of the extension + * \param oid_len length of the OID + * \param val value of the extension OCTET STRING + * \param val_len length of the value data + * + * \return 0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED + */ +int mbedtls_x509write_csr_set_extension( mbedtls_x509write_csr *ctx, + const char *oid, size_t oid_len, + const unsigned char *val, size_t val_len ); + +/** + * \brief Free the contents of a CSR context + * + * \param ctx CSR context to free + */ +void mbedtls_x509write_csr_free( mbedtls_x509write_csr *ctx ); + +/** + * \brief Write a CSR (Certificate Signing Request) to a + * DER structure + * Note: data is written at the end of the buffer! Use the + * return value to determine where you should start + * using the buffer + * + * \param ctx CSR to write away + * \param buf buffer to write to + * \param size size of the buffer + * \param f_rng RNG function (for signature, see note) + * \param p_rng RNG parameter + * + * \return length of data written if successful, or a specific + * error code + * + * \note f_rng may be NULL if RSA is used for signature and the + * signature is made offline (otherwise f_rng is desirable + * for countermeasures against timing attacks). + * ECDSA signatures always require a non-NULL f_rng. + */ +int mbedtls_x509write_csr_der( mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); + +#if defined(MBEDTLS_PEM_WRITE_C) +/** + * \brief Write a CSR (Certificate Signing Request) to a + * PEM string + * + * \param ctx CSR to write away + * \param buf buffer to write to + * \param size size of the buffer + * \param f_rng RNG function (for signature, see note) + * \param p_rng RNG parameter + * + * \return 0 if successful, or a specific error code + * + * \note f_rng may be NULL if RSA is used for signature and the + * signature is made offline (otherwise f_rng is desirable + * for countermeasures against timing attacks). + * ECDSA signatures always require a non-NULL f_rng. + */ +int mbedtls_x509write_csr_pem( mbedtls_x509write_csr *ctx, unsigned char *buf, size_t size, + int (*f_rng)(void *, unsigned char *, size_t), + void *p_rng ); +#endif /* MBEDTLS_PEM_WRITE_C */ +#endif /* MBEDTLS_X509_CSR_WRITE_C */ + +/** \} addtogroup x509_module */ + +#ifdef __cplusplus +} +#endif + +#endif /* mbedtls_x509_csr.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls/xtea.h b/openharmony/armeabi-v7a/include/mbedtls/xtea.h new file mode 100644 index 00000000..4bdc711f --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls/xtea.h @@ -0,0 +1,139 @@ +/** + * \file xtea.h + * + * \brief XTEA block cipher (32-bit) + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef MBEDTLS_XTEA_H +#define MBEDTLS_XTEA_H + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#include +#include + +#define MBEDTLS_XTEA_ENCRYPT 1 +#define MBEDTLS_XTEA_DECRYPT 0 + +/** The data input has an invalid length. */ +#define MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH -0x0028 + +/* MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED is deprecated and should not be used. */ +/** XTEA hardware accelerator failed. */ +#define MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED -0x0029 + +#ifdef __cplusplus +extern "C" { +#endif + +#if !defined(MBEDTLS_XTEA_ALT) +// Regular implementation +// + +/** + * \brief XTEA context structure + */ +typedef struct mbedtls_xtea_context +{ + uint32_t k[4]; /*!< key */ +} +mbedtls_xtea_context; + +#else /* MBEDTLS_XTEA_ALT */ +#include "xtea_alt.h" +#endif /* MBEDTLS_XTEA_ALT */ + +/** + * \brief Initialize XTEA context + * + * \param ctx XTEA context to be initialized + */ +void mbedtls_xtea_init( mbedtls_xtea_context *ctx ); + +/** + * \brief Clear XTEA context + * + * \param ctx XTEA context to be cleared + */ +void mbedtls_xtea_free( mbedtls_xtea_context *ctx ); + +/** + * \brief XTEA key schedule + * + * \param ctx XTEA context to be initialized + * \param key the secret key + */ +void mbedtls_xtea_setup( mbedtls_xtea_context *ctx, const unsigned char key[16] ); + +/** + * \brief XTEA cipher function + * + * \param ctx XTEA context + * \param mode MBEDTLS_XTEA_ENCRYPT or MBEDTLS_XTEA_DECRYPT + * \param input 8-byte input block + * \param output 8-byte output block + * + * \return 0 if successful + */ +int mbedtls_xtea_crypt_ecb( mbedtls_xtea_context *ctx, + int mode, + const unsigned char input[8], + unsigned char output[8] ); + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +/** + * \brief XTEA CBC cipher function + * + * \param ctx XTEA context + * \param mode MBEDTLS_XTEA_ENCRYPT or MBEDTLS_XTEA_DECRYPT + * \param length the length of input, multiple of 8 + * \param iv initialization vector for CBC mode + * \param input input block + * \param output output block + * + * \return 0 if successful, + * MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH if the length % 8 != 0 + */ +int mbedtls_xtea_crypt_cbc( mbedtls_xtea_context *ctx, + int mode, + size_t length, + unsigned char iv[8], + const unsigned char *input, + unsigned char *output); +#endif /* MBEDTLS_CIPHER_MODE_CBC */ + +#if defined(MBEDTLS_SELF_TEST) + +/** + * \brief Checkup routine + * + * \return 0 if successful, or 1 if the test failed + */ +int mbedtls_xtea_self_test( int verbose ); + +#endif /* MBEDTLS_SELF_TEST */ + +#ifdef __cplusplus +} +#endif + +#endif /* xtea.h */ diff --git a/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl3.h b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl3.h new file mode 100644 index 00000000..007b392f --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl3.h @@ -0,0 +1,44 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL3_H_ +#define _SSL3_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +# define SSL3_AD_CLOSE_NOTIFY 0 +# define SSL3_AD_UNEXPECTED_MESSAGE 10/* fatal */ +# define SSL3_AD_BAD_RECORD_MAC 20/* fatal */ +# define SSL3_AD_DECOMPRESSION_FAILURE 30/* fatal */ +# define SSL3_AD_HANDSHAKE_FAILURE 40/* fatal */ +# define SSL3_AD_NO_CERTIFICATE 41 +# define SSL3_AD_BAD_CERTIFICATE 42 +# define SSL3_AD_UNSUPPORTED_CERTIFICATE 43 +# define SSL3_AD_CERTIFICATE_REVOKED 44 +# define SSL3_AD_CERTIFICATE_EXPIRED 45 +# define SSL3_AD_CERTIFICATE_UNKNOWN 46 +# define SSL3_AD_ILLEGAL_PARAMETER 47/* fatal */ + +# define SSL3_AL_WARNING 1 +# define SSL3_AL_FATAL 2 + +#define SSL3_VERSION 0x0300 + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_cert.h b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_cert.h new file mode 100644 index 00000000..86cf31ad --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_cert.h @@ -0,0 +1,55 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_CERT_H_ +#define _SSL_CERT_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include "ssl_types.h" + +/** + * @brief create a certification object include private key object according to input certification + * + * @param ic - input certification point + * + * @return certification object point + */ +CERT *__ssl_cert_new(CERT *ic); + +/** + * @brief create a certification object include private key object + * + * @param none + * + * @return certification object point + */ +CERT* ssl_cert_new(void); + +/** + * @brief free a certification object + * + * @param cert - certification object point + * + * @return none + */ +void ssl_cert_free(CERT *cert); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_code.h b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_code.h new file mode 100644 index 00000000..80fdbb20 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_code.h @@ -0,0 +1,124 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_CODE_H_ +#define _SSL_CODE_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include "ssl3.h" +#include "tls1.h" +#include "x509_vfy.h" + +/* Used in SSL_set_shutdown()/SSL_get_shutdown(); */ +# define SSL_SENT_SHUTDOWN 1 +# define SSL_RECEIVED_SHUTDOWN 2 + +# define SSL_VERIFY_NONE 0x00 +# define SSL_VERIFY_PEER 0x01 +# define SSL_VERIFY_FAIL_IF_NO_PEER_CERT 0x02 +# define SSL_VERIFY_CLIENT_ONCE 0x04 + +/* + * The following 3 states are kept in ssl->rlayer.rstate when reads fail, you + * should not need these + */ +# define SSL_ST_READ_HEADER 0xF0 +# define SSL_ST_READ_BODY 0xF1 +# define SSL_ST_READ_DONE 0xF2 + +# define SSL_NOTHING 1 +# define SSL_WRITING 2 +# define SSL_READING 3 +# define SSL_X509_LOOKUP 4 +# define SSL_ASYNC_PAUSED 5 +# define SSL_ASYNC_NO_JOBS 6 + + +# define SSL_ERROR_NONE 0 +# define SSL_ERROR_SSL 1 +# define SSL_ERROR_WANT_READ 2 +# define SSL_ERROR_WANT_WRITE 3 +# define SSL_ERROR_WANT_X509_LOOKUP 4 +# define SSL_ERROR_SYSCALL 5/* look at error stack/return value/errno */ +# define SSL_ERROR_ZERO_RETURN 6 +# define SSL_ERROR_WANT_CONNECT 7 +# define SSL_ERROR_WANT_ACCEPT 8 +# define SSL_ERROR_WANT_ASYNC 9 +# define SSL_ERROR_WANT_ASYNC_JOB 10 + +/* Message flow states */ +typedef enum { + /* No handshake in progress */ + MSG_FLOW_UNINITED, + /* A permanent error with this connection */ + MSG_FLOW_ERROR, + /* We are about to renegotiate */ + MSG_FLOW_RENEGOTIATE, + /* We are reading messages */ + MSG_FLOW_READING, + /* We are writing messages */ + MSG_FLOW_WRITING, + /* Handshake has finished */ + MSG_FLOW_FINISHED +} MSG_FLOW_STATE; + +/* SSL subsystem states */ +typedef enum { + TLS_ST_BEFORE, + TLS_ST_OK, + DTLS_ST_CR_HELLO_VERIFY_REQUEST, + TLS_ST_CR_SRVR_HELLO, + TLS_ST_CR_CERT, + TLS_ST_CR_CERT_STATUS, + TLS_ST_CR_KEY_EXCH, + TLS_ST_CR_CERT_REQ, + TLS_ST_CR_SRVR_DONE, + TLS_ST_CR_SESSION_TICKET, + TLS_ST_CR_CHANGE, + TLS_ST_CR_FINISHED, + TLS_ST_CW_CLNT_HELLO, + TLS_ST_CW_CERT, + TLS_ST_CW_KEY_EXCH, + TLS_ST_CW_CERT_VRFY, + TLS_ST_CW_CHANGE, + TLS_ST_CW_NEXT_PROTO, + TLS_ST_CW_FINISHED, + TLS_ST_SW_HELLO_REQ, + TLS_ST_SR_CLNT_HELLO, + DTLS_ST_SW_HELLO_VERIFY_REQUEST, + TLS_ST_SW_SRVR_HELLO, + TLS_ST_SW_CERT, + TLS_ST_SW_KEY_EXCH, + TLS_ST_SW_CERT_REQ, + TLS_ST_SW_SRVR_DONE, + TLS_ST_SR_CERT, + TLS_ST_SR_KEY_EXCH, + TLS_ST_SR_CERT_VRFY, + TLS_ST_SR_NEXT_PROTO, + TLS_ST_SR_CHANGE, + TLS_ST_SR_FINISHED, + TLS_ST_SW_SESSION_TICKET, + TLS_ST_SW_CERT_STATUS, + TLS_ST_SW_CHANGE, + TLS_ST_SW_FINISHED +} OSSL_HANDSHAKE_STATE; + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_dbg.h b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_dbg.h new file mode 100644 index 00000000..ad32cb92 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_dbg.h @@ -0,0 +1,190 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_DEBUG_H_ +#define _SSL_DEBUG_H_ + +#include "platform/ssl_port.h" + +#ifdef __cplusplus + extern "C" { +#endif + +#ifdef CONFIG_OPENSSL_DEBUG_LEVEL + #define SSL_DEBUG_LEVEL CONFIG_OPENSSL_DEBUG_LEVEL +#else + #define SSL_DEBUG_LEVEL 0 +#endif + +#define SSL_DEBUG_ON (SSL_DEBUG_LEVEL + 1) +#define SSL_DEBUG_OFF (SSL_DEBUG_LEVEL - 1) + +#ifdef CONFIG_OPENSSL_DEBUG + #ifndef SSL_DEBUG_LOG + #error "SSL_DEBUG_LOG is not defined" + #endif + + #ifndef SSL_DEBUG_FL + #define SSL_DEBUG_FL "\n" + #endif + + #define SSL_SHOW_LOCATION() \ + SSL_DEBUG_LOG("SSL assert : %s %d\n", \ + __FILE__, __LINE__) + + #define SSL_DEBUG(level, fmt, ...) \ + { \ + if (level > SSL_DEBUG_LEVEL) { \ + SSL_DEBUG_LOG(fmt SSL_DEBUG_FL, ##__VA_ARGS__); \ + } \ + } +#else /* CONFIG_OPENSSL_DEBUG */ + #define SSL_SHOW_LOCATION() + + #define SSL_DEBUG(level, fmt, ...) +#endif /* CONFIG_OPENSSL_DEBUG */ + +/** + * OpenSSL assert function + * + * if select "CONFIG_OPENSSL_ASSERT_DEBUG", SSL_ASSERT* will show error file name and line + * if select "CONFIG_OPENSSL_ASSERT_EXIT", SSL_ASSERT* will just return error code. + * if select "CONFIG_OPENSSL_ASSERT_DEBUG_EXIT" SSL_ASSERT* will show error file name and line, + * then return error code. + * if select "CONFIG_OPENSSL_ASSERT_DEBUG_BLOCK", SSL_ASSERT* will show error file name and line, + * then block here with "while (1)" + * + * SSL_ASSERT1 may will return "-1", so function's return argument is integer. + * SSL_ASSERT2 may will return "NULL", so function's return argument is a point. + * SSL_ASSERT2 may will return nothing, so function's return argument is "void". + */ +#if defined(CONFIG_OPENSSL_ASSERT_DEBUG) + #define SSL_ASSERT1(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + } \ + } + + #define SSL_ASSERT2(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + } \ + } + + #define SSL_ASSERT3(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + } \ + } +#elif defined(CONFIG_OPENSSL_ASSERT_EXIT) + #define SSL_ASSERT1(s) \ + { \ + if (!(s)) { \ + return -1; \ + } \ + } + + #define SSL_ASSERT2(s) \ + { \ + if (!(s)) { \ + return NULL; \ + } \ + } + + #define SSL_ASSERT3(s) \ + { \ + if (!(s)) { \ + return ; \ + } \ + } +#elif defined(CONFIG_OPENSSL_ASSERT_DEBUG_EXIT) + #define SSL_ASSERT1(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + return -1; \ + } \ + } + + #define SSL_ASSERT2(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + return NULL; \ + } \ + } + + #define SSL_ASSERT3(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + return ; \ + } \ + } +#elif defined(CONFIG_OPENSSL_ASSERT_DEBUG_BLOCK) + #define SSL_ASSERT1(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + while (1); \ + } \ + } + + #define SSL_ASSERT2(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + while (1); \ + } \ + } + + #define SSL_ASSERT3(s) \ + { \ + if (!(s)) { \ + SSL_SHOW_LOCATION(); \ + while (1); \ + } \ + } +#else + #define SSL_ASSERT1(s) + #define SSL_ASSERT2(s) + #define SSL_ASSERT3(s) +#endif + +#define SSL_PLATFORM_DEBUG_LEVEL SSL_DEBUG_OFF +#define SSL_PLATFORM_ERROR_LEVEL SSL_DEBUG_ON + +#define SSL_CERT_DEBUG_LEVEL SSL_DEBUG_OFF +#define SSL_CERT_ERROR_LEVEL SSL_DEBUG_ON + +#define SSL_PKEY_DEBUG_LEVEL SSL_DEBUG_OFF +#define SSL_PKEY_ERROR_LEVEL SSL_DEBUG_ON + +#define SSL_X509_DEBUG_LEVEL SSL_DEBUG_OFF +#define SSL_X509_ERROR_LEVEL SSL_DEBUG_ON + +#define SSL_LIB_DEBUG_LEVEL SSL_DEBUG_OFF +#define SSL_LIB_ERROR_LEVEL SSL_DEBUG_ON + +#define SSL_STACK_DEBUG_LEVEL SSL_DEBUG_OFF +#define SSL_STACK_ERROR_LEVEL SSL_DEBUG_ON + +#ifdef __cplusplus + } +#endif + +#endif diff --git a/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_lib.h b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_lib.h new file mode 100644 index 00000000..42b2de75 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_lib.h @@ -0,0 +1,30 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_LIB_H_ +#define _SSL_LIB_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include "ssl_types.h" + + void _ssl_set_alpn_list(const SSL *ssl); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_methods.h b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_methods.h new file mode 100644 index 00000000..cd2f8c05 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_methods.h @@ -0,0 +1,121 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_METHODS_H_ +#define _SSL_METHODS_H_ + +#include "ssl_types.h" + +#ifdef __cplusplus + extern "C" { +#endif + +/** + * TLS method function implement + */ +#define IMPLEMENT_TLS_METHOD_FUNC(func_name, \ + new, free, \ + handshake, shutdown, clear, \ + read, send, pending, \ + set_fd, get_fd, \ + set_bufflen, \ + get_verify_result, \ + get_state) \ + static const SSL_METHOD_FUNC func_name LOCAL_ATRR = { \ + new, \ + free, \ + handshake, \ + shutdown, \ + clear, \ + read, \ + send, \ + pending, \ + set_fd, \ + get_fd, \ + set_bufflen, \ + get_verify_result, \ + get_state \ + }; + +#define IMPLEMENT_TLS_METHOD(ver, mode, fun, func_name) \ + const SSL_METHOD* func_name(void) { \ + static const SSL_METHOD func_name##_data LOCAL_ATRR = { \ + ver, \ + mode, \ + &(fun), \ + }; \ + return &func_name##_data; \ + } + +#define IMPLEMENT_SSL_METHOD(ver, mode, fun, func_name) \ + const SSL_METHOD* func_name(void) { \ + static const SSL_METHOD func_name##_data LOCAL_ATRR = { \ + ver, \ + mode, \ + &(fun), \ + }; \ + return &func_name##_data; \ + } + +#define IMPLEMENT_X509_METHOD(func_name, \ + new, \ + free, \ + load, \ + show_info) \ + const X509_METHOD* func_name(void) { \ + static const X509_METHOD func_name##_data LOCAL_ATRR = { \ + new, \ + free, \ + load, \ + show_info \ + }; \ + return &func_name##_data; \ + } + +#define IMPLEMENT_PKEY_METHOD(func_name, \ + new, \ + free, \ + load) \ + const PKEY_METHOD* func_name(void) { \ + static const PKEY_METHOD func_name##_data LOCAL_ATRR = { \ + new, \ + free, \ + load \ + }; \ + return &func_name##_data; \ + } + +/** + * @brief get X509 object method + * + * @param none + * + * @return X509 object method point + */ +const X509_METHOD* X509_method(void); + +/** + * @brief get private key object method + * + * @param none + * + * @return private key object method point + */ +const PKEY_METHOD* EVP_PKEY_method(void); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_pkey.h b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_pkey.h new file mode 100644 index 00000000..e790fcc9 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_pkey.h @@ -0,0 +1,86 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_PKEY_H_ +#define _SSL_PKEY_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include "ssl_types.h" + +/** + * @brief create a private key object according to input private key + * + * @param ipk - input private key point + * + * @return new private key object point + */ +EVP_PKEY* __EVP_PKEY_new(EVP_PKEY *ipk); + +/** + * @brief create a private key object + * + * @param none + * + * @return private key object point + */ +EVP_PKEY* EVP_PKEY_new(void); + +/** + * @brief load a character key context into system context. If '*a' is pointed to the + * private key, then load key into it. Or create a new private key object + * + * @param type - private key type + * @param a - a point pointed to a private key point + * @param pp - a point pointed to the key context memory point + * @param length - key bytes + * + * @return private key object point + */ +EVP_PKEY* d2i_PrivateKey(int type, + EVP_PKEY **a, + const unsigned char **pp, + long length); + +/** + * @brief free a private key object + * + * @param pkey - private key object point + * + * @return none + */ +void EVP_PKEY_free(EVP_PKEY *x); + +/** + * @brief load private key into the SSL + * + * @param type - private key type + * @param ssl - SSL point + * @param len - data bytes + * @param d - data point + * + * @return result + * 0 : failed + * 1 : OK + */ + int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d, long len); + + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_stack.h b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_stack.h new file mode 100644 index 00000000..7a7051a0 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_stack.h @@ -0,0 +1,52 @@ +#ifndef _SSL_STACK_H_ +#define _SSL_STACK_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include "ssl_types.h" + +#define STACK_OF(type) struct stack_st_##type + +#define SKM_DEFINE_STACK_OF(t1, t2, t3) \ + STACK_OF(t1); \ + static ossl_inline STACK_OF(t1) *sk_##t1##_new_null(void) \ + { \ + return (STACK_OF(t1) *)OPENSSL_sk_new_null(); \ + } \ + +#define DEFINE_STACK_OF(t) SKM_DEFINE_STACK_OF(t, t, t) + +/** + * @brief create a openssl stack object + * + * @param c - stack function + * + * @return openssl stack object point + */ +OPENSSL_STACK* OPENSSL_sk_new(OPENSSL_sk_compfunc c); + +/** + * @brief create a NULL function openssl stack object + * + * @param none + * + * @return openssl stack object point + */ +OPENSSL_STACK *OPENSSL_sk_new_null(void); + +/** + * @brief free openssl stack object + * + * @param openssl stack object point + * + * @return none + */ +void OPENSSL_sk_free(OPENSSL_STACK *stack); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_types.h b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_types.h new file mode 100644 index 00000000..2ca438c4 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_types.h @@ -0,0 +1,297 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_TYPES_H_ +#define _SSL_TYPES_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include +#if defined(LWS_WITH_ESP32) +#undef MBEDTLS_CONFIG_FILE +#define MBEDTLS_CONFIG_FILE +#endif + +#include "ssl_code.h" + +typedef void SSL_CIPHER; + +typedef void X509_STORE_CTX; +typedef void X509_STORE; + +typedef void RSA; + +typedef void STACK; +typedef void BIO; + +#define ossl_inline inline + +#define SSL_METHOD_CALL(f, s, ...) s->method->func->ssl_##f(s, ##__VA_ARGS__) +#define X509_METHOD_CALL(f, x, ...) x->method->x509_##f(x, ##__VA_ARGS__) +#define EVP_PKEY_METHOD_CALL(f, k, ...) k->method->pkey_##f(k, ##__VA_ARGS__) + +typedef int (*OPENSSL_sk_compfunc)(const void *, const void *); + +struct stack_st; +typedef struct stack_st OPENSSL_STACK; + +struct ssl_method_st; +typedef struct ssl_method_st SSL_METHOD; + +struct ssl_method_func_st; +typedef struct ssl_method_func_st SSL_METHOD_FUNC; + +struct record_layer_st; +typedef struct record_layer_st RECORD_LAYER; + +struct ossl_statem_st; +typedef struct ossl_statem_st OSSL_STATEM; + +struct ssl_session_st; +typedef struct ssl_session_st SSL_SESSION; + +struct ssl_ctx_st; +typedef struct ssl_ctx_st SSL_CTX; + +struct ssl_st; +typedef struct ssl_st SSL; + +struct cert_st; +typedef struct cert_st CERT; + +struct x509_st; +typedef struct x509_st X509; + +struct X509_VERIFY_PARAM_st; +typedef struct X509_VERIFY_PARAM_st X509_VERIFY_PARAM; + +struct evp_pkey_st; +typedef struct evp_pkey_st EVP_PKEY; + +struct x509_method_st; +typedef struct x509_method_st X509_METHOD; + +struct pkey_method_st; +typedef struct pkey_method_st PKEY_METHOD; + +struct stack_st { + + char **data; + + int num_alloc; + + OPENSSL_sk_compfunc c; +}; + +struct evp_pkey_st { + + void *pkey_pm; + + const PKEY_METHOD *method; +}; + +struct x509_st { + + /* X509 certification platform private point */ + void *x509_pm; + + const X509_METHOD *method; +}; + +struct cert_st { + + int sec_level; + + X509 *x509; + + EVP_PKEY *pkey; + +}; + +struct ossl_statem_st { + + MSG_FLOW_STATE state; + + int hand_state; +}; + +struct record_layer_st { + + int rstate; + + int read_ahead; +}; + +struct ssl_session_st { + + long timeout; + + long time; + + X509 *peer; +}; + +struct X509_VERIFY_PARAM_st { + + int depth; + +}; + +typedef int (*next_proto_cb)(SSL *ssl, unsigned char **out, + unsigned char *outlen, const unsigned char *in, + unsigned int inlen, void *arg); + +struct ssl_ctx_st +{ + int version; + + int references; + + unsigned long options; + + const SSL_METHOD *method; + + CERT *cert; + + X509 *client_CA; + + const char **alpn_protos; + + next_proto_cb alpn_cb; + + int verify_mode; + + int (*default_verify_callback) (int ok, X509_STORE_CTX *ctx); + + long session_timeout; + + int read_ahead; + + int read_buffer_len; + + X509_VERIFY_PARAM param; +}; + +struct ssl_st +{ + /* protocol version(one of SSL3.0, TLS1.0, etc.) */ + int version; + + unsigned long options; + + /* shut things down(0x01 : sent, 0x02 : received) */ + int shutdown; + + CERT *cert; + + X509 *client_CA; + + SSL_CTX *ctx; + + const SSL_METHOD *method; + + RECORD_LAYER rlayer; + + /* where we are */ + OSSL_STATEM statem; + + SSL_SESSION *session; + + int verify_mode; + + int (*verify_callback) (int ok, X509_STORE_CTX *ctx); + + int rwstate; + int interrupted_remaining_write; + + long verify_result; + + X509_VERIFY_PARAM param; + + int err; + + void (*info_callback) (const SSL *ssl, int type, int val); + + /* SSL low-level system arch point */ + void *ssl_pm; +}; + +struct ssl_method_st { + /* protocol version(one of SSL3.0, TLS1.0, etc.) */ + int version; + + /* SSL mode(client(0) , server(1), not known(-1)) */ + int endpoint; + + const SSL_METHOD_FUNC *func; +}; + +struct ssl_method_func_st { + + int (*ssl_new)(SSL *ssl); + + void (*ssl_free)(SSL *ssl); + + int (*ssl_handshake)(SSL *ssl); + + int (*ssl_shutdown)(SSL *ssl); + + int (*ssl_clear)(SSL *ssl); + + int (*ssl_read)(SSL *ssl, void *buffer, int len); + + int (*ssl_send)(SSL *ssl, const void *buffer, int len); + + int (*ssl_pending)(const SSL *ssl); + + void (*ssl_set_fd)(SSL *ssl, int fd, int mode); + + int (*ssl_get_fd)(const SSL *ssl, int mode); + + void (*ssl_set_bufflen)(SSL *ssl, int len); + + long (*ssl_get_verify_result)(const SSL *ssl); + + OSSL_HANDSHAKE_STATE (*ssl_get_state)(const SSL *ssl); +}; + +struct x509_method_st { + + int (*x509_new)(X509 *x, X509 *m_x); + + void (*x509_free)(X509 *x); + + int (*x509_load)(X509 *x, const unsigned char *buf, int len); + + int (*x509_show_info)(X509 *x); +}; + +struct pkey_method_st { + + int (*pkey_new)(EVP_PKEY *pkey, EVP_PKEY *m_pkey); + + void (*pkey_free)(EVP_PKEY *pkey); + + int (*pkey_load)(EVP_PKEY *pkey, const unsigned char *buf, int len); +}; + +#define OPENSSL_NPN_NEGOTIATED 1 + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_x509.h b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_x509.h new file mode 100644 index 00000000..7594d064 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/ssl_x509.h @@ -0,0 +1,110 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_X509_H_ +#define _SSL_X509_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include "ssl_types.h" +#include "ssl_stack.h" + +DEFINE_STACK_OF(X509_NAME) + +/** + * @brief create a X509 certification object according to input X509 certification + * + * @param ix - input X509 certification point + * + * @return new X509 certification object point + */ +X509* __X509_new(X509 *ix); + +/** + * @brief create a X509 certification object + * + * @param none + * + * @return X509 certification object point + */ +X509* X509_new(void); + +/** + * @brief load a character certification context into system context. If '*cert' is pointed to the + * certification, then load certification into it. Or create a new X509 certification object + * + * @param cert - a point pointed to X509 certification + * @param buffer - a point pointed to the certification context memory point + * @param length - certification bytes + * + * @return X509 certification object point + */ +X509* d2i_X509(X509 **cert, const unsigned char *buffer, long len); + +/** + * @brief free a X509 certification object + * + * @param x - X509 certification object point + * + * @return none + */ +void X509_free(X509 *x); + +/** + * @brief set SSL context client CA certification + * + * @param ctx - SSL context point + * @param x - X509 certification point + * + * @return result + * 0 : failed + * 1 : OK + */ +int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x); + +/** + * @brief add CA client certification into the SSL + * + * @param ssl - SSL point + * @param x - X509 certification point + * + * @return result + * 0 : failed + * 1 : OK + */ +int SSL_add_client_CA(SSL *ssl, X509 *x); + +/** + * @brief load certification into the SSL + * + * @param ssl - SSL point + * @param len - data bytes + * @param d - data point + * + * @return result + * 0 : failed + * 1 : OK + * + */ +int SSL_use_certificate_ASN1(SSL *ssl, int len, const unsigned char *d); + +const char *X509_verify_cert_error_string(long n); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/tls1.h b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/tls1.h new file mode 100644 index 00000000..7af1b015 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/tls1.h @@ -0,0 +1,58 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _TLS1_H_ +#define _TLS1_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +# define TLS1_AD_DECRYPTION_FAILED 21 +# define TLS1_AD_RECORD_OVERFLOW 22 +# define TLS1_AD_UNKNOWN_CA 48/* fatal */ +# define TLS1_AD_ACCESS_DENIED 49/* fatal */ +# define TLS1_AD_DECODE_ERROR 50/* fatal */ +# define TLS1_AD_DECRYPT_ERROR 51 +# define TLS1_AD_EXPORT_RESTRICTION 60/* fatal */ +# define TLS1_AD_PROTOCOL_VERSION 70/* fatal */ +# define TLS1_AD_INSUFFICIENT_SECURITY 71/* fatal */ +# define TLS1_AD_INTERNAL_ERROR 80/* fatal */ +# define TLS1_AD_INAPPROPRIATE_FALLBACK 86/* fatal */ +# define TLS1_AD_USER_CANCELLED 90 +# define TLS1_AD_NO_RENEGOTIATION 100 +/* codes 110-114 are from RFC3546 */ +# define TLS1_AD_UNSUPPORTED_EXTENSION 110 +# define TLS1_AD_CERTIFICATE_UNOBTAINABLE 111 +# define TLS1_AD_UNRECOGNIZED_NAME 112 +# define TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE 113 +# define TLS1_AD_BAD_CERTIFICATE_HASH_VALUE 114 +# define TLS1_AD_UNKNOWN_PSK_IDENTITY 115/* fatal */ +# define TLS1_AD_NO_APPLICATION_PROTOCOL 120 /* fatal */ + +/* Special value for method supporting multiple versions */ +#define TLS_ANY_VERSION 0x10000 + +#define TLS1_VERSION 0x0301 +#define TLS1_1_VERSION 0x0302 +#define TLS1_2_VERSION 0x0303 + +#define SSL_TLSEXT_ERR_OK 0 +#define SSL_TLSEXT_ERR_NOACK 3 + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/x509_vfy.h b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/x509_vfy.h new file mode 100644 index 00000000..e57e42bd --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls_wrapper/internal/x509_vfy.h @@ -0,0 +1,116 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _X509_VFY_H_ +#define _X509_VFY_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#define X509_V_OK 0 +#define X509_V_ERR_UNSPECIFIED 1 +#define X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT 2 +#define X509_V_ERR_UNABLE_TO_GET_CRL 3 +#define X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE 4 +#define X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE 5 +#define X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY 6 +#define X509_V_ERR_CERT_SIGNATURE_FAILURE 7 +#define X509_V_ERR_CRL_SIGNATURE_FAILURE 8 +#define X509_V_ERR_CERT_NOT_YET_VALID 9 +#define X509_V_ERR_CERT_HAS_EXPIRED 10 +#define X509_V_ERR_CRL_NOT_YET_VALID 11 +#define X509_V_ERR_CRL_HAS_EXPIRED 12 +#define X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD 13 +#define X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD 14 +#define X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD 15 +#define X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD 16 +#define X509_V_ERR_OUT_OF_MEM 17 +#define X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT 18 +#define X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN 19 +#define X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY 20 +#define X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE 21 +#define X509_V_ERR_CERT_CHAIN_TOO_LONG 22 +#define X509_V_ERR_CERT_REVOKED 23 +#define X509_V_ERR_INVALID_CA 24 +#define X509_V_ERR_PATH_LENGTH_EXCEEDED 25 +#define X509_V_ERR_INVALID_PURPOSE 26 +#define X509_V_ERR_CERT_UNTRUSTED 27 +#define X509_V_ERR_CERT_REJECTED 28 +/* These are 'informational' when looking for issuer cert */ +#define X509_V_ERR_SUBJECT_ISSUER_MISMATCH 29 +#define X509_V_ERR_AKID_SKID_MISMATCH 30 +#define X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH 31 +#define X509_V_ERR_KEYUSAGE_NO_CERTSIGN 32 +#define X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER 33 +#define X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION 34 +#define X509_V_ERR_KEYUSAGE_NO_CRL_SIGN 35 +#define X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION 36 +#define X509_V_ERR_INVALID_NON_CA 37 +#define X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED 38 +#define X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE 39 +#define X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED 40 +#define X509_V_ERR_INVALID_EXTENSION 41 +#define X509_V_ERR_INVALID_POLICY_EXTENSION 42 +#define X509_V_ERR_NO_EXPLICIT_POLICY 43 +#define X509_V_ERR_DIFFERENT_CRL_SCOPE 44 +#define X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE 45 +#define X509_V_ERR_UNNESTED_RESOURCE 46 +#define X509_V_ERR_PERMITTED_VIOLATION 47 +#define X509_V_ERR_EXCLUDED_VIOLATION 48 +#define X509_V_ERR_SUBTREE_MINMAX 49 +/* The application is not happy */ +#define X509_V_ERR_APPLICATION_VERIFICATION 50 +#define X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE 51 +#define X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX 52 +#define X509_V_ERR_UNSUPPORTED_NAME_SYNTAX 53 +#define X509_V_ERR_CRL_PATH_VALIDATION_ERROR 54 +/* Another issuer check debug option */ +#define X509_V_ERR_PATH_LOOP 55 +/* Suite B mode algorithm violation */ +#define X509_V_ERR_SUITE_B_INVALID_VERSION 56 +#define X509_V_ERR_SUITE_B_INVALID_ALGORITHM 57 +#define X509_V_ERR_SUITE_B_INVALID_CURVE 58 +#define X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM 59 +#define X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED 60 +#define X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256 61 +/* Host, email and IP check errors */ +#define X509_V_ERR_HOSTNAME_MISMATCH 62 +#define X509_V_ERR_EMAIL_MISMATCH 63 +#define X509_V_ERR_IP_ADDRESS_MISMATCH 64 +/* DANE TLSA errors */ +#define X509_V_ERR_DANE_NO_MATCH 65 +/* security level errors */ +#define X509_V_ERR_EE_KEY_TOO_SMALL 66 +#define X509_V_ERR_CA_KEY_TOO_SMALL 67 +#define X509_V_ERR_CA_MD_TOO_WEAK 68 +/* Caller error */ +#define X509_V_ERR_INVALID_CALL 69 +/* Issuer lookup error */ +#define X509_V_ERR_STORE_LOOKUP 70 +/* Certificate transparency */ +#define X509_V_ERR_NO_VALID_SCTS 71 + +#define X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION 72 + +typedef void X509_STORE_CTX; +int X509_STORE_CTX_get_error(X509_STORE_CTX *ctx); +int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx); + + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/armeabi-v7a/include/mbedtls_wrapper/openssl/ssl.h b/openharmony/armeabi-v7a/include/mbedtls_wrapper/openssl/ssl.h new file mode 100644 index 00000000..bea50b75 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls_wrapper/openssl/ssl.h @@ -0,0 +1,1816 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_H_ +#define _SSL_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include +#include "internal/ssl_x509.h" +#include "internal/ssl_pkey.h" + +/* +{ +*/ + +#define SSL_CB_ALERT 0x4000 + +#define X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT (1 << 0) +#define X509_CHECK_FLAG_NO_WILDCARDS (1 << 1) +#define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS (1 << 2) +#define X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS (1 << 3) +#define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS (1 << 4) + +/** + * @brief create a SSL context + * + * @param method - the SSL context method point + * + * @return the context point + */ +SSL_CTX* SSL_CTX_new(const SSL_METHOD *method); + +/** + * @brief free a SSL context + * + * @param method - the SSL context point + * + * @return none + */ +void SSL_CTX_free(SSL_CTX *ctx); + +/** + * @brief create a SSL + * + * @param ctx - the SSL context point + * + * @return the SSL point + */ +SSL* SSL_new(SSL_CTX *ctx); + +/** + * @brief free the SSL + * + * @param ssl - the SSL point + * + * @return none + */ +void SSL_free(SSL *ssl); + +/** + * @brief connect to the remote SSL server + * + * @param ssl - the SSL point + * + * @return result + * 1 : OK + * -1 : failed + */ +int SSL_connect(SSL *ssl); + +/** + * @brief accept the remote connection + * + * @param ssl - the SSL point + * + * @return result + * 1 : OK + * -1 : failed + */ +int SSL_accept(SSL *ssl); + +/** + * @brief read data from to remote + * + * @param ssl - the SSL point which has been connected + * @param buffer - the received data buffer point + * @param len - the received data length + * + * @return result + * > 0 : OK, and return received data bytes + * = 0 : connection is closed + * < 0 : an error catch + */ +int SSL_read(SSL *ssl, void *buffer, int len); + +/** + * @brief send the data to remote + * + * @param ssl - the SSL point which has been connected + * @param buffer - the send data buffer point + * @param len - the send data length + * + * @return result + * > 0 : OK, and return sent data bytes + * = 0 : connection is closed + * < 0 : an error catch + */ +int SSL_write(SSL *ssl, const void *buffer, int len); + +/** + * @brief get the verifying result of the SSL certification + * + * @param ssl - the SSL point + * + * @return the result of verifying + */ +long SSL_get_verify_result(const SSL *ssl); + +/** + * @brief shutdown the connection + * + * @param ssl - the SSL point + * + * @return result + * 1 : OK + * 0 : shutdown is not finished + * -1 : an error catch + */ +int SSL_shutdown(SSL *ssl); + +/** + * @brief bind the socket file description into the SSL + * + * @param ssl - the SSL point + * @param fd - socket handle + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_set_fd(SSL *ssl, int fd); + +/** + * @brief These functions load the private key into the SSL_CTX or SSL object + * + * @param ctx - the SSL context point + * @param pkey - private key object point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey); + +/** + * @brief These functions load the certification into the SSL_CTX or SSL object + * + * @param ctx - the SSL context point + * @param pkey - certification object point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x); + +/** + * @brief create the target SSL context client method + * + * @param none + * + * @return the SSLV2.3 version SSL context client method + */ +const SSL_METHOD* SSLv23_client_method(void); + +/** + * @brief create the target SSL context client method + * + * @param none + * + * @return the TLSV1.0 version SSL context client method + */ +const SSL_METHOD* TLSv1_client_method(void); + +/** + * @brief create the target SSL context client method + * + * @param none + * + * @return the SSLV1.0 version SSL context client method + */ +const SSL_METHOD* SSLv3_client_method(void); + +/** + * @brief create the target SSL context client method + * + * @param none + * + * @return the TLSV1.1 version SSL context client method + */ +const SSL_METHOD* TLSv1_1_client_method(void); + +/** + * @brief create the target SSL context client method + * + * @param none + * + * @return the TLSV1.2 version SSL context client method + */ +const SSL_METHOD* TLSv1_2_client_method(void); + +/** + * @brief create the target SSL context server method + * + * @param none + * + * @return the TLS any version SSL context client method + */ +const SSL_METHOD* TLS_client_method(void); + +/** + * @brief create the target SSL context server method + * + * @param none + * + * @return the SSLV2.3 version SSL context server method + */ +const SSL_METHOD* SSLv23_server_method(void); + +/** + * @brief create the target SSL context server method + * + * @param none + * + * @return the TLSV1.1 version SSL context server method + */ +const SSL_METHOD* TLSv1_1_server_method(void); + +/** + * @brief create the target SSL context server method + * + * @param none + * + * @return the TLSV1.2 version SSL context server method + */ +const SSL_METHOD* TLSv1_2_server_method(void); + +/** + * @brief create the target SSL context server method + * + * @param none + * + * @return the TLSV1.0 version SSL context server method + */ +const SSL_METHOD* TLSv1_server_method(void); + +/** + * @brief create the target SSL context server method + * + * @param none + * + * @return the SSLV3.0 version SSL context server method + */ +const SSL_METHOD* SSLv3_server_method(void); + +/** + * @brief create the target SSL context server method + * + * @param none + * + * @return the TLS any version SSL context server method + */ +const SSL_METHOD* TLS_server_method(void); + + +/** + * @brief set the SSL context ALPN select callback function + * + * @param ctx - SSL context point + * @param cb - ALPN select callback function + * @param arg - ALPN select callback function entry private data point + * + * @return none + */ +void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx, + int (*cb) (SSL *ssl, + const unsigned char **out, + unsigned char *outlen, + const unsigned char *in, + unsigned int inlen, + void *arg), + void *arg); + + +/** + * @brief set the SSL context ALPN select protocol + * + * @param ctx - SSL context point + * @param protos - ALPN protocol name + * @param protos_len - ALPN protocol name bytes + * + * @return result + * 0 : OK + * 1 : failed + */ +int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos, unsigned int protos_len); + +/** + * @brief set the SSL context next ALPN select callback function + * + * @param ctx - SSL context point + * @param cb - ALPN select callback function + * @param arg - ALPN select callback function entry private data point + * + * @return none + */ +void SSL_CTX_set_next_proto_select_cb(SSL_CTX *ctx, + int (*cb) (SSL *ssl, + unsigned char **out, + unsigned char *outlen, + const unsigned char *in, + unsigned int inlen, + void *arg), + void *arg); + +void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data, + unsigned int *len); + +void _ssl_set_alpn_list(const SSL *ssl); + +/** + * @brief get SSL error code + * + * @param ssl - SSL point + * @param ret_code - SSL return code + * + * @return SSL error number + */ +int SSL_get_error(const SSL *ssl, int ret_code); + +/** + * @brief clear the SSL error code + * + * @param none + * + * @return none + */ +void ERR_clear_error(void); + +/** + * @brief get the current SSL error code + * + * @param none + * + * @return current SSL error number + */ +int ERR_get_error(void); + +/** + * @brief register the SSL error strings + * + * @param none + * + * @return none + */ +void ERR_load_SSL_strings(void); + +/** + * @brief initialize the SSL library + * + * @param none + * + * @return none + */ +void SSL_library_init(void); + +/** + * @brief generates a human-readable string representing the error code e + * and store it into the "ret" point memory + * + * @param e - error code + * @param ret - memory point to store the string + * + * @return the result string point + */ +char *ERR_error_string(unsigned long e, char *ret); + +/** + * @brief add the SSL context option + * + * @param ctx - SSL context point + * @param opt - new SSL context option + * + * @return the SSL context option + */ +unsigned long SSL_CTX_set_options(SSL_CTX *ctx, unsigned long opt); + +/** + * @brief add the SSL context mode + * + * @param ctx - SSL context point + * @param mod - new SSL context mod + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_set_mode(SSL_CTX *ctx, int mod); + +/* +} +*/ + +/** + * @brief perform the SSL handshake + * + * @param ssl - SSL point + * + * @return result + * 1 : OK + * 0 : failed + * -1 : a error catch + */ +int SSL_do_handshake(SSL *ssl); + +/** + * @brief get the SSL current version + * + * @param ssl - SSL point + * + * @return the version string + */ +const char *SSL_get_version(const SSL *ssl); + +/** + * @brief set the SSL context version + * + * @param ctx - SSL context point + * @param meth - SSL method point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth); + +/** + * @brief get the bytes numbers which are to be read + * + * @param ssl - SSL point + * + * @return bytes number + */ +int SSL_pending(const SSL *ssl); + +/** + * @brief check if SSL want nothing + * + * @param ssl - SSL point + * + * @return result + * 0 : false + * 1 : true + */ +int SSL_want_nothing(const SSL *ssl); + +/** + * @brief check if SSL want to read + * + * @param ssl - SSL point + * + * @return result + * 0 : false + * 1 : true + */ +int SSL_want_read(const SSL *ssl); + +/** + * @brief check if SSL want to write + * + * @param ssl - SSL point + * + * @return result + * 0 : false + * 1 : true + */ +int SSL_want_write(const SSL *ssl); + +/** + * @brief get the SSL context current method + * + * @param ctx - SSL context point + * + * @return the SSL context current method + */ +const SSL_METHOD *SSL_CTX_get_ssl_method(SSL_CTX *ctx); + +/** + * @brief get the SSL current method + * + * @param ssl - SSL point + * + * @return the SSL current method + */ +const SSL_METHOD *SSL_get_ssl_method(SSL *ssl); + +/** + * @brief set the SSL method + * + * @param ssl - SSL point + * @param meth - SSL method point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_set_ssl_method(SSL *ssl, const SSL_METHOD *method); + +/** + * @brief add CA client certification into the SSL + * + * @param ssl - SSL point + * @param x - CA certification point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_add_client_CA(SSL *ssl, X509 *x); + +/** + * @brief add CA client certification into the SSL context + * + * @param ctx - SSL context point + * @param x - CA certification point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x); + +/** + * @brief set the SSL CA certification list + * + * @param ssl - SSL point + * @param name_list - CA certification list + * + * @return none + */ +void SSL_set_client_CA_list(SSL *ssl, STACK_OF(X509_NAME) *name_list); + +/** + * @brief set the SSL context CA certification list + * + * @param ctx - SSL context point + * @param name_list - CA certification list + * + * @return none + */ +void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list); + +/** + * @briefget the SSL CA certification list + * + * @param ssl - SSL point + * + * @return CA certification list + */ +STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *ssl); + +/** + * @brief get the SSL context CA certification list + * + * @param ctx - SSL context point + * + * @return CA certification list + */ +STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *ctx); + +/** + * @brief get the SSL certification point + * + * @param ssl - SSL point + * + * @return SSL certification point + */ +X509 *SSL_get_certificate(const SSL *ssl); + +/** + * @brief get the SSL private key point + * + * @param ssl - SSL point + * + * @return SSL private key point + */ +EVP_PKEY *SSL_get_privatekey(const SSL *ssl); + +/** + * @brief set the SSL information callback function + * + * @param ssl - SSL point + * @param cb - information callback function + * + * @return none + */ +void SSL_set_info_callback(SSL *ssl, void (*cb) (const SSL *ssl, int type, int val)); + +/** + * @brief get the SSL state + * + * @param ssl - SSL point + * + * @return SSL state + */ +OSSL_HANDSHAKE_STATE SSL_get_state(const SSL *ssl); + +/** + * @brief set the SSL context read buffer length + * + * @param ctx - SSL context point + * @param len - read buffer length + * + * @return none + */ +void SSL_CTX_set_default_read_buffer_len(SSL_CTX *ctx, size_t len); + +/** + * @brief set the SSL read buffer length + * + * @param ssl - SSL point + * @param len - read buffer length + * + * @return none + */ +void SSL_set_default_read_buffer_len(SSL *ssl, size_t len); + +/** + * @brief set the SSL security level + * + * @param ssl - SSL point + * @param level - security level + * + * @return none + */ +void SSL_set_security_level(SSL *ssl, int level); + +/** + * @brief get the SSL security level + * + * @param ssl - SSL point + * + * @return security level + */ +int SSL_get_security_level(const SSL *ssl); + +/** + * @brief get the SSL verifying mode of the SSL context + * + * @param ctx - SSL context point + * + * @return verifying mode + */ +int SSL_CTX_get_verify_mode(const SSL_CTX *ctx); + +/** + * @brief get the SSL verifying depth of the SSL context + * + * @param ctx - SSL context point + * + * @return verifying depth + */ +int SSL_CTX_get_verify_depth(const SSL_CTX *ctx); + +/** + * @brief set the SSL context verifying of the SSL context + * + * @param ctx - SSL context point + * @param mode - verifying mode + * @param verify_callback - verifying callback function + * + * @return none + */ +void SSL_CTX_set_verify(SSL_CTX *ctx, int mode, int (*verify_callback)(int, X509_STORE_CTX *)); + +/** + * @brief set the SSL verifying of the SSL context + * + * @param ctx - SSL point + * @param mode - verifying mode + * @param verify_callback - verifying callback function + * + * @return none + */ +void SSL_set_verify(SSL *s, int mode, int (*verify_callback)(int, X509_STORE_CTX *)); + +/** + * @brief set the SSL verify depth of the SSL context + * + * @param ctx - SSL context point + * @param depth - verifying depth + * + * @return none + */ +void SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth); + +/** + * @brief certification verifying callback function + * + * @param preverify_ok - verifying result + * @param x509_ctx - X509 certification point + * + * @return verifying result + */ +int verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx); + +/** + * @brief set the session timeout time + * + * @param ctx - SSL context point + * @param t - new session timeout time + * + * @return old session timeout time + */ +long SSL_CTX_set_timeout(SSL_CTX *ctx, long t); + +/** + * @brief get the session timeout time + * + * @param ctx - SSL context point + * + * @return current session timeout time + */ +long SSL_CTX_get_timeout(const SSL_CTX *ctx); + +/** + * @brief set the SSL context cipher through the list string + * + * @param ctx - SSL context point + * @param str - cipher controller list string + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str); + +/** + * @brief set the SSL cipher through the list string + * + * @param ssl - SSL point + * @param str - cipher controller list string + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_set_cipher_list(SSL *ssl, const char *str); + +/** + * @brief get the SSL cipher list string + * + * @param ssl - SSL point + * + * @return cipher controller list string + */ +const char *SSL_get_cipher_list(const SSL *ssl, int n); + +/** + * @brief get the SSL cipher + * + * @param ssl - SSL point + * + * @return current cipher + */ +const SSL_CIPHER *SSL_get_current_cipher(const SSL *ssl); + +/** + * @brief get the SSL cipher string + * + * @param ssl - SSL point + * + * @return cipher string + */ +const char *SSL_get_cipher(const SSL *ssl); + +/** + * @brief get the SSL context object X509 certification storage + * + * @param ctx - SSL context point + * + * @return x509 certification storage + */ +X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *ctx); + +/** + * @brief set the SSL context object X509 certification store + * + * @param ctx - SSL context point + * @param store - X509 certification store + * + * @return none + */ +void SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store); + +/** + * @brief get the SSL specifical statement + * + * @param ssl - SSL point + * + * @return specifical statement + */ +int SSL_want(const SSL *ssl); + +/** + * @brief check if the SSL is SSL_X509_LOOKUP state + * + * @param ssl - SSL point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_want_x509_lookup(const SSL *ssl); + +/** + * @brief reset the SSL + * + * @param ssl - SSL point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_clear(SSL *ssl); + +/** + * @brief get the socket handle of the SSL + * + * @param ssl - SSL point + * + * @return result + * >= 0 : yes, and return socket handle + * < 0 : a error catch + */ +int SSL_get_fd(const SSL *ssl); + +/** + * @brief get the read only socket handle of the SSL + * + * @param ssl - SSL point + * + * @return result + * >= 0 : yes, and return socket handle + * < 0 : a error catch + */ +int SSL_get_rfd(const SSL *ssl); + +/** + * @brief get the write only socket handle of the SSL + * + * @param ssl - SSL point + * + * @return result + * >= 0 : yes, and return socket handle + * < 0 : a error catch + */ +int SSL_get_wfd(const SSL *ssl); + +/** + * @brief set the SSL if we can read as many as data + * + * @param ssl - SSL point + * @param yes - enable the function + * + * @return none + */ +void SSL_set_read_ahead(SSL *s, int yes); + +/** + * @brief set the SSL context if we can read as many as data + * + * @param ctx - SSL context point + * @param yes - enbale the function + * + * @return none + */ +void SSL_CTX_set_read_ahead(SSL_CTX *ctx, int yes); + +/** + * @brief get the SSL ahead signal if we can read as many as data + * + * @param ssl - SSL point + * + * @return SSL context ahead signal + */ +int SSL_get_read_ahead(const SSL *ssl); + +/** + * @brief get the SSL context ahead signal if we can read as many as data + * + * @param ctx - SSL context point + * + * @return SSL context ahead signal + */ +long SSL_CTX_get_read_ahead(SSL_CTX *ctx); + +/** + * @brief check if some data can be read + * + * @param ssl - SSL point + * + * @return + * 1 : there are bytes to be read + * 0 : no data + */ +int SSL_has_pending(const SSL *ssl); + +/** + * @brief load the X509 certification into SSL context + * + * @param ctx - SSL context point + * @param x - X509 certification point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x);//loads the certificate x into ctx + +/** + * @brief load the ASN1 certification into SSL context + * + * @param ctx - SSL context point + * @param len - certification length + * @param d - data point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d); + +/** + * @brief load the certification file into SSL context + * + * @param ctx - SSL context point + * @param file - certification file name + * @param type - certification encoding type + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type); + +/** + * @brief load the certification chain file into SSL context + * + * @param ctx - SSL context point + * @param file - certification chain file name + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file); + + +/** + * @brief load the ASN1 private key into SSL context + * + * @param ctx - SSL context point + * @param d - data point + * @param len - private key length + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_PrivateKey_ASN1(int pk, SSL_CTX *ctx, const unsigned char *d, long len);//adds the private key of type pk stored at memory location d (length len) to ctx + +/** + * @brief load the private key file into SSL context + * + * @param ctx - SSL context point + * @param file - private key file name + * @param type - private key encoding type + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type); + +/** + * @brief load the RSA private key into SSL context + * + * @param ctx - SSL context point + * @param x - RSA private key point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa); + +/** + * @brief load the RSA ASN1 private key into SSL context + * + * @param ctx - SSL context point + * @param d - data point + * @param len - RSA private key length + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, long len); + +/** + * @brief load the RSA private key file into SSL context + * + * @param ctx - SSL context point + * @param file - RSA private key file name + * @param type - private key encoding type + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type); + + +/** + * @brief check if the private key and certification is matched + * + * @param ctx - SSL context point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_check_private_key(const SSL_CTX *ctx); + +/** + * @brief set the SSL context server information + * + * @param ctx - SSL context point + * @param serverinfo - server information string + * @param serverinfo_length - server information length + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_serverinfo(SSL_CTX *ctx, const unsigned char *serverinfo, size_t serverinfo_length); + +/** + * @brief load the SSL context server infomation file into SSL context + * + * @param ctx - SSL context point + * @param file - server information file + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file); + +/** + * @brief SSL select next function + * + * @param out - point of output data point + * @param outlen - output data length + * @param in - input data + * @param inlen - input data length + * @param client - client data point + * @param client_len -client data length + * + * @return NPN state + * OPENSSL_NPN_UNSUPPORTED : not support + * OPENSSL_NPN_NEGOTIATED : negotiated + * OPENSSL_NPN_NO_OVERLAP : no overlap + */ +int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, + const unsigned char *in, unsigned int inlen, + const unsigned char *client, unsigned int client_len); + +/** + * @brief load the extra certification chain into the SSL context + * + * @param ctx - SSL context point + * @param x509 - X509 certification + * + * @return result + * 1 : OK + * 0 : failed + */ +long SSL_CTX_add_extra_chain_cert(SSL_CTX *ctx, X509 *); + +/** + * @brief control the SSL context + * + * @param ctx - SSL context point + * @param cmd - command + * @param larg - parameter length + * @param parg - parameter point + * + * @return result + * 1 : OK + * 0 : failed + */ +long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, char *parg); + +/** + * @brief get the SSL context cipher + * + * @param ctx - SSL context point + * + * @return SSL context cipher + */ +STACK *SSL_CTX_get_ciphers(const SSL_CTX *ctx); + +/** + * @brief check if the SSL context can read as many as data + * + * @param ctx - SSL context point + * + * @return result + * 1 : OK + * 0 : failed + */ +long SSL_CTX_get_default_read_ahead(SSL_CTX *ctx); + +/** + * @brief get the SSL context extra data + * + * @param ctx - SSL context point + * @param idx - index + * + * @return data point + */ +char *SSL_CTX_get_ex_data(const SSL_CTX *ctx, int idx); + +/** + * @brief get the SSL context quiet shutdown option + * + * @param ctx - SSL context point + * + * @return quiet shutdown option + */ +int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx); + +/** + * @brief load the SSL context CA file + * + * @param ctx - SSL context point + * @param CAfile - CA certification file + * @param CApath - CA certification file path + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile, const char *CApath); + +/** + * @brief add SSL context reference count by '1' + * + * @param ctx - SSL context point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_up_ref(SSL_CTX *ctx); + +/** + * @brief set SSL context application private data + * + * @param ctx - SSL context point + * @param arg - private data + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_set_app_data(SSL_CTX *ctx, void *arg); + +/** + * @brief set SSL context client certification callback function + * + * @param ctx - SSL context point + * @param cb - callback function + * + * @return none + */ +void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx, int (*cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey)); + +/** + * @brief set the SSL context if we can read as many as data + * + * @param ctx - SSL context point + * @param m - enable the fuction + * + * @return none + */ +void SSL_CTX_set_default_read_ahead(SSL_CTX *ctx, int m); + +/** + * @brief set SSL context default verifying path + * + * @param ctx - SSL context point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx); + +/** + * @brief set SSL context default verifying directory + * + * @param ctx - SSL context point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_set_default_verify_dir(SSL_CTX *ctx); + +/** + * @brief set SSL context default verifying file + * + * @param ctx - SSL context point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_set_default_verify_file(SSL_CTX *ctx); + +/** + * @brief set SSL context extra data + * + * @param ctx - SSL context point + * @param idx - data index + * @param arg - data point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_set_ex_data(SSL_CTX *s, int idx, char *arg); + +/** + * @brief clear the SSL context option bit of "op" + * + * @param ctx - SSL context point + * @param op - option + * + * @return SSL context option + */ +unsigned long SSL_CTX_clear_options(SSL_CTX *ctx, unsigned long op); + +/** + * @brief get the SSL context option + * + * @param ctx - SSL context point + * @param op - option + * + * @return SSL context option + */ +unsigned long SSL_CTX_get_options(SSL_CTX *ctx); + +/** + * @brief set the SSL context quiet shutdown mode + * + * @param ctx - SSL context point + * @param mode - mode + * + * @return none + */ +void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode); + +/** + * @brief get the SSL context X509 certification + * + * @param ctx - SSL context point + * + * @return X509 certification + */ +X509 *SSL_CTX_get0_certificate(const SSL_CTX *ctx); + +/** + * @brief get the SSL context private key + * + * @param ctx - SSL context point + * + * @return private key + */ +EVP_PKEY *SSL_CTX_get0_privatekey(const SSL_CTX *ctx); + +/** + * @brief set SSL context PSK identity hint + * + * @param ctx - SSL context point + * @param hint - PSK identity hint + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *hint); + +/** + * @brief set SSL context PSK server callback function + * + * @param ctx - SSL context point + * @param callback - callback function + * + * @return none + */ +void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, + unsigned int (*callback)(SSL *ssl, + const char *identity, + unsigned char *psk, + int max_psk_len)); +/** + * @brief get alert description string + * + * @param value - alert value + * + * @return alert description string + */ +const char *SSL_alert_desc_string(int value); + +/** + * @brief get alert description long string + * + * @param value - alert value + * + * @return alert description long string + */ +const char *SSL_alert_desc_string_long(int value); + +/** + * @brief get alert type string + * + * @param value - alert value + * + * @return alert type string + */ +const char *SSL_alert_type_string(int value); + +/** + * @brief get alert type long string + * + * @param value - alert value + * + * @return alert type long string + */ +const char *SSL_alert_type_string_long(int value); + +/** + * @brief get SSL context of the SSL + * + * @param ssl - SSL point + * + * @return SSL context + */ +SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl); + +/** + * @brief get SSL application data + * + * @param ssl - SSL point + * + * @return application data + */ +char *SSL_get_app_data(SSL *ssl); + +/** + * @brief get SSL cipher bits + * + * @param ssl - SSL point + * @param alg_bits - algorithm bits + * + * @return strength bits + */ +int SSL_get_cipher_bits(const SSL *ssl, int *alg_bits); + +/** + * @brief get SSL cipher name + * + * @param ssl - SSL point + * + * @return SSL cipher name + */ +char *SSL_get_cipher_name(const SSL *ssl); + +/** + * @brief get SSL cipher version + * + * @param ssl - SSL point + * + * @return SSL cipher version + */ +char *SSL_get_cipher_version(const SSL *ssl); + +/** + * @brief get SSL extra data + * + * @param ssl - SSL point + * @param idx - data index + * + * @return extra data + */ +char *SSL_get_ex_data(const SSL *ssl, int idx); + +/** + * @brief get index of the SSL extra data X509 storage context + * + * @param none + * + * @return data index + */ +int SSL_get_ex_data_X509_STORE_CTX_idx(void); + +/** + * @brief get peer certification chain + * + * @param ssl - SSL point + * + * @return certification chain + */ +STACK *SSL_get_peer_cert_chain(const SSL *ssl); + +/** + * @brief get peer certification + * + * @param ssl - SSL point + * + * @return certification + */ +X509 *SSL_get_peer_certificate(const SSL *ssl); + +/** + * @brief get SSL quiet shutdown mode + * + * @param ssl - SSL point + * + * @return quiet shutdown mode + */ +int SSL_get_quiet_shutdown(const SSL *ssl); + +/** + * @brief get SSL read only IO handle + * + * @param ssl - SSL point + * + * @return IO handle + */ +BIO *SSL_get_rbio(const SSL *ssl); + +/** + * @brief get SSL shared ciphers + * + * @param ssl - SSL point + * @param buf - buffer to store the ciphers + * @param len - buffer len + * + * @return shared ciphers + */ +char *SSL_get_shared_ciphers(const SSL *ssl, char *buf, int len); + +/** + * @brief get SSL shutdown mode + * + * @param ssl - SSL point + * + * @return shutdown mode + */ +int SSL_get_shutdown(const SSL *ssl); + +/** + * @brief get SSL session time + * + * @param ssl - SSL point + * + * @return session time + */ +long SSL_get_time(const SSL *ssl); + +/** + * @brief get SSL session timeout time + * + * @param ssl - SSL point + * + * @return session timeout time + */ +long SSL_get_timeout(const SSL *ssl); + +/** + * @brief get SSL verifying mode + * + * @param ssl - SSL point + * + * @return verifying mode + */ +int SSL_get_verify_mode(const SSL *ssl); + +/** + * @brief get SSL verify parameters + * + * @param ssl - SSL point + * + * @return verify parameters + */ +X509_VERIFY_PARAM *SSL_get0_param(SSL *ssl); + +/** + * @brief set expected hostname the peer cert CN should have + * + * @param param - verify parameters from SSL_get0_param() + * + * @param name - the expected hostname + * + * @param namelen - the length of the hostname, or 0 if NUL terminated + * + * @return verify parameters + */ +int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param, + const char *name, size_t namelen); + +/** + * @brief set parameters for X509 host verify action + * + * @param param -verify parameters from SSL_get0_param() + * + * @param flags - bitfield of X509_CHECK_FLAG_... parameters to set + * + * @return 1 for success, 0 for failure + */ +int X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param, + unsigned long flags); + +/** + * @brief clear parameters for X509 host verify action + * + * @param param -verify parameters from SSL_get0_param() + * + * @param flags - bitfield of X509_CHECK_FLAG_... parameters to clear + * + * @return 1 for success, 0 for failure + */ +int X509_VERIFY_PARAM_clear_hostflags(X509_VERIFY_PARAM *param, + unsigned long flags); + +/** + * @brief get SSL write only IO handle + * + * @param ssl - SSL point + * + * @return IO handle + */ +BIO *SSL_get_wbio(const SSL *ssl); + +/** + * @brief load SSL client CA certification file + * + * @param file - file name + * + * @return certification loading object + */ +STACK *SSL_load_client_CA_file(const char *file); + +/** + * @brief add SSL reference by '1' + * + * @param ssl - SSL point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_up_ref(SSL *ssl); + +/** + * @brief read and put data into buf, but not clear the SSL low-level storage + * + * @param ssl - SSL point + * @param buf - storage buffer point + * @param num - data bytes + * + * @return result + * > 0 : OK, and return read bytes + * = 0 : connect is closed + * < 0 : a error catch + */ +int SSL_peek(SSL *ssl, void *buf, int num); + +/** + * @brief make SSL renegotiate + * + * @param ssl - SSL point + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_renegotiate(SSL *ssl); + +/** + * @brief get the state string where SSL is reading + * + * @param ssl - SSL point + * + * @return state string + */ +const char *SSL_rstate_string(SSL *ssl); + +/** + * @brief get the statement long string where SSL is reading + * + * @param ssl - SSL point + * + * @return statement long string + */ +const char *SSL_rstate_string_long(SSL *ssl); + +/** + * @brief set SSL accept statement + * + * @param ssl - SSL point + * + * @return none + */ +void SSL_set_accept_state(SSL *ssl); + +/** + * @brief set SSL application data + * + * @param ssl - SSL point + * @param arg - SSL application data point + * + * @return none + */ +void SSL_set_app_data(SSL *ssl, char *arg); + +/** + * @brief set SSL BIO + * + * @param ssl - SSL point + * @param rbio - read only IO + * @param wbio - write only IO + * + * @return none + */ +void SSL_set_bio(SSL *ssl, BIO *rbio, BIO *wbio); + +/** + * @brief clear SSL option + * + * @param ssl - SSL point + * @param op - clear option + * + * @return SSL option + */ +unsigned long SSL_clear_options(SSL *ssl, unsigned long op); + +/** + * @brief get SSL option + * + * @param ssl - SSL point + * + * @return SSL option + */ +unsigned long SSL_get_options(SSL *ssl); + +/** + * @brief clear SSL option + * + * @param ssl - SSL point + * @param op - setting option + * + * @return SSL option + */ +unsigned long SSL_set_options(SSL *ssl, unsigned long op); + +/** + * @brief set SSL quiet shutdown mode + * + * @param ssl - SSL point + * @param mode - quiet shutdown mode + * + * @return none + */ +void SSL_set_quiet_shutdown(SSL *ssl, int mode); + +/** + * @brief set SSL shutdown mode + * + * @param ssl - SSL point + * @param mode - shutdown mode + * + * @return none + */ +void SSL_set_shutdown(SSL *ssl, int mode); + +/** + * @brief set SSL session time + * + * @param ssl - SSL point + * @param t - session time + * + * @return session time + */ +void SSL_set_time(SSL *ssl, long t); + +/** + * @brief set SSL session timeout time + * + * @param ssl - SSL point + * @param t - session timeout time + * + * @return session timeout time + */ +void SSL_set_timeout(SSL *ssl, long t); + +/** + * @brief get SSL statement string + * + * @param ssl - SSL point + * + * @return SSL statement string + */ +char *SSL_state_string(const SSL *ssl); + +/** + * @brief get SSL statement long string + * + * @param ssl - SSL point + * + * @return SSL statement long string + */ +char *SSL_state_string_long(const SSL *ssl); + +/** + * @brief get SSL renegotiation count + * + * @param ssl - SSL point + * + * @return renegotiation count + */ +long SSL_total_renegotiations(SSL *ssl); + +/** + * @brief get SSL version + * + * @param ssl - SSL point + * + * @return SSL version + */ +int SSL_version(const SSL *ssl); + +/** + * @brief set SSL PSK identity hint + * + * @param ssl - SSL point + * @param hint - identity hint + * + * @return result + * 1 : OK + * 0 : failed + */ +int SSL_use_psk_identity_hint(SSL *ssl, const char *hint); + +/** + * @brief get SSL PSK identity hint + * + * @param ssl - SSL point + * + * @return identity hint + */ +const char *SSL_get_psk_identity_hint(SSL *ssl); + +/** + * @brief get SSL PSK identity + * + * @param ssl - SSL point + * + * @return identity + */ +const char *SSL_get_psk_identity(SSL *ssl); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/openharmony/armeabi-v7a/include/mbedtls_wrapper/platform/ssl_pm.h b/openharmony/armeabi-v7a/include/mbedtls_wrapper/platform/ssl_pm.h new file mode 100644 index 00000000..cbbe3aa3 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls_wrapper/platform/ssl_pm.h @@ -0,0 +1,61 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_PM_H_ +#define _SSL_PM_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +#include +#include "ssl_types.h" +#include "ssl_port.h" + +#define LOCAL_ATRR + +int ssl_pm_new(SSL *ssl); +void ssl_pm_free(SSL *ssl); + +int ssl_pm_handshake(SSL *ssl); +int ssl_pm_shutdown(SSL *ssl); +int ssl_pm_clear(SSL *ssl); + +int ssl_pm_read(SSL *ssl, void *buffer, int len); +int ssl_pm_send(SSL *ssl, const void *buffer, int len); +int ssl_pm_pending(const SSL *ssl); + +void ssl_pm_set_fd(SSL *ssl, int fd, int mode); +int ssl_pm_get_fd(const SSL *ssl, int mode); + +OSSL_HANDSHAKE_STATE ssl_pm_get_state(const SSL *ssl); + +void ssl_pm_set_bufflen(SSL *ssl, int len); + +int x509_pm_show_info(X509 *x); +int x509_pm_new(X509 *x, X509 *m_x); +void x509_pm_free(X509 *x); +int x509_pm_load(X509 *x, const unsigned char *buffer, int len); + +int pkey_pm_new(EVP_PKEY *pk, EVP_PKEY *m_pk); +void pkey_pm_free(EVP_PKEY *pk); +int pkey_pm_load(EVP_PKEY *pk, const unsigned char *buffer, int len); + +long ssl_pm_get_verify_result(const SSL *ssl); + +#ifdef __cplusplus + } +#endif + +#endif diff --git a/openharmony/armeabi-v7a/include/mbedtls_wrapper/platform/ssl_port.h b/openharmony/armeabi-v7a/include/mbedtls_wrapper/platform/ssl_port.h new file mode 100644 index 00000000..c4c26618 --- /dev/null +++ b/openharmony/armeabi-v7a/include/mbedtls_wrapper/platform/ssl_port.h @@ -0,0 +1,47 @@ +// Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#ifndef _SSL_PORT_H_ +#define _SSL_PORT_H_ + +#ifdef __cplusplus + extern "C" { +#endif + +/* +#include "esp_types.h" +#include "esp_log.h" +*/ +#include "string.h" +#include "malloc.h" + +void *ssl_mem_zalloc(size_t size); + +#define ssl_mem_malloc malloc +#define ssl_mem_free free + +#define ssl_memcpy memcpy +#define ssl_strlen strlen + +#define ssl_speed_up_enter() +#define ssl_speed_up_exit() + +#define SSL_DEBUG_FL +#define SSL_DEBUG_LOG(fmt, ...) ESP_LOGI("openssl", fmt, ##__VA_ARGS__) + +#ifdef __cplusplus + } +#endif + +#endif diff --git a/openharmony/armeabi-v7a/include/websockets/libwebsockets.h b/openharmony/armeabi-v7a/include/websockets/libwebsockets.h index 7efeba1f..460c7326 100644 --- a/openharmony/armeabi-v7a/include/websockets/libwebsockets.h +++ b/openharmony/armeabi-v7a/include/websockets/libwebsockets.h @@ -27,84 +27,31 @@ #ifdef __cplusplus #include #include -#ifdef MBED_OPERATORS -#include "mbed-drivers/mbed.h" -#include "sal-iface-eth/EthernetInterface.h" -#include "sockets/TCPListener.h" -#include "sal-stack-lwip/lwipv4_init.h" - -namespace { -} -using namespace mbed::Sockets::v0; - - -struct sockaddr_in; -struct lws; - -class lws_conn { - public: - lws_conn(): - ts(NULL), - wsi(NULL), - writeable(1), - awaiting_on_writeable(0) - { - } - -public: - void set_wsi(struct lws *_wsi) { wsi = _wsi; } - int actual_onRX(Socket *s); - void onRX(Socket *s); - void onError(Socket *s, socket_error_t err); - void onDisconnect(TCPStream *s); - void onSent(Socket *s, uint16_t len); - void serialized_writeable(struct lws *wsi); - -public: - TCPStream *ts; - -public: - struct lws *wsi; - char writeable; - char awaiting_on_writeable; -}; - -class lws_conn_listener : lws_conn { -public: - lws_conn_listener(): - srv(SOCKET_STACK_LWIP_IPV4) - { - srv.setOnError(TCPStream::ErrorHandler_t(this, - &lws_conn_listener::onError)); - } - - void start(const uint16_t port); /**< start listening */ - -protected: - void onRX(Socket *s); /**< incoming data ready */ - void onError(Socket *s, socket_error_t err); /**< if error occurs */ - void onIncoming(TCPListener *s, void *impl); /**< new connection */ - void onDisconnect(TCPStream *s); /**< disconnection */ - -public: - TCPListener srv; -}; - -#endif - +# extern "C" { #else #include #endif -#if defined(MBED_OPERATORS) || defined(LWS_WITH_ESP8266) +#include "lws_config.h" + +/* + * CARE: everything using cmake defines needs to be below here + */ + +#if defined(LWS_WITH_ESP8266) struct sockaddr_in; #define LWS_POSIX 0 #else #define LWS_POSIX 1 #endif -#include "lws_config.h" +#if defined(LWS_HAS_INTPTR_T) +#include +#define lws_intptr_t intptr_t +#else +typedef unsigned long long lws_intptr_t; +#endif #if defined(WIN32) || defined(_WIN32) #ifndef WIN32_LEAN_AND_MEAN @@ -125,7 +72,7 @@ struct sockaddr_in; // Visual studio older than 2015 and WIN_CE has only _stricmp #if (defined(_MSC_VER) && _MSC_VER < 1900) || defined(_WIN32_WCE) #define strcasecmp _stricmp -#else +#elif !defined(__MINGW32__) #define strcasecmp stricmp #endif #define getdtablesize() 30000 @@ -134,6 +81,7 @@ struct sockaddr_in; #define LWS_VISIBLE #define LWS_WARN_UNUSED_RESULT #define LWS_WARN_DEPRECATED +#define LWS_FORMAT(string_index) #ifdef LWS_DLL #ifdef LWS_INTERNAL @@ -147,8 +95,11 @@ struct sockaddr_in; #define LWS_INVALID_FILE INVALID_HANDLE_VALUE #define LWS_O_RDONLY _O_RDONLY +#define LWS_O_WRONLY _O_WRONLY +#define LWS_O_CREAT _O_CREAT +#define LWS_O_TRUNC _O_TRUNC -#if !defined(_MSC_VER) || _MSC_VER < 1900 /* Visual Studio 2015 already defines this in */ +#if !defined(__MINGW32__) && (!defined(_MSC_VER) || _MSC_VER < 1900) /* Visual Studio 2015 already defines this in */ #define lws_snprintf _snprintf #endif @@ -156,8 +107,15 @@ struct sockaddr_in; #define __func__ __FUNCTION__ #endif +#if !defined(__MINGW32__) &&(!defined(_MSC_VER) || _MSC_VER < 1900) && !defined(snprintf) +#define snprintf(buf,len, format,...) _snprintf_s(buf, len,len, format, __VA_ARGS__) +#endif + #else /* NOT WIN32 */ #include +#if defined(LWS_HAVE_SYS_CAPABILITY_H) && defined(LWS_HAVE_LIBCAP) +#include +#endif #if defined(__NetBSD__) || defined(__FreeBSD__) #include @@ -165,14 +123,21 @@ struct sockaddr_in; #define LWS_INLINE inline #define LWS_O_RDONLY O_RDONLY +#define LWS_O_WRONLY O_WRONLY +#define LWS_O_CREAT O_CREAT +#define LWS_O_TRUNC O_TRUNC -#if !defined(MBED_OPERATORS) && !defined(LWS_WITH_ESP8266) +#if !defined(LWS_WITH_ESP8266) && !defined(OPTEE_TA) && !defined(LWS_WITH_ESP32) #include #include #define LWS_INVALID_FILE -1 #else -#define getdtablesize() (20) +#define getdtablesize() (30) +#if defined(LWS_WITH_ESP32) #define LWS_INVALID_FILE NULL +#else +#define LWS_INVALID_FILE NULL +#endif #endif #if defined(__GNUC__) @@ -186,10 +151,12 @@ struct sockaddr_in; #define LWS_VISIBLE __attribute__((visibility("default"))) #define LWS_WARN_DEPRECATED __attribute__ ((deprecated)) +#define LWS_FORMAT(string_index) __attribute__ ((format(printf, string_index, string_index+1))) #else #define LWS_VISIBLE #define LWS_WARN_UNUSED_RESULT #define LWS_WARN_DEPRECATED +#define LWS_FORMAT(string_index) #endif #if defined(__ANDROID__) @@ -199,15 +166,18 @@ struct sockaddr_in; #endif -#ifdef LWS_USE_LIBEV +#ifdef LWS_WITH_LIBEV #include -#endif /* LWS_USE_LIBEV */ -#ifdef LWS_USE_LIBUV +#endif /* LWS_WITH_LIBEV */ +#ifdef LWS_WITH_LIBUV #include #ifdef LWS_HAVE_UV_VERSION_H #include #endif -#endif /* LWS_USE_LIBUV */ +#endif /* LWS_WITH_LIBUV */ +#ifdef LWS_WITH_LIBEVENT +#include +#endif /* LWS_WITH_LIBEVENT */ #ifndef LWS_EXTERN #define LWS_EXTERN extern @@ -216,9 +186,11 @@ struct sockaddr_in; #ifdef _WIN32 #define random rand #else +#if !defined(OPTEE_TA) #include #include #endif +#endif #ifdef LWS_OPENSSL_SUPPORT @@ -231,28 +203,24 @@ struct sockaddr_in; #include #endif /* not USE_OLD_CYASSL */ #else -#if defined(LWS_USE_POLARSSL) -#include -struct lws_polarssl_context { - x509_crt ca; /**< ca */ - x509_crt certificate; /**< cert */ - rsa_context key; /**< key */ -}; -typedef struct lws_polarssl_context SSL_CTX; -typedef ssl_context SSL; -#else -#if defined(LWS_USE_MBEDTLS) +#if defined(LWS_WITH_MBEDTLS) +#if defined(LWS_WITH_ESP32) +/* this filepath is passed to us but without quotes or <> */ +#undef MBEDTLS_CONFIG_FILE +#define MBEDTLS_CONFIG_FILE +#endif #include -#else +#endif #include +#if !defined(LWS_WITH_MBEDTLS) #include -#endif /* not USE_MBEDTLS */ -#endif /* not USE_POLARSSL */ +#endif #endif /* not USE_WOLFSSL */ #endif #define CONTEXT_PORT_NO_LISTEN -1 +#define CONTEXT_PORT_NO_LISTEN_SERVER -2 /** \defgroup log Logging * @@ -277,11 +245,12 @@ enum lws_log_levels { LLL_EXT = 1 << 7, LLL_CLIENT = 1 << 8, LLL_LATENCY = 1 << 9, + LLL_USER = 1 << 10, - LLL_COUNT = 10 /* set to count of valid flags */ + LLL_COUNT = 11 /* set to count of valid flags */ }; -LWS_VISIBLE LWS_EXTERN void _lws_log(int filter, const char *format, ...); +LWS_VISIBLE LWS_EXTERN void _lws_log(int filter, const char *format, ...) LWS_FORMAT(2); LWS_VISIBLE LWS_EXTERN void _lws_logv(int filter, const char *format, va_list vl); /** * lwsl_timestamp: generate logging timestamp string @@ -295,15 +264,18 @@ LWS_VISIBLE LWS_EXTERN void _lws_logv(int filter, const char *format, va_list vl LWS_VISIBLE LWS_EXTERN int lwsl_timestamp(int level, char *p, int len); +/* these guys are unconditionally included */ + #define lwsl_err(...) _lws_log(LLL_ERR, __VA_ARGS__) +#define lwsl_user(...) _lws_log(LLL_USER, __VA_ARGS__) #if !defined(LWS_WITH_NO_LOGS) -/* notice, warn and log are always compiled in */ +/* notice and warn are usually included by being compiled in */ #define lwsl_warn(...) _lws_log(LLL_WARN, __VA_ARGS__) #define lwsl_notice(...) _lws_log(LLL_NOTICE, __VA_ARGS__) #endif /* - * weaker logging can be deselected at configure time using --disable-debug + * weaker logging can be deselected by telling CMake to build in RELEASE mode * that gets rid of the overhead of checking while keeping _warn and _err * active */ @@ -315,7 +287,6 @@ lwsl_timestamp(int level, char *p, int len); #ifdef _DEBUG #if defined(LWS_WITH_NO_LOGS) /* notice, warn and log are always compiled in */ -//#define lwsl_err(...) _lws_log(LLL_ERR, __VA_ARGS__) #define lwsl_warn(...) _lws_log(LLL_WARN, __VA_ARGS__) #define lwsl_notice(...) _lws_log(LLL_NOTICE, __VA_ARGS__) #endif @@ -326,17 +297,9 @@ lwsl_timestamp(int level, char *p, int len); #define lwsl_ext(...) _lws_log(LLL_EXT, __VA_ARGS__) #define lwsl_client(...) _lws_log(LLL_CLIENT, __VA_ARGS__) #define lwsl_latency(...) _lws_log(LLL_LATENCY, __VA_ARGS__) -/** - * lwsl_hexdump() - helper to hexdump a buffer (DEBUG builds only) - * - * \param buf: buffer start to dump - * \param len: length of buffer to dump - */ -LWS_VISIBLE LWS_EXTERN void lwsl_hexdump(void *buf, size_t len); #else /* no debug */ #if defined(LWS_WITH_NO_LOGS) -//#define lwsl_err(...) do {} while(0) #define lwsl_warn(...) do {} while(0) #define lwsl_notice(...) do {} while(0) #endif @@ -347,10 +310,44 @@ LWS_VISIBLE LWS_EXTERN void lwsl_hexdump(void *buf, size_t len); #define lwsl_ext(...) do {} while(0) #define lwsl_client(...) do {} while(0) #define lwsl_latency(...) do {} while(0) -#define lwsl_hexdump(a, b) #endif +/** + * lwsl_hexdump() - helper to hexdump a buffer + * + * \param level: one of LLL_ constants + * \param buf: buffer start to dump + * \param len: length of buffer to dump + * + * If \p level is visible, does a nice hexdump -C style dump of \p buf for + * \p len bytes. This can be extremely convenient while debugging. + */ +LWS_VISIBLE LWS_EXTERN void +lwsl_hexdump_level(int level, const void *vbuf, size_t len); + +/** + * lwsl_hexdump() - helper to hexdump a buffer (DEBUG builds only) + * + * \param buf: buffer start to dump + * \param len: length of buffer to dump + * + * Calls through to lwsl_hexdump_level(LLL_DEBUG, ... for compatability. + * It's better to use lwsl_hexdump_level(level, ... directly so you can control + * the visibility. + */ +LWS_VISIBLE LWS_EXTERN void +lwsl_hexdump(const void *buf, size_t len); + +/** + * lws_is_be() - returns nonzero if the platform is Big Endian + */ +static LWS_INLINE int lws_is_be(void) { + const int probe = ~0xff; + + return *(const char *)&probe; +} + /** * lws_set_log_level() - Set the logging bitfield * \param level: OR together the LLL_ debug contexts you want output from @@ -359,7 +356,8 @@ LWS_VISIBLE LWS_EXTERN void lwsl_hexdump(void *buf, size_t len); * the default stderr one. * * log level defaults to "err", "warn" and "notice" contexts enabled and - * emission on stderr. + * emission on stderr. If stderr is a tty (according to isatty()) then + * the output is coloured according to the log level using ANSI escapes. */ LWS_VISIBLE LWS_EXTERN void lws_set_log_level(int level, @@ -377,6 +375,18 @@ lws_set_log_level(int level, LWS_VISIBLE LWS_EXTERN void lwsl_emit_syslog(int level, const char *line); +/** + * lwsl_visible() - returns true if the log level should be printed + * + * \param level: one of LLL_ log level indexes + * + * This is useful if you have to do work to generate the log content, you + * can skip the work if the log level used to print it is not actually + * enabled at runtime. + */ +LWS_VISIBLE LWS_EXTERN int +lwsl_visible(int level); + ///@} @@ -423,30 +433,7 @@ struct lws_pollfd { #define LWS_POLLOUT (FD_WRITE) #else -#if defined(MBED_OPERATORS) -/* it's a class lws_conn * */ -typedef void * lws_sockfd_type; -typedef void * lws_filefd_type; -#define lws_sockfd_valid(sfd) (!!sfd) -struct pollfd { - lws_sockfd_type fd; /**< fd related to */ - short events; /**< which POLL... events to respond to */ - short revents; /**< which POLL... events occurred */ -}; -#define POLLIN 0x0001 -#define POLLPRI 0x0002 -#define POLLOUT 0x0004 -#define POLLERR 0x0008 -#define POLLHUP 0x0010 -#define POLLNVAL 0x0020 -struct lws; - -void * mbed3_create_tcp_stream_socket(void); -void mbed3_delete_tcp_stream_socket(void *sockfd); -void mbed3_tcp_stream_bind(void *sock, int port, struct lws *); -void mbed3_tcp_stream_accept(void *sock, struct lws *); -#else #if defined(LWS_WITH_ESP8266) #include @@ -476,7 +463,7 @@ void esp8266_tcp_stream_accept(lws_sockfd_type fd, struct lws *wsi); #include #include "ets_sys.h" -int ets_snprintf(char *str, size_t size, const char *format, ...); +int ets_snprintf(char *str, size_t size, const char *format, ...) LWS_FORMAT(3); #define snprintf ets_snprintf typedef os_timer_t uv_timer_t; @@ -512,6 +499,206 @@ static inline void uv_timer_stop(uv_timer_t *t) os_timer_disarm(t); } +#else +#if defined(LWS_WITH_ESP32) + +typedef int lws_sockfd_type; +typedef int lws_filefd_type; +#define lws_sockfd_valid(sfd) (sfd >= 0) +struct pollfd { + lws_sockfd_type fd; /**< fd related to */ + short events; /**< which POLL... events to respond to */ + short revents; /**< which POLL... events occurred */ +}; +#define POLLIN 0x0001 +#define POLLPRI 0x0002 +#define POLLOUT 0x0004 +#define POLLERR 0x0008 +#define POLLHUP 0x0010 +#define POLLNVAL 0x0020 + +#include +#include +#include +#include "esp_wifi.h" +#include "esp_system.h" +#include "esp_event.h" +#include "esp_event_loop.h" +#include "nvs.h" +#include "driver/gpio.h" +#include "esp_spi_flash.h" +#include "freertos/timers.h" + +#if !defined(CONFIG_FREERTOS_HZ) +#define CONFIG_FREERTOS_HZ 100 +#endif + +typedef TimerHandle_t uv_timer_t; +typedef void uv_cb_t(uv_timer_t *); +typedef void * uv_handle_t; + +struct timer_mapping { + uv_cb_t *cb; + uv_timer_t *t; +}; + +#define UV_VERSION_MAJOR 1 + +#define lws_uv_getloop(a, b) (NULL) + +static inline void uv_timer_init(void *l, uv_timer_t *t) +{ + (void)l; + *t = NULL; +} + +extern void esp32_uvtimer_cb(TimerHandle_t t); + +static inline void uv_timer_start(uv_timer_t *t, uv_cb_t *cb, int first, int rep) +{ + struct timer_mapping *tm = (struct timer_mapping *)malloc(sizeof(*tm)); + + if (!tm) + return; + + tm->t = t; + tm->cb = cb; + + *t = xTimerCreate("x", pdMS_TO_TICKS(first), !!rep, tm, + (TimerCallbackFunction_t)esp32_uvtimer_cb); + xTimerStart(*t, 0); +} + +static inline void uv_timer_stop(uv_timer_t *t) +{ + xTimerStop(*t, 0); +} + +static inline void uv_close(uv_handle_t *h, void *v) +{ + free(pvTimerGetTimerID((uv_timer_t)h)); + xTimerDelete(*(uv_timer_t *)h, 0); +} + +/* ESP32 helper declarations */ + +#include +#include + +#define LWS_PLUGIN_STATIC +#define LWS_MAGIC_REBOOT_TYPE_ADS 0x50001ffc +#define LWS_MAGIC_REBOOT_TYPE_REQ_FACTORY 0xb00bcafe +#define LWS_MAGIC_REBOOT_TYPE_FORCED_FACTORY 0xfaceb00b +#define LWS_MAGIC_REBOOT_TYPE_FORCED_FACTORY_BUTTON 0xf0cedfac + + +/* user code provides these */ + +extern void +lws_esp32_identify_physical_device(void); + +/* lws-plat-esp32 provides these */ + +typedef void (*lws_cb_scan_done)(uint16_t count, wifi_ap_record_t *recs, void *arg); + +enum genled_state { + LWSESP32_GENLED__INIT, + LWSESP32_GENLED__LOST_NETWORK, + LWSESP32_GENLED__NO_NETWORK, + LWSESP32_GENLED__CONN_AP, + LWSESP32_GENLED__GOT_IP, + LWSESP32_GENLED__OK, +}; + +struct lws_group_member { + struct lws_group_member *next; + uint64_t last_seen; + char model[16]; + char role[16]; + char host[32]; + char mac[20]; + int width, height; + struct ip4_addr addr; + struct ip6_addr addrv6; + uint8_t flags; +}; + +#define LWS_SYSTEM_GROUP_MEMBER_ADD 1 +#define LWS_SYSTEM_GROUP_MEMBER_CHANGE 2 +#define LWS_SYSTEM_GROUP_MEMBER_REMOVE 3 + +#define LWS_GROUP_FLAG_SELF 1 + +struct lws_esp32 { + char sta_ip[16]; + char sta_mask[16]; + char sta_gw[16]; + char serial[16]; + char opts[16]; + char model[16]; + char group[16]; + char role[16]; + char ssid[4][16]; + char password[4][32]; + char active_ssid[32]; + char access_pw[16]; + char hostname[32]; + char mac[20]; + mdns_server_t *mdns; + char region; + char inet; + char conn_ap; + + enum genled_state genled; + uint64_t genled_t; + + lws_cb_scan_done scan_consumer; + void *scan_consumer_arg; + struct lws_group_member *first; + int extant_group_members; +}; + +struct lws_esp32_image { + uint32_t romfs; + uint32_t romfs_len; + uint32_t json; + uint32_t json_len; +}; + +extern struct lws_esp32 lws_esp32; +struct lws_vhost; + +extern esp_err_t +lws_esp32_event_passthru(void *ctx, system_event_t *event); +extern void +lws_esp32_wlan_config(void); +extern void +lws_esp32_wlan_start_ap(void); +extern void +lws_esp32_wlan_start_station(void); +struct lws_context_creation_info; +extern void +lws_esp32_set_creation_defaults(struct lws_context_creation_info *info); +extern struct lws_context * +lws_esp32_init(struct lws_context_creation_info *, struct lws_vhost **pvh); +extern int +lws_esp32_wlan_nvs_get(int retry); +extern esp_err_t +lws_nvs_set_str(nvs_handle handle, const char* key, const char* value); +extern void +lws_esp32_restart_guided(uint32_t type); +extern const esp_partition_t * +lws_esp_ota_get_boot_partition(void); +extern int +lws_esp32_get_image_info(const esp_partition_t *part, struct lws_esp32_image *i, char *json, int json_len); +extern int +lws_esp32_leds_network_indication(void); + +extern uint32_t lws_esp32_get_reboot_type(void); +extern uint16_t lws_esp32_sine_interp(int n); + +/* required in external code by esp32 plat (may just return if no leds) */ +extern void lws_esp32_leds_timer_cb(TimerHandle_t th); #else typedef int lws_sockfd_type; typedef int lws_filefd_type; @@ -525,6 +712,36 @@ typedef int lws_filefd_type; #define LWS_POLLOUT (POLLOUT) #endif + +#if (defined(WIN32) || defined(_WIN32)) && !defined(__MINGW32__) +/* ... */ +#define ssize_t SSIZE_T +#endif + +#if defined(WIN32) && defined(LWS_HAVE__STAT32I64) +#include +#include +#endif + +#if defined(LWS_HAVE_STDINT_H) +#include +#else +#if defined(WIN32) || defined(_WIN32) +/* !!! >:-[ */ +typedef unsigned __int32 uint32_t; +typedef unsigned __int16 uint16_t; +typedef unsigned __int8 uint8_t; +#else +typedef unsigned int uint32_t; +typedef unsigned short uint16_t; +typedef unsigned char uint8_t; +#endif +#endif + +typedef unsigned long long lws_filepos_t; +typedef long long lws_fileofs_t; +typedef uint32_t lws_fop_flags_t; + /** struct lws_pollargs - argument structure for all external poll related calls * passed in via 'in' */ struct lws_pollargs { @@ -641,6 +858,38 @@ struct lws_context; /* needed even with extensions disabled for create context */ struct lws_extension; +/*! \defgroup lwsmeta lws-meta + * + * ##lws-meta protocol + * + * The protocol wraps other muxed connections inside one tcp connection. + * + * Commands are assigned from 0x41 up (so they are valid unicode) + */ +///@{ + +enum lws_meta_commands { + LWS_META_CMD_OPEN_SUBCHANNEL = 'A', + /**< Client requests to open new subchannel + */ + LWS_META_CMD_OPEN_RESULT, + /**< Result of client request to open new subchannel */ + LWS_META_CMD_CLOSE_NOTIFY, + /**< Notification of subchannel closure */ + LWS_META_CMD_CLOSE_RQ, + /**< client requests to close a subchannel */ + LWS_META_CMD_WRITE, + /**< connection writes something to specific channel index */ + + /****** add new things just above ---^ ******/ +}; + +/* channel numbers are transported offset by 0x20 so they are valid unicode */ + +#define LWS_META_TRANSPORT_OFFSET 0x20 + +///@} + /*! \defgroup usercb User Callback * * ##User protocol callback @@ -654,6 +903,10 @@ struct lws_extension; */ ///@{ +struct lws_ssl_info { + int where; + int ret; +}; /* * NOTE: These public enums are part of the abi. If you want to add one, @@ -820,7 +1073,7 @@ enum lws_callback_reasons { LWS_CALLBACK_OPENSSL_LOAD_EXTRA_SERVER_VERIFY_CERTS = 22, /**< if configured for * including OpenSSL support, this callback allows your user code - * to load extra certifcates into the server which allow it to + * to load extra certificates into the server which allow it to * verify the validity of certificates returned by clients. user * is the server's OpenSSL SSL_CTX* */ LWS_CALLBACK_OPENSSL_PERFORM_CLIENT_CERT_VERIFICATION = 23, @@ -874,8 +1127,7 @@ enum lws_callback_reasons { * and with in being the extension name, len is 0 and user is * valid. Note though at this time the ESTABLISHED callback hasn't * happened yet so if you initialize user content there, user - * content during this callback might not be useful for anything. - * Notice this callback comes to protocols[0]. */ + * content during this callback might not be useful for anything. */ LWS_CALLBACK_CLIENT_CONFIRM_EXTENSION_SUPPORTED = 26, /**< When a client * connection is being prepared to start a handshake to a server, @@ -966,45 +1218,127 @@ enum lws_callback_reasons { * connection. */ LWS_CALLBACK_WS_EXT_DEFAULTS = 39, - /**< */ + /**< Gives client connections an opportunity to adjust negotiated + * extension defaults. `user` is the extension name that was + * negotiated (eg, "permessage-deflate"). `in` points to a + * buffer and `len` is the buffer size. The user callback can + * set the buffer to a string describing options the extension + * should parse. Or just ignore for defaults. */ LWS_CALLBACK_CGI = 40, - /**< */ + /**< CGI: CGI IO events on stdin / out / err are sent here on + * protocols[0]. The provided `lws_callback_http_dummy()` + * handles this and the callback should be directed there if + * you use CGI. */ LWS_CALLBACK_CGI_TERMINATED = 41, - /**< */ + /**< CGI: The related CGI process ended, this is called before + * the wsi is closed. Used to, eg, terminate chunking. + * The provided `lws_callback_http_dummy()` + * handles this and the callback should be directed there if + * you use CGI. The child PID that terminated is in len. */ LWS_CALLBACK_CGI_STDIN_DATA = 42, - /**< */ + /**< CGI: Data is, to be sent to the CGI process stdin, eg from + * a POST body. The provided `lws_callback_http_dummy()` + * handles this and the callback should be directed there if + * you use CGI. */ LWS_CALLBACK_CGI_STDIN_COMPLETED = 43, - /**< */ + /**< CGI: no more stdin is coming. The provided + * `lws_callback_http_dummy()` handles this and the callback + * should be directed there if you use CGI. */ LWS_CALLBACK_ESTABLISHED_CLIENT_HTTP = 44, - /**< */ + /**< The HTTP client connection has succeeded, and is now + * connected to the server */ LWS_CALLBACK_CLOSED_CLIENT_HTTP = 45, - /**< */ + /**< The HTTP client connection is closing */ LWS_CALLBACK_RECEIVE_CLIENT_HTTP = 46, - /**< */ + /**< This simply indicates data was received on the HTTP client + * connection. It does NOT drain or provide the data. + * This exists to neatly allow a proxying type situation, + * where this incoming data will go out on another connection. + * If the outgoing connection stalls, we should stall processing + * the incoming data. So a handler for this in that case should + * simply set a flag to indicate there is incoming data ready + * and ask for a writeable callback on the outgoing connection. + * In the writable callback he can check the flag and then get + * and drain the waiting incoming data using lws_http_client_read(). + * This will use callbacks to LWS_CALLBACK_RECEIVE_CLIENT_HTTP_READ + * to get and drain the incoming data, where it should be sent + * back out on the outgoing connection. */ LWS_CALLBACK_COMPLETED_CLIENT_HTTP = 47, - /**< */ + /**< The client transaction completed... at the moment this + * is the same as closing since transaction pipelining on + * client side is not yet supported. */ LWS_CALLBACK_RECEIVE_CLIENT_HTTP_READ = 48, - /**< */ + /**< This is generated by lws_http_client_read() used to drain + * incoming data. In the case the incoming data was chunked, + * it will be split into multiple smaller callbacks for each + * chunk block, removing the chunk headers. If not chunked, + * it will appear all in one callback. */ LWS_CALLBACK_HTTP_BIND_PROTOCOL = 49, - /**< */ + /**< By default, all HTTP handling is done in protocols[0]. + * However you can bind different protocols (by name) to + * different parts of the URL space using callback mounts. This + * callback occurs in the new protocol when a wsi is bound + * to that protocol. Any protocol allocation related to the + * http transaction processing should be created then. + * These specific callbacks are necessary because with HTTP/1.1, + * a single connection may perform at series of different + * transactions at different URLs, thus the lifetime of the + * protocol bind is just for one transaction, not connection. */ LWS_CALLBACK_HTTP_DROP_PROTOCOL = 50, - /**< */ + /**< This is called when a transaction is unbound from a protocol. + * It indicates the connection completed its transaction and may + * do something different now. Any protocol allocation related + * to the http transaction processing should be destroyed. */ LWS_CALLBACK_CHECK_ACCESS_RIGHTS = 51, - /**< */ + /**< This gives the user code a chance to forbid an http access. + * `in` points to a `struct lws_process_html_args`, which + * describes the URL, and a bit mask describing the type of + * authentication required. If the callback returns nonzero, + * the transaction ends with HTTP_STATUS_UNAUTHORIZED. */ LWS_CALLBACK_PROCESS_HTML = 52, - /**< */ + /**< This gives your user code a chance to mangle outgoing + * HTML. `in` points to a `struct lws_process_html_args` + * which describes the buffer containing outgoing HTML. + * The buffer may grow up to `.max_len` (currently +128 + * bytes per buffer). + * */ LWS_CALLBACK_ADD_HEADERS = 53, - /**< */ + /**< This gives your user code a chance to add headers to a + * transaction bound to your protocol. `in` points to a + * `struct lws_process_html_args` describing a buffer and length + * you can add headers into using the normal lws apis. + * + * Only `args->p` and `args->len` are valid, and `args->p` should + * be moved on by the amount of bytes written, if any. Eg + * + * case LWS_CALLBACK_ADD_HEADERS: + * + * struct lws_process_html_args *args = + * (struct lws_process_html_args *)in; + * + * if (lws_add_http_header_by_name(wsi, + * (unsigned char *)"set-cookie:", + * (unsigned char *)cookie, cookie_len, + * (unsigned char **)&args->p, + * (unsigned char *)args->p + args->max_len)) + * return 1; + * + * break; + */ LWS_CALLBACK_SESSION_INFO = 54, - /**< */ + /**< This is only generated by user code using generic sessions. + * It's used to get a `struct lws_session_info` filled in by + * generic sessions with information about the logged-in user. + * See the messageboard sample for an example of how to use. */ LWS_CALLBACK_GS_EVENT = 55, - /**< */ + /**< Indicates an event happened to the Generic Sessions session. + * `in` contains a `struct lws_gs_event_args` describing the event. */ LWS_CALLBACK_HTTP_PMO = 56, /**< per-mount options for this connection, called before * the normal LWS_CALLBACK_HTTP when the mount has per-mount - * options + * options. */ LWS_CALLBACK_CLIENT_HTTP_WRITEABLE = 57, /**< when doing an HTTP type client connection, you can call @@ -1015,11 +1349,76 @@ enum lws_callback_reasons { * From this callback, when you have sent everything, you should let * lws know by calling lws_client_http_body_pending(wsi, 0) */ + LWS_CALLBACK_OPENSSL_PERFORM_SERVER_CERT_VERIFICATION = 58, + /**< Similar to LWS_CALLBACK_OPENSSL_PERFORM_CLIENT_CERT_VERIFICATION + * this callback is called during OpenSSL verification of the cert + * sent from the server to the client. It is sent to protocol[0] + * callback as no protocol has been negotiated on the connection yet. + * Notice that the wsi is set because lws_client_connect_via_info was + * successful. + * + * See http://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html + * to understand more detail about the OpenSSL callback that + * generates this libwebsockets callback and the meanings of the + * arguments passed. In this callback, user is the x509_ctx, + * in is the ssl pointer and len is preverify_ok. + * + * THIS IS NOT RECOMMENDED BUT if a cert validation error shall be + * overruled and cert shall be accepted as ok, + * X509_STORE_CTX_set_error((X509_STORE_CTX*)user, X509_V_OK); must be + * called and return value must be 0 to mean the cert is OK; + * returning 1 will fail the cert in any case. + * + * This also means that if you don't handle this callback then + * the default callback action of returning 0 will not accept the + * certificate in case of a validation error decided by the SSL lib. + * + * This is expected and secure behaviour when validating certificates. + * + * Note: LCCSCF_ALLOW_SELFSIGNED and + * LCCSCF_SKIP_SERVER_CERT_HOSTNAME_CHECK still work without this + * callback being implemented. + */ + LWS_CALLBACK_RAW_RX = 59, + /**< RAW mode connection RX */ + LWS_CALLBACK_RAW_CLOSE = 60, + /**< RAW mode connection is closing */ + LWS_CALLBACK_RAW_WRITEABLE = 61, + /**< RAW mode connection may be written */ + LWS_CALLBACK_RAW_ADOPT = 62, + /**< RAW mode connection was adopted (equivalent to 'wsi created') */ + LWS_CALLBACK_RAW_ADOPT_FILE = 63, + /**< RAW mode file was adopted (equivalent to 'wsi created') */ + LWS_CALLBACK_RAW_RX_FILE = 64, + /**< RAW mode file has something to read */ + LWS_CALLBACK_RAW_WRITEABLE_FILE = 65, + /**< RAW mode file is writeable */ + LWS_CALLBACK_RAW_CLOSE_FILE = 66, + /**< RAW mode wsi that adopted a file is closing */ + LWS_CALLBACK_SSL_INFO = 67, + /**< SSL connections only. An event you registered an + * interest in at the vhost has occurred on a connection + * using the vhost. in is a pointer to a + * struct lws_ssl_info containing information about the + * event*/ + LWS_CALLBACK_CHILD_WRITE_VIA_PARENT = 68, + /**< Child has been marked with parent_carries_io attribute, so + * lws_write directs the to this callback at the parent, + * in is a struct lws_write_passthru containing the args + * the lws_write() was called with. + */ + LWS_CALLBACK_CHILD_CLOSING = 69, + /**< Sent to parent to notify them a child is closing / being + * destroyed. in is the child wsi. + */ + LWS_CALLBACK_CGI_PROCESS_ATTACH = 70, + /**< CGI: Sent when the CGI process is spawned for the wsi. The + * len parameter is the PID of the child process */ /****** add new things just above ---^ ******/ LWS_CALLBACK_USER = 1000, - /**< user code can use any including / above without fear of clashes */ + /**< user code can use any including above without fear of clashes */ }; @@ -1042,10 +1441,99 @@ enum lws_callback_reasons { typedef int lws_callback_function(struct lws *wsi, enum lws_callback_reasons reason, void *user, void *in, size_t len); + +#define LWS_CB_REASON_AUX_BF__CGI 1 +#define LWS_CB_REASON_AUX_BF__PROXY 2 +#define LWS_CB_REASON_AUX_BF__CGI_CHUNK_END 4 +#define LWS_CB_REASON_AUX_BF__CGI_HEADERS 8 ///@} -/*! \defgroup extensions +/*! \defgroup generic hash + * ## Generic Hash related functions * + * Lws provides generic hash / digest accessors that abstract the ones + * provided by whatever OpenSSL library you are linking against. + * + * It lets you use the same code if you build against mbedtls or OpenSSL + * for example. + */ +///@{ + +#ifdef LWS_OPENSSL_SUPPORT + +#if defined(LWS_WITH_MBEDTLS) +#include +#include +#include +#endif + +#define LWS_GENHASH_TYPE_SHA1 0 +#define LWS_GENHASH_TYPE_SHA256 1 +#define LWS_GENHASH_TYPE_SHA512 2 + +struct lws_genhash_ctx { + uint8_t type; +#if defined(LWS_WITH_MBEDTLS) + union { + mbedtls_sha1_context sha1; + mbedtls_sha256_context sha256; + mbedtls_sha512_context sha512; + } u; +#else + const EVP_MD *evp_type; + EVP_MD_CTX *mdctx; +#endif +}; + +/** lws_genhash_size() - get hash size in bytes + * + * \param type: one of LWS_GENHASH_TYPE_... + * + * Returns number of bytes in this type of hash + */ +LWS_VISIBLE LWS_EXTERN size_t LWS_WARN_UNUSED_RESULT +lws_genhash_size(int type); + +/** lws_genhash_init() - prepare your struct lws_genhash_ctx for use + * + * \param ctx: your struct lws_genhash_ctx + * \param type: one of LWS_GENHASH_TYPE_... + * + * Initializes the hash context for the type you requested + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_genhash_init(struct lws_genhash_ctx *ctx, int type); + +/** lws_genhash_update() - digest len bytes of the buffer starting at in + * + * \param ctx: your struct lws_genhash_ctx + * \param in: start of the bytes to digest + * \param len: count of bytes to digest + * + * Updates the state of your hash context to reflect digesting len bytes from in + */ +LWS_VISIBLE LWS_EXTERN int LWS_WARN_UNUSED_RESULT +lws_genhash_update(struct lws_genhash_ctx *ctx, const void *in, size_t len); + +/** lws_genhash_destroy() - copy out the result digest and destroy the ctx + * + * \param ctx: your struct lws_genhash_ctx + * \param result: NULL, or where to copy the result hash + * + * Finalizes the hash and copies out the digest. Destroys any allocations such + * that ctx can safely go out of scope after calling this. + * + * NULL result is supported so that you can destroy the ctx cleanly on error + * conditions, where there is no valid result. + */ +LWS_VISIBLE LWS_EXTERN int +lws_genhash_destroy(struct lws_genhash_ctx *ctx, void *result); + +#endif + +///@} + +/*! \defgroup extensions Extension related functions * ##Extension releated functions * * Ws defines optional extensions, lws provides the ability to implement these @@ -1217,7 +1705,7 @@ lws_set_extension_option(struct lws *wsi, const char *ext_name, * client and server for how to do. */ static LWS_INLINE LWS_WARN_DEPRECATED const struct lws_extension * -lws_get_internal_extensions() { return NULL; } +lws_get_internal_extensions(void) { return NULL; } /** * lws_ext_parse_options() - deal with parsing negotiated extension options @@ -1297,8 +1785,8 @@ struct lws_protocols { * be able to consume it all without having to return to the event * loop. That is supported in lws. * - * This also controls how much may be sent at once at the moment, - * although this is likely to change. + * If .tx_packet_size is 0, this also controls how much may be sent at once + * for backwards compatibility. */ unsigned int id; /**< ignored by lws, but useful to contain user information bound @@ -1309,6 +1797,15 @@ struct lws_protocols { * capability flags based on selected protocol version, etc. */ void *user; /**< ignored by lws, but user code can pass a pointer here it can later access from the protocol callback */ + size_t tx_packet_size; + /**< 0 indicates restrict send() size to .rx_buffer_size for backwards- + * compatibility. + * If greater than zero, a single send() is restricted to this amount + * and any remainder is buffered by lws and sent afterwards also in + * these size chunks. Since that is expensive, it's preferable + * to restrict one fragment you are trying to send to match this + * size. + */ /* Add new things just above here ---^ * This is part of the ABI, don't needlessly break compatibility */ @@ -1369,6 +1866,23 @@ lws_protocol_vh_priv_zalloc(struct lws_vhost *vhost, const struct lws_protocols LWS_VISIBLE LWS_EXTERN void * lws_protocol_vh_priv_get(struct lws_vhost *vhost, const struct lws_protocols *prot); +/** + * lws_adjust_protocol_psds - change a vhost protocol's per session data size + * + * \param wsi: a connection with the protocol to change + * \param new_size: the new size of the per session data size for the protocol + * + * Returns user_space for the wsi, after allocating + * + * This should not be used except to initalize a vhost protocol's per session + * data size one time, before any connections are accepted. + * + * Sometimes the protocol wraps another protocol and needs to discover and set + * its per session data size at runtime. + */ +LWS_VISIBLE LWS_EXTERN void * +lws_adjust_protocol_psds(struct lws *wsi, size_t new_size); + /** * lws_finalize_startup() - drop initial process privileges * @@ -1380,6 +1894,9 @@ lws_protocol_vh_priv_get(struct lws_vhost *vhost, const struct lws_protocols *pr LWS_VISIBLE LWS_EXTERN int lws_finalize_startup(struct lws_context *context); +LWS_VISIBLE LWS_EXTERN int +lws_protocol_init(struct lws_context *context); + #ifdef LWS_WITH_PLUGINS /* PLUGINS implies LIBUV */ @@ -1469,10 +1986,10 @@ struct lws_gs_event_args { ///@} -/*! \defgroup context-and-vhost +/*! \defgroup context-and-vhost context and vhost related functions + * ##Context and Vhost releated functions * \ingroup lwsapi * - * ##Context and Vhost releated functions * * LWS requires that there is one context, in which you may define multiple * vhosts. Each vhost is a virtual host, with either its own listen port @@ -1543,12 +2060,42 @@ enum lws_context_options { * even if it happened without a debugger in place. You can disable * that by giving this option. */ + LWS_SERVER_OPTION_JUST_USE_RAW_ORIGIN = (1 << 19), + /**< For backwards-compatibility reasons, by default + * lws prepends "http://" to the origin you give in the client + * connection info struct. If you give this flag when you create + * the context, only the string you give in the client connect + * info for .origin (if any) will be used directly. + */ + LWS_SERVER_OPTION_FALLBACK_TO_RAW = (1 << 20), + /**< (VH) if invalid http is coming in the first line, */ + LWS_SERVER_OPTION_LIBEVENT = (1 << 21), + /**< (CTX) Use libevent event loop */ + LWS_SERVER_OPTION_ONLY_RAW = (1 << 22), + /**< (VH) All connections to this vhost / port are RAW as soon as + * the connection is accepted, no HTTP is going to be coming. + */ + LWS_SERVER_OPTION_ALLOW_LISTEN_SHARE = (1 << 23), + /**< (VH) Set to allow multiple listen sockets on one interface + + * address + port. The default is to strictly allow only one + * listen socket at a time. This is automatically selected if you + * have multiple service threads. + */ + LWS_SERVER_OPTION_CREATE_VHOST_SSL_CTX = (1 << 24), + /**< (VH) Force setting up the vhost SSL_CTX, even though the user + * code doesn't explicitly provide a cert in the info struct. It + * implies the user code is going to provide a cert at the + * LWS_CALLBACK_OPENSSL_LOAD_EXTRA_SERVER_VERIFY_CERTS callback, which + * provides the vhost SSL_CTX * in the user parameter. + */ /****** add new things just above ---^ ******/ }; #define lws_check_opt(c, f) (((c) & (f)) == (f)) +struct lws_plat_file_ops; + /** struct lws_context_creation_info - parameters to create context and /or vhost with * * This is also used to create vhosts.... if LWS_SERVER_OPTION_EXPLICIT_VHOSTS @@ -1560,10 +2107,10 @@ enum lws_context_options { */ struct lws_context_creation_info { int port; - /**< VHOST: Port to listen on... you can use CONTEXT_PORT_NO_LISTEN to - * suppress listening on any port, that's what you want if you are - * not running a websocket server at all but just using it as a - * client */ + /**< VHOST: Port to listen on. Use CONTEXT_PORT_NO_LISTEN to suppress + * listening for a client. Use CONTEXT_PORT_NO_LISTEN_SERVER if you are + * writing a server but you are using \ref sock-adopt instead of the + * built-in listener */ const char *iface; /**< VHOST: NULL to bind the listen socket to all interfaces, or the * interface name, eg, "eth2" @@ -1582,23 +2129,38 @@ struct lws_context_creation_info { /**< CONTEXT: NULL or struct lws_token_limits pointer which is initialized * with a token length limit for each possible WSI_TOKEN_ */ const char *ssl_private_key_password; - /**< VHOST: NULL or the passphrase needed for the private key */ + /**< VHOST: NULL or the passphrase needed for the private key. (For + * backwards compatibility, this can also be used to pass the client + * cert passphrase when setting up a vhost client SSL context, but it is + * preferred to use .client_ssl_private_key_password for that.) */ const char *ssl_cert_filepath; /**< VHOST: If libwebsockets was compiled to use ssl, and you want * to listen using SSL, set to the filepath to fetch the - * server cert from, otherwise NULL for unencrypted */ + * server cert from, otherwise NULL for unencrypted. (For backwards + * compatibility, this can also be used to pass the client certificate + * when setting up a vhost client SSL context, but it is preferred to + * use .client_ssl_cert_filepath for that.) */ const char *ssl_private_key_filepath; /**< VHOST: filepath to private key if wanting SSL mode; - * if this is set to NULL but sll_cert_filepath is set, the + * if this is set to NULL but ssl_cert_filepath is set, the * OPENSSL_CONTEXT_REQUIRES_PRIVATE_KEY callback is called * to allow setting of the private key directly via openSSL - * library calls */ + * library calls. (For backwards compatibility, this can also be used + * to pass the client cert private key filepath when setting up a + * vhost client SSL context, but it is preferred to use + * .client_ssl_private_key_filepath for that.) */ const char *ssl_ca_filepath; - /**< VHOST: CA certificate filepath or NULL */ + /**< VHOST: CA certificate filepath or NULL. (For backwards + * compatibility, this can also be used to pass the client CA + * filepath when setting up a vhost client SSL context, + * but it is preferred to use .client_ssl_ca_filepath for that.) */ const char *ssl_cipher_list; /**< VHOST: List of valid ciphers to use (eg, * "RC4-MD5:RC4-SHA:AES128-SHA:AES256-SHA:HIGH:!DSS:!aNULL" - * or you can leave it as NULL to get "DEFAULT" */ + * or you can leave it as NULL to get "DEFAULT" (For backwards + * compatibility, this can also be used to pass the client cipher + * list when setting up a vhost client SSL context, + * but it is preferred to use .client_ssl_cipher_list for that.)*/ const char *http_proxy_address; /**< VHOST: If non-NULL, attempts to proxy via the given address. * If proxy auth is required, use format "username:password\@server:port" */ @@ -1611,8 +2173,14 @@ struct lws_context_creation_info { unsigned int options; /**< VHOST + CONTEXT: 0, or LWS_SERVER_OPTION_... bitfields */ void *user; - /**< CONTEXT: optional user pointer that can be recovered via the context - * pointer using lws_context_user */ + /**< VHOST + CONTEXT: optional user pointer that will be associated + * with the context when creating the context (and can be retrieved by + * lws_context_user(context), or with the vhost when creating the vhost + * (and can be retrieved by lws_vhost_user(vhost)). You will need to + * use LWS_SERVER_OPTION_EXPLICIT_VHOSTS and create the vhost separately + * if you care about giving the context and vhost different user pointer + * values. + */ int ka_time; /**< CONTEXT: 0 for no TCP keepalive, otherwise apply this keepalive * timeout to all libwebsocket sockets, client or server */ @@ -1708,6 +2276,110 @@ struct lws_context_creation_info { /**< VHOST: pointer to optional linked list of per-vhost * canned headers that are added to server responses */ + const struct lws_protocol_vhost_options *reject_service_keywords; + /**< CONTEXT: Optional list of keywords and rejection codes + text. + * + * The keywords are checked for existing in the user agent string. + * + * Eg, "badrobot" "404 Not Found" + */ + void *external_baggage_free_on_destroy; + /**< CONTEXT: NULL, or pointer to something externally malloc'd, that + * should be freed when the context is destroyed. This allows you to + * automatically sync the freeing action to the context destruction + * action, so there is no need for an external free() if the context + * succeeded to create. + */ + + const char *client_ssl_private_key_password; + /**< VHOST: Client SSL context init: NULL or the passphrase needed + * for the private key */ + const char *client_ssl_cert_filepath; + /**< VHOST: Client SSL context init:T he certificate the client + * should present to the peer on connection */ + const char *client_ssl_private_key_filepath; + /**< VHOST: Client SSL context init: filepath to client private key + * if this is set to NULL but client_ssl_cert_filepath is set, you + * can handle the LWS_CALLBACK_OPENSSL_LOAD_EXTRA_CLIENT_VERIFY_CERTS + * callback of protocols[0] to allow setting of the private key directly + * via openSSL library calls */ + const char *client_ssl_ca_filepath; + /**< VHOST: Client SSL context init: CA certificate filepath or NULL */ + const char *client_ssl_cipher_list; + /**< VHOST: Client SSL context init: List of valid ciphers to use (eg, + * "RC4-MD5:RC4-SHA:AES128-SHA:AES256-SHA:HIGH:!DSS:!aNULL" + * or you can leave it as NULL to get "DEFAULT" */ + + const struct lws_plat_file_ops *fops; + /**< CONTEXT: NULL, or pointer to an array of fops structs, terminated + * by a sentinel with NULL .open. + * + * If NULL, lws provides just the platform file operations struct for + * backwards compatibility. + */ + int simultaneous_ssl_restriction; + /**< CONTEXT: 0 (no limit) or limit of simultaneous SSL sessions possible.*/ + const char *socks_proxy_address; + /**< VHOST: If non-NULL, attempts to proxy via the given address. + * If proxy auth is required, use format "username:password\@server:port" */ + unsigned int socks_proxy_port; + /**< VHOST: If socks_proxy_address was non-NULL, uses this port */ +#if defined(LWS_HAVE_SYS_CAPABILITY_H) && defined(LWS_HAVE_LIBCAP) + cap_value_t caps[4]; + /**< CONTEXT: array holding Linux capabilities you want to + * continue to be available to the server after it transitions + * to a noprivileged user. Usually none are needed but for, eg, + * .bind_iface, CAP_NET_RAW is required. This gives you a way + * to still have the capability but drop root. + */ + char count_caps; + /**< CONTEXT: count of Linux capabilities in .caps[]. 0 means + * no capabilities will be inherited from root (the default) */ +#endif + int bind_iface; + /**< VHOST: nonzero to strictly bind sockets to the interface name in + * .iface (eg, "eth2"), using SO_BIND_TO_DEVICE. + * + * Requires SO_BINDTODEVICE support from your OS and CAP_NET_RAW + * capability. + * + * Notice that common things like access network interface IP from + * your local machine use your lo / loopback interface and will be + * disallowed by this. + */ + int ssl_info_event_mask; + /**< VHOST: mask of ssl events to be reported on LWS_CALLBACK_SSL_INFO + * callback for connections on this vhost. The mask values are of + * the form SSL_CB_ALERT, defined in openssl/ssl.h. The default of + * 0 means no info events will be reported. + */ + unsigned int timeout_secs_ah_idle; + /**< VHOST: seconds to allow a client to hold an ah without using it. + * 0 defaults to 10s. */ + unsigned short ip_limit_ah; + /**< CONTEXT: max number of ah a single IP may use simultaneously + * 0 is no limit. This is a soft limit: if the limit is + * reached, connections from that IP will wait in the ah + * waiting list and not be able to acquire an ah until + * a connection belonging to the IP relinquishes one it + * already has. + */ + unsigned short ip_limit_wsi; + /**< CONTEXT: max number of wsi a single IP may use simultaneously. + * 0 is no limit. This is a hard limit, connections from + * the same IP will simply be dropped once it acquires the + * amount of simultaneous wsi / accepted connections + * given here. + */ + uint32_t http2_settings[7]; + /**< CONTEXT: after context creation http2_settings[1] thru [6] have + * been set to the lws platform default values. + * VHOST: if http2_settings[0] is nonzero, the values given in + * http2_settings[1]..[6] are used instead of the lws + * platform default values. + * Just leave all at 0 if you don't care. + */ + /* Add new things just above here ---^ * This is part of the ABI, don't needlessly break compatibility * @@ -1744,7 +2416,7 @@ struct lws_context_creation_info { * * HTTP requests are sent always to the FIRST protocol in protocol, since * at that time websocket protocol has not been negotiated. Other - * protocols after the first one never see any HTTP callack activity. + * protocols after the first one never see any HTTP callback activity. * * The server created is a simple http server by default; part of the * websocket standard is upgrading this http connection to a websocket one. @@ -1767,6 +2439,43 @@ lws_create_context(struct lws_context_creation_info *info); LWS_VISIBLE LWS_EXTERN void lws_context_destroy(struct lws_context *context); +LWS_VISIBLE LWS_EXTERN void +lws_context_destroy2(struct lws_context *context); + +typedef int (*lws_reload_func)(void); + +/** + * lws_context_deprecate() - Deprecate the websocket context + * + * \param context: Websocket context + * \param cb: Callback notified when old context listen sockets are closed + * + * This function is used on an existing context before superceding it + * with a new context. + * + * It closes any listen sockets in the context, so new connections are + * not possible. + * + * And it marks the context to be deleted when the number of active + * connections into it falls to zero. + * + * Otherwise if you attach the deprecated context to the replacement + * context when it has been created using lws_context_attach_deprecated() + * both any deprecated and the new context will service their connections. + * + * This is aimed at allowing seamless configuration reloads. + * + * The callback cb will be called after the listen sockets are actually + * closed and may be reopened. In the callback the new context should be + * configured and created. (With libuv, socket close happens async after + * more loop events). + */ +LWS_VISIBLE LWS_EXTERN void +lws_context_deprecate(struct lws_context *context, lws_reload_func cb); + +LWS_VISIBLE LWS_EXTERN int +lws_context_is_deprecated(struct lws_context *context); + /** * lws_set_proxy() - Setups proxy to lws_context. * \param vhost: pointer to struct lws_vhost you want set proxy for @@ -1787,6 +2496,25 @@ lws_context_destroy(struct lws_context *context); LWS_VISIBLE LWS_EXTERN int lws_set_proxy(struct lws_vhost *vhost, const char *proxy); +/** + * lws_set_socks() - Setup socks to lws_context. + * \param vhost: pointer to struct lws_vhost you want set socks for + * \param socks: pointer to c string containing socks in format address:port + * + * Returns 0 if socks string was parsed and socks was setup. + * Returns -1 if socks is NULL or has incorrect format. + * + * This is only required if your OS does not provide the socks_proxy + * environment variable (eg, OSX) + * + * IMPORTANT! You should call this function right after creation of the + * lws_context and before call to connect. If you call this + * function after connect behavior is undefined. + * This function will override proxy settings made on lws_context + * creation with genenv() call. + */ +LWS_VISIBLE LWS_EXTERN int +lws_set_socks(struct lws_vhost *vhost, const char *socks); struct lws_vhost; @@ -1799,10 +2527,26 @@ struct lws_vhost; * members of the info struct. You can create many vhosts inside one context * if you created the context with the option LWS_SERVER_OPTION_EXPLICIT_VHOSTS */ -LWS_EXTERN LWS_VISIBLE struct lws_vhost * +LWS_VISIBLE LWS_EXTERN struct lws_vhost * lws_create_vhost(struct lws_context *context, struct lws_context_creation_info *info); +/** + * lws_vhost_destroy() - Destroy a vhost (virtual server context) + * + * \param vh: pointer to result of lws_create_vhost() + * + * This function destroys a vhost. Normally, if you just want to exit, + * then lws_destroy_context() will take care of everything. If you want + * to destroy an individual vhost and all connections and allocations, you + * can do it with this. + * + * If the vhost has a listen sockets shared by other vhosts, it will be given + * to one of the vhosts sharing it rather than closed. + */ +LWS_VISIBLE LWS_EXTERN void +lws_vhost_destroy(struct lws_vhost *vh); + /** * lwsws_get_config_globals() - Parse a JSON server config file * \param info: pointer to struct with parameters @@ -1869,9 +2613,24 @@ lws_json_dump_vhost(const struct lws_vhost *vh, char *buf, int len); * \param context: the context * \param buf: buffer to fill with JSON * \param len: max length of buf + * \param hide_vhosts: nonzero to not provide per-vhost mount etc information + * + * Generates a JSON description of vhost state into buf */ LWS_VISIBLE LWS_EXTERN int -lws_json_dump_context(const struct lws_context *context, char *buf, int len); +lws_json_dump_context(const struct lws_context *context, char *buf, int len, + int hide_vhosts); + +/** + * lws_vhost_user() - get the user data associated with the vhost + * \param vhost: Websocket vhost + * + * This returns the optional user pointer that can be attached to + * a vhost when it was created. Lws never dereferences this pointer, it only + * sets it when the vhost is created, and returns it using this api. + */ +LWS_VISIBLE LWS_EXTERN void * +lws_vhost_user(struct lws_vhost *vhost); /** * lws_context_user() - get the user data associated with the context @@ -1909,8 +2668,8 @@ struct lws_protocol_vhost_options { * served from a filesystem, or it is a cgi etc. */ enum lws_mount_protocols { - LWSMPRO_HTTP = 0, /**< not supported yet */ - LWSMPRO_HTTPS = 1, /**< not supported yet */ + LWSMPRO_HTTP = 0, /**< http reverse proxy */ + LWSMPRO_HTTPS = 1, /**< https reverse proxy */ LWSMPRO_FILE = 2, /**< serve from filesystem directory */ LWSMPRO_CGI = 3, /**< pass to CGI to handle */ LWSMPRO_REDIR_HTTP = 4, /**< redirect to http:// url */ @@ -1956,14 +2715,27 @@ struct lws_http_mount { unsigned char origin_protocol; /**< one of enum lws_mount_protocols */ unsigned char mountpoint_len; /**< length of mountpoint string */ + + const char *basic_auth_login_file; + /**nxt; \ + } \ +} + +/** + * lws_start_foreach_llp(): linkedlist pointer iterator helper start + * + * \param type: type of iteration, eg, struct xyz ** + * \param it: iterator var name to create + * \param start: start of list + * + * This helper creates an iterator and starts a while (it) { + * loop. The iterator runs through the linked list starting at the + * address of start and ends when it gets a NULL. + * The while loop should be terminated using lws_start_foreach_llp(). + * + * This helper variant iterates using a pointer to the previous linked-list + * element. That allows you to easily delete list members by rewriting the + * previous pointer to the element's next pointer. + */ +#define lws_start_foreach_llp(type, it, start)\ +{ \ + type it = &(start); \ + while (*(it)) { + +/** + * lws_end_foreach_llp(): linkedlist pointer iterator helper end + * + * \param it: same iterator var name given when starting + * \param nxt: member name in the iterator pointing to next list element + * + * This helper is the partner for lws_start_foreach_llp() that ends the + * while loop. + */ + +#define lws_end_foreach_llp(it, nxt) \ + it = &(*(it))->nxt; \ + } \ +} + /** * lws_snprintf(): snprintf that truncates the returned length too * @@ -3620,7 +4729,7 @@ lws_interface_to_sa(int ipv6, const char *ifname, struct sockaddr_in *addr, * reach the limit the reported length doesn't exceed the limit. */ LWS_VISIBLE LWS_EXTERN int -lws_snprintf(char *str, size_t size, const char *format, ...); +lws_snprintf(char *str, size_t size, const char *format, ...) LWS_FORMAT(3); /** * lws_get_random(): fill a buffer with platform random data @@ -3636,7 +4745,7 @@ lws_snprintf(char *str, size_t size, const char *format, ...); LWS_VISIBLE LWS_EXTERN int lws_get_random(struct lws_context *context, void *buf, int len); /** - * lws_daemonize(): fill a buffer with platform random data + * lws_daemonize(): make current process run in the background * * \param _lock_path: the filepath to write the lock file * @@ -3661,6 +4770,19 @@ lws_get_library_version(void); LWS_VISIBLE LWS_EXTERN void * lws_wsi_user(struct lws *wsi); +/** + * lws_wsi_set_user() - set the user data associated with the client connection + * \param wsi: lws connection + * \param user: user data + * + * By default lws allocates this and it's not legal to externally set it + * yourself. However client connections may have it set externally when the + * connection is created... if so, this api can be used to modify it at + * runtime additionally. + */ +LWS_VISIBLE LWS_EXTERN void +lws_set_wsi_user(struct lws *wsi, void *user); + /** * lws_parse_uri: cut up prot:/ads:port/path into pieces * Notice it does so by dropping '\0' into input string @@ -3683,7 +4805,7 @@ LWS_VISIBLE LWS_EXTERN unsigned long lws_now_secs(void); /** - * lws_get_context - Allow geting lws_context from a Websocket connection + * lws_get_context - Allow getting lws_context from a Websocket connection * instance * * With this function, users can access context in the callback function. @@ -3725,6 +4847,45 @@ lws_get_parent(const struct lws *wsi); LWS_VISIBLE LWS_EXTERN struct lws * LWS_WARN_UNUSED_RESULT lws_get_child(const struct lws *wsi); +/** + * lws_parent_carries_io() - mark wsi as needing to send messages via parent + * + * \param wsi: child lws connection + */ + +LWS_VISIBLE LWS_EXTERN void +lws_set_parent_carries_io(struct lws *wsi); + +LWS_VISIBLE LWS_EXTERN void * +lws_get_opaque_parent_data(const struct lws *wsi); + +LWS_VISIBLE LWS_EXTERN void +lws_set_opaque_parent_data(struct lws *wsi, void *data); + +LWS_VISIBLE LWS_EXTERN int +lws_get_child_pending_on_writable(const struct lws *wsi); + +LWS_VISIBLE LWS_EXTERN void +lws_clear_child_pending_on_writable(struct lws *wsi); + +LWS_VISIBLE LWS_EXTERN int +lws_get_close_length(struct lws *wsi); + +LWS_VISIBLE LWS_EXTERN unsigned char * +lws_get_close_payload(struct lws *wsi); + +/** + * lws_get_network_wsi() - Returns wsi that has the tcp connection for this wsi + * + * \param wsi: wsi you have + * + * Returns wsi that has the tcp connection (which may be the incoming wsi) + * + * HTTP/1 connections will always return the incoming wsi + * HTTP/2 connections may return a different wsi that has the tcp connection + */ +LWS_VISIBLE LWS_EXTERN +struct lws *lws_get_network_wsi(struct lws *wsi); /* * \deprecated DEPRECATED Note: this is not normally needed as a user api. @@ -3732,7 +4893,7 @@ lws_get_child(const struct lws *wsi); * useful when integrating with other app poll loop service code. */ LWS_VISIBLE LWS_EXTERN int -lws_read(struct lws *wsi, unsigned char *buf, size_t len); +lws_read(struct lws *wsi, unsigned char *buf, lws_filepos_t len); /** * lws_set_allocator() - custom allocator support @@ -3742,7 +4903,7 @@ lws_read(struct lws *wsi, unsigned char *buf, size_t len); * Allows you to replace the allocator (and deallocator) used by lws */ LWS_VISIBLE LWS_EXTERN void -lws_set_allocator(void *(*realloc)(void *ptr, size_t size)); +lws_set_allocator(void *(*realloc)(void *ptr, size_t size, const char *reason)); ///@} /** \defgroup wsstatus Websocket status APIs @@ -3762,11 +4923,20 @@ lws_send_pipe_choked(struct lws *wsi); /** * lws_is_final_fragment() - tests if last part of ws message + * * \param wsi: lws connection */ LWS_VISIBLE LWS_EXTERN int lws_is_final_fragment(struct lws *wsi); +/** + * lws_is_first_fragment() - tests if first part of ws message + * + * \param wsi: lws connection + */ +LWS_VISIBLE LWS_EXTERN int +lws_is_first_fragment(struct lws *wsi); + /** * lws_get_reserved_bits() - access reserved bits of ws frame * \param wsi: lws connection @@ -3821,8 +4991,242 @@ lws_is_ssl(struct lws *wsi); */ LWS_VISIBLE LWS_EXTERN int lws_is_cgi(struct lws *wsi); + +#ifdef LWS_OPENSSL_SUPPORT +/** + * lws_get_ssl() - Return wsi's SSL context structure + * \param wsi: websocket connection + * + * Returns pointer to the SSL library's context structure + */ +LWS_VISIBLE LWS_EXTERN SSL* +lws_get_ssl(struct lws *wsi); +#endif ///@} +/** \defgroup lws_ring LWS Ringbuffer APIs + * ##lws_ring: generic ringbuffer struct + * + * Provides an abstract ringbuffer api supporting one head and one or an + * unlimited number of tails. + * + * All of the members are opaque and manipulated by lws_ring_...() apis. + * + * The lws_ring and its buffer is allocated at runtime on the heap, using + * + * - lws_ring_create() + * - lws_ring_destroy() + * + * It may contain any type, the size of the "element" stored in the ring + * buffer and the number of elements is given at creation time. + * + * When you create the ringbuffer, you can optionally provide an element + * destroy callback that frees any allocations inside the element. This is then + * automatically called for elements with no tail behind them, ie, elements + * which don't have any pending consumer are auto-freed. + * + * Whole elements may be inserted into the ringbuffer and removed from it, using + * + * - lws_ring_insert() + * - lws_ring_consume() + * + * You can find out how many whole elements are free or waiting using + * + * - lws_ring_get_count_free_elements() + * - lws_ring_get_count_waiting_elements() + * + * In addition there are special purpose optional byte-centric apis + * + * - lws_ring_next_linear_insert_range() + * - lws_ring_bump_head() + * + * which let you, eg, read() directly into the ringbuffer without needing + * an intermediate bounce buffer. + * + * The accessors understand that the ring wraps, and optimizes insertion and + * consumption into one or two memcpy()s depending on if the head or tail + * wraps. + * + * lws_ring only supports a single head, but optionally multiple tails with + * an API to inform it when the "oldest" tail has moved on. You can give + * NULL where-ever an api asks for a tail pointer, and it will use an internal + * single tail pointer for convenience. + * + * The "oldest tail", which is the only tail if you give it NULL instead of + * some other tail, is used to track which elements in the ringbuffer are + * still unread by anyone. + * + * - lws_ring_update_oldest_tail() + */ +///@{ +struct lws_ring; + +/** + * lws_ring_create(): create a new ringbuffer + * + * \param element_len: the size in bytes of one element in the ringbuffer + * \param count: the number of elements the ringbuffer can contain + * \param destroy_element: NULL, or callback to be called for each element + * that is removed from the ringbuffer due to the + * oldest tail moving beyond it + * + * Creates the ringbuffer and allocates the storage. Returns the new + * lws_ring *, or NULL if the allocation failed. + * + * If non-NULL, destroy_element will get called back for every element that is + * retired from the ringbuffer after the oldest tail has gone past it, and for + * any element still left in the ringbuffer when it is destroyed. It replaces + * all other element destruction code in your user code. + */ +LWS_VISIBLE LWS_EXTERN struct lws_ring * +lws_ring_create(size_t element_len, size_t count, + void (*destroy_element)(void *element)); + +/** + * lws_ring_destroy(): destroy a previously created ringbuffer + * + * \param ring: the struct lws_ring to destroy + * + * Destroys the ringbuffer allocation and the struct lws_ring itself. + */ +LWS_VISIBLE LWS_EXTERN void +lws_ring_destroy(struct lws_ring *ring); + +/** + * lws_ring_get_count_free_elements(): return how many elements can fit + * in the free space + * + * \param ring: the struct lws_ring to report on + * + * Returns how much room is left in the ringbuffer for whole element insertion. + */ +LWS_VISIBLE LWS_EXTERN size_t +lws_ring_get_count_free_elements(struct lws_ring *ring); + +/** + * lws_ring_get_count_waiting_elements(): return how many elements can be consumed + * + * \param ring: the struct lws_ring to report on + * \param tail: a pointer to the tail struct to use, or NULL for single tail + * + * Returns how many elements are waiting to be consumed from the perspective + * of the tail pointer given. + */ +LWS_VISIBLE LWS_EXTERN size_t +lws_ring_get_count_waiting_elements(struct lws_ring *ring, uint32_t *tail); + +/** + * lws_ring_insert(): attempt to insert up to max_count elements from src + * + * \param ring: the struct lws_ring to report on + * \param src: the array of elements to be inserted + * \param max_count: the number of available elements at src + * + * Attempts to insert as many of the elements at src as possible, up to the + * maximum max_count. Returns the number of elements actually inserted. + */ +LWS_VISIBLE LWS_EXTERN size_t +lws_ring_insert(struct lws_ring *ring, const void *src, size_t max_count); + +/** + * lws_ring_consume(): attempt to copy out and remove up to max_count elements + * to src + * + * \param ring: the struct lws_ring to report on + * \param tail: a pointer to the tail struct to use, or NULL for single tail + * \param dest: the array of elements to be inserted. or NULL for no copy + * \param max_count: the number of available elements at src + * + * Attempts to copy out as many waiting elements as possible into dest, from + * the perspective of the given tail, up to max_count. If dest is NULL, the + * copying out is not done but the elements are logically consumed as usual. + * NULL dest is useful in combination with lws_ring_get_element(), where you + * can use the element direct from the ringbuffer and then call this with NULL + * dest to logically consume it. + * + * Increments the tail position according to how many elements could be + * consumed. + * + * Returns the number of elements consumed. + */ +LWS_VISIBLE LWS_EXTERN size_t +lws_ring_consume(struct lws_ring *ring, uint32_t *tail, void *dest, + size_t max_count); + +/** + * lws_ring_get_element(): get a pointer to the next waiting element for tail + * + * \param ring: the struct lws_ring to report on + * \param tail: a pointer to the tail struct to use, or NULL for single tail + * + * Points to the next element that tail would consume, directly in the + * ringbuffer. This lets you write() or otherwise use the element without + * having to copy it out somewhere first. + * + * After calling this, you must call lws_ring_consume(ring, &tail, NULL, 1) + * which will logically consume the element you used up and increment your + * tail (tail may also be NULL there if you use a single tail). + * + * Returns NULL if no waiting element, or a const void * pointing to it. + */ +LWS_VISIBLE LWS_EXTERN const void * +lws_ring_get_element(struct lws_ring *ring, uint32_t *tail); + +/** + * lws_ring_update_oldest_tail(): free up elements older than tail for reuse + * + * \param ring: the struct lws_ring to report on + * \param tail: a pointer to the tail struct to use, or NULL for single tail + * + * If you are using multiple tails, you must use this API to inform the + * lws_ring when none of the tails still need elements in the fifo any more, + * by updating it when the "oldest" tail has moved on. + */ +LWS_VISIBLE LWS_EXTERN void +lws_ring_update_oldest_tail(struct lws_ring *ring, uint32_t tail); + +/** + * lws_ring_get_oldest_tail(): get current oldest available data index + * + * \param ring: the struct lws_ring to report on + * + * If you are initializing a new ringbuffer consumer, you can set its tail to + * this to start it from the oldest ringbuffer entry still available. + */ +LWS_VISIBLE LWS_EXTERN uint32_t +lws_ring_get_oldest_tail(struct lws_ring *ring); + +/** + * lws_ring_next_linear_insert_range(): used to write directly into the ring + * + * \param ring: the struct lws_ring to report on + * \param start: pointer to a void * set to the start of the next ringbuffer area + * \param bytes: pointer to a size_t set to the max length you may use from *start + * + * This provides a low-level, bytewise access directly into the ringbuffer + * allowing direct insertion of data without having to use a bounce buffer. + * + * The api reports the position and length of the next linear range that can + * be written in the ringbuffer, ie, up to the point it would wrap, and sets + * *start and *bytes accordingly. You can then, eg, directly read() into + * *start for up to *bytes, and use lws_ring_bump_head() to update the lws_ring + * with what you have done. + * + * Returns nonzero if no insertion is currently possible. + */ +LWS_VISIBLE LWS_EXTERN int +lws_ring_next_linear_insert_range(struct lws_ring *ring, void **start, + size_t *bytes); + +/** + * lws_ring_bump_head(): used to write directly into the ring + * + * \param ring: the struct lws_ring to operate on + * \param bytes: the number of bytes you inserted at the current head + */ +LWS_VISIBLE LWS_EXTERN void +lws_ring_bump_head(struct lws_ring *ring, size_t bytes); +///@} /** \defgroup sha SHA and B64 helpers * ##SHA and B64 helpers @@ -3880,7 +5284,7 @@ lws_b64_decode_string(const char *in, char *out, int out_size); * However for most cases, binding the cgi to http in and out, the default * lws implementation already does the right thing. */ -#ifdef LWS_WITH_CGI + enum lws_enum_stdinouterr { LWS_STDIN = 0, LWS_STDOUT = 1, @@ -3893,6 +5297,8 @@ enum lws_cgi_hdr_state { LCHS_LF1, LCHS_CR2, LCHS_LF2, + LHCS_RESPONSE, + LHCS_DUMP_HEADERS, LHCS_PAYLOAD, LCHS_SINGLE_0A, }; @@ -3905,13 +5311,14 @@ struct lws_cgi_args { int len; /**< length */ }; - +#ifdef LWS_WITH_CGI /** * lws_cgi: spawn network-connected cgi process * * \param wsi: connection to own the process * \param exec_array: array of "exec-name" "arg1" ... "argn" NULL - * \param script_uri_path_len: how many chars on the left of the uri are the path to the cgi + * \param script_uri_path_len: how many chars on the left of the uri are the + * path to the cgi, or -1 to spawn without URL-related env vars * \param timeout_secs: seconds script should be allowed to run * \param mp_cgienv: pvo list with per-vhost cgi options to put in env */ @@ -3935,6 +5342,16 @@ lws_cgi_write_split_stdout_headers(struct lws *wsi); */ LWS_VISIBLE LWS_EXTERN int lws_cgi_kill(struct lws *wsi); + +/** + * lws_cgi_get_stdwsi: get wsi for stdin, stdout, or stderr + * + * \param wsi: parent wsi that has cgi + * \param ch: which of LWS_STDIN, LWS_STDOUT or LWS_STDERR + */ +LWS_VISIBLE LWS_EXTERN struct lws * +lws_cgi_get_stdwsi(struct lws *wsi, enum lws_enum_stdinouterr ch); + #endif ///@} @@ -3961,24 +5378,85 @@ lws_cgi_kill(struct lws *wsi); * These provide platform-agnostic ways to deal with filesystem access in the * library and in the user code. */ + +#if defined(LWS_WITH_ESP32) +/* sdk preprocessor defs? compiler issue? gets confused with member names */ +#define LWS_FOP_OPEN _open +#define LWS_FOP_CLOSE _close +#define LWS_FOP_SEEK_CUR _seek_cur +#define LWS_FOP_READ _read +#define LWS_FOP_WRITE _write +#else +#define LWS_FOP_OPEN open +#define LWS_FOP_CLOSE close +#define LWS_FOP_SEEK_CUR seek_cur +#define LWS_FOP_READ read +#define LWS_FOP_WRITE write +#endif + +#define LWS_FOP_FLAGS_MASK ((1 << 23) - 1) +#define LWS_FOP_FLAG_COMPR_ACCEPTABLE_GZIP (1 << 24) +#define LWS_FOP_FLAG_COMPR_IS_GZIP (1 << 25) +#define LWS_FOP_FLAG_MOD_TIME_VALID (1 << 26) +#define LWS_FOP_FLAG_VIRTUAL (1 << 27) + +struct lws_plat_file_ops; + +struct lws_fop_fd { + lws_filefd_type fd; + /**< real file descriptor related to the file... */ + const struct lws_plat_file_ops *fops; + /**< fops that apply to this fop_fd */ + void *filesystem_priv; + /**< ignored by lws; owned by the fops handlers */ + lws_filepos_t pos; + /**< generic "position in file" */ + lws_filepos_t len; + /**< generic "length of file" */ + lws_fop_flags_t flags; + /**< copy of the returned flags */ + uint32_t mod_time; + /**< optional "modification time of file", only valid if .open() + * set the LWS_FOP_FLAG_MOD_TIME_VALID flag */ +}; +typedef struct lws_fop_fd *lws_fop_fd_t; + +struct lws_fops_index { + const char *sig; /* NULL or vfs signature, eg, ".zip/" */ + uint8_t len; /* length of above string */ +}; + struct lws_plat_file_ops { - lws_filefd_type (*open)(struct lws *wsi, const char *filename, - unsigned long *filelen, int flags); + lws_fop_fd_t (*LWS_FOP_OPEN)(const struct lws_plat_file_ops *fops, + const char *filename, const char *vpath, + lws_fop_flags_t *flags); /**< Open file (always binary access if plat supports it) - * filelen is filled on exit to be the length of the file - * flags should be set to O_RDONLY or O_RDWR */ - int (*close)(struct lws *wsi, lws_filefd_type fd); - /**< close file */ - unsigned long (*seek_cur)(struct lws *wsi, lws_filefd_type fd, - long offset_from_cur_pos); + * vpath may be NULL, or if the fops understands it, the point at which + * the filename's virtual part starts. + * *flags & LWS_FOP_FLAGS_MASK should be set to O_RDONLY or O_RDWR. + * If the file may be gzip-compressed, + * LWS_FOP_FLAG_COMPR_ACCEPTABLE_GZIP is set. If it actually is + * gzip-compressed, then the open handler should OR + * LWS_FOP_FLAG_COMPR_IS_GZIP on to *flags before returning. + */ + int (*LWS_FOP_CLOSE)(lws_fop_fd_t *fop_fd); + /**< close file AND set the pointer to NULL */ + lws_fileofs_t (*LWS_FOP_SEEK_CUR)(lws_fop_fd_t fop_fd, + lws_fileofs_t offset_from_cur_pos); /**< seek from current position */ - int (*read)(struct lws *wsi, lws_filefd_type fd, unsigned long *amount, - unsigned char *buf, unsigned long len); + int (*LWS_FOP_READ)(lws_fop_fd_t fop_fd, lws_filepos_t *amount, + uint8_t *buf, lws_filepos_t len); /**< Read from file, on exit *amount is set to amount actually read */ - int (*write)(struct lws *wsi, lws_filefd_type fd, unsigned long *amount, - unsigned char *buf, unsigned long len); + int (*LWS_FOP_WRITE)(lws_fop_fd_t fop_fd, lws_filepos_t *amount, + uint8_t *buf, lws_filepos_t len); /**< Write to file, on exit *amount is set to amount actually written */ + struct lws_fops_index fi[3]; + /**< vfs path signatures implying use of this fops */ + + const struct lws_plat_file_ops *next; + /**< NULL or next fops in list */ + /* Add new things just above here ---^ * This is part of the ABI, don't needlessly break compatibility */ }; @@ -3990,84 +5468,144 @@ struct lws_plat_file_ops { */ LWS_VISIBLE LWS_EXTERN struct lws_plat_file_ops * LWS_WARN_UNUSED_RESULT lws_get_fops(struct lws_context *context); +LWS_VISIBLE LWS_EXTERN void +lws_set_fops(struct lws_context *context, const struct lws_plat_file_ops *fops); +/** + * lws_vfs_tell() - get current file position + * + * \param fop_fd: fop_fd we are asking about + */ +LWS_VISIBLE LWS_EXTERN lws_filepos_t LWS_WARN_UNUSED_RESULT +lws_vfs_tell(lws_fop_fd_t fop_fd); +/** + * lws_vfs_get_length() - get current file total length in bytes + * + * \param fop_fd: fop_fd we are asking about + */ +LWS_VISIBLE LWS_EXTERN lws_filepos_t LWS_WARN_UNUSED_RESULT +lws_vfs_get_length(lws_fop_fd_t fop_fd); +/** + * lws_vfs_get_mod_time() - get time file last modified + * + * \param fop_fd: fop_fd we are asking about + */ +LWS_VISIBLE LWS_EXTERN uint32_t LWS_WARN_UNUSED_RESULT +lws_vfs_get_mod_time(lws_fop_fd_t fop_fd); +/** + * lws_vfs_file_seek_set() - seek relative to start of file + * + * \param fop_fd: fop_fd we are seeking in + * \param offset: offset from start of file + */ +LWS_VISIBLE LWS_EXTERN lws_fileofs_t +lws_vfs_file_seek_set(lws_fop_fd_t fop_fd, lws_fileofs_t offset); +/** + * lws_vfs_file_seek_end() - seek relative to end of file + * + * \param fop_fd: fop_fd we are seeking in + * \param offset: offset from start of file + */ +LWS_VISIBLE LWS_EXTERN lws_fileofs_t +lws_vfs_file_seek_end(lws_fop_fd_t fop_fd, lws_fileofs_t offset); + +extern struct lws_plat_file_ops fops_zip; /** - * lws_plat_file_open() - file open operations + * lws_plat_file_open() - open vfs filepath * - * \param wsi: connection doing the opening - * \param filename: filename to open - * \param filelen: length of file (filled in by call) - * \param flags: open flags + * \param fops: file ops struct that applies to this descriptor + * \param vfs_path: filename to open + * \param flags: pointer to open flags + * + * The vfs_path is scanned for known fops signatures, and the open directed + * to any matching fops open. + * + * User code should use this api to perform vfs opens. + * + * returns semi-opaque handle */ -static LWS_INLINE lws_filefd_type LWS_WARN_UNUSED_RESULT -lws_plat_file_open(struct lws *wsi, const char *filename, - unsigned long *filelen, int flags) -{ - return lws_get_fops(lws_get_context(wsi))->open(wsi, filename, - filelen, flags); -} +LWS_VISIBLE LWS_EXTERN lws_fop_fd_t LWS_WARN_UNUSED_RESULT +lws_vfs_file_open(const struct lws_plat_file_ops *fops, const char *vfs_path, + lws_fop_flags_t *flags); /** * lws_plat_file_close() - close file * - * \param wsi: connection opened by - * \param fd: file descriptor + * \param fop_fd: file handle to close */ static LWS_INLINE int -lws_plat_file_close(struct lws *wsi, lws_filefd_type fd) +lws_vfs_file_close(lws_fop_fd_t *fop_fd) { - return lws_get_fops(lws_get_context(wsi))->close(wsi, fd); + return (*fop_fd)->fops->LWS_FOP_CLOSE(fop_fd); } /** * lws_plat_file_seek_cur() - close file * - * \param wsi: connection opened by - * \param fd: file descriptor + * + * \param fop_fd: file handle * \param offset: position to seek to */ -static LWS_INLINE unsigned long -lws_plat_file_seek_cur(struct lws *wsi, lws_filefd_type fd, long offset) +static LWS_INLINE lws_fileofs_t +lws_vfs_file_seek_cur(lws_fop_fd_t fop_fd, lws_fileofs_t offset) { - return lws_get_fops(lws_get_context(wsi))->seek_cur(wsi, fd, offset); + return fop_fd->fops->LWS_FOP_SEEK_CUR(fop_fd, offset); } /** * lws_plat_file_read() - read from file * - * \param wsi: connection opened by - * \param fd: file descriptor + * \param fop_fd: file handle * \param amount: how much to read (rewritten by call) * \param buf: buffer to write to * \param len: max length */ static LWS_INLINE int LWS_WARN_UNUSED_RESULT -lws_plat_file_read(struct lws *wsi, lws_filefd_type fd, unsigned long *amount, - unsigned char *buf, unsigned long len) +lws_vfs_file_read(lws_fop_fd_t fop_fd, lws_filepos_t *amount, + uint8_t *buf, lws_filepos_t len) { - return lws_get_fops(lws_get_context(wsi))->read(wsi, fd, amount, buf, - len); + return fop_fd->fops->LWS_FOP_READ(fop_fd, amount, buf, len); } /** * lws_plat_file_write() - write from file * - * \param wsi: connection opened by - * \param fd: file descriptor + * \param fop_fd: file handle * \param amount: how much to write (rewritten by call) * \param buf: buffer to read from * \param len: max length */ static LWS_INLINE int LWS_WARN_UNUSED_RESULT -lws_plat_file_write(struct lws *wsi, lws_filefd_type fd, unsigned long *amount, - unsigned char *buf, unsigned long len) +lws_vfs_file_write(lws_fop_fd_t fop_fd, lws_filepos_t *amount, + uint8_t *buf, lws_filepos_t len) { - return lws_get_fops(lws_get_context(wsi))->write(wsi, fd, amount, buf, - len); + return fop_fd->fops->LWS_FOP_WRITE(fop_fd, amount, buf, len); } + +/* these are the platform file operations implementations... they can + * be called directly and used in fops arrays + */ + +LWS_VISIBLE LWS_EXTERN lws_fop_fd_t +_lws_plat_file_open(const struct lws_plat_file_ops *fops, const char *filename, + const char *vpath, lws_fop_flags_t *flags); +LWS_VISIBLE LWS_EXTERN int +_lws_plat_file_close(lws_fop_fd_t *fop_fd); +LWS_VISIBLE LWS_EXTERN lws_fileofs_t +_lws_plat_file_seek_cur(lws_fop_fd_t fop_fd, lws_fileofs_t offset); +LWS_VISIBLE LWS_EXTERN int +_lws_plat_file_read(lws_fop_fd_t fop_fd, lws_filepos_t *amount, + uint8_t *buf, lws_filepos_t len); +LWS_VISIBLE LWS_EXTERN int +_lws_plat_file_write(lws_fop_fd_t fop_fd, lws_filepos_t *amount, + uint8_t *buf, lws_filepos_t len); + +LWS_VISIBLE LWS_EXTERN int +lws_alloc_vfs_file(struct lws_context *context, const char *filename, + uint8_t **buf, lws_filepos_t *amount); //@} -/** \defgroup smtp - * \ingroup lwsapi +/** \defgroup smtp SMTP related functions * ##SMTP related functions + * \ingroup lwsapi * * These apis let you communicate with a local SMTP server to send email from * lws. It handles all the SMTP sequencing and protocol actions. @@ -4189,6 +5727,59 @@ lws_email_destroy(struct lws_email *email); #endif //@} +/* + * Stats are all uint64_t numbers that start at 0. + * Index names here have the convention + * + * _C_ counter + * _B_ byte count + * _MS_ millisecond count + */ + +enum { + LWSSTATS_C_CONNECTIONS, /**< count incoming connections */ + LWSSTATS_C_API_CLOSE, /**< count calls to close api */ + LWSSTATS_C_API_READ, /**< count calls to read from socket api */ + LWSSTATS_C_API_LWS_WRITE, /**< count calls to lws_write API */ + LWSSTATS_C_API_WRITE, /**< count calls to write API */ + LWSSTATS_C_WRITE_PARTIALS, /**< count of partial writes */ + LWSSTATS_C_WRITEABLE_CB_REQ, /**< count of writable callback requests */ + LWSSTATS_C_WRITEABLE_CB_EFF_REQ, /**< count of effective writable callback requests */ + LWSSTATS_C_WRITEABLE_CB, /**< count of writable callbacks */ + LWSSTATS_C_SSL_CONNECTIONS_FAILED, /**< count of failed SSL connections */ + LWSSTATS_C_SSL_CONNECTIONS_ACCEPTED, /**< count of accepted SSL connections */ + LWSSTATS_C_SSL_CONNECTIONS_ACCEPT_SPIN, /**< count of SSL_accept() attempts */ + LWSSTATS_C_SSL_CONNS_HAD_RX, /**< count of accepted SSL conns that have had some RX */ + LWSSTATS_C_TIMEOUTS, /**< count of timed-out connections */ + LWSSTATS_C_SERVICE_ENTRY, /**< count of entries to lws service loop */ + LWSSTATS_B_READ, /**< aggregate bytes read */ + LWSSTATS_B_WRITE, /**< aggregate bytes written */ + LWSSTATS_B_PARTIALS_ACCEPTED_PARTS, /**< aggreate of size of accepted write data from new partials */ + LWSSTATS_MS_SSL_CONNECTIONS_ACCEPTED_DELAY, /**< aggregate delay in accepting connection */ + LWSSTATS_MS_WRITABLE_DELAY, /**< aggregate delay between asking for writable and getting cb */ + LWSSTATS_MS_WORST_WRITABLE_DELAY, /**< single worst delay between asking for writable and getting cb */ + LWSSTATS_MS_SSL_RX_DELAY, /**< aggregate delay between ssl accept complete and first RX */ + LWSSTATS_C_PEER_LIMIT_AH_DENIED, /**< number of times we would have given an ah but for the peer limit */ + LWSSTATS_C_PEER_LIMIT_WSI_DENIED, /**< number of times we would have given a wsi but for the peer limit */ + + /* Add new things just above here ---^ + * This is part of the ABI, don't needlessly break compatibility */ + LWSSTATS_SIZE +}; + +#if defined(LWS_WITH_STATS) + +LWS_VISIBLE LWS_EXTERN uint64_t +lws_stats_get(struct lws_context *context, int index); +LWS_VISIBLE LWS_EXTERN void +lws_stats_log_dump(struct lws_context *context); +#else +static LWS_INLINE uint64_t +lws_stats_get(struct lws_context *context, int index) { return 0; } +static LWS_INLINE void +lws_stats_log_dump(struct lws_context *context) { } +#endif + #ifdef __cplusplus } #endif diff --git a/openharmony/armeabi-v7a/include/websockets/lws-plugin-ssh.h b/openharmony/armeabi-v7a/include/websockets/lws-plugin-ssh.h new file mode 100644 index 00000000..4ba11658 --- /dev/null +++ b/openharmony/armeabi-v7a/include/websockets/lws-plugin-ssh.h @@ -0,0 +1,364 @@ +/* + * libwebsockets - lws-plugin-ssh-base + * + * Copyright (C) 2017 Andy Green + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation: + * version 2.1 of the License. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, + * MA 02110-1301 USA + */ + +#if !defined(__LWS_PLUGIN_SSH_H__) +#define __LWS_PLUGIN_SSH_H__ + +#define LWS_CALLBACK_SSH_UART_SET_RXFLOW (LWS_CALLBACK_USER + 800) + +#define LWS_SSH_OPS_VERSION 1 + +struct lws_ssh_pty { + char term[16]; + char *modes; + uint32_t width_ch; + uint32_t height_ch; + uint32_t width_px; + uint32_t height_px; + uint32_t modes_len; +}; + +#define SSHMO_TTY_OP_END 0 /* Indicates end of options. */ +#define SSHMO_VINTR 1 /* Interrupt character; 255 if none. Similarly + * for the other characters. Not all of these + * characters are supported on all systems. */ +#define SSHMO_VQUIT 2 /* The quit character (sends SIGQUIT signal on + * POSIX systems). */ +#define SSHMO_VERASE 3 /* Erase the character to left of the cursor. */ +#define SSHMO_VKILL 4 /* Kill the current input line. */ +#define SSHMO_VEOF 5 /* End-of-file character (sends EOF from the + * terminal). */ +#define SSHMO_VEOL 6 /* End-of-line character in addition to + * carriage return and/or linefeed. */ +#define SSHMO_VEOL2 7 /* Additional end-of-line character. */ +#define SSHMO_VSTART 8 /* Continues paused output (normally + * control-Q). */ +#define SSHMO_VSTOP 9 /* Pauses output (normally control-S). */ +#define SSHMO_VSUSP 10 /* Suspends the current program. */ +#define SSHMO_VDSUSP 11 /* Another suspend character. */ +#define SSHMO_VREPRINT 12 /* Reprints the current input line. */ +#define SSHMO_VWERASE 13 /* Erases a word left of cursor. */ +#define SSHMO_VLNEXT 14 /* Enter the next character typed literally, + * even if it is a special character */ +#define SSHMO_VFLUSH 15 /* Character to flush output. */ +#define SSHMO_VSWTCH 16 /* Switch to a different shell layer. */ +#define SSHMO_VSTATUS 17 /* Prints system status line (load, command, + * pid, etc). */ +#define SSHMO_VDISCARD 18 /* Toggles the flushing of terminal output. */ +#define SSHMO_IGNPAR 30 /* The ignore parity flag. The parameter + * SHOULD be 0 if this flag is FALSE, + * and 1 if it is TRUE. */ +#define SSHMO_PARMRK 31 /* Mark parity and framing errors. */ +#define SSHMO_INPCK 32 /* Enable checking of parity errors. */ +#define SSHMO_ISTRIP 33 /* Strip 8th bit off characters. */ +#define SSHMO_INLCR 34 /* Map NL into CR on input. */ +#define SSHMO_IGNCR 35 /* Ignore CR on input. */ +#define SSHMO_ICRNL 36 /* Map CR to NL on input. */ +#define SSHMO_IUCLC 37 /* Translate uppercase characters to lowercase. */ +#define SSHMO_IXON 38 /* Enable output flow control. */ +#define SSHMO_IXANY 39 /* Any char will restart after stop. */ +#define SSHMO_IXOFF 40 /* Enable input flow control. */ +#define SSHMO_IMAXBEL 41 /* Ring bell on input queue full. */ +#define SSHMO_ISIG 50 /* Enable signals INTR, QUIT, [D]SUSP. */ +#define SSHMO_ICANON 51 /* Canonicalize input lines. */ +#define SSHMO_XCASE 52 /* Enable input and output of uppercase + * characters by preceding their lowercase + * equivalents with "\". */ +#define SSHMO_ECHO 53 /* Enable echoing. */ +#define SSHMO_ECHOE 54 /* Visually erase chars. */ +#define SSHMO_ECHOK 55 /* Kill character discards current line. */ +#define SSHMO_ECHONL 56 /* Echo NL even if ECHO is off. */ +#define SSHMO_NOFLSH 57 /* Don't flush after interrupt. */ +#define SSHMO_TOSTOP 58 /* Stop background jobs from output. */ +#define SSHMO_IEXTEN 59 /* Enable extensions. */ +#define SSHMO_ECHOCTL 60 /* Echo control characters as ^(Char). */ +#define SSHMO_ECHOKE 61 /* Visual erase for line kill. */ +#define SSHMO_PENDIN 62 /* Retype pending input. */ +#define SSHMO_OPOST 70 /* Enable output processing. */ +#define SSHMO_OLCUC 71 /* Convert lowercase to uppercase. */ +#define SSHMO_ONLCR 72 /* Map NL to CR-NL. */ +#define SSHMO_OCRNL 73 /* Translate carriage return to newline (out). */ +#define SSHMO_ONOCR 74 /* Translate newline to CR-newline (out). */ +#define SSHMO_ONLRET 75 /* Newline performs a carriage return (out). */ +#define SSHMO_CS7 90 /* 7 bit mode. */ +#define SSHMO_CS8 91 /* 8 bit mode. */ +#define SSHMO_PARENB 92 /* Parity enable. */ +#define SSHMO_PARODD 93 /* Odd parity, else even. */ +#define SSHMO_TTY_OP_ISPEED 128 /* Specifies the input baud rate in + * bits per second. */ +#define SSHMO_TTY_OP_OSPEED 129 /* Specifies the output baud rate in + * bits per second. */ + +/*! \defgroup ssh-base plugin: lws-ssh-base + * \ingroup Protocols-and-Plugins + * + * ##Plugin lws-ssh-base + * + * This is the interface to customize the ssh server per-vhost. A pointer + * to your struct lws_ssh_ops with the members initialized is passed in using + * pvo when you create the vhost. The pvo is attached to the protocol name + * + * - "lws-ssh-base" - the ssh serving part + * + * - "lws-telnetd-base" - the telnet serving part + * + * This way you can have different instances of ssh servers wired up to + * different IO and server keys per-vhost. + * + * See also ./READMEs/README-plugin-sshd-base.md + */ +///@{ + +struct lws_ssh_ops { + /** + * channel_create() - Channel created + * + * \param wsi: raw wsi representing this connection + * \param priv: pointer to void * you can allocate and attach to the + * channel + * + * Called when new channel created, *priv should be set to any + * allocation your implementation needs + * + * You probably want to save the wsi inside your priv struct. Calling + * lws_callback_on_writable() on this wsi causes your ssh server + * instance to call .tx_waiting() next time you can write something + * to the client. + */ + int (*channel_create)(struct lws *wsi, void **priv); + + /** + * channel_destroy() - Channel is being destroyed + * + * \param priv: void * you set when channel was created (or NULL) + * + * Called when channel destroyed, priv should be freed if you allocated + * into it. + */ + int (*channel_destroy)(void *priv); + + /** + * rx() - receive payload from peer + * + * \param priv: void * you set when this channel was created + * \param wsi: struct lws * for the ssh connection + * \param buf: pointer to start of received data + * \param len: bytes of received data available at buf + * + * len bytes of payload from the peer arrived and is available at buf + */ + int (*rx)(void *priv, struct lws *wsi, const uint8_t *buf, uint32_t len); + + /** + * tx_waiting() - report if data waiting to transmit on the channel + * + * \param priv: void * you set when this channel was created + * + * returns a bitmask of LWS_STDOUT and LWS_STDERR, with the bits set + * if they have tx waiting to send, else 0 if nothing to send + * + * You should use one of the lws_callback_on_writable() family to + * trigger the ssh protocol to ask if you have any tx waiting. + * + * Returning -1 from here will close the tcp connection to the client. + */ + int (*tx_waiting)(void *priv); + + /** + * tx() - provide data to send on the channel + * + * \param priv: void * you set when this channel was created + * \param stdch: LWS_STDOUT or LWS_STDERR + * \param buf: start of the buffer to copy the transmit data into + * \param len: max length of the buffer in bytes + * + * copy and consume up to len bytes into *buf, + * return the actual copied count. + * + * You should use one of the lws_callback_on_writable() family to + * trigger the ssh protocol to ask if you have any tx waiting. If you + * do you will get calls here to fetch it, for each of LWS_STDOUT or + * LWS_STDERR that were reported to be waiting by tx_waiting(). + */ + size_t (*tx)(void *priv, int stdch, uint8_t *buf, size_t len); + + /** + * get_server_key() - retreive the secret keypair for this server + * + * \param wsi: the wsi representing the connection to the client + * \param buf: start of the buffer to copy the keypair into + * \param len: length of the buffer in bytes + * + * load the server key into buf, max len len. Returns length of buf + * set to key, or 0 if no key or other error. If there is no key, + * the error isn't fatal... the plugin will generate a random key and + * store it using *get_server_key() for subsequent times. + */ + size_t (*get_server_key)(struct lws *wsi, uint8_t *buf, size_t len); + + /** + * set_server_key() - store the secret keypair of this server + * + * \param wsi: the wsi representing the connection to the client + * \param buf: start of the buffer containing the keypair + * \param len: length of the keypair in bytes + * + * store the server key in buf, length len, to nonvolatile stg. + * Return length stored, 0 for fail. + */ + size_t (*set_server_key)(struct lws *wsi, uint8_t *buf, size_t len); + + /** + * set_env() - Set environment variable + * + * \param priv: void * you set when this channel was created + * \param name: env var name + * \param value: value to set env var to + * + * Client requested to set environment var. Return nonzero to fail. + */ + int (*set_env)(void *priv, const char *name, const char *value); + + /** + * exec() - spawn command and wire up stdin/out/err to ssh channel + * + * \param priv: void * you set when this channel was created + * \param wsi: the struct lws the connection belongs to + * \param command: string containing path to app and arguments + * + * Client requested to exec something. Return nonzero to fail. + */ + int (*exec)(void *priv, struct lws *wsi, const char *command); + + /** + * shell() - Spawn shell that is appropriate for user + * + * \param priv: void * you set when this channel was created + * \param wsi: the struct lws the connection belongs to + * + * Spawn the appropriate shell for this user. Return 0 for OK + * or nonzero to fail. + */ + int (*shell)(void *priv, struct lws *wsi); + + /** + * pty_req() - Create a Pseudo-TTY as described in pty + * + * \param priv: void * you set when this channel was created + * \param pty: pointer to struct describing the desired pty + * + * Client requested a pty. Return nonzero to fail. + */ + int (*pty_req)(void *priv, struct lws_ssh_pty *pty); + + /** + * child_process_io() - Child process has IO + * + * \param priv: void * you set when this channel was created + * \param wsi: the struct lws the connection belongs to + * \param args: information related to the cgi IO events + * + * Child process has IO + */ + int (*child_process_io)(void *priv, struct lws *wsi, + struct lws_cgi_args *args); + + /** + * child_process_io() - Child process has terminated + * + * \param priv: void * you set when this channel was created + * \param wsi: the struct lws the connection belongs to + * + * Child process has terminated + */ + int (*child_process_terminated)(void *priv, struct lws *wsi); + + /** + * disconnect_reason() - Optional notification why connection is lost + * + * \param reason: one of the SSH_DISCONNECT_ constants + * \param desc: UTF-8 description of reason + * \param desc_lang: RFC3066 language for description + * + * The remote peer may tell us why it's going to disconnect. Handling + * this is optional. + */ + void (*disconnect_reason)(uint32_t reason, const char *desc, + const char *desc_lang); + + /** + * is_pubkey_authorized() - check if auth pubkey is valid for user + * + * \param username: username the key attempted to authenticate + * \param type: "ssh-rsa" + * \param peer: start of Public key peer used to authenticate + * \param peer_len: length of Public key at peer + * + * We confirmed the client has the private key for this public key... + * but is that keypair something authorized for this username on this + * server? 0 = OK, 1 = fail + * + * Normally this checks for a copy of the same public key stored + * somewhere out of band, it's the same procedure as openssh does + * when looking in ~/.ssh/authorized_keys + */ + int (*is_pubkey_authorized)(const char *username, + const char *type, const uint8_t *peer, int peer_len); + + /** + * banner() - copy the connection banner to buffer + * + * \param buf: start of the buffer to copy to + * \param max_len: maximum number of bytes the buffer can hold + * \param lang: start of the buffer to copy language descriptor to + * \param max_lang_len: maximum number of bytes lang can hold + * + * Copy the text banner to be returned to client on connect, + * before auth, into buf. The text should be in UTF-8. + * if none wanted then leave .banner as NULL. + * + * lang should have a RFC3066 language descriptor like "en/US" + * copied to it. + * + * Returns the number of bytes copies to buf. + */ + size_t (*banner)(char *buf, size_t max_len, char *lang, + size_t max_lang_len); + + /** + * SSH version string sent to client (required) + * By convention a string like "SSH-2.0-Libwebsockets" + */ + const char *server_string; + + /** + * set to the API version you support (current is in + * LWS_SSH_OPS_VERSION) You should set it to an integer like 1, + * that reflects the latest api at the time your code was written. If + * the ops api_version is not equal to the LWS_SSH_OPS_VERSION of the + * plugin, it will error out at runtime. + */ + char api_version; +}; +///@} + +#endif + diff --git a/openharmony/armeabi-v7a/include/websockets/lws_config.h b/openharmony/armeabi-v7a/include/websockets/lws_config.h index bf49e46e..96452c48 100644 --- a/openharmony/armeabi-v7a/include/websockets/lws_config.h +++ b/openharmony/armeabi-v7a/include/websockets/lws_config.h @@ -1,117 +1,156 @@ -/* lws_config.h Generated from lws_config.h.in */ - -#ifndef NDEBUG - #ifndef _DEBUG - #define _DEBUG - #endif -#endif - -#define LWS_INSTALL_DATADIR "/Users/james/Project/cocos2d-x-3rd-party-libs-src/contrib/install-android/arm/share" - -/* Define to 1 to use wolfSSL/CyaSSL as a replacement for OpenSSL. - * LWS_OPENSSL_SUPPORT needs to be set also for this to work. */ -/* #undef USE_WOLFSSL */ - -/* Also define to 1 (in addition to USE_WOLFSSL) when using the - (older) CyaSSL library */ -/* #undef USE_OLD_CYASSL */ - -/* #undef LWS_USE_MBEDTLS */ -/* #undef LWS_USE_POLARSSL */ -/* #undef LWS_WITH_ESP8266 */ - -/* #undef LWS_WITH_PLUGINS */ -/* #undef LWS_WITH_NO_LOGS */ - -/* The Libwebsocket version */ -#define LWS_LIBRARY_VERSION "2.1.0" - -#define LWS_LIBRARY_VERSION_MAJOR 2 -#define LWS_LIBRARY_VERSION_MINOR 1 -#define LWS_LIBRARY_VERSION_PATCH 0 -/* LWS_LIBRARY_VERSION_NUMBER looks like 1005001 for e.g. version 1.5.1 */ -#define LWS_LIBRARY_VERSION_NUMBER (LWS_LIBRARY_VERSION_MAJOR*1000000)+(LWS_LIBRARY_VERSION_MINOR*1000)+LWS_LIBRARY_VERSION_PATCH - -/* The current git commit hash that we're building from */ -#define LWS_BUILD_HASH "james@James-Chen.local-v3.4-138-g60b1a6f" - -/* Build with OpenSSL support */ -#define LWS_OPENSSL_SUPPORT - -/* The client should load and trust CA root certs it finds in the OS */ -#define LWS_SSL_CLIENT_USE_OS_CA_CERTS - -/* Sets the path where the client certs should be installed. */ -#define LWS_OPENSSL_CLIENT_CERTS "../share" - -/* Turn off websocket extensions */ -/* #undef LWS_NO_EXTENSIONS */ - -/* Enable libev io loop */ -/* #undef LWS_USE_LIBEV */ - -/* Enable libuv io loop */ -/* #undef LWS_USE_LIBUV */ - -/* Build with support for ipv6 */ -#define LWS_USE_IPV6 - -/* Build with support for UNIX domain socket */ -/* #undef LWS_USE_UNIX_SOCK */ - -/* Build with support for HTTP2 */ -/* #undef LWS_USE_HTTP2 */ - -/* Turn on latency measuring code */ -/* #undef LWS_LATENCY */ - -/* Don't build the daemonizeation api */ -#define LWS_NO_DAEMONIZE - -/* Build without server support */ -#define LWS_NO_SERVER - -/* Build without client support */ -/* #undef LWS_NO_CLIENT */ - -/* If we should compile with MinGW support */ -/* #undef LWS_MINGW_SUPPORT */ - -/* Use the BSD getifaddrs that comes with libwebsocket, for uclibc support */ -#define LWS_BUILTIN_GETIFADDRS - -/* use SHA1() not internal libwebsockets_SHA1 */ -/* #undef LWS_SHA1_USE_OPENSSL_NAME */ - -/* SSL server using ECDH certificate */ -/* #undef LWS_SSL_SERVER_WITH_ECDH_CERT */ -#define LWS_HAVE_SSL_CTX_set1_param -#define LWS_HAVE_X509_VERIFY_PARAM_set1_host - -/* #undef LWS_HAVE_UV_VERSION_H */ - -/* CGI apis */ -/* #undef LWS_WITH_CGI */ - -/* whether the Openssl is recent enough, and / or built with, ecdh */ -#define LWS_HAVE_OPENSSL_ECDH_H - -/* HTTP Proxy support */ -/* #undef LWS_WITH_HTTP_PROXY */ - -/* Http access log support */ -/* #undef LWS_WITH_ACCESS_LOG */ -/* #undef LWS_WITH_SERVER_STATUS */ - -/* #undef LWS_WITH_STATEFUL_URLDECODE */ - -/* Maximum supported service threads */ -#define LWS_MAX_SMP 32 - -/* Lightweight JSON Parser */ -/* #undef LWS_WITH_LEJP */ - -/* SMTP */ -/* #undef LWS_WITH_SMTP */ - - +/* lws_config.h Generated from lws_config.h.in */ + +#ifndef NDEBUG + #ifndef _DEBUG + #define _DEBUG + #endif +#endif + +#define LWS_INSTALL_DATADIR "E:/work/harmonyos_data/third_libs2/20220210/build_libwebsockets_armeabi-v7a/output/share" + +/* Define to 1 to use wolfSSL/CyaSSL as a replacement for OpenSSL. + * LWS_OPENSSL_SUPPORT needs to be set also for this to work. */ +/* #undef USE_WOLFSSL */ + +/* Also define to 1 (in addition to USE_WOLFSSL) when using the + (older) CyaSSL library */ +/* #undef USE_OLD_CYASSL */ +/* #undef LWS_WITH_BORINGSSL */ + +#define LWS_WITH_MBEDTLS +/* #undef LWS_WITH_POLARSSL */ +/* #undef LWS_WITH_ESP8266 */ +/* #undef LWS_WITH_ESP32 */ + +/* #undef LWS_WITH_PLUGINS */ +/* #undef LWS_WITH_NO_LOGS */ + +/* The Libwebsocket version */ +#define LWS_LIBRARY_VERSION "2.4.2" + +#define LWS_LIBRARY_VERSION_MAJOR 2 +#define LWS_LIBRARY_VERSION_MINOR 4 +#define LWS_LIBRARY_VERSION_PATCH 2 +/* LWS_LIBRARY_VERSION_NUMBER looks like 1005001 for e.g. version 1.5.1 */ +#define LWS_LIBRARY_VERSION_NUMBER (LWS_LIBRARY_VERSION_MAJOR*1000000)+(LWS_LIBRARY_VERSION_MINOR*1000)+LWS_LIBRARY_VERSION_PATCH + +/* The current git commit hash that we're building from */ +#define LWS_BUILD_HASH "xlb-20210911jjb\\administrator@XLB-20210911JJB-v2.0.0-640-g8964ce9d" + +/* Build with OpenSSL support */ +#define LWS_OPENSSL_SUPPORT + +/* The client should load and trust CA root certs it finds in the OS */ +#define LWS_SSL_CLIENT_USE_OS_CA_CERTS + +/* Sets the path where the client certs should be installed. */ +#define LWS_OPENSSL_CLIENT_CERTS "../share" + +/* Turn off websocket extensions */ +/* #undef LWS_NO_EXTENSIONS */ + +/* Enable libev io loop */ +/* #undef LWS_WITH_LIBEV */ + +/* Enable libuv io loop */ +/* #undef LWS_WITH_LIBUV */ + +/* Enable libevent io loop */ +/* #undef LWS_WITH_LIBEVENT */ + +/* Build with support for ipv6 */ +/* #undef LWS_WITH_IPV6 */ + +/* Build with support for UNIX domain socket */ +/* #undef LWS_WITH_UNIX_SOCK */ + +/* Build with support for HTTP2 */ +/* #undef LWS_WITH_HTTP2 */ + +/* Turn on latency measuring code */ +/* #undef LWS_LATENCY */ + +/* Don't build the daemonizeation api */ +#define LWS_NO_DAEMONIZE + +/* Build without server support */ +/* #undef LWS_NO_SERVER */ + +/* Build without client support */ +/* #undef LWS_NO_CLIENT */ + +/* If we should compile with MinGW support */ +#define LWS_MINGW_SUPPORT + +/* Use the BSD getifaddrs that comes with libwebsocket, for uclibc support */ +/* #undef LWS_BUILTIN_GETIFADDRS */ + +/* use SHA1() not internal libwebsockets_SHA1 */ +/* #undef LWS_SHA1_USE_OPENSSL_NAME */ + +/* SSL server using ECDH certificate */ +/* #undef LWS_SSL_SERVER_WITH_ECDH_CERT */ +/* #undef LWS_HAVE_SSL_CTX_set1_param */ +#define LWS_HAVE_X509_VERIFY_PARAM_set1_host +/* #undef LWS_HAVE_RSA_SET0_KEY */ + +/* #undef LWS_HAVE_UV_VERSION_H */ + +/* CGI apis */ +/* #undef LWS_WITH_CGI */ + +/* whether the Openssl is recent enough, and / or built with, ecdh */ +/* #undef LWS_HAVE_OPENSSL_ECDH_H */ + +/* HTTP Proxy support */ +/* #undef LWS_WITH_HTTP_PROXY */ + +/* HTTP Ranges support */ +#define LWS_WITH_RANGES + +/* Http access log support */ +/* #undef LWS_WITH_ACCESS_LOG */ +/* #undef LWS_WITH_SERVER_STATUS */ + +/* #undef LWS_WITH_STATEFUL_URLDECODE */ +/* #undef LWS_WITH_PEER_LIMITS */ + +/* Maximum supported service threads */ +#define LWS_MAX_SMP 1 + +/* Lightweight JSON Parser */ +/* #undef LWS_WITH_LEJP */ + +/* SMTP */ +/* #undef LWS_WITH_SMTP */ + +/* OPTEE */ +/* #undef LWS_PLAT_OPTEE */ + +/* ZIP FOPS */ +#define LWS_WITH_ZIP_FOPS +#define LWS_HAVE_STDINT_H + +/* #undef LWS_AVOID_SIGPIPE_IGN */ + +/* #undef LWS_FALLBACK_GETHOSTBYNAME */ + +/* #undef LWS_WITH_STATS */ +/* #undef LWS_WITH_SOCKS5 */ + +#define LWS_HAVE_SYS_CAPABILITY_H +/* #undef LWS_HAVE_LIBCAP */ + +#define LWS_HAVE_ATOLL +/* #undef LWS_HAVE__ATOI64 */ +/* #undef LWS_HAVE__STAT32I64 */ + +/* OpenSSL various APIs */ + +#define LWS_HAVE_TLS_CLIENT_METHOD +/* #undef LWS_HAVE_TLSV1_2_CLIENT_METHOD */ +/* #undef LWS_HAVE_SSL_SET_INFO_CALLBACK */ + +#define LWS_HAS_INTPTR_T + + diff --git a/openharmony/armeabi-v7a/lib/libmbedcrypto.a b/openharmony/armeabi-v7a/lib/libmbedcrypto.a new file mode 100644 index 0000000000000000000000000000000000000000..650236eb5e4dff42c7ee85f81f49c0e40147190a GIT binary patch literal 2274830 zcmeFa4}4U`)i*wO|7R1z0#PCc+(49|2mvCZQe6}+Dr)$T3MQLm1JV3hlMR0qH7Fn| zQBbO=;BJ++wxu>&pXc#uZHp~d>Z7f-P_31^Nm!Svt+chRPixEX`<=OW_uji3?9=xB zz3=<^y!YemoH=La%$YN1&YYQhgXJ^B9Stkb_fHO5pDI&P!RFs!aB9_zY13t$I=>K( zq!0_*{-sF^b%>nQHdbi=O#0coLi-ma$MX3ilQ#TKIQ}n8?!}wLpy{cv2=}KX&%EK{ zxaqZD3eO;5vEi!t3&)t(wA-$CAM_J+5avw>7o0@ z2}b(u-^2-d(uqIw2zwfN?rJEc81uXnO1iqHM7AZj&e*B#r(|lNdC8dAJz;KS*Q5m159z!8KxxIko;x zjQK~>;Y-Ar|BWd)|2rZlJ@S?a{sXDp-6Z~@)cUw6|3}jMUlHYlq_Nk$EHY`u>tgJk z=jKbT^^wL{OJ{93(plTku{Ij3ZK!V$d9Y3OQ>MyiWX{gVGZEwnlT@&lH z)NPDN`7F3dTQ07tBNDMxYHn+eSrDC(mZsWRq|=U#-4Iz@i*9U{B^o_h(2%Y+rzawF zdLyzkl9#uMWai)87K?PWg8}k`iMTlbAeOQRrA#G|R2C zZAxuZb6aC=TevmSSlbwmg>6Kr|L-N%wlte3fxK5lVzuFx6;_@)vbL?Or6reA-yG|V zbu_o-X_O%i*0jAn55q`XS8HxJP<$@3CDN9QY>hVOB0D2Dc44|Awe3y0#8}uSe5ST_ z=BS}qM|f4FqcegD8-!zLti5CKIauA%9E(uL?EqG`);2dr+G5R3%@NarWk0H3MuS$N zbz+YC6h2ph3f~+)t2W=H zFkFjxD>~X&TM!m!%T~>85Y{GGb7vm*2C_D?#@a_qXLipd#};fcmOjBgM@Ph=vbA1U zOKv^j?Dg`ftRoU`#NgY)9oFeF;cHv0>XIZ(K_0Bl&N-<3mWh$(sJwG!b5pD~>&s

5E$7zCF3|9lkF}ehfXF6}g z#=7C2hkG23SLa==$!NG8a*FK)U|YVa2%|2j*W5nzW5)FeEo?0ugWbShXd{JAYcH`F z7>+%81pcFjZeLRD3v|>)FrMnEa<(20Dt%b7M6paU1pSd;Ov7^&7XuyWxipgMW4h6? z%1%4}Un*ylmfxnhOECqE&T`ckI;0Iyckfp}mj1ZPU*}Ng@jfgM3*JjlRVs&9Pc6tbhaU7SjnxoihxZ;u1JVL6l=ZC*?n3&Y0d z7zbM`uzji+@mXyWet>eSO&Z(vvA=@1Y~t{95qPRlQCkg?S~}8%U*k z{NU|tR~{%U>U^%>c?>c=b&c5381S5mxbozl{<82Mu{%75Qs9Jl^e1EY_7*$$r1itL z!XqmMu&X}omkO{t>6<27nN;7fSgL2Mlf*c&y+7ZH_k4`Y67Yj<^|1~<=jp>k9aC4) z59rAcWBuq*cpL2ao?eXOM^R>9IWXT@0K3`V4_$wOyg!0CjD}JU-r7F{`Z^u+?->~1 z@PzI5Ga&O(@@H9;-CYLy(P*hR%40ubeUV@4|3mZztZk0^&~_|`va=4u@P{&Syb@lh ziyu0*^^ZQOddQD#`^@eh!ed^FY zXe(b*+Xw9wMW6I7-QG*xd`M(9W5Hw%{IlTC2fF*f z48#>WZ3FrR_VTdRHmTe3%Z>cZfBfzzkB}!Z&$+e-`w!taB%JEWi)8E&XHmk_*!eEB zQJlx@5V5;&+sI@$WpE;yeh3?r^4xO4jz&jiY%}xI)bK7m={xsyJQiE<4Ej3SweKF- zQy$ubvSBMb+84XKm%N8U7OnwI`Ek_U89g-I3L9$cWtxpQebUt3TTkhOosT3r2Kdo7 zBls#=H{_0fy5HAzSFh8xrQeDE2l~T&8EbvrSL4>xKcL-6cVD;Dy`{epWjQ)#+J5dH zJJ`ST(H{e`R8L8ieQQ2tEhw(r)9;JU=nY19^arD8ulTlJC$2Ut?dlZd!?xJhEngeP zlXl?qLpYA_7`vQS_)~qEbc|aM`=nl22lv?g0cTzx9+|zwi9CR^xAZz#>pIb&^#>pm zWG?n=oUa>k>i36#)<2?XbI+*owBDN|T$j$HF1Fu{^=OG}9qVA7QRrlJ;VXn(7(>zT z%Z>rf!EINLSOrSQwc-XL~z8s4`_uH#_ zUtET~Xn$V{eH}I%r~|fRoQik6ir--BU+jksKzCxZozS6a|Iv)&`0tKKAA|WI&nVar z`o%CO<@?-kcleL*d@`SO96OxTF}9y;#`dQ`KNWGUTlVxPo6Xo>9oy0W9mMZ*cIZ5{ zs4wJm3JRTVy;YdIB8eUSrO6%rRjD2QWsce;=UT|c{!|8zy}V!CRp{e>iz^ zJI9Oyk1i*oJkECR*Rwx@qrp3_|py-*(?WqZ`2&fssyBaU$+ zQC53HUH8rLH(uF#UaIHjaPKR=FSm6w4<@V8Uj@Cb1IIR-m+4sFkKXFr+RgQmGq(+6 znpw{=%_p)ATw|O7ziMYsKkHWz$&7vPAif;&T=!9K%+)>BXAyk~2Q6cGGEW6^1do zG&W1-mol{9=8>DbS=Y@z*gWc98lT=<>a6d>d|FUi7sH&>+RZZkk=AbP)jjrY=I=L8 zo-Ft==HxQaC83`LWMN%kLp}YFf&S8HTQ6l1xv_8dS8Ns;OQU!7`q4N3jJkdgJPMwi z)?0!3g!X*KBRhJjZ?^Zo*p6Pe{Y2H)xmL7xKh@Po@?)u<^12=U%cM{3==Ju^Tc~f? zQ@UTNes0!wC=4fiqmbKeYoFA#Vx+OI?z9z1t3n*x#2tUV#&cc5wQH%$?Pz%mG`$dM z%tu}COQNoINtrv-a>Jf5h|Ff+$Pc^bcjbeAQ!pL+TN*Qa1U!M=KLj@Ut51QPTR(|J#E`rd#OsX z9!vVFQ6D?@me=j+-}$$bSchVa?lj{m#%7F%@zd}5+sT42pk7V@>qOL>`-Nm@te1Q) z@Ht28HsM?=M*G{-PaXUN_d;kVjK`u2t4od%0mwOPX$Q`+I$mY|BIIWuVPBy<*5*lz z`~?xvl9#0)3i=`k<09ih!}#LPJ^ko&XS5_+&)Dd+p20R_nY*=r%!!%(mF11OsqZbc zIc-7g6k|5&IbRG#Tc?(%dMppo70PE>GmwWoX%FdjoTlNP*J$S19Y){t*w;j)6+`AT zz62XYzo3475v)O=Gs+p@ULDS zmbkk+9NgUFL;ZrXm;TYKf5f=L`DGaPC)`KJNB$b!=$^h|QSe~7T_`^RSBEu1bbjxU z_=Vj=5_#RB*z-ND=Yv-y*1yZ=?+%5>bcZ7TZYSJ@Hr;~#QL-1~-sp#}%d}k?WV1S+ zaZP5tqHTQ%b*8>qAIi%)knyRdynKW&F)PQ?c$Exmg#XAD1VZJG*&Rn_- zr}p%_^+#KE>*-qX;Jig0y5n(fdrJKkLLY4B^2k8hF`teuk3sIR*>_SuxpZgyB>Q+S z-Aw`?)_KOIm>Z#|biGxF-^M(Eb5|LgsB?}@1y9CgEV1Jt_vJWC!dSL=B>oi8u0rjY zx3Sj1oA`1TCgXY?*46K|cEfsQgRI>aq}Oh&+t4`e<+?uD{^=k8>&b!wwTVKsJJZ?z z#7TcOVyX`vXv?^{?Y*MUKtW}()SOxynV+dur^#XexT>=>-Eu1NP2yW#uj_Z|l z9?0}I`UBe-=`#0ne98yU{OCZw=c6Am|Nn&SO|_hhO*{PhuP0?)NL|t%tgePpmukP% zrMr%wgUtVqenA~jf2EOu>D(8zBd^a%(9WMDjUA6^J6tC)t_1lIFJ-;~8*Psm8)$_r z*!vC8>r>##wxNDnLFbm|aY@URM>=nLjPsUPhVt3Yth<}vUhpeH-K-6$%(EGG^LPs~ zlLu|Y%i}ZPQKvef&jrUad^w&bBx(IB+qlY`dm+7;R-h}k_ z=s?-mBc0)cO zu(lmwcjsvu?Ll;D>~}Wl-F2YO$a|wl#vzD*H=bD&`_OOPV=;NKUvoURW3ju2@4Wviw2DVV3{$2~&Tx(}24F0`V-Hy5(BOJ;t-_pJ+b!p7KX0WWMa1 zfc-~pA)eiVp&!RNSpyn=C9nw*>l3%dfnr_6LV(Z%3P>|wT-52_~rY?3ir`MUu6+G9E_nlmOO&{iig1iLl3p%s`Wf+3!>|2?mrP1PG;5+LC1_OtT*R0u0d(Pq7#u@?kSEAqEC?~g!GUn{YuChPV?E(JCkj- z>9XFZ(PwNsF2$MtknrZ-FZ<#>PvGp$+lK#)I)oD_Bf0Cats5}}ncT8q%{e+8-ywCi z=L6Ii=VkIFeGoF*HkEl9_27LV%4ls3?Z9(ye3l;fj==Na$PTPon4Wn)0(MofFGoD+ zrM~D#ed)f2GAIYS3GN%A9#(F|p)Z_H8?ZXM9eOF|ejjPP@5D9;M`W)&psruXm=#Q# zwz6%=Jg7^04Kmc$Rm^aYO$s2}#AoQtyS)WWowu_bq%*nYGx>djjw>vRLkG3&%aqU@)ahm#%NA~nDMq4=;W0+6uTIp!F!HDS#q|FB}cRExeV;s|L zyzTE+t^(y5k$WUsPaUVw9=>vpQ+gl4fo}0Um0X>V7Rd8f)US{7)S>?1MLP<_jV`22 z=n7}s1?sMTS%G;M`M~G(6akL=Vb` z;{#2ajbK|0ey$eSL!H2*BkUl`?CUUqtn`5_l=Gd=ce-YG~6 zw%^-3Cyw&bXF0x>V|-=5b&szffi4(F+e?pi%7f!8((&0tmu+g=c<|@BM%p$tek|g7 z&Ow{PvP|;Y^GZ9WMACWhHg>0ZadTes=0O&#M~pv5*(QaNyRnYmk>1-`UYxV2ga1z3 ziG8`om!+=pB?i64RBxP@yn3Tuol0-N!aP8^+`2}apwFN^qG}J3Og%XcJ&*Z_wo(Ne zws(5Js`|k*2iUV99W<7Q)f4j{M7qt(b(7bg4v;@&B8@xWBO0F`!?e78jE|c!-90~! zajkE>HpBVx3#dEW%w2bELFGKmTgFb5K|Aus--CGCk>!E;<0y5)^FP|VmH$qb1$~qZ zqO)7ThkciN1+R2I>MOxC)Q{(FcKz`|+nMt{`IqJ3zxaQE|K;G%v8W^mf9_$cAV1Ho z{=4#zCx7TJ7Bx2KwV98g4BDK7H9)R0=v<_8Oe7ELz_ttZTg?1Ek%spD`Y17f1OXndP+(?~_ zz#LXEe48IS#iy9D?l^??6V}a3>-apYd4}(6Hz&JU*Yuo2J4F5QNJP)wc<#&HmVAbX zVd@=rpI+N=&BS<)Jvh5b$8(>~c*&{ z;PcS3k2sEWw$@YJN8lX&ejo!YURH*~Wp!TXfP&RM>@o&JbE-G+NlWl=-Jao(x( zlnov%dnfA$J#wwj`uNBbf^fKfi1GE2<|H}yb0@X@`=zMJbW;hj%M5dTT37e z8SreSq`B>lcEL1`3(RNjEF*)t&%(5mE<3gPXu~1{($Y4sJh2}ru+L6gefbOT?zMVj zx&IgQJM{&AwEI4sm5lDf7%TShlzCp*7dQQ!ZIkpt*SH_YzKyXCef`0He~fjQE6*7@ z2oHsyXOa=z|3+I~l*IWM+TrLXJnzMIDQ!^dhw^X^Rvbkh>Xz`8hiwi{Bspn0Y z+je38;#kAIF!#ai!$lZZ!bv^Dmiol|u+AI3%W*w>gf<(BxDe>wxi9YyIpatE8|zjcl555I&M{+n*DK!W3a4!Yx*n&@0zGy4bIW< zVxU{EHE1X5jP)r@WzJuUJ7F6dA92%QoMay)eR0f;hxEe^(z@Zez&Q3Z_Qk89Q{LzH zLyynm-6Yo4=HWQurp34?;}q_H_7+8`C)2KMr=e(P+P#~e_uzen&p!b2TTi}IW$Vd27-t96GatN;ApX7O zUfhTNTHtdw@cE?Yc7ZSZxSKciF_=6NmD9GFZEM?JlozJTJ&?#(Epn@Ej^z5C_XASC z%U#dP9za9xgL??>8Dx&Z9fq;r2Z#Abu17D;6T2_MnC76(4p86d8~&7$-Pew_9&{35 z+r*On4{3YQ-|q5Hb#Sg1X~(nH+U^NsQ`@pY=<#%!%?|7ACTK-(~Tv2edp8p`7vNJCpitc|~ z+nWAkEX)+rfL_1{%~MdP@~A#AFJXK4@GI^nD9)a(@)WGY{k4 zIX>6V{scYC+6et$)_x*i+_WvS7O=l_er&+KFxCb4G|+}vBgHW>P^o*6T>avC!&$1j=9>?Si)CmWgLhJUbaI z{b%HlyzcoIXAak4U2`-T!9Gd(x_SNpd8*hxabs)cJYRO5Ia(bsuUk$$S0rnja_AR( z4!Pw18`cn2+TV`oxu(C9I_-G%WzTu$p$9wq?b;#=8!y#y!p>!d8Xk_aDRZ%&ZQ|Zz zK{3W!$~G(l7aiCy?~!LIF!zHd5K-MGOuKGDS~$72HyGR6TUv*?7(A$JtN#mde#1EG zFbLi@9`k7dZL%59R~AR`UX_;bj}9#Rli*Leiz7HQuzZn^_Ok+MEVnR6xflyRsoa^0fP)|LaLYB)>9_1(;MAl20j*bcgZ|ju9HvWP!ESF87%u}|_>m0X}_onsCGk>oxF*k`_q}L^?S|bbM1T0Io$U~bsvg# zi?7PH59L`Z`vQ61g6D7et-crFo`>Vr`Dmf6KRF-1I34q9JM`SiHOIWZV2tbAUHzQ* z^6~zK6aGBb7zjuBo@%`3>yVl2d6buaN7avTA=V21q}C5}%3Y{~lLFra#+(@Tk)WYG zg?wi`R@=+>Xa=hz>&ACiy!vWJ*?z3ap`S~F@q55$R&POs0n}c_}Fh4odws%v8!f?$1{nN&S&K0s(3fAE{u~(qqDVPe1c9Erj>}tlZ?mzQsA2d$&TA zNghGv!92E{aYzr1eDGB%1N_r{2zg=OqeH$2U*(>V?+1~_olg5^I_1ih&U@8N&kuhw zz3%3@tBteo08vh^uNlvGhA3NpY!9B#S|IvD+xHbhcaK5m0rY`nGuEd#!vn9Qw2ML8 zAN!1gcxH~|`n?csnD5l~{0Z-AS-XhDuurk}I!Ir577KlxVaX+SkMl>~Lx|ukiT632 z7}nTzm@^=cFNrqMGbP?b2tjYGQxG;H7%|UCVO?&X(W@J{hsGKW>z1}&p6k;l(mDr! z>WX_8dtZU+>3K@i`P>HY88D6Ol=Qfy={#@aJ&D2i%XotFEf073*sGa3D2~9Mnf;9S z51bXl0yx_bV80~$S$VeXUUMG-?+wcJRO^r=_&aAiL;W|RF)=n!ul}3i55kZ3_icuM z2>c&{|6cg<-+?Xpz6cNOgueyr`zrh#hH#MKdlY^&k8_68?K}lP#!06L{vW~5Vo!Iv zod19yn;U!wwafW6{5WrNphw@U@IxQ?erA`CzoqHEq95$4a4ySz&8(bsS>3|r(xhpVt7>LmR#QF0nK*OWq{}8$PnkBMdV2Nr8PydtCr_F@dE$iW6%(gTn>caO zl$jNit1D+th)$b6b8=1PM5pS5i4=7v=N4(uSZCq~ygsl<-WoU)XH58e{zaXMlPf09 zoH1i&W!1#$371WtHaS{3VMb+D#iXhUQ=${ACskKf&aAGOR5Q7nOHR)EpS=&jF~eg zPnbL{I&(@z<@Bm4lO{}`G#yP@H3<^@eb)zXCQtj}HTB5M8S%*cMG^cyL`&rSib&at zwQKNm1#4O&YZJ>>tX;pRr985{eqCckK5!nneC#C=Z>Gwenbx+fY-~2UGI_3AyQbyF zwW}MOZ#4yGmqywJYZ^Bu8dtP5Hbfemo7Xm%N17X3);F(-tXSL782NbQf@t;P0%sk* zNk6f&qPfCZ-dw+GO=9iZruf8)N`#p*p}J~7iU~8Na^fVVf$t`FZdXbra|?B46=>+I zm|}Uuhq#TE6DQ*H=Nqf4svZ8`1EejxVEtHZhwIm^YsAEFuL^jU!+i$s8Mr^f@%NW+ zgxd%A8r($~h;D*|H~pP0x4-*$w{7~^w8tMgb79|~-|TqilP?Y3@w?rXkNtJq^3a*f zu6W#8w)?XOzY@Q%^sz&aE!ch68%u&UOP^U>a{sm$$6WpELmeX*Z3N#YxH`C6IP6EA zC|ofduUT-Va2zLF;o9LyPuf$_k#8Lw`7zH)Tma!40s5Va4q}=3Kh{AcKfg1zgIFd0 zDILUW@n6zGjEVo_9Yo6Jcd9ywaq&;+ATAdF#10~5^*hxa#1`>ab`Up;e{u)$KJicL z0LW!!WgrNL`G*jZ;2(VP_abCng3e%sVWfg1VJTYD=hPDF#2Y6xz?tmyJu3;dpq9(Z z#&2aMBq`nk*l4_)07>I*1+*D2&j8zvmq&sR8SidD%6RtzXmAi~KcLfi4*(uF-h+TH z<9!BTWTL7E$izS)9M}+OHiN4n-w+bG4uTp85xDo2rw)Y3gTHcFwJ_k~ya~Y^R1Jt` zQqXC^ci`ZW%gw{pNUR2U5Z-sg9x{0dFTmxlQ5{lfihd_5Cb=8_fV1Jw4tn;(;k!ef zfP*%ko-R1V;43_|QN@K-K(xrS;k!BEvIQM%JJ zi5d+$BR_p-2YoCXWy1@<>nkjjL(@%V571cb8|LVmZ1M*BDjo+GUwJL65NK* z!rxn0hAK-?@}h=xh%kye1r>i-SJj!*DvE^HJi;tER$yLE9h#cXCzwLB8k;4Nk7-8w zB5)A295B^*@mDT)GrC&Gj8ls^PH|N7Ig19*AQojrxpr`>dE{>FE@%Bs;qwVb71w!r zF{u_V`VNgrh2WL!|zWtIAC$O?6fxbATMzsl?FH8b` zoHmdE61i+;7$}27A0?Oq7rP6b+ra|K8#Dyd>Wl4^#3JT)un03NEe45P?jlMNgEJt4 zDPobkh>cgN(i&yNH|ZHhRlWp{FTd=%Rm^;=gcRRi}xQ0Hv9anak5HNeRA&i}z!_QTBS$0voYT?j@2rY1?-@qeRHivm`4)a_b=D9iK zo(KxT6G|bls2uG=eX#)3%(f_0&`N3&SQJeJ3HU3QTT)YwEEUPnXp6p9xIr{*6giiW zgd1E9CBkDK!4hWImW3%Hd~#Uw&|~d zgKh|xF!w4kCWP|{Bn&vs*^B>tB!uB|*lelh8%$u$Mle=i%kGncLlRr{9K8ty zx-^+v1h2_^T_*2!%)3kSUPqV}q@CPRMdZd5qAtY|=nHU+=9B4sN}YbP=H*sb1Yrz^ z1XI+tENUYTNPW(=hj6CZ4F_)whIIsw;K6$gupg)6@Pbq>H%HTj<`WFZg&E-&Quvoe z_=Q$V>|ZD(AEVE)l_>|CYBeDn0cJb^ZAn1#;7^WhNq4qn z$dxS#+0A9MB@s-)<9V@&T13cY8Ke+;2F~YPN1*O#Aj~lbr6GDHG}H#i zXyScvh$cL)(Zqu$notg#AvG~2_H!NW=S4V16OAopEx9QTMSwwNB)FCmWZNM~<#N~L z1Y%%1gk!S)xh}&dYw?u=)j`Ryh@e%EFvk%%ETma5f5Zb)M`#SR1o~<7Y)Sf&Q!cj{ zU5N2HiwVlLG{bc#4$zyJ-4M%PmPk zeE$9#1_FXXGCGC`E{*e?oALW4qdVwl9rBzziWsKo z)PfDu&wI{!=)6q#^2BuCkC{vu(U@gAmEhJq!zI8kWofXH0v_4fhz7%RMl z$Kgmp?3U%3tNm zUo}|ym>O($cx`TYZDx3L<;`AedHifQJnlMAb`z#=W+s*J2riwQn z1I#hrId~?e2@V8=jpB{B0d|?#gLp9H88{5Sgtx`JB#y>Sz#*GgdvB}UMl9AqMfVcE zfTV7zRot8OGNP+dp&YB3QzVhuyM`g5Oc-QM2>FQCdC^;J6OuMct}KaK5X}X24v9{Y zL}u-VA)!mWSrVlXZFpxXGlCZ7$}~r@FC&^i?ujGIF*9LS1^ zZ4wS;H zhFU_kk*(M(Ks(adqMX5rcuy6K7Z7+bz`MuZES4RX+lTyFsbq2hjtq(9lB3r}5nTm0 z1WVxX$sFs$FcL|WvhT= z>B=KLQuCa$M>0OPpgxODJo6I)I1abmd3y};BRTGP(ggAk@ z80{67S;~<%1Y5#g!O0h7)rJHdqD^h+8$|9JB*ozd+dLje+S_nBmZrxvDVH{Fnkl~! zc2_L67cT|W7%weyzj(8>ITg_jaD3WVxzfBFXDltj{faD&y4ea*~MSqoz(J+7k~ zu?r5yO(@jminm>ug%h9}ky7TEK8_*jZMeb2qDWj28%FeTU7UkaH=>Wj!Ac^0N;6*; z$#V%jy<;@j@6TfqEF>zi-9(2$S1nntBbdX{h0MWKbdICUS)f{qbvCV%>uoJW_D{^h zc&}Dmd8%A_WY45|vKDSO54t~2nrto;vf`Q0{~x8{WOQm;ObJ*iC6G(Vm!V42zTNO0 zhC}-jPQb~4Ob?Zfcxqs;@tyz_p@k6p5WpPL;wF7CjExH%;uC;2IN?H1%EZ45NSOW5 zUI3M!bL4MF!TcF&BOZPH5os_cyZ|S;=wT($DZKUDr%5n}tfsY9G0gX&Hl3zogu`$- zMcS{4xi|))25Q7`EQT)v2XP6ta5*_Lp#je1S_xkQj@koIvpI7$X<}~UW43*8hUb3x z4#0sYA>C45ZFOp5Zl2|6G`6eZ8G~;Y9C#Ag(mCa<(Zt+5+mT9}Fg*9dw;v8X3Eglx zdDg*RXg(%a3w)d4kc&Wr%9)E}4>#c^7k%7|BbQeVb-G12gxsw2L?#CzGh)m`lH6)7 zg4f(jqwjf1$U0U;tUSJl+iIooE*7c z8{vdEJyc2#-V~N+0;mmv_Bi;xU_&_9O_=*$upyM^11!hv=L1lb7A-e7En)U^Ata>T zLq{N2uHfCTJ9PZH)ctc_kt<(tBe1f6M>TqR9YJ)S%r_T`9 z!Y7xzP*=}9h(xSsx=17CFAM_OjF*wT+<9HqGI?veNFo_(GkH%@?mQMBkvv(8OT;=x zI(bybv|W~ZNznplDofucI5Y{N2BN45!Z%9GS5NDo+UGr?t?Sz=re>_ zVs{})RX`svtFtZ!q~xq>FzFDSVNahS%wkWq@*y!pNS{`VS$NsP=r;`{GXQUtV4gS# zXv1O7DW?oE)FR~1ad#oZR-VC(2vwGp87g_As6?o;Dosm20cYw$-$v0+?X#>FBsB>u z;Y*45wdEKs4$6p8+YrRJ+u<-(5Rz~*sL-?9#CPEg_JkbI)-Fb!O}(>PwgH8)TvHf* z#^h@W2jPS*Jrpa)%*5yy;S2-u8EH`=xondJ5zQMnhLFCgxd~Z!)*7wU1%L$fDz|hC zTPmzyx*WNuL_!n#dui)XtPztwBTFr1c^gg?LXQzFOQW@#1q)Hf%1^(&tUmT@Ynp=C zuFpzMYYE5Uq#$}un0POPFxoi+XBg0D9*xP8s0~Rp3PVWWJ~*@`fp;IIBzlgRcyCFJ zJ^^PK(8pU2U_h7(Ck*JBW#YXI7|okIh5>ym4IyDSoG_qgpNaP}ID+UCa4G?O`O=ST z2~**W1n|r<@m>ZDn@%m$RhbxbR-YtQF&vgzgii5hO)*mu-2i8Vp)V}#at;Kg!b2YW zFPA)ny(D7@W$|eVbI;?3P@WC8gt_N&LpYyc33JcmtPmy*0*%M4HR$6^jRZm+oJpW> zB^(k6`O^6Zt5u;8%9zT*JI4S50)3)-UKzYB7Hd#Kop|RFOx^_qTVC!u*GL{&AlRzR z@1Sp!Ng!Ab*~*9_RXM;Xm+h`q2yw{H@mMXRlD_@LHIm%IX*i zGE_NxMHwie1VWv7b5eyRNnZCbR5V1ntXvGxzR@ZK@}rT?lb7r2B;gdDe10(~ z3{}=yFj+<6Oed$$7)H7?Kzu~XWu>vz$#n+dN+YuY`51`6fhA$7c(b&NSf!d9f!9!F zwG^qsaL@?BQ03HHM5yKy3{}oHFjOKJ<;D`ZI-Oxq5pm0raa@lraAOeTN2`0m$OoptAlgiid#iu5mB^=o* z^clNlDRNl_%|VEf0jH%b{Yq>O%Ol+&+B-!Oi^_*Xoe2%%U6=yY`WU;g0l9yGTQpyeB(exgF6j%ZX2$Ze zyy-Wp5``M7Ec+!@85~9of}x^G%4K=6v?yGTc4HEaO>0hXlTgM9w4t0ew~0A8B8$6v z_aO)+>;vpKUi_8IO2>d{J9$^84MD7vn1OqG9@_y9!Epl2UOAS6kcF5o%xpXcFd_O< za1em77mgLhqv-TLZ&Hv$E-OzI(Z(*=wgZwFD1<`~Av}*AQI6+WBS<;{XJnwy5at}C zTC`s}=+20wUP)WEP zgEFgV8gMZi&@g9xO< zH3&gT8G#p+Ls(PqEY-1wrdqX`YSkiAE?dY4)&n!Nz!|CNOTs}a!T~sAVDNOoA)fF8 zoW#@fG92OwZ`*i!D6HXX{%$muiPbWs~Bdl(Kmd6T0RP875oo_A%qT~rjn zwjT~834nRF8@GY!NtyU=z`Jmgl^z}`fu83`E8!%bo>mjj!#YA6=l7MzN zp{B>EbWuj7Swlk*qO&HZUi6ij$`Imk!i%1zCLT4H%eKiOM6>>e0e!~}A)(l6gC42} z@_HFCx*EYjzNv5!g3tgbyy;=X&=WNVL=8aTs%zPKSIw89AkdfH9Amq90@ zpMf(B=sRQx2|;VG^n~GZ=pc${nz&&=-yB0oXn_+6=wT1Y!GIDK!C|B!%o6XCIe^1r zQ(11xFme=Q&lk`*s8K{(s;5|9)R< z?mg$!sZ*!UId!UT-39!iQ~PjY;z1`kPDkirR)*6|0p(jfOEq{CPFpm{b%9*&~N>7Bc#Wmso-h5`D6m>DPz-8eeOPCGH>B&T=I_>QOMz)nMzoi@HBNxl%| zrwAi1DTXRvXU#gkBOYxd8<~hCCZ`X9EyUASr$nrlg=6 zkYE8S<>J|xRMt*OIR&(|mw9&~n`z(X6|n!=k6=olkL8ZU=V$)FYUWN)?kc z+Objnjckq(ZJNiSlt zB!S}hwFL1|cW62QM=LlEM_;fKM>}{Cj{e|vI6A>CI0k}$!7(BD-#8`)zr!±zDB z!F(K3f+yn`3{Jx_RVAd6)t|ZySYm>GBTjulu^d;YB39QrrJV>kc`Oe2uCnrN>cCUb zcYFF4obP~czKtsVVZfJy#dn84{WTZ9Gm!oc;I*XRm8g>O&kCr&f?zL7Xu~PNmvKEP zX*c7Luor|xEAtReTY+1bXyYUVV508PNe4J&ni#A@X2O0W&!A&hl7$*&Wl$0^9bqeHvql{pz}W& z;1CT>aJ0((c-YkXy+{oG8&n1XaK?ed2$peinI0FOCg%nr^j(xU1JJGI0kF#1_iP73 zG63ZK2*Z$}i&bjlzN#j$KOp$RLDiKEtSC4JXYNa==HJ!L#z|!`AiBQ|(7MxS^^j%v zoxbi;bPSHk{c-pif4)C=;3?ntQ2GI!8BD&1Rr(Juye*jilM6o*((2Ac16H|(M38*~ z)J+DEN9AcWW(n(2pVQOEt~)!T70(4AiuyI4@8aniXH_ZB)%Z{sFVOf%gEt#_V>E7u zw;RF)m#`B+_Y|mPJ%En)(m-dNR7Nh2y$W!s!k@3Jbqvo-e10qcH~@Em#TT$tK4v#< zhXl)?-_J!7t@QlkT_oAc&Bw&0Xi8tuD##z?mZVw}@-a8bX!E66)ALVokq*|3{8NE& z$oVp@nfarD{D41SN2@v?Ib0><3c}aPnw!t}I0ebJ>hh-o`3YwBb+#Jv&jUg)`a)JX ze+CeaYG01kqB8yk>{t%?ZVu$A47xI-13*n=t!|W~j>Df?ia)FTScdQmzEB0|Kc@@a zj!7Voz72w-lw5y`e zgH@S?5;#Eh9q%T5S&A@8Fuu) zt%qdyl|Zc5+|l@&9*yFR-O|V@bjJI>&|7Fn;`V(Xhqcnv9G- zS<`j%labNceM|{m$;}49<_m{}3Qre4%1}zQmY_u9soR&}QyF~qDvilrq7{~eVqI!* zJz$mg#wojxA8Ta*U5~^2O)O?lIG?D(7a`Gio-GnjMrpS#C{`IvkRq%Ym{nc`gJ(~H zl+ghCwg5N_K)>^Fkj~wXnx4+791?V|^gKnJqS%u#d-6{-;Gg8_2{q6YE4^ctFMw>T zNE8cgL4z`T71_*Sy+1b1slsn4W|2?Sr!Bfg#V{PL@>YsDRf~B8b(zrG(~HK3pTCM z6zN##4B#19VYubNA-iqH+fJF{Hl&Xd6Zh6b&(Mc(nR68;@7yAf~`f;!@j zuT5{dKs26;(Z%!~2)<_N+CuFeL?691PRfk8I8{3R-B3?d6IadFt~vvF4m&7%cS8x(WsWsRB6-zvzg~zgVuFa{@xenZ7rVFIDgSQ1$AkX8N$efgmF z%?wyZeEFdEW)##ZgEAAw7A+qAb9VE~A?9`ShV zQ@eoPLMl<#cDUnSFlkRQS2cjlv1z?w=Vbo{MUuDv34nP^MZ77gW*4ew!gW$zyjchy zNny+;^k$2}*SfeFB=@>Fy!{)tjdlq>#mAvE*|#WCmovy-mp7<#jzzzf@wO{F%f%sU z6v}4`j@%-VvN$4(Wi3)R1(74#8ErTo1&37%-=u^6+WEX1=tf(c=*R<@CL!`2x#~Ov zTjGmFs?dSb{vSMLQ3*1Nb%H%W≀qk8K|9`R~N@1FXs7_jc{~X($!HAF!W*yF;si z52N1?h+hMz5dOhty@X$;8rI;eH41zZMlAGwp+dS}1nkLSTH5t$>kb8bZBF~@eX zrouhQf!$y#t3(P-4lMCM3IRPt=$U@@x5ueuI#VPDxQAd(^m7|QZ=Iawm#veGJ0LED zhR)!&ME|o`XTDrMT0NxFd|$Luy}qs#Z>&N^tGq95GF}jI^g|y)L#)8tF^L^}&Hha0pf-|J~v9#cY+JeWS1+n0T zI;tiCm#Dc=q9(*I3W-Ggi}w|U%VNJJZOuCf-x8XLh7-EvTa z`4JE657v-7<@^HoAu?XZG5Jj#rlG2JL-GdzM*>V(*ny|&gmcq3gS{jRq;i%1G2mMX z|1OyRDPS5mp<+V%kANA<3A0MmeW)k&s&~5#J{T~s6BBA@s^qgl z+ywznZ3mu$PDT2kaBcF;Wu$2@Qw;r9~RgMeJHX&yakj!zmEc$y6VN_h#0hWXLP)oInluowNgpfx+Tf=ra9+|z8zV9Uj;_mgwU&q;F~0;)f+|WP!*59* zjekpuhRAP8(GXF|(GXF|(Gancqaor;W{3njQD{Ok9TEr;PE6)LiVm0L6~li9G= z*hv>RUL}hx8-)PgHWqU;!!bgp&zA_%GaM zJE4T&)&M5=6FB^=hdBUGkc|Cbly;&lW4C)o*JzcN0`}yskTeCgo$-UKDP)7mF&iYu z6g84I!|@n#h7)yrxw8c_ddQe4cchcj<^@tgcYdCxUqL~24!52HYcwo|yUGKvjl$YM z_u&CUx~XVAONM)g`*0oUGQ>ydA$~uZPDo^y&=Gf{47DB-i6_Yj=DX&RO^Hz2CC5-h&Hn|EaPI1 z*0O~IY_2CM)q0ZB1v)874;LhUhdWt%ywvHW^xssjUMC;v;e3&=wcn7a-F_0UEU~{A|LNt?q zp_5EH782H12{L5Gwfl9FkqrE`$kB%C3O8qw`9-gmFM70m(WB){9xY$eT8hNKYCG@~ zHP%iIi>(YS8oVqG=vLoBs_ISV$GoHLF+Iv8EkEu^syc~GZ4SK>IF<0zj)bmAd{U3N z(@1|xc(iov;S`-o;_coqID)+>jKt0c@p0=e^T1-iJ)T}6*osz?;aBgf{a0D%_25kq>)(Fnu^yu3Z+@9PL^I`x z_9D?I9?^Dk;Dwth@l&tFPdySp^GN*MBk>D?^yq?^(z}_cU0%s0?M#`gLT_QsDNEX!$#PM^haJR;Gm{yBp-X{FI;fQSGPDc0 zII~jb%#gxbTf%6T%$uRVVzkQgYL?8MdgiZ6=FIQ(LYbJUM%vc9Q`aU>$6O^>;9&rT z__J0gCuI+ZV7US>_!ujNnIx|P`3}r{?I2`-0N~#QdU8esl3flUo4_&vy$C!5pg(|< z?REEBClc_j8+p1W?D9vOF;Pt zfmZ;$OW**2PXY96$6-4ffaclg`5u6ng0O$+_NqImO714?MHvxmnyb0&oacSr6}xya z#d4PQg+{)0BYpu5nxW?jxzy~Oj&dsNfs^Rf4?ti3vth#l^g9iQEwpCA1VA@Y(24Nv zS13OhgzTQjDpf<^YycM$xCQ_}hMD~r09O$B6~OfXMEo5ZxYhcT2G&}SYhbzcyao=c ze`sL8dQSs;)#n=6t$xtJOUlB(TH1H$ad=DsK))Ouct1C<7XW_PXaY5TKgnU22Y`ky zU+LR$5}@p?-q@fZ$+s?lD$adhhm;Bc{pR7oZ!@X9Fd%-ysFY$p&|)qF4Pw?>8?FMB zJsV>FKoZ2C1_yw%zua{TL-TN^}Dt5*`g zV5Iv+XbctF7t^o(O84vQXuk@iUyp$h=@&m*q!l703Vj@-&|a-j_UM90zY0VfJfRis z7e9EVwc!_wM4Qi|+GO7VUK$zQ+O0N-mHq2pQX52{nJA3t(}3z)pS6HQpD#T6U{{z{ z)^dz_AV(D1=2d8~$f4V-k%o#P)cPi>5S?T6fpKHJ{)JZ?e%A=UnJzY zXo$Jfx;jDpKOD4E)Fd2XNj~n;0-$dmGX72IgG?UZlKq#&RBd4IjaIlPx?8zV2+HFAn1p z(Zat0@Z-SSX~)TE;k@qH3WHg)e*kYs0F>E-XPFWD0qWZuJi`gJ062}n1^|-?YzJ^Y zfp-AR0RW4JaVlUBE`j_XLB9-y?7lsex(Yy_KM<=0b~k|&dm?)hcn*}O2&CrW`7#2d z0K5U9&j&b2@4f=iw;AN03A_!!fgk#1;J^>3%2PVk=w`k`>)#@%qz`%t(*;Z$QMQ9+ zNr^Jq_XaIH3=M_==yNJDri@3gH zDmSg=feYT8qzV_YNx6&12P+;lwOUY%ICHab$%7Uxxc^4#P@krz>^~isKv0}_lE^>{Z4_KL$xdxC zxZCN+T-p9LJl9%7-4vcv$e7aE)hseuoIlK zBE8~pSYr4tf|lQ*-mQY`fz9F0&zrLyCL2wqbbis=?Tdttw@chWbPIJhp`*tMRYw9l zGu?x;1KccgJIf~4M(~&pa1x7jfQe?i5TXhq>FDTUEbn)@nU~rB0%T#g72*S39405u z*GHrr<{&=T;BHhjxVYhOadE@HR^xiyQov0h$XMA3Kr-1jQ-u*gL%bBhz5d*5sIET` zMsP6)W0&InSVW6CNTC1ngrGgekvPJG(+zxpiXCKjTQwCO6nv^grOt7>>?M?~(q(3- zF{wgBJ;$+_x7H)prZU^KY;FF2XCswpf(%lQv>*~B8|PR)8RdC`8{cWcBo`YtKEcI8 zZMRZGrRMC(bd7U3Yr;&IfJa7zW3EeBZU_x7;h>Sx;u7{7!cv#8*AP~@gx!X~Eflf% zOCX#JZ8r)*KX0aO$Ep5Fp-z^k&@`2E32*bWPx{%k$Xt>`a~_nksd`$FBW4bF+y-Gi z*KIU)md2wDxh{d7Cr7?ZVCP9FbP4P{2}4~1J5Rz$m%z@GFvcaY^CV1g3G6&wRVM^9 zIYvFWJVMqnzR9ge?Ks+B@)Bspy-|V$I2pw%LWd=m>)>0969zboIe4-1*i31ZAkDaReh6C#jB)VOBy{5vm!AZBaD9{@{G?Nnd*cMqgw$ZC%TEF| z*cT;;0Mgk}K0(0+lUWt))#}jjEagpP({UMt`*pD!gZw_W&|h+^NiW>hXqgnFTO_a- zby0%pwQgp)&|ycK0cQ4$cy@B*Va@2rR(F8jo1J@?0QLPIfGD1oA)0YzAox(hA=>zp z0nQ3#F5UGAKeR2nA%1()6{|q#P31QNkUEbE3o;VxFeU5}LNvL3E4WT>(X^J1ogwKR zb0*s!=q1QN5Q0o>s&_N`RR@Cf>q-KgH~DF9g+(tsj6bXV61dfJf=hse8vB^r5l)bI zt3sQB%RQn%kat<+HUXx6eXSY{CS`vJ27TorL5m`e^=9;n9iI@vX^(|yPnIop5wgaY zdT=J+wH}tG7^ zvqbH@kI>!-TyO;OXZ@U#k$p@*)C4j66aa?+A^!_;E z#zy*yIQKmll}-oHZwd}iq7o+Vbr3R+;(vwsrBLj4ir)<2j{sQpQGND5hjZVZD0me> zzyHP|5A|gKo0l{+r?m?^m{yr=f7|Q)vP;~P0QW)rUXSLv8>{P#;H=3yyOW*lH&Jwy zTHl#kvRA$wl@KX(XCVMd1xo?Aer3T;247_S{Gj0O@~+uXcf?T1E0J#MwitY`!PntE z2pNBZyVJT}a_Z?Oj2h(7Pi9V)smPtY^mPeka1<24YSecf-lgEDZVk7cU8WuC!SV2I9G)oGo?6eD2$;MG z&UV~dBZTU<3#zQjCV(nwxlW3qK)Q65L#BpY<4M}qDP{>&*e+#I zDI$jk`^-@3G-gW$qj5D5FM;mKmon`hvk4*6rr@Y+7n|DQ+`~1VA!TkT(dE=Q9Mhh@ zLS-5I$ZvA!J{y;-T&}DWmUml>s{ob3NAykwfVWLC6w3D?zgzFfjpEQXrw5>; z!L1zBm96vT9!aEXM^jaXdph@;1p{Dj(xvF&FKL8RpY?Vtf)NJTn|XPpXRL@ z^41)TYoPdg8tK6a@5ZmKzkP_)J zcTcpGJ+73_|3^}O@JbozxKc&{5?#7@rG#8vLar`BZT(?qcyw7Ck@A=;CHFr`vC74R zi@Y+@1Fj$VFF=Yl^8!vE@n4KBA49E(50Wc1~0oDu}b#U&GLnTwnK0ZzqI zj{3|QoWr?ZWA9C&n_i zbkMZyN|*K^6K$g<<~BXOOg6fh_MkW08!8DrzP$-TJ-j_;&bd++UBY2aC_O)N`_yn# zEC)6=kvT=fbt#JB zxf;iMIUO;_Hsq4T%y7oy@Z@~tn*!lLZ;WTh3GVKoy7SIVp}IS$(Rqix;X)}kTG6LS zZ`j7IZX2)_qet%)$G5TTKeWNeS7>viyR^qP*plu?5c$U)No=D)@c1^0g?i+ER2vDd zeI(uxF=zu3L;o)|wcW8G(S-Kt|9eesT8#eRew3CdXYYTIlZf2Kezip8qtC+ z<(o1+uA<)5S%L7dQO7TpV7e)PsV<>Y_7tVD;On-(sNRr5B*tKVzcct?}%><8b?x zz-$1#O^yqm{NL+yXpKGxZ^XIp-C#JMz`XHFH4(T6z#IVm?!tkqjIP`mbSIaKp$sRN z7L(H5D~u}*&d#xXy^EuB#BX(RW1=kv=XM>PwNG%@^lXI}((ben4vU)*ESRYL+8kvj zW$UXD?h#T>*raJv-FL&7LUpi`L*EZ8HB*gVOuMyt@km}$_1zGi>d39-bH&Iqazv>I zjV^47Wtul6DO9&4FG=-&3+a|iJ^{uMpyQ_lkO;WaRB$6?y^EU&xz)u@glsW*GmIyz z?ez!|tNe3bqn{e!{2mGqFstoT19FXiH*i^PpBj*79bX16tL@?dSKFcQfa~{x1uwSO z?Nl=}Aa7EDkH!MuuBtpZZd=ceK?`bQ&|GENS!V|_%tIqs?#g2$|3p;vm2xGz^myr*q zah))ejB~hlJKsE)wlnfT86a7YTIa~>?KZR$S&fcEBY1)VQf5MmH8)RCS#@c&oA$a~ccGi>J~annqT^){6VdUrh?s9(F_--( zG4{FwE#*0{lyS)0TA5NnqD-q-%1~FCq3)_XS4**ncyzfpB89gS%h;tASTUQci1fo` z7){1_WsJiR(X$q^nhavDZ8)nU-wV#XPuxvm#F@gjdCH0FbuhO5wi|{WhG8AP4nc;U zE^hAJ?{;zXZI^dl+`&?1Vx?X=%FfxS2}s>r;U6YzGe)06Mek8X@wGKtc^wjQjsi49uwT% ztk7+zDRcL2I0KNn-=)d|gOety=@@3r$of5Em$$&By1a7Jz8F+db%qo}RTk@x z7=tj~Hb|*-L8sjom%y%)W2q(}w`qKpi<{4YtaWkonGko4&CMg$-{_XZku=U8gS*Dz zlvgnoF0?kjMPx)>JXgz=X-~*hfUKAq z(JhKuB`og#x0y95ObkJ9Y!nXE0M!_f>nQUyhHi`t;@yT%&ywsKH=X?|c1i7Eb9rU3tj=&&3!NoB*^3L;2!QK1i`e7G$m@F~8rc2lXL+o#dco@PB z@0)aeZCWgF!GwOo!PHJKu=O507u?){pk4IpAsXErCkIX0x&o>nD<=5i)gsK)WK zNlG>H%nCKq9l;Mb3qz;O@S2q}3`;7%-ym{jAJrZ7%U!BpA|QlC(_3iHf1T%5{x4Bm ze*|LGmnd@8T9^$(vE0hq>@a7TASgeH7NF4?W@CQQ*6 z`%mLt{)B5Sy_G5Js)5K&R{2jIa6C@$Vy+ls)>X&pUCjG|bAm)U*Hzf2OqVzQhPu0! zetGFnqs~9TEpLSk@$5^EcNCft{|<$2?0OhDXA&&Z1z%)vck1HiF4xI3rQE$(XRgE^ zy_rRpn!4r!2quN&VQyS%B3;q_8->H2Vf0)=Zg3bGJN`$GeMjd&D;%(gghTgraI=hgt<3kzKcTwdt8HNbbn=uCM%>>j-ahFSJzK)Obq8^JBk-0WGm zJ|5ugEzWbD$x%XQjx>g#aaY0oWrDkDmxjkhhcP??KpfA@89Iz(rA4lm`G_8!x8B2n z@p%OIZWE3vvLmA(Bhz;XqVC=8k>R#tBpE%vkL5rskc8P4Qq8ppV^0;eJ%B#w&#`4Z4DeVfq1E+U@bXC(ach~lmG_RVo$`WM=;=|$tvmIn z37pY*svpf+ugFVgp?<*S)wNgU<+9LZ;PU#~-vxIT0T;*pL*(fTj@|x3G*mDiS899M z;_H4V`%y4X10nle0J8w}O+5|Y?F685mf@JIEsV!Lr@}CN`V*GG37@v&tyL~}&1fED zO>T%{GS+YM;GA0?)WQzi(%=lb>nLTMb3cAP6U zWJIdMHFVJ`@3(bsC*?HHIJ05fZZggaA7|MeM;@QAuy$m@)9?Q39OPFuI8oIedOo))mehLq^*ptnn9-R|F0RN5UdcVQv8 z{7=Q3fg!94i&?hwh-IC~kdHsBeBtj9R)Y)inh1gO0bE01Ie=RT{0YE40Px^-=wW@% zeFopS;vLaMw0nUW%JKpp}vy8y(Jc=Y6adJg>ALfQg0uAl1zbH& zAO{P2rr@KSkeUIae%^dP0FF^>rYVwVx+NKxf$W`WXBwP)I84@c2IrN>HyFsv1$VE> z+=nwMq1kY3F*Wpj+X5<|JKSmNaWm3Q!aCJ+8sHAwKH-R#=}U=kjWlv`);wr%>PK9e zF%13m?02O&`|ou2Co)t*H^QRg>`(OTuCD_ZXMd_+ckR&MIQujGx@!?|arWmj9Qj=_ z@#Po#jn?x~EDqW);Fw34zFH=kJlyGnf^S5BW7tFF(@)rQ|Su06w`QXtR7?0sI(~ZysTt#Yp zf(Pe7LbgN&_x3qgK<k_)M>aMR^m-^>0>?7BbQ~f2MJ{d0xQa?(uj?YbswvV=eI+O%7Und}3XUVSRd@0TG zoul)s4uaC7B*&ta?9xPe3d`!jFV|XU$s<>hx-7)}aCKNv76C?5=vF)&#w ztD-w7snAGzQX}$-33-s~c#ow19!Uc{k_JiT!1Js-ILNx%vS$R9n2_r!t2~z`tPs}F z?J$Xq>k9qc*w4VFxtY>js7H}m)mBQAp<3YjHFarLvME~A6H#pt*|b!$X+iA_RAh4( z1T(UC41*&;$i5vwD}fdOR}&})a5I3uhah<~fiFPW3P9!cz!CbWJp5Vpkn;j~3PJ2? zm5q?o*<*0Zz8~aL0DV6IFav;I6ORKB9gtyAPr;%y&O_^#BseF#k;cHUA3Y`Rk$10@h|W!WaPte(FJSaelm=TkNEy76@A|1UF2+% z%&WiIv`MnA{)Ecio)7Ze?fD?jX3qzCHp@o^^u3;$P|GUcTmi$S4_E480>c12LtqAg zmkF!|@D_mp^4>=Tz5wML0DT_?@C$%`2@o|M(((X zK6sMRMFqKy4W+QmUsr$r6N=hBs`uD zIS4ZRS>*+lFiS7kr-;Bf0HX*j05FljdI0AV=x`$5%Lh^2mO^}hrl z*3Ub^Sbs7Av3@H6vHqt3#QF~dh*-Z2dWiK$0titlvHmn|{ps5JWnz6B|75JT|2f+J zXN&!{1GpfH43((q%~Eix_5d4W>ZgC)B?dhPzoCBrN-_%@L1(TF`TRoI#u<95oL9~A$SK0Lz98aM~gQE`O)IgBH)r|H|kV%8*oWg z8%3=17vPd_?-Y3j^xnPn#eML_BiQ|;7ZJJQ!=J!RANI7S(Sr!#i2t^;4*hpC>WKdu z0nmS_EMq4RIK79;^c^aT=f;Cf&xymPqYGK=BOT_)_mVegXPu*m%Cs0CsT_XbFAwZ8 zxzql1lJ=cWb2_29&sIhg7KcuqR5ZKp;y&C-{AezjFzscC)5K!12~_*H#jco)?1RIyQlJUkB@9h zR_~FTi-hj11iRRvn~2lFb#m$^v?K3jZ$TSkhr(38vb)~>v<$z+zZ+!}@Mj&5GCmj? z`5OPX)QlzkHy50Bp<~Ryx`0=tYakfHvsgON)Z;h7F}R1|qzCl~aO9I?h~bbtEX{Lt z_mQjdx1c%`@hOU9{1hc=SYBynHj?H~ah2BBnB18ug;=It8QJ>#>LkxKWVy8^Us;z2 zmX;baZ&v7Ut;>bzHX-Zv4KGZ$yErZZi0^dqkm^l*FK{XN%q_si91CbDhJD!Fg*@ou z<}Rf|Po&)3#WYKz=)W*w#*rOHlQOOcx;22ybRWUpNgsFL*2@by&4^6tWrOgzHbJQ- zFE?a;yN_!-TIwc46_a2Up)Y;6=w>Kd6SirBT#0i4>!&&NV{-iV{SH%(2aR-S^FEwa zelKa zSH9oi>$3E~IcRXkIX4;d-2g>72U3~f?!!iAyC{pPWL=)h=~0Ipfu;s$LhRh540kqn z0KtgEz!#qF{{s()#%|4{D{<_+>k<$xveC59NTDsru;1Xc1y?vhco5c(HakKSWYK>l z)!1ycw-Tk+xdgXa{b;Mc4NM08Jpta$)N1enH9DCFVfmE?rwfR?k5JL2#3PSTWtsgl zW&*2x6LUbF&H{@H~xrQ?Cy&=Sl`h2Y+0)HmokR3`-Slm{B37Z(C&;13o2FkUqlGL#>G zR{1u1>~4jG z3U6jvA6bM&|0xsmFB?3-vM=N7$(Gva=UDbL`>v}AHG}spGJZlQd)WxIUtu5Lqt-Dz zZ}B~75N?Z#r`OJ*yHa>xZeG30>H;xD3kxF6hA1%8#G%o@mv@F z+~1Yx9Qjzj5r6J)C+h9S-@EuL_O!PbJp3RNzi4wLdDSrOE>q4|`s3R}T2ceiW+{x$ zhilwl8F0>*+wrG7bdKiF@b@kLxG-~n$Y!z=GZJTxJoiUml;V%HI+uvEOP?M`9|)Xs zIRGbk+#-*|I0N+~ABe{`f&q{&wn;*;N2$4XvuIEUFwfu(D=wRUb9>!~u)y8|Mv}TiH0je!=4Uri$vyaOHqcw`|$> z*cG4L@c74V*M0odwV&K^*MPwT2jl-i0|(5XRZ|_VYZ_2jJFBs>aq*0rs)qhm5Hy2= zX2c4bak!uvuAmvSnrrK-D~z}bC{R;5tM>SX!z)$og4%FJb^U@GKw*UjDw>)b8tNOv zHPsb!8XGEVt5x%YrrJ3RYO3?dF>&zY#aWZi8XHfWin2i`44yLR zNCkrj4?Rjj(Xb;I3>k5h8byN#9bRK}>EI&?8eMusF{4Y11|31s)6SkUZS3HpqCqDd zsSD`anMdo}Q3{HN9bO=f3>`W`xo)BH=QP$gi_t48MopPA>fDN{>A#!q6d!y;3tQ^!r3QdV)!*zsehOf8!-YUb%3tV<;v#DF{)gkQz$W zC^cH0q0Ukbh%oqEj&s%g`sxN1u4rhi;jz9cj1#jRW{)x*hi)W9fO-+Ol zRW^p)P*)kAUEesr;-Z?ydWNMN@wWb)ND)kLi#73X94#Rg_Y z6=*1nsn}S9U~dXH)-IS6p-Ve8;fnC$hNw0q>fsebW?M2Ky;?77tPR&x%&J|0WFL`A zPH#a)T~s*B=AcEGJ;Kih(JL{FYDD*{>S`(%G&e*TSV`2^4aLi2U9Y@2_J|m^!>l8s zB6(|8^K4aDvp{(>ik`(PqLyHyfsgCwivYxtYlI`Qm;}e7>c&}f;2m_fD%_&xBL(S` zPF$uLkVSr2&7EIarCFjyRrL$PH7)Rwng-)E)nJ;FY**8$Y8HeW5jL>L0)@z}uB{4V z+DHGIYMa893#w||3W$%I#)Xx2YIcRGqZ%TR+ZAbC6gEvt`aX=H)9w6OYKoc8NrA1ELB#fE}#dckQ&Z!xkybZRi)F_tY|lAJk?ZF#Te5kY1n|X z7KbrA!5Oh(uW^_^;!hdW#1>#MSJrXPxBz~eU%6nhs#4AByjpc0{Yf&7XX(T2Q}$c}avdR>A}G z*)iI&PH5Hj&9mxiDmaglI8}{8CLN7S@6+(y&6rW@w9%14!2u|I_0fSsT2u3^3M5() z7quOw9Ug-*+25^PISUSo4vjj5xfl10Qg1?w2DXeI4tQ5cv?wN1yY1l|VHFx}htW}8 zQQ5>LW=x?rS_}zUiDT1kEmlO+qRQA5Cnk$)5#EWItZHrzMn^;Qta&wyE1DLmbI(;% z#!VG##uUwO@z5emoF=$UO`l&HqYaykpFHTL!)SABXNM~=tl&Mp){5zqE{#ZLJkF_E zfEcb_XmoYi=vZltWNO3e~jK?WQ)(>tcshK39IA?&U zYFLECbU{;(whYmw-etqlD#xuhs9j`M7b!6nS)`>Nxh%REI7&5HD8!V}WoBlpL`sY) zGXqfv{*g*#^u`oG9Eai2B(gQRHmYjIdX>GEJW<<%xr|sekusZm-Jk`>kUXREFgija zh9;JYCu&p1QzPj|hJ1_^%s{g%FtKvRHIQD&i}JE4I6~rNr`?&tOg!uz`>VOlq^sgJ z0nUN08Y`=7ThwC3^>$@g)iVtv@ykkyhgw6B1ppWN0)PWcWUN>e{EEC?sv4%K2As+U zsj|VUY=|lws*r%O+FGcZ7FE==G+-lQ0sJ!G17m8PRgXLqEnVO#rT3~hy)RU9b*e#j z*ih@6!&ulTeG;|KR(05<`~PH*XA~YiQkC3XQPu!}r(w(J1Qke57?o%x`O;JeE8WWQ zW%{$MPO7sVvU030zV22p>o{&cap&(h{QTHIx0a;wyPPVBKljIScbAT|P52v=7P{J6 z<-6Qo>0jaCg)T2YciOyoA@C6X+#h!m$E2lSZLRUGu$TK|cv&~gWyCoTe`C@TueNX} z$SY%}(4#WEWlQ7Ayz;m^Il;*D_G!1!(Wf=hK6&en@YM6RRSf#k`of(~uMEwr`{Jcj z59#BY*glrU$@aF(T~cXxrM4mM=Ki=dIVLTieOYZ^;a}xk9$1;MB5`@rn6!dCmkDR? ztd2>`yV_dqyTV@OzuZ|FSdoBd!M(a^9iTIG^V%zn`kwX?4zYb*CFQ!FSKjiY&}Vq) z^pX4HZthX~vXmS3UYqO$?$If-<4almyx|f0Iwq|+RtD{8d?9`E+Lb%UN71D;5B1!i zwtvj{faUd5FD?&vosS}mH+@x}%ZM{~rsKxjn6weGdUK3<_4d~1PPWvK#x_h5-4RDs zH4}egpEWVDFeVMR4DwLs{TZ(|#0QxdG$#u{t_0Kb{=<`2l%jkGuO`UA;27OEtMzQgM|P6je!5ny@c8YRdvnPH8af8=4hho=i&xM zQ}w(73o6643u^`p=|8xCQU75Bnie-T*4KvzG&eO4Fro(Fe!}r}wF{bCj%TeIvIoe; z1@2X#zXayepOtlW+zV&|hAc1(7kth0b;>KIn_Ik&1 zGLt*Ph9%HpvXgl!z}6Vc+zA#Zd4-dECf-{qadHE4#y|KR^~3{UNlkvr>9$N*x@i{2 zJ?94O3rko6dalc2cMy`33}X73j`duOJzo%s_Pn+W_xLU-R6#!il9XO%c&A^N$36E9*d0rR zH!Z+0EOx^7$O-g>+8I00ifo1rYu3(K4XRsFwj0@OLENZhWIMSnU|$76LHj_U)yWLlcU?-OwgFrbus^*hainuxz+Rca;ah@+Qtb-1Iq&TCoK^FF9_~Hnxi0TF)P@szz6JL zONo;eu-7CY1JQ>Uwg%83wD^N)Q9>=8F7^r^s9^sP?5Mnv?Bkq_3C^&I7)>SiduTk{ zz6)eTUMfNpyzhb+*110cDao7BwkFWJR|M=ATH2iafc;bg^2=W!AP7(_@b)F5+ZPwX z?Dh?gRwC7Y+}DQAD*FM{OSNA^W9T?r+Cr`D-5@vt`^`&B;PhquW7+P-lEgkoA+Q^% zlT8G<@LY&r5omYvz{w!bgf!ULeyjy1{u{Jv2YI=8!u}gnLIMI0a_Of?j4=OuB8D2> z1+l4uC!suXB${u>h(Uw5!Ba2-T8xRX17ZU^1wFqEJ?|W_TN6v1bhMQnI1|ZwQLDWS zgyg^#PU`Z2{r#dgO1UaAHcoF$q$TZOJB+=k6=7=Mi%J>eogT}0q`s)dfO!=Hwr0&=y6V71)(@h8@Tf39K3RT<0d2>sgPImVaC%DYXKGW#{fk83dx+Nt}$o}3= z+=qUjhh99THQbR1_{l}FoqbtLPKG7yZ1mD@U~)kNodTl3s9d2n~h(2K~U{nM9 z7cfN5nk3jO@l+{|@zzIKV&^zTdYxdG`CN z#K}%P$q9j;$0=!|fL#J-z{OA%mGdx1qjnM^^XvH-8mO9C@&rZ#n!psd*=dIk1oaf> zPBp!d1XAe)RF(d}-_$Be1Bt_aD-l6;(}gk|ze{6rt9=bnMCuPf8L1ruPhbEt9G-+= z`-Vj&I`SF*@W*F~m@ud*A8STm3PXlpUYPI(u?;tN-jZ{XPelxEGk3+Ze zOjT~lVt%o|N2X+kWpC{@X^A6|Nr;A>u43m_`~7)nds9{$SfC>Y=bM*cJ!n5xU*Zg~ zUrKLvieS8gfc-cK=*cUWqPc+m2toze%fyHXgl3s&-b%G$ZT~6={7bZO#Uyl5wP#D(D(O|V(qt_k~1;E+=F!`jP)k0 zV*e2qLKoI_LN2w}G{6=yDH9XN-eliU%;xq3eu!yrKrbHdkhldsU1GWhc!m>N4$|Uw^a7@MHl01L$Kg4QsC-$Wv>`HAIzuGfCOSjTzyc*;Z>uk{ zcczz=0D$yYP_5m5nBc4Ft${XsE5YRm$1Da)E7Qx*2yukt6=_f^6EWU7Fy6^L)9J=! z$_WB1D5%0fqGEOj)Uy|1I3%9xbUedJKWn^`HHkwsZ>iJi%<)dznNI3>rz2Sy><2D{ z&b!muyDe1zjr0=xxK{iAFk&_LPzp0ra2)Bk>7m0Q7~Yo(QwympJD<78XZck&ZNhL>pKMF?M@B zhorp@Hcfg4mimI`xe*uw=W~=L0ci!~Y7(#?!dQc*yJhShO^uQEQ|MoZfW0FHRxsKy z%RUA&YNLfG^w9kb3sxv_hsD6LpU#k$?|{#f?Dr)QxCU*L;KuCx7FVG#S$C7x+{J4z zZ(76jZQnK@{rD0B9D9Fbo6}uqLBo#tg+1PK5=Wl7%-+PQav8g=Ef^LH4nQ0@0p!ys z!blphpZ#a#j3m1=jgJyE@!0~D+~2VkR^Mm8RtEtOc4RiRcM*Q5BMyJB1Isp0?VWXE zwMRRa*x#%6rvmot^ThBEWI-Hk{Tfh=f(My?o}-YL=Ar)M7+^>vu+N>C7rLS2!&nQ8 z@F*Ce+M5@09cTaAjGD_4NQooc?L$QNLKlRL-SI!mu-DXybK0^PA(H0U^h3>(bgx?| zndj>y4B~4SqRU?=l>h+tA;lxg*656XbjD@L;@w}HMbdIEf)6!AV<-y%*jIXLKDvZY zbWfOak?wVSM;G_GQEd7Dq}Z3jXkSmq?H4CXR+oc)EvXUJC0dW5`nM2aucg25@0b|o zNOWU@Dg1v3i5odHJv>j$auwQdvk$P*t6f#>@9NroBRp4DD?_|ewy$B7yDMf++bg(E zl}Orvx%PMjaX&;0*0+JnkX+`##Mgk{AM{kv-SZ$s)3Kb>$2mP#;o=7Z;Bx!RIju2Q zU0-*$oMVy`KgWP9v9FxlYJcAu{sbiJ)TJTxVJYBDcRi$+@JaR^>21=~F=&z*wSSva zXuu*~I4=7$E(`RcYI`SUGQiz!fQY_Qc-n5e0Ns2MMTnKh3BNWjQu#!bX+HN;#ES4{U|g|14g0t<6%0^Gy0${qMFrrLf>|K z8@R_4PTYs0ZCE;@*6X@ke`2?GcPg>}>*!M6?9>YDDf^EXwED6+48$GbMG|5u> zFSu$+vNIqNvtn9cg)E_!eIH7@+HbM24dhiq?h1|C?7L6|m+a-W)keVG0hRzNafU~r z(g+034}yrp4JhwMP@p10kTQXRds`FK*%xF6xRv0?;D_sPA^eGkZzhbqC!K9&WMDE} zB3&fuF`)zCB=HS)4AAOl!FGGaC0xv0hm3Dul?o*eG-AJopg_YTP-z50#jDBL4$f`_ z1uBX_aOJhBNDyCRx&-gn*uj)IMT)1lzJ$81_VwCAKTDS`r|SO_a3#TCf^E=g1;InQ zbIS?;3JzS^61*0(62gIV(seRH!5Cj*h+yXXit^d;Q;Q?vzzca^a@gO%r0D;;CdrV$ z!9VTxWfb@ov@~YGbQDqe|4qTNRJ!TcMo3)_J8|$5{tEM5t2T6O3zvgQE(j62_D_v% zF{yHMGE*g%4||#sS@yljB^XPD(ZNT!#(NoXcY>fyVq-7RC{H9)hvx}CDfS6mjzw>C ziTx}Dj0A*&=OP73x6#!IOXI+=_`iCLer-e2|*_ELuzq#}s_1XOoBP z=;_EF6jCZIkLjWVH~E~zld%MyBby5cKpbr20^70AYIXYBxO8$#VGLaO$sZCf$1^X; z2ScPixix0A9zt_Ya^f~b%G}nC(~s&Tg|GqZqNka7?!LJy^3Dd!dte^J3_^*|7UZIkMbZelTEPKU>(p zLB$Mv8rs3aAdFcWozYj3galnhjd}*`Y|5mnNY(40I;&zvy+^LHWJZn2{XalIECe=k zwfF^Qer}z476RGW0m-46xNU|t>u)t;v*le7XLJvi+nM%dB3o*q{tsE0&J$0I*$cU) z3tRE!=V0Q-z8{1@(@kA?#ax1`&1KlE6ayFW+VjX5_Mk9=SryGb*9DRLbd8yaa0SHW zdE`P!uEpWmt>}r_G6N6y`FfyP0_eKgt2A7Fo?m|<`M4*QqbA1r3E z{V=powSVS?!0ro>s<-G#{Bm3p+OI%Mq`XJKG7xHEv4Atj#xneSKp1i;h6G%Tm}_B- z(JqklY)wf_61b}?L(opfS~&&IMQgQK?EfG1NMEeDTQ>1M!fM2w!p$xQ?}JDkSPtq( zb~obaf9qO;PxYf4mm_1{UoF;ut1C0|ebo{cTRMSeZ{d8If=SnxpS@z4lk%iM*c=8E zy8Q)e*f&(;AnO1|Ty`r2uGIqDDG=Kgs}S&r7_0&gU<#;`#JwUHwSK8`tI9rtcR7KJ zxLm~11W5a#N*cQ=m&5)*Rhuv0Gu^i%96NBqgDdb3zaRgk<9v^_xdLuM)NJX*H1ZDz zok+47`^zEj)9Q9?vf9hKwtaV*({UxXcyQ@{8G81lTngKpWa#{pl~R{uQw3|=>Q?(o zEDMea*iCZ92gL%o{Bu&D!91?}dRtcz?Zp`KUsRXaH*_t*xee!5o@3VQn=Pi^jxmGk z?@3H-Pf7;BDsrqI_*^F0AL4=~%f1~ci?LTIF^KDVu1?=Y5w5H6K^Zskkcl0MOp1A$ zIV2cZ3OBXkK8Af^o8DXt*dyAp#!Y;{>1>a0bxwrGKU^3)H@ur7D=4fz!q~*ZaGHYHkM)Di!7Z{z`ZlL@(}i&+L#{0_OG1nm&;n?5Wy7!{-T#7G1b{RCvSZ{ zdBo)b75FiQie9ZGQ%Z;SoIVe1yHAJ;8ddx;tc4&yOO2+um< z`Q|_JTrWIdlIQ>8lI9kX`tebuVu65rE3oYc|53F&u`tsc-|vy{9-#Kyvg8FQP!Wj& zO^iUW-+fpP+HW=Cu!(ivZHiqYy@w@IQZlw^`*3Bk5v#xq>=a6Hr!h&j+t+fr)1HhK zAm(fg$!nS+=6kMpuEct$8$p4F5dsI-Q5Y^siKn1fST@Qy2uy(&^=+9$*b8G=t!703 z7=~hN0JX`m;UezaF#Nq1G5)QN(HkU^BNH|E+%S2s*4B`e+e@ZB`#p>fj7cN61b}2B zCdzkofZvY^09$`Dita}XgofEJgmC;5s&u~$a}f%Vg3&T&>(@{jv*lK){AxJ%3hUNX zrVl&lD+J41jhHI!`>?Z*d$8=V44Qv%0lQV!wXYIMM`{x+%?W7=D&UX0fPy)$$npc6CM!ey4gXroGLoJO=-x8X3diK|K-E-UI5S z7<{X`G=~3Cl@^1ysr51PpH@3#@Q&(p$csKZW~)b0zT9;eUVc0Pd3@GQ{}R+d*k`GW zs^6)Js6Rb|&r)l_|Cz_%dBCGzIhd_#A%A1!s{#wu8K}>1&*SBIS3go58(@bDgYu~Sj;ad%*@F5-Xx&mTsE@$^0q~&)=a;`b zq5pg)lI69)M*%<1;6Fp&9N_qHgOooB{6gS-&YAqb2Y#8Sd>Hz-##8<}+P}q9J{9=g z9{hE*_g^0V8-PFKDL)tZUp@G7z+d;^pQHWvJopyip91HH1E^m;@UMaM`B&n{LB9jQ z`P??~If(%9_gTJW$Mcf~i*Ux-0VW{x$R{y|9i}};|o9a08MGRDdyjK)I zlf$3JcPd{;jq{mSpSn~HhJO6>LNAHd`X1QaQf6%l^D~%m(}kKjzawZM|H1}pC|HOQw1^j>!3z|HXk|k{A}@J zlwf0gd4INw3~V9W${52i*$U3~{A|_5gYjb`_`Z(kXRBTwjO82!(VwmQMiD@^>K}&> zj>Ct=;U~u7r^Ml-F%J!{3j? zKZ?UYR$qBi0Oy!rv!g7;OQMSdnS;J1(fkO`^P~XcU&fW6*5Ui4ebH{AH@a>JOR3^!osr$VYFcX`JurWFr6EX7Xbp$eGAbW0=VC zqZ*kQK?jWdu;4eSVP^i|y8@Z&TJ;SlCj4gNFH>Eu5)41zOUP8KRi0@tU&=eHZbm<* z{YKuNhU?(H>s0G=Vq-5Cf7STM#rX|U_ecIv9RIa( z{9zMctV90QarIv!(fkNrAJ?CA<8YtnOJwAKFs{5UuKmI|{Wiyy-x;URE>{_xDgSxT z5`lPWoITHrtAB^_KgE#$vN-+Dk86LL@xRMoA6LFQuDy3SP|c6>%i{X?VO;%kmlRIqx&) zL*|@?_+>fs4bNlDnb%161bq37XY`NPZ1zO`WisM>h@YiD{%KEA@-N!krTAw{NS};r zGM=aCZ-3fT@r5$tQ1*MC&&EGa!}By;%kg{;ltI3+r{m0@+uwy6jo^#)7vFNf)xPGL zdAJ+S@^kC8=<5}h=b?aS+LPyj=FEIeyx5$_nKM<$O@LDTx$^Ms$q>;0jl7wrK0|%^!FPr9pKtAao&I1iD{R3WXaOofLQiDsJ0Kd}U z>&c?l^}Ix1Pv!16`rf;Z_I8qf z5aWwy*z*w2IHXf9%4hKW6XsEK=KOt_o-2(0Z=f=NZu=`uoV=yU5&GrO7bM!B@o`xG zS*6!ChtaRldrF7pvDK!X$Mu&ObDuDA|A_8q?uXcmK|A!rUUM#HfBuYlo#$`CZ_X{| zyq;&o%@%XsVb07exeuc~pDv$Z&NI!qh38qYC(kvoKh_<&mB`OLe+d8ajP|yf^LBH7 z$(;A`jCK#1bI7l8{#&!8Pv9ATsWa#0Ji~9d@{Im%;~B4&?d16r=)v>H=(K|~;veIxI!Js3+;A6({C+VS z=UM8LN%&7EF^{rI*bO1!cQT1~T}+O^H^x#m68`#=@K;EFgLp~UEhgb_ zD~WzTM55hN8rtb;V!D_`VjawrTp&&m=ZcHOWnvkLICheVV?X%~&U+-{;DaT`kxZgK z=_L9klSIBe@)xulIR^7YEF+O`A9)z{$8`(aKbiak>!FxMvK>VJUW4%~7KjtXDPoB@ zS6oIO!tXVc-{O2gV*DN>$DsU1AmT|7lSJNsF+ElEik-y_F;g5#BK~60N21+!l4!U6 zB;q(mqTGbWwmzMNK8u7tN1RL|-cl0rt|8%X7YTbm341>C&UpdznKJzH*RsgYB=p%N z{EQ^wr&#)BB>a_=@VAeIJ@2zke7Jrmy<)b=AHkqq2?@W;Nci0>{a*4Yu9rykfBb16 z{G^GU$?p*l`CmM9SGte<5$g*WH5~l~vR+%oa&f1)3#8p{$$P}T;yw{0wdQ>BfXITz!e#5#i}G4(no;*!G19<~Sih3(3?Qbnk1 z;+c>7L1cZ?#Z0k~M4Tn$j~L(LR*=^vCJq$tXF7v`e_sE^gOphwnIW3Y~_ekC+`bEww zzAs|jhbV*b90y>E*i9TnB7Xsiam61iAg73Cd_kTonLkEA{W5V2iT>G3qWmKy%8%oC zf}BDk?w(?vSR$J19K>a=Z~jEwOvku9L}FY6Cy_s!MEv}=b+TCG zYmZSw(QaZX$nk47XS^&xeb~?N*OSCJ$P&%`!FoD{GRimO7A%+S7mt%@4_tzoelg<~ z{bR;0`XvqNb;^B6^W{Ti=H|q+P;vZXUvDRWr}6uj=IsfU51MfbvfSpN*&IKM?AIle zccOiv;QXtle;DI}>Ck7B!TLv##`L!p59~&UvU{|~u8?}%cg!JiU2ozpph>(nI`W5+2++Z@}#dR+GmF;8J0kmHMWt3kmE)qA8sFyjHhA0kGKgflWCyT|RX?N(+WF|gSf5>Ih2iM>93-o^J4~eG!s8=H6i;FP7 zdd2abO&Rqx=g)DN57KWXA@3nkpM50i=@$=)CrJ2<=*jJgSNk%R5~yr@jXNBJr|mm;smdPiPk zub*}LW2xo|?)#^(ozM;&NW^W%1=78&AJXTN4RBovM&;-^8P*}TPt;h%BeI>S-%mo% z_M&`1@*xuTM@S5Uqe?$U!tS{AY}cq8Eqin3%`#hTUKNzST-OahYkVEXdJPk{Yls|<;d}~O=XU?C9Z@F~Ez`UA>$f`s0K z^C0z|NyNkF=#0la2S7YLZ}L3q6E~BXe_O?!;%?DAC%}9=Mj83|9-OEgbYiT{Xt2(F zT49fm=6PD*@myyDvT)qY5lcn0o*{h$W%&1#h~JD4oS!)knO>;=H|s9+TO@P7(Vp{$ zOk_WUspLtFSFt~ddWKzJpf9H#2CW$%s5jRQ){oa+b?WKU^#$VZ%(%g966g0q)uU7_ z6ZeQm#S!0lRi>pf6%U2 zoGY?Fn9hyF@HBMFjhCDtCW^rS$=>+;m+G^TxsiXB$^(raH06P&JkXQ}Cdoco^oS{9 zs+cBvMd1IJa!k98x6jX!XzWi}?nLb9*T_5Ub(Zu~o`l~|iUcQH)@9_KmNlHb%d+kh z*OPZ!*5~9D%W8~uhrEfLYFYEer${_c=X=4(-^7a%P~<(9HIOW}*CVow@^r*U&cJtg zis#2bzSpwweLRM@i%Z0Ek=N~!CHMtXtPA8d;_c$2BG(D(FBE%;Ipj>s`cOw}P#ozcMpAq+oKZ%VR+4>8~`z`Bwaf-M`+%A4jK44jA zHnurK+$*-igrWXDF}jH@cNGVUQ^W?R+4|n%B=J45T~k}XNURbYVnVW<{^A<(2eHNJ zww~`Vrrq5l-_J<-Rq<=ldxo91@JySxi)+Pd@q8={w96G|i?53(#W&8f z?YnOyhnUaJSe6&x9vuX z^Tj8{H^kq>i_Wp_ZxN@6tHqt-SK{wtn{(}aW5hSbCLTMzmw2c6g?M=jTR&M`C_XK| zBi299w(BWQ5*LfFi521rF{!1U?*?(QxKeyg+%GmxvF$sH{L)Ld^K`LX{I7Wa`L_N> zaiRE@7|}}p#Q%s%7uf0P;%(wAajW>Fn2>7Q_ZIWSCE^zGdoiW8ZQobCgPdzwPl{iQ z5f>tT9vH&O)<8Ets@%<}zFF5xbI);XESF7M~J#i6_Nom&1Muu7AY)#m~iG$fdZpzrtoOa+zhl zB36j88Fu=`;%M=NnAF|YcMxwB?-AFFJIKdzUD?BCTXBGRxA?N?7n@vZ+b<+n;Pp)L z8!@4$oqlF7n}fv1#LvW^#g4sgyGh~}@i(zcA6tL7xK;d<^jTJ$Oq;ifPl)5LveW-1 z9w%2?);U+(>?uwZmx}c)=%3boMH%1Q2pK$s+=O3#m3$ug4CX62-m3J! zt8qOd{ZR5LT(?UFrx-x7cCW+^ht8l$5xwrUFaj-Z-EE4Y(?-!SftHh^CRQ5T^{G0~c`%QAaWxXr; zKja4cc^UPGDL-LZze@j?STEAff0}rX*jBtkyjtuh-a`J%e*K01r&E3s*X7bLBsb!@ zh~#zRM)4K#HSsO+J@I4lQ}HXYTKrc0ulSo79c9<2Az5U9=7{mNpgaN30Z5FiE69nK z^-sw+lXuvkL8AS5rB5Ou-z#~xuVkhxR@mg^Rc_-d~PNE)s9f|TnakcoI_`3M9SS9lHCFYBa!H#$uiY-L`oHo=nE@eT14v0D5^jE%L+O%hv+UBpcCZp*rXL^*kq$B0wK`$@$8sOS@) zBBxl^i;}mK@bkLl4Qvq_vSw-DQj-Nk-lu2>}AD=rjQi_eMWB;x&u z#3H+2@&OX@9g=)p`k4B5dQ%eieE$)7v3R+7t#~sz4bM$U_?swB6CaR%k!YSvz;^i+& zQ}37lYsr6-Gw}Gfp{;L9!v0LjEhS$dxf2QdYsGwVvh?%GdoAlR$!kgYdqVQ_l3$Yi zhGg@c1@V0%`BUkuB_Edjvv`6;IWh4zQ^X9hFA0C6#5=^<;$pJIvQ|lcnnawNB)=+o zhh%;}fclRle<`_A@_$A1+y~|I2XAPfKtfKI?2()%b|w)=FX^wBoFjRx1`x;liW)jAm)n`#RcL@@mcXT@eA=M zkq?;Jj^?=;*hBIyX9h#G|6X3K2LHh$?YX~l-xtIc^--U11Ud)`K|OK@otgt zi(~l@OMXJ~Gvs}E&ZzXaM85xx@qH>*ia(Gj=eXp!rjSwo>0%494S7Fa_mSL_guhJ5 z{5%=uL6Y+%kCc3eI78{PBtJsJ?`ow#r}S6EJ>utLrTC5bi-_;{vd4+oOl&3c^VO`^ z<>IyCK=BswHt`N|fw)+FUECw?7Y~WYMC)|Bym&E5OcD8g7L14At3YOo{ly%yK%6Y{ zdmL!b?=v7D6Z!oCly`}rh!rBgAB6hf#aP?`Qf?}qD_$g~i`_+jp91Y~6!XQ~#i=4c zS5CW!#g*by;!ENi;)mkb;!om9vEiAvzca;_Vq3AR*hjox94d|$CyDopbHyd%I`LU? ztN51qk@$spNc>4mNK%~Qx#C4)XR)W4Ee;V!iW9_Qajv*nTqAB0w~OzJ{}HRiAH+Yz z*t6_7n~LX(7m4X&cd@T{qnIz=E>0Ei6CV~=icg6ziRN_(jE@f`e<2^|hI2(!0#FnC0>?UT4{ly%yK%6Mf5FZqmi0i~n z;;Z6Y;$G1&9ubd=5$7P@2XLQGVjP@F;(U0vJfT z5+5Pa4yz?UA#PIob`tS?D*0RSnE0pIz+;zly4X(aE8a_@oKne4Ncdf?^o`>4;;Z6Y z;vVtB7Pg;GB zjuGz`OT>BNBjO721#!E$OZZX_8DSdr4JNu7w;1973Yc% zi)%>K>nX`Eh&#pi#D9xliHF3KVqB^n-{~acI!EjxUMv00;#hH#SS-#Xk^d2KwbD0> zZ;Bs?`$^az6whgG$8mw^6)z)U*IUe2`XsSfoG1Na@p*BF^p)bb;&JJtF0}ohD|QsK z#hXdYgVB;_h>OK1#O>lIVzv0Q7;}+b&e`HcVt4Tdag2DcXkKT30I%Omep!4+G_Suy z|Bd9|#Rh41c^fymAGB35`Pz?F1E{!7h8*c#XNDMI7^%_ zE*3Y4&x)^!ABk1sPhwOXyWD1CCvku{TAU)z6_<(TeFSL7t&%?yzZd@!o3*vexlrsb zUMCI{i^MtNTJaU}UGa1ATQSmW`)?|G#qMH1F;~1@oGva9SBjg&SHzv-Uhy08cd03~pN~miEBOh@&r3G%<3aviO8<}ewfM6b z(arW3L&Cm^m_(x77GgGua&M9RfaJxJSBcw{{(-n(>0gWWFSGreLBhXz-w=4E(zBI5 zSiD>5b0j|`zNYl|CGQhsFSq?ClJI+u*jMR;CFh9?l>WHn4dPo$-z)h`@q6(vvC$PO zN6ZihiUr~v@k#Mbald$6jLWe7T_|RWW5xSLpSV@rCms@`yW4(RiQUBO#Ia(j=o4QM zKN63L(LHQ`&BTu4AaSHPOw759mU#ONz+e;&~*W{D%k$>JjM1@R-XQv6Hw^tAnY z#oppDakBWJ__+AA_^SB6SV8(M>nMrw|C<=u%a&V;Y2qbf4-)yV5pNPli+76;h)czP ziLZ%Yh(C#^_qP4E6R#IXiT8*Pi;s)z#WJy6+#~wM@5lvs{}74wAgT|DddHHGn@T=Y za!bh6jzB)lPGtSNd>_t9=@h|x%@+n*oN**nFoaAZZJn=Ea^3fLQN(+dfsiS}YK!i1(3*`)%@ZeBMm*S0w6HCHV)*KS@3*IjX;% zzcC5>rjpN<+){E|u_K9ct{|Vm>%%1S^%Dn+BT3lJ79SSZiqDH5ir?-yVuNQO0sp4bggZMlx ziS~I`d|7;5^pmjTcQEpE9RDCu-?K>MYc9F9)*q*OkQj*Hikw;y`hz zI8wY_yoW^oxsq3l8^xEU-yO#r9%Xv8ULNM1KvIJX|agCyLX=*lYuASbRM7=tSJ;Z;CgT)cz zc=A!pnkxA|67`rT`7z1MB|jngDakKM-X{5N$?r-2f<%44R{AeulVNsxGZN*s6g!Al zi#L#n?|yNm__|m{F1D=iNYwi`68`>_Tz|MN|AU17EXmC!x0Zad?IBqZxttrOT|s%F7Zq82l1rXc%)rkGPxA*Hzv`}?Mc+9qvYP=KrvsOAeM-WL?4O# zYb2M6FOn#yT>M=8T|8ryt#2n5i4TfTif@STi(iW0i+_oYZnOQJD|*EYF2uV!2o;)*Ee?bD`K(%o2x)1>#h3rMO9aUHn+A5`Pk-3hZ*4iXL(qKIcQC-#U_L z_b!rqOTJq2K*@t8kC1$uJdH0W-Ai)$dEit@)XJQ#3#g;#E;13IB%0^kHg|GBERE`>8FvfYa{t;@dk0YI8MA< zED?R;R&k$rLW~|~m-7#?nRtO{VdLkLqQy8dUQ8lq;&U6KM@$jDNHb+yqF*+iso~tXoqCUsUpAsi0$JQ)5XqW zH<8~L#@FSt#B8y@m_sf=dy6B*0&z0A2;YMv7K~Lk$yxUIzmbb6&$ho; zmGn`@q*^0xATe(@ie=>exL**rkQkR+#c~ppai_S8#CY5-?jawv%=Z(L`zX&xe~W&y z)c&3^@(^W=*CXOl@*(uUc$~z2>`dZ1qMMjOE<^u|nIzWtEHRtJ`0g+A`;hrM<`6N5 z^r8R7k>pDBznH{zkfmyd8cczSaVAdzd zW_`ju$dSESpNcWQB~Kxz<9)l5&H6J#>kRUnb>?2gC%suuP&u<+K!1$sm`|CY{oU_ff<*O z&A7z)H{%U*3i}uHz>F8jX1rkhn|_B}Nc{rLR}%6v67yiI=} zAWbrV$AR;J-`_}m28nqvNb(R8^PpIA3F*W0TFD#9m6#{&M~wT4B*yy=663sr#Q2V2 zKVV$HL}Fbx?LQgc-$ohZw;$UB^F&=*>F%FYh{&ZZ| zk~8o*Q1V{%16hJ`P!F7m{)q)KuD&EOo-T?5F^*=E7(W#x#!c_~AjV5o6L2ot;WQBA z<7iV5<038*#CRwnF%Ett7vTE~&IHl#Nl763yB)a*>o$r0eV;_X#+(JBKeNciSU<_f z@P6TDAo|UGZUp^RkqjCAw6Hmd{#j3=U((M3(I4wPAo}6!7T`(?7pg`11#P-t*SAgn z|c zaYbWt3r5|QKlHZT;X}vdj&%nY&LGH_Qy{b4nm=}EVbQ2NM(4Yog|!IdZTQIi;iLb? zUkIDO_c(FbsRNWlmq{3ZtnaB^)zXIXVvqk*`w7yA@ni<&sU6i;hw&3=1k?Jbn3F+9 zLx<+(=MEb+bmFMIQFmBv^74mGyme^quwg~{kT{|Lb~PA2vFMKcp#`JH%e2la;4*N= z)R;V1hA=g{wWx6DD7S4L=XET?cpINzFko^M=(D zbMx{XZHVPE;L2VsU40Q!6DDXby7o{q%dX3l)0mvXA+7$#s~J~+=hS87l*gre_!x8y zTE?Bm_6km8D+Q;GpE%5Yk6MLuv=><({6nJ1f1_`H}tJeTK*WQYxO|^ z6AC9z82`78%HA43a$M1b;Q{M9lPiQxUhafk(_cm7+O)|UiYYL5eC?})zyNPEe$vqV z$%W&_qK_5N|0VaBaG5zQ#!oCPMEv=fhg^bC1p6s>!i1tx!zN;y+f87vXhpeWZ$*mJ z;HG6U40DIU%C;Ckp~z~JW&Z!oaMTHc!{`*V(QSdw7(Oz$sCLmKM~#>;RJp?pu9{hG zM$sus3u#rmrN>Vig(%ug$Q@RYU+YpXWZu7t$Sete7m&*cZHndMZwI73i365(24juB zRxjp`$mbx;8#;bc?%x-}>2z0q(YRAIWo>nsb{I82oSRx&dw7i+J7QezF%Sqmcl`KK zw~no)#EdV{40YyMXtOZ=&r{Ka zI}2+f!<8L}`p^+YIM{UNQwd*!J7pBx7pI*rPK<-QvqTHxvrXVBR< z>Qw#RSg}X&h@$*cjgnx4Fx7LerNVftYZAtveKi%vo6Er6JSK;eP&467vU`=fbz&~w zX5bjIVMmR}rj;I@&Px3m%y~KaW!3wVZMyg)G+@5ro*MU=%!_x_9hko zCATv&|L3(ahaEff@DlvbZIf>Pcj)XGw>LWccQPA&JM-VDI(9N8<9}Y8baULHlVjZ8 z$oTJMHgY>-YYsbhG$rFdN;bzGIy%PfO{)FBojEoJ9WOEE;XleV#~m&SWHEC4fZWc= z{EzA}TgP;h+5At(e>78iAhStrACTJ_+5T@#J9aRc&Hr@sze9&WW+S%`$nA{G|0qJE z&~<;uaW%R9C6~0j6xR%Sx(#m+yK!a>2%%!|?M?akkD8nR9gszRY;^4dayuj2|LGTx zo!zTT$nx8ry8L#g@y!2A%zu2-JtFFWEGpl~_&hjL+u?s+n;LHzgY6&&o`;Q{GzvEr z!wd2Fp~y?qj`)wkYyPKu9hV)94*#7ZjK013-_HE^;)(kIy!F9r0C>3~uq}H%!s>_D z1Dp*nftZcoNz7xsBw@C6(E-$EyF7$lf@1_ac3p6Qmn#C>)*JDAc90HYXFRl{+|>40 zh?hsq))W7k?!-(xZjEu^_O}!MST6nH<&=QGrMAC7J+h!%gWcI2e~$+F+Y5hq8N~RD z1!>1P#^C_%5{U1p(rLrZ@yG9EcE@+b6(7?be+%)Njk}$XLzhBF+8lrLVdwUD!qt8a zVe9xCV*3lk$Jb67H*L5%{`gvv+g~)kgxqPrf5?vc9>r@*?)Xw5q|uQ!$KOKOx&0-= zAM>+68e@0j<9B1iMIb)Dc1t_jaC7_(3G$chiVv!Qzdem=$2SQ6qVYPNvpN2D!_FOF z8vOZT#Q5-XS-{^?+g~8QAsBd!k2c&Ke~$+Fi@&L+{Z5x1^EC^KkFUw6(2+LBAAj@P z-7a%ft}`_qyZE4TlU?O_fFEH*);m-rv*&Kh%U{|YM;LjQNc$qKYZ=&rl z&@N?)k2c&KfBbDKx4)jQ`0z4ez+X2^796ilZLH^-kJc5Z)ZuJ~BK;DpjLkzfIp{y+r!w2kMEVi zU!eWcG0s>HZMZr9_}&_K|DJHg$7=w`-4)uHvH&H^<-BAb;Il@pY3O>+8h{8U6z8$M=44eRMX*UmEP(@nyN%?{XMB@x|Hx z0{vU2_-Mn;@fRKBufHq44B0WhnL+Kh1^)UY-Ps&}(}U`p=W4$mFm~eOckjE~FFw{D zf3)G|_`4y<-xODTJ!QxE_?_?W_Dh7nOghr$_)CSIyZz?6;_D4tC%)g~YsWW4@zI8x zQ-AEtk;_B)D3U^~!; zo8yl~xcwb)#g`>J=G%zf9Up(oVR4A~HU#-Q27iN)#`yk;-HGom93y*R{FR~~Sq^Qu zIq~6bRkh;Fx}|3RX3LKGeno}d@hyhGP~-0>*tzRF1pb(x@m=Tgx6Aeyi0_EvqYXDF zzMVn-@?7z;e5byvg5o;{e-n%+`=8_Q@gRQ_T=5Nb`6~*FZzSd^>p>fCj=!-%{-(I% zW4}1@wM9Jc_A7+HImVOy&+&H=?A+})*X3`p%b#WY3$)*H#YY=%j=vLd=JvPDHS-RX*N7>u3x#@hY@@f}ipwBhFXyDiAyZdZJHvSWM~+1G1< z^T$#6+kYB8*_-3FBKN^|(2IAX&uHAmL;pX`J6?O0)O}mY>q!K?A+~_41dhe_=>R8j&g$SFVKF)aK?1naC7{{2l-2J z#mDu{@mCTw{^r168Uxnm_$v+?f9dcy5;lyF=K{xHKigj*zRl;`@zI8x_FzUIRLt;APlErcjEiZ_7{lnz{PfawBhFX`*)DP z{-bK*E0!JO`wkC0-0>ZOKW~WsJq$Z{e0lKa^zRIpzqf3Ef%uZ!+VRnbn-kybLH>5T z;wzCIcdqQ1 z?{Lud^GNv1LAtX!{;GqnpS!vIJqTl`{kGWt0`cuqe6-=__}d)hFU#exRCbKdi$+0J z0_V3q@E7X*n+7{~`wemVd&uQ4+V&TSFRh*3ezf7{#7Adte+4doi)6?6z6%YUWbNibDe@V#C{(Z#d?+x2uAifQXk2c(#_+AV0x5yRWV%agiX*id;+pi4%Lal#y z!Ok7u8u-gbe#W=NvNn zLH?pg*No@KVN5&v<8M5==f{4 zn+tzFm@>X6u{-gl+x`OaZRujiM;mTVeEf`%+h5w)n)o)#j`4kg`xke71Z+Br$|89{T^KC|3x%;;>{Dqny zWiWEbw;%rYAwT1L+2!v(+g~8Q)ZTV{wBhE&H#5lJ=G$xH+bTQ8_phe4s0 z$lq?4zqeifqOe}kuhTBs@aL*V;P|xv(XPe+Xg5Xe=PoxMaX6b3!(`aG+vNo6!Fbs& z?_+n`H!_Mt*g3I5(UH-eR1xu3hreGiS}_@;7cPH4 z$RFn-w}Fi!%;#Ng$u5iKjjU%MJ9d|PA_C7&X-gaKGvaMBjoWUEk#G$b|w}-zw}*zugt&Z*i*#YuI^?x03;ex!|p*bbFd%9J{b##A3Hw_&-W^9MFaC1l6|v=Va2tk zG~0ZCwpCKS2lAc^5EtY~&wPJ9tK{%b$UM&RlvHoU@zzeZ+%2c1I?6lW-`QJIoq^+? z(65p082sc+aleM>USHM8q1S>X)%eW$H!M3=Wyg7aRg+_DmtO$606wDO(}^Jteuu~} zW9X0L{$XP1CR;2^ro1?nml|8UtYpZ^uyx8|T@#d-<;3AQE=)N`TiNY^^ROu=-f7c% zwaeK9c@J#e+D zU5+2J|9tG1)Z{r;ead0$l(PlLTaeEwXEn;%h_oJO|D!4*Ap>(_zCRE3POwTUIo~a; z1NcUdDm*J|7M)X48G(4}X)SPcSZbOv?Id*WJb&QrR!qmdu4wA1tveyYeEpp1whUkI>SD&nmlR6fpw%`%YAnBBfUL3%pUnf90Et3o}h zh9HI_wYjqn`J-yL`CiC-TVn4}(|!p#HDf5zQ&MflDbhHO%3#m-%)#*n9dk_iaO{I0 zrw@9lTxU&)_4=wxVB;QFlOa!Tie35GK3tEu268Qm&q1GIPsEsZ$B>15P7FPD%ow`i zxEuUY$N5BmsqmME{ANz!xJ6K03CQD)DH?KgOYHw+d-x-3V%eu-#lNF{dk}sV@S`&wcOrVe6Nr8a&R;DGVDI=h1hen4+68WXJY4j z4?WoV-V*M7&x(cp1cEz)eJ}Q1+RMSs*!jL2AND!er)Zx5^7=Fndw=Zwew|&~cY=J~ zaSisx+NXd8+DC$!*fX&6`=Y$qx=nG4_4{+^c;LxD`9E$+`QmCu83V|7#-94%p_GL=_*s_Ts~dxQ^p_pM7iksnlM> zar@FNF5%&7D+kwE*27ri=T)B`z2H!icR{sPxX_O$eHB*Orpjbb8Ls!{VIHlkOtqkc zeQaT=KfZ8Ybz0$q>V{>T{8ste%Gm6s{W|Kx ze%LBpR~etPygCl&E-Pnxbz;W!>ZHQy)wt$=*@~F%kHVT@d41FIuHy=P1CQTAdnH*J zl~JB@w9Rs}uGB|+B<`74d363ZoPN;m&qSN{jYs=7X8UHSeNhIwph3KB;}RB`H7FTv zWua};{0pjMbFTNtq5Z5vw7q9Rbt7+Y)W_c;qR{Hl$QoD?o9%BG?SBl zb)0v3bwi{z^z`vZ~|EL>F?hvP)_ORRUDKMCzTzLr0>v7CUUuA*^ z>kr0dJlecLb`O7?W^81yue37Q_oe=B#aP1%*JBR7fpsan zqCrN6KMCbDMA@;~z83XRcBAqu{hUXQ(5G>w&fFSe&#kg7e{>o8tjt$2QR6GoXU7%m zMO@ApvoOZIiVI^b32}LHmRB6<*cuaLAi<0)$^{#JhSC`h$C>U^oFpjSH24K6l-)2V)VXViM6^SG8=vA^|grP znuGPM0b(^o?C}{`&k$n*`hfGnjuG?JSszS{Sj*AA>@&uZoZ-ZWw!vCs<*YI>)?;7c z*u-IC(y`JTnfO+t50_U*Gd{FoG~$b5d}u??akg7RHrfs2D6x<+jW;nxdATNPP2f24 z&PGgVH}qGOwG`($#)5vz*l5a6DnuD~HIfuC0sNCNn(s~?qLp+|1SWmDPql~z+c~~1Znm%KhPXC!> zpWUyfeHb(Hunm(DvsJzW^ATgw`=mb-<1P~Mp)cFjQy){juHp2>bvizq_Zvl3sh0JQRlXeeWLUo}tkuYWpVn#%*BsH1qrf;Y7K{h$ zfxMPU#M(!jL>wpSI0?teI!?y1N5_oItl5mG-GYM{6IEuNZl^UH@nJsLYqsUDvT(n{ zypdLhpLt_&jgwOA8Yj-I+i6(0&q{z#tVix^{k>-0UW#izULQj5!8J(fg6jSl|B+ay zvNLe4gL7RM`UFJNjx$fD4@z=is_rEOy za|zd-yk0S5*MqrKSZu}>ubt9S_8|C4#5o|A=YNi4lwoC{EXW=UWo57RQ|2{Bs>Qjy z&R;(R=ZRv(gz|a5w7hRr*2g)c9?Helxmj<HrGS*;Tqm3XZBkl$`cUu`dD;ps$UZ2NXeQ+-2SbW0Y0P863=h`(w+wi=}>mx&- zucFXm`xKh>4tGkfKFX=Y-Im=x=%bVjl#PB##2CRl>acFH?DaU;m-;g-UW2Sf-u39S zMYxWihq1rBn&&MiEsiqRLfYgkGIa{*ab4i4rGLa9Q@#rI!kUkDx>rYoUK#W{Jq6#nl)i9 z%JG@|lGwtvramk)HCug-Ym1ni9{w1VmC8C7`dXx*uWQvSr*^&S<>kJ>t56g*Hk%Z!wl97V~hQU zdo9*0n&lMQ{lqdourXuVTr*u)5skXBPHC(YuHSf$+;PQ@3NO~)Xz$W$To0Rb>OZ`= z?}*U7PvKIW7i;c)I^ulF^RazC?T>qO-nTpF)c?2VQ{H=6@Sg(z=J^MXQ*oT8^fVlM zb?n74o+P1-YM+O3z5O@m;RlS5NSuf1BL?T;v|8uk2E|^yCYOWraCtVKjb`{NVzT*q z+{4vFuuii5qw$=fiPf*_JY0_?By_Kg@c61ugB*=@{j>yMORT4raS8LPBU<3x0$aY0 zmys~tJom=)oto$6h_wly4dMDGBcZf7V|1Z))!0;6I{8@xciAu&;Ug znQI=DhihYBMRbC$74VE{2*zZj)vqE4&s@EF=DNkQw|h&@ERIW9fpsPDobel}tg^B) zql*ori#vsmuVH4Oy%KWm_Nte|_Ijkco2$LzP#=t?F0qAZFUwa|ANR9-*2QNtkytc~ zt%g-68(&*>G1jhx?0J<|g0CtS3pr8i276)y^oRDSRO&`+Ge#ZTL z?XiS9;;q`v_Uws9zshPc9p}n9rtcX)=MnR|+r0tuHAWp+RwCk{jnnt+ zlREWCK-;QM7PC(tuwRG3+uO{xz2tmz-JQignT|feb$47b`($x-Cj6WE?pum6I=F&; zl2kgcGBV?8KgVz+u46dQBN0n9ncdnk8_^SF%f%J8u})&6uxqNRS6mM%rnk7 zth3SR8`{J)nQdNki$NKYc#VO59fLW+F>d9~KFBc~ov<{}SMXh@U0S2=@t%3OC-hY` zbdA%NNRLMRjN6GN2JxG65kJRD4B`&NmE(?UmWhkcWf@yEt|b^7`fEwd?XwO>WY5Hy zS&B9qVBdpLwvC$0pvt@l+^|URHfpOpCnJ5>C$ev%$$@)|{1Be(Tvj<(E=#S)&c}lA2`RdCtm7zm5Ooy_C`4 zHAxsg`LkUoAHL|U*mkKOZGQIc(TN?8e~FhyYBmiEGd5~c?IR{`J~^P}m6tZW;N^YW z|MOy5&+LKiyZ`*J=c40hHi+5WqWO>}|1NHyeqNIu13!K(>gtzDo3_7a`{vQx;v2n~ zKFyl>*z`|&=Jkmk?3;MydtZNbUe+Hie|>(=@J`zR^?08iX%#n`f6*C_H=c6! zw+A0wdQY>zDtlC2+wc70Cw9E^(oZFipSk|2-@o4KM8h!L$BrD_UyhB#A1*xd@prps zUby_jHuulFbl{tVXE)8BAD0+)TKDOHja}9}>8y*7SB;K&aPfhImshTD+wQp+8{ARU z`Ii1&3R(}?e)Er!13F*We}=#NuQx7Uy8eM-U7L@c@RaALbKZLP!A>y`yn5a{v!5K= z=$q0h&9A&``SfYc-+wlzLHU-W&o^!N+2JXPOH#KrKX$zJ{)ZmgzWDK*$ECG;^Q#l8@q2i>&TJ2)|X{&`bV=tUtQek*z~@`-*V#pe@=GX71^Wrp4;n(|E8y1Hs`DH zm&9&=w(GX?>(01);j|3Pd~Y<{@qh<7i4{Jq1`(J$6}aORuvkv-zW6?ZIpbxy{PqE)jByIqnS z`_vT?FJ-@x(dyVOj}?9YXxfO&FF14CGiQ$Mx%7ssdj7ol)3c|hZ6136km&NROD5me z`qCuSrG8%L1?Rjt?vHCu> zLya4bDXbsX)B^uE&wjYJdHS&zizBC&wR-yS4dspgd+q1T+uri&oF`{wq|bWw^gYA7 zm#j}6xNJ<@woB*z`Q?P$dXH*+=7}F$x&4l*4qXldWLa2qts!e(e4$bPw8l?NEIe@d z)-|J6rk?PA_1MwA9d7Eia&7LI0iR#`f$OJ{jFXbQ2fWilXrFZPWJCe|N3^@Z5ECzJN?9{qmB zuR~g&QS$KiDgSxJoo874_m^zDzGs&mEw@!wT=3;f&%8MOMBB`3(%!vc+Pg13{m}!D zj*4#kR{!Qh`ak&H#Z7xn+VOVt+{9+Rk3ah7&d*-Ij!2&I-}7!rN6GreSY;_ zm(IOCD8B2D#I|c{^_hKpv*x9(*MGdRWs?{0IqS1$Puo1O|9ACoZ+rSz-M`MBHty!e zsbe~?o^j4gb6cgpf8G~wZHWGMZEW!x?NhmF_76|?{&&Z8f2%`>61K(v_0Bz?S6%zxX$M#LnKSx|*Iu07 zW!DPB_)jeuPk0#R>Olr})ccawS3x2ycW?4nvpd){^ZusJ`>puD5 z;RnBccF39?zj-D$fA#+S{OH4x?dNn&c>SKy&%Ds(gZ1Y}Z!8#l#<|a(qP{<6b{RA< z=gHKWZ_c>5?aAq>Ul*_b`ofj(J>6sEn@g>weW%_Y*P-y8WyAm7=%crvdv2ch-PjXv zcX;~iy;nT2^YG_emVfc&JBvbvo^gD<`H<3;PwY;w=@yOuog_J7+nSlQ+L4TEp~ z?&7V(7k~3k_w)@3XZ&{Ayf5Be^hQ?8jlFJfUwL2GoCn&i_D*j3>lwwvx7APmqWa}q zUd+x|eCy?L`~NRK&pZCo*81mN^1#SjZp-MCJ!Z<#sV^ z-1*C?qpT;E&3I(?^Iv>+bKLZgpKabJVdFh#<<9DUR;wqnx(~U0K;hrCALn}Fm%n|v z>epre9(3C9WA*?&gYXH#D2*ZS>oUoO0CUQw6AC-=|3Y)t?4ul(a}+yFAq z!e%x<#DYiJSrc$*C1A&OI)S$_;;?@)FxNiBt8wN7l}If>#>v=mh{wg2-#+Yy+pA3M zNZkqSu@BQwPG?hA|3!e$KIAVPC1M$55x`vgFbOxJDcF&E6ez%RZycgrv$-S1ofTC5 z2s_dN#W*}-QU{y>l5y=AVGW3bW4=QKhxEudmEaJ1vpF71AgPwp1e%4(ta*qy79-hb zRJdNZH^*TZ)dpDF4(sIF2-Rln5$20Dj7P^|7}YL0jJ76}TPsX1{Bttykv7uGJf$wm znvi}k$`D-_Mzs&+`LT!SA13oG5JGhXs$(WsolXd&IuUSK zCzpkC;!Ig}x-N_=895kX=&nnV7G3A9({(k<5MAdeLv&pjRp)T!)hI)BoudrVbzxK) zC{JhT;919HANCMk*B{A4jH*s2gi+-M9M;J-5~@Puuuj*7QI*JH=&qY9ExN8}ovy1< zhUhv+8KUdLsCJ<|UEu^bC6js86QU{iLv;Wp-c7`jjMj2u-PGinMWgxcE~s0aqYF8@93`HK z1-D5U6+e%Z5_$+RnP0gaVs!BnO`VOZ&g=-I>M4hzMwg=tIl8FihpIxfWEd4ce#Q7h z73b(ejxH)oOmTJAnJ}ts6>i38R`5$W^B$Pe8?|mG+5)M;UQ!g8@V)c5~wBj{`m> z4S5!!3tFNJ9lH>{$>EZK9nDKHkPuHusfx$Vc%WTsx!ed$;kB%i9m^o<7 z=$%X~2}x#in!}yvR5~mOj*F13R*Z}#*rAMD!GlG%P`A#-P{=YVU>T~H979%x88%>N z_~fY?%AIE}>=;Fex#UA~8FtfzJUCm5MOZv4=Px(li0P*76i{=hUC6+#CnApeou*@JH0CHnqvv8Da{Us$+7l zIc~Rt^qb@MD@cYDX?0jZZZXH{E66xJ*om|*SwUu*g6%{MC*kVPBl`2|n zv0`sjtk}|)T5M@Wi!H6RKG(J8nsfF!C-naPfB)y%ABOL&HEY()tUY`7%Q+|8hhrS1 zS|l_~tVZIhMy^A`Uo|3jSoW#|095#Q6;Wu}@x=gV2d*u7zN>ZFI-tq2S1bZrTy`z6 z-m>F20Ee8GK(p{LAsZNO*((Xg3tEB$=xC-6LfuBI|D{~OHb1(_keZNihFb)1Jw|pd zu)(qu4g_nk<6pTAIbYHUv8(YbqE)<*Invq9(^mlb&DPISG#iu=%Ybpm&x>)%z}gU!~d@dfbidXg~}x5M!cBm}gG-0d17 zMxh0&k+sb)0Hx5g%)O!{r6?b27vO7DDP?VNwZ52M#5J=X35^w!jYt?Qu|?|iDzl(( zHnS@UnH8s-wW=(Zctb^^KWh?2lhSL^n_G12 za=+!zXd@>hcw9KiLUcbXsB9ybTK=pya=+!zZX@e)1D_R~(?&L0encC&$nwM6n!y!F zJi}=76OaR(gd$sLnPDAVw9vfCVv;deScNk(xzLtE!tz4Yp&n*zKIvkbvCz(fnY$R6 zKWMlAE7Lo~E?$*0(F-BYJM$E;WR}vU8 zFDCL`wiRf%?1VCmtI~~)hwuTHi>7G7=hb7woG0<@03SL{lX z_YMbChSO$x(P0fT1c372rU%LY_Klwl+tne9f|K4(VAtZ%xv0#sL7ae7%H%K9S3 zf{bfHR;jQe?hxC2{}w^bg%_RTVUSYR4E=IfjgVQ7bh8yGYjUV-M^@nfp9%0#Su|jZS0?9xIn!r*^a)qNoT7MT9(Lgf?=z zTm-YtNFB|HSD_KgmSyyhby|@+=-+y%Hz1*wRwt!c*k^I|pS;1LtWTEBHZX^3z{+u?l%<{wA$V$tXwUJepFK?>`Yml&F zPXcOPHhplEIp<+TaQW@vUXRng9?6}and4a&b@0D!e$q5UT7{GqoZm*SMe5*VA!wtm z7TL0!5qP%Rg5+9djxN#aI$)#A9sr=~s4p8(!twA*hunkozxQS7k^92IxV|t)_vp)h z;IPZ`B+7Faw8Mc>E;|X}-9!h`T8et@t}gFb+~wVw8JC2xh(^oxFype4R@F!tBEi#m zcJQ~@FPGR9N3KuBaINEl6&_%{x7ccl>ziq+oRS zGx68SbB;wO?22Lto%+J|+%8>^&1JSrmvfQrobb?v9`a5>4ZJ!gp^Xb8;UH{)%3c zx?CN<3jRx2iXSKied9sV(aiLt0R!nxPU#awYxIvp#QB8UsM!F9nI!`&kN)GDF*);&O?J6k9y3b#EgE7BDP%xn91QM$eoQ8o|+ZMF>yP%FgWrDYsMSa^N-=4tE~1?}A_sa)LZM>pa3+obN0;kM@d- zq`1;6#!4~WD{7>e3&n5Q$~8`rY$Z47d>ab?!@{ZQg`I-VclpAZa<$4UW=rviSIn2< zX()b6e|JcM_W?M?GAUm1imyoVORrcd#c#agAu0Y0#iK~!qfU_=L4MHrAHMJ@S%FySM*}_i(J&w0cc%uX)UCioNC;Xl(bEdd&;aSi6J0 z<~6S=_nNnStqQOCo!6Z0H6KCqTkhy8uldYtMte;s92eHsWnRvHA3n*Sz92 zZC>+^*F51hA9~IAyoNU!=I1%DIU4JXXoyqw zXLY-nW9(Lo|FgT@g8$>)?#KT*-JZn%ow{wo|GC}X!T+7ReT@I}y5(W;UAmRv|NL&l z@&8f5G2Jg>1bJfB&IIWc4#k;!`XSRy}b zORwo5sw9$1s0})AI{S$g`oI$1#7V)Ax3H(-$*e>GUNoZ~6hupXKy}T;BBT zd3d(d52gNW4f`(;j{7J6`wSM@y<^9di?Xw0y&pj4)m$iZVnOexATUDNonqO&pY}p- ztf2SzypR_w>irCaH(4h?R@$4B)9M@*8`t~i5ZIIKuCYnI-}J)KvB|yPfnc-Ym{@J^ zcOi7f#LDg-tLy!12**+A8LRKT*9*tSX7&Cvgcp#qd&L@ie}c?lnia;Hdh=G(+Bq(^ zFvzKe^dRk8a(1Iz&oTSlu|(hOXL@m7SO!D z?k6NDCKnEzf@P&l2L ztx@Z(&YI6Z!&kG|U03s`k(&6!HpS>humwGeU3)VA4?nizlc=@%_p!M-={u0QV^Pk1 zd-Az(%Pssot7pk!WX3{K@~v19uzP*2KYfF_%m=rzh_`xoS;(Pf28-v|5e~t}k(3h2>Bg z1gEg5lIrua;wPVuVPcgF!fM#?0&6%Fu8~HnFNFGUz7byiu#u8?ph>o~8-`rc!V6$L z4K~&zUU!)BMaY=33seg&<6+N|XQ8)1@qBB6D&~$$3Dij_vOpDCpeA7Twm=nGp!TBF z0##&z%7JKsDoO;ZosBV2JAAi>!^i?voE!izt`mX!v-<4O~k^po$ZLDrI8~)ZHkvZheYOdY~3Y1GPp5E>L`s zkq8tAYJoZx4JQNDOf>^_9n{vy5@c-bqmfAlY8wm_fqL5;|IHge?~PrcTIseM0yO}m zwm@;6v_O?*%&4!S$O2VnfqD%y&H`0tfw~%^1**&fbt{Z5P-Tfgt!HBlR5i+M4C|4x zK$Rs2um@I&88t-)E>Jt@z|W|C6gZfOdQY9N=kUmFM>;DZfvLIC_J3k6mi6G%m|Cxac(j+?YL29JHAUy(`WRO-+&Dq40 zk~Q*A`6zi2nPfYyFoeR^r~WkT&z|&mf$7J{ZihuJEe0bvLohrG&V%?1YZe?^mr80O z&V_N`;@j|l$pM%}j<}QX$Rl#ZJp*Hlkvrm=VVrivt!4KaqcJG6?%#$w7Ng>1-??rj zVl)GmG;r(lHab9zN;Y~2Z>hZG8_1XsJ6jx};kj9zOG?pzwKP&Km2^SI3`=<;;KwXB zn-FX}O%y=E5SyD)3S8np^lox6X7;CKyLS^44#U#XG=XkaNRZi%c?{Ei_~}hoJ#$X}nr0DMTh2PJWsMh0R?HCqG(BgmVi8 zhV$>N1Blzp^Y2mC&9KpNTJI>BJl-VG^hB_9`DjT6)VYI_45zaf*eK$J~ z(E-ExOYh(#m6tq=OfsCsIE`31FF*s<(iF8+(hr$rICsNiN;s=n)6dRH6d2ABLp3+W z$XGZ(@NR;BqcO`1U}>l9bHknkViT`~YT%WyorcV*bMPO3lHeB1Mmp_-s4qvkMg3z8 z*Cw%D)Rp`QqD4L1qCO6yMLpZ1ep@$1z0jhb57DAtXi{7mt5!0=p}}>mgbw-Id=T;nPByyr3y#dkp0>D6^jJfkz8vk#)-^@CsOAxGt32 zVVMkN4IOX-^F6WV;2b$9$wDR>%0?P8l=phW?|8!-y`e3ydtvB9X)7vQXDCaCVmQ{s zWyo0cjzuQf#CjTXazEk?f9wsHc|#ZGZL}PKFdu~8!hCg4h1s3ON+3qUyaA6$l3{jd zd3Vj&1Van4JA;jcVOogyuq}r8Xp~v^&qW;zad9%leK9!`Asz_JWQYS4S%?>T2M?>f zq!yXv_={=C5dYa5=BlNVH@u;R*q%3VfBG|66>Iw0I*9_pm~jzs^36ExSvRak=za;` zOQ9H)wK7-%4*V(AKtR~3+fm{}m^N+_}8jchzF9=Sf zTp{@;*q1^c7m?3{TyOH_SvOfNTFroVQN-$I$gL5%74n9N%vQEbZYp)H@{@f&&1%{L zhZ|sU$Qx9+1~y~dei&?Uo8$$s{|RJXak6|RWHwMBxk)ZepHaO%qP`|suNK)ntNd$PwZvGZ4-JALA5-&bq$&PM zwLa#vJD;r%>5QId&59UUWj<;R%KEVEUF$|rHkiT=Ck#1{!uQgv$fU@wqFxK;G zm*GRbp4Ue5QU+-Oe z7LLpC&X5s3iLVp4C%Sire0EfR!m&YMjofXGl#hgb6#^8tn0@&i$o4$*9&4`r$=-PS zMt@EodJSzK49DS4?c_fpjxBH+-XF$G)}Z3wpy>ZO|LcNk1AhWlFJ?YOrUV&RrQKCI zy5tRfaLpV7kB)fIMRXeU^H`G?`v6O1vF_o>_1Z0xc3K@_G!lO&(LT%MP zL?$_!hkdoz6V*7HDp##vNjC%_Ig)cAB}c-wB3y-$JOs7*o{LP-aZyJ_%TmT;1Fq+QPfc`oa-=8h z?3Sbt&8GGgAJ!K>pi@H~#MMmrHDEItl<02ycv+rsV+N_2NpT6YWZ z;6^^w-M3SGSYP;1FJa`OJ0ZCX&18@_IW5uM$c(d|tYuG5Q)CCku8H)d3~erjhgQsW zm<$;BF%;J#RW#tgAaf;UZ`_ZauARUIq0%itH=n2lsM0M!8z9>PbhcZ7ehJwYAjva| zwE&&%7NAzhwg8>&7NA{_Z2>ylEkKW*qy@;?y9H=s_8MFi*bujHh{F*99t{1H1GK_j zuF&nOXdx%?0Tzx>?D{8zYsYs1hd3f}DBD5q7BDL=bH%+oIJ)S%#ucA(gynBNB56B! zMD_?Bfay!nmZ*u_|22^=+A+#T&eOGKKcIvCL@%#@0A2UL5 zYgS1OyhNIz!7gXuhFWq%roka+;09YVEXBaqy;1(4sY(p@s^pHcxy-KKN${=1d!YKgnV^(l0$(D|@8* zNvu61vrlm|FVm(d>8D(?GqP}4BwHDqixkQAPEaJv5recDw9OglV98oplq|OZ)cFQ4 z@`1c0Gm!j&lZ}o>9S5=nCKjYo$v~zDfS($en^DO?rrWGZ+W7NhBmmas^+^-OF=cV( zF5_=0)RGTlTx>$hU>Od=vDrRIk<(=<*B}1I z!x|c=Ko#P-eK<}l7LS#*>BJ}b7Wi>KPHiO_$7O5OsN*=T@eN;^h*SCqHzZAboYGCU z`i3s`M`bKBLW|Rmq=}zQ=_ZM%Y zQM2-TSMH`CuJ)3}*2hvjUb3KG=7YMaBqOMmQKOE7S`8E1o0lho8X2n%q?tXr+#jCN zXjyTqD|V48c`LOSoSA&!W?j9!qlmkc9(|1W!H7k!tgLv4E7qZS08J#LVFvr0fzAzG z`eqog186|!#8XlX`ti~$8`m%GocQCjM+`h4<^SuYS2J#FV%OI4WP7c<^!h2P*}dPj z?$YZoknPfIio5jc(odIOl79i&?)|2?ORv}|y7ZdjF1^l&Y?oeB+@;q|{dMW(?A@i; zvTT0*Y7oZH2h_{~ z&Cq~KPJxfKS=H(cH0{n$F|bB>0|^^?@z;%4B%|i;8=@v1kD0&vurbd}j=3=6hR0BK z(x!uj%}!qH+1q-p$=jTu)gxfz~8qPL_ z$&uMoP~*zA)1FG%X=YIG4767KG{wMTQ|8a>H~6LXcPZVl{aO_@>Uh6S@+PyB`?YUc zJet{=*~xgNm$$ld#p~ZG{jhkgcLs{raRZ_Uf*I^^2JUQLQk7|Nz!|vnRLM1&1_k(F z7k#|gPGlvEQw_LFN@*}hyQJhv7^Ll!Drca5@=B(`Bxj&~vM0sB_6dKnimAh9{E?Ra z{3G$T3Yu__lzf)yhZj=jr!l!tBG>j7u|{^LF}Y9D%U8H^h5Xoo(U4nb6W3XdiM8kI zwEfPn6`&36l@TdE+-`FQ+AEV%46Ko6j3k#4Y1E#8|a1^84vobN-LQOxfUpjZ+8M&@Am`(DgX zL^Sfy$pTj8d?=zXrT8#|T4$h$zMpDf=K~rvDO`Gj8F@y^??G6wni9cEziY0Enq&ma zdeP2CZc-#lvQLdp9y8eJ4BYdR0U1|YJ6y3Agi|x?A8-aPmYH)R7ketaIWfre=V_b$ z2yRXcGW|H?C!ZDvnshwKVm5M%W<$wEnVqb31{%dJDF!w(5BNrINlcpPA;jG^i9T-C zNJ>`0N80Qz#U-6}^j3|f!;u+k ze(I7YZs3?>X-8}$$MhvXrhjLSi9f=&F@4F8>9|4BDP-p+K8s5jbv!11)d8PE;de`Z zOckkqI3|9}!Tj8j7*pilz{a!_CbkOQ(b0iv*Ci`BrsnLp*$4Qj#auS~{?ANpm;0n3 zYLwA`J4)8l>0*BvEl%-K%DxxF2W)8MTISC!tmVato<;^^R|Z??bcv7tH{mogqj;0B z8a{T>=@Q%|Y()A0dXvD*(Ac%JJEP9y?k3^Z({z*YxZNZS%UYSeo5kPB=J(|x7W|sx zQ`xT!$HzVGu(qeMYuzouYmn{f?UQy(;l7N&HT$%(vv7fqw(NuS?BKMEA#XJKa(r>Z zeVlF|y5qPS@?-3=tn(wEFi(bMFyxn1FO8_}b8!3MnSpa}+`0BA?A;~yQ<{@b7^1OU zVn3ZZsTwkW`h#+QrhL+D$orf97(aVLBl6%IJzBD8}T^C{MV+U(+ z@4DT81!NoCuOhquQ@8tDYykKI33flfld(>66Fxk+;v76)Pn6rRHA!;S{ftTS0cXRX z(`UnEIB`ScXGyVZH*jbLZZ<4J=j`^kz-9xdvhBtmiQV{HT1yO9?h0%__Kd%ep~AWt z@8}M~p79Sk@^AZ*ALDlGKm5qMM|SJ*_-XgTc&&{rZKC6AGdw8v`%xnbwB=8PIsTOK zs*E4gMRs$6#R-1+MH)8+5M9Xh<9B8XGk{&lZiiYs_Ia%*@SeE<&+%b_K z!{tTtM@RBqBl#}wFEgyiKsO`pL-Jb-GRu+Lk=7tFP_*;gYGm4xe3{qN&laSuNZXOP zitR@7+ZJS^WnRzV@@}>YX%>>-sLw|#Mk+-bghV^P6(Juj^ZF|2dFML{sRoHVp%%$+ z>1AHu1e?`JYms(F?5SUf#JRfyX%!Of{MLeew9M=2XC2adq>V^hkhUTDExpX^cf*FC z0`MvSa3sG`zX$0c(jlb7NVN0YfwVHOr=K23g-HBBvJ{DTtA0x_^ZIJo%tBg-)E=>? zeiYJVq*|mpB-;6ncd*eiucx0yNX>XH05 z3i)wJESrQh8HqNHNKHt7qYZs{8~UJ)-uyk#9%Zh_o4L8`2IW zzpY1p0}{)&An{I&HoK5^Bl(Rs^xb4GEIlekzg;f9q-vybNE4C#HVPT9tMy8d{cc6_efLG}$gD&1 zj3aJ`tR776|1ICB3nS|sw#)rCEqIrM9Q}#zY}Q}(!PkE`6KNIzYjRq{T9`A zH2HXG0$Ne@7X%Uj&qPnFKJ@YG&Rw1=U^ikbv=-ZLjM9QPO z=$!EFm0}-PAaTDBkL>TLj&s3p%-0}IM4A-QZ$o}3(k`Uk5q(s*7y5ljysq$DJJ5_Rh%dg@k5w=trpt`&*8Z4rGXIx-w-98wJukDFQ~zf~c_ zvh?Gw7P>m5Sx7v#{8o<)bv)LVdL_6AX)n?Nq{B#l^Tz{qxsiDjU1vBa{l@%4B+l99 zh<-Ej+mN;+?TqN7x?RxkM%o)GkLvbApN+YZ8<`)}am}KxAfl)45E6BT5&dE4xUNxG z8qwDwUysCV=cb6B`RKKgtgikyz$8ucK`X64wJB<9_qU`x@xh zM)a-7w@bGnqThx5Zlpa(2O@f}J4_v}Q?rqBk^IJdAyN@iaYWyU{34`gq@_qLNXwD@ zwj25VNd7w5>x*!0S&USM#OqPNjY6K+qmz-M*R3q)-wEM1iN_wczS^(6_U6`%Yf)}I zA9L&BkiovHzdVgJziiZH6N*a*6i=Tub84K|f|poz`&LO=nIG=FXWBESNLDVdk6}b;S*Hnt}!R@ARQlngVY<^73SP@5u@BWWt;PQ?_AFZJ!o5qNZ(?nZynrLfIlhT@0(bk+Q+S;&kH|vv~bed>uP7`g-X;NB~D%zS;%?a#~ zA3AJU`B_t@4y_1y5O#EQ&SycywsGpbrYUo;n=&VPWKYLp;Y=zjD$SYMQ%G8mZwxNE zU}W{gaTBJDys&0UbF#X1tcT|8mcZ7mrXLMYE$aY+SgC(=z0?w(9 z)E&CHpazl5w7&3)@mG$tuy!;AjBV_Z#&(2)VP|9(SR;sUz_pue=&ZR@>u}*cKftlp zaO(`Lu#M3*HkdVIj@izfH+Mm!vz|GxF=(huSkaR!g|a3%Ke!;c7=L#E3n>PTb2%F> z4H~C4G@&i~zdo2fx2`d0n$kFL2LGQszX{-32v__Qr?5LIKCF?Tkv*CkOeHXf2~6CX z3oUa?F!L5>=I}p1#Q8It%1u}>e}+3>xhT(@f%!RW#?(0r8dHlIpG)Uwwms##c{4ib z(v*fd4XG!lS!gm*ol%}&-*8>ilv$~|1=CP7)edoC&!Z=~c{8TgO_|m(2PfPVJ(_?z zwR%eb*ltG8=A%&*1XJtk&Zr3L5b^o*rU%of&V%=cKsl5|dw{s#9H8RqLor3{jBLj( zTtMRu8SLvC7EYNnW9HPRhMQ&twu@)azd2!%jKjPX9sEq0IxQJ)+Ra`tDSVZJGCMpg~3WbUF$)29cQ1eY}8Ww@6&;tggvz8YpT5>w~j5ZIK#e!6}EcGCYh zmw@Nv1IS=1FS>#lK9&wH#1-XPK~7$$^K)aJv%2EL#)4S4tYfl!#Cit3!ot{bvE#E& zh@Bie1=pwru;-t0&knMK*rKlaM?o$|@*A&FOs=Jor`q&$Q zyk@TM+Lt!>gm-7R#P7S zYxe4{1?=ClaA|gR*G7G~EE`_S=SS>2l8YndyvEOn2_AYx`^M}4>aN9X^X{-E`>yz% zImj$ z>4S$39ya)lA@gsUKX2~brXdUF&l}P(XZoxKbu)(GLjAN^4RaPOJdL#`+kt)rx0zS} znRgR%J6Xr|{|h%JnAEdoHQmyP`;vMNdKy-(1+$UIGXgFNc9Fq*7R)Qit{}(`gSb6J z2tSU;;_5;KWbDwJ}xJ`^VY@jyqxfn?5t6-aihoPEFLpvOwQ=|QQ_{`n0Q{e z{`O7bf-zy2F{8qp$Ao!{$3n^p-@k2fyk}0hE$5S*aN{j%Gl94 zV{(=t7U660>Tv!ci)~nJZDqRvK(Lu0=xv7_%S(4;srU2 zQ~27mV-QH#fN z!k_14O$463WfRB#GC~`^fP6eBd@Vla5{xY+0v(0o($oMjG))XwQ~2#$(W5=_F*%=v z?aY1ZbBPCPzZaz2UYBgo;$3&$Yz;fhXU;$6eZ zi{stK#=BxCb%Tgwq#MTmz%9&&`>AE&V$*aB{{jVVdRq-DbHYQ|NeecO&IwoHkm;Rc zHr>oF?6Mfgm06nt#+YSIW8(Rj#Ji5N8TZMTe#%%M&E;5^V6Iv7i{rpu_S-Xe zpeJh)gky8Uci?6K%bY%b>}bSjarh+K7?2Y_kxTt|?)U^YZwH%_Hu3PyU@_(;igUvC z@b7%&hu?#5Dwjkx$iEq&&0RO!qVlG-`A&c??z%bAi@dRHJRbfMeUW20b5-N{;ddjB z;mm1JO7pyM?H%ZExGTWQ^-iYC|1p~<;4QxH!sd(GM^Vd zW?tSiFY7w=63-ut_MMl<%nR~ZI&RJ#9zLDBcnot*@qszvJ=nLMFN+WSQoMIfd?3OR zFU6>E5R_*8KhP^PGre4@$dFPz)tMG^;qcdha{z9r#_YPO&j)8&g_y=H67Ix-r z?6D~;H)Y;#)V%##nQYM z+pi2~V(&yUHl;_ zD80>m%$U3y8|#v^v7)j4I4tuSAsZ51-)F8rG1rXKu~@2jc<1GWZ+1c$;f+1c$04gs zLKDrn=(-kJc?lZ$tBqr&HO4sPgjzqmHWtUIKCw~VXAON~ z4YgQ9hpeHmT0>|Zr^jRqiKY^n=x`W7Od|OH6u$Gq<>vdK4d^SD|J2%9h68Ry_?fjs z8%>Um+KIYPj073K2eH(C$?Z8z6BodLSbHtj-XUvmv5o6L*52L!r9JL2*I?2;yxNr> zNA)lB+>B|Nvv{$s=eE?NIUG*+*^>5= zwa1a?g&$f24_O1OVhudN1|Cc_khz-qCBO#^O-1GyPS%JaPn~1Yod>L)zgU~h=ZAm1 z-R2tC7C+Tinb8NvFj`MhwCb*J6BL%qAU;FU>Ya-j#0TD@PRym$Br@_8Zh z9d{+!Jw&5sB-*x%ixJ^B%?IP`@_FI=*7l>;HubLUc-Uqwyk{+RG#+=3K(`(@moPL< z&gE{9E?m%FhL$+8yzp1n(&N_Bo6YKH+ z-721_{$Dbkb1uU*-~ZKx;Gcr@)&B9$v3P!7*g1DEE-HBic2~Ufl2PM$MftOv7RLwW zgwNv=vImMf<5sL>tlcL6^d_9uHgz6@r7<^WS^RjEo|N+=D|!i)y5TaeGj5wkLyHT^ zF(H&W;Y+X&e|*y>-nhQn8Mh;wZd#mnS^5y(S9Me#Ze@Sp^hp+;97gUcpRl6ibHW`N zMVqY%w^uJ_6uo1k%l%VyY-4fDx%wvbD<}M8=TG9DzZ{Q`jrUlBp^m{HT4#4#+1(E{ zJUke0*iC6u^$LbXldea!xi1HRV{_#Yhb-5CR3k;mv~ z_V4!#tbdQ>CHnUxyJ5gR__5Z-U&8=lemoDis);baw*aj^na9&|XY7{vLEat2$L5Y0 zy#!~|H(9#gO8a6j^Kr+|7c35+g^Qzc%OC!10iTV8&*d$~E$M4CejY{iz}i2hViRhI zuP(4%_~Sf`=%oeeyYLs05rt2|C9dgzM?XvO@N3EV@TSF=#p9R9JBPP!;v9R#HTnlw z^cWi-Y}3UJF=u?d^T;?J`iA$rv3>-blSju-a8v4j_U9Ap>wV1r%?8$$16vj^!0x&v z-gy*TxC`CIus+Ld0S^~0iN`N<&G6Af()-~ixNPadNE~AJ?k*VkKbmad_jbX+|JLLN z9(jK2vwYX8-?D>`KX1TqT#{QDOiz(}2j}J`OM~FVfIlWnZY9Cc6uEz}H#b>|zc(CI zqkeNj6$aO)_#YDdJ*9r9;Ilh z+kPgOlury6z<*LM2|j|qVm@%Tt$*+cK1T@UZ+lxh~+J#pPCo6bo($o|S(m&k8TfX`;mf}J zsK2g!d~mP)Ir*&M#gzJI2d}bo*j)KJiQmLHd3eAV7IG^_is9D+vs3zeb@2O?{(d1i zPW^TE*Cf^gCr=K(p3>iIgU;%&E1wjU%b%0a4W_8SPChTVE^wQZtAc$g_0JFZDk*No zNU>l@VQcz8WbOj7t1A&dH;L zF7of>F~Obk=j5@$r}F3Ii|Hz{h5S$|vV}N4qg#mMFS>;|o}ycb<0ZOrB`$c4d0X>$5}7?oB& zI!zvvCXY>%lV@@kg!slmbPMsNoahz?mqkU`*QCk(JI~22#P=4WTNq4;il{#^O}-*c zzA{a|Dovi0CSRQ-;gHr7ZJ%V3}z<<ltN|P6) z$v36R3)AG=(&R6t$zM*Bmjo9@mdFB>{zB_74Jo(fFy}VPH>b&u>-fveqUO7O`3ncLfLP$|1eEnkS2#|{-P@u>;EFn{x@mkKPRpK zccQqfOwK1CeJQRH^_8-t=>xZe^Kz3hH7 zQ1mnR8=|70yWa-Uevj%MB)8(XBj^w9w~G78&1kd}_$t1GL!w@(SVf|}$t2q2Um&Es zLh>3C{x*<5#cxZ*JtW#YNTNSIaGk^c@eimMy@B&RiSltI##<|y_b#uOYFF z+n?*k^0$sMcG7wh%ijhPr`?St>TM>mY;Ga3oNgtt%xxpFJZ>jzanD8K^t+Qpyy@TX*{6>kKhTpW1oTNB@!r}OC5{c7vE?I^B zM-IlZMxs7nEf}7Q>t}KVVol;SS4>`v`9@xZ{Y{R=yd%r8pGefNAV=djF61cumV?A; zr;5bss+z=UY!r#p&o~m7B{d}KPb6{LnndDsHkmBKJ|>UDJSGeA+ZeJB?p;aLYb1MP z|C7gK|C1+U|C1+T|C1+R|C1%y|0L=yCr`ruCyTNF$x`fpvLE(8*%$kt9Dw~#qTX7v zKlVR)3idyV%dZXOKW`pr zID-Cq#1RgPb|7x#>+UzvML)s3qm1JiMRxoE$^PBozFXI4knY2`T0 z!aNIi*oaia`TV!|LXrnes>V})tDdO71?jfy~Q)c%SHNS`Ca0-#TUf)#D9oAvYh=8 zag2DKxJ3Mx_`Jy91+txw#JteS{lqHq8u2D^mAGDfUF7fZ=r6>8$rHul;#J~2@m`U? zX`}tiBHu_)`JZBsxRZy7mx$MkcZuH?Ul4yK{zE(_$N4!;C|KOXBalZHs@fGo(V$a^P7aPQt;?v?bvOWm@D&`kCxlPA>|3;9Pw^(jrgMYEAdnDHe6d~HQ;(rd|PZNcKX%gZt=;JoIdAd z$FszV;#~0_@da_O__=s|iK{1;+^8t;%nkw@pJL` zfzHqQ;$(4&*e1Rz{#MLA)zup!juF2kwu(Oxe<8*Oso!Fyc!PMS_=vb!y!|xPy8+j& z;_Ko;a&8bDKiKhVv6*ZPg2%qHF2{M}5>3xazkKTOUKf^SLw4%rk0aB22G zA{XF(S@L%BCcF?*^7|y5{#Ek7$c2GD_hyMfj1IfG1UE|l5_v}uES7v9*&GB9NNyv)jQc^!o5{sN@Ds_e zlS_i&my&-?E)9a;Oa6#lhU+WI_>e8gx-$s6k?4OP@-DvB!O8r5Dys$8agxs?@5X($ zWIpf8x+e&(kUWk23jS26#jT)Z{(X?F6+!U2 z)^~&8Q^`lgA!8i;+aKhK;wj?kB~Kt>*C2VW zxIny3{IYnLc(3??X!n6=htId!-eclZ;xpoNBA=(y?sf59@ekr>Vpb<-mnR-8o-Cd& zo+pkICy8}pqqst@_8%mo)>>EzAe5l{z3d$wEJGvtLW_Nj}XU*SBcZbxgwt< zvb|;EO7WZGlj8Tu>)i7`+Ha%$ES|Hee3#_ilJ}E1uktTl)9ydwad}SW8}g_>Q@lvL znnb;6l5Y_GefDz6cE1g~CuGkzztP{1CI3{i-G@W}uH-+G7{@`${}yw)xcWUw_&q^# zfAIqGa2_!^)^U;L41=$d%u>vpM>2%#jK-T{Q?sD<0PLf zo+_S2!p}vLFB2z;GfC8MlzfZ0N_K_)rEv_fw?sGkFH`bu^)-@ z!IIAutHeu5_?tq)ZkD(}<+qD>i4T&n|BmG6B>#j&{hvwyKjQDik463wGxqan@dUA) zME$cRUnpKhqCIGI5posQ7}oUHlD+dix}QEXI4eejP(T zi~f+WA=g zmzc}vt|;$DqWpNVR4f z?-Tznel8x>$JrfAqThYRq0*ltxmp}AUL!V;XlI_}+r+!Y`^9z=lK&$4W6A#(v-$iS{Wyw5{Ej6Vf5{iB{0iyoC4WWb?c$5l|4xh-JAcQE zXOU=UED8T#l>B89?S57IZ%hA*^m`?DI?2@^C|)8?A>nTx2|p{Pe^mM(N`6;7EOtHF z)jNqqy($v@8!!C~$t~hjBv7vH__C3G=EeiSlD4pCI{U$%7>im3*$` z3nX7EdA#H=N}eWpj^ufgZx@%5=*N8|`umi)P5gtH-Pe_uh!>EkH$!ZZ{y`GscvA9D z#9xTJRsNCWe@iat=lq{QqJB9E{}aWVRlZE+t&$&?{Ji8>#hudsQSzsfb5C)8k0;U2 zX_9NiCb3oAEbbBcog&7mKs;oVF(mw7CC(t> zf1%3nk^D``Tg2asIRl)(0pd7uuGmb%f4k)GlkoqF)lK(2XYnk&~M8a-}EDw4d&z$%;s3bPouB?B{GUxif34UoK1!m!m&6?;?0>KFoC;Uo zgM_}nEmZOyFwEBfs#i^t`+A=zfAI4@#iGs@vh4EOaC9q-OhA=E5wV)XYsj>AW=mqTQc)R!zIX4I%A>rp~5`LbMyhVIN zd{5=Sk^E=LA4&d9>~xOv+e_>(ju5XT(cV0=5zh-Gw~%Omx#Vw%-w`*7uZeGwuzy$b zA0&S$`BO1A+_lq3JWU)e&JY)f_mSw|cfqLam{4|LR#YJL^xLjNzt`ghDHR4)vow#1yAZ`)2ird8P z;x2KwxJTS8?i2Tmhs498|Nbw(2hF$_h&{wYk>59FxqaUO93;6+tPuIVXW9)HM~UOa z8j;^yrk#Bc0<4oVzanZTp_L!TgBDlT5+AYUfdvV6gP|8#O>k^ai_RT+%4`A z_lgI^gW@6auo#3c-r1sk9|Ysiu~BRi z?fWh8zesY6xLjNzt`b|t)#6%low#1yAZ`>li`&HQ;tp}AxJ%qE?i2Tm2gHM75LdiK zzBh;Q&ll}`G?4io9qNn4zG9hJAy$gR#VWB{wC~%%&qT?S#K~f#8z>&*e%{fq29dwtq`%GL7ICY%P24W-5_gMx#J%DH@t}A}JS+yCTzlD~{r&~* z^LL``N1<3G7K?qwQgM)2CRT`5VzoF*wC_F5#OLplCyKRVomel<5*Ld0y{MUiy)%ma zTq=EwxLj-{>+!olv0Ypvt`*mb8^z7y7ICY%L)DvuVqdXLtPm^3;o>N9oLD2;?~dy6`$EZ+#d>j;*eEuM_WiDUtml$j#O2}&ah2FA zt`^sd>%{fq25}3C=X6`eZQ^!um$+NpBkmOshzG?(;$bo9?EGho1!51;epl6i^;~kX z*jFqQ?R#hq?su~6?{Mj>#A>ldoG4BbCyTXWo!BTgiT3@q2E`?FUEb8I8K}-P8MrL`#l@%>m|<;7mAC-W^t+5BHH)zP`_33YO!5h zBd!-Wh#SSt;x=)+xI^42?h*Hj`^5d?A@Q)tKWW1_WQ)0CzE~(0iN#`Hk$(@0^#_TS z;&9P^$A|K2$u;6cagsP$tQTjAjbfA7EG`vW#N}eExLRx%*NAJyb>c>Gv$#dvD%$rD z(f^&2cZs{jed2!6zMlyDgOd3}Xp66yE9Q%ZrD#A30pSSk(@E5+erl~^s>_Zs1E zqU1^9WU*eHB{qspVzanZY!R1>t>S92U0frs7w!9!=*LFMo5gM7c5#QeQ`{r&759nz z#Y5s@F*wS_FI&tN`BEIlwNNY)i^aZTsW?ci6o-pdVzpQ!P898XnrLUTbF7Kx?eAhArW5Ua#$ag;btoFq;bYsEUTQEU?Jd#D)aBFW9-QqjJbit<&G zTgBC4ySPSNFK!SwikrnP;#P5oxKrFE?iTln`^5v|L6Lt_jPo{I%oX#+04yTv`?Uh#le6c|6Ar^~$#ZqyQSSbz{ ztHf$?lsHbDBu*A<#X8ZxH_Z4-UMMaSo5iJ~eV-Wit0cFItHrhAI?=vo4Eqg|w}@NC zZQ^!u7kM2%FBSKYGx2w6#C>Ev{(gsefaLj5JVc_s!(z}4@(q~pVlFug_lu(azI-Z)YtR%;gYLJjH6C6hG64ZE_nrs zaoBTz)Za)MNiHTajzN;kNQ|RK@B`tb~j_P3L0_m3pnv+pCLovV95 zhW}vjycx3wpFjSR!7~;%)GZv`G-F}YVE-;Z{|-H~>98dFg20rwC(f8Xz3~<}pUZbl z4xSH>?p3gOgR562-R@$wm`zUG@E;JzhkZ zYHyzXJ8q+v?%lc(&uR{@&rMTmbPJC>@MIC4Xmm+svdXX8z~)zqQAe+z-3W3K2KUF zcX?8m^x*b*vLv~~Q*~~Cr|E2Wr|R6^hRzOd?i9RT7BBncbQz3y2&e1mq659TF+JBH z7y5=d*Ue1{yk67lgV^Cqj#CO#-)QWMk~?HhBJ9ZkxgC-$p|uNpQkS$&FEQVC5GJju zbBj+>m-OIvNV0_1?g&iPxgCURJzhTOCQybD=f?Mxi zj5~PF+@=|WFTV7O)66&}+B_PgFL~vQUpsmktbey{WKZ+eyLkKWV7^b@P8e>7;_a0w z@^$m3&hF^Nz8UY+HAQqlGZ##qSLa-(ov-|X%9-e1k8H1`O`f*?n}NDHcY5mkDhJ~b zZ<;zS7(D-$*~W}h8Oo$f?pQaGk|oKBl+-1y-9$>3Bqvg;&P}AGF6qHdq-05QBBkow zL`u`yL`v1UiImhOTXG|t+QFFJC^{-}y-SwZ`0SjLrn8=;>ReBz27T)W<2y(A|Evyo zJ$Jb+K799Ya)+m=`%WEPUK!wj{0DDmGJEEK_lD7S5b5ZR7gB-BT$$G0wb5DTi=d;1^%Ar`0e|I?lEk-T9~bmWa{db9s!aU>Tu z{W@|IDL7(XPL2-iCJT;K*CtU%bt45ws>^p$cMwFX5i|FHx#i2T?%J!Jr!1IrbHkjv zDbpJp@uKxIhG(e#UvB@G;d1-`bUO~$_xK1uu~qhs1#|F>(Qmjdux&2BSHV0!j-Hy-l{pRiXIbcK`?0Xl#u|Y?c!I1r-9X=Wfo^}2j7bDN@ASzMs`|SPk z?;u3|t#}{zMzEtl+{z^Uotl^0KYkuC$q!O?K+qp{QGe|be+XH^U!L=q=pUayvwyVV z=KGhE=5Kw(AKUTceIG(Jetdr2*AF)0kAE*O+P^LE$96eh?mq92pQpfIqJMmDMLWNX zegF9ROVr=CNdJzC_&d@0OU#27_~U2se)Il%r}^6z=^q}AB>MLsbSB!rO5889f3)G| z{rwBdX#e&^`iEQagulnq`d0;i&3ii|*x23o1A8ok#{xzrh zJM{mM_cq{B9_9M@?7q93B?+(;C?BQm%Xet`2$Z(iq9zb%fB;KKTk4NWLJ~-9NMb%H zSXu)Og(}#zVn3A1s#x)er>J;DY!xeN^;ge9+oPOXb(64ywf@A4+M`we_dWB>?z@{T zp!HnWxvu|QJA2PF^UO2Pe9t@Y`_AjpZ@BO=U*k~l-umS^V=qyV7%PwGAV6f&gny1b zI8dzL5wPT=JfD%5)Nd~~Am~pX8Y_?IEqLV>LZ0m(qlAy~cwfh>-+stL5hjh5$NNBD zc|{(1$Wl_jZyR|@{f>x!XCP)@KL{m8TuW|qThiGd6gb{cy%kO--8+Y z@mx2iLmnEd-}Vf7%^rDUg^%%?GxU2Ui+&9m@;W^7#(U%~&Cu_x=tmwJs~^wD^wvk0 zN8Uu?qke0_~Mo_2c<`{prUt_sUxZc~SULzZtMrzaZRR{Yu6f{m4UO^<$b| zc?UfD%@jWB_YKSy%eN&9--}4V%eN;BUlbYk z@*T{=_qmLG90#9kGXb>u*q)J(Q{Y3BP8!Si6<>O~YFz((Uq?)^Cd+S37QVR|`IwW1 zZ+S*Ocpjsh)Gn2eDH-`_%ffeiMn3jr;d^&RJ`QK$i=%+N`F$x1-@O_6I0ruOI@6Z( z?HT!)Fus32o-6H5w;~JQhcfcfnT2mqMtvO4!pHN}yy>0-Ur9gp@!gDk6in!!kI#2| z5<9U$Y ze3WEKcVtF>YqIb?l9AueEPT}&{c?X6z7ZMuJ)VW{?HTz!m4&Y%BOigu{g-nq%F7J!_&$}H--7=28<$bP z6~&5zM72u z9?!z}&XAFZY-J7pZ2@JG?E zxWORCrpxbCc;&6i^{Hc6Xm1DKJ+M|@p~$mEQTjRPhx}SYd9+VTel6c(ymNV*WfC6p z{a)Ii4T^!!Ypi~MhCC$QY{SThS4We^^1VmesSS7qd>kXJVLoWqWz^fq@yIXyncuCj zHox!6khcl%6fYeP1~FFjZ5i@TLS7|!DDQq)D{m~?m8aU(^DijnVnd2@z9xJTAnx9_ zG&OIYUOl~Oh6_{3KQYE_{%@E)Tl>zs{<@hrXjf(K`xlfg^!co2lwF|ZL##F>ys*SJ z;%p5CSTFiiVd=DAsc5WM6~($$v?CE$9X%=%>#dy;>;2pL^S=(O&K_c1?MVz((O&Ga zd|!?2i2IJkdfmcUuP@Tk;~(1@k4HLn_}Rj3iF3!cC5j67C7i;2r%!=C6Wx|5-1%(S z57}|mneh3x#+gRIMY_Ju_*u6jaW2x4h`9R_eiv~-p8<_HXXZjzJhGw9q5C^KB1O}F z6_0l%-hM3JJ5;@!pMU+nujoTP@uH5zpyCh3!^fUX1biLwbH_Ro3Ob%G>`0t~tTT|A zuVUSij%PVUszZkkXjwYnsw;tSv-Tn^Z1byBtasE^v0mzXO3DCFvGn52hlE##zcAMA zb7S4ZkROy2dLv~Y>NvY(+OJAaEbV!v3*`_6PczCFWn8RQ_73RUcN!;>Budoo1iH{o zfsWlhe&`mAfCpt7hCG(JssxQP$M`t9D2lSe@iqPq`t5heSf z@;#ssK4c@JXb(vX^<=6#4BhSsr<|EWm@dJvt0I z0iDl|cvyuJzd(N8*&Odh`Mo+9i0=NXYL0cIFB4HGxAwx{DT?k(Fn?i`Sx2(WkXI?Q z9F*BEmf1t5%<{ocIgE1-X$*sw94pw~X%0O-uH!7quMFjPq!_$ivF@9ZevvBg4HU5) z_asV@_evZc@mj}&J^mQ-U4;Jl1sqKsL7AwE?&T=k0m!4SSL6@$=(zg?>ae^Qed?$W zda@kDD6>lSVSMWOwqDiz;l!}Q`+IU!hYG6OyD^Dh=X1+@{&@cUXsC#~WuJ#FLYq-5 zdQYJ&iy*t_{P~;0&8Rno6`>xGU!86^`e08^1o;&DjUtn8)(P{0J*m+)%!|qPh%zGY zc-9TtH+d*u=SjlYKUnT;tL#6@l{`y0_I*dk(SFf(*`AKR7J0A-JiWu*t*7AE^Ct2Z zP){Z(KQ|Ru*L4x}Ww}#V*7o|+C zmt(}i=6wlY)Z{Ct8Fd?Z41H}k+Tm_J_TF3+M?FP*9n`0{PaMbG!>9FTS5H?K#thI_^N)NZ*cifdKLY9Zo=Budb7zE9;tL7RNiLf$_z( zS(FLg3}<~Y%$Ij7>Tq|D@BhTcGjBl`Jd&?>pq_#lpD?D44!9f(&A1%2`EEAyOr9a* z3Ta2`cEn>FLK#K8ZAZOInH;MF!%TUwABR!5zMrPXzgJKOFTig7qHpV=Z*-!zQ|9a~ z(|+}%Uo7pZ*^e?QGI=RtUZb(z+!*`uM-wH^ZuVte*Ws>IA4>Jzie9w6+zA25P^O-D zMt3J*d*W()`g~ovy~mbco$txioIRu??iR){XGVK{W4FgycIP775-eNJ*)Lq@nXlpR zb31zK#_IVg*FSb!9Bl_WaIW7T*K<60_GZMX^FgN$Q|>Hdj&E$YM^U!aHF6V`B4mRV6_D8$;AZ4JOkwyTE zpHe$@U*~#~Z5MA7Xx<8pjX1feH>%7S$-a&@ct zFEAeMFk^HSlbj37vk`c{!W`IAC`U{4uPeUT!F4}mcVB}(;1r?nL{oaIXs2F#lb37m zyVt6gwaRrDEUPGA9=*fG)1PfOxvIIUwY9cJ@wqv`c^F2ZLBW8yWv8K3I zkeL^hSnSc4rmw8>6xT|_lg`CEZb*@^MLR1F0*)Ie{}znr*2I}xD_7SSXIbX3abm84)S7oYoloYUGQUe;QtKZ zjB(;$8!L(`nG7?sHa3W?uNZ$qTsv_C3f>eB-I4f)%?SFwt zYM+Nw?JI+Fm9Sdr%xI+9mY@>h8QA`ZUIa+pu3+6(!lIuX1~5)PUB-p?Y*=QTV{wJJ zi8ZiDk+4TQD-HvUpeS70*y3rcln<4@Rc z{ponY_!CZ9e>(E9Frs__pG`FK;V3iygc|El$1dYf*l+#mc**#m161l<_UTSrkjb5} z{Wj(f1RRI$r+69XaUIlW7C#GbM3MGISJ;#s{b_8S=EJ){2lZ)hENf0k{i?;l)fWr& ztD-*39UHN~HIoessC##!zQtHoi@Zs00`WL3YKXvH6s;#6W{mDr%#6>5WBMFjSs3~H zAcLUB^L-bfZzYsc^U=1Ld19G%&)i4crQNgk5ns^m>-G`z(QvrmHw-e#3#c&8X22ffLxaws$cQTj4e{MN0wpyVEY4uH2pe62%K^@yoAPePW2iat19LN@5PeawdR$M_wMBVa=9j*arA~l#@Faa&AOm9{KX}-T`O+a0E@prZT<> zNS;B{A)c`&k6JYJougc^3=V>uUJQ@S_7FpIg}_m*(~*hGLPaAVn>T7E_=X0Re*_)F zuJp|udh3W)d3WU94q?OLKa&2J2NhvNP>mT($4EE^(lKhb#2lRqjv;6*S3J1Q2O)Hh z`M@?G1Ux(swQ*%i)w!eIi7Z?-TSQ!KB79`tD8_LiP$xN7A_SQ?6J^{ao$K)_Q8r|P zCqp{>Iu^bG&x{!lmd7LtPmwr5*&A9Q1r($nQ>fL4=Z&QMntr7-6W2-s2Pu8(P!#Z7 z_)cRfvVc*JL6+lm2$SNOky74NSfMwc#%re3p_V!;6=Bg(*6?-7I?}Rdqa1aeT%T-s z*p0eDw;nju)7aO-3<48CR?vo$Yx+-;ggFW8=V|OJa3lT(vp4Sv5;pmL_l157zxTrW zI#ehJA~w<884hiSTl?>fhaRD5Sl@%ERE`5jFc7#OUX5@%^TULb&f7xRThMD8=VldJ z3U@bHoVk(EO1OVR_uHePI=Cs;dFKf=;CVQ5U&fzb1zrRcBGA7zXA~eOoX0QAhI3L( zVKv~tZG;Y$^DYMa25_>{GO+nK0`AvgeVfCCVZQfh6^a|V` zq%?l8(-c@K!tA5HzUs*PYhecU+)SsCt&7669ci?HkH_!J!Pfa9u1 z-oFTN_5X!@vLihQyFO!l<$x7qd@BK1t!X{aBHVZ9FIaisL-b$M@n<;xNQVmze9QtT z>U=m{|HJ+f1_R@OqqZYp4jm`pm`}&A;g|-;=w2?LYtYWz1D)S3#?QFU1%Hp=R&C>a#}cK|5p9|5kOgprYf zQqX2$q2?fU-lF+_kzG%5*VIZbg{RrwN<x*W^Eg=Ho{acQQW(tjodh7wEz0 zE4~<#y@FN2YgguGGw4}4=DL!!X;62=mpzd!-}stQ;tdbYrpEcrhO@D{Nt)$}lF|*k zNPHg-qkCyzmgm8wFAD9aY*3G+8WfAml=5*ne0L^TY9~!8^XVU5G$(b@OneCRUS|EI z?>@}DDAj;&F|U|XJ%-??82nS;LkONc0J+sA`LY&gO6GMR=h!Q7XIe%=Xdgh%I3}20 zRD^J56}?FJD%&sFPkm?-T@sF7sK);R*~wX`vvV23l*1=Qr}8-HK|$u^H3s?2bn}{? zZgjKx4ZGN2-9moD24W_b-|F6_n;gsAcW02f`HLwGK3b{^<1eN#szK|*_)B_WC_fK< zn*5;6{9kqS$zKPp3+Hd9aQGxLzoH#Hubb60j-h*?>o8cXPX-V7t>SokImgoBzFR#b zDP9{zH)pfDg2yaYz`^3eV{}(Apw2_HkL}m=O5NU~ddNe|K+&=&4|#amQl1f-;iXW} z3}`F#kjS_w@Tp+Si6#qt;BF*2P?uZIEEafR{LSQ8q5XB0%qXV+T&aY)lOaVF-bTOc zbSDcK7wfgU!Q7|=)T|BUI_#;!!;C$cr)38ZbLbqbYxB#g+WfMv%?HTvmD|wO zBOJDZN7(BleE2r_)l_wVje;Xj(Dx`M4ADc@FFgw_zsFsqW_*gQ?UIppoe|wwx)9lS z=OotV9)0S~#9S0E$0(sEIS=pj>0CbU=UNo>^GbJ}C;U{67b3bYh)1=! z$$W29k1-$fQ~k+2#_((8H?$dR|HIEK&1qcvtU?-(!v;U;4-O9??S090P$9js4${6C zS_)kbIeJZT9URFu#ZE*wOQBKl_^Uu)$CJ zhZvMR=Z^xfrmplar*Cl#6a)`>PXEy0Y_-Ol zYp;I1EBp73_3s_;-`hpz`;*6_?9di)scp9F@96VVR!B4VsxFCvzJ)>Fhd-Rma47qnjCjPrjULp&Dj_#ektp>sX~ zv0OST($jfWMP!>+3*y)s}Fwhq=B>(>B}z19=R>hFT(+;9xm z8n543>j?}a5iSEtU`t`kV56|yq+11R&4qZ_Dy+FwKJp)sNF{=E1tWr1PZW+eb0i%$ zI-27Ktm%c*XSxLq4I4L1Yi?$BftE_r)JD5oQ2=a!WnYr z%Z!G49AeV4d3EwhWC&YLVXM=Ht?nyqwH3B{ZF_w~%^G`*43wy?T3bJDvB2ipk zUVO)zm5biBU`@px(FJSPC`fFpRcqVVt*dQO$!OKkT-CSo91yEgYh4viTUk@x)W~z% zRBKavOLZ;CcBEhkwQh|#l5&`QYyJCbk+_v3rL@K}uW80fSIssinN?d|OKodiQ$r23 zYeAm+#FfO2?wNwEhME36Wk~d^Zrh|5z5R4Na}JYR#hMYZfjlTac7) zi&MmJsA_CSOJLho4YiGGU2ARaU8Z5MF4ncxHl)sMvT@V0YdzOjwbh|XSklP1)m~qt z>T0WM5Z<<-S+%#;u3=)$s=A>T3N-i8P8XgPWhC?bwc3_OC~FJKhOcXHtnTA^cS}7= z54ovXvks5X^a+>zXJ=@wZCJO458@=VRMWm;!)Dtg&;wLm)yCR2I9&?eOgFoF)x>Ny zwYN35w<&4rI%rLLJ7winRo9_oHlx&(?mg?2uBS%!Q-wilEvxT6|3jl!@!K#i>Jws= zZw8$6F&Ms0g>rL>u|wz|qz3yUz9Ih00>ga6)d**#Z@&-z1;jkm3D<0Olv( zmO(t`IPJZ0j_4(WA|LX7(7)a345Xb2QKG}bAM$nj)BHK=mkcugm@$)vvw(Lb=WI|i z$ffKDot=Rl!3RRyb2`H%gD@?6<8cxwNJ_y<3bRGYpb3ok0q4QM&ft#F13BBnodZe+ z=_Qpn4bCiCc$;01%;RvE3>rz9JDdjs+k>52_Gp-^1Uv$%@K(xS1`Q;DQ1o~U6I6X;bwhhi?P}?0+2*>YI?Q^lHFwQu ztZJ*@SUcmo>9eL^KmCRot(#k0nwr{Xw70g*5K%KQK~2NKYweq+G1h9Fq1T#a*2|V! z-^noR%$iNa-=T2oJ)t_5W>rH&+veul*6DQ$D^fFP!;KItbG0di)lvwnxvW@?nSQli zb*wh4jn%efTia@CYS%#m)}1npO|M2(s^mn`-d5jWQUGs#6P#Gct3Xf%p#T<=bA7?9 za-R$4I-3^09E*c;ZR?H%L4$_X8O!eHp$3a>Mt8oNwJ1o*Nt4V)KaZrwg`A)GwgrbQfqJh8^Fo~==P62=6>?sJlp)Z0K}y|;=XMm=U2X?A?LCCj%F(3r;4L96u%$7gL1=P(q#|~?F^0%g-->iEDjDu zIV^^XJAxCI1P3h&4qp;{JCYo}I5;MBUvT)c;J}3sI0Lr9YgDKc+Poed8`>V60DA0V z=co4`g}3urfA}DBaj#bJ^M0uHBHSqHLv)|G_o&}ZE5+xb49aUB>S{!IZpis4xCe%u zGybE&;XC2lhVtJ*O`Y8cxgq5I0U<-mf^KPWL}_ryGC)T%7-jNjCiB3(uZNt!`WFXh z{h5X4{AJ5gXS;*KV?`gkKRD!mM0wr${T7sU$a#n%Ab)4bM>UC3A02W=GaHM8SB8Ec z9J+|k(9)3egDs1lFFA{WDET9fzW}*=9&rK39Hf41%TfQZv`n6Ke8C~Pe+oID-155f zb42~*79=SyT~fbyP?ftOWN^qiCHm~8{8t@>I|IUP!2!=YZSZ&$OvvXOOlfDIl>UO0 z2Iu-GjAV|$w>_vr&R_1KjO~HN!OKEu*Ix?`IQMMGId{+N&aS{>;5IZh=Z|P$LFZ$B zR>E)ZK|&t}|A5Zm!0o7wdtPVmo(M4T^gXZp^V71oC+G_f&HW>S-iK!XL~t=2$j(R6 zmsF3j|SOzUk{E5JrEp*b~9pI z5ChDV&{uT}{Z<;2^Bs^QkPVa)dH?^$g--shAjgu4p$_&e=Ns=k%Hi?9IX%D|Z9Eqx z`&SNcSqJ3-&UevD2X?ZRe-4cgF`bu#tT7ZWYV2ope+q(wbkdbE{CqOt3kGx1#9zK= zoAXov{X3Xf8Vr`{A(Qi1y7?E*abg1McjxcJ?SYhW)TT80Dm65X9;g25iH|K(^@}w6 zTJ^m&dWIU87C%P~N~7`oLmE9uy^$9GGWBvAeYyINGf;{NAx&{LE0MypnFV^x8*$#tp(^69qp zDA4%v$a@{W0sMGgM`7Py(+SAC%0vH2(&oC;kJG4*>9vPhPy6vY2XFY%a9!><_hU89 zKS!sUBtbEilyUG{n%6jr8)PZt^pSUYDiAJ*uakI;qcu-?I4DoAarC1MDIX{83W4&j zO$EZ`=+n1SUXHn^pY(9l4M{g0j^Z^{$~fxg6akl`-kCuct14E87+&j4&Y-WB@+J$z zZ$|xCLwbdjKmADmJlPfuy)=WL-%7QH{G&2xo@rnW!(EAA0{3O8Ki&za;q}^OsK1X$ zIIo#5L-{`~>67g;bva)m)`r)Fm!SlB+o^PpP?^zYOSFR-rBQ@C&L54iN4eJRXlo9SBwLCtPV-4l~ zzYKl8g3+$}0>e z{l}SI-Z4n`O$1TSNaUMxICfD^q2O#mEy2niZyuN)1G&c-ALVm`xX|dq{IZ@|UKqr* zzGH~cpU<{1Uz>4! z<>pok^T#=n`P&3^FoA6$U4n8V&PP4aAJfB5;z;OA9ED8K*m5txjXIFbr#9AqiYXsI z`qwoGAVMXLYX#pg_))>H2)-!DX9WH1k0=jfk>LL!q91N0x=MXU@CU@PO8rf60?LW> zD!~T@`D8Kue=9f~<>nuc8^40QT}^r%@=N3yKg6#PCn)tZ!6`vQFBiO9@c#<_P4K#q z;d>8pqEa6g)ZcCeJut`k7ZcI0)(h?yd`|H9f`h`~L%Giu9F5zeq;C`~7u+EDsNfd_ z|6P!`QyDKO*Wh@;V!^F~|04Lj;4cLOc_v<)AU6;FQ}EQ0;BvusL1bI`uQlVRe;Vf| z&_H%AKlV?#5+OZ~I8`ZjHPUkgiv^bo-XT~k*dlnZV5i_N!N&#n3my{uf#6GmKNbA5 zAfMKy9=aU@U7$8q_%{kJ6|5F~zu-fHdx_BRyMjG}ZxF{}{l|U| zoJ<^#c1r~R+lffGSZJQbO8?d3Unz8h(9J?`5xPU@T|##Wy;ty4M5M>-J>oIJ9}DuZ z2##00-eJ1`O@uzYz9T(=;}Gb9M9{phA$_ILQw8UU|6HL<1uMjVmC!Xp*9qMwG_N-) zACEd{`8$Q)Bls~Q^xQ9aSn&ITFAL%@1kLwn!3f7g#G52|9TDj)B2L5!Izq1@B42!P zjNwf}w+g*Y@I&JNh|nJw`jbNctKgT3kpFeT{}fCJ{y`A?oI1Ucf>#Po5!B;1^m(Vy ziv@2ZPEx8;=msM6Zx(us&>ccQB=|A$-zW6vgnnA+uL=DPq5p%3bp9e3;CujjnBWA# zB0>EPW9lVzD-rsCNbnT8$#=E@IwDE=Rx3L znGZ(_UPr`u%x?=&Uaeq@gm01XPmBK%@&A_K%i^!UQ42Z06Z*VhIN!(}A~;%bykH>_ z`M-%c73af=|7yW{@!u-+X9V>(V4?4`q!C|#^A)JS=?Xk2{(*ree6-+9!D7L3!Fs_C z!N&yuRq)$_`kSVZ|9hcxv8BQEM++7ZrzkaxI1LZG6QSokp_d6=F7&&FUMqB?&@Dng zDENdRrhPr%VR+XV7DRS6jis9qn@Cn zMCjip^d=(o|05B4>vbRW-R%brJ%2)Uu^u3fRqA~X5c+fxp~sa0Aky~-VUez0mms}v z(nx1-7zp`lgM0L~qVf)aE|j|f@KB~JDSj`$1`o@l`r30XcD{6eAUYlPFw_)Ws;W&CcL`EJogN>`pB z%3cV<09Eu8Gn&!!k-l|J&3O98<|=t7-99GN+~j$b3D2w5;0Y;wnNE9~=bXIXcGDlL zyOfGce~>D>^8N5-l!sL`^LeL~%xoOysjbY<=ryWi_(#(LM7u z+Dnst5ry<4ZrPPcdwfuOXevsEY+EpCPpGA2XAjPhlbJEkBaq&{VZM6^ZK~w!hp8_X z>O?OhRX?wn(k?Sm9V{y2p_t6i9^zAH`1&3`^VatRdi2FN@Hp;F#|QCh%->A;upL9w zKQvc`56#gR--^?t)O7iBT)!VrGapvN7uXD|d}qyma1lw)oPMFtuKnE~Tsw@p3)5TD z99x0&jzdY3Q>`}KgQD98anAP|OpV&?$A2c@0SO~mz8KsC=pm-ENGTWY`LNW7e3(x4 z+0~HOybW#|t^w$8b++>EhM!knN0GVrLV3tyQXUQ|P1Elb!b)JRvGO8@FPSda7EBkH zuG(0>eDHbG?J7#8OMdbZKLUrhT)3v13x8{@Jiejnl@}{Y$;0JTQeK0Rm(;I8^dk?A zl~05boQQ;7gY=65zoCR%-mB%yky!xFiGW(;{kNc@s-Y6q4soxgpLA}XC zW94!0+bb_poYHTY@G;(Jp^sNTJbIdx;g$DkFnQ&o=pn|+`#1P|^_v5Eh2Wt)?mt_3A2RZi`aO?w zVm`=2W95AyLtdRnKVCmrc@JguOTJTkvLF3En9<)hK_0Ios2`T{NqOrs`tJeI)Q>zg zR=>3w^3HnnbA^xbz5sowjvfCFA>MJ&)>wI;2cNh6)I4*)jrxs)wfW^9F61T4k9&bk zhdeY^-sTK>rI2UqcY^RSUNItg_1gk@ygstV%FBnttKTZfs{|AEn*>Wf%H!TIqx)fL zIxz5Yys*Z~;~uj&AG^TE_>@Is`F@g-k0VHz?UU(F5kAIS2J6ko9>}wA+aM?@Z!z57 ze4Kzhjt7)?t?*Hv3+vTy0y05=^3YiQ*cQF=jzN$uXKbNpKF0fBIG<(+^$#;1OK6rOyfpNGS%UsUuX4~>;~JVV||kAA!lWaX7ZF_zyfMuu4hc@vFO z|1*sCcC=rjHTQz=F<5JC*vgFlafa!lQ7|7|1K4z#7aNB%hT%Tw)3)(=!hQrMFWL!1kmy| zfXTWU96;rBF0{s~S_i(g{6>{J1}2u@J7I0T@!q&6y6Qs1`8q38j160rA+Hka#7gi` zUNNkd_YB&Lr`lEYX0#V+Ys@_7ixb2Mb=p~he{C!m zJxox)${5-D1jX6l%$_$kC>)|lAY&G-O}5JkhAY`$tv(3RgR)QQBghO_1$}8O*D$yX zV39X^(_}rJEb|O2IWr8INuH6V&kRFb9WyX>gjgtfMwSlENuBN$_MGlDz!p%KHoc zf`R-W0tTMPpH_D^9KJhOP|mNly05@PtNUxMZV(|_-Pg3b*MijQzNXb>Jgx3)R5x@t z{{9Wt_y3mQe^3$rhC!Sf9EQtTLeIRh_{$08^T?w-UTKAWk$S*~VFT0i_>MP1DLnsu z_!~lP55N(88~$KeyfoC?n*ZgmAL|WJ?6dq+-$9mrLB2xT=MB`h`VIAs>(?ZAV9nd6 zX|Dj=Eup__4_Cj#D(_wMIiXeY_%<_h8V6SAjlv-!}cq zo0aw&q+OBw`;hYp-VwsPAg?1P-{)8!%)3A6TWWZ1LlfjEY7O7%c)>$+l;_ZzGCArK zpt)c&#!*YegG9;EaKqWkhU>ts){}mYIX9 zZzJMbQya71R@dNKow|*&&mLReRe!?48hLYv;dBXXb2kLybAN0A;!L^U#Bl+Wv9`oEos3#DSA%Y=>!{eOgBBlLTO z=Jg-r-y`^d_y7j%p|2FWKa0p+4ke(`rNqHPIy!xF1 zO+NC_Sb5LE?UlFRqaXdPeosLd_2XDb!?A|>u!do@yfh&u4TwiP9@be4hd15BNSE^l z^TF}Lrb~Vs2Tt_}#)eaLh_PY3KDTZLZA3-v@OW5fIl{c@<|DC61TtN=C7UkuY2(1D z{)zyOU)I>L>G1H%Yd|}7;YWF#xvjh+xEaTG0vz0}PpyZSHVmWXbm-;#AsTja??J*C zJ{f;RYbM)@6%QN6dl)E+W-niVdxgAMwQ19?#!3CMiVECZ7_zq>s79f5G0-+3AG z4pScL&KjH6J2K=Qggmw@mLIl-lkz?YK2LNNz&u_lY1n#WyxNwQrk3QFbY0i%44Mr? z<2L_xuW;7P*>lWh;l=j~%a$PlbX(Ie3$T~ZTts_2t{&VAZJ6cwyn#hMv7xcY>{XWc zPT~He>=*j5uc)wJ=r6M0_qwgOV=#2ATsKcOUmm{>23s>I9E|{H7`8 z*|7a6=3}s{VW+|lgQejf>-(;lrjZJNC z)kb{htZHpTtxB@btKx}dc;3rxu4<{;P>TbgT2rA5^>@+Swk8)BKTXv*Ez8C8eN8Q! zQ!I;gWbO>OJm#yazOfYoH&!*&*Fa=V4K^ZN?A}s^mRg)f?`S`1w8ZLh~^V{VnZuDzkb_@<&1x8o43#huJ(O+)yg5nZ)LsLy{ z>y#8f%R|l|qYk3lbax>l)NZQU(A-cv)m>X#U4xS=-jeBBc6g5A6-@ zXiaE?>uVd+t8KyjXqIYYo9AOvED2@Um|=4&9~)9zQDOgTtZ zn42r6*-Uj?+pFtb^nqHmdF;CW~aW<#X*znF?_U6b*ouB zRqHV%xp&vM)#>KYiZRaH^H6zI59emps--2DJbr4{{V{Fn51-BR`#Z5Gcp^V z>?)h^@|DHzqT6hI6mMParfH_aD}7?$1I4b5$vh4U61fyVkZjV_J9rU@gSp5oY^bjOnM$E``uF-hH$^Prs| zr@FP%*H1?Yx7MLxW_Yy4)%n_b9z2F&z-0cSwH{r9s>s>{b!Y`nI&(MFWBkB#)<_&v zB*si+mCZ*|H*L16(OodV1m(@1rQ=>&`W#DV^gEDhA({0fN4A<2Z1-jfw^d=zYB7U@ z30(r;WF4{%VBg=4Pi{d|W5Z^b?Std(g844z%Vh8rBO%&f4QAFj3-PU2IHhph#_*Jx z8>(&>Dwm`-<)kw1Ef|j|lfwlK4fR;oRJ+Mxyl){bTePymgky5*r<87O%+^dvVC}_slR*R)olZR7aVGq%wIWk7RvP!8lrG6lx1kz8dUn6w_rT|t`%o@ zZm30RiiqgE1>V($mgF6`EZ;w&$;@AQ{iWuPjJG!0(bJ=#R-B>b$z^~ibEvYK`t?{H zusvn0%$Z|Ge9IYOqqu}hGHn0ID&E9g*@TM*j+(MWaBJH2aK^~|i72K8;5UDP}-17x9WZ*rNa(v`W&Wp~EgC^GNM^2EdC8DlQM#?l@?lP6Z! zuS>tAP$^mFj;CGwvBRb26gvqvRJE+fY}MG*zP`>ARn}IS3r}WT{AyAEjnnwTNUJAa zJ+DhP;5x@FYm(Dj6Ay*f#g$qrCbO5ZptKh?C`qi}Q7b6hjrC1tb>GTSy`jn!v|Z?8 zafZp(WSsvO8U|LbEJO2Rg`_medbw$sFFIftw%fdwAxi}L#`+p4f%eb_ z1*xjOV5v>Ec**x4E{qMG`7T1H{qp7`jnr*bXrb^P)b{&_7Y-@TyBwNqKG=m`$Jss)K;G)Dsr*-PmWS_^3)7Dho)Sy?L)DW!&4~xy% zP_@Zj%WZR4{qtVv3G;G$BA=cZi+$t4W^HU2xSqJd8g2@?o2Zc?qUXs@md@d3D(D=TD zQHY^ZzC0rUg^%DWwkab$wFWbri>c(x&1zKk;~JWp?rN1CP_EKsIb&BKp48Hp7Rkn2 z-)PpX%mXhP%sRw7!pvv8P%H`C9xzRB;n+5)w`%dm zIXBbM9@n+EU?I|CD~(_Eu}ckn9)^t`i;)_%5pQlTyP_RU1Zui-rh=Xs(JeM{6!`GT`)jG zN?9|S;@Va(g|P(o#7EKU5g2_2En;2$dc3Zn_X|yCFe>mK7dEAe^H#Fx6SkuKC+pn5Ze?={upgHRZ~(m9i* zX_>u6&Wlam^pYE@$xm%Hw&QWC78_}0^4?IYI0~BTYj|OYdQC>Z0Dmibv0fwSE$ZoR z0SD~W)$UC<+2^)4q3x}y#w8GPy@tZAG|vFj-^Plx6SSkLykbMINfn#f`jMrJRMbM# z(75BrA$NTvKJJ9^x797d{cgm@uDngz>|#lKw4N8b?EduTk+R-$X$-p>UR z9%^%jeIA`Wi0C zw{qD`@GZxDhzVb3=5E~I=Pf#Y0SirVlUeRDi92gVL_88J%u zSVU@ww7O)yz>sXs)8Bsctjx69T((eeFxi{#sREf-ymG+}EOC@1pXQKTugS%oN;23M zh1S?og~u_NTl^47&0BQKvRip0u^6+bE-%}LQE8Nvlcdjn=6XwuLC{|2rD(~5>knm%Qv==D`i{l^YrHWj4cTb3|bKSqv1`7|< zJY3nV!^iC|*stdoFI`YpwkZA9f=Ulf}vxH}#UPe{J#s3S9O7lyL@takMLbZ7@rIvhV2fL)o!*wZxYAXjdJ;^-pV zIFg(FxGMI@oL`3z*i}J^i)$KPUUmm`W!p?$Go>vw*$8okv!Px;n}haE9pr)v-3kjF zNm@i*q#SROp;~W$qs7_{W;MT}d`(IDyjw&Ybh4JFX3QMe?yOEe%ag&BQdw@7$lxUd zt@P}*_3JaGn>s15iCpXQc{47((Qnx%^?FB7w%o+_#@4%HGJxT>jUMYzD0&Dh(GxGr z($igJ?PbR&nQ9Fy|1VTW3zk)sFORZ<=5xHnM2~BeKIOt`EyaneVEsIdDY#ZX5W!0; zWDt!cjm>iKQ;A@~+^Lz^KlH(C>CF0DiBcV{(E4I=JWHeWQd&@6zMRh+>Su{?S))Uh z^{uEwt>IUN;TaE_nC52h<=rx0&oQ>m=r) z-sS2~iIuo9l^FrwtL2?oom78u=BGA>xOC(`BGycJ0Ezc`GRt&5!qEK|McK2s->PSP z4xpwC@wvq|UP?+tS-r`ym3&5!U(eP0=-D!@X88GD_7)jk^aX>xd+T{5wO|UGg^3u& zb92lym1u-|s9r5ZW;w%T+N=mwysXFa&|KVeIxtU#8E>=7>2EEiqQxa;%jfe!8Y52+ zimA;W+%x89ja9U)xMJb*a`x=fJ{#m1X+<*+8=GaS?`7OOPF|z3R+vlsLXzSHHS@Yc zc8&|o%^t3Q+T84siSpm9mAFvfEMJ6c(~_Ata2b(uUns`P(qdi>0jABoV7E_WG}EB2 z7dB=*l**oiIswu(T&bX_Fvbmj|*#doJgEL|57o6ek7?5c_dTvoDKTy)|UUJVyY z{nlkmmMy=1nQP{y`O8ZdxCIjnXRn%~CblZ~CRd%u%L3!^Q2s5j>tP>+|bH|?V)nm_rdOm{UK}!FTdOX z+X?$3?B8IAUJXCk+hH$ezK53=x?p*>_#)W*5QpzN@&E^ZU*fm0{9aWtEWaDYZ_0cf zwi`Cb>0kOn@~1?usjFZ2 z753Axao7;vnVAO5v%z=6^6c*=c%SuB&7bh1#}8mX2)iD3GHe+3H1e^;R7ccQX3_BN=FZ6y3 zFA+Tidn@dXuo2kfc#&%@Yys>!ytMQ+*!y5_g3W>bB3=l77+p!(M@xkBVW}!G0R{hp;p8BGP8qBd~vgoi+sh0`_CD--Hd}1)TY?9k9>B z`iA2C1K91b&%;i{iz+){zYm*_bQi+b!oIgasRiSdx_Sz}BLu7fei66>_#5Cs;OOya zA5-x*67VMz(58U?iEsl8fCnMtN3d_e()>64=YVf0Y?rIO`u+P6+I}9we+`@ftONgh zfZLb`?6;<)KfvmjrvYQ356w8}@+0W=F5sSNXqS`mZXWE;NlJYO^yh)Y5$~742H*sQ z(d-3|hK}C>E(88X{NI4A?bo8uT!Z&`fJ=eD0yYB&A&rj!X^sp2L2wFqmLdOTz&79; zu+PKJN4l>f9!&)L(9{ST%KRU34gOYe^jJgRDfp1!Q-a?S+#%(>Rnj;B{4M0qLtdYN zwFd=J8k!2;D2ozi!}foM5kt`~$cTS!yfP$+kX;5t`7&b`86G_jYp&al0NylCMA9Gc z@ugl%?3?}yreNaUnu>dCD(1z$< z2flfJMhcg}S4W!XC)HJBsjE;#s^Fc_8qjYVe7n*X&2LYcRD z|G6hY;f9{R1jFTHTkFWwRiOlb5o1b`#Ec> z`KT!6dgOURQer%wJnjiQc(m9iQ*shiCM(|3tZv~;5_qwuk8p1w-pgD=k(Bkn@35!{ znjA+!?^#j#wiyE1Iy31po^ZC>%(J9khF?H^7hL~K&x^`(6q7V=Xph}9-u-XI(Mx`2 zR*p*gF%CBxkUKnB@O6BkI_Pua`1Eo{DS4n zo98#Z-$V1XgXL*-j#`jL=cx+Nvy)OCwK$E=QP+bWlT0^H-2{5X40Aq^52r+219~QC z2QoRA-XzRB~So|8aB=cq>|zwDcr;ruIHW+x5f z|9i45%^LSB88qv{vDw7+7tJ*TO&vLQFtGlElyVWyZ@@f);{lg4#Fr)AP7 ziOBw&Kz?JG3o#<=)(Jxnae(jS1=~H zU+{q7OM)i_UlEK8o)SDG_?qBZ!E=Id2y*UVz5{|`!F)lU#m(?$!8SpD&w&0Nf}Mi= zjsX3433dtY5qw;b`(EUW3GNp>Ab3#lkl+f>ShTxlm0qO5y!F<7p;4s0F zg4xE^sS-Y0aIRpHV2NOT5Pl=dI)Eb_XDJp)MN-eNS@ipM^K= zG;d4ObbKKUFBetUP1ldHT|{=a110-xVf59+vvc6p_7YUd5;Kb~$!(FoDx?Q_4&y`s z_bf7xvutgYuLf#S@?AGPf@(eiXlVVeg4Y8lW0@V9e$KF*E?-ug%@4EjSkURSX5)iw zHPf$8(W$Sp>F=@OD{M9Rmf9tMTCET*^3n{yH;-vJX`Ww#9cB1ggC?yFnmfCr9+T)X zn|~g|K1MSTOqqP_H`Z7_o|TJBout`RY_4aT^{|op=;&c2DewggP^G&d1$PD<#2oD zJ?_zu{#ITWgyEOe?=ajP=d7{vIG1_l9Vo``F_@TNUdmc|cYzPTWci%}LH+FIu9deQ z{$6>Jd8zWlP?(f=2igW$ljm^024c<(c!*&b?M(a;Z9PqxY4#(8Emt;|pCTX5UYK?V%1`cn!k;P`cz;wAK zVAJIsZ{twL%Qq?I(jmr%T@TtTFN%K7QG)VD!CHB@z|A;z1o<=MowPzEj3lPTG`=5U zQeM7Hk5owI%zE5uQTM;fUhFSW%5DtH2A#v?eOH6 zJ5DygKh2PL1oD1v69b=h{v<=*A;=qvaF*X#kGv6RL!M@&9)Bm+IfzR+w%*vT*H>@w zoDzERb3$j&nswbQm*(Q*bl1^yS%~XO~a=)$tQc zdxmYt*_$}4(_e}2{kXASCmQPxckDZj9j(MMwL8J{Je`P~sflwmhpKolo?z)kK5|D! z9!o@Ut|rEa(E&MklbB=qagHd~u{taSzo3gW3bh`;RtUq`jPp5>j{9W7uU2#)Ke5|? z_MvCPJmd3FWOvU&wYx_}V@Pjzf^s9!5AnMXMRz9-!ybWs2KFE<<4|UvPmPYcojnKK z-HBDe5?~#$6xa-m0yhD7s@;j_RcFsC&^tjFf<6hl5_A{n{h-f)t^@rz=-Hspf^G&K z13d@y8=yCVJ^*?y=y`)Xd$xc+1iA?HkU^b29iWeZE(5&~;YE?oo=*53gI@*wE(6bM z;9`W;0EdEB(QS#2%Fdnuu=E(|t%=Gw>8%Omy{7?u%fLTLedNrESZB|y8Q=J28~m;x z{Ec7wwsiKyyTGd+(DhmX|C#Vt?hcgUjzlbSsCzBS(BB;Ep5X3Ie8c@&Vk&rWm#=4g z`GR;be{B5O$j=gN2hSA#ETN(gCVV6L4XFnc&X}#;Ux!}|{JT)*&akcB{zF^4WA35u z+OAml{=!4u>d*s;+(@ijb$uXlR}A%CncK5t@crE?_MyZBYZu02;CUSJ--Gl6>O+Z8 z!?^eX^<*MYxizu<>ifI*Ms_Dub4MZ&=}3G+9qL{mk99vdxT9OecO{-eIsvsS;X9Vo z(*+szMX~N(eu+PQSgNhiU$C@hIH0!JB(*vJM*q|8V?C)Gy*6o36`X zE_fW}#-j>pM7EvTubxcgL)TUC_rX6mGCm#w|I}koCaC*d=#?Lx7@q*$n2#dxv0eI* z=ds9hK@{Zz8Nnhqz6Y4+y75ZjFx7F!=T3>|7fp(n37zLoj^{T|kMAXamm9AG2K*go zST{bzs{nQ)UYf#hRdQqL{oKMY9z*+B9)i2oQM`AdQ1?-2h8ko-{~`P;;Q4v_qFf#mNL|D8bP zVhlnV;`xu{81%EhVXO=)Z4NzMsK?7O7%xYD(Ttb4lJ3nr#BuUtiIFICg>Rt^1LFEI zH&BT&6aAsm_f&%YEFZif^o3AItb3%o24m&{)Yk)vFl;{TFxZi>V_@9~tO~&$f`2HH zt1tB*O9U|1hTX@I&I8ah)*E&ofZqd&Cg1S{mM^akZI1V@0)Ezy{_+L(t=);whA@^B zbEyMx5XMkoMBULlAPRRhHlBJbw-bHgC#QX?qo;D_j}k!@#dqY!$18_Cm-y59^EYwq z<@gKyk$k=$pkmHHFz(bi4UG{GLE`-^%^c-+#UxH|e50zUKeG>V-tv3X|NV7M;|EcrajQr+E zew#h{4I{r{$!|_{dpxJ|Hl1I}*LALSj&|p$m~V_{-pa=UfY$*uhn^1Ub~6m^W^myT z6UU+*JsejyMPj{!JDi>%box}GFJ2Vs=-FBPmDAxU`!4D(_E=&<3-aY6zu?bp+|lhc zfBAIIp-J(bRfkRo?qmISCERU0x_yx06n*9Nq*>q}bboiC8Eqs!A--wIzQkY^!kqDu zL>OZZzZp2FGS=IHbG%hJ)_slNjR#|>6XYWg?IM73n(FW9-c%SvS^e;|uX15eunXh2 z+Sog|D5vK$g-*P4$X8ECpijVkBH?s>`Lsg)UW@h?KJ;WFcTfjpd?b;Fa_cPq!s$Sf z8xKJ4ILK5T6XVm%+4j&k-@Uy%d<<)WW;cFP?L+<^PE1CafBN=re{@QGusaC#{7^g? zk9BVw+jZJs0A0t8gZ|^<6UN25^NNt)!o#P1)3~~5)(0x4J3|1e*j*Kun-acK_dLa>bb-<0h9;m0)+cXqr7rS zgU?4A@&-qrOXM7SE|J&qT*8Sxml%L>g|J~KcK2WnbB6nn$Jhv94m}-6jvsrf_9c8V z)){0+QD>+>uFpc1`%e4SO0?TY^?1U1cksAx&@G8`&6SI>DT-xrjvMPP@_jK8D10Q5 z+tC$QgeW8aurRW1!N8-KV$cp&j$nSef^fLNgI2#@FT;aCF&FBv!KD49f@{jN6 z30Lm!!FB4ZXusXwww_ni8P7v|&x^e)j?1>(hV~gLk|`C zG1?RQBWf$0hXBAjTwxJ{rtJe?4*j{52gzI3BL({jIL+9fZR;b6%f*yX=16Y&o z#@HI`{=j?97|ro3%>Ji#bO#DC_eZv(eRZJ?#CnTS_N;4;Tg|>dC0d63IB_8N|Ksjm z;HxUG_TjzH&OW)E03n212zr1Z0YeB7uErXWO9(*@5Fj9y1Of!*5=lT*kbprDMM1E| zddab(qN1i&D^jVbSgBe|m9}cB20|3nR}t@4<$Io)wa?i(Innm*|NVaN@7>AX&ssBU z)~uOXGy8I8&-T}2mT}|d=3g7D`h)lS>n}Hd-?+=ut$rEs!Gs?5RlwzlH=y@H#4iWG z0(|AOe{FmaeSQV_E5Lg&9$x`^C1~bzH*~KA{~-G8Mzb0=WY$-LzY_6xL(i3bhF!P|s=pdxtEda@`~Y;V0>2vk14z3X^fjcB_8QP@K=XXC2DI1E{$Lt^ zJ8tF`9YY%`eWvlk@vqsgsEb7DQ@UL|)u;0No{U4g@V+GjV+!llLOrE}R(%RQ&l7&s zDa+>E8}MEvvtl#aA&CASJo<|9bFSmB?ibJ{-S=*8{iV+`YMx*Eh5)56JVDQ%;_%y1|a3YFwuxA6^&o z`v&}efMW~KWrYiP>b;C?qD4tkgm^JuH?;dGxcl3*`vU|;a_Ja&V=|2n|JVtb}0wwgBM+Yx3G zz75Mdrw-Q9oU<_=f89B?jdjy7HsUKk5~G z3i=kW%~?krLwS$u-J4wRj5DmY^}NrbFMMdT%t+IJ%X`N`A8)VuoNQkAYh6Za{DHf%cj_jw9<$WQ;R3C#bC+E)2I_$A=)^mIO#Xz$>!aY&;{%)ftQDnhBJ0H|%Tus{b)tRghwJ1K zvDbt1KE}&F8K|Ggx?#KSME6^2sk_L!t@E^8w>uEWy4^nDKdak0u;E|zH~i+Re1Ua~ z=kR^#d+xeTT1I;V4IK0Md<~Bo-yfAH^^3ZWkvcwpd01{FbgH^WJ^TGNp}M9XT<=Bo zVLT63KJ4!Il+Q+Zw0iC%dZN{{2X@Xf!}ZMbof+J8jP2;~CPN!@di967~;K5!}B;hkiqL z&ROF8C+Jck_YJE51`qj8T_`|%Z>DSh!)eczq~%ltih;?p`kD|-+38(2-v zz)Si@bAieVEF0~J$!oq`)q7r;f+uA5hxw)oPUw=c-P7Ef!N@;{LD z|HmlwA0rPtf3J6TkZMCU;+{h9s9H5A0QVpvMBh|t0HMv1C%QL0V^F^Z5&zTe&He*= zepTabymve#`_ zuf2EId9mxKbvatF`4Ndj59Lw40xQeZ_rmPHD60pD&Ic{L}+; zAOGaQ%au1A`t!m2Z@cZXQ|DZ~*jxyc2nKKCl3E<=E+Zf;cj<7 z9$<3I!*7_}O42n}b3nruT%>V79yV~pgJHcL)!_e5W8Rw@OJ2}ey;Wmyv&Q`oXsmxi z<9~X5>HEFE`{vcZKm7JfUv2#F=-Sq<`z7pqQ@7kP^UUOh4_2!a_^ZWlWXd|JTa+zqvft#-J>L zp~H7HJlL&Yre|mUpl7e?(R=sZS>67U@>tRQZE34-zI5j9ng{JJ_xOfgny~xl=NH#+ z9ecry_5VqF+FCm3yuu9cwt_3xe17&X`;48s@b*5JPyFNWzZx>X@$0J>RrRQ>UT7Sz zO@Hj%_~oMxUw_%iao0a_^n=}PVxPNU^bV%K@z}T>bEdWbjTIcY`|b<&Z2#TXHpJh$9w6k zVo!ZPBJG@OF085h;@?&`tokKiu5n_-2i|WEZ0OT#`ue-l-oNkTH*4ms-}ZRo-AC_O zeZ~34v!h<E9jc{mw7Op1u6{^F|y#{MMiUaB_I(dvCg7 z>;=J7bG~Hy*RI)Ep4O0_o1fib=FLaGKGXH&-EX}6_}Gt^eEH;#jQLAOuYGSz@}oKb zc=On)A;q`%?)&R^S6K^2f7AWFlTQx8ZOVVXy?TG%`4dVmTM~QG3$O3}^iJn7?!T;f za^Gi9-8OA?>}P9++|#FKTw);Ei=R<Y31qxkBoixyiazFdil}RqZ52T zzx10I`hEGg+xOmC|NRr|ULTgT^VF?{&ka8B#S2!>*?nQ_vWJe}_Svf2IiJ=W*Zx63*QiyxY}wCb|Y+U$S+$?DUiM)$qvgHK*~BlGQF zj=28k{?=b*je6u7%u)%z8BUtl&bSXE+@Z*#Am9WprOfbr8|PJW#2A^_O=A)vN09*> z)#jGsB{ClA6SUfCL6AF@+R*eNcY+L+UFxVKSK0pw;jm_jZ35$8*26$TxiBpOx+7?5C)7exEiT${Tj4@Vc zZi^wMHO|@=6PfcNh-xL1!%Dmc800`bFdp+5!BZ8PbQLf~2aw?#II+f59YE$F_IP9U zjiwGF%eQ1=4cJL7F))a)uf!VQgODP#9lMPHWcxJ804xo~lPSh7@sVXX05cC_XEe-U zkyud{t&Ty))z~d#`nDJnhoBtwk`6ggx?UzVuNSALB}>+IF;bI7DM*%M_p$^T+hRyp zV2?Fs>HspUlmG%yB+{Hw8>a+zpv>f0S#dOMHABepj^E1=m_)ix@jq2O>8Bl@)dc!5 z_BaFatG7S{xipl@%Mdg+>7m%;jMdu_jSzBqN&E8FsIM5ZFRm*CqJK_Tf+AEUsm=jj1KUl7R8ll6XTiW-ST2hKeD%u4b%S66KnSsU;EAj9p9OkY>EK zB;X8G5L-*4Me}HG5_TC!(_w83gJ+GBnnVa<=gKRSYDsYz!Kiv1@GW*70YYug5JDyw zI|f!lP?2if(gWROg4Q%W3EtcZJ2g#iR-urS(R)e`$RKvpm_g8*rVtM5P%32eLI9N7 z9D~xqtwJUo{D>6u7^^wztIaKUhcbraH7SmdQ3hHnWE4iw1B%cYH#=icj@1mg{VFFO zoZM*pZtOpSRol$}&aP8YM;-Rue_M}EuaDHQ2m7FZUyF6|Hj_zLqDK1vTgkV@ASsiv zRWkprq{vTg?%Gr?U|eY=F|bYQ!1QJgMPKnFFSO~?0NrfO&f9N5iWZs1R1W4^s@d80 z2=iA`fiyrSc8~FsS|Xo{dW`dHiMfitpq5yq=-gUjxuVajB{DOQkyrZ)kf*>XR{+e6 zeE?B}JnVWwBvM7#5kdG0$#n!6wK+9JCIvhCFCh;*Izb|_3_F4e<%(=pScIw+=+k*1 znF|s#RBcWkoxr7Gk2fmO3TEmBskLNFu$zWj2#75ZZ(QNTlKo1>(s;GGb>$%h16!L~ z5+#~3YDok&(^?HnG$+aeOqq}ws^oB@B$1EZ%X2?Yg`@+DpQd=yC5p#+1Mzo&4q}(n zF3A(v)oBLNq(8*YXs{%|Rna&FfhWz@cXA`0kKJPKBnq8Kob5={C6q8ux1?ubr*5z$ zOH?#u!ILgiJS+uIx&ph!Gaw1}C}k%iNwaz!yJ45woLXkJ&%$mQs0I=x*u7*>5YiRc zX-F}2gItN-%WFRHq&F%aCwcIs>l_}Zbkg+>k0hjdQK>EpP!`g04v%=!DGm>Pq|+3S zYbo%g*}c?d33$@kiia}rq;*-fJhD@pQ&y*V@hDD(0pARlu(h#52S_-Jx&?cz6CMP^ zMvXPDQGzBJ8kFP&Y_pbW6^@y$;pQq638%RX%0IfEs zZgauqVHf2jXJJ>$52z&`RP>-);vq#3R?igPP;^c$@wlRg)Dk(&dyJvAM0RbDF|3xzQhAKw zwZv>ipI1xFQ*>@Eu~5`}%Ygi5AUDAh?xP0t4COeTX;o6`c6Vw4`?NR7gdAteAP(4(k{kqeLG1p~zQ$ zD3U&}wSvNgO#2FpyB2qn=C>b|fSC6C{J2!&ZjC+r~80GXN`3dq+aXU=@3N!J72TpM>A*paLZP@~C>fbE(L0yqf= z0+}dB9(LGU1E|yF5dcdV<M zY?M;*StLCi&jljYu7aP^bzM=>7Uj(`tk&b&4fmbr^T4+()8uNmG2O7}?GQ|hv-Rq? zUia#^vEe0r<4F2^KY=6`+Z9DN6(z(#kbAwtH8zf4jD3vbWeb!#5on^`JNlpAJD)3q6^FA?NtasU30Anq!d5 z2rpOM+qGPAAE`677;`gLko}#@|aEOBnb8YM=AYk5h6gMC_P&F39{x zN)|YhZ@MJ8)P(mW4p%_TJU8}IKx|C>H2@FyOeax4Tx7J^cI=;yAYzXI>!m& zqR~pvNGIfglj;H|=WT-{CmM*C_#C8u1OpG2b^H$8o+zI2QP>!*RSXh-0B|FOCy@f5Gu0-zgj? zIt~4t&xf(a@O8z}^kw1b@m+wU!CoA%o;m~`- zp}R=xWDkbOcFDU*S6&B)HQFUVLT2?gX82f$griS@HQr(zRwFbf(4Mf-j2YP>7sk?s zV@4SrE=J%6B#jxJ*WsrQJ!XH$QqZ(3W^A6>ah}8E=bIfDgJJ1n#s$odS2#>TiP`Z= zhZ$dCc3gr?RC^Uxn?|R4WH%DgR;AgQm}mXOOdSi6Md%0?2H4c=Mcx`^#-yGAGZ=YT z_YVNMUB%8s81P#xU{a*aqP-stAmk3 z-%cq-;8`@t6}<`sGNTjo!{Rd zY(Ml4&kY4Qjr)09T|oB6D=?h+H-f#0>}FO_x2JGW{o-b->Sm!1=n|eSbc*h~P@vri zF9CWUXxpPVq8|sHZf&hIp8?Tx6hdAiu^7Z(NZbmdp2T|~J|OWBP90y6I0M3ji9N@I z<7|MQ4}j)k%}Lg$=9J!M05HkO$V7Ot3J-Xy zAa?=yGA-x10@6Bk8bYg8=w#1w>cAHooVZnpI~>wL{U}#&a|!{ch~L12t%uC+km@=J zmUd+wb)|C{DZLPA(_zp3E2W+>yADT)k-}cq=Y0mfZYpsGccluW&lv`9@`QugB3db3 z$4FUEsrG1D>zhcalZes|^GoVVA+Ovao0WRW@8}L+QL~>;pxogr(J@-ZfzH*-Ar1>`*@wP#)qej$0SF7xN$)nIEX^%-B{M3#tl=xt6` zZRTz{#_=}@cYA6%BZIBFqgmV(s|q)xO6j+vbfrqpqjD9sE-B4Nee&~Ap8b9ss#IO> zS9LiS?B%q0zp9=Zu$NHqS$6bp4}n#ukOS<)-M$2?it{{cr`s@CT*H-3uBqtfd0lOl~QNbBhym%PQiCMmb-cM=JdWs^*r)~^kkcr@cDtIF#)2>f*N zQ&eU5n-5;uT4d7LY|qxX)y!|YZmXXoS~cy(DtWe9w2rYem2f6ktx^p=O=X^$3ZGCd zIYYPPAn>Xsb?VId;8oF!!!5ZB#b67$EBy-eTDDe_YLF??%2%oeL7Xl-pQ)Ia{1?lz zMVI|Hs8?m*qRaja_(hE0s?6=z2)>N`Eh_uW&Y(B4I6u>lxB~oE@;}#nJ$U7~+jV8k zYAfd78aAKL^64iWJSM5(WipPq-o>t-&6}5ej9Th3G#NkDkoYNxIK=kY03wCN!yx=1 z+IY75Gc~3U)tE6#V`e~O_AHG#u}v;R7(w1t@NChQ7!nq3eQo__JYb+JHZK>iYc@yfX8M%C_GI@XFMG==k5J$WZsTj=u}MGWi`H zzZSeQsb0sIfmh}p)$wD&t709~@qNInqBW=@po1meMRVWPK4l_Wm8wyhpLuJ0_!#3) zXnr4gw5{horG5~d2}z7{?4D0doO>al9P2m=LdP1coT@c~=~O*Fg*3gY#~UE%R)gtN zJ!T`GPSxWo5cH}Zqd?HD1}mScgEsnj_w+N6fTqTl5 z27POliqr1s_}vO1le&S*XCdU|c1T=?g46f}naf?>8tyx8`r&@9BL4_=y=bcPbor|RU| zuN5wjo(S{V*47=S@~F=}ylw~ohQaG;&ljGl5CwnG;BANJOOHCg1P69W@#)veD@=pelM@pQJ@>2P|-1!mYaUV}Ee#$e?ZeLHEl!00nndB!*dD9>02 zf}W9=M7QWs23EPo*GR8iV-Q>91O`Aq^Bd&Y!R9fPjcGV%lJN|8;*^alE`T^?e?%PZ z=cD6drW@0w49dORm{aNCFgKfp0OqK21YsWCyT|JwSdhW05XE@-=PJZ-u&NMV5aB{_ z7PT^FhGS^B5V?p`h4`rx7cRu2=yB(BPHzqhkhuccynxi6DvOs!hN`j(c(=;!XO6~j zZaWaCa=YD$3+Hw)dffR%@DcXV%&kstzjEcqx208XuQ?i3ZrYSP;Abkb!HU=3q9QYP z;9B4?RI*#^>*6bADB!Oe>}urM`FR=+Uy1QbnkNr+vHS)^I0o=XEGHP3(gzXD-usnH z6FYGXTHVpi{8uS{iVP1cB!B*pKq>OfpT8#1N}liB0}L}hqT(j0fk~%ezG-M2M+5Wa zXC54$`SK?HnJ(XP3T{Qb^tBY(teZXA)qciTp-hbDPk6!`UfwqiMxZs%;#ILcs#HD^hgM6%&e0>xcT(a=QO-Khw9Uw6ZG4ShN&hZC8gTpY29J^z5P;fzh*P8<)+ya(30c%BtC1*4_xEQy=tW+`=Vg z^H#bf_`SZ0DtzB>i7POajIr`fzJ)7X0$`dcS`ne7w5)6)zt~s0$dwR*%~CR~Y5p)M zTm~?adChglSCuYsNlzF#dQ?&2l-U=K3*?WUJo}=F7mYR|!=@G%MuuS_i`o4L44pmt z!jVyG!Z9NOE$VDBR;g_x=>t{{K9c#Mh?!2>=5DD=CwUy z@`X8c`N%ZRV0B^3{i}s2)vV1^g`183`9tw^&L4EmwReTpwj8Z$pyg<#JX%Y$f>^mN#3{8c#8GFIz7(>yr8w$rDNfnh zyrDxnqc}mhVxy#!)9b`BEuLOmh@z1#MA63LqAAgO2UA6fx-fqP{s&}7CUL@N2PPKI z=sz%fP^5s<q8iR(59z#2#$I$rk(*rH5iyEc%g`*}+#2DA)8b^h=yNe2N`??Nr zHG~Rq*Rhsxd7BDwyNU{!QZ#w=i0~O+r*gHu3UIfAmQZcLiVl@sg}bUr_;4{N21ZXF zQ8aGiMNP{(YV?JZXW&IR=lX8+MNN6R1{^o4X);%Elq*36}ILjJZ`Sjkyae%I7Vc z?IIU0nZMNFhnGX&`4$<5LC0c#&D;6TmqalPQM`|sv#^REtXfjK7#Z+u;kYH>oq{oc zQR#w8V-7w-b(s#BQ(D88MWF^X679 z!z-rzK)GWIt5(wCIr35}<_E{i7aA+dal>Y;SY#|TF2xMp{Dt}03quLrWt_ik>EhWd zN*67kR~Z>Uf7!fdwN*K<0~ zG##bI7uzeAqtcgG5qLAj2#PvIu2@uBHGk={#j~%Pw`?h!*omO_g-aHO+mQiH3c!E} zLsd{!>9VRy<)(|5FKU`TN(ts8lgjcY*_JM^DxZxd23fWy5tZ{6%~!XB;_{(Lr~Xk5 zbYSlA;Y#C*rOPgx%@#(LsDKKCUy)}etTe7FH?CTQ23~9^S3o7rt}vD^Tc|5Z5st&m zEuROEXT6mzoIhVxB(<)Xw`|T*bO81l>RiTqa}xNP9v<%ek37>DF$_;nO6Qf%S!kI3 zKwdZ?D|?vXO^6+VS%03^nCg>cw)G_AmCN=8=oMEY0s@gY+Sa@l^Bp+4{-)Tq{-Se6aebusJh8to+iKK-QqF!Tl<)tX#HqX;r`F zmCO1qTrzjj^0ImTkh1Thg-e#N?8{WMl*6~6_PyP^kMFtu-JdYuvMcfME2?GxiVCr8mZ*f|E?UG>P-Rv*3yt9dpD~0(=>Cg9 zJUeEfB0@vc@~VZ4bPykf+v+K!wI4HM?1U6gA}TQ)y4f`Cb_sE#yw>~Ic+yQf-fQhJ z3+xW-K^54xcfH-V2IOA5Ey#FpT(0$xYu4GO*Lv98>$P47-PUXU%{Xn_pV*0~?6wn_ z&U#?YIy=d0ePnp{o93r>g0%?3_pUkZwT>7CUTfzX9Nr;y_nHC<9yiu`tviq?!E629 zK#-MCV5e9~2)#jv)>9$~=?-4&Q%H2Ff!50?)M+oMazzz5RQtFpJ8do0R4_bcot-wu z?l8_y8*gL6T!%3ryw;6t3arndDaAX%?vih(6pn|K3PzCiC1TRn*eUz+3z;CL#_j-_ ziFOx+S*;4}&Zr%TtypJwRJT7uP&_4>B9eDB zIPuMRn6MYkYCXUv|JyZtJuyvO=sUPj`vj}?Y3mBOM?Ab{vK{}Got$smW9;OMcx)5* zh@D($$3I@MT&R{FShg5BnGJ7t_5Z(UJfceGj;*zumc6uVy$*QH{b3))<#(3csn)U?ukZCqzAUP zmK4}$2kiDw*sW1Z`N$y=4PsRl*zI7zc<^YTHdg#zbPm=Ulvs&-5xjyOaUE(qU?*N@ zpKVowzsNotJ>srwR3ClUgsHy(jVfz|wOy3pIo2`+*CO~VbYnPaZxkSjrnH-6w<)yS zRojV$cK0!M>I7I>04q_<@v0EE*IIBKgYR8uownP2Vf)6}No>~ztRSy-Gu)sPMi?aG_}A8Zt+$}ywA~(q zUn_6iZtHru4C2>X>+J4`_hUR_S=)l{3hZHB1tI{Cgh?H0B>Y<2&-enXdi7~K&P`U_ zaTIygx(Ls?#WL*9~(TINnp1Vt0o3TUTK;*l5Sc)!Ut~v*SNgfu2lsjrHT~6u9+MUhCCW%88$}3L>iZ zd05dl!AgL0KL#saMNaYP*PuDn|C#w<&@sK&+ikD$bZXKn4La$iak)%;8fhWiB(2wa zbX9>?vKORMd6+p^U2zK82gTLd z?Z(-?KDFDewMR@ww^&&~?6AS^W+h;-I(Fr0)&dJQ7z03o-3{gq1~^AV{t73>EX1#~d89{Kzg7--8g1*UQ?x8<28R6Ef<5ufWxe%R&uKduF8exi9fUTMb}0KRB{_-KSpbi>rBlwx0ABT#K+9;CpSYZ)`N+^H;_l*M&sNeQQp$@9u}i zZR4)6Zh)EbUQc>5vjW9xK%U=tPOrCfKDFCkOZ|IRue+8;dG=ECdskBPU0!Iey%K(> zst+Bt=U(fZm1!6djvM+~6*qFC~bw&W#R($RVlXGIKY)>@>9 zx6ar|rx=i^S>@WvaG8%`Fe>VwHm*r{=7t=GpSMj!-M_NHdJ{HWi&1dpI*c&Z(b#oh z?m}H5$@MV>VA!~D*Y{%Ct8PP#62ll#yK=8*75tkQ(h(cq&2_dINBme9&(}gP0v{*wKa={$1R}_1^F2hh zX}-U4zVOws(KLn_M?}6FXc|M+IuI%W^7R;P)bx1rI(?SGx0u3wKjSecz0x<>C=h-> zgz$|`<8CKE#Sb#BZjyeWkg#)b67p`@f zh4Q#J%fJLd*Ji1&^M(T~qf3|pW$9Vzp)kwn5u!<0Sct^ES!zMlaEN8}4KtuDJ^wQl zW*K}+5Z)}bpL?^g(wlp;LSNw4p_Vbw9S!}F^))CWesBaoB!V9r!SjJec(aVAOZHk= zR?odz%5%dZmRe=Q&5tp@llEmOpLxuK-#Ht3pZEjA$Oj_gpLDqZIB*S06k@$2K-$SihL=}8KlZ+O4kPJ3H zZ%BrJOw_D;(0IUD(b5#@Cz z`cQ`Pte>vM&FKTIt?rm6jC4e`Ir;R#n2P}FOBDS< zBJ^@Bran%LYNq#GgfZQ8J&B6x)#m8UlzJ$_GbGAQ)l*ixI*sVapt0q=pRai{(K_z^Icl%Un%^JMCji`g#IH$=>Jx*Q;gA<#-gJrd86*8qFK&&hX#ej?t9;3>^&hwBAm zC)78w1N@wr3cn$CM!ASx&<;dgJfsoNf*q^AogODV{e|enO(g{~}_1YKN)h#9@M$ z3f?aGo*>^|;8pa&K8w7tPcucSZ ze8ZCkdBHh?HwZp1ctX&I&rm)~aJ*o-;CjJd3O*xvMDR<&WcVia^cBn(oGW;Z;BA7> z3jTxG4{z?H4|(8+qXc`xXUVS;d{pqSg5L@DM<1lz1i^B_>jZZS{!K6eeUtJ(5u7D> zmEf&{a4W-efxd3=jNrK+JP_s?o(r*NfbiXkd3b@8i1>lT;jl;eB0<%k5I;xwr9@ml z-XQ!fg0;kIFuV%35^N{fS@3K@t|>wJa|Qbg4iP+G@It|Hf)fR&3SKN&D!4#!v0$a( zm4a&o*9+btxK;4yf_DnuBlv)z8V_Oj6T<&i@L9nZ1^+1cy5O6F?+7*uejxaX;Fp5m z394}y`Nebm1-21vFW5z}n_w@&zJdb;`EEilN$m=W0^ZJT-gWxSh3_g6jo#9Ui z@_LK>%YuIuJSxbSJsAI`poiyM@T~;-+6Q?)Ya#X*%oUt0I74ubAYTEe{8fV232qY% z3O+2jSMWu_HwBLhzAyNtU<}Xq(BD?@EWvXHxh4za)pY}KvhcG7uNJ&k@J7Mg1n(34 zwcviiKMKAj_@3a`g1jDNzFgyl*hg@H;CX_#5i_v5kMNHWahv{_@cV>+R`^$hKP3F$ zg?~r*_l5sR_^*ZkPWVJ#{~*6kMC8*)aG+qW;Ap{%1g8s@2rd-l+B2R!!&ohN3o!#P zBMR;nJS6y`U@Wh%P%nK2^8}|0t`^)y?2Y;mejgEbKP&tz!XFa;@4~+${QJUxB>dOH zbA21;AIIxE=u0Gm?xuJD6}A1?eD;R}SHCj3m{=L>(S@GFGBO88C0-iC3X z;B$iS2!2KEgPqr(urHnnds_+LN%%D3dkKH8@PmaPF8pZW#|d8~e6jFzg zitv8n(}m9#K1X;i0Yv#x!WR+GHH-?u>xr4TULit%EfMnf2>+-G0p9+6Qc#HP~$WPrjWa2)LJg(! zMQ(w_R|ToR`Xy6|%aFC}K<{y=ag5&Bk1{EZU6i-_~Z?xc^?ZsDMaYc z7AzDj7rcWAxqAhFE%=<^%Yttbq33hKw!H5J-&=415qbs_Q9olPe6HXc!Ji8TiICq( zg!~f{{+i%Nf-$@=Mm{NmLj*4p{Hfp)!5YEsf^~ww7yPT>yMo^eCi4Cn`E(Z?Dp(|V zsUVkRpxh?GpkSTg?*)$tekIsi?#Is(%o6;G;6x(ofg7&_a5MMFKg^YQ~RojA1$!V(2rhVcjON=fSSu6dQTy`s-`j( z%kaWW_|=TiWZ=m66r_sf%>t$Q2kdZ*HFIotq^^F}n(D}>wN=!uEtCu2vEaR|H zvustAyOkC!FI`sV&KB?6$Xsdq0ABntvMR4!tZ>;VR4Oa~OxCh=MK4(qRJ`g99`T z;1LH%_ID)vD>kGQ`Sj1~j|CpoTO6~OFS!D>J$r6N#q5e@*-BI$d4Bj8w*ff+;8Yaa zDz;&+56(f(hSQeXDsUw2MCIt<&=G3XwhTg%a)}`+eSJiB354QZ;rUnLo(FtBcG^RI zcgY6kiK!C-S#owS&Rgvk|U1B?zXQ4`i3Hm z@;D`j^mPXfeIffQkQwcx3^&KVvp~D`?Qq%0aHqWcb$LVeyb}627sJ^ceNRV}cbCgP zJW2@Zb9@mWnU|iW4hs5U&y{X7Bq@|gCq2va_MX1($`h% z3)Np8j9@;L;pW)aIYOUtb+~l7;QYB&Z&L-y@~KF(cnHb>u;kaL$e3HmZ1l#d;^ zFd==@w7!siWvDpXM;UI8zR3~#hPv#-twc!QuTWQR`xZf;dk&1F?_tQf?aO!R!%u%9 zeVeqtkbU2xv(Y}vaC7us7oo4%r4K*(h4g(JVP6ayf2Go-501XCBJ`C*UnhvL{<>hN z9PM~D!oF3|$8gGUbM(Cwp|9FyAE&`M`aS{euD=@SJ3&RVIr{z!yu1FkKp%%i+Q+$! zj=lq+p)XW_i&|^@D8tRsw;!}y-+q^U-9(P%;wois`?xS#I>MdJ(Z}Ce-1-i=^!0!+ z<*4sZT3^V%9bzA4xHj?h={($`busBb5Bw|znAD{}@bm%boqw|%FeZ$H|I_18<} zs1Mz`N&Us(ewg8u;pW)40<>FS-8JF<+gs$A?jwwMv~K`*Zi&!0O_S=#IPN2%mCnMyFT9CUbLT*tDa$O?qt7$=wD?q!; zaR=n8okF584p|u?mxj(At-SpG%B?R4a(+jNOW$n~a>c30*Qq=p+l|{u`W^8?}oq=mg z1pLpu89oHr$(!MQLALm2xF`H(xPC93cDgsmj~K@HEu05Op~o}4!*)NuhfDR&mU~Cs=*t#HEuUH zH`+$<==W#Ne1Ko18gObzhz$gf?lJCcOiJ2(%Oa%ba#iaQ(k2kvZqy86yW>SKBX=^0NQLFkAp*{tFWq(?o!kJf6yP>@g^ zNN6}SdtyV9vH4gY?9}$azN9-F@eMUhxd@s&4sG_Fx?x`&F$^7ribDQ5Ufxy+z8dn2O-hD%1t*p#rwB z97Yo4l2|TR-9abIQ=OO4z%regII#h~o4`6Qlrq3(GvF#ixZVQ|pGg@SP=+m`GPJ8c zHL>r>MQqQtwT(ty@TgNyan-f&;g`?Ga@epP_OUG%AwM7Nx3+}K>D19Y+ENibicfA?-xyN~51aw^JUXF9|*eKU4V!w6EYaoSNvrvoQm0OkYHMNIOq&Kp#tp zt%je}-PxE}fi~X~Y>0tfX(f;iLN+hhkb-*jQnx>Nw9A%1YCnP<=Rj`;eHC#rh;z#9 zr*BG{B;@Oa!^cy*h|-wmyX52DS|P2st3#h@q@TcObo&6|xFU;A01$-#B2wI(ZxoWoMIE9h5qP4;2h8gL z`!yL(I~@UPbEoCiD!vIx&}pZI(@taBZWz$xqAdN1(2;sZQ=X0^w?N ztEM16T6@rRL=_`~O^gu918zx9IMrJeo%`LA`+rFCX}2UFGPS64k6Ut2Gs#>e%*T$l zXYI1KqisKj+#FMLKvN3Ye`W+hh%KLi)LRtEQ*KFCUsK6lVC%5|V1*_@ z02NALUQs?qi%=s^MNJ}~Lpx zL_di`X(N<^I z604M0k)sJ+4gzX(7r;poEp9sk;YV9c5<%=3*a>pGr;BAFA!@ zt`Z${7IM+wZB>??E#F1;wMBjSo$sP{3#Zemy1NQaOL~Mpnv0rC4}COOeQXzNEa{sc z9HA7xVK`mH8HVYU9xD^anEp7}AL0;adcOgf{V8O|wxc)nzYlb52FU@vNbC*XAl@pPow!sOs0yE zMq`r}pOQ2g@H4 z%(EHW*0VK9)kb$#K{EY)9V5HZ#&#TUxtZy{6pj|{hawJF@<#hc9A;uqnMaOED#%@p zLkDZ?A>%p_9sM|T;!7mAfPiDN^yMH@)dwk3)h7^A)%S5y)hEl0&Od|1jY>j&9-;I7 z;CCsWU(s<=OoGuy=WQ{1CJ{r)GwrExTBFNa6vlJZWJ%I)M5LD33I2fMCn26v47~}Ve&oRR*P$yA z`XEAi_GM_5l3jr#T0KL@1yr2+aEX#F5AjN>i_w{duU4V_iV}09-hUwU4UyfNrag## zM|lv=$KCD)6Z1vdIj~dtiP0UDdfnQ*gngksD}beJ&(Hg+j=*=4*%8|F<)C>a4uD{1 zXwS!)szc!0an~WBBUNB|KtLiek{SF3tewH=@ z1u?8KIQDoKA&H*Z>8}FsL#Sttk^WcEEQ4oWO!_|@x;)P4s$Nw4o9Yl$p?d{cqYGW! zbG_~?DvrLYE1^pd#s#Ct4QJeMTyd&Hb(_TCd$pknG?aFF7OKl~mbni59_%Nu8;Ei? zclcLMAaEu28tg&rlyPqyTDd)~0o5S{;D6*v>wmB!qAaR7OF!=WfBRvP(3d@$%n)Nv zvoUvYS?Sy=tOtt~Rm(y%m=<%Uk6M?vvJ^|T@}Sl)4QZmh^No&}`h{HkSz9hnvcdAd`mXd}U1RlMS;_Q&U@_Fu!)I~D z*I7+he8m-#`Xzva;^Hzady4Wpi@?s(i@?s3MPO$wTC`&EELb*c?jp<@oz)*p0cZ7} zX(USyo#_8SQc>dUaZY&J&ScmTh(x(zkO@; z`hd>*tvPC;RxF+wB~Pe$e2pgq%Y-T2YQeBS8c_P{H9w;D&sY^U9;^K!v7NL5i;AsT zXB{=LU@F$4gb{aQ_0=@1!6;A^)|mT47Zm{EV#43PT@zR=!B`dvHzpnt=kn58sR|EV5SCZVrWhxIMDJtW)T(I;7 zELh5A0GUXMt>B!Vx9$p7q!cy&oAI+_3N5%B{hj==bT zMDXh(x;Xzv-R%`X@32Xj&`OYU#_LZ zH6YT?!rDE8WrC}SX~>V*9gnbxc;r$~?1rb*MA$!0@!d>0Y*_k@HiKSKN~!mG7N5U>0S;a@Tw@EBd!I4DdH%551_6GQ=!k0)q*Z86ywdMxmD}}#C;@1hU*4jY)R^jgu z{3Q|PykD@62)V~4{u$w)7yfl31M_F~LuXXz#Ct_p;wY59hlRITw%m#|lmqyjXC7V3pv_f)5G4DEPME z$AaiK%CC^ELJXA(VX{J=gXni^NCod%n7hy4Y1aE=?pop04lxwSKqhUwb*sr9m0< zFTC%?!r)~Wyu8@tRVNkfQulA&{kw0>U1j*;_p_W^^cLQ&YT-38X$y7l9=#NJni7tc z7sc>~maA+u*SU|2oCAmVgVb9_>ir@0=8$@42yY9?TU$T+eo!{N_FvvgF)m{W3vIbQ zFa{ya+0YHt#(qnh=Xq{98bZeyp)Q6{q#Uo2oz0P(jxcn$(3XRanggaZHhS zQ9^U$`P`S`j?Iof{>0+eR|S3O-bx>aEOoucbXQ=fIZiq9z&s7!*&Kb92ypAGfxZlc z(Y{#hj(rz_hKi7VypCi(l;P&+D*)}*x7%eO!ySFyQ1@>8cpd6~VCm@Vig35Sr=f2n z^w2&ITaG@CV{ZGB5JCGW!_Cq6IfUH$M&Vl8sXtuSh4gI_`*{7vjcaDoUS}iC{Q{A5 z!aG9_6RSd-ljgjLauhLNM6w*rpZ3vSUPn4&e1?0tJOm)Qy62#MN!ZmHp={Zl1u|(?&(QX(P1E}5%-J3|WPr@x{_**;$FD^O zuKBXlk$X~J-;)OBB9>vUBIn9-ZeCKXr=i%WX-ul#cY+D(>UODln1z^!$$6%;Ow5a{ zz#L1=>obF#+sL_?TN?9?&5eo1&yVYQgHtiTadV>?pj*ytNWh#yvpU#dCK>JQEp6-L z>NX!^e(<&iPqoo5*7&2E+o;n98t`KrZsCGQ)jU&wcrN0(2#<|2cd@6sRh!X(E|Xwj zt|QYjPe&ixLh0kYOeYNO6bf_Cn?zTMnm4*+DBRJ3@iH~m_y^`LRv%*-DvXcc#Z}(X zm(QHp6H!zpgsWaES$3oYZ(tT=zCJtJ=)Bw zmbuL(;c{WzflZoE%)3s_L1uk$-lk(WbS0cxyYGY}XZSgv7rNjJl%YK5I>#aW)QEj2 z!uju3zA*Ql3C9lAp&WTglQ_8{rlP(9Hf{CQ(HCxS+-PoY43uoY)ni<@#oH>d4MXTJ zRCrrG&lCBYbKeQi^NicF`Iz!0VFHG@i zc>m0q)Ijxi)a6X@Q~AgsA0U z=ekqC7}y?|1Plaf8qLHR4Kcy`hV{n!EkWaYS34j-X@>+?I~+yX<4aH`w1pAT4rs5V zYzNlsd29pdWj%htHlR&tC$^EDbbbB3kYPJ99`m_V0|>7}ew;@gtXN-obfIuZ7WcwxJfUo;y{e1r*=FyeeVIRX#rw6M5A#r`0X^rP zHugk%)&a*uj+2GP4UK--yv~o7^Ax0$u~Z) zM){B`m)OGk!nmD4eN69+fqBR~)XvfuQ14B~B#aLYl&8JU_+V@aHrxk$(s1tPv#(tE z-yZDs*tyXcjr_hR<9M#j#yK?`z5!%i#vMW%Z`9}1>Ke0}w!vpjbq>zcb;mKHEJ@3U z&ck{8PK13M=VFZiBjLNdN_0JAJUZ$vq0j!TF$Uw12RgPS)i#<*H>9tl-8bQszP7lAH8{i*9fra`z_$F$Y1 zca8!LV^McFC#kX}R&P-6EU|uVKl-mz=V+JnA*bpNHZYF)C-$su^!RVC-|vU5$gi$~ zF*tiK<$jqp{Y zYSkDSlc($Beq(+8{ecbjnEunqy7Z!KPC4jz_~{|xAi_ERQ+FQHv%d70HKT#`n;jFb zU!Je>rOjcNxy^NLb+8(KgtXMPyAJO=!A9yd(4OiYHPjDn2(VqUgAI>EM#l#lcumDN zU5C0maG@SE`HoggX(Q8BA>9^9$7`#N?P?qOjvMoG_YEhXa>$p9{2w4+58#+Q#Rcea^{+ z5E2p~ga8NS61gPdjuJ6IKnNfKf}#c!AVIJJ(j+J#YD7>(QBYK@SnyJ%mR3|+tzu1E z+fr*=+M@Ed+J;+2r7cpmw6*nno;7Qqv(L!^?fZMb|M&j>^UL1PteG`y)~s1Gd-loR zvm-u=br$8*c5b`IK);B8^154Y$AY)-hJz;!??!R{bklb{y8T${4*2GdjmNh7;hWW7 z-@MfNX0`fewfZJ-clE|&x0+iczKOYILuCWz7Wmc^^hxo@g<>Q6B-@l!Z~ZYTV?!(Z zIuy43&Fl3Oh%?=7?-TI*C(3V)_#wxbt26x&zoEqVA#F>$w&EVp9oq+WEixDV^{U3N zK%Cc4@j3VxeVI1gU5A0TZDY*&;t8W4|g5e4>o04`suz5 z_=L8JIy!MWaxIalZk82)FW+&*^>yB(x_z6DI$WMa`61+=#=M@$e{s(xqh80U{7tc7|* z2G(a1cHgqL`MUY0VZI56CrukWzN&QQxQoO2n^!-t zv9Y$sa634F+40kF%=z%}vB!Tu=H=;s8?)`on!g-;&41_V%t>Ec`|riyxZ=;_o|-nU zOZ9^XuF87g?UHG?K6d@bmsc!bJmctB%%l6$-+1WXgHJqj{zKI_Px{sU5BF(b++#~d z#@3Ga_Id4vPhTHY(b%=VC1cg&xA*CK-&Iq7Y`Wic$u$E`Kj! zzr5wc?|~p zS27Y|GJ=(rutwXJvj~=JPP{BulZV5;&&gOm4ro~dD7R6ZC3v;8lEq0Zm%Loq3cfSE zOFK%kW>f$wZIsX|(S%MxUC=^;tzkCHwn}Q7#olev|=^jgpHmAY!kPo8WOzyOVJp(gh>)@qaurBOV&(+t>MaO4Od2M;FB&A zyfs*R%p%ybk@xQK;vdUah<0r{iYg7mVY`~K5*+Blh{F2U8;!@1kb$ww(-Ij4f;421cR5)arYoAZ&4;w-@xJr#8>l9tYh&w3RJ z6kuCQ8989I6k|nFteg`N@6%v{wE)|xZ5rzeqfb*5=P<^J*3z>Hwsae#yQSgXJ}GWZ z1p=ZZxb1N{@nR!eY~{6a&nQ;~m9bnER#J3;kpn+!e)uK0XV;m>V6xmbmDkWUdy7IE=cu3!W2t2ktcGO`axg638r*~+*9|CO@AmEql|YLV z5pm^|YPs4hH<%SGIh~FGVV>V6H_x~v$ zly=3PL4VeY{cu`Mq+UxwAqlQ^w}2`a<=c!acHS2it(QH{Td z7?=0+TKAvwi95S3Na)*?cpL|7CZ5KD%MpR*hHtZYjg7_|+bwMSl*QA)D89|e8M<;S z_#Ve`28V7%merz-Nsl6nk2xmr^=j0|w-Kx=j6IG6jb!?+`}Lv2Da4ArA*?AQa>H zyhYs%UdU`2`R%Q@EsnDUcfKZ(h67e6P;!EcJsW6cMOv6>yCQBlG&u{q{sjFwa1HNn zLxJeNMM1mYP{`eHD9P?@lpNi5C?(*VoYk%!w-3VqKk^|p5ATJv!(r0wZbA~+Z^?b-=`>?Ky&KdD|XkTb8Mye zjq6Gk&W%c$oE3(NdwaKy>f7p!U7Y&6n>P(`cWoM&s!bi_ zZm(3p>hB$w!^#UIQi7ME>Y`z?7t~-HNI8a3cW$~gG`?}ceqGr(Y{;TpIt3?#ZMe5N z7jV~KBW6UL}U~We;sYh{6PW=Su6w@v(8;I=z@PR_E zS*~qQs0m!2-VV4P$$_~hy$tc+GJaKBI#)g1=Os`zHN6UP8YwWpJpD^<`htq|o85Tr zob=6z|B3vID$}_^Qaa;{tBrFnBEym3EN)LobE?w${wy_h<{PP>yiRQ(eV~?eu)j^( zkC2%38gt&jDVGwi=s*b4;$r<06S$HIfwWU#$)LKKl$Du;)J$q@(#YJAu`mwb+~48< z-EelB7dcDe4E`~EV87E;kPRd+`W?=l@Gztam~ zMab>86OlSZ^6Z93-S~3jTA{g-Ql9KEbDc}`$-`{D8OuqbV(jLP(i5=U6 zAC!0Y`K0q+lstM&kN23oBbuB^<7bXXS(C=$*8>YL<9x@%z)m+kx-j{6Pja+e&jREH zKd~+%lENqTLmQp&wf{OWSZ6zSKAU)=;!-Xveqf>@`o;q(k-`d5mZ{S4#?I?PIO zm=8gU!(2~M-6laQmm{(Dn{M=;fi@i*P?>J*))Jw)cb4leR3 zU0&1uVlX>zMY>1&FO#G>cMh`r4>IoSEe(5+4eKpN`wCmp`v!7+g)QiPGoufYxyv1l zKKv`Rp^LO>yQFe??f)uy`^b3sL*FisFzHby>9Fs|Nw?W&NAyv|eRG@PUs>#rI~lnY zkp~#L4UtC?$zOnK82lf!&sq<8%RryE3a6~gK&@kB5F(op=?`ap2sq#c6n=t{e<1P< zA_Mp0)B-7kxTws>G2mM$#2-bBDe%o|25@*>E7n^H%TuEkO{Gn_2Ocep;n0o4<88^~ z@L(#fFSFDR8guSnI7|H$75tNtAlO4#`ehA3B$JV=5#fR`s|yt9$H^ZMih|an@Bvu#9#~?Culyl_8BYStP#p5Qns4rx(Ln!5-!L8hBYpJa zVZIsSz9W6&fFAaH$$n9U{UVqBB3KaVGB}1mhwk$q_Y98X(ZTUvba1>U!beb-3b>4K z?sqACk_Z`j7X*GxIg@<6u8n*J^gl^Y_Hniw`A=4e4hKy!BS$9brK-%w8b*E@jh9)g zO!7zFk9--Z(?sP_dqK+xoGSH=+6jKSN?l_4{|oda)=@6?jrs`mRMOKW|9lyzxA_V= z26@r)SNS?+<>ECE8H-a8k+FCaB9XCJPCkr9eppOA@em^7iJkB;nRp_W>Hz0uy zIN&8j=#nxX`7e|~t068M$AEtz%X*_3bQ}rQI7W5Cs&NJtt`~))m)8Q{rF+0YU$S0A z_v9t_Q%RM559I=CFK#pC0_x78*MpZAzI^dGZz@N9rKHYO2PQ95Ij~uqb!#{ExTe~< znU~z?41v3Ip>3W!Z*bR6jxsxMa60s?Zq}i>Sw%SA!^q`0eU*_lI6Z}9z&CLE0V6-g z={q>OeG5Iufeev}E@UE`J?opx4~}R31!eff@!S=N(Cjjog{=Ts67K-M4#PNK%alv` z1#g4!-!0DN8!euEw|Mes@#4G1t450l-z^({QPOmZY6P(_}G4L=>%_w>y&BN)44feNSHY{#$O*N+3FZMYN zPMT#vFJ#bA)J?lSKNuSwg2bB9c% zUVzsOjQ@GHiL~)~Y2)Z(oACiSizhPvl8;}Hvo`szwMiM%U-YFwKRf!cPDncmuB4A~ z3XDZ|vQJjXa;Y@P#g7B#B33^YnZEOVGS@W2@vs`^T=Q#@Jn}NIi8j9$ZARVzS~U8# zj~bQuH>ZhGZ;4W)zJ+X2<_%G1l!Ggkblw3GH);Ur%Q^B6`j(*mqb>%0CFwV%qsPkB z@h9J_$h(j|`ZgjfaQOe~Yd^#{NBVX?%1GZjoA2~X=iY!6>D*@!iF7V657N14ZnSf| z!B063+|GRqMWl1N!-13@aXOnVX z&&4MWcz8L~>}LNbnESHP#w0K58KQBt7<)Yco&l1JoA-kdu$PwtpxpXK?mpGeSt^bbp)5`GI z4AH9Czo0Yx?`p7%F)qZ&$5oCug7whKe~~{pB!IHp<&LnBOD~RW|0I7fYg&db!TKS> zCD?gfew`;vug?&ZrPo`C$kJ;gBC_;a3GT?!YbS+q>9qx^a=~jsL@s#85s?dC2Ht#- z3!bxipHEhx7a&Ehc-J8kx#Asw=7UZ{APQoYiY&R}O{hT48EiD`+LJlNciBp$n0%(U zFzv^khWM^r0xIh*6p~EXfb-!&W=}<1yJ4=EN$?anI8MxkTr>sHrRWvopW@nyYp97n zSwhL6D*{J0Ii~r8W6DLuD992Kg}iEVY(vzXFe+H_a2X>pxUg1^MU+J<( zd!>ZwRbW34H}JABPDdoJSN;f5(ktIXM0({WM5I?{gFDhI)fC2FsYj~x$~Hu#S6)R# zdgTNnvAxn6?UY{O!%>l5;k-JCcQ4W_w<9asEBxiZnC)k;TpI0_6|Dcqow9a1s0NdtY5b5D6uvjOd6Y+t2VW^2PtallttNDLF|3bGV zQ5V?B^hM~?XTUDWxg9ZDd!sVBr{L<2b2H~w{)l03Delx%(!9fcTxi}!aR#>cuAHqo zJM+JeZt4uVKf|=zicH>w*;@v^-R0P`$tR?Y&eD))R{?2|CX;fjD1&XvW%a~=5ymBR zam05Ds5wiss+}I1`MkyS=D+Hp#@U(CmU9kIU6 z84)3}CWS}ECDUqkk{q?_3J=Zv^&Xm5-x8%w_Yer@PX7Ls`BQj|T~n4K;+xBfGV7P{ z!Fi0FMnneXdGJLJ$^p|6S;vVh`s1U|6EC;!&r4nJ<4bg1b96iyN-4mx0h^iBB6hp|oP^tg30HRhLY^WPtC@DXu5L-CI{PnF;qJ~*b?3Y?3v zmHN^JwQeEo8eiLR?Yug(uu99A`bf-GC9;8!yJfp~1GP4r!@0Y#Q!VTRKfku7sjjig zP5r`Kwo9dP`@WxT*Lk~ZUR2eHRT^pyw{D+TQ?r;xKwD{*<&CvfOPA3SG@fkz&Iq$) z^Y*4?P4ntpOT=uCA76#Hi3=NQYa_IW5xdJTTLQ~AEWO$+Ti#T^yon%U7cQt<)>vz* zCQq-LIC<)X1f{QQSlm=wC4IaQZvmS6c}mujP3z0pvBkG(G1o-+KRT&aHuUL3}X4{Tbx$=90t9%k{w7 zc)faXt?+rYS2ouYXOo@d(K(E`*ys*_X*vw*wOZab;t}vSm$$%NrXC^+O7U^BR^6!cL>hR}5mQ%K3|%8nKKiIQDs5j6#Rnk^F=vY@a2XPsrXL9_wY4_ zAK>e7oyvlPLsNq1g=^0q`Fz2`RHp=5ym{jq=P7&_f)Rd_;sbsR;y!*Y;u+tI!OkC} zbXl-(SunHAc^w=n&K`VdqEqNLeD9)bS+Mh7REW&bOCjeQ{I0}*A(twE{mC0yy>kdD zT_*;Ex8kcAH$EQm_79c8QASJ&cAA6^Mk_+M<5MAM6>9i3 zT9r8=m^VGxd99k@mj9j!p7#5K;nb|Qp8Gs9Iw#6_1sS=CGG0T*2z;ZY6FR8Oc^0-n zV}Ij^0ls+yeC;hiPG5)h((%<0|C(SJZORDU5*(}87nl;76zuD~b|W}{hnB*CPx%m6 z=XeIK?kg?_CUIU{2^2d<n9mc&w%k|@@SXx#?zaKhf$c9I!fY`&7pCiS2 z4%`^X`$g^DtK%n#Ut8H9sO%@ejn00@LGj06H~2S&Ji7W6BS5jopJ`ouaAy<9jF5B0 zS%dGxpdd5x^_i_mhJqh}E0}yyFy&>8!Ksw{-`4&k(f&?o&u_~_XXWn(e8K$G!m|RKv_)UXu_)jIF9qt_0ZJ0Gf;*}ZLjnE4QrgA`qu#YC7nbw1RAh5nEmm0gXx$H zFe9wvT)^-1MCO7aA!h^Ug8y>e8gaUHXSjHP2Ec5FPwfQDg4t-k%xS?9&chf)+0J2( zp*NvY5WJG*JbFW!^Lu}p^DWeZ2`}n#;DpEFY7%%cw8nV>%|kDK2*SDBHuVr@98QRr z1l!>=JQ#+U{_(}5cDNR>g6HsMo;A*%>(y8IWgrYQ^ynJrx$7bK7Z8DqIoo}9xp$D2>F?5mH7()*;^J3(mZ{Cf`ztCUgx=q_e`4BgGV4Z1{s_oV(?LB9~Gp~$QO-4wCoFcXA+{LR^hB-0DD{_hD% z=bJadU+iX^3(d2jTO)LqxfgWwcl9oj-@18k<}+i>Ajo6fr9TBfe{Suj`7eX+g*fjC z$^R$N*k{iGgnkSW-lMoQKfB40kHcpsnBLmfQ9_S5qnU}oGJZ(P(0u%h0Q?ip$QZiR zoTu`*#`c+UI7h>O{_QRPiy|5v`>1my;q$+>g`L(s!4b9OEtLn?&d-$z3 zT%05{3q8!7Q2rL-FESr$KAC8bU&h&EZX7*a<-7d+549UuewNB-8tE^`(dBXd!;Sjf zK>o{I0!X@hocw)p{FCD3@tZepV0j*SwVE={V*kFdH`6Qa{{r)_!vDcYSKA!~h@6v& zuM_9$x8bVv`A4MlaT2CaA}+B18_X-Ub9MCuJBJe`xb^n4WcN97>G}3IpS<~Y-lSff z)ALYYIT3U<5$)jrE!&hoPx(;)BIVmjtg-v^<)OZVq@iaku#H~*t-rJW67r!ws>u3R z5Fz(YBI*yYy}%kG`hTUxJ%ISlfkZw1W94&;HDtqOY!8j0b8+qud@M^n3xx`u75z zT$~tOc|)S|rXo47%x+0VTumBs))FCi8*vi;C#`e~k#-`2?>G^9iG8705$y%NN{A>w zRqa<#gkD^uP%rksgT=yXqO0F{2t(*U)c(sEZvdJw=)8G&(2Q8C?O&+=HD8|=t<Xp!DYM18x7SKBot`)?m; zClB)+u@CG=?1g7Ci07akn*O$8E0E=mlI{sRD}6%oB-4B2nFFOylg6^?Q(|{?Y6uvH zUl1Wbnb-%v^#dt4gEZu3E6ukqNaraXCVei(KM`{I4jIcy7-ymXaP_wuJC9O+39^V1 zTs|zXU{*Y`3121lv-2qNTBUa?{!no){K}8{_7=sjEB;dPV@3HkA%yZ zyoXq5%nubmQyiUS)4!tFqPRTSrteaGNAa{`j})6fUGWyhJ&MN^@iw&7Tc&uk;wy^( zR_xl&@(m+mzMZRhtK!p&uPOeOhnDjwj!V0B!8fT#h!{65aF+1QrxWgJ4GkM<_}QhTl?g{L2;|% ztBNNSv+B0#mg0&6n7}@Q#`4d zn{CTornpgYm*P(p4=eWSWcep4E>OHv@!N{OA!0m#syL{#rDrL^jg9|8`#(khMO+($ z1|r+|$Ks6*rOzRbfxjp{j5yNX^OC<*)2Aq6sy2L%@(UT<4MII*Yhdk=I|+G7kdZRQg@T_MGqfV%{MZW9I-Oj9f$nKfj&E^ox|{ zyVj&HQTlSF=PJ$jtXXcQ;#$SKi70ok(qC2jQKi4B_#6@S%X|#{k1Aif1~taBIN%=F_qU1&|$?Q z#mPjJuTiX5yk7BEMY-;PkIxX2|4GGX6<=2Tk>VeS{f+rE5qkbjk?RK1?THwlye}qw zt|ITBNnfZa*EP_yNJHKn#d(^)RB1fUAo)8KpCb;y3ot~Kmv2G?4=DYP;vW_NqIg=- zmt@PO6QO4prNfHnDGpH_uQ*llaw6)#O0hxlcEtx3pHuv~B7X;Dxl@Y#-OxV}_8|_! z)9Xaof286BMQ$wZFTgrf>4l0-iZ?56RNSignBvpKLSw$G^pA+J*H4vxLutM$$@-5e z{hrbvEB$w+gDJLr3K9IBlw`f{af6~9bG|E$t{S(iZX zJC%M=^B+x>vM=4HHtWjL0 zxJmH|#UCghRQ!Nggz-y6Jx)7|X^MQ~lj%Ja2N1!3F>x@yRHf+)l&(`;Nrb+#&H~=6 z^mawQI?4R!6@RF>pE$&rKM+yxamBwY;u!-;@1X0i9Csb2>BAMrC{ES<`HBsSHxW_) zeTrXEd{Xf_#a9$%-3R`+ls=;PiDDMldC2dk>pfW)f*wp7?HI24W0jtubcJHIrq?K4 zuXK~r%}TFTdXv&yl-{BEBylM2+Z10VqW(7(|Dbq6^FLPPceKgZQL&q1eFJ4s(4cIQ^h2%W5L%^vAbfv;!wpgijx&*E6!J3s<=w= zR>gZ2w<+#a{I=rv6n{n>Zp<4>A0om&$CUn9F~IdR^vxh5KU?YEM9de(iW4;d62*Cn z*C;kBu2#IAi1PO+{gC40ir-XxMRA|v8${^+Tg4-q{-M$-T)#tZ4iWn1D?M0gz9`4^ zNkquGM)3wszk`VKk16ib^cR)>wW8cFK+aLk|C=Hg(v+W~*iljLCm=Up>A{K@D2`X0 zt$3BAMwMH2+=29Nuq0uU?7;M93YgSgh$&m9A2HiPFtV z-$g`yPbfaE=`Rx@@5hR7EApi{rYGzDOCQBzMQ)+b{KbmRiklR7DDGBlQG8SJkBa|N z%u%+QSSH9o;2QP0W%b{6>}8x6y-h;d;^s(Qk45bq|1FFuvF70Daw5!(#w^uP^?yz z`$pt1Qo2r&zYkL{xsL=kE4@~6lj0V|t%`Dg3I3f*?^4{YxJU5?#l4FAh<)*Urs95L zKfB>R@gV7Z``#C^mGpU-*A$Nv``dTIh$l(IUq4bjO&o~d859lg69?gU9Yy}$%=L7d zVg?a@oUNEcEYka6V3_n^j4#D};t=$YqTC-3wg0c+b$b-kVV7dX65DP2c|9o8#-ClT!zKQ7VVD`1CK%@_ZK9mGG8Fa8NT7}^DN zfCxKeD4k7&9g3AMAws!1N>>tLhkB)(h_J&JrMD8%e(7h(Zy^mkNPmGoK^pCUn22`2 zLPUG{|6jKAP9oZOfQWYS|C;RA>HrY!SV@Hb_Yk4?H;B*|kC};{a^DI4M)N)odObjd zKC_d6&|`5b5cQjahT6J5Ed*bMu;-8WzuA4h?PV ztb+{oJ8uh@)#KHbFJ`d#*LJ>GDf^O+twOxjRV>;Q%2HJYTQ2xg)q+J| zs^VAI{sXn*-xVrYx~!?T;NnYW4-%1WI&C4ms&Ua5t^n`&@lB?)xk==8r}_rGA{2e= z37*;JJ-x^q0jp{omMvaYYZl6jW?xVpedFqE$|#F#X?JvJvcC7`$(7d~qpyI8XzQ(b zrK8sBW$A?t^Ok5r+*IX?i*{@L+jD2rI3e%n)}UiE`g+&ds%Xn>e2Noex~OgxI^LVDR~-_q+l*4Iae=ISn4k z)RCCBQKDe*2vR)P6xir+ozM%0Ge=H?hcSv%O~H_%A{pm-1#%iP#FaEeB$1>p1t7t0 zs;cB2zpCX+uUotnZx`3sqsIqJ9?qzGuv@^Au%*3@K*r#L!HLTkvE&dr50*36cV9H{ zw`44PBBB0zV;YhpB$sXyxE5p_OB@MYJ9-0_MmB&co-gd?0bM@ctKjF)XsE*dF{n#% zP#^MbD5;j#7{YS6(yty!svY=$8dv zSHH`wyoi2Np$F?B4}&X@|5NhH%c+j~Unk{bxnIZW$7h6gP+<+OykEr0%dfW2q0oL^ zaJc$C8K)ng31U6uVQ}R=7AJ2-byUBu%ExjY;`IAeYnh_-kB$G@~5tLLLTJ9{)G#l{aZ#)GmFMkLCE`c&~nZXCaJqH@Nct5NGE(kjL`W zFCT}i-*>FMi2Zh|e&k_rxW$ji z`?{4E(XUnYBM*Zs?`v`LnmzLH6G24YA5p-o-*L!mp&$*eJpOOptKTNbD*+Gf$M%qq z_QdPrlo!#D+s-oGZL=$n&kB0w?f2-1pC}^oR>#{9!kVeD23H=R8S~0(g}hDRp?+Kg zkdJyas62F^gd+U*k*0BiE3c#Fi?pK{d@S#-CtSYtxO(g7+uyNRFCM*#)cXYDR2yzB zp%n7?e}6Z)@*YKkw;k&tkJlQ?;~NxiJFZ0>@*?`xXITB*w=7(F4RP|0*F?wBXpcPn z3>2f^3dk!(nj2hs_!%iiztfP%-|eU$9#M+u2eZWJw^#Ke4}&X@Hu1JMqc*DFMaoCJ zkH(3-^bLkrA#aL}%9(jQdgDZXOm7mn{i0hJ6WlnTRC@M)k9)=vz!I^$F@-2tIGU$&0b>!~%@*g{S5@W zvMF=@IM@$m-Qec&*(jJx4puTvq>&Es#fV6FG^;Ze9qaQU`FQ8&)a{gmfvFWbTJ5F+08o?MAU6r_$b zagdMwc6YqIY3Mi19d2;zx+7lRD%cN9l*fA!SKcc4i$@((j~~@H!G4s3t`WWrAa;^i zP_V2p?1myY0<>{^9x-f~O{M<2LvJbFcMrnN$*DAA_VPRnr~Ji zH(<6OLu*@md{%f!a&g+ddv|luq(Se&V~&i#V<)C$$DthG_G5vJ9pJgU_1~X;_5t$- z^Hr<_>A23No`zg6|A}(eQ+^~^zWrU6!{)Ft`OF)D^w$%l;}P)Gy$RBDk-jTII@Y$S z+v3tUW!UiP(=82rX;f0yx5o_L8T9>at7uq{EA!~a>x zJO-qFPvSU=;~u#9P4o~?7n3!hF!_w5bOY*Zb5(CoD7|P8F#lD z-{yDOKlCLA_7B={#AGzXhRw&4ak%}*yo?gtcP3*~C-fa=x*5D3$<1hf8QYF-k$%X5 zjRF~)k2x7*QRj>!nC3PF!gn9`W#03y@8p_Ru4||x*Wf&Q>%n%g|KYmt6QPqJd|MFN zn!e>2^OLo{AnG$2TaKk<{OZ`v@FO?R%Ghxz4eiM&dHFc#_aOsq+}UjCgJJkwhg8^P z=8?}jOb6Pw81`M!J!s3UBc_G_sjkfW`)8k}rkPoXke3rEy7!ny#~eYPQB z?mp}c-t?|>vbnVs^6PN8ZR1?UV-615Bw+3l-RT>w=YKj4)tKGQYny%H9Y><=-Q9e0 z?4b9W?_yiak9>Cb^drsn>ks?NZU4coa+Ba|CvQf(OE?a990{1Ucr-sFtC5BsaZ2j4L#Z*HwbovU%UZ7xQf$2J@o3rFf;fA$6Ird*Ci(ztJWpZN#l z^3T=$&YC|bE+6-KQa)YtE93IvkdjY7qWt*$cA9VM(Ff+zBd?%uQ!?H-<_E8$is_ziqCm%cIl zIgUyk0ketz@xB**wtbSuvFYZYDV_NcWyiA4wWbK;)y#^~Q~Zy<+(KWjJR*9w-hDW2 z@K@o>ceQeimf)biJo5FJ3Z#B!k{wh3X&lAHN5y_&>NPV)FR@?vo?}jU9Q2xL^(unT z^}6?6|H)gJ$M3AKsq3$$^fd~ces2!5#Lyy@l)>HjIeD;uhc-A`UT=)Ii% z(+>N7H|=oI3|yPOg?Rzv`Lm}v2VN@IQ9QYLEIY9A82UWb-;6o57p@me#}2HWOl*Ka(WylEr0H`sBAe(f88 zIjAUF50*!%kcp3vU>thtKZUW2@%+B8Zo?5=jNVU0J^1|&W5rVzX^z&L?3P7ZHgxlK zvt!=nkLbqsXFrTKmmdn@SF)V_8~wiDZS)Cl8Y*pD9@PtncRCyT654G@P6= z=)Fm>Z~11}_9oc21h&12wyijlvI%Ph^Wd>k*k%ITq}Q>FK zem>+kmmR`9*x%I;bJii+aVXluv>@6O3Ts<65A#ZHpnM~4?`^)=U-SAPk9DHHW69O~ zkFl;~@Qr}YlUzBtmL{3?ttsJO9gEJLmmcA~NnVq&|Cq1((!(bF2G$Vgw3>{TV@VnN z-}QyxI7&Jxqvc(nX+Df=MP&YT^$xoAL+_OEeq3Lox(Co7CD6nA7HpJZ?GK;uO@jST z-eGNDtk!;IZDuoVk!Wt?9FkmwISSWkUb`VPGAHs{$o|<|js7X8J!c;YRkL62mws`_ zE_6-xm9V|I24WqPTz?<>=&~$nLk4)m5969KVWC%0dU+_{YMv4*5yXTWYJN?^C`sYiVEv<-ZFyR4m# z1WIVbEypvG%Tg%1M_W!L>SQVoI{d^f7|G-l>Xm9xu%meV(hmTqQ@*{tO9~7a_C@V4#XdQoqZHGZ#q#mTh z-cr{efCp$~gjd!&&Ej+audiEZU$WT`Gw*P`>vQUc>sZ2c+!eM-pH@2DM7J)M&5^nP zF?K}OZIA)n`xw9tj{&A(zF5Nk9+OeRwSc|v%|;y8O`#d5qhYL=JjCJf@;g}=@m`20 z;V5dhYl>vVOAseA9ljvtT)CLLKR0j>QkN+M5zO0!;}WePoUo~clQ`_>h#4#Lk-Y*j z30_Im0Fnq{9G~|IW2v%K%2ZSX_Sz_+1;?3-rwL;@Av?mz7;hW!rQ;?*vyH9?Y_ZX8 zfSoqF8(?dj`6{COZ7R+ZyiKwaXHen_96mFHK&e!3#&*W;v>61}VKW%pfdeH7tkGsL zwg(3?2&~^`Ft*QT5DrE%5Ru^3D~uGFIv+65MhTS?t)Pli&)iKp!Zm|n3(Srdn2kgU zZ7Z9}$|`Wc!US9P(rDRBr65k;ve{CgoREiuO)cNf*eIJpNpozJK%th0v1%M>C7}j~ z&0uU14rCDOBN>b}*$l$!NCsogI8cJH9)}ghnC-oC!j?z|V_R{c1Yuhw0}%<{Cgvao zjD#=_E1I!l9LSghsI*bS|F10@Itao7yTT5%wQZ~}+TKtw{@ zmds>J%5h)@Ak4wRGBc$m^)`dBB9g(_TAM-G6v<$0o6R7&Et$EUu{}0}(1OF(!Px6K zP&tA6+YH8z+6;o*l9}5Z|Esj(vh?8434{@p+Fq!wtvwlQ#o;pvFPD=fYbN1wiC!8l(8dHg z;Hbu7ZN(Uwede+p=vOK_UWNn-ZcE59O0wE?&pu=wz=1|e5uDsoOm4;DH$@3Y292V& z$wQP)wO8taHUnn~t~?SMI8cT_RbY@x!0R@OvjlH}BBa1S38fOPh!$wm7x~I%Z9~R7 z9F}5?eu&yv1J>K!g~O`C zm~BisViMe%*v=9hXYiCf$towX4(P*nP`xv#mTj{LwwaghMD$ZhZQ~|L)vNGKsz}io zgV7phM$5KwOO~A^1!fUg2$KQ9YBy^qqPE^Sh)Hl8&E_!CT8A-PTt*R#+YCzBivzYf z2smw{I7{#fV^jU+hGA}GQfw{tF#P+>4@c-|YGs)6o zacTOl9ovc8|3Aa%%k=e0&k8!}8C|-iXZmL2-+=yM#z~)?by3#~+Kq1K&%y0*Uo#oE zyn)UDC!MLdjm`2o>FwHCBGg_=kQjwLyoyZzliA@d0<>ut46=BR1=?3D?l?6=HST~ ze;3P4*;yXO!JzS=n?Hw55BBRy$(>q@HY z24whiHjjh3atmM@HmYCOViAI^qF6XDK^<2A?o`88OU52nH0AcR6>2TvsN~66R(3B< zg1&CjInktxx`tuBbFob^6_O_O9u`wqACT5SlG`^`Sy_3%?r7lbE_2#l9=r@<^0Sav z45OS!qtI&oqcyQ1tZRVu9)27d81WYVQZfZUVF$#E0}#xonB42}!;)$jtA75HIT8o9 zvzFgRoMI4xi*fo8#r#(U32DATp?@N&8HcaPgn~%h%=pkih)-}FXM99*h+l`5IJT@v zT8Bhu15VgI87E(08{*$b)IT}p5TXJ9nA9#HO=>@!eW@dul{x`uC$$3SKxz%n!PIMU z4yCTgIVtrkI47s>!Z`)Vq(JgPruqDiUmG&ZHpHLnCRAzy-#e71)@nkDn^30-6>h?{ zn!v|yrO1sop&g&cT!;#t+igNx1BmuFQU&8&N4N_d!9e;wfaIhOfkSBE6Nm=}B+)XQ zVC=$R?)D^z`BpD<6aH}ZMq%IFrWzqRE;ojDelJXA zNa#nV-?KmLd*kk;id zh}1Ds4}WN4hZ&NS@%B{Lni<8Zmg$B9rzy2(hf+h!uYVIf!cAmvpiUlg%o@>tuJe~@!r)QZXD^E{%0Ciej_q?E~bNKH}>x-0lC zib@$05tTA5Dk^1oR8-1{Jd;ZmQa|ao4yNgL2-?W+81_DF?#Fbc={}mR^Rvh*q#sTf zck0Z&ZHJOB_w|M6c6kXkH-o3kTZn970f_8J#N_f{Y{9F z82JMt^=@P}BOfDWy&GYRdbWc{QML&`MP*jdwX8zn?^B^Qk|4t({9i~2)=2_qn{JGm zFuf|&D5;zYG_^f?B&AYPv%p|Gl{Nb2UdTqY^E0pWSoF6vqMe^}V&_w!KY^0S{{}Sc zOkerb(%g%>=O!f9KuXVVBO-0vkBGGG14N{4bQ;!V!u_E{@On`~6sAZ!rjq#7w{x6K zrCiqz0Ok}9pVsocLa=|M@A2HMn*k(&H{*3;Z0Pov#2b-MYYbEB9NKZe8GKw|4$BXlZecZSn1B{TxW``87mVF!Fsw zHo1|VjNoAc)8a-BGU7*7)W!7b4|z$BjFYJOyNSlVEJ%BYCTSFO4vfc1wu)OEB&7MPLbM)D z=bvvvk0H*>fxk8oddiJ2N;XMcCrJ<3DXxw^aIfuw74UEAfqQKa>;Zi-EQb7Mlx;6^r-wZ%!7yw)&|N$n5dte$ZcpYe}CWkUW+2eImWjO`yw3-|xSW`7eRKjPwK2 zpMAMMn)9rmKehGas))gP#E%cnY);-T>!Ti=vgx^;CO0Qz#>VHuO^?gay!DY((<2XR z?h|^3|2pAa39eVL24_d>6x*X0s^^lMQdX!$(}OD|&d5?jw(0R(l*&^YHOoZZ+s%iB z@IF-DZmM)1HySfZZ{VE&OQeRm@qW9B(JZk#7t6l6t5MW>$y)sc;$p^^>`3kiJ8+LU z>!rRn!Db6_6H@A$3)NG4spT%-;cB&-_=UlluG$@#P-+1mfIs&S~+O z{ivV6#fc>=JvO2xIg+~KqwUvyUQHqa^2Exe znz|Vl#~qXY4{$Db|2i)j-G3b-*}fUK2+X`2(38Rjl2t6pHHdHSy|m;hYe~M{A(lL4 zEx81=`0FXxUjwVz@{g_M_yD$8?jvitPe6;MJ`r|lVI3-A+t@;U0zF`Dv^tV%Tevlj z-V>qSQnc1SNu7ZexRt2wn1f{B+^5)%RJk|loCz0_cBDGI!1duhzbKj}`F*NEOBc6y zI6XoWQf;SDh2^07^V06TFKyKc<$bZ!xiZVXFWz>p%&_l^YgjWI)Zm-j zLiM^@^{z+tGEH=KWTM^$S{ydl5r=&Tv^Z?8BNKJkG@Z!1+5Fc)OEukW{-dC!oARVN zaB$oD9uB9KKC_W6t?wz-+j*kMVIRmm5k|!6?F6%Zb7hw3M;D?woB>WI60IZ6p(CAl z3bN=*My8SqL};VUpg*8Zg?3%tP94nS>TIotm-am%bY$uP7x&{k5#_Shqn5t8`)R!q z)_U#1CY?J%I=A!pKsVDXM~HQLj>*sqcLgGH;pT>Jb&%7u84>ia>3KgQlx)J>>@)Zk znPVcW6%+1-)X*c68d;v0@K~fK*-La}Wn#kI<}>*v;f*XxOn5a?Q*M;h$a=)K2vws+ zcoM}p^JOvA`6yZ-{xDzs!OQkHvR&iAh^BLU*j?DJX~Wiz?Qd|J$u`1eYp`rdyme0+ zfGdW$gWOCG;GH~vHc1+X(9{Jg8UD^s3medTlUteF!jYVYV8u<)$%$Mpt-*f-p z{z>`h?m%otRg;nLdq-MhKOSDU4BOmDM$`;q1@OBm4U6k*m(<`h^|2qPZ(KBQaGMl7 z1=cog_=q-Xcs{I68Xgw2X^qS4>z6e&VXvE-#n`V1TODB|8*C;qcIM2nmsic2e8q&S zip$FinJeoqKA*f6?F_DkAo8>4ubO;;YG_R@FVDB7kPGlB0@@X}6}4eAy*Mn{X<2J_6a zCGcSE0CshxB{6w&X>;3%oS10@^n#etD@7MKiM>6A>~?P61Q~zc8r85K9^LUQn&M?& z2-|yU=^Q)Q+9bCTR3+TpA}YopO!XE{V8b>WqoKh}i?T2gLU0!b*moG72s$I#0?zXsoUX5AC(_+(v?eVxB z-~Xjm*x2*2zLSlejIR*U@k0uV&d0yrlEx9}%9xflJ=f^o+ZFclg&iYXdR7Tn4APjKFL? z+@uynO4F0?^5Mf6%yR>m$&!u_5_!vW*_`Jx0l6$LP0zW@x88r7b8BE-5S#6I`MIq2 z%H0Awkz6j9y?iG;eC|>nNm^g{F5d?K?aunZZTL3(x}>$qlhR*Ejx71f$7OnHI{5C0 z;VVtYy@pr6f#40ZfQJ3Rxb~E$SI63$OMS1sz4~$apRnGd*m~JsuO95v&!Zb~qa83m zL=AZ3`=9CU2_RUdZ^8wI*DY)KQsJU`4NI0SUAe5Wiq2j5?yg-&U%35`_kZ`;i}xOT z`JO*M@>t=Jq9OPjTvVu&L*e433+k5F)K)5uh5vtBRNdnF4f7gSo=L>AMbN9U=1YZ3 z=QS<9wzhC+!H|OC1tSU@S2i{*Th>&#ys^R6rV#BIgzX5IuNcHqmGc*4g?a|f{sXam z*&Y`*d$lQ8MAPAB$HfH(zah-4tK)3bh*bRiZ!bue194n@T<+nK#KATexqw(QvKU<6 zw75=rn`#y>Lo|R+3pgf-+Hk}CEuSwKOwGdg(r~m*bP(J8nD`*MQsoY}=He@1?kmyO7Zd8Qnwpu(W(F z{=zlEbZ4UdjCW6b5gniNc0RyI)A7aY=lu9OHNGu>0~CIV-!uOaV~;WR4rAYB>^F?< z#J9floLnm_KQw01qb0{;izu-8h)_* z@2ks@;QShbyH7!^j9J5840dy7;*;ml@k!`7Jmmb1ItKHR-@eSb9bX;?+iiFdWVo{e z9b=PkjwTOrs-cigelVIm%Bd|24zS5vqRB&@Ys!LsZSvib~wcQd+QqAxP~V~Kv7(Vrm->pH(=%h%#_3(kh7HEP%n$K*d6$6dBh3JoWJ5*=+N!kQsfi^KwhVi^D*UxoI9?^hu(pkf>764QkGnjd~Nc|s|=H2p?T_%AXd~qL<$Yi*>LpdhuW2O+mk8%ACAL)W$&m_sX*15ND0FXR!G^yP~a3rIlo1t(2%b~6t918fdv0E=sV|^P#2co1Mh%St$Y#cI45Wv@N)i# zb?J*p5<6p3{0r=y;uOPHZ&{>bZ+?(>Kh$$ z4ussfWpv1nd(2mLcHEz@Gu)Vj9jI&jS?H~$4~ig2$&B)E94DIBsk{07`n6BfrV{TB)_v+PuGwwqYno#C`SIo zT`~F7&7v53rWqGQ&o6mNKmXL8XN=Rp5R1w)wPL^eO5NY;mDUyBP8UpWzpb7 zc3HJ)4#uZ9IHs?cMEU-4bU_?FB#s^yNAuB`XmAX7R*VJ*{qGHq8Sf=g|HX0ilsI~N z96d9RcAxyV$&P0vFvV%pAJ@c{uZyFX#nE4mqxn=oG&truJWm^?`Mbd$_>&t*uf!t+ zZXnG^Cfq=JoW})7PgDOQ4{7e7>ju(|aq^1e%6}Lqe?A>q1Ixc0M|0mkH!y!(9DP$9 zJy`2I0p5<7f9K-g$ZlYHZc^k1(mUhy*{SWJnKI4g=C>|0ko;*no|sJf-pJgdbew!X zK+13sM@Nj0iCQ0j3+sqoGhb7Ct(N@$X07J82;I>f)$**XBi zOA)Lb?BKuHWGerDDSwe!p!&`cdc1j8+r!_$I^vQ05h`z>iYZfjTYK~{J5---QvMwC7p;Gb z(0$DlN>eP`{6Jj)R>s-?4{`llsrI)0dnI18p(Gn9uOzO2-;T?FJ5K)ExcW=u@_!yz z|M@ZX&oz+^FHkq@FN~}I)wud!jg$YE7=NuYlj8LGdtCV~ar)q9UxKyAJo95q%9;B7 zJ+8i$aq{@BWH*riwHSE|%(6Ir`p5BqH%_1I82i+k4_x6u%Fm0l&r@;wJQXKDKQ8}D z)sJE+kL`B&`#Zzs7W!Xcub+8O=^lr`smLN-r?^&;e#-PcimxkjP2%7}%}3>`QHW3D zIYoF>h4cpdY`8Pnu2rhqr%Uu|x<1T32^kOn0xHLBZtp=I*75jKi-edL=o4haCwRPTRW15+N zyL~J(Z@zu2G4EDmb}=3FUSN075?r}s?4vDtTkTW3d5>th#rDyhyxZ(rEbs2Pa=0vW zn&^H@TzZM>F<0fm_&dOo2YNU0YxdC{()&p-F{V}XPZICN33g(B2JsH8t(0cJ^@M%u ztvm2I^U1{E>OH}(b@Qs#AJ89cZyrw4@AK?VF?s83`MfG*(vFR4U-&}~>8s#}MA)~4 zc%}M%rTV?QOuGW*5&BQG{ons$+kV!^u3MfQV;6qcwv3j zz-rVd!EN6pySDBQ{+RU1S})2iLI&Hjf(ZFArO4l{_^Rf=4s0X8Oy>`jt3ZC6dZyS% z*79K2I?B0T{Tq#aoHXj+Pjv0O(%!4Isb{MC$wKv$tJO~ysGroTpVUAYgWLXTmWCeE?W7Ni8C=ymA*;w4#fwE zSeHDa^e!UC#dnncK5>>YKT`TvM2wf;Dg8&ye_!cOh!>(A93Qw&cOgR0o&zC=m zGZnwAc#Gm4ihLcDeEhBuaj)Vp6yH=ltoUceB+d)q@2c2KaggHqiW3#*5HTO|zLw>d z5@F86Ke;YpqtS+}5_#AGh_k z+}8Gg!XXtYZK>MUw%+>xerML~v(L#nU|+w_|NiftWM<8pwPwwlHIF@epS@=w@1#JU z(?dLq^AsS@e<3U*EQUP(1^=GlKP5!| zp9|!D2=Vs>^4uQcX#y`Lgnsq2_Dz@-A~1g;~TWm%nq z?sj}o7)pHC3JN*v?%xWE&H7+`oTGY=Lym7?+Sd6utMLT6AmJN6Ykv!v2GtD_&7q?7gbYq zsH*H-Dfm)C*tt&d)r7FGvMc0u5{I216#7BJVzCqGPZEcnj}ZcYl@NAT^#p#BIP9$I z0bJDs%DgZ9mJK@WoJ|NipWo2Vd_G3Jm=H?y_X6U4?nwK#3$E^8VCRE^KSBsQKP&ii zgs|@$f`-tTJ`hfqb@U8e7yQ6sk0XSz1D`*${`{SQ_0H#d4E4o(HL9MI2vI+^ zPC~s>x&ABFhz85^z*!?zt?{kb}sQSF(niVTr>(^Q8aO#Um zR-Ypzl&UGU&1=`<^!SU3iTSigKD~%Z^Do%GRWo}Z{6zy#fx+x`GO^3=W)|6(goeD z{8lmF^fuE+-3-ZPnGawRs$+;ow0R@_qTfH!ycf!R!H=WR7KO=kM_a)Zkk8uHwBrM( z6&>yMZF&If$qJ{h41ql1osNv70qsOfQDy zvRJX0Z|M^1m6$8J)LvhkIp1U4UfaC`m5jHKr~%@toeH!Zme$_8%Mcrk7U`DRkp zJ-JBdd%277MXja2oV$ocqdfd*NHJq<<(IduZ)mSwo!?%wqOsl?YHI0XS}d9~xz744 z$Al`xegG+hI5v@kHZ}!p99q2+3*(ZaLr1eJ4fJG!4~wMzHNLWy+Yu;+bu~qo0HdmtMlwWCUQ zPd=+UYFg_qVz-1N$bzVvI;$2RTQ%2e4rv*KCbs}bO+uk+3CZudK*j|G76#n7mN2&_ zf8x~)C#bMcg$U~MCr(w#2~82LI8mk#w&YE?(m`i3Taf!xx96+xlOtip*1p@<3#3r%K?!syLvf`Gij{KCYt z3Yfo0g%c4%5fv7yumCqrAI^O$-Li0-=eSJ`_}#6qgYuSEIXs3^aopM|S0vB?+!`vk z4I%Tm`LZ-gg@*4gV7TpbTsEHT;P%kM&-6+k@)56shdk#@aNK69bfdG8_fe#~<>f#g z%cVTro~ma&%vyYyo@roR7z%x?XT0?Ad9bYSFhhb*^#@4D=VCUxX>YI%-+r$s;V&>4B$gUv1P zeV2ah4o1Hth`aUUvxjU75@+On1~^DgxqKFZBCLLKe2)Wnmzz-;Z8x@`Dfdo13vibk zfV`t3i@=n7JNVr4av-k^bhaCRUpMk@(efPqUKRbwLucgi8H8J2ol8H~+sG>flUqOT z7R={G#u<5e;B(7shrBUhqJ9J6jl2vk&(ZHmba>j2Jak50AWq&RF8u}xAM@qGyY)LF z@{p{Yk#{99w|<8qkNK(JV0fb+$CSH$pA&iHp)>MWrd!^#F8%m?&&cB*qHg_;LLT31 zHO|N@2A^BrG03Y16ZIPkZ{%H}3PVR zcb|j22PsILk;kpH-SRd;-Wc#uzftf;zgM(8N567R=q!gkbVlAwaq^yU=|{On-ZA8N z+piM%CM8J+M&41RyY+k4rQcYWynoX29Q{rJr+(z2Gx9zeC+`iHe&d9X`L4o*=+^Hf z@|~j~aYo)~@VWIn2YIG_^TBKCo1x`7`W=IvSPpsUjJ!acyj=XwVftTz@G)Ppp0Awt zJq~$^#z#)vd{qQ_tC64WJHaJyvdF_UrQ9G?DnsG~M!)xw4!bz@$OTS)D2vYUy@z!C zJMIyb%lU`pPJ%af;V#*3JC8#qJ`Xp}$opwrzke3;D!@c}Q{aufFUO4|{^m^m$U|r3 zeKAg+kI%zFr@X6$kNFA^xb-^-dF&^~8F_rCz+K;L$YXxW!y|P^Kfjje*zcI=M;39 z*}}(sS0aO3KW<8sXr3GiKDT~vK;9VSXaAe)lIPL#9Q}5Se&nGu`u#b6e4x?H_?Rbr z)NgNG|Jx6FfjN>stvvce%N)aTjr9- zdrG6C{H4f?+Ci}Yjnx0b;(POvmf7SNmO5Noc-Ee z^6FjkZbV0+e&)Jg2YDgj#+iQleHm}2U-6w8uGft-e6PigqfIDxDwx=>R>K=R&(rgy z$!>K)UKPA?)QN6(+&uX#L1^126h2^e=H|6r(QIm%w^n)1X zUM$2;^{$MRNB;?dhHnNI5S%ZJGkkYTe=+F?%|b&G$VV53erVekjp3aG@ZpsJ#~Hp? zpo@u<_&WFox$I24(7gmcm)ch2D%_VLBkS7%Pd?5!&&0_)hs6!wA2iOC^>m!PI9l#(6&c>D2=t+E>M*KxYKuaa{AF}80^eHGncDu_%H0f@4p6G6OdapZb=60qZ zF^zjmnD-%^HyZd{*!`Pi+%I3sp1mIbx=XlloYyilw~+HR{47Sq8T%5_qgyMdZ7c|Y z>3>*8C_Ym!@+BG{A>jj1?rswiXv$@uagPu3ab7dd@ZmKXXD%h}7<>qxbPf~hr~6;g z|MoxF!Z_1T#Q(bf2Ydc+|Fb@P|C{s|^}h)dr^*a?@%gWKp=woU{+q|%pVbvv8tRJt z`GXJ6l6vIGkxtyfM}~ed-d+ltJG~cQS>9Xgj`<^Y&=avBW5Uttkw2g78`*PBTBP*S zSxD>b@xcc|ou{&ocJ^R}5PAO0?8x`7pC3sp-g?H`{o)x_X6N=!D^8Y?Lz(fi+%lA0 zmz?tp^4>apV&17I#~$ig7T$Nt6FT&!6}rFY$PA> zUr)f=-&2V)?3VO!4sd)q7xuS|4lk|VhsS`O;SKF+kz3c#i!g4tl$Md<)%*AL)RpcCR{*BA_`>7%KiZQ5{*>x_!qoZcyR68jjs;48KlCpNQUC4X z%Fv_Wx59(6_Vuv7{tD;^oyV@ri0oQlqV)Gc|FWz{mHrz#DL*A#1gPp;d~cXK2iN%` z1smo#`j>~b{#gZD|EUF!ivGKm{&q*7$gIuKNAw@l`KZ$0*QNE>x4Do)BL`VW#A(A=ozPF9)4grJ z$i{V1yT$5-@}SGG4OZmYjc5zRi%}MJVjHHkq@sQIDm(blUudfp9iGV0b-JCyeYdM} z{owOgY*n@>V|zoN;htOy{USeDpGddeN;lf==bJMk-M68h zh{x)6ucOxw*ISV(ZOLs$J$7xjBLC42`}fjmtI~=3{1WxMr9-!8tgY^G^zm=Zj6^n~ zU-Z&vkE73fZE2BTZ_@oMwhi~HHlz;!*=j|a*Q2kx^(kQc-5pLT7=iw?CG0KO9=^NW z7a2RREaEHJ7OsSSGtu{JC+`S*i${n1v~+d*pvR2a-pC&pEQm1fFCG#0S8NGaXKo9# z|69em=sP>ZTUPdq+_tJLl7f1At3!~zJA8UhXLuaOx379sI0bqPuStnKx^`BCajQBP zx@-y8FWnwypYxLkI%KT&MtasRh%oM}9;y0eq-clg|6cMyhmu<}BVVtZ6Jgw6O?~z# zeWvY)KIDN8Pc>&mezvBhmp(?9>NUQ|*H)q&N0+TimvW2~qf1L;dgP_1xxI8TdVI4f zHS(#|GhBMytMr(P{%7>~<0?<&v0LZ6^w^{9V)WQi?T!4pZeA}vj1K;_c4T*5u}g=& zVcNs!aCLRx$m+DuKqs)h! z`$fjqqHPfOR)@R21zW$Rvz8=;V?9@=Ak0^3i(qJLu#Ak0-P{9Iw;;jTw=QX7t}U zojB*DR7Z8%T-Pu1>t>Ya=(I)Y#OtJ6uYX_bk8H1pJoMv8J+4CqtmjVXcW>B(@#lpu z3$9CzJbC@B2;&~mJt6etzB@5?I=eYWy#>3%Va#>o?!;J!oLbl@MakLK&GBo2hhxVJ zU9uPd}`#ju#L49 z^*8-$EBf~0Rk|H>s@aBH!v`&_$*McUf$A+iy4`RsK)WhC!)}vS^ox9CEyfGtA>?73 zKGDKFyTaMXL)#l$S{CA{)7Mt?jr{0Vj3LBxktYJ(yRddZ`-QWRryP1?*MsgARt%A%kJu~0Q6ZO z@97%c)qPXezx8wt?CQReZ~$}yeF@^9&Ft*11fRQ{0P^7J2<}Nf-V^enE{H#G{YSS4 zFx~o(9xq@9Xg-1D@gx3q@T36t15YYo7I*>z$WcrpZ%r!V4P z22Up7rQqoYsQQ|@zq@aHuW?b0d%ZXIV|>BxeLMA-;Mkz8`s_dSChuACRJLas#%2IE zr0v%E{7738nP5$i@c!%18GR$q2WCgI5Z{xY7WrPk`S=7EW7+G8l%~##1Q5^SI6@w) zVqXs)d48mCOBd#YX!{gbl%6WC-ih(EM8?k&HTDKsyHBwV{UKd;U+Cr|F1irPefBSu zp04?!n)AawdVV-&Y4_6hOV!w6y-)uCu-@)EA9dFm_w|javsK*Hz1u$2lf`@W&aTLy zt{tcP9^o9M=hxL}tHuL|diw0YFYLj1vO9O5O0||oN;uD89>SPQt3ZA`YxgOfsu*T} zU>mregGm2as`^JR+ z|IMsw_Caef%S%NcVA;jhvrZMa>_We}QTok|O2;(eNeO8_=1G@4?miP3uqT`jT9%m? zFz4gv5WL=18F}f057Jtse3oTw@xlim42FC?k5qI;FejeHn1RlfxR$Y>^LnLiGgZaK zw$e9IzTN1$cJaGNej`~1e;#edhdPb$)8LEX>5e=-xHA-*S28JtFK60ABSzMJB!q)% z+S=;tEPk>9@OO7Le{YF3D{B9~BG=+jr z+ScB&ZvBRhxBr#Gr_Y#KQabB~ve|Rymd~5Npkm>o#g$8LylLspwqGYb=Y7@}eQ$O4Ie6~98Fyy9-0{_; zzxnc$g|B?#RKxmFHT&&~gVVmh;K&ajx_w5u%==2rmsA(Z_zE|3qSXpniH?Q z|AQaZ+<)5I{HNKC-&xgt&A+#Q{^0l5|L1T2xh7}aq3Mqvy6KniK7Li?+e;45{&D`W z)Gy!8bBa)`a_sw9>k(l3v3%A$cEuq@LEvU&-v=YXY872Va2Q_aVeCCkAn3vc$YX5| z5gvuNt%U^7VuG_R^CCk`0S8s)g#^!mi&7UR)C89~YC^DIMQ>!D<2s5^Ik)PAkb?3F zbcQ9-3<*`i@4v{fh(KqkjAp1rqH?ALAF!qHKCA!zcO9Zp+Tp#}we}Emz2J}-qn3&U zsGN~P<5$4j)=kl}@E(qKhHD&9%~e65mAjc4o`8o@jsj>)@CQrfOkN^c@Uf<&hzH?y zBSwpMe(!Q;AEdG?LoQWOWyqsCO2DF%H=N6?I=eC}&0<@X#yZTt=zrTCMu9WN|6AKV z8?w;u1j{fBB^iMkiiK@e*7vwF}GJAcot;cS$gH9m@Ihd+np+!unSWYXhER45>5cRqc0*jqcZfe zL;;dp6p3#XDQBudQX{-J5@YA!6WWEuPI%3_A2E*Oq^z_+g0|a$WKHT-Wfq`Gz0{=k zBzdfYUZyrQua#BYi-Rx)aA%1CHIvUb8Ju;72& zcF0imsUYA^9|>%i4boJ2WfDfX0>%jl)c_lG6p6|ibB_Z?vdUukfY`md!ZL7n!E5U? zR$%fWuAC9t4vfSEZP*3Uad<7|4aCmFCv3xGAV38Edv*0LA$hIMS-lixJ{FN6UsPnT z%WX7QLJ}28I6{m__t3KY+aoiBes5;hrI%;+x0hUskym7SGiL`sl75ZfgQ>=A+p~kP z!Z2%ga0>2^{G$-Dtdv}EU6-DYlvGC3)2~A`Fc3s*P%0>x#x*b0H;;0(_oMl$zowXMS7$7fvDANA^&ZyO=glo)Jq$n5>W zeks`pL>XoWufHq=HG(*MM`=XH?0$;>k|5-yr)xb2_B9nwp9=mbx}l=5%hT zHpr!$DV@Tx?IVkg3Ljh)Q>V+Jx)O!wlXs&Qod# ziWfu8mGPg5!kvWo`~m@I5qrPw=e>;OorA!~(U_{jg_fW1Wv9G{AYiAaKv*EvGZ=uc zD%zhi+3o&u8|Q7=B1 zfr{|<@+&Fu8VLNEicny>z3>!~Y1hMu`jy%e#ajzvf5fb27CWE=pB9V5#pT10Mu@iAmF}fu98YF5}k*26h4di1F(NS>CUp0A){) zEAF$rG>S?u)|Ds*ZZE%v>Mk-?SwuB1rLrMV)e@=F534Ax)u%VsQCPrU&fRA1n^}R& zt^}v5!_CZm+1)^YN9rxlqFW619yn?JoM_crgqPE@JnT{C1!K7LPzJ^@(Iad!jM|FeTMa%vrl?|R`^jDq88u}@t=gAzxGj7ZN zjY{PX!uH!VmX$pR!7#>jE$*TvhSFUZOY*CC>;upJR)h0h^EEBs|<$Yo*bMr8T@D8wFPvy#Jq z4na!oFbw~B7K}qbBx>%92aEE&eQnQzw@=m2OVwp52Gek?v!Tb1(coSKNezM-aL4Nd(7` zbp!|NAj)XB`}dy)vKp(ZCArSE*CUw^O;t<2iim1S?kcQWaw{ULCI5^F8}N$3kjy5v z#&Swz8A|+}HYS4QoE~)(??ohPzx7CE)yb~yNg9@VYQ&##Qt?gX`!vKF)o}JW)fv~Q z&NxnW#74Ul%;S_v*D90dsh-ecb5hJxt=_CM=kw$sd$Vn2b7mU`uWqmG2(N86#A$!v!;c%fLeLj@wL9VQ{7+93@Q)ebumQSI!z-5j5xq z*8L^BU;kmqtql4LYD5LI1L>YA&NNSq884)#2sm{$ZGAM_go8ndX)@D74boSx(&iugs%^Xa< z!%1bzAeE|S5i7d{MfllSqgUcA*VQ*m&kqkmJZr}J+BkN;Y49cRjV3WJ?O9j)U&_A> zd7pqk3{UeNgQx1ok=_E&JG3r%n&)R zIoy5OijIcHx+=5391c^juUXNMw{A)ezBrjw#owf=R&=biI-1%VRyEbvg=!%i8@fzi zv}pRxRf}ieQd(7cb46)YRSbJ0_8xO`V9z?M4f|+SwMTi{I@VepAWWQqR7R$fx}v_W zy|JyT*9KgMK#laKdTQ%H3a)M6V6`{5*ECunwAWkEb!C04BT8)w)r@1@H$=rV&9z5i zLsLsfyM-Uxnk?=rh^>_xt;YJ5vHWU7Bexo4ZSH7i*7^+%vCJ_WVJZz8o3V|QJG-uh zlZ2Yow>H%@R*~E6s^{iUlqMU7x!Drz7fFe-|C)=_DVgN9`o@*2rLDR)G*xS@g}s(w z(WTaOYlbxwa|Ac@u{!vZWMlJsYjwk_)oe;O;=20Q70qq+R)hMn@*nlp5PvU|uZG4W zn)It7JNnhoP+NaD#L0n=gM1j?_NGjJj_gbvh^n}mNQjf)jdN1TCP5r0my*oDz4kqx znDk;-`WWFQ;N(-1nM?k=y?cDS{ku|jrtS!A?^BX_g7b>IEKWcnc;h%hm1KsPcaL|s zZdmSlF?mYeU~1^C=H z-~^h)23&Ai`*ET7sjtxRmD-;&`&s}@hqwRsxe>GCc+QIBV`s(j&8wT+s@m$-jBl!G zZ&+79eq#QF{7Lzf$G2^4Yi(|BAK%f|I=-Q)wy~qGemv&IJnRM6u_2GSmaS-LZ%Zb& z_hdWXOt#}?1RAl+1n1X%oW4~qGg^4juO;~BZ-%!D274UI^`f`^<>3Fle02-&dU8w!rDR<-hgY-ad0;$Ug?Tf7;9b;P2++r1H)FAi^DU{Xy@# zIdi?~JZBpxmj@T{DD!^a0XPeLn=a{B)*SEpIrF`@&q0PVf3U*ee>XDE#YyyFza_@n(kG+ipyob+uXUp7oX1}wge0HE`3sP%&toP74Uz`07S%?gq zvkll51`E9#s7DQxL*!AZTefYR{m$&U5`0a?wh&zey-YF~c0)yPpSO`%v2AwX3)(Lz z4O|<=0v&O2;=MctE%a`j^GEN7trdZexn=Wj2wXe2Y#W1lWlmJ#bBR`64X;P3tZQsm$0_rH|l{pUN; z?mxA8i2A4Rd_Jbnp0ag6cK5hnA+1l^f)wxGJGc5XQoO&naTNO=#L+?jXrsRjoaY}5 zwU{`^KM;q_+jIPx+f%%q;OXP-^vuDNO2*Z(?>H%ayT9MpXH%g*RC)Avobx`%KN=^u z&%vSVJ8|OrYUFd0E=fVZBmaUJO%HjfmA4Yb{$J6{oAEp}tLCBfM%g5qJq67&(iWw7 zU)%gP4D&_Qzfa11|7B(VOOO>u)~6u>?c~2|9))?owHeVA@7EO{50ZyLUi4?a=l9R| zX9l_n(gITzn8mPvx!-@(lN;3ke%q6KNz7alM){nJ+->+vqy^KwCpQNUr+A;gD{vSk zd*4Mn1-&Ql-1^n8eia&h9;n}YDbrdQ%YtctyO|1k_d&PbZRS0@`FTzae+1R<{rcwT zQ@myHon8i;pN~;$r&lTP(m!4S^davas_^?wTVquC5>&V>%`s9=is9uFR#XqzC%pD=)wmHd~KyN$CQbK7Z)(;_V5 zAL6~o`#cJp^L)zgZT`!=EzhgcVf}0j!Y^(@@B{Dj+fuxTH$6|yf8^z`d}`D4o?K4) zaqhERoQUK1u6Oe3jN`o4ycj&y+7N?}v~GyOueA91DC+X8p)q)&^?g@)+<|FE3_abN z5`*_sXJAF;4d9PAE_aFby%>3yS>K4khs2ycZCS&tLgeTAM!P)z&ZK^p*Lb1zE#!a1 zvC<@UHWyzZ((V%LS#@#7b2TK`*rADM6EKdYj>2;xZ;%Ub#kHMo3ixd7WDu78T*uki zk?B3bTNFNxtd9HppXGjuBbyPggEVWba>!$-#9SH|J|_CM;pR$&xD%!~GR zJ8#U+4y0e>CIgSR$F*_v>*Melad=4_UKWSXv1-s>#_=9O{}829i0^duC*rS2dy#{9 zo#4D57+_surHVZEu>q)mQ1bJBV}O-z-6Z{i$pfq_t%1_lxRxJajkG$1pR##2xB0=0 z>w2EGeTkH(^IxWZ-T_Ii?FV2t#R?*DT$>Moz17VK@M8D@`1=kZT?stT_C6u{99Q@- zYlY~e@gdeup)(J45;9SRKdoXqApNd5{;$Q^>nkn+xVf*s63r?ud(K)$l#_M8+<74MbJJukjIw>bFg_4$8_~X*hyfFyekxD4Kdx-$O$12 zNI6K~O9(xl6v&5aOjpkE4~z2e2Z4HDkbk&-c$Wivl!KpeDIw&p7W}B-0MYu7P?$A@ z_tSKy{9HM!7IJnYnR1R0LXV?_;AcD2E@uc~mvex$i*iQJ$PX{)G%`{S<@J&?O6oH! zTA$a+553+egkAyk59*ao2)%L%i_m`w%k*!uIXCFDX^0k3*hex_*S0AwS_9fxPi0 zuFmiTe49AhwGiWgutnh00(m`PdVjBmGX(Ay_%8y_5{|%_^JzF)pgM~Z=?@D2jKJ3j z(QfYw#7p=JFBZr%(@Ebc@LvTU7x<Yd)2uIbaqH>?bCc}MVX34DzZ^WI6py9NG|5c6It`w^fzqZZ{}K^*hmm4v`22)tgPdW`}7_ZH$; z;W{PhEdnF^}@+V5a|GU<&&$(k~~(I2lO@dI2HIEfV~C z!DkA-NMH>i^0f+nr@*@fJ|ysQfky~Kmi4^guLwLL@c$7yf8ggh^m5!lj|_pA2plSK zw7>#^*AgP%Vu33OQ6H}32saB<;}iG;g8!4irvyGvI2=Ea2!5OpdhmKnId2Fa7W|yx z=LP4l7VLL@2$64qz{>^Z3RGv-g0AKRz!IjT+*<^$B^-ghsR&W-HbU_268r(d9~S)6 zg7dzB{AxY{|5pTmMd(~7ll}w2eO6gd;8Mc0!cDP2gUE>Wo{Ye~$P_=t&5By&&}O2>t`X-w@a%@K*wVFVNzA1$mi- zBQf3uUMq01z-mJ1xmMstfja~q5U9?s1s{LLCI43lM_Ja(f`6M3<$X`^{}lYEg1;sB zF9rWE!clmgC{^bhDR2TI(yt*z{YxZ$k>DQ{yiVX+f$Id`C2+UEhX^6>h`?_Od_y4j zbLKqz4k7CG0U_$)<-7}gfWV=INFOeEzTguCzfNE&A>_>`g#I@XB44$@27$K=+(iif z{eh86oUkF0evirNC-|bplrlY!tYG5PEMC*eP(kz}*7X z^#^kWZnLR_y-3p_)Zqt};& z=ZWL`^sd172yq>GUm$NZcwO)b`QN4pdWoJxrHm?p585cVh$IEZ@TM=GeU>N!U6afGPnRKceaf~idKazfOzTJSnT z)N_O2n+Q?QCj@_zFeL4O@}46;Ox6X!-yn{9zE22T*$MSj^#-o$ZR!c!)U%TH0KSwE z^;Fk?;GI&xs|nG5<%FnDJt69`fe`vXP6)kUCWOA~`V@lweZYrd9wvldC4NBYbBqvr zoFs&uZ%zS3x!kXrcD2^ludQv_XigCO3l2YY|FD_p9Gn=svu$8&eWNs zUBLN4^242tW?r;NQn0+iaIyAxoyyg#ueoS)F4SLfVi!!nbF6xI2sVNuxf{TBmR0m9 zD*i0ndpk#*YNQU3(uYPx&w|4FPdNMthd^C;wn?lJv*Lg#$X0tA>jll2A6?OsgT#=S6Cug49JOM-H|cV-+@ymDOoxE;hO zcMxGbUxv^K4Bvx@V>#xyW7q2Eg}kOxAMyp@+u$LuWh)?EF+9_a&PHA{(%kZnLtYlr zC=Zt@M_w~Bxb@?;oP5R^d20}H%X`D6Un-c%M?L0fd5(TdC7nEUM&7JAd8b|au^c0> zua@W7xf(QnnWBcMRTb zzZT#n@WvT=&m+NIF4vyS-%l6~-`|~mdiD(c{$N7?-ua6<&A^95E$71@JQ0B2Vb#= z2uHtTXb6@=9y+5RzaDYRD|hLKN1l$nesTI8hdd+0EiXMz-ZIEzxzrDjR2_M5LOHj7 zCqzH;&>7hgFuC=sbLodArXz2emgn^6laO~@Nz#Fl$F-|lUc1YFLtOF-wLHguPh{wN zkcZC5%Zroupi4hl;_7~-$A_ceVaQ9Q-#6pN#}h97hDo`!=cnVw+Xf6Crjv)x=yxbi z-Z7VcBZQCncrS#1N54+UqfL!7@_6s$w%_ZJHwH}Q@K~Zd?a_lcSRMPlk*W0~51on=yw|Oj0}*S_`JCKW?ZlHQ@<;PkMhQ9d5(T(L_hM-8QG)a zKFWIxmBqiK-+9P858OB-?@=(h>zfOCQ^7?2@F>EmFFq)Uv0oSy8p|OM zosqXOPTn$?ez-Mr1=tczc9Q(ZvqcB~5 z?s4?{X`H+#T>9as7DwJ3#NGP60ePG|jbpiVv*6wOJqvkU3($V}3CNKbLfoz2K}^il zk34in9&S%#QpI>7>l3 zhV)*xelB46jDF|i__8s9w-_csBkvJpFmaN%gRjG7C__64K3B4}tQb4`fk^w|Qta4| zbvAhrwf-;^zl#}VU9{t(A9?6LG0d`7xC$^b_-%(P*_t-PvO-wovD{*K)|X{|JWk%9 z@HWw5*qmi zO8XkpQ4TVfGx}{oxnOmgihLhQz;|_AyS)#-CyWsAvmSJl5OLeD5d$WSbk-MDcj|j( zoV+d!$Op|L5qw7U$T)fBbG5RR$FazA*&bg)1XXcd5q?+YcWsno=7TK6$4{IRa=QW- zqT@Pr&Y-w@vT$5{5B6zVX=e}i{}E?U)UR!B-N^4N@XbP%I^sCNO{CK-7maYkD;ktvimP~De{@|LcVx;q=(=Mjl0`K1R5IqkbAt4kJm-x4BvbtxclQV z;30U@na+MoS!-L`@La5>uD(?t4RF!^ICbiW?vH%l3->>(Kf3JsHyll&t}*fbaGo-! z4oo`}(*J+8AC^M558DshTWf0T<%Eih_d|U~PbhTpd6CcM;r_?4VJ;bx!}|h4x~7uxQex0)0ik_&j*{5oI-J9^8d1$NA}bZ{-z-Be;8r4C3}2 z)m`1y*q7DU@=%Z6+11UxTC*xTPgTgitynjl<=)TPSvyWK5BEb(L%xixOYp7v!tUQ= z|JOj)Lp`Y>y|*lR-bNbkSbD7DE|jyo$7gkQpWpK0nM$Z*=942w4tJi%9@lvlS{JO7 z((GdHXS^SKA}@?w3ET^qkJnoQ)%$zA*pv1>(aG#%&9cUT?+ntJMjo@*?8z4HJ6jP+ zZMiQz3OvUX@Q^+Xv}cpha1WgJL=qbA0S4DuyG~`pJ^|{CvfcaRQZ{Ut=4aip=d{@e z7x~VXLnigC;6CWUvmpn4@z%1;`jy=CopY3?9M$32?M9$G~z@LCW3jZX0 zBYYV=@Av7B+_yc(w%0%pw{5XDO$)%bxaU{44M6uC>|;!w+_uFnS6T+rnMNLC+xK0z z#dDXm^I{`659>b$w3A6_BS1Tvgoaz{v?r6$V86i?u+Ko)$=JOUyhgWpyO#+KefI1! ziC4q!SU;W3f*jgE1W5ZA0K$A{ivcqd*nbcvpAs4vkZo}q{y6-z@EmHJ;FrSFu??(H zS9hMp{=F!YfjapL?#EbI9KrqS-~i5%T5_!&2^ADac&3!sTGWkmvifI;jyUH4b?V~T zS>33!ay(DVJ!a7N)cEy5SHD$^x>Q8^VIO$i*7u#V>;rFF=eOWoD1AS|`-VDr>di6h zN1KK`v9_y$Ow-?FTt|FyJio*EepmX-ld$Ejuo-#T{$WYy9?>Unqij6}7eKDzIp*Ra z9qU|&b~uhU$3=TEj`lkAn9*<7De$QBIR*>jcW;XLt_l!^ZuAA4R`J`<^v( zGy2rolSpIV9t4Pfa`rqR`!@Ts53mf7eY+YE&3<+RV4}V~4t=^D4D924mi@l;ljDHw z-#HMn9gr8b^Ps;0e**p}Jl_M~&p7FDYX0GMrkZ`fB7(Z4SuH$!C)!VOFM2nxC4sE_ zPI)lzU%0P6torJhxPDjzxhb3*acv1?JQ|b^Ik|UV)iln@ZrX5HKF-N*n(nJQAFrWqn(nK+RbSmNv}j-5t@`RxN!NXK zxAfKB(pPbwf$FQfrLXRmzRLad*;jX;%EGl3Ym|tUwWBASb26@nrp@`hp%RQCz-)N_ zHh2#B>+mnY=c2Ff1q=Yb2ij@)lkl&?AAvu}IOud-k61_be4Sz~)AKbT9#f~;fOw`o z*qb%|lpoj49Q555sh9n7XLz;5IX3Z&4Cn0r)kv$(()JpV*?G#&x-ZOe>Ju61_^GAH zC1ae4_wNkjYSLrjoIj2iybS=)`fu&wwV)BYat_BeT>ZYp>kVx{$Lm9ZYfXipTAb@X z^+p?DAESk8JaUZ%+hgsf*DhwR;oQi+gx@&Tb)W!i7xM60(Jnd~9*(U#NgIPX3i8jA zm*cQFj`tVfEs(Tq@WS+%v$TEU*E%edb4@ni}rVqy&0e_O+v#@KWW8DXn5A1HYN!T z>%p|FB(xJ~zrDD2V7+&i>v3Ky&GpdK{|(o=kajzPHX%)2SFyG<{f5_r=aSIAjB;K@ zId}&E*DTXN^coqqKij3QU)I@5p|Riby2mv$=aOdudEKi3#IQfhH9DGEUH9Vq8Q0~{ zp(8E>!zRE+cwWmYfY$+*!*h&(PseLrR&m~2raz{mKSIyD+m3$l z^ACPyMX(l&T$hpEoz?kb;KTM&@SX`lcC?Q^88faqj?H?WeG>Bu`c-s1v#*%7uCY1u zuo?Nk$ICg?jccE==nJO*9+f_1WIgMWg?A{Ndyx44%Q<3ylKzWzTH1yr zwC_R(_D8J$&rUUEBhLFj_F3NlvCpzE!<4EIC+f58k3}>#;CX--;MpG^f!_|_2>&iT z9s8$O=E{`6^ISO@b#?c{39h-(tZR*JIsf4r>fCF)?-ieL*&Xk>q#YFdxp|l$eJ!ms z2@TiYG+u{UUVJ|EeRa>63Y(h#O?!XX`|hK#Bl?!Q*QSm4!neaOgQrvLU0!!(y^Fak zjcZ#z%Sb~Xhi-!dE&F@8&TWK_Y3S?h=jPlV)(vx5+EUP%X6R<@LRY=c#e8M-XFoA( z2A=Nr&BuP93&slL8|83{Qe%h3ukn-@EK4=1ow)#-re8hK|Q`V zE+cY$Tsd?;(bJOk>z^MOur>Vn1Uzr)zb(AQE)J(b=N9YNKesHLbB8(R+0daLPe{-A zX`Nx@tB8!m&!=ftMfV7-dwf}VHq~e%>ZQU2P3c7G@ z$5}$f+p$)t>_*#<{dC4hyJ6eGJWtGLop|%Ekaeol%8G28xV8ITj4hT;`(eDQ^N?6B z+I$YaeChV%ygF4b%CTB*Q1aizIc=$(bHV}S^PSjt3g_pYIRe{kpn>3yJZ*IzMn;TR z>&t-Oh4&(kVP~C`bSwz1Kft4nRC+2dLgeoccqKeYDjf&psq_-SW$^e{>HOA-{ObYl zgNMEsazFdCe#Jo5-&H4>I^-($@k$Jg+Wez;^GCg0?rvT1| zM;4XNZ<@%@Z<_cW6aG~?zhPqf0l-g7oN~T|IQ8egl=O6zmCSud_+JOaVOpwAKL^CW z^(zGb1&?;OGEf+GXv^lhlit7*^Uha$~Q z^J~`DTQgNOq~r6!lj87nG_|*G6ebnNHhN2ZsX|xV>ov4*w92{9o{E4P5USqDaIxCX zaB(FFX+mgjT~*W6a65J@69pEy608N_Oi#dB)3~ImpRTIX8s~Rl%d%E$u|h&k8f$ZtmiV$HM@utm z;s~x#m?JorxWv~#CezI3x_V1;)H1HwRq_&_VVs;afP1A8Z;Jr=VK#tLy2wsh0Y zbOU1{#c=~Ut`ZJ@uY)SJS+h;VNm=3>XT;Pu)we2(FYG{5t!zN;Z*bB=w>gQcoWv;O z5?_XhX>Vw6thXvvsN+j~`9iB}ismT6uXqhjt2!FmR@c|5p5-dS&A7xjU9z{d)pyi2 zH*H*NRXDL|TA%wz?Rntsadq}(WUp&R>o%d^wqQd_?4DVo@DTd6Nnkh46UiM-4YzgF z&#nWft~mM*5<;$&-Yi3c%w1cbx1y%4p>}3-6FyBqnfMxL1`|T=lqEy@3GDw7V@SuA3>hgzY~G1vom#q~y}qdqwsAA6&VwS`I#%3TU)w&tQFr&n8Vv#0gS2{Q znZ5J98MaNqP4(?>Q{s?h>#Rw8ZC^{Fs?1h=V5us zSKHVCVobi7Dk(`mHBB)eM$KaE*ow}Cd8)2HWDt?B#t`__;IC+HZin4iyo`TWieyl; z6Ed_ntgXk~w6=wkD}jU@OgQ_9>I-Hrt}vxC?pDEPZ#_NI*k*l0TSrsg%9^IUy83ku zwe{9b4S9=~%tyO5HqL;LDQi>H@1)wXVIQS|~AT8~towCM2qt+v%Qd4(6?UR*Z4&|%Lc`-BNa7v|3c zhm$2;WtlYjVp%3lcCutJ%fzV{D+L@*mcGm~sc^zYN&$y;Ri+nTX=3t!?OHqqsIRSS ztI1mryX2{wmd-3Ob}}^wA3AX?BWoDTDs?8aC!QH~i(}TcC9^kAv)ZMC-5#C8j943FxJ^|cipD=?}tx#(FQ6ISWW&>Emu zZSmP^Hm|QODMPVL46ST#1s%9DD9+Nc+Ujdt3a_5fTBu?$3t~b{)k%{k3lTMw*rW-C z5<}KCPF53}G#Rn0a=l(pz_wGZ6`W67nwuLdCMa1Bu2I97?qbwMIgA=LjD1~ z7&Xd1lWNt~x6Pb^&45c6=Mic%dsTW~eO>*;yjmOrN@{6I=|mTcN39?*C@l^>${NfG z0zJ0SLMO{B#NASvUGMdI)SRS;n4+*#8JcPy($II9i_p;2TnQSx3TcFfrshM?*fU5Y zM8$P;w>GrYudOSbTwpDlT~Ru(B#%*DF;sZ<+L~HqDYVMwO`pl}0ab+@^DFhI{JgYNibNHYvn)?pwbMWh=BYV0r&(F}Hm?X_A~)N{;3x9LrF6Z6n*D^aJ$ zdecZ1GfMTW$9jZnn(9J|DKrrbQ8~U?ITJpN9L1#N=z9pR-SK=(y)SRf$xI<0{qkPOnV0Y1pI%(zX8v+`_JLu z5r~#md^`i_GWgN(eD2A-QvvxL^rP?%lC~D`PWZdwKQ3vX0Q@Zc)9_!EH15;%P56I@ ze_hh}`^%f~{0;FBlJ;MKm*OUE9DFf6%Pj${fWHxbnWR+%axa_v;6Ej4hXA?X(^uhN zf#<#1Yk=MGZ^QoE2-l>*)f-!AxOza2Py}l~VXrz&Y?Y!Be*yzzy*6j!QRA-qtV`4p-p_6<(pj zkP6jpF!%VNh`xZ?@WT+#0c80j0VlwZL_CrEt?>OBFcs3Ex-|fhc`pYX1y9)%C2bnu z4e-2gt(3IofUDto-`XK*cLMH_IFft0hd{%>^%#Pe;aM(q{F$V`1=t5S^h_TCpUm;u z5T66_nGc`u@L5h5m4h1uUjSbQUk%S^N_<9xi;;Tv!sje}rt&1xkHVjXKMx;3zvD9! zJ`>?H5IQ{jQqS%9tb>lvGK}N%1wK#U^8-USG(wYi8sZi3UGUGszY0%R2T$Gh!t>bz zpC$0w0iPA{*#Msf@ZO&;UY5zrz2Y^8=E3QnWNn8}aE>22LyEMJKyxicOt~boR)d&C zR*@p9laW~|eLyZ_uWJIqX@_tQu>#mwvjI`Acc}}rL0~pKd^C9yoZ86TqJXPNrqUU) z#}FqOhG8<@haiznWD`W|z!>`q#1Q~Wb=Y|-9gHM8QxxN@6^>OUU^djq*Goa6+Ry8sCp)Hp}30HPsyoaBs9IV1Z5B=YInsLnu3u=oyyC7^^|kh$z>0ncS$twl4#x~iSia85v@m{^HxUlRz~w) z%$A9DKBElQOJ~}VKZGUdb_b!yBTA);3vkhnx_?xFS2?#m0!We0sr6b`f|N}vb(!Ku z;Leb%NDB$bsgKuYjMc`NBdBu-jOm71NYLdF5K+!8nv*wlA)sOP+(miS@E{O$!fOI! zd*MMKcoqIb&2|)xS%7kxC&`2$y0}X31hbTfm~w9A14t1=GH-HKT(xX;7~2u+gogxz z=+w>FG~NCL@53h-ovkFOX^)~&HOgh43)j+Bx~n{7RnF9M9ORG;9sdFnSu@~~i=Yxd zc?F6zBSDG7SdQ3IO(1yCAt0ihQIJSByv+QRfO<1K^CU3=%YtsMLXe=G5!(rDJA8tA zlh4(j6rw9viC8r}@(^^vYXW13;Xxp%{;=&y(Wrrvd(rlEmEMJXQXXQ;nR-0}tP4It zy)Hnah!5S@$7%5d=irk!e70g#J(rA0+DgQMK{-nt^6lE`eh4q)sI4hfiR9vSw%!f#&LUk&SXKB$qbeElj0z zYd~E^Wjxqp9Tkg}CPOxB|p;zJ24DQ02PiN?L8Kd+%lCA#t-*t$wC*V=} zFcT9`Dw~AMV-+4Ew`S{Q;Kv+lL2Vmw8eg1X2XAo{-?ZoF_yHC1K zjUMS7h&@cYkHhB2U6^y~G>~+M(a%$-GxWjKeWS-}XGV|J?iYI`cUBa|Pw!GTL=Nyl zRdcpRsc=$nc3fSvL~#MM^L zSM|+7N~$ljgM?Ji9)RD1=zU+bw~?T!KdN9e}wkGk81y(6?h2A`6T@z z%j$aw5x=h=AAH@wv@6U(*o%QFi2=*cdS@L&LLFJq_zuxy_2VI(TbVxHWW5)d%9?5U zA3(eh3t0j)d#|_q5At4Pr#r@+2J^fH>T!7QwRTqeVXSTW#=iGDJKIY65t2U%%r|=g zZQ=7>7d($7D~N$_*+Fh$wQFIXlbhcL(@hrnuLPxbGQp8J3?K_4yfs z-=R-?k5k;YUE;8}Rr)Rn_%j837vfTQq$*yCvQl>I8m4Rr-istF_&7p4_%(!{;Ohvz z!CxZu1yjK64_?76L2ehF8k~nP5UfMkCwM2qv>>;EP7fYIm=XLo!oF5NyeeRApqNn} z>4MuSjswVR`S&2+=i>+l<0-K>*8{bOd7@Sr?twT6_!0$-@IdXO%naVtm$cfcO+j@= zOprT5+re1~JwZP8^9DB|^aUSA=nsAoVM_3O2vdV+5C(!Ncv96Tn2RtiI0IpNa5=(^ zAP?JcK#HwFrj<_aPh_`~t!&g5N_J3Z6zdEchpc!-E6yG-^b! z5Mgd`9>S5q285%6I}nZzK8A2i@Fj#-27iKZZ15d~R|PZiOmAH9N`!gA5`_7|I)vkc z+YuH7pFmg`Jc@8a@C}3$gYO|M3T9(go)j!VI5}93a7u6u!l}W#5ndg93gJhB|Az3I zU^l{P!T&;dZSXQ&)UOLpLU?_U%YfqGT7=Vsdl1eD{xiav!J`OEfr>V7s9#0ParH0K7(*x@HK?DV z+eLBPUE(l5q%QzP%|kmWt{xb-r}ci-h^sf^(7|t|xOE6NP~2BMnAVm*m|0OjWVpFx@ ztw>cehA0`szX6;VGtjSrav`PM5LMWSeXKC(Z@`0Y=e&c+Cy|)T--&pxL~aoxUql3I z{*r25r8E#VuhMEN)ign?tm9h4O%Px&Pe;+-aazL#NKqP&(;D)^$7?+3G@sURoGNET z5!9oG@4gJ1*(Ub#d}=sJ zYsg=!l!lX3_L25NrQal%ev`C*KSaSSdkj2s+c}Gnm2dk(n{m|Uko^!QD6!Wem%R=t z0oq=g$;#lGU>NguL5jV6F;(i)Dy=mtb!nqL1zaiBrIZ@A0@nuBv|Xye(RC=54*Bhz z9x(Gw!Q5fs+RVr_MD{2aRUWUl_VN~%_n0n^KZGe0Jf_S0DsZkrKraT{@ZSPwF5soW zNBs+~c&hxzqUGaef^<8l5JXk}T0~U&yAg4f{{lGe<-1w_RoLjWxWp9D0^fiIy21E+ zBnJf0kxDL7m3+ljN$^qL(3@DvK_0A+O(h3; zqBDpl=t>Uq=oy6TCsoO*h}g@y@0|BCkD5VvPK_$}G9_d9L%_Ly0(}A4bR{oSg^m6{ zD839DfM(}>3yg0dA@@B*&M*?h%<(QY)MYJ0#9sam%Nnf9;(N+U_FxZ}XQsx3J)8;9 z$g0MJJ<(sm?>I|o1lfN@f2O- zPXOoA3-n6pG3q>U)w!pr0!P1$QmY{abUTMX=e>r6AwNcdw%9?Sr3^5`L^d*59#ZE=^YE$&j~T0=j{8h_q% z7p@OdftpO+eQ(V=RbrE0vKS{&9|jK-{_YJ6DNxB@sA9iT^Rd{`AWVjj|= zv^tp!bUSAqm~TPikd+Kt5uibiP`z(^h60Fs-*%~|30l2xi+WtdDD@5_zrDPJ>U~G6 zcfhFk9j)H0z*U2MN2xdb55QH|`Ht>7r5N<8>wHHkFyfr3ycCil)6N+ShCfhSKlB^Y zAAyw3n^}ALgDm?;y6kGOzNqn=(fGr60)JWK-$kzBhk+~8om9Gw`aW7eSf2`z>S`GZTi+&&Q*NDI2;fg30 zDjCPf$Tq2iZ-hS$PUD!q8omXdzxx=+^m2GU<9fs-0y3R4+Tr)d@w5Lj59Jx>mP7No z-F88^Vxr@^gpM-kc*&*X{7c765?xq@`nf!#oG)N4@CSv*`|NpnlAf zsI{PM!Q#-ED?_!7HBGBRc;&SXFPer5C*&987ly_(Hm+NnhduoH;%=y@sBps6+LcoZ z3hF0JnNl#dwy<#W%E>Eh5m`}GTT?TsW^zGI{e;>p|CYnI8yoO`TkFPUYPT8)TE-Vj zm&G0qzO45t-pkA>-pf{WG&I&#$=TgiI2ydZW<^8Zx+yglL{@E>G@+o1=LJ-$mx}S) zTrJ+oYHx0}YTB9#Ep;LQV^!SkzoV%QFX`fSX1pP7wKd#cU)64@H`PrxzLRT8qI8qq z4DopDv$?gsO7X{)j1vQ57v;7FlkH5%bj{i+Vs-J zRhTQ$|7Ij4T|FTg3Fb{kqCmde8>f>h3j&jnC@=|037j^s5)uU_AkCaUue7{;_Vi>;6s0F_Cx=e?37XiUD>L+Nu_!%pvpIBS zkPGE!k4V@EjtGpVi?OIuE+T~m^=_HiQZ7JOMO=WMq4d?g{NX6>CT+H8rXM(OOF7s#JP{`5u3$F8O&9=D1{nF+?MBQt@?9hu2! zO3&WoG%7RU=!%L>PF9kWlhp*1sHJHj8aD||iA_RFG8P?e6O1!Oqs(M9rDyMkc4Q{# z1dhx^G`YMkn3eSMnuJ6plaQ$6(#q)i&UGngt^}l+Wz+FLp&))hne?iP1?4vvPArJ7 zn_V(l+}xYuvzm)}VhZ(0OwrORl8Z}7(()>tC6X+BT#MM~Qb?9bau>n%la5By`9%)z zG87aB#)YG0O>JA@gerU#qZaXcCG1WTzUUp=%GTz!RqD13%vO8NDvLK|Ez#RDb+=}2 z6VzQBHfy(PJ6dCJnPTL`-a6s@FjpA~Z=&K@j?-n)SZ*uc4$R+3CfsL=-NrMnDj zNw3vzV@z+-2V{LxdTUXPLhZ!6T?CyLnVKrGi@Ug*KSJT*0kB5~1h=)4U zaqfgw!>1{hJs#1Sct&)!m6Db^Jz)3oWLo{~EW5vFfG^v=#Jbcw$iB=T>=|kgw@2aW z6CU}g_u+ha)yLkHnZakjIq=5uiC9VIpnL7zo?YIZz8(JUDKT_DDO2=&64UtvEuNlX zgah))n!7wcVTUftYQ)mFD=d=tLdUspeVV*Z5uN%@nWfe`BogOT|rxOe${BOLcl%FJvb zbB~qz8o2iO3fyVb@pY1l)#Ih42;v_xdKZ&?2n0s0~P75iK%NAA$PX z|BMz77%kpim9#4+`v-LPbpco>v!nYC)cmdse^$qjNnquy*J96Gi#-R6J@3|mO$=oM zK8BUx3%D;pM!@|UtQI5T1uek|>@CEO{Q5d~YeJnbrz6bCT-@W= zC)FS*S_xuj;f#p~2}Qo0;F}HeAG;o!UyJ1bKyqU&cP)$Y4_yrSb(A+u3Wb<}`&9zE zPr$9C_AT4`S6X<)j%!X){t>^}@z>X(gZb-{j@G%qz7F;Ch(BsTgdmq)eqSbXc@wcX z;M-e-SFDhqLdYwAT0mDuzB9QC-~bI`8!?gZ~GU2cX#>6{OZa85Lf*JlZy$K#LCn4-Up%Ts_w*}5{n}7UDcoP zr^%@6q5gzFn?_wvb#IIGiKPF*A9d%bS6j#*q~2*Ef3W&}3wguU zf)?`5Q#ZAcccFTzg}gE9M=j#psK2&|Z?E|6bJTTG=OMpUkpNe90nM+|jO(QS3V9c0{HNhJMwsypay5&A;K@3uQf(vMN2nSX?C zqt+ol+FshL;mChTBz-6KEAeAmgJ=3=m52Q4PY}94XnrS8Gc*2skk9YrEqxv2^E-J< ze++(pCvWKwz|ZgG!KTw6MZ^Q35v=Kcp!xl`jlTx%gX=6UeGVA;UAU$H8~pr6+|nn( z&+o-8eLeWY9(pPwxYr;4>-?TYdVW97ZpQMwkM#VO9Ko8dKzgo~v2+5`^BZ$Z-;VO} zdvi;_41Vt2XY+3lnhRAdy$p=}2Hobj4f*kVbgR#0;OF<|R^DDFgfsE86qlFrJ9Qhs z7WqfxXR9+IFG^pkCPQA7zDzybLf++iZ@XxGiCO@8{Px}I`vlA5p>IV5zlpc;&%)2W z3atM8F~EHatbU(^k>9^tIv*Z>3vc;v2R~)m_LYwO`JKF#zZLoOn|VtwgNNVGTlyII z`7OPr-vvLvtGDuhg$Rxb_^<1;2Rz&h!P1q;pZg$Kn%|3X4+KkdnF;qlu=FS3=ROBu z)AFj|;r<4e{v3?l^TL+rD(F|{p??NOF7dPRcOxzLxv(@>4RMbP1Z(+ikRSKAu6fXeke<%aSE*fSdvyH$gDry8xe{;a73y5%O~+tIEml8- z{&a?3qRyitaQr>!sQD^HMd1uxp>CrhaGh~E>PlIXY3W7kIT>3yW;$w)dY{a2CvZ7x zlJ1+NYc)Mx{TO|pE{w}j7pwbWAG(#e9961b6n%>|JyDGk{t23%t6mm;i(wZ>jaU5; zPPYLUKa9^|LxJ0*<0&QTT>gCVI2RvSc%7?jJsRRhP60PzE}q9;=i>R|b*|!x(oyHO zIN=pPfMRyZa8>^(Gkh+dCtl~`dE#}h8tf&(&u@yN&Q&Ccw_uC&*B1ayQ&?qCF55w4DCe|Jg$dQj7Y z)C-cH?_oNk{q&P2%y&o~(SC1{{=#=E9noH@rGN3ANk_Dg^F$usfpkQBSO%n{9>K$c zoRhf_K7@ER=8Qx%mwcfMh*#h}5fROXZ-m@3)QiM({Bh?(7+qN3)c`b?Z>q;3B%yws z`w>}wcOLX7R-rzK^Oc@UlGfkC4ZtcrhGUqhBxYd+AaNj`8N_UiqeSp)7d9~9I$2w6 zhZ7rq{i*iai6qqLHNoS836RV1OhMX(H1#3Y3x);v2_6>Y9No=9xri%JE@G~ko0DEh zIuGR{VwkHUVj^2Z9Ex%ghoK!1!CyJa~HDHx#|13u>f{1Lt#6yA~2_{K-vIHjxvOdVaUhqM|{eo``^0x@>pv#ML=<>o2 zy1bxud0_`#Uf4mG7k1F)g&lNxVFz7a@ayuz4!XRcb$MY2U0%?-ys$%9?C_x2VP`x$ ztTw-m+{I?UCHGs#4(<|J8C+@hM56tlf;~>LBZk8Qu~WI=Cc&41?)j!&xyy}R-3!d- zL!{X+T|BPdCW6*3Y+%5RreC=WjeK{J36IoYE&3^fX#X<7^@6q@nLp!?3M#3Obivlz z^OuNs3y_HRT84QWaTMnJLZ=c(W2_RoGjR;&Pedq{P8_FHhpRpU23 z>6y4Of6xiUS*TYcjGRim6!COneaEhbQ9Dyr=DQ8(Vp>8L7nwgu#I$6m(12+Ao27j| zVcK~*uru??M0+8gt+}K8>kaMOXntQ3QxQZ=6ATGv2<8Zm5X={xAV@ngJ@qG+2`&_@ z6kI7-D~PJl{Io06Z53qsN$(WgEx1Q;zu?P)uL&L&Y!EyuctY?qLDm!HvtEd7cSPEa z7!u4B%h`-JAn_r=*5u?f{!TMaQLhQYUrfBq z^lOHfNO(DM3;L1JRf4)+?l#XU^4ogZ!1#Mizh}6upRlCcDY#3}*3Ukn_Y1x(cu4R~ zK|t$vKz{#}9l$?Ui(3p*e@t{o6wEBw|DAmi#8l<>}ivHE66c&1>E;1IzP zg8726`WH!fv0!XD$|Ss8Ft$83624NfR?wDfz0ey3w+L<(+$I@1ir7!u4B%n=+S zm@hb1aDrg5;B3JX!E(V$!74#OTz!HPo+j9uURe@v^&26y)vrKkt6!1Ot?5}N@e2j5 zz98f3*_z${S^oc&omM$Pl#r2|_0crV846u;tYJx1b*|9;o?&njfh7ftnwv z`O)4^Ctve{|8#O&lc&RPmGnTZ7qA6Co_8(Ehv%8r7tb$SK5M7g_Lc!be4b?z@%+jn z;(0~qyG`;1YWYBI51^J0)bfE^K2XaCh9td~4_eCyYWYAq_Se(dFIIn@ZiA!)YQ2D| zln2y$0d+c{)(fcfS&4TNUtFWK7;QNAoT@zj)xIl0X5x@7I75uy4P!xdSR|#$qd|dE# zB7Wz6C3vYHG=87$5o{LZhpE0={H=hv2Ad%Wa;FB;UkY}``zF$P#5(i07~fi@wvz__ zLhuv8_NWM7J@)q&5w+=g+5O2bKSMWN)yNNd=o!~zNvr|m?L_zL; z;#-eByajg){zfpdjfv+@T;!`1yh{+pRKEMA-E8MOF3`X(#2sb_4AQ+xZ^OAbx^tIjAa)D56GmMU7#>M+ILJJS6y*;5&lNf`2C7fxmySy-`oW-hzV! zhY5}$Zo=reGhzvjqnU>TwC_ z`S&Wy86`MgklRQxe45~;f~A5Lf{O+9_y+!Kgyx>{Outs}7Qs6N?-smY@BzVx1s@fB zLhxz9=LBC8d{yvQf^P|OPkQFxB>2AIp9KFZ_=TXuaTffEf^7x)$vnfm31Y82O=DX- zjpqpF3Jw=MUvP}zM8U~|+^~akFBhCEc%|SH!R3P23f?HVPVhFt&4S!ni*mOMeoyd+ zf?!OsN)d`=-CV7cprWT3q4urX+mEixP*vw*Gl~D5`Mqn z!-7u;zC^@4;+I1Io``(j75YP=|0MJmg4`d2>C%Yc?6j+nE1!A|k#g z5$XB}&GkJDKVOhLp^^VGBKRsKyjt)E!CM8l5izfNNa)9jNcW`BF9>~5=r@G^jnMBA z@m%M+ET;QR(Bb?6bSiN*p0h;g*;~SSrUU6bp@#`QTIh>}=K2@PnJM%FBJ$(93Wl!~ zTqC%Fi22(+M9BZHgg+$o<3c|v^Z~&)1i3bX={^+X{%@plKA^^+U~eMkg;_%D`4RNt zdMxr!AcE#@ainJpa_bE0f0e|qA=WB&o5bHM;r9#8z2%txr-CmE9uoW?!S@BZK8*Z{ zslYYZjgJVL>ujh`FQEqtoh$VDf)^8^-%N=w6xe<1i1 z!50L7Daak~nEsgH--&DSj<~G}Z%>5WPD1w-x{uI{2mqhX`!DL`W3<75|PgliT_aW6Ty?jby(lh4v6xdL4@3HLiZOODmY5; z62Z#_uM}J^xQ=)e&b$%&ej?=V5c(0J9~1f+!B>e$cUa=NHyic(Trkky&>aOch&N*m znb0GN$mar~3x&Q!=*xt@Lg;S^y;SHMh>&-igolaimHMH?KPlmRg+3_s&xQVt(7zM< zJ)u7k`ct7l7dn6+uGBY$h;nujy1UT*gdQL?eh%pI57Q2f7v@x zf;mKt149Hy2<8h;Afg`@2^I@Z7c3*9-Ioh46s#1)qfxihRf4sGXu3Ll6A?^X1h*3L zoI?}U7$#n4{%%9uNgB_GU4pxb5WYw7DI&_bPjEjGg7jyw>*kv{mw0?gJyQ~y?6%lq>FZ2c??6Fhm zT}0U9WuadqqA;_FC}cem<^MGi+orrS$k+=r( z5`fVATH;##oty|g&)_^2`VAvOuj`4>=f^}EHM_iG-U@7XGjCpX#nmdih8yW*S65VK z^Mg6`_xM&gQm2i{`DU!J(m=n_(3z7nQHnqOxN@^NaiK zqfW@2{|R=Zb~W~2V$O!br+zBCC|g6kBFN??-$+sUC{n&}Y+b`Rd|u0C7cIwGl=By6 z*UX()S#e7F;-o%}0Z*%tFwC33q)IAMSMZ{x3zn(ur8pHed;BFc2I3s!`HR1iA!5Fx zY~2#^7*A6e&u5~o%Z+97nwR#AjXzDEVsiP~we@V{@Og9oW)yHvFN0ST zD(a0pO+HdC`w8)B4bXzoo9{QXK#Sz3QLP1UTpP6D@G8SnwTL`TRxQ5?8Wr)pB;+8M1!l%tO3%*e|w!^pCA+7a%Odc#Z$7u5oGXw0Z2DrK{NK!MQqb(Y!RM-s^6b2b$UN-0W+oNcx$q*++@qoAj<5{$ zRWH+put|nTB6EjDy+g?uGs*gA^^8gz9P#F1ry`p(ycu(|Jps8oz}zEj!-q!_41xFG zRVpfN@NnA7-1D?QHxikb6Y=K43%)2lVwhEkzF2FX8Z>Mei#b@|^CD^Ua!=(%5ID^} z!kByRP@7-WmpgQ*Rz4DymlyHo!pjDt@45PpxL7@hSfRPtZ_3ulkcc;LaKxJnFAJdW z*bI^?Mk4caBHmnh5f`OL47P%!zTBaMwc`4o7h%ZDjd*k6Wg9kpRs!}tvR?XPOT(al zskP#x{k$Q0x_prg^710yTzF9?bH|pJVki@6soY_?|7!MTE({eQLB@)xH*at>6kaw~ zeb3YP+(=|zPQ;t*@oFnZOofptH#--5l?nsX35H{; zBrWB(dd+fWmLpQqYw14Aqyezr!O<=YBAyuyySeT&UI1^lGd`j8K*sf9*f z6@Ch9_Z037w>n#SKl0F7dCbErFBS4^{dN#OmMaA}uYR9EUKlpC&dLjb&nqt-^7t-^ z`gOu(_4}=|cd1+L?GlY-nzKsN4{n%f2#nF#{C-&->0eM!x zt{! zMLx=V1NQgo$G=lCoIG?^-Y>xCEpLfOzcYo8>Fzf2BI8hJ$ZJ5jbynWy7)s^7;xN)9r&W{Eyg=e?J=$r~N$zCa=7skaq~_Xutlr ztbUt~yh#7xfd^7_ZfJK&Lb4tTA8 ze}^Be5&e#ee&nIE^8O0Hx4dt9bKFp>XAuk6^wBI0H zR=+EZyoi3A@a$zi= z6ZPYoF{|HfBQK&~C}{K}51o}aJx1OxkA6dikNRDYagyo;aM5K#-dN++cPsB2@Okyy z=aDxYoL0Y!jl76{m7*Vc=&ZbnG4fvX$U9f~s9z;+Uj1qykAM5H&dOT|KCganLtYt} zXutDtS^Wx(yoi4F9gO|RLucjX$H>daw?xQV%R68Az@pm3)b9q!+l6rJtURvg@#N#r zfV>dWQ@=5|tbV?j{!xMlFY_S}oz;))`Ml-b<#q;O}}+k-cRB2 z%G(EdBfv-f#^WL%B%dxLl%M(LvzCFR`EyqX5w+wa8e2a0}d^ty#V#NV)T0(@^*rW@}}dm@_33N^@Hl# z&CW2tJA~A6^mAQ|mv0XEkVV8Xj_!J~vz0f$6}~f4TgqG13g39tkvHFEt?=!L(Qid7 zd{aqvO>a@Q{z~`F7lxuWbkWArDm& zaaP`~;PcAc19{|Qy_Mp!@`l9pj}d)MzqA6ayquW+k%hnQ+VOO*M_x7(c=fA=yfiCJ z_(%=_pI5&UkG%Q9$MSZP`mp8Q+KRmP;PcAc;E`A1k;ipuUj24M9)_%lv*qRbcCWmB zke3NA+V4tSnqkX2E67}6v1a;3c>NW1lr_j=6pgAoH`+Dj$macw^Jy9SqSf2<2$*3H0! zDPRXp1lqVG@K`^2FCT(&AZSxXV!&)EA?W|)Qufc+r??<{$2_LFfjgOI+ zbs3)b2(!+L9up%k{r2eZlzK4RcEG*JJk_pNl|e^&=7oii)m=5W9DnLsoIO8#*`N?y z4sYU&-`s}{8KOgnjxZPsm8IM`uIM7Oi!TJhIT#VGo}_aO;YZVg%fvfC1pM#pLd~By zvJ3Sk+j1vfX(52>C{McrD*(gn8TG z0ni~_jAuC8s&0c7OCs%$jqG%7FmG7iFw+W8-v*!JyBo1MY|@oDcpFnbaE3`tu;Bp9mkZ~-29ZY zv3Vk1uevJSm=Fv%x>eyu-|leZS0_(?7~U1eHXT}3^yL1yS?2_1r*sZH>AK$$`R>SzjR_&X%3Q4JV%o1L=yBLOv` zp$qfF=K}k??7*wZe~N&uqNUQ3Fy#8&N*mFx(W#2{#6+CN!w3 zjar{9Rn_F@=XdSeHJxlfx#`Vt?U7B6`XJ@eaT-$#wl_ncCfdx(o&edD$uP>JZLB=n zaV+D5+nZHExG@R3>2eEp*fsVD)+&CGP=+*TwQK6CK5ahPb8-{y*A@Asp{b^o)uXw+ zdCVzVbA)yr0R5cen~wNV?yjKm4B7kI89SQ&kl8h++}YqwQ#Tz^!3hmPHKl2QqxJ?_ zew4j)aAR{27lzso9w>g}n45ERgQGe$xp`s7%~{v@K+X%toZy-xOjn08I5~%o4XSEr z$|)WLJ!Ulh`Q*uwqu?KgumI>kfSwC_CTKtC_fMX@uN})44mVy1v^K4UP0u3@9`qk$ zo7!8NRhV|YrFjVAI-*>x&(AuWa&?R;7p4U%Y&T9>xakV$-+=anQK6{_;eIvg2;0$H z_&hTyc*l{WqY&q8KBi8rX{bj(;odwUT*Vj!{7uDEGfoNBHUfFV)fakw4pKY}>T;8 zy1t4!nfhuMQ(x#)DXgDeMCn_#;esPiLl)^SNYDPpustY$lE{he$C%5eoakush>cr{ zxWjScUPc)EA;+H`=nsj|yPReA)I%ET0nH&276Q%sNhm=72uWW@JI1@a4@RKwQmf4P z6@s62g>g)eB?|m{TmUcg#LtlKoIi@crA`exI{BT)5rlX&EP(J={ z5;t$^uE(AKrMxL$>!dDgLi5F+6dAuL3-u7~8)Y27W}5K}elvc}G~*X&Gk(p~^v~2EY9<>PMJl6rf>#31je^;n#3+3|R<+;klySV;5%E zo|rW7{i%5F@7aX5UWVs+EuQC9(6=Dmn7oP4{BJjp#WO!k+Ek^p9rK59c-|&iG%*S?cz@j-N~Pdwp-sz`hdi-{W6Zv5%v$={;JS^ap|@KKARWiMxU3^L&^>t zI#XHp+f3QRD9wc(oHe_5KgVG@;(`SO-{-RvZ~k;YhB;Caf?G^J%3zWp=On4nDOm9A zap-|(4Ch5V^}Hzc(8Widn!BT!cEPiwF(I_^h!cjbAUjY78zCK@-Dr#VU@Y8-yx`B- z*qoSS%FcOAXT{;h0?>(Nz_M^3+KqX#El^gVYE}d5GO+vTu|V;< z2B)C@$j2v7c8`=>@=8G(@<+m}!c94_g{nGwY($7{y#9z2END={x@IRd5opE|I~HV> zVZH|2J19%-4e0APa-ItNLk9atBHBpmp=kdIgE3QD#_q>_wI{|8e7_3yx_-)z=FSCZ zk71e1mZ9x$LYa!$_U~@4M18W1)YYPCQ^ifA(3UsVZg1|4cAALtM8^99Q!f~!x-%|d z;>=hmahQkbxVB;kD>Dn>LCm*N*S9i`_DK#&eHVnAGEm<3YWs0S>wHslZpCxvR`khR zO5Nw#t?CS&;_8f_*C{L~ZPXU}a&AJuwx84oZ0A(5K5jOB zmO6z{&R}R_UQpe7gk^mR{jLi2M7R4#J!*@qm(3qI9ZQi%hK6K~yJXDNON*zE8>_~S zn>27DzIqrL!XcFdaT4X=fjEmWD<(W92xrL+^l*^GF>$d8b?~`)@q%$YoC!V&XLK}g z8qwM?*;XO+GDltdAYdN`Ie0CTHv!Cxs3`;vRgRiI8wD=I1#i3r1)6Ir;VJFCoWMj0 z>MzdJ9ns`dDTP{?2r9A-iWmxMwDao1S3ZuKM&MUcj+zw}Hti{da6JG*%K=rmC~4Y` zE%0qK5ibKiGv23=+uOLno|J$$$+!%=$<~~AMSnUk$o8q69Ykj7sLO563@$?uvqvzY zGjd=sk(s+H*f*jDBd85k0l(FV!PLxD%H^~LHKatq2xtc>y>`%3f(zk$^&Gs|FUvnFKb0eJaJ&rvf8Y1*_i2sA&05uVcC znbzQrnn8PWwt-|c@;+P$CD6=BMiZAAFM&n|1EJD{5@=$CavF0$n|B6bwl;4up;CKi z5b8}R!Pr0Ya>v@L3$I1b;f6)sheVgQD`>nBdiTy zOx;W!%(iuamS@$0H#)G*rZQ|H2#w7r3t~nXiLp^b5Nrn9)j|C9HO{tJMlu~oSt1!x zsj+MY2%ey$ro~1vxF~)U54SK+lH%A@hY`h+VE{cmfYimM_UX%ec!NTF|b{05LJQE{alMdW8X-6;n8 z1i{nwND#+BjAT0fY!t>g2Etz}R1&T@24Zk({3zNXhzq@iuwQ#m8IBRECjiKnPqF>D zTAB8w>8Pm$!-YR@8D|?Ism{2dCt<(#p3=lQ<)@j9$?4mV3lA9FweyNgLI?^#7@@t> z3Hi7$H3(C}gtkc+m$ z&`mI=I>p*d)me+xta=m&S4bzALNEy~jV6fu!^Je)sRWZ?W;8+Eex9at zm_{%OW27OQAf}!>SO!Dc`kC7X2 z`BcFUqA?K{glXq=aQe3ECV)- z(4dE3rMIUiohj%!6CrKsIg1vd2m8tqLd=4mUMZkEpoV(iQs-#FSW9?oorCDjqtU1` z5G)*hy=KhUhVJLr_0T^WW5P4z78Sd5Sc@{p0g}q!zuUx4Cfzx)=@3T)VR9uV@YB=- zjjnf(?nXJ;aS|E34vJV#CsXxoQMv)L%cJTe&!_L`P;>LO$BZe#S?Yd9+D!$kJx>Np0NWxTm^Pac}D`!M&Zk z9{2X{_izuoKf}F)`ws3M-LG)(w?UmU}bqJ>7?K54k_Xy_frI+ZV{GGtBLW`*3$0?jziC+|PB_;y%*l>Z$YGXK>GV-@^TT_b<3# z;BvRv3*B>YFL1}>KFXbs`)Kz@+{d{0;Xc;o3Y2l~A>1!=Kg4~!8^A)C3GP|APjq?K zU7>p^?vvc*xEHw_alhEziTfq)i?~l#2_K?<6BGOaR#O5`$V_qqneZnLWWYx{0Fq_g zpYv8K+CWyaQ#=lTt?*?z9FS7}3@&%a1|)FWB&Jw@8-90Vg4+b?4fg>@n=`bR%xFOH z`x8>|##Z@;ne=_N{|GtzYj0P22hcnGBY0Cs(0i`-j*NQqBVH9a2DU_&r!8A?E@BeS zNx6Uwx0*aI(S9v>2EDgw@1@#H!EMUu-Jq4wo9J%P*)3-1?eo#4)%xM6);ptG@6=lJ)Ir}5yP?&m{)yg4E}~a!y(_BqQ>twS z!hZ)2e{p9*t>Z7!YL7&?{}Qj-Wh$yiyap*$BGK16ieGHTf*aYe*iU_FY!urmMh^+}~DLLlXy@}n6fzYE^)k~~hqY5dvx{V17=lI@I=6F}}F*~}88Jp^($$@iFT+7lQ7 zwAD=PW$43{bmLiPS-2LWB)(owukKvLy#oQ={|BBQ!qX$^C%C6`v(5eV^n%4+ zr6(Vr-@s#p@HeRzat?&dLX;L#4Ub329U!%kC*jdTeg#id2!FR#QIk;+vJ%}_3%Ls( zEhMNl*$q+);XajG$j9&)A=9AGZkQ4Q$~WKXaAxflr3gC9nf@(6&lSAY;-)wem-gmP|dL#Oy^B5`Yxg1>zFIK|v=t2b%BU9$Aup!xoY zvKapy#=|O27o(u6_pd;&*K{PuAk%IRsoqO4dkO2fDWG*IQmjSj%Odd_$eo5(ZsU0D z@S7g#&w&2OLo>Gol+>04<%{ITWv}Tv&YN2kLdWXRslM3U+M!Exk)-6F!Lsvxk~YFN zi9n%M-_I~;1g5a-^kbLk$HBMX4PfubzNbmdUE%HD4*4a1+OJC_I1}mh_G``@#U6Kn zQo6K7K@Mn=^12KL`Kl%A%^+hSLM4$bmP9CL*c2fF9R2&lcK*_S-1}Vx z_@L3Y+lJQZ%o)j26lvS>?Cmc2L#nSxTjyzz+IB@Of0qv^i4TK|b!-o$)5f}l#_Dn# zNNuc3#8{mZDXDmsF_vmiYKk6ixh1DI)->jt_7jkLXr9WH#&$OrL$}_Ok!FaLj`n#R zbiRjv5p;>B*@b9DHbj)Uv+B(_wlId$!Y1?`gc@7I!jVwQJuGr<+D{~Hl#3FBxrn>uIP2#G4Jl9zT__*%7o*^IWdPH# zlMd?KDby5<<-`Ir zrGslAYs1sVR5sHdLiIRvdNJ*fb?#X{6hTi-e(Z2Ek~J8#o|_2GQRNNtKkl%5WQ9TV z=y=c{k>=-6dLVkjVV!0D9fkga@lTj|ZsYr@p*dk0#0i=1BtO;hgLrH@*Z%l~<}vMh z-XZiN(D+-o@;#~L584D;_qm^F{ReTIUl$G0#?J%okJ7ydz&{ox=ktJ_3eSTCr9=07 zLZ|pv=uX7Wr#V#L!4MQUU)PInmb!t)4CwtQf+@MUUkNf%fw{Q1UxJX?$s>c80dGe@ za=r?(iQGs3`ANYA@IOTV1!L~fAVKm^$r{NeiQFnC#O&G*5B?_{~o$A}7yuFB{N}mR`11 zI*#tv{jaR;A2)K)HOs0O4_Y|4ddae-*DhOL%KfJX9ox0*=u@}6chA$!d+%y~_RjYn z_}-wroIL!`%^4({at^9oG_QJY^|d8cTwt!ojVz&{l9qx>P8C#Q1(nQOv8WQ8bj_fv+Milx|4YiUJ!2piO?i${+eJH2RH>6nSd6UI#~y=3ww<4y^i zQB)KghE*1&SbR}BZp`SoQRn8h7KKF^twmAbn9*Ze6WB@=1-25U1zt27(5lQKhEjfea=brXr#2Kl=5Y!PuQAtD0XW1Wsg=W-e;%;?mbX_?E{#Oo}+Ccc&GZ6W{b zDw6W!#AEeTy!v5q9J6cgvEy1xfn``K4sn#Afb<7Yp`Pejeuo}~P|7s;lSL>;%qSeM`^L6oToL>{)iu_SiTkpFj zE`Gn&ag-US&qid%F?mF0YjIl7Q~PODX58Kt72A5WmfU)@9$@0tGz~=Kwi2hswi4G$ zUyNuQr=RIK%4{u8>v?KLM`Xrn1QD6>;^gr<`Jz@IudPH;$yTDM5PcFJNcW}KH_FH>j!t>z zV+N)4&CZM}s;ie(m(DFOSDX$lTy*6^Rk`dMwO~clYnIi_tyI|5y{3YVVL?T8 zL>KbJ>cTKESJx~rWhGk`8N8wjKOZVi30{CwE?;ET|dZ@$hJ&G4)B_8R;_<-p(j*p0qElz zO+`_CwTz7L=$C53@yk;_`yK>utDk*4(a*lma`cDaL9lb# zL<0Wc?5t{+ir>fhb92;nhF8D6lpy{L9@{SCcIP(Vt?n%e>-{$eZc1F2RG&PyT?5`M zsf=h+{Zn~tyAXMAan~o@?7u0nF0npoY`fz=y+XyZ^8L@)c1gE8^}ZJA`O~_UymGwx z@Ta%V=hm2fHaY5AykAOCFMrN6v<@t~!1YZhHyF=%jhUiQ%JVS|=mySy6Be$a~L)q_NvLHJ=l5RaJ^D+e-F z$-G51%Uk)iuaxN**$Zh2^d`I)z&jEB{4!y4D=XP&mV-jQVnjBLn$3Ls2rn5{G=0^ilh!@xzWR-n**7n%A4 z?s?FAT%Esvz&)t6GJ9`?bk%)I-}=qghZJ5Jr=B! zJEG3tZlb@#T7Sr0e`B4$4~*F{Dc}7a@`1b$d>^|h$ZNyuz5byA_e-B|i{k{`dMMio zR3TJze{|zstKF~vJ?*mGM|@DOEi0BbxeMZ$f$!sh`^M_Rfcu~iy1Y%_6TUi+g#zvw zhkyUy-5TeVV~<7@51R%tJ=z6C(3+biV7n;_EvOXs@$lfvTLo}3a79JegY%5bzk)rvO}U_f9&o-2-@D8=pee^p)Eb&CLKkeTD8|Vq{SF<5MzWt z#h2AJ;O;S&`31@dYwvO&hbhJc++V>mx@Xq8j~V0qH|_E04JZ%{{uYTJ&^U+b+j#@5 z@jGX4zAR(@n z)m?idZfoc}$%Kx&7E#h4D;} zz1@QDs+Tlyg^Y0lmDwUbMRB=I)V0U5u_(peslN-Fi(HNCs-}VtdE^ZPy9SE+3F=JA0s$d=lO5ekqzsQZ|g{Z86*GqHWJAA zO)>mGh@rWkvUTKNYY8Cfc`^JvciuY2e;AYg=Qa|^c&4Tvxx-R+B zh(k~=A{Hzb5%KXnznr2TJQsp`Y!x~z^gh@>y`R!!TN%390no&kf&9b#YeWo6hlnub zo5T(%2eBi*5+Py`YapU>j{=$gxF8qDk=8E5zyJ(_S@5P0gnfw6znqv2`x4KAo04bsS(un!fTG*q>=xdMDS_-z?aH=fSG~?MDR~1 zjzr!>*ku(F`tTVTv9Gn$nZ~}pG^_}ReBuJZ=LJV19mBc&n#k4i#8rY13F>cO5gtT^ zF}_Ifhk`%#n{cj8XFT^ECN>IwCD<43is1!!*Z~W7d}w#W1?LE^75ssqK9?NrERX_z)aP))If4%g{#x)XEW9A! zNI@>KB)vtD3o}UnL$F(_p@#}`fePa{5K(W>3jR@0pI43WV!Y5|{2hY&TxrlSuk!UY z@49@wI2MBjqKhhDA1nzLx;HUo<}i%c?E;9Vs`*C=ju*UGaGKzyf~A5Lf{O*O61+xm zwcuL8TLkYAyj$>o!3P8%7JO9j3BjiYpA&pZ@KwQI3BD!xKY~qy?+gA(@UMbj2=Zkb z?UE?iRlcqYPgzc&*@# zg6jlt6WlC#ui$pU?+N}u@G-%k2tFhDyx@NczApIRg1;4fR}h=gX#GAE{IlTS1pguE zavbS}RY-!|{z9QA2u>F)6I?8Kwcr{-o?AgV{AQaN7JNkTNx|m@ zUlV*w@Xvyu2`0EkPJ6-bf_(*Z1kV$^NN|c^iQq!PWrEiTZV|j+@JE7s1z!?8B=~#5 z_XPhe_@y9!AFE(` zfamVpLLVa{pAUupROruz_H&+q_+%o|^E@ZgX+rlATCb2t{7?xWBd9+g1OHT^^*jXh zT%juktBKI-dcoTS?-%^3;Ol}-f`1WA=KKWd`wH@_VA4|r=L#+*LeF}^#{~BY{zCAm zV0+GEz@ILdEjV0ojNoKJu2>~MzbPO-A-JE2dD+i}euD@*{6^^aB>qo=UlK8|3UIyz zIUR}M?;><>q5BD)C-g9(M+<$C&{Kt;DYX6!4DuETT`lof3tcDlO+w!(^gTjTkgF?R{^lyYdBJ_Jge@aAoQ}G*+cn%TeE*6|8_$|S!1?vQ#5Ii9GuHat< z+u%2)wxeKo!G3~yf@1_P6a1Fo8bM6A^m87=yGC?hJ)WStGzN+2m-uO_5ksP`cN9ru zhzKG>Fq4ROnkA_Dd!xOP#(YA@gVymJUl|U1HWB%(61tX%_O(UmtwadfC-ijYIV~FR@n^#?NwcUiAM`p$xd&~s^ z-X#b6SWSJ<_bD+ZCC(MjjvsHgIJfH#PFbF!mj-Y#h|VNN5t~Y{Q1C87;c9>ut0o}V zu2ZR4f)yi?B@5(iWz|M2%QHNSIkaJTcJ`uqD{3m1%lV=e^HyA0T8+Q2A_Pa6;=i@5 z_UbcJPg|T8D>b49_Llfmmaj37cgaY6abAvj^Osb4OQY9@KzpvbD5bsTFD{+GaB=B^ zxr-`QcFcD45gqNHtnC^kov$2q9rsXko06@d#o86N0v&L=RuE-saqv7FNDG0i_7(xU zfwTyTzdESpax1Sbu3RyYiV-5vJv;3M=Rb#_tvU zkGMnF#^o3v2I4TRYRC5%^kX>HZit`-n}qKNV)^*&u+H-R00H2us*{KbKt6k{E|%~6 z2*cDZ;*tu@`|5KLLLOdB_X&h~^DRag-&I*><(&YNS6&+ARUwS>ST-wENSYltpLx@Q7@Y?_uPN$EnU2Q<+GTk%)g2vChhS z0AXHvA;{YVChCXR@ez3|jl76{{HT-mBM+UGR}&*|w@1G-gpcVqBLUU1?TBZ_@NbOP zS$P}b@#?o9@>YV0`e7Os(XZObi|F@us?m=;bXMNd7EEC<^h^`l*Q*);H~nV7p>gF3g) z#`Q4m#RjX_F{fK^8w)}$A3xgj=9@Da@A%Q^nJ-??M)JKF32Yh)oiWh-t$=YBJLc@xF^<=Df|l>$^WvWw!}o9Gx9%U{^Ew-M zE<7-Gm5n3cNJ{`MAOD_U{fr)g&f7qbIF^Hs+i-ZxTYv$l4B;$qe_Xb_l`-wDF#2gI{z_ps|HG_J9v!|98FjwLTjl zB>{WBX9hPn=i>aE1ngJMGZJF=eRovB5f?J>CT1< z?Wk1nPH8$hd2$m>rO&^?$kj|epe6DQH&)d?dprYY=-|AX#vFb2PBC8V-NZdIQlMXx zD!!@N@;RwvkC5Nw@k6~&KlUeWq|Dl~)TWcmCL=#1+ey8t347rm&&MAAZf(o``!leA ze>AUkkgrlg+-JQk+_cH5J)R2NsZHzj**BDtrAvi!Jy%~#`N$8$WHE--uuFTUhBo1q zcDS*l_v|2?A;A6RwQjHjZNRkX&nYf+_CY77jPX-wi|**nP3U^v1CV3(2`_HKTqH$p zBF_wMzhsH?V=s3MU)?QjY;bRLa6fHZ(&R_F1a)t-?6KbH&j~l4nDp%Nbm&)GFc!;g zK%-pRjwln)JNSP_SDeX|jy>v)zIQg){us7>&e#@xE`>HtMcYn98MU1Y!i{Xxwc$xe zXn)KNQ;HPMX~2H{6LPjUkKMGrxd8jsqcTwkGn;@Z3g;oHu&JAo+Ll|IUDRcg^p8ZG zN5H-M!_H-m7#9ZkQzsosKeX`(&Yd`(f_$x?@-RN6@a%wS7-U0_zn?sb5q^f${iRKq z7hrEVv){h0{}bdXqaK&?RX1M$nzq5S5GWI4TeQ9CcCtmEuMn)-gtIi5ZdMasGwHsa z6bd&Mv5n&lhGevdgy64Fywn1b5fMwQaB%nPqFNLylOu)9BXt!ZbAwB@&T$+21 zr|!oYEWVA$(eBV@HyqdF4fd{AIXDZUR?e(I8PTp&BITw{MKHw9~- zO-fMPniIgs=YbwWR4v109Nt;`b#l`GSvd`&PtJElpJ`2)GNq`{X6Q4OV`NHb|DEuc z=yPaP!JW;1=!vOccNMw|?R6@3OH0u0_dCt8I@hA_Qui)x4f@oy#=oGSdCSB8iRUA_ z#gxbxpMYl!+iVBV7_TN^+(f_9_RG05qA%^2m2($#oYth)(|&h057z0>N7g@k96D&! z<8N(!E&31I|CFYn!g({n&BzzeROFqYHlM-gY7!aY_*}KTh7aP+v%SfudXk@F4$2DQg3$<7 z+B<_#gNwOO+X0VuHp>D~MYv!K0vTI5JLLbkAy_A+IfWzK?r&p zVUPAs-w!Yero*S5H$e_U(0&Le!HoUzZqhl-ATVFklx)`V8y3sKY~$>(&M{{TF0vPEnW7a_zIoqP3})@Drsbe00R~`lli=%Yu^-Io;EdC@8FdsFN==}Zu~j#G z+SwfUgKEGPXEy!CN4aM zJ6ksT$wOz`q=zr);R_nBxO}M|K5D349C=9|KANKiABq3t#q+fA*(j}}uHYD3YrME? zXYEFUBPu2-1ah*vr|gKPnSwCwylGfb7?KDfT&9V@qn(%WG{&B4D+>>%c*%1R2;B(e zG`dC8#MQ0UEJH>Z?%H|P^pqzZk;qb*)W5wCzjwR*q)v|AAwRk04*4l(V2Awvc+HNT z$Mu%`X8ZoO-c9w}#qQ!Rd-=EL&h^o~@v+{{=h+Ou1GlHYYjj!%JRdr?*cHB$XA}F* zvHR11%~t&0(*U>;zbCUakBZzozZ-R-2X9%-Zu&h$9od;aJ({mMcmVtHM~iY+ClL9t zirtexc4Plub{l{1-ux^i3M@Hfcylm&=-X}j^|tyKb_=z^-jkB8-UYvZKh%Ea8K?-> z$k}H&gaKVdF}#uXiZto7BuI;-z=0l1=mJS*_--mvKRUBPw2a|k#pkrqXFcRb?5dga zSnwHL?Rf@+rHHK4AvCBtpkSz12~$+{0bX&LDM135Ir`ZjYulxXZvy&CaZ7MY-M=x= zO$4jscER1}_Q&1T+xjQCMezIGQrrXX3fvP_0$xwyOFxs|cY%8|LKVIlX8MP4_qklQ z?79bVPjKJF-S57KJ3ogXP&!0LfN~U2ZM{l{+4H$1TAf-`)paV?J-;*2_g) zO;XTZntT=F4wAJ>C3DZ|RETu1N=SYNey+xLtCNyHf&UQw%TrZiS9tD6fYT7*EG?w~ zw>Ff}M*GH-oW%8C*V!} zD{hJW1IcVMEpJOma+W5a3uLYijK!tTEU|M{f(rBlZz4_3v#R`C+7fp8mn2^;O#Wpm z`8xQSk$-tYGEZ6v;PS6XO5SDtS9eb4dT1TKGL*dA`mfDOe%$)68#wUxe$o2Z)+Qgc{&gFYU$Oq1wkE#@KMUqx|6uZ))_>bh zmDmA9n2ZP85>f;ElWQeD@PbONgP-LKyqJ(&5B~+Y0tc{X?HG6xFTstQ*9IOpEdbtx zRr)V>`nfS@aR5xi+dIYl({1AL%Rwp~%_o&J=XyquCaeD2ZsKS%ba3=*fsV8k**an0 z;u>J*69`E9)HD?~5QP_0@{4fJZIrZR1Ma~g2%MQnawP7Ci4SdO&iBc5Gp!Jug8;45 z&CD`*JIE`T=4OiM;1n}sle7{ZXATdiNPJc&-Gcy~^jV$sI7oK4#Agq}7i~V=d zOJzPoaAT)Se2(2Nco}Z&cZvJi^SbCPUu2eDuLeDz8ocmd5CaVg0D2XH3c=&dxdnew z?6w(Pcf-@&nGy!{aHcX+r6<$8A5cB#%pTg$27P94?Pcffat^&8{T+7|_zL$_*N=d9 zxD5v7yX-7N8ihTG%bD|c#B|$>lmTehjbBD|q-Ow>KZ~A4@Nk`XcWk~s%wWc7V9!f% z3%v?qob67)mDt-!?(WQd3qd{crykX7JCgnZ9@U#igcQKTD!v-@anP(P($@-2`wQL2 zDcP#2X}%Q*;}+DN^w!pB1>+#lx8WTKXtMx3D!{)wrLue(rHuMJN1-;1SACZwAhC<1 z&DBp=WfzBa*-x9Ut3%uMyAiC3X$}Xye%g*{4*NmBdWLs1;p>fGhi{_4yK@I;nSnA$ zOJw8cCzZ}?Z3#)v%gOxWfYt5%TqRc^>>!vO7%Q+DfvH>{pZEZ7)0pbTwuBtFck*_m zVq13ms^mTJkE1^`A(^MMu%+X$ljK+6ucSXaHTe+ytLV=S>JgvoH{D^K^^-tw9xlaT)a`me}L#xX;R->bQcvQ%O}sQq0qItv4Z zkexaiw}ht=fYF{G!XUn7HJnh$P zJY7Zwif~Vyg&RN5aGq&PNOhjnwZ<<7oTs9-<~*H{JRI?q>g-KYiI2e3i|KwG*aF@G z_tO7cPe1&C-Tp=Nn7`4(vBSmR>ADTZSlFJPYIu6U!+ywh_rMHp#2sP>hD5zEC$Z3J z+wCE6vNQK&NAAf^+>;%+Cwp(tZ`gI8hYa0y|C4?9oF75e#J6>KJX3eaw|AkiXR_HR zzHQpej}ef{Ue$L$nY;T~gO2IE-F;+NS-+v}s&y|lF(7nI-}jm3B5#Mk$kX93@^tv| zo(@0W)8Qw0I{XA3uKMybn8eXODkz$a7ERhiQEZ&m3$^9+qoqNx1PTjU^>+t`wimR(6U#8)`pp?)z1C_XgyX<)v6D2H}6+^yqc!f1bsm1 zF>9Ju74*ycqwd7%HvTnzt_En@F~ny}1~lW#hr}zKHr+l&2Ie_4i_aOA!xov_0R>)8 zwaT^Hxg4LaAzk6{0TDU`)^adrQp{CO*Y3{r|3OgbNl&;__OdLf`?rwk6mas6QlbeF*^?uv-=>iehM~#gPo`w+X6dM zw=TFvI#V8>gDWXPKLck(pMkkxGaX3{cBW86KI5*@v!8lU`q6k?f>+3+kiS#BkIJ+t zJ=mEwT~pkSz7saAzZQ3WsLGJfV8)$@!@P=<4mGqF^7g0s3qZ6Pj&&Pt@_9RmC^Ok# zKwoqQu1U?zkyHgZAr6c}63?)#M^-&2O9P8cAwrnxb*n*U1L@)9>s)$x#?Cl;`k?7d zfrmra9D^B)3}&t{n6(Djb0cmorxe>`rW8Ey=RZBA=sO0ACT{YM8k;<$#%9l`ai?e0 zxYILg+~v?P{q!{9E{D&lex($;#o@E3Uxo1>gvI*l>BHS-`k+UN2NCMb!MYHY_`De< zR-=%56nNf@0zU$+M}gY82E+bEqgLs;hfnvS(WS#b8efDHs_GCr&WG(h&754mw^>;m_ z{l}jx+KdI-jDMvWUpHoa0C{OMzOKzU$eB_L!zKR042{mzn+(N)aga0ZHd4RT7R#QE z(POKjS(n-T4)0DwlRKN=?P(hx(l*R)Ku+3-hqMuUIQj*#c?cN2cv^4bQKMHaQfs}A zw$Q7&g(hE2GkWouC9T)7Q}wFV_Ub{s zzA$=~LfUpi^J$vB3G@R|8l~ct-TPC8<9)XSVB;v?!!|w{T(c3j8yBA=A9>>UBQELxBkxV%q$;lc@w$DxdwP1tVP+U) z*tEeBMwW3vKvbfQf`Tj#I~tKe2E_#!0TmT>KvY~%h-(bUXvm9EOo$F84cs}Eo6Y6GIdn2DK*G3r;Q(Tc87>LqsQjQ zjn2;nA#+Aem=@+i)KtVaOwDcB4e@6+jG8<>XQ5-_=zM)ZPaHiY5F=!63w7ASxaB(gIfz4vXorg~ zxC;AL%cque&&L+++^iWXQW85e%&wigXzoJrapQNaEZrjWhqfc7WRdf z&Ax@0w_rX#PHdig(Gr`8a!@^dlb0j;nV+TX7kZM<)eSn?SWyZuxLuy7noYwl+6%)9 zOKV_HcYGDeJ*ZvVgVb%?*|^ww{z4uyZkFI%y?j<}oM^PxHzYIE7?D`%yH@Ik>ybmn3_X~_7q~Np1 z%bW9xWQ1EF!U+f0FwE6qd-O}@=&%WMm5E~aE{kK6LgPp z-s?NZ>k_$=(+FM#{1J43(^jF7&>merd8mYj3=JM=->2w)A7^dTOQlUH#WAAs7^XJ&y8GBX-!oO>U??iNuiP%{kyBmAh-8kt# zdflo>5wD<#F6qM)y=>jRa>vIhIAKPCIBW3T0Ryr&XfKHx^g zc*o&R=!K2r--lkuAR^6uj&Dqq`9HyS#oDfe5COsdkFcdU+vP{GXd%x^A^xmY|FUAR z!|^XV6!U@wgIilut5k-p7dYk?%NMviyp^D_1K`h1iJU~ zpRoIkCkCQQJy6}lFls2k$3EoPMjSFxzuT~PH2%2$fO|v>QJlPv5r4ItMl-q0zZcsu zW3PJdT|IFXniILNJJbJfsDR!q)U3w89h#-3r7N%#wQFK_!ZX}4+}{pGLv6iQZ$hsA2Dp>f43RP-*X=$TqkRFM_+ z|8$LPc>i~_tnBk0jFNk>&$k;Tuc4Zsb(HMDP|{H{Ku5_>SJ+Xq-H(ovXQU8+rX3~! ziefNIu&sDx#P5`1I7(JQw;O?+&1WU*#-gKF`CqoZhz-IcGwSt2=eynJ`>;d4ze&Cy zU^KwW09K>oafz;Lq*PaW5A3#%LCUd(t;$axhmH2xBmUdy4#eFPM`ylu&6x~11pkFpg_p=K=B$us?(*N8e#u;^c*XaphxzAI&o zM_E{)IM*g(IZpaNz9!1}bijzA>KH{B&YMxU8Gjf!$34gSw|UNC7wbGaX-%*P3>j0A zmtG_P>;=jA2Zn!02C7@}Ea8 z<`nZ`Uj8!kRvukpexFBoF~7*8tIZGd=$__#pff=MCm9dr=jgQIKQRk}^a{hhAnEV` z5GU(X&EIjhrQ6_k(26nH+(T zA3O=P(Z2knmSgc{2dFT8Y>q(44|X81(Y_fLNq0{iU3&h9@xD1F!apWLpAn(YjL;Jz zbVG!mVg`i95Bp>>E|r`kT@j&Ah|puSKbeR8ed7#SNBUmn&mdfh{`iBAhZdoSn4y|K zEA$BS4qFVxXxaa3Zr{2O&VvgNpE_{VwjhZ*;E0k4@Wu@mi0DxcTPm1s|A z1Hh)I&2_2|b>*JqM&2*end-W)2q$dk@l-m`Q)Ka=SAq5Oi;&kaat(%z#fW-UgIM1_<}iuDBs=8IsP6I zJ~R^NZlfDUjt~1&h;uYP9v+DZ?m<3_h+)lqL~)Mq$j``^u^+Wi9u@_WQ>D0>=!UVA z+xs)h?eiJ=jDYMQ%VFppXaC%bp%Zz( z7aOAS=s%8k?gclOh<^Hl;*&)5&)bTXXfM(u6wgz9#F)G?ZP)qk?)H!-*RFfW4@-iSFs=NlNm32g9G`(Q|u^Xo>2U6#rl+uZ&JKo z@hij{j8DZ<{FO#}sN%VbtBFV3zuJhhcPFqj{{A9;lHxpKU;Njl_$;xXG5<}h<=fR3 zn~2BY|3qSc{L^oM19e=~aV-K3Je*jMKkt=B6-^BP@$pQ=bWTYk&n(1Iif1TJRGg}K zwqm2=V#Ui9uTfm7c(dYK#k&;0sJKb-D~j6`pHkeR_#4Gn6!$8=ugG zK}gG<_rNEV{(<5z6nQ=&-yX$x6nS1_dw?{r1U~X z+9Zi#u-u^Zt;7M)TWQ%l8tI#r@0%LWcbmEX{8H%`iO9!yv02_;BG#pMmF9IG(>>02 zr1QK>x?JgAMDQO)#CkPI<3|v|H&W>{lpe4245iOedcM*ZDZNZ-zN*D?Z&18LKyT7#Uie6pk>cz;E_u6dXDkOEAr(T(q}31eFM^$ zD)PM`(k+T#QhZqPQN`~lKCSpG#g`QStoW|tKNQnkUm^c+#XgF4il-LFT(^-=)^qTkru0kqeMv*kXpNt!I74xP zreCY{ZA9qtMa72|pHO^Sai`+jitj1@m5BPyJPg=J_iBb7i%A2QE3Q=hmhwHX^h-*= zsra#Cs?5skO@#b9#S;}zSDd1Fo}%o%T!-s1rDgAB(03^PCE`(7=al{?5qf@G=^rWm z6QzHn^zW74t#rH6?<>+C5cRB7?5#MMi1JP*qMW5l->&qRlzvR{`-(qT+(WFv^(+zc z_Y)!K6Q$F*>0x}eVqe7}MDPt)nqRY!K3(Z4O3zUGe5Ef?dKnSrUQIk2dy#AWIwIuU zt@Oi+TNQtx_zNQVex>wFO24Y~n@Yc<^v6p7L+R2ATW%$>FYbAWsAnw^atA6sLg|r8 zpGgFN1F@emb2R;8rJIShs236PZqoEymA+T$2b6w<2>!1VkHLFb8vhItdOWN2?}`0! zU99oAOp|$q)1)AlS3yh{LEd_D-rQng<^~1YQ=R#TtD5dcs~)>MH>`biMSrxtoR7Ar?nkM+)5hP7jnG| ze3CS-E4C}{AmV)gjN-Gz46ZvAcM?(m7ZhJ4V!e4qaTgKu>@~%`#2UR11nwh^aV*!* z!2P5#PCikT>uHP^zRS#U!*}P{?|i?GSWZO$^FEwdO+3xAeWV|dznL`JXPu_sO+-7jD!rNL+6ny6lFs0IQ`6rj_Evq7F8ZRK zhEh+^avzL#;=6*R`Bfy_iSHkhUPeUwtWo-QBHF1{X+D2o`|zDa@^2%evd=30JQ3~l zqSCJr(LNUv(JuJ(RmROXiD(Bt|6=`*i2+gX+ljpXB%+?(d?4!ALhNnKOK~9Tb4mh; zdi)y^`tu7a>dp7usqac6^xQ&(e*Z;;UUJ<9eF|>l9D4IZ-#y9g=3F4nzDtw0-Mr&E z_**E2wvTqX@Rx1qZIDBhJ%{hJe2OIZddR1+xfe_7+*bCV!Y?nj1n;pF)Ug1|!FG1% z3sl@3pXrC(h+g;h|ExREb9;C99@VEcRQ{_v$c5ML!y?L%*3MK{6!lydW5DZ=}7 z6qWzhT*2M*53P&5i}WcavpGYrTnTry?uB@o<}RBn%u5#6)lFD>@Uco9@f&A2iH=3>%;Wya|$~zd}!6kQiL$09Q z!dwTJD(}w~l$1-+Muiaqc^jp`R{w)#uYd6d%Z~rz4L+Xx>Wep6cmC(*`MT{tgV^(b zF82Iq5F7qCVZ(n0htL-fTl6ym^XW70%s)hS<{$je?$7@uOPXKwX zLLMH>$B%l#hI+78F^S z$7ir%{hmbJxj3A2^7dK2pj=+lF@KpdIzGPl7p}+HY_8l+;C1yFZ{-E;%4^t5RTja? z#LK zrFNhnrcs`LDU4f|LmoOOk8KjJ?~ZIvKU}H@^1h02xc$l@k7Lp~C-2LM2+P}+wI=j1&Sk(UkW*I)UVZ$FN(e&<477IDrwdG8z72UTpq+E_eroxGa=G6H%N?SOj_+ykh0ARol^X~6t2-$7ecNwAxyv9g zqp}E2-kXvBrF}`3>s~u>e1DGgZ%e3LzG6T==BvYeg^EGB8z3(W+Bqk$#_|RArM+|J zAEAtnF9W`CebjVj?~#yxpF_Hn$7c^={kSWKTO%pQ$>Tc!;0wy-ht4eb6f(g%KJJYXuE&$1 zaV$ z0<=q;1io>d!bi0nhIUZxxIi~U8fAV3z+XiDl9LJg0|Br$yEO8h=m?IllX#eMjdOXfD$&8u5{YzD5Lo;n-0zOw^!-0%^@hf4aV z+kvU)#R5*p|CQ`LqRM8rQbho3+v& zB3Ikv&eb8gkQswKk&7}Yw+MB^6zo1QvvyBy{l@lG!`k*D^M$=*&Dy;zkM)Z~K6#zo zmQH9F*ivvb_0KB@vV(F^CiB+PHV5>UdZ0|qiw8_;z8uz#ZOOVBlx><(HtLniTALfu z@*tO&B4RgyHX1zG*w})8V0r8x%!)RYBX)RP|1gd93EM*u`wrj_(qIQ7C;O2Wj1UjB>1^o$|-&s6lT$iE(;+%ck~J^V&TaTf2Se%Q2E_+4MTz zu4>pW_+EqixOFJpo_5q^)zw71FnzFKxl= z|C&bm=o9QiyBp)ydvfR6*uItjo?^b`wu)x!mO*02WC!%TA2x}~v(U2{dbZ@oa`8Iq z`o;F`DA$cCVv*Ao{L~eHC3k-ty6#1puVGB=g1#Jw<oVL7TZ+QZvHoo}-`x2VoPTzzZ{ct3Rvc{+wD_n#d*)tOE0F^uIk7%!%NWqT}h z=dL)$ND6ZyYWu=7c06z_a2(`~7hTVy@f@2eu3`3f$RV&-MuC&13OaA(FALh+{?Ob1E-Q;+}IO6)obu->z*BIIgimov% zpY6+ek_!Bz^&W1WkdIdAT39}!=RHFSM@soH6ReWKkQkJ85v zmb4{IW>;C|E;(m;rX1%xlP*U7-mq=dKOJi;Ex)(DfBMw6p_ofJSF{hrQH!GnM+Qev z9Mw4RR*=|9^U$V{@j%(aTlSRGJ`&1fTB`A0jIY+V4C+?B6=NxbJfLH#wXnO^+QxPr z(Ykg|Y3thd;i$J;gK!CgQw{1-m0L?jVqSVLV{YDQ=ccOXE3G%aFn1{MVZOCzVk1?m=#~nPzoW^ZC5H*P3XY?*)$A6V#t~ zDRTK(cyDtmq>QeNgUHAry|4^sF~vc#qpGlJ;@1;5)7{Y!(5mQ;Nq(| zDr*)(;=){fWDNTj1Y2V8&4c5jGEF$FO%8@ya6n7=;v6IIT8H95(nvto1_@U3G=#*t z3?xD|roaOBHOLjJvE}--8e6V{trx1X<@z+e8bz;yTp_(I*Qe=axjM8lN|28bv?nZA zLG45BwE&qsQ;;j9m*x62y)4(K>1DY(v;<2VD#~<7Ladt@DFn$0vo8czA_o`9R4@{14#{ZiB8Iz0NS+x4j{K0lfUpYnHi@tS z2UVC{P*+YQ%v{3#5-ixqY(R_`g5{cqkT_RpEvPIGJ98OYfCH9smIG{_4&#DC$Yt{| zL}uiHFU|=kVHH&%aT!{k_9*x7c8$*_{!<0G~NliEkv>TIF zNK%IiF=?43@tKD>S2B|>#euP46LLziv8Y%9OG{);Ns2KGclGQlCj20B#b;HqpggbA01=iiN^Bu6lsNbXm>EkX&;SCW>=G`VgM(D7+Ad_ z*z6tphWt#jqk^HKI0|$<8UMvSWh>V}=!v6n2gH%0j0lNy zl?+WtEU@q~ixnHH$RSh=Rpbzj@=sLc5PESKp}z<~{HF1h(`h!yNV;%!Yd~X>B(Mso zE|-%HHrNW-VuSF-xxBTYG=ruDVn0KYoenJN6&#jg=rtTrfjVbI=MLk;36Gh2F-pW7 z4CkuZVHn&FmQSw`xtuTr#ktCUmNeg#XF8nBKP}^@t93UNp<2GVc0>p9p~UJAiENQ9 z4%@m6*y{e^rAVsAfpJ5yTpiADn`dHL}#N8*L83=29$V#OVlHBw|@dq6i6O0vkmoz9kLhM{V)aZVXJSL`7jqc*67=pV8QRWcLJHy{CnNEm3*>WT>_ zd{h-wSF+ayl@s#VpmIXi2h|aBaHy;V%NkOk5NxbYqfBaaiw2r#kE#L_%2{ZF>iu)yZdF zcuLRY?-9O*@v}0?cHn~yf4(Nkml*hBN$kAZWDL4&V;Dv{;%`A2`Db=PQ4M6nhE=K( zXi|OPd#S-JFLf$>KQ#k>Jar-bMCxkz$<#XdMW#4Gh^OlT{xEpO--DO((xU)k1*%l` zgpad;pX2Zcr1_!4Vd?Y9K$AD6Y!g%bM+6h`^i@IhMyBx(;nH{LO~?zGviR2!u^v^4 zkF(mxPfop#D3kgKzL!d}mMMNj?WeePMLabWej;@`{A6kt{G!yw@KdQ3@QY3QJ!BKh zTE$;xw3m(ptcHbD;pf<;$I}~0k1Qs=AHJA2Nsr3UEZnSuNq;^+C0DteM5${?EI-}0 zny@i#i>9e%Cl;H29HDa6;Cm7lHX6M$>0iK)b7)+|(fIuY0mesUG;%b+_((7sVSFSx z4{?-A<0J9IKujdlH+6(;NioW#j$&kL1pJt(SPzgHu+g(qpn~6MOU%)RMxL~?nGec>bvlZ zQ@??qPQ3}gB;{jfm!^8cKg^_m3vvD*;l=mBdjOF|cP9v2iWVk^0y!3o7MtVjweq=_%C2jJ(Du&_YsI6fHx7bsV8L0jz-X5k!HK4 z`5}2FPG@Ey-iAqj$Lmbo0?TVvUq|F*9LXmRZk$2d6G$Fc8!@V^5Rv$K#E98dF55lJ0k7%tojuQ5nJljR=G|}9_CG` z+KUv{E?MTys(Qx}oxF3a-Uq=|C|T(>R&n#Gg)FqQ*Hra45UWUZ@fK8Z+bAIp_b#nU zf#76FcJ-R8XtU)$vQ>M_s<^wBl+(>yZsN^oAAT2~TocbC;SUUcH$kXLelxifXj{Z2 zf9t~AN|P_R@VBc?dI|E`IesldCd~}k7tuwsV4dQuc={oDK6@nn7(#J|SaR{C^!J&v zgOSg{dj>~rS(ozIqT~z&S(#X~k#h+DMTlJ%mvhTdhL@z0EM^JAOG{0>1c7r9;q6M7 zBN$o>W!;v=PnNIT>K5l$^H(!ZTY7YUo?tyImE5wjvp?+eP7x+f0~UOz(0e_-in-as zT5HzmaPZhW@Y&fexSk_90fB0~{$pk$(CsJ4#ar3#UW5Ohhs*aKuOMI16P}dxN2HoG zUy}2=2=L)1`{3Wc#3(A(YcyjKNQ~OWkd(QGQM3P(WiCYU4F>K);C%+Zhrj^_ z{)9jp{71yr*LSfvGy^=+n?4GF9S3pJXP^#&;RuMj)WWITZ8el{vJtV%fj#z7{cGdW zWZy$#=@00!8*MZ4ELfUrMs|luvvTPlgE7=)(nn;p)#jazH+vAPy-=!6%amV6%On<3 zc&{7beN{+yR4-a1p*4}jB9_qWH}JkCBzq_W%OKlHEoLF02JR4w0|Zq4iO?j`%>D;8 zG%FMf>Fv#YnZ%MbMsLTqSO?|CLQOPI>`GvdVn{7|$p5TuAwx>~xKS#55-WSXRF;gTA#7z=~f%VLI4bQVXHt-541A9gR(dTuPM|PcSFp!890?#meOk=sF zwp^|drLs&&GY%E;++ic}FspP_KeUWA<7SfGj>GLX@5xyQ_FBzi%KCPx%v9+*dgf>x z_O5((3uSHTb*huIMdYl29NxLBZn&pwp`c+2k!16aM7lTo4(5NN7hiA{J)U4idu;;w z0;~FjT=a?Vm|5VzpZt5ISAXX6>|q`|PHKedYh-#^#tGkGHAqgpybA%-Z$0!#ERx3Y zYNfe%MUYbLdom>b^*cRTj^1Z##$W$}CxySy z)ZVf6sh8MNAMw0-)DMwWwE2+5_K)L_@(Iv|eVX{B(|`)l1A4*hx)4j$F$_#WU>F0u zZydz{FEA$}Q2ic+osEF$MtfBC2yk3r>FU-Bn*E1C2Q!u~mOETDDcAZ`cUa?ECLEXz z-CjppOOS>E@jTkBxFJ@`Z8J=omtj5r#Hcguz-4slcO`8*d|wzoCd1!7R!#ER^&&Tq z$dq=rPfce(%g*;j*FkGgJL!GjWA_i@)}GS+zQ_I_^e52L|8b99JSc&#lmQU8 z=8XLHyX*)^cvPj%U;mmN0tt`mfZpqgN=c6@fqvT)wUSaEOk0)97%BERNa_c`lR=Ua z^#*@{20jUl`=5-nn!y~LCycv9wb%Zy)yTGizfUaLb)*%esiU4;W>ADz!Ga2AF zATtoKqlGJtt|Bs8vO-VB=y9<>!UMn-jpZ1cf>pCS?6@r#j`ihs%-k*<4X6PI$m#6a zC87S8s|7Zhy<}kHl*)-DxT>&Sf`N?r_#(TcMY7lFy4qq5hv~vs(AP$$e6QQ=-!O<7d$^<-5Qy{ja{ z;mokz4%QLKBrE22Zx=$g0nz%9do>mw$Fm@Md$>>3S>Dx!iQ+K$azk z*Qv7P;I&Oza&TQ)&J_n(B@50dByhp$#+5|didD7ewka4Rpr-0ItnE{d-6OCnVc;F% zO|~O;iXE|2IbtDO1}ren@d`|FxB^Q#TKjMqQWS<|uBgejD3mzWmKf^eA#8+4Wxm&6 z427kEw+Jokr0Ol_&rq+P#%$YSgKl(Lw%IIP81s5n8j@!`Z+3THh4b9o4}t1E2posN zao!a6TDW7TQurIP$PM~C*rfm7i0vYq$Xm|1+4Cr`FNRk$1H77A!N3v()-b@6>)i;T zacWyF4%}j~{z;2Np8;0?0E{~kfF(y(7q%FiS(LO=lN5D6H7b^C+d+Q;x3p5RFUwyS zq{-!J8XMAMxjPB8T%V@Js{Ek2pyhI{#FynRwmu_Qs3pFvb}-{7m#8JeT?bud?JMoMqvEMhz@s6zddR6dFj29KhNY;HZ z?#X6`Jx{JPc-HlXOMT8D&+&3mIF8%(nSOsF%Ln1J%?HxW_VVI`(Ann0(Ann0(Anmr z(Anmr(Aj2x=xnoJWLo7uj=pe*v^8b)zRE@Tmq zxv&WVnF~iDz`4+M6#|?L12_}9a(6UNg|2U*M41aeL4b3?4CeiG9JL-x@pXPNisqg5 z3HG-7G%Reqtv)fsd+M%zLCQ_FH=Xy?)!QLhZl>`fx!g=wmw0J)>IS6y;- zj_7rgI^#u`T8h%$`IWcc*&J98_9O6Kj<3A za;mU&I|qHmF3=?teNv1ulK#-%#>++6NqllV@+vT5asAvb2uc-6+{ui~*gK^KNL_>D z6&ztl*>oB4Ef0eYN;fJpKV95{bUTAAm5yyihlUWxp+nayzWsZfL6@J6L+A24epzi1 z@APtV50;OuN9XvLTT-r#8RWE~bLBaH#{J)GjZnXw`q!Eyblac=+u6uQErAt0+JBpP z>X^~fCQO|J8+wz@nv^pX2%4`lhm!yI7%Frs<6AN+3*&DEt+A;=KizDH716Cy#HO0l z8U_pVDkb&|^Xv{z9Gz#FaN_9y&DIWGb+J*6RyXJ!F+e99wMd=vY#RPcEYG=C3d|?w zwN(&%P)mzWcXXBA`$b0AKWDkl$tbXUQ{F~RIlf>YCKr{r%ag0qn9~~OjBd#9eT|z6 z9DKr%DLFfqp#&JSJV?T@;e``m+OlxMupxsxCY;&;T5vf56CW9N0c{A2Y3#I4gc0q%nASC zYd1e07WpmC(XHw`BfY*iuD}=PtV( zqavDb{(O9(!yc9{6155$nzTGuE`j;Pg2I~JW_Ho`2n{K0Gnc1$FxG7Qu%T%3l^v>v zNHvNd5=EjVirhK1$rNr~(&2#-7>v7m{*uKso=OHit1_4`$&F}f5hlCyP!N&Zy-zM^ zR3lnJ4OrOkIm&KGXP5s_C2fQ%Vu^4yY)no$WzTILXd|rsRVmp<g#Eq1eiQ~bun>g4FM+I*hI&%nbwqS0j? z<=~bwaJ*}AcQlOT&2k|do4gAu6wkY#LUrd|R=6CtLk5R)tq6#2YeIFz`(fes+9Es| zwnKhk!o~OtU@0H2c@x1tKVSl3Hh&WzFaPpXd^9f8PBSYESBr z!QmY5A`A6x#xVe!3h{seLn&~)`z&a~b!^!#_F-7Jpj|P}!|{R6t7B#xo{h!LWsv&+ zcl)Tg9>S&FLG7Z3%%^g}uM>NyIMG^TsaRV(T1}NTQ;n{=T~EV?Qxnc`>d#>Av?4tr z(J4u5kJg@FkoY4c*1#5OB@$~^B`V>AOU;S~T)zg_;pxwjCA-QzIkXcqJCPr>=y^GyRWYloT0mfe}kD^>vuygmur`yj77b>yYKJbm|IP zVLdZZLOZO;4MVPPSzD_Qc(CdDXDjM{q(M|f!UmDhInq)Oiz?$2#qZycNW34(vIU8W z^bO-#~WdG_j6BTE{AD5_{u*RBAyiUzj2F%0Dqs9p&gh;|%ryC$`TJ+hy~nrohdX#XD`!mF->*AjaQ z-gVJlx(PN_6Y1E%K;nBaf{M0Zop?9te{yxK7Rj)hOM9b#xfb4C6!Tx#M#Z$i2I=o_@`%Sfq| z_IoPQeEVRkvLu~a&bE3=n=0Y`AfgxsU4gnhir9nJWg8L;)a4yS4~8k@?wE5Gu+h4z zeet01auT%ve9`j+N_F}q-(vwutCaLk*(A?7gu z#^h6oPhAnI*6m3uvmeS}D%0q&|6f;0SKkYfgAfTDv0n21q`&v7RsQ|S=xqCvWcO#p zYCNq^(tq)4%&_lZ9XJZMb|D3Zd9g6O3b8OLyb?sh$5K=8pNj>fT+&5t=$jNR^L0k; z`apWp{|^WNd^?Gu_S{wPqH6x{uyz#RlD87E19c&KDl!|Ngs#$8+hqoe4e4NbJdMOe zdi?h#PjEui!0+)4+d0}NEyr{Hob%1^@DMxaip($b=>B5&C6_+PtjSBSH$)hKk@p&}tQ|8e#Ohq1j z4j%A_%RA5TU%i~0YwpNPFEjthqnix>v&*>)&0Tr)#b$mUz1WP&qn8@~&6IPMrZJB` z++_3U?xt@ZeS|5^qx+b@<>}woq|u&3g97@R%fP=OpzFwi!%mfWH1crYddge-VJm}sbx)H3fsWVbF*C{VoohNPZ=@Nh@@fzlGlR@@)z#)7A@-ZdZ_`Jc zHB5lByAnxFc{On~e1x z!;Z?I)BI~BKRQ3;I@;q^WtGRzpM3Zt5N{2HoG(@ia}mD%*FT8x#cE+dB0qQ6%{kxn z$q@+orf-DqAE5_D==unqn@LRYgB?6An=h@L%i^1CjzGvaqa*a#2t7VRPm0jN*Vq#8 z=e96V8tYle`R2S3#q#Gy=%xsLVT8UoLSGu87f0x&5t=Uq=bUd=~o#yq>kmDGAG(s=Y@ym=%e>}84lKx?Yek4L;^TEK8zeMLRBS|N8NY^7=VXiaJ zF+m;EheYyMMd*3De%Sn1o5%C$6?r3^@|q+0A995Onf|v(efezyot58WhFMa4^4}7X zcU~laTVDR<=BY^j>mqb`L{a_^LsOn~sQEqGR(NzS z{mfkYXhiqCMN)I=m{wfxnP1Y~Fmw4Q z?UF%s&+C~8=hA0tyI}BCA-Y4m%(B-YJ{y(JGQPTFfKVU*v=^;XntzSan5V6 zpxv8o{{Bt&`l$c>oc@yH%DF(}TkN>*(7qSy_0<-@p;@-YsieDr&s9Q3o4kNzxJexuf7uI5KSO1q%{L{5{|1MMzyT>Fm2 zyJ80Q0^(=bzUX3U-}@B*U9nBE*t6+F6z37q54R|CH$Bo~ml*gr(i3nE963iUF@w+^G0t z#g7#EhCBIAQkw+W2D?XDKdKyhBm!btAugL5FelC&ptObuI#8 z9E~Jm+{`Cp9Na;~IQXvOF2!WZ#*a~4M8vodJFyrSVh6U-m_IWf$oB_hbMY|(@qGN( zp?HPj2F0fp-y_b$>uza_rzrCNkny)Eev{Y)d(MhSlvw%%#c7K7D*jyYFN!6lmcO5( z*foW`Mx}33{IcQ>#Wxf?9cJ_QS3E%6$sSbO5Y!#R!@;Vn8M z=sv_t>^&jr<4E6#R{%AAtRjY<@N=mq-vY&DiY0@fyXO74K5qr1+TPc12nDP|kBo z|533`@vn;bJ3;j6rr2Atzaqa^qQ3m3n<(ogkl%=tzEE+QBA) z6yr}&yi$?RH+cShn0S%3A3%IkR$C z$%^MFUPwefu^SHLhYr;9KZxTo9+iHF2)XYn&F>XRd&QQ&lnA<9X|Wp)`beeujW6Z$ z^H<_H#hHptic5(oceUbrjsGce0^ZqH`eoupI3Ftgrqb^y{a2;`u5>DG`T0DN<#$&U zd*YynD?M6qvSK3<`W2;jDgBnxVlN!!eXKN}w^E-{ zp5K6cC7xKTDE7iZpQiK_BFdeo*sSrbL|nH%s`PgipHcjsrteky01?+k#ih2qDkAi+ zR$9)lNFS>7cp^?>)0O5s_~dU?daLKiNFtWoDgKAzYedN1tMo@ilzUj2jXzxRNX1&k!HTC4 z!GD(Ge8rWDV%Hq?eTX#hX~n&YA1eBtY)IOBX49H4*i? zPU%~fzC-B;lzvd@N0t7%(mzoAmEx<4?qUefqcwh_qS!HqK68{_ zsC?Hd-lh0$#ixmo_Yo2IZC-_?J1O>397II=sY;(s#C7>Rr56)X?oy?1(DZdmKS;#& zyVwy&d0R3^t(jxf2ef45;Wvg5OE*SL+O4*@C{IU1QGWK zrz$;3)2Apshlq>QMH+vlVvFJ}iVrJ(g9!fTh`8VE-r3^kh`6sfg9yE*5~0UTr7zU< zWklR}T&M9j5y5w>(hq3*Bg97B&uID%#pg8sH^jNdyi7!SuWR~SO7AD0kFVIPfRJCV z*iEsI;&{awMDWj6oJX98ZCZ$se-#mOu2uRLrPnI`MWr_?{WYZ@S9-hRbBZr1zM=R5 z5%T}4bWs;uewktqBJ`+L9I7}6;brReV^}|4r#9l>Uy= zKP5u`?==1u#WyuR-4*GV;C`Bja(gNstyrgcyy6(eNs2QS=Mz!R^-ABN_@Lrf6}KvG zCxZVcioa8QNwH1wJw-l{;r(fvh;}}l2z|RN-H&)7K4(+<1Wo^((i1iP^GaW>h}%Tb zBd&_7X&4Vm%NB;{ z_xqLJKt#VkqVyIb`hADe@*HCp^i*1&TcF?Nc?HUQoAK!P{hIy>5&cekcht9(crNCN z(zQhNJGcL1`UoQWeS*>rMD%-;(hG=<7`IBd5a*(Om8MNx_WM?)WjjUm`wL3HNJPII zK0iQtaU%M=T4{M+g8puy-soq3cFg|$F%kV*#{B3{ex1#EyO=o97;XW{dHORV`s+0! z`sr^(^v@v5N57mwM1P!5L_cgJqW%9yM7vkSfoShKBHDQj5$(H>h<26d5@^qdNTVHp zMnwD3CNJCVVS%I(?y_Y|E;|46W%HN9g8BSQRl_B77hT90tMAff(T|VvzHX6x5%cXG zzKO`$Z!eq_$?rZ#$bHgb)nk*@6-u=Em(4w2TD2exs~0K8>Jt9ABdTYIw1@=i(t#(? zvO`KFx9yD%T$2AFX%Pu5Kkq}BTm=dz70BP=laWF_N@;oDmE;%HF{wa7x!$zj;N*)a zm>Q8{J1qC@O-@3=lt^yYft8KqFTfSy2s$(pAIWLEEW#7&%t%Uy-2Buo_W@3{ZjqEo zZdbPmSD-oT9Z4%7A;J;lj>JcD+ImNLLiLWMbjZzmhrUIMRy>*%$?s|&Web#N)uV|8 zWdxs!xxfPs^aM7X*7VA1(fX7wz&|ESR@IhIK zYySC{Ul^tjB0H3$0Eew+j;BK_umbuan$#}B;Iuyki&Om&ER=GHWUHhyxVB{;djjPI zwCx*F&aNJzZvYQfgU`SgWeLV&C?TvKqxos%oHiTF8} zUbJYw4s;ou7c7~(F#IWO?sA4}M{u1(o%15B77`V1x(hF#yQIm?lZh8D2J_h9Qy%?B zrw$i3xMDDMORri;teIOkBcDUgxqQ); z7cFXV`;ou=UX*i)9Uh{)6iV7tUNSnZ+LhABsu19#_Sm+3|lD zT*?QodXX_*N&?d0HbNXO)g_F}ZgE2u9pExv+_+RnzH-L|bbNe&0YwL{1@{_=GV5_r zAM%mzYvnbsLYQte4#qp3oxDDX49i;sc`TRmaO)7r<91D~ldA`AiA)BEb57n3mM^~>3x0M(4+qsa}NI~kHyj~G`dqeUn!RzFG5^2BfsvmjioV@*! z_S+wlSEYQc*OOLWpdX(*ETABDPTsbNycF)O-8jXg%s@ZB4+RlH`waxma>zsHKJw5x+1%7WtY3Xd zzn;p+e1FFzMSX+z%R*jwjdAk+3cj$sY)IY_A$c!Zd4Yb*R6p|2IeFYwJuI&wBrl_U z)Q^iuSU*0`Vf#Ag=TM9%51o_u^N754A$hgR$9%6v*4_)u=3jE4OE)+$xM)<{zZIj;}gW z?$%Jbbt;efK0;@N`-9KvT2&Uo$)lZ+aDVK8yn3W_z7fesdE6r%zo0+1tA6C6bMk%} zk+(0T-w@@aynjP}um ztB1UD@UgzbL-NkD^$qk}4gpRE*n;r*NPV-A$8sregz}N@Z{-F0tx)~QL+503|A}yY z$APH?rr(b16 zUU^8~EahW;Y1SsJ-*(W2)&ur?Siek29{$b=^y4^(yg(aLykH$?pwN8#T%=sS zcS^nIvQRizF5e3cm)j63_k87JzF*k$Wl$~+7%itDbxz)n$a!_0mfIBJ&6P)AYd*0!4n?vO;P(GHs4V@eA-#FT7 z79-R-d210Dme&G#wcz3Uaxo6_QQo5}55 zWA-5<+ixunSKp}-dDW-k*%#X0Iak(M5qTLbqWi%_d3WM)@?HlYnl*4c$KhQVZ3DMX zmLpaE92!zLuWs?N8M=D$t!Km5A3k)bL=M5$v^J(Oef^jTr(<`tpbQUZlpKXI zTe!1tD=%+tJLA~3drW3+d%T=SYg@{!ZBJxccb5W_rge9`zIC_oLl&N{wspqivZ}_l zd(N1%c29YxwQbhQjl!2GZ{0m@)W-IP^&8vCFL@DH3|Xm=j09w|T*qT|fo>HW+hNyv zcigmkonKuW+jrZ)rG?U*Q36yXASBy8L#)&wyfO~Yi`}`t!v$#L0nH92D(%OQ_w5c8=pWm zXnoDy?e(bdsi`?6%3F4s^40B8Ui4e~>V*w^@Z6{Sxu`q7ZfKk3ZEVLWGwo&8v?c1HXX77V^XjMW zi8Vg`+TRWw=-#t=?H;eOwXL*qZTs!!zP+X%eHL5$MhyLMV|LZ9T9jMfj5y?#c5SqM zR*5niAsb_&jeXcuv9Sy8b~@wQBTbpHs7&OiTqiFl%e?tu<4t>{ZMDD9&)&p8p}+35 z{l)sH(T_hra3K8vc;7p4;LSBUaKCX%X$$-9_MH>=crC5FAF0^XzO`XvdrP*gZQDBN z*Ni%sZ+hKtMPHtE7IdACV}1J?_LFIC!`Q_bVH=;_HVqg<``hu;&^8fuNo`#x_qH>g`h@f1bb!}q^W!+To@`jVhjSDwnB?ng z?%B(+5YCI`r+byz*j|+ZU-^wP9>eJ^rmXEir?c9U6I&`5KvqWQ+bo3L+zZOa>-{a+ z)q85nH({)D-k`lPcHLaOeP^z3??&TS;mGJ5-1?0^(x00!4`VH@y9d@_F0LzU^Bd8B zn>ZIIx5YA$S^tIh=Vr%&iR1XiGL=Ts1H}t1Z>s zx;ukBUbE>eZH9ir{d0QYI;6R{rdHke!Fn|2h&$2vPcSf`yRJA*#h@&)L$ zwPaVq6z$@A!f}FeBWqv_^7e*&j@#=xt=*H&nB$5eGn29Dt;`Eu%eSs=FM$r3?8f%< zu&$=fwB2#&nQm@fnSeazDau&Ain7yo6*b(r>jSO_D4*j@@-}a5-;c4AG&6S>WieK> zHg5`fuf!5!Z=%wal2L8a@3yv2z$+= z_MCSluw~Sqf!Vctu4C9__i#?7nmMm9p4Q#6=SHBLJLGXPFN4fXW}~!|YyV3SSFUwQ zupN-jGF*Pv@qF;O`Z^x!6XwAyoZUx6;gG<_m@(rDKt+QqBaxrH>G z#=CpjX?s3I+m2{uTTb7dXy&-WISzfnF&6Yg!}MJzL068i+J?35Tua%1NwnSa#&) z8Ei-PKl9#$bvl>tkCA*o%gc8w)^hYC)?`E6eICYii>@vEO)k7V6dr+aR(aeQE6r?b z=Nvllj{|R3a3Dwqx^RXpXw;Wrxz4^H%zUNX zgCPNR;S3`Yhk6rUliT;x6wC9HZ?1hU<`{)I1m~_W=dRcx zI9~~KzH%te7sH(V=g~UXUMoO8kHa(PP|M9Y5LBk1L)qn)Yg&%0L$|Z_*5R;Yi=hoT zFiW-rZ1x6b-ynr_m?g|kF0@k3CRdCQh!p3P4slk8IjcKND01p}RT)8@o<)RJYDO&- z8X-!}SO!>bgV78xBH}e1F;m~69P(yxpt6J~MMA;BSt?wU36^UXLgHNQNU&`&83?VA zWoG~r=)#P(pfULgR$Pa^8;PW$kU_PH9Mc%FRm5pHpfW)|3PJSU2;YyRP%SBnttoSb z0roM}ba^BmQR1AI%tY1DlRE&`6-eBEs6+}lXwGeiO5EBZk&Vi6fr=BTJeF@)2gKTf za_!uTh^;uV(s9t(3>`*4QcM;H1e^=7P18W=iCM=rg8#qo#{mukT0}awq2OrBf&uF% zMXk0$0vidUYKgCi;?t`jN=v9ErXbcc(+PZ#E!@CQY&2wua~(j!4#_EmEDq1iVyT~q z_*qUoVi74WoVOY=7=MJU1ZObs3zBz6E^qL7#^vp)8Dz*XODhf`Qph_NN77tl%DwKJ z7^a|7|fXF4CJtI>RcxX9wvTqr!uE=XAI09F^aP z!%`B0Oq}FiRM7~!hOj(*|0s(C2?T!b#IXpt)CSi8_%Rb=Hvk^7!Dj(nz&U(^4sBq+ zvM~yrRjDUC4Kr_Rf@)^LCj`Rc!tJG;Tf&@M5{KY?B+SXZN31I#b90z;^PxCf!(?5;tY;@wr3QhM zOG*%zkT^WkPa@tF9d5>T_RB1Lsty7xliBL~PVHvn`gI%E`IK&WW}Gmwt~P2M9txyE zR_Dl)p?PE}$Pn{kX_Uxghv2APk=UxF=a zMI9B@PSRNUnxM54lzMc~yh8R3npenv+Pn$2X)SBUK1AITtlKf{DORaJg)lGxJz#7P z3=A|xyA2AOHNj@B3kC+#j_r(kjf7_PxoX%-4DRCfL;R2~=mZ9ilWsu%p}B@)Gnv1Z zb3)Pa?uBP|H!B_@3C9yPzwHOZ$uMRC=W}~o&+iUD<{ty!_qo8ueV%v|{yFfI{-yAX z{OjPS{B`h)O`QMg6veHq*dqTch&BHA;Cnt_oQwH;;rqUiWhCw&0YBlN06*zZgJ0zH zzW~3d|33U)K3}Lf!XFC%NPimq zjDHFI-u^21ef*8^kMf^{U*o?3|7d?7{JwrEo)7l(YvI@Wr^7$SKOcU7pMMh$@b7^? z(C1cIgZ$^<*ZKI*!5r(C;0aW{KLGw?f`S8d1*TO&Dr)}&r{BOY@>pus7oc}ibGktE`Ki<#4pWvSef1*Df{v^K{{#iO` zVo&?rwb1yqsO$M(hadBQ2;cW<969dqhM(}?g`f0&49OzDEButty_<@C?r50yC&MrC z=fW>Fv0tL6pi1yrt z#6K`-cYS^lDcg8qeV)uWj7DmSzkWmPb0pVYhb$$q1V4(@`Ul~c zZinC>FzcOE>ag>f@=z-x%Z|rL9Ed?&1YO;yRK4rMC&jDYNBBx`CPt=A7k0wotC`y~T|Y!hs)!4X*~;Z$_DAfE zY0?|}5GlPeO?sm@(igEUrhNx~@f48K8`GsXc#$N%F`eyQ{4hLe;2CW1;^iRkVBQ&$ zItgTqeKk{3Ye24H>P)7hH>w|H^PjUFSwYoa$h3362EUZ66}Q}qpG_4@e~P6s7hji^koH` zvEmX)HI+vq*pvO#YX}*xW?d~4(=8`k&Qy}Ad<>Y9A6C3TE)h_E9^Yai5)AcWqEb-a_N5|F=9LX74<^4CvzN4Z2UM6>v();r5SSG~F zEX_ya(sxNqUya%fW&Y0In}ELD{kE93tB~6DrS+Gx5Pcrb4KfT$r8WD04YW)!<^MD2 zeVoWjf3*a|k@<@}_Fvy$g03Wen8%UYPu9{~Jl+S_W}(0|Oo>`B#)o^w$9U7GBC5YP zeHow!H#WQ;0n5ni7-2k#j5EWGr{yu?cEDsQ@j|b-`yv!S7Baef2ry4~p4!es;25mm z7Xf>WL4=fdI|5SPfZGti10u>ELxATfF5XvxJ^*^J&~CwIEdEY0J!NV)U>P@M13>Ro zdi_94bA_W6rgK@$M(C!1#*)GzV%hj?!Dh43o+&#Ux%r$Sh{gahWzC4?BL^-*JOwq# zVl^3QTx!U{(+aVRDQEaCl3E8+&hU?O-s23v*Pej3{s_f^e9@k9zNsht>I8@Fw|4OXc1hYBZ;q}r>4|K!p>;2A7dyswta zg8OBhOvSjd7X<8+D-q^t#FX6)dG4gnF>xy-KO;FNYyUBpdmz51a(Jxa8D@%Ncg~3LDFkY{VKDftgS? z1o=1>RSDDQZPYpTCGQV_iX~9URKAR0&t32a-hxVIVpZOtGy?4ISU1lM;$WCfqNf)h zltthYBO*n`iWa^2R?^m5+tNyVsijmat+ZlmEw)&#S{oAL3+gQ@ZEfqV&-c6b z+A}AU3GLJ0z0dFYqvtbcfA`vZ?X}ll`{kTDFY8PPv6MNdy164~+nh7q=t%OjF9KuS z!jX$@PPtn&as`O%um{d{i=8ZLAP%yh%=#qQ#dqexf~$~Uyb3`ujv(7DxSk0&As9t( zn5(e|a@^6xvK=ILyZK)NIt5=vI3fxQRt7F~M{*Ew2m~ge8Pr@F0B!QmE|>z0h<$&loH(k+#yOU|dSf$E~-S>YV%`INU7{V07o7M(qo}h-mS{2u9&d|r1Jl`ZsWzwDO zEwQl^eVPnkF|EwvKMVe`2wj-^#}IIxEZXN9ESB!H)DVg}qc~MKQv$2qRC>ZU%qpEM z8jf~zmpKiPasc~wEGE2<>EC$B<+e-Hd5Gc0lRdl5sGcz^R(eKk@p8C>ior|K>SZfe z#Kz!b%cI7`N|!Ic=Bkm+t5#mow74Z!UOr}Q#o{IBmX$S)J@?$Qip68boU`PdC5sVR zRK9rO!m}5iQ?{^a?BX+=$>)#0cIB!oM=xEt>Z+A1u3Nc!0bLP{eq-m(BYSRn{hsf4 z?)`k{6L-D-#V?N@TQ(NIF=eCG<;3Xa%NDI#xazw3_Hj+fnon8tyULp1UDkXnYyP4& z%a%7Tuud$X1HU3Y@|trOI%`(YJ4jPw3?F)RE}A&Gs=jvCf{UsaTs-6A$$t8xs$$T-$iOO?CWbA~bh%v0<#4J+FiCKE+&#tv}@3~~YRB?j*9=bPK zo~<}hM^b)<{3=Yt4E@983}zSZs>wZ-n2fBROPzIsVrOM4H?elc+$qy$Rc9)f%*#+; zDsRffb5iS=E=H-`?$(}AH>sRMKI0_fNa}fh^^hgq+Pze&+cHZ{<#TYJpnMPVC)D*k zcTFDTX6Sdxqs*T2dYG?CnHjnxDYK_Mk(qIJrNs7}Ef(lGTZCuoX&Q*e?IBOZ_K-)J z8Rk+_+n(|$v!^`KvwKG;Wo8%zDZ^$cr-#=WQ+hnS_K-y-d&r`W^Xg}1njI{aA!}0g z1pMH?$(}msB(&)Z;xlS58FN-y>YPOx?CHVux#>kE2OXC=hk9hrq4Lw`#(Nf*G0VtH zWnDA_Yh2eeGN$;ai?H~|x=HYLge3TFY&d+QO%nV=MG|J!*G-;~I>MV$zP^_Pe=isg z=>r-%*>*|ynMvum<3IJB5uaQ)p?=zoi@UbBYVxGIOXBrOS(7g|v^}L=+1#{hVGB;w z7qp~KX&2)R*;&2p(@ji7B^5whVBxC8<;F+sTIV|FDtH5%P**qMk_EG-T{?L|{U!0q z3l?Hs?|*knipYT2)A&n z9fg*Kmpk;4=c{J*iZKfoty$u%hKomMS&O!OwbQhs(OK1$s(c|C>0^&Fk`1?sw7N}P zysUX?(<*V62v2h>uUgP@U2~HoK^hCwXvUR|DgSg@nrXFSauEE zkAAwzS+acL<*S`V@JM&1Nm#USbvHpw^L3S9xeO{VYjJ!WPI4qT3mY3@%f`lKD=v3v z1sh+p0{`C@H?3aX)F}VLFkn&%RD0PqR^sB8wdpp}anN1Au46$}LL%&uE(56xP)V9; zS2ZC$J#kGl{wQ{{&=R;ZUcEG(*FT(=EL*;ugJen5Du;hHB@kze%t4|su(fMoY@*fX zs>bwjke-uLQh3n;T82oIExl^tVu|=lcDEatyV?v1>?av0zLIbOxvFKgU%xb?pj?_k zu4?qNck!KQryC~P>ZJ?EEZ{nTRa)PMlnL0_v})NkO$)>|X{wh}1(UKhN%&>;;ox^@ z0slO{w$W+6wvi@Yxu&IgO^egC7A9M>Vi{6tu`bh0X$-Gr*RTi#5|-H!DaU}UE zH+w7}F9cQfE+OBo-Yvn+q0fdlW!;>;F{i3GpRw%1%Zo)l@XGb1QY#e53raok%Hxc` zz@`46b1@|1E!w~J&Li+z6chdrt`#j?v3U8K#-{l?dwRO;v~npfK&@`Pa`Xy}+H0Cd zpEYXisIy0%GkW!Pt5>aD*)n>~>Q$pv)M#8R8VSFpYu1irsrgvhSN9~g`xU4juV%pm zMB}KXY_3@-O&p#}Ilfneg7MAl8nu}B-FUb(Jjo;KnwDkDwHOX*CWd>ZPKf>HcsIFj zC=~Icfl@c@y>op{C_n7o$pC99Ae~{9tvfz{Xy9K z9kNmEtM1;g_uK3D2C~sVDbX)FZYU>`{pnEe>~ljoGs51NZm6NO!_MBDrcDp!d-LB% zH8prxZQ=%2`(p?3u=hi7odaTTD8D9@vp3Wyd~?|Q0TRLTQ?TSs3uUA9MwH!)vU_gW zfS7m0sR?@zmT9nF1k@vm3QL-@Xz3*%Y zjrmj9yVX?jM-&#$uy@-H**n?3kDTmrVQ=FNw2Jq0R`lH)Y668_8v9Myv0o%GVqggO zr~1`~`aTiLxhXUVH_*b~Q!pz8{D`*O6FRLrlwS+#`s^d#lSs;`L3}R_^HVagUGIba zX0#U-?hQ?`(GA{rU~gFAd6o)q@E$efA(s}&ZV6o&-W>KGW@X;XZjHq984KlX0P#Mn zc+G|OU%DRM`FqB`$XFX=ttf`3cDUI)(ckFHXqV<~47i~I5wC!`Z>rlJwE&HQE`1T)xnVr##-cBPfZ4xEnZI7Yfe|zWqv<)5v6~ssB0eDOy$4I={UFr; zc&N{`P|g(ZXY8w|GvE=*gcrU_}9!D3w4`P#z_CpkTXvL)%uz0Y4?-VfzZ55+jt zYtRzTpu5&%Fr$sfVevCC>rSr;T~HGm7Oo8qtq%2@9?F|q7xp%p)+O*vUnzJ_s|lT7 z6B-JhAFu^Kko2i(`R}IXC(`77BQ5_zInbCy z%Ilv-yJ_~Go>vv%8Bl)jh8xe_3NQjLPb=>eFZF*c z+$NwtJpU>#cH~``Vm!ICne@r#?Ze`M#usPt*?7#K=@@PYiA82kHQ3>Zr~0`K@5S>o zAci>~!z@16JaSo#VY!F&DY(rGg^I^w94c-jLLTR2QeJ;BW8?DzabWRKyf{XLexk=P z^FUDX>3Eim>9_~_5%E;mnDR=@>n6o$+&t1T^Ijs`v5_=z3vq~fk%aYg4PgEI6!$Aa zEC#8B&T!mMorkFK6Gs|56pu2`g%sm_ya?rrM`-D$vAgMQKrgZ5QqV zBiRX{|6m$H`mrN@hvGiP<3#k!sb~jrj$*6g^NOX=m-%&y>l7bW#9s=@m+x<;6PX4Ki zixj`9cvLZjJ|f=;#c7Is{+sDr6~CeQyds+61n?vvk4OQ$bWxzlAra_@C-amZN<`*p zrDc48AAS;~+yup`iWe!)QoKZQfnt;5a>dUm-l+Il#oHA>uXwNG4#lr1enauwir-Uw zLh&iZXB2;__=4gqiiZ{7P<&VM1I526a{Z*eLLBEnz5qhxyDdaGcMv>TahM`s4q^Ui z#j_PJP{cD#l0Q}PBE?yXmnbe!Y*M^Z@oL3u71t}?q3xY&zN};Dp-P{o^cbc20ucEtm9A2H zmf|ACs}&Q9pHsY-hwbHYco~!f{BG%ItntrWfLQ#%KXdnG-vYq!UevJq_@ab3L zD~j(a26Uv< zFDrdi@vn*z9;czlK*ci@D-^4UsIOY-dZp(n-KaEQF{7LorPnIGQR&S}Z&P}^(hn*9 zh|;^2-lOz>r4J~5Na>f9KBDxSN*`DJ8xj2w)botNM6_e1($z}OQJQ`lnZI0djp8Q7 zI}{%zLhi$gk10N@_^Kjbk0aklin)5;GE9*#%P~K$xJvOR#chgTQT(prkBK;+dzJ`$ zzet4MuPDtoAxO)467v73^j|bTh_#6M*+k^`RhnfBxl)hJKzP87DA5nUz(%)112TK1`@mV6;|AHdlLLDhMLxz&eLhyqg)K;*qif1JZ4`M%-T9oX`9;OWtMOLAVth!k>jxG8IYqiYeIR9e&?=47G%@+jXRBbUiCy{e z4MX`(qkN`OzPo6?vM66u%={5V`F7%oK9I;2@t@o1Rt3N0Hh(r=%HYDR8O(#r7fw-mSb}BCg>W7x>}KWd zMF#MECaTryibA8 zuU|RjC6G^fw4>GU0wXVJzgA>WH*0IF-??e>cKh_hAu=iN1t{m&?-2;#eFeMOD6i%C z_1h152f#%AaJrC`$7@CSCH3Qf4(dl9ZdTrx)8uWLlCmGKJCcv(9x&}i%xrwO`_DM$ z+YMr5+n(0m2O#elGN~U7oZSwgxX3*x1M8re?+FbJaSuNl3GppcJLF?`^Js8(%C-ML_U(UGSw%&R+dua0zZGr8*44K^{HA{dzv)%8;HMkD zcLNRL*SRBcV_run4qv)=%z)qEyF1|%S$x`$hyi0;J6k|EV=r^+I_N7q7~KkA_gg!c zJGXaktWFC4YAwXtIKY0&w{UF>zf(&i;S+VY`+zMj~n4PI0rt1!zi~j zia7jR?+L&!wsS|DpFg{@_3-uJua4n+0N|@dIoAIY>c5t^3o37HD?@$3Sfc$UBI<+B z`i@|$@wM%s4y=^}UqZPS=u{3F@FU#m!cQ{zJ8c?X7O>;b!PC4m?5VS%o^I z__jhNbc9d+!R;S}&DieYC|?fQ6=i5U zc$-l!%enncwmA%b`q_q`@%COZZKsyQf2Dz}E7^CNj(ao%n;{RjZ>O*O1bpFJoot=> zi!`tl-v=mdzP-H!e*I%(9_*yP4*F{k%H8PP{#JS!XJTGo_~`FTUD%#vKKi{Kc7m@7 zjK!26`Hy^l3K zm)WwYgJbx0==59ouO302T3ZjdAkO=vyLGbfdh|l^Wxow`EVu|`I*#vW?7}>Q9o=U5 z3U8oq{ChgL!v1WV=(!bnL41z^X(0!`!J{c(>rTS-=jE{NzE+NnOFJ%u9{VfdiyU^| z1N#Pd-QF4B#dh<%4;W*W#xFd_!Nn-&lPNyvnU2HAz$n_uJZq~-%4_LQC{Hi&V2%pk zvhWx9&uxJ@T>oPr&m_e=9c~F$Y0PeZLobd?2zMJdN`+n-vfa^_J-CmoD=lP&U(U? z8{5LIHEo{LirYfXSleDypXg5yaMOIE)0VXFPRNGcJFs>hrTr@#c66G46S^acF=Bm@ z$9-|>R~@U_@B_TfH&%JBFb)E_?RvCC#z-T^$i@j~j07t=F1B?xU<~lP4b&a&NcI=j zhlm5)F^_Ydwzqbi3cFQ)aYtvY8Eey>J30$@-QHetm6-5TkmM&_d2o@cks}4 zl>HQT=CD7oG|p!KMWQa+2ibQ0#klHpm^S1-=yXS0c*52Wqf07;8F_ueRju-==WBY!7^6YL+Fo) z+G1lRbU=G(FC5p=p4N^m_7lpZeUbUT^0nY)K6$N8#m3r4Vf0a>uaD^WVubFcz-;Uv zqQBn3-iG}UcJzZhkHKq1>#%d%^=MII_@?Sjf6jA5xlSw=pE$j0%Gg*b->yC*Htf{K z^J92Pgs(9;ykY=IKE-VWbPNBd^5YX`&6+!-t}0y~X-6I-?^g9cnUD=WyB8sD&#{7t z+r0$w5O!`br8ytsNsrwTE%fa?|6~?7dEnhdPZ<7h@XeY~TTi(?q0!I5J3aq%TW-UF zKKBgnef0-l`)+$KOb68y(|&O4hOY_daN&WhMw7HHai>MUJ3ME1eeJ4 z!^Schyd#52ziLp&L1PNcNfk)`>+q}608Y5OCh)Gf>wGd*;FCy{%@*J|=9~^V}w^CcQT0@x;1*0ZUUn&HzLcI?0#@&RWD zYpj$hK}u^(4hPE%<;s$*LiEH5smHrW1$6>m9Kd}Vfa-}Cm5xZV3XzGEMl&AL8RL-> z#^MDxV=U>{wa}RT7;`s5Pkw zW%C!{;)jVusFr9w!4#-NOg4XkLZo16CA3KNlZ3U{(bV8NpqV~1UqyS`q-ot&+){AS z6lN4LHXplw(168dF=S+$q{mwUyG(R9V4sQZ2OKidR{_VcOF@pCC~6jhkz!FpCUlvJ zmIG={bUENz?842+L6dIvmvlD7n0+3E%Vv$j#!!8Xu6-^eT);DYoMkDpxY%Pz5w?O0 z7Rx5GRt`D> zj7QKY_;t8Z!wi1gM}VWka1p8{I9ZWW1k;Q$FLfQa;tQ zlYYT*={U#lY(8S0&G)h%=5u-HI4|W0d|F?+0>`snDUa!W{2tSz#@l;-(k(f-3zBZh z#oK$|bf@XPtc&`>q|@|Xbei5T=`>x){z<3lLJsizq%Z2~4*n$T4jxyPjLYw z`jdU$>rY9!R3DsjkZ%3F$BZlcA$~g;=jlVOTlHbd7UNGuNwUS_i2c;0!I5`bN{A70 zda6E?P-+~qpJ5%c52pk8l)caNdy5~DZp@?y`jJUvijVnGNn;8*I%!NH9l8(=%3up( z{P7NoU8q|nReig^3xdD_Z0(=NqxMzc#Gd;k^f2D=vk@pbd#ZVmM!jXOmvm&P>%#P42eU9<{9Sp9B(2=wgS%lDy$P=`YI}!IH zJRS!leC9P2X-622{5Qg^2+u#VBj+H@iSVyRB(e%&uL$45$&K(?)4a%22zy6fL)a(6 zr%I!dLUd(*q#R*Eq#j}4NDIQk$To!iBD)dxj~qfcAo6E~MG;(db54qkM>sHY8Nxx4 z^$3e245=CVmPY=7@QetZ)DMr)74?~s3lWZpT!L_9qy^!q$TozdBfAlnMGhex6FG)(Y$O*4 zm9rwH2+Jc?2+xi*AUr3s4&k|x`w><|_98ql@>_)GNB)TLf=E98;*X2)8NTt6X$UWj zG$H&%NksMn=CO(OVdOjL~x?`h-M3htxiF zWbK|ml~G*kb=>nPtqTHZnmRbG@_IcC2REah-LGm5q!GNn-;A>HjW55Wnr5xqX%R6 zDsmPwu~kSmvG5F#U&p0=&E*O1H<-JEiWc4m@=+lZh!q}W1teEW?!zFT5K?m2fqaZ) zGqvpJ-Pz_ekZhrvAP+gq{p11XGbu7~=eS$_RGFB5jh1}LeSn$QUW`Q-g7&!kaT8j} zz@5e8NPXr~llh_ZG|BZ%Ap1WKt)-8yp@I5mK||?=)zq**??y_$uA*i7{}trVSkGEE zr~mm_Po%3&?hcUBo2D#3k0JeRa&a}+DQCUcm0@uA$ERGJUsBY%M=?+OSAbl@+)p1t z?tqt>^DF+XEcyj1=H}j=e^M0j-(o*$9D*Z^EJ5%GM(#rJS4Mt_AcVRG!o{-_MP$&M zNZ}*#gV>#?G4c}xxJr)oXeFk03nC}ODe<)kXL)xX0MxN-PNtjacffQXn1I66Vv=8S z!4$l+Y*^4KeiGUI*GC!tZ12wFDEta?%OsZ$sZEVMAxqYXj+F`z8Of~hZz$8KJa^(m z1bX1~{*)oG6pu2+?;)~BWkUPn$*|czL$lRRF+cOurUE`qxlqh0o`cjP*c8Rz6t73_W`8cyp;z%Yk=|<3G5DO~ zy`Xs!Mp{C#G}$|nU`z&kA2YcWdjRY_N?C&<_rp}~5#)~0+&f2Dkzw`x#Gu|=0rKE2lpe>05^?`i<&cpZ%KMv-eCzY zDNgh~L_>c8bKp3-q@88Z ztRNgmm%M3n;5fSE0}#Jq89I*6rUvxM9egso8tjiUdNBGk3a|CbS_q zm5-T!NUj`rDDkus=GTAIHNAP z5jj6*o8gSQgpV8lm27ZEUGg6wqL>FkIHNB4GKkS6;EcLtH;4qy31`$LTs|cS&Zxzl zk^^VdC0skHesCe2QAgi`+|Yj^IF-G|P79vrMscg#DUETw#aK=PC)y7+ogu?1mBZI} zohX?+9eHSF3t#MyvMTM_}l!M2s%pJ}tdorGEF}WZgck@X8?lv<24d+>WXVHD_ZIH;_ zFW-D{Ut=3^q&evPo{~GR=CLJkXB0OF9ruV*x%@7J`{sHcXhuPh91hy3aetn(4W-;S zD5y^+;>2hlYBja+%v~9TH>~0?4IJlXk|z&&PSvc z5w3Gwkab1lr(}vpB5$+g$){z6ZWY?kMc?JSlU$Sl$N$9*NZp@IHL{|pnf1u3sH-aL zp#)w+V_CD-GL;g_CDqiv3iLZlvj);18k(lX8u1ZQg1!QSD9CF=rPNUy$?<;2Ro?gqsPwJ!_+yE*xKGVYL z4E{9o!qvWo?r)fePLzw{kh>`IFEdyr$FDP(j=#NIOj~4Fi_+A@8BD*}UTfyOL(F^3 zmq)#^;4}F^D%m;B#c<2|Q;gFyCSpfW_5mp4URKSac%^WU`~?QlMI1SX9)%BKRFS;O zDyBx=(KLGb^X0LF$hK(*kV`L<+6ltURw?PK1q0f|)m;2pjR4Yg766nA~ zFus;_3eN_plpLX}QyFq>KBhGO$;u>r-a{=vy9QxS9(!xU_o9PUVUy&fizNsTHKs z#~yT|Y?KUV4oG`J7fH#Dr@-8}u5hEp?DoInQ0xD|bClo9I367PpLH^B?-MU*Xad8ir$@^k6+>d1{z*h{^sUz>E`dC(XEwQX+!QvJEeENVqYpl8`?8=MR3)Vmu zUB0DswC+Ry?GD|zh4*<$rH4|#`%zz(_>`UaZ+GZ)r0+KiyvO=|tNOBN%nVs6cg%1i zo59$r{LF5ZlleV#Rx-bb9!urZV{!K$P3BYniSk8$MrX-M5&w3FKB=3_m}_Dv!gL7B5;e0I-D4L;1T44$r2`5gZzDBpv8<3&63+%0C#p&jE(Upx$#*+BgJdCS1 zV!VXegVW;XRZA8uTz>h2mGC1>SLAd_Zr@N$zL5%s?uq`_RFj;3ALZR&B(;KVPU`Jq zR4*^O>Kml~3Nyd0+NC+l!Zf=1{=e?(T-x`qdf8647Xp&;B`g0g_(?}Iy1rno>hzSz zx7}?QD{I%c&LObNyTHoSB`rCWI4W1HS-w0e(vA^Gp}+EEI_PfiNGp$h>D+2%lha;^ zw#nV!(H6((U0-GI@%3w+w~Lxqk4@@k(_|KR(c0v!Zd$%X{=homNKVA26^j?FUc9vF zswSD2HcM9lU#_Om@F#R&Ze56rV|j5#uBPWi6Yu6%HICtf;8!|}SFXW#6IL0g=+?}t4DrbUQX(P7k7!e^74{X z54@YnI}8`CgXT%K|4BdOdNrvhN8$e${g0=6NVjiFI`ndM`*MxGt=9$ANDHp5HnSZ`det7krh&v-W=(-`E#!2*sv`%BP2NYD0xn zLpc}Gf$_we(79naho&=adIE=wad>9_4*Y*d!`?5Ai}5V@sQxw_gwx$NQcM+(8eijg z!=-kgnRL($VI8KTR+rAqH+XIIsQoZ>s0odQH|V~iF+P+V_I?A#K@f_-7MXqwFxhGbD{e1dZQ-qzxfd@f;eE&$_c);AdR?k^h=i zfAe|-hZx(5vhe!-B1|6kz6KUp`w%^B@4TUg5un)XMHm*Q2=5DfUq;UFkn?4e(`ItK z)*H~A4hKe}PWQp^!{NN$g+J*d>P6nVr+*D@)z6ItN{d1#!#no<#w16fetsPrInMi> zNjgpiw;&D=*B^3BLo!=DX%Z^PqtG5q4gefgkip_AY&`}-yluDb8_yXx-qM5qv5cLZL%VVoVv%AX$I zTT|n;8K2oulbugR(X|f;vX8(8IGv1tm7d3c3nm!&>jAh`|IPZnfn3LRts&lq1NKlP z`zU%hAW+!&pILle-w-pwF~guNR*c=CsEdi~ybQ>f4J(C~|@YeRi*2#rU$Cp28b zvyneO{DV-R8$2tsvLmc;1BtIYdr~BwHpsq5| zMUtN{PkHb@iKYLpy6ltusPlr-Hvg6``F+J#B3R|QS{EKye~NtaT7Kr)&Ev}H+dR=S zmEgf1{;j(&aoi>HZJu~|O(l5d?rk!`GtV0NXj&0iQbJeJ>^>>J#c1N~aE z?+krKT0Z?y*p2)*q|tZVOd#{!G_ZiqXLYtr7EB2KLr?H z^r>n$v9Be7r2D7k^U-#@G5=jl07*AvFD}93IK*L&^Cl4!t`Ozu!+Qj=+`I!oz6R3g znpZaH3wt-|vyHEA`nKki^2OuvrU~&JvlbMe4>{0_zPaN>+~M3vEQNm&;wZ=An^nbU zn76Kqhd>X~sJ{^QC_WYEg2W25)-(*oJEovLI~Zb68ryI@uO~N8N1LbY>C=28(u>bh z-|4_zq|3~k5%lr>5^3n0OMQ_aBO;%VWHFy7m&|{YI1Z0ZDDoW#>dCc^`tZ3aqHHk( z!*O4hQQ8Mh6+2cDVVCX13(a$5v`>(7VSlN=(mVxF{0X%;=oaR~PFsmX%$myjwuAO? z|MmeQmX}sy6!s+IQGiE?xaYo;n2Yuk;oyb+=HV7GPqZoLane}6_7Sll@7Hvw38f@- zhWFz+HlFu@ozazo;*%Wo9ZK(0v_6>mWHtE{ieFber1*D5euIE~UsmKtzDcwHiIs|1 zDBh#Ur+AqEj^YF;NctJYKPdLY{{yCvQ(Qzu|7=$LzT#2Ev3#xt`Qk$rcsdS9q?;7) zRTLkmNPnI*?DJ+E@V6eR4E$QeACs1sTdE_f64W_vA z^OYy2i`{`&k{;kVH*5M9#m_6Y5^*s5p3?h?;D1Kx-za@d=|3xSJd!Vmh=aaR%ggC;gZr$2sXAD;`jMPEp1s@?TcEO_A$3%e|xczT$_9GLDfSjf$UDITjCCYUZhx`Dfu{(++S>PGr=O24ewsd!9LzO?|pFxNF8 z&yR`x)&%i%MV^O~rY|v~`1A&TQt8VTS1WE;q)$7pliyPM`^15G23+X_Nl7OlS1MkwxJ6NXbEDkDq*2e; zHJ#5ml9qKI`TLbVp!vU6`bDMNmFB~c)Kh$Vqx>J0c6fXM9V8;ZkJ5dWK1J!FN{>`} zjMC#2ClX=r=|rsivxtx@KEi?WjSJukO}|$07R9?1?^pa95%Qi>d{>cg!Z3Z1;wKd6 zC@xT3shCi_N0HA}viviOZzz7O*oVhClANMyhriNin|n_Q2d#q_|Ar$50oB>q7*8 zU!_k`dZ^MP6)QA-oYGU3o~|@sBcdGfg$=n)n!cQf_O4O9UhzJ~uPg3T{Eg!4iu6m& z@E9{+meTJk{TD@CQjvOc6i-qdsyJ40qN4c5hMwXZ8_13G z7|XRFrlTOtDTq@^K`d2*F(T|+qF72qJ4YxA|0y^=k%rtVBIs%&$~7z9LPR+^F9cr; zk9WxD^&zJJ17FgOO^eoCzF^^^MXQ?N^I5)c{g1rYo{gJ$_9jziueE*-d#5bp{k!D7 zxqsPfw7t`2ZmHqhx?MgKEO*=f6+h9VYT?q?fjD_MHLVR@Z&&jElz5F^wD_uKzl&h; z6K#toTbjHJ>Gw2zLVwS;iD@?z{SuS62kk9Q-`%)w8t^`Q^D0<;NwOHK=yu05d0Qjh zE40-o?VhJrDR`E4{&gqNej^%p&3>`)(QNCthEe4+I#IX0-S4sX zG|csB3b_v}rSRNzcW2Nmd6yI-GCW}1?Fr>ks|@#vA8by0GMW!9cYT`KiplWYwG3@~ zgl-(A&Y&$bhI~2RJx9h_|CD`rU%F?@NNz2yF>0)FH9g8u>Rj4a>zGmhGrp$z-5>mt z+p{xpzRCqzH~i(4jcY99IK`8#T+xCp!tb!9^VvuG$!qx*AcE7MV_;@q|(lj&AxEAQMic}E}*m!?D>PNS3ZrlFu;zwMy;KiO_p-ejcv^*auE z2`~-Aj?>Vjyg^1@Qor4(jQWv>o0T^pO}KWhnv7q+ zjgYqwY19v=O-XsU{6~37{Wd}|)2c9B;#DWxAyN0RdHMFFZqer{VJZkg;N1678b&vpcMN=fJJ(Ob8~Ml_20olJB<+IJj4tvnz5zHK*-6>eWk>$i<)FLh;maS1eOzX#Lgy#sltW6s&l)_ZT7yxow; z^G(Vdf}Qnp_*{oZfHk=lj>kMgCgsGilP`+B`AT`XFzIc&ESB0#+=SFrK}_0@G)f5)ZJZ7+1C?_94E{*Y0x+X_F_@HHE6Futtat&`hx zoR`t=c*g?vBlHfbUQAnoH2S&@#UQ)c=m|f&;xCzL@cj)Ns_)}U)91FlwNWkfL|OD} zz36r~WKss(WwDo2f4CRqe@^pkoyIO06Da@L4CSb=@IXf^i+ba)>p;)h{$>m|z}{XG zRUILx#Mrol`ok}7K4geLZ(G+@8R`lAzpN(^t!$^xo-?zf1iqSKiy`T4n&qn}xA{T7 zihPtlxwD}&d>rFNX82ZyeV;AZ(fRC9Ge-h3ozJk<#JuJX94fxP8$Pcu&bwA@i)AR% zH}~3(MDz5(1(5eF^4!l%Z|9i6l6Q0n@;B2*HpVg2aD2y$vl(oNzN8)doXC!4;v>8x z3VRm9k2B_ezNh_)`7PzKMkf0@2%Xs`+8M{xqjuaagsWrAcNzF{-8@u|8o6uNBDdV_@Hz^xMCk&hZ=-iRI9S5HG0>*F|Q{W4yq z&GC*$;K$jH|F8J!kNkuBAHdrCK&-2cS^r0WH@@?^wk4>Cj+cj32hMxyz&6=>VF%IG z_4T>!Z|l$d9_YsV0=%cgo%enc*m-ZCJMR&1!=A1CF|2!B`?#;gJ`Ov}Rq_CfZP%lb z#IXrxU0<6(J80*4YE92ha82Ldbxqg)#TXix-C+E;2b&-449Cp6CUyl6#?N8;=qAm$ zq*IoTub^F{Z!~LkqfyD(wKKIw*WQISdKQkoiPpm(FPMQfu&%=%XShCN{=qlW?d@_r z+GXl+8>Yfv_$#s|+kDoYoTr$Vr=lE=&8amHZRULCZD0SGE#7r|r(OH9nr~}^YrhWI zr=tXY$8m@?FrU7`P1|I?M>uzFpMD{j+YyB9kNZ&fde{WtNI*H3;W3T!rL5HN98JV0 zxAPck=OB+`{yE6GP}F)mcy90PRfgkH@byPNeww;c;a~;te-;>Za z3+Y(by4nJ1F{VK$oC_YcwiF-pD93tPzpZ;W=D_X@bD)*qkAN*$H_rK_Znl|o5H`R$ zOQMaou!DGgcwO;C!xJl2G@l6(7UzTwd zL7PNh@UqUwP^Z-seUABd-WQfnz^YJpl*(mEd^>>SLckhwNzU5Wl|o|B|sR`B|Q2;jpOFO|*{L zymfPXplnJT=YLMLYr8$j>6VWF0z5YGTPxO1E1-J=IzBlju|Ah#Os=~cW3s`F$r$>K z!D1Ziw97jmHj6Akl)$3Iu^};t&2Kwn2lpl6#gN+Kl3w;}*y!6Y?9QhwHnJk>eft_i=9Ec!qDC@S7{<8#){_Vh`kT zF7kib9+YSP71qedq|OS|ne3D3Ju>F(SmF9oi0=Yz zg-!TvqxUctia>8u`d!fME36gCG0Hi??=|_qAJT!e5wLF=(yi>*kjC>}9wTfT$6hhg zI5uq>zadhHG_Jcgjo)aBB2C77v*}CDH_}|w$(Id&>bxJkY%kYEj9KDgjs+v@9`MZV z*n_e-6~w#%Eqw8g#MQk#98bK8B=21QPXf=q_$Cr%b9}||U&R@iqvMsbG3JgsdMuJT zfbS`RPyR>D_&wH?JIr}rma`dsv#}kzbW$IVGoBaNHdaG#JBGG`XG!yP@XGP)@Ri78 z8UJ|BifdWuK;0IB$3LcnWoUo18PooAwNd1YJ&3UZU3@k!%~alz@}jR_#>pz9I8DZY zG#MUs=s^bT7Ge8f&!g0vx>#P!vBM#>Yb50P+s!svd*Q#vz|#1}_B~}Ni}r9_(xx_l z8007Ndv$y~nCpK0@Q2`MeQ?;_`FF>W_2L7h(dK)a%^1S^*pBgW_+9csAL`{sZ)|sC zm0i{`3^*ezdJyw=V|ySvA$e}{8uB=I-DpZzu1SAII_1?uXUYzt?`?b8M*lkZ6YwVI zXme}FHjIa(f5-7L1b2)2ALh|d^p=4X&o4_-Si9qpqT8PaN0W>Lbd zD`98eVW#mvG}hnb|GmkGKZFI4+mjn{ZiQ>joX@Y;nfc6l%5OdLoQlVK_BU+Q8HnE4 z#(8Y*=byj4&cOLg-fr_({-;5f&R_mdOP{~@-G%wPL)OfW0;~&^!@4NTzy7|B_N+_b zoFsD#_DG{nQ^Za< zkIc}HFQ&Jn!Ia^DH@1Ve?Wxc1(zfQt(5KD@`TvRGBD!pW9fQytwmG`F8OI>}|DwJ9 z?F^s}e;SX6{NHVliIheCVaLc4$hsCX`QK)9bYpvI*+#7OJWt}@^<0Ja!?gil|4wON zN`1&@Z3DR?A2wn-?S;9<^RW(mtMMqG$4-uW{MRePxUXN88u#}9-3ZiAo$&u(#=Yv) z&j0Vy2dIbRzesJ#Z!2>AL+|e6UyolSbo}%9Rp$HO$Nu1ddHJ>~cS&^fc#oLdd?{I7MD9+v6^L#d;%GSXzn zfP7v<;93Nm@_cxR^e5y|M{_TxyI#DGPF;8%oqF*<1^Tf|*_)x4ZF3m9+z7p@b-eA` z*(-5u>d3b$G2V_$z;)J#ayuHDVZW`oUis(@`352XBk+3GIP`5f#vP0m;hKy8QtcJ! z0}nEj|0$s>=Fh+i=uwJ1{ue67_}~~MzkdzJx`?lG7#ZpPh-+7o@ymIBh3laWH9*u4 zSv=3e|8uvJ&6|wH{^p z?0wLw%#0Jt@!Ty*8LhZ4MLDPB;@%U=;+}-8I~+Uwzg7|Bw?Tbt2hx9tKBLY#(77s2 z=kNU!I*-!2*glNYqX#kZj={K{fX7IZw#}Yc zJ8e==4bPORx@XFw!QyEd_z357<6YO$k8$RvqMD8wPa z!DqAxWW<-LtO&n2!&OJXoCOz-`ew6Stf?G3DkU70=-ih8M(kX~WU~b-LE*fB1qi(5 zgfAJfz^f+pO~8jH6`^dlED2VqE!-o~K zFK!xJM=+IiYX)UiVdp2oh^^Q&d`gXMmDu^gDn(s*6GbSSt)3++u$wQ3F=jOA zW_gw>#13N+OpE6+m75jEcqMiigHVi941Bq(0?Y#?Vn(NWR?#Tx)f0H0Z+I9p%GN`uY_@f5 z_9+cyA<(t*ij+D zjErvbiqPViG=63Ru-QcCqhXEG#+ma_S%c_36H;WeHPBikz=Z)@OasvrjN1XgczPMq zY=e%(jS|f`PKqRJCZQC&nU;)k)MEe<$|M>`D4SJ`T-Dg2K#;f`dxkHMlC2Uu*kr;P zwr*<#*~+n-fy0>5x*jpvY_%kOZ7UR8&ZC8C&mNXd&I3$1!iN(5B;g~InkxHAB*^Bk zjJja%5w=ToE`jA~t-2j4Np&en-G>19Yo!baeG6i(*s*@^2JDk)oN!#C^#lqAgOzVA z!z!w<8;Y?wc62mhokZ&iW{kxNTO@ThVXH*r`vA|HDB-w7>j@u9bT%O<=By`hjzSYc zu0-RNfVfG8maeXcxMMSy#zR7q6F$sj$)`-X4E85VEj46V|O6+LIa==;>W%u*M5~<*o%`cSgFe8mIRsqHaK%%*A)Cu|~82)|n^@%VujW2W6VFzNi6lE*I<;;%4lyD(6NFGMP-Q6#3o8 zQUYvSup9juYsH?Sp$Q~YCKmYY9YEQvJ_%5o8SF7L!)cf;hf^t$hro)YzV)JWoWN0x zR_zDSS{W3qRLhx`(1tx2kBla(d!@;&ZpVRCsd?$Dk}kv!r3h;!I(r>pi>TU77IO5^ zF>?f>ra*nFKs_0_Sz|CB#f}x0U<%Ah73kIwise{E@5hK{B+g`shcub^EOy9z6Tt4% zVN(dLS&&#NEtttJXf#pq$!2w9Rpr=?-5IOI4qI@5R-5QnK&y$e%0njlDxl3o!LMiD z@hU`hwML$7wki^AKZFw!5}nNf-)f?d04O!XP(!MA(#%3cdE$bPn)Cc%T}Yy2;ASg} zA^s-DgJ~CI$FO5wMp33vip!}MiyI!6=4K_7ApRlBV9M-q8KE-)*qDXQx!O!yzpzMQ zUwL+10y|ps&$W>Ss3bl^y~o{QWg7}vvRUQG%g!~bGqwji&ki9#Tbh!rviX%|N24Vb$w4VZCe8#B|LFn06wGD}&9P%O!=c1C zP5S0qSaaI|9FDNvaX>E2C`B1zAAp73V1}ZMKiXed7-~<4HD4P{K0#q4xXiu1johMpEQ^iaIGJ{0Z8{?lnRIJx;YX8Xvu3om zgSBJU7L3y-yRc`l{7xj(R+ybdJ7^;?8G>yuaw5+fp)Sc@GM5gIi)0eoEJ#QoU8(gt83vE(tJ=_~o4hHU)egvYUyV;}Hy4Kf#L%WV1$KM^<8o-HM510NXae9_&me znqI48^NwSuAm};*J2{B_PlV*PfP{&%r;cMM2N4k|2w=;YOpKXiwz9%R!77_yM|O{n ztOkkBNdS!9=A_DYTh%!f8?d9cSOUn-WSqDiJ5+81uzQiU+q z5iH|BT$0$2=;R=gwWA`!a!sac55Zt$A#yT;Wj|mXbYU{FTD0$Wji>~rmx`pa9U@8N z4*`!!e7&3!vs)laCckfT=)hoQ&ngG;AodIckoKuILW_v=u!F4x+*PJ@5s`Hv`4NC= zOr4dFRIVMSEp;d@o9zjTABSBH#Ae|D%vS9aiE}6>Dt72LR9KEGp@s$kjf*JDZZXkA z0JAjCu7DWo35Ml>?Gl|$RZTr|b(wXcc3R_*VPMS-rgnlEPTfw!*|pRh#xAziGfp)g z!H!B1%4XZm>Bx|PCMM`*=P#=0Gh83}d!5VaDz&uL`p)#F)Jh_+(K$u_|h zpS2HBqkp#{L8WW4L(Qdt?Gl}{4{*dpIbjmg_HM=>0S;f=8$e<-l@lpTMYbZ!WTMeW z402GDiG?D69-&mCa=)eCq!Kt4&?TI;2TUq~=K~prEY&)WtjvcZWU^N=VA|v)#c+bK zo9$V)Y#w&#UO`-r9ks0kY}e#{z+%)y7UBp|XeLe8sL8};le`VkD$zPN-P9c#3 za4~>dvILXCA)B=hi!_+LBBCiG4bvh;S|WMc%pyhswn;WO-#xW=-;mckI$%)me0TN$ zR2Fon_3hQ`{9YIILNArV`ExOzAqtita$&DtNDF~E2|F(+($c2Ag8bE z^|k^cc_=rnFZn7^wpX%P2>(%%j3Dxoj3F}i?guSS$IIP)LLxLe3aS=_D~tYP;z_33 z(@&b#_Y+{q4>^GWCW%TEly@Qf-m<}U#`J|d0H+X9*F^i>iqt^SofBcB{-dBS^`pRX zCsE{pzEFA`B1Ne@lXFtK8X>F3z@!=>sxb&^6p36R;Tc_(6!PR=(i(W9JsBF!9x$)h zB_TR&91I~vV^BQCbT-)L3{g#_z8F}C;yWo+TjUMPs1}y?R4JqXsnn7coJRc^Ih~p@ zQW|oK^B6fJ1cSjbZmO)c%b5|alja=ZQ?VD7ADJ@Nw7yhvl&aW^1{q!M(-)t=HXSj> zN`zA)Wf1POMk#lyQ=DH9=fcb_i0UzXl1~SHi6k~ow7>#Hg6;zEBc^z{NOHYF%<#B6 zcwQyKpf?j?$m8M=_UJ-7%L)Dg{8>R$KCl+wqha}0gf70^!t%dD=y`Z!8|8yI$cH?B zG$8EptR>5vjxgI>gfPcjhcM#Zjj)&ZErhw=(+KlaId6scdytOz0YcZy!r$kBHx!}g zjYk;t<{=Dus}Y91&mqk6zJ@T{dm3Smhes=kZc+Z*L{SKHjYe zquy5#=6gRuSm1Rc?CXUv(+WL|0;iuh8DW2~3E=>5Gr}V88wgMGou zve+Ai@MP~|gr|5b5DxY}hcM=S1>q3yafCy?7ZDD_w?ueBr#Bv$J=GhI@HB4s<}I(VV?6OfMg0z%h2f-vBHfY9>-x$Niygdwj4Vc0tdVU|~o zFx$HnVU80Db1bh!JalGOfFpoIC3p>4+^oJ#C}P5AOakLsXCMfdBlrM`;cYpDo#Cq@ zw*Yf61i~ww$eoD4kD(V{9gN(Kc$DdDvLjE~_%(%*pV;`?SmbFNzive285{p}Mdar; zzOE|roQ*q%f*?3}U05OgFBNxw*uhfn9E179yNaf$z9Z-c2BAwZMP6 z>+)!lTQFM!yhqXN+ep5eg$KF0#C15H=Ji5E98iZ**qSqtmOc2gkFt<9T&95yV_+ntv;)e?Q&`FR(C;Ft*%xD9zTK>Ub$^>rKb>OuU5 zL_c?F-ldl4?=H_<2;x0T8{jtQEd}v5*^1njyemLRJtw(qo$wOK?TwVc=I}OfjArzE zIfRnHw3=47!z)+@oDf%H2B7YJS^M9f}D@@z3c=f7al{mltX$yw=QsJc0YG!;Lae7=HY2qr|*+!^=4!iviZhbGXrbI zs4Ymw=@jHZfP2|E>bfsTkpusL8eT`cKvUa+{ZMT)Yy45LHxwGk?-|Ucx<3k1qk-2V z5cPj-^1lzJPci?;l0PVLXLJ_H1Htb?Trm%^(t!O^T`}u?i`D%kxE~8~@nq0k53`?^ z;wQ7)xfk>0m?jFkC`7|Jr(6eiZrLrNA%g>V#x{|Ty@rtI2sn|1kwP)%yv-cpm(;_- zkxBkj$X`ZYCp03-TlgVTYmv$UcxTipJQo@n3(g9(h_%-soQc6njbh%qh&m9Oa)FDs044ZC2B~wE`O5wh-N5s;e(o$)2sW0gc*Rhv;`JKaaJFZo(zZPhDQ(5?@$q{Y+50U&I*-+T zBy@Up^%zJ}T>~Qi>Jm!ZmbEI)>L{+w=0{B%oI>^_?>Jj2Y;(*vx~cA!NG;BAjBJ zU+&Lvs){tO>h8~jPS!I>%zlog=rI00%6e)5VF-tU`#@kZD%MIKFqIUYiJV^XJ|RpB zCkrnjIytpS$?Y{M!i9^ov)5!NQi(WMh+b2Ik*PL)YPL9e#GwjOFFT3zx!SBdv*Gkp z)}3i)-Pr_M)}5LlB@R3QTGpK!v+hI&>$)@DtUKq#blsV5*PYV)D1K(}lgPm`RQzy? zES`eWgSe{2MSAfD&^#xx^hqf5ZSr4amZ=8NvMgOJ(u+Gl%QE)=(Dp9iQB~Lb@R>O| zlgW)F5FlvOK?4MYkc4nk+9nVb0?2R`EHs29kd#2uT(~G;jDUz@!CUbjt8G!yVvAL& zR#e(rYg=rw#cC^ZQL3~ewboXv-}|n;&dixfLi;?w?>|q@ynC&^_S$Q&z4qmtnc30& zDgAL0Kjmj9?Bg`I9`r%dvl4zu`f<=Qt528uvR*~`sTRWp6ZaSf&Gup|>qBr`gge8( zQbK8aF@s`zj>zR%Qf`|^!dv=JSbGn;IHuo)pa-v)gi z^FOqwFh4y<`|Ph$JZA-H>GM-Y{$bG4hbP6HoDujrAfM|5l^%|Wlcnjj&7pJd`-qVe zcp%s_A#;F(%um1=@D@rXpt=E1Bay+xH<8FeVjz~DJm8=uU=$+}`T+_Yupo~sIK`it z*LK6zKLPJNU-%b*!3X*F7T$EZn#bA(d6p|#-cEuG)2(1(LP2E7l7+01@4qfKjb9(VQP?(F2T+3Bl#BoLiSO93GQL|q39Y$(>|G}&-xl@vybviaBl!D z^Vti24enHK_Jc3^xeL#E0@)JWKl4j)pAXeC0sU0ObL5#8gI)8lM84TqN%c9~P_+c} zexWaHW(zN|`Gt*hSLLAr@M`cwf98M}A-DmI0e?ke8xy^He^#p|378$ImW?+>G z%>gRhY%_#wg&P^d7;a{Oeu3frj3*D=RJYs<(0;(9{WqYGDcyn*_b1Swc=A62or4}> zdG361hXI>dL)>7G)IbfKxL9H}G*Sb%kVb3vb!Onj%%4Bx`TocI=+RXv1A-iWybH202Y%>XSE-`C8lekEv`_$u60JwsOYYO|_8 zfNYugYRoFVtglXNm1dQ0#70^s!YZ?>XJKbC=kP6;r_ZyIe%u+B0j6h;46K|pTT{fCrp(b}?Nhf}01^;T=1xy@zt%}m&yaRGJ^^ZVl~ zM4HQK0Shngv{>fNZuET#B~m>xj}oR0*mIO1@}_E@sf*S%g1e{__Zqap-2KgrJj~$! zq$LkS!EV7lsx;HRA*7<8p~x$$DDwP6qz(&L_99lF=di}7)XK`wTbpz~oiT4*u+!zO z0^Upi93f~WGMW7cmT5A#LK$F~FEA{e!SQehRb{Thn>_rvLmvLz2T~sX+(Gp{{|r*@ z3+~}6-;*B)$kU#?xhLp36r?QbcTtr*?I}PV()Dpqd$RT+K4(j&c`Pwg?;u)HkPm>W zHP75v;6~Ow0BS@%zJ=eQy*nJ)xXeMNV(<<}cIBHu%lN&+k&Vj>pk@5t;kX+YdBF2+ zM;`E`;!&BgS=8lx3|e;4_d4=`rwF#l_`X}7tLLE&I*|C?)&OMkE-h90;=SRC;^J%K8az9rg(AI!||( z2u|KYzvL;qHz)echSB6c1>)wJcll*908Dt#@?VALntW2jU9XtoE`>CM;``#ov!nu- zi}A=fH*MoxvpXlS3ArwgxQ<_#!jZ!6tiv3MMucCHdVH@Idecu_obVC=|0fX{XImVObNxPiDuEKoU}Ml z`Git3w@Ky<*<3_LtgP(=qL0p2qW!PJ8g5$Ya5Lk$>Wr-GcFJ;PGjmrMqrj|eE$UIw zCh~8DGkgoTvh9ma+kfhY=3;+o2yOouw6uM(Y5SO<-mg~qIWl-Zx*`k3m-@d7@titj z%l&7qU+zDD0$N;ABkFUClhjp9jH~*>wK6j5{2Uo_cUWTS!qUvU!|qlVxfN}LXmB-l z@NYw}+=_mNL_!FQ)_x@9R`h#F=&fi@9&!e)2csAXsq9v0z`XL`Zbd~l74AcOtl(N2 zwxydTFT`=W0ip;_D|mx{Fve<5^ucW8&UL##pE>5itUR)%{4IXoxhj`y=TnB;YXJYD zOa~YPzJUZ+&H>*;Le|bnNbCp4M93HBnmrcMpJY%{J)kSF7Mfe3~1K+{Yw?!!_l;q=lGr^HA_Zf+sPHPu}q z%`(;L<`z<1D`(3%p5b33ZRPC1wX(hwms8gU9rLiu8g>GV)cZKi`||%CN#}nNP4Zuo zr*?2{$`4AC!dCw@-fEUg9Q)3f>ATcl8p7wyGCs!3_&8sJe}exK@?}dm!9N%2;j>xz z5*Z}JWk5_6MOGr$yu>LG3Gl{xAjEvNi5yFTC3u?vI_>@>LTcJw$zK7|n6!JMpO~iI zYd%V(qO|*hR{up13VtBB?`r1;iO987-3v2vHg?Dp)HT;g zm4X|s%uLN298OP9b9#D7q|Uk!v$nYPCEqltIBO|rehP~GS3u|N04?r)S>$v0k#0Q( zV(^zfe%5&|>pg&~gRl8|4>$`2v%nZI1&I(6cv>}PC~(j!FvcKJP=+^dkj`Cz#0eJM ziDGcBXJQ;=Ze?OI68ACjEhHXhViO*lJi$ayJmA=e zgcbTd-iv)0e7J&7`ckk<9&_JOFwaZaj$dDXfYd;H`!l{zkr=cKa?ZXrg19+Oag*+xI~F)ll5sGnJqyg-kAe z!TEqQfv}~lThll+!%RU|uNzU5%n;v3;+1Gd)^5;;JoL{&$Bum(N^VHUFE_8%mbw7hdqzz=8Fbs6MCC0e7oNG{kx2NX*(QL6jEw!>j zd01O9ir7TXJam`2Yt$R+PVRa}q;;DVaW&n=`;&vJt3~f0xFXTHav#u1I$LtljhG2p zb6L02%-x{5oVd}uo^IqU`k>}YH%ee!27BJr8rU}4XJP1QcV;aDouhOMp4XEuFtpvW zPd&Ft7`j?$1LQFzJ=Yl3W(|1_^VdNzqpJSbl$FS*RYNYIo?J6GQIR!d3^}hG&VR^B z`OLh(OD3rEW%7B{cR3`7%S5%?$8T(yIrsZgpirJm;_FwU;}7s-0`_g5*vuh;}X7Ow12 z|H0dpqFbo=BRaY0o=DP4q+vmF`+twzHf@g7*XGN^h%n7*GtK!4g|789r(FsR=NC(Y z8+=8OH%+@2O&bO($O;liGsX4|c>xM~*k&n_MPe4R(BpW^eI0rJ1^)CU!eajqIR#c) zU#TO#6izZ7dYuTcg(DnHhyKC-9pEJ1gSVh)I)~h5)ik7-)D?4B@}5OZ=*-Tm*RQYYk}zJFR#8YIrusOrn(A%yOH3a?dO}hulTZ zKa3^{M&r^N@AN7RU*LHhN%K`7e)OBpVPn3sGUO&IS>c&gOjqp$yT>)A{Su)6 zqO#AW@?B7o_#({c^K(e0%NK!U2PFHXXs3EotkCN7F2xs#_hi>3DJn{*N{@JC5)@0V zKL19+4D;0+F-8hTg`z2`Cy^sP@xdW@Hp6fAl;S4M8S6`w56Ag=H9xLSnH*r9FCZ^r za)36xg{1wQJlCFtrFkl@FfRAi2I+0MxTfBX%YE??>IPh!aovdPR$O=Ea$nn!xE0q9 zT)SK*kPG`zTwKt{c=R+2RbRW_|z5c%hp zP_}@|7Q`xB&{^36SJ{Hat#$R)74AQlh7mQDi|dB199?O(u4t}Xx}v5!#D9H0ZT!Tt z*;8j#gr`(oHvO`RUK;0HddZ0saJ*+HMn&1ASYBCdDJZEZojThq1J*2X!?R|2xzod? zGv-9=pEx00Q5KH1NqMt?g=33m7DkGDGKz|dyU7?is_TpqW4b9ZvZ%0giSgm0t`vbMC~Vks}MocGU#5ZAy1->n3C5sLmNuNpbO*NEH(%hbK*(8S7G) zH)rb9c)8Mvvnmkm6%!|n?=ov_QFmGJP4a(BDeNYT3cJXfP&#em)Txt8yX&H8e%JjJ$*2AKtyvpd%JYzgkpw#d>MDLn$Z3D>LyFNwR5Rxw=rzal+WNiLw+~Q_ z<5u#hvx}IB=t-xQ ztnFf)Ngj1}mnU|1?&yflE`lJUv#UH^UZ-Eu?ef}97LDvCi#E=i9o<*y^3Ku0Qe9+C zm{f|tqJsDV{{tXzVGytd;j#Yk5O;qt#N; z*i^&!hUOLk?|twkh1nHse2fOE0^d<^n@6q7YSuJX)-_p6nrmv7SrwC~S6niA>O`x) z0k>zYZ%Io{eZ94$s=lE)s;sfTvSmp_)AEWdYnmFowKOiPKr^kzW%#S8Td|}eQkT+j zE>cx3tGyYnS6sUwQBxHas96qGbuHH7)+M~yW3j3s(1nU6O*I~iX%2LFs-TXFB~1;> zD_Yhx#z;2Tw6r#QMVHpJ#0jCwrkcv?3fQv*krYu2eoVbJO-&6=6^IC{wr*)H+`7tI zQdeJN)z_`4p(m&rP+7m!s##G@4wDge%cNR5t+J_dd9&408O^M0UQx*UEtIHeK;Sgh zh;ykDJ=?k%U2E}jwMhYKO1u^_z4bzy*RoCu7=0~G2=a;*t%wdcKN6+to4OUawT{WH zs;#M7R-v}J#W*nPmNzyuwNx}!u8PQ;@v^+JzNRJGJHqrTp$~QBn9gi&tf{J7Qdd*W zLB{b^RbNxN0{t10ls=D&!S5B2udikgR8+M#tu#Foqty(ZrkW)Y^IRX*RKb8~w9p4? zkT>2UzW2^1MwUia)YoC`x(fL)>iUMt=qTnSRkgga0vORi9y=8s72!oph!=zq z$CO(;%bM7Z?LYEkrW7*jF;=XI<`oSqI3sj2C1&WcSWLUvr!fpluti>9MS~>9(5i;U zHSRcq+sr6&TS7nT{1#gQGnTi;2Cjx?Q{77Mm~nf#aamP!VNpfn;+mL&;$b(}Ru)z? zRhccbYe6(WVl`PKsi?Wg!>eGIA`CG#M9Ws7J#Djh6wU8kwz+k& zj!h00#1Fh4WwgSUh>sxd38+JgXFrw-9=qvZ4D-Q&%~`P75IPi)U$Lfo~KswQKRJ> zj^qS9L>+4dk`qhud5FJbnqJ_;`D5xU8Dga3MabHa7brohI;4M8i{6#(wT)rCx1j{-cB_Q>%u za#@dD>e^yopRn1vF0d(aV{k)KS&wkYBge-l;F`wA+ui6o%qQF4die;vOP@@NmE$Aw?&Q4o@ez6_ z`{Hz2uC6UHeO1LeG+@zzQ zF(68sTdM0Cz)ygFcQ@VIQdh5{HCjgYkA}xp)}*i~shF%v(ey}@v=Z<`YgmC#+J0gA zob==^0sFD5PdiEWZ>@622|VlI}DH2H&%g zT-5IP>`*&WUq_LEeJ?8X1?*2CnPfMWJAG+MIaz7t0ekb+?fxJ_Hrkxe(VWa=|Io7_ zwik8&Ydv%Y>@B`>Cx4TZeoess`}$x@z`g+tsQ<@$*op>i^R@ptV1EE%Xuj3AH(;M! zzc)_x3rW6Y``MK!kYvA-)E=<+Fr5&vUroY~-?J{GVdc(Q0sG%*Z5nD%3T$K@kF~Nn zzfCT8(gSF0@cXD~XDiCTkql=(d##g%2_#_O*UBco4Y8C!*h%_3c{_x60z4-${aPn| zlausgCm%i0KX7e=&q=dyzVbBcyAt{KCZ{|h$hQ8?X-A%eJYj$?f7)?2dy9v(_`O%2 zhGs2y#0ie0AS?c~r5)DVhmz0=e_r2!{lLn0`%g*i(Faz7hjefklI6ne6?n$!{bOew z+B{4(f9I+=!wLiTn+fgCMW_wN1?&f}Vzs^PHxi^H?prDS^ih&O*N6U1hwGC3L;D2m zji~rjsdytQM(^B`0?mJIp?jG@iE@z;E1nT6hPv&$%5C4+fPFMUszz!DFSv0-Kz~rzPOFuc5OpuuqwOw70EcH>QB*xVVFmd08iJrNHNDKz_K#piW?+Lf zyC3EW_!}nv9C^J1_H)QIjOR^Nze{OH&piqP%6`uVsIu>fvNuH8bx!(JXAIn!5}4!^ zO@$~`-rG`+=)u`Ubk&bR6eHd43@sdIdfolWy z-j;TMD5g7)LQy8WW0%v{UJa*Z&SXC%q+*t}pI!@%e^^hKBGNk?cVbue+td$dZX_#)%Ti>^6fC9hy6K>U@DawGwb2I`t6M1df+*yr=4~hI?(y;_K7Ro zok0Qnn+`_(hgX&(ftft8L4pxdX7)l?H)9S?yVeAp+@{(?8i0&&FsyY?VszIf4v`Jh?%gLy%GuGVH)?-;JutV--Fbp_U(SU39DhC zJP^FtzL)x6F;;D|u_BnZIpy{zU=Fc2+x}YgDwS-!77jWOZtaP<8c^HC_^#Z3bDf0H<8TpTaGY`OFU7e}Kp+g)UJ2I<2U8N1RY1uoG`|2gjzASuHrYwu zj9ClC67A<9lZov}B8L2PM*E9rEcT=n`-K!Urax(ly#f{@gB|%eWO`t-0f%c;61D~K z9=Vu{{N<8DV}CEr;99uRnJ~pEfoLX-Lp0dmTi0&Cj_mZn7AFTy$il3YhWxB@rvUSD zIim7fnYhuWaqu?+2f+Z|AP5f^#zo~Iu4SpfI#%C->eKAQuqioUWA-04-ASD2Wbz$j z*tFr4X#?FKu(yJjfkOz(nTp>7I*7Sse_pneHVqppE2Vl+RKr)d$HBrzQECU zBR9o9h7e6F7XqU1NWgNq+=+P&aq;^AW{8K^$ZqC+2Yq-O=D7ErcA%`5KXfphu*Sav z5<&J7T4g`A1}foZx)>AIV{0%{o^7eQ#ewtGPt{Tncvr0V~yQS&=jErMHI!GCry*p5ZQz8f8zi7P2^O~5|> zUxe@X3LpM2!rzSwqvv|JJH@a`W}v47_Rr|leeke@<=I{hpY4M>=>aUt=z+Mvcq<^w zdN1_m)-|U&X&y)6oGBRd=q>pA@9ZsH5*pWmmty}5BtnA(1U?l3hQ>zJgwXgyB9uLZ z83@zB=j`|PHCR5 z<{&({8iU^61+q`M5YX@#DAwH@4W?xnY?#+9`!^_B8n8dY^z5$d+)6^r^_Xw5vi^tr zpljEPo1aKT`j@LuJ0ma*VA5nLlG!nMF^zr7wBbM^x3l7<-K*REIWeo~dx_H5{m?z1 zt&+a}0G8!U;ms+g0Ct%6^T(^$&s(rIqn}B@JvYiq&0hLwmGtv7K`7e4O8WVmL0I?U zDr|Ft?LZT82^g%;IL;&|a|2Zy$GdyHzc4cXwhGZ2v&U=a9uIE6R`wcko4aoXC34^) zOsm*G$U;U>9zl&T@qRJU?9+yEpZ5By=sqp>ezOeH*yLU6-qyXf*4)xv3v0#08jl#WU5BsL1a(`}5 zYy+=zdSB`kPUCx8fCX`{0jcAVO0)06mKwJhb$gxOlbm5waKq2F4|k1|C_D~zeh#^d zaLbScic2JBiLc{63e*J{AGj|asP~v6{l?02e>NP#XFlE+P6CU(608ruIG7Y6k+7{_ z$IyMPx)}Owi|5QnU*}n`di3$v&9}wSgRF)a`9zCn&_-VuTJvM*;Z{xzonjr1(U)#L z7(@56Zh?Giq?NX{0rX~h(#2Z(T7{r*jO3qfeSq@OuVbHQ{Sfqi{hBiEuLONEQht!t zg7Vc7`a-Ke=#L`$hFc||pNTXm(fS92sD0%F7$EK zzXmiw=$|8T4QTv;Sm=j9(_i>`uh64W9>0IGLQ3}n&CeEa4wvNr1M<_5cJ28C=z7qu zJv^!SdeAv4e;4TQAbpn7OF=(}^gyLg0{P-|ct2XfLu&crb96uY=b!2?K2!C>lG~K# zb8)|Qq5KC!%JX@;-x?$*?vds*d%svo%Dimxv`f+NiBSS6Tf7ow+2RQ=jfd%;myLMy zzHI4*D97$p{{_)Zq-@yhec5P__hpOcqa52RjuJ@O)~Gm|9|%QXwsmooK+3kh5=WO> z{OP*;;%7po@SFQ0jcrimMf&%VST~;`6~^Tk;D;dYi}LTs$zK>J|DLA{C_gi?Eh6$aryXU zA@XARU2*o*$JIB^9p8|p{IhZLqvPUfN*ui|PTx{3&(AM=BH|aTgZUX`PmJ$pwfsKR z)f40Yan0xFiao7fI2#Wcc=5Byo*4h%7RvnOr6hWq^k>Ai_g8V{C#k&z>Pv|0j|<}bodubk$@p0iajH4RFb5O-Jf&-imtsC8 zmYbhg<)9L-fjRB?9WN0y=W*gEL>__wyK<(Owc5typ8?wDBE{DP149b&lO!Z_8qI$- z%ehAD`G(d5J$Ex7dY&SdnR*vZH02|Dif|Ai^S^G+-=V#0Nw=w$%gxbiIYZ5XGn8*s`PC}V(>W;Lq4N8P zSV#{LA&fQa(^nHV~Ja8E-&?+4ns@E36aeqFEp1BwU9ABbPs z69<{!b+g=I%|Awd9)21}91K4z{}gHba_}Q!4%(&s&lD}k)X(_s)ZZh_(S4D)X@(5@ z6a8CDoT715X7*y8$|KmvP!91DCZfIbi0~u3hJM^egdcYkFEr!p)oRa;M9?zst~TeylNSGhUc~w_Xk{E- zW%i_<^kT7-d1{IF*IaXsFaOExQ>y=%Vh;6PqT>~E(r$F}OXSbNPbZ0&YdgP&G}{L( zP~=Y|NzYTH-$`#ER$|;JK1GDSV~RnJH|UKSpEJ-t^3gf`=_=dJ6GDjxh}H0i(pd?H zE+HbnO|gRr|8tz>)IgqCjib>pK60us9uyZ4QC~d~_3_?^eryBU{ox$GCKwnp#(d8u zXEFK#EY=5=7X2yxRi=K0zE{X!gmFz=XMQT1v(TLBm$M%2r9UAzn+U#)1MqKE{vPEY zB!YiR`Kk09Uo1fOSV zkiVLUIFo)roIOYy?RrL$_lBL~4%=!B1@R9;U;G0VGR_`U{yrj{caS(=*A4hn;u^S% z?S+y4s z7UF~pMYvFCs1STu@f~83*{2YvKritdiaQivR{T2=>rX%Q1F>B3D#d>)K8rYF{=154 zFo^VI#dSnXW)CPHQB1-(C7 zuE^&U%pa3vuwC&H#g`P1EAjyW<lMGJ*wEMHw`3d4?q_he;?0WRS3Ihic9xMFt+-I}TE!=c7|$mZGtV~kMT*~5 z?3H8qO^S~xjy}imzpi+T;?Js)Tw+-mv9o99-f&nNvA^DKi9nuTi{CajW7jigzg9r}!PkM-(4dd{XgQ#a9%6t9VH9&x*$s-%~uL z__5+=ihiGIH}8-9B{;i8F-!3*#gHPuYfL%L@5Ca-F^XSSEK@93Owrt{dd@pV|@I6gMf}sCcuY%P|iZ3W~AIbb*D;`w* zqaxQU=D(wOQt`AR*DvOOu9(1e19Y+?@AFCbQRM!V^!bW;iusDgiWe!CDDwXZu^jhR z#F>g*ze#^hv0Cx#ij9gZ71t`ZD{fZ2Ns;?u>bp~s`xw&SReVD6$BNG@@*f0J?pKPx zQ+!>K|1psH#}(gKlyw$-?)#YEPcdJS&)Lc6e-0HGE#c_%=6&ETlS8P>WuXuyv4#kHR zf1vndMc%)&zSk6GzXAFKrFlQWeA#~h`*5EDyg*U*BcQ*eG(Js~{L2-q6~Cc~ZwgBO zO^UZE-lO=C;uDH|&dB}Rr%DI7ulW+j1F-~tQ@Wqhxk~3LJwj4iWml zrno|Jz2Z%Z_bNW7xQ7UR2NhpeJgoSkqM!RL$np6h_mAf)J(!4g3{!fH(&LoAROu;7 z&sF*grE8R~Q@Taz)kt&VuJrQ>NQR#P-=JR*j{jt)rUj!ZC z{*eABg6^aASxOI99I5=VN>5aJveI*up09Kb5q7Omev|UAC1QQOL-YAL9qC^vzNLJA zp2zZ;+?N9R`4^F&TM;i+tWs=NyjJl>#k&=EDaw8q95De}}*^2ZRdZyT@lWkkf$Or^i3^kSt~ zDBYy=dZpWyzDenumA+qbx8gIJzfb8`ls=&Jn@S&6`lQmQl>SU<{Fhp>pFf16y%|d9 zC>>IIsL};Wmk`n3xr(b5Z&lo__=@72il-G*dYF38RpdYY;(mLi(xpV$Gg0XoO3zWc zQt29{TNL@fcUW$N(%Y22Rp}0;A5?m`(tDKNr}TcM4=8<5>BCANQ~Dz!#_NBSAK?8M z>Q7h9RvfH2iimbDCZgPGrEgYxr_w)B{G;M$iamKhhw}M~qZKbzyj*dq;wr_hiaeB( zrg%~@$os>wxGx|g|6C&4b-vR1N*5{pWu?a}JwtJ!@+*~IuJkvQUZ?am zN^ezqyVCb4eZSI=D()e|zGsQ>CBv6yH|-fC%~CJ&oK2M9`C!zFg^bO5dRL z<4QlL^l_#Cu5`a%M&BSJ^vV4(?D(qE%M`Csyho8IFH@fX(~0=H;$IZMP&`}jr!Q2z zSdsrCf#sGeu2Q^3@d3rB6<<3JQt=+eM-^XGJV1mW68ag;Bo@Q(N)IH$&LK*VRC=t^WlB#{ zdY00cE4^6hB}%svp35ZWU+I4;{i)K)eEx!V^dX|$ zSxOI7dWh1al)gymOO!5G`U)cYvr%yq5q90K_+7>CD?X?A8^!k(KUM5|wkbbMk^e1_ z`YusipxC6?u6VN||C=D?f1vmraWv)wBHH^J5$%0l>ElZOMd^Pi{V%1R93!7ZMETxI z_fvW>5&ADtT&yV1t-!xY>3bFBITrXoCOyiseoBPiSBbFeHKpHH`nb{`D*X?o6V5T^ zGKeUbrF2N?T%`+?E>^lk=`y8f6Jf{IMD*ik&EKwgr{V*Odla81qTF8mla=AJgj(9@n4Eg$dt=eJV$Y`;z-4?;v&VRiVccaDPE^|tK$8Nk19T` z_*2E-DxOx%?r-e*vf>rQG58!s=|&>`u5_Ey8#T%4=yW*pY&nmv5_%Fr2 z7Z^Q*6blqf6vK*36jv%K&yxUU8b@JVhKrEdAG@ z*sl0<#Xl=13^8&e6zdfqQrxTfQ^f;{7GAvnPf!dh;`UYe*@{?hgbpbp?1U~*#Fj*8 z3{}B#iY1C=ieVzw<=Kk!6c;GgD%LADDz+%L5i##?P~5C|qvAHjTNOJLA5`3_xJ&UV z#b*@vDehN1Kt!VsDjrgNQ}Kl2NySr&A1PWslpkw8k0#3J8^BcMXA>{NXV8lB`3C4* zrSlYrDi$afE0z#1##tVUlN6^a&Qp}nIUu)4>1xGBMfscq`Ky&)tJtQvL2(Ai{t0 zxd`wOY540+#lu9j+f`~KvBhF$fEK-hC$5)gL$g^2ox@c9tx<-cWOeZw<>^jA+Ho#7r5 z#gnY$V8CvV?CS0)FF7D-dCl@FoRj3$7JCj>ep5|-e(B6<`8BKSs#oXp@WOmoI&#)i z^w=m7|DS~7bapy#DypedmRmpD-tB>MF&Y0;D|qZzv{tv0NFyWJah7)y^c=8t26Y}O zS3~rOGdTw@zq)2|>(YwK#fzJ2R$Aivn2s{X+r^$77gZ4vjU3MAJx$Gf!diY+!}8@d zo~R-a+2DZ zirACS&R9biqW?|5Ig{-ST0H`1(iJ)0ts7O5{D{YwRm2{x>7K5qXDBYlp?}_>rx!+p>#EsbWo<}={1DDd>$&ZkS7`7`EJOU^g341}Kdj9T_>41--5 z!;o_p- zj+C+^-CQ9fRAI4{Ep~H-#9MWK(Fm7UI6^c;Xdy?$w8uS>6Lu68MamV4Zh6NWR2D|E z3Poj<783q#;PK1!W?_CII!VrF#9^1K>Ug$nBQ|SI1yqVtz_qc3LYwyj?Ck#M*Nh;( z1M86v{|3)Vv43=5*n-N7-#KDBpft9hF|P!rDzO)hm&k z`)0@KJM6J7|CUo_FO{xF0o^K$dvfSkA99Y4VDx3W#W zqao_n+uQihEpBDP$)C7Nz;%?tx75qB7zI_GxuK()d^sT-gesLE!$hoR(;`E(@zD3BNfU6Xjt53e83EF+t z-UAnU2;`^!|)JZ1$@(&Nt^dk#l^zKKi?Z!B&kKoS5KUJi8+DV z)Z)VjJFcDNlq?j!WA>(d_5wgaqAJ=y7fc`@)D7km9h0W^Q~~l+d`MzW9UU4 zM}5|uqk)o+Oe>?~XaZ!dP{&cLpyTL1YwHOq(+D2)!UxIFcSLyBgka1nuYP<$lN9k0{dXM!n&ky|^Q#6I(#(A zn(=lD!ZQ^*k_t)>`>k20n0@JU?fE0*QgzO z2Uyk-2e+L_g-y7Qz=zT&jDZZ;!oJUf-w_W8neE5X|0X6E8NCk5XBFHd?O{K&ZntkR z(;dx2y@;zLsnC&(`U7Eae)wnz}EgTb$loM_#f@(ETo|;(#M=HunxfAx1V4<;5w3{ z{thjIkKvn~#(SiUv}>E0FOnL~e8IVdu^lK-A3~mU1(w?65Ohfy%rAeU&q0eX-8fL$ z-_w_iHXe5KBXf!7W4ex%b$!S&_9DhuAYFL2Sx+XM5ankr;~g&mEpNMaBj6-UNOk+qCVPh(97@O8v3LQ}%w>mu<%He?=a4 zO~*rs@9dEJztQAzTx27zX;;WQE+qf*qlZ0uBldQfvTu0uI@~&8?_%&dPFdeP)SGCv z9qH(gF@?UsoaU}E5)-UHBT~PK1$V4)Tu0+&?$PHx^WtRI(vp9KGKTn96*Ih=?q z8J8bd02jto#BcF&gpUn7#S!~*`4?YYfidu2+g!}`71NJm|M{Nrk;leu#t)o3Lh!4^ zJz^*_muugYVlMAgR`YN>P)|YJ8)l_%<)!$c|6NPY+>AE?Ybyi`l^*jeXp*Crk%oD-5G4rzOinoP+wA!{F zryeukgpcm}FS?%e=<@lto^abmU0ywRo}q2ub=!u%khURCBR-02+vcwHpwHM}*0$^S z{qXZI-U}jq3;I40xE+`b{3ej=(^lY17(jgO{{E0Q?g{(<>w)@@p~C6)I+A;BO`mS5ZWG^ba?nE z-%8FT>mu;r6Sqzu=ZH%%M@*l7RBWexeeRWUg}tip=C`)`oj2f*8_XKL9}REQ zs~X5_JN@$92CN~`*D$`uPrP*UWufq#@lz*H2;rZf3p3dgn0Q%PH#w#h{>gbLJah8g z(%BQcDtd-&Q-0!vGZpVL_Y1t-7Vw@3{wM5!k9^j=y8--#E|RX0w*c;iku`&03e1ld zzy{O2yajT>!tRqmg+6Qcn}Cl@axE&`Aob1$LtbuK7Fdm}1S|9AtM6lq!m!mXV=`Df ze_(7Vri}5It2+5lQB1S)8*%xqg8PV1;qqB?4*+No+C)`P;i3c)2}O#y@bnWT~0V8$uPmxa5-z(jSB*VHzhfjz)HY%>q50CB`8f)%y=E7JrO!oq~`1b>@&%(3XB62y-6@qof^hcV?=5ufl>+9-+ePX zb#E4OSt&h0Y&5mH26Pn>EHVif^N5RZA!rGkB{{!7q9{y#n~ly60QJIh!X8{yL3~Eo zow}MemEbZCW{Q(I>S_brEy=GEvZVMtLXITo76W#eBw?o{!vtf&T!M+yFo8xOA_-4P z@~Z@6)?C6q;dTnMp{Tt;3<(pa;__STg2V;FokifZcxUwD>Nq( zX2-zz2$%5!Q*3A#eXjo;?7`f<3>&PiCO`4qW}CbO)G^BIIt z0;Oj2XZk0w9YK-;e7TNbdK@m8OJD&rFx)cT50f2`XTTC)5*70a^g1nrtqEf93P}mkF{p1UE`~Xgfr>h^*|*1VF-^3j2Rh9>EMAMt zgaA`i07tX@AzVm`t$1_IWf>zin^GKyUCbY@l#K@8=gJ8Yua8dUXBpB2V6BXS%iS_v z4PX{ojf;82ZMa}5;VDU8eh_d-k~0V&Nit^Mh&N*rL`<{hx>a{Ek5cMEG4M=MoXK)= z8MiW3CS^KxUl!N}xY$j^5)tb(^HXe$5epHGSf}1>LzWsB-#RzTSVW;ixVmWItzh3R zSu+Wgf^l4SCB#Dm|%*(4TTe4;njMQuuibP%k z7?W_Z+ld@FT^UEY5?rRSOts+hS+iJxrXq=Vd3ClRObg8Rpi_UbNG>k4hG3*R%^s8r z;lkQUFjAe`Ouy~G#nuq_OL|=f@fGC*5_|dV9&Vvv8e}K;V$K-I;|Mqv#I&0n5d@JE5p*b++8Z?w>StMLj?~Zt z^;+rq&6m#4u!EEdiwwsO*=RyL-7e<;dRTiN|+PD$obHswR7@89#D7iaCG+6Gy`L=M) z-rHXRBEeT-e@3RA3Q?bZHs1aAP`ulA3EmUz8F+W>YP<(*9;udSC42z+!~|2`zuLYL zT+8mjyU%_a?|%EYc(-jli9-1V%zlo24&DQHG2RpHDR>Xsi}9Xhuf=<^eH-3W?8oq) zYX2PXX;uPH`*IST-#~Q$A0Nu;t@f>nVXT(B?BzjxI%d7dY8$NJyGVbZH8v*%Pb0mT z>DFK{1X)S1%nF|GrdNl8+ztwV&Cno!j3enQ#{~1-^xCrEg>HIXILL#Gqc3Xg7UrTks+`z468%4;_=Tn|1_CkbaRiZ+1TK$ibUzGUJq|88GOH4@X2;s1fpN;wRImim9_Tbn|+jKJmJ8ANqUv=A}I766wALDG!67gZw>xi&A!hScc2r%U7N9I1;SO-`iK4@}x`j@ztmN z1jL=p>FaAu`6&{&k;wM7r2HHSsi&WBwG~(by`pY&;LFIkky1}45_0{I2R8wYN37sx zH@zn{xW!FBk!?A=qe^`ddeW{!%5qr1*%)E6;xw9KIc#{3^pElG+u(m09AAcmQ3`@5 z$yu3u@gAVDgUNj*kr4E~6bu62VX2p`;Q2^Xo9~wimh(OmnWyj;_!Mt)-|=EkLN9K1 z1Cw549a#*Mz@)k0WPMH8UuCkI$;q^$H>(UxqusqZk^)odpWd|;m_ikO>X}?=-^*mn0lXUnnxh6Z zQH9l)m1e(*w~bc6Zv%pf_yEc5`g{xb;X5sX-4v8>BT9RBv%0hSjVfvLZdQ5rVvytU z6g=?wC`^z!mb7*cD?8_2WJ!yENImD?W#b*Mz_Ur``L}26BzZ2U)R19@xHaacJ@gn7 zeVO<-66~G+kRJv-|8Ec-!^8ySOhDp-%kak8&^mW1Qrvt6UJ(5)Agyz+!TTa*`sQr~ zb)IiNZvsQtq0j?JP&fbU#Q7mGo@Rn)Htt8l%5~7Np-2qyg>5{0GYoES!0@kvKz|4< z@X#Ybw<(RSU2ZLC?&~POJ;Tav1-(n?nf{gF&hW31yw#B1hCFVXV!1Tom`5XNE!D37!P^jTy>1EG&#!!_{no%A z!7sj5{(-P4tuHbyCkOAD4EI4VBhNXImM?71xdYz-$G*(>BBj3uw&Zp7W;s<Ep z->BwwqbBbQ5Q!Iw0!CjNV=j#|mzBpO6cc4UrbV+D)YiaZ$nyWoFU5E=Um8EBNfVL> z@_Dp4Z?Im@#ST7uv@$tkInsXDqgloVJ`ebY#MxDNehd4Ih zX5q8H4Z~&hy?rr8-`PCfQwILqto!VLfxHB*3cM}jk;^sDK@1!hat=r_$&k;1l+k*W zn$M|(f>{(kMpftV+{-y6-zh;w=kQocvG!eBd(L{0(hgBIm?QBOD8Vk!3MBYA98+aD z4(7k}IR-9oge1q_9=tCE=6Sx^{MSVxcK#?NhFGO|KmVs7r!v8FGcRX?4`mi3Vde7k zxDq57tF0zNgJy)SRW8TY42%+qUgU9v@g^gd%MoS9WEgtP7(XCV7_%5r*W<&qQ(9_! zs*H>*EB9e=Gj!BMYj_#l0^x@JSE3$_JCwjULy32gH@i~_&Io*B<86hpPwkB_VGY~_ z7X*8l=;mUZ_8n+WV_;hjyCd&G2qbP{H+n_}bIiyY_+u*grx}(qlA{XpUT4|6yDMuH z^ztzR@1>B2{k_q!zc(88_et3Irtkxm*vgyr?|zo+&4We*-)1288NlSjo&{;V`3mw$ znBrUb5p&0iu|vNDj)ePIALD%}zHVUReXNhQ4($n93HY%-Y92Njw1oJV4E;CI65|(( zzF`^o8mI*MI4PgM4VDe}Zx6}pJ=w?Qd)PY2$iiNZy#jhy7VhhOd24pNCr(I z*RZF^{hlu=G!tsLjD`4X3t7l)DAI*2Bn#QouviwdPmqv>OvW9b{S;HplNgcq_AKwX zJI^hcp*LumEiM>LsDYDi}p0_$0ctT6W%w1|A_c^h8I5%vvx1OQIK2Hg1GgclJ?o9vcxHhv6JWLXM7;J12o^*ijT9%(txC4T+jY4;A zJ3qNFvTm=k#8X|Dum%pnylLNM7K|?TaaLX_1QMTn5d+Ax;*hik&O?^}lLX0|g>dk0 zzIX#YkVi!)&M?ZO8@V+Um5rXW9?48@>;~}^>7WP`|7bSAdp%(NMpv6K$YnofzupI)N#_&ngxl?w^8XW!QI--A=kdvWNW|v@9F> zqCWR(%#dc%nqej(+#H0hq6>SP=ebti_h4u8HfgdfyYd!kQPcxw(UwMVPw!jEGJOCu(_jp!|nnB{ZY_ z-8wMYPxFSI1bsu4&gDtRoaCcnf|X8YMDGm`XUMjQl$A>#JR|fh-kw+vZ^IqA3m*uQ zKW+8Z%B|-J-g*uUnq^;z;e9Nt1VUk4vvF}9ScIz8^d3oG+xi8jNjjItC+8KG3A@v!q1!%@AxN=~02v->{e)8qM`0-04u7i+CK%V#*9v{SIFp@@{VPG-*wrG<{YmZ*Zup9*1v)R@O8%*EOsN6&B?e zg!i7AJ*8^@b#LimQZnVVbPeXC8G-pYKlgWE*Mi)SU76Qs3lcMEH199tQ=W6 zs-Uu_2q$VyylD8UhNfl1Yb%?UH>_CG&|JaaRu6x7*REqvUH{JQPaofV%kgJ#e&_xN zh8GnS;jge@xc)YOczxaCrpl%@3nIT&fwBcuwjfs7g3ihoxXKnRZmp}Yu5f?u4bM8d^vIvJ1xc>Jv0d1So zUE8|J7&)qQhE!5qJjP--Bd9H&H^S35Dq5_|tY&Kk#$zk;MihbJ#tBbxAk)jRCR$~f zH)dF6VXJJ0H6v`zyv&-3_ZimQI&1C{tFf}Wx^Bf%tG2SawxTY2mV-IOV+BuCvT)vy z<;jX3^8jY4HQu@uGtzwPib%Z_kfWijMjnA;t&sOxYk5O;qt$|g2x|D=(A)yxz`~?9 zJN9gmNEMiS+~$#|r(Q&OIM)P*;)h}Q!wEo38oW7js7MQQs#;ciGpZU)yO1M4D5H)F zoY}#HmLdbJ3gZ<=`BXNwSgfL{rp2nkNeT^1Dr#0YHh}Be1uZo^&_Z?LL>W~D?&8)Z zIEtZk=FHOh6|*K^F|lIy{P4tz3U65+QxtO?3cE4pFe6$QS7)aKJLJd~(-`m3G#XynqCS_?;rMf)r2 z&Wb8eH+t&vjv>0r_?6M&n(Ps7sA@qEnsa_4`Q4t4!=qS?I)ug&nD1(gG(&@@8-7J~ zS7l&Y*BM4x1#0bF5eqSc?UI9iaB7b9sswXPNWwVMm}{WW^n7beV{1zV8fT3Y6 zu31{Q0-y2xzgUq=$6~>kBTX#da3m*SfgfuHk`qgVz9fGSE8Umj%k=k5$ny2J`r6sP ze!jE(=lag~@!vqnw;A|(e1er=`PTN}zgm!|2>^Lydkt?*{)C`}%~<&UJxJi5r6(lFE9N;TPoKP7JlSV)K|_@jp`G7p|Z7NF%TwGX4)+nYtBK^{v%43p5nF z+Z8p`Vt>?Jy=?f3%9gs7HN!{b7v+!4A2qyrO>*`@F zwLsQ||AU3P*}@KUS$-{>i_vNl8002_(}x(k&7jcBi?MlXU2bxsJ2Y%TIiO`+nmkNT zDpX(DvZSGDc|~hWUA?kuRDqQcupHT{+K>BuPExX+?9cTD+U@=8+XMEqzVZa0lV<-`^EKp{Xs-%)Ol}<^MYkgTCl`P43yh9qjnTN<%5^DtuJSSjo#p-1jNulU<+Ln zKs}paTeAIc9}7$ioVKr}>pw@q(@uI|L%?oZznAW6_m^*w-ni2~4M{p28CKKk`KSouRR_iC^H3UcuGlYW05;1}!SUG%h{@f95J zx(KFC3)oMi-k{Lo0POxd3(qH8Pj`==@qSlTtB5Gk84R@V#pJ8vJx{aOH+rC{qQ<`fTi+dM*5bH z|06n|CTIIuBwANwKWMEE4TnV0Nl>v%LZ$D9`n82ZB{zji?X7{Q(b^c}2aHi<-vs$V zGSR+i(#2@rVaR(4>f*bUZ?ERRht$t#{@-5lbZAhK{c-@h(f?aTy0C%&3fh6fA8UUZ zg%AAKEEEI_`a1;oe>*e@Y#(rI=L0mhDhha5TZM?bs9nEeqPN<}>3^-zy7Uv&js0~u z{dC}I&7a(kDYElSuH?qh_)izv_qtwh!mIqLBKtlUeM=}BL9xa4`Xeb07TH@}^j*pb z9>-h~8jtGP!8bpJgeu^6r3eN!j zg`M@E-!d6z-D*|99Z{ZlN5(zYP2?xN%K`jt}5HHstj`HuCR(Z13bT z*VopkffXohg@sVxW2-73#?rt7n(wi7E(#vD&Y2%)E((vWbLq#277(~>HB41{W$TVN zd1j4yB5?4dvU!M)>lHrAt1CDDj}0*(=_hz~>*Am7#cy*je0nebFZ2rcC8zo01F!cm zy=brazxP7j^au5l=WD(A^Zr!xkRLY)SXkj_Aq z@K=OBt;37;hZfSO@D7ANaGRNV$p3zW01|(q7w+`JIexDl?XK(+a*eh2G<~D#R*SFd_u-2 zMEw1PgIybOSh`pyhlrYQlfe0eD31+$o4RUNnd6IrRpk3ycyUhtKA4mUH!v}HxhmX@RbB%ztXNdly z+_nA!K1F}<)p`QHtS9n)56~Wf^REcY-8Fr?0*D1X0?5bFf7S3~C7o&)2B4o18Ji`Q zx<=rG0^bpM5%@41n?5z9-VxXL4+GYr-iUL9F5ztg_5Hoj!(S2y{6OF-s4wD|3H+hJ z78C&e`Jtci#{%CGh^^_`zd_&?0x_i5{`y{6)I**);4wumyhPwT0;@`0|5XCNBk+(w zY@gQgKO-d6A+|trF^0I- z1HexRK2G380xuCbUEpN`n+3KCTq^JufvW_r7r0sA7J>H&q`jvc4-5RNz{drCQ{Z<5 z?iKj5z~2bW34B}N-vt&^Z^6G(;7I~U2s}q1_g|83ioh!bUMq01z?A}T6L`14hXg(; z@OuKE75EEs(p6=+AxSgcjQ?V7b8K1)e65cAMen3%p3+bb+%4(vFi(-;WK* zU3$cy708|A#D6XD&jM-h>2J|40QMKiZA-*Y7C1`axdQoJli^bY&JoBj$Mo0tV*{=h z{0jo_5x7g>V*;NR$c=oA|C+$p3DM~ODEMCqkAwXayoB}%IQt#OJ63S~szu|&1fC)O zXA6D-;qgjcF7Rpzzh2-Hfolco`?HbGeZ(Qp!-R;B*}sPSgpNDSC{LHb_X$B?N_z>Y z@6850Rq%5Kat9j2TLj)B@HT<>3H++S9|?R-;9mt66@w4TVTiy6f%@KR_Z1w-KUTHVD2|@a=-@d#Vw>Tkt0({3*fr z3jUnnFAKh3@Ye~^PW1iNNbh|KKP2HL?4RL3fDm$36M|mfV+|N3j`SOZE+%-R;Bmp5 z1fNF;KKlM@#9uGr?E>!+sK*E3`*p#;Pl$Lp=ufBjp1=C@>{Z-$#w~o)tVR@O^jkb7xKrTQ1->LOFYwO-D=;=D-(dnL2)s<-Qh{p)J|OUM zfj<$L6L^RadT|2A-h^WWUM8?j;9Z0m_u&*kP4_4v>Ze2SJ%V=%{-WUf1pl4DKZw7+ zml^5(UGQ!R9{}6TbWRaCk`Q!P5Mun;BKVDjNPnr|s{~&w_#J|86MUDz4)K3d@J_+^ z3cgS9mjzD?uJ56O9Pbf_9AVfP!Wx0Y1ztc1IzH@Y(0ytMGpQleTtgJQhNwyn9f5TM z>jjP!7!}wcaE!pQ0w)TbEHEyxNno?Uc>?DPTp(~6A%s~WFe$K2V7tJr0=Em?AuuIy zm%!Zu9~JnNz&!#x1@0BNPvFY}_X~Vg-~mFE=UV~~5~8f%6Zk$M z2vJ{LA0VtI9S#($B?RA?;EjaftIG%Bx_rQQtAuYS1V5b*gm)4Lzt52`_&m+=CgQ)w z@gCy6#qk2@&tbn0I`4bli~A{GKH2wqdrJ=r^HIO&rh=ngw^i7z z;0avtI@Ayavgi3v6@pvu@?y8lCS^xDx5`n~!kc5$`U-g+I8bXwE3_CZe7< z4>d5%yLU+L6p~AQ4sU> zPlG@Mz(zlp;%{#{vp<*whHg6Cn0k1RbD_IdeJXq?59vzqj=&3kiPeC7=AoaUzmeJS z8wNi=zun*$fgkxXJBAE2pIDF&Lw=7R`)QDR@=XN46matxej7pO=a&LMswL&aklf?fA^ZUJ za{&Cx#7$uM@wd!K*UQIyk`MCYW9TmLmF_;I%P|Yn#W2H5_iQMTKOcv{k7FM57=ERo z^XKCL_{Bj)ei){B{6-2tlMiO1uY9C?<)aKlCBh59%g3v|@-gO9g?w;0MEMvm2;HFA zXW->i1%6MuPW_i*d~ZMmU-lI5{3*tq%RDCRUqR>3Zyf3J8vygmwPcg-ZE%}7y`nJc9rlI<9XTH-is>E=`9#%m<&7;PB^nI}C9g{><-Cye7Yuz4*O~ zM0@8K9{%Jv46osL8yvoBSBdeM+e#Uja*lxB^y=m^kf>95T(|qz+y!!G zv|)@(@zHmI=!O6@@AgUc*zLd)OXW`NK0O16>gec5`rYQNCx$T}IM~c&r{@t{eVy8L z#KU{+o`?4Y`yk{QKOvC$j_)ZdocC1hp7&JZKgOxle~eSO=P^#|0g)fM&?-_m$>$+v zO&(o4G!@pB2l;oAbprsZh(C$a_)@xA0&Zzs*^k~UtdJGg1S>2}P{dCvpUm_nh%tW#PdtsvdYzAqcL+_hj`B_xBE@HzPoojjeox0nLv! zSa|x{qgCaTht#u$oOR1RK=%sHx*cdnj8f^tjV&-Z#xe9l!Dz|=`d|j}`v}Kvg!-E{ z#I6y12q6+1 zuhRC-YxQ!7#*efZW1@PNsQ1c%kK0kMe3ltHr_sW(uX!|X^gYT2xKWha$9uX#ru#J^ z-v=Ft`gGJdIcK2Tv=DdPAdvuA&wMV!+nbJcZyrN81sZ}Mg6*1^x;`uF?NMKkl#{XN`F*F14J zPBjRi3CqLn=f^!#OqcnfzsU#bO&mDYa=iD`A&&{;h{CuT#PR&YLPKD}J`1-$-GfM% zZI$V=Et+&W7cz0+RNnzY8uOU2QSk8dOQPT$_>q>@(C~}F%{WFAUjcH7VIpBfv0UAQ zj^`A827cxt4c{jP8vkWRQN+Wr=H6QbCH!>f83fSK?f1DE{3Igzb=v5`%Lw!5H|5K3 z6~at@pM%@*hEp8?zk_thW5V_V_w(xnzX<$TezetwpWcfD+&udcKz`(7>W%SEKij?i z&&&)yYL3v*aL(BucaFgCrFgtK!U;O{shlHNWl`LN;-oUXFUOAF|7NAk8yJCe2i$AY zW!!}R`2*#alXq$UeP_@2HF@BGD<>J)Z6cEleFQ5u)A^53E$6YITgF#!8-H8{>HsId9^vTKh- zkHCa7EB=~xkOkMZR7RuZQ*KRX6}p?%DXMkl4;gqZzkMNMUL!x!$W*-_ay~;M?|_u# z75Z?!cm>YQdDof>NsdD(f6!>Rldkw1{6m-0XSG(|1LsKllqyb?m>GMRsyf@a>w{IF zH11PNsxC0@;bm1cJ(_+*q^ildM^;tMGVar=tL7Q^sM@Lp#(la|wG{3z;}*Xo@1$@u`Y zXJ5N;$#n}`&Tg2!NV!fpmMp{saW26^{74sIe(O^0yKvr|<=VSddoRaSk?2k0y!1?5D*Y6dUfoQ6|G2;3{r|y_ZjaDb z{sGC3^o!!dk48ECoR!07(7qq~q98q$l2(XmG&KhkYV-nLpm@=&;0Q69W&cp|x0ZuK z*5ptre&O}h%962|Y~cs19>oDr^ba4SeRU=J{_t1W=HZ;1wy*Hm>I*&aVzmXh?j}f$mYy5$w|t& zGTT%DfAriQP|xi#=+<+4;CgP4?px38fuBiwOfs&Nc=H9e3gp~?{F8#;DsU?y2C3Tx z=e&Y+UnPWm|1SPN5crb7-%9wqg8!F54lgKojX?JA#Lp1;F9IhC?I@}DAUWEO1D`+(u;AgMI4wsz7PXFY%g`MQcot2}-ChIaKN{LEvVY_@bmE%ehM&;aThp8$w@(>XfC{bT4p1nQq3&Idw0)iwl> zbi`l53x3}ENt5^+nGL_6!r#v?0mRrOnk2)o&E@CiW0r&g=*RF&0`v1r`s8DiF#I@& z_siD|oN|+fkKs2BZa=>bKKbZx_|1^=Gx?kE;{m6~Zz|~g{I&xz<;R(g;di0%V_ZH9 z@SdVw?jHo}XM8VyDIY)oH-6HaIE;8F-T^)jP#DP=YiUOh?Gmi;73m$%c2hpE6@FPF=Cx+iea5GL6FP{g%&mAD0Y-o3l}36R}Ryb4@0$*KvCLM<<^4d)xVG zUf~|xfC7xCavjm1W(GKctSVWP36v!>_=Q0}sP4$0ALz^l;Vuz(3EXAkE`vJ)cLcBs zunMpmuo|$I{*b2@?grJCb>eOLI=uCGN8*j*)%W7!dvqi54c|Gy9CfT|OCE%LN=?h1 zfyuPhoXRvt+VcU(3OOOy)ExTqu%*_fBZ)cL2HY1ORG0D$;(K{NaS-cOXhBu?7RsDt+W82Aml zaXrdmbAITJYty{X+p&`AYTP+o20z}*9E@(xk8Q>s&hfkQV|gcd;x71YOP8c@*Lw8Z z>4pes)9v{(l!fXXkSUEmk`6lC(*0szPM005&xF;t(t*xYW(?w%wEtVWq=P(Cnfln~ z{GIW2=~~_`j<7nUvvt~+(&e$I(klHxx-7XfzolPWTHnjwxjDaO%tn;WwsbJ|rSy(z z>(X~$@ul>b#LoOZCA-pgd|Nsk{ZhI*1$^p5>1Z7HNk`j3zbpI2(W!Jj?j9cr{yWZV zOV@So%-?a&uJn$p*QSf2ThgJ}uJjjYu1nwZiCyUsa3{VqUj#n|H{(~ucIJ0nyFR_G zac%mJNe?5x4BwhAjz66K;w^|b{^4|SVr#l620Rc-tHj;usKR~dPAWIH8F>R;q{VKDKXj_TcTJ>yHi4I#323pl&y!POTVqJf6dlKitr~7W`5<6?yi}#>lq3 zrB-SE9N^5!VuYOLx-50w=xY&lO^HrAiEVk+naWk89jJ6VR~Kb_*o=0$Egx;(mXD;i z<*Sn0^7YQP{7CQ)#qZ8iU+~MCtm=3otJ)vWs^%|cPx=1j^eJ<`kPgMmP)`X99UD=DfwTpm1 zk#-QL7~u}+ogidS?9GP|UJCw7t;&?3u1Xxxt5kYOZ7S0*vNu1ZI+Y0%R^hI1KnMN< z2;pCbxa89xknOoBx;I~ru(BRy9!T;Y@i@vnddL0HW!xc-GN+xPowSqg9pVAh2k#G` zj4~-!u1z5fqMf*QYesGq>S!WlWZQ-PflWeNjJY-`q?*unT$>bf+&B}V6Cv27iQst> z><`j~J(|(O9?@PHyV&5Y&ytqu`t4CLegW*!3~i5sut%uZ>`>UGf<1aBHy{q3jJ2U0 zXXI#)g4!Of&r+6&XkSbNceQ7ES9%cqH4Z3!#UFIukvHrCLOG=D_`bru+n8_cQ;->-)jpc9Vad$2WLsk;w8?|rH9iV)Y@NsciE*g7M{7XaoUIDUn$yc*~yK6@BhRHlfL(t$Hsl?&&Su^ z8GHB-Gk(7D-7`0=3;yNb4_|DL*x&;fayLO~A=Z1OClKCyp;srQ5bGfsm^|LLD!;RO? zbFN*!s6~ffd)>mT7qnn4SJT}z=jxX8!s8Y!a28&-aPe~IrWTNq!PTvcTCZj7k>PQ| zb7AYk7H83%CG!_MtxK06$5*$E@_)_Z>H%5;!FKIr)#=Ai#rXxkc@dC`d*-Hk-*x?j z98iKC!G7(Wfxr6kQ*j6>pU_+?Z|v=-s@7Ec^2)8+*+j4dZ{PPM!x-qnF}}z#Y8)?a zaU__Dmsdg(?svWMS3f2}MxKS2WQ6na;>K8lcJU^3V_yoFeoX9;%hjWJ;9@XJQp48z9hVO-wW!lHB zo~*Wcc##nTQlaE2wSJ7KEdOS_s8#|YD}z%%hHN6R$#_9VAY>6ugFl9>knt-hdM93F zZKM{R2;~i7I@v>Xe!$ev;ao0b@kMl`#f&rt&UqTu#YZR83A?4K`I;gNf8%J~A-#NraJE2)jMNh)#Yn45^!l(zy?>rQ640;owIh0_w#PG}F;R(+ON&GvU&YkvCz|wdzMA!cKV}giB@S@rX0Ld!|Q13eF$;U)+;BLoDnF&+cJ^FsOE=CEc zGY%_T2Q<_rw`}PmCC?D`NRPVJE~K~Gxi^mo&CTN>ck7-1*Eif^=iWtL;%(ClVWHf= z-!9B$Z~vw{-si11+tJa#$9B1L-*!23xjMGzxm)FM9~N);u5d5tmJN2;RM&GOo_8@g zPAioSeEKHvDmNi+-W$XaCVq^$&-~clT#zWHLLLXbBk(xyYH^L$_%Ccf-n&Fx-=SXX zyU1L7oDjmD;y4-h1bwx*zTn)wY~6nex`Txx2PaSKd+V9i!G%zU4RL?$bh3ZTU|r8G zgF`(z^kwG0d)UuEjx2@=dtD^v26ibjhMy{#(&4y$-T$+z5nldvDDEJ1Z&YWIp61K2 zPFY=uuO&g$JpLk_{g`Q_4-v%^#~V0^KV$G(k6IxcP}!64CrGmt(0?5jngXQgZ}?MU z6|=>b6bGpMt?;q-93k3DRl;osn@RI4%f1KDWvW8_i9+dD@Mjzd0wapp>*MnEi2y$! z`R|UvGNQsd8b2`xR+Rn$v^UbZs_1fZC@H0!dXK^)lqAH&YhAe=t5Dbo`2axwp`fF0 zxx4ETUkF#j$No#?Wq3v?lF~6Fa9CFkF4i%J15_|3ef76G*P30)YMJ3LMq|o(%Xj zUh67KUCmABykF9q%{r?70O*xOo0*5|(Qxu8J!{S@2tBR^=&3~KlelICoh=Nh8C7ud zc6sq_@SMl3LezJe>^#khipT5bt!p&OpCx~yfbvv6p42CyH^cdUA#Nv7$| zWS8?wpggTmP#!4FLkF#EDe`gu33LKE&rK8E1<+8{tSWpq9aDILb(}wR{k-&mhSOh2XakL|Uu8d=O8JW3W1r5#Kir|LS5dwits2XMF3e}Yr@ zEZn@+G1%Bp_afZ8>As**+2pUyUeM=87x0epj}$CnXw(o|0d59xhn!cwL>X^%4a~Wy zCtaF1x&~%8a9yN}ESBle6{uWo$Jbk-L2D7%29GkU>2`o)Qo!$}<9Rq9rsF+0I_NkN z-Nd))I2Vp*>1cw34ds|tICuo{F~5f6O*;Mz2M@bFCW6l=JT3B=5pa|s{bMeKgXfbU zGY5_n;c(5*OgLzcJ}agPn>x*n&@;PxslbTQ}^pT=#PNpX0i6U|-M)RsI#YuAbX<^$ZW(5!Bhe!(v89 zj72vyg~sGg&3+_pob`}ZjdV|AhsDTc3}AkSt6!OYNAP}j z8z<;47>Q?j-aY~3i)L+y64jzmPrbAp08;AWO!It9%8Zo z-7WSrA?+0`8y9CW>Qeo{`Xp3w1P>Jcx^fZ_4dz;4-+U zql;8J>?s{a92E9vy8+^XWe$b}Y>B$zqSJpAZg!)cc%Q>-9!{-i;+=<=hLiI|_Q>X$ z2?xVx;U$g#LG#lO*z0Gzz_h?aLQkH2sF8eFMCSQlxdiJ7JFY*@c4_a|3EtM4f9?+x z_`Qv{^DXXmfnHyi-)UNX@1N(=cZ&7(V+KuuZ+C^;4)xCp^q(H|y!a5mcvzwd$M}9Q z;BAdG8!s0wU2t}Tnxn4v_8HBd+qw|9nYGMjLi~w5F8)(<=FU|&E^S%b;{MeVdRs}Q z6cN$ANsti{A<93a`R5G&Ig@`H)U{E30=Raxy7mlp?V0M@2DNa`;_LMv-1GO@!ml6< z(;k=qnY~c6mnKkTE&5j<*WCbV6~1fUfNKdC&H+6xaKukC@Y4_x_L@a4`tmzmy@YYkNf5t%M(5CucOiHlWq*|dqM9PRJViTWB;z@ zAFyRd`t`^^@B@^8_I-4{f0WYq)xYS83RW0}wI$$&GX9VLfvF>lKr~S?+y% zv*f2tDbVJ`R-F2*1*BWytz; zDD)}(Lc+2P^%jIwgr|hgz|B>mib3N_8KpxvKPan<8x1k>Wl1Oz@v6zsQ={9 zv40MgemXRKUFd{~q0-5r1!{zTX9Ac)|`JykOH5(qIR z6uB_u#Ea~|<61iSCwU285;VxpT5I)0+_iNGAr3g>hPoPiA}-Ie$AIQ<@U6j(a|#)I z!cFux#{Dz=2P5;K?r$%FFjHJVO^a~QBGPKoJcBFzYV2?0KEJ_sCuMu*^Z2vXnsfnV z<;8mKWO$IC+rX~O9ss{rO}cP1UGTYEOZH77_Vb$OH#E-|6s}CGv7gidFCw7K?#C3r zvT}71Zm~nm|4@_Gz~gaEzK`VPZK1L$p%bU#{y|*zhuZoom{-|TCWX$i&zuxG5p^!S-0Jkc&gs#XV|`$ElQuzlVBVU9=Y0z^x7) z3l$ylz0g3^e$k|&b&zl0=b`Jz+e25wJ&Q$s3SC!Dg5L>~Cc`-!GS=FqD3S+QE*Wdm zWT^Y(P|YQw$i<;ymxL-Ip))Bo46Kiv5~{oaRW}Kq&<`6I;0?8xL)59EVfJDq#Gs)? z(?X$msM1~x_f$Cl1U5t%7%oCmq0p32_yYVbS!&;k8yZ=~li`}wBX_skJS@ikug~)e z$G?7VwY@&@4sN%DBCLkM53PJUbP93|ZbxrBxRemBL^m5||09}BQa78nBQzVR4caAS zcmTKjh3r3m9;*7M&*9I*ysPdvE8JTTjk)JY z)Q4{24UgyvasOV)c-$BG-Yu)`O~Fa4;dq)ivfah|-n!sM!}&sR^_o!WcX3bPEvo~( zN{-gA=d%!Y);#>(9`B1NJhpni2VSh6>4EoCTib$<{1 zM70Ze%#*W5-3z?l!%tM}#m&!KmKvf~0jHb4yCD7*&<}>2b4KD5gr4Js0M8_=sNkX}$2#z3?;DZ+%6;aU6g5W**}2>K@khA%0h{@WH*pxva*A zzp^}5(&OZn_p2p@Us~e> zP{)ObY5cH&>cw=f%$bMb{@<+xlEgu2B5n~j>8bnu-FQ405Qjg)*1lYBvl9TNT| zA;R|(BK&ni3Mu@#Oha6!d!}m(nBGYE+hy*C9Nyc-4>ooL>y3n1Fr$3DFO2f>elO|^ zA=jK4Pd`Rp>&kaTMVz9R5X0=c})@QIjv5dK2oMKFZKmkQMP!2s_N z{3U_i0#7V)=|4#beVHrpR)M<&{)fQ#1rEX57wNeMMmSU8Vu8OE_*a2dSd1jy=>jJS zY!R3wgdROE@RtHV5UB4%L3j*{h@`t-;7)oaDCK zz+l=A;DBsmfs?VOFZd8bM}AL@aH=ZrF^Nm~r2?-Kcs(HwUR^EtLjoTW__)CD64v70 zCc*Op-xBy=0@-izci?Ong#4gMIjQ$N?|+)WnS{{is|g1y_xIB1P8JEy-?H*vGk$Dj zxc=QV==JZWk?DVv@NWw26v%Us8SiHTeyWJUlW|;GKTX$RKj11|9=YpSHXE+EyH;ZZUE^FBSe1A z68{SXUQP&kuMv2oz|RR>E3jSQeFDEE@Nt2A1pY|i&jjjw!NC83;O`3jP+%$T9m1;w zo+R*GfiZy-1vUw67Pvs*GJ#(c_$@-%r5_6Z5+U;cbHRTncuw$l2~ke`4J+x&XmZtzzu}R?QG!x18VEkAHAKjauA;aYykq2)yQO!`9(oi6ZY#39EH zp-&Nl`Ch@FBZM4p34V|ea_q1Gk!}Ye(tDl|=}Zg&g8%D;;LA_ZB^l>;wA4K>jv#z(Vfk1^dX4*q=O|efio_y(db_6ZDX7o0P()_H^HY4}u_+&woc{WCl*DwnzZ~5gUUZDY8MLGPn#50lI{c&3_6U2PPGeM= z!A4U?9eznnk2Lj1R2=K#zcywR^#nJ^=<8$f2Uo}NvKaiqMKSsq7#@#n*noEQKj~B$ z*bI!F@ZWo8;^5@J`8;59^aFFF=th^Tp9X;jzy#^%%lO-yu0+BJ4BbO;qg(NwWtjJq z?kv1ao^-@NhZp=3s{#4Y*3#dIX!tFMpPye6{37rpKMZd?e!QF7FJB|VNM|0y@8_WN z^K19Xhi=>B_cfQFCm;I&%10VLhTm6u@!Rf`kLi$(@woZaFW)TqZO3aK!>>Px{POMg z$%kp9$1e{zNIm)91I~0v!^iN;!0qSP;ggT+lSaOO?Nxq<5SGSk9>edNUis|=zj_d{ zKDe}F`29<-@_QA+Qa-c%WB8rdi{AmCd=)-^pG188_wJl$M8GTrSr-q4TWO5 z=x+66=uQWnzg*t;rHd}v%Lmh7GNyg-yj-pen#b^azZbufGYWdjHby$ivCrk_$;UYW z{Yk^e@O!ZrziJ;p3<*4b(;yGUG4jmgnW9H z0%OWY8a{^K&|dtKKKW{ej`618^~<*#{J1V^9>ecqc=+XO2fq~jC?AHdo_r46i0+l& zduWhMhctW)Kg!_e7d^93ACAy5-b+$`NKQW-yVr}GfTHq!ULe#}KXr&46E}g$66e-* z8@hR*b4VbMq1(`lt_^e_8X`bL$2q%kGk7&J^~16Pp$X$0-=E(Y@=GCDey89y^^0VB z@Vfwt*KCCKg>lWr@P@Z~7)m$Emw*Z5CRd-giXp-IsAHykDqfQ=H-4EoT& zbhT+159R=YJSL30IQ{&p(eKAVLw-~VQy)oW0;Jwkk9Bvh>yS?!UeZPICKk`Z)s{R% z!94*g>J%Q=?fx})`;0#K+%wNQgESv~{?l_m(-L^+KV4%X^++?$xv0o0HD}lFZ(W^GUFtzA@NMAy8Xx>Y3pGl30Fus@0%z7 zQIIr8d%01V;Zfo5=Xtbv9~H(v%+Szna6;yd`Sioy{)}tNpfAXL`{R?Jc^TJ~qmjW6 zd&gs#;m7h|_zFO}>2F>`M`-GUVSfKHQjTf(->K62&Zi5Y6BrjfG8GUu{^^wi`{lY% znv%oM)H35>rl-Jvk%X^9N%0K$0gO`lDZuL!2uhOVa0m4&)i{=XGKs4$4U9w-vl9k)KN$*H=D9mP-(Siz$c7LVP3N zY{c(EIbh8D2+QS`u460@R^P{x0*P$ zg>(&{35bI_skuwifsDG&y*L$xIHue_jX3ov6O>oiC(9C*mmof5(D9PKdNE})4fLii zlP4DH&6Evvq07jfJgJbL$=8P{7c9-xfL^BoTN_SR73fSl$(n-S6r8DpPefhFr;c+T zxu3;q*8zed82L%E#~JXu>PW0a3gy~bHRU2G4gERx3;(lqt^7HCj@ zI-Lyyk$;VU0&z{gvY>khX&YX@1^x!`SCIB^;8u8eU&84)*9&=mejp&)Vfa|U(~%d9 z)^b*vKG)9fgsnz?DPtyz@Ji5)0~`vvQqXlH9PTjbF>VXv6IWMJ|Ealw&^N}#Sy?)N zX}AO8Cao=Q@arO8BzORB^i^TSF7>bNCQP z^CxuWeI$8s+-bjOd<9zS7gjG>KVchbc0_-cv6_)~VrRa%#?ICzasFEvX!9$WLole^Z00zd9$Md>MG(* z%M?=|%ck)>tw*e=rTwU174SP5ko8*HZ(0sR-A96m$2d^fuyv;E{tM2!i=j@FYHB6g zc9`~~6Zk>+Q`exE;ef>Z1N=&yaoP9JQEWS!*Bjm48__1Z>;{(~(yGjW4*bZ6zyHuY zwZ22wid97xaVsg8o2QN>^-RT3H#k2JdWQ4z@S@EyZe3)nu5$;_LRp$JH|J6M^{WRT z#JBzN)z&=HLtA#w^x~OmOsC$#8JBT44g8cm3;R;(=gG4yOK?8g{^t7;Kb|XU#@T2Q zoWU5uxr^Z6AG)b!g8U30ih5M>o%)=<0Pqlo$kZ9qtcj&_`1GvLjl(Buw9!{IPt;+! z4Po6beYiwzbM>4&!Ar{>OQDV7EI`n>`EqGoze2v4mX|M_A;@%bvPAB#SQ^zyx!p72 zkbkR$XP|BPP6=uDu`=-7-e&1D;T+`oMV<+VwqrpKb0%D^+U(UsS!8q88p3|0bGT!8pN z*c;l(@o0av6(!Nl**eG74cNF$iJX7OvanEgOdFpFx^RwWwxk*D8#K%lY@{v=$dOag zR4%19v+ezX@u=5~7s1(k^fUQj98H6;66Aw!12KEzxGPNEp+ECUi1yTFMHKAt=ByQo z=`$Uf25fuS@K;HcBXp1F^=bYHXWxJ`O|=X>8?VGEgkfupmajOT%AgJjo$k3nCXXv;fEp6}}B5Akw8f`2CpjL-MliuKu*LDaL|0lSNIteB*q zaO-j^b-8_OzAcr`btHe4DGrxptx}$|cTe7mKLa%kr9&8dqMmAaHYIW*8+W5&8f^o zXQVPGH9z;}gF|q(WbL>t&z-bBu_KQXqUuKW8Io~t$s_C6ROg30%@E^ zlfhC-jY>n;J2z*ytM48tgWTKIg9q+aU&Oom0Qr|jaXu~5tHaCo&$eF%SyeO6!!>O` zmcsbT%`f|Tw8;w8qaN>}Zo9|_^6B#6*j?wrL7$Jlc8ssR>}O-Z^S!qI+V0uNcSqE% z6V^e%K_A^5M4e2_)S-Miet2n?JrLzsIj(Gmu8-pLY_yB%TF*?ql%QT%|Ew3cPHye9 zPIMjIhOvVl2TY^h)-Vps;NZpXSfMvgc{{$>rsZXQJ$Hoq(l+EM^@Z`LS6^0Xh1Oll zivF47d|j4unODTF&HGx&L9WJwoxrluNt`vlsELLY}^tZ)Q+ z$u!wMU_a3RtFBGJ5!S`?m!F7qW;h1catI%c=fc%7jt!b%k5$;w;~O(JkTKIy#yoDG zj@*xscTl|y{uuL+KgM6|_v##%x7!cJbFXnssMFb?!%bO1k9GgW`oS*S{Lj(%un)r6 zupp#o9`6QJ zMdnTTKM{GE^MoA7;7kMa$Bj=}7}ubz82`7x`$I;5U;it_!>TXNBYu)LE;AWpq6KOz z-c<*Jk$uS9RM@DUp^`{4^i&1MMc>aoRnZ9@N#&l0TqROw9gkvshBB*1nN2oj7B7@n z9m=aC@>8u_9nQ-YkOyP%sTJdqM>Bpr7iHAZ{Bovy0Qwjwh;)n6lv~?I(jnhYlw&TG zc@pO^BQH+UwWZVtwwgxv%qCa~_ZNafD$QB24EEb;Z2RL%thO9%ZO|=#{p; zEIanIq-(=D##sOA;#in-C#**e_w-44Oec@z&U|&p&U~bKd%h#SA7^Z1zUjE<+mlaK zYIeHPE04=J}lD%iBoPYJ|rZTrESn<2i;T~^ES#? z%MV%BLdFK!J;?XDd{J4YU-=5iQ=JwUsNe5b{|339-u zc6odtFXr7{^Pt##Ivy)eMzD@TTZzL(bXl;^pl#Oavi(Ic?$_%gIG@~GAKC5R%OLSK zB+@7YJwGkPMLBT3!LcjmCKxYc{MMYxus#DAH*@TX`y;Z{)3k$h;)S`iIrE!5DG%p0 zI0!KB@{8y4uz%D)%s1V&jN9GyAb&p4H?n>p*EHRyd3gd)^oi1+upe;yxk5POwB?H+ zJJaBr5ZC+sYeQyj!0nILfQQQmWBEe5H6pS-y?K;Avp2rzD*2s@!TMu`>X%8k$` zH$6g^?@*=}cgM{Z%BX)7Z4!Lh24W~vU581x?2eRAe7)v+58CU_{MIDL331FJiGRi| zC)A@A`Q__Y^JlV_^UCX1WC+II$;@AMAEfKNCW!VMLp@4*T(j)j0A4-(MP{^Gbjj7*vRTbm6iloB&Nm(cKJ&kzjP5G63RW=Zu#eT9Dl zUA_I3@YU-@(jM6NnDPu^j2vv=oBvQL+_`}=m2}*CLYat;V60>{`1%0KV&r}g_I)fA zL6`GmWl4^m5ayLT*UepBaP2+v=-ElG{To?W=9~+-GQ0MsxJNkZ9`dpMQf|sjd5>l{ zIo333+X;+)P##t?mDzwkf$6av$;(oaT+n$LqD`wrS1>wLI&xM9pG6D1VH}!;y~lkth?Bzj z6n2K?5{bEGKz_8LhNo_`$u{=M;Q1M?e?@9dy2zR6=^xW@^$=rU=oIIiyb}if0qQqp zP4=}}gy$^qvYMe|;D>S9d4EKGHF|A#pq`t}M7i(Anhev8#L;I!-?WXy7`>?(YZd6L zIc-ECufUAkroWMY5Cxj*|Wj%Qg$Vdz!Dfgg0rivG;)vl72}-Hr}R+ehfL zI7fb4zaI#A^TNx)-bIer5P zj9itqQLp@_FiY{C7_8f>=iX$yC?30NV7IduYpm1oy$9c#KCuexEAfmPP+n<`T~*mV zUBpxFTW z>L}U-Xo8@@+zj^);Xa|r=6q>HudnBeA)i8dGkySegmZVUxBL$MD!=E<0uRoAn|kiT-f3Cx$&p=z?HxGOpL0MDQGLf~fcG-xs-Sgo6`9KWq3h7!& z^oQ*%%bB@witDZS=40TcZD?e5zB{s4f8$kkD#!e(Q)0Qmiq*N3qR+iqtfpr$?+SO% zR5|sTST2M-U~KffnpVJvAzV#Y`rA`?J^UFTbRp6WDd1ceP$we|+SyYJ{%2}`%ZtbK z0<~>9+fjI9xd(#NGQ;7=dBS|gy{wQn?Yf$dxFQ?-3+sy2S>CS%daO-MufROFrdw6z zutr~_TFY|*d>6p{J{Op^DqGYXOcy66qyxUX;?`6N+%x6~7fwu41&02j$zq`A8?x!M1gU-akRR$g&?x zyXROo%XmSv*o8RjC7v6JIAc*)zq4rrylK~3bU;{8GhdNw+MZ52! zU4(J!`Z)B){;?n88V&o}evaFAc!!+ZhNxo&JJ;y5b4-KdRZFc)Th7Ivt@PreOlbFZ zp&{|;%3?K2JMt@Os9rRGdq7kuESC?LcU?ZSc{aC$!o&99Q7cp#9OlB_7iZ)UM6hQP_qk zZNu~o)`7z7BI(>z+6G@-Z5t{JakXtYep43T;WMDGEK^Mtjci|NpWSMZYadpYTkm2ttM?g!0`*)Bg>UK-P@nzf(9jRR?C5JT@j8`Q2!3~FphQS zp6g51Ub`&UYegNMSWiwDWBq1UhGSU$JvRMA{XMo!U6oNkv?`%HDDSH(U^8kWF?UY> z(&V!2+Rk)tTv-$E$E&ep_&y5Uj>U2h1)DOM2YIw=f*YnTjG_OyD#P!K{ATB0f8tsI z$Fm>Rhw6SWdgMNo^IPVr`)#aW$AY=?bXl5d>b#9txo+l7rgg9tTn5L&=yheR&y#d6Ls93eAfNu_2pP@GW0C0W@gqU(v>#t0oI?HG`m_?@dM;p*KKgc z|$txrs@%(|Nypli$kO2eK>~-^j@EpoM&Byma#crf*8>&|6_^dPrCnLic9KA?+{MGtYn@`&p~(Q`tD`5c6fNE0N%4d@Dy?C14*Mx1Qef)ze$P zdh+WE=B!#*VB5P`9vnk>deQ_vY3ALYZXe71>w0o9u7jUnPjuSQ)3Ox$UdVtkhpy{o zJ{b}|88n|r3i}?A7vz_CZ+$36xLej(4}?xMIG7u-{?wgE)Q$bnjdr{Tp$`Y}F2TD1 zFZy5oP)8^$((9rJ_pctj$lc#D65|T?E7TpNx>;4pxE+yKGt|QX^w2@v z;;|K3jBCQ(=c`<2Lk#oJ%h^9XudvS|Cb$|Mtb`l$)XOU{#}2FW2k0=2OS*8gm={l- zVO4^Mrh{BzTwLyjg^(80r2Uv$l`XcMls#}X_SS(%&$)Lwp5eh_A>Pf@__Qvjgjvc;TkaAua3TsB4!}&YWkM z?+;(VI#^-f4EOaEY>(a-v)&!gdNkm{^~tJ$Rx8!c2?xL z`b$};W0)hRi;^?b@1k6QyWaz)+&I4BJ_1wLx-Cl>3^&(VbEGySsPt*y{p+o!Y~3~Sp5IU?8~3I7^VgSrY+LLXtK%3`>9z@Z&?jhJ zfsSdr;*$~iIcgc9nRU5q>##v_^v94HdswpO`_7s+?EiplMlRae!dm>xgHUb*(XKF- z$2bl8qp(NGl#gFORibCzFr9-~Kc@bAV@54^Jcr*=pu2R}wqbh;@D^f9oRHIrf2n5RGr z`iZ`YYa_ZWMHblb@MM&?_G{mOypfM2{BHVqF%5`d+-Q@Nm5z|jKWmEre)QJ z5Q_Nh59FY2E{d=9>?8L+vL2bPE>Glold^1_4b@5X4t128v-4;8> z9&Fd&c8c4R>1BxH*O}gO-vAyz1x*r6YLSrE*~hB2&T?(Ga}~y4sZ=HrgI*!+l~wqL zh;+DyzpkC*8+;eW{5ytxQSZkBHlnP!erR_5Xq@^cvsH$P~sm zGmbL80i8F#nNgv2(;MH+(BrUaRoOQ!=-I%*=tCj5`5g&l&f$l;xiSZ1ng))sW@JED zQ5M5~Y3L%_>b<%iP)6>a0hF1vRrJS}f6dYVjb{P$Xg+kU4En+{RAu;9lE8R7Ci;T% zW7)a9FU#RKD6mg)j$t#{Q-eM0DekT5+U?aX)+b?)nozg9QMXnqm1%F^ndcl*f0w~p z8gxnK&$q%Rg|Sb3Du3r!b93bFHv%2(W2WZnAkSd7-QIiJo#%6*csOm1#h!L&eA@LOF8Q)SJcdrZensw*dakM49CIFiTJ7hKaZ1{Gs4y*p3 zuS3qo{$H;{|Cp~EeI>^@>X<3Hm30{JMO3;pI4u{jS3zCexdPXxyH#gSRdZg5Z-@io zQ_X%fUctQ{)xJGSwb-{xy`mqX;|ueCMvzNQp;3#>1ewi}N+zhf2EK`xcRK zj*%#LD$)V_&);3DFypbGVt=p;^WhZ6z7J#U`ys}$4+CeMAt$=MhT*nKMj66XO&uYH!Rqy=(fzMD5n5yV@dS3 zJPu^Yb;nV!W88j2ouMkp6F6+ej0&cKu@}}F)44<>^F{*Sh69aBd;^=BI~((W5_LPq z6RDh4(f+1&FquAp!Zhz5xcR;)??k{S@$SX@I$neK6qktF-c2%mzp7du@uT)nI;Z+##a*P;4S#rK-!~I3{c`R?}7{XDu z(50EEw}`qe>p(X0qaCLVTr;B_w9`fw%AWu&=Pyw}cf1B$4;+1XmrAB`lb1n<@LjVs znSw>Wj1W`cnK|kce=G1g$lx@i&g0ylJA>y4)C7X*Ty2WuwzhNyZQi=$ zO?7Zpn(J2PMSrW$odn0v`?IG za-D?kf5-TmG};a%Q<*0){vc1-Da>8n-`TJnN&5ogjYJx(r}N;h$6UyZ3*Iiz%k)|a z>G|Cfb=+mr0zatD<@z`1+>_0?VaJSvJ6>IQj{2l>&y(Y80JpX5g- zV2|({JLu89%DD*nT9TkjMxS<9dm3HNWx4B7R@6PpN!{a~5-l(4lI1rS;W|yxBfVb(dcZlc(F1Qj zRI!*3&A)9VG8f8~I8v3_3r5PI4Un-4!7j=I^7`R)$r2E*NSQaRQe z>yP!=v;NxB&Hu#u>!v)qF7D2ERJdypSZA{q{;sgs|1Q|*vqAS(fcEqDv}LuwNt;}w zev_|HVO<;R+1QJiTaP^3Sm&!lS=GSaTmd_rYIbe$ad5MJavk+}xM`O;NB%s@vl@K( z{YbTsgMQwYUXJ++)*>>&_SER((N>qo-+m(ueF{l?B|X>ml)5!tjdT{0N1XNZinf2m z`R$VSugbx=KFaUfFX(S*)d{hG(4}i3FXPa@u`P2S7N^rD!K-=C0In;@m@^_q1@Wf_<%_bJL&6b5?5Hbx?P2 z>chw{ZNo0-H`+EpNAdgoR4#^gzAOHMp7WvYg66h#%$but-lrcXPi$YzgH9^~okCsg zioB3dMQ+PK9QloI;|~M(xAEnvt~a0?x{urfJI3D=-U?lap&k4dI?Hn5w-Jvo^2##% zCEC(1@T87Yx6X%d!0%q3L-J?>>pI}UKKFqSy1VuOCk^o{5#H_#zX#!MZg_^_+khv1 z;dcOE;=?xspXtMI1rFYj$*reie;Kgs{ttU^16}1+<^MnTEx8FPTp)!9nl=|m+t8*p z*c51uZAxiNE9%V)5DM66QBhH;Vnu~EwNz<~3L|P&#zcp9(CJvLjDy;7Vr8@{jyR&C z!)PGIB7=%rwa!%g`+WC#&V9+fVLI#gU+cgAYyF?K&a?M9XYYOX*=L{E=XvhMCk9z- z$i8lk`)$568aS@9-U)9X9&v)fbr(k2LfA;qT+Vvio?|lp25mI>UZAc=u5QVnzwFR6 z@V>%#6#kq=-~VZCBL9Ch_@UX0cg84b`|;R1XFrWG$>2xFH|N}(Ab*T^3?8j#kDSRC z**oXx&mzB`KBxZlDsaDNkY5(>8J5z1I=dv@&S#eaAMN|$QKi-I(KtS3q`mKb$MqW- zdxC$r_rqef9mg7j15f4GeYCH>`Kb=xb8PS~{1-dszv&|HM#>BZb;iPcj(_Lp*htrf z`0f?%o4G4hMr^V>2gE<8tB=b+-$8zgZ;#W#efDkE7m3G+XQFtP{-p1*^Mh@$C?0TmOb9p>{x5>7{e4+bKt5 z2Jeuc)Nj%0(mQY3%f>pSGy6B_^<9wmgPhfe&xQN#ThJQLk(ldh?`%r)j8prnE*mek z&()q1Q6tZ3|CLD&-vfU<-KlYNy6w%B9wdk3lly7Yf_~`57UQ0je2w|tt9x($Jb<+szpHfpG3l=TjpifL z?rY(hnA%KpZjw1S9o$RV*Z|*y=BWJXw9c8L_xE%T++;1Q_kCYv@9^pQPkacyTic~3KKyb}cK_J%y8K?7XDGDkoo%UO z`t6JwzGI4a_a|bicW}+H_I2paHxj%P$J&)JS!?3e*da!Hsn5L9+NEoR-~5^U3h>su zuqp5CJ{SB;v`@_)Jzw^n3BB!Gb4OpQIQv+AtK-v{NA3NGbU))M?>~6?JeS>)BQPmvF$`@UmqhjicZr}PZBhP9#cW5K^1kLT{muj}hM zpOJ3zf!88G9o#cqlgkau-!#riPv6Hw`Za3``vxe5ETuQ_EGrJ3^r$CaV}6GEmDkOE zXQ%PX$)k;<^&jI%Y~oMxtLQnpWbqqICuKL;>@wLGdw4xHUnI9_o%2N-ulT;4zR^4K zV(4m+ullO4R!*Pns`tH?j!36rH<*$;5+aogR_r)oAOm& zeg9@Xe=|E3&q>su=l4Nvu^#-s2z__I=ID_xBis9c`bf|kjoqeeZshaGSKYl2i0>;J zM`@=t^T{=hj{eh8+TQ|K^lv`KFl$hLbUo$kEX~dY-_ zOUjfCYu7&2f%h9|yA*Y?H0pDY^S1(z^or&J^;y2t$p04B9#=Jf3(M6_-@-KU9hK^q zK)&kd>$Va-^xFxl+nx0Z&QCje&!4km>aRNI>x&=joi?relUlFV+55x{eS;&@S(j>E zyI@#;x8r#I5YGfVcqcK-xPAfeIS0Y8p2gH~)>xILu0zrD6?9Sms77u*^`DNPc)Q3} zlX#xsZKCsm>GU^ekEM3j;_XMj=d8-vQfm;4+k8VC1hhfWpWq#dRL0wwK7q|9>f5oB z?`ER!U+ZJefFIzy8J$7bW53?**bjX>a(qKEI6Tt6hx%+Acxrx!)&w85HN9*hU%4|` zW#`bdsaJd*@8n~jM8C#+_Y6xmt!j}vLSgRvEy>jhU*kNn(~NxN^d%tn!1Y+=7?;M3Hvysf0~J;;;J`j#ZsKX`O~ zFhJ2C$nbvB*|E&TN%T|W5B6+{_P^8>J+%g5-5RSede-%+H}@YKhi}Ek@ogaWj=gJe zmh{uQu{s;om-ar%cvRi7dAK^a#NN;0`KNt@wl4D9J&z>K?%kaIuh(}*eLP3+h}I+7 zj~!n$L+hDfBtE+X-^v|*A3E;AHu~23x$Mx$ZTtq+7TIgv_l_peC!5`VJm}|4zjeF5 zdE)GpZzRyEu0Qg_4%Y_nQeA1+g?GswIz#2W8GTt$-dD%D? zgdCxl&_`HH*g(*jxsC7uVHZLDau|Nv`XqhP_Tj8kPsSDx>f3;mRWBX1-z}Le8zCez@?408X4?AkF96jwQjo` zb2=xues>M)Qni)(XsR`8FYKp2dI7ds$QnVsv8?Nt=2KC={8xG7;14R~Pa*$d*0eRq z-tbC2mz7-JO`gzi=k`0u(^{Kb zyq}^yJ^#X(tD}c?(HP*N*0+nIwGZP-th?y!YYhX}PTFiMLDwT!^L-?1YOI2_gFIMNj-zC-uIiNc4ghO+}1zpFX?rx2Xj%M zLGRd0T%VDDCb5;(ANz-rx9+{e$*9i|KbhsZo8C8Oojs!cMl9eRsQ2<)T=tuU?j2Ow zL^eNtL-f0yJnO#)9`%vm(ho=HTY2!P&DBrS=!&0R8B4?|$KF9D&FPgPk2bk79c;0- z3W>*TukPYn&v>0!KiRcs&u8;vYWi;&Q>nY&x%GPu+Ks+P-{2i|jZ0b&JsSML^w|^q zU}Cj?N3JHPeFanR$MR!Q^{BBZ)`b#zV$qIhEb%p(wu-0_mcU6vL_o5?vR``ElI%pr2r3}@j$^Xt! zM9cn&Hqq}a=)3rW&)C_L(MaFT$FG$m9<>*3cT~T7b~n0iMNj#G*2r(5|M0rs^_VQ+ifj?^x{pczstS9p`rp z98Y$@!`iosJsa~t?WZPewmz!g1k;{yj`0p0|1J9$jZfn9-%V*wqtDy5XAi%-!*3{P zeY{X-Gkxq)qVpK_&oR&1Wjfw_OnobyIKUcspt_FrYC7}YlzclK z8vrWpy(z8Xq|2vnd2hilk)=IDlKTINy{6XfLGX>^xkPH@nxMn>NC|ANc|yMYScZ3^ zGVc2t)dL-^4~@e=q?cqQBN@f{3G$2M*wVcR0gtzv?<;lG$?KY9t}3>h$>40JY&{-* zn=Tz>H`bw658l1!OytfR zgE;3;{n)2t_!rnSz*cd71M=nY@jvauf2kS5*13_Fz|)mJ{#0jp{3+4s94OWrd=URR zs&~0#L(twhY~>__hND-jjGseyElx~b;O3pr+O0DrFKH9XQcY3ARe#nNn8$H z_2SGiorlzQ#D}jwG3l7b=u4j%JPQ5D72qmQJlMB(2K5!rTCz46Vt)(HcL~&Ic;qdC z&M4j4*}&DjgV8ZKqHj+x3+j(HQO;ZR?g(`)dk^Dl`pp8y(u;y)xwd0ZiBGciJxBf5 z24j}ad%2b_`zXDY6%+Q5ZKQ7yyh4y?cYKEljoK*@*(SleuYV=mX0_HNKO21TlhyHI z*==tt-}biB@4xy%WVt%%9SPPw_oX{HTac||JDv(oZyx5H`#B$ILt7`W0V*saXzkob z*h27e%?dncU#*n21X&EPTZ#QP^-CBFl{e+FtDu1jN^ew!xN z$G%K{LESaJucLnITecph-!x|UU5J%;9}B)aenh`d@Lb2&N2*ueJ?XjczMOcE_UZg4 zz}=Qtm#NCcR^B}sx`}GL=Q4cz%=64y;PR6MzYUP+SU5cK7Jdt0@xo*Jjo|v1zuCV1 z*Z01=7O?itZ9W?B7_@Ky_1}QVa~S;2`l@4hwyFPh(*L>>Y4{W1^yTU5hkv=^>xsWidpyBA zS~2z=h#wr0ZT@oO*GK+R!&rnI=I!b6X;sJ6$Cl1N{*-=W5}$;&`zU^NSCFPIHT}jH z3`hOy*Efue@2D#6SJTz6IurVxHNCg4=S)|JQ;z9**bMsA)#0RL7YR?(R+Oi5bjHX( zkMhm?;9d0FV?mnVQ}$(H1Do&B13PR-?+4=3CUL&5^UK`P&72|m`lw&dmn`~@`Xy!C zdt0~j-j?2x!X6h5+!FQ6T*t`evHGK0AIaA7`nyIZXRbLGuXn%Ypl`He^h=#tj?cu0 zC!{(@noUp1?v($Q_xVO-=jeNx4&IqL`{>2U9@CdOF;ktYH1Se=znCGA*x%ybkhcYkfyhpBjvPiahmy zI_ceBZkQW5p33n)z*j%?)JK$WbMOa-wKx7Saji@6C%g9S`HanH`t39M6^%B1Pb$)7!i&zw}cd|h<2&_(~J(7pfIQ>rh% zJ3W?x_SB$$E0u2`hVA`5`2lkhXPJy`_(^Qy2YGMr?qTf@eb@r7&=ZBlz11Mu-m z`Rl1@19Cajp>1XV$B*kQ%j#W=eoeFsbuO zP@vv942B-(y}AC8x?%cF{qRUE+s_$rmm8;57s;FP!KdQXWiyOEoN1g^ofZ)^Zm)@g zkM|L8Kql+QlUX2beX<^ymTo}i8qRG;y-zq<>os&HKgM_P+S6i=kHrEvN6Q`^!O9Wr zakuQzF-%AU_|eD(Fm^dA00yn|oW9oZ9_B=zOH@MGi8z6;;M4t`J6!90U~-P#o!MQ3_C z18FTfOZLC(_JPggY_1I8i*dG^$l*_YDyQ?P#^_i)!0$SbUI4ECde;Pd&vkl|{f2+8 zypDe8pP$mUCC{_;oQ83)R&#DD>-4JUd6wvAQco`@MnBBjc;}wOj+Vpkd-A?dshm3G zF#g%I1uuvBp7pNA&B}80d`)9fu|9gf#+*if+kD*59b2g@^*TXQ;e(&)*MGR3X0r6* z6bn8DAAgdAqG1M^gD(hzAto&!A1gnDTpu*1D)>0-${4Xf+<<;`;{jGOE@pJxirFL{HUX9B2!$9rz#0S!5Er`T>IumGuuel)GKUR%s%I zz9+ET(4_*t@j3^D9da20zVSLMDv~zBE&(U3r@-DL)+0tx(O9nKx&<8X5&^GBcab7X ziWTWDQ$$u@NvI1lIyJE?HlUO>1iYyqAZ1DkNU*EeIB8N~5NI{Ds|~Q(p$`Ct9Ln9U zF?c)39K%J5N?2T(s)gi51U0^(Ba=JWRa|5q@OB98%%IFv-YJVTb4&Ui{4sEw4t zvQ#gol-9{Bj24pEK`5o#P0C&ZIt%PGbg968mzt(H70Zt^>;UMSG*I&F^6EAdQ`3|R zS4szA42Fed(Ux^iI93yc3$8PkoPZOwOo9$r>N1nUtys`7@nkUZukIWW=2XfF zWZ_8!6N7>NysTV7R!$=25k>;JUB!aMkLMJs)FbXOoM;I4$Q%WRGuePIXQB%B7L@9B zS`;d%cu1g;1UA4l_RL>zgq;E+tkA8=v1JL9T?SO%K(AJ+E?;@!bp#F+1e~lDO4a45 zRE!3hQa@CRx+H(Hr5dg^J#Hq!F3&3;c3I1#oV-}Y(*$ZPAO&2Fg|)g2f%*B2^HfIC`Dveh64c+OJ3)IXCs3&yNY?70lEaX5XLa3qcStepcRbi1hSl+`L4^+X+}tU_ZfGPuLSKL*VIr28dn75?oa}1x^!U{L*H0 z6;sW(tS$jbSCQyoUglzKznT?Ti%ig{!Mda!`!=^QBVlo><y*yXE}CAN@I+S&R@Q7NUV50kQoP+T`EotO z7+H%TRu>TLB|s*91|7N=u+O2~?ecOJ$q--=SZ}lD5>32^94Z1`#SG3PItA7fsGq<_ zLpuc;jJHQ(Hab*566GY7_k8n>-3E0hbXh@YmxQh~Ny`ell`YC3incY~i$R^3-h!C! zf|%Zd7}?7%U&SV3?F5Z}f_;W>3I(0arCz2;BvbqnQ`fHb9hI}3-@E?=1*VtoX(lai+#DwVY8C$%0RL7r z<;CnG_Ar4FPv8WB(lUas!d()XBq&+Xi7y)lRc)0a%L(oxQ1o8FkfAvNx9YCg)r-7U zb;EpX0Z%)WyIo#wMPw4x7EqsHStEvKE36mHu3`q6o^`5#sN}L;6{kT_(1ZU}m{gUr z$k=m>0Zzf3%G=;lw*huIl)GKN=vHD;(NRvm(<#fzvdSJNTET6U{3Jo96+CTZIqr7( zazv(06AfiBG)t5+1b_t`WEVW&1$<% zTOR80jJkMA_xFZzU$d$`f2icYqNAw~MshV8da=U&CRar0F z5@o4jMhoA1hCI33UV``pA0yx>2LOi+%?UV9FB@G|P?~_&0Ch=@N}DZ)|Cz0!k~Xlr{pD6p$ol zF<*2kEqQi%iL!H!Fh-?RVATFjtnPMs0g5ycn5hLc;JK;`b37HR?s&S2dAbG)JY`i! zT2xMVF;909Pq%1vdEI0fiL7wIC9;fV+1{njdPBv^wHuXfSauk?>;b^T1Xs@|zz$eO z#d^xXOxyyFed$h6&)zjqU@xn37Q&4L4Jm?-Kj%3rjWnu(^Y>mbySy<9{@=To3`xb0OE=76i z(Rqq5BH*?Hy9t#GAR{8|EGDeH!*mk6iV4ft^^)kEs#{<^0oRkesLd;QVGGH91nQU; zbR3-pjxv{84An{k{Z%qmy9!-*4argIV0L-a`K(F}w-(B+1RAccV#B#ko0HmYglNDK z+t?;f8=*ZI7hwe}NK}VqVXASPjc;S`S4lS*6p3O4jD9G*v0iP-T;| z#PktL8I-btz_c_7aMfDsg_BC6UEU5!l}Q+*DT*3@J$z$OHCvX=$g4qJ6Uhf1Pg&n0 zr+7y8JY53?p0Y7oWwa5Zt{|QY)giUmVbvmI=>URg{EQ{q z0kCuSvQb=eb`VNiODS%^$_eZu&}#*xcquIjc6se2aXz7xO1wj5sY=;Ts4yg~CwZG? zl{qS@#kSmHR6R=7<@FHWPGDIgu$bW5UvAh>AVWaxWA|Mr!A^6$gf2U25G$Qpz)L8f z4rB|tPN^*l&XkibVlO2i!7g7FiRmDeQYl3`VLV@@Qi6UmCA@-ly+tbcpbRMu#~3tQ zT$Vr^L6*x^oGBb(XE9;riPaHy6%&?QlA?-_>3z}V@7;)S5drlD)-r^Qt)uG{_Gm!^ zV=P#qu~9srlBCPGg7A7mbO_@ZZZ0rX9LgJv!QLlw49g1)WshL85bq>tC>PvEU?%>W z4TKrAQih-twX`pefZeJ zfX5vAG=L6>dK5`bdULtN?;#hY}a#yoyCNeyN4sR?Sq$CxqCQ5TQzvX^6t@u zQff2Sn;Ah>k%4e4V4Fj^+vQCrj&?$6yDMcefdNE(dmYN%F3-D~m@A=d+U$+8Dy>3S zlGjhb_VpFVmJFFRfPmHs6;36|DL%S)RAn7bR1E~Ww1A_MW_I~nD3T@ch)_TSRfTa= z78xXz+DR$u7-;(>;54C>fCRgIVQL9A9}N@=4iPAryIr14k@*DV3Um<0_BCfN8|EBO zS!=)^?OW{eavRZDuu{M=R4m_7bqjP5RDQX`krC{1{Y7AY+$$=qgFp=g^k%cGf&Mr1 zKt3jZUBwj-iQ}{agAnpe#`9Eo>qN}X09G}}&{JUO5rMAa5}Z@muDk@C8Td_+il~VQ+)HwwA6BtXq$&{>L4_IfFU!szpaA+m*ssKId>A-7b zkuy-9E~Y%~3G?=m%8|@d#gwPcM0ui^@d`L%}75bGN&}H>{Hs4aa;20v%SK0;B zW`wRfK$}B50IMCk8K73e-$u((JVPK$;8{bFLlC9{v5Ap#?w(Qxx*imPq0f`IJ)yoMCVQ&F6(Nl5}NhOQKF z3>AkIM`iC<`SL3dDcfjn6cuQqQO8y^v~q2%a1U^Q2j)~|=k zl~`7cs_IY_vk|HXce%W>eSZ}phDi9i)^DJJR;{61gRA4h<>?W0GKq%00 zMndO)|L@IvTb!Z-ThFMd>kMqfC>abCjc_;*a z38MCvFIU)9EF$YP0!sUXQlw>t<)Iih5=t4Aa)6)?Bsfe!JuUg?mq}Mj2SLPpfSRWv zJ_vAi=@NLxQp>8P@>Lf)-eFL8`OZ+3dC2GG`&Lor!82t_e|J?7`-IQSi&c+Q_35$= zg8K>dF<*5htHSM8o!kk)DThL5moG(v`Uo&vI=A91$)?f`_5@!NEix8mGRXAD^Q0~| z7A-F3wXNW7t6@{w_=2d~O!=}Yeh(D;2x?P7wGCAd1&0Y#Dg$S;ap!aZs&N*X0uQ^? zA;5lz9s+3mt7Hq3do8PM>#pS0m9tc$E2d2KHDs+dt}?r?BYC4`Rh*>zT*U;Qgz970oxo5&DBmr{l81@vc)s%$0{)qJC}&1#QPm6<_~E(4Z!(Sk|KEFcC=9Hk6Ok-Mu& z1y2)bFg0OYnRKPJ6MUcE2hI#CpneUXz!8^ZH9CmqC7m=K^tg_yqba+C^y)=p69uE=HDJzUGS56QT*+6?wDg z8ROBGE3&%}zV*i2EubPbe&^LKvq}~!@v0U3fZ`G^xZm(it%AGEJS(379C7F{;IufKy?I~4P81Pu+E{}?J8%m$BG#;Y3wF|W9V_@g*j(oKC7%9M7y3q z;iI_}FVag2jp0*8R6E9|YPT$VdZ$v|D6|2r-(?7heeB`MNwBAPUP9T^J1?Q!N2R4C zl)9W!77;LjfaEead9_Mu`^nsF1ZBpOBRXE)?J91rI#MV>KnjjwN3|1uQ(z^*8Db-t zE3{K!OFjd{uHtf>1ba8ZOX#w15}bstVhQCIk~k-!Tfj@`E|Sn)ETQ}?M->!nsoj(! zi(vr)$;HOLVx_cReg%h=WgTxt8>@Zc64+^IMXF}Y>Xe){4iyl?*na1Dx(Yn@1(N5f zY{#?-FM3vAHYA8blBxf*g^vb&A*HEnpj&Ga%X%=Wqm8SYc-jX4% z6D7cELwm%dX%z?U2Z;TQzMA(m)(5`4F_sD)RzkOc>d5*)4BH$kph=5?xJhuGOmKp(KqveifSg6t#U7@C#qtU@`h8Z_-!a59NqO(^%u$}5MQ z6C<#}&?Vk*r4kTnSF!qX&{8U;IO{Cg47!UzPthVGYL%jLwvg%?sLUr+iGBk1*cLNE z&{~8V+2wwzTOklwypf*r;MUuq(4sLJY&sYW2y;BvDzaFGjmMrm)lx}zHZAL} zLwTy4s5YCd-01QZZzbSa0`m#3{|OT{mFI4kx2z%!1iGSt=jj{}wt-?bSON|@ltjCV z*)yadS->&eTwtiUs#|0X-2y!(c13}q>{SWrAxdjR;0D7tweJKv?wq*g3DjFnu-l=s z>|TdLYM0kqGJDA?^?!*GLusl~T;*j!yGq26Qp(Uv%4!1I2)L2c*1YR1b-BQLM<7)n zCh#HZV}SjJ7X3m)*+T(oE+f-rPTN6@RI>;fb`>iZQJyNMJmm@Vqj8bU6UCG#$|#i} zeyS$0ld_-J0PmWiqAzrqxGn*S8{=J>B9Cc;N<*^XeBRwzZtNR-y$5NC#*Ey{1TF$(7ctTA(t#5=}MOPc7kxhg#<0| z0UZ>lWWj}QE)iJdk~0gF3{V6{C4sF38K84uHM*@KSgF8W5iWRy!0M}?pZwcKa0~~* z^rui`EX(>(6;BaZLqKekD&y?ar3x%ErMm_w2$Wz4A^a{$49k9ndbX^GX!hM_{ly z2nbA<IDo`y}r7Wv#itQnJrDc_kk>XH8Rn+NWGWIz>frEyY zwSr}UKA%Yi@jZ9>QOoDS*itro`^-|O+(S8g&#Xo%Ll1+O1~9z%4C7cE6gfvVTFKKS zyLoQ;>HOSQ)(v`@zgF8EmOBVIOt7U5a5G%O1-B6x$pj?RRxM0jTJ@lyU;IF!b&p@~ zjMiu^LU$54fYUN)kujH@c6cfbpYdeE$C5@~wumk}nr=tF)SSo`TB$h!r$E^RFbKnL zr{-u``$?9WDh%r0dKF$7@mXjZj+R)+n^WdVrzq)}%B3mUHAMOEjXg`A7UHG;q!hIz z%~hd6OKC?dDT!g3L^;F5WvNQpL#SY)9+KBvR@s2564km}F!j&3)kxWMQCOlgP&;woXp(va1_{yj18fh0 zor{3vvJeo+Ak@*Q2rZH-tR=JXtR$!h2}*JNqTUw*%OFV-EfT@U4Bu2Q=!#q6i-THa zEw-{&2)JU)I#m}!D3*Ibs-NvEpU`ou9=YZMetFElwCTr;d zz$pS2Y8P~J%T{ft;c!{Kg(7>M)WTx10RdXRW5+?jlLV6xh{M?#>IoF*&0 ztQU!DkWe~WDrFY|n?DS2V#-V?UYBJhoG^y65>&Xd)Rq9dd`%Q_md^<^5j5OX{%Fz> z+Nr)Lto&729by>E1VTes3OM$PZ`M1iZUHa3{MePu;>HZk`Fa`v$)w8b(SGA;hl*BL zaXpjP0G$FYglOaj>v0(ZNAelMTtDd)(5Z;yXrjPYE4xzz;~|F%oF+ILmVZIowoaV_ zIYN}-)GEfJku!~@LLyk78Ss^~h`AhS`tVrASk1kNie|_mLavNZovi=4 zIt8jTRmW5P&pHq0OD*eUJEAPQY`SdJ*QCFTP+{Mz$=+p^%_H7?H1cROtIHfBlulww zk?*h$5O~tiyx)}4dbcS}tyIoN#FSFW6W0++Q#6N$Z8Tb1qrSu-45k$m#>2&8A9YA8fzHpEvXb0QlVRmLFOxEP|6{KnqE*PVjf>`DX~;>(#ys}nO3rBk&K}8w@xod z$r<#Leid{RcVs3oyL>&B)knaIG6P}xIO#bp|Zp@%?~1Y}uxapkR0)Q$ootnfw%snPr2_RHRmN(Q&f z*R7S9gviu_8x7x7C+JMwDKm>3@2X4VS@N(7-X%%ODs^V90JZKZO@-91Vl7l+DV5hj zx=EME2t04``jirzJZ{Azn<*G49@?t1J8rbn}bo=8vY68KZWrl%-ms zM_qm(u*g`HQNQwa9;2K2mctD_Wd)C1O(7~hvf+~s9bK~d9kyaLZUe|{6$a)4mAxI} zsLBTBj=X@f#dR*9Ro1DbQJX1eKkT^+R2?BVa2RY23rQCvVwZ1mMOG5%KLVbuvxKd3 zZ^{^(y%;DqY^S1zt?Cu~>0+a@j^!AZh+(TSED`W(mLE4XLnt1a{h7G9`l*pc!0qxC zDx!S4nDS{D#-u!5OsSKDQp!a{rMx<`p!`AoOVHJ1g>+g8Bk%PH^ch;#Nb8{5Nx(OT z0Z%%#7h+Ytg2(t0RGNxdi zH>Z5mWtE-OdEHoWO0}pRBmVr5QlL7Mdlab5lCH$Emqq&#E_+w9MssBYZiajdp~Bc( zs9IS+Q(d%!r)n};2SH^b$1ZOiMOq067ts9adYQ1DE<^ebJ5*pklE?0eX(O~F*vAa* z9ReJ2=rBO+6}A-QM8~&9zw=ktV4_k3Gsmw7$mUX|+x{lcsoPypw`_?j9%|Y%LbMfB#xzvN@74ws~8Cu?xhO%RTPdGyL{Wpbsr$$IJ*J+49y8- zO+EW^UxHO}!JRI74`9flzAmCru}`|>QveO3O5P0I65$1H%7=kxDc9L;xe9PDuv|hV zt-?8h7^G-vPg05#v&@SrCGZkUQ;}ttw~a(BCa4C2Jp}BeF@Bw)_RoVGUFv9NCGR9) z^yI@pDWYXER!9;+TLEnjJq$SF&=Y`D4jnC0v(s)9Q|2D>oalUOFX%oKP)4=$|3NA# zCvT#s3p5*Aw#(l}@(w~(kU99!J@EnIj}a=lVj=IcviZU1RhZb-?e-8V3^{vAc0F>b zKoho8TXq1|mcmK4%eT2AhY3h~5|B1?+tbiiP&eNQlMHACH2b*>VW(V%Knvz}8N$>T z;1JNd#$^nGJ)DoJa9zd9IH&6r@C9`a2s;29V_ZE0qE5>y%nuUf>e8jU$lo}K5m*=% z$t%KOPEuDvQdu)@p*%Tp1sfN#%67t!!EwmAR!S9JzGkw(1_BeP#)hp9bu9CoTyBdBUuKcp+x1hEnCoRAWMT?g<=X>WmVV>hlKL0 zhw=wi1GJ9%s@|a9rl6y%uahZkrksFY4SKanObCS`U-@>uYI`BA6x9@N#LOKb}XxRrocwQE4wR+k~*MR%EK zO=BvyYoHxW%DY&h8fBiDMAOBD(kWOe(uCBahp19Y1(v4zI+dovY?n7z12NeM2UZ)Z z08s9Bl~d&kR25CH_NG-10b0x)_Iph|psI4N;)Jr^csd2d?ixrEJX_@^aYc0%in3qD z@;sHlXm&i^1)gqc>3PbJ17sfYls1Fd<-(<@O34u_Ou~y{*htV%%gijZfzM@+UH;S# zuHuD+%ufLlmabfu80H&Qr+_O~9Y9#W%MjR4aHbaa1c5FikU_4?s0VAv$H=nFJB1>3 z1p0zNy`g2J7^xA}nf}_h4XUVWV$kJ_DP)z&E@b6*Jh6$f^T$t4CB|o_o-=-8Y{^vC zF>OI&{Ed^Zo_6K97mbUDoMl`P+&Gy!PB4&~0!WM}GsQwI9~l<})sth1@#9ir!`f$= z6h-C}ttpDaR~w5-L`Em}Vvzci}Wyie^s*@u@CJ6+2gYNxmZIjpj;uuEso9N`zUWp);+b zGm7};5T7Y(A+s*U&@zCNlf_iLGhbjlA2UQ1x*$TS#f5o`q|_qKc_WZFyDbuZ(YdiX zlb1~G9k)ES45EvpdYF1GA}W+}$-VE61#>1(#NjUmh3`WPrYZJ<`^bog+ZW(FtwnVx z=o|!dqAHjH+o#EdFDxXvgv+Fh?CrJT6NPvv16*Dk)mFvLb%hI^S8N!Wg%7`6sX=f> zDrlG><}1gUo4<(Kn6UQRs1`3Sa61LADkR)E*(F^qu7V9Z3KS~tn#mN`PF)tHkQoHm zwi#G>u9Z-z$aUk)kAmR(sri<=ArfU4k+4NklbR3R=!_j%_$Jt*e)f`a)O)e@Biiw$ z1tAjgGMVOs3qslE<(E2BAm3Fb7bW0DS5FglXMw_3H>l~?;HE2y3=K_w=y*_3u0h^* zkN*~A9wGJi6pJK=jCO9xYn1X*ZYSYQ{w7w{3;sRu*pI6PI%2WEPfLG|sIf2Cw zkc|5gw@gqsnbdUbtQi8;bqfKhWYuZ%-VPeSxbF3U>SR?M@M%I~O|?K6ORPwL7)077 zRt4#gf@=axyds%?5ZEF7mUNI*6-?evkod-0#jWgxL9!Ekyd+GJZWCUso2nILl2UPE zij|HQZdJdHB{l(*^rIjpt_H1vz7U(#0vu4{dS~aV&k)&x$y0Bc{6r%4#`^gXs5YrL zCu5C4{X!pImyDkqq+dq#Ct|-X9aJ3$c{{9Cns@|UNB2(p5y(37kBHi$JCeyD6 zzeMTpO4qyv{2IhpZS0Q+$r+@cJwXS&LDDEx`gM?0@2D2o5U;)?eG6%-b9H}^ek=G} z2-Ta@>F@gVEyL*};HQ*+?~|wlqD6T6+9?8u(^sVL1b#tDFACBR0<}I*w`bCS2OJju z;#~Sspvp;KeK4qfoQPRH9#nk?d?z7(SKU2;>U1GDUE~}6LG3f1t3IeopuZOV)$f=h zP+xspdW3B4A*$aRq-%g`#On3Q^dxXKWA)q8>8T#Sy)Hci+-m;zOi_xc?y0bvPi(5fncS&j~-py&-&@`?=vU?&pPZK6+>jXL8SmS8$&Z=D5!c-@tuV_#W;} z;itHtAAW`V1>sM)Ul{&@dvjRNhbpr}eNuB#s1H^y4sYe&65hf6lJKM4FAcxQ{RQEV zxwnRY;yx!ln}PI&;T-Olg)ima7QT-A<>5Wt=Z2r;J}(^NK0o{!_bbA`aKAE~&Wi9w z;au+Rp;m`44&TK6s_;JUSBDRA?+72~eogpO?hC^I;(l#-HcOI)VJr9R!k2KrK70-L z8^XJ|FA6`({l@T1+;0jGaeqnpEAETK^myipa2EHMg;#NZxo_yl!{tPS@D1E!;YRN9 z@O|79;U~B!!$-KM!XfTe;rF;#hsU|6!#{AZ39DH()rO7S$AvH8UKdQ2^C!n0nchM4 z&gsjz2h(56JrmUY~`K^ zujZZ%U(P)hzLI-Y_*U-K;XT~b;YYaFL}iVi7d}ih2*1KT7F3Pke?I}8a8;Gm{5R0} ztyO;_^*N<>RwZ$@KPdI>bx#4R<5g4Sf)mO7Y1Khk#)HP+k`hY`Xx#;|lm`3jMR9|} zmkOT}Gn!jPQy;4m&0CayuO+`*=mAH*Q+RdE3VKBN>T@V3cz_NTTebNjDtYH&N^4N! zKK2i(JEi)$zib8FEHpSzw-bces*j5P-dK1$JwQ|QB^O$JJ(bADI{y>#srzEb$;igK z{#z36kC})WBn68Iu~qf-p_%^%Izz}aAeVpyvxda{(ztYqH63x0E6Hj4>?AT?7MIi@ zss34Y6So0UGb_(;&dg6Ah4`%`Wv&d;8%Y*rrn@2iUhoU)b(s}eY6ZcoNT|Cic0ohk z+}MRbhwE1qRyRKuTqw=2qY`yj#Nrp8Ch~pA>#mF?FRX*-r;5BNmcFow$Vo-oV|5p< zBr-!hFOG$QwZNZXobaX86(mj|bHatO)E}UJ33y#itocg8xCCe9{lG=4$nqe)4csbtb23QEdCat01I1Q-xDkt{VMQQ_GsaxXb%-lw*wZ#`etSwxNAAumY>QS}$8f%uuXCT-i7kOR$ zKhMPjbfhBPQm>EymW65KUBrKRw#B7l<3AC9Lh(1mrG7TPJ^a3lDw}9S?HqE~#x+L~ z&6)$b=*4QE)SKgKqLy0n`zayyCR5~+cQY!kM8u{42=Xw<3u4{zw{h=^ujk$w$3HJ^ zWe_}EIWNF9IbS2hR()F){AEmj*VsupR_-rjD%ZR8ugs-`Ige4-i7%ByPxv_nPnbao z6HY5?t1iPXR+?@>@;{+ToaWY?LieV+1+fc%gao;&)`%A#A)@KNZc(h^!e0@QRqAex zWrO4e2uK{15DA?#9sWrRpKrl4UL&dm2wt3i-U?&8*@%okpcz{!7bD@K(N z%zBy3J2_d@{U#^X{hWU-28pfujih}ZX_{YV{}`l}DdRE~B1(x)ou53XE!LyrTzNLG z%zBfg&nlKa%cNgyt$My?IIlZpCH+c`vcQrXwN+48Ca#XyvVeGl{N{SgZ|Ns)+fspxx)Fa99ZLuX*mtVn?uZswpL|}DUVs#1TK2=9U zk}CJw&a_*tdC%fGT#w0{_(tMpkK{VmpP<{N)T1ZVjWCN+f3`K0n6vV0{5 zbN+#Zvp-M*G^tzt&lpO6un{-BJ1NxT=fCJiU4uO~F3G-)(ReIua(#o6|o z#(c3E=vxW3==?v6_hce4bInW0Jp0U4v8F~vzL-2IvDVYSl+?k+#e0?hSn?2)^2J&o zr@oR@kG|L@jDJc>xX2@jwu2UPkCc{7Er8H z-W;Sa1egC$d22F#F}RAF!rC|I@!RXu`jdN0-;hoBc>EnL>7^cj=lpc9$2TraukiS$ zT>2Frzhh&rv>RoyrHu$%!B~dt659)JKyuh^I7a z3=p5NH+CLO?meqje^IY^()EhkRMab;v|iDugEMQf1%NKH&lpZPglQLDz8{U8s5yePgs^Eu$`pThP}LM|ldn?jC(`~al= zD7OO)jr6k_%mc39r?1-<}EP-iZP_laOrkFL{)F9mP5=qKx%qsP}8DK3B^Y&9vf>1T98% zl>qW?ATDEB|^$a0(G%=|y@s7HI1`^w1z0C$zv;mwG zh9ER0UYVm^opVlQY;Cia?25n38hQiNO4Tuv7AS>O`Oq3m&Bfn=tX4wM$E+G#)eWAS znvhu=UrL@CVyYRU@h8Nuy^Q?OjL|slom5cqX%@dyo8Xp@lDJZd3lql?(z2KMdd07| z_+|ffhjUAH`BZzNVdfnWRNsl2ZUvbP!Zq*Hvj62NH~rX3?(&pYdQG;Bo12p8CR+i{ zOKCo68WF>Mmu@S;D^l+K;g4`7v|K$;g0~Q2tIoa{;)N!?@xN#a8@{ef+0ybRq*;O2 zTY-&t5Vu0FH{p%Dh+DxoSiy}yCvJt`;PSsk+!VOM6mYA_8&mS6%XXtn2O6{yQZG+U zoOv$&OH(fkm#-RF@*M-qehioyC-*o=q`O=rw(1h;zS8Ng9|E(vd1Xp-bK^USn{KO| zZiB>4w^umbju1E9ZZX}iW~8#JzcZz=za?aiVk7sfOnl2N#BJn$rHj9hRfLV)x280m zUnIX@qpG|uHGbw>$Ta_71Y-U_1H}CQPslOx_6GaWnFL&d5I^ZbrV}<$syD8F_1w1H8ZB0E^I|g^>DC>g<`n zgSf;2mKQkyUEiAj(vc}_n__w1?)Ri~zh9AU?)NR{ zZaRE1_xq-cKT6!(@7v~nZh8HmDLIKPBIbk8mO<(#xZ_74j+POv<;#fIkZa3`(Qapc z)r*k1H-%^NzhKS^j5lq`^DtgVKa{Dfs-v@otE$y^nm(+=tE)duDM9k%+^Zhq_61U> zzwDa72F&}eDE_mmXkT=ys=)foDzP@1`F~aQ3vjpUK5YzvEzPXi4l~ZjR^6s%d$3x< z8h=gY&EX%cwh=FziJI-9YTHb|jkq<_-&SjwZG4Qlm9x8A<+LQ2R;?ZW&Z^R~nYdNw zVXIEdLE_eKpRw{Mk*h{&6A$)%a^G33A5_+VX zeOS*v3Ej_){&o;ByAOqrfCO_tIo(le_;I`Z?e#W5g~8nV2EW4Vq&uopy7krD;JcPQ zt=>dS+;(Q|#OH40^x^@_$f*z8UT$w8?q*`Wln`6huO?e#&DnIt9Prmwon&@w{A;wc z=6ijWHQ&Dyw@uj_sW>(F* ztRBy6^$D}8vKV=WoY69+1$yWIT(w?In+A0%hs%fx`MgyBYAN?Ik@B##QR0R7vxFH=(H6vYhhw@o}!~oyXmK( zXP!XZ;fm_zUJYCI5w*~*u2VI6E3U4t%F+rq5w}))wRN)V`rtZ1V9u?7y{x~!S{q7D z!M7EnE!yPShUTr+KkA@yK11k&PhU9_&Q2 zZYQ!WpX%ajUq7X4XR?>LZ8?TO=6(x14TD4!bAL|!8H;lOk+#%&w{>tnjvb?T7`d`` zK-$r$6FP0Ma|)+Cd#%~|BX~?<9}y&X5>M!$bl$o0+;gK*&kT5;xp|YhbfdZS#Wotv zs?wV0;?t;))9KjMjes+v5%9ERYF(4mNICCn1lMhji7sX*40ZR!)PI6`J<3@Vle8%3 zby3c(QYMI$vF$-nrR_m5?_J_K6nhnxiFkhCc&bj5t%tAYTsmhfMDv=_G9nAIw`UNuP`)*%skbZm(oU z`kTad&U%|xi)fear!Ic8@P}-haB;uzPa7U2wUwInS4vq?d;-5BZd0ADCRW-RZ<9?) ztL!x1HS{gU5X^g2+|}u5qSP5tby|I}=?P_|(~{&kYK17{M&zh39b@c@-F$Wc&nzkW#8S#HmJWOjwR42Y$(eu*sx0X$04=LVYWw-o} zxGikXG4U-gV8F3XJl(}VNBn^3&vo>ZXj+?48`E-KH(_?BpT?^$`ZFr;L+RA4^!S-q zl3R9uLJ}>J+T0Q;UUbs(3UY0& zz61gJwfZ`k(c%UK9+aF*(&HEOsJzFa>J#z+$Xbxur$IId33-ELGe~gJA@1r4sl_ON z70E|QVA}ts$lgZ$PaqfRVS)yJhcF3l{zv}l&U*=G6e2(nq;78=h$t+^!Coi1N!1UQwMtvY5an+me%UPd;)sSzx74sHja|FT8;)qT$Z!uE?DW@`C~lZ# zaBj81nIXC>zCGzy8+)i&Gz8mfLx)>Y+!nhhh}-(4o_bhHyGJ&I6rT;eu@(F5iEB7$ z{0W-e9u2PKWW(DS~_$bZ!3|ADxkDWyJd@hj6XwdjvLKOmw5){R@{5&wkZ-*)j; z#Q#?DZ@GtVS7ycaMW6b6NA-Kp^#>Q9vni7LM~mAD!#Zl!g7&GC@rIe7fWb}}?goiY z7-o=Zb&IW(bEPNOzJBx9`y&iO75J?(KDhhM4&Pj+#i@@42x z)ODxzxK6%Zw<1XY63VxdS+|lGQ|({;A@4yjQ2*s z_XzI{(&{rOgf9uwo51zb%DKx?qUsz{t4TSpV~RlUc~{!oDT_!xuid?!(j)xEX?r`R zPxw_~PB0bWf!k^*FOoOr@ZQvW(ls;pku9&hRvzhGG7A#9X7VnR>KZ21Yf^)#|9Oau)c?eV`2%(JDC=R1 zpv^1ZK;hH=v7mVVF{e9i)o>bH)k9e`{}suv6!J948-+Ae>N|w21i1%f_BN31Af^}4 z>9r@Vy<(A8ZDdhFuZ3yVUWf;CUL>s^D`=HJKXw~}SvQlPda&3x9yD7vyIA*UTAK!lu?2Ohr~S$-`Qa>`T`z zqt#zd_LGW#(RsmN6E`pTQjr&YJFN}QWon-+NRE*DlBVz;wbTN&(iI(QqPEy7YoK={ zCEq}5T$Bn@qZ=r=>=W>8Axo{4dIG;X2;*l+oLPMy3o(!dL)>O-ZT4-DYk$biHTz)@ zllreVt&eJUspz)o&IRq^P2`wsEYI!I_4s-yifdj~T$075xTcCz1$x&A(jm6$xEkU6 zt`VBh)*h37Kdm{Ghy2#l4p|dqV_nwI4w;3sv2JUgADH(vz79_FpdVOn<4cKKbN$e~ z=*FWLxt0z^rhwD&3DfZp(s9`7c#qd{*mP|CEOFEFsB@Gb z5jQ=LI!yu=W~S*eSBu2<6Hc>ZmX9OVnIk>v9BB^Z=19jayX98m=13=t9O;?#PV};7 zS1VYv|DI;Q7h-GnA&`8tTWinWMUvW{=U~`k5r`V|cH(NR-4>^@>Y^U9mW0@<>J}>g zXIJt6K)@g6;(t#6;Z6p^iCI>mFC_jK>oG0!h?}NWHQH&|pwfX9^RAj27L7}ayz5>h zw~_0-%Xx@ATpsf_;GA!&ojz~vGyv@cx1!hun$QGdGe-x6u~qMW0gk>V%Nhq{_WMCT z4l?)OAywIa@Vx3NNvw7o!e5dZB!A1j`kflEV|8~I7AW@z=_HAICQ`RGS$`JzX~^r| zmyAtK+S=s>mk@nFYnLlQG~&;^`KArAncew?$IKqLc=yrB~@Sz&*?dW#a zB|luFE_rFkrL;QySheWs8tZ90T8b9KHoDH1{ADJ;@zdF8bX{g8H2#FRmCBk9O4Y<{H~SzLjh{V0}f6_O30D5x4#0Dl4ufF*9<-l@@n% z@clJUBkD4FOAvFTLF#=qH8XF5Se|pOye63Y5|*heLDW0m$(>C@OEC9~_OeJA*N>^h@2z!%bNN~&)GLY>AYS3sLFd?8yL`sEZ%LW_5K`KG;?&IKkeCq z-lNue)>2y_jICO%min!8!BoZ8e&3i{mk8Brfbap8i=dn@2HZ9eHB&ZosFlx&*TJ5B%2YkIcR^oZAViqrJ03nNXZnl6olII^i4nyQVr6E|I_x%|b%P1)(D zY~xJgHgKO)D?ef24sE!(sMZGVs}Mg;Ylf^%N-g&iw}JaSQ@7>ciCbHr>*C)+oDKAi zwHoMM+jrDHjc6OF7nxl;6WjM=o^FnUA|ts0dzZ7CC3hvZe~ny5bDm74F85<|#G};w zSRBmJ4r!V@W*+r6sm85>e^gvDJ_bo_)%|LOSGq>{Gqtcrc%^HE3uZ^|@+#K|FDGv9 za;s~E4aCh|Ry&7CY(MQ9;nkL(O>BSK8T~bukCE$JWYpKy+Fs<7u+LNc^_Jc8ed1=+ zHKvX;;vKcy(9@QXy&z~9q&C#n%$&gD(3X(bgN#~2UPO{xLdqxS!*WKSw1wqPN2LcK zZt+oPKKe14XT~_|O}8S}oMh%Wo0IM(ZtoY&8fU%d5#siKLDM+(p2i;#x5dKw<7}6Z z*xnyA^Ic%{m}hg$%y*&D6W+hR8=e$hB}xR(D$zS*nA z^t*07g{~uD=LTEJ&lzWSUcj!v_86@u$1SV}A(Sh!hMoK7d4+|6P9-~|cN6roS+_ef zdzU=zN*hxD_ny{4S+P~0mnj!IQ@#$B%+nT*vw`Wah?}XdGgCF{4Bt$3y)*4Eh?}Wy zaHgOin57muOHpAn)QvtjYj(QH>@@c!ctD90XbsruMx?H2M6w^HShZg&4!F)R3EWg1 zaGgQp>Z4d8HE1J7;|GbG%Aa(dL%gQ)r(EY4&jQp`{u?&}J;^H9bl&Ags4o#Wr5|+p z+lZUi57`KnACaDLBhv2?ZzIsB-H0;>a%=qEF8(Hpvk~YsMI+FE)UJ-R2>Rp|EDUhx z)MsnQ&+LZqvn0%%5Ar1tH$v?p-?g?4KJCHWZ;+?g^EDrB435sS8^p_WJzIu1hYr{Fav? z&st?gp-Zm88XEenOZK@g`61}6OWtC9zu&-uQNB6ndjM@&?PD`z@*h zgFMEq3o3NKg}6*?RT7_0{n~ZESHogD{n~ZE_Y*fSI_$C9Yl&OK{?Wy&7>BL9 z{mHu9W$I!XD!E?W?7!(|0Swm7&H*WOvu#l~i{3hJ3+6u8&KzHqN@wF8V6}gpbu;%> ziltib3e~&j@YQTEt@VH3_?xZqLmB%2(Do+qRaHme|9!c+&zF#dtn8Q&qJ$8YO~4kF zRYO2QKt%;ZNP|_u=Nw+2+idnKNh3+;cCN8sU#)Bs%g{I%U{Y>x5ZtWEq&P(`B_0 zbYPCMywyw=HoL0Rt)AFZRHa)zrASwPuklQDwpzP2UTGiY{u(vW)80Pb_`cKnoq(x= zMr%X?Bh0+(2aGVryB~1^4Kp72-y0q--A>>NEI3;Dv)%Bg9R8>xZa0%-J!$2_!)9`9 zBdu)cFq7kL(#nS&;gKpIc6xj;OVuM@sadLa{h*~vN!+L;ju#UDXh=-P%TW>jDN2NY zjuPRYO^2=scSnnGceDt1d&C(LKIN5WtIVF#(rMS9$P*oCnf4Sw1AsN+Y?0aXKY;ZS zlQd$Pi0hUAsg1J1n6bIShHniUM!^P^)VD@ba(G!K^_`JaD`}O~_eN6pkyc4rDc){J zB^5{!cTRRYI@|;;{cmP$!gY+pNlpov^({F?Tt4$MOplb8CtywPl?thvKWvAGve z@8>{KFeVgwlR66XZgJuLX*8jMj! zW~Zok=CHF=M&>B>xqN-Y*xFvosoc{@tF7&=tjgWYw&hZ$fz!v7UrM@3(tS<&BGQS2 zNcT$-M>lsW=^m2qZ^{cvKS;E|8IYom?sD*}G0s)`inowfV|=(tKTLf!#(61`-Pfv= z_X2QAj#;b%aE?kz%TE~N9{*?8thH37)sfbix|0X>QM2u0%EiAT1K8n2M9AwA|}068Hk1?t4rjCfQ2dLUHW(1oly2jTix@BL+V!%{3$OZ-BNa`w68Kr6vYMM|(;I>-ck} z+dBgK-iRKg(m&P-%Orny_vD0aOe|rvBjT=Ff01bYI-~X55RPj7I-~XfAgx+|nbG?1 zNvns^ZnXLcERbsb#sCg zFWVN?dLF#MjpB<*tJYs_(pS)4wf?6*t?x_`d8*d$25^3b*1tqWJzVrTfNFjJAGun8 zGJtA*Er8K_IX_c;ElJh-yL?*zVMOcS65P+D^_^6_3AyDL;;^XJrvj+fPX_MMU=%DxA{I^lZJrEj~}B|WaE3KjM?tP}2$MpgQTjZw~+`4CaSc+FJ{ zLv$Wk@Ke#k$*Ce`FJ3%3wYo%7<_X7?RR0r>sj2#eBmd<8{)A(KYWbal|2w1QD-ni9 zIloJh9&&$2TDAUrqxE}9tJYiEOYT72(>Af)fz+Ru>PE&q;V4X1Klv<*RSBI`eZuiD zX;s=p9Zs=zysNafNiQHhEE9CWR5_SvVmv=e-G>y4WdjH*>BQZELlnepSMZO{=`dOkQg{TG1N&? zAJR2B`c&?ZU`uJ?soZk_V?Z~c@uZRgOT!Q42Gp2`a-UK>pcXgaAV6>G4P1Fd$-sv2 z!?b~oJOE^=65IoM={3!Rn@vB()5u>DI%&edmN4#t%Q#&`y;3P#4$00LK;MzmqbX1* z_X#~t2n>-m@f`|!Oyn)|G7@i4wZ{~`FCfYzn$Tk!Uo&`!lG`OQGmtXm2@*RcF)NTh zvd=3yCr~)#e6Qr(z_=m%NyyvmJ<0>)t;7%M-rma} z=OBNspsdGnfkL_G^~eqk5#Q&0>8&pmP9e8N5(A)6$Q5Dq$cIADUFvZJ6iRPeG7Jjk z;|n^f5l|=|la`DQ^cm7fwN-*`Y=9F;-`K`R_INb-zJt3fa7L!CaX_aJHw)P#Bcdr-E}?FL>O&;ZW72z{q1eYwBH7O2fSO)1R% zD{0XpXLhRkkJbsOf~4o9N(Z?^Nz1%&=BA4O$lgA5y_m2wQ>|4jZf8@h3+WlgCT$`u zQ`DKK&5cdEFm*4eMs31?R01?`IZdf)`G=i|aLLSnidOdk{7C%gp~sNDlhn{sfZYJJ z6?y2;*PjH2^-Uw$JX%)_fRE>&nAg#jKsN5}nhO~13N^NhreS0eFhT)hnt&q$4 z9jidmL~j)kR!JR~8l`T2ByD2$hPv;By1NZ^Q$e7rbGM;xDQR`$?lIKeMOvM>ZANuI zBdvP-dsQuY0;Z~auNKRmP+he9RI!RjOmfHafNv~+Nu2^+D*agi#azxF#&RW<&5HK= zsb=TwAB!lN$LSGM2O;ol;|M(NgPhGY4J=3})ag8LM*Um5(osL}P8iZUsu#?JvGI{~ zSbsC49!pxs^`aTq0@5m@mwe;;SLzZv(s2z3=)>iFmYVKqwHAm*Fj06H0p{ zge~|dY4vB4()5vMZzxd(NKRArEFrB5&?8N4M+)wuvMMD_ZOc1TT~?)<^6jLRRcUEz zTkLC|v(&g`rCF=g))ZM)5Wnh-v&k$ue` z*ZHX=drb3bXeo`oa$=2z#y1*Au3D=$06s<{5;GB`I(s+!NO-x`xi7>L=F!EXks*G$mjND0D8F{&3q_}jy zl%;UJVPuF&cblX)D5H1;dC*EH`r~ZWa?;;eUrG5DUiqrPXOh0sD{l+DA?d5U^7g>r zBz?6Cg7zB&Pe}S2ul(x3?IX16qPG#Kd&Zw7jDNr|{vjw;#y?;f{}yRw{DX$^LFTS9 z{vpHoV$#a^?H*%X#y{*a)@6K$SH8+Hc86EqW*E8CD{nV~c_hO4JQ3tBul#Bws7Iq2 z|Eytr4df`}|6mxug|ssM@k28HH>V$(@t+9eU-t0G(92ZQ{6J@wr!sknncCRrLfZq{T8^-nZW<1W$-$3uOcU9XBMsQ4xJ1vD@V#U zD>MUG(f>X%G!Iy@JrD{l@!$uOvgNy>O3_1!32CA17K${vJu#3P3SB}{9^$7w+#@6h zy%g@4uBR>KR9(uBt9|DtCs@J3RG!GlQ{L;9&+X=vzl83io%Z~K73ul!0sUg>Ho^UJ zV(0_vDAoUf5x`3It0|$cz5IWs^YVn7|5|n^1z799-Y1ml<-ai?lnbmhzLgiD{oRFD z@XVlP{Q+btyAOwJR*IUg^JND0>ZuF&KT$dLS$g%{zla4XFvC^JK3ZN}NZL7qtFNlS zs7`c`1>VZzA}<$r<9o8KA~`rI&!U|pdS>QNrj?$vIu}6CS?McMvhFFc$^*oSI!caQ zy#}BsLJ}d-^T?Fu0h9z5tPz^$7@AjtRB4{0nn<`t6v~-vc5~VYj5NAc8Z9)9Zt)r| z)PZ`9%FX6*>~(O^8Io?cP@-y1Vfvi2*g~l}8Je!o6?CyHN*4(f=)yKET_k3nF&w3J zhUue?qtiw5=1Ar-igehM(!p?(|8xYl5=E!Sz92buN@<`#w4TIn>0TdS)GP1J&aR6~H~;1)fs=Ngn-^yFWG zx*E6YslNhsGj7upf9@+D+Q1rIBds6ww|>yH)?;W7=`qy;J%YAfTNmi@vxoIl#l!U6 z;7)C9uNf&{Rd>^KMT+)z;b}^1n3Qrj1CPQfE(HiU~;~s%4QQ-5ujlX z+h_qc0GtF+^bCKt3+74bz4ABWpT0`Qq!0MRr@w}GavypQx!(z}2O#-ufDZwB32-5Z z^9A@32H|Lc@jv2^{72h*5K{n|%T8W;FFsB-{8wrq{y-x&5Jhsl_7&;;Qw&HZB7>Q&Zi`7$dy>|C!mX*@Z%=eLPjVpF>)ssdwnjL$=9QxPx>Ft2@*j#I&ik4EcK(bK$#*f{3xMI&gSL`T~>Npemcz1GrAw) zF6kNFe}O~K= zPV$v?HvLP%5813})9s4#7B@L87Zm;CHe7pU7%sR_Syo znujuOm+n_H8(u=wtH{V7MXd`2*htP#1egSHIl$!W`7?A0cz-QGE`RRg`q33vp1ty4Bv(259{^RxeCC(Y2Y~RI?xG3cTn^9Zq58X0NUwC0NQCH6dEZB@5f1tJJH#|8NzuqHeDEh+yv1vRTpLd zk7=Yjb_GCK$F{PRnPbubqdgr9DD6XEq^8GwYs?M?-%JfzoG)Ur-c-)Mm~lzkY{4ki z)9j)*Cf6Dxr`_+5NgvSkY<*M0yo9aqJunV`tF6AYl<)DS%h2+Trv2ZV5ekdZLVw@$eQD`Sw6tqqqfuGO_4=BJVd8~qAiV8ITikn@?@9G!ou>n80> zllOLVe@R+r&gW)x^mo#7QrGD;o1>&vmi4%#_v_|G;6 zzyasWG$;QS3Wt)B-v)3jfHi6oe=%ofMtqg#po*biO(*lXRfT72jY|H`r$#!LbI`3( zD@FR!j68XiCrT}(2W6n>u4hQv8oRlGHut*zn(mqIOP5ejfqp6JeqD&o6Qu`q(H^El zc`jYTL&G*?()b}=yobqWnVs#%kJI5jtVms-Ae~P&W3DFblJ4$E514P}-Cvu0#uI-N3$^uHS}wg|v?5107BA z%yZmNS$vo-pRy?aIccTxeZ@bj1aB8@Fiie5onZGFr;7tzBp-iT#f))68AVzy{Q>A!+P_GBSWm5?@JVO^-C1P7Qi&>neR>20C@9-&p4#(L&e+?VmGoRM&1+kdmgn74|H5?h5v#W}eVUrH zISH3gX7FmzNxxXNgaNpdRlgx2aXmL}jr@CoWgWRrL(E2t+8{EpAi$J$7G&rqZ3zQZ ztyz$v4(OGn)g?SPL-r-bFOxP7rq=(_LAZHhPP3K%{r79O$^QiPeV||Zs#U8d4EmM& zrRSSw_tQ+?;&+y6+8Xm2qw`F>%rcA#`%Q)ySkO<%Im(dJ>5+4^A*au|lpVo!jKNz^ zS`E#QH9btE)y z8hO=OEz!^n-f;I9>vsYKji{3OPJq}Xd29JG%|+5~`lCqN8oQ4QPIkr{)Hv$3BYEFwwyQa!hJgiVNUtkQuaA1Yt~9-V?e%)0>Gj%$n4BEyUz92D z6z0A{TB*3$P?1~iQt=a|qWBEb%GgzzIuR}-trOu=?a%DA?#Pt02)ffMgmf_!&Z^9C z}aY_qZa#m~!*R;9255y4w@oP+Tpz zwu0-{#jcC}B7nNsH2}JyI2J&iy|Y2A&fenyVP~%ad8o4|?z+rv^U|MoHS|BUb)CJU zzcPR=(%(&tdOst2O~&{Nz()ey3vfVyjQ|$*wkVZ9k4b}5Gc)qGMH~Dm+M5Z#-1&;*1Gdv14L^xA_1axY6A+i^<^0{fsLcmo*|RheEREhp8?)r zY{S@U!FrO;l|aE|k~le2BS4C&#L%G=aGFj)gQ-*}pEY)aG$`=5KEkxt7DxJ84ABD>bWdXBMYHH$ZO%!9en0P1zgw+?kZ(B)#4X3M0LLRL^c2)2=21#Sk=$$5Xc9<$>q z5!#e26PML7Psx%6%jo*lEYi_Q(_~b0r`>zBp$$B4z!;+2!o}RV84!F0# zGfciZK&NEM@?rF_R68>(Zh4k3%simS$?&nKxYC2r z)0mZ(zlA~-*AoCLu1^6}T>Y`xDy}gADy~r%zz&2cM%;3iWy$AUFChy(UC%B5k5t?w zfGl#i2yhj^-2j;KejVJ0o<_!>1b7SJ1p&SWcmrVk$Nbq1Vxtu$0IC((;M*I#?8E1JZG~vnqW)Q8wQ}c?ep@tYfGIzk zv})GCEIFevbvUHRj;DAl1t-eJ`iQL5<)ptLt<&#FC2Z8W3`1ZeO7R#DoOE9+Us2Y zsVZS{kaC^-*O<9JiL~m<)tVl5jOfwripzMn_hoHoG-?A1#RlAn4d}_lQyWkOpf+GG zfZBjo0JQ;I0MrKP0hbBV^pUKj{AbC&bvl&~0LTHCsiP4{FYPr-lbA=6u^iipg(R0PI!mhPcUf!91h{5fmvD49)f>Y5ZNP%gh|oCxLcTe=h% zluD(yGY_I)1v(wyQ7586r{cS&j!wh(GG!VLJ0SHx%v?|B!v+rl{vcCk;V=yp{mVEe z`oE!loGJesnpp%sQXDeoJq*tXWPPf1Uwl(u09Qxo=I{78o)c;6w_N?&VbM z(KP!_8p2PP#wP&iX^0hoy1VS@4q50`rDk z3@jY-GZN=Wr&)o@A)84wNFpb&WXLUEqF111$Ztu=+2Ew!frcU5NUW7=eFDux?j@o9 z^bM@wTZM4?404j%gGWH*WuF_0NUA1D4*?8eY@?LP+ae@K%!i7eWd*CI*sv(31=#t*J1;{|ALM z$BrUv$n*qJoj}11lMrcYAackI{U6e-5wj`CI7&yS{|Ai7A#$L!=K>VcN?gR>MA5I2 z%c!3AZqH`TmXV&&E;;Uh1S8o!ua`eh1f|_gfVQ+d;by7z8}qFat);I(M9$KLUzM;% zJ}gzgH(eb6G>N2(6M6~-#xhETF0kMev5eR0!Q$K}Sr{~wd40BqGBcX60y&g#(zC|7 zr;ygSRyXMp0F$s@E}=3()@q}7t$p!m#x>~UkZ?DNeTI{@d`*_ruYQBh4$5tGiG zv7>0{Ii%G5tOhXVM`MX>6HF}ej_lN<`QK`-#~6d`3T2NaYl3z3k>tJ=o2yHRI1(Dv zO96|lHdNQNY#}u52K|b?bUN$9d$23h9QxK1c@YK+zpW90LZp3-N;_Wp*uyDzmb&M) zl$-JTX|Kdm5fLRz{S7<`IM9Mv=NCc`zn&BjYtyF0rmU$WNS3}EYiBT z{54yTLB3CVQ!m;-m#xv{((NoMNX{YbdwQ3!?^)oAe1KT|y$Mn~B_}CA5iy1X-uizX+(7X-DVCu3EQ-TH zZzV#C3#3>A-$fL=f$uTD?#EY{DG*(d9X}Ceb~St_hGnk(BElqE7I~he3t@qYHor*O znAT(hWvV=W|3v;DgA!Mz5Q;{HD}CuLpl%PRwZlY%bSsovBW9sNeb4Py!$ven`Pq?j z)yuWsLf%N3?P}!2zIhYUhtkWl9-+?~LQg3qH#pxN(){s)>f{q7PrscSC^?_;2e%h8wvxG$ z{qP{Bb&32(cfp5c&9layBX|$0OXf1+pyD3ZBn97R{fM!fmn`@oy|hS{{}@ugvX^Mh z`iWG^&k3kNYT#O6!DJE03>8RmKjw{2%TqONrs0a52~-@ljUftCCU7~Y=QvaTL`Efv z6v_Aieinu3d%H}yGjr00ZbrC+$Qb%Pz)=82uhQT-DYmkE=D$bo2W05Oxz7Reca!rC z0DXx7_X3O))EDL?sW87G5hYB?2uTeQrpQdFQJEpq-(P}f;ig5;cah#2PRn$XXaJ8j z`M-(u{aDJ5dXGxa3Gf-fTLOrR>;q605rc20qx5DXff~wF4auYQDAAAt0Bhv+usZOe z(To%Bl*A0PJc_RPUZoWYo3~<5`vbMI&wGQ`r@ac;H&?*1oq*0r_Z$085s6XyWo{Fu z8?9gQwkF8;ky7pp1kC@Ca9=?F55@wq@G1A}e@tpk$dek^dNr;!HO5Kibpd%d&zdkr z5>I{$+%{5 z3BG1uzRX{#JD%%FU%tqGA=fwL$>!briHx4)+Qaptm&sk^TFE8yY3A~NLi3AUtH9Cj z!*d&X&&A0X+`G91|3MFloA(;`?X;q)NNT+eZNKY{mh?c+M=%l`)W;w1Rb^&FS?dyoFT zd_NsRZ#?=$_iyGBeM|T0N!t&|w|wUn#Hx5Yb%%c8xOFM zOUCG*hcifD%q4SQ%DkVziQpg2wZzwt;NQsg7MH*NJko7(@-5m5zwYPS>%+4dcneo0 zJo4L-72pthuI9R*%lmoxH;~~U*D7#a430Lg&0IHg&Gqqd3gtroD_rk!dA|l=v15tU z-^2AB*DG9aaec(Kk83!1#&O9(I`20CKzLcgCA{-~c>p2<$rC;Eexm^&fKgiZho7ap5Wd$x_7T$p<7QjRPyuanh=xr=vZN@h5NbAO?&sv zZd!MLz@k_3+Zl6Danl1#vCdTilc_}>tLb*UUbvr+;WdjPkv%M-xNf^U8_zWH78 z&G+!lU(`}vQ(5L>ErX7#@RZ-tk*Id`pUu4}d$8mlU+E1F?m z8Ku==tgEQ9s_L2>>l;><)l}6*&`R~D>IFw*#vo40*$=Xl^X4Y+Q66RGP|OfsET<0Dgbbc~#9W zTf*6k%Npy>quO~j^^3}DRF+nCU3GJHc@4v;w4~Iq5GXumsbQ5@RJ7E#)RZ^ZH%gVp zW~%%0tmgV=hFw#S?&+T}?}bS+{xPHJ*dT`sixE$C)2MNy!?ZOmDL;0^$nYSW>RTEs zs*GeTlYmPu;0@E0idRt9(A)?I-C80Vt9c1hTvA_CN#Bi77w*q%>vm))i$(0Q+^f8} zu_~+!mhe7|&ZmTKBZe!PK3vMIC5PMvw`)Y!Z^l#MuU3v26O(v&tsVo;q>vw3(-tO*>`Q%-M6h=AS(E)Ty&4 z&Yjw|WXjap)6R&KKY8Y?v%1!vJ@w>ibLLK+9Uk1|X|qbE&W;wQmv{P%8L{;yPMuSR z0Y(QV#VtB+WOqf#rn@3RIC;|K?htlUBnZ1HQiLZ>;?^zBZc7zyx21}CZWs0`TNwM~ z_(h5{evu$NdGaaU(b-LrAdFKqdEzNkXUv#3u{#k(%Hzu^TrT+Ih&WuXZ0IVnNV)Lh z5ar5{LzFB2xI&2T;?PyJmqSx5uCyQjmf_j-aP74dcj1 zvg5E_YfqWlU5lv{b>C{#A)1Yf*KX2`nP;9fZB9wNcHy!({YA=7nlxr~?1YGvcIEcO z*^@_$%Ez|xjMe1s=T|pHD%P&8B4QJZb*OUD|3j2_gMZ@e?&q#4i$8C*OmN20i7?JM zEDz)Cu1x9dI!_}w&N%Z-%LHe4WlCpP zL5Fe1QGzhecxCSLI`gD%m)CBJgvf4+gvNPu=fs;G(kf2TEda^Yqz~d8IjXOQudE&)YQ1E=sm% zElq5o!uv`#b&Y0cIbw{v)mmD$vaES!gY3s;$2rcI-5~LhrsgX4^1j^i=H|xgMJ>&2 z))&{5%g$K(5;QGM<>&cpR#*B87gaY4DN?t*=DhmG>gFZ2zT(QN#_DC|8bP4P246`{ zeTB(4jjJju$`+T`R@Xqbi%n}(m6;uKS#y0^Q%ybFX89w;S~5IK`nPJT7gse`*H(o| z_A{2v5KqlU-5YSf%)UtZQc5 zU$NBPs>3`>Vno)Wm9W(kUTV@~tPBMT-2oC#Ij?z1m{_S)RnbsZUE6?gr5|EBja3$* zo$~6svWD`;^4cmQEKOZ=%5=By_2Q$hDGGZdJ@~MD`~3z28;k23Ys)UIYOI&AfgozE zs;ysUMk_-oTii&5sg}&fm0G^M8dZ}48X2jEYJo&vh)0zvTf!9tWlLSxyvizxOsp&m ztEd^cRF8|OY&rT?W`rfd4$+OO#>RRgA8r#FWJAj$WL;LZqM^Qy=!Hd|MNrU^0M@Bi zlU2uqQg8IN4b^2bVf-1^R3hTD_*}r0S=N-(tkY&$vrn~V^Y=9CjB4wQ#a2UkWo0$- zlqKa&OUir-C!Kp?lZY6UHep313oW2yB4?@%LRZxa0!@bVO|US!dYCw^Kqocz<(0^Y zcwG|%)Oi)IBO}tVl{ZA8N_c_E@Uoc z0nhMA-RXo_Yh}L5Xms`p{e~1Bp*s`kqpGov5Sr9;17s1YCc?7S@GaJSF@+#Y36be0oq3it zDiakK>`_>}Nl3oeR&8^aifYygDaSz(S(vo2y2*5*gt&bQ?yA~`=9QYM6W*_V@Ve4d zK7YQbF4`F$Mc5=Y6D@DTm@;j`7^AHU17cdSI98Y%?m(H>WMYb0Vnkn?c$y%Aa#>1Z zGt9bDAwhHDX)T;@B+e|8$z9ciOI^w>V#|zIiH^}~wKV06WDZMcy|SgYHln?fQ(Jj# zSet>vW~dQEU0W%RhsU09PPh)?=MmvzN%%{|*{N<4C&)uU4e^gXLq}4a9j{bIrqtG> zhyE4c9g&trhlyjVo0;JoaTt?wCZ=}x?81(=G<3_%mIj#+-4>hq7wOPVOXtSyt1VJm z;w9hOd)DS2~2mbQr2AGImY5bXP2?!dWyH19_Jrs@ke1 zakt}1URxfb+(jDhDP|~cv4_AfURmuURQgM*Dk{4zlUDvdySDR}%GjkveL33zacNwq zsjRlXvdZYCFru~+tGKw{s>8dr^jW2cmJ)YEvq&9BRc>FQG!wP0REBy5(xt2!;#2wa z8kSZxjbQ23$FboOw|C>-Lb1O|S&c-%af z$tsqZBFTfrvWBs?3rnSY*&{3}Z>kD2z(pi^K0D&;(wFPEIC#;XR#?Jq&#i8$<7s^b z6NAUo;_b2Vjbs=qyaDOb=Nc}z!-#S6M&o0szkA7c=S-KTahtf?KqH!NFnRXO#Tc=H zF|*Sxca^1ki{{pIb;DQhysA1`U#q<5-1RNZm=w$0jF3cW@MKKFH`*8)MW?Hc7Z{(& z?k%cIUH7IkdYJL7T=W3r)hHJq&zn_ohN0#D$s_ve3q*)&Ev;OvW}>3JuFPc-wXBNr zhVqK)=9ShGD&WRph}5jOlc#?1Vr5QUna(N8%&fW=6pKgrVt-^Vy7)|$297)kje<~} zKOZ5@7KcNKmNhgkW-q!Ju6u~3MYt@snLeIp3gL0ehSA)-X)k9u$YQ3rG}n|bs^Tz$ z{PnUX8b7%E4wT|1jV#gj%q{kY&lf(o0y^MvM2F7t*DGQoDkd*zBV*1l`vgx6JrrRiC%YC!yTN} zP}^ixw3v8J1XH*a{4&<^^Ehl$D|@sEmo%`bJ6NlsinWn?VZh@&dl42%SY>94Kjl?f zs)5Te2O>S;`Yb^w4dU|}BOxLQ44l_kkFu~QooG$6PUaBgS=QNM2}y;9dMLFTbPHUk ze+li?S2kD(jVK;}>zkPWW<8s0%{4~ZlX18Uj0a7Ys2S&ZBl(GqbAafb>x2_?vh_*H~- za?FZO)G`u<)S4CLHMsglLQxH(;!o14JNoFrlu#s&Q+Q5^9(Z^>a-#|*Gb(hU9*;x> z#FY`osm{4=yhugNQrHD!mvS?C-H=w4vnmAWVKp6LgB(PQqS!saXG*E7!PW8_6Hbzl zM}&jn199QXF?2*RQF&!f2S&*!Oi=t>T~jJrnwsltm{CV9!Kchb}dRI?C52fryC}!?}r7W zS0^0EindT;QlqoYitDk#OrtUrmG&|tv#frx&N3ZvIMOdx&J7HO6_tlQ&5bP;%`IZk zWS9`;^W@yXxhTKjQXfYQXZWd(X8U5T5kpG#NWQ;XB%)~dX$5aMjl=O zR0s=?r@leLWdy-uNc5s$ic=RVpS!7Pv#X4h`?ua&K{BxWz8c|hNqD73wC-Z4Sy3r> z+ZtWP&Gfmp($L?xFCEPw^L^N33TyEzSb*mT3O3OC_uysb2)vDpo8wa*H^(PGH^;w|aI^eWciCyT=Cr&Hl|C#5P-4;jbR}6N8fXsNOsYPFk@&nh0`2bX^{74=-A8dshPSH7 zV-=j$Uyd)kjP0F1K9uM267sF7Z)jNQdxGZqyFA8i6ko#K=(tZ|-4v5~NxgZvBSd&l znutnDK6}n(^*kM}=Ao4o;}@2*AhBf$hoi(3(?^%4z;E2$!{s!zni{Gqsux$Ykoko-x)NZ70-{W2k0fFd4bUyUWV_h^|9Pcn;&HqzggswWZOKQH zt;xJ0bet7TK5Swrkd%;S^$es3G7>TqvjaI+Z@W*RZ=heo;eq_Xk@BulI+uJ9InheA z0vD&Hq>@hI@_zEdoIm{$1%13i?j>AP($cRCY)DvZw&eT0Q_>2g-g^7;#CGSh;JU-shT4**q!s$dCNI}%pT4nq zFO*522emv-e=sahD!9Kb+~d%tFFks73?Jj;^7kn(AjZL^W6blAahDeqV`x`?`RmBb zg%UNOK-Y!@E6>a1zFYHS^oh3q{%f>OL|6UeouFlAyeYumF9hJH z)9^U1uFZ>W=kL22JUSoa%(?fpEPBrQ+qQdciKopNBD6aVQ$jhqT(6hwPV|kf1ZeJ^+3-Sicu=WQMi z^xV($*m3xEWn(vO4n>c=Xxj}vCH}F?i@4p@i`6fGJ9%MOdA2^rR?drFCt~&a5IQo! zZ#!4$n4@*n&y(=jWB7QTwu{U;KhBsk)n9-4X0K15ttlkW`^ihj-SDa%6^fd-@*;9K zb)$4oUR3U;-U>gz4^^*^M<91IZzALO%TUJZPZyK+k568P?uM3ErY;6@50-XX!|-q>qPKgb0Qxauu73|AQ1RE zEmdw*vA6>N7w@lE*HzTCR94M*!q-t>&xu|9?TD`-XjYly!ZnzUxc+-XPgyck^z( z#aTP^{`t{Mgr#hw<8QqPY{6r5ayZ8nF|H8fakifb!PkvwjRs^n1*3LjZ=%$#b`v>FPc z^VsaW^}HkF@rJG2__EsaI*v8TBfKuCd9Kh%naMXeVeTTf-YvCc0=xXvvHA#&e$*k{ zkEXB5#p&tge5051UA>$yAA*>V=FHdcM9eqehnVl_K~r-jds>jPk8|1XcIcicY2ry< zH6bA6AbpD*Ou)zunRY4W9Htph_{gP6BIyxfh@+GS?xs(PIM+9E#yWnVvBi3#$sDIP zXnp*XI0~6Cjc3YHof2GV6xlK+E77qWvA>r6y%lf|fY z`|E^+_QZhW*y}GTC3Q)sy*8i){|L|Gi`5oOdsS8U~ZMtGt zE%3{RDu=E#V8c)9cy;BTK&;6}?6b_dtmHL8d)q~=PLlmxB3%USq*AAsePOASw8P1s z<|IuI+FLIwb#j9C%ThigXy0*Bsr`?{SY)p&GP{vpqtNvdbhV({Z_vSrbkNyNGKEs% z$Y!w9?FWg#H-Q=;hR(g9PD=hVXkU2|*uO}GVWEjm#>r0VTBqm9PNv-h2CZ?D)&=da zF6?v$1nqW5xRqb(q}dg4X&ojfC)gIWKfTaMgsBeX^5-DV-5Bf?Ktf z@K~xJ9}G8x&&!4JH-+GKL8;TzZh#_@NRr(k)+nPj2G!%BN=kk_Xg{zVeTCe=hp4>9 zPHuI2f*WlK31@!^+9a@tIx*`vEk{MEc3jXN(duMUZBWqe10SAWR_ZW0eir(l2-|N# z>|d9uTHl`pclRvoNC-u#^7~0L??V3y+SgMLD)$@)Z9AMk_H7BR&f!onAQ);PnIr;e zb;bwnOveh^oh_}-*r0t)vhd~}re=>eCn?ktv>yRE z@_RK2`e%sF4YtR0D4JYWG(iUsl1tY(MQtctsr_b)=KL{9xU$2gEQxYRqn~@p=@GR5 zCg^rB&qx*p?O)TaX{;l@EtwI&*3#h&4%#n4ejzjRxA0NvfHAi(D~&Nie?BbWq$P(Y zASNdT+5CQmQt|i0N*VdU;3=X>gZT?hTUH>IHxDbdZ@(1a>lGdL+QUNQ0TPx3082aF zJXQ@Y>u|;d(L@G1Q9#uz`^yy_Vu?OEj5#u0#&z8arTnwQx=@xJaEg-|z(X)*NYH*- z#`Zu8v!^+kOvJ|!h*pK>)e5wJWp7`hu?{~wdPBN^E-z8&H5 zF{ai4lH5fF_;?e|a@N`DoeAktI{s(S>oB)9n_<4(1JZum>>p+iF*EdyZ426I6kkU% z1AV_or#H~Nb=#!G9}Z>w zg7)LfJ7vi4^km4t1R*N+nsjR42#VwEz8y}lY0hyooL(j5^=ozdw=vREG;BI^A4_7qrjd=yq zmoVDU^mMAsjK)?cIcVRNVjApP)~XGjqCsk~)!x%Y$M>XkFxojl-!*lJ);;Xj#v)TY z$^KWU!|At9xV{tANa`zEsAYgCn4T0m-s!s*C1IgPXz1Z5jh!(w?ESQW(=R#nzH)Q~ zs}J3yIqNi?8eA7dBSr+*V-GKN@=tOGpXy|w8ExFY zrA~igCie{PX?jC?z&ScOG!enq>pa<<-Z|Yl8v7kO(a9}AB6lrUiHOa> z9SUM4T?5C=#dwJoKzlEDS20-nD*<;pL)JQz?Ehe!$4^In){0zB^54!RTq$^#8$96T z9dI&tIT@>+{MEt=`#G?Km;~)d>!s}ZeoAM?S8?_@A6UoWR4pWoJZz!iHd>vi4%{AHL?#MFWrre;TsKk^pR%T7iz z45WV$O}Pmn!kG`@Rp6AEIryno7Byw^25m9r;p$8+yd8W++9%luY2G)u93rJEWzf?ZTL zgPvZmYZV}7;9KY+GZ`Z~-NWHz+YekSb3P6y?5D+PdKOIgcER+ZVzQe;@43kAze6AV zxjUm%aWb3ZAx*Mhu}b0iuDVkD@r=^Mbm7FOGT75vMJtA*2-BQC)3GCrUHCLjEfA~- z+S}=Z>U#vfAF}pHU$}yo8Z#XuO2ZK9KbL`yY^#g)_g-?Dk!+X|2+nj;SH&2ucc_z` z9QsJcV&7;+_;Ci^g;oUZp9ONB{dU{v@Pts8bLAE76?Gz=_Ph782KXA@Mu9 z@1KlGRNccw6Mvtrovsv=4#=;P#^>?ECnF#{3H+Q*sny{T4h(}y6U>k9bv9;|qH*gZO5pTqbNZ?hWlfhs6xjzX*}Soxs?nKuO%_N#qjeE$0~#D^ z+@an^ZZ;wjg?P0F3El~U{z^F{Jy)aB*u+@F+TVq#)O(-dA@=*T7}B1aRsmwB>ciU4 zIvfm8CfU2Pa3q4bCQOU$;B4*weoAoB-iLsJ5Oj)@$u0zCo(4O%5*6!~0_k5v2%piE zt&Dw*^nu|dnI`T}5An{VvyK??A23uY>TD%P#w#_&Eoi6X4TM~}?bt~raw5v#VSlzX zmfx>ti)!tlH1uAKe*K)Hv}Dn*)O}9oOegK3p#8?uQu~(dQn}NieMdH{$}X(_(pEgd zJF~^v554Q8k@dpTR{L&>lW;n+u|3a73;RBDGK1@b_8&Fw7Q4MFX#aU>Xsi7& zD8P#i%E4!R$n>&D8m(bd3WieDN4IFW7C8C$(6M7bpWOk}A!cb$wsOM0e`)Oc^MM&o zVQ=in1e_5enXry_=-QHCg3%owrWo}(Lr%FtFsHVB<#X1sX5 zigQB_gZl!wXVAVv;Qi-^nt@sYTD?2FwVckN{Si4gP-5<#zI14-w5E#N2=RvQ!DiFo z>YRki0Fd_fp!D#U^K}KQUsxp^|?s#sxDGI7?EOVYm5-T$O$Cd>(6KBW^a%|eQ`d5{BKeV5j^?f zViVzSMRo`cIYmhiT^H#*=Jdo=e#szU_eSBtrAX;ck;1`hky1O%5(pMuDdX*|Mk}uG zrR&Hi)t#~u{9Kwbu~TJ__^#o{uY@0OSI5q#HN9moBYp$X>Lt3jxU9GA9YjlrE2i10 ztrUG|ihkakU<~BFO>zWFKFNT6OssTwfwSA0@)U(h1U)+K2Mo?<;&k_GQ}njm-Oo*T z&uDi?$9C7+C)`~Zk#44}N3xv?(~qRfm(J_3f7eIWo$W#UmGjiiYZJfyfK#}ZT?~+L z&EA5;{bQEJzn-VgpS_)MU8}vD1{2whfZ*_xgZ7i>5%*zUk<7%p>~e-P%XX64-+r=B zsY0nPq|@8!@jfwTioFr_t9@3KRe?vuY znVwLBswDd~<=e$NbK3f%Dc>yaNazz4aJjN?6f56b++lC->$36#TH-OoN?I=O5P%M5 zIE9aROznX$Cf+9N^R(u2KUDZ*}Upo;(-_P$~l*2BcSC?@`~Up%LCHMzOT;)wsJs?}cC zuavuR*51&M`KFH_X0ak4;Mq{`wGK<@fEi8?`%3js2%}eNAme9*WF&gg8{5t;Z;exM znUi*j7>+l<*4Ms;3itqdggnXnCwT?LOZ&l>SF2c&ZtvF$(CXf?xwrS@4@Ck=QRqE@ zQYRlMKjY$w=lVG9Z~-3cN0Y~>Tg2?5t|^M0_Iu*8@;*-ot$aZT?P$y60Pm$ zh(V>{B8#)L7JSHPP5)B$%B4StJ#$z>4ES4~w=kf~`qS4}l{)xu5oz`gr$6zU)m5?9 z_%gf^M`EV2gy~BAyF&Q+(wXw80V3Jh#3PcR-I=jZExza<_Vk5Bdal$c!Ri6%^K@sx zbSJPjW-Z*PO&DpIi>>y@W(1r28{hge5$Qj`1QWg_&t*Uy?2f%f0_uOSY_;#CV*lXD zj`KxA^y9btv_lh%7O~}FaG#(<*2*XP!}|Y7Zx8%{-h}JwNj}>@*5`lG3<~=W9`^6h zk{z5ySNPv_)rSz8WXVH6Pnub6((m`kky*XJKlIqd@o=fKSs1-q{vk_cH39qk$8LnK z93U1np|G#E%L$(3B%O*M18xSnc>wD1g;Qkb>s-K;KWdcc*#Riey$lJd-#P#dcpdyX zfVwYea{96!zgi&^cmT7sf(fj5nYIID0#_&`MXG;y2#SAHAdb5zX0FoWt^uXKyRJO< zpc;<-DpBiBQAVS3on2H;CXGf)cMK2@^^cI8XYYWtbgcjI5@*B=*(Mhy6!g_uEJI=n zJ}xxu5*q$EfZZET%EOY_O`m<%Ft&dZSWmSH!Q;wSbl49vpubea&i|K{o1v9(MX=hh z59k0A=Gp&*fFz8u6u{bdCHaNO@g~ZPn2OT>Wx%lXV}UnOF$d6PX&+d6t+4b{dcGD0 znLCX9R9H%pKvJZ2N(I;o37;|mx|fjUWne^~z7y=Nz*vD*12Jo>kU}0&3~KV+!QKcF zP`IC-i$eDbkKoVrwOEykSmpicz<|>S?djzt&)^9nMh&-Y5tQ6GkUt+TO1PMvC3-Xv z6bEo3L8imG(@8tk8FG@7H#7XCBR646KNNXIsgpY!4Ok?KY~M}8emfzQ80;cd_xpt4 zXBNd8sYfBCcMKsNLdc(lkPeTKr~YR`Za0MdGeXF%hLE>}kej;@vgvTy3EC@L#rt6d z^7!n7a+rV1;c)$pa%T16rTBfgf8*8jn!wY#)M?IWiP%fQDL*vVezaT__m;yuona>0 ziqY$A(rEL?1a-1)4U~v&LwH@{B#wQ5O2>{E6Z<0MXD4Stxjc_;M;V3dZ83K7ZC|Yb zwQ{i<2(~X9_P~r7jBn&ALw^4g*}JutD#?FK=x_=&+G78#OdfdJpXA97XEg4g9B3do z_OPC7c=KE#!~Q%^dPSbSNdI2mj`@6h^225frDV(JJFuK6L zB0-$r{XcPGw7pC?BBeND$YcNE9o%(id3T;1W_m&JGf(cNSJAv@%Lvit=^fwIet>Qr zRP+gYAuRsuyo6Z+T;9Q0#GPfG((o}Fng=KLcb6dg#}^`N0)LO@CbS3OubsqTVeB|L zn1DrN&pOU#$AMLHY+`6>HgS-{=^Nc-Q4J831(xKlL3x(k8aXgF@z2K_J8m zZ)AYO?GJUZn}M~aE_!aoiS}n&ag$d3SSw1S=!$7Pq&0EC?BIGChfR3WKWaM9Z6{b? z(`o-J3-u}mltT){FNuP%wOafCk_S9$1`)IBHbO`^a_4rK*@IoXqFfz-FPUeBa5f`| zrA{c$c821jq8-Iz*-8{>bEa}fS8`QX*u8YRDG85R-(p6=wVmf$EMVAUigCw?3lKUTu~QE_0%xQ3~nY7-Pzh&lQK zf{Fs8fK8@gf}#AT}g+;tsO#ZEgy6 za)1i+Yt9gC$VX+rSfEDf^+B@S6t+6UAc$c3|MsXg-dTb-@@3&? z2{FbKoq=osKANw5+9Ms`e-2pg66kLNZ7+bQoLO3}e@i&u=cI7rkDUd3bMj@akshbB zg#YeRF;TKM-#A|&`{TiMiecL!i&H9(1g@R0T;Des9mXtPMUsW|0M*d^ji%9-BSPaT zdznGO+dGedF@Hb1L!NB>Vz4>j21q_k%r}F0 z*i-Q4A(%DO$(<%gIS%LG-418KG&#$dF~b?KQz&}`Iw$ZnlK!Lk_S$?=O(tFeoZ58` zvkcY^hTy-=F9p!CUen-O+o*NitlI3CJX8BWK5fge{~!lao`Ypapob#uXXmSmypY8M z34D|qHHWWY>v;|*%0&iV+`qC!=divqdH+Qz&7YFPDbLPlMhzBJ>fYjS_C;WO=6A-- z%N=NS|73gjB6%orqP=UNc%6?gqMMygIE-t5xg6@AKBCkaJl&b}h$zdCXP_eNM!(c0 zQ-kAoB4V^89Dj9Bb0pah4`e($i~_tQ3h=wLWA{NHA8EGp5^CZp%vn0KHS!rlhFI-A zN8;6?Q}>;vCiM9u@j4&mnVy6aMxaaVZ%oPSlpHO)+Fz1(>~}~)VDD1et~-lrE~(}$ z(UF|e!oWY`4hT>1>v^iP>xMw`f9A#RnXeoYaB`9phUYjvW`MTT-b;1tQ5&bCl0wTO z+@t&4*3ezLWU?)BL$bp z*&(Ey(e50L>t#R0;yLxy#38Wny>k)cy%%*PGDSW)BH@()ig!KsiB;@VR3j6Gzate~{FUd~}uEtg7ndI4U{AdTSsgLw8aEA<-8FG-9#4LFMyWH3 z$2mixYaOHc_!2DsmuHqn#Vp;}Oq`fyZ+o@GSXc9m=4i(8&>4Du?ryMUFakaDdw_-h zqe~>(@}1QR3tl~g_>pvnPOOOIL|FCN{#c%-SMVv9C|pxaH4y zyb$jQIL4Upk*ovH;04KUX`Ok%O*{pi$UNYr?nlC{gqHu8<6i26$Z^0gg>^ffV_?)8 zM1x1=o}^kvH3@sPtI#%SDl=H$ahmBQO?CPs^EFO?rt)-wot=s3?^%Mj zKSGm!Qtc14oBsAq2(hpI+n>k|YxTTRDI=N?5FJgi|8%5mRqU4%FpC^-<>VVjQP;^| z$DV`<)aPdZg>0Q4--vp*p}g#k|810a{po0}B<%I4$39%UF(^+(u{iG$&9Z+jTzGS3 zCqS#5H00jt-idYHMQm$jhkXlWZ%}p%W#-<>{vn|-Tc*uxD|HV44n_^ZNjZ{ZlguOg zXo&j7%2NAX%-1hgiYsG(K=DLS-6S2~#iXJ2-#9Hik%T^Bn}(Ky?Z@^u3YoY+mdB7Y z(5>w(uhQtjMBL$0LQ{QC6+34?c2TSS7$-A}U_b&J!~;kaI{!rTB6;q*lf;wMi`?;> z@q%lZz|ojkozeqPui zXVwP67$(@^9ZruOD1@H!+I*o}wd<+Z!@l>@Qq3!G5_=*v*(V}H$hEJRO$jv@GS&?jw%T8?L5bWuNb?Sk z=A$z$_~sD*Z|bZk&)g;5;ii?FsS=X=R%Ch^@<~!%*oW*1ZCoS#Af{~N>jrEdkN3A1 zii412OW?;n%D1p}zw{Hk*SL){bv=@qsNk^dmxyn{>IV}g*z=gHG~}Z;!tuY$*|{KK@ zfq0!mx?l*Zexr|@MBfBK~c{~?J_N*m|2UtOQMU0&k51>=g?^B$9J2;&{ zOZVJo4xp;+wW#{7R9&N0ztyU}v?|B64c7it{puX;`Bw$d z|Moeh_OA-eN+R#h#{6!~k7OiTpMU@1k&!en+FGwhrSq)fsC07R*(3b*(*l`M>CC|W z1^)70fgtG_@-nafdIjbU_F%d93*<)OKRi$og)cvFM-;vz17Fepl`x7U1Jk4M6$N%j zwJ)$TqwpUcI3ucjWZ!*&(LdUn z9hDwu{T=*$^d)QQ!M6HF^*`QP5Jlev>(^2Er&#-=@Re9oqtY|1ABY3QT69pv!c@Tt?Q!tUuYd4m9Dg|it2xfH7+V$WA%-~mt@@+)qjKaeN=g~H90E1 z!g~Mzq3nF%yqNa?KU+zckc6%T{aK2%$^p(j|n@C3FcP zgb+ekA%qY@=n_H{LayKIHRm~>ot-|*_csqd&tB)e&+EMB%*>gY&!5>^{f&z*t)<6D z9ct+b(L1&JpBPW*<%^&p&o{<0Q z-0@qlV2fJ)H7ux7e|~mQSn5YBq-W&f8x~Z`zh};G%Yswn-=IMfzg@xo@>`eEt<`>2 zQXLgVZ%8l6=^YE6kzY-I`ZQL0c+S6NL0|dL$i=rVxJ~|gEEG%Yg6HMuXZwVuZNVJ1 zZ(cvq?F-hcea*9bIu;xxtw+;m?-}lIlqGo)~o%br2FX5f*#T}{U2K32Lr9k)pv+qR{u4A z-J>TIzclC9Bl=D8ZF0J2beQyjobDA(Q~#54`S*^#Q+<) zM|-N?&l3vEr06@<&rM`BIqE9iC|5rvYAgSm@tPKmQ+q!cB`njU)r$A?#lkW(dRg_& za(Z60i{o>8el$_>J#u zMBCKT>!SIJU!C)-SI|_t#;;yMsp7}!Sz2MKS8xpv8SA5h0&U5CwY|J}A1jECD|n)1 zETcvBt&c9)vuV&CgL-<>;Axu#Jyto@)1KOK)z3qbT6}O)my+OWBP)KASM zF0P-NDTD5iigtbHjP9P%JuDTm9KkAp3itnG%12TG0 zMwe#v@Qkj==*o<)&giijJuaiiXY_=Oo|w^-GJ0}GPs!-189gndr)TtxjGmd%vod;i zM$gIUxfwk#qvvPzf{b32(Tg*BNk%Wt=w%tbJfl}+^vaB0mC>s+dQC>J%joqPy&YaeXt+PcE^3BvU^nqc2KL@s8goG>&*W4 zkKDCi@ZUdmN#gcTW%TGqDr9l}PKAjI?Jsws7C(c%sgBrf3WD~lt8U0_-*)srPjO9k zr|=Q}L9dCLvj6l}+osWV1#VR9C{E za7pEEnnsJGLG(8(Zoeuzy;l8#XqO!osAZb|ZyK$P+Tic&&8E8Z`-tn^DRKSs=mNHP z&?};+S$|*uHq}-1+|BK#do2CmRM&fb84ur+G>!Ht_?h_CaeYyAM`nL`KeIiqCVzW+ zd}n30fB#JUgw!Ra3_4#{`p9z|2s4N6=(XJl*3(Vg33>A28mfaecqY_mN(j z#r+S6u4jCf#kxmS!tof!W9w*1X8V7!YiRFRZ=Zw6zj54tz5YsISiIXdjW$GIbG~gA z>!t;_a6BxH^^OHgna{e%?RPG?ig-WIx@lCe;9%nY%xazA3p`F<+UftM(Qnac_OA)C z-mKs^^644tifA3<)j8G^qe~dCm9ZWleMtL8v965vX1uFoJubRfd3l+q|C{Rlkh$!y zVSFbo+S}T%-yuJ@tRnXlk?t`(GIUDbeGZ{cTAzM~B7zJ(1adgXk}uALd3y^fyVdO`|!{ zX+@!JsGku%LA{^5-!z&YJ(k%&nzR4(iQ9WG&{97PV%s}|%;}lo`P_xcWq%TPS9nj) z<-OFT&^w2hr2g)3z9_sy*C#4=y{w`Zx_tM3)nd;~{5>l4lC+-{MMaW@yA;IxQQ@YU z_K^Vffc-3sDo$QO1fh>vfV z`?ID(`N<-3em%|R1yNtKML{&k)Hshbb$g`HIBu?~JeQd2XSujhzOyxtkf*wg3UAQ+ zVzAUyfANxx`vZC})bZU5qTyzCJRj71y)M^!dwUk1P@p|fl#jQo8LzkUS|`0xJ`b^9 z$iKqz@}DBM_;VP?79I>QNj@@9`s=4+`^WwE&-APQmZ^TD{vOt6nQnKR-m^9}jtk7e zYzJ*Tr4sLF@wjMv$U4re+LZ4U^M-=d6xFq zeC;2N!hWfpV3OmsA9-9%ZNkX=ljk?@H*x;TbGdb480W$rSRd^NK5uw`Xk}`Di`Pea z49M5-+$es>%G-0S{j`2@zZ#eM*8d8BL&%K%G>#Sa)i_QxHF&d3jn5)e?N`Dk^`v!t z6`9JngQ@M^-BesZQ+bU?`#tiF#`Q6db0_a5*)JYfTggI|$NPnR2U+`I@sh+n!SSlw z=3Xjxe7q#}8q^|}4^&=ew*E=>AJvyqA8!Y(*HUZI^Mu*`s~AbXnR(g zs*lHeXl8vDa=eu@4q2Z?oS$x%iI-%3UtqkozSC9g^<86@alEMCWIf~c(|T6qTfY}| zAMJMXkH<~>!5nMF&lNWskC(#zn78wC$DLjfDKw66l+S-L{nDj z+kZZCw@6NZD&oZ-v=6_T3;3`u-@%*T9@VIz;_&Xi-uT`D3-c~I_w?cb$a_jR} zP2TfW?7ZXcrv8fTueUwh&`)RRH3X1br-gB*$Z=ApKU1Y6%H<-#d zaz4tp0rd8D-i^uA>t!9Um)67UwbB0eHuJ-EUMVffc3Kubw<|nK`>~3>pU2~OY(e}T zoI<^w>VBM$-#>9a@o^yS{c59r-l?OXccXA#Ren0u;`3xYj~~Z;r~Z4ezJ1N^VSC$O zhg`gVPCJ+Pdz?q*=XtAz#m%4pF#xEPUg7cZib&%sUZsSdj<2D14M+I8deRpk5>A1}#v|8J1F{pHh){*3#i zi|I$}+oryJ#D3;9ea3E2#srp5f>-*ACq0XNJO!-xs@>yWY zcfF~2zfWlPhkjqq?Fu&))vkl7cH>Qrf0IU{`s-)PXR@jG^WaL@L+|IgeP2`UXPWZu zr~6=Qf0pmWvsr6leUS-}Mh4t3{>G|CK#_Or=J;7QgOHH*~ZOW&K_fPrvG<7^o zGqpbP{;T*3@1H|;{~~U59Dl`iuI7PpO1)6|Pc${2vWz*~R6gY6&Agx_v&*zXQ)SNrNXi;q)nuL;)r__RX# zdO!5}$?fKvYPZPL{^#$eZM46w4fhKhZI5-~`l0aOx~_8nTB#nU$5m``Vz}RTyFStz zwf|oC%Z~q(@-a8({U(i1yx(5LdJSR!Q$LZ{L;Vz*>Ziz5Kgsd#^Q!ajFSfNRJ z3Hp|y-reDSE>pK4v7Q1Shb!O)Q|~|ecrh=A&%iA;E-pXLoE1e^nR@^6QB&_Pz7PE! z%zAo%@L)IrJ_EmlTk3pUPm|YQq0h(G&%#}F-nH%vFN7b%J$3$d{RH?h{1i5BqV3WQq0hh8D`4T~K@WkC zz+d6+jYEAOcqY6Gz6$+0em(6hf8HYS6nF)E8omdAgiW_p{KMM+;5qOS_#NDBs}Oe@ zya_%6*P4&${fj1nXT$k$)2&1KM7R|0)HIZr!duNpqv&;5f19A&!Smq_@M-ud+@e{C zZ)48Yc7xUMLHH@u-y@Ie>3y`e@MQRR_#^DJU5I-aZnu5VgW+9p0bC86H4kz7!xLdO zoCcqV>tNvyq1}P-6nHkg7QSviuIp5|&5qJfMA6>xG&m2wZO)6LUt#f1L6^Zt;p?W} z-&+sc6$U*BPJ#EEdjIZC*sMj+$HGhCt#B#)25!D{h;L)+{l25&2>1_keiS_j--8Wy z3FTejF!)b66E1)sna}9^8%2Tp!V2@*D7qTnYc7bQ58$@D27NF*3(kj|whZ-0!gBNZ zD7q3p2Y-Yuc2oUAeeMX$p?~M$@`vH3t%5!h`g`*A7ReXB2DjNgl%E7=!G-W+^Mxqd zymeq_cnZA4d@+jdhyFgj_11d?9ti&lKZLE@g!;bl95@5M0t^1ExR-Q%!DHb#_;2_& z+@@`aZx0WH!_37|^iTK@dKnH^BMkk|_EdZq*^^p0M0}P5UdH3qODj zibMS_a36R&dQMkg? zMaZ8z2kr%rgXh9ouw9oBcPJbRFM`wIldxge5Wg!t9G(UL1)qa|=@#O9!y)i|cmtec zzOCyQSigJFe}+fF@i5vu)VF~9z!P9Kyb8VxzlXc*6WSjR&w$s%AK=#ehPZa{5I7i~ zXTB3f_rW!A*B+t#6!;`;uwN)IftSMD%=e<`4cK7+p#K6-g*U>N;pTr0ah>3iu-sf8 zMK{8i;HR*lr|RF2qCLzHqUZ>CC43FGKOoc}YJM0+qu>K@E$nh&sJ|NCYp&4xz)cSd zdS6%qXPO^H(T8xSUP1SP)8UVB;NL?1JoqVWa&Rc$2Tq2Mz%O8vLqc3v^W!Kw4c-Oc zg`4*d^#kD@aEC)f`9W|5yx#mo_w(>m*!Zwe-Um*EPnavCXeHe2@Sr=uN;nICX#O{f zHt7@C4juvr!}H8fqv#IvvnYDiTopyz9TE5mJnqP#FM-ifLGJ|5g|EY}U{T)?cQBj` z--Qj14)xvOKsXsLfnUNQ$AtLv;eX%?_zT?b*bvtV9to@AmGEx35Pk)>=@;6U!Dr!W z*zCAazd!s3oB`*<_u+cD?eU>q2Y3V=4ljnc!l&RjaL*G$`-5QxTn7IKTlWufN5Tu> zjqqW(1g?gSP7LjKgMWor!DVo*`MK^VP6|95E{DgS9LjHjOW+T%a6qU(5MBUpgp1*K zaIaHBe1-Xi&aZGTd=LI$eyMx#Qv;8Hqu~wkP52AkexTx4>-|1h4sV3dnO{ZGZ}9p- zK`)29l>~hfyd18D#|{qlH^R5zjzdEEWcUbN4u6EZmWH^2@M3rmd=svLTa<PAFvWcxMTfykcpZEn9x^<{je)no$KiUoO?imh+x#Yq2EvQs zeegrrA zoDA=Q&%@QQX;p~t4o`=dz+2%W^E=(YjSf5-o&_I)zryy_A#NbN7~W&9)%P981fBvv zhX-0Se^9TLr6t05x&kp4~!=ud~b>9hFoD=jg zcp>~3oC`lN*GJLJa|3^dMdO0r7nZ<})bQ^pJZZSTT9{?x9JK%HXFZvw}Jmv2}Uj*-h3*d*aVWhbK>2n%0D$sX11Gh8l z6+}CtTbjS=x)R;V)SK-GqmO|nLQR{opAM6l8s3h5lW%>tBH%z?JX|xCZ_JH)#;sZ4S4F+rt)cH~43`7wiJ}g$KYx;1Tdxcp@AK z%i!to40ski4_*ZS0k4GD!kgf&@J@Iyd1HXsAz=BP} zcy0=}fZM;SvM zzrn-d(QptP3M*h091Aan|Af~-|L)Dl-7WCn@E-U8d=x$j7sJ=#`*0Op3;zc<*);Ui z1nvY|!;Wx&co;k$mcSA4Z0PTS_;a|+(AS#3>i2T!8F02aGm0KZKW{4TMf5Tle}1L$ zSZjTk{%;iGHiz4qs&5I~!(Q+x7=PZSxMAqA@M7rSpT*-2XTitd^KcoAKPQvlH|QUs ze%crNYyo$KZD0rJ@4vXe`13WLOi!`a`VWPp;8=LEsq^_2=u0yo<%`0W69hsCDy?1KKAss4|Ir@@QNS$f~vR9-ijYWFYnJ#a4k z7XA!3-8{5w28-b!^IpCGWy)_H`a|;I4@GReIWWs^fBmD zO>Ng9lnh~(@pFqC`SDMOa z%k2ZZn-53Pf#@Sm<#`PHRCN4(549VKuA=^Y^o8iF;J+xp6@4%I0rZpTXV5RhrKa+E zAAVsfpGM6Cw=-4W8tw)E1`jut=NNcCybMl{KX zQ~hm=-T}Qk`p@Vt=)KW@Lm!Gh4t*lJ3|)>MgO0xkqy8?Ye3GfWt~Iq^KY;f04qW~v zY^XPetXrEJ&(7$+umX;Q7sG4eZRVr8&NS8kT)4oL-y-x<^fL5H^eXf^^m=rIokIIY zrhJ>Bo1@#9TCe!~I_hU1>W_dYnab;QI060(&V}*!dKC9L`X^YgFtp#+RR6uqxw@W3 zpJb}vQ_-iPN21R$6@Ll(T6n9ecK=2{fPNVL4EjIl*WfZ!ejmg2uu+Rp-W=`<+roWd zUpNR>!t+e6-)-=I_yk-C-+&*&Utpu1Lwi35#y&0KUa$u|6dn(U!IAI^cnf?Oz63vm z|AU+F68hU7?gsaQ`@-JvI9LKlz_a1S@On4{&W7{gBKRi!7=8_ZhFcdYzsL0a7*pf2 zhxuz1?TPM&-WPoc`f&6~a46-cq0dC0gT4fP8TvZ(jp#ejccUMHPnyc_dGj}Y4s9yG zW$+{T1zZcGT|>JqOs@~@3=g2bk15}iC?5hV;23z3sklk#Y49$}pF=M}uQru;@y80G&V?gjLl=y%Yc zo67eG%725Kw^I4zdQ!J3zujO5%KiLhuivroWH=0tg%`p2`*@0;HUWf0&mGCS0v#I#zZ35fC zE~fmBgM;Bn7=NEq^_QTphPS|b;3M!ExEQ_-KQW(*qOZ_DnacZD^q>A5^cJT2+X3AI z-41rAya&2Bx(~WP9B8V);qVGm{oRCq94@4M3H$(lOZ`@DgU_CDUwAk?84fp}j-o14 z`JZp9zYEcm;mvRsoNFp>9(oaaF?zWv-;dFa_mrNm{moQAElss=jqZrOcN|vC0eg3iaLLk+2k2!}H)p zruv%uftC%Ux#kcG1Rv()z5zBq9{59eXJ?J6VOA@!_cGAXQ3}bUy8m4 zeLebic(>!_@lS4_}5~z^F^8Z)ht2znU*aQT+XQ>Eo=mekW32 zhAu~sL7$Dj82u0Q4e%~F7cMa6y9m7$y$rn)erYP7b+DjoXtx<`0rxZ&cQicJT&(K^ zQ|nP}s=u-53FwLFDd?%_8R(hlxo{C&23NuLutB%bPa{+PHZzq+5xO1q9nc3*e>AM5 z{4Vol9Y5%&P38X_`c?EB=nv7Kpua({Mc3;d^4S^|!49VS>0`bUMaNS<*i?T*(N*X( z(HEjGL0^r&4t*Q?4)lZQN6^orpGUurehd9y_$}q%qYL&9d2M29e78n#i{2HsF||I$ zrsn9_1gIYWH9Cx9IQD1wBIjCZ@M9dRuh- zI}^3v9bHU)7xV$>zoGlVL6n!GE78^H@#qQYDW>wimGZmcT*_a8E8)*D+ArkY*?e8s z8R)~zU-fW3=Aaq5lo%z~^B6yBYZ}w-!I9e5d_G|NYE2^nNP(H1k)z zUxGddeLng!^cCp%cQ=Z^8GSFD2Va8knd;|9bE$ql|5s7@Z(*wa*63Z}U*Nv*FnA&y z4$p#@n)00tucQ1$_&@VaeQwb+^xMo-zs=FD&~4D2(cRI#(7n+oz@hL=Q~p<@Z-RHi zhv3ujCHN)$4*m=q9uV?u3U`KGU{836`Ie4H^eLv+s{}m)eFpkG^xx6{L|=ve7y4H8 zz3BLNP1;^hqMxDuW%O(4_t77rze0bD{uNztU|7E`OmBa53)srkdi}-xEsDCDiu)_< z4UdK=!BSK4<>(Qn@;)1mH|6^eQ*rU{vgCV{wKxOb3m<|1G1cxp_$6Eie}xSX3UOP( zU0@s79UcG=gU7-FaImSotKn1d9rz`z-z&uJXTGiLb@Z{O*5?HD5cDwgX!Kd=i_n*% zuR&jrz8!rh`XThA=;zQ2(QlyNMt_3-480cpBf9?ILcW`tTJLS(j;7XYH&ffIovHQe z0{4f9z`pP#Q}F}QLrnROf@hlYy}(r5L{q+3!5iW2a29;RRJ+&UNAL@{7H)u>930}e zg*(Icup8_N4~0jW%69^M&RiBnFQeaspTi&FriX;M-OP7%{Fw6D+tm8)hdva21o}ku zDd=+a2=q8Ok@89Cspx6wndn*Qx#)T5MetQq`7JXw{vVmj?;Fa0gWL8FaeKl8;9;<@ zsr5Srj)v#Li{O>;W_T}r48928gdf50;IHschlc*Pg}cIHxF0+Uo&X2I_;-=Y_Z;-4 za0KcUZ`4D_98s473N}4F^xMsR zSJ#Q?qu?p#Y}=X{h8Lsy$0=zEN&{4b;a3iOTWo6&cp??XS1ehU2}e9e^a zyYMqp`F@YyF&d=+ogj@Dl1TLth8~Wvbsh z;6tYReFps+{J`|MA0@8Pv)4`OolV8JM7KwGMDLG25Pc;281$*=!RV22jH!Okhu6c| za6Wtseqt)0`hCTZ^mjB&=^aev*8=@#^k2|>qxVA}iar8;BKj0`IeG;8Z1j2Pf5K^S zCiSz>bJ6qAi_nYF%h1cwtKc`L)@!|~{k!1kuwI+NZA_InNAC(dm}++j>=biHGO-?ub4B9zprh=u^-o z=n?2M(C5Jkrt<$MydBPh&%#Bf*0eFF-GaE8#lW;JDCV{5yB`+X~$o9t4jv)&H^Rf#@OV(Wdgf3{Ho4P`?&N$A|uQ zg1f*#_U1G}TGW1mVZ}T&~PmX@VRNT|(m*KncGq@K11~)%3^s_yTpF^O2 z_d@Rr4}mAbp|A>`4=;n)!Q0?{@Co<|d=GvG(EP(H|%Upcx8o(m_yt4+n-guV|xVaj(oEI374>%FC^^0ubhb)vin{2M$Ho&X2I z5vJOo2`5p0lPSL$=zHNKZ~^r%qgTMMDgP0@*{SmRRo4xs{B}jRg`Hpz_&0crsk}~x zXHb5=DW8kbmzvt{*Hb>7^1I-J@Co<=d>y`L%5MewEA$WO-(aJGiqm>*4RuD!1aE^6 z!e`+!xC*X^Tb6`=cZTiZ{_sdx3ajB|@OtxSy&rFCd);elJRd+miGBwCGWs?2`{<9* zYv2aTqrt(qiTPU;?O@8kCG23T|6||?cpkjW^nL_yhxfxL;6nHY{1AQ#e}eUf1ivle zPUh$O+yh-~D!(r11JHj%AB{c^U4kw{pMf5O{yX|&^tGn?yU)~kJWBlw=-1IJ(O;o| zMK>%B`E3P@;Gbbf_*YZ?^oA#z>hDbSb*9#H26{ex0sa?$4>u_be%r!s@DSL~)OIQ{ zztHz-&}W(I=Unuq=*!X9qi;grX)4cW(XUYdI{Fh+{%g!Hbv~oK;n2{}W~TDk4!t9~ zHM%XjD?AV$W2)biP32pTu0me~CsQ6j4@Yrxtd+-;a5?-1Zapm2?+V+S%5PuT8y*Ks z;0Sm&ybxXqZ-RHiIp%8polx|Prt*6Q{Vw_g^cU!_(LbaAhu(5{@M~*+rQcha%Dbm2 z-(Kjx=zi!y=u&hgx*9zmJpnx#Jq0}-Jp(-(K58nD`S2b1y{YZ?KT~;aS{~R0?f_fD zy-dY-M;`?TnDRfD`U#Z(6J7^zfivL)@F`R67sB@_|I$={>(IZ#hNr1q`ECUZO~vhw zZV$V`-tcI6s;T%&^x5zqrt*lNgCs6OFN5n~gVRIYPH<1SFYIUfc!ne3Iq*^#KR-!v zx1jHVkHY8R68Jv+9DWZADnfr-!kyqAuoL_%jGx1#eosK30ndk*!Rz4d<}XonFZwZ4 zwVk^iAkH z(f6PqML&UFh<*wEHu^pEm!|hS%729oM}~g4g3V!T^J{(H0gr_PU>U43mH!3sa(F$w z9o`S0fD7Rp@I&||j7G`#n<(1Ml>c_7#%D)#Yjj(5SM)yUgVBefPl7`!KMj2*`W*Bn z=*!SIni{v;DW3%&hEKtT@J;g@osZBz!FrV;|7~C)+#SZxq%4N^$hxD^lRw%(I26|LVt_?6#~Js3R{U4=dqeIdL8UTZ4f#-+kq91ADF$#5E+3FpB1a4}p4SHd-L(=ow+E7%Yw%t81^gLqdUnWr4|oXd z2M56lc(%D#?~|afG_}6hpl?Cnj=mrL5c+BKbLdymZ=gR!e}eu7{$Q%#-(d4|q%}Uf zn(DtT>`wUs=zgZ!je!58{3i5F^yBD-=y%YcqJKa)JvaEZhuz>2@Dw-#UIhPPYCpUS zK5eek_ukQOnp%%{(4WC|a06^KF8FK>cQe1&c?=!`PlSWv8SwA$GC0{(Uf09B;REn- zxDdVy--DmQ@8GZSPv-^S?O;pT9v%YY=RN+Q&$ZD*&0qCAYV?`#JX3L(!0X{%ruKse z&0qC?7hFX7Yv@nlccy&mpC8x^?hd=azrhlC8XOJB!HeNF@OC&0K4@xupN9X1Yv3=i z(FGx{8Qc}Nga4B2{m%|lsC0qm7!S!$h)SsS;`-`8~ zss5Uvo5A?`ohmOx>rta|d^^|yc82~_PR_dr>QGy9GqzWSHI_n zli?IN-CU*jN8wC33(ke};C#3ME`p2UGPoSBfGgoDxEij3>tIwrGGnQ#`I4d=l5Z~CWh$uovtN`@sID?xzO8L9i57!fH4cj)N0T-FHla zli?IN9nOF=;Vd}U)OG4SI3F&6OW;zt3@(SO%pdhV1GomRgX`f2*l1J5>!PDEjGs#@ z-3(m>TfsK49qa%*!|t#L>SAy)Tw>m<-v`5G=6(8J1zcg? zuip#9RpxAMAGpSRK>I&jZ$7B`1xAgeAJY5{8<}&oy`cZ@v!Bb>3^q4)y;}&2OkLNu zf^E#XIzC_rQ`du?VR!R!T_3`prmh2f!QSRPz3&VAnosI_5%xEq()NUd%%}CdKRDc+ zuj@xxX+ERv3&)zz>iM#8y!o8Y2XLafK-(KmHvgmV3&N@9^SYjg)6Iq2{&1$bNZTLI zHeb;8hjYyrwf*6I^CfM6xX4_r?GKljFKhe5Wu~r+m%|n2tJ?l>mAORQAFeT9)Aon! z&DXX4VfiWA77MZ$UZUx(z%e4Jr{9I&R=XSOh zyPNN7`@^25u6KLE-lnc^`@p{D``Z4nzxjc-KOAI!sO=Ajn=7>aVWp|-;c7V6{8-x` zjyFHi_JJrviVm0rRNEg;H$T(%hcnGp+Wv61`MI_~oNMa*J`c_}bv|DJ z7n!TI{oxW*=i{YtnW^*Ha=60O`D!IxW$Jvi8m=+F)%J($O`U%>z-TjRolhFTMy75S z8^b21-Un(1o0~d+6v84?=Yv+Tjj8#)9qeFg{_PCAo0@OqzauO5wATFE3pV$CX@UM8 zvUw->_tNdGXKMeUzK402_6u}>^X~9>s@=ZYTJ!2;>Zh2RSEr+An3`8L)x`bHH#M&= zLu(g|=hY49$oF%aS6i9#Z)0j+?Sqc*Yc;P{pyT^i&8t(;@qOu>D2nel)jq!8)Vvzs zPfEx4lbTl>`MyTFv8j2r9Xh@boU6YRjP7S@UXAbH6d&KeXzP{JI8ehN5FTQ@)yc%DpOUKvgnpf8mA76)SUM<{2KB_M= zHLrF@_b@fD4nmijnpel7$C;W>s_p#t_@pYc`3b)t18ehjrN1IBo(0G{AMdnBP9u>Ne`LT{abhY`3o-2c%X0B9!==gf) zzg)+-KbL>Xb&GU--SV0GCqDA|O7m(PQ}yl4&$a&Oe&!dP_f=nMt$B3{_3?RI^XhE$ z98>dZd_Gltd_L8@8lM-XBhQbTSBp&PR;K3F-snE2=GAKSSX1-rRCIiP(7YPY?`j{< z@9XsZZ|dXuT=Qx?U#mWzuQjj6^R9F}?6)0>K#uUKAcE&1&tzODVVNYwE=)O<(Zm)=!;H;NuG-_zec zXesLWeBOLNiheS6JjTzR)N%OAZqhpbj%X!*r1rauAM1NEtwkMY&Gry=eErMRaW$Zg zsN?BE^RpvJOWE7f-rbvzVy7QfN+Ma?z( zT|*a9`+Zec@w+IBpDVLg-&@^VdY#tO{9eB|GJnwdVIT2F`R*&OkD|ZrC;p`K_Wt6} z`ksLKOQa9d2A7pqSBxH5S~hy%>1AgR99>pDu(G78y!z~@eN|aS`vZddmxT}gGxz@b&6 zMhqOG!YXphW%PTI$qJ6BEFXB5)~jsb;PR0rvPf4{m6ep{%F9L!sjPeLhnI{VKJZMf z{?Kd|8`b0)yAdTr@;A;_Z(!snr>8+r?q#A)Ycv~ zrn+)Wb)Gc-AnuQy%SZm7jBCQYFP3UIEUVInEvc*&%f?oYs!C;-r`K#qZX8n;d7R5f z=ED(hO2je~NlQmZP@;4<`;V+L2056PR}??*VtjU(zxw2sJJ zwsq9!*_S+xm5eMMSTSnI=}vp#=!#L*1J5e29zL*glvX8ssQz($p1~PXUO8O5wkPKD zGwYm`^F-xVC{JCUl_4s(t&+~NHnjpu%Lb1bHn3#y;Hom^=FmDb)LEvuk4?#79rbl~%!;Lgva6J;$}=#TnJpEZ^T`{MC*SxKkuu2BTQ(%u zN2(%^v(F#DZ=8w9`PP)@v1RPaMh>YuyYdf*xK>!MgN#Rd%WCWDx?@yHS>?c_ZJs1b ze0EOi>pH484$394aaEpiFByIIh!JJgRhocmbyefCaX@-iDo-CWx;WP~&ss1HrDgx8 zp{x~_%OT^D?msn@N!vV0#6ywP|L#!M3d$w$e`{YeQgyg&9FSg>FqBDCuZ1VhvJsWl z@kLBL%f_?8n31(+-ncC999!qya8`L`xWe?zotcvI)aBW4YEILd*Q!T_Rd4O-nH zdHj;gxq%~es;(+8si@QT4sqb&C>|Bs*52Idnxrd_SZtRRlnp5zUb|#Sb(Jn>2M?pPY=qAExy!UTd`L;f5M2ih zsZxcHig*Xrw#r?4jE;-lkM^7Lb87bN(RFT}cn~XwjnbXb@DaX<98q3PbZ!gfkEyjL zKI(MaSTf@Gd)oL$V({73W%>I1-N--QH^N=Q|G_*R=rOG-^MzKt#??9*3?7q9FHfgl z>wKZPk*g~pkJp*nVx>MZM^*Z^TE~4!CV`ym?}yqu+caFJRh5h!mJD_#gJffR2-tsz zj2bz#eAt+(GM&`IaWZ<;n5rR(L7dJ1U$c;fZbtL&jft10Bxg}pRW+(A-%(j}r|fIu zF_n4E?2tb&H;NloyG`bnsrIGIAM{suaIVk1A$9l5De(W+Z=T?6zj;D3`+;*I$<*Lx zeNt6<+WUw|9lojHoKN16JmcVPG`f6P{3g>MZ0T%RuCI(oo?hZB>r|R~)+rm3bI(@f zX&Wa{v!~{oX3E3SQ9g3$s5;ayV@tqx&rDL$Dw-fESQ{${QGO$H8ODE2_)0qgZD|9=CWe{2i}4>hn0! z>xi<^qf3VQdhK^o%Nvx(GwwZaaBi2$8llJR3arCBbt(uKTfbxf2eEm2i1*hz z9P`xWaqu*(dlTvpeb=MNb!x;Ho-Uk6Jk)>CN#3|zH`&@e9mVtNA9S)&Os<1; zO&)Vb+EKYp=`hcE>AJekbQ{IwI!@Olv!ggeM{KnT)15YmUgWA1_Y1Mh4| z&N^F>*%94aZY!2lF*>={wW^XKA5j`#U{#-8nRm29n~G5*>mKTCNT$Di-Vm%+lDo35RqE+DE^yzuxz4j{ z?i1i4Wl{S2dDxhes?vD%%14J5@oZRLnj4E;PovAqN+Z3^sJo`Hh1p3Ylf-j_Ic6j= zd3O8kBp=@e4%hJ#TyvYN?zozfZLda}$aOXl&mIwT@aWO)hgFOktar&gapjWJ;o}=< z4UoPnB8$AcX>Lu13>i4AYLreTqlU)8txDSOy?4~Aw0(EImbC8{|GR7a?=JDbJIDVn z?i3@u7I%zAcr7jt0pYbn484@L-@CgFyT`BH;@7TvEp6W={&(m2-^HC`;n&jk#T{dW z*W%*1#;>Z;pK`L7U-s_ilJ43cr@fHb!_YE{<#bsv3Qx zNQg`J?&^Pbk6*jRuU+-3Y~z1-j{jZUDHeWpwlTtMadBMZS7#fG_+{@daklYmH@%j$ z?;5{$iC;U%uf?5WgxBJZu?Vll#UUWPc8H-Djcw;R+xWFx{Mt2s?GnEh>o2gWC%-D2 zPBFr3amQGM*W%(hj92~jHn;K1-ksv4^{T;%U%SR7UE`_&vGA)$Bu02G zE{<#bs+tb5&=>6fkINnU4q*LM?DBi+MXU9Fzho)kA4fFQ^Uw8fAzt)Vy;@5H)WuCU zj`R1DlO>5eH^fz5NQJ+f+(`dUa!KOOQk=dfnp=8pUoTQoRHkGc|Gzy^^>Uic9y~FV*j+ick7&tna3#`}KF6d*^x$ah8n~m-Z`_ zpZoQCxIFP&uJ698D3@Pjb>_IFZIa(I#U*8`jw(|5sVe99VDQVWUo-jjcLSEh@4k%R zxRjs1cAN7%KltVHs~|tecuD-u$@oo5`E5m<*X!g=e*R9kzM`6262B8Ne$(Vvq$rQy z)}rI=*FKY9UlqFCFY{;GEyf`VOwT$cyd-f?D=xj=7N`2v*NJoe&eOls{kBu1p0QJSN&MzYru~+u{F!~2;S0p;leoLhF zUvB*7C=Ztx>3=VYpP%WF_A5>0rzs`pcbpCah34{`C%+XgU`hOrR$SVzT7J_Nm-1_;SjX9K ztqwl<!28qpPA(M zf#PcAr|sx|9OEVNdpF}ZBb8rA;@s}}%=pcb-%J~^B!16k#&3@NiWKAgd<~G~cTMoi zjo$#Bq}@+)osjrlnekhi%CBq6Z?nw)S1P~ds!x{0uVH3?S(zHY?g~!wTcLlX$FHYO z2+q$jUJ}3M`bT>EHrui0_|VS`a(-83wr_9wEmH@{lKA~oacRF+^6Rf4k6#bban568 z@XL)~kxoJ`cZ`?B@3f5HxKw`nnM2O+tY)?Mzc%t~mnXl`ic9A=Nq*j^oL|qBU!UNY z%delb^K*=sB){Gnzj>+r4kXU)?g{f%ZvGpfc7yWdcV}k4S}eceYVZ7drToqee!2YS z>BQ@P9OEU)uPWo$d8eA~doXcs_n7>hPI6tiKz{z+W3nWE4=X4=e!b*3SwYUPx9B+g z`L~(+FPC4x=Aqm%UJ^h5mNV_QG?m|B#M$pwT_-6tm)`*SdAlV`;`cAbrTtdQ&+VOG zA2G@A{NR_%ZxZ=A#!KRNPR4I_D!(I%v%i09mCkR9{3hCnCGqQ|xO9FSUFn*5llK3^r_%$o6*}lgR=lquGVj-PhEBTe$h$Zn`s&iHjs`5jN3^ZQ5_Tj~5J%P;Xt`@OHYbbh^3e*IH^PX@nSek;k( zFJm8-DLeXPNBKuqmlgDNGD6;H%W2n{AS6|?VaBsG0E@r;Frs< z1Nk||OX4>y<2NUj-(ceGe};aum(H)d{1(}WCGi`fxO9FC@mrb7ZzyqY_faOlM)Iq$5liCte#UQI%5S)0ll-2_Do>Wg@B7Sr)l7bF@A32cB>BCang8aIU$V}L-y0df!c=}E zQ-1F>t-XC0;FrzsO~s|RZ@W}}l_|dmgI{j@F2>I>UXuLo%lLIpzkRMJ8PbEKaTN|`1Q&7O-ki=CUI`}ZIjyL*8@L$ zc}e`fQe1lcrlrPjEOGW*6#R1I*9$+#cuD*gWc+5N@;iq(`*q43AARJPtZUkDugv~D zC*?OT<<}&0e9R|5$9PHdYn<_0kn%g9IOjJ$%=fwZZ;|{~+K46b8<&~ym&&iXV!VCF zi;lBj|KOJ!zgfy7?niZA62E>KztySyE+o$F9@P25yIXR7HAj9ErIRJ`yH9cH?Ykl6 zH$lNkem>vIFPC4BqL80syd-`TGJcJBu9;shAG2ycze*RdB!0~^>)Tm=$@zDZ zVw3#7(MDJETz+eI4f#37OXByX;?morB9-42#CiQMkeSm-w(olR&67@+#P3`MrTxaq zuSh{2zsX{f-vDX-m&XvGb;LQp=Zk9Rw?uwDRh}$~-?K%v z{g%tm?LB@|#U#I56_?JhNvn{bW4t7O|0=5Ow=$LAjl|jijj+Gu#;>{j{JfWBN&H^T z>@Vx&*IPl(Z<^>h``sJ-a@%)R>rn0(FNxn>8NVL8)EvJz6KB7N!}iGKw?=*q)Mv6J zeh*}}M<4kWDaiRv7nA%h$!y2((}PO z`MJHvZ?>4^_d@W?jbA_VbBve7?>`y84XOMdB+mXjX2x%T{F1po?YCWKeH$0m9B*?{ zeqT4Mz5lHuKgW1U^7}$@>Gds4`8`6M^E)Xserx2H@Ax=Av%c-*myF-slwa4(__b*l zwy$HnB>8pB_;pU@_c(F(-&HG--o72=*Cx;L(L!IOkWfS?&A=$xpXtxh3%%uDG<{2KjlPa(?qg$Jy_I;Frs9 zoDOoA&)5H662JX2ezSJ1*|+5 zjGtq?B>8Q~tZ#09S&pB*yd-|_Wc*sm&+VPxV&bf42fti?EAexT zm&9*Y#;;u}zgLK}U(1HI$8WX#@?D?qthn^}^^jjrwRe6?Qhq<`eSQ_?@*B`OjGtq? zB>AmXT-tA3D!bAIQC^HFa6O651!Ml6ZnIhpg(B>6R0jPqM6I?jH_2fti?%gN6% zUJ}1!GJZ2s`MpJ){l3qP-%9y)w-HO?_ibkU=E%?Oo!>Gs$bBve7?}3cp@|52P z#5upSb-%0i&E+@0j{L?bF1^33PWi1!`5hbla@)6G*D!vL@si|sRK{;Z%I{<1oZk+* zPfq7IKz`F~#FF@JtGIN2jd!cr|5hs2arRpq?gw-EttUUncuD-e$=naNl3x?mdw=oJH|_r-(DHN390H?O;?^ea7^P3{S4vO*mt`;3q_$^4~_cd|$ zdrvRv{3grK&*My%#P4mzrSn^w%5RN=ll&eDe!2Ym>=*KLjF-gk!Hi#nRyEuAJK_`) zwGQX=-0{&*e);linK_>~lV37^>r#FN!7rCzlfQ=i9OEU)@7K)u^-AUU198r8KfTYI z9>3=D%Xfdix8l;{*H3=E)!y58eaf#%@XO`bs%Oa0F$k6Ty5Cu;et%V+{oHR`{h#i)Z%=)$tFmNC z`YlpHy5Dg5`3QhpPHRV}}A#ijF`CqHj@=eJqP zuV?VfDBo_$^4~=i|w7_8+bt!A+C#tCU}Fyi}a?D^*-Nzoqi)se0$P zWy-Hx@XO^l_o&d1W4t8!b;|fP+oNXtHc9!d3j0egzxncO6|8Fct<3B%t>l-CU(=M| z!@)0?-%9dxjF%+82Qq%`Qu+Dw&Sd=l-n{nst(Kpk@0%>iKhINKdi;9GZ?b|se%qz| z4iA1c`Dr5YdN{^Q;&({KZ*eNW<|)4$!v35azt!?v8mwyhU7OjTm&>oaBAlN;drj7N zc<{^RH~+YhpJTiv`ITn;n&~FFiR$fFnDTq2aqaP2B){%>rTt!1TzdRk$*(tl{tP+E z?}p%)%P%@1_aWwtvXaG3opc z&-g7!<<~0Z*D~xcx$Qe%e)+zyva{mSfG|T6=0U_T z4>E*FQL!P0FjR&Zf9#!Jmgh@gZdTv z> zC-0NYmi>E3^dk?QEAJ!l`Qo*+o-2Uae zHmPH?rSKiqP@^1C%caBfq z77Tc1b;o@kKGS$ijJD)!f1jhyC4)GZ z?@W82%Z*l-fY0w->etW@!>GzlBi~q;0J?l>v3Qut2f?@3S6_D=gu&pgC5u`?#vAZ*-Q{H>#}qrp|@+O_ACIZ|YLeYG3nVXLoZ@ z)i-{2>eL^JDOvT6;aGiRsMyA-4XQ~ouPSZI+ECIo1AjH%nYX`r=hB9z0`+S1N7?(E zL$TThN6l}XsMM~L_wH|wW$kZ%>juVO*YNsn` zs;RWHq$!LvEDLGsG1asUGE1K-X^J8avbto&b~lHh&&xgbH|MF{%@MWrcqF*{tqkZE z*|WPjdU$s;^~SI}!MqXmrKTQ`6$L_Omn`UvS9ZEEUsPm8Q8!h;yIG~}ew%qQobcGw zll``XHi|-iC-RfG0p*~qEGdh5-1fjS(B%_ne>3Q&f~;4e>(vb^tF{?kabi34i7D2- zv=L>b;Tcm?Y5S5U%-BYZtu%b}=FzyVWpuQCpiWRYS<+wXc$ePghA_wm4C^lRyXH(}iYZMnNSRn<4% zSMuA&!&xsh22od2x2*ccZK|OO7BZT?Og+*6pWXTMCWXFFQ5Vqcg{e!4smle8y`(NK zeG%${A=p$JDuIk0&4<-*8!yjS$G1afYWln;{B`USszU#j?l>Mo`KHboFAS%YqPGjd?#9aJedxdEB|R7 zOxs{Q^+sN|POJ|expiS*y7k9`kXsTe!4SV78-H)QoZqkcP1Ze2&2Q>}`GNE%q@!&v zXmr4XOU5qeN1ESk2fc$?0e5_KVOwjYo!u$bv|V;&9_ES~KwhTd4H%Sxx~lr7pn3*l zt{&}!evR#K4q*O7kHyEwJ2E~F-xDz7gKI;y?q6RUKEWJUm8$8TOM&b=t`U_bO*jX4 z;o7jhv;kwLl>N2qBg|oyHLYPM;;0{%-Cb|phP9%2fAh&kjO)X@8eVy9e{)zZkok^r zHXq|?QAtw>aWRgwMywIYU)o&Kl!3UZD2MBcD&F1vI?z9lPlApjo^#oqyZC#3g83tA zNfX8t)`=xe7|&*%=n8z@+25R%HSIWMI+5KlrHA#V9x|{7u>W!HKjAMg650JW$~f*! zzQ*vfEb^JLBJF|GkZB9F5BhvsgHk)~`T#w+K7`ReIK8%5A24oOtPfmg+%-X|MbKY$ z!PxMv4U3vMR@mk(%fb4dZPyIUuNG^DU*1QjPIY}IU9%8JRAq6kH_kc0n3Xu7)iRV-g9E{>fE_r%``0)xV_vij$YGpc zI471?SJEbOn~5KtF7f2)65lypBJHEKStgCBwVBv(y2Mvbm-uq4#OqPYi#X7C9|2;f zspj+E$SfOln-vUJAy^=SbHltk!pI_I1sGiHruexA8LoK*%jI2s`nh6;%Zwq*g}YeR z`MK=STtKi~=O=Qpm?hA@<)~rIN>e9$!38E)>~MsCiX)(|3=(aF%zGKZamc}FBL8_N znJ=Tkw#VcyK0stP+*Uh4Y%t;C1H_;aRdRrsXTrq?h@VP4Sd4SE;*7Jy+-UL&$RwpR zOP)#ke`tF1J*WS|>AeKHCv+5Is!WX*-3s^=2mUP|K;@-3iVu_^yv#IP@d4gv+Kj_d zi#XY@$I)^LV9e{5Ap+g0KX@V4IJdQnK?RXyRs)x>&80y&Khi$V#vPrE@g&aCOdte;I z4*0q{=AGJ{Y^QfdZb)Zjb?lmv?JUBXKM-_g7$> zWa4nW81A5EEjXXVx)_DT|MdPqfuCXAsQZ4TO;kE$N=>6gyG9!0fXKLGDqC$N;yHNw;T$X2GoX18Cibu@I zW!Datt_`s%u|brnuOW&O^)dyqW{|(hRSdmwrvqvwSOA-Imwmj{;uQUZ}{0ilsj>H&k(kgn2Z!4IDY zZz&e_(9rZfPN+xpPB5H;)KD)Ky$|7^AU#wNjQ$4UT84*2+U;;cy`wK7g2jjWs_3f- z|D1{aRkSy5HQbG%78<0YTM*_`fKU<23qKBy=fJ6}gO30rPWVN{@YY0lK?b2DJU7aJ zsc$1XjMH4^pAq;3ryys&lSM3X#yi>Xfa7Y+0B3@uvI`N*rg0`a!E9FU92D)$a3a~a zA>~{WbDe1R{UB&6*(r6hvX6rJ7Kw#UUUoBxOG%vP6lDL|O}WtNmp#c%`I0j_n`*U( zHcq)SPNi)}@j2JQ%lrns%faZ3ak7XpC(p_L1k5-oDyK6v%tdS-iF{~Cb=hc6PiQy> zM0ck2hK4N7qzr_H=YTM^8UhXHxhcb)PT5O9V1ZT6C?{Wq`=D9>fx?_e!yO>C6B3F9@ET;>&4`Ay3z3%Bel`5|Y!KtAG>xDJ9WaZg}d^u5%Hd!1!q;PFKDIW{Bz2ovs&xU;X=uVFDx3zve+Oggv<$-Z)U%_w zPo?G}Iu-Jo-SEV$=$i;%$oNUI=pPYY!SLka(LW)~a#E*E_LUR#g+nS{W|j(n4HX;6 z_8FUxzP4LyU9=Q;B||@a8%enRjr~YS9=ZTr-G+eVXYHZ8_F{N;yBK7HAz5g*>p=D* zc{f*@ZVtS2agGn&W0?6bh?g6odkpi_AjgnAY*K#!vZoTZyoNZxBwt3ak0(xff` z`3qbvgzn>>gx&b!z+YJIeI^yNQ@w0bIe^ay+z>OXVv`+HWX9NMVr`vvrKnhfC$qVvw5oMRtwVf?i|y*cYrj#JJ&S& z^B_%kma;qhRExXsxWeRME53)ckA#;k{&&#I zG{8LJVr(`F9xctnTxWphos=XJOO)wQQ;YG4E%m@?dH&+=6N&Y;p#9d0yfwdMtg4LwYT zw4cDw;kh#Hb_gCY68zz%R&Kv(B-WWyO(T*c-iT_z1xOEUvgP)xCh;}HY}$w|qXt}$ z*pzasOuzjk)*BYn8VT|S9Y%Vnqr(yD4CW;c2oAu(W~J!la7+(2>q2K6e}Wmh*zjK& z?&^FSJcXwi?q=du8ecZd;VPZR{6)}8#aO~cJ2*$7W~Cfx`MD#jStiQoiFjJdCr`c?k4$&Z{8(N95;a z?1(GijqHI`UdF0nTygO)S%tPaq2c2Y{Y6*XJ8|0MojP|d<>_&p%=#L$?p|J{dhw*b z%!{>a>q^jOZ9N)KFl(!CE$zj%m3MpHwY6Uc`ab+|d}x1xIq6Mx)xR%t2TH%lf?zV4 ziQI1*GNrs6AN{8kF;0B9mtC{Hv3*kaWK5n$2fuPr$DqL zF&3A{jUYOaI1`u0VF)NDF%FlgR837eHr%9V#9}H8}*9i zql$|whmIOmJh}o~lP@2+yaIuXhgX!Bk0>8mTwXb}qQ9Clw&?P8)t3~lEU#X(ZtbRZ z>&>?EMQju_ci5(Q40 zIH@gxZ6r}(8%ajs)QNyLWwx1W#I~7gBrlxbrr6|3MrQIP3Y<1+c3T45NTR?bNs}hb zo-%9Jj0tUZQ9M0)KY8htpQMYubkhv2dn}#~`APc5OE(R2y8IjwNjt$4F@!~&p2d`M zdX_f&vt=o*d(KNYMVuzRjqdgGvlgf8NXk!=J{i+6N&hf9NwXX7$y3_OF$GC&=NfjJ zY{Qb}n>cIkc~fUBn4T=3mzJcwc-qv7xJjL`K*dvAxAuhjlZJE1C+2Y%t4VFouQrlQ zx33Il)1`B8o+iBw`4i^1J$G#yWp*tl(^8L@4oQD&04>=3zE$a=1P(@Y5D~GUaJs6e@qtd8KWOOPXZm#gk^w#TwV*8pp)=r;Ca3k98a2>j)F!Z)3~h8*L`SKU7S_ zf`#*^Oo*T1Z7yHmn+Sg|SPs(%Y-q3UCf?UfLYFH41>M}zDf1^RoH2J!%lb~9GHL$# zr3*b-Q|7d!ZP&86veP6bN|CF_8IxNU=8H~p4GC_H6Hk*kGtN^%~jDf zn~=QDFDt(oY;nV(>tKb;+BvRR2h-`0tZK?v&|>b2nw4?k75GzNbQld;6*U{xvJGq2 zY*G~!Yn0f-W26L)O=x2h&i!W~38KrIb<5&*%_NC&5KWC?_K*g9*V3??DRk=DrarydIf*1!u2_+jVTk%-0*5HJhNY7RzttKLh#uZ)jksH?H?-{Jf zuZK}aW4o)YY{LBc6V5MNFyn$LWed+Qol;hYc8W7m_f?lADgf*Bv?Au$tYQreBAQsW z0_`|`mV&Xn6*1#^y~^3fz8^UpS*K4|lunI_rmFbkSgkfG*n#wlgfvew8W2AiIYMWd z;LzeSc9k`dh~|c=vdZ!`quKH{Sa$KIn#%QM8&F|SVmzxTOo3dJjjU?5UX@o=s7p6g zZm6_=3zN%nX31TSamWhTzBlbc((5x%=Q0@nOUc4sVaV^}9E zp)D5Eh}D~_YFcHkSx4(@WtG*{>#E}tQCbVTckzaA8Be(_8CO-UtgKG31Lv;G@Y6zP4M)V4mHcCsfe-c>J{Me zxh0p^)Kss!7}k{6D=vWw%g=g~S=J)1zN=R)udG>x^@zC{??xaEb_w0sRm*(yd;Mh< zVz&^H*2>QE?%XaA_OPlUf&o#_MH%MQUe(()5&tO13AGwr#)UL>V&rpx&+Q}dOG|rA2&43 zi-tkGA?0k&z`J*Nu7ksMywf;2qu{H~b%9-aXK+X8+VJ+2ZIP|1lQYaaj|DCxkar{7 z;4Svc9c?xGx-3Z=z&;VfOcob_Cw=WW>L4BXZT+iq#vIRW6Ywp{;wG>sI3K z=K5uq6s^T&%4L;B!wQEMjwl>iw0_h2>UHaCiZ-mTE)r2ixB)pB24XjC9L!ux%uN0- z&=6CrE$v$09BuQCD?SP|L$PorTP}WjurzF#^6F?kD0GL|Xmw+7tJ+L&o{rYJw`=jR z1}6iX8>^yU?9gIMxhGzsxI$PFTqqDp5jMhFo<y0m8XMM+I(4DKa9t>Mrhe?Ix==3Iz|mn# zSU-FfIZ1}~gUtH0Q-?qu@JOg#cw1;h_=8Zpnfd{wg>^F$Q$Gle+kvE+`ueLPHDUcS zB#jEs1QT9pJa|>0z@fmMfx58%%awJZGsAjUpe|Gdj{KSWW5jd{>(MhqAqbdWr$^UW zKQu7B-3XmLGc*)>D+mO~ku5WkRX--=qadBI-V-azeRjIyErJ z3H6vBnm9X@J0q;`*m8sly{b^d?{2AsSls||p>Un9-%^Kg3k>xL>(^CXD0^=Bi2erH z2Zr@KwsbV))=)N-x^YY75czhY=GogqL$^^?q-+iA_t4%*`HMOd%Dxs7wn75*Kh;tK z8tT+lkO8$0IH*eFRUaTwht@|Z)Ge%UchGvTpviqKb!0)}wM_XS)D=uK5vpT@+({`f zT~(LRAa@7cA@Zv$>-4<=86wYJiIRRCV6&VP8utOy%hiRta#($~`E!O1Gd%}ML-nIqvUpRU z#}MI3(VuKKV`rB}p&xHP;u}`X{BNwrUpF5KU~T6Dn&9{_&UHccr&C*fG~RVm6)or# zb$$yvU9AMo&!Vi;>Pw*W%sggHidqPo-z8XwXPpw}c_M&xztd(Rh{xzw>3lCB?zF-q zL!Z<5*wOE_`FtcEqZPh#^f`^sBmGXp_{kby{divN?&)sNlYG0$fTSU*1 zcK4-;AzzM4H%~Lkz-xva^ykkK^6yHZhl4jC7Y5Ub5xciyKDwzN`0`O0->1p%Vc%ZL z?~9L_NaIt4Cy98i>=>~p@)7Y+m1A*f9yNf&Q&&2^7Ca7^-`(zwosahbj*-TT=O>AH z6OB*!^YLN!aLVb0Z}W%+Qa;M%(^typ*lr~s?~^3f;}gnjZ{H8f$1qz;c`^Hr0PDfm ztymAEKk5+_`B7p|9LdVT@Wl0>mkTYXuJo4#agI(-#SD z5xi6IH-i5V?2Feu$Ujez`;n0Tp5Xg}eE*U0y#-4Ik*or^;N?3a0W2pRGDNNv0W2q6 zAxQTm;?0jDp-uZE{!F1K2u>56Ex17Ne8DooO2JD6FBQC8@JhjJ1a}I4P4FhcZwcNe z_px~o|PYFIJ_=4a|g0BiT3BE1(zTlq)|1QXL3)?A0u$^G8Am5v0dUwIz zf&&GI2#yjwOK_4P_pxDq?g2wwB*;BONS6z)5L_dOZAeTy*In|_z6f!f;B|s#J|O-Z zLhl#+uHc=5_XyH{ALTqG_?RHyJZ1bZ1b-v=JHgikn+5+U_$R@?2>wG*b6!DSsvy@P z(mXE_dkbPa7()*c93^;`AU{MQ{|v#of{O$%6f759A$XbKX2Ckaor3!Wzb$x|;Ex0! z6ns?hDZ%FiUl4pr@Kr&cH>vM?f`1hZavec@reIgWK7xYYzRLs;3jRp&h~N`~d~1;W zzZZN{kRKE=-r>3o%nb{8BdI7)Dm;6}kMM4UHw3cZ(zlgmD#zbo|jg}zVd2ZVl1=%<7} zCiII!za}(4nWCQW3H^c4{}38)p_%k35#?tI&CjbycNcnq(1k*e5&A5lrwctxXzuUL zaw{c%mC$&f+{oQ1^fiLJh-ih3 z=xU)a6Z&eQw+X#R=)FQ85d49}-!1fmLO&uj?SQkK=Y@Vr=-&&?56Gxj7zeR~;84Md zf{O)dKZAT*1$PlqpO*x)ajim{AAu3SEO@!#R>2zu9~baeT0bPXF_wIRnpv-mF4}1(0>s6gwXE^{WqaM6FLpoV$6>_ zekOkxq0bO{fYAIXit@(_&99b7bH7IBpCj}ILVroL_F=7Gv9c@IfBasYXq+p+%3ot zf0*wFMCif&jfvfG5LXHED+AJB5xiD#uizbmKN37D_zS`R5PVaR`*~7c7=QYRIfC5; z`wMa(QKp|II8|_g;8H>JPCodq68dX`xSTZg!|BN&mIs4qGJ|}DoAt+ECWA4-0>OTQ zg9JwtF*o`Dk61#)9GfgSod|ie1dV*?V&sG0@PRgb$hVq&psR%cV_v6$FT(RY(#`oD z^1Mes@q4cB!!Gx6l<)bM8|8b@R=BM4;tebCdMuH6Xwq@#Pf$` z8%d+#=spBHjfNge#kw_XD)Bfv ziK?w0Cbo#6YBr*B4IaiR({AzSNwzI*8&~5cX*`IN7ROy_ue26VU6a+#Yjyj)FJ7Z$ z3AQxzqC#029$Ddyf{K-wlr1k`wOSRfT~||CIBm|N!6w1ez}GcxJv3%b+e%~4nY-=Y z17)M4)dWv1D*f%SoX_f#mE7XdF-5kBVEHD(U#S%v%Bz?8h2w#4lIID9XziNvi&f$J zO>2l=Hz#{OU9hZhgeoY7`xHmtpT)!Joc6;)MbRn^60D8@|u z!jAVY@bg^$Y+T3rA~4mBn+u;|TrwKRdp~~1wTo^$jzm7*7jvD_CCkXe<+r(q#C(5)Fu#7qkmr6) zfMml*(L08fFcIEM21z0`(s?dSdk34j)yuTpq*KZl*x$TG3xhIdGi%>t; zZG^n#Ze0)!zs{{H^G+&LG=d|_Df%VU3s~PbHn621m$j~g5umX zeyHOw_sJ4$=Y-0#T;At$+vR)6;O3!-i9KxlF-+&C-G+c)-a?!-YmrWQyyfc3`w{q< zrx*v_H+#TF5$>J3j%hrm!6UkSBXLvB+dfNpOnO3nuLqysk%x}=aM09Mmco}c;2Y}_ zK$nmADBLiUp8?-qAD=r8?o4RE7g1m8%KGxYpj+Sl3G!%@>0C}Uac)_(rQmPBAl4UN zZ%`huH(Yr|s03I&cRy}2?vXOwe#=5?(U9VyF`p}L6}B<%-mSxmM~@n5cs_sc)@AEV z@!sC8XR^hn4}N>glj?XVxTNW`)T7#YvbJfYdQ<^O7UT#IYDauf7;qd;-BwJ(_cDpl#uX4CiUCj=$+3Es(aL340)ex4tR6y53PS)l^$F zttk)-HROcmH#t>GlP6U5^JeD3BP$G-`AryiY1ujTji-uK)6s$w^xGn|fqItus2;)G zl7bSPCKhG4r*1`=O`y3q=Lu{!;_<58qK8`JXL+hnMRvPzwRXs4@)MB$gb2JNM zOUgq1@N@)yk@a)a-zp1zC;Pj`xWDVQcK=^K-=aHwcZxSw*oUVZD;!h7;$zJL?4!C} zHRNI(b&9B3v+uA<7=PSTI1l40k9!L5sc#%zkAAPMZ`4&7TP1c+VLN_rYGyw|l_qug zmgd^bX=w9wv~g(@`)`oC1$!j_t~t20wjnJ27=*o9xgRUm{VtGuJU?saaqPm<9D=T4 ziJ69Ce zAG;RJZ~D`zQ)xRhRlfCNFZz$`TN?7`$v(~4F~1S# ztuA|z$K4y)w1brOI@0#-*?l}~>F(p48@E?sTn27=E43K?2^~3~Rh1o!O7gsfJma8W zWa;+f(R!9y+QjoAb>@Oz7A20Q#1^46`lX!dOUC)6D+Vpc_$N+%DeP zKz&4qrq__?AR3wO@ZDX_UfQeCw-2*#593^172jvSMcLd6 z+a>SY>#Q!6!(lP^y^R1 zN6}ckUonT%Qhoi}jDAg3yIS;X1LwKhulIDRb+`6pKW|1n#wLNUlW^K4LAa7;d9x8%?M((W4I#AGXniqb7RT0V3NFMVl-M|A3Y_xpLa;qEv3<9s)_)h?z z+F+2qWK=4B1<+uFNHfl@0}G(y*hu%NO@Z$wvUOg>;g|}TWH*U~t^5Dm9bEuT+8$%J z7v~XN#^htnGMeso89#T7#msc#eNE$9w~ZOwuOJcsK_;V>cbHCCEc{+OlP)$~^9iq; z;KFzY4jbeAC0K~G2-QNsgb^~%ZHTR)$cOfI*^=yZALm*a z=W5lcajx^?T&-G?Ty{NJM6iWl7|(E_(GQ+q#XP9kvgsL9U=%m)&4JO9;UHojwhW09 z_j=`?8!xxj>U1l(KElCuhZut}G-s5EEs4-%^O&0@ljVBg{U&^6l=vc!BpvfpNV2(c zo5DJ`qNF%BFhU5caoBlDeV_Cw1dQ`%%R&qaBkVE3#crM?y~*5m=`m*nn_*Er!y+=! z`Af(H?WhF=o8jDehE`2i0Ip>?&?BGX%Fa0F0Ap<4^O%?I>(IWcb^gLQC(#N7ifVgx zvRWnD2Uuvb&x3EAU$U*YSypBt5!N*bHUsV>TIbIYLln+pgk$JYs*-$J>t`5^`HxZ) zTtu*v7a(MuE4didVjL}pEMu19z)6s>5eG*W(YBlEq=O*A@gyK-#@M1IfMqsFxD^NU zfx$R`p_GGD)j?-30<4fBEML6Csh)7&?&rK68LUepv)<2He>%=v{hZXcO_}@rocm74 zx!2FR_jH_l{G5AQao!JQ9>$Sm?y}`=QmdiDq~~#K2Lys>szwOGgD86#En%~1A^`D*JG1DB0lbVA+*`#JkGF9yaWG&Fe^#JSK zf#l<~6HqwWJ#BK@2`HScC!kNJoq)pGdII`5?F1CgJ*`T=9m*WWfnE{4yc5weL~zz{ zA`v;rFi)u$#W6ZDOBC^^oj%OW#yb7~NR?R};sXzQT^m1F=G4hWs7B?Fz~ z)-t;ItYvid<+pXC%?tc#72_4AGTr?4GGGwEGO}Xb(~ZRsrDC3?3X`Kp+z3a{c-?Ky zds&+!1+KA?-qzSiAJ^DO-?*`n&$G=zGaCa$Q)3cipx?~KAlHrv_M}aRvW1Ct^~`P* zd0lIy6nlMX$RRE5Y#1vXY|>$@GXulZ#NfyXscU-Q&bF>2;}JB3LVaCp90-o~de~TZ z83XGsVpL{q++@d@@%D2?jPn}X=y#S|Pxi?8M0+XfYG@cVvn7ahoryXf|)O;B>YecW>F>kuub+TFK=WPwf%;?kgLF1-h7Z<*;1_D{d|#wj!!Op? z!ylp#!XK)igg;E<@eNFVdG5QAhWA$C|&(uGMKThKz zFHC;$E%oub8~n31-#jnTi{MYtm%^W@cf+5g55k|UpMXC_{{j9~{a5(YbRHh9OxJ_p z&(Pd6eWvC+;OA(*@jXj_3;t~V0Q@=n1^6)e@mKV(&*aBDh{XrE@Ex6r#|;4;gRk`v z_(9G0wL^LV{IFgIKSghZAJN=7#Fk~@-)aTp+CS^A?`&EyCF{iT)QF8 zZ}ewO(|I`EIhrOu0-Dx6v|bKBsKR{ZXe%SExexAz9DuoxZiv2>(c{A`in~q+D#F|v z`7y@M3y(+er;NQkNTVJw0)k@fy~>Mzi~Hcgp7)}o*>dV9c)cLl>+cYg%5&br9FPV5 zkUw=3$csq!{s_!z&VuD6`mDr!On(Sz>3C=#>{o`-nf_HwpRG*ozXqvMer3bCq}m-r z>CO)w?gf#t1~D1bH-iQ%R3^W*$vO@%dmSXjU_B$}B-j^1AgyQQP(G#8dPYtk5bPW5 zbrH!K0^-X|f%S}>Gu;$e&&Z)E4Hn_RdPdF+HwD%+au$NPf_Xga8Goj3)_O)35}jk2 z>yVzsPjrGK5fO1RYZxXn|`PphW||&EJ8` z$bJMma!_;%+>k|sFP-0ooKDEr#VOUe&)>zF2bkBznGcvR-{pP^SX z08!sVp~2f9g^W~MAo`5m_PrjcLh1pKg=D^?0o|NG#st}AsZSxr^zZjg|MDfsZ?TsS zK8@7$KO*%ON{kRR>paIOb7i8h0urw zmwYlpNRM5h8$hd`+t?BJI~g$)qcVHL&mM*s=u2QCCWkd*eP|-aj2bf>U?L`mEy#+~ zL`=>TAbw2(CSr142SF1bG!c_?62uuOiY8)m+CwZWO%pLWy+N21n20gM&ZNLZOin+f zWTTG8L`>!b$dJV^lyW(`Ik;gWCVU@S^&W;BGG9VkuZ*|gXHbOkROY(~27d((SjXW| ze-**Nz|0_YDKOI}o}n}1R3`KGX0AR1Kxe7G4%CRGw4)^z=QobY!zQxZyR<83^e(eF znU>2~gkmQpCM-Q{Gh_p!c6hJG}268gK5OV2+EZp*@ue+<>Vi-8je{FH%Q z4EHAx==e)`oCLoEe%>T7bE^RIor{*E4LXd2ko62yBCv&luOe_A0zHa2;=vi^;9wTj z?htiqWD&msH1*hG>QVGI=$pAnY_aLT0B!2F#ni313bd);)uz1S5VShP^6L!$kaM6K zUGP>Xrvt~=VnlS9j=(Yo)*?{Fz+MD4Ge9FaI}jMkP5t*Wa2DFIo`DJk4k6I}ehA!( zW9Wm3c?>ZaCL3_}%`ywX0xSSnBVj_tt{PlHHs#wTArBmeb#V(;cbTzFOI)VgTQE_c zZ!I!Q%t3Idc4wi_oWCU-MRwkPi`NI4993qtJ_E|RXdlNWKk;MtbVx@n?qy&c0*^4T z1_6FyGz`n-zXOMU8xf5N41X8iYSy_MdUOc_Zf)m*)mC9ClgA)=qe(7hf@-&bdbZc` zxo#E-qumI8L=^rwg9}rJ8UIGrLCEG@Gz$fG_zx7%lUa{75F10h>RCs5kIK?I@@7!M zlV-Z)n<4inj<|et^7()#pL}!T`7nOs`H<5l-<)(l;z>tkK8YM*e$PgWA}O0jO;4#B z&2*-wRIAYsAJGBx^TggK8=a9&WE zeZZA95MJ&mc%3n{_5DtE5LghI=;Wkg$yten$Yh)meh-2T5`pD{oOeM`-^dInrgCe* z^B7_xgMA(BUxUkLhC4X98X5UIcqG-y-Uf_D zw3G8?1cp;$2r9X)7=h)2oLZ!?Nh7peU<6emMo)80x!*@P(#JV-1{x*!TUh{2kG^CU z5q0LpObPo_QcTJKp7nweyEL+|5N4aHGdDBGVSkQ$Z4R^8+-Da}v(VgUa@Ym*KD&T^ zhnauue2lu-#q@q7$S#_{a#U{)2|2Hsb?`+@OXs39xDGWL)*_ATS2Gfu91g{z;h@cM zeBG{tG#zLzhMMg<_f^nlV7}q7p^AzzCQaquwESVvrh;!-{#P)?&AR%wP3Qjvv#y@7 z={rE1s{YZgt6u_bs{4*j$KPtZuD)xkJPv0+)8Z!`PKn}2p^jN*-#67Mz6+6$v3h?p z*^6&Noqijq&oZZzb^-p69nVY7ap(h{`hp)i8J+YESqFIe*~vMN7oVM+bK{qu&LUoU zs_~riOA+AZXD~aEYBF*9+oa799Ai>uAjg-)GjKhkd2$W@9VymNpOi}*RL8RA_6W{BU5 zxod`SSId7bXfuTKE&oNJ%@FPu;3ZBGFG=5R~BZe?99WjLC7mm&%UNUt%mUJh|XiuU`gT-Mj2)R{~mhB2k>aJorwYb1E_BX@YfJ91NcP* z%mA)LpydGWkC-nsfH`zIbgoDkz*oosK8)fy!0ojTV$Cq-^-+>x{FUUxIQj*L@gCnW z&g5TrV-&IqUFKBAS76NO9Vni&p%w@3&&M6;2oB!Z<|Mfl2Zyoe5ca3<1I-)YerN6! zAR;D_pGvw*bLFAql`!2i7Std?o*C%;<^H#9&iOBF2bsijj_m08zqWI%orH-=&FXM} zeE(kevIo1neSdPhDkhb-7m}N8fawAww#`&yE5Wy0zQ52mOggwS+sM_1K?fR9fI$C7 z{JyfNWRfIzKl%T)ontHrwcV918Y+n$j(B?VPW94F5v_aHOXqkwZAT^VV=sRj9c`@P zv^HPG=p<9ZaR0CE9KWqFZyoU2ut=C+Nz9&j-C~x3)>-4}95$y(H^ZiNx;43iA>%jd z;i_fq>OgK=X_VPkn$b7OGV01qGHBu^UfRkBJ=<7DJ+aBxQ6`%fXgj&Bb=H&Idd|fa zZX>OYxo8_b`8@PwCYi%F9~+^qj!ZrXJekSzaoLARzl9dJ|K*I(MiSezjU)>6n`ZF| zWUeGhp3RW|wVg9HZp6r#s`0n6wQ=JcZ6?A$R7}KwzwMlaZu_{ZaK&)E@V~xg3Z?Pd!Lcz=g z8$f2$ep}*(Di{x{EUT=z*qBdRwYF-5HS9x!N``WcQmorh!!!$Sq*&FUeU)k&%4nHt zY+zWkJ(tGDUn059GT8weEg!Py;Rm{C!RbvM;iT1`Ttk6`!5EqOk`I|@Pe9O6No6+TyiLp)) zRAYV!IV1K} zyxXu-?+9KS+8*APvNbX}qr^UpAP-#(hhK)jT*`CH^~>fx$2RQSjHW!-@t)-5j80#L z#rA9U_TaYA*6`$vVtdQk<>CFxWM%OFWm5fdcebCK8OZyaZRi3{+_;b6zO{N4LD<;& zUt2r>taWqM!q(1z!nTf`*f543#0wC~?B#gp$PG2CR>NKndP+>_&=z_P?QB)AS_6Al zml<0=cmR~t!cNe&u+s;YY|`e0XTq3CPndm~Z|ukv!}LjMoi48P`A57k%*yC@X=&!` zusV|w)^90T8`)9$qmYINcLbpO#tI_{ZGk1pdr?4Pnl>UH9 zw`PQO8Q7f(!!nJr%<@gxylFQ(ls7%pZWcCZh4~$?xjuqHqIPKyL7Eum@lp;VWkA~B z!unS%OyBFkuuXAzYA7@(ls7AsJ1f*prF)i!ulzYeXIqe zOx+Hxc|VNbpp~A0F`UfE_)zMMQ07C-_mH(@^eb92x|ijI^@~*e5R4fiKxDoq77q6P zAbX&LP)vScP+q9p^ick+u)Z0lcuqJ+fRRH8z)%iC;}EJtpiU6hYPuju6GgMpYA6`3 z^d4>S-00fi@#=o6%~sg~>pVTuQ0*}Dmxe~y(z+02&ah^D;vxc0ny$Sv0Lx10daGvj zkA!-McZRy06B;oi)E9Q1K7v6TRPO5=XM{RL&J1OjhB|Hw<)0JEn?b)PM!=jNJPqOkeCx$A8I!@l)EF;VOpruoKWVpP}VGrnCh9KPC64=^rh%T zodcs#+f2LVfvgLi5k}8_6^4J%4R>qW8~XL;x1szPjPB7&(5(bKt ze%iL&QL%-3?vvEf^NsymWSDbzoE&XyDZ-`h^^B<1q){Pvt)SyVKn`7dL}FO zV-(zSTD*jU)6-^y=SXM(8k&Z$zGH0>HR_oOUHvYY3ye{(J)7(FN&SHavUNV@bkMZ{ zSdB{8l`OH&FAZHEgp%)GVTQq9QJEh41~cI6jLoglXdm{N9bfu=PK>R#6172^nTlK% z!n^UXR@DhCq3JeY#_$m zOwQ<18f9YBZVRIUOrt%c>-??B(dxFQ874p8JTsv+4+Px?`ok4<`a9H}V~1v=^!IJ+ z{0OyZ)jU6E^ZW$OgI9Nc7_^$8QJRp^HpC9LaAe|(0i|DS4~_Y~^*I2s6M#U4Wg^+yBQ*7+uy`k!qc-$jfBe~ELX z>u9g)5Z*bAJFRxLpi|TxE$HrQYYV!UTHAu|i?{CM((neeTGfKiR9|XA=c@Bt&>hv> z7Ias&2{f<2tm~yJK*yhB_f<8ZKk?Gj)k4q(-gEMf7_9cwZ=1g>zWlHuUb_aool9-p zzivN^?_kHBRvqI6Lb`?ZC(_*$(t9P)eG}+`3H0Cu8W+Akr`1p&#qvfb(4!UYUbqgI z_v&kCFV~SiOWKQZq;E~&r@b=QF@0r1`e2dA{};4p^?=t`R^GP~Xzu0dI?CIeAP<+? zo@4sUUSC^zuO;a7Zwd4ZlAHeta?t*lOZgmQIjXPviO7qY^i0)D()nK@NA*(YwMb7< zheSUAhvcAtR|Dw^aO9|5HCXiL|Ct<&2c4j=h&OpyAKJ%p9q9=8yY-itUKR)7H4*-Y z%E#+Z#<}qre#03*!0v-UyI{*m7uq?H&*1|3`KbIW#4&g|iwI>ohnDs>((sDB#Q`WJ zX*qbE6|bhKd<@4Jup8tU=jQ8xSCbJzJ6y+zW9@q?`9DR&_e^kSjwg}z^^p>IS!rgIzxFz!O=4`QJp z=ScvA=Ssov3jSR1eZfK6^6eHh_JWY_Dbg5c#vTx`BNQTCLd5u5C3vHtvD<_GZzK)O z!Ma17B*^mw=@$gw6->q3dyFp-VtzOM;sO z_X^%C$gkrlcR51xKE{s{`D2YEyaFXB*!MTFQ{v7x(6x!II z18wZj0ge4Rps_y(H1_9!JB0tMf_nwODOfLfhu|T>hXfxJd|HtE?6aP)3N{J8Eojzz zr2koH#q}L@x?o4ao`S{>9nwb&eYW6KA|`pM&=(SM(k>JF%R;XedXvys3cXA4CW*gA z=-Y)pDD+Q=DCZHOjr~pN^N!Ge6%6xygLr;#M~n&bx{vf&!D)i$3oaAn7wF{MC1}oP zpua&H=hHigsNX$;KNbA7q`ybR`SKGY@@byez@I_{ZO((BvA=_%dq{e3p^F92lz3ye z4*B@MiE`#hI{&AUzDVemLa!G3azXq%H+>S-7jda6F|Qt=^qktvf_v0=9B6Z$0pw0WwHMmh znFHNhXk%{<^a!Di-8s-xgq}wPy-4VCq4~`ah-?R+{b`4_b?##7n~wEN3crpG9vW7jfm^I!$g$(pdfcO zApM*mziA@okJBH}vnLL&076nd?sZx-Ak_;tZ=3*ISs zzu?aWUleQ*d`IvT!3eMOphuoyvEXRI34(J3FBDuO_!Yrx1@{WxCTQ&6LHSZV+VSL&^3a!g4YZ3D|Y6)L-0Pq zp9wxI_*=o_g6|1xUdQ61(_H^TPG{2Sw{Aqx{e>PZ^cbPf5_*QvvxPoiXnrun{Hugs zBlISruM~Qx(7T1cMdPI5 z@L^vfQ~yqavjtZQUL&}N2zj>%en;>y5%c>&p&u7~PLLl0G2a`4=6?X%`yZr%-Lotf z37#!DUGPhSR|swuyh-poMAYMM!3PDO6#SLoe+a%o#Q%|#LVrqxe%LP8$cYj`X9>-F zHl$-h4-&dq=y5`q2t7;aQlXa!y;SJcLRSgBS?F4!zb5!Ci9aCp4~4!*=!b-UROsgf ze@#UFelM7XYa-GE1*ZyD5K*s7iRizt2z`y<^@2AEeqZo@BINx{utD&oU>MgxOwSbT zEjUr|9Kj`m)kO3k9oKPO78%58%pjH#gIH?Kcwtv@+{6S61p5gN5*$s09^(W{1Sbnl z7n~)yn20(o5nM`yZp#E$5^+7VTCj?U>xCM@jYORHHw)GhQJ<}XJBX;n^@4kdI8W>q z+($&cZWXL2LjT(ZkyQm^xOYT^p2b2BCqhqC52TlphMq<*&_*xlY03j_%7dN<$p`un z5qcgI`b8oN`$*_dh|n|2|4A`>KahG37kV@idcH%1UdBE(^clhH?L7QH3Ib97IYg9e z>^h^o2YJ1Sa)$Cc4f2hhW5})L^%dl)HI-{BTEAk47na(1eGqQ~CNo%= zsIM|UCR0fAq<_lVrtLy`>oA!bN!r%W-BzWA$IJaWFTKj^hF?$tKX+RS_<6pN^-pOD z|J%1Rin(6M`_=a48NI(9>1E)qKJbu*+SG`X^l{C7kLx;`25m!E?+P3;cuhoRxZTz zI#6SAP#^M<{ulws^Xz7pKo;X&on3h!AmEo*1$kNEqdZo}l{XLh{rXJ@9Yeb7TzRt* z@0VBW(+{UbPhP&2=jpc+H1#77ohy&FP5ttA`1E7Et6v9H%&%V+^6`1Q>s)!N&^&=0REAQO|{a*Izhref@Jnkgv*N@i_F$xmr%DXE; z-dn!*!`}^09`CLC_1i1@k%!Kew=qH9NuPeWy!PZRN7%0)pSc%MkT_S~#i0G|rxwM> z3oe;Fd7}~b>vt3a*nZ@pbL9<3*e@^3Cl8lgp1i)u;MeaN(0sn_I#*sV1pM-1khc;{ z>|b26dGdHK)vw)`L8BuDlZn`{gY@H$I+w3m@}c3Sm^oUB?@ciO0?rgPKYK)^4reuXlY6)2DM$(6@~ z5?=)CL3bVk{`wxppsGhaWsbz*)|dZLec4rXIxMtufQWO`_-x28Z|N%gznk*7cDwRU zAmCeO)xlDwj!GN!6uvBA(U74dVm?>gDr{q1yT&7jj2>=TKHsi!sqHV%u5owNFso$n z+p46#F(39jX@`zB4HfJq7QhB#R*BEv?csyQZlne;ZAPl4IA9+ax5CpL*hGY_S7Src z*s_B?K@7>X5aNO{@KuTJM(m?R8;|+w=4P}~6RMkL`4LyOy*XC0z4>tMzcs=phR%1wZ*WD8Y|h;yc6~W1F)HiuGpnYt}%83V=>sLgsng{XIg&o9z5QKO-qzb z*&&3B#TM`3Yqr+91_3CS-HH9?2{98~NGQP3w$T;#5%LgfOwb$Le#udjG>>4p79(Vw zpNl17qkqC=6I?`?Zev#iY+kI)*7@^VJr>0ESeVGgq<%O8u!ce$hXa}uY-#7YrICZB zvPc-EAyk=QDSYGnB^M(GatL;S)AF8WiyKiPJsbxN6cAj-t_yQ(^Y_4h2!F9mCE=IbhK}!i-p9f}JQeg|r!27x4uU-Iu4zFnh@`^(9mI z0+4*YQujMTvKHjupq%c14gB!KAlqZM=>fbfjvNQcbDAE+U6pMCB?vednO)?km;y#Z zjwxX3?G#Z4(ny@fJmDQ6`%uI*N(|o%(iAZ5Zc0q$RZUudc+DUK_dDswfCa&cPP7`4 z7vKnDqpfH?V*7wUhoohWO^x&?99GRikiULt{g zDx*I^pos+bsf@mj02l5c_Nk0!Akc{f_Nk06M_@Gx?o+9s0^eR7fq7xws>-!B zxD7L9?2^mZRbR3M-^;IAw|3LI^=0^mynM-Ac+wNK{wyP7=R~EsuY8 zZMY8Y|xYMi&~dUbVck zX4RU?_+AUFPm66D$nCQ6oBCx&MaHhe*Sp?#$LlYvFcmeCRqIx-s@SA9tS?_t>9HFM zIrt$v+W@$(dR5KJH8$>xd=tKWb@_^T9pa5q#sr9=Shh<-lOv^dL$``4Gv8jz1`3qa zvfs**77WQ4JMrc-n=r8bxc>l?-0zLe?g1vk6!Smt^J8-#i&p?aoSdA^890yGcgx*b z&gpNy(cKy_&!pUVE(ZzU_qO;xxx}Pr@w?@1dTUTMV^ImJv*CZ?Z*kYH#3Wt6?2@9j z<@^G)XjtLU!V!fdi`H*iU%hT!P0@z+)kUk;R;=Eztg;A`bMWd_Yd35h%v?*%sQ(vs zCls+uFd(pS6mj7wYPoO}wO%-i+=Zh^mW(3Vec*EetnB?T-_L~v}OobZ>r*k z6YheA)j9ENSFXuH?SAdrgWtzp!_U*g=im_>zU=gp2Jl1JKZmlmhT44?O5Muu+-CEG zt6?+s?3tnVVSM(5ZyzjH!e&j~sBFz=BqGxZZ{W&k6?C-Z6L zgxZ_0AL~Ln_!_VMH57r&7M<`Tcvs3n2e)z$`Xc#l(`P;!=OP$V_h(5lUu?%?a5?95 z|N6H;yrUO)+I&gjr#r+6gtU26IUc1k3*PkUn}sA^VYrU;w-aa|Y35sRml;U@$AvBd z=HTvWN6Ems$8U31N;>CU4lco>z;Cl@Vi7bfD z<-?`paF9$l&W*<A&~c$&>sr^P0)NZg7j>xH!QcC zpm`@6bfM5^3QiZiK#*6@%y+4v`PKyVjY8idh-NYU>5exvjp;u#PSB4WvTW}>!A?XZ z<`XdviiPGlX1|vT&GF8Bb66knts)}*5hCKF;15a zrbNC1n`C^Kk86bg-eVN&Gv@EmEAqfx(Bql+@f+8TGf}+(*U1PPaT3gXt z7u?WVwbm+awY7F*5w}`JtF5+Le$O-W&b{XzZh-dNZ~x2ZcRtB^=AHMQciwsDojL2B zePj|pCV1E7!NllF0lS^GFfz4pBdn)OhIo7KlT z->a|6V;}RaKHi@2+Q&J#690Cy`W``sSKln?W4*KwQ&CJGj|pD;ia}70GTf}b4M=kHxyPliq2gM?RK6ZCQZqJ6xxW!p!GjI1}SLj<3HziqLuqGjOB6OZdPt75=`5z2hJP3o8^@vfofVTk8-D20%+x~ zLBgiVo&&kX9yuEaTOj21A3v&M+spG9+ulok`gTH}zTYG|ZC$H<`YNE$jwAZQ>U#}x zp6*ol;y5^8>OdE2xoqIzvWns6nSt4tdI*y?d;5%`qN03gxt2NdGln~_)5gc1G2Em* z*0HbG!NGgT*}i@I8gCl+=-;#X-gI#1*8K<7+idG^*+qkMSL!Ur-+d0*caKgWiOwD&@VPkzpq>G=w~a*>cISaNFCG-y%;W+p^6UI zuS@CYFEiP1dGLQuM6IE1u|8JlSI6}0zsJvJ`RSeN_ts^fZHWzk(za*Ac3ksjud&aT z?pmYp{0Prs_H7cIohbYTyCcy{-}LIUZL@NnwXIXW*xnic-;K4ymHU4(e*Tj&YJLB2 z$JLSI@(6L|eFBDQ6|)*Y&?AShza)7A#z~n6w-8T{@J|b4|9#+46oo3ALd$(@rSuKpfXSwtqS1+BgrVD(X1&kR+&?Y zf3&I^K^bO#ffM zBtHsx;_kmapB=X9WN$kKoe6pA>8GThiW^gI30`#K10L@iPdX20<>A;nN{~#65xAg> zbo#baYK1D!bhD^^0^TD`8-&}Gx#7yf8%B3Gx#sPubi6%P7#GW^fEl(-=H+W0r!4RK z(cN=!S0d|*wGL#j84bU78RTfOQ2*`|@c+cc1&Qx*6~+t;QE&HHb2M2LdzVX-Jz%MdSz7FOiZ+w4fc1>kp^NpB z)@q`+w@pzvI*Nr!=?l$0rYAf>56($HJ9HMf$I`wsSk_0%;dM0Yi@wHj^xARKN|fjq zYk&H1ko^lB+xaDVsA&Z3JHD&aA8#3h8tHeoQB;eu}^V-gMGyP8}_L#Uw=w-hhU%XPQ^aMZNxs) z#Y+e(%jH{TUECemXS=UqpW}XteXh&5%JSTy*yp>mvG3|G$G)3;J@y6eBiI+Zzs0`0 z`%mnP++Ju+4|gQ?#qL+I@9AEQeJ}S`?0dUUVjp#1!~Pieee92Qxpqq*7oDm4x+Aea z&OHbFe(nX>_jj+wzQo;*{qgQg*q`9OiT#Q0LF@;(MYwr0&>f2XAa^$QgI(THEp>Sx zw9LI9`*QbZ*bi~v#lFG~;Rel6_ZaMlxu;=&k~_@v?4}FY#KlWAbOW2Qf-^Tt7m(OO$xjnHT z?{a;R3GSKLPjp+bpX6SF{bct}?5DW=MDJAh4eY0>V1V5gl>UCk{S>*%O~D;1$1TJ@ z;Bu`F*F6RMpgRfskUJOqu)7rd6!%i>Bkr}>r@D7wpXNS>eY(q)IWkm$@2Ulz--Wn< z+9jdCVXs0dh*?Jkxn@Tw7`_n_y^-UN3{$uO$v|BSe?&BtxhYPVp*Voq{OY>7@^$7t zhTGi1u~&nY`tHRi;aTxO57do9;|6 zr-Eezq9kUVMxwbA9iHyY3}TKCwv>>-m&vD)b-tDhToas0s#Oc(6T9w&D zFrE|SuS71_Cko@$%={}s(D?8KC#q6ThfED}!Xuro#o=L2{z4S|8Vlmp%zS>Cc{>Tb znwkG?5Ra396B39srOJ`#j zd=eQECx_`A_Jb$t(lMO}A7*#ksC&d4b&qd0I?lMX6I^tpIOB?hq34e#&SDW~8qITmXWl?I`k$;D5ssNE6XZcQyHEz3 za%gj*j5g)a=0X{6j>DE0V!VBgRI%M+WozB^$+Xnd)>)Ce8l1G(d&CmKdOy3 zuO*t`*-FK~GKwFyihpet>$&=M)9VsGuUij3M1`;GN{jZQq&_gbVf@ew2Rd!YZ;c;v z5sk(VT@jt36`o%Ab#Cv$5D2e#IIlTT_GkDqZH>yA0VTO-VVA<0bsAXigN`Q{wzDa{ z0t~yJr@;Un47~#q3@^~!Xkb88kA$C*Iwl|^K{xZ*z%cSK60|$}7$!!7ZfM^CgB#ok zr{LgmnzX&&Usqbhx9WAPO9G7bV}`(1Zkz&wC4oN2I@OiT>TwK?oW>pXXho>M#~rcW z&rWnqwmz_UTKh6vyV$h$GTYil+gjbC^K5H%gU++9)t*=qYwd67iY2kuYR@b&&HLOO z?U$M6@j<HG7)JR{>1(RUjMyFiul5bq^khwMBQ~fmmB~Odil}F(dwCZMoNt6|5}c>ftaFm1*^wkE1H%YjH)k4A42N_)JP&3WSquk#n%2c~GxT{{w&iAra5)>yab;xX zXOPUb+`>YVd9L@c(N!B<#6>@KtaWqsVPhuTtwXBMgGi-(aunxeosA@~kItlz>Wz>1 zdl>Dbh6EoiOz_d71RpJq`AB=A(R#t0t)6Gw8PQ%?V!e=|z0hR2+1d+B6THxDyl|iO zLW}VNmr&DQ=<*7^kbK_gfGUG=8p*#uaS*L#FXBqtMUUu@AeG5q~{DvCeoz zJELb$oY3lsd{nowCl@c(LG!3?M$Z>P>(log+9gHJpmqN}p)D`E3bZ~zJg)2Odjeu= z0Ia|ncwjjON1ylDpfS2zr-7I37^!k*fpgsWNJ~F^S{Z3o{TPqm1|!lI?AOz#+e7_M zKzbANS48?(Mwa&*1e(5yT%h_@Abmf17s7@x&m_AdC(xSm1TrV$-)VF5h?UMrC;wFN zCg3>ijKUf13J^5Yslpj8U6zOAf-?ap-5-MJMPeFGy8i)!Z>BiaPIi6@G|eP2%gN6l zK((mRIm_vr&#|RB=Q<_%T5;{7Ys8(BhOV?7l^*RHuX( zUW#JBWybEDKHwd1j&p2wHg_uLWaOTp13`zb=5U5kIZU3&&KghyI$I6o(tME=eNe1| zfHSXyA$`z<^jioy9nvbOLplS8VLiT`Am_lILqY414g?28L4O6b4(ULU74`fzXdTjS zkTYS?M$kH>!$D3-MO@EThjb`-HR!%y!ls0fu7h*8HTY znV*BvzIjU5Y)|!`*4!TZV%mQ}?JvZ%n}(qK(4&*6?k!!Q(5cq3^tO&A^rv?8I|+_{ z*EU06iM)%<+GOV?|Uq zWeJ;-7Gj|H6(7JIMAw5vu0<8x|mX_~ZfU=kmV3xkkf&O@#*O4&>Q}iV$cMS?;jvhp4%8a)wQ`+?i zL^3_?${bnJ?@GwBM>0=e?6D)F!mmL1H88Wr3?jUqb+Wc2f^*lbQ;i+{m>!X>{lqCX z>$K{ATwav=vQFQnPRvK9_$=HT>F2-VgkJ$} zs{E2eVnFD9aC=sQev|Y-9gaONhJKb(eRx<(-KfLtI%H-u)>O_nkj!PQdFEcmLa@r{ zZ-hP_-ea{sJ66vK@hE}0S5J!LLOe$Fcn`Wbb>Jp9=DpN!#zQ*k-1{7>nP;lG)>iWs zTa6y}HKAdq8a?Xg>uNCf>Oo%{(z9y~YBZJhV5L8aSK9f^wx2bxFf~7BYhGy_c3({2 z5bAq7rq6f?lL~r(5gokJD0mYJ^pSLP$a^)h#d=5|MYmYf_0({co*H;@{V8e-UTs8i z*!YJb=}lf-NAOrCxYcqq3JodT?7<|jvE2NV4Jq8hi6pNz{tH}FJll}MjW!sP9<a<=v5PmC|qvA~ba*GQ_cH?{&{9xID( zvHozwI<|UX(lP$v^2XVx9ECrU4eGgiOfF#CPt_Imd>j?&S!+c2uTjj3d#x`{3+uC8 zuEwv=c1MOekM*not;gx4W-cU0>fnp&|`ON1rAfa?m*;1y0z{1~4j$M|w^awbMfTb!KuK|Tiuc`oZboy@Ulb9gRN zML6NjIcYE?2ggnoa>`Y|2O+tEk`Y6{bg4;|C-OJ#rG7oxNU1Sf@RLUNi?2XWm`3{inwE_n}+c{*t!c9s_@-Ew#tM zm$jWeK0v+Za5Re*-WjhjHY<7$wa>Ad_f0ijaUWDy^JiO)9%mnf=X_cG*H)^lOhLsT~}@jhenTA zVs&j~U4M($m9&9b1*oRfRI|udQ>LrwQN+4njOy|&s>(6<57|2^rwqJYhE)!CDLiHR z5dV2^1#)=PJ7+rhDf6(q1sd`n4iDM@tPU@XhxIa5)(?3)#9M++?_gQECC?8!y@LHt z21(`NHgkLAE@%tm_DlE&NSp^|ZfpPXxl7^$pveq?U0~-fg)DEtOoCiwWzKHorEs`C z2|E8SH|HY?F*oNQWThMf`!O%(=ZDIF3tZ!b*Tqe}QuSl!YGXDB%Wg$lo4qCI6a@82 ze-+AyuYzsUka!0CuIH4laJtTn8P|1|F>WdNU1vj>lgqaum@`Rn!*J6ZuZXz$QBT9j zw}_KPy;-_5w0iw~&H&u1448gK8t&1XAFVx6;al{}S=wKprER?yt$b(5>i$2l3{8D2 zR z(W%`zgk!{v=%-<7+n@+GBA( z^e5??7+*W&aOD{hNjo8?qKs7>UPRY&c#%%}GqILKdoIS;RUC%jN%zLevlWNyNa|0* zufi})(m%{j;&v@vHMX-7W5MdY)R4mz8aq&s3dJL74cNk>;)ZRc$5fzH`ld9t3SgXr8&cv@{IJnBp`mSWa+#-q;8 zc-qcGJ36K_Nf5*xo1~l^UZEX2#7LDwLMH}bLnwe~Luv8M(nDL|VS6=EbV)JXN zr%gV)Y)I))zknTalg>)YLB}QM(2nFB8b9f*>dw_AWf^^O)|6?O;}XtsbdGnp=nQYH zn+#7!=nSuqjf5xKbcQ!nbjHkCGscdJAK^_YPv7edZ!Z`L-3N4ZtnE7A<0hf2^-6>G zgl<~(*cqc{O_(+{vAtDe$ILjpdR9!=*r|q2x=2?G0Gp&bNvnor5cd#)T^n=>@WM_bje$TO8{f zPk}@77d0$vXsvBGD=i&=Q+j*SfIMnn&`{sr)Mj0vKcv*InsJS&2W5;O%R!mi`g;4F z8pVE;Z`L4?T3VayFmxO0_1dOb0BO{W8KcgwnK|K{u{E>Kt{z)clOROH@i{GN6n*0} zr>+^@wW8f)r>DE5Pki4y@(6H=EU33SJskOHPZEy*dqVN(FdxzK7SZ93<+@rhkP>Rq z4Aj27MJ=r#s@j{|5%pZ6wLvXdzHnhfYfKt!EFG#FsahLb8kW|V4J(atV>vOIw#Bt& zF*XS=2S+B=*j8R%;g#Uw%GQ7aL-Ea>rsidfqI#Eb+0K9+Rsml(whbAcpaX?sIu3OJ zG$m<%5*KT?Byq6LKh(Xo4Yl<($;PB+BpZ=SYwKX=q5Z*pJ#m>nSqxg4&hv(xC(TgN z0^YD^rrbs`g=4{)M7#}SsJ1@V5n6&~colkGNuEr*5;!t2S(3~o{$#dpRuZ3j^mW2D z4)-)l?hRosYBaNI;yojLUk&S`C6V_Yv6Jx=k0!|^Vh5FEOes#6Cu7?Ki5XaC>Pupz z_ehjXP5jW3j2l0`9EKY|$|Mt_opL(E15q*&nFnpiCuxO9*x2t}BJrTqxm@BL+PR!e zrJV~%cy=xzQP{aar|~F*%?#@#$eVSKDOH|9rF+YiYvj^E|Ipv6N*QLp3j+G|u$U;?Q_$ z-3|nqG68!L&PNb&*6+B;K>#Hji^+~P1)b;dD_QaLPBIdOjYkvn+W(iH0gXBtPnR%H zENE2DU?j(s4=O!bh0{_-;e!c*EY-!yc5(u_`1C_p{J^*n?<*Gtdg0yVe)#qd#JMzy zcU^V7l^omn+|5h#`Psih^Ld$9-cPgs!}0y{N22}qCX+8lop$5%yQ-|%`tMjOUS3fX z0X|ps^S$=+dEftprax(;-J(d?b?m)*neV0l)q0cp!K;t_f5k7!{N~m7ui8iX8_{_| z^=G^*a@1?@AI<9ac9DFUGdo)-|NlqJ_?tPf@63l(wa{aVh5h3-l)j5=-&eVzlFG*VrDrur(wvWMe5@ zu*TB3@HA=;W?~C49h*F9fHjNfPt9$OxX}eR%t~~KO!IA6mO0US5yK&>wbonE zo3_`2F(v-GR4{12l<;HaghFXbca zCukbK&i2zz?5s&>Ed`&Rfy5k9DeizwXa7yfog zH1A$*G(Q@k<`a_&9|&nTW&7RzwXn2+PWp*r*=m19fA-2et!2*i%j`&@p3B1SGb<+I z^B3;Ul(pEcSR3jVc7L5RF*F{ZrRX*>loOs7cJEyAaj19L{XMcBHww9RE7rPSrudz^ zE+Q&Fzfh~ZJOa_bU8q%dM7%0Pz1Klg@3p?(c@YW<)AIN=j*t^}izkLE-NkG1sSWvz zMl9wIBntMW;QVBQH>W0OL?>3d3zG>xr3DcfrfLYDo?P&K2xg_Znf~zIoaTgvrMcN_ zLs?Lf8lDs?U>no?rhgA|z2j}nn~0@bmah#}h200!CWelk5b8R~7xT}fgvTqn6GJ22 z)?{tilPH)+!Sj;|ex4|pH8FIWdqFb6Ytuc!b{u2ve19B0cVv+@86GV|IOuBpT6Ss? zMC0RaI&_}PK85&lxX~qx>}YykvemkSN##4Zw7e zB#^Jo@@uS0uJQgv!TgD#5pGLdBTi6!TUYz?8uIzQnAkT;w4AFx@bK}boa%;`SmRrX zdMANDK>a*{9;|jG&_mQ63G_*7a{_&;`f37wy5cW#;@cQ?b^<+4jZdH_sb441sd!T| zUYaZE>`ma$R6k9i&r%O2(C4aK66hMWA%U(_%M<8Dsy=~UqWH_p_|~jOC(vzbX9At6 z(h}^wQ2!h=UjD1<#|iS6sP8Ax>(mVi^hR}e0-d9-O`yA~OB3ksswIIgR{YUue2Xgn zoHV}mjVF;h^m{@0xrb+S6IOGlJYKo?Y_3XZJotEP+OxR|?`V29ejmuYxhm=zf%TkaE>oKKfiA zUE`zceDoq8y~Ia1`{*_weW8#3s*k?JN3ZkI8-4VZK6;Cf-s+>T_0eDV(c9EtJn_k7 z1Kz{78|m|LGHo}~x8j1rZlt;TnB7RP#IGUjMw-9ou^Z|4JRwec6yDpm8|hr1{>wcf zPkxS1-(LK{*>2?D?71K%&DG}YM*4i-ERc=#L7)CLKK(g9{!>1C`Q3E8Y5hKXeuNjw z?M8l$ul@YlEjM0^=c*-Yy7<%3i`2#94_+(hs!8g_1pW{;UFxsW{8QDh#C}tLuzE)7 z`7Sn4zK&Fba^e_f*95PutgwyBw7uPOgk zb*uEZq1UNX6a0UndQ0p#`g7Ed1plR~%?bRj>YN0Ars8i~>_#6B@WmI`|FIkS7yHKZ zc3*jZ(AsX4-{zyA^U+#%swr{8aZ=LK{S4jnDqnto$=~YBFTpP}kkxaGFaLPSzuK37 zf{#8?-%!dKQF+xreCle9B%LT6^ zB7UDBB3|DT)Zg6$jRjCt0EN#Jyqq{lsRsmqPDFg_@8SWwV;&74K1UM~k4prvAR-Qb zAovR+;_ov-em|S^M8P(}YXx5xe2-WG|6?L1o-DXP@JhjZ1b-{|HzMLUig_r2c%48* ze6|u1k2et!XHN^hC)fk?W&m+kCAgG``1(2#@$?iC@$(K5@sfjinOI7!RO)QO6~s|W z-7dJ3I2!&I?1K4?^l-si!8L-93%*VqgKu03_D?l*wctv@ZGx`~9w1hse{dWLj79$t z&p`hW$MFggIKhm+z$6}%Km)rGr{E`;LLW<7 zKEZbdKNS2_@E?K>#{=4xBA6+dCy3>GG{3jtaf195JeYZjb6Gp)j}e?8I8AW2 z;JJdeg8bAx%W)-PVw>Pf!Ak_WkR18^U_0>|!5ai`5#%bwGJDe@l^`f0)E z1-YCX%l%UDH-di@+%NbiL7oRvo@*QvzZB&61WBg~W()QfJWi0`fu~%V;7Nj~362q* zAUI8Mw&1yfwSruhjQTDRTqU?x@N&WH1i9`q&)AXj&0`L%*u1aBsyo~ML%IX^;PmJ5z8Gu>{v$Li2o-{3`{w34TlP2ZH)|0J&F${=J|+J|O>7p@W?Np}#*7`E!ZK zE45JQ^NHhe+!cDQ;8wv~1-~cwxZqC(-w@==*VO+vK{v(dO(7z`fQWi~3Vjyw1U#V^ zdMOchoGTz2LjV@k;$!=+A}zQs~T7qc@KTJ1Yc7 z3C1@ zi>rc@UQ9%}CZR79+$8vQ!EXsZDEN%v%S4p_h0uG6(EkrXC*9PemjuT_ewfgsi70o5 z(6a;=2(}1bB6yYH&4PCkQT|?`A16ZpYl6R({BQ>Hd3{5i1b+}wE-Ew^pJx6D!AXMW z2rd+CBjWsXwa}Lnp=XQGHwkjJZt8nj@HxTP1m6_=i(nwr$n$;-%S8nT37$ekJtKvl zN`xJ=gua1@^WfWs{vHwX_Y3`$;LikqE6CLnS>NY^kt{gZPZB&^u#pJ)W}&Yj;yUa)p*x5uf2Yt72<{YoS@8FQ?+boGgq}bi{$a-eBChL( z2|bz!y=MqLOK^c;i{Kg}%54z(+eBO!a*1i`eVhnAJB8+A%*_7-5pr(|{V5UmF%Aly znQ!EJ2p%tZlHeJFvjyt}+lbKfb)k0>aeext(7z(Wo;QSkOX&B6{;SY`7n(~fvV0*C zcAq3TMsTKJjUbo*quhmp>jbYByj}1v!R>;N3%(%urC<;jlGK+WSSZ+6aFpP9!D_*| zf{O)L3a$~{BzT=*hv2<}KM~v|_`2Ymf(Hb@5bR!H?2HPYPQ=CS1fgdW;rFwJZVha6b|9e-b)e2pabpvWf6tF%jjXLJtxgAvjU+ z93sli7kUj5_bKo}Tdn8oMCiFu=zD~}UFfHYxR3Eup?^(;{BMPRSMYCwq3%X+zF;50 za=}r8)q*vG%LG>oZWg>zkjuNU-g|`JL4;j9h0er{i9jXJdx`K*A0p)Y3q4eDjNo*^ z`GU=Y7Yl9?yjk$Of;$9%BKW%CTY?`GQSV=c4)-v2We{Q4*~C$JyG!V1BIMhIzEtpP z!CM6H6?{zaMZw<)z9aZo!9cOm8z!ROZbZ~uEc9&RXxx7hdI=GBGz_b=sSp2N_|i0M~SHa388-~_#44@iID$L=(OIT$KpOP5&n!4QNFLx<${%h zQw6_5M7esQ*AvfB>MEgcBtp-vLfP5BTJc6B9!-$Uq1 z!7~NFBDhenRq#^5t%5fTeoycb!Dj_u6WlMTjxqH|1aky?3LY;wTyTQmY{6Q=RzZc0 z_j7`R5n?~Ne+tBDoxZ<>k6lluMu!d_#Pcs%+?u!MMmSMaNZ{P4w3Vc-~l4W=O==n5v!E?LQpxN zF>d&oH)4c{agZUHO+=jM3l_56WX!`v#7&9N1Bi&1;X;of_QzMoghmk^FLQ*ROGMl( z7P^Uucv&IzDk9=$lhB)qsAQYaHxm&zcL{wjagb7v2>mz_ar1)EFA+?Gt(g5pgqK=*dLH%^acU5)n6xg>E7aNBe|cMMT_e z5_&Tcanm96okYaVcA+06j==eX(9aSPH@k#>m58|6E%cj2#LWSrKOt7KQTRi9g2Yi6 z-$LgTM`OGST|q?LR0}|F?z~H7}VO(G-%X}DT5kTG}f;e#NS~J;;Z+G zKOm^_{2W%7I9jRiy;0G0YDd;gj><_DoiV~mkZVv9$` zk)7@NweDdn^~iav^kg4pJNX+ykA;tUTej z&WEi!LDE}s0^=yF6=Uu1;SXD}Pu5$tk9CxlYlDxf>I6w|#R&{fwDEZj%P`m#ZU*6( zMN1p7u;x)3rWbI~(|CLZ9aGkf+1A=+iyGS0AVamaw;rux#$>_|$`9-CL!`YeKZJRd zZA%PKS^MR%W+W})H6^LQzh+M2G73jyPGX59<|GOnr8)E}f9rfSe(}kAP4KafvT{8^ znspcs>j96Pw^C2GE^eYzFO0;I;aLX6uA`xU!l;|8%i6`lJktJk#K_VGk}=|EH5_~K zMWnn3_C(GhhwnIh(6Z+ChC$<|&K`&r59*fu8zW3sQ#h zhiz-3sJGrk&QaE^U3WC~dIi0;dh?I6PCDpls`SWtYxHCvWrZd_^wK_u^{q$FTcIag z7dHo-rbeu0=Ajq1a%H`vv`9v%99<4S=90-CIgGtWufyvYgA zw*k10z#yDGw%0BIu3Sp&TRW)yWbVuKUhlAYGBfmE@5)co8G5gG<->G_-s@fYP@SRo zdN-tk8Ccnln)F`ph78f!dS9mZW>>DW^&acpu_Sjx%5+li%gi226yh9wL1WGGWfwLs ztFNhRX~ALurCM6=u~03m)O+07Ir@zsLBnmL*tTXJK4F{_BNc9a>FpHUi((qLaP)@T zLkSyh9qH}+xHsgN!)=?`X65cQaxH6xgWE-la@H0r*8w@a9u?a*)tUS1HzJ2J{Aam$ z@J@%f-YVe%^k((_!N|qx9S<(c+jd#GHz4P&cblhP+@6Zn`=GDhYT*I&X7z3N>AMU1 zSTEbbdMHPFjnBSWl5cIX`d0b$ZTHxh?$O6@cX<6WS9k!uS$)+$eLFq&;dP^!eSBvJ z`eOc@4<7BN3^%K<$fxfGk9}ap^zDYRUi%h@&uY2rcxKfUG+-LN~ z>{})IHl(e-@A~xZ_Sl!_(YL{8-+J(p*|*lG?|{cXy#5fgZ>G<_ZDJo~xLNzA`Sg9} zv9Cbn*xsCsME`Xl4?{Y(S$!!+F6Ni*kYM@lB5CDZ$a(!7sgIAhBFIvX<@%!2y#4kF z@{;)_3L&q)Lg-_8#(gpVt-b?DLo{aJOQ0!78E%y0_CEf-`l8Us_EH}ngU0k-gS6Ma zS3xJUZwvCh`bs_aMZvT7)gbM)?;X&zFN%L|*1mI*_Uaq%vF})sV>#SLPq2^ePi7x( z$0z6;@3F5hc&wNDFij@d7lg6QrwljBaidSX_Ep!%{nrmXt8XI&DQo9NKGRBO-#X-b z_05Mq*314V@#vds^u_u&3Yv11;b!fd=+n2@V;>%I#O(VK(h!Z=S0eh5r8leZQBYvT z>Ma$y0Y14Og7&s!g{NLTLW$M8%T278&$N>HzBbEeK#6?G5h!|jB=FW zX4~;~pT4ag`^rR)<(@?WsEGMxRwwrDgq+vD4(PM?G3LP5^i@V*%sxJoqa0+=z zPv1`Hv-1WXVa4=K!ol5ZAD<0YX-#Hl^^Jp^*S=lQXYIoyu$aCsMqkXnLYzlYjxyY= zzI30y*P+kahev2Jef*7#*S;w96>3dpXZ5`eA+LS!ca$bF^A@0919(@CizL%XxgNBfG>67AzN*<}9f205>Ng&zCHdGzgv5ZW8FZ-v-L8E)3TJ&^P2i+b#vAab;i z<-PvnGvQ?RwIkoFuhe7TB#*u-qc3LPHqfkxGTf|v>?g0j;U4>@h#bpZfb#>deH|!g zb$Io)Le8siyvM$29(|*YzL8tkGH(lgt-xTb;_T3A8QRLgr>YD&L zuYL19_RWMa<*2WR(HFDtC9#h(+^oI=pT5N&`(}$A_3>SLuYIp}VjthV_u99@W8YaG zeVdKGn0=p!eU#y5?c3zjx5i`N*&;{#-Z0}WHh%dILbCY#m2bRl_1MRAAnU*H7=1DO z_$~wMp$s=`-yJ@E+dTHo6FHX4HRsPU`--72nSEKl^XI!f_VHZK+V@8@AH?jd5c?>@ z&D!@{-+Zv$V_&Vv(LTL;BoK!iy^ZL^zIWkQZ~yM}*jI;=*1pFehj@wEH%siJ3^!}v z!#;g4c!_C^4=hL^_V_&1l z(SN6h675^jiG8O+&THQRk9|u#`qGWQn0=eYKFV;j_NDmreFlB@__0*vXy5z3`R}?; z?0d&IUqu$ik8jN$eUJL)zq`af%5byx{m`c`8~Ut$=ZhTedo?A|f7_ui+42&VM;UI`zR!LATj{ZHrO45~DZcr61r#KkUncnG(`t`>U-jtg;hUegihY#fX6@r| zxV-J1}~HFkA3Sr`f7~6Sp4l0`zXULW}i>rCXaoWi5%^lhwb)yLo3+BA8+@tdlZ$5^R2ZxiIa z^}fCs?>%-k^~KEagYi*um6UxiMRLbC};imrI|OVN^h^@B==T!sBE^b&wca8;{HLC~&s80J z!nka^Kz;buC{?`=r*%cIWQ6yQ%BbF#1|AMOh=Q}2pO%unaqou8-TP9iJNDe}RFju> zI+j&no}-HPjR1WQ%256<2M-plnT|SC$G&^BJNEta;K4uPjop36LPl-v*h8B26!dQ1 z!@6Kw-tEVB?4cc@Y{REK=8iN4Iu&|ZM(e3$9o74aVH?|!1Kd=7`CiIIq8)qEN;~#g z9bS3(zlbuHhwgrFGi*l}zjqmsv{K*LpNjgd9)F$iRT_0L-(nDSaMzZ-2d;kNof37+ zepT7APi23b7(ejcZ1lr}Ew}Ag)#!&x^aJd4qNr>Bmc1!0x4n(g zwLe2`*{|TU2=IaI*Y<2zukBIux9r#LK${U`Y3#>H^)34m>hF<%usLHN>5|=B_J-%H z-J^1X=#MiYbL%^7>)hz|`<*CO(}-TRKZyF&PSFQFA!XWPQQMGx3ziJ2MqG3_*}Jv` z4s3cN!uoG!W3XMl-d%HG(!h5kXiv$STlS}ATWwrb@9U@gWaHkr-s*j@H|-sD z+x}J2jeAQJ zUR@abS`X_tdT8gS{qWnK2;)Q&<6U0anJrAfc|3t zzcK)0JbTOjQD|>T=`H(nf`5E_RK|>b^w+42jy&rF#*gh6i-+s?&0@dp_wDF+H64A` zg8qiCz*g9U{&3eoZ#Db#`u+E!Kewx2@4;`O9U%T9?El`o`JLc)ZfYV0p0;l?V{$9T zZ$`I$b1*h>*WOv{rDr-Wv|1ENi>$2?2=q>vLYWkiE z#^%)~HaUm?gz@1hwG*-NApUtTz8?SFw%?bb=g<FQ1j#-Id=pt?WFoeW!pHN!qD}MH?~Sz`Wf%i@>N$Nq=5+AjZyR5n(>HtObn83L z8>|nf-9?k(JLZqa7!Q{se=Fi}jkFPRaMydP6|sHEw0*X3Z2PP}i*_zh^qurciD$m3 zhO+D6`%StBI3K63;kR*w)YtonbDpN%i+>zKqbR{AUr1V^Lkmo20i26K>Z~<@_jPhM z%U0>Kyg#Y8L(9%!SzaGGYL1aHpX;${vK_NfcD_#Hw9;%=7Y3Ucu9wpmDTIcq$3L3W z4p?uJ*z3)f#b7Z%CRC-jZAN+<{!xMu)s~-4Fb=3DFnS$zHUoK$NkUX_UX_m{Cjgbi z7w`|2gk3s0-KwMnb(U&H)nMw)Dq_o7M?kGE5tjat5!0{ZpK2U6i>3Jt4oLzHq+(jw zZn6n$B-^iuv~jWS^;sYtHJd$QoR_rcO10E<0^RJW8QAO1+D^g*#0&x@gX%BNjN9U6 zW>SWmw~Xn$nS`DAN1L$Mo0X!15%^~ti8K=)iV!>S59_hln=L{ctMQLsAh2-=XTn^Q zyA7~YCl3?k+COXz8&b_*relF$t(346|AxWTv-n4C1a`1tfY6&Yiv+beYC6FLnZ2u? z;FUrxHG^QJct2flUR@sF8L2~jXRApTQ7zE70{`&L&49afvYPO?PR=Im)X6j70eqs9 z)r5!+voi^Nh>wONQ*U1LvXKK8VXjUd(oZZ>s#*Wbp|xFCa)^6a_Xzyk(4v_PE#g-E zCkZVU8IS)AmHjRbhI(^uV~(lgNbzJmk+jqEb&b;rn{@I_PEgs#*GTEj>tIimm;z_V z3nUGgC{$o-C71$p;sxd)Q*X8g26+qqgDU6ROY~g%NQ`326Y{?UiIGcqM<=VX*PCBi zqT5*eXZTOdWsZrkL)=se)_D9Ui8xkCb72S78tb%4yG<_kdb1`m8ccy|7Pt=oNz}5) zaKj>G;KZ}@!QEF2PAAZN6r6q=Q{|Vf z{)IEm(gYdYysAa=O|RseMl8AHZm;C-!%6CPNh>Q|Q7DFa;5bDnjR~Ftdy1Q1J-oN{VywjmG zE2IJiCX4lVsYoERX(Dxzmy;$$4jhns`C3PnWDNMYRAp8ghx zY>Tn@fV4QoR`rgR(_}Q}08JhP(rDEr7R)qlV!QjKYp3EB$hbAemgDjq+fMZ?Zc+tx zpafBd5ou3+?$)_x7x*i%9RKdej(ZX?$XE?A!iS((;2|f>mlRU!xohC=eC$+&D?f*V zsloF|(5Q%$whHM1NIEA*xBzrYFr7KU;EIefAXUa$3`1sTo7CPs^B$eR@U%_8A%cT1Tcb%0nYFz7A4ld>eZwM> zGM>fW&G;qu!3^Hl3T1qXeK;cp&pT2wx?>;7I1&3)m8QoPlHuuTr=sdMn$T%Fr)hS(opDbR!^#(W0C*Ca-7D{7P|)0%LduBUr8&2JvJ9`Fm~wNYR(PjH!_?`oq2=V z#8-3^yTP}5o_j^lbLWH9w(O!USvP>xE&e&%l=TG2Ha6oIY*ZGWtmH&=VF}xF;TJMp@dP;U3COa^V+OUQEl`wfoqJ-1DvyHb8p1{YKCMVhaDZ|SkP@aR#zAO0q9G~ zKh7BqTcR(6*2mcX4rkivLC_n?Kf&RG#koA9@+u&=cbZwcE{_LW6N@_j@-72|J;i`C ztw&VqL*Gl1dktuNV|6ubimjg?e!F?Nw>ksWc0 zb_0U1_@~PFV9-4og&UlCm$N6UO-~+&wC>62rYEO@);&4H1m{}Nx+iCto_q-ORh;%_ zI?G^VuT;4GMY?{bk^dujPa67sc%#=3K|e@(mWhljL4V88nqLc=FLHs;a7JWAuO)eo z!^0QId>%uEjDC#Tb+Dghg1r=_b)cMS0%Zt_>Oh)f0_i-^`mF72ZT+!tQ}tEOgRs00 zJNhpCN4FyL6*A7(O^SXO>DNiOIuF34=yOQ#Cf(+2;UPv3sY)dLQ#coQpR4n$(F~PG zy57?HDldf6&kD`JnSs`ETD&I8qd@x?h@z7rG91?BZbO2X`g!*t!TbC1NTs+bY6|7O z36blx$aFo?&d}$D#s>1XYhElDmhja0aZyT3Nk408@OjwzozU$tf&+m!G-w2ZUG@Eh zL5CMWpP1>63Atu^XAgkP(_tbRHq-FeinTsG^IJ zlipRw#u2R4h2o>9=o=^*>1GZSxcYFPLF=iVXnD}P%rLvv z@?SN>>Q>F?IMT!FPCKk3dRQ4UdJ}5X!|HZ3toU^YJ*+y+usR4@536sQVKoZZ?0Q(; z;TcvhIh?fg;1~hlBpV!abUp$TA;!Tm-_j90OUHp=lcr4&^WuYXj&RdF4poL9&m>GP z&rNnpE~R*G@|ne&^r1#=t$Evj)qE0!!(WtUK&|> zjs_mtN#n4gihjfZ_|$}zj{8`&tD@h6mwuWjs($62YFNs@k(nM zstP{j1bJu=E+xN}tc$TLLr8@mbh;G-`(}-H3W_ip-Umh&F7XQf0-_#Dv&Q41DFhMD zwpkOLs0uv>ncsk&HPSh*IBS?wz;UHd9N~llp40N{0a+(Ifr23*dXP8;7iGL$>qp{L zCsM!^f8_qQ$b9;6Ts^Rv60eu{1lIIHCiiOVuDL0OE zyGYQtJ&gF_z^)+@)5!k||BnDn^QmwLitc7dk zV9B-m=A{bjN~z_`xH3mWeY6fW#VNAd8ZT<7X^$0NSkt;}5$GwS$5zdnJhNu(nChCU z>YAz3rjGUJ%>=LPG zC1;Kw6*mioLBrcV33$hs1IPGs;1h4oj0x3ar&N^+NF(6;4C0Tdot80HCm0sO9*GH zb7J|drKOpYQ&r1?#&)RD`^9Q$bA5|y$5Jc}+&8zi131L-V#F-0;C4|%f(~s7CidwG zxnjR3udc?}+`O;`?(;BOgwfPo8*d|K20FQ+wY9l5K~|ew)7ns5U$dZb877kiZr$RB zx+OJOqZRchFmwTbrggGjdB^&Teras0xu~JFIYGnH-sV#_=j(WKtK> z`h;#_M)F>#aR(*O4u38vl_5D+y0lr_x;0+j?Z`G00s_Q^T@F?TeN0R<>h7QP|qlSck~bq6lKu!egs4 z(+=2}M?5Q%)-_{vYf;*ZxY6Y>2{kn?Y-n#p+}V7aA=4N|8|yu@Roex1y1dS8X@(Ii z)$+F5MR5(9LJ7=u{4bBGHqte1{)~3Du&H)YJUec84H;qyo1km}r@8-kaG)`uaH zsEgH#W?A1t6wr0fz)_G!{8x<$_EV{G;DC&%C^?# z=JvtM+gb-VE~{%=Uf(bnC&mM@tlsh!16gXW9`c>2J@jn*&@*^ZJ6C4A|G>q-|3rng z24fi^+SJ6uPTQcx^c{!y^7h6iP;f0Nx!^EY16=HxJX}CxmNY_3>kW#aRfg+bPjO1u zvDgBP9@b{@TO%cwV4c6^b?wN4Vmw4s zA$_Um4sk-MX_trHu@gfB+*3aeDM?KXrG_U>2q|#ZhEm;ACmIe@VK;wbsQ9u_W_XAD z{Y!R)-DlOrP@naXN}U+$=BBR=rB4l|KE|@QU$Qn73cGtCP%IC>(Wr_`VFDeHbDQxP;NMKYAAEV#<2Uv#XCX+!tQ1#GD35d`^m*0 z!$^0V^YOZnvmxy6gG5Hyz0O%1h+qK3+xT6_2^FOUO7lZiQzwM7pf)wUk=4F<@!C-D zu=^7SZF=}(X1k9v{rtrfk=Owf!*1$YNF>AHz)L&t_Ug+`1IO@KW)6G2T5<*W&Hi?oGuHiWuv z4CO}lg);FNC+uDiGc&{P`=}1ob!c|?FkZJnomWBU$H>lP_gn?Bu3`7DpmQG$Wlp8= zMpN_)wrV{J7Kh!xGra)?kq8y74LRZJu)F3EyDtk^r&J(( zCWLYyV^`%)VmkB`obcXi>T7DQZ8iM;LEvLIANKuoRiMHN^$oip1(197>W`TKt_6N9xEA3WD9H=;ofJx)M2k1C z4h(nLtW9oYMEGO2`O{TMxmUZW>Z4WIZFLcZTKL0NYePN4?zPAWOi z&4mH)tXdn0CN%3-SNB&5nl&S_S-VzEbho?GtXEjg1JEkXdI?Hl(hhfR7^YknjScH0BxBz9jd{PMdEbM1*)R`N zO~Q6I?o-(mU_bQi_vO7SgE-J3ucs4qbC z?M<^4=Y!pp3UWK?b%%D z^KP!f?PkyBD!vmJ-(1|W^=_^z@RHEp!$a=~&dosvB+edHn)pwE4zPEh*t9|yIWh)0# zf7D0UNqL@Q<|2O5h32_rF5>4`B44WMbi4~Y7p?NNyi+G+U z{#c{=uDZl$@2ft0JACve=qX0nZX*sb_oIuCHNU$pKHj`9R$Pf^$m9>g4)u^OBqDq( ziKRF%mV7?GC_YiC`NSyXxfL5Y0mG}3v|USeEeum zZ?-%f3=>r`hDkkfpi+y8l{o(<;<`q+1N4KWM=7|8^HotufUQ`ZwUKhmI`tmhCrbIps!^kX&4^*2wTD6h+-5!${Ib4^6O zyC_$QhoMB+dqC(fh~RUMV?Fs|H~oKz-I%UMP#$*AAr6I%;7(#6ybO(U#Y4=q;9|Tr z%DK0=FZzRc5?;O&e1uqm{t$ef2s?HYqxg9Su@XuHK(vcIJ(LUHaS8zRXn8XF}ank7bPl)Juj)&soq&={61Zkj-L)bZ)bkzL5jdnJX zhMjCL?QAE)&K1OCpp;v&ffKs&S`JM^yuu`n=L_B-_=Mo+f~=47*9+b+_;(`W_C&Ow zI9>2E!S4$GL9htpIe_?EE_jom{%#ub`LZARE(|2jCnDZ92;M8WTQH3IjC{VgNj#5; zIN2)rv>>iKbbcS450Kv?_^{wF1YI0L$v>W$uha~|4T3ua|0-A!F>(!pR}1pV9?S0& z%*2yK(kBTn6XYu#%)d{NuY{21+J*u2Qx=}R5l0JNAb6YLF9h9mBR5tM&B43eh+ATJ z&ZP#s5ph^A68czTA-?}A^eDlv2rd!4KybAn=L_n+R*>@&>01Tw6ud`pyWm5DjCaaE zBlv>g%Yv^8z9IOo;D>^r3jRaTVH`qVieRQ-o?v%DzV=Ny9%qO{1v$P*j}x3BI8Sh~ zV4L8@f|n67F0K~(Mk1VitI&4~&DWW!pYsm+j|!P!6AYZ1ZN4JE6DR7mTMOLs^G(dzZCpXP;nlD{3(Lx3a%2o zf{1zaI-zePqF?V2`ujpZAT(bXBwx>S(EF0myM+G-!S@CKF37izST2=_a`{5@%_7oz zo&+9G8upY6P86IkxRi)_`a&Y)*Ak(3gV5IqeZ9~fLfF-$r^EeL!iv@=ZjuJdea2^r*n+2Z~{6LVuFW~Vbp9r}q5$)jn7^L~a9BDn@ zgRT_1O8C`6&l0*$uvL)nTCn_Dq4{bCX}*;~{of>_{vCq51bXgR)~!g7BT z+U0QqbP5rA@`NrBx{uKPg&rn2TJrfW70b;K`b?o02)$6~R-rEtdackKg#J1acHSm< zm*69UFAM%b@B=}<&&6_if>9#u86j9DSS>hLaIxSef*S*U2Efe&YY8+oE*Xd0tAc_AbhBNB!G$*HAtud zQNyQbp(K(Z(Ew=(iWW5@Dt=JWVvANvY;9{TZ$(S3^`oWLDq7oeTiepswh1wcUfZg* z_RH4)^Q^u0oH-{4w72(tfA{|9mzlNK-fOSD_S$RjnVgw<<{?t_`x{F4lETiXw0ytv zFDTD%Kd}5I<^M#A`h9T0Kzg*&@k(ozp0D&mrPnFFN9i||KBM&KN?%d>HYx1Q!%Y^_ zQRYC(sfF&QF^=5JC%M#DZy;0&%+~Vq(!8-ZYoi}oD}^XtNaw@rz&5qe2wx8 zlwYj;N~P z|Cr=YQ94`c3Z?uu3CnL$`he2!DgCKZ0)$cSPfEGQv%O=KE>U`!(yNtjR(glh&nexb z^gBv_sPtD#4=MeVQm)x-uUKiB(&Lq$q;!VTvy?7STCa4q(sre{DBY#>J4$hxDAy@C z4GYEcDd#nWqfnS7=MjXyP+Strddz>BxGtBGVx1~iI+hf|B}IF?mES{(b`L23A}NjJ^&j*_Nzv{JdL71B2dSUmETGYKIf0CkJa9Fphkw!`=OYm5dbyr^_?MoCpsI{VV{&~`EBgV4 z(9;hhF5hf>KcTG8TxE-g9=15V&XAC+&kkfi;KIE0Q#K!@M;VV~9KQVwv9JZfLqs2> zv0mS&41F=oDdk;2b|Z(Z{UBP#7oJ_M9M97PU#U&YWIaRX3et}SHLk+mdU3= zF-tDN<9kib=7W4g)G4vUn0^jvnLMp=INNi|9dX`dJ}-16y?l7YwjQ=kZ+Y`kpp2)x z_;9Q|sU<3p^a(zvjlqg1UgXilUXN!1Wq6o_`Cgw@(Sm!+^_i zOCKM>3tI;^bn6@{b9@KSX>(7f$&+@d6$AsH(ad-l5nq|Z*YX-B$QSbPRlJ4?@+CZc z{jOnx{ni~*{F+^Z{hHnTeZdaG|LRxk`1=}8Ex|Um7XN$Te=@h>bR-+!hG*Ip@w^z` za5|E07L;YnwL2w{aB?#thkqG@tpvYq)`6RVo%T?U=k$J7Uw{d{2fCO~8E#HrA7q5} zt%p9GHbo!080afU{jh!f-DV#Z>E`s6AwR5dGxSwJhW6oK%s}6tkcMbr-zNBp_ECnL z)AuIQVSSH;>|?&`?|!7i_T2(~70l4h>3bf0Sl>SATZ}x~hfDuJ-#ti&?Ry-4qJ5O% z=Jf4AI;^j(D(yd9iU;}zWyQf$(Dw++-RAW1cdM|zimJ5#aQPJI>x6M(`!+xU?V}7g zr|(4wh4s}{rR~FIQK0W$t1pPtO;AvZJhwT09a;KXs_eZP`VW^?fj<5|h`(TbI}l8? zk22hxzBO6;4pgP><7FA;SZ^s35Do0(`;KMsmD`-Y^N|Sm_fVBF9T1{@_!&6RH{R+C z?AwRHV>^`L=JXw#rEl}}w0*d25A?;XzQ8_y+h79?*3IeT?`>iGwnN`$$k0CCWu_eM z_zB_z)dTzHpc3=looJ`;M_Kc??2NR1xD68M!!s)4KV-?a0QxR+!HgVd>TJk`?W=&k zP88C*-2PRIc|L2AEGo#Hp-pi7*Hp-7lyhti>E=3Yq8td4{nbm5i;9s z4fXdpl)L`!&eB(h6Vi5fa)O*w&HGDXeWupl!=wNBzn;_Aig-a+g6%KpM47h1|M@7F z!j5MXE6PG!n6YVlbeQgyQzxBtqR78Lru#Om;n-sK+&UH@IUamlbubdGIv59rDpr7N zk9lw6HF3emy|vSLx4ita5kDE<`FN<@)Yc7qS&|WjZZ%(y8QG(?m z$cG(48vYN`up72->Vf6@8BpE38vX7<&B%nB@XJ7H(_(W$lWI6r~*xPjPZGXGiZfdNb;=q2V&;P5u^w-(hzN!6<=`Mcv_i(KI zcH$Rfz5&O$Kjvx_w(sfR$cW)ji1!kZ&(UqStf}&^evzyQZrnf-#!`+;I5k z1vjs!Bi03bd^2B8PQ)<&!x1z2Wi}3OgunC6g08Xf3w{}b4AzKZH_zvGkD$NGZawJr zyZsgKjg1-pYKOnL_x9KIg3(VO70Fno`9v0P$2MJV$2QH2pY3`D(>BN6xaNsNoS)ow z@7^Vt>8}F|d)MxrJ@G1Fl*4}!#HW2zc^2t3eLqmGaX~aCg94`Rwgn^|*bhIV z*5J7{5TY*ts7$h0>&)HBR2_B{kkCvEXvtIyb`+4T4+@xS$BqILnrUk=wG}%GNVW$B zOm$#K0gkeT2f>;+uLcFR*nyx)vKTw{&I_41uMU|s%oZ@!f*mzTXqYWvsvSEDNNAWX zU}`IN6p+v`TfkHYb`;&Ajwad&tU;8^V7CQG$mR?slfn)SB)cTJXg>&l4>-(}iHnrXM_XZG zxvD4)s6*O1V*%~5-s`pIu`(aBWRto%1!Rk{ zqljdVBo~oT%VDNLsVyRTM3OljTOvh*cW$L}4$?T0nonY-79%B_GjR$y76D{<8&1b| z%Tc(sS78lg@5Y`9AIqFw*mHP;71(}e1?JFzP+aE1fek~p`VO)+nnrm|qru{T=DciR z(*VjfKL9orxYl?YmbD-R%bLgrD=oCBvPp|P+b0afiZ|dCq*Z`e`+C5ZMW_u24DCrU zr5{Z!EIbX#{sC;Nv`t7@MTaf6X54YckbVdx2MQYkZXINiZwF`hD*$XQ3Hl`%tV4pP zgdJ*|QvFAT0b21WX&AiqXhmg(xyKB)0If(Gn$PtQM;OQ&#;gm7spJ*?k(j%<CnfxEC4)BTinDS2j39lPsL=|5aKt3r;$#c&%$j> z^MF)>g4m)$K09lY?0=t$5NVE`QpCsjZer;)JgI=Z9Za7ZFDgcwj||368(VZN(o`Qi zeWmHkuBSeQl8EW|H;{OKIxBAaejQm-Tm__1)C1P-he7hrFMJjyCiz1g`?MqHK;FsH zcs@%%WE&sF^t6;TUdi;SwMAEevhlpr_nW>0z-Z&KW03wB_Q*BS3qbPY>C&(r?Iyub z9p*17oDE`<=i=DsJ{%V3r+c5Tz288|Q1A0kD+%>DY7&n_AU?bB4iJ;P3&%e6^^*9c zz>)DOwlB|6@`SV_<0qDeRK-k!(1Qhyg`FTK*@I)B_i$KJaC)GsV0v0r!5L{)1v5%* z9M!;?-cr7~65S?o)CgS?M|Uue@^1z!vG*y)UjGMiAktNII~^K74Kr#b5{#Nl!Sk!Y zEg_z$hwUN02|O!0`76M05AipE?+EdHQ!obEq^$3)&#_8x+trDrgeL_-8b~)&{`9QDoM$BQ_&34H@wnc1#EIvCsGt zDV0G^@LR?Oi|jBB+(>4ll*+gz?m|ZFY&)?MeDpK#TpQ>Eze{GVh%)jEnKA=kqk~zAS6TZ4g`ni2|Z@ z#@ThQ9RCNo&AoDop|rJEF5{@9SFVR9c4z0B1YfU-eN;ML_<2+`N!}0`#I+?+hO)eR z@k1dY4^5H?hl4ov6DOc7zezk__$w*vWEp2=;!Kpq=gB}6{#nY{`$3#$iDf7&Xq90o zv6s!IhOnt(%w-Mnf|UPbGj++ z77K#T%1lN$Z$j?taFYaikb4($-|dyV8@asd&Xj!`xxD1g$Q{5TX0vACTS&!j-i)Lj znyVpik}@Dkn45RI6v=={(ZJEj&A(G}Wh`v&smP7n*)PLjbBW$v@MV#e5s+MQ{$8}= zEuBGU?z7HsgRHFG&w5omrqIe4Z|6^%>2p^x8vH6eC*!s43RrdH zN23PkLIJ@2IAU{wtjBS?4db>9nmGpw0OohONL(Qj>jMd{;dhIK)G*0EO|bAX=R)Wr|Py#@OrMP(DTQ>5yauUXB0GZYHnXk;P*IH;{?xW|l(4}Z+38ku6iU;%^JPZBiECHpYJWxV61JZsJKcVc zLTNuoey_*!(lB=!uyK$hj~Vm9;pg~lphd~LkbsSDk_Fj#;uSbqy|Ob0D3G?!>n(0O z)jNOrnpG|9+8PDuY)wmJs|B1}-nQN}tXs7T(0mOin80O*{^0?GL4qjjtufF7FL36q zU9+xrdE>Gm+h9`iDb938(`uLyAW{mK1{xEDQ+YU5oFsmgl%kB)FK=5{-)ueT(8&b0 zQt{*HR4xPnvNZqGz{XNIuk&}-FxFTybi(JwLUD-iK)Sjp{s|8c3YLWOc@a@vl=_5s zedIbH53PmE_DUU;-E7Np>bp52Kj1r+y!a5jvCRQ?nf$2c%B{|v7-;ev@pN3&Ma{d= z@`3Te{u_b3{s%yf@yXqP|H29nToK+2ZVcgs;qo&J>~QV zvf4DJv`qx_I*_TfsgOEF0)x6tq%Rny4HDG2jqru7O{IHSRs`^RURvbm#*39C&H~!cM*mA!$EW$fFp(OM07NGP_UHFNz&aj~ zQ~>M(mX*Kl>e;bMU>GTTD_CH4y`$_+V2c561iUG4PF6FY0z6i60{BWjK&mS6KSLRS zK%r*L|JK!LsS~JGXlb_>sqolVY(O4hoqhyqH25&YgS=;vhgKgC=RJu$U}F7(YW;$@ zViWwjphj$xU-+o2PJpHdAv`J1f59W%mNdlNuON2<@TM|zzkyu9PyO242pFdhFeQ2Z zZ`ktL5rLZuT>UaSI4p6k_;LGHZ~2G3$O6ybjvDCa{lJ%+?AOjdE7oV0fO5r71{POD z`F1#Y3bHMak4=r34NNFHXj7IK9{{FR2_Us%7>geO2@7apZ$^kV1^aoOSUmUPwXUC@c9}QTvJnkv~WcKs1pS2W=>ex%l;6@Cv8qfUkQh(-mr6YSJH z{|lBSz}ivp@!7FKfOne%h^h^tcH61_2{`nd!R#W<^i9#WqBX@E@hy zh-Y;&{-sZEzL^ZZHpu8}`el?4Fn>q=nxK4uyf+=N_zmxuDBmAs3^q@N+T&BV$qaq@ z<{gx$+silqnIT_jehQwyhuW>sJeN`4*9?Zfa#xHsBQJv=VDJ!)+(@({z|R8DJFt%b zCiur43;R6O9~bcXrW55;1HRCF8+^LFui^XX+-QS`Cwt%GvW1O4^2~5ayTku`e610# zX`z0|Q_S!Mr6Vok8{WW5Z@w9yW{~pDM0qdXW%AnN5k^dde+ioL|JBq`Q~+;hPds;PP{02iYeeR{#wrK z7vfJnhm$2YULWFp?@t8J|$AYqz)IM*GZ+?Kmb{t-WXaFUySTiZ6-v&}V z3oi9OWbX%;PPad@mY!kbxOA3%pSKjxL%l@#d5ZhQ=cC{s@+nft@kjGgObV`n4u|Y$ z8q3YuG1T5EDV=HWES8?FcwU%P{Bf5!Q@cn{WhHE`9$u=L1Ge-m+kfii+Fd%|_KUpq z3lG1yA)mbTZ<_5N`CBMI!}gQBY)*fv`VmhJ9H88X?VZQcbL<^Q;;+TouamIuke-H} z6nfZSUw)%UMW+uBcXMqog}z$SDQe#dYR6=IXOw<=gyo~{xuR|i7;a7v9@gd-IiCNs zfSwFHNUQAsUXg0pLmnpubiqX6q%u-8D)K1gO3U}xn@Hh*#wjV+2h!I`;oqat57Ki; zp-galKtG2#B|j7KPWpRN^lum%Amutoda2U8m7Wx{`Ae0qCq;k0tn^1p|D^ONtgkGe zs&t{!>y?6-NEv>vCLO^w(o#;5NI7nwDUTu(8IGUDm50kk9w9Dtx>8Ib;SqvD5lTY& z!#njaQ`)GsS?Og;H!8hR={BW1m41;F{@<bpkiO-eth^lqhJQ2JG+f|G}OdzF7yDX-7j?%PWH z;(DC?aY|<@ts}*HcCqr8lA<41C@=VW;BQj?Q(AtP@?TW`e&rulUhw$P-qXrIr{zCW z{+G(XtdyTkr5*1mO=96EKSJqLrROMZPlhtWy}cL_W6u&{M^A3-$kl z6!px69FQFXU2p_!2l?^6UhY-ohII%F;P%2Qe8wiYOJIMK%)A-K8#TG^j%DXnW=aLW zUTU_*266XEw4ogL(b!y$Z2Jr8VM;1<<);nEt?n>)tk`~zTTI%1?h@Pq?R|qQ-F}Wj z?SGDYX>317wzi+Uq%v2Hbo-%7|2{U$2Z}#?Q|t)w7ZM0zx@1L%eBQ?8*)Uv@{(=@f zg1g>`uFO2#TJM!-Z}4WyFUn(7<1&m1l}UE%ntlvPY*6=Go6DG`Ads$Q4 z@|6?X>Mv|=oZ$K%+&&B|e7`lo-8wwNC}fDdpFSH!N9s&i;{CMQ`=dv)E#vmM&X>%) zstk$D9GxY-GApy>(xV-+?a-6HSp`rINCm#vM>6I$0CEp%QpF z0*ZrNpyJd|kVB5xxE{tSIM^0U#p@Kf=5!nW?USu9j!Z*bHeOGJH=MR*tA{|g9Ir9l=H!+_4wrDj zwg5j=@Y<&mJMEzydHx>(eF4q}uSb~gY<9JHJ(QyzxTMLjkH7md-?`A~8;HEHzHK4!Wh4_cAJk?OTF+ zdy(%pr|%#VVSVGEZ!CmpA7hDf)c2Ux7uZ*dfn`2rxH)~qDGuvf5VEhI%CR2*Uk=+> z4t*WScbn69N0z<@=&OYg?Hhoda@4oV>I>{6E)er6!_DdA+Ye#;_Jr)?*gJjCqkh;v z^6r7kus-5KhxI)LeN_;kef+u6>Fcoi0{a;3w9ow{>Fm2ZOJ5W}kh$??3_E?ZkqFxt zhrYcicbn7qVI;!#6+<7E4zUlH^?|;lt-ip%eQFdW z{u4jCTr}B()7PH89)#?}zng(RKE%%cB8+8w8~SQAP2%+V+O8{_2L5Z<-9{bU-b4Lx zKenOW{mAFIjlfQQ93RTNI!Ky7;2*x*Lm4i~r+rj)3-cJ-?WqL z3vCs>(l*E8^Gt&LB$0W4e4gkzVnBe;GZh{ayqzlIOKk1I%GizYOklz2-aG6}{xsZK z6szqZ7{H~h4#*dgKUCH*2uK3nXJ!P;3bM3Wkzg>sEw==(N*1<^I8GvU#ulriqnN&NA z(GO?q6g;#$ypoq6Vl&J&5L;@XFvzR<&XWSn_r zKY!)ovJnTpvc0c(scR16{cWj>rRg=c#kz4!M`NavYNol8*u7qsd0r|LEx zEI@4Lq0bWI+Fz_6LsKc(j{HC$%GidR7sR~5HB`b>Fiz)pV?F~;-p1zp&7l}=Y5`^p zXm%_}{HJ!{(;Ky2`KH6$7Q%BGU=Sa`NeZxdMs{?ai8;mZS#aC^KzaL-<{ZFV5T9Fn z_MU!bw_lOOJeuE)IXeKjT>VlOb10af#Au4t!hdC4E9Sv}CJ}>g{VMep;sWF81LG-1 zOeD_zFg6nB_Z-ac#SdbB*8wkQD|G2vv$?iYaC3;4QzLWzQ~cD3%q2*=y`w8ywWa4W)A@3MRWuA(MP=|`s;axv^vC#_p_gIq4}ktiw7uK(uflp(+f`G= z`Db1`5W*@-bzBcjoh=8Wi1{k$NEq!8`-(n|gf8Y0lSg7g^AXQO|B|}?Aj_g;9cyZ8drx(0OON1f0k;g-k%>rEN7wb3zf~ApTrS)ct%Fa{FX9x1 z=K|&*y1u}kD-7mf>ZdPxRSPf&fA*4>8qtY4EOT%hbkTo^Yw&n3@%stU- zXiGZ2YuJ}-o`|#TUe}LZ{o3C+bNs7$zdrlm8|X(L*cz!zV=nQ0!+!ZPHrsnPcxlWf z&L@r?*PU2}>x=0&kllOrnPMaQKlI+=T+ilV{4s~kjvmG&))9$8_PL|qj-KG$C+*mC zY+f}YqtW@4qJ5qr(!XfV0e(XTR!T5sZjlNL80%9J^Dwv#gi9ZiQ$Xg} zB&%@?TW9OeWnKO+j~GE_9sPG(P-!xl2_aE)c=iaH#e#yX^L!H!EL z=R727q>XclqfKJ-B9cAWBj(B^DIfEIup3Dvokx&_PT5>THQ;PRGQDUWrcSz{@Pyh6 z<%|{xq&4=MCQhSo+Ty{;3*)p3(*{NRV5u-poiNtGv@e>Jpz zD3REXEVeRfUH73?b^{T^uaeOK29It|7rjWSh^g4g4*x~dqH(OZ^MW zb_o=qk0j;T*?w)W?v$dW47+by;=KxyFNM%TnF{Py3sY0Dqkv>;P=JJNVZ+Oi13!>B z4Rd!g#cC+PQMPcMkV~x8!dy}`9t$T4^NU(&ZF zePxssTB(?eT@`k$E759DtErdMX$FgYb7}85aD|@f)rE9XFS}`wZEXR~;pRHN2WeZB zb6nXi_?Kieb{lg{ZM6j?9oTb+Gz#>RWiCgk4m*G#S$&&L;wYQ5hRitZ@D@p(Bp0j% zS&yBK%-fl6U4R3vre6JGB+?_9A;g>w*s(@AHJJjgKRFgLHc=;adwD8d)XNT6#JE6Z z*<5cqPV5(e-=e(=DQR6%O9GRR;N%h!m`hS6$@56q+r!N2Vkw$OVo%zONNj~(rvjAd z%$z?K$r|h!MiN`0*95OX5j&pgTjsQ3M_s!4ahu!=@~%zdD4X*S)vyTu*^R~BZaE5f z9jWlXBNg6zq{5C~g_~f)E!cB7wK*v2<-T;SBNPS8KrZCHK|r$ei%u#05PlT*(|~(` z@v*sMhRhmJhO$@;NOu$?{#~9$%F73wT+CLDXX4})gfa9IX{fovGyq-FLh1E!PTf6a5kjsn`E#uW~>?uYca+!t)EygLwlWQbG|0+v|sz9vH&>8~VCzwp5p^REQ|fSMs%D0q9ecxcE3>34v|cNAN)S#(8dCN$sC8CZYE<`T#ONUt;hw4m|)Dywex9O#FMGzhwFx6Mq$yuMFkS1@a>3BBmFb_!!VHGEE~QABWU~*yB|NB#Yyx#5aKQ z!aF|A#6Jc47}KZ5<9CBT!!#iKfWQMdJzjW60L8=1{B%~-B!7Y|DXud9=UMDU_?sgi zkuR89K(eG@QqWSt6x)(~8Rmp^O9epmORL2!BTnM)Q8_WQfMiMH^gu^qdRj-~jI@r# zj8YS+N4*sG!ZQj;nhVptEYw~S9;h(X%fi#f#uLb6d=&zgF>MEi^g$FXz@D5@Kyn~? zve@w&vp!_);QtKCX({nqG1I5k#?L`H^(BF{n0yC}dN9IIh|C17gia=0qSwk5%>J;nlwUPZk>%sr{f6RD3#NY^4m`W^9PYncFu=!udpxO_ z;%(441&M)Pt>1=!nTo%J3|fhdNE=iQ;*HTh?+pGT@&_|$Ovwv1 zxNu?fhj~RQzT{H?vs0HKQH;ch+mINBgc;5cCyW0py#A@r!n$iI$k!MMT9x7txOXBk z@?IRuBe$ja!Q>JAn)IVg3`8^EW8y}R4LiC-bn?`0hJz$!C}qtE}6Ip+T9UP0;` zkO?AzF)5MI36WlrV2Veg_PyvSyb0Jbj{oI2&W9qBL%!NA(9H5~uC<mD!RU`OSxJG>*D*Osl49^=DjvO+xfRSE zdpna2CXXOu$8t)`nQ8?R-tor~@zOuUD(Zzp^uqDHM)eb(8S*F+MazAedz_Ag&%q$b z#2mahNbw`sCT~8D$8wp-lLMuPe4o`{v(-6u?UWw!OJ+yYGdis`JguMOoH{pSTG!fX z{c8l8%&NI|R^`EFnN{=btQrSiX4U-6X}#bBP3tHhGVw3APLTn+L=i5=ZPn3dH!Uy?!aaDOU~-aubEjJB4NA z80A!FJuwvtZ|N&+?z47v`8@U0z@63?e6yWj-|{=W$8o!(bO`EKlE25UD5rz}K4kpQ zc{8zem$iVGK)F}+6%WEK%`&vYdC28Z7B!yZy`_A~*WX~9{RXN@vsda6fR|>kvd#K1 zUYfm1njOUtYcpz6(B$8W{_@M@MD9#|1&NE8Ab4Xd5?FrXe2-(qvB)4a--v1?KFLHE z5}#$_T_nDYM87>aR6(aH<|nszi{Z7AD_}mBjwqK3AQZ|1vQNs0TgYYP3SB^6lH7Tb zHqGUlekspH^t*v#E9?}pk+M*3xDl>7{JnuS(5Q(P)9tOJsmD(2wGubtrZx^vOgyws zChI8_zU({59W8Tw{S4Hz6Z>)zkcoYTBxSrlPQ_zSW3_E2j}tk4g03<{W}u*GQfN+P z&Clq32=qOcW8%e{nLbWJd38G3B1vhH;GccRb0W)9(pMHE8>;)7{4<8nF6J)`9TEHns{T>4R zXS*D`|0K>aqml79?5XuQ#BfEQnobUhiAUiuf+5D2c8mme4H6tmoA|pVOfMDdtrPekgSYf#I^lWiggel%tVutxYtpyC z%bN5<>x4gmmo@1}c3$$oAUWCWmqn>GiB&?H{125!xitG@EB|Bg;?$qm3HNpI5>7AJ z^6lWo$v>5O4kz0&IpFc!RW=vJ;^d!OCrcdtr?(fb7{zs~8HsZ2{z0$*0BVR3z+YaIoXR$z6Zi8$lS=INUlTDyUbq!k{_vLA>a6n6?^iZ==~IY zwDKinKgZ-4uksx9`3a^6d6n-Xzdvm)@Fsbn$(Zj=ei?=1*<1|vx_?4rc`)%^lyFgs z<$G}>ie9IpGd*edSSlLr<(@2YYy1sSKln z8!xQ6Ii69(ji*FzJV$ZcD@QE9p?3cl;G3?hUyk=8W}dR-vNf%jELmCKx@yhp%h#-3 z#+MkD^u{n-GO1z`{wgb$5GAW&nS0*`^&0ChY#M**N%h1CJq%9hYJM8Iv7yXCaRyML z_01QpX>Dp-xe5?_^6C!ES|+dL;hm$l#@5yK&1NO?1l3Po10tYbQ-cZN`d!%A(AK|21Yn?e$)z$VCKE0pw%`!~Ozk^3M&L^2@NZz2 z1}{DZXoTw0hE^b%wOUv~#Ts?a#=9|T@WN$l&6<|_h5)_Lxg;2tu;QSwxxQ`1n$}gz zu4rss({x3n9YpH2?^SX*SlfK*(DKr&4< zUxFkXv$Dx7Z*Ht#orOLb#G1LVzCn-`L-xBDz5>76_wWK%-{1;N)i(!&sO3B|JUD9u zNqxsLkYsq%6fwGORf~mt3>wlG*#eKlZENdSU_@6nu38T1dUK&!Z5oGE_BC94-&Cvy=>O)D-}(VSY;UfRzJy?U$D)s?Hl9KB?1HwyJ_ZLLig z0^W12A&#FBtkPh%tX)aGQDXd7o~W_SFi`;03!B>3N?bCJ3`ClnRy4LXt+L}SA*C6i z>P>(^4P3hR(&ha2`ZCFES<~FK{BpByZT&@Q4Z@)YB5_jCoR!4XVs}|zGuq6G=K71$ z+3Ef*V}V-1u1c*?ahqvav#Opbh4roVs~WLJuI-&;W68A{s-3gNHknk4zbsA?C}yjK zqmT(uik$xy_@nN`&GR!)?hbD>sV8g_%8U*1Jn2^#<-`Mhgy;9{x?!Fd2qht1yigD< zQ^hNF7Z4QT#lvCRX(^+CZhJwq@Jp+U>g*-0ipYgWby3+Tyqh97`kSLS#IDb~E`L+J zx(IjOp2F2p)Lei|o)3&)`u`u$(SHNCv}yJ7=5-B?OLT?93n|UbTuz7xilNKGErokI z*EARN16NiEq%2rbu4QZ1Hen5e5>(ORwQa5ImbYbO=_y;!)@w5XNz*lR;+3Kp7co#5 z#jhID#7T-06H>TT`>mvQ{FU*-1rHw$jojiy{E#&J5e_jdG&YkU7&i2pU7#ou3Pl5&KJnB!1G#qld<~;vP=zxDW zkW_(ETFF{(#ro#?Cqx!N(C>?Ck6*np)<4gG+5iwWerar=pWH~$PD<53n&+Q2+dtt^ z>g+o^Rz!RJ2T=k1euK)pk?xo0|I}=ZjrgWitIXR3b@0RNyl=&Z{4q8b>A|yOBl2bm z6zCVPhR&a{>it(gN}FCZZ%MrpR*8*5?IP4Dz>lr|Jx~rP(1Voz?9~+Wdw>pG08Cf7 z$loP)pe*%%Lxf?3Q&Iia2<+Fv`ECT3eCtXvq7qupjkjeD)(bfY>(??^z!%LEoY13S zwErgpt>$G9_U8anTAa8Jl5kxf=wq>g05m;2&;Rj;+5T7kZ25meb3wu{ij4E}HpWKh z`Txmb-V6xcWS;+5jL#5Yt6qQgqyFE_qo5l>--1~DGHB-z{V`T_J#bEA71uc*#!dic z>pQ@bE%I+-Jmo!>=l==O1h0MqJ|rgUn_%IY+da78_g6iN`1bE$`ae-C#-yYW%y;|n z*Gn57jR?qX5W8QKPR4h$m;SyDF!*sFho>ym>bC`XHQE=d{=l-i5-t@$eVr96IV(1Z zp5dGU1n%6~Q6EbDCkedz1VC6})iXYTWWNbjX#Y93|1jFmoI5{7`@<9QOY{8ufCPKM zXXiHM`CkOQtN%-XHWKW&|7&XfJWc3?NyYwqoZR! z_Td#D&b>BP1RL*!GGGe7idKsKYv7>*3=|fJ$Ha*livz6xJuSXnEq3QRM~}zq<~HKT zJ{sb&5E*_fD81#IJsJF9b9)AVl-ZEM4>Kz=_>pEy2486StKADh1BIp@d|U7XKp~z2 z4+@d!EBIaMoB`$rl&=irk1`(v|9BuU%zT9PgYuDPBluf_@o~Tg*DhcGscXU1=?PBM1U{LuM=|P^-d&syW8gdzsH9iW*gR{Z$@VE;VU$b?r~Y= z!eUx zhJG@iH~^&WO1F}p06b696YZ^jwtt8`=o_T4qZoFwUIpoB8}oHzvf9T*cuu>9pncj4 z{j#}!;8s5US4wAdbNP7bd>2^aaXv)~`#MQcpFbv&@_`$cb1t%fHKee&ffV*}j?+Fq z{NfKlC2meX8m$J)cJC%dy+=q4Sd=bK9T2n~6``veu7M$lOp59Y5?dWX_i zlnU-A%0Gt&DfdUELt>UcU1_7z$CP%FV%!pWmdbr_@b%;|Zi4d%`X%xhuUC~Gop1RW zO52n^Mhd@oDb0^te!S8erMD}6K{ zv5^s6i@<{-1Wcsd-t;ApKNA^_JMmhM5EHpmmDVVgc!BT*%GWDhrF5gxPbj@h=@*rL zP3dDwpHX^1X}8ipC}kYezCxvgm5xz5S?TFY&r*7x(&b9mDdqED)VE3LR;7IYi~0Nz z8tDs4f2;ImrF=4r<@|OnX zDt%h%kCpyL>ED$`I1fkQW|LChisQULlN6`l1`h~diN@SpYo584#&+g&F8Zol>dp+E-imed0DSe{;u-8ly{I>&O67XPb>Wor7tRdMd?43M!CL1KBe?1rR7SO zE4@Og;G$w(?@<1$N(BcMe*2d4f`bbFhsp~MD)`?hFF2@Z_aEe;ZwS|G@S~JgDE*Mq zGf8p&SVRgvA5;D+<@qsCmUoci{Bl1j^gXQQk1Ee+NmyUb6Da?g^1sybmz94_`FE86 zoAL>sFQ8xWQgL1xP9A#3lR|H$@~0|4UHP+>pR0U5DeAA*{L7TKE4@wWT}nT%beGa^ zlA`{TN`I^LPfGjq{DgABNd>J|el98OU8;1Y(zQyjQhKA(ZAy14y%rs(mbArp=W^7VM>ozI+YaX@iUY^hZOqfDgROBFI0ZD z@~z6tc^>i`mH&j6->&>;mH(XbUse7g<-eu;ca{I4@;_F-OX=@4|4rrpp)}gZ+TTa% za8lTFoYIpt|7_(KDQ(pJE0u0n`l!<9ly)k8Q)v>96wsf=N{?20oYIq&&QiKa>2jql zO0QIUlhRKs{j$_hv+Tk!)px*1s)7x z<7PGCYzaw-=W^tSP<4A_*%Hq4FsiffY^P0kjr5ktiCueG@zrbE8Yi52&cg9{E@Js5 z7EdDi?U+uZgcuhhEQ1FIOt=$)Q5jf0)0hRUtr%O zD5D%@xH)}z7a~L7l#qRFhjOg5ZVB7>cF4ZLA$?!7`U3m-dkO8M3^%8b z-`xr8dpBesE{g*D{sQB|_H{skdr&s4?`;T$_2ErId5??nhs&x!-}6>qU|$Lg2<@W` zH)r3zEPYF$&&^+4mIeCodEgBDN}z8q73t>m-H_GaX6P$}4DG|eGl9PIv;22J?V}7g zr*C1FzFR`}4Ocn#i@%?vE5ZEegud{D#ZDjJxC{I5Zs@B*J=!-CJLRZvhSeAN?(E!DX%eTe3<>tbZBtPBj-=z#Wu=e{xBEKU zeFGKQkFnUPkL_{~>w6Z9#!hEMsO&2c3d^k=Y|L41F$l?h2}0p^Upy7R@gRfk@?7BB zy)#q?N%OVQ7O#V8Zmz96kPhqHa3=bJJn9>d-Rb)h(yUW~o!g8txEFyjb{osMuT$#e z$|vAADkr36l#>@}L-|)gF1%5O+jZD6#4W<$Ksij|U~_W+u<;V)6PLQg6(X1Y;KuJ) zh5OrFWBtPZPR8!~`@1ZC&*Ox=FRQ=Q$M0f=^}P#y_!Iw~5Ykr-#i3z0+fGEMv<(-h zDacQpG^MgEv{m#<+nfOZ_Qa_toG3EykAJ(h9u45Kz+S_Q#WjX!-Z*Rgt7X7O+%_GU zlr6xrYzM9&aQnPEVoVZyc3V%W*@D|gTLkkqKaqbhKT+GAFSlHPA)4ywGFl!hL%PCZ z8lr3X$q;yWxFjMdrhb#z_F`mhP{f79XWr?zf6NW8=1x*dY&N}T{9=_b}`eqBdD0}RSM z=%oFo1=xw$vu#G7hSDzP=hvnVqFumiS{`@2_>i;9Rll8aM!VzJXq>@r7ia#~jh$ipiH&Kt z+BV~LTY3%{)G<5pGUt{a7k`*eLn%j_X)kSJ%tgz#93&Pc^O+|&tEQzJOZYD<(C6#T zf-cOnV_f5(QvdD#YE1n12>kc@R*f^XA8E&W*3r>b zu$AlCojrTd?=tgg#8fTkY~s4APPAFujZ@l9r77fNu6kwv@e*SCU~Iw0uD=6|ne!X# z_XYTg>@}~}bbGZ`-SH~KDPqH5?Qpg}RPpmJQ@f?7MPs%ZIJ?9PX1SNz`HGAg+Jdfx zq^n>TbnZ4k@1pNa9mWLX7_UG~x)_E`;7{7G^9?$^M?$_h06#QiuM7M!UNFT=IqzB# zPtcR!0v}X-x~C)*PmC?>8S%6V@$_EYber2v_j|QZb(_4ZZup?fe5$J3$L*p5q%l8$ zGGowpU^f>)R%LL_gM2UGQJ#n-H+B2KA|^g@M|5u266kLOJ~7825^Wz)jkpzm)akr! zr(YJJ-_QljYn&r->(G{6U)KqY+S;zup`&>Bj-EM)_d+eZ5oH+5F8ptC6K$xe!`i2I zRY4B+4gimTV;1(qGXz6f&%+o7IKx~!F;~3kmO~!q8|GB7{=A@LY3tar#O2&;*P%`P zl=>R&qF?ZTh3Iv$!G6^ktdY=XVp|STKj+?hjght-dU>v*Z{TauRSVl~>}=}cn&f;{ zjC>b+jvB;viN*-$ODSXIR(metdh~f>&LaTZ5GO0KbN$)pV&;K7iJ5Z5%#?@h8dSKO zG4q+8vQW&FB8@#GW;mBhbJ~NtA$!V0_DGC<4l!2sJ&l(IUFM56#u6C++%dL*@3)6y zY(bZevFkEo>XTrwpg06>AhvOHHjaq}cjE${W*V{4wTWowhqVcgu zPl$X+x7F3rT~Ma6 zgtloz&^~ycGm7iB^h{MdrsS|=da|XP{%C*iJ-eROb#z^cHpZdBJ&39Muus807CX1y z55ysw#$4t#FV04ws7UAhtp;wNF9#1*uSrqin9lIBM03f?g(%MfNl) zT38iG_0mmkAt%wFhe5cUB1Lma=t?3b<_4y=g7d_=4fNdEkRTm;9o2xPn+#KwHS8NBdigS*7sM}W8d5@sN3$`wfvN^S6LSeE2 z>|y*gPKpFvve>$xb-9IgS*iIX2e9Wrl`TW|N+~*@WIc9t9Y?!4Wz@iSP(}~Q=E`WL zwV_vZP_7(1CI?9cG#nmalZr7vNSt8qp|^tb!h*SnJ|!CGlZ?ylq%suIG7ddyjij%P zk|w1}uV^Vl(G(V&)T>yiWb<}1rwTiUi@zAz=6d;KGbA|tKt1JnP%;MqYAuRdMCv>e zN--Rflr8Lc8%K-M%6c`)Ds+IZPk)hQ&PWXfo|U?Qb-B3~nJ&Su>ywpQ%v^3^sbcUt z>GnyomtA9#eJ}Q?>393pJDJ)og0+u;JZ_UX%H}jP3Tv=)v`8DUV^PCVHYZjMj>S39 zEu98;&I8j1P$w3mOm-c12%6lsOAM z-OKDUHQNREOW+Ym#iZ2WnU6R{%%;LloBa~V>yixgQv&s5bB-Bhol5Ix)72eWr$$MioC z^q|*DP=*TZftvx;gFr5=0zGrckYR? zQd(WaRyhqZHvH$GtVaex@B)Kmvxv!VxSmeqE75N7J2$SF132CHZ6e>=X3e9Bg;GDvN^@|_AVmwZ z6|yaMGjwg13ptr^yR!xW{y2uwwZOVji;El!qu=HY^kxkhga6(0E#h!I4YFLo8!?GM z82{%MMj>2SXfc(OW6?q>WcmaEx)3P}0CWoppbMH1U&50^DOkgdP&W1PeQqsKsfWN8$fg z0guM->!vgWTrAklM-x$*kjBRZ(8rPwlw=EiT;?#3hf^&jM_8C;sv8+Xc`mom#mpX+ z?xaO@9vya+%^H)InKi&>jZI70jALnBx+j26ChT-o$*0d4LPL%ZtFYL|<6@??FUtU( zEENUic|xe7&2^rf7dhFp&IcA##cV zl0;OFB-i5TCvU(pn%s_KEXkXjdCBkKm~U*w*lB`3Y?8R~gNkqA7)g4V%YKsQ^JuaR z$5@hYpX4REp5!M9jT}#|#IZn?M0X{x1Z$F?#L-LMhhxMf#z5Ckk<6Q$n1tl>EW0fJ z1W0})QH`9}S$JB4eSe9C%VVtaR|*t+2_irD!>?|6H%h08#_DZ|UW(krH8@-aKEACF z$*%aSqT!%a6klVCMj=fP#@9xRjzwAwUKcMq$E7bVF5)9ClE1#JXr4=7KCXzbu}JcebthpWiH*mvgksW-q=>u=+f7=7p-*Z>uxFHZFkXs{q~~O zNQ=#z?=2!Us-$ne&m`*Mf-{g&@N^%NWWnB|xY+Lw$)u7~K^47~JKh?y<}xkTE_-A+Zk!zSa_bz7I(}y03^B{Cx8?`kX1^ z8?Fq===Y;0`g>&he`KwH;&3x-J=uq(qHsjfF4X!o_QFx7=tssjBY(;ppMbPni4OgD`)iECl@gHRk@8T}H7PXpt8;wJ7z9|6gu`|@e3i88xi z^oPvl0OYeHCi zB>InIf^RLY!ybLC4@olmunelf@)vz1J*d%dMvK;{mO^vML59K>Kve25`G=$Fi$MhO!=4P`zj^I&lHf_14MNBJz4moSrqmY7{imM3Mx zLnmgRnFKor?D4|V5hblSJjS|bi9p>(nC1<(%e}ni$COv{%56(uY>tK zuZ&uTvV#5jos!L!cytS;&+$YzrKK#_!Hm9^l{Z_(BhXb79fPA!HKRVovR_!mW4{C@ zn&(*`$Q;-WX>TdT6PsiXjDj`aCwpBXVzPuUqRJe&Ugkg>SeXOY%N*DN_9@)IOx(a1 zp^lB*R>8ZOi5pl5Zpx3yZRX+uZmP@x;f6kmiZWeq=4oQ+J2=R6xrsK|`O(o1B_n3Q z;weasBu;T0K>-N)xd=-F%G(gLFw4q*+>u$ci37ah`2oLP9%u9JnUs82)T?o7bW8I@NXl7h|9wxST+Q4 znbT~lHgj9ljEJMOLHM*WGL=wPjqL>V-r z`IY(Ta6cWtjVQ{e1I%bVs$rtdwyX+O>^g2kl48gI6#|L-=x=YJEPD5G(X)%_mpLi} zW!&%Q$POINb?+-2)`2qoyEvwUcydqd=7KlqBnmu8*+Cy-@&TC+(Fc%`xER%jAk%A= zkmDrwmY%^F>y(f?8fqlux+LU23|4~bpoAPBEtIG_C?U5UtQgj(-E)Cgye1 zyrJKMs07)|5@c_Jl_2Y3tEC+D8d&x?_Qdas#$D6yarlq+7I5&7_7-yJkM=H*fgcZj zI`Byu`1#0?fxiL?4!jN33M3>{quHU#xNxD0@eGYUQLq`RcFkj`W{tgsZW1;#LfX(m z@#%E&KkV2olr&v6@FFJvDWh~1lkf3+cjIqhGUD;dcKppudmcqhbPh^=j!=|?HGz3? z8Jh-<&0vrECw8EJGB_n3M`z;G;AM1%cpQLyEO;4|qold=#hCSq9*zAG&j2FG*(kB<#h>%}cmR`e%_^6GD zm*8%Rh-Ee+`k;zLM4iVdoOmL5iHJHI5zD|!&+5hMiM-&#FAeyI!^-~x=1Fhst^5Pv z@dYW9xX?z}b>JhGXWUNw2>3U7V!2QvtnxF^FCo_Gah_Mc3tmF1LF}z0Muvpk3LA1? z2QMDI$fE~NkgKuJd7Y>`>H8R{YBX{;_C$+Ugw@~xvW9U+yoAK$H*gq!HMn<~xC@Cm zy)WmfVDcAdP5$x=Quepz@^wf&Lirnzu(8LB9eXBw0|gA)kAvTi@(NhQg@I9Nb9W=R zPIA*y?iz=+@Z6+%Bvj5zu>B#P3(JejyK^G%R=9;_%m4@!jl2YEY;h!OzvT6rB+bmPkyXZ)r6-9@CDFNodgR{@P7gDBGb`O= zPheRy>#&vj?nI@;{W8uvo$i;QOG$uy#p6E*c53aCU>pBUR`{A!7|)mW6A#(+lT7cC zw4DcwahCIzeg*@c_?Ddqzd~B(!ME)^h$1Fs9_+Po&3E8s9_+Poy$HO_gYVdR@K40F z%!BV(`4_;;Jot{4=khA^;JdcG9lXT-ccr{?2lPp|zGvfpAj&1~pR#d37C#wE+}q`; z@>%c__s@jlJ|39{XG`4k%yKvO#D2#8LW%qJsFRNSPlA)U|0)s^_a`#iSh2DSQ@;!r zBz`AOn>4ha4aG8Q{GC@k{12#e7BYt?AbB1WqmWpR1Ok_rc@;>=xwABD`p9BjBc*cw zlj+n6UZ&F_BxE}A$1n!6n@(k+K<9Mg&(thu;NOnl{q7C%^1n)mr~KQ(&yx#DTk9Fr z;(DlBNR?aEV{}fg_w@j!QIFDv3!ne}D*=St7zxJ<7!{nkvTp9Ed|~I1UdW zB=YunClMy0JpT-DD)AiniN}2W@->xL3JqvDA8`Crd9CmLG< zc;3qg%KlWGpDaU^eNl8Qa`MjfTxB((@&=^& zKhJvX8$$W4f1mQZRT<-r8$2ePYljiTjVp-T{uco4x2~<9@ZSuyAAXtlqQC}212ncFzBquTUF8+aT2~Wj`s_1iRxg+{e_8EW%g#CXoS9*M-u&rd zcIJ$;W}e?GV_9`gW?pq>Eht$wea?cg46^1Uw|4&gaPGOa)8{Tsw|{nZraj=#uAUTB z5Ozu?dqS9LSF0?;g1DYPnIYgR-_Y%h+mT zYwMcUAQKkS>C!i+nHDjV!{G85Eg8*IsBwJ@VfVu_I(p$OdN+_kdl@{{WMn|#GJFrj zqTV+kcAcuA09^}ri+xHPBR!TcFEF;JVhrR94Dw}#jBhclS!-Gw?JQ#L)<%2)g8fnuf+@8qMkNn<&;k^7%;%ixYwbc$q}m zU$$`m(Q@=SJ7-1fnpGV7a6zv@M|I|jcBg>d0DJ}}kDc}5e3Y$4am(7ZsB=*|P*|ts zlI3eFZMLwGfukCiw>9D;8}-dLvQ{#@F5#hd4NhHQ-L}4+`WXeGMs;BT7D^!D9NWAG zW7*o+(%QHdgIV9!v?gtylW77Hduv<9{BT7!s+Z-MK~4fA+1OfdW3*T6vLAE#(s--Pc*WPRe|NS~;{+DmJ=aQsjGN`)Y1hyBI2v&XC{@SeZIzEhEhQU%5)0eljjX>-q5`sH;en?MM?Y!B9DoI$i{18 z`KH6oS>JT1%9P_ZbIxx+RAkEWnmVVxEID3t=hTPa4$G}+a^y96PPqeKh8(Zi5A&Ui zs<1v@(;r5z=G*x94nO2W;(yaOEObS~7q%wy3tJO2zpyp2_ZPM%x-V=^)T$Gkn=Wjv zZ@v8AQQ^L0f!T;)&G?1|C#Zhr0j?#dAEdDVO)SG2$xlGw|JRmFKq0fL!BUmuRRcd| z@&A$cE$~$p*ZO;(efG&AgmCiU9q<4Fg1o{*po%tDR9bwP?{=Yf&q$SnaL0YHh2nwFxmTQfsNAVr%RF`_`=4XP=XUdhhN1KYss7 z_W5SbtXZ?>v1h+#*5DajLxQa=5QM?naL>aTd(Beg59cC}MIs$nHnY`N8>ZAQ6LNh! z2^WV{B!w&|nrru>_^IRier{xNXTRMAu&sYDwmay+trlR&{#)zgwK4A{?7HB)9hj{D#(Mm`N|vv!pF|J04ro^&jrtwDJ<<3$?1bgiCwj&YZqL7G0OoAO6qPa2ed#fi!qux)V^$^j{`#vd%d@4$jLi_pg z6@EKd;ja*te+0SxQGy>}Cj*$pe-di9^9I85{}$2f);4-!M~OFAGk@Q^MWp6=e_o9; zZ8rkmWBIOMkDn9RY#AFQ=$-&U&27al9^G>zWySvZ3uG$<%zTnf5N?u95H9q4ZQ=$8 z_1NA33UYIXO4JW3Ccn~euXsjGwtA*h!YsM3G(pXL`C@Cxs&{E6QsgS0jBv0?^^5x;CYekb_t9`_42 z`e!_<+bcH-s{+lrQK$n zFG!ih4l3L;;=tPYKKR~(r=B6eNSVvxKLzfN*ja{~vvg=c<$V(zzeeD&nAa02w?Sxk zY&$%bIffsN2vB`dy$IweB#Zd9DnEf@r!QCoe#%>kKw1WQ# z`)dRRe+2tqpx{5@t{$8HF5Woq9U?;BUCkmyA>#Pz1Ex0M|1Z?Wh?w^ej%53gRZs6l z?BKBv`n9t@oPpdE=WqwquDHY* z*Tv!IRL++)u7~q;(EBWj>6ed_KS|^MY4h8y)5m4TSvMwBc4-stYbXq^;t){5qAvMk$ydc<}S0=F}^M% z{m_i~&jf8}?zMYm#Q!owK4-{UNBP`#-8#~TGU$6V_`@|y{zo(9bCMe!@52jWJ?(2M zkN4Y!=%2Rl@V>ebOY47Z*kxf2_Y2`fSUNrzaK91mnoY<1Ywj=7U1{D&7vlWroT1;R zGs@p=lFKjky)~mgf0dE`;tYC820y+%1WxKNBc9)YtYbXwv|C4dcZU2ByF4pBn8Cjw zgMTn&l%ShVCk`^}QA!Y4P5LwFFT{a3=N0)4h&KLSQ~CsP01jkaGRCwM(~TnC4`Trl zrv<-bP)-A}%&cTCfia7{psP-S5W1cQPDR1W;pP4yq8IX8MH+z(L_AY%BPP+VM9A3( zY$FGs_8>yaS4A9RJ{6V>)$)u-|77^Nn5IpH-cqh}%rb9=7gJxz=a@zLEN2xA1&Ooz z!jQvYrnmZ{K5I#TL_S9tk9?&5kPrJW%atG|A&-cB*}s`D>$6S17#`P9&N$R35f9d^ z2bSYGBI@fEBIHUwkoN&-sVBmcFE~%I$+m>|kd<5IxVv zd^N}^`Lwn#=m$xkiFzf150AH^*AXK0IYvz4BU=Q>`UOh;5}_C8-&3zrrOTA2nt`79 zE@$f)|{iR)@zr%d{;2=V;YU0`2AI~yN{1`6!A)NV^RN$K$@iXSy zMm;Bhrk+!Xy)kYpJzZ(!l+v>^pTjYSBmqMLhAS>s+^G0f#qTTro{08~<9jY~xZ>rCcPVzuHSrCK_bI-l7{TNNrXQ>* z_VPjBuJi+n&nn9PG>Fg7GwB8@j#osnok&-lKg905b{Rwxhjz6QB;kFC-7r^1>9Z9- ztN3}vm5OT>w<+GDxLfh7ihC9BQQWWikm8eyKUI8Q@z;vKQ*2RuUGXo9?D)N4Va_>_-p!j3O7ZhJr zJgUeE#Y`9B`31~Z?5@~fk@ruGKTC0vqU>*j@OesqPI0ATy&|vwOi!DR#C?iCQWSga z2!CGb-zlC@{7^B6=QH?<6i-p)0vv{qQ9MWSBE>5duT+%r0{rWhzEM%e4}{;VbPmS@ z(9bHqsQ8NF5yj(*KF0y@=P6=Yq0oI5c^}L8@kET57b<-j5wm`0E4^50PT3^?wMws6 zdb83uD7{!R3?h#p(Df%XA@EGxk^_nU8D4Br8%>a@?c0&_-|7BPQ`l^A69&V z2)R!w{esf6j|}8AYxp0D(C3(9KF4j)y%bMZJfDcclyl`McaGv>#j6#+pm?L=E=9Q> zApQNMfzK+wuJ|qydbQ(q0oYIRJjH2>vL6iM7b`9M!GM;H;&#O^YrO2s20qRWB!8>oJBoN8C;7{D5czadx>RwP;u(sU5^+BAJqimi&Wp9}c@p>#XUlx4bsisg!96~`-9D$Y_|Ld5;m3Z>T*q4!3m zZ&vzNrS~ZPZ%Th#>F+50xYAE3{d1*%q4e*SZc+L#O24i2he~@LO?f&Jp-++0rzqW5 z>0wHbRQl6OpQH3eikA>k&N+%Jh>*KM@dm}+8vl^uyn={!TB*2I@ealN75|{v17j8W%M?c`RwzzUoT<1#@oFM&3Rf$=g^2RrsPyeh ze_82oDE%#^zo+ygNGzcWyV5xr6PbT|BFfW6=^jcCPGKsYB%)lGDt?{_xz{PyD{j;H+myb8ho3F~5Ap zE{X#b$0(k!c&Xx*ifa|OE8a?k9#1QF$CyC6kK!Q3v5My^UaGi2@oL3&iZ?3mR{Xl+ z_Y{Am_%p@dC>~b)li~?QAAMQcNwKdYZp-C<0=H*^xU33d*b_vz6@(bUq++RJnc`r@ za>Y@K6^i2(Cn!!)oT)fVv5JU3wm@+)5p7qkSVKfz*D9_eLb)}Hbwre{L2)Y)?Y&JA zk6N;C5gx6iJQYfde#lqy>ygTDhsN(BBHxFVew2uOo0NWyhm?6$g*!_ zla1*kcB3JCXhzY=Wrmo-1+!DbK8fyWlaEfGQyQDi3w4#6Gx$j|YdaU}>(oWV@n6^_%j$Tt*_7#%7p1n$ z^ii3-XH!du;gr}<(g@k+vz@#dvT=vA4OJ|sN(Hmjs8VR+o=w8q%b3(j&dm9t^J|yS zS+IQGm3Ah2c+;arbC*;*L;sUoSuvCFgt?O!xDD6GoTx0d>`L_!=YERE)&up)HWxB& z-sHliOP8$-O?E{ZolC>XyrGCJvu;(8%)||Ko9ZQ3EevlMwP-nKOIxjQLZ{81WoxAc zP;ChaH^|5BLWM*_=VSM&^j)ZIo-z>!)0=~7rPz5YZF?%&m`b*!nmZIbQej`Jk^IFE z_MRHSU;H3+xcvSLH>1LI9tW3~z%^Wf>kzId*5Q&Qj(axKZ=*(OxCLCA#Px-+Og?^p zv(EDI9TOgh1NY$hW`X=rgis&y#c})z*Fq!@_F{Pj1jDV)R^A`M7nV0}g87C?c_?Ba z?;!kP{aypHA7R#6dAwGKB*Dn!Gnc`r+|1 zkas79h4niGdHf!0ot3v6VPXBaH_2i!Q9nE`1@aadc|rSr00GpGJakqb%{ztVEtr^U zU)&-E@=i7Kf_@rB6+SOfidZcsn+&{=u!z#o?P zXh=WYq6P96BLUU1=Mk+5@O!j%R^9@5!t$Phyxm}8{ozq3kaxO~7wA_3<)|Nd=&Zca z8S)lPO4T1;K?d?@gD9*Y-{sBBq96A(3+q=4c~(E%$_DaYL;ncZUnAZvQ9ts~S^b*8 z7nYYdIi+7uY4!+*3ZBZ}kO^QwRN+Zyy{iFUzq$LtgPPQ-6pOXXUNVkoU%A zW{)JwE5%{uZC82aCb_c@^7wwyI?CfQFoW;;PdUydmPvWY_nc|BAZEbnfmb|Mzt2M+ zSZi!7`NFK0uOOq{7J!N0ZLG8XphHHxy>ht`&hnm$!#XR1AVIi2 zrr`Q!$ML}-dGgNRCI(JF$8oBVmU3+W!y_5?NE$sn8FJ-q{3gWik#ySFvC8rBdnEBY zKU}a!QVw(fpP7a~2KneT{2}n3bQ(S$FYPpZorF&fL(cX$260ZBGn5;Drk*g`Y^R%X zPaB%tykcRNJE%}rAL*??Ec#*KUW2bPpi<{9tC)u!e@}KF!>&X=TR!q-J5Q3z2M~9I z^(ayX9s5rBJRu+Zp>>vT0s?SK1?~`hNgRx4IJ%_B8a85Vxa%dugz=~M!x1A!j2R(4 z@#FiUgE0#(=!X@^-Az^;&T*H+WMbpUULOt{?qXjf2YWWS<<1jMvauz{t!Z(S&PKPx zuh?Vu!l}Z(5EVB!`A$PqNmZTfLsC|`>9C(Sqvd_>jpM)A`cKC>?D&UTYw8|5QfkCN z&OIW>#a<>Q1&~$I*u2$gf^Nva-}9}mQ`mxgqul+@^U$xdr9b>9lHfboDCKgHZzOqh zQw00qVE8^-;(QUhR<`7E|1az_;g)YaoOCX3!M#VW=WZ0fI_zV$-??Ap;dKp0-%DDK zLq~7!#-`14>zks^uSCY55XSV(gEHO(jmybV^5gP@&)tnJCC+BqM~QoCa4((`XD4*7 zX~Df1;_D8VI2*99)27x5woaY1o1QJnYk8(*O3Oj$vBPzm>fMUNc&jCK%)0p^%8%+f zx{a7XITMJ3494->`VmBq57pnXv(3I)b@kE~&0A}lTEcr}vF-5oymi4m?CVs8di8$= z9TV8gj8hP@?9H{o>;vPXE$ZECTJXvWSAiKVc$GD&-raOK*$4R))HSi*HxyuBuEb7E zIi1?v8}j0Xh;!?j*nV~Hh9>CWT#~#W`7Li5$2v*YA9j+c6PCB8vE^0l1CoP0SWfiE zjjjWKlKu7E!)_9N7P{xSE4UZZ>29L1X$#8sJoXWZCpJS4^PSe*44QRame_!{u53Ah zc9K2G;4ed-tJtqt2awA=sT=!-^q2Bm5qEKmgZEc!F^+HWO%*sZ5-a% z{GIZL&|fZQ9iYElD*c7=8;5Ubiq`xBGA?bA{=)Jh56WPF!2o{ri_m#5_f!GTNY(*# zDZ$=pIgZ&^B?r2&-?HD}8kXy_E>NC6&gR$SiS38EUm5!u%fLO`xW`!xX`QMDv)>Q& zW}nBH(>j6gpiaFt(2shuPVy2vq;0(1 zf|ix6+cR*E4Qg!ZJ=|;R-8+J|-PjySY-r9))U{rPblZ?l>KASLIncFetSTH`aX2^@ zyQZ`5-{;k_KN#Mr98cU5w4sB#LZA0YyUEWSEl$JX0@Hf4N&ZUZVba&fN%k zxFkXX?p>roE0hy?O?%x*2{zW)nyr>D~&#izy)FaNZFv0U>YV+^dFVNS^WPF__=UfzZnb7fzn5cN{2+Dty&**z` z;QSZ2fB)TeEH|Dlq}(XKl=~&*lUe2)(e^Ai%F+GNk0^K0f3)1u^5`oeE3+_-V3G51=XtM*$n0>PYl?Y+tY-S9` zK#j4dtwDb>@+Jm~5cq5pvJGz~kPFp=sHp_QHG`pamWu*j!;!v02QSf_x|$x!5F@6N zBIvA`QuwFfpt@DSZ8)%V!G6Fq#*1HZ*-|iNBM$5b!xT>&FMh>^Q%pbz3bYDPXT10o z7v?HQ2)HyRP_haEbvUTxUf{#(C#sfRwcwwi+NUEGHg=c^*nulVmOUO2BfSKwkZTqW zcnKx}C5Q{_&fbz z=?o0v3mI-<1!!o)zz|cEOHDyi9fGB7Xj7Df2x(gs1d6lOz_c|u*a!!KC)5uRXZaXT zX*drwCTMC~J2)?-I;0fSQ~I{4dYhna#XZ-iI#XiW6q{nk;h^f3K(0eT^-+gI#+yx3 zn}WDQ*rqYXLF3Jqg6~0bek}&n7;iSNWcDa3##B^t7qC(N%yYl`i6_zc4MZJRHX`ql zu-i$TNaM2T#q!MSlE{RaqJX20GfKUc>Cm62j z@QJgsNk6)X7rX!3gGglBG=$Dk%{~L3KDxMbP&O4n({LIF2KG4Y4dt3dTBs zrh!kK)s$RRBmE?+LkJV3hax~+IPE9Pf%U=ORR=t%etYO_s`F_0{2^2+Kx4 zg2Y)72SJ%~PBRgy!H@JP9FRT^zyaJ;+ba0>n+U>#LBt{Wo-+|P&+HWq9xIx{_L(#c zrL(%xuL^t&*I;m_SG-M-9!lj{VdbcYmpQ+xG*uYGFg6qqZqdjWAzo(`!ke)7XxuXGFuFeS`hK?US(-~KFw z6!ODZQD~nSZX#1`H^J#-_rB>o)CsnrF&op^on*4@)+2lM1bfJsy?X4vFxaIhwX;o+ z)ZRHI;Z1GKHaOU$hn3PR9Fv63r-Zi-N}64edgnUBiwbZ(>C;}?rf>STKBb{8Y-FFG ze%xY*W$kbFvKf%t+@~zGxzE6G-e#+vQ|-P&_+Zl>84kAF-(cdpa{B|iQBSNRNbSWl zEL6wod-0T~@5Ph3`A&F4pOK+r$WAoqPCwhZE@RYy0IEh&!R4y^$h02u7I3G^td7vavWlue}|AL5Wf(>QN%uoe3vBL z5rjt~_!$GjALZkr4X4d#@I%w{{s@}O80zPPVF4M+o!B=Kehz4Vc+@?`@tvF+M8tiB zCLM1z{F~v8&T3Z{9qaS9p67G)bjLpr!9M~Wy|~2Z-R-mVUyzrurC4fCRA_Lr9 zGTuUeXE*mM;NNk0?cDsMz&y`$^B#eR%$|=DJP!}IDDq%dG!IYAhM-wd5%fcZM9w$4 z|C0XeMX5rR!RzmeCS2v`4(hlT5RYE!&jNC?M)Wer=fXd!)ytz!;%x+a|HRKSCRpBK zE)%!~w-Iu@E&y2{be7i#UT$LK&hNmLLw>Xn`yJqM9sbCxq7}bnL~>koV||vIJrW(M znB=GF83+&UuXo~AUk#fYQtfV( zn1`eLSq$4-#{SpiAW|mbaZ0#eDf$zt+mnhq33jkv{TN!!Q1=w3i&k?ZACw=zNp{Cx z=P>lT5XW`G(d%-A$F@;3lQOnVa!fFhl$A~E&c2RCydGhj==nB0J6P6V!t-T%_(aYv zdOES|+)oc%k&D}VKZPGg_ep}eQyqLiM@V10aNK{iWAVQu@GuoFJ%QgT@PGqfHwyZ> zQ=?E25edLE@UVLPmkaurFn9p#r~E}cAx_!B;6+0rwfpV# zE+$9!uhP4O{n%9Y=UMdb(iWd%TQ~^@47`tQqfOO`%+Vr~D??4N5j2*9oLgP^>7tm=4eq6{H<<7_hbfPtZF7)h#rw=@*@gy9}#OpeqHW&U% z`j@to{<01JGSb@%O@DDlvmY;J&~i7wzw~9=U6#K5J9wlomx4$7@+I&{U;YU^L0@h_ zar$tG?nK)JL0{fMsp!l1Au!dK`5=t|)0ZzXeYr3DGJ9>%kDbxYU}|E}2Dh-Ed&!?c zc8a5pPtbE7JRXitOYxJBqjxv_B%y~hvJZTGJyOoZ+uU~jyqdf{gAiy=j)TabC&#s* zPtQRpSk1{&20QmVqh;8uWoO(Oumo{@n$;7j$4#IIgO-tJ96V0R9Z)6b2A&2zXCSuc z<@{NIA1A@uNN^=`f@5uh*NPHWT=Y$0=Rno7f$WTN5?rgCB;be;#{H#gV z7oY1S*|U<&8T%#_@pnn2J5)}aU9Ox}(&yQc+}Rr`;II)e1p;I&IBfd-a?s2h@x{2s z7`_{{i20+48U8qEIS2kA=|{3~(;>A4hyRY-0Rx>BbHJGp!t%2ruE8&w2b5^xpn&e| z9n9sQMvLFrT>t5IW3JDj9wk>dLgk155wzs$M0lo-=Gk_FImROS#U+U3xz=CKw9kOz znbv6?JaVq>g-6b{j?gtY*SfN@^;|2be`!1E&lBhm&NC_BD&)kb^9v#c{iSrD;&^== zLE!>@l?5sm1j$@pX<1?pl7L@VP`pw6iRRWavoD9|P(P8H}|prjnn z!y_f5X>%#iP4EN-+REfwpho(&Ko8TOUZ4kUfqJJEh~+f%e_n#eoxP6*DvgwX6WJ7^ zh2Sq`>u{46xw!O?aK!EN9DYVf=>|u5F+PKr#43nDGvH=2(sASo1hAK&1dcx>(xJZ$ zAl>RfcEvILPmsu)KL7NHTx7aYLw2d*F?4>3`HYFdS@$7=5>Y7PacyHWl#E|E?rA`R zeaB;c)0k4bL5YE+N8#rX=-l@@?gy0SHu+tF)I7Jv@dsG{AEN$P>wi7&pKtwdZ+21hLpsc9e`<9X#+jN?um z)*XcB85}R-V0%~>4r{W3z+zuG4lCCtseoq!4#qK$up6gD zQn5mDtkxs%Ip_u(Fn8VX7b{KO#MydRe949b|3~JO{r7El&I(Tkt6o++XX)Il=3cpw zD^)Nv?A+65(I)7ubeo{F+S&x2Wo?4ans?2T>IHM`B>cI{m(uX;kdV+5 zj##~>wcHiRZiQGAHWt@|Jpex1%DfmNrq*I{*I1PgOb`b$XfZy`);zf_8;no?OAHf> zG19ORd-z8L29Il&!L&JwnHf;)EUKP+WhyviW0(<8PTFJ{Ob1ixP;{*Wd+;>QeobnZ z1h6>9koZ+x4YF`S(rl=pX2s{hT>A=#a)im&8|xk!&6#udv}tEwHs|7rm!CUl`el{p z&Y2^;(llZkddvaX~~L!p0jNJ{A+5KAp5MbtPE96>LpDKSN>qPi8*O8DAJsz3zsf~t=bxs zqgtk9*eF1IAL7WgtQsY%UMRuLcHz>R z+UtTsI5ytOx#lXP_?)1E#K5=ev#?qXkh4CF5qxGR%cU|Bp!S!URMaqRHeT#>Ga2TE zLTkzSniV*&=a{Y+_Mb$$lxF_28dH#^SQfM#eSsEmHBYAFlAX+A1pUmEGgS{v!1ZjV zO9kQPM38;}yT2L1SzA$5lcrJQ=4@nRKb?7`#ROG0-?Y!Nnvi+>`PIvGV*;kDxn?;k z2vwO{wuDe>z)k`+v2tvs=IAEBAvQiA_mJVd27^CL^A;kLE(yup z27f3&h)>;i2%G2=zsbdGfv_AttR+Kocq@{{4!X?WkIJjx|Cel*qXYhTjE!4+hjQbJs#&CH`=!)89%P~+JGvVQM8WiNcv}SIt zu|uvwID?m~DRT!)u=oK0&rzdYe^72G-}Q1~ZTC?a7l&Egv*NXWQB2K72b{OTZ1jNK z&b}W%Gv>9zsx&PAyD33mMRdp9_-Fj?uvMLaY2n`I(JC;W#J2kGBQfvS>n3HSpvmkm zxv(_;GuYsMfVQM*?7OR|fv*@Hyr0p+_n~zRErMZVC%#XDpJMP2U?=+gnD>1oV=ld8 z4NU8OXZ`%kC5{qWsZYY3=#^7z(-)R*9d2k!)WC^o@C)5pX|kZ~uaNOr{C# z`e=;ix{a~$Nq(o;CP*%TQuY3jiTAv;LG=ZOry#5>+8LLI`zOw{uwc^0Yxf69Zim{_xl0cN!7%> zrS(Yizpa*0-v@lu^v`La{3ELxR@&=PP;V!;^Yr~*-XDN5zmxZ+bqA!3zegSAO@_JG#8^x4gROSuJvNb`!s}2@`uDWAv-kjBz!_V2CLfW*bUyK2EPMZ_x&~XQI8?p zyaT?AF8CK?5PF+ef5G_|_%02Hg9X(SL-tVkOX%-30G;aZyI>K!UG7GlIh|-5{VHZ4 zR@V#b{cc_jyj~*n9Jvo^a&spmsz-e!o+j>DiNaY&>*EEP2@fMSA6=&_4On;B>UMH zxbxMfcfKgB_SbnlEjoD{*RpNedH;aDbr=_a3&yg$!6G^`ALQ*>OP(xU^8i`VIniYQ zghk7sdmhN>o>XNfG}My!=m>?(Y%BALv-RT=xV3L zHlq`8NE?nmF~wVT;0FJcO{pLkyBj>b+6=m(E4}f)iK~uvTqDL$2r1_|-$#o=u@1!G`g?zxior!Gd+zS9;fk#oaf|+D5fvWpyktT5av0YI*@W+s3Z*aWOZ#g zzHf?<_yHO8pbR>*JmnejBQogIGHA|KNIB0rBSpaHIcGZiwEh^8z%e3JWu*CH+B(wr z%iW84g<9wga()xEjY+@OG9$du>FeB|5#J*tzfBs?d-Ov5 zpDU9U;1$RE5O=CV7t@z9nJPUT&j#${v;$4O+r*3UQR82(m!VFkf*t9Tw0WLqJdH#j%3=oKXBg5s=C!XT0NO3s&7sHn--ln);v01SU=Lz{Z-VwJcKA`xlqS%2&JZ`px?`p+w6VYD3B%+tgo{?9e*i&&R5uM{qBJ?{?QS3N_o~iU)#m^~TOGLUgMD(W(8h(?~ zUsQT85qys+{z9>di1NLm_?{vj%_Y2pVpqk!ilY=O6elZk4hrSXQ@l#?3yQptVm$Bf zh`i4t^8S)2;|TCErJq)OPVulJCqR(@eMR19k?yG2U9qp?U`4UZhjD3w($k5hs9&WQ zC@prVA+J{HRT|%*xQhrmGM*tl_syXkexN4G_=fi2cWbuGpOrrvGc-T6ldp$jsp1gD z(Te8~sV}iV_HWVf%axv|bPW-F*K4?poBi>LRO7#^_ya|;M-Bd8k_H}Aq){Z&oNYlI ztazH@8N>k?7Zq<-yo-o&eLoT9IzYs@en{hGJVv#{ZRw@&E5i=Wsj* ze|zEp+&?JxQyf9Wbz+>-V$T}|*vD}e5TRE!5$S7`UZZrK(%XoTyHn}Ah)Dl{qS(a-{WH>#^Mdk;U2KFO(eO7k zyd9>0FyDk?FU6sXrzxJPI8kwi;#|e0iq|P_QrxNd6-8V=Wju{4qS=McQ{+83$6MaN z6O)Q4iqK_>yai?aSR&51af%g+;}t6v<$eHsGnJmDxLC1Tu|~00ah2j4#X7|X#T|;f z6n87$so1EvS8>1MgNhF;KC1Y%;xmfRDZZ%Kr1+ZR5ydwYPY{!4KO7>TlZa8pxMH4S zSH%)VxgQ39snUFIVR}Bd5cwQO9H+?nV5FxgRw_(zKZqQw^f)5QF z|8n2j6*GoeF6enF5&E6)0ijnX-X}nxiA3lj_an$3Z&fAVCL;3VgiYo%DF+Do^2sR6 zM}K2uGsAQ!KNAHXwo?{J+XiPzm-+^to-iXkOUl&u^7NFUaAQ(-?!0-+7p}Bcs+KRT z76Vn7qp)C=SgsmMMYBwtNEdrDhAf(8&O8u7S@^QgE@+!=n|UPCI&G(}eAIM_l>J|| z=6jNQ$TATkU7?dPWGP?P*%s;2PR^1cFZ}I4H76n^>?HA&lA6I}davmfusC}qrY5O@ zWf*Y{M~W3<5uTw2yGq&wk6`LY*mCU2P5GL`zZAN75>t$|xs!AU3H44t=P#n8}1EwNoIW^d(Z_*e$W&+sucaVtN=M>AA@hM&ez z`N1MPga(#z=cX*SnEE#u<;I*Rvb82+p)pMZNtgjt8-SKKe~OFxE9 zaibJ1*d$LvSSBB@Db`uOM+{$0y+-i*631b6v3%b{0B)%RS25PSkNz}5$isu_K8x!> zINwzWOX9H3%Hw;Bu)IphV|vPC*{r(Pc40&52F9{~rAHTBL^8OBfum<|^eunwjFELi$%LohWcXvp?L`dFx2*ZD%AMc0u z;;_!jTMeeLyoVugCYY!n-z8f8rW$#He$OC+`jLmu%Hw{oVR?y9rTSm7@-ZEZYo+P; zA_VZ>$~r4=U`D=JKPvg!SJ{@YUq-&kP`!!p{Xq3251p0AdJ4;19MZ41@=@NkIKuk9 z2ze3!ptJH;z#o>k3i6T&qkesHSp8JakqbEs=!f?GEYJPx+YcejH)_ zUg3bo0CiU0y`aPL?hfgP*93unH^U#+?-krnGavHMS$Q|YAC~uYNWX!~$8>xj9M+HT zw_ZZHbynUtz!#SHQb^t)Fq4n+HW+z9`#y?5hLeZR%Hw*;u)HH7dHj}S<&A}h>Cs)q z9Rd+$8>_SOxcoCztq%EM4#dq`y~7}4TZE~pz33l2*q&; zQJ60W1Is;l=VG0WJDySAhtI&X80wn&@>`0{_qQ4H?(c2ZA7;wq`}%M>8qdK=1^pseDPQT@Q`Bd{Q4?*HAAJ;k4Z{0B4uo__FoU=%UQ}gJ-b*v&?Z!pnDb%xdR`kUg@}7gd zDlk#rnK*3y6~Tj|1g;7Uf$5!lVrOnM~1?)s7cD3duwu>!3+H#~lLYPKrVmQiOl&AI{6R`IP zn}=fW(YE*gyFIaOOPOMW688NlSM2)1&Y!hIndi`^r?Er14K^8ZPlLtOumuSFf6Q}t zWm5}!Yzw+rchM^pC;C)YHi4&zHZAjDs}lO*lS89RovaPY1zOwt@A2x~gCe_mvL9`^ z%&BOJIvZOnJ-_8_`0C1HcD>#nLzHTDt-hh%W&a1Fc@P zA58rY+O~hZq3+m4LtZaNf82G~9_Tu?B~sB?0K1aSo2%HzrWNHj(l+Xs&?dAo%TLwt zYoCgtPZgt29lP1|bLzPr>GqUw;_+Z6PIJ*NtC9q0xb*I-u_VcC=3I#WqtW`y6GFpJ?r?n*MyZv~3C6w(NeiZABw(c{V4YtGmODCGGdK zZNH3jZF_6Ha#yR(+sZ~+nlTg~O*C>0X>7?=9T|`N2TXW_9E4LQ$1J9|V-(Yp5BH+o z5r_Io#XCvJDo1>csY{Mgtj}C$YBMSceGK)5^mwkq*0+t#%(q<>U~XkNeCO8aj9a7hQni>fU1<85(jyHNXVdcX#Mc?fp$brKy!aJoxk%tb zL@ok#F$Jd&q4?+hy0~zfI6@FbuxY05Nu`-(QlyucH^(puCilpY%zUQp$;PO4MyQZ9 z(^=9Z#*1HZVQu&r32g`!;=Lr5;1UFg3nyU3LKQ-VcrQyOxC{Z}!U@U{0@JI63h`c= zN^mIx#MuOFi~m#^LM2sELC+kEfC?OFAm&(Uy!aJob0mRrja&qBy3S=&0Q|}XFMQ&{ z3CacAFcN~=l)inHa5f`jVw%()!4Fx4qzW>`e^58+Z^0s*Z3%yqAC!QwXs8iU4soKWbWm1O3M8mBpMWxlGCV zIzyZlV2g$vDWDPuyoM*$Q)eQ;oK2O4uF@ix5=z9|Cc$EGZNQI`-5R~x|%8kOr@0}~r?9lHmkZ8md^Vf%|-${b?U7(Mh;CKW>_7->4Ojq$~l zdBj{AWW<|$V`MO|BQ)v|vW!Q|doUUl=|WFOYl|;ottJ+vj0zTpj0(csV#x-J3kjWr7A$y0-752$ASJ*dIa$|I`G;GSTU)VHc|DZK-D>Wcx z_OdM9?B&3q#=v%JO1!mdI4B&%LR)i<@D8yyBZr3c6!VG0`lF%CQ%OxD4bM_Vte_Fr z0%QSB5HZmxh8T^3Mq^&`G~X%d$WG#L5^fZTUvTr@#h#~p4M>;75gCr37#JdFMaIGV zPaN)i?{5Gis!Z1TW7c?@cFm4*b8P|1a^_Wa~ec7n=_M>kR*E zB6gYezf~CfEd1{<{O#h{Ld$5WG+in;k zC&d&EC5VLldB&ehLFlGPbvNZ)>)ip!iA4JX+D~8{-}3)}acjK$85hlypr_!E4(-6? z97)~TeETn7I-20=2)kQ&=5P`N5%(@V97bLAje;FWSPG(0jB^#bm9RpHA*YD5c>Ow7 zve?Qiz8AFP{T{zL@#q79PMjwa_se7Nf+)k`k8omt2mXTokx|T@fX4-sU)mXIja~fN z>yf+n5Ia(rtMPLup0K=!xE)zn=-5c=0Ht@k9g*K9`TasfcKZd$CXx>`sc2me5A==H zs_sq!cS#!`gc`1@fHoyW(KxZ#zd0zHBejO{7`3(;S>(TuB%FMkPy1eX&@&evPQUH$ zUi@u9NB80b0H?=UkmTjLRLL#jykrnR2RP9e@!S3oe0;kv)@|I`Ut-aVg}c`ckT?%A zKr=xvPNL31LA_4y8SwUc13&C%UT60RPK{nY!9?qgUKjTlIrx4M*_q`0X0NOJXGAA2 zgnt>u^>BM3Rqub$-(9jwehG2x`d&|$Ez;+^pzR%<*T>Dz=O%eS!hu)%mjJvIZmE>z z1T`yN$)NXt41uMREDc>2{>YBxdTdK zqunx|YBVGm!yQ5y&$S8?Fe_Td6LJa(m=!I17|jrjpjpvK z9;hwgjZE!N?-${X6+;;OUuW=v{`0~6G`$1d{tT8$-ksh4T#Uwv+p%`;z&v1H%yY|V znUkxQVm`E^AmZuAgpvwlA<$2fLozAnayL*{A=Vq95Zibw5eacYWI8>EHSGf7$9)+Op?u<_h%;b6% z40!Pwz{K+qR7KAqA}@kfTFoT!zYHNGU^Q0(=}Qb=WCJ zlF+adcM6JeLZUw-^kNv$<1n*IIm{5m+|pBUpsEW(odViPz$-o{`YCvam3IPH&b!4luWQ12k(4pro&5shyajHrYk@MHERdGy^%c-E zoGg%*5(T;{1yS zd%X%;`s`I^AdMoe$X+G`X>tW<>9Z?LpS>BhWO%h1J=?|fB30}1tV~VU8-7r<%G-|)-yejLeGBUyr;`{3z84?oBDhsX4_vGA}FO+Vb3FrhqG(nEiM ztH#|DdU50n8s`+ejDGowhO!?{i(H4_smgIJ@?cNpP@5L&6s2EzvSE0!#~%CT0|jMX+{j!jIRi5;>z)eEmmw>K8d zm{T)XrkHaUEn5z&QmOnitiA<$QUAb_+X@&XQ_Eqr{KkohGF7m8*;Q927IEgZk3qe zLb+fZNsPDz6>??mVq@rz320!c_Bxn7OBqFDC5A{_!w6bpOs^TEOrY&F%M~lfZlUcOHW@`ybo0?j(05MAzEm^qSw5rr+Dp0z?=uxVL&EguVg5?XGFu8=pUx&sEm(nxuNArRO#3B(vxckmw=UCr8AXSdd^hOl7sp-5T?n*TRm@ zO%deq*4p?uUVg= zFPcc3ID@AkXp;9dOm4xJ*!>ZR{W*+6!DiPZk$S&4Hpwr9&9X!YyMyi;n}pxa2<-;! z0(4`r-t!nTc_K0iXw2)RD*Y)a-Z}SR%zFSVKa0Sw8PsOY9FCx7zPeUw?D@z6e*mm9 z-3tYZp)%Elg|vI18%!*1iX1ri@wFFhiLdZ`##h2b*>#hqo_C?QYSPpRlc)GYy%*Sw zUq@23!#nifxL%~*1~XszXsRRYU?&XiatGVxk7$>CWK64OZ+m&rC9#!On0}77Ltd{& zCL!ay*49T77(`OVcunemV}tKEM8t?$&@z8POn$ES=DPU4nD;eUJ?kIyj-x#J-cb;+ zP6gq2A=42kvWvR*b~Eco8Qg&K;nm4u2i$0lw_z`ewxFOf`eT>)y)o~0n5}~5buh{W z{yG}%0)b-1F7Qu@@AunpL_19KOUSjs_qRazw~b}1o4xorn21_qdLH|Kx*NrZ2z9h~ zl#jD4?!A&U15R%5A_pvo|6od7y|ob(ET##0U7k540?$3*H967P2Uof9Z#{K`5MkT(tPP^ z9qC>f@q8y|9piajwvKd&6!~XsB<~3dQGdf^Of`&!sJ~q*kJs%&)X$9?&-)A71L_?T zNcoF0=pSa#oigYqq@m;WzYz8PN0rZejzYB8EfQwx~;sc1|LK_ zJ;5i==8wox2%y~Q#H8vCdN1iRGk3dWhfEP~W zD^t8salPULikwqTJ^(&xnfq?8mqk^`x>31nMD(+MKiQ;pL(thCQXG*5)s>rWDq}fl16^iE*(J#1%LzoYnw;!}z*De~JI`_=18A16Zo38iJ-G2|7nKOnpl5p+`NQl&={A!nlE zWs21rzm|x8xs3=pw<$`$1O1TlJ)!s;A{y;ArH>K8$NBrrA48+ixYZCkp>(m*Nu^7b z9;qn(8FJ21`Xa?EhzOsfG`}w~|1}!EMZ<4a{F36=756K0eINDvjp82_UhLukf2rZkif<^s zrx@XR2R=-15bUEkP!S)|CA>m$vf?F*a}}!<<-CTx^`tqTX!vbJ)cYMue_iQsD*auh zzpwO@O8-RZUn>2w(wJZ>@?KZ^eIoK3%5ecWlZgE0Dqf}G*DBtk;a^s~N5c;)a@`Q+ zyrmeyEfMKXM3nCg#S4fS_byeMTR$=1`ARQSdWF&(iQwO%^qq>|P<%k~F~z49UslBA zdddHo;@=fxaT8vkSfV&UaU>Dr<(W!PBtp*%l)g;q*-9@_da2UaDZN%{v5$uI+m*gU zF+BZBtnm$5HTLVK!ltlihou7kjU#mI}<-#@pQ!rM8tnqu~zX0#eIrm z-v;ePM}BmBL5LU3Q^b%aG@3>*NyIo@s#rz@6YqzJLRyFmFD6Or#$rMD50?|!8pBo>?f z*=R@N8PdqNJI7b#a}g2p<%>4t{)#l@$@m93Vy_G7Y0s4D9Bg+nzvjA=nvFQgOUcx_ ze!i;sD5fln-Lt)|Oc!`kjx5r$y~a$JmX*USu1_~TF@M=oZfqm3U+g{k|-x2WM zkByBDKY-UQ6+DUkj+4HUPgnM&Y_O>CDJZmzuiuBxUr}ofHi)SPG18#s8N@KdNC*5d z#;`z)G2r)KX^dea?vd~xxN##f4FThdb+{E3$2oZP*y{ z;KSu0aM6M09se+dP#^Neaa?TV1#4;RG~DWJ<#Egm%j5GQhETEMjN6bv-Wl+R_2U@L z@!2{nZwvy$@&-d*8N#R^F7JW7Joq6m(61N-^(GIUmB+BKyy+qR7;eiuFr)rTs4Ne4 zR$jl1@-Bcp=0W}VX2{BW2Wjyi=qGddlm`&#_g655^{Wo)$L}vzUUP+c{0P(Sj}S$VVI56k-?q#rNQHj( z{>nNl?^g&2>o*wkCLoOU$2W^s-hJ?g>#rOG2=gHiot1YF{9$>uA^q^mCXn}#)*o(% z#En&XN{a53KT!E>cm?=Q*ue{dwn+Ul>ZO6@KqSkN#9_;EB9sPRXDm*N@1svzXXUMi z$NCxfS9E0BX|&G9amI2e*m(voLHK@!`S!(O^F2F5-fL*ADk}_V<m#nV;m1o`3du_#{0obER*suez)@3sOP~KcI2VsyA@P* zjiDTee5YFiX!%~tke8RtKE5=8FI?VTBaCpCm+zBod0)(scLMUT5+HCk-{&&qMR6VE zeLm$4!C~c1MIl1X?iBZj9ab}j$tzXz$$2$$Ez7r>HN)dk9=eSUZrw5DQGq;OtihUV$nh#0oBLL6Kb%v8{F1k~ zj!PmxtQ~cd8(SYtVohseduunWiH{_2Zt|V&uVX!Ob0fkV%aI;oUir;U%zqcwa5IkU zw~anrE4m45$+3nNdSh+#VHa`|kj?npu?9Q={c-K>J_~6XA4gm`J({?CS6z=?g0gu| z!x0qY=#8>AAG&IJu_o57;M!6x?;$YVjbpbSyq;9zpu4%DW8JZ{jm?1%>QII%)B)-t zUXJ|hSO>eYZr#)Y)*QEXNNSzeu+A$vKd^hu+10eUriqh@PjyrWT(7?ruVkCdXhAp3 zg-*H_7V?xQ2YS*zz_AUcUC8e`D_d}F`3?DF3Dlp~&rZl^en+v!y9{-}x{E>=u8(H@ zF+K{L1I>sZ%sQ$;o3TGs)OC6V>zQM7zj*ld4?nz|aw7$>pP+Kd^WKLa<}&>+z-O=f z`}cW4->A9T^o?+zaFaWl&qcY|UnY+7TV^J|(t2@uMN2XIW#vfNF@V1$`D|+fbf0lp zA71`!YoD=LM_!6Gh{f+6{iEciXvwGKvqtwnuhp0miOxeDP`8TB|Fb;!7I z9r~ynmahnPFXcqN?R1)Wt90~62lbI)K3{2#U>$jRXpG@|{KYtC>M;dKx3QtUtnZ#U z{bCpa#g3cU6LFy!lElNZbL~85`8=oJihku|SIMygZyNPUKUj22F=aTg6q3LkvM*WX zJDwyCF5V;Z`WSK63XX$6%K||rq0o~p8Xt_f>5`Pc;yA0x`gxUrT7)L?X5})<%W~yy z!Zm{<)YHa`UvX9}nc3J@Blyv|+5A|)6*#b%m_WtzoW%P$ImEepQbo9wa$ao1z>wE) zuBm!7c+XD3O!XaJMim;Ig7iWvclk!m{U6t>_;Vb5O-ybYfcoh%@h`Q_V*C(tsVe6HVZ%e-tMiw8^5?q zLPFd#duzB{EoUIeNhH^E!B!6Y(Iq6;F>U;J_+g)Ihviv2@hdA_+qqM*&~<7%cN$=t zlgq_Xp}8z!oyqO=d(t3;^^q@>?_7Oa4{_h9X*dVSg;;m zr?3IPMPu+&T!A0&BDa&Mb`e$UBspL7B)pEt83$j$;g@+_GJG`-cSDr(%yQy|{{e{J zhM%|#O^^>`Xa5Gj-exItN2n=+H%po4Bj#Jwd`lC{ybI*_NNyF9M$n%pc|E&GjB~3v zf55we%k5AH&cBno`Ej-nm6PV$F3rW|r_x;8m~9T%T}lnz#2V`S64UKx`%6P|;6bBF zL!vq3>CNfH*^br1!!=M&`~@W6EA-UJN;ZBF$~IQoNqh;(qLo1%7yKE?3P?K9Mnw6h zThi;!{sVr!hop*jdRj#fNfqUTlsfsI)X5BxQYR0uMoGGOJ70469@P6j*B1u8tI!LLZL#Z12Eys50PHUjFbf^FD^Evf^-6{VWc+< zr?5YMyRm~M_A`D$5bq#k^F-~=ehX3FF{#IS2$rsPjP;1BDUxpd7ON(QEApf=-ezS; z8A~8U%6Qz*KMm1($`qMXMo#7hV2M*t+Z%Rbcq?T8>pli0$HMg<+z^2cg@x-qI>XOq z;lg!~_oy8ZfHn4v=Sy#c{zhvb1G!K`0lcEs`w~ zoH-LOnseU7Ddz?sfuU!$D0|i1r3=&(AxbX8v3Nv1A zqV$V!=mWM{HDv>^$Zdh>5opG5+%}f$pRC_XGU;XUQn2Dq7Rd>xT|4ygtLN~kbm82k zj?~JE+PSq@dzEcLp{}Ge>kzFjEV-_+<3cYigA!R+IlA;uKBvoarDcmyFSTiF>}t{$ zG8xJ&`wAG< z!5WZHIkDWFvtj=uk`H4M3AZ3p7%g@?;Tq7@?dEom^m6;S{dqp}Ntur!;k8X1+^plt zEbEtUjBN56qO!gzX(NF=$q~r4NL#$k(M^6sYNwL-&I zT(@HRvSqcyu352sn641Q+NN0)F)LlfCtIf!8X(aMSZlOo+0c_NHL^2vMyKzgALUS zyu!#}tP6VE?>Ldmf3QU4OJ>2y>)iGJ_Vo~Q)S1)}!z!0Sv911)&3>Wx1uTNufn_FG zg7ZFR|9M;1AHaS);k7O|$dac>8CK%F4RxR)HlF87mQLJ2z1}}HRtbcd&hQEtesnMu&-Ssi=<#lg)-@qcNm)Aj^Z*uv~uh${Vd+7TW!|nxR*U8vEeI+EE zhfTX*C;?=V*TAk(k8TK^b1yscdBgGxo=CV5+oln-1Kw*dv}3MuFX>5h9rS;sXv zFNSE`y*OV^qjMbI>!)0MXMP&p(Wy+MiyVIE=UW2fJZC%T*DQ%y6@0SF3)E`w%m7^% z&>fx0pmzoQMb6{u=eI%^U&R{{Pscd}E^dx*0Zl(nD4`ob7l-JTp!qGGb0EmS7<8%l z4ShN2exQx~uCRm&0*>P}>^+I!{9LDP43p<1L) zyQVu89Yx}YnzvddNZf$%5_E{Y#6ITLKGVMjn(2=KJxpGBgNO<_MnnfZPQ=SDzBBRi z@Izqot58}_bfOc(OxK$ zV3lH>;+Ki2=N~G*rFaVTW%v}uD~YH_mWTKg#Uk`;(y|re)cY%|ty7ET%sYiFw-9iB^wtz_?jkMBe^^0x< zWA#&-ZnaQE6d0>tJcbr3&?*LuMbkV)z&3-17#S)VGD9*XcGSrzkk~QC_(hU<6KBSm zm@lWgC?Dv2A(3R9i8tK;e?O{ER~N*5Gk1RX-rqfNdhN&BYp=ET+H3D~&aS;R+(-!i zwrI$4knsTxU)JzvgrM`kH2f{$C3t4h@jTio>f@U);$5oam+5$kj+g2Yh2VY;)c+Y6~Z9>@fi#pD2%2@9|5(1yU z*(Lm)hB>-l6%YciRKx2C(VuS6@mmPN?-CvF)Ns8{=YB{m-%E&c`*iwObo?6{4iW-S z{uT(3dy+Ap((sIig8drl*br4h>^3UlRT|FGuuj9MhUg|zK9G^nr=j!*kQ=PY{sz(# z1_;p~iZv`Dgk4C#02pK(ve2AQP<)>-a-H^w)bo^* zKONw5@Sd(sJ!YA~|Hcmr^rG*p9X~9%5VIqHY>-*EdY2>1tDi#17bh!uOz4P(@bcFP z>IKu)>(=*lU46q%x6Q^&n~t?&F|5z;#JPz&CQnT)H!+-^$OZdmtv_CLm0fWCKD*n; zzUHBCpgW|m;u%74LpO7wE6Iz~A%;0O;Kjb|ygWK`7BCZ!{nuOu?+g<7yko8{=-&ZE z=sU;{@#uGcf*bUry@0&>aWmcUZ0Nm;G$*|$LC=pg(t}$|)B9HtbMkipc^~06m!Zes z(>m!L1-+#}B0WBF8UB8t=%xANT$TKpr!qtDdl~dRpBUzk^%#1a5C&>m&z$R;m+?rJ zc!WK;o%|JoUJcU7AD;jXJ@O0^Y5tC)ZONZ`N;Lc}Mw*jetAjsIwGF*GMK8_Yv!E9z z!}>DxK83iG-g3~}g*5UCr~m9zNVhakESiH?L)&$N8wan8%xK0az4l={HgGVN#Mg@-xJ|8f$d8Zx8-(}~9XV~p)XWCv7vscFsrXo0xtSvugw@uk?3zYAP zA57)=x7w@L2JFPtc%oywYjT}sE=?9N>#GwmGk6Bz?u z){>V#I|uZ<AF9kh2Kb}|#xdn9V3hcDovA(`-Z7=HHhqN5%&`x~e-P~ly z=3Kk?bYn6Xytr_W#ZA3*K`&j)9!48m_5!q-1^ftbbEDfOy|K_k`)u$GJ#@_5V_Q*| z?F!q8mCL-g7dp(vJr;Kd*84}G!$>}K6?NO);LQ!ZHsV1ixwyyTwxJvHyK?PAwmT~9 zKImTnubp_Xsodxedn|PP_Gci+t2?C*aT1nY5U~>jpxLoD$9^`d+BO86rEX6kPIww(CaQFQ5nNKE}IoI$$3pz#ntXvD5((Mz;qR)=C zuwC>4S5)yX+Xix(HcUF&Fb8cIh5pjKgJ)+OD&G5S_n_u|vsdz60N%g!>ewXt|K}e! zCEF$&8Fty;=+?xRFxqhQOgn_oXe+XRm}GS-BSD4(zdGmId8#9C%pjg=1ZJ4DE*U5%fdqrfu_! ziPf^M9d_5+?32IeTT-?@ z)&u=_pdRWy0=>6^H_9aWS@zuo{apL99O>5=Lq^&57{fZ`Smj3j-%HTX$#k@JJLGAf z)hG45l5HgQzEA3oHrEE7wN2RtSzb(xiNzDFr-SVSK0B7V#(D+Q{%;5DnNpY)|mM1!eL9hrs*FS1~TmLVsAxeicjPMD_rd+TEBJuy1vP zFNq8PrsUjh=R_{Iz2RQ`)^Dqw&$fVE9gxfG$Gm4=A7sN^WFE>P5A&%+8~Sww_7}!LyX9Mafi*ags8*0>#qaBhWWx$&L2OIUDC0xzQ`ocJNE!wG(-BsoJ|77TM>1QMJV6#)8!~BQYu8G13f9p8iE(vlj8nb!E zD}9VVh;cu>+oq4SAxkIhDj@dad}54K(RiXDq6iqpMK2<;T3&Pg}JU z9Phm0SRw%%>_l62wqU#qPqVkgU|*p=do1o#&CoyQCv7cu!V}(^hyZfV=?QI3bc3!Z zG}HD#zj8i;-$!bCB~v@v*Bi!s z9Q;u}^63ffOf>X^N7#M`{HiA~L(W-g<6XdU%H$4iPqbfYWZ5NU@q~I4MxMwRC66aG z9rpH+?SZ~28}*JkwCwwEQr zh5Rna+mTPdhc?7~RKV|TLRtF1R`C7yX3BRB zT3$qZ!8RaYR|{4%14_RQ`=XrfQ#|1LCD?IH$}98GR%$*^9|M`P`Si3*yX>~LKS(Ty zp-%xft4zAxM#)raWWsa92$?XpL8eT3_?&e?dEoon;nO=>UY7F21lj=d%I6dKkFI5C z%PG0GCk&Zd_DLI+^1^SL`OYe~Nf`5@mLDY8hgP;&u(w_{Z_#~e)hrL%W;@yvcEPqm zo2fbHLv|b5g>B2WX#l?kcrN?k$L^%SdiyiugoysADM_Eh=P?)NH>)szqTSJtbz**F z#yk3kw#{Y^glAE)GtnK#+(6*|7^B2F}> z`b8%1PQFdQA>ZWL@N4RcppOpoO#N(!Z=r4!zmXCA?vnf(UZp%JZ+PSw>*Q1B)2E>y zsre=PEBtr_{nYU2f!`+{`A~DHov@V{<^&iA;HRZcT?!syQv$g3SsZUVWj@C|%t>f> z!0A}V=P_;KR*1 zSr>d#*D}lnBDwZ*8)G=|+K7k#!M^N+9k1+WTVPCsedI>)ya=2y>gpgKY@g4*KK23h zaWyZ29YtLBV&J%dyNY;_g>w`iZjRGtZsm$tHpdZK& zrDec70LZ|1Fj-|-Gg^k$EHVtwAu+Fk4B7bSJXrCM{tNyWfKFEa@x0({hiv?FTu^O* zHU$5Dpp}*XKR5jEOSi!&{bLTP^pElLe7xiN!^yjo?@$Q-o4SX;YM(dF=5vVb>-jO* z66QE~FW0s<09)H>2L{pp7;Cy5>05V$=e4w(hhTH+dADOT z-fgAr1kY+nU%BjZ^bhrXq3j&fdMQAf0v7f0Wpei~S#R@mWCxX4-s@)f#}mdzb@5eAF<-8C5G%{;ux-av2)*ImSF8bJ%8TR}*{04Nt5_7CR(BNFLDELH*<3Wt` zPLwYW9!&ZBpHO`neZ9c{M5<%nF1ycNp2a!< z;>iHsmjNCC>;OCp*ao;CFao$5@*hEX-7L=4_9WsVy!Q@mw+lnNQ|nsdNSkJ_hAr(v z`b{^EOH#MDHZM%lzx1JOKHf9)c_Na(&0Y(=cF(gD&_RN8dCQM?sL*@A*qdS=_3aBh zfp&nuf!r=UKk~U~9rUvY`j+!}r0>F>6sy%YhWDn*JvH<@c|ZCy_U;fO?mo-?RUT3M zs}u=!4LmhJ=KL;kre*fKLfn!J=>0+j-s|(dxGRL)-;eQO2Y7jW#`V}{TlB}VC(YK& zJ^mdt1io{)Q6?0P40*)u34GFe0{MxM+Ee7(91+KJtJ*sx6lxd>g|`n~kGv1ho!cz{ zJt#Xy?68S5Rm6rocpd^@?}6{+nTNmq&eYhBA?D#rt(~j$NYkfj=7t*3uG?+amppgw zD(vr~zO}s27c(+V`)`)Xn?E;J28^QUc#L;+Pxf`hS#)PvSm0fD_mjKT3TW>25-#y9kkP0rrlEo&jTkU;e~a zJTLwzb-mv;R3jE8Yl5P}irk9tAtKKecpUy_J8kfCkJvur4EDwm1Mwt&P?*e(V*exH zgko(&KCvXxh2_N70PSH3_n5iXi?++vZ5N6(4TYjRVGm2RJuH#-kT3ZBtn492w>ehG zrMMRo_w@0JXwv784P74*u(`)(2>y?6UDPI=B=Url|xep zwhvttgFeK=7{}v@F`7R4%14~GR})w=L>b2TVRPVxcFA;pJHl24@*7gX!}?xI9TWe6 z{`*oYU;IPL4OjpikA}qYBK#fT)0F$h0x{X-%Ta3XN>0SkdspdoQC zLik(284Gv`aK-@^0mrW)amFKj3^)@2rvPUnptK2xFDP*Mg8BW2Qd6Vb@uMfqrJ#o~ z{g2pVv<{r@6dFUqYY4 z@1y`n?`+vRu?A3laW9!9~eqzGk%T z-qb_+dC4D*yD3?Ku;q3o8*`gr7ki-(*dEG@FutY1-Y$y5-awoCNRfUh+&C19?10VP zrfu#v>A$9mT|>n21{B^!;M2pn=8I5&%Y|>w6T7KQf?O^u@u4$!Bov5Mb){jt5N0^Izj>A@{y}+WTmY4 zyw%m#)i*RY-LRl}VN2_cH{Bdwbjz)aZ(DNv(mU=vKkvb^@`}o;In_0Dvye^a4P*VM zLb?i=v_PK}V{xNX$#sgK0u1ARa{TtMeE;2#7Ppo7KL6Qwe!Jl58GFm}-#j>b#@bK4 z`!C<9-2B$rH@Dr{^xz-%J?;B9d&Pmze9^OT-+`A0cK-U#{Et@TJoKyPpZ-T`!*g4| zIsM38|1s^3yXO4c)S3P#*OX3Ka{SHrmK`kVdM3K}#Dw^*H4C3C*mcSq@1FVQ*(d&` z{k>TOL;35$*J?s}u=g+z_8YF?R?t3-)F++F|iqvfA2c=085WN>l%TyJNX3 z#(nHz*9x#p1)+a=Ia|6ADd;i;s=(sm0*e*;aF;1Y!iTt34`7JM(#%aMm6cg=ITCi^ z_KFRnqIguJcO$C@HyFWRc^Mv={2Xp%v5HP9$tWyhkR5a?{u)flJE~K~fH8<$@%S1- zZ{kj~&y8+W7DJ?wwFAdcM%8s8-40_dF{;4^ekdw0BV7!!LEOk97VFJ|)dvi%gJD6J zIn*&M^D>~y%hYfbF;#ZyFds`bQhHC(50S7Mp^R)T@Yulj! zGU>V53E53X>8=nMeaMn3VSvBmLBtx>u0_CX#Vs)z=#~_hnnISG0wH~PREQ!xh+Ek& zLyJvS2+PZ~A;$n_X7LJx$a){QqVf?!bOu@5@DwrwlFBHDI;gX-p=i-4*;tNMWa%Qq zBu9-J!=Kd8y~;wPqRzfo?HS>Qk`L;NCUGcZYoHaxE(g8Cj=mS!Ju6BSIS?CQ@D9wo?TqwrKVm&Oj z#Yf)cai$v}Ddj`a6?bu_bxpn%egR0C6Q)_f3bgLbU>B$#h4>SE-&b;M)6>XB~6R%DK6RPGEj;V%)j z8u_a>YocVQQL>YB94TH;;a32B1NifgxIHx&6D;?XPx>Cq zKpv6gnKMHjP8{B?wF*^-kb{ zEH-|HvbepeOnpwLZZfIj@-rx9&9bC5O_wb(OL9D2?gd&Z`JFzIGR?Nw!HSC*zD5=( z<|d(5P^C{}xXhvoMPUQ}@aK%`mBWft%v)j2cmtKmI#$R!W^gAYSmb3I6^PnQBg;!BZYGDOZq!xaS6sd);B89?F zOCdmYh^wf{4-x1iogG&GMb>SS$_jWaNhKcvNu?YCNo5lPQkQ>$z_2c9p0up{qz&C; zG>n#I>gExtJy6mJTxAsG$XYR(BJNLjl>MfoNX0;gg>vL=oR!{LDKlD zHGX^@Ql;~fO|XE;N0Iz4l2xxnKq`+!rSf(mAeHBVmzPZtKtMGC#|YLToAMcKjc2Xk zc%dxx00Pw1y;6VoA(f&No&A@+c#*3IsdRyFrc<#B`#LHjuKTa-OL0e^{gUiQ)1^wk zELB=84f!h;M+w!J56i+=-$_DGTcVJzUiMwui?yPH&GfuAgD3P#`p>Jr+JU(2tH)#= zGkEf@tmn9_=PI_rR8Wxa?Aw<28rc@V1s2=lni1{rL!^#whY0IuJ3NK#;da=>WVXYn z$LMxgf`Dv?c?igM@FO7GVGjbb9gZMy;dc1XHN;GCC2T0wTG2?2{Ytrx@1xqU4#(*# zq>_GP_0v_nhivI8eyv=^#Yp@n(N#S748!AGe3-g|3hk%tzqiJXpNUzaROqi!LK^o* z1hi6%q;W4mLRzV%q(I{yAO$G(BKM<3hlZ8<3X`eS*HKCucL8dUN_`$FQmOk8kV>sX zmh=pFAs{`&RWxqaQ9wF0Zb_czt<*|e8sQ0~eX|5phrI^vo3lJ+^%zMgmY2plJT>t< zrXxN_7!R%V75j0sJJImW6+?h5m{(dRod!A|cLQ$PmARa0gC-I1PsNX-%uBe*3p?{E z+!W7T%eyeTzWuqkzVuhul=D~kNZ^l`%1 zbgyaO(6-_J<&K~8pJ$ud<)g_hH{_PL-?OH>^Dc8nF?P7+4#%_at!^9MC*ZDVTW9B* zb*n^rk8HVhb+&z<)6Cq(58d41*+Ir6VgKu4Qrz`g@Bf@p`0h^Zu)VIQq8yt=Gf)F) z_>6Y9_3$v`yFSykVf~uVbfq(fX<(zH4f1g19>F>~dNzrk^*wFf*g>}qyB4+IvvOtE zhAibe*01BfLs@d}iDKX1E*#fPiqU)Umy$5beZfU{*UD_Aus2aQ_E>EFJv}7TwP{VZ zf@{`gO~!6Z>#`A4@}}8_%v~GSwRPV$tP$*a-GNW;X_SwXqh!ufWF^?!xLPX1G|DhN zl{vc9=oIYB)xA<0i|E7}fQ=hEuo-#>TB%mliF!DxMo}9Tbx~0t6%A3*7{$9a?!GMU z-nfd|?_PhO;P-gZ-G<^Y)O7;;eYdaQ*o7x+xdGPy<8}k5)8flM=U(8(q0!ke?2HrN z8OO{(?o|sQFFL)3vA%s)pKC;Vt0TQcp~}B>iVb6nxtI8E_d}jt-kmu+a<}{X#x#sQ zK!510i;giMOQ}C60UE{zSoR_JF3(Qyj-2heeZG%{Q|zEa$9oO@%h5q+slQ=t z%#u&vrV0*x=fiXAf)4&Xe8lPd@rnq81Bb7Vz3=&GXM0}X4S${0{hLj^KgQ1D*T7@X z#(rz}Y?{qd%iFQz+4;zR9M1HH<;!)S9HY0IoCX``Ax>VxFsb z(t|hMu*>Uh&2bN4|8VSz{i;~#_1^6AIEue6aozX0imh$mYPs=7ujL-Ia0JFLC5G=A z@Aw=N`8HrLV5^RwX!MTX>795ZqTG3#$;@tXZ&=uRV{0qY-S?r~L*DT_yc1izlW%N6 z%Kg3G$+vjNKj57Vd>M1+WApIsU=urzf5AG2)Eg0YS1j~hx3z`$w&s?t!>O&!#}Nq= z<(giEZas$3)eBpi5xxnVj=Rej9^cmd!3WLTSPp-V_bpKHcQpp!vSOqiOpM$9*YZ%AJ4A zea}L7zOTo9?=cW6wpyA$IJ=;A!M2vx1l(MO zxuw~cl9A&~R`~9`g)O9=*Xz5txw)_T?1B%r-*9u|aY)mAQ&Z~#>IjNx-sXF2t1kr= z$?$dji{!1_ARKm;_Z@Ygfi^z(V6XdsiC!cegDQOA*t)HGTl0-KP{SbbjjcdNq35^x z?gcGL)%@AI?Svw2s&nTZgEa0u-%)0K(9+Uuq&iD7EzMzUXb-8ij8X$9R8C9t@e>O^ zXxS?D;=brN?u{^<7e0H;{atSPp4ZFvkpGW2`>s0<4oPYo1ox$WtMuKvz;_Q@29d@HuwcV9#U-MH`sf@5gG_bfyxkBOVoA*4-5pYYCRZ<4*@-i6IA zzKtZ>=be5FkkPGXlfXpuOZ1xi7P5loZO^x$q@)XkbZEi0oL-zn(3``?8d2_^g=lE+ z^zVWqy5;mmgbQ1|v*9_QIqyUbHHY^ig?vqKMm8d|(Uh8l9Xal|9zYvB>GI9bai4nN z*a)ZeC6{t)PUrJ=q>ahD8OIAeAb0BjmJ4n9Lxkb0o_B$XNjG{YgBvC;^iIlgf7^wF z3$Q8wcY!m;{Q_b_h9Ul|h+N#~9rqnD)`-k8z22F9JX*jz6C3z1#OD7yyi?q(c!GdQ zx;RJU-#o(A{!((~z7^H}xA5gII0nw{;xPk%gtK3Rv$1dxmqNyyeH*=bzJ%AigHE)d z1tLH5Aetg9wKn!Fm2~V+RT551h(JSw-ibGOC*RdKU*=c-=)zT+h&W zF!^_25={IEsH1Jg{Wa)pe2)7mH_>-La4g4t1Ma_b4IJ>~itmtz z7q|3|=v2RwnsJp*@?Pe93kqN8y(p(|oA+7;9g0Xn5md~=twu4&y!gQO zBj`eQonFSM85Dt(^QEr57q>c9)Q6$1J%(W< zp(!qgBlzuR{OR``!vQG2+I);c?Dx<$yuVqUzhNez4tOWtNSljiXLQI{L?*>8PCN4P z^-l2p^ze0=I5i@Fn)v4t@fjobj>P*l@#PWuv&Ehf@iM`a`i8G6@yikMeDU&#_&9NV zM0|o67!ki%d=BvfKBUO&VzFgJ{-t6Najq0o*9`G_#5q4#*KDyB@v|l>%EaxEe~^=J zc~yyn$mfz+bzLlWBF;szCVmZOoxF;0TVk%b5^;v{?oh^$0RNMYIDfpvD}>t;*9q>a z&nu4G!mF`-ov&8NT`O+Y@qo;qhrh$ufBtL_{36hCxy8kf7~TNNoj!+?+~Ts~2tsZ# zEh9c7BYtH@e0D~>EF)f(5x+Jgo+&?H8xCJ?=+k+*#iyK6@EgjA*Js2VGvdt|@fPt1 z-CoR~S@3JAxfsV%h4jVvr!w-tqivDT!4shG-)H1E>i$O?odA1$Lcbm4b2rZ-`L4!i z@&xp^YqhQNnRbGhfg=Zzfs1udfE5nNn0l_}*(DviepUWb!5`uA;}MCK@X6~3PEx&1O@9wr?fkL+D$n$e^OR5@Yd(=y_ht3Ds8!8$Co(^Syq zV)&`ms_!#hUZ(tX6}`-ut4S{wB7&@`NZ&&UK8|SktWF0IX+CBQC=aiJ{NBhMhKCOP9ZoM% zzcreQ_TWbV(mO#2`fUHHz<+}f`jh;j{tpo!rN1jbKAkh92RfuTiq2K)H&9bs)T&SN zCF=!WQ?(vS2*Fn+A^2KAI9Dx&oqD6zSF1W}g>kOeV|{~wtnVd2_Y~-z@Dj*LI29io z2;m-ICoF>8gjg^1Cg3POXDPdMP19$?z<&N5^0)xML3AjKH8|^5#}{e1RKqU9Qq_M*_aVkHZ2y(c|C)y1)bKlmR}1kkI-b(-eM0!<-|6@{ z4fAQQpTzn*4QCOep6dt$IQvA$!y2y8a1G%!)jwT9?6RTL_i6ZqhF{b0n;Jf^;rBKC zKQwf)KR`JJgsA^w4U2X9T*B!%Xj7-(M2LEC(eV{J-lpU9r=;^BAKp^ z!$A#CYWRkRT)D$?XEgjsL!VovPa-T9BB0|}X;`D-0-e8ta0dJ#A^4VO+yH)7$9HPj zui+Oo{A)s#JE7rE2*J;r8or|;$8Dx_fF&%@ut>wJ2(N(O(((C(s6V9RtvVjo@#Q)m z(eWrD?Dl@0-mBrm8t&KdpoV{~;j@IO_lFw(f)K|4HX-=@fDnBAn~uA^DxOP-{7D*K zuG6p3@p2uPXW#&@PRE;c{w+GbM9158e5H=_xrg#RsMB|8_^5_YX!ute9@P+!m6HD- z>-axuXlp3_D&+Z%jtlxr$U8~HQVp*sEWw#bgy8>H4W<7@{L?yrhfd$8;S+>cVoe1h z>Umnj;~JjS@Sh2RH$(_I-_z;;uH!EHW0cR=uu#LxG`vE?Yc#x$5cHO4*sWo&hK~?} z?CDm4jFas;4i6*yGrFsUP=kbW+`B?OYt!B_1(S9k(6CrT zh#>7qj(bz*?#ji z3=x*#yQqeopR>JMHI(xLw8LV?0hba&zsof&q8ydl9v~-3$#|)juSUn`69zE<*KyhY z(}alVcqbv`+@#}M2qC9zC(u8_IOKd*=RZdX`QFfRsei~P^$L8cSI8;#g1FQRn3H-y zTOA^7_q zA^74-OzK_wFYvM2hdAm#O$fcN8v_Wvio3h+?ug!>{pd5EO_p(d*XZRK!)q*tkJY*$ zR>%6g@9x5)nQUiujV>q`s$7V&TFKINclr#rKhE*+;+>DjgJU_$g*eGX`=g9F*8E(E zZYJ6vrOV|%7b3`ftPR@uF`Gay{`q*iGV6dYRR0K^^GI`nB}Su3UkI7>+j@F7tZBao zYs8eu>SVhOZR@Z%2vXK_(a+WC#RbF5%k+VOTxoW7tNP26-l#meO0B))?x>TZJS%TB z9j+yEo+~Gp4rQL2_wm%L7e9?w!EmiUhAm ztIOp1fcS&6{NyQt_=D7H{>2}p;H%0FfLyg(x2u)sDR7O3sG zVl#jHzqkR56UX#-yjB>k9YBT%I!ey z>A={9G0j{U{^Z5?APk!<451?~kB)r}FcYu9fobsm8fh33)0bzldKZmXgpwcPVdxYO z;s(8FFCecFZl)Wa4ZY1sbJ8mSJwMV&4We{>_Z1!8G8AfNWfuYiW$)(rkm6)FDAmqJ7DfedS=n{Wbk)J^G6(BhW4xsdWRkS;dOqR-X1XL(C#+k`j;n@~5%*pSI_hz!=lbmsCUV_6&NjJNUyiKTWR@1%R5?-$~HR z#$PS)ocx_~@HfptkMHZ8{2joHWAaBFUWUKI40@j1hW!;DGt&I=c?SQ}{KY|UKXh*{ zLyymaPW}o(Zz+)2zIaSY)8qFK{7>tz5{e^##NlP=okQ43uiL>N9&^(4j>8c<`I`@V zhK7^g-viG{Zwu(LUh;RPgWf(xFU?;_^G6(BhBkkV>ZI4_;E#`4#3OzFVA#pu0?^|# zq`3^ee+H71-hR-l0TTI}joZ+BM$t?2*MMh7)rDJ-$bD^2c*u zKa`ZzA46{*@SOa;>EMrF{SAM7J_WsD{$T9nk2t&xy^AyG6)qXJKfL}*)1z-6!5`?^ zOwgC1M_=sZuNd?WAdUK~!fp5qAnfF?beiIiIJ^wKsR%piopA7n&xdJxztZD5UYW_O z67;UnVFI$s+pX=?be%ha$8WXfA`Y)tH9a$4oSH5~K<21F}pk@VZ&kQ!$(k3%t!{kVc~6uLXEcy_|$zLSTY={uFNVN1D7%83aW~ zP>8=U%sTRJ(EJgH*YBXngLx{;c%RYqOx74y z=C}-h*yxyZ%&5sC-nAwIXz*T!;3mxM2H+iaBv3EBUPQntZ*e>N5z?u@X52=9-^!qO zrUAB=r9Ga`py%mO%#vPU@gxl`s6<7 z+`ARC%OvI#81-(Kd8NqXe%U6kQ0A$A za$npk86|5tgim1cL^OS_?$=^G1Gj;D8pp8*J@y3`*c-S;U_W8DODLWw z6}x3x$fWhh6E!+*zD_Ir3Ilch0)V`8FDjIne4!uAGo?OeZQ zmjrO08O|S=a?ScgLwNVlmoJCyp(~(`Z0@~n4a5>2u_Iyi2ZpEz%1VC1q1{6~7ngAl z(wVkA0=Xd*(@a~A5to4PWnA);$344!5$y4deYpz7*5tiapnZt zCWv&#OU1#90VmEvT8U080389ja#3dhZI}~`CyE0Hm5xvbeQ7f6`*dtve)8P7o0AQ% z?H$6o2k#W=@@#9`1Nq}w7G|$=);9xXd2Sl@WkFYd&}VvKnCB=^kBgG99ozDYiI(su zEK%jc-m!8|XWFN%>t?mbKlx*y8xt7rlk9g)r>;CWx8Z;AoPy9^$%7B|dY~W47x*gx zZ?fG{|6ADW+4MUj4_(Hzrj{kL06&E>4_#V~iU*EE523 zO%`0V|0rBEF8qt4OMXccefL;HMp{17!Wn63$79QxhPKY60UP`)ANV@6)trTWRQB0I z^jY6PY{-g(=aAw%A9&K=_N#UY>o)iJ_oiAA=9$n70DXWVz=kl+KS6kY6h0?*5c}&x zH}E}99ndD|kDO^359N3M}a#$$wsk zo&6SjfU~?8_~eat=nD+n;lIlK+hsoeD|vN}9VwZw{I3uB^qo%s`wQe3Ko@3Qq6{A3 zN#3;m3+zEY%qwlxBlp7hMWBD!s?k5~#|_f3;rW&$M1|cj)yF=y|Cd zHk8LRIXLF9P3Y&G%Z%)EzqV0$K z7Sq{}YckTNAuW)RhG&cs{gP$zZUw$zv6Q93zkSH~eCEO4rHxXKF!G%Gq27g@CoGlY z>~iEg^+21JzAX~6X$#Ii%Xxzfa!Px_m~uFP`9?(P@NjrX>PTou$~i6{_Qz630c|`w+ILGeA@B`fQ-#rjdeCR%ua>Y?c4Eoe(5rmP~fHQU29vIgp#CZV{ zim~}gD}NdJkam=_B9^owVw)wVB!55~6U&m{$CQ}+>ANvrya+$Vv8xbmmL8|khSb|} z;4^OrWc*vm1{d{tb;6LRc@ucXbbG!q3;fy-$%`3(8MfHI;LY>{JiAC@&)~SabC-C`3C0eIOh-r{Yw5rkbjh%VPy+=r!rbroriZ6(oV=D z`SpcxMv|#d^QT6a#BW)QPe|PR`5c;BtPM} z^>fU>-gm3D8PZ=oRVaO|pL2WgDs^#_E_3tE9Frz{p?9ZFl<&j*A7|(UV%vu}Pb!rD zk!OPNrVqxv&X0Zq{@Le@j?oA5s4xF(n4@B@!ubsSXG2hxG4nx=&Cc-~WyYH_lJBGL z80CWBv;6Rx99#FmkFcHt7@G-KYiOQ>%<~fG2h2CmKISgT&`hQ!v;WqNX>O6 z4+BSHe0KGPF&B-%zeM{})RmM~>hSi&Iq0w$I`oLgOtU^B;@X_Sj& zPa)3hAs)vF(j@M9jmvlpam=r;Wxk=uvY1chnKCZKF-A!o=X^$lL_OQV`OM03f@f@5 z5zxzG3+!)(F6*IOj5}=uuLLKTMt2O=#CHq@26hbj`XK}Q4%?G$n-}0%j`=^z<-;xt zW5|!`=RMFIhw{tC4%oyF*aYQg|5DFBobx&T8|0cyTQmNYJQ@4Kc~9~gi1TD~W*YNp zMhr}omavUHp~t1ah&{+Yg6E6}Z%)!znfARp zOZ#4#rG25hyh7>*?Q7;wY+tLdtj1S3xi7IjTEk;~hmb zi3!UOS3`fE=;JADG)CPG(T94WYt%J@25`|A)fgXhd2q&9gUxfZ=)b`W$2be~+4LED zp736&%UsffE(|~EFy>0{bN&~N6Q1Vx3Z-MrgJD~TVOxcdL&ssITiT5~g1KA_&x|-1 zi|0$lwVtJYPtktplQ%;)k!R&^O*X)%?$SJO(J-oEr-pd;PQu0Ig><}9!=)OwYFMHn zp6R7O@B|)9kv9F7lnuPmX7Kzy*%#kF#5~#{^V|`oZ!h#sI=lROuB6KZQ2(FGAL)~J zCZC2s)+6;I?v*~Fz994>pLx&+E#Zgm;P+i(QR1+p&G-!25Q1-oPNst=AN0Fl(>Z`V z&ZXjbM&1J-%y|>#y_dQcXrsVLJ-h%t6k?oVA5PnnmiIa2$@dM=55}|+`unEN%PjY| z93NxxL=X5VjgrT`DauY=dO(A75NA7l4Ym~nZjF=&&#D@iT=fcsG}V1+?lr@hO&Q!I%E0jy^z%%8@dDivM`D{OdNI) zhn_=tHx-H}t@Qn; zeu%tM^f&qk^f5KZ*X4eVyc*=ur)B1yMjn0KRQOHPMot?A80tse-HV5Z^HEScpFi=IDtH`*6G&)UxAIV zAJE?#8qfUU-06?tOnD7FRU*fWVm%j`KjBa+c5{BxJ)oZZ<@n)0^fu>Kmbf)3#G|PI z`UZ;2cR*Lcjt|3*Ii9)@#yf!1Y%h+vN02V-L>|W4Jbx5EuRop$vwfo~FBaQv(}%fm zHew#eLDfk?ZI}YUKMT3cM!)pnWy{$bfN1x^7%Z> z@i{M6i0=uZklh2Cq$l~;V=ib|#SZ_?bB%L@eKz06ah^~RRCA>u%CbF0Na>h#IQABx zKA(S~?F(?u6tlx9k2Biw{ua+KIOo>ok6?@td5dLzYQ9{kZGya02F|A-zqHGxz%zBQ z-xQ+V=!bHJoe=%I@y;CQ^r8+c7L)TZ`s}oAXx>;K%aQ(f(f&U0Xy*50fL|B~&A6Te zqKxq=VLx@g7-#Mtdi(Dn8+|CBm6is1wlsVL>g8B1v`*Y;XY$Lu^wo+K^k?OqlIswK{CH2)e|xfxHHunvkAP zv%m6O^7&{l7i6vJhn^r8-}O?zeAjECO`)gBhy9;}4j0LJo_U8_Ans589_J-{VxLRp z`yaylouvu9m%NtkLR%32m+&rSf$fgg4h5iBSG*56%)345gH03!_>BqY&Z3QIH{d&Q z4rR@_K87}o^OZ%s&la*A-;Mqd@31gWlCtiWb7#u$hYYN92J&ccv^(}SFXUmq;hBEs z$Iv}_acN#yzu|>^;k@QND|*9FXN+f6!ro;Y#go!U`2R)f0X$5$VoMxh;Jxj zIoknsESK*#i(cD16kMR5b%TSDJseM#+6Pl5A%^i>f!jy9Y@A^_sQRuf!*8T$U$$*J z4$Iiq=aqKRNuU1n8;1s-hEK=4TQ}^&6@!h2(7&SS7X$F?7;lwd|6(fQ!M8fvhxoko z=QknjiGM!j7Ym239~(|C#Pik>?sBW_tDJYyJ`2E?vo0U%;(I5~kvP73fk!${9QcE@pQSw36xDYF zBlC~wk7C)B0=aPyv=rrg?8*G z`AJtGJaq0SH_Lf4Y=J&P_74%{{1iSca0{MmcS7z}Lp`Biy_Fm4OB}Ah!ggbP{2l1Q z%uW;6Eq?p9B?8cCKgM8;w~^MNW9T0i=2dJEUxsFL=F$I8ThdyLITB!0AUi z=5X)>wa@%pj&E(3cEz=jXw-4XjT^78OL=rr?CRoZ6p zKIk;ZLi(nHDD)OpZ4aE&@GV1`wn=-L55C!6L9}-b>UN90@8H{>97jz1!Oqfl0?ASZ zz~!?)ZKL*o!Y+2I^POLUsN1C6-xw)3p6lg24Sm{=@sqMI-hVI^?nB)eLlzu{K7)^? z0?+|vYy}@U)lAKUpaaTG9bis1*)u>tv^eRHwhZz826ce+C#F%xLCTCX(A|69q5V<* zm}l?1QVu`p7prGqjG=kNkKv4Uyt|Zo91s0ccYLQ7aOe*0oM0ct*noGuN-z1)7yF>d z(eH|Z!~SFX63735))CtgdP-ov2A`(hHw7GRfp6HDvg3U-G`1^?%?Ry(O9x>WgZQQa z2su;5fIh$gp?~i?7Hpby=uZXxE3TOKr}N=Y{T=Y7hqNz^YF|2l{u+TVJ!E|8Z?JVyobVVI~4dIBuoHh1E*kc&|Pvl7%5dM-0OTCHHosom7BcNgO zzkvJ_v=XCNaf@xf58EX0+l@!;w3oKydlcqJKH434#u)d+ zF7U(rK8*R5$Y=UC%)9%bZx3W7KE}a>M=S`sqM`CAd@JV#^xIzGuuf0^0=o!&{mQl~U?ZilAE^VKhIfRM`CI^AleyuT&3w+&oH#Rpv)a#fKzQB@ zXdUYEcy5`@cXZ4n&(3nN@yX~oM!_I85t z@%^_=`2fo3{+Gvc`QVq|S4sj%4=TOF-<^&kjd_-Xmy(FG37kffszE+|7RD%RzGGhc zA(-Vl!dBeH>@>Iro*Em=>~~_&PO{&z|FPe(|9Jq}{{$d)n62-5(DzCP_71t?;4O;w z4rA>0eeoT4h_-&K^eczq`>-Q`^xNVhH80A$JH~!>+QYm7Mc?=$>X$yngTBr+JnWP5 znIXjIS*$xkyON)Ac>hS;R=R3%C$mrR znU8(PnKub}d`9Q+eq;t!^LS{8?;W1@zijilhIS))523Tlf|*9dcmqhUeHp z__o1R5MdW!P6R#_(1UrA8_?^2*!KCi4p|8E`G@pO|3@3kcTRsN{u*+?*6@wQ1046j z%kbSVr)UGLyGEd|2DaN{{O}=|TfGYVG;PjzIDBXGGVK9nX)i4EBI5lRBUKxE^>fMV zw_pwv!8-%YQ#hv5emI75E`y^JVKa}VR^yq3W50PO;ato4OoDdajr`NjG>G@am=M+l zAl=w=3H-Nt=Aa(j$iv!1%nxC+{&ZWy9@KghE4EPj8=v_3+b595dgXjo<)_E#Q_#7z z1IPi}I~@x(qaN_B=Pk6U?u>c={?3Cb&WU9?(EAzv3izcSnZ|zN6Fd2xGg*wZfKIof zA-r$?MQXQogS7oJyw`XMbMahp3FdI{%L5O)eDS!Y#_Ky1-^TNMVGQ4qAS3A#(x-`l z9yd`ZE@D;SSNgzvF-qpx6Y6BwzV2H@|uR@o(iU!>R<%7n`q16^(` z@~rpv4l%#Pzfa90bRKPxd3+DXJV*bR{J2}2Cm0?-i#~S31tYxBJQV%s2;K!0+Iv&N zwv&EByblN^?76p!%kJODs7L zHk&z~aqiBx8Ij(v^p0l)tYyahJ%~8Qw_Nc#waz1|^7&q^61K#C2Rq24ui{*dl_cM5&nM{43(eG!DMDXkg-h=Rgl_4c(4cct}AfCY@aeT&sKeXX% z;2Q`1`=oAU`HXipW-Y)Yc(&j=G}^TX@7Ap_VITTG*7IR}kg`OSZf^iDTt~t6AI|hz zq;uUxAR`@Zi}`Th5Wjyo@vD%|^%?y3;Y_~<>0Ecg^>@znE0NB18C*N!OlKeDx(%+m zbEb2i!*v}!8R?uabKOTQBb_?t`jOQc>3sjT2kHD?>ZI>QI@g^X$VjJc!{5sGXaD55 z!*3HuFyA>W*ZjwmNBn&w*7WgP`I=weI8@YhC^a>Vb{l~HL;Oy#KNYvsIt12@XDxpB zN*;x;F>{l5X5if|>hW`o4?JQ^9?^d6XL;Zy^INi{IbO}5QO;WP%i(uHzQ|5|Yr^+% z&40SD^7jzou+8_5a4DxvKIZkQZq&~@vel2ZaFa`8il*`Zq=~hV6G6|9_tBGs7byP| zt}z&8kzun7$Eg8 zzh6f6++MXc`oZ>5YpbYt&d2gl*3iYAG!K0|Nj~qzxPJocLk*uB2=Y$`;d|$rzwW6QrxO^?X|6)woj(6Y#--y+dyV(GP=|mxG3(S%7+22WeBceHnDW0=jPm4yG;{yLX6k zn6}`$h2@TV7CXZ21kp9|?~v4ao1&ps{uc+N#xyz^1zA-@N@ z=J!p~WqVT3d>=^t^S28n4jSa)2Hl42gMMqc4Gph+Z%(}HfJYmVJZhdzJCbL~htp>K zsvR&^oPG^*)AmHbPQFQd06l)|!FccXql}@$H8!3I`WniTf6^4ucybW$W=)$;A-`dy zqd$J`59jhCa{Z@jn>?ZF+=K7s1?aeMV&IA3F2?;1Dm#js`#th^kvwF*NWh~ob*LO z{XTMFTVHH$`P}mAs+!8Gir}1zhMHhSL&F^WscNjQu5PHVsi|pfC~K&yYpSTKu9;Id zH`r8L-c(-ESXUpcsjR7OtZithom*aCJExw7>nh6YD;vs!bL$#|O%-z*=F~P;msJGo z=GHehRM*xwG*wmBH`P~HRaMp2msK`4*45U{t*EV;TT@oigevMQn`(k{<}{RpRIsVK zzM`hKrmVKHqHJzu`P{PV%3wuPQ{~*sId#F>nu-SeYYbL3Hda;F&uOY^s+tp=(^Oa0 zP+3<$r@o;A)Pps_vf8S~xs`Qw)zx*u>Z)LMc|}ESu&%zkuC~6W3Bpv*74_gV*jQKH zRNqiuQ&nDGQ4cD$wRN>sbq%!;s=Pi}R$tptHn*|1vZk`OrW&xKx_VAUbt41;pY?U+ z!C+N=Red#7*H~X!TOS0GhFVZ-sGdv3%mrp+Sz}XuWqD;yOXr`>Ty1u%)wy~xGu%bFxU)I!ARaG}-sHC2^!YS6|_4Gk5+iXaqRUe!3K5?s%jQ(s$IU0zpTS&6iY zvS4{rOZpJo950%u%Q9X0QEHnkyBk>U)@wzUQt$AUIw$6Q(0b7Szn6=EQjS( z*VNUNRaex_ZK|n(-fQMml$Tcqt81Ieni?CxcVl^7W8Iu;6ez1|s%V7mlvR~O8P#P~ zP~OVa{km%d zIK^(`#;(r1Kp@;wf9v$JK-apC4fjWx8OV~`+2zbl7Xr1mz{WMJ)&;T^LdMkr9F(_a z<^5@r^0>UNPT9M^cKoEI_kKCl)YLO@wDTAZbN0tJ(-D12r#6T%-NKCqvSf(?uSfwuo=r-vL^r-Yr0DDY2 z1N&7v6+>-HIt&cr27UaMms6|)q#%nRfFZ*YcNPQmsh~nvhaWObtR4&~lJEfp4&z2? z0xrUl=^T;XROuvDiCd;K5R!Dm-2huuFtZAdRcz`U@oC|=CXdoE#pM1xIpW@|`G=9e zT;|^=^9^e`LdB6SFQWsh=R@2%;{L4kP9QHJ>21oIPt$r$mfs-r8K(Ap;(?O=o@^4F z1jg&KM0N?^LEif^KPo9QtSJ^{r&tR97U0I38v=^#5)Tv_(UHu?IjfTiRa4)__Tfhq zViWe@w!|oV1p~6_jh%qN1+f+tpg7RF-r@-ICT~uG-q7f<)kD8i-*(Zg?aD zRp8Fy0(TODm$QJX;TD2o+;}NZ3|^zLZY5R#cNT7$MZVnP0XD3<3<*aj+w{DdG?DXW zzGU*!oH@u2o;MRMHs54s@`JpZYhW-2cy7Oe=aPN1-|8m6Lk3qe2@$T|)w ztXm1DN~}=^!7Nq-?a^f9Ww>$V1$0)LQ|3L1Ta90Fgq}^u7@`A#tgivQp@Q!NoK-;| zD)dVYgo^>#k%5amd70`N@!>`m0bA@m{ZC;nA|PMq8S@m@Ed)v#SyiU6E6 z;@?7`3fwtdAgg0jtt#yp=M`1N2B8+_nWECWB#u6DpO0f=S?x zYD|hib-?R>D2zg61R3%&Ne0o4rBfo+ml ziwU;i{#f=Dk!40rg;{qGZt0f+0LGZJf*R*~xLND6Bd55#iNqE|wV zB>>7`vKDaIy(+M5xWFg_WeqfVOr{A`fu+L*mJ)%Nk(}nxk2|YcOlB6fFlzv}>In?J zf*YoC7T_ZlWVInF<0z|nBaL-Cu@+0Lte(=LuO5kY+a`cwyu~?>`4q~^PtCX*|6E%ceP*hMwIEh<{tBBIik+V6eWUT5aaOz`*nzW?_<&vzb9-nI5#d+oi~ zUVH6*_M90uxYlFY*xDAMwpG&UA_6-Ou@KP=LlJ=uf$a&0p_&rJ<5F9RM}H_{f;fL~ zQT=e9jZm~7ZE3}iB2tqhQgO}`k(v~dYPH66G{4muwlmzEt9GI}d!&m+2LVS7c><6w zjV#Im6d1BU!1zNE!Hk2)HHzpVbPqTTN5ph9&L6TdIyvGsC9y+7J{LEaBR~M{gq=bF z;}-u@1T+P%iWG>e99ngURKht^jT`T{687N6=%y3R3@HL7m+PNo7=m#8K`^yVj?@-6 zR+OSHGxtax!j0asOt$o{h&#kuA;+%%+X+FFSe~M3^6u+~<{K?dEDl z=U%VmURN+GUbDBTaF17#wlY^MI(K^|ce{dNolG&-7*A`MJ@a@%j+kH^VFYdrN(!+^ zlEd2@8&=y;iL`2y?pENoWEv7`al_gKQ`Ob1YLgU*dt8_gsZCN~BEb~6h6RpFfw_G^3=*kU-Mg(w$&<2?it8x^ zynbw?;zCG&NU>cKLdrp~lfsZ#jT@$24=^1s+6r=)N#)ocFyu)91Sv}}bLJWXhg#He zBA7PBnV4;0798&=70Km}@E~wgaQm%38;BfcI7{FmAgd+qT9h)hEGuO?vgLAhvAk*9 zM2eZY88--{Aw@f(GXzs$vRemIBW2@af!jg^G&ZzJ)J!HAH4|92E$&uUhP{wFh?~6t z$mO=2Ob%|;PRJFq)yQh3K_@F-XGloM z<(i2VQ=JLLRFDrr!_mWxhN6guA}NkPu7>fTsR6qIw|Fa?vIa;j5~+yUafTt0~xv8Dtl-q>WSDiZlbaXTMG{$h-b<(FsUgfgHVb4)DJU8L$Oyw z@dj#OF&x_9uUu~1$e1!E-ZCYgGOc={DKpMnW}K(YI8#f+?Bw%tqj!WHm;^RtDlczq za>1jag#AKt#N_fy5g zk;GI&x{yT!0ZUElLx8P@+y^*lNEDXKZ4j&4h%7|G^@%L9%Pjuu@rs$UdgpTCb`-x$^Y~7lsZ>=C0G5JWQ$j_B~EfQsxZd7#_c&KdThHqIlcOcC*cJ z^dDC zSmxFr%iI!|nXh%WvO{1Cmg2@35!T^0V?=6)$sjN|nG6Oa6HJQ;xwucgI2hG3My~4O z4H4DFUe(1Ls5%=rMwQ^IZhcgZ>Jo3OOFXJeysAq?wF%oL1Xp$I!`)W;EuRMEOLO9e zdo&~}MXG2cKn>+F4HD&YhdolDcq1}QfnraGjd*04h!iM^6o^|GBU0lj#ZkfziE7zH zkVud#z8%+WM20DFO{73vgpAZMjs;A^$3=P?x9&y?Op4SnDN@5EXpt+vNmp+~hH28( zkpgis*sa0LHI~_l+i;|ehO1l+CIjhmxwRI7Gb1>8BS=$bvRkH=({z^ZgBvr2Fc9~t z{oV)`dj(tfVk21M6>Qxndq~x?v2d#%*Xo`=R|Mr8gs0u7=t+)9$)0|rkm5g+;51my z@`=;Lf#QZ2!rn7m&Sk7Lgd$V8fM^OAQJ9x&bkYU5^&sRSAtw-aVL3s~xx{_4v=ki% z95o~a^@bZr#p995Rhc*q zH=1kPuB^uv8Ej&Lo}0F5E~b9K;R# z_vRM|U-yy!s$W)1Ej} z=OSwgZjKp|K?GH&5ZO6CN&&V?a-R)@P<1u#R`#&D5Mg~NJ@6oq6_N%impcwj@YYE6 zkPCUM8I7`&q?))Mo`AU7LS9A47O5fv_rY?kOoE;Z#@RrEUIE75Kw=?F}SaBz*#5y^tlF0A?_Xq?`ET_H-NQow(s~2LVS7N!TW3 zH(diH-x*6cRUydw8W?Sk{C`7T*}=NU=Fs*QtS10pw}`j}Aa` zh2Lk$0|43qsVE_rYXnw-bU6ME4<)*t62{0yoZKV1(JQ$z?kvb7x!x-oe-7r6T<4XH zKL?{EO@XGZO>_+@3@v&Px5uiI?%GwD6m&6HOmr2Y0mfkPBbx14+&<3JwAJ3G#UH0} zCYlkxh7Fr9ZMi10JG-VFH5&8B1%ho5<|v|(1>#fFAS(=sbQ!bB1pp3VE9a?uPb${IW zSvR(Vm$y|p;L&`-AlRUlWs@c7RET5*BNgWmlroXS^U2^Ort*rfQMQCeSDeLDP{L%z zO?$SJKFgsdZpDp?K5nG;2MjVKj479EZ)#!-TJMV|x0SveLfPZE@pN<323BXf0w%VW zlaOLx8QF;`Lidf6dkE>P0@QfJejkZ-xUor&)wc`Dqwx-2>#g?W9*7^G5h%y9t%Sr{ zB%eH`T2F2(YWJcXzvJ7AW3ly|g~-YVzDQ1WEPn?QX&|ymwCS%Y>8JbpW>I)j^3}-`p*F*@a#AUh=~#rUmCZg8 zK`(D^_M!Zm%V6zx+8l??8FbpEr&(5eM=I}-g@#H;p)ETVjU1W9W)1{5{ovzeZ28h+Phr;+R8HJ@p3*Vx8LU)Y$u zaAO==H9uUtu-&vmVb0X1U{KHUn9`vs3nDhU^fV4xcO5b*d3GdsWR}T42NjuKi$o7s zH#^Xi+9!0tFp2J7k^Y$8^lk_LItz{O6VYpO`nJ+f_Of3@(0J6jte#`uKS^ykfHu7I zvTQcsye!yx5Xzn3iawfYV6r&+1!f4;?ic#dEX%s63w+~z7-Q3UHMGCD=dfNn`Vl`IE_I;->(Ed}1YUf)M0gB; zh2nm)xVGT-55k{-@1$*?0O7OSL)LEv{t6}`;7F$b68i#but(yr&z?jHdlvrM_FVi8 z*vs+PvDe{m(0&Ym6Kt+=A^T1IO|*guXo$t1LiUdge9H`90`=Mq^5=w-0M3Swk>E?r z4bzF;B4l@x8$X9c;<-Xn*b3y34kWRq$w!&c3ke}#3N!cM_D#L-0?dB0kC32+pCU0D z#ET^AK=e963|bX`sw^C8qui%?XsVo{oRRpJ`Zd z1LZHn2|MC{jkT)DR=kV99S4E^0Kc{os9-}nR)DQz?o8%(@~=rh#>|<_1lN{d4GPTC zyzC>)o27X%UYM4EvEy=H>-1*4K3FqWY1e-_p2y@Tq6()05B4tCDvo z&q7Qd@(hE_Z&ZER%A=g*_fVc=yPxHSABVAKsd-5K4^sC@YO#NTq(V0L^dMGAST8c} z3nBXtr1qE85|J(T=%MFua9q8~3Gfl+SsS%u%H5A7-#kC*%2em8%Q@{Kxd2MupG?otKE-GsfCB_5K_9=DUHnh%Y&!r{<_ zsxJJ1I(WyatYM<3*sWbBNctw5*(ZjTiPsesm?ylczvXlrBLaCVU@Vz$V|-OuX!7_) z6^V9ZeI0PpocASo33p?C3_p2o(0z$_SDO4!!Ar!u(&WDeUSeL6$$u2QM7<)D&+j8i z+$%QubHGdFD>nHh;3f8znEV0YCHj>}e*O>OB_NEK_IHz+HbLk!%a9kC?~@@aKw~*1 z*Q>=Vm2c3Qx5(vn=B;-5+~^^OYi0c#_Bt&2?mSo+*3CSAoY2-+;-8Pd?i^t~%;Nzt zQ+4S?ZA=}Zsk+SOTDeTEl~gR9@Y{C1Ig0H)Gl#>WF?1~&BjY&`C45s4plsj7 zEq2dWJGxVWzQ=KJ?Ox>aYWH%NSG&7Yk9OyVWUJ)6R%P5{DyEHSrB#bXH&c&jD&rbb zQ3F%W=oIPbxZ9F^bV&f83ZR0kR7` zd{6L;B78o-Q7)!>!ego@g+A+H)V3ctM6AFozVKolzb%vSkP9&}uWQambz|3@jWOnI zj4>x85sg95k>OzHO*~@q7EKm=+Kn)8l$ph`?ZyL;Dj2~Ye(Cdd7t?&{<1*d-Hj~Kc z)ctPKUr9Huq}Py}@HYP3kJN;<9SEBfW@ncJDV;FK%B}>>*pg5m$fm14oC3Nrlufr2 zdT!fnx}?zabF=BbLNDl%P1hBA;lON;jnIpRWpiAFzM&|aV88r;W|wYm z$X@2sOPaD|0!V`MPX&Qrg_|P&PX$^evmL1a2<5TlKw$mYY4aZ|ZDpzEkhO z_|7H4_g$Mwd<5b)5NF*9qvSwZJm7%ON%LK`9!Y7w37Z7QZw2s?NB{VyvIP9YNEI8Y z5|I)IrXt_eAfiOzgo&jA&@xIV#DT4|pF*nx_ef09@w>;*sBb0J;BPVqOH^ee==-MP zzc$8qMnyWWr>iRH=YZ!;13!}CHo?Ciha-7wz+Xu|(7m2l zvOl;26@Dl6-w>R_gsj!+;oTSOHVFff!`ZL~vxfqMUA~9a`RCx5vgB3}W`Q5)iSQ-< z2F){jFq6krMioXsmgB=hTVHG*t6Tty1|oJi)ynD$-t6OKPt|z< z_)W;qBC%5h-K`vpbJKP}i(emBS`69al3Ic#kqzM9hkF?wOuIa#_yB8~;-=0<>R^>( z*>R?^#*DWibDAfU>P;VN!>Ly1#~`&Dd=`n#k`deHy(&%v8bff4c_^G}WpRs{jv;0X z!duMFuR$Y^b31bnI}k+H`b>N}Byw1G!2cdR=QR3b+RTL2D!`#9&z~7&hu2`}_k-UI zKI`{5usA6htkJT1?E&N4E1NB=-Ji)^DS^&xzv$UkyT3EJZGenPX3Um-Z~G50;O#j- ztfY@Y_7)lP?IVkOy8tKOuf(xU`S9l0Y9|x3#q$K)=Nw9>`;4U7{|#c&o>&E@aYf8~ z(2g|DqkJ0kEKgp{7PMUh1)lW?cnY^L@5NRt?aB`C!tI-SDJF8@Mv=<90TWoF(~S~? z&f=~IO62>Bfo6YV>P`qWAu;tq5aA8I+0kc1ki+FZ2o3h|+_8`M@bvO(NDbAS-g5KMJI3NiHZo*-e=wlM()P+Ue$i__&`N3{J_6_7m zxIFd+e~7Lu!VO*?ws_LlME+Sb1=!zwlv<5Du*08-J%L%h*mZcJIDvGX32xWv z(=^3kBOr?pP0=L$IF0w*6qoq<;KGLyV~WipVOE4<$ukSlID76ch|uwOiijJmX+x$S z)KqQ^F$s|(lbnm0Z)!bz{0GzHv(Q5^;vdYuVG{V`Xlvk2KhK2nR)XgvNZ>6$Lm>76 zfu%IayRt3FKZa~s_}>`6zzsa=Ot3QIar&%xJZQcSTUlcHVVILz5|Aq>rBB=D@AnEDtBu0TTSUJ!SZ z_zuJd5a-%!*7_a?(IyAVo+EJqh*v@Me+z&3yCo*bcqav&d^|GXb~LE*dYvV-s7WYy zC5~!BwVQBA6BfA%J2hdcNr2UiidC+_eic~jChXA!cdo4|FeM&xHRPDNw^evOMlg-# zuN!^yOryrI*RWj-QI#rVHtgnzz!=Oll}|TIjb0}3ya8py zzQTrWlx(DnolSO$oHIzPc9_y8n8g+5I~Z)UJaKtcSXpnPt9<_gxuz6qU<1@kS#vhx zF|!-jafD52X@{{#f0J#N#Hd{Me2V0bGmEL#jL~3Yc+Nt{;<jH5gjMP_X)J`o( zW0?mfrXG}39Qq^G-MH`}itRihd1l=<&ukpWoPg=NyPC6(c__h$vHqvXqqa(u$H{K` zxilmnn61o~uQy&<6cx3>Jj zufWp4?L)CtJ%DUk%9^CQ{FhLipW6l&i+KJS*pJK4k}U~5-39Vjf~SK8Zj$Qqo4{{l zbD9IRM~@dt{|4t<*zY}zgaf#-_pt&G1+b0#{uG~VckT+^(;(LQG7yVE4DemG4?s6G z;fu3p95QpEnS;wcTm$&|$~S=D4W47nQs$#Grv3$~yHtvfVS*+ltgQ3$+?b1ikH|n- zww+RDKh6?nKTg?z1T97aE9)2njrs7+d-(l$JM89E3eUb)mq+0@{#EBfaeEjX2MYs1 zCSQy{=e>%oF7Gk_pKFoRo7jbI!6*L3L%3IF@@@JGGU6!THw z`OqQzQ{U9*>DQMTzubX=f1QJUnK(+`-@yOg@Zy(QZ4s6{`4@oSM}DaB)4zZhM;sb> z7D;%a&%=rf=WTE`SqizWfx*28ElUeSrR=!EF@6^VmXN=AnpKxS5yYxZ*b6KM8@l9 zLA2Qli4REhgwMZ1Vh)HmN!$hEa}WdjpuRSrg8K%X%>C6cE_!PP{u4Ou)N|iVq~nm2 zy@#5`=H+e=k56LfJ?|y{UyDvPs+sBA>)lAo_qn z?+OMP>@mV%pYgy8?#1X7Kvn1D&gPiKJmc)fB=$|^F?rx3hZ7_3b7+!Kevu=gJmoYE z<%1jv<^8}*D8JZgq5LH963Qkg@LV0RQ4p7k%wtCU{-~4A$HHbmqvwbY6y;${MWIO|WFGj7B^;P79hU_* znzeHY;bhlE$+UwBOI?9nv*v7bc@!Ae1(8ztak|#=Ou=1K7NEs4m$9>gKVF4_O|69K zW{`Lc#2gYwKwM9v7ycKz6(sh7xRb1m;njLzZ5fpjR|&%EKGvNxBCVBC{cr! ztTFUoiBpkt_4dWkXeAB8pR-@1-@Pe*sb?E+%9QIaJEyl~x|y?$y)xCh%QSmi3Urq# z^o~rS?lOJemFd%6rp`Wb#_lq0-V;afCR655GG)wJ$orzFn@ooNB4f@)uK z|GvoI9e)GXpthKCp@gnr%$LTe@;?F%{2)5=Qm~(uknw{F8MDAkAO34X#w*|@WLQBO zH}7_mdNjROx3 zyAA!+%KBrzyOh$YjUVk`2L0wB2zRErpLWSZA|jUY9y3qjJ>WULb7X$N^K$hBY9Lhj zrv96zeoRc2cODucrhY6a(YX}7nELUcMCTUpV(QJt)V~JbNK-u#TnS|tL-!)GPX_6N zVDp!f{gp8^7LNctIk3fy3qFNf$=qLy*|W|(C-T`PPJc0bZG2rG(*aO|_j#ev>Vxs} zP3^>&;kud@f8e&bt7$RU9cgi%Y4OG2rN#NC#S6iUb98f^f9D5`G@_-v2oMW5Ni-4|Tz*X>57&qT_={NVres8NmakVg%MHd$>}xhb1L$Olkn_aR5J1AODA zK{V{nGiDYdu@Act406f>DCY9o6rTj3BHj<2;kqlW<4=H~=@;T2=M0m66a4z_! zCica$k=P9}n?yelT}ey^(Tl`V5Ep{L9xL~9gZU)}3w~m-$4`MWQTjtA7E4Txn2Car zfW&b+!&k!|zNx)AU&bYTj52vopca|o;}T?se*|9U%lHJD;cd>;`7$A)h4O>J%Y3;? z%413w$b_GmpcB4_%$7;=E;4fa$Yi-XK_V;8|731llfb~5KNGsT(fOtt{x$IDc=%3d z>13HAb(!7Fx`biqMCX@!n|-BNe5dr@eC8ARw1=Aq4j#wgfJnI89J5nl-s^oZK9c8t zLILm1WeM|a;eJYF-X35H?mUXrt+0;}ev0z+e2Ggt#LmUE^Fb4rYS9-l)Ik$hegR%A z^@+rlyzjt^sXmpsk~aY%{ao7OFETOn_JWs3!$T$zEC+uP^FKF%-~{+#LjueuJ6c&h#|jIGN|Z2{O%n<7Jlnrf_mw7hKg#pQN}R79qtv zNgY8@!RuB@(EFB|$sLd{Gx;qulP?A@GkLF>$?L$&%J;UJ$=`sNnf#6^|7=h7(064j z=M4uhcH1X&Ij<9VvE6$zne)ExfjtZd=#NJJb?{fx1K&6LehyyjyIz518071-!WO zrwOtU-U?n8!h_QK{71o8vi!#h&!M{fx53N8_lePW1bhwi|7`RnAigXhZ}QE;I3;ud zW|xrDf=0NrgyCX+n3v6bfms3fAXV1H{UkWM(h(UXh4Ce7O`L~0#r1CyGN>8BL>{lq zdgvbOGL=tGj4-Upe9C`4Qn@M))}@BeOgv1PB0T16E;YKT^JApAl2Mm?Ea%E{ZQP<7 zZZt>w(95;ZUE-k8%$w2ZpKt1h^DsHO!g8BQi~_NZL<5LjBz_KJF9YEKZG@7+W%>78w88^rrypOu_7dE+b7T>Gh#(Z*0uyh9hng=Az9mc zf|nVwGQ{D`8wXxy#LcGslbC=KMQ#akam%{{yv&GIAx`SNx!`3++!~Uzhikx#$KNJ= z{sQQ`g+8<p!=r&6WZy&sULx$1E;0rXauJ-PeF=_ z;0@xhPt#w0iQ=#Kp@^*UK6x7|?`77PEctwKCjSfY;vcri8~?~noI?LNh(Ebd&AHov zNJ4&~@Hlp9E2)^fOf7O#B_=fFn$$`+wTH-JXH3~9H+7(-;zKH?t~058a|p@urjw)_ zf5Z#cdrkUYZP#vB{(wn8py>zQ^y4P|xTc?Q)0^aDN_iWL^)hzyF|hHlkw2{R>Z5k! zDkG1GDeW2T%A1cn3!^n~--!&Nf?FAss*F=PDupxYgyaj}hCD+CvxM5Lq<^7sGT$RP`vB|c zAZHyqzdCphYO*~CHK%zFYC1}R?sCA=Q4UzlK}{#mK~0Vv)L3VK#~R*}4*|4>x8#E~ zGlTcahiGO7zbzl2nHl_!6fiZsBcA~1QILEnrbj{Y$$=jEhYcScas%+zmbvM zs7W8(txE_k`c?|yE4~Hf=8Kd2y7x9r3yfsyn4ie#*_|)DLg+rEcat;I>xH(?zK8`L zk!^$a?h)A$nci)Z-H_?sqp}k+y?aawnE3R#>}X7U+ARAA6Q7=tos5Z3Ps%>QI=h6m zec+9TA9$kShn{G7z!MGs?1_dSd7|ORo@jW`6AeER+60b8*s=Sj?qc9rZ34&Xh+dy@ zAu&AnQk%)%mB^RdvGZ!Nw~)U(@ztTiAN9XP{+=-J+e3a`;#(&FfbT={_a=Tw9-s36 zh3wB0>7V&yQJZ+~9a4M#KEyp4jI}ZVCM;zpG18sI?*sGzk&ZjCG10-t9|aru-GB`F zVn9aZTLEDyek*`deB(bu&hj%X^R0lM{9bSqH9e@B`2AoA=WO8jgNMkMgNMjBgNIoB zUhoi0z7_lg8vK9nTfx>@tO{|;%4K!G^i(%QzKblC^1H~bRQE@%&M3)2un{GX#3?Zi z7FGNNIHUX(m~3MHl)qRP|p0<1jjxM|6HSIOf)s>C!yREhP9!%Fy~<_RcS zM4LRFm9GW3>$VOl?RuKT%69hu`rdwbaW&$VY0=LYI7! z_6Z32B<&;!`H-y{GW+knR(mFfXWwvF3gqgz_2 zsjgJD^4wNOq*ljBZC2jAdCIc7XQ2QD@!r`^0qu3m54*4gC4%`Q0!dc@KWG_Y_71B7`Y}%r&cSAa$8!F24c(5?k!YQ7QUlUU?aF!Rj7 zdFGqSxt{tMU7p0dAUM%ePlAxS-e;hh>telZ){(^ZE`e`@@MRExm3&Aw+z%@awvu>i z5lIMm=#Yob_Rvipx-E2~rQ8=D!krH5xfgvb8y>L{>3j*zz38{}O6IS_?OvlnRN~%< z`zY?V$jkNQ4@Mg29~b0xxZSG-#3tNZaPM#vfsBxJo&fF;Ztt~6nca$f)sdH5-y*Gd zpyFYZEst0vVNbb2iu`I1FSdafmlj^T3`l=SaslMUm!x@>YrP{heWPNf$(H{$mgFJj z`G~*^Lo8Px?H8h;T(l{#9Wi=%%*Km0<~2z38w@Kyxki$EGG09l$lohRTsbbcpnL9& z>avZ|6|L{rmUrH*m(x^ZWFv=y(44 zeFo0x+xNVg=gph}VtW4>Wn}}(&g)ZF(Qig~Yxsq|=gq0Rws&P&-RwCv3+B|9mX|e@ z_5Nb>=0n?7et!4!pKZVMvls99{1*@Q?$@Uu{`KwCd-n8-@`mdA-qlsp>&ogDOsT6c z>oo(4rclw8Xhl=v6-{v!O_|Ppdoin8fdJ?EZZW;NE-SIw%aD9^2`X|Tpz zHhkFl(c?JGddL-}!$$mA?&vEgmJTl|iHHm<9ed^2;a+~s zuzt~O|7doAmmN1^NZ%N~U%#jVkmxtyycn5t2gb?_=o?jQ$;hJNV}|uTuaD*0Vs?3H z!-Cq1(uRm7X27skebquHx?&Y|b#v-U%gW0w+NrW?R;5)vXPz~)s=C4w`Rb~gim>$T z+N#nSb7~h@^;QkOcF~A3=l1hxV?GnT1-x`AYmZ8(t0*fkonBP~FNjK?F}t?Zs|X%a zT3%7!IHRJpwytV+MSWO0I%jTKLq%!D{MtD+717Noo!wYniuScuZbn^Hi%Vx!G@wn< zY4hr;pgE?cth*kMKjD%A;B~V@^#&#r#MUSksKkiW%3k`*W|Yh_+T$O-yU6(W@cx8e_Pq)cVHhQ8u9@I?m?14#K4Rd1bZH2`J|s9jRePqzB~7tLDb(uBt)WoM<_i zE=m`BI=8I43PA*8T~=2%J2KYPJF~7L;zCiv9L9*9Tnkp!i^;6%@MI2BX-!21JSnO_ z^fu^@N`n(gTdA?Ot^zH=@T(4MW@#OUyH@^|STp7{!rAIz@)^|?Wi^e_#zKeVl(W;Z z6=Kd+m)4cll+T$RX$WmIa}GK^XSU4exE#+gmy6>@PcctFsfuo5R1)c~m9xuc2oWA| zq#Nh+PV92}xwm8G(E|Z(^$lfp4W6+oFKw*lAbOiT6HTbE45!pqmo?0sQ#ZSGVMW~> zZ)lj&Pzt+OVCb%$QQx<8Zr=f=jWzCkaa+ofiIpm^m{GT&7QLKPUSZ9lBUjbbHa1vu z8XF=|I=gIsDf6Z`&a_HPhm@2Ixw>@R$ZLj|j=#EScxkDH=ogs*Xv^%1*>I6?v*%P9 zQxm5zD4iWKvNoxnK2u+ha5oEj%1g_tXIY%(R7*q@o)y*>QwH&)Y9^-lteJgFTZ;@) zbDd?YX4lT~1TZEUt5wvfEzD|5TgBPSm8qG|AZEd4Rs8WqSzh5`pUAt$c^}Lq(7Jm^P)^NW6tc_>I#oLQI?Uu4!#m2 zYm%ditE4y7QvpN0cd$)bO{q7+GA%CZXfSS^9xEBnFk#2-DwWhWB7n?@Y8IopcaBgD zH#~n%Sw(HBJ3R0PIBos4QDr@HVYiPPj@EKe(CeYFq6wTa>9Lhbnecp+;YSHJH#!H6 z=IrzK+?BzcF#audwk8qQ@6H2Hk7VoNEmU7oJ+ri-qQ1czE2B7E{tlDB#qzgE{#KUF zttcIfsRtNlV7P%I16Z6Tv)HP=u5@-)eLY>3D@WsWt0tU)n5|hxlNQ3_KEk>J8}b^g zo%I$yO?Dr$Q7OHy5sO*F0*k6@>*nH%dPRM$;=b1SB5OSN24+#g4nc{L)=;auY#-JuHfSjjRgRoayxyb#r4RrG#;oa?WJYWoZIea#_u>MqsPqx~RG{)^EDrjH=qo ziaN<;D5-CpZH;34r_ZUczz3=SUp(y$;o)T&A2Tc;J^;0b;^FB6E0~lpB;-rOngPSoz=n4_MPVI=s&~P)psTz)6#MChm8X`9P=$oOTp=-{Pqk$E9_fo` zElnJj#utgh7oUrzj+RIrUOjwXK82ovxnV7MZWXy)*0<7b39N9I2bU!*4Mp{b&)Ttd z$uWlNDUkd~f81wrW|Q{vA@JUI@;Ut!?VO(rS@+^|d`ugLrJ-URcZ4rKoT9A*X#@A-S;8sgc0)x}|9ReU3fU3fx_KUP3b|UZ z9M3CGAve%#lS;HheDD_WL9wN`5Bx$!t9nMH$$y{gt@DuRf)Cvs2JtNZO|77vDd-RXAo99HW>OqY#Q~2UJQjE_JOY0MDW4e@^Lg4LFPOmV?r$Jfi`721C?0l%uPl1D3@V+oW3fsU-*P z!Wr*g%jdL93JrD!2AiGSLT5y?(=NE=RGj_jP0Y9VTZLhfLVJ@*{8J<`F?e~vaWd_F zR&yZW`0VFzY7W}>-&E)%2JMd^)?32CK z+MzEeZfJJ%I$hyp*fq^gj~AQ_sP7R3jvNImx7!}HkKM2xsrFs|V@{&o#^1x|wAtZU zLHmOnLJcso{d<3C5I$5d!|+M^J2!yu5B4PCn z3@&*d)g?7MXD)G)X`StWB{0%<=S-j{De+k+-)_UvFNAcEWte*|86%h&Y=Q`W&#<(a zZTszw^e6i-zGE??`i|e{w?d-XQPA-OK1V$Kry9i`twx5Et zKZ6>~_VrMsBAD3Fn1nukw5ZU2z%KM-W9^x|kK1Bt*sj_B!=h&UX>{cei`WHF=mK2f ze`R2&{R-z|w6RN}GpgBXj~0hH`(?DMebC+sg_;OIkXilL8_cwR$RF#S`_L{Y={J}x z?T?K@59(tZ{uKl=lR6-8R7{snNKTgH1Y^sr3{a`ewxIpR^_Z>q2Jq)|QumSi?D|65 z@8^L~1KjfZW1tG52Xi3^S4a#l5Bhs#+V5W9Y(EjeZ#jiF2bTpy4ffvaVc)HRX3W9V z;1XD&O%MS(HCPD7e(icrBKt+?-wytm{R*Xj1NIn7n-Y{*j;!aIwHsNXLH0J%zf+}4 zF+9&)e~fK;S4u8{2plK084(Nqv+4R~<{d{}rxzN;S=cXvR?+E!M=xm{|YMYyGi{O3KB=}aM~|7GGe}RM^qnrVVfr%p#4$-VaGs6%xF0&VG z#}b8tj6fq{R)2bw_Qx`*Jqx~&Q|O#-&q605eR^=z|3e(}zbO|p?|*;;^-Qww!32@8 zS@`2&Gv7XqrY}Uef5UDLHV0R@Ar&Ztg5UTE+TSgV_5NqYlHVah!jir17sQhGwC&-s zbOyA*qA+K0)JW9O>BGB;i(siaBmUU#lt>y3RlvT@5k`N6%WyE)-P-(0o$*{ zV(2)d;HUOo3*qX=okEET&(IIwzfl4MmRbkKTaKo}yN@`{p+Z;Q6Otkv%Mef*aSf!oBw12T)=*Z`tJ)t{IhxZ zv!2u;Qa=xw27EFP0uM3y0F!@7>ce@`fJaHc&(zJN_968Ql0u<|UorJ<=5K+rO!Vf> zd1it=8=?=+lX2KWJM1-WYJtO~jh5|6;&z53`0G5KX^^)dV3 z?Dle!P`*4EI%I!mn!76094xetgF$4z2bE!KdJf}y%>Et8Z6t#$ z7;>d^uQ2f~B%-6gCjB!`$>`?7>S2TAAkhIKT13Zcf`)`ju3h}Dro<0 zUhM4uPsrzV<1$r%uA)v?=yXQ{l3}wq&{34wN%cEX8jX4Z;!fyG^5WL7 zfKSEZ^8#4xfM2KR^K;pw*Aiv7xqa^Tm<8)q7}`k+EyChG@0h(ObPS70_oYq>%Z+lEg+m|SAkj!U;o}4kVS?=5HbhIZ(hwepBJKCQoHru3N z@gop{#XF2}5|=s2b~Y?95DZp zfh~Y9bTOVWreYh9&fIQB^&8Y-G_}XHycLPqx1K;^`)}X?g-(}d=WH&^FFI-8!e<+x z$j%XWv+tc3YLKVP!=YH0U!TO?+)5ax5RWlf`1Z4XPbM8h8?ML0P$RZKNwI}qMIp?S zcE&(>j-p>IbFxM|Ltk{~2m{vr=u`^gEjpD+=jXm=9nz9v`XsD!cQoQr3UMt7_FCOY zkNF24T~KfhGGNwY%(x8&Fl;BFB!iC{oR%w)22X5CKIUAGhWElUT79lX1`#sp8(Ec5p{Sx#fn;HE|1A6cqcH`xS*r%iS zl4V@djyV}eVSVVrB>DmsbVGgX!6w>=z*(T7Tj;DHX710>6pYDNG|1hcF(yY?!&=t; z*JK%zyO53{`8(6^F!EoMzP$nA8{_jWnOl&7P3s9NYH8RWvx!@pLSOUu=m_~{`dO_=N3Fx6#nfa}4`jl>M?En`mh}kaHl?Dvkl#b*i>B#I|Ka3LNc|dT#g86|@l@ ziJ9-ePW3q{NiU!z7SxzFKZZ8L)iWYX!mfH$ZtqCJl7KM)1CMzH{YV_`WG!=2N8xYK zeg^475n%BwA6_$ljWl@EJ1N*1ARe4r(J&rt&Q{yQYve24ko>~sq*=JURNJ93inNDJu%NM{7c(v1h173V3A<@+~o zM;t)ulPR$B()vOW6hwgJ0=WbV(3{2ZWiwg-TPF!ikbu_wrw+3Al2r76I~d7YMh*j) zfp9E3{%O)ziVn`z?~!l;rnJ%V579v;6%WW6V=s3)FGn_XiPnEW7|mOsih()=(e4;8 z)WF{T6?@JcFNhue57K1xQ{dueA+UdTU9)p8;uPl?9{@!4x%3D)@mV~(!Fbz0 z)JptX(#F`WR;JW)aEULlMgK$sdUXNP8`2Z`nVPkDBzC3 zE-><&X_#$KA%|fTHgZawB&^<}gZ8IJ{6UCgFGT;8v&uhT2OfKew8D{1P6GBx!<`iT zMRwQV2=o)VY{8Y%^HdYVE1LHl zk`cXrnFa+PUKbmfo@~RwWMj7yUIur;%IL$cRBq$#WjGUrlG%&;lPzsjc3bo+&kRt;M8|I+B9lFoQxb2!FCVCBG zNpQ*MP0hbUZqf@u`&q;8QTA!WzD410@IYbMcVGvWeF7|M{A0R2COifX-TE^)`@uP} zE9Q}OpVLWBu~Wx7ZJ%{gmpg4QcR)Kl2Z=szzb(V(v`w;8VctVEV&3~Rj$z1ATcQ0a z_NUl}{}L&~5fm)@LzD0@_t9U&>A+%IZzju7yAM1}yA^yYo~z%e;ebAqVW!saYv4xk zH)Lk46#1Z?y#0k`OJ8vC`Fiy8_a|sol<(pMz2zqO)k;{jt^GYry>d=75hFepzP#AS zs+QI?+b1((eR(mCdfFwekTVu1I2zAhaz?928c(W{M%ulZw$$)wEcTL1ozv_E%{Xu$ zxx{gbVonKHXUSP$8h7EJRC8gokK%yRv7c&ljGL~Hs$t+e+hVx>b}jy_C3WOl*@FM9 zE&BDvwLGq}-@}I^a!lK7);IG3ievvPqZ!@aF`J5I86nhih z#klf(t`}II&VgO;6q=(tIjG~)aH}Utklc}lhj5s52To@{n~P2{T*0e;bJH=WBen*7 z8o@)smzdp2qn+dyr#)sCpA@haU7Q66wNHS_vRfcv=q^x@7Tk$B$!+DWD4&E7g-y5# z&?wFa69k#td6NA#XzbAVbdYG@nTYMbos6S=`)PLat*m1_q;-13SJ|)aP?*&GQqW$< z+^@tYseCxQvsxC8x3aLfg$v-hx0<2hgDeEThv@<=Vc%Vi4@h7=ILVuG(pqTmt}V2; zVW+gaRvNPdUSsd7<^Bx85Am8GFgyvx(l!|CZ}_~2>*igURA~G^G9bUEhNl_$6pGWL zErK?uhMD+@_A(oV@$A4x+|ssi3A%9f+GhWxs9nPe%oHc77-Db$HE$MH8>~Y3YbTmO z!w(Llud#g5Mz4VN^?wKA8%&YQw*HE5Kt-+ut6x-pcWXmbeot#=6yMi6FNz;v@yC}U z*9F#Bp8D}4W7Z>4{1EHODEVZoYgGNit=psWM_PTN_%T*e6klu|iqb#9S{KD%V>L#} zx3O}f>MOOHqVmhFq9`7p)<*Hw)<;qLYps`~c)Xkz#m~2fN0raA`0K@yYmv1uDu1z6 z7{xEM@}u~b)(=toZ?*PE@oTJAQT$z2=cw`>tba!3ce37%;yYWj3mc zz8}@y`UCPO@kIr>F1BjH=j-=x_|3#WLcT~o;HJQE>niYr!}24o*CD?voIk<(Dfok; zi+`@M_ClV&&SI`o>um73e3?S7O6v~DZwu!)SZ^Tza9H0W>jmVy-&3-zHP)xd=f#&R zeAdsb0*uF{(1+JAgue^yaUlilJPJU~owXF?H zo9{mPt-Ituks_Zf`E9I=HJ|V3`0c%FTNk-mv62ao_}q=DB-zmX+XBM5W`Q5;jf9|r^N83F??AJ zUmnBrjkU;S%Qt(yd~JjQWy?>9MUrg!VN@@_D8h*RjWPV<7=Bp{zcPluHHKdk!`~Id z-xtIGJci#G!#@ziKODnvvi^(ti=y_{-rVH|G<|F^8NK+nE0JRe8Q6 zor!q=qVk7PJ`?f&Ijw(@o#ES0H?6YXb}7;(N52R;l%a?oBF@mWlZMlKQXV=Ua;*$BXZRW?Cz)bF_Wj zLu6t-xQIr;HAVDYEI&C$p6~uO;iz4*h6gN5tt;pRI9IqS^+hxsFrPM+gSY*E~-2#A!w+`OZk zvr@|g2P2z&t)kQq9-A>q=lA=WPyZsWB|d`R3LtL6z6;}U`eoQ(0dwwwJ|fyxNqiW3 zc)9JrLhDEVU?fxDc;X#KguJvL{6@{+s`KcIM2F-6-2Hd4we<9K+_rK7;nsO*F?;8|KHVpWJDFvMvWW2qMHL zBDODEiP+YNp8y#b$@7^hXFdFY*rI-e?aV{uvCZNBoVcF|zd1@oX9Dya^gD+Leh_gL z;t_GJ`7ILaTSb03ep5nm4-t9}65(Gdh@14kT;hXhKk+j71M#=`P7U#P=uup&xQPg3 z9wg$YU--X6~LIgO{tpz}dxGFYF_FVP`Z&=3gZdyv!5Y zSJT%M!EYhnj6b|weI+JFhWm~Fi(d495yaU4O~hU1H$PbZ0Qp!w*JKe^oY!-##5!0{40K)=)v zoW^uurQ&?WCPkP;@>eUm?c1ol*b9k!$fKQyh?t)zh#VJfZ%8p)QQ`seCEf!2Xu9+V z{9xrrC~_Y|Kjr$$_HH9$9_%CDt@8?eir?@9iLe*fZ(gS?&yxot$0+o$|d;tKc; z=K=Eh9L@YmM3k>3qJKMxw_$u0j}sx!eGcXO5Z9t!BGQ{QeG?IS_7Ks(Lz-_n;88Az zh&VA&aS{>rG!UU@EfMYG4@xne>pjztYI=4MJmWerZv64MI)&r0SpB}q{OVKAZe0)N zB9C^wLF3r#sF!>*{F1l?en=dw_Pzm zEc?Beh<+X=qTQ6Mr{}LA4ERwC6}uQ&LVoIs{OaAzd)b#2YMtPZG_*mUC^Ja?PXkw z)AtkASE_M;nAYdod78$b#oF#B-5-J91X22d_$S6q;zJAaSs(1WjtIMMCZe-@iSUmj ziXqwyd_EEWBKx($h}-00*VRPm6T5;xNFMz>PDH=>dr};STp;_EuUMeiLlMo4_)Qtc z8Ej5$Kc}l74b^pHf%-LY2jx-kej@5UPQ2dOm3}F4a-sS;#(y;Xx6#CV;xzKe7k>ga zk%ztHa_u}r*Vo06M@G&D-48cK{K3+4;-9Ez5qY54c_aKt`E9`PIJ^4Gb-ti8qp3f( z{}t+w=;u1-qhD-d&SJzBViW#QKkS`CM0zd}=>v%vr}@NY9seb|4h)7}I9?ck#u<)x zgQAQt_|4=o{<43Xuj7pIK8*BmKV1Kxss1_(@dQoEc^Q9rx&5rv_=ItrhU6Sz6LF~S zPtiY#FX*4l6O3bs?cRue1QFvS>o@ow%A6oH|YZW&u?ovFUcwABJjq=hipu|&P5!=VYyxjg@Yud+kcp#GLXHx&q)E-#hU?M4p zA(8QP+p(4Wy}Dn3{9*E_N9qSJehz*#>jf|V41SgJn~30d5+A}i5`PCh#0Sk!X%f>p z-j}Ig{8r~ZI^V+d-y^;fQSKyh5BgyP;pZcW7&qBBKMy(bkdyWPDa=dq@Sjis2tC{< zGe4jB8uV!TA|mA15+T1?^ZEap=3st|AP&QL5mA0K5#xP=_%h-u*K_F4CB6Z>0O_Ya zfcCkFFU0dP{zMGIK;i}HFY!Y7E%74EcjBd}k2nZ+C0>kiB@V$lq&P`&3b8-xQofvc z3G7E4fc+{F`f4@5fp{L~B@uFRxqecu`*7GdDt)$@U;g1(tB^q~QpD63e!b$?#LMwH z4#t-_Sg}g+cEt`DNBq%nfRUJfKXYz{_=PEv>_;;tN5B?m(C{r3dQ+~k1D>UXyqEYzKYWo?^N8SnApY0T}YgU zuc|AqQhY}7BVrliY*&Lr6mL{~O|f&H$-i82sp2uk^YTr8v0}60R>ij!k0_>ggZy;- zm%)mqiYD0Vsr`7`n6gW`I{?-eiUVe)^W_F1N#bnFdS8(nX!89PgBJKX*bfu0<7Ybt+Y{^Y>&nVw`da>4^PEXJ zG)LqwRvfKZqBuzrAxh*hl>{+_f>0$mS8y&>``A3w0M)6g}w-rBD{F~yx6%%dKUY<*` z-fZRb6uT4AzJ7`m6e|=P6>m|zPw{cZZA94PBjOc!j#B;`BI^5IdAyt}e2_@{Dc?@{ zT;=&3#QfgMpR4>O%3r4Z7{y7NK1KOi%3rJeT*bwjzD)Vm%Jcb(^=(jmOz|1be_r|B zMD*`%#ZMH!R`fY0KSQyLB0mRbxgm-Z6=y3hQQV;TE5%ocXxE<+M1h|J*D?d;9CCaZ*{!ZoZQT{>YA5s2k<)2gjRpnn-{$1tYSN<=`f1&(0%73rC9Ww1p zAfi86%6CvcPm%wz4fFZ`)v$k~6elb4$M2bbz2Ys3k0`#X_$S4GD4rxj@9BxaLj1oK zMDTnshju$(`Ju{Rq5L@ICn`Tf`B}=>D?d+pzUM-HE0n)ed44|6`W{q#nuvD1s`#$r zUlhMlw3Ce7X^Q-BN?C5W;$+22;wZ#dBI>!3h;}q9f1C1mD1X254=Den@=q!MlJc)8 z|EA(cMAVa*Y%o)?t71RJ%M?o#s}!3Q*AmgrpDRA9_>AK372i?(K=E_MV~Rg0CSk#) zzV?b;6?-XOsCc%+Ol3I!p?6fzN>hUI2!x+RNxr= z&rHOz@HZmbc_|U)hALmAI90KMcqPVB`J0K5zfJjjmA_y4$CQ6k`R&TTr2HGozp4C3 zihol)sTfK#^`sEd&TQp#lrK>1O+@Tyz|aGvo3pQ zc7xz*!5<60C>R#}Tri=t=IiRf;S7^F4!ozfe63x`@+Ou34SV=mZtN23-WvX)SD3jRj$H6rZ#j9854Q0dx^ zE=0(^1&0Yv7OW?t-V(tzg7*nNBDjNiEv`pJ-b+M3-xApodB4cViO}zKhQ_l6a|ACD zEEQZPc)#FQ;w1cJ6A|{kL_~YP75Pn(|0?o6kq?Ocsi2J;4c7A$!ILKP86sy1_9vpf zJi$wdsCSj%4U&JS;5~vr6#Tj1Zvjef*S>!1h)!4 zE4W*5uiz)d$+$ldIUz&$qZ1MQJw!fBehwiHY=E~borUr7vM-4(s5 zf@Om91s4gfCZgW=1s@UIF8GSzUj+{eo)8T1xgF~F5F8+QpLrTM!F_9mkJO9U?$oFrH;xKePP;DdsX3BDxwd%^w0DVFu2 z$X^gKj^Bu!*h|YPM6};iQ=$hV4ohsdi%UMuqb zB5xM?ry@To@^gaCMD*wPf^Q1$6Z}Rny|>mIAb36z{TnTKo!~sd)q)Qar{cE}iSX0Y zg3k-SB6v{nnBeDvo@`w&iHP+!RphgX;2kSCU2wkOt;Fkb|4&4_8w4K^d_-^$5qj!* zJn(OnZ@~2(5&iow(fdf`uSK@|=yLVk9{gz{pGAb6CGudA^F+Q_yCVNX#S z5Bh{#Nh}!S{&ZjR<}y_>ExC{<^#$5&oJYSSc71TqL+k zaHC+8;8wwB1$PVX6?{+dkf8Tm-CiQ`dzO_ha*&ArXN#OGa=yp~B99iiSma3}R|?h% zHVSSOe3Xd!`6LnTJR`VEaF5`h1ph7=7Cb8WwP4%;&C`{Lew-yZSa7)DRKZz-^~6&7 zd+~yf`dHM*RCpb>Fi3=*=L!xLoFo_$Tp{=)!CwmQB39zMfe7Be5MjqVBCF3)As-g`Qz`#kWPh&K zPavZH86x)(xsS-_ihQ2P7l?d?$YVvGEb{dtR}n*&b(7@Jk^IF(*u75h3BjF$dx)^- zuwY`Imb(k~791jYk>FK=*9w*h-YmF~ScT`)MEGUB;QfL>5`2RQy)HvFo++3`oPpmz zC(gxlb0T;y68S2T$B8^ergg3k&5N${|seSzldA($sPRjkR>=L+5-xLWWBf)5M+TyUr0?*#uW_z%Gk z1pg(-?>=+9ItykJYw+Aki~Ou$MDjlr{8IA! zU#j`?1TPf4T(C%Rvf%fKXg5TJ-D@O&v*hm;`5nOnlK+*+g9~*1G9vnWli)3q|0|Jq zi~N@0e!=5{zEPT|r{Dm=3k8b>O9dAQt`K}kaI4@;f^Q1$6Z}}vbD3^0TktBuV!=6r zcM9Gk_!Gfr1YZ~YPr(lbzY$Ej9PJ=p`w0#eyoNX%dm9nqw;6)9f(r$g6QQ?}2p%5% zywxWd5KI=#AWp{L8VCjj@t8>E<1$h`r^4x5A(l&p2w#O`h~LwH2SO|sd6M8%!D)iH zG*H*C2qA?CA%%5<4MY?+3a%1dBe+TMA;BiWM+LVLuh4(DO?;N}mHO|jh|QF*(toE% z+(Q|icujCGajgEkB;wnY3-#Yg5gp3o^xwM@4^b}CfA2#)M)_*}cU;61l&`_xn+RGq zWR8bmfLM(0=?JRt!%e_*56Zv{;zW#(V32sNrT$)r*q<_-JxDN@i1Ex996`KJ|6LEU zfbtamcap?0l&9*yyCD`+zFz;GB5^9^8}R*n!BQdyvr=#t5#wGX7$TP9Plf~+63g`8 zlMx#zmt%YdR}m|)jtH(NR_ec}CvKvQ`-z7Hn}{>?-`Nu%r#uUPMq~aXqaGi>)MN-~CL|i>2 zauX5pv|HpoM8uPdAJjie8SxZgyO5KKh^K6k`x6mQYFtr1f->T2w3Lq_BCcvgR^x!U zQvQVgM&=`)9+z_EuZf6%kyZZ@Psc<)PDJN2JV4aXBqFZ(cfORz5D`x`B8P~GC-pr@ zly9O8r#vs^%|yi0dm=kT#8toxgg*B(U|gwv%pm7eMqEvk@={_cz85F*B4U}P{!WYa zAEjK5_N2U-Sb=#evig1_;wjmOeCVeV5m$pm&LtwA)b|omuD+LuxT=%#g+#>FLn1d3 z5m(J3?$OR10e;NNYj z^@fOe@W%rY2j>tm{udB2?wbNYjQ3|mjPq>?z=_}^VqCwM2*h}%Cjl{zPA4G7Z)|5E z#_b>x zbw&mdetokC5dQpz2tRJ@355Szi16DLX9D4`q_ctWlVyG^nZLq)%e?A3{Dgh=oHG2Z zue(6~Ja-5A>gSeo=2g|?jGB0L4t{>Pa$ydCYd6PKRzJa88@km}N*x#Rr_+tbX=p%Y zev(>#__<@wQ|NsM=GY&WK0SYj+NWuy&2OJ~Ox<4PG<@9TgKg-S^aPOEXR^c>U)w82N2H!DPtioxyVt&QFW4>6W z%Bu4EnI&cA<@2f*=3?|0DE z>~&@3?Wgx?*uR@i{F(UgW>H(s)3CSx>U+n%j43}2lMb%aMqY>G==P}&s#9>d3%}Kl zl8SkCr{IxUKm~W(3-HtOm1S7fV+$&)D(fqBw(`+w+QtZ1%`d4fs|uCir`PA*8akB? zr&9b@Zdv&9&ihUcoI?9Ft>_x3H@*X%(=fWaT3PiSeG*mFyr-H?#@A8xZ#lneQ(B$U zre3>K?kTmu)u>ana2hA+8mG4>M&~qEwAD00&g+(n*&+VIa5V6lS5{fsE^mH)d7C`= zqD1CF2Agc+Nhd6 zzsl7VifY^${AJ{ldC&;e*UfJ=v9biexjfI6!yZPLfKb`Ivf1-3b*)xbS2wS^yuPlg zwRT%?%tndonLcIBE1NTuIa-=uH;*k>%qpALrtzw}`cO2ZqOOFOcC$lPIp5rVoPSGM z$jx3oXGZO}`Vsb-3qYO-w0=96cBmB-qwHyidW!9or7bPy$=q;kOk2_l;u^Gbv5(p zj1p5C4VTK2`Vg-(T6@CPaYk*)jCr-QOZdz3nn|x8HPv%mnrhvfL(bW4v}RzrYO6M5 zUX?2YBS`t%JkqMv&Ks>oF`npfPUHHaw$km`(`mUU%*^_-d6li6L4T{~AmVG==Hb+% z@;dC#t(=GM!O$7T|FzXRn26=KmdtiByOMNtMWt0yR#Q`3(Pli17~=**uZFz7yrx=e zwR2=h7eX%wDwsgHxB=ceo0wgeGwcE@yE12}ddEk8IrC}}EM+-4MbynfcA0*|pJ_vH z7~acrhK{guiddYdM7)c-5|v{9`HCFxAXo2sDo4HL4_AfieW-fR8*V6+sNV9=Q(EeM zsCv&k&uA%8z2)aCyYLRX)O%jO(Ndy*8>YDM4s(W?@;sG`cQIcpQ8Rz2(jSTv_H(Eb z@h*yaO2)g$x)@7wSyfqiH5Q>;s^?UeRD?p9I(cj}U%d}g??cslUY@B8u`CCYcpmNL zLF|w#SJ|fChpG3WxltA+W3vO0<>KklcRnWJc^4iLMvu{>Z0lk?^D>7miQhnpX*`Bg zN4}r|JhoFuEuP!O>b+)^fJX0T=;6^^^!VxvJo|+7GrVXI_3$W9?H2{U&{Cw;0fG6( zX2Ul+hHuc9c*Y4m@}Vfo_cfk7y6p=<*n@I&7{1S;=eBPo_>6scI~?fNxO;_B|Oh9+luL1`qASqunUq3e6X_FMxri zebnJ$>{}Ycx7}qQ9t}tN2Ercq_@;u7pJkZC@b!b9yT7|#_TkZTl#lzWp?cK5F))ty zQHO`&<0NqNrGMS(KRl9-^8Gr-zG9FaQcU{I@I4*FmkquGsL+3B;zd2$LI1n$8v!Gj zPaPhHZ&eImrOUpvM341qP~Yvp0?7SIB!}Ufg?#*v9(CYjecE>pUdBHDy}H{z)}tPE zco@FRWB3-i?8_28*1JZ}w`lx@P%oK8au~kRG4pbfwA(vIuOMb#u5q=S4PDcZ&oH6g zerXiG*mjR7?k9q%vlHYz1Ei z4CZ*8D|+-_f#!?aw-xX9*gyT56T=YgWfdi-3^?U(J~+eRWe3?DxSbociy z@CBhm`v&7>`pbP+@IPu_Ws0_sIy?;D12KHZUG@zTJ=%8^^`RQ|Uk&6%kj-KE4k6!d zpYJ60%77B>%frjq_dCrOwU71K4t01KzL#V8YQUF@a`FumJ=WtsF>d>gq26xfo5S$+ zh#8MX;46R<`Od@3*vHRT@jq(cb}aO4hdMkA-%%*J`}@4hzVk(o^{&?EkEs8i2j4Lg z$zk}$#+*N11K$Yf(7p@sGWMOV`J(o1g;UrLb$A%Qo-uqr^vd|}BGFU*LZ;h)+adG2 z1m-Y&{JVK~fAJf<(eb_5#h0S_qV}cYT8-^chlk-yjNx14vhPySW4%5)UZVcX0AGJ| zk>}#eiiwvs;Nw`*f1_M{Ut@kDJ8EA6KL2Dp)Zt<5`y6`i{x0&g`tNelW4()D3;3e; zjR7Cm5_1^7^P%VFTLZpLP@;WT;6*+11vFpOzODHDmHE`+VfcJ8eA(Vs`>ql_*1G|V zyW76);2XmXISk)*&~w|D558jP(7v&F8T&5Qd{O(p!ikdYP=|-%yC8{-`?xPEsz>d6^ek;3b$A&2N@Mu8yX+e;dbICE zjD1_dH;Y7a7{22%e7jwI6QFDC`$LR<>G(XI?NEn@;rne2-&-!eYekRs?!@&O-34`Z zWP)!`2k|!!dT#&i2VVnf(0`NhGWOL8pP|?v?D+a1Q|m?jd<=TDhg>{NKQdz4t@POz zrif~Hs_3yE_YHFQ<3vz@hYLmOFnsUE@GSygE;QJW8}KsyNDw~LkN2`V?g#fpa>vUd z=+Pc>@i6UjA0@Z{wz~Q;UG!M*{+NCo17CkMU=G8_{f^vxyTLaCO6*4oUZx-GgwOON zqj$&s7^U^1zA8wELB-ALXug*TVpsZQ^PW_-LOwOh48j;qFJe-&XCi zAC-7fk9P3B4t!DjD#bqP@Sq+Ke!s`fmkBM&%f1DoNBf?Q@!x3h%_5N;hHraJe~-KP7DCt9 zw>HLqTg5)=@GyLqHX)yU zyv{fF^%Xut(KNW@b!ZRx&~DVvTcJmL%sqqY$L^SRx1!w)X?L-!-DafQ^aFfF$TNrG zdmb6?e(VMx+hsqN;AQ%857KV?tQ>70b$A%QyO4JCz2@@sGSMS{5M=lto#z4Yjbw%# zhA$I&Zoc=xXX11@bd7z7kcMj1f1`(J`>4ai@a;$1%{K@S3QZiW6g}E^JIH8G99}$% zz-MBfvf;ZW#=em*zSW{fzH2mJ)V^l1k2*XIUttVik&Ewc(IX$%FSmVrXdg4=FnqHh zyZbv0d?Dm+MGcw|%3*$KU!h zhv9ROaPz$fK7Kcs_HDq6dgR-o`J(nU<7Sch)Zt-_iubg4(a`!rwFzT;vab$A%Q@5k^ZgU`g@eWFJ`?zc|=4aJMc zSKw>H+&2fy_*#I<#OV5hn^ZpcGY7eNoRt1*3BQL5y`m9D(j1h&jIl2h_GQ2U9FGU_ zGX0$cTiC8S{FodoW9(zu;>5OkYi_}FM+T7`hU0eVx&54{Lj{BhJK1><+vxGUEit3==g+>4xy&t5srdj+J^n(6YMH5#Wpy&4AYZqgk zlzH?Ms2l&)#_%0~1AilidmnR{c5ja1%Pg?f_4v=A_&8pMZyMsy#2z^YeTcsW6CarC z2&h;?hMkumbRD_v(mH2&zE;Z{k)Nw`N)s1fQFNtk8_VdA{!#z1&8AU&xBU4E`m54o z;|Cwk-h1`Fqf56$EbH3vm~ETSu$r1$ydftXXxMTPJDuQB|E5ULS{s2o69d-wBi@3h z7JOO|4pDpBdAZjQj4E%CU+&fdG$b8OuUfp1Qp{J<`4!euS$q&9^;#Z4_L z5A{Dfd2)vz`8M)R-ciX*Of`C;@WGQOaa-F~Zy)rS=hk~4dI4+gK60gp*6xEHsx6`) zd~rc7TOn;f?CzNkeLL6`hHXmMlwsV^SK$(T<>bjD)F*$a_~ZfHjfN|s$2{^g-_-x- z$&)<;)&r5i`nCIf#cSc)^^rAYTlg~_`!K`y#g(peQajhSG)-)3K|CHwfQ`lvv!F-+ zQl|(u+QrNF4M$sJ(Uw2;uLr5iwtT<@w3}%9g*rGt^<=)`BF~4gB|W$ne+nS_x#<74 zwGm}6$}yjMVvMkbY}d;3m+SKb|}};0cTqqejsl&@(M~fV}82Z zovPZ!WrAv#{f>?W>I^tVyV<8`7pIwa?e<09Xv7m@Jlu=@og@9N9UqRHz5;!p+7*uu zb^ETq;dV}qSDQ5sHu)vr2VHlcyMyDh5a!!@ z#6%N(TiVo;w2kxe!AJ(?V>0+SKAkKbZ)1w#r+bpZqYLynom@AbvC(xF`iv)UDm`1$ zJTIY1g#2}3#)X}Vbb;+)Cmf}BGxQ3`2N`|FdG31TPwqM&`9035McwRue%MAIJlus` z>s!_+?kVBBpwGGKp4W}IL|1J}OmVK`esl->!1Xj5m&NpLad;xQSk`9zq--3@*k@(8 znfp@4IAy&~LD%?7*~L=k9)s^mUPm_ImgJN+Ft%v}*Y{}5OFO-#UPm@$N}1aRtD(up zoI66F4TXOgn_Oee+&d3-xTe#89hKwOz2|C_v)}Yd^jsnKoQd&ZnLAbj)?~!?6~${!ZMme_S2^GA)f(d8J=z`7oQ zjj^_=_?B}B=TN5Wn(73Ck;k^D;?&xi%4@jwa?S#mrxbQKw62}tj+ptu>y}RN1?4tt zWJt$c5PsyCu}}1)^1qb9Cp~l3d}!rpv)+jwd~!;T0Lt<$&M9?$kjVNzwAb1W)|5~a zY&2tkeVE7ozl8?KkJ-6=MEfl-bEK*e%09V*Ir*% zHS^}#a~CgLefJOU+x*C5Pd@#tT`#`!yFdRU969{YkG?#KLrByUB8)sPM66Q0Z0m+f zz*q1!l1Qn;T>+;Q6iuKORu?7-d>CU}*X062I!WN=hR^!Mp0LG1ilkaX1$DINok(8Z z9oW`Hg65q}UOoe|t;qz#G;xcf!JC^2CnYFeOVGwnYVFdb*b11Hiq31L4sXZCLQ;6G zG;0e+N7Q6B_QPYFs5Z$^{fE*c{iNtr2{hU`YXJXY=&BKr_$)#FEL zdTwEwBL*j%;X*Q&oLZak!f3Orv>nOa0A2Sw);+FsW9w4pEgzghC{;-{IyH*1-RM9; zJ$pfv4MI{6=M;{FuF%d&tbhd-Elecn3R7DvOr-)3;}E79DQyB~a%+Wl{ZEH-o0!;x z3>6?uXtScX|L#^?9Y3UddlV2*p6amU9B_1;pesymt&hY-oF2zfAkck?+FnkLEjXJp=@Q_ZDU{cep-wVHAJ<93R+XGg*p8Q~$i%ZMznJj6N=_y;Mk-zs@LN@K$_cch7lbL?MBu0jfer`A z6#^Mv(zF{Ow!i^Lz!S7qhYPoBu(j6ptjojgfl|oIX$z59WdvN`u?bzm1iOI6fxuNj z)nFn+^`)3F$mBCILgy2TOgZXVJimupWb1HWw^X|1WO z%fob>=?uKYiCU{eSG$~8rz*6wi@{NZm+A@=A*DBk>g!ED6WewEvw*!OpNY40KH+VX z&xE!r8YXs{-6y51-bL~4yxpv^UA-w6CS8OZAz!xTO}Qi~2}yqr zYIKP!$hhya9=f<+kFi}Z#nnxm-|}?VSz~cm5T9>(GFrs|L|17-J{U<()x<;*(hvtp ztC!k#URNfQ?^9)=g8~kjzTWlv)t8BA-w3B|eodHpIQi(mHeO4l_)uhi# zJo5~DY}bAu$+VHcH{`Nl@%gapY`Qlo=@KNZM{#}W1L7Tq@S{8v8jn$w!{g;+dwf&G zvTyMnM>5`n`%;_+IJ>9+1X1s~q#S8HP>~%$E-3?X9BxRg;mG$~s>Ib0N3@E6hIk>x zf}5%QbI^~Ait(Ne>1vOWvDcvxQb7HJS|OzXZ5>I~>p~Q>AYMiBG8z$h8zR4M=eepM zS_pgs@mh+bm3SVkRX-|x1;vC}EGeo7O=2mNJ2Ii3L^~FuIN2`t+$J(t6Uz0F|A_J? zB~L)P$z?6h56TNfYfl?3=5nVK&J1d82xysS9Ll$#{4PHo0J=Jjlo>zXxeGp`=E=fHI!f5Mwc}vDw|n@>#bpb0X2B_$v$ab(7HfcF*;V=$$fZ%kRfAhP|w&isHWbw1wGrqWT~<}MsEs(4?ry7Wc5iRqVp zT}C4POQv@REbkLYoQDj1pszn5-q-opstVq&g6#dJ(zt{gi#k;@=X#d~G{fq;klA}v zKBCZ>CUjcOoOiV%v$efSyVGWty%t-h`qK3mEPF>Yb$W@yZ8j}b^{q~CGG~;lD$A@+ z2bewHR*q4vDY8!gV)i56)@_-q8#h%|P@y`&|TK798`cR_Qx;SEXM=T#lDViz7gJH^om?DJ}x6 zRZ%fIte>|TRwV^`!&Wt{|Dq9RsI$umdkuP`h9_5C$}aMhFv7?(Jf%uD!$U26W+o@4 zi8xWvbv!-5NvOd^YrU#L2kTrl5GZ3`AB|zxCm`c|!+uN{I${r~A?TQ$=S*V>msUNr z6J==0&d{ncTG0@p)s4c-<*$KrJWT&@U?p z!|dt&yE@M}wH9?R$6%`c%f{Ip-0nYwtl~uE-H=tF6zTFKkX58;Im5f5Sx@<^RXOC{ z)<(4AxyD`#KFE8ldnk{$@v(r_!?Ph-Edmp5h6_YXtpZx?nTk1~;$?!eP6y00_AwaT zHeixt0tV%@a<3XZJ(DT#7n#>D927l=P3Y)z>;`agX!IP0`;%4BNN&DzZ#2xn!vWJ* z4hRH2V9^?EGdfSfz&0BcL&t4CWCkzFKueyLHuV`C--c0bz9l>zwRtqkVapv?HE?RADsE%bwdXs$EpFUpmQ2mS&t`@KkHUL#OmFS5B-d{oI3 z)U?%CQ@mQyR~aUkx~#ib>T+GD78f#(imb?D!3oha7U6uR#{;9@X)y}DpXe1bdP+>; zpI)Uf5UtK%B6%j4B_*e%CL{F(M62@|NcuLRe!y0<#)5b4={->9*{x^I3y4!SOLps7 z!H-dCH_Fv4N{E+P@`{#+KvoOtD>hGs8J-QfcT@ehM$A_WsunpZ)ExP}nj<|Yqq3S5 zdt8&kvAKM;ofME6K4VZoXUS@UT!w6=mz)bBE%8 zUhWXt0ANT>b@@DO3OJ1$0bmo0s(EwDYH}*TIE{?c+A>aS&p6F6PAjjkuEFjcvX=xb z;oq_kUT}VyRX>Njn^aW>=g+FeE>`tuCvSL3+f8uHPCwl3XTCM3wT{Zb{us~?sj9<< z##AMrdk+S8TJ0dzW_J*^M*}zF5kpZ}($V%Kv0DmJuk9`s$f%iL-iB!Ytm+xqRHRK_ zo9%tb!krr2t()y3+<6^sa)fOq+HQ0Lu8uZX>1YdzcAKQ2ZZ$SO;m#ati?-+(wb}ZI zQPH}O5_b+VMz$?!yTg)OC%Q*b>^5c50@=LCUCFhD*(7V6b&Yj}H5wm>%&DKPEuL?2 zholKs?YzpWc@}m&s+x_h%do}eJgcIns%#GSDpEb0k8Kb}O`JID`jTtM-f%_9r0a{X zC@I0?w9&=Zgko#-1S?cB4_m#=Q1Ab1rsk*%FzMB{4wgLx$;&a*FR@$2SH>rxdj1_yF5pA$d_wb)mX57Rv&2K8+Tu(bRw|N%s9n*RyzwT+x*I#hs-Ift6oqwWLVD7 zobz&q51D`K{CTytbwlds&l^%br=q65vT6v{pTXFSrhegI)|!URlIH(USSJ5F6k^#l z33Nn7O%1otnV&O@osL<6F%soiH0x)hl&2A&$MUPwinrOa{aq8i-FL)!A78w~`!;sE z?fbDmcd37Pp+BJzc}x9voOhRv@)z&i;ZKP3z6+HBaUUbO49Ki@_)MJl$EfI!^B%Ga zEe(5o#MQ|WVP4t+`)vuSDbhJ4m4coKPRq{3~|e0 zYNxnm%FvZ@fjaN;JD2*?;=CJCZ3jwFj?#~j)#x8a?zm;o`8#=&m+E{~W_jO6CG>qg zn#cfoLZRRC9)mwX^dlR+_|H27BR%*dS-aJP$> zC4b0d7z$9{%=7_rJaFg7ao!_L{RiFt0aHJ?v(OW0WB#Ww-=F9i)Gf}tf@)vV>Z{|t zOJNPX-rzxAgEo5w(mT9g+<^vGs^sTPuJSC6Tk1V=hf==_`AfZ@L4X(UW!(>T!A7Q! z-k~Dv0af_`D?g}`5hfo}Jo~l!50SsryHE4{gmwRpbaw==2SWnaP@UWLv{>u}ni}S9&1B0=`3!N_( z1x8{>m^`v*DH62kxIafl>9XfAmli4SH9_NJud@iPKdh4fVDd*Q`JYTa;$;}T4{cca zDDszj-_uo}P)dKH(pHsxi^(Td^3P2ETvdHjSA7ck-ajFYAm8V~2n8*2Nfw2|Yj zGuy~XR$3dmGadl9*5=pY20-RlD)iyCf{^*3MIZ52H^}@*SRY9i_f^k~+SJ+du)Zk< zA0Mvq7><`6-JL~c;RF$_s4~13?#^6?H@aJo&h$oi$1yTKhH@QV_3>qEhL>Oaa~)m_ z-;{J6-so;8I@4?Qc9r68%j#ndL4VAFr$W}t(Z1{JoZDPoVEKOmez_8gOu+k2K6V0#6y(P|Kmi|>;XnKs^-?u)CD`z=cHU zuMy;@h>Q~z7r@sf-;sQNTF82g6JiG9gZ<|k+^*l4fTrK0E$E;>r9{}dO5{gH-b2KA zzefz}?^%%dE6DA5(|GQ|BR9n1d4g*N|0WoKKUmH?CE_myId3TQ!#d&x=m)W$h&WOo z{saFeGS>;_Um(bjJ^2lfErNRm`2}_6_Y>^m*YZfg8ASNwM}m68r<=qhqAV!9p&>J5|p3yJ9WXpzSgL2|9g z_+GY>%SE0o@?4P@iQFLa-6F3Od9&aXg3n0#4v}9G`S&7oKC=C{MGlL6P-L$2EdNYo z-t@9RTt`*^WjxOm94L5^-~_=kLH=DZ`@d4~KEbC2e=qos;9N$@v-iF~QZ zxVcf~xIOAp?qf&(?+e~f#JpAW4fuq}I|W}Ad{^)T!7l~VIR8+u zpWx+!C4#pL-Y58&;C3SH*h|EE@OP0TMD+Wx$lOS(oF#G} zk#j}P7x^;5V!<1wyhP-i1m_ZA*KLA#2|ggWP4G3rLxLv+Qv$mF0KqE-uM?~hTq^iO z!JiBMM(|Z4`gxFub?+mQzb3*Dc7iVNM1-6s@>wEhi9A^3JdsBUP7o{;Y4UCmd`$3V!9NTBQ;=U4 zq(1i*A@YlE#H$3S2+kC|L-6~8j|e^|_65)q#IB^iqBI110Pvl`l_~m?&FBkbL zk*^hbipUir&lGuq;Bvu@f=xv5J}UAy!Cw>6ezPF|HktAPL9T(6GX(Pm3k7c^q8}>- zae7eeCYB$C2q!ggxpwZ^zDtBH-pV^pCk-n{8 ztsk(xnb8S9q2tUylantK8N%Q-#;W zv3k6pGKbL{2tAxmqsLL$d;(HGyr@n+uH&}m3oS*O$4C@1-%uL9uhFQRZ-1VC_C!8h z-bMK?gPz;I(I5&jLk`2oZ=<^Tj)SiOI^@G;QIro`*^n=4-*yntKI-r=d~q>+bwgY2 zV>{Giy%M~js=tN~d>#eK@PRoD-;Ky{+t&!b^~j@rINeA2kln_4i94= z@73J)B_jZheLQsgAL9@dN|$}OREhG9*YRvchZF-boJ4XMQ}@89Ce5PZ(0j!M6=YMk8+z_`>o_q{ z$bRrT#`J^wrVf(Um$)ul@5(UAUyFUz;c<65{tk=*AcxU=8hUNoJrC`{KDLWTkW`$LKTL)WAJ`vQ9Ca`bp_Fy@i8Vd5nfrTlTN zoQj;ZKM8K78!Ol(5~~6JC90V%REZ3cvYsQTU2}SB4kt_lLh3*(n?d zHbnk-&NV1&h$IIa_W6KAol)V8=7tEK5Qle+7#mJ3Sb8Y6;e|uG{l^=~OHOi=*Ue|z zFudd>A9>gY`N>CqHz)T%dJlg;e|*T6NT8`3tJDu2h*I*5&EIL zjUVEpey9;Y5Ci47E@H4pb zFn%0!Ux8QUCqQpz+H%Lgt*K=a+d_Zputx*?m{5TJXJIdgP>!<*c{8$lIfEKtf2g11 z30h7vka?ceB~B^yLg@R!#ppNkX3SmbEJU6CXDxAxvFD8^=mS?TCjq+t;=ZWA(g|QL zw4j~DP#>qVd2J-28GZ#%LBr-qDRd8(U|$T_JvGGowv!M07#}Ic{n1`8Cm!`Z!DUVo z>K_HqNcb`#cd1hbj%i{`CG>KUF11%Wap=b^WlOS?P~6nQvN-f1#60+cei^+D9Ki;s z#>RZw($6VVG30fMn$|`R*EY3Kt}I*O6t7O0Pf98J%zjyn(Iw8qXQp6&_jRTrk1_nt*;iuk9L&kI zrj~>2`Z^V9S&lC?%UOgz9s*AdV$V)pfiYMcdHD8}aAjFjivwT3bLW-ec=))ytgllF zE~~k(lT@1H^vAf7zjSU>%i&tAFQusWAnIYxAJ~O4%ez~})S%|gkru?+J3qWK>@OYU zOoIIhh&3C2V!sj)Cr3*9Vr&)7=IpW9I7h!Ay=wotdpi=|e z4uGQ$c?ZB#j(VK?6{tr(j&TZnMt}Gl5CgEq2QKAL_+=sLaqUY84RRu=UkMuzl=MMt zuZ^l6#4@= zI(2QN;?e+O3?6c0-s`rSRn)E1f}TKd^qK z6KX(AVr=TbQHAlCwry?1Q-E<;oTIq8FI3Ap{hS);$Ay|&*oRVkiIV}DYe*5w4lFOzfsvvOYI9T>${iw!VPg;+4D1`MJ{-%|ZNzCQ<~-yglvQA@NXD8#c_HLt=}RWCDs73gza&Sk7mQnu z%aPhXP9RmUS0T(bp7RcrVDBCHK7jf);O3f{0M3IY*{HkBIe9KgA<8a8l! z=Q?#@G4}p}E@RNLmO61wnAgy)0e1lQ=Z84o8nDJ&n6Gh;C%B>|Qj0M}Tl>LR3j7e` zJI2`@;Wf-b_;4irLqC34!t=%o^r4R$+cNm`y+ujkYWVZa#bd(EXH4_l9~qBz6uzsO zfa?VKHLeubCCymlX0K3w3gDcZ+Q2#GS8GiKW6N{ShySO}rMt z{sXY3EDh@w=6BWHr7im~ze}N;TmU)E;}k*1PF>lO4SOp~5%-8ut~ZmA{$Ll@vTc}a z@J~e^*Ir(aG`8^kR+WeACkJb8nveM{({eXQ#-Q(9f5VsdcQRn-flGVqb?d3#xbDH2 zHzB?*Muf`)48{^(89G@XUws@ z24~KMH7&)E2ce8M&B;r~wTa*H<}PnJSQ2zX$Uh1j<34G==wwSvrln+SQ~WeSRXuxxAeujxw54k9M~sQ^@aPn)!5)s{)~6L%_~|a zVJr^9uYTl(VZ$QGndo~M95eGQ=g_*oPJ#4+v5^cv%|v{2?e`m>o z94L=qZR5JZ`iHPaRid108Lwg0J;sD3Epg~C<1~OexF2&$v*25BdV`SL>x8Aa=EuEMkoOSqEjZ#ryl#b0!7&nc(H36&vOhsb_vZujXN>fR_bv1@ zedU4gDzf6$oTX3Q{ou9vp4Z#k!zW6mX&I4^R4L!MI-QhKR(APA5auNgfTfV zJ{#+1wrb1Mj5x?b-?MrlALo@|FPx`wod#cWE#Y|ZUY4<*(Y!gr^>S7o;%EFI#C~tb z&h3qJPPX&cQOV&C{)xF?SQIYUhVumCW9D408!Hh5@Gs{4Ak^i#zp?;pF5;Tkm9ucJ zUgR*g`>OMX2j}bkhU)Nus{b?(Fo79Z+PFhn7&y)1k5u9Vp z^*!g^fm&Rrp$^Z*yf@*wcuk1sCVhW&U~wOHkH&SK_d%RH$ruw}UstjpTlzV?o-IOO zIEO3pR;aOB4^EC%5@J4e8_xF_Q?6&c52EchI1a%k-p6sh;JG^&JX`}dqHY9sEriUN zEkoTJ)T5tSm-j7R)aNq>HIExmA6%v2B2NvaFS~h z^0~g3f!_ir@3jtME{2#7u7|)=V|d^TURQH2^FDz0jJ{IT#XPA&+dS{_-Y6e+dF{t* z=cZy@r{Ny-5cv_ zn8P(0&sBa4*Ka`HGvXVdj=F|~kLZ)6f(EAwy7UdtLEFGlhI)&@!D~rg$8oHAA5;aO z(q^vNJhx*20K0j>{n+`^9_yXHlmL z_x!Vpx&EzG_w~G2;khM@vE%&v5Oe1>=y6Urz{b5u^E#a8J%k##b}S$i6f9l-otpMIvdr!TMgFt^yZBb-hXi|dA=BJrLDm|Kw~5$bz>w6 z`GL}nm{0dOyvGS+Zf97Hkp}GRnOux=+&@jlv&lWVYa_d18}Fw$?txHaBssS+k{WDO z`(9^S*elcG9Q>g%PoBC`aRbkn|$`lW7|{18?ZNJ^jRnOh_o^ zw-jLCVmv;+FwWw&ir(|GpkVaA0_^*JDauZqJb4#3KfpT3eY5eb5jvSx!#-co?2p+L z#@^D0G8Sv*(1G&O$T`PfI}*D z6JvAN`N6X2-o%MGFI*bTipqZY((H#yzw-I`h@k8Z9r{6JCFbvq)+>?6JWVY(5aXI! zt|unqoCNe)KZrD8kKpT4Ux_qzYigNH>_3Lje~&+OMVwwpVpc-DT1d(~oWIyLBd!}&vh za<6ZGmcYH%`MjHZpfh%l*(u1I9DdVV6y`m`0-rxT)EX7W-usbnk~@WW1jdH3uXJQ} zQeyazov#TeBW-&<;Va^=3}YXE*o=9H`WDs`d`5O*rx2b8fZL2`LGcy)3b2>_rO?sy zZL*rHnbxX()bR(k9i3pOkFwZBl+QvwP&T{Pl2X?`wR_b{!hLGHtGPxW?Ek;q2k!pA z=I%c}Z&`%?+wWez&njqY8R5a_F2!rrJkw*Z*X4yioU_HxnWfA3EyQmrSWQh~Ujfej zn45OfU6`{sglBQh!kUKpn|RFLf@`e1_Td|aj)@x&bQm|hKQ?j0ef&+_FrG}@FrG}@ zFrFC8j3s;|r+$N=3^Dq}5VIdV;1=o|_MQhANIxewR-s`9iCmBjfMhXQN+VjK@3(=@>KnM62^bXl0x80sG5! zh&qPTZde6driR&Wz}g)78`e<==ei4EH+_g%R zYo6zh_+S^-WY|+2#yBPxyXuW8Ml9f5&N<~T-f~dY!y2?0m2CY!p z{P|Ut7QZ3|C@ZgM)&6%LL!*Hcy9;`04$Z48JOF$xS;h=`(j>@k=!i?R|T5s9i)O#qJf zX*YtMz^gc2VRCDQ$;ecP+ptXJVAE5At}v;!Lc5;$pfwdQpOtp+;w@N$tUA2ZKBuhp ze6)xuTB(YF>M+e3|Jv4+*0!d^Y7Ih0F<$6CK^u2HD?F-mn*rJr*CVA4(*lK5yxO{s z6dUo<KUrKa^zH%RE})cNdlWb^}xB@s;euv(k%!O;~iG-cmwnH#(#Hn zwWt1{9e2zpjys_Nt6vBEm!rf=R$3DXT5A$>d6*y|!8E*dtTPqDO9k|9Bv`A%=*~o8 zf4nf;34>I!81L#Z?2KVj_^n&4VcG2#ne8ZMl%ON38s1Dz%BgrsY_Czt4nvrh$nN1< ztHT9A2fEri`naml&J(%FUZjeq<6Rxb7#1zWOFN0F6L@v#7Z%bCt@;pB+fJw2jKU7a zt`XU~s9l%YfG%ohCaq@?_q+$F!*s!vd9Bofc7@dZU*zm#pzh#gL63fCXOp8tXOra= zWBz}`IE?AocY~14B5c_nXg8EBL;#4tkjT`6y=4#*MR;{E8u?L1{QLu{dCA3}#gO_P z{6faF(Bc<)5$A{E+gb4%O84TWMvV!o;@1q3Qiq937V*!IJM0PzGgT9*Xo9JrVwptf zA1z>t93AwF4CzXdCvv7(RTVTzS;T5siG zL8~3@PVy(fK>Ir|@o2Q@M$D<;mh})sA*g+?{S9`kN zZT$@QHtXHmZnNI~EVX}om$<1(*C+AMyfQklLGKyggUz;*bHj9(QD>ruvK4%$Yb*G( zy4q%g_p@V}u~9p>X+J00JGJwAP!ox(ve1g^YcKbn^183RrLU@5wroF&kszLt>_22{HMqVo4x7rM^%0(;g4IR zj#8w#MuCx#mv3curqWO(Ix#U!g`OY5)CsryJ{8wKXz~iioX*X>Y(}n!(`E!-_N%s^ z_ehqv5N|%7Exqdf0?R)hLfjX43)t}ikOksBoMN@evEMY+Zil3+S^fs<-iP^#q_ z7&jOY@AHfT@IuD^o2eAjR=Sm-s*Pv0MFF-umC1SNi(G?E_XIF8>|)%wW5O^y6)$^w z2z^HOLO?P*%v`HeDN^3gQl3FNh4$#L=d-FkeHfSU%Tn#)k5u9|R`+ez)0fD>lwiPem6=x8p`7Z5tKk(Pg z8fA6c0(_b2%L3hg419y>%QG$SuR)~z=y9bHs&t0RFVLMRf^1K}lIE766UvMdn$exc zW}}oZyUY)-D691j6q)I)b_1);U!YtD+W{GvyRJ*#{NtDoP`)2HTgG&5!Q~PEg_NX%Xqr34>X|&FmZi&%!QMcr1 zy0}|PG>uEjvq7lh*PhO8AMCF7Inv3lHVr+;o}kQ3w`pgv3v?LmGz@p)nf3$#mUR^& zJc)t^dTI9}xtxiYk=Ve*aU?b)k<|yRKV{-(B!0yNhx0`w&Ln#!^g!#WXB(aclKZUW zE;PATuNP6vKHFB&(OY@;Y-Mq8{&_xnL3?}ugXy5%fa=-%neL@3WFKO>x6bER_w8(( zZnM%kQcQtG2FHoPFs89`gb>=`5mzJxbkcJ<|S# zGW(avehJxXBp*XUjpQ06)JT>gp+@q3BshRspCiE`wFYs~WE+b9IU7sGbS|KJh&Lh8 z>c3l%%dS(M6M)lzTm9-a;k{_CW%csWi;u_zP{H_!E9f7!8=%}dEk!syvui-1f7!mCm(K1^)>o?CF1G{w}*uH@Hag@6y3O60!>RX4OWYa>%Nk7galh zI0l(uP*dn-+n=Mx;&tS5EOOe6!z0LPKMuU4SL3h>#jWE|%5089VZ4k3H(plbkdA~J z2X3aI#-R#1Y8;jzar$xi?+wJcS@hE|iO69pBKyHoE5!Wif9LytJs*DvQ-*Nm$o3(qhv3Ik)Sw+!gVrCP66xuBKu_0hIK!S#b&9ah%OUhM)p5-A7;<=u&sp9+ttXR9zkUI0LS+S6A|I|Js$-5!2rFAsc zGy5C6d)hiwSF<7?eNdyZ6*+1&K14!|#sUv3}UJzW*G;&@p&lI)3O z$SYv2JXK}ry^G1E=TkNer_FXRk3a1{QK@xC@xG~bMwt~UUvh7ed8Oysf_ z7v!9M`0W}i{Q$`QoHVW145|7$VVHW@;nRY;Xuw$?lUF^?+yvwdFb8MENW4blMUR@p zo!4wKf&Z?44eEsO!dhW%$IBdCNqDO`3oqW)nuBMHM!d}JnaL+6i;yY^H>jgnut<jvFw!|0Co zS#G0WQ`PaF-mOaW>u0y_@6A2EN4WO+4%L*^&8VF>yX3a2d9~OLJi3E~sz1N3Y+l{` z5^f63y}&E#7Fu<+b!9ac3hJsXm^%YoLz}--S5>fgK%1Q?RAzk$`=(b3PpBSjG@Go(k{&eVO0(kR6lFkt>H)xS2*(D`k2+XyA|t7>Mbp|>jMV}JH}6&CgZfPcC1 zwl&2XWnE@njy2*6i~G)7_52jDruG(#pV`s->JKkDzS!@+ymo$-Rn1)b_9pddq4j^r z-rHt{;p}JHEpydz%UpeAp+QQ2{4_cxaF5;SX_H@sGLzq5Y3etwQm5EsyMYUkyDhF% zL0wI~zlQe?_TBzYI$Xic!If}yN(T20U+G=pTkda+Yu9eJQ3i6Q?4aGzDIjv|oj8r2 z+Xq}}JM_VrlqQ_ttYvufSvj!sJMSUh{uc~R`I`u*+U)!P!)?gh?IF%-jh}0P2VA>} z!)wv?vc9gmMsFdmRP|=!W-IYw+=BNEPcqzRvM#j!35i|(_BDS0SX^PX7QBp0p5(-C zZSr16Ue`oVcE;jsu3F{y7jYBuLhh9OSF6zPAMf$G>iYf5gb6sS}Bt#t=3C5=?x z8KbNzPLs*z>=((aX&o7}bKG`{D*%J6_?6@U6caGi3#Mr>apDfwAByh1O zyQg{EM!ZT9I$bN2I;G$(P422OX4AehI`v9Ljx9k&U?hHJM zE~6T(#VDvw1R^LNw`7@8y@=$IC1i%mGX0j@bqSQ88;8L5-m>&1SoH;Z16Q%@Gzk4C z9j%H$D!@!xdnY!y{{(x#BWEYg`h=vPED1!Av5bCv?&=1N#gb1jJWJq+z>{MzLeDKD z1EhKm)3UK>wrI>a)LgP`+!*u$Ea(D?o*#pM0cGwyj5A6%GMWu??ep+km?|IIg*_~_>w6*`Q z{l0$(W}ow(bLKtodCz68IZu}wN5_Mh21XzemB?E`)&NHym*~gx{I!lAwmDpO-Hhr2 zngEf1Y>SER*TO0c!2cn;Y)MbUvZ=80yDa-1EK5$bCBd>gmwXP_e27XXV5$3V6^<@A zxL2Gl5fQdU%N+$5Qk|_1jw*<={Ym75gGi+CtRv+sw3Z{qsXH7OIuf0O1YE%1P8T{H zjU1fje}}4NcWE)TZ?^H=(6S-#M;w?Z9$w;n7z@uYbv}&3Z4aW*&SX6JIW}1JCRhg? zwhTsI!%!zw<2kfz7qKdT8!czsht>75VEsO0X*8xYzXUD*6 zrt_Y*I&Xy|+xEChqKwfTQ)HYdw7refU;j~#LY_7rLQH?#TjYSSy>tueu@9XDjj+}Z zx{haY+;YbmFmw5G+vhi975#cUP72*@lW>xPMzm`_B0pftz4qmQ#KQVFGsQL(5p10u zcKp11^XFPNPw}zahvuy_61cYh`+RN~*=)+b7IM6zw~%`&kF}69mGLd)99&#Plp&C> zoYO)+OUY~@7xP`IWgDnWY9S{nz7}#vWkd@(Rq5YC?xOUB>@*)UC|yW-ZP~hswPAUU zYiwsJU6KBUDdM>hzSL2CqDM1wpppmKZqbLgu;N=jda zLOu`qyIbT(_`nIcd2L}P3Gsla4P=&3CPWdom>SSWO=-=O;s`#zI)?l$i2|VqZ@5{ zJ1Po)Jrh&^&t-Yc#{66p+uSJA553H0Dlt;}^fc<%%UmGKjPGUmsaJ*6V8)Ag5{NV9 zGh@=-#+a`{cRa3PvK2@h(E+XtKlF084 z7+)`O2N8BR5=#}qxZV@a`hxNpv?ux-WqvutdQ}opFP;Nv&p4p1EBs3Ajwj#5Zb&2c z!0TmVI_x86V7)Y8q#km5>yvNv!#;fs)X?8JGisT}`isOnD5L!kOQc^Z=fh6oH4^#y zhVmOkw7(1G5xLGE@ivKK?RUthq?~Cp(q~CrFY#p}`opIZyVwo+LW$Q(+$ix8BHH)Y z68|g_pYw?Lb0yA{SSN9}#Fr!nCH_@ncf4lP(B58&S4dnZai_#zN&JIEt^vs71a|@O zA}P<2SS#^9BHH1I#IVHfP9y$8iC0P7Byo?#&n1>782N9K_*038B{oZhd5YH0n3pu1 z_ITzcqAMxd0OOi~a&O8-#=3cwITW=5V}7N4nLO?%60af_;{BME*Gb$YF+fD;;<)AU zhb6vF#5@@$VqW}KqJ#Yi`O=AJC`zW3`$#-TBF{7Ix0ew68gGDj9Nz*F7fR$CAj)ec zZj#s_aks>GiEc%CU&^0K{F{vL%zm4RIgki_{5u$y%W+Ei94QZ$@@R<@i8$^`DPJ#f zxkNEOa6He$)boJECnPo!dxO(R%3QCJ`I;s2{KWKlj+ZR7ClPj?DbXXbSmL=7hfDMk zvlQhDi8m6Vf2G8Y67QAxki@4X@_K>!-y~*(i%H7w6Jf_kQYMo$WwHJu^2c$ULQW(? z?oLF%%aZYh5(i2gBJl!=K8ZgeW~03&t|I2(H7yZ(w-Qm#HYtnw0`lWhepaSGFXh*y z{Dzc&C*`1&{~+bhq^xqjKzV}m0oaFfF2)TJM*9a$aFPP?z}M5^YYz!=5CG>BM}@OHw|I z2tCD89wzZ(iB%E>M+EX!OL;L7vR}&Uq+BQEEm96hnO_{xjwgvIf4`KUlkyRXZxNw4 zM1+67mT2R70P)EZyGT4kVxGhzi9?7u-Y4Zn#C**2Qr;xx2PHly@hyp%&c(RIFcAnd z1SU(wrHSZYI0XoFOU#ytqD8zo|Ku6pma;#V$@mJQ$GFZU`lLKgVwJ=h5@$=CD{&Dq z-}svcqF>5266++^OWZ7Ri^N?LAC|aB;$Df3L{#pO#3MwU=Z;EjBI5k^ro>}JoX_5s zs1x1z97f^^BF-ZxC7vQ;-v2`4SHvviy&91>I-D1IT}pHkbI|@0d7a96DotVr5&q=| zxkNY7gAb`BdWi5-p~MW9*B|+b_(4`77ZOp=QYn`aQO^n~R}xXrDk;w(x{WVJsBbal zOym1r%DX6|p2Dw?_ftmwju9chOGN#?k+P^a>M81hbWsn~Q`ile*X69=I3i?TpR=Be zrR*o7o`Z=!as5U_efU`r>v1y?_U|OR73F1OrlPFpJPSLw5n(=v}u<7XZ1s9_R5_qg`^I^(`8 zIbti3XadxT?FIbC=1Z1o1T)`3gcB_BCr262IWI&U?O{GA_AS_ceR@qHm3%FJd3uC-N~5 zH&frr7=6jmXWGYdn2-7^4Sf+mSIKyQ*i3yDG5UI1>`OvUQ(umuFJj+pq_G_4;b!W~ zjM0~Ev9E*7$KyW5ZuMU^WFK~OGxdcLVQsfY$UMFyc5Y_AAi`EZmsrZBf0&QQeFJ6I za*rU6*Lmh<>Jxw2VCgTs_T=%YGNYOA6U1A~Ew_}*cUfk+^;*kvdCg~ju}hVvzB=Ty z>Kg}rZltrn@QstHZagk?8l$fU z`dBXQ!=v4ZzV0#hl}r1WhnuOpYmB~i7W?psIHHfw#PC1TpDUs7C>6=g)VB(mtp3|# z@gFXYBl<2k^hNxafr*LrU><&Ro?-NeYmua=!?ezR{Px0*Oq-YU&|CLeSh<&S}kN0urX6k!AroNTXSBgyZ z-&xq1kNO^o@m~!F2IHBBo2l=?7=1Ms`|yZ7qHhaMPRJUuZyoe~MMZKm^=(EzYx~w) z?876Qh`yT*eG&iF;QbBlV;*j%z8hln9ktkpNA(eX3lMH$AM{mY?3hT_3oOe35!MF~E5|b#XJx#o;Z=t;b0LO)Sb~`zd4Mg^%EPGd2_(|bL$I6mrLW9m5LC|eD9WRz5tcNYw2yhX zz19cMZxf9$e@z|y!&z&&^%tQZ;9`*F4#RGidldQ1V|e^~xKJ#$M3})NG5YM|jrWw) zH{7D{ZK2yGZ%&N9dVCJD%5tEodS;BiLwIRM zW2p~AFQV@&^=Th9^ryGU6Eui+6C*P*y&>Ob)8C>vFgJGvQR<2S-Zb@ti)OGK9M z=AvqvB#L(!_Y5Az(|GG{(O97Xo6>CsB!4nP|5{k zL)E_Fp~Y7W4>{&nhH!2AQMcEUL%Toh5L)Mn3oY&M2%S5kV`#yp9YeMA5<|1DPYLO- zjtH&zbXdqyFe;Q%JR&r9#OTnx$-_glt{M|cxM^f)w#yH06!2eF!6u(SoaXh1Gm8A- zp0Lra`@`9d{;;C7Tu<|Vdwr~HgOYpe;@@A`yuVLFI0Nesn%rC7%=O{(`_(kt6~S52 zd_viC;)HS^_PP^Jr3Uiy6I`p2zDdJ+!isyt2mSkjlgqv01FRR`?8VxGf5zH_qZ`&Y zGY{8tRMAh|&x8Nqad46pZw;4bV*PsCT_?)6Vg3J)8p0|1?Rv6rEx4kRbcfHbyQ;ai zVJ-M80>P6%$^owc_`tBf=iEu)o5I@5@fY6<+U)h=IU%gu?C7h1nC#Z$J8k$N5osd5 ziaZ=x58jmp&LmamTKSqQQ)iqLdXxZo3ASO)$m%u0WM875R2{E7z3r-;TAC!MCE;eZV!N z<1;tFM%aKoMJH#JA6!kh1ruE<`V8nwMw#Txn1}V8k2~CYX>fhmGi-hMlk4;J$)MAhwje6<~Q%F~tkcYI*0UIkt>)JNTfGGPbG5@l9{Z(u%n zl8ROZQ(W;_r{9LMR)GHtYlNSjrOz6iMHy?E(;w@@(_v3`G1jey9bDUd@9c(f2sSvB zY(34*wy=q^9WK;eSsPNO-hn^5*!V$0)k>W_PNG~t%SPU+)q2rX@Wv=Bu|6hv7kIjG z`GZ$rt=;$I-1-$sZe6YO>&eP$-K}B`>(1aI@-&3?E}6Q1lsrweP0=;??YiAhd2L9| z-1q_c#JJA9+Uchsa4mNy*3#y>@Laz?5$zf0TOEvZJN0;p*$rOi1%?4LgR_i?9lr z+)T;d<$4Ox>8lAk8|^69p|jnR8*76zP~LHrSDJ~nxKZAs^ajT3(@<73%HUd_%_nov zulk@YO;_s3C$cu=K;N~YE^JFj@g@-_*B7~zlJ_jr>LtQd;a?^$2QCuIqXF$?F@!;BN`VSKqFy z^Y0XWCas!2z4HTOYy?6n=tD=|huuK(FkxNQu%i(iMrbpRQ&s5{Qp9*(A1>N}^?fnc z6@MT^UMjBVioIDY%F>;~z!imlr@6t|g7w3_SUbG1x;`9)FPut!c0W(Jb7kY*VSmNFC&)#UdJD<} za;^HK%AF@PWkrzuOViL6xLVhn(H_&-_HNjs_=B7uxCSljTc#3M>4iX-yFOfwbch>`F+O4Qv^lx@eVO1InGOCVgmcE{>QzVsKa8%=%oSs(2=f`sFTtEvdhyn{M0xN*aB4AhVm{1%9((~kvUCsXN_)xep`cBRV6$83TPEhJp0M2qo6BJT`|vr} z#lHeReqd^z-VA>?BiuVD5Bw2#<21qcTCP`RVg3IcaOFXtUf3IJmLR z!sap@ldVD@rc8h)j zTc=;eJ`%6PHmt#H*v;|7KFzu^T#9fuY@7gl%VB#6ZSRKPr(>SjUfg=lm{4^$%3Y;T zMVqj1m%)zUb$NOf?OvRxD;ST-I9IAJoX3E)nSFcoQqCQ)7rtA^xx=?Y*gTCkSI6tk z@bfg-E9MUOsvxu?U_AITmSe>3m}>@_afO z_2D(f430_oIS&2UhU*vloAZ{Z6a0j}!Ewj2Vyj!FYgNmFnokv65ph+D-i-5t1N~+i z&I{~2oLhTVqg{$t;rePd*5SV_#QED@jDCgn_jz6B#2VHdFT5^0q8ry`YyS4_M_g-~ z+z?LG4POiE$*8BxS1)v>DK+r@N4$4qcB=4dGX$C8G{5^!c7hPf<4E z7MSyIP1p^2^qGMW$EX`}He?&Z*$DF-!u6*s#QN06n&e*88Ox1gP7l~F{(W=}>OHsz zF2&AoQZldya6?^!y)hooFt8s-<@R7dq~LFYv2%NDsH@f5`2T8N2~Qim5}yC%yb@-e zth^FGs7@AM3D0-%O0aA^7x=-v60^u70bYqKh;iVJBZ60A2GHb{m?n88rdoIv4H}XoH3GRtB@Jk#7_e2+9Psu&eRff}nS;&(Cd_sFG*bV5GdAiGR58!OX zDY!qxbp}SPac`Z6<9Z_PDIC`em@SVxLx#@;nt3^P_uL-CYk~XNh2S)pyrChi;J#1r zS_E+a=LYX3X=5{g&quHaw3w1J5IJEzcvKu{@7R#`B0CcplMbWGK54*GG-KXC5CS zr>C=G-H9|W`7?M84%z*Wb7^?m;L=D0*8uw^=UJkBmh-Xj5w7{oxptw2m!}*JC)(h# zo_;<*px-C_$L}Av$6@l1`rYbtZ;a2kz~^a~qOW_=$8jH~RvCN^SoSqZe{^oRpr#|9j;yL)2jCgs!jAL>3jM4pejPRn(0 z_=HrSf>#dXLieHXEW>r0>i6Q>L`hr+9uekKdm@i}HTv-Fy6#d2uy1kfk_Uub9vEwD zBG3Lt$g!4yXMepg)^ae`4qC=qg&b?~c=qSQSj)v&dpu^WRmidCz_Y*37;Ako)}FGA zwJ~z6Iq>YSC&pR<#@f>(Lxqj&!#y$9G-U#wE3OZB^R7F=Yrr&)u|5AF=ZMeX9C6_K z&Fh`n%=3?xbA)~;UkH6-_kwfe^4exJ?MGi<4$cv@CDTp*57D2zHLW;t;$`OuAT{iNsa%@4&NQzxxRJy=_u{fi~Z;}=dj zxZrP(zvtf>_wGFlKfCAo=jYsWeB}iPKYeNI^Bs?FOU}Ng@WZnns#!St-3RwfetY$w zufOEtA)Bv$sd(3sJlmebOD8_}$0Yrw3pVV0>*DFJ#LddjPpeJ*Szc*okG|hrU3g*V z4yBilyEbv=Gl^GT-}mJgmem$6*tqS)bN7w8qWiAuwPRk`e(~JH-A-(LBRlS{-_#CF z`Jy^-rK{`nJGwdNo^wX!4HbF&4(us;GP&oV(GMNFXzVLnCjIf6zOz4Be*3~}rr*CP zZPAe$r*?SV*WVtj`*^Nz$CumxeDL!{^ItN!SaN2xPsVb-SOUw9MPjgS)51B|%ya+m zV`&lZhr~N#^0Z_nEa_e1IM#dR`8#fS_P+5?_Ic#M@n-{1ei@p(btk%qa$V`#t{3NB ze{{;zQ?~u}R@JxXr4f_&{%LKuOD@UDVY>Uqk>fWfZ#eeM-seBMbLyHgr-q(Cp)WZHD_tJRUVr7(U&WQ~ z4>#s+N*+=*XnWc5i8H>5a0YnxdFleqEWJr+W*Lbwh)7eyxqM0kmdsAI=6?1UYd=)e_2;1Y}|-bGx8=D-r_ zgj3iVP5eegU+ja46R>NFw}Hq@Mw_z8)xdxYy8}X&vw^`3BQ2w$5CPr|(jcN&go_)9 zO}D=#YBsM*sc(j+`KT`X5dldhXw!3n@*smf*y}u)<)#hXlrE9Vh%W z1LK5Xlkf)i)9(Dh^H=VsMqRO3>Dp$nfE7@L`^1mY>| zn2TjfL_suZN?S=M5ovgtp}8=kO~*2kWgA)fw?x^e%UXiOHX5H=jHFgRizc-)lNIAp zZISAjY2Sxb$M9XNl3BCAyR~MB3jT{*i$=8BT5NNpwynCu|AmH}ENVAyKZbCVm}SPX zzTC|5kc}{tgm)M?X$We=HwchZpp9W$h=auB`8d@1n4M&6q zp57SZp~8<*9ZWijXrm5oFa$k}M57L^`a%FnGz|VT?c+>B<;RR@>F`MJDMwumH(wl^ zWOknxjyx^DPtxi5eXLAA@lmoLXO!$Gp(RmJB0t$rvJlCTyCs=SHVkxVLHCmqrI9HU zj5i$(x*wP2aD!JTPb6byDJ!#1D#>i9wR2RDN%xb6RrexvKV1yEpRQKApY)b=KN%Lf z8bSBdtqmItE}ZTxHmbZwgvBOl6m01kVagF=uPFP^85Z`RGr|7jI5%l*17lQhj1!j`By5wUc^r7W|}*xEAg;v>y?9 zIR}criK#;%S-tokfYNydel_1t{Hkf&M3_p__D7|LGv&Bcl-HW33Kh| zrr!_zl2K(!I@dk1VPdnN=S+Vb;f@Rs@uX87%dii{`o9$@SNKP>gq@0wt`hNHql$-w z*)yO*y8%@c*4-ehDC}EAl^LuTy|Ev=c9R1Rv{ukq?CmS~LY;CGRXxIky5}RaQ1}QH zcK1O%k6wGU1A1f+Z9_&LrM)lVh@Lkh@qCI;(fz&HGCQE}3^E;L;4^Dg+mn74(pfL< z2_=0%By3M7uf!5$)}C;>2O~`9Xiqw!A``hq_gAOf&B!>lx2$8FN}GDC7YmExRhpD_ z1@dsPpi~mOoMBQ3iC%RS3F?%eL4PWFG!8Mqrf6b-r^R;>$nF3Yd~lV0DFR?ADC6|38%3VU<^#7v!4j+wl# z8SWwu$P+8ybT#6IGtyQ1P3gk1lgW@#na5#~R<3&X0Yw?*q72U$kVQEoL^&QhTa-0Y z=**`RxM>xtBXt1;;f(DF2xo9X8Q}~Esx6!`1_9xW`3MLX|6ShbW0Xe!AEwD;MKwK- zK$$RmtYJ16lIq8FpX$N41O;4BO1R|`k-q>ls8SBwv`d9M3NC{@it;!^z8><0QCXPC zD?m2Q^`dF6lMQw#HrDVe%7ckPns9rhr`>M$G+|nuFfHpvWM%Hyo>u7O!DVuqC}STr zrk84j)G4pv{Y~lynE6`d&jObamt)Dk971OV`kslOa_GqC zNaoF|_MqA+wH(PD$f@}Vh`CC%Z4uKSM*7Ey7H!*vfN0x&2#B^_gMet;IA~^FvU?-I zMppW9j%8t@oF}o)EyfL^j3JPWgs4YvKrEfX>>Lst7#C|dA(m5sFA|GWws;tMj~o)B zd){Li23the%oR@FDx91v=C6B=AtCz7HkI?MF;oH~zUXZF`w3O)vIh2LVi$ML>Xa`T z|8v#D#cM=aKR1TLOvqv=JT1!etc5Jfd`6V%c^tAR_khsfk1f^{TD>S(JE%H}*>c5f zwPMj?rI=M)v{(m3v~Dpm?Xkr^hknswzeOP0VpS+YwAfx8E?Vp^1VoG7f`DkTOA!z) z_Dcjri+zm1>09iFHCdrpQfr{>%>zYm7Gt>r-9(*2b~x=T;U|w19|KK}%Kb?{bP45e z)LSvN_XppNXu`jWCM+0)>|$ttEe`AqLhWMyG0BL^PWzSsfp3 zq&lYd(9%;!p)}D*S0Er7={^KRBOOOTG*Ta&bi|Z7f@dGj6=G=aqK+)BvnWC6xB=e)-3?+0nrEdGGIn7kmIHM% z)G%)}mID>Hc_J5CiMlL89UL5K(W?-z<;uftRHq(CZN|=1k-2fCG+}=e`$;o0Ca#3V z$?fmW&od?GlyTT+Tl8>JxNozt@$k?#$cY$jS+Hi#yzizb z;vumFMT|QQMG=!@Ns1WPil&H>Mg=3bTbGhyvbju6Ox@avmJ6c9WVS5$(`HJfaHFwe z#M9Ci6$|pB{(`+ouolgU;Vm*$T3L(8WOSu+mC0Qs)};BjV=m&P!>4|BOe^Z*lw^FL z5t)!US#WYPCn(CyZ;I^R#a-`Y0iggv`R=dkOXQKY5ObpS86^hKyS4+ z0hP45NW4+~G(+TssRqZxBPa+Y5Fe^fYcn#y0)s=fJ!+b^7yD{84Wu%a70ySs8EF+- zVOoWANJWjdh_RX{jRCDB&9(q{9jHb{qyW%dfL#VMym{v>Ak0XQv;7tP6y4*r!c<2( z0*r$#anCx^FNm|PU>0|EcAWUCut%EQag_XwqlV+g!G{(6`fV^G1)thREj; z8B17m)Zkos3YBV2HDr6iAgp;z5Y}uYVa;<(@w1O?F|SI-ny7sT4Er|!i|r$y&2zNy zdC6xJweTxgn3VXHBf3_sMZ5xgG;KQ2* z7tVd!>A7&4%ywzTh4W673uh&mZ~EG5p{it*qc6E|zC|A`;XH!ozK2{mFCYS3I1hpg z$9>Ro4l3ea?l=d(tjKcPugQD!q``-$w@qduAQV zSjDpaJMiRiU37EfeM?ECuNe0+O_uS*bUv6fH_FX1>95Af8)SaovyeCEV2u7LvV8Vo z^5%?_$2*~$yg9eZ{EQ}Vj>jDF&`aK&12R8tA#cu3AUF0m^5&Gu@{QxWDKE<7c|Stl z9P$1Ud3hf}-ki^5`XOIil)p)C)5CQJN&aDe;)ZcO~i)`AC)dPe?o|@sz|bfYd8Cv;0g$Y{diA8+nmL zewTH`QIb~&xL3vlqV>p%=C4CE{jdwj@{ zLqt987+2)^aT8Hr&i}O210?@WAu$bpB6f$1i8#5G5__P1h+W`6VprVj16$QI-{|*T zZ~QFOPs=p^o`twX%D13iS{DAkS)wkn6YOOCWfGT2{5cW*<12~hpj^t=OXPWu@-c}C zc0(R3k!xi!{c$4t%WozARpLO*dyFS<9+Br|;!lZa|7RrP4-thNkC#}CKTBeT#OV@m zllXIqZ%X8QFCLc|Z(y#(;Y9QglW*sCDesf`jzp8+p_9|dUncP~iOVH!l_>ZYJm49U z@~097p90$Hyaeb0E|B=B#Gu54L?gYQ#0w=}De(b`oL{J?FW#*XM@hU{;vEuE{eOth zX8@1uW2{9+K8bOZfs-UolXwlW0K7R;-YBtwSg0sJmvW=T*NEt(A4>TY5f9el*&i`~ zXG+W?qCBpN$@TPyOPTWr<0nd-NkqS2NCa<1t&HCwaf`%V5;@*^{BsfyOZ>IO-%I>h zB45&IZbiu@;yCg870B}{(h1F6FHfcgc9pBh>c{5qgeF z`ItnWCz*aqBG>ZMdSg90jz7eAmY69~@c1BoB;_ppqm~hZ6rJQRO(NUBqmhi=>=GL^=6VHhFsnNqK}!A0_39#3Fog zCF8G>xKJYhT8a8rO1xd-R$?}IP$a%Y#QehRIokCu5y$CLJ}Ko>QvOED_}X9O$H$T) zze~#G>*VpgKcT)tDHloEOU%Lgg%alwbMgF*^h~x4k4wUgjq`k|4ZTrGX9j5|11$tW5w};-v@fqq})ql0nwuw>p=8!*8 zp2yOOkaMIwSmMPJXGz5ALX2w+Pl2eez+{QI^cMY;?`qgz-4e4UqG%CcB9Ygt%vUC{ zg6J`>hlxHZi}N4kDk;y9I9uXeiHnH&_#0!1eu*^_>m=4o+$?d6#9a~}mbgdaUWtuF zRPK<(BSf4xk4kJJ;(Yn0#A8I9AK#Uz6WzGZm3V@P^UX<#r-(Rjd?E2GVwUmu(nLjt zoQ>;EiM-C|JeMrdMa;$ckeES)e|t)F6Fs;NmgphEUxgAgSRNMmMHNLokyXfrMAWlX z%4I~xh{#{6MIu@FU7Q!gSQ{gv@`EhP=NVsgl%$Y41oDANe>0$*6Yk63ZBKn>`mO#iPh8jbX9l<2j zfR+T&FI?(1rd_K8Dy|ufhdR~%9Q=&pG_X5 z;(UQqN@P1W9?yIbXKpwhi4BjQco>|s79_8YN7U-fbzH!pU^n>L&Ju0xzvUjX`Ch@(DM$J9rjd8>UDNMk;8Gxa@z zfK}ffi+%CPZ0fts&=;|90@7$7^Kdiut%=dM-(nxjG4)+!=!^Kd3Tf15Zl=D`G5U^J z?8BpnfhKrgtgpK2t1yD zh{(;%_X5IJKkJrq*)Gh-N(D?aP<>C{Hx>MeI8&?PDHprfxpZ zwAxn+eaI^G;c>LcM}2(GYxUoo$i%*8Zl=Cx5NFj_0e!sJq$XFlrVeH{Kr>?_B_ z!g%K4X6oa8pH-h9`b_)!$$UJHe-?(U5&u;}AMYK_&D3`(@>%uOL7!3v% z?AwpYjO8#7H&Y+)7p?k^SnT7of3v=%sAgT7;kf3_?O#k8aTSQ+c=|6KwxHvhs;lIN&A8yUX=E?wfuM87- z2=@lrpG|#ZkZ(6L$jwx(#^n17`P#b9=^2yHj)}Cai1&E z%(oVu`;P~gLfthn{Uk2LbqfM3pszD9HPy;^E-rA^cxnczjv&# z`Kq&$LcXh^~N!seyDVNd1=Ve=ckouT*78ZB%- zH>YE0Y|dz5^JlrXP_KR?gv|@GI)>&I4i`3y^;NNkDsASP#$2~pLAZ%rO5lF6E33ka zz;#&b6|$RgE3q#0*0AEPMY~Y04ZDS0gY{M^*MvPnz75<%vOiO5|A)E@@ideCqaRPl*2YSh84`_&@#TKmEq882u);zpx**)n|SO zF05018^WA#0{->Q`3F}wlM^ecC=gWK8^hIE;CN_UAO1o)aN-MPJ9dfQEhh?IU)}tL zcf|=O);@Mst#0P{c%a|v<|<&HzN?!j10RAs0r)7;2h4E$n>kmwft(LKK+Y*eK+YSb zK+Zp2V1?puPP%Y)^Ane^Zq8N=?k&zaDr}2$!@lY#Kd={V3J(|x99{vJr@;3Qj3MwfbL*I5B8>+yX$Ccjo;c<=Y!vPo8hsIjY{skMtHPbePGkR|b zuNn!Ckp3IOE5S$ez^Izw&Y#o<9lmUR)v!P?_ZK<(&WV9w9=J9hxTq$$@<+A7xFxHC zc3+M@0msKz=jf9!*$|GazEkgAjy1-s9@d@uo%(&?@UT_Z1QQw`(6?9Z2~MjH1XoP1 z4cfhV`toa51|8mPU7H*TW{pE!^}V{I3cMTsKydqX@P*W&p46k%HP*hOw7AOy!QL0w2DQ{>;8e-fSHfTSU5d6rI38`H2I}pNd-ovh zx?QjFZw)W1Cb!GuA8bLLo$d`d7J1!RqaIzQG7xhi{dUSGlC3x+KBPUlKIJdI(g$jJ--KIOL z?uH%ESN$k_Tc@u>eC{V$Tf6sds0-o)0iA7hs;V(K0jSyiCl&)0Z@jL6lct_w=*M{| z7uiy8`<^VdYv1bE8aNWR<@M4(tODaU6Kje~Q3i=kw?aeBc0AT{-eP;g=+DJvj63M|{1`^QDTh zqCnn^u&t;b<=(Gn`0Bzvy>($n(I(+1yZb&pWzQyEaowlSM!tfJ0>OpwnbNpPuZA37 zv@EEik16_nI>$h~Th$BD-_-MKg0mZuZx1*eajxh1s@5UgeTi@q^kzaA{kj&u+y-CHMIYn55$8?PRkx;tb1kU3eyS(KpIFjKPlliR z!l!-VC;IU=`0-)*k>k#$^wv2x7r~Z7ELhz7oe(ZL(%UV zF$bq&o;_n3I1$0ihPiclSs=J$z=~jY3Va6Hj(ok5rfGio5Im4bzYpo0&nRo)2Goi; ze>pHmpx;S9C!;^4VJY?TCJ+7)w=e!yp*rwMY z&grTR<`2Qx^TDU^rv^XTeg3ecA9x*+FF$j6(9wSd&gr)Xy_k!gibGcv)C)ddU9~=( z13#As41UhqLewpbb3mq^fa7y;EXVz=@bCTfua9-^t=myg@^gX9Droa=)Z_BeZhqJX zpZ0-I`{XT0y?X0w3NV*vFAwIzr&^<1&qcmOq$R?q)VmV?+Byx|O0#o%52d zC=uZ-oqklRael3i(@U%FML18)Cxw_>J-D{uJgT5?vhQ>LEmQ6VPum96@qRrXXhWaX zfXP5R`lz!ppeOk^=#x=KU-)g28)FatnSr_`fFD%Rmxb+(%fhVRLgexKF_(A)Vm{_P zQ|5)AF+bSRr&T2xZMP2oQuSo`i+)XkUkl;WzVsdZxDGyjRQfapc?zXZZ-Y-ChEG}N zgrXF~m+p=FLO1lIpE}_y!IcA_X2Yl1(x)}>=`Q%xL!Y9bdXUeKG&_7cTj5wV<_Vs2 zcfhagceXwBYaf(h7e1X!UkRULZjk;gfj^7jPvLL)%Q#OP=QD3rUAP=`HvOtezs`o= z=-VX3&DK#a!V3|%5Mx`bLVF-w-H5O+Ag(iV;p=+zQEkr#y$UvQ9$~+%t3rLN;B((H zF<#t=&V8I4R$*?~jk!Us!<-7+3lcC# zV9dwIWBw^hLSO5xtLUqo6V{@AcA|aCd>h~sH~Q>`aH2a~^l5S*CZfI7syoD7sq%UO z$5d2r2v_1-Egtcz>wdJ;9q6;$bOqN6oQD$-POiE~FH&$G#T=kj-=mizp7$9gMQF>a zY|jA4i2sBeVO|qAd0z=Oxf?O( z1~A8g6Ie&OvQb}zepCk8iK^i*Sm3kbl)0gAI?TTyZbiLN9}lS!g<#2UWIFC;+pUlpi8~u z#A^87j`Lc%!uhHmV{0YK+okiFOF%I=^s)t~iou~*-5KXb$)Wc<3x}SL_f5y}9NMiI z+hdcTXp+&K8efpZ)=W&GaqX1}kt zc`4Gq`u5v3_zQ)Q9mggpD{<`~2>Q_f>~15kf@edg);@c}_dPlDSYGJcZ~J^`KAU{5 z#(!!I_{x<_Lb?A2^>nmRPb-h!52`1gt)}7GY7_2}aBd0u8u1(z?Yh(z*X)NMoqBDv z%TIoyqaUcsvS#wtX4KU-y92e&o;|hA^!qhvQd zaWAH?53?QZ=&w!}<_B&{NmZ>({&Ve?MlWorS=ke8euFGTN-9}nd)r-NE zY9RPa@aa8(`{&n*;NyFZ2tK}}L|mV(QvJbK5#EVBuMm;vWg_w%0dkB6dIy3pxnB$i zas$B^iG2dWL%{8be}Rbj=ZT1K1o|^Er}kYQJdE%PgaawdgTGJ=UO!=@at!0{P&f{# z0v$jNXb0MWHlQ7-0UbaU7zf0tgU=3O|1Zp?JpR96ACLd9a3atSOaj_~$v_R*0jL5~ zfC{i9FkX2Z&s%x?+u=??2QU?A2X+S9faLGffaLE}f#mK}faLCrSKblaeQ`i?_c?&% z?Xv^P+h+rkqfY~pqfZ5rpD!70svt~`zIf%0up1Z$%mg}sy@7UM7SIOF25P_@pbE?d zVliGkC)gU!Lzp@|Kq#`z@^^Nv@kZLV@r>Hua&E;~9EE3(e1@V_;hGFwY8BP%o5ehfalrQ?HZR76 zV$9*>Oy_xy{m!MVYUVv~1~41w26})VU?H#w$mdX{z!IPr$T_qW;R=MyfO(i_dO7W( z;#ZZ>zWDOcu>&a~H{y46#CwvIF`+>ZIzr^j?vR4_BuN*Be!M{mWkBB95${RtBSY!y zJA~38uS&#wl9Y;2pFvv41-X+0?@62^1+QB&>L}KxM5VN+CMyWcYnNl$sHbgrblJSp;mG({-|4r%}-jomjo)a$Vkp?O<|hw5(|8=5tE zOz4&DicmuLk)Z>&v7v08V_?c>JXXxtK>2>|W4Gn{fn3<; z^}{I3^+Ua8e9OOS4GjXrJd&vod}_|!veW`CZ9 zIr_-Bws|*aV@|g6ZgxJ`yXjI^in%!h$a&QbS11kkDwvXJMdo0|Yd)79`DU(8fz`Q{2&YL6Los+(kyYm|xc^@Z*Gz)j9 zzmt`_b5dwB?3jRk9Cjb}KDf@~IpfDckY_;=Wj(GtwXzAzz7Qe7O+E`|~nOTr%Q# zZsI&|o^Ncsm?#l5Y0oEz63g?Oik z?;bR_Psihikmh;=&%Bg#o7}Gi&HKJn2rsqpqx!**%6o{@@uR+d8h%u9UIRaB?0JpX zMRv=1&E!YLeMh1XbsdL#zAode7KykC8_;W7*YjlS}n{&9h`g%J zd%t~)+^W~ydh_SxSAG1Bu7k<3IxzKc4tZAVbLae$T&uqt{n@?bTMgxmEhXpbzPHw` zCGYCYEf3#7?$ztGf{El`U2*(@dE{Vy^Do1mB@gSqOFOL~7whidU-1d~SY7@1o<&a9 zp_zZ#OkURGDW4uBH|qdkCtT{UqH<6?Dn&mc~JgwF9QWDA4`c1!IjU-=d?#sE8 z$=UjcK8Jox-qzng`O~fBZhde1V{6IZy6cG>%E;mR{-b}mfIO~)2QE(|m+K7MXO-l0 zRg2C)Ku*^UcYf7GUe}_7%p1h$?@99J^wQDyzYPFnf~N@J<{~6 z{p5SSboa1}$@zNM$G82Sysx_|?g^6nb^4EAev$mIudW#uA_wfXq3Jh}2X_1ZCw@aN z*l(WrbPD-ktNNu6CnxNJ-KVyZ7xv_!8QsYZ>p5e37WrX6e0KSJ^-s-LLdNaPZ|Wi3jg3 ztL)&~a%fhs;ZL1EU z|L^~uI&J!lnODr3En$u!&AC!U&bjg`rUB+kxZ04eo+l!&o_7t?0M!!a8`As*B69wM zYncXEDB-%l-@+e$1f~pyA5NY?;8o?ip(D2cWbMAdd2{Z5$rqnj*nfA*dv8qdzP9Se z!@r&M2mi|Wf^8oh&6@D^$!#S^a(2d+o-iPJz?YpaIB{OLeutO8*5iUpJM~B(JlOH8 zegXf=(4H?-zd3xk`}kYV`uP>V`0(ou3#;(8WXo-9N=Cx`84F)^&RcO&apLHne@MG` zi}HEJB{wd3{l)6aK9l12KlyIy$wMDMdgt$sEj{nn+LlKv%I_W*JTe7!vPj#9on zKA^{4?;YAV{M^I8&i~}8-{p?`$sOTItHyko@Igk!dC4ElnQ>9y^A8{BvUmDzXKsFc zu)EyzqyD>Wk3D$p$M1FgynNLy4UiuMYxP@pA*=Uv9R5Y_=?ihXgbYW*bYRZFoM$YbcONkf~UgR#bQitGYj*Q zdoOlD@OB&l9tFYGP!0npV7DpN&ISgyV0S1>iopNNV5OaZjJ2ew-i`ez}xWm@KfZGtX z1_sIvL2Y2bZwN{Q18f!?6W@TK*sRT$h8Q#-flUbB!-oO75yY?9tOvLdgJvWc2aJy% zfNztH&3ZsjM5)Rp1ml2l(F1seAvW^>w437r}}66`NTCh1Ra4ie1=^5f?2w z@`1YbaEl}7;u!D`@&J~JpjmX=qXc=x!U@u?#^J)PbPISGP4DpVOa9aD^w&SH-8o00 zcM$j&3TQ2A=hja18o9<9d7`=4f3{#ZIy6JENP?J*uw4fn*S>;8bB2>o6p67t-+2UBE)8PkZedy5)%aj0Ygw5_8`DTW7`cM18SR{fzDl(33b>geT0RilyKnA#wt*T5i%SI59Vl!>DVJlFgDjI^h_pWw6?)y%;Wcq)Fn-=Ck3W1#E#k$7K`9GLX8ni z;Nfj}n#XcVHW-T;G7cYa9&RK=HMFvv8mff`@)a}0Lxm%wI+#?CXj;+c>^}|(Mjcvp z2L8P!4TINA`#7mkx!;J6b>>%yHvD{XY!Ywkj3oTUp0Sw?YIZHmXBH=`oz$F^&JJ6O zE4@cbCv|)}rnCq<@qcKJam$bqq5Ku>#N8~syn^+(do1a1QeHQM^!GnB$NwWV#~sL< zOq%143@97$h82?#Hakx4{JURsOmCxzO{{A62?BUzu4r2v95ae-IDP~ju1|4PARKoo ze&V4*T^4_eL8sFN2{gyqfNK$>eQDAb^TC8T)}T3_FKLcTm|smeAF!SI|7PZYERtVw z>_s^4Is8mRHnkvrJRshlFb8mq2iY`fV5AU(?bs{Xj&I~)3*wgn9Cq|q<1d}nDT|y4 zsXjkI5z*qJW6Be_qek@8fDW{eu}VrULLfc<2;q*j#favi>Xa*ZnR6)^fzO7cv`hCP zD@c#er7&&*oNZ_?LN0a6MkL|^I#wJ+0Hntc0+h}aw9Ee+LDgV7zMM+Zei?~Yx;%|= z+>7{m3%h-ISHdy-pmhGV?%x4fOov2f8#;;bFfp<*?RcD>7oiJ?!m3Cv5c<%iQsBLnja$>dCPQkj+s4H&Q z)hQdO?g$UdxEeqEdB_o}%(w$0PXgM@-O)LF*fs>zArzbVC)7RZa;~kQy~<;Iv0dK9 zGXPS;BBOFHp)*5Nl3xy4ver##Nc zeq^E*M)gx^6*!NDO+_k=%9@Wn967N}w4(RuNKmI7g8o#xjw{TjPC|gmx?EF=LO)SPSRzNm!?ytI`{)LEd_D_G2XO|}YX1e|+>el%BRKV!2#6UP;olRkj}TQd7~1lYDpKhCTy%uPKZP>k7OPXi}fqq!#|E$YvOh^0e#1pP^w<313T zm7D<(w8L^3h%R~9()Evs?wBiF{IYOyu9&x8F@}NY8?ULHS&iXwRKyouNTtnIo?{LK zbxI1`|3lSt5;YQKeQ0$5RGbDx_y0(g=OItADDz`crl$(BDEFk$pU?Kg($*m?z@BEJ~P!^H6g*~oM=^PjJYkzNH^oIYgwCdgdUN0ah1ke6BH zAmkNMdB7TmYc<{t4iLTLRxN;VJ})8m)6-)?Z)}HA4dQA-jHV{WPXWKNh&N7%K3&*b zk{olC?iH~(JJStaZa^I!Y^mtghflGsL6W!<@fy?KF31mK*Rh)$AIb4H}Bdxv*yj5;U;JCb@(~E1YF4N z@G8TW$QrFtM&{|Wr!L@cbd&Kn!u)yD%mvqgn>mso%dikF zw@b1-ptJ?aGRtg(WSP;HrGLK<$ubX#C0S~j64m=GLy|^eobFV zm$VZtSCNg$Y*}Kt&6F5_$B6$B$@1(uvt}!Euem{XlmBfb%bbe%9PNj2EN7c@4Ukh= zJG{UXtobDage5IJyd23U+mK`YNe7bqx(cVs4Ocb_a+Yt=f1Vg9~>c|#NHZz#*tG~doOtEj1X`qb&`p83dk zIY*93tLD$x5cMCGA?gp-z|wFV4N-Sk6!;J< zQHL+XC+u3BS>xLQ3+(^dwV>_f_f{UMvJIk1H`wUm1>VuuP?n2w` zGp1QPajm$_YyCQ8zZzESJw3nf>20lso#*Fm3)Tf83)a@RzowSSKO5)+n6Q@Xjopt2 z(T_c?50nM#?_$W>{fKK1I+6d7_-E(~Th`x#Eo-%WK+1a0Knz|lE(-&^)4kRYVN)GL zm}|v|V#ITH?Dq727D?N6Pj@nH{Xb&b8Zv1wzTdO3WexlF7$#h4)2+u;`1cqKc6_Y$ z585Pu5WE;VAJNA3vz={R-$@(SXK3U4GOHX-hUtN!oPo$sZc;X`|JzL)*FUjsT;J}Y zjq88hL`LfX49`77yVidNC;I7b55gbb^nb_3HEp(qT&9r|Mt8PxeQj8JZ)08<-Pf2M zM)xOa&Y+dln@=r^7iHMG7Tpo=2t>Bj#l8`peBjArBdn=*d*Z1rhuT=RMF-?4Gc z=RT*6Yd)_zZCvx&w=e#^AuYydW~Yto0OFlCu5J4NT^rYj@WPiiiO&$nqjKmk+7fmH ztt4!N3XK%|_$XjhilU5YwyE(#N!d(pC1Tj^7ThQCfRLP_IG!Z&+kmu9-7SBrec+om znl~~ZaEs*ME_5;07usxAF58At!))x%HgyI1nfbV$QSWBrm+W5-uzk3;vVFMbvVAyi zJK0r=r86+IaQbs)VGcZ{Wl6e zCGlqj<1x-zpV35|Kq)59Kz?E|UgZnDRgmYlSa1I3kG8505}_}zDb)8ckhZD=#6-Lt zCE`rNaUw1fCy2O!oFw*#jS1oaY`p_JwcAL0e}=a1#-M&Kzx|zd;`O94-X0WuQIPY} zHPkSw1-~Kqq9Ct7Odl(F9Wm7~z9-1HIHc2{5AiC&I|ZK+#Lb>cA0fDqi1BoX;FE&y z2=>HFN2Xsw#CWI_Trc>2!Pf=f6O6}&mi!Y07YN=g$PG27|3vULL1mK^gJggY>A;DC zHG+2vep~QG!S@7XW9@v|g0lp_D!4&#o8Sw?k%sY+U|O6_*9bl!_?#dXwt{`GwtR zBSH_p_M?2BA}3uSSWX0Am835xreM90^sh_2vSp2Y_Y3`?q<>eCuLmiAr_e7GA?Gcj z@k4f1?gxVZ668Tx+PWM-gnYkXx}ZAFg!D4fLvfsqh;r0?2Q~{cME|Fq$kLFIf#h%8Y1x*395A$@sos}E?6!&U+@~iWr8;op~p7`pA>vfa6b|CdP@)= z+EDZdg8veX<+=>M{(>ojV~J_FE(o1RM12Z`o-Onop{s?i75aLiR|>tJh=?`)=~Z3i9|3>GK6g64P)5M{u5Co#1LB>V2EwT|}(o z4+#Aj5%Rtx^iKs}7JOaO-xRuC=y!zvNa(){ZSnd8c`-zk+fQg^(;D`#Qep+a9G zI7_fr5SI-#uQ5#(qS^{^8B~Z{b2VOZX;J7GOchKM94!cy6d!MiInHwh^92h9iv=r) z5He4&O0Y(7kzk$RD#0~^je<>r8w58BHVbYRY!%!lxLt6E;7;O5`}u&lN9etR2Lula z9uhn(cwF#=;7P$#g4m=`^4)?y!FWL)!e+UNf=PnOg6ecPI%70xUjCsgBBK015K->qF+jBIzhQ%0o!98z26qI@IojZ6uC8rx2UE|@2Deh-oNaKE z+i^f7s)6EYJYCxkCb#2|O_vfQdAgU_r44QtcdjqWhForJFcUso& zUTBw`l>Eim;HE-d*x(K(eI7QrDXcpi++pdashX>0R`u zXyq`n9chD`1v!%c4IA95QD|kmONG_Bv`UWXh1XRsTy$OKS!{4aV){bk+--2%ma-?% z=(YNj8P%RPQk607OqkG)u%oRs@3twstemp6oyEWE&;LCe-2TP52IAVH9WF=8VN1ss@De^TZINLb&8MlYIw-2Ukjwmg=ai@ z=(N0*2s`B!LS6#mD38@4AM^bL0jGY2h$EkNTHX&4aLTK2=!Z*dP~K;?!CmFhkL76n zKC2DxdWU}4;tI+eX4f~^ev6RCb|4R(u5U_2eOEd3>nVK9cL3hme!Sn}9;tR(-p>)? z?6+3%Fh92WmD7ALfO59;21mK<7xFP*qz&%vkjHl@+G%-5P^hz9?k6*UUt!dIkv6!u zILhVkEOoh&Hn_PTt&e6?q?X71DQ7*lLtYxvIsULM9h4VogZnrNqkiO})AAy1a365! zhwbp7yht0|Cm~PEaLUVy&@TXaESLHXa>$Fc!F@{fBM+UH9TOq%xI;f|#|QP}a{>Mb z*Nrof7XYoDmdED^XZxLoJU^JIA8wO_@}}7Gg5&vcqFoR2&}n&-BIG4q9a;}?n;n$r zK?bk}^*aW60nplMdHm&tQ@=FG^Mi@{rNEPq?HOrwa=}FX#=w)0^0uI|&h|^ivmE2eL#O5OdDf}lafg0mg^&5} z#l^|lexo6e@BFmW^6mkjQ{HKZe%OWz>Q`^e3-<3RJX^9H^3Z8{+(&iF%lUF>evA`7 z=41Vx`kjHiGg^p4UJ=4hd4-V2XKLmjFMO2ehljkNey1_m8BZQMEgH=bCeJ@Fq#s@@ z2J72L+Ar8-sfK#DN?CN2O~?IT)&q~?$~6u@Hyhl~fRATQw9`RT#=R~#A+7T{bmmEp z;7bNyqZWd69pt{b4m01@k$4y5xN*{H+-G;Ta|YTa4N9<`uYhO!vCi~54}!*pc$fN` zR@RaBSHwB_PGW=QKI{!@r_=bp#93~|SMUxNH-juU4_=r1QiQzqlkw9kEd+cz_l=rwY%_26tSMWDwB${Q&x*7~b9}N4`rn z0n~hvHn{V_cTgvSkL^OYI-=hWTx(xvSYN83+iwX1j_gL#bnG?7QiAPt+TsX#ZHsJW zDGynK^3;15$xEmzx8J2xPBuKt<$YGeqUE*KHH(*CD`vQD``Uix?6Cd!;_Pe{H$KNk z|2f#;&ajpCusmLsVpzj3g!H)^*07uN#-E)Jl7C&xNcOcCr*zel5XRJPmFXv`WorMEw0FIilxgMYSX9AoHIr} zpE}#K(<7)Z<7_w)4343090SdLPVKbXM0!j|D0|i-9Mft{eI0!fU7H_z}Ud zc6aK4pibksan2F)VfhF;&6kfDOsAmRi;y3l>5Qj-Y78!35*mOQWoH|MSvli!a@1%% zyB+uw*PswQ3hFU94yD)Uj`>p(>ZbHLVI>w`tq=JdGy{ zZJnE-qmhd;VeiOWMcwaLx}z=Q_`PqXV~PEpbUbst>(uWM>=A!_E56$g{o*qoM*T_y z{HD5@@M6HoKz&L!L-xbUMv^BXKd>ogSU|}~o$!6GBOa{i)c52DTVLu*cTbb2F$4N# zv(1!l_IJN&YpfUA$)C^y`=fTdg}zB%-i|iJFk0`)*zoM}G|1t#pRR3PQ)43Y;Ctp~ z0_y0$4Yo^yGT!Co@fd!$rg+=h8fhcT4|^r4_y+xjpWp-p`U&m%u1=>NE%tX?qphE> zk?pocwOcCsp8bs5n>gK8hP0n*ua<7ws~&l)?DmRDm=Z|!Z|>L>n-XxL&iEWAe~907j>0!l~ZN6ksEE~%iVBv zQ_MwytX|WPKH0mZeU>_UHK!e&6_*TMmkx%0qC4&&+RbLr&3CD}=SKYuj0qo*cF<{; z;zW;7U2~*w(<8N2*$3gP;vI2cS!Sz35}iRpZ~2@Uj~JAJ4MqO2?T6gbBYjNc!3v~d?jJGhjeBF*2Bv|gn*&=7cXgz~ z?hgC^SX`)04m-lrd!a4S|FoZxg)nVsus^ALV~O3bnB!_(q_y64)K|a$s4w@G^=hunx^!h6xihP2ku8-zxT-}m!?(G)(F}S zo?{C8i*b$3cGCZAu~F=hLpO>Vmq zc0p35oLkTzhhkegmOIARAhbai?Kfgfah$pRGQJY*@y2nd$5|`#>T#+2m38$~KH9XZ z5xTTK+;Jdx&k?3?sDj?2n>%uxp)Hx$moP0f&OB*dkF#7EXOPK!oJVS$d4>myQ7=6w zef5n;m2SCuti9azSQFjC$J*4up6x9i>@RywDLpd5Ip%V4JP2bh3uBJ$g)?UF2Fq@Q z{S4_pU;Q1Q%b1zo#h5|A!d|02W@4nw1IE51A1|}VjB~u`vErOt!FlDi=hbAaL3&>0 zV$4vcTtoistN;4vQkOx!qL2SX)`u1p`KRi0Yd7_gvB3Vb>oWz{Yr8%RQ6D|- z_dvc8)6#K)vQv6bpcn25jEq40PH#&`Tmo!!`FRboug%*ZM;xvt&w)qhZ$tj4z`Noz z&YLyJtK~#kBcE#S$Qm6scid@#1I90pG@?!PI-&cW^TpXlNLTCgEo^tWK7`ih zUv@oTO6<88K3@s~t>4Cc!TPM{%XN;iq}OQNg1*as<(NutysKj#)|Co)wFbbhCD+&R zwRPXQudV3weOO1Mt*zzGI?9@$`xVc$aVOj@9dGn8g4bKU9&&E`xCTN;>g>)1VvXeW zmh0h8aQKVLXp}qwxERZQys+qprBuRrN8Nfq8*u=EJ>y zqo3FJNrBuU?)KjP-1bc_f8bZi@$LJQi`%_MW1zXu+Q5)Lje#L%ZXgL`G#Tw$u^{x^ zrrWnTLa(Upi)R4p?uQIN`5o=c>qWv3TRM8Qh1$4>F-NsA+n4qaP1VMMb^|uNKUF(B z?~PPDUwH)c_fCCpw6(f(eKyiAl%t(>eIna;k>U$)+loG2w`~l@eGjxN$5FD3ckCxz znj~Qh*FzKI0^_UwaoC5#9DA2GzVMKR@!Hy6h&VkTaBYdh*R)hS;(0W94e=rVki;Ks zwXZQO4{fIIgLvH=f;qYyX$*5tUI_XC9`yFW?}Xn1-wdA!f4m3IS3${b@Mw7B5IjG{ zMC%w^;rAoF6NU0~P2^hzzr}<1+d%$~_N zFNfc6;0zcr89pAK?*n+&s|ucH!44w*0Q^(%bZt+jH4^>)@}e0cw^VVo`O2zi#o;TK_Qo3N2Y&SGRaY?Ls>~7{K?6YAECKVGyDi7w|8n)Yetkuc)m_TeNt2?TV2q zNk`#RLv{qVuNqdaNV91c9j3TPHCVuhcZYM1(NL_Pft)z{VfS1emn>t{oyM6qk2>;%-It)qM?n_Vzk zCCw&qN5wW{!B8$d3`g4zzlC5O9W zt?(#x8(_B`#9!s~x39Th(hA=_S3Nj3Dz4f1tDF|Vq&4tp1Un&Q5P~$d5M^>O#PKQb zM2vhtJc5L5OcO>K^ToGM-E~RJUA8s>Li-T*@@_#xSHf+(vq84 z0*~k%%xCU{BiIDk08b9$W;;4kb3Y;`LOFhJoJfuEJ@jU)MeD{CDwmIv?G%Qn7gLCf zAlgo0p(oJ0Hg%3=wR*cM3n^Wcg%n3wprVyUz3k8HBd}8w(Ksg}Qndh(`n!zGs1o-H zA2C;T@|W4kR1%-hXImV!gY2I|l*sSvOW_Do2c9WW;(^I3oYg{{hhky%W)+~x4(cMitv_;!fm5_3i$RtSc`;{7F<)vFDiBr?b_L3K7eeruZGIh#SlnUj7c+ zgsW5Q96&+_rh8Onx=r*W7js7G%{D|QVp2vG8cK}PAECr3{lVX*a^6Q3+ijvBxf)c? zC}l2^#3&WvFQ?kzVUZw;ofMslS=_lhbYk~e*;yo$?O*1)Tw1KgpcaOfa#&?Y*UcK``#SWu#NN4JUlvHl!_kKQ&q zHEOf!#O|}QA}qj%3y*5nLxDr zG1~R40oREw@X^cDsZmwciQQ+Vsw`k1yc!}05#ZBE)R{+_r{Nt}yRPk$d}+|7Jub5? zlZ-cta9GZrYFNFl=+OfL@bc2?Rn$*2c>9@FuO2-};@xh~U|J4H-vDH`df92QJaie? zTZ!vonv@!!0%`&nds2Ll9#hn-_9taSEY2T_Aq`I` z?|J>r5fE{H$i#-0n(WY0m55yGXQZwqn`HGawAH+C(jY25*eU-@gZ!wgAD_Eo>v+hW z!gkffkRHe}6gsP_r#kGRc&Ulr@$yQR-?NUr7&|ZBaEC%dQI5A%iU)A~WNper${^RKPYR5`+7C zTomBki0AR8IRv;zY_NX>`yL1$t1wS^aB0RE=Pjk%gDf7mCl*l7#NXP9-aJGkxZa9k zQ7e()ddr9zgYef?*k||}5#WIf*GzX3z~fUf>SyX@o+89hy!jS?kBwVAbu263^$Lj`pljf>G<}(k3Xt=9^SRa{S+X^?S4-I zHau|QgE!~jh!*Yb+GMN)CVUO4`H1erKm`JQ@hSXGz<#{JQwBaJvbu@)AwBVX2pMs# zn3A^z0dxLlF!pD{BMb~j;QP$F2!W>&7|87OER*NEl75aqc7fRlu)qePsfkuVl~9NX zbN)}z(*4&V_#6TW>Byc2qR(suG9(8i7=wl)!ZW}u03<4<88YIg;qQ4W!Z?2v!rl_L zQX>D@FY;3nFz0`aB=chP0<+{o6oU{&T*%Ur5rA6OM|dS}4CYyK*jbp2?54lSCISHe z3_HwhDLfo)rkYP6JS1ffi7_fi%9j~VH`#_zjoq&*%4cnJ{{Nuhp=L=8dZzz(5z`NW zp=Rk|KyS0;B0wrz8?(YbJvY}(06W`#n8`*56Pw%^&fcU*TliiC%=z4F>i-&oZy_+i z0!Ie}BN6xjff1BUXV#c~hnnR|s_M$#W;vy%QK0U`0r|+LI@0dR9Hi-<8(9f%bE0Yb zueSqi5o7Rb67y86!o0mra6qLz!0=bhml%GC;Y!t1#>mG>%!C}pJ<}w&pECuKoGgCM z6bai>N|Y316wRQRHz4OP?EpI~h4=gBDwA!V@&>~hwXHJk6~7b&Ya8e zF_RCrnNA{~an74%S>FyD}v<<8t z3bNbDNM%FulsA`g^JTMVe{M^w#`+opYUTJb0&Fm)4kwXXtHwI-RGDgPGA4tV#roRME2Ji6r}p=m#F7L=%ng71%dE-W>9>vpVIg;!O>jyfaF7S z4g3BT49I3HdhHq^IyfMigO`YN8IWon>V81-CnS*-+=n8nSj4NS;On}A{18-l1)IYw zxILnRs`K`c=b-87f2*&n&MQJnu=5U)pPhFRVpZq$LO=~Xet9a?c_+!(ecgQMC}-Wc zlus~MOL0_(b?X9wyiXYZ!_d_NFKr4R|Dg~eBbP)5_lhL&qq8m8RkiJ>E9tM`iOlVDZwtyB|p3LF~q8x z@LMOUCfwi+b!i0|yYEu|s>Ru*RFg*G8ljx|L71vc+CYhaH~U7^U^}Bvql+I!*620h zo;|#HqVVk+4W;Jhmwb8-%_| z=wm{!7Mkk-@^cj18J>!a7>&LNp|#5U zu+WDUsLXOXb)1KVAdKUH9pTaKX75B2<%}uv3DC zC1MzXGe}Pq8ilKjt)NxLJt0Pwz&#$jn-OqISQSBU6Ix63VG&aq{Rl`#`_d#kFmsGb!5ZyH3$dWB6!{k@sU}(bLHz!Rx{*nhHr)Ei<9l}+I`l1(PZ+8 zem8s~hPifapmqESgipeshS%AZvGX@PQh-coAEcP!iC`JQFxImBYyfg5;jPk`u0=#ygHD5HDe94mppA4S{zX4u5XM6?X=fT%~ ziuBFk-2%TA{){7^GoG(bv}5=%Jg=fB&LKV?>rOs=A$$qEc3s8u1<7`Jz8u-<;O{E_ z5O@-?mLnfhF%S+%Z;Q88stN9jq?V_deE<(G=bRAC_d*S)Qg6}G{ z>nfh7xjHSTxRx8s>Z`9`SsSuPrwrCbGjSK8r;il{XGwOET~s zBPK>Is*R;Ev!=BP9-%X&<$@{F6~SX_28W74dwO!pe~0 z{9f43)T<6zxgseU|D|N8=X1u>ag~Z!A^Q*W>6MEyT(zRuh0E`iW553(4;?q8yRfsy zT{Pp%Sk>LeFA+3N^PjzX5*W{je}BQkIu&)zTeb+R--?>+#xBKS&>L#Uj!Vx5$mSb>`bmgis%r$Sp;)WGni9MI4RK(7cIoOq` zPod#FX#F{e!4*@l?r8k#y1E9j{)YQ&Nm*pzzLv`p486JW?M1Z&A&k4Nl}i_|XsEHn z*a1=ZE- z3k;Wetar?{2(EP{VK``Ek1E4gfAwAAwGQ39*4hqBV25bc>q*yI&!{F?5nJmSyw;OF z%`=>^FC8BFMS zyz4&l#IE!BZ}*t6;`8*)w%s_*{}aXE&*Om|oR=eHy`nTt^7NTHoi^@bt=Zvu4;+eYcM#t*^VQ*7MFzRO`d>ky4Yp#?q3)_@N^p6QtkIs?KUvYMMGgA%78?>K8fbHds8=<9+9_UXukq$QUk3Y!Wh+HG*@rb-edg=aWU&X z@h~B0RkC9{4~s6_|2Am_D4a}%Y1pi%*E(wK^6s*Bq6hX_=mkd)aI(Pu9{P*ZV-ytN z)QRrEoHRj?Eu+ z)S$sJA)UiTnc3nX@>-MBuu#L{^Hk@Q>aBBB2S&)=HP&Jrw5|CNwhL*AZ{HdkgWGRm zbl?cjQ)`svz3nd7POM27(YuN`qQMthT0f_jw7z3})zSdK=*3^GK(ZKxrkPqI26Kt%a&Z`iE7Gg5i3TO^a=Ru1KC*3_9kQl9gL%G< z^E^OXeAB#5o}`axPH@0($lHU-nr7v~VrP*jZTi!Qc^+$Kmh~K_^o1C6S%haiJrKkY zeHq-JaWKYOf4F6ucb6)iS4=F_a>d*Y^KolEX($MPQGZewPD7E?JtM6<)ari^%_yo0 z?C7EbYdr%#KyJkrr3ULDP7RLFUIVZ7Kem0v0517cU`HO>2A&Y=OVR=3cB-zsu7T2Kl~e58x)6pF8t4{JGQ3@%^{2t#uv1he3EJ z8SZ#iK|6kzM!m$+5xBj1!;wzQYQGMnV~mHx=pM>$MKC+Q&R7wa-cQ-P2&E5HZEzv-T1Gr;+Xl&CM~E_bBKQ zphpRvE?qz{jlsrop;JM-&|WD*^LfWK{P-Jk|GvFB);i=Yw6D`y%5q*P#)5uMXLZtN zs52R(Wmp7_hcJh;R4arcEF(QcAY|cy*e8zNYqr574i3`)KznLO`j!ZKMnwLxjcgYN(6r{c#?6nsa%kAAsNj`eX8(Oy%k9NXRXBZ@VqIw zT@YZuo&k(H-#(H@dAXp8bwmu-W+LQLKIJMm+J;e>U>vWsv&E?73_E`nK8BYMns&65 z)BO0DChLCz_&GPpr<_j5M{*JoaRJH?i^uTGMg;Y$B0{fLBJ|n=?4*}p^tsgjXNrc?vMDX({5iyO3^g_WZBKWol^34v@1455RKhcg^4iWkJ zhKA`if=z<0M92vU&GAOMkcfPZf*Xm*&$lx~u3O~eb0(2*I2d0nbgR%i1rJI*4oxe* ziA3b96S_&TRpO5c9gnvI9r-f^D~L#6BQ)P2kPZl*k@$%| zJHCR5ayANXk$AopV7`My$aiBWoj96^_!=VhBXax`(f->c{vZ*2#|60yPdZ1ioCtYa zh2AZgjoobW6$*0KoOG+;ZX)uz^5}zhGn(>g6 zK?Gkm5qvq4K2hRx1@k4nkcje%iI|)v#3YPs;&~V!g7XBcB)vxHMMBpJT`$-m@vDga zF-|1DQLssH0}sZeu<;WMg9*2dtsiER(7U>Yuw z6Z%fU?+Csm_)o!snAgldUa(ZKUhr{2RMT(`v-fyiBY3R_4a5*rc26+m6+MJF9QSlW zk0W9pUoLdMUQ- zlFsWR`FPTS_%9;n9lv!zzClFLLj=bXp+~9ULL%-DmI!^L;MXPoKA|5K{9l5*1YZ{9 zcV8*@Z6fCT86wIb$axC-azUQgcKK005$RtRtP#APi2lD@@F9s;_BoO7r=(HN9>HG; z{#Nj9!4CyL5#;Fz=Hn>_qF->d;3a~S1o>Tm@?9->jo>Q5Cc$Q63cflc^y9=-vA>7> zyCnX<1=ae4^tXiWAc9u*_`v^Hq5mQ2934U8}zaTzPqx!?kbqf7*p&-u-Q?Cp`WnT~UBuSqusO+2~ zp1(*Z|4kCVPUww7KSG3ldxZXPNqKr6>jdu=d`$31f-efbE_h7v zuYz9OqqF=0g2M$T2o?%nCHPgr6@u#o?-hJZaEIV-!IuPoBiJGMSHb@g#ARJwm)wGw zZi+@XDa5U^LR?}M`UTN7iq0USK75`g;?YUrM8RCae8ED&V!;Z*d4g4fHG+!->jdis z8w48#n*=uqZWL@5+$^|7aI0Xe;5NbSf;$9v3hox%Be+*^pWuGM1A+$y4+$O?3Tne7|1bu?)J`?c?Li02(`H}>a1=9q%kHho~ z!E8b9>o9(zV6I@kV4+~KV2L32ftasKko!TT7YWu0)(bWWt`b}$*eJ+-B<61x+$^|7 zaI0Xe;5NZF!KVaw3hox%Be+-afZ##FLxP6|j|-jAFp zI|R8;M}3|W+#|SGaG&6Q!9#+F1p|V|1WyW{5L3puBjuT`u24uzdCW094Np zz*LFnej(G<^8_$M=xo6p!HI%}g4|zZz7oN5!3x27f>nYwg7tz8g6g>ha@GjlD5#!O z5Whj_je^aBn+3NBZWY`vxI?f_@F~Hag1ZIx2<{c!C%9kmfZ##FfZ#E~po7d+|C{f1;gKN0&3se=4i5cd^E3##Wt>;q(z2Idg`SnmaM ziD)POAeETJ>wX&K6H#7{&=ZM>oF{Y@5#_EDdJPffs{0@0SNA_CZ;PaFCHf6xkI;LG zC{JA#cw5*zAq!-f~EUmlN;Ezxj zGYx-gVAnPJxpiR_gRi!k*vxS{|2SqPMbVis-&(`JlBWxku3&-sV*0mXc_v6*^OZ|) zT)ecVa$$WvEHY%w z_hYS!*NQ{gNS%@#LY?@>r%* z-YSQFcqJN?w-#ZieyNbR7jfEYdAA_KDQ^Sh`4LC`c)~~P$9GXq{rC(={q!jyEpImB zobt9i^y8~)EsuL4PW|`{xQzoqoR-JE6Q{hLkVhfZ54SWyc`qaE)NeB;CG{f@otF0^ z!eR1egysisiGuR@u_Wf#^M5PkQD5z}yyOVJR`B6}&`}0mZwPYABcGPRbRB*dd@P6c zqa)vJN5KrztM3SrLEHxzoX=vvSv#HOBFJ;rcOUAThPI~sq3|r1dOZoR^B`#aFWe`t z2cLF2?Gpram}%p1-`K-ZVV(9*1f1oboQ1leAeK8EUY9#JLf#c)@w})PfADE}r4jO) zE3l7&0w^!dA&+}j%##66clUU#iD(1um`2|(g705B(e2Ou7;Qj)?aFX2!|8O|Bm_`Q zy-p(^j&cN@<_ko~YX;x(AXjJ{aIeJKe*OivaMqV=if%vdwP@KCvkHY)Mi~eDBjhzh z9;&R`k8P#pO-Cib8gz&94fQ^fWsHI+AG;er7+bM;*;294cy{}E{ssW_VMaC zAh9Ic*Zwp-C!uuHXis+Kw!@a%5hk|5##+vWuJ+7?+;$6g*0K=JN}3EC4$9tIC!To3 z`}3t`|jtIhup7!E?1?_Hxm-O|v*CtNsls79qD+hN&>c?~b^5QbTL`3^yW;(u| z+t-_$^uVM+>SKpJ`29$JdD4pfZX!|`@8)M6ZB~Bw(G&W#CSD&f#<&BX&5gfoef)%s zi!j}zHmJXkzHk&o6q$J{WXI{14^5zn8PR^oS*3-D9Rl}q_sE*MSV zZ&!6*Cm-(3@x$M4k}9uRS%+U=+HC4^?2Gvka~{^7&-$ZEt^tw1snp|xV}oHQ%`xMo zId-0acN;bM`-S{oF|`=lK61}CiZ`%yn%38FP2*vPQTU;t z8V4?1qxzBts&i5(RGpIoJ%sUSo)JXI#S*OeCK4fJiqN>FQ1M?TLVm5#O9jN(MU`@SnV~$^m&i7toJ2w1&%5vd!}^myP3X}?@bmh~bfp*aT`zo1lKvnO@zHmt zf;&mv{P;Zfh@5MTtVND(iL-9wIJ4VpkG&41M{KBcw_(#+M%c~>OvpItYnE3psdda! zZiqBgFMy5W)k_pQcO`PT-=MZI&UL%uQ|(WrVQxBS;7RoF8pnLq!QSXjhLNnC^BTwq zjxD;Y;3N4s&a~5f9K+xXKKJE<=D5_lXuj!)bFLWN6X$r<&p_m3zQgd&atlFo{A#D= zy@m*9xiz4fU)M|Xy@EJrxrZF(a%k&vw;=2+w+^(kZM3|*ZN6ZATS2p2U54hn(-DWD z!99IlUrgy>xqLQaxx6o?+YV2?v|}25P6S^Y;wVo$>Y#av+U-H$T1^0T8lRhWn92N| z&RqM~zANW9tF>d0o_hvF&6kCNHy5;an(t?bU|72idVorVPP-5^lIop&mudp2`T8KB z!%XJ8&U^=-9tShtbZZSDUWBBxz4lwa918|zYJth z_X~)l<2%6wDT9|Z>X!gNcHD$4`?<#co8chru>Duts-JL4jur#cFf#WjYqR3?12q6+A|{`bcG%6`;Rev8n)5gu)hcU-p7qx z*in=)uVs1+w6%S&kp*)+4TWd_mBN1&el0w&Yd?g475)_bAhZk51YZfi3jUk$yWoEZ z&wVzYd%psnUyE*pZ-M_A{O{rUn=PJyzZjn9W|zX>1J8Hizk_E(r@&8vUjlzW{LkR| zZq>wGx)6RW{N?Z!@Lz@Jd&#@uzYqW4@PCH)p`Uq`fPV=7 zN%$Ax55U7{r|~yQe6{fe~{{rvAfEoxt68lIug38I0CI{KW;-^fC9$#J>HGWnX{1xS8k^Cij`T4MkS6MQBa@mBg z5@*dsa5@tx(FVJXgMG#gx) z@`}qV%jT4n%qk6y0xnCLm2)%4JD62WR%S4!te|*GC0314uClUXNTV+(Ew7wWP*#>V z)v>BDxwK&NtkV3-$%O@zr(^vK2}7C;MXV~NMR~4G! zc3vzf9v2C%eOXCyQF(c!`lSUk3#QI0FY2uJjJ%4lH$D3h+#$T3u{4f@vO?Z z=!q#&QYRM|u__!gkT9n#bXg4wn3R`~4yr7M>DTZ+D8sNozgA*lnO@+yFxp+HL}Jp0 zR{$dds#MO*n^90%G&7%_6FD@>OXtjFpXFB;ItK=_snVtt57Ys@|;nVoq0Iyo$6tg$N#Jh zX9g8jGOHL@jbPz&zvPH0FRjckoix?KlV31tPB`r>DZkLEhgvQ}((HxPNtZYTV-S|k zDsie~FM}cesbQ5YoSr|$k)0zYQr8(+oPw2`kw4x+%`7N)P_v4hoVcGWo`r=al((c{ zMyLK{Tx54*6?SCOYkgQ$=PZ-UoQkQ{I?E}hIIn!ltWsyYvfDDpWrStJxK-=vEN9kG zWLfzvELzT?SAxVM43jBE#m?x`B2+9t^J3><;guy+iL%1H%y1GnOyLo@2XaPm#l;A8 z7Nb_-S+k}WMMm07No4L~=iFo7veLN`JbZ)*DQTOjc0}mKBgCQ>2CR1uCVQ>GLTF#4 zBX}p5VjWjk@5qF*(k>E8u~bDZAaWSkB|}c9gz^G5J{>ogVWE?duYz-m0Tp%-f0c`P z!$|vdu5g2UmTf!Ft!?LdhO3u`^6oGu^fu8KGOB0W-iv%6sVv>`jU-IhI4!lsJ1x-} z4?{0Ja`P{q=(%UEUq(Jb60Qo~bsB#rz?;b)KD-+iEA8fH=tjd+2=LCp9}jmEVz_1F zGksn{Oe~&RZ5ihL^AKasu{I+DPo;QvwrOUM&u92b>mkO+a8u9Y_Ns>c4}Sq!c}*>B znd9@Z=?g#KH<4Pdan?`m>dpCui)t5Mr}a@^1{N8{;+j?euYA8Xi331f70~hhR`t7g zx3L7VU+8;9-GuB?3`7h?>}6rd|HjLYLvFxl&sMMX^zvFqy!hBwPkdG^9^VD@;3Hk8 z_YQpAZuMI0ZG4;%Xn#DDdBYvQC!rnRFV1n$+-0R*KrS4%vy3tcao^6wF6Wno&VXKK z*seHptNAG$q_Mf>aGl>bstFq8u!1N1?5NJ~Bl`w<8L+VMUE$E5d#60>Nmm8W_l;MR z5Xbb<@W}|Uju!Ut<`L~hNbKEVe+x?^9p5W5iHQH9_lzJYi}74@i5xpbz84|-1ycpn z1X(`QGX%2*a|9;}<_hKu77B7r z8w58BHVbYR+#;GbhgmE z>@c0zC1S21uT7*21^ND;bctZOV1?j3!79NT!9{{~g7tz8f~y4A2sR2f32qSFDA+8x zS#XQsR>4-mZGzhccL=r#J|(zQaJS$d!M%d}1osOb5IiV&Nbs;=K=7F0alsRUCk0Ol zo)$bK$QLziXSbkFFkUc0Fi|i`kY{X}&o7uN$n%km=hDLS3GqbSiEu?Ds`Coi_dZW( zzVqUFfDuBEBVsw_dQ5(YeZC?PCL<;RrzZU4|-~zsO0CJP{Rzue+aVIDTZI z?`L#07fjX3RekneaI=2)W3wjub}Euo(R zBl)U=T=un%J?Q=n@2syM<5`abs-WxpM}(d7Dj@I2h|^A|{SFaMc^Qz$amn^egxB(hAcJEV z83{;CKpf@t54*w6N!JrggOa@4!{v%hEG$%Pxk-JY9ixbH;i39afp zFwY0`yfDuXJI@~TT{>tp0epDR{w@XZOtRreK7V6}8{P*W4{!K4b!3fw?rl5X4%_K= zSn(xn>c|}Y+}n}moGirq{*rHWn8xgOxBnX*<6nL5ZOX#ghx4BPQw(%$ZTFY7woiDk zsNJeEkGdwc9(i<9YQQX+bJSbi{EjQPDd4TTEzm3Bwtzc#c;MHyN8X9wgE*wcgLemb zya4$iydC$#f~Aq)*~KbeCrW6a5U0fM8um!#N&;32Yyk|ZtZ!o>3Di|OuMi7uA@d3#``Tr=&zP{dbV*aGee3XZ&kt9^iJ26$V+ zYY30K1o;xytNEM){bCY+)#3I3sv{*0x-MKCA*kx?)NJ@AZfAxzBs(9C*66 zC%uh+KVClO`5S6iH28-OtGU!~)K{-qQCnm1x5t3INt5#nrc5o&6LK#3sSodhD@I027dBBY@sSaL~J##F^Po4}s3Rb;5iP9SIr zopnc|x*0KzQr-(_#?nqjxsfV5F%O-tKW{pi(NxEmnRuo$hB!>nOoqD`1B3>4dh ztA&Ajo3L6KXtW7;3j@tI;b~!@)h4_x47AxqObY{cBcf0!pq#F`ABm}o^Xhxu43N`n zfcWyg?nq|R>`e?)0{1@5&@ORMB$BvZsK#W#?##LSA^8}*8G1O;Su((N3P~yp1GeZ+ zV~^4b;W2zv+wVZwGG^cFW`Hg2B~fy(TerH$P-LTsWIpY5*;R;WfLCQRu*xRP76!PE zsJ>@lyG>Xv44@uN>AZN=A+1rRb66>-%Q_5d4f3G@B_+5ToIymDN}3&+#FDnEr1_sB zNjIZ~bELs;k9hev2eh5EtOcSAg=9M7{uY{3J2n z!Ip`~yq-*Epw}I1O(V14eUk?DL5+K-oB9`z6V)#p6FllwWFNjxBzxa%3G~ZGF03;> zP(!}b?2iN`aDbyEEzAD(;k1$UvEW^t9o3C9K#tgXP_oWc#PzpYzt!#CNTcPxsi`kS5GKC z9{h-PoxmUUUUjFuS1m$>o2*{-*JpTUlK2Py_{^9X$nwRw&IhR1VB4eTO2Fr-!J-7e zV6*sQw?f2Z#Jbjad8j+a9ZShv;atn{NMvs}ne$H~!c6O7mNcrsR;)8>-LWs!^ZAXm zo=61r`U{d0n6q~|c&)!BG&6$b*g3dbnDduI0&?60z#fYI>+`-N5oivIRu}2{Z;|6B zB;bL>=<^r?CmF!4s_{<*dYWZkl-jo!%Id=atC-9{J^~{U=*J&9B#s6@XLx^e_7#jQ z!XG1XOEC5;)r_6XShZ_mUpnWzP=vYsHT)e|33;ma%USz@T-|rWOX{l#W+-NUXKdgA z1bGPFT)`vm19=Aic`~o~6+#22;?K(@8$V{6%}Lw7yLRDR2oiW?2ro%GP+E0@U4O!M7$!t zqT&^c3Zh0F$`>;Fe115@93!fYQNx#eQ${uwp3hH3rE-{ABF;_>;x3&y2xTf%F3gxGw%ew z8=hBAw$BE5r=xT_wGIF|=jk{~>Gle;`L+8`J zA#8_&2ZdnB)e{G^wja6NXhD5^Xbeve^`o&{Pm#-MRyT+2Gd%tO=IMvSME$3E`i1{B zy~SaI_8F!pE^d}5c7`Xe5LSU>VS4vT7*@>lT5lR3dIouwP0xYeLeFKzp3$ISZLtr` z9%dCWB0)t9(`c2LK+~pEyw(%9uJv3-v#7ou-Ac)ekOKL(pn={go`jiRYb&&Y6~aFm z(|k|(Zk#$JO#M?(KQ``X9@82I^Pfj=Q3e#xpiB$(zGS^89UAw90n`bNp7Rk*pXRw_ znrFf^&-tHU7~-FSeZ-qkP>GF+Rvd^aAQpe<>AC)cb)NJYp2QN*rDRH+=}DjB$$>J^ z;ZmhWPPDKc35CIP?qOJ$Z=(8!52H zn>fvP+4LgMdDdwIWq7PRZk<*HORA?08soHL*RJynvg&pzy-~j;bo4i%Zy)rxxeL~6 zA4acZfMg+lCip*s*;DJTTXwlpIbS-t8ppi@&&z%2pt%n~doCg8HC_m#r8e11=#FtB+nzQ%GmOMjR{;;i7Em>t3Mc}@pwnobg}hb@1H>um4QdG%py z^9^;#Sw>2TK*%zNM$jW7=#j?nf^BQxHZg??CYyWo>VjH9Q8enIdRBF52i z!S^H{i<0V(0Yuzj4i@Bw3EMwM=sdw`f;{I$e$^kqI-zeOA|J<@>Q^G#{Rc$UhmZcu z$8kscmqK%=g!FHP=A$|3KMDO8q4_Mz{AYxYVgG{WH$}#PI z5Tu=A%DGMOE+WR^147eIFzfxe(8`Vg_@9&b7bX4`pAYz@#7R(`HTuv0sC1M=p3l>5=xMq0k<3mE_PNPWso0uG4}P|)o3E9t9O?mHpS=vpzz)S{_%u2{Xsr*a zhJB;Fi!X;uRk(|>Alivm=hwc~*T^HkawVS)*P9f<2Rgl7qFS%pgQ{n1AGPJtMJK2< zr;hd)$(@DbE8~jnt^w@r819&KQBH_~4aNhsXVW^g!xQDKt@?cVc==Aae4-rZYVlR_ zFY?n}2EPT4sSkr*y@R5966SUKO-$VrX>eosF z=f4kL>!SJYLmY0Kf^G}$i7@SzU3l`)Gv6N}%vo+Z;>f3+miId_IpuAKJm$wOovNFb z_p~i9s9z1z$*1eD<^4E9UYkQd@@sj+Yk0|#kFi?(uBGG*OG^w*5 zdmQEBb~0G*YV;*ogXQiY`$Q9k0BGw#jUDxy4>r)=PdVtqg>q12FvA3 z8E3iNCFiq)c3R%#2zddAJoX>?s0Z(#kv*s%?fx)c_pz48`)#LwCmr%|c?in88eyk? zJ0UL{d9~B>cwgz1XW-s`72-Hva5)Of8;h`0KiW^Be&nIk@|e#lZx!U}@r>Kmpgf-G zrhZxQbf+NCuR``8rqSb#l|rq0A_i!N&7%I2hfecrKH5{MQYrQy&G(G(YQAk<$m=Qk zX%Pp(_dDpQot761K4*P5puUH|#CE`CKUiPfnkyXv$~_s6?<#2_h|$5R21Zb0{i># z@XVw8U?=2#SvRJnF@0kMUq5s{$C`HJp|8OoqIQcpNE}Y5{RVNUUcF8t-=&%WYQF6e z^0tAGYm9cfDYt>oS>KFQd%Uo|d`VBgz{IujPFU XZRKb#;}Gs~_aK6DFqIWw0`PwW^OeknGDB#@Lq#$33xC=pTd zLIp*kRm`-tmbShct!=5*mbazWw)B;@wpEKZBu3EMmRhy8)$;%S_E~4<%mwZD{lD*d zzUO=X=gB$0z4l&v?X}ikd+#$RXZ8%8TGdotcSZX6Q2bHsA)U1M8VXIGG(lL_rYogR zC^cxcIudl4FuBl6?(Olb7*;3b3+g#V!P!lcNjNGc~>e_Hj5VO|RZ;t1wZfI<- zjjL7NxOsDJb$qq;O||h%^_%PCIl_$%4RKnuy(fFsdZUB5nDSKHLwTHiwb8aGwe$ND2>c{5tr9E*}fp4R5tW<*822A(!_ zdAK>|N(z7nDyuzA2|6SeZ?4)D>-|*qo9j1JRyD*cnJ9!j;f+ab4fV}&y2Sgku4;2l zb6wTO+REyNdN{kXxh1iu8yh#)qqwft6E50GPC;@EIQhxl?d0pxln|sIaVTz02sNkP z)+Y35TrXhmSYOM&OA&|Ewla*kPwHA-g0a)sln@uXfDzRc*NPs$7#A(|>$k@h)YMit zZ4bv!VKhX~aZR=1hN|r;yyh*%l#&qq-qO}^O;v)$wVP8nxxTigx~{T*bJ#QRsml6> z`VDn0$?lQ-mZqxB&6_;)j8mtzxvmmZNTM*t+q&&77!6fhs_J8N5i7CG@o8o4wlJjD zH*St|7UQg;wsKQ#b92>(+RB#g;rPA`S2Z;=$f`D@)EPOI&EbS$7lv1>nrbU!L7So< zn`*1#JC+%uT%1Zee+#CHL|r+tx~{8k+!Su8ZK+KZ88@ZU1G+EK1@v5HxDjg`B*(SK zDj1!$O)ah)l8e_@wNy2D>{|~HJQO3RTROs$?f#Nq>4_xAe6rcKH5;Dnl|-R736 zmezRng$EXbGqFrPZ0)AL8|V>^1I#{q}6(6i8nLW zRC8?;swYo~^sY>n+NI$}^k~8a-%?+_5o}3wqvR*ejgqfNL0nWwLGr991=`HG8hWCx ztY(rHNVbRps(pcTt5bsZ?ys5gh zvbi-(SH-u>zNl(#soT_8lb{hxs;d|u_3=}QmRP;6+MRHk!wvNCsrEWH!&Nd_GtUy9!YXfRB?eaI1*5H+4o@MWW?lS}?u2GtCE}oJQ?fcWQo@_e zk0`Bf*_NtwQ{^TM-gWgY4YjFiv)ijSx75QUT)I+7Aji6@noU*Ja9858p;dR+r?y{S5Sr4gZw)mNcQEc0*P5cDQMC?FQTxRJA0oAG!(NysmGm+5q+x-e&0q zqlMjc!NSI^oAuyMc2MFys8$1+DLthZzYCi9F}B4Oqe~I{)d?%4ZakhZjC-}l_;u9b zO1$}|lX26{b=moxk!-75?975GMpgntN*}oMS*nrQygBxHGCIvgr~71uTAErnSL1fA zrm`+&+@n7e?;mMAX4IP6^;NA6Ey*^ZENT6aI!WsX@>@748X6OBe%ylQs)QN81`2Jd z)x#~$nxrOqYZo`a$FV1T2uUt$Z9){_j;EzHsZ8Im>Q8wo2MR@FHoy&~+!k)Csbp7R z8cGtC$OoR1$_Ytq7aWvqi-o*>k^9(i)%GNBlFhj@{%EzswU~Uk1Se@Aae1M9_ueY0 z+=(CP){Iz5Rho1c8=cAGxTCqru@x&y`V1H=+S*hVPWXJ5Sg0je)-_i~Z#WY)z{d;y z!5saW_?b2-upJ(UKk441F^n0k{xkC7w7E5Y$&`;2=!N?A^&FdVYB;6q(O`33!rbM2 zh<4h<91&j)^QjCSd>V0g6TH;P- z)s5l!b=fUQ8nkXfl0V&oq|kN?v>I_1#g*U_PJH;erAZSEZfNlIDDdr2uvxu{B6;b20x(@&^%(y4u+{|rqoE!7MYCznhv z)2X%TJ7>+m$}kN4gUC4yRj6W=QhRpme5+JLp(;aZz;5p`?7KRZy0Pb?^W#sOPF2;> z(b0Bp-nci0zPg~RqrAOGg(IhxTG4Hmx1Uk!Ku^%Ow+FoVZ`8par7F5-s(t-{ITrpc zrOW#s?lDxw>7lRg^_{!pnZUo#pZ{ZnLR)Jor~M4e-Z_8%DPKk8bg*r2SMjjJJ^p=> z(|f1w?Fy*KX% zHc@Bl?%I;5|Al;b2--K`oQ*T3T?@y(an~Ofbe*^xeFi<0TGrirAN%a{J!R28yEjFj zptIg=d29Ff_}e0<>xQ-Wl$G!8T1z|8Z?x5n+IeqJ z2JB1^MNS8bBd4QwmOK5VRHR#}<=w^V7d>Ou-kw67BXEXrzI6V4dR_(N40X{4Wvk*y zcUl zo&xCE2fTsem(N)0j?OT2@U|bYk&m_u)Zw1q@Ri$sFSOqqF`Z@~KNCVM8Ta%uW*B{TH9~6Qd%A+h3esk@~gPdUT-mWZl&sl|dkNOk3Fz)G3`icJJ7@<$8tJkj? z@aJ*Frz?|j@;?|axowAaKX&YE@2Nw)J8@IdZAZ{%$Kjq<^hW^g_fd9t26Vo2En*|w z)|IyQu1-t*o`!y=-yMJ7+SNx5=;qw<9&B2RHeJ3DY;fDBP2L!Zv#Z>(YdQ2g=2NN- z=SrOKqoYpYv~eE8Sf~RY0dkO6;Nu`^~&#}uN!5jrY>oJdhnEHehtG$rtj{9`vtMt8R>92Cs_wu{G3937~ zO!Q$=y?xHy_yYX$9Bkc#GmNtsCy&QW$M#!cyIqW!MIQu1K*V^iy|?G6!Lh=5VP8)k z{DApL&)+8cb>^22gI*n-(|ch|M7;dsms>r4X^`?<+nM*@#@wC`Tg%061sn1(j%FjS z)!GQw8OJxYGXs9mV-<5E>jy)JduASU=5xCkx*!Io>eyc1eKE(1x~j{pf}DMk?#Sct zC*tpp8zY>9-#iCD8i>UYv1atPr+2!3>_k3Urn9MSG#h>FbLB^182}zKeSM?c2J>t3};^IDh_j12W*R zr;L4(({G_~iZLEB*K`lUcnm3j_fg{)rxB`eVqNL}8phL1(brc{6&(+8y2`rd`hjEo ze#m_iLKyR9INwKqcj7F=`2c7hkEJ>NzvkqEF5mALbQMSpw6KzC&vi;W$EMh_vB)JpiZaYFUrb=EXLD}YxZ_k z$hy#0c37_y-u|Wx%JjCwSfbnl)C*PY?K+>Mx*310XQ{~Pybfnv*&T;_EY!~^kDShd zzD8tb=XpcHZ>vwM2^Ql(#>|#)lbi`O}58AbZt}noHjYf8RfeXTX(=Gp9FtJ z_gUD)`=|FYKi&j;6k=sWDAMh&pLx*3M7hL9{zfa#=J_agwxNFXHUxYp3$muf7f&OynUxEH# zi@1q!EPbJe>(5lIv-IH#@!?1y`(%N>k6zI|Pt)<8NPN5IV($9JN z?jq>(8v20xbmCsZ?YBgI9{Cu3jzC5#eU5%iJ?&drqujMS3;M6Y{rX8yUGH3DAr|Nh z`XN<)=69gq8*nbg$r#AP`4+nU1)L{w^4@$tP99u;M>ZFZ3E{s0txcP2YeFMyLWSds zw~Z_=-8Lp&)wJThq0JjYqenK64i%1U4e9@HqaYL-*_^J(by-M-Mix)lhOCf+td(PU zT{T8+scLAg4K=R!RIYDn9uul>zAPQlGqO1}d}Ixh3a>JayF%4(MuqyCP{q8EJd-8Q z$YzDNidq|LLU_R-R96+oD+}pr)|E47Ulv;AVptNNQRi_umf@ZY35<6FmmJ(SR{%Pk zB(D1KR&cl$k!vMRLoFg4)5+zy>La-DESA8T`Si%Y%rG{EUIHr@U zaMg!fAq0vlnJWA4o$ai{yC;WY>HtpIhpRrk)!4m$b$y4)(qk?G)Q8LY5U38E@QhQS zqW)viFZ>VML!55q)VH*asPhFq)8t@#>6afG(3HZcN4(ke^B&@-r069V8DV$j7S&xTn z2h)xcI>PyJ9uZF9tYWCu1b)bY9GmFKSsav3$H`$u zzIP-|gd8ed4&a>;W^_WElS|m`mvo{ zF)!z_q>gw1^*V7HYPqWgl3ExpuDr8I7i*|YVTYTaSf9=)L!qTU zt0oR=pN%B>g-qmLiJ}^ues!Hn8d02~E)XLxqDWklmsF39Fbptr5a>sYM0&9lA5T); zi=ae5M@9#ds|6>L1gAohlTacR^lEiLS6EDNDkQBetl$iSB?O7K0#_%*G(%k)K)Q4*Wg&)U>$+<%WrkJN=Tq|N+Nz+1%Yk7<-sb^d+demiO z+R-Z(=0}n7wAL(X?3F{)`8Z)wC@Hq$3dzN1PY9L+0Jeu@VpD67&0^foBo=XGu*g)` zN0M(^-O^P0yJacd87oTiPOK=&y(gi@3tG#HL@iA$djY*7CfRlz*-pqO*+wZ&$m8xwS>SBHq=t)@^HCW)TZ_N zWK6H58-kDKGO~@4Svi(J%N~%Qm2E5=fT2{X{8@8yF3Y$)!-tmrBS2n}k%6Z}rfJN{ z$;e;{ro=+z7vO&;Y0+Fusb0uXfg*_Qn^vB8aK=D?7THG+oHkIY-j?#^IT>^CFfP5w za7#lFm|;O6nOPR>qX?O!G-UM$=t4BnCkNFsEO3IbGhJn^GRVmGkSOh|S*b9HoTv~m z<{B_XseVHtcnawLv@#>(3M2>gGe$$%JWDq{upbyn4~jMmp8RM#8Em$|L!za@(PmM0 zQ4SA#uM_sAOsZm#Ibw5$6U2z4OXzsKO9jv%lptGD-sONMiT$GyO z^d|h?e<O+rtbXxTaYbE|?)wD7(zgboY*EDM~uDw*6R>GX^%-1!);+lTtw(V+m7}b+&H5=w zWxax{VZDc|&+5bF(kjH&w5H=~S*vkPv#!Inm$e7ifYpv`Z|l3brdz+lHN*NNu0c2f zV_K9*>u*>Ebf;B@1c zK8exRY&!>fX`;}YZx3~eF;<0riA!8;Ew!hC&>D=lR@zsCSVsXR)*5>wh}|S6SZnRO zKn$X8Q>+^MK9?x7>g>ZVakJnF4JM3d1wBu)4 zZT8PW3}HK0S-b7uxWv`g9{Uv#5vnuay3_u*Te85~XJ_N_@)ImsWF4}nxx`{CV$T7g zr7g3L*o#5vc2-!A*sEP)mDOQ4g4l;xGOx9swD*9}meyED?R_p$Ydvira*6fUF+1WC z8?EE^5tnGNp0giwiA~lC`#T_Xqm9-{`$r(OI$`St`+r>GI_pLIcOV|723xFCb~gxZ z>2~Wi`wWQVG_K8h-TpTSE$tTTteuVs|2a$UwBE9FKyWyi`>k{K5D?mgcIzE`6bRjD z#CqQ@0igwa)%qa&D!1h8mNK%JgE~oZ->^(0d%a6NV%dfY&c^u3T!2f~DqLQ|xH13B z*O%C7e(1Nqg&}quTemR8e(4gp#jyY261_~H{U?_Qn11_TAhgqMjKmGnF87-DAFn_Xg<8MHs+5+lt_`!1I# zG_&llxWpx9AG^aPicH%+<`N}lw*6C=C^h@qFN3(BX3sKn?QheF zz7Yi07iDfR=i8riOX|!D`v8cGS+dbwYTtrHHHM72$y{mQ4MGdpY_74t0Ad$Qn#{F! z#4TwyYhrWTHnT1^w{15Y>?hqiH<)4jDYwo}v&B9J;sr|EZEmxl2k{|^Tg@Hzt1jDZ zW}AHm#88B?`8jj9{T_&gB=(zoYzzN4(YoDj-f3rn*vyiH=03Xs#6c4Gn+NQfE?c{K z$X*QM_bmCU`GEZ>h%ty=^N1O-Pk@+()BKwGko_AZrm^Jf<`H`VBKODi=+ovS_DT>< zoSu)F9riX5w~{z+K54hR#E;Em_E$jYQT1!{g#9%TdQ|<+JZV4fmb_xVV1M5&=`vrm zp9k?grTx)7rTjla$OnuZXQW`+ZOUQipFynj+L6oLeox>MQ2ocF^8&qcsiDp?Rq$s> zXL9HUUqEU=9=()DI*-FXmQulY$oUUk{97o-2wL#)K+UQv(S|(gu7Ye+>u@VMi-P0h zIj3o+nYd$wwpKgZ$o?bRrB?U&of4juekWugp5De+`p5mKrMORXBMx za)M`a-axWHk{MqdObBM&pC1HL+l<31-$t4dlJTIKpNlj@C!;-}a)!b$Ut)!~bH*Zh zJCYec983shd@uhxAREbeM&-A<>F)>gsYWf>Gk%ble*@AC|BPb=Do7bQt+<>rFfqALFVa+%_Ej{ z(1(@5qgk}r+y1C{9%}CqHW#INPSaF3xHO)78uA=&$C&2$V%=b@Rq}|{5Bz70j-pz^ z^QfV+euPUAd}3bi3w9zWvj>-)bGY1#-1H-Z33hsWekG93O8=tD-{_{lWae*m(_abX z-{PhpMlTm(dCa;Dm+v6geA0IjF*p+$ISX-_it&(HIhgQ%=FI41mwATJF{k7TZXE8m?)GCz4v2lXb(y!IWHGaQLr3cX@5 zp*(X!%%)Nmov1S>2lM~w>Q$DPpYFDQS+SN^M|o4HsvzYB>8RjVX6?Ww=a1;DYE-cH z2Vl=S9#FyKl*4}9#mY|vx!wm~ zVrdU9m&0@B0$-{S$23GPF8|BORqG4dxWUgVz-22lc6zJn(WAqYZK>epWW5@fUz7E5 z-$lgWBIaI;%ZJSE@Lfa)|go5%MX}6K%UR<`4Zb|U(9c8G;i8`?ETk8Q+yhcSRamG?{{?aq-eWZ?SQ_%}5BNzf{&7fCLH*QW zNe7R8uE>qgU@HfG~Ac3ZIJ8m8FB;;v3Zq;^t08-m=tJZWTShXE{w5E50 z)OPIArF^!e?QlwGgXFSh+{P(#$VDKz(XxM>ei~25uRijXT&MGcf~+lT0)t@p~p7LgIBM&LiIqvFk>2g>S2Hbc(VmIh;s;9}YCGeT)(E@{lp;LmeS6 z>j+s5Qb)+kItKQF)DiM~9U;d+>InJ0F5QE0&=GPdLB3fubGUAKakWxKsTeFGX8=fSfPW!w?9`$0S1i@1GqwWX;CrwhQ0_HoXm~) zsZ9}lrH1A~+C0krfO5yLX7XRU#j8NCC;1`oeTq5qf^H;PM)t=wDOLDDSqER1(R+9` zM1GW>!*2kCj-qkX2jE>BC^*WfK<6QL)|>=&v9W9{1R|1N1gMgBOdDByjGK_oTY?%Y zxDwY)E@%^;;FN;@%S_b0m20rOChD%rHE91t-B0}tcEv>9N&TFB-9!DIe11+b`WwH7 z)Y4}uaG>!D(`T3-WQ>ImOZC{yGw3uGe39+*lTGd$Na@AEuX5f&`fXJ4e{V1$=>K;9 z3E)sv_a9aHltwlD-!=2!LV71u^*@D=0(=?Zm&oux9$Q;%H6b1L8JD@HUFI?EGLLDO zdrZ6BW15p+>O8477;L4yK`^e+{H6T3Ea^$5dd8aN*ygNnlNpH^$5TeL&X45j_>bsa z=jr&5rl8z;I)0o+IZwxr>s;;HAM0El_&?6UKpn3&`3V(K!8~MS4#p*?5SLkK!}`u( z!U*f}eAeM35DT9Irn~7UgZWpw>2KxfcZgICW>DkWpK!!3F)qCyJ)?tQiT2c`CqU~! zSfagh>4%_oFf7#`xRm#>Iv|!h<^KY$HDBhG^HEL%N5(Rv&rqc<^Y4!Yv<)k?H!rV3 zxekhzx_(g`47&_dyj~4z4Ik=Ey%rHM8~Mg2jEi{~lm>7w~4NM$F;&vp) z+(+sp0_#gijP>vDupf025&J15KJhFrdXPQOymW#BSGf zbsAPgJy*kZK~C19`v*vba2j^wPN# z2|9FmH4@sRvyjl9L8Xz#vf}`E#aWEyka-2Dz_o~rBk!!#xTo=7d;Z6cQyo{RC0s1Q zxi5+H3^;jf1y28GPZ$)?qFHUdpgK2dx*@&z9n!g6>f)5pW$()p%m!o1P=&3sFcxDB zQJIt+s$>PmT>1dt6quODhy8ha66Vm(dj)E$U>B~L`neQ8*Z6B3)_)^6FEE%4eq1y8 z@F2+Pal#GYGFsh9t<^KBZE+?qJw&&7Cbg|j{ufzso3Rn%CSJ@Tzui!{+b-ot1Y?KJ zSHUnFYsDp}4VQi>>T}m1LaEWGF8^VOcpv$FHmdyhkme-Qr(s9_`#?@ceKzgM=l{uc zdh;XsAG$n^C-eDHhF<6sK9wJYK+SVqXF(q~-DDaCeL-lU&4q@_GVxW2*HF#MH~JEH z;2#_Mkt08uS!sr{zm9~S>3SKa{fJ8h4BLLxCDM%oy8{H8!N}Cv3~;MbrSuII{Ozc(cfsW`42-bO4a}) zZ2um_zsQznwAinJ(CrK~wyEH6k?nloJB<_`ub?#e$7m*N>F2{LNUgJGL*#gPCN1A6 z13Q-$Oxu4zj&Z=al>Zvk)Aj*p+FlG=PumA{zhBCyAvz}Rb*AM9LF;MzUR_@9-+$E9 zv2mY{0nksIIzA5S_?ViB4nKrOjV~D1nEoKf4CAGUm&W`u zPT=HgU3@{yJsLoVaZ(niTlZkS6F6VM>E$m5O@|%ANqOFbFGlfr&H>#nll*+igSzv0 zU+VE5MIQ)y_gFZ4;gV3{m{4^Cww(-NKMro96DpZdR9sXNDr{)jvS}PPkNY(C>J62a zmP{zCUO%O{xOT#nDaB>gB_)&BPhMY*#JbYzs;WsfFGuMUhxAW7f>2^OsaEm|1zv!fR%E=>;<<#FM4*ArhlF7x4e3xCOie`p9>UBnw+`-3Z*WXG@&H9U`7SBOqHEd%!~^3 zd@}cy%N8%6HDS`El1roR^OykJ=3U6P3lvP6oLrzADJ?CFHZgP7jAd6>@*8=Ti&AD* zq{>|#%|uK(BI3qWG+$T3J)yT(z!& zn`f=(KA<(VDrx^m>`5mZGBzvk=91N^w(k^q2|Fw5o%Nhu_1wLt++F{o+c)AUjtS+z|$J9p`g-JC7pn%ykfxv;Ww`r^gYS5+>VvwBwL z(p43+Dl1joewa0NaeHif_6K$L7sa-->ozFeQ(>K4U)hAs51YA#S&Is5V!g9>IJZ|< z*o7Bc$Tc)#ancvg(lh|f?hG%arzu3qCTvZnw@*~{HG2Qadi0Ur5mUu>rsJMh&JNnD zscNgju3L&*RmS$-u4>*~61PA9wn@d8>Wr3k%}Q2FgLz3p1o8_I{PfT zX2KlTN?JA%dlj}sbE+D!ojy!yR^A^u&|Yok{%@PBV>`rY`=Ys?&9JZ`U_*U1cfjZN zj@&l8Syfk6Vz=6+R#eA$4_CF+vE#S}qO;*IIb+mjY^TcMp|{*dH|ehOY`lgY_E-dS z*@y6l+ZQm`Q-HnpV%siib@>wwvX2|WjoT7B<5EBep6pWGP>&tT>3&x>x8ia)Oyg#s z+!l@z9~ML&HsB2F>-x$qP1t%p?7;d;ZpaqaS8NdM-5WkiLQ*w(oKm$Oqh4>v>}-}C zC7s=t!%_-1&la@tlEvclON|&q{ACyY1tLHsktiE z&b+RVqx%=LODR9jiP201g|k&M6HN`OrLMlYQnrxiaC6iAL51y@*tRrcOGNIlsyCU} zxp7uX^9}kJ7`Ed}>_{=VopB!9TGQpzCEQ7l0m|);Rn1xZsg3U$ByQ;?u0Je zo6C$ZvpvF)TlGelR!kzYkjf;l%NebS8{%ztm&oPBVy>!_RUVx_wQU#*I6!5Jqzn(OQ*-R!LKvI}1vXKbg=Xo~xs#wx^8 zo>n<>_-hHy0Cv*uAaMpbW*u^97jW;?WS(d)c(^+?ehvmu-O@y;tI@!o2UWj?S8f0g zXk5QuR{*IeHm5{58)}`x+HhlaUF;SKJ1t=JFw9COqd7e)oW7?xOhOdA726%+uBW9j z>{)o@J||JYBrss*7?x`<=)>UZE*=#Ys-l= zok-h>luCs41e!0X?UuC5r7cIhdLvtk;!c%%gY?RpM&3m_ANTYvi0om{+dZtBvZw`HJ+a&V*B`^ z3(Q||80?K!@-p#vh*o0fgw@ef&T#Qtn@4Bx#M=ukC|c1Y*7^A%?y*|iv>EqF`p1Yi zG=;GZ#&k79U9GNBVR!;Fr@mq*{>GZH;uiO{yrL5U>9gF@or>dq6VO3dK#mg4?8GuR*#`*^QqChmq zEunVeuNFpL%{C>0=}aK}{SR!7zfSSuPAZMnEvQC?)c-3FoTguj=UG*J&ZCU+NM4EO zSC^`^^j^~gMsK|K*2l1oY+qk9*XXAP`19~T)j__CjA8hHhW?5qzmJG-4B^>*7T?m; z-%EENknthg2$ulzVcX2C(C3Uhe7E`cn73NDq}|+WcVK1~zFXtv<3qp;@fCXH@nPM} ztPzxVyZ<(Gk9BL>Exm3I?Cw1?tJ4IZmzNLpF2Jk5_wVK9L%$2~9!r$V2ZJejXJ@tH z(RiE=d}5xGcV?E>;jsW7#HuU!T-`AKm6b{0^GBS<|Ne8q|D8vR^_#03T5D?8$XL0M zs7B2EmCZF9$8W~X;g;I*6N@GkO)8o^zIl6dQ)6Sx_}1p8@gizG9xjf<9ND^U9BZx7 zGg9g&miU@I=hvcYI$~2zQ62pl-sm9i6r2QRC@0}CYbM+_b7F5s0lLZ6ZjGbe8qsbI zpVY3w!_zhTLGBvo0qz>t3_HS z2R>m9OPgyIq|GDxkL=uK8EO7E)Kh8xgGdic^S`LxPSg1rY5qT`z*Nh+(aM;Y=Ktc( zxmMpaf0vqT^`4*Re*mPF=Km?k{{H-3mgTRVYo$Z9J=YqBqPhO>?A+xGdUW`c*5TbW z|6ORPf13Yo^_14(b31pX`TwTorup~od>e^f)|fPZA4r^&=0AVK+x{DkT@dV_{WjWz zcvN!5Q}vq-sQ#}TcKK{iQ@0tZ&Hc*_+T3HTa|~&iyWfDh%!e@t*^>W>oxTx9Qd?>M z2aUON0-t~fZkTK3ruiQ==2~L{Z(6zj&p@k%)+i``FxTpr z_7ug}!_F=k^q}z+Fz_1fd=gELnq%4Vm1jpQ)3NnWS^X#mskv64g;plSWv5+ZjYg%Z zbFFOp-T$SXYy-(%aXsK_ntipEyTIZ#FfGmhs~ga-z0>?hY5a3g>8LRmh%R`_z~$K+ zb}?aHoOY8n4Kj1l$S&~DdDj{OvJ?@ZyW~!Eq;B)6xHf&op04<@?uvJlBJW#HSNxV; z@pY#weok$e4`2P#nCmOd32d>Z1zOpL{~I?19`WUR1fSA^1JltlsDgOvHs03pbod7N z`8C?{zzuIRME3atQ`7wCuGjtjn(>sC_1~8Dw3T(#vgV_|Pth4Vw7|g7qGyhPZTRhJ z{#zk?jQ<~S&#mb8-b}&w{)}Bw?`u!|SZj^m7ZC{lrznQ(%8_!ZCiv_@QQ4Zp_9 znPXiFXO5hU{+wscMzRb^N}o3$4Q+)HYr*~9E>PH7d!+{p$ocw;5>|UI)}LvUGCs! zSUv0uv|#*P50{a7t~KM9H2>#8_V%9vg<4(LBgnO9Wzf=uFH-D%EP)@N^}TInA~?Q> z;69J4{rxwhs*_HK$c2%F6xEbB6LizH=_3 zrVBE)`Z9UM=B7Z4m6PWG3R{Eg`*X+wXQ$l^K|qL@>;LWbfk)_-Z?H|xkoGrg0UFPo z>;KjDkbtQB8G6_|qauF&KR0&8;uzLGh6ux;Gv+47bE&7J4*D_ar2FfA#po~$MvA{F zm1rou$C~CFkweYX0*~q;GR)tCLGYjRBPhRtfX3+fvfoz-cx4C7O7q|8pKFbsXJyVw z^S`qLeWV#ML{aP;OKlU6kY0eCTvPq^{B?NMG_se1mY z-AjEHH2;(D96@y*=u>*RWlpx54*E4I#j7i7mdL`JG`M{kt;V5!rtwCFrumL9UgF`m zFEu?Fbem2)G1@t$O#;v8M zKLz@GNW1M_1^T$B9N%tNlR&%ey$t$t(0IXB*MA!H3{Uxkpl5>y=<+rs=6lNPK;w;q zsJsf$D?#H04b5K$ns2Gog|x>2&4Xa5Q9A8j{Je|v9Dc1;EW@v@^3r%;$#eJ>UjO$T z+>yw8_|ae9!>@ZOmgCo2dujbWfoO(b4U49k@F(f-{glD-ixc?ACD8mp7CZcEVvIn_ zkDkJM5v(<%In-@dTmnDCQF>*w+d{e^^b52^VX`|iQ| zpBDMdBVC_BGtWPgr8vqQxENu^m@T*rTNM!JI%9q<0-tt7`T0>9$Hk+a_`De1xdU{; z9K5tbM19T;toJmK^^OtoYK=bJ`eUR%y5DX0PB2i;Il&+dC4HwL=Pc62@DFjfV22>* zAhz2HWV^2sF$tU{;!Uo%hzQqnL=3)nB%iMqGM`_bV10Cn@`s=wk%N?n>!(YS^?eA% z1=AdRsn;o?UjtI!Ss?X!i#XJ=&p!+V4_EG3=gm#}Zx6ByX5w8kBIE_cZoXVinlA_G zc7WPmpthGd9PJTd&s)S1&NiULcR*|VyzOGR)v+D4`@XbS2EKx;oSoeYu15cnp6$Gh zR4@y>d%{m_{{Rto^V<=m=}*!@_>J^fB51BHY_|+ZJ*N^8{N+SUH#3QOm_v#E;a?*7 zDu_d|Pcd;A=1d|MjWs~ZTT2>mV(P<f z>8Ax>Ai^(P3)vpyk9u_yha$d+gT&v^Px~9?=cJte_UAhF1=|D<3mzpR&K3Mi zWWNyi3BD*e%yjbS3v!($Uqmq5a%isi%%3AzD|n~iR|S74_=@2Bg8kA^ALHXH!L5Qv z1YZ*L_j35g5fRt??l*D2;Bmpf3$6<|<#!5xTkw=%L2svguHXj2U4rdI#M? zA4x>qEf?G&_$9&T1ph1u_bMNjU5HUW1SzL-B8IBsOVStunjS_h#g~1A=1T1=aYCK^ zS4;i^!6kyL1S<^EalJwe6!0QuZai#SMdv|y>=bir!` zKPgxz*ebY7@Ge1qA%k+iCirc^9|@im|dbUeNnJSke@fH5B_PPky{3l9w^AqhomP7E*4xZSS=V9yk78j z!GnSi2|g~!Z(~yK&jnu;>=ArhkX!zcFUWbFdI^paoG4f>xIl2V;0D1KL2m6sIo#EU zc)y@tKR|y==pPC`FL+9jd#kYCdxCnM0nP84F@Lb&#e!1=xjzZZ7YXY12=qpww+Y@X zc(-7?;3In@VkP~3ce`VE%>G&H}7M; ze+#DbegSm8;3&ayf|CTN3oZ~`CDzlT<}+dFAKgdXz;!S z`UM2B>8Yl%3#rE8f|m$R5nLd+Qt*W=hyP8%zY6|C(83p4*-p0LV8MxkmkZ7jtPor& zSR)t~+#$F}@PJ@M@DahIg2x3<3Z4=?EBKBeKjc%-px|J^5rSg{%LHc%a${fCTO)X* z;GKf^2;MLFRl#ox{#5W)K@*RXD39M#BbE!!7F;g)DZvK8&k24-@Dai92!3Di$AYgA zM`OD$q5n*rfG;cy{h`nXZdA2jh$y#(&KG)!&=(6`Bs6z6V76E z|0MKZg~o4|>2@=79n2%bo&upq3w?>uml2`w2Ek@2-ywLj;O7J%AcFsh(2ol~CHN!3 z6M`=i!T+}4KLq>sL;hH$h7zIQ#ex$BrwYyzyhgB^hq7rk=y!$Y2QtbtiIea-L~yX=4;6Z>(8WSeBSNo@#8Skyl($Iv zPRZXb`FkY)9>E7C|4TwYPK3PI1pg}KeFq>P`h|!nFA|(2I8|^45&C~haD!m8;7-9i z1P=;+S@1Ez?+N}y@Xvzp3VtZq8_%BDUO&N6f|m-;5WGfkwcvWeCczs7Zx_5z@XLbV z7kpOmmx8AR&j`LP_@Q86prhX~!7+j*f}aqaBemoCrJGg#Mh+ zM}>Y?=zj{`7th+rKV9&8BHFn{@Gi+eB=lE^(C1O1zaw}|@TY>m5LqQAA&Z%FPV7_3X;3UBrf(r%L2-XX35xhxopWtD^uM2)h@VKBg z#A!d1SPVZ2J%ot<9WL~Ep(hGGP3S9yUMTbup{oU(1#coE9wJ1@{hHvniD>sZ`6QAz6q`UTR^;{)N>&jX=HA)lL}d@K=q%;R$^v|CGr z-ER=l4*#z~`P|u=a?AMK1M;|IG3^NifT*uF)o!W|Z&yXmYr9qJ*5S)1sz|@OUDQ z$`c;fa`$Th|GC2W`o%{!pkHj4kp9R(ndDe>dc#TjlHVTbehAoAA|v^^RO8 zc=VSTbX|vD--K@@;$8Px2X1JsYO47UREdA5|3c~{aII@@mMD(Ba_`Zmp|LvpYA^#F z9#cil+c#;{AzyT<8c~CbGXRQ8%G^|$8c|ggrAnr_`BTUrrAj8d`IE^XrAj7|4Ofw? z$tYD)N@iT8RFhGvWTLJ+(Jj?vl)|0`tUJLi)#Lv%T_&K*_gnDw_T;avcHVKCf;{R&J}e>X>yEteE~I(P#>ss0 z@Nnflj0~^5x@zbB5z3=EuDlPietGq)K-qIR-NTjlOYnK+ZG*fJm?*CoPFLRFL>@pN z{J&XH(gar?|38GHs2%)&8ttGg9xmTk652h4c6krLcJU}S+U`G*hKOi?aJ@bb+C5x( z|AP##9UYKYh&;-pp5&t*=WtS{!x^+v#7Uj1yyd!HF{xbi~a^Xm6LVteIBu!u$PyWA`=pJjb&@N8*aLcm6=k?z?=of*`w6_o^b)a56-8x9B1~`74tE{K& zNicc&K9A3>gNCw(bGT(4NO;@bSC6rUfy;LBu_W3q=S8;;C495oc~^{S9&Q;w_ju)X z;saC|d6b8bHBot&A&+&6aq{@abnx|c(!8>a=iP!XU;a|Ovw}SLaQXNi7Srx=9r(P5 zTgG(-?h3nQ{fPL&qe3QpJsMPM@QSatH-@jd~!jTxxc+fl}An+5uA3U+rKt)+Se92-FsjA86zC& zR_gOTW7XcCOcm+=_xbaG#82CHry-3s#~%po?J|q^cBzU;w=b;xx!_Azk<$S?a@r2> z?Fm%u?Fr({!&!hcgmVN=%2~7)I;o0oJR%%qh7b2BwW1rtcM$Ut>Tga57K9J#d<@O> zUh3c*tj9Wd!?fqU^XKQJ?|4C-NVje8?MVZj4chfrF7g7XLz{y@6aLBr7T^rw9D%bJ z{n)nG(!OeQe1%vWWR}xcOS{Lz*0F2%cA?+8&5j6t_a?R<)wcI)i<~YfKcM-BYTq63 z`0nN&_pXUDIzbbdv5H}aLX ze^obz3`E}BlMXwn@72QdGI$L3CGj`pMUO91^+%6_@a z>6aP^8SD1VW5Kp_^Txf=_tgbmWsA`_Ya^%q=o9u&(B9jXi+Hpu+RreC{jiUE6&QPa z+7$W%el>ygIong{2l|0J&nb6&+yq;4p{HS&ci|UPyEkLkT*ONE0Bz%aJ%`YSjksqW zeA@wW6z;~l`?9VBzA@x0XS*xAE8+X217A5^ZXE9MLDoW)p|87Vpe<9a(qj_y=4B6{ zy~Vo!bi8!ssbBOQLL1c4SB(CJo_T0jg`h8NV%u!@^!f8Y(|VMn&%*n(O@6UQg?IO4 zAiikV9FG61d;8BXTVQL4G%W zYi?}sF)BFD+s`Qb5cEV`?qff$>YfK*T?Ky|8LPVI;G^OpjCCLT8SS^hXPCRRUWV$2 zv`YV)4`ZO>$K5LXzB5BYy}OL!NOw-(8&9k3Th8R6Zel&3r=ITu^=6}e{IG@-(<;(! zti7#^b3EqrE{>sJXPVvX)b#EH>c-BY{>bTn4nf}{e;+3AeTM4fx?_Zwb{;Cnm_a_u zx>PuV&G;jyIpH+M`ho8hBhhVz#04sL??L+ zyt0$y%RcQ>Z3rFp=1l5KKMvL7?XS zm7bd}%Iwb1nc2NBdspYMfmk2M`MU$iztLB9TA@D-e|cxrM%b$0FV@%NQ&FB1gCWdo zcALy=3?LjGM|!n|bEW%&Ueo6O^QR%>tWK@1Es zu{PtDcaZAUyZd~fg{*g$J|Pa#>$dtC%gD!axCFoSvK+D2nM0ls(sgQi&O&?>26O=V zx~|r-WB=-!wN8tUzA=s;Zzm{vxa>lE~?sD{_`a0u<^RW?u{_qLcV#cr^ zbGGVmeDtvH=d@TqWA4iB*xTd8@Xcr3Sfj5GBHq|nL6pbE-E~gfS%@vSFR+fnOw60= z7H7`h+8Z%l(S3gB!frf!NT+{+FSF0J4Vb6#d2p@)9kHIB4usrs7Uq44Gv9thKcL@q zKXCoV=iWi+mp6^ztzEeHd((-9eOQAky61&EbI7A?_z!a()`!y%c-B1jmxcD&SMOj< zu%F1!zWOWX9=ESx+#vK<_glzge__3T6Jt*w9gmIre>ASzJ|eDImKawHE)ZA9kBcj3 z{)8_O`|J-}#)q@s?Ct@5)`>xPu8rsATI2ZExkpJ=&;4z3%HcgY)^vgmSEcv`b8_Ws zu0@13I=PzArjr%8>ccBGgd9UHCal%Tm4r5(T!gDWycO^<5fzpYxc=bQTC?Edaup-p zfYVgjckgUxY9CI1H?W6|y0iTuq&jdy#%ln&3k6T_Y(Iz8`%VF_`f!Es0L5aT zy55Yj;WLnPxNQ4CQoNy79054OoKG1bT`nZOe%+(}nk0){9=|>b5@LCO*Ptt;6dTf9 z+OH4jaH62j$uQ`a3ac%0~}#V7El#(LD<+%Ao~M)8oK}HJFSdGo<3X+NZ2?fmS^I2 zCPfU93o{&w77_Si8$O>67^^F!^m(DKu$bV8O)?)P(v?ecqg+WoFGJA|ocPh)Hlv-X z2u@gOzX*H_r&GdIg=3~oT&uNQyc@6&r^Ce5S)8m+dNmhs(#Z8k{K0CDM2( zL0uwFlKPx-lI#w4GZ>Je4_6L5jK%1*#3I&s8mEpFCO*K4_5z8Fq&<;R2+~x4Gb-Bu zw-_0aP?)e14LcH<;>{Kc2rbcq3pcfhs&Q}_YFVs$%E@D@=2}d6M<mf<+VhYo#7ScSbgRy1VyTnw3U+FiR=Q zlE2+jG#5%L45Qj^oCw3bk0?x06P0wMFo{k@-Nh01160OIS=nt_1WQsI@pTqzSHs#Yv`9Q_eX~Uob^MpuV@W zov9HxVUQ~?b(aODnlP?$>fovmS6RmPOq>^(S3P5@PIv#(2EY*~=}3wN328^xB7zfG zt78>br>annOgMz#R9G3SKm+yRYD;1%PTW)wp3}({1lDCgEopbFI~0oa;Yug~Mdciy zF?AfL9t=#ph7%4egS4sI$cl2nOecvleYmnlfO00-<*ZPlxsq;iW`e5@XUZUt6{ZOC zQ>aD3SXpV*At#AUeYjf0xU{Pst|V8-xU_#At|b4G>n)s)cbNLXp%8dX1+)qkNa@2> zp%c_QI5B2)J}zz%{o~9$Nsb{aBmMsjO~(oJ2M^bEA2T#PuHy`Gft&mba~avj$gCX8 zpJflo&&oEI4ZzCEfA0E6D1X)!85wvuVfImT@R`sWr6H|9z@K$l2LBD!E64C>Wn?%6 zz7ONinv+AK4ApuY2CJnH1wX%9ltGCZ8CM_~j8+4Y8LgJVYFSbFAo>h2v~(oxe#U5g zV#SxbDYb7A6z`i>o_BD@K&?#1=z-HvoMS0po|8eg+#<9Ig-|*tCj=?|Qq-H1!;94fFfV^ziq$Q^XsE<xF{>7KY2Wwljr4}u{m>w=cvzM?26Z}y>HO{g6-WdaFcu~v@$M54s;S4HV zY^j1w)+{M9HfO~;$gy}rPPES_rZ9%4lzQ?h2j3KRRGI8`)U<(g)f5`AYydh+t6!Fh z_+dma)>Iop-2~zat@&?g_jc@Ik~j)+`mhBa;@>nU63TG#{~ecrkv0#|8#Rq}hMzNI zFVp1RYcH-twy)U;?8)L7QtVE6|Ed--}(bov)?$x<2R z$O`l_sYmdCkhcAH=Cwdd^Jl9}F2sLey00&DH`4DionvM`hI9z0A78)B;OjRvkdn*wLE`YK%2WxfnTD>qzazK*n3ZiFxM9MTl-A8BU(8@Pw*QGv{9sHgKs=c(Xi5Vn6n zW&rpA846S%+n<-23z}_W-;Kv2u) z0m*MfTaUBu0Q`h;Z&FX*i5Bx7MOG#Sf0KoI84x!_m;RHb6F~B3YONd}7J`$|f3LJb8&7}1=h61#|vYApBJ&0?s$y76&b~%?_XgT{lF3P+WSBpjk`CeD3 zm!0`_Ao+VC%D?HR`EXR$^n`TDO!AL&@=)Uj{_NbXZ&b?VONAl9+qkiP+`V?o!A z#zMD_g@2(?$3hnc=gozsIu^Rwdfs&)bu2g}JBi<`w={EnX!In6#+?wy-rb5Te>gEd zG#Cg^gG0y23rOT|gIp&fmhg8P2R#IuV_?uRB&IUKm;Z{!><*1?4P{o>}vyEZe%~OmIA#C^(7F?+0mQ42IXY2@3W?<2k3p@&1*7fG)$IF?7w0sRe!9ux#U60)9j zXnq%Wlz;yrV+!dt#y_(VGns@K>hELf1OkQY0$?>uh!*- zov1Vd=P2L)ynmyvwcX%%e^udpXxkwLyIA3X)8H>4;Ca&bIvyxI4kk_wqfDsQ{!H7kS|aO3Ohwup< zb@_A>`;0@g1+xa}!WiuYGc)jG^Az(tM-1l#E#`OsnV6#8(A3&bwTj7IbZULyI1@m>5+RF9HVr2lBt zbJU;%-y->zCP)7hX+22J>efat#~{|~{aMpv@_RdR3$G~aoRM*{v1&B3ij4`lszS!B zjdS#MsAu4`{%y3NnbCJK?a;JY6~ea;=OZqs<r-I9qivbF!@9 zB&bRb!CyykrjI7G6DD_{LiYcn?pxraD$c&o?%7Q?7uW@YAVgRoKtu@Pj*1!}Xn>#r z5%DdU1PH=wfRqG_iW)8=B1llQR-| zM%EzmDI(|WN8}_UX|Q|<)1T@Ipt`#cj`yP{N>oo+swdPe5=C|nLU6Jlv&c*}i*Qm< zvq+CU5Ql@;nHPA{wt5{wi$Zw=5p^s%fU&8}8vO~fg5y+|$ecgU&+NWxY8>b93SIj8 zX@GHlPS5?+D7sJ;=%+@|MNWSPc%iEXeqkw*os-L&gmF1;BnS8V;KKu>i*m8)v{ z-w0Y&Rj#V)zZH|L;MoVL#8$!@#w9g|az^xf=Bg{T%fJ=_6JtxIoo5@LJGH z$!ip?j7!BJ)Cw;4XXx==2%0t;;IZj;%q&?byR8sp?i8JKfu{oYkqG*|A*DM0G5#JQ3ZGY;~0QIQ`=i zvM2ldq)MfSWv1RBou3VH&UE7p#$N>>`c9`G9)~Q|4|h8K@H^0|AMW&D4@>qx3sO}- z+^PCuU@2&2**eFvJ3%}1Tgc8#MB zPFl)0_X9TSIe&k=(Bw4eIX^Eu)Fn6NIZKb`D_*V<8{Fsbp8-u(wt?qIdQ91duJ+Rlt(i+jwWu( zQa~D4Z~s?Zef;-*NX&_Qt@eM`!z{i%bDSH-xl7_Zyl_the@XCjwy=E3;>zp2E}7g6 zhehL?@I)apRu(%wED9=rHKu@MSy?9|>M- z(Z^85^5s-qvzO1GUx8Bev8LQWE}Xx#MzxF#N*(0~uoPB-%MZA1tE39Bwu&fUWTQvI znVL#o2m>k)Cd$#KI|yjun(I(xzIMC`iWXNSU0Kr8sQV=?Elqut$46R8Tzm3+U&r}i z^`aFu@Glnge8(b-moAQZzLTC)_R`;}GEG^>Opx}QN&NcKv6nX$J=8h_z9lQ;bYB4{ zW)-mygLQM1t>9@ajyKK?o>E$Mu30fV+FAq~Rx1Z%a5x1gNNO-y?0?5YAU$lcZKaE= zEah_yUuMfuTdl`qDg0S3Us?g5k$MWjXfJg%a)g4Q-R}TetD%M zNy+CB5}#*A6t&{xS;tq_;wt69jKkiIC{0INbe=|?M`JjsKF6@C#sP<+AziBymcx;% z(ri;6 zPr6E;*O$~jzq&!yCsLl23p;f8T>s zLihFmg4j857WF^iUy4^M@W5A-Ow@c)#-?Wd#UB+@SK|D66{~FPm+tS{{hMHfdzM5a0VCinuQVRoP!-VRg0Gb zai`1q+DWHttw4Ojd<$3F^b}c6mshyY2ls+`P81h1@TcX()d|;$I%iSDF;ulF{!K4k zsfNb9MGOSB&#PT<5Y!=kYS1?oH)K9vEaMquz|+c1I%WA1?poIS-~i~%6npfVwVwsM zO@(`_V7FU>T_*?ALM!2L=4N=Bp&K8>ln0vqbS(tGJNAC~8yn8SoA^!v1d-em0E@U#MFGw=J96CHaOAWLvh+QINCjOi&woC zc*g3MavasI1;Qs(N>MOvTCnRS!L$-Mh=LcYv@e3)kp}Nvbx`_KrF5O6^k1p;9Z>qO zK6rI$rS5<0-mP8iODVA@xM z8A!A2*WvOg&3*-~dYxX1E{0z)NbXP+j4BsE_D8FxsFWP|3hJJ+2ECE7E;wK<{Ri1i ztEL1e!44=eW~~|r#VJ1wW={?l!-Lu%kqH+&58G@06g&%x2PZhLgx*Iww0+fvE?Qmo z#4D>XE-_HvusIZdu*y494!~p3ndv3U^H>2oZ3@1Ri!*RL`5z#^OM2)zwDyskFg!kS zhRRo{E|~V0TZ5T60-*L+H!A;F_N@U}ESCH^lHo5XfPyD(gr_Eqi@=)I!5$cy@X^*E zW{F_1hErY%2I2N7?N+wv!y6&O{uatyx~}#Fh6)Ozf!_&G)bDRx<2e*|1=N9>35lVx zm#9Gx(ZQ74gOQtqa3*R0{6^)%>iYoL~Ljr~)QP`(SSgQkH2 zk`D#;YF5vr)1;IM9YGztSH+C|Nq|nY?!NK3{RylBYu|O_-r#Wf{DSZZ+`wHD%=kRm z1N&*g$R#kYaxq5ZW)w4j_&POc&%lu~#okQorr3WAOnEst#J(7f!tCXw-Ho|G3~&N% zKaL^ZR@+(fX_Q23YlG+;+NajB#_d5k-TM3nM{LuP^M%0TFxyf zRRW`8GC&!$ZZ8FS&ky_J_@@Vh7Y947rL!%2uT$#HSSfvZ=HfA&9rZ?kSp17Fw%OM0 zade8cHjc&@C~%vN5qVoA1I8N;Ocf=6s??f)qn%S6nMyW=6P z9|<~aw)=&xrp-rw zsPxd6xVCrh@%W;h-pKz;Pd@*N*BkSDx_#-CzuS}l4lW<{M*i&{e!eB6H|DGNI3$5| zS5Llr%fZOsBXI)xXM6a=QXlUhJ7av^Ci?Ndvopre8=_wh%67&h**f9p{cC4j&5jcO ze3d`ax=8YQze|5suSk8okL+yqv@S$CH{KI=#`xHzDCa(~GsedoBG1VmY+Wn$bL4c! z`0N!&ceDH=zgFc(`{;j`Pq5SoKQBD!mtezz)MS7-UcL5 z-it((KS+e!6T~S_`RrlN%gWj3IuG(GpD%n-KIa(9XMeV;2mf`JP|jHATY&6*5G*$t ze=QIP;~!8Wl$k?BJ18f6jMIc^ibWh@7N-1jMcR{>pq ztw%5U(;t;Z$p?E-RqCxa&DR^p8`GiBJ|g6PK}0$ArUlCJIAXa1B51xzNIiD}Th$wt zdM|CK-af*IaiKP?PhaPGO7>JK@6GS$*ujr+#v;V832qX6R*>@s^Oe6EAjg3p;|A~8 zDpY=DK>tSQQ-aDL4APbV7vKXJ4=ktrx?mjqjWlo|jw|9cL9T~F`a{99FiRf?6`@~lTzYHe?mEQ}b|5fOo=?>p`!Igq{ z3qD2cgBL&r`{4gf((?s(3I3PhM?{R1a3-*yv(A*iKaP6~^gzzR4x-D|x}`9!N=K2{ zdaB^Vl%vuM1&ak|3ziEm6|5E9Aozgbqk>Nh{!s7@!FL1?3;tQ~Z-QS5s__cFxHt&g zF-&l*V4+~K;B3JKf>na61aBAID)^A#lY&1G{Ij6)pM-i-IKF|(e-e=AZ_;^0oG-=- zJzkJ6^fLb{B8;y5w1HkqI>)k>Oa4tluNHcf&~-wq;|%;egnm*``FBJ5OG3Xv1pRZN z-xK<`LaX&^p~v4z1O2vxIf6q3M+@@hKk^k5q4#`2zPUvD9>IqMpA`Io;Ex6Q_6+%d zFZhvQFyN&35xhijwqOMj^UE@!Zy@Ga*3ClSF7#%h`R)|+w+sEK&`${c1Ht{0{-)6H z2>olJn}p_j1l0R8q5mp0p7SWZ_+lybqn}&iMS^^9i!|>Ch`f&={-iQxaU(5ECn%<};Flz&3hpGz7zLhvFY&ST0C6Vk6B4LMgyeudDBgPZBjI&b1U zpHCWm=L${`oGLg|u$&0~TET6S{;<$b2tGqZJqHATBgprTnEsjIKLyixUPgLv!2!f5 z^b&d;5&9JfT`Y8o&~t=_Wm zG@@v9lS1Bq(cW2tn1U6JLr!5X5!We$1$k@8^E+>Sh+~O3PmL2SAVNr?U=b1XV6k8c z5%bqf!P!JqHb=0Gh~sa8;36W9t4hHtVifmvf-8yWpH+gjMA(0w;07Y>yh#wMS$;GM zRjPI&s%X_dv`6WOM5Q0vrR0NF@=>^6_;(V~t`~)ViHLR`6#88vD)~a_lSH(O_ou9% z_knCzzR)9yQP@G~GGZUpFSNQ2MZ0+4&GOrbXjhsIME~?9LjQe4=*^dn*$+o~9RNMk zdESJ6gNV@U=S1j(MGuu8-z1{`TSGw9+nMt=>YG692jx8u2-;XmpZ|`k*LYg5avsZS z*MWg%b>E&zF3n}Z+a&t+CgV*fRWQjq@vKGO1WGJlXFBCutx0c|*M1S&tIv5~$#I_G z{EOV?`thtnzX6t5M>m&Bp0-bfc6v}=W=dS6WSZ~6#l4oMN;ymBJ1_L<_qIw)@fzCF zWu<((sD>}~$qQ>7FUD(V?U_)$dX-o;C##L_QVe*HE#3!%^M`%A9l=+`+?T-;E6|#y zjj=~&=gqR@!X)40B*J+iu02CJuM8%ZZREA(?Ldws^-5rS)u~t364$1(OtZJ|Ie{Zz zy|#1!UA|oaQq`6VN|PkCdmb#2n+HYKM8PvP@d;FMS!=11$jxm9k3ic9bgZU3H%|z zcLAI-{EHq8_`D3K40p?#fv>u7&d?i9GitjGd&Y6vP}@jB4G^QYbHU{0%hXIj%{SEH zt6C#@1wfp7TwOHZIpD)7$lV5ycb*Aff)w&Fu-ryRo~vIG(s+*5o0hlUBX1n!6@ZEI z*fuS1o+HoIkLP37qua0LUG0i2W%kNjHRYDB>5mgjR{p2PK~<J7xGb0^&vgbZ65}Oez70PuDmAlGC{Tz zkXME{^~0s9EAJHIY#!87TM5QgqH*vla>3`ega6M`AIjpU+wnuh&3b1}aGq_m-cG{D zauv{<_3CykfV^DLdeidC!Dq^=ggkARE@0MnIp2}z>bFVsBM&z%Z;VIYDnlMF&s=%k zJ^F1+qFKY-rYr9$kq1!QxYWesfX_9}aZm(4_9ta=)AcR|pV^LgC&b19E@$0( zPePd4juObLr6Ad~yf46H$~$Jri-MPY)PrAvQ1&;iJ5< z2w-)`>HCnk9kkxGJkGPGep!%*%X($!9H7>ZZL@^I7ga9bEBZ?K`?0O4b~ z^$4bZ^asA139@N{nAWzS0{QFPK8;Xc& zKMT*Bv@BEJIp8z(J7CD;*wpgU9eJ*Pd~Qbl^mPLHxTSdH9WvyNM!uHU=*UxLxZ{d3 z!;BLMb?5ebkGx})=XdPKV@%5lq){HrL~mw&V5tPzx4D@^RaV2w1Be3jfQ3?>tQaHQy&5c{z9& zfMxZ@c5vhWIc9qgl{n8%*xrc!#aD|m zSVtY_%k)4M)&j4;y~!%Wdf0db#B^MPqz6%Md&xa57S_FnxiEupE$xdNKsWyN)TzDQ zqu*+Ysdk0tMn*o{yWx_ z_Cd#4Sg&1|ue5H5?+z=S^tR|W_&M0tQi-*_bw1>$$LRWI^0Qr9K8?0#&r@oR@GPtm zZgGul)B&DG*hJOCHMxCNOlLbwnqlMgKpo;`Sj)Q>{x51bG+Fhq)gH*Lg0F^>&C2%% z*Tcs!fO_||M6ixJzQ2WCu4){CzZRm=ds=cLw>D7^t?MB09*q9DF{5f@W4BwDHEu__ z^vH|`U%|SjjL16;k1mG}?9YhxoG}zFSD^=eRfN=9>@yqj zD$3)uS3S!}TQX~@M+x+Num#gbI{S0Gb!!VA^BoPLKJqcYFIFMYWwm~gr}*(ik2XJw zdK)PZhmISkT#SRGPCc_!JviT`N1)egYd!k&UR6Ks;>fLUu7hueZ3y=vgs|Q@{je}k z>w;qor-J&%tb?1I;9KKJO$lXO(VT_!P!)7W8_An0<)}YpVZ5bhM($}zjXLrwt^1U1 zSXYhsjL^uwt|?gGa+v-R5N`rfW&>%Ck*5Q-ul0Tn>;K35qhXr&cv5TPmtej70*;w0 znqeP|=Ubb$mpOh;?t`7#z98D<*Z{t1Fz#@?;LJe#uWRAD_Nrd2U$0jVB+c`mtgOgG zz0KtTr<0izkI&+zlG?N^W^F>i5}CdojBG=IU;?jsu%a}fUPVhz08XmtZ0yyh1!aL6 ziI6}OUQ-sRtSbnGDms(k$l`UG+O(`}P?Y7j@^=u&AwX^cV4D-&4sZ(3L`-eEFbST_ z(Fg+OenhVz96-S8!U5tzm0S|Q9K*-s;2@MBkOP@&Yb|p+Wo9A3Fb+>_MMq}wzFXOn zk$MEELE!Z*nn2j+q-J6`XCZ)rkd2@UdZp$df!fm;^+2i&b+zV9rrKprvK9pn@TyHW zA{UfnjS?Dd4g$D%!BDTFB}V{`QA-F;MY9MYC0wnWTA-q{3IVJZ3(N9xL%kDa^PD!h z*8{qC-3+xBD=R#V0E_5$sPtGvW>QRdWu8_&tVJ1CNYGr(MFUZU(=yc@cC{K?z_E_z zY!=&u_QaH!6|-j2_Gs~JM~d|ycL%<9cR;sE*HLEVX_1;2nyF3Oi3A6d4BsLZZDj%; zw%ID{3c^?wokeg8wCemUm&?tEx_k+PMo<9fxNPU3fX2Wvn8p7op_pl6c?VTtoDX1Z>Wdq21gSHPy0~-ZesHSx%ML zBONtUwNB_`t`I7Vg=WVV3q8wNEEFq)wq6($D>!lW%&57>rL$zFu|BAi&{wJpvbuiW z24G20wll|Vr&{u}zuOvjeNbn`Q$<>}7)t?I%{kyX`1ALGX9hyg==c>OEBFZue}Uar79N*Ms1J@0@ipyXtgFxpRU&>V;}?fQzd^hK*D%4! zb)izAs$lAND`gxQ<{~q2PRb>S&O+3_G{Co!gQ2wlK*~*!obrS}owy<8mv%-C@_Hbo zylq<tc<(OTQaWM!b?Gt-t#&pg0Cwo;!IS8e} zal1BypDZZiZ}vJXz!w3r8t8+7U?7Df;CVz-^D@~Mwa#bM>i7zoQe#Q^ST+wyDf6(y zfn3xq)~imv=#ajkme1I4TO3DRs7sYi2pV#p7XOqgLL}1XlR&@Uobdy zu8vGqTeL64yTT!5=lUW)2SE#m{$s2!LX}jNbH@21hd_Ldb@stY@twJ>I^;AMM?S~;Q#K)S_UbaGC z)A3g_)sgcJ%6YYWh|XmxDs5l36{L)m+pv2Bsp+Ru3Ek7b4Dqc^DwKZG3O(z_1ECk( zcqp`2$N!lbdex0bLO*ijSyl?~xwsyb|3E4s=d2rXkXa zHcUAayAxpZ|EM#eOUfW5ECO%(=P6v%aR#DkFQgJ8Y0rc%1*&F02h)R}-;||2pJ@fj zo5H7_RKqtpWjUfJ5%n($^2ks}(`fM6t9WX*q6ogZd}BQ0?5@6&6Dslqb8tr{7cX{X|5A}`L$?9o;oOxmiVtVI7lS;-+%aVCeh)|`@q9`=(@sUsxtxN!b3zT0 z9LL$Mdn0yfF4=>t!ey*JfyACyLK+p#rVg7BIScFHU5`B$5XHKT-$d%0_Ytvr z{Tg~TAY`uRB-y(X8CHo)^y*D7a_hyyHnKQ_DIy*7e=PPi9#@oF)kgaGI z(nAM)sti+lzs7<*eyre6Sccx{`Ilcp688=dbKESVawDd-uOk2kX?O`JOEs#Xc5g+=jch4G~zq;!1oOp^ym zmm{_0^2^QC%Sy&izhV;CLc?-lTn`AZ>MW`9EZoI(tYW0?FJyH^bv55ATCxyNZa{a#a4gDxqdxwRIh| zq1M$E%NJu!EWCuC88z8Yr=P#k~K-@>?qIBwOU*3R-H#Fz!m1R4l)yBDR{A zs*`W+EO1tO(xy^XtG9VXD#f7P>h-JZE6SH!OQ6ew^6Rnc6c(3S!Zq8lVpm*onp=w1 zEVHVvRf<(z%b0rKOEU|NjzWyfMj07;eKlz&nxk9EmW?PyliZZ@O1yT3rc|q?!L$(7 z!s?2zuc%l$zrq!*+UKUSe-w zLoC0(3XNNYB?FnD72ss&9vt&37SvQ$m%0;RDb@_b+B_7dmMMcJm_kdL<<;LI?y`8L zdI>nCgUKiLfV1j)SAcG2{Az7(DpuFS(so*ko2*_M)2T)qFjy;M?6HQ#Ed>`##w%>D z>{u$^y-S?xzE5h_?6jWm>v5zcw~x|HG2ZVcJ=N z$!A&R0tU=+9D!I*wCJ+Sqq%2C=U0|5y(TI%Lv+~iy!^aj(cH?)>y`|`5^$Uhq9aER z8$Nda!ZG>z6~o7j$sap^*s#$HM=zX@$h?vB%gaZVkIpZz7(V}OYy7!56RS7Iu$(la z6Cv(gD8HKkSL-wUzr75W zUbyMsUpj2gHoRB66gPL2FW5c()?jBl9gFL{e9IIpfMWl| z!rCl*Z&`!LabhqF>+V=nf_o?hRv9!x}i0xn>hJ;)!mDLGL2MxeFHIy0~U0!vyBvsurBO z10`~>#tn+#3EW0Ut=oK4{Av*`SNV-tM5}xH%PID8EO~XOZwhb<5$o6>#-=>T1+kj3 z;!z*0$mH|q_=3H33swgUHbQl%F=Y)3yay(<^C_0bYBZ!kU>zuTD9Zm<6O_F$tmz{tf$p8#r_!7S@uk1V?i-AnoEi){$M98QJ-Re8*+Q4*dIBC zz6lB%Z}p>j_JB3P zGwk_$)si>kU^=c%^=GW%wH1r&tPS>13zZGQYFm?o18>DzTUhgGN^l64Fyj(AIVo5I zjcZw9m7XZq^g>OIH?8rj#id*eKdn~p>cY{Z7tnF@zAt&*6Xd;uyw2&#r;pexCO_PDik1& z6~q%6i#`F_|9%`Eodx+A&5u8%*ndn%7g(5*EMDG`9wo?k(MXRMyhL!C;N^l>36=_0 z2v!Q-D7aeiHo?t;cMB>zp}rkLKO*=&!IuR03mz0aBzRo#?}9$s5%M|+o+;R0P_0M8 z_6c1ic)8%$1Q!T?UGQeXI|TWNk@Y+x_^jZof(HcE`X=D}K9Krd5eA-F=m4aBVSJ7%c2c&NodY2&o640V?_K65JuUTTrd*fc&2b&GoOy&lit~p9+31cuFvX z;~)9TfdX)d(CWAVeUZ?Y2wpB&DtN8nYQYVHb%NUkcL_c(xKHqa;O_+w3vxX>>h*jl!GB6Ry_K-OOd{k)gzhQWhsb$RaD?Dw!5Mzl&=(0kMQF7?1ms;M^jyhbBv>tY0}=YJ72G8Fu;4Bt<9MV~WYtt)}~zn9Phh-eqj#mpZq^m#&GEc6ti>5z)&k86a+G^)lEhO0s( ztA14H6Z9v~?`#)OokX4zsXxz`#3&KWIfA)F$R8}I_;FHF{1C44L92YoFD4&obsmNM z8lhJbA%C6F8;Gc9o6z?WQO|jtw;*>m5%TEmk9zX&N|xszxh(fI5&UsabmE^xRV{xLWh(p&lFOdA@Pg z?R1UnJSH@XVae_aQ_RBUcuMS!0k>SM$Ax-is0<~q-R8wulk|Z+`K!dY&8A8u-Hysj z_&q7V5#>V)IMl%Booc7P3dQ%JZGG)oo|lgSe|p=)IDT;GxZA38aPCE#-f$VCHeNq6 zj_FoyBLy|!FjE_kQ!iiC$x?gGx6$FNS|fQgfjFF9T{Pc%q~Y*(x0m`lbJIYikcWZg z&PJtXy>pOu5pT!}R9L<8`yC-zsz>>mv_0E$c{s_m`)yUTHZ*HyxoR=ymuoX%kf1s>ZiApkaw9Df<&Enn@8SDkXMI%>PJ1bygo)5 zM6Ic)Bo$@#rsX|@h>kOF1_snRDkPiE+Ol4>)qm!_Z~Wd$D7`? zJl=1a@-_{!tTHfB9==&{<1DA!xpr5n)_! zTg?X_NYr_g5J4AInSAGI!rA6++9_IHg2<>T1RuN&Mnk07jmMmtau%9xt&h^#)_=mGRi$8fu8J>cs+9q&S(jUuFiO% z4IZzJ;QJ?^RnU|Me%NR&bXXn2SYY2VKTxrgh>eJAPhzLwuL!{h|mvVAOa7uG+-Bm5r{tpd>COp z!bXHu2+I+!LwLnG+=zgmx@X*s$n^-fBdkCuMVOB;9bqcMWe67_Y_|}AlTP2=xdzAndiAXQi7EUx}~*p$6eIKblM!$kVc7`+lGHIa5~%s8qnDR_JPzj>eAFcoA8ozK;A6WJ@$ndV*5ISA ziTHS&{K4Q$)D~o`@ezV?bURX$$V=OYu@64oAG*D?tF9kWHK%Y*ddeYBGQNKMaO{gb z>ZbX$EF!ma_Br2YcSO7`z8vuJ893|Jb(^xZyusk(HBY1+z9+%Q`y!5^w(5Nvd>6FC z$3EW;zA{A4X-D2u;9K1eALT6v-%dobJo3=Axc;aH-&^40acA1a%eNkUTyNkk@U_+6 z+rW1YjM*D}raaTu$Wq7qY$WzaysdGNx({m~gKtn9d@SDue0+AV$Dgjx+m0;oy^c(; zZeG5D;A;_iY_FDQB9hg4jnDe^_%ri$oP4?aFn5EG^)l!@6OpXW$5(<+k3TbC$H{ly zKAeNWr~6mudE4;~@bNza-M`8BHiGXR@ag{5d?un=b?*NPe7b+ld>toW=Y2R&p)+*< z>O8N0oXhC~TK8`vK2)c!QTXAIwhPC&=GBNKb&XL6KHVS5_^tu(^Weizjpt;1*CL<) zL9ov_4wCVWK;B7_M}0LPqOP8d^IGaG2%@~U_;&2We=gwD^NW_J+e+m2oqhOPryV|) z?R)i2OIfr^l%|-gTS7qOR+X zfKQLpWPH5t3*jV=p{4AXjPC;E=YkI++vFRH{34M@`)PTI#*NcapesaPTYS9sT?0Nn zPPIJURy|H10^bAe@X_|X)_nnddi*7mR}a2lw!=qxydFLZK0Qv8$%8nHYm@77nv8Ee z_(pXmm#iI3@3;?hJ}M_aX%vZ*tH(hYd?UffaoQH&+2ETc@;Gm3 zd0xBle&|N<>EkFF-yrbSOTDZ+8Q*a5{TO`u_)W&gd#j`1)8k6>X*=rnUJt&kjM(`% z8Q&)GT?jrs4m6*)y_>X!+=?}2ZSmApULPXX|~13ulq zXnMl_4TA4;@ag_d#@8QwJu_qTn&$JicL?|M3$Nt@gup4~Z&g^GXH^#X=hHwCU+J4FSo&w)7@G+mqujcdW_cZb{ zQK{~?WPF>zHyC`(r@opGQCCmKHzQ0Id2R7MvJcO2z&8Z^rhaCdk)@tv+|mvo&oevs z;TaM5&Oy8_dAq>(TswS}w+(#%1wK9gbbGz_RzOU8GHh36LF>kn+p&Kr?m3qC#mv^*rc{l@Z-BYX>dXo|8QZD{JoIJYMdUIw2Y zf64gx45Sf!tdBgJ&uhQukQan7J^qsM)q(G9@KGN1)qIG$dNRHhVT#CWi|^5Wcs>R` zJ^r*jv(1$E1o$?z!^iRRUGO~$K0W@D$$K1p``h88ynDgd3_d;nv^=lECF9#-;aN2J`UBgt^PR|l419Y0X?aL?`;Fzt?87^L z;M3zJB>CR$UeUr(%2YC;Ryter6+hO%E>c}hDwmNHsDe$wSb@O9*ni4!K$N`^T-O!#EJeI`Q^ zKe10}Z(ZXh6Q{M=FXS^SpEjwu zc=CAD>`9H~GM|nmTxM#}o_Ss7)3M!%LUhKY!bxq9fEg19p8GW#jzMI zH98@VCFwA0#g)(saa=}q@k6H-SHc12a=G?wUpbex{kmP&q+QxtfutSkvbNEkE|0e} z<7PsAYf-mZ`~805%Ktb#i;w8~bsCo3zNG9$#5 zjqBjH%-}M%XA76HO@p{xhPc*Nak(hVb1Wrp2F0~CDiRJochDsnS8@3XRB4s(F=Sl6 z(O^VXo8$7mW{b--3b!t)GGz?3F6EA$xGYs$qB4>pW5z8L*CWZA=`tDWwrZ=(l(fMv zhao1u)h-8Rc*aL-l_|zEHe9B*$AzAZrWKBgS3qZ&r<~Y@V6rn#JcqY+yhe)WFf63a zn3&09g4Rq%UFO*)zPbcmhVQVJVl+566b!}NaVV}G8csrZd25x4O4sXSip!!xk zM#q6&bx$jv1O{ovW5{V&NE-~&sjb8-72LtlDqH$Jv0%wGE*4!&x;?4EzLK2^yDx%dnL)cmftfP$Cw$?S?26 zX_M6usgFue#R(1N;qjV^mrL$wNOD}Y;-M;@9&5#upk=Li5;Un5k0D2yrxk-Cq%}iZ zhK`fuG8*EvnG-WoG0*r;%-Ei_5_VghD6`X?=fiv!%AlWb^4TV7Zu}2~LGx%nO_N7& zI!&WqX1@pwD-rNL#RkB3CyKq=G#3eKfW`O;gH?1o_G;5ynV@nJz~yA%^>b`G-rdO} z@Qoq3DkuaLJ5lV_rVC_)a=2#2xMm4coLECIr$8&cSc;E@>0ts;prTi>(B5Z1mGB5o@FP3eR`MXk=J8-R<>jG`zO zf>2Hd)Pnt4;(kC8T}@`PwsL9!p8(?2AOptfjQ`l^&Y*it-kBf`e*ir)d{=bC`yXfd zhIJwT?2M~|S3+?1NO(5De;`2x@MFNtg6`j(a3+(ncDcVBBT-6Yq))upfxh%fz;x?J zP=Uh-dmfbdLi7p(wkI5L)(Q9m#8?F1t)Za$gUT)h6_|?MHY*rLQ7lQ{1rSR04+JpR zw?34qc(?h6^~&$NBb6(-tYXG!k-=kK$v9|*Si(OI92~g5aXw+87E(=U58`PrVVBhb zyf^sLiMjrDzKjZ~(!btkWh??wgy6r;7s%lH()`lYf4eV~u_he{8&vXd^krsDfEoGC zss9dNB;!rY8cKuBzO0P*G;yb|d&Xf+Z1H7h9M?ph58X>G0tk2ca;!|M9-4t&a0z3+ z4qS((5*6C7cASQ40`}4{w8OhC_hau1KZU(N{8Q}hFhBJRgim1~46DW6!=o^xriS?$ zUnsm3`?T;T?9;>i*e@f@rMoi24cK=G{{#Du;WJP}ILt-)BjIA~JB2H;?;PHQeV6cV z?6blLu{6s z!_Q+sCj1WeW5dU>KR4VdgwIyOL$E(TJQ@3OVZM}kL3lOx7lt3i{-W>?urCPz3j6Wl z&#<2m?tr(wCWdpdFAPt_ep2{q>@N;qkNqX#ZP*uucVj;}{0r=-gg?Z7YS@QvEe`j@ zep+}m_LqjIV}F?yydGVc8tA~K=jj$PFxlz)z=h%UV6ejXV($w-g1tZdJoa|@N7x6# z?_eJcw_u+V{v7+%a2kq-!acE1v(olJ-fj#%|4?5eUl`@(Cm_lI|2 zZ--yOJ`nyR_QCKM*r$ZMqG)P(IQF41Jtn1vmtmhC-hw@ru1mo<4*48SgQej-kXHCY z?0w;B9OB`tvA4s^u@8jTVjm3Oi+xI%Z$YJ6ojSh)^!+ll7$e2kU`FXOvcuW zyL<%STo&y;08w6KM2itoWfez>;@FPC-TN9uxu|>eK14Y5ohB42jxsjk4uqcp_S%toTprzw=t*EgNDI@(&DJ5bC^iq+R;7>SpaOh?A6hUI3fYFCrx zsIqRK!$?s@jv7UdIn}ZO82-+T{-;nz@2*gkjmcIGaaxkAMAlQ}=OMnp-iJET_D{0)O{0LZiROSH=Dzq!(V^@^&hWy@=@!nm=fdbL_qJ<+=9F?O}`jZvl)3$SDL zbhVDRnY^H4Az86FI;1YJ)T-rbC3lA@w!FK!)c(ZDB}J2F#4lp6)2=8kc9)u$G~92N z;x?*u(!>b~v(6o!EDQHk$+9RAclyZ$Cds0}Bw0$}#S;KYWhTv4Vw2`7$unmp6`MFq z$xNI@fw(74CNN1B1t!SSx5UZ1D3+hNpWJ-PPte6~zA{7W9*gBeeuBPn^OZr`D$fy- zuoGMn!&pVzEUK2aS(5Z;d@Zee&dpa#|7Cd*55 zyt*tz=wJ-sH$qLN9nsN?LJF|RSkshp(}Wa*bDy+@5sFV!zqdKvT) zH}%SdIq0~=In*O@4wavJWl3^z39}q|CGOgG&J~b$D?(o%dOrBy?`lY|>lgEvLLVy? zD{*OubpqXnz{^nSq}k}9OD~xee>oSIgQwJqi{Ss4IM+pSrPN;%?PY^0nQ;7Hk-XNV zna~yPj*^sgRBAK3ZG|yeCe?S+#3?1?r%rOmk7;pt6fLILnEzb1ycCW{==rA^A=W?UsD~s7*|*5x{p2gAn=W&$LaqTM^ni(r9-4r+;tc?B+8GALBn|v9QG_( zb{+gK&99F4edKMp5{IQP7cafW6si0gxxKWsQFCRxF3&BuR8hjeZfw(aKJHz9yWe>i*glWA785c zjO>96mNV?@r_etLypOz(LTUCcBz8}EJ;gq_bV@KY#eS~Snqc>J!600Dyt#C*KMQu% z_5Bj{bx8j_=$jtwWPgKhKBm}DLWnQLKGX@`M0PHnf`1HR{4Xp0ZiSx{F!hF;nNIZk z0WT?Zg5oHNqG|95^4!wnaV7ttYO=2j?bfXUV^_3kH9Ur-*!Q6#I)>4T9aR z>Ue^x^4Dkyo0hJLtMGG3=#t(=84gu-UISMpOCjzyk7AoU$MK;hLAx4!pDl@Rz{5%S z4te;#7tfa=QrO9!jn80Zqd%0F4I0m{t?$Rt-7K!d9@}~!Q|qf6+~_t@X&yap`VWRUF;Zni@yyZouvbmSMibcQtq z^f;FeTm3-upJiw3VtpmC5YUIOAKwZ%3Dm)d6}*0}4jFkCZ4I&L&w?B07$5#@pQtFy zisJuBpLMo%2mX}cRsi&2Rmz_^q^v!eYxNTvM=N{J=ae|QoAoI8xE(;Cf19AlXBze6Shw-d%u7W4 zW3!Kl%J&m7hTfEP0RH<^duvcn=d}*zt4*il-SC!3Bbw1eJdcNFdKh4v0R~GrQkNf zmjn+B@^54Ej})9ExK41l;Jbn+1#?19xnjW@!R>6N2=i#d3v$m4e#@UlKeln2EWI{38YD2(A;{E%>hB zNkJT@mLK!(AR^}362WVUm{+$8zD~qEdW4Ai@=VSA1c%i?P{{ytdOf!G)8NfG-w z>p%D*9K+4>59YbTK~!(~^Te+e(ow|npX01=O}>$&2RQ54k}j5VmkX8=bMTIh&?|}k zowZKM{{ZQM&KjnqUlzWf2)-lOAoz*kmx8I(ALX(H`v~R<^51agEB{l#tA*z4KTNL{ z?)}IULn7a&;tdP|0|@A5c*ufiv%YLP8FOkc%|T6!TEyp zvqwFa39b;lQIKnVGN0?_6E_RqE%+_L9fFStJ|XywApHTd{L6wr68x#)F9m-k_&dQy z!4CyL5&Vnb-vv(z^2IjRlOfniu$$mng8c-~791)#O7MKa@q(8KUMhH%;3C1Lg6jN^ z`fm`rR&c%GCPC%r3w-q7Kz+Y0_?X~c!F__t?-%$E2>rI;`+|QEJS=!rQ27NzxxWcb zzX+_)=Jf-xvtW0@UV=G-g9P&hM+>U!6O=C$db;3T!DWK01aBu|9#npYP;Q6Nk4ydw z#IrH43H=iy=Bu9z{W~Jcb1i>jh}SWgPrDIOE-E;Phlw*FC_gpMAZL#p+6G*I}v;-ynaId8N?{`Btp($NzWJh z0%9M$7AN%Ol7FSp3y6KO=C#mVLz8lE7WxiiKdgBz^h1*Wh|oV2#PqA|2QxZ$6wDOF zErd#kX%$9^AaVq83RLz*6BOnXVJ~$)0gfe&c8?P*AVx7x1dE7hXR)9~?yvm9=CuVJyZriAdit=xX z(^pe*|7*Ir6*%tA5_=(QuP42ltGC-uPi^N#IAb^&@6WYYZL1-HKZp|7nw0Zj7&u9V zdt0v=#iGl^hgus|nd<33o7!(kjI-TQnW%zRe>)^_=(Zs5Tsm$WYvnA+8w1-q70s`% z88%uubW?lm7UT^Z#XWX#^CrIEG&|;)k#q$ICisF|kf$8N4O1TButVxFwRgpXe^}ly zIFc)`D4(~ubj8wdEMAKDGOMcaZe_lzK<#KkuL^;;RMVj7l>QEbQ&G9VP zxu;{oNbZa+An}KQUcLhf_#Q-Bnvp(ort_TcLZne2$_pVZLx4Qj7Z(YpYn^qyyk|A# z&4IiK(kPG3(ei$af~I~U5T?Dfy!XIo%BzGt)=PPKeB{det|QOYZ>;D?9&TFR!yb7x zhJLI^>!*EU;gU#g1&~)Fae|ijEu@?Jtuy3h2p{$3_c8dn`qB3`)5*h4%PaTD+h)k? zAbc#hz+*r9R4$|-*|fYePkVP7@;H{rM|r%rG4(qn`jLm5mPdaHW_zDE?hKStN`_>91mcg)a_A6001 zPkQvLNuu9l9{o-l`r#7PmB)K_Q@`z?sW*AJY5l(Lkr%ikcKqTJ)|K}i6o5Rpf9by? zk^OiNXSO#B^0fVM3GB+_y`ZVz0nv{<+_ZkzdgNsr`t=b$${z$_rhe~29`6(MrsYK) zKDXbFNxl7qQSN+DBA+1dEy7)<6yYR1--Fe(mzGSls6K5IhqMbK5k{g=TMkiz{lrn zdehN4;4|BM=qi*26Wco!f%4d1^6N5)T4P2!&;J0*=s44VI|`q{=#zxOmkB1b z-f{nd^BeeBFI08wZ86FqYCVLT)1$dsJ zCvnMRepe4)DQ=EuAx&@OVVI5`QE%VlO|-G;ysse*W3NhQkO6wr|l}A$) z7W?$FAs=l!IIZcWSK+r1z8S6cY0am$T-KaAr>H4o&yElAw7sRy+6=#c+gc*eQ)^D|_!~Sv$X%BCiL&~4x zww6xdAL_F<1|nOUtUg;m^nbd#f&H-$P3QB=0KzfQIY2&F+=jr9=J+2b$IEV{qidZ1 z*pXI*V~hWL^4RggpJ4A4>nL@hZs2Tw)Mur4Qho;4wbX^3c6C6TEo(~yo>;fkqOH`` zY^x7#SM5c4{HKu4cArF9rgxIEKL6$;EO&&q5<7iI`L~SO`w{UW37a>4dfCfIAXDi^ z+nzDbYR)RFgO2sh#n59Xkp$eer_Z7abkDemKJ6qg{{W#oN`2ZfhyF?oxd+1vU+_Zs=e~-o_ha zZwEj1?Z*gsTczQ7So(qbZLs&-Ey3v9ErI-vO1FUZ+m_xVt>$3lw=D;ugKcg8NcWu; z-P~fs1}_=9af}w0#l|U)?;ZvIdsQ9yZvbQ1v047mS3g*kv%V!0HlmCW^xulM97g+f zpB#c*T^H?C89-Yj>oJD5wPeG7#rbuxbzRE{<;Sw5xdCn9xY-3695?--H)UxXZZq`k z>KQlP+88&lUx0CgzMpOAR^rhug1(0n(PmuhZDifO23XCVtj>-1K_|As9N&1iLFxIf z==lrCH}yPW==t$ir;eKQ$tPc(QpdSDzE407$70{Hv9WO2qn}rYx9AE3wxYeM+dwI+ zZDs24Gw5(c>R5bXtd5iI)bUrT<9(@PiImlK>_>Th96#e}=W_|#c^~G^eL$arFCBh-8n~4w|ikP&R4X(uBX9M59cY4yZ11^(+1sT+|A+`gPa3V9FGyq12|R! z(KSsxUU=@=X{~N5iEM7N@;A49c~NX0({t~OsFU)}y(oTc?lg2QgsyHo>*|{eK-Z$q zGoa5|KC8#dD$X~*Mt#ot%7PxdkROb`)e?Ygtbfy-8L{k?=xWTfC5`YIKB!3Q9c=W= zSWlakol$-`<^bB*_drooAJnbRi>NmfGHAb^nD4dSP8xG#m3l!qcFyRYV0;|J{L1!! zY|O9w3>mC9eS1-pZL}G_+toRGWf|HS;dy#`^CX*T?_u67X+9V62GMOgjyHc@y{q4+ zrOx;XmTYMVMxC*vc}dSOj&0ZGuqE3`JCkSs7|hdU2U~Wd4&82-7q&+nHlNkJF1oEH z6PJ*w`SqCB-%@&p^DWyCAIjwc>;5W~XWM@Pd0I}{(AfAcur0Trhe(?P=!;#bLtmd{ zMk#N4V>!nG(k;}}5%!o1Islq|<%_It3Pjc+9=mqoIiGF1&6sD78FfF7YYjc-U-Qhh z_%A#C2yDW090q^7I@cn8xKo|FKKqcmqVD?0R`5)3wxU~+KBEhsQ}x&{_1+}MCeNqO z8}&9DZH9Ag%)#4Q{)l;-ZS&zg96|9{axF-KdWpT#@wvt0kEyFY;ALD74pm0H>8yP_QRB#+Zt`8`AcqVC@k6B5@b5c z;lIuM>2n;nvgs!<9{twZ2CHmi1I`o89G7X<`i3I(i;b}zz_s4Hw2z#>sXMO+cphh) zf*6lHM*MZRH>FxvHU9b3sq@_9AMGfNK8W_NX=2-WoUl#)$l8YV=<0@NqHj0)bL$(2 z;~K#qS>0e`obX!uJlNw?*p6fKN@IMOb7CIGhd!@%Gv*MUYp56X+~bFDbi^q~&(WXD z99=K+C&}EQ&sCdHUiVMRKTjRSeARqCY|Alr0DY8;>w^;5vVWkyF<`ycascVUl6~r0 zXt1^3xz3B!H|jZ=^KptXALoLHb8#>~cHY1{kLnz~U37X(+N^cjVCd9%(m8M7+Ol~9 z=4@VDn&XSduhySB_|C8AeM?Jm)VYS@Ibj#Cuh54U`he$$2<)!yb3*KsExKIcIWL3^ z`L95ilQMsPY0RI;jQKMQ^X3;Kt3|GL)io^S=zdb;2XpK~A6@l1bH*F6c_!i7IlY&_Z_)TB<~l7ElbQwaJiA+t{$jKVVm0|EH8}Y+5AO>rtE=g0Nq- z%sJj>Ll)<}T)93kmwB)d^7I%jfPLBL-OIMNM4}frMPN@GuC&zs3&wy2S#P1;r13mB zo%Fz}jZFi}e%3Ou4r9A&a|H#TKD?Hb{^_FZYzvF9JS*O6oA zb@b7hm?J)gj)xKI5w;;@BJlHwV|d@T0l`=Q{STjy{JK%uaT(7Syg!`YxC7;R4a@!; zFXw^r(og0!Y$n>n^P6-2p4Ciy1nc&-Z2rfo^l=yyyiTZ*V>^Vlti)Wywv7W{4X&ki zobzr?q_$-x0>>`OAnx!M7`z2_lv&@Lf^$KQb$iQ71U^I2_QHQTm@95;N=PTowuOAv4N7T!Ae^C>4;g}udIcKf{uRfkBoAu{LowklbUpJu6cM-ND z)FJR)=^_O7!IPMy4&b_}P+ePL-i+Y-B7%8O+DcoP$As!PwDl0mJcY6)o^q_8WgI)> zo+yfQU!<-jlE22iCsOA>)L})|G~`-qnsRb1w_os{sX7<)+Kp{}LFQ0>F6K3=ZtGWH zo;vy_+QB&h=cDF}FcwRqn{kbZYXg+E@-g13L>J8QoWnl*@>GujcqYN|&hfAZ*N$(Z zF52vBW4<=;Q9r~r=@IZBLf~}~d9O3BU(M^H5jf`G2j4-_KWNC@2i;Zw;Mxf9Eh-%- zllKvnImVFrslodOc=`T1-(}y2umNEeg6_itzjJ)>I>SQ0;|Ojk?E6|vLEqJw8+i@s zT>I@pU+{ip0M3z|2cvxK9C;7dpVOQ1S4a=5ZhZsK=hS6|%xNL?leRtkmE%&|pY>$b zuWL%nuWwApaTbgo#BxK8ZQ7A?_LSg02R5bIP+7sh{Alk{fD;39CK|bbtTpwEb6LFp_Xv)rir^U*Dy~P*B{X+h| z4S(bF>d2Iafpuj~1Ho5_{<;sgU|%he^S+*s*Ws8pkL8uZ7eqZ3!W$~v+@jC3`WV*t zn&~*csMp!4C5?D*x(CNwf!}G*-!Nwvc7ChnR>l%^{O1p)ZN0a34Nzp3#hP-zgy1xP6eGjeCcZ+RaTxGN*(v z#`z313+<*JyymzF{g;LF6Yotj>-fwE{bpU&9K>;!QfGDHJqmeQ*I^&;k4y0P{o)iHs&g#BdW+05R*pK|ZX z1{%EPJsEj*aiFXm>+J8|NA`h189R!&GqYG`}*b`DE}hLa{MQ2+tboE z&cy+gQR4~iBR}3jNH4M;#2iu3#CGyoex$ax3Ev4E<^Kij&ohm=bDN>h7TDzfaQ8mo zQB~L4_&IaVBs0m$FbN?9j5~o+1EIaE#a><*_KvoWJhM$nv;+GD{k8GW{3~qf7cPXY z<6be_@Vmg?&cQ$%@STO&AM(!mD`a&+Z<763dt=+f%uAFx`=tkK4V69TDz$Av8+9dQ zLOuI7WVRV|b8E)Dyxy;yZPYQC)4rj9KGxXhb)!!pvwXm66Uo_u=)+tJ4U7TbE&jxOZBWB+ZoHHl*<)Xw)fQ%gSFH@O@0i`~^% z1s?$?^ax4#ffy6ruz9GjTKojAp&x~=SZ{ZOm(>V!5aI|f!co}Sg9xO#N9fGx-y1i3 zQByEJUF)fXtc$egfwt%&;NvGxayFOeNz7~GrI z@^*AqKYl~=ReRX&kl&2{BFN8;4}<(Zc3?y?_>TYJ5OEuEHDqtcyY^FFHPA=uOAY$y zyU_0=kP*kqE?+jgEn|naf!AN){T962h@gF)09=f40y3p+>HqIR&^fIe@M?rwgldGf z1<(wH7ffL z_pyfW@^x|W6|^O0p5KnVL3>Eqy<$=KD7$3;_u=c`rIcCO-j2SI=dy_yMHqJ;6cn6e->JJkG0zu2eZ$5(Kk5nz!>FT z5P4RgdoSi^jll^z0jB9=Dz(nwMgz^S2Crcw4!xcTd9j`_)(IBmnFBddj^{wn za{)Uj6GlwEk0h`T20Rk5Q`rj}*?TAoeLn)*LRsh@)=2az>23qBlWCih_x0&oRrMyg zS7qclvmZ>oY87I>i?*OnvnLAYYZ84B^2qv57FyEJR^c9uyZf+a>^;OXCNFcO4i9xl%7^YsZPLybtRijt9=IyI~iS{Xd2M-{4FaA-=^!D9<$t=bp1JwxqoJ@9ZD#o3H%^`(2n9zlvCWSoO~x^cAiheA{Yz z?GX2??WWg$o@34WDZWYkCDUx2Td#$#=HZN*^-y0uUze@qqlZ?*2amTudZ@VRQP|Z- z4{;1>y)s5o=Guhu2a4dwKLQ@;Q)K!{x#&Oc7j5w81@I*Pr-OOm5!k0L1ldob|CNBg zLax&)KXVBCM+fo}_xIH%A3v0YKga#w)!37WK=*hK9>o~oo>CnA>0AI(vhLjB@4vn2 z`%fynErC6=Ch)rl1!yzZA#grgfl!-(?TSAvdo|~jV_YYC-wgXW-x24&4*Uf44|V*$ z1Ki&k1bMvQ{toW+2!G>z{{EW5Uul59iQumn{6ze`a|3?y@xcBR+phhQ^!sB7e8UQq z=bW(%fp;4$tlOZQ`)%vBpJSiqr$7Ar$yY;74;)Z|cs;lz@z9;Rz@CDzt2l);oAJ^0Lh5jD!YlHre^dofWuYW%I zHvJa*wA9T>0Uz>sfNrqu6a2Pc4PAT->g+fj}O(r~PB`driA?FZRc_ZO*p1=HeLp4#o!O^YsWd2on)p1Uvq* zKKQQK>rM850S1<`xpqA6{NU~c?pY46feZ*w1e|X=@&BAsQa8t=m+3@2usSJrp6$B zf?ILFhkhjcpM9kHyOGXwzaLqATFx zdbF(=w2n`LZ-%;Ar_RMk0`!>w2FNu?ry@Y71$25r=R;ZOaDJiQs{O;a1S#9qihhZ< zZ`l9Pm3VJ`^APvcDhGY{cjQI+V84>D;Jivc))ZU)3G@-iT`ueyc}z6@LgwG~gL)2q z+TTmzT0UW!dq1SJn*2aU%s&Eq4vR78cOpM!_q1PzzJ0S_FY|sD>u1`Nt<)vZQ2DKZ z|5)vpbpm^rm4UL%TkhxiZeWZT2lC*aaO&*k*MU62vzH|70B!DJ-=+<|_*DJh6R>}r z*Z%UZ8NZa(IPEKpxk}6j^f~Z517kL#%2KC*k%P!WodPZ&88}?J@Yccngnz#akbbZ z%&U{+oEYZ~6~4dYU>{2NRW=3mg6kA*cPaFO^B?Ep?dW6bDCgC`_%>hnoi?J3%98z2 z9WwhJHuN$K-L<=oFHqBtxd!91I`pwaEvTP+_u+)mH`ZBm^A8WX-K)i35T|Z&oz3x; zAK;N|Eah@a+G+vmNYb!&j`F(zg+JB6+7s$KmDvo;lYqZ0A0oH}zdw!Jo?i zLbQ|f*Jgx?w6pMyDk|xZe6-K5e7G-xI;a~K^y+U{4Z_&Cc|Z2{#&BI0YWnn>%+I|_ zteuDRjP(Q5d8FCH=5dX>|62IT^tE%E;N#Ng!Mww}1@w2y(T;My>%LFyk8Ax%bcXBI zaQsJya*|zrdDal=U$!F$?{ksvV%?U5bjl5D@!<*3Es!pEilfHG3U&|n4_*vz0lYY+Pm7om@{%U{`D4r&5XSX@vrf{ z&+u}8%#OYIRR1~-8Y<^s982#_Q|A}K&Kx_lM{H5hz8}2X=nnbGZGWsU*VlKJA-of1 z+E8{PY*?@y^^Il7tLEkWu^4&h{FA)-7!O=uP`+meY))`}@h?x^>lGMz=%c^m`?edw19hHj@%>rO z)9JgY-o>%!Mj9%g^NwTB53*4^{$7Ty+#4wSyFZ<@rA(r65MN=g?(`Pr7yyV z+k~-@IS#mwuH)eA;Ge!piNE&g@@d~3utO)1U)zs!a9R71SN6~BK)&Fd!?wMFam~4F zFTxrG`j$L@+KiAu;O}dlD8PCPA!>cBuM&Ood}#N6E3#ofea^|iMMiP@DV&FA^cUkS z`!~=fm7mV>Zu_H$ejkv>rn!da+$PM|*b4|JjJ(%^?~(C`4sef&Y23>=f^r}A^(AP( zcpr}YPS~#*5=!odt(`fTcUxs&D2ef(JoWAa*F@yE8e=J9-7otpUi|(;aqJU)&bse# znT0(j)LDgb#e8fN=pN#FliwB`L0{!vW|?szXWkpK-xoyNf^F*c`-1K9{PG+x+}F{* z7ruZqPfYT>@#gU?x}ojop1AA*W$c4L2HCTHw1e@)6F4JC?*9wyiS!ff8umx>V3#1* zrw^6lI|$mc5cU8QKD-C#5Uas2^>18&*Wfz%9_X0*aP&=IgdfknsJ&VErO%|gOdgK= zv`+;5;={<}TE;JC9)VH6+WkVgo>aDFS`kE$oxz1AXut<=Y3HODHGKPglTB zgxjy{)3HrEPy0TTa)3_KCt{j8uQT%z&uYlWEodj_8m>2AMH^3KX&={o^d*%(<*`fF zHMoPBCI5~r`Qd{cpuJ121E7EG7whjQ^9~L&@{0uQ-5$_Tc|C`{c-n{GVZVWPmj1rl zDGUzL)l6MuUn;*UYu(HF#vjvjeQBWogL8dmAHhDpU5k3F5nP0Fj5ErWXLO_=hEC`D zGNm1*{MY~SlD!92X1z`X*^JK?X!wyPX2@_h}J`^SB`t6v=CWf5dWo!o-3 z5kb!zeuF#fEpuI4lnlo!qRwm7{8ip??D=EO&R)MeK_*}??~s}C*FJd zEo?M>0Qx#>5xNj)r{^G4AygogB6tXT_QKyg+>NjnVGY6xgf@h7gi-|hCG@HD;155H z`C*Ioz5S#7yRjkoI1cvx6TrjC?}7L4NuQh;L>p+%P3WhIy!?5dJ~P(^VcE~aJ&`!> z=fTfk55LJCJrBP2&Hea&fT!ut+mLS#+Drd>YvOzR@pHBP);ZPvxYr8$uxa2e3g3ux z3HuMApVp4fRC%;rtuq$By!@7|(GQpzdV<6s%RPLJRdi+-DV{ zF3eF}2S;(2Q1;%17VZh7ze1ot$gjWHubXvUi~6nPgMFtvOQk;9(V6|@rQR0!-O2uO zsF(Zy_8I8QB=}{$Xk#Ae=QKUg$F{PaD3ix?L~S$5Nt;>k0@mC9U?1(Kwl{Mu@*Jnx zKgVIc^H49(mrBY^oi6CG-V(9f#-7Z$76lufBNLw)(*d|KSet^F4@0j8U35- zSF$Za%irU_6g1o<{Oxvsy$oN)#@?uFed-{`(_bwj*CNLK0)M z#vh{|;=}N}_9ARUz}(PJy?%uC4_hE>kcUuz4%QTQ9>z@5hW#&Cuk>Zg21P|S)X(h~JYn z(|vuk4_u3%2;d>$te^WrargrqOQZ+6r}X)YzCKqY--=}Sp^3N;tMabQIA@?<&sM$e zen9qx>#5uA5BH6P?V?Y%#rmPxF0_d@px;UU5bJiX-PaDm9Z=|Caxg@hw-{myyjh)?s;jC_0j ze9t4_VdUeuXJ0F?r2$^aBW)*nT#;|;eL?B@cVwE!rswphz~d3nYx3(}s(F1LYyG;{ zqV7u2qrdf{pNGCp0<bxj}&XzHz&ig@UpU>CAfM2yMK<9fn)9Ll| zbO!Ql3FOg!AwPO|miO#i&>o$ei_xx#$_loT=N%!)syzO4@LbqG^6$a>AfJ-^AZNkv z3;X>}S>m^GaE_6_r&5CVxT^x)o6(Q^8DeJ(k%l`ONK5v|0K@hjx)}ajWH@DW>ORZy zMl%+IYZU4}Z8Poo43wJ)d(CzgC%O)W6WCLVrpGD$Wu-|OK+g~HY=h&jFt+*t*NIaG ztv*nN70tEC|%I<-AktQJ?r1)M4Cjuweu5x4QPjFWZm0 z!uR7h7*JmrH0?p)hy6mII1D=*90L*Zit?3s2Om}T&}h%dH+8iWyq<)v)%iT#7vQNT zgD1`#_y!mE0@fZHdpQ4VP1m_;5*-Ufd0ypXbWxP3WU8mM$Y>K zb?!X(R5`OP`~2~bGbQ}Y$ISlk96R|m>j@>M9@rZHsre2A-?MN%Ql0or*p5#L<+Q&h zYmw)V;Z88-W6I`!@aJ}$c`mn!yqk6KF7U!};3l7fUo{i=k*$=S!o8sV+~4OKmgh6U z^$dN9qqswz51Fz}l<5Y9ZDG@{^?`P68a1$8d43bKSC zw?F!OT5Ue>K-3A|E&3H`9|hlB^HCqRBNY4fd^1pw zJD{GK{r@g>dB5F^wO0eQc}HmnXj9K9W7hejORWB`5nM0)^w92N%H&iV-dm0|-%f5t zS;~}S8sjGnokN!;oi|V?dFPnpKG_L;&-)eRrLEvx9|7-t|5MbZcH%hc`g7?;zU^*x zO}@#2dl?OZe4~+Xv(LBQTgUx?)E*%FX#(X7f1t{zm5(!rpwE&3J+=8#Klsu;iO1jJ z_lWp*!7+Ty3CMcl$TYt;_KvIkJhx(RRohe^$dfr|AIH8D<-XQ0_xAwp)fwgZ{lF5R zmlNnCw##F`VlA1=@6s@TM1VK=w95Q8(npyVp!I9+*`N%40d&-GuAMoTWBfZaC@0W` z-f?e-r43t%-DdIiDnbI_C%IR0rtHLY_y!OBX^r0@sAwpbeW5IA#wc z=$=k7;0Qt$7I+m1yP$}@2x|~lAw&>Pz;WdN>S#hJM<_)&0ihm6*nu$Fv8+mjt-0{c z5GnwdA#8&*HX~F)nJW;I@KtIMrXkN{gq`qb@cpy38Opl>0q0&;8A21_Is^}}g}~n( zKLOul6Y^p&$f`iuG6Z}(Z?z-rz`Jb-yK=xg!U^QzPd@Rt%902k+Rf3h20X1os6bj7 zLM>qWNxP7@7oi4$zjH|+Yz+c`E2$J=H`==cVJpHWgcXoi8$umqGY!Fl+>Rl}MMU{u zB;@rd0{^yrt-Pyp+WBuq@LN+>^#+`8bRXJ?`7!8|3u_6 z2JIT>M(Qg3?ER>@pW~kE)5z{e4^*ys>2Q;;M;{C5NHU;DQr5+9UJbgbU(4tm^=XvZ z2tOQmQ)E3#KRQ7kur88vm9ojezVIuM-v*pV z!>`|jdr5Y87s}(FD8BvTw_*I9Bf~SlXL#tq1sKzrzbS-n!yZ1?>pmZ|eLn8<+usCU zwC%aphW&BK_~^%8I=tK6vA+`Z;@ET4z2tL1Ygaq>F8M7^dM|l2>wv9(0BQU#(W-p7 zZ&xpPzij>iy(`Ld7Tyufi$B7918-TC_w|tm?~Gbq=`&~6L4No7ef*IOes}tP^&0HJ zCO^-DfNa;{z0S=++1ilpD=4$dFZ1C*nYPR_9q5mHZ|eUx@`D%XUw!{K;X7OLb@ICi zJY&v__r7WNCDt9{y=vY=hn8S|>pFlDcIX+DJ&bX-51|!d4#IlqPB%h3LNfyVGHV9{ z|F%5qbWNQ!{?4V#7L9M6w`}p!B`cS9%;oQMkN>ayb4LIFJC0BN)SNZHZDGrj&O}G& zyv~+MiBZiK{)caKN9(*rz?zpXX~F;UyklP5!e*0$8Lqf8ap$syoh=E!XlqMb+fr-E z(!|X-UYBTJw)BpL%`NzMs!NwFSa|#LWi8E##q(Am;NQ|F@Na257A{?qSlE&9$&O1P zV+TqsODylezgA5I|7EG6!5^8Qx4f;hqhhpjD^-pY!am7Ki4Tryo;0fYR{0gZ+gp~j zEJK6l;wRvnmoCmIW)c&(t?X>+$asbSd1@GJPPDZwxc~yWYx!xju+6A`;ewTD#L`6z zTN0g16CEu}(0C(MpH1^JBXM4Hb0Y8q)u?G?Wz~vA#i)+VR^Gm}lWYWYcO)wC-G4)UWV>KD;Cb{MCWI` z!!Oe>nb!$D;lHq53cYGwjDI_OO7ZkRB!H$ZZ0}q+fA0L{%kJR6r#(%+_N5D#bk1F{ zblKv0ote3yjrb}3dABcy+RsHN-`?4pL8o)s@+I@3JxPKYZ=H$Gg^Otz+S)P|!B@DB z7Iek31iL-WDGFo`EkFAyx{xlA(Qu`mML7axj5uIQ%veq=U66n}o!>gIqxF1fQ#vOG z=F-G%3vWM7Ez8^6mo8&}XXsa&K*|b=;;}}Em8MH)mPNVWugIy|{(iYL)&G6-r^ds)j?R{4b30n*FKg+1zfv44@0UkSwHZ8t z+_b>7gc%v29KOELrehLopSP@|1-V3h%_J5aQ_EWBHRGRy&tJN%**aBem$iI&c?(+8 zJT7tD^3KE(*yq-z_&@9D`P)|d1Ti-(fg<`-X<{)(`n=m)63xr`|HBif(6erv2bBr1 zp}A4*{Fa6I-{cA5PUjlGdJf_&O$ZVirxUK_r|SH>6l_Btw=G=`1{3Ee68K;6sTp*f z&rBczYL&v2mQHRNW@359`%@;{Q<-DC@t=`cw9)6{WLSqdL$!GsnYBByMYIS%Ti^SdL+9%|oYU5TB134LJf_flF|c znayuSB0VPt`V&4*HZmOC%HHeba4 z#5RD_w0%6CaWiBx%)s&`ii{FSE)5hEDmd=baw(gh0=sR4_j7j#)f6Vuc1;)T#46sdqUgXc0jD``>Kd2o&I zglhd$avT7hX)6qeqtnJI>$t~1SYL|qdV69T9q)Q^KyNlCNi7E*Y)*L{t(ezT&HTY1 zG&h>$yRW`|Y+l;ZA>6}zn%|0H=+~!4tYhI_Etc=pvVrpx3+63sgPE!rMGFY8dUV=2 zWo-hDqY!5^PLYiadW^#*=ik+`Y^hr8(_~4Jfa)jIr_(a2?h)@n0CXIYXYiy z3Qzt(IGLLI+xC0+LqQb-&kUhfW&-^f!kZye;tb!wx2q~ zoRWinCI1Of%lzinxtNIN!Q+*GQ8m8>Iv1GJf~8bJRVTB(ODtaAVP@6aFg=5bb_}3w zJVLvdw>2l0v_Oq9bdhg~m0C_%!cq%5r33FeT2p4BebHRx$D%E*qgja?15O4x^Gv;_ zW?EwYymtQUs}w0|I%Qy*A8a&*uyDabE+Y~ZrZAT*qpdWI{_O}B$tsHq{ExA@SROCw zT-dpCE;_K&*YC8QYi?Z(KLyT;&qd9&8_>z{+S4WgRbc@+8HUor+ewLJ!o=5U+<0o6 zg5=((Cr#_7Cd4rwZQWwThX2ykoLIgjW#|*r&;?U;fhUW`(`39wUH;SN&LoxSY{jU# z6SFxx3TC_op4cgjWTzQqHIrs~a0ELt;CTfGN46Z|+5}Xb;DvAR(RD#lD9vo3wFB!*Y2T8TJ29gfkK4?9V)F(jr}WRC9gQ<0mdo;! zg3gAfVM2tl8JB2Y*fD?JvQrj*3j-r$V0{*Dh~Sok`HLgM5f!5b0qf=k#!B@E{@!M?Oe(5$(ch2|yl@@}HXnJc8&E{GbXz z{u}e7_ze_*#}T#SI0Rr9q8gl_0i1@2|681?h&CH=E26yy+=s}*^(AD8AR1@D8bl}j zR9soDK|qFDL|q14gJ_2V4P>%6sthgV8Av+b8s4qidzvKH=uhSiXk9%E27E@ z0jm%-8L$}<_M(}g8qp2|?n2Z(MpD-y+H1f*MDAEgEk?A$fL)0C#!2d7MD7IwmLWP~ zz~hLvjF;4Hh^i_DoQ&v%0j&!m1_ba>fhcLf6^Pd0ssU2F5uGq#yb5Ot2uSTjRCcj| z<%rf9a3iAbOC)tYqGJZE!Cl}rmr3e6MAef7Od{H3z%7XO7!aTETUA#`hKY#g7_bS^ zY6CukXs-eHA=-rB(*Qf$5N*XzxB=XWsJ&Xi@+r6zhJe&AL~U0a5YZ6>9z(R^8cAJ^ zsMmnI5S7_3S2pB8Ws8&eQ)eZ@w zmPin_MS`d`5=8BhAZn4!8=4#hLDVVFc^KFwLv`$IbB0&h$A)x(?Xtg9= z?Uo>Fxdc($C5T!tLDYT;q83aLwPAv&6%$15m>{%d+YkgHV9Z)0&051qKb?TFagA!@ zB)?iYLDbF(qLxk&wRNUUxv_SFsJ#HdGL`qJpR$6+|tmAZkkmQEMuQ+EYQ)q6(rmRS>nRf~Z{;L@lczYFhEf?68Ik)I?DT&nzt*SwwLaai_33`CPxotmx?k(r zug4HTH{GxG?AN0RNKJQUeP&znGh?E|A*-@S8%tPQOIVvrSldgO4K9Tu6J}h8U|X{o zQNJDQ?p>Bjf_YRF0{c2nScO4Yr9qhD=tK}gy8-kepaMp8@+DmbB?v|3RrqfxtX+x_ zIEH}Y#}P%u!%tF(D=;{uFaa}CW>KPUC37cLqLM{rDhNkQ0s)y+z>+==N>*+3EmPXO z7etG}*8O*+9f4RyV!nu>-T$WoHmjvZ6(cC7^{p|jZ;fevYfRgbMwJeVQ8vd#-x||) zq){b<44iK{ECFW9r5G~tEvYISY>?_2Kppk~vz6t2Nn;TR@dhP2g^?lJs6?|F7m_}K zfD)Ocd3CeW5X*ekjAYh@TgsWQSm$AfuVj~?G9q9N<^i&SRL%puSqo78V1V>o*B}5? zR~4W-ssPnZ1xP2gYlP&j!eHgF0aV)$0Pd25RlELDjE9s(Mubr~MBu5NU8x zMK)<|g|tl95b71#B^enpHgdCtVl;VFk_MwNYebmIwv+@L8xoKT1QfOkyEfm`Ly+>4 zsX-;?zf-CCC?(efv*4oyxvrOzDoQim_`>uvszBwPic}B^bsvHtb0(T4xL-=0OCMGD z(nr<7^ijH)7M9vRO3*`q;xaOe^+t6){Y>h7`Y7GcZc}C>qAdnwWR~)cbV>Q|ZvFh_ z0NHU`rQdt%lBueT<@P&?uyzq))po+F?u1p}39G^rR*fgDDo>a?@1hS0Gmapj>5SO5 zA?xl6?OA4Fx7HyLW}mjA6Pbr`8v=?lV&5`ZyOyvH6T;f9gtb=*vr{)B5N5m!0VEkU zql=l$xcV|C*E4EHkYvPW6Q-WMzYPI77;P7D1|x3GU^3ZZsYW1+Y6C!O!j{YZECfvF z*K6lXQSEx<*Hs5Vb})MtAfpNa2UtGsSkYM>eu8M%3Zi{0h<2_Z+Pi{i_X@)PO`tEq zW3R=37~X&YGs=jYijuA!F9>^{|1w>Q`x=pkIH+pu+4SC^gAHXl`)6yd{HO*wiDc`Z~I#;ZqH`GT6lp??}twz)!;LVlT1*<}UNl`gUQ5S>9Y{JhJ zNdm=pZS9Dfpq>N~nf>^gB2)|;r0zwuPrzjJ*|2{Ij`d-?hrlX?T`#b+IVbbl`bQgz!Cpzd=r z@9@--2>0dIAs{syaek9y+z~>p2sa{WB&7(Uz`nHIqx;f)q1)1gbyu1&H>DHT8YUQ5BcN$^ zk8V&ilkQIw*6nG+x;ss{VH(B;0%6A65rhx{o(u9trgizhqC*q^AJ!pS3(=JK*CENK zN+iht>xUUNMpvvJ0z5I6{#M12CaC5JqN*c^>W&~(9_ol7nM%@!3F8O?+yh2t?r5aN z;YY@FCHz6fW%#4_^lZNdP7Hz&OVnVBLGa(L0?31MAKeRZUmD$t!O)8UnvBeOcw;6% zWMBmXjXWl=4Q2x4Gs$2#JWxxsn6`Da=#vWL|PGHt%dt%fw229jap zkxDW~DI3yc8vbvzywqUTtP3XyNx@oRaBJxL(r1_kk=5uzM&)I1{XJ_)s0Xoi{ z!jALcOdD^TKh#Wj9^;)?WvJma9)poVy!zlxJiXY04D6#$1b{q&U4sBnuVDb>B@FIX z0Hmk=U%e^Dix1qmKr!BQpoa!9TT_msImV0%Bn?Zth)f$B*~ZlfCJ&)*1eh8|+XQT6 zwB4k}A&xQ;Ns^I~PNPc45TSsMB7n#=$f-_bm1JbZCRc}6Lv+XxhxE!sf=Nb3n2o$n z)Q({25n6=+-K1ze1e8?Knmm+lok%yS(lswszy?zp8%!^w7>u`3jw2XMps`XZZ>H2B zm=}bS@*>H|T-|GAha}M7FDb(^HM?scPw|WILi&24rOVuQ9X#x>KrH&u&Ue z7u2&ijNI#0?%0Q=&`U+q^?Df#sVXFZDi(k$6M!lZfGQ1udNBu}UdsWPR=WDM(hZmt zcKS@y1Wg93WH)48(xYrMy$&O3H3DH}oG=?;bYzweEf%fw6@XdNgKL(KC}v^nb|Nqf zv(n9;m2UPdHrtZUoE1mZAmB_!re9~Jg)u9$ z2Y36zzznwAn&?Xd3x5@cq*EHL2vBMjhNPE48s*ZZGboJ>GGb<`FeD3`y%zyRwMn#p z8==PA5wPc_ZIbMzzQPKUZr2R9DOzxwFVU;0jk?H0Y9@P| z!J5BkqRV6$NL?2L)U_`_UF>GDpoc-m5;v_bvxY}7E$&1>Z}!6Hu%s92(`4(@WCxBB zkUVC{Qr-RA-kCKVOy!!9`D#lZq@T~qXQ%g&X6p`BmL27TD9|7UW~FltP}dX4#T`QG z5MxtffN>Zfx^Bh^0FbpGXMN z^vOZJ9{!=KO!0HSy&Qps8IME2UU*{@7)@fXm%v@WbwC1~nS?No1v(lI3W@Q%Go+?nE zE>NE?FhIiHxJ+Sc7~n{*z^g~hT?!2Q!+C~0&I5Xt9?j5oc&cV zDxtXn^6pwi$TG^VPM5{M5&18dtz*5WK=ATQ zrsV6$lBt0#trG4A^v?$5*dn z!g@MMSdS+O>-i*MJ)k74CzOQsh?20LQ4-ceO2T?dNm!353F~PcVLhlMoGG{B1pIdd z$7;{*AutXB>cXhXq`N%?k_HL&5NJTiqEjr-*I8a2!2#oO1iWHo2;6M>e|nXK$tg)! zU`2pHt|?t!!Xd1eaiDP&bg#G__1WZ%94cmjymZ4W7^J~#7`%Q#_%=;;b$7Se(MwNRG1sn%~Pw!c_l4MLU!S58J%G6xNq_r|4O4X|jL075#9q0A%XI|nQ2yk_`!Oh)$l*Q&mS%hyL0%9zf`G}55wEjLx;8@) zZHFM4y_?yP{}X{$g9Wn4xCQ|g?hs%a5J-ekyQXK8x)cboyFJ%iant3D&h3KrNG{ zK`gKX!EX@3eF)HFmTwhS2Q;V-?KI!v)^i6TiGbOek@@0wmL6nNfh*x0BLGZqCd?{_ zmaaxXYI-waR(dmGfQGk&lWxNeTXO^<%j`)O+Ju|BOpRZKFHBc)R8_#C2}=di6C|8 zp}Qb@>Mn>Ly9=V{?tjaCF~JlB%?bvrxa!ed!rly-oaW# z6n2(X@FNgyHv$GGqlkD&cTZ+qiXbQO9PrHusBp55cfy&%szDV=sV2D-(H;X*R<5Zb zvj9KpN{9`tSCEcM|( zrCL=8S%~u0r3jBPdlY zL}xK7LvXA+Lp=oA5W+xk+nHcHLY6)x1;f^?%q}>Av7QjCGQcZckK_&J6(jz737m~y ziw@ceMF?2crdCA0Bi3sL9I@V@BL*bxi1k_lN37QhIAXn4z!B@U0*+X(6>!9Qt$-ue zYXuy!-k>AaYXuy!UMt{;^;!W(tT*V0^#&a=@OB;6ZwMlRfFp)7X-BLVvM_(@h*4HY z5ugxN)kZu3RX70YqaHy3s5eBJ>dOcqCDe3{WKfYHRRsc2#Q{)-0Z>H&P(4zBY%K43 z0*s?E=2u;2YTJ;?mW@M$0P0mvfZ1BLS6Y>9NVO`-R#iw-l5ADC0okf@1gIrjwc3De z)o}x|RlB8uNw#Vn0`js|YYmuL`!oE4z%-x$4rn2CO1Bf(}<+pcPQifL2oK4cTkZvguYTiFArm zN~b8nbV{adlrEaC1OX}~fJ!2ZYOm>wnqqgjTujJJ zYL{>9PM@nTooj#&*Mg4unJuxF)b=c$kj_;{n`&|mptTjWc=Z?rXl_f5xy|G&ovSXL zYXB{l@(`dmjP?mQAXjnf)c{johF29*D%pu>g#q!DKb^*i#1T*pqw)~J0o5=UR%LiK zgV7uW*ZPw^Lw@+H&Aec=N5I*AhzzCKfaEV&Uo}#&vSp-{ZWc<-<^>}|si6;`q0|6K z{(_XMkb(moMoQ@xp|sk(V8r5N_Lc!^M3IGJvK*l;2#^;eQ+!q* zz=I~W&c>idKn6yu1)Rm7!8l=3kxl-z9i>Q~mi^TUWHhv9Z9|Se$tARo7|51Z&qrD~l_89e3ME4U zwn~u6!fmMOgPoWu8yy4$HZhfk?D>OjCnm&!cm<$2eK2x|CxUK4>K%|+>RmqH4H^Qb z&Km}m3k%W0b0sRe0OVNyykXM^Cy;M&7$lj%nv1If$Pl3(<~z$ONl_0^1Ul3Pbqu=^ zAbKgN3}a*S^REOre2C3z&q$R<8m@%;eCM^SC?AWB_{b(R}UlcOM&_IOeFZp zt4o=D88i9tq_k8f4`T~22Nmqm1-jg%Uy)8S30GcVFNujLM4~3~s;rX3N+n&*^uZ?U z6l~91*7Y}W?DEeAXEds6DnCyYf5#&jE{g!T_LUCDoaK1PYCC7(8FI$p={T3+={nQ# z3_BmhGsjtsXRdQEo)PD9JfoKT2b9fq4Xw~z=Zi?SoEPx4ogd&Ca$d*Nao)z$b^eAY zhAhlejzc4rYlVdg=c15v32@7~2~XSMzXlFD_u=U{>+y7bX5AIeH-TEtkMXpfgLsCV zzvJmRB@QbXk7wAKhG&j57tdVh4m=~yqj*N0FX5Tz^x~QCyn(0Z{1MLrpLlqQlSipJ zXW?l(6YvZYwBuRnbmMuU zvl-6`&Q3fpa(EN6%7GJUUF`4^=u4c5cwXwv!gHc?2cDNXpTcvJ^L0Egcm55}$sIPQJ;CYpE1)kMTBc4;7<#=B0JdWoz&SpGooFC#j)j5FYwa(x1yv`|wpD@j- z#B;hc1J4gQi}1YOc>vE^rw7j)oNwcKqw{k-Z}PP*=N#KP3fyw?VE%1qB%UFs8c)ZW zi>K>!;Td+G!ZXKt0nc3LXLzEg@kCF@*wdAG=Bw(w?A!p-kWn1o>tCW zJZ;OZLKJrWfm0fCmhz?Z5MMf<$1~)-h^OQH5>MB856`eO98-FZGZD{RXBM6j=T1DM z&ZqIrbGGA|@9f3XbN+#6fit|2N?V2JAZG@iaiLgxuQi~L6CUg~@osO9_=PurJm zq{Ma(N$Pt{b>g`F7lMHpg*akIp1@GK2w-$sWD$y94lwTm_i9Aph?_)|>qcKjp1gm@ zqX;J1eZkIWyxHAid$%FONxX2Mvn?-%RQ~T+_j!Aj7YA|)28g@WUSs9uBbmSU+J%vk*vh* z2JbaR2HA7Gy+GJDx5#etehFj=`5J6Dd%p$pQ6fX^R_~A^C3c&41jys0Hq>tS{sd$l zvz6MN-n&4go?-S1EAlhYU5FHSP2?RkWdp$cR|*(;`Mt3&#MGPom#x_SfLSj8`)+JC z;4?rle@DcMCICdn;_(<#^PiJ$co1N8Rb&cMw*hp&S-_~={d(*<#74+gj2Aft-s;6( zQ1~0ARc*BB%O z+f_VqBwpmoi{if{m52nXC?pofN!;Q?Gzq_tCQjwEx#Jf-tE9`kw6$yvq-c5?+gp0jK zAna}@8ZPx*%=6t4jS~x(dHF!tY-dn7;k6*!6GMO$h0DErfovl(I9%a91>{FWio@f) z?*oxCL&KHckAPf^);MM1Dvwu61vxW3(d$#>tng&-up(!NtG)Mt93!<6;TrD`3CsFW z8IbeB)4UUkRD^52yb=DJ(cz?5tjL&fomT-wI2a#p@G5~kh;q(_;W=I%kWEA;gqyq- zKqzVF(r~kPuObt}t=@x*Tpn)o9#y0|-0rPaWJmJ!z;YcDRNDCmG@;J)COm2 zxXarLggxzC8(!^wN0IBoYrI#0eC7Z~^~?%y_VN{J3~%ugK%Qcyw}!WRmjRKMHix%)Qxs_lZ}+AvvLM{+%}``f zc!$@hNLzTP*QChe@Gh?vh%|0#c(>OHL>ku~-s9b?$cMvwJzh=z5+)nxj_^LO0Bw<$ zt_&aa_-Wt{Hm)oDJMS4FLhZruVegwje#|$IgpYW=K#r2YKk;QjsDz z$KzKvlC9Xy^$Mw9wDKg3}@c6BpkgjlJ z-noj5bq9GDDsq7v_ogUvppwNTXZn{Q}6h*`G~rm3J7(ZX)yD8t+d)WWYAN)4aa| zu{kVncWb?q`li)QdSMua1m7%j>%4<7l{eE)Ep{8cqdq+qRW%n^y!wCuQz&+r3h?diT1W-dR96Z8)pl72f$keof?K?kaDxW_!r( z@}>f@(G$)m+|^zkknuzwch`9HHQN*JBOd>?!Hs{a5|KhIoKCjt&+;!d- zAXE(JOYVA)7x|-*gR{xq;9UfS-jnlXccaI3Z<24m;%@S`0(pfJ-R^Goz6<1|w4uH3 z7VlLcoY0&d?pANNB0q3@z1M-rsQQ_^%ljn|8CAbHRly8ItkCbYw_5PZg-vu>`etC0{JDpboyT0i*bJClzFvyQ$b{(GugWZ zh;&Jx)8=hJg))BLa@svk=OW%CPN&B?U#R_uv%>4uZ0|U$WSj~Ie{{NJ)C=-wXSEe6 zL?vf|er#;yYiRXQfYBS%LQe!bpwfz7hTIYU$mC-nKWP3Lj2i4gRk2%9jzkAtV#Qhk zzYGs~&_p-(X@xI~$DYY`enMHL;z5!*G@dU7d^- zmH6;A?Xls28<{?}J2pe%Yd6Ja0~Q{p^~UA_{s!|*-xXV@>DTXxeO}?(zSvh4zTrr0 zE8xE||Bc7X{;Y5^VwdHkwbIC&OYO2Diri9Wmz}LhUBWIK3xo!0P<^>wb}gS-jNxSS95W@|8 zGY|WTk$;1bA3#dsn-Q){IswK%SHQ@N|4WQt43XRTXRKH|V5&y^v%aSb4UYFjtVkT~ zw9v-FKSs^~c$g$!E?|_1zZm-oVpbA=$%_3<;qQ1cvcXTGj%f!Npdj7qlNhLTFb3 zqey6HtQqlsB!^zLV)p>1utGnEY4{xy3xAJCSpO{v}cf@Ku2E z7YZbbe?9gJP-*q^mb7#Nvc$J~R+M=o=R#l~M4#BxBg+7G0t~fAIVPgB@IGKrZU<^b z+wd%;*@)h8>TCM%aXRb1(fQP=uQ}k2`TCmB;h2wp>(o44Mj5*mphJ5QJ#cEq)azh{ zIk5j3>;{O9!P~g0nwk@>IyE=VVbEmWa_VcTFkP$Y9v@gj{ns)YMuo!HP{PW429HND zYdM#PqP<8d`~e=3-FW;7se?8ZFp3ZAiM@oF!W#5BEA}IWKkvqVuJFG`V*C{f$@4{Y zYYfvt-f%q5!Yt%$4dpZT3Kl!w5CH6lf~BzO!+~6nTm|ip>v05d$}IS>gY_b9@4z^m=&o4@DUIzy0U;#b4o|g{L+qioj^D& z3Vw}Um5%^9$~V8Yi@m=A`7$I}u-`8A^07Xp!&Ptq`z=F({FX?+o$y8hd6&pRyWFb* zG9EH0coRD@oj`s_MvFk#~P{|Nr!pgKzU8v-2U{d|`P(!HXB4FG(D7Zc}CsblXlek7HxFOU8 zD!{lLEtnH(4V4rEJL7C%&7rnX$s}Nlh_!@vgi0EKeT`UKDB+ZJ0Xs>oBh>Ab><2W6 z*osiATe1`HRw5Lv3~h3)yj@V0MpWTE7s_WGDQL63n*h*{DCmF|-=avTjp^`R= zkGvcx%znJfxy#OHT#>WdZ2fVH&Up|eA3-XIWX{K+*pCCDVaa(28v85|R*>_s?Rn1u z`3&ED9O}zes}Oh;>dRHDAfJHxa-}QCV^CiXEkU}WzP}=A=zq==cDWU)w6Up&l<;@+ zhJlms0?Zk2N1sIv!{eFLxIi6-3;(TRAsmz7k*NPrYml7+$I<4q?NX^T^usEL` zx6(EyCS_gBq9Ki@?1vSZghEXyH2CfUMym!dO?g#=KMc{X9Z`Wh;;GHS z!JTEXT9lLYcC*5FR>$fTUQrvHrSQsz*ldOGYL4Bi@JHIM$ZO#12_)n` zb_Sy=JGV8ad%(Gite9>A=eDhi=?-x2;x)0mk(pbKxl1<3x_pAUOLxca2TWPzw(k=L zB+rNY%E*Ag%UrwcF)h$hfsGC-U9=95Leax!K)*%?cVht~&;4xdS;Vrhyupfn12Bh% z`#CqZN8!)s#8l_pFTgL|gbY8%%jli%c0{?Mp)VrEU-acK$B6X`#)i(W0U!hNe4J~a zZJm9C;uiov%R2jmijN0=rj@oVl`tl4cq#VjLKu^1F{;T+;PEb!ae|i5I9{+4n=a^1 zu>l`}7mzYXtKbFjqj9k+cVn4Hmq5(OJr10T`6Ra#kKbebI$J_R7#G_GzYlp+VK=1S zqcCr^iu@-yx>=Dw!Y+PDkw1kzuSJn#p}5xuq!LvZ{5e$Ybtv+eP`P&(kjZ>wJ5}Be zMR0DDTJ;r#om%fFc=HKn%X5<6YhX-}e5X6LZCl_uyS%h1bxekTD1|s&t z0!E%aH}(MHP9)p6S+O3#bi?fyH}*w^TOs6?$WV9>9+8LecoeVf*=I7!dm8w+z)85n z&SzX5zS8!7gE!|Qgr~qJg^^0d4A;OW)dAVVH`8I0mI3)Kk(*$X?g8>HktA%=!$2sh za2;&YzW|}!!?Q3~KBI3wh`BPZZ$4yC^qvJm=EL)BI4fg8s<0A|yvcZ6iFe`4?0m+F zaItMP05&B&3>?0V9M2+z%fKPorD}%H0f(yF;Zfj_waJ^Y;E)zjT6G~fEY&wvu$m)* ze2dgBwacu?BDDMu#CAu&gQ)QPc;vAkE08T5wa;W6c^SDr#Du;me+6N9+C%pj8Sf$0 z*u0c!i;LwT_T-6$&2Md#j7hgvhdQAbNy+bb(p2*+O%MDNS z2v3en8y6G4A{l!IG3gDxYPU7?CLn%$BeMa29wB<4`*B3Mk@VY0VDNMqIKdsQa?Hxi zoA)FhldZ;1P=muP->KxShaZPr7|CPKbmLk8-XOZI9SYTiNFCii;`dd5;c|uzBD*g zlo!Q+Abhrgz_OQaNug7N-2NIZRJPq-BMK4V`m} zhY*<+rSUF4i||Z=!RshuEwKQvEwQvzZrST=}XYev_H;@t5yN4m2m zlhKC{#)T7U#jRq;i)94fCY#-6)HTIr)P0B*%oVF&ypXV;Uq;$IGY1s4^Tne0kJiW&4h;soC3L26@Vn_xHAMt$dpbeIhT$nGqB04nK7#R9`UU5F1RjcTHP%60I z*VCy6nTJS97u4DUPiK0qO@ZM24@e=`yhS%M`Qt7vmEVSs2iowcX+zO%$mM;-AJ?LT z&xj>32mYHKN_H?8R^C@7(_k*8eApWK5tg23Bp^2g=21%JG7fHI)5@ip^C|gqu_w)( z_(zE#7BIu8CrILUVSZ!};Y|T@o6_XIoF?~`G`VNe#T%IGHEiQ?#1MrM@;wcVB7? zAJX3wZPsn{`ZAm19V|UQ$)|m7=A^-z9v7=2hD~;wz?9y{l|4 z^Q@wuvB15-n(qzN+!d(#zCg|Qo0_FNS4$qN=&z(y>i3+qp){0k!>~}g4Z}m}Hk=WX zHVCCNC685f271Z6EJ*3H0HsL*N|y&HO%71H(x)_$lp2DR8UmCW1C(Y5D19(M=~kc8 zEK*t#q_iSHX=Q-YT>(lT2~fJ*r}SY``hJko_XCu61StI=KKn+g^YWNpZ!WJo~>&VMV*O8xN>c|_75?>9L z_-dfUvw;#{lM-fBJSXYJl`Q;qpVA~E{|Hk0M}X4F0Hu?L(hV$N=ZgI61F%RflxzB8 zE?>+EQk@f^dTW5{hkQQnVTn6~CGHHASP>|((l4=&C7uYDcp^~ZlYtUzO$jIqKCb%! zrmtH+IUZ$K$&ow8FV=OOgjN+&=oQPLSu%m%BkxCVhUMX(cc`#v%xCg*n1fBx$E`ZV3U}B$05@QO_9B0=hfg*KZ0(;L)-3G$9gWg+6 z7~7eTLIkezz$x7Pv12hs6cBg{_HY=0^GD&q|2I2&J%HmRQQ-|4^L030yizsxKLC7# zz_hq!eUHF=0RIMH^g%olHVXVHKR(WRe7E(VNKg)$zRVk@9F9H&KAV`h$}1T2=Ss`^ zBNE2E3g90E_?s?y=Yskj07?K{a1I{U=!>DwD_HC$6dOJn$G}J!Qw`uo0{r54Hh{5D z09XLP8r^|sH%oj9C4PwHE@nIqfP;F>ge$P63SjJf02>M9Ux_bO09fOHi2mCIZX!Uu z1738TUB8E2T6rAwE@TTY7=Z%EA^u4Ox-PS<6lFpOnDXi*ef)!1!^!;M)Lrg=}m;fVTly`4PQKi5A-d^Tte^wU{T%?G#s362;RGII&&7*e zbkx{S04M@rjXn#{I3(i5rTiFn+u--JYLiTutwj8XC;fB5iT6F z2r9P(31jZP6h|HeEo(YfPG4@X=_B4SBc>k{io&&Ijz7B9X7z#9EyJo{Lz0b+5dVxI~LV7!z)S#>08F?RkFk&af3&>`cvM9eHhepk+a!>L0AUXh zAZ%d^5H=0Ul0Y^fEGjx^6Os;zWSgV|fkA};5)l;@6%`c~M|4n8K{2AD<1Q+0BPyey zpp1ixh>D8i|Gsrkb>D=<@B5$s`TNPuTc?&&r>ah!I#qr9UQja;umKbgf!Q0xap zmmnf3Wis@eftL`o3W4E#!vDa|h~9*NHQ)jKpTlB{Q0xezpFl)XH3Ba%@FW6nAu#-7 z{2MqO)RzpbN8khlt){>#B47<@H4rn7jMjqD?TGG#h$Q|RGLZrPpfeeP;i>pHFb`A) z15Y3@8v!u*xfgC4CWGCu41A<*cyDAVMIe@edIaJbn9&s`f`Mld;M*ex^7|m(C_V6w zAutgL44#93b#a(IYY<2wQ`8XkVsxuPp7S;!%CTs;KN>#>i0NW1S~7p)GVm=h$wQtY zrT91SB&a3963NIAH6x}&QdgKBSq z>04yltuwub{}s%%4VmU4)4!PMb7ndV)VDg*Z}?xwOiv-xHbh4ZMy5FYOS%$N0s^dX zD*Adqv+aQ%b2?qbQCNmRAxD9F!9^%)aZFdEL~vn{)QPe0q0rOFyBrbP|5(S;WASez z1KfsgVW2nIY-ivt1a>oUKGcG5Oc)s158n$hkc+@U1}vyCU!I_+@#aWW0~w+Mu`S{5 zIMeukaGA&Y{}$UTY3>l*jf;qZwFvA%z#6&`%=wIM{8>@8v5`qfpwTsmbdruD9{jDS zeX%KM6cYwsh)P!lbG(X$KY=+Oh)pm#0w%`*vaezFpT`bKdI8Iq=J0O>GzV+IFW|nO z8QwqE>@AX(IQxTCX5%4{&(LO{}AR>jVH@k|G)vGRgEi&>=vm-sT!j^_xx@mOEr0UW4 zBb~2F)d^g;C1H$b)(%FK|KU*dsOOQNtEXFZE&zsR)A@Q+L$mz45IyQWl;`X2OgiP| zuOJQ0@&{cs%X8T<>C8XIMKgbzi)Q{nh#qwW^=%B%qgj3r=utl-;czHHw?D$$u%a{< z9SOV1SA7{lSkW>UO~%~Qne?v6Pa8PWGlSa&rziWj2xagiLrRF&lF>q^R3Tw|C}Grf zp!s%f!|v2CvH#N?71B=G{srvqNy|VWh7l! zpPMLSNN-BZu^s`F<1dioWFO=xMIfp#a$JExA_At4n?Wzr^h_~szS~7JKc7i$IOmIuP zeQAi*^6t>d?m}dBpm8CcH)2F%R+NViY1I<)0q;6+m;uhclL%;q<0I{js24!=5=|Rd zKpSdx{j10#{t{)_>?%WgpNpna9~Ro!yxftYI#~I<5Ur)E1D#Tf%J=AmSz3)k4G-4M zPP0aZc+t!!2we>p_ksl8>Y`qZAfo*(eI%dJPtSY(Y9JRG%+;gPj=DV_iS;|On=`+Q~vch zd@$uX1e;wnJ+tFNvm2Rz4o)8(tu&<=yFtgA35~pZ`1tThT_|Hhs1j!9)BQ~GLuk}V zp;?f0)I=$mhJeY)f_(Iyo8}YV-1PBAG#_f_PUnNk49y+Fj`R@C-Z|`|^=t^yxQpZ-3 zU1SD=ZTOS4)M92>9L8v!!AiXhF)gM!MgGPj%lU6!ILq;#?a0+E%tv^PyNUHZ9`3YR zw@v@!_utkzk05auu1;6-_nEPL#X5Qf!PIA1tb<$3PZ-n79rF`oI=N%wuslU4xMPMg zW{19|#Oc)3DTrxN;*xzbhTXZBl>Hc+P4ar(6w;Bopj|)Kq2Nx3kDEu{4=Le$87Nig zw3EXZ%UgW(KPz<;b9QyfHST%F90-@PUw~?Li)SJ0e;)N&kuT$a8$RMA^(4~TwQ%J9 ziLwRzPmAG}m$&hci^75%G1$|j9`wpW`D)#^eh9YVSf%zwffo1u-*iaoxyb6>>|`wl z11qwOZ1|gtv*xkheN9%&Ut2i8d1DK$R6dD6y0xo2&f18W&ObRnaMpQXC}3)Ec`n|G z)i-LXzE7mzyVK=M*`+Oc$58)Mp!MAxm$lrF&g$PT7pIfVzpN$i=t!X(0JmGuOk=Q+ z#mv-{FqEIG=^3)64aj`n=*q>VeqV^T&U%z>J<@zz^%$n|@UdNA*T@BRCsylRNYiv{ zbHdo#cPafj`o^AqVk3i=#hf$N9{Qm;2Z#+%cH=b&{mJ@1s3eTd} zXrWsoXzI)*H*R6kF;TI) zmef}m^_wfF*62nC)M@Lt%=&%ftic(8g90dO*iL6mni>JN-LY`m7>`Rq{^(D{Vvau_ zRF?s|yG~C-M*UA)jz|yGZ9-}hvzNJsK({(|IikZdUE?0ACe#-4aoJTX2WrW0_fxS< z^I&gJD>w$Y_^teL%rEoCOuph$AG@=I@!{7Kb8*eX#cv_Zhc^Xm!EE1!xWl}_D=`YL zXEe&=iffJU>u~MI#dnRKLLK}CT3rX+)PSoFrf(~*2#g-zv5Y5NTK#eH6{Dxn{e0U{ za(`@3aP=R6%_io_CMc14>y~+;()tmoYb4r%i*HOYFPboN#z98P*;p>hlMH#xhn8zD zu6ei$aGB3Z$bT9apSBu~D*{&(u2@`gxXfn`!aRpFuShlV=B-O?4>!!_W8P!L_HmnR z-e6?XccCBn^~S5X_Tt)yYdc`T2T`7{ z@A$L+WM3Y|+~Q#{4}kfSaP}?7`bAuPy>413>`bsM*WucRvE|zm%{wXiK1v=GEFXxC zBF2<2H{rWp>V`ruaq%T1xxBDN;aHlFc~K{iqWG51b-32!+JI{luFbgk22Q?MvksT} z@b`Lr=Vs&hISCkNTt&D_a0PIk#AQC_U3;q_CtrQH9v9t%pq!G?ypf0B&nDtZk@lE& z%tku`xVYuoh-(wB&A7~m?R4ka3VJuLy}0;p5A$L8B(77qPU8y47HtkL^I@3p;3&XV zfh&M(8Ls8H_zDg4Vfa;C`*0n_bqv=@T)c~D%vh7l36BT88P^V6v(Ey5T=Q^k#$`Ty zxx@Ro_TxH$>oBhIl4mRMG{a|`+)kM9ir9*48!o2V&w5;) zS~@mseGKZtwJHwfaUH;AwMTjv*fv~z@iY(8%x4|SZNRk=*A`snvkzgudAa~s2`=-( zYLm{ixwz)xVjjMZx(1i|@cW}U8#V-UATiRhc}Fo1XzLE+;`_>Zkeq|71{ddo)fKW~ zF7UvScl`5fN%O99zGkc_$(frx4KgqG=ACGq<29HQb(o)tBheOI=Jh>%YYq2pd`Z>8 z3?m)-SL8DFn)>!iJ%+z2!Tfxm`EFc$a2>#P5Z7T`$8ebszqnx<KPKH|AsB#be&wW8T7J(z(m#YXM@XU~b_uAM-4I^C0~Mw0}G< z^9X&DkDKihTw76=PewN%Zo2uXck{4$KJUE(7weeg%E!(49$e;0=;rC_h7ULAe5N_e z@ctL`;U=BWCpV8BH}Tx8AHc<%X853S^Wl3bI*kV}TpJ+{Ghvo5~16;%!kiVJ%)?rm*X-Y^M23_l;fR!=EFJ%wZH|Rfon({WaivHhPk78 zU~OK8`Xiu2gK$xX0519pb-4DRZmubuGc^OzpF%OJ;f=BU9CyItT5mqn zGp5f<=szGKza+10LBb+`WmR!`S;Da4Lz0IKOXy!xvZ!=$MP>P={`^2fO3JX|WAY0} zCnx)dj~<;oCV$wlQH7%l^AVVzlAo71GH+CJo_~1$04x2hp^M8a7Y;4Tt1K-qTT))- zE65Av4gG4{w!^!w`ts(dj?~|HOZ&>os()s>^KuOimlH&Q5d6i4% zR#lbw@=J<`xv##W+cn@d;a-^G_l`&yhBYODo1_h8~_{dR> z@{GV+KwV6cXXLO3wa(1UO`n=JY*cbETW)qkNkPw?HNl;nJ}Eo>!ZRX#X&DXU(i)Zm z6W@fK+3q}unuXZhS+m@+({m@xz}{+vNeC)y8nUfm|=1xF(M3W^@GSqJkN@PrM zcTS@ucTc8I%Jrq?HmqCXW&wwd9X>Nug)0H$(@et1QB5a6pr#W>4j*=A!o*xi*;I6s zY$oPn4K>Aacerw<=Fa@g2l_qm#Ywq-Zhwq_DWjyf|zSCW!4CRoL!%-oFhnGL(t z#GRLu(>ULR^jSXG1z-B4iA^Sr9o}3LdZ@W1GMqGVQgaNONg~5$k~G7~69LWgY&KQ1 zZ8lYNo;|Z!woNB#o=qo_;gm^Jn`78a5*ap;G-<-r^qic`3C#^rD81=%3Z|2P6GI$K z*WGaDh=tO@zlpI4rt1#*v+~r4CI=zN0u$o@lttI_f8fH3&K#MBwfsrCuHsM9n;G5) z{Qqnq$-jy8G)%)L#)r{Obi2--mfl>6bR;!jYQ&!u8_`s`i8<3Rn4CE)qp5Piv?l5c zrA?kVDzsLLF$$%g+1nFlPD-K5H#vzoz|GIEW|H)?k1Y)x|wrBgZoqy@s@nm(`7c@B+F>p<%P>!Zk9B#SIvuiTR z;TKARm+VWQ1M#O#NpI-uG)QrK*9{WVGSVBk-VGAdC;eX}Ba_PsZ%{sWR(7y?4HC$< z*+e?=%_ce`{b}-_w+EJ_S$WeZW#vxD4s8pjPR9b$a7)D)w=L3H+(yQUaA~=Ya4WEr z!!?z4gnJ(9h*`5|rcVgDPfjVMsU;F(SL%}mFJYE~#GQzqqPrcaygWC)7Ggjwm>5zK5p zVN&|c*_o3wCry|g8VpxCw=Ol{>nhizK<;{dY3{wUOI#O|hRmJT{9jd$)@4o(4S}1x zGgZZ`%*ssL{d(D@ME& zs-+bH>WvX9!-!V}Fz^+Af2EJTVU;h2K-GnXh^)+8Yz6WbSUR6`*6GWuDjUZ1pvu*Z zOdhKv0`sdZIg3SyR~F}$V74vrm1D{jS5;MmKlxQv&*#Cc4m;5nb1XvcG7P%@=PUJB zE}(k2>nzJFg*xcTVB&Svj5l1#2JI@WEHAZ|_%ZEql4}(}ZHmgPL0}B4{P{t)x;T4D ziUrE8iiKLRiiHdnmlc)=GYgIWMJPW|<4(Xt3Q%@wCYobf$(D`qG0nu}l>~egxyo{P zqVCly|6i*y5khlZ3mA;$=oA+g=jTB^D#}ZW^NYa*tbKtc6$n9tp}>{ZC=QLR$O{y4 z*kBBN)m3>5FvXBFM3q(P(bi=-OnRtFLtS2qSpc?ZF2@l4Vfq}ccO{fpz<8M?Ep9$k z2wG5F$eCYNT|%|g7RLdtb0%0^=-1tE7|>$LRJ95bGU{C+YL2+FVyHj=7y1@e7A^sy zq0m=Rg)!6r3t>{q7Z&?{iz_jckWolX6wG+=(y53SF-$fgwaG*_heS4i4Xqpd4u-=` z>2Wo(<9h&@Z7|h?QQ^+#SQ&gHQCM6e#*v1t0G5r065)!4p>Te6tL@+vOOIgHLaiYP zW2pu2;sD0jMd;MLl8Q2?yy+IUmCG3wIlwlFaVAk6w9C%IQ3cJ?hA+721s653&N`h6 zSQeTPj&7D=T0jZFXi>0z${y40rgu& zd1VDvMR^O^z^ZCkE_~g@j<2#XCw##LxQPY7(yte4EIU4@hd3C%ypjc4)hvI0K~-J@ zfjN{q59c8SF0E?3Mrr$~&9Ae@1dBVQu@hW?sfYd=XkZyEkr_01q{&=Zk_U-Q4n3@{ zRWV>WY6@M(Tt){#olElRxxn5y;lkpwVrW@`B@?m%FEdH==WCs#8J{x8nsT9)ZOzQJ z&M&skFSIJ=1dC8RjcrE<6=}OaqrzHhY1hYBSYBD07qEOGEpc+mav(Dqz9ij7)(r@{ znN>yfndmPL8-@Ob4{)Y~=gbt{&m7<2Y$m~ptY@?#Fsq$)n=VnHJdju7o4+LBuaeaq zT|&L~<>yzylfhc$(~Bhog_U^=N-^1x1r(ix5v!UP zFz?WS>Pl8&&Pu$uDJz-iL>;S#>R8^mWTaMu-#BN7eOTsCWS)S?K#^mzjk8aN@Ky& zHXM@*-Q}9b!B`0DY$rJJ8s_0>>sU5M?+gg+ctBBs20hSam_Cf-Tm+OC7U}{Z_4IX8 zBxi}=Np$Q5{eH0^EC#8_U~zF-0d|pray_9PO4q5^p|bhDrT)rt%mP0=y6Q@-_b@t8 zM7p|WKS^Zf9k;Yn3yzBS0Cg9M&t$G3*ibIf(RtdwYcwfoeZa0~qIc zCge~6r<07(LbTl-4vNi699!mW<23`GFNmiP1;(C|xf*o4)2s$3C33L{p#9OI_jfGjy@vK0-V`MRt<*1?YUV+ zI5I(Rvum`XVVD?pDL6wwsB<;X8u$ocQ9z=Xvl!_LQb%0L#Zhib^Mc8{nmt^w5vPFI-OtoJ=ZLMuqH zyBdxtM~RG`^0X4zoWOa4GL>ViT2u;UW)`DgJdbj1$ywAT3bysoewnvHX6|7>vjTUj zGvQs+@ytYcyfUll3FqYps_9cYhgGhIR9A3=3=aU4v$z8LW*TJdVRdU7#%UF39L07v z#m?Y<%9>I5~9s*eFGtZjKTI4F}uo z*5n+4ne?$9o94{+KNH%?(NJL;8H;9GB$gyN3TJj3Pc|L5FeFQ`Av%#Q;nLJ-iZUiDnO#FFW~s7xrFCDXZ=Og!Mr!^ua3!$0i@x%VM@<~Y8v_R>u0 zkS4>P^2iJE9i_tlLcX^i*fh@8yDJT>z0(_ zP{CJGJs;{w8~xeV~s{WPHumGqj=R zcPb6O_t0nNO~~pRaU9ZNvmO*wH&34vz_V(s3}+ZroFnte*4@*~)7Qga99n)h$*4@K^gj;$p!vFGDmgR})!6l16ic`XT)#On8hB6c%3h~<{hl0s=0yuDU z0z6y`hH!uu4C4^Y2}^DGEmTl|>OiqD#BLI+5ZuI&OjdZ5W$Rx8snfkYE!E14BLa4e zTHgDFJ=~jRpOs}tX4#fnesQhs@v7yCC-84>y={Bd%HCOao3Q?IcBHr7j`3b;$07gt zECg5Doe_-mX4>sn+tE68tv$}0rH;+5MY6i7ci3Ey$>Y_rab9%`_}S{G%gHs-;cBVx zQE#MIUEeFqtG>H9EYV}P^{NkhN2Ef=-GLLfJ=N}fg;#yEAPd#24V}Ou$L<>O2ntaW zm0551q%2wX2ydO;YC7U;?O1PJc$gin{!t1(wl@o}!Al0$w)Kd$)dQuBXahRSJ{x7* zNEcjPq(wQ^5u(%;Q51B-S1nKt#bx7BON{p_U3DMtv`o7b;^Ms1bVMu?2CDe1Y&&|2 zZD&u1{9j%kmh7>+sl~{pPc;ueJMn)f3%M*!?o?p&9m|sdleS z`$N-v)l=QU^p!j^Mdd$3L6LTqC~+^=tCcLy360ANk7nf$ zEI_}i{hdh0sjW~=NQ$2B>O~~7X09fi_b-k(j0AOSr-*H4>i}^CH!X0^L0~ z)kuRLiVfC=Zb9+K%c(VQ#%isL_O9|~c~^xEYDWpw@+A?6QJ<|&*jaY($+kUBOLFZ} zN}*$QwriJSARN(#d(|nM@ER>|M+Mo$f>%A-R(JL9(Bd($Ptfi5sw&G)Rna;Nn~$2% zJ{XtPcDrnQbf%u6t-aZHAJs04rboS+pJfkFyHGe9-4LmwQRVLZTJ@riIcfI~ONk9h zbZsfSb7eb6mfuU*m95mTZ80W0^4Z5|u`?_w>JNxF29?L4x-rk#sR%|w3)CK)UC~Bu zTjX>JC-yT7D5!d=6Bs?MRW07D?(9}?N9J%Qv}aj#&yXMOoNR3|6EN64Gwr_Fc6_Ei zMo*Ek$kdw6&{O0i%qC2c2fBgdhx479)bpG$&*fz?VE6Z`w$SnRlkJfxIRu7~7OuT_ zvfX>PJwC%u$+p{Pf(O@^N1X}x0n7hGPdG^XON%UZtTkAB)$Q8g!uD^+L|~CVkgr3I z-6zA2UuCBtqK)@Q^zQB`N`m=uO};a|zU*EPGcnM+hLJbrp#@%bHf3Wd8`?zMLN3_Ch!6^qp6IegyhTCb|WTkY`Re^_EWCa%t>;Z)ys#F$>MC2a3i z_eX&G2u9u3!H99tPBwxCUPE+G^<+dA)}S1S+q&MXcENa$!>F*>O9;1wJ!klCgrQ-t zb<(p`8=4rcZ8GzItKf9*uI_H_%)QSls4N{pGee|uXj|PQ^rw=(8DmJD<#gy8*1x@- z1}(j60aU@OHg(9dJJosBr^Os+bstGiSjzrMu^#aMbz)m0)ys<`4nvb^`C*s4L*RQc z?*Hzd1w@zi!8p<+e*nYXn?bt+y1V5{0DC^iZnGN|(tyA181ToL`%M~fNI%T0Hf!S( z$@z_r_SM4wa_;06~v=9! z6yqHatwEe#th13^Yxja=iBs*-FjTNiShsVaFkqjBvB0TFb;z{*(sClA=B)XOnW>g3?|Rh_POw^z&V=Tx6he}PjDW-uIC}v znH5+h&_n7E^et3!6}ms#8xc^a(T}~o>Tp*WNcF3QBKPQJ88ZEpfFWGV{zrFn!TwFB zz{h!#DX;0J6=SeJ7HwenzzDYWW@E5o)Gswu#i6PWe#*d1M8zQrEVztBioJp=U(>?T z%pYo~sqv&8tL0spsj!H`O^FX16lagh)E(RlzEB@0*uy&&a{;s7Sqi*s&~@dQJDLod*ayJM-F{ixK4eI83B8umsfy_D`;fIJZ5nTW7d<9tqrnT8Ri`51taj?QGU zotSrM^&w2smKl23?!uU&7e9}vw_71A*4%b5<+0gXBum|iWDFe(*sH_Fv_prqqa2P) zsOlD@`+h}Y+f{Zq-EVLOJBJPGfbP>~2Yx0NaP(SN_0kgdOtg9$sz?p{c~LFR=+)3H zNcJPTGg=cJp;Nt(qji@0fqe|~(F?V_#JK=Q30`$wB+SMLs4I#N^R5BcNcC+;u3)jq z`0XXs(i?ix!f0#$H6kL_%{{XqqDt1wUOl3Qs+SR^^{oDqdT>SuUI&iuH5m&nTLp=R z88>G){BRCe=USL$Ogi=G6`JMgOV}@v_I}5S`N)Sc0r?nh92)o*#waNMVTcc*=o2@t z0z-WhSF#T;saFp`!1k!5)AyJ?Yz15@s_$1?eLI0^#0k4kw%smM&-G-C6&H)uc3W-L zwqfuFsrNb9UU=9vyPUG>BRGSpoWeHxaAKDFdj)&!V{JQU(EC6|KYP_}6>L!t|cdmxIHXln^(O&pKd>z@V^MU_ib58Yg7U?K)vt^ z&=E&4?zXy}!>+?EV46u_>SDOzvfs(!rQh`VB6zc2wYLR%wN~HNG+5i(s4pUP&wq|$ zHcD}YqbTby*WC8iX#4PZi&}fQ`rd=trLJ>Q-b6}gI31Xxu$ggd^xEB3?@sKvI{RFX zE~ZRmCL9`gAv8DYfTz}u3rp@O3&uNWM5KBIKFMmkm0oJwsHNCHzK?ix_M=EpZzGHq z`FZO^Xc1P=U4f~6xJ6h6TtoFPn8t(+>Wm7&h@FLAcuuo^9?fY<=J2al*fBF?#=#NB zh77qL*SX$|%+euLxeo=L%t(C`)F1H?rtC=sI8A`00U)gu$3Ecj4bqkf9a3hUoa z?8=pz?XSpWDTXm8PDj?SfZ1Hcl^EvttuRhwTd`l0pFwi9UcUcpkr}pQ-e>HdVf{Nm zUJNrP4ys;<8DguG=m*OQW52Edg^H}V+hf_mNI-%P zWKD_oUQV9sNn}Ui*HG97QR|KPiuB7&RrQ{F9Rk}IP>FqojTb((gfLMUQZ(D99fw@x z-2wX28VH4bi*Cu+)hAfr7vL{@Ufa8xd*JrEIp~$Xn6E6!iOmw9S96Z^ff0;_($X%# zo$mux;{5JIC7PnWv)Xc4W^|yoF)$2nBNKG|aa@32#(V2ANqU|@?qTYY1?=q}Y9Hp@ z5Ddc|mt=8D9LAVp-eXlqTi}>yKp^ZIVXrUI+WJ+`EcB|jNa(NcdSY3N=W#|C6zJZ( zyKg%BwG0pU~37??}+?^QyZlcrtn)`S9j&&&XOB_a zFJrf3@Np1B@5NH@7oqiP8&)OkKU+bY5lf?hAX@!w5nNLB0^C1z&+Z}$1Gn(U_VuuT zu+1=oI`?Wc>e8_O9v7-c-QSH-MssmJ7-Y7D{%3|QO=dotukKhTZjzJdda z(vO9sV)eU49v#5`Yk#e}xl5Kk2(v$0!Ijr8oNnEReq?eq|J}%l0Cs?HwQ!vJ$6$uh zY3SC`n13)Q&Mpr+vJ%Z^R-oMXdP#x%j z0pFq-LE2*;t>GJBwP0^fdN5!6;{3;MUk9tTG>c9miZ0hiY&o>`D!UKP`uc%upDZ*8 z$2yqt_@6!vk=nRqqJavFBBzO+rGB{#+PfvJcIwnAtEZr?zqSDVS+zC@f5*sTjjX|G zrpubO#J&}Kf@pP!SwGNI29o|at{x6LPF$c73#prs_b!a?M0LGBfQx}lNNZaUo2t3T zWUb~fK>UA{aS2ebhp~S_KXDnigIF}s+UV@H*uezQ;rb9mRc9$UQOI=1WjMf4Uxd}; zRPjn}LRzB15Nt$P|BiNSradxS+tZPVrCn|5O}B?m*S!WShr*bwPhyy8ar$e|-A>H3 zlN^m5jxn8_tykbKP^_+*m`sl8>X2y#$et;Xv-u z1BtHq$pdQbO1bws>ADL_xCwa^<>@C&P3qpL#&Pqe|%^4P$VTxo|Mc@{R1?vd zAMNxR!$a&^=-g`^Yq`OS2uqH``0Wa-Ujgsr7g`_k`@GEwq{7vNf}#UA!XpLqqowSA zxDH)tNO8)AxTpMjn|i1Vy7(@CmO6y0+j_$WIUR?c;b<877_L0^w9DLb{I3A3va0Qx zr9UvUCXIJ;9NA9b?xLb6(L_EQP618?+~cInLhy>~H$JkuBkx z#eu&u*OqYOeSP#dvb;Y$OCf}_vv8QrT)QJ=hv`9kabOy)ZU7mlzFndXKUhA?LfG3m zET7gaKzL#JAmuJizY3NJK|HXGQCLywn_&!px6ujrK;{Y9pn^jjzg}RuyBtA}I9zYn zTtEodjha3Rt_Wf2LJQQ*XbfarL5_bcWw)z$T4pJnb70opr|lvtJlYZ?8mDeW2AnHF z4DI+wtM6^FxE6w7WZu$CFOMZ3Ll2^D?;rv)J%U0u2ri8gUutvI7cngJgI>R|%Jqfg z1fPV<&x1?BaL-6h#s9dX9wYlPo1*@X`kip34x`dfSt&Zv>4s0V2>03b-iYlK=|fFF07)zz#)Ntt z1Z$a!)8M7G>R}dSh?7mHt+v~94WmS`_SimRA7iVQX#Oia-@h3)37o$UXj{4--z?d6 zc4WjO)8M<}TeVj3K@rzws@)-YW*38H8;AEe4TC?z8OH!cdLK-n3lDSi{BA&NgSKI7 z*ta8L>$S5S;M9S%=0=j#rK?|6i-_F60!txjfeix3T`l0a3(G&-pY}s_?)|Zz2(5GVz$WV1ixKz%roN@>M6+r?YY%t=U!B-- z5uZb8U`L?cC$ZvdHCb1pC4=#72cg%L(Em}V+CkIm@D&JLqTg`JV5|L?<%YU zn0@v4Qhm(&1(pVN2f|?aL))-D9*=#FTDgQQ(H(2i9p|W@&{ObFmy?F3egRJ+8f%X_ zsJ{}TBc0$~tv#|7il)u-69KB$>lnHeYzoj|o|GpdF3X+@YN!(dg^0$MH~_(4YX!T} z;sm^wb*AY=<2rWJDs%$8r0YH8%8Voq&^j~)Sk*( z>_XJDs1)j_UI2-*hxlcX+M>UuarTW~)gJ3Aj>59-1gyYM+p#k^ui(nSDNS6f3%~W( z6F5?RECzEND&85(KwnfF?Opl3-5nO-wZEb%Sg+ba6V!`ZEb^Yf^=Bo!@-7HIS{;hg zHXDr@0)eh~8uNe_=-ptUv|yoCy3pxhA%2VVlhcYP+d+~X^_l6cuMwT2ZpINvOE0Yi zJL>@AuBDIue5P$*%1ab3rE!}e}(pT!SJdl>CUR%{MJJ~ ze1(>56Tb+-A`n%pu4jz;nW>ly6c*klx&w86Rf)P`7`DVkq(ZEPNTWymU>pyYSaSxt zj$aCLJM@5dnj_V|2+iU><_=q>aFb2w{)AuSz@X)``tZ3etWo4jZMDJ%VYNu*-3gpA zsti5&%cZQ0qCmy$%i*o-9iomvr+#&5ZCG3b)_XeOi};qJz$xnx5%8*Q_!?v&!u6PPaK8t_W5}>OOw;EKSf6lyC*RJ~ByUA#biv2qh#vWS zF?s|-T!ZyFMxBpgzoS@x<@71id-C1{XLsBx7r}b$C+Tyd+#2LU{XZesM4bC(+7scn zXX~%5lf6^yHko!3_GB6M2>qWYOqROZsrk1KS&DrL4P!IB>iZ7Rk?WlBijF66wi9s# z2UJBT!uq2}f_F-V0yp9DwB{3TegDUUcqDD;qpTZ1^D*+yM_KoR=40Fq9gD}{^6}<| zz6p=FPA&y@K`OvCoG77B__TchObg$HzjO^bX+1$Kf0L z1@Mba3DJL`{BrWtA7%Lv=HucGy%*_xytJWbfd3X3eG-qq=3}Q#Iv*LFhDVVbdK~y| zU${kAHSP z%Ib&yU+$9kL-610O6O}k`=^ESzXty6T{IsG9$zUIKt-I1TKvoQ4Y;Lq0|7`hbv`5FU5w*)`FmcY=9!SA?>K281T8A`tk z{L*@b=xp%Y=b|&vKYV<)^HJ7O^gmzcVd(RarXK^ZBb4pAEOUuEHZpuga+UumHulobR1DaoPqdhkE(qLaao zuSjt|%IX0+(PiK70Drz3!=&>?#C#=yp^vo$KNo!u_*bNa(tk%^$GhzL-@uQr5-{bv zgCAd^V(8bw@1%=f4t{km`~EP>r@7|uC*aRlKbZ0tBAu^*F!X8Y=ld>tEBL3l?DZw! zKi5S+1%9hs^l0$g@1j2jzpXC&ekJ(raM|}%wtsx6{uyZBGMBu!fInX?;Cz(T9{l;L z07LKMd~(qR;9uji=Uu>`uLdyrtHCcZEkyqSd%#x!nDm>$kB|O0^hEIMRvcN`D9ZH@fHm_@8po2`E3?WzYWw{;OPcD)@z7S)iJcxyzoHb39%2 z>)^*%ikR{ltjlH3|BL?F;G%B*7@UL^( z``5rf)n(tS!GE`l9ti$?6@%e-CHQS}(czRgF_eBk`0*7>&PQ3Zz;BL=js(BWF1kDH z)jIGr`3n%<=1Tt@`V!YCl)f7L=eX!$;LleNnetyjU-)V#Lr*2Yej)k|@Z&3=OnMpk z&2!ORz>lwjGU@xk??o5=I^^f8tW5eS@L!)4qIZD*eiwZK_=mgfy8?f{O2U+X3jFzs zB15+oU7m^vkJZ}BKwS*8i%8eOc29+W!yzEO5%l>Ob2fqWDCEB!^bnzKwjVURgy}ml zUhjgY%8_0Rd5^j13lR1qjw;6V!H~ZfXm&Yih4GpKnkq;7qe!feps6yXA3^_I3A($` zeIZW;x>2W(WZOVf z<(a<~&K9}?;TDK9{3b)*9-vKsw1d3kK%-h+{y*r?bQk>` zqhJ~6AyR$|>bnQ>(xg$o;gEL|(y6kf_d(v5T>0-p_y=6WC4Cyo(}tSyON6{rK%4&h z9{tHVY3NrV?+RD`J0S19pc8~&73BRVXqqh6KMV4H3YscUdMWrn33-!*j)lCD7%ap8 zVdSOGnDUoFR{B7u{{}%`pDP`|ZnBoT%D)YHZvk!k|31k32x!yae}lYFy672@_c>So zVaUimmB~K^<8=t~jud&nMcQY$%y`gtaer>;zd+tLXpM=iKyaPcPd0#{MT%;#R`HqnP5`>L>g{Y{)l^%}r z>p^#v{O=*-{h$rMT8zg(L7Vo@L3_Uh-Cy$eL3?9V$X@=2_N9RCCF$=#-t$45@wy-K zRe?6`UxV?u0kj#9mr-9C%0g`2{xrzD4e6$TK1afHE`Ey~=_lAesKML~p z1#Q}+An!!bbV;aRA3@$Zpw0L`0(qB!9xCapA@5eugN61(-VZ>h2)zmXuRz%F>jgn0 z?U23L19{H|Jy!Bx2YGS!8SKwQe;d6ZQ94R z_ zZRE{_ynH>E(Vrd&&%uQ$p!@F+wB;huP(e+%NBQ3nHvD!&-iwjmPtq@fysJPb2t5Gu zZUJrjo3GL198Qw-`ylTRpiO`M4f3{uOh*10sBa`_GoSh)JR6tM=ikv*`lzPvLtZn!DVR76{vQN+sWVV( zP5*|3nV^k+J_vc~6N9ZzUkrKIfj06_MR*G?Q-5#N{Q~F&$^Q%b>vPa%eBXvVHh2t_ z^hdxr8FXKv%ONX2$8m+B)^MTuy0b6~%v~R)wI~#!w3KeTaefSj>!Y+67mC2{IYc0& zw3QD0(X{`H()`DE}$gHuGWn1* z58G-!Onw5lAC~^$@95h?W6x^TKespH_jM!rE^0*MZsy>J{Bs+% z@3ltl-_?kJ=SKDa-iTjRqxvpw#P8fj=^r&JzphdK2OH%d(kTDHM)E)0sQm0k@}FoV zzpMMTevN5V-yHN&e2vFiPF&%!>WH^{tlh-hJXQ%9FdkW~_y;@|-?ScI>#_C%yFH43 zsE_G`h}U}bGYsO_qa5ivkF|-2{4Ywr2-F|H!(&knmYYXh>ajKmeUOO!;b>PkOtxeo z^U-Hx{dGj7Z)5sn9&4YZACUAY^dHkxh$uInh;kJYzX8~7JK87d2TA`O^`T#Ne!&dl zt!Ot9{I*K`Ng_7Di5M5gClfcLokY~Pjrb7y1?xn&`;ZUF_*H^i1osKnV10@IhsRom zb&>fpVDgE_h>$xTYY*$0O}qx_prM zIfOnX$g=~=n?gjsxx}5Qhj<0X88~kV`WdMHiL+zk3zjt=lZ)xxOS2r$)KrwmI!Z*k z{@xXGrD1)Jf81jQh>(l>K{eK6ttTSi2I5|vp$ff;_z}*)gx*3-LjMbW6v+A#ux`cQ z2)!d-2E7w{j?e+(GSovvd-f1fj%QOU+hd(1qW;s2hm!Y)1HtrMBIKM$M8EL60EOp( zln{}h-Y&;`T%jH$2utVGHg&O$7UkrJ|&n8$BpC3Gi5an<3fbo6~uEeE<_*ZEpZ4 z;Kx6Lb`ZgrudyXA2jX`x)+!?SY?b&uq$AJ{i9gPG*f*X2MpRj)`0G8^4kF6)I|bDic8d53&U}e4 zVEz!_LO%$d*c)1j}zGp0e}?QvHJYo#@2p0Cj(m z{vLWM^g1HSZ)QBo^ScJlgY81^AYz<%3B8->f!znPpZHw_%keu1buQ!+dL9wuR3LN_ z@od;*VEjE;r}_f#_gD$Un@|o&KJ$ne=K`T?n7$VCf{6C-AzleSLi4)~+-Pf^CZaqy z!s>0D-vHU(93tdgM#MbjcOU8qz9S|g|1QR3JvdB6ets9ic{v-%`sR^Fz7o>wJk}N> z^6e*X!a6bl>5*8Mh{%^r#JoxodJGYEFI8xMcf$UBRp{eD%5|CuyB(DT#5&fW2)V}) zw?U7H@EhugsGr}lsQIufMAXagSX4gdyU@phTyOYYi~11m2@(0Ch`(aJ7J598{!IlD z?d5kd>SO4Kq@QN|-S8&{Ik=I?_7jnx-_@w&*as59ztdpE!``I{RtO#?qTDGW^o`%) ztKT3Ok#Z5ec>b2qal|&LSLpG;_^V+r1o@r6Y6m@#^pnK)ux~?=?;4Cd5q{HhBIMjk zME$%sK=s2sB(mQmJ|Wpj=e+`|Kl+`B^m&YjUsFQdig`u^Ki)&22EgAN=H$x&l0WYi zz!Sx+*%Cj8I05=C^gLoq%nPB5h_G8FLRS!5W4#i3J&<;M8}VL@FA?>G4+lbT#uMRB z7ZIT^+lffuFBm?;p~n!xhxab10@y7g+P7QM4+|M=9gvTRdgDg{u})_YZ$Q5i!KaRhapJudEWd&HDb`=14>0|2@C!*#gkDPgY2qZ0 zKA>f}@X?@Q$0CTJqlkwwe}s-B?t|V79Z!7EvJ!+&BzDAn7J3lzGuR2CQ-~-(M(9+b z#|yn4$o@$fEb0Wq$;hedsE>3dfwKkr##d+La3SkIX6Hu#@JgVJuj-zW9=fM+-@SqagWe1 z3LXQpzKZckw=l1X$X`RmxGfWUIq^%hL+Co8PL*KR$G0%9<4*TatNq?32KE7*bI{5P*9`eZmlIA@;>ObfYiLWDm zjqwwDJCON!Zx8t%lz86Tqtc<@MDim-Uf#n)n)mLg4=~O^?)MK8p&!SI& zJN$VskNOwJOK9H9!*t%mqlQ9GB52;jqmp4ygzl8#l;^!XY8do~hVBxiy)@JZxA|`I11w5GBFYJOXxAgKJaIS9#5Qx{uMfdI34RP5&fJi@w17!nAbwjB^JS-61sp`jCDik z658zlB~!TnIZa^g7}!*n6Qj5MRQ03%!Xr8~QBt7UIj;{|UW~ zcplbIp?45pfqy9UZsG;dW1(LpqP?#Qy_fhZz6%rjec~M09ia~pU&r_heVF(L?p+u9 z81X{rq0lFZ;D1W!)5MEBmX!s>xQ7$}f_W`;6mc&6C!ynr7sGxC9Z$T(V6EOZl&nEW7_zOLk_!|5vp)GzEqdoW} zl|fD*{kt3@=Jg!n2CQR3?&cMHBN$lsVSe-G>@h-V3&C&>K;c!S_BLH<^S=}!v&EI0~&EaO)SJ|Q?9{w(9m1vd-6EOTM+)W&egi*`@hRgS zyiPEBfXC!N&yu zBNzdHhxPOpJV)?C!5YCE1s@iCP4H*IZt#o9XN=%1!6kwl1fLfCk6`O5PC36I{VDRf zOR!$>v|vXVa;6U#T!eLzG}j;E>w?DxCuKYF#e%m9o)8?8ME@>L05EBKt?3BgX&oqXpA76`5t+%EVpBG#?bf*o@mdK?k!M!w)ffwcHwxY=c$eUPf;$DD7JOdt6~Q+J4+wrPcvSFP z!IOf&3Sx_<+kvAfjZuPa1#z^a5xhq5MnP<8boyO__X++(@KM1h1)mZ8r{HUXZwr1P_=(^l z!LJ0r5&S{$7r{RS?J!54R)TE=I|_Ca>@7GzaH!x&LEaNdJ)9soMR2O%EWrx}eS&_$ zg@S(-Tr7B*;7Y-(1g{gkN$_^Ty9Id&r;1t2Bg0loK6!Z!D1p|Uh1(yq6DY#CM z_k6N{HVWP;xJ8inK`?#0;1hzo1>X>SNAN?zPX)gfJSq6AARTJ*(0An#vd{__Rr3qB-RFZi#VE&lk)WtPs3RaIGMJ*THhUABFg+;Io2n2<{g=B6vdZ55Xwz zPf@qhv4Y(MlLUD$ zEz|kCS|acFC0-)9P*Csx5x-h!-eb#r{CzTUo8VJ|FAKgWcu?>g!CwViz!7BmIKiHR zLj=zjxczg5`qC1g{e0?=G4DUP0c!MEV)Q*9AWmJS@oH*D&Az1Y1QrbSJ?+ zg2M&R70eO5P_R(2N^rU0HG;PZ?hyP<@Z1=uKK`bQa^wnLEO@ElVnNim(g7Jchg2{rZf*FFB2>Jy}1(yh}7Q9~Y4#5Wm>jj?| zd`<8J!Q+BI3v%Pd{%IxHRtfd!S4ls7i<^jllPmuS&QI2l}e-n)4IV|Ek3ic5kAvi&By5M}lazWlt$MRPR-Y&RRaHrslg6|3* z6#Q23v|!6l4!=%#!4^D! z2H#l0Zh}dIqXp9hX9!**xKOZ0aJAqqg7*miA(+B*ZPa(R;3UE6f`1WQAXp`Mh2YhK zw+P-V_=w=sf_nwu6FeYzRPdxA?=z%4QG%TW69tn6#|d5{=oc&%Tq3wy@Or^}1RoIG zE%=h)2ZBcge-sRhcjW3U*i$e`aI_%rTcrFm1d9YK1eXe~5!@hnx8TEqPYb>(_<`W( zg5L?A7L4rX)Z0O@x8MZ948dH%xq?N4D+SjI-Y9sxAn%7{yB-yMR`3l$-p9!FBZ4Oc z{}7Dg_aaE|EI3kdoZw`^S%UKfO9ht-t`XcIc(>r=g0Bkh6Z}Y!_eZk+eu6^<&la2_ zSRuGr@Cw1J1#c1DA^5c5KLy_w{6z38!SDp9{#JtR1bYY$6dWx$TktP}>jfVZd`a-% zf?o^%BpBAysV_#bi(p^Dp@L@%P7$0X=o4HhxL9zd;B|s`2tFwIgy0K;ZwVd|JRum~ z%aN~*U^l@5f+Gbd2u>BeP|z>?fEa zI9_m?;9mq62nGaK2wo$2tKfZtj|x5`_?qAcf`#rizvJ;%#iPQj6{R!&ao;mRfANztZx(@64KWc4D;sJ>T;^&$nUn?lpVOnl&?P z{_dH5S_PL2t`^)R_^*QB5d5y-i-P>N80G&;&=LHj;NJv?jMsc;30@#LN$@hkYXlbv z)(b8cyjO6o;3I-h34TlP2ZApP{!H-Kg6|6cN$|8F_hU0XqXjP%j0j#Xc&*?~f{O%~ z3Vu;=o#1A{uL}OV;B$gM7W{?aZv}rRcv3JhLF+d{@La)*1*Zzm7Q9jLvx0XDE)%?8 z@F79&CujPf7JNqV1;L*RzA2ay{Da^r!6BDuIcExv5u8ZGd*KS9xi8)Od933LT_f~D zp<9S}@A-N0|AOEe!3~0s3w}lL+eC!>k>F3o{}+OX1s%cP3;vY|{kR{V;fE2S-&um^ z3yu?Pvk(El7F!d*;+|75|-1givZ5WHEiPOwFAIT3Q!3qB_P+XSB$d{Lh77y5OHi^{*&M-!GbAT-(n*8#t1!LaEjn8!5fL-TPSpc;O7Ka2(A)bFSvz>a9kXc2&#Qqpf4m1`e^Tg#;5P-I6?~D1{5c@>n?%StEVLu|f%yMbX#X^=_b|b8hzM6E z^d*AR1gqrv4MKlbuvPrqh5n*or{G4xCj@s85zoI1{e8g~1@{ZSF8G$96? z4~ZzB;T2lXvx(4;=Uj*riFkgQ(ANrmyU=$DeZSBfiO7d1gx)UrAL9Q5p?d{?BKUK` zUke^3BHj;$_Ft;$BEd4ja=|LW8o?&P4#7^r#|8gQ@H>Jp3jR#+w}O8VJSmtrL+f#d z;Q4}+1g{jlQLs*Mso?#Bn*_HDen;>{!Ji5KR*>g;m>>LRI5Bvc#$v&7f;`v5=W_*b z6>Jr}S8%o9qk>-(d{%J3;BN#^2>NGg`9*@`1!o9eCwQBn+20u#x?Aweg5MN;PVgnc zp9}t4@OOfL6&!lG*5e$(PYccxoF~{I_<6xqg6jnz6a1#&bAmq+{FUH)f~N(~yh6u+ zp5R2mIf6F{eqQhkf@=gH6Xf|PmKV=G5nmEKB>0Y??@Il=P_R_+LcxiGQw6UO{ET3m z;7Y*_f{zP6E%-gbR|MY>bOb*X99pUM86y}GoFzCjf7HwhOKnd{ppjg3k*6P;j5%LBS(}Cj|YowH`%+WrDK= zZxw76Y#02Z;6sA{D)@}xtAcL}{*U0_1oN)a@tz@gzThOmD+O;9tP^YzJk+ zEx1MStAfu6{z&k3!M6mD3H~3!f@^gAC4%DxX9!*=c$?to1eXb}5qyw{dH?qW4+#E7 z@I%3K=4!r61V1BKFZht)PQhJ*F9{wLd`FPy=@@UpwHiwW?-1+|>=yi*V2>crc`-cC zV-YX8P9x7bk?s)OF8GY#%S3GIeNE_J5i!nrTj=+M{vVKEeHh2L$^B4+t6 zM+M&(JSlie(DF+D3kC%X1w(>Gg2jTRg0>*fd9q%P6XZEh(qTcK^CZo4p2V4ga|Npf zqk=Vp3k7Qh>jj$xTLjw#V}c!mD+E^x#sxbCy974~b_;G6+#)>B1w(>Gg2jTRg0^6pU|6tR zutIRAV5MM{;9S9K!G(ggg7tz;f-Qn=f-%7k!4-ll1>=I9f?a~@oCNG>i_qHy6M{Pg zcM9$jROclSZnx0Ag8Kyb3my>c6FexG6g(n$RPcSlAlN5(Q1Fo8VZo%}5y7K^ z?+cz3JSAuar2Yto1d9ZV1xp2O!7{jj$xV}c!mD+E^xb_s3}>=xWCm=N3{xKnVKV2|K#!99X|1$zbe z3GNp>Ab3dduwYW~h~QDd_XUp&o)F}Bbd~)Js`F6D*FvF-1xp2O!7{;df)fP8g5`o0 zg6bR<q@B{)~GS}-bDBUmrkB-kR@Cb&XyrC?mJQ?Ofbv)~rNZGs8G9fCUrcM0|g z?iSo5xL2@OaG&6Q!2^PQf(Hc;2_6^ODB)dt)8e#KxtI7dJ1- zJ=1|&?`-L)>u7ISvTSi{?pagI;=0C$w#K?;&5iBNIsfLyrj|h;XyszLFYpq+< z+R@g$#6lJk+zPcfFGCrq(p|QEalc1PV;!xFTffkpds>I2HNaXLTkfj6qoK8}AA4hK ztOYtPr_nB7*1U`b(2rqR>z#FXv@cy;7rV=vxMXQZ^TcaDbJHbCVwTTcXP|i2pQ(dw zG_;9`mWE|5{T_;aB8q;GT=MQv)}0OHdQ!J|*_~PcTn^{Tb>MTFtvk6)8OjRU^%Fx) zbc(g={T^z5{TSi1&)j+~T7E~?pT)QgrIGcBwKa6yv9x`0-4~kMm%1M?1v)z#m!no^ z1LRWH*xcUHdPi$xLr4FosJhEg+=D!YwoG)#y|HFpAGDfntxNjRcc7`si9{e6W9uFF z!Z1R7vUmfzVPt82}%s62BSu(Hzu&k@hv=u%YgfQ}>9*4)wDUxHHk z6FGF7en;z))@3aN0_)7rK0;U1wzRQdW`i_IVr#pYO;>FBqPEtYziMpmr&V?qE*uW<+jL}ZHQ0EmzF$k7pOzoHC)aA=Pl9f@cTfRU;_ax^|2Oc?;-P;{2M zbegg$^*2&6%`oAPHl@9%XT5Ppo66D=Y;0p$0z|s@$kCChngbvl+9O9t$~6Z-IJ8HO zj!e-U0O8OcIXW^~a{z=xd*tXyL~{UyLp*YHSaSe`L(y64(y7cy{WnrE)iB`>-uiE3 zde$3v@XpbZY086Oq$`gc9hs^*0K%a?a&)9za{z=xd*tW{HcGOz0m7j@a&%;}<^TwX z_Q=tZh~@wYhj`@Zu;u^=hoZC8rRB<|)Za)&xnaT`ZAyDj&wAsIHdT)P8N17O04&@3I+9suD`^pxz# zhQo-#riGXiM(QS;K$lKt{_4MximW&8;I02grf0oz2k#smnWj7lqJ;Ly(UGZ|10WpQ zBS%NdH3vXAv`3DPOwk+wlT_uAqa)ZD55)+=p*?bRB%(P0!XX|xI;=SWMh0cV6Ai_s z5#xzFc<8^8imW&8;I02grf0oz2k#smnWj7l5{dT6(UGZ|10WpQBS%NdH3vXAv`3DP zOwk+w;m{sAIx<;v0E9z(Oza~XNfU~=o%2YFF2Q691^E3ZP!%j(ySeOlCyJiLs&@&WSfCv*BS z9+Td`ihnJD}-?(?n z+vC!2nD8;&%_FsblX1`MeaO4!OnuM4)Sd1RFchM>rZgf?<{K*a?04XE$Gac#@|_mb z!SXZdVBBtbGrouKgc~DpJ>xzIH{Z?JpmZblewoWWD`HT zgSs;R&Ve)OT|Gcv67rm~oIn%TeFNkjf;_&vpuBTk^1i|MRJq{R{yShVh>&vb!5_vO zf>TQ)OPAi&+B~sw;?hZW*v?)0UjLm|UalTsN_gosbyr_-|D5WpJszVOWsmEZCvBfr z3Iuc;IL;c6r=iMA-m@wbslT5-jUx+*Orh23gyJt8C1+31&Uj%c?wogeQcBZ3aW}u; zN~A)eL?%@E!cl}jX2OK$Uh>|!z8lhA(d~{WoJdi=KeRC&h;DxuzcP+&+~{}_*0vLw zDN1%UGXg*L9zgum!wP{P&pmjqXe*jQnUzom{Ta^q!!}C%*2c6AJ+xmUV}%fh{S@Mu zmm1f%(Hri1A;@Pds35L2okQZsuhBY|KeFAy4{c|xDD<>$%AEerjTv8kV#JVc>bd|` z>dQ*sK;d=iODwCvgS1$oM;vb~k@6OC+|ny8o#XKFpbAh-lZO$pFRJ9{Jj2>_vWI^?ODjrrNL}|`eKO@rgS2)bQD|pNFFe6S|kth zU3tK~vAbb^kTb;Pk2+Vtc!t5hRP5(hNY@7IxuZrbBO_QAqnkOFa0!e(_lsAL`KJOW!gikr8ccWflF zT^xVa<<@2#d{7Svnk%Y#@C)sdG9$omjd=9_?PQv%!bHhguWwrb9r_l3)n$T{px&as zA9;r_N-_(p^sVB?A9ny9!#u)q6}Bc9V9=yjDX#eh9pIK+fLq|HE_Vzze2^sst5R>EnDcRD4^4|TbNQMk|g(tgW`SHwWha(HMpJ}GDF!PN~HK$p6m z9~0J>iEbN6o%n?&GX0w>ip_8x0(Arqg|7VZ$2`gj_@vCpaeY!A=eRzp=yF`2ly2(j zGNEdaFd=4l7`cmEGVn49;XShypBf`qlfEVB01I)au8#(o&j2)M#u1rep&4WA-DjuX8j`TF2+JCJJwJhrGu zA2H3GLN}R+1}S$N>Cq+p5dnNu28U+IMC%#hxp4TXfNyx{>~n^X@Z5AZMtOeEwWEd( zoiX$>^hdsN__f#4Gf@6zxVd8JQ1}JTu&%|p0$-B6c9d_p=F1=D@eMbDg2TXj?I=E} z0RNCrDgJ^{@SQmtQy_@L?_MJ6k$IKHPtG2#g~ zea3oBRlUWJ@QaI~iHMH!FB&~l1sf4iag0Rh;#}xaI`reSM^ix2AW>dBijkgK-Y?i$ zAYD3~O(~DfE~boP+*?|o(K#Ki9i_D>5wE~Sqm9=&ZY~?SQ5rxtP<1Bn+;SIjo(CC^ zk@pxRg`Y>ZndL)=UV+;&=OPnsI(y;JTZi5Pax60`0^SR#IB&`(dX@|~Sz_Y8ut20! z^G^k!H-0AeQ^@>rXCkJHkZ_CR7{4+GHoYj8Y(w(2^2HB40ljzOkKc2JPj&PBnNG{Y zAHlM`{HZ?tF4Ro?_48-*tN?#(%gXb`@HgLw%(8+$o~amO`9FY=e1G5`K;CLf#eBj$ zC!Y}VUK;!+xV}#B%dFs0-2a*PR~A}%|ACudz{As;Pbl=%1)l}}8s45oR`3AsKjeM0 zU&&DS*q#H-tuiZZy5cK3Rp_6dypIC@H zJ%qWv&4+Yd&Dps6ynf*7cH9kTYRPnlC+fqP1&Nr3fSxBt+=>TQfLbdVLELz5=RWwr zf{~tR9IfD%S}<`pP{Db>7eL_N2EoxBT&v7{9DLKPp=>5gyIui(J|P{7*(3|-Cm zpVsk*ZU&L}=Ml_}5lofpJ*;iG@!bAHM$q^MIELK@4;4uxBN-OQpCT&N^b#y%*lv)R zo>+lq$~n{fh(AQCn(WMB=4l8vpoyK@HoRW4_rD==3B+v@uU*o!=J|uTOCn$ zIL}G2N6@qmWesPNR*LT<5IuS+*gP9}IAa8}!wP&4w?kN-qxp*!o;Mk_O7RHAMAGta z#ovIxp#MsyzkoPQ5U+p>QLwqSk{7_7PQ z_T0{M3V|)uV%TVSlrdkoFw=)!2U2P9Woj^tKZv5V_%bCA+XYf-vXz<)E5aY8%~oo2 z*4y}_if9`ppLGTPsKS1Vg?&~NNdEpq;48GiF6+a89^|%@S3*69%Sj@{o^XD55D0-fEML*vo z;(K@2*MoUa5fY%oDiZ-u*=fYa!pVQ&RR|mL-}qzsgNQZ|4A7_KEZlqc=Zf7bnLwXJ z&Syl<5K6A%v+ui}F1XuS}HAA!Co@GAa}Q_oo_BbbRJn8mINhgNa}Ji6i705ZBl za8!{?u3F$8I2z{>@iTw{hq~C3^MW{aQ5G-OU|zHrbKN-i#s&7ci|xiXY~ZwIqoN&| zJTW{mVvlQUyL<5^vG%2(Yi{hY%geEYr16gF;c)Zh>C?j%jd;U<$Fw^dakHqrv7upV z!?bWi^W?^htvNF$-Ltg)u1PHo?TeQ#xp(QZI=;o3^zN=*NA^7U&J)i$&p+n8@aQ{V z{raTI;mPdrULEQ~ib)UKMGjrVZ4ONr-ljZ%%scv$?+*y$U z^klrPc8LeaWNg9c?=uDO=KK3h#mhvO&-`nnb8e{Oo2Zt>4UKh;9V;wsTfw zf5s~@GRSsol1rCxzbl^cML%|3TWw2G%>A;!u;+4INy+kH8*sa|9GO)CG2HIRm~v5I z-&{Ys--f`C-4JP%R-5|N7DksyY=2!IvsgSXPnCYPWpSBn@wSfMDsh-+V|Sv3{l45p zsG*KqYgIrdy{>N7{Q0wPty^&IZFA~sZjH{VtIO?xQ2C<%3>L52lKT;Dmd9Y$x!sRQ zlZs347tC_!wl160xN^E*?z#NA1K1SVAi?@&a{pk+xj_P`O^$;-P`gqsnoU!4Tf@B; zwtic8)U_|U(~7CT+$E2#nt0w}wKw0P^Se{L>26{3JjQ$fpR_Qu zE=2>TUItqpyp^%8LW6awl~<5IE9e>G9gbEyT5LI6z)(N2`VhANF*5^>A1DqIn0p`PjZ1KGW8cmF;cS@X*7a zhrDZjo&G9*L#vDr+oR&ri~u|FPh)hC5>&%o0@CIgg&k%U)q8;eOc38la@4e;LyaRDHA78 zoH}vZq-FOmYhSvwW76_v?UO{*B(%MkU{mt)6_+qnE%v=H`a{H zzfc%QS(+xcFe7snOVil?%cg1>D0K5iWUbDFTFHZ2_L;Tl#%fiUTC2O#T9dKMI+~iA z?|=k!|1SBBC`>EcS}yNsZPQV*Lg5bM9W>=={cw~)yja-&fE9oym>B-p@&p0}Yw~=1 z?!PWDGS7Fwx-Q_k(F^g4}%Qk`98F+%kw>idrzM4r1e3buj~HR-e5nOTRon@ znFYaFdA{U*t9=R2YAiD(?|Yu1zwUWH&-eCy*Wre~xC;bue_dcSVh*eeV7C6oeclP4 zKrqj@3*G_WtmLypQ+32k~eQG`D3AJ-h+YRzJlii=j2@%n4Wik;G!4Q^RD}zSA|Qfa9=mU-pu8<{&@O%7Y+Nd z`1^mkE8qHZKf1u$+>ah^t?EaQv^ZbPU1wRFKyS%<47XN-&W&S7TJ4~@{HL$8%#A`H zD~IdyWp_(xPaj?(!j-nUlM#wFhPXe9}50bP@QLnzmIkZ zJVUTV@It|`p!$7Y@LetRJVEtc8Tj8%8utF6__N<+I@Nb%@SObw>2JvMXNCU0&_5FT z6`}itJ}C5Wh0X~5d!f0CNB#dMw1@QuG}pmt-^E14J4TS}sida}aygIm9Kp{Lk&Y(8 z4#D+;3Bm6Y5s&&kT%h`X3Q&D71^A9U_p)As9xe6r0-+}o5$|N7FBf{2(A7dmh5oG2 zTq~r!&k4Om=#_#PE~@9;uSWS#2>n%|pB7quUj)z9_eCJ@MS1?RJpXS&_5BdEKkD~$ zk)Mw6{a#Rg9|Up&Xm}XkaKSPn!m00j0M+m10_(;9Zovlxw+ViY2z_|59FUC)*)Nh- z?HUlG6irt8+eCPl362w-AXq^}y=T8jtRzBMmEc?=>Up(bl!$s&Be;-=c-Suz>xqc3 zNf2F|Z*KE$KsfnUi(JS*h+N+RSZgx*0!JO!+`kjs}}lsA_M zIdw#YSHJU(aLZW_!2e0#CHP0D$YoK(y%v-GJi$L1R;}+S-jAF+7wP?0fYh>B|MfJr zq%`>YldOjQ-<`@IxQ{Q(Er?V?tfB4wM_Vl3iew_ zgno*47mz--tz^jgavXW?w{S7=XfY43@XUic^{5W?P0cN{;-Na0g%d{VKn#vXe8Q;? zHXi@vwFvbc|FhSwi_n(4JTUA~7sr3RNAs#KwoC5IFGLq`ARpT{a~Zx)c)0gDH(_qU zHu_>XMo&J{Y~LU+yU(8OEB%d%MjqQkx4bsUV>3p1=xVa^IL>$L$M%`>%w^=+@NmaV zJ;;|2$II}Q;@%zaN>{w(H|fZO!tQvR@Qh*2W#sWCty|s(mpsnijl8$eZoBo1;~C>4 z4=*E+<2ARuZ7zA}2D0*IL6}>=EtL2?;+mxIYIZx`gz+%ASgH$CB4{$|49)~ZE;#dsr^ zdG;sJZh8D&z8?5d9!w%DFMt3HLmTFG0P-44=7Q!kx*G)z-z8_`%ntm_W%y3uhWF-L z13vd9aN-<-U6#_Sa9aw>w^YQ<7&57V;d(2!stk?)Yt-XXx9Q4$pnz=qQ{AQTJUh@F!Jp zf<<3zIz4d{XMG6qMJaz?2JKyeh4>aihX}%Yp$E#TWCHYHoHvUe7S0@$B7Q$~F*;b$ zWQMw#_-sVQHisAEJ3i}@_rgeH_bQxeKpdWWghhHiklPBm!8p$}Y;h()cFY4Fq?hru zd|t;$a7Y+i=K`n(Iza|A>V^BL2K z0xJf+Mdp1XZ{uRT2N0g}3<&Z- z$?uUoTsJ`eHjz($xBR?b3-r${gnZ`Z zzlwb3-CW4-S4PZVIU|yfRh=-;h^&(HJg7`GMM+XBb2OeGwzo?S!Z z$8Wsky&~FdCCw8-(GpM3o6eA)S785d zItBJCj+NZ%1bTmi_-a|6C8xt<)2DIX#nX-BA@--!-frm7vpNl1K6b>b^C^9Wu2TWT zOFjC=>UgnSd(7L7vsm_4$7_8yg=v0?$Nr6DJ&f|+bYsSA-I_w*^42bq6SOxvGp?{y z{q%UXtj!{eWg3L+BGkv@n_f5?bA_2~!UT1gg|0BxaKv@SjTsY;>GFiuC0p#RXZmcc z%7!0x{Pv@c6<+Jy3^{&#ty5&Jb$UXtr#v_x6*>RKcZx%6ozTebjys=M)25Nfr%(rj z@lDB~t!+7Iz2SToa*A=@=ExZ2PjKUV%oEma3+W?YD6~=4xx(&^4%1a^KaMzgK4*TW zFt!%wuU02Ri1TOatj<>WCo+NX&rv1|V4GG+9?p*;|F?Fbp5ga!GC{~=d9$9g-ZH)z z;%1yL;7m_X=#7-gbCss0FTS(4_$@41-<(3*Ske;O>J-{PcUq$Bl@93R3!V+Xk@7>Y zzRG%U)bXhCqaFyslosPTeGv7YS*zsWD=&9q@%X%mOnM%>|7l9jRfX)FATG^*AN>Ofmegx9Be z-&gr^$__6|myb-OYpn0P(d?_geFVl7(WSBPp z)cF2k;!+>Z`Vz|lak$#BgKWb#={786KLMM3g7%O)diwN?;u!Aj*~xs+M?eQque{1@0ds4MZ=ifjI^U2%DOV#vrQz@pXl{Jj=C~0 zg`r|eUR+7BDgw{FQyN4(=oSWnRhBJbE%JW#` zPmbR1TshUkdDNWz)qX8Id9jv_ando?otZfQSr%H0JlO~vh3pu@gi-gAHrh7(%>9|6qy2us35M3Bi(?Ncc_E|$eOn51yYUmC;~S9U z&I6PFBA2}QeY)RW3AxyQnvBIZrpuvgq5ZjZG2{=mZp#!{>yi~{Uo0E1WRQQb>;;4D&kK$A=uXLix@{2$D8k&@dNt-hNE2OXDIZ9GqZPN zx)5QD!%v`GXC*^1mM7{E?8t}yYFHRH?b&!Vfw33cd)jIUX{22h#y2`ey&Ik4nAX9J zc`=qrRpe{C3e42~gR!eJ=w-&6rcIbJjBUa#DcFS%<1yc#|9<*dF?5=V{6rg*+KPJF z1bJ+yUUSvO8ptwfQ+6FoWZq@iZiKa-aw?#og}(kVg!iCsLaz+%EEeC0bH#~F71?6O3PcDp0I(bBbUjLMHAL@KH^km%*BW)b7?MHh15Z;G0UO!dWYxZ%y%XNOa?Tl$mz>bPx z3%4uYS;;)48G6AUV8^iA=R&_!>0{b#e^V`Xe@ns&qVv;L~GO6at5Y*uVPfjWgTB6!@-3h*q3{23U=5C4IFw;<1W);NYT zqzu!> z#-Pk!+r={rJPG01eG z(Ct#WD-7eJ%`okZ!=#&O2>Enb-t8(M3t`>5yKMpGf6Ps@|K+%XHpDoz?0L}3D%dCE z`$t9gDzTFu8QXsbvigu7&a0uz^JS>REH~39u^zELa|}}u?n)NKW+mBI7Fh8l`%Vlu zj`4X}d~KTjH1mROsgYs&>I$?aCe0``HUA8YZr?V#N&ivmnsLSww`i|yB|>P=iR6`<)GOX*W>=@NZ&pgzhCUCFS{{*H+e7zJUpB_ z0glHq`C*;e$gN!K*qXrHz%!(OyZ3KM zgBNQJtXG{bS@;0}wQdlotxUg$@o~s{5_Z2JLw$#!E_gzfNtjkip~d<6JXKfbLQl&1 z9rQEvuL{UCwz(I1=jla!kkf^*)d)+Px^4&kJH*pRKhRT9Unih0`m869wxA4x)|=>4 zIhK7h^-TV2sf*G7cXYqzly|RBw}Gz({n9w(5&QOK;A2}>hPEplmG&!|>*x9X4?brb zqsmI2!30Y%*2mh8w8i2Nb1WI?SA@2(5bFjN(&yF4{AIHA!=`*HWxnw+e$u`|crKcf z%b#(0Zt^Fl<{?|0if*jAMxVkwWUDhIM7`Ileuwd8^}zbuf1&K?cXS;4zqNyovHS4M z*oP{s&=#jGj5eivRnqG2Qe|o*eY=V&qrYuj0X=CO9KUtD|N{lnq&>ygf?H!l?m;}5NwIIc@^66BQg(Ybmjd)*SH-Gz%km2$9gdB zk8VXfztJh{-RN+QmUgAnGcPj%>GOoq|`rh&TME0vL*_`*7a#dlaK6z{7 zng2!K%``%{%#hG4@8Y#kftnYB8jYn3H;wZ#q|m-^Tps zHOyVcBrgXJw=TfC!)s0oc6%k}$~N+{Qq5n-Ca;9QAF^1dIsdH$9RNK`Js*>t1v(G( zY@ug^&If&!&{u)}q_%=>1lv!x4N1&NCaC<^?K{)O@h;c>S!Vkl-|h_Q-jp07X|?N_ zFE=H7Ft-1BTByBOuh`&!7( zAYZ5lWl=WAq^x_C7ec!mu1A{y{yfx+;_#EmC(e(zIw9CAzKewSJi7kPhCXb^f?>3a zVT|dae^DIsW28^nBI*;?s8qc?D&z01qNAyo2QfcjyHU@2fwZvh-h_F*Y1i!wbM`$O z_Dmby4jCcXr)52m+=B2NGjZNeIZTsf>oSOoZ0f@LWTW1*O`^TGKrh;IK6Jbdb$+4f z_bt(n?af?-r##BN2(~;^c;0gHOmOj(K)+tZLmRe{C!X#^Y8u{2v0Y-{b0)@C%tyAh zte0MEj*RoSI5zb1BTYVpc^_l@p##=2SU!i~{~_Ww?W}4a>vj8Bj&fk02Eu4Zpaa(~ z@(_`;`c$0aBVHn2L&^royL7RZK598{s&I+W{ z%+bQ#PdRu6e5_LB`&?xhhHR6MuPfQGE!d(Tw&oAzp*_!2?MgA|pjC-Aw{_5e73S#c zP{s=~pF{kmBDdBhx6mc`hmgzsqaL)^V#r|mdb+Po(mp7&4Edtkew4*c$d7;5D>A8f3!$Ma^2^`B+cbH7+~O2{;}TrpqE z3Pd+014uv1W*pvka7}^ryCt?U&HBjrR9%N0^5GNGs&1B}tU0!4eK+}TY>Vp(9B>H7wd9Ghmlc=~(O%lkSVC-tan&OX*RHO1 z^$St(n|u`AGV@SoyJVhmy{k^~{i5OJJcG7a5k>m~o5K#~qGK(!yYTnR4h1l;fJ?xwfUAZ(jLhY4G;V-f30DnQ2^WUroM;ci?Sc!#mBFC_ zv$&^v16&-g9Bv%%F^}Qi8SXC+!*N~{N9WK1R|CiQo@I!y7%l{U&WU*SeCJbY9#bgq zJ45WN>-GG_*rO$V^}kHdwJGE9-9OsQ1Zy)SMtxs`Jv70u4eyItk8T*@#~d||H8Wjj z_UGv~yA?8w+&!PlmEUr-3CJz$jbF988$u_vd zCF>`U)rGLMt;0`jcm9evXGuHBew6D+`@wJ8G4fK+s~~KXY5-`DRDhxVYqVZ4c} z5r^JGun@dv{{T#(WCL_zJr1J&x%UvzE|vW*)blR9=sq?f$~?PCt*7vtj&1g4rz^JE zDGER0gdsN{?-@B~nu@*vW3Xe)%P#PY3vX7>y?FP*=jvOSsIw-GjJv2JmqxQbrs{_1 zb|#)%J?QVErq8`8gR>t6tFfiKz`7~bfxeCM0w}XCe7lkP@gnAXd(hW1A1`Kj$?Ki2 zzIG1uG;4^BuCir+ZR)1VhoGLn4Z-}a8DXr@ykr-?Vaa_NdyBR^>k)R~SYsz-Fm6*$ zZP2e<@`UR$N-o;OZs<$hABT(;kY&o+j9Dn7iL%fRF^nm1#68|Z`OuEJ4#+(YbN$** zzu`(t#elSUK062RWvpXG;HB(sE?)ltUMq^cV|pe1<8QA_UkF;+6>JLk1#X)f1DiU4 zK8!Zywx_*~IzRL3Hzm!OcNh2=Kj~-PI#}BFW+9&A;Ne(ljFjIPS+_fUK`uXxZl2Fp zrr9&gQiZ0@IDbu3;Gb)t-Ts^0_#{6?jN0m`*=KQ#U6Ev5hwNkPtj?W z8IQW+oKVlYaC0Vr^waif!?gGOupSGc={rWdr$3+bnX>!(M5-5kCDZ+5k&p6LDubRZucHIf7DBvC z+Z^Nz^S%l)OR-mC?#OP(hdJe3*m5!7`QjeO2@1BJpUB)lDUo@`j;EMcJJ8pbM06eI zz7WQ}S^8$y3Cg1^$}WYRRagV^qAXU06Ju6EChk|MbWe^u?6=t#3=uikVV)4hUMBbZ zlPd5q-h7nb?_6z%NwYzwxzxpL+893n1H$P#esiXj`2#-Y&94XK&HES!m~ziUyLbco z_3^jQNnfwV95?e@xYu>ncRK%taoKJeN4(*(gB`AM1mn9L;V9=apr>|D`cj}DeeVf0 z%4Q9b-^l5KTLISww+jZFfNO)RhYP};@}WNlvM=w&{cgBzaD{LdX;h@0a9wcRr&n4>Nx4sR*~j~1`q#-a*d^=a4JiLZa*zF<1%0cwJAL!uV0YZ_Lw#v~ zy=W))!-fx{E_y<<)qL28e$$WfHuW^RU&lD(x-VpyLkLrbFl=kQn9rKF#`H-h+>Hzu z)8VjRCv!d4J*XG^OPsl!0Zbl3e{`7N`-RLskXa4+0qo})X01sNjjc%^z;mpzW_-xQ zpuKveFT4h&I4`pw{`+E`POshR>gs00mrLnmoIK%Z>eQ>JDAI6dXqrpG4pj;7{?)dA5QwjXMY6_Trg^?|=8%$Zv%6B3w4V!?P2<(1zpzeB&HEta?^Yyi@HnrELb; zHdV4dY<3Exo7I{I^Fp^>H)R5N_7~U#zAvuBuIcQz$1sewNZQxmUHNTe9a7mV+I-4k z`jcY+wvM^$KdcWZi(|)S zO#YH9Ka&{m56n;6Xnv^IiGGdyl5fl0j;?+Y+o=YICj7_)_2P` zWo?i)fph64%r7Gw>&XSd&|A(~NXxYx6L3!2oyhF&IfycO9cvKtGjrfy_SjOejmE~&6)Ey>N|I|myljX>L4lK(q>w%-J zL!VTZEJM~W)-%>EU4|$})G^LiOgXZgO&iCu#N6p0mL-~kV=8};7e?`8ZqyElI-Qe-#c{B;T!~4@{<~@u9RR0i$9m8flp{tVI z0aGSyYXNy$2kSljQ;vMmL=NOtwH-5wa&z~akT5uYkuYwo(HYBU;|kD zLwVPBa(p#EL%VCmo`eIiqdaRXe>(wtZr{Q_#7;H-<2u$s)RUUA-Hr!wZ-h>K&i7`i4|7@d_a49!jl>aRkX+??{%CsuKOj`1Rn&)>}T z%z`Aw<4h~pNm&P3k8VR9G;wbBNyAbbd=vQbxkUj`|QFZ~lr0viy*=E#?L|wNzHrfgsLR%fi8fRz?@?t*IK0~jY z%~Q4?MSITQvruglZ3%JGuLjOzU7rq}u{4#y9$!-rS>OH>`-|p+cLm0I)RB2ISi70e z@wH|8OVn%RyV+yxM_y6a5b6;INhOrSHk;!bmIv=^!NYpSwS>9zF&~0|1>)o!jpa2) z<|*Sawlw1r&e<+h=StW&={1!?grUqWt~U16z;O@q-{|In&gR~Xv3^_bQE_ry{E;!1 zymK>Qysq$8eIm6I<1Y3|>m+_-V=b<66vx*ld>J~sVz`qSD83JO1mpfgaAwVr^OG{T z7G&s2RCY7Q;=H8Bk25TAoX6}1%`d1%;jq4DHNk}urVP%4<9vgc+AEFUL#e>{eg9gt zQI%+i6M9U&aR$bKa?XYOSq^q@c6MUz$n-l2*P4;4GhvjejWq<6T_F4mrx)eH{q#_? zgzpnQ_9CotqhGOmVRsE_M1PF;UX=G<@S1UlpW`-+%lQ6%pR$7=Ir}K9yVtZ^8Q5UK zp|*XggYf5Gz&z`kB;PUa0lhcMwzV=@R=?4?p}~*!@_2F_o>?)>+3UH->T#zO&x+y4 z_kVq3_NCC4i=GQ$tI!ku-x$2dv%-x^&oTCE&e-s4PO-f)-G?};@ovn<^C;dknE8@! zH`JQDn)jQ%b#EXanP;Z#V^~izHjBRJ7~fB^Zn14L@1lM!VJO@EE{bvBjNLK5>#(i2 zRlmW!xfuIy4|aDV-+EPEsl83Ow~&7<2hN`Yq1Vxm%uWu8twwt=PyOx=>*yim7v&D@ zX9M-oq}4QJ3g!?PQr^t>!T40fEh(7PR`{#A#X;yo`F)5-jWZD^X)AwjqkAz`@)-&Rv7QcF0(Rbe|M;Rqtn(1p8DK67-i(yn9uV34R}|{TCZs*{g6eS zdy%d~VaA7c(q5g+53flc!nlO+x^ijiaA;Qg>ys0yHRylQHl^@8GV6bhK8y9?*Ldc!E7Kz$1_VHi{oF|wa?4=aX%0EFYsp==G~!s zV(b;G#@Oo? z8GF^z_AvIUC9TF@Z2Q?>BK~7Mb3^-LyXkIwJJ8lscg|@|nrDK)DCQosAr9C9$7~$0 zu@9LnV>QIN6=Oiyex-Vcf%qaG>+Z~_aXyOn&2l=0_L}|0c*$o|XOFttYmASxd1&e_ zb>~?d>O6Ts*nJY#i#~CO$e-pa$IW=&uN>>y$K~F^qJQvI^x@oy{B9G*G^uKd>-+(6 zRY+Xi8@@Y${dI6#;LP4S^DZimjBkOPO9untJElq)U^(1zxFc{|;5NYV%nkdS1Gw*n zC%*1%5dVbuA!kwJg z>nt1@S9w8xvv!O8E@(k|*?tV{|7#?@I@5^} zYh@1v&b@lqI#p4$y(qI&o7qOkhJO;L`+H>X;+qP=j67Jd0u@A#|xx_qU z+nX=`LHP6C7Tc#0uCayt-PSDBg@cgg88Q#`!`jNdC?4$P1{NHaKyHFJtCRw2xWP2V)JjR#}0#O<9}1k$X)s5k6*# zu0dB`93R-9%32ZIFRpFUZaL2@#Q9*q?ER)ry3LELIT_n3+93HVyxr;yi63cl`vruq zK-#wr;2N z7@Yc*BP{(tFZMA;=9@NTF#LFgp`2g1Fjpc6RsYv25upq@tqddywuoX9PUfuc=deC z7w0;nWxaf+C-m}}_&w1PYA$HitGOWjVe<{Rf7x;W*64A(2T<)MzxRN?p%Y~sz?v$@ z{ghY8c_h}`FlHOygm&OnjDrUD6H(NE<`2t@XHi$!Xiw|$J^|;vebJvgc}>{cU-3XH z5MF~eXiah_#`_lDHNFETNgN{0#C7(GIe2;rSb5L+&;TO{SQ zy=QhRy`vnPjju<0zi6kp zed+h$U+8_z;oQuNaHtko?|&U_;5_vW2lKw0GCZP#k>Q6PS$h#3CPRm9kjcE?3fzZr z&I!cr?#sN;foa-R-+ykLKs~2F+e!C(UZ$0KVi2-ZD_p#$Ecrb59{#2be)qJX27D~@ zlahYZ-c{N;-FbGP25kc84BT&a3YpLZw-7FY`fk>jcB9_!gkw9=1~(TD^ECClF&6l? zz-@rz8Gp__cx~$R<;K{R91CJy-r9U7_FIgC?G&(HQSY6o!^Ppp^}Z3Kw-o6*pz5Vp_pXBqVYy#;F@iC*gT64r|! zah}DuJ;K-rtG9R^@rH=i#=OW)b+|l27?pK$H)tP z?U>THC;mbOZPN}%(<5x?h`z(Jtp#jvB1lJH<$=@)Ut%79+Gj-fPkV2TF-PX3F zcC;Z~ep4cK_Pn(zJ2o#}g!SQ~TfiH#7I-RGVa~t$=y8N6Kkcw*sD6)Ii}lc*n=m%7 zgbkq{vA#85nOhHCi1u~E8M(20=cN8^O%H67V-miHY6Bm`e;eUV9XvIFpSIG2xzSPK z{f>+G&_Lc;B6Cr`b!>~(i9Kr@odj?~bfd#{P_CQodU3nMH4-a{2tJj zE7_*5!uYv=-$vcy2(vuwQM^Nu$E*i2(S`J=NNx>0+rDs(2J#sf+wPSr&GS^6nf4d* ztP=Jw?58=OK--z*9J~{2a~|32NBUOC?qvN&ItLq58hy|Xz&4^8G(9DqiB7x=vyKsW z!l`}?&o~Fn>W4n`{-Ju0BF{-;FUL>gLvr-%X!qg;IT~ls3ZBkm9JzJ{ZCVNU7IKdw z(=owgt>;{v?bF40uUIo&mo0VN?boV;lNNX3|$*;cRB!}hVE=AcH+cI(QMSG2JGO6())8B;hsESed zTQd00MZpeN_?kh&o4GL8D^Le8C&YPujIm>`aJLQ;?&Q2zou!Do3TfwEX{&o-C#FAr z5PQO{hIL7PAW?X}Xo*63=SR1fm>yVpg;hYBQ4CV4&0PVdL z@6Ksoc9iFDc^+>)#-;1i3^VZgPw|5fUX%~p@W0u?H0zqzilg6p#o-wYdlPiW`)s~H zDMsC59UPB!-V+|2p@RRlP+(jS<5OpqOL$(F=h5=<4V|w(gZ25IhemowV~mV%I{ny( z^>*YFe!Z`t@4W5KH<3?f?cC%G!*ibQ9nHC-ey_RnKXtqXD2s&4)?OcAYfDg%g5Ecf zcOkVd>j$1d-9LeR`n~Wn9*k=}Gtt*2k^h{xs`xOr=6Zk`x3GLneJvUw^CV=R{1}>t}z*^6D-vOkbY3zz(k3JRwh*cgP!` zX=|CMY$q-BIi-+e?1F7_@nlbCm8>5y9VNpaz_{v`R0QwRCj|7FfSKWqX`Tzn%7YyC zLo64LanX07yrLPrD=N9O@E-1GC~&v!pFw_`ww>eUD!d!yTH6HglL6@FyNG=i+KBvE zGQ(#)r*J&DFQwKFF*oIVT3;BpjCW+dn0`mb_i0}2ZEUeSomjZj>4>2pg6pw=p7M^< z-z(#o)E|01fVD>--WL>{a^>OWNH^1OzCXgWSEFrY-f(|E?Ya;AR|_BKtS0@(aQ3Gf z`ZCSPSLuUU?(UIciwA*e{ zkngseci6Vj2GK5YtrvBy;0^e(JW(G~LC{;!KTv< z+L?JkIpVb9k2wD5BWN2IsyPAXhvS2>`N=>CbAtMN)R=!G=LBdQ*uQ$>dW;!PKILpi zdTG}fR|POP^esYt;P`Af{OWMFr3v@LP+w>_pT)BdS9yOQX&yL6VmelEjs@LUTKJX$ z+LP~lt&&PtxX`nRJf;nk z?<|ZZcA{=^td|e|PS!Q(W}(03^EI$Lm0vdJahNyRAEa->m?j*1${9TdbE5FPw9P#g zGB3Im^PIl=S5u=$VICJ=r@lkrwI4{Cw(dCgGtEI>79kEF@(THlcXDq#XXAc7$}kRp z>dpT842%H=_B*uGN`!~5I1kD96n*dVyt+5s`!4fzS?mw*;C(N?KicPXL7pdu_uApv z>9g-&n)*h2BDD_tkua`O@4h|unsgkpI5uK^@?Kn@X8-dr`k#}iTPd`~W^BW8pBit- z7{`o*jGexMK9hE0hwe;U^F3qIHv`V1fUK;RdRk}=pB_d#IHnr;cBZ3m5S z0;qP)-7c(ve+=mwi~S{>w{d?7X_Ys)|2pE|1sZ!Fu~rvP??SwP`TOa&HoNlc+(Gh- zd1czMA7C!h4BfHc5jLXtNa+0$^HckfF1E#{U7S9Mta$8!^mf$8&6xak!L5X=hvQg; zb`eM0_AYD)?Ht-(J?2;6VzTtSp5@0j@hEs`e>D?7+Mb)fhP>6$r=0Nobq?ioEs}D} zz3Y(Ax-PSwoB(<(_sT(D06H)n?K^O5BQGS5(*w57BTMiY+ao#uWth+b7!R5<2owld_$KmPlml(q$OYe@;={@jWz6;P@ z_Q?#?Q{ek7&d)xJv$@ZnR%dgMOI=K78KZyOX&WJckY@BB_tuYl_S3pk)X#mIuD>=# z{W+fc^H5KIiu#%U_v*(P=QKM-{j>{R|CyrX_6I!mJE$i+Mg2_wd-dm|{_T#MkF@^v z+N&!?y%){6-VN}#Q`F1!#Cp9t|Ar6W?{w>2=;`xwo^KV6g>UEi7RT^x_=^Lu??Hqp zLLNd6!Vv6yH$pGMHhlYtHX8Bp>+s|VvczC$G7AAX|;GxEOHog z|KZbVm^0IGZz|A>{U`2EWx|geJ-9!Fd*o)I=QwqfUfXlL8{a~rfBUoBZk}f>!1pWl zIOZNS&G^_bpBv^_=e<$3J3Pd-+%fp_z$WG^00 ztL+)abMkMW1wRIU|BYpNes>D^UN_JOmLbp{0toa$u;~o)HzJKE(uVmhE_}N!^3;jY z)sGy<{oc8%4&3*tRWd=w&y9+V!S|I|?y=zj!-(Mzkd3~w%3pQa7IIZ<0BYw0JL2LB)A1}jq8coQo?SS7$r%xdLEA1Kbng?V%lMrg z_;L8I46X^dCYun({Za6xY=0X)`lLDau@m1he|(&4k)ZM8)A@LZ0^el9_aL8;bvt=> zRm6GndktInL7!3gTLKT=A@@eu#{1Aur5NXLO&WcY?*&l@X>H~5Zcsk@>N4=3fH)6v zHbM}vgZM4T@t#qRe)$;e_+!Jgt1Gdt4&z)rl>K9jg&$)d`{UDp0v+>5BP|S{pNX`z z;G-uB@g0Q3F-{w08?)VKyC};R>Mmid3_^d*JBw!}K7xEb4z!I>_vFL(WvSx`=m)da z`}zA(hGkRLece1&Zr4X~eozZL>Q!T+`yD)Mf-{nMY{G8WASZwwpG(~xjf#%x}LPQTh|=;YTXy-6P`z)eSQGr zmS=pU-~;8mZ;-dgeKzZz3-Rv>T)2RH?=H_icMqiHFTYBS=_|pj)TL?itc41ZPu+0b z;~S7~?{aCr<&kZ>hlV74nD(2i`3$rB?R&mI#PXl<>}eYl^n-8UOa13v+NV8j;{ScnZIXV*IOYF0IgT>A zkH*1|51=e<%6tEEXF}N{C_{fG_hu&apXB$77Q(JMKd`KxI|{=1-ni?BZTQq8&}m;< z@NnEVeBD@Y!EXKod! z5iVkaj3V$G0F4M`7RD7q9s-}=>OzPj@P8)^A@Dn>q|HYe1A)(U?Lp{8D1kg%5t<=S zErR||s(uE%2xY?vOCe_jAqSxw2M28kjR-Xeix7q|IqgSiLm0-s^bo>%q@O`(1H2mH z0uF9ZA@m?b5z0{?pAE}F;P;jq$s?e`9>o0!yO7t*02#I-oB_;d&-mN>_1qE9)Aqps z^DGc5nyAOVQNg*S;^e20hH-RyJm4!a{(0~67Nqf>AnXxmR(MtmFf=dt{lGcLpgj1g zw1<&~bH>y9{%s}rEFz8j92M(%8fiP-@icmNe5`Lv7*E%&dGy34j3?G_w5a#;d1g}K z%5fFTaxO;Q{2qy%ce%F5x!(w@`CpH9+C1f-u?F`Nq+I368py(D>+oO%)})6|PXo^! z_Z>s(C+6$HpJPwkZtj{}PCz$r^Im|oAJ2C1e0c%*@H`OrPDKy=_6dC{<>og}phpYc znsLxn{8oF~KZvn0Vtl&KJe_PV_?(I4EA@})AwBNx0mNLrwaf_vQJbf^9G7jwJSv~nC#3#OY<|yqR zv~WT4e1@cd=zDzs`RyZYV=d+<^bPCM^W{*RYUhJ!yRVmfr}+QW8bBEfv|Ot^o?jP1-+HY46!MmW zj&gp&(c@${}rYeIfV4x^2(6e6MuxM|#@^_Zw^5bDsJW+vW#<{eRPF zH@yg{+Q#=E^#5&xeH=dpKf$(r)x-Npf}f!5Y~P5!K|A)MEYrW9Apb6u*L`z0rSYTKEE7(uY~92@S{~>>ap_VVw`ouFX0(aKBKo4&**JE-H)&v zVSnBc$oTMy{dotD-y44KO`P=~zY;nwaAiE~sV^t7zI64?6#7BFGck<*X1l)WDRVfX zzs0UVgYU#Cy{uBt@m_`Uy!S#GZ9F^3cV^ih-fOTT?mPxLZOF{~0DjPM?hC4Cr`5e) zL){A)W#Ab>+#gWy%snz3MVT%H_E#fp>UWTDDP+}SlXfF=VNL1U8s^QoT^xn~IE1hp zfzNv$fsGtQ=m8u>$U~q%T8y+Z1pa6*e74XJ*_*?N-FZlT`vvdxA)S3A_o%ZWH`+TY zo6j~HRutcRq3m6V8opxP*uctiE=>}YR=oh!f%T3#ka-Z>(!Cfl`okDGz7%a4GI~!R&t`l<#*cw z@MBWnR#!&&mJG=^dWK&^-=wYn_{m?Z_ypcrfBU?9HZlh~p#Rcy-!R^{(>nPD=#JsM z=h#+t7Qk<+1dt~F)NMc4ycX8HUuJ!-+<1m`Vyz2f@W#ITXc}$ue!YG-5!)yX3-xXy z&*J$WYfeS)={Csbm5F++0o@dwJM-Iv)Pef;pl4pJQ0wL|LdRMM=qK6laJ>$FOP_e> z(Vw~b+%G}SSUzQGp{i0!fh4MZj^6)tfWiQ?6<9_H> z>+bWoKirG@=o7T=^gKl0px69bcbpHs-)(#X>o6@p$2~TB6M2t*0QzNnY|N_;zinhJ zKhC{Q7V=1UIof%V?FNkdGJeEXp7diS_lSP(e=PWGywmDWW#65U8~f0=``!H^W&en) zEAKfr?Lv>oMwHo%GTkVn+q*wS89ukcxg2}SmsmIZx*qMI4(JnBfX}_)qvc{+CDJfH zk1uxRnRMOA@lb+&p&k$1BT=_}CcPWM2mW~|H_t6Y`5n-czb@kktiLmAwDlkF397XY zpLN3?DTD9zQ_dQW*4~oH}4tb@6qqv2U5?RZ&L9wTs}Wf z;B(evKfeYaejg3}0oSjdr=$P40z9?f!TWkYTZ+62cMXDdBkJQCvqJ8PzG)nR-;{47 z$Xvtccun{xvq$+T`Yy=$(wjX8&@Uf5VTNzU-qme)EohN%);{(e`rr$18V9~;yS~i( zJg@;ey%#^~8Ow?N`X#id7q&`!FF`0oI1d{=gOJ#-vHdFQH`aR2HSpdf+9T&0^mFVh zz8AF0{WBeh2SAU0&Mfm3#VzXUaSiVx8wb zbrvMl34d{t=i1xR#vTN&E4elQ z@xQLow@CA0&NadhkJzi}_kLw93!P9V84DO&?waaX{00%e>pjgoZ{m61iTu_V$M`x| zFF$n02;a%peZjLTo>5_KgZJ$f{YsbqVV8c;Lw^nE(onZPzX~RdE3R9i>*L#8UY!Yj z7j=1IT_NxHhib7e&sO&_&uuy&ZKF;p_lPkMo{L!NkVZ|&K0YVh$lpZ?D2 zm!3NPy-&UQ>=%k>MP}h|W~6x2Jq`8I=8od#rhD4!+P4&UbTqHs)Ujd4I-{c@x;EOh zsi8d_Z4FPU4{z!)6xz_$*3{lmZ_Jw?c1y2isdbGF>o%@!Z&=sbUT>%&Xf(e}=D(a!dUOA|MMSA#A;H{9A8ZR?DN+v>J7x7O7g z%cOzfb*(MYhL&h}%Ke?Ftu@?S*S?{lD7>kzt7%i`CMFvgu`=K63;!)EkGV_jQYLyNJlbrZw_BM=$)B*=^& zY;I@?&!Zeg;ii^#&7Jj4EgRU4_iTwabc9>iqe1mdi&eO;sjac0eXXe0Sh6DA*#YK- zO=xC&OI`ESc#`OQQ&SX`Pc_IS+SCe)Fl|khVoMj?ykOBkELY_3idEMcZCva2sZqBc zLTO#j4M*!X7`L~EE0*1UYh2qN6L3}Cj-G64Y50eQV%NsB1%=eL)Ju2A(zFIUJE&W2 zmC;6Mo}F^rf`!+hdm5s3)2SL`F%rV->YCSeHrG*Q;q`S*%@{|pc3qYh4Fh+_f*APU zwO#MPar?cHqE8K%g)vl{o7Oc&*EVflOM_s>)Ue?pBNg=L$#lEks9JEV^k$-gNKd$x zCUS!L7lxZQgPYXE@vtt=`r7bJNL3iVR^$q!qN&EFhK`Q94Gm$@7{qN@r)^s2fJL~z z6*kMEvZ*e*E(Xldw*>apL{67Hzm zq)0Zj*KI1ouw0KS=8F4hYC)H+S4dH~<({?o)wQ@;klrhN2*(dar`cFzc0+X8H9L$p!!17&qa z;~LU!6Cu~HW%T!CP~%u60eLiWK64ukQBtTOVeVVs+_a$)(Lgq&78mbYS2c9rx9>g&W#h*EM!qfAF56y~iO6OEhx22d>?`v<0>RC5&T1^xhZ4&b2+VrFso9O0-JDToqP_v77%3D;mba`^| z_yl>Wa$F#|;>he)FH43*;V&g!OmOAsrL1@QhoNu=SGjXB5H>`&v^8*c#N>!6m3;#2 zt|^^!r*y7?)AG!o#)!h~D)eP5rs619TFl+hDr4RCW9wQwIb(+JlNtNI_PRC^X9FBZ zd&8zWbaKlEtc7GPu@*y|?tx?9SRQR^ZiYnelvB4ElSAD-%?)r#;dPzu?W{OP?6pW4 zC~K9N>|&)QR~5;I!#>1%qTO{RNd%%F`fPXc;89g$M=Tu{z8Usi@9AvU`cQF0(`MN5 z`c7G9B~`$+M+con%esbeODCGr&Sn>iXQV;LIA~j6-`=_ji=>XIJDAWzO4}Ib_qyHK z5v^;Fu5DfKnvtX$_3f=~ZR{OrXL{@U>9K0v@@Q)kqu3lo^Dx$AgtZw~It`nfT01-7 zQH7yPLKE;-pgU^e!sWWPMPc-#o@7)vj>vV_wxEd2>WV9IA!OOmuuztX%P~4IbH%vsb%g7% zn2KTzI)W}-h>?s5XsV)E*W3!Vp*Nb=Z_zcWoaM`xZk~-Ch}F`78kH*HuEbh)X+oAaUX&sy94I%~-lO&x4t}EdX+*JBfwjoT_3>X4+2FLeLc+7JE+v73azgzmTGOn5t;k zZ3nH4z2hNW7i~vhX`5{rVIVQN4OFUJax6(V#fYcGhzjYi7IRIvOfBiWON^0J3!9rT zEeS1F^7qI|f}8~?ZycA5i=Os|^=hLuBDqM$09Bzz+lWjwR~D5G^+nhVMP&!j*xG_+ zHTSXMbyB_2v;isP(9+s6UAX~59PZrbE50=4q~6eD&UKkouneo%K#HZHuDJ6U*;Lr& zTB$=j=~(H6Leb7J_D&QYClFk6VAM=;H{?cV8%9WM&uu?c+0 zwXqcgQbxFI3}RVaz!h$)`!IZkUW#FvEc?8QsrPCF&&K2B}R(Dh2@Z8#G80$Nmo3|M7`P?G`x}AICxF^!QxS_p=g6Wds>0vp7yUFF0 zq72Tf)-}(-KFeU4aYJ;EP5K(f)hW#>kO*2A2 zOX!@i3sh=a99x6QG?YS9baZZCf~2Ls^*#=?=`>{3Z1%)I!bTk>u&}2fEYX!jE18RN zcPr=4$qilW8t5lz3OHlL5!G~_2ZWoOu(K6+QCQc^c}VT#)h=2IjRV2(^yy)7$PF3) zzt>xbBgsu|vOn9zV~mcrI&3j8QLJxokl9vCnV^J@3~X@gIy$f-#bO#7k*!E74avcp z*!Vq7(M@%2Q~$5&jLtU$zDk`NU~df#yAl<_xo~ak`d!(V8MnAw64%r*M<|~OQ&H-d zlUdk`-izqNCB3g3!A-YyN(Z~VxgpwM7#ty68lqu66qNE}*1jOFY^patNL^lXve8(# z8K(qEds^dWIqP;iD8AKI=eoMLTuW8!Mc19(60eE_p`)1-giLCl9;Zi)t1s4}Ngn1O z6C-9c@ln?SH|y@@V>bd~?taATK#u9K&*!OPe1)eLF0#sQX@Pe&>YF;&)wRnJy=Rx< zP7j6Jn|Y}8t}c;8R;+T`*xEuHl3CVW@#;C;;IzG|u7&$X=BxEA*3$K1oKSmZNvs7& zu~W748|fJpCwIihW*_mgGP~&$4C%}n#x1fZh-uc9GnrC*d~TJJyzz)SX$^7j=Cv6n z|9|Y_w4$W}s_vM-jw!=vYsChICpxP8rI2(##wZRr=y2sYm3L#6SCdTjh#CsWYf*mVWHPr zA6^*WP8ebQxH{yXSu{#O`!byK@SI$#6lG{purP9Ek;72~I2Gj{NKwoB;BI6SRQVA_ zU1j_urA1pK*O}6zx-Oco_b!dr2oE8Z%hUHF3f&udIJ3a%OTEj}JuVzci#(|}e1AiG z>vY$fYd@~eN5CL1ersnteHFG5xC;ia%$YKF343(f`KCDC zq}$NhN(xrW9l9n~3kNu4=)9i$_tg7U9+6_n&XY{{{6U|S8oJ-rol@M8hAWrxf%$)8tNZ@VoPxKq)jqN*gZYTWzqT1Kic0=`g=tNgq*Rv-l* z$z#M$XCE%_Bh;)i7}bdE)y;_deI&1DG>D+c4*)6@ajO~eeN2^svhvdvQkGrF^%=AJ z+^ksh<9V~+C$IE<^4^c<%=anxetD6kax|7Q1dIWyX-I)I3BIF-R6dGTra)>eszBt+ zPpg7vHi%#uo#}lnJ**ML^3#;Vz*G<1MSj#DzMiUR;&yQs39Q*PR>i4SB~tNqT6|6m zR7u9rgDiF=Y>u7SEL2J6r>SgX%%>jeBO(8zg2ECj<9n`(VAKu_L;yU{t1(OCXc{^oWWJ8u17k@dz662paJS8u17k>7#T7B2lD|F(t)Z zK|xo$$&4v9lD8q+E?@Azf)L2YJ5WNFDBc+)C?j4@dHCowW)eGup0F8SPc6j5z98M`F7UA>kAPTxnv~Q6$h=Iz6+&nV&h$iHd;(pma|Mf6AyBg}C$x`@s2YHYWm#{()E((#ycYq(B$4b4lF1ti zC@X}5_aP8wtXxVZ$LBdWnXw@nub|)&(Rd~0uMn_;x;=+L9*i#{pjwWFaxwZO31|*E z2=I)IC=A9xEh^$e{77ZATfmj<`@JevO9g`65QwILV!g0u+BDofBg!ZSyaPZ9>;fdE zh{_a5OX(5tPLG8fefuEvkO*GE=!}3X8J$(BiCWwXp&KDrs!n9yCHjb2N2L3bCfGQ~ zvLv(MWO^7OMRzj!6oSu)^f5j!@XS8O0U1lP`WWX6JiCu^p}-|Fi*rKr86W6lyjbAt z`WV*;e0?9|OEt6+d0P=|3 zeO0b+BFz5FhVBU`Dt{@;u$-zlF}K#uO|jI8x|LyolRxL16k~mRjOxxfRZ@TDL)Zv{ zW!#_MM_?yHYKh9-+!PXVLf~gd*nN!8$&g8^Y|tfx?Q1HGH%@2r)AQSIkewF}NmB~5 zSTx0Ka|p?*-ek9jtYcD&`-Bm75%H{V=sU5JIgH4W@mdu@bU@~}D$??&1rYF`nraz(t#q{UOjtw+2TYvO+- z5`@5cg_wPYE5A(0nw=m6$f2GEL3#P<29Z0}YZ(s=nYtZ%B%Xnk`*ixRaMdxv?-9$HUttg-X+NuROYY(Il8Mv zua(qmj||dE`e8M-ROF*a!>Nt(0vggK!d7=9Dir~%8C4;m&IscgNv>oQC_7fphr#_Q z0=&U6BK90W8i}&tq=8Wc?&VTZ(t4m2$u*L-oHFcDAk|nRl`Ut)x*<*h<3lQ$qAXQv zEMOc(;5rA9Et*-L*h}ZYvmB+=E{ssGu&QQ6&SFO7drqYz!QHUnyd#m@MQ{s)4nFLR z(MO0gv){NkbFwdqxCmLSf$o_Vu-^&qfvaP$5$1^Ca3EX@tqvj(Zbsj6C<^SVm~f&% z+*<8r>t)MHXg>m7AR?*-9mk$3K|pF^@$D`Z)LcrkQUt<`l_#j=IEo^qm{)1NwFs(m z+T>z1M`47j5Kt*2wilwXx&10NQ4}(w*HFc2>tv`fYN!f9VT2kHXp@MJ30T2MxwLA! zv;YF?-U~g_Er6C0+bA7Qv)!rEJ-#8i!?#0@egw3hB5_BSLJ`b5ioh9)@vy)%`%WRg zfRIA-jo`%9VXDQE&Py>5F^ix1f|3^+1BoIF8tm6zbE=Qe+jPov#+X^5SKBQabJ4UP-jsG0mj6rK!#DuWrL!sWTaLB zNfRow^5M(WfEomp4+n)oQjUnrS(Q-_s7*N$dfH>L3_=%GMjq^YFM=vTh*l5#>_O)! zo2g(#8(=DwdKdv9qay-VGdinMbI`6lY1;}$`2r@L)o>Hoh>+r7h*_#NcT#>eMcf&e z_|By<8EfM8*05exS<oiz&j8BoK}g{okZLrl zEJj@j>P83v`RO$n#c~PVoDmD*Y$U?&ix6?OMjjPO0|dR~U2PXgnJPvs2jkYoQ|Oc{ z*}qQ(B5(gJ3S6>(dSZ$rv>icu>lgqYE}$&|h+BeyHF^|Lw*rS@7-}F?(E7t-{hm{W z3LAB1OTEh&!UB;g_ zG_LaUgm+RY8_Ac*iXbandZ;Si&?JdSMR%!2452d!=xau*cqNM;QN5}Ji;KqMixK=r zc2AEfCk*6)xr(lq_LAact=uh?Vn(AM??M2-pFe`#k^9q{V0I${l_bG7BzMVdlQf6!h%s162E9U+G_A$gut^PfP>Ll}sCqGy+axQg z)apxTah))jx)hb5BurAoYIMsE>6)Y_QfKbm!Dx^0uHsVUr~(s}N<0Sv-jb0jaA&+g zl1D296?ut!2P{85#ArJ-0XW6PEKW9x`>Htiq%HJPP<6pyxQ;_{{$0j3|PN-}+9%Qt&R;fn&<@0k<(xUAxY5lc{9@7`bgpYxK`l? zJcVt>vy$wE$L=h32?aAdPnagTOeU-PlCq8>>s0DeVF+I$4M-}r2+8#bwsG$lAM7K< zl`OE`5B71}P9LZ85*0+ctq3Wa&O*CWXVFf%9#NAQA?|(A6^wcXT)~K51F1uZjwz6l zEq#?V*2$EP4*KMj7WaA8=a9;-PvO`gf;+_|^$#~2WeAt(A7&RKq?po}T$DPC47aJQ zga#@BD;TK;Ci$Lt*(#PjCTx-x2Bg}G!1;=?s%;rd9CDKxtI|nBu^d@d2r2q=F_Os; zW0}nMD3EO={MI|%3_ zM#lt9(ioj@M6#+Gl?u3mQJG4`Resv5u|Pfo4|?36&ME-@_ZhGdnLsW^+2XUR7}2q% z-f>_FVw6jnq)M5*6+yZj@j-!S_Az$AkWcwACUc*W{8Uf5OP8Y4ne~6lnw$R=ssd+k z=TO)b0@Nb8SF)0tjZ`lK+E@w(?D&ye%Uy63%JUHFN014Xz@AtZp+N+65hJzcst%xz z)d;FMAsTqf`IxQlk(Mvxes)-al$k$mFT3HZSuq6Hyi>Fx0E#>%3?o%QgmF+kM2sM! zG%3`qy?Kf~83oBh00Txv2&ruk8Sc_1Y0Sp6h_$c)Vr3nI`a+>_eJx@gGgDMsZ2Cbj2%T*PXW z*qOSN&PuhxVUaxuJY;2jMBrI{j86%i>`inT+vwb8$4UX)VaLh=>$j7(Q($P+BA}Iw z>JgMZ5^6+12BYn<3;^=ey+Hq6h9HlF5m=0%pA{oaon7LYHD*^JNLd0k2vWB4DVs1A zC7BebOCyNor$r!AhyYm`4IrpSP=Ci_7y$X{VwAiT0pBfr$|lf=kVXVg-x2OXa3$BA zbT)G2r+F;~wiE&1Nqx#Dz*eUbseZ~P%+^RIIUUdlV)kMY9pfZ2?Ew5T8vKzqKXPcIr#$SAu3nkB18_py9$DAM70X6N3>mmy@<{$@B*Tx z_$DD}A)@@e4a`A`yLIapuzCQ|paL1O**K{$((NX!8%|iaoUm>>VcmAZy77c{>j~@T z6V~k~tQA05Yk;s;0b%N(8-Xz6tqAC;ortI!CQ~12L3f z8vKu+Xs-$2Zi}c*1?7#l{T_ShEU4(lt_E3j>W31 zidXr6!AHc!tI~#xv8?Sj#jvIt&LChk)I!HQWHPQGn;~gs1$D-sS8r^D%-^~hg6M__ zqO~Uo^+$&%h#vQX=z%YY9{Gakp)ZJTmLO~xl`V+JeAvnoXkO9@(38>1_B@z0@3IB^ zR9Db9)Jt2FeI9y=PnZZtJpu)x0dkZHqQ{sZdV~q0$Cn^_bP1xzmMVkl9o?dA0E;xD z2aAwNKX|$#4AJN!(5+fHfD}#L_p2&&umnO#(eDK)H=vtFfQ(SfLw%Z+R7qz05CkD` zP$78!-sPQAGICdvRcm%wr^h9$)}>Rd-g&mNP0X;85zE8h7HI1ttc{DXwk^WivQ_`JgL8;8F}76p_wP8pAXXP8qNZP8XyE zNJ~jxw`h9?fwpFV+Li%oO9n{CNIM2dD-J7A+b~iS#ibyHkU&kEgo+T{nV|$=IRe_k zNC_oYABtkR{D+EN8j0j# zg@phvdJa>P*=PwH=9$shIK=_Lc8#QJU>G90Cu&+jmpEWM3U!crq$(46@+Ntq9LOhi z?D-f2X+QvCp)H9F`cas-Wl{{j0@ThfNYPh=NIt5vy70-~Ap}rq-}gQR@OWQYpDrSZ zE+j~zbnH=8&q`egZO}zhG>4B-^BIs7B7~9bX7%H7B-hXrOq#upvh4WxT~j9tS`=fx zjLeV9^G-?IY8u@($&vxaCZRHFk9G)3g`Xhy(+IbALP zU$$i+J+Tn~!6pCEC8SQwI_UcB6j@}~i;yDg*vQFxubQ_LdB>@$IHfD9BngINyjH}i zRwVMWu^TCp9Z5}MRvD7_A)vFZJ_7p@Frip8^ZN*vjFmiJAAvFiHu<0=g7fGlBUDRDn;O2kEjd* z&lZ|}1j;3SIZF=;m^6pxBUv5EBv!Xe3e>RNSph50A-br*M0HmoS+QBc0=9^nWH0f` zs^e{|rgW-6bt2om7~8}GtEGmd0tF~gfq-)xvfZb^M79Tzd|0xUCuSW*GTWKrb{A#5 zM77K+K;RK;nM;=HxYdAr;-Qv%3zOdJVjR`Z)6LbZP8X%eJc8h&iGpj^STd09J_LZ8 zB|x%^BBWST#LHG|k+52dm#t>mi&D0lVl*P8SWd;+tctT)6=$=GY|5qVD&3kCXBBZa zHE}jIaW*w%Qz~p~;%t(}MVyVy3e+gos-C({F>2#%R>Y-Q5ofc4(v(Tr6>(`+ zBz8{^X2`t=*fR|xDimej#j*~jMWn{d-j!JP915J5vXzXAr0g=5RsFe)(IH7)8E3OH zkpyuh+} zfoc-)r_Y46RH{)da}YscgpMFUVn!DQT*(MYOeMshW=7bf$NfN47$GTEBdAIUDZ(V# zkmF@{K^^)ql|Nl6*_9zEc7zrqKsrWk0#-AMs#IL%r;GDxoU^Gp!#qWqbbh6PcOs;6 zgqjX@YO=qtoE$K_bf+IhE_g6H6(bZ#Y2HSZjc{oWo_SPXpyj~ zWTe=vinCe8V*F`A2}cm11V$GHT){|jtd4VBMvmPg*a}99d3Bt5(qN|=+YprH6WWac zhqMRLJ^?Ej9agD~j;d5fXH}{eKrx{VJ<`DH92^AlFc3Yl2+>jn?!~#@pd9hZlLiL_ ztS*7PWTx%%T`^FI*qP2(=+VP)0ii zT)}9UO5KBKP=Snw1zfQWQY*=mOqCSn$X2xxS}IMHFB>%qD6ds)jnSZh{Itpg$Z;gM z4gXazF_*Y%=sz~)9tM4C-jU(??JymVLpiAP#9^#Wq(g2RQV+=O35nUg;IT5eGHtb>l9{#9M@3AxM&l2P?3>x zXi3&cDQQm_&CQ5Zfq#%H!OSQYMRF~HqZOd*NRcN$bBsA9Ynz~b0xB_N0G6VDl>CF zz;WZvYp}x2@k^=k<3UI~H&!8NLa`b$Sz(?B1@j59nvgef95|PO!DZu2Q3eR|WAy&a z%wVP?OfDB$kbA`pD06IDdERGknlKYWPVyVR5P|UHkC^7nabuwUD?k2-Y54MYAk1)6lpIFeq&s#FryQ&=(r zotlBBkTaP~%al&O79@G`5=E>=i8wv67XLL9$aF@m4nNW2SRH~!E|(ULO{>XV;QKTR)3A)ghfe+mCu+hAd9t11YOxqppjIC^cN~w!+U=lxB*q4P#D;YMYSEEfL-~ zxSABf!;q!S?;)BO&%JR1bLYnss7)r_7*8Tv9!HmqQ=PNGO+s(!q?@ire=T%7l|nA^ z(kR9^yOLy5g}21>Rqm}NM*e8&6lo4_qUDdKj+S_on@Qzcu}?&Tvg(+2sPnJ9Rl*H*=h8u~lwu(6drXHTyg+|B4UD zP&76-(vS0Jqar#)JqbKV6u*9m>e~pwHs@OxnPQ1UwJt*epEV6v%bJ6$Z7spoZ{3A! znzaenQPxAa2COG>O*icSMA=cc;^kXwJ&#nw`WCLH^$M;&>zBA%*4wz+);qYu^m ztn_TF7+1f=XaCZywYZM5Hsczwp1?KT`Vy`g))20l)*HAw)*o>Vy3GA87XB$JcwK?3 zY0bjbXWfRYWi{ezTOY;MZ#{!+n)MxAM_EU34OoA~HQmaFN6N4;Xu*65u8viYYtVWK z*DULExQ@2IiEFlX7}qft@5GL^vaxI&XGL($u_|yKZ?)l?YxUw9vR=eB&-x{<6Rf}B zI?)$@&hiVT(85uC(65^(xC3FpSC8<+v7Db8wwv zRpWZKbuX^hSWnuIDX!OBD{(EgHsd`5dmz*E8Hsbmr>rq^nT79_QX1#>#?bhqK-r-tX+Eu1?4!B`u@Rooz8CRcGj;m#@ z#nrZYaP?cC#Wl_P7OtbL*KkEoVkwmWe0d{!$nt;d;ZJ%_8$`Yx`P^($O$>#w-_t%+DfrCFu8jbvu9?IEv4*N^l)*RpOd$@tl5)^(kD(8lwUmQRNQ+kD6is z7*W8qj}Ws1%@_-BGNnDhN67s+ybnBV|ACo-^j%2F7{KN6t03SWUnb+QY5m!DvOxG} zSgduyHk|9=BdGxEUE6lJBoO31JK%g!BZl8`?$(IkpY1eiB+Z}Wv;(1tR=PjWc`Fy@ zgjQKu{(R>TKx!d@HQFC`9t7FbaO&1re}S_T$bKT@{Dsa7Kz>dn$6w?e10rQY{)lq| z$m=jZE8kz@{9YrM`%9g_XygiinPcLRPsk?u%bjsRE|A-m{zXnz*f5^MIiGcnf3Z`i zkwX7cr&S|U{T0p@jZE`bIZpr)35xwS&ZmJ4P6C6O{?*QRfc%QcEPt)@8zA4MY}fni zol_bq^*1`d)5s0}X6KI@DfhQIf6>SSf7E$TBRBcGoU|)lZVUb0P8Ja9g`537&IBNJ zRN^iEt*lL zq@I=jJx-fOR{8fjj{>=$4A%JfInMx*me%_Ro#!>u;NS23i$>P_hn#O|WTXFp^L>pp z`wu#=Xk?TBkn?jOQfaIIu=55GXr4T{@0VCl`p-Etfk+ej{O6rgAW~_+|AMm+ zh%oq)|6;I4=X}L)n88M1K6H}xRqP3ZT^ift$6;IgI~YG%23&WBgUe)?qxCi4XvV|V zyOuK!LyW`I@?(fysgX3>bc!{CiQJi|k$`PE9|9su&&Eis(#ROw@7%4Cv38oXK_fZ# zDCZH4G0qr`l-OgPtALbI={MUsPN_x~+j-8d8u_4|@2mhKO25MnJ54~O zrz`9N=Mz9S8emXu7dbmMvdWG)UjlL`S=ZVn&LEIBBJ1o$&X0h|fUUO|J3j^TEOR#4 zOPycnoJPCCc^$|Qb2i#l&QIW){zA{a$*yr;(|)SOUhVuENFF^{yIt!X*Et<_ecZQo z*^P1Ew#9CC{#%!M&~9_y(PbX8qmGF!X9KxywY!{bAfF`iF}vHD1Vp5M-0pD-fxN(+ zPug3Z>w)k#we_UE&ACOBeahbM+yUf0=6uHPb=CkWgs->$+1}wis>%B7oz7E0IE7eW zvUfTE3FIXr19rcYi(S{RF&kT7ws$*|fSBl4>nnH&;4?thQ#wvw_`K?A?v4@=h1R|sAHT#hBCm=Ga{>?t@yrXk|V;^w>7!;Co!anLu0P-Zc z{mwpS$kbL0EYO|J(K2Q^BnTK|?_<)aY|0}^wvoOOa29PQookhGIaFN^@f;5FIAo-M znv|cz#r{6onCZ_09xtR)h!W>e9wVJ~roS>Wn-htV{wrKF-o)ia^rrPy-)P3$tY26% z$Yf;yt7SOHQN#1p=P#{*lZitovFf8%wiD9G8&-}p8Hi}$S6D?&1M(x5`L&hrOb7A{ zBFC&Urv!-f&al<&d=wSRQ2MRa<~#{RG=0{JIy->~x8GY`&KES|K^gcRF72o#V_hzz8Z)CL zG#`?ZcgA%_XbIpZE~-lH&=w8P$qqfBX>Q05J*v~o!XZ8_AoTN!LOV2kV`->Q!{v)Y zUj@8}Ja4K9{kMh}wuRmWY+%@C+}s-~8Slck420$Z7M_cTLW=;eCe4yVp^xbF4;=|T zs^O)>p%a`Q6Y9h*?SI_l(fDH2i%hL@~H*&ip}M z=m&t=rp%#yBb__~nGo32_M%kI)2z?o`wE9IuTKWb^GWR(~I%xw}qi5%%Ps}BOc7Q7Z z`Wn+YCer_ge2-trf@3z)$Kjeq?~#5vAW!yZAZO0?NOOHp841M!-7=Dp9zglCT4WgM zbOPxg9!c{!&>V4O9*)G*pBhOR%l20N?U6JT+{5hGL{-(aq4d)usp%gTHFJ%0J}TvD zrc@ZOl{9XHr~hMwN>JfYixNi0S8-{@Bxc>S(|YQJdDdPk(x0ufl+owU#K53 zm6h?V5!$2S=j_m+hQAmH{Y1m?+UeX>WxR@uiRsGP=Nrw~32w5S3m{`Z1Y6(10N{k2wdTALI1T1^gIU)635?3KX2si7 zV#J(!)^$#35%NXG(!5ZWu77Ss_)R0fvNBi__@z@(>2sJgAD6&uDEBoKu(t*HJpOM0 zj{flkM$YJ=&_Tp>YNKB^LO%mca~l04<%5tEQ~}xj+tn!&Iw(L0<=W^`V1bNZ)IRzToXIjp5jSQN$Ggl+~O@D0h9vm{$ zoZFB?uMs?Gj&kk>asVDF_$xEuJOPB_1%G2^JA5SdJahiT%yDwC1O6I}IC$L5a|(d` zh{y>u--!S@N#vv%cIE^53z1W1fwKn4Z0IximRaaL1>{vC=gi%~BHYFKB-jW2zN2PP zuK|OO@0c0Xi@;#eH;g(3`OcWZ$AHNQ%kiBxgHHkDQZzW;cg_qx z1B{Q+1#j@3H!oWhoa}Q3kR*+p;xnA@0TCq@`fTUNK>kE=X88gRUsw1nOV06?UgiW# ze9l>9v*&_1@^tjP7`z?@uK?{vbY!rU=XSvYjn4Cx`hpRS&G(i0f;RvYCgr|zUvLR9 z>4KYli+sVmfYBg=H~SX*f-S(7LtDXHd`o@7PigE{UxhFDIbgzNv9HP(+zm{sU*fCr z1qXrgpd$Do-)dj*F>GSFB?{i=s|6Q#_ZwX8YxD)52DTP&Lkforagv|UqmX0 zWZK7I*k1wiG>W7>4vYN>5LS@(ano^L1@bI&J^}OPCRrFf0rTZ1S&&b{e7Ug}2JDu!PniWqAYvNEH<050LB<3~aui@%v6=n?Y8aQ3I2Rw3)HiTdGaIKs zBmLijXYm*<{Y<=+cmdXl`5&nn85kC~u;aFv%EiRzKG~SWQ7K6qHUjkA51~-@0}~i^ zXSc?dY}xl3p$4RJ$Cce~hc;-qBRkZj;b?wnqlP;RLoFKKToSrh!}pbkIyBt1G_+a6 zTWUgEG<<)3s9VDyX)^-9gj^vEm@)s9%c#U0(-_(Xg4^K?$80o0e{+e)GX=R2LOu<*>8`gj*)g7Iqr!No&U*1$*juC9(ss8V(?GvNK>CR2=KD9XPO;bWYG*>g)%? zez3F58s}w=j5b$02Z3-*+GEXH=Vw6HlEFB$-uVTPD3S4Iqw~5(a?NJv7!a;O?U32# zoCNYX$@0voa~g=$Gr{aK0<(}jfE4@N6BrfP--z|6jg{waq>1eNoY3U z&3@JntT$UrZV`8(Ml;S1Zm}G_ zn+bjd3$vIz@5aKc6C~o5AHY_et2A-L4_a8~eTnQ|#H9@$&)VzDWSnCLf9G?4hEh^5 zK9J%3FOB>cB>Fdv{1NlYNsau;=QwX`fO z^EFwsX#yk1TpP+jJcwlT9wSr$nD%Kl*r97Rj1NPna~92d8JED%aT$v&^UjHkGX5R- zd`RN&Fh?^k_s=(-b;$WJn&e-AG5B#H9N7Lv7=v#B$wTljflvP*0F#N_0iSN6@Ejr) z7@ebmP&xi8`1CLk>fOH*YmJD`xeG(})1a4}yUkK(HgYJuzs|(^u@%*4MRCdK!R1F} zJjWc(IPA|c#R53D_$NTZR;2!s;^sp_ic8bhs)QPm~KvF9C#U2Cz&vuUWjO1eADD^ zh~^_zjqKRekRvls{0yet2z(e+oT* zg>!D2z^FMVE>n&x)Ah{u$dog`FmwiK)Njs>jUImRFt;NkHwAjse9$9|-1}XJ_LsG0`s* zmPb0BqGEuI7uGtTi zCnC8GG|FpE0R4Uh=z5OHLOyucL*ho3o%+;NfS;^D;xy11*ZQ8!?nl+RTV@sk6#ouIAsZFWmsX)Xs}JgyJUhlQdNieu@`sAD=( z&r2#BNp7GmS_*jzAeI#3QjiSeg~)1kQYw39tE4J@P5vhP;_xN=LY-7>MCAt5iSI8! zCFYvvsoKFH^)us>;3m2q3{tr>_5l~=ekVxn&iEB@PGY$)1*zT{h7V7RK(^fP28*D< z;(LL=LhT<3u9*+~3E;02|Ea>i4Ezl7A1nM7;1`G=Q224+4lFPCWrg$UjmgA^6wZ}# z3Gp8&`~$!j6Ms$QDSjR}Z~W$dPuf#_2srQkYMf7WJPTFl9t?8CMA`wjK@(_;k$ZVo zaHhHJAzH?)?YLrXY2;4J^3VP>kl8FY`)jyN>IReV05E2~iYufya(85nofHIKRF`@PUa?@%<3mqQ-mUxH0+XSE1Q|R`)74QjQPs z!bd2~HQ%S5G}vM%e0W9dq`?+D=?C5#M*e!6YuXuq1TJ>5!KPhYXFb_(e!KwrZT1{E zfZ{vwxJoPgZIewqD!u^xJ`diHo0Sg|-zfDJ--rz_H^#ZGHtn!@79J_#gqizcn{#II zMc{R)D7Q)RdoaTt_HOxy(1NE}|GknQDTk5|pk**+Bln{=?rnj=ZPfgD)Iq`oHc_Q^FnukuY$?qi_c2s>Yxy{;!YZnuLW2eu463C<- znTGLs0(${`nZOnR-z0E1fFBaL3Bb<*l)MVy4FE>uO@F&HiJy0Iu78zqxBnvaJBw8u22pN} zKPc=cwFa?z21`}JB4Db5(g^g6BF3DvD3g20&%th#u0|@Dx~ao%YA;f^BK11olcl|^ zE+egyI{i492byLcn!*IQF2@XVYiXz{jMA`4i`fnccPQQ-3>hats>~v z9k5%FjX9ve2y=2MbyK6RFW3fLd;!0nm^@z{b4RtBVeWHjv!UmawC7M^t)y1?RE770 zVmZgFs+Z5{xMGUf!yde3Iz~B0Iww3jok|u1vDG<*3Mn-oX7iTL!8ji&04LWjN!8OK zg>3=n?QSY3;!1H>Oy$2=Ag-JoX+MtCAulZluMvJ0$^6U*t0x(!(6b6x1e7m~KGyQR zhysIxFGp=m<%G_fjPM)CJLu9%s$xN&!z!6ZhowAW#W3A^uN4s+rBus@ei+*knG9=W;9hD{A967QzG$0$>J| zRg^sga~U%T;6XOwqgF(mjIKs%Hd2krZ(_m-efQEU4$c^1vYN@ArQag zp&zZtq z=D;tQ+_aVTlVG>W`MFHiNMAHJq7idmW%^4(Z=`cwoG}lV{YVXNurA9F-ex(wfjoo6 z;2k*B;5i008C;2T40h31m{Vh=J6t)k+Th)m;|!n-TNPZ3hYj{>q!tew#Ew$xENlbG zO7~nte5(VuY~DdP_ zg5sYbSA0jBSe;rIVEGISly$)n*#s=LR+?$9j4cLA#-mbqDRu!w#m@s5PIHA*G4CtN za`gs_L&BKWh1s0d%bN2}OV*r|p%p2#N(#*xH4D|PQ4HR|!c|88YGF{k8zW7;!d(`% zAj{4?@XXz8xy#P)p@b|u`FMjYJD*01EIU5}K$e|r0m!nm5Hzyvly;VrQ4bh#$vNqD zU+iXK@K!OUk<~EPwBm<*zY~U-K<)(=B;PNuP##WVQcYC4CWa@m(%ni2F36 zp8b+PZ3s+aopYHTU$`!|2iRIJT>Dvdk)5J5)`Oes4DSYCcFeNy+Jg>|l~fpArRQ1B zyUiY)OOG;C!F*XK(N5Jmr6!iF)*@{&oRja9rD`d%HI}MY34C#Z%$R=}9FzmAQp}Yw z$l;28*a_Xnhh31++Ku@_< zqewr4Pw$C9RijvB#F*=@<~pKR!aV~ zJn$^e#Bs{iY0!DZO$bV_E2rbUtI|@Fdif4gFgvXEpKVH#b#xEp;2a=2BG}4F+ z0p5%3-OPS%)OeKpIg(0dg8v%;uvNyjD$Ql^#;D6d@h4I&1;u-$FlMpx3RIqJ2F6T! z2I5N9GSEtpuLl~fz=(SRoKuzn6Ebxgr}r$_BP=wlcL*t$-N2Uf>`X1fRf(f9ModKs zS&pA~snmW3rY1hA9^OH!8F1YMZIIINv*=#wB4~t*t0N-d5R=|Q==rugtJ7zbt|+lm zDo<5vplhX26oAVVV|s^R%jG~+bOm&frb=5qdv+wj=yVKnh% zsn|xZd5f_ZDPjC9mO6;Ws8pU2o(f*wu~gNF{uu63$riQ8iW`IG!_?aBg}l(u-?xKz0l9(ditu)ACsOF(fW$ zVtKlpv^)#^F5>eQ{uAI!rvkrG;U|Fe9%k;m^eCA|aVmBX=@$so;(r3(9>=Bi!))8F z>6cBahNRN|0H{W`|AO28Nt2N!8sLq)md%>z__6R;ng73;dlT@gs_XCnB!_cNfP^H3FewQL zhzKM=P!Lp*K@tK)z=?t(WPnIW(j-id7-r??R9mehZEdwq)jAX-&RY4kwzXC3@Y4RQ zBU;;9#5(K$^Ihkhd(RDt@B2LO^FGi2JlXf|wfEXNxpVc z%E|jp?f^fp52<>_$vnRzir-I9hh>@O{M+duofY{*tB6Q+6jyhE@9zL_j2lM3{EKl| zBX>Picfj<%c&d-3pY-r+39)1wHXf2X1jZ-Q)R3cM;4>qzN~t}E(t0j#ox&RAjrcYx zV)zSYLGkstweh*@88mKXaJU@PRa-nJED_H_mwma;S^`#RRQuX=sM z?CV(HzU~J$`#Rq83rBLEV`oyuX|~ppim#+Y^Jb?>Ax*)}#BNk#U7BYmRcC4tGLt&q zAL}NPj>>wqH9jID<||tvNaD|R%rp|$CN$IL;Jv_>@o6F>+Ceh^V^hk_Ce5TVahtRV z@*$7;4dnQIGL{+Agp{RsO{Z^nknq$2+$@_QoAi zQ72OgWwVv=fc3cV#6Dm&YnA-4710&Jyk9Bmlr<~)nFt5Z81@g8{H)bw*n1UqPP|3Q zzp$g`poPE475=1WlyR?JRhVQu5WmconoW9D=@0nnx+9TypTEN~`E4@1&ur5x*vI=k zWicgq$#?|E=dWe1B5qro&eWqw$(ZaVQcQXEW_HTb$x_~J-PM3G&(JPY-fi8@bJlx* zHYacEuFb5%qY7v+b>!_Z{K6T)ZJItW_46x$&2_${yM$9Xc5tBlKK{rnut|kmKr&h0 z?<4&Xr0pVdj}LDg60E0x(OnD|orP*FAwnCRyob7{=f4Vpdu@P?@pbmHm!Pzj>>QJ4KoRzXaDR z{8#th!3HFqlrr%VRp3TOR1G=)h#L1j_&ieuyZ7jy-%k22F>cBFEvLL*J#zA23X`3Y zkCRq-!Z1dfbZI~jbxn~Rg%6?MlZNIE>>*#zT!jxQXRd+7I|Z7p!vnF_Aph!Af1XUNX{1+sEH#{$wWik$D>pl=TAskC5m>b4 z6NmZ2*EUKNE`?|GBM!;H!Pp@ki01aUje2;$O?yeWM( zg*lU#QZl2rozn*MYj00R%{ie-G;d8K73YnJE(!Wu^gs9Gx;dD4yTzS(l(3)NOIf-| zMrl|280{RJLE4orgH)s$gcAPH{7Jf({|gXoHo1_9%_hGgVzY@Y#g~CRgOGP`x)v*u zrFg-2Nmq6#AQMOeX6C#F$mdFjs3}X=imR-?V?GSI%IYhw3WqWy>0W$Z@4mBV0-pqY zvUV79`kDnBPGX$vetpGAAxWhvr%mRI6&0Vac;FB0o1T9Wg-<6T|2iVei4?y^q=Crs z=kno<(q_)eFrvxbQa%hL#jxs}v|WNfFFTlH&dU~`lZ?j;vc;p5`Dt&^ek8O(^tlOn zkTqw@LrTo=D~sLkoSaj)z4Io`RgBgBt9AMzx;uiv4p=q z1GH!to}Ym6O0O`;yi#ZK8{%$#)V)~myB7zQajt3Md|y4U^HtJcMSqDTQkLE)-uK(d z-I!xx!T8^A{1+|(HlO2t%b#?U=Ccpd_0n14i{#lF_3ySO9XELvrYJ^!ZTCL;pOZP8 zgyI5NSVUyvGS^p@;w7Y1k`mYghHp|kwhnx8=4#aKM~&%4uvFh^XVa} z(*7H$I>gel;LZrFd|AmbU+}07u#9YwZ`&0+fqmCe({9RA&E)y(Xx4H?b`i1JJ7s~* z!6^%E{+;|O=^1~Bdh37iz4ghxw6cG=hc@5>4STqU*_p{hl~W$gDGzccD(B1|=AZdm zd8Xw|vTcIJR%Fs?LJHz%C*scJS^+0UOP|<7L&?{R50FpF(ifx`Pa4jcht;Md4HnwC zzny}uQeQvaV?h4j$owY>PSF>9E+WFHaq@oKV*&;tZ8q_d*MeL4C3vPxFB;Lpt6<_z zG4fImnUisapiULhmwRO7FCk+J3B~J(%vR(nB8wFHE0JYH#`WRjOchw#Ba5nr06OEu zgLd2Vmh{NVp9ZRN;O{?jOyqB1{-;NL|M4?WZ2z%nHRZMOS1j&(_SD|zxgzP$S+@}h zl|V|e2uz#Ib`eR+KnE>Drz}ymQteXN#0)7qQ!F()Lu&OmBcAHh(o)K&ZzV6{2j1a z#nC-w56zJ8mQ0W9nLgf(_yu6dh@0&$UJfKnZX-3ab~6jUQR##9AwMZ)>CqLo&>F{= zpS;tObqO#3Fh1<^T?rApe7A*&UA{94`wX>t9;nZeaUPLkmqECV$jIm6uy{Vu)j-b3 z{Q`dg_+x?2cj z+mNctlHci1BFnQRuKAN5Qh_$h05U85URJL%&}?+>_lwx*^y64(75T!D#BHWLkjXD7 zv43`i<^DF~Ig|gTobN_+z8mDE(-(OU_KK8wu$K+($s?5WSTyG`%kdlilx6r6;}gA1 z7^VVG_EMXCVGPKcKgsmuon8_KZ8H&k-b*5Y-xAeuhdJUYQ!L8|rmR%Poi@xTwJ3hK zAvu$!M|nG=?bzwh>2{Lw{cMx1>Fi}TzfZDzqF3@35yHGfg|F~&b`2$ddA7vn^ZIzU zGxui+6;erbVl43|#*_9br?E%M zln?xfG-8UCZ8V*mVm$frN&gnkcYVG5G7+CY$wR7nYkei1KPgwxP9Jh64-s^IFnL-n z*Y~hmjPmt{=F9p_`DDSDBx;!#Pzb8ao8b9SM6?ocDKTu$C zOJAb&XY8WX6kXjRZs~R||4dKaAevMwoM$b4QbQze=LLKHOIEf|a&^AU@!^G_FSEfv z=6TSqE0>vJ7;`VDk3W;kS7}O9_{TB93|?jU<0|Jc3=bp!s$PBb4`TQmNGQIT$hnF< z#Ep=xL{7bmkLOq^jrXk$PNZR?N09?W1`{dL%7*`&;%}>r%nDaF#V>=9Sldig(@)4s&u>1# zU)zjNOo?}sO=k%L@35jXZ5m7h)eD?YjplIvV?PhrP${wjZ0fj#$|5sA5W>cu5 z*w4)J`7{+Dx17(}qPn41|NI&3oHvqCyphOxiu{$xHbss=v%g2=)SLOZ z9}i&SL2CRG62NUtOT4Vto=@8a08 zZ08Ue_aCqy7g|P6kNiG3X|A&0CA*g*lSvs!P<!%PSI8f^dlQh;_7(L(fQYq_dODwal82ZP$h@v z^v(Yz$#;>E|0a=#h!hWC?fHx$?&C8n9mH`t+4*xwe%q1{@HtV*Qz&0c@;4+DKSiVm zqh#DYd@NJ;uQIdq7fyDZM@T6CdBnMDRLr_(-hf4q>_j;@qX6jR}(4z z6-jSUJp67q*lf+&&VIwB`1au<;jA|t1we#f7#*a%|9|3ky7 zfNZnzQxPiabwoaIp+)u}vp~$7&?_&$G)x9xzG#y&ru9nC|0~qZC+&rJ%qP_~`{GqV z=95m;|1Mi3-hWDczF&&;koRpOu_wpNFNC)BOR$KT0d{l|(b@st)d5aR5&nYI^Mdjt z3=WqUO4T~qKO7NONc;XJ2r!Q8FFKMB^FoTc9V1FIu*p)EPX50eWb|R(6`IiR@5ZjnL%O zp2c)_Jk?*dEsMb35VnZpu)U);#m8EL5+>79^EY>z`t%{Gs`vSLs^4Dy%4;%3sY1D> zMpa?-Q2+jU0{6;*C;!e@RGGxn>z&fg?V;MDbcOqYrFNt+lwpymEmWzpLsG?W>mjM4 zyCzLY(A0Z6P1WybCF6>jf~*eJnj*>FP}AeLhb&e8M1sQl zfU}kHRDZwoYG6axe`WL0{fyk4umq84#?@hl{$pD-qi1g%7zyVVB0gh80t|!q=7zA} zQ$AL1-;SwjYVjedB7IxORI5h^z-a~g<%Ccuq{6%RTbz&Im%pdf5E;bQ~uQk z+i;zpvgCe){5M?ut4Q{02KT+vm>=TrzHpNh8r{}z+!(w$quC>wBQ@j2LsC`ammO2t zht$7(5?AYj78V=aQK8odScxl>YPWu6B2o96pi>?{B=zd0_`dN}Uy|BW^Q95U$OOHT z)PiZH2*Q z78f#qy={x=F@IuSwpGO2w%9KG6xbGp?^=Grw%OF}#K~B-yF0)-z6<$R2Whu03h$1< z4QFFlBCznM#-}5H2s8m(MTr9`AKsrpwEW!o+ys#gqwrToCvKqG`L^He8C00E^a3@z zxwkeL#tfbwG`qRC*1=;|0Y5X2{FdJJf^Pu+t>9LJ3x5Y}Vp(hD7wRCZtb-Uf8r<=! z-7RsfP!qMQy*HlfYs{w+SRyG%h{#!VjaoL|%e8xTc)b2G1qW1W&?;l-w3Kq|#Z}gv zh0-ESuX@4#NZy>4dXbcrr8lV56}}h-%m~DAg_SFu3T(~1%JNOfMLr$9PF~PBi%r}J zEbZJLfyMeg3D`N|*RY?zrtsnop)Ttnyy#?dAWTQs$E#!h8dApxffADdy`Vu$bS~0nSSFgVB>F zg{mzfcU1NLiF|**vm!CZ| zxO(>SiYSBt`z&_eRS4f zclLe-j-3J85zBVvZs;?NT>pSY*ZjUj%cTN&IeB5R;1;&2(;~7$b&^Sms-sR8u8rh> zQN;;N1a7YO-!%@)>qz!+Q$PLefp1n;Ce)ED&9cK*?ZJ4mY|?r=2}m>B>R+AHNXd=Z zTEV(y7FMN^A|vgWj;1CqQwNke!PfCe!DhIlj#?o7aT0H~Wd=HDFdB?=0$ECHK3y$EdLanPn{4aEuA|J8>V>4uc0^QCSd z`h(|BsDi26hc<=_-4e%nLG#A}8-s;|fL{~*k>M9k0)AWYL4&Q@d!QOryYL6qY+oc` z-oP8h7RC>3$=yb>@YldL zvf8bD(QP#Cb((eyA@7Ae-R*sVB;Njd!oE)X9bd)8rM!zk#O~Rq!9IkeM6CFaz-xtY0widHwW8>7wg?XheNg6S0F4Fru>+n*Q zx7qUi`;O6ari}4&!4HNkBOzt!FC@?TzC3?6Cy?iSU!K}XHF=i%^851*LR0QlR#C~Ni zJx>jI-EY9vbciX$>(+q6zXBUWZ}<#J4pBp=LEQwEu-C-Tt_Upry$RUAx-pf6l%-dz z+RyUF6d;pE(1`0g=BRxu{5BUTLb_&@-G0s%ix6%@#Rdd zrIb6wACOH2q$GajX-p*E)5$!YPD}p|AE(Rx%&ZZ34j-BNS+q>ug2~iawO@gFnr~_C zQ1wahNXvHRy)d^TdGjRL6Lu1I2Y5Q96F^3i(l2j@kCUY=54#vkI{ z2-3G11nFutKP-1X<#tB;O}oMx`yY^|_qD=DX({e%w)9}!e^@RnjXolTk8Hx3ge3%xvG9>iTTfZZZXY3hzEm8Z zyAd>&!sm6;_Y<_m@S$*m=V@^E67~^ZCun?4jqoX(xRRg^k|u)mMr{orwQDEg3c?MM z^w}VU{5>B@pMvaW5ag_u5yIy~aAb4tC&-?J&lDoksly4n+Z#SJh?EmFe=Z>`BV0iU zpId0hE@-N+mPG22XfT=Ls4^uMqYTUMGZ4XL$$1Oup4m z8VC0fmcUar;o68i%E=Ggps^Z0YTuaz`5&q`e5#4G63!>w7AEp7oMP%wKfXwNWy7TJ zyJ+ky9DMFM9KH!x9Dy9!{R$uL+}=jeM(v0k`kHVXLEEqeY_x{YUU(K=(OZ=3(|H_P z`jyX#5qdf$ZX%pd*i6_?*h#pSu#0dD;Wk3}v=Z+OH_XrKLthaNCv>A7;iLA--pmg8 z`nL9V#;0VZF*pO6R1?Cd0Qo)FL54bF8PStA5aJJMsCebh6OuK8pa;TD2yMEL9m_Z7nW499t#u(ua|M?K-QPqYYc5%v@G zLq9#4Cv2p4TO6L#nk^nP=8nT3Mb@KxZ<-Le1=bJkl!)= zad4g{>?M3a_>gdr5Pv$+zmEDdqZ9pULYG?!=Myw1Y$rTUc$%=65I%H+U2HAlyO=PM zFq=?LIFk@QQl${LAWY<2G@m0pPuNFzosb64;UnKdKG`yY=8Wi59{?+Z?~t$k0bUVu z)bn`otsf82v)=!*ot7vp{`K60ZtKx2Q+nR=zs&9``bq$QiT%HWZ8POJ*n$!D^=ns;Zfb5kr>3g4 zptyMKxQSJ@#}yUTj63eQqKQ>w#~xdIY;6^h<;7K%l@ltDEvl>;S9P>A^Z3Gbjm@hH zS5`K!Zfw}l*iunl*;-ln?wxnOwR^`qKX~Zv_V2y@$W`zB=qH8aipKFbwy1FR@|x<_ z`j*1_y5-H4%^Q}qwA5FuZdoy=3Svt{Y)LY)C5IAQ5)xaod`(?_bwxn30w!uIm)DJ6 zdt9ZnrlF;7MMF(>L0vC7R{bHea_6Y4oRq( zF*`YJMsg{LR7@*d6vZKFA*tmH7e-U(mrpzOw1lJM@DieML6BG^gR^l5WvmX(!E>#BEd|4iQ&*5OXNeplfH@Pn?Sy;yfmWIPKc9WK>Y7etd{=`6;*U-&m`CKE%{c( zx8!%xy-D=Hts_Ohll&PB!%q4~$(@MZuxHHds>DpPx-K>TTZ)bEtlY_E^Us)7vT$~1 z<>Gmr)R)Mcb@H)^xiTZo|b?l z+%EErY!`W5jKw&&os2Wf6V0yjjL$ka9?x8q zaO{E+rKwz{I?0+odm4Y^5}s&KBuuX;pI>&?*zrXPzc@lu)y+Ah)3Hd$b)F+WI?wT` zm3K|9(=4A}A`36MV&<8!Kkt;8$-YifPSm?j%9t^GW|HfjlsR+y|3NlL5hpyUeEGsT z@#ZCEh-{aca^kzp^jZ4W>~C)mmZVF5XHG9IpEf74ESNi=2_$(*rIe^GGL)#1@e?9i zZV6EZ_Aw$u*%G4T&=M9dS}=23!hP~fMFylLL{;3!Fa?(u$0cv+5giQRawocWoL@e3 z!L&ss^XDbEcgD==3(hJ}EU0GAONOx}6$7c457RWg0rqC{sz%0+c4iEgA^rwm2wt(XyAD@WLk5J@KPx90z-a#~k1 zE71i}>i$p-%*w*@nTgdw1Z!5wJRFUgGm;nxxDN(Htjy0(4MDQ%9^Xy}b$**c`sC8CXuCG{Kc}`<< z1=~SBRM!wfbq&!xLGiqrhU%t9jg8jk%7&Jv#^zS1a!u>X)s59PPGx<48fsQFw$@d)ve)EPHdhr_RM)jsF0Zetc2?KcS5&D)O+!`lhNjkv)|EA?vdXDh z-%1TN?CZ2Rl?|OX6 zY0*wsMQdHvs+!gorxp&ES5~cZs%n~BDfZops>+J`x|UX_xu&ujwAD3@YY;T;8$S+7 zt!xR?B!MKbay@0#LfBp(u+|bLHPtlNHC8(n71I_hn08jh!ji=^D;AwqKC`02SzcKU zXH>enuGOhtxmtuPme;k`*EBd)bxkYTn_E-YTH|w7TT#7yg=5{_WYOA+X4>6kpS2Y$ zYFcSP)yf*DrL~fdNOZh)5UrsN;Rcx+r_N8*fg-GKYW79s)K$}Q4Sb;sEv=|TQ%y~C zh2-Qku7krhwY4NRSFUqfD_1x|ZHkkwY-t!PjCjKO2}P4Ep>=tS6Kprq8O?Q-^(ga- zibkrbYiU_S4WihxX1VqrE$$~f!dMG-0}5du6{~BSS4egIEyN0|v!QY|s-kVjc)C@s z^pL8^(74*>#?{V-8U_xVl}DaiT)B7Pi!UcMXH2CQjPg7f)6H z)YaBiRiZIXjrDa^br6AcMeBwpVrVzY-Moh4C}~q=>q>Rps+tWIYg#H-F#NzwKn*R{ z-&R)LWL>p7A@bFX5XjP8^&#>I`-0X-G8&s0XdA-_Z(5azSFLGYOLsQ6R7TB3SWPHn>hj5{OKs%Z2T;5_ zB+W!_Wd){%0f3rRHP<_>E9+V+)-*AkYWyJ=#A_N_n>S$E);6MNGN*=NsY%TZ_^7Y& z3qaDcg8@G-&P0f3YP7PlWu-J#E%c3E*sPkWrivBKjcb}J7%{SxRQo^2w=ID^-T@QwMs&oAf^7Tl0;zT1+0l1cz-HtK_3}U zk!dtOO$KJ(@};&7iDBexbOVD4)q&93cng%Hgm_Lk`*ecgPgOEK%pQ&Lna<3aKj~>E z3r9{k5r$K8jkB_{p}J*dWexVOs=iL$)#5OcD&kXmL(RHy_=VcvTw_x|^H+s0 zA$4IzW&H|MP^YGL#a^kzS+EMm(2RfBswKEUJ*7m_);d4|jP_bxv(^&UK7r zMQvmA>dIE9BB7B!FTsQr*c#ZJdJA;Q(6wfbY(`c%3Uw>JW0 zYRu+@0CvasE#%O(HnvvQS1jMqTGJAE9Ee|IsG_Q>1^0{Dw8ExyMQWQXSFC1Wg90R9 zroM*pYTkf8Y=B4mA8#&jV`|s5u4%3byf&w%sj+IM!*J1AB-;L6)_(D5FmDADL=t2b zL`FmCKGxRPtyoFNVD;m@A^r2yE0}=Lwl&SFBK)psQk?;UIdjH`90MC{>az+BX#5p( z)7I*GK~ zGNQrI3<(FIPh75jDES~m3j_#A83Jz?=1gIi*Ed$J3Zj)vvmFX9Crvd6eqW>>QXBEK z{RKvtA5S5-vYKg>52==XTl z&a8Sp-ha&Ot?EN);&-;Lq5Dv?>IuHq2csZfl#EdBhKQ{m8_yKbF_*nB#(|EcLs5XG z4YAPTs5+8#{9Ma9`I2DyT3Kyh){zYi52b0W@zq#cYXtyp zc=|a3W_^vH>DvRXJOT@$VsIq_>*^Y+S>v`g+JN;TtJCJRhUFFK)-*Swmqgjx{lhQ8GXeTy}H(+Yj58Ns*lAH+i}Yk^FQ(j^UB zD_2xEHn1G>uSD2llDS@-X_jXh)Y58GulYh%fK(}G0JHCZ851m$e3Kb=q*nETIgDFd ztrR0^{u(lx5beWIFT=Fzn&oR)Rx~rWSUWpQmzctI_61taE=uIlnJ-ER^X%B%uW3H) zP7__Qn{bGgww(ZY*2aPF+R5lPHmkAmx2B)k#Dxr_M+-Zkj7u&CB|l zW@zah&b48p+2*+3z=tC_(Y<~Zn!bZU7s|=!RTE}MY1kH0$3*G2tg>w{!BQfh!6ipB zq|5wfb6&96>6q+$frnt@G}EUcGOb-*v%0EjLr12AjMa&~5>jkC4->nJ4V)+mOJCmD z$g=6XholQXk?8lmwK3d6i?&fcY>sVUYC}Gi9yhP3bv=7uHF#D^uWnq!-W>g8N+j<- z^k=jN2;)&ol0k=cjh|GpvW7)0q}aQ_LyeY^VZydqFGte@Z(P~tr853HXtZ=bRAFhf zY@W4eT_r1Pxp2%$tC?K1FDbiVP}~sGLQ&A%hF{-+p{d+Z-^d_gIEEJ4c1c8+{Yl1b zfXOaN6C`C0RG+A@n^L!W&FXkT-+NJAp$3PTaVl(ER#w#{)#m%T+G=3WGf7H5r)EJC zmB$+XE2p$xM4D zzerNx)YdlFFb9F6h{VKpBJNi(s+HlVscQ_SrM?kUr4Qe4x575;I@3|3Y<_n|WmA)> zB~xXTX{dyXCuFrx+q<^n2z4n)G=X4#tV(|zsWc{4Zi}R)%!JrjHG~wv!_?wl;+V!) zC`QL`Ufdg~S&t>A^=mcP$<&9YBbo+6C0^?4<@I>Y*v6J~H5-^IP#c&*wRBJPQ{ZVR z&ljwiLBZi?1)}qZRMfHYv*Y@&f;K4P{S!JbfiVsxm&_Mk>5l+ecVn>0wz1ge4hCs5 z(V){|OpOu_DgGF?SXfHk5#cteJ1HFP&Oo}!3%h9d2L?vM(D6lRU;N$;{2}qx(7;Z# zbr^myu5P$W^xb2&o6MPN)Xh`+?GW!Fa0+ZD4`!5>m38=)lAL^KOf1XxmO9_o#_L04 zrPfKB!sd)`HJs|2mO4g@lx8Bww^Y8FGZ#8eCoryN&BC&H z5J_-2NMu`Opo5_pOgM2;Lh}V1j0YvyPIFiyusC5o$`3sn2|bz~dI25N*-funi3z~g zC*jxDuVK^9p9DH&X!F9Cx{j!#mG}Y)xQ%9zv^Lzm2sdI9+e_lxAD^LdPogR(;@b=R z^~O6jX?0*i3r1=JqZ1wj1CYSc<|RA2$?d=)=%lO)F>nK8c<8A2n}E|AT_@L8*449Q zN~*vRE9-Uo7+Th7{eDCJ&CQBH)moY&$5ROv`QIRggUl2#Ztrhk{JqgbeIv_zitWw)$_+y$h6xFFI=c=sy zNnpQ8T=+{7t-*EHs}vKSvazFUm{VBh`KF*ni4wY*Xqjo>Xeov_jWBGjBGtlqs%c%# zrk;PK-Z4FX)~-$B3crgZ%eClwkX?&)oV9Zr=O2HQ7vKBFk;ZE^Yhm7T-08uwwWeU9 z)gswCqVa5PLPTMo0)9vMvBHw64defB-gueDZ(Ta9te4k0DTPF*^8(EzC)WM2X=y3xshLi%l&qBO z)SPa)DSe#2ZoicNDFadmr3^_K&Z{_jMd}-#ZcaBR<^0T^ya8sfR`F#|J)bi&vo1@y zGaKiz_(r< zn~_;?S;{4;JKXKvws~7)TMpZtHY4-QofY?Z)Z|}zY>=1LLc;c zS`zI7UfGOO_Fr2gDgNm7HIvz;5&b}BQGWJ=9if>-Pk2$>oguEzUsB$_FmIdnUy{D) z^|&r%yixiR)dRgk7vTqyC$~}UjrNOPv9o@;v_rq}{$iA_UZFF(UC35HC($uKD% zN8xKbz|zC0tn@11j7-x-$R_9QHeM2W(e~(-zb<4|R6x1#@!Qj3>=!r=fAL4J3m!6N zK#0mE-v1G~s4d|$l}MS|u{kxV{Yoz&gwL|Dt`54k=mcJSb#6quDJdymWM=3KRELoA zfAKb9T|-sM$6 zEnL&mTo}|)$V-N!>+2fUtRJmXOKe&7f5CY08l=P7+nAM-Lenb$8wbdba1iWAd}lD8 z8#sq{RjkEN4coEAZ^x3L9ZU3f=MrjKVlRI#@n8B}63VQlwYs{d77BCoBA7>8bdL8K#I0schoSImH^Xe#u(02U&^f=pVTI+&JwN28BgJYYRQT8aAl;=~>F9&#tgC8Aw z%1QAuyFcuu$4Wgfw#7RVBw=N_wN@T@WBH{Ddt|E0*7y381Q>zN_)(G^TPJjQAy2x zc%X#j=C{$9>H}V``@aUZ!LK(Y=5{9%vqt~0y3~DlAZ(B*a=l`0-nf{1+eI|S`0MTV z5NoCIJIB6<#>%{rYB>_iDfRNUco}70{%kL=#LJlL<)1>iy{p^QjK5Wh;=q`DH{GJH zDu`XecYAEJa`#rHjxcfGd<41fl?aX0=dBD9yZMNAQh!3~kuKE?b=Q{?+hFo}xJupb z{`v5B6}cTKFXp~LC9~%cYbUQPbwsW=Dz&(u*WXwz^Kwq{hRvZ5#7UW#>1LJEeb1yz3ZHl_dJ3Qv@Kd%kR^+7;xgV=->s%%@)rgmN2-+2C}7Fqx>Y`xfo z2D*25lLV{VyfLXm`+3JfEgONW@W;!8epAB-xo=ZL#%8#(va5{#<$R266vw6#{D|f3lTq` zk#=Xyy{Ea|%R~dyO1&e%Il9y}cDs*9z5ruxC5`Z@qwqT9cn#n>s2*=+}2Qw71vLqcQha-4B>#hEm}~ zD$IzLZ1D=+eHWq`G57tohV*?@why`$qcM*A0TnQ|u1kl7ch*XfgHWaP(h@J{Vs8+? ztrT;2Q*H#Uqa2;+%lvLb?HhAnNoOdzU!B|T^>sJFv*M7t;q0S?pJ450%xC|{>kbJoHrLl3&uutB z>_^yubeLD)3}WCR!U-ne5^u~Lueih;KF1q!ig#3**N5>GOC6O%)3^Ce-`E{~H(Go8 zpot7+MyLDrns#qM%)JEp(r6nVPq~cz`hmG+jj zDKYoio~7O}x0eRq-$Co^O7{KSzEb=bNywf@(c4Jt?!E%(S)(B0eu?r}8Ml9_H_p8| z9jVOqhR*hSZ}x_6^m><}Q;1BgK8mIN+L%Hep6w2c53Qj~iI$?BN4q^`6$T=VjM#i{ z;7rKA&&bc-8kgfh_wvJ3+olbrF2f|lz23mD*CUpnoo_AQ>#B`clYU&<-PVWMv9uGt zqAgzU5-pwz=)XUL59^NqIDe2X{m zKi;5=y_^znU>T8^`+94;2H9;rXwJn@W6(S9tF3CJdq)p=ddb>`ZrlS3y5VKe+p!(w z%T&84Oh$=!xJzdaBPB-#%e)cHN55*LZvUYXg; zwu{i=Zh7vel+te4mkWg<0nat-xiO^;Mfm%`dW4QmE$%}D4eWkkt5=vhs-HKs#5{Z7^9QfKfNU8K7djo_U9-dtv)h#vGq=022j5zRn&x0xZP$zP1!MbmyL8B4rT~V z6{SQDXsY;eDs(;fuL#uUiuQ0Ku<3w`Zx=#u_s>G0N#f;VJgeUBH~5Bm$g_)CBVp~- zm+p#E_er0n!22A&_+U;S_qn-D{p@22<3;6fY0UiCKzmwvmpFHEGcL zcPY`E{?BIiJ_;`o(G7rI_?cbJntDD8wfB{=f#?F=St(69W|%@>!3{det4eLEW`b$N$;xj$e9=Ws{5pl!oOosZE9+hPxwdYfH%;+yO%WMPk6NjTa+6NuG=r7^Kdz~WVJJ% zOL1VfmUz>NOvX4)nC(rO;|-+eK5O*tKmPV)G7Hed(R>$!G_XV+^brW?-&I+qY43X3 zX?Jh&a^`viE}_aZ<%o@v5qroK66Bk{>sPwD7o#bAGYgN@5q-STbG-aH-f*T*D*PBm zu^Ly1>$%<$siQQLmb&jWA@HB}D&35YYod;(u0fv8*naUHeO{MN*NS~$0(-e{YJQ~?5ow9rUvcD!LTV*po#XbMT8Y8a# zrSPcUM8c&o3#0ASq)J$@WTR%prVC)HRN@`6g}y@s?)B7()AKHri``qzOUVTDcqSd> zNW}aB>Bf5(w4rM54>h~YVdXuvk2TzJ-^2icwu=leZMrw2#PjCR2uZp}+B=@N2fOqB z1!-@YY5u8%i5UK^j${ql$E~D)?od-wUre5>-_4eqKjQU}l6!m7-if)FH?*hrOd1RK zW(nz0sd}#UV5Y4#OWnsC+qz{SdiS|>ED&QvlW@%al1K)t%FP=rL9mybIy8?7L2kty zlhffSYcHk^d_4R}I#k1^FN8h!90rKXw1*<>YSfa+eGj$Bb+KGQ5(DkV5mMf#R??+? z4|sX*cS~oxF9QA4JnDYJUxIY$fPPG!QV&KfJvM}{bbq^2h36v>eDp^9dXk|A^+%<7 z$nMWs7{%Kg+38szQ%455f#i{r*<+6L5RR0dFZHZSGOJZ`YwJqVfcQW~nN&6-J ze!8*y%F)6b^@Q@{QHtJ7fg^)uShG53#f4)lxF@+93Ca!R+b zj@FnQfD2&rS@%+RZ7DtvpI-iETcsW$WPi_%Xbw@iC;MU;uZT2S4VMZ!-w;=7KSIo#BYviBB$*j7eqU%yii*pyeOdlj>g4yOda)HC-l)yL z>Y22zra-29FI1(C4rYhJ#ikU7h}ki+FCBCLkOThydQFLtzn+4Sej9=*24K^l&I98| zr^hj@@&txs*x+sR%YGK2Wt39ulZ@}SKAINOrg?qSCTYKBusa(2!bZbUn{4L|o!`O) zpR*maki{MvpF6b4n&*B}Ywd}BR+#$4&aJRB=GhqRhuogRIf!AOA9?Wd+-OQ?tt(VwtMJ{)ogE6C{ zUhQN4i&kPkJx79}E8hZTs6WuOPc-NPFJr!!^Ep%cG4B7g*vgPG&!)kTdiutLL=uL% zH)!htRQETl7>n8k&T*ScPc`dDzwl$QNutoG4W;7Q$G9MJXn{1c(D;dUvUOKztE<@U%Qdu4TAK6L`I+Metc_xRC zF`U^hfRyWFDl>qlvH-laRn6+_9_*oJ4sv&P3a3Z%+riIvKkgwzJ18ih;eOVm9r6CF zPU4-)>V!Sd;ch<}?7LUBf2+Z6H<|z68*Fs?e~xAt{^;~lBBj9?z$f{3Gwv0r57XVt z&n(?aA9S$WH|DlovK>ds+J$D_gGAFWmU8{E&PM((N$_y{V(xDYhf(=Z-T^iykvSaQ zq|x|>a#GJs8dtk|r+7zp-{Xy8Trk#mT*z488gXm7yPu}en0;7{$;>ni*28CcN6hg? zlzT^?BBz91b(`>2T<2HViGiUCiELeY>nidv6H;y1wJ#))iw? zykh*k^fES=PHoc?=;9-72xGrDdq>alMlm8$?$2>Kv0vNBEOxJB3opCe?A_}4iT$uKf^|v( z3!k~(ksH|#^fJ@#WjvV@WaIbkkx9tZ&Z>4Ur~2Ki4aNTI=Gj}xV|OjZdYnavyHxu; z=`Ke|DN@>(uvu_+SFYA?wldQ)PJRP6Jd>!rW!4?|IQ@t*cNWvBqlx+(Sx>IgrXx0g zd+q_z`*al+7O{Vp+s-<_tlb>vW3Av3P|Ifde2SO7MKdz`sWoI?>_4oGv{vv}NCPmw znnVY{KXXLv6EDX<%9(`?HbR-PZDC_4gG8-2u0kH}n>2!vbM5(UI=jvGcODL)emjKo z8D=!s-G&)W=iro2ye(FsDx#Kd_j+BV-BS+g2L3j607YmRdMpkx~V9>+cS#(@1-s1 z0J)d@cifWUoMe=e?#F*%@%Kp|G)K$b;hdtfP9c>R?vkB!U(Z8P1~IqGag(r|Qd`B} zy3$vm8<;9GUAAlU(FKm?m`mPUAt|Dae_`o6lwywi6IQe|;;((%y(uJQ!&}BIuV}kB z_CoJO67Velh5?sPosOzZiE&gWy>fq(a=@xPu!8C^<8Ss&o3hy(%N8SYmb*Jw|yndbuj5S^^*Z*|M2w{oMExKi|>K}{wm0T zV$7(NYMKoIsOEDx!CuVk2++0Mn-1$c{-HVnE4vE;mzstjG7~vS|RH28bppI@N{ZR z-Obn#9q{_V=lc|3o9Txfg;V@ptLKOP zwehV9X|7J%uomtcWUwQ12WV`Rr7$TyPYTP7yQ%4L?G%sVTZ3c|=TFV0X>ZRJz1KiO z(D(H3IB@r24k|gCFgn3NI~_4j#z_me0_joqx0hH0a+2+S-QZ#Ib2+p>C4zHO=WjG}LX-ET+C z{Q+g!#QO_i|G8)eEXC7a2;-6Qbs9`OdaD|GHF>t7~aa-ZbPN(&^c)1wT&V)wTs zq|fubEleZtu&FD8j~NH)SjqluNcY3!mw1_FX6^^a=9PE_>?XJ;VCmkf@W;yKG`-k; zJcY4TCQ>=tieqBGy`s(ibAej6#T!c6Fs;N#>0qF!+&e+v*^g^%X3vqBuBtGz_c;ZC zwhD4TFOc2W?S|~w0e2&5G~#g_s(d)L9Tan2Jer%{=01i;HN|~`>?80lH<@e4=SW&XwVJ5a1i_yN#dF#+Y$Ua4K?`F=pP;XRQ-wT z$8nr`8Y2JHdCqG~+C<>zlt8*K3Dxh=OXKI8yUUru%gbF!sxRVy%ilMt=}vdC-Gn$Dt(I zZ2kUstOKqk0p9k1hsO2CwajnleD-?IE_+blhqHW@zPn$$r7X<8Vx&;tZ=o^ReE=FrbW=Bk396Zz zy=NToCgH6QMPuA8-Ad;phW}7VyQs%9l37}Eo|ikvyl6)JWo#)GroHcFmw89CKaZFE z@ONyp-~9_DMs4*5b0j&3{=M-#h=t9c55%~M;CqN51DAn>LGDsoAR0JEwBwhe!JPIH zd7k?smG`|JJDgtYc$uRqlnPRm8`NQLu91;Dc8(d^FzaFe?b9W9ZjcvgUS86O_ChtWI{(%2O zC3|9m)v!NQk}Lp)WwrbEDyio{_qtqvwfm028NmK(_MKH)-HvddW@^i1%NG`KMyThO zC9(w?P#ns8*-cJ&cVjOd z;s>DPJ|%!XLUM449;bL8_iM1T-8L(U{tuXAKGgsOjSDCRlINFuF-I=gyuIrgrL5KZ zn;GBEew+I@UH=Glhbr#hpmjT!&rE{Z?#;Pc|NnO-NLYw>j!bJ!9hJ+@`KZ3O)i#D5 z9xT^!vkXd)&D(^Rs0pR`RPc4(iqcz`9FS?ad$6X~V)v5^Q>S1Txz6OioC@9aIbE5j zq3*4;izS<+uX_~5?z|Gy~Dr10(hqp08K z?w!xMwDb|1Noc}71!_Gi@O&_d|9bENkF-7v0__-Er}y8^WT?&Ad79L`!R*xe-<#}v zNbI0jyxAKv+bb?ZbC7DT`#~!Ma)Nse#=4jLW@~B5f)cI?FxB^3fXQX5>Q&|)RpJdg z)y`7gAA>jC{hwB8-j9fnVFo&0+xACjjjqZj@Kx&WI9rpt``KWPf>L)IQ})rgqeJM- zub0w5*3#Tp$#*}6(j<4gt{!cn2tD^7&LJ`|quX!}X!n-B%<6V7EW0*DzW*s~OG0L) zCK30GJj@|zb!|jtbT)bY?5-U5l!l`Zn{g*Fj5{>exK4#HJCB`P%8up!7PJS?m%Aj| z8L^Gt;JLD=y2|R6x*y?1^HXOxgFv$=W31Vv5)^34)1;fp(Al&q;7tG zDe3KM@>g^dy|(FWU5aqGNC00fO`U4XpbrNy$GZnFWK6p|Ial!GIqrX1{3Aj@hW#)t&9B_cPYG#LnM~1Rd z@s#E>g!@k@$i%Wfz>FQGxnnkJfWg9;nB9Zr+Q66D2)9}823gG<7OFIjl?@hn^MJrc zvX4{~c+NWqXrPC#x5r+Boj#dMgNv9+OGazM>)g_kZQfyUpxaZyVF$}-Lw0{#)8;-v zr3ikyH?SNTjN=H#oz2Pv_m@Hg=>lzUpm{QN125dfHj6u6rga{-Kl?K=3C+`Pz(qLw zZXqp9d(WS?{Ppl~ravsNF~I%48rq6yI{-uPxoO(1ibKny$@S=E^4nzbW zSCfawF(h?{4bEq^SU}2`;|m?{=Gr{*mu1}hbAN)*jbF_ivkbrMW}s}=uo7*$`@2-D z_BTreqH$aEp+XOSzKn0k|1zHr{QWZZm3z%Fs(o*<75KqmNWFiy5di_;({rEE9^*fj z29$OSWAEAO47&UG1(f||MSJS=$(Kgn9;P+hxi!V8;6Z#($>3PtD``6QOlh`%l7I`^UIquIXQ|`VzTr$K1xh1UO_2Jq`(D@I@B}n(ivuNNKdob(SLZ*EhqgH!hawB-HnY!>~K6z2sw|{lO@L_K@7-XAPnsFNGy?KNj3! zZ{Y94A=|xohdT!cN$t~p3$~AD+kp}0EYn>rA;>;%^1OrC!L!=juZNe$w9Um8`#dji zBgc=r*xQ|(QHJO*x*hlPGc_vR?MKmdpPnh+nT#(L^s%7Sp-HRnD~=++JJ%>bFjQQu zA26!fBGBFKUW}1!wi|WZ9!D@F_T!^iLUUz58SN%uiR4TLuxkm+vG;aq?uB^N(`&@6chef5ce&s3uO5;li3hRg%81LEc$qeMd= zIO+f!i|oChc|a=k%26`DkYo>rr9dy-Vd}lcry&o?Qq)J+_{hI(bzz z@);1aHCcJ?wHL{adcjfrF46t|nf`$Lry6$^(kM!j#vN!9TX8*2vG#HxlWR^|u=b#z z0Hv+Uq9*xlRyh|z&3k(o4p6EWNblpWLh5c_X@{Mg*Q|;@YS53t&UODPA{t_wS$EzF z!$-KU!SJwc)}`8#1@(uZ4s+iHl^)*(5^0~226WkoHnq@RZm|m+x$Z!}ulmFo@p6s& z*zIIV$!@HgaCD=i18WChEvI{L#uCfcQg~6OACLE z%bk8dM=Or;NUl`4X@8dz5rh5LPsau`Oz%9JNn<1DHK+SsbEl5xUpyU`J*jJcaWof> zyYIn)J;voyfR@s@{pgc!2Ix}H_Yb)#;7egpXEz0~1DrQS4qe}ai#(TWLtS4U@K2pm za5=7lyX3cwE*~kY@F>Ibw01i1>XFu`obq6XPHS_o0nUu!Nd>FE&<5*NTic{Zn052| zbHL6J>=Dzw<|(!e{mp6Iv34J{@|V~M?1lKITHa&iO?96j51qpn$%oOJD}^X~0vtJQ z@p3nLL+5$9vpkP;23D9pN;)R+*9*;VKQxl5=h@R_cNmR79EG!}6~pl|{_KWuO6%Us z{;X(=+u?lc%?)&f1ncFTE|3A!0FxHENbJ2EGI+`Sr|5#jHLRz5LAZy0?bn_ z%nz{&WaK@ZT#12nCKXk*nXb`AF5QVakzV7FCeIw+7;4tnea9hBo75UZ!r>qQ2{V`3 zJdP8a!zQtJ#4Imko|k8zneP3IeD&~8;xN-{A={6*g}=H;ceC72;Z0jkCriIDXs?~k zc03EhTL&v4-F@|JX<)YdQ~cZlmnGv8Q9w4Q@jV3LWzY7?^dc4Fc#Yc1+@BpI2Y9a6 zcZ)aMdhi93XS;WiOb^bpji4>3X&D!D_Z-7;7~uBeQ&x5`P3w;(b^qYV&y*2*YoQ$& z-!uw|ys=On$foB5qpZH)E~F*+f^4b!mj7{j8>N3?WcxPpbK7aq1%7%Y&cq(|KHEE^ z{Qdo}j24+YM$u277z9IasAwNvPg6~h*uKbEb6+{e_`YqC(&^oMj)BYP1*L9GzSH+1 zLpZbhW43bECd4$_#qHqJ&42&&X!?VH0gif*z!LbYqY=coId({Z2R9sbQy-7Qr|3=l z`{R;$Y>euVD&-^iJgwuad%H&mQ{~eO+T1;(r4wv<9zj{ujrM9s)?J}NAZb3jK#J@> zJsN55S)jHsBmFm}q}~2_71{%!A)4O_?LI?04xa=x7=M$z;{Y_7akZXug|ST-luY-- z(|tO=ElPKH(AZ3AcY?TWv2FH7&b8Mn{4=oZ7}Mz=7N~yr7u1pMw$dYiS)iRj_Z6{l zn^@@JBD_w!lRXryiN^`5rfu6P58A`J#r?kDo_~qhmDV0e9~89HNEaj-;m;tQ&J2;F zcT$GC>-=@oaCBXxX9%k8e;XW|+u^MAPr)G>qPpW$d&}*OF^o;FpHMgj-z87$Ol>4{ zy5A3?@@aHB!Hb4CiWK`9#WLL2#&n#Lo@eFUt9#lBoOQE9%B6l4#BMNGn)=eQFONdg ze{K*R`*((kFZ)ZVK^^;Fj3zqvV@6C~cpj^*?u)gmwB0=UMqm2k+Uj@s=L;ADXwuHn zbj!g7?WvMh_}+E+oueO{2%c`vzrU%CzU0ljz0-m9Z_@pzw^Nan|2^k({?&5gxyE_8 ze*$ux>ztdD;J(fX{$+C!FVp%@U+2N-OXJQ!X9@ovJn`f^zfCHCm~%u@{YN?*lJbvo zj*q@f?~HU(sW0)2ajr%QhmodpG5v;wBsD_T$R+m6P?^7`X@Wr@bAMD&n)Mh zB>E*zRucWW&YKZ=JN(%8+$8>bIDbs4f06w=>jeEXoY6_`UF zAzsH~=VSi;`o{RbTL&NdJ>xttc5^ug2{p<8FenXYgAn{xim@qWmjf2#<5pDZeiSonxJy)W0kaALcAXH}=Ni6P{Wlq`)sk32K`-e z`Sfs3r9Edx@?U^{eFUx~zCPY3i=D&Nz6g95^q0hSWU+HB^rlAieK&ct<9)u^nFYPv zh<<;7zD$k4S3$35M4#`bz8m80@8t}H{?17LjnF?BfscWH*`P%G{|NoVv`<^EPe0Ck|iatbm`1!M`7O zoK4QhjPK{-`P-c9;pd(>y-S^G(0@Ljf4TGD0k3mOOL1;;Qs7r{b*bP<$V&6k=m1^> z{4V;dCM*A6$j9RcS7Z_e-vfWSz+wJ(Y414TBSU)ddm8Yl06vKPE(RVKz|X?}eZU0) zd>xFu06a8+SJR$PfQJO|ROHj2A8djRtN%qJGvQbN>0SJcf#31uhxq?Z{%OD=y-VPC z1F%#~_;cX*a^SFhZ}`1ClK*@7eHs|DhW{h@eI2+UfLkTF%tZbv(uW8<0DdO|Q;n7X zKJ{0_@5lg7gK#md5_Kfp3MlF#YXcNzR18^CX%FYl5c%Kri)DU=EM zI}v{S0&7UB{5QyR9Psb}eip1GJ zNdEES7dX`a4ETK*IBf6h#Q#R%&-l3yeh&bk(gwc@y;maq{s?}*CZA->p8~(V>7!7d zU(p|9fML_}A0;vqIK@J^JREj1RVCq?eNu^yPEjl z38DR)K-mm%!v6h&woL+tP2=zPM9P2>k-` zH>5WKet%AW*uLlCS2{2+z`v4sk=hWz3*hw};Lx58prWn7pcy}}!|zSNkTv)|DtZVw z9A8`E_kVyx{WuGLQt8vszKnw3qkuzwdJ^1a(86RIz1~#36#m2Zl>pBKzaYqei+Bwo zY%X(SoFi{SSp;7~qO;deQ3I6l(gcO`Hr z@2B8*Bd}al>GKcZcN=gx-s<4@XTV{7Q{eZvz@a>P!S6@FA%Bh3eHuKF;5X=~3xLD&H^T2Vz@hw_K)e+=91qjs_m9A^ zWaabV_aDF^|L;*S2WC$U@{6eNIrt6nUxwdu@Up@X#h9m{~z%GAo)z$R(?DDKNEpV;QvM7P~W;!K8496J7{C7wzv&FVus^Sa-vVI1EdLDX z9}67H_y6PUec-d2|NsAU?OHXpbTz|dvi{H{wQH?fOon6#OJRs@ZOhWC%eEK|E2B}p zTMW}X4DlYq5QY$jyv2JM!ealfO2QE0op;~IV6)t*XulA&)47c zI_Emq*>Lzf0op$P5A0+@+x@2*{^mj3<$nAPs zOMi=keFi;5@lU|f-O%=WQ9<5~E7i%VC* zk$UK(WbYvqYyCrBTKvTBV7sNtj+9rf(0^cZKQj{#X|l|3H|2C`|t=Og|Q;A2(LK*%s@^|+Nh^$ zd@zXm*0A(#8c%k7JO`#WrXR(LUmJD3EkNq3FufS#(B2qd=o(_w_);jeargbO{1YNV z(Wd?9!s6?~$`cW0zZi3`z0v-GI9J#k^};awL&M7VYnc7nVd-zxd_LCVKIqQ^vs;L(kvlY*GgvVh1$yE6YVJimn(@8XpZ5uu@#&Y9g+2?z}V=y1_T+MAM zJ~0OVc)k3?Gz~q)m@WTWO?{yet>f35#~*5(qxR{7Uon`!GF5*mX8PgAAByMuw_`9L z?LjyJLR`yw~_Stp7i&_DVP7Z#TYB`&<3xY~wolGuezUHqMZ? z{2yj~q5goE`=9mmG^tjFMdbd2h61j1r)KKU%n zKUZV&@y^D40qwO<167u_;aMJooC-bLt z7kSM4TufKQ^tB$Nn!Lbc-Xo8{&tr5`KjbkIU^;%K#~48(99fvGAaOj~CH@wV`CUfN ztsY}Fv^UCQ)RXXU4SA5qyw~m>=rPtRypcS{W2}>2Po{Xxdy;?h_hOGR6!FZ@%pc^u zK)-h@ybJZk_&Bs9xm4tL7T!m2Z)TM{!Z8d*>Cef zZ*Pxz9%lO$QTOo}0TQ~DY{LCV>2fm8V^m02k`JOurI(V?7+2CYWM7X_E4_-`f_^E@ zwZ8X2)C1YiW2_;4D4*ijlCa+>y^iefG1f~rkv%Xjq&Jd1(LQ91$7oUbCNdW7A>BqE z>@m8ew~>ccjr1{+!SJ zc^LYoG=_mQPNqBaRz1fD`sYRx<0M}5L80b@RE`Vu*J)xAiT+waqQBOX=uf*z^rI+_ z8|X9={jrjSea;W;U*#M(=y#18KV=#>c+%TE-X16Q90xew92ej&YS@{`e!m>yB*Kf> zuaWO+_4AD+^4U$IA1A4QoBbHa*YviIt0z$|vtNU))F@XsiE>4uU09AB634M$F(399 zhO?irznlH!B-9@?>)q@pXNL8YBFtZkH~Y!en7^dWezFMPaY&o}WEs{W(q=!w$$r26 z+^-@r&eF*rus$Pq<6aht za!)2BJVvJUG!k~Rq^FZ!)Tea5;tQpVqyy5WWF+Qs>2ea~sF1ECA4HdyUP>arYUvsh zzc_BtKTs7Wvovm6#BLJ( zFo)xV{YY#iKfwGTJwoFoOXT^J>3Ofzv@ZrUZkkEhjpVpNx-_wzdx{92Q>lW#1@;<|; zk*+1{@GORO9XSf^Lnh(;K^}#Eq4)+8f6QsEbR#(o^MUkw66I`?-XLxy;b$|6a9vOPo&eN)1~+F zGbhaNT&z#%=Q6CD#l6zcaLSd#c$5!INR#C%2c~LMZz3N@e?-1aS1zV-JUxZ;8u=vF zg&a>fs72#zgT|9NesG@2=Qu%pEBPMI4`?siizQ*7{g9gdgX|VlbROa}RbD^*AUR)> z$ru;X)5!ZVUrJ9WAHcYf&KC>G(bjp7=>tkvN@5(9DP6f(Ay$f2B#v83!hSV52K|8? zi}{iqhxvhopLHb05znvG^<*l>h4fzSlIN_yGg$ABVE!i2-_UidfTaXiDf$=oxM&l*Vl+oWxJrhm#Tf%kXX0y88x1dTS0F+#uEvD@xwR6dotF+ z(mP1hQ@1p)_r0fJeIdP@JQdEOoxKw=zml*MMV^LvQrbsOLi)u) z?~vZ9cupBik0v$KBiNaLW_pZtNVbc8J+%SaTW383Mn9UV;TNyx|K!)@u#0dWU#a$Q z6kAE0|2C)}>?F|-BH8{+G491w663CxgdOwx>^+=srTJYU!+Bqe%py_FDiZy!8uX4w z|0dyYE%_kked#*s)zbCSYor^<<1wzK*&n?pVBVMJcZc59cm_y%1Nji@hkO|Iqj1hE z)SIMv{pd|YKb7tx|7CsGNI!Q_Pry8)_?_g5=%>=CR;Qf`QJHQ%3+FLtvtCr+tHfy5 z^AcodTGuBJg;pa(K*fg0!QQgsrVN1Td;`X`ruUIZp9A7`P)0t9au$;HC@;u*3n-k=o8oVw8D-MtAoJTKc9E#R zrdTVyl|()A!7^_n?rV@Q;yg+|k9Cg1rz@P#Xfr&Z@KS}BDV)!RbKb5XH=v$L_`MtC z{Wm_-O~1=Q@5@L>qQ3cTw|6t<3Gyr46F$`PFNs9E^I322mpGPeLw%4qnXP6#%E#wx z$OJ4%*>Cym8renScs^Ukcs?WU{TSE980dO)U$MrSW9ljx&UN9s-ylH{Xp^cieE#1jdFraw^s3u zOZi~Bmax_EBP7L1tiM1gPe+W zf%Hyt8v2FwZW8s%M+2BXl6({6PCA-=ALD>*#(g4%$AQd0p89RWNKp7tg(pgnAm2fI zk{{qck-}5S4{@JJI$iM-r8A@_OJ_FqH;qy>_F#dV8D~Wy`g(xypTq|xPpT&7Y=WFx6 zDAJkNGhmm(eO~MMc+fi!^-99ep=1E}X{CAp$9pB}RXT+%#&a^#TnBhdFkYo6lBJku zq$iW}F|MSikyl|{Nlz!sP^Z%Q!*o)5A!97`5|8Qln8pS#eF0af}J{($=FlHNtXD{wv{X&>$HU5N2VLPwD|;y$gkd7q^c<4@YW&vFxNODB*wqn}8_ zqEjEG$i%JZhv}=r^wpSWke+@U_(%Fc?_%Un!oN7O3USg2%?wKW2TSU)4~r(RJ(j`d)&A4*z&Qq@P^Jc3LqRpcF5mr7TYcVb;CT}$4D^PqGc34d0T!%!~@ zUqjxF^Pn`E&1wH@(LQX)|7e~7-Q)C#bymB2_x#0pT!8y=JRbF$L!uv`imY}a(I2q1 zGBxLo_zU%YHdrBDPvZCn(7O`-k3@Skl4uXOU}`kI*&a>O8_0j+JS~lEoN|>r{k4es z<6v`sK)W|lBfnA`i9bQXzue7ZEuIpwLq{T#>$BpM@@k{5Z*CnqB=#&sDrxJ8VH9qQZ2OK?6FzZ5y2 zGJL+sXZ@)k7vB+sq6g!i@kfZ`#R~CJk@pvv?iaB?9H$;9=83n6AB#OP{+Vu&SV*EW zR*S!gd@hdRyT#SLEPZN}#lvyk%=oe56!9MMGtua6rCTIU>SO5{;&o!J$nU#p_dnuU z(U!hZd_!y(cZ-AjTIn*x67e76vtq0Gs~B^jb=+}c28r*UYYQ`U8@e1({@-mO{lGrXjfa^(yzby8Pv-B7-Q!FF1@rxMoEiwn^BXK0I z52^Wkiili~Q7kSa@%_ki;*Vk+t{Wq8e}00vQQRs<9B#!QAzmcjAU-6n7rzjH5&Oqm z$Bz@Q5+4)a5`!YIFX_+WB7cKJT`aB>KNX{JUBmd1;u&JTc&qr3_^!A`jK+GO#}5-v z5ib>a{lNI!#V5pfNGvvf7mrP_bcUEG-XcCPZWg_Rtn_2Vd&D=yFU8-)xWQKX(c(Gc zEU{92Mf^J5KGaH|DgHxzMEqRrbCi|tXz^rmI*IQe7KzV@ z?~6N0e2<87GfPBZW8||4oy_NxPavSZ}C;~3Xc&K zjbki*nwTRl5bqS<7CXd0#G{7ec-$vGOPnb#6z>r~5c?d9^m9DM+2So?Gl~1hy+&A^ zDy|e;NL-ITdz{6OM_NowvUroYOI+%=!e16|Ot$nRV#a7oSBf3tz!WR|De+rz&=@QH z5^~oTp zE=`;x-Yz~Nz9V*t(dpK4mx~XI+eQD$R(zTGs@U@sEBqAk7V#zV6Ec8xiFnkh(74{7 zC)SA{hyy1g9@ong#W`dt=1uWK@mmttp$DI4@dOgrq4{K)$9R~$#$$Xc9z4m?lf+zc zvG@Rat;hIUOgi1t%fve}Ed7%B3Aq5{>kNy7#S_IWvfN`_FRm8@pkcU@jme(@mcXD@ip;n z@jbCs>=3t!--$cL-$lb?m8Yj@UKg;Qq~pYa;!tt8I9@zSJWV`HoFd|q(X2Ntd77IlF zzJ=+o6t5Pq6K@o65toa1i2oGt7yl)i*MG44jPwiQtKysDyW$7pr{ZR@Q~X-|Ui?|) zZ>Q;sD$lqr$eu#LCI7%ENo*L+uV<0(&C*N7 z+r(Otzul&Pt3~tr7rH^3zujj1I`Lic1MySwOYu9A-%Inj-$h>dQ}-03#TYS894HPI zhl{)~$K%I}Y2qnjhIo!RO}to~Db5jjUyt@~5N{P%i1&++i2Ths)2|o#n{evS#jWB_ z(bL0=3^f&HEuZ{(xSVokPSS zVv=~Gc&2!vm@i%_UN0^Y`J5;Hdq{j*d{yN0nT-Ej+$Q#jvcmg{hloQ&J{Q5`P881+ zFBJ2|E5+-@B_f}*GyM{u7GD+l96RGb6Ss&ziN*o)PaGf)6H~;K#dE|<#6oetxJX$ls~3 z{@TUw#Q%y>eXRI{#lhkz@nmtD_)qaGk?$y@eLk;G{vr0pf{yx7aj57QCy3^KIHcqA z@l0PJ7K=BCe6F4GcZ-jS&xtRKL2-xpv*_t-9p6{vyUb|sDA6yTD4rqm9cE0IE6x%5 zE;EMTB(4ze5g!rF`-4dLn)G|(=i*jzr|98*L8L!WJX}l^$B3th=Ze$Cx#Bfqg;*ul zh;`yq;yUpS@m=v#u~YnBw*XB#snM5Hm!+hmQ7Ui1Wm9@fMNqM`F4M z#RloGF%wd=86#@clgGec~GN1#yG;iP$Cn zDDp)vJpMp2UK}o_ij%}?;tVk$UN0^cSBmu_->b`f-Vr|#KNq)(-b1Z)eZ*LCkjVFK z(as5ChIqa>L!2j;i?@jX6dxA7ahAPQ@g(tdajKXt&K9p0Zxok{{}lfvJ|n&=HjAH% zZKC z4-gL%j}gaDE=x&544Vt6^{_j@0VbAwseVjgSbTGbAZhMCGidM zKjIf6pVMQyJz}pTEq#!9qq(?*lKzkMN77$PcSwIL{e$#wF=CKq zw-<@~p8ZJJKT_f5_h`uXEa^GojpE(n17f52zW4dQ=aL>_}?kmQUIQ|F{#~n+e9OK1_ia(o#or|UOqyy6B(p4mmUn*TI zu2y)x^jhgg=_ct7(k&$X`Ap%P75=sKx6->wr0X%v^6y}AkeEoKe0~z?%8na`85?UVKGt5x)`t zD@Gq<*^d`f#dAgTdvN%FrSw8^g?PXCl=zzXq1Y+z5&I3d@{1D_MZb8ucs7apEDl!^Bh)UzVLBeGZ9na-Q^M(leyzN*7CCFTF_mAJVr;KOjD#@Ta9;k$zqJed!OS zzm)Ef{!aQw>4;JA6XUxN34afkK7vHM9;5K%q{oZtB+7dRiR1G~96wjOMEYtHc5akj zEL}t5xK+~iieDq$C^jj4gLI4ZCh2V??EIqeJz^A}|A0UJ#R1|F(NE&IlcdiUFH!g$ zu~^|(ktoL^>6@i*lfF~>0qKXOpC*ydi_&k2?~$m#PZZxx!e9Qu0fzg;!^C66@nWW! zBVHxmEZ!+TEIuc`C4M4)CH^e-Nw)GIB#sl$5vPkqV!3#m_)qaE@ojOl_>*|RXe*z? z#AC$q;v^FFeXDq<_<;DR_^kMv_`dkLxK-RK@&Rhv?Mvc$!$YNqkf{G*(xauvNly~b zQ}_kaGo)uq7n5l3s};UL;Yw_1Ed{FFq#LFwP5qsCZv`jd!1lEm?q9y;>BX2 zSSJ2MTrEB>zAU~cZWg=5Z$2Zsaf$d(@iFl=@l$cD_=nhY zoR$AUB-(8_nTPeEbUKOpnJAqpJxw~FM0=Df{ATGpr5_|=uR(g9;$M?~lSIBBh?~W) z75}aDZzS^hpTZ+jt>X?P;a`lj`Ft1jVCj*HPnMn_eTwus(&tIfAd$~(g_nvqD}1?h zt@sd$@;xp628rW0N`EYFRd~1bZ(`5!*6|0C@Oub}<3~u35hsYJi<#m@;!F~LR7fwA zu9JR5Y$RcSz4SZchvFAvm-qvT^uJ3-9dG3`R6LbL{8SSD=PLY4aiO?EykC4?d|TWs z{v>)&u<|)bJVrc8JYOsj7l=#5yG8RkJk-kz((j0$klC0QNcjDo_+N$hPqX3&i76!d z>B*w`{2ug$(s^P)yiUB8#PiZM(sd;ATP@uny;gd?bdz)oiTeFoG@l2Ay#r6Q><$!@ z#S_FSVy<|Fcr}@e`{yM5SSkH4Y4iEQ8TkH8`rqP5;${-%-Y)(kMoh56`-z8(M~i+j zO*~yZPs|hNiPwrZi7Ui=#Cq`=@l|o7xJm31yT#q&0Vi4h9wH7A$B3ts`5t46^ra-~ zD_7cleiHgh>FX4~P>W#@y-pyJ?rg8O*fbp1)x z(~;7N(xatQrPE0GIhll=9EHyki^T3Zo#631^M(H`xJ-!A?n_B_o>*H4TS2Z_T-`aV?484ZI@#7K!rxTl#aw|3t!n?<6a}KZ)Z8iKE0c5`LZ`o-fW210;Tz zaIN&sB=Wme`cCPU(hrMIEBra>w@8j-g>MquN!Z^m{hRawr(5BNi3y_lJT%fzlAbOW ziRI!_ah146e44~Vudk7;H?f06J$x_j77xgTp(7FSK$7N z^t~kfctHAT67^(0-;MBhsFD6lg?Ew&-%7&YpQL}4HlG8>@xC*xbccz9#bd=(66wws zFHm>^iTtjSUMzjT_>}mfXg)`d^dCugioc2d&a~_uDUK0OA@Tc?$t21#jYPS!r1PZ< zrAtYqzfR!`6~0V*h4lR-%JrneUl#vO;`q|)_bYzs z;&Ncr%}a#lhkzF-<%} zyg_;v?eo;+x`!;+Nuf@mDeOY|B5N7%wJ@DPp=fSv+5yA;&#pvL-(77r7T7L&yZ;+f)wV!l`+mWx&59pZ!HQ{pS)zr|0) zPVoove`4=*Ek6$t2aBV`H1Q1aJn=H|3h^p&k+@vEM|@0d6r03makIEx{6&n&wER0z z93UPoCW{lqGsO$U8R9$=KSsDl`X&w zx^EP|Q~X2hGsTMck;wlD632}dFBPv)e2G{t-Xz{e;<$&U*OJKhW$9+Il|;JlrFWA^ z*W)}8`5#0=$4ehgBK;`oG{v7LeU5mcm?O>-i%A^6K>8->e@NdW{iyUy;(H|g_(Zyk zgqCr8C8g#LE>QkiK4ev2?X~kHR08eo}l* z;s2KYNNg2@;&VuCoFL^(!FpGu-0Crh6%UM5~H21um4R=h#sOQr9S zeo%Ui^g8J`rQa7nRd}oP77~7aFTF?cQ5PT_^&dwfK2b~+GsG-$u2?D7h>wcv#ZSZ? zV#I}({TMM(oFGmUuMkVb8^ycDC&f3#FT`)e|BC&yto(+FCyGF-IT-y`_Qf06EanPu+~afEn^c%C>zoJYcs>&PoT#$xF^ z#D^6A3|WHnrNZAK;pcnOpGj|){+2}gKg7P-mOerpP9opYVmgW6^`0qx0SWsTOV5

gzXK*QKdw^zqY8gf{I~eIxLy2R?44uT86XZL@#D)0Bz{kvLBh}T#2F;=n@z&M zQgIQ9^tB{@cl-c}2paOKU-WZE+enS^CKkue2|3we@Qky$r}S3oUrG4UYlda_ zU=n&biG0rxFA`^o*NC@>cZ-jR&x`BD7O_j*DMsd5`3w+8isQu7#S6tb;&tLO@gDJU z@j3A=@e}bY@q2MMxd7L*`5@{yhD7}yB0X68Xz66>vC^kVPm;cXguR(!iNbFZ?-Cyo zpA%mf-xog@x02;pFG~MG!aq*|2!H#M(EX*4kRBv`oU~v1WD@rB6dsViPI{^IDshdt zPTVNAia&}6&a~_f7srtm=-(v#Je!1{Q=~7I&Xt}ceWmnu(hH@RNw1K;pM?FV#n;6T z#SZaDaTj@=2lwA}*;B+{QEo+r)_=aJXrx{E~l7Lu@clk^>mzgK)x zd{t}~Hv0hvwHi&D* zMsc0EUThMZ#TIds*ebS(U1GPmQ`{x)7NgK4ET8!v0?;QND<+6T#YAz0m?Wl%sbZR# zE>09P#c3iQ-8S<_)+Tere6di(tvfRwr!hz;Ue zalP0iZV)$$o5WVJP3#i4i95t@ai_RT+$|bjt6Y&{lo&0>k$7$=UQ7^&iizR~F-c4j zQ^hnfU7RRpiqpg_ak^MY=HTyMhyk%wtPm^3Dsib;E!K#2WS-uW0M<*d5gWv{VxzcD z+#qfgo5dEfP3#i4i95ty;%?D=p91`djI{iU63zE2Al!VP0vNCG1krr20>aJrDS#;o zPZiDgDj?i^p8_~p;hEwzF-x2-7K%k;Kr9t2#7ePBTq@RztHe5Swb&r86&uBM;(D=3 z+#qfgH;Juco7g3GlbAerio3+!VpI<+K3epNv0{QaR5ai70DB{(Q^hnfU7RRph?B)E z(R?2S?Bq!2i-ls5SSFT>6=J1mzBdAPYNTt$RbsukMr;t*itEKDaf7%~+(hF0;8w9s z>=L_4e6PAw+$HW7jh6=J1WB`y_f#Z_XRxLT|i*NBZIzIR(Et{0ocW)k18wTPRo_R_?3aiW+ZP8Ku8X=09;FBXbL zVn8ev%S8U2E#_M#E)}cA8qs|32hy#Qt`k>__2L?_QCugk7n{Tl;zn_k*ebS(U1GPm zQ`{x)7Wsm8vwg%UFu~szS^8&kd(yPUKagEp@t`!@_b>aqbqu4CAh?~S#u}$m}w~0H% zUE*%h=&kk`X$Br!!y71P9YaiW+>;=ZZ*J{~Yjdb(Ih;yz}P7!XUvGO=8& z5|@hAVvSfw;-Y)CSWjMr`AKXbaerp5*hu1j%sO#BiR zpj*W@64x_b;x;lD?|&A%Njx9CQ`|*j{k~h|izT_fjTECuJYN_s`bezbV#PQT>$P~1 ze}{|fG4uUJU?Mf14;vvSkywYNh^ZvjGihQviJK7v5ds`8|7jJiT+qAR+0D~VX0V6qCeJ%wIseLSS8kx zxQVh_tS8a$)`$%x`rBHuk;MJrb>e!m9PKY|Ag@FFi_IkNE4GN6NZb!>72C)Pw7(d~ z`%pKbeMt1nROvJl{W42>I*EQ+E?q&QU#^y}C($p>`(vB%HAFO)7K(J#&WFF4-3|AKzGO7Z4>74*wS>2)NW-XOh^M87oei{SWe)aaK6 zue+fmN%Y4N(n%!xtBcNY4Nt^cx&@avV z0!Y7!;pmrLiZ|~IpkMBkHt!3dU;22RiuAE0`sE1eBoh5{nsgS4epx16PNH9~k~Xiq z(J$9Yo7dIsm(u2SH2S4^-HiOUF&vG(hV_Jg*g>NI4WfVOcjkK{(cjGLMD(+7dHz8E zGT&c?esy;YH2TvkWDef{dk~0uEh`p8zcJr)g#PmJVbJI&#~lF{;QL_`{o=)eAo|0} zM}p`F8G}Hy{~{9YZVUm@-uIDc=SC9kJ9;RHc72INdv5iEXvg@`AlfgPM7upjqP;vR zAlj+l7!d7KOrl--js?*kDJ0tAQ4;l^F%Cq%&p94MeYcXR=av&d)bA(^RF3yKBd74}d5|2fHi>SJa>X5!>8DEyqt%&fVtY?wuEX=(AS8S_gEl&w`yXv@nP zVyTkSVq@gwktY6T9JBY7&YDwz1DNtpgCHz^KZVRIEXbR^Ut51l5oV43I*?n8d8N1@ zZ(cFSL~j0Gp8Zt{dpx06mdv`gAbZBVc}3X;SBAQndh48kF(VKEnMJj#YS!GD^FqnY zfmNDY%pNzl;BriExuqCnf7`dOE}n(1cNMzA|0Q)XO7(wE%-K=3QBW4Zhz;fNr>5Fx zQoCkYG$ycSyzDu-W!W=}b1%;>Dww-h@tyH=b#ZQBegLToFse$d>0;)*;yHg?8_Z_L zHRzz(xmV@RDl)P;6wx*E3TJ1}WWc_r3i@YNBdSM9%o2u0*yXWXdQNW1?0p)v6Y_ZX z++%h^VWz-c<$vw?_Dj;+WOGPYdiXR^{cD7Q5yFFd#H7`2$kRNk_z6};Bn__E+%H?mgW|@&V?Ly^NZa@`2Tjuej1ydyr=++fs&Hk z%L}qgufdZ&`#zQYWlF2%i)PK$k(S2vGzX3CT62cR(>@!{ozkp?+@b=^-PyG8e?M~r7ZC*Y<7e&p^&MnBDF)Mrito&J5&6%gN?>9sC@4u)b>$<~=+^>zi ztFqN|afJ~mDkv@ZYmz$jikgTAo#7nzL-VpW<0vF%Od$rbk`QmIMl9=TAB9Kly(0u~yFi=Y0M$ zxm}r<|9Dwuuu`#p!2`0qpeW6q0bVo5qd*j}1j(4^fWxj|oL# z4^fWxr-Y)ghbTuUj}Aroon7p~BS$AEJE@#q?7@~x`<+y-T{D%VlariO&aUN_Q*Wc~ zUA$`#uHb*Wm!^hxv4{K}?H?D4!XA!tw0~?U3VVohw0}$}3VVohv_B;jg*`+$I(c*` z%J1xA4<0!>8Q)CUemlF^W4(o%c#Wc*#U74ww0~?U3VVohw0}$}3VVohv_B;jg*`+$I(c*`%J1xA4<0!> zIoV0&>|zhLT-xuXa_yR_9G#rxq{1#N_?-~TqFs7F-e0MTz#cquv_CZzg*_N?w0~SE z3VS%p(f+ZaDC{B1(f%=^DC{B1(f*WB6!utsA)P!rwCi_vv4>QSPEK}GIlI_HHg4^t z^1F7K%F)S5P84>{>T^QOw4oUgD_{RezjFmP_v%^r&L%Gq$PVC5rS^CjAKJwp>^a(> z8j8Xm+;FsiTqp{AILgufv7spJAADDGc6>-0_}0?g z7U6&HY({Qux4G6Q>=JJpEFddKM-v)F07YD)TDD2I)my2|6|GHtX4vAQQ zcq}MnFV(Uasz3fVg!wQHH``uHn7!)XocimlbUdyW2e|#?GZcJo!QO0pHP~_cR|k81 z4u$^p!-wf;ugJ0&@{i9#Gn{F-+4lGw1h>7w?~Z@{m5#?v!+&o7_$+l2%4To2y-cKY z+pB=RIFy6_;W34fe~Fg8kbhB#WIjy8&9*l*%wFvuj(-O$9gpj2*$a&$9}MyNA$zm! zMTFU_hrLw!cPJ7w9qsXN8KS%)|C;fv1jCtzn{DqCq;r?I&4>t%4?KPmvX=p4d(|K8 z@i}LEv+YepBDcM6*vmv;VErAAkL_Q)WiRC4x?z@oOvBB#$A0d%m+p1^!{Zr4f^=?snXt!ck^Z4bA$w0*_Co%pC0hP54L94~<6-tHT>cGGI@bGd z__+O>2zwJzFZO2J`xyal|EgiH7Gd;n2tG_ldmHhAy^w!Z!>w?p;bz<0fPJ^U#7L+9 zj#4_>I~9G%?O!$Q?W_LATj@giMjdPAi|RHvJ74~dTX(*xu6$ASP&v-TgyYWF2Yc>w zh;45Y(z)$rxa`5zkiCJHy^wzsVUOiw8g90|0b%yCT=qsN9gq7J&bj@Y410Vo-QH|_ zKOvFZze3onLKxd^BtA^X!``;+h5Xw++6reHZnnKQ!t8b9k2l-rE%sO2-m{n^kTf)J zM56NeyBK@3?LCEbZvTv)5$1D!^e-77+a8~hguRe|DR_p7elra>+a8~(blXep<@m?; zv+W&w;NJeF!CseX$@Hw@|A_EKTb9+!B$DrE2HuyL7yXRGKR({Qux{SY=T3tj%D zDjkpWhSgsp>}9e-wb}Oeg!Pv)*vmi~)*p%#@{iB*y6dkD&v-E(rr~DWO&zkC=PK||VXdxu%+LituJ-$`NV4n{h6Im%r5o{qG3Ir>}uG&C;x zPTC!q6Yb5;mw%JhZLbRUqEs(uxa{%SU<8N!tAt}LAJcHN?eSS+x4r7#PQ9F^bUg0k zh`sA&DeP^dA#Jw350K7nug+!fY^1fzdyi!=0ddnbnFTcdoZgryrFmhXC3zULvWU5+;}ce?w_D%e|UXR36RFIee9_E_EmBy#7=cc`|?7Gc}t-)?sIgXlA?d@od5JKcpyhkv21 z&6RH!LhbSvh4s@|*sHM@IZ8((g<<`)8}|77IF8?om5${|x9o-LrM}Sek7>Bs{-uT4 zYlw0B>2#%|y)%06T`vu=SG13D#J?f!F7JBS+lAxlA6|D9D(}ITy^w$LMV5a|!_D@O zf3w3;CBM|ColG zZSVdtd(AHY@|BMEH;2_ z%w9&UQ-8E;+nd*K@A|8Ry%y7w^`C8THqyE4FAMfEk%aYk1wOXDv6j71{bkLy{9_t! zw!P#qd-X2=P(>kopIY`p^LP&IC1NhIH{0GvVfGqfuMUZx#0Q6j?D20pyT@-;!19l2 zxY_nrhS|$H*r`7p60&!-wH^=oSB=QYrX}k?+uj^2U8r7Km2a`q+UaH?ox7e3UHO){ z^6eXzZx`&~TIHP|mhYah`MJ!M?^UjR{nor2DsLt1#qJ~DVOF|Od25w# zSy;Y9kj`D+Dp$VOxbl4tbDevf*TG)uKE~10Nawa!3wt@R!+x;9WskpIcK3r#Xb6s1 zrr~C{M`f73T`vEwQ#u~^NZ2~34fYyoNSkf%p|JH!)FBa}`)fBKEz{9nsb$ZpKQunW znTDHfFA!!g0rq@|XL%PY9gpi__4`n})xq9c)V;mg_B>(zJ_+`CpNsZx#K-op?ZCb3 zZ`!q%e@w&8w%3Yu?)KPqsN>&FN=N^WL?Sk)?b3AE+t)mFIMTW8Ma4PSDT`h9et=PT z`zE1bnGe%&v;F%Pfo^-LuxHobElS7ZKDO+I{7Z$sW;(3Rw)a7py$sl^LK@cJ5`66X zd(yHOYTqbyCIp#jfRKNWh1qL%`M1nvZ#?$h_2+}VZ8W6K_HPWdyS#0%mx(a?w;Uha zzi8~c>u;C*V;XL@J^Jjnmvop@e=C%ZX`ZyM%R=>MT#vO1!tKqr_gL6%o{?cKO`7jMP+a7;w>h`bD<=-7j$K$40<1OT0#$Wh%df2$EQoeUFQ*3s= zr-qHoGFQHwr|ohqvF6E8zSXdovyXnYIDDRjJ6F~DiJRZ7R>`W^d zFm6X6-NUXECev{nf^=^GeDE(0ZOQW1;bYfd7WVC9uxq^WjbY^5g>=PzjWBn*Vcmvt zZ6S}aHajkebnbi;kBTr7(ye?SL{dB72JhbX?#IP+HwTS2+uj|#s$#!W~bY#er1PmLOSDbiyfAy)7T~@QB5Ch&d~AC|efTY(jwJ$L;Qcg5SpF|YdZt4X^U1!F;;TmHjhr_s z0b3IP(`M~k|Bp>cF+=fa&zR9;xtr7bhSMfb@_1~|Xge`fKg_dXjOjs-6bi&0i`edr z)H*YI%woZb?%vWZfB&?9P}8Oo$zPCPUDVXM0#DjCs5b^zdd`t!M8=7kv?l5 zcfvY%8aJ^^_U?tS$OMJw)OGGkzbV+$sB7=8dU@M{(KmOJ%(Y>8Wks1$(Q%+rv2Ea< zQOFlz4Gk6D=N|X-pbvSXgaaZj zS<;CL-5yz2*B&u@NykLri$Tnio%lMYclVL^1#d|9pd35~zWbK98NOw~)=~EbBYbt8 z5eduNSQf^SR{1kK@q6O|xVjDYQ28;xK(7q;l14f4b==;^e1&7^R}B360Dsyg%D24Z z_)C{`7=u=9jp$z3#;KzX4#%SEr(wSgow*W*_^u`1ht0&N6ybcwPc+hvz=!Ye*^N&k z)^@4-lpmcgzAAKJG!eD4`)-0HzG1CKU3`x`Os5s^mkbl53kzd-yC5k_wwXCRGP zX9%0`HE?KM`zF}uv5z1><}=7xhMxe}weMzqtFG_BpQ&;Ceb+wxW?i%HncrgMw*z)r zj?>VVw*PEHxBrJ&{jsyzs0>a|Sk|!-KIh~t>o9!lVW%dzF{vh)?yCt_2C9QgQI^Pr zWx?JFH+Fc&-`HW~EDMe^`(S2g49e1iesjq_`ptUe$@1A{!3^J-gSzbLHMZBw$7jbF zAs=h!Sw8m6S>Dz&!RjwxR#bKvfx1roe0Y1gjyd`S=a?eo;Vzfi4-+^J&+BYqzx1sP zPK@~gWt!57bzSdt*%$#E5fyczyhmhPc6wwkZ|kAFNr=dTQIg2}dbv40Q)MwA6y7nIMueWTl4|q{WJRW~9(DdhIkJS&X{!$YxLtiwE z^EfiMn3cmg8I2F-Gmvt-i+kW?O7f9(G@= z8Rhh~-wpOPv=`E4p`EUpV03a!a4ZCHyxo@yaSY36x2ruCzKgKN!UGx$+tC*fFw#3X zC;kUxoc)x2w98X{FnAE^rbnH@x2a`%*Tc_9aY0 zvFM}re6X>iCO8CXSr4(UdWa6I2hL{`(LQ)XWk)2&RiyDj(C51&NS|2No2dcGg8TeA|d)(^3Du5SNK^^=eqy(bIS>7~wHG*BY<2$HG2s9fNvc zzgpvCzgS_`=@G2Iz(Ujs+7Im*Y24Mty2f|xz3uYUGt9?+2IfSb$2DHiuRD7q@12;7f7r)d%rd&?;+_}>Za*;2JgBdT z?&U8>v0oILZN_uTlunPYxd-U|0sZbdUvv9f--dRq{t#DX&I5KodI9IYCiu>LIDh9( zKp(<+jpt9>&#FLWuo|Bz+DHGi*9Pd1p>g_Xq}9J^qbRc``0*H{ll`RuW#e1|UpxC^ zdCT?5V4gE^Y?LbxT-678>~5rQ$Fbq-8P2zs&mRX5fxUmBTmksQW40rGgVEgHgky~; zYYmjt@6|0_2ibP)<2}aDLHvzl)X&GkTGX%CScc0HYhL7h%yhJABY=R?LU>IXoZWoC4d;sOyt3heQUfdd}7Q zVI6$2`y=Ntj&=GGmxS{;{2Oha8=SnN1BSPkaY6f+_?mFH+V5=GwcBn7?AhhQ_aECQ zYi;uf{NXvU+0)b>nY7p}Po(i_Fazhx9==b5+i={z>ZBzb=S$almggMSMX#K?_M}m- zZt0ouaIgpbjYgfb4%xQPqA%6KH`^!rW7lhM-{OvV%vY09zD)RLme1_pnVqL$Zetx( z#TuOnNRyCRhjnm8TTj#pkI#fnGmp$=!EBx5PgXsq!hd%?M)){qP3goEvv)e$AP#do z$A{soIe40H1IUndy3R6`zaoi!@q=J}0?(0CI-_$8Z%f1wKvq*x_7vcoHVHt;TuTuKQ-pRb01LVlKDGwSB!4zHUA6 z(z80AL0Q(QZfmt(XWg!H)omZtKj#t7ADlaq=DoVbbHD|iAHab!)z>kuaka~J?7}FX z!#)m9L3|hd3iqi6Y1vQhx@B6)E z7-i#rPwX>IFRV=x7=}I-<$K)>I{<5@-e~IqGB=ZX0^W&X{=ev()kZwgW+n>*GAK(7ZRneq5;a8n1(CHxK6y z_j=9U_h0^F&-PZ7y%`^_37P&GSAA}B)fN4S!CcUQW9)U#`F}By3dcb$?C-*{_ImSW*L5Y&srFn>fBIsKEk$~}4L7O`@4Dvybz#SNFIm#Ta|z3e zzdgQJ-LxXD-S4k5%Zcy1;L9p}s__ZnlaEglK11<|#>c??o{4L&=deyXAmQeY=W(sl z$GEvIqM@RLZ61+{`#KGEoiRFpjxhWG%HZULWx*Y}yneZ$b9D}{126F6wP3wHk5rl0 z{5&S!xD)Z2op`Mnt_3e{&oJ&h3iUZ8Q1QdjJ$z>-L>W^C;a2wXfxwVm)P@=XqY_eE6v9<$j&xIoI3ejcQoZHZAwgV6V)Z+7=jlw$QJH(z^D| zI7gn#`!IpJ&T~NamsZu^{jPfExzF7;ry%VHq-|8%3teNdJ}j+w`dJ+VP~U9-6L;^~ zZr3;GlpKCAFTRg{;6;2-BfYJs@ph2w+ko-?7S7RJBb}l$v79?$-!2#DNnVrXU|!|@ zo*3+Vl1^#kcr|ccXI-n>>#5An9F3o~@_SR*J%c)z?Qh|08vJ8_@Zl3l;=92}e$e*p z8==09eA#E4hc>nEGG1@*VSHq^Z9ejgGZx|AQ(foK1S<{KOT#i3cf?^mcQndM9q+5? zh)Zzp5ipEpy&LDCxQ6N=$2-Tly?$$3eqS)E0(FBv!F=sLK)q7utz6X^<2moGLO9oN zYf!gqP)_!}de~(hvp#WMj7wJBBXZTXZJ+-5;BP`?9r}N8tF1l8o2LJOrZ(=pFX z%QxYxjTXfWPw=XFPf?_IMF@Or)8hNs1xGkWAK>8LQUzAzAnu>J!pp;?A^ z&3o6zpc=Dm7VT&24yXAl5tZRr5H$QykD2_aLg#Ki@*1>Ow!- zgb#h^Ip{&%XPq>v&b-fhAJ%W~^GXBi#n8FsL9S5~Rt7f>x-Dn~ZbMxeA$yU&2IN1b z6JPV<_zOEDa_ZW7U!+$OuG_G0B;Ag=cxrnI;vIW72#(xu3w^YKEnC1&5LWQI+Tmy|LtL|0iu$udqis!nvs5LCy(PX zvAAwXOI{K58t1ithkZ}NqK>q|3xoY}ABy?f=YrrEr|sP5f**P~Wn@3+-2SU8E$0J! zZrXyh_PMT?>-^n56=^vi#)#5+IWAcFZ{Ic50Mdp^;=DCENb&K?7e1dM!7KecQ(4_ zT+ZKix!C{T`7h>B*snrAN?8W;Qb;RW?3MM4*n3~|euCa^$yJx^{SR?bi*o+U)UFrCw;1h*&569d1 z-FpV``vrR*h{GB&-gi?+8O~er8251rcUW@<^5C`kw1n#5bhJ^j?qd%``MItP==&Qi zDhI?umrCPnYOYVsd7k-jzY0Fv*ZIts^BTjz3qN97->1D@x03Z6?CoZR=e_k z5%#&RI|S)>A-z2paxKBWJTa#xI0ALX{81*{$HN*tp(faZxn**|x(DJ-Sk%UIL?Y7V zB;j6pz`9S)zB69^Hbp+q2uxeH%I-Wzq-DGYTQo^;gtP3AcfJqGb_;(kzFCv8@s&3j_~ML+S( zLGPWidl2m6yc4q97G~Gerw%r6W?r2=FyGr_h;vU3K1KL&UPwoO?2%c~7K{4wnfK1m z>ogMTyp;(Hdzkf!eB(7g*g6h65`OVM9WGi1(9cR}`q+x|VwZfJ8|Gtkn2(1om6QL2oCBg*&lS^KPeHaDR}>mKRdl|%1P4$q-N`as_tWnJO18E2@_(-8LbZsL8gFW;2&V)}Y+;+vww zvjEe-%XgkWauVajdij`t^gmRt8_=l?0{h6dFotoa9RCG&$i;r2ym9WRT|N!I)P8V3 z^7ctzosRv@jtm&LrY9rr|y$#n!ocGE*Z1$t}9Nu9|Z^l^+||&JnE7&rNVfNBtJtoHTb5LJ!?@)H7Ly{^alx8JAzua=I`?_)XAelONu>IT=5 zT?n+#SV`pl?)lbQ>Tl?#6-Ou+d%a!3{xlDaYJXnIS#RzBL~%9~#l8V&lV$4fzG|JD z4q80U$9cgi;R|a7^or+l1&{~za3{ic1fI)PV;?c^`X|T2se?EpJvf#>g7+B7gJW*h zz$o7{7xf(+E68vU^Iq7pgJW@|7Y@SKJ1CcUYSgR1yokMbG@W{BEWh$8?ECsgx7@~k z>r?Otp8Xlmn0dZT+3}qX?MM&!{0RI_9j9K*`#ii4r(Jp#xE!EvIDb|=0!8p65zb??FZxWqFf@Hs|rz__t*)NkGyDo+LP6FJWc z;fv-ueIrj|4d8l`#(r-RbVldoW`AC*eZDT|%zXg7sJ=8}jM)~~t&hTn60sf2d|i4+j_t75q+8L3+Ns%=OgJA&le|0$nM8a(R)7}Qf1a1|{8xQk`wZpV zn18$dwwYh-uZQo3PHzWY(#*pikLP(fS07yhnQZdQuk>vt_af|{^6+c$plbnboz~?Y z3HqL#Gdr!iwlDL#Uzc-)_G}`XjXxwS7nKE2m+=q<45y#{)myIh0m|B)ugn(ym$OdkL}`T^yTf9|=L?FUSS?Dv7rZiGIB z9)wneCIs4o7{W>Tviyw$b?bAOZ?q5E=7HwGKG5G)Uxw=*=eEkg%tM@SM+?yB!a_Q8gSov*!q2x;`uLdhqO97=8+Yr-4}CC!-!^908nI)VPu zwo<-oW5~m>CA&kQ(*$`zCr4=e=?{7+!!zE%4@6tO&XShO^mc!q9P-EL+d1z6Xm_>0 zJs2aQm&Cgt@QArDZRTZaMmW!fX5T>eeiG&&wkAzDr-oi(Ok=PMG4LSeuuf4<7=p59 zzwIAm9CR+F(XQ$}%NKWi@W@TD^YTt94gVB%;m4QFL0!t@pL5PVPFZ}boe~{QpF%y+GIc8|r!4`C+`KzC?sbzQ9lT#m2>b>Y(;{X@J|U~GgR%x&Q( zIWWpIN0CXhk;&QLoh@4iJz_c9lcVe<bFo2Kf#nu)pM+ zdpC~Ljh3zEd|*CxwL|;@tm~M6i*R0-fbWyWK0Uk7fGnNFQzMml*HBU6$XZQZyc2C7 zzgXoC}pk4d{SexUJ=-_IDY4g#6@FBa51! z1Fsmf#B=Z=pFQ3TAA|lR?=QuggY&CTl80v4SD%OF{=B{2Uu)F{TnYb}`op=a>*W2` z9Jkj=j-v}(a}nyC^y!8zJsUy4RL?d*&nU+b{QUy#S6$de)q{I6hq+JSSqc4Mp8d=F zfWEs%E`?2m-TS~cpZ?!ielGWtN}sff(gUN@A-_{-NB18K*k<$7BfO^{#$1_s3(wKV zzxz84S~}+BC6V5UdjuPg?;(egotB4cRNW*c0%5M8325 zW&Eb$vpc{y?KIzg!4@6)0Dg-=o~Z})5x!&j`_dPr-{s5ZO8D(Z{tbS6N@?Q0Tk2`p z3hYN4!G69#8^iwmi#0a3jTr*3^u_37>_AZe zg6D9v!4G+O)35uoua7oAHQzh4Z zAF|d)%C84Dg?BI8#g7Q~JY0iVPuC~PbtdM|ameK`Layy7`JJ(m9X>yWIkv;r+eYXL zNSS*6wDDwL|+aCw=xgYgZH>md;25Fa;@y>Li zzN_GQFYnu9&s4bG=e5$3ojq51FOU3jU7BN+vH7E1F7x$<{TV`_zk3>XFq#|~<(aqK z;Rnwg$9euc59nhd_e!K)`WCd+mg7wJjg6q&fxt5y*1OQEcjDSWX5@+WsEZ4x3}P<= zeLPc{eH};AASAo*$>nr?Jm#`WBi7}`#iKwTSFh5MjXqPB zQQXa{0`DcsKJY(qv<5uGQFu?0U|1%79yzcEug#j)Rmz_o{R-+(|p*ohq}ze#Zh3lKxE z1#24PLr5QVO_|zAQ2tOffbH`9yY?p$?6f}wSDrn4b{ISzK-h|~31JaJ4Z@%=|Ib?b zL_f@yKjq%+`(U5MeTS`nouw)0E#?`=Y-3KH5Z1?*sFC*`l{aL`ISQX(bOr7-a7^IS z%w2%7!yUXMpHF^oRPHp~_SK)d_`MkR$D=Pt@YB-_&;A;Zeh2<;*r}nuV&0~Y{t|N^ znsoHt;Au79Js(7WXdgotPonQM3V*Teu+QsXS^cwZF!f6B$iK>c1n!;SuU3M`^eFTo zir-~oB$kA}>FZe~c#Zn&Dc5?o&pG=J@PNNzDtGC)|Gu>v`!C3aa@0LIeF5sa&Z9Ku zD$kOc_H&CruKBk7Da&@;;iO*jccR?Kw&G5UdFS`Fv0FihYr`Rg(>}e^7CoLp*z_pN zb^h-pCi%Vq>`)Z_ar+W|(JO^7^S-zaG;0x(2=oQW>l4;o&GiMy>m#^dN?whhk-&Q! z$T9J~XsE6)1X~t{Y(vkm{bt;=37LBp&jJs@R(uM!eFp3c{a@T?eQ!SGXXbwT=%4Z4 zP9OKX^+$(8?;CR<^Dx@`{qN7poDHY%Jd)qscjWUpv)m0`(|QqSQ%NXuH(m+XAN>{l zf0o0&q9f!LzhC;m&#_-TiT>?H*oDxC5cB&wY{`*(16z)=27(69y? zWMJzs-XY35{L=5wUdehY^MA$IaG%Ay=9-4NUg*HTqzv=npK3Y`d7<`mF50C{dD8d0 zxVCY=9EDDj);+fk96gNrl{>d66Xk0dW$8oG9&n6!k0U=BoFl0o<9poF*4O;DNP}(d zM}74PsS7;_oCiGbVjEXtZmZoJLLFNtXe$rHRwf}|+J;7qIpzJW-<^GdvJN|UAK9bl z<5-hnS-9hik9OiWd0gkP=NSDp z^d*UT=AgYfetXrhc@?^y44pK4-4JZD-%mU+T*T!RIlw%{6v2g8I~- zgsw(m6DXGqU7uFyjs6z-5{V?Z=JZp?3`;M^w zre^b-?zj8<4E$_H&i|WzAFVH3aP;h?`@wVl=+(&Ui{qODK3)agOh68l$1B$dbI74A zF*cM(HTty$ZSyx$6&M@d^Wy!k-lRFh;TUrKn$yo7fj*A$PL}S=nYRhFnLmi%T(F(L zu;jPf`ppH)=pKe+M49of)@sP=G}_Pj_5a+e-)z;7gHN?Fi%^#JKkfHvmTyn0QC`Qm z9&~As=nv0>E;{ymGT4CzZ!!FTr;vL%*lVm!>CsbX&(4J|2tTKbK?`l%Yt66YR|j%4 zI&IEjxCf(M!QHCQ?ngcHw%Dq-H>aM+9%ULJ%YK|wa$X-o*nzMWp&22Cv7ilzVGLQG zy3aNflR8HS!m#s`2jDN^t}%EwyxExqqC2_R9S}e8}p9XY~OaaM4@NKhHD$eV?^np1CTJ(+c#DYd!l%`$%2m-krap zc@S+?k!Qf*#r+cfLGbhd(y9BnBOo%k5POO$$b@cAvfp=g?jR+SxvYCWHkDspLyI_rjRKk4nK- zgj+uUy4lk<9OZb)oJ&(DpB8Cw&S6a!=NtXDk`9UCKu0KYXeX z?C1YEd-h8D1rE-($usxq-+^z!F{CW1Ba{Q@OB8n^s0UaF%PNvT0z82I$CRUQV2#5) z3CW8&AB$cIz5XKRnC(~Nj0Sp6U!3yi_Xf<~8i{4Y1%~ejExz|(5$MW6@Ut5{>_D(- zf)7;RiaWQYx%lYc09Rjv`##dP%VSIH`-`|Ei}fk6Bk802kf&v9L?2!lJKkb+1#LtJ z@cSR`B4zF&wqDAAnQ36&t{Apj=qO&LQd77$vcfDe!U-A^&&a-V$IyIG#u^l z>wX_)mkCcF9Xn7;xtzP_+gEAir#iy>;58V_16eznJ~~2Q8R^SX&mN&)97+c71aK}_ zxG`pEyl(N;1G>6q(%;+|>v zi^pn<$G-%RI{w_dug3f!Kef;~?q?qXy?yznpSjYB>RxnrBNcq%rbWt;O%KU*z&8!ij_`CIrFr$DE}FW2LjyWRIInoySd^d`!2 zEUEXGW1b%eA16?c>vtdOa^1hmY9nK{@%uONUOMWp1J-)6@6v#eV%*hKU*HTjZ`IAu zj&Y5j44OP|J2trwZ9g}5VjAn5tM`XNhxShO9^Vuh`)9PXe}b}mQI@`qmgU(&O|!W# zcQ83LO5ID~es&1IAt}i`iMIF+5bmGNcd0lJI8Lfxv@iJf-Z}PV6UG8MeU6X9IyK<0EJ`q#qG0Sf}WtCx@>Tg|(d431#P=AMf z+Rs~l!5*vL+fa`BoAl{_!Wy$gMZm)Vb=s$eKi8F=N4*xUOF(O$U*>+Ry*XBy3s6RN zDdv~G-RjfnOM*7zC|mBA`LI>Sv*<-phW$JfHu70%@pi(Z^;^8JW8znQW+;g|gSp$KH+n-0^5aIoY$p4%%&HKzl7{4}iz52ptIg z`1dI+SjVu64I>O9>_LDt>YPG^MNIyF!vWWv#V-S%M%awdhj75JGXnS!!WlSsClOL8 zUxBa{Fn*`y^dPh&>_r;C@pu{mXBEx{gbYFgA%eiV#}H0~Hw}Cfp7o|;UGdE9IzgQW`sI~6w)e~hYjBzgc#s6h_ymxkcJ#;5LAZb{WN(+oeaV}w2?yKzukX1w=Yw3_0MAX zR-seFGsWk|LTSFI?mL1#B78;Xg_y73`L_jg@wBB&5aAp0PABoSe4B^g*T6X&SW1tg z*%uD_y7;DbwmoRor;a%hbCwZ1`0SBP-&c-vEzC;}j8tQaWcKx047%2zwDWAY>45 zKIl{;@ZavwhD5H3tX#K*qGiiG&+9vq@a6sm=ldhP|Ka%GNufUu zmBKme{1M()2H!t9?T=@X#pm(!jHl9-{mLNuTqZtm5Bv@nzE2<<$gc$ zrPWcWec2(FWjT}=z9BE%WyDPT$k;6Kkii(je;aova~XKj^+fGsw{QPdKW;4!`c8VP z8ys)ty&ATR-?79!X{Qh21jZM_a9RF9#K7sqyo|6vqVj+Qn*J9aFzO~%i0UW^X--`|Tgb4;6X z|8IQWT9Lt)?0zR7dR&rtactma&f~>LVY=`><{5mar+ySfUa0Wbx}}y*lwhqZa?JT4 z<({9$Zw#ELM+z`^(YM0mz8;Jpvt1E>Y}<~M)s^$_m=ENFglEYbW?=uxAbF?u!N0cQw(;Fb1tqxCH}()tkA zVczlJdaJq(nL@W;94iGc497<00$>yd7a4bUcN?f4l!O*>~sMYaj3I zT77MMOV^stwd*^(m-DYUU;Fy5UB~vm|EC}Qo3Sr{cmVi~rZ9u3htR zTWe28_q83X9`0)CT7PYKcgJ%1G_cd%*7aChSF*dOrKfFf^3qnPy=84{cYDifV6B~N z+niNvA8YAY)oMzxz%92XGc8@+ZOIiKtJ>D~B-`6MIyxP{h2^BYvaM%D`|?$5GwXVs zuC^7OU9Bk8(%RPL*j18`-7qJ)rmefX<&m~z&-#pM{^6F^a|mmR^H=R?TYHUgK8|>% ztFxzbMQ2A6J?vi9xpr>yp-WrmUfTK&aFyw3S>M*0H0;euwyx@4(bCnrYV9M+@rus1 zJ?LKd_=d9*3b-EEbWkSC-uZe4-q$5(-I7c>f2ah?U4_EuEw{Y8?NOmt+18tBThW95 zUApcHXJuE*BWuu=<((^6cDME10y5boaQ8@0JCm}IbBBy;Er&H*u%!p`ORnwgNp`Qx zWIDS*`y9c{Q5kD$=h}|-TDCh0tw?sSY3b;Is`WrN$u+Ciu3EEhjSfh1o;zvcDRxl z&sCY8RV$J!)?v!ORmn`}D$MJZon32Mdd8Pq)6$z&3twx-wc69QZY@L(1#Dl_vSM6z z+u9Xf>oYx2g*K?dLk+P>@dMT_R&e#bq_AGqUz2H3$C*po~b2BR&x5~}=g z%Zk-O;krc+EWh*Kblro?m)v>Zop;|~xA6A5h4 zteuXwM_N{_KR0ns^5L$wmenkbnVig;7*My=1a^02XV7cRG)xmzse}xnD_2ZNT4px- z)cH8n{4L2*scH2q4To1a(9fhb6}pqF)+V9+Sed}@x*kwo+Xj9))@zdMx?3LZXp=f? zJI_-MOHzk1UKUvl(z)|rR*wm00DF$Ytq$n7w{*8BvvY$Aoy^v-(qa6rPIk9bQ!#cT|Q4)VFk-1qaD!Bh58R;}d&6N!X+zbR3u0NiW zEC--)?y6%OC)fp}Dl+1}6)+1KQr@}F@sqmR{+DRfTzf)csrR#2bxRv9>u8UVW~E~x zUDbs-VY@e`)^gDVD63h8y4S5(0dVEI4y=2aBR!p{20Mwx%anIi!`kR?`8w9qwVs1? zuA<+F&Tp$yosfTm=WY%}!0O zXm42s17(x2U`w3nx43!E#M$t)%u00yB}DrMXEs=N=#pvaJh3p9`zh za`pAe$Fa0C^=d3K$?LAUK56EWWhettP1G}Z?2p4eXv1_7XWw}2=S;@OMQ}aI>>S|Y zO%pglMF@DweRqSQ&c{|^jRqS5Rfx2`6AOeYY2b3_lv;-lVj1aKwT6CwM@KH1a~wZ= z_F)@=)pItwE1kV4HJl`rWb= z5p3sjpiUo6F!m&=-b+*0H{}rO>FjCg2vo#3{>EHo2TDfB_@}fckFJA3Q9Ax+1`Y|f zDBbWpDM#O9=rBCocboeANkSsqXnp(D{0sb>ElEy0?71Q$8W}9M3naSAJods3QIv7k1&q9r4qqgn!CmRuW#F<+A?B}f}K44m76qPMoM!PdBE`6FGO>oQsO zX6hQ8b0~=gwfD|VHYFX2(|&xn#!YM@>&?j)N*qdZcc&vyv#}Dh5U`mstuF8AYze#w z;ofdLgAGjX;t9`3JyrnrLo<9r@C_E+7Yyh`gtC0tx@u0Ba+SxJ6*+i9E%Z4! zXR`Gw+f^zrHbt#?@SMp$8nMe~Pmx$&s4h3l-*W2wx`#X9^jW7bcGYZC)EC&-6;LH^ zMvb1_lg#GJpb9TO!9WSnh+T6W6PfPS%dwQg_v{HqQA#1hU+}R0o6WFHSknjJRJFA( z&#b{(lhuHm;4sGT1-FHC6dt%8jzXZK z!Jt|$iyYCc&zc&azwrfRgvKRj$2QXj{iMZcX~n?|6}P8T7f)y@rUW-lGO0|9*_xWw z+S%5<_VOMx&&4^+omT;?=jAf1?Q7c}hZ!;}qQ3`FmEchM+X%BhXXn8LmGCpCv*z?y zUimtBXN6ZmP6`C8Lge7w8(;)cMZSRi z%Vm7~iqt)b4jS+fqPm!*HX))wP@oRc83R_}#p`CA<|B0rq6KIY;37l|aDSK}qU{D8 zKs0Q?!-!(I%!C37M9l`=h^Pmzy^z|AXuyCw5DgpfIHHXh1{C05Ul_(~4S@J74o)R* z`T|TL>M&q0qGJX;j>s#O0wsu+8L%1A4g>B)l)OL+%t3U>fQJ#);rbisE_FsHNNNO8i2;*{oJ%D&iO9K3z!;+A zmkW3bQ3do7Or{X^7;pokAp;&jl(<3)R3n;qm4FKnwHvSx(WW_)x&_f;10F+^xmr?t z5gj++Nkpk@3^7Cl2Hc4#d99>YBI-5Z21FwUJc($3N(vlC)N`GHn-Dc!FJLpGtp?nV z=&%8gA&T7~1rmsM8E_w>M3tnLBHCfVU5IMlCaHCZh7CA^DD!qn-H2%3jRHohFTVLS3DE%q9zs+;S5i}myqg6qN3_j=I}jbl+b2*shN%1&Qx?%-10F|IbE~8- zLUho8hY%%hGsF-rGGG&;K?4pUI$^+*h)QatY!cBn18zrDdb^>3sK$V`h%yH3LA29= zyAYMmm$GvZ9WdY_M5hfHy8}}X0lnx!w9SA6h)x;sG@|kaQlJ7+hXH#K?J?j1M0@X) z0{aow-X&lf(Sf@KJd9|6t$+s*oiyMnM2i+mY7?UE1{^?i$bg3tRs4w*NFkbYj{y;F zGT>%JyA8MpQF4(Ks6>=8U=N~g1{^>%WWfE1P8jecqS(Dstpw3A1D-%sb)TfpLv+}H zj{i?BJ8X~Bhu}JsoqhuQ5U|ED8b*+G+V3s-K0;tC0tzwWWfv(#6HU8pY7}EqA_zjD z0|7M{9f@q*CG*T9eqLco~(dNuiyu0~%Fn*GQW zzXk!b2Gny6Sf=R&%z{v_3xZVEB|#7_3I`AbA#f0Zy+FjpLeh1)5JVRYL3GIwL>CP~ zblDI@7Y;#m=@3L04?%SK5JVRcL39ZbL>Cc3xQy(Y=`%{etSR-nrbr=ORRqy>MG#$C z1kts{6uZc*E`sR#B1m5n)@PRABmuMB)a!C1g}C5s(n18x>Qm3vXIRq-n5C$mOVON5 ze4+%*x>V0~saMkpY(T&OG1{l;1O`nyBWJcxhk#ks>UB{Q=5$#TgbP~&K@b9Fm22QC zcS_Rsw6bZr!bt78U15CUeYtmjfWsObdE zx>>L5rj+N(*?Og4nLs-Nnq$NjRSM~vDu}MCg6O&`h_0-HaBba#AP9lI2q4UeYp$eo z)tz&Vj}S0RaD6qv?V3)&tjG1b9!q6ikpzyJccWn`B9 zdR_LVh%Wqs=+ZBUF8+e(@-K)w0D`CsAc#5vf~XrHh&lp-s4F0dIs>MT?+yr}4uK%* z5(uJBfgrdEC~kou>KF*3u7M!x90-!EG46pN>L3VGe!FoI1W_kJ5Oos-QAa@#brl3r zXF(8k7X(p$;D_y(+M0i>FSOMQFTZJfnk(?>XLAacnkr)9NmR22mrbGCldm4iSI=~Di`=c z1J)+9yBRgxC{PaTdKdv94Qi{{);hIfNTm%+TrCCaU@v@+U#B$+_}pdp!ennZLe!bu z*Z=N*g8PKqG$X^f_&H?UFGS|IAz)Xp9Q!#t!P_3;FU`oXT2H2qBcOb4^X=$n2LiGf z^&+^=69*mbs36)^LH2^sK0}NVcSVw}JvRtU8aF6{IQ~B!k!9IFW;=$FW~cbm1b`fo z4jG1e?H^Ke$&`f69cl=b{+_>cpQzLZl#Do&pMOt3A>L6(cUk8U0>ElCYpRcHL@u$T z0y=V7yi0z?Ul0PG@Vg|pO;*}%Dvb!htKMNJ)vs-Wz=*?p?&U&Y+^DcTuZg2;^n-a* z9UwKJS2(Ua3DxxvC8)aop~OBM9{A@7>iVIYI(`7v?IU=BqsIi5aNqp1f!?h1R!7&v zcpG(Fq2_yys{d#9uDX7qHC?>`{?FF*b{S1wbs!R5a{%g!15no+fV$cM)U^hnt~3C3 zodKw;3_x9DSk_-*0P6YzP*)d#y0!q+m4#*fbp@cVDgbp&0jMhqKwVD&>S{vJUrPY$ zN&-;V5rDdi0Ms=EpspYQb^QSN-`Se#oRURCXO$p2uLRMVC5X-~L3DPR9REa45S?Ly z=o~YMKg$Hsc_xU?G(mK(38J%25S?#==xLE4=l3*q-bpc?d4h26Z9)*_Kj|TcohPc) zK_pE7FoxqG!i;%X1iGPq^%a?+t|DRe6bY-NNLc+u!s;eUdEZMUtWF|f^$`iHi%3{K zM8fJI61M!qP`~Jbs9L$nM*8qNUVaSbzaSE~P+6iz=U z#kT+Aq!3lmSs}>(Y@3{ZUBpBnx{L{O&J@z6OmcKS38KrHAUeAQ(Iw5)!QA3`t020p z38D*|AiA^(qKliU^Z%!96L(6&wVuifqSIaw&iiIF@11@EocqWL^{Ww(V*g_WL=68g zm&TMD0a)3T+5p1VYM8QC!<4lermWR4WvzxOYc))zg4Hl(t%fOUHB4EnVai$!Q`Tyj z($$c>S&L!HS`1UxVwkcP!<4lcrp}qkI(bP{rz>Hdt%R-hFJ-NNDQo>pS?gcQTK`hk z`j@iSzm&E9rF0^&EnWWztL78VRebKT_zIf7C-zt;iUi~yYX<^SdB}f8cA|B90FP82 zztbCJ0XTT{>j3JJI6xkV)4>DCGw@*p>Y+DM^~f8b9(V)Hd6~*12&A5mX|tmx-{s)j zV1%lq7xjA)4GEZLWcpUGeKW?H1u<>Ai>)VAbgv_6GtI>K2aDQQ(+j4Z$2pwgHayU2nJJ$7)(WCFqMhHR44{hsTho6 zIf!5|LQaJ!l84B==&Dx%nKG166}oRQLNy|cG^3n1Or{K9G1VeKj4C6Op+Yj4O37g7 z6BE>5Wdu+K1W>gFpo#{d$_1bb1)xdO$kmIDHWc<@|S_G2vQ6=Z2`i|a5N%jPS zj}kPkjI+2IFk33j)@utBbZHpOcZeZesx5__rMcqa2SxaCk$ilzB5^iU)=!Eh2-$>* zYV1Xg37R~J!kvI=wt~Ndht>T0e#Rsjc5dibrU@%0!pbt?T#m^SM~2p( zaV-KCG)7GbuJf4N-wMF6Jx*60WSN0o%%~gzHzOW8TPXNM@iLtFt547)+AJV3IU)Y|JES!H% zW)vEO3$KlOaR)Xl0cmAKaE-wvX{0!f;2L>@#)zmfm?VwCBx%f*3*V^hMZijN$k|(f z_6vO^c)fz0;PncS;PncS;Pnb~vaeTw1aDM`U}fj^W@#sQqry6H#Wx~IPVhzrIl&th zAbg{8$T-Si2Y|V|gPh=v3XtIL4v^rD3XtH~2#CJTltzO$D#!`$+yDvg+yDvg+yK#Y zBO#y%M}p|dksx|>B#53J38IHbg6QdyAbNac>f8eTLJ&j`kOa{aBti5DNf13l5=0M? z1kqC@LG&0&kYtT{sUnCTBnhG?NrLE6k|6s2Q;^{B7}5z2kAVb7PC$agV<39|Bm{!P zW8~;*l;r4flxcK<9v-7uaCi(PI6MXt93BG+4v$%QTHlWvb{0b45CqY8 zq=M*MQiI&1cWyvU&&MQ3-<1lYCuD-?5t$%*Mka_Jk_n=xWP${T$7n~-%p`}0W_(X1 zNbdALh^ak{06Uq$d04reiKQ9&7iBqp2jxsG%}KZk0c9EamqGX6gj=o%^q>Fi-Qygk zV<6rKvjGqAv~N8C9)MjnS03usSRhrc13-QC3Q&y!K+b;NmISDCA0TJ`E(Cz5{CN-O zPiH+qo$~;7#sk#(4p85p0@S$3JYPJq`pIoU}Fu zC#{XaNo!+p(%Q(AyxJr?IBrebj3&1r;IGs0W0^4=B0+kLN(Ee8frvc8^}kGxEJw^S z)n)wzc1~mYdPb#~8LqP~++PlW_PB)1_4wfV7Wrr9_PpN zBc1%fC;l+%ha-zW93gxX0UrbYFm~JKpZYT!!2VY0O}#b_>ba%bv!(2_?c7qkQOXQa z!vXYv7=b%2#+B$ZWT(UBI*H^s6EKwBbS$PnML!znU-YLc5dhMk+9g}&#dM;|5s*qJ ziY_%kb)qn_MjUmc1W`vy5Ort;p=Y}v0h5j%6unzXClINWbakgBoeotWf*=Iw+@fuI zSBEs60DW4d)72_L0DZbzeFmg2ODEQ_0ARmKr-!w}IH9@HJ((3xL*Q;U^d;4?YzVx` z1{DNEu3`YFLI44U~oPCL6T-s1|sW4S_e=5O|Xffj8L@c#{o*H`x$) zlMR74*^t{;ehb!I&urw}>_x!*3@&0emSgYID*Km4M(hsQ(~F7#c_(ul0;)0EE?`?8(n9_Q=53bKp-JFqe^SU}A@1BsXiP&m(n9*-`yV;Qa<+ z#{RpG5r<-$gCGWsKotVa-T4UnhbQoEdJqgos1E_Ak&*cUYXkdz#<-6uv^Wm|1sIth zr8cnXl(d!}*V+`=T?Der*c`Av#E6HEOxCkPoJHo=K9H@^5R@8cC{CeN0>oS#$qKa% zisaJcs?Wt9I-zU%1nR+3O;YM1M#~Uf=Ur|;fnI}z`w477z#L|@)1*iG3G6lLjP?nb z?t!rQ<`Z%|KTi(@JdKkCt_(Pk>dTKxT*fb19Nl z|7YpBStpTIB0P_iFtbdpaamhY!`uRxFl+C`1Su+0OKx#cTocT1mP#W~Z5S_;V&k-n z#hU$Mj5{VS7Tipb>mnSN3EE5`xk|E{as|XJbG2byRu8f`x)TuGoXr|HhHsHYHKC4R zvC3tGS>D81HAptsEXLKUO=9{YP?n5)1+MBZ!4yl%1Wq%m7H}y&HscvC4Lrl8fycHq za0izL9^2C3*E-`~$7%c6zf@QZEa=y!V9gH55jx#NL9{uttnEpLwkR3bV@r60>6hdG z(;Zsi-!=xlXjD=YY+L)#?cE4y<**XV{@y6?7RL!U1FxYRej*uSY<|B98uWN}`5BCd z5JUop0GvjEt=NwPX#?iA7=hN7B21uz2_&0OSkwonLiNF^P(4qDY7r(d4NPvA ztVSLf?K5C*<1m|%zn_Z&g=)B?KK$G+m#vseo8|KSZDTw zj&)`~=vZg=gZ7y{c$*LHK@bAgnLP;Hfeku>-dnZ<3qNN57|0CWb62lt>dT@==hLh z>G+VX<7g+)agc^e^Aj=B8%xKB981TCY#kr6b$rOyaZn3%e8{nMe8|@EAzR0XY#kr6 zUqzu#pw>fh57}xxWUKYi zIJM^M)BU2cjS*O6^XZ~S+T<+=Sc}vm15|qqP^~dQ+Tv{p0M!x$q#Z7uC#kBGNL7^t zNTa(0fz^Bs1gQE4P_+-BnpA*lPywo{0aQf;s44?ctsTHRj6x3rKs7A@^|m}fH7fvB z`T$k-09En;^+g{*y&DfuMXQb)CA&!^o36}CHciRKM6zj0_P7Bl*>(ijjg5#l8IVFA zHXwyuB|=V9$Vmj0rI2?TkV39PKq`fN!hjTVT7*2#U)kvoyzv}W?gpd0YY+@ZXb}QP zGukF#JqKckNeu>~J{X94$N#7D&;}tYZ4KamW@yh(u`Zxk7f`GVl%+1c7h{EaQeoV-On+m!$W}WXq)bH8 z|301;o`Aj6plUvyCr12?49YkY9F(e~sW+v@P5L_6Reu3vi6oX+jMv1bKbKq9<#+pn z{wRqcMJWX-x|Refx|9bg=W7YV&?W#XZGcJ?pi%>vOJ)!ZA40%RaTw7_1bLNC;EYMn ztwPzDZxc2KgvZHx7fS6F0%=C3LK7>T5`m7J?&O3l*z=TJI1p#ldF(xywz-@f%Mu<( ztq!%!R}*b_!dmNdX=#N(;_8M3DOx>9IUf~BTB`%pdK1XM1AJ~k2znjr?*qOC!F9Sq z{UlR^AV_X=S{rt3Gb)%4k278+@Vm@sBb#&wjN_PGTKhr3_s}e#iGI)`GXo~7F#ck~d4%xRKt5WW!8T&|;Hr?=a{=i{r+ht?d`GY1Z9`0HbigXB;vc~86QA^LNM}K zN|NR-1Qubu8v#Waae$bt{UmI0n#|?YLwWPH)kdm$X5wiQl&T9#jhhe|&?0MCX{`N5 zZi_)F`*SY2r2?@v9so&p3uLud0COwwxTzO`C#Q^eB0wfQc-n2i=J_y52uS6&dj|r* z&HmP!^?1p17y&{{F+Pj{x0w+?)yibO`bk)CeiGJ;pM-U@O<0eR2-_>a=n7w>BHE51 z=>+y51SE)=@6#^UK1)gMv>@7RLA2X~Xuk!~jtina7eu=*i1u9&cD@xs5CW7$z+SFA zsxh!>gs@Z9&v=;(^f=?P0fIQ^gAfUH6I#G%D}sCqfq?0HI_Nq+kq~qpNYHg4LDzu< zT?Z0$9Z1l1AVJrG1YHLbbR7u0oMR%Qw7$s^&3_}c;=!8#+#9ST`Rb@iuHRlw>KRROC{R0XV}e3sQGssdK= z2_OIDiZlaOQ8$=QRROC{R0XU)QI*RodE%tOYQf0Nom4;Pj?sjApu!w?3-e3iN(=41 zIl_#|D9LDROwX0eUcZ|#-GlZq^q`zPlY-gRDR`8p!i$ zpMS<@5YR0~+LheqD3z2*CDmVpc#97+rnJE0VY@4bl|c4g$|;mOgAj2t2SVdaA#4O#hJFGIBz@dcl|u3&$r@+)k7JsilBt?zt2+?SO1|u&k0Ydx`K58(Um(3tlXEGQyXESyKBKPN)ASEDQHX;pHobYQ; z3Gk5=meO^IdJKrC{8Ql)VMz=Dqd8%M52X+d8juC}&#sUJ4&Rf}egPX#BdP``u=%W8 zEp^A)W)yPDrNRMSk)wE7%i3sB6Q2@~2XmFo8(8Wb?C^-UR{K$d|TBp6{oG*MPSoI=`! zV8{^Ki~tXU(O@>?d_-_FC)H0HEGo$POFmI*l?0MolB38WMB|JS=qG-f66z;VDxI!Z zZhijtp;3Ujgldq$9zutdwFxfZrctUH0ZNCb{8RZi0W$;|0s`YEdk0GOB1}MF1Csmx z(^;EQ!!)}zXm%+Q<)1Q_LC^Y(I2dgba0#O=0*>nqb%#oe(<5h`(2pVWI07}5ajA$j zJ843bLzl*X;zB%aMH zV&0@_VCwP@=6P{s`*!t873bI%Uij@Y% zrd^K+B0(K)P zUPK8N72OK(;%OoFC7C6Hv{_jqMI>^`RFs~FLbIoaR9^U{j>@a3sJO@z$y_S*QRA{g zpGn8LJm?MkQt6{b+PN$I&J~ftEB($1a#gOlL?9H{oUB|$Bv)6dm<7G&!q9b7>t{3- zJs537i`TO7bs(NXu~Gupu{?q6S(0O?WpCg}FsG_W#?*1%R^g1 zlW)3Ek^=&B-~UudXyWYr15brO?Ya4-SOrb;N9JEZ8n*y*K0Lpa@U6`8;oF#QnyCrI zH17g-`F2oo<_EG|IMt-z5hR&}1=obu#*H#j#3u31fSe}XHKBAJ=Wa?VP`BF4Xb>*K zB#jVoBH)>RhZ@3Hh~nSw7-s8g0FltG?ir@I^aMigOgzKxm3X@DO?XD!g?L8Yhw#jE z*Wj7&z6Z~k`y8GHPUIJ;n;$W>!pq%HBh_)gglEY8CZ1vUhj_Z~8+bmw@yvH0!!zbSi)VrR89WQ!K|G7xALHq{zr?fHCmvnv7E)^NMR+uY`_u}cg{ESh=eJ`F-_Y-*LxqpLazIzDInEOjS3tX5N5Wfb`B6lI4p4*CNvHKo8 z|+7ejLw>-M_&z>GBWF&2nGI^Ab0Vfu8MNh-Za+6P}m4 z^>|+9K8ok%?z4DSy07ASh5L7SUg`cbo>#g5f#)1|T7lzS?WXX&#!cgSt((C!B+z0Wz-Cc+0eD^s#?{IhFxxoE9JnwXm;CYw(J3Q}pOW}3Z zx+y#ty4*7SiMtxld)%k-T;%rSd9V9rJnwUVfam?bw&h(Ca``Jp$1TL_6LM$c8Fp*% zblv56M%+F;qwdG?%yYklXTJM=JTcOEVx;37=@gztsybhH?*;0(%kd1k89brBc)ITM zct+e$;u&@K;F;%s6VH72$9TrvH}EWQe~V|KI~B`dkvkht&k4T<#f(G`=kad>yeIE| zJe|Ddc!r!v6{2XwpE#vqx09Lf`y77pUU-!w(O z6e?o8E3!M}EdcN)G9q6HIo?SiKftVsd@;1a`y~*5)hMzjw8<&_9m@P)q(o+hiWqN* zL_%IIfWK$?JXGeNzmm%Np@{cqio`+*Z;K*@p>pqeAVSs)ReHNLr#Q68`wJjD$Vxoa zxo7yZ3jBOb>N<-vRO*sm%ywydMDh z0E?A|db}S2k#;T!^*XWdgYG>@iEN6Epes)SEc#Y4Bd=&M{xD){O3~Mycq?GmEBZzx zz7lXT2o?>+oPsF;Vi)4^C{l~QAcAiPSg;{>15#fA82RgBMir6I$G0LjLU!UGRd|mV z-=^?il{y7&s5glXCupsl0#+z^XEu?2Nw9ZL0c9C`0gvfee+#-IF+{OY3x&Q-HdsJKQQ^S zX@D0Her7TSFykJ=?=@u}u*yF~`02@0QKodp!$hu_BHeTfhQUkWF$x69?ym3!jFTbv z*Ab7sy&m?^Jsokp*=0s0+}}ka-W7_Rjl{eg6>*}TcaI{`Xu_*kBrjUxEeAqvb_=4V zULhp38sy!0wA`Bvgu-$sMU&oY6k9VL$dqV>_cV|X6PX&V^!kD9AW{;Y%8eegoA6NP2NR7?niL1i!Sr#19+6k_0eW;B>;}4dt>AuD7xAEissxK-QpbtQi|X%j&Ae*uOdsL1Kx2hRv+Ezy$M9x zX^igjext~P(cNDB636)vCZYR|=pOHKAkx#;=w9zyMcShKyc-o+86EU)Q)G2?$h%vS zj_7{xK1J3<4|okgq|wgkLGNK8(z#6ZkheyWN29~uV?g)?75A~|VehvW`#oJBJ?1@y zoM*wT+ZX+*_i-RX?S0YX-lu?UWzOd43GXj}e2oO2i=Onp3`DxnA3f!L4Tv;45IyZ3 z03rlF6FpNlsyUyHI-#;Rfqk6hUd1-FEQIMJ*sf?I

n5HFF*wg|&Djpn>k^!bOZn z+~2w063hWwF*k}S)~rY#7MZn*zzO#F6I>}4i@4qgfQZl&n28@&WO5|xy`;#LNS^m; zMM@(1-q#eFjtTo+MJ|XGc*Ba6M+&{4DROb7$on@%E{S+v2nSBm=%tZjZ@MCtk+?TU zk*gw;yc-p{CX(>(R^+2krHpMBDIlHj|W?l^CyvVZ!-`P z`u&ll$G_<;Bb|;^cwYmun#QC)GROOlA`eDV-fKWU$nk8BRCzxK@-mSXkpy5Mrwrzc+!{f(qq|Un|8Sf&k^PWhL$F<}`q_#2A>v1jFOXQiz z29IlrH2VHXpLY+C!_4`!$VP7|kV16BeJ--eTcyRGk8Jk3fLy_xk43h4{OS1;A}>a^ zdi?X3Lajft&HECNk22>ok?r0TtTD%k?2HU}Hvx&lVRQdHvcsDXKWI~c6PQiA-GpQ&Ap9XZX zxCja23C`>Qatgl1lHbN7a*AX^1wR68JPwK_K{gX)&naM=1;0Kwn~RK7P=sgU3_N}a z9dKU_7ct)Ce%F^TVB100 z@?Tl!pWJe933BKjxQE?&-h)77NJiWa@6%{dX35XojJF4fi1&osEpu~uoL>%-GV_x0zf|~^Iq|<% z__pf!*A=c=5dRL~ACl($bi5S0A@CiUcoOiH5Zt6Yx5OJ2zH4W^8L-f=9gIH$_wwTeO=_qJ&AJ(g5NoOo%~}YAIx=Z#b!b)t5NUqdywI$rKKL_|ufQgrj8F`5p z<6Vf!ZQ>;-{up4YM&c93kr!R>k2$eX)XPI3C;u{b0^rX{;_JnXl8L{K{{S%?NqohL z|5)Mw?ZwFkw_J&@md1|&W}gy+jL;rfZ_H6&WVCbj*N(03`#Xnr{ESmXVPpG+(fsc#G!mw%^#v%g^Lxn;fx)L1Z!B1gI4E9Vx>X4_4Vo?C{DTg0L;mkHA}b*Nwx zaI2d%jJEN-=G<&)Flbe@kPoMz@sBHL7!?X1Knz;P(i#^cXXaLV#xMyIDN$Qs5e zcR5+ZIOT3HYZ#|2EX^9jDSuL)HHK3bRb~y~l>4gU3qg-YZ%Vo@Ua#=tj(7{;2$Xlq z0~_Pp0MoimsUM0DDBO53u2yGC)8V)pohc6jn+)UyB1dqrbRm#06FC}6dRGBCNaR?k!ut~-WVZNq967xc$SXun zhIW*F4#=el#nJF^s7&3nVlR9+RHpt}adCJgRHj~G@#OHaP}vdG5jCG0J{~Ij1u&To zCE*jHvNOQwB^FN$pA41dV>5jtW>xXc;Zvd63yNn$R7jG}T^e@0%YcXwE5i}*S|Gh- z=lXEWTMs0|nm2{3XM4p}VXq!39JykgcoDP?{ z7x}EzhU>y*#lWQbh2f@f*(_i@Lnyu{yewSy3v5NXTPeOb+zcxI#& z>%%)EPT^;uD$6mz?ia#EjAO+eA+MeQl()DWTKu3QJs~WNbk}G80FS~^JYGj$-aA7@ zj4SgtnlnzWVtMaF&F7KIDVg^S6#HX9)csU_cxqQ9&ZA#$jHY%cvZtU^d&=Xy3nJ<3 zD&zGEKUNiQQuy(j_)>*?7scP9@cO1WKNTi*-`N^pq42vhPV95wYa0^sKa^xt70Pdq z>tT2PYA3E|-T56G;(FAbzh+bXy(r8x)%>-);_veb=64>9ZvsqNqfO$F8h2C-z_=t-{4Zhe23QGc_auzjTt(glM>UH45>{}L zBEJfI-UEu93Mag!Kz;+##lH@hcrA+jd$_{mM_;1|#UZ!K`+_2P0hQhD6-V7g-dB** z$YOo_o;C8k?kh$lCuUoLB;tUqT42DrV$`mdCph-@>Gao%pke z>H3D+BJr&Xw?oMDfy}%ckJu7C-h~iadI_V#6?l9GoJ6}rMT~2rw}!j}Nc;st^mbUF zUjd*RMi;;W%}0@!SbQNYP%{92O(}XmEKmo4|4k$f3)BmMl8V;B0=*vyD7BF4#RNk}w+mN0q&I2=Z? z$62Br9FkqCX7mzpsG1zT6dbZO$+-#~(%wn0t^vp-ULYzK&9hm@rcCIYbu+{X;tzG~MTEAG0lw-df49sjsbZ^mu- z3-UZT_xl^04R{MO3!aRuN0c86a$&t_C8T7ZfiLArRt47JI#erc#)FNy9}oK{SCpjh zp+3eEd>wEfOYF3qSts%=&Ykl@1w73v=R=zCoM~%jBmIXVc04qlZ@7Tak#wfL2*kT> zipi08QMXNzcTw{G>2}GOv6qGJm_jCIe2wsY^Qvgtw}`wDwQ9c*mD;Z{<5Q9` z#=!X%fIn|wezM&AtbwJq?FQyP+xujc3OVC4tIQn2{ZUTL8C4d13*nbd`aKrhK=>0T z{b8&8YAgM5E4|N3|DcurVZuH?^2Y6@|Btpefv>8%_V~}u$+;vU6GI3?&@h8SLYPEE zfj}UHFbG)DVlN>BiH0O*U{D;0plGSZ)+$x3Xlcc26e}DU&bI-{o@xA}&|M_1ycdxbA+H0@9_S$O?=iD4urse@Z|3>k6`kOm+cRJ<{ z-EQUYc62hC`+#7#?C=K#?{$Vhqx993zPT?8SR2)7=YE{QuJW-rMf(9$HA0RGzTUv_ zeIjgCik4eoNyEV2PjPSQnR|dAx+MBJO|*gCLp?RHd(h8=4I$UGdPsL;VbcpkyPIAx zE%o3*5|rOvr`DvOwks{D?Wcy2Yoy+hW@?zD0=o@t<(w^K zb!Mpa>P%C*O@yXQqo47ZM#JRZ6K&3PJ^BimqQ46J`ma1+zg?95Vak4w@+6duZzpT> z?%t6FF*RzllkuHo?QpD|gR1`V^pIYUrw6Ti!Vq#l7SogI5@qH58zgB*(!I%&tMf*X zQ^>OhT#4y&(uc#F8y1)w64=ibXxyoPx^btIRN%yP)sd?^JL!X59@AMTqz9el!3E+U zm~IRR4u{T-m^7?CUvKIPQ&RwEBAErF-Qbzn%wZD_*)%=d@kN;5SztVILm#Z7Y>F=ez zLzb)2KaHOb|42N!-K_yS(aQN;*cahG`@-~DALE=~rfc@h?LPu0JHzyc>A!!Q{_C5o z z_ok|qea!IRlWJOTy6qPx-^%%}WTu*jjJ&BQHOUOr5x96}8$uE<2}!)n(?x$|KK%y2+{!Kk!R_5Gwg$ zsN_eXlAm}bTU7FNe-NB*27%j;XPDsY_Tw38W(}BgCEU?|;lAtV_Fc~Xl5>$qG0TRF zk^-N&ILY{gap?_7#@Wr_x-7{IG!qmqHHEE_e~_fbCZ>)uf)-28DC1j86lO*lF-s-o zBvbMmVm|3@l{?$y8h=|R-jn_l&$ULTkAmZgkmM%<$xjB7eGdZiFTDZA=y~eeFE$Rv)<^lJs|Wk6UT|kmyJQg z+mt^j*@U0F1rJM>{VWrZMn0gN?QZ{==h3$787(X4fbt)(L)AQB8=p3!e`OnSdL$!# zudO9cu6Zcz*S6`JzpAj8ZpR?gqVbgNf`7C0bU`t&g#y3;lu`hl2k zcVV6Lr2p8~QIB;pm$hpVbNG4V$CJIz>^4UKhFmiM*O{Hj7(MrA2L45cUND~cpilZU zJ$n_}%*oTq7;9g5*eVAo(sQZH1Po$jQYGLA08Ik+PUcunz{#g_cV55?#XR>TV9`v= z+9}{kfV%~}Tf!q30ONkbK5Jcs`c&t&J<`TU&iVyeR>5~!3e+m|!5*pOBTILHS`(W1 z=B(N(`UpY4qdbhifqe@=`YSzi3lE{q0Wyk`xD9hqzzl#R0@eT=1+WUf;(Mn`+(;WA zBs-0rT~T*gRzN;A3>GjPa~23Vzko-c1SmTIvmn~n&m1Si>#1)nX{FDL_VSHydSr#TE2F*r%u}|IQFLe;4{=iy=jubD1B{I< zK1&%!+VzDTSxDNgQSLp^VAGkWWZM*dvD~sM;VddxU|Ed-1s@aFcB-1eDY=E)7P1Y; z!wdfokR{*@fB^u;Cr1DjJx56eAFDv2X1|Kw(=E5~D;UekD4ey3!wdn>0jvZl`T$_H zfY_OMpMakNTp{2cfNKG)f}8mMRKoTlY|mnzRwbiw8Nhu4@&NRwnyrHUeCH>@cofF! zB^(rs-V@+80q?^2Ps8{*-}=>8`sXm-2fZ7EbaF4g3cn3@qK0h2XucPT>5nj7vXm$8 zMehYrBH$$$&jcuXlAQAdd;(A>VBlFiq%2?oz(xTZ0lou3WB6{8)R&Rk>l+;Zkx}>@ z^j`|t0q`4uqFIoh70?dw5`a~3gzxPt`XojFL-tWJCV#Xn%>P{Ml>O#a5;ef6g7`_q9;JnT7V4#z6YSc=w0-C zfa?WxKL-a9@C^X{Y3icy0qhm9ozbE{RBaXff$zhrCzE=Hll>|gli%j6P;W*4*f7~d z|4+r#7p7*i^}3zOd3+U?gN+2hr}f7|aBHh*KO^rFd3C`=D2s64^ruq#72d(9D^{6d zD>yd-n0zi@MeSfU0;X1QOBJ9%?;mYasg=p8h26>BMut_egYRw1-bD6lvhO6L@J@gS z0E%7*cwE5Jm6r9Kfb9T(5%4I$>jJt}@(dloxPSAdUyoxeEB&8#M&Vp2-3edgBg=A0 zidKOS5pWYgAwa=E_NIGm*neyf8LvQp5*hlOvY*_d2jKhm5X_+8j!!1L=nZnVlf$Rr z4${Lmh3_Dgo_L~V-A_i*ivW)axFnx&Ea2G*gku3`Oe7o&_z2*rfQCu@6kfo<=^UzJ z=z<)+#wH`QuzQa}doa2Wv;af-WWj$P|-aUz4Ua>z{x1=d4^?u0Wi56Yu+OLfu>#n zR>2g$w~PD!?h2zbK?^q{bRodxZ}L^N6KoZLRnW@!9`XJf$uE(82^obMGc46{?SYJH% z;xz@s=sPlsz8uV4B|ztx>jZoTX%oP>>-gG~OaV%#Uz~{&XZ?sQ>(smW-U)&KJglFY zQSc5K2PL{a6NjXi^)|wy5`bic72OVy4KVI^Wa~xrBsx(VLbLuT&Z}T}Rhed7=(k!^%WU~`2eXnOwo^6{p1MPd>X&r0vLCIuj{kD33Yl# zYGLM7#xI%HDYeKc8Ud|!)dC&|ST7)xc5fDN9>8@1G#YLZkVT8`6mS%?Js_ZfVfwfL{e`;c z01C9aT+xk+3)0gHKR~EiTb{CwtfB>!|0_(VtP{2o>`gGK>!9Htm3k0$?|{&gjG}`8 zCjeLlC-eP+=ubf(qe)$KP0zCgEG7mo67X}v&T;_$Y>JBA9b_9dHKm>wS)8;cUYQDK+Z}~1H~8YDwhmky;#`u@Mhz;v^SIpq zA@?ya_aY=Lp*CxZRZb%kdC!QPm6xo#&(y@_s$6a|TuZ6~#SPywCnMybhf4wBZzbR< zj^TF&&Vga1m$7D7#I0eOn_>D&HEa#=Y0WASMf4_s=>X`KV2A5XuB+h9a2*KYcY?nd z!qo@KxSH31sSinffEx=g4dLo~IlSLsm6x~s<)5Sc{UQ8ssxQEeyiY^;`_NNxSYMu+ zJ2`~^2l|!}F1mh`?DD&wVom8Wp8*rkb^Ee+Y9g1)PVF>zL#MgBO>Wp1M^evYF0Xyv zL6lfxOpkNC=y_0nnqRARMr4V$IbluRzOtss1NEX-30Rx#`stGf5Bc=8GHTPiQH{~~ z328_azJ++b)m0+brnyblTTgvM>JPQ;4dLpjw*q|X8t6;Y1AfJT`VcPu9RWUV3;cS+ z=`<0l0Nkzw@N1NLXJvN8^&r1TpCFhPkI%APdH2oy`j!jdmtc8k*9nZ!qxPl{o@5sk1W{$Hsxc=@Aa~Y zuV+LSA2HaOCfcShU?yjMtlHYVN|t+gE4b)QF75`(Trw^XF{swNL-;W0R-P+x&1h@N zDd1xbzC;34&zg~LWA=D#sz)83GBB?EH2v*Zz4UC_4gkH@%y8Tta2R~#3GosJ-xc6S z!eijm_9Ed)0JjcyES_ZzzAOQMH-yW#^78}!XArc^!)2@2z;_4qX+1fJI0$ZrX38Kq zPA6v>fEyqEdSx>G_|V4}pNX6Vt`0Mu&bNH#V=#aDb>KA#pXPJw+Azb`ZL%4c>`pAwgiB~D+CPQ?W5pt+)3Cykvj|E(2j?i1A zjfZMa=UYwT?#mEvW`L6dx~i)R;mc|977v%lH-PUk_?ZMzx0eow_|;2!CkOJbfq$~W zwYGD$NVKZT><*QAfHF^dW!6$A=-;?i)QsfOK{Z;7_4RP6`Da8-@Nm?e_7=DflBQ?` z>)1$|i1Bj>?|L{_S7=xf!o^=7!o|NM zgqK0r%j@J+axEP1Flxv)<%MyvW|BAvZl=Nfv2nr_Er_OjxXQccJ~OGcw<~0Oi1#w; z+8x4W&HSQ3mhe3xTuPLV3+NhT+d{b7wmXEYZ3jcRJQ+o!ykC;{cc8lv#LL+>Ni;x=00 zBw-!b6b(a*5#;MG!gO$B_H6;dFzyWDVmuJSCFoFqn;KSN2;&F`0K6Kk>7Sg$T5)&w zLIeaqK@Ol9JpT!4fd2MIan{K^$<)i-BhJ2nTr1UNk5u;IPZuz_Q7yk{` zq_s)S6w5vxN8tHyz6a>Ho5deM>$bo=tdLzvZg#D{R&elPrRoO^sjJ2M7&d+U6 zYVsJcH(a{9)hZsWob;fC+xVGNl>I<*b_tH+ei=*3Jp9-Iqt03a$8xT|SLzqn*)bTc zRDs16|LN%WI<9F-4wBRBpwZwD^U3|Q z|7E4>XDq2NgAX|Da7XW7aCZC1aGHMk6Ixj_BLzqt)+0L^@3vC)!}po}l{MDOnmHaU z<4xc8i^00z7`XsuQJpI0C8iMp4J$B0l0ZKXM2`9b@UzJ=5d!Fy7)oxf2sUUS-a3>PSSNJ zye9NVSvlO)oMT`2g7v!aTeI}110d%wV3FgYW4f>6-m~!AOzAOY;O23Q9Y&kn&s6l5 zESY@Fsygl^2){i`O&PNtJZS>>&MXbbF%N*7N2Fa@1tUhF=d;{QJYVQqDbO%7bfM+0$7BC#)lLgEG&|P42;D31v;)}CJ6mF$} zIq<)i0`7tTnJ_Iw&wQ@*nOP&oN51(j2{;PJ`2beITE4eS!mO;Gh24?6N!ix48%Qn} zpjbZ@*D(ifD*&`Yz3v2Sn(ilW183i*zlW<8#d_E@0nVaF74p}B{~ESUaa>$xk<9+f z2+DV7n>`-K#Z)<)%UXoU$a!bU)L)vXXGce>Jg4~5JXt$>1h{dEFEfAH3k%H$H%{?Y zrkrHVZgA6$|1ssqyaH~X*S1VIn}%(orYU={|1JP`zv50>FB;rkhiTC~)U?pxu6}PB z{hFlT`>xa4)t-LuyG}a_-01gymeFq^xY6&JaoRC&gB$%mbluG8_EDA|Nj7((OVul% zWTh7N#=Fg3XfrSG3^X%M_!69TxJGwq??AJ(v|VO$wGDIE+FOHWm`Qy{fLp~UFl;kc zB@ahnww&22K1~C;|NmtmPuDxAQ(o^hMwqCp_-Yl`!9Cl+^SADPkSDrwehvbi;LxU#Rdv*X5hEjoQB`Tak3|ICc3 zV&-yje#hf9g^MpIE4tHdq1&IgDQ8EhhiCqdoRsX&ryJu+YZ!NeQ)J}YMer1U9fIC>9yPcdV;j~U0OnQ`04 zjNz#+Y^IUZ&D7AxOd)4v>A~SXl@c_~#2NQV`WfyRZ&H47mL3qy-5_|T3!BGkXBmDg z=PC#pHzw<6(T@k8&o7(3ufYBtZOM*7_ABG(aX`SV)CFv>5LQ|B%?%u=)D zX>tY>s%yN}=&NFxV4m8{HiI#4iO|3?{K15ssz2M6`YH9K=?`t(Mf|h>o|2l%G@GVB zsPU9CK1d0E-bGy3ZO|iJ^%=x5U0F;>G_Je{`w*_3T#s>;=7V#k4`CU|m50w9;+j5! zz|FOdb*CQwQK(tRbp-uWsL%iGMebukmundT zw>8bxQ9n~ZijK299e0pE+=uC#Yh5n-^<|k#%+X)G7|EIZQm%EZefDta`8qw(a6LNj z<=Rk4Ij*Bz%g{L+opt)57u_F{gL#avD~XN?{Ex=YqGWgMyxW~|kcoeD9l}q)X~gc_Wh5ZL6E#~`AtMszr0`0=hrRU>$!F!SNFU8kM8L8=E~<%{iG7_vFpc)cKiEq4^6e!1=s`)@Lw9D@ac$u8KjFN~L;0oHuHLiX z-Pq9o{BP}%ZT0BC`f>u-7Hqtev9yQ2OQ+xb&rbMuaqZ#S%jJKDQg%7l3NG`fgFV8h z@PzY?+))3CH>DeWO`SWrb}^Qp~q>{0TYYW#_uJEVcL;ULXBMp7DE!9WcKYes|;eQsEE?km7a#Vh0eMQ5n z{593hEp?3z`9vwBQZbL08dm96;`CKQdETv>C<*s;~)PB~@l z`i&cY{rbM|zy8Sg-ni|@h2zGK6k#u-Y10>Q*&WSLN3=v|96vOJ*%C zUlN-?E4E;or)=5M9&}3J@c%^-zXV3abnS_ zar1?mK-=bZ)wV7O6DJ){FqKT0Fgaeu%(;t7OBQ!Dsh@Wi%SC_GczH8Qmc)n)v67j^ zosv!+*A)p1bw!fEnZ+}^64(Vv0=pm?fwPNAx|G=^)rjqqY9udR+@;vgNk(SpBng}| zbADF>yC6wmC#0D(=9iS0&z;d#7X|dr`zcPB{7$+!PB&&azQ+PO@;m99INccJ>&nX` zI_-qG2nNLe#$syuU!XvZcYoE;N;^R41gFr8D?HE?9|rMg08OqJ`z>6pbGn ztcyc3Ro%R^I~|L3T;~+&(K*GHwy0}yoswL60f|*|tYjJLFPKx(ajnyV5?)<*Aj~Q) z>9F+fKrEU0e;~sYT7-8fzi7$4c=I|CB(_VU7V%vYU6sC;{Ppc2l60wW$;`4vGv)=` zg82)XKss)zloO6ch9w+i+>DTyn~bmnyBwjRY%;>*&}1xGy0~OUuzYe$g$AU_2)nq; zVH{ju9Jjp55BZ>nFS5dW$AybZ7SC8Zcj1DL?VVLJbMZO6w$@)Pmn`UrYfDqg%4}h5 zaS0o$B>|@>Gt1|eELiF?#6^g(q=X&8;;soZOBOGkJA3ZT8B2rC2$c)_QU|%Aa-Av^ zt~WL-yjKpX8xqn{xZ9flQ{}X7?(Coo!qVNL>V=ghi%NpsL5OSi+yyK&N@jIXz|-Cv z>|IIlxH^?EyZkJcFU4ogo?Wsy2%D-Gt!A-ZomUb&d-04#X9WSKBXJ=O>rAHwC1=yA zOP0uimd<7G-q8^{*xj{_-#-*v5HM?a#}=LyQqJToEiIWF%9~YEeAXNduTyMD_W~#oSD_ttQXO$Y;35pR#&Wxt*$t~u~`%st84JFx`r@K zSe#bfP~|qWwYj39rAdaaXlt#dk=0g3eSPEFSbg=Xipuq|=IVy(RgJB66|EfASryHd z6Jk|$Efp*4tLcN9`dFn(R5w&MuWxFNwboXv%1WzxT`M(Ib1c?kRW!8LA*QLmV!c(l zvJ$YevAHVN(o|p9+FIAJ%JSqTRMpzt)=(L%m9&=X79AAETI(t=sHRJ5&~Rl%PP z8Rx{7%ssaxw)C7uC9#;bvZ4xwsB3jyt5sFIT7qLZNPTsKRaw_m%ZX-N9o=MX>Or49L#*V499$Fl}@vn_F~fxCfDH(#;U)y=Eq9^pD0DpunTX2AIQ zrfTK;QYD6V)igJ*w$@iOGC0q*s&Jdy#x@Z8u%)^(F4h#6mAqoDjaJhIMzN*~1l2Xv zG{%`d9Qy)Qwyp~k7)Y(s-D@Vz@mr~ujgN`u=Ty|U#-wtK6*i)=YD@KnZ487U4j2XF zx#3aV)L36vS%(lr$6D7n0pY?HN0VCGdQn89524{dZw3yyDWz|il zt5ydlU(F~$EX`FPVh`Wuv_3>=Y+^L|B%^L6j_Af1Mny|oz1&iR&P$BXxjFcFO|>z< zFTk9ld+u2iYl*veljr8-HPqq$`mTwsX(o;}xk*i|sf9i>-!+7k#tZ7IV{4lkNicdS z1BDTfEJG#VQ^RNTP!lp?^VF`P_Y~b^I|4@-GyUr8&fNe)J3>uoG==%xD8qe;n!0)~ zI4ZDJ5!nTNFDp7aGyF=Cts1-5d2m=5& zscf#dT5IcCVr@+fr)qb|d2n?@Yx8>I*qTOW3x!O>VRAb(*VCgu<`zJtA$tRUTwDpC z&$v--MN6$bRV{QQoFd>N69?y5rUzRtFdhQTbd2n}R{A)E7-~g*Q-fRHH;dY;=}eB? zsy2DSSx8$vF1r&)3!Y^HUwqPwPikItHgq{)Logs*-)vx5-~8=Oq)E+$l=)jyGNTY0RHMtF79KhN_m@iVM`hmNp_+Wqq9t-(oQ)V(|&M zp?WRahvz)_%|y+#6LT%3&WKgiuQIM?RaaKERCG{SU1@kU4pDe@OX3`5;-d+_?i>>@ z?xKF2&;%?$tX_u)HV}#YP77!H%r*5DXykL4ZVk(O>41hb=SNdxj1J~3w z)Zt}SmNy_f$npniLF$zENW}EsGbCclxm%1J#s>HCKBJ9jm&jv9i{}Rau^`!qYBflNkrS=A1x>dDI5yZ~8@m0T@A0v#@({0VF!cSu?;v0Mhv;Hx9XnHk{uD*#$HnYAQw{DHT zYwFe!Ze19^R2B;ymrf|Fge_L3B|??@+T;LsSO|DHL&9aUw8HGLB2d2T0&ylI)EgGQ zU=MYLYZ2^wy+_be8Ub)#eI4_ z2WmwXlM!EXEiEs7xUGTtrjm%_FTuhYuKB#>YX?jCEsk5m&%m}aGh2r$ zC^Rc*vBHv>iOIxj1BYvh=c1^)ZE*R+JnC(etHziefD##=q_)Z=rlT7eKFZTrBx$Uv zF$F-)@O3F3XMMFxbmN8A_g(~1F|?9^wRH_u>=s)a&46|>Q>U448dkm#JP53MqnBz@wv{*N5i>H-*m8N||Q!6#kD`jD??5eia ztJlZO-l2o&&@3F^G<(ZedW(&cMy^>(-KH^J#v(Xi+cQWCct+twlu(xLOP6|xW z#h=kE7$`Lrb@kXRzL=E8TK?!z1tSylw3K55#L~{9XFWT&v>3qK2Y9aMVQRXflJAiQ zHknM1@l3(WR9#+qfnJuy`38f1HM`B2*}jLj@-5c+w2V^)@7SUin6X-0!5Y{Nhh7mJ zL@H}Gm24B~1>iMwSygpSg?3ZwF7;DjZuZ(ZM9j4z0bWW4RFmzy5GNgN)tqt!Z8uAY z5W6QVyfia@&N7H+JF)fce2#|YImr+0w$gH2-aArL!d}cE@#xlRUHC3pf3^!s^R# zaUDzeD^OLvsG#9yh2tjYuT6HEEAe z#o>iL{;GqUc>7H_SJu}y+v^X!#P>&x+fHYS{$xO&Uy9Jar2~@#RLsj+4HcsQ3S#_F)OV|->>f4y?S*A2;(-Ydnd7CJ+gw&~XnC1@b zQ2gvb4NY6|{ICjIVuYo+JrUo5he>Wl%u_mtj~5CH3m=CP;LUn8ydN}EgS#g&tL3nC zv(C|}FS`RXJBEo`{f3SSV2Rf+d+U_P-$(je;*K1y?!hWVOU7^oZnL{GqDQ6pDu2S~ z)Ipbs@6luEG%?u#61(~K;?L~vX(h1(IZU1`h5{I%YGhM z((1oMah54{EK-P{LK zswjpv!Ya8Nj(Cntkl2k1%-$BlugQ!qvfW(>y^4PacJhUUS1}sCbWu@k+;Md!vZ*+% z9r&b!F?lD7xLGb4z7FNQL&adEdB?_nL(Dm#4jMbLv*NioP>$c`Qz>-?@y=L8@us3) zHy-_ctX~i7)z#IjD_QdSIl7zdF5)z)y4uT!L;fb2<~USU8C%Coo9e)7tSNTfG$yJ`%@alexd_P4-&oap2~<@plma-AV@7dd1+BzOwPg{l!|B6By)W->Ror4l_s>kKn1 zxO=>g10>|(?iPZ3zfGZqn0Jc7Nw*icRjoIHxfO@+#e@oWv@5r{I{Lh~-*hLAz*458 z-FtPe2b)`m+?`j{RkyGV^mf}qtLkd>yaI-@{(t!$(2P_0nNfv)d}BrQ8@!qPtmsrL zn$~SbN+dNY)5?luM|vdnOzs`Yv2yLck$#c>Nhd@GM}|lEWtR0HKFL}w-eCT+GiB~wjDx_(C0fu7&7F8#c!i@J8}7g(30ShDpt zT#-oRi_8oq%IAvwfB5B8T|;GkTUGUPZy&A~$g%H20n;R-T)#LMu z){|}t|E9Hz=~;&$KY(;!+Qo?AF2Iq#3+VVh4sk>uhdE|bnbSAAIcm>tcN}|4nbR*? z?xaTdIk{ybInnu1d&WK|Cu%=tl{pcxM=oo(pRmf32n@WS*%!Otia7n#dO4BJ34~9F zs=}n9InKCfnZ4}5;dpQH`&o50mqNWYB(*cIr7na$X(x=@S z5}oHbb2mAeDQ}tLG^{Xcr?oqM=QxuWIDKb3r<6M3w6#-`04R+`j?6pRtc&&J6ok{mPOvF#LDx z+ns#4#~Z`;i_UjW1k1pWilQ<+roBJA%$bV5snIJoI)krq#{N1v2?@_%fYU|G;5jX7 z-`D#XnGTuC=mD-?m!sTQW7PdqKh*tsjnu`EH}^%q#m?y2j zj?-_m(R_~)mTJF%uzm}q7}+%T?hBCR`o)~6eNW$gPPW~Pw*6*RnbR$5zeq;TY$t6q z&Fd*OG%l_-?K;`C@?@L?V-JpQath1kL)%uhJLBx5DAi+M^qSeuz=fA8``gGH7_~p` zTQ+AdZ99@o9lKY04)pRs&w=FT3#E1M&8iER?;${Kzj>u;`kSjoIzy{evH$nMz=T_AK~Mhoc<|q zIK$>*uzN3aEtV5C<5fNqwZFVXuHe`=B$Z+6HT0I9Cim%WzkP}N+fcw$L-;6eu4C#4Mt*9$I{>0sf}GT7DVhwD8BBbm&H>0MchVGN zR6a-LUEQv`#4C&V%R6itk8d|qohY)dZP{AsPLuKk^XW%jO%O}{?BN_n|a`!M~T zX>VP3%v3;B?SYG>Zd9jV@A}t!@~`XUU#?01n2Igz&-=8`2k&iPQKvpS!TzF;OqObI zHh7L0oYeVFH{#s6hQ~l-)iA zca7R_nV^gB-I0E56Rt4QkdsEs9P~RDpHA`UCi^90a7sK|Cl&_shm0Zctt%BGY3a~? zbCbsQ!WmCDHKtK|BvN`{T*gLpQ`G)}iQn+PH&ksl7!I^&NSQ|9BojR*G4SW9CDFOE zhkbhu-fO?zuiaSVh8ojjSY%L?OxGl28W!T^>(wF-B&`td}I(_ENbFv9V@;Zg_pSd&cLCv_k&5TR`{i6>C8ubzVLX^-vvA{F@ zHU>TVe$a`3-L*XjS5s_`+~zRq^X?|U2M{lZ=6?;IZ|I*r3>EU2jP`wRyf@*xcY+sc^D z08#G-@Yv`gGyjZ;UK6$d-HbyZx+CD-5Vjf^!WKi1C9XT?f1K z!H3NGLwhkdx7+WSfNB4b{7m~9_A@wt8!NJZU?Q6RRCnNg>L{u5dJfplW~?$FztW$v zI%}Q@(|x0x<~k!#=LD=S&(GK9WR5d*o|7ZjlS}M!`|R)Pvmcp0qqWcX+Na2tHJ|Dk z%-&W+GaQ|EOZ`5kzW?b}29(lD{k@1@i=3gzhnLc~U)pYppy_UGl4>8+V%?Pe=W3Px ze$O)dpQ}~&2R*6woz5suo`3u5fxSc1q?sQ?4+}f%)EYV2+b{O@d0_ zGh+XR*zXy!M`^~cWh{9QbmBA>uRIO1+vt}-evZGE+Cww5jNNwIQB*RSi-$% zONoDMpa6xue%WVAJVl9pl%NygKfzsPrqgpyX=(X_*`-V@J+_#-Ok8F^!X(f3h8Fxi zmx|b`(CQmlu{rkJ+FM6c?q%k>t`?8LVae%#CbNd)jpyz-JYzY-{_pM@R>$mn*rWC( zRA`TS_i~lDw+xaxpMI+hs0{y4c}IJeiD*8anWTg?Cpz01`LHv+)R~NHnrYqjwfFo5 z*h_Qv1?_l-?(POyp{_~9L`vz0pQ$G3Ce7amaaLc}(9R^K1tR2Qqe=V~U zg*^Jcj=;*?HN-x|N}RdV-c^SYKDt;F97ht{hZ3a}C{wlC?2|OKk2@RbyyFq$ z)C2?uLqB?fnRE~*DI5)q#G9!!O7F7hah~vkGVF6hB~GYB+NdE;kW!HuFruTxYr(9krRgdOl=aYBc9$Gp;Z-l(YL(=WM)^sAnc^ zRz&|ZfGO-2+?O^V6}-(*SbAQS2liPdJX-!GkO%kMm1O{$d6P!>HM-yzgz!-t%^;-xW0<|7^E+g?tFgZ^6@-tAHiwRjWNBLX z>t0%z<=ekyD$p_oS1pPzWK+CGOT;NG6NX^L5@+HsiEYR*uV9hapo>Nrrl$1I}^PQX$+DrVk?A?_n z_WmsoF}GD3MW0u9-{-;`hXVh{YOlmI|r1IR{Xe z{GO>X)y^&3Bv1ISW&!|KeJq1CPm4(oekLJ>xoq^G( ziRDh8Qhkp`uy*UL8rh&;Xq^7Te2lg=rVvdpZy~=!JtRZf|8=37V?RW2O1)AHk6%b9vCDXvL*|Gwo}|P$P!>XF zG8mFHxvw^>ePqb#Ok_qCXn&C^X-Q*qh}-NQD0($TGwe?&I$Wx`&cE64vqs*S#c-kT z{@t`sR@%fK#yyL(*(LRwt5I*i-=xmBw`G;FW43SIP-eeoW7>a_O~ZC(CrxG6uwOHa z@J!C(WCd;inM>zlu-|Bj{%E7QA@O)N7XMA7Y5omVee&Z@j}O`QAW7r(wI(wRewxJ! z=dZws|5;YjixGBDGMz#Yn+=+IFOA}`ueVchwR6G;#tU7;WNdUsZg%>cSj&D+>wO!` zvx0Z*8k%7bM468-)xOI9DGKzkvvipAedCC7=6u{r=Q?8*i?mhXn1bP<)quiNnf=R4 zX~MG+z8<*L96UV2K{SNX?{@`YQR;YRt7QGU36 zP0}&@V^^;oNfbG9Ntq3xRQ+;$679yKuU?{|LUbZ4s+dq^KLGl9Wa9`R6Y2dhBP}RG4Z1xJ|g}3!DW1 z&%avR;CxO-9*WwxUZg`o`&|d8nM>$mMwi=k6sFhc>KBA=*pD};E{ts<_mi$i_;ki;$Iu=jIXW{OBi%H`^d{amnknXWIZno-Dm)=N-Wv1^AFs?px6hk|;bPzKaSXl7obu=upXq>313r_f zsQely^$|Kvr8p}}qRa=zqfz`bZj>_H^v2w#!>&+pV&#y90sbMuEHemG8TP&IAlY-N zD#L9z_24dmJ>KnA_Rmi@m?-=Ry@FlsCxqIM^hlZz;kX(Un}9;(2D8ihI5*RdsW0AK zW8#rU=2{bj?oA<_Xyu`u0B55)v_5sN*-|~b)@)DgN0|nuLnXwFjc#^I>AT+|7K`mm z!N{@|!zEV*>HRIn;{D7-WA|=n{?+p03bUnW|JYrGQWn>{-Gi~$QrOGEG8~pHdoQ;i zH6)Pzr*3jJh2c%kC=;i)p)vFC`)I6?ak{#Y#apWVjBY1Cwa%#YXgAkPD4WCX-5gpl zU>tUB#z`K8jlOuPo0*62Tt^cNSh-UQQxZ$Kx4^-YId>h&4Ks7gfuk~}VEl#nmTBVE zG2Q9EX`T9KBqOieG3S(roMHrw0*q`{$;;bdP=bQYyGBrQLov#mM`I86SiqqO7*z5g&C&Duf@&gb5e{iFQW*?Wr8FUHZXgzO(Bw{ z+HWLDNgR6j2G?D`XKUZ}FZce?k9w5ZH)__mZ_;RDnXJ)>rIOn1{VK`kcYCKLrvH5galUkq6gj&y1Bud5;y7=w>=+m3P>W|(_liT!D0e4o+6ACO|6}?jJkGV13!%Ue;BMCYiFFTgB-|q0Z z$X5f|h^IY{zo-W>Tz{Qaq;T(Ku9NQG1UEa4qZJs3#@>3uK4!!=#Se3UVgkEnkGCt- z2#+J>5=}2DOfpc8RA{a?6fE&tMSD_y2NjN;7;%QDJ<4Kbg?iP#iRnjU81Rh~%xG~n z%d&5-P-~69!6FWB9>K{P4&Cj)oPgD@S|J{4`&m9w+GZ2#HYQuFUK=sgN4kgPab?<^ z5qqn(ljJ*ywCwj{$MnR&cEl8raWekp65iyVDud*<{B{n6n8D!l1f^W&L_Uhze~u+K z@g|yhA`5szH&2WtYfF8^+_~*x-(v3Mj<^4(&TVza$2PQdJ=5QMcO+>CK8v%K9L0ky z`@SlsW%CFJ!|3k=lsV4+QI$6GsluIX?tIgZ40YB|jUl_sz@}Cj-P1M;B{h+CzHaTf zt1vf|?^O2>BVeDn?{YoIGPcz0;4*A_K|P?=T0hP;=Q;z-k(oxT9$-r2>@9shH~qQY z(jD`2o0^*jj6-wlfKyhxCw+Dc9iM0a&xt%m5hb$!aK%1^+HakxBRu4A_QH^-1$vri zuGv@&Bixq3*e=t*b0Ry79{|&!Yfe<>>|=RD3NC|3%0f z8Gp?~n)NX9^a>lFUP5`jy2r=A;uQ&cwT+K=hkj^mfcHiImZAVZ6Z!hn|L!Nv`abgY zG9w><5qWyGkB|SIzx%IO=J@z~)ctS>ABnua69W4A$h$j)FQ)#TA${*c{?ds7|F4mM zID|h1uU^sOe$uS}@alu)$pJnC`3FOIJMxz4>0I+kv$i4c#SnfA^2YMY8lV1WA^Gkgrz?`SkmduU8-W_&@1Sy)w$j3y~juGOZ@$1)rYQrN|3DeXNz}r&kcUpEPS1 z<#)t+(yZ4he>fhK)2t7mjg8ABn4`a5vE`RPRq{gk#mG}1`}B+89~uephvC&LX?*%K z$lo2pU!uKw#f(qSM!sHkx$B>UsB)DjDY`q{iIpLkzXI8Pe6Y1(11P-`FbUr z&%Y7*dL@vLKY{#|;Q^k7ybnhN_(0^1jsE~5%^Hck4I%t|065Y;I(~e)>+W+9v{fN3i;U+0{m&@?+W4Fkw1N6KtBH9J9R`y$|10rAub1=jUdYqy;9-{As_E-pi zpRuFY@%jAYk>7iIfVUxkdkDW8d3|RD^c#>jJ%m4xyx=u~X;u&9?GDkGAg^y|zHXrZ z^g1&4lV&x`z9IT$&^`^}daYx9Xg>a&@xMKUPeuNRA^bl4Aulu^KT3b;wS#_rdL`QZ zA$%P6+Z&p%ThXsHG+(zPuN4`7`7PiFLi6_zpy_pbKK;Lte>8-rBELK|AJ0Snju0M0 zUhsOpG^-wYL(2krKSG{fyXVV4jD5F+@WIH_YXg1ycPX#eg!%X+yNx6AzXWz2@3-Hwa5!zUzldSfIPje*!^T$kHdd3 zr0)^@VSk+7(|TY2o80^B!S-Kz+Osd3vp$kKczpy&lxZKcM|v zLwHYO&6nu`y&LlN8d0CWH}VgM@Y%@M>-v297UT!7Crq=RLH@&``TJGusn-qq{O@4T z;I)Bi)==cF%Ma)^$jcrS;JcAGIfO68{=w^0*&iZ*Yl!|d@(+dZB;=1B9LSr6e7zpd z{iIn}B44k2_3@jKr`Hhr_#Md8>j-`PF!8_&&EJEOr`Hs^pERoqd2fa0?;Gepy`Ije zUxECgq4|0n@>@gr)5w1^gm;%cLi722u&+C%Bp{{CD*K9`KVqJchpVQFW>4pU}2X!DSZV+X1@K zM?U>j;9*=o{jd1i1aP^W_%Fsj)4}sS{5JHNiN10%(FdUK3g|xmUFaLYefgu%_a<WE*BL&1AV^>E*BF16X0KQVPb>N zrtT-eeR*#}I1KLFXAAm%39b;K@}tnVH_kw{2ET{;8qwF+?`iZM1sydF{d54WS^e@a z5$nzdPx0twl#hk*BfzUd_y+234B-ROcP+TD-=paJeQ?-JeKGX?F}OmYu@Cz016K$W zUWz@wAJTUxjDLczAuGCGvHEdH-aY86Jtt}!`XGRQ;C_7%!K*!?Z@(oFW`q0o|B(K# z1wYX%{{!^B3f#B7-^Zc*{`p(<{TuiokG@=UAD6H1^XS_b+>akk=zBW2Z{HO3JvYREC;B#n`}&ok z??vFg|Gh*1>kP~H*RAOL6L8-@22(yl%q#Tt84clK=)QmLq~JktU*9RfI+O7G^XJkR zo+)1W67*Hf^XYG3j|;(JGxoTO`V_N$`6JQy))4+Q`aT5i+xL9*eKACT0{f3e-?5&& zD)?7``}VGa_gl~~lc_Hm!)}4@+hZNTkHDvU^q%m)3hw*EX8PtcaKHW&QM@O?9X2EH zK?IKg_xYF6zTy!68SOa_+;87a=(`@=@Bh=#_eO9n8RQ=?QC|ZvW;6K9*#AE0zCSEP z->1R-`u>6KkA&ncr#wIGjr)tn?g;RcJbBlm@0sAfeG1WcJ@`YEzG_vPq&GPv&#U(x?%;J*ESguW}m{qa1H@(&?L8U`c6X80`O5@`CHKU zY;a%SiRilqe4@`1Mc_tcc6bv zS>L`6`s$vD&%YjhF9-MisTcZg10U|ycP0A%3fyns3F!M0xbKg@LEmHGe*bE1n1+si z{Sn|XT)w?-N1xf?etesWzAM2AnWjJM={tS&w?dNe;?rH!yka>CuQ@`#KKffANv0Jp zu5X)v;g4;(Q_ z`-MqW{$~mNiq-x{^mD!bQl9V=66m86=)L6#-begbCA4Q~g1$2n%72-Fk4}(xYl6HF z6X-LEZT?5~k4$L)6AAVI!Dl8Ff8PXq{5+w2N&vx{FVfIcnC@#&BgvlxaMmABfKP`KVE14 z^gp6s=hcc>@hxm!Yiyp$mCjfD1mH=#YRB>2PY3HJOjLEfJd^jnkAKkp^zb7g|O zGZOfBC(zGJp#RfvJgM6MXafC2uY5hUo>Eq*jBfJ<5 zz850aI;BS=*4;|qi&&+w4$MfhT1iE}Tj_ry)*+>T;0w_M2_h3nMc=KI{6ij|PJ5KU z%uCmK=?*V_SZR+W>yXmtsE_uj{N+k1_oC9*BGwTv)!JA1P^AYW)>5VL^XpH;KNS1t zeHyW*Dvc&t+ms?_zfwENdO>M6%F&N1HG4qH=;?urS zcF}rO{QH$Y6|uhb@Tsf|)UVo)iT{43?_ejTv}+LoYhY%QRZFUV+^&@Tv06*~HDaw$ z3jU!|CCrk?^LDm z>t36^2tK9o)hi!9-P5wCMy$s?T=$Gb|I)*CPsTnQc}mG2OR92uen4_pD1TYRs`BVM z^RNld^&Z}&^p1$t>f!5@@>kC`c=+W?e@6ckFJ;G4rPxvTD(r69K{)m4UVxnvv7YpB zoweI(__tE@(s{YvpZ0rrKI=ir(Yjl9+n^MEb>?ml!cUb_ZmZJq5pz}`{CeS&sn?_L zAyt3BsI*s-^{G-^ruH}Rr)gi?%}!@z#rtZ4l1Rdqsqsh^Vu-SuDUm1{|LWO z3SIXGY=YD_55HdN&#|l0d+<9i|9;Xu{u0;$rPw8#1$tg`k~LH*_yncceVJ19uJ`C0 zl>U=Ar|I_uF?tU?craN=DmWQS6zHi!$&Hm{pF;2Z_*D+pFuyRl-Iosm3vI-5d7G~_bV+x z4jVu5=^lsprYk*_aqHowO7B9xhc8k(1-pCrGNt&@at~jj^c>pb;X6r<9!k;gF{N+O zJ~nj9U+Se*N?FYAP>TI^kHub$J(Qx?9;K%f=REu^QkBokC&j;(Dt(o>N@_DnZcs|O zUCRF><4EaC)H{fje#<7cFCiW)g>R}->YMK2vy@`jrKEYkV*Dzl+*XgiP3f78TMyqQ z`u)_S6uv{sPsJ}h`Vpo1_=SgmN}Bfo{y*5|*F7G40P~4b^qHl6=&c@oi-+&^@B<$H zrHAXDkUc44r6{F*Hfi2x_?c4XLER(bPu^K8JbIN<>{;vKJ4o~X60r^_MSmSw+1(@N z-jU?>6;40rDFxp}D*M0drP_eod$6xk=qXC?BYrEj(MRbok*D+*$Wxk(Jf#l)LYntH zt!O2R=*S#$DyS z|A)3Wfv=)Ek&})BphjvV=uNjfRi}k`f>$0YOp2qJn~= zqN1Y2N-J&^tF>sc;#R3*#flYMs$q$Hl`1OMh4=S6=Qnq5LSp-W|L;4W#;h`AF=iyl2PljQvCDA5kA4;S3)DzJ>D$=ypLpNaU}l{wEv< zNRBJ@$rx9qA60tBK%35cdfcw)KN9(is7L=*knppCgdg7PJQ*JI|y<& zj1LKY0mydq-X9kq;#N_91@lk(M(SaAh{ScpN0L7iQ!`07{kDfhzwsU=rZ*~`_awQ~u)mY=lMAxE%_Pd=F>Zz_?0IA(3x5$b7u#i~cu~nbWtqz8yYKoe4P)^(UcEC&!@vlKYeB|3Z-U;JswDYb0TJNOJ61Hl6pDF+HC| zdV%CBrSBkd9m9Lh+$@Y6WgI7X&l&S|A%i$BOXj_1+;0jcPbcriehacby!VXxc+Z)8 zG4khGIfc9g#{4%gjE-%U6AbF5`G`4`N0@;&S)WE0L8pj(OkmW1Cuq(Ti ziws0Khe)*Z2NLbXds)r(0`JXZ{yNIA=e>FET+~;3-h1a>k9v}@(* zMWE?dlIKP0Z^ZFK>4(Uhke|dn`Aqu5l8;C}D)|S=&SYyJNur!s$?=ktBzKXVLSBn` zFF8%=>5?o87|Gs)FxkK|ku^&2iZPjbHG0?8937fPNkd4}X7$ulLFNv@DwCAnI1 zo#e%mmrAY|SCZ>6FC?!aZ^q{Y$?M5mFdrmuB-dkqlDwI`4aYCZkC2Nnza&3NUWVg< z(VGFC_0Hmty=SA0n^9_)GqbyaW56M*iR+*Cx40KisWqae#~dd z!^vOccr7`fT!!P9M}Tt?!0p+a&Mc{TQ9$#rBsuCF97 zC0F1$CwV2g65}s<4T*WWPV#!P0pl-uBe@ylFWKStBKi|s->2ahhcmlw3fbgX6knxbw?<2FFkOM|np@oa)SV*eVj&pBQ?3 z++lt=*+rsUWHI&FBYCf6TvD0zMsgyqPb9P0P&@yC>pPYQBi5hg7m@fr8HYwE6@~D3 zK7L=FN4|%CA>YS!Itlw7Aiw8*31ollBvG$jl6OnqBYCf6e(!u*%qtX|tOpP`8O zJ?bS^ig%IQ0?vyh#;GpaGA7aT*JAG^E8i(LiqRddp7%pB|K%d@m!q7RY?+>7**Del zlpdCQ#bs$$UeVJsrkCX;al7c8V)gCQEwg%C{wSW($I9cx8^m9WyTs0?TDv9UCh=wQ zTd`AywJQ-{5j&q|^;5-b#D~RwVz963)6ep}0haRzT2930IQG+T#JljhjPmQ^8~A)h zc_cn3k>81Z@VSTb1hGbZT-=S%D@@;x0VfCHa|QWJk)J0he_((;}bYWc{b(dY9ZOekXR#xB8&CTKr7R!1XEf zm5GmuZ;OY;o@1=taB-G+rTDb?z8E#u+6Qo*NB?_q9Y$v1x`upH9EtNBWuCvu55z#B zm3h7~_Tsl<=@hGfNc=)fn`-q%;*;WGvFkLOUMb!r{!aXdc*1mRw@lnAelPYs*QQSu zuMr!>H^mdqvvvjIwc;b6%#M8_7{q`i;)*v zeP6LqTqJH3Ul+GuWbJnqS$-w%xY)`wFR^T2Z27Qw+Dt27D<+m$IZwP)d{q2coH5JV zZ4_S++m~AXL~*WoulTh1i5OJ|dz^RsiBrT!#QkDSIqYzr93V~;KNnMG+w`+YoVON; z4~zT6#5p#7lDJNMSUfCtudsIc;#%LF|pFx_Z3HrbH$C~(_*v(`#<7y4!Hxz zPq8cc0`Gja`d;L7I1WqB5pmcx`9_FiMSScrdh8yCm`;WmZbNjJVU>7=xJ1X^-5ziO#RgKY?iuj0bWPF4+#7AvId~`6xCAJ|xq8Z{NuHmiXo#G}Dm)s`(VexSh zmsUpqtjJ4W&WAsXxWqLwE`1IEA?_FP6^GIPOT3;vg|cJVP8Ijuj`0)5HtJVzFGDD_$yICSED75Lb&giMNS&i}#5Sh>wa-h);{p zi7$(Jc z#bUWwCtfbri`R;4#9PD-;=ST#@gZ@m_>{=|eAuqn#5cuv#P`I{#UtW>L?_bbj~3&_ zP9pCkr2mt}bg{3PDGm{biz7wecf|aY#OdONVx_o1yjr|Qyg|G}yjOfsd|G^7d{ul$ zUxd8{*%^{o=>s z*J1!C9@hH=v6nbN%oce+7VQee>Ee3vZt<7mgCq`SPe}eFiG$h;l3$nnrsRE+`RoA8 z`HaNp$!{e8sPsULP46I{C}xP+;s|k~c!5|h@;+gf!)Fc1)#7d9ed43y)8e1Re~L}w z7vc|MyIAYDt9XjYXAfB3nc{fye6dWtRJ=;OLEIqzO8l+(oXGpt=>J{u1Mw@7_eU~4 zLF_J`DrSo##7W{sVuiR+TrS=uZWJFBpAugbcZ<9amG$7W3*@(AWSo^diYJTx#9VQ- zI8`hbt3*E2K)-yxmb_JL5FZtv5nmDai2KFQ#qY(~_SRolF%?UupR1?-ZgGqF zJMjha4RN3NvG|S1=jrK(&)t$IiG9VPBG)Bh`V{dJajtlcxJ%?ZHndL>dx`_aGsFV% zTyd7j=YpAkskmCaUF5oFOy{$~X#l9lff1`f9c)nOB zE)rLW>%>jsqv9XLKa1~(P2yK#pqni(Q9McPCk_+Gisy=@;-%u%;##pm+#)_M{!#q9 zctHGAJSs-v3m5i7C$WdvUmPZm5vPeW#TxNS@$X{diPmpd@no^DI7A#NP7*H^XNxuB zRpRyH?cxLCZ^Yk=FN$x7{}4YEzY>p$?Ne=iQ^a9no>(AG7kNK4`>jg6M!ZqHSNx6m zNAWfBfcS~{mB@5aG-ha*dPZN2+HD%ssP0kZ97q1i7i}#7Y5&t0W6yFvPh(C$ZJ*@vkF;zTG z93qYq3&o4YUx-V^o5efDUy2`#hsC2}WST8MNgO8Ti3Q?xai(~sxKdmrZV)$%TgBJK zJ>ov`Bk_pn^tAOkNlX_n5U&t#6n`x~A?^@g7vB||#D9xFiS2vY@=g#>5eJE9h-1ZR zVzD?^yi8mn-Xz{FJ|I3JJ}15=z9SwKzYxC{V@|R4>@4;W`-wxvv&91OJdyXKa~@ZV zSBY!HJH;*H@5JZD*Tr|mCh_0mk7B!YTTWN;6mgJvhB#K7E|!S%#3kZ2;w|DP@e%Q9 z@lWDg;`<`+pJ%(j6Qg=txubZp*iSrD950?H&JyQ~my6emw}|(O4~b8SFNl8;{~_}J zd)6j62oVv#Z!k z93-A0juX!nOT>Ai`8^)(ULpA=@ow<}@d@!c@pbX<;)f!iJ77QlAjW1`xr^9S94MY4 z=8J`5kys%v6t5Dm7jGATDLy7{6ZzZ%>$6+ra|@I|5|4<1)2u#D>?-yW2a0Ei`C_41 zBvyzE#jC{Y#oNVSijRrg#Fxa~;y=Yt#BasOzP7$eVyc)SW{V@liQ){gRGcp^5&3)t z`{yR{Zt(%}x8k$npT)n42gJ|C@5R`D)^8UvO&lPeE{+kWikFDL5EqHd#T&)D#Vz8K zBA?%2dv=L?#U}CJ;tyg>e{0`KJW0$D2a9Km6T}O|a`95}N^!M#n|Po2sQ9$_viMi= zeeqNATQPEgt!GE^B=IzHh&W1|EM6qe5o^V3#GA!?#D~PE#23WBh<_J95Wf_UiSYw% zJyXPVk(eZJ&U$#W!MMm~r8xTL>Dyj$e+EzJL@_>}mZxKn&n z{JZ!eiF)t{WBTt%Lheq&-)YikNj^i&7bl7rk;q>rd7ijPyjtXQHS~M4c$av;_=xyB z@sHvw;%@Pv_;2w)qMK>`$BW70$>OPErg$ca_Kp!JlWd2$MEYAK-!E<<(T?9L{S}eV z^HBdD2|ouVeeMHdOwHLdHeMCP0!~ADT9wSZ`XNV=@FT`4L8HxPYOTJayC_be0 zCnRqdUl!j|`aa2@h)1OlWZC-1iJiq%v9~x-94h9ClStI>e91G#O0h<~LR?M4{uap% z;)CMv#U0|G#dk>LYn1%4_@(&07&+LsCqe8g_7F3~pm;V3zXg)d6U(HZC;1BTS`zc@ zCdv1Z$p34}kBQHUe-hs!VYg56Cz8LC{DT;k4Li)c4&n)7ns}NxghV|?NuDMaiIpVE zyINc+{aOkfU!Ky( ziBrX5685!{myxi)Q~ag$4~tKV&x)^-$p4Py{Uq{#Ao&aNN9m(;k&gB!k+4gae6o0| zm?@q`!fveODUypNSBRI2my0XJbtKy(`Iq8W67}At^tYvdPyA3kEPf|O3`0KDzrEN+ zJW1>$n)_p6mn(TRiF!pLm9Nj(CwcS6m`47jF^yydeE=6aOL}68|Ie`9a#Hi#g(G@m#T7 zTqs^E-XT69{$AW6{!RQq{6>r(Zp-Z|_7R7OW5n~s+2SJcTJd)A*Wy#+E|JeKvVC8Q zv1eNOWHDQuD$W#_ifhDQiVus=iEoJSi(iPx#Kf~~c|F8IVy-wsoFbNpmx`B**NbVHdOPnNLBF+)76mJzD6n`u36yFm+7rzx_@@)A@ zVw!lGI7}QTo-fW6=ZjZ~H;VU)kBQHTZ;0=U--yv8Y(2V)J;V$#S1b@`h$Z4L#LLC& z#k<6Z#An1;#ka(L;+JB?NX-**kT^js5|@ap#b1k0iEoJq#m_`O|H=IzVU*e}_7R7O z6U15KVsVZ5kjUpk>2J5#C>|D_e4BofI6xdFP7{knK1WJ_OT{(fM)47GySPi-CvqWC z=1&p_i=)J8VyRdqE*1IQDf8bZ{!09v__Fx6*d%@}MvbxgQ^o#bjyPH@5ib>&i8qV) ziI0oVi*Jhi#ea*(#Kf_-{2t;UF;^TRP7zDQOT}g4E#fc5--<7YuZesfmi=`|JR(LG zSbc(ck~lydBAzW4h?j_U;!1J7xLN$IxI=tL{75`1#*VY~ND(u{T(Ll$A(n`jip#{C z#k<6Z#An1;#lMT6i2o7Y@wOhF#Z+;ym@iHj%fvcyrO4-g+25PRN5!Ya=fpR}z2ZmW zQ8D%$^^4e397y8(kqgC3#TDXh;v?c;#Y19Xg3aGwED&qOYs8J>L*jPvFJhzkrO1~S zuwI?S)5LSc$zr*9nYdc~mH2yczxb^fH_7@>5&MXI4w>aH6Ymk97GDz&h@B@}`?E+q z*H9pNI*IGT8IsE+S4ggtyjb!|$*UyaAwD2JCB8ty@1G?9Rr22?9}qv6{!7U}NscJA z_3c2yPbbN}NL-)xlRjGLxfl3yfYw@dOr zlzvG3m-wR?ImPDhBBqOD#Azg+Q@NPL_*Igq&pgRXBws0cwdA#u@05Ixc#8C zd&Eb@XT?`Zl)q1mnP%ky;>F?u@doiJ@g4DF@q4k|bn7QuJV&e-H;T`S?}~@T*mG_E z?&1LPY;lUXT)ba=T-+tTD>jM$7Jn4mooCBQ7JG^V#9`uSajIA>&J`Dn*NAtB4~ox- zKZ+gBx8*w6c>InOW5sweN$et~h^bQyxC{80Lw%Trx6FlZH6V z8e;b{#IP975R1eLu}Z8K>%_(4QgM~IMqDSZ7aPRQ;ui4{ajW>GxJ}$H?hs!RcZ$2j z-Qpf`ueeWa6c33XiJysw#UtWT@dwcf*nWx>V@31)6UI47au+d0OcgW4{$i$>E#`{D z#R74HSSU^xXNqNFg;*t4i*@2+ajCdUTqCX%*NY9}W^s%7h`3dJQrsruP;chbPH~sG zTihe=759ma;vw-P@iXzL_=D&~XgowLm1fGt(r1QP(#;S{2pOh{>0*Y+=l8jv=8D6` zJTYG^6sLd=isaP+r6jzCB#0}y`u|eD{ZV?|5w~5=u9pX#kPH~sG zTihcyiigCH#LvW|;twJgF);lWDJF?s#1t`AOcT?^46(nMDQ1hg;&3rf%ohvA>EaBr zNSrB_iPd7AxL8~&){85}b>ez)gSb&_5I2ik#V5sW;&ySTxJ%qE?hzZsL*hr`XX0V; zh`c%njqIup6dh?tYm@R#-XrA|iK2LJKXrB9m zeuCse(LDbJ{Y=SaVue^GE*7~CJljz(t`t{^Ys3xWMzKNMEN&H_6t{`n#U0{H;%;$| zxL4dKHj0PD!{QO~sQ82EL}@(4B+)#7hW4dMP8HKcuE)*xXNdhpzTbfQ;bNYcFBXbi z$D4LD#3HdmtP-omI&rbMRIC?Qid+|*ez|TwxlUX!ZV)$$4dP~Ti};ARReVz1CTI9ug0WN5rGz4`OVzZAZMABz6%~#8fd&p!%oNRYdPvWe zJY38Z^F{Og9_%JaE)>o4e9+I3TqIVARbsVRCoUG3iuK}3ah146+#qfg8^q1x7V!~r zo48%vA-*K;6nBZc#XaI)ai92+_?dWEJR&+Vwx1)#STSBq5mUu9k?YW#@e%urx#Dm! zPs|q!#0g@dI9;46mWdT&mAF`3D%OiD#dYF(af7%~Y!Ek#Tg4~EZQ^!uhxn4XTihe= z759ma;vw-P@iXzTctkuZ{vh&2ZR}UB*H6ZZ@nVwLMNAP>#SF2(Xr8}>pKQsw;&8Em z#OK`!Vxc%)oJrzh(>$jMR!FWAtHnC8UgUcPm~WN1Ml{cJLcdXRgSc7TO5!=%C&g_f zE_%0%J4m$WC2=Q-?+tc|yGgWXkGPjadHci^e$IFv=VKD( zTRgC?d~w~t+S;n(>XMq;^5W8}%JTVj#nrWQiz~|ztE^jMbNml>^UCLyRxfep%_=Xe ztEw%oo?E=AyryzC9F&#MS~#b;WY(;j@#Mq^64flN@$FGuS$S#AlIl8VVCjN+^HBL_zG};BYbzJbhqub+3A3vz=Ty`c z*VUBFubs!V@_Du8zDZfdyyDW5s?y?Gcn{N;mzGtunh;*W@CAgAWU0YSIn6{uiBZ#ptb!eyhgtF+VUFg5E$BWSI(ckAXInE_|lU3#bv&ReRx?-C1w%|;%pDuGNq=xr0lo^IH|3i;~PTeh|a34 zt16%GpnHj8&c{*|S24GEc1dMbGq;}cEMAvd9XVP(!P=Co-orFdTLoRHq{dVj!Mrn9!D8t7zHsaaljdU#LL z_J1^M>B@A7DaSUwSvl6Htp>^nrG>S)c-F$%Aw7B=-E(<)NP!Wno4ufBUh(DSH4DNM zT8^qcriJqP9aLIgQ&%~=vJ^+WW~n*@wUVkyS+}Ix&tW?Yhx6GBY->!a*&A(Jsw(G~ z+r87uvvI8Rv$Hxa`+R;&13NodU(D>1In8s|me1$RV&XiUTaHh*=bPCz<<0Y%-LR&- zbU{s7vmI;B!V+l04+qU=_w35~EmApScw(|=SsZu&>#@k}CH4$&PIuJ{Q29#bJML)I zmbF*K^3v+!(uFvtg%1Kw{BY=*u$RMUwV9PI($N)*a0y^e!Z>kPSC!Y5H}_zA`e!Zd zK@VM2SzFN}vz=9~CN=BdlCm-f-C4DuGy z#h3}9%%0wys#;43+l}n$R{KG1b$MyCZr9%Q^G4xgV~*W$!V+q077av8aQLq)nFTJH zN2Zqz3=SKn)9ygTps-;Ox8vEf@j%3&_T}JEqab8q6}}uCVl4n!ScNYKbF2j*3#+hU zR(41oM3lAkHCAE6tiiq^qBQh1R$;@eEZ-1O8u}WmP#E+L5v5_6#wtvhmFXKIN<&{` zWCSJX-dwMRh(Te)U~Wi_7}UNT9BLGV*S$vJ%fTVm0`R)mD114XV=Vx$dyT@Xv$8|# zAfl|LudxanW)1cY5v8H8u?ibzW%-7P($Lpfg~Fh3h$s!iG*)54EZo+rss|CJp|3GA z0`&Q?p`ICHP}ne-8&V?%wJ!&8pD!~4UiTV>F9(NM3&87MqwwWmj1?llUl&dLs{ zgNU*)Ut<+E%o^+)B1%JFV-+^c%JK~nrJ=8}3WY)65K$V2X{^G8S(&~eqBQh1Mn-@> z$IaSmA!1P2Fqj)sBL=lE2ZtI3;dQT3_;PTFwE(>CH40x2=2#2B>t3U<>MXplMCu@- ztfjB93L9n(_6-rGp|7zD8)jwshKSP8*I0$Zpl^sM4Z}26VZtoj?C#YOQ5yOhBO^ec z56kh)5QD;o!Q7AQb?R-Kg{ zQU?*GD_>(3Hq09A8zM?WUt<+E%*yf&5v8H8u?mGj-w;t6hG|q6snxI z5K$WX8mq8j)?nWdQ5yOhtFU2KmT!nC4SkJOD8z$Ns(KJn8ir|91l3uYz9FJC^fg8v z-0V8AweM%}-Au4J%Z$*lEU#F^Fl06i=7!XWLG8;yJc-7k1-!v93SSNmu@-5@kYF`cxH44J(Wux%r;1Fv8c)e^CR-Kg- zQU?)b9ej;d*f0wZN-BR4Q5yOhtFU3#VBZi?8u}Wmuwhn~Z-^)jeT`Lkp>G(phJaTY zDVRSi(^n%(k6{|q>-fyJ0AHb&@FPobU=YXOlJb&SmBkC^Uxv@k#iiBN#nm;L#&lSw zR|aAjF&hSRLu$mJ_T}JEn-TEF!YF(>IK)~2-dGrgRcGad)Imf!Nqmh}*f1;GH$;?% zzQ!tSm^IipM3jcU#wu)>mE{{EN<&{`6$*pCA)+)4(^!QGv+&@rH$;fi&>|B*Nc@jm z|2V!Y!{4T3G31LOw|m~A;i#_`jk*|J3s_(|Su-SAsWOS>x12=wfdVb?B9KOMi1 zu-Lx%XMJb~6K6ku8-u@Umd~vL|I~YR_WW^;(r|xO@RtNT`oquBA%8dEH=6MJZ9!T* z{=Lofx6Imw%H?l8EEmO?&9md$&Ee%P4J()SUOR3;g~Q9;jNgYj#bD;Eys{kHaP$2AriH&lVfEwwGh`b7Gf+9w+t$o;oPCv^F1#H_Q0@%u9Bjvl`1i`KLpz>_BZ^ z+G8#D-}N0LoJ>qowj&Myp1iAp477P=z2CxLI?f+#JN?nz^Oqfm-@KKVh`bZOllQcB=DPp1OTs_D z@vN&Xom*Zvuyo*pL1~$3{$}Gg9Fm=F67Vr0(`shMT|Iijm_Wd*8GUCo>yzvmEZO1m z0@yN~eoRejIM|TZaPX&N$3CHU>(;IHhtC=CamMb62X>WgYI5=#_D9d$^r7S2-jwdF zZ7Oi?X zXY6;~W1ZWY0`Y}h?&JE{bt?}zf828?@h%AMEbkO?ZZoQ|8<96(($>@)B55_fc-0y12z__#D9p{Foe6)Q7#*t$+ z0`UlE+J3jXVShwk!~Vd`hMtj0W7A^dR~_i(OgRPn>FMk{+b4wwhoC*vF@GY_C+pL0 zYf4Rm-?aLsc#O?D=k2EYo9i1_2W~@|m{*y%HEl#WX3S95smR+2`O-7d7u91Mqv03j z?T<rv`8g?*4e;FL2g=6pQ?6X=@L>;H>y4GP7ZS z3fi_ha7|+>#xmBaKhPy@t*MV!XB;cKr=!kEN%aTPK#n&Czk4UxvOjFUIG>pDNJ3ww z-P07|OxfR`^Wi2tAEMA7-=gme)c0E-i>p6eVD~Xc`xyHDVEBHv9&?s`95i#y&Zl)r zdzzN@T-La}=gP*&v|Erqb-#;!DZA14dn~#ysGW44!zr=#{YL2tNWU&{T_g9I`T**Ixfz?Z6?K_% zFgESxWX{k3qj|Z?_R$d@e6Zc5d6|xRS@k&PNA}8UO90cu3U|=$8z@7>@(CQ>^P7fHtwmIYmrIU z9_WPm&AHX7@Y(}OI~ooqRj)d*8FP{IzDwrXrs&Lu{qcoso096+Hl^%XYmcWG3yf_X zk7uRv)d%aV$3+~(97@F;#4&Y0+YyI0+GAGpHokl87}|pUwc3vP-n3WI7ln;((wmKM z96R>R`XtVkyhgSYZOM8aexsJIKJXeiBQ!^2>yz>Ze9XRQ-8pv(ot1{{+lC~xBk$Rd zpx1e0OZ_oy97AqAmtkKahQlRZewGLD$qz(nz%4ujPfAzzypXQAdG2^49Bbz~SMGFJKbC9+V-{xFAMwTbk90cTa`h(0cHkdN z9wi}1I{p!*13rp^D6!W>@u-;HyfRsp0{o+Mh{Gm&oYh9Cci`Wa$CwI1%xs=J7TQLy zGN}yz)(2xd@E>rFD~t}Y&mgIgpe3v-09^F6m0`NcFok%@M9(88AcGw`#`pmWW9oTo zdrUbp*t-bk!xZtePxZ35F>xlCyweDNs6_7*UPY#D@;y!SJh39vj+--_4gbCEnX*{n zj4iLSQDq2?59K8M>ww1MTA7Sq55tNXxOqk9BR(DfXdu>OQ*G=8Tm@PW=u`t|IrpZ2yXfV-p>1m&h63pBB{>x+6&sOAT zie}#b-Z!+Gfqy$zj5XjNM;zAC4#4@5sGpsKg+v$p!+=P|f0Wa){+_EgF`8yl3Wo#S zJ75GSX7l=k#j!zV$MpKvbrvOU@_N?@UbBo~J@})u8wyql!`U*)>&;f?S`}=!;2+;< zuqgI9qAeXPhN2$-_{6)3T!a5eC-aoRCdL|!6oiC`*}QhKPHAw-;~L3*74y?;M=Sde zPb5Y7$0x~KBd6RN$vF2{m$JM!n~BL(&N+ zcIX&5_XN}`GBB=l`}U`|KLgi%q;3LjG1z~&lEQIkcUnrU2)*EuS?(^6-*H^MIN zXoSgbIl`{)H3&~|w;)V$`9i~PE?-;N-R*$ZoahcjnCebKc#=CG;mPie2z$7{L73*g zjIgK6$1{7m-y%H4?Sz3zclkoU-tKsWecagyPj#0g%y1hJp62rL!oKbvg#Fwv5cYTD zq8(>|+Z*9PcQnF5ZaKnC_Zoyj_dbMK?z0F7yYC{*cE3iL<93X}Bya~H9P09sv0Qg9 z!eQ?92v2u^jqnWj1%$)h_Yj`x{s-Y%E?+`-wwr}8&z*#Dg!>DGBi(Bej&koqnD6p| zqS5X<2*$Y_Z-nFAF$l-IGZCKSUXE~ryB^_0_c4T%+*c7!b|SyT_{KzP zykBsepmkin*e&43;`@;Zw;Mv&?TawdJp*BsI{{&|dojWo_fmwh?sA0fT)wU?&V3kR zd-o3rXgX2VsPpgV1&J z5k|Vx5k|SQ5k|X<5yrUJBaC%7B5bGG>K40?Lv-Bd5eD4d2qRp6AKXSO-S~(BA0BP~ZMmd`A&I zmSx1>$>{jum^$(IFglLL@%J%$P64z|!cLgQyoF#flra-K5DhVBC4K|nDVW|dc~0WF z(9vDYh;@lYh>vG{)cV9K#CyR@%$N;{HHc?YKX#*&l#YxYD-c9DF@u1!kQg(p15pq& zIPrVl z6@lr2F3B-)Yko#NKaie$0tAzCQ6M9E5zI`=C4t=J?nq&410{jsPC`6fb?u0t^GOIE zf?;4-pbME6=n_cIMC2xx)(tg02f|$xQc*)zmm?qOg&ML~e#MmDs3A);Dg98xt00(G z1yRG5UP^W#CHW=@PchHXK&lhd2Lp-|h7))$rYpP_GP*nAA*6SG3_;|jP{alj{y@bJ z1fBU%^Lkpf3!Fg4@RyZWsc1~tkF=C-Un1th+e@VIr%||B@|b3 z683ltqS;ZdrRN?ep(xI;=<7Jc(yoTdMp)G2Kl<^GJpY4D{j;HbyrtuVL=IOfQJf(S_W>`-d=iv~M z4drQpLKk0OI2koi)LBKu5~!y{EW}BO+I7+{_OyL(gmyEu{Q}dro5U#*$O?%c0+{vY zNGIbl7{#L^C?U+@-=R&F76lkr1(1<>rcqCE>vkHk-ije#Tb0XJ1LbAV*A8h}_5Lq% zBHSI|leOLYK;b0JL$oXRt^WI&_Ex}5zST6Km6O0D!+>v)b`1Zq*WS;RhnNx>iR8cQcO5ag1|nlA97Vs%-RR_BK)iyfud&>dV^Gf36nAmoIhik< z=D{`k^+fpZ@q38on7*5nxDe_n3#2`e?1BVoE= zf^^6EaF>y%MqFlW79pG#adSGSP+cb{V?4Sb%?$7~PB8ORsQnClaVHj0Zo2YK6mA+^ z&ISkj!*D15d+-|Tk2I??duS&#;Wdi$D4JcV3}&3&(U)~R^*khVSIP?ClgzG|J^)GF zG1ItDvc~bub3w0DFGYggpX@}=hThC*ewG~^m`2}d^j08zuQ(*xo5M$pTxgoue+1eb z*CWo%Eq-RSM?TJ^ZljUpB;-Nabu@x5gD~8y;@)tRFGK<-U)*0^Cz*N06rY7G9;Y2#v=MGQa0^w8&jc!%) zSD2gZytt3u>f``Q=d_6X%&kj~g%Uzu8o$2E~cb6u2W+hpJFWvg&lRe=Zccl}P z1i#hr-@acA_p(YvBPaPMflMc%KP+N~A~=AO<4d!N8G-oh#NWb}UgL*2iF|?S?{KV* z&y7s{mlq$Fl=yGY=8V+D?>znRv_yXSX6(=GpBU@K&(2Nk?8Wo)6MGa>`2^(_!ioX+m-l*r$1*;;&)zrLStei8e;4x zewNrC@y}^L>1fV4FJ2fM$hic9Y2?(DKu(1xOiK;q)Of=5v_Q^P5I8^L&r1*Ftb$;i z&BzGk+zx^BBL2eMKn~wuYKklx9>{qBLSOVr{KW-r*@z~*(1A!x_(NhJkcA{X>m>H|;(v@!WHrXZJmI;N#KDNO zO$j?vodo)bIUm98&~`Z1fk^4_pTwmg>(b!|CvjOQ9+`MeC?1=*+Kc}fpLk;^o|Je? zDBi`1c>=!oLE-M|K*YK`6Zu}+Jy5%^I*D&1&dzdQi*yp+g|h2=2x2})@FH`)cmfgg z9pu62*ACyt@T_tYq6trRAd(UuPvoVxY4sD1X=!hmBs>}KB+xeICN$$Wu#6ZNvj@>v z5OpgOxKAW-(EE?VE){4W$<~IQn#}RSoTOUBI1=5Ajz<#{b51OUkLVKvJhIyhsOZ!H zkEN-+vWz|{Ku1HC(5Od%ea}}1@Z$;3X{Yg!+RvOVN_lfu>mTTX z+_|4aHXkeo1Xz#UTolNu52TgT`@$;-XJ!P8mhH(j$ zJuE-R+OL6Z&UM*VegHBLQ_(}L%+I&)(SE2cFAeQ7XE7@eF&}TTOh4Fj*j0hkZ$$lg zIM2X;bYXzkZg)e~GjQGmKsr|?c>)n9n2+wrL}b`hcs1vp+5nHkjyVlZM}((A9`lD` z4EenWPj)=zO^H~9)8UoS<{ItP2=7vhIWE^Zh2L5_{jWfC0;B$~hP(gW@DUfVr`V>wa!QQKa78#6OZEm2mCv1xwbWk zugCue{BOj61O7MTKYU}Sb8D2I7hl}Eh@80GSWR!6TrhcBTE=NFlAIndMnShi2xM;^C*+LuQvEGAp~Zq$HiL-D%o)Vs4UY3Sc44jE0N9RwUFs*phxWa zQ9OFo$X1hvWwn)*l{2KRBsv^5a#ULm+eo6rHj<3PF(ZLCeYTlu+_sr&JWrq6rrXw& zjL+7S=y2?)iETM-BZ&@MNg6d`;^+wz#*Juei2U@{$0?Lf|E&yhDBX0!@gwG^!+$Gd z6G}H7@^kq)BU&AVkc%LT_<0jk%Fmm$F`ms!Iez3q>86OENpE9#L;2Z?pBqT}ZzVk+ zyJ0KiLv<_NZmjc1x0PcwlG@HS_-C>WZY|%)36swsGj3WzYxzQHt(51djTwm_FIpU+ z{M6%nd&JaH*_`q%^LPiVQEl&EZ6ujtJwBH|Y@DAzm(I!gGwE&kA2GGTbTrY$F`DBr`O42+C06sk;F>2k;FRAm_Dtwy@R=0Ng7o!0)Kd% zs>M#|>5B^|Pq+ZjY2~yu@b(P1&D}T=Ug>AcQHOcz(lO|5aF|OG) zj?skgE=CbP*R3LKAdDiskF7=6Y%_}RsbUns z`mk=2To+nYev0>jcmGZ>GcH@C^b&Kd3Z8q$rTIKQB|QGWAWa8f*Cg5N{d?=)x&r};Y%w37=*OgY!TT1HvL6Gl%O zJH4QJy~6Z30f&lit}e#O_h*s@J5>wt>7?0}dq}_{bu|u`B+D(XGaQ_S2v@iwLJxvq zZK(NN*3K!dTkM$S`pn``#l<70P91SU@w9OljxL^lLE-4)Vh5JxH6?XiTaeHEJ6e#( zEY;T9idEF1ta%H{{B@y}hdLy2IXx}FW~y7c$S%P(yQ*YPtuqU25^>QstjRU2r1m%; z)X}|GVGOGcvo(Xmh96jxQwE;s!+ySN7Rs5YVJGAyUu zVmB@;U+i$nGA_1Af1a_L?mYmn9&M4@V*RidsaOJQVYR=QgQ=I9TqfWVyl~rTcv~()Vip?-!*(|%_VRbnc z8sxfV&VtM4b3M1&SO&4C)G?a*Qotmk9cO@IZ`YUY&ti+Y(dxkG6_d7WsA zHanWU(hVBNWy72$<=Aua1%Xpmvc#!aunmcBH<){J$rIoe=| z%rMRKyBo^@>Y&5%Ltl9Pji!brEU2#Y8)2%;^;NaH9H!dBD$YwjCKuXQQ7P1Nera*V zypmE!tBn@dRp8)Bg;x%DTg~>6PJ3s`!n%rLFQe&K{}^0bUd5Tk9m-$!F+86Zd^O|I zN?FBK3rhT6P{!ldcw1_LJ>vv<=0n04N7HWQ2f~k?M zofA6xRqKgFOmMS~AUe0q(VCoGIFSp)mUFK!p0$Kat8zA&J*Tt^`-wRm(4~z)H6O<@ zEY?@U)qTw_!VD&Y&NqIlIey08`Tyl>z7fOlEuvYK!3hjPbQHcd9OgvF#f*pzw2SEA zBnFZK9V0qL;*Jj7JeGpHIl4!jj5{~_1o#yy?_-U0BAvj}4)OTy!~D1in2q0LrYlbH z8_oOtOcC}?iSZ#?rmq|@$tcXi~dsOzGyjkzXvWxME|OhZNdf=Uy9mP1MTh{0@1|eev7UHhdLy3G>BoQ}a8--WXUJ;UwUT`bg(= z{3d}XNWbrpK){WI|G@vnm!g&PORE-^l^1Eww)Oq$f(m@oT3a@E(0p9HEGi!~cwpAR zoPk3I)h?;6S+JmP(8Ai9L2@++--r&tdYTIt4`8k$oJwok_?oq?(vJW3wassH+j8-L zP+{B`U{<9aSi#PmS7uo~*AlBd@~~G634QOmEwcSkq<$#kx7kJbg1N|i*K+&SX;kM4QAuOQMRlGW?S6UH_^5W# z?o9#QOd0L|`>JQ6x<0093Pbv?Zz*U>WEmoFDb-@gj1v4hO3uHb&sZI zA~KAR>Nq~CmkHY~hkQ*`FQy^qGm(L)4$GmM8syGLN$aUA;Vs`0qnXnfS! z(JQ0f8{qhB2&R;4k@BCwco&3A_ebb+qhssX*}2x)Gf~NAuzHxfjYqGoifWIz<9>DJ zGwjdXBfgAwKe=*wL{hWXH8~inxY&=(;P;PSxgshXx%xzJkLtc6sz0I$(c_}Jt%7&X z6ZgFFQE?ODe0dZmhBp@7qsK<|vcuAHB1C0GUu)`-!6C<-SRJ|C6qO!5(aZ%q_I3($-G1eA_a!8uBE2yq zdu%tQB}BUyERSCPjQbulqnvA8y83?UGw4V6-3a{N8tp!C<#^HV%Jh7L1qpP6nw>&B@`W*C}=`xJpmCv-;C$Dz{Q5kV7Frwqp zE$5KYg=RRoAGg?eE48;pI{!ZQMVO48-r=pK{ubl>xtZMFd8(P5XztMQ?K?ZaY?gk4 z^B2hbcoH&OjPnxY>X6*tc^q<5NKSMffV?y$cXobKPM$L(9RB3%Z!Qm(VVjHFdc!x@ z!H=C`n|oY-{LUJ-xegv33ENz=3W%?8?OkOdh3lk+;*7Ysw=jHj&1w|B#>H=+d&8>C z>kzzZA+%9Gr$zc7TFB>wtnE+1{aVOFTiEj^dvBxvu;R>5$+v_ln7+4#d~pkZ|89}q zL+QK@>4g4!NQLnlsuOzTW|hzDnNCh;XNmGR8ac)pp>$q5b;5YPp!@{u6N~?oyhh>~ z2X1|F!IlZ8reQ9Tz3g*KWCP_?tGJlkAOu+T#}1G7|ncmygSbX=>_+a&YH?DX)?2X@6yBdAvuH`8oHG z%a4W^(jMi$M8b{(mx}vovq@Z>P9WibX>0lMYd`xxwFiEE7kNE<63R83*FOC8kIM@O z7t2nLc!_wO_^9}f*c0W^eyqs$Q@%lbl0^IQpuJ%h#+UMZ@eksDvAt{4bHobqPVt{! zIx0#(mx}j`Zqzv^^CItvq0Ia6$ScI(i~kh)@CMV@i4Ti^ z63zQ@ke-eSOFQ1_ORgZ%&v4^JU@$l?5m?xScU_S9!*flz=~{9xG8y-1NH*gFBi zWT|E;%_7fltoK&&Dbc*&68aY;?-c(c^7d`!J1BlEej$D>elG@i9D+UX z0w=qQsbVkjG%-s&Q_L49ix-L|B+h4ZCD)1d;u`S|k=Iu&|54GrKN9lmlFfS}A@7s? zk!aor2|W+^%x~WJ2%aW6Q_L0f#X_-C#4Y3||5EW9@fMNyq|^T+;?v@v#J9vo@n7P9 zM05N`emrez{G2LgizCEI;zeSGXpZy9&xiR~kM-gvajW>U_`3KvaT1UB$aj%gL*o3l zRPuEsE*o!zhCgOZ<=Y~G6pzb{IDMd^Q){5Q$_B{xYn@3}+y$vn@X+*3)M zABL0A^JYxyi^WToey!5)5FZs^6kiqhisn6U@b{DC4m@wMT+y7@AZJS+FP=}LUA5v( z;;rIlajWz+;DOM>Gk49VKHSFC(W(=9+y>A0(M;FH$~B@<_=OB~OuD zB$Q5w5uQB3eu}G{G7l|vxb>cnZL*nnnm&7;4_ry=dqhcH`q*#8k7!-3w zKGkXZP2}^Pl*`3S#Vf_t;%(x6;-ey;`(*x?#W%%&iXV$#ivb+dX`di=6Z?pR#XNDM zc%e8)tP_`sH;Q+QTf}F?m&IM;93p7o`gcg|C;yQAq2x~`e=GTW$uZbRXy2Yh{u3mhDEU;${Ui^Se1_z)lFyOM z$292gBFS?k&y{?cJe`Cc zAA2D;k@yhvpybC%`2U^cmzDk(@qO_#rSs7x`r*d&3{L-sI2{;bH!?)E4EZ^hc4=a| zm?8ETGsSE%kHlQh7Yn4HAQqAs%jx0_5``9tGfC9BOspVL_bQQh;YZ+WBYYG$<(T?F z_UdE&L-zbHmimotq=TmabXFkWm zKJO@ZL8&bBkfzE6{i@U2>++i20n%CrdUXkFhyB_4XWJ2G(&Dvct@yJ)OaH9D=D%F4Us~Ka z6V^ekzj*I|Y@Ycs{AX*^><4^R#^}Pwq?MQH+27IaJptjh#S7p3?rrU@XLv;b-#K7j zBV}H8WM0XWn z93Mf<#$##thC`3pHY03l7q2wJvui*cm${)WX_Wn5w=Xm-o_4YL=dls~LhFU+N$*wB z^H&FbxW5$m!=ccu*Nnqq$REFx39nxP(i*AI=J~@i)6M*4z#q>8tRFrOh5U`N{zCQ3 zz%iNirVTgGAD77quU~yw{iyfadj|5eI$l3#Lgx42-sbt^cP!!l*1=x}j95Qh4u|}8 zu>L~z+w9u<(T1DnFRq2ZZDIApsV3y_DB|Ju%%ROodjOH}cI+LEe!&D~xm-oWEBCY( z{uZU%V~OX`^T+Rk!~Gqe>Nq=KM1N`c_x$m@Vdn9Ute?Z*2i_!ro@xA_D|&W&avkS9 z=)BFd+ldI{-qv@R7qj%zk`Y07RePzlJKYmN&u*Wc2ceWQ*zFBTwjC7rwwMQ7r#a3{ z=-J*r`1jhotA)SeDAcSE0~>B$x%>__y#JDL{$ShbkMr8|cNZD~)6iC!hkjNW-uz2K zsyR(o)!Ie!)6)L?I{A2OW~Ny(|G%%3KZ9T7Vo3&j?#gf?A_7h|)|kwX zoU7uhwB9u89>?{ODUqAD!mu8xAtB6No){EOD}pqhq#ieW;#&aPqN10dI}yDy;QS z-T&GbE!U35dejH7e)+-r#Ml)mYXy8S%fuS#NmvIwBk!K3^ul|Z`ZwN#_35!rcHY{L z(+f8>rR}( z1o-6o;cj8W{-nrFO%XG(PIxuPm1~Qy!#fVvHsM_dX02=XAN#1f9%Zk?TG(6b8`*bV z8g4icm!y8mL*B@CrjPJx?I3okxYX*kO_D3Ig?7GSAL-7uzs*|X>*^2C=E0eGHv@c|F_aySZCI~5cNuOZa9#HesKyL4yMmsdmw(@ z+9n*oKj~bQcL4kNC(d-Vzj*RN`lesbbFY6gq3aSh|Czoq0&BZ_{jK%W`L2QqVe6-} zKJC!P_;sw)x%&s=aKZ72s#o1n&s$LM6y&EqDea!n{;&r6%%rskyzyh3u7fUIUIDoa z+DKhWJ=XX~pNIMd_E*TBy6AO&nG2Z@WzwE?Oe$Pbr|`TMUtcFc^EDFZ%FQ$MoYIMmcmUZ^uo_=G*j5}I3x_0%qd4POPH=+j5eN`Atp_7)v5{c{ zA|@@H433P6W5=?C9X58VX_jqiN@Lk2DNRYOCe$C=vRjg}8`9ENe;Avvv|(GeOH*(C zet+lOqq)qCoNV9s{k)%dK6>tR?m5qS&U2pgoag+x=Uypqv+EPk;U}l#9Y3ZF^Cf$8 z{?W;1uQNonr+=3VSqWBoTLOhU1{|};xdfRXE(_grk9_Z^+UOWFsqTSY2e#pZQ ziB|z1^nbz&UA!qT{SS{m{Mqp5=ue}@2Ton_LF~97U$&=|L!K`FM?rITxRg(*&*3kL z>wo)5snLTzcye6&Yfe8`>dHS?O7MRiXxpzZg?8z?f#o(&qW#Hn`C8_vXPSa%pu1|a zll1!F>dAO8Jh2#h(X_7%>Ggj{NS~E^a$NEJkAqk%X|0CeGXB?vWk~5`u6Ykrh?)V zlm1v?TsGH4dtLBeJbl6Y8es81drzJIXYb+Df%n+t7roKbU-b3^!@%RGcQungC{Br& z`myt64d^Tr`m$qPe>UL-&y{+h85-No{|M3lqWM8-LH?PNpM7M!x&66PAxC`hM5!|v znrsSfVod*sB+K|PTK-=T#`kBjDe4!4|Njc>cNMg1rzYyCwqhD~rZcyLapi}|)jfqz zoFC9PTZ1PiMW?=`|Cu72+ysw9b4K`o5l@)5j-{U*kH?=lE&c7g%JNg&FUWqm^gQ>< zqcWIloY@wm9Ydckd8F$j@N@F43G?3wt#l-v_~=Re`p6sS{?hlA+o%WnsJ+Q=Tt(g% z;``BcZ1~Y}m7Pw1xzyfXoVt~I?@N+D_vkqPv!&#>e1$G7hD^FPB~<&-V1iy8JLQN|*gXS(lP= z0re5jHTaQ2g8g0~2V^2}0N=6?SV&wO5QLBh3$#Y+1$5SH6wnt_b_02QNFUHl-V`7j zo##4FoE*$CK)=x!TFhMM&cD5L(kn3EOpTOsYiVC>ESABBv2BgNi6VN%W;E|G2&Y3epvq(WO#bKWgg$K5Ibw)e=1phW~bVT z)Bg^NH5I2+p2kAWC)&}OY!W@wf9(H1NwtlX*1%sj@V>B(-=}g$ixcPSZQJoWDl$Jg z9!ouOdi=VP(g3oGUgaHsKF3Z+_~ePl$s>Bk4*p-ye<<;x?Ww|B zMx4){Q2+3dFAtq;O0>+E&!|q#(5|ULyEH;8ITk)ZzX|7pb%!#O?tl8U&#|^eABf%g zx8?s0qU;GOlEv99REI2DUBE&9Z5_=M`L|mj&4;O6s5O z_)yp9CDRdT89%2)%lDxTt@@XIZIo_rgzn~$PGg1UZ$>WKF-pIX{*v^bD&_AVDbX46 z=_9ZGC%#UYYJbY;@3I?;Q**qz6CY4JW{OiyV?bt?p-qnMGBPdje#AP)OQZtqF^A5* zG;^?B_)ISm^FBP@lrK!CgIy&rzpJzW`TpZm*j=8vJN1z*G>xGze42D~6q#8Yl)P*4 zDcxn;-~;zl#+JaF@RzDjs<@}LGhG-DXz$}IG-lmB)&3rxc@OUiGJTp7;TC%vO zt_>a3<>)ur0=BbDzE-kN&t)3YL(Ic=O*Wuk>HFQ-%n4OuFXui7aaY z@`_HjEnmiXJ3m9Z;zbip+d%&2I%|(x!#0uqC$G8K{!hxLsZ)FQiOHQF|IZ4UO`WKt z>M)BqKeJ<8b&;&9x2wafyp>1wQ2ksz#`;D|b?8;?D!+hl)Y|6Td=PGmt(1l~+F$jm z59{sf^ZQ|a>Zng;+DoJj-1^m0y{Y@|(r{ku##K|d!B1rpzWw5SF3%i% zcT-r-g7?@yqrUL^4D>vcJ0l;{OWo9d{F99-Y<@yAH)Ono>|Q=o{Uts26mvw@%Jcz_ z+0OS!OXgX-)6e}Jc1PWBqkQF+PIjZC+@i0R*1%i3(p*703eumO43I~DD(>}6G{{yW z_ZlNp?mp-mpL^q`iLYJFobRgQ1Y1&P;>Jc9gV{&me|$_CKa<}v&eXR-eyOQw?Lz-= ztzoPWf;d(`MI8-WFs{z)SNSwO59@?8so=}_ zF6LXv6l*W9!C8M89;d>2#fuRh$C;}{Wsy&iFNw9<{6qix#+jHmh7U9UyK8<^{?T#i zN;>*;(t1Lke-N?1E_lj!sSW=fdX!wMll~u_hg|4odVheu_y(^~oXCcJe&5L!!_;bJ^ zU=+~z%XOA919*UY?)AclnhNJWdc%)fSbv>+8h=w{{ynU97xM*tMOWr4rIX$IKYlBw z#&_&y>C`)Kw)#8&Q}HP4F~uJ%44ZhWJAX8^|G$dNn~T_O13H&|knv2Nck3ko^<)Yg zek_@Oa?*=E^_q8X$9Nji`hg?BIB<~veYmgLn|je3nz&l?Xs>tTb_&-2>D2$|z;_H_FblUFbBrk19M*&7-*^QW(?4Envt7}6I0 zpE&jHcG+ycIN|!!+_0=2*qG{d47*j`R8}wiHRn&v=YKY)hbI0~Jaa?iU17Ob({E~) z84Qi@rOYPgm(CYl6PBxWjC}sJ73KCt%Dox>Mt;ijpk*#%)*9lK%I#!q_s*nqUoAdUXk2YNi~S(}_oU_%-|o2breZ*AD}qzXK8(&*PA%pBe?OU+N@br# zt|jBzYkdc@s|~MdqkrXhOvZw-*REN>8o=<~G0uIdE-2r}vtuQtHSzyF>%)DDp0$M2 zkHBx`)N727H_=`*)z3@Y`u-tw#n7jGG18{P_>-uP3wPr;+0*TTXMwc3G&1?j|I<6z zFMD!a>tL;=l*bFS<||HVPvu|GowM0OgY~_IY+>@l@M)o3wejymP*EK0*I8zD&=A%JVDN zKMrEklJ_m|w{p1tu@}2`vU5D|%%0HpuL$YXFLzbgKK=d7l929uk$QDh&?TvdlgZ24 z{-S-=b349s8i(W^2een>0i7Vm9kXAui+jBnk{1x}0rrzt1b9Z^6#)H4_uFSf`hUo; zf119N!FN!{TRz}T)#o*)f4QW!lk7H`JyuFEcFSgGWslVz^UHnh$U82!1JO6rH`9Rn z9M5T}Cv>)JO=Yfrj+D#1KJYXjN5<_8}Is|}>@i~LlsIMGkJieG_@vWHtkKh=W_ zt{uK^Y{K?w^;^x6>*(L`oZ1&ir`>v%nMkAy`1WNJ1^W8s^k;lcLngPIXN}LAe#*2b ze8%}~xWA)koIA;HpH;5hRF?0Z&}uFuc?;D4a_YnSo4tAU`R_B|<@u84L6pCb^t$#R zl#+q=>z7Y8vF@MM{;=ja6U+y$-^ad{>NpUwp*`#sNhhk~1Jo}Aj{-FLbfL5qdbQha zp-yCToe_G;BwO-wDo@WXhDvMU(H@rbV1+JQ$?J4!%7k|oSxsBa3g<=xnMwTene+8l z)^!nCPq9DbWVK~myJC%f5s$<`VNz>bqoY7NS~m4-_!>Ru*~Q*aLi%A}$drrz^eksE zEU)S2vOnmnC{Mb{AhY&Bq@R~HR}baB{K3NH)sz`;|33DO?rD=)`@>W5+{06eQGoba z>F>XmXx@Q;z<<#uvQJJJPp~g>y;mqsv3@<%6w0wZQt#KTn_Ru`M|Yd4`BKRnlU}-~&Z38X zxrgI>(@)o3x$$#zpKpIU{J-(fmgJxExt)`@cH6atX`6!Plg7U^91izyz8K08W1TE{ zN7*ZK^*+k8ANdQD_gnn0aq?=<=r-znlzDhS8v&EYmMQHL7n#-VJj)Nb5crxtgj5|-Cl0JTluhH{s z)kF1_ug#3oSBBMBR-66Hw8jbISszUL599i5KgohB%o1T8CZ}iIA7-CjOkyIMW%*`AS62g%xtneq!gO zY%4{3ETWt|eLvQeX3p)+zn=Rfd+5lM*w~m(+(sG3Rze$BKGCaPH5WL}^TD4`R^@zs zjCrM-uh%2j0p^~%|Hp`2dn0pC(|_=-kNxW##_rXpeuuGipjaps$m?u$4gM@|5#^^1Hd{!H8Y&tC~An{?gUGA-b)&L8LZvl9~XGE(8Lg z2Oj6+7W52JaE$xIfX)IhP&h_DU?1>2pzl3s4y@nk3k`*4d{&&X2X=p|_2WYJFw~b? zm?v=lif86eG2dk!h97QDkJORorPCvqfzytr4PI%0xr6zQj*b>|Rt|ffFl*9`o|_aW zp1ZVQ_GY^96WU*3zBlnAarw-5PSfsZlv(G>l;{1k4Q&`VYT|CHh;!%8L|^8;yCj~n zBaLJ7M`1p5FS`=&%Cl$Dy@(;~Pj)`|L2t_0tk(U`--@@wt_czK_~YdU+C^#B;|==F9>9Tyyq(#7{^T=3}MK ztkx@xxoP#=V&a0a@D=P`=q%Nht%^V&&ZDr^4(lM@9uIbx`mQdNa@?cIsh4ISp70}78_26@h2nk*jPgsvdCvmgkz!l#o`KC3gHzIKYA?vz zm~6QRnWTrM*mMW!G_!dgB>O72P53Mhe=>@_sO%eVv3}6)@jQ?1xN*2uWrk&lx1Md( z;x!QRdQSx}?Ug!S46A3BLML0gIiyp4JE0LzM<+k4e(P*@0B4&6_EMoez+M`250C@c zd-E~?`(oy~&O*}lb2hB!Ho5!o!x=k2_&DY2SvUWj%sjtYf^9n=ovE;C)mwI~^L50?4z<* z%JTqM585Z(Bfu8S^9%e}O7tn7KhL>kXi|Qn-g}y9+2>Bnw^sRuu>V@WV4j)G=Zv56 z3&*^}w4KiMdS@;rE=hlJzB<}(vZ1{`9jQ;IhP`SHo{jT-5$FKU!Q>Rc8s2=9D+#_p zVME|;Ko{W-K)=zi*A>iM2RUxP5kH5ms-Dax%s4(A;>97(fGg)W@(a7HKIyL-her#F zoBJ-K&*`{x(PuKu0p+`rxgvWczk$CfPTe^tIdx}u(zJ`7gUO%vdB0hrZOuCiN_TeV zu{YR2yzEGE4r{KWeDW3Q%RFyC^Q#|{kMYjz1P`K9^&9m&=X3hdsp}hFXb*j~srViY zv1CPq$owdF{3v_tkCvK%G|&u4o+QAtEaG<(zmxc#w5#B^t=c7}Fl@#6446XLEg&lA{^%k$i4cTU!a`Cq)3aXSpVICp>3FPGC4r?OS% z`zzv|AJucdRADE2V2wiCwIM?j_sX+3lqZ4ilFS9nxD*+q&AuM>w9j`m4r)B~<`pP+ z&DA^b6@O&>pOb<4_L<($7T;p*)6PqmV2iS4XOC(}m9IIza3;jY9(Sa8{xej1f1$nc++r!llmU(a`i<_lbE}y8NDg~eKgh6F$`uT6mAgF$51CU39H&hZ|*GJ9zDAGUNx=8d|6LsdSZ8Hz1FR_mlq1C-D zLw#u{b9Z|$TXTJ&Ja;cnb;8e+?vUvm@+FY#eAp)ExxWBNCvI(G^se`rtnE$v!X(eZ zv<9~6qlLPP`=*Nfh2fgn(a*VZ)5NdOElwP$pwqg!H7H!fdsYQaKQsdsG)sxgR>XA? zx1=J@8{^Cvac%8|(!#L%iN_CZhFfu1N14(^&oZ=}LX{z_S;gYbxm7I@}A- ziD*rV&ha(fQ>@3B-Y(qYv4J z$wTJR(S3!*l-mJx0+|XKnDgjev^fd*CSrwQXrGDJ@%ajRtwF;+HX&cDc||-^mPK># zVz6@(9nk*RQg%nlW8XQM0aHeby>&OOOD z9fdwoz#k4X-_1#1cCB@cIjY)L&y-#NJxbp^1{^0&bg~ndcAWSVfcNX#gIziG#tU~% z&EEc)-fv)TamVD9(7#j9PSH{HeIfDG9*BF-PVE8?sXy^7y+QjlPQO~)y1kk%o=cyM z*}a*r%$Jd)I5i&A`i^xHb#Zk(Nu1`os&^gr8xPmfUP1ew$i{dyyJ?Aeo^EB_U(oZy z!OC`Lj(C9c2ytYK!ACYA-K4Gm{O|Z)X9M%cG#4el9y%jOm?k|dkK#llJd1nH!6d)M z^!q1=jGhi;3fMj8JPOzu<;s6c7bbu9kx9o(@v7f+dC-RTIKL&}>?-MMUn5JHCRvnE zagL8^GxT9(F<3rme?jwOCrga{F5g&GhV-Lm4QR?hMwL$)^V7sT{!T}=%AQFNm41AG zg-;u;xYyYr@7C0m@pH)f#$9(ATayh;%TXX6`LNlq%x)U8ZI3;i&B>0m&u8a}rY`7B zvMGEPn=^5Yu{@J$h^0BxOS{>)EYIv7Evatq9GU8C(lXdu=9Sl^H`yDugYPO%oXtF1 zGWW*U?=R%2OJAkksXhhile5Yht5@~wWNv8E%gaaG@?$~9`fbLef2A+!y=D5#V|Cdb zYF$ zthi5A+$Zr3etPT~Wc(82t9vgR9mpO>3zt^VUs7>jUvWRX;y$Rb886U2+*2hpf2c@H zSL7XHA8WQ(I32D39@=cUBHwQA6(6PR1b2Tp*Wb5xe- z0&nCI;tJgFXn{uQvDolyO4nLkun=G`#A9t>e&ISASs63g%hVn*{b7C*J^Ym-bYu>X+Wp1M; zT|lim8QJMilIbFT$S@p{p#!F}tr!F}l0Q6HE zU1TfRiOyO{XT}%kxjZ`4d{@uHm>=BS724-lZY<7wDg6}N{@wGi(fJ2vA2V}jVc8{d z4cMF3t$Z4~c+tFC^E$V8V0>SeG0V5-1!AjV}$`9v9ru<-- z@|Vp!@UG(&w=8jm^fN6x^QavAf9Og!-Dp1fk)8U=mBo24=9F)xm3!lH`Mom-W*?uH zTjxy3yGZ`m$VYwZJnv(Q2Vc+EImcN;P2g8|XuNRytvb)DIr`4U<+HYx&#(A~gYmmA zPe40N+t=4)T5BOk_f)4jQz?7zo;Tnx?F`iam(9aw=DT%f`e-Aza6q1jd=0J+o)5J>;FG3+#8wk4Q%CNz~X?o7Vne@qC-n-(Q#f0XHY3!vnJv12v z#i@WiqEVdkG=s&X1)Ko02R5npUI6B~)})?$>wXLS0X?L@RDXP81vn4Ac&!Y>tH8aK zJ3zeJCY7g6^2J2Gw`=?!=7T=ALf?JtI?0@W#gu&=a!Zy(Bp-Iz&_w^zT%ta(wpX9q zId1p39~rObEU(Xd`@FmKn9kQLztSX&>Z7pgBc6k-F~Yvkur1hac&aXj7d$_!Jq~F9 zkUA;v_K=VAD{S-upP2XPq}~IPJ`=&Clbj}f2KwD`;uXhUyt((;TgN89!iR>ZykJL3 zbBl9d_|EAec&QxCB^0l?*JC`J2aG+xJY>$h$J;|&!_H(wl2!A2`WW?GVfw22n!Z`$ z^elaePWP5x`yjQyE#vZZrHIY}*!g44B*W*rdsm-#Php<|V1&&yPz+)#vZuc;n_+ z`bVshKaXAgs1y%=RIX2Mcw$?QeLG}InL4eUn0(_6Q>W6)9vBTqW|59d`F>W{Fq8dXb)A;Y8;)ehwZmIw`IogG%_*h zQmplnlFyA#)W4ySm9NQ8{SU^fzr#*0=3}2FD*eZ#mo&f4YK*b(J9dP!T@jJ3twOfw zIE^8ACx9{F0I(1U0R8m*GkWIbRLJ{|2=C(+yf2p3^izf&o?zKTGmlPi9+){1 za-+u-_N07ze&+fM$}#6vwo#_$5xKC;TF-j)OjvvHYLmW*Y?XWP(vz#Ze5Z7-eSYau zvUJ9GT-FiaQOEh*Gt$XXU;xMgOMwiapU&1y>xI1Dz1Uu+NRtjXoqQ^Az%s62`~ z55V`YZ1`%zS;F23bN-RLrkcXFpzK}W8&VnnEmB4P&CL7J4YR}bgLHBv%=_1oyaywBe?Z<8 z@88!In7cAhDMFtrJi@rDIsR~IH}Ag1(tI<5XTDzgkrM4|Wbp$0VLRW+8f8r}YR{0@ zw|<_zQQrGvemO|rZ64OQq(0Ac)9eIx`PloJ8zsG6ryLK>Vf=Q+zA(S+=YHk$cpred zz|t^p9eHJ68Ol7KE=+1(AU$UayC$-zfi5#Si- zWylZq!5Tvvz*-YGf)n5-a2$LII0l{#))|;f!D-}Li(HcFK$^LF`pE7L;XUK?W7=QJ zXivu5MV?)>(XPo)gmqVXDXjY`u<9Ns{an~5aUcy4P5#Hu?w7 zCKnM<@0xc3`ad~&AO*b61j4=BzK`(pKmarYN#Ftk=v`cW-?NYVUO@lHXcX833X0@f_wdQqwt%i)TEnL7>f0r$tY`{AyGB zBlMH*iN%c99e|!8>+C0U@td1ihsd9#=zD%p_PLtpndjEXq`h*z`}1#kcCByD>Fmd> z^rPdlw^aV~<2{sL@7+3{LEa@Ph&6xt}MCZa1 zW9(tb_SM(Oe{zxihRX@&4B9)B&yimB93;VhsJ_oJlz!sJox#pYZo=|Sl&&<*L!MDu{wel+hbF!Dr%Li2@7wh9tMC5o z%deixeU~=kyQRdZIbU@XaT*`rO}gGaJeM1rcmzG-FHRi@4x6!){ZH08%cedHU+qt) z=!;46ce1CPX)lj+K<7d7s8Zt%+vU`maAEG?Xhrnmr=-(}X z`us7R)=@w|^=tK6_Qzt=bJxq8VSRd!@TNYp&($+!Ln#KXIN)WlZx6`RdHL+L`la|E6@5=R>bTF55TH0%LYl7Xh<1T=?y%zxbX+EnlVmvV8 z1mh0v%)Ykvcjo-fos*}2oxWXQ>>kD!(bgJ|+Q_EpeNOp|zUc?DPugI9ecFE8HD+}({Vh|5$_C{Vz2kE|eLGIy*SlPadEV4v#^l7j z3~N;C!nkvgy`6)sJG8IEcSnqW+)sV>5wH2&^Tb^=Hc&VABF-cd9(7;MnG<*sM_q_I zT&J@0ChwEu`^nq?CVWIYO5Rvwku@9gWSJ|nPHCEBzt4fLVsrkc{Cy7fb-l|YJLv)r z$`*kAz+PYg=mYfo#)lFGw-+DXTdx%-Um@E$z+R1H8pCf3AH|+Soi`lAuems3jaQXt zI@CW-gmlNlz972e)a?XN4Ed>@QutuYN9V`vJ0FLv(X@dZ?dd7D{B zvsYlAZ)U*At+8W5Z6=%uG3{dRX(xl}TOpnGMcR|I@4${D&ob6KdJlHF*$)&Sy;sV3 za3)6Zo+x0K zG3FHVS!v$mmLFH!F)v{cy!?)=^NH$fvJ1^oy!^O%KUTg4)tvG2I^T#-f?o$dMe|+x zFY^pJU5rI}ke}x>W-=~=UUrEG_F zE@QR*ZiJpO(r$CQsE2!3kb0fbeGvLPwXyDbU(ondogH)S+eUeMex6pr{M;CJMBf2o z3^Q$x&NPl`uF}nSu-rIyn0*_4!&UXwdm$$Zc5fq9U@nX7>iYw^^7p>edA@;7ofWTn z$8%Q}rpFcCzsS8y*Er$MN~L+P$i*+f#>Lz7K41D}WRV|t-)xc2uV$@6zcYTvy$c}v zdn4cPl0TCSZY*-V<>L>B?=T#Re1GXQdN~Ok1J(c;K)=y%EHcj^&!MYh!z20zzBv@8pZ?$}v$r63iJIKBX|3>4tAEl3!hx5 z1M!d!9**e1eaA&Q_+F$;XP1t@zCU#~tou3D{R{TpjYHJ42R$L6 zb>Cj2?vF*}n5phJ%~1CsQun9+59leS>YnEtbA8OC)K3z$ zxoP`Cx$O^8e^;K~myzAMd-)aieaxQl!f>DKkq?IZ65*P=g}pA#`8Jw9yxV-2IfIXh z@ePW;kYAL~S>}!!lfO{GM{7;-!G6yu-$iHgB68@Ra^)Yc$X^WeFAei+t*W|2%ho&P z%KJ=3-hnXh2g&Pn5Y6Ylo%mcuKE2B%ne`k<{z2cQc6G1C$Gyw+>lJ)n4=f*jLtFV~ zs=M2l|ILd0ZeN~f0_;=nVqc>CO*=MWO#AJnU#srFQ<2x5$&s#HdzJIAm`WI5ZhdQ( zcC|YF52Zt)Jz^`dv4~A-E~;<5_2Se6pcxov&UqZz2WTET2=oJ*i*^7>-~xU2C@==> z0UihRdwJ+aW6OH)?&MR}-y1v5;!7fStZyfFvUWG}3rqjrbY07RpdUWcVN1x%J%7@7%EfCY`{@Yt{X#{)1!2CQ*M2U9ZFqGB zpHmV0>0oa}?dN=P)Q-o({MS|Fci#z={U~p=@0h(0bp3dkcVR`|ZDH9)kD=We-J++c zy;Qz?=lu7ytzkFkv6~~PokJQ}bK z)pJ(1FzyX&yn6)GX1r&A%-CH)<9>GP0eH;Hke=IR{s(~e0Nq$#px^l3&haF1$|G6$ zj@m@b*&F%9VOvka?T#>Qy8XgDw-Nt%5xW>=FO)jz z8_$fBI@2)KG%VZaf3hqcn!FthFZQxlPBa$yZa({`zK85t*PpUFThBWSsssNk1{p+W zATD~}%6$@@Do%3F3d*!h$_?$b{P5JAQZ%!2kBmz${LxqRKRH}m zpf~hl|9{FZ@2lGHq(1h43h4VYst+zmcp?^J$?R+(1uyr!gXesc8SGZ|adAPGxsS7* z(C1+{u{H8}Pue+14+T&!^BaBPa$|?*vBTy7T~qFu`hU^-(2-6LTazsgvj_M@N#Dfb zn^IGqqr2;#htADacdxZRO8@i1>1a=ZzUf(gbw+%ao2$AsH&=B&Z7F_6dy0G`-F!=5 zzRE*3`kwKFS_i9)7m!VL51`lk@hRrD`sUzF^an!vmYkJKepC6=dhb4zQ?fJ-!@r&X zagZM_Er74SC6yX}qI3wKqO%h64XU>(hxI}`^5B1Co&5hGeFIw0n&rop=Z}p3Siiu7 zc9JpXL)8^sM&>W@T@GK-pQink z*R`MHW7@8$^!XqXi?D?D&^XZyXsl412=YJ|uo%$qg%8>1 zSbOQC`u@1uMsvJo+9ujAMQo#1yR?Pv@-Gn^YMG&3v`%pP)Oj%8F`f+2Dfatgy9O`! zLDjoHY?H#9wMn7epS&j8q3}ehh;E7j_BCT)s&11xu1&~a*(O1aHo5F)v`I1SGkYU_ zMsvJYKz&8))ZHOew#n!VZ3Ug*VoaLQ`($z2B$l1|8$hy`=y!q2-|Q)WD@fn%seEVi z_M2~fXw&9T+}OW%^Mji85<{Lkwx=Kl-wZ<_DzU%Rny zOaIzWtiLzE`F%dy#2Kk@RTkhYq`9ZJqgBSDb z-?Vk0FW9*LQ|mVe{cH32^&6-E-F9F9gZHjmJFxEFE$i29UO(t{ExGgN;N!t``ucT! z{TC5z+!PFK+V}vRAXkYGZWtWguRmuGO?n| zCD)cuY{=J0d0^9E0OtsCFt{n$vVLQqx9Opc(RlA-8l+jf`GNHdgKK_eYjBIM)1phi zMuvzYAKdbQq^K4RdCk9fzNjcCZ*@xaA4qRrzqaq*&Fj}~+T7=@MF;EJB+GrD9$dfW z9l`x;Hw>)rQ<>FFD08}r5ov9HYyRfo{tX+~4g}^OIg{y4(`)4S)~#LFzdq>OKy#zg zErXjjuSbnrwrtq6(KEUiXVYBHxB>#fMYdB}Xt^;FZo`&->a*pc4TJ0Y#fN6vxc;Fs zgJ4U3{ki}%3^r{Yyl>N1n5$=aT|G;e2kY~j*7XMu8FN&HFKVm%2R1y=KWNPuqbj%4 zbg9#gG#zu_+CFK_2o*d?J=Z>9%*-m=rI^A$wdh^#E^w2#b>k;C%Cg!d*E_uB%a?xY z-K2A4=qz3o-cOTzclNBH#_9qOnL65L57uwX(-WlQ)tj~k4{qHu7;N3LK8RY0I`rU% z2iI@Dcinw$*aZqw(bDa-zE$P&4Jn(~Z(L8;*r3i6WmYC4$4o?92G?#L#4sHTiFe1w z4R9MMmlAB)vhljXU=yyvTQY4DHd4-JVErJ?y&Uhfc3{Jn^?jJs=B?`nw{Bj)C0Gk@ z^2+`{?e+Ap$J91#3Ggm`GK>uy$*+KE{;FiGzTUKEXEUsQ{W ziLb%N#7FpK*Kd}ucQ$szeQVV^c6?YnD1B|ZA3yK_&R8K@5Iuf;{iko=whrr|mpFTR zun*rqxV79D6(Q5v5+$(`MPsZivR{oKLAe_a4s7vU&kF*Sh0Vx-r{h$WFmBzzhV>f< zr}KJSjF{zn!+JU+Mz?jqIEIUhtSv-9Iq&XRd{MdYS%eK4X==)?EH}O9y%%M18SIdY zGd1HRgH?X>`Y^67^ssb=En6R4-}ep=gQ6SIAQ$Iybp30$^cxp210CbNS7sj;8L@LZ z*ZrFegKMm#zh92lvlNlUt!5OkiRJd5fq=P3#F0fy`(SX*7LT#MZ_|TzT=PVGA4A27su3Z;~r|rjbuQ0rFBus0N-kV?BC)aZCgPZ!+Th|p7!_OyAJv}>;XHL_ucXiFPx*@ zc58s1Hf;2+3T`XU?Jk!4{(-d*YzeMu@7U)33>qwB?dEXW^bR>HW^Fj}`)&vov&GGz z=&yFxcJVxu@vl~Nm|L@xflX`srX7UUNFWy_7h)#PeOC5Qo8B97FP644Yv@#*`v@6^ zeuHP&EK)w}d9&XLe}8i6Uw-YX{_ie6{K|b_D4cBl{yXBon0oAiql59rKm3gk%zN(Y z?vJHD{l&$}zy8THZ~fi>eDiHrw7;|A!GE~7`F(dyyyw9OyT5z;sYkx~sr!EUGq0Rq z`r#k{#{2&66OC`I`PTVazxQ{4-|>lmx%=}Y|LGee3+8P9_?55T(RP3L*;Ds?@Vnmj zgTKD+<+?q8x#YdAEB@ju8!rFQzW=@8&+q-*`d@nc$^ZB}&$iz8k1K;mmi@u6{nvNY z=bwG{!3Ub&^NSxlv?uvL1_x4q+H%$Qn}&b+Bky|efBC@FuRXM|W%ka*bJuiy0!_FDn{cuwopn-CxS2lI^C{8C&Muk<<-V=ti&BQc)$=VbgL@VCHgV!~dTVI(GL z*6W}`1PGd65Mq%DBwrY1z8lL~izX$ptmNOOxs)iCa&dCPFfddrDyasDcpgZ4bDsX} zh(h}SI17!LAltC^7v+rDq7u@!0_6)W0g~Q7#%rBZpx+9O!8enEZu|aGhN7!AH z<5EMoOvn)~t4WwOgv*5-;qsb<87Sgj`-re8`TjIl^NUtRdJomV55>m4e;@1zw^28R zZH9|mtkq=c7LwBWC(A-(06AKPj{-2&c7LyFtyMxfKolgJUsQ}1VmPrObj$=-DzkEM z*1=G7iDpoHaePGRfC;Wph8~k)g-X-&h8lHl3o}?VQC4kgKT(=ffn0f2Bf`Y2o8Xj(p_LC)DI-QIo?Q~z;+X#-38ihgF4u) z1KwoZ4?1Xrhe102P3#HKSsM&!rUd}8LTa@c>b#Vi${d7k#qM_P%zyqP()^r;r6o}% zynlbeb9Ck=B%E%G2<7=G<#|U~i}GBQ@>~^VZ&*5g(Uo1pEy(DG0S@2^sr_Q!Jvzl)c9JMundcZ03r+beg(M1ODP_^IdxeEN zj4)N^yocO-0UA+g)C9X-*~C6h-n~ZJtk9?lRtdgfy5#l|l{^Mu3`aoCCP%N3{skBE zGz$-!=x*8MX(QSyiZ(x|ryLa9Opf-E^N=JlFj>(|baY`yhTN4@x^D(Z66!R;s(KI` zQgxT9mMK<0Cz--&fD(m7DL1@qM4=9outvxhvYe3lMYCI~1sA7{1%&0Zt?yGvyY6+~oWj1(j2tF-%-B*^$ojt(LPJJ-xMxx&WF@#;5=dRl5j0adXYAqbG$myKV)LLe8&siPrl6|%gg71o%(O>= zBLF%Ux?qC$2&qs*qGI;}knEi<_MSm1yT{b~o)kq&iqQQG5R@e0t%3&t3{65UHbULA z7c^>uS)mg)R_L^iJqx;EgF^bRv~UnwV1n6pP^S$FS(CV@kDxRQt(1Gn1hYp$)=;uS zTKC9MK(ZTXg;FM%Z3VU2pitHXdxUyS@E)OF6U^p7c^eekV}dEU;!Ig#QD%)TuXJXuXqmVEzY3m2XsHRVQXj*z6f2X<03w!=Z4bl3y8-M~=%5L% z78*0bl`_MAV_K_))F)vlt9jg*%W9!v6I>}ILt6$;B} ziZG!k7n!Z!$FaVj5O0i_R(a#kW5Ec`;9>;=_Q}}&BR|hl)Idz%6v89-)|UaXX2Lh2KV_!-o236JBh3gZ|`!1`t04; z{Sk%w0i2`IVVeL8Ej?`ARthC4*5+4eu@PdG(BO1}s;^4GN_Eg6Mo{Ry30BE`4!Pvv z?DSWmHUOg#%9`LRmHoPnt*r8SB1A>kON;Dm7#5af6keI7pQPP@Em5H&K#4*}Owd$n zNo|1#LMlpZQVAV^!oq_lOI3-IATqyIC2Pz^JD|z{NW#_poS7(TDG>J-jhqIj;GnP} z;^OE;GYr_ODfB!5Lm_MMD};{NSgz*hvg;-yXUcRwbujaDRH7K5qMG)Nd}c(!ZKmE? zp`r<{5ZY^FkAN-!A$`bgTINcuaTwQaw$y>FCl)Z~> z+} zwNxuaB_pj-tA3*MCaJ1c63ovv$qDY#5Ky#qAvaz_3R(0tKc_y!PfF`W zTQ!-xY}Q%1eD=;|w0A{V)HblC*1)!*`WdXsl|s9@A_!Kr=Ih2}@7~QslqOLd%X%&I zyT$x8K&;hH+259#_mr9Ul$rNPa?8A@%)F<}yr;~(s_Tl4ou@7nvisQg2xS50dSbrM z1Xl~4GQoRRW%CkA;Vsix5}+;Bf4mks`eE}i9Q4{#I}xskAz|2;{e{fvQ<=N)mNrUYpRk2 zdqCC+^+-V5Q>&Ej@|HVh$YDCd@tKZr+@>RDmgnxWJa;=jn3dyD!@`_AaxgBl!Y;SM zF1w)#3wJ$O`Lzx*Jy3yRqnKXDi^;55?K3*+t(08LwlyZhY9XuCmC9@PW>yO&P2Q^J zR>^x^$(4+Ekzki+Rb>v7bQp-42dE~atBly~H%Z+>#{ii{CG%0@Er%*=>ZBG~Qz2s- z0piziXi1`NQk89KtIaZ4CN(r0235r@B)S(cT2~-v=&HDhZo8watcG?Z_5yLQV`L0` zG7MMJDeVYQqbHo8X-=8usS;8BeaLvVsw5SV1{hU@0zj*y?1(~b00}}}fK4D^ey*W( z(+nVzPypEVl|l;u5`-Lw+K=ZETtx}Bn_!iV5o?Y%z)n=Q$f^}nnQED+Y}KlIzNnG_ zB?@VlJ9FiJZo)_%GKP7NkgIp?gAS1?xQ6N)21;yLS@TS9zoA+oGzwU;6*^!NvRuv2 zHIIa{d3wrJRSFq|YCC{JgoaFTrO+-L%hmiG+il$aY$|1m)bM#by)cZpI9?T0kJp}g zNW@{oV8tHLDI08pxZPw}(F-crU}Xs%5HA7Z-c2LIITKzqA}nULyy*$zZ6W4Vf(l~( zE|fOG>;jN2IxD2&YfSJZN*X}3LdW4sBa3<7WTbxbWL`lq6w}L+G~PY zEl~#nP1c|O%*ZG~TSisa=puv4jC-9`GiZ{cQZ6>UdxScGnfpehaS>59gWUY0jjJk! zUO-gVJ%n`ARv=dWfUUPeg8&*;z4uQiD0JQ?a5cYZQ4xW1we?#>f}=pKHg{5Wm5~q@+O4wRoY0nQJnT}4XOK=tf^e7iq$VFVl(%MC={4r&5qDy zlY}gnqXB=CN}CYY_(QNMK;5m zRBO2kn!%KmGz740QQMfGQ=if@fUUAZqU3A_SMzg(y0MipRkoF>YR)p%^gvL9m-t8x zworuzff)?eR?5s-4j8JMqBWZ&V*-|{N;FZ(_%+-LORe-fr(H!$%Qkl}A@hq?KSc~( zN2t#P--OC64Xo%rh7lLXD@oY$ic&2gRst~OZ#R-;xv8NO=z@InE+30Cirv!1s(4JOm&*SMzg} z3%FYd%;pK>+;sgl?ZMm9DLy%4smfNABcjjHZGKa_VQBUkx=+3-oeX~rpdMV!&xxcP zRRC#)wwYiRl@zDu{#k;{90v>wbK+ps1`mQ}&`5@)B|yEm+3wL3Ha{od5O=$Pdhe69 z2}GR%sDMxxVB1w8u_i&NcRGQ9`MDx=qY6SO)Wq;xW166(00>)I!D9e@@&w3cs_B?S zS)=DFdW}h{aw1aOVUv^S}Jq6*j9awkj+r@II*Q# zF67FueVo{GHcGV%^r~irg;}c7>y$POs5-S3WDU?PCYC^0V{jlg99qoW(iU1Z15HAu zo{Bz%)b-#cbO>MoijOF8)ZQdU6gUQ8AICxCHYk*$A0)j`9p_&{5Yh}4MnVe#7{x{u z$k?0shyvRHh=hi0d~8I4-S#FvqCjAl%qxXd2g8Zt%+J}jL{}4NAQYBL;@*2kgm(iB z?m|Tq%m#2B0O(~x<0iOD=&T85g)W%jG9g$&nQyvUIq!;c-m1!pSd?TCcU!qC zDv4w(w^A9Fni5v60a=}O3q1}byoVY`6tFhbE%ZFVS?-hG$QU78*y^%$re@mvqGm$2 zlBKOzrHUcP{`MFv)bGHvLOJxN{0c=A^wK4Gu z*!)$7qPA8xvK#_Q9ify8p0X)I=gKJxCXG06!mdZ`ELD}zq(r9|7r3pVwI-rF0oybR zNe>7rR4~D;P$<68ej9rdWSLe8NJ`WM&K& zOQZ@}f0q?fVW?Hv^Cp-L%b4yZx=#btMre--_B;JA@g%m>82Bqa|QJR){QEZ z14t0s2G|6{%qAQJ9iL86=#)(mvIW*`*QJJPnUE`R*@!}Un;_&0TxQ;+Jz^7tT!G6* z6dJb)Lbkw~<6p*5Ef;bHE;j}C*#se1;Br&oA)6rN3S4dqJZTezY=Kp~Fs&pF0j5Vk zPoRj`G&c$yv@UcUbk+u;FhAEMF25!a%B}||3JWW@o`DJ<254uUC4{|#EuaN9s8{ON zn4meQaMlLTgJ?!IYBMM>!K_wKwk}muvH_UegH^pk<3PgOmKsr@&*bhE+71vO8&RNO z;~2VwhOP^MZQBOZ~45+b(evIgoCaKCa zQ&fJ5Q9xBws(@wy-3T2t49tNz*;MVJPkCBw9-(tKk7D(6^-y>}K(h!f4B6FQ?6n!f zWkQx+mCqn09D~fu@s>(%*Zf?e3%P4CC262jNabR}LMNsZ!d%m`9wkB)yh2d@1X79T z0o#id3V9MTKUcWpQtRBXOG|p`LcD5w%caiXFz`KUAfYB;=2rQ+2~(D%&~6j#5!wUP zWeztaGKea0$cFl%| zv2)q&%!Eosa3Pgz2^9(e5`-24Gjm8ALbK>~9J4$+1BfSE;)6x=ln_fUsrIBL>E{1Em8q(zOlYqO)^y-9RH`ZTGu3Y%)>>Xw^9AxpeXOOb(u<0b zLd*cAfGx91%c4_eL#IH_-h6gMfj)cVjVNGCs+wdM!X(X237VhNdx5)MK#k@VUBuS< z4OLBx?63@kGJx%k3M~QPETnd~2@3Vv1R)7NbN@{nLbG0KVq}@Ycd211N61pWN&A|I z%$BO==xBKvTRCai*5uV{OBAwHRaz${9NtZdma3+${C`@aeG{l>8}mHP0B2BeKxI&{ zkj>Cr&Y(s#KW9_AvHDpiWHYQRXQ-)!7AWxxLN>#ya)v71%BOSzrcWp!o1%jY4Vs|Y z-q>bi9|!HRL7_t?Xf|rbZ0u3c2^$o8-2_(%!Bl)TUu?EPp$-#VA=GJOGoYn5D3mwB z6+(kHHnJkvP0T?{AY>OE*&_sxo7k+-1ruB$7uY=TpVLL7~K{JzGY-2k? zOKebRzyzZkIopV_tK+QDK1(1ZO&T#N!~C3TR0q|R1zo4Bs=^`JvYO1i}% zKX!{9*$i9aktSCrI<$}&q5!Vu=fu=aD-bq$j|r|4l2Q=ZV7o+KCA0?9Q?&a<8AVKC zsbREIsLe7;ilJpxv;Q}n9L7QdD0#!6oT2J<7HRDWP+pPSJUv3nXWGOuuv98L=aLk# zoiw|h;Nt+=83sLXgGJD&4ITm=vB6`Yb2iwFBD7UvN-FP}WCP-~F^}Gb+DtIJ5G2*r zaIdP%AfR0&VHrHlA*2eR?3A#?7fGZMQjnORYXmj2nwY8xEijVa<8s$%{v1?lA2tz$ z!t#>)2_H7mD_u1aBMGtjx#EVnvt{%ODK{Uk=mM#_1Vj31V}G281AyM22iXiOToE-~ zM-Z}g74I=ctXu<9E^@fcqEIVXeOC?H7sz3qXVnD8C5c0&z`Bq0C+nYkYEfC+H*-fz zRb{iv)db)yg+zr?n-#5}Q|dy(ava!IQU{JlAyt0{XKbm=ku9}!4HG9eoMoFOg{}W|Y*w}ar!TQTd zPRu3~H>o698XN76-v&`D|9-t;I+nMR8ci(!B&vxN?~+T&%^{s>CQw{DFDB*^gFbS} zv`ifoFlRcAo4M0zjY^w$8HHc>RyuHAz4b$H4IsF@4ql2-k#8}a>a3_O z5l$5P)@u!e`SYOfgy9usPU6%0E|fQSR;K04AAYN?`E_r-W8Q}#{DnF%{uUdhGT!zJ zu|@Ml+S|CgaTPhQB)w%3DM2KqPAOM48lIka_2P?Iy#4bJ$2>8?ArdtFJnx#vh>f>A z^%66E9h8vfNQa zM{3!R)rj}Jk4w9Y=7mkR^jajibFtTYX}Jo&$n7QN+qvO0FNaUoq?k{{<%=ha<8)>LfP6+-p# z8$o>}#MZS`(x$xlouodj)N8K@Q@`jqCA>P#qwA9Kyd%0HB#M8YnBP~n_qc3-T+UX1 zjBp&e;=58eK$whg^Irga{`a`X{F7Yc{{Q5f@MkmNC;jWV*7+H(v;0+D>-~*fQ~o1d zeSd^&gMW}~qyK%bP5v3Kmw0twgGGH3M?hnXbF&j>x(;=ol^}78zetMmZ{-^E^-^=( zzn5#m-^exTe}-$FKg@NO|23}lz8*@X{8za8A(Q02{$FwH`Tw13%>OCZxZg;7B>XG6 zCjEAALr`(|G>4uPxIDjqyJ8>P5wu?UgEFi zI@{mQ^-}-KT+{wbT<7>d;5yg;2d?w{xxCcb?BB%oGJhG@%l*w<-{L>RwZ%Wk^{xJ2 zah>n~3)d_BD;O4A{SR>c1^*tdZ}WeZ>y`dvjGnu5JDkT;JjU7T4?jKjQjM|0LIi{{P~7gFlx~2E5C^iR+F2GOq3Z zX0D6;FLJ%f|2o%q`>$|a>`!uikN>Y+-|Nq(zrD|YKi3Ywm+Slehq&JCe~Ie{{1>=( z`hUjtgZ^t=Z}Ah%H9q8D$u;ADfa|UPDy|>)w{X49|035e|F^i_?jPp*5&v(we$@Xd z*Cjp!q<4q^Zmu8m@8tS%{{gN`{T*EI^q=SYi~jF%y(=_``m1C954iXIvs`0--E6h= z)m#()tz47-eO&AOU*$T>-@~=u|0Y*jnky~MwZWguz~1Og=ez!m8t466xyJluT;u*a zt_gpTYtny&Yn}fr*IE8=a;^9OfNRP>%GLM(nrnmqKe;ygbxdHIywn%rmYj96@p5iI z+jxU!HH{zS8Vl=?x;*CJsaXF$#roU0#+|{p#Qi5s+Hab)F{SxG;+pU;a83Fxb0kg& z*IE8buJ!&_t||W+uD*YOYlHunTpRs=;@af5&Xpy1aGmWh<9eyTiEG+_jO!eKl+^zt_!y*e-AOe}U%jp^aY=yHt34 zJQ+(rNZ^m*AD>0$JU1qDeJq*&HFuMWrPD=s(-3P-e~lZ%wkg(@KIBp^i7ie4Avbx6 zGCS6rKJ0ETjjc)lDL1N8d~Ph4KFZCt^w#*iSYP`4+evKPb&Rb*Ky!zjuicb^M_{toirpB?ko58Y^#_xJ_2Seh20bgN# zh?^W9uI|4jQt8LJk!*D*66y3Fck`n}b9yf~(r4XYCR&V1d_sBtD$$z$ZBic6&B;V( z`Xz2YrCf#Jx|K3`*9+lzJ$_$RSeE12Gh;l7;b-;*p|MM8$6&bLNr+$b>UP2nnE!5+Fu~36KzwU;-pu1B3tymUIZYkVtOi!bMTg zQj3==C{?Id(PE_*TU2bV(w0`+V(W#k_4}$-Tdg;2wYAo^+E456eb+ww%$dnV`#j(O zpNE;*>$2Bgd+oK?zMjKQ>pTto!@J8!-+;Ps#hQ6;e991ZO&^Mkz-|1fsBOk>ErWv81BOOGX4NUii{;tzAtk8#=XXfaTIo#$c3x_gvde+2{rPJlp zL!)%MqB1lA>6Mf@rzW&Xr{{Kswjq6(_^LgjqdGnBaOnF;iw+A;giavsLmUq*d@}S; zjbHq1$b|C3Q~h!%Q>T}_9U6x8BJwZ&Aa|8cW0N@dVgORf+FUcYR|6|Xo4J>309#bK z*8pHg3tW(I=I#R^!d4fUxpx7OP;$|9Gxs|Hr1-UEX6}Oku40*W3(VXn0qiC4`D!!w zbpZ6&K&-~hod)%9Bc*<&X{3)v#b1L_hrXFU0m)w@nRRE7Kbcv#hJI%?dyKpE)|;_G%`hkg>|Pwvovg?8bWmK*w!5xUw*`$AuK(ix$>I{k5G z=w>Hvg}&;fvyJqjsQha{_?`^%C&PC#^ca4NfcE{u2)%?fjph5L&j^$NnRgz((yQ?G zOXhlPB!ALZ0WODKhyF8t9g^oDnf2Wuf2^$gL*wu(wSLf$nqC2xtYeu*fV}CoXxT@= z;a!-13zEM^($^ATpBNQGcQQ9-*l}WGhQtYOx~L86y490G|32-2{~sK?j^`63(;4Fd zK1uKq&smr-Z37OI2X#B}xPOef@=9RBccOeWq!Gr)oRUlYy+C0;)rPNXe9q?A&Er5m z$zqJL>mVi{iTn;E79cUstnu`MuoLiZa&Y!?8xqF&9;hE!;LWCk856DsWc@=zWj4Lp z7=IV(vu%38!-Psr79%;b?}Z@68Tby8d31_%@KMKvb*xk2PJm8TFxdC2iYOcg;oKyJ z<@DTG2Z~v@iFUlq%c3L4@O6royUbgR1ybZCz|RuC+)ITb7*vfH6wD3~;gaWN!aKZo zV>LI)vp4((!JWbmF#jC|k{e*bdjzlWvc~|N_@M$xjjo2Qoo9pm1@G4;SiDw$BvJFjr8T?K4HQG%Q?1v#*%cEK&+sRJ&R6zk@Y}=ytQ> ze+;lFcZ*5oA_oAAcDD$9if3=pzp3o)<_s7HVE)HwGV`F>J`TF~K)N`}ouXZI19E%H zLI0ZMj*fu-g9+az(xbBgXAwT2=-U7X3EwK(MfU;DcENlv(yp;_{xqogD$BpaTpmRE zO90O=0Q^-Y?@quYnBRt<0Gt{$n+<%b}k2sWlK@69*HZUnp^aQ;*a=!<#{8xv#lkmc{L9N~Lzo(PAoB1{z0URW5FO$2FoX=B?<5rJlR&yxK6= z0ak{I6O>^bc$`V|sG{B%Y^^7iVKU((RHIjvLjh97F2S-2O2Te|YdtiK=G7|mA}g`m zL;|ri(vc(ykK0_T9G&;MWUMja*KjEB&Dmoh!wBT#I~c&;Po_5(qN~x*yz7k+-JXMj zx5*dsfiCG5%s#oe$om|=(wp)1Cknf0B!7y}2AlV~?Z9R;-W!1{$V#r_GLn8HVUOiz z3ll-3UYkSL_s3PkNKZzb1Utjwi#9u92BZ%JuJ!auzqErSXek0Au3d6)QycO%H1#LJ* zP(iQ;!CJx9nvVW58FiDnsaf|mq|G6!i+mj}Fa9<}b&)3ki@yy~UF0u-#osbj7ny{a zi}+h0v5N!}yGT}I7s>jMx=6{x(9`_8pB=-@c}4*^&M|Uc#2nH5hY)g>j6?dLe)bk4 zz@RO%TEZzbUOJZF|Rz&z~T!A#GKX6Xh%qC>#*vRQfnbM8aP8Vq_~GfPX6PoQC* z(`IQUATFST*`Bw}(&d2uM9$%!cg@nZfI1QWgEKwvo6{?UV?9P$12CYES7VKsVqMToMTjh;47>BE2)6#{DVJnkv|A3)a=YV(A>rT+%>J3>94J>JqkkHNHbJfN+f z7GLRj`0BiK0d4af_8D2fhZ9`@5Ai?X8Oq;`V4G=GBSBXW_P~p4G|+2eNtXdAFMzMC zJbZnEPx>Y1Q2rLA?^0W7>`CcYA?MY=a=b|Y5*+&`B)&`FYIy8XBv?TDHD;!D48V^` zxfbsG5)vZd%W&U6Y2bReFT0jdZh-r;YYDIi?)xFwDp}}_X1)=)7f{}J@a4ZAUm0dP zXLw&lGVMoMuXydEqGsS%K+VX072j&%L?<%>rvYcZkFQ!drT>U$8h^v4{~tc<9CW5R zaC83$xE+5l5>&wdvCn56)xamd4C{v)F#MU;uQcHITNVR~hUWB#{P|YqnTA1M@(=SDSmOaS63F&Xv}y=2&j^2! zbpZe_YW<`A#a6ur&hSsSxP2y+GyP>&yQYlsS6B>ujC%gF{FT-YQYd34{5!3m0bq;z=lOS8 zr!+9%zuS5a06Uex+JBw(p{6YH@3At`0;|$NS?=F&jnqJ`|Dcr*K%}kmAGRU@q?`-= zN30SJtnnYU76Fh`pgR9Cs{w%2w9)^twNV32{^M4U2AcgRtV=bp(f_#h1r4V# zpxytZbt3>Nw9|jex*dS1)8&8G`lbdp`Jb~M0MKZl3Y+~eS~`6AxA|YQegeuWR(q%a z4eNOTBJC>wY3p?WYe~7z|F-pK0PM5=z5aKte*usx+~I%UGSLyF(1ZRDtV{qR;2!@+ zrDti%y?(E_Bpb2-u=Q-P#Y36KL>NS}OoZhi&vNu+{+hAt@Vt)mBVX zT6{HD699G@|3=?RYZHKX2(b)L(8UDn;2vcuPFeG9-cO55ezYCQsAD}gWhwp&kVwyS+RtzQASjg;$syR26L z{DQz<-)`$&&32;?ogBbhq}<}$W2Iwi5`t6uZ}si7q5#AOclh>OvjAK`%00f@EIotq zANC!zu(7K4{J-ftWIX|ZGZz27zQfjRc`7krIoDOm1@*7a9JXwLv|0`cP8>s zU6-(*5>!P~Zs3_jZr0ds5Jo{)<)pxPsgz(_ZUh|RKVVdfiiAbTVPtV>l?O-i&-4U7 z2Ta~Ne5G&1*G^yqhlBjF0(XQK;a7}xrxCh9r|UkR zfb}2q4CQZTu-$9jg@jDJJ8>v>4}dqo73}i*ES@IF1bvein=*1z^Db!V|BJ68cwQ(L zynRBSlMVxei7p+9TArsszKjkM@;UXjSlro6H; zcoO6VXsEzgpz?l7?`F>nOaYj6KE6IgG5#fk$q7)01!g7y$Qaf~L3FdQt-(Z-sN18T5Ort>1vM zm288(HP-K;m;gh(dz@)-Fw=X=auz3H@3Thy)YCH3xtqw%L~m=>F39;AM5OhYL-|{g zcD`x7fdVWnYtm+8sSyH}p)RcwOO1K}KO|)#mKr+%JV9U?mKxUr_&tFdEH!Qcz$&J# z#8Trh02(aqLM(wF)|Ag-34Dg8eBPXHJqm!)Gp*i4+Yg7Rypj0I8jr8Vpry?)hw?X^ zmTg+^K|?Ni((<6;KLPA#(W9Xu)#Z4db~ZHB%cQh%(2%7GgUg^ko|GBg~gDaBX} z6#@79&+fCwqH&p$8>ykljE?7ts zW*x)VZgk1uHdECn9=l~wjDt=^jr7yV^e8e7yDZ3`?ZY~qL)&3^OP{_MGOXJd;^hyH z?ZbL3=Ssw|-qE3ZkWcV^1)+O&dUJ8;KAqlD5&Di!Z>c3j>8BKw9B{3$lGTSEG}OZGZQD29By`$wIjrvS6|kD)@qgRO_WbbO_U@D)bb^BfBD zC)0C#Xb^sX3j2Ew;(dllbAjc#(-#_{(|4tXw4Zyvo?&<|gbaHMGxT8!37+dY?@LI~ z`GXN$%Nb*ww@1U10H0}`ce{q8fX~1p957ojScJg#9RL#YCSzA8a1`>hj^k@8;-mk2 zo}v7;g4?_nufIs9OEC;O`$F3>46?sgq7uQ&a8ZO~qU`5fj=N{+e(a_kf`s7}LH?{B zeqQJn{7wOSc$pF6Zov6W&&mjW4R~(13_m~D@UmA(H9fAh59i-t{xKMHs)GDkn^W${ z%bBg@T?v+)IdOS8b4R;m_>J@fV0aUmN6ZQGr)@-BrxCVJzXHn$mrf(jF9^K?Ubg>; z@)nmo+(dW_%tOcFy1?8Zf1b;oAv&FXE>JU-PLr4}v!ssaF+Hm$Gzh$ums@_y@N)UA z>+7V^+?8Mu{7#jg$=PeZ&nT%yZgXZD1=zc~ zjrVcNHZy%;8e6?=2h$g%v1^xcyfEjcJp~QRnF(IR{1;hft$;>hGCl>y!Gp1t4@BWSB-)sGdJyCyaX!w(cj34EF67+9#GjG4 zjfp5&4l~h%#4#q?koyD@##!0uIxR@xKqWl59Hsm=jgDyK-w=skJ-F0{$;?9p!raDJ zhX^$|G&J%b1^?qhul4kn;Z=bvay@d!WFH&yXtEXuQ#jCo)hdN1lEzZfKEP5WF9q90 zRG6#Yw;`TztdO&dCy}|pOCEhV3}wa=%eR1tY~J~GYpISe<*3t`a66ha<8b!<&^Er# ziKk{8f$xHp$K5>0L@$HM%(};sHh-)RB5s83Mu!FFeplpqz`P-5{zTCS4?z$h{FpkZ zxDGI{Y?(h(^wKPN2jM3a8~`l$5uWkZ?tr{k18@Nhx#lUA|NDUDSmD1E{|$h-e_{U0 z%eWV50xXXAKVCXJ8nP(NhJ4Xm1#!{0P`vozbCNw;kK#&5e?^WuqLYW(e)*c$OTRq; znA0TlbuVX1(LV#0D*$hJ<>ai%!cAJ{e^rW)eh=`4gkP4El&BHJ-6X;(vOB_YGuMEDP)&(zOHk$&CZi0(6IH5#C70f`HJ?0QD{Jv78?NR@!cG6`G6vU@OOv4^Vr2RxNjA~%4O|A)737539-0q2wOwoOpCC?F{R z3&0kk;oa=(086mxvI$g`j8EF|X4@bik?{}+qY?Mq68Jx{34s?nNzgg=0X8OlcN|*c z)PNDebwg^x(`0>gU{;PuM#&rCGS_&yXg71DXRnc)Mn=IuK}p|lo(Ux-JIyyzrQ zbD!nc%lI>e|aP1Qq$Lg7ILT~ROQ?aQ*Qw^d|flWscX8Ra$ zuN^x88wFgI4jZqUc^imonZt1)`*MO`;1@e7PNmRN0a60HfpqO8(0uC3U%@L7mwmSq zcam8}h{NC($0fyte}O;a^?^IU-yp*Xe1PvfUM?RWf)03ICuN5G5|&N>3!H;w9t$Yp zGSD19BJOek=q_qXRv-lBVP&Y9S@#h=Y?-uCq#G?M1L3j^W|?ykqNDqPyqe9sDueUt z=!1Z7Abddvdyf&GgtDuVxD6k(DIv~^ z$b@!AK_zMv94Z|sJ8K#+0nRH*8i7uKQ>! zbd=Ar9-w9J&q$jA`lW#R2!N^R;bGI%wH0(m!~9;x;4$W^Fi=J~g701?NO&WI7hKN+ zs{EHZI5l=SIQXK44fDN>A)15JqBzG&*bLRg%s^T}WZbDaWOSMis&0j!l&ZIeXqcnb zZIIxGUv|N4wKlseL0jpex4B^Ee>@ILE4~fb7=H+jl3}HGVhPD_K@~ihfbTrsC@wjU z4Ca`@E+-x{n5~$@!zD8;gfeN0vj?ko=iLeOok6Y~?+juNqa+PB3qB*WAKN3Ikr-^0 zoB@h?p*zook|$>d39ARuiOR~EUMozh3tgnr((s=j#E4fWjclhEl0PPorByCt`geoi zuT12-OUhRzT|vUQL5vqUS2I0cN&E`a1%phuk&#Dd3Jk$l9-l)fxt+9GZsW{y8RvW< zs4A2XW)*TCWrm8u3~H(hb6f_TD+Vn433;j%o@Ynq{J}gvD&x_Sxj^z(m7RcdnO!2Z zj0ZC2rolXuF+f3IH*Xt!g8EjKi4C3{%mX=S{!?ns?d_6ND8zT0XD9Gxjy#@ln}<|m z-tSoavC*#PJ2qMd%0Xj=@KZ3A{ew*39nHfYW8S|Ayl&^CrrnC>uxo+k#gX`J+moOZ>Z|rBSCc{g=_QY~_$>oW?T6teeSzQ8a{_ zMvkLzNx&!?LSKu%16Tsa6ro4=V z8Ux5w$*=CfeP>87BGs(Fp>sTpLd}XH*@dFibgW%_P;4d=O7i-ZK3wcwK=Gj8zU z!e4?SVaAv>4h*L#GYq8hq{;>=XQk^jWXr z`#FUT6mlo|uRs)@J;pFTMxuNc5`)eIqY=)*PjNc-AOM*64d&ErEKsmU6hCuk;;Xy? z>?@eK7Ks=W++E+u#3>}UAYsh05Rc3M1n>cBpho7ENa&c~P>$t>3zp?Z93CsrRX}BV zj)KFDMETQ5$nX-5hyVObAWF}~I9zaeXiTE(nVF_P8>frlwebA06x4=9J`3ND1eLu6 z@b!QT(Dd=03}RVMn_$&Cmbo4VoX_!2ug-LV73hY#?vl|3-;8n}w_ysVE#7z0KLp*t zj0pL?mpqBN=*SA_qY!9grO9p^W`Pqy=VDCjKNs-+B$)q`tfo^T198Ev;9(a`!|+jJ zn=TgP|Mf1W=YKA%Gg9-zE|`L!i^E32%yTeC4vJ5+?8)s4p#9AjW1Y;tvMZV5mr>9S zTHw2C#lt6O)Wa}5@XJ00z0^6lOoo3;knzr*R{uBPJRZ6Revg!ES}kIvFy=D~ZblKl zFQ~b-Re}6`@CfHWNapc@sDi^}*y15Nn+!$)_nrf}vQLxENrhdJmxwNOp&39GZ6UI$ z*9+CHVQBx^kjPnKJFNdq!g{0uuuL|7K13!Pi;%;hhGyLsW*M0oxf?7p5{%5`ND%oY zU_MV}j>_cPEAm&svicd7$-yPxJ6p}v)D3c69p?@5TI1ZYz*90^nvVf+kAYpk5Iftu z#WZJv!?mIgaF4wBOnl{hMd;@z(Yfcn2r|@wPk@Nk*EaKQTN=HvPSVV$j-e|ihU@lSZ-^(iv2c=&CiTf=wkB|iXE3w>^N0y zaLxe5);s=4v?Gdb4MX;ijgzvi7s8n|# z@-?kgcYr=4fr~2WUVHZ3#9Qt;P-`{l!nh~Ss49F62(xb3RD9n*BJ!A)eZMUJqMozi zf4QJNID-59XZ3=c28b4ba1`Od{NE8=8b#OOi-#~aY~-JVQZZmsD{t@HJ|lk`5cwK` z_?SNzh>03;FwMxX0iswV_M{v6bwHFUgr~Ov_xAzgpOT4Hylh~v17hq}p!Xw@e=QOR zk)Scq1>~`~qc%+C$3F!t2k-D^=TlJNU_RE?r-2&2Hk&=fnD8NhoThAPs0l;PMMGVX zO>Z$Ki~*3lCYxgF$n9-TSXo)9be zEL=vEr!S-FAjk^p6M4r#f9Kyf&*d`QAziiBt~e|qH8zrJaGeXj2f2CKM_YtTSI)FF z%mGpFK2zR9;Lk_x-1L<$m=@X|hmG-f&_V^ag~SEN|A?p;e9AWpULo{yd_+}y4u>Ga ztZSwPtFq`7kt<;c@tCSC1_7KsWJn-hnANZY-SI(f!1=-+&4izeffr!A9}Nuxj2p5?aTDH(S1F2)zFQ zaP|11aMa+7b|aw2st9VSgQ*-JwX|cJr?=QR zm$2O>y}c*EIes$8X~#_24pz_mW&&;2-G&0jm^F9fM+IhuzJhJOcIYItMp}FAP`0*m z3U*zy?nW{+4Hc(Y3tfb*N!TJ+0_Htx(TELAU=%!;+9*V=p_$pL0IKhs1=rw8!$gDd=b^oG# z_#G4|>i$K1I4qG4oW=NENHY&W`I5eegk zz!o&ZC-GeX!|fwsf)M@-s9FAMoCUHI{2H)C903;39Vy_*lA8*n7~$Y$t82D*nUP8!2EOoXZ5%CaB*e=AEau@2u!?2EvT z4oiZkyvC?oi9G9jXR_(J}R=LXBa4<7$uo` z7J9}7oCiqHAU;gI^bEDxqFR7{NiV~rrm6?mCQVRKv_h#Y|8(3cwHUX~ZLOAtsiTz&fGXGe zHVJ?mrySCI;Jlr*#MFD!A9h0-M4EwXA>;;7zS&TD+Y^P-xYJqSCR z%N_RRn*BL8&vHu!29a(dpIKK-_BCXe_FN-%i9Ce%{2en~i9GGOT-~(0W)fS(r!h_ZZAE`30 zu^Jg9T)uFcl5cV(-=rn;`5NHoPDo_`i0lWPS{%@|c$cknK-x-4SH3W^1nAox>9;Fi z_#J%VJk-~`Lu)>V&_RojRYCJ+LU&qxuIgOIM#|DX(=B}}r5|yWIii)}!yD#(S~ef@ zFuyI2MnN{8@-V++y@MjuykH#?W?d~sJuL1LNgr>AqKB2b5y0|priU%wypQrsTf)sF z!aw$Vh@X{^qEyQkc^6aO(~fFSYt=rWou0Awg*Cfs-`!;YjTPYuxb(^2BxHC_GN6V1 z72tc`juk70#36T+K0slwJ7vGFMFq+JhQ-G~jFRgSjm&pMl9_Xt0%q1Cw96*{pDj7k z;6-}#FBb38m)%32zgk?rR+Y(G))SOtJ|n=Ni4dy(m$$l8EPqH)=2*P4D-{|NWRQvQ za&8{=$PBWC$oqiLCL9Q|l<;4cW4MPT@EYdOV4!d$oZurM=Vm~;x!L$CF99ly#95dc z$XurUbHGG^!JoLc>aKsJ9-*KPb0N_Hokq@AhDrG_shqH62jzstRSDlTWS*ibu^Hl} z-%SZJE=TSFER~q5D)CdmXIFr~I7KC zvh?7iB0hW`+${s8*WhD55ah}5TzX)buiQC|1iQESlOPX-*8?@iT-|}6!iyp25@Do- zcfrItt@(HmQw}9T_FSNxnjd_G1eb&A1tooeM*V>ndIH81b3Y;GR#v!;qUv_h3NI)t zd=bS7+Y7=L`7U6w!i&lZZvqx8yeQQSZ&{_L^hK2PTF_sZi`|-?K&q{v1xUD?{#F*1 z9n$?J8;`Fr953giZ07J#CSo7@3!h~(M}(y5rN6XLdfkJ}d{#(0{Zteqt#y`&h^zt3 zN5(+sj&NiLU_Lcw!_m6|OLL5s{P{0j0MkP%r%rN5i~FI5pvwepUn0XA5wquyz|DqJ z+zMW;U|}!{{t6op`MTQS{wKKO*C>quuYXJ!GzkpPXOpI8QM-_U?c31CPeZxAOuUc8 z*O(Z0u3>zW32t3I#Kd+aevCxl(i8Wd4xa(T&uIE&+o}u`(Gy_@8x*<5HFgG~t8#H?n z*;_*U!r*dApFs9*hrL^~Gpw0CAvqmqgR1|Npst+kmngGN175o6B_SCu)&hPVodsC|jVMmL@S_?jrYJO99Nj{Qle#_M*X-KoKotYn0 zI-Nk7($o)%h{zj&E2+bSA@0{iGtoulmfCj}ya@1O(jO8XquT+mh{GyEDZ_r5#XPNg z_AOwOsy`k20>(Udbomz9@`vf@l0VFjE`CbQm-8t^mmzV;o%tj)7dn{>6EYVjWLA*7 zDPL#i$xi0UIy0YH20nSY^9k9fJM7anJD+McXY^w~YdX*s4ts@W{~T*l(T{yD+2=d# z^EG>n?DPAvZzTIthkdDLZy@_p#g3*_{nD(vn(V8@9+4Ah3u*FIIujoT2ep#?E?2*Y znHrrk8Z~=Mh2R;|-RwUn`$mU-qh{Yk_Kp2&@DABGIqaJ>`xdfq5>?&Ohs^+bi^IM} zv+pANmVWG0$iCfS->%tjB>Q$3JF1Q@aS_?CaM-U9_Q+eX)a}f0mqS;Tk8y zHCq1NWWUBGpZUzXJITIxSR{ntCAQzIGw^Y4^TuJlh^uh(R|wrS?27`e-~-*}zF{(? zO1mgwyt8B8?v#DI7R5)t%{zwOtVHoKZ}VWk%&#-^H=NAh(3$y&xOva8dt8|htIXm? zhy|zy??afs8OD`&WG1R2UHUh}q)Q7Mgn(@V+5Rw0#`McH+aH8&G4H37OGOGb_RJ;! z9~J*MH2)u!*kyBpFz;s6Hft`D^z}~mC#AU0F?&#+=Zid}vj^oVx+w0;8e?XIK1}G* zy8urhoGoy8=jYW>CG{JbZ50-R;W{7b(6d;nqaL8xZ0a2f-U3)=Eth8> z2*aF|vla?h<6~ZyJsMMUk!0kvvKFwqvialc<8OF`%gRRVM~Z>7IHTYa=;!~1?8nPp zVO3Yv8{S}D_h<8VT!b$Kle+GAnWO>|%sOKxzQ3VN@|b4(hOkBc30U6SdQUdDco%bL zfw@#MRMo7*<7ya{v$+!y38RxqF%P+lDG;{lWP5Y?^#CFZ!6q9RZw{Ai-GJrz>-2D5 ziHz(AJcAZ|Yd9w)5uWGICj7_YKSeS5GuJDxwC$v>Q6#;HZ#rA5ZaGVxq)L5HmpVz6 znu}e>d6XI*UP-NH0~RfclolHRix!hb3$EEji7BE)^vfX245e7uqbrIHqn6@IguRS! z!Zu5X^TE6*PnItvZKlwa`PhNXy7koXxg4>}t6&qmJeNarM+TMH8a~W#Y@BkW}Cw!=(a;0E>zLsZ9JTU@`Fr!=*xFFlCkseJFN` zeh#oatMJkA|7k%5uK+AI{$Jsb&cjql?D}tI*Ij_ct{ySSoDZN;^j;vvDxVjts7q^x ziCXaH8283`&4%yUtFIQJm-%?6Xgj6{MGV89R zfj<^>WCk>m4)(ERiCzp?>iUV$XHjp<3;y9Fh8BJZqUe9Gt-lH&^gCN&2`KwrFe`M( z1+&6$yI`IK=|ctjfv8E7nss+k%_@1&ATkCqN7SrR_fV<;i<>bWSp+lI3a5Mgle=aHNL9VXjf{yrq$>a`Yb-eP(W*4F(O#VE0gj7 z!(Jrh0fuwmX--_?QmviwV)MVzgsXxsm}=!h3#~TqA8_x;hUIC?7Qj;fJ#m6j@GpAF zFxS0-l3^H!g9YL@>Od`cjyG=u3JaWx?>xSaLX1BefxxW$Eo;3m_j=GHr=Y(We_yUF z_e{{F(|sjZqH8x`iEB6KN_2e{umrYSav5Et{Qr-ov2GK2(S3j=uzgkdqv2V0r#v9? zqI&_ahqmUeLZ9^stX4s*KAStJa3hGBRC~^9prX$J>>%&byoWL4Q};->Bay!V{rxl& z+E%nBZwriNus?`?Em8kvB-9hFst>DY2k~w_oiCqfRLA15Q7{$7`LA&ektIv0z%}w7 zAG-rylSfPCh?TC*V`$2euyma~xU4$nUdd1<;pv7vhNm(KP1g&5nOId71xa9 zO?b66ebGp+YSC_#U9yD=^yQhY_{q6N0c<+;Y{S+(KId#?1@L_xiJS5Qe91zd7dlFt zpQ3f^{>C=HbELHS-(lBvvjvtmA9cRn=68*hKwAx1YV`GyGIGqSu-o`<$v^8NRA(!t z-aT??;Rp~n08#ixxncA$!Mi6rkSN~`IoC4rG7`5ikq*+=nYakKzJr8}LJQDxfHAV= zC7gEF03RmaecCze1!UvH$L9a$4Z~LEX^QJZ_VeoR98P9eh!R*-Lkf&fz*)SO8q3qG(Yj|3^EdGS1dOK?$ zICxWuH}tgvXU|o2uwk`kdlDkex=eH+^Zt>MZ$W+OnD>ulBb`+V{d4hg&XRv1jbog} zDr$mU@%V)zh-n`N5dyJ+IufRp3uSVUd;+*I@d;NfcqxM+Nu~tvB<3K#Uk-^)(;>&M zh-?_6PpK{1E+%+sVh<8>H{ytkm4svDSO+gZMUD<6-nThmH6if+h7hWeU@0^w8GBu@ z?*6tGauHD98RE#W5Fa_1!LwX6Zx;T;Jau}UHHsTK#_(^j>r`6yHh-lYI_2<{bwIMu z7{h-|j&jXWt~lfg@p8p6?*(#9mK`fw&ScrH%8}jUDItjzAChT`Y)j?HF7i}`|AhFd zf>#lwL#3W#mB4^IC=@v zYK#>)%p>;#RMUr#xnva25EcS8##|%E@8R_TCTe=M(A|gkXB`G@7e2h3*1~eWH0lRC z1WfNBc=f1X0G!1=>6g(D%Rh=E=B%A*gMuYQ*^37`4QIT=t{Gl9iamve=JDTM~=`TF{HqRE2q1Y|Ih4L3G`F&dc;-R+u z9W1R{$uMiLQV>OG`AZVzFOjP##;BR7m3e4{nZsuxk>Kg58kN4G(sJ=vrB%P$FSXr4 zZQdLexgDCw-qD-lnBj$;YE}ekhG~xW7kUx;YJn{O6*xc7#F@ZcjD#_kEn*=dO~aUm zrjSz*i7OMy!miIAD}9_r+kIYjlwu&vx?8AA=4iwhBT@N3b6>}{EKXH$5G(x?LJ%B!?HT#7e}kaDu^QD$fb z+X1S&M;?Y#t030YtmAyS@cT&f2_=*!&nNu>usok6#Wo7#TFU#W0^W^cY*;DZE9Kry<;%~w9zbLV@{982XUHV)Zos0xqN@il zxRN#N9%8md=@A}uNtQ+F+$@cZ2P{6ZSRVe5R0BTB#;8u`+<%I9@7u;bgqNoC?bnF? z*0%^QOXusaWo}R{imC;)YzD}E#?`j^h_Z5@k$%DIFbX%IDy$7*(suyZ<)YsTc#pt3 z!jtQMU~hA{xLEJQF&$qOa?-}~Ng3*)^g7)S%V!wgwXu{q4e$q!MC`|Q!GDIg%00sD zK57`a1mAglwr0YWpyhPSwZiPZLc5tXK37xx73Mp@Hc@#QzFi>uQ40``2~g#Bz=+=s?@+u{kp|2JFAO}53~pv8#K%e~X=A3?kkcpTq( zd{U@514bTkt=K}ITM}DHe0to2s?>c#TWnNa`~uWh?6FaG@h<^>kri$`gV`bv1Llj^ z%ytF81(@$*1I(EK`tNJTW908T!|uNs&k)>n2K#SxB$`0xh@DcLdXC`!Gm4>y^x|S@ zu7gqmY>V+tVBXT_tz=Z&q4Qa`>lDmV)x&L13L@bOfg-YxXPCt^Gvo`q#PryG>LhpMBOgH;-a22rAh7t{3_HoJ!dk6Mt%-hn#il@ zufdMeMBX#mM3LiwWo-AI$&1dMUduc({mk}pXrd30U79FOijQV4v0o#VaVB3QrJAhh z%okx4c|{Z5e=J`tG#v>E2J4WZO;9Jfd){Wl=$!IDrEC{iTawtnZd2yf{Ld8EyE(c&S7PGQ!4o^5zzX5`8myZvrb&uAV7EE_#HWlH-! z4cMH6&rO+ZZ*-ykrVN3%WZGS*OoqVyne0MnuH1jk2KRx?|Ji}&`a5#V#>!VDcQmxz z-T}WglRMzi2;ekIzd4h~k_pi|e#3@O1T@+PX9Q;7>#|`s5J%9RE;>ihJuW)q_z8ja z%iU;UV&CnDWluE3?%D-dB0G~_Puc%Dj>T7hal?jgaj9&AAf}1b?Si#$J&B{Sx9zfd zDUY4)IvZvUILY5{!<54H{lhk_#&OIP)M&W}XtS=D%{M9#SpWk{_ZuzGnngMQOY@Bm zNb~IjEX_Aso;^eJoi?R`!U4XvkTVz=J;w()dM?eB#yV3yr}hZ)%5lXx0couN1}u#= zM&2qcL#+;hoXAjV)l6zrN%b)fwX`YCL@t{BkZpE#v5t+w0r;3;wb{wbLG^e%FAT2x zU0;I1^`cgp3f)xa#mog~Z!K~X$gFc-Zc^8!wgFd7BLr$%2&}USCC<818 zeMa|(oywrU&g6g63WH|L5d3^5hhW>F|E0XY0eQusFDmc99IzPlSIYZ2UVpYhIbJ6l z^q?5YZFY|0M+NIPC`aap1*>1N_JIv08gz8Bsl=cKNd{ez%%u#v79!2MZ_}Xv9uhf# zN{T`Mt)3hI5n%DqPlj;4A9)?Hc-<#MH~VIABRSr;9V}PJey4| z60k-dU!CS9x4ix{Tcu}WM1iJ8;6el}d0p=Wgktj>-Z&@T0L(Y(1h$dm&a({T{t9fG zzmp!gh6ujD{YfGgX9R8~f^TeplZZhXfg?ol&Fm)B_n(uI$4zf9|4U3=t^lHt=~6CV zU6Nc4)etXa2k1HczKoCldlm_edkyK+`0yD21AJC{u)~NCk8c|BIf#$`+Xwtne2&>X z8sCC^C-LF*pcfzg#~8^tciN_D{AeWLuu^UYX!>s@68rIC{CeDlr>+*@U6B2(OFs2x z8Smrs5kC5FC3q>L0=&$_(@SnCvo3sN#lAFfVh|}tx8u9`_)-(T&*2z8r}5E$U68@O z)2;aI#z+70br{#-vmYNGk?6l<*=r%2FOYZ}pUlCU3-ZvCyYShK&vp3h!RI7C`Y#{) z72`7^h|kOToW|#EeBQ_B1AIQh$3R&=S9vcZy%KT` z;p3Kf0<0{9HkinK_Fovk)A6amhcS9@fLtv{|E{z7vhCmGd|ftP%hj;XukreKx?L~&F8?&XMS-%< z!(^`w4^)3`XPv(>iC^RO??7^r@yYc|rYFPNE*h`POa9Hb^&4&f>iRut!zb-u+dYkS zHk@tSOXsVw@!GxxHay+-n>HJ+v0>d`R@-tc`}c&FYsY6E5%cd!8?W_etl*!9_3wU# zcKU_ZL)&j+5?$xh_0a8AY4at+M{T^eQ@*X&`!-(xK5px$;evC*4Q=%u8^W8Lx_eqXJHnHvOe&f*Ib6`zwz)mh)!lhZcXeH%)0c$EZ3lx}~#wW3;8dyS=kxTW3$K zvA(xH`sR@%uRVPA8#jOd^+#@c{RcO`ap%{gQ;MeG-{hib`}(HF-nO1-TkHDn`tEIO zdwSYpfG0IT*jfr(n<#8;e_?C2u(j*^TH6|9w#XQiXsTb|8rfW0Z%}McQ+I29Tk9oF zjY#&ezOk03`o^YiqpzcE!jvh+0}x84r6x?BK0uC=DUm{T() zm7qB_DaFjGDVdx?(YdQ?FQ}SQQZji)sw$vviwCOP0ECih{RvV?aq)CRyGc_+S8PLf zXJ1#Wwb9)gjZMw8XwkHvu{0c5@S8K(}#{NN!8c zU0AcAsy4A~jayY+?G$U{W>>9Gu>?Kvz)eC12)I@Q5>UMJI zl%JxB9lDsIe~ZQGke{M$9J(0f)AG|JQZ|Ak0-^7-SfrHCkivrcw@hLwpF)=+K7~F& z^Crmuw1%Yo6!c1T!xZg9bPBTzcV*Q;IjTS!IM>uq$u>1rzB$#)E}XY;#e!7%99oL< z;kf>Dp zRPv|S2a#kzeXHg!s+qkwK8Ibh3Ps;0SR@E{kWmPimkYw}z>34wl?CDMhk{tK zvbJh=eEOtvxjLjE+%B#-#KGysj^zdK@Q$Kf%vm*WUR7;8 z*2ica! znQLZORxVsRKUTAN?ut^UAdN+X#h_>GqN>_uarHG-utKk{TG}sf>O2w{`mkR!J%$}0 z>@?wLLwA>fjfEPc$LPR41yZL@0bXxEw0E_}h;$>2*~T1WKHg-!#<TTtr%*@>C~jRwVid;by2%)YHO{zyQ#^r_t}j0=C)WvXCn~3_1$rPJG*PM z%xLIr=QbI4=U}#2TT_S8Uf4>fGYi$bg6Lh}W7u1rP^}xgfoP=-u}-v4Yfn!faIV zm&Vj%(~Bzi7;Ym<4SSk4^)+=g#2rc$bg*ol*5=lR`ran^VOwiMD}->Lw0BzZDF&)^J0BH^&6UmGY)n1NNY=8Hj^|}d)(yhjY2|o*@m!(wmE9g z@@zt97kY{&iMkDNA$UP+^R^f~4O@J06bYe_JSV&$*PKLp?0$^P0X{=w=bI12Ih&UU;cosBN58pBl(w!Hhg z+$D=l>E&^&LxQ0Dy3jY`HP+~6Xp1N3Tv8JZquFGCT@1^8_LlmN#-5h?jc~N?<{rZV z#kJb&FYfG)p^X*P+F?U%ZuF&wwpKbk_TD>MWA%N#EeN1Z=+;}Da{=2Sz|_>yh(6uk zV{|w5cGq|Gw6|i9zn9hEzHqF*Z39R>^+r=eBffPV#1-I`!b5e@C)<1I?XFm-T1SF| zoI5CzBSV4OmFZ~g8%f72nx1iH(sBd70>S)@~+1py*%K%>A-B28BZ0)IE z--cLO-_hF&1~~dQqhWmmk`0~RIE(3OYwhiA?bu-0oJm6TS&eFw9-|oruCH&{XfWD< zcT)^;r44}vO;nGVfN0r?3+gRBI?2i>fc0C!N+2iYJK9>& z;6`IhJB7qB-X^!96x%Pl-_5ZNX#0kG7}IEmbLn(f9M{nbUicyC zo4cF00g#{OSXU1synHvKQ+94_ZHjH_#&HrDZBUvBJPHKf4qBSc1|>j%&GzYLxDXpK z2FHOh-4Hv4;~6-FW7iUw>OppQF0nk02b){lnha@w_L0UOC*8F%o^DXbS?DBg8)^rP z$1z(R{aHqN`2yr*1pHXjn9ULwB3e+tS(-vjYrAX`OEB= z5`qMqP+eP(wwTHQkwUho2U8p+G@lGQ_R)~kP`MyIrAGW^z9B8xvr)zqq;b3i*{!{3 zV;3OQ`nIkPm0z1h`XzcEhdqflws#Wfb9`0xpdNUZOp{z4-VS)S7Ym&Z*byH-B}4&% z&;*xlYS`>lkrW~vitb1$I8<*41WZJyGt+QdHoviQamvKFC$f(=QRT!|H2qY>BYPy2~wZ5?t6QIUMhCRjzo$l*E zw`#!rS5G9}2xSCU9g~ZW58f_2&@8ZaL9#&bf;9*?FWF0>Zz1{q2X_OzSZ3jGoxb~h6{ON3NmJ9%;ITgj` zY->`)rmoJ0miX~`PYZ`DE?_24Lva!u?4bwZpe+S&Y3*plDAwDF#hQkgYLP*^W4+AE z;37>3w|(8{jJ;R^^vJALk6N7fZ|JUXM_V>*WV^zYQZxRtYW!v0_)C@fi`wyr)w6%4 zUUph@NzG7hjChJ_@9i^W+>AALc3^Gcy1jtO4YlL&j5S41ugotbz%&3vv7G&2(yx9* z5v(}+x|`7Fbt7}^wr9w!mC_cAE*DNM$J_{a`|9OJLw#F=oeO~)X*JiwWWXL?68+I0 zavIi41mzND{%T|X8e_3hTVq_%YFyB4bgg!>FxKjVF#T$gsqFGD;}S#WDlvwa`d%Xz zk9mqq&2SBg+C5yK(;U_iO?Al4fvQ8B-i3)M)PO zRV~OFm7zL-?L+9Lo9M}KF-h7@W=|RtASu8#&(%|@=C;-iE%7+V(4kN<%ttUogk#cy z?cbPmA)7%~0#Ytll}=!xBV)4A>o_$00uzW5WiZ=-PD6v>G&C78@1N`t2_#doB@Pqv zT7_e-mU`}!Yj?4w@Crq14{r~+_<(fyuoYqNJ~#}hytCLqS4W5E>I3T+nuU$lhsCd* z2`FdmQ#`CQdvy;I_QnRR(*UDu;~Q=3+Z=Too7VSXZQG6DB_`HdxbY00sqm1gdznl_ z)%a)ck%+SKJ4&)2LI2l+++$h)g&%Xv%+@7A;*8FY5t;Oay(e2F0Dg2-X|A zXsTn=omDA2gqyCaBp1T4+tGwMTlZ!)&rMjPQxvziWb&)?yEMXF7t<*)sbxRe^o9$1 zbT{S`T$++W*#Rl$uwT@(e#l2gql67ZaA zV{?Gg^gKalb5=Zd?8T-8H$}Ndc0_OkuO4fagv~vfG|42^?!=BHRYi_VO5=V-DF$ad zqdzA@tiAGQ+|U9fxTeN4Os1wV(59fU2&rigtd>+nYCHv{rm*l-6tqZuj7i!>DoNaL zld2`K0K*cKaV#qV$4HZakPwrAp=;P9U_ZPXvN1bI6v8ad)H&V&z}mLtcrFtg+$&9> zi?7+G=~+Xfm)b-z4fiv2^J0^`y{WySJ-&mdd>U)N0p;1TIbkzW<)Zc&oj*lSbu!Q| zYrM&XL}|%GECjps7F)Tu*D$X4sGFJ?Z&5$?y~Oy-g}k#HmmrLOnSc<_NXF1Jl5zBm z1ROmh0U@4|fT8NV@QgmdjWGOBVPfmMx)?N^*(L8L%ci7^1&Ck5g_?4?-rkAe$Kj7T z1xM?@Q(Upx>b645;=fhNGZFZ;g8jPIM4b5f=vLNG3J6^s0|*@`(O~X{^Tj#T9b(t z)&cffDAt^`J)Be|TVC{%{nrF-NODH4eiST?WTJ}gjSizmM%wxE?dIf0rh6+m9%Ix6 zX|9sg9u@1Ly)-d~ky8d*^a30-sEMOmSm~l02mdM-58~pgQ1c1wwLr4Z2;Q?xVOrN zpR5zI*$Sn(8qp2`5K1M;#6eFhx<2f0KRVFa)rXTK>_h1twFGuX1UpOWwG87AqRwYc zY+V!0MEP?1G!PYMZ`eP_F}QRWo+hyN_IRdoT=&rjQqpXLq{^1UI1)_bg}F^04-;Fu z>$`B-pRtZ}-qd!BvnRwv>JcX?NeT8)%K+sIm;t*rP}Ad-q<$j=f;kpRiKV4rQsb$r zHIL)n#cAhL1B{y@!-b4N?h~2R90|uDZWazV{dTQDy67>O6*Cw3HFey8bBTJxXH|CH$eYvuBBi+ z$g-_PsGG_yEN-9m8x|EOR~Pye#$CEl`>i75CFm_HcOGht-jFhvO>?%oQshh7ip)1q zBf6LF)XXj;87);|5KCo$J+AdPv8KpE(XFn?<2226oY#-8=ZZ<&<;v*lG|QbwRM$JL zZh~as*hPy`2r6ZHZ36=~4o@e{P;y4(JuE*nmXm?6jXovhZ~uruO6b)O!z7 zRcC#vw!hG(+}P@`zZ?tq^mV14$FO$X3hg&Tkuu~W2F5#erJ%p;ln2ZG>XP!bx*u2K zhWMwGG5tbkZAgmwqH=;5Y=y}AazAN0Uh8A-&tgc~BV32HpGoI-MpCb$@2L)p36tE6 zacdzH`S^}sg6-{`{Q?#7tsR(M%TasEW+jW7fqy#BfPO&%By!;q}Tpq0+j^dax5EgLMMJUA88OQYzf3p`)Lc&WM><5_gDDIrjmLTYjA4 znpdk4MHVHZp*sT{Grn4J6Z%be=)zb#_nUp#c>5_yH5s)pCa6hJV_$o_S|r+NwPsRi zcagTFekC&u%M!wMw@Yjn$M;+2W8(}ff0YgS6OHKJ0>C^haeAhMzKldTnN7&5HWZXt z*~oY6FWU;DXo`IYRcW;-;V;Az@|YgMG;`&4lYMY-@kEYfaprllP97qoLXQ$ zq)(JZ37NoP`=V1FUct!)-PGG|G~rZ?!#wU1V9Q_5BzVnBT@V5nFN@hXuJmOwhHw?W zaotD_lGuB}^qY4x6Ft$s*`(r3;snDcsl`?z$vrp@OyRHyDwL7d;gvG(XkovtTXy8M z**m34cpXr`L;!a-)SWa^>;NkV*T>g-Qlr^Zzi_5%hi^cY-k?Ee4hZ4k3( z;5`%AIa}X~|27E8xp=w63?prD`s@sIkSEI+YFcK{6Y^!7!;KN%Tr%e8)$E-gtQlDs#Pgjpu6bZr_*uSEYS1 zeOE?h)^zovC6>)UzT`)2rt1&I!$MJC3q(%t_2zERm%LZ`zUbeTR+$B*+-32_Km+Ji zqhE4DX*Kw`?NSWb-Ck~9rjy}p;Pjtk@1*uT42I9&vPm#?s(<8s~!Q{Fn!(l39|M5jgP=>x0Z-a1RJMkq+!sBiy@VM*Vl~}(7 z`(~glw+{bTn0?hPk7+lYEI*n4SupGMY4VcgC+kDl-8Sn0r)nGWxXVdZZi0yX?=sbIH0$Fw|Gd2V@3yZIYGgFm@E=1-RAhLidKuW%|~`v0=LWZzBJ_p|DoOlQn@ z>qlF=VYas$eliI@nFRZi;B|oA?Z+2=CC6L0{N(a0lH{=ux%*oIU}ua5F$`G$@nvDs zf38g!FB9^&f!Q^-B;@DI#ZvV@wt@azi-e9b?t1b?WXbh((=APRjnQs8UtH$WOU5m> zmHy-ZZ#KaAT;b;93(p4PbC<^#qE)-+Ofa&$U6^*uX{I~i-p#IY-O9fWm29So|ptvj+@T38>SuHaAOi&3E17{r0X_!=OdrnrbmS@VT?~G zrx)~meDoh*{+80Fr_BVu_mLrmUsq=B@%(3e2NUHzuG=!PpHybOoX8g*h;Mr0oOY-1 zrJP^yL=_X}zrKNa_k)zcyGQJkQtpXlUcLx#0KY#;9o#;+R_qxc-^uYRUYp($Z64i;dd#tB%V-!~eafBS5I%&$Jl1bB| zJ==P^J3D)$eLdY#TT~RU&Wm6>qHk-2xz=J2pl5*h@!>zcQ(HxNV;@X`8vv793>c}s zQT=vpRKMU-33a~ZAQP?}D6Cv}R7vb(aOv6u2q88cYge+J2QGQQr%?Jror3tpYaE}Hsjs)yt`O^w!`G(n zj(QuTpAk}7aN492ybPpLSh1@Fm-bEyYkDV*Wxh&d9|0R(xc(d060eS?V;kN_Ow&JT zu=j719`T2~C)Qo*AC$HzZI?g1m*SFw#2(@`6FrG$1Z=* zA58O}Fc(jV}i z@t)tzn3d*zX=`GEw|L3#9pag2`m?Lkyf19O(tEcTWiRp%LG|+&`iCq|^Zs@__3+-~ zy)w=F{Prtpz6Zbrqxy5w{wBY}(@ucpN|@>Ais46ITH_HQehkErH1FfcVWfGFZ-;0A zl=x_x_fbXsIf#S)=AX0+oXiKxL!kK6yic>x2cQ-b_=Vx_^g&zb`qHIn%|pILyP)8u zV7kYbQ3m~peH!A1W}MGf9lFaO_?vtq{Y8J^3u)fFA$chBd;cF}X9DL__5c5SKiB;< zGt4k!FqmQNL&#RvN@blHYeL$PkQ7DILX5E_l}b@4Nks|CI@Xe?Y$c%-6(viu6czP< zz0Q4oWMp4t!>d;b)Z9@A*aXBm$x+{-ST#8E1;( zFXt4JfLUWb&kOL3Jsoy(JUOZmB#PtTM`N0?JaP+#GHhgS0kU#&=AvD~&M%Lex_TK= zpv5AU)yNp!YKNVfg>u|dZQX0K+-C48OV75()7P9{4%=>gT+D+=I8-?)6cg3bp8jvI zym&UMvu;966Sp*Ccf;9kM$DqND3^^RQRe4{NRxxhv>|8%$BN{vcFQ;o*>!58`o4aEp3dfYTHAoG z>>nI^5JhqPfAW4t(*o@;K4vJo8p0RFXC#g0$Qt^C3GYV2@nPp3Haw>q>l%&=9zaoH z;CL?KRM`3Te$yKl#%G3VmJB;vAIQUBwkjAyzA{6AQwevJiJ9lR?c542UAKdq(lP9e z8g6nmI>xlWe;>-BITN6Y!_?R?y82nTp%+btThWNy3AmxvE{s7#4P_LkK|A1t%r1^W zzP3Gte1)AcF?pfNWkNN}(Es>Dv>dL73meaAL-W{pm&Ig;8YPEn7DqH;=i`S$81ImU zjf`g1Lz(Us{D@C^ZrQN&Sq!p}=#<0&?ZB_RGYqX6CCT_-MfxbEZ7?&#Nk-v012f&4 z4%%^9r%#TPic)v>n-&unY6LSD3_ImkMwgGxbW0(!urq%c{`odG$E}XaM{!f`hwpVO z8U5^GrikfK56y{nJ_}CuF`>ku8*)mx5v-5qWu}Ml$+2iMEC;4?(n}@BG10^H>zp`a z_0z*L-RfcIH2gVM)(fL&G44sjFlId)m*>W>b&Kb^4G}%EnHXN}Hq13ulNdgO7LWNQ zA?$n@mxH#57&4u;a6w=G2rh^Qp6AeJ7Cny0#tk#Y{!uK4#MPddg9MPbeGkSQ#Qfy^ zh3brVVvXAc6i=D3Gld4XcH`T*Wz4_jvrvrnQ8FuFINJZGap)ZEZ1pfC)@_g4c%Gvj zvXU5{C_VwkG;^MQ*bF_ddhvg6s_s?fyJ47RQ7N3~>>h?r^cqrZg2@ikDuSRzZHa^R zOK2hr`)>s0AdEnkGuBM6&OdPoobw=y8X?{+%w%8#Cz`K^nkeQK&U9;qDwlE-G2(;-pqLG5fH6&gBNg(30NZRY(hXUz)Exn1o+eou#5phSc4aI z;;lt(H!Uva-9m|OY3C4zrz%LG5i1?-VS*V|t6&&Ioo5!}_~*QKS&mZ#(O_;GjBFh% z8Z#gDIoKp~q9}^&*}=ef_qW;&UaoU zZ!(gvO(d}WR8d57I_x|(n2pJKfu2VPWttD|TBBAD55jO7cHXAPSMcD6cCCMBW$t7~ zP?Rf*nWo9fW~`gI#;u6-(L+8&dbo2_F_g*5L1qm405(?p-My?0Y7SPXqyNAq6)kf0 zpqx;hs7lyg40()Oqu$0;P=VJu7@b%f4Km%1na(?i0yghK6!8<#TehU3Re#k*q*=9m=WUS3W?CsvX5!sr>Y{BrKiXpm}2jzv*qwIP& zk#?ExS(kV!VtNvW6088wn&AF5#?EwP0Idhj zseHJd8=vjg4f8G-@^Op_<}5WMctN<*2v;6=#UmdG>>L=zmWLb8BqAS^?#p3U_#-jX zt((Q9kkCXEzHqp`o7T$3P?7-GluS2`eY%~S(8f)H15`Q0*Z?1^!h;o&g~^8X=nVEO zc?$(zU`M{aOdeITHiiqpS@)T?|7RlVdHj7j&Yy{yASYo|&dNm0nwuB`Njl?`^4vHi z08=ovq#!vee2l|KEF92&RAoiO9o@v$sBO2v zm7tCJYIa_7e$B>*bJ5Cesu+KwhN=_{%V)?o5lNOm+@qZb8RD`c1=dg!OI5BE^r);9H-gf7p3GJL5GwG4(77MR|Vc1%Qxh_B#!GZ;oAwFigB{0Yx z7?|VC!X2q*m`NIAx*y)-oSO`ay#V)wQp}3ot)fRPF4uwCF_vFGm4MT+& z!z8G9BTyDds**D-v#p!a(oJ!Snk4=jki%-8Py&Mja#A$h5*Ejv%602F39P<&?78+M zOhe~21i3uCs!$3$& zZv1LDG3F39kBAfM3@jQ<&~y=fOOuaGvvECjN~CbI$ibEo>WL zGKr!_#C07k+pa=QIZuz|oW2CjWJ~cJ663J5ro<^X6>F|@sHOpk^y3ovC(lHH9Da@n zs$f`%&vX_dYjD|FA`|8~Xu=8W+zKcMR$?fl6l>|J0bYw9hwc^UU{~U{cdL!WzqqYG z*WxJk;+d;(`!t6ZCOYdM!D#-$hwxS7N}~MG+%tVAFmL>~*N-s1a@<%99{JJp zBgVd};m#(dx)&>7x~Ix;>|e#TY04OLM*^mp(+99&`Jlg&L_a_fSB?U;A5 zG3%4#+nT?3h3z(o!#&y9DRs<&4bF#GAbnU=RT>Ssyt%4O11Bt;EOK^TFja4U4$68~SNZ~rl)C?KUnuz13!l!)2_+(kzEfu$lOO%RS zqTnoGp@|Az-A%=u+8M*c7u?V|i;+SF#O!Q+5X(;^W1VdeW@i7dqdYg&IW~ZUEa$4u zSR+4zaV*PC?to}9Rb_N^D~(~R`JxYoKxYB=g>}L>{K24$R);a9q?rzz^X@TbHI3ts zacfb8ebBH0+lpfa-Sjx3BEdjmn zD)XTfY|I$v7Hh>Wg@5a`H#d|CV`|BA%d~S#j)7SnJxe$?jWwe`y6p>nPH`waQx<({ zQXjK`{ReilhEkLqKiP@-$7Hr$!#TVQWYWeJ{j>tnRVNdU_Z<10$-dUjbPz}Cn`%{(uG zy^Q3oh$-K~6t4krLglCWT3{R-$OXm=#k~c_QA}#y0;4fD7sU}2lMN?cIOc`NVgPgQ z@zxHr?mUHAA(evJdht$E-Y=xV^=NNYz>8@Zosaa!Kj)El8B79L)sDSHt^L#6EJB`6 z!#vg+%c0)fvOAP86UF9^#U6@l{ZO;0VQgO-izCaedd9SlNH?yi8H=3~{mnO`{9Od|5@CaKb;RP+~}OaL1ooH+%VFw$~pwYB#sy-QsHyP zhx(Ad4zv9`7)8>ZU45{^nFu)t(slMhRyO0Wv%0rg745_xD8bo{G`uA`%6FWbFv?BI zcI#o2l+9rai<~xYZDba6@z!2wfKyR>sT_D%99+Rg(K&>SRt!6@lrw9*ls2fBvgkRR zd*%5W%F6O=C=Ql~#U96O<6wu5x=-O@TRDtMn1^DHI@ls&`&Od0o1Enqhuzq@@!^Ea ze@Z$$RA`Se7or45k>XiAV@=9(%VTef*{7XbD%VZH0ymoj493&gb~q{QiM}*C9rv4- z#=}~qg24r25t~S4E_9CH!N%rHLC^%RqS0t}n}dx1U!zHNzQ=YSu{l2>5^PPUr=tW8 z;WL)0bC@>PlpWkuFWM3)z|!ak?S195Je{ZC#eGeA9o$Ot2~C!7zWWHyB`$XU6wakC zcK#gBDHl6`4d*Iwu7u^F9rh=10DfiSif08A{u%Cu z?{30stY7emEsQM~n%+?Ll5lG`aU$xHCDqA|!yvojc60=1GoHlR7}TSms%=M9jZqj` z7iDiRe9ZH;AubJk$=@+XZfqK9!&oeOjRBgJJ*@l&L@ERf=A#2kmptBg)~QCV$}Cr{Rbt#b?f z5--u*7F6Q2<8)+yzYRl$^KZo*ob`B%%rvZY*+DPd%0o>j7u)SpS#D9Y5)ES?@jKkH z8J@&#IG#+LhD6_83W);!>{docQ7Zf=-1E3>z$oHkMu7JR@J5_#;qT(!4{$Fw+tVv? z47fFiA8_7{Z4;jQjyAJhdpC8o3Az_S(bzU21dkXn`k8qP6J1BQI9KX!DOPPZmz#Lj zY&%Udee3dl$Z`qpMP}cMhTwdMcr1LTwclY&RXXgLQ{)_+USpxv)=kaEmeiQeLzfEN z7@A=)kB^Q_hH!r7nf9V*+HvOMdE^2gd<|nN_hgr-h1cL-Hx2{uH`wqdI&W0YakEZg z^D_o3ETn;l7j8v!M1qWCXZ^)3InIL0{;1za6y+GjCy2szmLrOCc)ZOykgK%zJo5jT zv15yj9dPW)v142t3yn31YeOKejgh#Po47vVj#=|*Q^ZA^u&-{KZ{AA9^$z0N6^QFw z#C3_`<}jQuF)E(EwDVtZj*W}C-c7*){%SmS=wbGwbE=@6_w_I{)1)daC_bq4mZYh$ zj#E_!x3PB`9}fpSPxW3PKm+^%al|^WRLR6A?!lc|h{49}y{|`(gP8dQ21{@pG58Dm zohp~E!}sA{GLEZO7h_)WFdlA~YiAah>k)rBtgR6z(p}Rd4?8r9lHn1oALm0@f`Q-@ zrtcqOw;|3Xba#aEwWB#zIp`<1b?t1Q``iEF{vO9cjcER~7I49$w=Ib|`>N-%>KYSiUkV~|Iqi{~YIKq=~u6nWaSvXg?*!eu1%U$f8 zQ;iEMOn#?*~s z6-za=;#u7@odebUwfqC_;*y1jpBQIs904>Nji>MaP)AJM$!uEBcgNi89IwXU=mv0k zwmYBlVh+0iN9Zx#v0?HAKZjDHHaE{AWI`M!MkI$#G56gV{pyd!4Nu(+6ZhhEn73>W zmV0r|#ns>|8SHaBkj75j8Gkcwaz@kE*aHcXWR>{~k!W7pz4A)q=#vH_YzZ<)mXO6Lq=4?blT!}O`!M{gv zy_Hj1kP_xew5w!@SnSW-qWPj;J*k#1>F?cdR@olDpXxI9p<+dLildGIN za8${ZbKt!eg_56af;U|=&C*V39FUG3>z2i75F)jlKf0P$_Cj@*|NWS}{_4td#SHpF zb*Q6Vb9`1#tIkH3$&@JL$qG&g?Y^j1z>U&Ze$vVnu?pBpzfa4&N3~Ed9{p#9ZD4lbNYsxP^D1CkU|0~#-mBJBqHEl zoS4Y6XeZuN0zAf`6>*($a@EDO&rfhd6vwSvX`DKn2;+F}m+jW{9?r#vF`CZnVqW&x zhp_eptTC~FHu=Mz)Q0yfUHk_SU)SOa5AP?<>7428tL5dfC|;z&?vamio-!vl954RY zi+OWL_zw*JL|vgyig@qh{B$CzN)#3h@8MHxKX*}RAMTP^hMv5~_MEJ59(t$dyPf{A4vrkPH8ZkjU&=c}ld zWVFcUu!92|HY~1b5pBnERQ@CKRDE)7j6uH{g@dXyD8_iF65jB@Lk--4Q&7y2Y&VPx zq(vxQ1S`7SO^7`Bcb-BHF&#|Do2GauiM7-Zo&0m##@d|s*SLw^flMBH%mkC4=IlHe z658S+5uW6GJ}Y>&eruiP;mm?ngWAjwWwDC9QD8!Ma%NEjQezY$RqUIKtm z36y05&hkw#WE8a(kB(zGzu*Z&Jl-uqyH9e4aD?}Q^Gu!oCq4gX;qN*xJ#MDq|La>2 z%+j__nAcIp%UEHbGSj|;;;D7Hc);P}d}A3;ypa(+xT+k_yLY$8-6*7^^?3UDLOZl4 zoK)9k4>KLsJmad2L!iy=bDR}*b2uEC6Lb?v!SevLD%Kp!NJ-#f4-V1ix93SRYHvO= zi?&t>qZ3vhmz(FnZ!>Yojdk%XECtVY5VW4NuM6_PaL!zeq{-N7(q8jakruzy9&On9 zxo#$gqQV$6+PD>C9y9Mf#CtD=aVs@elSWpqTXn1%)!}&!`wCx>h{J{y=d`80*|~7| z490fuff3pp__3AS-Hx5qdAlB()>rLNwDap_hMJc^faaJPI`Dp+%yE1-GXZZs?Z#pF z^gdPVXckB{`F84ihzdLEFY2*yIhJ9vbBdV~m2K$qK94;#ex z2#JXd?;ysbgWwpwU0$ev)Y9KFdaa=Uxdn`aL}|j|1xF>>PIc59@pV{&F;=(i7avd21<-d#w5r;Z{7X zOlo6J2eVmS3$if)BR3db@t#A5S^Un08_IS;9d?QT)BEQ*Rp?;eY&^(!>Sn-{%P=4y z&T>q;ls6uf3gbCA4&yNpPjFK(+M?ayfXm6nYXm9ISj-M(oeP*L$~j}W>cnTx4W}$* z$axya6~WI86LCikqJ}xd7e9skmWKgc9+u)lkvXr2;wU-FEyaZk&uK6%j2zd>#Q}01 zEF0Rpmu2GvipngDyia(1$uqfFE-R|EGpA>zFfsCe7Y!H_liSuUwbnRrn)KQZ=bPj; zZrN;e*2%Rao|?gzZ^!X9x;nTWW6?>r`%0ZS);N>1a^URbqC%5fW|hE*|e10k`Gn5h4`rbq9^WM4t3e&Lby!$ww zE9hiBJTVg6I>dkht9I%v5)- zEnc#T{)WNRS8=ZMKVA9=Zdk4*V7XSpIeqsjbGYt2$5)WvZEM~l+Knw=$|$UBOJ|NA zvl0u?!B}W4?j9FvgE6c*y-{8@$rh(42KF z!aF`yoG+4i=Yo6Tc2PrEbhr&(;=`Mxh^hh?^4E1lUn-K>s{Kee zeI#D*dpHjV#du2&!El=OF@ueCtBiLmcXG>ha?_VZg5c2(+C26s7$e8w6rzpUb^Oo} zd%#!POR%ABXgN-NF zu_MF&jr2?KHs>4YzZkh%n?jx5C^M8CmDx8l$&E_@K2Z zw9OD@MslECo$uh=qit2fC9%dr_Au2K!Cb==drEc-yCa&;gIr7(&h(}F18yyLi9^v} z6(t^xaSMN!f1f(JvB@b$j#g&b`fg+M2I|gM_})+BOy~bYp8-n{RRX?}V|K1N`R^au z7;EvCEZ!l)F2=l9D4;|$H7`NzX!sYuwuBH{08-mCkX>WIrBO} z)XPwKO{gWFy<+N|*M#prMZE!qJ>yxFNXs1G@_$_u79iFQYg=-X`>+X{9nL?Tiijr3 z>Bl!wxByu%uG4EpZy`9c`EwJr)t6fO-x%7G!1|3Dj&=F{p#})GGl7E@4=}z=z%DJ< zyyb(8@=0%9M2|0VUMr#NGqVsgeSGk6E71v{KG0S?vi zv~;u?Yb@uS7w*ZXD8k=caC3k_Pa}}`^2RC8dosO$i+De8yqU^z&-(>>AB}jwWV|^< z{Ooy8hr<=di0?fkUV%f6C?kIG!o9|5_D7zw$iZg$Kr; zoh@R_K4fuI6vws}i0geuk&TM_w8bfQrIk%lkegcMg*rx!dAWEqA_E0kf=6gv;@~S! zD2p4+KIo}tELE&{ye}ghxxtj`v}TC>Fhj7krXvgoZp%63dC!Cc@{4uFfg5=HEa)2e zfO{G0fEQ{uBl#{8$s5fWGt2ZF&-*QU?~QoBZPK9kSDyELI3Uko-r(i=J>HJ-dn;uF{K&Ib1sAE=asK`CYz z#xE4|Y2`|UM3%RqcX6F@+MLPYzW3nHZ3Nuo!l#^fAhBlK1Ih2dz2(VoC=tmVPktxg z*C0_jKe#aWl}B>$0YgtwzV+^X0}x;0;kWzpzXJFy!ee`K61T_e+kyB34;*3GIXa>) zYOplVu!P3JgVQKHpvGeDmP%nhA=Q7~n1d*Re;-ETIbps6c^=<>K?fd>Ee94Z5Bq1) z=S!QCD+~*($28(hjP<^Y2)^&j!{^sZqtf>GMUl_O8O|j~A~dE@9c*#7_Qh*c7%mX5 zruQ%|4xYfRAqUL2n*-M%5*Ij0go>&I2sKSIuF>np; z;H1fQYNNyxoX#i+2S*-S8Lh+jb}6O_?^VmX zNQaX~l=2ob{K|6FwYElqC}f@dwiunD2g6lFX+2>#0s^Zg??Id6LYWDW4 z3huV78uqX&qjfF&3H|^?{#Dm5TQ^_e!1Mq zZ(~=h7acy!{-I38y>HqR zU{663Z`v(=_RO=76?h_7^X=d3=VuNd7TF_x_PlSm@}zM6HvuRPY- zyL{1MKZ?doO#s8Vz#uxu~yN55no%UK^e7o(AzWBbeQ+)C5x4-a}*X7oJUwIU^ zPWkHd3TuYXzrNMgmtI4wq_2N8wZ8V%*R|GLzVvUf7WvX|ZSC--mu0Q-<*$QP!Pj1H zw9feQ*UcL1i~knuX@x*YJG#y~j%Pg&$-$I$;td{nbq89?@Ft!&)zlG%|3hATSt81OIag*_HMB5@!9*amEp7ZQ)|1=-fh+% zpS_=3_?^zEYnPSovv;pm-IxBiRz07+2dwLT_Wo#{_W75!`uXhr$?D>>_lT9~v-h~Q z!e{SE>jR&?XRJ)0y=SdhpS^!sNj`foSQUNtSav<1y^h_@XJ6QE;j=H+wte;$vFG~i zD{4RJ8!wXVCO-R0*nj%$NwGsdUDi(W*@xd9_1Ra!Zj1PP=GRbN`)l04K3`vHpGNrA z`MR-fBR@0v!)xX$Z*{?VQ-nVdWUdzW=LlcN{B8>!y4p`7f7$u^cH2dI&GWSf z=e(Qo?*Mxt?w^+Lf1iC9;-8T3U&)$}@>_wQxbdzB>|*d=jUUbNu3`3%C?EdrrFT7I zk3jy<B4;Rd3o4qyNu|+-|*ZcfkGq^YwB&7vcH)W!|;Qu8sU1 zh)8Rl{T4zLV4FFyAk3$mVf_e_9w`HYQC;!-HZ5#=ZD{JmqPq|^8I(( zn-KrNe7)N)iun8I>u>BIP<}D_`NMpL@+yMgGxe@3tQ$~XEh5sYZ>?u}=j+ziIQa87 zp}ecG^$60Rksp5ts{z{QqN{MAAD4k5llkBL741F9l=S25IkX*jpbuQMxVcZ2^6`^sTUW5H!tV z_*B?CD=Pf2sE_xc%gg^=*t-L|lJqjzdm6f!^vAH*DQsC)rI#T6D`9UL>91gKb@)f@ z-2i*rLr3Bph4A-7ms0p@uy;a~ZUTE>g^r~67YttrU0mVU!rl*|OG`fqd%uB>)b|wF zdjvXCKXYI&e@HH(Z$Ww;U~gI7e;?8t03AuMHp=G_=nC>@!A*xwmtKeTRzXMVXEV~< z5vBJay+hFX<$?UNe?;}?GlNv{;{zY{tVUk%v%V3aqP0Uu(tzrB>#P3Z(rz0`>u%i<|D3T#rGua#aHw4 z%VRj~oef=4{`ji`)<@6@()(cV7toRNJOq2cj?(ub{vV(t^;PQ%%Q_mRuY$ceD$BR; zTG(4ST%bF^-ilHBdxT$)v?KjtDC}(v|A_7ddpkwxag6fpW9$>{V4xT*xMSq zn9{!t_I8WX3t(?Q=tzH94tpPij@Z{6_C5_AX)pi6zIUKYD!v%#52E~2V9$5Z5&JS= z?GU@t-bd3k!B{emY=dLioxd%aJOv)@Nu@Z#^4hwxW5 zOv8reZ`+4Z3sqPUxV-xN#Wn>4?b-j6Jv!caOCPo$RCv$-XS;V%&mTpI{2sK&Nuvuw zAGJ?Z_xwAW^l!JHF6Ze+Mt8N#q5gTHnqf~vt0Kl9UW`9vU2FAJ`FOgi zm{GaF!7;N~v}UU=xEwP|Mr-zhg3B?ZaI~&gAn?gCtE>Vi$5P{vlY{kg^yQ#Dqc6v5 z8Z8muwE=xYK(`L)tbpzi&^HEjw}8GSpzjFiI|I63K%@OeU5+&Ll?)I9ti(RK+g{7Hv)QIK+g~8g#o=d zpqB;o%79)I(CY(wLqLBV(4PkMwt)UTpmzoI-hlo#pbrG}j{*HtKpzR{;{km#pg9T` zT#j|NK;V;O{T0v`0vbbP)P?aUpu+(j8_)$O8;l0yQNTYbpi2aFNR(8~jwJLiJS!TDE#Vt?5X(3=AKvw+?n&^rTqcR+s= z(E9`W$ACT<&_4zA&jEcnps{|7x*V*(q9pQrDxeEa9vKefSHSAJ*BCi+WqY|LTDM!b*|QDxW}p zZVH4?tn3e8F>1-m^j25(`|rTIJ95!~bb3U2={a$JT_{j~M*{KB3fR*(aDRLtzXt;L z_D%DrS3VH_C^r_mXm8P|B{=m>QA=p*&gu9^7xl*hdrQ($7e8JI*n2}DzPlrVL33-s z{;1|;{KxPhL>I%q9NACeGj)18{?SGKNFe`n(<8oK_yz&{st4+$XrO#P57fuh!2JUQ z@&6JC|63q`Uj@o;%JpVpM&$o93>gRp6H!u7myQ#wSF4oT#+W&g@AGbbm=;NKgBw1nmapi~A zkYqh!o#RFt7x$}4)-vlhrRVtUFIfAO9-~RJ=2_nr_ri17 zOv1_9o$~j>|7bm<@ySc?Ije)l*ZwB_=hlm|C)em*)-pBNp+@hus+Pb9TwZ+NTKwBM z1$u$}nVA*;dVp7!jiY@b(nPgk=`sD8cp9DA|GPf!14J*x8X z!jH4otN(cZN%j~XMB(zvBi62_^6|o-u~L2If7Y5_$O}IhNU|1Nmn*$S$Y+xEvGtqJ z-fh-mUwursx+i(}d+C?3Z^?+(DRzv;SFgUx+6`3So;}Z4w%RA#Qj#^>nym55i?5vB z-V{hbF$Zq?}+uBul+q@_4n0B5xb=7&kH}v>Z$bjH-VC@9D8VG&;Dt~ zo=Nrq^*=BCNV{8g&!2yrD9IXT|DpcGziE_YJzyVFf8^g$Ou~7_qcl_(^H?)5e^m(h zw^#Y{7KT5e@LNoM;CZOpub2Om)?S?#v6&}Xwd|S|c&B&qex9rG>WTl8tn2JEYR_AY zzS4f28N>CF$^RyM$CaK=H~KTXv)U7zNs@K7{bz>fpKR=DVLzkzHXHxO_Gy$0FVCJf zc4M_Sy3wA$)n1z8bCQ*1SJnE0eo1%|#ItT*tcE1K54TwD*XxgU?cK^B`(cuW=g+)R z7e8)P{Vl;~#BZ$#_!n1yxz+ghwtLH;&zzCIHKUXl*<9n_+N!PbqmR*V+KImQaHsXQ z#v9(nsB$!3dij6duB-Sun)~Zpp>%w}#lKORg!8GID$hBlyt`R}z1Kmx zCgJ>RrN&dn!SrqkjK`O2eqL|#bDw>i>Z6&_)vT{opDl22l68aip4xvTzOxni$-5Z; zh(P?z2d@|tpJP2*$A;{|J`#uKkSEVmbGJfW>g))=dJ1uuTD{(rJMsJuLT)?1sCJ%2C! z8mo07PY*Wtue82b|C(X+r&a^h3op;!Y1X@HzdhlWWW8av3apPeXuR^`f5ke=n{j#R zZ?Fo{1D98R{j6aczZ$?T3H!@`lpinuQ|zhyfXnlrX=kc^dGXD%uUC20M3^M&WxKNM zD`v`bfL&4JQ%~bx*qWmHf;8=Cnd+;N@xR5|8E6l4)t>lwSCeqQx<~C{wP~+6dJnc3 z87^k+xavh|evx|2HqZS@_K(!kA*&0C%nl{7UCbqyhs;T2>WYwgmdEgWoby08qzUWBs`8;ZiRz$6)KTe#QjFwVm+r84SDyk4OtzjVb^0M z?3^S{AroX@v5@s8b&-%|?2E_WxkJ>caUrV@856SD|Cry$#9R_~&Ly#p-b@w_SqDhm z&z&*v=lnwV$|T&Ik#HYM!k$qi;-5g$9+LKuw1>ofeCLJt4I~j?E(!N(a-S>r^>Y7G z?tB-eC${x9MP##}yt=49+r!vs_nZF1y{qc|58J#WlnM@HK9P^%B+7^5YHD-aYEHXP z+ty?f?tG@t@Rey7jtN?bJxP?`Bog6Geh_{ZH0_=PI!i5!`E!=w*)ZAAwic01Y-is9B%BY*LVJ-_{SQ~9Di zv*DFm5ABaUZd=1iw2#9i%Fnb%l;#ESJBfG? zOV`ADA@w)(XANDPA2RQXG9NLt8~H=hmV?J!=_KN< zOm0W~(ikG}_k8dUjC2EX2i~8P_N9x*0}YfOnv#`@Nu(LVG5^y@q-V+t?9Xz6J?7mh z*t4D*?uSKFJ|C!jV3#SMEqG3^{F?HC_La|W*e`!mKA5y4ftqVLXFO4TsFQlvW;%oL9sjj}g&qthCDm?sv$&O2EA*+6}^|x*>1fT@K?fH5RGO z8BdKs_+A(%>5ul&oZ4Iw`|;S* zF`KR)qbO*m*3Qkkhkyn3*!U*@feBa#q@3^v0msSJzO+)z<&yL-;l8*6@$lo z=!^CfcNUDhgBc$EJ`&Fa#b@F{I?NB#Eu?XY<9h1r*au0YXsy&yA#a{TdCh=!4kG^~ z@;!$OeGv&goJ9CZpmP}giG-a~$RpmnxzsbLG2YLTKgV0=81f-KpFECy zNOQgKU~`Y5)x-z$3i5Fm#!=bZpTvAHjf6eFk$B9Qs(hGv0QQ-3g>h5l&T{0q$Z}%+ zn|xwCZ;td*pG12gao=E&?2$v?&j0BvDWv(9@(% zdBE66dBE&~{Pk7;!n!7f`S}&)E@qJ0pQeH4iu8ki>aV!Z=idK6-0!x%eL3dK7Px`) zW_R)#%#Y-?nr~4Ki>T3VSBMtM%{hQ|CW-PeSHzA1>W}Ex4dB84VCoC^XH$bF9h5uk zFAaq`itb2%mbhL-6EW*MrpI+&42kk6CZ>=mhjg(4iEzzHG}>%3P5lew6^2YJ72_3( z#7eD%{R>$c>66v5zb7$%%_aXvzR7yRkVM$+BI zfnXZy(Oi-A;aCU`X;WbwuZa7-fpGT)^q_zq9MJa%^aBAsB%oRN(dj=J(8B`yp@1G9 z&<_XnBiJt^{xp=cFP%pN;U3ex@LV9=h(Nf=>n@Sn_nIWyLmP1v8R<`}v0juuNJ5_@ai4`Kd7l|CL32g&H(uic!gXYL z__Mz<-dqy#m@5)~Lg4-5`Z zKZ$*<+|xxjBNloL8j0-U#S7z5bRqFi@^!3;${&juwx$16Xm{MjD&|Q2=}%Zf7+0MeeVR)o$rljsR%b8 zx2Ha+evJ932!c9)V4qH6-Z59CJl+k&v%p(Fr3J^kg@JI3)F0af+~33ckm;j6?-R{@ z18wF_kn^I`3hQFgXU}5w)7DzYVLmhc6aA$N;{$t=9G`ea^6@_QvyeM#QJ_A*gibCBd@;s0AYR;Q6jy_h%({sqvSkIAI_wYN?T-UD#oquuO zPr}}hNEF^?=`EyHSI=wMi(;cp?#tm_plx^`2bUyKGroRKj1X#FGvn$LuUbZ8_JW{ZX&PKfEIO zSc73ez#Vd0E#(@4fpf?3HD>wT7Ph{V}0ryV>`ZMi6mg2k@_w#(0{g~&AZ09^*oKNC> z(OePxws_+;PXjexUJe3pnZ0M2lvH2$uzB_ZSB9y==pX?=P6~iZ@_qB z`V;Oq?asmTY2Kfz`4;V}7?NbWN(P-TaE?qaK^StUi?MT4m}q_`8Q%ZDF5ap&Lt+0IG^1t7DBnDq8?DC=DZ@8#JMe- zD9Qesiu&O?i}SHLe?Yx7r$)VWCnxJY0hH4yXqHnh=p^8rk3>05B8z&@*{P>UPm})) z5|ukkdJdU{b}5Y|g5?y)yef^RYxD|f3|*FkMzLNR*(<33&s7fzIw!*O-dmY})N_9l z=Q^hUWAIr-ov3j<3FXIf0L}b$nbrd+hxv5J;I*1W{`Zh z9+uR22yM~cQW_7T5vApzQJe7)8YUTyAid2StJV0Y4R< zkh(0^VPqP=2@RIRI*cr@dQaCpi16p>UIG7HDt}1K^jC~iJ!vn}H{%4xsae#p*VGrr zs}NDxsW7*voRDz3l%E?43Zu&PgEe zH&TAUw;wbS=k-sIxaP{#VnS4n6LQKGOO1fu?d_GJ4 zBH7)xz7-Sj9was2M<gUBZ;?H6t-q)pnQ}HhG%A%h8O!1U>cQMa>l~@Sx zyYl`A#IMB0c(0T0Pm(v=)+Vt|aZgVcH;DXR1j9X-?D2E45Z-^J`wikSvIq95;&O4n zSPt(Chi<_+tN6UQT|6RQgZG>n?q>0E@eOf3iN<E}A-oUEaP!3N;t|m; zBq#W;$rcTSOM?L^1cVf_r#Op6?i|H{`ZIz#Mi~O z;vtbg2G@DyU5H;ST*=edisQ(>wzXU=R@u`v$$pq;$pN-C zPFyISB=51UQdK=mFdMfqc}q3ReY3*j8P!hd73O9Q93(wyiJ3 zb7Hw_o_k~Q4)GBZgXinwC*lb)F2nP$BW979Jcg2EZEGeu-nKS~zlcSvd+t|?_lZxC zm~`^Qqhe|e&%Gfz(Y9_A$B6U9FUTjcE)c6A;g{0HVzoToUK}M(C!fcDhn$Y_k$lazO4bHn$2d*CXN5$7joHuVG zalZVwSh*hbBHL<5;yihnI78ej{y{Fry1Kr{mf}6)vtqXfp8po{XYzg9ioeoheX*aI zLoUHSM*LZuhT_x!$(E5-+>K(-p-w?jT+alSD_{7^hh?!eD0we{FQ>_K85{-n5CJT8{Y^!#tg0>8kxEWROr zCY~49XM5oei^bY``YLiK=2vl%cw8*k-t#{qUfIFZeZ@KAE-~EE^Y0)I5XX^UVxAJe z5dRcQcJln|irM5YtOvzu;#zU9c!vDSw#sz&*j(%<=7=-N-I%Y$U&OEl_XFN}VCV-M z-}Qk8OOgi>uXIK7d)ulejbY3ReP>%}P9{8x)$m5KC%MNtaw3mY{Y~3VnrM!8C^mwD^?JziM7Qm#p}s$ZR-~4 zUSdD-UU7){u!tpzNe@c}LrmR<&x*4|OqIqRQ}=h*u5_v9&fdM|UVMY;}$1R+r^hS8OO=E#4ru6+4JGiMNQo z#D3zvA|EL;{)ffK#jzq@bu<2W)z5IMI8%IGoF^_6aa3)>uM$5HH;G%to#I|`zj#PI zDxMV2iWfx3@zRMEi;5-0vSJ0XnpjJ$FE$ph6Qv^YyN=S_%rq4X+ollZO3?`_cza~=i$B^|oVb59V?7VI4iO(0pA`AKGPL_$k>9_dUM=!_7S#M+ z1?g2Z_=f7_dOZ6)`k zT}tnhJ|KO9MEGzKkEvo668BXn5l>^eUoUnRZxMTu2scO^Ej}YIB|BrEPtqRgBjRb1 zKOk++%Spsnl0^72(p9BvNM9x0M7ou9ru5BXfAJx4ocJ7x_+ONsL*9sU53&oseyUSrGJw?BhBBR<^6?721V`r=D#35mcCc|Vd)Xl zlf>!b+hQJxbiR`QQ9L33EhggNfp(M@D~WZ)tHn&Qo7hLZUmPhuDNYmL5EqN<#4X}p z@h9=L$RA>-T?t~USVL?iwi3IDy~PK`9Pt^EzdOWu7l^CG&EjtHka$|OQ@s0%ifQ8I zVq>wjc$0Xic)$3#_>{=sp`<tjJF)>Z7AvP3Sh@HgS#e2lz;#l!H@m0}02St6Zl>S)UDIO4yi+_oi@wq7O zOBO4L{9P=%Hx=86H;KK)L85u?ittZJzbL*gE)v&>pNhN1gW^f?AF*(nXGe-yRcs)3 z5^olJi-W|+#3#fT#n;6};u`T&akqF-G|z{Tzkj3)my=y$6|tUpt(Yy|EcO+Lh@-@( z#Fxdl#3kYf;x_Rc@v!*27%K1CRa8tBtBY5O{GCtMZ%6Sqae(-cm@7Ujz9POOt`Ikh zUx@p~W8$A;INeLPxR@^15}Syv#V%qm@jmfUu|q{KzPrSM;!tsvI7yr)E)bWA>%=YM zUh#MFyjZA`mtHY3Rm>0@h|R@pvAftu94tO2P7tSvv&8x03h@(hhqy;PDE=m%7h@`W z_BIr66YmpW5?>SF5m$&C#V^GD;xX}0FYVjHo8 z*j0R2{6YLhJSkofV>7(?N{AK2T4H0drPxWlO}txtL>w(n6kil)iwnd&@ni7|@jLOT zSfsjVUvaUlSWT=iUMqGNdx`gpqs3>%SHz{_8u4Rsr+7d-F8(WqYj}1gh-Jj8Vh6FS zc)K`2940<5zAVlb7l?V{$KsFT5%HAxj~I8kXIDwFi`YxNSA19;D?TgE6z7Rc#Sg@t zB;I@bR{9qb>;2=>e@b7Fj;-nW$CGH+X(XNlR+ak|BL5x}<7p*-{yiz`?qV5@o4QM!b51?ei%b;U*`%KK^(?dy8E-zfKi;$z}iagsP&d`Da&ek6V^{w9X&cA5!(+lV)jJ#6a^Y5rYP+A~P{ zQ4;wZCHGvpPnMn{{RWA6R?2;o^ls6-HwOQ+(iceBnS7PU3L^gwF5R1ot;H@RUV6A) zdH@MK?~~@=m!%#lJyH5;>6fKnk$zixfpnhqTIp>h()(HbTmG>PJ@+&c>0K^;t#mu- z+r)dt5#m$gOz~ZDjmW=?%KV=Z?M9xC7x{N=>0ec>FE$tXcl+qyL+mFG5g!-%_Z}H; zs`$FNP+TQ`Bz`V_EB+$>E+#hi;wvZC5U&!i7u$Fv_r zNbi?EDt$uwZ!y%=OSdqI{+LW6-88YPSf7M_&80h#2;W`$F6l=}gqtEgQ~qy?3&j=U z2jZvVPVoSV_Jtt6dx2visQw};!EOe67jty zy-3WH`)2Vw@n`w}CjKeLT%m&Mn``QmDE zi?~lbCY~4FYrOaq#ByQ-v4z-9yiL4U93eg>&J-7jYsGEicjB+&KVrhQo*m`H+G0bo zwb)JULt>nHRGcdQC6;aO`PUL#h&@Ss&tQP`10?EWm~@WxIO*p}d=Fu!^c(V@C%sg9 zrSwMWPo(#fxc{VB=sIZFU0G~F-eFtqrMr@_r-yWZahN!cMEL2_tH_?VwNZL2iTgj7 z-Y*^(FOUeIbUg?=>XE(hdmGX%NZj8>y1V>)i37wTqInM(@l2!!r;G22o5Q+{0(0Cl42$DPTQ(QBK|8$+}~KbrF2{An@EJeUGBZ*Zr(q}eGf>FQMf7M z8{#r?lek+vES?nq660EU>6Id3Uk$OLXx?jvdnf7J#ew3(;w159vJZaGKzcq2yBA5X z7PpWXCk}{zkhm}0(qmCEO{^+jCAJc~ihac)Bkg$8MxJ=wk_Qm&Qq`xDP5A(h^ z!k?7;1-aX;y?EkDgiDl86DyO5uNH~&zh1hd*jF4TjuT%L-xQaLAB$g!`^6LDzhaR# zo?W%XrX*g@%_L!GH|hT3!{QU-R1*1pgY1ueKY2Iy{c_(SeoGF(`c(QfiTKY-J8eCE z8HxBxidDqA^1o90IDeUGe^Yvy{I`jRMLW~GuZ&oa zMEx`+aeo`>PSQQZ0VL8JB0eTg5@(3-ifhGf;(qaj_^((r%ZsuDQ~a zrKd>0E-n_$_Y#ng9n^@&d_MsUwexgwv65I{Y$mo8ZxVZxh;J~7m(w4So*+(>``}@==ByhINH>ZLyh{DRv_tvaMdy_lOUR z#*jG$UBOk%{E2Qg+*NWNXqqfymx~Djh zMEMSu9w|-|XOOt>ZSpa^k0$rE;ui61@v!(iIl{L7l`h=LOQ$FayUR+Km%d#33h8S} z+~1NMXAfkvMErmpg>xL~UE+`8Z{h_pwll&b zo)TgOv9@>}Ioh_eq`Q%@;}&W2eH!R{q#u(1qtZ{3xPO}5-w~I{eU0=dWDdR$Ny46Q z#iQb%V)#b*k3st&5iXTP`sva&rRzvHlWs2Ek;MJC$$hZ+u-tQ`pC)r*H;Hs+$$gIW zVsX8=mBg1?c1!OkVb_n+C&horaroVXE?&GzV!BvcY$~=8yNY*;gTzP03FLTuzg_wj z66w#DULd{r|5bKAaB@xO|DR=PkW@;_hLpu(5o;&eBpZ!3YD=&x2!b%#f61=Q?vCAA z7OO&|4Gm2R4T2!8&@G`sv_X(+5ClP5sit4i-&WH$Dm2w?`}=(E`J6Ln&d%(n=atNR zo^zl3d7gXDx#ym_Gdm;u8QIUveogk9vi~6dMfD%cE;!r7*-sopBF+i2r-=<>CyDmE zM!bo{-}^3jfAI)$EO`U& zOUSM!5r4AmX|kuwPRdTn?vg!Q_Iwh04~Wl*uZbH;A)(&q?U*Czgt1$ocrYYT2if zIIh!WUm!andzS20*;kX;e;$cHKD$lzi^Ye;q*VBD&k`>ezb7srZ^d<3_EPZ)akcmc zd0Rp3J=q_MpNO#wu>D8)UK5hzLOfVJhFpl()v`|z&k!#nZ^!r1$Ziv7i#L*Y;J&Zy zd&Nh@mE@gxy&?Ne67Bbn?9JlG5yF~ zULt;*ya#_rF8gM2vG_A`F~0Xf_H*Lv;zsgb{9Ur_tzs{UB@jkNbZ;{ylOxe@L7O_jbo?L?OkC1(r_*3yI@kR2-SZ~Yzt=J=eChmL@{C^y}eI)q+z9&-lL~XBfajm~QHalim1!DiX&%iiF?S#cJ|rSO?3l zCE+(icAM-=WnU}%yRvU1k=H${e^BX-zR^L>%Hu4+P+iR@C@l_c~gix-R6 zi#Ln+kjv5jBy=Aq(GE|^{*~;PWWO!@H?lvJ{U_O<%KoS9UFwbAZY1=-EPJ@@LuDT! zdkl&3e5~rfrux%K&*+b}pM=iE;uYcz;vM1xITp}(PpCf;X`zj>* z;VlyF@UH9+wEb_gdu0!rW&DSe*gr0wD%Octi8qS3iT8+0#TDXn;>+T1#Sg?!#GR8S z?%rZCxf1JP630;?9xt9Eo+H+YNwHJBPP|#XTYN}-LVR9)O?;1h8n54Fe@vnsKb2k3 zZ0ub~_cV8Wsi~lO%nPI;x*!p+P+BaCNWMPClUV{@z>(p;``!XNa+4s z9MWR!L&Wjo$>Mopt=LH7c+%nxnAKF>#gnn)o~MBl20yBeG+yX8%GG zarP36#WL|Y@f7haF(J+pJIPfAv1?`DKq9}JWZ$jrKUMv5@oDiDZC@{bDE?Lahgg_` z?sNG2F%o(2MtZ$eJl0p*UQ5D%hU|9og@V{svai?n8)e@?u0}h{UZ(BK zWj`;zPX4MO_8ZwBh<_sy?-SVtm%v8eUnF0|_YIK0E{Kg){WnPXpD6n*at-c3%5Kv3 zX4zMeFX8WkRDZj8Klw8Lex5|Ur&Ry6?3ZM}D*HFGe<%AdB*yz^s{gMzs15bVZyyr+ zB_#AGlCR)>3)$z8@H=02qnK8Gr|j#d`sL!LT9V^Z}L_A zU1&Rq{Prf1&%Uw`k$t%A3i36q2V|e9?Wf2-NA~%$XUM)-_7&pw;_W2#9uc1vUl)Hb z{!QE^ZT$BaK|D)r60a6-74IXF-!tNRavkE!{v(NeK9c>J?9XNIda2pII|-fP;t?ct#*3$m z39&=`zIdDk@&f|d#BMkOq?KoQ#?nUA-0omVtylWJlB&r-Wz4#F8eOo z56b?T?5AWuE&Ci#{QCckQf(F5-$|n#qWuCi9Z)#5Z@9%5I-Z|#=5u* zMEeXPk@sNPMY2c8E|on}_5|@%ajIBPLZ?x7T6U-Gxg_E)6dx9!5!Z_!iQC05US;+x z5i7)#$anBL5E9369*OuD%5IX~Ec8M>kvNWrNW_0w_Ag{VBl~69ugQL&#QvX&gReIB!QwO$ zy5AOmATAak6=Nv;`=LT{kT_TzDh?Bi#S*bp94VHI6=J10L7XU7iIc=?aVk00{H`xK zT{do`MDOJ~;!?3&TqZ6TSBa~|HR4)vgSb)LByJXa#4X}> zu~+2pMMV7}4i)*kAgt%_f{^$Li-`DXi0E^YBgJyDLaY=gh?B%>ak4l?oGMNe8_5~? zy#_HQrp4LhEb}`s%~Sf zDRz>$AJiqz7Uzib#RcL*agn%KTp}(NyTxVVa&d*YQd}dh71xRD#Z4scGi(-n#4X}> z60g&GMNZ_j3&o-28E9{@h&&VHSu7^c!s|S-l*D8(QY%Ioj3Y z8nO}RkGPI(!uQyT8_0|CdpF`H66fV+v4>3J^M&G8vKjYv#O-7Y`dj4h4)Sw}h2kJG zg>{|C-yP)V5&64=WD(hh{uhhMcJ#kkN~Y2OVmaA?{ue9BOVR)0MDjB9zc`8PME{GE z$;;9I;#Beq^uIWryb}E{Hj-WFe=$W~h5i>iNqkPOOPoz!js6$slC#nO;(YQN^uM@} zycYd0E+)T&{uh^$bI||dGV(g~zqo?@F8W_wMdEW-tHm|sT=c)Vj=UcIFK!@jK>v%I z$nT^7#U64V`d{2i-iZDex05%a|Has@uz!I57YC8J=tkcc3J#_HL-fB`MBa@47mLYT z(Enm7xd8nymXo)l|HVr3HuS$Zk^B+*Uz|iPME{GE$=lKY;#Beu^uIWryc7K|Hj<0b z|6+=~3;i#4lK6Z^mpGfe2mLS3B^RUr#rfpD=znn`c^~>;Tuk1N{uh^$OVIz~GV;gh ze{lu*6ZF5hip1v|R*P%MrRaZg9f{8otQR+s5263XP2^9}|6&i>js6$6lDHmk6StEO zqyNR&7hpev{uc+4SVRpLhmwz?|HUHmG4#J!Oyd3A60wxT^?RgPPCkzQ7b{6zzbA+j z$tThO;v{kf`d^$(;(9$roJ!()J58KU;(d^Mv5{Pf{ufguu77E@_F>XxR}KK;U(fyay9y2Tt?!)?{aYk`6BvXTt(vk?rL!jxd#0& zt|M{(cD=ZP#PxZjxQToP{V(>AYtjGWR`ON!zqp;meaBugHV8KE;}wd7$aUy{aVYr) z`d=&}-$eh5#pGM)f3cKYkNy|S$+yw}VkP+w`d^$#zKi}Bi}*U{1L%`yU_aTFyBvM4F71|jCDs^+dE0D zJECPEs1r<2HDYi1?!F;*;`1gJGRS? z)+0EXig;Z@z9YyV;yjc+lDrw86Omm_-hzB(Pa|;>Hp)(tx8i(|-9_Gp{AJH0e}wZx z_9Aj2jz@MkiFL;c*(*t`JJ!fvOJd!zLH0%x>y94TTS%-sw#)7%vF;eec^Ahwn8doH zNcISFF^*UEND}LgO4$=gtUD&jt|srt@ynh@F2V83PLf!6bjt1`vF?~Fdmf2($3oeQ z$fY=b+1(`89V=w7B(d&TBYQ20b;kzT8_8}Qzw9j})*aFHgvZPI9qW$h`oaFCjde$K zy?`BEFP7nWSr0q9K0J!^N%mCoF&vNVF7oG?FJvzymm^=|+J2uGPNMha5BYO*p zb;owuz2qw7u{(%-ib$+GM#_%9Hy!Ja=zG(#eIn~$!1YPnCzGqOE|NW+#JVFXJ4IsM z(ItB}iFL<3+4IRYn15t1Cb915mc5L`x?{EM==;^N?ufo$9r;7hPI{xm9#C87o zFN3(g-$>Ts`&ae>aXsI2Ul7;vGq5n?^?Uko5ZCQnNL;TUAaR|JzNZz}=kfc&#&vn! z{vfW$Td|Phb-3^=Ag;grleq4VB5}PvnY;wLWEZydCQr z@(%ot7K!V^!z8W;zanuR*hpgj|AfT6zx$!!;)2*gO} zb*-(lni>*yjSY3P67?O;&AC(ZTrX>DN;mZ5YBMm|rxTYpv^CAht?IkhwYJQ#zP7%u zDb?7}hBipgYS=-AsF7=0(ro2avSvs3YD}bR+G?5;b?MGLtsLc7@B1YZH4QbjO^J@C z`ld@`W%UiU9WxU(wY6;xumxg=3nvtxU;HMBRh)F&DnlF3%?*wJ7^^*I^xy9R^b9)TIz7<=iqnwIudYugSU zL`_>=MWVeUwL^QbyHgDq$~^P|o12~8*q&&;45z*G?{lO%y#_kS0W_oW;e2cpnUS4p zYrm6l3fX_g=V+f>Lk;4wOpP4f`7Sai~M~)Wk z<5$<(+>CQ_z!2>->aV>{YXcftYAYOCfSU0KZ+cz zO*1{;KCRHlBT(aj%*=+Fpl-AV8*Prw^(LydF`JGWGd8=fxqeJ`1)RpjNA;5<+aW>fE;Rh3vo^Z$)z;KE*VJKB|# zHKf~JhMXdz5scH6tE@zH32JD|_E3{%ZO?TuREq|xt{r$q;I&`gt^Fj=3lX{@(a>3k z$!cap0!>PtY-QU6+%n)EK{S_@8Jajdv$gx#9w_-)L~~Y6GS$NCWV*GkHLE3d$a5fd ztgkO^K>K1*Qd7n(Q>G)^JMaRgmdo#GGi7Sh>9(fYjx^l;&|K0c%#}IXNu4!d;OJ$G z-6LQ4ew{SLadm2MYU5!8!qkmY6JP%{cedD4F%hWo9mSAjAv3wEeCaL=XH^qLv_O)WE8T^pokVP*2iO@!)dPRdPuJw} z>nB$Z4cw-{O&lyetZqO4QH1}^o2NEgqqZrXY-ow$xrf>nr z)!N-L$|IY{uOH>i^~78!F$NkMI9T0Xj69)sbjKiew7P6fbtHNJD_4yE90D!>jL$kL z^Q4@^ryoU*+N@=FEWwwrxcOh#I4d!urYUK{^dq739;>=M8HEo0Xhq5ASIXYpj}F(q zGum3Q5XhU9@6pnlZYVqHTW22~9r}Pr9HlX%CYh{7L%9`$e|G_Ix9pfodrOlOz_QQ0 zrt)i|dnT$LXri+#ey$$PLMeIyFkmJKT$5CT@g>24JD9hJY&e&$*8(#VybF_SOQN}b zrmN?9VBSE=oN3%X(2+(x(1veI*&)ZeTHbbwE|l%5WK%lbggxzf<=%nA)r9o}DY9+3 zPMFE}hf){-z8H_kG)@Y4u69T+GY;7a1BPe+n4xWYZNMF{kaeAl9vjd*D(8E=N1AEw0<~W?(wH$9+XZ zTPrsV)bFNSqq_tH`|8zZd(EX1?$ZuvX4WM#F2RA>ur&m9!nb#`$8qN2x`QS7#x7%FTq9&R(RXtG0n)!$CtToMOs>2mK z&*9|p>*s**9x`qi46NMO&mJ63UbbTT@>FKz>ZSuu&lcSuu1mJIWW;!b zJG(}Ah5J;--?cn7VK9qoqMD#+NFZc#L$K3@h&u|I050sxhf9q;6(ezEw%s#xc z+tFS#Gp~bt$0Xx9(D2v1#^y27(GGpOB!`>5DUxg`svb)Q=gd8CL4>3kF1L5 zy{oJm9yTt!GcZD1xJE;Z40Pli@X@lu`u0hpk4Hbp;s&x8ypLeuE zaSF<+&vycNGTt`v%$;4V@#?vfOGIjRJ9{Pi1dLf% zX1!{f*-_J0j~egeK-hPOdJUT14McoKq^)TO_OuJ}Xx)$33IoStBl&MUHEWkX{hGtk zHUU5D6D^1Q3l7$PO#_G5#K3o4`0kP0rBC=Ajy61dz*~c0aNy-0V*A_CIhWcw10Ur` zB^%NW*&fj>q**27G0+KSmIC$-usj!lTu%L*W@ZsEfMzbIel(*iU-pn{z_OvO4y`cI zF=h=aoB{*xz-u$_A@N;Lz1m9ET%K&L$v3tJ+M)jg<5)@bqmE+_T>8sK~ekVUP7kzpFH?lD?)&B4M z?dU$XgY>@sj>O^=7`?OToTKLVo3^jZK>fh?K$$acI^g{U@bcz}(VMMh_?U4?4Ij;$ zuVs~yjYrwzBHKL1@mr#*#xv|@9^+$NHJ+i`JjN?rHJ+i`JjO@6YCJ=A#*U9dMSU5e zFs347$K%EWkcTQVcDeBYD%`O?c+*APai1u*S__0*Pqdn}%uEZk(k8{;{1~)#UdaSF)GgQ;g z@lk|mHNek;>6IKONArT$xVvfCU-g7e!Aa{h?L|3StK?VB>y|@TpAd@HH_>NfqlIyh zYky9Gro9;S$u8KyCLQCN6wlD4<}qI3s__if<}p6nRpS|U&)D%%ksqNBH5Ihm%!|Xi z_H^8BjpHeF2|IvHMaC{S6@WY<+gbQC5D4JW4xq@cj2`3TTs5A-%{<1(x@tT_wRwz> zan*Q+YV#PcaMgH*>d4Of0+%b89Pbrkdcn?UX+W8>0;ij^h;RbVgMzf$T`H1cq=b9MLP|ZhFk9E~}hHCQ|ALFX=4Atf_Ug4_o z4Atf_KH62|8B{ZN9KUoAKf;cms3K#>~d29$Ro0yHGVWh;89yEBilU2 z$GK`egPVDbk9E~}hHCQ|ALFX=4Atf_UIC-N%sj?NJ0CoQPsWaqiYf?uu+fegJ06cJ z2z#)mB4d{u4L}}|1FRfZ6Mt>Tb3FV+C5A;jG0N;3jkg`$LCd>QJihS|(0GdMN<4Br zxoSLv8y`8ITs5Ad+C0X`xN1B@wRwzJM22~ck9IzI#!=+#_^7CYunimSn6cyWsDiK! zYbr8!xv2oG1`~mmqhUEIgy$vh|KO?>_gb@GFEwGDLB?Y*HDP2|Mvw7vt{TtaW**~X zT{WJe+C0X`xN1B@wRwzJz`)py9^<2(51zp%W5-8D6@)$fXqSu~j~frbHeux9+2zIq zupSHoOA|R>CB$L6TS_gL;U-U_E|tO^?Q*-%_;T)qN82QkU5Q7IDp!qXaN{FKm8-@x zRPzzlV_Y?!q1rsgDROOx0u0vMoUPt))cJZ#pf?nC)Y}ELdL8&%V?Vzt z7?ZHw7OQs&{CvIT&?|-$_3-EDPH&RYbNS)Vpricg!(#QS0=@NKevD)D>%rfU`}y(D zqNh_x#p-Q_pP%1m=&@axAO1|<>8&z)F28Nck3K9`Z)Kpj#mf(WX7BXQMThwL^};B( zBA(t^@bmNQW&6RG`Qgv?o!+rV&*e7~1B}N(9~LV;HqaX}Jk!5lk{|cGZ*+Ek70|1q zkc!p28-9L%BcW&8Z*Tb0kM`9@&*j&t{OH4C^{x!`D!lx@EI;biSNJ_Ww%Did!Ozcc z8uTWsfAMt)PVeVN&*irXHuIwoi`9E1(CgkW)4%9?r}sGy%+Id}`|hsVs?Jj&@11WN~T!7 z{|7%mzd6ub1{dasslw&=gwb>Pbs-PNp%07Ido0kaI3SZBzP`Zeor_%j_L~De&Z)Lo zy|duw=T`;2MmRA)e9eK=JJ{&C{8km2{OH4C^$rO1y1o34kROlhJ~X_a-x}ym!oIdx zy}RM(=eH7iYv9EEjsodNy_C^&`3=Q9$9np(SiNMRH|M}i`{C;soL+B`UlH^;25qr= z+XKA?&>O_ILVm}1dM^k0v2mFneORpCi-F#vgERTXDK`e)M6ndY{72?~m19e)!r6r&lyC(sTJuhn~NduzJJb z=j*Na^sve4_29cHFkW1K3zQ#ySghV=`1yL9Jv}aW=*RXu9|z`-zeUi)*Uh+M_09?A z`)$zU{_J0Ty@k^|%ILZLmMTB`uvopr1HE1^zvJXb{SjuqckQ<M~=v8_7eN%qayKUd-cwK%&p|_MmDpv1i`1!{>1$sP> znBPgD&F?Iu=ki;j{OH4C^-d4;mU#J{EI;P=Y)N*0tDv`>LMm48m+KRw8-cx-U>J| zzq3G_-~C3<<=2ag0prkz#p>M?=q)%j(|%{mkNX`~nw?)^SuD0BM}7yx&(CiO^wwd2 z=69~A_m3dIrR63+`mosiJ_+(mAC}4QJozy{euu8#e#@X&Ng)-h*9|{Ezd6uD%29q7 zfVTavF?z23dXyi1SghVvfnK+l--YsHeisG#ZG~R0`T6`nZzc4&KieBWQmdX*o2 zSZsbr2YRc${A%P!{XM>r-F}6*IOodm3-I&XZ@rgaou~K5Aitr|V;uUh*!=!4$Zw;U zUxWO(-+%VZ&aa4iInLkD;pgYK1$vXPKihAnr?jS-t!!zTr zNq*e#XF>awLXW?%V2jmzFlfIj>ftz;-z+%Ok9yxVdM>{OSZuJKJ}g%6+CXngX(qpB z`EkGR;AVnY-n{(>ufHx%>u?HTltp#pZWfpts)3?-Kbj zzgO_!=Qm7x)MBxEzlNWm-)87>f9BUNKiYR0J(u4I>CuP9>fIjbZSnH!kRSDq4%)9I zPkx64?J`n+moX@cjeB6wF1=pdPWdtJyq&Y#1@G5I$4f01t9PyObH_VDe)tKfs93*m z!_RNO!AE4q%azh&+%q{QL7bjZsmc>~lJRqKtL1l<_Oo$$zsiq0!i)QD_|lJYPsM{D zcS@eP#~VKvcbfcWLxaV}Jq~_;+>u_~Yvjkc5AL5Gw;p;!DWqcc?lFEYZd!4_6ZqW; zKR@mSFYX-p+T-oOxb=^>3wpWc-C4%Z#ht6T-woo zS^Zl$&Yb@XgSf@Pc<%P%-tNWi4&n}$UKsbjATD38Gw(ZtxOWF}S9)<5d2ye{I^92i zM?f#vyzvzL{PtT5J;vpA>uyhPzR`32F;e-_hsE~Cyg+Zgm)~OfQJ>#+>gR`#2<6Q0 zW8>%IRw?d%&|tA~{{lb%I5vB6@0TCrKCoAI+-m4eN4+gp?|%6CdfU8q`7xa7N4+bJ zp3ARW`O$~P>RlG-^?La|AV2E8GbB5|<PkNG_xv`gXm-1EkYpk0Q+ zkNZE3|137{@}OP1ytvQEkNcf$)*EiTjDTLQ{`k7_bH`h%xT~PSV&i@letv(<^Wr`y zKgRtK|NZ{JhgfsQeb4y0xDyoj1=O?HxbNb*A9s-#ceVT&_t4?lajT$L$wXAF-a+v5 z^}3-q89qEeUIgh!z22fo&*j&3tf{9Di`Cl>KVPrc%WsYRsP~@HbNw*~dc6MGV)fn) z^adZ5xi9)MoNa!~g8YiVYVxBGi`DB6^hQFD*Hs?xTKO@*kAmxODfDuUmrcQSwL)=U zg9eL@yD_+~PVnNsEEUbRsprOhxALP8i`Ba#(A(nW_n!RNe#KwT z&TqN&sKsLS_A!1g?n?Rn&bT?hz2N5`N3R$6ed#goY36-XcfPI86ZZt;=i;uF-=-k$ z*Wu^K9Xv8~9{s_KdttC1TAwHGS;2Z}qx?Py;+`I?hemjDH+yl19F*P8o1wQ{T7+%q z-QedR$4Kbear#G3Z&PvhI9Pa`8K?ANv3eVev-PHV`Sr+;{qc9qy9MB`_|LK!db#G8 z9^>cwqg!!5GP}9Bo8jjlN79S?XZSKd#yukFkLA#-mlk1<-etl3S1dhhu~@z4U|uVg-^a$y`85Ue+5#`` z-=)X62LTsu!z+GJzLhJce59_0KOcj99Mh7 z$v@t?R*xbmc0BK5{9N4m^4mFxTL3>l?lv!Op%?d;J7>pTm?!R|#?QrFEI-~S^Yi-| z{QS6uM`z~yFL-gU+9x~iQt06nbj2QTyYX{zS1ImpLEKjO`EiGNad-FP)&~8%CeQIs z4f=PT{00Ycrv&|5;>8`}#XWcb?Bm^#C+=y+&mHe3`Ry6RJsE!f@m6?od5_bMt6$*0 z8F#hUkDfenml;17cdPvN3gULd&yQQ>#ogPBdnWFK_;I)Ai95;oxwtWWfP&}4mxH)f z@blwN@#5~|#XY+;JMJLq*@0!p)v3nM#T_cYq9E=`@blx=dvS+*ad$c_J8lv5FvYrJ z<8BXLH;z=?{e!st?HoUD+KW5Fi+jT!*>NlK94~*X3cI=Eoglvhg1G!`D?jcWFYbX} z+}fkE<5od0*L85J@pEw}EABx-+$r$$<1X;x9_+;}3*t`A6SpLYTd%k!LEPdX?h-HV zpSs}HzG&e*Wu^ut%n}ZU#|a-_Vn&IdM>{;%8x!Q_WZaf z(A((ccZ{c(4%T7opqDmMS$e5peYFL8IHjZf;-225V7*o~(ab~iVX^sD1$x8qhJ(E? zFxu1mYw-H5dZM{+5Q%wu9|f<=N}$KApdiw|Kh;7iLAANkieFMENFTbyQdjG+5?rN{Ay~pQ%e}R8DfPb#vrhUW2 zJ)S$G*kjrX+dq%yd2zpiZS-TlpOj|Dt%u$)Y5978gP*Ur2zscB#ueWSw|e~C9ZZ*B z=LsebeSE#;f!=B_zY{&ZzXa>a+0e^1Z+u|sYKMmF! zOQ1K=NM-4L9IPWYLvIi~c)p$L>Ae)JOExP%`mor3`&FQ~#mnzBPp^2-?0(w;+fy9<7Pf7C+{r%W`i&iC~AIZ~Lee>W*V`mosiQi0w) zFTZJ?-k*$~n}>R!H#tZ9eHiF1g5FfbFpN0t|%;+i!-a_khuJ`SqS++K)agR`32muglA?(bGF1nAZwV#k?Uc zUvIx)9-8Oncd@7UQSdr%ShdNIKEB=`gZ|j;<(KsI4m~it{YF4 zJm?iehxxU6di;%9n67{MfoA4S9~P_kY@pXYDwAK@(>vpc?ED5nZ{5yD%hx*%etv!{ zp|=IR=U#F+{r$e&y+XTI}((?5_grA>Z5_;R= z!2I~02jjAxRvSH+UpG!7*3*Z@=C>-)tFOr9*X8Neo6o7b^LIJ)a=i|n9(+zU4L!zX ze&6==Dvh4YZlcA2*k9->YW2Wzy0PxZ!w&h-?g6J zkw(wuxA}b2e)M6ndWQviBgbUgZ;q$;3+%&Pcje9~TcDS#{gz=H{9N4aiu>IlZa4h= z7|1E?aQH8VWhJ3lEHoSZclH% zr&kr+m+w)2^kK32O$_u_dU`i|dfWHUZojS2D>YJCdVe*3u3d_7(PzIc2;zPOKfj&V zdU0>{;+}^W5!}^|(_-iq<%oN_@pEx26&F8;9Tj`Lr^3&VyU~lg(2G0au8Q#Z4;i9YNeO`1x_ScyaNQ+);n9oqmW$<*xR4)6mN`4!&pnT->FKi=Xq3iap-% zz|W7{>&3m>i(9o{cHCvq%QYVyYy4c?m5RGKh&vX3e%!%hGxN~BUfixA?rP|bFo%$J z9Bo0|O^S=3BhT_{3F40M;x6&xmLdpuwe8#ky?P^+rFVewbH`hKp&8FV3F7VtKmT|~ zdT}4{;@)f45iaf&=vC#2`y=D$;x1I&2ZOk`z|W66!HfHl7k8h-vyXQ%^l}~VUhwnv zs-eem$@#C_)B7M8_k|akcA*c89e=+M#{Cp8zlS}&p9SM!F!XY@%l*MPn5?+Vg1Gkt zs9o@r^iHqU=(&CylrZf=9~P@O zE6`iy<@dO!_aoEJZoCYIUatF{w*>9n4L#12?6)U9z51Zv<|sej2YRc${GRgk z4#XtEU3ZQ4#x)XpCDQWs_J^O}e(Rw(7Y@wtm!94~f_2Wa>8AbY!(#LMBv|K68<&}1 zp7!(}9+jQnis`Y~wn)i5SiOhf=jWG%UL#zX-?N_H)ke?tZ+DH!k3K9`@5(@Ly_er} zo?hyh?EIEPFIRp^`1$#5_VRnd(>vbix%`&an*8YF=XYG7SB;x5c9bw`$AKow+```-|L>_m-#k)1ZILlO{j<`1w5$=oL=LYEk+4&fg7 zMFP>*%s!tF$=2)X%Dvug)#oB@+--UMt_<{ISLN0_Fwh$ezhTOauG= zh75qm!T%3n5RukzJ61up7R054U8BweGQilP5uh}{NwF<5PvU@cH!~<8)EchGd&AGs|_JtkJY-ZFh%{qokvuT%#D2q~jzaA=1pLF_J#id6S*Cp{I+r|1t*W&o7vhuQc zacMGnY4g$e`uvL<>e9s(75M(~x*6lj%Ns_G8&_Ughc8W@F?L2Bp43*<)zpls8Czb{ zFskl|*zw~KBKoC~Si#YFdIIFe$9CQQ3&#&C*lnjT#`Y{2TJWWv_9`5<)0boW?p#zb zykNhb4lXz>lX{dPAM7~d^TOE2|BaRLt4(8N_*sl*`~Y;Uj9;4T{W5x4@T-aZ)=qvg z>ged3{PE)e;g{P}cn8bz@U!zdciD{pXYh%NO`qg{d+jvsZM`yc%@^cnkCA@4&Xr>M o0a3ZZJ`rtPjvxPAp&u@ju2{d5QR9!r)v$~4pW9i_bAVd^A4cLbH2?qr literal 0 HcmV?d00001 diff --git a/openharmony/armeabi-v7a/lib/libwebsockets.a b/openharmony/armeabi-v7a/lib/libwebsockets.a index ffcc846e6ee3e49e8f89328dd5958a0ebc93cd68..298ea86c6fd48b5c3bf200364e46f9f1b52d3bfa 100644 GIT binary patch literal 1556918 zcmeFad3==B^*?@}xwDZ32qc+75DgF%6~ZduPDla-LK2d&DLPD&fs7=XI5T0fsED}K zx-V7x(Soh5wl3AGwJvq3ORd`0R_y8$K-^kewTpI9fA4edxiim9Lfh~6)BgVY&MR}@ z_nf<*d+xc*GkNZ~>fiqUaHI+z;5+0EzZ&dY@N7~Qc6zekbHAbr|KIojSO!JguTuZ(?@JG@{SH5Efy()ATdazMj}H7k^+i?e`i@w6 zmHPklJF@X1^`HEf&OTiY`u$5%mECmJ0l%T@X2svv$E%Qh!|P90_;zhdMcQW1igd)< z6CJTgDxHk?tXGyB>&fRPW6=&3q42K6`iy6z@g+A$)^#N|McNZR>13iy#e34RPVTA<2@Z2HgnpeU0rR__6-r> zzY!AI*qKPB51i73N21B~roc@0oGw#<4eUwu#1SPznf64xVGLe*nE9gt!q(G%H}jHjb*U6Q0Lk%~puC1bJ3rc_*#xml5Q@t&v=PCLhiv{Q*5 z6B9CxZB9q}Qn4g6Vm+z8WQ^%Zsux0LF6R(GlX^0mO!xH~rn|`Xv9zft2W6-O)|z8* zZMtGT>(iatWX$Z1Zs|%uCrBkYs;Q@o?(0cM(w(F@MxYdHU7|Nj^u*Ge63Go2p-_ZG zZ}g15Sfn?aj3IePG!5;M5)3a(#$w4xw4);#OQmAjOnZr)ig)*l@F`Q~QJ2I>krJDt zJt8#@6g|vjj0|JRjj@hMTRff3H_yP#E(wk?s2q7XZ)kMUHb zeZA>>c)7Qr5z+PCXeO7;+$6?DKGzm=Iy55E+n0>5+rkNYFyKs)~$;rW2VZP@rH_VtYoY^v61vL(H%+0yJLyIbfhaT;|D?@MMB?1dP%2y6L2V& zQ9?W7S)2n$rwz6Sfx0k7(zD%9M6OjJ&H*}~f+15G4)C zgkr#Dhfb=e7iKQK&V-r{ZG+J<^cgTQS@EX&x@jzl2K4pBA^mhR+LMZ>;pG(QbYng( zWy~g18`n`Ucg4`An2DX?q++oR5txeHc+5o$GF;Lh*T|#f#Oh9Ta3eGEQn9XByGyhb zF&*nNx@ioX?QuhqhLT~n3Sn|0BbSwwTWnpCSa&=PVRXcj-21SIvCSQQ-E3qsMApK0 zaRnhf8)IWU6(?gzHY}1cx}DLU4hSf@ndT0zgm9V~>+2hrw?;5y$l&Nqr+XvqU2(Dr zJQI;ZnS{u%z0=r08n$s6+2V(R;K?ReEjXGT$~NXY$W^R!hSe2?<{PWd6|@0%xS-_r z4Y?u6f~U!LG-f>vS)!{8HY47Hq%@l15iumt!vv~ehHpkD1Evl;0lESP4!6OQ=frXu zqTG7%z$AUx*qPCXh^ee;R(_Z<8cJ-3t37N+YYPyxA7K?Bn@{q`}a4>J^ z!d{vzxoaamSTcxZb%z=Aofl|lTo;?;nJ(yn4NE4rM53LB?!;6C1>}htWzk@RG{8uZ zLaQ!Jvu4f~k1UQ@5SVDV_Yk)u8IAXlO{8f#V=&Puh!IvC1|^y_2C1_H>YnJ$C2|cs zMX~a54|n35SuD~HjZYg5cX4~u#u5`Nok+vlyNpFnOQY#Dh6uMJhu;w!oWCxSG%Gg~ zfqRB5p;W;wL^Lc>*Am+{}7L0ZpOK_QO ziM}2gJkUky5Uhr1j&?6iT#CvXI(X+{zDjj-tujN2)fGmr+w>lfbhH%nDJE2OSUQ#1}6PXpkHI{jbh_@x7Z;_3$ zWXeuVP)}KVSfgo2l(qTjwz$bO!(j^$-$;`Tmo^~aOq%T5Im}EXGQMOF5X%Omo|&jL zDKiyKCyd6r@}W`1f)>Seub&19OD8tSWSSqy0>|Xw8Uy)JNQL{1xy>w=U1f8-m`4A` z(U(RF$ymBC*<&i{%7JUbyPNFBiFQy}a&`B@n#jVKS*RNp6GmMOBRim(wsPc2jWVHr zZHI!>Vi21KOz^Z!Gs0>9xwav{D7_S886{EBHj7Sg1VU;scQmUn;K2qJf3c?^oNc577vRp32Mj@Sq zeT?>XnKc@wT^a`N;MiufqjU4}^Q3GrJ~{?TPR;3#r8^V3x!SdzJ69+b_DN(@v2h(F z0ITR&hELM5ag4d@?SW?Uvbw!3Cn%?ZW_v|8CnrvRizv%MT10GWku}`z8ss;L;+iJq zlr(57`$)ytalB}II|N|7U8Euy`0cj)sk~@D7n?F117(BKTY58xLxXa&30Orq=|E+% zBZso+z-lWqY>AQ4BIeCs;I!JaE6lV3$%_D{3 zjBq4C22aK;MbF`60PQF5fpjNFk+ zEK>1Iv2J~*KqJpg@Bo=p94pP-!t#aXmR?p??w-MEkm)k=VE2*k#C*y{Gb7UxOqtyU z^#YTdkDhi6a!qW&fg3aFj7cR(iMZfyh*?y)c12U9X-VyBmj&B6)6QdAs|H>UArqwV zTI*Z#k`TugI3W7Q>5=IJlQ1`%jLE^0&KNZ53|EOrI>XN5IT^|tq$wHSh@r70wuNOskR7RNX_$VXFxrXcgf+KRWpm6X9i*gO)`6n( z@sEl`a_ZkPBkrzuV^eJd=}l^bv4Sp|TANEodirpxL(!?Jw7eA=S65}YR5e-*#Mj~E z8meex=kc?3wo-E?G8Lzk1IvK1n?`%MXg6m~w$GI^!{YyF4) zl=r7b?Txn=VRX`itqCh0?aWMwJ;mj{1(r3u`RDyM<=JI6;~XgVEq50~-Dg4(+YV0m z{*Q8r_H5yu6Ri{M5x$v;GY6E2HIUAOq*G~=>VOiVx@&6d@}pIlfZcDz{#DBvMJUk z;vOUtm4^KzgxX2#U^*G(rdwX-M8q;uc$}6K!|ZsOmD}@X6H8r7d#YUdmsA{^x4thGRMtY5}7b{3+$pGbJ>E5m=#x*^d zFiMff7FDih+6z9|($wY4?+S`lM_V`A0!+Lpi$$@b^5sl!vfO&eGW%Z`ziIcGG z(H#ju4ripmoTmyL+bwE013QppJkb$12YM2MrMs!P-3L%t&?5{!=Z^KzjKHH7)*8|g-+Z}ID!uX&k?a4UWm2@3vnjljHF2>DZ z0|?77Fd+MoH7C9~qa@|EsoFdHdQe#$=5_P03EJ`Gn6slvu!o-E8Y;)C^Vl|g9-g#Y zvkP84{@@UtCwAb$91iT5Bm>Zm_S5E>8JRgz5*j8QMwwHmEIsH^6bEO|%;NZQMmL@L znd5E_mD7r>D0ueCK68;seAq_S!#Eu5#|@kc2Si2*tm>F$IX~Gp^1{y!a*P#7_duXv zd&FuA27^j-v4{VBYCR z&l2|9g0^TXHhb0-^IW^Ky)rSi0E?Q;#F{cJGX+h_^imF&1(}qzn^IHAwoJhT^v#B4 zbSyt@Mm$qsm%1@9qw8a+1am}adlIH$ILf#W#J zejGJPWhteu2y=*U7Q-ZUFhbvNobrzM#ie^y|E_&XE!(H2UAq4mr3#9t@7%AaUEW`) z)Vssi7Ve!?y=#wBtM~b%JNBF~Z`VHm+Lzw)to_0MlX`=mz`U0NlvdAsdjAnftD1K0 z88&a%9;f%^HyrSNN{v=`BmZr?;72~i@bB8SkMefzesRA8zX$QWi04t;_EJ2G<6N<8 zpGF+dwioy7;;Oxx!oX8&Z`$we-?7)PPTPYfeN(Ru>^tJiL(K@6it8sixg!&bEaki9Zi{AEn&+Hko`C@>Na9w+Z<+A>Vl; z9kqk=)X39m+Pz<)uP6_juX6?R>_xlO%6*e5-+2r72B^MG|D?W6s4v&GjQVV}gY;Ba z%ERPawomo$-tY9+qP{EljpF*c^F2U)n{0h;zP7&Ee4WQ@M|x2=AL$bivU=A8L|475 zfm9D?-h#c<7ap}@&p4%?Q)^$`e?sxNz5e2J_l!6+vFGNIh|^Sy@a6li`0TTXwiN&2 zP4bTeKNvlC5A~(9_K7zx{_L}Yvk~T{uo1iV3>kUu9;f)Z{b=(;!%8mM;~{_X#e26w zzdXRRfzGrG_L2^HR14%m`t`*9e(2Zx7aH9noQz7-=kB}j+Ez8cx~6u)!bNq9m((w9 zXlz>6+|s&y#mZHyPmZ>=!&~%R*|Cd$5xTDA*N4V?OAoTa~}mFk&rf_kQ7Lt{KTk` z-bqET#g}VG9wX5a&Q9`>+z{f~X-nWVHh(4%gFiO+f1cqjh|3w0M{?JLO12ykpcj(> zbB(tXa0Po?9|62=xTR?KJQi4M7vLK9HWA!txCFNtF2Nm!I|(Cb8onq3`S8cKfQWK@ zp)dp_Ye$_-U@EeV;7^>*$prsk@3MoDTRG>rtO8JDyae^^JsGL^W6SY^D#sV{PyI!7JEvXkthw5u1eYK|E|)kYqaoS2M3Pi; zBij1sa*-#0+(jF;UQXq0#g|(}p52CUc9Lf@3gP}I&kjTAo#dh75#rrR9_lj?&Q9BT zoQAsZHWQ+E?uLh|3yXq$`D1G{4^%6@=s<$C>}@6Wxt_f%3CJuU0>O9L+eAv$&)${q z1H32z5eUc(V8oUJ7O{6Z!5a21Bj{vrQy1V0_Aa-raMVg$?Llfv!nz1wG*9t>d&LmW zPV&q}R@`v%P=+A%zbhZ4=Z`bOnK-P(r-v1X#|#_cEXNYaGfU}VbtT6Z9#`lYg}9aA(ctdDXa)lM`g*O!?{33T}payWKWuCyY@Eb8prb|;2eCNDL%}j zsDCvaZzG&4s{~b=y382qZFyNtXTMv#i)u*d~+4##;5VV?w2+pZv$enpB+#$qV z!sJ~*9vrpcP{`&&O4-5L z9}kkNWyl1`&r@jZdAJ4dg5<(Y=w|f7WgPkxg^tHkiEGNC%0C@UpLb|AsyUS8ttl3F zfL8t#{6QznG9Ah?MpQ*jvY*C9jVgw9qJq3H; z)A93?@>#Q{&zRf3ZqBr6u^DsbOq<(2efsQmv)8r5(>AL;8a+BXds;L$qx}d~d+b#D z0sU0`h_O4-vjxA5qaVyq#S_eA2c1QyW=x$iZ3h0PPn(*viz8}kcRba;CU3uoEZ0z$ zYjU$(>j?ff--a^0r z@5ACr%Z+QDCZz&wC50KymJ^7sTlFes(WD42X+M2Q0To^osJmT z3IBcAPy%F0hQs;aD-uRr?#Th=i=o3qK+kl1o`NU*y7nR848MLsJ>)xdiEro<-`qvM zuz$O+V6ktKzaHMjK965_FZLDa5_risqQMt@(68rj_l@xDlY(i#u3GF1`t^y6v&`dt zh4sGDMI03H>u1zrUlFnjEcPAlzko_oetrKri+w|>=*7M%i#QmC7WwOZ1&BG+f4*Pe zhZqGMq0oP^&kuItVtogge!W{6-w?n41u{T(-vHn7>t8EWaCl8?qUFXb20PKsP`$4E06~~zRBBt6Bhf1_?P$!AE0usLOEXj zdxQ+}2Wxzzbb7IGq#nB1r*#U#xoEJINOt)-5Ba=)PRE&S=S;RElZz>j?LLj>jqv|p zCP!s-5mf<|`M;@xUtbJyjPmP$sNfsELrhmeItAO&Binre|DSyo=lKFld=+)R(cBN< zo#(4qlFwV>n+QQ6MsTtI@N9ILUtjG!gubIp&L{c33oiQU1_v^J>uku}Sxjj9i4-*V za{?=^;d#{upIzmmVf%Sj$)*UX^$4fEkojnJD*UtpHlKhx9CQ_kW%xR(P?bwu;t}os zXyotyXoaIA*GCVCU*rm<+6~L2N9561jkrEqVR_{GXmybKoYarlWRKpFaIz^QQ6IZ> zCtHMn-{!V!TTLnMNUSqR2HG!)Egwq_njk$0Un2Oh;6A|uWB zu;2uUjOclSDZ$?hZbg9ld&#IV9wrc zay+DP2l9_ND)CFPSmnZo{8w7I|B}({hW*pE~SRb$A(qH<8H@AD0ds; zkX&fY+j1$sO#`ob3yE$gk9=%cBWUZVpsQfBf9Yaa?-GQ$%MF&|^cjIvF6ojjm)dF5 zz^hJ2rN{=^j}5B?!=2x4(9?48C_kG1Y<~0Lr!;m5Y)5`{h+;qFr7x1_#2X14nK=WK zFp77I_yPRsL_GJ$W_<{l=&D{DM)8id1klDSfyeqO_!h)lOCI@9JLoeUk=*Tl*418G zRoM3Gy!^Zn?g&)Ger#Evf#J^YZRBUi2aa1Z`OyIYrvA)l)JS_Enw2x9%Y88Uub&mp zJbK2Q+2!>4*Ut)fT)@R=o)wlsV)VSL7|#lCyK3itddBDAxzUg-cD@CRv%g4Py8rbv zUfv%pz7+nI`+D$9YgF;&dp&D+?a|wI?P>nj`FjK7u0&iskD0b>kLUe!`)M8VING`m zI2lOuCD}AOOtJoaME-l}8KS>@*Pc&5`|P){9QzuuqqW|&BpY7j`IyVW5H`yL->>OpaTi|1pud}{f8kfwM$Kd4h_;4 zdcI3C^+2Y>)vl7)ou|uQLjE^mFueesqVFQ;*HiKZsJrjd+a{)tEw5kM(h^zJ+S(LZ zR9jV3+uU+&dBgJh`toRJf%#bi{igyVMXIan>*rThFENqlH`c6E!#n#tUZV106!>G6IvP zmC{fP@MJ1Th+zD+64c;JY{IR~ZlQy`7mfFKfFPI9S_CL&Z_{MJT;rw8=u?63Tzvhi z`D$;=)n4)+&-4nW$xoH>E6}U1_EL>*LFSewKdpH+g(HkVc`Y!lZq2s3H4_mjP319` z&Btbl$6r()IYY-QLZD8|+EM^TiKl@8a(N2mM8 zA4KQ-B|bi-FExktWhIDE=ripN4MnN^K*2W`%?Z0mNMlr%EG!&aSX4L{%!9(N^rJKF zN5~lSIO1UYIASc9B$7QO`y}E}j(`N^=6S`qG6?u^RCN4+@=&JwdIhj}Kmil6g);P#Yq6os)d}V~VJUfpqj(xE_53T&?F)1YHZ)r)l!{EAMX+ zGvMXqyC~Et^k~|DD!mP^qpyVPG1U=Ee*{Pce;KH?hGBka&M-d1b3F65BF$&3f$Sc5AGcO1-Ntd z&2W#=Pr*G_{|)YOdKjjQt zQLD$oU7$~Z`*r|t4@8H0^*r4HTIr2&9eqArkNy%|t#60x)sMjS*~m@$#~_t{1+Jst zgzM3MEa0^s1J|pMgzMAu;QDn7+<;yOH>l5qJ49a%w?N+lw@^O-w@AMLcc}gi++q6n zaEEI;aw^s(a7XA#a7XIn;Fjn{xTU%SZkgTzH>7WX8`ihM9i<pj21DEz`%s4e2JhVSPH>QF;%V0VBRk$AgCS0%n0B%tK4Q{daB38K`PP+v?8tyhnk06h^#^dLm|DLIlkD}JK3q?vEu@|c*U@X?di2F`wZ0p!SN{sG zPk#j0uSekUGoWkX2K5HGL-Yl33-njv7V78W7U>V+4%H*DwHu}s1Q{0TFx;Vf4%}h- z6u8565^k|6vm3{UUXMrXE5TFxcDQc`^pk*h0{S(;y8-8H63fx|3## zQ;(X3MxFE<*h82prS3!o-${FkM1VTuP$I9wpeVQl@ig4 z8WcX@(0kZOjETD-Ib-el3PI|TUz-_wrb@0 zkhF8n5bBo_>Wz|_hryvPRNgO9FL+C74l8?jCi>rT#sxxO2KVc*xz3b;3KvXJst*0) z92;nI!sVbI!{~8N46Jg(k*P|hp(xHtfi+Gz28s%B<^|R|;Vw&61v;GYCQHo^bRw5S zl=>K7XF;IL3GYByf^u0H=yk$hvN0D1(oXnll*f543T$@5ciWhCfvryXlgXG60!Y^o z*ye=4k1(bh13R4X%b-Y`oMnNFobWzNwFEA4!hZmDG=%A#61c(%JJT>Es4i;)*E`{1 zpnAuFiUf8!;gO)KDCXM0ElzkGD6UI1aGMjJo2Bk>!i}JoQp}#f-A;HjD3Z663f$*} zF9Y?%;h@ri?>gZdEY%ly#0lR5in_wt7c-9F&4~p|VGw^~F z{*4XW8hFte^`@oH4tSkIcRQp0VHxLuaR?Yi)1{nkV2lOh5X(3hjDx|LX&KwW7z4)f zmT?{!*lv$nV;MWZI0%f-S;qNTz=pxN#4;{Gj1U+%TE>N7l!0-(Wn2VCDHu;pl!|>G zj1n+jwv3Cx7zxG$Hpv&j7y-r)EaMU|ioy7WWn2oza4_DojLX0n2FAyhaXA=6!6=;} z#a;nM5f}$q#+6_cf^n2(Tm?n}7f>}#(Q9F zA!WQDjL~3xY8l@F9i)HI?V54`Gxj|24` zQr;&5uQ}m97;&b)A9&pf&$D4q2Kt?Flck;t>~X^FmU=p{*9p@+&gq^B>~q3r*svc2 z-awv~dN#1%314EV9|qoZ!e0c%b$KrE76ywAdol2~6TZh%F9qIl)InslnjGh_Kxh|y zza;Z@ctC~P%9ZLb0dW+FAAz`_6vX5J4Biq@NU_=%`WjL^LrcR`d@A(zSQ+MPeBRKX zL9iV;)fWsoFcY-Sb0WT?&>|2#a-+WD&?*pY8rpoNp%@67tDJVsP#l? zy+nsMfl3qQ*Y$@P zrZD^yP^=im`pm*`z)~ah=L%IRX`1&tsBF*~O_{$4uhZ}0Wy=rX_ir835B9=8&EboO~dZy<~t`vzn}3zS2sy#0_#rhqp+{?G(l+FPE03eYh6lrr7q{R1H23D8g) zgE;=AcPM9l$Q*(|pcMga6wu&p1^9wvs0mUH_8&@B!XvG~Il%KM>S^AyD5_@+HHxDi zqDrZR(i`EF&4xymmpbLXPyoIl>DD-(3J(WSMg)HU=Y&gb&;*|v5kAOL6+ShRr(#Yv z(WgqnM<8rGrNb`_O2gAEb-1s%RB;VV1syk0YzVGfu^LUAoE=E$f!w-*f#B$+V9kdX zdn(IHo8ccj2gD@L*s{>gi0}Y7oZ~}4IP3gG@X0Kmjy$lC8YG8in3zv z7$y!Y8^wLG7K6w$sjNIyi8R#To+HaD)M!$jTc{$BdrF^0;_@HC8C!%n(>zC)g&suE z3`#j0MgJH?7ZLMO^llL65>bPqe+%L(L@X>T3cYWM#i++$Ks-+&4P~V~oVf1G$|kGQ zIbe^YfnGwql4T%`!<(YDlSqDEC3!RcBf}u#3C=RX55~D(=XNmFnFX zH?ze3p?k8#chndXJ2!rtOJnD$u@9C*8=a$E)4&w>G*IcD2Bx~Ff$8pPU?!%4b;xNa zHDwm2fzv@eO~lcd26{lyn099S4i0?|#Ay^V2Xn&ZAh^ZH_$op-SmIdU#Lyiecv?OV zKkFX*$MM+KId}TAGupTOD)b`au(7_|KPmJ}5S;Hl{>h;?L9k8#wtrga@0PgNKPyy> z^(|ZO`}}i56G6~U%DLY^FEkqjXYd_=O{f~gt+dpCz`rQ82*kZaJm{|vtp>prd)WW0 z(CLU1EtR{I7++W{L0nUk`oL5>NX3L*KK+ zQ~o{UcZ1-%J%bbY;r-)(ZRsC?9@anpT}wX;dT9Unzgqf-po{v)7eaoV{yETv{o_Yj z`gza={o^NE`UTKK`p3_<^p8LX`^PV`^p8OY`p2JU>7Ri1_m7WT`bE&b{_$x`{}i;h zfBXfO{uyZ9KmN;>ehIXvfBb!x-VNI6AODo4Uk0uE$M3fE&p{vh#`rfZ{R_~CyrITW zkFa`sUH(f|=~L*ovX-gXaXHS%Iy4D8Dl>0u6*|EZf78LxN=y7*7iWyI^A9~L6hR1C zPv;YTaH!i79&deUBZ!?isBpaAt)X;h8)!E%lvln~6`w+%D*y6?B z?^#Q=dLPG*)l$p7*!#U{b6Mei)(QXJQY*dK`;DrUTCehA?{@?!&NBij(caGkK`~=3 z7_|4BWn)CapuJzMWwe1od%sr8Xa|G#e(Nox0}Sl_!kaB4=Ee5m5>V4frd?ia7_JA! zQtbBjJK;M)v879RvAF-frFy+s&cA4>GrVu3jh0G!-$jpFD&_s16CMtIrInSF_Ws@p zPqb8@_kAZ^4~o}*o4g-lC2~8|kM-VBV^4*i&2tXYp)JtMt4I~cLd!FzaGdsLP2qT` zeCBvzf-VZ}LK@b$BccEIfZ#2`QMxp{C76uC@E}6Cxl=G0eguN8>{MMIdL6`5RA{ZP z2z>&AcMePRq!9igM?Fs=je2ruA_(rFWqMXWdn?qmdYVY-q02vz+i)P&d)gzaEd_!n0vYxZ`fn$2;L=2%{yC^Cdmc;dL)l z|D$WL%SBA?@0;`@C%gm{A6@O#^-lOvP}gCR;q1~)P;XFdcy89MPI$MazM@w-;a5Ph zIsB?#;3R-+cDGJrzh}<{?$MiFhUb306_kzn9XwSGueQ_!dWRE^TI##{A}74TQV;4& zaBOF(hwxkf@aHY{u)f9#f7w!x=<8vuE%kkUqZ59}Qcvn#&Zym>SmB@2Fj2QSqu#ZQ zAAoTP7#W-OEEr>NLD!+{S^1ySUvt7oSn7HGb=iB!Lay{H=+W|9;f$pRzsGyF7KA2A zM|;jHP@$R9vz~Jbydm29@JjdGf?()G8**MjQHV|?Ipq9;;?R7A@Xq0)g3{0?OI%Vg zDs-VGE-N@VbR`H9zvs$=^3Y9|xVoSsbUO%Yu;N#pOg#PtPe{p9iX#LII7=tCxt zw+CLHFM%FAIrJ{#Q`0>+7EB5K%@Q{iRECD2g1vg7_7E?)__qvs+w`A992qm>CK2AxC71;7$?E%3E!dN z61=J6Z^(oCCb$znyE$C^H+w5c4rIlGUkz5!X7|)`_`g>F z;_KjZ{0F909CCzGpHQ3!(Q$34K>2z&fh3$|h!&hRp&C#Wd^_8Uck#Oi+lu$R6(RU{ zQqBJmRHe624&R_0?t?Rva+our955^RVZ|84T#J=(@K36u59OXf_5X{v;%xYt|8cP5 z66^n4QN<0`|BvE|ufk9A3VvD|x&!`p@+)Ul=zb9A5#ezT4m|lq>5G}Z1!s&q4 z;3HXSJf^b!_=LA&f|blu!E8T1Q)3fzR>#7ga2WpC+W>-ujAm@(1AG-=s>DP{P1ja6Uz=f^`%A0w@Y5E2i5i5&rWqxd%5x6~0A@AA)loxWW1fmlFg}ub2nq61o+){x_63;Z>#m@RaYT zRPVz%kD@Ohn+6mIhdZG~@KjRXBODc42BMmX62}`l1w=dcenedt3 zq$-w>qe>TnIZ^zrxe?+ZOGqrLv*K!|#faZA)MtLXL$}1dp9?Bth`JicwZa&R1F6aG_TP zx)660MLJ^Co;9P!znl z;tN35ze`lbjn;pex8i2_S#7QeD(}@G@Z@g~lA8ul7nFPeQkDJ%?qRPYLa;m#gp!^F z1r0V%I1=CuUR_ZEWIetXamOQkVhPQ%+=;*3s{#BVmDczr-0?KYaidfzF-uQC?DF|=#vY3GPLbzw z*Zg^f%%3R)d#=R%ITBHL8otU8#oG+_=pArAM8TfV`%R(r;I)JngXTHzceRw~o)y21 z;7Mm-y;S-Ld}DXPH_G|3=G6ditzX0n`f_mj4B)5O16>b-#*p(fU93uJWm^6bCH)=v z-|@5!4fVq_4CBJnJ`{t4c4fRmI7N*<4BQj2H}zaPr1U8GkD%T>lAJMAO}mg-fS|+1 zPJ;*!8@(F-Hh4W(jX28dxqL*Z6$EWdJXegs$s!0o555wo4M&ndM?N-_surY7^B-SN zeidP!PmBtX@TREBH;L8il&}g>25RIVDTiAJeE?n=oQ1Ic0h2TRcuZA}0n78X;fA%z zhhkYr|2zL-{lEH8W&BsW+%r+x{vZ8M_sqYV(|@hwx6sWkk%q=dRds9KirPqXRl~ws z;m%*(TH6w-T_)s$I=sM0{4K3j&8>9}3x%w0sL2xYJL=jR8+Ua>Yt<^n|D|T$G@erY z6K%XTxCOtq#yh{KT2q1mGQRJ);2_1>Z@874PZoS8e0ctasXb|kM|p}0s%@^WZQyM3Sdm5373EZ z@65jv3=-o26_NgFsBK-@*u2Emr@2{3G_GW}-*e+giyLZJVrZ~j>l&a!4Xt%mt@$08 zQH#db#_C4Au05kmxp~^xyVo~X)kJDnwKiATyyfNJ)wRv7E&no&RPA41FN|)ub`DJb&=}kTJ%e9C5b<1f`zrM zk=8{>Q3C^$o2II!1|zG!KC&P$pr*Ed@PKMaYGG|;X=6?8;1TK@@h>uzXKqQ$8x9a) zwFH7|g?uB;wab>*HN)IBHP@{`BO|y}A~!48xu#kSPZAufr&#kGyMaiQ8(ybZwY)xG z%c>XFI+)vD4zFo$#9bevzPaJmi)zvPRn^tC_@}Do zx`m7KC68nrwy1S!o`R4n%70+x=GlV0XvozyENILPS%^MfLGxoy&vPA{mgdEE3Fbg{ z-D;w>BVu^|g&k?GS{Z3xm0JbknH5G(&4_&fQ%*ruHH}SqZOO1BG)W9Bqt6E#Dsu$(9WH}_w z|7+KdO9=QrY`lsZ*8!*0(w2ph1@(<9Bg-3Tv|}d9aLlqLL!v^p3me%UWaE&6Q*AP_ zNGv&w1;~~cNp#UnOKW6)EvArKB~;@QRU_W&W@snwZ8bB>YBp0C+%_hHTbfr$92b+6 zCyzuiRjtcgTwJ;~r*;*jk}Zps4yMq>;{0nG8#1+{GG%PE)>SX5%_)e@v@3OfL#s(c zu@K}&W#WP9uJB4SzPVL1F(NCP7p!)t$}MhXq=Aet+Xz>z{5rI(6q&jj+S2T8hKA;$|a+wqVIQcwkK5EQw zlQQ%on2|G+j61xpWpKW&LvHmgH@9Y(2WiHa#hW{K32A|`a|uDX&{tY}yF(hPmZJTx zRP@f8%*)s_7sS!+3q0Y}V=auCMG>y7YQ~-co(9Y-)#y!l&D;o2P3`>UILm;KyV|5M z>lfxi#*9X^?5)SzvY{G_StQ~qk37|l%dvo=T4nBw=dFD8QuBZ2G~8rD&13O0t4a11 z2%~K}hPxz?P?810vivN=){G<2qG^UrD{*KoK>zP9%H`tPEemqai-gmlm3a}}EMtRk zE&)kk&Nr2l)i^TCCZ>fCEqO3ft0fw*>jqTX>MpH0UBW=4r~`Snw;NQ+Cnw10KMyQ- za9vBwa%=_d$onTjGX@ExmkHR@02aQhE|8Zyg{`7k)d3Z;;XIUi84M+-Lo9bDcJyOF z*VJK?g3|FqDAbG++DpT%c zXC@QAfv$!_WIZfXt&Ju<8EILxytSrrWdoMzn1nL9*kBsh`AN8Xbj-@9tmeQoKMsr) zo%TVAX){R`j5G}<`P_JP%E5<(`PoTZ&5)M)Wzy zxumWh7B4a%uaULeumeYtJy?DOqmDVfYWrhRV?FJLB2@#sil!qdWmOAi-T74*d~$~w zUt>zIp@pS3Z%N7eA|z4D&u&d~U!&rRXl-E&W=$MIk%-Owjm2s1IW}#nzk3X&i-&BQQNw_xq**KXl+-K8(ZF1iYbnyrnEk@~7;^E4~B>RA&`>tCEt4$_F_*zYxAY9{?^#7sPR zVYJ6zP*qpI9LEd;BxHMxGT<$k-KlVo(=~_uz^E^!=$+6J^9t$AQ$M*<53i3-t3G~$ zrJ|jRFIb|hyy*3XieDB@K6_hLA7am(fvlpqH<0*vy(1{RKoR$bCf2RPWl;QT>C7`g zTr-(O{zx``HX`;=%)FOTQ{Y_6gfAbZx>F>2DP?NVH)Tgt=2g~;uIDaihuXlGteL9F zO^C_OD!I8gf#!21Y#oxD>E+kN=ZAi{LaG<1M={mek;FZh8*s538U?Y$)A49m_Ihsk za9N^x4xU%H8e$xeP=q^(p zU1dn^$_gga4~*s zO_*3mfoODxGIt-Yi$nF++vIee7u`@v(fN)&zIu@gAx~;cDvg^)=_){l)u6c(n{zf5 z%zCK|yf{8aGKF%{WvRSLgI2CzuiE-LaF-fj9fhYQR%BzeD~@=0`=;@=r<1CkZmFZ2 z73t!^jyTFpZb8?k;vGmuQ7ICYYo0CBU0!q@b~o-dkAuKvYINBevS4u~V`uc?2E@!A z_AZ;t;pv>4Y1cymTpV2c8HE}o2gGr4Bo5y`$*N0>W^6|3dbJKxU)2X$q7E2>oAFXo zC?078Zl+9fC0Vz-;@xq`EY(i70UC)Iq^;>#63UJiM7yAzN!&|j9yXghEsb_(irSQ- ziuRF+1{?@jEr12jc~ec(bNHgH|;_SGr~-3p@}3T8hlXMo^-sYFPf&y_Rx2!IJ#LSHlap* z&mc@TUG~W>!5vVzL)FOEaC*DjaZ6>Q8&)KhLK3-KF0ak@O4_{MBz1Lnqzn-*k17gz zkc6%AHky;UEH9%xd5cBp2q`3wB)Z!#iY&;K(^UqhEl_7-lF=YBz*vjEL{i4+2X+rRya#2DgJ&YIJiZO6^S~aMNh4hYSTs zQ-aJpX_zv+m3RX#SL{VFnJ5t;-DDa`cd`wp>hLIroHnb@=@h4jkT2F$otVdA*is6q z`+Ck!o(SG zk3{?MD;Az)B@wST__k0ZNaM|NdlNKsL6cSc`gp8oBjzJg{gmpV(F0T7XD+g|^QXB% zRj#2#&u>N(Gxv|CF!o^Rp#4y|^>M3bsyzx#!|>c3!9|OT>&V8&@RPB=6d6;A1}&ng zgk}~K&UtpnI^xk}9Jbd?=yZ9fOz701+zhrcE;--~5B*7VpTe7=v7Rt87SqlbsIunJ zaty|$BVrZ>HfLCNc>-p-#y$>P*VofdGQzeDMjQj3Oa(92_-YW0YB70CLX%K(k_NZf zUS?D8W(%@DNS7yQEMPV!lwI?r$N+MPX|m}_zO@;8XMa?cgf+rEgnL727B>A#RpndF z`CjzSzH~=o6YeF!1@bU1?U2{TSQp<|Zm%sjn7PNC?`Y>6&9nEMXD>GA0J*OfE3H*@ zKl;+z)dbA@s#x~*_W4de}xz?`0BX5Lp zONhZwgk&*SU8UL~mSk6S3&akKNt(o#B+AoV688hsjWrZZY4I$+vAG6Yjny~<<=EZX zN0hV=!q3m}OFkaxm-b{aCWRQjCvagrc$7bz9_S>usB?}k`ET(A15$(n( zCu7E$$&))ATU0Hjb_`%D++mH;ybc$I+d)8;@9j2i;JUMydys-M8y^$HDjNmSBy1Yb zcGE}!t4hw%%)TZOuDZp zcmpptij|312)s}us~ACJd5^b=7IQ>J1h^_>H!)TA_Cg#Oe@0fyTwITB25s+57hqqP zQf)EPez_VNrr!36ZHnErMmJ>=x%NxuGHc0G7KEHvAKQ9ka(lb_Xhz|Qm<>47R1!uD zsz_tOgmz%%!nYvEl9M|iCmwI9l33tk%e#I(=0%g5rV_d4-RzZl`Gy6CYjZ(GyJ&1l zSWuW=Xj{eCZp%&AW^KV2fyc2jh55vNTUfBc62J_aMK08rGQ>8Ami#BgWfzU4K3HCI)oJvbYqzKt16Go$IBgiCJy_DFSW95^aLtC9qw@nZO-K288Z#Zk zlXsYC-iCM=_Gz-jfSTaMfv@}`C0vi@@CDtyI6&#Z`Uz`hcTDaB5;v_PsXxSzj!m1D zUVbxZDJt?YOG`A}s9GjtvuqWvYuNK@HmB2h6-29x%wj$>THW1l*VtkUct0eIWA1Bn z*}SZJ&0>PDjIlUncFDNk<%+?iKM4V$`)Y3{5+Y3Gxuob5nOWHsO1+E5gCmC8! z^$bBN+B^GtHe@GsSq1Zepd&OoJs^?OHnR&Fg_DVNy4UO}(r89EPAS$Waax8NCU~^W zfEL2s!^HNcVtpM6v#yj`0Mg2u4;CmHr7mnQG9#B-jX4;*X1XpN1Fa{Ga9UCGvRzt; zvrL@xpiG=DCFw|x59&};+IyN!jTuAPRewyai*8Kxk?Ev8BhF{&REQf#GC-(cn<+ z?g?Fnhl4IH4H>K8R02`wk$ZRf;@N)jTwN?V$5k9Hcc7p z#1;mLp(HrkwH2mQEHi-P>F#K+C^lz_g*pGmBht2xW*?q`T$%Jhxw(C~>67;il1n7jy|Ti#h$^lX&h8GyG^E zVyljk1u3S|6oNa7(0gns5;!Omt{sOY$^XuOA^kV+d8Bv4)(pJAv4-BX*^U2T^QsVH z{D<#w{NG+B+7|0bccn07G2UXysqvonuD*^K5N8i`VmSDNV|j3+x(m`|BDJ)*6^N zEJu+8Iyp0l@Q-RJ5r&^eIF;{3)nH=a!++XQu{HqZDlcAEPN?)rj&FED@EyN?_#C=P z^J&~q`7kbB#Pyh;IG$CG{~=$oe+OLysn0!|ucqAYSq$bOxHR(YhkPZEAtr8~#I1`u zxW%u}$9lce3<^119 z{w03A)?%@5LY;3&J%S7TbcN+u_=YX^l_B-`;GMn+I<(j~UY}04OO|c-4MXTC_!s-X zhx-3eq0HZ&^$>E@7khA#W$-@S+PPT&{w%)V@p{ige*N}Y+>oE4pwdTh+vZ}bS-sC! z=PO$R*RO9!O>isbenjvEt9--$i2E?<(#U$>kVUwT(iC>SZ^XlXec9RDab2_n(GU30 z3zhAM?uh(_i-zFUmqG8a5kTJoy2(Xf0s6b#NyOBAfjIff@pV){eHG#OhhatkJ5BVp zpzGns8$p?-YY@ueA0jj$^BH)DB>oH3_0gOv%g}twmYXil67XrCPzoA^IIl0Ezy29*x%)Wj+*sUWPL9tMll!l0Vr+x^uEDFZ}vE`U=noBhr0@cpLfq zgeADTo)G^xTZH^5d=er4LAal=6k`YZQ@jd7{5NeAAzqc#DY#j}sqg4DgpU9<{sH!J zLUhJcgaN#?j}T&iLHH=vGz@TL0p3sv^c0~Ug!l(xWW|W8@ZE-}BGZQuB0m1lnQ8o& zE#t9*^8^y^sRz)2MLAWEBK(`V}ef$J}>xF zL9#ED?p48kf_R57^Zy|DXTiS@A3w|o-#WYOvD-bLe3<(}AI9_m)V5Q(J!D9vI2`&(<7i<<>C3u=(hv4agy@DGB zw+e0-yh!je!D|G+B)CiP>wkB3mzsoS#XBnT)`6sYXlbyHVLi}TqD>f*e%#6_&LFI1uqo5RFE#{ zqI%yTxKr@!f_DnuC-|`7GlD-6d|B`}f_ntt5`0hakAi;{#6|F2z7Oj>sz;&V2*I%6 zSiuQ`M+i<8JX(-0>!N(B1Q!Y}6>Je)Ef^7u32qQPLvX9$`GQ{%yi)Kw!J7oXD)E>$zY=_1aKGSh1wRn{NbnOunyab(Lj;ElmI;m#949zMaJJy_ zg7XCz2{s6}3Z5*uR&bqQmtazGv*6i+I|MHl#2ZhzzF!o)S@4^JcMHSnyE70<2Mmo<&%Qw}=T{E%ZX6n}uE>bX4e= z(7i&Zg+52<^Mt-k=&OXjN$?gz)Z-gM-!1h0LO(3@<3c|p^iKqTD;U69jq)iLJWO!D z;2Oa$!L5Rq2;L}ohv2<}j}xL_UJ-m-@I%4R1czenNb$x99w9hKuvV}|Fe;c3JWG)7 z%%Xg55WH3Je!(XNe=7L8;Cq697aRgvP(EQnx^0W-nSxbf!J7rYE%>D1Zo$2R?+bn^ScI~;-GX!x7}2u@YXqAG z*9!IsZWX*(@Or^p1@94jRPcGhUkUCLd|&Vr!Gd9?9$~=>!Rdl@xfs=RiQp>1m|#+n zt{kIymkHh|_)Wp@3ceutbHROr?+bn+STJ1bB{)%VreKv|qu{B68w9rq(lusOuWJRr zD)@ll_XU3}xJU3^!H)#J*wj)!BLwLJG@_3bJX-L0!D_(Dy}e9M$?-6`V@JE8b5qwARBS9Yy_^4hbg5w0I3Z5XiL~ym> zdci)y^8~LH+$ngs;1hyB6Wk~GCqdsqQV+p#f^-od)$atsC4#F3*9-Ouo+o&v;2nbZ z3w~elCxWjCz9aY-K~3+vqy7>cD|nAtt4kUV!;Bvt>!7~MS2wo}pWx+cH9};|4@aKYW z2!1F?HxN>J!vqf&JW_D3-~z!`!8XBO!LtP~5u~f{C||k=iIDCKB792lXM+8LzZd+6 zU;*AaP4Pzw9wsf6w@}FQ!ZVs!}Sn6OmL>)Ji(=cCkxWW zFqH1=f_DnuFZhJuj|6`uxL@!C!A}H-l$-p@1jh+Z5j;k)R&beMmtacpbAlHNUM+Z+ z;QfN%6a1mz%Yu6Z-xK_+pl_V1-$+5+h0X1sEO?CI0>Ku+GX>8T{Jh|`f;S7^Dfpn^ z(}F)0d{yur!9NQ+<4rw=3LYdlQEwklFu|lN6&xpcso*t&HwxY+_@v--f-ed73%)0KY=z0cO0Z6Fx!^j% zZoxjma|N#w{EFZ=1n&|2p5PA!e=hiupl6~fe~91+!9NLl4>RG_g7t!{1=k6lC3vsk z_XM92d`Ylh@MA&eaFhR`f(r$k1tWr8g69bSkKkQ`PYAv$_`V>fW#z$M2WFJdDfpZo zdt_DF5o_yPABncL(QmaX)A;4pfFD*=;#V8=Z-sfk%rL)qVdjB<;!#=EytFc!#_#sp z`sn?cQXYQDrz-0!3Fv1VnJ3k*pL=9~5K@WXFiJZ5u_^w!5kFkP54PGn@uMyJ?M7u! zA|0z-*sy#G2XK~oKNiXS)Wnq;p7_UkD)a~{i+1n~PLRhin-O<2)UIa35vIYU)M;TSPhPN%Txs7r$W zC4tgS2N{V(W6`!aezdiT{?Vbm7e8xBPNRg=(7FHKXPbj(jjpJ-?Z9~xc=ltx*qSQx z|9{lIdtj8s^*=n%WiQzT*pRG*G0Foh5J-SUqaa3EAjn134Frr_YEW!xiy8$jRji9f zMFa_oink_KY^kLhTJM*Ng4e3W78NhmO_mj;T4`&oT9xdeRIuHMJvn*b(U7j=BL{!oY}P{jz8hkUr+ z5`0F7{|#3F=ZDW!nC{8!)ijyi(b`dytf?mwNOghJ7OY!71zY z;{xEU&l~BfBk_}!IfLTK1s8S@->YW}F&k;#$K!hr3Ayq`bCr^lw*WX)(cqOQ-&l{x z;q#-i-1_RlSCzxZe(+<0DYw5(joEPvBcFU6x6crA>$?N>T>wG6kC*pPB;?lDg8EpV z`s_rSB^gBSfcfz%O_1g z32#}U7X2|q*+G3+s3)3F4_g_2Mv1(M^pOWf8vDl&|4_tR+Uiy`WfmJvncWxc%rFn~ zhk~L>;YnjXPQrhzKV^x1^UDjhW>Lb>MA%S&5ZQPpnWJ7Z%(9paGKm3rf4dlhvWEuqO7tMGq7jA>?gzV&+ zb|cZ!b^tO__d&>a0As_p4{$8QYuYhZqYUU2t>5hzFZ_yqsDPZN)4b=X10&m1{e^cz zr-`-+@2@fUPku5O+_A=_jj*2Oka;lzUCB7ZSkc;Q+y}Jdvm8329?8F~Kk*sq<%L&7 zkRB1v3Z;)_(BELnlF@7x6HGyN!bo;H{6<8R`?6mpXL2& z7mbiDnX$y3dwrrQm0qwt^K8GnQVFEj7B*&3&pzlioi?_2@Gy^claD;#)!tOU!+IRT z(EtAHo(!@td>4qHry8x~{?mqkSPGpbZr3`)Z>Xg6ny9l|GbPX&-tWL%(S2swg^;6e z%lgdj6?$&t`aUEYTGBf)X7v}qro$_MCo}$VOWUHFCRabR(mvGjZ`d>Ywh;Y!4>sOI zjBj^fQ^SQ=Wjkxzg>l0kvHyw`7wpZD?|&mSy7e&54Xpdy=mMeVHAD%;hv_*e5_+Ce z50t+k(Fhx_LEmbM;H&XSA9D@kP20sWGh~O?Wf(@mM(06qKFq0Pf7BamNl%A=v>RyK zEtp4Zlph!kzMbGRgUR$x=m_?@uK;yH$8s^!t8&U8s%%{7vbbK`*DGM6?%8dS4Zlpj z9%B=3hkeQSDLd*#{h?IhcE~usJpg*Hp~t}}ykU=laj3Vk&+uh~1D%m(ybEzX>ZC0W zKs~U5wuOZcgRV*A$`LkG!$+UjEkoSNSJy*tZx}l>rU<98_mE28@E>f0Iy{PX zL;v0B?>&?&Q~gO4y-~Q+XNW=zDhN5K3wudffIM8M$U%^S<7woK$DziPb+Y^?SaVor z_;)CiYXdCLcCjCz9PQAleBVv8kk+e@iC3d$w*|1KzKT5BAnlX>;=B5ZR`x|Sq_MY9 zbDibkBCyWrx)7(i2E7lT#5urqd(05}d%Z@cAkWI0MvP4&O_?aOg>@4CKaKspJ zBQLCcWU%PEl##bJ-7Xq4NoNaWoRP-f2kp+_DAHya>T-o z858w!O=o?kTVJDKeF=^`>Psm51AkkkyZ2!IOlQ57;T7$bZoQm?m5`^*t-pRS=6ij1 zu5&L^R^O=VW*ybcha6u2xhJ7)Z`E(lB!%u9>?cD#m{`X-W*kG>|6+HKU^lG8KIrr! z?1?4y1Rcm+AJLsX(QfG@I4(i7FC1;llvR&e1NHyXrU=Fced63;dOrAV=pnCze~t3X z9CPw7@5E1g*s0`9q_sb9%wYaZ^X!2-Mmb47){nPI)2*0yl>bP`^*{NzY&}?G-1VuH z>(g4jK6!rSEa(gN2EXzkbYGLk835zg)vqMnbmdphJcM6q=;~LfOYK*#%1nZtvCnag z*KpX!E{t6-%-a@szq;1#FZw6Di_q*q}t_kwE=M}r6Bl&-5;pW!?Ui#6@L7wlB}&6&#*Z>6Vf=g|9#0@P6q zopS#W7I$J!HnofJUG3if;x4v{abiEN|AzZuJ;!fHdZI}C)#(Gf_p2T+{pf_8aqiBS zo{RdpMh<{JqF5i7pe-{PR{j&~Wg6pIgw25V&ke2}yS{*SsYck}^^`%V5z9c(u5_;^Yi@665ycBG}-WTI2#GLdw%BEV{dVxQH zHduc_VofH9plv>pKJl9a(+ZqBGol6gkbOUVd=R?#^i<&5_CBN^{mp@WEXTP%UD-oI z`33UQ7BK(uN@0R}vA+D~fV>d;gY9*+HQJSjeuuWjx^}`w_oqL7D-rde|-S+Or1BeZnUK5!ymsVwr2+0Ep77< z<1EuLzi1bnUq(Rhm)Ixj^#5e8m2~QhiMhsk#`(s5`Vh!kosVa9=nO+8q}zmroPqC; z)nQ@a`*kfo`~WQiKdtxslRUri9A`8^ZtjudEp3ajUz~my_fh(+>CHL%6g5}eJ*2lr z&^Ea5;M$W!U#Z9X{#dsX*>x+4HQTdQABaXF*Ox8TG}2y!k>QUu#?kG zhLQ5x#p9uU=pWA5Skrc_Y2Sa%lY51j#r;-D)I*L2$O|4LF{{0_;hJ{t6*%63@NL-Q z))ak?x#dS$Po_`dyCDEfo^|m`caHin+3Z!A%oH2 zjw^H}k}cTRb?jr>rpKVSWY!nsTrM_GCrO(CM;NCT03`;OaTX3ghKt8*EO*>`ofp*m$OZb*dad=JUjlvyR zhYQnT*jT-RF-98C#?-H;Q_QnzxT(e2Kas{f8)k>EZa2{$`@r)L`M{&r58ODbauu*a z?Ei4bk=^G}M!|NmCYjhLm2gkBQtzp-ClL;X$7gM$FUh;QI>=v#yAtZWA&zy7a}9m5 z>d}ARn}j!HY9TLW7Y*By|4gR9S<_yCv`X9qQ7-NwhY9gE=a3%rL6?{T(fNitiv6;fj^SPXfqsJ)9!S<6=MeXXEC;uHkRIoCt4H=*-<#A?hby!Wi&2;9w4@)1 zzJfJ-U1myH%UO-SV2wgrQjeQEW*;dZ1nIQeMeF8BvH|0sJLd{I(ewTXnm!}9d@jBp zHkn+2`$hOi_}#~*j|YzNHRG?w{d^up#1VU>@D#$&@mHQ^hy*{(5lic$lYrvIz@hJMgI{5XOg*f|5yZ*+E z>Pzg-OboU~Kahuh9Sgt6_C9d?QgBdT%ntp>ES3n$A%A z*Zs)Rf5KZwuR=d&<>>#G%vIg=BXm$d=E9z`{oovAU(|S@9~>XukM$k>=rShmo`&N= z8#mCGB=$DEKf|kpk69cCjEAy8$T}T7A=E1{-?)bR>YMfi1Zentw#7LQpNKQ_Em(sa z+er==(AHLT|mMZ}Mn!<7z!y$6WlG~s88f^tW#c?kytOG~#WtpTI_pve zvAa?JrcCFuywAqGLSJF`;)+Z~ocprcH0CsxyP6^c{m+9=aId?U^UzmMUhI|Bn)U{K zX-nHky{3eyFYJ}%KVfGT4Y#14)6*LW^$$Xq6+qm8; zTfsP%VjNip=QR;$&RQH!>UE?{ zS0!3E`H~zL>;<9AR0QyV&=K{3pDeHbRBzD+XTKwzEH~Es2;RdN)zCN2Qnti16webzK{$;LgjTv| z1+>#~uYhuD51K?BM(I{O8)#H=*hn{^JI-$tHcOhiL?89~o=Bys8`N)kbtpM8r_^&s zjI~;ik~cxty7XYQxx4|s4YIR7BU#rT$6Dhcy%Nv6SeNqW^)0-++Q&3KPiAwS!CG`n zW@xnf_-r)SsKC!;bA&<^) zNsomrm*br8$$_yA8TDItljd_*+QKs0DdeU-^O@K}civ;p8;f%GcLi?y?_s=x5bPru z9M%}Yy)!?poBJj^@4wm|%ooT+84b}}J+q9vdrtJj8W7lOQj(;ip0+~w4*XbDv^1Gf1 zTQ{k_MlEb(_YC+ov~4C~gH7mLE6ySb`na1i3D^hw%J!yX?Jo_lX`g~L1iePIV0^Gf ziPjf0lX16fi0bxnkoiv9LzvI_Ft_%vNHsve0%0)*sLG9rGgNn?y>u_0{y*e2OVLJa%dXCsDf@ADzXzJ8w{G3`Ep7+T(!hnVBF5c5Xu*%~me^{&k%w6Ecw zo@+bjv<-U-4>1)l%k9ECS^>X<)h|`rfOApo%66yz&P+ahWi)YTrYwG^dRDwRAkv?U zHG6ShQ+wQvusso5fqNirr`#v9K0cd_53un}4)?20Jk9ek zMH`eQh;}FgpY5}aDzxW4lc`Lg?N-#|*{wV0amQ}d<~(cQdtN)BqzwpM=f@yaAn?2t)Wb$evTs;MWV-`c;r*(6o+8^@$ zmu2;66XWHtr|-i1K6vM4kt(BcWL1JE~i6>Eq4dR zv+8}9sFVA?3+m2&-^IOiX@EQn5gY{lp3B-spdBCjX8Ly8Ecf>Xq8Zz$wPCzB6yf?1 z24~Ra=Kd_G^vb>%DduCYtB-p31@Cbzgndx|qM@a2hq|jJ@48Gq>|?v3$030Ce13p& zd<6NNe`W%G$CzlH&r0JGEYz~4IpZ{$=`ietcAMY2Hsv(M@yvXUdOs!X{Gc7S(&k|7 zSuP-^rNS*qrh(_qOsjaQjb-cIHvG`7*G2(+g-_JB#c|J7g?y~RZFWw+NM4;{J`^!5 z$bC;e>rAHn&YOF9FP9&7?KZg*`-H38d*ZGGdRXNTH>$mdf#hV#N6!&%WzSq!vm;++c0!L=E8i(_puq1|j*nd*tT z_P~JytE`3z?VGXBh+|AS4xWB0JH{B}=Gy-EPDt zs(EPC|9Q6&o7pZB8{3Wgr+34q-LuQA^nY+Zft|VId~cHNh}aI;IoiOS-mn$AOF@TQ z@s1_tz|zG1A8^ez@H`NH=5527(T;UFWW-noR%0Pb=?duvgiHwP*~UEi^Ug_eo8RVG_QBw&m?xHey|3eNBkhBWysp1HnWZ z{dTK(9`7}YP!skERz03ez@L#n47*~V3_N?ldvjODy^aIjPJvDrA(TO8fA3E_zBBW?@H#wyYf6dm zFWW!2wxj$_c!s6-t9+J(d8*zYU8qG7t@rwp0_y_qn|M~BpLk59Uds>{;(O{DF4yBB z&zmZL2-0BBa?93j@Zr2yhdnnS%8o|1l#)AN0L6?_89u;cXe=tue_)b^peF z6WfVm3~}eK@cwK+?zLabcTGaeQ_Y!q&j!+zBer#7x@QV@j&cLwm*$DuBFrBtwqBX> zQ=WKDCOYB0J$4-O0PhvI+wJ&!dwlVvcioh{c<=Qwk?`c5l^zOtH^=FhRe`f@Eh2lk*9{fT|&?BjR|#DHW6bED}LHC?H%tEObdu4?0EZb*yFx(q+xxNMsoXZ zzC-X=t`A}U9e}Pgg*tbkPPXaQ0bf5&T&U+M$JeMosU7m~Gs3K6QoAlYEB#VOT{Y=f zQO|Q6ckG*T@A|k7pM6pX97C+3}S;hM}w>>oDuZ^}H1=kR0T>m1yVRyy=GygPO8 zQh2BAo-5F%brRmC_vT==tMhxu`I3|;caPz{)BP#-V${ia)LEQbfpNz8o9p%l>mSU7 z(N<~V=X*tBO{O5ZE)&L@Sk|&GQ;}GgDXw3WDN*TomYcvHdw?ak2j{ufEVK(e_zY0ltZ2v@U5#;QQ)O<;Hm3VL9|!a0zA1XRe|(M?9Y7l zSEovp+>ix*cDAm_L{lp=b`wJKI`nHr=0%JV-ZRX3R_IT{N2|ZSQ@9<4*x9hoP{Cg>h$w}sv7sw@iQd+;THZF5*lBEwV7WDJ$B^CoZroG z&O7Ivg-e{J=R0Se<1ARXWGsKYBE&DpUiMRmKX!zy^VRPthSXQBJNW&Bv(Hi8IqkGl zw5<414}1-}{$_KXJ$F#7a^c89v7gt!l?&%XqOp#cJ81FZi;&fkFzD<-OVq!! z=f=)OJA;;BQ-SB8@A!35p@05Xcs~`dekOjL zn0xf7<42u~=vW;cqobpARH>t*brfS18+FvtmB$=AddzX-CrqrKbP{a;d^k3KHzmL4 zmETF(h_DKQ-$S_p;TH(MM%aSzkQ*LB%#q>2*Brn{a|rc*68t)^Jb1l}tudnnf-U}KB$|me=nSujS9}8!xCG&~hZaP-c*oxh zdR)j6cwq!w2}Uf0MgY|(mum`A@K~Brqe5pX766ZH9`HpfE5S%}b=xBQ<8~|Bz4TxZ zm5Qr|Q38QIu4%3Z#+?I1VH8%yyKRKx7-9yadIT1qp^9r6XE4&myYyr!vRV;LahZxA z0qzqw+BG-YM4v$Li-e+yzkpzoCc-LN&ii=U+3V&VLcKXESr1Nd@f=YKTLD^yh+hE+ zbUmVaJVrW1H5ICC4I^F6>})l&Sxu>rWoI+0L(ocPrPJZ_kwMqrqESYlB4{3Bymtdn z0ixA7J^;M~Q5D=SP)4f}G&?b&F|^x&pa>$32+KxF$C3W7`mvE!$M(Uh_r_aWg4}eDkj#%2&y}sIX8imUt@{aa2P#-pjAoi1w~Pn#CCP$b*^Lsn%b+I^L6QrmuZTsL*{ie ztvC&KAz)I68K)3jXFzl}g69l~vw1hWvvkE6vQjl{bH*T=qDPPs2O95D@#_%vfYm^zA!5j#%To9HrT$Z)ljAd_~CwTxJE_hl-O6GQ06 zxgs^Ux;qqCw|!u1?vPOT@ScF`)1d@VnrjB55`^w7tAlGMxo8uH=rX*_nvS5xfyg{X zTzq*mkt70Euhoc}GzzFbo-9#Nx-;FXx*FNg2BTJl?$w42cQaQL2D%vmj*hAPcr6jv zU7f*5b9J$+G00+TrieE)o}%!})V6IQ@NR~t3dt0XMG&cv*C_L-2%osj9%wh$18qRS z_$)=V0m01yraoRls*)mFDA=V|a~=w_Kjp}x=-}$Iypc<{IMZtpQ-rEgA5X9X zP*j91mO@*^bgNy4pNv}UT43tq)sa&_#XcyH31bi}ap~pF)FZ1`1Y-5^YKenl)l@QL zEk~D)LIbi|5uiyx_3>&T5k_#8yj7uHDnP2MK6M^`Kyh_zdDI4!%t&+90aKqtw5YlM zueQix;8d{1PcUA@bfdLOE&xw7GU}`@W=0(`i<(BHK3=hJ%c}rqC4wb>swWI9QG}`j zz^kS6gwcX@v8lxwlbdXU{k%!uj|L-$~(Vkz- zxY3?@BfpJY?V@=40trfeawT<;;;|EtBH#&R_sr}Iy2U7r6}g+eH*(Zk0`Fhi!PUh) z$i;?SM;Fs5BVBEmVW8;R22{1W?5ql;j!|W2G16tbY-;8qYoX%mVr5L;fS^W~$jh2A znu$O>=5#$5Gmol;Di|$N=H_NCN*Cx>LAt;Erf|1~j+0t9 zOI{3Im8yjVqgn(k3M!^tP_!o=lf928UlkIjD7HlBEYd-p#VCw$=#7(Bv$~sOA2lN} zEkn1Jb9kT^M)e3RQ`5zHA;UcmsEv&7DP9oPAFmsv3J_e^(xOnRLVY|gc0+T`Dg#Q* zb+ch+5pufb{>Y)Z9FCRe4(n!!ld)$Oic*OhZ0@Vzk|1-e)WnQIX+35pS^k0)48Ubu4} z+pk0DMss8(Ke8C{P80U=AHxV6;)8vmZe8 zh)#VM(O!*yis*BV0;*4LyBxspG>$o@U!ux%tNWblsJ%m*MGoV4wx4R%E<3M2x!tHl z3e?A_9^ueFgHoZtj7k;Sr8@TRTUyE)*~Pj7-s63B=#h1`#Yh)8g9Y~E%Ks3nWwEMO zxp`fnE?b}udFtbJJ_c$Gf_HyPoVKZ+MiF5ZIB~zAt{d5^B9N#)UNz*Lg3#SQF@bbl z3m%406h5v{3nY`1~YlZ?uW?5es)AAo=$pe8A#mE6D&n z;Yd?JjGHH?HY`d!U1tEQPi`5l$QnlOfMyGH8FrS|jm*exWJYtgOc&=tMqRVI{3GWf zJXem@*ignHmX{oXHCGoY9W=2V0qPGm6WM?Oz3f2rk(Z8GeLP((1Vvt36efesO~7=i zZf9_gq>bP_M1N>zm~V`9ue<1m$rK;LF=|j~mlX}Ex%c@F$V2;#0_3`Lmr@>@F{clU zRGHHm(T3sX?bV1M(8+-6<7tY7ZbdCcyD?NK5!6iG8Kkn69o>&8Ekm~%Yi4^X1gNtD z+`P%^MziGJthrd=k?y%(Mpg=ebCvPu2)K4(RIExQ7_k`(uLd-G?U8*9603AZVKb39 zf=@IQ4m6sl1Lf5x`4~4M;E~{E%|x0s@v|=bFi#kGm9UbA%^9N3YgMJQSyqp9MhS&> zdv>F$F~p4YAa-k`nyV(u)y4Wy9`>Q?VnohEn@bMkx7$??6ystx+pRxnz&A`@Q{l?#%yH z#{VVtd}kT;$S8}bclFr4dK~29%EDWKEV1PBE>p72QHv{F4P_)3RoMObhQWa&IwM_Om!lhU+@(sLbTn6& z>#Zr^V$U!+S%4o;Bdl9@cqXF;1gs+a5f!KobZLf$iTRfd3`Fq-1l-1V6@$8K=!8fCN?q1(A+Bg1WorK=R*1^PCh zb@;>umt(6yRGUthS<4z&6dhtTMxiqqO-F#A!bSr~Jpv{yp!(!?R2NZO%Zqv{ZmWeDgqqb4t%$Q?QzP<^~MDY4roOV=S_+jDs{k);T3pNTdiU<|y<6dP;Z zm}LW|KDo8CTIhpOLZLG`!mJSbu$zfcSfv~yTF{wZ%_<$q>f_Z*g7X04FnR&u(3+}3 zu2K&XsvqiMr27h=N@TfCPa;~4p!kVAfB=3*JH2$o>f=dcgL0)|6H^eBa)_`YSBGAk z5SlHr_%a2zt@hAeMVpNB~ z8P;{dK?ZUZBcq@q55-8Wp+-hg3es(j%&pdppCT#&Bgz0%AEVG1)U(KE^$hnpyl0^? zs}F{)Qdm8w7LDsWHvjm1vjqB!BH_gRe7s3#k3fOm{&>kP6Z%>`!QdOxcU)ggHeH4Z zEaCSFvyaZ7ia!tvR0^{sO9nyaKj`L+rm#1Ys%JCF|2u)N> zWCJ%&C}H*0*}8OhC%N5K_IZ*X2O%bFEyKU%^qCb-WnYO*qYSh9c%3>qq_yT_Bhx$b zlys-~L}?F}IW=ERQ6Wy_ymBQ=vBB{0=JFp>43Se zcQ6L>X@3;L1dH%Dm8-DM8Qc714^9Dn*Q5?QZ|TW;4-l$Hops>IH)_m_0Tbp$pezIO z1`Yapy~mpW9$dT;2(mICe{*Xlf{_<=rMoVQPP6$y@F)07O#dsOl{hZ_4d{*d(^=#{ zd^oZO55iw4QTk|bAu8&@Rix){m@q^o!0Vogr0|acN<<-fEDmeX=-ro5KuPupP-Fhb zlq{|!D;kazs>7%b`lq9feK-RkFH;PeUIqPIHW3eAIt=uGKyR9yrH_F3nL16;Cqae9 z<~rw>BS4NcU}YxVRh2ci1X zLlm;GZz4D*kmG)Le6uY1;;@sEdnR)S>GF|nDL{$zWfsq-tyY! zIG_AJ5PnfSvgCDuro08vlD`DBRAHO>ru-|?g#0_8ArAnW zLgi0a`GuxD9Egyk01ch<832MkDly-`qp4VWj7#5@Yg zD!_a>2e3dc2J9iP1nepA0qiB82Mo(JV4)28u!zeMfJJf+V6nUcFd`oUJWTEb>?0jN zR4%6j_LU8QQnmmdE*}Rhm2UwaA^!n*q{JVzi+*wtpd(KN>@QCT93Yng4wP#FqjD4A zAo(`nV0i#=h%Cj1tV|9E94e;*4wL5qmdmRFE97qghs!?#j*uS#j+DLdHx@B@4B#j^ z3-Bm;5#Z7CX243>3V4is5%5^aFRd6YzW^K~d*RO}j*~|Lj+Ki5kC)2E% zPn6FBj+1SGarq_ScquU`6Xdag6D9u=qFOcpPLkIFo+N(*h(9JdoYrUCartM^Lhc4M zUg%n4b==_{uJ8nPD9luH3Ec`cwVHvszNeSm)XG+;pP1Psc( zfO*n@e+kLnfcX-e6b$oNz#eicU{5&@u$OEA49gXOh4N;=-tyOgMe<3&V)>8D?Kc0p`hC zz>r)5m@n4>7RdVmd&oZm_LLt2_L9Cr_B9GvC{G6LE$09h$x8r>hcil_y&?`X5Va>|for~?4ZJCx_heRQNqq5{SL>~s^dx-W0;K^n{9*^kbfSir!?*Vx+qE7K4j7Ux zfcf%yzyitdndl+^1K3mYC+T}h2QVy00T#+yz~1t5z#@4YV6l80Fd}yX9wt8p>?0#s zt4p+2{)+vEZC09cAktvZfQFm_Xv*^dEqOVhE!P72BVdK(k9A`)0~{g$1~^jYN4c1l1CEkY0FRRM0FRaz0#?dv0gsV)0v;j{~fdvj9(!KLI>Z-Uc{MZUKzTmjTDicEAbpE5M0z&|ofR zCjm~9^?)bIrGS&=HGos(uK=gY#{s9wR{&3z?SRwemw>0p&=8!6qysodjscu2rvT2A^8n||^8vpn zuLV3){v5F0^A5cW<#V77*$x<&=1}E)2Qo?;@&v|lc^0FshP={EzK5~nR$<;@$`_D; zofn|H^BOyx#`<NzwiwhEij|h=HYk? z7>jAZc0}ZGZVL8;cfVow4>2a5!7dxeCC;f79%+l}aF95C9Fh3F%sq<>vrT?BoraxJTGAt5_%)y zBd^GHNGL?YS6;$uB!rPrFu|>34H9}Gq0~#b9tk~>Fx*R6i-aCXnCc}oA)x>Xr+NwN zkdTjrdN1JyB;XfL2mQ=TxDg3?NVv&MSdWAt5`N<)+=PSx5}xrAnvvi~!V6wP3le-t z*x@DIg#;T3DKFs{NU)Ibg_p1i2__QuVBV{t|4qQQOLrNA!kD-!VGB48N5TLkd`V+` z5DECP!9hoR2@fHm?=B-c1qrh`sUHozZA4E4MGs~EA@Hsdoeye0^R@>5YD61Ay(U0C z9eB@(^6ErU&jj8#q8E92+X5*gdX-0Q540K44IcGupxuaaZ>`Eb7f2h?UwV1Z2X-6L zdp+ufK*oqZ?NKiVJ}{zx1f^toDX<5V#mn0f*lR>T@Tk88J~YH&I<16Z4h}fq16F`N zxj7^toG&2pe(q4qK`b1FZ|cQ1)2s-<;k6?RCC>0UXQRZIEHT$7oXg>y)HI*xvz^r- zlpmSz3pyJ>Y@ue(^c6VogHT#u;0rsScxBG=6+2&nn1T+QXZuQ=p(9;lq0ezfftbsj zb9`ma2O#n(*&<)eIUBOb*`@hP8O7^{5)R_Zq=jC z_l<#b_NWG5+=%Y*s0)0!)QcQI{|255(USS*C#Lg#ugiFw)%h_9)#ZPfwsSrR-b0!H zG=t7k5c^2{%Peqi0b#KJpPS)mI|#Kdd|~c2qXHFQ!mI=4elwa6>S|J!b+Q%h3F<~t zertMubbv<%tW)!&WuTOA3|fi&XoW}RS+)7mv7nR}4Ow;h(J7$rVJ$tZdHK=rgHnbO zwl2w!ZiOt0Dzq-m7ZF-of7W^}(#@1PgyWP1?pxlg2dYpvTysUgok$9r__ohGfv8^Y zhBA2lcQPBwKp7o1e_;BZSCONd*<%L85YC^6k>dM_wFyzc9Kt#D98)eFvILo55IxoU z8>3(^7IYg{c-fD^jptlLevS-@?)biE6*Dq>QGUgGq=-C(+<~tk-6=L5pYwBI18710 zeIm+RzmX&c_=FMtjh8jhCkmsj9u@WB2@n@tRcw$C3-4A?RV+8yCyJxbd(;qLxLByh zwQNQ%5!QqfD=hlgqWIx3U@K!2|Ba|nzj{!fEIM1RC2iF=FiHiO- zkmHeJZ8an9C|tM)px@m{iCM=)oCJ{REO{)NJ_p2d5);t$k3p;>QH`dr0P#B#lOqMr zH6Aeya;yRI4s%Y86st+2WUq--h)4~R2XH!^9`z@m|xnfOb95>*p1(Vy0{l%+l}BM*~dG)pOl*U0(?0ktC{gb~_SuRTaq!()kl z>rpsp#Uf4<5Vgx3h5pmB$!Z-Hu|+?=#P*0e)#rQ!9*(Cu4c?D8$1V|cKFbne=j$v{ z;ut9GvN;Yf(09>!oea0eQKY!$bl)b2>&0^Vu2X!Qo!%hSB5HqM@dy9APN_#c<^QWQ%p;!mzvoQ!h-duoJ5xMjn?L2u z^@#2MwxJh-P_jMe#|ADnbeTs#54vY+=t_@%0d$Yl&|5tEMbHJQp}+R%mq6#IhCbxc ze*_&$4c+F^FN4lY4c+O{uYeAwhJN7DuYwMwhJNMIe**1K4Gmy?lzclt`%*)Dd-Q9d z?bOhyNB=lfRe?%`1jw`5HNNpXS$Asgqyn5~e-fDF*Qv?v+g2UhechMu>0vf$-T|odyuA91z9!e&TDeGzUP%Y6I$XC zZ#2}V8mUJDk9a@yI2Is*N4!hCgtL&qBi^-M!r4gR5$_H!VIdN5#EbscOE|~IDdA~Q zTd32;HqHgFfKsxaYp0B8J1FJ!&bP6L|BpvC*x0rEV1+900(&p|=usEi`!J#&wZ#6& zh*pDA=a8lL-;L-TkGja-k23=(wcGlM{ZDK~o;%XDdqed5FU&D+_O+ZoKz`c~5*`67 z@9>KKEj#NK2f*YzZV?7r13K)laJCs|SFb`a`-aI#hAYy|NEb564=oNXY~0M%HP&MP3eX)$M5W1M$EDE-u0 zRnA8sl*656o#^cMh}qUS5&0de8a50`!9c%qZlWkpz!Bw#yA=fb+vNj1d;lJmUJD{% z_xdLaDj#9$4btzCY&~W6TL3eSnP*rIH|T2lo&&udfmD~keG>@Pxw+6zS(YevMrDZ- zXKa=zb;f52$C;WXqE3xR%!797vIKTdRA*#8oW;NkV9A>dv(a*{28WuqS3|5@J>nWG z8SU^nH(4U*7V2gThoDw4Dz9^kRcS;Y2lWW2{ss$2qCXw$4&1F)l@ays+|1joxS=+_ z%AMS9RpW38PBq?lT2qYZZcyrms@a-uME?%z2;LF3SP3IaHsyHkvTBW}?NPt5>To~? zwTd3_Zfl+q<-TnI%iUwu8__Suy3{YNg>ZDoV=QpdYW~_57}2vpp(0_nT1$=Sd7zY8ZLyZ+IGzWsp9_K?=(uiK~Q4d>kcFOiAQa-T8u$?o=4hl!9{H} z2KDn2o=3uwNa*lcFCgKFjksU~hcf<`tb2^;_dM#47G49$9)pr1@+3yI@EL%9TQL?@ z*7A_^oIB9gWg+3b214y~FAv!c&pwJ+5eho*dO25y3LKt;RL)hQu#-X#$I)6DDt5xC zRuQX1C640}*M~}-VIZh}Yh4H#9&uwR>QsZ^P*^vG%7&im5gS72eZ^4kV#~S}^pO=q zy?ZU|Hqb{@I9Gz7UAOKC4R>zzh&w|goL_)YLNThq#3=0`&Vg zgb!P1ht!!w36Ae~cDN2H;vA^Kvv%wIP{Svl8h#Ke5WQ$zu7ik_p!UKQNQf{sG6dw1 zqX7N^a}7=$_5q?X!8^-`K?hVruvwHJ<>7bPJsVKh(?f!x7 zerA{72VA9p9xQ*t!@n#jf6>Fg3YY%{_)Fyfrr3EG_-^9DC~-0%Y%0PuN}YdzC?;VW zj`J0WVI=%U)CoX_aU_C9nbQYEf<(xuaE61ZCsBZtS>$h!PoEiimn|ay1svkXVBCe; zf+r2T4N-0IiL5rB64`Nl+Ag2zX=ZycJC4s4WXJJ^aQO)s3;MR;OU2o7f4QW5JklS+ zqo3fbrR6^X&c{H(*P`XW2i}+c{Yyo5tY43ne~olC)^AppmqIQyErM^2DUW*i+g0Up z;K~Nxjc3RDz3TE69#3jY`BlJw&idP@m){7S#vH^i3PwIhzlT`xv?I_`aO$wZhzf!i zmM`!+xm1+@7&x7A@M63CW#Bf2UItU(qq8A#faj4KoIdO+M!_GIHy~CmoGVoC`B*J@ zzAYl(2U7TBmbw_=_hg^dZzG~`u$SR11M&b_@gk$M0>q0XiVWMi4#evuB1X`;3B;!) z`rysB$fLmYXi~%y0ugx?u#bzseK5l((yFu-i5QxZ4fPGy2u7eq}-5ByTa(={S#}1pLguSwS3Sv|*f>(*GTe!v+ zLp}!YugG-5unmfLc{y((deSt0Cd$`%<&xn2(uUtaf_+NlNaPP03Xox;_^>w+6$Dq6 zKaNK;2jOK>ZFKGcf+33ps@&+f=@u(|-c48zZfs=4t*956<}p zq-zcqJjC!w9-uDCmPDj4=sqQ?7A3c?W#mCzZUxl`vx>+pa#24@Y7seybOV5@)u3wn0T$v;xqhw$vxHkN{am!C-)%4V zx#-a-G~$=ol|)Ve*6(#-CFZM^T65I_7T-7RY)7g(X}^Y(#w#E=hs-})VG&t^QiaP{ zv_B4k4_RmRa3Vm~BE>ozT)lYqQS0zr(Vq{ZFGQ}jCNHuX_(feLg!i#-27Wjg#tgS=U%(6D?~+9XoRQxNFE+g_dB;5Rpu=* zoYQ~|M@rsOOy6@r97p0J14jo+cLq{?KQOYJv7TZG4>A`cJ=7yI3(Uiw0v-;9%ae#% z6@EXe{5s&*6Yp)7{~Y+O#Eb0mhk)Nlyck#Cyk=jIgiyh-`w-cop5?znJc;=|(Qh9A zRKJ7bs6QgZxXL)1&nk?oczUSht%PySTi_NE9uJQJA{ycHjQNA71D=4rlMt%F3E2YU zSYY%xdAT(X&te{&SG>126+8i~l-+^EAzR z@qV_ru?E?n`TqnlPrMcY?opLR?laXZ~2W$N|v{jER&QRZ>jghCtai&C`3?x2&e5Ai_UKz7WXRl>p-}1$7w^WinCl&_s+D>mZYv#%B02p0uX^2_>@a zg*M_KKMz^%Xop&0#miiJ9bz?RtMgHIeig^8*zn^=iL@CP8?<9T-)kOulFEA_pvEkC zGsmp2k*b4=)Vw&%pq&TzfR!(87$pWhUT~m=gC=?VsH%dsp#P9V%k0`s5dhpJeijXik2Qct5KcEYo+QS0$(bQ`VZ=j6U(wWBju~_7M35 z$UlLI6CVSdhyE3i`Edh!OgyhLSOcrwz>Fy-El<^P2_#f?Yy_g~;B7<+6hYM)7n%XE zPDYYAkt4c4&;4W2O{R?uj_oNuIIzbVv$Dfl4xu}S^>Y;A0CpZ$NQ>lMXjkPvrG&~3 zZ4XYA;IWWm8#VD4bCrXHQ@0{vI&}3B5Gov7BT%D!=8FBhDTXz4G?9ml|b07@hgF_N6Kt63Xs9P1g z0f;Jg5fD}EMIhN?A^J9U%d=Km??OfM&oG4YRs3d>(~O!$h$b4R^IJ|_Zcs1hQnNN; zJo62DL6;+szVT(Gg0%p8%@(Xbh+3bel>6iucp|MwC-IZ?9rQ0jN3*mNu^O~O@HkW> z)j&=&PJaMV=mC^?8Az^ByP5GiGQLt7HLlE;qBv!yk%#_^>`EYBxgJ<>szIYOOS8$L z_h2pj6^?A@1dR1yJsgRmQ;@3M!A6yxF!3sN=on-KVFz9tY&;4&#BNt+Gtg#TE;Z|s zgQ!%NQr)#-;%=3S9;4_P=1)3OC!^tcS+2aZLG#Bm@_q_rBaxecJOLy`WOtTTxwu#; z+W=i$wM(Nh>x|5Nor3p)*`Q7P^v64iyG@B zEK(Dc>oX?t%GD*r%wpsiCj@l+dQTBxd2v)f=G^ACe;d<|R?hjhJ{ZQMk5#!!l;ers z$-Sc9y4<0*E>+`@Z2nEvtQW@<<}js4$X(hmCRN*MY0ug4SFI$&Y|WsywUj}hAk@x5 zb*<_Sa^>fd&=uG6d3eu3DnYaG+@E))>V3`ur0QOjw0;)OmaN*wy2^4yQX6+}PDJf% z$m_LMF)zh9iwG|ss@`MjK3(;7D!B=;Q00BZ+Fr=1O%)~(Ro}4OzjMmX>@gWyJWFi= z+<`pHuLfck3+#fwG3K8Je`~a}hGUB`2x_?6$#iTrNcG27?Y!O{{UeYc(OG|>$j?Fk ztAm`j4I;Ln66}?x-j1vt6#P_yCKdx3{WOw3A@_gT(roLZ%bV5iU&vl5_9&4BbeMv z8<9S~O#!$5hJyL*+0-KV1a>KpBE*rWDy5Km$5a5sn9s#^>TzJ53`A!%s0^-NQ_n)i z!RuB9GLfj)t($?VbxZk52g#m3=qtIfOf=@zXOoYouVnQuo7xuW?{b*GU^*&2%i=E8 zzXkQGQ9VmdV*i_fe+^pg8qc!$2;Dyr-ifb2AfJO1oC;cv)j~~Q3;I7CN==6r z;8-44V$6W_F=L;KW`2g~bYViMxU0_xeQ(_1yF0CiNt z?+z(ZbFu(s^|xBiUq&VF(n_QgS4!NamG}y1rNmuYY5xL!fJ)h=l!T*!{UyowEgt*o z%)kr~DXqZ1=$umUJ65m?(oUy)XTD4G&$)V$ZnNlinn|0!?B74B0~-WNFA440IO{#47CDC9fKh)_UmkDzJg zJ6F>}@@@YgFha^Y@@;xf{~pj>5s}9$27eE%+e#(*Hk9LVAXA8338a?DuYuG9!D+U5F=K1pcCie| z_|a&f5lD|6sC4`n;9Ca@wwY_O>nfGS7Qkz9f{M^PxX7VXryFDDOxLI{LcwA@EZ^$p z(VS;u>!XSni@b@*`y6@76SF@mWjYWw7x=)41z2o`a!EBl2s#kMS9?6hH#|m}H(xSP zGhcfjwJ0cSR~T7Dq!)M!c@8o0p)083R zvb{#Ogl602u_d~&y-&8;HkWw60b5qJ&CX$?`5W{1lWm?#E;bU1NmIH>5`#YltyY=yl}+nvHmhp-v6`RinQ|A{lpcPn^x%IU^ur^N ze~E79W6)|xd5Pi=@^_`x8GpI0&iK#zRTLDY6tzW5AOSXnBu#=~1=o-Sh~#Fn31GcI0L4ocudP-q^;WfN zz1IdWczw0%tJP|4wbs^FX}wg@dZ}9f-|sWe**)hZY2V-b_J2NXzUP^FX6Bh^o_Xe( zIcJyig{gcq3tS+!Q!eh{f*iiyX3sk=7F}4kagpe;P;_#M=)^|(dM~>8o^SYfK%B_3 zBRC{C+9BBkGRw%`Xh*gbw21W+J0vSXi)cR){-dZl&I1|Tn{)D#-vxtc@ebC6+~jX? zBUWO}Tk(dk0QdI)Wmt9$J8+xr zz?)!~e%>bij13>90&D(PL65B!e!9?D6KK(?&5vIUT5RYJsSl0TNTW5fLu5co0T2$^ zrGtHsEbFBJ_u+M{8ZqblWEe(AzQuQbkxp|g>d`AY-iq3f- zS@sE=9q&@#u^YiA&5n0DOtF_iOS9u$y0TaS691dZ+0Eta&G92aix_)Ie*8P2r?A-) zDW8AN9IUmryP0?n79*?Uv5}>%l4XOsZ^?32!{a3DjLJm1S5X_5WAhd;{|ThQdsBN1 z3{A~B@C8@lGjir(AjiLse0^NRGxLLffvh6;He?(=X0;Qj`W9;lZ4 zk>J+JSQbf>`Bmt^43{;=EDICb}m(D^Lyb+!kc=MhjnYGLQo=mU>i z&H-)eoh41oywJ_PqdXGqSC?(qJ#?D3SGF`X2Ime*mcY?Ma z*yVy5|1D@)Z7y^Rkslv9URRroU0H3u0a^@9>E)oMcNd8$M^RgA(ITxOa)s+APXPlp zw=hDrE#9yrLamuRcKcS`_~(8Ng}la^;P+8Z1ii*(RA||na1&X!l598FfqM{aM^c+N zxNi(cf8GQw^4uu$#D?$Yxo($VhKzj`G+(%i{KOScxE{24#+xkN1X?`fO)giP_~oFb zzqd$x*uPpkuZ^CH5u$}-XJ*5|Z?H?0P)E*+%;VC?vW*n^0W0#)P^H9654h(gAkt3I z-)0vcke+knRZa3?clDrvw2#d;b0683#u)X+Uh>$M zTDH0Zh!>d~qm8QV&-GQ%DeXMZ3f9DATq77f5oe9C#SQ@7PR*@}aa@mLpK?%2nqC*% zBUyt~>0c#JOFm(RC&yyRUL?ywkQ|#Fj${eem*U21g6G(gWpA_Tjkb&DqsV;}S82X_ zFPqIiKuj#ZIVzK>L;89aBnrdW^m-z8dr?q_@PHnSTaovB-0z zx%j=H<*f0HSUsFm9*%#=Hg{=MTrtDtLPu&suWv z+(}Y-L~m)E2M;^}5+01t@bf9e_>cLAcV-NQK8PKdJbeF2M*wM0!w)c%W_kA$b0*F6 z?hlMls`l;=Dwwp`yPs4v={WCx^5{t`y!(U4Pipt>4=I_{>)lUDOgatsd>LW*)cq!% ziF>YG!w;Qk#(WNmM$+Xky9mkAFY~Auu}An*4Ay5HER#<;WAO=iYmC}8`7$^&L2tG+ z?IhL)S{_syIZ)u_ln18Kd_Jp;{|MPK7>-mo+tlBHCJR@}?2?HEJHvFBcKLKQdE%bN z@R@4zd$<|+T=hPr^0_LWs?w;fE8!^csVWUtr`~SWkok*P>~-*qv3()dfbeTBnvMK3 z#$Rf(%NT49o!+AoZ5CiFKM^;k?pBByab<;yluHGc&;SpGBg-bSjbXX5uc6d=)X6Zr zqIH43!qWdd5IVXPv>5cTTXy*>gmClXXTRV4{bnY8pg9I#rF@f{1q0i+RfVD62Cd(GE zs$?!-bcuZf#l;UL?el{I6qWLkWsAvHV^!MZvDNt4Y;CP%J6al#eb-|<+Omm3Kw!v! zCfS;EV|RNj&B79U1vJ0bi@aA^p$K4W{vnIB<$gH{az^*j<+d$1yWCo~pOCFvl4Fy= zCf(`Ior$rvwXw>`vh8GBXS-AH)wXUxZNDVjX}RL0Pw{Fy&DS0JuE?@i$+kH+cAdwv z*>>j{&>f6SH%k>ud2BurCH(#R8_S+&`9JZ>pXU?U_UoTyyV$bry|4D`V#_9qwT4kp z1GXRJdS?Vbu%i0ZxIYc;J-Gw3lf;w4|0$W-t?Au{3APG|Vz)oiu6U17Jg#3$f zbB^TjcNOW$n4ff;oH_6*}+I?pw%5iz%zOw)y z+1o{y9mI;-@@Q=E1i936Tb@J=c@y!h!_u;Mo(5V5yiK0I#=Ahv64oK5xxAkqx$y6`*a5X&ZS2v^28G*T_rKNRo~GFwn>k zZ6hTIX-{l!tQ@rT%j9eq{JdJpi4nVmNiqtcdUe`qDI+kzLUqrk3rt<6yR@pt5HM#68xEo zLShy<*l$i|^GE9?Mr6(@@x!w}HgsBiX2Sbok+UT} zD{;v;v~y?2%M#w#ik$P}^Aop20)9ilxiDUt;5Qxloj2$5cum6l@}P5Nyf(q_4oW-M z#p@H^S0|n8<4Y3WHz%E&;!6|1@cMIG{P@HR9&ty!De)SJW8om3pT$=tsA%~HOnnf z++8@&$G0T*_lOtb=OnzZF*?7FZ%y!+O(b|deo?~vlB)A&{QC*-o375g@yip3qXHR{ zkK)@BOFZJ!_%(?WJ>v8D^@;O6BARzo;(CwB$-6c4)mm`OPK5_hqgYzOAYo&^iPYJz*7P9Zwli}Ucn{2REG@+UUrn0`|JEuhU_x1d_h;A3ZL0ERsi$H^;9ZJwCOP_q&;f^`m#2^dRytAicYp^cwE3;Qby^eA5O5 zgWb{CDcYYAc@in3$7Y2%)r{d6tjFAeA|o$KfbA80Uc+Z6K0Gt_u8U&ugt_=Yxs$12 zy*i=FoA9|4pL;~DHe)pS$Kz9iPXeEb`0&*<@7jvGF2d(>e0JjFUGL@NY!jc)@xc#f zngV=|$H%+Y{T`(|wVap!@6a0_%FF8}3-Z6m^LB^QTNM9YeF^28uISmzTBWH& zUPTt{Q8n(jDed*cYo|%md2Y$eOP^@Tj9$ESPd_{duXJ-@mxG4a4eV{1eE%0zE-S9eQCd*aY(hfF=>(8R>n*50;*JG(kgXl_g=rcXa~ z+To2W4x2i)dD>xzO+CEv&_iden6aV}H_N9tHZ**#VaC*k=4p)wn)0ttS<}(AddjMX zuC|W$bsgQQriOIGl=P~WuBKFL%ku7NQ>IOwhJS}nodR-A^YZSF#?{T~ZcsfENVPY#HFulF zj@FKzu5Q!1rn@!O+}4sdtD4tlYhy!|i|cCZQdQNd(mD0XqsvpZrB(CFHFfqe_2qS` z@^2|QH(87SXvh|*t1qpsPgc!Svb?G+OU$WWSW{VEUtZ?%9#d6cy2Ny07@Jew>4r2U zn_pjFlRCP*wk}y+l{z#vHJos0FkzZml}>l2)Cg?eoa(BoatMtI=2TYKl@CZ=P+ne> zDy>AXZ0W|1_I6kctSFUU*V$|q)h27|QpvK)a=oo9FRx0~RhHtl4x5)vNR?IB51J?$ zJzXuS&W7|VuXiX7#d$U3Rw}9~ubop~CDnwIQu7ZrtfRTR(W?S#PR%K;tejmsXF;kQ z>YiPhtebCjn$4I~nM92#pDN00YpZLi_yJ6Fla=-5wW*rg@@##BGX9I!pk^6Wf8|U| zaXf>S)t1jGr|JWuXkx0S+M15P9_h)TrL>p-w(#QGWPLdl6>7AuycU+08X|X~WoFUHgm zy(X(*LRIz2Qk|Ar#b?Z-y1sf&b>)!lR@anQ)zwv|DyvJ&QsqnPYfHVlq1@!$V^VX< zYwPQRatu;NMf>+IDdB1BRNNSRvNBMKv|mwF9(RQ>*GrRwczpW)+;tD#OI8 ztqwJ`xGtHRQ(KO42@1gUK?}?)uTRy_M~N~xm|&UGvNFu9%F5K-P)1pK<=`1}ps9J~ zsfE>L<%2U+R>S?U&R|Q6s)oq$MjVz|5B;WU%fGcKSqpbpQ=2>*olGq#AE1C#O*y6~ z6({DY-aIfIaA&NotbA_iqROz9&B61t05=j+aCHllRRhhPd3E(ztx{#B^`!&L*}T9K zmK{o;XY}lHp!<-;sBGwb&yA^x4N`%(e*Qnz0acfVhTVFsBqoGsgTekvepzjG%@Fx> z=9gpiOXtifud7SdCg;r$YaZ1~-u(K7Ap@Z)+PN2U33aH8Q!ZIGw>l`zJdE+tTpt5t zDKge94DtGOHUjQ*AE_-}oT^#)j6`PAob3oDGATA}$&e7J zd|tKqgDejXoYG{tsFpy&TvRJTQhg<2uKLvMax5X`Mycurrc7_=)WSL|E355_a*Vhs zOm2@8*>$x?D~~Uc#uFmZOlke1I$tV09Gn%jl5Ish@lXDi7 z2O1JL?JFJb=p0%o0zv6ih7XB;ffv*H21T9^)?+Y;JL?iq2Pjh>t5QL)~K4 zsjs7TwSKug?PoYO3g9B)(>}5XY9ERI&VUSeMmac^o|IlqemzqppH@H)sK{~zv;ww) zN?=t1RUu&ztqeY_p148#VQR3-#n~$9emD|yX2Vn@ruCLtAYzL}bF9Nro@@*wOYxvQ zp?W0Z_}A48%JQ$9A4D`+S*jPL>Z`eKRaPQ=ls%lUi+1&~Jg~hQ>@(PV8?uSZ(SG{F zq+n92wCb3YL|8sYrYv5TZ%y}CT7!KTA}zRNY?$C7vA^`mrn&W!TZfQy@XWGm3{)@^ zgR7w_sztZ!?P8-s&8=KiHy`nkY^OtcU_mZ1 z;!;`4bOaGFV}}fr8FD? zlPM?GE0N#76&+IsKF%6(X1WZhnXwH+Qv_LIaU^C$GZ>(OnHh<^7I->?IqFqnr(j(@ z0*5lm(I`S4l*d+YM>176e^Gr|_2Mc7Hki7ZTD)xTO~OS)JRVNT*_1sd3iH6z^Na+G z0Yh*Kn5r2}^FcoD4drMhT%GncSy#6R8$Ihk2FR7sOdU3Tb*Xu^<>d^oU}JDp|BgF5 zs{aG#(nT=I!K+=6tgM9MXXAL&3tq#W$+BqV8fLKO7#LM=JmyzdGKNf*4jd{@VlGB? z@Kv)*G5I>1+nZY2SEkY}ZOt7$X>mkawZwezB)WLhd4+On7nbUli0hh0iK%(jXdHUh zJ+MDZ!YdxYh{Fn3xTwn7I#0LY0Ow%CK2RRaUWNs_3-nhG7c`WprL(JW%u)*9#R3B> zO;#NZJI$;*0~v5SkeqW2b`sTaiJ5~Lf9neo*Oua#p}x90RashV&zFM=%en`yNH{SV zq!Wt}fz`n2!8~AXWpJ3@DUiQ0M%{Bula-4Q_zyBJRt>B`f+8<=ko`()N4Gto?&)Sx zvSM6)Ct|Xf^^!|#aB}16%%A9O#QkZML>5?o#jIgKq9kw`!tSRs&|qePW&p@2*C%5j zuYB&@f0geq$4RDB7uvL%v%2@B4|7;M{Gafo>fo{lYpf0jbY;5D_L|WN8t5>s8B28v zZoF1zjAdr$?NNtEhm<%wqdr|BU@=svukwZP`k}6S9YZisX(y|GXkE)WBgGCI&a zJ^+90*HSBHwlI%Wc$k8DJV!I_>M!BLz?85upg@L(Hu%zsprry?HnO%$mZvI| zvp#%EyOa|ZM;&>-~XFX4$O4xY;tS6N?cUVhe(4$>KKoy1n5EQ#Y! zJg4AM&|vip8UhT`p5@cFh8D}R`Idd(v$(d7re=x&ub>Z+?42l=YqfV+rpdlzMNRQ^ zScho@$HKRB>8Pyd%7*xwhhSMcEpa2eIb_HwY+jt1)zmawrPm`&>$#=e*La$o=I=ar zv5>u<0iAV&qU`{WEy`IYt6}zOsXnu%8>+8ffM=wPGx3bmWK*y^4=34eT3v_{5B2MP zmw_zgIX63=npmq z%(G|BS^1?#9bKFo;*`oiDg3#j5dTETWWw?4DB@)ap3V>6I8Clhrx zNDm3@4dzhx=;aS(keU2yeH1)I{ev1od41`C31IgX;hrFsk1oT>b8D*?hSNAb2b*|E zA5;jWFRJ?26B@6f)Mw^=xV_3`)q(+OLug}RDIP0T*W&!EY(QUZSVKF;)Z>Ho0fv|5 z7;-*iT0u<%rYsi2+GA31(}5W$W@n?Aa0g(#u*AW90}harIPAhZ2URdCya-TNJ_qa1 zz=@mV=$pLO}@nSsM8(d$Q({tvBmb;oo;bjpU0lXU( zViT>PM|iUf%X3x=(Y}usz9m>JuwPHsgfjRVRkmnm(6M4*_cEVo1VC98*wff7 z&EsR)2>QBSw;)*~Cu>>wYCKyK6P#U*MRQ=DjBo9d*^B1FhzHA`ma4%!YrdUUsB*jj zg8)||yuouYGh`<_TVGQN%BIDYX%GQC26%T?GYH4r%F=l}#+DZYs;Xs|=ZRt$3}3f1 zI}-cMi#fW((L;Vc4NBQFDDRoRnxj0&8(4{@2L1gMMlMg5)9L$`81sO#Z+`KKS zpL_Tq&2gt)KBvq+l@At02Nn(10UWoXF?d+9KkRadg9*t8TBv?rW%X=&An#qLU@KTR zaUzJRaWrT4VAbIH{}S1z4JQ7eC8*le(KD*6@W@QoO?!eGY}n5PEiD>sycZn}{UU^( zS64poXyRPFKkFS-c~+ywSFwnj8l2wpltJCmKy#Z56Oy+y`7G0(YJ}<$yWx^Eu&{J! z@KV+??HLFjGvFnSLCV`#$E>F9i58y7>Gmy+Cu6COPQLKkZTLd4@g9(w9(g0yG^{f1 zU@~jETMXZWmOpq4xqW4NmFdCj!C#%0N`p&Yl1{ZWtp&BBt6^og=~%I%yE$#Znth$P zdsRnQT8bSy1B~tD6!LHuYh^J?#^ko<_H?&t=(evlz-o$Dt*R1LQPe)hF$`**z)sgPNi`S;DIlZc*$+WC!XoTilThL{6XGI6! z@I?i_DyeY{#F`Yw!M3-erL~#;$|@%F3OF?+YP2j=6z*8VijL0IiY9}9UjB+E`=&E; zFl2b1VROjG;Xv6&o_U+@=H}I@#-6TB!HyNoM5mj~ny!{~Gukj1E3bIBjtkrAY;8!V zC<08aTV&~8*PU)|OLca&^co!Q$nz7gBn1@dL{_%Jx5BAYm=2z|7 zUpH-F(osBR8trF!RKFeBQgun z%Rv%3Tj@noon&rY)!ew6#XIrlS2GG)1$DQa#5wIX!bxV@8oE~-Db(4puC=3~DMdK~ z2{dc6(f7cB8+laN)!oYvY_1C(ZtGrYjTk0rB|s%B&}kO!Nv}BE&R0xqF=RWy{*K6O zWOgTvw;f7@e?pI1x>L(R!i=Dh)Je@<9jW$?cFbgaxkG#ycqkdh%i0!gAZwE$uxG^0fpEVRs8g+jOjfL=EU-JH7=1g{Gt@P0cHs zG1+`6oo$WHu*EhwlkRR5!IwU|8|-}QUX|&yKFACYDy`N(o;p*cJqikaP{W?Twg!~> z_DaTvLXSydDzrNey|^W3iT3KH%s~7#bWcdBMXPsUb=VyOS7n7=2jJ2t!t!*8;(b){g22S*e-xtdG-6jk?T@zdH?C5Cq8U$%u(B&r$kA?+k zb*ibk6Yhldr~*@+u;uhBam5rzCNuQ3)~q^|Jnh6Z+!_`^EY@;^(mkCkNjJ21f?-;! zyJxxNGr6mo-nWKgJ1V!Hp^n`Q(aqzR}+rGrdzn%vM(9) z%oSfCL+~h555Ae&v|KD)%?*(-ErdqlzdPDJPh`V4+B;nn-Y0=HQrNPwv=p|l{c;#v zR;)|O^Dw>71ni<&c|w$$g9yKCjqQ}!YgbPv16LbV(4*RrO{>7lfGCHdKtmhm9o>sm zrtjY3V54*)B^i)tn!CC%$q=w+q@eH^K&t@CF1Ip*Ov^;rmcuhPW^q}xofl6gHNZxN z(OaHuA{HE*jM&e+#a2U>RIcgdVpgzwUaD1#j7jFHtQ{RGsD{N!;c4F*S86UE`uSOO zY}EAVN39#c#(?*Y%VpPonR7Lg_%Ye63yN&5?Mi)H**R!A%5@bSO+)k4UESD0dO*h zea9L*c-X3G5;Y{X=~CuJ1yWa!{o<&sX`QV-^!9SkLY8Jrm@*KF6T;>;!GE{5v}5ku zNKi&0z$Y7?F2tSKkgi;bHOrPp|FsLo?qnsZ!n*GZ{n@mS#)d%@g}|Geo-RxfSXCDT zIlJUzEV_DI5HQ03;%m!@SKtod3vKKP8)k*rgfJ49WuvhH!_fj$PB9*k69g`-jC3&1 zx~Tm%Em;5ITM&<7tKVc+;)Cc1VMtR)n{LavtIh1MHH}MlcW1*Ie5slI(mQ{sQ}=2QVorbaH-HF!Wx9Keoh$!s++-`r+VCDVAD1L3wMJN zqUy&+eCWD0wM@k}n$*K}H`$ki9fHbtwGv2GEo&|uU~ z46Y>{@5WX38|`qF+_kVBnGyqn6&P8s8IUS5p*PMf2=#%lqq70pSDUh-d)L|(t%x{u zQr5&PMI)k83iKhmrXl1Tp~D^ExqM7-q!&cBundwnk87GaaB({ zzdOa_1WsZbp~{5d0T=i7R5^Elt*|JZ8{jMQHq=j}8*Mm4SlNZ}5r-iiGFzs>3gPZC zr#riwdzw1z>|fK9;oG~zhIj`JFLi_~&B1-n$iDPWUp#}R$dB^(NA=xu1p z7^W<|%RA6HmBb!_$rl=UCYwoydRovLcGGq^v7v*Pm1#$<@eO4JS(ptxhiPd}!Q z90l58VDAE~mP4wrtDm&T#aG(2y22C_A1#N0*tGW2tzjRHBNj~QwCQa%DcCRm^fo9b zvS0zU-)`nai1u#yNbB|xJHZVy^`xxj3|L}uGRciT*|=mhc66@e+?B^Kk}4CH4=BWO zHW+NIxJ#8#kEP^rAMtBC)t>I?lp@@F(XO$t!6u-WPeSa|C0Wb5a7c%b+&8qC1{j|_ z_~DJ6OSt2Bi1Wa`H$lnDYPs?;ABb6|i9`uTMKBPuIFp^b33(PX9Rto2LD}p=Msi9f z?lX)uuMENddD}Fuav4!{OVQAU2UhsgY1&}us75SpMN`8%&+7eYCfy5jY$RY^LeRj! z9eCn|Ua%l{No)~bOMD?CsxE|kspfWBZ_sUKFP||TDLm))V)ur0hn*p4Eh8cX;`1s@ zOHRKOwsIbY`*fR?qz#8*LT15A1D~ooATL><{9mUMw9Ae6$D0hv#scB~SChtbvS1p33_e8(TV8VR;g#3R~{Q z6DNcycK6PTxPxzQY{GeO4|ZhUAt|2}Xb_J@9sTTBnXOiiOuGl&v z<)mxZ=f=7RNy*0FhT53>9C>fmuumwUOGyo`D0X)7AZg zwgQSq%lC@d#=J$x@4kl4(bEmKoN;`%cCS`l*`O48WGwyTqu^$2gFS*Ov%zm5De$B> z6AQ?bWqDJ8s`4TPN#*gMS7$dKU?Z{(G)lXJsjFjTt27^q)?^1d>`Gagm&QeLO~9+G zS_YhGaGIM}uzpsG!zbc#6qjBe z>HCwUgeXwsCPZNJN`w~^W*Efg?SoR$U<03cvb~;m&Nz9zB>UV_WRMDFAS86eaAkIJ9^W9x2FzliA+j>HdpoSa{*Q&l zpKA2#Z4<-cozx6)tV7Z`RqD?^+9fGFB6uS^?bX<2VPq~WiDzz5nD0o3 z>%SVriCEuIc7?Um6Yzs8ei}Z`h81=+yIPyDc;jI@YZim%^Lc3ikN=p+N7gGNL$OR&d*84)0Hbk;|g9hgTrUE%9DvTNjX{xvvq#A6P;Gh#QAJi!f4uU_haO6kGQ z(lp8z7$V@YFjt4^>;jf%FXl}l6KHkM&o2@Jy ze{N(;^bF_poXzg0nEmf5l;KujSz)}aaN@bnSvhCATViMAo*v(vw<*7@@K*dHs`sm; zWS@%9e!S6(zgSyVm^e3bcJxeVOU@bY>9NhZn@|@R{e1jI+p@y_$aj`=X3iG(jM(Y9 zo8z1E$_i)s`S^>sQr}sj`X<_6;Pu+&FXEOJ7O}p~&ZeAzjFfl0#|Z2c-uStZO;HpH z%Ee#M9jZNlzxfNT34FYZzffC7ot~Z1sq{JFF#!21yuy>!ds!ib3D^6dq;t@&f9xwk zhvW>5%T1C$=(tSukIN%N^G)^h?HHObP~R5egWU`=&i_|^_{TmW?PTr5pEo^}M_%vZ zFBT7C*8v+?3+9k+Q6y-4Wx}Jjhdh7ZV2S~{6|`TzZJ_-&?jP5CBriCp{dLn`{dF}7 ze|8QeKzkQ|Re6A&u8#y{V}1VmCx&R|`SZ!|{i-r<{c|v2fBc2!A^gJH1Pkhw29_1( zlogIXH+r_SIcJkAst$|?f5mt}KaLO1+l!>0(7fFi4agqu8~edD@8YjS4pYEaCEDdN5i2^@aJv?f*~8`}=;p*Z0${ zkN4-@8Olq5_AdS^_P?9E{Kf16wt}CH_s_9Ss8Doo+sFDCwCPsK$DBGl8nAUMo6NO9 zeJ=@r!1e<9{B`b-Oo9BRVR^0(+Aa0(_r-QT4C>ow9fbcKDaU*}2mg^lB=T9|Z~|=? zpUD5|$GZP-KlMGOZFzH3x)mFiE}SMccTH(&Z*1*pY6jx8oUe%vAzTL@m8ZI!R!?ci z!F6x*l&>B#?U1h>GGhu}itg&@NKfhM&enyW|2`PcZ+g}q%u-8bi#YgCivI^%`wvvH z6rK1_RD%-^o+%GimG9@%|HY574>dwdd1Qc7vY~4Ke;A;p4PBiL|A~5Jknx`-`F~Iz zKOYYp*Ml~gf$z8G4_U>mL6YP^5!*H}!1ZH`BX2^2!s6xiYpFH7rD}Lf`9t~q;rgZW zJNirQ@8>U7b6$!g1-y=e8ZZI*=E++nc=?$}s`8;xy_-~96h)#cR-++p`t zxy5tc7?O8Gwuw1EK8+mC?+mKg=oT}h&&{oHb7C7~&W}!u-{cm=oIjwI5lMGkr5km| z_qzqoh(4)fSnLeJiKr`H>F$owqhqJLyCvORr=`N(S6aW{jX4$ZwCmg(bM828S9Cla zqt}lQhezCKesuB}H}0HJfx7yfA9nS{oIelmi_gB-&EM!o7sj0Px^}sdnDg22{+P45 zYge?$SHtE=#4X4lBVvH35dC)6u%-%kpj45CQS9e3tzU++vHXwFpA+IUrO417a!_^5 zdG*wOYU}z4`ZK%|>V+OE+&yBO+%d!ocT9zw8>@5=T;T3r>F!bK?o}mP7zYLIn{+3{ zDx4=!#kiPrPo%=#D=C>1DyZXH=*u~zf;8*|=1wSo${KLUk3bZTET?(5V= zQFhA7+l8?zLbrxJ=#DIR_gvt{s$$NQr}Vi8#+>cZ3U}mu_rOXwXQMlEuA5WkI^{9v ziBtOBQ8DKMZ?I-oomY;UvLFT*BP42J{+-TCB0xz-A z-4FaDWB18;?+#)2taOKM!pKv{82t^ng(fkIdBRv5bFPH**%!(}b-4@O-9trS3uq1_ z_y+R5YQ~=Kj+w_AobTJh?;z8ubPM9W)JiVQbCbIlEN#!EyVnAD!Wp!L&0wA2e1;xu z#CY_%m@;EvJ$piq;h6t@ZhVs+93;YL(I;V$jPt=dYRb77!$fC<(y@>2-6ojg-n-oW zo#hqoWCsJ~-SxRsQ5tRR6Wf#%b-(8HoeaI*e+sR8bj*1inYmSBT%*w#bXSNJIDsfs zT#TuC6`I5}{aFn6PvBl`)sDq~#!^w?dmP+yx6pYZug@Ll+};bfLb+(A&OUuf_rOim z+FQ^*xc}+)vrkT+9gMSLa1fZ71FK6KSM225t4%3Yo=ci~)CL8qQpKJ~sEabOSgvJkJ zu&%-R6jL5n^apr_Lr}+r*!}JS8{L9?-QqLc+;TT>qZk+FAci5Q52fyR<4LiH5&hzO zxbVUEJcOZl&O-Z`0hfa@*Es?9{H{9^OILLz`VL1ywS5PwbS{RDr^8_AG>YKsmryY@c{OHz?)IdcvpMGc_M}~y>dued3h2=J z2z6uS`FHa-wD9cu-wuGNe*)$Y=9pj3e?TZ`^hPLQ3i>w^(jNrOjqQjz&sc|Z7y5s| zJa=Mc5@QRg)j$fJt1%4wCEeN1t1y!NoU1@aoxfs;{hyD*7jcp(@_(v8KBa-HpNG=7Tu?7I?|^-Xpx`ODz+5qV&yOMoa-4S9=!R4KoG&B0U;`Vm zgjcw5*$Ma?E~)U1TijvM{l?1VD1;2Lq{IZVK1{KknDbgboWe!j@tdM0{%#d8dVwnv zZ(1!Pqs?J`?sTWeT1G(joCR(qerL=%r@Jp&;H&4p!iZa#KN{BD7l?5BV+;oF!-!S5 zQ&Hdl(v<}wu0NvA;{5HHH|zSGKOtfR!lIlv&_N3!9K7Rq78{?!nP10fdAG!D+ zSN(GT9d+g9?-mGPUdojKW<+!%`m`O>Zy4rOja!21@bAzH=k&FG&OhMbhR05I^PD{R zs10j((UE+Xi~G%M&JFPjIKW@8 z>BIOs*P;I0)7_%E^zfO##aL1{qRmFE@eABh3)~`SH}F-(b~!JuMNPNn_8~$r&a-R9 zvE4~|p2Gdem~&TdpSULDJekRq)*oC8rW?_=^WqvS`Sv($?NP|F55h#qF?ORn89waH zm;+vzit{KECp)m=m@^#Zwy*6EDD{4HvM7HPlwJ`qhDVTIJV^R4kX|@Q`m;l%zc@tt zD@c#zJHsP^R^LJD*!+c*#yJn2+CS#(iua2zg-RyIHbC7l9Gi)8`zT%!Fo%Dj{9gGV zVk6)laB9riguz0;&&`LeeU@$&{Of^b6ln4s|w+~IK5sQVyLG@TJB z3I5n!C^#%=7Z>D3-2L(~>ED+1)42pOtv2`;QqbVl5>Vq_+j~RWyDZ$^ZfIwpKKC$g zgzj|<7Pv09P0mRoY(cQipGcd|D%ee?Rjfz0oBx+q+1CPiAlo$e0i%K~--edQ!7JOXB>HG$~c>QF^=#veOO$k*l2iP zT?(KdI_mw=7`A}$SY(Nf(46$ItJG@mm!I&qXc{62ToCJF6cgVcG> zw)}qQwVrr7;23TIdlci&_&N%o^~;{%*70uS$1q5vDlxV_(%|;|pbz|FejnZm7Nl&{T>r|_*t@64nvi8OS1`wAmgyIIWXe!&N_&6 zrkh*y4u#p=*-xEqD%uqo?DL1wq1=ZZqs>8Psp7t zu~!~e&MoeQ1vvQN#B#9SV=$Z_pd5Pp=`bu`XQcbt(i_8I9has115!VRpl7i4<|(9) z%7MXkR0(^nq6AYWp;gcMPN2<#M#wIOuo@@CkRNoa5NBe zE*K77ZWr+%wXZ%tV&l;qc)dAOMX z$o4?be>4R9kCDDR*@JP@%^CKf0`EZjR|eMpb0m)%L{ASOJ%5n&$B>?j!(y1+CO21{ zJO1K)&bbvn@jy&9thryo_(ft1V$KangHwMVX;|HdCwbiBB%`B!_HjlLj>hsG?2Nf` z{I&xdB}~;K9Q48%jq@TBVE5O->yE)9!h@E4tg~of5}e3*;9j(3Y@M-{2Nkbye$i2Z zV;tuvMergobZ|TA+>GKQ7t*erXOWAPew_G3;I$s^=yUEXssILO=YtRn&Y{$uuo1n& zItKadL3SQazmSlJ!$9W_R0bdZ3@XEHxeXLn)aTGxA!J2kH>3Fp&htpv8!O%}6x;;C zkhrh&0upifJ!}^``4bc@h&eA6^`l~*7meE}$B;$4oNJMV!~Z{mn+KDz7!Eh%J8&wA zbezq+ik4&FLQ6k@p0I^}1AK@ru)e@YY~qqI9HrtomyK-)*F~1=9dP9?Kt?{?0iTzg z+tC*ol=DX-u6nl}i@o#oNVv{BaJwgBg^@UqbL!xGcH@JG;V5}WyQuREG??o=o4?E5 z?aY{SQ#(VUUm=K&#TGt?#O$V)UEB} z-JCZ`T-t8;xSx!KAKud5ACU9+#q`7RKih*7y9h9_xS~z0=4M2dg-$;~k(_lcixN&t1RY7L04(k$S5*sON&Mz}Zzy$Ligq@;)Ij+8^LdA66ZQ z@ty@%nAWFALBTUv5L;K4WHnSB2)TpL{|xET%D_zDFp55<$}M<+CH~$@vCkgWhdVT= zcVgP-jKUha-Hq4qnanVZBc>y_E5o2*+#2WIR%!d}QPMWcvnE<6)~OFcLd;7>VSfA- z_gEi)FbbOfb8B!4{1D<4Kpe>OJJ#o1&FV7ueYm4sNR>3`;+jzyxV()xAhGSUK(U1R zzivfbghp>-qraj&*dQY}&LIt$e&7~+Z?Itn7YW!0+m-|dccU~t z#^WKW?}gOSd_1{&pta9=5ZVKxLg!8JbHZN&(V{pQ8HEENJcHci=KYMkNJJXF74+)t zz6+0jWDn(RLl!31Bgh+ZrW=Rh-s#nVGYOp9<1l$MJRK6zKQw4-!#4046oKTodF)~p zltx-Yo3h#X>!_gC-+}yN^W$r99{4Rh*x~t2Es*<^Z^5Wg879p?sK(Q6#h;IY0dH#U z53D^GB2bIwj}4^VFdCEkMMP;)=VruhMQ6DA^OHD{f}2?HjzC<1b1Nw5ad4C%q#oTb z<4^*H_a=;Eeuo{O7&_M#Ah zYPq{lEmiaQY91Bb!yq!|^z<{Nt-$D`(1K>Ob`GXnH%(-LUE-25)k{(N(EfUY#J1mvkU zy#cz`ybx%Ak?9T4OH3j_A8Q^A$a9?8KR`E_I|B6=m}3I+Hkqdb@~t#;1M~^z#X$LX z^Gu-qF0*@p?ls#3?XNS50DX!n4%9co)CJ_(VE!x6{$?{PKyNY62Fjmfo(QzR)tnHZ zFEpbA^d;u5fIOF)-2?RH=D|RF+srS}UMpWZJy!T|lKDGliJadTIoy(i6n0s0wpf1v&6%nJUE=e92J|(V{757Z^3BiCZUis# znDt(9_}e#8|E(FiC~_Lg|0+X|j_d;ek_=rEIR*6{kMA(pYm~VH`FLGauW{xQ^rzD! z%^qe2__OsNVonGDsto@$vm5fS$?)fzPUL6H;|uzzZ&oJ1%bbAxiJ9`}n46HFrAL^B zkiRLzf4P~8`uTpUy|$Sql>acJFVF#buQ5M`KH{1BZ!q&v-xja9x!D|q`VtxXcJoct zSCpaeHpij9otg6e=3~@%Q6_(siBjGS{j!M$^#6s~6YsY1!aHPm3GaYNF52fk-ij0Y zbkO(Xes87UgFL^-J(pqfcZ2>A_Z%Y9pF+Mbaqrc4A?Q6J-$9zc3-ZhdJyPj&Kpz9T zQ0W<Lf1wIl|4h*BpeZ)#v(P@vdh&EY-X7%RO*zS5iu~_@#v6k|{}J+> z3VN#2CxdXf6z~W_UivH$ny+nyiX|gPX_%w=m|;}p?$VB zS?Ltydk^`Olztxhd!TVoAC;gdgWgB;Z-jj9xZhLhJkaOh9w6<_0RLZn<*$Z(v~RDz zcOlPR!fW~KK;I3T?<`Y)PZt=&_nV8AzIK$gN3cnL7nF-vmJPq#ME)IUs|ugJmHq+) zaSQt6wRaj7fy?%H5}t!wdO9G2nX?xK$7SW85;=zhgUjmg;K)2nf|vXU5i*w}qnIH< zsqt!(BUb0nN9TN(V@CKW+5|f5yBq`M`7Q_k#D6(vFF%R$9Hs2#nEkT^?i{iDY?5OR z$r6%3Ekw@<(MN>nnIZa{A$oR*E)UW3Lv&?`t`5<)A$n1WUJ{~@4bjJi=!Ov86rxv# z=o3OTXF~RJOjnk`orCWX`Y*?<^OMLwB}8us(VIhb))O%z?eMyME zG(=w>qPK-;&gAUnnCr3x?i_PNh`u>Q|1?D39-{9K(fuKso~bB-lmW)*Y%4jq%Vo{&R(R4aiP?U^kbp+jt!Onl`cuQg0~p!*&6NP zMMB?f4rXA5Ya2er(Nj!Z`I*N0_X+jaKO>p{9RKLW+i!>H`$PJ>Jw!hlq8D|FHb^sxPkpBcuCARxz-`)rn8Bx!n9N)ZdqMNq-4? zDn@X7qS7}Bf2BD%%F@^);8SdB&G9PFBSKf3DaE+ai|rq%`CD*bY!;ar+8-IC`H=Qc`V-y9#MPdT2Tw8l#hDty*!GSv zx2nCI%>3vc=2TX!7jFxxD7{Gkh6Qoi7!La-ZGV&K$1%++zpWqpO_i5wD>m<%m8xHx z|Do9#;Q!cMt@dd1pEHl@_}KCs(aSR^S^1vt9%rab(|cszbl!j7jJLX{xOO4-T{3kBCT5AMC28l3(ah$t^O`Ce^dD^ zy%!>E)?_c%cY)rEy_up&Ozou%>BWeD{-OH5NAwqoJP_#rqh_>@7pq}?@3NzMk^Uku z9<$B3P=6X!KU2Y5j5izBX!%V-=S7a9;JEB~Z7^vapH`$5BmTNZ%ae!gE$1J-c>9CE z_$@J8b-q}A-ELL{?B^}>ef38yTa5MnV6E$L>Hj(AP1PTNAE6lWeq809D*P{-h1z~v z=xfY4)z=d8N8N}Q5n1_%M}DFFY=*a|hWc~7%Fpk77DxAuRO)ypz*}sdG$o$>iag^Z zf7JQ+lH`w$T&4VLg>Eo)$}jy#JUTfrKKGl2I-dOQ zcCqONywhx3aw8cgy!pUDxX)rJwzW7 zD&HK+zf;G@D?cm5PrvJ39EuGg`G#Q}cs1cu9Nl6*3&~f5^peF9$tQM_PDTvtzJV zdgb!kM`M%8hkhPUM7inYN53A2ov^>Zf*r8GqhZe_8zLq_Toy62h~P`WE{L-fA15Nb ze2qwb5f6=+B8&&=sYEDk77=0dTH;qDW-AeLmSNmW`k)UYeIA)@oIDNcqRv7fVusDCRl2fy`z`A3>(oYYej&^ZrhmPBk9 zTZtIgPEDtOW%^o8KUs0T;wIu&oFNj=7p-T<{aR~>VmH(~^tp|=E@E~Pm+Cm2uJ(m~ zb6sKocK|8JBgB)8d7StiW1b>@&zNV4=in@tcnK=w<&F1scxDEY?KBZlAMKp=&|X*% z{U7U*%PaTe5Pdz$B8lTD_JeV31w8@dD3@362IbolvF*-_$eD7W68V64VbCYkx%4Kc5J`|Fcm3Jt6w%A-X?AZx7K_ zDlf18`z)EEajbC;l4uV*6hBl1WXnBZ%;8M$*71k_X}8q3*zHAR#^trM!A{Z0los4U*}Pwh$+V_#QE0e*?-t%F1wg^*shz zKn~#hFP)#zhqSX<=gC>xUc#;mwDZSNz69wn5y7{UI8yBt{iSH^?_{8JG0wh;m~`~- z&N?vj^5kJ(x|g??of5q_nW81^eq>-qz~I}7)>jaxd0 zh~vjNaDYAhx7yiv2ih5G$gaQ7==%Gt@=u7EdSsWJ5;1QR$Ee?cJaP1g?ckqru0$+F z`~iMPh3T8@csZw{jM5ll$&n-aK%lX4NVJk5lCp@QeK5y-p zeEa$Ny!wA-V?5@|<)y!1%q%2uJYhPf)O8;{W&^ZI=NkkawO~f-% zFYzp6?j)X$LcBcvW70H%EWx^;ChnpBu2|!u-R*i_vR>B-Oe(5^_Ga*pNR#1u&3VQ3 zdZMP65n+$>fwZeipmVk{l-K#LG4;fAQ5i2!o_FwU6eQOVx(=3K4;)~Z?;??xSMG1B zzYA<~CjCA8Y~2Z`zi;EMl2ICe0Oj)P+ok>mLW+NZ9Q3aPj# zjwE7%Vv*u##qo+IiV4O26elW9R-CE`ka}|z|5NQqy(hu1vfgd@bx6e);*X3$s4mD5 zhcu^j^ct84R7#ws$f-~IdBt~$*BbLR_#NU~iU(kQAiYHKRK@ER-%lC@~W_!0QKCL(|7wOl*ZWXz|CVi#iql%v^ zj>Eu2e{9T=#OsY&LA=43%M|Y-A|8KPF_LHL0~8l3epm5&;!Vczb=968L=hbb;oyh!nW#hr>JFkqIStJt7;hT_eN&nteR_>JMVTmupD_*q26 z;dc;kHRcr};%>JPc)Kx&5brc*u_DiRNncBZ(LJg7zT&tMHoZ!5t>Tr6{lvSCc}+2f z2}pXfVx8j2ir-VbL-BWtIU{Yky@-h4%N18Ep0D^b#osA9#g>1v;ylGh#nTjTP<&SL zE#f_RMlj0aVT!91FI9Ysi2cFeiQDns1RP8BUSsAFu@C4aBL2Uci1_{q#lI;g#@O_w zifa^aA@0DtFN#HDEnTX3n&M@|hm3ic_^^@pafpd=mgf7V(MJ%MDqcW*6z8XkuPTm# zBV;O4N#ZY!d0%ndo|dju>>)mf^JK*b72hQO3UTIMz!!`;g7_lrK=BI2hZX;>xJSbB zU9b27@z=)ewztJ^5?{hTgZLX`&L{rXn115Rm|u#qeL%lr%oO79;Ma+-;+&B9dt+`S zzJ_%{@pIxIjQPsGz(3+$8{(ggSwnoom~F(Juv_9^jM+u}E8Zd6&*B`#wBmWhx8NTY zqhGP~L5elRxAB}%@iWD}_qXZu6qgg@c&g$Piff11+AQ__$)?Af&%JoP zZxUg*Nu|G~cpUK)gP+m{evWtEG`(BtHA9G!@L zVT&s1IARdIn22^SRr*?`Z&3O!rGKvUqe?%a^h=7|_pzRxN^^fldma(B?eN{Y=*Pw! zs`OFBPw`XYN*_!7hcPEAy+QFT#jT2$D02T#JGe>_KLslEEsA$3?ofO}@fpPz6kk*1 zyL+tfZ;Jm=bR3(Wr#M1!jABCZK*cGFUsIf=m{hD*T%>rcVuRvJ#Wuxm#dV6ODQ;Fg zTk(9w?t9u@h12lYEfaSz44 z6{jlBP@JhaTXDW3zG5cz)GK~l@p#1*imi%Wifa{5Rm5)>NIhpMZdJTQ@p8qh6t7pj zMe$BW{2-6ivqSMQ#itaXQ+!GBRmDFk{#Efk#g7y}SBzpoq2A((qZCUN_fedvc!=V3 z#jh*!`4#J#t5~U6tGGn*IK?K#6BIiYdlgSs>{HyLc&_3_ikB&FQ@l>`CPmp7Lauw1 zepvBI#a}A^TJd*^uPgpV@o$QMSNvSj$+i8?R~)HWqWBfXNs5Om9;SGt;vB`KVzuHT z#bXs46jv&?DRwKaQ#?&^v*Ou`=PQ0s@e0MO6>m`dsp4IV+Z7*Fd|L5E#a9$xSNyBu z`--0^eyJFXTfGfe9Id#A;y#K8D)Koe?dveb`HEGF^@`tCJYG@u@hI1-beG~<#ZwhG zDW0XcRgv$}vE9oRuTs2T@fO8975f!;C_bk6l;U%WFDbsR__pFM#ZMIfshE?ecBWXQ zI99PlaUaEriiarjxiI_jbw$1}AoEqRQn6N%&ySgZoMMyW35uPHy^1F*_9<>rJXi5j z#j6zMd<6C1qV%1L{favjA5(lv@j1np6kk>Rlj2_$-&6cZ@pHv!zU|j=#j%Pdiu))| zR6Im+y5iRr`Mg~8r^xqfNY^SZQ9MquN$~{5PQ_lulNI|Ew zcEx)X?^k?8@fV8ED!!=risBy?cPhTC_@UxI6#2y(_BW=;_XS87D~?y(Q*l4VgA}JK z&QP4GI9qYPVwGaO;vQPF9?z zc(@|pgJZwS6e|>K6pvP1q1dX}rMOOUgW?v&t%~1Qyg~7&iv5ZYEB-?9S;b!~{!a0A z#lI-Nr}(iV-xp&)+~F4apBj-KrMSD|K8gn^PE-84;%vnV#ahK<6`K^>6#Ep*DCFgPsKl=-mMT^&E>m2sxK8m5#fufMR=iE|0mY{kUsn8! z;>U_E&sV88MZOnGdWzzaiVGBvQRMr$tX`zcOSoTXT$$oHbje}dxw$J)EVM^T-B z+%tPN*^qDv_pm`&?x=_X1A?MPMMXs$E&>WRgd|8bBryq!)@oD~yiie5s8xxr7pk^J zMa5f1MMX<3Dk@${h*6|!vD&JwmG}2M^E;biNqqnB=kv}d`+Vm)=Q+=L&SlQb>}F>d zi&u*)#ovnS#6OE$#P`J(@t@*eu@m2yMm@d7!Qv>9|L@HFQ^i?gnOGxUCSEVv_rFo@ zUg_(_=f$n!N8;xqe?W!xWs3ZNSn7ktQR30!sp6U9IpQMmO7TW~j(Xma zZr^{0{$J^x`93>z{y(yfM;s*{Ef$J1#d+dFu})kqt`Q#>pA%mbKM;3|--+pX{87x}=L0C8BMuQqi^qtI#0SJ( z;#cC2Vn=>%0Dt!L25_MCL&XW=$>I#LMCA9US^k&ewc;xAZt)?J->0YjU&OD(|A;Yu z9)bKG;s9}^c%(Qn?LvgqGtr+dE@e=!q2aDsx6U3=vkys&KBwj7vEH;Rbh);&g;-lgV;_KoL@eA?4Vuyi2JiWys;$h;k;?Kmh#Y*uq zafNuN_=31ad{_KL{95z|1@(6l;yvQS;|0hO=1@U$ibHu@-{k$3V94q}~@eHwAyilwcmy5TF z_lf+CL3>^o4-gL&CyJ+v)5T)3QhZ8$UVK%2Tl`e~Qna6YqaBe0gZjIRgT#Zx(c;nK zDdJ3Vv3R9;t$35T=%B#=RpKV`ui|^+r{a%d{=q@Hqs5cN>0+^Xk$8pJAZ`}l6dT1a z#LN+Dx0nz|i>HV)#Gi}jiWi7ih&PM3iS~1U^zT#BUl3mtcaRNuhKlq(4iuZ|+i!X~?#gD|##s7$z`9XYfF;6TIPZp<&v&HkoUx?RuZtg%_u~JAq<>9f{(dVxa(JMpljz5;(tAozNFOZy zFcQbXkxD;-g#Xi}PbJ}}Sgcb1W#Te%wRo5Kkoc_lH}NeJ{yrD?lK0_x5aU3!BbS6e zSUiYai~o02{_*7R@wu7wQt9VQzfAfK;;rJn;v?k!p7#uiI9?%9?_Z_AEB!<1pGp5h z`uEcRC%wb?pnNA1{`yEiK>8sh>N{DSr}Smy12_+e?9}pi``cu+hmi`y%?}#6fi2G9#$LqhyAMl(Y zF?Lj-XN!Hr!^8?ODqv9#6@B~3BSw9 zz4(5Mc(3@d_-FA|@ojOZ_@($CG5y%UUw86x+=oa%kYxPQ$4fs-`pMEylYTad^5-hO zR=h;KO8k|$N^B5+FFq_jCB96;?>2IS=Y2$?{kxU_rS$(u|51A8aj--Dok`forT3G5 zko1w#Cy?-e2Kj{N6)C-3yii<1KIwVCl71VBdhV3|0QnT2ktzK-<-aKX4f1Kczbk#0 z@;{gUJ^2j&Px5#Wad#CDAW_c%>4%6%lCVFS{4F-Eymj0>qucd!0JvtHoH)1?Ujt7bQ`bj@X`bgNxz?j{gdLW;#TE4T*Ym!2N{tD}SNV&zF8F`4>EoMfytRuaF-JZMEY*&{~-~FIVE6R93+kxCzFV?P&`kp6)zL76IY496aOSWCB7`a zDee&eE=Eob>g!DY4ackW!6f==xb%GK2stnkX|AE z7vfU!X63Jv{yXXSNqaB`Pm}NA`;F4yQ2yJ}o5}Y*?+fYwQvUbS z(@qcS>p&vzUgQV(eyH>j%FmO26!{^(zbbv2@@GmfB|k#Dq+hK3OQl~&?!Y{fewXs^ zk^V5*=y^{|-=zG_(zi+9E`1jX`!C5RJWoUE(Vsy_KW30o} ze^7d%csBVlz7Hq8mW1C6r7s~{a6Kn|wRo@i2>A)lW71zCQU0&e-y=W8aU%Uo@xSCQ z{NH0Ci1@pbDA!Z^K=L!ZuPuF?@+U|?ncR)*Iq7GMQ5GsnV~L{%i3brT<>~ zqtc&{{*w5nxI_HA_^oKBpkA~ioBRUTZ_etO`uoy%NdLR^e@OqY^u5wMPDlB#u)dJ!m%(Bl3BUQ$3#3n!UMPLK z^tsYYrJqm!6W0UMmn#1{>8qswM*4lyACUgI^rxi1Ed4Li-;w^l^uLp+?;G(yO7D0^ z(5~*}*SHUsejthV9U^^#IGKdqnbIr73&bnM72+M@{o>=|Ch>LgBk}LzcVgO%Aii#5 ze{qC3UOZ8pCe9TXiWiGZ#g*b+;vdDQ#LePc;!g1&;tyhnnL&KL#6e=7c$9dGI8!VY z&lfKhuM<~`_lOUR&x%{bcg0V{uSGs+hV!+P7#D|$`QowS>EcD?H=cK;^czUbgPWx{ zkpIH}T}ppg`HxB8ByLsuHt9{`Zt+`j@|i)L72;y?Dsh#FD|7pKXH?7(JBm5vJ-8kd z6XIYoPs|s`i4#Oz{@e1nOtQrCZ;8Xi65(3T5f_LRVzpQ&){9HTW#aYX3UQ^_K;9et z<_Nh~`h(&I@(-T(w75~+ByJVAiQB~w#76OBahLeH_#OFIJkLw?{6LS28Dd85;v0Tg6Dpco2fq(JonSSuT1@6yx%8oCm+H6h}cN3$Mu%Di+mKHV~Kmn$FRPO z-;s|8&u1gO2>vjM_llA=Gx-L_U))OK;N2!}C*Q*Oi;d*l7=LjW`3}Zk+(Y7^|3>_dd>7*{dImb~x1u7S zpUC?wK0lhwCb3xb5c&Le-Y@kP?Q;@ve>9jnIGo&p@fY*RMvT8Wj%>pCi}pDRJ2C#$ z!AWE@#$PNXu{cc^?Q^?YF#goRx#TApe{li%DaK!{Cb6j1iHk|xXIvuIlen)~A}%Ab zeqArFAh8&(6jzg9VEn}f66@LB;#v~du@8#t$UPW;aRZ6##;3)NB(A?UiJM7WM{N^);15l(>t+Vm59l4qwO9|N_a(7z=1U((V%?l0eJ+W0vqHLEm$7cz^%ef?`igaP zz4AAZST8q8x9cL-&27@RlUOh9x`*<1-NU;1jq<-Ev2I2=&yk-&V%_W^J%_})nJ;}D ziFI?1^tmL~%_Y*8kytP7aSea=xW;;Ek4xzGxWu|?k3+^od#soCxPxwwJFJ^gjvMq0 z66tp@Mq`cbNGKJ<*z57_dGklkZ~kT2r6kAkqzCb4ezm7XB6ZjO^afy5-4BYiH3b+bZxHHmfe66y6M*3Ijs zuOP8*-Y&g?#Jag&`UVo~<_FRnNvxY*8i@F!B-YKr(ub2+Hz!G-Ok&-fC4CNwb#sAq z``inxn=7TSCb4ebEqyJCb<;k-0`+a6j&*aB@;8%MH@8XOPGY^Z&!>R>H`K9idg&nJ zC9!VudFj;oyAfP36VeBhSU33`b>`dWQZ#z@dFs?BGQA1!!zzC|xzqFJN-rgwF+Zf& zkso_rz4Rqy3ywGGE6GnhuR;3VB-YJ!($|x_Ja41)O(fRMtHJ*-uA9};>qxAd%cNgVV$o@kem9AAbEEW4B-YJF=^v9=H~9ce z)*mIYZe~lj&t<^6c@F1M13tIn_}qoh0m+ z^}HKMtaHsI);IfoQ><&pcY%)e%zl3q>)4WP=zqlgCb4eW?{i|k+Cm-c)W;;&C;q+! z*QIV&`tS)*HV&h;=51#QKs)VqKX;Vm+BlVjWpRV*PlG z#JW-01Kj9&caT^oo*}V5G?Fjid#XLbO?Yk}`68Z=)(dEz2OPj1HX)*HleK7qvX zeGZA^`Z5y7^C}X@F@J}d$L}9s2Y{I8t4Pf6Tl#^R*GKgSzl2U=9%m)M zJ)U>we0LJyKp*%Z%od=5sVq^gpm;8_oCwv(0|x4QC$WmSt{$+6vMM&9A9i=wd6XC`TnWV9XpDTv%Hk7|mNWe|}j_ zS!u|scwrf8X|1um5`&5`Cl?jXUsPFARAgtZ9F;66uP6;%6<1zVR9#$CR@r`&*tyQ6 zq-xN!((Xz6*BE_<_xURVMAo3QLEyOss zJH{8xXMLE%wPj`Jam3rV1sJP}F6y$M+#k8h;-lDp)_8qaY)n!=Aic3q; z^|j74*_`$a!d;Fvs;Hvug0hODN*q(FELenUiYw1S3THueMR8qGX-!piQE_!OT3UVq z<{LBHI|PbL&s~J6mYh!2wWTsnM%ShZSEQoy%A$qkB{fyGWmx1;F0>xhR+XH`G3MGa z-??mKU1HNqsuopZ^;=L=R{Rr|l~osFMwFyR*P0x32F_ksT}E28eU9Acj2Co_YwNyQ z@PTt;RSnOGB@5uTZGUcsFXEY~U87*`{iF$x8m^_SMlLQc7NM+t7tek3+KF*rzikWz zCT3l64QnZ?F0VYNsJaS*qpT(+L-`5ABAiKau(8zG{G#^zVtzT6((;S35VFce)%y+t z*2t9Xg>5;ab0)6!`(^AOf*q^i zyo8IFnws)5T!U13nCLwG%PZ$sdGl+^Fx90XgGaQ@u;B#r*y_`!O)jcku&A!I>cYzQ zVl67EzyXLgy%^VJ?HVnrEXP$_9hQpP@;dCMboqYSMMaqUl~r~?TkYFuZStg6Rb7_q zb>BSnd4)4+!x2}4+S-bCTY!^wd)fA~tY&c$uMF+cSW_iGcHG*}ZX=BL-EbDRncIdJ zHpZ=~?Y1ab5;*w03f|Y;O}O9^&93?T8?{lf3lQfl^hNm0l``W0Z-#C7PM$~iciV>b zyzyE7Yd~-s-M2g1%xt4k zTx*kO;(cA%<35xZTpPNxcDs`xIC{Av*ahCMeJPIHHmR(tD;s&z>1P~bo8PW~&P1%5 z7gp7r#|qlDa}lJ}-I~1bAho8qGd}wUo#M5v%r<%(t0-1B+-as1Z%r?*t7^YVSTRb@ zX+N7Yh`obF>72R+?RE@Jf_P=fbzlM3Z(Pvf#t@hDrC8ca+IHY>7()$cO$u7P-_51H zkei1SXjx@RRVh!BIBT5a)#7TdvTnY2L2ae>+Bta@?Q4)+Nm`RrDrSR{ne*k`CZ^uK z1s8bx+;5cBm0wWi@kDiDF|Oh+tSPT6vj+Qg(fq2K61&O;ePz21^H!!<*Mlw&x+ypT zR^Vjc?x47_TUb?UPu1aqxb0ime#w&J%Bsq8EM-N!$KvA4Q!_8m-99f}?S6ax%Nen# zrULf>Me{DQOLJ&=*>CL`v@ykLYVQqd%NJHxDD32rwVAuW7u?8~*Op@{?i)vIGJ{I4 z-nb6nC~*wh?O#?L+>PU`Udrpi|4XToiZZ;T^Z&gZIy0E-`^L{s4yW(ma9Wh&=A$&F z<*DgyluUN5ov}PqR$&5{wBIFVm9>j%up04AsoLsdXPF$UHuCpfGWRzKpSsRjR9sVv zlUZ?D@jToDRFsxqfXUtN0O|gU=gO2$+b^e$#wRb#>^l({;dbjuP6T^Q;~hKPYU19Y zqGJ9}mvQ%h?OS0HuPeu4=-xE?=@9HSZgufR6;;Kht*Z_17;Rt|bNou|F4F9N=vvxl zmCw7dY+evn?Z^_3cZfI!z>5}IwsRii8NaH!_BzBme~gv+Rvrcy_C|f=XsbiI z(5yZRvUKFAykxS~ZPxh1nKcfwc;w+$jE7z2tsFHfnT$R9hh*0zlWi)rnyTQklk0tQq(+wI&Ch4C@m7w5L<94&*x=~4Z!OO+ zExyQ}N5?WXxPPY+RLC(_=G(%D@l<;8IM!Y7+Bqk@rT)Nu<~## z$67hYN<0VxfgX04D>vHelyEvKnT$PlLy(-8Ot!ks8b8|B0*R(tiAP{4mN7Ojkon2f z!)z*~n>Du7Xq!4}R5BTR3?)d;OD0==bnE(Ec_D9qO6;3(qZrC~E5})RxRqnA9Ajnv zC|B)aRuAN8yFY4FG821jHY7*CHQDOP(Z|X*YUHT4W686zSUC<7ons}Qs{+Sktjy0# z#$xruk~*Hk0xL=mMluX`{bukO*fJj4W#Dym;IH}$>~rJ)nlRnP z?ED>(;;$b5@Nup6mj*h2ui>-baC{q~tV6!roWF-)7mjZQ{0)Z@`QvXNh5hkIzuoxaWB8=MM^ok>|5xVvEbGb&=a0{@4*Sc7zXhm+@!@0m zq`zOK%)d(z7~`W2H|Ou#6n~40TjRqamh|^1Iv!OdkE12<$N!IVoAdV&?85OagTDnZ zVtn|xKI!j+Y^cpALl3iU4w>&<12-~ORT3rIDc2cE*zgX zul4xA$M;EpMS;I$e2t2aHr$-Q*(v^p!=D>pe0-nu_Zbd?aD2Pq4^2yM&fku}E?Mt4 zsuv&m+s)a%54&(X#)axlz>;?C&t@D1;d+07ziOnr&H38_yRg4W@aK--fiQOd9t->> z27oWcEK(jUjzKnj`1A?y7)E+ z{*v(}-#8zDRT=WlX`;~Nft8|X-z^Y?B_dpE#e0c;rGNYKUiXiEPz zDn8n9bN(Jm@%LRQKCb7^AODvv9N#YZl|Sn& zRPW)Tdaq2Wx4NBr`5Q%uFIn$m*^N)BcTq~c%R==Y5vunsoL9o_t#7B^zXW#4dY8#= zLQ1_a!!F$3)uDQi3e}s2^KH1^746jfUl@hkyIOX~q}2N@jKcM<4b@u^s+Yeh7p}LV zoqGA3%;9?1%I>(7dOu5P?}kvl$A{`o1n1x6`Eninxj90YZogMxm+a^Ds`rGHdb`0c z+}_QhdQS}1+lXt1aC@JIzsd4NxOzW;UD)4t_;c&kq>#Ud0)NT)GVniow4)6-=kE_G z{u)E^ogzDyI}azlaD3VD_aGfK`HH>1%J!ri%9xQX>X(IJwvw6j=vQct~U{?cZU42 z-dj*0+|Rq@PwtZSUKiLU+q*}0vr_6^3cGNmnL&I{H1K+1YL9R3pWMY#ELSIT-iN%fY>*4gp5 zM#J@1hw3epKaS6s9{aYp5dOmV^3LDEfnBn_OH}VUDfJG6UAW%*P`wL6_5KTv!~J|c z{ADvio2&OL?1cTTfImz@d;M}QNISOUuYtd0e7EC03#QYCoAbxt{0#eB8;Y+&b}V;$ z=DzXW4S$R2NSpJw8g^lS8{jVi8(v>kg0!PQ{>B=TlJWJ$4G+_4!_E1tN%6Nm6koOM zSdMQLu)ET^k8LpgO$>IebpH4ok>U7uh5D}smM*>>unWhxK=ILroAdX6ia)Qcb$zar z9pk$>m@mors^JfZLUMEdu1T3!^{V#*SvtF`Qsz~5sNM@<>)KJ7a-LoWe;il0Ie+J- zoL3X@$GACe7lF>-i7DslZxkPGxH*6P&A4zs4-dun3)#{Cu$1_IfWHQ$yUqCYdVfBen7aD0WK_%4$jb+Y2SZ^9SCEPFkEtFFEB3!*bjKclAEYvT{WJiB*;RVxVzid~0wBhFb zy^j5`zZIeQu9Y4A4Z|xOUnBgDV}ds4ZxHmbzXteQfHcng>p|MlA1+Jwi7y9llrWt( z+?+pF5%!lczjZzMmF!rKzi}9jFCl-(vYYeA_vT=i?3dxPTajY7Eamvf3DtWeY+XC% z2j|P=I+O>0!{v)`_09?GlJ(9~y*JC&+0BAoxV^(e^{$jZws%5Gy>sCYQ#`pjf1^|C zTU`soe%fn8%pX=mL?vm{t8rUVzx;zKa%~t1pauwa+~wV-(C*;n+1QvVZ`}&JLvq43H&AF`$qB6hMV&@D#c%Y zD84&o$M~vHX}Dj0fWMCDQ@1&P=fN%<-wODvhY{mz09}0ity&}{NoE*dPWy4<`9cgp^hQcl!UjqKzdEsu@y7>6ph4hEp8oMolzqaOI zhrlk`jumPLeQ|U3rlr(7E>!P*vST|=Pq{APZ`TZFAljV2Q(zZvMRX zfq}ndd`}M!`k6M|oWCI{{?>;2`2pE6zVqRq;b7X>Z4>7wVUXVeHyb8u&}bw^H%ZhMV&@H^pBDJ|w}^u>G=Lc8srYw|(Qg9sYVC z-EGca4(!75<-i}yv!5RWU3~vdIiIgne6-=_{P8y~!~PPX_;?-T{GF82e;eq}9V{V# z$EUP65B?S-pYc5z@|Q^Izm3C!@udwn7hm5Le``bWJuN%7e<&Ie9^cLI$9{I3^EVK7 z;r4C__1~Xi?An_a_)CuOcEv{d;%{RpzKybDe6Ix8oyqyvD1XSZoAdW<%Ju0k z**%|P_f*RD>DExaFTmEd;|WZnaKG$nr(gaQ*d^P`gM)Fum{RWpunYHJW2oMjLiLWr z`|II)GvrV1lKnR_uuImPExXMr^&SMfaJ_p%^}Z6S_r#Qb&Vj##t5kMWk4x!4ue|j* z`itx`zyngoW1Qln4L3J#eNy~oz@IzL|0+BBdkh7_{Zb%*^u^8jdoZv|_RA#M{Vgy{ z+O36MxLZ5^Ovfc{S%j%6cmuuHc0bJg3DQtuMj zh1=T@s`ryny*J?Vj&Qx-wA0?J0=s0rKge!ZO1+oEE?n=rP`#gp>gDH#;d-M72J=Pk zlH)cbrQVLR`+G{gQ&Z~Q7^?U4P`xu!u3vhw#N60lzPXh-mg;Xy)>oX#!$Wg4Aom4ypNt-*9zoM?vnjHGq6jxcarSB zNvU@l>^iu@;GR&u|ANlrG6S!jDaTP^JN0f)IgVz@?pyfa=8p4iDaVm_ZtHpLJK3?` zNXmJ2F8s|!y4#$;@6d?wy0KC9{zrz+?i<+QFS%uh>isWLU3-`H+IK#0hQIa6QmyS+ z0=uxk1pF~>UU&X4bczh$BLOvqo?l=(6d{$|Nn*k7lV zd9WJ(>S4h6_+Fli?~9b{wc8H~;-d{W7vE9$q-EMco-xBQ; z&fh}Vh5K(f{JHaGhmgOc1Aoc>8$L3Kk2Ya{N2K^G2*sBb^0y9!!tv$7Uq#?*AAk1- zcFB5gSG}E5>isS3!tE#w)!R8#@AZMd)_#G%w&wk^6n}H!4^6Y<#?Ob`xGf0$CF7fQ zXwWb2GbGo~r78XvgyQQK^7lc?x;q#C+%*$iB*$%g%6hsu6km^!zb6BK$@uX9y|x{+ z3Hy62#b13WzFr}Jy@Gj~?7sr~ldrJ9ZYlG0MaW-H$lo_9@l6^P#7CR3zdb4OHH7@d zL;l{xAhD>M_l58`CvdfozrVpQJYUwqpPTo54xJm{`vZT;{^M^lBFR3Rln&ka-kaiY zb11%kA%D5Sc`F&;dik@#h5U65?2`39ExQC87qaUFyKp=s`o4e%A&4cHo;$8 z?}rrzcFB5ojSkv7D5c)XunX6_D^xH2vR~Lwzs36uENbxLwg>*0=Qg+BGalF>+iu@r zhu73@qYu7X(o+15Y5Q~HCfJ4J`wsCfKzXja!|`(Q9fvf=>EataHt>%myRlAgH7LOS zupO5C&d)L+Z-lU_0dJltr;j-Fg(e4PRfX=RG*VcVzZ-ZSv2SA(a@~*Jkr@i71AOEl=dCqwJM6;#hChqvL}HTB-%%ldr(nLgxkoSKPV~J-Hz#EW zS00}+R9;dxvSeh{p$Tkx6xxFQK#tANx2a>t9+o%G?#<1-?1afD`aYa#<2&K48rt@~ z%}C3)815Aych9MZe3rfSw4IG5Yg)X5hNkqnYd*!NfGr)p8k&CGyBD`|h0W;tQ&`?BY-q;R*}Vh% zSx844i_J6dqXish=o&)&K`vgf*IGFXRS*wFM* z*KI9By(!JT;PY+x&-SvLaT$!2@{Hy)5F6_+K-y%aF}7%SL$jA?Xm&B~*t<7Qn{eH< zKOSXWTM7_+8shGUv<@KpE;9q1uXfDIUb6F}#I}}bUPH4V+i2V5%Ca9`+Pn9ZOs}Ci z9d++O-!acu43F*IyF0ah*Y>0jwDW1$MXMW{c6yJu)FZwztQ&1F@VYi1hkZXMdne+| z^fNX#GoGE^5?c@3nufSsdw+*mW})x9B9@HmTot;kI-jB z(KgKI%x&1m6?XHLD8sh26@O|Q*~d#^&o+99C93|o0&$=nJKsfrvhUcZY)^WgXOjJa z^z+dUJRQ)EZGHB}W-ohbO9}j)hw_mQ+08h_?RfWqZ}x!)KdukvVa(q_oC(ALKbdUH zkEpXF{AOuPBavVn%h@lAk$xf}KPTuNb8Z3HVA2awsBvt^*xejmza8Q(jlK^U=6@nG=1c6Z82WK z&OzvpgYofIM&1oOk76JCH-GBwxw3Hu%C5$%;U`|aUs(GS`9D?m|4ZIF)RBeQa0=U< z31aQuoeg4M?mm_=gX6&p|Hc+?V?%TOs2kD8E3l98z>EEqv32=QZ`m`uVC&T{@$0J# zg1+$QHZ*m^7;@axF$P>4xt6(pM<1TjjJd;k+6Tu$A&#r*SO?Rwn0emoe7ofS@H)qN zHVn3z7{@uV_2IjIz{-}%K90k=D_VMbj2CfXz9sV3w3xgb8prNEw8_ms){8Z-8S7vZ zW3H}$W*5hi+q(Px`aQ=6>$pLj%SNqeVf?}Tn%0aV&rJ8GHFd+IGB^0ET6&{jA_Ws0 zBlQhUD-u}uQ8(5`+rCI5m_KaSGJk0c*4E67?5i7bj5cjJc4^DgQIIOk2uy_zRS)>q-PW?Z%JS-CQujWXKNieX0Z0NO<3D^?z#LK z{=2NbE~^K*t$WbeF^QDaH=+)XLvwxht%!LF+ZB%>ZZ{@42JM={zFC2D7~7D6w8^<1 z$Fb?5yoZ|}PP~ERX{Yf- zT()F-iIpwuF_*3!bw%U)!Z({9oBL*yUzoNtZSK|Bf1%0udfC|WvN7)v=hwC_Z#Vnn zcKL}R_7&Pch%p}QHDk`~##2jqu4qC`nd=9jeBR2I2a9iPxnjVTsOycU$MW6?>dLzk z`_H4U?#*Ap7QSsiu#PXdE~##;HJN^1L({|6k2F1;_hysvW?J9Tyc=7#o&P4*jNUfB z^`maadbAR4TH3fC?Rl&kZJL|DGrf8#_SvT1&7TGJH1E;zvhIc@^?QDH$Y&j~c0@2X zcFrYkveyx;-;PT)#tboe-c@#PbG`Qy?l_vsYXii7A+IIk8@dJaW5d8Tv~5n#lj=s; zH8geP9JzsGG_(0G9Diw@mhAMZuWHG_aWnOXB|CY%MH^7pI+QiR8t$9yX1}_j8RyB& zT{s4@mSUdXf~&D9-Nz#>3LW<;*G98%*y;HC)4mbC18 zXcN{FZ?~J<&)|Hp1?x+-_m5BfNPW{5TsyH|yj!-@^RCAJE!Z!>{#7kJzeRC=dmg^n zb{r?WZ7kSlJUqXn4_dY+He+0;Ha^$oO&qs8&oqoOiJOqtfJ13!Gmj^n-;|)|>!viuM*laU+%VML!8^9mwYP)EV=`!O2d@D8SG73bpTj=Gv**?3t=>koV?|Rn z+Pc--+=Oel##j13*SH7!Og|U4j2&yFjh*oxigwuZLp9c6yj?DxPZ4{3oVMe%ojnrE?Qzi~YfVdb{SvO1=u2K}uV~5h zm!l2A^(*>3S=VrH`OcieAdanbH#bck7-=4k_DvjiLh}e*FGTWYG_m0^)JYXAh>CC5?Siei_bX7~AA^6aAyD@C_SWmv?Bu zI?=$d;m&HpK29Sununr};njDvq!-{C9sTUiyP248vAl++#l^R_th*dz1wU>KcH?+( z=ig5;9`5`b)A@Jj-o0&}f45^S_dEYq?|c5eWPEV`JsjuXEg09nhW8EvDUEpBNj-z6|fLJ9d?wOF`q?iwVts3TzRT;4=#wWWXL-$D;gUwLp7&r4O&u`D{Sgh#dG&v_@$B*5 zYU+Ug{b%-DO@#-qY>DBVjs99Bc%Hr{sIF5K&6G6uIUaIN|gHn{e^HXK_N@z4kE`FOs0lJW3-$ZKiFdgzoO zc8u@t!E^6u`O-%ly{jA7d0TCr$D=PZ5?Al!al&I{Yr*qPnRzR4p15nL$(!C7%X_O4 z?;qU%&5B!b3_OoAXEx(4p3E;V_w03J{*Avzyk|C#LR$R*?61Rdgg(c$<^4D(?`E36 z?m8TEvzss`_s<#i>z1rzaczuoG&pu?Q+I4It{k%+1GcrKp*+Slz76{YUbp6*iIr)7 zMmNK2kZ55;)404xvEJO$5}SK-(?8f}c^J#QcN(#t-S1~y(aig~!Dvr5=2iH<&Gk3$ z>Dbl{i4{$3cO%v_-_at6ydLQxRV2*H{c>LXhcH!G#%{L>~!6?J?#vWcPoR4!K z=G=1RKZbdcgYyUOIWpH{ZeUHq`5~MCI)HVY_g%bqUyAwCI@f*pzZCOehyM=VJ1FFw zh%-N!KZVT={wl2dh276a`bV%C0GnT=oOhRD&E)Iuy?gh547wN7K1L9!Nw%fja4&=$P)wtHgF;CiKC$iCONw2f#j zVE<#D?PlNd+>G}@GFeX-)PZY&Yk5DAIJhJ3UAy62<=JB;4RyNy!~C=Md=DbaYcMMFGSnCJHRnIqJY1*YzG6o6;i`-AzKMMvPou$y;m7qi?Rov<>f&`V z`;+nh9(L^Gdr@Xt*Wlg**O8e|55Tz8H#GC!E0TSAV_x?1mI$tc@^NlL{yx5!Yt7~P zC<@;=C)hT)^AqZ7!Zp@z9^=U;es%=Md)MY8(GN?J?~YfFJ&*rLMt1Xgh=u1r zmczP-SZ6fn7c6hd!wV;M+omkk+aZB9A}?qY+xyjzdr!$vVBJ9m1t$Y;sH%ur_7a?+nULX}2m1+pe}Q$OjJuy>yvy)j0{#Bu$Kd?*1(<;o&bYMTwHO^U9j{9=f_pK3 z?#As;$8@aMF^4&aYwUIF>fxu&eLT`XQBzi3RZ~}+n2+brRV3__$uqq(D)}78L|s*) zwz|9m$uJyJnz*1AGSi!mCvlf1@S75e3ybmC=gM;ucu=P|r1ppe9@sv=q8tzJL|X8Z z8VNjzZ$zSGQ4N1|Au*&nfoCtm$%sT{*@dlYX7G$X`y(89q$D0P=Cu~Lo>4=hq`2CK zr6BqAy9IT1)p*EfIh^xZ)uqQB+kTB0d1K4)N9&UsRhoWK^a#2_8S0C@rh5 zDJ#JPLrWPtpE?&rq7NDHjQOHEJl(c<0eYYW&)CO9NfQgIDoT$?;Gwq&KQocwV>T0d z1pg6+SCJ z4FDhZg98wIb_*AngcRSKLhxhisQ0x$Wz7QY)#HT>7JoX}CGN&?;(KQhYw-%qxmSwC z3mL=;yn+nw1$Cc+vUYQI^Sw1zXuPiJ$@;9q8rPzrRk*|3J>Q$QRnBa>^#$SF@h93A z;Dxs1Z87@`YS?wrATT=NGntUO61{P^?U6#_X}de^1AspyhMH2H^M4`v+h-^{85Yy6 z)y!(3-tHC>{Lwq#n@Ma9Qt2^hJr>PibK#(E}834a>8jRrV`}1l|B6 z5MqSgox*YXA=rhqo2!ReoA83StTo)(5-6E#wqj>npk%M%&Ifo!y{^xBYq-~l7YdDE z!=1qSRP5Q!Ij7PWFGNE;Xm{J3WDFK_iCAoRaRn4?&X;r0ZnJZ2IX<<(+iZ9D?^7iA zuvz>cQd#X+5puk7)@mwIXLn~2mjtQA3cNUjr>@z6y{B!)EJ(Y#kf{U>n?~g0g=37K zSg4)DZLrNMBu3!HN($GoXhl-Pj@|aJ$95nMF`s3WJOHQ%&ZmZ*Pu<7))HSKa*awAp zVGQR0Jn*p#X}A4Du=6f~BP@u#EyEs2#9$N7aLRu5GIwHN$fYN!cgkYy*4xw>M9_~@ zuxB?HO$M}Cc-gtaoppF2YGNZ^NcY!pht;>yn(SoObnMy9xn>*;0`YGG0tfpAK#L{T zYQ_p+W3UTpH|L8=4qk|W*k*U9?*jOJyLRSBP+&@Hff=m@+MLVmNL&jLEELSz*5YTh z7T<5m42C^>0IOCV&=BlG+RZhi6rG6wf$%!xZQ5?xu_1Yhe%Tp=2drV*;-G`K10M&w z1Q%f6JCoo?@*DvmSbWcv_kHFq2Lx8c^>%kUu^O+4_shZLcR}*UxOnM^tGNI7&g*Ln z?AK(Z>X@C{5xXPc4^{Nw4BOcWH6PcV1$c30Xbbl+2iyAOP9m601;D0Y zcMC8Fee8Q@EdYZ4J&XMt^yFFl^<>Z`XStC@!M3Umex);SjT^Lxm$!yq*|*$h@mXj9 z_er)k;*DBEvSCaoIeCKrxw5r{TlRmc!ns<24&p^RI*Gt_Gj^wM13tF9ZFXHFs$?AG z$9QpG0qic!=Y;DSnjqP3F1`uSxEjE2ILXri-t@RR%AE$h@NUh`(J41axqmlaX`WR% zNEsLss%P9B9f93Kyzn{L%~9^G#Vef(GP%!DlPUi%)yyF+#B)2;Oqjv33k5&7y?rHjjv#m&TO5eGkJsu^KxeEyxi}a zrZv1-lan#c3R=^;EVWwAn3S~I?`%P<3}o9wi^IgGStZpUGdWafXlm9LB(opTt_1qv zW7{2^E_QPr%uDrMcvxvxodtW;Q`yC&*Cx>LelMrKK6m9lK0x{*;LoV4Hepi1;=k95yb9V3C&RzX8 zdgHK(`X_fcowKrz$T|{>h8gae&VBKwV018cj?T)$qL4-tYXBuZWDhl#%tK*(rxJy6 z$KL@Cyv#1%$@n-Ys~2E8!#&J94z+2WMk11K=><8fj_VU-4eN7q_haz+Y3DRA(mP0E z;V$`JB&Su)h8oK4nu+=tcUO#Tw=CP9?)ge%@gCP);rpYyGrQ-tSNQOC<8e8j*9*yB zklcHuAGlxu6Z$ZOoHQF_pYF)XN(;Ir-U(h$?oMSKnvok)(QY)^-Y)u+~f$aCJtfP@W$Qq!);GQTj451C#uOgTYO%{hT zENPL&K!^AAS?<7IL8l<)prII=gS$hYfQ%765d$p_8DkqgvbXPM!l7-B5vG(nIE!r< z)!KbQ=Z#iE*04T7!eQudFF)jK6pD@ED02soL=SfG0Cno)IAAv)m%|YoA1c&3MjW9d zl9MEjK^&Q!6;_?l8WZPK0*yW@Eoi^ZKRTSx++&iH%;pyyfGKlE?^#)Arp-j|u~~Mm z;v2e5=d^V>$0Lj!Mm=$)U)edBrLEKGgpum=)}#|#JI777ljtL89h)*Kn6S4T*M~je zeLjv?#@wP*aS7S?r;&(FF&x)9Z*zwGzkiOw}Y9oPro=T#A*NAz*=0C^$Am>OdYEeHe&3t8Z zeqfI2gv5v$2x$VV%dAz$G;=C;JTn8*H|3D>e;Rr^8d+(~uWbH(Hh&BA&A%Xx>4{Y^ zY7T@}$#)4=|TQ z_A|FZ_BZ_AaKgL>Ilz1hInZR_`fHHs4>{P3gB)Vcg&b;bfE;EXgdA@8ZP^3OyO0N& ze?cB>dSPiFVUC16#LR{qX)b|0)U1KbGcQ7pGWdYU8*S2X0yxa@c?0=|SEpmlnUG^m zE#%?m8pv^G4di(9Jme9E--tWXbi|oqf*AyPlsOvmXmbYSG3I>80&^|ovF3ir)eEfDt^D1N~ z^Dbm(^Eo8`*&Jt~Y||C8s~HN}&5VcaZcc;jVdg>hG*>|OGOHkan|mR1%oC7(%ofPF zX@tx*|A6dk_)qBv7(SA;pE($^znK7;Fh7GFU=~0QG?zjSGW?11!NHVYkB>W|knsAlH9g?h{};v?iJtiq(l=>X>>{Q&q%lJwqvmkPG{c`#Pd8YVv*FtaT}(M-c2MVWxUz}*`4O`WX`cBFq;DRFjF>ke zjrkZdYQBL?GZ{TuXFtf8IRrApoCMjyoCTR__yFQ8b1`H`vjnn};Rn_U^LxkvW)tK< zvjcLF`4Muk>C=mc_!!8crVw(NIR|pMSqgcec@Xj-^Eb$Y&9{&vOh1HrNDy@oqvU>oIjDhTKa_|vl4|4)!Pg4ci%iILn+dKl9V_t*o zV?Kk#VV};!{ze<{7bXt+W*}t59LzK`7Ba&e1DS13hD@00kOig)vfel65D`;DM9rl{ zhT+f1XL&KZo;Wg4J+hCe3nn=OzL(+FwI_mELsXtEcEL#CUFkXR!iGt4EB9n77O zndW)OEb|#;N0WyC$m?YKKz25xA-kC4AhXRh$gbuB$ZqB?$nNH8$R6fH$e!lkkiAT= ze(Z(AA#;L}8j#>fMT|KCX`U&9+!Zqy0-wdqO~CG$SqJ<*X5IomkC}e}U&Ksif6x0e zW)1@W5i_R(dtzoG@KwyL0R9;>>w&Lh<~`usnE4jC;dC!D7;AkwYxO_N$QX;A%Q7ZI zUg||h18Kooe1kPeixG_N4dGw(zC=1WK{ z#RF*D9TH11WSThwGTodC88fpXGfWj^2eSk+)7%W1Wqu3U(L4&-$-D&F*}M(e#k4?X zn;#*&njQn$&0`_Eo0*V3OdVuTb2DTw^Dty@vl%kSv_SSTkwILFb0BlgSjfI+D&zrX zK4d@h3&{TFCdhKgdAi(h8%48=JF7Oe;>f%I2Ll4;rq!OmrB}xcs-q<4iu}@#bvE ziRMzs6U=JJ6U~E=Cz)p`kh!IYS3hCh%gp%QBy@37rLC{Z+b_CKgGXI8@j=W8d4nRVNpUHik zT=6N5!OS~*)kK(`#97X>rFT4x(oXu2XY^4}eTcM^N^uNziQE`1IRV-!&yB;p`U5hr zrg}1qX8!O-$x9XWb{*8&bfy!&wRY|q$Z@4=!G6!Y4{*L>@BlX;Wko%|lo3YO` zme>78Cd}~Z((CaYVw#Sfo_=AZ4tn9i!J9HpuYjIFMNVH2ouBdrdQX3fsrvxM-a_&v z$z-nwi#3FF7ULThZ4`?}TyjusZb)Y|*N1ev;YWxmZoWV=KOGDQnU8UBI`gZoJ~gs9 znaZZG3|Vy^5xkSEQoRz;`8^W5!_OqW-a|2t{_qTTT@FVx=Rpj6&d-tMW#YRvUZ1>U zu>|`5fLJ^qrg!n8E)zYwV&JND0w+4 zR_EttV7ghKlVXeg+#$%bmM6z9@pEgA@Vo~Y+3B%*KlgCtS?y=BC4TNH(AYqKN^F^* zJIiU)V%Ph*rO;xCz@Hsk;pbie?az#5PHeTGdnL5vhCnNdHTbzpp>?O_+}PcI?yb;l zEXA?4e(oPywFmv&P0;$&vNE>L&;0@#JKC>}t@m@y(da>3FZp$`4SsHCr!9&-?dSG^ z#xd|Oh;8(94|Ljvu}yyNSf?$HZT52upjn?6$F}&ng)Z-s*jB&qY^Pm{cY*qE^ZTCf z5-vkRKO|i466%p~01|F?36~?GFA~h*vEeEZl`UIwfMO{ zRv~NoO6(IqHw&7L<<;1yI9OcX*4QpTcc|0ejD6;N2XN6U^!=f+_*m@m&dDDZ^Ws|% z@x1$RvF;xX<;amZCF4rm9}&ZX_XM&~;>@)8ktp#T&M^M$G%r2_J!cQ|Icd>&2^71I zoSl{tuY$6GJyVp{G5#2opL)3W0)xia(8dc@y^vX^EhX}F9>k6EQOEfLRv(hc_} zep%Y^_%l$R$Bl=-AT2L`1Y-FO!z@qRl{*DW8C_ST4fk`4p-=~=m5q1hEL)6B}sqi&GNb(yaSsbES*pFV)|8Gc690V7$y#Ws* zDZ_7$#1~=5HV_{~#QDe{KJLbEK|ds&eiBKK--{eu!>5s$m&HTp2BbtUjMf9ONEQ#D zJDE~5@JS#e)}Pj@&F&9k&G_6ii_bCpil#r0{vAk*^yhrHrv1Fkg~;u5H(HnI;V07K zi?H`DlKcT_UhXfUd_rYln&;A16dNq(nAGGJg%X9q(k-7b7JvGNxyI7XS%jB@JvT zYrv;m@N| zgMV^b`~}!>JpEI!+P%`MWW@j4s$|EvwJJIB?X5~8z5~h)T&zyTGR9G~N9p9WwQ-&w za1-VEr=>j@{|t&<%1=*Q7ynnQ@=$zltMYK%ATF6b63=c`*2i;Nl}F?KTb0MW{=A8? zjjs>Q(*ke6Fs$&y{eweG`XS*ZePnn^KQz3gj|wm8hha(IhWgg9Dfw8^w?lc6$`~x^ zA3(7WBOII7H~twEdm1<#>-+zp*rtq68yt@z6ssJOHY6U0Vo$M0;-+-K0$fG!^8b+D zdUpC#I=-j?8@uqXOCKIT5sLNuQ2L1YbSQRxemFfZUhb4f((~h&Lb0px`t)(}o1s+l z;{4I{g7^batb@nWC&o8GxrjNBr%#GM1LZ0zPoz(dzXrty_Eh@2@f}WiI{m%)E~h+` z{(k%)PWf~C2l20+@@)EtasN;`crN{;c-$$^r|*dOcghRtjq%Y=*_7TiG20hj|zo z|IhS|?{rEeIywG#DCZx5oM`lt_-D8Wd$b>vwCKk8NuzZO)+4$nJ{5|+|LYz7CjJzz zORbU<{Vx63Hds{+X0^%#Vy@| z$g|qCC~oPFa@zFhM%;)x?TqLqKX8qlP+N%5_n7Zic2U#0&nR)a0#VIz%5S`N5_nw@a%T0hV1_EkOAgBldQBWKRNq|5|LJ|g* z_7ai+k%Yty435k=ixulod_}9R9aNm!idwZ=YpZXot*zR@f*7mTszqyUUt7NC+50*7 zo_iDQ_x;}g|NfHuoVACw*Is+=wTE-=KA{oEf-+98HRCNTwtcEC1GDr}pSmF99n{gM z+B4omi~3YY#`~cWTS1w1M`y+dp%J(GR9D7Fp%G7m;%F6GmvIPFkxO8H#_mJTs9(YY zXM~2kc^|+ox%U)03Ra%*ilf|&q*ugkzP!Y)!EtVO-VkIq8v`f6{>OqaGyN0Y!O5Ba zcytE5S=v_jBy@(EAdJJE=;r6ug7_*6EpactuKM-nY4PLL;66Wp<=) zcgsT~PM(74;c?)($E|{SgEEfi4!1TmqRgl6beDuiEC6M8q`vMh4UJd{Y7O(aenIG#t`i$VD*zvpfYjrh4wec#<08u1&S`hk0SXvBV>deprdyKz3X&)pds z@o%4c%-t0l!7~?3>5scN!&&>(kKEm%5fgpt8Fx=;WEm(U*|RQO)Lo&GaX;WE2sj!6 z37_>m0*<;1O@|c5_<0^9K6F4YARA`5;)~@Qtx?V@~jin`5Z`_%WyX^ev!|9zVw4#|qyH z`l#`Fam2Ig;oY&5@>+f3w%CNcOFN9>*a=G(ru&wTD+g4KEDmp@pUR}Gg>_MM8LG@Z3V4h zP2-H-?i8%^ukXkxpdRR}qF;{|aJ4%T_l}}>XBXUoG-spJMZcL-u>KU=0i)jYMfz{kk&$oPU0 z>N?Ty7Z%)ryuV_p1RV-WO-Q}7wWFxQIj~ zG&-*w#7+{?(73#%AnqU$3ysff2k`)j>`yBd%kZ7=wSU&&6V zU@xvYLPXbQ6bwN8Lfle}u7@dXV&<#ymCelMV>1ZR^9vq922({8ghw`4lg+tzWvMuj95JN}|3T5QI1Y#74A)#pAZ$Xrj$PH!V z7udM6tw|Aw@ym(vCh0g`k4;T59po^o(TUB#Wj0-3Y;H;#Cw4CAtVVn-XN{`IE;1FX zFBl3m6>GE=+m0mBm8jTNxX9kgTwlZ2Tqa*KYC0f0nitAD8W%4z=}1(p0K@?jN26ks zK>US7ehB(}8CSM0RPiu=IkC6#Jx(Pak_bA-bjD8lbV4ZBEiR z?8tDk&O+Mvndr>1e=un;F5v!1oc3|4Q}9ba-$tapD~zpG1i15Kt%%RM5ML+2fTAggj2{#?+)v>>Er){TQinLhh&;G-AeYbAoiS43=~yq`KOhERK7 z_6M%Y3yz9BJpRPDF<**Zi>pyXPDh&1&s{ScFiUIvh#)Tmp=J-@Wvqevf?yvC{Swct z#hyj3?4L4g9m2mCUfwrvAujeKBwXJY3oow9%nac?=jhK6`XFM%*Yt_~3)kbRo0Ir; z48`;(62mai9{&~G>Wq#(`b1p6ip%g<2298ZUpFA{ry#g23GW<$n=l~EhVb(<_8R11ahO?P)m_{}2xhew*CRH)P-TkfJ-}9hTBS7vlgokR=g`+l= zpq&{{AC%ziOy0qee_69-gP-i=?j)BBEEn!E+hV#=ux(kxkJ31?dPG}e=xt(T(!d*I zza9UfFTDf}ozjL{|A7}@#RWI0PUY|8{)UUG7=4|=d~g602Rt%R6JE;)2VDG6)R`7C zKREQCF8CA5-E9(?M<|?0-=)mmnO4+YnTUeTVILF!p)b9_)>va6fI9tk6lR)ZO_(B| zei$_Og%M9JpFRdwY#K%BTS0R_TKNZ`kFC-waK&R7e0ak=sPHh0%6*a|{IrkJPC`Xy zqut8VY-IU8Wx31BvIo4mL{mn(|D#&$-o!o`evB> z0z(f$uF*!07bwSwKBkRL7d5tF)R7;eI{r=(Ua}&b3pPfCm#hd|K)=l*ZTxipgvY4s zRim!yIK|0%mLk4p@=qTJ<1=FY(u!3K+KBZlBi8gL&@V9kuTB1;w_tPd2NZMCUn%B* zKBmR2g7^!T(3f(UI^U(xr(cKMru2N*G}cp~O=IP|-S9-G{}r@poP75^(9`)~^()MO ztjRxp5optxmLBjr!P=3)yB#c52f$x#JlZ&ip>|4CB_jlQ9h;kx*_4 zBX%S+IcJ=Y5Uo_rPPMvinQ$B1oBo+@F z_1ab_&tfZ#p?03Mt-uG;jg36%8Z-SDX!AJLlP>qPPCpLa&De}he|Gr#Li2ppvo0U7 zn!X&-MxdYBMtK%3`ytssZ|UiM9OoaTf8w(4)Bg)}<}A=Zc3GL}he7uz{Ueu-*;eRj z*Ytw3kYOm}e(G`nnSMNkH%fWV)M)yzK<6d%PX7n!QKS{mhr*4yKI5_%O}`SfdE85~ zo{k~rM5cei$U2~q*I$Y7*Ng*Z@_KiKzdW5m&o&IgdKnqfQ_8@^IJRSOk#KCzKq$kZ za*PEJ&ES2`>2Dy(STf4Z;GjJ{0|gq39+F{9qv&RIiub98V-PcrDKE(2CXzE?E{Ovk z)j5Fo1-;!Ke@ix#oBI6SWDeyyJrXSrEzU=fGlLOT41C&)ow6A0Oz_}2n7##Ueek)U z=O7tv|N3#x;7-tYiH64;%(cr80yKRwM?K#+(}C9-x+c8N51kfT{8S*#E#UEy=yl-v zP0;+^2YHYt&+KrL{vqOb8+t)_Ln0NQ7JJr&R-2M)5a$g2EznGrS}{ z2lOk3t`2vZa#3+JoP3VZp$&+3U|K_4aS_GE;QcW05?oM3X0V##>h59_YUrW6L1Q-O z41Ew6-{r-xaPcfI41;m#jHwK`44+{_19BL5cDd5BK_XMZ#L%`_K5Y0(faX(!c&6JI zYv@r(KN6NXlo8W-F%cnH6gq>sDBq0>zXr4y{w9*@O{#tgQt{W)ekxi_ZGfi5EDO+` zNY5V*`|0V@+n_OWWwTnbDa}15)YA0g&l`FH?QSSX_rY2C-wt;CWtTEKxwp-P(|aO0 zsyZe2BZTXjKHGU4d{`?4a$>xk^aG}StIsfcODFf2q%Jbu*@W1s*rfLuyf13UzuY0k zpdL({xjDHfAvip6ASY&aYQy`in#&b2uDP$7>o0~ro!o^CS=X12!=|>u=QH?*KyZS| zFq>c<6I_~{Z(<6_kc$HI#N4kTBy?A@{7OwtTPcD&QEH{F1&bq!pWV- zEM8#L&OMJIw*^AXbc{*}eQ8=LT=Ja}R$_Lj$_%u3Mrb;-Lkr9>duN1do^ul1H*>%w zIVDCf1}xA-H^Z=+O;-1$u)4=*WhRz3Zq5V@Ma+@TDz}Ytej3oBQLPcymQceI?n^1* zzLXODxazlOBvQ_~yVvs2HBp0VC~Omp{Vc6m+wP+-LW$Av+u3=maY4%s|0&zay8r}b z3%`?%?G*;cjHtgytwv)Y;jh)F;NSmzhKne|3-MoqfBruIS^WDSJ}8}!^yBcq)b&GQ z3*bB$|M~bIhyUP*kDc?w!H=K47R;i9m(8N{70n zKEJ-X4kv=GZEWx0nOu`5Pbi!)DSupZ^V*h^+S*&sZ>;akpE70Agx=e3qv2SsLK8)aSEw zc~?`jVV>j`NAZny%bQMGJGIW~TGP?Aa!q4He$$#xr+jfubxpjYGG0_%Tehe)UR_iH zleVEVh~iI*-AIjgL?rdHQAwMEsnWfikUmR6J`iQ>xnRpq6%r6qpab1G_!mN@ND zYh%2l6DOE;ICE-itKy4Ft82&lh3Ns4QUfMC=I}H%ij6C-tf(l3&|pwpUWr~} zcm_h}m6le;i^@?en;WO5twHOdRpXr-+8UjO)n!#R@v@TgQeD=RmR7`T%8P2|^azNT zRMz$yXd=4Wo8oPCovZxXfio26bH=6NTvb|KTv}n+qy@$CA~5o3?5OuypatT^Mdjr) zi;CyPOQG(WRLVtIKLjp{TS%Yf7tOY4Ib( z_LSV%(ag${b5dnb1Vi1%z+rj4q=1@Bzc|Ga1X24`l-4e;tezKW)6_zg%t(`L_tZ41 zaYgB3bPc1|vI>|`MQvG;x@A)F3A3oItt_rAKVrF+Riza;*f3sRSyU1)T~b?Jl@%AU)2EiCY8F*NN?2o2MM=$^ zqIsq9Ii*D98DpRGI zjW%Ay@iC?4jf_?E)6xcXcO<{=TcYnrFi4550YtU;FKnjifTy-m<6_Gl2lucIah6bW+{e{Qb$zfJf}pL#nrIR z^72YMqMT#g6gsz`645o)iG7YRih}m8KMA+;kv!dPR$Ap_mAoN+r@EFevb1I^R^$Y>N1z>RIOmbEOuyI9@^L zYkWu`Rk{o{i>1>*MQf^qa{1a%q|_{cgG504i0-L<1O_VuGQBcN!M60J^f?9fOpyXw z0oj9*O_8D%B@ zI)k;hQ#RvrRL|fvDK#iwRB=w+%&-EEOiBExz?dFnT7`8NW?FE`STMmuVtpBqO|i8m zwgywq-XlvY(NL+8Xk1NA!4}o7wS$d>npM8AW)9{M{{ zfN~WId*$3a7*kO+AN3F9;<4&D2)z+I8d%l$7;wncR14F=CAJJp&cxKP+D=4m06S7y z#lqyu!UiWMXO^t;2SbtmDmIyzowdl$g#v-WnNZJQF1dOu9Gf!WX6mm@lQG($yI|=e zqq5;@@Uqzz813RqDy!r3i)!YXF?d~jQ)gow`&ON;^{vh1Rg+k&+pBn4P0d2o3uW0k ziGl+%E5u(C*Ptn}`l!Luz&0GbQtAc;HXp1Fn%UctA{SPm;@rZqdkSc(A~T-TDX`mE zmw>&g+LT2frlO^_3#%(&33lF7RL+@!Y0a8=klpE>9Sf zY)rXQqO7|#emEG-4uPEm-%)=-)Z|{`xUuQ?6r=orEYMdlhi|GHgnJ0$#~aUYR!zNB z#vd%;|4YiSrp4wH=l8vqgC1KGpIu#AO8Z1N!T@ySbSmpVB`aE3J4a~(w%pR%(CEN{ z`O?*v%`dH7SnH(G$?od6MGdwFG1eY2T~eweq)hb2_~J51W_5dHehJ+lfnCC%7~h{R zR?^9&$0YLgXgnzE2xY-1VR9$WnJ~X}&bHGPmtu999%bAuG=vV;GcqBOUjp3)#u1;1 zoqHV7J^IPil5yWtVnv5JOM;6Z&3>Jp#fZmUd9x{R_s7%Iz*%u~7)H#!2jiuC)qH9? zZi<;b<#cwctL@U7p7f9_p&1ToJvvA_%e2%6)EM zgD~n#jMXM2z}uRz3xrhSE&)7DQi77|qFE_?=3uj@l#duB()_oXswo-&R; zmRnIRwupQ1rzeMZMc?JRulMM3+_PJVzLFkYRb4cDeo=a8F*fLVLmD2tvOGPK^AWV! zxwccL6<1tYIj^ioDW+Fop2}9N?NI|iw)UK=9yz%VrGzjI%C3 zDZk;UF&O*1*i8&}ieRi!NDs4OR_xrU74c9D@1pcx2vrLGWlwmbeV;yCh zzd^tLZ%?lYLV1fhJ$P1i<^1$8cF*2A9>RMS z0^tiQzPLllIdQn@lpben(o7YC{ZOHN;;1*@fZfTmVmzJzUBamFz(!4JF$SBS z9nYjdCqJUAGiwr1^n#kd9AyS~t;i|3>bcU241M@mc&@eEs9 zGE;xlD2^FQu#t@R)1_L%Sus{e>7x!GcS}|v(dZa4(ENcIbRX`H20}RKq)7xzFn2iY zfUo7Q*+}rm$eLafn5iu8(Ze2ki{=EOCs#8i=ou_G)H6bUwP!?`*+EUJz%KWaG`IQ9 z@*q(4nt5eaW+Nb(%nyp!@CLor9M_#(=K2qC7!JJItQpb#g-aGzmzz0LXY1<5HSwl3 z4UOyZKw{#d$a*|t=`^?E5m58RIUd)+@lMCaU{TuC(b3fyZ?9YDbeSg$@y=Ce4Q@j? zc+slE=R3_8)~#z+cCK=|z~bb|$X~b0Jp37NYFH0yMSI=K4ySd+ijKxk2T79>bgaTl zZcVmHry}7RrZnU+tg8u3DyrZw>{WWgQ()_T68HogikxWyy1tTbP|i)URsIvu>gwyp&)>y1Ma z>~?poa`ZAqLtHTFbJ@u z!qE=v;%Ek2-ioGXyfGN+N;GGpnc1#Ji#7>0iz{+i(b|T0={orH0|r zYz)(}HITQS%L1pPv2k@AuMbXSY+b=f^R8cWBL-zSXcj*^EQ!`<$hPLX&NxMgvk+c% zZ0P80Y{9*ornL^XQ_XISpOXR_>5Qx_gAdnIr?4FC-ZRY?`ZesH4a2lFWX8Q&-ZATL}b32%niCC_EmY3@dygk`z z>1yt50@2C48MqnOY1P%zL!T2EE`}w%y#+(gdB^CvRy`FhW>QXJb2z z9W|(HhH-LTWuMG-Y-z^26Gg4-prBn;u`q6W0;z^})B{@LeM)PUsAVsK^f7cI@ir#L zTczt)GkY5zplL)#>q|PCE~F>&3t=a7TIxDhJ0??G-G=7Yx`sIANC}`>GZ|eE47i?~ z^X(mL`45|GM}=EDR$3#5Nm>cOWCbeCtX-WerrG|Aj&1KK`VE+25S(M-y7xXQKcsaNba8+|;C@aYZ9KTOg#ZrM?li z*aBzL(Sa;2fI8csI#wm>tZmWsMs?EKQ$59$M?s+vYS?$z)_@X^<|k|@ZPOK|Lc25_ z3L{H%9av~TR+7W283^0A>VS_+#F!DQ3rzuM5~pif(c0c(sSBIhoHls7h7Je&svJJr zg>9|P&G0LJDaK=)Ze@MB8NBGvO+?VI`_}1Kfez26vJQnEUrsp1|MKSz##kG=T3R-s z8f}emY)FYZ@n;YTzuUn3q;O3vy{)yi*)I^JEkVOiCp;Pkpw)4_D;?tr`AC8BHrR6K zD&vYNj_J%DXgX)rB&JzIH1A?}R$;7$f9t?#9`9;fNxH7N4GAX4JGz!*keqCS+Z*{) z5ZJ9s@mZ2=Zf#u+?XTs4W))%dh%s&bhInGgGZe-*6i&Iqb-0C#$g? z)(?YQ+2q@qQ_q*%qkFE8vojbOjkB@g?TuX>^r=b)E8>X40mjBdz()M)q@k&9ZuWY zR>zR&DgYJL)_f& z)^)=CjAqRZ)p#);lxkmRD`h%HdsiE$$#x3E5#LS_#RB6H=2V<`)U}|O)0r7&dSDW( z96SUBNqPi2jqU9iNijW6NI~JzfK~yN-CUX$WLRQ8Z&Ucj#wZTLw(`br8V;~glh7Xw zZ6Jm>8;qHze~ERC=~0|PFcqUxtLKMWwU{U;e`sHSsX2VFqf7U_IzF0|>sjW2>S~Cnxh$uLW)t82iYl52LiZQW( z8Jmujv~2iW`;3|$+!AD>m6F~`nXoW~;nCeB5<46Tuw-rH@-Q%<7}}15zC-G8R@d1D z0}z4B;azZLEDvtlS>4#!25-FiJ`Ks4eCJuv$}HXVMDZdI}jxWUEWCRZ@@yKy>$azz27E&3JAb8 z5?0%`-S8Njf~XwBO=G4%{V=?`><|6S;MvyP#Sz6^8wYM^mW18{k=Pe(Yy)O4%}s02 z?d_D)G(bu^v$AT(1Q#pcl`AnW+T0vUY!w{4WH!?`OfbwQgPqH<=m3qCiBS}W7p|__ z(KldF?VK^%xdjHP_O(rznZotr$Df!O!4tp@+DR_VmkhDm;gsKu81;2%jwV=foD&Z- z6X4*@DHXa{JGH;A2@?&t71$}Z6dIhB_{TI0^PPs)7Onrdd^XD$vy9Rd4%32;wz_p@ zM}d<&OiqJys-XE`dTB&w@3&(srRXt}>}cY;v2G2_57RwZ37j6PZ^!8L$VAm)A!!yf z3FCWJ9aB&UQL(V^B^VS{F_yp$ItU`cAVlHj^zhlfT8Yys6chSyq{N7RAg2lBN1; zNCq46&<8PbGD`=uhoWr~hS<#&e@THQBDS;8YdO=z^1|#6U=C;m=ZK|C?iU0qU>eEN z+PSj?bJUxAu!#X(vtasDvy;Y61gf0N%w|{=HYhqf+a{YeMJKA!g3XGR?btNKu1l-w zEt6q|aQEobZ5@qW4Xt)wsZjufL(+X1h0-ZCV|n3k!5KYZ%*Co1Gu{?-v^AZG=ZxA+ z+f_sCYVvp4ovqkpYUj?J*{`D)O01J?A4<;pu@hFewzZ3{lWRt-uDLm6Dn}ilYIV(Q zm<@66A)&{?4dNH+MqXpE4G#ANnE_R`8%yTCx?TG>wXHpsQy(*y*0po>5QjA=#Bcff z_6U}M*1Y{GnVF`Vjbln?%azGs?B+_4%pe@C z-(1t>*R9!LS_(VW@j@?~GucanAT+@+Lia@hr zw2B+WV(Z;Rarf9Cv(Vd{S{s_I8tg7t>J)}Kw5MZtMX@`CX$IbYfbfPU#2Mx3+CCxe~1$?9ogGEpSZWr9W80 zm7`qM)qxCc7_QB@&r~#ajy>G=X~*cy#X@2MO@cyW*4Jw1*6QQ-%#8$7GD`OTjuyjZ zT^+Z^+4y8*sHB~vSR^w7Fols9HsiYjvuB(x8WWjaf4?p!RWKxBrN(hIn%`mLA?mo9 zjVBame`5&?H{uv)Xauo+*m&)P0y&$kYdF6vxtW*}#jVtY&}3q4*;hrPW-?ulrG7U` z1O@p8uT9d%6)V`g?5x1KYgVq6tcJ1uZHxOV~n8*g20v7xC^L!T`) zv25PG~@QAl`d21h3^C78)MP3m+XiHZ+ze;^g4}Fg_VL_$G95zib>xXHT#M z^26hGO8Vtr8@eidg?o9%4sUy8Tjthi2@n1oW|Nq29=}u4FUoW!{lIi&AdW}!An@AI z_V6}$Yeq>wWXuo5zhdHtT^qVQyu;m|vCZ2WDd{&Zl|PU13Ghha&!c_7lx6$*Q|iDY ze@gm|X8e`z6&aU%J0jaNw?()1K`l^B;=?0>j*#v(o??`pNNJA^3er3_D4m|zpT`OD z{K-%#^gsRj5~y?hhyGWm0R8XI5SrMsys@FPnce}@oW}NvO>63#yBZpS*q-H$nj;9; ziZx`sqha;LHCS)1ZJc=Wgvk?5nQ-bv+?H%_ZS9=c)sf_d(}hmL#HMTgNzAo$c@tJx zy`Nb0|3PU-Vi7nC=?l(OI+8w?^1d#|n*Y5zmO@212@m&eG5vyG0;f7nSVep2C5ZD7 z-j+iGSP*70W?vo@tXbp3gnH)nn`NnOmZfTzr97W%DbI{D$5$=2$5t&>V=u+b7*hbS zgXMCfhAR(@QK(-IN~K4%5nXGrylYS*OmFIv84!qr4efx5Yn(sGBNjdO7{~ny&R`oE zi$3fPd(6vnbM|?W$XxH3$X0JM@Wi=ZCSD`w-gen$Z&<|rdd6li+kO7xeO@La$3?by z!`vs_eI8y}{^~`WJ-h+(-i+v55%*UY?enrC?nlmMa*Mccgf>6z4cy{omV41Hkwf0_ z$PRDt6NX7fWLw1DeF+n~x8Rj^qoZrR+)cflT6??<{!WQ{~-d&AuaLz}&$e&l66;Y~nY5j-;Demey9 zJZ?1gxY3gv*%ER8bkQN?b00wV!4+QSEH8JPmpOa>R_~bYD9t;DmGC0&_{}IadgeB0 zIeQ-jn(Kul^Sz_pA45x-?w-pIQH?iU8a)Hy?$&U$6QK}u$Oqm4aHuTz`n!EMGtI$E zAg6m9sy+oR5QT!bdPA;Y%a-I9F~_rpsLd646tFk0lbOAdu| z;O>%kFg)b-kGTW)q4c?K?LO~>i2Jk?el`^H`fc^5%<=kA;C*4dN+OVHFW#RPfi}VY z#}^%PAIq3K*UOG>q{u0AOe-Rry6)D)@uBtkFu`fRr;h9kvLRKz`R z^E_`j0!zK&Rp4;kW)$gGLX2lN?4uX>D-;pIzvEtqG6zDHkZUyl2SuV6vIg4`Ji`4a zlE8nCLr+9aX!*4Gp}@&dHE8NlW9Z}tX99`pLoH_jEldJU@V4rCYG=YC^7#c+QI z!*<<1u&v$eVOwv5%yIi1@`9mtgzaSvxA!>09zAb|TeJ3Kpo z6dn*=(v7xxr)-b7pRZ#2}(M4{EqTs)*qq5vx zynY|oaGO7k9@_FFZ{Vd~Muiuh#kPHLoskrYyuKL3Q1ZylUcRZ|XtoUd$y|JoDDzI* zLf=0DO%RQ2!Y~1G!SbFc+Wk=sV)MK{;c*$4G=&xaGD1IB<3Cl8UBZwsq-B^aZ}eFjdTE?>9L^9;f0<5AIxz#&^$ zDC)fh*1XRwz4zw{o}`SH{5>-{X;X>}L1#wG_$S2?3)2^dcX71KjM* z-f4(*+}|PYH1}@wNM0Ksx2rEY+xzXtc|CzV#-1*cbY|eC;9X{G-f6ULOnv8OU-SOgtyz-iaPm00H`;Ch(!|AG(Y) z`c~`^yIbEYji<;#WcCj9CbryE{Jc=UFb#J3!2ixb;$=%*JdIo$tstS=d_hlF6*uCXZ3__o^A7VQn z27ki?gFh@I`w}l}fj0yWq|}RIw($YJkp~I;fbDxI0{Zwv3~EOU_r*Mmz8ypEW9XG# z80RAH#@JjChr15Bn=pWF_xfL9`9mQi-S1zvkH*J_c?i{md;TECF2edj3NXLiJ8FwJ zaSm!i-)0@!QJC^!4rMY%FdONEH_aWwWTxwocN{u&)?AEM^p|gU&c)1%G<*Z({He1K zR)wAfJ!fJfc3Y?Ef%n2`!xIlIqoSj3!`$duUXGdIyxqYG&aK%TyRY=J(1l=d1Klh; zAQ^a$sD7T+c6Ym`J(-I4u z!722K&YzI~@kEkL=VvMWvYb0p=>E=yDfA%cc<}p3M-*fEWHuVOKVm;4oY#;(I}ty^ z`6lS`0r@W@t)q=uzyBfaXUE#?d!WCYptGE7K|i0M`#ay{1_eID@gKs=bn+n&uX)5c z>2pDEMj94L8ZRbta7w!~RP-V6n~&?WM85%gH?AoX(?1RRo4C#ueJ|)=;rckyw}Ac> z*L=AG({BSk4&_ydz5w)E(A;Zb{7YDR{t(wZ@|*ORAlOy7#;bx1Jr%kdg7kw#hovj- zSB1@56%qQl)OXf!lXYj zjm9Qi;Nv=YkzwHDIy?an^03|g57Qr=#(!{H{=I4Pj!8?u zA<>uY-stOTg-uz&!2vln|&TK#vX(N$^uekb|4$2k!G zZDxQW_3=p>jdy7!K8*iyT79Obwa2Qo{QpkV*T}T=+^h0GlMoaBGPlR(l})?ahX=$GQ(he``=Y&2Aw2&rIoyd$|MAzp|w->V051*I6$4_A-4q z%Q-08@;}jeNc;(ue_@*bGt=t(4u|{wF{e`}>~}IdJfEhJ_Of5RS`{7g#zGKF)FS8IE$;z9Z+^ zG0OGbrJw(J$3YTj!ySc$i|5Rq;P?2-1cj5y12-Xek@2l$Z-!H2jEu4g$i?-NDH56>7y2> zg%>KkC@p-FY+;M=1|sbLS>fM=Q(!L)KUerD z5qb<|S}YK*5Izq(VEox=XX2eg7wt=Wrtl=R59wEh{}LXTZNujaR|&5bzA23Mwdsx% zo+Ug_2r-@T$#z~EMk5U*4dlEyj0rMK#L&kQr{H~NqH$@$Vd4g72xke)g)nIo57%H2 zF4*At!VcjE;bp=rg*OOq5#A-dSIBXX@;)kjQus6BuY|7)|0sM<__6RG!oxz3b_l*% zLcBHD(7D2+gvSYw7fuwOBAhNP63!OR7uE>R5ypj$!qvhHgzJQt2)78Y5MC#|QTR3C z9YU^?Sg(794+$R?J}LaM@CD(^!dHcV5FQl1EBsLSH{t&XL+r08H&fVG$k&)Mobzqs zF~Tvz6NQt6Q-x;=i-l#vO5sA`dBQs3N@0tzL%2bBnQ)u%D&h6Qn}oLs?-f2Id{p?P z@W;XzgufN;7rrgz_{;hq5`HH9w=jc#4Dm4`$7j+*g(HQ>3dad22swT-{prFP!db#{ zVYP6H@XNvm;rYTg;acIv!p*|Vh1Uvq32znd5q?AXUEzbmCxp)lUljgQ_?qwy;akG@ zgq+v0zMl%YZXu0ZFb1Q-e!{`RJYl|YtZ=+=ve1kp;CGhj65(7S*E=k4k&rL@BfVVM zB3vuHSh!hux$s)yF5#`hJ;HAYzbkxD_^9y5!k-IY5&l-VU--7rjDL{xkm%2Z{}$rT zsHsOxm?Io294S0j$XC3w-V=nU31{?K9kn>N{F=38ysBon4 zSm8L~1fiK{Aphy2Igcg3S;BH*wQz~>%R;U@nf`oXn{cg=Z-Zp~X5r<+YlXXndxV@X zGyQ$ShlTruoJTYMIpK@KUkYCr?ic<^_<@k?cIMCEya^Z+<_L!hxt?eIu|mG8lJo@O z6yfQ@8Nyk@a$&V_iSWz92I2X_HsM;~#lp=(zW$QsbDxsP{Xru4QHl2m?-z1^li^PY zpB26!{H5@9;eH|aZJF-_;opRx3ti4L5zqZ#BG)CvqlIIHg~HQ>XA4V(^Mnh8ONEWX z)xrye>x7pGw+OEgUMIX!_%-1j!fy)i6+R?6XAage!n1{?!g<04!o|Wb3G0PT!d79I@FL+R;SS+7!W)FQ2yYkOEqqY; zgpliW+R?9t2Z#lD-MQ#biIW}YpQ1gk>p=G*B44iXScQ)jJxTN_qPd=DKCb7PuTpf4 z=r0Q!i75Yk(HDqbEBX@An~7N5?NIp53cpAA1L5<+KMFq-9u^Me`V-}i6`m@bCH#`G zMR*@1mPLNxxyvF6~a#8X5miZe+lmwJ|%ov_@?k}L;!i$902yYkOBYZ^oBjGQEzZbqM{8Ts| z8+7c?%Z0ZK?-4#Cd`9@9@O9za!jFZ#2p0<*gck@e6<#I0S$MbbLE)3a7lp42-xhu> z&hYhmBgwbF^@R@GN14 z@XNvu;Z4Fjg!c&_6Fx8eweU^hhr-W=eQ=L~KNf~? zFVDy!JW6|d%`D$FA855zAgM%$VW@4ufD=OVS#Xpuw1xESTAf7UMjp= zc&qRp;rE2k3V$iwFZ@9GxiFS*MM|Ec{I99Va=2#|Xy@i-qfjmkDx5quepC36@JZnd!dHcF z3I8hmw=iprm2a4EjIdl-BRo&IQrIE9On8;>CgInG_X{5r{zUjI;U9&67XDr6jqKuR zPIjE_qOTY3R`?##_Y;xt5z)U9ejw~W-j+W~I7PUH2wi-Ih;qIryi52!#lIl@o$wtZ z?BsulsH1n1r3VnfXNc%gqQ{7yB>EK5MWRbZFC>Crqj0stcMwsR>qXy2L^*eezE|`E zqMs1`wCMj9zOL{;i2e%^d_NW)n*bVh8cam}@`)&CwCF<7Q$)`YT_U!WQ8r!Yhg3{|(^}gii`z7QP{TPxz@YTxjzT7LF25AfgV_ zM3)euk2#`iMK2NEAbOSPb;2zQ-y!-2(Km_yy6A6;en|B9ML#3@C!&8P{G-ATivCda z$D$95b|=~T^(R99L86ZleVpitqE8lmw&-HfmBK|t=;b`o%SEpyPQi0VM3i%h@M?wc zBBGu4DEuzbdqqDi`e`Eg|4iXOSNQLQZz}#zqCXJ*cVQ07rX0hG_%9%W-&Emj;bP%R z;X2_}!mkOxBYaHwg7ARw??UHfTTYH}tZ=6A%fdCnONG}8|4aC=@Co5_!e0oxg?|(N zTbPMDvz|G^vBEQi<-(=HX5q!cZNh7XHwnKfd_wr&!aoTABK((d5Zah>949nUM8r=NJ&On%uM+)bVYBc; z;gv+B`-bQr311MtCUo%OeT58RRG2LsMnpSe`E4*?h-t5(F$FM)A;ciq8azWdLs%lL z64nZr2$u?15g|{ru#Jd9I)&?rm_J-B+(^Xuy;XQQ5##IC!kt72w@Y|45#!Eo;T|ID zcbD)UBHHb{!o9>o`y4Lu2c)6b$A!a)u$7TS$UQ@}sW0SSDtZ~wmmBFfl7`%Sh@egR zklXMD{S?C?_wN&}R=n^92<@3UfuO&k6!(kxg%=Cbe z?+ha3dVmOdPL2Q}hj}gm<=1C|M!A2F0#V+l{eUPZyFU>8k0pYyIjD!Pg)k>KwKTTW z;{d1NSy=XnHymHF9LLu8a%NZZ%^4FK8kcvijMpt+&O-zzn9~X;;4sSxMb+~sG_J>a zWF~9^j|S2K80jY$ndHp)MTuJY5n8TgUqadSXxJf32y!Sl0Vk^lLy zI{QMF^n=uJEEmpTvj@59bT*?1o}rgGSc`|d1&(B65AYAV`cL{vITY*&^-MoEEcKkf zUJgu49-a1oc@Ui`*cv=e8fpx70DEdAtJ>R%biJM}cceNqaWChorPlh367^y!{yCdG zOh3)gQlnC>Bqh%D&sBVbMbDG`j(mn4I}(rQOFc4=yn?69{inW~CbN1c&L2#6`ITLD z?Kn%=p2cTnHHV7oOvoc?+wbTr8hS5-=dY2QIUzK7M&ywg_BgICwc&b3r>eY1e8OThn-3iUr2X~A9f1KQ<6tWGQ$){jQ_#3$b8PhH?J}MF&`{rQa%}?@{lM!9iN5v zKYqHQNYuv<1ZMom{zmO=Tr)Y-QH;OfA4%Ib1NkXL1jBunKEHPn7UcIZ_~jss{4jM( z@cSGYg7WdXYR(z`kI#?KAqV+A3w|t@{GhS~zyG%U67q4r$aGA@kI(O?Y5ZOc$j5S+ zj`{d|!=QX6;I|jy{>SIH1nGkE{T}={*QR_~`1kouu>2D8eIogoh995b32FR30Y6`V zeU*;#%|ia5e4m4Ug^cv^`SE${pnMt6pzV-`@?lDxkZ+XbmynOYQ)f9$!;jDJs5E|4 zz|WU&fYLGFSMVQ{?=|piMwtKc`CW^EpnN6Z$NZFU5dN8tbUpsTFCkwE8kXTq!;jA| zj_V-5@_>9pl#cl#$Pko|&jIH%Kp&qUe>V{1w=^JMF48g``MvI@%GZoQhBFO6KEGch zU65ZxKt9~kPw;yL`U=X&-w_T&UjO6sdjRQz{5rv}3W=yc+!9alKdkGmS-!b@SI?D0)wEnSw zs10Wtetdo(r}dA!ew?(wQA$UCeC|Cc-#g+*Ui|p{_`AKJd=G;k^HaX#l#cZDH2r-f zeoVuU&u?lPzsCdejZr%C`=^&G-)G?G^9b_$6zPKUy$F83d<6l1zqR}l{o`}V$29!- zynmC%?-lU#`|t5eNB;bsWl(<^Fl3)ckl*WR?eSJXz7qrd`1>gEOUM@mKbFHZ{P?^d zN#pl^Kt3$*O*-bAfG^62?M(B@0lys#(1(}&ACG<=2zG9Qb8e?2)yI$H?*@W;{v74* zK_u;f{*v;s+N{Q0_<5{8Y)f$B`&l?(Uy}A9%7{ zY?UU;y*7>Cx0VObK}qtvGL2vP2X?Q8{ICU?;K$$D-pO%*H z>2Kk;O-e)X(_L)aHxZNj?Zl4t>hJ0glk=D9$mh4)Woi8Oeh2#X2e&}E7p3t#<0Jg$9P!lOnE`%gzX`Ped265J z>O|$PD=?n9~GVSZuF)3Z#q?b4x&X5qR+&f8G8;q9NO7U8fG}xUAE`I zYm;8-&Ty)cW&wZhAKN==SGQBRz56YMFWI!K+dcX6{TCPB(7o}3E&D%lUOfK@$<3m-LHgR=?*(N2M6Ld+0qdBpzMvKc6A?{v*%!>aL<8q zl%4Su{+&GsoT_WO&p15s0A)eD#hj}B2cfI?@(TyO`G>=YW3PeN3}@rP*Fw*Bdq^LB z>6$k`+VljDZTRZDkoCYnkS2=ojGR3OGV}Kw`1j$%e z-W>+rHgCF}bvzJSw&!4U89?7LsxcRoO26g zxwU)as5|~deLg(n=>sw7E*rd9$EBfLyQ9lk?ycSVC?nBc0bRwAkGf)=nVxA!r=?{Y z%ExrxvYnK1Pz>!_l5;!dKbVn^I^|rqpKU$G4=c1fWVmfd=rQLuq^~*Smi{|wYwAl@Qd%!?rb~m>Smk0wds{^-}b17pzZnXI0v$@oM^|k{a;iL?W-+>vhYtE zdbn;^_mrI6?v0^M`=j|eu<4xc?P%u+be-XBGX01Bg!-G}h0G#y}!|h zmvg5W5%u-<5qlxz*d)Hh}$o!NJZ^JBK*= zn}&3XZUfymY7^QL`W&#ayA%IM)4uW9yLWG*pYLC0?FysM!B7?Y#xmO1SB-r&hhPg% z)gVmw@FXn4Bp3Qvirqd8J+Z!jJA8O9{YrQzY`!h&w?34w@@>Z1v*#e~#^|C-K6B4C z-KUuTXZ!t|@O9CR*Stx7nK`g~w0E>H;j_?3ccG8&GJTZczFwK$0WZ^+)ds(Se|t$f zGkr=vZfTwBo>uQaq7P*wFKjmU3d)&*zElbwgd#ZyPXn@yL6G0c$A96TgS0*Bjyk}2 zoM-d_e@hzvZ!Yv`^n)=h>30!V2s&sVDSCl#O0Nt2LSA&I)d|}*1LgPeb+VCuE2$HP zA4w-1!e$@45Ea)7yr#oZ8raw73wx6_xHVrAf z{E2ssGQ5c7)H}Kg!YWaQ_`UsEOv>(3nO8QXfHOz}F!6c?aJ?-`#k@*WfP~AA}zEk%zMkwm0L}?u@F9Z?c_2 z%eKEcvTEC#na-jEnD2bsf&Ya+Iq(_koRKpG*S99@=wpPTD({g8)4yfrB#RHcdid~f zmx6cX0_t$_!8Z_|>Fe-M$f zZAbo?hT~&SjoDI1Fv$F-j{Hs}T-CI46%!%ahNlItY0bw?s{9prsc!?m+w-|EFBWy3 z`FPV9n2pbG>pbZ!zLCtl|LM#z4Kb&v6YqiN+d@%HKJEeHMuOqgxel*$VHjW4mcMpY zK5rSuoG~4zo2yp5DKURc8^yz|vwXhV2#N4wKn9M(|4F!jux7vBzhxVE0T16KmVD=s zeUltt9%9vFH|j9i7zUa;3pur~0eA}TgQpW%EQT5vnBZ1x3yb{m0k z^9gde8X+O4n&5M&4sfUra;U!D=C^M=@vp}j4tyR|r7mI~FvZ^@0_CRwH9fLtBi&y7 zyUu`6qEJJS13$i~b8t=hLe3IjB3v>BKYl9e$fjD%RQX1R#Z1AEpURhs;_2f@6(YwR zldCE{igXVC(LMz34TqeCQvl2CB@^)D^Wt?g{zJ|J0#k;Za|zST6avMP) z)81QcJeaX`=*hXA0$a|Dd{Im|(wI+Bn1J*=^{f|@VjFgXBPyo+iP}sh2TyTRfTW! z@%fR+!M_Y`v{6g#IDl1N4@c03#H^DMfES;e+)MCnK0f2EpmyRPjBP~HR%u3T14PmI zs_bQYD$)VTt_Iml)tD-3qIgDwd7!8lQyYn>LX)b8sUg&y@CRYez-2T3*;G}x^GZr1 z>`p}B!hHOilCXjUrz3begi@a zbMb^zMyPC%+b=8Y^sMO~3LEFR{YGMHmN6O^XJut&;U*lDm;@jqf%G6V6LH8K?zL3zRB3WQ&2v0Gikq= z2;5z|Vsj{T!^~j=&;fF;#5v93Vb{+@^9^A5q(KZGI3Z-RdMx;i;VgQP=aA3f{sx8& zLV_&M))+tkcl(tMA~6jW$_t`R#kcDMs282O-57NIHH9Xy!R7sWhuH+zk&8OE$qo=-09O zEmTr8tW7$J-Dh%=!P&#}AnHGL17ZvLx%Ati^~u1;#LJ5@Jqe%)(qh zd}_da7!7@gb9r$Z<>AHYv>RSbp8|o<$&&@s&RF!BG9FX(SpkkoyP#E^oiIp~a7Mx) z4OtWr*`vraJy|&J?kBi*-N9JdWVk$P&U1_K9dQ@oJJaRia8dVa zeD`th#dpko0pD5fyZFv_{|DcF-GR_yKX(eg`@1|OEyr!g_W<`6d=GS=!1o~cU3?FA z2cTmNaZB+%)a5bPxp=b>Z-V{~-^1O*_|9`DV*h1?I~U(0-BtKL%H4?XqupEZeT>UP zsq)?b#`h@qZG0c=W@b9haqiLh9_{kz=rQj9q3uoJt18Yu;5m2h#!Y}5lH5x|z)K{E z2qA2W6eS@ECJ>U4ghfR!Aqfx(NzB5cr~yH7fnwFVR3%!qw%SVTQl;8ri)(GGR$FVe zW+95!TI2n{+clk}?}s}< zKLPh-{W{!<`ct^4=u|)YmYxlFvOWiHw!Rqd6nzKW9DNY(RDB5UH0{Pc-gM2)fo5oK z@i|j3hkL4SfqR=jo^6=IcMgEzn2c7V2~~)_gr1?qQ$u(E8juS672px)rXa&DJjZCiu1Hb}nxH zI9!}~W=Ag9zXYlDAK+TL7p_a|L`EJ7*R4;2>(OVx_3CoCK3xOXuQ$RSqW8cJ=sV#i z=!fAZ>gVAO)vv=HrvD6gxIO|msDrr8PSP0Z(9E;oChHQoDY_bNs@@7Wq`wI_tnYz4 zQa=VaP5%;Zx_%q(DE%Sa3~k{N!f2fecZ{A0_XPblxDj0ncdT9mH&b5%_e8xL?l{}z zAHw~)+l6B>^ebRl`VF`)&1Vd5{UKbx{s-Kkwh$|#6XE9SFx(DH zb3c&|m!3#)>r)ASJr|H*R|NOja9f{QdO3JXuYzmo&2U}%8n{~D3fHaghwIT#z{N3Y zaDDo3aQ!+B$%p8fa07Y~+yu>yKN2;!{TQn6f;&t<19!N73vN*PjE%Y0h4h!8l}=7! zeiPuj^c=WaFM;dU7r^!C?Qp%i6RuAmfa}+#r{$Zy8TM?muHG`{hX zHr!fqAF>Ks<*qikm97n_0S^o~P}bblW5pxVcxI98hb%WwvWQ%K;6v=y!Z^(IPWjdi=Na4V>4 zhGn|_R`~DmnXnVxiB|Y_gk>inY@9o2h3^OTqYO}4IE^;^3sAe6ZoGS>7489*NEJ_W zXISCSK(WrOv)s2?;eR{SLU*SXPMRcPCGNYeaB7UY&kCnGRH^#`D}16umAm&@;nN&y zvHM{w{Pi*TRSR0ds&GGMg^Lkps7m(}R`@)Js&XH&!WTHy68AwXe6b^CsrxxAyvL!I zxnH!x-*>3x?w72QKXuYYQA;PhYK<&HVNE70!59O^^G=LvFh+y%hQn9|Mg|z~IgA=G zMuG9A!>9!#{Z%VG6!v3;*12D|!ec?*%{pyxziEXhgEFS`j75;`pwYopB!gqsOgaO2AbAM=s_d8U(`y(sd4eHwo z2;1oX*ivbKfnmN4JNA^iUncldz5pkk_BtvBHkad?nHu6wIW++cV5g?4(04$XE!gIz zxWmg+a2v!?_|*DhnYrZ&xOi znhCd4S45MhQ)NR5QHf;f@H#ME)hj9IDRxDL2R2f;0;zt8199q99q zX2c80de@c4cIA#ho-HZU!A|ELkNYk#{8kF3rxe4lI^#NI~ zoYc@^cv!ctsi-Yh0~5QZrMgw*UyS1$^SP7EQllQ9i22n@(;@CT#DUNnjqz?J2o8xfSM2$2rA1)3@9T zKL*N-yYwTH)&*D$iGIh3{~vdA_w)_&QXam(#&~Ujv3{gqg|VEMKz~ ze#(h?maokU_qRlmZ<7^1tHk*SE(C=YsktCx{iko2~F7P?w(oD(dUB!izz@$e1gAcU$3=piHAy`|h*C z8)MW1R(Ln4*BP_Xx6cYc3(D9+s}IBeTcAu^w)q~j!iOEI-G^bHn^TxZ-{3o7h4o27 zZS));g?X@vNw>v^VSlDWU5e*F9QGGFjLX2_uz#+@=m3Mm z{(6V86$}ph+Z@I=FgWaA<1j7<1H=Bv`yIx1Fw($y!C~ycZEqNiKRS#n5F-S}pB=`P zV5EZaPlvG+j1({esBBY^tH4MGW0b?V8jKNOcqd4VYrseXBjhly1tSQ?c!#kIjNxFM z>M(YLF$@gu!C`XwIv7L2sBsv3z(@pRt;4tuj07+)av0wL124))-s~{02V)2r4?2t+ z!0?0dw8OX&3?CS8I*h$wc){p#7@c5vzZjL%_a zrY!gS-0qCmt&tO*7(YaeQDDpgBZ#hIJpx8L7>gXnqhO@HZiQEYVP@3FeQ#LddQfIa z`Kb>x_(o71O|1jIx2*8hpg0FuPx=02g_H4i(@;P6y^ZyZ6ZQ*VmlfXYPzQb8R`^E_ z^|Y_Y3LkK&XMDX@_$7yW)_2GXzv@uW`TDHzpB?IXAJzz;fik+h;CmO{10$5l{UzUF zbPtF6tq<>;C@tHCn? zgC(dPq}F>TSz+$>X5=+`a;)$}4%OtDWrd%1sAf+thE9jN(1SN+DHiVDQqMx39SPQ7 zU1rr{iu{pFg?NW#)c>2y9l9LEyNGOk?DB_pg7|>MC$7ZMT_8Ru@wqD){v!zc*1>hy z6+Q&2idA#O^^q&gIbkI!trzO>$Dr1e^6HX=Ft^_`luwr?gt?qCW20Y}CxpESGt>}W zl@Lw=Wk$S!UY-!n1jQ{Ot)Y5FLO2(cF^r(TC?WhTaxheqzBoap&_>Ln<_7SsF4q`0 z(wQa1xoXs}!1G(ZuF!q(n4%p*4R8rDkJ7O!3iXS7$K^H4DkJ+{%zJ6Bf6hO88EPI>{4EQAPt> zGb^45+Jw<9s75V^$vkEidqSTeH5ZCF0bYf^h!OtKzhgu&3uVQKABLvHh#!Tf$B2hQxiRA5P*IF{ zBvck79#vzwd^H8@h%02S8nq0Azy#}*xL!XwzSn2R_xdUEy?$zZub+-y?}jA4p|@tB z*ZV;{O=2c`J?|>bitSWSMko!087WS~5HJ~pDe>u^aiP;3VzwtMv;c$|g}>$*uSQ*t z<`>MaQU7R2uv@?&pN=yediBp&ycgx&*T6#I$y521fL#1q~(LOlM= zggoi}V<_MdKlQ#D8s-o`^S%|zaEPb8e+tcXh@X4k4$XFmUwFGhiyY#hw>zsAgelxJ zc*8ZkE9(M>eirnwuB?k3`Z>@;yRxow=;uKvc4d9bp@MVu- z6BtW(tC)Y6O8FEmn7R!Mf%`0LyAJ&nBFy8CD{%AkvO`>{JHq|XYHrjRa{AZ!-_)35 zmXDD&{!My@6|MnwKXSEh)|ha%V6A56ja&2_E6fcfvpHzosxkd=05a6Kbb%GV0x``H zaJw$Tlm^PI|M%(=JOzpty34;|`peXSLK(xLY2 zJy!TP4)qh9DIGrKP*3QatuU8%M#|6iZB|&JECiYz11qTsdh?G!Tj2Icpj1d{3lVe0AG&M$y3!Ux|D{vQ_8zUwu_gBcs=T6xN zBTIh-&ZzZht~stPflwpj(e_-I1XO4<2%4AcvVc3pY0(f{1OCu<(mveh-56?z%1z3H3U}^?`ArzkxVkA>_uugsgu# z#LWRT$fPXiPR4Z$=rNPBoEsU}t)NFw3gw_2Yz^0Kfytp*{kO)|lLizA~Od`?BQ7N0CpWWhotfEqO!cDs# z&X19gfBx8gfGYnJvD)~VinZfY?#z0W(bVlhf2M*qv>GM|V4e)@kqDc07naZ}R=atjyVt|BX4B zOW`**@MdnTt^ZVz$=z>F{H~(RZ^56#8t5s>{4V^oXn$Y1O4)(Jr0s!I01f=bW9I-8 z{VkarokF&$%&qW0iGTkFcV-Xpn~b^%rtotRX}^N=7DG$MzDDq0ka-2rH0#EwqaMCnnJWuwLQTqWw|8Og`8=gGM#!qxYH-T76BH40>?gX)lM5^Tv-4Egl z5@9P*rOb!VZcVC~Oh=`h3+8z7uNfF&3&>G=0o zj6I3qugQED(oMnY?1DW@{u&hQMR?L*hLiRtoKa*iAC(A5^ru^)zarUC)Ve9~dE4mb6NQbRfQe_Sj~E|MJZ9fu{X; zsMy$mBTCaQL)<4B>5Q>IFmbnJ@)oEQZ2zSy^V?3k4#d6Ng`b##p%!V zEr0RAkUbzp(v9#=NcmQOICD}d_ro2ZOsVm?J~beg2>9K=s49h@uRtl{2{!qZzP@Uc6~i5bUg@n78rYyROovk%$ud_@J!#l z3%ZqYf99IVLXBZON9cI?Pf0oj<>TsdR4#lYtzT=i<}mMKU&6X@3b^Km@@2d#nFWHK z)Otk+Rmy6lN?*sM*Mk43Yt_(D2Ryt7an)c-AH(M-CbM(Z=v%>k1);88LsIs_KZ)it zkYEl zjlvVegp<+g=I#9*OlrTqznyRIhg(Z`LO5T#U*}gzYf&$+8hWwoBJ+a1-MnsB5YE@@ z?G=XBTspUKaD9E`uy^C3Lk zw(x7i;3VA+*4q9eLb)Y3_fw7)y@lF*!f-3`a}5@CGu*}IXB_;A2a9xQK&nlkMl{hv zULIk_0lr$m`WJ3G-_6arjHYs`#dZ>NIn|iUbn{~tJ7Bu`C5!Dp!x;Z;i}rDbvHY)@ z#Ag^gIo)C=XP6(c%(7@2YSed;L!#@?F7qDR3>`SvHpCZ)%+&Q4JQlqjQ4H~+3!~WQ zFyb?jQZ=J>tn>0{IZI3?bBDOaT9+6l?TnV0jB+nQ*t3kg!op7mD*8hbSzY6Ybk%e@;O>%4#PeMbP9xiMzWDuE{m&+JR! z;ZJ3fs3+5~7BFlX8P`(AoEK?5|1ud`)A`O8#K}l9op;CXFD*WbIm2lAl|2ZhWFs`4 zkB>|XCz=-Cz#^r&SmwFkhGR@A&Gjclo%?&xMp(Lw!gBpyJV<6n87@9j$ZY~`iapw- zFJM{Bz;cSqJu4f5rc71vm@?fB56h&I%m85uwYa}8*+u=-aLduF&{JsVDZNyhKX5WX z$A1aP24;ggR|Y)Hb{76i940Uq|K<3v!vAvovl`dppXu>5ZopL~G$$lp9IJUzE-&iE zi`|0P9vc)Jkryk|xyp*lDkBq4j?^?@r@9EX$!o1|YK%;smYtJ5H8P>0VZ-{#_?+&7 zx|+7gj2Tm>&8k^_T24;gw9`(@nN>4&>Zz+wU0nmusu?xa)ibM4&8e=NR&%l{oIPb@ zQ_H$3YpYwsxB04fU&9r%jobGYx-JbEbgYShvdFo3EAB3TL+q zh*?1~D+Y>L5hrGaBWA^__WA}RJ0>iO-0P}W)lc4VTD59#Y^`6@h;Ik$8{1ULvdW6e zXlYqAFTbjIX<@V?uk@@!;m$j|s<1LzxLC;f#TAuR;;*dAtEeh2Jxj>K(t;R~U$&^c zq_C>6z=?ZyX;t2GWi}<{4uRaPw5Y18Ji4^7qO!QGG&(h!Gng@TAY+;`8}Uh-*kSo) zrKN>X8Upf5$|?(w;w~&KERW`upj3A1nx@7^G#(l?+P1m5PA#b@F0YIh7nBr=x3aLX zG+J4bS6OrvBU(^abxfuSXm6>HHdnW;bxH@xs5nP5yhd_)VMTsnsSz`X6)l>oD5I{m z#u0&biRR~(l+4S^Ul=V!b9ANX=PyrEG>GR(4#dswmGk?;Ov3A_p?#m#=v2D$B2PyF8t3ij-!aQPibM*va*VW zacw#<6NzTDiM9K{I8x%$!e!_hre2FnVM3)<#d*>#V-??T7G+gs`DG=?&9|()u#}r$ zmXzfcL<^T!RpdFcQMtwQ&yMC7R#a6E)Z-XwM795(2EAo|S;ZnJ6H4cRQ9QpmKaZV$ zU`|rZymDv>Ys@Pxs4U7`SQsrT%qu7y+#kwHF_bN0Ay6caA7u;k1~qo9V-1R0xum?j ztm3FzEU%F2D=sZIV`Qv?`-2M5u`0?2WwflaIGSHkh;|uRAo7oy;H<)`XjKtX6kvcE zm?p2F06nXuBszakKtW;2u>xw8HOLq9GKIR(&Gd;Ee^}9Lj6W7 z3KuUauE20tUQxUhg^VsNJgNes<%Q^;tT)$1aZ^KFnlPaQtv*7!wmah5%>& z{9nmHRp$+Ac6-DsMu%{0aA0{&ctJ&3`EkPYiwe>DdHMN;m6g$o;g&MzCN%~@#UrJNrJw7k)=e9@q|admgRaow>*XB?4%=f8|2 z6?w~|70U;zK%TwA7@!&1#~I2QlvhwzKBz4H>?kLRqcf>kew={*Y>pFdv^z!^$Lpgj zI=`s6q`+1^y0kbiTAo*NRJGf2C|A~Xu};7q|A@w>CAl zszsG&Mdz24EsHKGWpBq)qMu_gTlz^TRCrdI84qG{XyDYQKNhQH0AoJHnnhAo3D#Uy z(RqcKLJIMsPi5nNfZRN}-jX*`2SWRq95q%w|+ z5e|bDY9*GJF**!|aV#UhpsciCJLV~UqpCQ6Vc~#`%rG67dT>GWX`xsMnnLx*12bOX zWgL75s%FQCF0Gh;*iks8pg_h&K3o9)Q$+%&{2#Nd4INc<)%7j*8$$9L+f-*GJz(6#vEKMO6#jdg^ z8&PV0$&$(CY4%7_uAZL78yv0kGkV*`8ag{4v*eloG@gb#oi%|Z!RNSZt z2TRo9i3aZKYn&~MoC&7{YhlbRinuJV0{0B?lww}VM{B}s&yDaD6wX_MXBqIBrnXZ! z_YUBqj!mdtwZ>b5wPk5O7PAO8Qyx9}WlOMtp;kC*Bic~6p{}8o1*q)5LAHI-;>yY; zn7aDsY+=VOnS|rqhgL#IEcq+39=B@?L&3nO0=VP18{RCLju*J36!psICiaaynm5l( zqU?#ZRl6UWN{YYJ!uqeUYDq;Ys^4C0mPKz%*dniO#aV=n0n~sd5>i~BO zW^b$5lOTB>Mah`RQHOCiz_u`9=au6|%^9PdxMVu(?sy)p+4Lu)a-4*tn1(^C!(yjo zK!*MOk>folwKyFIgcZ)8|DVF+({Vv4?T;>58J(Ypg{T?49PJ0k;Of8JF%~JvvExK5 z%Zu$M925=B0n4?=1SgxS;zfmJOYHjzhsU`HJu`~MXoYQ9Mi2{c-`Us^=MApedHvOA z?p3I*;l$PEA}jz072PQq`c;X2_iu|wRMsvZBONQK49`ISQv_y%Nn?=EeES}^q%!KK9m>)qS~+u`=D|G)^9#pe_%KCh+unu9}d##ZB+x~QC|(oo&nf1nkPT;j1X zt*W63&#{felssQ43IU8sA@z-GkQ$B?-9%__R;!zuTU8Uz0>Y+sCcoA74Rt)3h!0Ka zZ{6IA?dPx&T>S>@#~h!}fJe(zmC+G}`BEMZ1!`68&}RBHvKXPMIcnIT*Eb;(Xc-HT z{22#9=3FslPIywSb#*vfs=cLO!KT&B#T>@cuLaK`Guh2TkbS<;>UxEz-%bv#QJgzc zw+RQ4S5)9Tf&bx7$v#RMqMt#!&iUus=lBQ-$G`nLM&26KvA>)Psdb?~*WjjpP0tvhuF zLZdkBO<@vls=-74+Ngbw6LMc0-B?{O1#U(YtzU)8ME)3jTT#Z^TIAQN_yk>XH$v6a zQop9YQ90+Gsr7YjYny6S{p#wPI<$X1%7j9!=J{0=5GRuLhL+n13$M2;SS-*OuCYO5 zO!nIdDu8yXYphjf715@u*Q`;i+G}xc5nwgL+v@CC(GArN^@xXaYHVK(&QmixGDhXN zwc2{vXv=2QLu-94QZXtc(ai0aAI;Txr_{Jct#5B=s|V4BEgc)NdO_D^-)gD5u)Pkw z(|OG?_=QE=rvCV19&sF;UI*JklMap($B{VZEHKl~=y7O>x&}5E+gi25!l46t>n8j7 zFd7KDS&LD!iH6WnzrG%IX1}Un?W4uOY^!U5WuOGr4QR<09Ajj^%CL`MlOw&HtTwh% z(RNm`Ah(vpxkxC`(S5`WOze*Kpk>A@rfbIea&^et?kcVI7jb-ZHfL)9A*)e7CT(w9Je9^FqhZG=YE zC}JaqRn8ZtBs@#38fF>eG_S9zgGsGNCu?m*lJ$V#1Q#-AVCTRK&#%OyVQe)2;F*a?+p^!457z(3P zeND8w9k1uwXuwR@Xl%0;>Z!F;*Z4c^F;ltnl%{UHed#3gSDzg z*nz^3({9g;&Y&2z#X7OjJ6fuv>oI$BC^3V2T?^U_)wHJGsW?@`6X#%5o1$z&Qzxd2 z*!-5d_SS0JhC`Zxjw7JWfP!^+k6c?{-BOP%>`}UZKUhrPD4Z#V=^1hLj+-HL9gf5b zXMJIkuuOM6xKmV{X6Br3oM`iU z8yTBi^pLtb+s9GN_F>-NXr@7%v?oazwpz{NXpP8IUmQ7>~)o z_)G@I7n4}dXJjI=ZUatfV_M`?xD@XW5N1k3hIzCmGjx8QszJ51G*oX!wWFWYlDI&N zR-3`OrLLxlKZ0N|)8fTQSw%qop7nBZj`#T0Fb-P~#<2$5yPk>5xbQZS z7NJIsDVP;6h6}rEvv--rWpf?0F^R=uklG}+pT4pg>sN1%a%yz^{pM$C*4)fS^YQ4T zWuvW&=@>2T+>n{4$jTbeUT}&yjGmbEIWtzTM=x*2QpX6BN1(U?%v;2A9K}?1EiD-T zvDoR?g36--?Fyjo#%o%TJXVrfo!K!QV`C7f4!iJXp=>0;MomO#2)CISlx;Q-&=fCL zou)@|-eW8V4J@9+wX4OnN$i1_-Gq!HhQ&_7GPCw=IN)vz0)R63@E^Ru9oVJcDr#P zwOOnjdp1Wu!HN?r6Z@x3FcPj>DA(LI9W@YRrrV&7;+omjsRxrVoy6E(KxN z6)#uzaRoASwoS_orcE$K&D!?Hb+M66mIE{_bA!m`KAVQC#D+R^D}nQ@?Zr_WO1mDn z6>C~>CNb`hnxeGxX&9qn_pr6**1GoECVPUF?toqrYZOz#Em$-+U|r|jS(8L6pnQOYp!l!`)!W$Zm))m^(Oq-&gg5_-?fUjx=g_1m66t7mdnz;zInr`oCA0_ zRa4!Y~+lpH;O@SX|ldh%$&_qC%=S@MvzK%?Pxr359d!f`03^msJiM)l-k$aNBA( zC(HnIj_IDPH8bbdRik$Z6}3BysSi%? zlLb~R=CyTn)oKpf_V8@msi_P;)i6U!{L>9~BDRgAN`F^}#c}0NyTj8Vu5~e_sM_}R z>rvVD&2{Xle1L=)Tn{ZE1H^zw+M4QpB4E%WGSE+kkpkj!)M*&m{9YniWM zH#9Y^!y`R=h&JlVXf0N4M(K9@N0BDDxuKnFb>pX8o8}mfbqIQeIa%F=)*=sc?zY^5 zn*0XDGY?hRckzU1%^KWs*r{RLGC830^gmI+U=$;atT@`PGqX%=VgI#nwa~v>HsHXE zC|0BRbu4NS^#QxI?{u*mFeX!H?)%LGyrvo>PCXU{Q9foeH&(nCV%@`_S~!_)tjB$# z-5>Gf5GPpUAI~0f`&ZkvURsgQmSSU(v@APmbM;32u9or59cp}II1`Ta+p- zR)t!a-WP9Rt@V6Pgu$(;9S2@x(#0CGt)<>H7N*02f&E2C{(~mqsi-dVU5*;hkV^@=%hY34Yq5+zs2Ask- z^Jb))3k|+3fU$D|Tdy{lC$oHj(5Te^FTdo^I~^YinDfe&g^w>(K0XXMU3mk(Jij%> zH4NVo1+6642yAScitTVmT4`3gYmAj?jkkh`%_9ih3VWw+8J5T|%Od!9E`G#NFl^** zYp3fK z9yTQGzxaVfd^&z8@jsEz4=Iip58sybU;NObU|4Xsb&YF>-tJcX*u%N_@kLx1#0}Ji zA7vB_8^^R)>#N*5Jy&|K@a^z#A5t(Z=WBj^1cIG(@ePh;{cG4z0;2PqKff_H2!O-*f6+FN6?@Dayk%((5FCNtFvtXW$BKM;GIZ%gpa4BqcyN#++w-Uaj~c=fmi zo(%5-PpVg^@AnLWZ;ZFllT_>(S_W#HC&gRh8DY2!JrjY`7kEZ3@C;wz844K)OL)>V z>~fE{7?HMlPN3ZVILP5Amu-VoJ#N2ev>vj+gPj7^eovNOv)|)glE1&q>9Mbm-Cro{?UCH?{}MhVW5dy$Os8&nQ8!cY*gRPl8U^2Hm~- z`AfG!d;KV)pMdD7nHMho*pNxyD?P5Cc*gw{m0}lnCh+719+$VmGg)5*Pq`SUdW=$WD8)<;?f_JfJECLfybBq)~Q_U>)j4oY> za&LtOcB8S5QCTDOKUjDq-3EHUp&;x-Yn#Wb@4Iw?ejULRjxF(ug;3}w2uaWvLV$*8 z3`d48?`NLjXL($UJi#YCVK5S*f%kGx=9M0OsmJAi$g6uV*{^SRQQtDp=(A`UiI>wL ze8rw*B#12V__lq_LZO|K#KuI+{rZ(lwz1M4a_#r(UtKb|(%#TCcO9@y;g44tP~BSS z!W0x|PLH~n@^i2L1u{s{Pr6{j3k-qWUSV!OxCEx`MF=%#xpsK-<{7J>!?7BA9QuhdQLkRUAH9F# zHrOfbdCLN*uRqfZ7J9U4w_xUp%;Yw_=|)Z{P|h?Y3pz4Ouvg2MzS=i}$n3Z*%(}@C?-xKSq(3 zVg%I_kr{nR^A(~Xf2K*l9FZ63KVG~|-{aoznFQ-cJPy;_QTGcxGti#tKn$#YZ;@BO zfuugK{vMKM>ZRK}!}So9$orp)Tq0o?5Lm)44^Yr?*KYM{bT?=TzzK%Jwn|+fDWlIL7VS}jZ*3ARnWKfD>z0y06O+j zY^M4L=q+3jnaihs1DXfc*jIwO3-m`0sYa-qK{xcr52+Or7vCad?jEmPC@=lk|HIH9 zB0fLZ#cq;@egpI(__;V{{AWO40Y6vBq<;kZ5%{^@B>gR5AO0r^4d}l#*9UQzR{VT8 zcA+(51bkWzA4FrH*|-b4W5iL6kF8$fE{*nzzqHDXClMc;CB$7?@#Fm1rA;Z~X?)rp zcWE^(j$-~Z)CqC+6GSMsJMF(nKNVL6q(`Ctc<~-#gi9;Wpzxnd+wuN@yA|9g;asPW zK>2?v^0}rSf%4sJi&J+4N1*%@Bt6;8?|jLR_X8tbBXD#ML+p#;@ik8Rw}Zl`4k}Om zAo0uuH*qrHDFBzv|(+whMo;XQ4 z>`Rmr1nLxg=T2m2;N{4{u4m?QXx#i1fx+~(#2NN6pZutv<)J)tIq~tWemNK!)1faB z@lCl9e-ib9nXM&49{cW5>0#FVaGrW!3)D_GaO9&in{de4De*X_=&(|qMCV4%i60TY zA@4DSXMD}pn|g5UVLCr?aJsR)SHtEIXcsh@L2eL0`fL*ebYL@G`-x1+N#pMeuIH?+ZR8 zXxbZk{!Hi>1b-{|2f?=m-xvHu@C(5sf*#rdIBybUMRRx@Djnx1&tje-PeV_QSe)WcM5(-@cV)f2|h0P zGr^|?e<{cvm#Ek81>X|v6?{+duY#Wm@<=bKF3@fM8HCBxuGRgmb=Qya|HYf-?kX3+4*W z7c3F15L_;JzF@831%l0j8w9rqZWH7dOVnex;0=Pe3U&(KEBJumj|9zliS*A1{i5J2 zg0BnyN$`;1`+^?{{$21(LEOz4z5Ig11XBcY{FDig2#yz=BsfiQmY^BGp=W{63k1sr zd1NB%VTIr-!S#aef)@*#@gMQ86ndB7^@6tu?iIXO@cV)f3-UgI`EtEXWiv`U*n1y;1dY9n!g0~3n6}(6Ae!(9K{#fuy!CweIFZdh5-wFPSn1)>% zh5m$?snkD&c5$8s?ImWRzJyK{IwJHqp{EEvUFf-jJTjB%mq_^8Le~n-!!#Lg=6B?` zQRr zDfk0H9_GpXUJ&H5o}}LqP;iXkBtahj$#_MAO9g8MTLe15zG{vA~;8|Sa7M}m4Y`2-Y)n(!5<4A6nt6mPlA6I{I}o`+)}fANrD-I69i8e zY!&2zr;Pug;Linl<|+BF3%(=xg`f)yScVT5%n&?T@KnKk!E(X#1TPTeDXEmRUGO@= zI|T0+d`$3Z!B+(P1pgxVg`fv7)f^P}_S?~)%-!MBJ&u3-&69uOV&J|oFc&=c*;6}k6g4YZ3+*ZnaQ1D5?Ukd&~ z@O{C53G#GTrW-AoEjU-OT(DZOMeuUL8wBqWd{ppR!Pf=f6a1%OLeS1PLvXU-nSy14 zD+MnU+$MOv;N60c2tFhDd%?qkUkC=UODoGeQgFQB48eJV<$~u6HV9rMxKr?(f_Dr4 zNbrE*uLa){d{^*OK^{>{eTECB362+>E|@F0NbnrNHG*w|TLpIueoOE^!AAuT3ce!P zCHSGBE7{g7QIH4QQqS>%(*<({7YUv#STDFyaEIXaf_Dl&DEOq{F9rV~_%}fhp3N}- zVS=Ls%~84F&lLJB!BW8%!LJM6B6zRh!-78-d`a+6f*%Nu#WNx1KT+^B!2-d>g69ja z6Wk=YL+~4ddj%g5d|dDu!QTpY3F4?4+fD>C1Wy(`RWM($T<|=>3j{X`ZWp{x@D9NT z1RoLnx!`XE-xPdL@b7|rX2kjl3XT?>D0rG+f#7069u38G>jXCm?hyQj;9kK81fLLm zQSePco?%IOUkWDT85Zdb!AXL11WN>02sQ}v&@!gGR`52#2LzuGd|B`_!6Sl+SnDx; zn&3%-GX?Vn7YjxO*9%@Oc$MHyg7*kMB>0rzZv@{G{IejBm!cj%JXj*83Z5u9RdBB0 zBEfS7>jgIo?hw3QkSC^5?t_9)3jSK~ZNZNOzY^rJO-z?5I7M)dV6os*!5YD4!Ak_M z7Q9LD9>GTid5915c~S5Wg6{}^BFG=KFy2tXbitDZX9(sAmI|IP*eH0Z;5C9b3*IC6 zq##d3Vt&6B>=OKoU=p5TGCW=IB*7Vid4i>a=L)VByiD+M!2^QN3BD@WCHR5h=YnoL zD`oyXjE0yYI6-iRAdi<}c!?knG$LIqc$wf8g1ZH86}(sQDZ%FiUlM#%@UY;gf_#C+ zd=dpm3T6pT6PznpB6zmoYQbHCHwfM)c%R_If(Ha&6ntIqkl;sxUkdsowtgvs5y44< zvjhtS%LP{mt`%$(yjt)&!CM6H5&WUxvx2`C{GDKr;J*dkV{QG03Z@J4cnH?(48cyp z?+899_!Gh33BD!xj^HPPe2`6fiv+6#R|u{Z+$`83xKr>3!FvQB5qv`Mpx{e_Zwm4R z7Uml`(Z*E448d`NzHxSVSa7LeRIovCv)~@VR|MY@d|&V%f;(g`^VdIQ;Cq5C3w0ZkLV@8 zMzEfUv|9wfE_k!xJw%M54+_1X2)%wP^oxSO7yciGen;r{h5k&CuV|UxO+>!Kg-#ZF zjL?}vPbDJ%Vj}APJfUj^FB1Hw;N60c3I39Ze0qr(dwGN|-yaQ`0E8YR1V;%@5}YZ> zvu_!HiQqcHYXt8gLjHciX9a&N__pAm1^*$aPqxzy7v#G^%E=O(COB8Hf{3wkh0tq> z(7!?GO@iBnzfx6D4LheSP zFBkesp>HCh-8zNOGq;)kVIsz=UkLw2!Pf+PB>ZE+&xy$2bBc{TW`p!-!5Ku1NoNYZ zfC#-xg+52<^M$@Z=tiM068ci1cN3xaO~UUK{I1}SiOBC)f(jSy)Gg>2#N!IX$Fk9s z8zyKlB8V&uokN7Y8G^F}=LqHs76=vzmIy8^o7K0QRpzuOCh+zcNO@-8Prj>@jBTh+cMTD@u&zeXJVQ9w37>QUL)HzPZ*Vo`S8 zCTzoEc-jA(U-+B!l=Qz#RT4EHu|}i+yJW{v_Neb9*r^o%_ohp?1xhtyk=?bj?ma$N8q?Satj#K7)v9{of)DYPbLJ{X|UWe~842 zFy%PTXC-1!_)l>8+K}iP` zZcTf2i~Zf*F}CPBR@sj6>5YkID))GSgAB^_i~-*b#Y7w@OzNkpCiXjhS_(clRoShZ z*AvIpW}mLcRcFtl?=<>OrEls?v8wEuhPvA9;lWket1oFrh<${%@;TLw09%-1*vJq-V-f3CaQ6BFoOP%ubpoEMky}#4V^f2 z5970QVQ4oOhH3m(5$^9Zc=+qrj|VqVKgQwZ$m4Ha;^n1u#L7#)qaS}mhp7Ga9DzLk?$5a#dHl^? zyu5K8_HR(BUjqIedEJBbn}y1tevHG*k;mW0#LHXJ5z`N^UHawmHyiQ#F9`0(lX{V7=h6 ze7`*YCIa&M^=p7(vtAg77xU$nJxJbd9WnjzSi4`|U4!bS4f31=b|}Y@cgLXeJ^*=+ zU4`Q0wGXPlLog`n$2hzkc^3|n_hv^-zmXD;>AWaxeEod@d3(TjE=QgVk>cy`gN~Ry zEb02o`#bpK>u(D(VLpt*%aQjA{PFU>?1;(3lCWQ1J^b$fMm+UIhP)$8?Vk>X$i4#C5Q9Ir1JJ z)Gy~i-ULLVyiEK%@-DUI_1hocZ8IOn;pND?Xpp?xIQ_;+Jf`Cso9ax%Kd%DFL2w*fEx|y*-%&W16V{A)@%7TSRjFJAvK%MjpZYOh#&^=dt4=@%YJyEVmlM`# zm)Bvd-FPSS9`5U$%ZYcvpz=Pv4M#)b9)kJe_Ow6WbCJMFLm3&SoC9GI`Ix)h;wN{JC_shGm+=;&unpg zHZmSB{!}u&qE}S2@;R}3j1I*x3^{2WH(KT z@X9f+?bv?XJ$1$m!<;z{r-~Wh%D`oXCG+hsTkUKt^ejhDat<6cd=K?vubYI>kItI> zUgV`kJ?`MHK9$?qz5E+{`&{Ln-PX#^?jd{jzN^$NeHm(3pIdcye|6-@pYar`7u66@ z&7IwEC%xMDoOMHAf?C{*?uDVPymte_S{~fqgW|rgR(AHH+TJJ4un@woO}e4as}}Po zYF8_@wd){gOLcU4Re3jlE-=xrcJ+9Jo!!Zi&R&yWu(MYo|53qTAzo+i6G?mf+>y?1 zPY!epe!a`YS=rTlHu7;tb|K%+?x9G-a3_p;FUIY)>geo79i!*p+D9JjJK$I4UC&wD z`wpTUe&}%!el$z^+t#an9>h;TJeYdGDZhVZXZM-N>s5riRInFAL;60XwN!I2(!CIY zelFF ze--j`RY&iu(Cq}|?NQ6SF*gLRrOwTTT`UW1D{#Qn<+AQX6!5ml-adtTa7FAoI&k53 z+!L6o_o$`B7eq$2|x6o!@)oDdu z+U5G_$|wD%zB@X5?>%zl{c*v)roAZ7sf&-mFM*=_V3Z^Ae*>(r1OJ?ddF}gwuj8Y# z$?s*r9zVSS`j>Zh>wVBQ7c!b-_Bayu@H^|Zz98y97xizcw%#)Q4EImqxe>O)y0Pz2 z^=p00x87*#-Gj3EllJr_j@^TDUDxGL>gZFEyLuAGcJ#fCG#=CebV%<}H}<)P1bZ>` z2E55TyIeyK^!BJ7ecRO!jT{(G0C7=fQ&-(H)E>i!EgSw9Xsa2)tvxd!2eys>&fXbF z->qKjJAe~+UHdxFPi(t9K_%b>-tykl(GM)td(RZud1q&Dk{SWIus773ucNb@@m$SU zcWIT|69^WupY&pmzM67ax2*G}u!)r@vp;87Ps+YseTmJx`WjH)VD7HI4wktY_J=$a z`gj4*U%spFv?Eix+4fd$XENKi5Hb|vvyW{_Mjy-R?A~-D+7Nv#W-DF2Uo-X>%eyCd zBkiC!7}?s}6WP%>9gm@Xs3T09=|T0BsXxkxO~3zk(rczp{E@sKttxs^Zxh|>Tw)*# z;Q^J~b)u2KxOc3yhwAF=WjlkP9zh>qd$`rYogfF5jw43`7U~H11N*hwhVgl~(YxpX(yLBv?14(|x|?H{aDcCv{mlPaXOU`V<*^+}*bh{m+jvk~*cLya{My z(`TW_l}C;&NJJTxsz^rL1?;|H*SA;i?AjjO(>EiCzEIxL$Mj6c_}%-S?#tbGO)t`+ zZEj3;1%koi{uLC)-Wz?0<`FdAy zcvH9U!t3A7%}MC#bir1VI=ee`XZPhfS9W(apNM)FY(W7--BK= zPOiW>sd78JANF9ZRGh2#^etERTz%-mS26zG(C4%-+teAuF|PLBmdd`(G}rYlm$4k} zYORQ~?;N$gX9DES0*(Xb0wch3;2dD-@a;W0Kp*U5VZd+hxi{4c4eyI+btgSq6yF5Crl zS!z$W$5MeAXy@MGtBA+3cyaHLeH}gQPZ);+eUVrD685kyD|+Xm-6k~O-uIGvwp*)R z_yo7JwHRC4ofxZ(YZ+GsV z!x$TS-MLpB#ym269P)`E?BG*3_o>dCkoKlN%eCilBF5h#!IGXJ>LUSVcjxXp?C;#w zm$GM9-+?l8;eG2;;WEXsp%<$acse&)qIEZC>J`6i@4 zr>igLVBfHuXS=M(H+tqUJm=dzAE8VK$KKrM>4dG7vrgu94T^(KfSIattf)y%X!b z*RVeIbaZwHP~P0m+fnDmT^%Z^S9M;EUUW`xJ9ImMI-%VKg7%pF8rF3k7`vf&dO|bj zU-driu0vhfQ;v3{9R?!b=qf^+(GFjj^6f4wnAuf=cEmcidj-~D9A`SF-q1HA(%H*# zrX=aQzAB{cqikzsm$J5Y6+v$|Z5CzV+|07LgR%aA+olCYXuA^V-K)6PEXUeF&3*^A zU}24cI_}1Er*zh7Zshj9f*iYUb#QE#OGWJdf$;mr?nS@5rVDH8UdOfqogH2A{YmF= zjh)#QKs~Zwaee5^Q98aqF5>zb^})KxMVm!AJ3%P6?&WR(rhKKz+<2-G-PaW)g2jxT^_Phf>`xeJ8t}S3t`vYnj$KC+@ zWFT@@*U#tDh6ne{E|X6t;_<$OcJSU;v9ZJGqkh|U=&K{MX=iF>XYbq92ce5ChqBqf zY4cV&=XBa!dGAAC9SN{K**?S3rfMbH3jfrv+^ln(QI@^$-v8B+7kFR5w7fUKt%bh# zt0V7IuEO|%wWs+vV@P>d@9hZN=fS|irenM2?0oXDkrCO`XXSRG ztQEZpnER16)=GAG3d%O1olHDC4DD#HeV1?VP|%HfS*P22@xDdveDXOXALX_bcBInYZ!m%lts_|t?U4ytttU^4$X;y` zv(qT|l8t0%X9ptoRor$`YXsZX)vc*+h_p3DYMUa}jS;@lFdHjJaCgmf79vfnofK_r z>mtssnGxrG&g{tQ`c09|*wZt@z5N4f;=~BHGHhyz)Hj;_%_H2#EP~gDk-AOTg_2qz zH*Vb-Ft20HzREET84xkM|Jl2z8nwxs9cgdmew|Fc-b7$Y11hU^cBHkvwYk2g9vk^Z zu%#n%Zi{5qPKvaf!&ywM{&K0t_J#(ivl?|&d$O&9DKO=)Ys9wUri>_eb4_GQWMgx{ zK2896wyuk;scXbJ4BY-T!Z&SoCH|AaG>4oF*o=Q@ zAm2WrVsaJsmYp5RYK?I!cmU1p$g0hF;cDbfrqC&Lh6aWP%v(KxovVGQ2C8^%bvriZ zgI;zcKv8a1i9P)y+($0bx~?sPY!Gfg19Aa*!IsT4IE))yc$)px0OsPe7K|+f-jZ6X zsvOX4d+jI#6YyayCN#oI<6T+{c+U2|2>2BLE_I1}7P4)_KmEi#_-8_h9%sZaMnrRQ ze>ca^dtj{h2@#WE31NcqE~m&DChd}#mP?$Zj+h)U?6Ul~SaVEf<%AW+yNtl{ph^e_ zO}@*R*>aQbGBC~MWYz`hBm5%)frYn}QIsPXyi8kV(k@4sxtz3&%=>@DB1DYWly`>B zC9uqvTG|ZgFy3;4U6~aGJD+kwj-5{|%W~#S&0Q*IFR|Ha#Af}RFx81q1wmX**csU6sz|WFum8AC4V>j731eVkAS<;vAZ>e*fk{UjX zY`4`pgj)O?KJ#NS4MERJQ?hdiERx~J%65)ZHp6d5gzcuxiwQRy?>U6WY%bwNn@f1f z<`V4oJ;xOA7-gj0JLRI^DGUA7zXAXB6K!KV-zf>%EXeElx77IrlmgzRgq6m7K7plT zWTM@2OP$h@9c#Mt|F2rcs}`Sge0GELxEYN5@QKT6nze`9_0e2RZ)MM#7M z!>6afNG;EWsE84Dl%-`L$zhZFT!Jm=Y)6o#&ZU^cMx(O{n^1EYv7oWJoRU(Eox@T6 zwHZNM@b6U>*SjmPNBV(Di;w}wbv#PE-c8S|_;(`HPt!Gl^n4T-NIydC$crHv{zOAB zyWS0&{f>p)4gf2}S#U_9J&z~o5}HyCgfqJIwlJ<1fO177xdJj1-+ zP0xM!$HQHdKm8BjpK+<4Tuz-i>N~+uZm{+#j>7ctHy2(O1+wTL=L8;0FeAVs1_ynK zf-;?@@TSGS9CaF?pxwIV1iLklYG^;qCnRpbs`>HSH{4yF+Sqay3&9c!}M-?>=jHoeCBc*k_6*Idjjiopo&(K zl{GBcqlX2_kvGjt)5DNU!bxex$#e0HInkqBVVlL+ zLuU*ihs}TjjLxv(0U?qwo&*z&M7;k;ijlEMBd*$JSyPi4CHd-Y7Q(KZhqY1)*ve+7 zW@EEL7L+Q?Nuv@Wk5M(8jF1G6T?r$HBDdmX60=aOv^WxlPLGiZ2}2VS6J~)qDg-gM zDrlbZM&@WEQz~{$Dk_m5_?^%n6UibLxJr#3iv*`3t4!8Y~k1UXE@){^}VHC-CY!&aCv+BC-q@A8DRJ~01ZTEmX}Z!>Nqi3<^wi>oH?9Obs=dh};x>jaRN z#`{j?(&OQ3jmPF#R?ma$(G_sL%6%9yeQuNdc7|FBF5Li+(%fIl(!1fhZ1I0I;Ylw2 zJrjO_;daPu4ENZr)1yB!A>8rF(wxy*$-mbpABmo*oLN^3x zAS|*51VKe5B!MJ^BqTvV8JiFSWC$c?VNsN@gDdX4;;u6~qT+@+f-5fLh~ntDj0rJ{ z&Zvz0HuAo&?z!Ea0P}zE_ulJYQeT}@bx)nDI(2I4zW4H*51+aSpC&$CHUIS5nLDug}M0|_vARmr=1K{e8$Nzl>(nST=6+3Bh(oPN2+rXj#4)x%uvrG z9IZY^I7ac=Bgd5r)*O2z#oJ5cX1EB1}^zzK86s_>hb~YAC|K>STmr zRfw>kT7Kb4KpQu7ev zf!qka>VAYiwHu*d@mt*l<-$~)sKN-7)F}u%sWT9ERx1&9QCA`isD}}DRqr9}ranX1 zUHPFvvg(I0MU6+8s-`3Cp%x(ws`C(r)HMiu8Xnz;t|h7JP0)t=456uhL+Dc7@OuxX zh9N{JBeWDB_TW*=5qj0t2z}~L2>t2}gbC_fgo&ybJX?|)kFb-PhOo0*fUt{dKp0Sb z{6bfC55jKhEri|Gmk5(pmt^Y7hbW|~T!cMT6~dt1o)*5GcbngtY6Wd zLa5Xe2;J%xgqC_Ap-26Q(5nI|)NukrzbZqRpsEojsw)sCsap|tQhN|~R&5Bos9zBV z3@_W{a+c}(LSfQHVFM7l)Nu0Dc!WMR31L9xBMhsV2q&p|2%F&A2rgAmaH};0pV|UQ zv@6302)JF(c2T#2XQ&+rO|=K1OTCLwsZSAFiqA9fC<~drswYC98jaAexSpD%79vDh z=WDR#R^ulEZgZ?lJp?9<4xy=95W3WV5GvIfGpk$mL1?Kl2t6tnp;yg9=u>AS^s5aB z6V&wx6V)9ElhmIOqLC1W)msSrsV@=sSANWa1Jn?N>59(~7^wKq}kHoQ*3vUMn`;j~!9wTWq$nE_}nh=n*4Wuhfl1&5aNt(OCTi!k?v-(s{u6D?fQJByIJaL1h+(Uc{gjb&Si6% zmuZ)|jcyZ>mVt6bLNX=H1Kq6x^<9x`-e1d9t?H^a38w3egkm?qVl zE@8Tnau!$;ujSN z-Unhav;C@q!N_QsP~%8R8{kedLrG%|<2FojX1Y6IhI)eXvgCny%}i(vs8(J#$c@*{%mBrwIhf)Gx%%$_4aX_*nUQs4b%&zD9BV;&fNz?k6VCT)n^wC&Fhe(j()uiQH=CgcL9OV5v>NxvX6QwSs&#*2 zhW0zu+3tg=qeIoXKgWxJV4?cDdiTG~PCl6Y zPZNVufgq+aNkZIO?Y|rBGkW)4^g~WYvWSgYGvCfiilZ2bRy3krG^m2wT%N8tuc1 z^D5UE+)CE}BIfai&vGs^jow4x877$_72Jok9GYHlxVC?T;3Q)9Q|=%d#wPm1&z(L} zhyf}oc<~s+b}~cZ^lk<*KLyteQ^~>4`$@Lp@PKzAMceoYc)(pCwCGVP9DEJLPiQGK zN2Lef1;MGxoTi2ZTR{ANFo+^GJa`C%9;P$Y*x=6~*b!!lnh^9ueQo$Zx#b$_eCT9-wRPSsvlm|*X?bEz-%}}D#YLmS4 z%uqLn%JeQUL%khpvUjl=>fhfm&V+vE6mPW|8j3VM4@~venxRQf&Z*u8GZgKKT<=OV zRN>^z^RABb@P*zccw?mLxuD3q!3NuoG3Pw*9cJhwP`Xpgz4w@*?_<<`W~kFBtnrw0nRka7 zngUAOLcJFrel958mkr*>&Cnu;YV^Xx*MZWVzTCUp46Sph72fB~(4`Kw(!19TT?b0b zJjeT*8M@a=TkVC1-|0~2L| zg3%p}>m9}gU~~gxqjSlHU~~oJDu;0q7y&TubQl+d(FKf09L6PJbOz%^hjA$woxs44 z{On@4fsq8prw-#XFcQJ|$zfa$MgkZ;u-4R?UIB(54BS_1Gp+=~2S&ETxC#s}7-u?+ zTfp#uQSLCdgJFSDi<3Y?J@uMpcss>^25?lvep+-=AcAwSPsnj$TS`X@V zQXW;17`n`%ys9uU#08A@jXqVJ7`g^&n!@=-V(3m#+T$gt*@>ZtLH(UlI;pvdp?#pV zVFc7UiJ{pJ)m5FFXy_HpK(NeaSGW?F=+(oSM(?x0^O>!#;E9OnT78VlyD$gdPQh3L z1*4Kaae4F_N*D4e?u+Qf@lu2ftrhM`0Iw^|G?A_2gSbk;9Mp?*?N(+zD@?1`dHNXs z&mp151oU(`*$i7jKVqlT0Qy-*s4IvH68$a145d0r11zI!sFy>fTShlMdFsmsT1NNK zFr?M;x1-awncgE1m}XX4mTOE3obf(s5w1V3^ab`+|P}p}j$&wIldwjCe4( zJ4QSdd_G1z9NZTpb_V|*BOVDh$B0LbFqf&iVohZQzo)3ffJH#H(KY}kh#Iv4{g0DKn zbDrklKOEwDPs`x%Ksxp{EnKuO;Vx>NJuo(}yo=%nVs!yWn+ z(2321Pju*4K_@g1p5oB2f%Z2Kp5@Sg0qtuZT;VFZgc3jK^x73zjNrnf$sb9VAzD+ z9`Ate^Rb~fWW{I{@5nGaM_anvh{Z29{5%%yVPbW9k7;gD!6Jyz=NX%@<(cmgn^jXN zdKhz+g3F1n?5|dsSoqvHy|TYXjm60dDBcEdUaK(8{4!W(i|f=xxGGTkWaWB=Nrw(d zQ#Yt=Gh_`B7jToxHA4YVdewi6DlkLqLH*2i_jXlmhOPpoPh@UYWmxMv)NN`uR_~zn z{@`{s*9<)d${ogacdB`2=#t?=-K7?op_@Q)@-**Ni_Oq|pteJE^FDmp7b?efdVlaI zRcnU6Mw)g`I}~;qzk#yHlv){gBJ+q^4GPOGo%2!Eghh@+J*GC8p+OGyxY}ZdG92m& zb&(mG=uo@VHZxS{P*18Wv5#@6r_{A(hzmMh!n5i|ENdLpIYVh7Wf3Ew1Z9_Z}X60QuPst{W3Z1fOw;n-WF_Uk9O;yd@zc z_%R4>KV5&oeOvw{#L~JV=*?|sz*Ui;7izi|_$_ykhlQG`L^C)e&$STE(903JC?UxR z)6jJ{yA1z4%B-Z!Mht;8*JqyCm7imF=?U&DNOpbUaR*NX!I{GKZ;vlnu4*sj|w`?!az%hWcsWhzy(1D1maEr9kj z+3yeI;3pZuCJaYk)_`*X6MQ$NKLbJRAm1%U`b$pyR(CoZgC^*^-IvZ~&3ff}J%aDv}@j|@*=0=|wvmXY3yYb%-O3H078P$2EEti^i>QjyI!c7P9%=KR)3KMA}$ zS?>4l^en_R|3_c?3@83`QaYchsQJGJ(ibECAoKs096THGR~a|VV2}@3{3i*QnHJmx z;ujKbGaS4OL{~PE$4n322x1TkpE)FWABgcJ63pSjXF*IQk%SWj|6ib=-Q(P982%3t z_Bx2*1Z49~888Y^=6fpE8qXN9e%#|uKj^f~^S)R=zL*s2$Gw5{H_;bvG_dcLA8p-tkqk?V}1R0M*8L8>%M+xZ2E(U>puPag!Ctz z_VFSL*sBe}bI{C} zH{eM?lCLiPd#92O_zE37PFcR??(}lR|H=4Dm_iRkdU5YJmlqcdC?oiOpKbwl2}=!K z`z&5i<2L-ch@?&DRkIP~GW*QlCjtV#E@rS3B3Cmjeijr=1@T7`-A#8e4B{~oDW)$t z6a<%~z8+?h;lBYfyEmy~Dg(p61K|*fKh-|NKIUSx82-N@nnwTUZ*G^z@E-!*>lXwM zp)6m?fV&93iu8p*U9n2LVrlHYMW|RmMA8N!=rtO_^~^rI_l1BYUr#f*43YWFil5B} zSAbYSq7N#z7Q}iIVeH`jix9Kx!X{2-VE9*qIYi=H+GmK>rPn=3ISgUGlLmZ6@U2h( z5UBfqqY?8Bo83mQ{m45JM&mnWzzBkGbvpMxT-f@~H`4n%w$+5ZcewDi9T;l5--7-0 z3LrR#7fl+#=eQ>ME=Vs1YWuqg4{LMcm$=gxBCgG5o6m6127#|t^KiLcLu!^f2c+RY z3*m9MA%id6s}^xL4AfUN;45(4zAMr{1L}HQg}hwd4oSTMq3%TK$?c%iIF9{)(CPNT zeiZT8K(`&b-Scm>PiX@wl0HXtsQ*wjoh2E5?hA*cQfhpuso>i3qxu+ro<+xHHT)Bq zi|wPeHv9#oXCbiZUi;9(Z=l9%xt}v`uR0`+qhG$xzk*qHL+PS#;6*&?N!1iaJQkAdyl>ah#e zU%zs7nyRP9$CZ>9H#LTt?9AeWFxegVK34U8tevQ4w$ZO zU5(&zAoN#9mvu$KtYL_GpK%RmrNYeT2t60^5l#3G!M_o)-VY!aG+$SG&7r?#eFF=^ zo59sP$$j`{YCpv_!T1Wfa9t_dxv>uq6<6I==&A8 znPZW1vETnK;v=cra0Y(-MAk^-mk^^WPC$nL*oMF+%rH`_!7|Hyx~p_s=@^x;%_`-5 zUUPmRn!!l9hLY43`QqD_ z{X>EVQm_4lUh4D%5+5Y_It6!rgwen7vQB)H-JeOmN}-+B;@X!;zCtJ4`E5pD*4Mnw zqW0=vIdt;K?-;bS<3D1i_soEaJ^w+*pD`b&=37vw+4%3&2B9A^;T!I^i~w(!nTQB~ z?QjkG`+DP4+!(uQ2!<7|L~o)f(>KnXc{x}ooR0EtLd58H0sP8AMEGllM$pMV!X|?o^ERxW$Iub_2nD8#`W1CwKOC#k6QcL2DPrC@3jFA$6 z0k|&c#zs%o!#QS?C-!C9pHlb@sCg2PeL?W#_aq)YN`i6XIOcjXg%Tv!lXkADb^^a2 zJ&Bg&dMbrqlb+-X>o^a9jS~x*>DKtGZ%xr(#-2>|4x%s3-?bo*J5&E8XX4rD9c`tV zE}H2n>axAYf7q)zt~1fCr{0G2{wIRYbJ3q1I zwCq!JPz4vSo$6u>oq7@IVR7_JpvRD&;-d1WPD3VE(xHnWRQ~|SmUsLl<{hkf&(87V z8UN80MttlW=4Mm#v0(LLWH(e8jEF7N2kBbqzg>PuXd|-PLirf;AceY=d(u^4XX*>d=8YISX^3)7 zdeBMg_S^_KH(cTTAc&U7q2$mU5U<72%>O}*)&@Bn6`gF(SPkg*Hqx6B;q~WY`E8a4 zwH=qZR)IG|p?*fUuaRlCm^VjI0_KYkG(CgAKT4($-f+|HUTDL6RBUbRpAK=1oFhZw zHI9inxcVR>P=R-;0OkU;&@G7YDhLI8Hz*^e9NpL;+8}@4d8LtZ1^DLK_J|t?4eShUNV46v9%Om|`cFc#J)5$;)T8A|d4S@| zEUncNuw=0luSKwyQx&rxj1zvJ0VCO&ekfUgUt>|_r z8qf;0Q`AU#p88x8r;lFN>Heg8c7vjcpwD>fv&7aXm?-)z(fY(4$tPoJ+8GOni;&yr z`Xnj18W9?a>(eA7xDEv6x(>oS_r4ia!1Y6y==W5vAG;X(%Lev}>!&X6AbUlhTm0O` z7v${9xz+UxUX$263GO4{x-}_C|D;Q}4JGgbUBc~2?w}hfnz$p$7vxf16L%)TA>ivV zgFnp2uTS(#&k@s~Nsyn5f8L|TVG;k?!u$7f_zju}5bV?xE~ z(I+fCVPOR#^T$?{myatyA)~xPhd5L=)RUU)Ja-Xd=2Fbu_G0G7iJ9w&nLEF+s#?pA z35%fg%JTVDBbJXZHyW4KS1nqGheP1u4MxGN(vs3hVNoPAt1R#IoJdJ#;nW=APM%Yi zQyR&cA>@?2lF~AXmzHIgl;ssp6*8wVJ4R#`O)oCUDa*-r^3EwN%baaLJ%P_p=Tq%- z%gTx)r{|QE<`or2Mn^I_GDf#&j4>8BG}K0WZ3W%g}k~)JOv!0b$H6$ty06(w`nXPs~`^&BXLcUQ&Lh?!iGO0)0Dh|vYe7gaY;^0-cd9Dm(tM8x>w_clNVus zwii~Cla<4!Z>NedBgI9w>BP&?H96{4Qp^AG;#nnmWjSc54uzKHl)%y=$4EU=b8VZG zi?Zjm*FDNcb87>KD3v*^+ zXy|s$D})IZmgQy2u#7c))GUh1in59dj#+L|aZX`rX+fl*C^I{fGrO!L(~*tF&6_eO zl9f|ZR@z>Vqg*4Z{m<86v`i@~neG%q>2w%*Q}VJhIq2J$B-P9;hL*6#%);!_+{|e? zk=&fj?3|9{p{Nk9Y&t7}D$#!wP0Q@i*|CAuA#3T(;^Lx`BU-VzM4B(JFi-o)SOZ6s zvN5nqiaHcDt28f?Rg!~#XoU%w+F0ROigK2+FW_C74RzX2zN{58(oPwh# zWTB;|=0v6!W#=3{LqQST4`sG5X=dRu5}Y1~WtO3RBPBUAX6BW^-4&PQosLRIrsW*b z0FmMx3{N(kHc#>9?feGZ8Kq_COv#*C(9z1WrslQR4vYv~-SoV|Bh8&@rDd3{BH5W` znMYn{r?s2HVqF>M86CSk(tYU3DErvyjvEsbJBk2j{`^0Zfu_#v(CxOz%EN$gY_NTO zb$WJ5QSmX-vvPCL`Q?$ok2bWL^SsZeCg;R>! zYcmynd^+dHc0I3kES}yWZ(Q3Q%db0@==c$FJpY3qDao7_DVg0~1@i0_Mmx>OK87o2 zQf78hafiA@*%3|>M;1~t`xpt)VvdonwL3~0{q>Ozot2wckZr3TIXy2kQk+?GM6=s@ zC|A~Xu|dEQ|1q8xkK5+$Kf&eS694`O*};M69Xi_OxGF$H4vBB`tZYp$}$oGy9dm^7XaB#Ox_n^_vig@=Q)LaW5e(nbeY7{}7` zvx^F&+ObR-8)bP}({kDsq}_Df)g3FEMGM73P**CN56pOlXVLk#SIy25IlW}cocOES z7dIGrlq)J61+=urD1g z9ZB)+OqJqV1>_Ne>>TY{1=)^l1d3|cRA3yXRgT`Rj=JsbhuroeXT?O){jevpCc{+p zn%0?SfmmD2%(5Mh!>2?OBn`!Z{JW!isZblEq1io73Zk7GvLql@?qw zHcar4*k8u!CaGmQwG>OvqbFt;p`+R-qH|?w3bCkmnLXKvQd0_MmgZtTq_@)@(vSsw z?6rzB=jcVa%u{k{R%RiG=xnxRhfQI;a-(z4h$m&}MKB{rCz<&4ywaod9Ua=M?{M2| zhIx=PzAWD2rAtaFoLyYw3K#auwRe0Ql?rm%u`1x8z$qnNHLPE@r6?TTQHt%FJ(w_4pyqLhMi>OPU(hS+ zVOtjrRqf(RRdr6OuCvJuJ7nLHDRqKN4^ z!@j~fga8-LTBq85p`!)Zq!wnOsgSJK&WvOg&BRWK%HU;^k?P9jmDTlZG~54RcS|`@ zax!+h_TZ9qbRw!dGj>p-2Upa}Bo{`uKEQQI=TI(|nQM57h4 zIL??MEl%s)G3a=h2~J{UjAF_vV7M8(IvrS1_aWJ74rn>KKvE?w#*Z;m$QaMES9dt^g=yHwR}dlR9Eim(=9ZG1NvwggM4s-8Bb0W=isK-o^~<6~+hbgY z{?U@`m4#li#3$2F;gHQ))BKmDF-J+`cL0t9L#@!jFLW8W3h9k@g;Ua^$_6g3^qb(T%j+8)?eISBN}Lnc8`L&}yi7y> zT0BfYQd@(dU53V5V_{8gy-|Zo8Vl{$RP%xV3m4d5>@r@z3eVin<%{Z#MyP!J7_yk5rZ%G4py92x*0BUBpLvjER8-g0R~q$|m3T{d zBN|Bxs9DGY_<{f}djbf(m@yVs8TdNh5mz6<%b_b*;%(8HB_)}#BkT|&Wpj#iA`xR5 zcDg#BekHel!vR}?O`+eTzObflsZE_zRcq8XplRw2tQ?m$)Eo7SYwB3MP1V*^SEJqP zRz?=ol~*leEA!ps)m8NkMx*|++$djctf;Rt_+tefU=6x#QNv>J^$!>#RSQ<43Vg!? z`eEV1`bu2s{I0+*j7>QD1Y}yqTy_N!;Y;r8jq-Z?HwapS)VXdYG-6*l7uKz0hv;wq z>niJE2WZ&E3+f^bHA^a&Q3K?xYN#r&j^L%?3+fk_FR4VVesN@ed3_}w##yy2(uhm+ z8!Y&8i^yU$KYrH1N~|cak_y+NQ0+4emVc)s_Ia;rS*$!Hv^lqHGq(Xs2?wFY*;wKwqqE)yQ=Iv;VTU*0P8m((n3l&UwD!7>cEn#M|d?vcHB#1`x1Letij zN0wsxrm<-kURj48LZd9Ia;ABsq8$AgSz5j_!Vc3dpa+D_ud8gV=Ma}{n5@dHt1tmM z3@BKMpRp~dDzB?T5w=f`9R}zc>1yb45ZB5$Lcu_xzcnI_%P=L_Z6po{4%4XStApsG z4Ge$<5!|Uup7ro*I~rKJ652HFzD=lrK$!q zVkW{`ps`^A-o9j1RAR2FudG0O;e5$hIWFTw9YkuE+Q{7GVmwq<+A;bpJBC?)g`V_m z(w-7w#>Q-3F+Ha&wELwlFC-ZSurcr@rsjDtug=WX7rX_I!7Ae=RxURCIhQGmNGOxw&GKxyF zBRDq3iHpv?H1<_9Pm%F6LM$`%K!vwrYudSZaS>P0I@5Hts5S+?nB~$tx&-F50b_wS z`eLydT&*v*zx-u4RxMl=(We3ukD8xuS-rc9WZ|2ax)pY%^uVZVtmP8No>A#)?d7G2 zfUm?9&v~$XDMooM7B*U#d;^QU2#(>P$q`Jx+zQ?vOPi<`R305@Hvo0lQQd>&Mb~0> z4#(J-#EHVLyj}=v39wO}(Q()|6E4_hbITx6tTFY7;w;BpOln^}hif;B?vv=*l-)b} zLNP233f7seZyQ%+3eLadv$RXatXPZrmJSe0NX9GX>qWWEBL)9ij&^p`iZz+^wX+-3 zW*9eVQ*jupqYXP(v+R{6&3GjTRm`&CZ|yI=urh)NiIUM?ig_ow2#a(WUc1Z&X9BFG zYq>Xwo31o%uOuCZRBtRPxA#3jFz3U&Af_!3ZrWHBjy&MZ3*>DQNF;>)L#9=i9 z_sdFYW6~QD%mi2s!7Fl$sh8<1xZuzmP64e7{U)Zm+FCRR#-H6*Mg~PF-7NB z()w|H)lgTn3a;Mi6DJ20;0~*o~TaS@q_ZzpBQ14tp|mAE(>}*!1ctT`Iz%D^afF<0_=*Y@3$tq)qUOip6+eV9c}0 z`hbR|w}V{Vvun5}tgh4>2mDyvUK}-`T1&BsSX76dA9h1E`t^WgxIbS;TdS?FY+O)d zPp~o^FiK*bq8qplOXO;-;;O4_D)h$0{)s-<%b5C?mM=qpA)QN$_{!oC1g{lDnK(44 zoEaQRbdEG%D+7d%2$?$NOn=K54uj%@&IF0W=st%`7OSHY!u z4Swsd_0_BG1qL^^yZ}|T*S0*5kcE0x?eY^i2hhGM%Imm{ioiOA<5)t){0O>_(}%qp z!vd}z3x>u9drN>G;X#0ILA^(?8R(x1Y*K84U4ge>oLgCr(IHgC9xO(M z?dfdKCd0+3s%%&osmJRwQGw-ET*L8 zjPo&At8)FTcX5uw++^AVx~gGmd94_>7Ks&#{*_#0{z5uw+a23>X}bcrQ0+qE&n`G< z*cVREMaM8KjOPH{1>o$5Yg@PwV?pE6rD)u$TG#`QhB!KPKAwlv*1!#lIFR=Ba)8o+ zwJS`237jey4r~cX<|!WSKhm(6dO!XhF0G?9krFV)oZ2QmJ?Kdcj>$4i8g> zML>ibLcNjV-iK|E6-pf^uN76;1=`~e=Yk82Mfk@tBDQ-AYL-eb^5iJyd!%PMC~M1C z;5HuS*Hwz|3}>RzPO`Q^t4qlmV(WwF zcIVqsuJ!}vdLyo{jwZxhsGgIw3#wR*0cg98`eit$U)G>KA51m+y?{LtJF95Dv(V?X z^r3dOIK$T4hZ}nSp?IAVt&yf;ZKnJ9XzvK_*v#6OF2f{>l~l(xEe^|vc8QK92pi6} zmOfp3Rb#0=MZuWsu$yhH)+MVH**Wn<)7TH&7X)Fzc zhIW9)T3U@82$7DnxhkHq8MWG)xYpxN2peIpmbGCl#{L?`8vkEzrp&}mqDDDyWHe0N zCTnEj-pmsXPl7koXZl^8jV^ewLRVKeyip(pFUAPsdG$SAea!wQ-%6!#s^vT7+y>rT zu)1?nC-88eY4pQeMzcGIFEKB0ZB<*`o2^ZrjouBu?9P+g=L_Rj((KOZmzWp2E>K(D zTdd8VP2P>Z4SwVt5|w7({eO&nP1GkCmzTGtW_J!y=0=70E+)sNjn!#BrrGb_kTl-9 z+6g!Jx{Za<+%(N!I(H&aHvY~3t2vf`)1uELMP(b)%}5Ra7@Fs03nJ z!~^GJC|84tGE%=_$*5(RRF_wdI)3Dsk>f_5Fbd!1)z#EAjB2cp$-*tIBd{Q7TseYQ z&4sbo|346Wj5}@rA4r~yO5n)}_(BrHADYMA>pOBWd+aDI?f0=7MF#XS7PhsG4I?X< z8KX|0v?2w!MRTEx7@id1wBTI31?Nf&&gJdPb9qa#zPov@eOL2b>6f`!-(x8S39xOJ z>4-+5_Fe}`c-(~Hb{iIWxD|V>X@wJ9L%Lg@3oN|qX7V~K(WCYl`6QlMlW(1@2@lzu zJnG3c>(mRzIx8jLN?&JX#Y+!`PQg>%j3z@87$>ddyRaLdVI|;k9r-VdgfTF z$fF)w<7+@J^{xT_J!`)9sK49g+`VQU`R{{DR3j-V-|FVsXr-*RyiZ%53aQJN=jU5K zbvd4=t2}sQf=3-Zf1Q=)QO(dM?Ac}E5(Qlnzq3*h#b2sty46nw@-44AJKyR$&2kr5 z9+i}@8uL}+I?FYkLN=jfm--n64@P+&75>^vQr*`v=?xSZR69`MC}?L(4}NQ^4X%R9}ZUPUICM?H;P$+=dq0;_AD)pr_L`6wMic0)-#tNA$-m3{jBU6$LU9yL+> zSI+lMbfsaG$2#Ig)3iJZ%I_Lts_wgZ@lCiGo$;lq^|>5H*+g&F)3@9j2(89w-9nxX zR__8UVFTI#&E#3{QCo0vf=B(J8%*=8lucIhRHWvs&5+gKqkcnT_i5Hp%3(cW&UkK0GzVqwZXdR8TOAxHzPrxXz>gb?z=J37raA32UsxTr0WAN}OVKE4KRN zqMK2YS0^TVnk;VtiZZ}lM`_1EmLXWS@b4@!q(FRHIC?~_)F`fxRvbJwZ# zd}|ynjIDeohJr^8-vxnppn2Tut&r~%t6MIcH8joYjp~N-t$rR@1)^P%!;^=R@Q2m7 z0t3XA|BXkzgvR!J)KjQSpN-aWPg(<@XKyqF47Q8vvd$W)R-h4!tM<1C)1$s{t+UeA!d=$D^;Re3 zP0m;Mod>z-477w&3)p2L-$al4boDNE9bQ|w(eh2RI^#*y2=lCNF#ML)>tIRhRtWCA z*-Al$3oL7@<NPmvWWvI05QAVhLJYCDW;kVmz-^R0=< zWvCm#@RCMMo64t1O7$JI((J|_hyLw9%^H{Ic3EB3OM~*Q9=Oh*?{>3|o|pr5ufc_A z`a`&Ic&_Cuu!0OdY8ylcJ?ba$hpCl_&sdL2BEpgr^6B9^xzbI`JH<*Xv_h(%?#PyN zc3Go6>OXGZM2`E>xh%f-G^>A})qAauqrHo*As8_|QR^fcK0KReE2^;ys?WgS!LUP* z!_y>uYxSccphG#%R3fbzxssrPH$Ok0mGY=-2eCR{b#M+DJwWe*)#j^b%X|}=;8FKm z`5WOj&snE-SoxlxtS%cYH@e_yTHXs#xDUpawayw01A^opo&sx7o|QD!8fu&MP*{>D z*BT0=pKcAEYIP~H{7B5TQZb5kuE}gv&suBpG}xI3RquEUx|*ndGG ztn~o!dakn|*XMc6N+{HW2Th7D9|>2-E=pwD6IS9h%a><|o2l(xkb_S7(1M8|SCI0a zrZK7QNI^YXkkbDfC_@i1&FcG&6-Ku`#U}JzU=7V=<;hfO63F@AKZ0j!S!!y=_PFA<$@}9`3Evgg7`Wfq>KIXlAcpr>S z_}QOUalCFqrUdjUMlNW#%cE`|h7kvDPhPD)EX#KdX*cUU;4!U~gsrFs{2A-M7efl} z{0Usc!NU1nVXiT?!%;}=1EVrMdn{KIX8TpzUB1Kt`NXPqE-c97X0%td>_RPj10?j| z1XfL%l%SG#b;$ouEzXe24Xs^Kl#hKFp`M#Xicoq#f-w7PX@jjm&m* z7h_;My1UV%9o@sY3v{hsB(W4_tO4zo$Isw7vqll-61HB1((uC%l*q;GCNoZ^zjKiS$Odwug4cY^JxZfaM2D%UEu+YmvKZ`gX zw4~F|0{trDcv*#}r+{uo9FHE;^aRiz$am^<)b9m<<6>D=#jb18#Q7<4|o{!)hkl76p4c^fREzdtJ?AR?x52#Y{h(02QWq^p`!w1tTIF}$1gEoyAvh|AUhr!RYku*HRYyuJG%p*dd zy+r8yE)nTvqW1^HlR#519Q?dX%*OT93;e~z({R1$`7sejvH|5YAAKzKevSHc#?vy1 zc%SQjBAnH`M0D^6L_DXp8OZz}3qqY(`{G%gw1u=xJaUYPb}l0hMZXZyPTPR08v=fu zehJ%;G)$Xp`(NhQA1A$E2f9DcbMV+S^e0S5e^lgHCyEy4r1&c61 zN%Q^T#NHT~#0i3>f~y3t6MRJQ4PqE?YZB~>34(O4;3^{8?>50#1-}(c!&KlxdqQ2j zoYC$F*C6@`&_I~7fmID=M4Lud!!;1k%oG}?r1QblG)@wnB3K|;B1peVxe>wN3*yj6 z^XZqFzDDo@!7Bu>6TCz4e!+(YpAdXT@D;(g1phAhk>KZo-w6IBcv#S)-9Vp2!LEWm z1bYh(5IjzBl;AkQlLa#crwUFNEESw17!j-#Tq1b3;0nR>1lJ306}(jND#05BZxy^- z@P5IE1)mV)T8Z`MyhwaiaG&5if*%UD3VtT|mEd=RzX+NfZ;?GJ-FeKPlaG>BY z!O?=_1y2#o63i1U5}YY`reL|?BEhAC^@6Je*9dMD#Ids0oAWUBzeeyTL9S28e^~Gd z!Dj?t5PVheJ;7$dPXzgdV9NPg@JGSl1l{ycNKX(92&M|A3HBEpA~;fTtl&w4lLV&- z76_II@+qw>kLwNM0>R%4a$Y2Vx!`KSb%I+2FA=;_@Or`Rf_Dk>p~sZ>kl@pTd>A$P zuL-^>$oY=^e+Ygo__^RA!S4ls6~yjHU&ncz*K_?%Ocv}Z7#18PI9zayAm>?LcdB5v zV7_3n;OT;M1?LOa39b}8Uy%C~%Dq5vo8Z-gHwxY+c#q(p1a}H@T}?T=1z!|=P4G>@ zcLo0;$aMm*`&{sl;P-;R3c5HiB3~!LR6(w9$nP&WL~x|wSizG7CkajwED$UaoGo~k z-~z$l3)TuQ7vy8dS^ieRO9ihIyg~3*!Mg?T7kpR{XT@619zm{`DEF^|?+LaF>U9Fr zzY_X8!CwSTkA1yYkWW6RyzYV_!M=in1jh)TESM=cRdBjsso)&Jh+w7Q5=L05t;w~Jt!;BkWE z1#<*T11-$*9qP&_=we z7Hkw;CwQsgje_?IJ}UT};2VM;3Vts5gPt@SlP|33_qHL48sL2MCT9JWa4zuw1ZCaJ}G_f_Dl&D)^G%yMmty{w$b?jW^3r z6C5FUs$h}eJi)UC*9l%Bc!%I4f-efbBY05oC&7g7cDcO-hYOw}SST0~tQ9<8@FKzM z1@94jRPcGhHwBvozZCpcFd^C2BPcjXaI9dK;B>(=1Q!W53a$~nNbowry96H=+%5PQ z!S@6|75r8Zzm?Mc(pfM~aH!w}!6|}ef{O*~1lI^&BzT?RU4jn_?h*W};D>_$6#Plh zivt>MuYv;vM+=@NSR%MkutspT;8ww_1@94jK=3WWe+qsl=)&11%MS?l5gaafl3=dj zd4ih+uMpfWc)#E-!IuR03$_S;Dfo+^4`-{o9R&LejuM4B6y$R z6M`=az9rZ!_=Vulg1(TgPglV{g2MzS2<8Zu2u1{}1y>1f61+liyWstTy98en+%MQ7 z_@&@4f<7GRvAu$VLj)%X<_gXhTr9X!aEsuzg7*kMF1T0lUBQEbKMMMAHm=JT93ePE z@JzwQf{lXf1uql4Meu&XCk0;?d`GZN@EbuBXYee)i(qfTVS* z3Z5-^p5Ru&s|0TqykGDM!To~o3$_Y=CHRYAYCl`g-hu-KM+=@Jm?t<>uv~Dd;5mYu z1+NsmRq#)OPYNCo{7mrQg8vcp_m}n)>?b%v@I=8J!5M{6}(aKUco(ruLvF#^bfJi zNfSIpkgtrU-b(~G3tl03v)~_y@I5<)<~yEwUh1cgyR7f&+vQ z{wBXca2*l(uNL|aBJ$ra^pldlSLnY9{fXfBf}Rn!oK(Tyf`bId3QiL|Q*eo3gWxv7 z>jbw8-YvL8@XvzJ6VWbz6Z}Rnaiq;ZL-1@O=EQS_-b_S0TqyK4Lf;_t-9rCS=*I+~ z6a1^Bza?}l5%PZ#OdMs?U5U_d3=wnRM4@wuD8E4H*+S11da=;eLa!8hwa^z4A@5e9 zpCw|>dQIqeiID$+&_4^R4Dg{(K(LSCV8OA1nSzCaa|J5}>jc*bULc4nLe^|B_7{4 zlD80#IN!rz`eKg8~Lt0U9MeyyJE&j zn?l1IBMU|nD2(^(@)2%`#%@}*@9~Ti!N+gl@q)O$8aFEH2O98}cc(4oUe9B;4ekx< zaG&FU%j!HevfcfX`hsW=A8}`^b6e&Aj@fGTe+XiwpYgC)$o}fBS#k0W=&fk9K2*dQS-)zjMs1HHPc+iY5!lu_assId4mI9LUodjKL!H316C7$B)5bZ} z=&??0EOSMv(Z@UdG7{1ElH$P~EBMr}idsBb z3bTSJJvxKJ=*|E4KJ=IPi+-A)!EXvViO9zk+zMpeBQ)oU_>Xf*378%8ZGmrgK2E+u zF#HY^xchqi_7jNZm)3{*IES$&kXO47$j?)dMZTl6BX2l(@$zQhfH?p>%CqqA$P41a zc>SJ-JpKmP`8e{DkuP4}V#wQuOq7SIB`WV{TpzFB$4I1p%)^f(?|bBnm-l0we&jp) zeSvtqe*c1?gGbTtGvtex=eyCKBdK3voV=%OdC~UU-^tdGdH8YkdmQn2d5=S$(|))l zsvm!M6|dh1NaS4Yd>nb3JJfeCemJTPJQ`1u=w_??QHAEJp4HFW_6HvC{90o zRTGsrwu62vAurxm9eEiYWi;FqViM+{q7U}n1>%n9`9Xi}u@7k`Kr0`s0+lzeBmWAM+<^N@Ec>gIfy z#((}kjp!t~(YR?&CZJO;f6v8y&L@m~nT}C`>7;$qVH{;ZzhWfP4k*{rZ(-auh#KWc z=!>pK|# zPJLH)kT>^2?3ELdK|W4d4ISj|fIQZn@{Ys5BhQ0~V|x@)do}C@Jj!wM1<2JhHZNgKPQeuWi32QwvT>W39o1nOZw$h;Vf&3C zMh#ML+%w1s($gquH8MW(ZFLzBd}12)tzREL{0hqXT!pu{tO>ggFuxIKZsj$w z-JT}$8-Wi#^%*l-F)J&`Yyq}v3|!RwU|?U15m?)78rxgQbNuj*9Xpybaz}h-PTG$2 z?JddS2iwfz?T}HzpT#A(A)n|%ni0Odjr^YuAMR;EPR5p}4;tYs+l=tqwh4i4ZDt_z zz=S|ko6i8xD28rE!jSMSZIIjQ3SZj%+u_6iOatx4wd5Hn$KgBj!l+~t{`uLleuLJ{ zfNrBYvwquK&kWnwQC7g%pm~pu+TKd~+%unVD?W2WTN(bfZX)9l>Sxq$Yoi?0O_x2Y z^X3Cu);#;#fU&u~tR*kC%{8{S7BAV{7DBmYz(L0IZTrnD+ny?azQr_lx9&GLw9N&5 zWxs8@PSjynm(2%=z5v@`Mr(hx!8B#G2G~xv`=9#qxC^!v(|;}wE*qnw1r{J zZ1v6C&_-MM*xcVXyX%#0JNw~!wYGV+v8`?0jHc#CjklpgQ|qI~3oXL~x3r;OTiMoT z;L>JC&d2@sw^``7+0gM&?$ZaM*XM`OXYC{|I_}VFTyDHpwTC zHet+bR*kUZkGt+~TZMk3Zf1Q`^F!fnEnf7^4tjcV-IakIx*aW)YlgR@ zjFOfGh`YrWe}*l(0~^{pWuRXtHKG37Tdy^)flY32Mf)7M*4V832LAGMFRs5b@Q{{= zH3MvWMhn)cw%ovFnvb!h`LuC&c-;Xv`!TRi+c3+yHgJu$^J@c}+xA|zt!-qd?XBru z?RIzSH~=z|`=K4@K_~Q!A8q3F3ERMDY-;1UPujLg>%EgQq3<^8jWp9(dtfK@W}j}G zw^^5Mz#h&?d=cqawz*Ny9d`d8*n$3!weOW}*PxGYgdKR$b{sFUa?#eXBiudIMw_B7 zA-&~FjCW_OyU>PiqqGI%FTtI01^A_{x_!e=`>xgPdaWMoYY$wDvCgvD=B&Fp4`Y+| z61WMv7o%;rn}Ihjb{*RMw2$ezaMoeCOE>R`cVY~sq zP>eBT^xSX0jj{r*_?b}8{r#?Lv(UeXjK8&f9r#;|i8;h;Tzrr=Rtx*BMOpE_L$`zU zVx>fr*yWO`yr;V_Mt@vl0c3iCMGXd@PE zN4LQ?)M>}2Hh1yXHrmNfw7Y54qP>iSw2X@n=zM4gGi=+LTesWM4jI;PLHWsvB%Zc^ZtD2!_STf z5}J$*+7fM}wABo(4;<>Y5AI?Hw-G&Qzb5>W87?_Mz1MbK-<%rQhy3>V`4RHhn(Lc) zns4ZNUdwdGiI!Ocnd_o5wf%y>w(Gj)oul`)P!`r6&6LM>Xg6NCPGDbhyiNjQeZhPx zV{PEj{I{Uv=~_q5F~JP_fKuA=u1)1@n^Wig4LY9Q`orPF31&v=0m|MqV=c;j8@5{7 z^6$fk{}4dGsxamq_5;=`^#8gKIrpIdH`8I9?OJ|#iAp0L%Swm z{J;mSZFWKDL-XIzdZd$IyS)`Ys-?+<9{t{ENj2VRbJcD}-HUbI*#~Z87VCLCD)$HK z&pCOM?+;}*{8RDiMreU`vUA0I<2Mt z&8;?a-YP@8Ha~3B^mF$$!DC{4HZ{W*pg-4m+tu2xO#z>=EhP}RECu5~5Z_mUNh3b< z!M90YVV>RAR($ehZF_;Rs}^kOPO@N66J_mSPC~g@J5YBoZ67|6z9GzXq;cIA?;q&* zeQ#WRAkg&m!3+bxHIaXSvEv@I$$+is@^^1*JNM)d+RTjg2hKhDwKm%Jxv##}cBV0x zw$bxnknch{PT9up=GH+dA9mk-=-EAO#%_!Q*xR`$?`vB>dTn!Yugls3f%UKl;dMpd z?b)MkQs)7kx_eLC?9r%a^R~9Vd#*seZ^jy?lxvEikbA(`{bpNnuS?KpH@B(Xdp^}= zWW33CX@!0%=k|Il1>-7!@z51|ciTC7&;O$ATi~NAuK(xm-4~eNWwz{iAg}TRHNeaXBF$C*kVIlTkWq>u|-R%t*Er6{4>;LL}l7l&^u+_0vgAb!)N=xaL;W*T=rG@M$|+b+f(o8#8~hCs{B3n1n}45 zxhUIxIr198g6_SepX>T6WT1TGuwVJ=h&Q4)A`kiY8qalwXexMDo|H((52^J5+;ikoNAIibrN$Gw*c+mgDDQmlNN9W$u)9||$ zTrbTDPkadeBfoo(??9K4ThQ%*tl>-UP_*#GJEEjto%C~&9Pn4XOpN?{jQ#GTYbg)q2pLS)P*cz6XjsdsrxDu zb0xUMK7~J~ysIn|Zd%doFHXoF926!TE8|CafXzc6E80x%c=c zbntbYGr(?E-5*^M%D_lQr!JTK~-I3?+kLHW~?$4*a z*0pLJ*7F#%!)b>&cj38{DPBF=j=jJY)CJPKNLvlPZO7QWI;{L=*PXykaZ{&>x!MdL zj&8zy!gV;$o3kY5o}bN+IhY*f2!7)5zV`@WfjO@F@@W^C^AD2acvM8-hOPSAUr|+I_VcdIEoW4=n#xmI1I{Yu#Rp$-?*QQ4i{-EjzHsFtFY>(%ZXAKpTzp zQrPbxjT`6fwl+t#pa)**^ukBgL{o|&xejbyAYaZ ztZ)P5S!uPAzDeNR#Tk4UW4wZESqJtJ>YRdpWe9i;D@3~T6DSA1NF1mALdN5BP#^Sp z{1SxF=ka`m=-cB32%!f{4sjfED0!%xL)KXl`*#e=b^C;w1K;X3b}F7j#!lDO!BazT z!g?Ni`P3lhGujUIo|({R5%!s7iyxnN7(=8Y4Nj0}5k1%!#P@Q+n>yJZ&IMd^q^4=! zc_@p1**??6T%gV~_rXuIeR^*AZL}Hd%PWu{iX853 zo(4VD{;_Ll?jNIWrKhTxo_^JVEKGfdmZR22c56XB9wN&Fii1C$-oBx}D z*FD<|98_Q%aAlCor7mo8>)SXxd_sp4?iw<6+ z=OV5%?D;4i^U-S<&%W^2qj{J=k`dmBf3nsES~~Q7gVB4eZh;PV;NFM(b=(4#x8r^W zcQw$%2v6hw9Jdz(A|3Z6+(o#Vz5?M^+&gje`Tc3!d9ZWnzbg-8pvqh#PM$O4D$8-3U>PT=+~lyp%XWFoVo4X=fJmC^ps+pfiJ@;4y1L9Z5gy<<_{r1 z(=Y3jZd&OJtaR#y`4@rDF2f0)H^T>`EN3p|$b}raFTj5o-OWLx`@3m3j`^LoU; z0sZ{d(&2u@-Bue1BQMS(R5^xom(n$Ke4P7Dt^u&8coSz^vAXiG21eiVJWb{K0y@Sy zp^EEA&{NXCh`MDt6=XV?0Xe_Lf`v-&^mGR9SpXgvW-{I)_4w& zc43{*Gjmj??3#LFU04$&VN%52RLf9<_^0PtXIP+lfWHo$KEPhvLodf)B2NO1eVogF zf$z*k`;1jMGi=}0!{=M9YY@(LIWF(QIyyP1*JVR}XkRXFq;sC+nB*98%znP7J9k?Y zYrQvp2Of@&9M#nI-ShDL1Y>@yr8i@}qZ?i@twP~TuqMM9^&sR!-S)FUKD%iT?m_=n z_P}SVz6`T3u_ny5==A%GA-l2}$fb1!-BE{@Y(AVL&^F-1)V{a~V_G5)+h(^5wmZj8 zXTL&^Nqh#HXRR0XS;jZ9C)Ce;;E#+h(Prl19LG7H z=~r{U$5~G@>Nf`6++UBFmvepFqV0I5hAI4bE^Q0*BW;)c?Gej*V18H&uHYJQf3kR3 z^?P#oz|ltN!G7+8bzoBaG>*@QvHp1&>%p%db7E{^eCRWWFwdaH@xJ>|)>DLfxQ=3Z z)C^}Y-3rB8krV~q13`-FOX1ZC}mfgi@0*@sFGB3y@Yb`~M8 zJ&(KE^H6@TH2|K4C1VY+uL5g;cAP)$f?aNhF8A!}afP`zeE@6SuSXk=9nqrP9nriz zJ{QKC0IDs%_myUXk{htK8jYo)hOre>rOA{^h89 z)nAS}^Zs&FH1Fz}Xe>p2FXQ>v%Tf2Lm!qD%m!sJ8C%F#n>Y8{p+7NyvYBVqHc7?}u zitvG`0o)aa-$mS^;yIlT#7)GV(77v|-Dv`MLbg-TaWeZZcSJY$1Uy6Ka}7@rWd#qw zuVMUQd|`dk%`*q}Y$ms`+h~5}2%mEpt6n|gY0l|1nhzY|n0!;bjxpAb_d7)Qo8l14 z!n|qQ2%ar54gdKldf0iWOX3-b#DT(T#Hm-tF?67F^o2Fv_-rmY;o00HD3I5lCmii- z^F(ujXsQtFR*JgyV$+?Xb(a|YhNzuptZz2zvm7mB9CNB14evVE{L|6sH#g*&ZBLk+ z51ZG#ZEkToz0tF~@VSM-qU8aj_HA?1yQcReP>g1eXsHn1v+tie`Oz-nz<)t$dsZ}j z%GCYBZ1RZO7Q?&IBbshgLEEi{H`;S{y+;IJHNB@!?ibGHB+(i%TfS*}kDlo|65TIc z?;m|13GN1uXiGD_bxES-b4S~k4)5+yqTL^z>iJvr?C$z3(GV0@O%TnqMeTgCu}Eyb z)o8lQ@Sf><4;6dv6y8tIMo)f3vG$8W(a)wOiRnpVPQ>u;7fJhtJag*osh(3O_KW16 zp6F?08GPzw4=PVNdm8^~Xu3~$pZv)*kH{TidUuH-yFZGaJ^TL2qbSQ)H&|?XT&(?? z(RjV#?TJDGttn8z9FLg19B<5}ezd#i)XB4FPMz4@g4UOyy&rxY{pjrOV^Os33`#if zz1^8S18N003O=zS$e+NqP#-5+$F?K!qzq&Ex}jp?H9 zZ=&Tx;XT=N>Ig*HFEYAL9{srMD1;tb3k842@E-l3Yrh!Qb1Z6$uwP`JJ$CBM`~T=- z2kjSGe|sP7!=oq9?r!vnwt%QVAR1m2Ej_~9kR)nf6itUw!O^p*bi`+;!8#HpH~ii3 zo<-cxcoNfr1lFK;E;qdBq?W}{d-TkHF-io{KvmJ`GrAMU)D9LK(nWKoXdN!RA1h(b zekR675j!HXyUrdH_1Kp|S}lPMrE=HyWZW z;{wz_5rq9>()%BsKK0T2x^a_ZnwerNW@?Ys@LU$OUrcNBh%JMJw+rfMq9 zgPEK}GmFuMZ1NfKFMzEq{N$6}ln9BIEG1~XC_O7KI}tq_6^q{A-F4>ZNBFVMVp{VW z42x*jiQVs?-Y-JCM7eGsj20~wVH}(s*(ECXiz>dwzlPsXR$yG~oFHG$$Ct%|{CNmI zY?h?n*tb5%rhXW}pK~;{3G$9>o)aw04~5FBgGI&F`GqCHmM!@7(wuSilMus4`&0~{ ziJN@sy80INi9&v~EcQLj;Jo0t`T=Udht%*vZc$mgF^Kp1gH3CKT7V#brx3*F;$({K)5Od}l9@zW93X?=na1>^g6qmx7-zJ}P+)X1i9XizN;^838_ z;;3E6`qm&=8`jn~!mF$c;s*%$3L<0bGq0A~$E^=GY^iH#sBcZsG)^hMRC5-J}1Afm3sq8mZMi5>&H=n7Tz{W^hxT|z|% z5OpP%FdGz9#b7ROT@_IQu#;a&0gPEGj z`tnp1N5lHE^AgiFgc*=?fEvh^tdhbEu*oME&#-(tN(Nqu#p(hZ(GLoKyOABtt(8G}q;bsmm5-E3h57(J4m|;9!PP#R6b+ z?L_=B+(=@u7q=-|oc;R#1QO0FzDfq*2jA7;LxgQrnHa$VjFmz*Ty{+*NLYp&H8JQ^ z(IuKE&c$=Fyn&njIg)r>hGyHRW~ONEFDi>#!CQJN=#DX z3BAA;p|fWrsMpbT2%2^DECT)y_W`Vd#pn*GV8CJ=;%mt)r`?J(+<_ZSV!*;Ua4I_N zVwr*E@UkV(MtnSOLo6qmS7MTGZ@-QvS&xRL49akuqS@KO$TEeX*BM!7ryx|9UHCJ= z4&xrciVlF>sgnAcbROD71)(L>sk-bEmm!V1G{jN{Z7RBqfmUh1p+hdJ#!w>nDvQ?P zR2>m!;8W2G20=|_kgchf7%{aGPp}xO!=T^J!Z zbg&ola09u%-xy0r0=YfnYT^6R7#`z}5s;{^#A*@*XUG1Z1h*Ln_VGa!V~SMK!N_df z1N1m$WpYfkNkCX^jDWbh5@pr8Q@(8{63^k8b&J#tp}G3m0Sl&`LcI*g#dcTrQz;Ux zQC>ANfw8I|BPAP;TeX{QVY?NAP+fLA$jJ&}(3v_V-tD;{%*AbpB_#;RhA5!A>=KAD zE7ZzhpNcL!fZ(u>0;(%9gBKKfJ_MSp-$-MYAZ{pyfiAZC0HQiWHDc;YEVdpL?B#Dq z@EC4tv8v+$VmeP1V(LoFlOQ{X$^e6rQqt6w0vXYK{rZvC&Sa0+tSvsz;`NATO#rSg zyZ$0zx@G+e+kvFLxMPK>i~x3C;!fPqJA?5G<>CqvbtN*g36{QX#(_smx?&77XvBT) z@t3O^8RW$n8G8#iWIBf6td27H9Jek^#gx|zI}vaqId?6zUC7NK&nls!gE49j2@LEK z25!)7#aPK84>zl-R3&IRD=8;udf1sg;cFhy)n%)(9T+>MciR$LqqqU=48*ByWMIHH z=!P<;_Ghl1^9!*_xGn75qQyTGW0k z7BA$Zs1A{WgV=d0e&q79(MB)#FAj2N1lbqk!tNdu$!B?YOak;@UeK_W)}tay+iMmL5Yu z8$z*w>axosvJ5wRpFuNjZ9j}{)d>u4k0mg+M<*~ifLrHa>=14g#h??nPC!ImiFK|3 z1s%`8uCtkNVd;aH2+vIB@(A|s}* z#0)-Akbyy-idKga@L4m4MI!=jrPZ|19m-CscOp38QVd{KS7M2Ipg>j@)2yQm_TtuJ zGxn)YcnsZoP<3s^3HCCo(>#pLRWejCpg5RVP0G_|#TjnLjj9;zQsmqYhL36TK?Iau z7s&?jXO1c5}0V<>AI`9@pBExYm}i(stZn zV2#^QE~5yxDFyah1ke*vL3pTQYXnidC5YP1K-6vn87!d@wIxOr<*3URmlmN5uW~{+ zKBcBA7JgVqE&iD2jZ35Y=TqHP@eKW((P5OpPNf5icU*14e6}&ybzt5VJej(7CuBVnzqUA{C$6!7!}i7j`gQrs5ZMFsxVc zSse`7tt_W+qe~#?GNljpsk&?h(y;dGB)b(bKQ>|oZbaiE5?es2x!{pD9)#nluImA(du0YC^gjc7=mSZ^o!^U1h08i6zS@+4TXr#Td@n# zeYjECK?JMx7-H}eZtYhX({7^T5KQJJZ8i*is7~`RHWD|=VUQh5V2nnB1P04u3C9ql zy&-|Yr?CXaKGz8hlA&2$2V*|1X9l!OodChrWw$RK7~7}1dKV&FQI0~WpP9&~khfR} zw4@NKtJ6kqhu)|=m4f{0`oEQ)XP3bO*V$z-(ufWQCNi&0XrK}+c_Yr z6a--Fh(E8g9oF7lAOSeXkV@!;Lt6pPKK&RDs}ZMYah5?(q$cv zWe77vrpnN-SXP5}uto-6g$^_{k&t+@rdI^ZNaba>h4D<>PzD3d)o*!8E?Ou24g<~A z?-XtX_f}}>=5ShW_ssOwZq%XVqoV<_WhBg_T#f_6Xqk|C;i8$1`YoY4bCV`t<6Bx(9xlHg6hb;w*YM#HpNgyyUx!lO`DrFKMMx$Qq9U5qJrTTgFGLJ zK}ayd1(_)f+deW4*`-Uj#y=P-rD;TFgApGHiJ{QJs5mO+V3{mugBTo^kbiWnp-35{ zO1AVgHUsK8AF^flD+Cpdi?IU9iE&5@aejuueB*~&LgRmt<0$@zSR9$|hstY)EtAXTQV25xIWyT$Gj(S? zP>{v0xiH=bx(62)Pf?kiQ3X=;DWBAL4YRIwW6| z5|Uq{G;|98i6_1R?~)S{5%MB#SmZ)LhvY`u)Li_OqtlV>lD8ltq}oc$?~_ZX--hmY zn)jRXkV@yzR}ATfS{!mJpef4%ow5$lCAR{)<-LF&`C~w@{2kyR$yG{{bURUjy?{Qs8!%PA26&$2`ZP^u!||j`SdGY#?SMn&Uch1UIAEq6ilt1J zoC7#qUI{ot-U2vMejm^;e+d|nuK|vdrvQV}i#5ti{p5_W@occLUCnF96P#Zvb8_KL?y6@h+CQL@ofFD^~)}lUo2UmG=P7 zmp=x~lLrCw+zDLBp8y*2SAY)r zDxfKQ0G;wIpvz_sOLsDv(*X?`0CdPp0Zmy2=#;AgU2+ScTmBcIM}7y;D}M?&Nd6CC zl6(tL%2R;J(uucP2g@|T6p2{?-8=`-Cl>*x%2j~p$yUHLc^hE50 zBtJcsDL(?tlI|3C^KifsasuE;ITz3`!+-(V060o+1`NtO07uL30gjRT0LRMT17>TJ zKADQ9m?>`g7HCi+rf)-L13KhFKvP}`=#)1Ax+FgV<(AI^dgL)culy(AAQ|wnt@8k- zyaF&;ZUG!D9{@~|KLZ>h`8g(^JPDX8`N^g8WHw-$ECNiID*!VjKdm%W-VQiSeh)BH z?gPw{uL2I&^5%}9ydNgZ!RJxlQGkY=4(O02fTmmu=#-6sE_pqmTiyfcksW|u`7^*l z@(^H>{0pFz?*S%DejI7Aj2Z_w*k}TKEMq57r>$N z?|{Q(GM3hvasptMTmU#+t^gb%uLB$@9|ZKv{{{@mX8}jaKLZBk5x~*%?|@_EpbYlS zc))B~1UOE91u#cm2Y9}G5OBQQ3phdYAADROKL?yBhYaNq%m$n+7XnU^YXPUq+W>Rr zqkz-oLBQ$qb-)?&B;ZWx!us(-nFV-}oCY{cmIBU}jer-+I{@d%hXF5=I z9|2w}hhkozFDC=$$r8YP`4zwd$q(!l%I^Xe$>#x!{{vVd-v+Fdrva`s0h8nbKq-#_Cd(my+SC-l6j=Z` zM6Ln!$-4nl;&E@j}5s~I@uMh0Ga4Fah(5g3g^ z93LBUJ7_|F3($~H0y^XifTnyE&?)(wOqV%3Ccnc|T%5fQQg(2(VT4tWKjH8tmDQ?i*3d8^`jNO3)- zxLzTb>;`noGk`AX9z)4S0(#^`K(8zY93+iEmNx;yPXPwyqkyC3^MGUI z+kj)`=YZLA*jSFm8Gt!51bDt|030uG0h}QJ8}I`8GT=n{G2kRQ5~5DlZTsf=5XyYh zBg3HG6qMW83i%}9?LqlA0-yXCFeuZul%kGeez`$2IWU8%##_AtDPBhb;KbT>4;M{>xi{rJ8vQz z(3~uP4063Z0C>od|BK)yL%xUL4~BG%$HxU6GKkFz&#mUUPB2s7b(U{e&;haALVoPB!*8%y0O6+ zahVGLo3yMa07s50hRsUHDTjYCl9=E)?GXM-AP)=%@}a}&-%y0+VuEm-ad`bLK<-8N zIzDnF`|kqsFp*CkzQEH!)aTSba~yL7o&|P>NnfJC0RG#y_!lwLTx14bM4CjuI^1TN z47_e*9y25ZzlAx{qys9+G>oMVBf(FhbH zt(~PT^fViRD{Rh%o;D*;Fw-it#IwZ+Ty1lfdbS#YU(XYQUG4~Z+Ks@?NK;t3XPXgt z5ZJX?A~`BNw;O>+Y^=(2ml4@b&knQ?*p1o1BA#7F;E%wn z$+^n&h!N-prrKBQdCUlW7RMep0=|4q?Bv|&*<%DQ2Btcq)w9VfR5x5JOD)TzeOGaR)own6;*ckPwja~0? z8lzq_M*Yer+yFuVgqLkXI|zOd-n9ugf-n+kU zfiTx5+~RRMhJmoyCfo{+p&+cZ3Acfe0YalqxE+La5H??A6?z8xJO+XTgnD=|WimhZIGrP3H%9HWIi3W^2oQb(!d*1Rr$87E!m~Ev zX%Mnrhed#pLyli~-ZTP#1y)KU{I%yTBk(>jK!{`!Bk$^F6}voQ7Yr zV)x;g2xJqG+pwK*O!C0teSpRw$8wjSZeRKKD_p|A5{Me+D_l^0 zq>Z?e{l5aDx}nzP^S^B8S?x;qzX>D*n=411E7R|Rzg9@SE9f5rWIR(ET;u&80{NI8 zd7UfQzY((hfnu(A9Sht7aOC}N9;F@FvegI6Bx6zer1b%K~O|IES;P*Dx z?8-y0+St`DJS53t2WQ<3mpGE&A_}HEf-e77#7@ymj&_N_HX!OVxno?y2;5;Ojdh9C zz}+^6v!L^o`&QY;xkOsvJ4hSEM&-EhImaK^*!eDBx-i-4>fBBki3t9q2vgK4ollG& zjqINxqZxI$yAgW4qxnJJBhZjJB_r!%#K*ir-I@Lj|4>A}1Bw~Q5dH~3xWP4p8BYJx zKsW`MV=}ycPLx!XnVsSD-)kc|8JYeUfy{&A&G8vQ|6w3>&gKOf*xgjOWln=~sBq>or{iB)jNwH$&c>M-gtQ4Q$8%Hwz$#Ep;PXqEi$H^j$Aa=2u63bkV`RSUPAfjWj>v6vyi1Iff z*B<|bIP#=_MjZL6e^wm%nZGEG?Ddz$k*EAsapY-Xa#g7s-=1K^d16d0oXdE}!~}0L zInkR;N%SUD6TQi_L~k+!-o%TNjUhgg5a4X{Q6b$TiYG7Krjdv*220 z0Z}c!*p=!g?zjDy z*vND4cl^~h^1S<9|8g67!QJU^w2_1EuI!tEDA|7N#*(2k`wkob9q^RS?1yap5b(jB z*^k-y?|~W`APie*o_3%pQ#X zQ1bjQaCc{Rri~v4?&{1QYvZo~cXno9XydN}H#@Tz+xQ=WJ36!LZ2UFgMrU@bjsFR_ z=*+&^#{Ud_)RFA_Z2T|414l#_Z7GHB;$`%eJ7m&=l+`;$JpOf&^(S=W$n-pHYYoSz zrvEP}M{jaW;Xh#`|1iCN_e?A0pQbP7wjH0Fnf?@{(9b%)Fh}}F+K9th<{t-S5014Q zPUlwt*bA|*#>th#cNd9s|J z2c`gdfe8KsgAu5=cMqeTXz?w;K4aP#r#E3|G1i%kX%%U7Y>sTF&j|blm^uO)=S(*O zr+`i7LMq3ZX#`R(72wz%8>?|1Gy;#> zr7UqCG6K)o*it8U7H`R!P#j9HUd))u*rD@dp;X$ zc4D!3uZ>;pJcc&fSc~&Gdep{RohOXIVPIs z8JM54dqa##hPv|{S*CwH?DG45Na%-^$6VuR(;0V-V_@>J&Ffe**Doa_IBDHzj^8uL=Wfrcq$i8)_nJ%*yjU4nG4 zXH*VXTa?EW6giWu0z9LgIWz3|7(6Zg77&lqJcf))R}Q_BIta4)tYge36rbx@Zu)u5 zp(gpup|@#q#Ot34L^bXTXlHI5N%t4WkxYLmj*Rrz#F3zXWgN-&H`vGuXs0obV3|dA zX5ATp(>e)De#~%eGyUHJhZ?rGLag03a+}#6i20lcOt_5L;m3m}*4_ufs2t5V&6!98 z_7e{M9VS-d$1buu?jduo5io%%2l6d54=Z>qa257#v&aaXL7M9Chs_cr@C7h+Fw$X` z8G+_mkZ=sj++~Jw8~{u?p6{B~M&MQ(`<}VX2;2=!xx??9D{$NaY&Y}$z+7bnzIus; z{m`s80(S!YC603)KQh-Dfro$<(d|8MHX4Bt@+lMjiP>xf-bI>{Y>(My1pWq0nbni# zmITN1l(`j{&H1$1ZUiLss`CBZ+-3yQY;2!-yAkl)*e}ex;1X?Yzq#EATw-ItH19V8 zVHu2au*FJzTZ=h%9np>0nZ(1E~el1D(qd?S}_l6{=pPM9w z+?eF`pSDwOPD=Lkyi29rlH~KBMGE`Tyge!1KLN!m3`9nOOfL=6V)jObX~evo1+(UXsA1qSL$0~oU!W;fD&-yP3+9BWYzsC-;ve&BZcbAWJN zX@2PT`sdon-`&anML?7?zI6NiwgH=NPrAR#X7hS7Mb_6))aW|^d?1_ObLlM)y+P&_ z1AwAwzES7bfK685u%-vC6B)jMn4s|aR#&*Z!e z&a1OQIxBL{2d$L#{@t0Ai@2hH>dm>-j{hS$XOSKM+?P{>cn$ggmG1uv;!TX>g&+S~ zAomb)7$g0yKstyxjiCQ}AWso-8`=IlfV@b=YmE0l1cZ-tyh+9+{}Vv|MkE=V%B;h>5IQ0aNZJ5p3QC<3=K=_C6EW#ckIy-C{$y+Bpf}!+zfF$!;~`(pv*-&t zT9HHxCUQPNoHK-Xvoj}z^n395&btMsaDbWr2cVRh%f{t1@Lrj7 z1{qWh8-!~831-GCMOhyr;`%#t87SjIve%5sLE!TaG5r5Pw)rd@@7DQEP^*cg8BYIT zAghRE7+(J{AU6;hW+aQOBE)oWQp8LGk+mGe^R0M8Z-(oDW>PK4O0cb0vdFq0cuEIA z2deQ_j=PV6w=Sm&p=wiuZqos1%{eb3 zR9%0Ih`WW`oFZilcqhPKyz|BlXW-qM!()<%K=xiQa)#Ju)ehbd9FPG7=i;m%Aw6X; zz*=U?8@CKWviHuMc?gy1-6e8DcKmKlRY7%rAh7EIzay ze-9YE!IX5wKV-Cg+*=5o-urU?j8L`X0q{;i`uUmj0agFmoe12;A)FOb>3U3Gj(B{G zYd5Yty{&i39YC#;?nZP%*8Q<`)+DkX0X#pGr6$(8zZaKP!2kAU6OvfKgwGem#6vtsKp7TLf+y7Uv{kaSX$B^Sy(l2$M>e9AnH|} zsa_A?;OKOiKSE|pgfWkS=5_Qq{NF%CJ<&aa2fsYmJPIyH6c2vChZMC{#A&KJRaVGR zhexEaF%KcxeT_+?Rj7*V<8ZG?;a==8dA<@q3=aq_8?YS0lEhf~&4qy1OULck<6T#${H!MF6iPl zNHcz7j8HoG33V`SJ4sLS9S7auJ#6r_$4UJu_d#Mz2ja=*-yG_3f$IMg=sxaXmHB*t z?z;~x3OVV($lykQ&XX+RHzZos{YF)%l={1P9fwpMbN)!~JgVIop;+?BGNN0NX)@DP z#}tr5V7x)MaI(hApRixwVl7j@geFzH-co%#4(Y0IRq9;Fy+XCLGv3m7Ro5;8A9th1 zJ5<)REejCsVuABMWQPX~$RRHMgz;&{{29RR2O*5x5QaI!sJ;ZGJQTkGVSWWb+SMp> z1tMbpcL0yr>@EY=QvKg#dx~rif$ad<3SI)lWFicYabDr;KxP=rd&u%vu$)vZtXNe# z$S_k4xWE3@js#Uzn=xjhW~O0X7qdt{hpI;{mW8H&8#sUSquvBrXW8Mkz<-K_g9_)H zAw!KSv`%w%TGY)jV{#QiJ~8YBddX4XrP`J0ieZDGMaN6}RT8=e{T9ivbdq-sqIR{7 ztC#|RL}?<6or7VFv4PuI`CInxY@^r+tB##*unPUki)I)BACg*xc8^CS?Mg&uA|e)? z&t5DrShBHD-T3#wN2l&X5lUIMPHPp2<-+&fa4U&vq+L)lKt)08PuLi2$uBV1(A3QN=w zSZq+7(5p!MoaPrcI3I*g0$0Pc+~C*=jdDSvQlx8q9-l55?-*y%RoZO-Y$!V%54L5v zjVjt*C&+K(j(J8nN9=S7sHhqj>ON5K&3mj zxRhHB!wi)b*CWCNSh4P@GDM7(gQ&ivx~DcnGSyQ@bx(Bw-^^Yu*(b&PQY39U(C9%h9|}2D3q2ROsy0{Q^QmNH(f<@>s$)p% zcY#siGmI*w?%x4d>OO^tQn&7-@k-RcUx=<*i86VXl6os5LlDUy0ifBoD7Fol0aBkp z>UD^y8JbR?F)sOQ~gpRttXdq?^4# z_gy>iIi-r9^L7CRSci&?tqxD>%SfakT7cPhBono0p-~a)^T7$G{tLW*dcy^GQN-IE z7XUF9KB5smVHNHjK-`9QU9fRu<>i!gpO!Qarl=&{rzO1__*_c1&%uY+p^+$JKJi~V z9z|gxu47c`&p5aq3;htda+&)bbdZ-8lJ`pU(nYFu=B1Sko6Q1B+l~T^Kca;%fm2DX z$U8{>iz6xZOfT{tl3xUOCPs(ip3g$YLk+o1dfnl|@=GOTdmnl*7 z7`{wdmmareN@Q)IufdBME3ais+D+wrmO>!al6F%$pC18N^|Y&plA#?#tZu!@WVeR! zod!Kc-E4A-3jN3@L<3v9%~WQw0o#DJ#BWjMhxjWHHI8-qJY^1F!y_}StXj#p(K#FX zp0}RyLnfDV^OWhlY3^nGcG71#Iq}R>CUmirzgjQgd$7l#2;)7|mAVi@ybD4qf3Kq6 zhgJTf2#m@?u6DYyg ze?UaJm-+N5`~^Dd6h@oVhbrh@Dn`?_r19%;%DpI?(-WS0!&c$_p9uoQ^5B#-NNfKg!nb_U+DCUhg#;X)8}P~gRi@tu*`Vx%yY8N3GQ`Zn3vA@9QQ87l^uE^l!}Z*B;z#BR#qXR zEo!Jy32kYr7a4j}Q?VTzAEUyUfwNfK8ZQL?3~;qWek-1k!6W#3w4cRq0j$7gL(4#| zsN_8=Sta0?IH(+NFN`aH@|tXW%-tj~Ek7WzK!P&~>Uz1088@6sHfa`P!j+0*DFHH@Be zt6`+rUSfZ){59F0byLW)cWt(36OZ`vCZ3yj)J~9t?5pJ|IcFji9+i`Eh zy%RT8!QG{O(H$PceFAqLoSuEPBeDbcG2Ha6_QkU6aUa0_8gBbqhsbu^^zhjU{G>gO zo8^3t+rGSr1aUXxz8&`g+;8EwuWCe=;a-7zFK)`04*3q^KAa%u77X}pyfKP);druB`gj(DLFNYPNcdi~_hvuZ_S!xr^#@WrN$t?Sor#D7w+L$M+f z$*-);UmmF{y}US5y*ykTi3t7g<6GmL>o>NEvZYm(RgqA6B)_n_bV+ffGC#Di*rFCJ zuP&~N6jxa2g3`*WYAaqHErC8e#bwzkF;Ie+#qTyOT$%>(xS3rD_T`t9EwzxAjiF4v}$SdMDRfVr$z{>RKqD@&`3p{PEURuxym(jw6<04UuUwSSr@bq&*pxK!e(%j= zwK!C~6hlMlwKN113RRcpTf;K0_?TIgSC>4MV2d=C2FHCfHf4?{{=V}7Wp zsw96=aipX;zo@wHcqk9Sl`Uo?&?Neg@-n^IJfIDMpMa2v9Ys&gsS>eLc-qL{(fva0w8tQNEOslHKY!xZW zug>qEPp9>o!s1<-;2CYZ?C(C*WK?wSblZ(tCN@9;_Wb$(RR&a@->2KP$125uux+q+ zdsTW-WqJ4<>4hc5=>7b{!s4o`NM-55lD?Wpu_~>kdT}2Ep(*OI*T*GPp)3x$($IqP z-qI{YA1~qj*sJH2jN!$7coTGYF28PDqU}d4$MYZjNM-)gNaeELB9Nw67`-GT`5dmC zN%=+P_>@b(9Eu#_B+);ua@jc&V%3}@T}d}U8vS*DMHiNomKAByBTGv2BjNnYerne| zEZ17s#RmaLklpe5)%?s-@0Qd+)9Nctb@+4>zXXIYG}X2?ZN#UKsuo5Tl$9@y)Py+N zv6P5W^s*&}LZIS><;ow#d1&C2CdNgz^dc-kv1*Z2U4}JRb)=veQ%JF}u<}Ks$ch$L z!aB>!%Jq!0T)8O>ZkrRyRh3IDo&+L|rw@v1@~dmA5~%QSa8}Stye?&QaD@pZRen)< zC?*~2w8lntY2l*cUKJ@foshe4Lknr4SO}^{#rQx>6nH6}Z*S2wM`TImg5`<1dRMnJ z5~A}}J|uywuMAa7EuAJbw5l>uE?fICPHPpwNg_e}NbawF5EB~%v~Oc94)&!jrCm~@ zo+(m-R)F>^NOSbk3fTH9fkpLF6$k@pW#DeL#qDiBr1mayX}m}}6ZS-50Zc`$Y3*qi zA=VZ(h1%g*Jn=P*nu-VH=~Iqcas2yY24wm7)ej(=npw&hMXJj=Z-CaNxg4vViOZzkq)2{fc|@(S5*(SuVkafc>4}AgvG2l43oaQOCU{8f zFB4?5Qma*J6_%U>Cl-~Xqk1QzbFHN*ibb=l^<-lSwV#t7h!V zMVtbA>PylESM_1Ufl_rsK8R%tQMn-}*{|tw%qaK6vX>ab@v>;z}&1;$&Du0)`2c=8{0E!r?(5%Tw)xiC_%o z>sD4LmXVOWxEM+(N+>NMEu2448(C--)VjD|dvt}?>=u__D_dD8XFB-RL`zLfRSFr< z9I+d*dJ)HaTu%<%^hC0Z_awjI+PI_=HWue&BUE0wG{3T_Ut9DPM?1#g;!#jP!;5pAb39{MK~4RJY-MqE5ez2*$1{k|eB zQ;WPvX}C`U5B}qgigh|>40L}&3Wf*g+yn~G7Wzm8OHgY)J>gr6AS}PEoeTU?)c_3Y z>Sr!^xIa&9dex%RaJcuJ zXpRWtrNjw>4eWuo0gqu5Z|aM>BX96kC9n zE-o&wsTO_kNdD4%wez+XoX{N(^sz!dC!f`UFoSb&##Z5xrKQy+*7oMy58MEMIIT#+in;cW%*@iP;BI_UgW0$vld&mQsDiNt|K&<%>yV*T9EK z*izVq=p92Dn(CtRr6HWdV5bo)#ZKl?YTqnMJU&ZP zkJ9v0t-d_inDUVhW^|qyDlwFa{(C+y%GHygzHC-oORK7CX#Q%u(@(CLW~y*TT@_ha zSzOEoEIJDNs{h0t@74bUGri|Iid|HSMLcwlC$08bTi?dSS*(M$z6{zNd-bZ_A0_2w zT>eJ#`*)R^7qEA(!V0V)AA_$MAJXRM%-hy)XuxO6MHwCh;8;zCm`d@$1O$8=y%ZjY zQGGCoNKtVC-e)06?Q?Yw`@spQ7z-*@_lk;^VcrcD;v^r*>b#E;?Yy`pYiwE@X>8cs z(Adh|TUG4oppHe@uWXfl3TlxP&WkOI{SdASGQ!`pqxDu1=O9>FCOi_wics%*m9?HL zu?E`-HJbHPOzdqfKZaunWwg30sHDWlOgQ{5uCA#Jp`$I=QO2`K^&q1v?hNB@MKxND zFgEj?gHy5DBQmb3>AFa}ML2&@vqVgj(-Rxd;|a)a?cE0E(M5A?vvU$2gIf>d%fdA{ z$-;i6G*koIAXc?hFO?O7$+&>enwWr-O`cNX!7j^E?=(a-k^dVXPQ1=DW*b+DrD}(JVb-p;=DhLGI9%BV_6Ps9>_PKa|rO#8W zoO+<@r*x>b4-;0uOZzY;lJv0~9>v4{^>alOLCtD0HQ|uL?+uK;tZ>(l$&ErBzQ)V$YPf>ptB#KKF!zL&7YGk!NDhtjt#JAilD3t zi*W1QiAQGGWkr@?KICDPek^XeA9b|cKMxmZb}?vVc?dffIAg5t2B<*qX~Cpy(+aqW z7=X8|w4iv&0CenS`62|C+)FO{H_7FEO(fyTz153WOV!$#E#kBRAE?@`k2-rZDpj!C zYN{8^9-umovEoAfjG@0~(14nO8i3^tl#F$k8a43G4E3|b-gWbg6~!+sD=&abxxgKu z7Ho{mN(-^}UBadNK*ivZ)G{@}43K-^98_&&$wlQMoZ_mDv3{`KTe?IhXo>E%pF!0u z;rmxrr3sLh{x;NpV`)Db*-`+ z?kW3cRt*|Bm$ppp{jik8bHf4h>$e%Srd8Jz;*i*yc-nAS8)<6hJ6P5`VETY4KKrQd zwupFOmxw}1oTMmqBAMHxQgr=5X^YF3VA94T;KlhN2SdChBRns5sOs3oGw0sNPYk zaj80`Pd&_}cN^+;sKi?0$0GwvVYMe>EkS$90u?X7IO?tcg?xyaSc5(f9k_JN@hGH7 z9kN9hhv{{ zh56M1m(pDoj(e*Xl=f4SK3-F2!2?NI3M;G(!RD;NuAg2fR>KY`<;I)c-KUMTnuYL| zOYzcCVjdQT#W~K|@|Qp}{e-ge4A?WO9P2b#w=DLal6rHJE4@u>U4}e zkldM(4YjRTMW*#9snvnbVsp*t#kHW4M-(MRm3?x@=`e?Lwty=Cf^ zdeO{?o^0$!^i7?0?s}0|&x_~Ed*Q#$JM-VBo=Zb$FY5g_?L}&0duPF?VS9;5P`8W^ zs{d1ZV(A0rPn2z-^n{k#PxEjjRf_li)Kd+6xVRq$0{v91X`O)cx!uHOjO zrnaWKrbg=(Y_Wb#ZC!(?Yh2&3u?^>LYnu4hFA7K~68qs@L_cS>M>u+|()> zoA6@00rK1^(>xHTC-KXQZ@>CL9`wO~^iDx}_SGp|N&t zEAYC;rq%}0+R$)Sq;6A7LdA*oHLW2lbWyJgnhoTdmi2875CJM*D=3Ak8};ckMuj#v z*0w2m(M_#N+}3Mb+Zr}Rnp@Uy7HsDlN+GZaS0@^F8ElPJ9HOk5ua&a{TG|9oK!kc6 zjNV(jR;=DszZM<2dea)FLnOr&*<9PW9()_?tyo=Ki>PbbgsxC!wTk-nD7fWXSWWAC zYyn!yN+#B;-(u&!7iTSE19rRXfwXZ~jmOY!TDL6?S8r-)ZHv9Hp0KGi|TYT17bCBF$v3Th~x`mEchpyO>^vzo+1!ptkHv zIBEr_E}=3t*IwJ$R9hdR9K8s%K{dmzuipZjr&|y$t($qn23yeJ4Xtanxx+-Y1Sn(; z8qKVm+Sbh0L%g9rqKsR2b7Di(0A_MCjCmuJwx*>P!mn?QtOg2Wf$TwWPjbO#=pB0;PFFT?4Fb1N={GE3#}rP^(8(>$+H*tpi4C zKe7L4yS;EdUQ~S)6#Afs(blyaV0PMo;$GUep+3i#FcsRR8Uk>_jkPGkI@z=&hi#LH z5unupw-`%NhO-G>L8n7kv!_%v{$P5c2- z%vIO()D8}cwKq34HQE&d)iuCqH^Ei6!LMOnyDC!O(2QZiax4W#nmN0zQ*N5#sKLxp zi{2CKrjczU!#4Q0R(`uDYa!Uh$M+MWhDzZx@+St@| z6*^!ur$Ma?rAo|%Tds}7CQ5~^u5Ddk7pdKZ-_NKgQC223`EF2tS!rBH1GUUy|3JefhXYPH#I21?8!HxWwE*7YFcU|8{lE+l3Te%XlTIz_ zXmhhGyryQ&EJZiL>UePp`-8F3j5n@(b@_stQg$>?G*b&_8rQ+-oL62}QCeMrB;3^i zW;ky(z|5I!m|@0O4!D4hD&-_@l`NQ#s&&g)Lp@uvlh%Z|Nn%01sKlJ$@$b2n{^2nN9@=d^^Azdgp{kMpRb5`b#QZP;3dS6BU=lD#CINHQtg)DDb!jYLSXE-Yp>@Q?c-WrL@GvJ# z+FUTyO7Q%l7K^2NZs`&fI|fa*Br}+lnwhQ|7uop_hxBG#o=Z;{j+5l6xL{#I&ue}- zn%7Y9k8h=D9Ihfv3Ul4Vd5k=cSItbIF(^^f6uhC&UForRaV$h*fi)(wS`1>F$nN9H ztj3C2OG?b;QXMCnpD9^$1EhqPfvOj|wwR7ly`Tz%2Uaay?{Lz0*Nsx)-b&!wqjVm6 zIma`jOwSDCs?X3d%*Qc~R(W+bdNUT)2`gwkD$p$e+HMX_4bqK;R5PdaaxC>&L|$W~ zzpQi}r5qn22gv z>=ev1OJ7%jF2Fr4e~=cwSaeijIm7X$#yy@n!<^K(ZY7W~ewJbp>zUPDWU6b;hHf+T zt%+zj8mngwE7v%==QM1_rXw}CY>c<=W18;#mJk!Q)I2&VQl(k^aJWeXwm1{uS%oUD zV|^2fk=?1#8<1+O%S+ue2M~@kFuLH#v^)&c*5&2pRX7n?hy^AZId7PH6FDC*i1A0(UOyFrZ*PN2x?Grf}TER9RJp;z0j%%gUOGHpCY1PDIUy z&M0T=$Ej*$Ka^Un5&|6><`-1CRhQ-U=iuvgF?yA$wAT7d~Q><#NaZ6_4EDQ6Z8=F&!n+3~# zpv0`;YWza;zaG11BDADMShw6T+wiQ5|22*FRn0Y|yVSs(RlTqRYgLTI_z!9nh*=nLF6SZ(J+7LSv8V#;4vaEfnl8YUHyb+^ zUReH=RnF6SAZ0qeUH72{l!vi|{Yk3~w^)UuF4Q6BeAtbPfjYR7)$4SzFdr z@O-j#K3XFdfM_%r1Cf1q%1-u7WF6@zHK6_|E^`8k>|I_l7bkF9aiG=U>P1;4YM1I~ zBReIfGiPFOMM+{gHQV35u=@6jo9jy7G3vS2UHBzugNsv@kGt5!a=>kQ2@~9ftXvZv zTkG2vm2MVAsLYgxgzG-!td9|6GqjlP63p z0MkQ`S+<~&Ej)HHW7eWxJu@PT58*1SN>Tc1Q)YREmDMZ`6*`}*t>!px8kALv+Qk@@ zCrVWY++p7SsZgXUDdVrX_Y=Albs9c4}?%vBa$KB0?y z`NccQz)53;IeX;76DJ(*TLok|ComoII)X0)rjlG4<2A3FxdLO%oU>p)|NBexyB5V9 zUU`Xv1;mResH=HZbJ3!3;R65UKfs(~)FK=6a1mp6HLlCyYD}f+Ed$UBG5VuVSJjj+ zD64drnVJ-^NNFBEOo4KYnv1iIM9+2K%D|IyEP&^sqs^~{KNr|$6|WrPsvzG~P+N(M zPu0AqxqZl6^&?qpR_VgZ1sq9v7K!t1o&=lBu?(z&ddB_+JJgdT@c z5wCSH_L>G;X7R!zBOt5p2{bRh@vIpuu!<^tGr(=Lm@cb%GEsuoAQ!LZXU^ap#6^^Q zPQn2S%jN~O?sW&$2(O)(5;PYgTnE(8Ok4?Z8|Wg879}$JLSY+~oI zX1epeJMOA`SQX{97)z^gE`UB)!Nhp25Ca=m&FqM}Rsw6?%Pj7dH=Hmfh9WbZASABA z;<}J$9nXs0-da&Rue3_7n2nW-a`Uf@B{ODmP_fJv0dxMO!o{k=h|q`YR=nhavp%<5 z@G2|rXVhBr>1@U%9`KR~`aIU(e0hh7;!XF9+10#Q)r;AqOi^Q2sKWiza?^?Q>?Z8z z*j~Yz&RfmmsAdl4=$i6D`S3MY2oilkSG;wx0Y%`gf=bL0VwekkI1x3bdZRx_3lyRM zA|O_EX!yA9j`xz3n--{+Y=+XRQeM?wSfXnzX6=ExF0Dq%RPpq+#OT5xQHhG5Rb4rc zOE0f87!@XfyLN(~DRg%dr82ci_Dr^{g%w=l&8i$=tiIA6V_gMquhvB#M%85<_nJS( z1QZb_Hk|OY`=INf9l06RvWAJ{g)5AS(W|zy7KN>P$E^b6ff}Ql891@W5`(uFOk2m| z&Hr+inax*a-RGtfN-@b}C@iV+E;g6fE~uXGE)-}F?%Q8aPBO& z$f(7&7IO~)eeT#G%nYU;oCtV*jV@^GrX{)46xJ5OT*0KVQ4UX$~SoSdw$u)G03O9tS0`=r|GOwykc(~83 ztXh)rOoXOuLQrkEP0zTRQK0#GH>;wi1~a|6jYPf1+XO_aEw2937b8*4JmZ^~5)s2( z*Y>Zqy{o;r%2VMrFjUf<(gis6!9=nECv)yH*s8*8j?sYkI5-~9M?tesm6XrLZ6{ur znqO(gWp{q_dX)wl3>jru_{`!0onuRlRWcLTU$9zO#BQ?)mrJW>VBuH37#C)0I1aNY z&3r%4!W|QHfwvs%J)Y$<=l;3eU0yerZ~3fQT>ZEw1KueC5@orVA&i${ap?^yn|~SS z$d3_SjmTUfYybbeL~7`nct=$!U)+Ru(&F%Zyp!roD-;P2O%0?4TU*gU3@_Bp!YAw6 zS?%o(fsTPr!LETGfs^pItQf){#g<~>yLd}mXW%7qiMM0n(Bd1s@QSs>#y5ElZymcK zuqL>|#_PiTetf%^-!D56%YF0N@YWp|ZXb`6jU8t#fV&Tpzs7UY)Ya zSs7XpZb%*8IYV)vUj zqr9wkE}kZ+#!|Svx?jconR6GEm4moTz}tJre}~&orCN#04<$8am-m~GOBD;t`wh$; zkb8RWpnkaLU0qpO+iyWla}s#FTVJe+7cB0}Skq=yV14)#<@x_WE#5q6RoE|AdBxg^68-r&h}JP#zqC8<1Wahfp0J;pamU?pA>*)8CNBki5& z1x|RZ`CX~wc6OxR35N=uK*(-g@3ga*6jBV?mGySJLi_TzD+`?zqhWQ(KEFPQVK?BV`=J$Zf|2DR`z!c8 z$N@XL-DzdlxJI0SgfgCUQlZTWEq7ABaRRAVh3wm|tq*v>?WJ2~GfkMX~<#cLrT7~Kz8@7g1&vopPPPoYFHO7e| zMu*Ti!}NMY9_^$&>-0-qU`i(&g~U=`5whRArZAY{%g)DvfRh=q(^Ee+scl4R?L+oG z!Fs3Favag5A}9ShdZK8SqYUfq53b(sL_+pI0^6OF;2bH0ubo!!q}e-6;nv%4Lrpkj zKLMlDmYM8y3SH;4LH@@%9WQW#W6keM#6YwlGGwae3B*bZ*>55iO8{<8CpMAxY#0%^ zWQQ7@&ZC`Nd(d{2-?P^s;loa=6^<3MpFvr-vR^|jheF>t>7yK!K-PGtEsOj$D9p5< zMDTPdX&V~jw0;`SZ@@WbSE1m>JFP~ekP8tf_#)IGP21jbO?}9I>e|#HPM?sy)r9>E z)DN?NgQPkaIcY_-{C~{q^R(^-RnW#1aUe7XgzOzx*E<;@`&E1h9HnM&N8}tx^$yzCNrg@> zoLlybHxTojNa`a_uaQol(J0~{Q8I3Byn5LFzp00i{m3=jS@rKD>CEeJv>gp|xzop< zm0C-?3T0OaM%A}43XwXajGqnJcV8XM3$ScHwYP`tO-r{U6ZqB)j&DW$XvqE-l*fwM z)1qd4u%oQvLi@;4(^zh?nQa8`Qjf~Ka=Vi;)`?umc9uTggnI+w?2!E&!gc))9i!0c zgcjX#baSIduXqxH!uFd+mwgkOcletYBSovjD49a%*dd~w{clsJo0p~z33l*R>OMQ* zWJTJ+g!<5!tGJr}CF!H6K-$2ccm?clBb{(TT%)`V;YcZ7TWOpSFwofI~9GolU~P`f=0y> zs&|H9Sf$*h(CLAY9C{kyS?`=!kIqu$bcbIcw7f-nzcuOE8gpP2O4&IjWS?B`^y3j`KBI@j zCVR6rn?pafv81B&$CZkVcRQn$Fe^u&3EykTyPQZyq+I;I|VX7;3qSpko zeGT|&__mAKX_$_m$0Um}aJy6Jv_`8f#?cu}7rKYWViD1bt-a9RNav7!z)5`wLtW}}3{F`nk&bA2 zr=d|}z|X$W=~e`R6I+p!eSwpT{<8))^+1a?CL*-kQ@f0EP8wxeD^zB~j4zg?*0MDo zg1WH%@U?K-y#%IWJiZ5UVs>V|bHWj)3zc(tUhZ_k>SCGW6ge3qovve@R->G*qn*>x z89AqN$uTNqzqDjKHM|JOp2^loK9}!Nu;1!SAUh+wC_H zpdqx~ega{PWv18MfFUOUGcm%4>~)yAxXefc-1(KQsST_Pk95+mhabmOE=B4?tI+q6 zSiOA^`cgyopCCm;hhQxG2XuC?$MUO`_SA<~!k`R93}d0wp~2~euw7ZEqnvJ|obF?t z{>Um)$_k;@H+lBKZdga#NS69)gbCOOEaVCcZ?MsoOB?ArHavXr_w~u~m1+iYmu`C5&>mUs#NWj^(cwzAzRm zI(O}hLTfjMEx^C(bNollMBBrt}c}w$pr!&eej49Oqo)viy zltAsCROE2;A~<6tM-n!c;x8jb=zlYeVPOzztPNIk$bh}gwd9>JW(`!}xaAE_76u(; z4Wa+Kc)MBCo*1$pM}W>FoD;{fH-|@|MWPs2A=t?%RW^n55WOQ7RQq8An*SZC!GeH2 z38A>zHzOHTYkeA5EB{_t&oOr+@{)#Cb2^)Mnq5*K?33wW+)jPT$zI`Pjxj~nmP_*s zSUc|{LtSx#fmo?_I>u}JJToKG(Di20!#s>OpO_VWGkD1UJf+^g>8e8ccfzOxJsc%YbbRalQ)a}U`uNOt{V3|Kw5u4taCQELYvo?-8X^;~(nGiG|oz87;~HpZxR zi|Sj_>PBTTY6nC~vvJB1gupIt&M(+@o?}tie_6<4u^+||mvmb86f}n-sb4s4 z&B;M*B>O~k3>DeWqxLh=Ak%^kI3I!@41rv+**NNgaV2cyqzcn;mm;V0H|)p$<1Sb> zjHK5IFY>&gjeQb|uFh#U+G#V|v5WAP8YbDM2*>Cd3pi5QcSkThbbZ$8l6r2){$zpa zG+QwubX(=L+F_FI78=ROS>}w?eicCw?YRgl?{{wS4^ap`FpI$aEpS1<+DG3zT;H#u ztn0{-eUmF5q1WmK=#NKvw2Vh9({c2DEsoZp>2^ikeph>ly?4FDuU+w0BccpqhkW^7 z^^?cV zS4MD1!0EcoIb{r+0&1J*8K;D>hFxD%Xdld|2hCdWkyd6@|5J56(|$hd%-p2JG-1oTd>in?9sq#{q(VnE|EX^hi( zHO`N3#c4hU>X4nW9pNndM_fWdXMLO)xFRkJMZdthJ|tDIBP2{`*dX_OhaGf;0S zSWAs#spjAqr(drjKHA;0%+o5K;bU>bt2(WaU@B6;2n^pEGh5$)o^3L6oUx>h-PRPG ze-!9qH{tXmE;Ry8ZoXZpl-usoY-h5bp%#Imi;w~Jk`E2qtF~-(%*<2bVD!ytmaUQv%x1?d4ptO zi$QWH+|wh$-W_-i0@uIX$>RiMo5MR#H(TQz?ShpnofELQ!njq$j)R8sE7Wao`>&>M zF@O9L?P(B}psniBMhYEV9%;>U@zeq*;{wP24vQ{?$I3E}0LTXx0BoRbpr7erkWD)5 z4A*YPqZL-th}#WI55(no$e_3qB^@@`t+!Se!kb>-aCz1}p%%W*iDS$}asp%9^Es=w zt9QEWa5|a}&z8FuEe6f!pRKSWysmn?yYAzq!xmeF7rnKmSYIFQ5%DC_wz6Buovc^W z{Qh06Q7z=|R>u}{PiwbNKfYXTZEYc+X4SQj`&q>;K; zw1_{-`gsev$Qs^49%uDzAy2S+x3D+edH`~xr{0=i^@YqYw7J^^>*W^lFSa(ckf&Pw zTx0VVwQg)7x3SJ^A-A{QgZ}#y5p3%=$cq#C?PBF2{M>~90P9Kkdtb(}tU*>9WPWYP z-OjP95dKR~w1!%zLM}+iBdjS1zcwLj3j^@M#>trsBkt3~b>wMroK`=;*J#yX;7sKuRvpIL9? zfX6g}au(9R9PxWf-T}`WA@jZ){ntW%5Hdb9X5{lA?}Xeknz1$M0@aWHt(nSHrq;6oN=`+d=1OD*%rQ*=-X^#b+dzQtnka7ngtx; z`|n9|_avFM+Pv8qul$>Bo#q#zk9V@0H`^M}Ea1pS|L||Nsi|fc+d8LNz>$4S`Jlb~ zHk%(L_HDMWC(zlp#`%0HPe_t4PLii4$t6j0X_8!)B+p8cf1V`IwLV9C^fug5wtnNQ za?0&|RZjUZ+MBmg=GS_?jdD+RL~OjrpM?+E{}FAI+Yszo!E`HM{&Zvbza^#DKo4vq zv1bL(vMO=ojoVzb>&)O~7QYYAZ436Sply9>B)7k01&gf33QuS1=SOh8jq*83>2n<5 zmVrGB^*7N-_^O$aPqUWF{!K9#nkjvJCLt@>-nzGi+{ro@;ka>(&k9DZA<8fB$!7&e zSih6Zd;D3!bF90Q>gOuSymy`zoNDn~>)iNkK~`{p^^c_RuSsULXIU3p9aSFFO!#ru zB*lkl%6qf&&-?jV!3oxzN%gyv0kyF{K21vRlBDnzUSN>nZ&vzrrd-McZIsu00!aCO z?DiFMobB>dG_E-~%wCPJ@rj)CYzz;KPnyjOk8aKJH2Y?J^HFT!Uuao5a?cZu{u|sc z>Sd$bQGfPL?$`I2?qSOFF^?cWUDm-?(8iZI+mdK3{OYki0)e=Bc8qrC*6e!Anhxje z1$brx;j(YU97#g&PV#bmO;2(G>WA`l5=L<@osL4C1KN1zhifMr6I2zMoNqRAZeIFh zTrnY!wXCghV!E`K`N=1dP63I0b8Sa^w~?@8Hwn9okRIb1yFjjKXxCEOfpVxLG5j`= z!|_!@685bXjU}F4-mvP)#YuLK$K86`iSjp_7j6Rd)BTnt_luHb3<`r84*6rdC+C9p zxo-X1=ehdr3zFhZa-S_?c-AY)erp$4Rt|~y{5m7!_a>9$d((ku?_|~Qh0uq7k_~b# zMh+JDYyc8>I)h6nBVK>QM<9S2F+!FEYIj*$57r`bF`n2t<6Bfa&om+8Jk zLZ7MEHLwHqlZ`^XpM?KL+J*M8lXf9o4C55tw~>`_2U+hggY2jL5WPJVU&bVdK|gtZ zk{y>M$(JU{tR!x;U7UIuo&|y)rr$xFMlOUq#!Ip%xdLCgBw;TeEi>(96N$$2G`Sw- zM&1CM!{7$ATM~L7lFYR&^YZ~{=c6Bzr=xtxLGE~GpMfu7QXcHum$36^NiwGUI+icm z?aL(W;#!&d%{JS`snhwa6V`7dEelZ$?;%IIYe_N<@yHP*#w)IogQMNAkdiM+-Y?py zKTN0ADdISBfq0kriRhr789qnkSH^>5Eo;7b9f^MWj@TOpQ$An(nb;^kE50ut5>G_E zG2Xf2l_dK6eInZp2g5%er2CoW!{CF^T>^EaI|3{F8{KloiByFr1uXSqsFR3|F2g z@+;=_e@FaI%*I2SbRR~dUq30H+S-*bCDG4*D{hLq@_&h=W3IeZ{H=IJrt7{|#G=9I z=`CI&)`<^@?}{mH-0H4|A(AASFwifv{W$N!F=7=YW zeZ&FcV3FqojK_JGEEJ2yi$z|;q5lk#>p#l#MV^mPzEb4+i}Fg5>n_SSiyOteMb7v1 ze?Z(SJ}K@HUlLyz{~+!X|0?blKNG(be-v@*XVOa*TZ>#5(T)?vQ^bDa>EhYqQ1L=> zjCheaRV)$9#mmJj#6{xO;&RcOXlt@wi&N^!$S#dcz6vAcM(*jF4Vo++Luju1zSxP@dfb}@h$OB;$OtSiB00?;y=W1#UI1~*BfP)6&72GZN!dZ zH?fy^n%G}FL*(@d>N{V=eGem#6DNt6ilyRgah_NsE)lO4agWUCTO-~i-Y(uHn)MXy z_>JU8#3#gO#TUib#NUg57C#g}5#!<);@9Fo#s3yluP(X9Ir z|4hl}i6g|(;&^egc$qj;tPpt}iuNoJuM(GutHgEUE#e*GX7QKegW{v&Q{rSK>F~zr>?rgzHx5Z6kIRyNSI-vkpeM{*uoS&k@fTM~UOaN#dnq zsW@AlC)S8d#B0SB;u`TL@pkbp@jmf4;v?d-qFJZ2{3QQTd{6vH+#~K2zY-6NKZv+J z=e9?&t=L68Q9MQLC!Q{zEe;hg6vv1ciBrWAv0S`dH0Kw{*CNSRi>t+(#M{NY#QVgD z#izvQ#NUZ;h<_B{6F(C7i2KB^M00)vyZ$BlsOa!K2JY!%rr2KWBAzIoBK8wc7ta=l ziWiDw#EZnKVwpHktQC1biuNoMSBdMyTf|?8_lR4>M?~Idqn_u)mqp%>qWdnD4cJSaPKDeCTCh!U&&{a2sd0DPa;2y#B0bx%UVZ5&+T&GEN&IIi?4~h z#69AFi9d*Gysm(B+Kau!f#OhcoOqddxwu4JCEh9iQhZF@DgHtHSUeye5ktJ50ejkt zJ;XfmT(L;JM4Tfo6dS~w#YXXAafkS(_<{JDcv!?O9Ai&R>?-yV&k{$97mKsS#o~41 zFT@AM9pdlBzl;A6d6R_Ykty~N2a3bRN#ZPVk+@pCLwrDdR(xChoA_ViQ8C8rL`c88 zI6ypKoG6xy3&mC9t>S&+qv8wV@5PVA&&7X=4zD{Q{WfBEv7dO3I9fECSEQ!h&PCLioX$`5?>Mj zEbb9I@%kFl?;-XT&l1lUi^a>tpNosc2Jt5GKJf|hdGRgr12HZh5|4@*yv_%^hKXav z<>DIg1@T?+BXPg@op@Bt;PpW0?I@lk4ipQ-G2$iSY_V2cCf*?4DQ*#;5I+(>6~7k$ zEvECjBkN!6B@PhJ6N|*D;w-U7Tqdp-ZxZho9~7S!UlHFGKM}ta|0RZa9TfJp5p%@8 z;#uN_;zY4joG)G_t`;|nTg0cu*ToOS{o)ZZwWG>Q>@5x!M~YL#IpSh*wYX7yOnhJ5 zEq*0_FNSfUm*vn_>@MbtXNx1nN#YE#Qd}xtFK!fnC2kX665kR3E`BL~FQ#^O?K(m1 zDGm?|#IfQu@#o@VaizFHyjR>Rz9_ycHi?HtCtG%iJ;ecHfjCy2CjMMpEUpwci1&)m ziLZ)(7I%wZiQkLiE~+oFyO=AUEshi?i8I7XajAHnc$@ee@lo+P@eT2P@hkCL@!w*4 zSJ%D{VlQ!kc%E1!P8DZ~HR2laR`Fi(5%D?kE%8HfpZKk4cXRE@6uXIi#k0jx;$*R0 ztPz)qH;Q+O4~ox-uZi!8P2$($QL$ByYgcFS6!8pkgm{ryCN2XdX61$40ii5;q;#lz#ah6yut`=_;Zx`-xha?yTu>G;7P81>0$@5mpDMY zLu?ech}*c}iNh}qs#UkW!Pn6tW93oyQ|Iv~!7E8rBB=padyhQRZNTjnx@{5xH zNTR$ym3&C@50W!;-FV$d=sjH=A&wP)Cf14#;`JozXOsB2_#rt4_aP;JC4Nti#eJQA zAneT&vq|VVMLb;`CXN-Sisj-WavZMbN?u1o?@f~Ll6;Tkt>O;3@09$u0Ebf>4 zmy(Z2{!wyjo||3<3Hv*U-Nxo;5flKVrFpAcUW-xK5F z4`Oh3etK`03yhFTKe2AQY z=Zi?B`;y#WmHe*c_a*O@{F&rKlE0ITN0g1-ArktsB%dI;hvbta4-^Z;B5{gXCSE~a zgzLMKSCJ^6HIi?ae5d4JOMX!DQ<9&R{F>yqB>zS7N0PrFk=_xxrw(+}%M`Q8iKs8h z`QrKHB+Hs0xkU0DaXyK1xk_A3UX159B;QRUU-wFWSn^|%pO^fSdhpPepm4{aR505&%sL`Ny3gI$x|dxlRQWAT*-?iFO|Gn@>5zB(DRD;2XPk(y}QLP#D9t@gIxcZm@S?{UV`VZB%epZuJa|2lYEh6d~neC z&y-v#xkmD}l9x-qQSvR4H%q=x@+0DtB`WrP(gRIFi^*wtexAI{vL2EDGxC2){Db&cai4fl{83Ch6MBAz z>vSaS=td&F6D9YPJW%p5aje`YNdB4R8ItEqu9kd_iN%bwyOag?}`EWx-e`C$_Idra~RJ1CT;Ubnc#(knVMVuziAuo3SZ-cCoTr1X*h}0mi7T1a! z#Z6+Pc)z$++$KIP?hs!mr{ez_#COD9;s@f#;(qcH_kVTCgOU%6N5mgRE8vDt5o03% z?}YLBe;Z`BXr9kSzu^C^v47-=`Ql)4h-jYIMYtl##iDs`7w*$3k97YJiJU_j^>3cr z1*<3*;{Rks^ZYLAe<@|Kj>P$gd5#xcO&RA8YsK{>&Kov}8%eCMH;Ij8G5+sF+(M4W z|7D0<$qDZNA(2m0zR0q6h&#!N?*CbkuT!3c`V!wE(QbB$ACQyX|Fa@@Q=WqJEO9@H z`uZ7;hJ|ybH^c(oY%hbzs`InKb56KNA>SK%Khe*`R(~?d5M!mc)`E3&QV%jV8 zoA!!&v6xTDrhTGbVv^gEsE<6!`6TM4Sn@;?^)X#?8Hsu^?FRblD5G9Xdw^`(1M0)n zKV(z?s25X@kl$f=)QhPf$fkZ!FQ%L!n{r0Im~w?|$`$oup1+2i$MQve3?U&GkZk{w z%ShBqm1Of=^>p|D+RXDCbVvCY+93MFToUEoF$F|9Z*oAC@4F<*H6sL~Jg*3YD97KD zD8Jn#%8l=1V0j%PQBLN0DwNOUG{`8Iwh<8JF@QulyqEzZ|5ICm$oC~N5c#bpkz`XzK4Zb`lF}J7_~9F4s(Gb5UkUGh zP~v#{nVtXmVS=BE^gn;~AQzvLG2a>eDHUEhG{2nQggmC4n*C8we8>Lr6#74e;s3Bf zv&#P%;yAV3;&TY@%l(^`vD}Uqps2)r@2aH4G?e3nU_`uNKly7CrkUZJ3)K}f7S!Sc zX(lDNPR)mo<#HS|TYl-HrG-g;Esaa^bQ439v~r7b4Su5av)X*0$1o`-+2#8hL$g6X zM-)Qy*D8Ej>aAzmPk>vbH?;!m*S38V~gZ z_lsrvaEkeS$MI~ZT4pi%a~1z7Y>Q8j{A57?S2y%|jh4A-(Omo?l8V=u=+~w%ZTtsq zUWk@WphbdSkmFRl={mlTuQVr=>|P`zOAr zl5F>X49xmL3Ag+{&QB%$AHVaWj}uWLzAD9Ul=&-(V)GmOIWnT8tlXL<^T?j1xwwqb zvn+Rj`R#wEM$cS`rS8wb!8{ybe)|vh{2`X*nxFhLj28St%Nd@3f8&Z@cQnp5qWQ@m zWWt-@0fRjM{zk^H!b2>}HE#K*^Kc-3Va4g5e}5z6SK*C#Iz9r$)dD^`g(&&>MfS`w zu4yV@f8&Z@$wqX42AYKMi-ZPx{{4-NUxjxAxs7}-J{OH|9#tlPGKz^0Fo~Pr0Rz0q z{UMj-;#bOCZ-&h8ZxT1Z1NwXZ{UMj;;#c8~HzajARA&F&{>ZfX8VtTaw}_u`o>_&@ z1Xt&oBET<-!2Ax#OK352fAgD%b>jbWHrTnAwYWN-8Iy#jZ?zMejP=?LuUyUW#=C_kQW zGaZKE=IOg5NngHCA5K*g`cA<46M`n}dl^DD9khA+vJlR1-*D)|>5nPDDCpVu1>)i_ zVc%}VqkRm+&C|CJf&BV5`Rv1~QbONsM4&ln4rbdAeLM&BHcub_|Ix4SA?TZqK&;<3 z*cpy?obBpM*vI!)(4AqpdHT*s(wA|#xqfl#me6-uQu`}|?C(pSzKh&&iF7wA-S#Hc z=5+agiT-?K`_k>;OPA-h{&H!Ae7tmTcEcso<$H~o-%d&C-T-%hx_x}2_C0FWg>)^OwuZzI1yaEW*rZ+xJ0@s zP|o;0v2&w7Zmn_PPj{Cu-Cpo#IL2FuME&VzAkrqddz+_^|L5=5_bK!-KI`LT?4G_N zS6{+D{+|}ZF$_0P-^e6=U;6AjMd284EOx(reE;D)aPu}#A1>Xru2ezP(tR4?{N?gA^s#?_T?)a;~hc2_S-iY`mmHpY@WWuN#n*e=wm)<-yrOseSdKECF-pV*Ugv?!*KKT zy_uwMtyT7_eLA@IF$_0PU)v;o_xtR-P~m7F*D3z` z&4)fzabolI(PV^6)LVhl9i@<7IO_7Zt8Kn?3*qPGXkmKrum)SghPr2a|>F&;P!(E&d?s0_kr@PjdE^a3z z^06Q(-Tlz_HVx6{rOW#letnyu4@GFo1-By-`p!+VZ(9%7K8E4u={qY)-!`9pxSf&E zH{0!R7N!xi?SMYMOVryuQ~wI%csxKJy-&v4+lvG@`f)$%+NV&KHS-k9`X@7@&C|#C z2Ke*)GVEK7x@0@R?UaOl58>F0Llu_{LpwQ+eSF`HKioqXSk?``1)JwLJE^@4`2ppO z#Rk)zft{+^Uh0rHFAhZOtmW>#Egp08{FWk|KOYnE^5Ht=qYU9ZeP2nRHwOHC1@19& zz|cm0+|R=g>4kgvkCx@NJqGo{ZBNQ?3I_<^#&F!`B3%TnawXV?s~M}9^;Ikty{O&9UR^F zb8CI$p5nmzc(AT^s#3?ufq=+Z+$XZrp7J8u$GB=+Q6eR~)!5j&rj} z-S|7=0c%nd&gr%nA*@x^*koB3?9R68_GVkfdr=ONK-H?fjx~AD_eYQ7+YyuZw1-~C z!SZ0cHT^adr)VhRS{ve_SaTX!mYTTP1r2+{)}%e(9X*O<8k-KTd2YX(&LqCt2X58@ zS8i;ge%Kw!fz7EF@&dbQb8+S!@o-?-zGB!I4y@lt9d9F|*WI_i&`@{qLX-pYW;Hf8 z72mYJ9qz1his}@Bo`b8N+g~?+eLPSHov^(l^P9Qe*dB8EVFXATU7fs}t{G!PzZ1Q^FBOv9k+t(;vWQVg`LGs*PA?`Zexv2 z9|Ts!W7fL8-Ete74maK!ciY4zO>@Sti`O6z*~2!+Gm6*6Qwna}P5bZ9{43x?~Tn08&D!}6BNMNHJ;l^BxhW1g)w(^Nif~?A$Cwncs%}U4$xZ)+jUOL9dVu!e z3B;xkP54_)*%x$YzL0O&l%47J8R|%#err4?IfS<4>1F*DA-{~5)_?sz#`{uzjbVQI z=$moIWtAY zPrP=M5xWaL$l=TY_@x9?eXY){2af0o^B zQ-@>Mp*&GO}{-p1;?-B7&CIy zMjSiSE&FZAb%6%Bjc*!)^dd3Ko||`jd;|QiL>Yb^yJOG9{`6nAyQ+Ibd_B`af2#{j z$JoDY_b!YPiToiStOu0Op1QyW^cU(zxbBU6yteU7;KO*v`gQRfv>A?FECY@oMX-Tk z*7n#O_u8C;a$ijSs3$Lt2KN2&4bZzG&hd%v-W)UyIu=9UV9-Jy3c7DF;R+Paw$_Ak`Shs!N*Lokeu8aSuert8V$@I^I zzJ8tE$T*1G=#FP!p|8~~+kiYwVScw4J-UJIqA8;a{;@mbVXvK`?9lfkf%Vtz&Bhp& zYE9+bw%zDLc*>unPH9)h`s*=|P2GcWsZ&M{$40bUjRm{WpJUU}S92Ph7I$a8-4@S? z!KR#-<8x7`y>VR2@3N)kZ^o;Rm+!wiuq$4NI_0>yAAJhp5_Oh5R-xZ^N_Iouk8wkJMH<;ZeY!SaT%rwZ zGwe@ZTj9Lk_MLTmF`n#C%|U)*H)H;2+%u-%GW3V>O;~4ivI^?rDRqr|yfN!*)Q#6J z>5jTOa6dAz6#EqH@1U^xoY!jX)3NiJusrO1HjmHueTh8>J368{2SnR6+tx=?>JAR= z`}qZ!LyM-v{sLp~o>u4=nV26#(>WI27H=C^XWG0OXV8~9o^!77Y_d>SZM$=h9KYuR zj+M*Yv2w7|dFVXHj5#S7bMDu8<1crkcdI+*{0ZgTfH2qi$0O9~87O1Sse7vI&GB@k zAFJd1xOrc;br0G^W7D(~H^=jKF54T-*}QM!z|C}5jw$`$E zopnb%BX1dYx2^27mSNo#uwyyP;#)9hq{IU8oTkn3*1I?F`__7X|F_nC*zd-^eE&AY z?Xz>4X@eVMcc2fiX}1Y(Z8O&xx0Jvdth*YUn4g2z>wBJt-`jyTW{ois;Wy!!bsR=s zuCQMCjBABJ%=+E?0gG+?zG7AxclYIJE0H9Iqn=2YO`iH_1}+joQOPZpZ;PzFn#6T zZN#=W*{l)0RShVLK7!#(z&MT(B@EPNvDR$ZvxHGXv9*OeUq4F3GUALimKCSVo z&bL-yYORUWe<^fP5BqHl@mR)-Fz!E!JfvG#7oknK?X$QE*8n@E!Hx0|#LGbVGp!Hf z9LtgKPRZeiLMOwsT`^8&INU^i^R0rWSYUO0LF-V{<*hGh%D^$>GE5%y<|7aHqwcr( z^ap%t<7y4Ygetx=080_HZ;l1%H`Kv#&&qS#3iE~XzXaFN4m_lJ9(Eomfc^m5%Tp-J zjdJH0!}K}+ZR&of8FL!sM|aOYu0MI4qOm49{eUlh+K4slo2at`L!|3d9P^#|9Anm^ z^2$Jd&#D-E5q7>;JsW!t{I;No6~mL_JS!ItgI|>qqTPvm17!J?_~WdlK&BxrU7_t-{)& z7-K5RAW*zwFV1Q9V2s4{cYFL`&W893oFiF*n=y73H(_pyMB4{VnQ@#76pz@8um=jz z);I5ev!df@!bG1`I7KJx1gzm&Y@^O97S<%Q4fM>!v0`rh~+R9RZZ>rA`!-0dXy zU6^~g20d(Tz&KId26Y_C$9Wm+jq6>GryTzeS|8v%t+)y2I@`B2n)O)|&k@-tQRD}V zKh8_BrpKDndLVoe$|&ac)B7#=oaX-ZE8^>8Pna@0gfeJ5eZ*eQWhSi{*Vpb`^9Axk zd+ELu=X5MHltCmP^OtF_$fq}VEiJ~H4q^S}kcT?w&U@e7c@M2Oc5YiA4w&=v!#LLo z)S=B6aLk?Dl+AVkz1{A1>oETcuJtB2;j%?!NU6K-`xk896~KA``6@8$^OfdYf_6@U z`!lhvI6q#tcWZ3t9+aoC`%AzsUC6JUOzs}t5B2Uz|cmNlTyaJ~O> z+?FT(g^ba-ViIi6$P_P2{sepMI)r(;d1bu8zS0Ok(dGJBv{@j`+1xa3mYhW(y)IVv~$Q(x$c zx_t*xw_bSkk4UZBu4lj3zNb+qbWDN2=l4wDgSh4eoNK!NLwx>>%Q!#BT*|h`YZaaw zbsQY(jt4!_cy^)==3>X(XvV{b?XCWt#vKdba_}$Salq~ z+;iF^SjXLu{BrD_iLp2Dij8rOzeDcX2)DYXueaU~+b+R%j@RQ?tv~wN$*|`z&O12H za=d5@Ilq+W4Hq}%;5Zd^h4CtKf8c$ilh+q&0~_PDnG7?259X9k!_ilVXX3gM^2c)w z>LI;6qkWsUJmj90@gbOBhp^8h?6lIlb_F;t=+C(Bb%`>J%VlVn-dOGGnA(K-2Ipt% z_OhOMU5D;PLpP$F7Bu|J`Rd@tu@&Ry_S8niS?{*N+M(-ky#Qrjyuq9| zdh@e|bHLMaZN|hy`{eaJu5U1=Za-{sJSaAOH}xm_1l>)axR!l__N+2?9f_@v=Vz{t zAE~Ruc`x&%I?8mfJ6!9#=78%!O|PQN0$WG#O}AIE&9s~ki!mP-Xg-8}0c)b>!&@;Q z-X3pAnh&RSUyt*$38sEp%#8)Z_hS4x&>Iy#4egoxdNwL-kDPaI-9cQ>VEa9+af4&P z@#ZfCKfpRTqH&q$_+Fb%kZl`fhp?tCn7SNKw@K#QeA@KQ@o80Dx8JxsT!nsu@sroT zESwWUN7GM@tKl4Ptaf!_Z0OV>xzCPt`z-q@cl0~6ZN0IfuBy7SwsL0W+>(WJ@SI`A z!WwJgoE#oly=u;>p*Vb0dpPeJQISwAahO(SqH957F_>EZArHc}w zar_@b(sI`h#O5>jE^M@7{4I6s?=#q;rDk>Q@_JVO|W zv#QI>t(ww#<;>08ike#Md_34|@_ex=tCM@xoSaitSzVjctE><9M8<0Rj2~}M*@uHma z`Fzg0EMl=Ja%#$}7nWD6z+gQ7`(t5F&4Map8~%wQ2meD;rNTr>xHm+sv6VUaPngQ; zB{{6IMddSUDra7fq~(u`v9%@CTry+9ETl85vhTTew{FouR4-mDGBslwS$TCeYM%|M z3T+I}*j6s_xtq#ibD3GYIMKFcd5MBs&HiV>2vlC#5*X|@TBFd|%4!~vo1Z%%XYt$_ zeFx+X=%06H|NcM!`HX3$W%E$J2#J65s4kdNG%Vp;SU9Zj!U4H?xp{pD<>&RCJ^0K) z`7_JUEVEcueJkhBU1E;T>etV(h6l4y1LVxv6~ws=nm8~ayvOzFO554!%ID|QTwa?q ztGaR?+Je`m_>{RRDlf17t=q7m_YBh%xb=WgQ}AmxFBHA#Xj_@qW**dH4_K3l)t);K9&+8c z0k3=RyKr#Wb;qySJiQdKs%K7!9PBC9H-X~KJgUMD52n$8-SyarBR7#^9GT6ptT$Y+ zR3tt%hsR`vgLVOSlNBCJ!;Y*FOwqXWfGNSa>9$W&}MTDpNBBOew>p^&` zFY>9r$gldM%?M>SPc?N(gM1PtPPr|1v;~5N7_g=i=HG#>t24+st~0R%^&5mU`MRm= zNyGx7c5o-FT00Kg_~y(k2A2Nw1^!>{bYg{VxT@ox_T~d)^p5|Fc^`UIp`r6 z0g+P~W37%ifV|3s3=%uc;RFOWn`clCB)9O32{+}5)U(q>m`J#pVfmZQiwo7}J{eNT zz#+>ExhJNX!(tZO>#l2Z+!&lYxS^80o`&-~#_Qr;01Mbx90Z z?H(qp_xdJb`%7`e&Tj09=WA^ z+&D24XFS0QMc4GzD;&(0C~Zh?1T%PTGu3m9l?*Wid(g_;OuDVVnBZwF1}GxW92OHJ zjh;(+{jbVBtOH!_#|&m1fZxWBX7_Ml{|f}glJ~-vb7O5Y{PD< zg$IYRqrO=~`KGvwd&8i7W7{$PfU11Gcq2rVBGG6Li-~R6-TL5>YyU*r@3x4gsfXW2u{2u#Y@$blfxIlVLEnG z8a!ZRbgF!)pNQSK^Wc7y-ZAsYQUqUXq7>uTY+gQ^>)jYkjmSoFsI>{*$1Q7L18hW8 zly$NK${gA>!Zn)1Dfl&;XABF~)it>{4)d@dXZm7ia=k8QLAn_`#;!T=V!n}^xirl?nF-hHn7U%* z4cOTMNY{j83b-x2Mq)>a;MZ)P2}2+;#pATMX>guvyvA1n%x#Kw#kSxvQ#n)Jf!*`~ z9vs1boOuDR{_IXSp_sVYJd1K5^}!B{2wH(&hF`OJp(w<#BNXwrDY_}|00m}bI;NX7l3dICRrLrY~hfRlZS&lL#Kn!H!aHW-nEp{|f zq7HkCRfX#05yuv{a(T2V;g@VGXKD@o$zGJ%R8b?u+vf0?+ND}_ z^l@GBYc{W-J3#uMLoG$9t=N67CXgBE)w+#iw~n>%+&VL0zV4cD*{w&lIV=5aT=%x4 z)+k&aPdUlJ=?SlM)6?M*N`!KPNIe_~FkEVPggXP?X>9^_>-2OeaWIm!@-#a9_mlJ! z5Xf%r`en33#FOy^U@ONY(b`0GT+gU4BJ{+X#q{)6=^5#R;h5Q;DJeo$LN(H9Lu=F1 z&&6R|V;4fV!*y2cgcPLNY+n1`2$v0y4#((6)Q*XqK-zlC_pb@c(Of16CS=2LMPa1T$r9nfY|n!;Xz4A(IxzU)o zELmfOvlFFYM7(m-%_9Sz^M~6P)=Ua4Qnn< zSM~YFv7gotPd8m~M7pV0Jp1cb)UCrhGS?TnbtP%!adhDShI|F-upkQ^E4vlTZ*)GY z94FDt6%WSv;!_^WlHlx{vuYsdV0DavV>*6POELNdt(0;cr*%ICJu3KlDAF2wSnjkq-S)F z3@;8u_jn;kg_j1RxoBC;kUchB7l?iXKO>C`Hw2;~OfZkq>ha;#foNM#x+uIh5Y2%! zxI6qV4X+PG`9%_b{l=aa-WZ6U2k8;$wM)W{f#~^=hBM^!@cn`41W3k~((sl*w4zyh zC=jiKRLqd`!&?K<-#}u?+cn{Bf#?g6_`tbc8-6+vebbW`gm(m@??Gb4+6%)w1JSrA zEegLJh#vB!#o^Zj(H|ihomYn64n#A$DBjZWJAqhxPr4?Y66m%o5bNtXTnmS;a5%?v zsDncnIE?cgmcbz#4rQK0Jsdj2VV>u(91fk}u+DR6fI~+(Jmfj72&V+w!+~EtF}YcZ z5GTOl_nyNlIJASq$DYG#IJAYsepH}|avdDnz~Nt>!}V~;VhAtF8aQOa;fUw377j5u zq~hs$qhlQ$qHy3>RE)z7aA*yOQ#^+o;m`^WBRq%oaL9l|q33WD9Ma)1&2zXJ4tPc) zcBSWV3mnqmaFge-0S>8f__gP7D;&abc;0i^42KXLUiKUs;o!jGZO`EzIHbVgW6$AU zIM{ID7ghbA;uH+a%3;k|+Ay`J=HxG4~Q%#&UVe;SBB=}E7L2VRIV)rp*p7n8 zcjQ9|nH;|6IC+uZV*=_yGb^0^(N7`dQkd)X#sCE~$5NW-^a(^)Lo)j2J9&ZVFFdKz z861c{{tnm{yl=|05VV)ywk1pcUx{!I=MbFeNe&!aE$2 z4h2&qyq3am=-S@|Ga@_z`G&%gU@ZC`1T!!EE4V)x{RYyNESjUigTd&(A+4lj+oSDh z0Eym0DP$L=N85Q)*dCi6?F`9`jj48VdbFD-rP&kHqkSQn5iep-Nsscs^L|M!t?X&( z(W#J3!-&~erbll=dPd5$@xe};tuUQhFM+$gJDA0K8js_YrOt35oD$~$^_l7UQY-Co zIHlT6!N`0Zn9SnZVq^h?bC_NnWs*qXvtTIlTlkpN_65UM7Q4}ExTGv{mH^>k7Q50f z=~C_74x|R!yhwzzYT)rDJ;pkJ2b|O})yNEU+?Fc_oKf7+Br_-CLEp2w$Zr_jT(0@1rYuM-_BGkTvV^>nN(GZmX? zy&S7e^l|tNWxSIdt8H|4(^ z)7x~)ZD(JBB#TywlbP{ zWTmqS&1S66g7yvuFtJR4_Zjpf{;+f`+l&%yVBs&}XsXAy(pDjIYA~-|WH}DZGPFPP z&&JN6!2#`3tafS7VgP#D9_2(nK_FJBjpcSE-Yld>K5rIc5x&(#!8$|^Hw!tDA0Ygl zgWPD0c&tX#p^Ka?5l$rs=rhK7D6$j@nz>`Fvo*51S$H&ZbF=VRFb|wa{cp7KmUBw-#_0B#C-Dw6t?C>mXG;n6x8NZI34rNdI%gm>_JX;+wBDj^9Z5R#CD zMTK5M5+Eg8v#_}#o2aO`wJs>Q)>^FCx}w&#E)}a*tJR{#y0>U8E_JQ{=b3ru=G;qY z|KIQXzVl1wIqxj*yz|aJbMDMg_YWXclQPvgR?9yHHX++_ynibBzoGnI7gz?pY?!w8 zb*}Q2>UeYUf>go`c&lIrt&}X3nh)(e!W|v(otW+%hNJ3R_J)VK-+)lk-4!0`Mv*hB z3;K0LFg7U{JML&As!09;qElV!{NWUHyPr$;REi^4e?0$P4^x{JQjY-{evMM5C7GD z*$_{J54!Ig;>qya8Q+6YvON{XnDk(VjXY8G)1bQ@%;;(8XFzv7m@&xE&w@@pm@&c7 zzX#prU`DQ?p9Ae4%qTJRe$XigGkAf#;{QD8=)sJi82S&OBL_3iGxQ6f!v`}iGxUp~ zor4*?I9`Q+33TXS#+`=#BWU|z#?yv=8FcVq#+!zI1$5wG1}}zJ;r|5MI+*djp?R zazlJ$N8JsE_}1xjzN5HydI4hQ3R?1H?WO_yRAG#!t%C zTy$UvnIFP@@>9AE3PpXh*1@6FK-v_zu@$z5gt`aPW`R13bJ3xpUV*e2sQv>%9UICB zq@4}w$9+JZ5XuUqT?$GyrL#gi18G+qYEEc(AnguA6^CvPq}|m)-G;fgp-MuSwLW5~ zvJhsiFB@uJ2(#7}BwS@!c?h%C_u!_eiV$Y4UmL12^eE=qnc_A-^kg8-1EnNe5PBw% zHquZFLzuM|8ER1ov)0obf?n?mnmJ;6}T zAxuO9D22-HC!r6KMnkoP{*D|qRBPx^AdNSya!hEqg+2+SEihDj=+i*jS)ka>+G|3G zF^1ZV;-|_z`UVaGrrUjO_ePXU-sWugM=6iDiUaLXN2@ppMLxbTGT2UapG6o|-bSGO z^Joh-nK|C>)iIeFiORsih)V7#RE94>s0Memo$X?|$-0h_7T81FV?n4n&m4Q0I~v5z zbSbq*x+Nf#a_89-+(jVN(7oKA?5+Tz^iye1bJu`S4eosVWcLh1EU-_p>}Ig)dk>I+h8k1)aA%YCGK=+=QkZhFP9@IamjFh*Fj{t`#Xqi_mvJ}hMX}fR<{O}&(E`>Bn29rq|y zL-R9xLLhA>sMW0cSJ{~5orbxfis@>5S|H7=Cfe87(*tV6u9}l;?fgJm4ScHnzRoTT zq&0z3i*CE@;y~IuP_MG7*=?5v(k=w08lD^M%0SvBhPu&S6iE9SDAgR^WG_bJ0_rae zcZ%e~eR+uaQJmxj35&2sMn zLG=eOb+g^a3~{+T#C-t-vm$tOPT3zsJ&;v$hn5DYlHK6;Cbh{xP zOnPvqJIWnki0j-OcN7REbl9xjUM3jEYR!onpDguN7LvsGz32*&BmQ}*tWyuNn@{3-X3*mPz z3VGz08JX31FX#ImS()$SM@owSo!Ob|V9$G{BX-XatFo(xEheAtnSzgwBlm{fcm%6tj$Z&C7p zMlG9zkr3}qPyY-?4mq6Aw;y0aq8na-ihPr)EEv+pH< z%E&_<+IYn3$j8S*nQs}*JQ?lC$ET1MlaJ3JEqG@`7WsXzj(p#rk+~oCZCH7a{2?nd zh&$mnX8STgN2#v@qRw}|E)N48{S!%Bkz@2_Fb7s{6jDvfMk)PzIOpqBQ2SSOd{K? z%rEh-3h3%k=0dnXj$ub+EsDY?4E!~Wat1E$I~x#<{5bPl1W++FSSt0I41jsEeGFbg zyhA>HG>nrOYJSRSK=(*mz_szxK(9RlIBf&OMiM;(A-4~Ri%IkjMBQu^txpQf=#f34Sd5Y0&9^gmD|?iNBL=PQlNk0cJUw~QU#J=wVqLEFRF9Vs-$QG-k zZ8$GvrT-FsccNfLPU?FRAR0L{ldC8DVI4W!%G?M$6>bCkz6Q%ydYYTXc03fF?xldl zItNUwbHEIGr@*wmGMFK+3MO`wQ&8B_d%<`EbYyzp=K!gZ3o`ctRbkz3Wj zi{aj{>n@lo$0gfu1|4Fhw|}MFbt|wB?;Wjz-qa)`%YG%%7=@YyTus@HxGbT&` z(bDwmO0ND`GhwUw$K|o?(TQHM)k$B}kCNK5%SfLNL(}QY@ft>38(l5gQRa<7<7Rm$ z!wh(ZFoWJon6`Ho%#gPorsLfRGwj_1GvYl1GwL0Hnc{r`)AhnVuoCF?g_-K*!0hUs z1hbo01~bj8f!W<_huOos0A{*(9n7BIT`+rjPr>Z%;pd1}AMab3p66l~lHv7-+1DEb zGteF?fj zPGTZg+sp9k%crd%yK;8XRaFL-QI&US**G!U0q4+_FjD5AHBJp);@dCB(w5pUe+tgQ zOR-;mGQ2Rl;ALS{#^+$&g&Rf#U>!U^tRv-Sbyp5U^)9%TE%Etw!PTnZ4;+mJyM?`v zA-3i9z$iZ8O@tZr7IAOdI|F9O+X2(@_P`8#FT#v?U&D-gslAy!qhY#U3Cu2DJom)8KZx3>vqAMa|Ip7$G=8Q!xn z`+EF&Zzk5hkceY$L}zY4g13~H@Rni!!B*p@eXy}##9ZT1*s9f%moQs=7K9oP{n5sO zK3~93=o<#@k3xTMa9LNk2VQz$UL34uo5cC68cUsSbr}xZMz{tqO0jeBp3O=&P*qu~ z)eO0c;M89=lgD;hjQ7jY4h1jkF(?$gq=&l&1SfF89X%{}I|#Mre<_OJKo$U%0gnu0 z23%o#76h}rzAyvc$uNW73YfNc9?Xz;ElkI|8)n#h7G}hI2WHg!0cMJqjhJ2UWSCt% zN|EX{!tCm8f!WRbIm|TgS(x3u_h9z$QU@^u#=z|9Er!|4+YGa}cR$QN-XWNtH)t?3 zpaf=LuLWkNcO%Sx-or4nyuZNg?|lYyfR{Ri_2W30+1_-R1HDsW4)WH+9PC{RbBK34 z%%R=^n8$j7q1dwV2EZKVjfOegn*(!%w*uzz-Zq#cy*prz@}7s8<9z~iwAbTU%y_*M zV2e#e1(D^d#3;c-Yl3wuZ(uy=`f>S4b1LdBg|}X9n9(8 zW|$iS-gZLJ`xznR-9(6bdjMT@$r(9{jGI%v-@&fNdjsY(0q-Ng{(xtVu&h4>yez;S zLGMJsuYz7N;Lf1846rxoodMWkdzS+)wY@!n%WUsiz~#30R{+Z77l12muh;PyblTo% zz|U;26mXU8tpZ$adm8}P*xsdpYi;iiz)stH9&nxQeFC`N_PUJ3pxX9w0K09k5^#g< zwE{l3y((4n)^9pnAkTW-eg#A%=YS;c<*YM+p@ji z0lIr{!p!!*gE`$Bl%rHQhY<8u5r%kM2~qEQ!Wi#qLbi8^Fx~4m8UUq_P#E;4D-3zO zfPDi3ov*OFcaOqs?=K3cd*3TWK;DSHVFMz=jUjvqd5iQ*ROeRHI3^$neZ$)F?tuAW z#N++uA4R-_fWJq){{a3G@dl&p9Ex}+0X~j+ivXWQJl;h9&xps1$3KmD4+8!b@!kR) zj(9=v{w(4R1N=MU6#y@gKwn88o`%$@p62i zEVvdp@_Yzn?@wV2T~#MY0ki~%@DfEF};YF;{z2crcqZQrr`H_Xv0WytkKuODzJyM>cE)$)jJuF;p{rV8{Dn2To4NU ziaxYVR|P>Y!8JWr;4wyX+?DXlkHG?uv4$afeHS<(_d zrF4`6UQ?)}C&_=` zr3l!Q*>gf*p-yob#9+GHMGrLyD|#4Cz3@9{_40~&=>;AmdY~Pfju&PQf?6Zht?nx# zl(s9Ar+yNoKmA`alR6k0pxczK2&9rdRGqUroe{6fSla z&`r}Pa?2I(+{~JawLzk+2z$hH5QxQw0znZ<TRG^ZueE;r}0kfz`!77nEEc<8c1gcd1d$1YzKEw`rP>)^=ISZ-Y>`% z&Z$+PRbj{qvT#hj474iTLp8rYf^K8@!9ngLj$h69@pcVFR+TLqk*XI~;}O3^vt5Q4 z$ylXFmI>u!17BDw?lvzW76#gER)t|63&ZfI!Q&M={24EYltV|RWFX!V|AYg->^VL# z54pv-R>L*}?djwrY)8YE=Q<_$)pC&)1?KPmB;!XMgW~;=(5hsHp)31Y-E1Va9Vey3 zEoD5_qCPgTM)rk8@UawC7?`tSeH?iV(ALb*u5`2PE_m%0o`_~K5S$iu^WcjigC|9C z1R2uJb|E+;8gk7-aF&1vwg=;V$M zWzUIDbIsCma9eb`YgUef7e@14vv3@|BwFb1fdpI#3SJ&9cDa|uO^M*nXqjuahl0DJ z9WML zxCi$|>s_;Q9eg<2?7nZpJQ{6tSy5O^f=@)(x@PAv_`B$tuGxYMJ`>&Gegkhxwm(ES zyWJ<~`Frr?=r%Xo5Pynpcg;ps@U`d;*DU!5--%w~nr+D72hposvzHnCB)ZeZx9&Pm zzl`p7%MI~$^k#RJA-;>==3Z!sV9Fl%Mni;B_Qp47gDEL@yJmAR*gfTb7mJ;mb$ZG} z?(-m25_+dR>Y8ng;NX-eU9)x{%t?91<+8r=HX&ud`xe4*;u1U|!53=B(OKGkNmJ2`l%bq3q8lT`gvtwuh==@v`3 z64L$fBb&gI^T~Urts3TX@KU^I+Nxn*3tBbYh01;EtDw&!^CJ77L(!NHM>u>IV} zkz>g$Bt!essVOtbV){lr03XdAK1MLa&JNl-rINY&iOTHh&3NZxm%EkUTXj7ael44? zx$EH49bK6R*2pVq9qA}E){I}%W^Pou>*2(VKhWxxsG@YZ8K2VX z`xN2Q6~h2~fi7c;x$4YSkyFh+->f_uUm+g?OLnqYJmE}Pfh<-<;0cGprv4tZ>YJZ( zSlp(mzV{i2!KX%$AT@e<+To~e>ItA#@eud>LGvq#!0((-FmzzCw5F~xf!=p0l2wom z6L#pTVQyq;3x`#QGW-A<@9l7z$u9NJcu`9K951GOVVc3_Y8IMnrO3a8lp=Y40Jq@+uZK7ypL!o?rAX~Q zO)2q>5S3U^3<-AQf9j?1w4L#PqT;j)Rzhsh*3^H)<$StKayY)S@-t{Vt*hi#x>mfZ zv4`MtLO}h_pE_KRx=5|FE?OgTNhUV*bs1vZUHMgjW%H|p8ToYkG({IjRgMn8EwChm z@eU17;kJQF^3bqK@>!r&IXX^d?$mvt)fiCIMJ?dB7##Q?m>&*K3{;*2tJ#4IVb1v( zj7bL(4A6qXExSW1s9 zURNlGc^r8uRy*myQn5!lln2+SaP24}w0%+8s&SmIMY~}UShAP3=;qLrmr;~e>TgyV zKILoBTdA3wL;N6T>M^JlN*lMTyqj78S{0a|<69`WuL7;Kquoa^Pbwu!NT>(i$Yn(N z6r+4zm7^(_BAANyc@?cS7e4fXB}=H^l6`QeR!a`zg^HaNcCiw{mnOU@<#tDq?f9R> z46Q_|1UP0w?nRjrums9Mn#wdi(m3=}$Cq@2plZdFT)RC827eK4A- zhY|1&dMtH*3$O|(<21SqLl9LnPS-VKIP)@|f)C+^DL^JGhh7kOL>f3?7e^(kO&rF6 zRz5g4P~}0lHM%^^XhsmbYl%SqCXp!tc@v-(?c^8IKKl=&#W(clHPI|napwSpI7k$9dVw%gbgW7}uf!p-)O z)DR~GYPQMpv;+TF;om$w=!4D7Wc+jP?0;C;)C2YMIix}L`FtfWKAd{;S*lD7GHm_A zE{)G_Wul7^+#|?x$cNd&hmAR(0~(ZBT3A|_tvm#7EKj`}n?0<) zes#kroJscM+UmCK2@}SSn_Rv8gfU}k$DMG(n90>+$4**4X?ZnXmQARxs+w3eX-rk^ zxa#3n!HJ{SG_|Z6y|SvMp{a3QQ)`U3R*!C5S=Uk%!@*^(<3{5IE_DdkXpr$!$y!M* zj^E`1K8wj`aU!3^K0b>LpT*1C>*^Kr4sJ0-Ut6`TZq(`%s(4;nOI6Fdm?Y7v22;zN zlLrCY8yePGjW`I-s+Rk-aU5Ek)vk{AvZ_{Ejkw*~TGLu*F)hl7)z>zzXj^HuH@4!C zH=JXp0>BtQF4l%1D%G*Nnzf*KMSQD;bK+WY5+A~K1ZrK0!{w}Y1RFaE9vkVi!&Qk% z$H`<;PbNGTjGh{BA#y7&B+e}_&pkC(QFK~Ctn$>df>_L|YSjW+^-aiBWl%Jp-6o>o zgtwa7wN?xNnwwfJErgMwWi2J7y*iYxrM9)Xsj;=z;$8P`O{;1fnJ9HCU0qdu4A*(r zw63gLRg1UQm9b@2t-KVvt}%vV;w(89uC^woFOYAgUe;9AwV@oewjl#*s~T{GTnv)5 zwjsDxRa1lbT5*pyG|LnCES#Q)gZtunWi`~ct!%2X>XuhkBeV3q&^);=rWyEHGJ}wB zYhuVY9UqTpW4byNlaP5zwb~06g*S3o-qajhUW4=QwCZ8Iye8JRuDO;j$kb-|Q6cG% zS%k3F^-V~9Yi;eSSao|#JYdsuI`WV@YfVdC8#vTi$SV`PRq}=0n(M3DViY09Nchsa z4kyJmsB<8#h9-!B{4^mcU|a?`;XFoMvQC|%aMd=}SSY5i6J{yqxt1UWfifa{Ne(6ttcociB%NmRump#5z8;F?9@^@w71kj?`@E%K>ttu}1xQBHZLWQ?^GHK#@8qH1&M>l$z(sQ5)o0UvBd zaF`|F`Sy~mSYOpbSSkp=^wzKF9##9SMs-~q12SGNjh(QG1S|AHL zv1BXC&LGxI&($kyt5-32a}^KPG<`yA-FmjQCK5J&Rzp?mDoX`wu3A^$R8^x6-Au4x zb3<>cfo*E8Mjl!%t*iNuwx9(GZfISh8y7ScS^^|yIg-er?QP2^vs$&TM1!ju7+psF z35h#5qfu#u($JS6MRl#QWgt<{ppe-5+LoqRV^bqqSoF54zkwf0hQg#PBKsirmi4t& zjZ6q+fc|y55JESAI&rA6R2ADsbuejNV>?a?MFm0@w$||k(WW&JxC%*ZM8^z;##Bmh zUMS9D)hgCD%?;JHs00mYn8h?gPZuA1Mbb`}+uOBuCT^;KZOmYGgEE$D7&$u^y8Kwm1wCf2I^^ zTP%$kNF9R=3);}+ z*CQZKHf=^*$3{yO7;8pZZd<9kNQ$E>GxW69S~-?}8i_cp6>_e`FiX84bbIp((pB}% z@Gvgc+P+M=)4HXW!&j7BiN&xaS>M#O3fkAFtaj*89m5-o4@Gz=FUK`?)v>B}GDIk+8Lmt1(<)(Z@l~RrT$<`!=IcIqcPVKoiqa6>C6I z;#i{<)lSY0CMQ$GFj_?+L(NtSFI5Uu^WsxMeG|rHYItJB+8cQwuu`w|JS+kAs?c!2jCQ3ariW{W zGsbsEoNV2^y2&zwM4rg353iQzxx*;aKehC!{h)kwzb+Inm4#4%Hp5o>PHNZ+(Y?Z-*M>WwY5e#7W^4Vv5K zO`6mLP!vpS5kt%^s4Oha7oXbBYF<^lP8p1Vgc3)+s0h@Xia@<}a4efsaH`>0yBY^V zGb~~%SWp(Dn@R~S@(Ri;&FD8T*P>cl>Z{hF5k?!v3|4i!N_9Lfwbf0WdC{3+%M0>K z%kyK!xu+JC>mgu+HMe3`Y-Vxk!r1(hqLLyG+~PI`<>jU29b|byNx`hr%A(xL0>5Rh z8vVrsEi5lmW5c+`Ot7se^z+5|5iB@;fKU_}y+OTxZJ?N?Jn&n2nv1+cPtnw9+B`jg zXU$TB;O1JSTLsqM7+M7`sNf)v1*UHKx)_H<<~=^kQ+ZfXSz2BY%d5l)b&Zxq)r^+* zW;7gV`5R34t)^MNXMX~ssS~e4Vhwwp=Hs`Q)6Yh<+*by$q|+oj=e^8#*`&4 z1%*dZ(F&mK>Q$dk4yX7WOZzazn%>y~>%^-zQ)>YOe#KEbLT!nzO6S z5A;Q+#N-)Ut(MASjOr?5GYV!xVU|#(bF6%M%`1-;78Dnka(qoClo!mKUw|1yhjT^w z0`cRsRHeDY4@s5t^DBIwSTzb3d2_H#=8LFM zO?5gf;-%DBEyRGnq*5m;9uStSejR>}5Ka4tEhwLPs?S?qVsr~*B?XHrV`b%~m8Cvk z$ud+d6rK7KT2bzo%VJh70Zpo>!g%w4Lxh!rN?HDJdICn;|?%I4z%Wz{wL1nCb5vq3q zx&o{T9O+uATr040(z#=PDKaY2v7?lNEs~A=_wk)sJinqaR;HI?lH63<^9%CPF`Zgm znwt;V{6X__OV|=Eq9#qg%bJGY+t|X>{G_z+F)Vzr$1i{?5)xWe(Yd{mAyIr|n;5#7~E>f?n;Kn*O^Oi@kPDM<|WYAJRNC-tOa0!kFh ziYZfbGa3<$#dHfJm#JV`j;pZoIYFzXF4r(uQefO~S~8OqS;NF7F!4ZQMGYx#GIui5 zP<53@yIu`b1ATp0i=I$1kfs@vx-diy(zR<1X0Y{jjkRX!LFGb%Kh*%XV4(vuxD_if zNz$Q_eshC}UeZ?6cuX{XYfX&WN4Kg>jkRK>hs%(>js?vy?{<+nrn*U`4l5KGv}5A} z6J(4EG5FSt9cc8)5KB>9`cdMCSM9oqgFb*y$DIFsYl8pEv?jy>1ZVZwa2DMhN zBKlVpTI;yLTGfc9jaF4kFaSpKbyY}qj3*uOCzY77P?uVfMeuVa+szySlt0^%HXM9md%^5Jmj;9@M1az)fzoact>teD}L@C(n*i$X2Ucj1uO|Y7xTZGXo-(@YmE_1?@|j(rZO6YnRt! ziYu#lZ7m$`=ylO595matSW*oXd^%C{g;}AHBBJhSW7+MSVpJmY17D)sv*mq7QB1Qc?`1L6_oq1*l%ePKPsS zy&}a13ac|%CRMA=vQnrt=(9lnRAc>H7tl3mEn>^iDCn*VjRICxbv_~uQV^k#s@1r9 z%FwFgUDi~CepjZ$@zSh!XpJ@0Q-|2Fe5)INsnx&wtD6l-F#x}8K%h~Rz!BPBzwdA2}+~J53VN9yX(*BFe+Et*=*C5qsnAhekCa?(9L^}s*AtI8o47S5UTP1O3s?!MQ$C<( zELiHooMOc~=3<2fx%pU2O~@vhe{{?_F<;G1%533xq}Pi1Wo4!1vVY!DeAQAB z)yFm3#OUHq{^@KyJJlo>Gi5BeCJ0IUP6N!swSl1opCtk6=G z6`)|SP?Nu?}rR#BpFSj5oO%`GY+za!l$DzPLU%g?RMJ(^p> zR}vk$>}wfKxnw;|;zIG63e}(;>28{_qk4!({{M&vms^t3s@jMdMW_&_3?@pd-1D&l za};;IP?MXNhgI5GdC{!Gw>#M1nP`&K=^>9K~Hp*NGe3>mwDNS6Eb>uSJh7D9Yu2$PsGSe#qCXuEix~?J^mk zTUnWlb^nAMn-5LvsS`%g%kc3923j4fHfB9l&9l{74fmC07fBEM)I=A9MOj=`Bqowr zTa`~alnuvcX1LX=H$;7OF}Ut1fZswHU2RNgkRpIIG0+C9iZoiY|r14y@kIY}Fqd>E&+rtJrs&FJB;u zB{pbO0T&WqdZ~sJocz|13{9iznh|rN+uYIxXlzi(=jN8ct@zZ0kTW4weu53Y{E3xT z79xxMF+ely1d3)Bp}q7w%;0jQY!&(K=a=Np$L?x5K5k45fR)0zkV6GR!=LDg4t+*Z zettnoLL7|zNI_*epN?2YE?taA1YcR=2XNINMnYpOwi8?^+F(|005=+FTrP%8&$0vP$ z=JbFMwzMn9$$rQACGi0WcBAuAd--W;f)|EY9}2R($0{&bs+d`HgpvvtmEpTMHInK~ z$|7{%0 zoKbu*Y*Zfys+7e?VrnAEDO$UpH;K%$oXqS-NsKMPSAJY$*27roLDa?=o3F$$6?2Np zj1|`3OG_~5MEikNYSq>ydRD~~%EtG4Xm15LNbJOKanX!|1)bRE7gbOjv7)jClm3fy zDW`R6H&1t~iGrwclo}{gKay@eCP?(CRDt}7&99s}xs&Laj)J^=-LNMHMFQq`mHyFbLvgyhx<*v~31odK1`hs%kvpmd@Z7GcDX&){X$k>~?oLoA9_V07A< z_??EJYGVr~m6l+0MzwW%AezY5?+IE$bA4ptn7@FZ~TswkMXfH)H$cUP1Z=_yGf zzuEJ#DUVJ9HF9AL&E>34ea$pCsdLvXcVQ=Ss&a#h)`^o!Q0Jj^$;2KQx{VmNQ1NBJ zk;%zZvk$Fll{MVDWJe}TpZLsKe;B2Dc@A#n3jkB=m=vRf^$6 zE}MlTn3*A}?zXvp;SY!wBi`7f4(DOQawH4PGq`&yqhNn<=9k`eJ|f=S86}uzvUg>G zBbgSJ=!QeKz>f5Q*-=s6sTfI>Vqg%TnEGR%i}7>rEc^-}-rgS}MSTA=vDzl-KsVZ) zT$mo_NOAb>1G}C1lGzC?OpfVc26mjy6jSB5S~-+<6iepKZTR3%m4x+r%~^f8i{Xv3 zOWb{m7n0Tbqe1lrD?habyOuV5$;SvAL2X7`Uose~7XgU%+F5R&Vwz|Jd-at**i6mF?J% zGT$U}QC7Avu%yW^I`Q?bVXHps!%()9EgmdjLk6jcOnw5bzclhi-f4n;?)>VmBVM0_ zKVV!gpSxcRerumHxK^%4=Gad)A8PvTRIb!D%f=UezY~AwCy6WzSjn$##{*p$27cHBo*m*u$dd>DKxi(^VNo}lW6bpsQf-h_=vCB2!3 zs&+>Io=n-ZJn>^z{+5Xrsu<~JEx9mhuaY$7xwB+;*y+t>{S~pX#qN>Wb;h0uBh+z; zqQ)I*b)?PM&f*@YwjHn&iTz>x9BXwG_i;Jn#;1(1wbr1a;%BEimCR)I$*eL~uN-Ts zylb}bJ*>5i+cVt8z;@*7mDq_}27cCRocjL%$IlUSr{JfKRs1EO6&Q`zJp8(GiWPPv zxzRuhPOD7|bPx0hrsFPw-j-))1p4B{o&kYDICV(<9+Or zLe?a3!AV!&;_4Xy#If)n_}IyF9mP~2F3l~YaSqFs;wP^UF#C9PzPffOI%gqB+Uqyiq1 zQ$~f0wF(!D3K#Ro&x;XyvHETFV*Q)w#iGo`*t$kf1rDec+z-YZ3J6<0!`jg#f5Qbw zQf=5wUZy>A6rkVQ8}VgEjefUqgBeN-t}+QYLAPhvUbHWWh9_XGKeGZ(H+O5;-geGL zCv1O(>s?dBo1No|oUBbWBgIZuA$dl$q|BjHe?fa3;VAy^hp^hnZf}0<4y3KTgC1LwlkmH!JeP!^lllr+6v>$}> zx@>j2&T=Ai9q&A7Yqot00;h)U3xgY-9`@?l4lX8{?L?8rzWbc$?8A;1w#zm;!>QZZ zNd6|L7hW@=s~+b%(K(J4wr|qW{{{-^wMhkyY(!4&H`d5D2#1s*zdxc*HaQ+7?*cyV zVdTRmXHayn;}vTg=FBE%0BjIyGZN4d%CU#+a|Q*6^m2}|5wiPcrXGoaca(#-&zf!T z3eEUxe-bXC1ch27!!y7U{6< zHOQ~+XGW*d=6j?(Vn50(eBvw^_d!<>?pYnt_cp9How+fgnEwn{E%n9STlNQMfCsYo z=OLwr*U#AKbPe0LYwFcApbbUzghIQ0?sT1lLX`&H7sI{@Rl`o(=tN3E)Xzrt^w`IE zA48~-5CuGfMNS{&Hnh+uTNjgHGW#@gv9B6hQKycdpR!}c3+OkueXKTK{nAqj5S{u|i!p5vT^xS$a>U(|KX>*y8Joz+{`2~cPEOeV1#DRTQ#Lvy z&;q36HAF`gVblV|JNaHGTH-jH!uCt+4?|h@Ul1a*aF&x*23@RInx2ifHfBibY^UpH zl#7ih?{l2U*06oW`hE5xXErFvaXI1yhmCMonxE}-L#S|xV?T(%y$^@?g*WSeRW^fm z&%>z7Yfxa;?SmriTOl3Tyn&oZNA81)%yd#V(e8EFr9ooYnW7Ebm)30z7WxYDgJBk8 za(ryvKKl`<;jwkhBKz_1?84%({aa8$5c~L+&}=-VLfZY<^ro|ZY+pCq{v5HTqA?AB zMiI6l@Udb0l86%WUu!{;u=#cz5)b<>cK6xNaV#Xq7C9r%b&fmN8N3x`btNq9J}8TJ z532E0dg{eD6s+THPci&>En8aqda&tJ>ZC^3J6#K$aH(@V%5EV`@L*MNN6m41&qZPitn z_uByMf=XbwBZF;Z8j^b>k`=MvVrtbpn!3K*tuM9FHT6sTOsZ*j)MrE3`XyN2zrAy;4f zyy$FaO4xoB{T!OXDH~{_to7D)xJ*ftiDu40=H7u21H$$n5rnA;?_+gI-H0X-Dx%DKH+0~Vcq?q`m-r3i(Kg;*7Fl-AU3WNm-E8ahBBPnjK#wxL?t2hdm# zvOV@ox_yPDU#&s27{+OMU~Io)vGBZ&aA+QHKsfuat5uhJRh-A^i1(s3`-0Pa1^0zK7NDoz}y_3|~5L zPQjHKe?ey&wC_%V9`>)^h?m32^i56#_hX{%f?32q9`$}Qc;aFUC=l^Hl7e_(4ZGgD zxp@S9#G#L!f>vve)2GM@Y)26QRme>zn3yr6_4>>`UoP%xqsPvn=Fq4a& zltP;Q9t3liiJ-j}!=Q&)DBps<2iP|vH-h2&X>kxL4%)j>+U%}K&dY6yt;&;bz!~Bq zh6hjwP#Ryr2qNus6sg(vo$YF9qHMlYsR}W!ubs%}Vf!ZS_!oGOJmiG7Iz48o;RE^# zXaWAxH>)i8Dg2?#{>w!k+3dhl(c?ow(eRuij`mU>bkb)!14Ja@EQ~4Z{4e9Skx_fNJ5C;vNE;ZSBMW-A_eNQWN zy3KJ0%~6B0N84s6WWsC61lL7@+oMYLE>sV6lpmv0>LcClPUIzu=Eq20CsvT*a(Ebw z;U~g?x)>Z#v_FCO?wgqEEJ!i{spHsb1PTgXmABa#HXMepV_<<26)gzcmm(~>m+xWQ z69WM~w&l3ZDTYQ;gF{er54WS2y$R~?@vzgYkj*Lv&fSWfbUieD4SGjj-0q@eVt9f$ z(P^iLqbE8}sbd#_O;=QU404{;8F?==66I+thant7dKhU?dFT#uII4cMeIFZ)$6OSm zM|7Br5yoHF{|W19_N9ojqpqVfCbtm!s4+IWCr6Fn-fN#7?B%O;x1Mo2XOwPc|z8| ze(-QsSjS_l3&1;Q&l-%g&pMud>PF`d`WWkG90u0$47N^AppUb9wB+w^YlM?)Qv3`@_o@UKWpnF=pSFd9o#I_y={iGcG zh11}z82BxY3((JcAK~wgyB}lKgFYBn^kC}_guglNKgTLXcpm1apK;c!@W0fM)+B2& z=;>-IO3M?~(UmX8-A}d}5&o+<9kITE|99hb7wZhrZSnAF)-j;B$K88cGr5?82WKo| zu0F$h0`l=4-V_~y{&`X$*W2jM>jMw-{kJ^^}|(6~6o`Uhwh3%UC&ei`h5kX~CJ;sQB*ZD8!B)|{_B9vuK%w`;VHs$a0rI;5bR%dS$gAjb z&^tkct)hp3z7@15^p~hl4};DYx)%J4@jg=Ms}b-`xSRC;0QWCI<1kmnZz^aT<;lcv zgB}cesJK6l_;@R~(f`l!t+{DK3x9`qP+9&13p|!3|ix?r{R~6E`J58?2(>~|A0OklcaiVE(!S_8@Ijr zA6u284jbFTqM`4xl~f%Tw#rpMjawFckF82ohlOno?jZ1H>$@4^cD8kV{GBhhDpeg; zHqz^VY_tdd$7Xxrdu;1uA4PsMlIXl7x*&<3l|-`?bv(8zxqiB&gTR|@l_$}a*2Bm* z^RQ0x0($e1zK8`^9?~E4$X9ttf5Y-659!B}{J)e$&q@map|o#g!SKbtB0zd@lKY2A z{LW2wPvZYZlK*>?(tEwoI}leo%F~}D{2tQ591BCX_(OTdiu-Q7r=z^wB(7Y`Pe*y; zwX=M<=ADlGo}U!{8efqozqv{B|0K!3zr@o&FE8iA_9h+WlXqY6;hsY}%J)2>xu21a z`oNnY%){`tN%6fXG~LosLVifnAMaD(vlRd7RzIsxQh2r%<{^(&5Bc1d&jkpCX`^1%cEVHyuAJ1;*;_?aD+c^An0};(1Z^E#r<8mS5 z42*Sv^uL329?o4R&ZLldjGSenkIVJpyo?u7Sy|^vdV$+P+e{1}6K)>-fTSM36U?Uk z*PxvtUe=M`GfBhWULyFTGgHXpXqj%xPx}{%I1uFA@i%4<`=6G3UggXitd8q8t#1Azz8dK@Q>w z9EnSuquT*{IB$Rgjqd9!;wYq_n1gho{E?q}jGoXfjD!XCGMxzd7ZIW4#X#nddW`=H zJsx7Zv*3_*q3++QzeA*dEc$MZNj~q zv_A`aAzp!W5idf#NJrLY{C9^u43|OtDaxDBrXDUPjdqCbPJj4Y3nX9GOX3E>&4Swmw+kYgj`W-gUJ~yZ zBJ?|*i1aK4+EZZgG3h@|r-$|YLs&Dt7Wh)0{Y2CQRc@iT=_rS+5BWgcKW`Nh3sD}$ zo^0cMPnUWEy^Vx*7H~T8XQJ2bQqNj-J)?X(=#KcW693dM^|l{Ky}Ssd-dUcgmp=;v zI^tcdC@Z)`&l7^HlW5pSVMX^;!R~^+1TzFfMD!~o1j_`;lJj3KVFdapY#PpwAZf)jz&EteSzRD#B#&~fr!7Km^i)C4<4ONi@FBt1h^SxR3l2`v zG|y^aTih5Db!IuT!733NR{e^9fp5QRSDT1>FPZwlA z%y4H3UM#pvaIfHFf`1fzN08$dhId$>ft+s;j}x3MSR{Cw;3~m01uqi3Uhq!AM+ILJ z{F~rsf&sP*h%ZgBzu@tLQv_!Ta(+ku)qO|^Jmi63jRXyKEbC1Ule>(@b7|O z2?p67Q7*wO!Qq0F1oH&T1eXZ@Sa6NtX2DAZcM0Ah_@Lmkg0BhwL+}g1AlpOAC7311 ztD$H=NibiqTyUviqu`l>7YJS@c&p&uf{zQnA^5)F$AawG7;lOo*S|;)791luL$FA& zQt)&^u5&V6gJ7HBRf4+&RXY!VPYKPNUKs9e!G8*>_8<0L*scTn3YH6=Cdl-q3*IXD8^K2fpBH>X@B_im1q19y zAzx3yEWts7!vu2#rwGmvEEFseoGPYJ#($jg{0=f{HI z2u8YT`(A24GTY`rK zzY&aLV94^*M{tPXIKkMt$`X94MG0I90Gh zaEaiL1=k2}5xiXR2EjW89~OL0@O8lt1iuipduw@m2p%IiN^q)Rk>EnXTESMqa|JIE zyiV|!f)5BjE%+zFcLe_>_=8|qOf;yceu5(fPZBHS;Op3Jw>XB3LB2K(Jb{S#X=+rGnQB{!;LM!S@6Y34Sif4NU4GRWL(v zh~OB(X@Z4jl>eZWi1j_)EcG3+@wqO7M?@9}9ji_?=+1ua>iyV7A~$!O4R8 zg7XA_B)Cd&t>6~H%LE?~d{pom!B+$i3LX;tN-&hES%OOkXnswC?Sf|ro-25s;6;L$3tla_OYj!KUkctOc%R_I zf=>uOEBJ!op9KFR__p8&f*%WhCiu1B4}uOptYCTRBG^OF6YMWISa7)DXu*ksQw4Jc zX9+G8{HfqB!99Wx2)-!jWNUf43HB1q6wDSpR&b=?IKjz+Cky5a&K4{aTp+kuaGBsr z!A8M0!S#Y01h)!q7radHD#7aoZx*~=@Ls`31)mjsRq!3bZv{gGwLS(3&K8_6xJ#P&D|mz8&js%g{EgrPf{zIPPVhOwmjquEd{gip!H)$0Dforpw}OE|Iz17= zu7W)U`wAW-I8^X>!LfoT2%aRECs-s{DmY*8bipdY6@m?dt%BfRzd`Ix_g8vfyO7I84@KCL%u7bS< z`wI>g93?nW@Fc+k!4koRf=dM(1=k3kCAeAeLcz-fuNK@b_;bNu3Em_4kl+)7zZZN- z@Xvzp3VuPHi|;ptc8>*Jg832=<>VORQp*}FbdJ#Dgg!~=T%n7FE)zON1izJn?P9;3 zSc-ihp>H4}o?C?8EA-t$KO*!KLjRG7@P8Hhu;70LQ;vf>Q@ipWxGiuL&L${7CR?!SEQ!g>siJ*hg@r;0b~yf=dNk z1-A-bA-In?AMLZy`-#xsi$Wg|`k>H<1iupd?}Uzy)!|Z!kS{~%ETM-Hms!>*u^%h; zCle9>EU}*>_KU^7R3bDU|2tC~@_P2}ugGBIo zT=0*Ae-`)81%u<^Z!y;Kh)7Q_BGQ*3^bnzk2|YpR$wC(r5q^c(Hw%5f;AMi>3jR{? zLBS^lUlDv$@H0XFaD?BrxJ1a8PK11YgdQaHu|kg%8V5Zo|1*T1DRjBe3xr-y1pijz zLVRZ+_U983&qYFCLtJE8zYzOh3qC0Lq~P;J_CxYJ!T6oxwgao64se)KOR`mzVfC{q(G3`+_nlUvWKz1seOf13o%YxI1 zrTTklVj<}=eAg$4S2d2T6hx6x<0e!kg-eMQ_#RboB@v$M1)GVGzfEv0aRI*55!^sT zdEP9zjfhCL3+^DIJX|4o6%qR1DY%=6_Ty&3+lUZuk6;E7!etTX>fdXT9!VN{C>D2> zPNZMS3wI?iELA+9chlcId{-;}A0n3HyHugyB|;CO01*D8MCd_%PX&4mY3QL++!qm{ z2Y&BK|NP#Qdf@k+q_-2Hhdn~?B|;DTg?^C;J$xwiAtLn9D+omR3?lT9M?|_$BO<*$ zY#`Ek0}<(aJp@F$avdPjbA1Gebo`kJ`4_rC$bCu|AmqJ^2szdFbC5456*S~}p9py- zbp=9>ySo7qzd9%Eza5k4JGic)wxPONAElUZP@6s-&z$3ygZr^^a?9uD)UK_oS(~Gd z_)*8G>EnLlC%P$rM|Ulbsgu8Bv7F8V(~d{=m^0JI z?-a+HsX>vWWzX{D1x=Mu%M?!*TUvEvb!v6wm(4Ohq1t+sM% zYL~UIh*d3H#zWZ@kIv#tJfSWrsw79|&i~@1w3nn&bpoR~F)s(FbT;rZtRpn*J5@36 zrjAcMn(#)c`jEv$*^}H7i%+5>$}vyI{GYL`#=UJg5tLWzCM7V=FTu-E;`IArI*)R? zX{YBlN}W+B4#I=E2ULmfFK+tMawAr&r7B=m8!mTS*4~DLA$0&%KydM#IV$qMo+BAQ z@ll=Ts=V@~Pn-f-yNZXEngWL#|^H_aIcS#NBB;VKJw%sjW6=R>}NP%0Vmmzn|q9KYJHi@SRVZlzx2;_R&&q@-Ti3 zWm54!(mjd2x^m2)qd2v$)=%qe$EYVsKJ%=T(@u{n;mTU*De~_IcniDRWhp#JX$NaM7}c&pY?>5!RC>%_T} zETl`>{zWNOnx@FOP6#q0Jc&CL-Bb zrQJA}s{2IFw^VCb)&ER6B_9u|6npaBf^)$@D2B>U@bJOPcrr|^>Ev#)$W z|9%S703{FoMe)zy8h~H(M)8|3_C{v<<8uvO{QMS!ALAuIOg~h-z9vnG-W}= zWBBcWKR>^E@EZnq@`F>HUybG$m#-Mi84vyNG5nS$@w>t&ALF4vh8u~5`Q_uB?hx$F zWBBnmBYydA2ES~0qI}Fg!|w;3Z*lpigJwJ?iw(bTVejYnq)$FfyW;#F(fs1&fWOtd z3jgLY{2ol=_X_x31y7VO4gW^It2Mv4dC8hUn@XJ6Pl+VMzk?+_f{cT2~7!UpMG5iK4@!S7khyMDCKZctK zc@RxpzU|<*6tsB^zp?P=*WUr~%Z4Y)*AM?jzKG@**B{R|VLbH1$MCb0_Z#`(g{w9Fm2G~)5gYi#)T)ypSbm@3AVYFSmi; zo_MSs>3A+lFNeTy4E!;la(w)5O43Uu8Y!lae)t&q_!}|5d|AKkC|Bfbec%@aN|@68xIshw@>&BhK#;%`dLML+M&R`r%{vJ($FAr%yhP0gQZK_!#UJH+N%UvR$4>C;ZkWKGvh#lq45De0_hjmGEMTP`6J!=V`O~q-7jGVXnsn>~ zBR{`)!7odA5e&b3;m^XZ?LhW!_}~3bsQd1>>32N+meH<^KRI_D z3-8_G4u6b?^q6fAe>jB9@a)~Rc|)}OuJ;1nFFA-)4&Gz@%ojd;5f_p7o)G!4z6Y!_ zLN@+G)@OmTU3gK?ksjyyJ4SH>8@-}+7=n-|cj9nmUGQW%&)?XxD*c_K?BOL0-cUFh3PA=c?VNdDEi&n-`7YCmx1h zz1xKUzC|cy?wqtF^CTpLjTj<%CT?5~Pq+E`fRocb&6wLs%H?B6ro!|s@k7YKkcBX8 zJYF>X%3$yIx46*T*=5eCV%{l!+&Zm z2=j1rC1B-nvkri;D&?i{H`h;O%GIiHpN4};IL5lKw|0)T|S|dV(Wm z)_D$oSvR|QHvVT7uiMz$+SbBTxl*UM#BfXv&uS{#c6yV0)R^9%?(OJl-P{pxiQ*6# zbqp1b4Q$@h)NSzOXSIXPjcu>pv&qee)GAO@qO;q;nS<^@RtU`#teQ9e|Ksc_uLw{~ z*5rhE?o-92kHm2S_y9P+evgl9KZQeE@X_q=8OwY;ktP-P z2Zrg-;1N5IUF@E*lk)m8ymB(}#qEPQKIa8>SWf6Hzs1j@;{<_=-EYLFg8v-Bha+1P z*?r++`KY<@SHovfW_|Jd)^B=f&c1$>M&tXBX>^wH^)!08!SC&)+A(N+6Lh)G07~=` z&{}LY>Pquh{Uu9xy#zehjdv#B9>(Y+vT9_y%OVFg}}-$aZHsoSqUDjj>zN;7c*xLC+x~ zeu>a*cg9~Q^adj0e~*ZGeMQDdPG0b zlg~8&5SGo!>n#xM zACqviJPgPF6LZr`?r%}%>8{JH)BD7L^gi&Uhb@X^dX;W^$$GTFkNN6Lr&lo`y%72p z^PPknTL8)Q3I~)g0Y8Rg7+yNP$pg~kH>7lZ$p?mGyno?F&}8{8fPE=$ed+Z64hJv) zqMr27^^@tn20PMA^6xNc=EE?&bb7DA?oF@QlO9!vE+5O|E#GsXsn7JK)7t?DZ+ayj z{!x~6dK`Pa4>2aLb=`Des zaac!QSHYuBCjy#Q-mJSf+^^9Y+2;Dv;qHY4?fTN+ir2LEn+ylEZI^auxCNR3>Tu6` z?DXb-;TBrtVm){r#_g>yzkyZ)w@J98xEU^l`*GYlZCH($kRG4e>q}c7g@ZS}`Ov3P zxG_D>k92xpL>^Be|<%RU! z+;17RN1*?v86`i3d&4o*CDYun>!`8eGVCiJ!hYZ-N8iUjCBs3cGR<80;`d}LDM|>z>Q1%;{S1@;1AJb#}VTd2hJ@h8sb()zv zO{8-idy`C$$ci7lVb3n3cwfKDBf6*$XFPC^^kLJu^eFc$haoIxm#726L{Y}*CH>y? zlKZLH%RF9M^gE_Qz7?UXk|)+Kmp?`cdD3tMqA=}_4R`eiHr&u>=H2q9v4Q+qbqu1E zX?E>7YIK1=8xAY}=s17*=%WRUi@pp#Axx4_hZUbfUEovK6-O;&bsCRC9v+1T@F?_g zJi6ptZ&CN~I(YEGUB_#RemDMw6-RUTVNdt~_JPsnKGZ8??_J>YZT!2L_hp}# z`@kg|AP*%6j+EyDqql&+b*k`e=3R z>Z588+_?q~pQ5$d|G-))Ee{lg9(IF`BVz_IMT*Yz{J+kf};2M)6DA|2Hpd%*ug{p-xz z`q%8+i#o17b}D2bd&6!0p#!(|2MqU_g8`o6mnouq_V$#^(pF}Jt^IT{HarP9nM1?0=ZtD>Bfy{@gs)Yvr**l;hJg4;*`M?_R}6mW{gN!C7cq@Ra=}Xmq>% zr3>Zl+SBjrLVt-af*tx2Wo8`q7vfUZOX?g&d?V_H$%vv}(cNg9x+CWx{S35=Zj%g8 zJ5Y~isJ@YE3$6Foq1+dmFZAy+a*q`tADuVLYfM0S5tni^);P~CZ!yYSyrdB+cE2g;Ee2T-r6kOj&T#>8p&LdQ&kA7xyZd$Pz1%RGr=hev*NnaM-;rG{N- z2iV>IXS}WQVLybP!o!~n0w z_u~El_B(L%I{45ir4J@SAKdx~_)`mAfc|3cJ#ZxJAoalQ{ZaHOzsU3Jc`u_5tME+i zx})aEU48fF?(5I(y5y*h{@yg*FO4aTEYn&+c9bh+H_a{%>2NyM0hctDemfT3meBC&pmX6?UaeO%QAKy zwZRKpc#+6MnGQgAK;KYSb-Qn%yK!~jDUfmcX?KRz<)b_<^vL7z|3;l2K0%!_MK7>k z_oH4R=(bFhi?V2g$C;S3m{JGM9WssYylF=vTe-WBl0U9IKHX0@U-9BT3%dE1k3M>m z;~M#lUoiJ)pbc3E_Fu?=(pjX95{wm5wo%`aK<*`d>|;7#tC;P5NgsI^EGg;p8_-vf z6I+)J?Q{Wj(H!(2@b*|S(jm`u8V2Mgf%({#n2_>anGYeuEx5U7KZkb6G5UIPy>RfM z(5~ali+&f~fO?c1I5MdVbDdh~;k}SSr9X&zxP7!1<2U87@7VEcIPZd=$XwJT za~YoY;TWH;FWfkkImZ3Hw2zT{c~a(>u3y?Gi1s;(_Th7Dzwki&yL#Il|NSQ%|5Ih$ z<&hz8zxYpOeEI}sWWQkfo<#ZDAorMyrS%DKUtyUca~Pl8@2>mej4|)xL?5iOWbea{u}O5 z7$3&qj^dt+dkOBfxVPdyANMZYSK{7>`!l%tyV@_|K7{)xxL?N2a}D3cZDJtfcl}Ss zJstNP+$Fd_fx81Y&&=9|`!d|0!F?z0yK&!-`(fOV*?z3P88M0@oT)+#LflAn~K_{af*6cRibc0^6{efrbP1=ol;S}qZ#2kHYXk0 z@WadArp+itS9jCq_9pPL3BOX)Ss`3+Vhgx6T z6Fa-$i(Ph@>PMY`_@;PwynA5f!P0?F+v43ls{PX0q#JR8lqIp#SkN9vv097;T}_EC z#)2Lcxjha{G$nd_gl$E9iVt2U>+1f<)FnOKp(&s-+b|-P5W$(1D-4 zCOoXvbx-j!>C)Mpt;ehfTfsRb>&_+kqNyYwAYpZ)=6T zZQs6qV5wMnqpLSzw8Y!+qjCdj7BzKm?s4l7HFlr}G_@7Ab|w2xF&(9@@fO;&K0v3! zj#|`Ubr-=>=k^_=u|rEX6k2W5PW~EPd7>p+jK!VZ8(Uji@IzcGzQvur9WBNRC2~nfuOx^{MKM!kA^yVw}85A{ zx}**Z$2$JhTGgT+ve~n#RTaHLiJ}r#oo^*1w!5RLEm|LE(?=`1yTMjgxw5^h4gC%N zEsCd0AWYkvb{Y)W+8mF9x7$#5m9Y3F>(5apy2|b7ZYgweu`!7;iLW}2#(f-P6wiOm zfa6%)lW@<#U5dLFcMI+W?hA46#(g91`*437_e;3(a-xxi1yKa|9Ngu&dCp4>v=xvu4dbect@y;^OF;cnPSvt+yp!-@CEAv%RUcqle-6^iK^@X>Tuv;Dc2p0Sj7K zSHe`6ej|`X6gRvk0m@w~Om%rf?Scz-y$IY;=9`dpcX7IN2sb=ns>>V4&A*;-2)C&o zyAKLAM|rIzl;CE{L%%wS1r&24=zv4NI_XJq-N&Z5-%XM5tOOi7#e5a8p1^>nu?D8P zy!GYo_z+BHaafKayhg#fKzTL7RF_UL2}n5{T9nsn0@H#V z*-We)iP276rxLE+0NA3eD+vkL6=Bt-v)ce_KW^xZi(CD32`<|Qaf0#PqOD35ZIDD!nzrB`LS-l5990FqFf>TmKGu_! zXaAJJCSO^HY-U&4tt7M|s}n1GH@P~3tM>=h7e11y8ev9(gj~{~6EJp);?c z-gzJ54RO8#j|OnxhS%@H+vzW^`|;Ab=k@eJ`a9^susLfa-+y0|wKi)t9^;1m#wa~|_&$6-E!prIM$51{Drk<0m+tZI!34Zce>zggb>FMcb6?3Hk$T~N zB&}IlXCurg8*xaW(3oR51@IYV$9TBGvW%T!re5AZXG|2~ z$N7;cnZnYI9|`{~znfin77UuAG2$TYBw0M54Fb~dXU^<^J z-1YOP5evsq=;pHrosr_Y>$Zgd7B&(*#Qn&c>dke#u#Xiex;14G5P_C}>M#qM%Bb>QDJRjywcVn~FdJB#|c$v5O zF;pXk9uWJY^#43Ewz+S$TLu3)qS{A6-gr8E_dg45Ve`pG?kOa%Mq+;7zT5=E-tk5; zCL}Z9c_qouGHRd_B((}fc^{=) zgWLReAhZ#5hS3f)^BIKP0ZW#-is#y8nGM$~XuJ*J#_U3S?q$rwK@~I0JeN@s!;QFl zsED^CcaFaY81W~;&=){wf5&(PkU10e`4%i$=30Jp8F~IpLE~$HVZVc+N}P&35pp z*%;ahB@3Rg_-N{D}#9shu#s+jW9<#Uxhi!c>$*5{1N6!P7Z`)v@;22zEcWw zjPpsDW1R%dan6k}$2(tv8FrqA8FBdQ!;_sqz>GRP&3%HCgNjXbCcr$!DSuj2lFf^ zD~R9wIx}FN<5a*baW=p#b+*A=e17bFmY`NWR1w2Xm=&Cd^8w z2IexS3FdNV8_X)_dYCJm{{yqy`8v!R=Laxr9lZ8qtaSbYv(5?ORi=8!f!W~9gW2db z!d&HSg}K_<4ReiiJIuAtqcG2Po`d-b=T(^NoZ~RpJ3KSH6HIeEfcghdLY12KqSX!Sp$o!?fH`$6&SXY`^mmEQa$W zOw)NDrlkKc=0CQz-*Vnl{#lqbnNBfGpR*RG+j&WLGj&=6K9Opa)bG-9B%&^lBGvfRk=E=^OTy}}sFef<6 zVNP_~V4mV!3UiWk2h7RNk6})6{tR=flbgpbF#%?wa~8~L&RUqKI_JZj?%V~l$oV$R z8BQO}nT|DrU7`@?ETEb}^Tmkbe=N_16J5Rto$9WlMiSq}TrA`hSWsx%tW|>n0v)pNcS>ap^bFp(5 z%(sHZNou(BmpIRWHk@C=G@UnL`kW78TFx+sEf<05*MV!DVvvS&HcZo53e)FofoVAx z!nB=hVfvkWU zGwhrXGveF;^JM1$%&7BKm=m1mU`}+7!aT+KGt5b@$mipSD7KXoa02

ol0AQw`JS zoCni#_QSND2VnZ0@4*Z>zk?ZcMqo-5awfyfaF)W%bT-4xa(H@NwsQ~6Va~T<<~YBB zIo$a>%v>iQFaG5@=fE7{RKpzUbif?tTn^K5?tpoc^9an*&T}yHoue?vI3L0s>z4N- zJh8H^SAx#zDERKEvz6s{ZiRVe)Hw{ubzX%Tb^Zyn#F;Q2>p~1$1fTOM!X)Q1Lddz3 zQ0zQIh&sO~lsLn}0L0+oXS)#P9EG;iqA=uKsW8`hRAJP4MPZ5ap+ZC)jRNjs%-OER zc2>KVkXwPhC$j=i4|i^av*Fwg({vtz>2r8+ndSTvrr+V=WC7=|FoO;c9t$}WVP-gs zVU{>NG7NcjDlkSN!}Ci&1G;j zGqS*KuID-lE*OERE|te2Sj_dD|EVbykC<`ieO0h{82mXhQl~Ge4rgJg~M1lTuZQp1(EY%K|Bg9E?Sfd@T zfP({v&D!BgIE;b=54=%nTm^@baM-6Eu7<-1IP~Z!*T5kU4wq_&YvGU!hnuv+b#NFC zhtFw;>*0_Chex%;4R9C+hZnTNUN~gK;brZx4-Q#ycvCyv2!~8K_~%JUZ-PSx9L8&h z{cs4u0pHYg>vA(3f^ewR4tK#J0EZgwZ~zW|IIPwVcf-Mk!)EPp4;(Bw?9vYR!@&oK zj+v6nmx8uE{+H&-pV1*6Mu>56cmNJL(;#qMp41LsgTt6#nvtKtp^qZ@MDP_e z@^esBclJ}kSIx-lpx&h4q2O=K$lpLwDcau&zGgeXKCvD!Pm`5sivL{_M4G4n)*TT4KuP4lq$;)gKwgH zXulVNZ=ri=>SsZ`wjRA1N~_kirv$^Ff$esxuc<*JJQ|%jaT17ALF@)Gb~Ffnx@$b9 z4UDnYAHD-Ic!IV43BM736v{w#^L2hZ{2dTVkF58H!q0;^b0mVr{Mq4A6QvoN{JG&t zAXJ=<{!!ssAYNp!W`BNoi6&b7(J)Ube2qSFe?iy=FL}(dy~SS~z68V;7PHm=R^(O? z4whYZo4>$}+z*PMy0hE;)6K}^pj6@={$i*rO?CR`Lpf`z%U@zf{-CMz{7X$E?|Rg4 z{5`0_t}OeHzVKbT%Ex_1m_vvv{-1ny_+AhXQ5xR!g~AVjNKhF5?8^>62jUtMANX=3 zqmh&v7yj;h%NLmo%4W?z@*Vd@NdqO5Eel8L_I3xqA5 z-pD^Y;WPK@!k4P*+)>nZT#jMMb^#KrbNi1=)!=Km0GL+*>AU;W-YG;({D5~r$ zo#{s2OGs)GyYOVXP3C@u7=X2O12iz`S{mezkw-I+LY4C=II4ERw*VeN@SYc_g&NnAicuUSOZ<(d$KCy*|UM*Jpb5`Yf+rKMi_)98#*G?wtd@ zelmz&5_6%~PhlQt2Ya4>e7G2dn#7zAC0`Cg)%Xnmq;Rz+7WgNJn?R^>_Dug2W8y=Y zO21`)IglEn9ts%Y%MeCs--CgI@O2!}ersj*)mGP!)DSsDgbX@T>3?O?)%( zN_eIwz7_a&c%CMn3cMO#pown>eiL4*iSGnn3pZ)v>A-Kpn>6v=Kwo&LCJqOVOx+7Y zmF<}TW^H{_Z_)JkLFe>My-(B6f*#g4^)XHV0CaZW)bDHhhoH0iroN=5{&#ns325~la5^USPAY62zn&B%+OIG?a5+oR0L+n^p|yeW3R8OfN10RZaGKHVN~MtCxvQb|kfJIu%= zO)a+%n34IKs9~v=5t+dvq$R>}SmgPqb6zTy0}r_mZa8*jU%~>v%D6iR-$j^xS^~ z*#-xmcc*e~f&>0qeTR9PJRdu{2l;>U-pAn~lXl z11MFxcDv7vw1QGfuhV`VD{f77*_f(dtEuzsw@^n-b=z;FMK#r9zhg#z1d1~#J7NF9 zj2zKauYKH%gdodmCb!*w50en?bt$r&^;@)BWk_488DC)h$A2xC(?)xHGM2_;wJ@%(TLq z6n+APS`{p}3c^o=_!NC=tm)w+AXIy-wC03=4}!B6yUv;){s#!fy9R4vI1_bI3b)ZZ zJDj75Rn|F1-aI5#uoQtqp_2z19kIR<1_*bHTSW;VMKZ%+q#N~-N*#XAT4zSS0_sf0`@FTmj9fNDsQauIGqN94CB`B90c(pH;o+vwqvZC3RvT8n zh^IvKD^`~o;lZV;-GI3#t}vv3ICi>5;eCHz0MK5s_)HT5IwK3R6ioGz~vEtgjI$yx&CCvSw^0$7W#)$e4Ij3g zb!FzL@M%a^5!Ytshs!i^edhS^3K0xzUuHDCRuea6P6}@Z!3tY9XBJF7PZPIhqW06L z>fJ2sHqepjQ}t$+^;yv2>EZhjo>jN*$SewfO%r!!&InWGszTnCSseZ~2<}N*U&J|@ zc}ro-T>)caKHPJy=1jFHQ3Y=S8#oRrA`UiaX}30k4cr7)iEhr!HgYIjq9F3_V48O` z%{GYLc7i;3Lf$VT22*r$#0=Z!=z*ZnQ zD!g6?3kCCyyeuR&VKj`faJKI8yNet4(aAUaVX$bf!F;e;0XnY);q#ZnxDe8xQC83m zn4fWH;n$D`1wP|0qwpzhzuPV(AE;_FJ{KzFI`>0F&G>wF;adokjZT;Gh1^1(|I7}U z@xZ9Ue57{+#3AEL`Gu2U-%tCO#}{5WUDAIjTDSo2=RuKXJUpqe4)#yc{?&rQUn3n= zhR3ECZiKtCf4#Wy6~w)fVV*$4nOLpl24Ljp!5D^M8FLCgDne;8-b&TtZKLo9x)$%+ zg)hQ>HiBpTF=XVGF@>c}p&rH`5jErVf>!}^GTtlv1wwwrknbCXv*7k3^Zlz`xBzzL z{z0g4skZ+kyRcE)Kg=!UInb{${J%$qx4`}Z?S`2jJ`Y4b8R0X>hc5(CK*Bbo;VVIK zpvVZAlfpbFx}HSHEC_!NL<@;bb9(p*5D605X0efHWBw}ZU)YSiQ84qlkSap3jKu|0 z01X-6OmXAeMyegZV;BBbbLMa;)sD|(r`qw^+`=EAEvRraemE-C?$6~HJ`eXFViKJ3 z`Fkl*@bK1pU*&@6j9gW)91zO*RN;q+pmJz8RPE14kc>{- z$h#Pp+&zqS1B`PRt8rp6AU9*U8Ma}0oS+GcASxMW6-)wzGA=0OuE<16#YINp7%fq|5Vj$RM}BbdugK$yEB`DQ=P_Xu)CR&b~QK? zGV=bF?lS@!K~fqG>-4-ZOgAQTGV+Q*Pn)b#QRQ}1DN73_32++f32NlEG8FlvN^Rur zB)tcQOXpt_#1CxI5&hfpI2z{P1+VGU#<%5h^69AnpNvlC%w9b?oy?(4Rm#YtW8RDK z&iw_9iN8klZ0iQksJT~0%@9T*Yad3SRs< zC#$h=OGxr_Iq8mtOAx832rJ#Zm9R}*2V1`VV@u5e)Pnj2%$t|PRju!Tij_|T2=*cS zMJw0Hy8^LtuVvKx;r=yi@(O7 zGil_on0ora3CgLz!dfk3%7j0_9+`tEH|7=F)(v@Kd|2DyV#L~;hvzRK)IRXOJS0Sh za)38pz-_MQi;U{+#mo;ttM?ZtnC|y}^iQ=js(kJUdUm!#InN<9V6uGcx%O zrFtqqi_hZmLWg0>TaB6gq?vlN@jI}nNAj3s8hjLwsmOjjKr-uDH+hI&&qi>cv)A)E zyZaEmA@vZwfq~tJ=#8m|=#7+(*=%5QHNzT+3IRh#=K6myk7h>0YFgf2ZDuxhJwnCj z!?%Uoxu;qC4!Liy#+fk4!|vOwaVCzpSB)ly-TVsLCg4L<^+M_vCLAOeOOWH^xXrBr z_jS;5mrJhh?RT zW$Lwp(iBG)vCu9Xo{`&-I}{UD6H8Mu#K2lWo! zLF%pdSZ^MX#Z{nrl>KHlwWWFN-}JHk^6u~J%sH?cBsaLtens*JbzfpKZ?Xh|M?fm} zx#W8w)yoiXsKEIF{0g7tQ@)D1x1ut<&Evw{@nmj@tj*3)GHUI!?{eR>U6sz@WK=JM z-M3{k)SDrU>An@b%4M?3kw4(LmpOjmZO%;o+Rts!b3Z=YWPES7nWrJT+p^~lo%bxh zi~@cd=Dz~!os=vVkME@5g=FKy-6`&3u@pCS#x34tDK}Dw+wMc@ts2c2)?3l9JJKMW3xCvO?v24tq2bc12*BDKc=T+oc;^320OjV5**- zWv)&ayJTc<`{P}3xAhxU>zk^3BdRNRD$`ey=|S9Pz0P!ysGlImWK3_4UO^u!yK5ol zw=%mmIylyFiE>s%q` zNe7TjbreA<1(v@(qR3OMSNe7!M(R;*zGqK_JR!50LlgVVhDBMV+s%e*M{`uhLiQ3?9f zk^ie_C2YY@zvVoHSZQ5d>DpL*<+&BHhPAa7u^7JwV8pw-=M)zc<^s}=Q&?SJ8EdFn zUQr!eQqd5@@6?TyOKna4K&P78hRT}i`T+r#BA_Q;Sxt3yMHvHn92;ww)RmT3cwB1g zDwkAxgOt~mE>25lX=zneMfDPIq>42S71i}DgD0is6>Ddule0Z!ZCy=6O<7Hq$Emce ztfJPNRdr2unKv8$2Hq2%c$JG| zD{9Is7gtu4qsayrAcg=aSVe3_X+zo40mYGAV-?k9NTYhm3B0RHtCuvErm;|!uC}gp z$%@i}k;+QTmR7{jehqbL{BkSQ*sv6Bc5dl_mQ|i*H8smC2XauQR8id!V=FccssZz% zFC}$gNysJqwJgGueO?9l)t!0BZ4UhMV z3NWGElfK8VwsfdEGSPalb;Y2fLni6hP}?6sS0%VPNbpi2PS~I8Di(uHgSu>8MME9ZUfht@ z<5VB0uc$*`8(0AdFC=j&-B909S6PP64_-p3>KdS4%P{^7?szH$I{67zT_duNL6oZp zwf3sgx~P+#krN zH5e>Pt74S{N1a)*Vo%UyqhrKC^Lu>IeK_WNTsY_qC=nzfmKxs6sw$~{>uKmQvVMpF zwH0J*_HyV+?MnTvZ|Jz;#`;wxOavRw1B;koK#Y}D z)znuEa$R0gfeB3&YURepw~pkSZ83g0%s^|`*2gN#t184=UxB$}Jrvv0K@PFYlSL*-V0Q3En{wR!9WzJp7yL~&6~`P%fdC!KXC z<5VoIb}9te%xS0UhC_!qK|!Q_sw)~WsauXDk}Hq2OeC1f>qKFs#?=+j53XjctcD0- z2*n6GpaGL&;jS!Bm~Txj7Ay5tv8o#AVk}+iN_E=kq?L=;#>y({8tT&-GDI9H+JBCN z-hyFah0cVjQypN5A(N^!u1GaYYf(x_V`+7H{nFCq6|!7OFBP~3RknhaaMxe4n&qVf z8e7sE9JIc%mLvQ?F6u!iMxC3UUDB%@9jmTpKt>$H$}nC+Wv5k$?n6f4+O}aSVw6L{ zq{qR)hMrYb6Wu=4TxqfLwSV~EGG^3VF_QL_Ga4;%AvA z*QA$b38osWI6kI@S7oeSF(9mmcPG;8S`xJ$5ykT#^hh11RCR08i$FJbhLKh>I-fw5 z)2p-`8%%=}QqD0B5`+EfFee_;Bbm(!{8j0O@T0yS%;>VEl~v_#(PLOaaK<@^?QR&R zE0erbCtwfK4PV;OfNhrans5oDCYsIou<6F8=B+%I3`YN*1Tt0A_i0z*iJAymzBqg{iFBseF|V@q`*! zhWgdQQ%^%8UC+)sv-S%B;<>a^iKnEP<_RtDt2%18*d<-nA@d}fh6Tmd;KAvZ)C zR}gG46PQ#QtKcvMSG3AYZ&qDg*)x;IrfYhVt5Zo*{jep<7GXib9STm?)G!Og+@cYS zW>1*Z9OlGf2Bf2A93P*|kU>5^`yq;^MwXi8Se|wJG3l}|Q z^VZWlO%nEqQ>?Ulty+eA6`2IlUY;@Cn`kZ8U6^S>C1b(F)wQdyC9?Q7C|~S4xC8GX z&+-~>Nu+tAab;?XWKrz~cd(JDi>n&zmtsDomeT|L5Cra+S=5%URg-WTrzC1wX*Ihj zw#!oOt{+`^xH@a;x!!6@*Nb69P7X3&|H}HI-E|q#i?3bNOXfak(UUiC>f*y)VNVgo zRp#DaA8wG8$2_rkSa$L|>ajrs4igm#mq@HH=A*Gy*cV_*?wUq(jCx^k9PYR1WWeQ` zYOFx2Vl2xLf!!@?1d4I+72t|th_F?aiz-$P;f}3ou41u+wrbwTc-L@;z_aX1uc?|; ztAVGwCOHpxMKL{~Vg;w>jSY+E50M?~QBhXzj`HbIQGv#xDo|HZ4klwqRL$Pd$BFLR zFg*cw5G22(s%8;)4E5S6JrMS}t18Q|m9>gHaYH48`NW!7J(em%6@SPWWNmEKyqaos zLA8nPu1eA~_67o%8i#7{##P)rtFK&AU$JBraWNiM)?>$Rh@vcOfPG0qQV`*5(h zE!Mj})QzR9he$`sjh?cl7g<$k=vb~~ViyT&B!<;7CPsrZcbB3rr&ZIGp@*}VVe^b1 zrjE%u2r8=57+7hoafRC@vEJZLHIsH7I7U@gH@Z(kQqB|!Pbjs=net6;5V>h6Il|Cd z>Mk=pj^0JaU}rTz4v{&U45@jtUy4Vf4H${AD3NPCyOR6!EjIF7u!*i7S<%%QQ zapFWgrq5t7s<7_HELI_&Wgu}lpzBp)%a>Mn9u7-+#iB;+o5H4s6*q=k4dtrX313$! zDW@uQ&+0NT70zmUO^dsG%(iLk+#G9*Z;Q9}q#lSj<2VANwIjj1E72WG;8Xn_o1@A| zduq-E+%4fmCpI6uabAO=XjRFkmX;XLiHNz6`(qn-#yXnXDkh>H4aP$@(ZcA)?Q)?pD*4mT6SpxBc&LaR zAHrh?5}nPRZHAmW(YmRrIc_w!wW7+X&L*}J6YwNSj-wH_$IvWpew*+yf7VO!%e9ju zurcVS&aT*|76bpdA$G66C>_ReP=O%ihb}feL z5Xi$oqv+^8(f~}YtF0*!V-cW4dQ@3@cJ?IV?dU_T+YFp65o5#Ym@Htj4DfQFACP&F zkvL9BP~$#?Yx8DfV{Z$NY5{Dbe*(p1sMxlqwpN7eXc1d8&J=IP=?aOMdpL*D(u#z; zccKk@T3c8-1Z5!RtAb!xA5R?6Biei060IN-t|CMd>JfsRjgovYG4K&XVn;GO_|8t@ zap{ipoBt5Zfnhu@5=NaNu4EK!f)K^QN{Bt=6sOOi*W-yw8~DL95Mpe0v`{z2#TDYV z*7jEL%zd~($$_*%OmN@=q#7qwG_^qrad=6$`|!bVb5mlR%xZfN3))K-3&wbENi!*& zaDzV5v6)jbSNu@RAspE)sVZV!42)A$nzu4~7xoC^i0Cq?r}cbxUY!Yh6OK;k*=ndr zT}?aNI-6QzEJvCH#hSsWWFWvecqVRi_iW=0nd?S{+j};}qz^z}||eZb$Df2rrJRpe93&T6v_!ah9yIL zxpL;Zp)B#H4pszZ0RP>3A%@%0+{!^9$tw0ib?6NaNK&U}u#tOOc?t+m28lJHiXC`w z3Ji^@nzY~)9CS91OILey9CFqUt9jQCW1}J9{n^=#l8Rh9KP> zWSmJrqoLbvjkVy2r!7iT>8V*4WI3@#sbUsKb!PBshp}ZAHB1Llos?s2!Ke)V)`MX@ zhSRG^H??&k!0cF0??#MPiWu$H3t{SH?VcFIx=Z0fCMFpsQ+&POY2|Yb+7)Ey(`f;8T{ss^8O(r$Dvq+K43te}plqoWYq@DCDaN;T#gsQvtyqPJ zDezM@Vb*G|Q6_I?r3Ts3-PW`dY=_3ABq>eOq=q>j$J7nALT|>!61t|YJXTe@7CY)H zbbD&^oBM`%u>o^Z)zL8$kehBOMy}z)S_N7Gjw(^mde7BU>|JWY)fGo+RAiAD#8#2r z?PxY*>!zJC&OEd|DSnEx^$lDcai!S3-K~`B7~Q>HoDaKG80v3#f+)#h9KxK66OX2L z^l~aQm6+@aV{L@R7)mn8k?;PZH)9^0ECmaX26P#~vMZ}{eds zO_c&mfzWH0558Ali9GF&iVy+M2PMzt7o-AF-yHi6H&SSglCTgy=BilJvh#8N?6 zb!phR%E?`ZP>fYaN=Y{KZ5-2RKIfqZNs`G{iY2v^M8Xmff|nK;r^;bPfGTkz=owHH z?T&+5A@vwro7@Eh5RMz6U0_p^2Q_VMjmNt%|KEnmq&wPc>4#!$?ulVsZEb=2Wu=rb zsTl%B0?ag_6=QH$Yr5^6%#n%-sG?ABVyNuu0z1(ETwWQ?kReLEI}oJ`x-m}aZ^0po z-JLt3>UEpw5GVj%#=-(;yW4J9{D~8pqf(PGQ%^rsTD?lwyDGPfH|A*F#MJHRw)qA-+rys~t}H)risD zgyz6`g6Pzkc&M2G2X9WP(8YKTU2JvRb~V zWt2?eFfHimYTC~I1cX-=ih1T#deTVo!SqrUoxMM%MopGt&`h$YmFvc)4oo(Cl$1c} zsZ$L365Bw}WYv-X0EwA}?x_ypMD@0|wqdy@djt>@>@c+Oa6by+W>hEU9^(m4V*Z3V zvp1w_1Du(ME&*L8tcM*9n{a1(1FONQsPN34TB7Q%s3jA2r>)}Z>Go( zP3Dum)!Xb^$VC^Z^^i=CRa>_zsgPN(+c7wdu)UkNw6@8-oXaCJKy`^h^Arf#w!yO( zHTl%-%!ptg!gY2vf%_s;YCeUj)FvFtDAOq;(M`pz1PaH2Ca83hjNk#G3AHj-lP&5M z(SI9TJB>w^HJGfqt2{LmNaZ@%Srrd`5ECc0bWnRJvQ0u4cXLHADX>ITCp$t$*gs-w zcR&}MBbL;G`vsl~s77*W*`sp_#%SKs+rh{A+_wO4WfrVD1h>q%i9nWfnaQIxu|dHj zX4RS^f!ej}qjIt9(y4mOY)B#0J^FN4PrSFK)7?9hQ2>KON_{AXQYp3V^z>Z!h+Qth z(NWvc(K-_F=ZsoS+ogus3&kmv$P=4P-Q0px8*{1xdY$CdaYijFu&q_S=c}fiYU;#}C_5u+NZ^tMJ67O_ znnPm*PYWP#0YLke&S)Or0d2pJj)fa2i(}5k(j)Y2ICdq0G4y(i=b5U`z zyC+3q5(5iDzVx~?u_4a2W(-v*U4H}9Mt377l`OZ=Vq9J*je`PX`mYSq-L2|8Yy+Rx z>!D`gk=ikejM2{R34EFp&+4KDh0$i7Qyj&>&jyXonmwZ!M^6{DwQXxJLYr`ZAv$Ny ztl9IMH=SNw9G`vq>BaM#XU&?oY2K!0ST@dSZfcs_G_SZRKD)WlC_Mu|h-`{CZEQ76 ze4ENBLvm*rfy`iO$jtEN7{kq6GtV~y-yd|0(N?}W#vJR5m=nz@{D~!h=gE`gYy)38 zydWnV-&at_(E-#Ig~{K2>gy0Jni(7{}qADgO`Q&WR&NWc*F5`peG2o!yAsj6Fot=rBR(JkiR1> z&xtbMtE?;SEBu!SE(`7n8PA9Cqkf|hzNTsZGiMlqe8O#3ESQPu*w&eNh}7QMv9q&B zje0Y&qsjGY>&BkhGiMji#{aD1nIMx}eLbY`i_rf;?3wKw<1LA{9&`jKt$6oLIV2b8 zo)CPZ)ncF1^nG3%TL*;TS36-7}iWTfI+Tw2jL z2l^u@G#|!9wZ#R>G7QazbuJs$2^-e2%dJCN>r{_i=k~;P!rXNjSFi>^3J^XjYuNDZ z1?HoZMn?SV15In3=?`RH>L0tpZ+;_S#g_TdqfG5Ng`WTL!+&I8ng68SeruUOGjORt zC$QV^EVF8s`GWy#_A-CQ9{;ewlm0-U%AbLNBbNCQz!$j8@Bgzubg4fZexbl};Cp^E za9O}AU1pt=p3~EY=^vLl#yttNeWhCk3oqE`HK_+gJu< zepc}^W@FWYT`Uw!aMC3z=NvF0Qx$@~C*+-!B-A^QdC`D%+V0Bbl>zHUWMu}d_lze4 z*7Xp{5xWyO+j z`A38n`2*JZ%MKyKfc5>0*p$|{%qOkCUldB9Nq4IzU1lv~t6FC)^ZUQy4~5P``|Os6 zebS#7ur4?8nd^Y{6mmtd?}9q{GXLaCzrPBpzlBu)Yl6hGp@l?{gc-1iLmd6Z8tb?{S?lb)^Aa;|JX8UmX8yUO9!?|RsbJwgup9V zvtC6l{~KAnhj>+JBE*+^qQkJGq&keMCz|?I(^mkv_o63#<(|gwLt{rXeUnD|&$`qf zSm_^Qoxj^Z5q!#HnQB+~Cs{jTtM-psOmi;Gl>zIfi=MRJHJ1T*Q;eSSL5!Zhkh1z; zlHP$lax0+4W4Av$^bq7?8I*$cgt^;40mT`%%s+t*`wf3qrT=7Bn0>)|5-s)L;8(hi z@e1Uib{QA2a+X1#DAtD1rmpZg|@K=r`H@z6rn^A}Ry{zK;<$iAUPJtYEY zmBjx8$xUw+blT9D2MX8!R?5o`jVnRNVP}#I-vxRL?EDrA>1xn>Vdp%U z^!cFi$za%BdK2g~QGU*~>0b_dIp`dr*MPSIpa?U{W3i9 zRUSo~p!oqEU7tHaGYqD(%Ky&@Tk7%Wocj*Yqs4zFnSpC5Zqt}*j21dy(S^oM!auiu zla0j;jH?0e_|COUh-s-(r<^PUpAGU{7EU(vUY6oQ%EdD9aW~Ip891`Rb6Gfx&U;yk z(6Zrh-zolw;5P#Nr*Ucfy9{Crqww(|)5eNXwi z-_jWYetuutvqXi@O5-r|J72|A$xV9Pr{+~Lae8Yu~A`A|*z}5TQVRDfENj6Wv=- zPvT)B(x*;h`p*HaiD)k(I^j#iQxKmB@qU#EWzx`epU)!8fu>(6=}B#tqRM~S2Gy+6Tk62aF)M11z~FcIDSS>gm$$`rrR{ZLg^ zz6XiqH^POHFUJH6-)-z7BA*0tV0+;+n!J42837vTyUu%`xnF43Zl4*wgp4F{3meF7WZ7iQG)q`;{~IFlLQL{rwbMf z&Jmn1xKOY}uv`!@WI0b%9#tRcZ>Ubg2Yp>DxJU4dL=@_0f~wu1r+N0d4_Gaj5WGR~ zi-O-1>?0zR0Q3NHg5W~I)q>lJ(0_Ldz9Ed`4#U=aH{=*OG!gWRuD10St4pSz1V;&u6^sf_5u7fl z`UB!~UdMFK7AzNBCRi)DN^qUvM!_wD9fAqL^96Sa;#?J#&$WU#3f?OCe+2Ip{G#AN z!LJE^Q}Ag)&c9gx9}9BcMVjkjBIjGgHv~D)BK@8q=U1fvEy#HlX|899xq>GNju)IL zSRgnnZbf?OvupHB+52!2YC>r(n}6TCohw;w)!Cwjf zRC{F~sv1TE@y@<(vEpd&a=aDw1e!6HF^Mw#)?5Ije)LU6g@O2O5F>jj$y zTLn7>dj&r&c!}T@g4YT1JH*WYHo?0DKQH(t!G{IEF8D3M?+X4v@F#*V3;tU0h~S%o z?+X4|@b7{j3HmusqFh;md4i(_!-A&>77ET3oGW;yV5#5|!4-n*1)Bw11v>?M1wSo# zwcuXCTLkYAyhreU!LJBDD)^+}A;D(^pA&ph@Rx$G3BE4)w%~EWzY2aR=nJ`g3kl{3 zjuIRz7!{l%I9+hI;C#We1;AaI72;L|7 zpx`5dj|)B}cv$d3EnJtr{L!WzbyEe;8TL%7kokRHNiIp-xd6` z;NJy567*+EzZA?994#0YJVkJt;5@;z1&+Ao!Z#JA(fZ3}NBG{7({`Bsg2JM6g3LX-CUhoycHwE7pG_fbja^(n)6D$y%D_ADDQZOdiF8FD|8w76?yif3}f`Nb&JbKExJ+=3;3mPHf|m*2DtNcxR|LNy_^jY7f=2}35&WCr zzXd0bbjw#LSSq+&aE;(5!Gz#$!M%e2NAMSd#{`cH{#`JD4Jz_uq+nFANN|DR62Y~C zTLlw>mk3@jc)Q^Jf{zJ4E%<@p4D2;C|E+=v!Ak`93f?AopWs&o4+%am_=@10g6|8O zC%O6L2#ymh5S%NxNU%n*SMdKb_criR6;~hdy*vBGCcuW>KmvhmAV7ow0mFxg7(V4A z!UlqXq6A13YJ>JO4Q|XU?2Cb7t;GcIN(2@OHt?f{zG3E%>6~e!)KpekAyX zApguNJ&P@OHub1b-&@E5Y9i{#o!-!LJ3A@IM6V(M7PYV1Zz%;9|iW z1lI{}5`0MTNx|KMuM55-*eG~X@EgGZUd&OCG{Ihi`GTVbqk>lmmJ5DgaGl^?g4+b2 z7ThEFJHf+(#|6I>^x}U})F&+1T`*5@q~KJ+62WT)*9hJzxJ~eB!99Y%6Fe+r;5@;_f;R}R6Wk>Dkl>Soy9Hktd`GZR@TA~3f&u&wiuUOwm@PO| z@It}Kf-?n61#b|%NpQX3J%W!4J|nnC@J+$@1V0u$C1~S+htw-wu!mrt;01z{1!oIh zCAeJhCc%w@TLqsG{FUJAg6|4834S4HPLvVrMwSqSaZV-xB;#kl!0-zx+!u*xjMW2^I<# z3zi6$3$7Hb7OWB6BKVl#PQg8b`vngP9u+((nAF43qk~{)!Cr!c1TPjW7MvrvP_R<4 zN^rg4X2ETOPYM27@VA181e*ju7fjD~^ot1Q2<8hG2o?&?5-b(05L_j=POw(6PH?;6 zF2TKm2Lulb9uqtz$e+5fUpoqR73?WEQ1Al5>4KLE&KF!Pc&lKI;5~wm3O*yaN3c7d zfm#1Kf&&FF5S%4AS8$==a=|r%zZZN*@B_i)f?o^r8JqP51Um}$791)#QgFQBG{Gwb zuNGV{c(>pKf{zN`if4A#caPv9!3M#<3VtofuUnIUg5Wg4%LEq+E*IP&c$eT#!NYHV6Wl1cg$TVL6MRPS*Mj^SH1iJ% zekgcc@E=5+{1F@Zl8Df&z0jS7?k03U!4ZO!1ZNOYZnn@1iIBTN(zgozve3ULqCS56 zn#ix<68|Rn4KWuVq{PYe4n)ZBD0G(4J%!E_I$!9~f)`7AkGa(bM&1^t4_f_N;@`MAx~7!kzus%ePP z_Rkj_COATH0ug!^3PuHs1xtvSyGjKY5;3=w3sw*@cT@_lBw}2z609P^|EmSp5#iJ8 z1#5`8&hNU2n@K~TErPmzL*;i)&;wOjF3@1rdQ1?ykciA#LeC*W53LXQwLZ|JPV%=A zp~pU<_Y)!Xq|m2`&|`=ThDS+@HHBI@~!2>DAC5OUkNfski@7g6p5jq=zF?wSP^ z*IWHd%jPe?YVN%G^SLgW%lH!4687f~jaGjwzvcFLR(~v<@6R2LbY$t0{@id+$45=O zxPRG7EP&J{`k%QRP;*h*+45SEaF!*A%|(3|Q!6rCS-aR=UTX}6bM;;UbLVR1TjO9& z^D40tfBtfQj7E!eEGrwsiJh@T%j#d)Uqee{o_*D2fBh9hEwq&;wYn-aK?80^fxQft za#iKoWVEy*c4c&yo$3Oyemg7MT&|nNdhrDdv1WYUqH?SM;w6=3{V$p_1FO=I@n2Wm zVkPQ#SKop;w#4;pt#me$i0?|-TzbpgWeIC&TUk)63p;&`g@0vTK7^5}Wya5BPxpVcRUM$>S!OgA~RA57;rFpS3d0H^&mSa%90@_+S zKN1Rc@-TP)mq#P!VEo07@|Uod!4o4bTcVi8b=)g7uZf8Vrf_|#u0eKZ`5a+>bE7Oh6M&A42OO#g#c|q_|9-Cw2-Q7Yz zUhDSYG>4IQXAAx2BH!D4%FQ{wB46 zg5)sre&O)N>MaG$dXrl4J%jW_yHqCBn+#r4FMksU)>yxlgE%0v2&Ueg7Iv;qkk?N5 zsK?hRkH46H{Ea5l$-~3Q`zM$Z^{Y*g$Nn?={j7z4{N^x!pKA^y?3 zTO=m0(vcU_uLAu;{m8?^$m4I%6ZJcopkG+{SnfrfRLA)JO3E`rgb!f-3TL9cqmZ`? zY1FSHPSf5R#1rjT1&3liLG%Md=cs}g6Te*EA4%2xENXd$l{ z@=X8YHDpY`DUQ5Y{~m<1vmWyBF#1hGJW;>u1pOky$8zW4q<-jDeH@0oVkXF8!aYj^oxGrrtGRN^Hl7 z2k`#|FtJ{|u8Gy#9g|_Ay#0_j!3YyRlHI_UD6bgu=#!M!8>eYUpoP3}s#7mm^kMY# zwvcxe@=U*-15P8aJtEXEW*5jaaSEjEnE!higlLZW;Ok)~T_l>k--0i(9pSC;D`c`A zxj0R|My`>!7S4ITF?xc$qbO@+lXnl^HM<9zQt`ZcFeTQzzRt2D;AOpdjE&VhzlFTL zQTR(-T&%7uTFBcj6AtCEdee>ykw@F|C@-?Cr-nIkhRD_@+s?S*>w24IT>{!1hOY#^ z%eXm~fiLkedHfAO%vE9X$T!>&K*Pu14x2c$cYrULkid5EnAW1-w(qg5Dx|Z$cqEOr zcYF(Zdv3R^Kd>|9Frr7dkeB(7}1oB2A z_vEO4pSY^(8rDU&HrW+*4OXhR;{2XXG!RUHZb(IBOgOQr1a9#~$Om9HjJNrQckHZ!2bw$S1 zC!;O4HM$;daNNJArpck#)F(%7s<)7CMW8#{gEG%+TSm|~wAs2BjjoA z&&{BV8UpACcLi*MG(YroYk7`Md?n-SeHH8K(VoU&!CJH#eO1Bn0zJU%jX3=5|DZ0v zsmY7-$pxFVPkOCe>VvSIpM3%TlcU6+A&9m*Ikn#>$p9wipu_KW*Rx#-G|m3mkvK*l2?~?I?7qsKrmx z(H|wXT4(Bdx8FkEIJ9{N=akhR>sG`sYix@;y^z-%HsN?}gZ8&UzbBzQ+sd-;iu;?q zDC@1dz22&UPuJYignvyR_o96|-?|@mx)i=%)zlN?$}WM8pby(L67n%8z(&!AZfsxV z?BklUyfUUk;7uIUUtmlpRY5Lvp`IS-Mm_zO__B4ko*z8u3(9fyxdru7&bs;}*eMx0 z(JsjcHXJ!Q)#;Z+T~iWt{Tt?#|5n$JTFgJxHC$5NRG)z8erv~*E}Xy(36nEU9boAli0*qig-TKWjuwkbC6v0juv7KYyvb)7d= zS2drLHtKm;S<~QiHL0#(6)wwl4c#zrYJSW;oNp3oUjHJ__OF(XV_#7HdRFg2tOIU6 z#^OA9iLk9Gflm~+H3OkO61jMBwXGt8!!^_4akeotalhu8MsT=hnH(c42MNP8SCqgT z6Wc0Y3E1pJ5$eMfAi+Cps7RQlqu2o0vUtsKTVL4Gt&DAPG7#z`vAAceo6aIDUs?OWS$+VMNaGr5Y$m8Q8`?Po`p?m?2;^$rWGt8Gua)%!|5ip=+GYKK4b(?s@gP#*tb{!}dKqEA zj?N;C)m2|cSf!)0sL)9#N^o?$46OP{6rPL}+?Wye=%|)h(6a0-$iRt7f{=sr zznU2h&CE6)=&vqe?Y8UL(rCo|WqZ6DKPhXa5Z%xFVin}8~wHuyv zK3>auvMtqaWKt5M-u@`q!CR1a_vmydyLbA;(1q!EZS1jJotz{J@aH!p+uXXwwg!e$ z&?NyxZ6}&^8&X|q8%M(hll$Acw1)ymq*G*DkJhDKFAeQmshV6tN8YB<>6D(ritZep z#(0N>5(A-Ah$=D?rgDs=N~K9oD%nU(r@gEvljUY~GNmF3ipPz@ z#%9H=>|wd?z0hUW_n;4Z86jHDdjT_49wv!{gV&{U5xR#W_y(uF)bkm@Z@VV~I-sDd zzsCdcxp9Xnm&wcdw2_}s6zq1d)MpjvI~5m*ZMj#j(l2s}N(<+tgm&UO6q zzq67-J~mX>Hz-zL0g{5OW)4oNCdDpV2r9*%wi)2OGA}{IzMO9>Lq`z(F(Tn?1oz`~ zI0`h!EZm%iCLytuk!6VRR{-HHh;W&>mD&d}HHOx(J8E6VP?t{kGI?BASjAFY-=DUT zf%`#MdK3{h)s1EN=`&PLGEoXe>#n>iAP+?=_^2VAlsv^VES4^{KOTu zR1%UqYuj16PxS=4%0mS`iG9ji)D2X~_Z#GCRd3K;jQehjTLq{aX2Yd??GWXT0czD1 zApMsj%8dim4_USgEyj7J1gBc<&9E=grprg3Hl3w=DI2-=<^11^s`XU?bal15x<^53 z`L%4GsjuGeK@Axn%)0ei)?I z_Ct)Aq2pei%)J1d&YkacF1w}c z>&)}ob~oKlugwD8bOEnT25BWy?aR5-ntEBc@=p+^OT4UG$#wg>(95jFHxcABnwjq6 z<0^RF=)ElK=VErffzfNs?erTmzKW+`%kPH~_L1Djs?-E z!5ivXgc`i^%}* z(AgM($;iY29HyaYmqQ%|ID<`JQ!l5KkP9B6rE{4$i=#AWGL)ut$CR8_?91n{m0xL> zCuu6lu4(a35c=ysey zwFE{+;N)atj$?@Mmc!ghm~`ScAqCgT0B8#*uk^-=xBRDQFR zUmI=y5jW?Pg#5)1_JY@6J=DxPfm{4LKf>aNCG~e!@QqF9`=opopub8fA5NJoIZWg4 zdxX@VT+m;DihVK_9}~c*Lh#K7{5Z!{V_nIQn8nD1TFs{hVih+lhi|#z*CP1pW-Bu1 z%1aAVN9+?Xu>^i}0$YAB#&?qNB?)}bL%yCF*JJ+jYn<=H#*-YzIE|nFEL$$$_M}m? z?#39gs%XYUC7mye;1@~w7|{Id`AaQ)hGFRfeCLs$%;ZB~GBMcsMaPH7@s$I>>aV}}8o0(@=mUGNm_NC8DYy;<@vF+k*NM>OpA zoS%M)Db?*f#r?PY)tkN0|G(K1K4JR#j@|JGT!YE%Y`e<;cOsf?`3`HFX8td?e8*)A zLs0&QXW^oDww>qQ=mobj`@DCyJ)HyC`MY$D%HYn-{*j(eYq^#8+)17^FSbATgfH^6 zpXg~@=m}5uw7b~j{ero(xQnmqjS`bRb`f?v$JWzGo{8PYu^;k)NnTa7#>MS?<24Pk zJ;{N|sA7$$CrSme^Dp+4Pxju5Bt)@Qy32o^r>|Opea8nN#XZRr@m>suNuDI|r%m+q z9PjBj#iPc1I$rEi7kTW|;3_dS2lLS1V;_DwE-Gu0a)&Kn4Ol2sCs(w1slxzEY$r!sGXr+h2{Hk`)p6wTd{k*?x8RoA!D-MxIasKh6f3q(Kq|h zn08*Z(}vaeqb1m1dN+3NcA;1Vo6^(JlRY_(;saof$OKR4LQmTXp3Fi|Zy3J07w$z9 zuzmOUJz=#C%}7=6b07VksH3gg53%s-huItO((mrmA&TAt(?5x_L-aQD8E}Fjx>gj%)Cp^*9TenW#i+$qJ+t`EMlY!>dqIetZkqZJX=7SIb^Y;QG&8Qc`ZofTj^?};4LT`tzimb%SUk74T-iHg@!|#x$dQTLYTWeXNnqXrIMB z+2Ti%)u|cX-s;ed4q0uR(Vd$8W)II{mTH!tX-xyYIaYzP`heaNqkYz!@~pw@xQ&H7 zeCT8x|3}yKV9==vbQb7tpz&a&^8vBrf4X#Xi(_j&MstpnQoh|t@R#=WiiVvmPI`>Y$KKTD9-0l%)z5V}Cq?X6dU zJb3Tc0l$nh&zih<>wq0mjj!0?6{SfL(#BNcWU-_y=UMB?ks)@ATqZD|B(0DAtyKu|;so)=p zu*<&$2gAQeUnaO(@F#+LuT12>Pa5rShlUU@7W}E;M}o;7C%?DgXhFWqWV!1Fw+cQl zSTE@Hf)Dl_D!7mcdu|kbo(OvaEEj$s$+^;%#j)TZOk}xw;FYY<-H8#|!xntQBz=tF zBtiV_QTGS`$47Zr5;4(!Pw3@BUoUjE&>Uanzfmx#LMS|0p(_P{Ab1Ng3wjGaAo!% z-xB;#Q2SjL{7C3d^e51I?_6L{((uCpl0KXW{YDC{_s|7>vCy+5pRW`t=PIGE7W(@{ z$lD<4n~CsizL6#W@T*e6g+%DV`vGDF5q7H-TuFqo zs|2fvXn(aJL|d-zxTX=I_b{PH5TUQu1NpN^LvLLVXk8EV)^b5tF(3MFA%dy-c_Tx;(}*a~>ofJ%*Fn&^q@nliMCi%?KvKVXE+F*UL4-ao`Zx60 zNJRa5+@RhY+@Mik3a=li=LbZ{e~bvZv9-foJ=e;DRQ*0yUQjzr>|zT@n`Olo=`AW< zbX|*;$g=YIyK0bE!p)aW>IzIwvvtd7Q$@1856qtNcDxlG;&1R<=l;*N zG=KB|omI48rR@LJYGl0@T(1}YkCsS$t^S?Nt^BW`mA16T^xj8>7y*_Eb2%^qEc;DZ)T`I@>LtBc!z)XQWic<_&)Bky{Y zPt=dkktN7Chmp4&>51~TK_2U%e)xS-Ox{>WUQ9pUZ+Hyj=~plMk%xzo*Rh4X!;ok6!)--O z-p&^K9fLfu#ttKIM+F!Fu`I#HgxXMB9%wkRfVG2)5+n+yTek32k#JU$;M%FBg3qhD9yW4XV= zUd{A_0Q2q(*)e(ic1fbV5s+7ae2x!1?#J|d-H{jT-(*a1tcN^2jDD}Qkhdy9zbxTn zxp9uX*!T!T9`AL{VdRZ!A#Xk8u{`zbfs=fsv3RYS{i;Mi^6)V7Qd-EXP0$a~n7kJe zPqg1U$jhN1IgGq#K_~Xx4yhNf^7LW&o&uF<=WPk~Qm$#o=Ma`y?=F$&NQ<|FKVnO) zcaQM#eHRZ??@=%%*1I#I-oC;|`^`iF);kC%kA0A5Y)6`TJo#RVXbvp=u|C9U4wJ{9 zdL`Do7xnU&fb2KEg*NTI1aVV_GTy)>x<4VoL=Pci;^eyv6W?MFW6ojn4kD6RZx|iH z@3ydBUeipyJ6p(eWAdpHSp*|*M+&K*MMD{V-Wyf-m1>B9ZOj;c3xt z+)Hf-(%IhgaGLi1vW0%Rc-G_hLd;=AKiguwCF6!+7MLjSe4Iw!*QhtaT-J#Q<{_j} zPPXs`feXqPVHYX0s`o#y>m54i+@V7vJpS{#-gP0Zb!=U4f7E^w>rXAL_xiv-(8M)o zF029T5iB@jRd9`MQ6t>pHXG|j7v$A7cCbTSj~BpGe4|G2pnbt^ln=m38F@JV$wBBwiu!4;khk*}}j`d`XSjX16WjUl>itEAgbvD5!3ExZluMuSyHtl-U9Cw8ETWleqUP={Sme53&~(Zb`D|2EdX`M`6M>&>u!RM&-e zxbvVZ^k&&uzE$6-`C$JYcT`s$%)%NtwB7Fh8=PxG2eYc0tvfq88Eba2RTVSr!Mei6y|f+dc{Jq@P4+!lkzt^dN(!Ad(1&;la&V@r5|j_xB;KZVjs7y*n{<=bqzHr8*2~rNJ1S|NMl}NI;O}# zIeAe}n@BwG1*|!wKJ-gV^d^n9uQ3`n)waD6b~pq(wMYAXkXM%i{m?%6cIU)4&4*tn z@+Ia?L^<$ZdaTH?=WMi>eNbmtH=V7_2r08m$`mG)*#lekMEMWwz1prx(3`erowT9x zeU7O%5w5R}r?XFR`3TUi%*XgR{sG!Ydndz|V~{o>#j%;OCCh7Dfrqj&$7=gAZhR;J zdr-z4=+(>G+mr*`eeGUtQ|fDUWtl!G-%Ipo9_4qCHc&=)$5+Pk9D9_b-#mGB4OLmSP3{V;Z%2K2!>{Weiglz1>32x8 z{Z)+z(J$0V>!AGr<2QIe{3zOhdBF}I*x)*O`wM>NA5xg{aAFKu>oI6n;w-_*amxD- zUTX_@g6AmGc@5<8Vztuis`q2A$an;EMFIS?s;(hW$NA#krhTHDKe(Z(7<$dx=c78uYt#O)V;^s{E`@#RK{>~+(MDW<&}El2`cWR^ zr*nRA!x4_3V8oFdgxz0fy0zg*a%97iAnMD>bMpKp_iOuHB08)@Js7k21QzCkNPL|6 zVY6Jwv!bi(XMrbC2ex4*%J+?~J>rjU(Cg5LQ4Y#ePvd)(VOgu|v8G(tIZNu~yf+kW zpd6;{ns-l=KYG8GLm4h#$HpA!e**I#W%U*xF=HNcv$o%M&X4d#Qy=aI^*Emce~9fl zfV$qKy@HPIX~S~lk3_xnC(c*yiW;q-g|^V2sNbuopZbxXm<)asr~fhj0`wXyI-34T zY%|A~3v9?uDFjRi8 zq0HUr+t|3~_|x+o>g2qN{;>CRUcJMaS7|5O?J3xI7v}mP1ntE|bPvvL3iB!E&=Sn6 zJQpIZ7$^UK$a$8(<4VK11&+pNrx7^AIC<=Na*&>PXMcF{5%(SN=P3H80OLUJ(@N|O zO-FGbI_s%TO?ep0mb$$@r(i=c7gbA2xQ4|S&YOR*Z+zte79 zd&CFci+C>z8Lvg^8dIze4P#J_dY^CPf(QTZ3TU0I15E=!XQQ7eK9Qdlab~|m0HeLpvu_EI>$cTW4b75QS&SM^H!?8S+*SsZ;O&^Co z**HuX*c-_Z<_BV+Z@maR?4msyQ$+w~|* zTWULPbnL|O>DcOKZ7bS|*HYSwyjnJN=NO$l!0{dS?Evu1z4lFQ>-Nz$umSoR_4j3e z25+vnBBSc@Omu|vC}og$E5^=3=tr9>^si|r%T7YsS!c=n9`Xv1=YoCQk@&dHL)+M{ z(P&qG!Tn7KyEtsnQj+`FNF9h*Q0*tAVvUBeJuyI79*pS<5_dH-pb&~BTXN>ZG85&*k9Wj3d>}a*Ng>8+)wPr1R>g^`T)N{y} zn0pI5x9CU6DL}blNN;J2oO>Nx{0jPTytpx5FwZH>ZJu)WGi+3a`+XO5vhv_pun+aN zDmFCH4%AUW_G9; zDTns5Ad~Gpfx0R8bVtV@-Dn$hj?L%v#axV|Ik-1A_u$V!j=2ZF3GocxYXv7^udfYF zeNg}TsQ*pfrfH1_(549JwWe;=`$O0YbvIafdq3X)?YFn_+M@fw(W&7z`X0wX!Cm^A zlm~mH=hZbHPI;@zPFYjGIfeT+q0gYd8^~u__DjBu^;)!DUvJS4_V3{oyk`uq2JUGJ zaz8lhW^IFF=w$I(q9p$O#eV!d`^R#wPt*&3)p#t`8K>-b%GNUNs`{FFRZT5*^(5$e zW#($!GjC{$;2vX*wc!(^C-q`o@1d?d*slt0&#!nB{&yGbyb*QcIRt&*n>HzMo?AFp zSmyix{ua;A@1swnjd&*!;8-}!cP(~x{bux28g!08$1sr3+0;1=HspOyI1j!BeK5Z? za33|^3m9Mi0qmB6a+Lc3`j2`=z<(I;7cF~r{pPHiCMTc!uW|e}FTW9GuG9YK$T)}g zh3)8T^keo{te@e>7o+WiIku2L9(`Vn=XB0ZW`3AZ8=oI8_;-AMD982O%n=#TfwrQ~ zWvDNshV8qjS-W@-XBSi-VVMZ>GOSyjF;G+2fPKO`&!i5hJ3q1k&yex@Pu>}?zboq3 zZAbs`9+CcW63@#gdo-WFkD?6cjTG>kIm%o=^GcvwL0to%m-M@3>`%uz%RF1N4Q-(7 zLdZ39G<+#GUlu3m^RI8dJ)YQi%f5jhvG3q}rZ_n&OB{sGv?s4dj4iQ?>|1ocs6-!IzYv1Py7GRD+{})1U>_>_Ik3V10&&ii#t#0D=YzM|)E^Luouv%Y-X+J*4 z_(U)A@?B?cgzq>oPq1yU19dsQ(Xmwx+Qat&v?b?MlYdb1Z#C_$KzpHktj|g|HYwDV zc#q*iU5`n*8%((pyc5M(FCRtUFK%@2sl~N+P6%@KI}zO5;ySRQX*BLZli*_8+&(dPWiD1&()0| zBi+s`I8ruu4X$x~*E+KS`|^40yy-{Wc;~@u+y@xbU*bjZ9-O5(tME`?fRo>7-i31u z;%PYf4P@>ueE{c5q(|he!(fQwOp}w}VopO|5N9Fc`8acN^4s4fIQebtT%6fBcjLzF z6i$A>{29U1bqaV3)$1k!9iR{R zEkL`khN*il8y;D-7{7)kD-2zUf5S$wUBp$D3nM+t%a;dqXGlk2M~Jee75K=_T*$kw zZ0X#XU9~c$i2Zk>!i$Ew5aNJsZA{ z77v6(nl2$fR+^n-@<)vsGcH=(te0m*FPb)L?6_Fkin95R$NvWvXNVq-8ztyyGT^Jr zmRwVY75V6eC6x=&Ta{>PBwhhE9y4{ylyPHPdUyi+qaGbO{{vx@8G2Jj%&lIB(fP zCtGXdDB?^6&I}M)FkgPA6fTyMt5W_0vb zWcrk`qi2j~*Yqsal}(>ISJGq_WDmzQz*IA)aN@Wr#d8y9oQuX4Thm6(G%8i%TU^T) z>8l;&E}gd`fQ>0)-m53=GVKwi5nK?jTexHyu5vSCKH^+FcpZeCQb1|hb=naJATnUN zlL&u6nx3z4Z5-GZod7Ys1|m8Y8_FzN+=AfMVfcUnngKl1%NF#TSvG&VzR32&RIf*u zlxd!MNf|C&ODL}t1$!WC?(n1j0P8SSGWr@%B8D94E%UkR&laud#JTN&HzWDx3bIvH%0)0Ana5v2*83^t7a zsDdcMu2_a?ki%95o!Bmif&_h-X5m*OqT1|uTV}`Gf;aQdVG3kO0hg7xl_m5NKE#DB z=39nOSt*ugtOJK8OoKE5?e%IZ^f%iR#i`R7nS&GQL39;+4$-jy_8g*hfSpeC7=SAz zkxIpR!;fe=V5Jj1n{NN94K0kbPS-J;zy+SDg9>mhr_}6p{~0DbiTcyf7HoK%WVB+u zrCOweI3bOYh6fewRg3LHtz0Kc1|Fs_7?0qDPZFF0v*HCfru1P7L_qDvX&LHro?yw7Cw~j{l1CHwG zEItbc-MUx=z<&cnLLMMrM~euW-GYS2blK=>R1Z@? zOf&+>b)toUQYXspta751=nSoB3G7?0O{j#RmbWozw!%g(WyK-4S-{=!|eO<`0}mtpHT( z=p}@0IvU*#II5$?$#~PmH&AHMSU^-qqs4$ZPP7ED(214AABOg$#qtS9er4y|IY}e6gdjVm*Gek4d^ZGDDB@C(@y{!i=BhJLBoq;Z@(;1;> zz#Vdk$8ciDcDh3?PR+we9Zp!44#A6@PG_VVC(F`3=o31Fu0S7P29XNt4AC%l1)+-c zI-N z%%F2xs><2F6en#&EQVs3!i|oIQbW1|qI866CrZtz15!=Rh_c@GdVaaYjhQ4vPb!yi zn(@O+z+fB((bhEKO#(H^1F~LRt_bClOr#D-CX7Y>jKum{R9nYdT$JDV^9`ZAeFr6HRz2Qv_piO$3{n{Zf?iS;Lr=z%wDqze#|`-LgZ`)Zo&vjCOQ+`Y(g@o9bF}m(-pW0xspuGbCL-h z|Kx7j7rbUgVPWk*G_?$WTaPbZ3Up2>BIWvGFk?T!ujl$1g@9q&2r~)*yK!o6MmTk2 zD&_?3v}Fc?iffj$>49%&7%dQGZ#tKwOHBnxHG&XrDdsUG=XzUA zDA5d2g5!Y2gab}0!5KTn1jiNiFq)vfGU3{MNr_k+gDVFHrjemp+%A{U&UHAE+R{X) zkl=SLkPOIiqO`y;oS1xBb8M=g1;V*aDBgi6?+?&_*47$$!A|WEMf?{G9YUu^5TRQ@ z4uSUvy1(}$;y3=0O#i?MCIVeZ7iP288Da|}bR;yP9>C$GB^i&>1e=`Uw38Qcr^!*m zekYZ13Ma0ExkR@f64N+RoY7HCsKH5&{lH^5wKk0KUtGGPmR2l**?2)m6LtdR`W+$i z@`hwy%4!{pCS1ZI^e@h%XqK6~QFElF`~;!-EKctPUp|o{5{kFd$9qw4y;FC*zB6xM z;l9p2Vlja?y2@I9qrT(K27%$*QZ2e}h4$BC!YZ7)2qV=x{fr_dy!9xW-YpfHc zBjsuTnMugUiMwrkDc9a; zZlW`JPctoU?ZR>R0795c+F5os*#T9N({4|IN{2K-8vd2 zI5*a3OkzPiHPqmQp(4au{S*-;@Yw>%;X^>@;bJ;#;sut;EzQcIU#sgYGNYf(<=}Vf zKI1Wy5_kkWU#6h<~Wa`8JZ?ntforQ=HU6EvwgGQ=$Ur z#yVYpI4B>T?&zb*!7(4uh^ zBH+0I+f&n;TG+^VbBs4xcb(^qA%w64+%$GgdYB}RG@Pz05L^icw|${Uoo2G)P9e6+ zLg-T5l~5_(2D%k@BJ`-)2)&m3GjRIcy7)Hc+DR_OkN8-s8lkN=A#^$7kLdgqmwHO) zzs7tgXB4iqZrkHg|I|4yUU(IMvFTDd2$jRNR&ynLR1qSUnuE|*OAw0u=`e@eRjU+l z8Z5<)0&S(Y1617XPpK}r?7P(fgdW9P0MH6~c((`=u=P7lhqaJ6sNXsGbP3)kuUr6>lkf zsZ9ubtEUm>sFx9*qdr8~M}3X3ugbv8nyW@3?5E}-?61}!9H1USn5TY=aG?4W;UJZS zOU=0|7h%2{k8rS>i*Sg#9^p`R2f|_M5rpTdeF%rEe!GcVBXp?%E>TKlB6O?%2t8^nLhP!K(5JqK(64@o zu#LJKVL&~GFiHIiVX``au&w$KVLSCX!uHCGyWODbgfKN-j5r!3Cgr%x= z2s^6#5q47B5vHjZ5vHrR5O!7{A?%|5jxa;{aXsv+G7xrC0}*Db(Fh}I2Er`07-4r+ zjj)H>gfQE2`R7y66c;vce++4s;`P;5ClR_-2p1)#hVaU!CL{Eys}OqC?FfBpCqln^ z4PhH~9AQAU!3)+T)f-{58jG;4nuoBRx)EV}bsxf@dLChlYCzaQokSQ?K`0PbIS5nL zNQ50#F~Ux2F~T%ejWAt3fUvWp@13|ryX}0J`V-PDbpoNS{P-EJOJyTeYA`~#8ix=w z2tuz~g3zaah|sS#BW$C7hA^OBLYSm}i!fQejj*jchA^VOLYSpeF)Magc?f%`sR*;x z_Yn3}HzVw&9z@t%?LwHN4k0{8eS@%%ia@=-Y68MswFF^5%S+Gej31i0U4KyzBgs}j zL+DaF5xUij2>ogw!k~H!VMM);us|I{ScRS-xYXAKxAH+um0tw`Nsc+NF#rUAue~}4 zX_gv+&{m}gUFt^&mD-8Wt=>oIQC}nUs#L7e@~Mdk{b~uqHtIHn0reAvN$U3qlhr>E zwpFQ}*nQ_9Y_Bdx7*xv6lJE)fshSX;W!zu%6q^j`G3{uoN2s^0B2t%qIVOZUYFjYNN~#UkI~RDwfpuR09z9Qj-z(R#zd+QEL&N zqaH%oN4<%#uc}9wtNxC#pGwQ*#61k*05uC?o?3};pxT6Rka`^9x#~rP`RW~ngVk|_ zLzFARiMunxVd?^e=c!8(4p)m2p0933I6^&y@B+0L;Yjr{!VA^E5f-TQEKb}55RO(8 z5spzy5sp=NA{?ilKsa8#gzzGD5a9%M3gJZM?~ctFRA+>f)c}Nr>LP>}tCaB>LrBJ)$b4%tIrV5Q0;nP)uhTsI8&XEaF!}YI9pwV@KUuF;bm$Q z!a3@3gqN$`2(M7@Ae^f{MOfna)Op&c26$Bn5ldwvv{fI3au*cUw)>`LlI? z1@qM!gi38h=vEIQ^r&YL;`1U1ed-uO40052qqrAVK#fJ1q^?Gotgc7cR^5ZJoq7Rb zdvy?D(9x-HFV^YtsV|UbsnZB;5Uz`;Q-GjK?oA);i?BcyA*{01_X#d_FCkk!OYo~V33=)tgox^r z11L}z5Kv;aMweQm(XDDV`qeItL3LDPL#*;&5OSK#W0i>TetXNAY)VYeb&x$NP- zs2!dSDhK-6BYm^%@a7TN+Nt3s0V0>%X~FJ3JZGPsv&0+h&I^1*LVF=X=Z!UmK^k+u?Pfo+IaC-wr$c6e!x*Ugq0r zhhGCVmKLn^?Xtsf8EUz2w;g^T6bFrcoo|mF{)?ej`1ac2uMD-)x6cl{M~ckv`}W)6 zFeqJamG6L^nrWyX;w3=lK|6J@Nw^US-Hq6mJkAxr+f+k@D651mnViJCYgmy?6XcF!~LR%zU zY!Ygakc@EzcQIqfx60kK(>Nh6gF(kN<@aZsV{?B}Fcg7(*HH?9K1%2o# zaCAXJFC-kHGd_z1Y)6zj)FeEIg!DspxDW~3=#szmy=RA~gW^PB|Jrxh4$lL{8(Djg z?|nO535rvi{gUqkJNy&OSDN~b??XF$y~%soS8s=JHPl{TgB{*ts8@VP>@aU9b-7o4 zjdu8_Chs-hQ9Jx|L+$f5+2L0V^}6pPJN$c4T9-F`A7ikXyaT>tcKEoV{^FCm4Frl$q}dhknj7WLw}#3+**T zsV5TJ58`p=lzDPOt6|I8xO27_dh$a51~G`5E%F=-r$VtZ3q-jm#}4-dwU*R1o?JUT z7?c*i*pr9p%1}!@!!S7;s=`xXhp#r&wVnyK<)4Q3b;yJQRY~?|u8`X_`J~GV@v5Yo z{5O|7)D{GvfbGv+{!j-H!{`iOxROJIK};p_r7IY&1);AC|8gC3g`WoXduDy>I_V0( z0P4@Al$xx2+p0N9;WRWvJ4O)C+~F&br>PWm1HO|)fxVGr*Spf#McokhtV+KO$(^4=aGBL* zDU$qlqbqbiBD#S`VFzA+?_nL-HzO1i`jN{UDo2j4;bWK2O5@O(ffUaQ_jrKMmB!&y z%9N!URRF&)Z6A1k#*``U`w9MZmY4c4E1hFSvv$LKbT~|h z8`0iK*p7HYQN&izhq63Ycov9i65TzP9lqRT_3&6J;rWKb|8qL%ORg@~6D}TJioA_1 z*9$_z*Bh$0Cm6PL<&JK4A`x^5tya+L^f**}4h3CJu1?QFR3$vv)j!q$JmOszfyi-n zO%44K9GQ5?bahL$LLY(XOCpl$4n@Jj>$R(Usy{?GpjW%HQ-it}G|?+HO&k8#ER&NO z36-D>JJ;1GHQVY$-*|@_>~ZminJQaF5PCOlYElxZWIv6K*h7QMxXG2(RY@|JBr9X=rb>piN9JIjd@+s!O z9J_DA?A|YNcJH4!yAMd5-3KPl?&o55-wa7x*_3?D?pr{-LSisx_c{<9z4j1KM(7C; z`id|VQ~gUIbc@gPWQTrhh~b`|p$|altL^!oURIY}+~6LwpYX;nR8M;Gq3ixK2k-Fa zgaRP6+^4*`p)?SBs(#v=7wTt-XT15L(IE7Mywf`@G!q1$BkX6r1)(J%w1DTlV?(Pz z1ex;-?}X555E&$X=`9TX7=%{rSKdE`9yY{o?|Y%`hIqmI=g>2T__gm%a6&e;8t~w;{9b0MYGL{5z|CeI|F6(7L_`x?O!{4@2(* z-L^h+kfC1(om`(e*3fT&PO8r=GW2gj2kJAgF!X-VZR#_Z82U}n{`$<-hW;IBUw!7? zhWSq5lBdU7z`)q2B_n>NDRp^dCXH>NEdh=!2l``pj<({WfT; zKC>F(3vXF)_rV5d7f z{3$5?%$DWG(?Bww=PqGhceg*`>8^)6*$$6F9w#$9+a0vSQ$e-mGh0u0*bZL>>L!-! z9_b>F&>lDstoLZVei)J8+sCPj`Poo~EX|@pNaOFI2I651vU4HN(Bv4rhYWnqA`F zXNU6*HPel!yCOr)a^vZ4z9}~sR^rp$`7oQVqy!0ky1T}3%tHd7?tW+z<|BbmcNC%Yw652<>+SGIp!B4-#EskcuMJh< z#tnNLc%ja_)_n|ZG}Kb}arCI6mbp*Z;R&F4A7xj%|7wS?Fw}DQNjtn2l)l?q;l?K4 z>ER6Vd)w-A7d)`QPFJC);g??{!|n<%kIjl%${n8-yTj#UFA#dDTerO>G-n7`$)UePB5ZXS)YDDN35PHI$p+<&oH^e3CLfjNWROA)t;rC@` z@g|D;_##%;b4a5AUzR)T1rzU%e`jW+yw9CpfP#9Ca5*(beTNFwdT?LND}@ zOa7&>+b*O&&S7;aO!X@ex^b7mIxokGaA<#=NDI9kCo)2Z<3uEMG)`oPP8ebitn)>j zz}*wg=|2KRJ1mDMKW5w2DwKs`q=)UzP%GaMx2URcY|g>=#}ZyZ-KFsSGZ~C}*122d z+u=(^{!o~qHyngnRp&l#da7!lyIh@htw=PoC-?6#(G%IvBUU>zU5)LM^uR& zcHx;_Q;(`rJDdV4)DwA+tA%zr0_wpWP}^0x9ex}2X&3#us<6XXB2R0!Lsi=0rJ%H1 zJ*8GAOgzu3RiF&#bE?V?|JYE!P}O$$UPJ9t>+JA0L;X^%$BQ{bJ+Er)@NW$DD^+WU z-!;^3wHcGOp?;&b*x@e>^|Gq7Q`?#uX|KW*warfLVG>?LLN_GD=B#~4=(-JE2M+E0 zZ>UG?@O(r4Ry`_D9db|SPeP9df(W{lz&0aXs{)~U($TIT1gucG^sMW~fIGy89(~ih zI^YkjFgZ5`l0$swsB_i^f}tCb!wZOOT_7CVVTkpCw9pev|RUs?wT9wfp)Ozt}TInp>qv! zf1rP8GzhKa)<9lp76`tXbp14tZ}~eQ7U+ba%O+G8bS((zXA<3tQka3)Ax)IQ4944C zSHcW;AV&+m3jbwJr*p{!;lGkHucpjTP*;ZQ6K}jEwxJ3A2&o5#_W#{Q(T3v{VFN4FxqO@)=;5|Ng9VF~Hb2{;gKl`6m9LJBxPUEardMpT)=A zS5egeNOD#gc;4ZEKzW|_fgjS4|mot5ZCEn`m?`Pby(?Wj* zae{=)&Io-4;xq}j9SM0*Z3mjjYiEaoAbOMV+c}{Kh+!lGc5Y}0hzTT;?L5o>JLuT1ctZBMKfCdcM%P6>hm`=}vH$uEFW4?os zb{2a^X02g%`-Ejcqc2xDaoccZk~8LI#NEqCXJ_7J;$A#~`y(I1J94Qr;bt%0HpIO< z=r~ux!(AE)Lx09(;Pw|LT9Ek$AT@H$gr|W<|E_Z;yzIHZlr-VDa2vJ3EBZ-42Z4u{ z#Yk>zNX|0O1L;JfxKA1dt&C)jxe)Fxbe3h-0+J#(OgJBC>TwgiuSNL8jN5QGji{Eq z3v>$mapZd@+;;3A!EFm8ZEd-2`4{_!yaiG@{Rz&=k@sTZED3wFFdh>#OfH6Ro6BhU z+WceuIFV_6qe94xMfn)6oybzsD{-^*m=_`8d>ANqQ-tHh{G;M=SeBjiUCfsvC&6{xZ{Qje_=Rg`17>Oc z0%p+r;cNB)Uc|)yMG)*mfnVbD>X9!XRmvJBJqe4|9|qSB89o+{&F~4<4#93BS7l~~ z@C9e|_3+(<(BQ5?ksIMYnX);Bx3Of?n@HS;ph?Tm22UrC=EL%@!5RE=#+0Ps^%=u= zf#9+vxH|*SV?dY<;XN71hyqRjXaQJDN_;4tJ}4L7e@-@yVde;?9Sq5vgJMu~`~v5H zkO#e8a$2C=JYHYI*rx@S{V<=tCN4anWJ!!WjK0h0oB9KI@_}~JGRi%5T0qa|mobCX z4IsG!ORC^9bBGJ2d7f!k?nc@nIUvpB`t#}_-64FX^HqkfV$MT80{L5#%h}>XGSQB& zldNXisoYXYs%l}n^$6j??@23Y6{j7db7g@4kv#1qy1yCNjTmX$VJsTKEg$!HfW8TI zx1lQx{cX?=_#GNphSvkUSWm+@)A-s{zXM&aSX-6L-G;6RlKvFo5BcJcz)t0UADspI zeILCLbUIk|%BupM@1vRD#Xfo+!ml#)GL+|~`W<$}x)Xh;vxYChH|_5Te$$sp3WSGe zRav|4QX2oi{ zq%(6Se1e}@Q^>~6a?13~F zG2a|&^V=Lkpz%*{WPba7`Ngtu(l2G$@Hih%`mOXC>G#=7pV2-aOqcP0Jt!b>{xoXb z`XuV;?CT)~)0@^Ou{X?q0`%a5Sa^=RXTN=Wr6GyS_MG6JoPRQTLsAFy8f2==*bPbB zK+bs&sZ9rHFuBiZLU}_O-jYQA=R6DA^u!C2*cIpe8T43&UzkK0&&dg6c|v-lrTGs? zrn@!T^#24snc>YzG)ox1kmz}MPN3)INi`GTkv0SV82!E0H8gmR(FF*lA^CHcc&ONmx&Hs<~XsYRsIBnGQM$l zo_VaNVW@0OB3%*OWPI6mD5k57Z#jICX2m0-m``PJPsA~m{1m=U`u${4-cLuSd>ZWW_Z86R`S|@c=qPEWuf-r=;|u>WXfvKEKR$If15<{r?_$t( zj4%3opx2QehAj~Acg6_yz@b6*z&Q_rZen;^@IlOQ<^)GNP8;bF*!95Z)%ta8Q4#sq6#Y3G}NzdNmThFSM)#_xdYsa5d+{00e+}_y<{wcnWx?+vJQcLzU>Y1|qETXEm=b0LmhU!Hr5V60 ze3K21)AyP%PBvJ_%}CD@56IW!i2p_Haljg^MAK4UkTvqZ)ljyjXe6JA(+E8rr_yNK zrlIYXmti^|^mJB>|8s4)=T||MyOH04cnZTE|C`j~h6$6Pg&s}rvJ6d2XKQnv!l@ab zp?2Rk^s?YZCKY{|ivJj`Qm3B){pS%XGXhmR02B=~W3;yoZK`gfC828|8c(}bwCQIc zHIGk8yBdy1OaKimgIO4TKaKg?mMe#?G1$6v=des?E3Kx3-H`u!GW`%(<_RpO zhdu;H+F|&-4Tl*grioV=JX73cIKYdpO%>Wk>D=_w0gVIPmsTH2xG z4z#S3emuN`*96N zS=1B0(aX#)vRmlAFJek}vcF2I*-{xBpz}`pee`-DVe;mrKTGfB*4wbivCHz}WA=B5 z73><3uo@-lob@KclAa0#&i<=)unHJ8neTrOGI^MrnP0M^&N-hUEM;V@=9tIlA^XRy zoQwpxDVkw!H$WGR%P~Brrz2`$j-3?qiAQ`g>~oo7(kC$LGw~Wb>GN35<{_qJQ%}=O z=aj%Z#k~C@8CNjg4Ze7WDU-}LY?KjR9A*TT1qE^-&RRft|h zvMcGBG@Qr<2)2uF!_7c((ywJvKMtG1JLM)<4YbM!|k|xkSG#7%eN(P zHns%rg6|O+hu}HkBq#faG{ar!^m~{-TLL zJ7=V3J}(AX4;yWSiFPxi{UgBCv(NXU{li8Z!`xp$gwPogK4y)-d8QY^%nE;s^*1kt zag}@99a*4rlRayG?YencS@pB#&C8l!o1Hy(-Q0DxaIDR# zt*Mz)GdHWIepcvx^Hf)eYvgna$CK&v!T%x5zjLUChBX}Hca0% zug2-bnVjpJ>+5h>bca*2qOzhgT3Qy(#c9OL3!)XdrHc#XyKq%iL1naHnaD*&6_r(T z=b-FwIVGlDyb@{ zh?Z9r#Pb_4qW^5&gp43&)2jZ==@(^d_06oJAg_R;?~{W(qvd5*b^Q65bA1O)r3(DZ z#49R_stRxrc|xI;1r^Y==rKb3b8a+mVOjpFzP!i0qf&6F?f@|$=7P_UaSTS(KBWa! zE6OUCAPet=@V%&D?Tu32n?R&95xXT~ZJ&EWjb}6$x?6N@2>DvJ$8g4N%#V+=Rwfeh_d%)XM7e z^0JD4QuGc}j~0~{85EL% zX>#-P(X&cQqKgs&@(W4^4#0=0HWmu=$;guQBPU(K6V4vNd6aRZ9~TgsN!! zUV=%eL|*K2MWu_%`f{@vZM>Z0W1p5cJeDs_i0hNxvFy61iJl#i;rSPK1n0;{D^~Vp zfqr&|(T6j7AH$S0C^x^XJfSWz?z3wmQyuzZAe9L-t zc~Ne(Jh!5s*lir$+lz_d%8KQRKj!>c}wt317CV$rhOiX70siD;5d@5Usxum{lK9!D9fa4BV_9yM6VCzJ0S?5zmt5 zhb@t}5UOJ4wB9fa#N47f&l()XiO*roP&{CqgnZ15Ma=newB(^@$-rbJ>OG`AK!XC`RPiAma}&svOwg zte%>{mvjwTS}` zGR<3R)~2SzXedkYG83F~&FB%v1u{Asdj=9Hlw2Sz?jQHC;ug*6$}BIf{5T486|ZLX z`Fe{5hjwJwRS z$Tj1vw=`6$K0#LVj7s~1iz+Ltu?X{Y{&Rw64G_j1Aa5ORgzw`8^75zfSd=~M$A}kh zI+2-xs(bh|@%kOQQhpJZ2Uy2*s^pL2S-;!N>J0%Jg^V9nY_`FS5}RwIQv&)%lc?z{igcHb_d&po{XxBmKKy%S2+oEG}n`m zrxBId>w)n+X1us;juA6vprb2_ARpVp$IdUN0msNL&LGV}B3pJQjo#WXB$lq93Zco4 zQ5K9pMr&)19(~KLYl-it<)rO zm%bD$v|MbMRh5;&Y*yGOC4EI1HxHa!Vee~zN>pPlQI5|)LOq~u`50Zj{Y-yhT>mY~ zEh?$T5_W)gv0`8bW_s_{`O>M6knMQ(`XHsxrwp4$MgA!H6}gN0be*vF3#j}YCu+ry=HClFGa+Z(u zG|uN`mCWZ+T2_j&GF}XAR|3h2TNTH1f62zi^~+7Z=w)W<8r$pYn}4)u5%*THXH5%S z)Sm%H0AtvJ&8@aI2w|iNWO+xr^}{XhNbq?AP%5L@BnS zOA-TV&Cq7&S?y0uSyr~Bs9z~Y{V>Y06|4HyzzeNfRo*WpCs>IL*r$&P1y>X-DyYCL zH|`B>@KM-B;Ec}aQ;8=i37Tgb3|~8iNmMPX{CW6-mli+>`M%tIVdc34)sdN2Laa;s z)yEbngB9mr+QT8A%Y7^^{hh)eY6LQ%I$}#!t%zrw+*BL5$^$5diQd0{W|9%jFTz}= z(psbhhP}o-mOgsn$5O~xc$uEy93%e$m7t(1w_gXaMl`V|@Z}SSMDIlv_*8O2iR_*O zbv*bF$OQbWOFzFuImS1u^yOvK0kY6|15!(|vlJ(Me6c6NCumg(ePU8?f(Fl!vEPkR_A~&+jS= z@-Y7N?|3E#I{7h8ote=JD^_4feqec_Pv;dT40q+#iNhiu zq2ZN=glI-8s8JMC0e>SI=_j(Vl2bCQ)DlM>zWordRIJf4VxakbA?QBb&+++iS(m^O zG{J0m*#TdZWwQ+N#>mP6BA5qocw_^87$}%?hW@#lDM5d4nW6pxva9_AiWcSe8JX?U zGcFSD`fxStuX^Q@qH?p0h)46hqLqAJVk+<&=nS8wcj!G1O*5v}m?v7#W7vqTcm332wx9;OU$*}^fF?le0W9OmR&eLWN zc3#b5%q}swmEeD}j^}*^Rn--xoS~XIX>JK0znIy6WqgsZFf5l1LuTd3Y94dZX`*>6 z&A6my*(_0(*}B9QoY9GxBxm{SXLjgfGqr)^*sQr`HS^)vCyc$=rcsS6WYSm3L$FO zCEgQD3Bf$2=%0pa?q!3GsuQ8 zTxmM)KT_-k=WM;WNAr-(;-CyOHsC8x7USPu!bZpLZUaL)(^UdlSBz$nUZ{ zH5;5}Wan&dZ*cgQrnzC$vw3~T2B#C5&z=?SKrHhLXSAVi3n+Z~eto;svThx|WA7kp zyy*4~Eo~hpS@v8+Y-UVD&S$blCL;&*ZmMtYXm_HRKUCympQz|OY%O4^6pcDH?e-;2 zCte3uk~=sm+>TXF+ZOz_wzNC8SVS_VwrwF#^k)t62)?})kKpT_4Rvi%4Rv)}Ah(8& zhMLCc27KzieM8O0dbrv*MAz1|*U!yCXtWba@KmLx7H@6VMK{#f)Zy(|N@8fr6p_6<%=T^-76clb)Av!MlXTG|@cH-H^|=iX_m@7T~%=QOOV zsjYYHORlKSx)z#eWZ=t^t$@ba97WsM^42vp*0WwlhSp7qz{RNRT3Vy)>Ky!e;p^(` z>z)WfdtocghAL*kIp&cT6mI=` zXKiQQdMMc1&UFk26DC%4Q%z$7;x*UFRol_#)V6dscSKEI?M__-%52+;Hf(Re^MiIq zWh9ns-^AqrhD|}Isk5=80Ypa>4;}C*t;33|t^UH!`u2|4JGZ_k66WpMjxDkHkUKky z&!?@vsRr$hPUhvQI6fc6iIO9uqkPZ-MTIEq>!_zrCu9j8(7U#D)KJ6N>}a7j!=#z7 zH8wOgKxX#6S!xcn4QkR+-v+Hl4Qd*pg&e5u!0*`7j2g#^+T2b?J1Jse)TlhEx;E5< zTc@-(M%_`%0X*3)X+ol{j9j~+zIG#%x8n7edL*<0YHzrRo!2Xby~$~+Y2WCWM6ESj z8(V7XqU58G2i2Ome25^4m2L@%muYl$|uG^5Mny>ny05Qm(hy{w+m zs5P-i*Vi<&BH#h?xAj5_+tF<0v?a|x2+eKoXlU-N>1b#H|1B_mXlxgekLggt4m(tZdTEp&<4R)e?MVlH=gfCTwkKY=m9$N-?@>x|KEBX6T~fHUWME?rEo21sXgX z%Ni7Rd~nO5w9hDtPPNG>Yh7nk(^gcYwH}7e+U53^+Kn;0TZe|HX=3TEEiH{+fgo)O z8fQ9S(J<0%jMmk+!ko}9NPy8+=yJyfV~WX+>CBMR7H2~?<1`aHVAe3&VWc(=r0#58 zPr9bD6%l4d+dJ2qaC*1Z^WQn3w<^WUl4N5`%SK3l6Gtv92qQ-fUR$c1IOmB>scnv6L%;XRPJUw%2YtTo~J-0;J84Qoc*jWFz`p$ORR7Hap zaYW$&W5Z3JP4#sRHEj(j!VcgV&RRNJYFipHq@h7gHH?k%$pMdx(ViR&ooHt><_}iJ zvhY-cMx!~LYr(kGMeQWO%NYhVcFE;cypX~8bA|bt86u)y}c2`=oZKOPn0%TBMe8i z5D^TTZCA4DFe0Wcn3Z*Q)U|Ae39HB8-d@!>E;$~ZL-MN^o6adueUCa z2iAqj-DWdGvZS3qp&K|WnL=ADCbj&W){XUB&5Z?+FzgtIDZsc)0mc>2v7GP2DaZOv ztx*$)X_MGH4z_hn zLMawI1?x=dTjh!_!rqiWN}o{7I9f3mpuNF*gYMe3W|3z7NWp&AK+YapagnL5H56Jk z^i7D!IF!}nhK*~y8exhtv49$zjuh8y*jxLCnH}6>WUQ6q)=7!5EQI3G+{7X~90{<) z*viGBZ$L4$9S1#w)b4Dou?q$uJlDdyz-2TKX4=_UU*8IAy$O>^C^;YKd!s(=OM4XK zYC|2&FDqq~$;=SUM2%K43V*Yv+sw%vsi?rPLc58fvb7cBK>xF{a%!PN)Ob4(#Ti{& zPwlV6LZPi?D@?uDCSD9MfDKhFa5md^!`LA&3diK8G1HrVn7lfTt+yt(wXu^UiWx|a z0XH;DLT>>}>(xmkt z*U4u2VwO>w!eLs_-deL6|MbcDrgr{0m0x`@y)>+|_uH|RT=bhswl{FySknykYd2Z~ zqlfC-F*-3YR&|u0pfTAHmsx0{dK()Wv0T#>18RaDhPoCsCzWtLsuQiLt%Ws(Br$)& zoY^1Kv;oDL#8|u@X^Z1+%m*KV-?)e9@hVvWaEO}^BTyQpMl3J9y*48U zjJa4fW5(Nrj@I0PaL%aBv|TmCHYfk9x}ya%@-}Y4nTYAHFrgD@4s#ep;hS?hB9uj&S%pm@s-0*7@7TaOi{9^)C)ov`A_l@k@zoB*0 zTuyz=SX$G@)k758ARn*gYu9qn;jGCnLTI2cPwwony9{U%?kE`vnr#Q`0ee}CeGl8t zn_(@YYhe`ZPz9ra)wFF#)Io{}fz)iOX^1JNv14mnP&sj8_uAsC3C|niX+UXMw%g`} z8opQN7T-U z84|c;!HyN=fj};7>|TuBbi<-4W}S?ML1HKgHikTgxtV1&lqdzoOo8i8WtS)rYy70?c<|O8N02C z?HvwWEgY+`Xg9L7tL22||O+ux2fZCw|kdXt}6%CNAq>nejF}jP5f}26>*OIqBfeHJtI0m#T(Z z)^~8=Ky1rR>>BpXxjz84#zp~l)2Tyd!>+Z}JgI@np{IEaW1i_ShMAz66+_F$8f*|_ znrf#r*2b9e$k;09LZ=mK=HSc`3{l+bYIio7vS(>u7uk91E4!_0=Xv<*8y>O#KR=iy z7w76ZH9QT)3E=QBClBYmobH5El5_EW)nFP9eM%2x1c%`hFC+0q<1vA;fpNhT0uuu# zF5SM%=4h#P##T({TJWPsN#p^hwT-f;j3Y5cni*2!Unb7x+INYV&_Q z5~pcxeO*UmJ0=Yn@$1`WHZ<2ZcGlGcvHQtq7XK&abmGpjGHJn@EZSbTab`2tZ=338 z&Ym%A#+(^*XW}tmTT4sF%+B^WLpW<^IwlI8Tc$JB>a`6}_<_&w`F~K_|AQ=6qY^kM z2~R3v)4;j!ETS13*z5y%nPDFTAR<6ftcAicMbIzUb+apt5Gc1Nx7Ai|t0lM9JXC2l z^2G^9n82>KXDzK(ldi^85X*Mt0JY~V0WKV>#xlLEQK&V{2*OEtNPx_2G@O0ugbjnGp->RTp`l^-U1uLSC=MlscZA*VUK;5LO$@u=bBhtOMk?{8INc!F-#i1c#_r~CnP-?k9;E)aY1_IK`LPNHN+$EvpCms%+?xs@YWc<<4 z5Vs8_`T`F$Gy50OAk`D%otHBaaY4RwzzhG%_o z*nMjg1?}E3sQBTqdvH@17<0dgmK*A(Lx~{7ADep-YR4vA8cJFmN?sa@d>Bf)G!)qx zN-m0pqr~u|&~nH93GzXvk0T%O@+6A@u@7~p?(e&7U*zmi^82AvuQ1((`h;koAQ9T& z+CgaID@>cEKvc z?NExYPzKVbT#nj--4kgh5T8s?t(SztMWIo!1?ZVb=%Pp}s9TIiJFp2|6(ao@UKvo9 zDL}Mov z11S>szYqc@pF_$F5LA~kBa~;pxX*nUfnn&#iG`tXN!j*L5;83b4K0BQKrYWB7a;4i zKk3NB%;ray{GX&^@RtIcKXh9trNrpL5D1s;IW)W|l)ltBM}*x|P{|$0>r;qr2RKTF zSxJJu*ynx=SwTB~mvjWgH$lvVjSbOs7l&q2jog1;1X;q5YH)QZ5;+Hr@&QH-)b|EN zOmY;77y(m433NgjTClozli-0t&zmeSsXh4NN7Tr z+x^8OVB!Fz*bR2T;ol+tbay5sx`Spf9er>IYH%E~9sxzp*oPjsGnBC?l>DU8>m4ZK z2!<$_pQWL!$PeJ8R=6iax$b6>ki@Se`%L#k$S~wHyd;!@FT_G!3PZujW@9~qXz|en zq2QHaw|ld(vON)4+1qI(p|PQTu!~oj=G_fR!nizxZjO-@;&~h~=q@nTg4suc`-5HJ z%GCR6G65kzgyxv=FbAcf+i4SNIAF8fCy^iceKvF?H1_>a>J?C}(Aa{|C}ZGYryjK7 zFNK1W1Mj2XUxaQxHtc=|d81rZ2P)U~@9^|^oTpE=f+zH;Yr@86uomuM3=R*wgQ0ML z3#FEXhJ!t@H3VY(AI3(Jw}&B-9w-3%^=+tf<`Q(CVz%k&R6jJSZH42DLZ>W6XR$Kx z3eABtxg6Z?3!M~pVQ;|q5%$G`sFXp zlmOe3)&+B%0(V-m`w}@rV|)fO{9)KVieWDpc0U3M^+6G|n&r zhqsui+RX?V1TBEI#~_|y*5BG4@3LC1s~V_DzZBP6-P0Y(UqYj zWABred>G0^uIOs$^CyQ(`<5{kWpEP3GTdKpfyR6X`AiPGX|x?|9_aeg(5Z!?*^E`} z{`Zz6?vIj-!`GN(lTaY)J*6mg0!Gfq!3gB}lVqeVjP!(3pa7ViuoIMo(5}?`_blo?p2V^N9g@1<*8&0sgG`n z+za)m^L{v){wc^}7>1=#xIDxu*(21zVPW_B2r7>P$6=r)j)sx~Y54wxF>8o>6VxFX zUV>rcZO~)fTR{)T#A^&K>PQ&MC86{sZ1GXs5f7P$;WL866(;|KFhcwa$uh(4caRQ) zEme01rm34Lnr}wH;qTxihd(Cq>}Cv0EWu7v>}b6Y-ex>`icualY(0fYBiN=TM)iZm z?!$Y(O=_` z@%ZIBYx>a1&WnBMQO>eH^jPP2-ch|KlN9Gutn=z(8KyW3K*z5%=W3q29lM4(e+bhL+7xAaXcusTXfF6O*8`x`@b164Ha81N7fL)#y;E(PJqMrr*N4U8M z#PG$SKZKk6DWvzK{2=leEBb8E$AM;%4F4ne$pp(8#KT8VNPpC`Hvw! zPgkCx@Y$e$4;o-~R-Edl1eq#ZW%8K|ckW`)#BjMEo~==}!gS13FXTFM}T!?Ts%+nE0DP zj{@!0cP!}BK=b@;=JyQv$pJlE^jgsTPSOm~qe0_au+C`Fe?$5x+@3tY1OE6G1W#V4 zf_@P6WX1n30$v5}wdaYT{{s3ng+GV<#y}We{!O4~f<8szLqRVG?aA+9@Y4#~Ywwlh z544y65YXQP%{@of?4}Ko-g_nZQz*&|dxl&?TTf zd-8p_$)l%VWpMMFhF<`!_8#)S0De4no$Y%&=uXgH`ZGXxf%fYESIG`vhcW55A^Zur zPgVK=`1=atd-~7?eyA^2KF2%XK-drQ^ZH)_+`q){6s3O^f*Febcd}?e>~gs?=(}8Q z+W9Wm^uoA@Ypj5urq;$U*R;Byrj?CfuCY3PIx|kdIN>41E^ zi#9umx_TGs%?UJCcCm}$e@Y1daRPl|0{s!>?_Es)enNOOf&RoNV#dEQq5P(V{7z7O z+J|9ij~*&EEw^99z7L^s^%P%w<^6g-*vWhF{_HApKZE`d=l`s}kh*h-mhoVHm{^ zD|?D@Sa6hcM?(DXCFF+%Y3yS8_a*Q%H6i|>g!rwo)VBWjB!uTBl)oc^K9JDf)d@7m zZto(0`3d|?_5y(nuTG%1CD3OklutYAT}*##LV3SPpgHb)7vm34;OFIp`2Oc^jDKfB z__q@1sb1zl#xKEd{Ehe=8u2pBeS{woZ^DgNi-ptHT8z=Pn2W({JU#()8xapsJ|*6Q zAIcrS8~GFOv~#raccUEAz-}VqKS;dUah@h#gt;m4E0{l`-s8WDv5fdNe6xm#csqz! zpgiKO_suKYK+e>G!YAlt(ZF#5&vT1C9n^~d+_yTBGVHuv~%P& zZLl|>T{Ox^M9hmnC2}xJ0-gjQW?{ZVJQI8q7eTf}OyouoSKB#_3xSU(4Ktoec0U z;3p`@-)=uWIerViDnfdf{nX@mHY(+L9qK{6%k~eJvy${T9cK*@^1G3Ua_<#BK}7uV zl;?JQosNifw-LXNITY&8@G9X3;wH2&5%uGjO~~IE^mn!g*C=d{ETCJ4IV!On^&?iG zor#r@8?g#}646-;iOZpf#1;4~5^*KUC9bmHzj9$@SCjq%${?N(Jt6)F^qUy9cHCV9 zdGPYus~-7)9RFpt6XZpaQ4TK&4--4UKjjL4uN}DN82=6E9dQrpOS}~IrQA?&+M)4X z;7c?=<;nEjLVh=J{I@Z8A%4exrIR!Ub!Ysy@Dt7_BEOZyyD^s$ew%nL`a2Q%?w7yO zfA~|c=})~L->LROK80$R4kFt9+r-O}o``mOjfnJziAbLg`HlasZ6}sbxsxBP)QukU z6NA(*&ROYSPDDC>WRmG_B_iE}3V%)ET(`0uPN58+#CsrTBJ#P4i153KSEFAOzXf{% z`_J$y%wxvyg#3ue|4kzNIR&HtYU1}$J`wpoMBIUP5|#`GjrhBXNdI%uT=>#|JnDCC+f1>xeVa4#aHOA>u5w8*w)JBXK_Z4e@m712G4BOPm9HMVyO|LlfsgzQnW9 z-o(YwQ(__Xgm?z*E-@eaPAovX6VHNP5zj%p5+RRQiRYp}5Eo#4lK-2;T-aISLg=OZ z4-@lXcZo&NGh#8u8{!hQGsX_eKZ#g^eo0&kdrvGyIIk89r>(OXqt_?U8_e+K1lQVi zH?bU1h)_9$4-o617Xgcn!sMW(=L^>eKNa$8z)ZJMcmuH>aua?ayb%4L{?7^D6V4A? z{|@1c!eFxXUr0p#YSCYbVf060vG5PVA?T0v&lmnxxHZ-KhtOXbzDxL$@b8c}{m;&@ zc)Rd-!oV==pCeo^5cfFwZfs&CO%Zu-~!(b3#=Av$yYTzM{}gh6f$<&}J|lci z_*>xt;aftkBbe@p@FU?rg-Nty2u~5F3%R#Sf6l*%6NOWRGlbk@W%wDw1;Rzb5@Cgq z^Ebx-4T;m?J?6uv5a zUHGQ(9U-4Nu)Gh2p9=95#rSic$?!BG*G;6y3AtV(eX?+xaF%es@El>juvo}_6{hFj zF>$qUt*}YBNqDiaOL&#=OTrt4Uln!>?-AZBd_ee+@G;@j!k-CW5WXVhJeqtS622|` zi|~En$3lnWC*p^Nsls7GuA>+}NjO!QEu1GjTbL*0-Zs;f39E%%FVVkNc!AK2>+ru= zG+yg6@var_5#A!aUHA>*cZBx||4YbyB$oH2@LA#W!e0r0BYZ>1y>zDglhDjFK>uCz zXF~3~Gu|NKP~k}7al#40>B70fvxIrVV&O93N?}yEPS_+g^Bt7`MbTYCKF=dxyM?z1 zzahL=_<-;s;bX$5g+CL%Abds0^%V0zBz#-=7vcNDkA+-sF@9K>DjX&pBRoMkS$LX| zUvy^rxx%xAW?l#XLeZr{ewUo_&l9c@t`jy2+k{($mkM_XuMzGR-YmRL_;n$_D9!SI zAbe1`PxyrJr^25L`3!*RUKPGBd{g+2@UZYhA)n_m9UeCuj0n?&BZT9GnZlEW(}c5x z^M&UK^M%DiJ`ZMj%Z00jYlRzx&B6}hMZ#^uokBjpVSZm0-YUF9c(;(x{TOer@Q1=j zgg+6Q=f#Nk3(@?RH`D!A$o*W>ZwcQO{$1#BU4ZbgFjY8Om?=D2I88W9IA3^VK@Lu5~!k-AA7rr9=y|734j_|PX zL*b`FH^r8pBFqqu5uPYKSvXxdM|ifdK)6&`Ej(XXFKiZW7H$(>BfMGo4dHi%4-?lq z&NHH4AU0r~E&2`7J)-|2`iSVyLykVYcvGVWseV;RV9Y!X3gr!aIcb3ik>33tthwDLf+Nh6wpd6OI?2COlhM zBwQ`57q$s66J960L-O!%DeRbj92i14T|6&qsYW32F8VWF^ExK`LAyjXa(@MhsR zgnNaL3V$a2wXj$C7vU$u2=>y+&q(1!;Y{IK!Xn{vVXd%Lc!}^D;Vr_uh4%{|6Fw(= zRoE;1Kp4W_zTr!Fl5mc&Kv*rT7j_D-5Z)yGrtrUn&j?=@_6k1`ri``a&k)WR76>bZ zQDLKSt8l0A24T1G`@(&~XN4~b4+#$o|0ztxvs=nzoN$V8t}tI%AzUMD7G5m8MtH06 z9^r$+p9o(NzAk)M_^~j8XDvpLg{KM66qX3j7d8to7G5K~Rd|o^LE%q?F9=^3zAOA# zI1G;Wffrgm(+?7d|F@PS_*-v+!eKGM>edzmdX8!ffHW!llA52pfc( zg;xk~5Z)!cPxz?tIpJ@Fe-M5kN|c)Rd>!bgP9 z3ttz$E6m8We2f#GBFquy3QL7w5N;553cG~Y3vUyCNBCpme+z#jd`tK@Az##_T*e3| z2xkb-6c!2_g`L7K;q}7Xgx?YVQ23Pax5A+lZMma_CkRgy&J`{cmI}`kt`oKiFBM)R zyjl2l;SYrSgf9zU6TT@tEc{eBdXnYy1mVfTS;BLK#lq#nwZdlM7ll^|ZxVi8c%SeQ zVUO?~;Su3Kg(;IIKjB2-4B;8VMZyZ0`ZvNi<^Q(mzX?Ak zg5RT}!&5CiRCuCrrm#R*Evy%I3a=2}B>blEzl6^SUl#sJ7?@_uO%aY0o+dm)SS+j* z)(AHXcMuyL=Vsw|gwF_H6MiNfIo-z37Ul`7h3kp+j&q^tONeOC%SG=Jy+`z2!o9-B zh0hU@?teu8PV^h1|0MdaqCXLRRP^8(HvLdyBi=t3eWK{8qGyUeleiJ@>Bv7{{?$a( zr(W18yjFOZ@P6Tw!WV@Hh3^SJ7N*R!`Hm4z5zZGD3Rem@2)78Y6W%6#K=_3472#_{ z)c+&l;4DiYPh5xh?nTcgLf-R4FA`P@YZP8D`a;p2qAwTjlK&pjw~M|@^!G*IFZxl@ zPl|qC^oyc@FZ!V9KZ|}(^k{y4R=8dGRpI@@$A!NX{!ut|p3P^fFh`gxJYU!>{EF~t;VZ&F3;!uR zalXy>OyM=c$A$ZaFAIBw?+Hhrj`ZvC|7b+ib2<_IC0q14#0_|^D!NMHD@8X59b6nI zl7taqs&EW(E#7MpW)d+k!Zg?*re|heF--`wX7Ypj7zDefKc6LBKm_0U!a^eWED@UW zn&Rb|^q@_8lxyOHHt{i^X=OUl9YoaQHqqTg*pdCBe@;ZXuZn(+h;n}#1fqVGE)e-Q z5s@$77iWH>BS7Tyx1m6!ADj+EI(tAJ4oftL{Na4TTAcOQ-qC8It(n+V-$eMl6aQw^ z)vxVbAFWxtmgmvN&W!XQ7&yZm8^}}h{3l8J4)~ja!}ItlC1(Z>RGyJrv2;fL7MzJ` z(#xPElUl z*?}X!4UbkjIDB$FeJll8J2OgV5KQIz9$3ki*nsm7JK79-r#>>~=N*@bR86f+)lBr2 z%_GE3IsFczj7D(+cXJCqm{Ds^wPtFbrOTo`8Tif>^-dT~I8F24J~z`IEg9v(s5lU~ zcEiT#I-cx0qq(J{e#YX`>ggsxrSk*W=45d1ywCXYma!8r?YFRehgTYD;t*4ux{;Mh8+7%uLYk9;`el#!W1i-CL293d)G4FJlo*8pvt~oJRPRuns=9(3A zVPu|MHzP*Qn;*+6=9&|8<-}aGW3E{-S9Z)b-Ax&5gORY*M_O zm}_>-H7n-Ij=5&BdcM=72RMD&9I5OTpY0VeFXoyXbIpmla$>I8G1sh^D?6K|;;vjR z*;lQz@uf&}a4pV+-po%Y)wbgEJZ)KC8tecl_1u_iPRx}Pb799o@n*$b*;%H1bLR~9 z-@Ev(DW;3D>)t^D=e0pG(h10U0g&#nXwHrOSCWV)fr;_>f1Tdt#d{PUzG9q4OlmXX zHyuCn!+4msn*SX|^42c6c`X1ze~)J`zZ>D_&+j_qhiR_K4^@oiHwFpGj#rOD5Mw}l zmzQ6fjTb9-jmk|{L@yrSq4$@2o3C8*>D7b(!|5+~1Bl69CW^?T<&vs+OviW4{rvIlfmZyy%gb*O9De>jMSk7l zFAb3ykNJ(U`NjB48f^U;hnJTh-<9|0ciZpc{IUJK{P<3~pTAV(m(B>fy!^hMkl($? zkMF-ze#7u%Jo48D2l9*YHy+QD>CZU47>`#o9De?C4#fEzfp9Osci{H(H(B|?+gx6L z2SEADou+uBY_wRpT-*7}%|}8{pGPCiEBA*9`kaIO$d`9{Ma-3^T3VWl>8U7q}jp$v! zL%f|MJt`i?cjx{5)g6G1Kti@J9w*26TMV~9zZ&cnOhVnf%L_XQhv#P44lL5Yin!k8 zh4Fus{N;Xn5dY_SvMqN4B75z@|Fyzj>^fl+{+~2P#lvb4$)8_GB;f2uJk|qMkLA~{ z{IZnCCggW(fd~N0;*T;Vdhya8!E+tZ-sQ!+3VQ`~dsiLe`7bYQ85|H-s~5(2XLtnA zi}x2q^4tvWM!YwD@jSia|I+yDn}l(OnX|s9;^)ba|AXVtZwCg7Q_|xZdSSm!$gczW z%~yU?efj+X`hqIQu6v)y|HHyaGM^UwST3`lIeUJl|H|?a)@|=|b8<|`ocTG~bB$|F z%4G#5i|h&O$Ou=!nbM~Y<-a%HAvVS4vL2W14)pXgnE;f=jpYHsO; zJ%8uZ5y;!=?)j+7mJuqy{y+%jv#c`_?(t^$Y878=ZanC8clS80yLu7cvmbdRWpy8X zda}(Um}z;1M)d?xW-8>8p1JGLG+=7hu0vCRlkv;MZ#;e@@CzdDm~_Yw@zX&kqu!=W z$P#8Kj0^HN|(?}KzZtvuorP3%i1cuYWYc^dnH$U}ksE-U-hiGN z$vOHK(?1Y+{$P6gu0sqOq}l9F~;}zxOL_o3x`&Y){I> z@#V7@vdBVtY$M9kOS=eZyN6jl^xBs^F#I~@dF#=m@0j?RyL;Q5g{EC#M$WhZ?fmPb zM^gp^u_udv+w4^mizyr|GD7F)8hd6aQ0fgX@s1Q2XEUZz@}xv zAH1QQ5c*iCF@SUO(a%h}y}NqZr|1qMz9%Qr=YjTQSpq#kK1R3pq76LVW4;APkDgap zZrkWN@&ox!1wI(EXNK_HkkxSWT$e}S<}V9_59h+^_#J>SUd8WL_;DPrgF7FciRY_K z#_urvGJ&o5-G=!5KTXctR)glX_rBC^95=r8#?nI%J#c65dDrhcdQE$&TGEXn*$r1h2L9&S9+%bUDS07 za58?G_>ISJ41OcX zH+0vbsnBuq!8la|#38@_II9MTGX`-^lx{K~e|vgmG0sq59G1B^aI@({OhcOE=HA1Z!9y=)?Cc$yo^&XX-gU6&!k_jw zUbwUO)r_CU@}zBJUo~=uOraLzo}PHSk;e*OJvcU*b{b}FGRh8o>y5Zg-Vpdb_%P{H z&YQUl|L)jVo`1!-G~bEGnV)In_~rQ);*9adfh{-r_~rR~#EJOgL=?v_&zBHqCS>yj zc-;_q9yaf)p3{77xE%G0`0BhL@jdxMb_X5j>fWc&XS$*5Q}m;5-*@r@+YT2_|0BjU z#M#X`5!&Jf=xs*N4J6NY+j4=M&C?|BteE9`x);ax3~zI&A^kJ^iLo zPxeoH-#|ORpS~xwI%6lAv%F_p_RiiC*yi6)K>H)lWbiO89r7mxQ29ZnA%!W%yaUxn_zGy!u(^XIVRYzku?FjqmO`3b_PYpZLRY zxKo{*d+81x7k8&4t>>SFdeO}`ARe9R^rXWtkh<+q%n$jEfM16E#z+?Ihb9fehbav5 zF>>;U4Of^aLobYdH#FFmldp6zk0#Ib$*3RZtzQ3TIka&{GXp(GF;^vxIqM&ePOx<` z?ukD4q_}%1^77)J=yNl_1!@at%{KgNb-Z5>$M~Ctu5jj6YLwuZ+sN-73jF#Vfo+GEO#kB=$osn8=xeRr z2ZwCKc#OOPYixTC+I{CAvcQ+SfV%OO-qn~BPI0a>{pCiiIk<+|4dgoJIw03FR{=3z z_3i+2U9%0y^$f@G)CItD)N2jq;TVHWd!-}a%-b=STy}5`=knLuxqOFJ3+M42qqiMi z{J-F{o4V1L*Z&QVle;lT_;>icvM--|e=vHRQ?ns+b4`0@X?00SW=%(CZS5@Qr1lgi zudKARAg?O(r1mpT>dY*xsw$tEJtJ#KN;SUCH@yZ=9Xrm*?DLhYAt_FITg#TM(`!0A zHng-gTx1?_pOLw?roEvS*&rN$$S(7w)-y6|>gw=ly&e83{)gZ3Clz?)%{Y9Np2>&S z^>ryue?KR$rL(cF`IL^#hB~l>FVlNDr#PL>{48W*f+ohTI z!J$9C&)ZpK%4RNjH6as^#uYzPA5~1@XA^yX?cx?6rH7E*Vrp{*TE+Rtlyo_s>e z=l!Nls#;ny@yXn+nX!+e_GuUUVupR3L?P&*XC~esXy0HmC@WjqCxzFNn;Q5TcDxV4 zj{vHFm<=Ep2<`*%tipg(#VI(yK<7pIU`CaiToR-HG(BP4*Xo_lGHnu zZ>$Zyz<|@QOa?uKUl8etJgXH=%|ai+kKV+mP3_7PGv>*0lmT0nNuDrCvidQ=co*B8 z*-AHB=WB>fdAaxx={wmtJV?k8bWnWYgc2;o&-l|(W&J5m`_QADz@{@%=wJgP>0XHI zX(Q@#0wrgnB-VoLbX%780w{)nIjG-6^d!6iJT>Bnj1x21jq3Ka~XFS=38GvzV$^4b9sD|u+L+7 z(u%`lzhFa56x_U64BCPpRBgzebZo5lJmDfdA~lHisUw8zd{poz7_NUrh~D3I%s1JnAaGSfl)jgtDn%A z7u5`XgJ5IzQ{o&2L91>=z3k=5-50p~^8z_k95dxrpBK2}^8&Z^3uGbb_@V6ywod&F zFk}7yE5-R@22$)VC|_WILHPpv3(6PRUr@flxS#?Vfs@jPhupOE(Z{7_1gi1eHkcGB z8t$eI9(=~&Ghq$fDL9~eJl5?=li@gL@ZiDtx(uV32q40~_#l&qIz?D*Mv%f8G(4b; z5Rfti>5GOV*TM5a4jzSgZkjCw#|?-;$dCYX#}O10;5QHSP!>FR@Hud%pKLPEh~*0g zhsE*@G2h`cP$mmGWo*%K9z!z%AHOpm%yeXqj~HdL30W3K`?5i_68cgOcj3NB6<8DNwXN2z?r$;6(xGhsOBvk)+GB+@d* zq&X&&$)f{a3!J1Hg}fS_tQv(_qf=&}4TpsnjJaju*m%XyMNU&fPH=R*>Zj&7!7*|2 zG?2c~sVSDRPzE~DwBrNW!C z*K`FCxM$%Q{5K!Gk&s#DFvblF$Iv~;U!k+clGnNMRr`dXBHkAy)ZZq&8Jt;7JCjn%ZjKv~Vn|;Y8-yhqJho z#G$gDQT;wiT5j)8pY_E(=+494br<2D)v6)e`LZrcMQ5A48g8@ z67EUv>9~hno~apj*W;e-UXFXjy&d;K?qj&8xUbvyR5uk9wju5$+|%3w+=sgB zaZh)*!$Sg8OuLBknU?p42wey$|;+_hsC(@tIxp2A5wD zn(fZTJ;&wgW^>#I+~>O6ai8aY1^4;xeYl_Q{u1{y+z9sB&veJ*ewI5M_p{wn+|O}& z($~4}<+v|!zlwXVyASt;?kl+Gx$okh@ACAm0(UCzi`*r+zn$!asC`N90=EscAaQmuj;HIf3;Pz9W!wspQ;PzMh zq5=a{F5H2t2<{;DJGf!B0&coG1MWWRdbs;qe)i$fcm%-f`G?vCmaRUA>rvmr^{QXt z22=pyX(|LaOJ%~HrbfbDYpZO6M;%7+s+ojbhs(125zca47ZP32Dh); z2sce#2DhKO8*WIw4!6Jh9_|1&U;qU%4(=dT2{){k!cA8j;qIfZguAc05AJ^Ib+{R7 z58O=UAIMJM5AOad7jBlC26u?6ggaCx;;sHUDhqC|8V`4zngw^fs)aj2b-|se zPKP^5T?2Qr+6H%u;=MtKsvqGVrut!Oo2o{`JzSN;Jwmm^JyM+tcbd8yF2*+8>1sRN zeD!a*1!^#6v_i%EeP*ZF)-5w#5NLZegj@SL019`8|?foG{Z;M(d1xE}Q>T%~v~j#mY->h>w# ziQ`w};W{cGZa^IiH%Ya@4JzJvldR5yo1!j;o2q!%O_q8D?hy4B+@b0_xWm+dO!o6w zxFghTxCf}ka1T_xn`WfC6z)OluW%1myWt+9Qc=lKYCPQ0rq)?QITC)~S1kn(BLS|h zu7c}PFThpm8@OJTu|I2lC|tj)hU=(Ja0BXAxJl|6xIy(1++@`!i?yBrH&s=`?W2~$ z?W<0Mo2KrD+fTg>H>9i~90|NNWq>*c?m)E>?jUtN+^~8EZo2vq?mp^QxUlPbS&%ZE z74|5Vjhb6(7Tix9wFvO3qgDexbJU*!pF8SNz!#2s3-Av|eFylbqXrJMtS=ok5%86x z<^jHT6t5cDY2{^ONlzP($lxly6Wdw@HTPEPz>Ik?VRRLG22wbmf zgX>c#!NsfN;X3LbxB>MZ+$8lA+@J~}t7J6=Zi<=-H&rcx+eiHoZeMjJ+%(Jk7{KRs z+A%$PpM*bP2b?t^l74>x!hLDMXTiJ=3|~Jh_!a!m(T}%li*LmB!(yvnrK0d-gdPPQXeT1}G!D-8&5su>119kbvW`HqK!PO~b0v>bD8pG=GO3S_ThW z;P14p&{_~Uqqh8AShJN>V-MiXBaZh5#2fI3!|A0l9k51w`y2!f z`hs46I=q&1E20fr4#rouJ;VuJhqTR@x@^4uGyK#jTnEcZ4)a0>8YTM(XPzD2 zZweZb3F=5^fgR?LU|FC&%~@!NN4iv=Q*VdyQyddE-C1gfUpo+wk7Oa{45!HsPea(R z7^3z}r_Bz}abwPOI_+@zXh~P(tgypPZp>n5l^wo+A}*?DW6PYicKAeuX{y}WV295J z6~+W)ALVSa!~M`s zbvX~(;f0{6CH6AsQ9In`Qp=qu?C@%rTH$Q7!>54Kd7j`rZ-*~%!&W&j+38oh)QOJQ z-haEDexJ)&1IA!5wz-V8U}S>vmdiK^j0`ZobQ$Zw*bj^!T*i7Z_5~yTFsbVXF!ljs zlFQhLeMlILBA0P8VhjRfp367|jDcV*aT%My7y!oFv6AVjVDty$Y?rYaj1U+dZjwKO z(GQIEF5@&X(!e;^WtRp#>Xz> z95C?ULb`9N)bw01lEBDt8Rvl!03+9BoDYTrMzPDd91K4g4-7%dZ|9yd8&Z^j#T`UP%`I}l?(Fm3=N2?N{y3mE%?vDIbV1I9jY z*x|o{K|5yO@4RJ)Uk62-WIyb@V~0NkMQde0>bz@*zXwGdV?XA+XNM0)uA2I*^S&Ma z#SMGh*6A(%ET;Id$r=r<`4Oc(fb#wDX}I&T*-2&Tczg9)-QyAPW>y%=d+EMT*n0>b8&ZS)of|ob)hX;PZxV1flK7vA#g)9uU0o z)QJkgAexg<-X2dN^Z*F% zIP7mcDWTUu@FrRN2TxkqLRNZS_|fx;Cp;L`4hH?|`N|VM2-Fv(l$x!=qd@&g%CAb2 z!_!>KQDw>D8KAUn#GWHLJjm;??q?C>*g&@i9XFZ`lQ4Tq}giBu;W z;j{XO-$U4SOotP|0pZ;)b)YY8fLSP*3fl2RTHF#M%}Ra*$)`X|JrKrFpc6=b1+4GM z8Z*%OJN*5=05Q^&IWRN_o~c+?cm@x&LX9AbNMsH4hF%51$=EY=U?9XkrpkJT4@}e2 z*2Dn=)3tziGtJ0>St0&dfIa6qc;Ij=nH@hL9M7X3hqv~oRl@1_7&zIU2?Ikd@Z8Ik z6H)Yf5MPs+j-pQm;m5G@6rkuWAPyukb6`s78kd-bdfWtp-{g791`g1JLD&7Lfuk(v zL1eWbhiL|R8C*CSX9s+i^ETWx8Z(Dg*UHv`%sfz%e}SJqZmP_(h+7b>TEicljYELsD`Nvz|^{oFRt!H;(#Z6VCYtOSVd0` zBtczfR8KA*+3MGN5Wgxd_JxA*uxIUAP@1$D5eN;45ow|QVnljq{}_=K;(c$WG*7c( zxY(b1T$cE*4{=67p_X0hyE&8%LYw(A-|ZpZ2`9uIp&2pa&d{tFaaU+=jJP`#i4lJZ zEshcQSg91dZv5Ifjh$xoYdIL&Xde=1#BmxOGvZ_7jriDjBc2m)#K*yi?}wZ&XH&+* zi0=>LNfHxa#D{_4n6@YSGD6uPwBerwi(UXiH*$(^c&N-J4)u)))q>EI>S4G%u-|Q1 zH-BQ^;*ZToxB0EmM#Ryk_ICfs(CHv_zIXUXh5igeTjV?a*&*IOr-{4#<3mq^(02E3 z|K!kHAVzUH{ulqW&>j#vgM0i1A>J^@Lvs6Ge^JPLh-KxIxZhtA8VEvH>;eCqp#xmv zLH}DJ-a4m49`e5(n&=V_``-y2>JpFm-whSH#AE*VLbWdOSO5E=#V+x6WOR#xaom-q=Mef_a%(jh;q zw5VOSe^Ke7{SZP!YX4hhgbs2EkGCY03u5ek2=RJXg|f$3R!0U1pZC$w86fobY=HNx z&_y8hjxX%}HsrwuOcUweA3{Sw91dG#@8kU?JQ)O6J~n=dVuxEm>8;riuh$Nr32HUN zhI#{Wo48@#6g&I`!f4Fw;odYm%v+$wXMq~w9bkt)19cViV_c zwPeP24b-Q4a<-aba9(VQSvs z#Xg`2)T5MXlNT%hYEW8=&E6e$xDk{#daYip(ob}$HZRuYr@7Se-cQg*mumNZh8}gP z4(}Is_&HE|r_t&Cryc&lrMkRd+2H_mS+B2_d-q^b!b`Wc-rH8ceV}L4?0r;d0`zhy zRWTD<9<_=?ls9G-heG9}=LEx4N@xMnXni{v`riyfuk8;}17g#{C=7-!gy`mu#$Y%V zgtoC`RaWTFAgWntp&A~#AB5fl%*K)VUqKwhka9ID^Z^L11xKmzAzmq|SF)9Aa_A=z zT6WcHYAA@dXtP?QjtKQ}i8**bsdFH*N-9F+K+^s}E~i+Zq%12qMKVYl;tfu7{X_As z-*q4yZ|V{x)UxuJrP9k_dmi!hTZ8Pg?fELiCAgmQkA~cMJ*5zV&=DYX;GD49Ukri4JBZh}sU19;Gvn)nn9Yt|Eyg_`>576Z6ZF_?XU5yxe*q)4P z-RlyksI}p!%{gDeWJJ%I{-m(Yc@Yt{p}9bfx5ICO;>Ftbg$kRVJs6m}<1SKD?Qkk6 zZ9pzo(`>y2*3_R>0k*3M)BSy^Dzd{)wwys-u1f6i37`(d(W$*fRY1K#X~T1csg!yT5E>~y41aDgB{Lv zsr%F>JA9x^-LFo=`I}2^RcG1ZLYI0#oo9!ScBu!|g)r7G^;dO?9bV>AkE<9b#zZe^y1faDpcVQOgkI;a33@}^1!>}>U?9XxQ8lqXh&`$svN4zz`VT_JV*>GP z3JwU3L$;bYEtnq4cZoBC8KF{94A0rYtk8UyI5#*vv;+hj>^VO;GV^$sxG;#;kIHn9 zt~?ik9y}`3J-PB+3_5dE=vu^Q(><32M~CiliA#fHLQjIwHNHHU9eNwYDpvBw;CRcK z0$fMR1I8J>-oQE{g05Q1Q?pX{mgxpM*;3p-iR4y?P&gsna9Ol^s zwaf5)>W`)T49n1d;C_!_&p-U$P&PF>9mLmuY~5VqU;dO3FLTwx_|=~lauwL)cLs!x zb)yBGbj$e#StSQBDE0;0bEVJhZ8%0Vc3W^*HRG@x%OUOLAb!eJIIE%k!Th9lz~tbi z!F!Mg6+U>m6@1wBU*Qc>4zyyys{%ppd;fu?!D~{2pCHb^aey1VE-m;-jv0W#8wLc^ zk>6&-3*M9-91j1P^xu*ZT%9ZV-uAMgKr}rU5CGn3N8X) z`|r&TzJ;`>GtT|!xIL&q+V^aQ2Zvp$h!z~5^y@g#!B1kX_{<7EjjqkFK_Tr_%;8BK(NU5 z|CAD}as9uf1tajk$@u>n5LycVH}qR}dgyo%{V52Koe^3MVi*apofX;yVhRbrJv?+S zh%yoZdt~S;5D^kVdsOIt5UnIq>}<>7*G8tZd4z5`KDa4qa7H6qa7GeuajgzM7?Z{$ z_~pObkB@nS@4J$DA`t7xr&415xGgRC4EllwH~8#;Sie7?9^}op{PrjKVn$G*U%saQ z<>A32;UCHNzB($_*RN#6?>-x4ZtgrUsvfU+cg-(_(%7UO_Mw z?a=Xe6b1Xie+%>9SrXhIekyZtcLlyPg5^(1g|ihk3l=Bc2}lXH2YCgtPTXk)zlWbQ zL~xlmI1l0dS?Lu}g(I1G7Mv<3E=igV2n2s0`~?Yg3C)&n{c%j(>a`qxo0itaRBPcJ z$y7D{vH@wqzIMn953kk_;<=G8S8AIsbt-ji%2DAiG#5IL82;G7QcQC@WZ*#0!oC!MfnFK;5tg z)35?o15f)n#qgw+G1YuHXEW8je(L}!!F}ye13a4<6;DisT0mS*VlW!E0tCN_3})Go z=b7-CYEZ-(bS&p;xP!%id-n*jwxqm-kbfbw;Gsz$0RqAG!RyRq#6ehhM{Chl$ zQbU)(a~U|Ex>U?i+?DAS!ZB9zJ>dR`P|xW}&I9ldrEG@LNo6(Ng~aO!+W$@L+JXlp ze+vI#d`0Lvr{8d|=gfYgG!WdDcyQz%3WLx`!+hi1FbdS^e-NB>I7z$k%}rKvTJU5b z%Sgr-^JlvLkT-ad>+c^3UgP=)qy+DPpI?+D4@?U_1^?;v4;m1B5q=({C5O|4Z^O@$ zlG8J+WS09N7~Vy;!*A3_>;YjNe$;F?%HRl`fs!ObDL3ZXi_#JOhql6=9JN^K#zF>j8o{j4xV%18H-k43beAhI6Iin zf+jPQ%cxqIe!#;|m94(yUBQ|m=W_u3@l6^C=bzp&N$_9JARWTr-sq5@ykq!dA{~-b z3JEPllw7;Q(}`!M>Op^^=}J!*Xomlg5Iz!h%(bg@{N)I5(sYGqx#pgol51C@_SQJ& zwE_Yf6lAIy%@XhwQ_ED^6&f%cbAP^~W+e< zHwbN#LrA*x^O$@PR%;K&qU-wY08KIam}^flGD(pR(vt6iu=w?+;e;M2?}j?`|$Y#u4Y)l z_f64h^~}ZdIBUY;VEfOAtAw8He}^Db&nV2>~*=yVj5HQ`vYx5WxJEjN{KW!O88 zE-G4i6M>y;?r+j!w6>^E+f?QwXgn)mk-)Z`f7zZR@k=nU%%Hs<9&HLA zg@=P;nb035&;hY&ZuqD;dLh=UB{5nL=W5V7?Fd*97q9{J^$eh8;*TtinQ+S`_oY~L zW52XLW4#cUax#g>$Fm_W!*$K4j_f%*-Edu_DcpeJ-mG(|^sIBU=X0Y!nlt5ka_$Xe@Cewb&s222eQeh>Nc%RAR-a@Tm{EC}{t+E`cn;{> zNZ;vU-iOZzt$Xke9slq(pmh)4<=K>lN%juLou+<3-43~j{(O~!LdLaVeT`vfjav)P zWO#BefM*^&BGGX-g5JS^$KZ+U!f~8T>TLwPih#Rgjn)>I1?4aXOOdRs36HX+4;g82 zxLFfkA?JBxi}bkEV`$2|WVaYQmNC#_%spUvhB$0Zh8}l1=7iK~i1}n}s9F<-k#k#& zV}?2wd**kH_OWLpf-_rbxnAtb&CrLx37XH)IHfpn$N9dN)%i;65#`i<{-w4RXf7uX zYS*&0qFoCT*h7uVY>+&-95B-v^WYGQr=L%tzv_{SM=$9RKIdtcT%|`Hr%EoLB(FTG z0icTcEWCyTZ`B5MNs`p`QY+P1uzt{07j6 zGrucM{-=SSOZqCsy2Ij`5ps>$aT^E??0x!+}Yp2GPpo6o`J*@p95ww>MSc^2olY`7+#$1yhhQb&6c$JlJL zCSJlZHruO-S8$9SJ?-9(V{EomXYe|XvDta-InNt7#$E`5v$N-|;K&fCDxJYQ!BL?m zgmA2S-p5Jwau7OXS8#l2lS_OQoE&l=^!0oaoEqXx%W2m0S#Vm2Go4QJU9dnOW&g@; zq@7$8cLePB5#bEHW3JbVN{{hT27qqnAyp#g!->jZ0b@>a*}R3aeyp zRb^GAtUQvJUtK(>FjARUHnUK;)8|(gRz(Vr5^_dyWmUEKtE%%VtBcEK3RzfI5F_%- zODjqWs|yRD$S*0cD(u0XU07HV$tyvtOlr9u1-%^UT-nxO)l?Q&R7HvlN(#kWRajUSsVd2< zD(bf5VuxvXkITdAm+l~jTRdZaB)_n-x~h9UdPyTy`|oKmT4t12mb!&7cN&c18O8Z|)jdQn&CIJn zEuoEhWd(Tm#q7dJQDI&|Vd8iwFM}y7Wh2le+K=+tc?q2z8(0ZZt7uWjs;0OS=B}c$ zcn%sFnO)dJ0FjD93{MJ9tEX7=ZgvCajJXvQ&d94NNz}6ZnZ?~}2Sx;@uC%zUr@Aw& zsv5IZq#&<4uV*?F)@=%lb!D7oboH{Q`OuS5!QR7NGbSq5O9t-z`G1rLM4gw=?Z#pi zV?ek%*uA|vyr8nYVlUzOMTO}7y!`yas;Wq3@ywz`$s=1GR#aV@pdeI5GxicpLKX7j zkSi{mQQo~aGttL$I6rpld0oef(uBBivfGpjC5-mEr=atTic1Pi)gyC?^CA^_ zl|966;xJ!X*Tn__N08g`dDYc<`9jm9cui+hD9jz@LR%zAD$c&QmxsjSO zj&>|1q8zhqiIS*L;mmSv4`Oks;H*tF7RAzyF$3A^MN)MM)?C$*>4lg=3N4|^XIlm0 z&98)Z;<7(8qs-T43WM8?iQuZrIT9z1N##i(QA}QSO;sEh77oS=Qi+wNl@6vbj-~T2 zC@+iFj%CW&s4mW*UD&N4ZKmT=CpI*n8j6LWZd5cLnDG^!OXJ(UY9>ZxPUVdG@u|8O zH#bs7DJQC zDPGR3Qk+yk_Q=S@=q43J>nQ|g)lF1j^dgnsyVb33cl{x^dzN!!S;(DAJIeQN*C`U(i4@Bq6(iGXE+0|yUkxI=dsi`W$dPr}l6T%P$eC)L< z^5*MBxXe?MG(WG5Lv$V`nXoC0uUt;i(eb1Vy$ELH=p+*#UR>2X->pOU>bus5uSp==`}dZfKPX|N#X7tz=e!;s1dF9mSAmJmXF0Og7uU~Pkwm~ z7BH+8Uc(w`YFO6L)L~HptIKEOY=LWcoDIZrpw)>i)4ZyLh&ZgOj!OsO@TOqygJRj& zRLrczb|;Qgj#XQ6e3XL9ycyl{DZ=0@QE<7sI8RQ+j;KdIi`cH{rT7cXYAYJ;O-x3~p|)X@uTjDbu3@ zjDU(^3zS!lDLWyxDK&zAMjlvs^d4M-JycCzHxZguYh~Wd(!9h(`B*UVfS?R}!FYL@ z2Gvv-q0f#sJKTig^2^I-7bi+k=fpE0_F{F97O)(KR?n~KkrErA9z1jWmr!tJ;f%sc zEb3xxXhR%@X`Jd3$Em^*MuO()_CZBp3Gz%UtK;*C3ob2$5DMaQiwmpB>#dE}npvmIME@u6BEy{aSjMAC~mWaO&0_a^tE7&>~-_L-h4D6WE0 zz{0khKt%*5%HH(R?d-iNWHh{7j!+T=;)eIC1clXkJqAGGyb2hh#Fl`|Eq@|=MrC&hpqhmg?yprOw**$oBkw$4Awqxa$m^TV~w8c!c)ME@T z9!T|2yjYCAj%N%jh^fbrtt_mroF9Ri?l$7I0+`iWVgsPO(8S(s0~TJz`563=C6o#W zXjO&zn16Z>JRJjre6OaCGh76!jM*(gY3Afr_87<5RVGH8I~QBx-sOcconMqN-Br{i zPK!9h!gmS@(X>?1qDWq4w>d*gKd}n)^infYT#*pKuODKKigr3?40L~72!;pe+&B(b z2njWUCg>HXneb&PhDD(4pJ0!wdWoP)edsNiYlfb=>Lo!>wwR%w0b*Bs1{BZ8 z>ozf(RZL7ITy}9`6yNl!*~JwV-RDG?6{+HZiIE(aQ-}rqG~Wqn;c@dXE27exc{P=Dh==^R2dn67M7AlJdlP<=W zjKFZ0bJ4Q60MThB4i8ZH1&pl7zg3~m^B}Cf zl%WhY|?wwE817R4v@qw6Jo~{lB4&(M2;IQi7{svV>=3&&yPgUuJ;}VlM5Fl zi4lxCcI#EQKZ?prxRHzG_3SFW!ogWo74{O-^Dy}Enwt8?mL-wS#^#3Bu1=Z~qXcr~ zi+!W)D|!j3EX|W|M0l*_rkGid!XY{N3M@VdBj0@gs?RGDi>fIza~Z$f#`y=fqw@7Z zd=?l{oLuBfp!g7&puJT!Z+aQNWzECU1rzjaWO3OX=xOxOsb>UyIar)OA73Pt<3xm; zmLAe5#i9mFN6h%;krFJ_dMPDl9(W*y-9s;psKEg&w;NCoXj_5VA@wMXhwd}-ic4y6 z?%yNO?J;Jc&qUp$L!Q{wHMMp$=*KU*^zx%B`cQ-MML2w@Jnok_!jAizOE~VtSA}yW zED$-K%n28cZ_y8NPja|R5VO$PTVM^&AN2HX#DXI^nbmQ6s%?YOcphxUe>;xv>hM66)zR1zSzO!P*t9bCY*Pnbht+9y z)Ji}Ee#B}cvkM7xCW0dj3FDiuEIcViV3cvWCJGrbpU&olhW6H2QMwLHF&WV!*osu< z!F&}T4UNaCOC+M-Hl=fEY>Cx~K0X^34b`oTd)wCdi56e_)TJL@!W+Y^mWCCbmQF$k zr;9C1I+r3qXA^0xUxDHmx7RM|uv!-{#tX76#IRb(u@*OxO)-*e##_5OtlAFq7?{=6 zis#?7Ly6MdNk(QdZndw#Ut4R3Wn}6~uYCpcCtp9Cg|}6;;Y+>-YbnKL*7Ef$Amhf) z#@ePx^kFvmI+jN8g0hB*6wT+#4WUiyrYQq zN-Qc5-kuegB?SrDE{{Okro6>?^BLO}6HK>9=Cl}16bcGH=CHW6EwZ@Y!k-(yxZXTx zh7fcKrV|swc)QEU3_2R4RY{$FMx>`CTILm-aR-q2hN zHE8bVhm$2MnMUoqV4i>_&%$9%|Q>)Vkf&*xU%2 znFsc$P*6f>PiI3rlpQUoZGv*PL!7*bvkK@;B{53Nz45<78RKG03<0bvCwi>9;1blRFyG+g9sx)Ce;N6iEv-qFYkm zu($z(EsoRHT-N|yY=$xE=s=QY0N&D=&}LajCUz>dHoiY)q_6|EBq0w<*tOS2fuc|J zMs+A*l?qj%Ug`mb*`lcyS;zubY7VU?leU8z1Dh>s6X`IvzYARfW1>yV;@0+NL!Hpr zX0^fE)puCWdRQ4-ZYDX{a~%+G*In&&n?QqSVi|+NfiFh5 zoBic06}7U~cQrS!L^IkNVAv27ZQ}FJQM+4@j;CqjY|_@++T<1p(v%?6PbVxICZOXY z^$l$>C(K6#7-@qpcP`bYnAOpP8FE@-EzMz^7GfvN8YV$37qkbdyV{nJu5D^Vgxp9+ z*CHKGc6$S#D2LukDQ=b|%_}plWt`BAAhaCyyCwCyL{E8q(NZk(56Z>Xc1==PB121=h@s) z-&ot;h$76qj_J&u*V#DT3~giLi3mK8?EV&SO2_?64aEl4nZ1!%fAlC=! z>UkRLm}RY&yY%Ux0n{O;$wm`8I+`$zuCUxk;M-x1FdfxFL@;QkUs+X)5wV)VVy&yQ zzI8cF7~Y5q<5CBC;p=E?#f0oB+KIF^8)R&9&5KF3kMn`yVa>N(FPsc%mQ@%A);y+= zBW0aNcvjnS4J)<70!ZlUXpesLsrKmtv@e!p1s}wb92=IkMRYK7Eu4b~6#0!KTf(CC z^Ex@ZWYEU1l6EEibz-6Fm9GCWeSpS6&)Tdiovxz<6ZLZgOp3nEq=%IemJovT?* zFvVC{K#lc4ifK0Nt$DP?Om0y!+DkF(B#E%|gW}QLL?c_A3GmH|-uuQ)D4I6&plgsi ztmA6Uh5-oXB3KvrwC2G~TgNptw82_0!(tLj&OfJtZ zW1s@~A_*Iu<)+`TClnTiqjQrv(_Mb(yt=flHzv2Osf#m;o=CL;*ECDQXhD@Y7EEY8 zRxVAAEg1G@$*DV_TRgq9YR3W>Gxw4um={fIP9>%Zmf14vv ziXMJ+Y^Pc2B{qXgQIVNhT4Me;sus=IEL(*e9m%qq?bhjf6@(6rE#{-6HNM+jB^O&@ z&N@vgy006}qKEr%Y#Yq*kp8Y)YJN@#E6ME<1)zsSk97)^Y#C0q5>_vI@#*$66GD85 z*V5ER8Jwp46#Z6dj$nLGPorYU0lvRt~h0%!$0*1M+Q}2xRVhi2m9`P({Y_+Br zmq!op^-3UCsw;*VTUQTb5DO>0bXvr392c9=Wfe?&s!!5*h(M8Zo7n`7!T|+-32F8eooGfg z4l9Oc4c6k?WvyK_o!m3>FjV&9 zS_WuZZ4*0YWrSx)7;!Lz_#vyVuU1$bhv7_+(m+$q!ID0+H+%oawq+B!^wD!^Z98`l z5om*O+@7yn#7T#%CbJ2lfxR57(3ThxliNlnaITWmMsvLT*El!k4)=}xEttgIe(lo}^p ztgkQ{go172;IQh<1aIuF3=gZZp%b>W4U2z_xkeVoGeLbq0jq|AC?_L&O5m0SCsvS$ zUPEIB&}T8`&<&fWsCCj728lcM!H`>F9%h*V+}PP%+a`*wv&6z&{{$qmXff@KRg0-b z)~dCQ<}}oz$DHBAM;+AV!tWN#7(DmopkX)=XIjD}>Um60Um*0jW^^t@tfi5JXE9ix$`)a=Z0MZ6|wJ^D!A=FF?CVGiny- zGWJE7kz5_oH3-p4C&XIT$Q3q}l%?$@tXocQ_If&m;qN6OreS=21Sk6K639068`PZJ zDsvu86RVfrZ5C!O9=5bLkB5=Q5lVfIpw&jL#rF?fj~k_<714$TOHXaTTHA3Zg!uuM zwLwoW`b#QliWZI-VP?hOxwkh!Eiq=;$K4p1PI{4omd-M35zQ$b+${3{2HQjJ19-~>FAw5d z?7g_9$zIhbB^C5={JS4sQBlxm_!;&eJ)703-c7z!{3kmb0~?YG`pg^YMgsB*i@n5q z6gR-=*UY=odCf&ZpLFJViaOc5(YL{GWx0VsUVo7gUeE^-;_I~q@xWvrr>affQ+y}; zH#!>v1%1}qy~o?!Gv1TQyqoHH)W){$pZlZ|C=>kK|Dzi*{)hKzG%sqX?`-P8bdR~Z zp?z#)OI=e}eFG5Zmi)G1FO_S>Mkvxzf85v>Oc%=<#*Q14J7&U|iDU8IT6=42=h&`} zSYEhUV>D*xt`(!1YQdsL*nAlkBkSI8_tskqMtYvl#zW|;+|gA1_g#0dfNbx><8 z?BK&yMXZrq2~-IhP`}88P#fUGeLa}hkl1i7FJ92CFTGKNZM?-v4GP@s^ZRG{Qv51u zoiDkuXbASU$$nCudiS2 zLXm;Zc=z?1z=ysdtL0bAXZbw-N?(7K8tC*5T<=RN^Mz*ml1hD!I@w<5^Qufldi=ya ze!LL?&f6#I%3q6@Q~6LAOT7h#mx0Jy4PNK-p%JLa11Ii5zUmT%>TU3iK-7T$AzxC7 zuWykr1JqD|iBGNdr3aS#k{{AyLhL>$>bX@Y_p3Wj1c5Z*soB2pNj^vf9;Zy_h>#bob-scAb?W`qvwZ2Or3b=B z>BXp(Ume7zfC2gXH~Y7$8&|JmZXeoPea^SOfki&2gxz&93K{8FU!V}jKWi3RyWY3| zH+b>T1ht*QeR%aOuY(|UooB0W2>K)7SHZx|DD`j15Y5`e>i@864>jSB5J>8SzJbN) z8`h<4{mFO*_bTS9KDN>Riy*i`e)Xnj>joC*%k&qa>t^{5hQLT4j9Sd1@HY9?rK|V& zQvK>957J$XvQUQ~QOi_O8EVLSUC(W?dZKb$J%LXD9`zJbpw!1bsNF-z38`;a5O|=( z*Qdz0AIchnay)B&VRVvG&!b|gfqb7T^(D{tsbZfq)3@(z#F^y_=?eL0p@);d^EnSv zYF{GvOusq@5+8#ofm#0be)W&l>u>{^ZO4Ynlgjov!N4tkb^oe8>S?tVxX!l^e6xH5 zpwy#_eaRbrqi6d3rF4(*qk?|_cj#rm`pYV)Y?@!ah`9a@53tnRkQn;^3ZyKYn+)gm z80R{}c`L@b%5dHT$Ftd&snXVIsXc!pJJzG_wb9F`AP(AdsuzQ;*q6G-*HY$D$uk)o9gII7502`}z;-sN6SuA^+`v z*otPUa}Y2~{SyJ`jB^Ky;W>^=*u|6`aKMU(*#QMOnwveTEfPlhX?S-z-h8j}a z*8BHh+;4=2ZdHH(!#Yn&x4yW|XZwtEsv7y43*eHj%nP_xig6}}K< zv%gB3<=dBnNmIdDW$d_XVCB-(+dfzZRFora{cK-owy!@7BFLcsRIq47)}wO6{b~gz z!*RLZm;L~1Lv2A`7%Cj_st?r!_3n@AKvOm#cML?x$Tt`@S`S-_VS=>Go0th432h$; zgvJh};=?-vCHKxqLJU@55E3gOY%sL&|CXDKS|fQXWS);cPxa6C9ga*{GZ*uOE);a> zBSAxRAkZZC0_&85#XegNK&91R)cN#-b)G~DyAv$bhK!BykFv|(@nDV4mzUL=bs6SM)lYVnZy2l zze3x;(-DehezOAA#gqfeQC(Yo!w@ye|DY$WTh*^}Y@a6>xD6(D#U6E?vknN8>{oXp z-QbgasVDi8Px2+5bkb3n6Om(5u`i_<)>RiF&@JN!q8UGij2}Uq z$B^-0zj_84$K{$@gp8q&-7>ygXZ$=8-7Oho&7SzV32PwtTqx)MQ#O05-XjzvbzvrWIl=Uv?OQIQuE#4TqO|N*!bgVg`N6K}7 zxO3I|5&6a9_t$rOGp5;(>}Q>i{OHF8i@^P?S3$o8|2{(h5%f3khlOqg9YlgbLZ5>2 zvOo_Nx&icb&~ALp-qw83xV=>8e=ulX+wP_hfIcaX{s{HG0JK}57eU_$+O1Cq${&Ed zC??kT8PJa-ysywFfqo?}eFXGw&;uoWHOl)5G!~9JJ>FkzDaeo4zcRn+phtnm7EaSy zpeKRm{*~eXLBR!}-SlT8oN32Pcq`}<__Kr_54sh8)|u%;pf8N0ze0XDgLd2d2IxmX zr3f^sodPS7F9|ly#7GC)(?Nc!qF4+U9;p^EP<*L;B;mCX(Lf z1_DV}B!u6XKo5g1xF5z3CglI0gzzI1==BM7A1bDNm>+M&@$-CF1UB-YU-U9mJz>6*kJvsKbi`h_mq4DB>JkiA}6PdBhsLDu9TC zy+?`2hv#bVSEzj zLY9yl;};MY;?i^?!q*a~8$Dn?_mR%Wm9|90=X}6+6cEARKt#H;h>+XO#QA1UT!>q= zUjnT#Icz8P!D}OkLy;eG801474*3#su=oiPlg}4Kn4hnRm^{8ELIHjt!kGR-Tb^5ym)$n2vT5_l12YVvIL;dQ0o;=!ma zKW=+RnX}i7YBPUk91FcgaK^#veS+Yzg6jn@BSLQP3UVBKAeX@yXT$=*-wU24c#Gh( zf*%XwbVR2cB6tK5a;q2IEO@)%>w@11rs4FG@ka~J5=8cvCl}+2IG%I7L9U1Sc4(Lq z%^yk}hu0$rji{Q>u4lSwf-?l6QkoA_tdaW2co^aue=pb}xKeP9;AX*d1uqi3TJRRZ zy9DnSd_?eB!B+*}6ntOsGr?~Je-!*x&_}&OeUk<8-aSo+1v3S?USqt21jh@Cre`B#QBG5xh(Ae!)is zpA_VJjPYL<{JY@0f_nTR{8OR76#P!`XF;3e5%Cl~Qt&y! zw*+?xek90!1k>#i{6X+Pf?nDsga-xF1P2Lb2o4q0_73sK2+g-rG5w)}(*$P-mIzh~ z&J+BdV7=h)1=|Fd39b@cC%8%Q48ijRwY^0>xK3kzt`)pl@J_*p1fLRoUhoycHw51k z{7~>S!LJ1WC8+H>%Ja~E0|SEGACcy}wTO7#y~ZrT0|ZA2<_b<0JVKD`N~WJBSRpt^ zkn2r`FA{7P>=OKgpq^(C?-Zd=7d%(+BEicAuNAyS@NU5e1fLT8o8W7LZwvB#hxPhc z@E?NT2=cs!;lB#{IFEtm8+VBP1jB-vg2Mz45*#b2=S!qJOz1qpnS!N)Rf2qT56g)N z@;rz1ae~JSE*Io^3d8k03_MlnGX>8V{IlQ{g4YS&B6yeJ{eq7OJ}LN|;LC!47u54T z%H1XOr-EM!ekb^|pw0Om@g2cb!Ty5#2<|U9Lhum59KlI~hYRKl77LaO)(9RWSSz?h zuvw7jTCCSf!8L*#1$hp~@UsOk5WH0IDnY)MhVgC_{EOfNf{zJ4E%<^U&;6M0O~LmC zcMECRfM!7JtD7fcZh38o7U791{kuwb^} zM8TSoFA2UaxKr>m!Jh^FLDTL` z!Qq032<8dS5}Ye|yx?lVO@ikNUM6^(;QfMl^OBbHcEO#3UkUz4FeTZ<+gEU;;6%X! z!Aik}f-Qop1UCy_D0r>l-GYA=d`a*l?c*MfK+ zPnX+YaJb+E!5M;c1(yo06x=NMXTci;?-hJf@KwPN1iuvgw_tK#Q;&TF4-}jrm@jyg zU_`J*aE0JT!E*$+2;L}ouiz7cFAKgW__^Q@fv0p-h`wNZ|oFX_=utu;>@OZ&B zg69feDtM#dy@F2&zAX5j;1_~F2?lW1sP$EFxL~f}G{G{#1%kg9TrJ4AMl+v_1+Npl zTktW#R|Ve^{Ewgy2N6s^RB)8w6v3H-HG*}5#|y3zyif2^!RG|u5d1*!pMpON2Kt-w z2MP`q94nY7SS7eXuu*WC;CjKc1TPi5QSdXttO2IHV+9urb_kv%xLNQ5!K(%D5PVqh zIl(sscMI+j{8caoXUCNDK7t1bjuV_FxLB}NaFyVxf`1acO7M2UhXkJ${JY?Xf?o^% zM=%8kPpr>C!J&d<1*ZxY3(gU&6KoS)Ex1|m0>P^V?+|=g@HxRZ1a}MW5&Ts!C2Z=K zAvj8Ks$hxW0>LK1Rf4ApULtt2;DdtC3%(=xh2SrODd|$aV2)soU_`J2#yoX6D$`zR`58%m4c@To-cTn;2naG2)-cr zw&16N-wXP1P)WV%FE~VStl%`kqXZWTb_i||JYVoC!8-&W5qv@LZNX0kzZdl3yB1v! z!6AZE1q%f$1tWq@f-4127CcvQi{LGSTLqsM+%EWm;6DX_77S#VdJPmDDVQxdRj^2~ zMzBe+Q*gE5X2A;tuNJ&R@L|E{1m6(cEx1Q8i0?8euK|KX1jh(Y6`UnFPjIndr{Frl zvji^_yjgIo;5Nb61wRzrBgjVvSf4(E8G;83P8OUYSS`3nuubqp!P5jU7Q9~Y9>FIB zUlH6T_^qICf6*tw$%1);WrD{DE*0z&Tqk&@;3a}L2;L+3xZq2II|RQHw6aV+QU&)F zJW%jR!6LyL!9{|tg69feB6x$~J%W!5z9jgr;AevN5L1tdf`P z;L(D0f^CAU1)mjsS@2E4-GcuT{I{U*0O=ROp@O-BQv~w_O9kf(E*3mR@EpO51g{X> zaG)vYJi%85-x2&&@Lz(dBTf8#!BW9Ff^~vzf|~@-7Q9XH?}9r8zZCpMaG!%rIYR_T z3r-O%6g*1sSiwfYF2R!p&lTJvcnk3m%eq(SzY=pS>nWkP3+@#BhlGDE^e=+W!KR)e zBGL~MdWg^?gw7UvywFDqoiB8m(3L_TD|D^UO@bXn)O&@{YlPk)^dE&jPw*Nd>UFE& zqr`ER^`y|x5Mh_L3;#{wzbpKI5>ehy!VkbtdH@mm4i!3AaJpcn;3B~j1y2z?OYkDW z>jWPcd{uCl;5UM5lqo+&aG>A_!3ly#2+kC&5S%aAD7aGaOu-8UuNS;e@I}GD3w|v4 zPr=}5Q?GQvk%E&2iv-JvkavUN3c)J{Zxeh-@Fl_b1iusPH^$^MRPYGFqXm}Gv>tI!V% z{i5Kzf?o*!Ea+sL@{@^>V_4|@gg%6b`W6V53LY!iEVx?mbiqpnuNAyU@Dah+1a}Mm zA{c@!Sl&p%BLu4jYl*05hu}uRbBXB7ONG9Hi2qxJzF+8vgnmZo7leLO=y!$wRPZYz z^8HTeUxfDM8h#(au;77$*@Dvqiv{NkE)r}dqCF=GUMP5z;9mu|3w}<7j(sPz4co(Z z`iRJ1Y}F2S#eC~pw{`CLsF5&xrzs86=g zQ-z);bcxUvLN5?{q0mi2w+X#U=(R$hCiGcCUn2Atp>G!YcA*~>`ca|(Cip%P_5Okg z-TRmDJrhj*{Y3CWLJtypsL%%poh$T2p{ENyL+DDO=Lo$>=*2>}3%yL}bwZyk^!b9< z5K+&2gnnG`HNjs60~1ZX2MP`q94k0guvl=8V4Yx_;A+9mf)@y0EqI6E!-CHVz9G0< zaF3vc59c|rU_dZM5XT!j9NSZkS%O$LY8uNJjW7)wCksv$oJORb5-cKO+?EJd5TXCo zg7b*z{{?~ziI8u-pso*O>ego(`JmnWn}lv7qMXx&K8uKQZWsD)BFcF~=y!-HXRQK4 z9yj@csP`lYg!$A4fk>Z`3`DvvBI4uDsrHt-ww2bH`i4baOCq(47V*BIG5TU6UJj6W zE5%-K(-?#MK6ur&zEZ%w=|SJ_gxjH;d4AeJ%MD!I}kx0+5ygvR$54wFu*7|;CUhBEndp&;Ro(}0Rbe}b*WDJ3|h`XGG*Q-P;wwG&1_Im3|TrKr= z5dWp?+&eO&muvLei#=oY+Mzw7u@yaT7m4uZl$KW9;%cs1qayRR4MyI}ts@cMwSzmR z>Xzc3Dc)`|rlqyBVa&|3n$bEyr|snenZ4af(v2^7$3!o*>A-K}TRQaxJl!uf`R)5_ z;yO@nmtliqH@C!f46Z?Fh*u|bFB7Bpyjmr`=}Wq5+vP%-xC>(R6*ElS%RMr3!`*tLfN zCUEkN`0atKo-}i_YpI_0<=J!Wf8dwO5=662) z@%3v$e%n#5`*HI-8;tn;<{`fw;4wc3|8D)-;E%80G$dmE7>6G>zb5$O^P7B2tbXLX z`SE$*`1EZv_`9I^`tiArrDVv*&5yq$im#t_D}F13IILe^{JZVF%H$XA-)~VE%V8XT-25(2 z$gcwVr6HX8^^Xq{Kh8aw>GYR10^2wvuKs+XBA(ar5hgNb&VME3SSVi;TzoKF2?zM(bAq z!I956{J8mj41aunx5w2FUqMFm<8zO!AGXE%Q-b^&p&RapVf^2MjEU~&FX#k5^X7is zuuBjxzT8Jq?g|7_&fF8Y?O+@?4f9CH_mPLk>Af4q-{!i0#;d{iUMZ94GaolBoS@H> zZ^v)bhMRKnl~A?4?cnE8#EWn58))xB@Y&u2@$a_x?u7g@F0`y?k`X~ZZdtb{lO|8rzJ!L&(Q%$Af6!yF<3`_Wa@TT|3)0>`sNe zUqpD{N9~<&Kl;S(zSe?W_&w6*z``?kvVJK;{)9d_dB-%!k@pGI?I@tq6vu^7#t&m^MG}3wWd~EYHih5>uj|S)vC3&)wa$+j3TwIT5Gjc z`JQK=weLL%LHmC1`~83a`%Ct-*V^;iYp*?=X&%}VKt6lyC;M%0FK>s~f0}j2JM5R6 z&@aOfW}ys*7gTNU|0lwekZu|<88`))0-Ov?m3-I_c1q74nCJb&-MnDW9;nU!G&j%N zv!}q?-p?|2BaD4g8hWzd8+syRZ)kf~I`YQcr}OQXN*w?pH1 z7h~K_g3jCR+x8Zt-#yW7yF;PJ`+ASCgQZ%P?kxq09GD_bvO1cdZZ3-3|F#=D!>YJotY*cq@?M zPW(?odBvzp$m-e4amV(CLYMX3hj$pX}~C z1NAg|{}yab&??xg5VsTNp5rAL>fO^b4(-gpvESRi6J>K;Ib(j#f$4jwpUk@%vR$kD zWqIGI0|zkM{sHl-`WnCwA2_goZieWy=rZNE3h{Hv2M^1>{YH1uzoSrY-=#}T)OPSc9^s_(K-V}no&%5aVf!f~+8@e^@-a4wwu|L5KI?}0>{UCPb5Wj38s2xO z{nQ?oOS$*VaBP*|x^$lxeJ~MnFlFyV*{09fj`c|I?$=Y$rZ=H;41=BY^;jVVBZsO& zXEDb0JOlekUG-VLcJ_;xdOo=Lks$MT>lo=iv~d{pH63|TB@2FBnDwAY?;e&60G z>Id1VBOmX(f5w&lZ?(g2%~N~TXz9w6#R_VOSL3EW`WDqd0Pl zn%DQ5{F*yW(j;9OE~21NgevW=y#??RIf+ax5oqMyVD6E+!GJbKJ*n*cmW}Ho31&1Tv#E1z-LmO0QzP* z0fd5h0Da|70HHP>&;lRVz{ra5c0Aw%$oFF{>ZOFB&y+!53jUFTkQoo4FWU(qOo|84 zSKtH?YU2SxSm<5&M^=RU@$a;QzK5Lv!pHFd^ppOLfy@3?*ks?t9%c_}qE|Xk6GmS& zL5*2~e@(D?UC1tV^X(2GobL(IIR+wR=G2+T#T+H`zS{)}M6Q6pa4;37PVc3-ZlI4$c@^ zYC_*fXh?@vF?5U`LGiS9x}7&X!>5LaBBO_=+anOs;9bhU0l2 zHQ}H_kt8>s6$m_?B$ZBPr6*?DOni9Qks3IYCL*6BGC zO~|M$!;#W7VI>=}O^1kKD<^X_^T&b1H(}Hf@Vm_cs{k73`6h@~MDW@t;01|{sYb%J z)g-tcH4Cm%MR2_e`x(opR>SpM-cJxS;MK{0%uqYoqfUp%QWwLu)eUexPWF6j{bA}MxJl|2xXJ3Da8ndt zNtLRiaEGh;aMM&H+>q*lo38l6lo9GVxEbo7a5L3m(2p!t12?SBhZ|9kz|B^CRC=W1 z1JI)sA7dV^R=^#jHp0zOm%$yYehBw4^*G$9dJXP4^)cM>DhtMEf|>$1SCzocQ+(id zB3}Fm^-+9Cc9MD)?h)!8xRaF!U3#RN0C$Qig*#QPhdWJO2zR==9d5q*9o!k}Be*ja zALl$u9R+umS_1cIwHEGd)dP2qx(4oC#YZZSQNMwEtit}p`i2?_cb>|Jdz@Mf_jt7i z?g{E_xCQE3xP|IIxbxNT;TEa);1;V?bW@4qgNqAPDcpT{hcva%s|r*bXiJ?7*H$~> zdep6OmAV(MS3M2aXCharS3p|oUAVUT5Uxk1W80zBM7UmcG+ewg7p`A@6K+7A1~;g7 zz#XQ(3pYvK0XJDa4mU;p5pJq_2kvn78Qe6LiVbT>jfI=8j)FTvEr6S$PK2AO+TdoX z%i)IAEpQ|1Zn)X%mvBd_SKy9Pe}Ow%@r-$lO2alHM@@h`R?UTbm@0!CRjc5RQ{8aK ztBc`IP&`AO8n<>Snkh^$WP^Y9HJY>Ys2kR0I{sRMX*R zsS>zhbrRf&>V})GE`~c&-3oVa^cY;S{zy$Z?s%eCvT0qEGZG@=0icp~LB_PG`Gl>)pTJFW(nVowy>{56UINcjd*IsYW4IoL`4%08`391h3D>8};ri7na0BWBxIy&; zxWm+waFf(txXJq6k11+wgdH^x?r?P?+%&ZrZb)4RH(lKicZB*A+zj<8+)T^Qfpi<| z;`xg@3W$cl^{8ULcbK{cZj$;b++_7K z+!WOZHx&|MBM*n0rjCaja>_gg>p!o@qtwaZS!xs9eF1ej;Jtvl4X{6;o&o$hp#B1Q zKcE6Q6Z=a*jR*WSpymVq7Eld<4+3fj;KP901^6hSo(KFrpgscpGoaE?(&ZISsinAV z;PpJ7rWSGesaC?Z)hTd2>Rh-=?S$)7H^IdV=-~#`6L5p-Rk*{{mv9SI8Zv=Y57*%2 zn=y|0o|2|c0@G3(;M(dMxE}QwT&3QD>s4uEnfp|@ezg#8K%D_MsJ;hxn0gp4rYN|{ z%ErZt6g3HMs#*wlxZ;yCY3dxfA@xJJ>FNczBh=sFW~gydj^_%vS!y%fu=)<%h!z|&Q3_m_a0H5DVKt*W$0m={42;tl1}Jk%)u=QlGl7T zB*-d|?Ib4@qnwltAUjEp`w?vohXVd?s&7DE&W%O6sT==K{kp2=6*Zjlp zq5ok!trksq2`vcORh}+L^Iwx7kT@N(tI-}SZS)bCb!{isM#N$&u686<`W%GMLSuCD z7L@A*nB(%Vs_QM= zN?U;<=AvOCd#P^64?&k|TDL3x0nocZr#%nPGl_t-w?XrbY)&aw+9#k>AYh@bjJfD) z`~6{=>})Hz4sO;r=VFA}_P9X!n+TkUImezFup*D4qaR0S*vAH{?8qNL(IDB!2UggT ztXW8cp<gJOPmL148V8E>e#{0vogH}+)cdHN9Sii@k!L_X!kDWA zx7d+Cg3@)V5A3ode@#%g+Y#Tg<5m zKI|ns`@an195BX$@wj31fRO{nONMbS7-PVA&oH)vF&d1I3}YJ@xbBrbVz$(EI~XIu zm|++@uz`qxG2bxGLyRyO)rN6C7+GM{8^#4-WP)+}WXbeGFfzd4gCtra7lAPXj8>E6 zVldLd;4Qa0#wB2cz_`>fE(IeEj2jK(GBAdN@l(UN9E?;jo;8e}V5ETY8^gE)jAStO z7{<52z;SN&0mHZwjA3Ae=SV%S0wV~<6vMb0i~tx#hH(=ZelW@mqZbSx7)uS~dti9M zs5gw8!BAkFZWz13@PM&CUyA*4!0R3JCp-HJ6XPz#7!Ahv!T1N2@n>L+0^=UTxEG9( zf3hRL0)rOTejxCw9eEKH&Ak2d!0UG8O;C3-?6JTbcH~1)vq}9T@TMI(GFPa_18>=p zPfXYof!%h5D<~cF$-o{v;)gZS)Kh`Ic7)TWrhXadvm==%?CHSUb|l+S&jkAI$aF*f zD)5dSIR=!j%d>%Z?Z`qC_F`b49jP_c?*rJFj-=75vh9h1@M`#0(0m;pu)^7SIA6>H zaU_UsAUt6Z+=yk_ppasvFWiI_3$R?aPx4ve?_&7tVZO@e4gVN~wj(F|g5mo>jKEUY zj`>o;UxLtDSnmskhfk0+YkZmE(I9@rXbryXaH%00ebI0gh=&={LVl|t6`y$taXrfVQ@lCQLKLWLbRI6`_9eDth&U}L}-;O+Is5akRJMxC1+IB*6&Q5Q|6 zt22_VAT`aq5xk&1ika_(*WT^X>!I`E_n$d>HP~Ywf^(9U^O}y?=Lz2ek8bSSkjalh zd>0Yye#j(Vz&jp)_+^CX(%$u8k;P&3b8!5dymtTso&bl^ugU2c`yL<|2>cpxGFkr$ zuOHwGj%Io(U;7VZU2tPh;8WnyjQUOQbVl`f8wlRfY?Mwh)(S=-hb&H0(M&t)3qJzi zHi~AP&x$++Vke35KFf|gYl0^Dtn|ol43+D%M(9~sC(H9$8IiXTb|ceG^jVpacMNs7 zFO+HN!ksGOo&2ncLxdbcS1V+V`WccR3l;Z3WD|ga;HYQ7`jo6`S;1e!pYsd10^)cQ(JXKHB@mp+J>#>2VJZmq-IJRY(tVRav+y>82m~u9X-VWkj67x~?MIb&W zQH-L$2O@{{SeTU({(&JDp&qw`Siq2qtV}(UblsQYnZV$GA@w+p@l5hEpN~6#fX@p4 z7H*UR46^E4JG+pX=Uq?meK5wc=9&N0QJG25Mk(Xc;biJO>9a;rovvi6cRa!IjG$BL z2=f@VkPhW!1?dK7>{|YZo5O;@HB#3*$s}sb}!s`;mz1C>TUAMl+rLqN9 zP8;TcN%oPhDPXF53Yg}e0;apCfEn&7;3!N1W02ELY|1Q50Z|Z7kvJMt03YGzu(oIW z#)M~p(9^~o%m*bPbc>Ji<%TN_ajY*dyat4xlD~lmvU7ffRrfyoC;r52hSwE_&qEw- zsPFVo3SS07=X;lbO85p4+MfTHKRw%Ygj=Z0Sc!S~>>XvVVt5n#KZnq!$%n65&vu9d_(-) z|9W_qAs+R=5uR^|U-;h)pJa%~{cnX=8{!H7?r^6ep7igTa1jVyw_oB?NZRfRI}QCb z=;6C3^cwmZ(5bs8++pZnflk>y;TMK}7IgCN2`?D>InYVFC%k6p=RptKJ>h*r{~B~~ z_k=GE{Q~H~?g^Rb4_%+%fcEd6aG0TA1nt{BVX~or3);JT!aPI&4z$`mq1Mp92kqHC zftzWa-%FtF-4jkX^vj^F-4iY{^dCSU_V$Et8~Tr+$G&ZiW{+s~_PYF+TEPNzTh_2y z&_CP$RE6I}I%m#SR`~CR_?HTXQzuEtzf~x1jqT4>b~p7Aw1sl@DvcE zar9z)y=R6eV}}{zCeG)5EPMe7y`#(Yeh}sp@OqON@qQfU)tay7qk&yeW3%=Ln+-vva*6JMuiJXcSZ) zKC>Em8`L#SH_@AIN7PIl7vK=Zp5q;3N5Y`A9a`wU!H$eI)M9V19l`DWVxzp+_svdF zyRcg|RD~D&zG6dFd9m+XVW_2E?E4O&;ks9=z1a7if-p_hc(Lz0+fcRM$FN&9RGk<5 zz8g#~%e>Fnk-H4F+>3qR3x-PMmaff< zh5cqjwR^FYKhIF7dH11>hU)O{M~@n+)BC<1c?uL)Rd$#6uXf}$Lv?#Uup@lbRIj}@ zc|XEZc@w5^JXAh@v@k)Xg!vi?t#6Z| z|LZ{L?ZA;LGqD|*g2B*+5Z&CV7!2D$Xe&EiMZ;HvC}5!_DmQ#L2)%1qtR{sY2CriuDOZtvn7MW)K+X%{$ik$Kwj$_do=^qic{*%gW;{ke&nE^Qb3h3$o9*SE?{q z?RuU+5pp{kTp@ztxgd1oPJ(m_5=3UWEJ0+4s}sbS@X7=c4c8}#+%R92p>taW>9i*Z ztez;&;6G5&tdF3{yKH;A3V#s`ZFMKui9aW4SF2Zzw->6FMh<&6S zTiv9}?MN3W?rZH{Tu_ai2TB{B@2Ofla*?5KRx9ktw?Jug_sC!_g?b}t09pRfTw2J;zwcC+Cgz1{ysk*S&1EtmK zF16WZcz&kN1Z860t9tB68sw_e-KVzO5x&JhQ}?S2?8rDnJ)kbZk)5F)R6Fg+35I$| zU4^~3p&nM(!B`vWaa=8qv>WOP)oW*81WMQJNd*&ii=EwT7*B&S7L2&fdIpS~ThMig zp_Ttxe4#b+mZ6?gKakCbEaZY?(WB7`aB}$8ka?anlfrLGM|<%8*6@2E^y>DUByX5| zA5EN_6byfCLbfHPgn1gNLv|#E!k;39{ph(MDKk73*=pjFr0no4@S0?3#>p`%=o~x54O*qvM*CnC#Qzn?xF37{Zy61+Z zso^^fabwc7@S`AfC2vZ~55EjzJu7)z(kv^O2VZnDoE*LkCgf>I(t8qJaolzm<~*c{ zCWygkyJs!LkYX}jmy}|SrgDja2yS7XXEV>WP`fdn_xy>J`?2;+2DcBvp1=6LVSa~4 zzeo8)e=uBNh)?_};Ytu%7zg~Juu))-Kad$-ZlVPP*;a5LvKsX<9Q}Hin|;oXhGR6d z--5%cIS$LQf~12v<6ze&!Px{24;JON0Okg7%)1j=Q>k%>P~QE<|2=OWttk{-yNaJt^;H>vhog3!sUydaav?qmc1hJSzl07ASH;9u+q}cgZ za1ZL|bT*GOtl)=m1E0e=9MOUca-)FS;KK=NJZdHS@fY5_SBzwy3?};Vmnn&Ud?u9l z1p0yoH~4I3qTip-&U+esZjOR4jLG`~{x|6VZEoH%=%Y+F@%K{_ef@HN-Zt=cU;lAd z-pxh_UYVPBoAJLoFYlM|YaMvKAko)v7Uu=f4&8&hOY@T9zn=N;EzcVXzgFh{Dl7O` zC}H3;IQO77!Lr=j0V%If@ya6OC-CEQE@|8H~{XWBrpyju~@ zhFTIFiSR%!oKu;oAa@lYC3sO@AyDhzC01Uw@n7c6TMj?FBZ&9Vd&@xhyup)^TpEBb z$ZQ2^1v}s#ekCFVqk--4^Sw{O%G})mZ}7^zSAn`6SA+dsgip-mW?Ofn^yEFDqa4S< zpX+dEU_T4LQy6K-mODNF_P~(OKuS*Bc25d=VJw`KEXfLT^F1+B=fVsmF1Or?Si(GE zU{otu#aNV&uC*0hP5M+g4jtgv4}XCnsWt{V*#^#I2DHo92QOw+U7#-d4kqFnKT~%+ zCpq0HD@bPW0R%^X4kzbjBv0{N?wUV$%KZ5^1beQ){P_%`=(+t{ekk6@V2{GHCDtym zJs0|&LV3|OlZ!!p$u{$TCFQwi#c4=%#Njhg{9O2Qmcf^8zo7JLKyR&I#0t6uTzv-c zTkL@5OJI%|haF1RehSS*X**Q7^-veKeAMD}9RBb9s6=2?Vz#o}KA9Sp=aE zg!yXjBPr0SYv!VAwLvX)y%^9wR@mv_sa=fVPtt7N8QNi5YuYx1dA`sQ^)c*pE8`MI z-!E6ar~ZW0X-@9jur_cc+i!Z(k*v-u$O8?hABI|!=r~h<#qt_6;+3^B-Xy2i&eSTc zBW3)VtXtEZqAm!;8}e`R&kiLLPtC-=44!2Pj-zbMB{LuCtel025cIs05}pGO&jCH} zrdZ+QKrk22z7#LMHdR_#6P0RraI~rpx&1*VmPM?`S6Mr-Er-R(ow8nX9O(&`8&RZ{5$;&U= z>pSqWm}w2jbQLpQH89gvu1r^%OjoVxZf?;fC9;m8E=~1onx}4@Q*U)|=xkoMp{X&7 z7nWG%%WJA@VilFK!lK%;WhJrd!it3@!kxdewxlLjvQ)?gWz{vc;;*SKtgbDqSSVyk zMR9^Cs$5c4UQ%09Y~rr0s4ZM!>DS-zl`MQMPHAmzRcu*Fbxm1iMQlbae=uXlK*mgK zeOFg|OnS%(E2^xhC_$x>K~Z^SP02yr#U&+GvBGk+%1JG6xoB?N5bN5~-elEPmsQoo z%8JWN#9LERQW2{uFRUp&h!HEUtR0f61G+n!W9{`_>rLyBGX!UHhF9lYRZ?A4QlYaM z#EO;9u$V_vXM@QC{SqrGEH9s5ShP4+0&&kTFRLkaWSR&lDlbEhF_$Pxs;eujDfojT zEhsCmEvb%GRhK048#3Zolm;>DUUg?qUX1-YFth5Cq7sUJKvjeptEzNV$DNOE$&jg} zm0z29d39NB2?RB$(3+BJXj<$Lp$FGo>*oB*;*|sI9%n<`TEU@tL&SiXOTIeBAu1yM zQ&Cd8ys~<+t4{|OBGGhh68%0fjGvGU5o;#kRw+Ui1+H-uZZU}dbRq`J0dU_FLNBUStQG#D)lDyx^6LYO-Z zM%jY0qCyV(fh9>Z3#(8|Xk%eTaZPFA;*wZtNnvrx;PFsd0aLbwjX;xVKPnd&4(ja0 zz#0^_rmm{0vicw?R#l7m$|}mVjZ6qQ9#o8hRb4r#pyf4Xv7+h{^vl2okw0XDg(bDI z+ESz_hJhKFrm(meBdfeTwqQ^|aY^~m0Y#A1!jjmM%HootBa~Od{4mdfCDm0NBEa-G zG_w}+ja8Q{tt+dBxvQ!!TZTr)7MC0(fLK)th9?E5)l;nb0J{Nm#@vca78KT%57x4x zg=GV42SyC0Zb@0i!RpSinp(_OvEsto!h_Q}VFRYHL|3{jqtVNQ&4-?hiVq!b%$TUy z5E+>H^S_k`L|r(j+Z~Hlh5=!8aA13NcyV=Q)gi)*N=wlDg+)arH8rv7vW2CCC68=% zSZVE&K?*`ubjIEwlTd@aIONJI7E}(b%|i6?GR}_!dS2JDYRRCuF4-N*t{Y7>c0>%% z*VvKj!sW5*6$7h4p0mOjP&2X*Vagd)SX@~(s4a1JjFZH{g;cLNL_oZlLxk(v4G~6r zeXyX5O3TWNovO!{l@-RS3abwiyAy}`%DOHw2snaF#~0St78aEbY)Ks??YvqKuXS6) z7x3W)Z=G!$I;|x&3u6n)E0@RWDmdD)l!$YjWlNkyg-RAyYI~4~Lj`AT;;|@}0gMI6 zRxgrj%dzIFjmRSk22*P&*)$kf%)nre5wjP&C%Wfj0l z!X9ig?$EF?=0E0$&q%tmq`OzvBHX#F}=ca z88V4tf?RXDJJTxcyRg!NNydf=783hQSKTDER)^ML$vJdjaV0uxU?4hImZr!S&8~GO z8>!TS^17N*tcUb=dQcdmfRDXaRpCm#2$y+Ek`@(KaEPv;BnNE@-IbeBdZL?@p%=r9 z9G_&|;bk>L^GzKFR^M<3)(rC?XM9<_xpSA08W=m5aD@wf<=WdFQc<`B?RTZpZ$I7K zg%_Z5SKlyr!eOSO;gX2$#dW$sRT--KL#Ci;W6Ne&R$vHX z_k;cG5J}yUAf>vY`nzr!56^1K7S@z3Tt-|_RT8VIDs%Ry1FN~H4r>xDk8sGgJXVPX z^^ma^m{T9x#=_-8)JyA)S+Wf*LN{pWRE}oi6bWV|hTSn1MhEMbvlVqDt-GcOBV4~G z7%y7k+pyc(yD-!`nRIzgWmOT+3$O^Qi|@%DuAXrgRLdA~c=NFzt6mu!#I2~TsVXUo z#g^1*ODLI|$-p5YPJPlS6c3MBr}+6MYSqxz*wh)zpQGDUy#fb&IQ>Wv`LklJcsopN z#=)$a2eXbEz|s|tl@?bIN}b@BmpI+6%SBNGLT1d44J=}C=)gJ+2%SAE<_yUpb4IAE zy@Sg|sAD}2mGriLz(cW@c;ff+yA_VJQ6g@?isGP1z zOWV3wOVh@t7CriE;%BaoFIHAlQ-^U9-v$cXwF?)HIohm29dU|8yXj28SX~Z0XvPHN ztR=J^KU82{1#AG1;+?Z$tQZRQzKn*S%O7WHr-kG`yu*<~No`$q1!i<-|5{ki9iBGC zHL*gIiG(?}y$1V7tdQ8unp$k_PVp-8j96VG)-Q(xD?$VcF8(fG} z$=b@wSb1T!b2(~Y)%99fpCieFZiq(IVZ(-*1zO2Dsu(J14vpP~ag)BFu&lgJro#b^ zF+HXyIj*zKRzvrAOPg4QZapC7M1?b-Zna)d$DB#e#TYzaN;0aTE0&q@Bs6}##K}|- zN9;63XIxCzXm@37j^cDX+>^D$L4PARSMjAYp#T_-I3$q^`+fX{_E-?1NkEv7S~})+o??(*bIE_rwjkhUCs3^vGw&E8avn5pV|ap z=la;1`p%}=vk)5VMl$^k6xTX*iA^QKfq&k zHZ|cxJ>8CKF}t?43`Cu&1oir?@u_|}!K&GGn}C4}~LHFZGQ(SrIGC?{`V zlD(7rqg|$`O`WW0H$^NM(<6b@!6pT*9D>OaOA`}or~T32zGCurTzhIlg&YBy-1!wJ zi)R6rj@@3rrKPRDF~$lEU{Ig+kpV}sbG~48bZ+E-Y;AJ~TH4yV&e2}zqEj?7S&P;( zX?NG!xz0evh}IhH^sKuDdKfae9a_5q(t^Q4Q<^(tYd}JOAc+`XfE(M;wgE#JcYA50 zhB&MlI?7Qn8agO=LrYWr1~vqBfZ&~WA%!!-oW_ZD=ir0NZs=;>&|R-LE$F+>W^}XF zwh1+=M-w-|P&eV~oo-2E)7qwbC~1Pz-rCRv1#5*B>Fh+3RzSTokUH1L+bq+`;NGOV zx;s*ah|ZlAg*+%>W56w~If>&QqdbEqE9f2-Qja7|I4$+aLgq24In2}itG-vNdfqiLg7*2eDE)-7m8dlM`gVxmpFk1%d<8`1H! zNt{O7+uB-8fgqg{WZvn5DZ}TsPK`A-wZo1u9}!@z9lG4LUfW<+M~`C2X|uI{2IFiX zcEO%u2E^>GJxJZ%zK(Q#OFJUWjCFRe(cxrwH1S?a=&h7uvLxBk)^;kS?|jQGAxBJR zo43T`bDgFzaW*%^>br5not|hVkzQrAYCEjcJKhAhy^S*$G}&rc*W9#WBSy7zmbrnW z2d2E+nIz2oDc_Ydv0z|2>SL`iHZ;-vjvoviv>yt$uG#3B)liQyg5kM2#=)TLsEv)o z?`Z1oq%oCf&>~JHoLQW3oo8!PV{?5+Gm3B~^u(r0w@5cb+ZdM|a5jYg0rlo6JNFya{DJm1huH?9jgs>S4K z5}JgPJ2<$-_G&hJH&KxBLArW^#sX$zo8=4_EU{<+b%?W%bcTff9v<}0-2d4DYlL~I z0V0AybNY2{_l5?G5wVQHO0B!A5$_qd8k#VxcQ!RZUN|_jHXogTjCNw}tqw9axv(`& zO^%QAf#bu1ZVW#US1K6Ruekf>G# zWA~g@B1e~AX|*?@Haf9r3{vaF&ixJS#^$wK^peB)}@9v$ci zfOXei-Gk)C7xGRFqihV~B93=+f3;@$`xCH<650}LiZA(SaGytEyE22_8;^&tkJtSherzb zvmSCb)k=s=`dX$!M-5#IBGwAZYHGvI)vOknVk|76#+x~)5}K{o;WRkTfd@wCl2doUfOvXK)qw>r zw!G`sVP14nb1HF~U^)9`y?nz0!?n3!(JmTW5-li9FWgpjU~E94@a0vrw!kFSv9TE| zQZ)_} z$MmepS{$^J>}=+Sv3>*8&-qF$j2@b=`wiRUfr0U+qx?Y{GXuj@?=aE4Q}IcS_?ZFJ z1SbxSZ5td#UWewy>KhthO(99FpRi_@(*+$<_W{MtRiqI;{OH&&XQel|8C;5r%$%hq z=6^@k;u$;3R^i4+vaDtYbh=&zp+ggk`S@scce_z?u?5a2f1OfvUpG689_I?TGcY)f zu)iDDJI~Umhy7DZQS;Qfh4r78{Pi zw7NQIxV1uA_2^v~owy)im>atEDVttw(XNR7ThrWT%`dBrpW(i%r|3<yRR zPI~L04^QNLgdDw~#8_~)uGk{t91EkCD@|-K^s#`cIA<(r0}l#Z4bYwB&~ldN5KPgq z9v_5BOz5%-rajfiXgocj$hpmIfkxqE0%sL7^`4>&&1l6b#k!7qe0dl~LXVc2&_bAd zjOq5yrtZczXI&|?049fo`OpHTQEI{Vg5Mw3BiDHpi(7E4cv~^hHgqAJD{8%Lmln!5 zle^k*y41lVIekz^D-_=+Ib$fX>c;_A{l>O#nojN+vAgD}kZv4hfTq>Auw%BwczA>n z2Q!GLxO9EB!r~kZhk;ChraC7|`T~@*_it|BI9qfU^J52h4>4$iqs3^86tyOX?&GS- z*@VzQVV&IF<(x90M|hN^C8&=b90vNQ0p}i$f^LGfh^>K9aHc941?;AsencBY5h0NJ zjr`)a(AtizX+z_rCe9&SVmD#f5Kl8o!?xY&PN)H_tR8lh8Yf+>uP_>ff^Fj9uo~PG zx(pAixv2}b6dxKw12#6ZFdhcNuyJ+EAt5ItsI7DGqL1FXutSQQB5h6(vrC`ln%eQm z${DTAU9I))qQz8JuEO=r&apN6Q{ZMXqCX<lh{e0dexN&DAHcXubP%#4$OJ zDnM2BJ=Iz+R6SNi7lZQkDYIij&>6@Pvs%+;oD{U{7+hVNwTrHX$;_=33~<)fI*PMA zgNQm?t){hWX`q}5+Dy|J#f+#YX(&Q`BdNOvB6ljNj}dr(RuX*d8n%j)zc<1*Rt(Qq&5O#L60>X?l~WzvR~TCB72)ae_rs@vE!{ita( zryV_Q_H>;3ceJ&2P4DhZ)DzFWPKEjC-aM75R;_8qI_41a{BLB7m$Kv10;~w~c0Is5 zZ9V&I2$o*YL*)?xJ!}eE<RAMa{A%tZ-(jUbwcR&zJ1V!x=k=pj#aj_gJ!g5UY@bqJ zst5h*zB7XJe24kfwRjh2>UN(()WiHpSneC~h%boBzJ2yq-)O&j(0n zvkZN;$ajQ)i7%^^xtxC{DfMp!3G6u2^mFid-=uAR_4yeOLe%OW?^a*RdA=D)nBsqw zod&^|>rML|r2<(Y7&;gI57bB|fL1z6P`Yxib1qXS2dL}|YJo_WRdI16+p=ux0 z{qZKGhW`2?`U5FmIeQVfY8Qm+QM;7p-HBWf<1J9*xA}tQzO045@M7PHGGB0sAKCp2 z9g$b&I|5z&5X4CZ+~zwH7==)RWea_&7qKMY2(9BNLES0GLh}5g}(8R>99Nwg8R>T&^OAjerxIC$Emcf6y#0kpd0+^ZE!~* zmy!Moa<2n-q}s=*Xi?73eVGe*b!ag_B1((~hc&QDo05LRVKn9VHE z{NADo_kiYy@eKVb!uahvL*FevyhIUpJ%INzcM342u6?Jk*Kr3fA>=ON{AX z#Q&JFmi0Cfosx?LWAKff>xkgzLq207coiJ_nBhB#*?5CB5&UvYl*BWM2*00*^s_K+ zj=^iDii!AM%~ixK=pJ#LWj#s6YxVXK$D?q(Z)6OVAczW%i8?y88n4mM2d(gqwpqkv zzI+XcZk1GTlPKC4$sP@>dGR z1e*j;6+BIFli*o`+XOEZyj<{V!S4uuPwq3$7Dv z73>t;B6yDA4#A5BuMoUe@J7L(2;MFDfZ(HoPYFIJ_^RM;!FL4T7yL-@Q^79<@l7?| z{v^SWU|5jf%B6hxIYuJCmP?!_$WP{yK31?maDiaCV71^1!EXxkqmE2}ieS6oM!_=$ zw+db$c$wf;g8U#P^XV1*f#B_e|0Vc{;4cNA7yO;zp9J3&d|Pn8;0J=A2!1Z;fgNV~ zoP&wO1v3TlrfbcQ3QiQ9A~;iUuHf;4#e$0js|1$`t`b}$*ebYD@GQY?f)@#L{$M?? z5xhb0`+~O#-X(ay;G=@S6#TW|%YttR_6z<+@E?L-2>LKTX*mf-1fzn}1m_4ICs-s{ zCRiz0Cy1}Q=zP}-wh49%o*{Uy;Q4}=3SKFAz2HrPw+jAP@Gimo1RoK6Lhx6DzY%;{ z@HN3bg6|4`B=|2uPN0;JUob^be^VIzY@x>r<_aDuI8*Q#!2-d>g0+Gt3a%DhE7&5~ zA-GxaY{Bh<7YX7;caA;@-XM6h;4Z~-AO{PC8oj73*9aB7NO4<{Fd;q5&C;V-zxN-Lf<3wqe4F+ z^b11&PUts;-Xrw;LVqCizXd(mvar4ZBIO`-hR~ygK1}F|LLVvg9HAEqo-EiZc$VOK zf;R}>Cis}(uLOT5xKHqaU|Nz>&%*>K3CBLxK41h;Dv(U7W}c`!-BsSd{gjmf)@5bEH_uS z#e#K$YXvt6ULbhA;BA5r2|h3QhTvZX4+w^!yDWd4;7q|H!CJvJg6)E53tl4lZNXiF z_X<8K_&dSff`1kKTrde^ob|{SJX~;w;PHZs1y>3-2(}BJC3unGwSu<@-X-{R!RG}3 zB-k(bksvqStk-bCF@lo?=L(h!E)#4JY!^IB@FKx$1#cC+TaaI8W_iC6d_(Zhf}aTn z5Qp)y1Sbg25u7hrAy_YXir^-}?Sg!vD)alk;BA6G6MR_kX~7o+KN9>*kQ;X9lPx%2 zaJt}ef{O)L3a%6E7W}E;y@J0Gd_nM!f^Q3cDEOsda)#7HFi&ufV3}aGU`((@aEsu1 zf>#Rm3hovR=XREpu(A(E?=-vaIql2*Uj)I!4AQ51TPW1UhoHkcMCoy_-jG^#ct&H zuF(GwR3n{o(ghC_oGSPY!7{<+f=z;*g69feE_kEhj|CqPd|L2jL4F6E?fg*ifM6;P z_Q)SCI7RR{!3x2cV7uVCg8W!G)88ogW5EXmpB8*suut$q!2^P+INWAFlLTi79xu39 zaD`x#V29v2f|m$hFZct&y9FN;{I%e#g6|4`ENJ6Qmi5ULzfIK(In^mEb9Yn+4Akyh`w9!8-+iF8CY4 z-GUzq9uUku%&E^*!D9va9e38VRjnAQ zS;}dP;10nn1aB1lk>Jk+e<8?^tTO#R!M_RqQ&5d}!qWsN3(gQcMzBP1so=?i&4S&6 z=L%jX_#MGrf(q0&;3&a-!8w8_2rd>}E7&TyQE;2!PQe=mhvhlt zgarA`X38yB@C3mHf|Y`+1e*o#6?{bSDZ$?g?iGAb@I%2b1cy&_${j11CpcB`7{L<3 zYC(RhlJz}XaEIWfg6)Sp;XQ(n3O*zFvfy69&jk4)JLY?g;C#VK!Bv7?f@cYSNAL;3 z7X0qFj}x3Gh~Lt_ayKvw6nr^}|R@sL2xIdXUnNHi#*3~p^VMX0k9pF4HiU;Df zAdtnNn=hT48(p=+{b5Z`tsG%Gchu@C4RwR0yZm+C^&QTWb_d;kDNV+W#RuK4MH%4^ zTx(kAmR6!JD)D4(ZsW8$R&M>Y*%o|9(>F^5i%(60b(EoIGHj-yW-x398q&rG^jO9W zkg=G)ml3xxZ{lNr4efZetRtTZ^Pz74@$VHI*Q{N!cU_NL&Y-8}hhY7i373AqLt3*0 z4S0^1x&zxJ&_{<^><-_+UU_eb#D z`CV|9bFTsO^Wop*HydqZ{n#G<&O~NA9Itj6#{ZwgA)23!%r7y8f@#8XU4F*B6lY+C zL&)#BLGfO|8PPo03G*}gJq?Dt9oL~9pJLt2b|m57v||_iOk+Ab=@`@*|K`Uq{$DO= z;yu%0S<6f$31hrTaERtNw$u0=G-20)gc#aQDB~S#2%w3_Yw5<%;1!5B&lS(~TPq^D z+q)C`7eYL?muT8sKPbPekl#l}84=Hvb@HJ6dXXRXh55l0$Mf5Rc&=`;E;!w?3Pd*; zm*uj2eTOHWHJ#Qlt!;WV8qLSQ`8j^aojq%oX3su4U!tr|I;W(3fpfPnGQ!WcCdKPX z`Vtld^_-<)l64qD+Y6??XRYqtlVbJueR<%(pK<3=AGZ5RRzdF`^jsgRnB=Xxrax$1 z(~lZusBdy~U^!AxBR^`q+ zZ|e!69_~6o7E*_U%W{|RE-UmEWiiYtYnLvI?ekhYb-mp63l%)F4|Uvc;_^Oh`uStO z+Ex{zM|H5Zf6L`=r6#($I8E{ z6u3hC0R1!ZU=XZq{38oOf%ev#6t;Cxbxf?U%lJQyhXUQAiaHe_FP;+JKRmC6Yw**tpR-_Kb|W$cp5Z$;*-3m?0uES`KBHD91Vn zCY2TkF2u+?#f&E2OAQCVezYLt9 zw;^o`kO{m^R@yB1e?$K|ua)`|JfT@9YuEbG8z zMjlT%ZsbD3305j^DkaZXkgVS!Vnm#4Zx}kYxt%F?*Z@KV+GD34D&^SjAyMZTYiHQ`A;n z?bQ}oYc5Ty)?Ce^W!I+6KDmiSRpcCrw7Lr`SZbghBPFiv97tA51tR(ihMmPRluDuN z;a31Oh8f=YuSa|wNc`nGpxyr;erj&;vpsn9qyujqT9sJK9OCJo|GUr5Fld6i6eM1wfrpL~@59iM2E9`wo~M4r+<*9n4eaMoGrlOq zd3DJD$1e-f1>^Bz{a%k|Y!>;(lIHePt!8;60^d%dn?lcqHpheiB#6p6ZK7iJ;37Oq08*^JUi5OuU?BwkTwy;!-JRE+dTvL9AbvQ2;GL;6yZF7OT8#^*#<>&LV5@C3?sUk088IT4Tj z_|;T!7yCkGbVpP&s^hm+DjrTb3s1}};v*;XxAF;_Us#K9ua#|^{C{b&0JQ?oADJSU zr6v!~(x)={yh|4!!;wt=>X|`VzJM&Vl6Ei(9+N3|qIyzT=s~}WTs%IX!bv0XQ`T(* z=zyM@65&|pxqb&f4-#;Na?v(8KG(sCpR#c9==!Mvqk`$N8+84YGtI^b zm`ensoQP&K-58vUv=cMo@W)L%ev`494+5Ev6F$@B6Om4*N4i?lgVW)RK$izGGl=;| zfjNWYp_{zmdr%IKWr$URrwX1&M1DUNd`mEZ_K`oGhJ|Xy~V87sB z1^+D=WP6Ywms3Qp+ld{5TLgCq?iBov;12}v668vj>Gksuz!!zq&pUvAOXxof{!>st z$AEAymzjQyAfMYJT_nhPf^?1GYC-)R0{Ev3{d*!h=?$Uva{=gwk4Z!RUkLhP5lN>B zjv*plp5S!Bxq`5X-c&~yrRX+|DlV2hH z?)pVRuzrlgpULky_}%$!cGZu3lV1VS<1a2}p3~=oHb0Z!Jn-H5U4Z;(2Pi+7qIiBh z%)wt=e&rxoKgQwDx5eZz$t?Qt4J>W4PEa7y#5RjG;=Nsno z%ztowX3mV+`by2$U!VE-B@_UYEIYJ-vIz9+R(#*6&bZR;@6GqJq zeXAeWppa%M;#f)n(Vsdk`OL$}EjzTcKNz~AKOg_;F8&9lxE5BxI>|M#s>C%ds7;c! zIzeN3lVr8`?wO0c&2=x-HOUHH-Jep`(;sT@>Carj#44qac?F~!=^k3C0HCio_92t1g;q?G72 zXa}w%hOR+B?!Yy{Z}ms>uYrtqpx!&#cYCs)PSA?L9`%sB3OL`|t9NZkW2|yXuCke0W^DHv`u0 zI0|L@tg1bBs8`JmZTIDyaRQlsu+SMN9;Em5z}Btq-E+^?R-e@i8hJ6#d62^}t8ULd z-BzDJ)Vs&m-g}oGL+!okEGrQ0-7~LudlqGt?JAS)gbW_U$4zzzP(I~htv+wJW!3e) zci;eD)3KlV%xmA?kFk!on5;mUmGr^+kL*KT`%u?@`W^mmML)t}tAE;)iL%_|l6~N& zja+QB!Gg`ULLB!?_n=HHje7gCtG4%34n|gkb>OS|jz<6{oxAU-!_4=q`pzwT%FA8n zAnc8sHhMi~kiJ_OTkbIG6y<2+f~jTtwr6`!Fp9Y@^!Og;i#89K>kcYg$K5()Twd3= zt;YtWC(m71ucY@5QI@G|Zj}Ad+c!ej*O_zwZ^N_;Qm~hEX|{FK4qOWBfn3fFhHirFFW+t1SG-F(ab3jqC4XFNw1@uoPABHn zGc4<(Vs#VRars_5{af!M{cih%t-IewXL3LPb^knr`MNj^--rK?@y|usSHXMF8;X|pNIca{MX{2XErVP-;94;60mmSpI0tTx|H@^5zed6u^t{mOmu6#VDne+>RJ@t=Z!FaAHrF!&h%@8f?xXvU}iZT!EE ze{LI|$N!V~=YH`X{NIlMTkwCw|6%V<;G-(iwedQAx;vc^Aq0>pQCmfgV+aWZh>FTC zNPrkX(18gd35y02N!Vsk5m68s#T^|N#+gx6Mp035xrz=txDKx4Hj23Kh#StR^M9VI zx4NrOy2ZJ7zW;ac@4M%hK2JSWZ@uqZ%c)c6bf*fROYm8V&r*CA;nRxG7U-c}K?VfM`@3n2lzW?dhc4_?DcS4xM6qjE6&VcaoZx-P`ABtbF%`d%RTc~u6=V2bg z`~HA%^_za)8vJ<2%)1IPHt^G#g9Hwa6aP+Kg_wuzz z?*;a*kTIBZFFU8>`vA^OyTd08%PR_o^IYwIhMorVcjn1x3+zY1J5Pp0XyXZzlH?ThXm4DuI};FdSm;P2jb{Y zSo#v)N#GgM9K5F7`sKT@rmU<^v(BNLsRgKyco}v7z0%4^Y4V?;PEBf!_9-XDK!D_dDKlU@$K*aQ+49I zw;Zo|*>9e};;G4y_KErb`rVc2>@o)8jJoLTg4P3G-y-$HU_nm{7p0{|L8i02{n~Z(7kACmhjNg;Tmu}xM;Kety;7b_xy1*Cq(a?Z3 zZ_*#UB8ETDzfFI==7Gis=7WD5s!YBJ@_hk6@%;Otw+S-vf#ocSUjaK~-%=fyy!RG- zF31CiuWJ7@-z!{v?mIiqlV|e>mo6SWT8$s228~ifhNgV30Oy-n}OJE?xxn($FWj9wit=es;$FT8+I!^EHfYHza?R* zf4%m(-taRKGrK9yUu(^rhAl^08x*y;96w;g9x(V3PD5(EBLl1Rut5se+E40`o6gQzsP{h8ej%TfqzU_}=zlAdym3?j+^qr|2dDYY?ocGJ{WY=NmaIhZ?} zg_}Mb`<2zl_5Ln_N{@3tfVnMn+-%?)Oy_2;akD*~t(U5?BjecF6Zd9;;7-85%hhXY_LfhcFqD69zMK!r&7$AB!`$^oG=6gsXLU!f@uG zt_jpNVJx$0T@$El0(C*2Cu86QH3Z@~!+{g9hYWs|))0q_aoN#!<}Xc?Fv@A7I5v-* z$xR^REpv76nKl=@Y_M$ediTVJ>v8=rcyY6eIVuIe2Xzv4?U-#|el*SL{~2=Q=WDn! z%w`=KL>wjP0D4QD43e_tS-f>7cNNVbq?Ny@6fZ*0jmoS}GoBPE%2)xanKdmB`?u5oz0&LvUe~p{DdOfh&SzChk3nx-;p< zJyWXz0py=ohJOb&SZ2`F9Da+GrPO}-bj7CwKEKDiqZ{zK2_ODgpKGQ537=Q-!Q@`m zVlhb&}rTs_%nPyKpfve?SW4xd4{LRxid``rt1|R0JIvM7Nx~PZ0%U^*H*ExI&_yImlZ-+@v2|iq}b0R)RNAQjX zpY=#z4SpX!Z{QO`9OVxJUV_g8e7N7n?Le+I`4K)baIW(>9iMaYS%(kvSe?bfsf&8- ze{FG22NMe4K@j-ZmHMAj83g&=e`Z0ZLL;F_2l>-JeYooWol-x!431I0kMdNtc$QKn zah-HLfxiM^Nsqslp>g=&S&q<{NMOh)OIyy)I!_gWl3wDUo)RYcG}qlo5sXyg=MlEf zSe4~QicqhE6L8jtmFf>R1s~MEj>pL+kvrvQdGLRE1nSG&oOxQXioil-7BtGa4rD^` z_{9I*xn4NUMd8dEX%8hKY}UaO2ruDd@-XziN!SI*!!v@H{9%bTNgHeN;jfObWncq7 zP-}DRc;^4k#N(_Fo1bqaits@e!VVoApENig5&EzhSf^|VWFS=P-~^i6W`a2D!)73f z;e!l>;X0`Qdy;uG*N>B@$mGFU9~m?cKw_GI#;icJNvdM+TcD+mCoIyzDxCF^K`ryA zQOhjGuj2`nVp-C6id>}PdL)=;Z&R&S2WkmI`pDqVdL(A>$Cx=jX{ODEM#YXZd0N** z#`3ThyCXaUAN03Yz)BPRJ-`@mqm~(#YpFH`W5t;MGJ!BaOH~n!t~OWsBqXghQtJ{@ zRS4cN%1dn$G(+?{D6Eyzh3U>sHGFFeh($n;5Rz`Px(j*~P|8N*dY}PnFribjn zE%iHm42xk-IT7>I^u1@7$U;dNf)u7cKxY%=zcj>6un16Wg5`h;6C3~-VuF=`DifRt zm}G+WfEgy(3}`jMMS#U7xE!$31TO)sHo-LjJ~P0bb%6CIxDjx_32p{#F~O~X=S}c6 zz%~jc3G%-vDov0N z6s%liL-p&!9Z{XjEsn(hZJw(CR?Sn6HbKh~DiY0ufIe(HmVz-A&k!adIiDc^cj)*@ zg9LA9KQa>hJ9N+l>Vv@Btm&={6`KSC`+54IghLgDpn?S&D>HR&yRK0ecU>c_ zdz4txDRup#uBi(X6>vEtirNK@_Ck6AZS7sI3in8^VAQQ#ul!Vqm7lze2Nhg8XfOP7 zMeVZ!OaFulE*w;V7rtCADwzR$b{ImrxFt&MpIkfY04g&JOC4Au(#d6{y1QjGD@GlZ zj4}}irzt0wUpgchAE92R6eY?Z;Q~;HCN+-e#O0xW=B@~JSTdDq#fcK?ygj5)5tgvT z68v{#o0mC{U?ZRzY4FGrmD*Qefd*A?{0kUIDV!n3o40+DaVIH`QhY-EN3*b3<+rDh z&!19y{=qnhd@dW{`#;Ay?4OKt#9xea)V~<#ET8{89>a#d_;)d%D;DMW{7G{=pZ^q| z>*wMrV-LR@&h7mYoICh~aL)6`;@r{ab5OqjE1Wy|7vS94=Oa!RpU*OTViR3_UE=ex zr2t#QVlgMbJ)SN0_7A|hn_q@=q0g@~_VM}5v9CW1=l%TCagO^J;=I3q6V3-I^CPIGkk3ueeE%?#Yzzl;}iO!bI#$weHm6>LCzoqjwT6tg*l@U;3pLJ;yEWG zP)`!|y5}&kkR;|6<#1c86(l)caSj7llH_`&D#GX6b}U-%f$RVgKHx@sN3rfVQNP3ZB?$zJeeL2NbRcd*r- zE{r`5ETqY2y2tW>V;O#~IN9yjj-+!uMJ4H z{OdzvuUnaI!(-bKeu;d0Wo!rVe75d8RVs220?|^O&Zbu*vQ7i!hUUa>q5zGxs@MjE zb$6W?jva_}ek~WmYG@Je;TL7c+LtkvS$hIvp_60xAWB=9rF7}pe?nXhEyDhheFaX@ z-{X|SY~$Pi1Hrsd2QTL#1h(T7!kCuxI0E00U^%p$=MnHJjpfjCJ_ga-?QuD@$a`R> zIq73APb%^q&K)EiLq10U%le^&D4L2KfME6^IE7z_e9VjVP7zg+!QkA!S+(L5s?M4L zh=uB6xC5C2HkbnHP5ZE>UW9Vl3vr4r#c2{gp^5EB0dhlodpV^D+{rkMusMe#@Hh$9 z)XSlv7fIqC>J@u$i^r_$T%J^fUzT=|FgN8hMbZMvB1Qj!l!x#M9g%e#AQn0+rgsEn zQ=YAoBgV3@iXMWF5N4-1D(fpPyD0Voa5$q*SFsPNhWQplmOrhhRc};eBGRLEI1QrU zfUMqt+|Y_x0Z{kDl`3|q4WA#5l_0FU&#IUT$3Y_D2zT2v1)zmoe&MSkx8a<3GESj* z^iO~%861;!Hy|9kIL2h{&!v$48%T#-evz!(QX2FN@N8bsk?(c7xxlk==^JC@x$K!D ze_(1#1*oJPge*r9@35GQu7n zp{9J8FwZiR$92VkOgaStlK@fWO&$Q~gnwRDmE@hd9iCswYWKR->#(kgJ&|U<8=KsO z{}lI6phQO=sS0GoO~oj2PqUnaEsaTWW##3*?#B@0;YDo8`S@-HmaB~NgcyxQ0|b(Nd1~Kf&&Uc^keJGbkj1L`^jC(c9s4V;PWdk*L_`m~Xk>|~DY}Bi|BBV7SAR0ED<;3iJYkQ~MO-XGX9|1Fr4GFVuKC?~C-;7q zhqJ#A!*N}EJxtB@REIrBslHwpEzy?}#(@3-z~sNvKzom4Rnb+}KznVVn7btFZj|TI z>*9kUq_2UFTE53Mba{xk9vXXG&+ssBBg48ShkKhC*3KN~y^nB-Zp%uqXA>SMc=-Ez zol7S`DYrQ+I|rwi7~Shqgf=6!u+!lYV zF1~h?PO!oK$#iqPb`!qPN&13|R$J~4u6-$HfWA~9;9hT&@Gro)-ev;2&BZBrz4iHq z&DfwD!t1MBp+URRPq)x?ogfVh&EDj8^tweyS9n!ALyPg7rg&(-=X<$gwvEX{tdKXk zE0vv=qU^LZ%FfKJtaC0q+V#8z$=H59hpnG+4&bk4w5g2&2zZk(LT~DHKkEBh1iIaf zQ!frkr~=a|e(h!N<&ERu#Flqz8`VY)QunG4HzxI$xwW>;skL*RT3du{-sA&V(93mn z5&i?$boa}3mSS#Rtt4GAH805mY%UM_*Z-F;2GV{=yAYh6o8#UTm~DL!e%6y zXP#ZVPqfg zcnt8z@8eYiaEsNQV7)fkhbA90CLeppVaz_mw`X#@QvWw#V4$blN=YTG0?-&5Qlf|AgkY-d<-4@L62QUuS0=$ z@CQ%dLmja(6pMxQn3{z?sKsI-J$=(+S7~iiDV85%jTMzzv3xC7bON}(&*f`1#f!kT zyPdVX=^AAr-8ERZx@&X`b#S`|p)NDhJcLZhPX?W`H_`m)aMpZ zgw@3=M0J^2iB``TZ}JUP-x%WCk)pk`@_W}Bz8 z88M^%8Hz17VwYO6#YX!B;D4odlWwxz;99#$cT3Wh+1Bc6wq0SZ({4BEltQmMQ#~KR z{CB0~zst$Lad-Jkn16Fh{>@JQM>FS->vleZ`JdHNMd#UKKWmD;0sK|Agh|IhSCH&2 zGSbNiVw4S~vNwz}?v1Uh`VFHjivF#Yne^Q&eJ6yN7lo!56XE*cPyVf{{ELPRH+_UEAF zO`c3I3v_hRO%Tyu7Wf=3deJBkUV46^e;_V9ZNBGHB(N$GncL|(r`2{VB>uPkx>4ae#KIcr>_ntGnZt$#xdA{n}((i?Gi2Ym@C0aGmV} zC)*HM^d?`!Y`aXhV=>Rs*>;(1&EPuQ-`ix{z-%4D+R5{5whm!^x7=W}b=2u@-Eq5Z z|6r5tFA&ppcW{_@lHy%9TTz>AZ!+5;ldTh~LuVUgvh@eoP7X2II-kU5JBFUfyy=+a z{fzfSZ}Kjxn;gzYe=V9|)lCjlte8&~T3wA!@5Lu^wx({;x-bV){Yo^w`HYGW@OW10V$vG=&O_n5Jli*Ks5y(iMx`%5N!&$YEzPNOIh%C{fw z9T~ysq@R9{jBpIcjY`iij*NW152Um>efK60rua~b>v|m;VRKmVp;{cn8D-_Rkr)UZ zn{`xDl~7V;m3)NqBA#zI-9dCA#ZQXpxx!JX0`2HY+EL>g(&5^2ip`7^O@oMbZl=}y zDfQ0O3XEQp;aX;BF?uhsnOY*r9$;$dE{dII#5P*l#x~ zM?4!>i+@w1jc>9}Y4Mw!dNEGKDZarJcr={QmARo!y>NSZ{{iFceCz82rdf2o7;VQ< zY>N?FW5u>OVu(ZQ@!8CO)`&f3jXrA&rmN4Sx^+H}nO--UcG^s@r(`mzZl-gX=|i2# zcH<9q;ewMcrw~^$&zGi3x?#Gc+vUqP?Q$o@en?dG54NKDz7z56!ES3mP4QS%ckCh1 zsw+Ac)g91jzPBirAGOZrN9CH+TJv>w_d4L%=oeC4ds!HjD_T!I3$=KKSIw^@AjNMa z+|2FRgAPg9I>g%2nGZ?He29~|vu?w^nYm}QXco%yoeAq1;$`4J2uG)Ybv?TDjOx+l zNaWQ+rZ>353~V2iF7BNl|{GS9B71lqycr28tJh zb8{tsQZ$OMXp650{~39WHc|X8cq#ehXc&br9*K9gy7<3{@@;PMqu{-g>H0OyQdUWn z@5|nXSFyt)9yDk3`^!i>gxc>9`ItXGn#12NP^*t;rW|VRiDZ95G_1n;NXiQ7*LjuD z_7XnZ@UaK)Q5Z$^M5D+?3bHkMK(Rh-dJwH#tH|+6=3#lcq546LL9351$9T{$9yVVP z2k2C#|Mi2x3gPPotv-uaWr(+WsDwKQG|2GHg&m3U6Ncvu`_ zsQxh_gI3NWX97GdT79-0mRoq;h%tv*3yoJhSlPEv*x+6Iop`VGn0kwZ_c89H$={;@q_OAEq= z6Q%VJ88bTJ9b6habnMs>V@B7E8-f3OcbyqLeBkI~T}k{K{fM!{hvNU_#m0o1!Ih)O znL@dd@X(=cTthaN;e_g8CpuyQa}#Pt51lx!rmA|(xG|1Y(1)=Tq)wfJj;(h6vbCR( zOkev*Zd?0^bZZ|pSQwFDTUsxzCbypHl2a?7Z4?=alv;sU+e)CSl$Jq6np#QUtk&Js z{=?W*l@pRGM~ywUW?1Ez2{q$Kb6o~Be(_rZ2-6vLd%S~t@T_2g#WCru-ryXW5c|LM#Zgr^r;4$Y?0_K6m&puGN40^O||u0 zYh&j0*;vRyZ>Xi?TV^!PuhH8fXlfk5mds{Ps!>D74IeYaD3v(9d6n703g+}qR&-7W zv^gEp=5#2jv5GxJG&an`#>M!TdRnrZBj|E5LU$~)oJ7swfvT=`ftu4;yAVsA%;Dl5 z4XDf7`kGoUzkwhZZK=`8%v(Kl@R;f$HI)NT#L6&QdX|A?d$Fqw)r+|x1JyNgIdLOP z6=SgCgC38DjzTT#g#}dW%vlXhbFmpWn~W{P2-VyGpLAv;#@sry8G)4fm;RbrP4x{n zTqk=_oBAC)4g+h=;BgbxocYEVy?Dx;xy@Xh2Ag!$=t?Pr5Av~ z3NFp9GmJ7B2C4>D4;)2LCbBEIk&0W6v8`(oUeI|oqp1M;u7ioaDX;)VyaiC_zYQ?YhTW5aAM#U!aMDIW7O)>Mmb z6I{_l#tt7ia;Rw?ol&|MFBDt*ri;}K8;>P~s3qA0**4MvYa5$qW9#gu)}|JvuLd1a zH&tP6pjMNBjmA;E(`r%K*0*H6NrT&dp?f3?)G!BEr708ot#yelOyl!w(RJWcf}o92 zdAg>9J= z5c9H5YOpfX3`!; zozYaUwXzAAoXB6-GIjPwMP2Z=aZaxN*{!*{lNVrP-rW@)g>yi_ty|LF9 zvuhbQ0_zr~)H%zh9jUSR6S1lrEf`02Zd}`(^uUz}=3qK5WEx>`juW0QVP()=+fvx0^M5k0mQonU8QCim@rz~N%~{VpnwmM| zRJbtBs%I@&JFTWw!Je5vVpgLTA`8~9gN~W?3smi#=~yUEX?GKIM$8m3?KHPZ%*g7R z=Hgz~tWL%1Kf}k2jTaq?6~M4w6&E_-xcWxXou zru8c=ZRpjnUui{MSy|s{eW%qSFtxm{wzf}g-_qKKUUi46|NO?Jc$ViY1O7J|;J(3E0;IjN>Z>mlyquJgBcVke~h(;$sh{4{2X;zIR?|nSW0B?8wq+ z;`J0|%5}QgAJz3MXor5gdihE#sF&a2*`pExy(jB=W=~dEH+|e4r+s@2K)~+R>c%f} z;$7Q(ZRXmJgWF?00z=xz&-Ye@&h?jvmqpHro}INcmf}yajmTa7S7{yCZ#GTY(&Y`7 z)h$C@>q7mX7fSIVUH!Xyg6T|i(}R8l<$nsNj6LEA=r(|#|7!e?`Be(NZaQBX{ut-0 zL^nOigZju_eI?E<{@v*h%Kuk+(BAI&f7M>F{6QY9 zKfX$J>#sP#=}#OVd+-&jzP`^(y}m!;7YFK7r2e1YxE*Ear}H+z=N*8j~~ zt<$^PLb_>2Q%g-t{V6?XV*$^34Ly68^eX97(zj>J!j?HrO|3oWw#?~ib=A(9)uVCd z?70hiFxRB1Gh18CerlX}UG&kmD_z;|iVQy+n=%=GZ$;jvY3~N}c1&L=Nm&-OWEF zO^)xizkaoc^s?jN_PqfomU&(zJ7-xWe|e<+u*e>MyCqTo-P4cruk^67cGO?EWO$?p zY9b&1?9*d-B)^j9j{bvZKy3XP$3^yt`WI62%c%bea$W2NtL1v=-y^4MC@-ZNHyEo? z|IyQzL^?+O2cZKScH^HeHz6W7>OYc*xEB$7M*SxkaaN?z&qjt}kq(uS&LblEqavQ4 zgJKO`8u8A?KaRLf^)_r2$j;lH&Cc7A_P}fuCmKB~5~&Pv8}4M=euWGjbM}nvU5Vnd zt||i>mxeMm{`pAB&N&B_aGKtQe04~Bi}JjOhz?PIKg*{qiJ*^Q*K!oMlisELApCd~ zHR%8HxJbt;Mt9KB2aiFqAr>9Uk|MgGDzaB4HZ>m+X*VXa&+tfl=4e-q)>w!d8WU-U zqCwWr)%%f03Z%&0fCc_%r?EiCMMp;cW6^Xa$3^{W?ddh}G{P;;y|W`>zZq!{n<8vN zg6Fq48>A;I={b}%f?DkyJDLguW?r>s{OdzY0@eEta<*&J6TZ-~{(LXcL%uihvx4!< zeD){*_vjVb{+nK`f5b!4&j=NyH09++>XM{XyQPrtKykk#OWcaOiya;HUtJVyMJ4;! z`z&tulECG$0gCc-9*QtKO1!7;HmO6xW4@Q;-?b>V4sG}xw6ycv;kpEP!q!38xB zy=@G8_H~PnV^4SsBHho3bQl%chJKEkgWpCiTXPYJAYB|iu(aBryru0hcl&Igp~brHsSh!1IPLA{Yv-J zo5QG+YLwwyn3UQ^MeO1Kn)RN&EYcx1Akt+xE=JVjuXb`UxSm=3J%ZJ^F{9;&kPy3yb$g)7LkCDEY9-r?GT)bZ+C4IFlj%3QS0x8V17l(sj zJzpY;ZEpqFWK_5oDJ)dyl-_z*+Stu$W1mHABxiK&=s@w_$PoW=hWKw0pT0U)N15W+ zV?@(qtKWr}+9~%&{cjiU3|PGmvJu|&URj9rWm%z*eGhUAjzf6K{|gvel+u#F&XW50 zYys+Hr_{&!sE?hfkN*cSP#?QYefWEXO3^RAnIF6-T!4Q_M*orYZEe!8NBUklUG=TY z&s*X*qgJ1vAMAw>yHXvN_@_c@V;iZzL8?oR|BfCz*2HiJym~$c=%~NWyB8h&zO0=b zU9XrQ>mMpiY1GHEb;fTol4tuXvyt((c}~U~Vmjj==e5arUyc{qJKfm!2ofSWdj@WK zTM=83PW%-lbj~S=MD7n&Z#a#TKZ9A4N?lzIe!xpIG=7az;8eTi`&+N2QpgOk}>63q_8RqSlBi*x7Q_= zllr!)A0jn3r%RwYzC>)-wEq2ols(fGX?bp@EEgdqZI-Jf;ee5CYv=|^Lrb)&y<3qM z%E5H*FD=0-{RSj?Ih_J`#*K)L=5)f8yJbnlkNWrJ9v2CHh3Q_K{10i>odQk&3S#%l z!JYnhEyqP-n8)N|4uA{hYN%@$_1~sC)NWSvzQ~?uMsh|*LYTE~io`}lvMM9d2QZ6) zU}@C<5`qIEIP$ni7f!_WG#KZiF~}74&oP5W6NFD>!z!dx0YIusjgVl8@>BH0kDSU*wF2%n} zwQmX^qpnQxuUf@Z_;_`FihmPT-xU6H^=OK}zfcdQ=+9LZDgM@~i&FfnSNSP?y1FPO z|H+EKTumOc)QS}UnpIv3Z&8<}_%}}-oWd8XyHfmJq>f6_-$50n_b5itQq)twezf8?b(SN17ETufx zsAE#(yQrxt`ma+{Q}kc2UQdy~QJs{+*QsqO_HI?vQuyua>lFKUs&i8KM)gRFe1Y1P z;?I4mI)y)=o=x%ZAyu8iH>;;p{QI*yE`>j?wx-y7N=-@OTh)#f|DIEeQ}~N&e2RQG zwKK)PmsMp7e@#7^;@=x;Pzv9!9!T-;9mSu-Cy)2l<0h$y`*u8BHF?FoO9=_^zLt_Ln*WsVhU zC-n2X7jvAiK1Kc{zew#s{-nLjR5XQOsbbJqWwWbm)OP4g^6S(|kjI}KAE}R1{NJhf z3}GT&^3?ZgBhneRd^Ggq=i&*z7U}ytya>Fz!`H$-f0}RecL)EO!`GmEJsf^8c&WqJ z!P(vp?+@PB;ZLHy4tID3?DO9fti7Y*Z-0lcM*1-hF909p@YV2dsKYyh4|n(~_&3tw zdxDR4_*L-lc!w8*k8}9_@OOg4H$p%DpDf{T3H&|D;mhIQWN>~b%JztXpNud-^X15Y z8p7&vM3`%)kS~UR*CC8(&7U*D1Y5uRBH^D-`T{t{g-@*fF32AOZtX8X;Bbe334ca{Tl>x6Ty75kL8t9~jf837 zoOaNkMc}RAwmx#f&veqSg1;Al+xl4#eJrc>w>=!Y4(W*2`es1z4scsv@58^xz-|4^ z0DlSG+J74v-*xg&0q1geHvhZuXAiu2=jwa(w-Nkca9jTGptu4&F6k@5CxUkq-WU2P zYyJHJ{&ATR{u3wlO$1*K&hKodxiY&>)*H&E4QX~&wUs*1vmE_^;R(3gSK6&`MCS1;v zCJ$ei)aCmn2|~U)Fu)HE@IwQfBVqFJRaufCn>WdVL=fL{~f*9G|X0e)kEuM6;71N`;?zcau$ z2Kape{y=~~6yTc!{LcaYcz{0@;9CRyxd4ALz+VpV*8=>F0N)hKk3AKcKjLN>cu1bySM{Mm_godMiHpp>9}1 zfDGk>p8U|a3X3P}!|1zSbr63{d1_UDia(px6LSAD=?5y?LcE{lhwfAR7My@shO(QoRri#k)< z*OX_LIxD3;r>hH6>hI5LP>OuB!uw!-82|26U8R0adyG-{i9d#qP~|E97N}QJ>h}%x zNJ{x$R5yseQeB=USligxGyb-yl~Uhvojy_75sJUX%MTr@)=RpnpYiHp$zP%62dMti z9!CFV>gO^)G5kt}uQT;w^53YYO8&UcKTq{Y@qeA_m(u@ER!61O-$Uwvl>7_TpHu4Z zcC}O5$JAG~nkn^nm9|%@rlr*1R<(aheLbhxk9e5&cwgbCjruV9wyW);FOJxJe1pMd zk$DWjCqHzAx<%?^lIGW_*Q7oSzfLdViX^%I&roZ{zR@35)1|(PbpC9$M#^h=uKFS+ zy@R?(%4^y)U+pR7Td(sER$Q9G9&CdxmH^2g4e%E*pSB0n$65j;KT-T;Ga~8xtI;O*XZCh&`As@CnSOJCuM6-$2KX%jertfQH{*I? zrKg|a3&(l--9zDcPfdYn;aE@aI8ew3HXhcm+f4sqI@^Wm-HBK?yA-$&*U#o* z@;gj&B7K8-rl8$oBoX@);nz6g81ZA2r=MkM?|#O^KHHmoD-m{I6Z}~4J7QJ9A53fF zj7L89JL)MHuI)n4aPT(exC@ayY&q^WG{Nok$fn;DNWVA0?exjYvrs%N{|`eG+zwtg z{lP%`rT~8^z#k6qKLz;a0DmOF?Zss6+v%I-_Tsbru|WRE1N?~qe=@+I3h<``{4W8{ zPQb(3f5yB!^M7yVJN^|WIg$RXc^Bu`;NR$RUHem%nnFAU%WM$mVaE;PnOM)1xYF#8 z>tBxf2Klwve3Ez_?#IO6DYckbi%ma>Q}OIhtiwARVm+SSi4Ay0Cr-l>z{Kg;MUXf{ zsWrrzO8uUAGIk6hHe!!l;w)_XL7a_uI>aWd`%Y}e&S1n-mD)s{gVj5UEf^1ptyp=J zI9I8y#QA}GcuwkJfz-o7W$NLVQV+k9dRQd&aGKP^=~548NIfi;dRQX$aF*1=QmKct zr5?_adRQj)uw3flT&af@QV-`zJ^Whg;e4rw3#1-aNj+RB^>C5Y!^Kh$mqEj^#Fe(z_$hXn*qK(z~2h+ zw*&m00Dm{Y-wW{f1N?&k|1iKm3UJ;uc-VIS#Lxu)G{8R#@ErmExw%j7bAqSu^=-zV zodNkTq(21v<(C1uuW)@KiuXx8Ag>RWZ<62?!Fs_Nf{lXBf~|rJ1Q!V| z7F;U0TyUk}DnUTndd-#iJi-6h>nY57xY2wE6uJpZ)sf$9o@Ybr%y$=|Kbm=b=oY1L z38~PnSlAq0omfx24V!%kt`~e!@N?qrN^!fB&>gsx1?Lkt;J!khOHe}?-Z`OgJ; zpAOw+?jIq{*WM+^JS`WF6OSU^uT-7jO2OL&pCV%3_JtreXVUx_!Dhkp1n(EzPQ?7K zT@?5r-mefh;kzNh#e#ZQgol)VE)H$Ry&wy6K)rj)BT5}h4s0eqibc(de^%;Y!HcsbEDvM#J^%qFTt+u!C%7tR`BOU-2bi?e42>+ zTwVu*1BtkA@jXWf_p6JE+b~ZczNz&0zoG5;z6Td5@lfJh@R#^57Dgw&hj|F`eS9}U z`~Yk75kJIA`5l2D<2ys*r%Ihl#JJAife<$lzf|f2BF63fd?3c@3c+6pE)~2<@I%2d zos9hBg6IYcueHp0{txIQ2kuGy9$O{}KY;jmto0?lkKmDl0|k#293?nb@I=8H!3M!o z1Wy&5FL;{ZS%T*ZULbg>;BN$fD|mz89|i9ayhjk1f-WDrw8kd{pAkgY(D9tAupZEK z8qq`=KNCdNYYq{Oo@X#iu)W|uf(Hs7D%ex7kKmDlc!bpYss&FHhV&f4{RH_PB;&ae7x4(eVS=@S+?I>! z&4P;r`JE%<^>>LtJ#GTIAu;2*8!_<_!Dj{E5ajN|O#fCe%5fCDhhVv2f5G8`;{>M& zHVX1Ni~0FnMdWi7kjp9z);a)o!M z4;AEIm*mq0XA8~~Tq1al;2#9J@;me0C%8rM1wn2##Ps2Ue7{IOL9kBnbV0q36VlHY z{u{xyg52qc`M(p?8vucGFAB!*FIXhVb=Dc*UvQM*WWjpDM!^Mwe2>U{7Yg1k_#c9s z1@$IBkh_)lA>bo|+>?yF1MfFC;(kWlh50b?CM=#Td>|2WqXbVR-i-UP@YzJqz@E6O7KMD zt?*CyY$E*=ewuJDEKR+?7QBjxeCq@sCazcN4Z%-{x8b)4MC9WZ8Pppkf_D_&ML4!| z)al)Y_Y~e+_|bwxh|oJiIG5@tA1Ay<_zb~Q1%D~HLXd0A(+@5JPrO@ji{J}_+ljYh zw{qcp|I2c4$#v$7a-M+n4uV~XxJm3sMEcK&kmn-i<^OkO2G!f*@E*0PZvC2@N&U5f;S3sL1X&y6cO{`zY2eY2zze{ z|3cESf2x+-Tkt@^V!>X-yRjOD;AA57pDf5#ddbfsZp3vU{5OI(OFX}yVft1gCJC=d z`ul=h*p~4fI1dEwLxkQ#1ShC_>YLt`++>cAW1by#oF>8}g_Q23|9|1SIo z;W-_VALZfi`lzQwaG2mY!Ks4$y&C0CBR+)9wTQ@nF%f=WF8uezhcT}czESW|!RLs7 z!f%-c`8!hTX~%g#u&W?{Kgs7i{w|*JM-XA>XyL~RA1z!zPe6VyIq)pvBeow{5fuK7r2j*B7N1j~za0_&^7oc}-aJ5fiKO=u zK0t63@iEMEgx3+FXS(oK;^Ww0P525)KVSHj!mkm2Gw}(mqAdJRf`1YGo1}k4d{U{e zB;M}~4!=7H?n6ZSVZ^5}-b(yn!7+l9CH)lQ)2M%mKa+@ZoGtu9;g<^k9TD;yiGRU! zy2L+CM80Q*zb<^c@Et_RN4fyF!e1i%?nXqu{e&MTyr=M^h>)))K7(;j(od1}1%hV_ zUL<&p;LXHmQLn-uBEsGy!e5Z|Pl>oceIx07K&4ze;&b@TArb!WFYyNnFB9HJ_#oo* zSO!}7L`k0{e1`Bw;R}f`px+C>K+-Q3ey#A|313fq5#yrpM~U$Bap5lte?|CvL_BnU zF8q5*_qrk;<=KOX{2hhwOMD6QSmEW8ULkyl@ZrM83)TwGBEF1GM}(h6g#Km1FBX2e z@EeGb-z4}~!M_n-QR+P+{QQClJ>LlT3k=U9BE2gS@}+{u3XUSaitCgJxmv*{!9~Q^ zlsZTFD#2?6*Gc+AL_D-VA@MH=z9qPWi1#*s7arXUd>5W`iS&<%_c{9uKUC6t2tQJA zIB^^LyYOESp=YY_CgPjeNm%&Vl76o6%ZS@?{};Ya($@=rK=5&ie_Hsf#JBK%N%-fI z{+001-bjBN?{SDI&z^$a1!}FN%t0n!n z!fzqIuhd52ne3h&>@HYJywUuAkyt@~lldN(IDq_StcN5xoVX76AHgc(AIBM8D3{agf<8j+-*d+rz9M7$64Kfx_TBt9v)mG~d{ zy`tbt#0T)+L~t7s^Yym{-zRRu^S$5>BIeCs3hp9ep8TDl;(JZZi^GEa1uW;Wxq|%N z9_O>%pqf}f#C#Q7Y-@}YF+c4tSVTl2_g2M{rD93nWJh{EHi zNE-Q5BF+QxQz?xTiI~4l5}ZQBysTbu1`(CkDA-KIysK4k0TKOmk>Fw?=0{5fmlILh zD+N~(F~7M)a5eEow7=jQ;$PAJf@_Irq;-Ppi7(^*h2TcwEBHP{a1-%Ww7=jMA{zHe z!L7u-EfVdOwFSwY9@qek{aw0C4m4d5? z80Rk$TusFId6i%RuOnPcg+z>RMZ$}T7~d*{_a|bU8!o((xK741f^$Dk8?Wjl%CIVtm7;p#9V12gbQ=!u5Eu0nfw2QDi;N<*{FU zC)Yd1xnkj^M2vI&g%2RYSf%hP;yrR*BL5Wfd*!+VUqFs=Zl%btBEm_1y&!!ZImWps zC4DQAtZ5Hc9$sBF4Fwguh0_ zIQPErkBP6Le8RsYVw}_83qha${vYF9K^XDig+z>VMZ$}T+fZKN{M|Iix#7YqiQ7?L z;gg7Op}fKyiEpF4!WR)S&MgRez@b8Ei=VB2c%TL5OS0KEQh;dGTUxoBya$LL>l8*H-^!TQ~$3l7~ zImWq(l0J!uac+k2Mj|fy1;Q5*G0rU)zLJP>?t5Nm7}xe@|HF7zPQ*Aijkpf=L&UiC zI1%I3M?{QMBiWwo@w`gJxbz4S_dd=?Pn!YRauaorOCq|}wf z&3F$%d<6Gb;-gA^O8hh0AqK?teGn1X^)WT*po1xPH$j;=26}5!WkssONRc zo!@zVzD2}!`8^TW+M`3uCrT-xV~N>;<{>|3&izw zED_hy6yj@mpG(Aba{&?8%UU9?lShfTKJ@nnxGugY-;VFm_5i+x|M@1qjebIWN2vzl zyV&EI_?}W%5Z_06i0IeP5YeAMBYuSUVC{h)P2)}?Es=vUH8qJ%EK2Gdrp}#SQ#*C)oQ8Qy zmm{Oob|G}T@_Qy%?NagFgC&!UU1;6vO0&;JrmV8JLrGoJtXU0M);yD(-oGPLqO;Px ztXQ8((rzn}Dc#nJ-HsuX9BXBFGPYKBCr9shCqrGS8%JdFZ1+-a7SGpRzqS>dKun#> z73{TY)0O66U3tbBhU-O@RF-JSaLKSRW_yry4yN6TB%L6yK3$R@?GSoBTld0ZVx&KO@G9d)#rE5O!24=VS&>POAdeC-17@fWw2QuVJW8dt0(`FN! zR40B+D5Fkie;u=tO*)somKDkmdXB)Cfe#unUk1(urldm7G37# zMq8Ogf1;Rm!rA02lSVd%BW8L*Vk1JGOD?x2vpuQV9wL)ETb96XS6V#f0%1vlLYU@b z0;)<{7S7U`Va9JuXLs4kJIq-fqZ!TV^Av*aw-9B1LZHOEWigFv*uUz|(;C(g6+2#R9=@YzMbDSl;x0c6QcrVRy7G9<~&cZd- zr;6S-u3vBMLxT6!9B0YXM{}I54$aFGytn2!OL{NOaTZ>tInKh3IBg!@i{}b`?$^tv z_XV#n!CB<{XpXb+a?NqJ`gH!@3EoR{oF%M8uLLjC9A`;46!)bjJ!`~pRaR1l*I~5{wNq!-%$+@dCidj3YsPlR zb4pnghvSS|(&v7qR!d)<)#|B<|UGEI1sOo z6TVovUqBA8lM}~|Rrr1gjQ_hy8Ge|L|MTS9t&(_vKCHggMlNA@B2t;(`fKI*UASvk zU6{0s*XIelwRp$v+MR;5B7E#&^-VBx3A@W7K)cq4l^Y8=8%G^^j$I@r>|Tj?)UI7r zOIo|Dj9kJlzHZQV@v2-O*6vEkxpw1@T_h#!eiA6}CZwe+?^}WLz7IK;7u`)C*6tgD z@|HSw+0K+>zB>Z_Y6s%d^{X2L{VI$~V*Y%5cv!oC2=uD~j@?co$9%^H?B+sWD;3FM z^$iHvT`YFH1myY$>{dB;_k^r1FaP(%ZQtb}tPguwyWNdkqJ7!F>34w$TDdsn-1eQ~ z*xd`V*6uk7yLQ)rq$@A4TUTE*^c5kF*JU?H-!!8y;a}&F@sBb*tbbDxcJ-}x{M$$5 zSgzLs^}_GK%Mou6tM8>idDlW;976POKcFq|eS!L`68|W}!|J;`pl^%g-~J*;{~kdG zm`IE#6QM6%Kjr`GK`v1*{4EFbABYc+gk1#OdU?sQ+g;?CZv`%B*KVumqb?p+-(n+| zu)9d)4mM&5xkZq3?Y{5WJw)`;F2@ts?o#N>V}u;m?gnsI-!ABzf;hIvp+L$}-&Ob^ zD&gNHxLz1f86H;OYJ^>V6E8}R&xeT|^W_EVh2QB{BHkWWUv8khGoY^sLiDc((E9g9 zpuh0De%hf753BF9Kz~`~_}5e9nC~K^FVSE4Kcwld^W_1%G{pR6`0%iHmj>*vaqRXI zIp+HS<-%XWZVU?2*?q&vCEBAv?AmM2+IyQe}D*DxmzIT+TG#U9SB*pu1x74va3bNL2M+Dq@-jt!dSw=2V-Yp_GCSccxoLkQW9J^JHUH+EJwYxQg-R*(v z=p~V>4%mG?a2-`ScE>t)ZwkzJw?SXJadJ&yzPm&0jt|(qDlp%j;@CaGv3pLy?k?zy zi!K7&gU6zP-2yzEuwPEpsY$s70lUqP-4h{8ea!b;+`rv=jzeF%`OD=-F44Z_V)y3( zyB9;wZQsR?-ARt!@d3O2MW3ikly_vn?hujtMZoT{0lTXlyETs8?0{XaC7-Um|3szW zFHznpVz)M6_a6{)%e%(0JJqrKM8NJ0=))zLIBfeqWaJWdTg7g@NLso7fShZ0y<@il zvbKFs3)o#G`mABAkNX9<<>hb6*gvKR>^24LZgT9-aO{=^?5>2qboG2l!0sBcdvd_; zfdRW)9lNJEc7GMP53bE%_te0B@P4s7D`0mP*zF&%yE%hh{tvrb&o7DH z=78OjfZZLA-BTUA-*T-^^W4?trx$U+Z`qKF~7jmwD3!u;Xx5CkPoY9x?k9)+> z4rO>)|AqzhHD8wWZ>7jFAJ=|y{cDB3Ayg!X)%OA9T>lnBUjbxTf9C@!M}2=X`V#(a z6#pp0!|Ho5pl`L~-zt%#KK@48^>0%K|MrKR>)%?(KRmJ|{QDZ?6Z9qg3wJbrQ-+82 zZztqjeVZKr&~*~}xR#IWUoP~OYE9;3^--CtZ>ysZ!GyloO?eak^%wsr!^7%(B~adN zj=t3*2NAuNpX=X{4F2sMDDMtO-<6KOFEAf<>#tS(qYMx0-)E3>%d0L=_CG$aP>%l1 z57gfx=;Qp*9#&sVp#Jip&-TA-AZ+zj8-0oTdrADG3=gYsbUaW7_?>a}{Jfkn+U;lhl50v3y{hJfeSLOKkdy%7m9r3*D`Zq-MQ5O%ZFU!a! z>{g20^+qfq=R*!vlQ^b0c5gr|_0jH#fZcJ>hf6bYSi4-S((NzxV)sUov~ouV>^3`g zZ-T6~dx+_OiThDwhVt$c?585PE?{@BKtEmV*!`np_i>E(Zapu8zRseHV9T+|$R+A| zmDs&iWUbu&kaO#Km1B3k=wm(ee?nZltDz6Kki=p2-5sds-;3SbMbgUM5vb=ij@>&T zOF7#8IAC{O2D@Bq)NS95V)xE~-PZ$l*E@Faa_sg);oS0W5`CgBQO`Y$T%w-0h}_12 z-9sVg*7GLE?mdp(FA#R^a;=(l{rLkUm$17{?A{l!`wqBkcdKLfex%uYJ_bfzyWB&L z^=}W`Zd@x8e+j!gMD76*v~pz-a_w$&>^=xtYquZ%H^sHPD}&u0MlNBOo8#$z8L-PW zv0S@59J>!Yc5?%ExhG+|@`eI-^F(fQ!0r!$c{~4Ul;4a|3p{mQXsoX9VoV zMeff5yT5{*Ti!g!?iR=HF9LRpGT0p#uv;o}j|c2l1?tABLdOl!xeFnRa2kdSXxiu87AeIM~Wtld(CUAvncyB~-g?Ouubfopdc^rf3$T?RQ<-&RN8M~=Q0 zqc7oKE|k#@Wq4TsngaT^Ir=^kIp+I3l18G2#3w{7UbM= z>~QSv5IN@i6Hacu#G$X4isZ2R9)z5$PhDZ`@;Ud`4+NPAJ=+E_Jn_{x|sT+3=gaC@qoTk$G?Aw9P8y#^k2Hu3m+b< zq3eg?|JA;H*OR{&eb;s z`U*rJ6K@cwu4nac5ww?@sAg#tV!=`zrM<+R`2n)yHjtez5H~`0gBy zNdIDvKF(2W9%kGF9iq%Owv+ZO;#|3-`{3OsY}>=8JqoHK@24)Z)}GzWL2OEQ%0XdNFZ*HEMuA~me8 zeFrNnY}@yrJ>QgUYW@24i~lzszhC*kSP#jbZCmAELmwB7Jwi^{bHa(6ju!M1eTDM2 z-%yVY2lLu^O8gTC)llAssmF$y*M?~~5w=dIL9e5CQ2S01zkOcUZtXjIdO6b)MCL~a z6kI-NFTec}?T&1B$X+8l9kUkdvGvlpU{Y*rb8Ex>3Mr1 zpRv&~j6Bw0ei7mek*m|eEbA?J0m#7yXI+oEYP@DjVMIzCddT3o;7$Gv!@j@&H^}2h zkYf}g{rw}TN*v*8oFbEPI)(GQ^5|qhuJ?XcAtYBI+WSyt@ph-fpMv-(1Y`;vHHs;qn9!%B|dUx%|EMp(!1ie+uJ z;lJl*{mq8I%gf?-lB+5IL+6|w2y;IN^tOVWZ$X|V33-J%5me!JlCT%g$phg}U%aT- zJ%{V(?7{nd%qz+{41^mLc{yHj&One7l3cG;Wlw;A?O4LxsR*g;={QHYY090j;|+^) zzl?F-{mDvsP-PvBsU0zweZG!x-g6Tx<0}1Gu^ZHMS4#bm-x>7T_pAJ;JQUK^0b>*oxHUmucnsg>C_JnIUCxqpVYy)x?tgrBFM z?^LPSFgTYL&OQY^G7qQWOc)Uz0Lb;`WN}X!ZL?Kn@i&*ceDlIt?;^Yuw!8%~mCXr5 zGK4qnbu z1d6DR*+Vbu3oOn<}NR$Rq10cPbzy5B0ETUbgDod zXfBJUvS%O|o`qBFw@?}LvKOX^s_b*YBmAi`w^H`1qlW=vUR~Bl5Z484Fa^95BHr|{ z%DxwY@Po|tI8NLk$D7zb50LBa?d5!dZ2zDrF1wuXK=RNc-o7Yb6e5KraS!#%3*Qup zRh`R|%I<>54ier!Rlq6Ikw}RQ!|52>85}JKRCre>`}DOci~FSOw*755*}s1mOZL}4 zz?%#!n%*%QIz#A z!rJbg#aVn_*5SKLlYRG|a+S?-E8BzC>?ls*b~wf6Kse?__Cc6y6M9!DunxyW z_W*>wi?gzT+UH9laTC%Tn0`cbJRs(smBo&x)6Z7Pvf?6*ya?HRR@zZf{;o0REy`j~ z`v%e8=_-rs!0CLLRYgL$SU*5SXjDfQBODr#e+H<^zYu3He+`rJ+28#9M{y44{}tzm z%H}3+kz;T=mWBpI`9tPhZ$;L@K-~ZV4l-);jiFQZtY(qFJ2i#d??}os2zJWm`eY_2EvfAHa5h?9tKX+ciGq9# z;*O}wJ`fS@ST60g%I-~mG){&`Mj)uyFPkUTSe380PtTvsO3$B;b0~iq&VK$?IEV9Z z#yOJDuhXLW&*Pkx{~pe<{D0t_ozI`;=Hwql*YYcH&duj$MSJ8=!nu8Z6V4s-&%!w` z{}P-#=HG~Oe*XP9cgp8aQak6rgL9Ys2;AB;pI@eT%|8_9g8cqC@0C9W=e_gmaPF4R zuXYRb&&GM5d~T_?Z~iSf@0b4|&hh+bao#_lTk9Q=kFi1>n4gbxck}RIW&&Ogiglo# z3Cu&9o(UW%GXb;~yu`(rhZt{e{umMSxjPi6 zgnk!^u|4a*1JZ{v!^ez`7aba}Ys8{qaamz1Ue>Fmw4^Lv)Yv$0R*&X6O(!?hwZ_ZK z%X(GRP3u=$+R&?CztW1jva-I@`cA7uU}||?ZEc_0zNNJdz3L8CLyzb=ziG}XJ!jO; znbkCVVN**D|Jk=^>x`Lm>T9t0K})Zmy-IuGudK8u==_GMElqW&G_t0dZ-4rp^aq|ND2Qe)M~p(k36 z4fF6{*~|+|Lr52xRzd@#jXS*adowg{~vqr0$^2D_KmM|_SrMT%m8zP z8JGbMFx(LaL_t9vu5xD>2E-I+5Jo`}CP1a4L`1wR7N(ZHOsQpQMddB;si~EfrKS}X zihOx3OW(3G{r`T?de%Pc>^XyI^?q;Pzcq8#Z#`>0>simb?7i3Cd+qhCIhlKYNre|R zEohuBJ5+3F-N0?zWY-#QeJI^R$=>c967)7jYg>*jZH(QOOT;ai-Z*Q<@y!jB8z;|; z8r6@K$4jUn6W!hz>(?y*Nb7oIH&;S&E7ozOGmc!1)2A+IoYp*d^6}Ffv417D%{s$^ znYZZJ<{5Jr9M`;f{;c`4nx;?7#9)7@1&tZ9ar*q}$1Z4^HMwcJA31s2tog@gB93dE z)sz)617a7=^yMyUqKH+?@twV>V*LI6pzH$HNtotg+)9HQw@0LG2h`Szn(|vlh&E9T#=d`m=30=m=~wcxKzi)|J>U<&5R4*REcBDvomQTBIGT8$p82WN+EV z;xKfjRB3ey%GhNbYqMe1^3z)_$Eq_ou3UHaS|RL)gk)mR+jJbv5^(!6iCDYi4TIeD z1iRa~SPqsotyUV7vUPPCY#n(fS=7`#W%>+^Nja~8S}?~<(}byw%`>OZox7k}2UO$q zg^Q;zYI2-NUevfmdAvwDx-ue2N*66&K@~17BA8E%jZO=6~ z&6+xAy06UCnUm)q>vKlK$tiPO^VGTXn{1_`QV_}0L58P;YL=sUN#l&;J+@eJ$2HHN zzO<>ip>aXe0*@=M!=mG~O}&aPYV`GTtsimbZha(oY<)!fl>r&AjB+&l#j7O0ovD)7 zDj+)uvK(2h0=ABgKv7vegNPihlDk`-x;(@)n$;Ydb4+%#MrG&X&5p~_#8QfFfJjgl>Dp9NHO+5HJAcrG zSo{5prpA+xz@%F?yD^E;2u{UJ`v@3`&7X`XYgn(>JyDVaF`~{jwc+c3De^VlQdy!JmF|fm>f@dz-Y?-=fsm9bV>JiNP5&I-Ps}O zM=t3bn#8`!cC~m6=3L7B;a%Ef&bYwr$)YRG)me14S)E1qGskAp1I?f;dWiX47M*W? zmPL;+S7y7_%{po@!3YqKnL=EV{etokf=$+DxZo840u6T&Cm4(hJRTcnU>l=~nY7 z9*kz_6U?G4{$s@!MJ9cj;e%Z|u6an9S?02={EN(-EP9@KC9AyUVgrNuZTXAM533$`ESmCM5WS+ek%2kROJ)A!WAq6zns4Yc zE-=j*0-?YxkI^e)bZd-0HAb(F(Wl4gwK2LaMsJMKXBobyrsH@lOHMUUb3y`V>2k60 zlc6V?@j66p`Vezv7Jpza&5}35ydl?nC$G|cHH$7XU&QN~jQm4Q_pJQYrcV}sz8Rav zKibH{&6h-TaFpX^vN-Lcq~8X)y|RsB}V{B^PQw~q;HGSkGMo2)A_>8InuW~ z0!X?kR{qN|ey%BXj{G|v0VK`yYA{qI*I68XxW>EFhl|JQLik6<_$O$*TWst2al<0~ zgJS$xKq&F!6qTlf!&#ZS?AcRF?Qae5T~!7=`68h=Zm?_hlOMBdh?AS~f|L9oH6~5`1YckR&&2W%;>Yb8_T<@iJ!$f+OnI){ ze>Fl4liaHH+M?y3tMxjMsYqY1>1~?+VZ1zMJWlg$=Oj+=Wr{tCIKB5)dI0f5#&8HE zF`hYe$d92UIFooR)=?;ZlHw_fC|dZ?bb^;Cwkv)~@#~6rD?Y0Dq~dQBUs3$CA{U)e zAFRX??5j9Jaf0G>Meeso{tb#BQ@lX&Q;NG3Z&tiR@gc<@EB;dPw~AakL;2iqhggL3 zG_g`~pyFu7iHh9shkT0^TNJqlm+@S~LgeZY;w6e#EAo27_*)h4QG85MY!xE?6{X)) z!w((xK{CU#j6xQr^tOuneSo6A1HE92*y9B_&ddV9C(c9st@7<#S;`yRotL> zjv~J+Apg~h*DHQqk^4|G{ZYjy6@R1niXv7!3SXt-LdErpA5q+6 ziYF^O)OBc}4uLp6yG1Wv|w+Cr_o#G_o0<7mJ;`%*T<9Ywd{40nJ zuw_WZb)5TAF#Z#Y7ZY*&u!C5S@7Xl|M#XOs8;!YxI2rRQjelJ6St4#XeodSLTbdgG zhT^-#CM;pX{1ek~)18R&c|T1YOvDP}k;G|OqpIR zNnDKhydXIPYd|&r3dPS7mtvndrN2s?iHivwuWvYA2%_0#e8}|?C1QVaibaGd=|2Po>xt+uR9TQJv41dB1kq(CS&wxgKVo0PtVh<3SC>3fLv zu<1%XQEjqgTt2Jx9wNt~(ytQHE^jIQHWBT@Z=IN*`(v|Rs+8u!bGAz!5$({A$odl} zz;-DS^*xP<{y&e1`dvqyg!>XA>hmKa>LK$4=x=!at;do&;$(bZM}(eph|rJgSE<*z zMCfxJ5qh{KB(i#h&!OAS$gEq@a87fU&QPT0>G&4?eOWV9DfZ3&Ca!rw*_lN#p1~Ed zDX8qxiX2DdRla+*KPqNRPFei*0VslM+t>VF5g8Lo*2asqkfZ`K>k?$)3}i%07F^ir zFA2HKuylN7CtP9)rjxXe_LAbSN3CHXXH6z|YD|iId71tCFH4t>?{sq-AhMDUEGI{5 zPJQC9DC7F%Oz$Wu_F^(iO0Kk+gj}yDGcr0&jY)AWoc-!EBj*6=IVBxfPL9-^QsOUd zmkXosz{#tE=&IStq$&$7JWv8GAqpx$&1)Q5Zp__cx$|7}|lro)t8;+@V;-tw5ddmxYHQeKFklgH6n9-kax%A_=hrWJqd-`?v&( zO8v+~=kz-?CNDK4)4!$4$9#OQ?Dy|Z#O2cO2eJOBfIQ~scqzxv)%QzQUZmd*NFyJ4 z=$wAn$K=&``t?vg=6fyHe!L&grQb`j`i}JUtMueO8f(9Mkj8SzL+A8+C?;>5r(ZAS zW4gk7|luLPC zth`7+KJQ^XdFY&e{C3ROZ>Oi9-YpzPuYe{YH55_+A7eBK^jx ze&nHZ`tjR)U*0XAethjpKI%6T7ZYEbo#Z&^y7Q^TJ3e^*z~jqE-cPK&sDF2=e&nHZ`u#8_uNd;!E|iDIpOHMZ8yD%v=cKvX z?~a(f8c#nyK4rNa&!0sAA|m~6QT@n6M?N~fKlJNc>*+Tc=}z7}D=*UT)=u<`@9RI# z({HLLZG!beM;J636L1QC@yb-m{Q5j)K%Vc|lBG6XdM|5Bql(eonvpV)BY{-Oi=oT`_t0c>2xp4RLKJ3ZE>$FHeE;aP!)pjE9?U;U#d-4`|^0vh4Ti1!a%`tgTdGheO zEz)mGOutE;$&1x@k0)=DClA}7WYw43r{wAn+Trlq?*&gDUdKiHy%p21sS|m8U+c?z z)suIeCy)E``2Eq+iM+#O`n~DNJKmFbS4={URo>!jre$llQflJid3z zrQcU#@@hPJD?E9#WAeBaPcC^gV)AM|d99v2?)T`|_g2Wub^WM{$r}lIX~^OE>QqnO zU9tXsxD)+ukM-|d$g5I$t37$O2va}jo`AexIRfa?zT$_gqa*Z!RF)VJ?rxbDJxUu1#1&)c@8r2deX{4y}Kr3@$2lrYbG z%PiTVGI!r3GO1_E?AV_w!4GAQfj-2N`g>o5?3bl{@V-77^)w6jB~VvWe^rk}OM7{+ zrTw{N8|&Frj%Px>ef{tZp;P@#OZz@oZ{|yxo%;*YkW+H?{(?HI$D!ITQctsFAExWV z7uVBouh-9I-4^fr+q>^dTblaw_uDw`*?7yAHnbu8ss!~dXxXtpVU|2c`H6bgVaYxW zG35KSv_&4;fNeo!871h$g8D7U)4s1QYQwKYGK)We%;HXDvaQ*c0opd%(*9gxi;fG7 zEooQOA-mtt-ycFx^kvkpIJKa?uG*hh(*9h28sih~N*>p)IEGQztE8@sXI+Vu%l^0R z*1nHeVy@YbHrmHF3(;oG``+z!&HjRhEi$J3KKS2Ox8e^_H|EJzH-kQN`=xS^&^Vo} zLtmyj&ZV98*xJ3t-}4fuG@Ml$2rUxiWKo>s;#sZ+KX4J6BuHPJ zKjgXzaE}eb7w0tH2F6Rii#i>M$ahV^i*2Er?ztNgZj!l6cm~<<)xVV z!Wt$M3NPB4(3m0w6Q7z=#nj@95uL2Mate;UuA{IAv)i|MQZMe@+|6#N+?}ufN=E7C z$=uf2CYRdnn9J;j&gK4&%N5yMH1}{@H23s(eXfjhV6IdZevQFG$1S75I6sgU*T5--EkY-BNz?8XD|(ZWv~c-Rd5RY zUIE`D_6{zCUmaWrzb5!P{64`$@cRbO!tWPwd)9RDHvIkpcjX-rjDSBdm;}ET^@VG} zFR|=O6o{J%V?KvKKKqQ1Y4YbH@GS%is3M6j-$kIX9hK$5Tlh@`>JTVOG)@B)CmQf& zU2$R|zmGFr`Grr=hb`8PonX3`oP?OvhI-QSVFv7E1iu%8GETGmARO?mX>mjKrfMQN>4}FD{TwNZY)E9e{mU7ioT!!>OlF)Fa}NTEWp6;i0n|Tl59mVh=JELH!2q{t zPa}{&AAu1J@V(684Ez*<$p{q8g|`_wyDUPWFRNV(inU3eR3a@9(NPPWj?B^mJRI2q z$jRz#Lx4jvxv|T@L=)>}TVx~y9Hx^HK#Md1v_*;%i#A47aiTG~Ng88k6sMK7y~59{ z^Ef)Wm2X~OlzbkwX4%w|O_)3%WiOGk(Wv884xb5u(;h#GW#jSuAa5G7Pi5dV1ZXHc zTh29|$?4r6l9Kc72&xQM)VG%n7J#wHn! z?2F|3K23x(O(~O0In-0^sW8=>n^7k>lQmJjLBdzSw*zCd42;s9i0HWs-rKlrhf^#6 z0GJSduIg+=F=M#PRGs6(pHEd?jBo=^I^p#Na!4M>@QuY)4i+%~cb zPrfYw9d%Vrc#t}d{MgVt^+_=2r%Jg~a@lftJ-HqI1>g?HRr0H^;_$^xWnMN_H-KLX zel1n?RfK7IE`%9^(*L4_>nY)D@K#g8_{t@Kap51Uz6s6`q1f$y8 zu*APrQ1ze-|FyX4$1ePKN!8C0-a`I&Dk}J$+-DdziK+_jvV0c_*dM6)GYDFF4O5A9 zMH0pCB?0>b6;e83e za7HD+{c8&E$+X7(CexkYNmbqDTIS(`Om{v~oaxTTN~$=DIEKRSS7f^X@v5rXXfl42 z7XGNFitpBTG5nL-ss|DN8N*MG%yjwFbyWd$kuHB`T-5-CrAK}~p=!7b|6)?r41{GU z?5WRm`LCx{UEp~3&aAow;U>1t^K+}XnYCOkV1J;L2Jd^G4R0be2xnCu3MdZOS3Tw` zxzSYp6k!>sXQirmvg8pF;>}y>mzkNS;YTs^+{(d#g7CB|ekCd;oMEp=PlF{~hwITV z5GeZ%bG;0&H*+m6=QpDzVfRD@KPnx{MkvK4@rKfl`Ets=T$8PN}Hc=GKbj( zDbw>S;Jux^M^%1FcsEyZpY|UhI{bvGy3Xa>0^Y$;i5uo5=9T^u={^4syjMVn^_6=7 z#o@(Ow1+5tcqy9Og)dK4J%g|`J+_B0twIOdnoy-~LqVec@N3J_rD3|~F$kZ@;DX8) zKq~xH6%RV8z*XQq9_hWhod#bn@_MD`-biIU2ueR<(-Fk=AK}bV(v97z{JXMKZUw0+ z+;wA6>HV2>giPs=;iFVY^-JBK#iauNn$2oTY3QW~8%DG?rPZVd!?ScxzE7EqE>E0Q zdN^WBX)>m)9$tzT^a>I^X_)k81jB1fIrH~w^f8d#wur~p4il5B4FqgZu(IH+elr*^oW(ZV-|+82TozrZ(lM_`gCVs&OGpMzg@hk&`v^@BQqx<17re{1SJy?&YWceavuUR0r@!s(F9}_ z#K_!(@}}YE<{l9}u{e*WK4fP6aRg-gaXkXj1Pl`gIJt&XTr>|^EOPDaG8vUKdL2uR1C zf^_NFa}jud9s2}iNXHJMf~aNw90U%!V>y|NI`#+bSkCIuvC*6^>e$Sj?qAih(rY-5 zF*9GlUfUzRb_ePs$KM_vf5Q?BZ1269vhQ`-U+}ZP;Aa;` zo4rIzKabg8mFzT*C#AnCM?dWc$sl=E2FYTOGDu$KAQ^r>bfN@|;s8(NF{A+tixZ0g z?kQ0V(&;!Ur>nIfkFyzc@eZHTbcd`UokN!A+`rj2{QOo7+fDv6_u!BAx#xcE|8v`- z<6D~lY}h?Ddyi|7@vW(qBWr7F#$|08jfjqWRUFbGg{AR{wNG3tiy4t)*9SbwDPGZ4NmY_)9*f=F^c!J_#pf-s}a$`yMjh4ghRg+ z+prNIUq$6hnQf;F2dpH(n#S_gYg$*Dwd<&EMo;oZnWU_hV^=pftY3W=Y$wctEer04 zYnGd~HiMn{Pu;jGW9s1yl{r>%jI+_ueCCE$Uj$85U}JC^jPOlWbZ*ikw+WDFTY&=^ z`jF3QJG1a1iJ9#Sgv_*_d_I`Vrbj21H{zBkmalAHzKWI)K7dh*|0z=uV&g;2Dy-tI ziza7IHdf?Ho@sF6GQ#|?v77XdY!1)a zBwu6td&Bb%&bbx@rgba1JaI|#`~bH|6)pkD8SAue1(zqVAlQ%R4A;fic>KJlo7S!B z^2CM73xe&b^TTa6QsyuM@hk6TuzwXIvfanvfVn4a6~1%qZ&OwV)ZBR;&C+4F*l@yy@BX6#|%`EMqR zvt<4R(M5$pm)T*rysg2F=iC)`34Up2hsAlpWGLHNL3cytqmf>4W>B;>41>n4)cfvp z{z%3DY$)X{R3a$c8se4gY=pYZPRiE&QElEv$=%R06?v%8?BLx`KziR= z@POGG_CQ)9Z(gh&u1I9%e3dz`mYiQZN3uTIY1ZqJ6>a#|CuZjbE4KzU><>JQke-P* zW~PqNX_;TayAmkzkxy(5?n0^E@`7V$qZSY~JMa7)>Ia9$`{Dts#VjP-< z47K<&w0Op9aql@HSRQNM7jnkFDmtGhyd2osjt?N6<39fXje{iP z0`p`Roo{}hMGrGS^77-+n)zN9-Q7H#MVFiVv*=25R~B7uZp)(kncZ3RKyz~zEe~}f zb^rJ6n;zG1SfnchfjJ~byRSlRbYQqEL&gPJU!F1lgiInr0loxi()QtXu`F3+xVFMM zUR(HmEFG_LWyyTAUMNSGV+Dqd;B~GnS#9f{Sqmc z{YAN(Rqg}1lM;efAPjf7u5RI1=NAbfe-r#j6x|EB;LJZ6exf0Q#3WlZf_NtGJVh`ty82+^d*} z@k4r~;!MR>#d8(Er1+rXuM}ysnfc2x=Srfzxb}y5vf_n`v?Q{qO=2?cWs-d6Q^wzBVNuuL!_W7~4NM4DJ5YKx8pVY?y%0c?{zR z5JB+FLHaPoiHegIk5!zf*rd2Zakb()MZ7@~c^^|eSMdVH%M?GQc&*|t#TylGR{VzI z9g6oVKBV|P#UCp^t@umD=M;ad_?qGyihogjS25&xLVFY`;*GG-m5Tg6is=IthbfL$ zJWP@M{*!MC5y!zoB2FS7Qe2_frs*dJTjpG~0 zr8LAriiap3p~&++(=So{q~d=mep&HWMP7f&|A->5-#nh5Q+$Jn`n|2l{U4ZKu2`cu zP_d4PiS$8=G?h;JFvY2g$0@EP;(W7#2sxV-FVgs3inkDPK9c>k!S}H8@%w+q z|5j0!u%X_D$2YJ@v8Q5x#gU4#APIa^l*WyPkeBFU<#tn)WeJGir1Uw8w0FevKcy%yB0Bn9@%w{fyGjE54@qrsBIqlvh%0<@Z$_qFASRgyIY$_!lTPE1s_D8x=pU zc(JBmrT8_)#})T0{!a0~6$4ybSWX|s5sDLtXy0jy3lvWvVxH2fbQ=-vwNdGFls-@C z%a#75(w|fM^Ge^M^lqi^R(wS9hl^y54}Y$2$73EkbIyeAL_W0`9QBCLf>slUr2=B?MmN3gx>ck{Qwbq z?@@X$5&FKZwBh^;dKVKRpWnJuZ!D@8I!%P$=MteO_mAQHrwivp&?`-ZKA#~%kEe(z zzdPq2D3|+mvAjMhAj&zE2>IL(NBT{+8jbCf8+&soEVA)+u7p@#zLIe71TrrKybXm9 z#E?T)_IrnzoLq@98L?NXnY!dkh~he*tF)B7gT|P=SK$V?OWsB3XwxbTN8RU(aXyEpB z&oOrG%dCTJtQ-cPcu0KSZ1_?`_D#sZ*{YxZQ~4jf&OdI;8P>;GC038+g9F;<}7}n0`m{bgz;~ zzZa24{m4V-F68mLO#N_ai{!CyAR^L_ zd!A80^3XYXEYp{_($f!@#z@{8gvsm1>0S`I`gc`K9{1j1xzrDr)=1uDgdrl*kL^i5 z^3XZ`jzZYiZ?mT#F3pj=TM_p48wYv0^xGYicd4fzr(`UbdR&H|uiqBcPp55>eiwny z*Ken%A0GWh^73(D`TAW5c~2qTIal8Re7?LJATJFjwjZXlk-TS+-`DR%y({ z1fMVOVNX9if{f%HAJcCo=v?|Oj_LQ5rym}DNAeD_@}mCbT59S?9y+Jru$a6zJ^lJC zAM^bJmBoKF{_0g8qQp6QPguUF+?mQZFviC@q2Dg4F`4s5EqE!9_fdmoX$@@yI{c0hP`8i&ODIe*N zS$R>rv_Syl$wTMl@!6iQ-$+lt5z5DW{4$jN;oK$&_?SC6Akw9s8ykO^ zv0TcVj5wDEqv_7q_ne~V*$?_i)TVFq=M@3YG1 z;+r@~JV!pdlMq1HwOI=HY~VZ65kSXxe@xyE@bODl=iE5B8*!f6=2D!9U441K=lbpI zF?n|m#eK9B0zN1D=9s)mm=7&QI@^zWI(ghP-RpK!fkE;FA}9yjiwR!|kaJ!bNm_Bb zZYoxn&Nv&kzS~pmura!&So*#96kBP>Q?#d8Ka}qF6f4GlLbA^j_I=_IHTB%PDieo3 zC`@7BuYqRUiz)2c#QnmEHc$J$`2JzOJPhRy@^Bq5#NI^vQt9@6p~@^M*|wj1hWT=H z?IDIIZ2R5bQSrUQI&MWF`y26+nPZC;wm1$9B+33p(; zaiNwnV*wW@E;I4Vv1d*i(JHGRL0e)2LgJh(530i$HC&cl^k;t%kq%L}2%> zNV$zE!q9LFiM-4v8?tLa0S8AHZ@UNCOv7!rQRKGUD0bUzbhX=UbjxhF(LJ-dgxfcx z#E-H&PL%qaT9o;lTHsSqyJG~N@ca8^^vK>Xqo=2%<>x*f+>)Y_TVX7&bQ@t*xs5P- z<;X$)-q~ANh`l!+uV`U8yffQU+##{Xq=8AC=}kTu5~G5{5lqd17tV7Ymi-_tOa+Z( zE0A-IjJ{#siWyZy+X7D)0VkD7;L}hP7v&(QH4Rz(X8f%y3DIq+?b5)HyauJZwSD;R!kYJ@-Pn$~&*S3~ojc4#-E==t{J2-2$3Jmjt zqvHY}#*)@vg;)ccH#=`mk_&CUVIo1=FLjRVB){a*oIUfNA>;DR_AJ^x*|8k|_&UYX zOi>60Su5g6%S9sM31qcUL?XS$Oj7-L3~-&`C{5;ZREDp^zo#^h9j+7H;nk-EamU8! zxiPvJJT>L^YEG;tT?UU%)gO)tDyLpdryj&<#5iA`T?fT@&d>V9)AQ}+DG7PQkxr!E z#IuOVf1TokMDQcZBr$QIo~XWEUj<~#@x70%uL3=QG-ebdliP?YjO zpQq_pDt<<>od~(#P`p#|VZ|RS{z7rT;;V{(SLE!8a^yW0uu5s}@yvKxw*-`ROQXB=*fFn;yFa{$(#cCNu{qLqP@OAME)-m!T(jIp^oI^^nm%1Bq;3)nq!6W zJns_IM6_G2;!uqrsaQuudE*q>-#8#;d@!HHgXT1Z^5$x~^f&U!dMxnWME#Kd7b4?CbX|XzEQKIw$XHgnfCdJpCB& zPH?rC$C#f-i4k#42eiyvy~@# zB|qptMwHc^B+rq)e%C-AMp z0n+?(xmIZ=5?L-Ud9K{G2)jH8n!g~So&j|(?KIH7yb?4<3*sn`=VK>tGs4W{j=Uo< z=y-m2jzRtwDmuRZg9B=bW70J8{Yt|wX_6aI8sS8L2sE0a&F4GP5kSYs*_aD6c@yNd zFrbe0pyRdCuP@g)xqj=7G*{n0AneO~7V_M83P_65UPIWI*A98^IOn)_@?^~~Gpc(L znd(*NZipja34T0p^3&;qwPi4N++hc8%bY#a2^ z`b&GHckGvErfPe^v}N|-FXi??ux-FS_`|f_gP+e)We%Q*nLR_(J%QUm)`2+1a57}9J($fY)1@`f$?E{ooXi#6;JV?|7(f@hS z$G3Y>0UHVl$cWoKD0v?;N;;9jvT2JU<;gmbF0{drdJh{62P=!V7jns>9S7RO@Y_^u zUu>~9K9Vii!@tcvWBAao3+0^=NkHUphbeb=@aMP zA@HouD*?C&O%kLp&T&lx)qo$kY(i!mecZ|Dn+JKJQ7>E_1k@pVk|cEyfLNImsh(-! zY9iF)m;DyQ>4OAGMIJIOJs=}5c-WDguv>!B72g-fdca@+!E$wIDhgmpIXChjiUeM{ zpb>$5Io|8A@;0eMGcdY6cdm_yzDAPlB@#hjb6%WLEP?&qd5it?87pkj1lBsoyEDY< z_!1itmaB=ebbd7`1l1r|t_~f*9Coa}mn?7GPZO~@Wu+x)A;FH#4tiyha*mn*p<=v# z-WWHV_demRe# zDkRk6r^hw+Xl-yP6});!hf0-jUdh)x-FnS zShIS=noZmJu>K&7#s74P2d!hrqI11`e?K-YvR`0h19#tQLcZFsP_qdIo(YS8>_xq2 z7bEKpy&Ai)3k1seIHBCPAz_m%?0SM8))q$3=uJIt%qyce^&u@=RJkPwz5MkEy`vmp zsg81pEsPp#3!_iRWdnWvWdr^EWdrHVvVs0_TNne}5`ckzJ?uh++DsufVh~%Os~!et zuL~HGv57HsFxq5TwyBHZT0ZJOBEHZdbW0QPNu`>{2)X#;kVu4(qqIIkjP@!Ka$8^Q z^r@pl(#<8f*W-Z$A9uujP2kRLx06(tN`7!I$6{1b4&l51oV>AAf>3BYFO)wIn)wZbz@^*IP*hb!6a zyy7ARdR)$2)NDI*Ew12)-8EKl#a9saO5?ZPr7YZ3aNCt0--DO>7E4J~JdJRM)%5ud zqLcloWTNlOQMjLU&j3dE<3{bt{uGyfgTe9XzY>nHkHpygiDfsU{rj`GkRr3dU$0fg-__Pz8N=cMQ{cAV`o9SXIGNG$sXN+`Su!EYnb-5TR?Yy%S* zWyyM}L~S9%GZTHK1~VCF72PdjZp5R?!aWFngMkpuc@G045O@@UqJ;=>+w>x?N&FQ9 z-$&p@1iJFe&*PpdbLk266T;5eG9??<7x!O}I&O@CQM^4sa2LdJdB{y^#lxSjg zY(orXfJ2vJ(GU#)tzq}XqPB=Cz#i6TB1QJFMoY9uDHsnh`2mjPbzNMq&TRW4CjP|{AVp%t+SNIl$^k$$h`e+aWqG1)7 zM8ikILT;MwbR3Czr=ut7dOlR;W;kDG;Cuw`LLghxvtc1mwz(uphw>0fEW4DoeV+9h z{0O+Ew$J|_*DTYgf^E8(Nr}FFB+OTxeQ`xbG|vWoWm}TP`H1buJ;0O4vDNHRemwKp zqkJi2(-X+>;dDJ=qp4tW>JSiNs?SWu-AArOU+KvE*pc>FyN`^f;&4RtnhfuGjJR-W z?`Ht8Z&JMyS(y>`O{&+p@aI$2XCurZ1N$a&*82;?Hx^g39xyXzVBe&AFpfG(hkcW3 zeh_~ka!R)kiy?+eTJDig@9_ zqpq5xm>-CXeG?jA$xl_hgSZ|6n0j@CcLsjpxZceG*f+^k=4DfTrK`+qsp`)lJdv!h zZ&Fc@K#%G0dU0VXKkyI7_nriReUs{4;1mlmZ$bi!`U{Ky6C@xk@oyDW-{iu7Ev~-J zh2Jiz=3WFLtNl(zuzr0rpxU=Z%U|(7k9_{4xj#XY}3|y8rR2>N<4QTkQTH)l{E?a4p;CC$-hwH{t|_ zpB$O#@~7*nUqZZe`7`6H3m{Lr_U99-X#-rsznD}#5@8t%d+IY?{_APgXE>g{Gpj$0 z@Xsm#`MK5SAS@ST*f*)@24#Bng4Z7HjW^=?MJU~j8pGXg!%Wv)x%y#=;#Y0sAcGyzum zI0E;QwFXm?r$PLb1WbTc{szRaNu(1f_CbVf2U3$#dZywT_%#~l@^gD_c zf;1K1gg@jjU<=c|xY5H2=)iD6Z`!qi36pB>1tJx=3cSBYdQB=%G{BHOhs*W3U_}{Nk=0%v|?J6E@$eBCeSsdl3A78)6F*y`Dk%N(94eEA}Ah z)yUwDW@$)Ih5+ZqQcF|8$O=v%F|hQ(&9Zi=pL~@KFqqo_%7x%n9>jxbJx?w*HgzIM z4&vl%6g!M&DCBzoI=j(ca(+)S!{w4=62t4kkxVA~bD9Q4DqFLlj#~a z=aK2!)dWLl&rQ-II+~>2ihMFj`vn5g>~s_I=tX)J0?}-3 zv0S1}e@+i}AYmMS$+wCIC6;oYFetG&nkC$T6wVZqk3_Q#JIiCF%<_gJfLUHWfYXLE zNiAxLD9-ZEMv9x|QKg7);jKz>Lez&AkdjZZ9TR%u!BQo8U-1f&aphk$h9Tu7HLJQacW(S@}7BwaWLfrIVB(VUk>UDzYRKI9Ay zeHhKpqCR}~U*3l!&`C1j6U%74D>>M9(C1JiIl2ZXczD$%7M{nWX>fwacU_|KLQAnT zZ69-h!{Q)CjItsgfe7j2QPRgw#HcJ0me-1aWQf40CnkBgbo0pHI}wK`+tFm3V%az~6t*cITZt69jBLk>W+Q1W=Q2z4lxHe9KNCj<=~~3c z8C|hfaknDdf-a7{cc61P&62X>ltCx|agBEvm*e>2@vMt;|7IUM*hMM-)NdWKK4SQf z1(QWh&1#>-Xk&oY{9MA+tA%zc-2{@I36Hngs2UekJ3>l(9(8gln|Ya#}XDW+mrRS8H{BqXgSp^PPz_q0sIO7KH1 z8S^XFtZrSqv3crb^B;>S&Ffn?oVf<3ewMFaeui1u+6IF;GIo|sZ=5yb_~wSmjg#lG zN+{?Uok71sAlM`cbS{OIx2){S+|wud`(WAldAjm@jpZP<9q zn&qc%=-AE8E7r6wU+;0aowk;*T!}PyBr&#Q3<_@cHFSBoRg@Q>vCPtGg4=4%&lTBb ziRX$ESbke;>w3R1Tg6393mT`(CRpUbP+qsb(}ZU4uyCe`cs`L_I5yU=UVEys&9~Cp zfDs#1Yw3J=$bWWopDIp`gNzZuGp9!H*U<> z2`f$+Usu;UcKrCd2`k2oIsBBvPg#M$$>UZmUw+u~!|Rr}j$JX#{3E7dpB?r(FYE!cHgoxn>_VEg z8I6x?BeOO$FTgB7!#tRC|HE~J!ip)9p(GZWTM9yD3(Lb~Ui{PF z?J$p$ETkcLzm2ZU8T%Q;b}O8ZmYE$q_X&JroEJQ9W)~bCRs=tT<(fp?-pwr@|Btiz zU(CgSpYS`&Iuw7=Ia?vVF!(FjbKBH;qC=iPf5PUuG|^d}=aHwhut!)4D?MSnL0&^5 zdi8c1=Q(j}P>V03*|Zoc@$QX!;7s`S7y3r(LM3b$4kc6Cj34w<7&+Bvgm#WAMJQ3E$?n0XR*UdM0wvl`n3b|I5v2aTuAo(ts5zDz{NZ}(+umWYAh?)xr?cEz)?ff?v0 zqr4$8TAt5Fae-J4iAeB|%@7C$=x^WA#*ps<^tbNuu&9I+|mG@$d7G~}C;TYbOTLWcA645CQ#5ux+jk7Hd z$Cq?$5At#DO+NN#2R>|KnMQn{czzrpSMZff(n*$AIEox%^m`&e3iYN=K(v z@3@@)ox~5YYZN<_JFt^@Doy9g8-#ZvAXyKo59+a*G|InI5s={@{66{J>B5yaRHS9( z4U5skWAum^jZQ5_RN!uyoZLfre}MNs=vRs$vfqiP6VZ=XD&9gw|LrBBf4X2i5=Sd? zKSa{&6=lx~&|+%`_#=&fiHQCz!+6JOz)U2jv4;n-zcCjp?j{Z}=4XmrN1H_d48S-h zij67Y3exC=ixkCX4e0NaMnAnlMEmzbMTy5Kwkl#>gv9gw!t^^8f33*t7UN}^7jQI= zJJQ(6#^AIi=Plx=mA*&u8O1*;cF(i?hbcBFp02oE@$*FV_xFkDXR*10&Z)@;^hBP~ ziOq_wiZV_R|6!%iR{Xf)d5RY)UZIF(AR>?ZA5iY+6~CnTRmE>9ep`|IDv$u975`iDZ;JfBopSRPxt{@Pu~7vasPr&J8TW`68&yEr>jfx#z2JN* zd%b`@UinWUB7P$g$JcqpQN~=Vc$K2;@q+Z-%J*%>2Na(qLN3>p691|g@b~~-qS!}q zxZ*rT+VUfx9B;riN^es9l;ZalpHqBIkqa}KKj3i%?55a5u@4dF4Y5fDoI)D)oTIo@ z(@$1BU2(l4SHbftQe|F0E)tN6O&UlegqDtvN2 zK)zw5fm|-b{L>T{Y5eJm8x=pMD7LAP?|P+o6LDU zjdad~$^SRSe4a1TToGjBYlz@WE6v5A)`Y~`W6?<@aa#n*@fv0hU7LY}X{Uq(cHU!{jD%>`^cPtVZ! z1&SwX{3@k4Dt#_-5SB+0QU0ej{WD5`QSqCKT%bn2#}uDb{Iw$2C^G#`#lI6#tJR*Nak4 z0VZCer(&hzK*iCDvlaPqB>9h5Y*iH7R*3(&(p<(%zN-{JuPC;y5P!GQk10N_$Q8!S zhsCynJ-b-!qc})$jN(y>vlJIAE>}E5@gs`oD_*JiImIt4-lq5+#UCpETyekR9~A$t zh|O0;-`T{&h4T{GpHY=X4xLr}!$spgSmA+nax8mOwQ$@DiV#O-OVTyH% z{GN>MI!$r0VyogB#f^$v6faf$mg0Si-&Opf;%-a?DgP10pC}e}Mf_kaS|lPpO~mnB ztMq844^{eTrKc!8Pw9n9pQw1M;yT5T5mC-%M9BZN;x5IT6u+T(9})aNQrxTYV#^Bo z|D^GWZkDgNqS&lLzJ*GENO8I1I>n0=uU5Q)i2CnVyjxLhR}H~>S*3qP9A(UNO24M` zAC&&P(g}QBNO@g}qi|kVx{u;8#W9LU5mAoVv;zO}q=6?Zp02o2@mwPKuT;EV<8M*? zw#GlK_$$S?6?>G}{CyP%DITggPw@oBRm7o~=Mzz{PY|KsR;70+{+Hs-#9_wVru27+ z;Qy}DPby;55|Q^i;&3dxRytK``3s0BuLp4iRIA6iPV48?|0WNidXeyZ( zKqbLCBIW_S|0PZ!rtN(+v7R)p)6*1Z5^lE9GXx|$YtB81j_LO>nzlAh1iJqWEPqeF)3tGy>d`rp!eG~c7p0^S~-$_ivMyS${ z5z(%Dm41PUc70oElK_o&l|3AhAFKPNUB?kYPavXQrzy=n!Pu@Vm0m?eyKYnZLLw?F zAD|(>+z+E&Z_xCch-lYamA;dRc70gs$B1a8r<8t{h<4={th|rl^Do{<{Dz2jt4RXU zUWXFVPI4d3_92aS5u43v`UU%chU4V-})hkwW&)keR3h?g^P=TgUfW@gQ2| zQXp#uOneo@`?Gj9mm4zXY#z}r*J6ZRYIRuL;cWqFO{wLme{2CrPHStqs-HtCT?mm& zHK|9Ziz6h5m>xR_zL+wqf7TL?TpBpO4(mNSW6rUp#CA~!8)@F6lboH%qGM}NVv=&E zzTcffSxgS4J2zaHL$A)6rDtM0kY?f}bkLUVHpy;#CcX{nfqEi)@la;KxJu_p&oNMP za7DeDokr_%N963yXu)Jgi6{!W#5Ug;G0rF67%|Z&-WV~|C*Bw_*C*Z>G1@2I7%|-^ z-Wb`C^}Vh5d1KEr&=*xI*LXOf<-OQQ%q24?OYO>0W5>`A;TY?q>DF;qeD?8}0~+ER zTPNAX=TzvRT`8_NxFkhxn+~50~34{cZxya$NnLJeKLpd(+d8{7&8ygnj*XgPx0@b533(B7AwNBQp9GBF)J| zbe4XcZ?Qb`&^dX09_`DkLBxQ3` zr*^uc{v8T=ivr+ahd3=bSulapCJX4f0(7mVw#HyTi(h z^xLcYk%!L7;}#RXyc0eBDwL1);vVw8elMy#%A#}fxOYDOqjFzYKE79=b9`G7@0YvA zE4Nblq+Eo-8jZ`hR34(lIeFVbAt@@CORt!}mu1V83)(MtvsW&r#lpvY598;TTcGj~ zEzXsD7bw46K1XMMOsT~=zS}|hP0bkyAkjMNS zrBiDl0GQj}tr5@5-3GTRr^-dh*s;d69nC zsD9+3L$WwNPxtG4kEh=t<)eO&BER2$?VzVw5#l>}4zsH*7k51o_8`%YipNXT>756%I|$9(t2 z^h+Zlmwwz%z?V14)9-Lk9(SPd_2Ydp%OMY))9ym*Y}Kf&dK9@U;Ibq)+^r(WpsSE#mc?KEB9FN zl8^HH#@d;?$?*7a&dKW?YrlISkNJ6A&ce^hdo`xtQq_+zrX1?WgOiq@O>)ZhUt@sjyt3ItFnGcjBVY%{W-@Li}906z1|!#yjckd7?|> zeA$=x0y?z;iIm5+8BQM8D=-hw#dKfm5B=OE8#L4S`-r0BJ8EQZ`vEtCnf%Uu3VgnE zX|Ey@P2J|w$cLtmoZ~wt)^AUMZ?8)Pw;L}LWBoR6R;IqkD<8+>=$O3Scn5$r(vfqb zN5tf9n{A&Jv;9uM&$XYd2Z(axx$vQQR*FQ*an}zXFY+0{8P0k@I&H0#rp4K?^&`8b zbz|zrN$PvsEq(DDqCjLnU_DBIeZe6w)jTop`H@q0?KeBHpM3qU-{PtA{wj0X{)W3%)Nm2@0WYY#?0LNH+fUv$$PUxk>%C;xZ=KzPqqv`c$!GUdu1UA= zGj;f3zy3stDR(>=tG%%jWPh@p8}>ACkNxi_G+d0jxOm*N^-e-Ya(DZ_u2^CbfF}UW zJQx~)M{EdE&C<>sQ=cAnmdHvi+1j zGQCS|ASBbfep_3&YkyE@+q9wOqWxw|`@UD+efQ;BoX7Y+VHJKiU})9im&Wfz{OERn zJx^>=G&JnkZ|d8hd(oUP{ruDJ77LWVSZSxPG41;rV4K0Wh5Py(*m}VDEQY-U+8?M( zU%S7d<=Xv;x+%}Y_QU?rT=^1hIs|6XzGq8zT~*Mq{dv;{n+YXX?4Vq;<&*n^(kri) zI+pCjm|VCoRk9OZwJ<<63WW!KX49{hbd$cO2Ufh4<1ob-vT-Sm!}AZxWBDN;I#VX9 zUHJMX_r7>B#_Y)Cr=hF01DvT_!@jrPeYbE+$pheR-?zH>!~2j{KGR%;vi6oU??{YA z?s;$P<@$6R`m22((;t`CMf={rZA%GkL$GZdz<+V~Ez-U`-l!ki1A6U6TYh*S?EhAU zXrGyC8+as+akiI~gS@GdEh0aco#6i|*$LA|Js)cTqD_LCW*hovFXLX6@wEG0eyTP($6ixaV_V)#Ff7#KgN`}$X*NO*W+iJ_ND4EWKC1R zV>(%wvEjmV(KsBJ@AgaVOVy!o8`_^srmxs5V-RB?GsbwnX+qh1zh#f1y<%6I$0yzH z^R{K#h)E!?$bi0VKV!}pJxqFM4?BiZr*As6vJ09m~ha`^m#1_iqvD(1%sFjEOv|$7Jy_a;?wn00Phq7wGmuR~v zx{fd&)2PCNlJ@7iq`}vsb!}+h*QMbRxz<@dt<9Hw@Ce=3{+v5+($0&tOP20Cy?Sj! zz4k(<_UCwfO1t3L^zHB@>i>7OaRILR9B&8H&bUU{^P<K`m_2j~P3#fAeYzEnJ%5jeQ3gp$Gu0wDRPo#P6!Mv>wwxC@7XWsiF_+RFn z67v~xyHP)mNy=k=SV#Yw!Q-CSLR*eIE-BlE?YUz?TkBf9DoZ!agIH%pmJ`<%>(-tE zgT-xYoAIUj#&s*!t=W)1W%=qgtt)X(!FzlB(B9$#_&A@*I&wb8#c?YR6ESXB7d;=R z{(Kfa5I=YRLQv%N2lm3xZM4sL@?%~@C`Ne+b3C84a?54}$w22a3`KYXG)kBgXe+hF z23G<&r9tc(z(yOCj9%Vp2vcm*OxzVun~R7R{GbToO_8u9qsS6OigSwW0re_=$bg?1 z{6vs*t0yFH1M~6`FB#Oiyl;~hF5dr%b4hiGX2oDhBDsrqbxSQ_b}_(uA|ASHKFos>-?uz7MDJYgya(?2SMCH$i@4o;7u zAEYiN$i$3EQ`ceaAlfwnHCTmT?zUoT8owO%GSmok}1$ruLVl162hAQ)bfGmR5YayZD#=;lpG7JSZ z4nLSJvk4hlq;&)ktX>^Tq%!vK%c(LIf-;1M@yp!@NYDx`WS^3;6T4GZAF;4zxjM{P zsE1Ot4n1{El$5ilQdR(gT6A6^4jDc8YC2^klO25= zM&g{dl&-C(DbexBXv&26coJ!^%})erRb;3IKja~7!mo4Ptx5|CY5Xv|B#e`wSP`T& zSXU#oNpLY?qXcv6R3k}^1e>>sV0)vH!2DFGaTh~WFULuZt3HPvA7a#NCQu^ z%8%)FWYNT;B(ev!h&Z~a2yehrzP+$;DB^4I4lOT=#S^1^M3@3=cdLt-&k89Bx4hZr zv+%JJi(wkypBDROx4Qafx4K0sVCx>GfPfut6(J_PN)rj%t19bnW|faef#uY@sOV?} zE35&q9@b=6Pir)+(wY3KDhJ~v+~xL)^o8`^o^+7agHf-VjCn2C{VGkA<<(bRJ*8K+ zWi*)oN>H`B{zM-^qWKOGysr{Wru+juR@OA|5#bNi%j45YqElr@=;2_Ve+Te^$ zuvz8S+}V&!l#Ljw5wPuLBZg%nT&CeUDsl`O0|vq}^-7}=NBU;XU==J=#ZkUgvf>MS zNfjetb-u;0G4awOvtwhUW|LfpM(rfzI9eK8T)DL9c(F5vr6Sh;+2LfPA++&vQ)Cm0 zq=WF8tyd&Dk7Pj%O!U>ZcGV^op}~)`ZLg;6j`p(KN)747_Bn8ggAnS$GNj@^BaYittwWJ;JBp_YAq(sWN;Eeie2Q!@(2M&QI@f zEd1(lGW?pb34Wh&75u&-SCjM$`Av8_{5<^rA;13~5IzBaVE7z-SV*(gtPkG=31cg0 zuteAceli>mKM47WcPg9 zzXLx%d=`E|$j#%sgkAV(JRAVODCF17#bFctu1<-nWVi;j3HilxBHRT(8Quv$2%mwU z3jYj04EeorUU(S%{ICgrLAViqm+({Y3&U^2FADi>aB=uI_+7(FEL!Lm^6TI3;e7Zd z;cED$;T7=9On$*L==&~5^~9o#FwwX09>nrZeWJf9e8z)v!6 zd5Iw}79HQin458~NDLdAELsMlD-shUuqjCK;b4CV+44{6N=W6OEYjy7I)5chb56HY=10a1el1ci`$Pc8s zpBrLyAl>Z&PqwoN#eod>R6|S)WVyo)F(WX*(5WSWvdj@t-=P1RWt z817zah$VqMmp@B>iek$Hqg{SC<}ithK#{u(#P84uoXWs7_s1X{wzE}%S?&`iraDmK zJ_BMTV^#;s+=uWV{%VTW1s1zcgHQ_U14~{0Joj40GzFHsm*au7ifIm1x_z*w=!Mf+ z7pQi*;!rW`1GR1jHA0*&r9Ce1ekE$&tj#aKN#n*!_HJ3-WwxHfQw`vW6(U7*c< z2*h_7^X zUto`01ma5)`vVWVs}1p7V4r&#h|}rO-vu%tRTN7l<_q#{{NyHJBarutiDQAC1M#eX}c9U5QRS#7C`6a*Q@`v($=#3RcU?ag z%!>GfKf~<>LOJerf0mmGqJU}M@DFhNfw+Lg5&r}?8-%L5qyAc#zd2X^>;r$JdnE`} z4IlYi+)W^qwvYYm+#8M9pZ!;;{;V?n#NVby2St4D-(-cek;(foFm!hKYy^)X7@Xt( zJ-`XZsv+Boh4ZW+KZO>)2$xHcOL9d|!eTplbm%NtO5Mq0tNnX+_(ojeG{Z05Oanw>lW#9|Vc%(9agfMAPFj+EHR_oKKKj43a(t#AjN z%+FG#ychm6f>RI--i}`d2g@4B6ttlz)XoNzt$y!rhxr`>zZu{0elJfe|>E zLI?&9gt(`~7hnf|ZH2gx1f3Q54F-#^z|64Wt#BBZ^O))vS%mNa&<`Sz@KSx33>D+s3B_T`puC&O%>eW$|0&NMAbt z!jj?lhB$$>0C$s6F_sf{KQn~mxb6uJj17Z_gFDKg_1hG-f zG~LN@xv@kAiQdjocM$^ILBh#!hP&KCf-ZOZI(hE3AUIw+1Dw(BcMNf=GtRxo5T`j4 z-1`l2x>M*r24V+JXP{H${t7L0Tj zyJJE8h6?hXrS3%_J|r>aVp)-h8X8myIT!$o>S}IVu(Vg(Y?bElbjZ} z-4K(Vb?yU(nBrXFJ_tfNzSwDV9|xgEd*AS&nyE_hq(zd|aj@>%5UcBdO+iL=MO1cX|+Epr}r*Md+bt#lr9 zziEgnXRmv$Ayzv3T)u#;#8x}|-P;UN>l|?JF+`nn(7hjo%Cx~b^^CT z%beHT=Rv3?-5TeJ`w|FM()G?e?kgZhuyAe8yY9yzl(uV}_uapP7|oci&POh`omBfP zIX64U-Bb|DwjIu=ZXXaT({|@eHyeaf@PPAG|1l=!2l$F+|6)+*Qr!>n<;?yI47J;F zZ7Uc;JILVOKoFm1_x3|huzKZ?iwG;oIW{;B!PFvL&cf-;_IdiPr^{Y~$P5mC!D`BL ziNQ2Zl`puSjLo>LB;%W21uU29^O?-b3ht!n9$cQK=udoE#NgxPK99>swg*0!xtU`7>rs7UhPi>^a%Qo z0g~(>mriNCsHGPMzZsD9c%cSlrYecYAEblL@q*E4?^t(RybMQ5kFqDITUQ3FJ@{O_ zbP@d*b)pqyi9D963}d-cgN(2#DB6D@s0~#b3X#G}J%n-oA81X^dA{I0a5A_ZOt>7E za;$2Tccl>AilsL>E)3vxY_&P^oi9hjt+o zE|gMB%0dsD@Vwg4K7_ABIaB9v3VnevS0||p_J>ZG@S;N@vua6Qd?aKREvZZ151BPf z>O~)g%#tPb;^S%peTzDmeQJfbA#fDRQZGm$6s8u$$~4-FE(%k}hC|OIUfDPNJRD)(z`DP}x^OHAPG{~x zyxbF8eY;lp_YluQY+7|sLYAF&aVQ-D7AS3*73za9yG`090kw#+kzE=-e4NIzsD4~z zg|omMj3+1Q+jcnRf&@HHY>CqVZPgtz9|@b(D1h$4edqvaq_Qw#|ke)fNxLt zo{~a%t@pX1&A?m1?tPvW;u7UPh9|h88^HfD!{?WTzJoB0?LG03mB#r_8RheYVJyc} z#c#9Ho<~9z#?tS12nT8S`V>M&`emVCKwl=#^kysc0g!G>ZwZ7xL6|;IZw-dNFyS@f zkd1WAKYcB{IS>&Cai*^h4gq)uhUnOm$&ttk79%>P3~7UQZm0;zDZ|dga?^whu-sft zsTw6UCbSf|6%6|vD^za6=R%4%BEee`6TTOh{&*oSV`@roKv~A#Xh+U?8l3^DzKt{E znLy|UAnnfB9}I0ncsu#eheONyTGmSpA8`MGbsO7QOE{Q$se5-au5y;0RQb-AwH>N-DKc%%>MNtdIW-Z0K(tHWibrT zn4VGs2xl~fz6+Mp(PD-E3t?5hH38+(dnt;qG6!E};33QLCikBhN__k#}q1eXhOW|XF!2MA_V zgxH!?ajJB2USc#pG97%Cfg`wt-@|1jsl~mrNoVx8U6wkFO#$0bxnU3^NZ=#WZYGFx zNo3pb;;9Jf640@kyjZ~kF#AaOf_MQ>2^J$JT!BkInnlKxlp%m|8F$B8@D3|PC#ssf zHxO&h{}qh2&hLd|t@!~r)|$Vc5o(6&LJW5qKg0qL4&4jBYNE5(Oa zh)-yhwvPj$H7L!_ZJ}QNZ=#!?u#IV5{|7bNhJcsB#qy-tE3i4P7yNLT;O7>camaL|1+b$DD{TXlf~N$VqVZQEg!^AyGdSP{w<4tV>*coY3-`szi>jZ+i(0`0lwt*E zDy{xxl*9=H|485-i0)*ATIydD6IDw2?LVpLU_OTr;p%w9q*e=GWTnGqeYz!3wRs3cv z)-v(!_3*ur-A38-Q#LEvE7ZLCEVH=E3SDl}wLx|;7By^TzS+T-5FdUMmuHx^Fy*I! zaK`nacA)A3TQOFc@V5h@A0e#9P<(qm*b4)4ALT+%6`YDvT8l9}+sl59u)U1t;uiqe zJ`&YtFJp^1-FI_v(CMI796K9NCGru;Nye_GH?r$M4rOcwXWi`UKyt{pBQHT~_TwO* zhr#x8D$f3#!st|Xl_L3HMm`y|SCSl`13*U6uJfUT+n-jZUtQqdauxzgKhzRMA4K zdiYu;MQav8l%M;avJ(cpHn%XWU|d$XN~}) zM}6jC7AVO7d=0$-9LGt^9H&_PFV~q1!E)croS`^e1fR)%o_=TMQpMqNa_H4eW+i1d zC>Eb#4f_t0&9YgiDsAQ+h|}YUnnsib!5v`go~g`I3ojKjY!_8#rm6I_Ce~i{5HWN= z1qxD>sj*0F=rQuAcIAIferuAJj~ZhQ?Twb{Tq}J3e@Tx8!-kTdnWPM0xiV+Lt5$Fx zt{HU9(D4*FO?)-96qLKz)_yv(8dUmy+C@XJq~Q0pceDrYg%a(MCzR6rarL;tpPjAW$y6zJ1yJmpS(+CdGic@hnrvG&AbX@zZQFcgnx};PD#GG8 zWZ~%!9B_;dNK@>BTa6deY??FbRpW*Xn>LMFkBd^%Tgi{U7^UQ4XWGeQ>?NzRu>;3m zq-kQ{69legAO)$mFfbH>TNs#vz Hg249?u+Dh|*L?`^#=#zFhsSP1)C*u*<37TL z&K~t3SX`;v1vWik<$N+wk8AAEt)QJV^p>lJJ{9y`5H$1!pbvQH63}KyLV9cH5jf9T zB#m16bLi(}-4oL7pZ`P1^~8BpMgwd`6&Y9#z7LZs5Mso zvwjdlgPsJRE!7$pVPz5N(cGui9sx z%IgI4x>)Bm7NRPzi&b6)OF{EK8Sxwk3pRu1zidQ))Q?HC!Ca!-FFy;Q+V3)@FXtb~ zR`=_9e*9_yGY_B?&f7xgWyYMRADgKWR++X`nU;*<&2H4D{ROI(X^q;nK6sTxnbv4? zsaJ3TXl0s~AGL}!O>5SsZ2+xIYtp7|&pC-{-=%3~9@Ao@o-z%^M-BC*Y4>Q;o`Py+ z+C4TGfur6tS+}dK&;Kj3Vk&Fc52^dkRF+dW&FGEWH{`y zmrbUUhioon3$8ax9@3?J$RzujcJK?J`FzEGM9FJgYL%M#RP(X6v*)!(Sz zSeU79@QLaMqjEv>QHK3jn@=-F@vR>IM*%YQMrx!8uXqV~jtQ?kPm*T4F#2WfH7HE_iyH|DuEDLxO@T(3jIdO^><(w3_D|e4OYfl_2v`>`qrxXq{qqUpcoimo{Gk zU)xeSw5c3M@q-IW;|7&@&~H&t6arIQHmnaM*_mpFQX|D-u-Zx-e)rR_#- z?!#Ai@^n+HMrPn#uumv#N`MzhsRTZ;N<@hFZd`(vj{{_wm zhM+$_8y36(`UbXr9 zoPJO`3%PQ+x^`Ek(ons`%tY(^B7>=$j)NrNUyI9%&ciMj3SMU#G$8qJU zK}(@98xq#AtyJ+7twPoJiU9 zDKm@XGMYAN&V^pdsnh37pFgd*D5`K#WXh~LWx7yarq|#_kuIho8OyM+bm|gss`%^{ zMdlPQE{l|u&MlkkkxH~-{vz?Ir=asoy>=PzMW^}YOH1dL#>mp*ImH*wEt@{6tk}z(R5X3gg)zpW(&=S!jHvOmCl{;Anq3r`!#3)n zXBQR3lcVFwFH)Cib~@17T$bd{<#IEu`E0hsGpNWj2YW~ z1PtmvVoX7P*NDj_u(CULw`wMrpysBZ3@*c&mw7{;2(q?-s1N7JWHpQ1XebUZ4QbY^%` zQ-C+QCmjbpHGz5Kz4=De5a^8+b3IDp$|=$RQRaFW?=HC>%OX>zmrR2P=9d&t=}xN4 zu;VHHf1^Rl*sX@Cvlh&s7MZ+Y>eS-WSXWh*IB8B12A-M4kwvAGN*0vF8HM3jBIlxD zaZ!@noMOx?@pHA;vvGcppW={gPMNi`(&8e;>{V1>)uLB2>sqXe+6ZE~bCFu$)RkY_ z&=kSPWn#;l3M`&rA##Pl`tg3Zbh*efqM(Uca^7@tO#~tRI^jYin9sYU)>6 zqAwwyMCDmuUWXRLTZ|}QWlg@(N;N3l%BF@oYkd`)K5VH(%c^c@1%cXauBwPnPFG2? zmIkYFwKA-6HACuCQN{+LStF|>6)o$cT1fKF0=7#rQ5;iBmTXjnafVY~+Y+J4&6d}R zs)Wr|m$jm=R7F**@cOKKNm2B;K~4rg>6j{hWn@j$%Jt}A3YcGgto+)PdUyerK<%1nDH%gXG{%e`-AL%6 zhHVDDzactOsdlIbEsjK{$YvljLu!>(U0z?=TwT68)+CsFl#5z!D#sYAMrqzWqshiu z5smPOFvsrrv0NKfiJGJeSVQPL(iOE|(B{ZhF5tk_RVK=X497kU7=Q|V-3?G(sX&cE z^^ux2Gm{vRtgX_KRgDc5)v-ygxtbFcr>y+3$d1E^jMY?!W<)J( zYw9a8Z?!ZudWO!p#{g6?cC@xvOEX<{Gc&JW5xKmosR7-o3XQR~39~{AMyY1iv&;;| zv1t`51l3Zpno}2Ctx8U0(TOZOky?o;J%Pm+ROObiky0f`z7g`Ns;;HgQgdXavY{U1 zpMIL5CXtHT8d}E*8{=Mciy9!+&W05rku3xw7??CDLoh0~HdVoCrV(%qmtM?LX=^bx zczAl!@G`t@#0-gzs>`m7G&W;MRo9gmE*nLA>>Iu?eb)?l=4YA*Lq>LwdA1acEerH&&m2ky8I6lG$}MwOw{GSF0O;n`Mmq_q() zuhPv}!l=)t^%(NjG+^}ST1QDJZd@rP``U<30F^3Qrs0C95k^i8?$zbZ)tomgLE zYM5$uW^&~a!!<1?CA9QNWfNCN4Xv1Bu_md)&|QgWO=3k;SyQ1rf*4GH<(xiQ_=d*y zO1&h2l~qk#W0Y56;=}A+4_&cIO>t!sM;p@V(a225m}cyueQL&sttLCGyrQDDt`(0l zG1sUy8dfkKp4HOO0s~}mRnyEnbE6kyJnmd$TCrNGsM4jhniavpSO-iRQ%VyNX~eLA z?xv-jE^>WPFhb(VZMQDw#NnyP^M)}jj4Hk4Ot9!j-V zug_G3PKR<>i@6$|U0gP8Zjnf8o-#8+oytU|Q-zdH6^bb-;f<^)sak_!i=~3{;)Nv< z#_16Q4E1bK#@i{A&|G=HfVDGMaTtwoi=sY?z--y7Rjv#~XK=-ix>>|I;Qd4*xFj&SqGAm>^MlFJsxdBa4-ug0Rc3?^Dv{@nOGT|Q?lRvN@BEDK#g zG3}Yi)CF^5ZaA{;!RyAT4R9fWTx@1!6q}kDy;$^C`pbAYf@yST5 z3Ad#jcC?e^-c<1@Ra!h{ZfQ|u)}$r4^;aTwvFD}Qg{*0avVS$GYGbgDiIvBd&}?=4 z#`37uFmJ|`EoMC^j+KW9#&1y{HLcb9)fm^*+Sq~tvZ<;L(+b*(%(7KYTyd>zz(QJX zjH$$oy8_B5saa>dOI3`u7 z{)syQlbpQhsL)u4dgFMc##fB797(YXo@qrz zMW+)`p2qzs{?Ov7OV@Jwfr?ds{pobtT` zIsKil9BxI7`(w*Y&R|fIr~TesRg0%l7<%wDuUTEx>|rVi<7RBt3?kpE$FsmHtcI+* zh&q`$I;h?%J|7DnbYGY(3`ntD0u)qtW4x%_N?@dd-#q7C7UxNP9dp{;`PoB&1T$n{w;xPookXd_t+HFugQuG z->@i34Sw6+#Q6vUz=TQ$s_`$kyg2qiQ5_8BtqP-@0xDQ!T}RDwyVRK0+){}(C^X=OY-6Un0nu5Qm4sx7|Bl4?u@Il`XlezX z)V0>>uvt863J)Q4Kvs{M(2oWr41bvNz#(dq#Ir9%;`KtjHU}QI?s?O)oxvf0$d_X~ z{rs2Da8iR0C;4yv<_4!{lK)TE45!z%_&JmRrf<%0GW^Fu_nhHmCv9~4%))k#&gmN+ zCuxQ=BncES2NA?Uf~RZrZ-TnyB>&eIv<6$9v}>K@xlYeVoaAero->_+*CzS@dKEPL zZ?tD1w4oaePC&%tQ0{NHeT8;#vXdN~==6NTas1&88#irC@;`so2FFhFKWPUiB>8`# zWgoO>IBCImS%4R>n&HdA*kH>2tZh4^LNk;6dy#Vvl0#IRK2zb4B#ozQOq!MCe*`(C zCHW6R(w^zV>=spavk&`#hWr<9a7IsaQs+9O{Nq@hX)~OO#m;%Not~SVq5huuJwTHG zP8KxDe}vij;mdAV?kq^maQecjF3|GdrZfK7e%$E~#t>BrSxK9m(?Oj*!*MBeGlZb{ zGy4Q9B#W@o&=b%rwqN~X_nMk2d@ zNy>*kH^75e&WJ1G(A0wl1lK+5@MGMV< z_VwUC0`3(5Z@@$*{n${hjZ^%xQtYqYa5B~DQ1X4R>Rwdc(yeNLXhWRxH^l0}QL7#7 zE0j{~gg4UjcR?+Tf8Q5h*5i_Dh)Lz|%_8CA^EV*h&#&0vzuvzA_z9EW=@0IX%k>^V zebw8^p9O!!tNxxu^`4d3hIUI#U)7c3^gX1a`Z)bmRFXe`gMTin=$BV~5-0XC#LfuK zanfV$r{`QJd9%}VBYPUk`_(rd$1bs(0&Fh~qrco5V1N1W8#54^L5x#*d%$*jg`nXH z$35C;1;n&S=^g z6;4++`hNxfDM|jv!0$7g{m%c~H#VTv`}cyA(8-=w%4VaBBM}<(bI3hOHN}k%+{rF; zDm14&;hZwvNtx*kDpB31C&wUF`X4~G<9`Lk`~fudPV&EsOmg(dbv7C%+qIMQH}=+? z>uC&3Q{$QcyO8gTb`n74-;OZ+_9qlI=otb&j(I8#{+i`XRG!)b=`)l3|A4LRx^~i> zB>x6@>gxngwK=vkhMxKwLohtG$w~0k-@%6oTfooMp8D)^H5_dPC&5!UDrK9K{2yy& z+Z_%Kbi4SepY~JV?)~&S6g&R=of-buksf|}09l--{WL7HnPH0a` z^8b;hVf1eY*~@NIMdbTPA#b?-J{*g!GR@`-X0l{1vS^n0|_shdk2R z(tZs+CLzDV1bwR$=y#Y<4(h8-um@vt^kDqA64DQh#%g;!;>y1F666a#0@TO-?#)5^ z4+-ThPl&%NfqqcxgF2XgOG5hJB;?N@ewu^wcPGUEHNl@F67*rVi5^V9Jt6-y67+5L z3?Y=iA|d`nLVZ4vApd}jSIm^@FHea7EWw^J3HJXhL4H9({`_sRIjG-L9F^Z1(N~1H zbl)Uvli17WTj{=HYdMgIjz8aW6WSkt9M7W+XF5KZ{v**>sOTQn2T~t=CYJ6SVqGHk z@cCc5ZIY#zSaYh z-%>@NVtp*_iO=BDebcR9#@RE-nkVtv{$AF33I2RU;*nhW>zz1%jj{M!Rv!Ctru)vd zeyu3uuYBuIqOVrPk5FG;8?YAp!hjxt;d6`NHsT7)YA4RrzsMUBz~yr>pAu)`H`-a>2PW`Gh+n3`--sH}2>%k{mujHjEEkM_ za>XvRA9WZ${wtyU+#vdpel!HS_!pgI0Qrz(e;I&$Rer!q(#`r4S_3ZAdngTP!f$Rx z&rV6VTWA2bnpIcpEc~X|MUd@U9fn^ZcA;}+BZBsHYu6}=hn$LsJtdR}Ruf^@IwF=A z%ASRK(-Z33Lq5_yMg*-6lRuQvF1F)1K9)&gFb1qj;Ex55eB`U_K)wiC18T({=vRIM ztqzmVIg)O%_UEY=YWd}x^||^WrB}6Fwrr;e!^oxChZwP)anC8>*?EjRzP;iCdm4demJ|y@8aR@%EDA?bx z>4k!q5z)Wy6FeZu54w|oItoY}PaKLdMDRMnp9=m~kYC2Zbb&AWXq+s#T96;WVf?d1 z^v6F5CMAJJe;g?|gE$<|e+9Xxs1N;+UzQ-gB=~0{`di-~8Vdv$3tlDoT_XD5(}JCX znL*9ZC+1=AH^C+%`pcby&j`LJ=&JA&&;2T8rA3LOR01=J1 zSa7xA&4RlH`8^lP@#`%(vI%!}gaUwr>uIV#~6QECM6xqUbu6~_P`3r?VTX4Q0 z??4!jsZn8-;A%nDuMp3ni*i>AZWO#u@J7Myf_DnuEBJumj|3kQ{JG%Mg3k&5M(}rn zuL`~?*dh3V;9mqk6a1$j|G7uIdkCfo_7?0Xc)DP&;Ap||f`x)p1!oCfELbkMO0Z6_ zS#Z6e8h2pNW}$Boyjiea@P5JFf|#F3Q;) zmw^1H7?E3a5qk^v6FgmTu;AH(`GV&No-fFay{Kop;9S9oV3i>6!zg!|;95a7o`Szo z=<5V;6x=R&r{KMU4+#E9P>sXT^K+q}7JN>S_eISAHNj(o9}E6nkY9A8T$87CAdg1BFOKlQBSMj2EiKz?-KmJ;G=@S5abuvnEp+{4+Xyv3~>CXor0$co-H^| zuvoBEFd|qhxL)uY!CM5|1%D*?xZp1Z4-4`;ZM5Uhg8vlcr`pKp{XFpuL40*k(Gvux z3oaC_5aegvnC?o!>jiHU+$qRUx>1f>UJ-vI_?lp+;3tA71jC%qAkQzp5r+tl5-b#) zEqIaOD!~@Ps|9ZqyhHGNf{zKF5FEz&5c$m!Tqqb3u669`AjiHU+$s1I!KVa&BghZPFu(T& z|04K>pr7jl#P<@+7Cc+9KybX^RKZfgO9c5`oO-??xKZ#%L4Jmg@%#cEkB27|4VR>;FE&C7JOBZAID<)zY2aWn4GHl zS%QNF3j`+$&JtWAxKglLuubq=f_Df$Ao#H0GlDM&z9IO5;1`1Yyba_~JB;7YnWsyi{s91s@T7 zM)0?Sp9ua-Fwk4)9~Q)Sl9fFji%!_>$o3g6|4`BKWl+KPEyu zP7$0cI7jdz!CJu;3UYgX$~`Z5Oz?fdzY2aW$ZhK>zf7=FuvT!L;3mPF1n&~uCHS!5KEZ>6{PY3! zzaw~D@GHS!KOH|v@GQXs!3zXu2v!N!3bqKg32qgKkWzY=^!utV^;;J*Yz zco0DQ4-5W9@E?Ljr|9^(f(r#N5o{1#BY2hI^@4W_a@%U=^8>+01%D~{s^D9K?+Sh* z__g3bJV@m8yR(VVHfO9f)5HlC&=B& zDc33ZnP3q6E7EWM1kV<{K(It`gl?c4+I|-{Dt6) zf=7shE$dyOKOw^2&xQ64)N~RNcBBiPDfAHH1hiM-PZXRcI8X2*!3x34h{*RUp|=Qq zv(Vd#$nSpPKPvdV;46af3jU1<`J^*6o+da^aGu~=;t3`U>Ju z*iVF>?@0WuLfDNh4xml( z`F$!8_GS{1zQ52z1;+|bmiVbc&nFJYyef2!#McS^4Z&-Le}mAs6G!0x7efD7;(sdi zQ$jy0^b112B=jGNxt8^T(4R^C--UM2W?7D&M3k$K(EWrSEc7s;#|V9{(8YqY1(y(! z-%6pcC62^bsf50pi2Uvq`bR?lMCd1len#lu3cgH4yMA5b-xB^`h|vETF%SO-5`GV~ zapsduM7jD3eTvX$6Cs~3^h9Dlo~H`EfQa-GmN<0VuM-}=8BJ|%V z^qoTQ5c-EgKPdDQLO(6^Z-jnP=r@G^qtJgLBEKYzb;SNelq;V&4j-u&dI}MCTqyJ+ ziC-pk3-Mgc!$My}g#7hF-zxMSLf_Jp z8#LN^Krl!|dkYJ?#Bq2|D40b={SOe#qMi%%`wsMbq0mLd9IR`FUQUGH+l1akgx_x$ z`Ys~;zDH=~FZf;g1NxOe;P;~v{|*s;SLH*zDj)o=$^%-J2Yy%fgI4y#@7c5)bPf@I zpCEK05q@7R^im@H-6HflBK&^4(038x_lJdkj0nFU68bO^e*aSFuZZw_&<8~Re9wx0 z&lWm|2)`E!&G)S6cfRLF`K3hoeY_tCKjS;1`n?V!{JO#c!kc*S z5>cKHh$u&02nhSt`vtHY+tJijG{*nXzrwq{f%%bU+_nI@*ux=rQt9m6s&zG$>vFkG zP_FrHJAWFl;=AW2q*A}{)4!*WB}!x_q%ps>kIyNNTUoWDbycK%#R}{v72R!sKb_>R zc9t?&8=0W`-~G-$X5W7+m7ukoU+Bk_brWfPPCsxjfRpS(!HpH7n_A>z^UFH?sb5ZkdLmV4JYV}go_?lq!P=+dgaN4m>L3K-q=B$i8JjLE~)%Kw8c zZ7R%8a_~NPmiTvuc{bJPYMVE5MRRj*;+GSQ&E~hu*e?|uD`JNl&jyj~OL2{;ORRTS zmk9Sqs=zL))!2Q7+q~pr_n4~O3+F5tp(5fEs~uCgf6u=upxMu)OW{m}*H)#Fd;hHL zy8n#k{F|IuP`w>Wm%O}D4cy%$H+NR^+M1S%>f9FYkDM!wAtq<6inchtH;vM)n;d?k zU*+w7E3w5@Y~MC2jN57E-xwb4LRy`gj>I5ORJR7l;*G&(e2d#UCt3={?amZ4DaHii zX2lr0`vD{t@3lV0O-N;WcuYVgi({Jt(GyC}Ffi!G(G-wDH;y0e6meW59ow17+vHcZ zmN&(AzEWElaBrUOJSH`y_U=*f-jc_-2_=uFQrr6c8@+6b*hj8AiIZ%a6Eor@0>*(+ z$Ea<-y34_|2DSZ9OmA0qLg`EeCZy}iPDm$SQF|iAvh#9{?c_zbPQsEfx=)(kE=?tt z{^{90E!ru}CV-7~xfK>CM|6MS`Z{7xc`m+6fUCL`j8hDC9fx|*;|7xC=Ym(6TX2qw zS66i@7#o$sE<*WZRkXUQOTieX%Ez@lS6%Qm4d#ezWv;puj8YP~mglNVL4lG`SAEG> zjC`5db3sC7G+Sj{J~lyDn+ru+>$!7oq@od-^u$}nyT)Pd!F+<{vSb=-(+q8#s2%wgni00XxJ(PQ^F_5JH*;Lsk* z;kLqR#0he@ZMeS!kNR-i6V>+s?peI{@x!Wxh&PAP_g|3n z>f6?)f0sdhh>GgFR_lw}cUbJB3=gAkV}icDZ87_pk16j5aIn|DBhbhDRC5@8osjd| zcd$+WPJ{Nb`i#E)T3^(@kKj1^&s4F|w=Y58SI}qtm*UYk6A8TbeF}YLh&PAPcOe2^ z`@&c2d}&`VoRp&-XKH;>`=)^=pE5is$72uzUVRzRXY5NuJmr{f73}faSAvM{?5lvB zS6`0DzTO^vQ?D+Ubo-IsYu_}`VJect=-UUr*S=bhefall z)V_PQzNmd=pqUS4co=J^OujECGp+)uWN7%**HR_`WAxWwQm#jF+J_WzjmVb;omcH^?O+CqYMwD506{p^lkOnH&NuMzY*!Z_8mEi zeSG)cYu{bamxc7SZ<0sfT&*waziec}d?>@i*f%pl-@_jJridKVU8U&q zau|IlPzXdtkI^3cW`j#P>U#xp_>0=d-yD!n86HO8O9}cWcx267=o#*tbaJm~IH{foRl!InXx& zv^k8vGa%~N8iOFNBh2s^t2EE9#Tg& zXmjsD24xt}n>2>~4CCN$KulhwO?Utjd-YLn7zN~D9MA7bzUjhm2hI7z9MnhpLd+MG zM>kQ&9>`6TFu~+|mgqB4UxMcE6wE;#JcfYp^~+)S<$Wk;J6M5}`dH3aaGEp-S}$TS zz0?%m6W13BymIHF^Zttq963x}Z^(J`-FprGUy4OG^R2>Z@;wE4m^4%|7KI(^VVGcF z$a(eE-UneR$10D$VWQ96!(1{Q|MxSCXUI_>&tKs}G;%#_EQ@oVIgH#ov;&6C5rLfd zFmXMQFa8=$9OXDSn#0KPH)kfyxVs?Nh;o>Ne&KN|sB?3eysk;mcjS9|-vR1tz-jbdjIeBPSpc5?m=3S+b}Xa zJ39}jIdoWG$BrJY*!Z01I32${^v&W~Q}xciP=v$A$Z6~({XT5P;fz)=6!VvDsl|3B}Jj14~{iG!A@x=$6HT|RAbv|AUPq~nT)lZq?Nd;w+7Dc(HHz4f&V+Zi~moyH~yb~30$?U zlWa!(zxx(Ao2=(CuKH3={3mMU%ZvYi*^8a)U30LBc=yu&8g#&V3)laz_tG}IFaK}% zqxK9n93?zkJFC7Sn;&Ozchim7#}eCoe(F=(c^cP5@x^F}zWM738|q?*>Qqtkzu#Yv z!%6J;@AunFvp$T8tGWKk1e)F094-Ps7J_xl{iB#8*Jn9IvuKe?;w+fYVbh2CiqBbm zAh^~bW)hLOztGGF>hyjTzeOE6s1QSD{5>d zZR&%HyyZRMsSma#Q{GC1jcx?3O6c=>7$&$JabA6|K_C4^|E1wH`rby^Tf}Na90HGe zjGtYE(Xq_(Q7sMsyEWw4(FL-I{O{M0IUgef&l++Gaz8$E#0Oc2X1{&-rX8I&){_3V z_G7-~?Zjr{C0!ubnQr#C-VV63=EQn4Y<;T}V_t~sPsZPry`$4= zY(GX_metvyI+xd{UEZTZ^C)Tvk+iqta`j+qb4NnGX(|#1X zjU~tN^d_h6_@ogZ*jD?oqwbDQKkR0CZTH5bY8{RIFr9>0W?y!Dhgo0SjR+$S)f<9- zRn{KB<5xfVK6G^u4d1pJJ3c#cB4o9(jCw7O@^%>ge?D=de>MGtbSyu8Wa8)_=1;zj zG=V%I@@72B#{B!kza3WF=FULl=FT@xocPcO`VT2&ZJLD1i68V#_eW=S8Q2v8XsU!H#c0F|zbg#h>f6d!T)?)hq@uci)-u7AZ=!2`R zyhHHG{EiXUeBMHbY^x33sr1;F@S~6UARciYM?tgx-#T&PEG;wd82l5mvk$!!vPwJt zL3wu)@|brF^Ti!j_V1v#v;*OgE&RWqIB|WF3!M`88>FGXgW2FUKGVrKU00hr_w@pA z`E{KEYg6Yh;paRX{T=5=+RbQd=uP%bsOOT73aj0J+KG`i(xRSN2YcFh{}x0X#;NOl zh0GJ}#nx>yn0F(}c;ivuz+2w)9p88~2WfWWgsggYG!0mWvkm7~oVVjVi1y5OJRE)G zfP{x3yidYIJmEp?N7iK>87MoRymg$4y4{6(V|#T_M$>*s^WL#VbYOh{(1fv;`mk2` z7&|{~vDl_>JW6@(qnlLwDT7`sPxpoHbdM7qDsT9JX{qB&l<5G@Mx6U`?v-%0gzo|t z;T$b|fV#hhpO2|9d~BhQd1<#$-!tc-UVd&L>U1r)!)<#qxZK{R>IvyW%zvkS7-Nas zfnmRYWkOuF(5UK=Td2zVA#}X2^W4>D_ij6S#lEZGzRSHCI_F{B&~?9i;LV*6r-7Gu zSLfAf8;?G0{qESKdA~abJ*exA#~!twLD=o^!T%Ujdc*ECj1|%LVxhh4O1r6Z_dvF( zc^#NfLc0fEt!T_4A1;1|{L+qhjveB^)cU86+IsY^yj#GVf6UtQWR{|{H!7K3X&d^m zf9^_a>)eeK@!I~jO>M_79PvT>yqh|GZLniG+GQb5Ye5Ir%%R0MZ|i*L-ou`8f#c$} zYW!y3U_a4yug6LY={X*TVGrI)?_7=co`djV_^{Aw>o{z0f;~q&j$fZ2WRVw_?A#&;Oc`#*xZUp$by z=5@T2f4CEM9P$s^aP%&BgW~P7uSR!79m0pZaVE9V23;0^Gvpd?gI^Y@aq>8Hh5Xkc z?H=&v9ealJ6WeBCTPM?C?CIDw>FPea20~ZbrcU}px91;6$1u~5VPmvSn*L+JW!}a)u zd0WppHrf^QWm~h{qaCKb(f{O6Ljlni)%aohF4qQJ4?Wg~F>5)-!4kCJLin|fbK>ot z8JH6}x3P@3E1Pz_XX*^~A3ENMwkh#e`E5wEuw$uxYoFWgoB9MSHx2fqNkWgzgKC{} zwO*&x+Is$O%fGcVjQQ9t!FtF-pU(bP=M>aW0BbO|%P`hRCeJ^i9+_Vz+gA2bwN7{! z^|K2F+QvfR*t6SFa}E2ksVB?}x}H$J!x-xdG45a-inc+n$C!ul^BAUfmrQy4(7dZL7Fhj1Exft&@W9_ermW+S*}k_A4}3n`&$A9Zbi3iK+kNG&@HTOW?T>^9({j-g0% zm(4K!dRx@5wx?Y5EAuw(0sk8e1uHfm-9K=9=N|BVdF>rL-A9#OTzBIC(T}V3rF95- zmUK+QZP;t@@o~&uui5*dM~__wSw5EKG57&{dA*&KT+#t~$FRZQ6OFW+&V+of${xZ=st?IDeAJrtm|ihXXV|d z>goXEDzam7wzZ~XGRklIEz0`gKKOxcp(pHM-KrAo5 zFSaQEKsWBY`iD`*x8Q%~&3h2^9rSVCr!tIfC0Nrz-Vb@!p;OY{LEC*LmOo%Uhkjqu z!L_}2PPQS#F+k~*@LTitcPbirnf8jcbAQflKCBO*Uya`;j^$*(q#wO~n(Y$$dq?$) z?f!0bU>=Oq5y)=u_!xD;`*EJH*_O2rCvUF51aer+t(m5XPqDgbgz@1c-$Xir8z08|j2~L?iXHM~yvP9WQQ>GM`bm1=M zmsw}cojY?ui6_DQCG)3Dnl)>DcJbV)-LVHZcjbCH_*^z$b=O5)FlXkRxr^plgPX@^ zuPv`{$>wX~A&V~I!@`R4M*h-6KEWLoQokw*sYLkJ`)YioI~&rHtf~pWA(M|7;@2Ea zYicU0sLX1ur>^XlhV06!^4e_tlB7BtmSp2+2=(|DY)wNwZWm!0e)yNIKSnz~dvIm; zQ2Y$5z5$_OI!7HvH8u56-vU5*Wo5G%1k)?<3y)P*k;aDF+Le`}3(Xq)Bj6zNz<7)& zDJ6t=a0aZu*(Ey=P={C01;@7L5yq)t8G(WL7>?$TusTc@vHY(LcU#v%h@(~s15~g?rN_mnAg!fJ z39LRl_N=t4)O<>@%1|Y^s>4Vzst_j}ZtY-B9~pvyXDwQis=sEO5|82s%MoECGwE4wGOgC^FHqbp)>7xCuHgNNmB0T8nAx(nIs2Qi~|X zheWo;*Mrny^itPSoTBS?9V8r7!IDFOFLe-Cb(plirkS^cq2)LsL#W27BN(d1i3mbV zG=iaZI)c!KQ>S3)E}Td~*o{+1FtkTU5FU$0Ftk@k5cWqS7&@RM2rRKy#n4fl$b%4+ zMm=u_L)>`*5rph$1fK>GP-czIZ=Z- z-u!Q2K}^m3n3^u52i33*ppz1UiagmQ##jgvvQ&^&sSa=9!r(wE13)SIt@}Aq=c_*3 zL%X$u5m1NGNNw3T;aA1S#YC~(MJlS4Kpovk<$yg+MJ>fu9Yz5Onkm+9QNgmUfFRbC zCvm!~q|{8Vb6mI%9G$ky2!I&%>>ZWOf>h$Pt;Mkfi<#MR&HWOPp(=av1i*3~+zQyM zgZly6u*DEnhbak5K_93|Am)q`TBtKsRx&pw!hqJgkU-6_E0#f*f@C8B&Bh?hwAzd= z<1JhMaHWeGtHW5xA}v-?Wh~NTI>;Qkj_=0TH-X)*qDo^@U1o0P5x^@U4oNJ7aO&FMiqPID#n677 z5F;FnMj)ULQEfMMag+Fn)j!K4=H*(!mU9&r&&*5QeJY zJm%Y`gUt7!3YNe`br|38hKfB(&BBKPR0Rjne5UWFD|m89)Wxz-P^lIa0ZMd`W#6fT z^x|ten3$Hdr*?Bdda5+xeai*-$Axb+-jd`CmVDLHmxU2L_S$41VDoj#D*1*2D zapW0elwE^*Lt+9%bNYa0n!&lqg~jJPuh~dB1YaCi4BC9=Nnec}8vknSu=rPF@%p;9 zBn_?q>{IRh-V6FJPF|9{2pJ4#%6urt_bq){4CG$7!G;KBM_#|d2KVO4Xcl>3Tbi9u ziCZRTQKZ0Y@q~VSPj{5qoJ^ZXOT2oESI3X>6oVO#9Syzs@PW=?`{aJqI}TY|=jP%z z-}^2w{K6c@do;xS#TYbGpMFQ!VeS*U5v17pF{`vq7qA!5@k})_>OMsllB9)`VyW0+ zSU-~`ohs{;m@jl}kvQIAiHhlX76-0(==!PAno#70+V4{SX)#^e!s)OgD`w*iquR3Y zCDH*Yv~L!xFeYMUoXf$MM*#VAsc5Fl?~=s9*~r(4%Q-mh=NybF7y$4dgyjT$sQ|@) zUh@OjB61g)0pCQ&xqvDiH3K*m2>&12z5~9hB7OUmJNMosmvci%AcO=1gbpDD1QZZL z5=bKnNhoUY5|RLski;}Vk&dv6ifu&~%ZeiQ0yacNMa5p$ww4tY%eq!{)m_{7yfg3I zM%?}Xf8Y1z2lLD`ecpNJotbmaJ;xHwaBZ=g5(xU5lMsJ`>o)As0FO&%r>`)%tT;>D z1CJq|glmd7;97=^r?;KCtnQZhR>sFjiz;I_$QU8S3Gf(#UV~-|`iQ9|PKRr&{7=E_ zvV1~Z0*@iChHHwu;BxtwLGCX5Qd_(({4R?k|i;-}%#Z0(kL=)VxVhh~k#h>Ah6A!{2FJ6W_L3{%D1QCl1 znJ0>=a3_i?xRV5ZTyC;B2kuGYD!5YweLj4uppVPth@)_)3Hm^HuE>C!C+Oqr`Jxu? zbg=>Mryj$-83XEaO%*qT8)83PQ#=dT5{Kd1;v2XwVfhfL6PJrbP($>GYl;zYEl~p3 z7Bz5Pq6MxH=fHJ~E8uzreKo}^4#15Oe}x+>K7$)4eu3)~30T;=3Hl<6BgVq@3;GI5 zyf_(dchLklL9Bz@LtF+oQQQnSNzj)~dW!ep_7Y#hO%^6@iu4wVbZbNmf!jxnhnp&j z;HHVw;Pw^tos#3kM!4zXa=87(opAe$C*ckdZ@|q^D*rQ{26WkuTYQEvLpWGzO_2@P z60_mjVg+26I3KPM^feNB!*Ekndlx2Ad*AYi zKDfQJK3$XnTw)d6E$L!6AYL4Rn=amiJ5>l6wza0nB(Ov&L564`@QQT=S>k4bbnzm= zRPhY~a&${1w8Q|3E>R%SD;g!ni|rEA#lsS(io+6-@h9c6L{GGI?b@|2F;RKEhDR!) zy|kz3M35oQhii)K;97z{bYY7Z;kv{TxI)mUEZiccCkdNASK$@(k%}164mVb8hZ`pz zf$I}*!|f)%g6jw`Hf4U13^!g3h1*?}z)cX#;r0+0!%Y->;3kRZ;Pw=s!|f%yVZBT? zT;tKIQg~g~-@V>G@T~EUhP&E`p_acxG4>at9%zbXa4peEVPYLzuQ(TOytou@y0``| zCL3IcJVf9UPZM~>D}XpPraN)8aoMN)#Xk^ch+pBFVh|QuOO(U4MJHUBxCX8e z55aYdH{g0i9PS%>#b~%Oq6BWNXn-3hE`sY5_rvWb-hk_ff57z%KYrB~FUG^|F6fI5 z31S1>9^x*ziGsehkR-flOiw}IQ|Kj1;3kX3aC?jOaA8Q~YO?G&w8t823Hsat)*-m2 z_yDdYeuZlbKc4k*iR0i3F$S(%6vFk0d2qd=6>f~!1UFXv32vOY0j^KbM+>@%$Ka-m zSK;;(U%~A!V(}}00b(fJ43P(SpjZHRkT?tOU~w_rA>wYhL&Y0#hlzi~9WMH#kt0MQ z+>u6X91Y;v@QX~}yB;)gBm7>|_jmZaT``VsQd&RS&L0qZ5cbsimu)zEH2Jsfb)MJc zCp+GG4diu7_OqSre3@<-hl%`Rr#e4tV!28j(GM^1gz2+fu2s%WgYc#aNZ1mt1J1fJ zh9N(tkm&l_*$T1`<7xGBedk=RNwVul=U$M{2O_4o>u3M-Am0;7aT%uH9*e^i8gKQ( zF~gq$HUbq`{as$ue_tlY4RHBPe<|YPsTCQnc++1Eb~dDH4Rj@%{&ujFDc>MhvgyAB zOn!J{yerl8?*gLwxL+quFfNLDN41Otx%}>yYWs z(QK~kIn#fdX7gMxneoj!UjR}%?o~5B2BMLbEI>eC1e~c;)F2=Y0q5y}g$PJRz?C|n z76E+_aGMUOLjdm1`ybW;^{zKf|0`h4B-2LMJEs3{V6v^tT!&5nw_u-R5wn_IM@+vL zdM8toa3Q?oN%pQ4YNwYokt{kfX8xjr}jv%v-=p_F#lm!^NIW*x4tP5;GUt7){C zyYP+9xEGf8O%C=2O7 zreqmt$8b#sB_%tfK>kHBLz2>+QV>Bc9F~+}B+-C;fKu!OR?<-TSn#kud{opYviio0VZOfrmlf=z%=L?L?tl9QSPC%16_7ubS2s+cdAA05W9G60hMD6jUaes=CoWJPV|(U{xiUiKo_i&Jo8NdN-$}{r+BJO z|4c2lsh$OPYAJFO@A5KPDf0Je%9@zW6V4E>YR;TBH=|8C1a?e52|FUK)JcmsG z+hDTHGd<6l{(tDWRUX*;?=@SE>uO~0eOX-W8U&ENPt^fy5kU4nQwOX=0NMLo9k3n& zWbaFKzy<`s-p4oUfQ<;~jezrXz$TB&>V<$EI^Z0n=!t+^b--o>Bq88I9k2xfi3oUh zFt_v%2~ly0X_r_)d3eFAPxZ&b-=|4h(*B3I^Yrn#2}zW2V9B(F9Ocd0hb}bgMh1a zz%>YPBVeZvxE28d0k`OYKO?|}fCqKJbqKH#@Tv~jjQ|S)4~*o#+=9y^sc)L`|IjJ! zLW({J_yqxPlQQ0efD{BcnA$SnUIg@h)ASEOfLux+@VsUEhk;3x@~{U>_XIGxlpgTB zYx;}9$oN~2dj19_#Ke{CG0%J0$mqDoJ%>&I0?iJ3-Z%Yinmyt9!1U8rU*>z#^P%Zq zr{kXT95MZyG&|(^$n@{f>}d}+2fM&zTb}WJg2|%eUh;fu`XANoFCP4Ust*~ha?={* zapS+yeB*`-OHNOx`rq4m$I z#|i!(kngFqB_hkoMq6H_W;TdV{e>VGP|=NI2#h7z?ZlRe5vIQZOcvfGvP}P3nl+0F zrvH4+TEtY-e~o5mhyv5_z0(6-_M^_Van@Is+^)zje{C7g4D??%{~OEY6ob4;BYxEK zI^`gbC4ziw`JB^1ULf+L74P2(qRtG~rk1K|9xQCRN<$_cCqc>2bN3B zZI{IP4{7GHOXK`jI@?CCT^{Fu0ddk&#@JPH{&&En#f!D)#rZ!2lb@CBW>?4gz37Nk zjClLZIRAx+ldQXaRvZpU}Bj`Ns9+Ihf zAEEQXl0LTFaw{c^{RF?Ej-&Z<4l=rz+sgqSt0%>A+0vg%yA<3=iKDgl03|)GCuzM* z)7S9P9P`zom~PEzetM#nE}W_Gy+pP56NbM4h^MP%FJjf8Y)%l%fNa2`Z%+8kO%mgGiH5ifdF~ zgveda4X8odmQ?8sLdykdcswUDc=7ZSIimy2EWa*yqYpS!@h0_1ig z54cO5n?Yp59(4cJc~F!6?zfzSnmpuw+j&-#hu!ZuFKY6L`(5W;dbUz7D5bibcA5JYzFN!&8@A5I&t`BUJ|;k1dG9|G@oIIT$Yr@?)P)2cOp z20ZR?T7%}#g2x_C>(u-?@R-ACn>BwP+lvHn5nE!n2|1oUca`XASbn>l)|auye5{o9(s!;6<6sY}lFLp8k(E zmXzLuc~5`2Jr-A3z&h#dvfai4GkFNF6Ia-iO#eK@$tx^Z+E{ML>PYq{JJ0mbKuS69 zud)kFe+8J_?_Xn=nEofgT5zq(y4Ef?{cnKDD>Hw#tFXb)>^gfM_U&NuWU$k&HvRts zJCpL=U@tKJFO6Wf%dRv1?}2TB#kFp-mze%9!FodK)~$9UHXq0*PX@Q!EvA1gwokHU zciK2#Ox2sIyX+NVS7z?9SApr2_u6Z*z0vGGd!y-JqS^iS7SrFV*#q`g)4y7?efBof zzfH3T?Mrcj(QLoH-SpE|PPXMSdj~c&nmuk`YsS9~CTGDx8(MI^8UKwAcnSf15fHqn za|i)x*JJ1~^l}zGW8Yx-55mWKNjsK{QZ2otY!ABa4( zo{CfN%OR5J(6{&E1uVXgE`W!l0%9u^D@lGLP zNVV)Ov5C%VO}54+I~QnjL2RnC9fU@~z9=@`xn7e?Vl$k(K{iv&WwArj_G_{|76URO zO`lxsE5Q4XNP9=eUkRQz!ubZAM#J6_JJK=HDM_x1&2;E1f3lI+#AZ2zKuP^aQjQK@9ULJyo|j)@Sr2eV3zc8NS!4 z%(tn``%qV^{dadL=Vw@1su4OB^UD6h?Q+fnp;f~E#_e@3(&T%$&$$+4GYR82cf6zL zlhA$WGQzKpqpW&;78+RI<70BbA z-unzdm3Mzg8jl#EaeUO3GE7V6pf@y*Px?aRcql$45o19Mf%loj(6~RBoRW<29yAs& zq^6X@KZX1+XQZ49e<%6>G9onAuVtmYif}pBZ;Va(7JfOVf1Qx>llH$gDWwy2AQ~NJ)rR;`Zs?9d9VP6R%T)sz;UG|!$;?l}lHiR@Qudit@}7Q36sYf#=Z8!ZVooK~3vV&cGYSA^1VrR&x+tB?F-gWrOZh5p=(35M5ZX_b1V9qd~*drC;7X8u&0J z`g3^hKPSnXQ-e{q{Oy@Jzx)K;tWTrLuq(kLhx*Ml8iOG)62?6z5~U#r9BYmE5uvnaHZpza z2`+Twh1lgbe$QfL4nV*p88FLgM{tF8QM{3rhtP6LPalhJ*3kYg7U0EH(a-|WcS5lnK_BfOOiWKK{w)}* z@t*ZuS$^3lYQKbWO8;)P~VY2L(tQ!sA-mo7GW8X zA@@*7rtH_mC(wXTsI{5qJ0u=51?opR^IxH4rCPz^~$|D|qjFiANl zPKHDGd^r9jdO*nBWX5BaoU#aUbo;?P$E0;|$~y3;(Q@X79Onh93e-E&EdK{!>WxVD z13cqw6k_DGp=IVF5}!FnmUf5=8zb$244$@`QanQ`jNCtv|8mnDB$Hk)D?Uj!_zKxz z)xaxd0}UTNNT4JR+hNZ4l7#oDjy|Rvzekoa@mp{??e>_oX_%OSL6Rz=(ofk6F57gU z%&+RXR|(<^#K|_?Bik^gM+{D1)KHZ+Pp%$`7X4-|pEUkQ^hE0aUro zrL%T{zY3m7vyFajrzWwHbw48L=QCN)z_S(}W9%L1P;4WOLgI1+hVL3_7G~d%D61w$ zCXm}AxgjHJ6ue4t+gx(HWMqE}hP$#dB~54}`!@>tEIg#!1cdxEEJO~Y6x#eW8pb~K zZE0iTCJ08VLLZAN9Zx-?RBG4{!DG%JN$E3G`rCE-44Ho7d*E`|Gb}mm{bG68Rr)El z;Bwdp$^26;1(!psxExM2Rs9rhl;sW%r!-}FpCGnx$%vmpcl{|LTazr3cmcQ+^#byc zs8^B4gYn-1k1;ltq;RGbl$3dBKb}1ZQC3}-;+~v~IQy57?VX_P$xA5GoS#e5sIeyA zfu7JK6Y$ese&TE3uhHzSQIc|FeUTd?#S5*Ae6LV+z4a}MpF%&Skvd;zk)fDU0WJrk zRth%rHFSa$n)-`nB8zVHBcG8;_w!3a5t%9Aw@OayhmqL;elQeoWS1aY>{3C-Oxk}V zyP87IaY<|YE6U{+!A8#RWbLwBC_y#tTXdGQ5MrI-l_B{^r*`g97qvDcJ)ZwUwA$xO zHSQ`+!R08ymkPSpqSHbCI1cFVG++yQ=+^6rwN zp7Im8oYX4*Bxw+Cwdf{oku#an*?Iq@^s8<9%H<)G zBwmMX+Kgyhk@fen>Zkg0OlYOaqNh`(4X1IultO6ScEFR_2TSvF@UXe3kD1EfO>15N zPKOoZbQ+N>i?mD0Xtwl>(4GQ#q=w9chiAK-#Es0`kt2WtucaJh7U(ONGR2Q!DaalU zLD!`{T&q3w5+bwxUW{Ob`LhyW%y_-?|TUnOQNI3%Shxt!Sub4 zfNpo7ws_N?W-aV==D1KcA7oY>vQxo*LJx#-uVUv z(8k=Z^d>s76Pe8OCOfH`1iY!v@tQ30raSqXEc0f_dz7+(cJB~J-;A@Ddq+6>>1unW zH_OovUfXAR$I5#kG${7j-U*=_5o^4Y9DR?@-r}9==v#F5dEPvybtL!nLT`aH8!e#g z$Mz-O5{I6uru+5w4sW@mA5^xl@m4tWoU*KEm$%B%k7?Vxz4ILXl(v1Vx7t~z`*W9f zfwMxBJ>EKJ1IWu5FZ(|45=Yg_MRJDj&sfE<$Vz1KQFY4R`c^-dxw4vqHD-rdevO{|z(onlQ~F?WWZ zT8@d?>*&YS?f97corOACLd<@r6GV0)DdvEq?-$zxVh%d`CaIknbI76lr!v{tnCG0$ z$U~Qu?C~)#IhSZMCFT|9S`b`5SbhEHST}G*PYtklO7C`SED>e=nk3J zNO&8Wz4p1bLwgrFA&`b1khGd|B?BehyVJ` z5(nXb6aV#J3p`u!e=Gj)*MW?mGycp-r+@k*lTLqhP^CYz0QBcoAP;-wr6rpF7DyNI zu#xnq^XqoLq=Mz!2gpk+CjCuP5GY)`l0GrH{_e%*q^{ zKBTd+bJ@t2*5=dk!n5?TV@GFCs9iKZE2}t(wF_<(l(3Ip$DGju|FuUl@_ zysnZ(e7L4$Ze>L!Uc48`$*n4!lOL$aDV>pTsL*LASLIg*@@FxfURY6C#s12woQkT# z(iu$iOY=e`w`^v4Nq$v+o=$smX;scVqgB2luB{!7ZZit1s>%a%@+&F}%Sr>I16k1l zqay>djV0~vEdd@}6~}M(qXKeE$}01Z2`$dgFAwCDpjRq)=(Tr&_LVL5#_Wp1^2$JA zUP(TCEA#V91C=E?l?BHH1oFzNx(t*N9jy(4mYVh@0qz}2hTwF`@XC_Q^DA=mOJy-p zL4ktN29;6YR;!D^2n6V@gVSxf)A=iSyfqX8H|Q{VdgQN zD=W`0C8JVOmXjCApI23pqsxYH3#XqP$jz^)s*G$$7kRj8|2+?8%k;8}nYt1xoeW0d z^upYns$*Km-OMRRE1``!rFoSFImP*b0=y?Qzap|#=pjtmOzH%>ME0YsI45ebLlY}1 zY31zl^0JC!q*z|T;wvmIlr}OX;9yi9CRRmRR7G z1@!(?7?{XBIeB@QStTWb=}{4R`6XRP}9CR{JoPUe}0_FLbo+LP_o@~vdq(P$vflSYtT@tNjxibnQ zTZe!EOx?`F(qq+~;wr1KS_SfQs&bCar{W@(u+UJ3Sw^jw$C?kh80Gzbyf$O3VqFxV z*U$e|8S0g|5mHkYs}K`H>tJMmWqe*mS^4k8=N9B+^yyW(m6d^t!Wjk8l1H&JuApjW zl!A~ds<{_s5-L#^O}WC->1C0vnSrgw99kcb?L+y@sI+0S`#rm^HBs9UHa!2uj#T8# z4OGmFYyyR;9Y#dUDEN0wIYs5Os**i{-Tm-ls{NkB754}4BlRZea}WKU*8((--AwRq+8!kXHp z0leb4t+}bqm{~a^FukN~ZeVsP&30@hf+1?#5~OHQ{){qd4?=0k=22^csYoml0n<^e z+$2?%V9!+*n3j(vB;R0GR&3<4H@5=XSyED_R+N*anZo4ODG^;+F^AKH1(NbaQB;#t zHM=q_6c!G~3Q`HxC6x}QFf2%xpGWVz4kgobqpC2sI6tByX{N(cMt3xqG!z>_*{NVU z1coi(EG_0eQ72)mD(hsKOT>vc- zVbVwRvC>CicxOPPJHshxEOje&N#Sy)CWT1_^q7KFiU_G7*|9>Pq9R0vfG(uc^|0#Z zM(PiRMix0YR3sS_8j0L#I8ewvtzKq<*jvobRR)LCg!V9UDef{&R5^0T@t=$7GRc3g zzKf>Gm8GmWP(?3z$1w-nM|p+|>!MnHR2t}BInEi>d$nbgCWreOzD@;Dt8ha?EcS*twfWVs3Fb&9j*=9JPDokx<4IuwRCZgjyZ;gqLd z04s8EkqM74tn4~mw;{6mIyACnSO;mv=gnJq=^RrDV;3e|4u!tb-a9;|G-oFIAC`+= zn_s`89oI&1%?B^fk6Li3P}XqHME%8nG%yF(1*jx-rqL23yKrot%HqOuT@0jLR*Dly zNr2kYMPleO7C0md(BjKLCx$N4mK09QpVLKnUSTDjVgrTcbH@FL=rTIvhaI~jdnz~8 za^Wd03+}^}o<=5=qM)t$?5gP#x~Pu&k)NBVR{6-R=)ml*I#7|H2O;NTJ)+AznB#fFhMJCFhS6)(>TZrQyuJrL1G%^MD6Y~O_YZqC=6G2L|yBhD=bLiq(W#Np<{26lyryL+sOwxxGjSCOW+Z^qF*ZiW>bg3LDoM+s z!8Js+nQLxp$4m<}x6pSZ+9)fnTu{NVD+Y3ib#P8OPPW>phX>L=E<8Uaq?Skn6diF) zpbVfrD|Uw^5fugv7%h;r3kYjtL|p##>HjG{JRfN%3=w@o1U9TPFg*u5_lVXBjCe4{JoKaoZ9fKh+QI|_pbx2Cml@_aus4`qM{!a<08mzKWIdj!Tfs(?R znD;pah%PORl&Q3DDqdYHiA+#gcna$`bt9)-HZOE>RCbO-XX14H-3W1{5xg=#QBRmVgITcm5C%?5URx=(5|S6K!1%9AmC9%ZYjlkv=k zNuFJmhff3Hh>T5OuoN9lSGl6I$mY>)4tbYD-EfFb1H(#J+i|R*i#gQ509L1CB_ElN zt}@Dt^wGs}UkfWMXXBEg+KC?1uApRSO|A^gsL0Q!gF18!Ti*YcIy9>PgTy(rp^{w} zTU=NIQyrLgvb1D!f<|{Hl!UK=L?=+{7%{4PJPOK6=xPLv(=i>QNlZ4l65GFNIhcI7 zc~^&THU-)nmen_Rw9^8UJ5z0rqzzX$L!yF$wwaUDjT_$2%6f5GPF-L^zEC(PMu4_3 z!Md{L+@-Ns^((!{yAQ&J_`*PDDyUR2yWpQs0nC`2DEt@KQM&ZEE%X zA@n7pLdYvThi+ofDw0lz)u!W*F>2w7v{vHqkynVz*0{e!m+-=q=yJN8a9z}=(nU_S z-%S=a$-?fTE^Drgu2mdg1gpoDzc!<>88_vnLwBcX0wB3e ziKVTDCPfQU1e41I9WBP9=9V^jFWXpDCs#rGaNMFgb>o)&Z7bW_>zB#f+eS-scs&uf zx8GHlqWr8Iw&xXa*_^$Y5~vO7aY>&28v+ef`ov zZ3j9{`B6bLK6Te_(8t{H*|oNY#ZC2f=~60G(*#7xPq-P28X&U8y6`r>aUTfeR8-`^ zP+`*&s5%)Zh=9?A-L_2E(pb|jtH9p7O$sJJL5rGOmnn8;LyOVU4negU*d{c!w;63q znp>$cim9)%8LcYt1!g!A(S zbt}+?MXe;d=0%Iz>XB3TQdLIX96b(+nkbd(AUw-tdurO0L}Urv=hhWy5sjSA*t&v- zN8aaet#5-?K+H?(S_AFPOY55g4R!Q{vwc?a(z!73i#KY(ToEI`-AJ zw;Hw09cYStu%gYVYk+#Tu7n)g8fa!xQc6S`s-C@Qsll@`O^c0X9gXb`AngH6XIwnN ztfl86TI+5K&jSgry+JK3=qFsImkwk}S)+!q*6``?VSp#IIo|GWzW5gip_WD+626|A_h>>i? zcM8>$6o#rzszR`;*wcn42nJIV_P3!eun-igg1Hhnv%a-C(A3-n)yC6J z^kGg)LoLIYC|y!vXiI%f6Lkb_fQ(hYkV9ES)j8hikTr#NHnlf2b=1%W16X<30L(k1 zc{y5CgDy5<)u1&(_N1Z>H^Bd>ylx5_=>U;t-idxsG~`KJr(NCC4M^;RQVZmQ6*FQzo>IlU)I`s#@OCbL8EVwOGDYUXt6fGU9^KyqQOMs5bgxZ9wKp15ej6IO{V!J746s>!dilQRB zr$d!kBX4X^lD%0TH+m)&)MPc`(z)()#)qSnEz4 z>-gdZBMf6Lz5~7l`x}^F>XcL_c_xwD3$lvxGu53sI<{3+qYy>#&7wZC(jeug65EKm+J0>DHR%YTU53=O7Y}TFo&}Xg^T9 zq@j_X^M)GGu7%1~B-#*TrRy|~G0$>!)pC#-!wG6fCe=5r2rwxvHQ0G$b&%U!c?fG= zv517io2~X%(pZvHtxJT$VlT^{JtW@B1mS@7zU)IDmAYJlF{ zgo0(WAwR4bc*dL$-pU&~c!ve6Q>i|cV~2<18HSIR+&Y|w<&w@Fp{dJW+R}%0NUqt6 z^T|>X%2B(dqlq3LqN4@v+SGP{6ic2AX`fF+L%YPrdU=MxQ{rlK)Q)Z~!+BzHD-MA; z7&XfiM>cFU^d7p_(pKM5*Q^#;o(`BLp+S)XZpEg#5&Jq4ygZ}uv-jBaV(DL2(*#{X zJZ&w)JIh}~Z*RuFtCdcg^86_~ptpd5y5=Umy`k+-y|JjKv$>-cO{L>HHpg^+lbs_O zK$~kCX`ogH=$KbaoAqXBsBEv?f7cmw#-$ACsyh48g$mxfH?(w)qcwnzQMEO#w2cZt zJ2*sZLhZr;hL4sHwHw0*t_>T8j&^lOz=+T_0VzRwYES_fpIRJSl)^4=z>#8MeV|6o zS);BQn=3Vr=mT3M2&AU7rXi@P(gH1PM(6Ze5Y%q9t!oSq~# zx#rf_V0JJIsL5i~Dodv<8&4Obp}u`lpsfYFAWX*w+QZSsA9=vQ&nhrS`CvoF0WBtF zgS}Fli4{t&eB{FJG0etbuS)x0d9Kq9rt_wn&<*X&YFb#aWs%sS$j9RX3m1`*R_0jg zrR+RizK|v){4xej8X5~da=|&wmjvh(fXhI%w}lBY>N=J!gK!&Kpbxl8M6*-Mg34}b zh8g7IK$VR6T1q?iu2B7@Fsih1AW5KPc^{azzU@n>UK!lj+`JT*?UYHD&1LJ%S}d({ zhuk%*-n2A!(B51orE(P~n~i-3W&!OgRBRpUz!2B#Bd4q{BAvW?LUR?Df)+2v2}9+E zF7sl5$wJqVg73KZn$e}U||}t2?)>;Q68k|>_f7L0=3fOwY&l6LN)(zF|y8BjQ_BtIPTRoFXK_9 zi%22cqeg~KRc$Rb%W-{?(#tN9G17yf7aD0KTiRvQNe9%?gjykITeyO?HP8hi7_;V% zHo3@R&)DADppH1vk-@H`{-_0aG{hyZAfbCpVF$t|1unlyi$`ntVwh6Q%v$IaB#GlE zt^w=AC0*i^dQ0La_0yt4!Y6ZART6zDV@aeN$FRxV5RRI8Zs{`m?{Ylx?GS* zBW1(r;&gDc6F%&E>X8ORx1oFjdZsEAG5F}l0f-#dy zPTOEA3=^+eZ4}#@@awXs_C<1sOur(Ndwh9BkUlC$j$|+wY^N-pLa|;q!v>S~E^2LF z#+w)@g`DhEThMG!^4gjfT5e<@R%R+#7DZY}*C|AGCPTa^3h(LQHckanCSXAg~{Pj=lambTdqa4+>@nO z(m+u>A)%hjaD|yJfrYIr5mNyRP^T?-&s0 z?TWrugR6Ns_{)LO8<{4oq-2(;1T`gP!=)+(^^UF+HrJ}_D9YP{TQA6o%j+ui7=_Tf zr6X{ScVTlYP5h9S>7|6`yi_Orkg}C7OX^J8dTU zM2igh;{aH&dR!|p&X89m@B|9A4HvuV!VT)tzy73aDJ{6YLd%jmInoGI>GF0)bkc~3 zTDl4wmaw*=WeEmU&QjRTPTWPnR#TlssUSLy*4NfykI(^g$!opr1e;ZC&ge$m;!v^D z#5;;jnnRq!p?+EFwH(u)AUL;Zg_>4ig4V78s$3 zYrNrMa#R{xcrnJkw4k3ZEYf<5Gf90r?aq}!*V-UYvg*i$!6kz!k6_5O93v4jT5{~w z^dw#B#7!%?e9|5OIs;hTj4P{j1BUqjr{6^9-~|yzO?}P62D}~+-dy~|`UJxr>&fw& zF_vTa&3LoBm4NTqB^kZ!WV5%KV)Zrqn}hJ9@OY%BkBhtT(`|E=4EADmhGlKe3vA>|Y)EWB=c)wHbT*KwI6?QB7FR zJL^Y{$;{3?K6BhCJdx1a+}u8@qb*bg-X1U#XP1r@BPmz)!UpVke@7Jmi(-GTi2vE! z34Tu=)%@y!|4*fdNxREeEBr6|UkyBdU?RTE11HTD?u8nl+~yS4D6DMG4S#Y>4EYFEC63+MU6N_c2mE zIsz3TOG9%o1|Gati;~dgT`&*6C((qHL>(uQI}G^c3p9j$ONQOo6bZ4`kVGL$-1ht; z(c5kJFB0x^gnznlm*O+g_9;ce>$Zm$iI@`MEf6sqh5K9KDHLveRNZY?6}fED-EBWS z90}Y-q8Fe@#JcVJqaw!cQ-p7Zxb1JMirn_BeMp(;ws#KSCsL3yX1)C`a+|_*+vE4S z?ZSPQ53?Iz=)?3j?6>i?S$FJaw|&i;_4fNlk$b~ts_%+5>rvn*MiG2Pgu-^)>Fb5H z(QW^*dcFMz6RmgKwM82!^(B3d2 zjrDGOJzlS4#fLTK0+SkJ4e7OEbBXX#-%%dE@H7C4A6@O8M16S7JPI+O6qnn++FUQX z7bC@bk+@GBSA?(!MfXB#()+7rldeOZMG)LSA(DLppC3XyVv(r?9KE3&8#u>{D#u>R zVLu1rbK4J~o1#GYN{|l$MZ$yOh%I#6PpvMBX!#+u+!vb!DHNfRvxIxKg~c)`dZu?`?$}`1){UYN*G3+5>?-#wlqgHR@PX2~^2ii-D#Gr@7zz5y-W#}*Z z{u}x`+3qM3W6>HH0PV*YmF%snkE-Y*k)BWGoP%m)dJOnFG&L)%E$c1lLaZHUMzrvD z6*|PU@B;r}yWc{nCw2pO%g$IYy4ee8EHZvG!+P&9D)Ud%O z5%m<-gTl1q){7o?Cq@R!j=V#P#3=W=;zHrsNX`Ft6-m*))LtLan#*Mga<&{niUIZx zyGV?e0~#koUthIe3~<|5AsD56DAN#$#i+U0qS{1^pxsW>k2+B<#utmen~H^59MRG} zvYs-GGRlJz*y|x<@pt1GU0bM|(W(O%mgRSRy&fNkAfd@7bi$MTqThZ?!NZZdi3x zq`U3+Q13XjD7}a@_MtWVs7c4l$8EE8-a`*O(4PtJALQtHNP~8)+SjGzJkaGRVWISw z)%a|O^2OTc(BxkW&*uh-Wj%~qa+xq^iP3fklznC)cp39Qk5t(c*hI`WnWbXs}VJ{>h>^z(5fDr8WF?my9jb1p5#`JF2dNr5(Jc7;@k$)4(;fb^4 zM0m;t=?|JA%zt7y&sra00pCY$Fgh8@8$|!L!aY-XrRhzYDN;#GitKHwjDNc@na+WK zu-pC~J@;=EF{{OBHAr#puaFh#ZTBX(z4@%85mo#e)*-0=29fk25*E2EalG5!b2eG$ zc>6_*6s$=ZP^Z6E2@KH-Pd&<6YYGxtG^ z_W5pWhzS!+M$%{RhH62!lEr(Mi;?ihBL<6X>&1Ia8EIM)~!gU z^|&`YfKL1h+k{TQ0>QTbexsqwm!ha1_>aB}cW)H_V$rKmnhPv~UJL+cev#-2RZfsR z!A)kR*M33Ps0Zq&!Fy#Tn&YAg*3eHV9O$|F^7^QRjO0iEbOvOe_HF1-1h|)ZGir3q6S6 zB%BHqD|`=8M*Gth>#43QARyEB!%DgBH&@8MJSW#@G8TR9tzy0Chl)M4^lTD??Gz~T z7PJeNWw!@w@|!ExlZT3GqmnRQ1MGd!DKZo3`@}d{RT>5RYP1oZ`4G)PRafaEP@FEJ zpWDtYf@xVVGGva+RE{svOZ(!LN3GPb#pM={DZ26EB3F|VX^%{dP-cO&4HRl_h_DU! zAQM)vKD>I-9wz*+yWDiC5SQ`IZ(raox}iVYxFmx2GU_9EiZMQdrx`I3yr1z=Sow4c zel&s)Hm-``!;O^@e3a21QJ%+mBZ7}HW=HVx#^4A((RdBzRRudV(KtV%{3%951kW{+ zBl5=?FGa-rjawsl52Fs8&c5oehjAV9AJG(B=1;)W>0l`TdKj~je!r&1C}RWS4+Z%c z<6nr+3-XD^UEn`s=dJ!G8q<;fYfZ6}{tod~!SdsbE#M=9@jVQBIVt`1z<<-2Zd`%< zaBE@C1&38(g40czLEQ|32^@ z;5z;i@PXidj&BAp0*_~241NlDcjik`AJv7o+{*Hv2mb@&GnlUgzYQEO=#}xs;PgIJ z&C|gD0ge|<%J|9P{on^k?uQ5OE2R^Pk}luHQ){K z<8_FVp9;Pjel4$eAn2uG^?!=f(pYd^9+C$CY&j}H3Wk$X*q<$>5DKtmE5kXBZ0OIH ztqA8SAp)Om;B#bQf3}oND8P=m+C=FGha%y#jp0$8u9SuTY-3D_z-P-BIfjC41MjsA z`?IB_Ljkst8zS)8Mqv~$j^d?JJTx;Y!Va?piqA2|hl!YUa4^PC{}HFpf9OBrc~R*n zMy0=w=Nsjr^yfsSUl3JZC-g!8QTi{U(w`N@djxHPD*y7R_zR=Tiy_74KPrD_RQh{q zBJdx@r$?0^hjYIEqxiW|`Jax8AHnfIBW;4^F}~pXsox1!oKYIpo*q$rbX5HpMb(!Y zRiB9B!=mKBi_8C<+5-)suSe)V>Q6&d`81E|kA^kDN-^Gx8n4fz`1euy>5a(xkIMgq z`$N|n6QJ+wqVi)868xj|Z!x25j|tWkV;lFcT=IVMf;1NVP{EI-2-AJx8lIX|N1{OQN(DY&~e!}x(B@TYiz(HSMr zxl!`}DT?F0*}*@OM_yEZT02wQ)C-uiKDvp*7M z!J$804_=Ks1T=M#+JmHCs6H)3`L|Ly+DR|KO>I$o1Zpq6442-nUriWY9=&E5`O@aV zp+8*@l<`{7)RlPSH{n9n|I`cAJqij>rh2x)eo(oCus#z)*h2`h42&Qg3waP8uhu|& z9OO*ApK7Pw-;m#*u?MJeu`}>t1&SYtaUdLw%IU90!7#kAUH)l)QWVF+jUtTHStysW z3YfM44*ltTQzZ-WoG3nx%R#>>Y3eEJrNL=ut9Rz7cB*?3sV8Gznuv$|>ImoKg~f!Y zMU|J!az=XjSEFE9p4wNW1|S~&Foy+AxPj(}D>P4!YR8(>Zob=^6pnV=3`qSl2=XN6h2n461 zan#<_CF-TcsSxsB;%C62Kb>y|$^@lw-F}%4a;17w=P7-lcqza04P%>$aFoBD5ak{s zJQd$MA#BI|AZ$W=EFk1DgfWk?iV*EuLWq8?AY6#?W86VliI+kXLO$OSB3*_JgxpsV zLhjoc_Y$Igw6CLarM2y)?p1j5o(866$SI4f5e{SOLp(7LPkn z{^|I_C|;!OpLGI0#e*n9QZd4fj5jmB!k7X%QT#NqEwYv5GHd+|Ia%aJpgql`%F>@rjIc7*`R_z?W!g9k%Vcwr`rusw|#naB-+N#z` z;ur#%ubA*Wb>^mUOdT0s%hS_%owL`j2*#9Veu-D`6^Qf5st#P~YnJB%MN ze#-bIBiUhU-@h3ROK~@&k1>HUnXxZp1|#j?shljvag37~r!f{VmNJr^r+lX{E?`{5 zNS`pF_*O<*2Z*m`#N!N-pUX)5T#ElABdrs}>3m1HoAGwWy^Q-94=_H-_&Ot<4=Dc! zjGr=o$w=!D#oJ^jfiaAJ#w5l*jQtn~Gmc~&!*~MY6vlkUV#ZmFa~bC|)-pCQHZyiG zp2fJ1aWmujjF&K8!FUbh4UD%i-o<(_!Z+n8Gm9lY5jm4 zJ&fHLdocE9JdSZ7<8a2&jN=(6Gv+cDGL|vUW;~U#hH)|DGR8K>m5gf`H!+^a_(w+i z#3S`%7vrsrdl(;Je1!1{#^)IS!uS^B`;4D5e#Q7bW^BF}}d~ zD&t#>hZ#R+{G9OzM!H}~a&a?uXY9>*9OFR7;f$jh>9duTe==h(V-e#l#(9hZ#?u+w z7*{f`Vcf)c9^*xfmor|)xRdcF#yc4AVSJGBQO2hjpJ)6F<6jxyWBiEmAB^8H{=oPP zqfPrR^go8t&)A1CgK-#R7UMX^NsQAN3m8ios~AsVT);?Qx}lzQ*`5;}48p+D{{0Z^mJa6Bws6RxvJQY++o@xRvor#@&qf zGCs}t665=fpE3Tx=%W2P+S8q}FXM2=35*Slos4T3w=!PAxQlTQ;{nF!8Q)|42jjPl zzcR+sxd81cW!%7cF5^{?CdPXi-(mcS@hIbOjJ{r~UA-9xF^*xJ$~cqp6voAj?TqUg&tu%qcmw0zjE^ur z$M{#qj~TyZq#GYnUW_S>gBiy%<}j8rp31m{v4e3vvJuFK4`-@h--P8J}f*lkp?Qql~{X z`qEVUdNU4XJb|&0aSmfGV+-RJ#)}xQX1s;*e#UngKVm$}_#30IFSmnn5aSreBF2r3 z=P_Qwcn#w%jQ24<&iEqZ+l-$ue#`h9W88779laO_Fpgp@Vw}ZzGGjgC8H`&QFJb%> zQX!ld?@-y~f9LzX|aSG#X#%jho#umm^j2AOr!T4v!+ZYcqzR36{<424~ z8GmD3+F!M^mGMl*a~S{3xSR1V#)lc7WlSER$~lg4Fyk1;JjPxG3I5 zNc&*sJ(%}p-kT1^QW1=%KS~{A2R=h`BCQIGdG8+@&zH<70*18`Ekq#FwbP3&3rOrE+N`o z!q~vLl5r~`%HK^m$uRCCM895Q{yNA1KsXuCTn<<1eS}CC&%6)w*|A>#kdNY4ro zk0C_A`!J3q%)zIxndcIsoEgk3na^cj%h=4}ZOqp&-@tqu;WXSw;P87m{87f|7~f$0 zknwZI9~oUEQ4ZSMlQ7pX(wUDSL_4#XPhw7Am8bM2%*&ZqGpCQnQ+y-i3Jzbzd<*lf z%(pXMLx}o!Gae$Gi7&nrq8)EBenE(IF_{VnG9J%(5@RXjT*mo?rLZ52S1{hl_yFUx zjPDZW;kgCo-x8u7KQQ-sV%6tg(5zHqrpTxX?v5K*pv6c|+S;D-T zc{}s7m~Ujfnh@>1mH88lf93E`nE${?50+8+F^ma}eHb$sM>0-koXJ?r*vQzyxSH_- z#;X}`WW1B{0OQk)uQ0yNc!cpYLdf+e#?<2#&t@!ST)=n+VWDB1#e4%HgO_G1fD-GOl6V%6J9iF2+5K2N<7ce2eiD z#_t%-394Q6P7WH^K8!;ck7u05SjJe**udDyxPfsS<5i3|Gv3E|knualUl?Pt*QIvQ zAMJZ_dtRcK(Z`s~h|3rhsB9zS7DDX1wlZ!b#D42i#_fdIZ|z{bmT;A0vdErZPtpq?{HouOozV?+()sRoygx34fkWYJs-bY0K92ELdBJ$}aq4j<;oa=$He%aIjoQ zW7nqR26WHha1W9+Ct@8h67mk>iAR5o&k!n-C;3b+9n&Bw$8fCa>B*DhP-5{jMdF8U z>7(A=!-Vs^oJNc}a>~Q!9@L7nLiB~$gHMWMFdpTW*VMeGZ(Xcm%^IE$tPgh6dF>uz z<~d64)3WN{AHFBYyyf9QI(_#6OH!X_XO0^@-tlp|3N-ZM(7-i)y*LJ1tKsUb?-$`2 zWyd{WP7;TjVdYii5%BMx1@~#mNt{b~Y^f#un1c!G)8q|x4&A35G^i_bdzUw<`YbL+ z7(b;i#xw13lAt~$n8(QCOgGOtjXZP==bVX)uKIG~;h-}JN$8|Nb~Y9-PT~A;)CKk9j<9ej@&OJu*ia9;@OpEG)ZY&(-|2Sj>5Z z#|k$-tYXHl>xTDCPJQ5|dv@Wc#nR}lXl|(t>i3fTlj;I8V=x0%awC;fML#ueeNWc0 z>2pt0)b4KIq0jd9(E0+J<5nT}{7G{nYEqhp@=U5cE=%(Hl?gRJ#eYaiY~3C$+~C@g zxfMS-H?o+IJ>^pl_M`+>ytO#D*#)O+o;VG%DNh@- z3gbM5nkPH7`|J;=ZVJ3zsvpZW+fP@ z5BZ>)#l66g*R>UPJ`oUfH#!@6eM$0KATJ$!l!xhcT;4RyrM>#)fZ+Rsd5pX%;PdLY z5%MUD|L}^-3%T;*`th3&>PH?vMjrPDd*vPS=tp;x-Zzu-ZwBPmQ(<|Gy#A#09)`Rk z@KC>D_&4$%O3J?-$T;dp9zI6i{Ymm7cqudaH(dA_j^C1a^Y41d%b*~6jJzwr=S^=u zC-fQshjW-+e zR>RFaCf=*z;FV|n5by7BV|kp2eu|H@JN9 zc#F_Z89rMW4c~6?dE=eqi8l&f6EFAZd*fY5d8k9?G4h^C>aP|;UJ;mB9@Ft}miW=!0y#A9rCcG7=MgBmbq8I{T_K(YK+U< z4?E<=^{Wv5$iv6T+XuT>-hCc<#lpvQEyTZ9zdFb>GT;@rW7%_1yelQ%5;Ea2VX%BU zDBdSM@s9O0*1c0vPg#-W zF@F5!)*El+0sP(;b>po7uZh=zE+z~`{E~yT$H7?njk8zYq2EIuJedyulw;(TiM)Kc z@%iO>m@}~=%R_nm=eO8I!}r=vmbF}X2!?M81k-MwIX4@di^h**8Is&(e96Z;WFEuU zBK?qY?*-rM#uJWA2cM?oe&dLx-$9t(I{cgT@|#9aaBJnQC=;x|o5%RoCCS_S8qNa& z6Xh}8M&2Y;1|%i^q~DHsk@1wX6#wK)$3NckbJsO@@E+~F#=Op%`H{rq+Ff&YVWIYz zGrMq(%Tb?tNm<2w_k?!{!egU{HF}cHacEkBLJc{XbJ)(fD8;|a zNE>?xco6FG?|QVr)`fp~5O%~pV9}3P2UdTSIl(Y49a4vE%~(yK9&S{$vF0Hv!koBA z5o}Zt9)xQAA3u3HnsF(?h+evfHp+u?MSz8_m0*Mot*0xj#w)DGBdjJNti~&>X2?Xl z!m0@zz}+O!He}k^Kh)zNi6->o|M-cXp&6GFjOe9%Xroq0v{$*Mdnmfe^&lA0i7c>3 z+R+iC18PM2*a;&>+RMhGYs!P;s9@2!|C%>mjW}c2XNOH6Uq1Tm@%jbaH`aA39}Ok1 z+G^Vcqer4&30#eXK78YL&l`tjq&(XMn>(JtLII2Hm>v;QM#Fp9Fv>+c8g8i(<)caP zOVeStO_sFD;5-d9zG5mL?FzH35!v89YuGTjpFr!dVQ0abo`|h{v>V?@=w-QjVLLMg zj*iEPz91tWXMk~z8Eb28;FCEGc{CQy+p?bWvk>_Bb+?(OPthd(O&ap(UOWQAJ}<0b zMo&i=SkUKdvWH|6l@)m%#DUH?twECITko8C-o>oQ%>OQ7EkVlt#nS#0&O}n zigqJ|#Vud^JRUGEE*y20S*NQEUrDafzK^p8Ed#k*ldOazd2kE+pOH4)*ddN| zU}5iIrRzg#ZqRYE0)+mX5wjSr@F%d2VqvB8q#D0lJUSN=OzEsmfr}D4C%oX{Ry_N> zQtEQCR{S=|(~4iL75^v58?-M^`|$r9R(5BmZodKATlYTzO}&kO3IdtB&$f{Xy2;}| z19V%0w$iskE8n*h$vpyrR+xzl-bAlvxBjKy0mAor(>K@L9tJ`GRaMnmx$iTeeY%^>!{*v&| z5iApZI-ZC&-Qk*6W+5MT6XvN}SXCRzIVqwqR*B%+Mc%v`aW7bjzvd0g}u zDJ(3QHK%dyY5DohvraoLe@C(&Tz&LK_1cIFH#*_ANQCS8%$&mHkV8a9 zfu86*37>W9Y&WXbo>}-!Ey-sHQ4BD&sDfBu7k=pCg^|akW@sPE8rr7-SH|Jmot9)- zaL4_#UNxDtp?S4W5;tQUnp^vjo4>Eho0oexYftNixbk$6yRIx=MmH6Mc+B1?-ZfEx_gmUCFS6W4R*V1U*V}aX2d}=*znOjG)H50Xm*+0e=Or7jvI;-5o^KvX{7&ob>|QN(uz zL~Jl>_^x&(cp8gXqbLFM@GguF4~^-8KHJpzWANg#0w5m$*t$pEZhbHu4Qe z{p_6ZGDEFXRcm`+4|1>(*ZbRPm23C({?e$uZ9ej=#PPK7)7&Cs9wU5Il8O9iV1TLmv6qMWW0`g$Vr z?M9)$F7&sA{(;c<2>lol;hz!wwcsn_?^CWGCkoCXqWtFxt5TqIa4STEQusL$X;_#Hy) zGdDrsF7yut4+^4s==us$BdV^hXGoex_7TiC_RK^yL7hJK3rwe`!K7&f&Y?T#8AR0A zQlS?T5q`DM^+beM%zuQ_^#S}BNx5*}4E^2hk3;N}G*fXiolfis_0GTJzJs>vySwz` z8|sg@71KnaXZ1tN*Is7I=gxNA*Cvk}-#3!^D^r)`-|D*YkfV3XcccCl1r4z8 z;lnW?nJ=P!T*L4cf)8Cq{3%4|gf7IIiho8=KGLIIdGWmtb>ePRH1bYJk~bIf*zZvu z-!Y85ov?fLV_&ud|K>6Bu7ZPCzY54>wo)FaQbt}2?2s4N?=8^O+f28Nye7DLPH?vM&5=bdHX#2Vd@l@ zmkYZ${}zJir675XypuqC)5~-9O#Wdgi_2r#c=dZw^dk=+Bad-<{1}aMtcqor=WJccWB9CRoXEx;Bf;=z}eb{56CZ(2PO=8c|K}95NMN?KL?*T|LQ#H<*STI?~jw@@x0W3!p%G; zt{)}IyB_i)U}FAF#=nvGStP;}+~WD4^%4i)JII%ge|(ab>wfs9w}3?49Uty457+LR zW)H|`3g?_QOMCzOJs?kRLj>sd3N_^5J;%1*Taf$q>26j9u)4|xW%UI>i+kR9>uhIZ+|e|-B&Ws+W8vyj!epP_m1=y?;Pm5VCMkCxcfb- z`|Is(11CYI71?{l$U(oGS^=4v+;@_{x8L8j3-V#Nb`DVHY1s3^w1(4d{>pe5zs(=9 zt-Wfmy)CdE>0>(Ko>~tXas7}V)Dd}sBrhF}B2CSQe@0~IYvKHzvj3!7?~@saG(%qh zoRQdPgK#FDDED_F9yjv1=|KLEx)ounj|B16^5j={`rfUV10(F}*w?WLnfv+74OulM$c^KaF1O+MoNHz5;w_LRh@z4)~-hzrV4*zNR=e&UZ zWD8jrbuIJR||f_IwLYY+A|%+zpSUVW1aSC?`&$0J9Kn* zb*H-cXfnj($O-L$neN1{EcR<(p| z>uhLZK>8l*dVce!R5t5~e2E-^Lj>PwM(`~eI#E1q_b6uqx8K>;GXAK23sMX#8O+0h z1zSD{E@NGSvCc3R!SV_IZEM9gh}oqjqRG0?(||+xM||R8FdH0F^Jzxfu zp!*QK8RX@#4F3!whg58rIs|w@TdQ9NP>RpW-{X;%L8&ZQaP!?TM_a22MffK-mk4%< z-Na4#6b{uHm?2?h2y(;90B)|u)0VW|MSqp=$DR|}k%F46aY>sia#^BQsN*Ti`V5YktXRNzLW?Y^dcYvFHT;}od zT{B2$R(#it-l;ReyEDg$`{^AuCyqgOO~-6uVq5?+cG4J|Zjnq$BgR8+x0#Yq(ZoAd zoII*zYe@m*4J1W9(Se+nAcqYbJ}hk*_xt0#W7#=VnJ{e?h3QiTFqJBT=~qi&2Gn^lgO>jTaEAOk_2t-uq5Vht)DN{kFNVbyEk;}h4RDEhK>b7e1ld~DSgNJCM5kOXuD<#0w18R$ zi>2ye+NuYp&k9hA-&dq=)Lyr1ulwnxxaOwR?_v5C*P{c5xmt1A%~I(wZN+J|Pn`i% zsVbO$^*NXU)eAGIu7nvN1!a>PDDj)O|2B)h}RoFvE(Mj-;q8&P~+mFo!8#Uz?_SVGdWkT6To`KFkx; z&tax3Ucxa_@k;bjDgtw~DuS7z_+iZ$)d4e8ZG$;h@%oH$>Ta0h)iW@&Tz#L!6veNu zS4v-luBKonY^wz@eTo-fD76cwU+se#P!GWjs^?&a)E{AnRT$${iaH5qs#*YZn8Kh6 zeK)`yuC9SOLLGp4f_e^Sx_TGpNHqp+X_Pu0=4jOnGehl!IY#{iW~TZp%(3beyo-%f zD`1XS7s1R@-+?(nJr2`Rufsf1eFAf$8iSe4B$W>{qRL@TR%>8RQJ2A-s&0art$3+i zR1LtKrc$|ZucpJyQFCCPr0QUvth!*HqIScaq3(g1t9}JDPyIK{nTppQ1&W^^ z%u-umenx!_W}*5K%v041FlVcGVVbD{F3LLja z)JVKJ_|;i3w@1|H0qJTh%!v9L%p&y!%q_NhkKj}37zegwt5XPJRYJ&DZG?#8Dg0ZC z)LjIG_@zdl8qnxhm<7T;tnxIbt8+9)6n89dLAcvABH%-=#iw3!Eq?V+*AljZ>_fh< z6YwWB2WYDzm_Ajm-RfY5)p;<})jF6F)eW;qT?`X~FDLlaE`nd(LI|sG0ES^>9|Y@O z);^D?F#3P;Hk%b4_i6IXX&_Gm`AG!6KYbmqd8xkL;|}2$D*t0+q2I6?cz#IFM>A0R zX**}a`uHe_NV|^KCnyk=3Dvs`MhSi&@{hE?jf!gx=fFDRG8k8o^C~+NnLXnBpub3Z zyS<0>Dd>0K0jK|Jo1&}}eg*SJSkh@Z0Lw^wsc$_zY_#yF$?-ViI|R!pdj)^S8i{?M zyT@54ybR|#pwmBqrCxi~`gVs$+BLr28Lr$daCIY~#hT_$%yfWHjtStvo0BO-(+iMj ztkDl6Yf*O8Hsd`QV~`7Q3ivbs3To`%VfcRzhp;{Fkao9+L-Wj0FvgCBG5%!?j%mTS zvfh9%r3BxxvfefJKl!tGe*y0*5B@o9WtKBoC5#EHU_6bW!PCay4=4=2pY;jlql|+e zT3I9DmV%TA|K`sc3%hpzD4Z2F_P?iP%`)~+(z7^Lv%?7fE5j*+eJ1UeJbLr7=7H@7CPxr^uvPNS` zXF2Upre~c9JHLnvK9!NhD#-d5e0p3~5EZK&U1RVWC#wMVKH8tn&gy~v4%(lek+lk8 zwfqfR)tmy5CvBJ4@Dzgn8bO04-0FU)$E zcDlb-k@X4eTQT?r2dXW98k7t9Gbcjt2`9lA0Rh4C@j*aZusdspNo%i_H5+!FzV-gB zJ7DLkQg9<`#JLQ-7RI;W8mt(<2M`W^KI^kU9Z|cbGvP|G1TpMq@}8!#yBX>h7}qh> zvWeRO>A@3hXAvyFB`YS$PA!N(lNfFLo%2BagTxp+?C=tdX;fh>GAQ%+aCQroDrV5I zGI=i7B(d|W5D&u`kh;a7{9zqC35I_iM279mQwFhGnV$tcfp3bT) zGbAE5vh@eBxf(O4GiX?uPr#fc_U8vPc#`xd_)Pc+#=lscCF6Oa#+=}-i7LIv%9;!} zT|K_$PgL)(hZEKH8)=E^{jKyw_5OB7)@ca)Fst-;#$}bj{s`^gbrMzg`;n|>xa+EW zXLi;O*mV`XD<_MWf#`UDI3w$TvEQ4YsJizTTAAO2z_GlhY63f`8DI+*X0mUa@C+Om zlm1HP^ROlwa>jpy%=mH!oHYmdH8=;qU}Y^a;kJNx0Q#H-2j7y+JK;a!K^V7y4i=5y2}lcGopljV z=j9G7>oQ}%#-FtvcHKO8q3*nkaFa5Q!gPlPDrRN!eyy?W?lMQfHYr2;KiECl$SjkV zQ8?I#GdS_7gmrReUEH5BS(#0sU8&w!FC4@r03t5gwOt1SVzUaH?aE^?&FT8)BUQ zBc~oj5A?Lh`#*_p0C6#iENrNYeisxA%bx7_+tFu0-9^7C{;(Zg3Y+$u>QA$yAHk1} z$IkYr+tJ`DSU;Q!D(cU$qZ2_LX1Hnoadwm^nA=qGG{0j;?W??C45EE%xuV zqiu$&@b9yuT?uNx9qlz#rT-2)`UOK(`w!Sro`J4qF7@9H4bbDUq1rY6`|K#sL)TQT z|3N!?pP}mf2kq!%hFa!-)Q_ zLo6DT?#u@9efm_6$#CjHuyLrRV`f;H7s7Vp^)NE%=C(i9#*8BHThsT#@nb}<^2TI- z1NMo$Whh6TIL28IODbhfgi@x#sR)$13O=mfY6_J43JA{RRW|hasUfC~8Rt9>;w1Xy zjEOh{AWkK5@|bLEItyeIT+~6|^eJ$?oAv>p|5jiqJe`a$(&Gv>{HStV1g;o9-=X6+@eG2PZI=Kv`W{vS%Cs&Xsl=Hp`W?K_8(DaM! z@ygi^zu({$(Zx?4a5e3^Wu%*}KLluXb?C8ganip!Zqpu<3 zK4j-RKh%b<7&)K^fd!#1JId{sTFQb@uN{q-#KO=$+*sy4L4j$Q?76#ngVL%Zzg&9J>iT~>!~w4=O~h7$ri7TRk^ z?*KKCob{o7cJxQEY0Vl!`|ap+3F;0z`Zg$Dd}DWn4%pEt)1)r+gwVau0j0~bH*}vJ zEiqJI2;F-nC|&65LkI0BuddP5hR~yS^n62Y3_WQ_d7X`}Ul)d+wxgFDzs(_Z@4F23 zg^=65^KKh0=n^=vd%wpxY=Hy2_a}|RrEp;P{)%zf3I}%YyzfTKxC{>H-lqkpi^DcJ zjE6(iI9!ee-?4C*Z5*xuMi9BmkR5PHhr^}DVJ93;fWvO%a19(rz~MIIa4j5$!{K4$unP`paCpQx z?1sZIIPjVr9m|*CkP3$njKg(sNP$CYj&NKLhcFx>#^DAygy3+Rao7WgARNv#4twDc zfJ2#a_!=Dia9Cy>Zi9n@Lx*wL4+kF{YR%C7osi$}ykt+i+;H3pjtOw!4LoaD8Gi_e zEI8~p4)?%e{7ZK9Avox<^8V0o?I>^H(Ot^JA&k_|fzl)A!O$yqbO03BPVAqAUPV<# zub`=)hJJ5H-!XoVgbv%$zZ>e&&=EU29KDI=d@S^u9i3pP$3y*g^b|uq5qjN@&NS4M zp#eKO-%vjbVJ=V&O6&4e=uI>a<98_Z7Mh2lo)5ikTc@zosDIKMy$-K(D)uoAuc>VV(57eRH;ab6(oJObhi zV6|g`G)F;>t{)A7bZ0aO-8HNUWH=EJ9Lem)z&Izz5KV!IlMjL;qum_HaZUpBA{@lw^wVbLB?-IOw1tsWNL4N6yxbammd z=r}`-R2L1iGFk8RThkZH!LM(a;ajrFSB6!1gzt8y?o;qo-BL_HRnoDlXew?_t zH+(@oebO<#=?hsC*l13GgwO^*HyMX~IrJ0R+CGC*6>MmlzyY_MJfF*4EeNOGoZ1g%eh&iA$urgjOrvns^Ip(tUP$z&R5Z&IRp7XbU9? zBJ3oH3&Ufn;meR^FVx#KBuAeUjRa<`1C-w zbCDs=2t=K0K9H@aSfFAeiGk0OE6$duMP)Vjla0 zV18mAdsnc~c?E2`jouxc}VzjwZ1 zh)05lo!y3bG~;)2Ay&^Hx>D<ICs0DUjS_%&b`slFM_rX=k7Q3uRu?FJ@-CC z{~Gkf*Dd`nrjUq~yc`yeuIYX&Vc%(Gz76l}S1?o9Z`<3H|FXj9ay1zB^!~q8p&h*e)K|DFa-+gn^G(?Fknt5Y*N*-KetK=?CTt1N z9gwDOR;70I0629QaI0E~Ni--u_1~i^>}Vb)-q%4(d#|dtqeY1vp!myz{S8%bM?Y_lCcx(O7Q0PSz97CX8f)UAx+4%KEy(?IE$ zgzu>?tQLXNnjKJh)%YzaT@CJ38|}oJ%n#LO%ybOrJ!%VPI)=JeZL_03NY_&C!w!dN znxXDjJM8Eoja5;aZuE)!ap&nE>+ELExw3MH!TkPn$hI$0s`KI-O(waT0 zP$Bl&)4pgNo`AzdIK-E8o`l1R`|Rjl;Lr{CDfJCI`jnx5uJA=!VmR7jO}q#tmv669 z4##ZW@1KJzavEHP2s>wh(C@G3;stnKg2-?dCx~%QU4n3&a}z|wX-p8=&iRH|jThkV z1c5b@ucB^@{W^?^{{>^N+MMd_1p_Ocx;WKxz5_zP^k0(dcQ_tu;?mTxbC2=4EH%yH z;G=ymPfd3ofDh}G+Mb%>ylIFXspFjgHpDflj>E>m>{q)}BMz4*HE~^Pwle_)Ghf}1 znv)wf#Em#oWzvjX^Y)^?0(#<%T=VjxZUTMc4Cfs1vl!GZskzSQ4RLE~p0f#rR&q~j zzH==IzJsdUQ?cy-4cNxs4rAieP%&LKrs~<6PDK;4fy;%OXht@emZ#Pt8y*M07P>Aq z&B|d#*L{P}%KVrz|3#S*7>;^7mL(#KQC}LF=U3N`bl!!-a{Q}ZBP|DG zwYxI68&i6{miAYA{n$5?S(HOQBXlF|`E6LN$=nLt#G7FoXFsEKx$3p-LuhnY!&Q&g z&teJcIuO**eom!ZnfD>o*oPSOO}O8K4J6L*VBuA{su4c{;$Fd`Wn&W4d;=JzV6No?U%0T}FuXN0^zPcm4+Bw;z=gx4wbE+Zk3O6}LAZDEe z(f5X1oFY_f-R>Uf5HQ4fW?oC*`>V7S*=1wwb3kAycm=0^|pSa`Ezemzi6hPOEN zVAHxi6W->m2f^}H&xf}=R~X{O@D9hUv8!K)cR6NAR{i1Y9rFu{dNX{ZV}6EF?}l%2 zZiE0`B!3IvxfL2yx;kYA$%!!IAK&N9mbz>AhFDyl5)3We%DaxDfc;( z4BM!b2OZw%sgp1!<)CAx8ER_EqmCI{RbI-I4u@UMR+#d%Q;INbEb6qBLr%3J&Q5vG zIS<5K=JouP7j%!jki?3V_pHp*U>i&Aa`<+t+gZrdzlPmIm|sTw*oN+97yivt4LjYq z^Ozfb&GY}kV~pHyI97W<=lH*Rj?tjAfhtzi*3`x-t763^b>+*;Vl~B;3(73lb>6DF zvf5bLQX%J;*VNXDy|%8nrmnnlfskdDr3s>>YDslPSzTGF;ayc(SG>~FcT4fhRNgtY zu&%B;w!EySw!Eq`RuIcib|@I^Fw1J`?d^)mDO0XrNmXTK8I*>Al8UO@vSVBqmz7n= ziYt&RH#9cpci=cG98(q3hwLn?DX*@Lm6ukOS+2FVtgJFtTTxuQ@EC_!X;s~jj@qNI zyEWF;(A#2C2XV+aBNTq^welNpgxUEU+k}xu?;HSW>$nHou~3MQmARd1W~> zGwxDWQ&UxwAZyAh%NA7Cl^55Qc^!*&iNph~s43Uw6?d2qv9${!x2^*E)y3wO&9AB{ zGgQ@Lt5iHnYGMn^Dk`d2T;=mu#cIlyE-OPtNO;%QEEgV+V@X+!mxm;xDXv>q>tR}4 zwklS(vSgvhNi!l2kCT>PT2&d>4l31_)#|!aS6;HXY*0iCbq!8vmz>a&6{s(jb#9{K zvB1%*@QTdh( zo%`@UHuvG^O$^B7#0Uq=(r9TUdGnbnd2$8hF@ju5xG24xi-hRBtni`A$* zxc<;}u*ek&k?6rtv+80c^H5c4ka;om7j@dDs$>^8y=z6#cYGInw6;cW!1$s=!=i_t<%1>7%7JK zEUiL84faIgmewvTUW`$xtQyI#Tj>otzhYVK!dSIC^d$M|w3n8Z#;S`~Ra6z1LN{;F zlHy7>(Ur_eQ|>aBc-aaTp5rB@*?(1 z(Lqa4yXK)VW61>__c$iMV(w@}m6Dm}msixG-Jwn-wb8t+{Dv#q~N*o!dM|XD8=~Y~c!G3UB z;?9^C%UoqpB$%-c?GcaWIR09@A^g~1ADhu73(G4?UDadD%Zo87!#it|sxA-Znz?6O zQ?@Qs@Wpj?#duvDRAS4J)A~T%A?Gww3^Eat?jg1u>jIn|xkHTUeEF_J(SyU(E-tS& zPMA4XRboJ>h;e>31T$t(cxeZdzOGz=9rzHu73K5FmJi`xT3*Y!Wvsk<`Rq^euHuwS zzo5BQez4ZMkJE!#WfkV;Znx;R*TIZBE7(&mtD8S(i0D|RWhJFASYN+?_5A zR&&uZth1oDVv%h{tP1_xkX-Z4B%JSi#Vdx;OV=CIf(A#S6Et)vw`St)4X=eUyjEec z=h(VlqGtwfPV1t<&Bt!r>g?c^)3^Yg3urx71x9^L{WY#Au0e9)fSOib0{dCa*!M;+@v>kDEy8PB~cy}h}&rL)O03x~}eO~-pG;gp>nvOj= zJ$^Sl&*!junj77St&OMVpRSEqSGy%~&`pce7JX`)w(*FM#2N8gN$uX#(zyW#0IuzH z1-VkN{AaDCpe1E>3#&?9FLATFaQufh7%K@Kown%cv`t5+Z3&6hT(%L3&FgW2FvCJ> z*>a4;oFFlIbkM6kjcu*X9lhvV^fBb!&1;*xn>!k@Xv?N5QX1O2I&cqhXK!Z@&UuEt zagEi%`k~!OAx96F`SuBPo{`5 zcegccYVNkW_3AX@Xzc86ifK1;p)0GZDUDSWufjm1S=!|&|M+SuSEjJc+<+UJT^XH> z#pR`lD#oOlmY8H(CYeO5s~Pd@Fp>$PolIX$cE+==dxIMfvZuMbyRWOaxe15gw>RLh z#*TGzySrq!910IM9238`Gm-s_4mHWulzE}8x+>9)slnNm=Qq0?Eq%RBof|qd(b(49 z;Ht}_asAP@w8dO@?d2U=;ge*VfHCR{U>ZVa=Ug8zY&1bQH(- zO6&y54i?5sd2J2rdJ=a}Xok+Nn05vW8lg^u?mnRfFQ1R|z{_fE>+C@>H#eUjYwYWG z{SZOtT1KFY*xW|2p}V!W*;?Cb;m!*qqX*qsQ}f0lue@NVp!vGm8c-J?6dB&5vm!>P zwVmDVE_GpRm(_)yxv9rO=ibrVgCpZR(d%{#)z#V72EDs+C4IM4b9Ojwttk0E{R@xP z&|+=qX|;HLx;EHDtV74p&=R9tthH$)(zCXknbo;=ElNMpF}sm5nFX`K)Ilycfv~h| zeHzd`@uCkcLDJm45gM_qOu+7qED-&36&fDu0W!9wsXNx&d46*TH2`O8Z)=06eW9h{ z;MFw^J!fzZ#;K=XqRKJ4TUK5WO*d$`(ZEU-G(}FX(GV>q95P0R++q z|I&xf-tbF}@VL0WChJuakHuZco;*iBpOgqa5VG+CVm4 zr#rhEIna0atmi-4Ifl|$d(S$zXF*$WyG8c;NFRgt^{$=cR$bI_-K)4|=}m~PpY%rG z+1i2pL8C-p+u9Rb0}?d`X^&ml+}#<&xooK0xU>R2qvoMzC>pm)xo*&^WJDaH?A$j&{R>IZCUi6)n!{+yIRlcr6TOoE#5yN-)L28F13& zYnQI}#%5Hhb~LY^9t3FzG^|7QW^;|F*^HLReQ)_Cm!~ue9Um1%elUmGNwIHoC&C+= z*YtGik~K9`q{jy^w+iZdj&6Cq?k047MkldxQ!L(xXbK%tYh$dT55H^c3ap!zuA4nj z&uS@PgF#nUfX3T^SArH?d!#LBwtZdeNONjP?CD#h{psA@%uAtAHf-LMAR@Ik7@eV5 zyY3xy&+b|iuI}_5xotJB!!&ih)qxsep=0TDui`PiUCb3{26ss9ZiuyGq}ErGpkAQa zp=2=ht!p*eV>LFQL}Tp@8)GaeopRj}T=(wgz8)S6Eo>N<*s-Ap5C<)@y}7Bip}Q45 zf!qDM6JmD1Iwe|tUH?6~ix(O+5caTEtgi#TzneGG(V(NW+W0!dPT4}mZ;H7+xk)Pe z8MFibnB!)t5HU`RSamVCM3*AdN<9wh?w~1_w!CepG8`v|EiV0{{n9*nxU0uiyyf8=x=~E;@ zyEQkV=$dBsNOEL7>V|onG8|?m(y$?3QsTtSaT_@X7IqVjE$$U(m>sY)qg>s}jwv}b zjrG%DOkMZNqD?^ufK|oVmLLSOe-R zaywq|nD8|AlH_zqziXJO%bM0sYhHO3s$gK{<0^2hvsN4Vhc|w7k23dlt%qpexbFtGc{?L~Vz@xyFmT{mWhm^O9BSkGs1?%u(=*45M8*VO5@NNEnp zy+ont4DQBQ+J^4Ft*x_B&tPQOz*vaBqP?L5bp`(Hi@b@&+C|4YG>A_0W!;>5>Io@F zqj)zSYwGMU{UQ5Hyec%T@9gV_s+_-L%;fA&Cysf5+T75_^4k>SB(RZVcxPLaE^>ER zZn8M(WdJ1Aof-07MMm`2uJyAyY2qZSv7wv&ZVa_UTue=9T*KDKIfmPPqsQ;TyKG;t zJ9j{d@FhX#pq@;)4k({S%x2sQyP*{`jWx}&2Di;xO`YhC-Eu@4q(?%AG^}rEZ8Nm) zf!1^)aiWPkP1b81x*s;q$evcj#)+aXPE-TDd+X-OT+?eI%?)TBLdD$1Vl}!wo!hfX zbFo^Rd)LN#y0BJ-=Gdy|!+H@0^A23Lhc+tn9d-`Tn3WCv6+JmMbZ1X`R&BB`-T`9x z@$@+|fa>X=NdRZ3ZUb-aZExt3ims!;>WbcJ5L>gBownOOyY*DRobmlecPZZY95Y2V zs>GW*Y8+o6Snu$j$iWd^iq+KD-j2*}?Lz&)Yb0B%=A-PcP7X-%_dz$jylnMi@IzBL zADt}Mk(e`(tk*j^cJ{U~UhUl0*?B(Rt1G>=)N0*J_qm%4wRcxr9|w1Br(Bn2 zACC1Hv52CRVL&8!*q1ziNYKdk9d3Z|BP9ncG?jSc8=S~2^G zaVDu}Vw^lN?@^(;`SyzIG?4f1=+lR6UWb45te7V@b+$_>@?|s87fH#ok#;p~(68HA zi{rZ!J10{ZX5i7CW)~JOr4G1vFj5QM`n(maruRB9dP6q3+PwS6r}L-^DdPm`XEXB=JJm0~BkdR*dUa@yU<3*iF-8 z4aN|o-<3q1F6&lrbFs|A8hZX17nNJrqIw`3ifbzi26_4Kf&x|2&TV(aw^E`cPo4)SQ^`x_R}45NGcx7!YpmFuw# zfzimFtWppstj�EnFR2kJk-W_n5BllGEtFxm<@AM&5$cydDp4z@hxTx!?)r%?wTq^b3IJ?a=F{OQp3-+9%fE;Q z=&1=4$N}7)*qeUUJu+R-s_+YlUJCBA&?Rg^N$ervCEU5y4pM< zZ8&Ir%@BVM;*)~X5s_=`t9@6g?fxqRR|GE)Z3~xk)ALU%rdMd8yG$^Jggd^PG5Y@x?^?xK9hTp3u2%i2Z3jZB;dcVT;39SJ z7q$jQ1=UkHtRRgSl;ZT~+rO|V5LCaSOK?eGIEMnLa5Z>75XaGv0K%C_$c*~_V{t|fj~CmPOH#d6LE(sFJnc(v_*k2!L5Ob2)+m` zY9g+O{c!W5KuGOSTdBo|o2iz%!56-R@%`cA2Ld=d<7E||8&vx?KM=?bs_WFEz+42M zy(o}^kio@)@RcIJG7wfHx8m&dHh3%vL~)tyYmgpRU#0Z?;8oBVffogE;ViDF4F?xr z9S<2;fFMEjj3}VC22M~j-UknJvmy{)7;s<>Z+##T2wtul-w&$aY-vs(<*iHD|p!a~rxhQUYK=T}XcPzf~@;uPqLoqe{I5P1l z_wePogVL#pli(kXI1>;1`GN$g`~4?84D|0$qHB}r6FvD${@*3ZD^BA7B*~xSjd>V; zZW8@t@#L7pyJ+$KY5XDo_4wx9)Ld+(@opq=l$BgU+D)c-1i0GVnSFS?ua|aRC=>QSM zcsCKncOMZau{}uS$FF>FLJ6OfQJe^B@eWm%Eboxyu`Wc`Cm#qzscF_fADHkJsHO`A zSvSdFBsgENLa;`Vb(VZF!Osi!2yPO*M38lu{MQM7MR1?scLnbfykC&z$8b*xJ}>wi z!QTtMEBK+{-vwD=89pee@2UkoLFmbX(*<({KO=a$;Msy@f{O*03a$|3eG-hXQLt68 zQ?O6)BEd@quN2%Vc%7iWcmneF2>lJg?+D&0c(33?f{zIPOz@Y2FADxn@QC1>f`1bH zK=5CJA=EdfYq%iq1tdLQaFSqD@D#xU!P5lK6f6-e7v#Nhl*daki02A62(A-s7t|MK zfNzt~mk3@i_(j3pg8wCWtKioKzbAOF;6s9(fl`m33G&`E(k}}BPVk7}n}UB5{6O$y z!J~q>l|;)KCOA@Xtf0O-7x7FL`Xs@bf~N|8REHw%7E@LPi46}(IEenEX_FVgjx&_5S^R`Az?uL$-FzAgA?!M_Ur zL(oQ_$#Mw^4i_9PI9_m)U{vrF!2-e41kV&K5iA$15?m&Du3&>;yWo1kiv=$eyjpOV z;Fkq&5&XK~?Sgj-@?sUH@5h3V3;sgzMZs4D2L%5l_*cPy3I;INP~Hf^v4Ro7Ji*z5 za|P!KE)=X3tP?y(uwHPTV25Cz;AX*XM2tVz2>lfzUKDQ?dcV+^OKN=|5agvW zF9`l#@Ezg_IA)9pz7NEm10&r7M7XCAkq={p9xrrM=#zv#g9trK1ZxFX3pNV&2yPbq zlHkpP`vku$_=wQ-g7Mvw`mf#}6dck#qoq`t$ep&EV!EXxQC3sNq z7lIMY)u>02Ag}cyT_t#~;Cexv9HjlP5WG%sui*QF9}C);6H?xA!SRAo!2-cE1e!IuT!5&TFnh(3z?WC%_X%ojXMutM-0!4|>wg4+bYB)C`bdx8%NJ|*~);2VM; z3I?DH^~n^RE;vW9T<{#h7Qyv`+XTNPxL5Fdf)5HlCHRuy8-gDT@>P_2j1 z$m^ZRS1EX|V2j{a1ivZxeZdC>ew{`X~EwM zzA5;D;8DReyc07Y#tBXloGEyw;9|j5g6jnP1TPcZEx1SUyMjLw{F&gd1qTE_5X5q{ z*5?Gl69rEZJY8^s;4;BR!3zX05!@+wv*5P{?-hJZ@Oi=41^+4-#EUocXRKh3;OT1RoH5Qt;P; zM+A9m66O9wFlD?;j~0vw<_ex6xInN@utBgx@FKzOf;R}>CU`*bVL@K9MLm8i_?F-& zfNd1je@-Wf&7;U?i9RP@Y{m-3O*+Iyx<=Mj|zsdrbT(Y z`+zt_aHe3f;6lMR!EJ)PHHG1B7W}s0y@HPkJ}-DgFcWKJ3^z%T2Q`yEU2wi&tzf-i zyWoX_R|;M)_%*@r3I0g%Nx>Hd{~_qd+8pB@DL7H^6u~)yWr93JnEWxpHo;ATR|xW` zU-ErT@OHs_1s@fBR`6B9KL~y#7{J0E<%|-XBsfFxbiw(8wSx76?SdByUMYCJ;MWB2 z6#R+cvw}wi{~~BllKc{!ELb2|EVxv#LGS{>O9gqBuFfC9I|UyXd`Iv@K|A8|j}UYO zPZpdbIA5?%aE)M>;1>jU2;L;PU+^BmM+Kh~JS_OG;3tBqlU=>W2~HC%6r3kmE%-UX zHo*%8w+nt*aG&501RoK6L2y9u1HlnfTs_7LW(yVwo+Y?gaHU|gV7K5Uf;$BF34T}b z0l_B(Ul2SZ_^#kT1jAEZy~YSm5u7PFSFl2GwP2ed&&g#yxk8YqW|IDn;N5~h5#(vP z^#7gUQNeJw=pi^oaHil~!E(Xng6)F)1@9DmSn%h9uL)*H-FRjS&J`>dJXdg&;AMh4 z1ivEqO~Ho+pAZ}nw5Pf8oG8c(JDBbzg69aX6YLedRPY+Xn+5j^{!s9zg1;1eS@3Pa zzX_`8ZoKJ&Ckmb{c$#3T;8MZQ37#*wQSfrXFA44uyhHGQ!N&!k7d$NZC&9l9hH_l} zG6W|J<_UgQaG@Y?wqQQ45$qJ)EO?dRmj%BrctDVMRxtcig1;7gUGOi0{}LQ_lFL6% zFluNE?s)gWFs0X{p7XgF-zUUxbMu;-*YvH6HLO{~&Bb}#lV{~&W32w_p}o1CyJyU% zBiPNZ8Y{23W=UQ{FZOq>>EnTeB1eBt6sNHL%gU?B(|~<#!lSnv<&mb0=8gDfOUIk{ zX?v73KehW*t{693VxM7S%lWaj+$oyZ(b?Oax1e%auJ%ZL(5&UTY1f+qJ+$7U>3$%F z9dYg4G>Q+z^v)xEAk&PG2t2W@>ubRFsG+}#mh@uhBR3Evb`~&0uvON|>)F(SeZWD7$B(K2AZi125-N{`i)TsbuET(tx zU~lpUehJaog|C^r^R4WLynIxn|M=l=RLaA>V=LxmsDI{xw|+2{)4vY~g)S5{;1|pN zK!)-19rVaEd_M$Fii9CNz0R@@0`Y34^&wvv|5xE3^17gwem;aOx*MI1yvyO{mA9kC z-K#`-0sI?zBM_eY&B8yQPe9-2TD3_({`0pzqIvE{gfWkUv0|xd5Z`D-#^1HfWB4{D z@$q`{WoZBAF?@Y+@TTJyq~j&LPcR)=4veQ`8SEwutk%y^>fVAkevQIs{62=|hM5fE zKIG&7WI@AsO+C()hMRc|-yh*XyLn!(H#QfIUl~YbS(ou8-x-Dg8ou$c7(2Zq4fvhk z!)MBO44Az6(z`WLzUVsR`I3?(Z#Cp~7$M+;w|)Xi^0q-9>lO1E%O7!hSAow{oYvFL z@Pq^97`}Aa*>AX82lE>9I%h`mBZOvx@c}*%H~?A4uPOWJUho{$Tx{ zH!bVS1KX^f_}OUhk$)XM`Ul&p?nk?P0Kaq&Sg>OmHT4W2(w%BoU;f%hM~}X9IDOB6 zZSC!UIRZ?-_OLHeqb-;w2a(6un}=t*3y2)Wv5%C=}*4{;Bn*F z+mEH_cbEh;Vs;SH~1$zMbX#A!l%&YdJ$fv#i z4D-7E!hof&IJ_@?*8uaC>2jDC`EFhWm?wks!wpB>`5ZWK`t+ZeQ03i$QvN< z(!=|Tb`890zc?@*@k7_Fz4i^d45&NCfZrOL<&I^{)U=UqUYWRzzg^EXR`(-+Q>`xQ zbP)VH4DSDW5oMCzk7bF}L#%Jm6MXMHDEV$=VLtQ@%KL~(AM=D^m`}vtp}wYA3tnTr zMw7gna>I~|x|o$>t)N@hMvZH!ACQn|4lJlzmFxtu9Bk!TCP26t&Kc@4a z?#yfI$$G-PH~e=aZ*gae-dlv_DZSsTjv0>Uz_r_Sp8H;2^4bd*Abb((Gx90ag|?dh zUjv_v+&ORu$}>{E3-K)Nx2yM#JU#u;KswsgYNWRb?SbyAkgf`gJZ^nyLi^i?`e0jI z`uCxZEJa$~Hc;IU9a4>*d{}BoEt-72uHUOsb|$Ye8uepLOwC8T^G9~R7S2a|mAqm+ zDEriW@*};vZb5Go_Ef~jaIA~0pN#J#lfS};KH(Uimy&pNyNI~qBj68Ox4v!UwLo{j zb*rw6Es_sdrbulwTF0BKnC*d8muf!<1zO!{_hqr_S~E&H=hN74IBq znvAp;?H(9|FjoD}fkNG;SuVFC-PK1>#%uPlpMAD{=>b#(SmRH$=Zwg*4t|mq>Ftc*%z%jbiX>HkQ@~BFvMn8- z{KeeQBlWZrF9s1#pPQS`h(vo*ISNHudI}b>ye)3wzawL!4KL`K50nB_lf+pgDlM(yYT&1(_rrs z$d0u3MAmk9wnutfnj>rbdhsD#US1yKT7z_Nir~w*2)?LjJfE&{c_5G`{jJ9I9xarL zcTDe%@bja{y3Wp~<0TS;+nU=W?(TXjkDPIjK#4@#`rO=N?8h+4zWfB2e2ohAcp8uv zWO#69htBp2d>Nvx2eq zFjkZC79Hl8G%zwYD{f`oL(3e^x0Fz-ts>2M{TRI{$c-aD<27EK8f?Tr zRMtUY{0ClSbrY)fuNyi`Ic=PQ{~=^EHT2R+qoq*uRbv#e+FUDv9g1zO*az6}x)Kg( z>r%p_t}9`jR$@gqAV*uPxt-QkZ3X=GW75X>U9V$u{ZqVHsVeY~ia^b7bgeM;V`P&M zE&?~#y4B@r*j|rQIt&bNuyoMKEy6x9qF$RYLsanyxR^;kD}N7hBmSY;OMsVMD@^^E zC~`n`X}QZ1a*wI*%xwzsSr_|ffIA=mv=iOdw)Fp@?M>jLs?PrLd+(VolS>#NK!6NP zfUpRJ1R@}!BqRd~gd}ERQFI7NAkl=xEG&u|Sp*jZMC($c(OP#c)}?4&u%ggtTimU6 z3B(9m7wYzEwetTy=RRlVW)j-BpZEWpPjbHJdCvZv=R9Y*TL!$@_(yTF063})TWXIj zHEE0dsd!WZg;VW0NYnf2$#DamBF;B>SX@876zd$rq2~?|aj~&8V^4QNU&d)7E)kda z9i!nnGd32>W+z3F5kTO3ZQ=MJ-F>xO>|#8F03r@~fEP1B=L|u3`yij(0TeO=Wb7Cj zA5Z--*Gb$y1Ci-iY*OQ#GPo})p!vetpkDn3>J;985Ykzt3>bqr@hNChe^*ArjdO-r z0b_^c4wy~bU8iOYwpdibLFt;25FrPHw1p;Ixlz~C2K0lthFrB#N7P+&60k-BTeH~1 zQqU$65#>K?2$hg1>*pjUz5s4(5Xj*XGB&nPtQk84%n^f0E}S3`mKZ{kbhICr(~{8o z>5#`L5`Jv#nedL5Jj6-vktIUM3_!$LsLa@bNJks(H3KJui}OVr)VeXhBPl{L9(3^D|<`RrlvEOTAd#53n!7M zMwcN)P6EeWhump0;`CUlz%#-`H0}qXXB<^iYW%c)kQK~L!`kK_%0wKh=p*Sf^O}`*T=s`Onf<-lHW_A zdaNPV!h?^s!PSMlW82F9V;SDh5Rc37mnqx|31Z)Y&oDa0k21tXrv+j#TtiHRE38;o z%2=jT&|T4*SPoYg^3G=~d@=OHVO%f7O)~ru8U7YrL(u)kLX5!n%ps=2b&5Q=E>Q;8 zEiQ)Z5jVn(5qsf!#anP=#W!$G;ezz~2tV97F&l1QQ3ls1E`i%m+y%G4I0$!u_y%sg zNQCYV6oqgHiOp~a3%Xk~L3|8%i16Y#VW^<{D2ItsxQT-9mGq0N;SLvcU*rh!9Nd6- z2W}ER--cl#`eQRNN{oj)TFil)Ea)_BjJO%@Sn&khapC~n@q&&LP7x>IP7ndu$cZ8d zcao@tn}r~$2sOX2EbJ6uED30H_m;X1^AxK0(hP`m|F6Cc6V#TRf55oc0l zy6Mg#roeTI9JnrV4qUfb4c8+!!i^EXgzFU#!i^Qr!8OGjaQg^4;fWL9!R;$x$%A5Q8yg z2r-jpE>Qs2DK3EP5P@daG3=z}#tte61T6ghDFh)TF|ViVlH;&!+` z@hsea0=s9lmA+y(K*Xa0@nRy}fnpBaL1GEq!J+|fg4hOkh`1B(P^-QgHoXqxAEtO8 zJWYHFR~Pi4jUf`?3NaS0L(GEf6!~ynA_Uhh>fn0BCb%);Cb(X458PPs1YA@65pEyx zF5EcrDcru|2e>}bALg^47zek%pj*BMhzsDxi*0ZRihJM=5--6WEZ&2gAbx;5L=1|j zzL^Mjn3xYYQLKdP7Z<@DE_T2jA?}775Rbu45--6WDgFv~l=vR*Xc0ei&t+2T65K|wbU%@zCL&J(Z0%@JS2%@uA;J@ds7xC=xI+&nQC z?n1E$Zoa64TOclnTPS`B_bl-c+#<0LZn5|i+!FBx+)~j8Cr*pRD7cFS-MF(v6vJIA zYT%wNHp4wfTn~4dxEJoZ;`eaR6K}!|iBI7!*IZ;5u9Q0Ux#$nn#Zb707)3mh0@ov^ z!}STe6DJ_@;AV)$a9eZ{A~3}H1P-x=z#}dL#9GSwBfJjd_g--mJi53Ct|6WyruZ1H z$BISYUv}u}C^L~%dKz3^6u~vbYPdpN1{WWegzFT)g6k4b!gUL}r^X}bL#8p}Tew~k zi=(7iF%YgPM!@YOroat|Y`95+?wJ`WE`kda0C%)_3~sVG1b2*}J72~M1C<#kM#3F0 z=D|HhoDX+`xDM__@g&?yR;|-VQrq5ji_gK^7!Y(LibK#hp0@?WMF5|;4sJluoh2FK zZMcw_7LXDP5R4Y56L>^1L8{n55D<3|WQZ3Ckm5s$hWJ*ZLkvwKzDJxX(I?KA7!W%p zW(c}rqlFUw$?_QDnB{Q@`eG}BJeng1KBvP?H@7?T;P>cmy20J^CY5i|ws}S=AiusM^ zU7d_uqhVbg-#NT%;g|gHJ>D(K|4-9lFXzc=Olre@=c)PcR<_(FbPN zVd#nGQy~0AIP`$|B8aI(xb)HHArLu4c=T~*2Z*Iac=d_qcOa^XF!fZ;eGv8QL(PnP z9X`$d4qQ(sobwUQF*l|hP~vzxB8}%XZynl2)2`!rhxbY)nf)H`b@0DU{FhAcrK4ai zF>^W&`n=oVzX$W4qdngHFyd5U)^fa(;9WTy1yZ~Ioao&J|5Wn7I@{O6PZ^@-jm zkyiG?o2gz8>hc_=eLLNo0Keq_b%r;f{O`{4(rq6d6z9DRZvgomCI1K6-uWs{M~*ii z{(C6@BYECs@Y7Pk(N(B9)}nH5hxyujkyqDIvTw6*>+4II|t6s zi03HveF^Y6`s(K6@Z3ysu?jbz1@SNu19XRZ5X4hN4Aebl2Z$~r2J5Egz70OBSE-J1 zGWg&bKN7nL9wW5n)|Qt#(n_D@fxzk`1rJ2RL%WQ&>kncvx*v66hk)-c^vo( zF;F(J(rVxs>hV<$%{>90*i<;4)8Q0SswKWmfaw^jo1@{Wp{R*y-y{&16EPg^n+{?- z5dj@?y%0XDNhInxay0i9VD@AGb=@P_nnY_c&+p)z2ZeBC#S{Z(I9ek*eY@tp28GGK zy~7dF?_YT$`ub~(PY6Wn_dULde%}}Gy%A{}NY5Tf@cxQgK>mjkBf9&WfcHi4rS3j5 z+WQ&&Qb!*h=XIhkvfRffdVR|OyVQv8KAEn$Yms3r*(vv0_}m+aBopSLH6q=R<+$0s z3*N{;j(Z$r+*9O8L7WF^#Zm8QZeqHrgWdbXNvH;KZ-7Mq!|ne*q$cXtIU^=ey{tYNad5z}nRQ_un z-ed5S);o4Wb!dg#FYXz*QpZ`*{{T9c%$@rc8P4_(ew!FcWE}si?jbm>Q6VP01Kj=L zS}Ca{%}o!K^pjTAUh0f)u{i66-J@#m^C%XzOV(O*uO@mu9Epc7Qw7JKnkwlMsMMLyfHxw4u{LdqB%VUDWr zHSK>ep7q)8Wx9VXD9T>Xa4*;WDT>N;SLpuJ6g9_PrTbqUt7#Xb5Phz@M)%J}*jJRx zJa@hBU#4Qtb2sV!Ga*fxXO4TF?r%^rbKM(s|8r9;TdC)}TXg?sgps1@1@6td|3*+W zM)kAY+jRf06;-CqdmJd$9Od#~<4M^Vl0 zr*;2IqNpd=xcBM)HHup6-mm*NDQcbjpzhxeO6GZy`xV{as=_w759!12Rn(Tnk1V7*8q24lw$F@s?uj1j7X5Z;G)Cj94%}SB&ex@PZLL zgKN4Qj2JLRD#rC-c)*yU7&n072BSbRZU@5!MyX=7f#C$>T*bHp3LEL;jJphBZx5!jNgEuzl|Lb^pI8CaLoC?hkZ7%`%eugZo3>Z@^+m>IHX) z?(eUt{qDoMKUq;Px{v7osfv2Z-KqPt6m`J;k?xvrdi>PH~WJ49Yrg5CYZAnQQ-`j*&x~}q|!Og`~k#8*hcGB&Q!A=bt$H5Ry&XR zw}Pl7qfp}<2U7-W3sJSsiMszDP%`t?&Q#t1q@wDaGhmz*RqxEu{qHO4LT3)%^+S(p zC2mEfTVnMu4YNiy`M3eOfRNSyhv6`rLC^%De`R>gi$D~SGJI{AW-EwlBEC0#{+~d| zdEp1+nBgCaj6b2E6UK4FpA70-qJ&r={Nq3w)M}T=i}lY^lw0J-`saX>w$URBWBqd# z6(dSw{UxBJ#q)|KvHlgH;whItVp*)e1(Z|_pSUR2{}SpVsea<(SS>&q?f^^gFg(;n zSHSPukkkzJ$U|_>(R}ZM<ke1@VGtnsM!G2(v|OU0-T;CO3&p>|7fZUjxjua(5!Td zdY&VNq8dpws$|sRnmZYxiFAW_AYKnR&AssLA~_^EHUB;k^sJda(y8hG7gf+GC!Ppu zSJY^y)?ZG!GFh@y8{nr6XPYb+&n!d`UVh5M9dp#nztxoKI+j1Vm^iB4~&7MQ!qxo*b zy84*@kSj7@{l=x4O^72+@gCPWa{~yO?<1~>=2al1#r~};)x2F1kGj&$$3RHC{FrNo z`9~0AhNEJSyE4qfAY=wlxU$VJK%`N~?_4?N*C5Uy;z?JY>6pM3`@QS0=0HU}?RwW7 zu83z`e>0O6@vQ4TbG#y+bG>g)SH$zK56nVE{K561S*nN^TpebWBKEruCtn6a*6k%+ z&+prjyhYImK*x0?-=OG&p!;+r-=*k3g2vI@6N+vJ9ov!of}&pr?d?cDr07>b$8;ng zR`j1hdpeT8R`j1iyE~F&&>ylse*x|4NRC(ZA<)i_qx##(Qkns@lo;)MZXPt_(z(Y$KFLZxl@uzYow+-w1|JZ z=FUeCCJw~5pzJE(~A%?pZdQDXsp077ox;vL7$H6Y}UaIoVW(}N9~BoZ9on`1#- z56hqras1>z6U1#q;BH{u-=sEjNjQS_-vH_j3LA-I*T^Ps6pmW`?Fb`drjK^`bpJb` z#=^Mh$#}7=|2QZehD;yhNYMR#r((H)jk-P^XJY=5prlEf=eSk(pQ5M*jy7yD6_w|> zOZU%-Q1@bMs;GPiHhG1LDs*6zSD~o09N6U1ajsODA_q2kYY-->Vh1*PS1GE*u@CDx zMU^`C>;8LHE{hxob^kMpTI|3k?_EVLabT18ca<&#DbXfxzuE{a2ZJ_w->Dd7Bu6mZ zID?SYSOErY@^IIQ#V7}ZHhJR}qXGY^!MNWnKNxj!K-*-^Q41I_&N5hjys_2K7hpl3ga73))NT_`H9AT6&%>_s! zj|xtK{x1U|*Zvbkd}QrE5rd%uA+ouXFc{W>kOp_M2$)xaptE~DC`OyV03o*s3&c3{ zb`begodPk@d=`Wh|5+m4JV*pJv`EY_-v%LNS0ZMaM?uJ$pj4b`{#_A^#B9x-gsftw zgXQsz@X{iR>f;G$-f^6PC&}TRto$QgTGH7_A%$dEE2D=IXgp{5mSJF~>Pv-5YjZih zpACT}fXjr(90o$R>Kuq=RD_5(Cq{?_^VA5DXwHfd*xp2l(Po|^mO(7V5dzC5lB4@4 zR5bBtsPMhIzFC-;BZeHWSD;$gD`Kl?@rR8KUgl;yfck~N{^tQilosYjk*@on07aKE z^qT~BLkDn>Abad)F-!L!L7220w}=dkEC@kTzZBWfLBy0D-70dh8wMp0r*0Q{y1yV5 zYecd}ZK6>3mw}QN=MGV#`zsZ7r&yxI!xO1P{$gVdp+jcDrA$_ zH0jJyhHUZr%)cRo`q9|tjW<2WRub2E6U+ofT9da}{xu7pSpj9WnaCz=-{J~iFA)jP?&S`n?@6!R7kvXZxZ zQ_Vdf=w#Bk-;2u^bXhbu4UX?~RNiNld*x_R4dW=#1%=2XBEtkQG-trY<%u=m`+5YwWRS67i@(hzH^!8DXf>q z375}Q3T(LC@#Yj2&Ernc++QNAz>jdgM83wIPTPre7i1|ftym6~qq(W7?$PMC*zs_D zhmo0S?6B2wC)e?81RJ|h$2Sl~%I`WCE?I=Y4$vdokAZDm>9WeBC5 z9wpNm(3q)MP`G~upKk?x3HqOfl(<~C9D~F0sm;6&l=bD8}Bf7^fL#6Ak%N`?5CN25OTM@s~<8VH9ck5X$bq5b>>e3nxIX* z1+19a^h9{vwQw{yU9fi36~1A2QqT$KuPKZoXl}ZCHS7^$C%C9)aWaf%3vJk|#5Qeg zDj<%E)h2yTVJ{jo7pwGdWq$vJYjuarjU=Z{{D~s}QZi(<$fr$o&%}|)aLJV&Cb`3g zfE%+@r`=H;RYP9W&{9qTTOSew{X$Co>*sz?$wyP7fem16pldc3`Ad*jN|G+xSr<;g zvK~66qV;nJQ}Ab$IG#eweN9yx{3*!mDD*oD9Xu6RU+98~^IOun zv>PcTUN1qUDHU+A*3qWYy4pERzXOn-kNDS9B)@D|dNpWyjVV#m+R#f+u__|3{>(sf zzWS4}0|At;qUmbTI;NYUyL9Dgr=*MIl_0$X`7?=7ahZ?0p z<8W~qRngBqgDN*$r?6?8!I4d$ty46sA#<#T+>bEX@JyXrp8g_eDVLy3n@;zW%7$iJ z4P6deHZ)7p)2YPti@~HTkj{-dO_o;csZWRgW`gy&hwL(H_E6g1Eh7&#v<)69p*`?e z*U_{DlE_bzK1*JaD>T-!T;fr=A$k$f@|qbvRv-mRH>-1UnQtCwZP+Rj*yGOUQDWRn zaA2Wg;k*oQERCRvEfissyzVH&rTjEBMnAWdNMQa4}ji5^j@8Y!*rZRXz6tO zEFH}_9R?j3rQZ&kj)0uPkY`6jX^U5bm_sMQLkc4sdJ{Yev|@e?9_!-e5WN@`A~E4| zq*SLjWSFH+B-~?^nmi`NB(oVu9$G}xGXz7oz_SD%nV8gxGJ|fOrkCuI6kYGM5_W*r zX8wZY_{k_FbJJ=!mhLW^crP(0k-dte5N+6FVCZhIR99))rSXv$?n4y8P0QP1&mopG z#*m%X0=9KMpZZ916LZ)>%6Ebxvyr(IS98;iFK*g*xF0~O#A*oGryH|8=H2Kyifo+W z(M+|PH0F35rdmE4xgL+H)^^51k7=rntx@RlnGYZXs;W`!i8uEvVu>fgd`l4_Ponvy zBC0$A^MoR5J)`Al;PNk@c$A1?LWHV zf_`Mv>4)s(uZ@w?$sa7E`u#uodeHyvV>s5+i_7eJP<}xuGpi(bQ7}}LnLjVc+&N22 zg2kcWSxnB&Eh;Wye{o4>QAuw8JSKzr*%2bEU}0fiuq2qR;x5fE$y}nz*XdXv4{X$O zN=gbti-JYPxdr*5v`}g^Bdt4QiuDOV_04XXI;$W*KZr^rgRH!Q;-Hnn#$6B$7KSqO z&?+l69!Xt|Z>7=q>Et&HON(*~i$l5Dc|pzc76*g*q2j#E;+!6gP_rB>JMCg}LR%Tw_oXo5Rp&-OP zCoi`+$C7CzAS*8yIfiVF#)HfSMcq?#q`A3yCBdRlVNo!WU#}7WO=%Fb>{WXWh!>(B z>7H3pFe^x+@754zh6)QT)v@OzThePPZoq#`ytpX0BnUx86m>%n9Q^k&PErx>pZs9S;)0?Dwm$7%2uG8(iS&E-INaj=;9?97 zDc9V5s8D`MZYB@Qh~UF&QBYElRgibmatjKB`SfgcUO{GdD7d7gC{yJP;pWa=8p;Y5 zl@xccM=xo(YX3P6M$6oSqJ^pu%AE{G?%dq0Od9mvOX6l`7NVBW#?1We;+)I{!B9>x zGdmbP9t!ed$`(>1&?K@S1q(8xI-B!@fTN-omlhTl6!nl|VG)ZjH$PX}$cTW$LD?8s zMFmj>EiTRtWfcX{FWnnN{9Y5x3zmdRa*!e$2Bv$O%(lxO#nO7l+=pn4pFD}j7NMZvR5bBkc^3X5_Vp^>2l!5#t#6$UXp zNpMm<*_wB=8!(2HTXt}6W@%oumSxS$?Or=DLNIj;bMt$uJB1aOV73ZnXO?94OlO64 zo5CVpX|s$Z2JY1PERg(6mXu^><#caJDI{%u=at{PfzJS!HP+$V%L|L=h34iJEDn|C(`d(1BFwRtEnyNB z3eGE#_8=066r5@kjzwbW#+Zw2OuEFa|_&elY0_OaqX_X@Gk zpw?SUHfeIWo%Ur?cUCAfe`!druxy5mqo^R;oNmvw5c@8yv|y64VSkvPH8?tjUHeH8-!cI0x$?xt)#*Llp3_*DB0hDi`5APjS+$ z%zPT6OGuJYn?if#(sItWlRWf7n32Pij6FQJxOcv)L-*<{ZugpD9;6wc7jO35IiwiI z&L&*uLSJd^Z4b%MT!{ADQqfy>Z67X=o^Yt^O9~cXS5K>E?8>zW2l^DvvNA4?iipok zm)O#wT72waW0n@qE5b&@#woyhDL3E7$S%s9+by3QsC|$QTOxImT};cPVjC0YDXlv> z#YRf2jD4GpMGH18JtEoW7vyKzi;+vtNHCF8pr|D@nc7R1Yp));F;~r*;bmU;3`4nd zX?TkaffeOs`lvelWC|G$FW|$AD1oT(UX>tNlG$Sb1eX-z z>@&J0;L>J0nmxCuU|}?mhG%aB5By#$0e)%zzaP*zI4uc}`RMZUa`PAT;GIMo3p241 zDkxfO~GX%=M`^%%$4&qYUD zycnC&-sOccos|$ZO)L=kFLTJxyTFU7Dffo!GEMt z;ZDblf$q13V0h4+Yva(_LR5{Q339DxP58VB!t#rEF0e<%y+n{_PdKfBKJ*q$Ylfb= z$|XThHk+ZI0c=-$2IS7o>^3oG6_j@CXIk*k{@mX5;sv>dh27^w#R?VEQH3QrTC*Y+ z^wYW;BZWuXZe9^BEL~DslqWapO?4Mkt`6Z9`IYPF$^#A%u^pF)A&7%kF!He(M@`9V z9Voz)9h_5&3qbJ6^|6&g9k_yv)r<_axF@SccHim8XB@Z>H+MYEDyRx;Z< zqmXYb4e_O+kbI47%Hrazh4KoAEP_PelO>PI3i(_Z(djY^wrgZJs26w@ zWu=SoIU_KXkiuoricF^EICPdn*MfL+VB=D!+DKa@nDWK85ZU`SmbHh(btQC)bx4ki z^Jyx4k(hLFMMqZHX=QPK*0d;h8a+AD!a$?)LW?uyX$?)?axg1d*n%w6EjLD-sZ5z$ zTwIEye6@4>H$hW+38O2G>S_*J)vYd4wWP?qvn|Q=sEBGpc%9x`W7O^q8?x+NTIpe( zg9A5v%~U?cI9)Fe%_|B9Y3U6ki5=m|=5ar1KL1Q+$f z$HI)R>S6v^H0|F67tj?`+hr(g&Q{w+Y3Sua9BdinBin85+q*}UqM&XoEtxx`m*S`a z!K`fS)U$h1G@!J%1{4LeA!MuvWPuHLHOYYGx=XwkHSd>l#0Ri1T~rhDz|kszhg-uks%b1 zw}^0VAuKrNt6r)yzm&G%u<&GGc=GJ2ZgZhR@+vr;6)~?pd@h)(@(YxH52{n2lwsb=EwVL&MZi}Ss zC@>_y<0F0aitNbk9kM!--&j?*7W4bcIxB&d3vO1>mQZ?Lomep~o>qTB<$CE*sYJ-y zOOGs0`ebp^7s;`ZPE$F@$~E}l4y8p&!9}>rM4MM?9x>!0EWfBbD^n|PTBkKsuB>dR zTwRVuNLfw&YJ9AxuBndw&PgnpIKwc zlesV~LOWBFi-@Lm6i9=aN^YnrTVL6rHOTuzP)2!OLq$mPC>BgZK~Z)nFLNnoVHu^? zg2<%~+DGFymNIZSQ)}X863X}1%bF=6aP9bTT8Xn>agzz;)!zfsZm+z}QsESY@tEMCi z>6Q9JJZep2RoMlVRt%;86jWYQiJ?S3>KZE?14?@Ej`s@GftgLAl@=S{1W;c3wik6F z^&jOyL97~FSH-p3D1{eZURYw330bXa1e1_S#+GV_=9cDX*`ss|l?I}!q5;dw`t@3~ zy!%KitC9+=t!=E<=p$9qAr)H%&1#02r%nkqAy$Y2L->vuD15yO>(9ECE9uK+)S9rx zz=(#Gpk!&&5OFodl;jLbCYP;brHD;mKWoIduriB^GMB<4pBt_$9ibt7*vtAtSs5uAjl#+XjQXn3+Oq1VP)#*tTMsp;#fJz&s0sS4 zu}Ukes6cs*7@rUyeG5XXYp7mTjR8wWqr9$0t6o`FUa7H#k&0=hwB;p7IP7Q$onjS4 zUnZc2N@4Ug(o&{Y6p|2pB!QK6^`v_EQ{gKstXs?wg8qZXS|JpV`UYw7B?mOSv9b~$ zcx!G5C#+jZfl}$MF}AW=Lno=^jocwrPJK-oG#*vJckCKvT^iRnHsKp@_4t6A2D=!N z17B9js$j%RWt6R6g$gv4L62x?$zyaV;Hp*HislLo8Nf;_JhY~)rW!F|d@Nr%zJ*s_ z*SxwZ#NWunCnrKp4eQaHjn!CZHd0iIL?v4H{m~~KXw=riR8)g#qCHm=RMQevL*<3d zm5p+kl8Hv{-S5?dIaTp_$k;fRU4n{6$FXrZPKatGwUs6gs4Rqt0RWBFnjuBh0pn~P zK4b^6k{+OMFe9Ooa*JG3U0V%lHIg+TB}5ETP*_OlH(F3uL-Pf`#$j1z>kECBLWhf5 z+ej5{CgC!MU@!4mJx~=5Y+q@nlZua4_QIqAYR!gZjLWMk%P*kh_4r&MOdSiTvHBt! z#;OoGyVaI8UZB-eqWZG+G<}nu?9L#Crf6h>pt|L>Z)j*-L;uh=%wVC~##NU3LK#Cc zGcvY3Up6v;rj52m%RRRM}7$T3v_L zfQGwVr71(Jsb=UeOV7x>VQQnvVzo5*m||7Ckir^bR%@*}LykVuEqsZkS$;Z%I=QhL zy{*-)MUBePL?|B#G$dPsl|?0nnT=ClTV4r0tA!b9Y($b;K$$g?8mq!>R+Cgzr)qXF zpp$u|$nvP7kOxUvnQcpf!ng5;b%=A90~`w(s0!(&93aTErVLr|+&7~uU`C`-!RJ+KE$X7`daWLIuA))HsSHgc_^_tL`nsAL*gI8<)KxjGSli_c z2NNy>?5134r)q*+ddXOpL7{<t_zXM%eqOEV(}X)n;Xe; zax~})%^NVV%#drz+RBRRvW99DVNKZ9ik>EH*%DcOIWODVk8?rvBh7UhKIVz_f+btF zJL{ zdrc}bOoo@+k>+qBtQ%3?Zjm)o8JzXj)9TTtd6KpUjA}unc0rl7f&hZK0zC$w>_hac zc0pxjJ-T-d<`^gqZKsqmz}^)P98_TfL4Q%B;b823Zvn zG{#hYJ;Z?>5A6sb5&p~+Yi^{XD=NvTRbc(lP`4hsp|*o61}~Z#%GQQ^idiHaISzPm zDXS#&YPOygkfW@=rkPYw`elzxno7d92UVm^jTKsf^{e~}FV94>1G>eNORWaXdsqXn zT7`jRrAGU?37T!S0ZU|CdQj0e8VeRFDCi?Cx*D*_f%$5niNrEO(CUUY)tIob3tx*p zXCv)ovHi5>KJ20?Lo9-5B_Pi!%FECl_^cL|>#$JLbkJxg+bfrfG{IHFB4L?>c>p_( z3T+ksVUJ-LE9z=_SxDQW@Xu5t*L=_;8LORCA}sx zI$=Rzr&!)ZB<&;RnSt8#;X{DhoZJFfcX?m{J%^S@O6|#()x#LXah+Ua$W0aR>WE|Q zw$$1KD@SZ>F=}aQ!a7858dSw;70qp+ZG^1>vXd;DH})1mDaxywS6_g7@-Yifn`BSr zo|^U+Byw7P)TtZJaIE2y>4yUEf&QTv2CDL_7;X zS`qUh1xiM#2I~;okI0crt;UW5i)l=ewHRotn-ES@u$CRA!G%huqFhNvnnC9&wHJ)>+K$pB3&tD*i{AEK=#MjXswO@-`YYh7QV z(dhssKvS*#Che$sOHf^pH{V)1i}|sEmKz~x19Mc*m#+w+`)HG5ty;)H;S3fFYPtDP z`zVs2je-6t$9Bk4(6z7@p%pL+)>H+ffJL^|k7xr=#1Kf?8v24e)6$Nus6*qpCf4R# zo=wW-hhjrK_*Nv;o4XTg04pnp9Z5}|VOEx5G%y9*M1w;sw+Zcd3WJnv)G6}DE=;vh394fcIm zdkB>hr|PQCoR{s>sQ=+pnbdkZHno}u?^6L63^opFwpvP-)f)$n_WkgHQ%JK^AD4VguQrj@vRq>>Z zL5f8=?p+9HE4MO@I7jKZXn{#ap1kcM-R(wO2j3BK_1<7xxV)SaF4q=dmsD@zb}87B z*@Z#YUv6$}ds914_DXd-Z-ddw=rL$br}w#JO-aGPae3XD9zDj0)B5T@y`Rw^ul^f|4@f2GL-e7>aDAjc z29J&V5TCv~>Co_g!3}XH9%0uK@vnaL=y`UW?^^u|V~g1A$d0>7x8Cr=5$KWh>^RT0 z`qg+Vuu24^N7V7ggYd5nK3hKB%Am*Bv*QvdkFDYg#}?;imlg=8ga?ncM}?yv4()p< zUh$*7fKXl6e~jxxfUGq9>;I=G)$vsNWDLLyCgZwiZQbhib&YcIHre)6`egM~`sA8w z+web~n%@vhE9H`Q<;QuXqOQ}zmNgeD^sIlUL$*Zv! zT2ncBYRZ(9Q&Xl*#u<7;U0u`U=Eg{c(7H*Obeq>rqEyRPRAcoYoVkpezN~xG|9>d$ zWLf;*gu09_Lcs9gdl8leMT2bpky1t4&EJ%2M*{^v`G*a*JECHf)C=V0I~gEz>SV>dcyi_m=Mumw)X7SG2n@!=)1nok>$ z!Tw9;8?bq{YCdP^&N<%A&g5L@5XkEaDZK>OW=MIytI(MurfzilAW*j}&ndP#lZ5vx ziXuMWfb4D-5THvO-LTP_?h?0vihJ7W&OyPV>M57_al=TSqRU$ z!s*!bj4>Jld}o8K*&d{GioKViB{!iZ5a}L#bkiX&l$n2s%q0uKhc-k@`7xn8O|KXN zwHYZcK;Mgj^S3zrJR_T7y0%Chg60JBoI^wm>R#v^dKIZkf>aoz$m#NAQ4q5K_F}YC zTT(mk>7CSNAJ+0_~(Hx2A#}w0qAw0@lGol zo&owc(4&|h2l{!?ex`k(KL98|{#nRt4E|O7j>1o}7|QXNfu64=9H=^oW7nMJ~<4*l3{oJVVPowDbqv*4u=)I~uia~zPK#c5MfEEr%+jbW4av=9G@|k#a&g-xH1eeP|Ey;|Y;Jy;_gTr}h$`Y_5P&Swc7r??NO@gp3IL zYFY)M4__N3#7jZtPt^;;sG@REDcPP>>)nu)?;hf3;I+_%pg$r+eLTpAa5N$K>4ce9 zeXV2~8**!1f+gE1{5$?pAinA?~noGHSHV1f%HauAk5cK zgm@L1{LQj}UJdMk_Y_P5ghl{<#&a0g5GGllZy-EKH2UKU#_7nH=px2i#%+X<&%=y= zWX#1lB7OzqWsJWjM19_4>?16CHe)5@uNYru#F`nOHi11OMCHkH6OzR?CR+0a(Ibh5 zQKOd=5)GA+h#@60gK;in9%B(B=^3R9F`m!Z$he;IGRCVI$?j3Qn;Gw7e2DQ;#wQt{ zV{B)9o$;@XA2NQ*_%-7Xj3*eKByW@(%ZSf+N_sG(pK%o9c*e<$r!t<-n8`SgaUmnE zDX5&Kj3LHK#tRrPWL(R53F9WlD;ak%-oW@v#yc4AVSI@3QN|}3pJSvKr&7IMW_*?L zZN~Q*I~hM={F3oo#vd7V(o5v$X6(Z_fN==p2*zZ_35;os(;3fT%wm+|0{Is(UCMY4 zV;SQr##+Wk#`TPHJRzSgOyd|v)_WJ@jf|~~4>3N<_$1?Vj4v|2%=j*22jj<#pE1%r zNpkw0@n=Q{jaTr!j6TLejERgR8OJfEFs3ukWXxcsd7tvlV=Q7^!gwBI1tYBkD1JTT z8paKb8yUATUdwnr<1LJBjCV6W$oN~vXBb~%e1-8f#&;M$VEl-Y)-6=O7*Q_#WdC#$$|MFn+`MPewX+q5NEo zCS!lb1jgZvqZv@2IHBG*^KiU3mF$NE@NE5SjD)Sv5D~_#umma7_VWxj`1eO+ZgX+ zyq|Fo;}eX}GyakBFN|+8{*Cc4<59-X8NX)yC!_9WIWqQT9LhL~aXjN>##0$H7;_m5 z7)u$?VJu@@#aPSO$he;IGR7^8S2ONnypge$@mGxZG5&_}amL>>KF@f7@lTAeGyawF zL&h$~zcYTvc!CjMFOd3YG7exI!Z?C4nQnF zdl~mLzRGx*@fhQA#-A8HI1(beHJmY-aT4QcjHQgr7%LeY7%yYIhVetj6O1lwRH&Rd z#-WU-GR|TQG8Qq07$0HW%eas66~=cMKVm%2_!Fb2k5zs=V}NlY;|#`Z#zMwrj8`ze z%XpaaGsdqOe`GXqraE+_&etRp6QpEZfE+hgvjSh#_t(*oCy%$%Q%2>JmVC`(-{{qmN1^n zSWbxgUdgzdv5oOz#-|zE8Q)?2nDHA%17{SJpO0}k<3z@pj5&;p7%LbX7+V;xWxSQ~ ze#X6wFEPHsc!cpd<1HXED_70Am{C9L8eC3dUx} zO^mx3Z)bdn@%M~>WPF>ki}7nlT;iAI_hs}mPGCHZF^92;F~nHIcoE}f#$AlJF+RY! zm+?i$*BC!!{EYDjMi&lhNInA?lNcv6p24_)aVcXh<66eejJp_bV|;*dFXKy$Z!jKV zJkIztqe*Z4Cw*lc$2g5Kn{hE?IpZ3}%NVa=yqWQC#=VTsF}5?l%J?2*C!;&Ts!tr_ z7{*k_GZ+^zE@fQB*vz1F@DJS8RHL(E}R8R zy<`k9PGX$NxSX+?aSh`p#+{6F@qEU$jGGyEG2X`b0OMZ97a3n;{E+c8#vd46xE4V58^kz%vj0T$ap#94#rl-2N<7ZJiz!SV<+Q37*8jQ<4nc{jLR5n882nr!Pv_90OOO42N>UE>}320;|az-Nn8)cX^gWO^B9*hu4HUv zY+>Bacnjk_jE^xs&-iD?zcC(T{Fc!eY1OAM<4DF+7^gALVGJ>@VytJpgz+lI8yW9n ze1!2?#+Mo2VeDf37o&TWRj+u)B*w{%XD}{cT*|nLv6*ob<1WVA86RT&J>wr4-)8J$ z{F+f8&2nP&GfrSUjd31hDPuX~g^ZUmZfE=@<9&?3V|&I^4>10L@dL)#@m9V`jMEwEd-c?wMT8iu%bC7_5Ou0!`XZ(;WqLay z;_oKJSZZbdy@b%^-!lCSA@X^i=~tLO#Pr{o{*dWU8UI0ue7<8m!Tea%mGbLLi2q?s z(>LvjP9;RT(-?CZmoio}u4lZA5dS+F?<9ooKgjf6LX`J3(+3&fVE#Kyf5h}LroUnO zd!`)|tb9C#;KdW7O+%RPXMPGH%BN4%6J{{xG8QqO!*~JX<&3)+Z(+QjaStKNeU z_77yF4+s-InUOvlOmr^eBF1vYdd5o_uVTEB@h-+k7@uW)neiRQF2=7IPcWLPR{291 z$1qN1%wSx|csAoI#wNzg8Lws3@T2kMVDvDWjM#Qb{lhX_Vt^4zBn>kv5o#rI24TSZ z$|qq4(XfZvj5&m`i+PNNgs@8`j7tcS`7*}kgwX#AMp++>MOmMKbw7>)dKQJF9GM?z znIFnoPJGZZJ<8d@bPFNMxs~ZQLX`8G0Sw@icmjz0o+Cs)ZxW8uv;__z(s`Xg#FvlY zgkM2KPaj1+_oSXBq9A(8Dy5=wMf0jq*@_kPL}m&-rqTPOR{SVc3LZkFHw&HQ0jAo@ zT6(m_{%lmQ4`$gO+)BwTT9{JSgy(lxG}9N*Qt(_d*Gj%Z1{|x7c*Ivr$x9(n4<RaHEI zXjS#!#SPKZczCX?yb4dE(&L0FtLvI7Q|9HDPLctZ#G=~%AD;7y)bc+?%nQjU#6zK! z{}5BYVh2w{^?ZWvWFnLg8CWkqusxv`sha9#eoV<8CsM1EN8*m``Rtu6!O|%_-cf1S zIP1+awg>HG$Mp7OpM0H}y=zuAm*JVT-k;#3L5Qaf?FHA#mjgzgqaeM8I%p}4>uU+A z_B2?#KiFsKe@fbETKEY-W}T*uE=xI$2S`fV3~h8p%8W2MUHPU{v@n%6P4TBu{4kYv zDn&b01*WAFnI0ymD&JH}1&W4jlmbTeOZXYVlXh<;h8*K5X;Y}sDgQ<0X;$3u;Iru$ zXP$=lp~)w~@GSFMdSOU;JziDVfP`FT#78Zo4D0C0T$i1@d9-kq5nt6=<#$6=e%r3H?suj9s5vUXiB^8$c3gw}XueiI zmEX9i{BA;iG~ZHwZv3nKen5Ksh3mJM>ql|ur}CqF*zE1yW2+zWReo+Ozi|Ebaegv0 zTYmq7A3@=A>7G=QODsoJ<^BNLUhY0yxwNiPLE|6AH|`c%J224{5)4j`pw7jC>`CKWUt>k~0s44*x*~tGp(LVC4Ul4_MszC{+3cC$Fd%5dS?p}mbduiQD z^`rWx;a{bJR~v`MieB=Yj!5=+6Z+zd&^CLg!luGwFE@3&rtJ$@<>DANT>5?~f`l-`qNZ)erWq6gp^)xav!cWH&6sn#?w?Ien zb6RuUI2l@>G3gU6qwR2DdCQUI+M%u%Ut1?s<%s5c>F9Fp4Rlk>k=dFLVf(vK|Dg`8 z?eNbhPW+w1C|*Y4@*}5dg`H4qbjuYT8qzxhkvLARrGw&8`rgt~8c!gI^4dCOzP>lQ zMo_uFEgds_mmit!(~m6o?MFTScl8;L^#9ws`~Qo$iT_31VgE(kq5nnPA^%0(gpj_T1lcykOENhYl?~qP0O6e8;;E`nGqyqHXUQtG(N`A2SdSE)R26#HK3OEy30Xz-395@5G3^*IO z1b8N}1b7Cp5I75%2h0NI0OtU+ftkPzUJX=vlJIZK98SN;u6=k%e4y~wTJL=SmI<}*Zt*B!=>fDMtwxbQL zXk$Ct)QUE?qm8X-V>{a1iZ-@G2Ca}$JLJ&{8MTAg3K_K{Z7X=~D5DiJZbw~OA>($) zxD_&Phs;}%wjF)Yiau&bpR}Tn+R;a?=%aS@Su4tDM<2GLkK56wt?1)+^l>ZtxE+1o zin_Ez2U?*c?a+x<=tw(sq!l{S4xMR5o!g;9t zba$2%zT362J=hrvyxX<71^T%M{{i%GpsjOJ{kvVI%irx<+R@&%xDY(wzOJNGJL0vXPT{+}!vmXQre5CR%4j=`b&t2N&o~mdyzQ{FqwTP0X*=8( z@!mUe;wru0RULuUU0t8R_5`lGz3Wd;o1O7mTjwiJ=XJ*H+|eQGJ39OLT8@Z)$S1Ys zNFabZV-BEt$7NXg>HV%dD$=eys{2ND7>Gk*LMK%jhHNhH z_}hsSL&w#(b&3|M*VZFKqk3(P)Cu`fePlbsbwYTzIzir1b#fJ6d)Sp4*WoNQJ4EW1 z!!;<^f%<9t+75Sc{npC*LFV;akId2*caBc;NcpO|y^FfdLfzt!hRXL8qJ9}|hx<_d z3Z1eJPLwNUlbYONAe{KbbGD4?=v(MM;zXTA>bQ>15y+$8#-pY$1#@^(hYNjbE^j;h z5&F1u#N{1UT_7veMWl9g;_Fk8mymiu^NFex$!jlk|7qy=zCbH%)HNLkm$za*zqVt4 zeQTEy*dqJE6S%6&UB9`*^j!rTbrtlwt#g}p)v*ldJdK@0hqfO%USQ2pK3+KO`OVap zy$OZTkDVAvs+;Y7_>z$XnTw0rsIWpFfv9-gil^i~H z;>673Tc0_m;kRec!!4;flRnWiP-dZ(pU~b!dug5YCe|yoW_c6-{ouXXC4g?A1Ly)e zfli`KP}5SQl>Z(uL6(bkFUi`OJ@g zqr9{|ZJh}jR{vo~-l?@<-HE>P)CW84{pImp0s9o`v#t6q=&uLRU;7VNY43;ot4jM5 z&6fuCm#1ZGhf`Z}7;1CMp*AbtQP>;R1_$)egS0We_t7s0AiMX`2L~X__t7T@AlLWN zF9#r3%Krdl_denufGm*)=mW+A2LnyuAYdQhFrW`O6zB~gPU`#Ug9BYdKx?T7y7a(- zF2i@As~^gZNBBU5_eXdF#RoqQarz?80Pq6Z?a&*RKgN=-6&`j&ADa$sH;(Uk#zTE^ zlWy%br9S>9vE}CV8_&Mu?|)tW-qXW&y!HHwc6!GWh0%}pqR4}Q9^2LB#S;pUZ(<_M zz<(kB5o-frv*m>=e=4tRP*w(|91_leXlw&00|I)wMc2+IxE22n?Q6a8c8Wtkl^tz) z=(xeD?GBu^TPH6@Hcp~;2QE3N@79S3;NMh?-LAsjI&nthKQ6+(WItjPZyf&nh51gz zmO;dxi2nhRpi3S@5*bJVv}qd@4s=kua5#n0rYRv3e#st69F9SubX+t{#X$PqA}SI^ zn1z48igd|7WYQxVMajT_pj$M`(1^;AVo`^T>=yHqrzzLyxD+o3|H(b$Qr3D@))X}l z|6~6@_TB`(s_JSVKIiN^CO4NGNFYGK3k1ozgb*+SDry1=5(p$DVN&oWBmq)G5;HJZ zq7lKOf$C1kgmXSfeVwgG zSg?9M!g(KvMSCYjh%h08CWNUUfC;6D=Ryvx2p4<+F73N0NIW0%Sc@?IL-LWnK}PEl z3O_Wn_FEw;S#==H{IKk#50N9eZA6&$p*gniq%Fyl{5B)Z`LH~tuSM9B>IYjHufM?eH87;u@GsB&Fn>}{z#f?@1RPN#@Nt4 zgqn|_F^-w|*4Wa1gykPWYwho9z1m}24FVi)BYlThw@OCR}ilIB;}EFNkk-y^E$!}pQuRfT{KZdC<=4}Vaq2d6z80H zsVLD~2seI$Qnf!zL&eKQncha&@hOu_&P^2TU4)xIb;7kj15;8oT=~O!k9`qOUgnZl zrR1ffzOL)^b&lWH`BYzf!@ky$zWQ{BoWm#~rE?(M_NkMw{VDn)Wu$x_gs*(sWR!DV zL`;h4L)iVP6SMsYO&JlCLh?nOou4v6IVZ+TN-0wi?);QV+J2Y@jhB^jrXhU&6p&TU zofI}5;Txxf!0m@%a*7*7*n297EazBCO^GuQzI94S-F}e1O}Qy^Cc=HEg4}X0j)+dN zvk<;>N{HTmfF_R!Pr-8#_MZa6bIy*Jo|5MxeD@TPzI|#h@hSQggojQ|@#V};`KKa0 ze5&fuK4pha1@aJnaEdA+r+?@{9SRU0JyrE+&&42tB2;1~!eghXB65YWb)g=`2tPVi zb!pE*r`XC+kx~RKAl9QIpOUl8zIMrd%(z@aVzi+q6$n2*HMMEaidToKEJFDC>7kBX zU#QO#gkPL4I<;rw*%l~NiSVn_L@BxcKriZ4gYfIqMX&Y@j4&uhrB)(5ahfP5*C$&y z>Q#^M8YMv z->Bbugg>0FI<}|b**qxNf$;oks-#^1peJ?Qi15Pcs%Lu&Mko}elA95Zou-P)_0iUq zdTv2De!A+~9zdts%2Ls72rr(V%5wdT(UzL-MCd*}wQcvst4mdHMR@JAp{`tCsqZd? zKYmtpZuj8XVJO^*@Tbp+(sKQU-qiUngf~Acdbc|;!l5{o-h=R$&xqo3eYSO{-g^=L z`dQJvopovH8Z2rr$UJ#9T8jEhQ2U+Vf6!s&W(iPM+Tm3qF5 zaGG2h<*1FhKe5B1^rVgsycq-!{htoAl{HQ?pe=3=Mzy4dJ_I~Tep+ZLcNuXSQo9s{ z)8u}dyhIf3KWdhaaEjiS=jh8p$VHd}zx1flN1ZYd@F@AI=$F=L>!lSn;tQDZ{O~EM zl^k7h{X}hY5l+#ktE|x!@j7ZU72#BPs**z|{@LOkJ~eu%Ljl66@QAB5R3eXeN0p!g z#R&JG0)xfc5%O;VQTZu*1;Q!u2LXA48u1^By#(Q&PnqfI^YQ;H+7VDbPkCz)K5hRn zviv*p_p+$K6t*7W)AskR=-(fsvQo}ggiqa{45i;je1IaZN4Vt^^jrF97q55YhP3t1 z^BpP5M=9GzgdLxte3n1LM6X6s6h)5J?7s7^* z$yD^I6LhDy7~#%|z9UWf6y>-J;p2J}hUGtf2tpzDB79u01+nI-cw?~r{Rki1%VDHn zMEZhFKZ4Nk5%>jtApYG-JJOX8u+4)AAH`dbtp1L?J}TNM8$68gQM}s8>RY~sE7~60 zdJ5qqc_EkV$A~@I%(Dm=f5?7hpT)oDZAVb`8Tr46@L}KhX7x|x^>@(*$ozGLvJa_* z)fapfV3arczJ>6iUkWJg9s86BieGL=nOF9TuxN$Ohq z_fe6RvJgTit0>p*_{K<|i_pi*WUaTuO1&bok#s7;a5O<34p4l)rPdNK=V0RNFBs zrj>Xi64Y4CdJ-)GGhHzw&C1@)JaI%Ms7JtCh+~;aA_pXASt|mp)3f|iG$ug8;`Ipq zK?2Y+3>koc_zr}Av1MKq5V;uvCXH4S^HJT2QkHB%V54J?UR&b`w&LxdFMz>no?9eAO+wxg6ToCqA@^$1RF#}a^i6%G&ezH4g5YKE4xn`tRXb*-!t z$rdZS6G?`X*wQQ{kI3x8!$?-*E!sNP75j)~xfiT-?a~7_ccEeEkbRcqxqyk)(xq&v z)xt7iYpBR%kIYs;a*YiG%Ves|F6cyZ(85xbEGfzoCe~}dFFmarA&OX{R$?O3G${Yb3NEIo{D zo|LL|W<;urlUuNSe^jbNQYwn0Ym1^%l}DvoM5!o_u9Y*PIJ&lk3B>`H3B`enF`+oX zGNCwlH9V6hnJw=r6}>7`GOvhw)q-g26>QzI$pW_ix};q|ud-}X!Pa-lCM)PwmQ5D0 z^)%V!0(uqS7!RTQYMsqG@rud|hwQFEmhIW#E@at|6R*xhDI4mP;2MH#fvlZ)$0NX= ztYd6RmbW6nD70D*0x&Q&~FzJxlUh~ZR z6rn=woB#Jq2EB$EsXVf19uteIm)ko~WR*!yXPANtz%YgHk zSX6z=Wwltwgj9ysPC4YEnB@RkkATV5)609-qF^TiJAvt22z~S@$*iJYQmCRn+24wK zcS)ALI*;gmRuL16d#}!WpCZUVyBppDgs^D~MV` zHkkK!<)wXT+F;=)yD@_=#J3$2otiPoLXeR!Hx5j?ZiB8*7?2E&{MX~_lt$Y2X^^6y zg}!;(V3q{>V2#g5#9$|YbAL9(%m6mQOiH${Bnd*=R3`+dV3cFv0F)&r64bOoNf8@N z0hl&OS0#f7LPM(-b{SEA7Y-)Jp|qXim~NLksW(f9+3h*m-f){#0%ydCE*YRs(EwU2 z7_pWl9066*EDACiISjU%KWI_nV&_6MFv_V>%?x5`dxakjCTT3uMqnnihKK`po`&}d+w<`c<9^JzU)0=>ZZmH=@ ze+abx3kZgfD#|QBpX)ml;By3j^$M8#iUGbv@RtOWrXf28D8F86wAwJzIQUQxm`)x` z9|VtBxVQ(rwg=3o-(%^IMB#pvhuYZXa{AIbxy~*9Ig0d^i7P-L)mtgmyB**gENS>3 zYJ0;ac&L=%Wm4Pc0rKO!`sZjyU+WSWItm7t;t|{^ct1e-MPG}!7~8dfMN5AU@ZSV2 z&ZEQFuSQDoF%=ve5%i@z7wBJ)V(#Soe-WA6nRyVIuOTzwd1UTm##xDlotYpqKV@bH zGEX2QyG3=wYH*e8_amb({VU4*SApbcBkVVu%-e<0z6 zv^0;NEeU6^aJ)9?9F&zY50@Ua6o7-k*}=3teWE06B7By`aXs_7APj?$eymTb)C4oq z?NcdoVDvW#!CYuq)c8?%9N@u^0+=PgSK3X^W&j9UKB1UdTRZQ-hekRa&15F1VC7ttn zK+-v@k&({%7&6j1pF>7Er&wk=rf1&A+s^MFX(OjV)n*tbKgz%DU#7 zaDCmfmWksh=1jzILe6-AYigIZG*(|$+uA~C{HnT^>LvC^Y{6;?SuKfYwIqhs62)rC zvbMT<$v?_43<+whmeq}0J-JE?&(_)+TIyCb)Yb&+8d~wy`24c6{Ket&qKgZ|6^ly? z!{I1FHCoid5Mx5PuA#0~t8QJ}im&J_o1!f{Ya+hKuxwJUR^JGl$taF*8<t!>ik*R+JoXXa1PfVS8nLw2oF2C&eU;aYjE z)}pnpYNBSiEwQQwUtIYpoFV@l_*xY^fioelxWc#2(Oe1ce2?xm{8~RfpeGys9VvRM zHb|uDgY_ZCaD61kA&5CwbNB4PVz00F`;q{2ltvD?dVxQ1qkgTiNo;h;Pj{&@x_^N` z<3{}k<9czOW3%%Mu4~Uq1Z7t2?>l&)-+iGgZW1x(yuWM*qJC3!MEURm6ImzIQ zd|{f>SJl_Iu4}4o$zI8giE40()!-7l!6lqWmSAizk<-i)YkFB?H@&2#wWg+aIXGbE z#F`;zFYyaqcNz)Tx{S>J&Lr1H=K$9%r{6W(iC@AsP65d4dKj5&oc?Q^DFFMS#9Qn< z6Io-H)8o3vX_PrVV(lzsu5)=>or5lzo+_lKOi%kz?R@Jz#po>C&cqEVzD zy2Q4tW{DHp20NYg|EJO(pST^I$u1GxAg-9@oOm_z8_?Hc#VlvC7z|92#7uNqC7*OU z!ImQjX#kRrf1lI<$u-W2Vi;5@avGv~meVCh&2nbb(_LaIloMynat6dQ>Iy1DEZd-* z6eyQC<00UxHju}LA`sTj5+i51#2Z(lDhTzzIFn~s79yg^nJD}ZVR#u+`(xP6aSjq! zJmgF+b*9dCoYi4Y=(^Ig7g>&9&o`Y3voTa3LNmp(f6mz8gl1W@oN2Br!5LZCT(s*F&w+K8 zOWcWiA*uHampBF-*nVB#;Pe_(l4E(L{*|^m1D5U0E`;_B7wZ4Ps{bt=${IOw_31rv zvSiJ58Z(@TDa@}eVfICZar%XCR#8#$j5#xB&vd$ro&F-kvz7VQL!9eCL=NN0k{9sUMmNV0uOOwE5tYpNQl@PiG#s7Cm zcNNEpc!v~GbY4X__`#K)R`HlV3mJIG-(gBOKD7Kj98mBqpst6J`@6({P~sQs9>N^I z!8sJ(m^jXTRA_pIC!7P{oI;{pLEeicxtM$cy2}OlK6+lK~ncnFe{f z{UK|$;UXA&+`^55eK@o~zn5We?=6(jJaMpF`&A4*E^%o;i-Yl%-#B=H_9S3lEVmA~ z_9);e%>eCNHa+)Zx;99|$CKs3{gr|5ti~R~TEinK(W_iufr%;S<+9}&W2ylA3^~p@aTWt6s zQ@|(eG#&g1&$QE4JMFYn%E@y6ZD|-%dDvzRp*wg>YZ%(04+w9Mav%5tl|IyxqgQ=w z$U&l|5ARXW&ySq~55Clk^`Ak?`fn2k{Q=5_%{+ar5|kJ!Yrg zN~=7>PG{L^EmP=wgPq=Ir%yA5{QtJoQB@W^%T8C=>5X>!4LkjbogTGQ_cE*ANINaE zQ*@VR^tbG9q|g@uBOS;T5l05$kxVhH#@O&#OyQVCHZ1K4x`j4e!xZ*zu;DhQxW=~5 zhUv$IH{0+I8~&0Fe~l^X-*2ZsvD4q$=}UI{cRO|I7X3gw<%u8bPqNeLOwm7cm_p79 zrf7eW4OiRn3L9>=;ng;LwGD5w;cYg&(}s83@K3w#ZYNx~Pbc~(m*y;I9QGXUw_|;+?zsycAv(vS9`L#?T z$BlNn+fKi3rw`cakL>h_op#wNpV(skf7+=Rr(uLs?R2D_R@>?4?DRT2-EOD5?DXq) z`fWS?zMUSj(K~LXO%cCIJeZIGAmZKwl>!-Yiq4-v6xw{HRG}-F&5O)+I;esMqG!hzARk5^0M&qs=9hDyP>hQHv6Kv^T)}8Sc!2FrZyH{ z-dwe+HjcxJwyNfulk35YfjxwZpe&i{8>@M_aNLCKYAqW!X{}m@blobZxJa7a+{o*- z+0`wr6DDaHHQ9)&vd?Ce%jhiPCiW>nNl|M}pJ222-`qvCqp_rm<84iw7+%b>{1S^_(+1>uQ3M67&o#qh&$jPUz0^57Sd?^y^(`AEY<@%th2vHTnxqw*0?I@Y@nAy&Q@fdpyf zQ2g!%CYE1H3_naI5q{iL#LBl4mDmnxcqo21As@>xBZeQQq6oht>v4++#`xobP4E zipY=f4K|%B3V^PDnS!i7AoPVE?e0XoX~0nru2bYkc^QC?9P1l!-V=jR*?;t)t8c=S z#T-EPq3He!IM#l9H(?xMP_kW|qD0zVjl8OZthODS;7VrfLzOiHj^$T;9c~-~M}9mL zReC@@$u9>fk3WMS_k-#nKL)PNOcmX~*I0Lefs%)!OF@Qtb(F7FIV)9VG(FUVHLQbl z=PCfHqMOo#-!{-4ilL((JaR!7tM9YWw-k8lI|@PRo7sckBAh&oWoO!lYB!??zbwq- znV=y*jvdACYoLoUm$vb06aqm$gKWA0((#ke3C12dF@Tk~;z_x=vSiX(xs#^ITxG&l zg~c42V_Aw=0Uj*SPOO@XFaxqXAF-&gePEt7s31=LS6FtN;mLF z9eC|#05aulwq&ZbWx8gg=umuO}#M54J!Xjy%e>6EbY=elht-_aew6g1_w6 z*}mxL5`nG9_G(f$DF^&CAtL~tG?WK!>Y{vjBo6g0c|4FMVB3d#T87rwKmDe644SXCk@GZ38QOc`q^|$xlOQ3vC;EDUQ>=(8bmGQ*Ymc2S48|CD&Z!g}b z9R#mH-Z3}oyU|AhZTHQZcGEUp-}WUB^|o|=4Sgs5Ue-f@pC}pk>QyhyIi{6%9-V5y zw%YvTdK3Clqpxl2ep}z#{Z{48n64KLzz`b}lr(l(vLzSV)USGBt8wBcOE%*>o4Sn7 z&ZFz|ZaAiQbRMP8oQG4+F8yZkFFlU6X^5w3>oMBzjBK>EjWSz0SI*noeFpHw`Yp1b zwH)+y<+g5?YumPVPkL|s(P#BdvLCyUI)SIZBm}Mc=M*Z6EA`GRkv9 za!1$w+T)O|^mvN&neE+r<&0xm@XOr>#t`+yxH}f>Ltvh;wuhfX5lfaB8^KR!>HB6Q zS#bP1Dbuap`aZO;U2^n=_ue~qV^8@Z!z1s#H-tK|-)L{jNxj$6Pn)`quR+S|3|tV> zk@EQ83oq!<;FH7AZ-hC=aQvd)YYOK0;+(VoYWN@QslyjJhsd#}-P-NL9J3Mr;K|!6 z{ReY+f+uI|F$dbGJnU01c*^pot&x5_3p&brp!I+UXK7o8ja z_%iyWUbpr|vTybZxgKbFokw#p7wCbGV+O`DeC%8$ryG4?<*m7PC-|X%kCL~VXLI4p zsxIdHDXK0`;}baVTthr*RXOIWINnoj-sB7SdM!7&vpdI@pY7$${QfJb`$_Z&X^)q5 z?f8k(okveV-nPp3USdBB$h$EJ{n=+hwZ<&qT#>N1awBYqb)a;%-Cj)Gd0Gzj;lR|*7Oy$xlqnIoZl$7R!P|wV4tBS`0|*qIQ~z_>A*Us)+@@n z53iZT+$8=28Tx5EU+Je^_e#_+InQgaDcBLb4mOFdci0yk)3mMua(xYc1^zkjDA(l^ zH(2Y+UA8WdZqz$oOn$tZ>-@gpw(j)-_-4+AWBYPCx;N-ochUa$2M!#K?Y9U$X#@Gk z_60h+W6S9So!CQA2lTy%JlF@cCz|~|{ef^l;5FrEDA))8=sCYhA7mNky4XDDxlYV; z`(c0jJ;wY|0bf#munT^a7TwY`&lVDCFrAMD#ZCNej0>}sXf_@ymyb}r{NHSS;vInLBRN((d}3v@un zz+aC+-h0xTkk8{j=T_R~_>sz=9(5d8(4{y1w9BYm(j_XN?!x1=n9k>OE=%?WJCiA| zs$=a}AOq%fqiJWCXu6|I%WDPyqwuGN*rRpMGx9p;Ibd%+$KEGEchoz|y$N{DI#GG( zsFOT{SO=j)8pf6bv}z869gezTd-&rq*y0tQ5AfjLi+g4RwCq#b0(1M(0BnzTWk0EL ztD*fP`j3x3b|J^qwywv{xTEU?VA||N@ZeF*jhJ(~x8zc8@JRF4r|t&hj|fwujakd<9o3`L;0-Lnl(RiK3`wD=@|Pf zOWSlz`7G`w4bdwX9LsImgzv#qGC9auAPrx?2M%*m>W)WpUTdHqV zc`@*?+tHbrgV~2HC!Ly$66YaXVIrT=RAPGxpOMQ6a*goZra!}y{Z9MSA%Ps z>so7rt&PE&wpFXv1)J)cYPHcVnqAslTU8TW-rTq%w8RyQ^@;1OOt+6z6# z*VL{a--Zk0HI1vZ`4Q0?n`#?^7B&b9OKVh4h@q*5*otw*vv|g@$n{Q|1|5 z2M);l-PvG$s?9W1~A~kq#mJf9-JNM zHT=63)0HycPNn1#%dh|#FkFP>?1pk;p?aS9Kg()4TFMc3f#D zplt|3TXR*P#`2*Maxo!o--@CDB_y23goOB)9%6YYNmxW_gqG~y&5T9IaV8H%MuD}jIeEkVLd`jUj1TP;A_%?!E{M3)4RP)KB% zvPne4aGOdqk(OrEjPuOszAQpuf}EQG!+k_AGlWN5j44l57J zAqkTTnPn^w)s6I2%aco)>_UL+Gub1vr4;dyg+(k6RhK|a3!4GrzqVVD?6tCp<)JFD z*L(=pB*9#sgj)NUGT3oB2#|&enG3D$s@;mc1b~!>YJfmG0(53_0O8~wk|GIZhd&~- zy?Pl~c`pD%mEu@bi;3kC+h`_W{4JWv0R%Q$-m6D~C?N%UQfozO@mq+TJQTkmps5IQ zDDOe$00J~ZEDuGO1&DNb4MHB0nKIjJKmi-uNo@b*CSeD~%&sJy*Gr8a961#JPaGBD zf906_f8hARW`G0Wc#;`CLl(_rLffFLnM{${UM2@tZqz_U?>UG-)yw*{k;S>3$pM5u z{)Wz0ie*tLlRYxq%O5I%-YJVpnRLqRf9q$f@d_pV+uM?a<(ChsEjJ+-jU zeX^9hNaiXf)CPz-x&XRSHRaG)&;=w}_R+rqpmPxX+G?$Tpx@}6;P5~oV}#sLRRSNt z<>MIqgml?T4N9;{*o=e?3T^dOyV>M}2t7FgB@d-)0U$aMI+^4LtSpmfWVRf!JoUTP(-4t~zrCm98ki&cRsbhS)W7CkG4!}A?v9k9GTs@0`%hntG*1!DuC;h4Nr3Ql|f76#$aX-NRo4y2x#=X5jy%zxQ zLr~R+#lHk$cpoD2WdLWyzFr^*rue%*FZqm!zK6gPXJi`eILdlc10IvGq$TC(M5(-{ zok@{)OiLqjO!P$sN}x<>bthhB0Lz*Yt2=4+Pz;FDu~9HFF)7iPI0eY8NUs4HmkL*4 zmu3&*I~HuN<7MBVIHwl_G%{hJEj3=NX1{#_q-UKieIj=N3a5hM*{OiZc~Vb{$(JtR zzx9!Rk*`mf60x%c&#_Eszg6PgK6qG;0VBk|bzy4sbr9#rzQy5!Y+L4N$6gq5DcNA2 z-4{-pJ%2#ttrFUW=WwFo;Xnze7PZdpA!r{4o}Sh&1A#-o(1{mw01|@`>q0)iD<&c@ zL_P_`T*OXsDPouAcng$nhphe$mg%1R>=&U zeK~ZeQ}Cg7O}KeZCejcaVjN;&QC%;od`__d8BJ6n))Q z9zdKa4k0$hi-<$`7YRm>7=buT%s@O&EJvIzzJPeVxCe2LID&YBIDvSg2;k1 zTrnH**`fyVBylC;$zmtsDdHZ)=ZIe-K353bkvdNdLOfMuBR*dgA-+IVBEC?pN1P{a zMw~Cci+GxN9PxDVGU5Wk7rPXSGZD`aGZ5o$g_GXr5P4!1U`pB=I6*zxW5@ej*W<$^#-Dak7|zxW6bsJU}c$oFY~sP8C}b4-|JI9whEV zoF)z;9xR?lJVg8v@lf#&;&hROn{UI!2*kt1B*bTkix3CJ#fV3U7Q`dPb%;la+Yo11 zF8?U*HaHCYne1NRH1RlMUHlEPA=0q832`2mMp25`De4j94^fES;(Lfa;xJ;bcoT5~ z-ory(vk?145#l7V9I;<)MBGnwA`Xa05hsh65cd~lsy1-)^5cEyN4)G3Rj}Ryih$O^8k%l-=j6&R@ zi?K`$F^P#oOk?5^yjh;8xutU$mkks(fHm=X#Jbpq*bsLi7UKJe9pVYZPVqWom+%ar z5i${bL>^+VScW)3T#GnS+>6*Jeug+nJcrmX{*JhxaAEHo5Q7jWi*ph87qy57hz`Ul z;ts^A;vvKX#qSXh68}P+hIc@CQ_-5o+kgS?2qN#%9ix#r9p0;fO7MOGaiXscvF6=@ zIO%674LAdS6Di+9=1kW7CCIWifW;48B#F2xxP4dP9j+f-56U@gHF+`tN29(QWYeV$1 zGx4;UML0AM6DMmA(&yn_GV=!MWk|{}axVgRPqq|PMy%?i{p6{VJhju84q%JpWs4?C zeowyR4`K+x6pjZ7P531m7zTz~D=jmTg#+&et{5n38LS@Z#c0esTDHUa+^0h%+jCey zsgA;U&+yMfN-A$q^H(7M4hp>^9R4bmABna35&%xa(S*cpbrj|`m?x9M&Sv!?dMP=% zX0x%Ol!g?L#(JI3Z~*cujlT3e)|oeW6%bOnd6a+HEdZrKE9m@Z?5CpTLncA9Z4i7a zN?}d|e<=xm6L1A!EqwzT^hi@l#eC}{_8hSpMaI7^^bb&Bq~`q*l2K$XW!VJ=`qFun z<&wca03f^e5_avdmjOyyE+zS}q1Z}Dd6rV1VSHuJdKzAqO7Ut?f#S77T#C2WhTD+J z*3b-Et6^&^1}^}EE6HGm?B%NfZj>Me9dj>7dbm+BMB{L;EdeJ=0@Y|tU!UeIa zStEy=n5AuOqFwU+B^XJi+Nspw{{Xz5e67-RLH;%vTi`JMcj#*@?O@$ue+DR3zDla> z!}dk0Y?Yo5a8H!D8lW`S)ihVeJuG>USI|eVhu{SWa9z(WMDP4r0N|PWg8fpZQezD) zHX7m`k#L!Dg>+!pZQz%o_$xLQVN$&v1JlIkh|yb1WV*z89{iI~@niw;}125dcygCrlB7yI~sB2RYs{{R&8PylsvHa3@?s zAMAKHQ~+Qv0o=mXLstOeY^9HIIP}o%fR3?jq{E|!hL5((MmcoF~dT5h^ zDjWy&&=(an-*He6eN}N;;5ej*9#qgm$6-D68wD+L9MQ+Vr0RuXr8Az=$2MWDl8saX zF&v0LD~c*0h5=z@*%ZrwNCzTWA*z8G3PgrN)BrK$DLr(yLex5*(L+UmM$@MCj%W4I zd_dBQs~lZ==yQNLo$HN`7xmCp3Tkq^q=&XD=yJy^&{09nj@R_iLkenfysn211LA%_ zZ*}}h4;@obo8yEY^1_$7>g#J9f6+DXnQ+We^v56XpqfBIs>kHgxR$_0sXmkQx&&sW2Fxaq-NBN%sVU~Q05}wkd8t{N_h#hA z{VyUPaXz}86%~PA>-R8_6{uijr+N<{pH&1P(-@X&a-|wgp2H!O8eT>aLODP}M>j@7 zs1yJbNR|OPxWG%`%+xe91mJv@WTpnqJOJDf8KKk+tsl+*7Wf+njDFm~q@mR4Hu{kw zhxwNcFROaX5sf3Y?^5J6FBS2wB(e~sKB*UTnzubdDUn|S=-b7J@@QVhUiL!ry~xQ8 zn9#D;pe>J)lWMjgL(>=&pe(f@sWCCtp(Q`3=yfgYD4ZxyA1qAnF}R59!!Rp741nvi zK0-LmpW)P^&Wg%0;7b_oPo-6eh6W{S_ohdETE4SDdsL*<&k7rn7qO$k?uJT zlUEA>Su$P(%}oHfL(vOGhPfTUVARuRi%j!20JmfUC=praHvq^1HBaQ4-vL0YVt+No zd<=l}^$Ic7d;$PBp!$4qf%#hnED#rJUM@hH(||gm>m%Ie5$LxWdq{npTMIphX;IF{ z=ekSv5Z6vl;Q9sbMSAF8faJ7!p?irQ+OL$)b64u2hZU6XuF*q3QP4E^NIi##~ z-=&8(1Co7H<=&%*c1NMTdgy*Yi%Hqw-lvD&1SGq(#f>=@FJ85}q}BbP9ttR^&5b#B zC?MH)tKA3m&{zenaUaw}Qxvq;eMk>Y10;D~;XbT~%2e5UH|E%-3c3;(XgSBWD8yAj zaE`r3Av%EI9DB1uTnz;0*n1RW0}z~JzoQV>0D(Dn?2`(y5s1M+{6!%);S$v#AjBA3 zn`=Qa5QqT^@dY4Kff%U}n}J9H;=JK@mFs{Q07S7uTn|KlAhK1J8-Pd#;sS-(0z?3a zxeBorh<-p^st`8<;Rm8oA#MU935XjMVjB=XAhs#Qb|4agxKkm%2t)!92NYrl5MCgj zR*0QIcz}3AA#Mi34TJ+8A$xZ>5H27R6rvLdClLJ=;tn7jK#Wv~JAn{DoTm_bfG~gv zVt`1d-*h`1>Cfn6c{foa?gPb8AZmcvj-Y=Rh#^3VJur6#$t> zKW>-;8L1V%?ITxzUggodp?rkXONL8sXk;TV8*VLnA?Fe+Kb{wLcvXih?0MkmxHOrb zD_a|`c{!rIqkzwR4N)*f4?4|$sKF7J&TmnE2 z>$%Q-=E^8=pV=G*zHP3K0^c#Oi30o08=}B>%`ZlQ`?X|V!;p$~#3-4kW!;7Wkg1Q2 z8Q$Y!hj(`D@E#vKyeGsC@3SzxF9Ih%f1&4Mc+Up#V*+Pmc$WZ>JFH30baM#+IVDWS zSZ@L#H9p6gVP2ttbDg8jtpMb7dmeTMSwF!Z>J|N7S9GTOUzcXy2O2pD_qj67?*XtT zcvn_*^Z9L8PIUA69apaTEXd@D-0zxV{uw|OSnJ<)<(XdmTURo;-&J4^1W?bC2V67F zp#atr_@1lS%mN?3SOGtDJ#Vg6 zz+zW|)jmGicO4+Hjg<#?g3Z10zVJzY6N75po}?yj5(3jQ@=F!H)xWbmc5o@DqSVSI*@MeiE?JmGcD!KLuFt%K4Ile*;+S%K5s2e+&4G z7jqs^@Y8^Yzo^M;$p(~2%uZ(KNKeOUN+iEk^InHKnfG8{ut(Q73RA~Py}XEUElyTa z6z~Pn5sF*^xmjS!iEQR?5m-yE1EJi^e@W!(p`C!vIRlPytH8>_t0r=R__COasS0KC za>i`}>kKC#3EeIVuqObeoC3ZgX6m8G0LhL1Zc&VrbnrWims~nUsUErrkh~0Xhp50s z3I*LM7U`jKK=PE}t73^BssnUB>)kCX_0VK&&n5IVQKN@u0GbWW^>2ukIMoMq7`rfi zuc*gf0`=r6!M8*cF3_M%O14kn#Nz9Kq#N9a`>D~(Am0`1p@X8lAOGDA{Zv5@h>d#a z*9v-2Y}P}+Q_%Os7CqFhpohdZJ@gL+JuG(O)CDri)*lhK>LKpoB=nfrrH3*V^dr3L zaqKieQnG^r4sn-0c9BB-6o}zKM6RG50%F)*dZ+^wa^U`4+^vVcq@Z62{1ZI7CUt08 zSD@!|^u@yD3N5Gli{T=ZfVBaSc@6-1(s>EaTJxhoia9F^q?zSWAlICe= zRLM07K9lE?vSd?2!2BLc=u^h#gcS2n3fPj6X8uP3HzuT;9yCbv8`~3tW{LuKBxIN) z0bGj7-MBd+Gbc*{wO3MoxtQ3ItkRm3~J;V%VCCJ zqC_%Xk>Jyk>F9E9Ff{L%$@726a}2DRZoKM>)_e`C%V9_$FrbV#Tn-a|xtA-2@n@IE z)IrZ>!}z<)X9fUVssVV<6)@FcGFhcCXk?KnU?`*A>h+1?g=Yfap>!)-57b7qG_jgnL z%T)gNQ~g&WFMZ(Iyl7uPU*LaK(R9u9{|Na9$p2We|8eB$(Z23d&5Os?w7_sgZIHlM zl(dS8ui3vxDcP#|zm2?f(A5tA0F-A?fwgc2{s|{=2_iph6(_lnczmDpKY$9dg;ko= zemzKhjSkIwH8P{FWv%Uq-T|3!e%2q61bqE;^HF4eO;S9wWF7+WB7p(A!+Zk32?D9Q z$9xt*3Pl*C`!w%UKwG^jMP#ITc}*_SXXXDEPmsWxG$Wn_M0OPCKks1VqD(X|ugwK= z5!Fz!vZO^)v1)%BQmI(2rPzFs_*Ou%i;)=>MilrQqGHxslyyE6-w@plB6B-Q)1jCN zU>||uQ0y!Kj}QoAmhg5WXNe(A%t-To7jdG`%KtE)AgW8?C`#@FGvB#McOdcjuJPZ5 zRQk&%Ejl-R!J!3`;0S*r?fFSBNZR#&p8I6eKd#jLPpNtxpuNk$$pa8#j`sqT2Z|7l zf&=;Tk~o3-eAoL8q|*PkX#ND1ztQ3EhrH|)-23%@9`!8Mq)0aa)V$jePnb*JO?M`yneA9NJ3u0r-!Hn*AwHn{r6H;W8n4i|8s(*OA2*~vxf=3ohdo!rWEQK1 zo0sw?Y=rOm&g@r<{O^!8zL-4GVce8#J`7+JkjA!T&3poYyj!y!PyWdJE02-(QR6Hs zl}tLt^y|pyo`c(r-usZtT8Uhm{wpE38S-xC5$pjM0xM4*AIEKsN&p;}`V%6cd0$4Y zQLnS=e&FvnmL-{ckP*24W>hDkF-)s+=@WaTPpozGzchyL-_cqo#OE_GZFcMR5-!Js1~yhcKe8EEZA=49o^*>&!J{*S zm5V+~lD-a9{t@v+BQ2tp^VZn7Iv@Ma+!C{naLB&OwH?&*1|l`&H&JGFtjo5XsXlMdA?9(ys-g zUj~_5&l7p~A)E9Ru<89${5K)x6_$Rfn*U2GKhWX71NkI0({GT+|1IRxm{0ThA67Jj z1O9_5KP1Kf3zZ+5W}U0=0mAVodD{M6X8)T02P6UO5hqRgXK`*xmXe)hb4he$B ztp0qHE~ z8{{+j1mK4)_(o(W4|HkT0m2s;JbRgPA>c!Vrx_!&0WSx9m~futKjlWiza~6gmJjrS zC=*g}IBdrt`7PiM8(w3>+hXA3DDRZ;JUP_LjCJUObPeeK>9R|QA**@WxOWVqqz#DD z`}_QfNQv#Ar1?{j(gpkb9e&c&PW}6N{H$;XX#zg~Y?V(A_!lC-hWON!sgC~r{b5x$ zK=ZFs`4kMybpSYj_aBI}v#$ZjnuaKl)S{a?$ncrSB>Y#_JQu*v5t7<;Bj!SZUmI~f zu>FVnD5;iy3*rF-q*^kPPE7umZ_#l2(q-(v4aVgCFs<~h4brzJKL=P&%Nq>N%jZi! z+bI3as&2Xb23Eh(nCx=f)o-+_j|VKP-z2M_r#cX>FGxRBBxs%LpHzqGq z%x;&=f``UiBP{qlG8Fq9VpvB@?}U=czlti!oOZ$8z1B5tT+=KT)=+(tEWRn78N>By5`9xLBm)cLYzuXtw;=k-d3yP= zDCN*QFeJ$>e#Nq%ti-Z{^{X6;?Pc$!$Uc+W$yuE2ta(W4WeN2Xg}Toc!xBnCmQeTE z0$W1eXV3?Rax9!w3|r|#(r*7G{|5}-0h@de48n&@0P{JO$wvUcN#!1}MmW#%-zNN^ z1&09h0TaM{kmW)Q)0bHMkTC?S%al?S|A+9yQv4~a0rPH~>k-*po^dwvj~ktkW8jMr zV@kws^R$8g0-{tR@GvC^IH&Eg2>2|Xmd@vO{3E6HB6b|9rQHwBe~ggQB8y~{3TZSi zWlDMqzIAJ=!~YAAWSoUNTTadY4DzH)b$R@+BF|lIs@vy(7y0p|@dW&dsCO>&-V}d2 z@?4El6Vm*nkmqWYnwahnAuoCQg8qrfOP)!Y{sQC+S=XQAFGIeR`F>OUE0Dj0`9Plk z3gmwP0aH_E=6h0;<#WJNj{cheT9nEB0EgzkF+y1Czb%qq zO8-HXAGFqgSmo0;YXM$dd;%Ie?v~4<17(iwGMmEeE%GtrVrFj-u=SGyA`i z!@bOQCOwQK;CMdz`112nu^rEQtWlPUUeK2&K}*-u(jzACQXcWN!AFax904r1Y`>G` zL)q!9W$%bAHb*3zkz{ks;B!Zl|ESm;v-~&(+eU#Y%r2k8zjV0iY%fasfq8IBu8(|p zvK79?W%3aTmlM{~e+P9uAwF_#ZL%UcOM*(!=u6L~1aDi4d=o85*M8fQ;BmlSw)nQe zhoC0^1F(GZ^q&TwhdR&L9+1yr|I^^T;VGF3_Cu}zGHB|7eC#ubMyw5QnLS{wX6Lfm zL_z18ycqRlvx!0u;Hv=3W)p>M_HMwkS)Yh&)+c1Mzg5lpg=`ilv3)d~f-R`Nw3^Kh zx0-ch3nQ14;exxF$^0Li+)th%xSyO-1z0XABZS<#+y_`bvpZ7OpEAm4ce4ct-+-ku zpl*<}KmjrX9bi*04S)@DmbH=DM+$b;Gb-~IGTN9I&{_InYikp;t9cD*&nTM7mkMs0 zJYn(jL9%|N`U&)LEYrO?D9gMR4iV6esUGt;K(mf?uZy`JXxlCp43?9$uZTVrpD(zx$=56l``5rQ=%7zukuVa)r}HkvnS6~ z_eqQ!JO!q@O=8^SnQ2}C33x5f*x@NQ`5Y;Q51O+TS%2>%W*C4}0gr*2>ZYAB%6rgM zcdCqR?;(>nu_Rfp_psT7Iy~1mCVP*V>lJXJ_X+bl03q6XhW9CXe`6AXh29hRw*_*e zs8KSX?2wlU@Gynkom&5jfiGDn6-+@VkM(wn(JPNuJC$b`$Ybjxk0rSD!$Z|mDNopW zJZmNLyoyEykt89A7+_{Ai8Vsfvmy{Rw z!p<%%EDh%uLo2Ix^c`Yhe(_VAUshCF9xf^5(>7B0ll zkajJa3m2MOQIu~F%c$WaZc$QEGQFhur0tfJ7S1g%FAf)%4jw#Rt3oG^-J6iv_PppS3KRx`g8QohO;_KuW6kuc(7l&u`C@3f_?z><* zEOk*~cuq+{Vc!JBC76E5Grpzyb5ByBdK{iv0sDr_3g^u)D#LVFT2{0GN`_|__A)@Y zv=GCShLi4T&*pLS2BtG|D=3_iKfk!AmrcK@C|)`s!kFsj6wU4J?kp>>z-kpP$gjxn zUC%0uTf(AU88b5~zwAAI$i=AO< zUl$z&96_q%^D8Ryr_YSnWIik{-|SkAPpdEEN5k;W)fT+CRhv_OQFumi$-?mbxg71- zN<=W$wj}~Wpu&qvNrkV4IdN@i;Xc6NFh zytBBt#9C1n%V`ROTT!C8yljC@6N9Al^Z?OJe#QLq7%XNuOjfW;v@Pj$m&#x*3T>6qF*6`f8G#YRvn6`=z%R^Wx4eB(v4D8dWMW-N}a72n*# z@LW#5at?{1>M29{LffV>ik6qf%B8Fyp|p1aTqI(wkK*3e2QpR}fIXG5DcF}vO2sMG z&J-!eDgb*ivMA!L0@DU`w)Oqd~Y zei#^@xHcC4%Ds1N$=v)o&_AXYUl)!~YSuQi;LYISUJFh!_QF_MG^Pvl z%W%$s%v`K1)6tvAT5BUR1%=b*<5~uCva78c>f8ZX*jScYrj^-Z>@DX`$7UAAa>-+6 zddYljV62yzuL#%IuCA?bp#mJ_I3tfaxsux=h0ZUNd&j2ADvIV5mdv;IstU(>4!s`6MyE`kfLH}o-r6-QxQ7v^ zMa(Dn!IV~FVyrm_Ta6y7E5+bf#nzdn#U7;O&r1}26_w!n+WQf(8B9n$m`=COpNfm- z6jg-tXQFs+QM}#d`IS{}omR#ZlowrGsMR;(P5m;8yF6IEvZ`6D!{=>V>KgFj*Hv}( z>$C_#%gV-PlvLRTVT-DX$TrlOFbNn`Bf>7Ls;Oz#TEa3R$ypOE5+b5G+1M4e&5hBf zq#Ud<1!UoHepy-m;xGjdS1c|q42QLr#_G!?m%4@+T_`z6<8pizp>cT&>Pi)f4u|o1 zgVwrLz}Hl*3o|zuq8Al?N?s&ly_Fx|aIJ6;fz?h=Ct5fVDo?)&dJs z);4HR6$S7;-db$1TP!3LZNdi^U~ojLL`shjEG%zqYSH+Kgor_w*I3s#1Y_;zqx zv$nhroolH_fx`HjMD1FwfnQQ)lf2|DJ1b0SB?VFV2*fH2x}vU0Yifm+TeRl2;hN^E zx&~^D`r-Pz7WkdK)T>pk)Yi1rY5WMVj4%~9tY}>ce3-Z}zR(QW@L^)8WPOlAYanE) zfeb(C+@e*rK-h-b8cAu(+PoGm(?oD0>EX?5X&!lf8lQTG?V;~Vx^v@YwGC_uly$9j zRrTSO_+kaVT6|e8axE*v%c@%Fau^}-C=Dk|jn%j|UK3skXR2*R>np=+s_JaTn&4uq z@C}YI+Q&8Y7U+U8Q`^#_@xrsVvJuKRHrK6y`!_W=wl-Eb)@!S3TUR#LXm!i0s%y~^ zb&%Xv^Aa zFnW+IXL&0+om62Ak2=udQ^{7Y8eg!kZft`nl2?mXQwJAnUI#n0)YZ^c_*G>P(I2dP z22EAXn0{7htJ>;Y>j1QdG5*-D<-g6fm$%hoOsKm9J+Je(u8q*!ZV-cMu3ZHmqBAL; zHcbr1rjcV*_A|U59Z?I)U8zh{rT6-A02#y~lza`5ao-tRN=@ z)@#B!c`e$uhD1x<6`b7^Keni?s%p7Rv!;@&b@h!^HDNXxhoDc8OgeaDQ#CB2HMgv0 zzyNNBZmU{WSfd|4XGs7i%b_2uwzV#wV)-!~UQU5lU&bmTy_Ch6yy_ZYANe8ia9v9n z-?piO$3XWmmx*vgV*@U}{S*)UakKOF8%+rxVU@ zaMFg>x`wtYesqTY*;0p&)f(48BCL4u8Eb}>n$*-T$9HAyIagwuR$=DGx8X6!T3S$L z6_TnIa!|CajOdK%m<`hUvHjPxKkY#w=XweXd(gt1vE;YsrDv|GUB*QaJ*zy^=B`!_ zcpF_%`Z?y?)pE{|{)`!8?K-(C%L(QG(e^IzQC8R5_@0@}Bn$y21S-Z@2L(li5H2dU zs6m2a2r?iym1FLZNG@Y8T)Ykt1W`09DvFe`Rcm{^#ERCU)@ZS%RxP$zm0HbY9KqC{ zQcJBKt^A*7@3m*%jG_PY{m%Ejzr1Bpz~H>bEg(Vxqd*mZ3{0WT~QxKf{A4chs+p20A+}R2YX!j6~K2mKnA-75YMR zMOg#JE4~2KF1)50Ed-@3tFvlSRTXI2vWALPWo$650o@@?cymo#3%j@^!}v}IM}KGH zAz)2&LrryEMROgBFg_UrtM$pOoUVrM2M#S`*ykJz{#N0~+JN0bR7> zk2{qaziv6h-^hNOQLPYVOWPXt?m=Gfo zrcZ6H)lDnW&1yKwtf_*&u$)q>&M5qj{#O=mFv!#lMSs9=QRyf8Ec1j}*h)R<8PW`i zFk`itIcCq8KXXp8q%>hFyu4<${>K7HXmRv|E>U0o z8qm4Jn9pctvOS0e?6lbw{~Lk)p)ojl%xIEQPlU{*&j#N>Q%R8(_YcYv|*JY)&G3g~6 z1^`Tg;0((Uu4m^fInN+fCSX>&ddk)o4nrO2c1Bmq{LUQayc}dr6JSQ(qAF`>{nePR zHaD$?hqrBFs{#SIAZo5ynam_XRE`<4(N8$%uBxr8hhyNXhf@>sHAK4q#Q?VgtMoLl ztOr%A2c6MLpmb#7P*B!_fdHN)T!C3O1_eE()eEcURZHvPTxCYp+DwZz)6oiyIM8;o zEn$&Wt$LBB2Nx<-8osiwNu7Vu91Koo=A~_q(ij208LY*I{xDErvLmZa^O#!AI)cq= z(k^u|jl)t5&Bu|JD|kJUOGVgq<&o2OM}_oIZD?678iF~hYTFw5ii^t#PR-0LfQF@4 zft=H`X*d=d z1kfT}=W7k>rGW`R`&40VVhna=9o7w%*jF)qR#i7)PG#B=br8dZLMm3^$22XiJy2y6 zDrd)nq;;FwlnsV@>QEZirlvVz1{jZZ_oUYJ4o*!4dWTSDrn9Ij$O$V=QZKw!~q3a?rQPHn-%PN=BX`9UtW2agf+`7;%#kqySPQJ_%T_u3pZ)_L#(D1xPg@NMJ9}kD~uv5^-daxEG$EvjbR5K?KH!!T6Ee# znO=KP3f=ph2G&x?%^*0prnVM6=wc3u>YJ5LdStTd=-z1q@C2w!?;fFg%i$NCodQB? z56Cfn8K&jvsa3EkXcDVX?6TTb5V!ZV-Ey;*=4VxpXS8OkS?{J-gElNWGd77;l(DZQ zV`J|UnsPTLn1v)8T@O&SNG%w*f0L6RXS3U`M+=5+Y2P8eO1E{LwhHMk`q@^6J0eNX zN7G40VBCT)(LvBtMdNDiB(cFM69Xt#_jIPhB$-1smg8z^6^11S(1GT~+} zrh~@v%}fO)V;PN|RBQ$;tuXr!`himL!EAf;iK$XAJNTq$L9CFDGWp>uF>T~?-O@H- zTUli@7Ne4)t*jcIiHw*+=f{ICp3cKQ!*ig6w8GnKo1}Umz7B0{Z3^Sv#Zo$XJ)Ol4 zvL?_=VQed4>notCGI#@$P-C^;VbTG0jZN63!8}cGTq1=YO!RIhEV#9-5k70V(*MB& z0a|OVTIryg$zL<#Q<61ebVtS1$mFW5U#HM7~YXss<};@wKpP=I$HHAnfqc z=gG?*yUBa}PW@WHDAd9=>tVle~&lVc3ktPL356 z$(r=wlH^#8_YB}A72%JD_l>u@!YE$XR9#n<;w*DnwvV)nu6nA!B+E#3tW+Ct#|?VJ zR6Z@tOs&!alW(%p!u6~oEzE3kI10x&(Yk_frpjuTE>#V9UBDeJJy9^G0YAXz1>V_UvTybR$cXy^HC5G^m9=4jGP}&;)Xne) zUkwv%!Y;dIt9N-@@H*j}13mgac#2h{_NHEzHd{81!uzeTBc6MSsd60=&WuU99Pv&q zID;L^U?ZT@_1Q{yhUr$R3(NEeZzz+`+|ku5KUR?IBhy7~@6>w}PIFJ}@6uhnWhujZL8<>IUx=E9 z@0+QLnu^Lg<-*r8)%1x4*u?euGpA*_2Dk^SA+CTc$2}B3y)hiWF*U+)OHDgFxrww$~Co6b}yE>blXr-qW5@JQ&~pvR_bR8h%;Knf_Xv z{$@!Z?3?HA7QsDBEmcyQLOu68$yG2f46IIsJ07Y`nBt81fsgXhMK_1<=0@!()z ze*99L{X!ZZ6~7!;Jb2WtuAAMPJU3-*^ltFon7KZyeL(TxD8I;-E_*s1Bon##g}QH) zkHVbtzlXG1Kc>Fs2p-ALbh>UgyZe+&Ih;KB#XN_O^>=lJh1#v-f~?O?o{bqByf^yR zXSQd3qaCONXI;pDm}LUwm;3sYh3)6em#!nyLEQG*gNJYEZ4qzfz63d|6QEZ_V~p^&HLu0y{J4?Ez2WVy}R+=%cW2!s@ZCrF!}JMoiLH)Qq20FtOl_f-}csd~0rM zY8~I!lHvuy#$oVlTQ!ckmQ>bZZS}ury9ASGj`K%j^*>Yqrw~VD@qbXsC8+rS1vX%@ zgsr)xZ)^Tv;Jl=wIb4CGoXk`K?cuP5f?C>PKS6q+$3_$qz@K4)t>34Df*sd20?{oo zhw1YbR(wgB({DuLJIDB1E4JiWtk9!zRQm6V0=%$b^7Z z;R$CsaEXB@aFQp~TV?q0({n)O3A(&){|nxcI9F|qZE7pXX=;+2ze3$M4;+iyRZ`Q=ezsH#i;uN4I~rXK+@l&$HnhwfGmJhxotndA_`UtvBDZ z-nGl?E71g4?ssKP^?4q?ewR1Phtr=+e4fwo?DOI5=Mrz=CaTc$7v%H!Ja;oB>l|;! zY$&zFn^EFDc`g5s@ICJxxz3vzLgG)or}^5ExWqdNp;=VWE+p7MKHeeF5gLN3ztEdA z+j}x7l;mIQ^Ze?1=xP@V$XxHmk8%FudOUev0G;KV1vUA6Pdn1MJp*w}n9uVZXZ!!jMRn(<*-9Ltw3WUl`Y}QW`90b0Q7*5~(^ldc2n}z7 z+$iJ=9DC;fnKzRa%=LK!P{Tj3EAje0H@P7{>YX(e;Wzp`pX$(C-6i@7Id5~9BqRT# zBkxRQ8RWYO8ZYslNNsx(*MaR5?p?6|m7hX{0VO_2Fkr3kQ_mjcgathBhU#};N8Nb7 zM>cDGS&zc(+I^nbb*Oxr@w;8#Z2tyt03~Glp2L3_s5d+7BOL;Ed27Aj@+?DSDYg3j z>(+Wl`aBK@eW6aK^v8@DZCk;K`0C9HkV~`^gmSBWO1Ly~z=eO6u z!hN2dh=#q=kk>`LL;kLf*F}Zwxuzsdgr954JOkLk;QuT*xPAC>XDIon*Q~|EF70$^ zfw{0p;974UdH}l!6h4?1oP#F14T=AjvDSMk8;8kud2YOh{=xHg26VFansn#4*6Z?~ z1MlYxd5-}v{2f!`J#MY{Bt-aTrK#k$RN^5>>B5mxeRZ}C35NJfy(j5dbkLb=ysq`$ ztcxgUnh89FwBNM<|3oP5zc1e>`we{-q1k@-sA1lGl$TxN9mW5iSFWbsJwNwCc`siL zrM%=_i}-=Q^|Tde_qnUr!u5Dw^RD#{Ubn_O^ak&ci?r5}agfjRsu#_75flpZ_B@WX zFvopfXz$Uh(>?p!T7q@nZ-Kw|!4H9j-{*M`EC!UORk#O<2l=&Qx{oD!K0>M-`fHMt zG&y>g_f)Na-!6pif^+wL%zE4dF^2g(pCAWa;7E8rcuC(2S?79(tn+%>F|w_Mv%UJ$ zG{t>^GDrAd@OjpOfzR_V@X{(+3lcx>Ougjb9!x2|UaiNQjqKT zFms;Qmvx?Z_(fiHb+p zv3KYNUJrY(%QGC=JqyvAp3|~g@mQgq|Lf%Hc?zk~$|oSg>uF$`T#jdtuU@O2HfIxk zuf>>s*egT*?a0kITPbyU)cQX3amw3=K0*BeXFjE_lhph^^vUY9KJ;m-*HIqMPgcYF z@XJ(fedvkmgg*3{>K}dheMjBdhdxJ*>O)Uc8GYzt^`jAwwRzXboocpfYCFF*%TU+()b{k@>afgUAv z3Fx_?aSWl39|%U@#xs7DK-0fR{C6Gnk3du3*%E&l=xPUD2s#X!YkHO!0KE~_lV@<#-h})%__?WyrS_?@M6jncu%cHfB3h*eLR_3@oD%U|# zr>u4A@@P#vX&fW(xIF442gUp+r_raS(KsK_ad{NZGjm)Xb699H#G|;+m%2RaoD_j4 zkD8W77pKt|rqQ#~=!?_nd1>^*H2ShMn#X3PE|02A5qR>brD^n)X*4Y(b$PIF>byMo z`ib-MD4tZAx;*Nd6oDs?x=zib;mbuE>d3H^v8n4}fA(U0Z5n+xmeuxR{G$$&B0Wp& zk!eUD6q@~SsJcw?$Y)-Aa1T`r)hk(=ROOnkRGXwf@744bDk}L+{8Dwll+S(5q3}=t zOe^oSH2F?SlkWxeU3*c!pQO=mq^19P8hv`2zHUsTf1Sqfj5K-XrP22af9~xLMgOwC zuT|5z>NrVHH4R1o{V^Q@uHCqY!rl)_eiJ`Sy(#)L^hs*CPHhf78;bt3K;)yp8H)ZD zmiV2T{*Ia~`AvMW+8|@Wdpf>AohbDs3{@Aa>-y01)OO*|y~m*n_ALCy==9UnqCWDT ztj?ACOxE!is=-no_nL>Q)6^7J1Q-41Q1~aFy=gDD-}ORYi|3*6XWzGxK;6D+`ktR= zFR!GJOaCjayu!5d_NDQAE6v_sAS1cR|5s`8 zm@y_V#-EW^{!Y<96EXfkT6}Sud~b{Xmmuv>w@2ZJ=#m%n2XW_Dn8WMyE6vzeUL{Gy z-JLeo*xT{dmi)eUY7s) zA`kf8g5dl+%^W8m#D}EO4Gt4QXS;x?*I44M&s7^OuX=0V&7vK-v%GeiZ2Wj*-iw&((JDDUteOn#TT>e?N}cCpL=R01>3} zTg>^u)NdDP>QP@-o>^&hX&OD-yz9!x^k5XC^3f>@fydkFg5_hUH_l9gHQP@#+3%frLMhmVTl5u@12}$Y0C+cbWEMIkX$%A;GVJo&x-%J} zA{N3=5ht2{?ZI)v{P7Kj>&w<-k?D7C_&D3N{J;Lonbm@zVsC39cg+qy9wn&p!zc&M@>{f=?3B zZ{8Nn#rWffT^9?61s@{9PTvs3Zlb31dM83O+%E{k$dkrQle<3I7iw z8gZQ<*LkG(3vylPM!QcHtPy-#@RV#5k7_FSrN$4rFXtQvH1J!*|G*E_2z?^)GNn!z zda@v04AU10ULeT+$Z)7e<6=R$PEB7a$S%!vs|9Zm+$4CXAY8jn_n_cof=>zlOz=g) zR|S7B_^#jwg1v%&7yLr-h@hAD47mmh;`hrmeT?Aof+q={DmY&748iXTP7}OPaJJwj zf|m-G3DyWM7raVvrQmgfx*tN$n}ohi@Gik^f)5D(Q1CIqrv!f{_@dw|g1-^e{Tt=H zE%cuRa$33+EG6e?-<_aDwc!J<)!P5mN2%aT)j^K2`iv;HgE)cw2 zutIQ|V1r6MRwd6~W&K?icJ9{7CQcu_X}!23i?|@=L?=FI7YBQkn1YuKU=U!@B+b7!Fhs<1+NgS7Q9k0EVx4O zTEVq~8wGC_+#-0NU{vs7LGAY;-%o^oLGYJ?uL=H6@EyVT1wRz*6+9&Pnc!D~*tXYt z$P(1!3(6fPbe>>P@MOWUf)fR&2%algELb8K5?m;_M6gn@L9k8m8o@P!8w58C-YIym z;10ou1s@aKDfpb=Zv@{I)Z-@V`zN8}f*%Y1Rq!8zUkc)FnbupT;2=Rg{(|4JLZ2Ww zTJUti34&({o+CJ25buRF|2cvS1TPn?5^NG&A-F}5`!cleM+A2Yb_u>I_^#lGf`1kK zOz>;LAsqj~PtO;C6NH{3$X|D2e2L&Z!Ak|piBpx*^9!U~CE*(+e2dUq1)mapPViTP z?+C^Pdx@CG9Txfs5reCT^AD605IkORED`Ca39aWZnEx#m`YIyww+X#Y@Ky=GL+A&H z$fxH!D2Mx0EbkA3J%axw_@y9Tzv^@Yi09!~fP@YTj+b!!{)BQDDRrTQUrdBt^Mw8n zp(}*07rcgud^Zc?XY6!&j|%>pI1RrmDD-|J_`Wan$3p)_=+A}zO6W|^yO4e$5%tX@ zg5PO^XA#ebekFb;5$Q{XUL^G8LN68iN}*R1k$;2G_YtRK{UWrU2ZG;ILi7C#`M)gm z>q7GvSSa6nLU#-OXQBTp^nVNewa^3nhTk9}@{bTYU+7Z=#}OgdL_xkcV){~{mk2fs zt`)pP@cV+#3cexuzTg4De+lMto{I8LCZe1R1?LK0A-G&{l_1{-GW{KbI|LsU{F&e{ z1%EHtE%+C~F9ip1o(z7+2#ywwDWSFA2UX__pAOf`1eIT5#YHBgY8A(*(~HJYVo}!Ji857JOgufZ$<4 zSHSS)XQ0{s#|e%RJVWq&!8w9U1nUG>2(Ajbw5J|y^z;BLX+33dzqm*7`|{^6$l5rQWR zP8K|0FeG?|V7=hgf;S1?DHs)eOz=6uR|J12_<`Ujf?o*wu#rH!$Q293xZp{G69mr_oGo~{V4dJf!S#Y$ z1s@fBTJUAT-wM7bm^s3fKT5Db@VkN+2`&<>5o{4$BlwKqi-NBSzAN~V;NJz+v8LQX zf_Z|c2u>E9CU~*n<$|?>ZGzhb9~692@aKZR5qw85A^54_5y5P1G|^6u6+BsRlHfGK z62V1+)q+K5KD^GBY z;F*HOg7XBc1X~5y3*IUCxFCOyjQZX!_@?0df`1nLT+n-hNk3HZ1i`U_#e%a1FB4oQ z*ebY2@K(WXf{zG3E%>tFZw22I{6z38!R(-s>sY~)1t$s45}YqsA=oH*jo=Q!M+Bc1 zd|B|fg6|1_Eclt=ppiz73k5G0Tqsy6*eH0l;EjTJ2!2oS$AZrYzAX5L;C{i61V0rV zbfS@Cm|(u(7{SSca|9O(ULkm;;0nRDg0~9ZC-|`7Q-WQBuM6%MJRo>j@VJwVd?yN? zCU~ac`GOY2%aE#ir^%{ z^8^KQ+|04LA;ILCoIj0MrFL;Gu8?jia8-(6OT&&cs zLf=Q6f&C1jpA`JL;Oi3KL%cw#PbB=GMDY1iXy0ju_7mZkhYNkI(4&MNBlKBB@S81I zCAeDfHo=DkpBDU$;G0C0^H0ISr-Qx_`y)hz2Z@kxl+c9|&)+F!IDfp9=`NP=MS|sm zb%M=;*9f)?ZXzQ8Ho+$ae3AA+v2hR;yJ;{`_vo-H_wI8&(wLe~hr zT$Ao^Gi2DCb=vRdPwa{+~{jSg-6OsQ@!7l|f#+mRzg1JQK zW4vGyaTfMpgZ`aYo_7W&6RKO^)mp(4ST0yEc&*?@!Mg;1DA+0Zg5cYN9||5Jmf~}}<4w6a zMCfO@&?AK&E%XGzbBVL@xgeoKMC6+VNhTtWF6@pEIHxNTgeP8I8 ziF5J!4x#r89u)jc&^N)PJCQgKpUWXao+(7gH&tl-!lkB5gN^@<$}$ER}0=Kcqj1^ zrM3(GBO==EF`<7Z^b112PP_#DoH!q!r<3qQMC3axG{4ZV?UM*S2ZSCb^eEzdd|pX# znuISQF2MU3p__@|yF%!-LfGXOa%YG2>pf7 z{}P%%r_T66MARc+aEyeH6?!TWd`pOn;2$KsoQV9@LWhNJ6*?kxyU-m%ZxK2w^n*h0 zB!d47g1;2}gWv~(2L=C&2)Vsy8XP4!LGZhRGX)n2Rth!=UMqN$;N5~h5bP9uLGV?< zw*@~G{F~s{f&+f-ecaA^1nZgM$AM zbWbsI4H3*2JXP>a!Rdk_!T%7vQgEeUyWs7D-xK^#!Dj_u5&WIt2ZEmnej(`lj*%}{ zP~qbH)eONb;yLm;CSZW{xp=QHID&Yd`8*ymNV>>;?vIG+u70nF>4!$Rd&T#1=oT6w zhJGJ~A~hBfG4I8nMogXbJQqW*#t;$n&-sFjiI_hw5iBPnQ?+0%5%a5h!7vf?qE^9G zM9ep?6^sy3Si9gxBF61o1UrZrhqnlBC1O0iUoc99kPiwzLY!+pe@N^kJDPa5s0FMV4&@AtB(#5bN7Z5Z*Ps#NP zzdt~F1QG2xMd+zSwBvlC7ZV|Dz0hGI+VNVUBSf_0R-x}Fq8+=0-c3X$_X@p_h<5B2 z`a>ex@pGZSBBC9$+(5{eO+-765IUcT_8TMgSR&f5RA_!~o9$OCbUhL6c#F^-M6}-{ zLO)7G`|TEb4-xIR*8`l2^%0T%Edz*lT1-UyG!lz2t`eu=Oe5m?_^z542>mzufW@$1 zBJ_P95qe&p350%QMCkQ%BJ?>p3kW^x_x;e{Vbajs$N@m;>wF^g)JTMW+KJGMexFWz zCJjC4_t&U@nIAOj&F{;xz9R<$QBQuKlJ!#s_*IF5Y4c_m)U3j9+7$3W)q>>FX7;Em zbC8@pEbf1lrOyF!I!FJk`=+a|scc(TR#92WW2&_<`ZzdyMqJuYCgE5up8kPj!;V^w zzGwE~@I{j{DN8@`IMP}F`o{mLnvNs({!Jy*Qyop;`l!Bs_~`J4ng$+}<~Z82@7a>c zV=@1&;9z0T;*;an(lm0kqX)H-RJ7tW*2=b4oHnRSG3|vD7J2^Qzb&`F0}K19=~0uV zsjS}|c<5gQa2~qbmrMWA zX{t(VU41HRicNp9YymkUxWSwh%n)Sc4=NZvOQTydt;qBy49r~Iq zXaUO=eZ7hGPI@{lyONhp_d3#{=;U?yhh~j?141Yd(_zV?*Hz#bUW;d59k>~8Ww!ht zOyigR2-a9gM}AmBCHV~p;gpZ-U-Gk;<(GqWPWke|kLkz{OROZnPm#eXUlegn$27bw zzyHF6liw)tv+^;V>6mX7{yF7CGQEcZ(3j=cigZqXlaX))QcylNpXE2l@Js4%6qqAO zrvW78o0Z0|6#T4wgB<)O8h%MT7z=*cWF(iBkKgBW%C`jk5TxZB0<`iCH2jkCao>RH zn1+|-mx(|pzv@R)^5sZ6=KBn{Q-4JuS`lV1%kNVJIQg}L-x!2Zf4R7=eBA#4i==!z zMLwqCW%=#FvyhA>HOhO2_YY zIraRYquf!#kNM`N*;Tgi6L!gRXQ$c0PVi%X>g8nIl#evO2jgtFVZx7Tc-eZ4N#pmt zL%uPRj{LIFMozutgWnbg$YuFuAf2TZJ@~uK>4|kNbvB`L;k$EQe`$S$^DS zbjr8WAs_plZk3;V5?s@;l3=-r1J+vh|&eaQr2&`@xU$(OxdZZR_DT{F3tR1I_v|4KK^j zm&R|WL%xe79rN|Vex361`)Lffm*v-O(k09NP}0qkgf`uKNQbE8wcAlHUI!%Wk&g_{ zaz8;P%Y&Ki^9VdR`RxNg%16E6bwZNgKhoOmkjTe0yez-JrM2684*5coj{H|5gHyiG zk0M`7ntY!)8PYNx`TflBOUn0^$j3CiEWfAI_|13l+EWbMu=G5Qw z;8%_`)Zdl3t$b~UUsAp3Ni5s$}@rG262B0rc7tA5Yo*@o$Y1g{)u!>`Nl#%zME!!!?}BJMkikAPF6#u;%}!oG+qkJn=PbAQ348`%lqt6b>1???m&oQJzgci9 z2l*hEjXN9ZoczA}z0&XOS&uf{mf!awGxKn6%WKl5Xpb|@GygM=_fY(Erkf50Sl{PN zw-^&jrnA?*RFvbgai>8(6it=ti|Nj`1kk4YmW;nPY9G>dBd@(!4_-sl#?|NFO4auo z#M}D%()jJX9q;t}u>*G+ziZz{x!^Gn(%Y~7`>WB1$TvTCO&CHv| z;FMFBIy7h8$Ju*l_qd9pv1fcuKHj&9s9TEqLFtcCPN-q;I?k2xgOnPozbgQFgV8wixl}kl3-U0`jj#cQs9!nm(B_1V zzX%_Dyxz4h5mA9Sn%H0H+LHJvN5%i9I%00fh9=%cS;=FF<>APW`NV$69rFcDeX`Yk z2c0zQ2N_CQUG31pCe#u7!1D=%qw&Q#sX8)U0m@h5XpA!K8+lKnvtmP{G-pd95L_GI zH*!P5kMbA0HY6BdpR*y6i89|G`K!c-YkrkjGHrvd6ZwqC5e`f<6}s%q>3|;B^mOJ# z5}mGl5)stH)*bsz`(2TZJz47V*b`_2>hUD#dS`$-hAu(dHaH&P5B3vo+Y$R^y|>tS zX*amzUY4bTkOBO{jF&hCdMfllIgO0dw2YZz7nUz&n5y%MO$N4uS16XHqOR<{o85>vFh8aoAgA)nF6GcbBnw>vVcCllf9Pm?R|)_nzgmHwh>ce79Eev$>g|2%T!RoHf{ z)pfTnhy2{CJBE`%x|MqOKmla^FNOt5x@|tn|1rWKpDvSifK5Zzdo&ODSO4Uz?m?N0 z;_Rho{xkM&?ty;w(9!vXiX6Id+{Z4&QE$3k(Wg~MG(Mu^?%@jh^P>Nw4nKws zql{?m(1sTd&PRXEC|}>55xt;?ZSP08$s39cL@Wq1SWUqiUJ9~nxK=h=Sp zz?b+R=_mXGgm3L9d^*B6_7h%&@KtHy^;f0p@`hw0zA(TD))FT%iT+>3D+<7OIOot=;CexM@J*b-MqV#-w=(8r=U zrbB*rk?|uc3O|83xzI;H06+MJ-hHlj zFlGlRm(Dxdk(ccoP?Rwg{|lafhxGJ=)H8jxK~w)g(YTLQU~i%pV>$eOo(s>dc*gu1 zzQ;UcPLSupa~R>-cvju;CxNdMEub?{t~a1O-tLIorS={;8)ZVKJeT@9f%?W>-M6CU z;IEL!6}Yu$d{;CMKL!64g8z+r0+AQ8IHnCQM11$HJ@|y9&i5JQ#;HfiXN);9R}ebt z`bEN3^l3sBb)kOqIZufFH`1cc;K@2YqQ`{EoD2PNcF*TKVBxA1$Ei~g2#1XoDqTK~o{w+>rB)EQRNPuNBMgw5(FY;Hec^U}gx zq4k)GFVOQD&dH$6yu&A$v3C>nxDWFk+QE9*0cCXBK}5owb_JWok#SN#=)>0KBnf97 z-Hvd~6?A&mv&0dO`GyW>T`zKk<6WQ*XMJZm!Usw?>pa&H?v-%Xd!8eFfyi#>VjPnw zcanxK=yTDgXtTGpot!7UY@Lchdmn4>;TUG?tiqVL;kIc8NFLV1hS7eRo^`fia2x(( zz0vp@wMowjk8{LjA#PQ8a}V>J5RAr;E5w)?Fg_p?VdQa0y&AJ^1z)ZC4*`!c<(m_J z)PZR*FNlx99JMiEcnturA>hTh7WF55MJf~zB5xa>UD0S9bWdPNQw%;TH|mb^2!>wD za3|)x3VE52eQnS2#$M1@bQsexj;QTCZ0m`BG0e=#Ah&BW=47rvrsieLKL+zW$bh~E zzZf+%`OpuLC;Jcli2pLtM{W?hM;)v_n6E*-jx|LzHd*Ad`RMaTA?z}>SjeVd!K_5J(e0!oE^Rl5RH!>1)HTaK=aEI>G3OYUO$oQBG^`bm%J3jvsK4LNQ z_>re;q)E#%-a#J2Wo{Kah(d?Q7MeJY7uX|tH9z09sSEmK9=!AD&GOvb?E#MmLmjBk`kt-A*Yb>D zoMAakGxCb{Jq&;LIQU1@mE%@&E(Kj8Z_h}zS=;(J*pnA&n4asfQ7FFwx?BQXmSRmp zp0*5x=doR~QO42QMYl;f8m~lJoKLE4X)EkyJM3a6pvtLD`v7p+XpkGy;(Rd;3jxt*vjDp^8 z!aDI`F*9#r`VQY{BbBlSoAAzQ=lZVN>h;#G2uZ~6iAcs?T zIv%>h4>)VTLA$W!(Wg1}$!Er6{O^5~yfFVSlYA#R@*Viv*qG(bd^Vo;#QBvgta9fM z*pZljs+oVfq4UfM9S8KhJzr!fq(1g*-&hM97=b$ExZlxqD`@OZ^{UFA2z zKK3FG{S@g`;1BxQk7xP_FLl?|m2d_Bi9Yla`tv;P=Th^LxyJW|*7u;DdfBJgms}a9 zUttd*b}GWFN0_$B1Z~@AKEj~8WP1g>wkO7*P3dC-!TVuLi{h9|LX>$%wlMq?!cJpY z#MsSv(A+;@UaYg@S>T@?yx)uQr)8@r*0zGRGQ?->>(ZccFgDyARojK=5>MnLbH zC)#d|;{HX5V-w1T?gJg#W+p)Q%vXf=;@XAzii6t|%*%0-c~C~;C&)KF@F%oKPJ9yW z9r5&khJSaQ=`b11qaBXI-VNhb;C4Jm60C>I6VbYS#IrpyBv1AD{dzw!k8Q^F&5@DH zF%JlF{}E+G<7|tq@cm4)YBc>jX5^Uqdy zCzfC@G~wEvh`7qTOLJ~dDA$_qdX!C_SUKr)>2CtCW6qUoQ7(O!jz@i%mgU&=_aJ^? z)XWW$w|7+TH``f-yW^vj$hYafL+B@f&G&qN;5Tn|uI`dsp(9W29` zUO!<=qCmZ;eS1du&cul*lY4FH{RsBoOZl_WCprJg4{lF*R8cqktCg8^_pTeTpBj~U z6vip88EiW@{_9Apol!sLORXP5@qv()^)&Ul2XgI&AG)BMb2(Lr{Yj+f{Ilv`M|uxp z^Wp={?^PIM3hJ|0y_(}v9XY@F>WIG!d(lW6e?ACA8?#@}D{JquzQ=>O4`8Fn6Fa0{ zi9Pex5nZ>L@T0@fw`QVF_ykUOh;{4Qs`W~l&Oq6=zINPWohdWxOdEU&b}$n($D5}x z2gt`W-tKjCJr`|`#%_h|*QV{kFGRXSsLyT;{Drvlar2zuPArZd#r-U11H5^bGw%_Y z1Qj8E4DLrjAI7~HgKa79#hI7^VM5x4y94(K4;bJMd$C7`JAfOC)O%%o-E_-OTx&Wz zpTJY<3UlwMD2g$c?*szei_QzeCaBZ=k!HNJx>O;|Sz#MQ?pM$cyS)MIv0zQ-+Tumq zc);Axbx1h!!omL57T7b-Q{~b4`*?q}5B{UGyj{;>T!EKBwhzKwcqfqiFpZ0;$7 zENqVfQcne&r@S)}J^Gp#LkyJ-d#?=dP3w zQ62XrIA4qS24L<`gf>`=_Z;f%v7BeY{>EUQX29UZH{XUh(%#SF) z3$}Jr6k}^AWw<=P0d215n|OYI0`}dqyW;NbNUj%tmgDA=m~VW`lNWme>F|jQ@Z~&i z1ANoor0;|MgI6fN0y3Pe_9a}MvwF%vbKOS0dC(SCmtdm(Aj4X*H=Wcg+9Mln;Pi=0 zT>$Sl@c|jePWZ&J|q2wLSSGBN%&B-V~-s zc{b0KkQtM2K$+QvQS4tEd*$8++HOC~;`pKEjY6*ID+i`v&yDQ{KkMh*r4jRV7iA7d z?l)k)GoS z`e!_SPm3~)7rs_kR#uipzlA;{x?2#Rd9+U4?|%yW*7Zg?7*=~-VZ>p*e-3K}uhP~tD__7LNY)9+c_#B8} z{iQk&vaX+~2M&IsI`qEeCu+?>56Yx0Z>VQ=*c&Q(@C~&UcSO^S;}}o9a^A62_%pm5 zvhep!^W|1R-UrcWybIwx%2A0z+t0 zHQ-^}@eKF^@aP>Y^G~*^Z9iQ<8P5Y4%Q08epV>GJo$SON#9fPduHgASs=OP0qC4)HemnFDorLFi zbI;JL<|7|}+Ah%TDUar`A7+HGZ>27Y;XUiwF13Pt`1?PE-26;VO6E}fbm)Zrj{NYO z0P*V!hQyy#>tjd8&%xaBuEd8GuO!?7S9jsat@vEc8icJ+yp!`*;{FNmBo1MJY4OPQ zi6Moap1A9kgeR~j_D;?#@Xy`x(wwb{&I#)=_N-47;<*(0cY^MmfH5I_M}mHza&}Hw zllTC6kB6QkuJzitFIfY`9ELuD>#$7de3Y~o>WThud@uVlZ3yyfpPRK8pXFHd!oeVP z{2p%XkL#=RQJ0=aQs2-|%-w-@3mbn^xJLGgpm*BTm?+j8MbyV-oR|BnUH4%l|2axu5ToOfZo^Y-=xKg&YD!TFz-3H-Qj$3~7Gqixu^pldOP z!2Xl%fIZw^Klj|r*%w24uM+LjTZ+$^xllHq^B#uI*W^@myK*AQF_C@9`YsoAz&u)p zU^G@V!F(R+bNW2Y<5>P-S%Vx(UxT2owWwFMYt!%u>cGB;F7AH~>1hA9?{$G@nYvF< zR@sZP^JX97bQ|D(`a_VH?V@FNMf4s9c=l44#T+Y8|IAQV48JAc*yhf83Hy@u8Fn9m_QCdL zU3Ox8a_W(?;j?MIoTp)R8SjMMFrMK~T_nTGqcM(MtONRkKLhj*(3Ypphp_t)b{GlD z;hXvS5Z=3S^K&6x=o!3ubw2KjsF}texq{NZ@ShlK;`BY_$97d4&F7>d?Wy#K;k%Q0 zkd}Uz`TEOKC}l8@JA^(cWqFENX5aES_sl>%%PpMw0@q)tFMcNzWgh|`+9>;{p3|12 zPs87temgH0hN8#HLt0+U)qw7S3-~_ZK061Pnbrra?r5`=oxVrs$LHes{$Mo9n&nY( zwl(+fypWCQN(ZVq+qJX&hn&~Ne-ipt>=5kbP{`PdH*{MvtzD0dBSIsh6ceJ^S{f#nO*=-zcZI$q7O|#ir(6mqL z*V-}pWnrJ2`eglV-N-k9@zv_#=V${v_F37mf81LHd*Xc%?Zcb?cnkc=ZuCQ}QImd_`q_q#y952*558MrUkdM( zeG#;K2j(Ye|7$T%!M;G^8MPnn7>Msw`>~%E$VG?Ojy4e}rAM*s=-CPfpf=>o;-^eY)U8fEmIt_BLO<)WD z53uHT<9Q_403r6T1^DcP^0O~_%cHSQ^-Sz1fj@9A6nhx?*zZ)p>|eT1moXo84+oEY z^!0f|;K%1d#$U!d1HX)QfKNE^BBoPU@m-Df51YY5ujfTyZm(I_Q&+494ZS_tM6HE!%)Dz1Kkd$${P}^(TDkSh8V|LBQFzN@NJLy#c+OP2wMrWaT zHOjW_1|1A{4KQ;1p$9e<4e4w=5hdF;t3=BnMyB~mE6rp`{Bi&=v(}@S+ zk66#*BD}Z5J_X(@C1&CdqCFP7wk3+-OF0j8z7Hl(`~I1E(RO}k*lxTBwc{J(A$G1R z#k*mw$%_j&_Y`3bNuC)hf-t^&h9AfK864J!blQ?6K@08-`vGH#NLH@dotEHl7^9XX4a`?wQfe*xN3`8X04FBpTa; z&zX{+AL)JIrQ0pojXWW}U+G1fF7yMY$-{d)@YU^2+L`vJ&>8oa>^n8~8@?lF`cCAZ zjQWp?;C(yl#C_)=Zcm2l@nqoL6Y}!?cL8M0fKJF;MbUo?G2V>AUWcp|l*siid<6MX zHohAT1S35o!jYa}VWcPZ&JLeXgS}&~{?#evSeM~5-K^6B=#_JyAavvoW32!^=z5^; zl);vt4_SOcBM0L-PG*7*LZ{@zawmtjCsslB5bC!V?>=3yXYTpi_P>htMjDP+7jl0W zc@C@p<3YKnxPFruhPpfDQAL{*ttUBj0U7wYH@@Q< zi~8*?>WZ;ml+{>Up!-;wkE@{|bDLY`m{>GAGuZ~3dSy}_4bzr}cSvD)0j zcizLCWt5{o2~VYN>^>FanJU`S&9+q?KT7iE=cUk1bzLz(>SY;BqxB}(wRQ*J?e+Mf za}_oHl)9lFDGxty!1sA2|+m3cL0d?}1BRrb=ya4TuzUNfLCDd<{_J%gb+<0>$AAFNMq32BK&e$IJG0gs{ z8$Q3?;q%{e{SiJVK!1?Oax+jq`=+*I@YFU2UY|f$SYP%sT&F`^G30m@Yl=*i?<^Oe zPtV)?(l)+xiFZ_R?!5%#$F||Va;zf<26FMaxx6t&c>js=Mu3O4*Nmc6d3cAGHx@pI zV=v0hOO}f?9Phc7@u!vh3*;$;{^>tx>(G~fCg?}XK?jPveVBLd!sq7;p$nGDx={|M z@u^5R-{HcK_EMdjvn@k&)d(yUL1T5J`0n9oBitp z^bMN_pNs2t`2*PZPpfJ%QxAQtp@FU0N^OaH`z8-LR)ICGaNr z=fuB#WPHwrLn1vlKqi!hISbmgvora9h{e;<2AycLF8Gcj&ONr^b8lE5xwc`;WN|#B z>t@KZCUFP+e@6EjyvIOV+H?o{KoEU9dQo>4`b;L~9~dWMSa<$-Sm9k-e(k5i?0bQ3R1o`tV8&_*!y0OJ=OKyYQSdv ztouueVZpl+LtuAvz$X~y-rypxvv%df#<&LHcRp2wi1&Aa&3HGlJuw)%ccX5Di?FWG zxgFij>>mt7+jy~ufbT})vz_aEGP?P0Wl`*J)OU#Oyf{vMOh#GM0c;lI6w2v@e+$Eo zTpgNMMuce>#bzLW1md}WFbZ-`Uviq ztCN0t5x>d~U(N5=uI;8xD(KiBJm0K2AzP-}*v<4Ve166ifh|e7nW&TIP5B}Fu&(uJ zfBH>+4uEZlJROl9tlfIuD0eVqrCu`dSyjeSzsyfLlKHzi&vWqTxGPaO4f~+56H|A@ zp*^#(U*JMpqA#455!jZ%9KDx(u>Y=+{HWuvicDU#cW*ZMW}t5D({N9CXSEIE$6C~< z8*|P}VyD55_QJ0PLU=C=ebKjhmDI7Ey4{xWq7LlSKIj79k<{{g)V71Z!ZqE4V58aK zPy6x&x?$J+?0p1#3|L17y6|~_Pkc~bk@n4Agu|!D;WB$m(|jrAf$jFX5$_Me=NF;u zV3*Y`)+*F3><;UbLg}OYj)eW*YAJkfG5Q?O@7 z-Wpum+|&?UQQOqg8XVo?S2O0#n=>!SQGvYPR$#^D)fE-$NFDj|F- zxUxm@1ljRdR;;LKscNp{k?i5dWs-zX1y_bGd1bf;^s=i}ML1kvS5?u9BcaDHySfgC zPnU!)R0XxI4fTede!?lA!krHVt*cs1Bu?qAgCs30EMGjGz6x0jT3eU);k|0y(x%4N zaSSeKN{iDmE1Q-g%KRq>r(mROTU*0tj~}nGg%8VXYQp0x>g!h2D0AvCQ!r+9%Xl@q zWps=FN22n~$-#;?sI#@HDOlgsxXiE4uV|^OQaZ4qu0^+NC4;>KcQmjBYu_uMkkP%IJ7>3yKV% z9V}gR$t7ho=g$w7oj<4e(jX4EZmkL8ykVFHj@MoO>>#9 zgi#**XV9E#@9gH(Q$;n7{x8GNIq2@!)Lf>0gH}0y1)`P7QCKAy7-97Z*h?!`G_|o_ zL7w~E)P^Q^HgWT+a8nB!X>720m2PfnZKFQ>lLMscs%nrkSdnx@jX`6MV${ubD_~SA z+*XMmkCwp+>P^ix4nw8q5)0L?prNh4wGN7I9bdV+wZ{Ay!FPj|O>K?U70s*9;pxzd zF%Yl5zHJ=;jpsiTsH$q)8kg5pQ>KQBRpa2gAV?bvuByNx`pTS19&E-D+s%!zo6*(A zp=yJ!Y-RoOG}qX)vN70zlbu^vhfV(>tL9Z@ZP148GP7$Mg8JlbcyL%y^D3(< zju|O&;7Ed(TwHwqf(t0zXtv4OObkU(r$!3&!B&Vt7F$AbKkNxr7i9js~ zA6Pg}Wl2w0gaAy!5w(D8N0yF9{MVONQ8y^o1}d_Z!nf8bR8X@G+3F!wXT(37w;GjM zr7IL-y_gAXD0Z!ROwVu&Qf)OE2qwcK)^%|z@BR95QF>m|rj7iW@V3DsZuWoZk+(--Jd1kLbsR)LlT=Y!N>s zJjy&GP+yi~5LBU#`bKLpY6|Xt8geXxjT{t1UzQ=8zY90iPWVJW&clCw*;FL5aU&I> zLo0YbLwPw&q5s^HUS4?2A&_FSXg3B0YBi0j9u3 zQ}Adi)o*Vx%@!h5<94YlY6127G4%gY_BQZQ6<7cGy}Nf`@=A~ZiJ)dQ$^|2Ym#~pU zNJs*Sgd`-J5ENVxqEI6s1i_Y8Y_VF46%->9YS@B2M-XZL1zvHyQQ+%xB#nK^T2=FFM5dzVcJt{1dxJAwlm1(ZLd>b;=$ z;<2qR29FEc0Vsba6^UXzurCJug+L5V{-9t!v;|s(;E+a{mVYMiG~lgxq@{=~)r37r zWIz*vK_XNa$%2DKZqtM_NMw&DLW4y1Ya%>IEXwt$fW|h&N6j_06c~SqUsL=EYIYgC3yIA=wP8@t`zQ8_5af58)xs@LfDeQU(=uO*$F4 zT4M(H3);H}0V{@C$kY#$8*A2q1u(b_;(~TCU}aH83B#3A(_RJ~Z)DTfS##p11*j5R zf@6UE^tL#J${*Ej(Tj?%&~;{To1nd>o@`)LYrj;jH(g8=eO{zZfHuMb5wt!@C#nC8 z|MR6wk8-_ySzKTVRMCU!0`>q^f-TdQv;}3X?)k2GwdmiO8hxF+pgS{U)hv6KbR`EM z)Iqs$?$#iYV$o%xX&T|1wihCs1U9Wi64@_$b{zC1``S4v>=ASx`2STD6@v9=D6?Pk zXRH@knIWp|6;&=|@Q9$D4324ThE$qWmX)iK3QIOwvaHycieEJP)CHPe!_7#sRZ?{@ zU}M9G%Z*&(rm=~qXW!!GabSv(L6b{UCZDF#bJ9B%i>Y70pjOZxev(Ne%F-7rz+S7P z7;F+WW7%1WpNY{i4*)S?`Z@Y9Q!<_VAy@G6L7cwlQq`Pe|>!8$)ZOEpr|N~#V9 zhmi`!=QCtcz-xUK&u7K&_xKF=;(=EC5j>|+Hix&Osb#nm4^q&{F2zHE4AENK#x*rcMh~XYQS-O-K^@2ooGVnAm_LW%d z)414IVsX00n^O7nefjf!`SX4GVKn;B*!)rCrzOK$_X|=fR-Ca-Jce{-5|!c0?gD#{ zM0L>aE47uS7u1iUOJtn(a>x$gK@XHO+$8J;3^rWM~Mf_nEMI3j50ZqKqjTYN!m zF+){;mtHL*I~aI_MC@Ten>wArc5R_!8B#75CB8Pxu#8tB>9`2(HOaC#f3DJwim;4U zVtc@MqMQx}wR+=2F8@q-FscHN_y?}zY3)LAiM`hlL>|GD#kRn;&@L>8!BIgeMgB}V zwV-rVhN6tB!-H;!GTej*`yd8;@Q}@LA0CteD1Sz99Vjh0V=qJr+wfqV?niJ?&$CN9C?{Rx{noL79sWnIiLx9&`6LN zWRXA9oaLZ~$mlgPh-e)at_8Xk4=TvuIYGM^9KjQ`*4u-}fp8fsg%Dw>NI#_TZQzwj zBWJWuCG^-Q?XZX~tJ`6bsT9u4jGz;oJeH$;SWdp_N8-AsDch&v?U6EiQ)Tp~%IHm% z(VL$4RWKaM+nws}Zg$!I(q$QYov zo{TIzq2O*&GNVi$6SLA;jo_|i2bo0&Y6Nr8Q`GmQe>}^?cX@R!56j zNHKgb9K$`8H)Dh|FNY+&GlP2t?b(YUF6H)6%;OrRn1doQ!@9;I1IradW|rfIC_;u3 zJQ8CR$!hPE!9$}g6KolxD)FGr80;1_&fqRVJE-tt(K61`wU%)Py3KkR92Vhm21f+# zVeqczGSH=GRPGT<)b$xLNQ6iKu+5ZApP-D~(99~s1Kk10qT8M+zN37WBe0@oW8T@*{(!XjcCf;vI7mf+PSrAG(S z%Adbg82#V1)g^W?(CrXspcNM*rY^ckh=NW3W@u z9tIS}q81FMgl4rc#sHJ8*tVP>I7YA z$`XMPEPqDRGEllSOv$f30K~_i0)JoNP-0NXNq_Z)T?-K zB)`QTBu0r`by655WLtr9X7?0G)g{AXUqGt3w65r&SO48yJnOE^$iT^Wk7VfNYE<7? zbTXg5Q^_!vy-2)IGIVT1hV6LRJP4>gP#$cL6}#!6h)o)m7634fK-y<>+ocIF+=+n4 z;8{*MnPDs**c=0d__t^$G`U~2$++KUqI^jxPDex>wq>0-d{hmT`$ zzwV*Ry$D$*a#yCx?x6|;x`0X+uo9JK5{6y_bu zCN*T%W;|%;^r%`eI41DA`_s1Es4kT@TEK7dsK1UdT5GBweYQ*bO|B;OV98jgQZyxC z#6$<#1gxtNR5l-#6oQD0hs!k7v=xu=iLmP6XH(jfZ22WygOvP&mTV0Y;q4IohiOMh zwgxG6sph9kt^?x{Jlyv%+=mCP#^7l@a;8M&Af7C($+~Qoy7UsgiXWsyFj78l@D=j2C&y6V1>~d z40J&mUgHI1)XsSUQhIqiRsdywS~`N=8bwn1Gwn^H2oF**D8X~$)fsvk2^TOh2^VB| z07UvFHcFnXYo=O>TEIZ3>ZWxc#=~Y93x%~MbUy<0X*_y8jClDoRbY#<39zhTqT_gg zHlpj7iWT&3L9jx)zE|f=^(6D^vO5@5ONK?Q2$%^o>QMyV8xi>s!FM!*)>=ni)+iR4 z9Spd31K%DbQYrjJ45kU%kzVXhFm~Y)ul+cX!-gQztZM*F{!BeTIupAaPB%SMhHy43 zb^}`w=$2Zz4^^bv$W4_yG@34m@^yw}8TN4d%)$|&U}4edF@?kJ?$PMDX;!eXWyGw~ z8F@8%0T@Zpwp&J^=akhlB8HoX&{;s>EQU!CDM#{|d3lJ463xq-2{dOSB%c(nEBVsw z(qJJZg~pXqCO*>9;>n`$ypRvKWk@93sVeq8DBR&XdZHVm@kWa*n0~Oj!aEf|P#l)3zkS z$6z;n+6H&WY$!ekY{+KeW0~TX*(JnJA=|@Goo0<4Mp>t&>TKbS7&Ir_i50Od<)Rv6 zaf@*}`NBm7&hRAyS)PnTjx*0f$DV~8*0>RNN)XO2DochtW>9g5YqI|;$MAjlz<4Dj<-ju3l z%LrYQIllI!EzI>-c2+6dzZw58jMZYy8Q-Li&?O;iUMjT~*Xk3O>P5?%Kha)YC=BT@ zow$uQtW&Ya+O;L$I=hs8)R9FJduD+)Y%f)30jh>>koN2HngEJfiHqpW`R70wHzsDv zyptsUWbOABkQg4jBm}1fXVL)RECPsHA+Gzw^8rHKltqq{Ye#L!i$?Ia0@eV-k#osW z#M%YHQDfmfMj|qR^6fD}Eims=bm4Q;B}HN!^a$=aW_@pEZB=zIIbjJ8axFG6pW8r)^y4% z4t`i;S%tf%10NQgiM)l+`10M4bdOgfZg}t#jMah{LI0BRC0g!>pbs#OprbuSHOo;YSO%a)4-kU~0okr7}`OD`r-cMJi(Ol{I+8gS(kMgJqy!7dMTrO`|)~=zbsl1<2bb^n$>~q|^t%DsQVh|Y9CEg*zBXJ&TT^b z)ER3pjKY6u87JFafenysH^RJBN4^lDZq8|GLlUFn6$ zhi$mYSNc!TJf+a8L?~`!*eV^}gx2wrp&Q0b1WkWGrvE%NH2kYHbUBdH7DQD5F)Fjl zbw0X%4rXc}&G=0|n(^1C=rOGFF3_dR5V7Bjz>hpg-S}EB+nGACuFruU^C=|cYl+e* zd?C?OWvsoJZ)R(Xy|<%6=Q_Z|6wepD5KTv|+n(=VnTk-6oj&?jWO!HT1%XXSg%;iq z=VmV`hQETP@Kq}`qr`OuckDwM4GC_j~+G`YXqUYq#Bfx zG^JBu=X@C}*o29tg`0$TdvU5U`Gp_O5OjfDd@`b&rM1)W%cGOy>RBekF$JQUB+J%VRC6SuFK(cHE_i^F+)Ifjn^)nd=uP3ue|6$rNeb0t! z^wHFPv(Ow@FqT4e4Bs;|iog$nElqF$Y-xf+5^p-1^9{u`V``%@f`)-^7fNdlqrqe$ zcFlL;d`sDY1&f8{gfaCkiNpbC=gMkz4BWJ=R-1CY)#~Kaz18aMT&`C0E(U!C7c;Z* zOGcn?0bS9XqJIYZT+$6Xe&!k2LTH*LU~%-Ubt>t3xj*A#XeHt=tpYtK_eKT!GoWQz z*&!Mg{1NmbruXRTaxCS2^v$3jnveJexi_7OCGB#?wdBrRXqLKjbGg(l_!ZJ!qRW+K z@rR&gdDxaK%f}cp%W`tQrvC|g71OtBdg57@^(4#bk$M&MfPRd6cjsOWQ3Y3kUdQz9 zxz}(xIs=WhophJfW7L@q`rxe^jb<;)Ehw=s_&JC8>-Lgz6eP*6s ze9$mHfi9=l*aR6I@mB%De)fS)1G`?>IvGdeZ7CY=#{i~Y)jE&?FILH6sJ25ykn_Yp$7u2 zke=?e3|jWR9``CQmlM?EgJm{AW6sNLmMcLo0L_ymL(?0t)HE$lC)nmCpc)i#zmKMX zy*`=(N}QBHs?EC@-49w>U77wQ*D75ODUS&4Z%ADwN;u+6OPY5zLn}@$XJpggbVYl; zRCJz{C6gNkK9^=H7S`VcTjjX;;?s&c?Q6$8vy{9vv?T?kmHRs#-G zp9U;axFxZMt9t=YQjY&QQYv%XOPghsSrE!mui*B`EobroBdI~V4{sb6SkqGNr2^dukfH~?Cz+81LV4k`YFkkHhEKq*{EL8sl9HvG` zS=Z@+!_^YNlT<(82(=BcSltCUQvCpMlsX7FTH(j&QCCh#rHVi3ce2*E7#lsu*%?&b zoT}7nKwI4c7*PB$B&ZGnI_fB3NabJ|6;`JLMpQLmRPj~)9JK*3SKR`bryc~%S3dzP zP`?K(RL22_sZ%lY7O5G4!__jtlhn0VMeKXz|m?WV2QdDuv9$- zc(VEcaEv+$3zV^n|MS@?su}Q9wG8kywHdHX-3qAGcK}aUzXUu({TZ-a{Ri+&H5m(s zvs4e@IJF+oRa*hatKEPT6xSSQt3Lo%r~u6S9CbS2MAZN|N%63zQf&jAtnLS#qPSp~ zs@?#crXra5t5g}_bTtDorg-O4tu6sPSA7m}hI$gPM*Rk`R=oyzo(ggQti}S)Qq_QU zY5`!qx&m;vx)HEJagW`oo&s!AF9Xg|0d(1`5$g;N!QIk*Z>aGIZ8aG%pk|P#ngFA! z4X{Y{0+y-efOTp$;1*k5$snMvVc@768AR0=5#(vRcz-1A;`b5t0C=A+Q-4C>s3Ppl zuP;-z2#Qo3uuQE7tW#eGgw!812&k7Cl&gO+h^mpr2rAV~2GD{*ow}9*a@;OqKz(0A zM;($ds`z^xTecLb3JJ?pr-XHCKtg1^Nh1MupGF+@ON~Tz1@@Of;lQ+j${j_+J_XQL z=K=;)H(*d*0_dnK0YmBrz_8j4hzbKn)z1NQ)FHrJ^>@HLbsR8Xg-6q{O99K&*?>yT z0X$tT13W`*0W4Qv1w2!IAMh;oYrt{puYj(~flA}mM8FA(Z^@snt^%x3y8+M9TG!#A z)p1tms^`G7)JuT2dJ8b1jspf&lnK-rz>t~*7}ohVp3Z!4=c_n)mbwJcR#ySS?EnVV z*8v^%5MW6C6fmrQ3kVkr2p0>OqwwFgqPC|3=BaZ4^Hm*Sfm#4qsFnc^Q)>Z>)aL+) zt3kk%)Q|nj#GaCbk#or$E%W4*s=|P zXR98-3UwLaIqD056V-PBC#h!vE7hBTlT{uTKU36cfKyc!;55|=Sf!Q%PFI@%V`@8K zwR#BfTy+p|hB^XRqmBdCs*=+_W2 z&j6gGVt{ki`GC#pV}LE{Q-J5I?SS*t-GHs?hk*0d{{XhBKLfU_V}Kp%B!zQBRSwvx zVt`$$5iqX$0K3&zz#jD#z=i5Tz+UwX;3D-Wzzftr0WVZ}Fqp;aG{7Zl3gAVm6)>Te z0WQ@xb@WWy)Y^RYIq+7fuLC}9t8XJXV5|KIp0(9s1m6y*eNuE|8g>>3Pz*4jmH`IUb%2iA0~k`z0*2MA zfDtuz90$;Bz#O#%FjsvXFi+h9n6G{gSfE}7#5@Q%OqIDDK+S-|)f&K))K0(=>c@b^ z>Mg*LsuaqMQni4i)e^uGwF$6P-2w>DFN?d*v!PGmJ@f>amUV3cwYWPGp?-an1Y98Pybs6AjwGFUDx9F9XP{9cV)mOl?)Ly_>BkBNxzedzw5WE&q zp-H$2h^Pq&UXQ3o1aCxC0>PURbv1&wB5F5+qY?FE1aC*wD+vA`Q8|$PPDD*Y@Igei zBDkqdmwN4Fmipsi>N+qj^+iBieFHF{o&XH0{{alCLx5rRH^7LpkR_@{1Lmk2z&h0m zxW!g0B+zn?OoiOQsDRo9rlsx%wACYk=o!GE`XivD-Uke+qA8R<5fI7&M%BjvbJX>K zx#}LkJhdM%U%d=ipezV4RHp(CQ?-CaYBAt&wHfdvbsOLa^*CU$6)uKrKJ%=|2cSYu zxD&cW{;Bbah#5C|8ghr%+pYtIKb8~5+c55U5Pc*zVCypeB4DS06S~xn;Huw>1cHykA0vsZ%q zBczH8*MG|pJ`a;YI(N)CaJgA6oe6{+QE!txrW-WhEs@=E1+)`{YL@a$x)q35p58y3 z6q}jilSsj;F~vqN$6cu$)|9)^P0qijvQeitqfXPTs_%dm-Xh(o`4UNBRXxnOFJ_CI zI*cM{CRWuxqzZg9D*4zUBE|~;0qFFF^Kf2b2et;?LrC>r8B$^k>%L`(>w;Ti;VLw) zLd>l}%Z~BT?M6~x3|88){1&{>1VMo>1*h4u(V%!)9M~1Cwqu7tu}=eE4%XT+ULvwe zfv*JX5Et{PuLc|K*q@P->IJ?QY_?->gW}y{U@+Kf$NmY*M!N-e2RrOo!TFd{S;FnX zxE&jAs5^qacB~ZCqs(__aIqbm1S$`u1nv$lwPP_u-4k44$L4^#7WD{xGq}=@b%T0_ z`R)()+p)#ab0l^7PH?RqTZ%Z*Y)^2&j`f3Ln+6^XZbC~yE1@0^Znk5aP0H^Dx7e|5 zhWdVRs~y{Es7Hd=+p(`3>e1jfJ9eL;eh}Pl#~wG-W5Jzv>{o_*Jh;n_RWy3K{5W`< z9ec&Z{Uo^CuEzf_qIKCHbnMgava3g;V@0{Az&I6*U(NLxPlIvFU3Tmoq@aHZJQKXz zjx`$U7r}dME9H;2SmS!pQk8*4L3cR2o=tNBOr$tPMBULK1{rf zr--p`b&4o+>rzCy+iZx%LDy|h5fxVWW?0^I3np>Q4jc=*YY=%kmPr9Dd)zM@;=^Fn zeaI01gho7Y>PD}3_@&vwDYd}KZYoAj=8Ucm_X|+b&kh^b1;5M;OE=z*twv@td!%}u?s+bjB%$s zQ9Jf?V{&IW`F3n8;$)zdJ4JTvW>8}AXFA1p>=&S3WWKYU5gRbXRICL?TeV| zTnFY6LU#)_&)JQkVW?IIJ%37yy4Q{=L$%@U+t}HL>Tvehu~~*%;OzAoe5dn>9b14n zv9K=ZaXZ#$sJOGwj;%9Px3k}lea1-Xah|qgy9~9^Ibg>gHdL>3(60WO$(KMYo%Wp1 zYL|j>Di|-B6wAOk1&qHN#>HTa1;a+;iC)XW7z0MJVXOcH|CdzkOvC7NUO>-)dXH_| z?;NsYO`xRRE_V*2pFnYD4XkmF*s(Q+TI>ATj(yTlS2(ZQv0Dta&Up=k+EDAA*D9vlluu(QMxGR~5Q^JDaG{E!7HN)JxJJtqj78)tAII_!*T?lF(sYGNqrssOR z=QIP<(#TzQtQM5iZ&~DCJJyw=?zdwf1N9P9u8!=nV|RiQBUm4S%YGD;bmBnd5j(cu zP#Yp}*}nuOy?te5pB;PAP#Yur?bz#v+7x-(j=c{`WPUtyz>bAyd-*m;;IfAs>QfQz zvd0<5)nL$N#|&c&7oz zG#KAEjL#y)C@`KfjO)M{3C3>?<9aZP!Fbs)J_iQ=L*VLn4C4kcP68v^;8peWUtuNcNHVB~=DpkeF;BMQb-hH)zx5itH}7=vJh!8l?VyTJ&7@w#E$4u%89al^O+ zj35{z8$CVl1tS0km!P89w<3-+_656onqfSM6l1`c14b!^U*KUdP6lJ4VSEpa(igCZ z2191UMePF2HME+`9wRBn?cHpdtdjMEB-PgE?<<`KVSK@>ta5jj0K>U^j zUs9T04hlIIh1_2uhq&_#LsrV2FAh2G?eJ9MN0x-5?zchk1SgOP<-70F>(fs!3l+Hz z+C^N$#i3$%I0(*Nf#snRx6}|TLS?Q3!Kp6L7jj(}#Jou$R)#9wyFrvwvsIy2V|!0)uBo|_NJlMgsSbBg$haB+EASxJIPR2gz(;AxEa&c z^iM>o~FM!~QdEoDXsQU*H6ItbV0{QL-AZCy_7AT4- zh|OX;_ffzR_UnLa`&I`t>5O)s+hJ&qnu^K}~f^B&*E=9yQMuQ!B zv3kS_l@pBT#o9rM$IA`&=EatPx|cEwf{XKFp8zF>Q55`mUaY`S!-Jp5vt)VlSLhlz z90<-q7FjP`h%XqBEE@Pz!2Or0)e%&l>xHcp{0b_cl!WDptcIkJzXT%I1dbO65<(k; zWO_mcKW`C62#zFETeefJ@S~79{bgh*D-M)}+=qaj$?jGmEA|+ODI`u0S$1rni8>=> z4UhfQP~{=(B$+BD+nFJ2MC^IQ&0@Z@LRPVC;Ds6&Dk|26YfZe(qbBfw8*=E0zD3r! zTVOJe1X@BaUzL`f_=9U3Ybgc*y-kirDLZCPh5#-jE``X9aOkr7O0@ zSIIhS+|96kH*mIZWS`?7*%SREdy;=-Pxg=OsTkR_AZa(NG7TfU0mRQpRAFS#1tH6^ z>7lW19E5m-7>4;u5K`lFL*?!|L(B-B>0S#$JZ%j=Y#R3jeDteVdH3eiLbA z{Ot+5?t>si?t|fq)JpZc;mXuX^`Y=I_ckB-I<2?Vfg>tCPO?CKIFC-;>qwI z+=YhtQTUJUT0{Ie{Gz+T5I+eYcCRVQ%R1Pq1 zZ7ps;oxg_NA|SFGdJWbz62#{a?Yt3o+-V?a8P40`sC&L4-Vf)yi$Jid&VRy1t~q{l z!jWQknMoFnlvv>}K-BoJ0GtZ8b4N&T-#B+ny>B=GSKu1394pM2AP@FL_kb1tCGgO5 z0ORVg)XsNq^69(X(>H_#xU&QLPDK)_$<5)Y6~@5|+GpzX%bcf+Y8C63>UmIW040BgoHLSHnYb z$vj}yTnGGGR`N=x=2hT}Fj?l{$6>=aF!QYde*!nBb;kc8h~|8(W*b5&;c`oA|2<}2 z<5*#yK!kWuGT|2hzhtiNar+Py>_w=OBpY zEU$S3rAnRpbe(QMlAKFXCmvRYb}|=t(~7xz$DJh2c(U!jhinI#bS&!hZxFALI2Cn@ zBFWn%%4{^{^T4zkY~85@R`@l*SswoW&;-6}6v4J8i~%?UhLF=RqXa>9&eu}*J80D` zL1EIJw>v3YzB8J#&Aancw)~Bvlr4X=xTX&_wVO8et&*B6fZt90+hbF9`aoIDE#Qlt zK3HD!1K?th54knZ0GDzfuBdt5;NP!I+3BOxtnja(d+4{U#Y+GeAX(0|8LbHNb6!o= z;x(&grK!amPR$j-3o-TQyoJ^q0VGrcFyRb{6D&fjaUM9N<><-1nRr+~jm z{C%h9I>SE}t-00UALiHGVesQcHTMJm8`J;0*nJpyh;_H@688xZr;!NQW8G&!oJ+#7 z%iQNdw37(i=UIalJ_35yRE-}U z5~qDB+Z6r}`BS;{?UIh+PDaN}0%nD$0fy-4!ZU$s$*GGgE6mkOD!n&8Rt-&Rg+IJ6lC1<>?_5pcD|s8{gHFrD;-J&3xBo$=-H!%Rxuq*7D=mzlVYnkt6OiAE}B zg~<&6DVbWbyaUn-9|NrW7R8lK$b~Np*8y#x@isV4&Mh^6L&(%Qx1!_;h;L#1j2Y)5 zh~|8zW(q=yzt&2b<#moVp$BO{%e3ds*eGc?*KoPI5$v2#SvCD8-xj3(GZb9{MsR-k zI>b-78Q?MIt($Q_g8ZBtYQBO{%zv9zbBDpd;M9BrxOma+Fjy{JW=X60d*S!s)>Xqj z=bSbE4d6Edb#5MB?>ILNcX?UMt6FFKaLfHH2szi?fjL%AVy|S{Cj+zDltD?i$il+L z3Qt0whGR`=uXBNo8#f1Q^uV)0+3(3s$Uz)=jsjPfi@(At=V>75>H@zG7Fppn$Q2r3 z*7e|j&$+n3y%fmj!Eu%spfK46v9JrR@NG~bCzqA%A; zElV!R#nCF#%glahZoW01=ZL=t$GI^ld=z*idu}#C_&*>+PA!V~AKWmz*(>sA?JR2Lp#9)M+Y@T~o#+ z*8^776-;m-hl%Ch*<)`e`%HcLEXyUXl&q>RfgQds?dIBQ;$=qenNkRWRrPgd|C=sW za^fTbhblJigqJ*teUAMGm6><|4EY-54VEzxH!0RtamG^0#F7Bs0qY^j8cv!CQeJI% zi+Lw)2YDG|-)7=T-vTMGCus6#Am#gxqmuU}kn-Y##Olvsa2)_`4pN)5dHH1JMZl4d zT|D|6(30zHo5oXc5oq3I+Y@ctLcv3zrOb1rMYPyskYq1;iDKgcX3KjP$>dducz|t@ z_bzDpWIG;^V$XEEPrBm)R;8c^^k-SKg_`~%=;?Tq!|oAz1_V9p?`ZsMzzcO>NQT0HlmE8hR+#(LFjYC*VV$n@ zWRBGY8>He)A6}74RLIiKf@>uh!St?81tRbp-QN(1Re6XfD?BX|a|<`Ktd~n_u-8 zexB*SVBbKT2RZi5Hcw~@AHZn@a2`(=ie+sT%PN#loNlmrQC9c^rr9n^6pF65*qj0j z<#VQ;8lT9P@%ZxD(&t2#fzi4xNqkCtUmibf4|E#2Mk=Jtj0z;EH$sdtr-FQ7fe%FS)+jS5+QF`b z@RIAT2|O;l6&i=`mVNqDM0W`KJEC6{^v^`!6!aaU@5t@)7|02IbprLPAbOv0>xe!e zaz8_K_lz9~ib8*s%5c68{V`RU&>y|?Mt#Z`u+IK1Qrm0A&O8HOD+XTpIwRIegmw0t zAe`GrvTf}O9!P_bOWP{D4SxQ~C{4oWS*nW3{;8fl^u#d%9Oo9F3z969I8~fcQw$06 zN6S?&N0L=_9&-eK{!|WIW_hzedbe_7eWSo_)5=b9qmU@Z9{_5$aoT1hk$V zBwoLHhMe+oXFm}7>jBXGBK#2_eF)y*1s~0C&yVd&v}HlXeJ-QIx2b;v7({GM)`(4C-73-PPEyF6}60zUJN>W}L7dlLA?9bYok z-}gS3DS5Ge3EeV0N@^l?Ty#}{=rBUp}pvJmp1C+b{N$E=Eyr5 zsTVc4ceduch>PJVT%YO&zBq(a6igdU=OHS$R-#gU$`z$mH3w17>XGy=Q~9QcRketm z4I>%taaNP_Pu~FKu+w`hk(u0YSyi8B(%<`%iWpyldzfI9Zv^?`o@884k;s%`D|~s5HIgQR_87RSrdA%3}kS}Bf%2VwILd4!5-uuPr6DQ7@bFN z9)*u77(XK0KdNy?z07tBz->*07Z%E($#d(efQKMVk@C z4|JCb%}@LF+p}9im;M=RyX_LeujH-Le}MKoD=tR!p^Xv5TXfe)--P{Mwb1ZmSrohr+|o0U`G6O_0W`n1 zJ|wjHUK$F>&y#Q)VTxoCj+3HA1s~0>i>GKQt{1EOQa02|AV$z;(A#}9n{#a{-l{rGm-4HV zIMk*df_YitmjFY218Lq-#>H*_d(;1-gNgW-1Kc@V^CFl+0;@g0^O<6>n#O{aFUuNl z*Q=Q3VEV3iUM1PXa`j4rzDZAtIIxAw>Y&TAw9A@{fh#V{5|>qQIcRYz0f{et9#ySC zcGGfy0=*ctya~TkBJeXKQ5abFAzv~MzIQ=e^IECNcE?-zTt@2Wdhec`uys|=-iSE+ z53hn(p|=4ZegiYS7^bJz8`+goy~|j=x8zbLZy&0oci>^VnF4;; zC)NAAh$|Qby^&7jZAm}sKd2rXx)+cA_i*m;i;y56i^&mxhNKcAh2WGEnGU29h$Zjv zZv}!;Rsj{*Ru~9kWv!sKa`J1EORlAIJ7l?)cMt;P>xCT=DwlWq$#_4K%It`A!2Pw^ zi)0IUbA<0)FEaM#2xrqa{7w|#MYC_wYqz@*&G)+OU9xs7_$z2>#9Je5!~zFX znbh=)l3p)&z7&z!;nRqdR?&Hf$)2h{>Ol8lce2Qu=vKO-^HAF|l#L1o@gF}}rTih9 zwZhPA5ROGQgs~Qy!EK;r0r^}iLPpeKAI*d;&imN{X*wF~7}{GSkWw)`NukFazkyic z(N`f}mZZM;zi^l(9U{j!Q}H8yJM-PXU@*5bhO{}UNU<7h}OLQ5Z^By4km53g)52N?2svnc}fX^>TO0+p9 zBs}&K4yWP!(0iMR{1wPnAS3um#&#g3zaQFRXkGN%0(?FBd&JspQLa+#3bDbqC~dIf zT^+&0)Yw{VxkM8IVE-nwbDwI14)(s zZ}9D2uXHie-YAV!m);v?>3Y!A0kN0t=AgMx(&v2*syP^awP#sG88Kt^_TrCPdYO--4D!)x}XRs`QXu z7L_6UHsbcMn#-en$5#*8JEL)wE`x_iDNT2UXy=U?WO_tsy%pi8JL;qN;|LHl1FEN2 zHZ)z1LjQ2C1ucWI!%Jv9-8Rrx)i5-OGbW#gI+a~ImD>3h&9y9H$+K*g@9I{`Kh1N| z-xUkYs{$<@`jGC>3qeaO?bWTc4YahDgV0-N~^q+V12?&|Swt zgSyan4e3ED1%|H&Wr6=VRtWZzH>m4lG6?g2h_c1_9@ED6CTQu=$8=pzE5p~kTn0Zb zy}||lUUt&{=;9^t!51R>IO!jYxPqU9ma0A}Rn;B*gzn%9G@jjy=cmyhFz>~nWkCK& z24unYpv5@$iE$J>3R;@wDJ}ao(BjiI?fLQC#c$s#9ZYg)1N*ex z5PsK3K7K3B?=ikz8;=Y6btGa#?Z~Hz>?qQox@pHPrVkIAS}Jp;$OR$2P_NCL`UiW& z_{OwA-u2*?UI--Rsj;eXN9G=AbzjVvSt%=KM1;%F8^I$LYjXxn94}O zZi<$S&7ezPM#Q#ML@Dk5HXqFrj|rVBu>x%-AL3O5p=xFvJkE%Bk>jWrF#x&;s zM>i%{zg*3lIx&5Jingjw$2bbOKG&bzlv-7lhznmYN1-yZrjF-mYlH~AiZTp?FviU9 z>KTUP&#F3~9NRbNh&Y)}suGNQ+E*Sh~4-e<$_|5_31j2V1Fo_91l{yU2)6gE+sl8+joT`0t9(B$8 z4z!n%e{vqx&U+C+w)!XM$yUDzzD9=Q$$6Z13RZ)bqxP|qzjPIbU@LSq20&N*h|qeW zas%R@6FT!Z7VklvcGKFJxHPJh@zp6C+8;BjfE2CxZuMKf|v|PT-6#)ZL*EOG@Ivb-EuKAG9xhh)ens5A^PeiB5 z?Kd5O^T}v+>Yci)qqVO2GS#_0TIZS%Q=QL88(s5Vs&iAc*?k!rF5@>63IljXQNx)IUsoF;ru3gz1w4m=cC(P^L3u{yXbb;d{ONDDZ0}&-(EU@iSBaE z2b|8E(c9dW5FlOhess5cy&?V)z01Ab5XYnUx<4{RAm@Jf1w%MFdr}|B<>c&j%@>hQ zQO+aoTPE2_Igh(Rn4wf*WX?X65LRL%_d7d`!Tq`4b49R17->I>_tsPk}RRR7$5$S>xFxQMiN9 z#deB6#R~H#HGBx7#=U@8*SRlWUPz~(alVE7$ghLTciWx&aUaQhU>X14&M%hl6IiVC zo%|A)4qQz4f&8)Vw?Ig;J^5ws_dwKNgk;~%$JdMVfjt3^b8mjQ6F5IO^z(;}9&6i+{%Jy8=2H;XtPbn(A3&iCT@3$=TT@C!G1 z%->!tefT@*k6=mjDjv$LNRxReOFkFt?)&lV#d8o3|7UUjui)mdEEh8!9{zZmiMto^ zi&3`GfxirH{`hmZoAGSH!~f6R{2eNQkH=&38U9YR$qRVyMVq|tYnPo!P>q#kGaml% zg8z?ud;alN5&84-9rMToUdUhG=U=0j?zkqcd(k%h<3@{rJjCK3&x`oy>cC>Z@vlxG z>g%Pe^=R%^_{ZN&MdmtPXAtn8Z-i&a)HpFDZ`CDSii4&>r#%a<*y zS~k6MS>Kf9#gOGXeAQ$ot^cI5?w79G$rDTI+_v*YYnPA zV69p`(1)xmRxKMqVx4onwPE%8RhO>rTTv#tlN1u;LZYj)E78`TsBeh3^fV

)Ylw zdED8H;!RzNrUf23r=_zi?%`eW`p$Su+gy)qYHLgp4ej$gTASicjVA4)ws?K7wGN%t zmsmd_nl;Dc9f_W%&aRgBw#4K_rIp5*Jd`oTS~)PVHsN)(j%#RdYioki5YW)t-qn=B zo!8XVk*IG)t#t0?YgVs@O~6(X16Qr>v${K5I=T`qjjc@{+SSz5mgs7&?`qCqBpTb} zS(y^CVcn|4+GPVPP3<5V4QC_+70De5*ing`F+ZUrELsi0x{I+;}VWizj9` z&1vs!GF1CKtI>;S=u9*>wYIjiyISTfN^~|Y=x%}`q@uezd%QG0W~I!&6KMht@g zA|`8+k1jro%;u(sd5QLUiFiButG=~$k>~GxRc!F3f$ep`9kOOkZ5$(X!=|31QTw7S ztVDg=qQt_k77^|_bCb(Np~m&ITeaKp3GJxo7)*5b!tR?o>O0|!Gh^ct+l84Tdt_rf zI%;SnI=8W_xqcpIrKS#4JKpQhI;XX}t2xo3r=GMpse5BnW1^#eQEPjBBXsj;ZK!YK z5bb44ntu1@5`VJE%@_Dd&+#QN;n15lp(%z`w52OM-{>$@eZw89S$l^}XpK#C>bqNq zSg04%1!w1LT#pOe#_T-bAJbMpANBX;>fg9N(YI-!4{HI;fXkQl_g}nh`DKZ9eaqIb zS-oDeHo&@Oqcaof9i5EGXs?8xji^$3qB$+Cag00IL`vS!VmxUdQ5p9(|vG3?vKjl8H7aO5@eItqCq!kEj+n+4?qF zm85lG(kw7VHng{%u-tYG?XIrYgp6Md=+1g0+nWkGHFXW`?kssc)&6@PEYGk4nr{lB zbiL$hX{hI*99oiB&H4^HphU`3H8<5aHg%?@)uS`zk>Snj(>mLe=M7|E(ys1~j`mJ( zHJvhFSz)mGxH=qKTr$e z=A=b5HnnDt&=YoIetTn6_5`i%a6gnew50B~6GWIEN5jeNPAA>ciS>0yXG;$%$rZ~` zQSek9P4G)>I4+tS(c|1cq_u|3eV!jqv$BS{Ekjd-k$|h4-_k~TnQ>ilEXEU!_3`=> z#SPgrrFz-t8I4_Lx(`vGwUDVSGv2td6DCL&{{Kq`7b9tP)gG$_1H#zg(E3VzBi1J; zh}X-Q`i2H9?h~CYbDPu0H^fR@b9{c9fzTB7*h}jyv!ZNi!&{p}`gkr@MLpb*4dIH8 z9rM%D`r0mSl1~mSV~NI(nC0R}`;pH2g=TS*ltf+@n#`nC!S%!J&D&=CyPf7S^xrZJ3r&8LaZ8HHId}Iu1t%NR(iYcmb!8ENNR?W;gX@ z;WxH)afO>`>FAmM5z*~j_{la=54@p@h^LjQ6wS``$LCaMDUS7M zYG~A5KQt>U(4DOUCb<|4~U=J+CCdinw(IFmeSPQ(c03`f;9n7 zA3eV`GzCs-dJ|okzp|;HH3yqE(KEfh4VxQGi8x)!lGUFGt<;^Zzq@;QgxA$Fx2tJx z55qY)6YT0}(TkR$YM$SX(;iqXj`|iR+TmrhrkZ260^D`hFU+Es*o_&-LyM3KWzVH8 z6MIOEo&+{`IC9Fg^#)m==$4kQX~5n|M)(?>Z*Ce$tXa!rJQ-RI^L77H1J8A&v2e86 z(A42g%!uQL#2a47;Kfo4#HIKth8gsdfHpKm#$l>38V`3(-d@zpNv^RaNKQ*+8r6$o zLO)9%S?Ffc%Sj~k)*ZmSw$+&UVJzJmyn@BtGn6)Sds<_lQuK{-IB1sQ$*TLJ;DE7R zmVLNCx}~eDyD7E&{fMY3S>iY@&Atb98KMi?%b&xj=owmuA|^h0>XEH7UI)Qp;k+8l zG3=W-HDxUa!vpHQ(|=1=-yLuE()bReFJH5wk1EVZ8z=X* zNkSZ!P-dzY!m|az#nBDTnPR2#n+a7$(&cM5tR6`4&S1^*HJGHh{ExTK!=U7P9|zbz z4vv%3S$ZPtN=r!3=*#EZEvCeGcg*d?7Ri^)^FgU3jh*##hRA7#*J$FsL@G_PpSyfa zto0`kC8zjEG_UM9eJni~d<;yPSR15@;aEx|Ir`%?3V+Em<}##tTy(h{nI{*hL**x0 z=4kKVg1rcqKN$)z0TgRW%&(7Q@spNYmzuz01TzRuIkHE$;#9o5en=CFb{(DdbLZEm zXKKJAi-!tr@y_Y}G?+A)S653w=~FO}ki;~B#W&6F`@JDcL2ixP0tLq?p~q@JPED*)q#C1&#t zxbbMgA|2;@Z7?d{5;iqp{>dD8k^+PLgszU;umnsQTd*{v>8bC`7{}O&rYBpt5ZmbN z?S(Pj(402ib#$jsi#Yef#dlgVX%*B6m-a*E3~Bvz6?!pQa1)X~>+p^|RjFjBW5z)D z`(iMBc#7-ea2uPZ5iCKjdh~?v?K^S%;$2+A0d{3cAbUBSv%ns*MRU!NDOHvPnQYGu zWkz^@H8Y}RPW_OHQE#}oA7>xws*PI7B}0{hTWN;iEDH}i9MR<-iENLbqhK@ zTipEi9`rHJl;+pBp@Ui%4aqqN=M9ZRIC#?_(T)+{IfTp2xA90rB4+b$%)8L{Yuepr zW_j$^{SmmfnomPXZsq-vFvZy|jg3uhL$a{&Oht7^^E5`!Oljo^U-oTs&E_v9<+ZYF zVOCr5mibNX-SHv1po!;T8$Xmem#-H1OVG=d?9#D&gpfv=`x0~NajrJBflxXeR2=>b z>*@AHD+c{g;Y>hpAhEob@|WD*mOSrI;QkJWWwI#pCt-e>ccksQunOy%(~{9hde)OA zS~e|PFpqb(!REaEl)lCD7sC!{;k6UHJFSkinz@)y7UCAepNGP5wub4iz6ULnp_G>= zk*#M$j<-nDHA`N6$h$v$acIMO3q#24;*69uI#F--X4+8Tu5kN@1O5}HLx0j|qQ6g& zGIDBOUgmz+w1 zStwfL1^1d}226*1l zl{~W0Sb{A|dFG(QWBaakJdQat>cYW2ToIdCzZQWTouRL&VEdE07CT{NH}=jlj^O7+ zG2=mS_$lV18v!n{WsdJQ7m)jZ*_kYr{o zq*`i<7HMjPiAa`2$(Eerub-T9CJ!pIr_rK0s=TvR^LnKBk|uKDZc5%l)Vo0+!`PAc z1{P!F0*XhI(t*58mJ>;j&weekMCb>gwfZLTVznT7p>KxDJ$eq)ePQ$cI$e%6E0v!0(6s3mR zIWV1%oQ?ND^!V`NDGGbTRNZy9q)XJKtVvQrldr6$62q}#&F(8nRzJS^(JRl-mU?6< z91Cek^UK1)b{qqFKDIB~K6Jrmxic3=(3I$H@5E_X*F2drHm+MW(3iYK5LunQc&8rk zfu)GbX^G31t-mZWIg=%KLKuw5Vp2^Vl4?#TclFJUooTsKd~DTDkOMK3rzeIMF(e;i zhw3yWcKWo0zK1sIrN_ojTrTqJEAtcOt@_Bk(>^lxL@k8+qTG+DFJk@mjlnXoJjA|7 z*Nm@r|F?L*^lbV4x@C*^)y%yAiWeqY@RFZg4B$PB=6YOD!#{Dft=ojJD%N=eu8-fg zSp948#SfA7%MzC?yL?suRjH3#)~{T%&KHpooFDO6{8DGxiWTc9V(q{>#E2XLL%xP# zsh6zk?^}z{e+H}#NIrFnNj)T?E(`H6q5*69n#=L|$Eu6_`x49PA*@SQSP9C)TOd++ zA9TT|LQn%Y*HX8&{mTXt;3f1|M9CX%+3Vt3Zqro>YTUPey``y(m#ts5Jh5y8zA}+R zC=|MSwR|nI-deZG8rWp5oSYz!;Q&6iS#Pa`?t(y*4QnqYy{vyN5==>~-*BAhnI%e`x=nF!Bsumi78RoTCVihqN|e0CBcTZ z)+KA!uE(cJeXFG~HuWVd^w&7V*I%`Mpzm@xlvP(+=mM)B=`QJCb}2A+%$l_cp->X; zOhu(sgjQeDAj;DHu)eSFvc&QY>yo9dxr7~ycb->B?^c5lCuUu;%EC8NM%;RR#AmIR z`m;vtE~SqtzH;=9fuMxXhVe9d*oDhr5HA*_Gau= zGT7D|7Zs-HaJButm$^kviPur1@jB|%3^I%@bP)z?SqWx@J=ZL$!xV`oqT%vTS-7&K zx-2{`f~)GX5Qbl5=wQT#YH$m_JRU2?54lQ0Wl$x4fXAv%4@cFkDk!*uvjGDWdx>ha z#2?G}m6TH!L(^mN=+tN>2e)|wt>3CS(b8~n1icqULs0Y57zZOVNXe4gLC;LbNQ+uE zYRaM$%OhsYaHK%x{KXk70JDJYrvtSkS0_Ams#8=`G8I}ZswriBLa9Qv;qoZbRhH?IBiOp>^%q!|e1(TXT^W`B-G?W4z_YW%hkBLgi6mpjHX$L-J6tg*90 zAz9RPj2#VA#M^?PVqy1HtKLjfXKaysrwsQGk_HJFBBJX=nWWSfWGc!m$=7 zJfl1oE(x*7CIK81#s|Sfg7qop7cSz}wfu)k9Y@VHt*=8N#Q2VKtEWJN9Da<;-ib5aM zFwGRLlN~F`pSmW8OWFYuMjMAGao)`RV%B{f!*zl?SKFMpb;=nJ9J zno9GFPnl>>x91!Y4X2hS6x<dxpiWFl~;ESzJ z-H`qx%%4zIg(Zx#y(o=GBKC?C(q6%3nrEkUs-{I| zm_IClLWl*J3sZo(G6k5c#vCWpmsO6D+NzL=My{hz$2ZUUwGg(1#hCBfN;k(J>lDL_ zieq-54~k(RF~O>0bZ@9e2dXjUlcsoHBv(ljozxVgIECXT*ti=E;&Nd^{HbIEF*$57 zmL&g@t|5meO&3!!3LO(Ioq-usjkP5iYS*txJl04a@SCmtXp=-*VH4P5Cex$06L9RA znxsiA>{S&k30G$KLa%tj3X8b z8#7KN`IC{2#!LuTI3Lh!JCc7O`?f@yNn;q z(`~j7CI=&H?v0Fw4T-y{WaLwuM)TbW&?u(N~^)mN~*)25^TL=KN3q2 z+(_73ET`~^L&nj7xiuDz-K$Hw9x0a1EVovcpKAr)QCwD2$)79I1>&+&9L5TUDOHS( z3_Mu+Bh(X@vGR!Vb@0l7fo7+Zpg#(~XKEbIDjc|2h@R0vbQ>P#V?C~_j?|RItpDOr zDUnKaU88k2)-sM&y&StT-}TkTj!Qfimx^#D3^(FyDr>6gRrxK%D;N0QgG3B_mN-3P z<0qR2_#3!TNvx6!7~2z%pxETK@kcrKY@`_(=IsvgDC|>dxHeW3M}xSpws37YTJFonvn`6DalR={E@*an_k+>g5M~3Wen}Li!V9;Zk3oZ( zZF~r7kCPVm8jGr=kX>V)Vgz8-vzq`dl}j}HmD44ubWUDi?h{QRS?GXwlQM@(^R~oJg-u?m&V*b`d%+1M;x9#9-<#?{M?E#1{Jc#S`p_8F+GYCAv-H^C{W@|#XneK z>{m--73yYglpF1q?K(46tHRUqS{SA`ZBFei-&-{Xwu)y}c94XOOUzoBIhZ;EtE1fX z!Vt!4uvB0rf~S&*N38>%9?7NMG#%v^MQDZ834fIbK)+_!jOI>*wMd;sIC3!7lf_Mi zrNq1~hR=YVIy^TVLg{z`^9{QRzkfJhQ?5~R!k&PoH;aQ_I<$irr*U>bCNs7ZM4^pF z$Of~JcZ^aWX0_|WOsa;hNkbMW|U}tX(pM)+J2?q%o=;y z7;4>EOa=$t9;vM5Oo)d=6>w8%nyTSN$Q&_&f7qv0hoy2iXwDwZZo6@*GFIOn;VE(>P|KL|=2r>zsm?rreA(o`zxHToSU!LB6uhS*STKvKz2y zEkbHzjva)1*_s(;aA?r8H?#*!6wOwn(f3bw9X3|ai^I1d(c`we7N^R*SqbNB z=7L@z{6MoJ@h+Te&^M9*Ex28GfFY-V<4LSZ59synE=rb#3EhoAgq|@kv1PJJ{5xoI*D5P(gb?A*hW>@C{rA)IFq3uvwR}~UV zLJVim>io+L8H^*WDe(0}c%)4qFe`o~rl>i(^$dfrI~BZW6-ns)<)xv%@Ol zVXjFD4}$KBITXdwK2~xJZ7dG(%uSfxpZz7NO<}U&wjB*OUvV<&_}VhxyE7?_S@S2O z4Z(xC66{QIOshf5JF%^RS+JQ_;)zIQLaLxAU|t5t$~DP|TB^nYIJ{i*oFx=0WsOaR zaCUD5dXaRKrkR|12d5ndIQ?{%>jz5AQO|o>B$NjhRk5*UXKoNFc z_nLIv-57TnZmz$1=kge?G6Ov6r)$^B>C)C_*@JzZ2Pg}X$v;HNWBi6*Map_5$L=^MEOiIGyXjK_jALFv3 z)LJ}W#IcR_SD6u=yhw2gw%#?^RQQfRAAM-^fddY7SZr!zwr2QP7be93n*$Q8%7)_o+sC`s+HeWCXEWINnTIjS03_rWHsVeZ7Gr#&0Im?-+@`6SGdwi-M4`$W zJbXuU!ll@o;gl3#>CjwVMc%@|g6#P@^KwVE=-<;%1oCCn`$*TjYf3r?FNGe}qAUJ8&zYCGi?SAa3j*`A z=jAx5Y4{@Ry`^cJk`G^UJ*q{{)fxEjg!wP5W;9=Vz1Mn-ZSgMN|DAj}HPiCN*rQss zx;kS)=6rWvR+Dz~W!ZbF!>AVM#MJWmGVQ&VH>$-lypP;5Z$W2a`0$0>Ddi!1ybPTY z`tU{Eqgr&lI%84hLU%#dd~aUBq)F8?U(&tTdZAMOi?^8_>uB_IMJ9@D8pjuVr^cn$ z@fZ^aom^pbg6cGF178Ae>Uc%6j!oLgmxG%&rre*ZFTONHqviU-+_IH z^c~s{Uj&TDVu^k=)s1=KmFS0I<62X981I@=L{s?xp6wJA^?#5Jve?@T-~SJCo?_bU znDgpL9IuwgfRR%Lb)>w9zHgZW^J+Xr93?=)P}@raEKcUg7YSfetV@k+%p@+LxWYW~ zyJd>)mMQ9%DSWj)>Qgkuym^0$edGQVb@miI_`_i%a=?Eofz|MfK|QcdN36}9%N?#* zcmgL8MK-h)CsHb12~eYC?Q%HdJTwpgk&J^gy!<@3d1mhnFW0RJdWX8rf?kUSo)d6K z2fYIW?osu;KCa%&47ekMUbDGgb|C1r3d}XZL9e}gRM6`VF?X()Gutaz;CbV{j$=J< zLco3U(w$!CfcsxgeZYP6(jc>V!wCl5hc9jL@&oRNPJoC!4i8MKZ30~j_R%g>C^qwVLSVU*feK>-Bb2bRQoX$l7Wmfa<(GpOBynJ!<_jY^i4*F z7sz`$;9hk}J^o{L!N5Fo&*hh}9Y19RU0$Jzzp;$@Nb_4pgV!GY(H#YJ0CT|Xz!NNJ zo^8#QnW*%xi|gGhGjm3I?U06D%05Jzofp@8-QBA*>%GFjJVexcy@Ou=WImUAnQjXd zu-4q;xc^3SlzvNQkT-9=xPdKMkr~X)Pie#bnHgSQ-dZm(k%=~44DCZbxFzodFEE*5 zuOS=U_$|V+-Lds(K+tQ6Yc#R}CCx{V>@;MD|0R@4-wAa*%i9ASBsQ_nz25YfR7xFi z?=_jdzn9E1QImY5uAtWm*Bzjq9E>UqLQ}042+MS5peJs%n)sHg{@cYtw5=#iNX-T`iIgXgXFdaU)D&oy%s-JaVJa2F%%9a+IlIH}1& z`<%x?JKifmcJ1oDZb7eSz1KhJ4XXDLk{y^As1NMIRSvF#?muUmF|^66ck_3;321EP zOjN@~fQL@tV8#G-A4alf0e7>cR$QHwk$i~ zMuLHy2ZHs%;NJdWD9rQRAG|J4dpQ`TYrO2s0}b^%Q~yVc_k-8c?b^WM`oWBPufV+r zS;HK;x%Gj1_stoo_bQBsu5&z8crfBza3B;(2G#`Jjkv2@z+KJTCIlMX4Ul0c8X)(` zIT}&W4yH)^XT0p3BLnUlL}vxuml2)wqt}B#MujNru^BsgfNVV*-a=f+szH4Cd+M6@3S@c&VcR?3%DO4_uTO) zbElVwVVxV;>E4cH$YLwAxCPhfjW3Z3HrZ3OS}D}OK-x87tj&dV9^WseKEf7Zcv&qElLyr*ub*E8VWl)V$hqo^Qi?0$*607*9*!R?+u*fwK&o1 ziE_soji>zW<_<@8(6?#KT$Fbp)*Bid_m^2%pWTHnJCWB|Cf#`#1>HSaLDFjzaF=)} zJTQqXAuYV)ZpTE1BI_}Qa_0VkR$;I}zS7(2b;9jG%-m^=Iij=OFR%n;%`!T9t#6*Gj!@&FUvi&!OL@l4Txp%0tTY3k6E?6;AIZZfC;EKCZOJ!fO=yBSm-=- z))O=9-3?w4lYt!qQ-IPJHqQQr|IO_8GQZ;;H2Chj=quN~=i;1^?iDWA;@zk@2I&_$ zW_;Z|J?Qm=z!B@d?CgY!g6bx8wHxPGGOP zH%vF9Z998lJllF50#NdW@)*CfzdVH|TY=mSV&>6Oawht^HUi>m;w+dfxB8GOONw9J#g(xCQlIKimW_ zpkL7Iic(-<+CFJKzU-j83T@7V5|B3M2e0`8FAJ{RSpIDbQ>q0&3$^N)v(2aw&2rqk za95`L5pFUTf39~p67PpnhGBy3H_mGhBQ`eYE2yOn0E}3ps&?}s01`OQc4(R0^6e+&~cD2(y?|^w64P8fj?IvNVz`7dr3OH>hAYm?? zV;Doz4X`8G^D()eMZp+a|G@gR&LnbN@d{bOx|dj;lLb2JkkdP}(6<1lZpVacCEf!+8(v}D15(o@*ip_r zO!Av+F{&}%wxLD^6TI%@Fg4$qiK?te3GK09LKk^vXix{uFbc6QWsifZo`UD|Y*qt& zsfkdo8MN!UIrt6M2=%^<)%^LQotd*z{FD1z&_82u8UFxI!G&fbx(zKF=6eNpWyF%b z(W&=(xKCVK?;V1afndG6_QHCU}0RYXs;_aT)%jk*#C_6GS^|wx1drm zy)8` zi#i_XVil%0)rCv_NnRJahWle9Gmet6Z-L2h&tTIZfK8vD^C0GjyNR0oCuA-VwsleG%I=^!IvH+MVkaEjnX|0#P-Z(p$|NlvtHQ|Tk z4J%~l2^jkD6Iut{F7=-07SZhXL{aXONaSK$2p6_FMn1fapHKlTIhe@sQ?RI_F3sJK z9T;%;PHddB)2=bIu^4TtHmly+eE7B_u>zp~p00+cj*U=0#_WkGBj`3%o7%k#MP_*3 zWnOozBnO*boPbR_=48vjA{5I>JHg8xiv@_Y8m@j|;oP-et6d1dLTRJhj5SJtge3~L zr5L^TP>o%+?qy?eZ!!~r@j_a`Aqha4bLIQx1m{jAu1K`Px_70eYdF2(L zu@k%_#+z+4Tw$*roglC6B&eh#*QAwIX0P^0OH}3cs-TMtcrUM48Snig2pyp&GiK*N z$+uRaTCbwK9QS93OB^cG&6@j`wADz+Eoi1WBYPr-`HFsfwH3;8m+;gLrM3^u!LmmK z`e0SP`xZ*T;Kw{~hI{dUERR@cv&O;!LLCq_2d+u4XV7KnmR=`OMZ075UN3i1t9o+< zm-xC?L3U_?8{@!g4gWacmZG9RA|Z0P9Xa5(&mbZ3vR0f#WCoF6eV7QR=iYimkqi86k|3X2St&dshwOG?r zw*P8{^Uu7WFhF)TS^wTe_`!K7;$9RDZ}=_Tp7~3YB=@&w689mV1SV5qKD+NbJDW_3 zPmot2Z<5z?e!#skR_|^@Ug(IUao>BD_3m=)c%he3Y!XJ{aCXy=7?Y{3`{ilR8-0BifVpdxwFaHnG<#^OK#*0MDhk7h3RdFHAsqglX-EO9<& zJSP9VwzT!e_eR@UUb_abJ5piMYZvOQh(+{u_!Fc-Ot5YF2d8Bcgb&^ywe zp&f+#yI|M_J#3m?j8hc!#xyGIVU*JY78)m;TvM?%#l{)Ef&`1vc38JxTQ^`;srL@& zequfgcIR3pEre&^2{AcA_m>JDc({uY(i#bNS8!=|uYlNc^#r;q$nVDr6mP=1!BvM| zy73Gu;C_#Ld%@2@VrVyaoLR%5As3}(yUk#P^KpU79Sj}fESx)`L2xBe6XcWSUI**Y z$ykl6P%ro~^I;N@9@8j;bBhCLLBM@}nz2ilwb^NpJ#a2vj!s5rUv1NKQErLjqIvA7 zY$_rDNt;hMjH-X4Uof@)go&UN1jijisoooj%E0b)VBXZmTrAxq;jx-b(C8P+&5YdB z21RwlonGK6thOkaXYuAN*guQMBzw9owm0rGs31VHfcq8H@7|6(u_ygE?(8^@yPp1Y%{~z09TiA!*KzuXgfJstwMB0X6=e?Y!y z^7ZX<5~vjlrq^*JZs2HM2=6csAM=8o2i%)5+2OfP;OWrPX-LPV2uIYgxm@eqdiPTl zwX7X!lyx^U8Hp|R_yFwKP@GF5?UUZ&m(ssJ`~=_2-hlGkVL?Jp90)k+z->7wJTK=l zFGm~uz-TXTwAXzS|I#(zZ~>OX4ec5*Q`g{r)a2E6d=Q7@`=Q8xq8W6^DjR1K+fcmw zuub(I6+ssQdv5>J+l|M#}3wSMhxA|J^RdGmy5DdfZsD!%&)yFja4&9Rf1W!Nn z=iq?}JJ7|sBum*9-I+NmWn$diKEun*bMt7ua*n|w!Q9;YP{+=gr?Bkq+o%_e&wcH= z<)OJ+Texja&SB_5?eg%JcI7%NRi_%MKBy$lS6Z3cCdlo z<+WLhv13dL7w=qDkBc{-^R|NA1%4hp%#V>X4iWD`7F;)RqJa$v?{nWPGyQr$mhBc} zIGA{T`wj}kfLzich{w)zc+`3z?(%}}*N8yR-N4jyyyok0!h;ax{6~BHpad#yZ?uS` z!R8#>R4ndzyaVO}7MNF%yZ{o;IE`}Qz|O~feu#Ukyg6Q`Ig)?gmhxnW;JmTC={d-l z$WP-gNY79*LT=!s$FbGIffa&afab6#|12|Gs5d&`pd3%d%jz==Iabm>U-OG!`eZrZ z|2ejeFOjaZq##w^&zXVmSv7tRaL(Wt$&#NQ&Z#Yv0xo(vXSYa|4|TGe z&TEqYAm_6t`44kOHj$5T);B5dXy@f7k!B-)O!qK|Q(7FzElol=z=epOML4 z+t1m9xLrw=9^h<3{t0{!#D01>?;-#EWcprCA@ZA&ln-@2Kz_TE<@Iw$;r_+R_@kYC zq`wj0=dhnK&Z|gYlFWa+^9IVlJDGlxGZ^=m;cFxIbB5C#=@%#SZ|3~K`lPhyFyvo~ z#8i8RbB=Q)9+E#peNKSfPI3w4b0GWqeTn+jLiX!-9OQb)R5{Dvj`VYJ?Z?L;Ujw;|;&&qb z1Gx6nPlWskWKLt=|03G=R7!jh@^g^$6#qKf_ZqJ8ogR~ZGUPXKjcklufQEgBYd`-O z+V=%y|Nb{npB*Xj{NCk{kbV8UV>3$TKM-;j#tV{}{2xbs+Cld7KOAyr$WWKB!+be!3%SZIxiKaEX^?M)Y}Im(^CT{wg6!9?BjlG; z?!N`)y$;#$|E`cffb8q*ew6nqWPkkjfxHc}KOVnDdA~vS>oXp52IiwbpH@R3ogn+; z^Ki(0A$L}L9z%V`ro{6*q~}8BcSSkA{)YO@fb7@5J!E_p*XgeKJ5Zm;A^Z7vXMI!T zt*FnBDe|$9^Dw#n{(cbkX$#q(Fa06+gY5UmeW=d~kp20P1-UpSei7<36Ea}xn~#gj zAp7;Z0rj~b@_~x)2>H7d`F+%jf{&-xB`YeF# z_s6d&|0c*?mER?h--7J-&s8Y@J;;83UqSANwB3~cFqHp0;{E(@LU{oU20wiv8H~AGnehGrF&snJNzfdjO4~3*BR6(nD}97@)2qB(P{GWY4Vsfd3>5YDNQ~lO+F({J||5+ zFHJr_O)g54OVZ@2X>v48u1J$(&J&nF{)b~QKTUoPu{G$&q@6mi<5arEj?fEiI zzAdf%*_uE8{k58J{Cz|L#@oY~yZrRQzXE5N^Qzi=jFGWl0Qu>Se+3wiHHzo&7Ydx? zo$hJ+xh$={W?^Oq_^|%(rRn!SsvqlF;GE%%*ZmujwgApcm$der0QdRz|-;^f5 znAU$w)7qPrHr_g=)#uuj4rBfS$^DH!vYqYfZ~lg+z!~oxnpVFX6;I1w;GE(tRQ~*Z zPJuJV>6BJ}|Fr(T2>1CPmVauReqT8(TLRxu$r0JV}i~nJM;k5hdyYbT%|5|5GaXv_^@A|a-A5E*z`n38!nATrUr1i&y zwDLQrm6w}V|7L0N#<60B@nL&DO^Yu`li?mEKTQ8YT7Btf`5(s5#=k;1D|eIYaW+AA z%rO2+VTTNJHbG8CI}5*e%-*RGgK`n&78%ALDtrlN4wPSp-9`JE&oLtBSK$jdqmW!e zuEU;N@{MHs3}+dMbT5(E;PTAm{HHO$#Lb{P&vD)*XQG~DZ@c$!;dX4Ld^mhd5^lzJ zkoTKUgT)~?+kH~u{uyR{DBLdtube@72V^)aNrZ2cZ0_*yTWa@fj33K*=<9rOmbgTG zK-?&96={fhA5?3|`AnI6SCgMuC*CO14l@2-lJ%3!GZ+_(+7j|e>`BR^;G2_htEf-+ z7@Xyh$2!gm@;IC=kjFdDN^%tZT5`1GtRYXpSqVADan_S)?DOO}+b?d=_KQ2-_KQ0K z>pSBos$Wi2zrZc~l;M-rFDI#APPYBx!cF6P=$?wRE)t8{Zt`^a$)xYL`TD;Fc9?oZ zKP@Kzje3ZHY{){AXfI69EJxQc1gPrDm z2@>TjCXwGQWVZ}w2iXkwVf`w667!41LDx$p?%OT)&xefshLgF_Cz+Swl#tLe0MS75iWE){-)_LFEwxp*as`?+p$Jbg-{eLG0BkLMq(&tUOX zawE>TNaVYO{1Ee>Y!3TEe(gBNU|-I9){(fM=T?P(Kwl*Cf0so5Jo}}c9R)JoW|3#y z?iHvHc_r)siAlVTJPUS!JR9SRjKB_%e}f$$ug5qc&vDGbBIPXjkM0zVck*16OP+`E zNQN*!$@9@(GK{*AS7RKJMVJ?4F~$>Ff_Y3HjNiAD7ehbfEc6?B2*w+EDD*(~LHo$V zaCS!aML&@9aaKb1Lp}LfYjMc!_WbpbWhf6p)Jqu&eXSxf&o+~or=OCa<6j2;ZL`0( zXZ%RWZWYQWuR|h!8Y~XE1LfnA{fH!H{4FBUpUX(}=Xw(Txrs!7?jT_Yc7g0K?kC)< z@P{8i-#b;`k73sk%zDoj(S=T7%M4rJ@6ZpdFUCht661I<`8&!dKSTK>=FO)h(q(0W zXjdze_mQ}-KM6ZgLZZA`B<^2KBHdOJ_c<;I{q-lIw~-_&F@c2smXWxB6}g}6+H~iTU+_SM8T)pleU`y;69}i?Y46-pw3ECR`X#60j8*a?5`*PR$%{eWw}f&O_M5x_^O2l} zc9Z2;=Ru}3p9YIV?oxlEvoZCY!k?j668@YS59`&B&;zElxxW=v-QTWv?f}du$^&hF z$#HVG#s&Ppv52RhrZ8Ov@*pdrH!_xX-#ti+pu+c|7ZQceCZSiT%H*?&L_cE)8$CM8 zpY>ol$B<~pnIg;Mda;V+IN^B7%&_C?CCpFCxQ~8O;k#Ntk^g$i=%<%R6i$D!aI5@~ z3+0EzQ3;G27tTT!3FUFUb!(t6u@zYjeJLJyG|s1cktf8$*Gy<*_;SbTy0`EZ>Mx`p ziTEymPrL6vdp67VoR28B$IN?lnz1Vg-_CGw59!L^M7xGlKM0>dLVxU^Lfp4V;fq0c zFvb~q4f=x|0=-FIMh>;l2Hj!sCl&qxIUN23IRb_9(_nGPKQPa5$@U}3U)yuP#=*B( z7ntr@{6Rk4XPipnzIo(MgtLFLG2h95q5hIrlHK7ykn1teN%TMai~2GC5YmsLjQB<5 zpYnsCmtB-`{~mH3`Y{Xag8c!B^n*!^uk%UFlQjz8PX2`aX$QVUeaX*Z=ShU~87t@G zE#flJodNxkwa_0q-P#j(3G_#~4&#%AyaxQse15>5dlkYyC!iAgBlF0AYyNCO{*+;N zcaiWv+ERZ%$WPsfc}p4g(DXajgIG7NWgypgK2zrUUL~3K*u6yd_)=?+ncmoA$nzLK z8+sz=$R1yWdQhG#dwc`*PPtz8_)OX3`A|MT4Hkzy2)_ZBg}F=7fonm_``PH=leKW;WHXP}tG`j7GW09!Qx3W?LhOIa3Cfp2uaaj`zC5iy zE3KUQi1m}m90Za1Vk?pDVR%QePy|dkhKpgkY{GBGvt`DElSOt7<@dx4w3~7-u~=Lp zZX%aD&QD??^g{VKaf!%tX@Orv-qpHCfkM|21PS|rTB0050U#L#vhbtIk1`K4Dk+e zo%oKJgO1~UM~GqZF7aEjZ*!Y&p7;-u=cv5DWedx3;!JUwxK`XQ^7}WukNXnxH*pyT z5M}N^NbU#7sp4|+zr;=jHvTMej(Cgstk|cGO*cneE z9>@7gEa+tA!^I-;V(~6u<_;MLUD^YvZsx|Ui_E%hj_$+HvUg> z;6YYCTdWa}>SeKa{*p@^;C)CGU}(lVS6rpT+X&D)IiFlKV>@ESc*s z<3~xJEcsN)=Swb;TqW{5N^IvW$#W&sk7K#lNT$C)z1=~goK@nJ;sz4=m~{>Dn2&x@PIt>UjDzZ=AKe2zx)yFldO;_>1sVzF2)E);JS9~55}-xGI;zlgcnwj4e` zWqIAj{^AHRD4s1|AkGo56>k>r5+4xPi5tZa#qHuA(aW**XeS;h_7#VTqs4Q?60t^{ zFaBNphxmy2lK7tZo#^GNeDNT$pEz6`E1oHqiFM-N#e2oa#izx8iC>66i*533`TfNc z#Iwa>@j`Kqc&&J+_=NbZ_^$Yc_`BGWelFJSP9)~lfuiw`A9I{xlrayFQ1}?h<0YRV z`5ehpB~Oz)UGhbeuMlrg_)^KsCEqW3wdA#uH%NX}@;j10ko=|igZQW7-F(}wmL%HI zM)CoYdr0mld649zB_A(&lH^k)ha?wEj!CYTJeP!C?-bXHuZmm5oubp+rtctj6^|3o z6D!48BA=76oLj_4#b?Dg#Vz7a(d9nlLFhy5Ar2Cc7ta!-;(YP%BEQ$me9Zm@d{^?f z;vZrb_b(V<-NZiP5b+4{SaFOvQ9MOFOFUnkCi45C%zvghTf9PCBHk?CBR(Xq5*x(z z;;Z6j@qO`A@jLNH(d^Suj|}e5z-+O(SSa%Q+l=om_7w+%AG|%2cyjIGn0J&MGh4C+>7#2BA<6r4vKuvMfr4bidZC; ziIrkPoGH#07l>Die-m#MZxinp9~Re$Pl?ZquZWw(x5W>|E#fxuTXC28tH_NA+ZPb| zy-dmlVn=a*v8Q;5*k2qfjuej*$BHM4r;2Bb=ZmFcxfmDg#7o3^B7eWadM*~P7tOf^ z!ta#4LVQSEB{qob#TUhm;+x{T;>RMt=g)G#5_gC{iF?FMo`)b^j@UwMD|QyUiU*12 zoCWs{lssHKN*pBy#mVC7;uNt+tQ2d-Sz^7oNW5BHBHk=66U})K>h+N1e~RnG4dN#8 z9q}V^tN4|;L;OknUCe50_0~)*5Ic!o#a?1RahQ0tI7XZ#o*{=ZeK*RE&u= z;zi;daiMsXc%68Yc)NIyc)$3FxLSNtd`^5>d|mvP_<{JD_@(%b_=EV1_^0S~(7Y8} ziyg!+Vh{0Pv7b0ZJVHEH93xH?PZ7@≪dnCSE8`7cUm)ikFGkh<_KCig$?1#RtX5 z#3#h3#aG0)#P>vV{=C|8zLfl}_@lT-bb0Q)8s|%5Yq6tvfOwF2m^fHGLOf0!Cr%d6 z5YH1MV!2o?&J^c}i^OZh>&08eyT$v()#7^bMRB9}rueS-vA9(<=kL(N4#_`>d&Eqh zwahqtKCnA030ro!gToLmAlKY5?4j4$B3ti#o~qH zrQ%iMQt>`wqEVUp5j3981Y1LigwO1>z0j3h@c?74ZXcyZF1< z;t*T@0b+mgSn*`BSWJlX#p}i8;u`T~@qO`YagW&iP+RW)Vn6X1@gy-MR)`mgmx(us z_lS>)&xo&!ABkU!zlhm=Y(3hEJ;lD_5#m_!bn$$#LYyfs6qks1h!2Tt#h1i?iCe_) z#NWkchuQjd5_^e5#Bt&&;`w5QI8$6GE)nk(SBg)G8^!m8;y2=NVs1ZMeg|=ac$!!w#>83TW#aYXUE)gdN%0l&9dWDp zz4(XNtiP?t0P%2fjCiUT7AwVz#6{xY#XH4^#dYG#;ydD};y2>2V)g)ApSEH*v9EZ9 zI95DOED~elEb%h&dhsrCrTC=yiujKBrTDX$Jy886_7aDQW5hGWsp52Tp?HJ1TwE<~ z5Z@8M6!(Y+4zlI<6^{_dil>Q1VoaPRUMK!b{8;>2+%2{oY|A-KoFbNpRpKmhk+?)$ zCO#mp5uX<~i64sF#9g8@#Fn2gb`*Px_;1;p{lQ4_WbrI9ELMm!#B0Rs#oNSxh%bm6 z#ea!g#P7sCV)0O0j|;@Oc!_wExJyRvEr%X`C_?PC(aWW zi?@g?#8u*Y@dI&-_?7sRh!@oxeRmOiihac4;wW*lI7KWI6XG24YH_K!Lj0%rta$SX zTmC=9U&O4#ZFn=Wjo4E>R2(E8Elw8C5JTcLah7*!mTS z{l&w@rMOGXKGN2!w|KO8x>zAzA}%JE;ypZ)?;%$?&V7Tq3zlat(Pa z-ti^*3dLU|d8y>vCEqXkVaaPHKP~xH$*)WPK=LP&zavrJpJM*ekkQT_%^DD&Eluxc5%0ub&M^qmDoi*L>wlL7Ecz>6E6^J z#d`5-@n-Q}@lo+9@fGoHaf|q^_^TK=*4DE?++RFI94a0yP83fUi^VGOV(|*`I`MY# zesQ(^NKB4q^{+ka)B>K|E6|5v#;m;v(@T@ow>9u|a%6+$4S= zej$D@?iQWnZ9VhFgTz7N(c%R0EU{F)SiDADDLx~9Bz`Ssjl_#VZtl zjpU`0Zy zBYBkM$>J1+pD(#wa+Ty+l4nc4Qu1QSw@6+l`2oo*C9jjbUh+oqEfRWoSMn#4w~F78 zXwUbG|ATxS->(`6qQ44A#J88+UGhPa2Z@K1DCcJ)2Z+atCy603CSEFDBi<@LCax1Vid)2;V&-_2FLoCX6^{_di)V>3u})kh z-X=aIJ|(_NLjPZizlyCV*zlg>5OIPSBJak#nkCne=)W0~=S#j!@=YYt-zPpQt`|3n zZq21@j!8acocaLelIKeR1)<$Q*w#qGRXTCgxI=U%*?d}woy6|qK=C;7WU)-VM4T@!74H|< zim!?vh}%f$?N6~_vXu`em*aOPB=mi(7!=P?d^w5xXNdE~YsK5h6^`>DiF_UxpHujU z;#VZ{`B`*NvT`f(K77Ac@IYjbM$%jimL2^*?>5|Wud;y94rYn55c$LDJi)+MJ z$$vP`zev>YGZN*0F8O=OKT6Ix*~WV$(zlk}PI5Q#Foh40e55#vM0pd%)5TJ;R$L%n zFWxIYEIuv1K(gNC{aEiM|4gDCze&zM#mdb{r0*bkKgqo$A1e6>68RO0GsUaO2OQ@H z68YRkqMYTDACtUV@^g|mNPb(~qVO*y@09$L&)#3(mllZB)Lv&8J^=M9_pAHs-;uNt?Tq6Ek{84OuhP}UsI7&QOED`66H;@nE zcaxGIBv;|x`;woO{EXz+B)=i~Bgvmh{+>jB8E0Cy77r7T6eo)3iWiWp9p?&hx%ia0 ziG0{`-j}?EL_NQdyi@W|k^^Vi^!X(6?M|-5_x~jiCvpEs$zvr?kbI6fRpHYlPnUd= zlbXisyov)D@C$E-QpwSQ{t=QyW(l* z+IpNTUMyZFUN5c?pB6t7zYu>Ao%1v<#Li+bajVsVMMOuSoM zAwD3k6jzDs#plJB#Es%6akKcY_@VfzxK-RC?h<#4dqng5dh`!o6=w9&N^C2d-`it< z*po8YTkInaC(($JqWS$j67fb7opFn}jKu!qZgB+(zy1MnB?*6c zmAHmPC$1CMlkh8_7hfXb$88ihk?@x`i|>-?{13%X$p^7N6St9A*S3p0NUTS@#N8zH zyGQKEeq4k1uaMC1F_K4-&~KUKauWKzQu1OFdPY{}elz}{XEWZApFiHrxPiQz>F&UL z_*gFFwj}gCT=GZ~dN%!t_%h1S^E|~bBBAFMl70Oe{UE*35A4cW9Cdd|tjeUS4> z=()G#J|y%!R`LWAdM=Y(PD0P-{Xw|@M#|7L-%H2*o+qK_ZIZW>(DQD|dq|FB7ld9v z&jO*(`#cbOY?}>2f97}Q&|BLa$QX~ST7h@qzp2t1ywh<$A)%Kx?Lg?`W)gZ>&>qA% zGw+8%yNf$QMtc{KXy?Nu+Bc^Yh<4phqCMt&rfA1c2S7&sAL|OD-v1)mndQ@~LuDoL zP;snkhEtu0R~Ca6kqV-wI)aFBd3jN|cv`3|Tv<{c3B~J5%VX2cebMUb8U%!=JAF$c zMKx1H;i95=q}IeujUZV%18@O#j;id&#RhQXVPZdoF*C+ROd6E+vub z;&`+w5sUvf_4#X}387GFO=WQ?lv3-zq%v9wS45C=s45;y#EN6(p=c#~BH=(=R0GuE zgo}$KfYDh=I1x4%@tDcEERm=Rg^Lr>SY_WB^Vp|qOQV$~p^8{dWx7gJBZ^}c6%nMc z{S~i`giHaYQ4EICcz9|uQk@&EjM~JK;}O)`++7w4mtaIC!bKcMCis8T>9+cN?e2ZH zEQ*mAuZm;DL@UvNXyw#U6$UXXVoFSAw(oRou4!mIQWA}0)aP35!*bE+uk$SICgr`KVx zNmzs0QcguPHA-Vuw&<$zFlHSTsF{aRhXI8wIW5A8L_AtllZdE@^dV?kYpcz1($}cD z0*Vap^_GfAqAXSts>HbWGc@+Zjv&Vlf1_Jf2KmK8r6tu)JW>(Eh@{#TRT_^~m?#)C z{NFcCyfj@3TUQ;esKN-WLJ)!@@p#N!6qh0OK8%n|neAlTmuVfm&lGzxBQ&MeW#MTN zD41g>EvvsqH#Hr9iD$zwpAz9XM_{PR4EGquJZ-COH)eFWJUUa8*N!wQq&!p>sVk|e zsG=&0Eh@$0aCL;2Mk&_9M=MKXMvpa>7!9EWdZ;?efw51`rC6i%W;WU>JE~yN!$pmT zzsa3x8c4Y{6haSH#zN(>;;^Ynd9*qasdQph_=85315{ABr0Fy(nh{FGrYSOB7pkr> z$)cDF)#c_=b5;Y3QnVOdhS+@$lk!NoGE@^UcS5F5>Ox#B%|aND*-Xs}W`;V7PnvjB zUJ=c)Z}gpTB36!kLg-ekzQtwJLZ#toIYxZAq&!+V&FNbiOGNsPIq|f^Op1Ni33ntS zSaYXqv~jkibw%-B)36D}<*{no`G}chNwrWBr6r*RazZ_o-Cjm|O=Y+Sb2}cbhG{Aa zS4WFO3`i?}U#a%iZDyWTCPL`esmO>)Xujxgqy*8WNyHN2@+N_)>kmv=xY*v`WL+wW zm~hj7<*})@V}=e6l|+hTCFp$^zRIclRQ6w;6->-G5d7UNzA;)=P{gOa`lZ;~j9Z+e=bR z&S>S{(^ZAz)e*-G*M0U52T27?Vq!*BB&|RG8f6V0rkbsXKgcSuP|>W~`)wk)K?pz= z^iH{o?Xw0lDJ-oxTp6p3!o3bPy({UP{4dg`^(rTWxvO#MO>1U)teN7zhYy3!E@B6m z{<5wBjc}M6y$K<0gW=gv5SDDJYuMya(MD;Sn_IU z@@h!(YH;#u&`@TDzkb<99+;E|Kt{70<^Co?QXVnHzjJuBpJ)rT@L_u!!Q~M9b7qtD9xI{CO@`%BH%<$yZu)&z(rCbDztsR<-XuKMd z3>%!h8Z_8+PEsBS8N)Iu4;avRX_BVM{Y^kJe#D?;t&&&6l2=2MS3{Clg9aH5CFOxe z#$UhP0~#+)REpf+-s>kFG0?vnp1c~Cyc(Lk8j`#kG|;p>DGxL<{w51=yfje*8s+{7 zfR>=~a3ow5g(aL$N3^)A3eM;NKZg;?tKrG3VacnZ$*UpBtHH^uK?96xlJY4Pd#4)qWgsB<;aj%u_?`Jq7c{MC~H8goOBzZMBc{QlNQD9OYXk`3N zR4O-pQTF! z95b5FF*s*TPqzbSlK#g}$NxT5t{(_)Ew%p*nG12v`Y;`iCY`o6zp8p%^TYSAGTg7T zpI@uA{GOkR|E3JmF+W5l^JC>w>(>Vv^=E)Setvr(r`B&X^6QN-=7%HHWPTsu8n-9w zHw786eoVuUpWi#UPR(ymO8pqlbiD7+yr%UlVT9jUr30MbkS;a9d>mX?p(3nbGo@pG z@7w&6^(#Te7|t~O`1N}`Ex%dOM*U%kBiReyXBDeK2H{P_8OfkdhK-JMdu)=J0wMx#DW>W4r+6YxKNen;4JNxck5 z=Dgn@`hL1$NS9jfs+4luB0babzQ18&q?UUOZaS3})5p)R66sR&dmj0fA(H)uqxEEd z{O?OJKY!{h>1^MPt?ZI|Inky|wqqI6u|CX;AHUpSTDg5H8~X!C^vQD1L}#bAV+HaX z#Q=T${7yx>)OL(Qeq)h_?br|hn2z;0(B_w{-*!YYoN4&+^XrzD-<8PEpTAv{j`z*N zpVa#8LPngc{>RU+4(U?scS}nB@CYJVzX>+KWc_v&+WIjKKYo5=)AHMzQon9Wha}Dw z)?Ov;+e9N<9#96l2rYzKt_cO(8tg39HdLt-}A_CEYh%kz3|VkUw@llvVPC^wDn^ee*FAs zXH)abzp$}>2P+-x_q&~!N&Rg^etah9fBgJ@Nt>62$gejNv3`f*AJZ|v*KK~u`VBtF zhBFO6etxf}RVn1SCpr@2SY|QzT;j`r)5nKl~@j zm|wDfr$QMlhiUln^TU6dt4V%?;qzkAZwk0~kj z8-~Pw{pQ*HlKNYt`Y{bZetxsl@+(QH-w35+{a!#LQuVhU`5l9B|KsQP4ASBM$xk9B zzatRp*Y8G~U$TDu56`e1rs2oWZ%JBy^HTCVQt5bKYrCE&`!@&qtzw1s@$+k*ww^CR ze#?-C{d+Y2`SshDR=;(a7%Ycr`0?}GnpVHT)s5rtSf%5AF`Hkqe$OMnk<3URKfh^d z`Hf1+?|7v3>&O4@OzQaKU|~5-^Z(KICGb%dS-*Af?R&eq3F&l5NPskUSR=B8h=71d zNCF87Nyx&YXcLk^BH1Pji=qZZ#0ABD8I-tu?xW~9ij3kqZsRD9>$puIM3m1N6&-a( zM&AF_J=NXm#QEO)z4!W;)W6QD?bNALr>gGlzL!3#K3c!=7y6V()R)WosNC|{-s9^* zeNVx6s*kE~De^_uSB?4t5QOwMAOA|eiB5f?@qH1Kk=mg=^ilPVi>hx+TUdYjoR7+V z7Smh4*HPbH{j47ckuOrd>rfwkM}g!kh^TL$Q(s8F=IM@nl!rb_zP(ZP%~~6lZz1O+ z`M!7NTWEaOqrTl}SAA4{N2BIjA?jO-Oe9}1{+0gd`wWren?A#lkMht*)koidi0toO z5%MkKd?epBPJcu4WuQLVcdC!7@5-qDK8E_JJjqvve@>o8~LmyS&(y02L zijWUqVGY&SjkSW*rG}J#@7vMO`teurBK!L~>gzx`l5YwAm3)so^@Zfy4`)IBpgiGxj&(CVYwZAT=s zAIs719Au(?EXP0Pqjq0FWs&uDpg!WOkE-t(WQweBXGA~n)xA)C^H3nNzHPry-`ptq z9*n4OMMQn{{#>e0eRiO}zr**ck4pPEY9IR)>buEw`nwXDRe#Aps4`T?1&*xS%E=9c=X`mT-A z%c0+EVg&}9#%(qJRecA!z6`ElZAV=XoFDY8#hs-uXKk#D&Oy6YZO;HcblPlR*K0oVXKCoiasor<^)D!{My3FU&2Rr)f$u(rIeEj%-m*X*kKgQqMBj$7-I3{lGNfBFm1oCYbTfQ*kI}eO1+0qlcVoT5X z5xaWyK)75g@~uNzQ*?A$o6x41b1(p&2laad=!iDr!G|5%sm<5*T;}cU{@mAF1}saq zfUNImkUze&`;|avH{OQS6`QcNCxHLdjLz;vU<&>{@h|nn#&173O5fTu0PT26xAutU ztv#+eTYIQacnfg%L~O0EKpU}Q`@un|D^ixR__>b@{R^PH4on25>hJZyV|S-9)eyj14ZM(|c34*7bOg{`0;uqoILWH^9y?SuW>^{+2^+CyVN--}$1|8$xx_^0ok zzJmV_{FmUr3+(;)--3U*NKuXda{SY0_d}<2kUe`~&pK>b1a|a@PS|sYW7pfnQRuy- z8(TEnwc-}U7k6X*vqi?uu-#jF(jk)zeRsolMaTA@spvoDKM}8EoD99kq71xQ_h{IN zrv&BE7ngSZVal)O1jfqN=4^qxTzr7W595!qTiT7ii5-tNT)rKLg;<2KyV-R4Ixqw` zL)RT$0i=O{z=xlZB~re$9fv)E&0Vgvj>DSRbP#VcLptg1Ipps`-)`ygWL|@@yQs^P zu(`*xfBQk`@N>$e;;FC!=(jrs<3Kj4#tK>t)T@!XCg%7UC7pU;~&bE-;2Hic1hpIrEAn1j~_oy zKH%R%93&q=GLJ!B&p|(@0sjPf46(J#)A?*q;NaGtSoG`l z(ZElUpL`4XnCCg4vaS1%A79WczWPk)od;5oPI9B)2PrSwk#(xPyO1{)I-)*mflUWv zN5BV;xB-5v1GYouo0+Ir>a>WATu6lWbq0 zUQKL1NWK)`F7Bc+-lmZpCEXWctl-PK$rh-OhPdef*<_#b?Q+If+7!yIKsg$d+Rm5Y z3p=_==i4Zbe;T6(^jQ-h9mc7!8Yt}y*NBdY_>X!9qD^d5 zY#PJisLLh9Wm*7h4aSAWGB5tw9yz|C^I*?I***s%Z)AOmWK+;N$)12X**~>Ub5SdS ze?nQBw=|9%3_|O2>W%$b@Cx|lA!8rK1gS4I-@t8;Of5(2N@dHmMo4KJU zfW8{>&mR6Be476h2 z{1mSpr145kc&R5z%I(+%`5_v^+et5wCt5dD=4Pakt&E1P1kkn~@6$)1Pg;bm>5$cr zHZAaIPeyfKfpR2o$j&12*GBY>`cR8Lz%E1iO|r{~{A5p57v>pk#u+Q=OCYlcx}ou< zHK&QkQmsjeygsV^S}D@^;Cw~@*dxey!XLtn?ZW?c_^0b1JMmAS-4E*>u^HH3(E5Tl z@n+HkiQ<|+XxfgKhs(7Fd3NvalPA8PJk4{QJ&PzoeOPY=_JY_4*#B{#_I!AsHVf^g zV~xi;Dfe2~4~O<@0{cM?@}-LxVT;fQ*6ikvr$5L1lAqo8YaJPRPWyYH4{HB0XWu6G zzOD?M1=QXhdq^fzi$3Jj};;fAJl{Rqgcwd>_~O_NHiPuWzeEyKR&3rNf2^ z^o0Vk62E__u58(GS|}D6JGynOEhVT~UsY36T~i%s#jiaoSJybLgenZ8?O@ePQH1aO z1=^aL0`>UTwJqdV0O^bGGQ!_jolsrZ+T7%PTY5%7C@y^$5hN}ge+?a3u;(QFV;h4d z-uc7>uuc=uR!0+|bADv5M44+5!Gkio1fl#y=1K(z>m0!=GP;ayfOC5jb|Tl(_U!EqV}la{VW{Ceo50E=K3{v8S_@)IdRA~+Z_0!M;!f;kSCKuJ&} z$mjrh7z)ZkSb~4B2|mZ@5S!2=Ra24zSdM>U6V^Ix0_rufmCzK2B=Qs8Z(U?akv~T& zZs2?eaE4*2>OZ)uBIgcIuX@N)-G%=+%!Gt^_vnnk@OaOtv|Yp_|BVj32sqSF7R(#r z!at^uwu>Tj9761($O?zhcTwafhcI@LUdr*0GR7{_2B|?3q=R}zND&dJ-qMe0k&SXX zwQmFg6IRtB8eN2}$Rl%+UyvVF8xf>X^o_uokbNrn-_J$sE$Sj@lhJZ2OCQx@3gXm^ zl%EplqY^0|QN=4D`*A{)gOd8Kg61!|j$VnHPa7RK$TZ^OlZVCmw2EX{)f8dG zGc!hqOopcA55gd(iTpv+Z~?{~g9x@3UJ33|$UHkH1_>UD#>C70l7E%U?5lI?JIdU+!i3Mv66gGMg z=vhb@lLYZ8$JkS3Khl#msaaHhBKN{ny%@*6FsTej*Ga!J3nD90lsgo zr%(i6!FCd+QUMY}6`4kjQI_eKZq`tUYCRQEnGJW`E(2FjxtiVzH;2v-v;5=0A(uUf8YQi3kP_ri> z)NOL!hCLIZ%PvG{+7$>b`z(ZRy9S}hZbmpjxZ{cCilO?RL)4{DinFgoMA)|>)a=I) z>O!XH!Y8_n(@py$nf{GTMUp>+F0gogbugf2S{17_M|5nA>vgl>B=LXX{oaDYuWOl|uS zgfaG;2xIL72nX7{sCcpIUqhH_A3=Ds9fM22Q|!?QPqAksoN6ycIL&TEINjcY@KpOAgfr|<5YDu} zK{(6yU~-&hk3=}zo`LXmdojW}b`!!Z`znNUZF-%3w*4H!9J>c$u1zO`d3FHd=WY>u z9|qLrnq$ugE$n3oHM_-p|wf}%{nEejIRQoVOzx@-! z;dVS$x)ba)gaLaB!Ze%S?>@q=LO9ZHLpaJY`I{5a6+O348KKX97GZ+@Cc;7XR|perH^fM?{Rju!CnHR@7a~lts}K&c&qp{^NLMupF50F4 z&E5l+X3LjO+pi+-vfn}Iu|Gi=Zy!b&u#X~~WB(grhi027*rD6;1TH(3z++=+!x!A8 zPpZVe$fbW1Ytsv&g`M_Q*bg8aWWSCu(f$HqlI_7&)WP;x zgvs`42vh7c5Du}|AslLNM>x!W0AZ^AGD5%o5yIj2*9cFr-Giy`*nnWr$08hI&p~j$o*jFJewC_Q<(0&48kxj3%EVd6KEU}LvTx7=$!|fD14Plu*5n;Jq zjIhFPM7Y@Af^dobYlKVf#}F>F=_QY6*z_vLGwpvMTyE2A8qcy*5uR;NMHsXT5Uvmd zt$pyQaqr-=^?2<{&D#p@5_n7PDouEU;JyrpsO`{P-i;uR5plKV@oocg1rgV1vEJ)J zJWs^6TD*5B2o3H~yG~2=-Unh2>esH*am@a_X4Yr9z+<$VoA zDNI}YwU#cd<&Y&l53F=uo9t_cbh3&};oE??tovk_?*hbEQ`J*EzKc}+lyu)V6`z{t zyI#eo)%xy0yp{4#-Iv^DVphDK@TnqBOVkq% zC}MVsKBx!8eI)%Hmv%y`KIor{&T?tPL0jmGOrPu0{Gj6$o$b<6Q}u*2&?~5XZa_~M z3*uT5ZT=`-Sfmt#0=ZubIPt_~U>XPfNEyYaxlRy{4+)g@fy6gF~eP=`Ab02yOWLC?xmXlvJ4@< zK$XVn?&X?)2Pl%$nB!id`EOKImb+T>-=V0v?pn=Xc7hO<5YU+CuGjnzBkd5?GT+^- z`TwAD&Ud$I{uj`mtTWHOUh{vXa^|}?YX0dnn!qkJB|6EXyQ_e>BZp}|`Ya)Fct?tJ(|C68=`9QU~_h^3lCa|R1 z-A`%$H$mMekha$Stmgl#qSm=z)cjv6YQ6gv&Hp_pS?9U#*EPSD$>lb>_iMv_in_p! z`SOl7e5_(z2*z+Q@as&coenVkVB{;tCNNULI9o9`gE0(@)rxTu7(>ChL@~C2F$9de z72{&JOHT%a-U=mqvlTf8gYmLrTmnWC81E^@HZT&w_-YInxfF~+V2H8IxD1R0Fb=9B zmxJL00Y*F+`pH~mI~ZOt5)|V~Fyg=%sTfy*F%XQ?6=Me&v0&sV#?@fNfU#IH zt^vaaqfIfc1!Djhmn+6~V0gf|T`{f)!wtqB#n=Ug1;#$b=mf(A<0Zwo9Sj#3?IP0r5N{up@Z?sc<${3ZkH?d18um4i7U1K2yzSqBL$3uWQ@N9V<;FWD#qhr4EaFw z&j#ZWA96hD{!sJhf_j0deeRDjIYI3q>RITUNInmB=+R*7beaeM!XSUtI~v2NkLJPmsU?39d?Kzt8^ zwoS%(IEvIZP$;p?^!|(zXT*blrYXF`;GE<%Uv9d*=^&&ZIm`5Tr+`RFK(?S6>pc&I z)Ow{E@4Z}=S!pJEZvt@#Wven%ynj$cwHfgK3B>OxrN&J6ZidsTNd!@AW_bSrVm3)u zXMXOFgzt;T^fcl&$!zeKP4}tmzQI=5{<9}XJZlfs1Pn!ej4LwFl zjQ(J>yq7g8?^jc`zc^PS@@XrNtDQRYeDK!6ll{C^6K7XO2 zMwuc(uDi0>Xj2UGFGt!9RBntZ68%+*8f(TUM(&E@BX&jcBIO~JcmjF#9^KsubbC^s z1FIbdtWQj`UP3(X91!WcKgmn4nLcR{Qidl9?_m(rhzKOPyo->9mTP@PlE+I{Kt`>P zN{W|*Ac-+aDN^sRQJM6lfVUE5Xl(UyNuxvxna2Ah$g{dN3t7x81aYS$PlkR_lTH_rrjX^n}{4VJsdj9J=OcOboc+NgBPayUOkisH?r4fEZ;vLqlk0?LMoBWx~Kt-*uiAgsflVwfvHe?D} zO*|UbVRSyEIi+NVlPGHj1*9EeQD{k<%mS0I{>5dWut(2G@{UJ@WYQ<2|76&dRnJUv ziMVbg?J@FA?>0neJdFkLdvumy!sER%oD%Q7K1`%|Zw?ayZzqUMa$5y(XlkQx6q@&X zX{FdNkh0Kx(0doMl@d{8?)L5u6OVZJhKWbL`@+O;y?+c7k9pq?6TkC*7$zP^{enB+ z5n-ouMBG8RzjWiI2KOE4)rU zYzgl_kw?1V-B!9+!**2G`-nB(>jfb_^`lmXca$Q2YfbT<3PSqh$E@kzA`m{>rvJ{G z<6Q+pR`9r$<81|zN-0lRdEWIP(usJ|D)e3oLJIbK>o4A06!Dbxq4!QjJZ*jCyrCMxBlw=P!TU!UEaSb;zjE~z%`O(d&$Dqtt((F`eo2@ zU4fyBeg*WvuE2?keid|VS74^1UjrS}706TcA3@t)feJ;x4thXWV3nf(1lrRTSg+_e zK)bsFS1S5V&{kLAW<~D@ZFU9jQuJG(U0s3475!(>MpxhsMZXPN?+P4J^gE!nuE2MS zeiyXp3b-)-a%|oMeZrwYqN3jiJ^YZ6>sJsOvnCoeIC7f1L^!@(Sf^qHQ!mJ%Z(kTc z8s4R-!daLN;cZaFzYLG}5=H!E#D~1Gam+~ZUWF8LpT@t9RPU{d&|QVzyFn!4+K1tC zZS>wX8W%_Cq-MIF_3GHU%VS%j>uc{o5b`9L?E238s|ie`xPJ8R05O<0qeEQB{P%ze z5P>f{YW`0^$s=2u3x|@QK`o}V5iU=};clcWR`b*AjmeoAqg?TtKMT~r0I1QfM9sep z)J0Toj4MU+uLnifA&hCRRLy@mD7l50@7k&PuT@lmt5fseqo_jHU7G)aFm*4Eq>3tX z;c)k)qDovi-2F*Wi(EL|ZBXZzQWp+)^x9-OoMo=3H2=4XDtA4LBk3egt8l%j`F)_I zWQ$#|X#O#ZTH?atE?ZGcT{zs8t8zhTi4J!YpeWhM3NYw!7gRYaNsnMOE5=GN=x}$T zVpM@ahr4SOqZ$kx?)>yZW?5;C3+IC;K;29_t#^HlLpUfYYlEvx^M3$JI=v>>Aso9E z)$GE4{U=5J%Jn(=2%D5STUoEhW0ZFS2zfLpFw(tKNiIq$ zHpY7^KuBFKGNyQgAZXKKlp52$jUc2(%8gmx3qVMRTVc%hZdSx%<8)!gqN=o~(6q;W zf{!*)BoFp2zTbdH6}Zz}zQ_r1E>Mm_~l5$ZmgE1V8kk5Jr4F6rY zw1yng_+K;rOY@g2>W{|VIIG5Be9U+Rai!45EPbQxUCM*2pKl9q6$lzX{X*O2r6Z0c zHrXC;qe{8Rj`h-IMwxOk?vS-0Wgx~?-)1Lz?@+`QHm;~E;z~Q!`xFRLxqh`B@V=sm zYwc0q_drl5_3Q2QK$jwJveD!50d*NmzZvxK@d0%eOTPuQf4nyd{h;pZJM9VH(Tcd$ zp6HzdLJGOd&hRb(Q9(l9Z%+|c0%B$|g1Af2T)bXo%X5hAMK#nwYmX#qpax~(`YNbl z6H;WQtL<1}kU_CiuvSr>YpBkT&{nGcg%vJ&1Y6GzaQ7ow|C{CV?gByENc|hj!JJI{P%I0yW2VrC{rKn9g~I=4J9W4FQSf1k?`B zGoURS6DKJN!Izjfp6s*(fa#uFeWTNzvGME@z6mORyURy+0JP)M!u0_0-;=f7teTh6Y_MV3WzWcz>MZKO! zM){sYd^W{@o9e&**sIy8UeAM z&%?bqB7DMty=9!mvJ)qq4R9G9&;9eA3l;ilE%U7f{^P(p_jxWWA$MKbT-*k)xIa$wZiQ#d7 zJ;gT*{M)ePc-~0$wIKc)#orp`dkArjdiD1B@L0c_;rkJMIo9t_@g+kpIi`P^?mI!n zKb+;8iMX_ZkLQHP`qLcWMwO>4&)0$YR;vGCq3=q>$(TJoCBpg$Mws*&f)mk_CqFF> z5bJ62Emxgv6TVf5)2iTE>+-#f_?HyNc>6o8}Z#6nL0ugg8f}~6Yg0e4-`v$pVJwtKbACW4`isx2&KLN3x zh~elM-38l1L_mW+YY}tAAQdN5AguGj9KrERduIsuCFwq-)KIfC(ki5|7x}V*(q1kW zVc&3xOC-IEymwHh)6%Y$c{lp#n#lKHdoB>ZZK_-c^3FH#3HD2V}Z4v7bQPX^d#cmpdc> zR_~P0K(bBzH=?7gZ$jzR5`J0&=P@E#)*|J0YDosysXru-u*Ub!Dy-8e7wJbzjqkq^ zy%d2%C$&MtQ{kXoYpp!AmDGx)UxW7CY^|rPvO(GOPAWwE`eZrq_aV3Jl(2|t-Hl}P z0R(Xiu<41_uZmbdckuf8F_QJGv3{P0EYzHSjRnIy0CvjX5ct8?FSVRT>27K=Z2*(k z+6c~caeI-g;xHKS=$+UjS+oSk{SmPg;|)XZ2IO&iKX%P~!IkI!x9Hphg65F%XCq!% zXQGt3f{G^NNcye~lc*C9TJbTgI$gTz!D ziHDIiGH)_eI3|TW({@DlYkcW0{VJdLLJ)Km(RcWScPj{a5%_8!Dk6o3uW!F1PW*Wa zyz&JaHK2`?H>fYr=nnNsgHHjcLnhGUo$y6u9gMSnPwe-#C(%1}QV4m2{C$nIH-YSk zzF~oM`jW+jLeTUj3+)40&4lwo)7K=Jo@iYCqefrP(Eg&)H#9&W)9Bk4phnnm&B+7t+tF_+?+o=5RKiW@pTm0+?3q3EN1rNv~@@1_#K z$fPe=`YG}+B&Ad29Yjt>>={_Qvfh@5J}&YKaLp)JzeK~us`NtfvBIpb55aSSrj*Z5~> zCHe-L{pwgTeLlGR!Ik9>aWcxy)RqL$n5@+^Lo1baQ(L4Fsse3ICz`Y(Bcu{X8qU#% zR%Z=`evQ`$kiL`e14CX;7qdna`&EY>orY&O3;o)Ga?;9KLl;XOS5NW4cR@={VXrYn>WpJE@v7-Qk$r>0rqBfoW&GM(hV26H15d8>q;G z(nKZ{ftFP~D65#z2D&pK)1QY_6K(-bm)}+S&p^{vPwh9dzDdu5mf}1t#hIkTQ%Nx% zk?B*30%Y1TCDjMZRG)0VUXPB|IbFGK{xvA6_4!?6yzY1Bqxu*8s6B>V+( zdJT1^7tOAr7f3esdZ-ldLdr306LB}m=*1M>Oc$|-NqHQu{4$9X-5$y?=PHVRkaZgY zek~?v>nIGUcGh2sW$RSq1bTR65zP);m$Uc3Kua-fo#dE6-=USVIQb`+p`H{ZXo>oO z%nOki1S4}dBIi)#2SnNtIfcIO-a(PC5V@Qp(=6QDqR1zR+)j~rNb?{fbDuyk2Rfg- z50Q6}?C7cx5m@xc0J7z^Qjr^wNS7t)=PEMtA|lB36w3F?1zs0AL&~R#L**&oMo1W) z?@%;P4%IOdWY(QfmZ7`j;eC@y@xuKuIF<%UaaO~>cGg#<&lE?WxTWprGezoiqP9p5 zl#}WVf>TH*rKdScUZe`8^(vGmt8@xsa-*drDm2b%X&nklBONCTN$*1=lS4Tt=!Wt> zw<4ePJ~OrDl-AcdkSVisa2or7syJ&5H8#y@Y_Do;nrv)R7iihBQ)Rkr9BYP{LnUX2 z8>eT4%EnJ6<4;HG46RIukAW~NBnAK1%Ttm6VPT|Sx+%BA&n1xNOkH{oL5{H zNIx-9RgZT{1n|zLR=o5mFgbH##>B~i^!oa>4HNL@o^$Y?u)vfllQXARt(umRQIk1s zTE_IM$&;t9n!2hAk(E=bDl1Q^oSIQtlUa45$el51T~o`NNwt+N4NZ+3np%VOi{wdd zwRJ7kcumF1*33zn8JYN-oG}UHx|)^FD>Pb(n&iCDVR`5gRj6(`Rkyr%b;~2FTdt~G zzOucpUbYdgGzcl^0q_&nPOB6R&GcG8fmdj>;92WgrKMTRf@S$<r&t>l1W#zeL!Q4em&dVg7G?xGY%M>Vo?;st3udskMPo1IIl?XJ*+XooTN*elub&)HbMAl6 z@e6|R_!Q-qFDWi9h#1q}jc_(8O?cdU=iwd~3@bil7RBYo z*~QX-ur2kjll(|oSs}bxR!%T?X?bausvFA9pSLWSom*O7_CJ}#YyvIZ{Evqz@1^Vppbc46@}4O zmOVeew{&0x;p!G*J?t}3lvY-b)hd{iRi4$ioRijT2@B7a2+yeOvakD)i&4%mrz!kEUzwg$T3qrA>DhU?82zm5?A)@lU}^sRylBm% zTA7wtzA(x_$P}Hq7v&PlP!~iTw+%oRYF~ic6wAL5LlsMWSybrAvPyA=Jz-q)X}g zNh5#VSJByd`Gq--=)uMLS;3O5(mrZ;@=(3JuM1BCnn7ydv&ze}vh#ZPqyn0j8_p{A zYCXJ@t(D%MyRdA2a9&~Yl3+y<&30@hLL6t?5+Wf`?)+lu55jrKz)6}=E>cS`26n*C zCaJuTwy43mxmZGS1yjWZB8Q{drLfMz!eVDdSti{SCb!Co_G(DF>4?(N9nB^S#YRweDwGe* zNP(A-^X)B~lOwpebl$SaQoWm75-cL;D}6{ru4oy`matAEI$Bm5DVNfIC@1d%XpxA} zK9c)tAI!+kfQ;@8=b*7vQmUFF^-Ll~Xa!`Sikuw1w1RAXl|WVXQWY5eXr=#QRpR!x zAL90|a!I&Kaz8W@*>hnka!;$4Ss?Zn71@r%;XL6zOu6LrmnW(ox#RfH)%2UCzpBH{ z_amBIS#T^aFQ#>?un^lvd4`MVqO7roh_SmIo!|4ZBlPmFso=;Q0}lI z92sX(NfB#$WThoIcVVXmmy81wJS5JS5wdY=xlAp?mb3rFoMH@A??enPZ%t7xx?S!p zHZ0VLP$tuN}0g)oCE7=%LM4hz}k(}JQ6}Xmxm>g=S zggQHb3mwZ;N3}9qh`nV|Ha4?JmP;N*vT>ECTrPfidotd>ytbykRgeLe7Z>2#0`1*# z`j6nis-sy>_i%})S4LccD~~7#<)~9yxcZ8c`K37SL}V+*t_|0m!dY@kv*z`xCl8Y^ zmoE8)^GHLZOq6-8?I15JV%jr->c^<~>4CjO!)m%2NBj!hIP}W4( zfM^uU`}Ba?p;UQ=F{(Zsfcn(tT>gv7SeiR8w-lSYFdNnoL17subBW-T;Sxra<;niR zMBoXsoL-hk))A4sFc(V5iKs0itt6|zK2oJ+P%Ey&hGmQ>#cOO-8jmj4TX^?KOO+)# zRVt)kbHtg5M-dkpX;<5Sm-{gcnZ2*1&PdTUVeGo)C5|Y8)nNXTJ*xCyGRRPRF<(OY zh5Gw7g52_~J`*5!X$h{tM)w3~G?M->(qhR}}r{360CQ<)Jwr z-CkjSQ9&QxFKA<77LH@ZrC2v|`t-$FXvvN-x#)saAHxgh_{I5*X$3X)nX;w1<)zDl zaMQhJoU}=2w-((27%wcbKi`0jSAI4oKXeJB!UeRl+-xi>eJ7sGfl2<0u8vl?AWRvn zTa?i(&MNIQk8!Gu&bDL;j>P@z3v)U?$)Uove4`qnD91bx};hWaM3U+tTaKQF7-!szT`!YZL{7j29pyIxk1UsBS0 zO;oI48C@`OG)LPhh-wWCtBMZ!jDG|(&Lfk%}8Wzt*fpH{;IvHtp=G^N>NmWw9UlJ=v(SnIZs=r2AUx> zZA$yzwxcH{_n#t~n%h(=JyJR1CLPMi2So>|;a2pry|E2(of zTWatm>c-X@IsR;Pu!6eAy0$uuXZXGCwUw>4!IhP*HF)oOU1P8vMR34qs)Bl|gS9o4 z)wmB%{a;sE2g9msg;ha!4J+$wf{+3?I$LW+Wpy>$YsDyHbZVQBr>UiGbzLK}HnlZX zHPwrTnzq`eYEieUvI;g`Ux)6ZE32C5Mj$GPs8SklW6ioC#>Q!nEQR_SR!T_U=(wXo zCkrVFF;c>+rsm+PYJoqgVsKYgJ2MI?7`$fWktvjqh5}`)>YLE})|#3%!K(I_P{F2E zl!#7Oi*+q^u$onM0^_8LxAK@!ZO!#~ojr*Vq(&&xx}g=58V@zETPqrxAOglxl_UW} zG9byhc}zNm5y2LrBvH9~wOH9+y&9IbvRzKWmbTzpSa&s9J;$ora2sFF8hQJP1M zBu6g>88c;*PQ0nP3ThH9t!wEYmezs}H?*#HOc#deNPtRKq0>~fy=~QWXO?0*OY?PR zL1ahd9HiuC$8(Z{LyziOgDc@kVMb6$@Z6e~reI@JBjzu@Z6duE@{nX0FJ3`pIml8| z*%)+Wfc~9+p@cKNoX)`@NmVrSNJ*j_2Wvw$INt;1-Grge~rmWf7uLj?*A%AQo$ ztb*fqRP1n?8>(txiw$rgt*t166{HnU@sH{=raLtlJ*Xm54H!V4DY88h6#5_yD-Z1$ zQ0VJ4Asgb_<>Z#@ue3`!K~QIXC90r#Pf1Q+VAaGVk3njHr)IMWwhHO(+c6YyA=07H zLhVrJ)-{V}__*p;fr~D*Vze+eH`Uj}o2XW#pO(|g@!-xn4=*kgBE7j<>QooV%{jRo zhe8vdU2iY1OW#bQF&5SB4GkO6jpiD-Gvq{{=o?HSZ(EIlC)Y%4NOMzDy=oAo(*iF# zZSZJVcGd)|Ynm}zs2)~euo<@8Rx2Gai6bX7^t4{oPNqCq@g~FDRYJ~MEY>oD((TQw ziLR_~MuyBF_BAq{*ex~mEiT?3L{v$Q);Be+f%ezZGUg~k>Jcm1`VGO*LMJJ#nsrsd z%65DuM*1TzB)1U_(j7~6JJB$=xrvr7ShA>EjfHS6?PqXduT{XUw>yi2S~r7^7%BrS zw52jg`#stlwqn}B)xq$wbgiyaCMK#XVPu$@>w`28q0TmKfNOymN?P+ou)Puc2xoC)=S~(-FO7!w zT<|N^L1#0dYKCv;3!Bc^GZ9?X-YCD#B*+R{F}dj)DDD1&%#;f7QU+La44HZE(Mgxc%0lJAo#PL~}cXl=zN7$&C{#1=RrtVC5%5nPKiq$H}K zjM%;2`BDF5FB_jT57#z=>glw@&Vq z9MaiGVFrk$RDusXvNZEV^O~9sGN1;CkmAUQY(U0j12Pt_v4n0Bag8-=n}aeLwdO9y zt#i5-Mm?dX<((zo#ARm*QcFvHYZo<6)vV*y)x56XjGbla(T|~kS3PgVKvu48d;bv z2Bl?T=jI~~W8JC^LE3bvc*y*uX3NTPPc@j0EB`I)99iVVXlZYzeX+B9A=mBf2)Q~e zL3sO&bC|&dCqE`D<2!&jCT1<9e)M6AnwA#KX6%PUQjqW%Kt};2yNt>aBwlC(@8nR% zMoF~(I-Qp;Q`P_*l^NAK=rFOeIc#h%RTO6$IiqOvK)EQXclQ+6QHvat@ckZV2q_C2 z7EKE3Gil#3uHd|iqHI}r*!IGy*laXo8$U=NtWmp7IRL%#$>UTDt_t9&yLvU&MW-|^CC)3RM8t^#dkcA$#yMV4 z(-AZdB~npXUg)gYg1G^MYN5@dv#r2bw5+YerWCFh-_^#R2%Z3L(AnSe^${F&;NqqE zVBN!T)WM2_q+@yUg%)qxO<{_)kiS`1hdl<4GISzr#~Qa9|JY$+t5e<7z(+qiFUymQ zJVEj94ch`-{#b`^aZ`TTp~&r&+Aos%U}q^sr`hkUtt3UCO=N2wy@+idB$+51B-0(URgO(8*@2XnoYy9w`bTXoLMPl1uG6@9pJ z->Jr#3POFz*VJ4I?Xyie$AgyjtLm}Ya2%#+Yaz!i4N6pEbm4SDihyITYLkazx!J-n zscSkb>zc&e{9@~O=4#kEGGnAI_2vm7^{Zn zdRP>$O|-Q&XUgM58+zA(>lCY7aFq-fT$n4#xi~Om$J>C3*4T!0+EL4GJNFRR5*y*g+L~}xsf8}Z$qRI{1L}z6 z%%SkE9~Z7F*EY42>!jl%4%T#Ci0nz~09~uBr}5elq{~N`ad3n90g04X8Z54V;UXXv zKv$h>N_54Hj>ovDRoA?BD%&j9#}+z01Yr%16{9cQ)Jj@(XxHQ%LdZd3pNx~Syug4F zk=IH{gAojjPZchCIODty-XgdXPQh8K;1qC>cE%BX;Ds0psa#uG7cxxg$5u9>b1aE- zfh~NRP;98D4z1B8COMoqG{VcuX-8Uvq_`qgiP^vud=pI$QROV~j^E|!A?j+{;7gma z`Ny2AqsHhWpu9K%uZD@p7e#1|fy88NSf-slG*$q48Ajd)Q0fb<`#3~}yp{Ags0>Df zOT4NBbY07t&~Yjk^4@VsPau@;d_O1nGYwuIGo=MLJ!Qc;`Bz5gq zy0)2@SXrpoP$zD!e{FT~P{bFN_D<>``{Bu4^r=Rl4 z^vlEPXW=)qF0l+f(lqU-xPb)p%Ru~V|1W--_kZ{EzW=+@lNwgmRJYZ)!kNMo*0fBj zYpjCN)c|o-2&>93Ro{edX0Ww-&7?+bN!Qj)I(cH|#8W0torGHzElo{rliFLub>a7d z6X5&W*H55Q%U9N66W0H45dR;vhG$N%Yn^~uGqH+BsMpUSC)Ns#BHc#8eh?x>{8G|M zk_Q&}R#5mEF&vb*<3`>pRQ1bK_<+-ZBmudre=V88_ebEi?zs zGZXVoU$JTZ-t^|1R)IOR&>UB2rstV4)&gWNG_7yVIGHkjp*h<4>&6A9^@Axa<2M&> zHe)U00|CZmW~{M(fjOYSj9F+}MW!d$9FT7gTxiCgZ(5~hoUsmx`KDcJT7{_AV{J9v zmS>i+6Lk! zaN}m<9bS?*%w*Hcjs-U=C5`k(^rU7bTf)= zH4S4uYWem&r7q)$-X8*H`MJI*uesrqII!l{BQwi%eV~L;|d}70^>W>oCp~-eF|#+J@S(wCdn2G z&DeZAczf_>Py;PbJ2m(&YC!(yPy;Hr3O1SEVrjy$5Ge6`hiUq@nnSIlW-U?x%N z0(0bL(x5z>&9P*e#^9r-_Y!m9d~?u3bHIFa;>BjdMW&f=CZJguN(_pid9P9Bj2;Tv zmgjVgcb;j(*dUYF+9I%>kD{;WVi{1q-dC#+PLG zcj=oU;Q*)vEha9i-cGhCy6@@87;yE<_QbT6!edbER~e8 z4H02nhrz_?T%qrUnII0^xCNcSY)^X9^cI?f^HCS*1!O^}eyf?V70)Z$Yz|%k>opQd zQIddm+tCpW2!^LmIgH{TF^WFR*ry$ZL2t$g8PCHG(DrVK9-p6YCjHZlk%LJyexOtF z0P9jTaFjSuD#c>q9H?ibxMwiD^aW-b_iQxv=^pe01@@v|WJ*F~J{njI8IA2(&~l;a zonK(uc_b-_IE>1n^Wg^|-%sehBOf$e2(S2pfUp;tgMKd+IS9&^b9p(&h{HEjOR0{M^ycX|DkH*X$?-g z{o8M`zWol>#Z!m+ejb$Tp~H8HZ;oeR0ST3UNNl~ogn@JTE5;;Hera*K+ES$NIFT}5Be3=yci;$1f3D8-z_czO^@_( zJ~5&Uboj9oG0r1mz@lzx!Y{r=I>lp{4uH59@xe@gjP$n=_cFZ?^g+bwsXJ7@6ZB!k zv2~U7Hqc)quF5xqrgzAz@=HO}bCCct{~L%}8l?ga<-0@mk7oB4UP=D$FwI!M_n7LrM{57#RP^ zk0CV|<`{kC34{|7GsK7}dUO;$Hj2h$Rw6zIp2szSjE6s@!yxN}SVYs)k<^Fid!o`8 zMA3~ZGte26FoWo;qw33Hn$Cd<=+W7noz7PY(2vFG>m{8euH*LTtd;wOGc%}~djuq4JvTz`t1Sf7{+)0SXv2_w+g55

uRO|+e$u$4&OrT)vrvC3CVDL#4b|7d_#+NAl%J-OLC*;%9D#?@ z5yAV1b15SDMeq=b$qRME5}^e{>q z`iF>u9@JmLxQX#m#t#^OW*h>2Q~uK#&tTlch&L_CbT7t(@{K1Pi+5cxu4lZBk?exf zk1$&BmqgP#M;Ihb$FqbPPlDh?U&Qzr<4=sIW85kITgI7|LmyzI@ul=hgcz?1LMY)p zLX5}ljP$xj9r`=OsCgV3)d)QUc0-s+bKXH(zjRDq8e-y)AjESG$1;5~As*XB>j$Nu z!C1rCz}U*Tf$>7diy1FxyqfVw##o$d&Xmo zI*l{>F_3XEBc845^q+A8<5Wgk|ES!2#u7$)lp*o)a5#x885e`jC&c$e^9$GF_Ir8`p=9XFn-EN&o`v>BaB}&e$RM}Q73ywJ`ZCYVeSs9L5sH#f-}tX}?J2Y8e|D&u66lGo@e3coidFMj-jL zzo+!u8Si2I4dZVaX2=R)W|=Ab~6rS z9K<+;@dU=vjMCqt++?PwF`mYl&6v+v%viy=g0YSf&!3iZv@@Q^xQX!+#_f#PGTzL% zi}Al0A7Ffh@d?JK8DC(0mGMo+cNsroJivIE@o$XZGX9ehHx{J)Cao{fOFUx=<8a1N zjN=$H7^gDQE8VI5T*iFH62>KrXEW9@wlJ<|ynt~F<7JFH7;j+Q$#@6jy^IerKE}A0 z@ma=~7++`nGvf!0pE4d|Ji_=j98nT*pJXEWw7 zE?_KST+FzfaV29dV&-e=C8;taz zQPRtYj9rYMG1B88Dg7uT?Q4ntnUVIjMB9wCpCx)QBkf~}9>JK-IFWG*;|#_*jPn=^ z8A}#?&3F!DGvivujf|Taw=rJHcpc*{jGc^kGd{@pDC0AXuQ0yLc#!cc#$${F zX#Ym~U>wPq!FU?u0>-l#S24CQUch)6;|+{=Fh0b%m+@uBcNh;a{+;nBMh`BCkbEhO z>5S7E^B5}_w=>?v_&TH8cIp|#IGpiB#wm=aGcI7PU|hkthH)d~R>o@?Z)bd%@oC0C zGX90}FylWMjTlEhAL9v(6BuVQ<})r~tYK_r+{AblwjJGmA#P|&3e#QfgM;Q&=pr&>c8AmftWt`8rl(CNS zT*k{8cQXElaUbKGj9rZ1Fyc14Y-r4>ln8%Ud?zL;{%LOGQQ0CE@L<2H;l&_2jbd{v{%Lx8K*HW zU|h^t$JoMnA>$Q{H#0uK_$cGkj4v|2$@m`QzZkUyN1ow~>5Qi^W-~5g3^Fz_p2v6( z}LFi@n4K?TnHh(Br>KkPGp?Pn8#SbxRSAnaUlrU*yoPZXX`I1~ojA@J$7-ujpVqC_!lCg<#BjcrvH!$AGxSR25#@86%XZ(us zpNtmn4Uk-e80i&8L{DNojj@1n8RKfkcE*bsuV&oE_#4LGGrr3BK4T9fz2t@3rPtOI zdKvwUCo!JNIG?eCv5N6mj2AL)XZ$teeT+{q(i`ciy}vLXVf>NNhkGQHK9q4R;}pg$ z#v;Zu8EYBa883VZ4CxGR7Mi?_hk0aWCV$j2|-| zV*Hx%7-RAXN6z7lV;D0TXEQEfT+FzVv61mS#%+w(Gv2}YFeAMao9v^T@d)El#-ADK zz1Ng)FyjcuiHtKC=P{Ntp3Qg;<66eej8`(=!gx31qm26)Ut{cIJk0nN<4=t4QI4E` z#!-yp8K*OrF`mI##n{YvKI3JK-!uN3(H!lx<6|7pcrxQG#(c)bjCV5L&-f_gKE^j0 z-(&og@d)Ejj4@-J_7fO~GLB))WIUa51>+jV7RGZK&l>C0*TDE78HAH?eVyq!Oy@9N z!gM*)E10fkx{YxQ;|@;0j_FRudkE3)gG~RH={-z8!}Nl;2q)vZIU(fyjPWZ* zdc`C0llilmE@CVvM7|Y_YZ%uuZeqNG@kT~^A2F5t4dWihXZ{y$UjiRh zk-b~Dt2dI|CM$%HV1R(A5RwoU5i}tQBoLCOldve-WN9E{HnRXaE&);8P;lQE;tY?nsDm5oERLh{zEk&9_e}@AN}nY39GobRXlFgs|y<2$4@0;!^x!grHNH9>w%= zgpi-h{6$Q!U~FZi57d*~Rg60s?`0IYsDC;cy^L{;*!C#+i1;bPfQUEvv8d)yb3LAp%Ekk~*@c0{*`W=1Mk~7$k5XpqM~n26L`vq!A>~2! zsBkbiB$EA!sO*MNUDujmZCxEb;i(c4*?4e~UM}{NIna+p4b4F~WM~e;K~${TPCNr# z*F_&aQcA3xs8>zVQ_OfTM7!YZDQ|hU0+X~&nU z@O&Je3$0&^XG7@$zw8#gwk~@?Ma>iy@RJ3#J?o|31x3%RsRWKvH6)MB&|{T9B^G`- zObHFD!ofjDNroR=8yedlV3`yTz8!I>NyJh-6@4Tm}L=%>i;IJ;S)Y6;mVimX~V*%md6s9BntDY6=}XKE^UhW5=M zsW62PT5{~^Bp;@7^EE%8`e`YnCoa?t%Pbg!_!w7w6c^ff?VCWJ_z2me~%W0t;f{^lTn z@<%dsX?=9Rj=j8_ZTTa<*7p?rcKa10AWJK=>3bZ0yS{6ouNyqdUo8H$zFXjjzHt85 zB9QV&GIWs~T{qz0t}l6e#C|5iw7x5$%$~nCD55!3Us~U0OD>%56`byH7SwXxkh74^x>#JtndA({Lw?JR39Wmm)7@ol)h@4J{)m}_05GJqT%*D3;NyxtuL+bL@@06 zYk)pKc+_5SBplX9e&`F^FCLXo`6E7ES|8=tuI~X`{&0jE*7qIy7v&F2QFWz4Un(*9 zA}{?7D=~d%Am&F0JLL95@0Dr+XXMn~pyR`qHQ%d{J6-?TG4^ z`=F1;1Jaj?e=09UI|u(d4!mM1e&?90GiwX0f{wQpT4KtAxj1j^t}_FF4K& zNpw8^b-KrpP{d2hUF)h!s!1> zMlCn48)XJhUs|pW9`fsJL$~%>sKX9{gt^*uD9O#%1W?PZiK@2;AorO~PPf1MsCsL< z-%?KHJpupPe#@ft^=!oByf#DWbgQED?SsBq&_nvL1q|z(h(bU#d^s;ix=4)lOvgW^ z8;}2~C(g>WUpY3y@>}kV{CpLXpEonl@~w)wprm}h^<+5|;W7js470q-E&r7Qmo*1Z z5+f0MsB+5RcfGo}FL}$(0kNuQzp=Y#zqfnm$7odpJz^`qQ{J=xz>?PnWPDHmkB1L` zDhhi0F#`18XNZ_sgk@?zc=tr{y1~O7`q&>v>>O~2p8oF4o_-_#s$SBA`+g6)sxI!; zI(D@^I6(YsAuBR__IsdP%Zm7({pD?2`-He|z=JTAk4*R>vnTiZfn?5uA=>Ep<2}*V zv!C=TIpkrBf!ni1_OUz5>O|+z0tPvk$hU)=Du#|5jopbUiVIb9Wt%*3$dj)2YG;f z4(>vHvX9QsX|PRB!PWsP!!X33YDQZ_P`0Eif&KL_BM2_ z=*PGkW3+8SeJ$zNdOkmVI0kd+!ILa`*e?J*A}y2YQy^>PJom8?zcEk6Mf$ym599Xj zEqw<3#M=j&^pXEv@}rFCH!(&}L7ySM8_1+GBOSEzgQBOWePxq|e;huXw$FGUGXDOLAd?x7ddS?4xPkrGLyt3lBl7I;`w!$k zKv|Tmae42y!tQ~5sx!_5>D!m^{y=Od@{am75-#sueayx_5x;eyG=6K}JhAofPV^6Z zKHr4SIOu?Ws zHp}}@BwL7!`&^KTFW52Q?7nWmyXxXTueb;{U*4Zf`usinb>I6J%I4K}hD~DN_oDpT z?q49B+UzW`b)W$Mr6`XO^Lw8*diKu&t!#^aoDRPpBgnp~ux(EFj)Bxn*bO%JX3pzP z&fGe1W5V_Uvh^(3+Re76x=2S}^U*e_tgj+XXHLohZ2+z@JdZ z?`+(u>_z?28e?IXp36|q_mD@7pJ*p!vy+5B=`Q&HjX0|9^-%w$`t0tbeoAeH{QHcT z26TI*wzv@a@KL|O7`>3{8D%j~75$SD7h_`oB;;+k|C#-cw!VQq)Gy+<4|M0!xVEu( z70Ty8#I?|``UA>79c{!3TWu0sKZ&*3nDk>^mbMCdedsS)t4QzD(AzuUhHc#b0yT!Z zaw7GDc9%x>c0-Q~GG5r5>dYnl`>}jcbw=aOev}DquKz=zt{95~XT&GkWy@1? z&Ng(Q=|0tDf*udR`CC=}>@6@PDfdYak#xhS-DuS%{g6|4)!GJ(EJ$?t3S77pd1dX5#I8 znVqez)?4%^G{lGr9eLAdl@!h|oIa)G#N7NT`7?_Pr<^#wsBlWr^ul>L#YMBG&&$mf z^VF;GGx2IyyiBAalU|P>)1sZ2u04a2$Pkh zpTJU8O>nN_E+gnxUOxdPf_OQR6so^P!7`CaLj(!{bep>^uTkl8{49!3jgRu6@&|`D zs__n56eozCKG(VJX?&AT7ovRG?fW_A4LVc2Y%M3X?bsF*Dr7B64Z#peP5eVqPCPP%yxKVC#2}&_< zg4=`gS!Jx=3$JC!aBrYzq;jk{^w?7q{#9|Q=C82$I{iCAl1?ek+bcG}bA?J^=>fne z%Inu@DG?pdCaPI?qN&nT4~D4O2cY%{uMT|#tUW3eGrn~ZX+`i;gkBXIE`*U_OzqC`*#Q*x1>zC!y4Gl90Z1EX!^M_)PNNm21h)aTKtjkK%G!askM8qt_!aKUcByu!7 zLdM3Lv2n4pz>FVhi=Qw8c~A)gftjFFRI*&u5mdt1*ptB@sRR%^ zb)qWHs1(FI7N-DdE=7+Xk_SXe4=V$a5tfLhGK@(vDEcuYxXeOiPK1TVCV`%VfN?3% zOA_O!s|2z}8oCB1WTTc6-36&P%o`Ok=P8h#=n{^R5rZC^FC3{6auP^eD4u1|COJOC z$W0=h%VSr#=vjdipeQvLhMDXV1XElh-6Rjr#;t&MN@`AQ-;)~LbGD=(aei|jh> z(oKd^jh=PcCIfM|&%;B(9m4O8%MLJY3W~=8U2e&5E=bi*ceF%O1ey z9sLBC6Y=OwNjLd>h{WZmf%y!0=qST!oPw7ak)%wAYe+h8a>$u*rJN7fDd~jACF|k3 zh4Vj<^f*;?dg9e-#5&}8@Cd06O65-Y9hQ0;uAF#}o_t(|zXlh@q=Xk?fWZq?T+)C? z$T%8rWCmP^q{mXFC3O|NP9x4GPlHED`a#iyR!Q zVdMn3PI)3+mkhvl%QbL4awA-?+yQr(q}PYU$bE2QB^}+x$v9Zgl;h$0WC`5iat+*g zc_G{cc^BM7`3l@5`5oM3ISx%fMJ|OqLS6=Uq@+S>(|auM85Ji21vPJZL%Shxw2o{mYBWpI<^>2Q-}JKPj`HQW*M4!9%bLvT~&3vfrt zeQ?v{A-JREVYuls5$CTNaw6O@@+7#&$a1)uG6;99+yHl+yb|tsxf5=d)#T|R2&V(@ zHoFfzA>V>)$nW4fWCmslDGO+Jku`8#@+`P`qY_+?d=jo#z6N)g{0H0^nG{cD&4n8$ zE8v>)Ot?OIDcs@mcDV6!58MR#DcnT)9o!_Dh72UjJh&;c6z&Ll2HcTy1Kd=3CEQW+ zPPl1Se(7drr{k+Q*$tKqt32(CwV!S%{Z;SQ6( zfEy$4fg3CT05?wl1+FQ3;riquxWnaPxbZR-<7R@)hMOq;aFgU&aFgYga8u+xa7W0O z;f|Dja8u=BxT9n`j=Iuh9^BE=4>w&l!Of7}aL35&;2tCIhMOrLgF9Bf40oLT5bk(M zPeEkKH0;nO$b7gHr62CGvI*`ac^TZ}J;m(jAOcgWbF>q(ed2mmZLAbMJ2i%k7<#6Z7 zJK)ZhFTg!neg^jxNpBP>kYnH$%6z!C{-C z87_YTo{;yzHRO|U9r8`MQXYWolHb5}O9zDUiaWSonGJWC48Sdr^>C5a&lOmD=Z=A1 zy!@MK<<)s8@pTP!1c&dxL(-?cbL2aZj9UoH&(s` zH%`6_*OdQ(>yvbo`EZ#JH{MEfXC|dN!Xc}`6LJ+?Lw3M*$cy1hc@tcx{5@Qkd&xwxdW~#ABXFcbc6SB`ER)KawL*VkTc;X%4Kkq z>A4BBj`M5yy@uy@^8Z`;y~A8%L8Na5 z%ZSNR{%%Y-F*9Znd-x=H|2AGr#Lgma=BenCv4!LvpA3Q6Hu6p&6|v`#H%oaB9SiR< z0TQ^Gykq?6C$X=Pvdn8q_5zYUR(Us)*Wz9r(QpZQCsNL1uOjcb7be1cO+?^2@{V0b zN!%Ou3eQC-KwKUehYVw^$DD*x71KCA#Up&1k(Iw_AEDi?@oiM zsO_BMS!wt_1VyGW3OuU}-$$A%^fVa0uQWB!v)1rkGY&Ubp_YvKo+iWhBf{wSX=8z> z&G04Xvz7&(PQzy+t4e37XM^E89$`wd%yX{cTc3-g4V2ZW@N^r#IS5l!rDwC@s|3|U zVM{!h7{1drRpq(D@HK*Z9_27j^K3JGKL>Rl^6K~gHjEo!}EaQ^G?SwLKf`wJYx8gG}Yz# zgW($k>I@XhSm$}#@Zla7i(2p5WB5+e)CSL9!&d@I={(2tvf-=IVdr{YHHNR!)cGE# zam-(h;p;Tx0x-saaj|A}gOLHojhe9$jC3&W(Tq)Cj0WQ&&A1SZG%()MjLl$-0^^^W zaS@i+Bf)Ub;QU_2$<4Q1mV6mZhG!;ceJ2=hFig$p0mB7Gie}sfh7*hln(<38 zBp4@a#+_g|z?huFN`LEdI@8}VhSz9`-$P2D8?T>9~iz*Fc>N78PA7??=cChMIbirc)6`zifZ>xEg_M>TJRhO^ zgHm~U(ett48?D1$^?YLZCTZ#o4_>epPlJ}+}D{5;sg){ z6EM!DfSBxo=Sc)1#tN4?6)_sH1T{``3G*~`f7Q)bx}4@(5NaGb-Q_hqL1fT+G3bgj z9|xg&Zmlccd`ZWtb0wSafOvq!>RqX(3l>vEgDcZCLHvnALas^XGaxo5fmrLxF;78W zXqGSaZB9qi;k!#Pc)+zOW0=y#YQcvJy#k*<-_}JkQiPUv20LQi7*#_`95~=%KNu2f(cLBVf#1A3!CUGj9e+l4PLVPNW5pu|-YLHqGE}p81+y?|>B)rGd_6+M zo9{-5RFjswES6~=08v2$*&+;aRG+E`m%HvXY3{&sR2Yk0cbi{;P{VwMYq$Abg!sLQ zgJ>OcpXrSd_nW9}9rA#g5g{Hlvm(SpB8kkd3g2yOu>~T99*3J`oM0R7aS$3A?z8Q~ z{Z#vKpKBlPr(w8%7wPS!qU2+^{~L(sh?tJyem@B6&c+N^y7>hNHAT$C*zZ8CO{ zvdlP5%yvyMj{%{k-;-PuMG8Ia_K9(iJ2G?K>lS7aWYnO%+dau#1VZWky?e5`0)!g7 z?{nvvEtE364tBI%Fe>2^vZ>8Xm?hnjkH1Ul4 zLo-Vg&$@ffnVQ(+-aonmgv#6V_~~JI@91hx{|U6OcXWfM_kuQiM|WuY1<-N5qc76* zi=bnBM_;Y!mq5q#j^3&1mq8Ef9lcxAe+KRC9sP`^Ujgmu9sQ1`{{q_GJGx)fuYz{< zj{ZW^uYq>rQFYXx%Kz)2W$)-zO}_!!(K|X@(|-kR^o~AR({F+ny`w8M{TAqB4vaoS z({FqV7Q!5o8`x$ z8_-5B*?GuZ214x(M>_vuKApovs`Fd(Ll9JIW0doI-@ibV5|QS_3^qBJH*sT~sO-g{ z&Zn?(POojdH{Ka%_%{^6DVI|t`oeLwXL{@=8+r8guiCQpdyZ4l4)PX_Uy;n4&9t_&o)6O|?0(f?ueqvz(uxjGAh99z>05 zs>Au2;ky(REv$@A=NH&bXsXM3$nZT6N-e+EJHN)FWDc62YWIdnc^fUTz!)XXZ;-q3 z)D$z&%EP1LSm}(6isR7a!zT*kWt^FY$m-DGc(nf$K&V~72{Jh{Elfsdn1&El+$rb` z3qYs=cdE=ZSAeLYL`!6rxgLbtEG&|f%x(}XDWp4P&!3>mV_1 z46Jl9vel)DEwbAe9&_+MQQL{s^%5JRDJ>V`B?RRo^>gso|r?lGSO|PFZgFW}SdlL?(3hNI#l4C^hih zCaVo!g{FQfmm9vNpww{qE4k9}HG!H!@otx^3}4YyrhY9O3||1$NvKofH*&4vs|7^| zcgEea$?%OpJk>;hC)*6)9SBo7+buf{-~FIev--WkTIl;?udk`Kvl!}o@!9+sO8 z-}{<+L|$U}1~m1kyaFe6ntDub!*(3?q0)O?UTgSLHT4I1BL-_tJtJ>5eEFJsR`wXf zD?q87?U5Lwb{WGPG~-WTi~%D&X6*$dV;8Cp5~}gPi0@hWex<3G<3sQ^TjWJ%69*9@Og)wm^9YQMNqL_H| z4+x=pbX*dXY<{JQD`HYj18Jy`D`V2lSZ)}O?J=1qJq}N{aatbCU(SRn-_vmncNwZW8MUU zjw&5@#pDamZ1_@7fs^tU@*D4{k5Ri5l~>&SX3{*Qh!D)6Tf1X5%!odQyew2dGLIhEDMgR5^a>vi3IAN7Dvi%QVWG<&bLOA=;A% z`NX+!PC`rd7NzF^W_fpH(9`}@9p0TH<6P~(&6z=Vps~vPD{ltvd%r+b@9l9JzlIFG zNyK|ce8zc`tq$n@O>)Lt*+N{7?&tk&Y6d;Qy^Z|$q-UHoh4tT?nei?7%~*qZf1i~R zkMviQ|NcoCH$jie!-JDEGQn5=hjTJ+MBFP$=22AKH^@Nhw^Ry=q4y=I^5&;M0f_T{ z5-G(&k+DUW;&W%lHu!TO?)}m$Jk#Mxoed|k1kOFAVP^WxfPC-Q8P`GbE0X+&$oLZJ zzC!8#%bD>l{EGjrH^U8C<^L`&BT4(ekI%?}|2>lbG1;65KP~O?J*!l6Du`qhX`xj2+rCd%Tf)d_FExk9*@YwxBL(!1cbE9I5x0 zQ!_3H|9R}pysxBZ{1N`I$^Tkb#t-lxN9BEEa-^=`%*j}Qyr{ZiUD?jF+@bZ)pa-z2JAGzpp&wZ}3xN_73>*0~bdAL?4_D$bq*k zy$ulOZO{0vE@Y?3co2S?A-wCH86yy$Oqt$*rcgkU7r{xO$mQw72)sYbcnlF#3e7^5 zo;LqpylC2U7Cfo+#+$^AaDIT8w z@R}cjppCkBq!A}Pd%(78ld_mbj_}YC!5H=r3>KjMej1rkcn-sxN<*J#7}Q0S2+t_c ziL|j_LnR8NpQZ{{pD`M!3Kp^oRzlgp?Jk~$@T68!EP8)VC5bOjDFDQI(+qPwJeQLw zZW%HsgXke*3<@>_1f7+7GY!~t8+=wa$i!*n2+!?s$FTqRg9RdGNqh|<4?vlBcKR*? z?}Zsx166yuNJPelEl!d617yDv-U{C@_A_%JrGrX+YXJ)_`SF)1bCIS#a?)t)N7N+=@53h2ndCMrB3 zk|O)4TnkSZ(cN$?I`K7F_#zBYa-E0f#l%|>bP%-nCQlEEDnqFP?4d}s#!pifPm`P~ zl<*MK^9q7f-++^H6Gs0y$5poZa~sc}PAt+L+cAG$0TDF~U+qT28wPel3Y;de9hbVT zMCrHIG+GR%saf$6$?4f=#Uex+`zh8-p2hH`q+zF;YP=%VYCvtRU&RV~7`W;T;5F=l z5)Z0d!?+Xy=5hJ2WCV!}cA_rdG9Iw8yHxGKSX1q5wN9NQA`0}TjuG`u|l zipZcII_OF{9Y62HJ4)PUF+9pl^I_jxLV~(vh=0e%c;5L)8lif~1jZEEVXq>+NM6~(?qzokzLj4$jfNEkQe()6P zH~#}v9mmS;y+ZvG|8X-q2*{VklN9%p--3))zvq8MzvoY?LOk_5{ohIJq_aRiOM(`8 zJ4ki=z^7F5Nf`zvZ3;a|Q-2LlCp-d81M%t04R2Gvml{+-d2fUMkm%(G86fW< z=#PnBVbK0eOnVCx3Rqp>VR=aJ0h)MOP`+R76U49l~-D)~&(dI4K^aGIJAYcy<`|Eh{f!6N!{N z5f<;bEzYDNhf3-AWt{bU5b1OLD$Z&4KtvI{;=Cpu$SdOZIP4Z_t)>R~WIX49+QzIV zZpA-6gg{Rq&^H(K_5bBV=>IQ1;=QsX)V?m%K4oofOGC%n+A~Ah^+)-}^~%n*jqMFV zd@;HsZ)ILi9{zH3R@QYjHYw)%P+f<5#H%BS?`G52*{7_VSu46)_*3=xFt;dQRu!lU zR#XNHi>k|(mIMQZ6$?t3J8wmGNma0936t~70#()Quc|H#RF_pOV6vp5I6@RvF7}s~ zRF@QM*%cMlh0BF{`4YV>iC)S?52^*1mISKGDl3Ay!JKGD?qEiqSlijz7KBwg8e3be zu%gO}iV|cR3W~}rt4fA&7nPLwgN5ZNl@+@_{Fs~iV790Ul=-WIWyR$s?5!#(sR&k; z7gm)HVFZgStB=T30bT8l!M57YwYqfB48v*7@G8yzl0Z>Og;Ep63YO*y(h=&Y*D6pi z!J@+Q@_B_ti-ILE_q_75s#43Qk$|G|GH49iOi>aDR0hcKLxkp+l~PoPMaeRB4Q1D|3N)dL>as%amJ!2;n?+@HWl?4MQPZvTmsC_$l?Tf!3yXs# z%c}#0S~rYaHh)F1s3cHbH8>wfh{IX?pW~pn%&!bA)`^gI8ZgS{mlYLKryraW7qifh zT%t7=Ruos27A`6YmX;J2mqho6$_fl+i>VMO5{(~~iwdJEJJPYDM5}82{>s1*EBXU$ zzOsrkHAY4Z91bc*#|l(NCA6%nELapMLA?wv5b=)~VL?fCu(}j6iZQ?pj#F4%jGk3q z9-JQ)P+U@etG5nCu!70^L93?>4I9g^k>>CV}EU76AV7T)K z%9f&#!9^uQ3=s5}pnHM9XN3)#!Xi~^8yR)G96Efc$*B0~;d&V3CUyh`dj9-B(g9N!Mpe5t zVwIso=r%aGyehmnQ0YHPcu{EyYQM0ksHCbY7${p%8f|%~Rbi#oi=!F{HASoMMGXm6 z&_!LYtYUuU;M^=g9WSN%aZt^xJo*<$$=Ympv~gXxL_Lo1!1F(hBZ0zY!NBstSsIGLk_tK1zSjK=GshAt{CD=)UP9$Z>h z81xqghM3)wA-%k=i*y3&LAv4#tE&r(N(Yyu29{Ru9IdZyYO14GW44ECJ6c;h#Nw(2 z!TIHt%Yro()Z4L?2y?7uOPEB4N)}YA@gO2Y4V-clmLjtZV$6qHwMeQi$C|4;IIjd# zNQq#oa*-%zZ&3iPv%I|0no(A$VG5mFOCq=`u#{zNOlmw)B$6qtuBozdF~VW6f>k1E zsYZvP(8f~wiz_R_xuZ0>Z&a5REh-t5kQ%0Kv7-xGL@g8xK~<=*9GLbDFQdVCaMmn| z;L^bS74}$zlUo+7puty-AvUS#JX9@Xo7xIm6|m<^TR$wxs{ooLY}QBcQ0s$fFAT`& z!mtF@rOu_+WVbVA$z~OhLljvOgRBCvp++E8gG>d+5v+3LYSq~t+|~=Xr{w78O=d7hO)4jM^01GnZR>s-5Jn7sQMlo@DIdWmQM!>pTq3 zzUB_j8RkKn@p7uWiHw)t-b9b6@`mYep@VhWi?)19m0u5YfEs*ghN$d zUAYLmdRjGOS1uwPw5Mp6rMN0euoQx}c*qtXJJ^^t{sjSSG;Ewote46vY>eVS;ru~* zO3~~~=&&V{CsoC?JgTxWF+AlCCi85h8kMncv$1HwhNVYDZAE28kv$o;mJ->=wztWo*?#X{N)t zYHz9bP-T!KHb?A6xE67|N9)NW7x@ScLx~S9pH)-EWmOmyu%sMhP&R=ja(cwpI1SQplLpngoazD;Kqe}uVZMLJ?^8=NOqj}UlkJRzNKVl}puc`Ry z4vmA;>TsWrPOrSIV$l%ZQLM4J5F4S&z_P+X@sP4uQyjHpbS^py8q)A05=ZUN=vFY( zkS-f2sSd0NVwfJ(<5UB%)=AL?K;uPAJkr>JB~MuqIzMcQMunrRs*)niKSMj7l0YXv z>QG19sUVs%HpWqnW@%wyNI%AYE?R8aGHgbVY%lcbqSC18&R-KfE#mYDr}}xsAfV2ka9V-(aHL>bGYr+LmIOoDJPZvD;Bj?mK-v7lK@($9WzC>^rUeh} z&+SF8T2$uu51tb>D_BKG6_({_%?c^BPwUqhWjxw;^NMJ3&GMQ+x!S0Aww@Vk3F4ao zp$+(HrW^-|*p4ei7sNp;7!}xzBd6rG4iw-iE}2(@AAsOf>tid1K5zvWs~Ht)RfY1F zqrX-Z;RF!D>YRW)R-tJrhtFRGn?mbCO~?iII%-9VlRVNBCgBK?M#fg3Bud7?rCQsajdz-q;z!7aCeSTkBh!NLN+(XBNvBEUT)jp*q&bNzAt8 znK}B`j4D(bI!+Z%b*(iwHk6p6ZNDvHYPGfxs)HXbumL`ZxbF|~J zc5|xL*w5>6ida%z6R1E3w~nj|%jr-@)n-+&P%GiEqD5Ar)uxDwSyc@qA@`Jkb+lut zvBauMYpRPYmno}T#m=)->Jniir@C9%l6m&R(>^b<2tKlml@OgbQ){*Tp2)vyQu_)l z$B&Bm<%MJ|A}2rCT-$MGFn1^`ZzyZpAlCc*$&hI`bz(XZ&R7^q&mP|H;s!SqSAtu70At2(_1YCVDTnV3?+@a??4` z{}gW5ex&&Jyd5drRx-U=#)w~rpVibR0%K-rVNDesjZzD1-+-T$+dD$mkHP{2A!b{( zYtsJWk|OQJ?iIbeNJYe+IM~|OiA`~b`mMV|&~N?pZKlYt|B4#Cfwpcu2!?Mw5bHY{ zMVI>ZT-2@=El?}yi!#c=NZqogbFJut>S=kwPDlhPFo+LIfx?G?)^v#0)vG%~odTkf zgge%@ws)#%Xn>ufg(MX@i=s7AG|CpS=}S=^_;5{OAW*mh+sIQ()P5=$6tx}JO$?%` z6)(6|4i&Mpu{p$vTN9dS-+;fiR($nIB?}>yYWoJt6YUc|L5| z0IM~2Hr6&pECOH0+F+e}Coe*SU5J8X?$&zT)zA=J8>(%D&@(}?Wo!M-`vxwf@IG_J0#4~cs90$~(q zbt^RlD6pxdT0q6D52C89^j0@Eg{WK+!wkCNLz&hRAw$7O8dkTq1y?r+{OR!34c1)} z2thTrK}Lm;990qG);G1H^c|rPK7Q5J9*)?$ngUVi2BD@fq#;mOI(i4!3u$X>s_hI? z7SLEbR9-sH?&u6PW7cb2Cz@N41=OdGNf`|10YTOsC1g`Hr%+3SP$xlXhile|x~>L% zD+{oi!aI>ok_xV?ZEA!ZzJ6r+>O0#-eQQ@sXOKS)*3byW?PsHEI~p6PaP*-h2vNG$ z4J_0l>HAyFT}_>hAUbItzzI~RWv=$nSzVzHq{O$X*d~e2v)e+Vb3<4jcBlShNeJ)HjU6=`ND+E)98mRe-F4z)zK&RV)FIvI4)EZDj?JARMt=H7p z+z6Xlx0_IdLL)@$=?t}_v7-dFO=z4Lc-nd7u~Jj5JDk+|4$5d3nV2!CdIC`m?I;JV zM2B-$t3)Y}z@*+vqe`%igzMLa>d&O;ZTQs)UpnK$cQl?ueOf0%olMY#DpaJl+OwNl zYa4=;k3kG-)@t6xc!UN_ug@0k9qZ^HZ4O_63pRJGu^KU&q?H3GS&c$d)UM9ev#kD# zj%}^QbOnYBqIx3*x1sU2z-a30XTipfU>!&_BN!xjPN=;#*wWg9o{ZbI)VPLHQ_fId zRy(7y4(+_YDOB4+1wkHQf2&-GVRbaCaA=TZD(Zu1xhw4s< z7Da5qfDeNPRY@8`t3&8)Hcne}eF*KW8G}hj2ck3sYS*Zq(y=yNW^{Z?FuGEy)rQT0 z3gn)m(xZ&R9%NxXh6~kz!uO+v+YoD4-MqDnnhLc`)%c;asTL||1fU=*=V;Z$q_Km{ zfH9k!O|Zin`@2vT7);dAvbwds*`m&AY!hu5?HW1+wih&~;ERL`+gh8NFs|rS)QGLR zl{J>D8I8ts6<{CNb?ekcpaIX4vIZ3D_&f*?8h>eyRgJZwtGW4X6r(MKfen%<6Wy&B z9(NmPg^8hwQg3T*ZPE#Xv{K;drxPO@CZIEe4R}NQTBU~#7;HmZ?p&*eV#Z0kL6v z&WXwiwl!Nw(!|AB6AD>Anhz`=)_m*L!pS17Wfi)CSWYqcSVqNWo@m2&8k9o`5TUZ8 zJSqX@QwbJ4Q@u zNopjiRnuI1sJ@kM@TFjii+hJE1I5Ae!WB58RMO3n+ac(z9k;sTu3?ChBFqR)mbaNA zSJLeuN@y`Gs+xix_pHUDUO=OtOqOD=(^Jw0E`9GTBxWruato8;T8fNL90|KcG&~w^!oq@P0-R2^(Vo#Zp(xs#2lar|AoB^& zr&=C{X>n#K)P~V|9Tt<;nnJgJ42<=-MSd-It{8r)P^vMh6@pr*(Wn>%Uv2f)(_)UO zAcM*ZjhmP%+uC3b^gqj1!unn=b{lF^jAXPfM6I7cw2Yx%*NK)u25=aQ4bFP2-f#fO zEHaML#&f1#ekfgC^=c`oCeOB}E}Bu4Uk%`jrj*cIkVWbXR%ioOF6uMByyR3BFi1}A ztlF`_#m;xl8qAAUY??~2*J*D(TUc9WwS2<@!?wquq-`{ICdyElUTAkk&pDt$sSg@k zYYWsx`?^M~Ofh_}$Jp0FBLRj%YmtlQOA4{up(VeXG3skk9gS$kL9(%03DD$CODc4+ zb{cQ+9UM$mwY2}iIYWb3gMTcuu-<8CZRY(SZJ*WlMQx*a35R7tM_cXs7Ss^rRq5<& zD!pi==7Z&>$~yJ_pqe!)7eiK(9gVbatZl)P7Rx=f5)67MzN$Cuk_QKdi;nc8T1+mw zr`l+ucxN^?VY|jh2WTcZcxY&Cu^RFk6en0)Pap4rC9!_On%OR?>VV8mt4M8n_))Q) z)=DqB7_<~+n^{Xs6y0iSVa3+6mAT=b%&XZ!m9ADnsL;q_KHOXF)vg;kj|FN!#OhRC zH(HAx+J|G?V090!Z+rkrJq&{}l(t7?0M#XitW(g))`=lpwfNNaOc7x|$hEfB!us5% ztUW^ehSg12Z1C=_vz-QR)u2QzY8Qh}*bo?)>pRuXSS_|_T;cJruCZ0jE33r(YwhyF zdkQPnp=^~s^g%3~)Yd_rq3|&Yaje4?y`{hw5yx5RwY1X2_ClQwU=64;PBRvJ>Ab*J z098pA&Bu8bK{4vrcD2wAo^);j+wv+{bqG31qeBETIc+nW(4ufaf#-Pg)SjXfrEA7v z#hP{;n&H%?RrQuUv_cH`=+kW-p{|BjYhB5+049gX@SzM!gHjW=7y1ZJ*#UDdcFkDv zHlw4pbRwKq)N0wzCB)fh3r4ZdRva?5)5)AVuTurk`y{ImMOOVGvAT9$YZncjv}eTb znhu9l;m8IkT5S{6*V#cjLqd3?@~avwj>B*!ND)v}>tKlv&}fg0-AiNJx*4?e zL4Gkmw$tt*h}OUyUGw#IH0jW)$=Za_0EKljw#Vv}0X0G=O3H#Z2I{9C=N?u)ug7Q+ ztizySO;s2au$#8(5oO?p2!qtFqmS7$t;VssRuqnNVx6@`b`zQn^E4tgY}>8s#Lf|; ztm<}THRKe>Qnly}Okr%I&LQfp3EmoaxqFDlP$$OHHZ1#R_|@>Y_4tNR!xnUR^{sM~I%+Kk$!X%e*do_PFjjf!WDjMU~ty#TXAw1~zvEkx7E)l3S}_voOI z=DCOlB;2Z4*7lGE2>M#EjZZD{989hXtHaM9)>q{8jH{Ap=|G#d znknWwG+W|!wBQ7`rBf9-NJ-YWwwqoVwR;S!#NhMp`a&~0Y<8W(R zYpwe!B^*=X=t-S(gcs$(ocx^WIJ?`RMjnzv{b8@zff1s)iHu3jiVo7%#HOS$k6H)# z>RCLLosdSTwK!0!qoyqWzdZ0+h=)-{Ej?Q)47?ga6y;@Ohw6^;6nc$e4xboq#N&%S ziFol}3cjL|YK$_{9Ak`e#zX_JEf9xsIR)M=c&;zb1U(7=`l7E275lQTG%j~sCNFhf z;@aZA*mIG0^RQwcJr^%drRP~i9iDo}mwx~2GYN=~f8+n^F;qNkIu%Q=GpFL`qUP3? zvs*jV3^&#Gu<2C&u<2Ahdm290>mX`sb6u#Rv#A546o!~k`_#sk`lhai5D-TrbV&Mt zr`}pW98F0p7J9{0kioO-y67vdqOatluWV{s*Sr!btgLUsq_;8`4KzDBM`VsbR_khT-zWct3N^m1i$>d6u~4HRo?~<;u_TPF|1uLYMo|OWlv* z16UWj<>lvl=eW|`@&^hkccpcc>n^oix4iKDuU*64a-(CR%i&(=ig#b+8eZlazldD- zW*0uN@!#_{x!lm>Sm@s58s)y!1ElN~ z@t7+Hu~0xCINrrzB4Lyf*@(f%q~^GWZ*h6uo7`Jm@hWf0Wp4SK3l_TYt)kZi)ZYs~ z3jbHqdiMnj;n_q;8b1~&I82fVSSWA0;4zBy8JJXXpS#>O0)cXqy!wJo6mp@l2`Mc^ ze#%|mQp6-9$REys%#AndEp&~Lb(_fAS3|j!Ux-bvF|Z-BMmCqjHo2Vcg>nm24TGtW z8!GljSEd~EHHEmQE_9i&JtcVz6>otn0kKg_1E_v^i-GK$D9$_QKL$DZ8=~Ka-{qFS zMdF#>b;?een_Mx}2IR2EVEy&*Qp!otKk6}8oZCBq2vma2uJ}ddmCvK~#LLH^!iASX zD-uP00`xct#z8RlQCG~PZuu;l=Lola8X@uJt}$h5fJWrK8})uEthdk=i()*89LKoj>jvsAt_%iPDDOSr+ewPw1W(n0 zM}CSbkn*|@KP&T;L5uQ_Jvj?f9wKRG0cXxcC34mYgnlZ z6_krG_d;sNPq{pPmjj(j6@I^h6gxO56^J+dizbAV|5&C^1$_$qcngFI zU&8w86zvtIpx45WSMea+D^3A@I{X;;lsvr(<`VevJs%a`2f7}93}h-C5Wb{}6(&K^ z+h8J>#HXe07hXwZCn4{PqVZA>+a>Yoo=Z9Z#HP9ZZ?8| zD*WMasFl9mq9p%TRQQuoG+w|OzDORgDiP_KSR*kmXT+OlMEVH4|AP>(aO@$>!W&`; z(E#@n;ss3m2(88?(#PX{SjcbsMEnzG;thX<;CB*^#k)iZq4xnog#VQgjn|I`nLYvO z5N6;_PMC`+-XucAdxQ{;elH;{@X$a>ZY3eYCu6=%KTe2Mgro2wVZw3HM~M9ICPaEq z6T%3YXdmf#zX|oVRWSM_poH$pgwUBo2-$o>{Ldov;#H)CX!Zq!Xzs;K)8`OntPtfu z(x1j6vt@(E!I;h=ZhFiri~0U^AMM}_Az&SorNoX=R!7+|FO zBfUY!pD}hYp3Qgx<7JH3Fy6$ti}4=D`xzf)e2Vc!#y1$>W&DuwAmcZT|6x4L=tBKd zeq$N&PC`YGWTY2mQTTYq;~1whPG>xcv5=Aa6~$Z3NM8#jdIe*UF~oQ#<5`UB8P8+9 zknvK+s~E3iyoK>L#yc4AVZ5L5QAU~vC_m3JzQp(%3%SFntl@ z<&4`IZ(!WPcn{g?l8yJ7a*v7by@m$7DjP$K)(sL!_wTw42 z_At`R+eq$i#`_qbV0@mDUR_3VuQR^G_yOYqMtZv&$sJ<+7vuMg4veJ~PUASCk1?4M zp8`<)OvZ_flNs|E=}mYP|76Bu#)XW2#-)ra8S5CE8P_qM%eaa062>bTuVuWMv4`>3 zjCV8M$4K)My48}Q(^B7ARD;TR8Pi0)ixSFwvv7K=P3wXJ{?&{(GX8>*-snf+^a*D|TK5n> z#P~lr&4FJio&@eamE7++v~kMUE+ z?-@<(O(^{_j8hp47?&{CF?KL+X1tE^*NhJ{?qz(J@gU=W8R=l3(#>GZW;}(_&sfVy z-$f_+ZpJGaZ)LoT@e#)78UM=I$4K8!Cp|wh#$gXfbQ^KQTNv+Te30=O#=kJ`WBfbgzZm6kOHVxG7{I%p6eNZ#rPoO9~l3{ z_zL5@jJ=Fbyn&kZ#4?U&oWeMpk-joda!VN-7~2`U86Rc*Bjd}A?=to=e#!Vf<1p;` zN&g7O@r*f)^BC#t^dxsWN{ExQ4NlaTDX^j5jjg z&Uhc=Q;aV&zRUO#<2Q^r%2W9;8Pgb#Wz1(RWL(48#&{m%WsEm4?qd8s5R>c=P_<&+`)Jc;}eX3X8arD=Zrrvnj@`zWH9D2E@fQB*vxni z;}*ti8E<3!9pmGSdl}zk>|^|r@q5M?oH3F;QW+;Q<}=P?^fR8p*u;1a<0XvOGwx!% zkMU{7R~Yv(9%THM(LKt_Pcq{;#vH~%#sFhIV<+Q9jMp>nV!V&>X~tI=_c0!1{Fc#; zgF>=PGUGVLxs3A}s~A@?HZz{XxP|dr#@iTw$M`toUdA^W`xw7u{GM?b&VW_FVmyv9 zmvJs*8RJsMX2veY^BFH^ypi#C#`_qbVtkqLUB-_XzhR8USuf=)g>f9?RK~fCix^ih zu3_wAypVA_<4(qV7$0YRf$?p|0mg3_4V+n1eugt9gKG|KFqj>@ioQ|7(ZonWLo){$#^p3e8vFd z8H_(;T*tVH@k+*<8Gp@qALEmZFEYNx*vI$-qjRj4pE$-;#w^BD80RxqFrLb|nz5bn ze8$TduV?%f<8H<$7+++3oACf+>^Li5iHvEC6B+XuPi9=mxRkMuv4xR7c}?x`V#cc( zf5CVc<3o(kFuub09^*%hUo(2gTY85xs;@{Ro$*XhWh`MVXRKyi#rSi^O^lZ_-pF`6 z<9&={vaEC`Fiv4Sk+GWbG{y$Tvl!23e2MXO#`hRMV*EGbkBsgKTrZ5{8K*JMW}L@Z z!FVd;8pcZ)uVK8I@t2GjO|;Uvj`6RIe`7qz_-{tvv6g%>V+G?f#sptt?j(f#aHf-(9>aJ%A@Xw?hc_^`Gya@$Gvijq z>lt@4-pTlT#>W`x%XyT~KNDil_Bzw_y+KtDraxl(Yo`CjwC8v$f2oX<7-umSGA?1P zWju>G(uytg{h4Bj5UmF7&kNC&PZRMqxkVtEX-vLFwz(1D11HRX2$J|^i?hj z$1+qnuy@2VLgn`?hlT1E(eS;ccnYE(x0p7EnhC7Crg49pdVjFGg_!QrR(FgY~*@c0{*|nW`;-apLK10E})RX;T3Rw}^ z<=F(Jhq7q9r+=gdM+FJ;-@hl2!p@)WuPj{ULagQy%`nY~A?!l+KPqSNEJ44wE zDr%;vfUxGy)}!6aJM@0t4%{+w!F{jetiL9vmeeGFY(^cDU z-JyHrdw02{c-;6%wo;juPTp}(0Oe=>}C7}(t9a~jh zcGO+Ks!&v?Ljo)%)3vsI?U|-MdCJJ@{%1}xS7bG0=MK(JF6v6%zl(gPNM$6H?LHg2i z6CpQDGl2)X@!KpSVq2{8LvmjHdn|ozo8YHwGjtJO=UMBMQTpZ}0=lu%=K^Yd=UDng z9(Z(J0ex#NuW~8x^#3UwLM`_#1BJBW2b78yGMCm&KeP`LP0Gk|=$*LLb#V*%?P% zVSVpG&Q_hG_f%1R zyJvrD&elGUxbTxXa_2yUf5*V8RXYZ->iQTfv4L4)EBrnElYrd`w|s1f?mi)w^#Awp zVVpkH^xu!$H4IVEC*phijozMqv8|^+LGnfX9yFSJ^kLCp8e>u2ghvMi}Ek;zl7psZc=gX zK-e8(#s1U5lWoYKNb3JL(%6)H%f~9+f;T>PiY5EMM0w-l-+)b)^pk&bChU^gv!Bv+ zAYB8th(r0FM;Mkz2PrP`DbIg|KFaS}N*8h`i6u!Z@H58bc-Wcp3_TkYF7I{5Zyzuq z2g9ZXSw~K0Vc#$j=tn=eObCC!k=fmsvudkLa+<$U^$_TvPGuD<`e81W#yF%=0X;cl z$AFX4KwR8G8J{ncGRou>HwKWLV21XlZ>*F{Z&0d zo^*zw8}>yT#BF_$t0i5cw|_2p7(SKFwXLZxVKn?%I!V`3CEwGJF+|0KJr#0$lj-q0 z2aI_14b;^vl+A&*G3V8-jzd>H;U#r?$K4*g6N^z7efyo$c$@5eea zMt1k?NBh`s>_$0Pp$z_>e%D!>d$$=k3^=!K3)_EN!VLql|BJSFfv>8#+Q#=jb8g8A zZ~}yVfPf(+fXF3aR8*>jB#=NLAqh7{4%Lspjq!b6&^ouUg`5&Wz_lHAMJxkZ}FicM~|MN z%fWP5o|RqQeyj6P%7JSSBi~2dyn5n!gF;A*_Z5_d_aZq zC#K_|eN&Ie)82j1-iD8rqOT^j-H5c^^n|v{e)134ItP`SK_lb0_b2}LPv%bkAPhTu zcA^cBVH+;*#+G>Uvb>$TzQx{$bQ_*_Wf$voXX=eT-j!@COS%J)-EH646M)^=4%m)u z585&EbSm1zAIH27xiXGjBUtwywAsJFZeh01E7?9Vm&E+Y(~p&It69j?lkFWnY^xX( z4l#ehcGmfB*bH@D^#`3kZ8m)2HHYmcv|~^Z9mff9BHHIA5xY! zArE6mvd_Mz3*%CEI@{99YY*>C-PsfAblcYMY3Q>}H}ovCZ|y0vu01jWZ6*l05Xv0h zd2Nqw_hIBq?4Ffi_xq6;e|vutZ0GxQF6E9Rw#EOl=%tv~`nz4$!A03_TpsJ<2qRW1 z*AK7$B`TmSCX|FI=?PJIJF9=kMk!B-l93Q4Lt^OH{)|5b9^0xQFk`lLu89G!5i)5| zaVsv5mD53VV=QNkgSc#K`MZFXXn~XQWM2v35oX5a!FiRfQqzH-5#PGT7@*j~%PNfcwYP4+iwv2uc2k}{U$CCx3{58!3RtfowssAJ1*4aP@-GDa>7nrh_?%Ho9pca@KfdB5?ET>DmR6u3YPjWE}QU) z_LlW;fO6zb|BhEOw>ZmKoM&;_)-o1nx7N9gd7)9k&5GG{8N&6iKb3I{okNum;j*oB zsIm<9@L1D2h%2>!x~})N@I&Noz&_V|1dxK1Jyvc9afi;#IRs{iN{IKnY+B}s>m~dJ z7i%rv2F}r$g_D@y0?^93_+5)0*9ME3VRkdDZQ#?t#3)7JAWD~R*KU+0jN%$-N!&oO zdm|H@P5m=m%olN}E@ycJP~>`9HnsuOG=asVFl6E>ATT2P9$_lDn>2l*L zE2vUxR20T+K{^E&S{vbR?X85XeRt7E69#jI!vM#)JTgQ$7pc5?rVwf}3=|wc#dG!3gXRs2GA9;g~8gxzZ+N z6y{44K>ah7b$m%iX~iWq=caT_WidX3Fg)e}^v~#?0LsmFCBTUi}77^SC z=forQTMur8asqRJ0fBHoE|?&Nn4=S37T0r3_0UqexO9#D5uQ(QQBy3h$3&s{LnaDP z|4hjl$XsZB^c=^e$B{dx2h9={7<9wOwBD@gB~~e z#U}Y)cCu6L?14jkYGBwIIWW~;?4XBv?cyP7U?_A(=u98fOt93zblf<2v*0-^6vDl_ zk0M$Cgg-$ZWMGh0JOn$6h+!oSgI^7VA_OE)L1Kgbvm!Uo9`5qS4?i0>U?HF7iMR|# zOzB6gcnAdtK+uT`4$SQpZxG0Y&~P$x%Y;+W-BYjLV%yV(&^vhh78~(y;L~42$i8uQ zg#4jXY%T8_KfHLzOr5bbpDxL;AqWZiTx&Q3ptg7ji5VzUB!PsjhR4ZJXh0|>Gy}{L zj@bfROM>YjLt&h1GG$M@$%^3C|v$f%K-~-FICJEZ6kh1mfgTxKwQ} z#rFqscm>>m`VQQnx({xWdI4^-ItVwU-iMo__~zaK6@sk?s?l%Zn~hfI z!978(hnt};gF8lj7jCB73wNw~4sMofv-g553eKcB2%e?BfNQICY*KmD*>IKOdsJSv z5w1_&2p4BMzzwJ_xIx9Ym6FsjZvH5~aTHQ~pD0B&!5yIZZqPu*H-84H7vY8#-`+`8 zd?#nHN{2f{&4fEtRl-eE--J6%wZnDPci~3VUbw^6%Wy}y`Q3*NGOyaDl#l=PQKRA7 zDj%*#)x%Y42VAe}gzHm$7X=4fzzwJ)aD&Q=Ey*O64L4ck!wo6EPm-cq;0{pR;SN;y z!yTl44L7Vlgqx~T(E$gmQ{WC!Rd9!@tKp`pr{E4#e}n6&@t8{^iW?-u)ke4@)V**= zs^{URt1h^s)E96^tJDFkn@MmpR3Y3k>U_AF>QcC4)py`#sh_~jR)^q@Q+~XGFkX#? zJ3-~bJyDgxov7;Jo}{jYJ4rnNce45|+$rksaHpzam|=3%Ot{n33b@nNX1FJ-+u`P_ zN8z5L4!}KCeF*n7#k-FgY8c$p)#-50P>pcURF}h@slE&M8;b7&oTc`|JzE`tJ4@N9 zjyyF6?ril9xcRCAZh_hew@`f>?i}?1+#>5~!aoR5qQXa!k`5!vfd^FYrH z6ZTRzz2_vfxHk~hPuY<)#GodObR$TP(B#b^C&WoUoiZ^_avLO<a>9pS@xI=yAy1NQJcOuQ(pbizS< z_(?F0PGlt*qrte}NK}C_3JgA_rzKW_kq!nQ*VBw@Fh+v$j$zb*G2);d`NS}4y>HkN zKBo61ZCdaBqa6u@()nrdcG;0^P$#D#tkL_f9XZ2LP2TtHNRgo~@E$=K4b|-Z(2lej zs>S;kJ8~tcZ=&;tu*wY|~%scj|kUCGzbT73(>FA{=*6Tun5 z_B!&PP?4ifNploDH-e*1#gTb@o2LN^)a*2`^F0t-NED<6orgi(MPhDRiu1f7=B0(5 zmq5JEkcDYOolilqbErjWldQmQ_|hMMlSW<|8=~v1h0hxGG?;vkNKHu#ya4~mb`TTP zs5B=?4|R@4rc8%Z8OYQ~gs|zWOk@h{S1XrdS;z-RBu$J2)=iz zCZ=UsqgWv!aMZJ&QM16ELw}FQI~5oRj-nu6dQ$Iul34S65z4nYP!0A7j@JRI4K%|^ zr=~Q%xM>Ag$iS6k-V7&Amzh3m6f5Cg>U+-<*h2vwOA9mU=nTb*b{U>Cy z1<}&}3@elGl2L(wj5m|-lWBh@7WGp=_&kBL5jN~U+1NX>?J)so8Mt3#Szu2NSdoh{ zat}ro+GhmH>M^Zt(fhB-_ZeXV!84GGK^Rgna+m7Ubx^*BnGd+f+Laq50MasjAMD7ikc*N*TReA?b_31Faq7L=~b*1%(S z{J!pJEu7g293QEW>CAg9Ck;VO$0V2l`sW*a8Lz`t^o!IT#q|hhJwHTfrC(#*YkR z8*U68FrGGyD%bTY#ze!o9*hBC%rT6eV5ERC-!N_fBLv2IhVgAM zlEL_vVcZBt5*Xh$j9p*^!PsLMH-QlV;~B%~0K*T)&kds!3?CT3GK@RG@PhFt!?+U+ z1;*!wu?Gwf7=Or+(*7{u^`^gJ4XX&M!f5;@if6Zx)75LtWs*|0e@{Z+h57 zB+(wSKlbQ#iY_w#@$B$ENN4|V9@Rm9qHm-3 z+kk*)G{Z!<_GfXGf`?3#IKTdZqUVohZ_zTNt-w9dFl;+=o-x$U@HywgHyBbjwtXVi zAWk5W>9g#}S`#$ZXQf6O43*`x2J6XFN6YqELn0R=Y!c&*^I1b9TMaed7anTq#NABc zc~a)YCBiPDvlX^Ro{5I?m|g61evjB(5aR4o-2cUipwks6!p{3~BI5ixPGmTrf?z$_ z^U=OpwYvIBe0v-Y99XMZ_5$Di&Q~DxD6-JE*9kIpHn)YopE`r%!~@Q-IPst}HcmX` zoD?S>cBaRPN379Yrs{&VClqp)HS!E}{R#F-34MKXVqc$<*w?2f_VsCref?zg_4kn; z|B+?qqOboM#Lr2bg1-JS2)#}_)tByk1wxMxr=jDAk-9GA>AoyygdxuGWjm8W=&|=q z-#BaJYAmRZ*gx{ehpnIZEoTvAbdTKYpWrM9;g0tHN%1A@1OA-&681rVuCp0px_dt4 zpW)m9;$2+!!~R*$4~&9G`~}VZOTM}~OX|3~LvKJWoMbHDgvd=U0OP~jIW%DI=E&of?}y0ZBn22CFXZFgm#X6V;ITV2_64gGu2C%l`z)X=Yk9{sMRZ^-V1 zVFOb})111cd#$+tS}Tx(JPfPF`gf0QZ&l76P@%UquD~tNLx#9gwMSxmGB+s?TeJMuoLr?~F!RAqMLU!e5H%pIx{Yh6R#sg_~&4k>+qaF<$P zM@E8rk@3E-R@#wIPY~)JRbxl&4BYR7WB)*{#pVMjZuQyst9oqjK&QSx__1ojmJz~q z&h{$YWvl|FtL3L^Q^Ll~!)h}qBl(DG$0Em2kE*S9WV@jrQ&-uMU50ub2VF-x4fTZD zX-6I~)X&r|+{YN|NwwRK{J~JqtJ~~Ix1nB8o%ZnmfYLeJr_dnowucWv#cIZjV2lPM zwx{zF7^Ch+)j>jcwU^cR?MS(yUQzeRBp}1%$VsTV9DBKPI9=;;AO8t)evc+1M9_H? zguZn>7x%t@j}t?kui`|+@j;V_r8_BcBE#Y73lfs$q#I%d?tRC`iAk3C5Yz>{0Un|- z;#Y7+mZ7?4s?EvHB2a953i}Ms3V8Hw|E0-Zhtr}aE=vwNYfQ-H$te!+FLlVa)Amgt{R)!}*0FZcNT{4uYV`)lJD0vfnnu?qpQR zq-=BlqHX~_dQ!HzeNo>9J!+CO1SzvN)NRR=ow0_vJ$Z^V9fZzgM{b~S$ zEASgoBM!nDxedvMRdupnujx|Mzzp0v)I=@JU^<{$4KrNI>|qL2Ym!r}(QNO!wmn$? zLHmdaa7OY3h;;RVKOXZ#Ofo!A;#%h5Bfr6w-end**sSqEc zCkOM#yaSjKygiczU){|;{^jlm`syepW=)zDQqup#*Ul+4AD*-aJqhBGID z$AKaEgQ1z*fY}%pf5j^?r5woDDyaKk0(ux_%@uR+u>XUv0(0)dO%9>NW2suTA8PsQhemi zJRAO(As+lVi2A37gVgX2oE6k?+87?_kQ@9ovjCFUAidycR_6DBYnkrn-pqU9*ZePn znGYNPmnoUg8~<0~%>D4UQvU0q&TH^rN55r9oVP*zn1shpcRmF1GzqVr;rs){K@xsD z%dwD$4@d;<2~HTqmn4$yNzOPB$+TpOonr-f$c0+u&U@p^nIoOvot!-*jH^3Zs_?~i1j0scyidcj|(XEwpV zgZ@{uGVh1~1^RzCDPGsF1DlYv9)n zbb~kZ=kWhH1EQPI6y9Rw9yrgks3l__BLu&hSqIc9G+4Uy*ygi>jrf;Z2%Zs~`jSS% zxu4>TN8Szy2M5{C1@J7VC>{oJE&{Qh#1Px-Yz1)w?v~ z1$ze~!8It@yYP(ofU!P<^EJeR%SL_-NC}Rxo!`Qf&Du>z!Ttc^3=*SJFdi&3heU=A zdrpMUEelPYM#l>9Y>;u{pWj;`UY4YF2;u26!868G=*(W8nFrMEWt$Zr8?N+PNjF2b zlS1DZbAy)MoT>Ltzz$wwWnN+8wL`WCS=b1MXF=d4geUzD&fAPMYYYd1l;HNvhk&~M z?XWU=P>uFq=gs7Zp_|RlpyhoM1paB7f;Q-ukU2}^+3r?g4BYWN!X}uJbTa&F=`9^o z0q_QI%v=D}<+us53lKgo?R>bp5~U`qL62ZR4m9X+w_{%jf4rl+13DF1fg5{=>;Wm7 zegyA?z=N@Hrep;o;K!7tEBy@Qk8|$2s%iuBqq1a~3^(K;~q6-h!tX z9{u0(S1>nEa9JkA^q2>J29K`c$ZkF%l%OoOAJ z8F-v4l>y%Z`N4?@eL@T05AqXD(li6+2IL_D9XjYw2>pzqPf~bL0HOL{`z~1xQa_yV z6l;6X9U%38`gJJ&oxfIRxWaRh{&)TcxQle=%XH>*UZ>(aso0*TGk7O6I8A3xv#05d z-N}qi(@!pF?sT1@yBTk~&W!8TDQmAhN`Y2spSOi(d0m(Ex5%DO=5=ic6|^jF{diwz zCmE0nQm64cmv(qMB3!^H72f27(StT4P$%`4Hp5Rqu3@N4Mw6u6nmn16pNo>W;`06_ zkZUhyD>x-ZH-U7>vI(5x*8hHJ($)SMJh~yA4guD`+W=~`1^?<={WepvOFm=X|SeP|*EIF5ij`Fvdv-Pv=2cyke*_*8c)NcpRSpw*tGME zJkZ**)3m-Bmx0#xEA%6vbz9D{*_emeOI9KeZl7Q;aGTaf@N@cMrLTX&0+4e3E2JIL^|K47lOVlPM?m3pdXVdwE3LO3?8(5HG}79^=RY| z>HL)ICLQ?Q1S}1{gC-NU@obs%J7k1rQaH!iF}nq54W>KkhFBZSa3&d|A(*8%QnXlWaDuZcLvDjM z1}8b@2@rK*Fvl?uhp2A_bM=iH+l9I~I3s?ybZKy=vjqxtd9Di1a<&`dnqYym%MjNG zi=3Ir0T;RI#$buVCqKBqsBR0EIp$#s)e$Ur_$-A^=bm7tV;&_@dxFax^CXG7Ke)oF zH0AkeaHSJ9#Dl>a=bIp2z@;7yu64|2jCvwi?{u2%JQZwmHkdfi23wuW83#9B>V@DY z$2@1FejeQHme+?sm+RKkBc++nndA8ck1q9_(}u8{%KVyPba<;;Y~uXCzvY7V{+C?@Tv@ zH)(JD$%>?;haB@LjS43{<`f&T!AVa#=aFC$(vqHa%%+wao3zh)(O73n(n}6Ed9+w= z(tc+>;&9$mrzIV5E;7W~NxyZj1o126Pt8d>sBiq=B(XH<6D#l%d?T3E(fl`vo-zXo zxA8%1z8jp&)>jZ%U*Vt-)oIrf!-NZ@1-~;@NffKy`N$^JdjCiJdy$ye**fEJJNU4 z!EcWX`dv19cL>d)#r*!Cd?oY$?vsx=>0?F0X&=Y=NaKox?^CWY-=|!$s?GiWbHXO+C-O@dl$8`#78V%U&u81lvei3 z)B*YftX25px|9yFVK}21Uah&TuspwTp;ps}6)l>kKi-P3S{oG$D&|J#l$0)wE?!u? zu$ab-aSF@JOUvVAdEvssxuuoGd6k8U%sgEqu}DkHi*R^)eM0{aB^{ zYBkyI-G0dJt#WBxCB`+htjcKqY&4Z}7%z&Ep;B{77gki3FV5FPnUTpaDMr`)?=pS# z6rdCQ4{G`q`R~d1qqC?me}1%dezdX_^_5prvRuZygd*lA$e`_&VK`*T3Kz1Ea2Ph_ z)Hy0$-VZC9w{UrMX+^PCE`zy=Wr9%RyxAr0u#up&ERTIKTD}bJzOXE>9AojZp_Mwc z0y9Pbfd!?gsNR97+yb0sHy^W7VHt{Dxhyg2oRY;AMbR>M>gf}v%U)1e5G~7FUQ(J@ zfV?F}&CgrNF1n1CH1#fXNut=aqH_{S8Tg`@a5$P4!W6viQ3YID-0`>ppD9W@`V zYc?t~+P9)(0ms-Y>dr>YQeUAt#U+*KcW4uFeZ7+rZT}@TG-S8EBq%2@$|XQ=W#xtW zg`DeqWks0LvQl@ga!e-sjV1Z|A0zi}2C*#4KyjSVV{@*TGqXzz+-@0D6Jujo(km*{ zmwQXV%!U75;y4+R`dL_5xwN!=KF7YqJ`hVp#B^?sCnF_ZScoCn?NP-TWb+p4RY{); zj5P~Pk@=-1$4$2sUAv;9B&z!_I&^uS(JfOUr>2VD)!k1V$=d%M2g@_8fEJiUsNG%i z6zAu$Q}#|tikVl&0VoKn{7-36GN}_Z6 z1QZmO^dI0(*wF>01%>?!l$2ulq0ZhZEnaw>08`^IoSxk|NEer5eO*>wyaa{hilw(I zj8tWX7?)@`E}9EaQ6hqyD;)T?AY*aX%Zuk0_3htKtHX*a7xZZ$Y>IB*>r+`~MOnOXPHFGl%*Co`32(@H z)x6GQ*@8Z@3AXDq$;UdDX^CbWG0VmOK8}>^nAM~Xv)=~7>P)tVNo4Y@gaI$0EGY>H|&=!Qllf?UP}Bz?*t$f~Yy zY^lYm+qF1Uyv;qCoC!3pW&&8Z)@a=`K)9!YudcJOvt`t^L~*or?IxUcomXC-w>(-= zd`@Asa(P){G-|C!eQUX<`l?o)Yt(*=Hbs=I)s4*!E_G2|lhxD;)3jK%8*rX_i`BBW zv6;!cR8wPpJ?z%JDO%H9Rkxm2W?QPSYe60AeJ87Gt+lbG&f;<4+KIw8Yg*TWA0;n} zbHGsqoL3HGHLhOWQkziwZeldyv{NCpo>FcB;oFyPc;sNST{AAxEq$6R~*{ zD`ahJYg4qjwgv3~hUF>mt&Qty*E0u@tZS{Ss*lDGBVSw9vNpP^s-^bST!cn(K)r>V zhQ?~N*qZ2Cm>;`wEX2mDIw^1yDy3mnJrf^XVs#_C1{5Tyq}@<+8>6tMYhY<^7Ew1i z-E!QWMrHu@RJ*>$JvO=3s#>$gTGdvAegs&}@K&@gN<}wR)z?7|N1?mEY8-@L-Pne# z$T|5nb!d>y7s3uLbv100JT+ZT%Xc?6*`ZPURzq8TYaIym%f|IMt{MIG!lqiZmkZiz z(P_;VX5Y=o)=e>aX&woj=Gq3dEjBWvQ)Ci2A`@jV)Afw*g^H*}Yp$(fU0ZEv;m8BJ z<|Z6fk6K~_LC0#=nbZxTzOJDTHgmTjX?@ffOx;@BjFy2CRMn#<;{%uFrly-hEUAqx z%xD`;EEv_z#zKLP?IU^=Vs~^$C_R=jUK2hgP>ZzPuF_I>5eGA)kB!f2sA^efxx-r3 zh4qb9HBlzni@`QQG2Or$o2p?EtGQ(ZFLe55l&zstP@L-GOLbOLP@Tv>22x}m zn!@N*R~@Zt!`8bV$!L%DdQxpc_N=wj*kRVYGh?sG3L&lNw=LFM%uL#YZqwGZhICbZ z6Nbv^(U!JVI-Kn0+Hc}t2dFJ}uY^Q&{-Sz1Y0%?^9{62voZHmM85#Dss@GtE+koj- zFEy<7Xa^RCoHln7G=pN)RcoZsJDRJa4VWr9l;}adwi$JX8FEdXF`QLhg_=d9+7x9K zYMbaT;_{no+gjM^MGVsyhdhpeZa6Yni~kYT)KxXtAqjVs#++|PX%5^js+oE(-O=9ro_fyy;W#G_kR#rSAarqJHxcJ z)MK3AWSL>R8GQ)jWi?EMUg6d&vuaTga}!nvZLKwp8`1GNK!YU`~{r{tWj zooG{oiGw)eVF$*>S@p=-ANJ++gipL3koZXN()5N=OF3DejZ#HqtAyj~h>4QQiU&M(Yh&0!a}CF)&uQpvPf-gOQzu(v3;qn&{;PN5v@kdf~p2 zOAt~~0i6|&o0#gFnqUs}Ki5`PHH^p>?@mPVjIOF>>#xB|wz=^_4E3f?j07^kd#>iH zjc&bRg)b}`$DPg5Pq5;|%EWz40gZ&K7V6cL=P?5@X1Wd5Fn8awESi3CzdB)4ps z5wIj`s=@-Cx7}Rr>U%Nw<6361)!NJ!>#kI*F!jLNv5H5FtZvo!b$XVeL8anX)iqkP zi%T&}xr;L0_Lv(t1IMy;wqZZa7+43%9k=U^-*G3f-J4T$JB}3|?$S_woN{Y$8?2{v zDG0l+c)7AqD3G4BU0QB1U4k*H*S4)+7a!SVIlzXcZxFfMXVq|(SYNAeC2$kzE{I>mqS|k=0+ai3Nq_q*-2+h3V)VHC?X?zJ7t!cz3!Q#uGT5EOHhDLk} ztOlL39t}>fSasoO1GMIvUIO& z+Hfl80Jg8{s%9>uqG%n$F)g8b6?-424|g?&1zZaj4A{oeHwmZ_ZVhM)CNNMx)wpfZ zUxSNotivtEs@iCk+h?tsMl7z}dPEtdVZtC)8~7DAq4fx~su6`Vb3v?iyUQxWhI#6c z8g5(N>O?cZ#H_m~t)}PP+A8!8p`vbQv8vsX&K=pLyI6I#t*fIgO;`n?JJ#uEcl6w= z=MZ)gxv}BkfE=^2$skKczn+I1vDSvF zCTZw839MLZt6ESGt5$Q+c86!Tow`Em znXYEnH#V-r{+&BS>+H&CEn|@$rQ6&Go^)_ieH+*6+E2YM%`qJ75cCSJGThJ_q@h2k zC%2$FyN;EuzM4V%j3fX>6MC4D=G!6;5>T?w>nGfqPIMj>xA^{p2A zSM!EC+@4}Jx)Dps7A~yNF5Np_tOj(Gsnz%WdI4Ttg%PI?i-IU`8TE}7?}cc4w6>SouYj9y?#qD2BV}sNp_m<*gky|so%W7$=+K6Z7D6fl@SQ%#G(Sv3a z*2>Zb@C`-WsxTM2_a!zkd|eSs84PZXZ7q7z#TpXDcW-(62F8kx^!rS}(_k*Wv4rBS z!?=*xDX=T2M?lW$YcQLmr&gm)!IHQg#b&VF+hH!jo{up%n_q$-wb|<4`1UOZ+pyTo zZIig2a@$u-vD@B-8y{|5HWP_ex}KoeB6Y^NOC4MMBv!lWdThaHTY6JOdX=v0I^8Oy zyJ$bV4TfA9qugF^RW;*2pMx6gi47txSl7~mMzFfBX)UVG9aEYcH(*B; z^QF6-rXnt>YpZK8u(hF%Wq{H>QrZG$7!<7$dss%T-Z5$Ex36G50i9w!7P%Mg-t{CT z-fw{u!u8#3EZu~F#EAWcCt4vPTB0$yj?+612^&?3JY6ewO)`Su{{k^TcSkr#U}06; z$|Z(d^=9PP%W-$zhYzkcR>=lZR2$VbO~NvpZBCeM>L7XPg$yHNH0F-9X@_Fj*u3WU zsteli@mA^IMq(rCr?q-5?kt+Hi3~?Cp<3~9F%nt5T2FiKHk=IaSY9#}O<_7l)iqli zbY4uxVJ+=82~y3m-+F*^DILEdFE@uz^v=+YdqW4 z)!wUoSNg9AYzuBpDj2vjQH~F&A4e`HQH~F=|8L}0;{BZC$jwUB#|PjG24-AmZ}(iS zuJT^#yTZRMur*jPFsFAp_<;Oz^cCHVcXzzjG7nxKvh9Bl96&(w7B2h$>bZA3=ROr9 z)Vitoe`rJF`U~-|MBb`RO?b|Is(H?RYJFY86Yiv@Hms_xX{~R;@)~R7+UBWs>#OVA zYHER4AaZm5|4uzS(s492V$l(8saZF5Jr*b%YNwt&W%`s;rkpwz|2u7NY;2v{))LPR ziZ&UGtF}#(8EXZWr!D_KsD+9ZG~J5cro(qz+!+8#CYWo=T2_`Gtg#mc3U%3!07`5= zIEte$xr?B8pds&tV%!eEhc_He=~uX=Um>MmQD48IVFlE#sIJG|+KOrDbW^6SkXl)R z`yMPQp#iOlIWek{6`b3QGa-T2aG#w#)Pt^vBYcIW9NU+g?8%AvMwR%&^L?J;t$ua> z7N5_rZm~U+Y@ff_=TX})o##^}ezjtYFX&g}g75mb;Dr2hK&f#!TS}cXPy2{oznbxc zFEqzDpxEav^{b+JzEr>Zg$3SxpZ{vVdH}ite)TI0vTEHtNNn*X`PJ$3e8ac-lKl{$ z=S!aFOYvXs3xSFNEx(#gj(QGiKs*B#DIk!lUk%=Z%nb2=;YcR)APE1@eEt&OpkiOrR$pkFFa0XtM8pgEpMs7p$l`qHr@r~fr(bQk^a*C_GW!YN zU<7-&sH2zA8c1&|PSZ+d@n?OnaKZ1te4Au0aQteFHrQ4t9;|t z1{hq0P#2f`9M!r-;yuA69<`t7qx=ad4<%oL8i3}Z>KWJoYKQu_`398u(vaKH^B6IV zlHKp7{d4=%;0BiPanPgvY99;*>Pb={o`CODMmcED^WemagckWa(i)oVndJDwIKxcM zn}@7zi5KaK{z`;%%P*l>?z87@N7-6YER`~k1!L@(LH>$-kG|43NF`BV<2>KUQeWU{ zU-0s+SNQ_Zqap@u@ujH?(FTis!Ez)tkERQt@%vRWs#`b3KU}Phbe|{K>Q}$Nc#CIf zuk8QW!+LmDC;Q69x&j~ZpdL{8moH{zKjN9^8%wSJD}4itd`_^5vS>n-_Na$F=o3jW z-T~lMqHNH`rFZ| z7{}s2g_HW@6i%nbiTH_h#QG27-ydW7t-mMe!*L_lUwhF5tq*$9sn$Ea=rnvi0Oth8 z^hGQW=-n~eufIaLES3kqh2sJB_nur4yhoq#Qyi2Neu_hB!cQT8i9coGIRAtnzfY6+ zQx;y^OZX`(l0f0zJN=cgI7?Zh;{<%l8qO*7lr63F$|U=O|s*C+iSNQ48B8w~rMo1lR4^$+I}@i!6Gk%jm?2%!?` zr{gVK*8NIkVuhd)CBaRw1L+?Mejqp<36Q^)i1Obj_?}=U)+OYhFZeydw*?2GtDyR2kqMf+&{d!MTtrM09UfF%c}wgEy)1r|C>0-swL{ z=v=`w1ZN4(5iAib7hEP775t`Pi{OQVmkMqdyixEL!Mg>2B>14<>Lp-&LZ7CcFCn&4@I-w@0fEEX&kTr7C5V3pt+!3Mz=!3za173BQE zd|o4XgW%1Aw+r4S_+!CG1)mb+x`KLsDfk<~*97?yD25*rd|&V*L9Qbh{x89!fG=Zj|)B{_;bNm1YZ?=UGPtW-GX{PKt4Ve`X7S-7PL7Z zAUq&AKyZlQaKRGG!YR-x|^`aYo_7W#3a_X+)y(7zMjf^6i30`45K)ga1ZNAD3a${W6Wkzpxgd_*((!K>yibr{HlyBsg0Bj` zE%+C~F9m~KM?ijzga|LG!&J$cJSS#2fc$wh!g0~C)Q1EfV7X@Dv z>=yi+;8DQ=*qGOL6FgDyG(mnHkKq-9Rf3Iz7Ykk^c#Gh@f)5M6Ao!}_JAxkx{#!5w zV=vPiB{)U!Y(ai^kKt8<&4QN;?h^dI;3I-B3cexuf#8>dA&hO*%kRh%Ckvh>SSq+u z@B+atf;S4@E%>nDF9cr~JRdh*e-aT;BA8U2|gzH z3&DeehXp?oJSv!kdpqW5nBZ8!X@X}876~pETqW2jxLNRO!S4v(CAe4cDZ!To-w=FH z@H0W)^D$px!7RZkf@caA2`&~~CDI}t2M%%d zWD4@r3Di47uu!mEutsp5;Pry{3jS2^X~F%1ZwVd|{9MqBdsn7+y5MZVQo$91b%GlN zFBjY?c)K9KqCtI+3honpRq$=WKMQ^#h>xA=c;f|g1@i6?+Sh<=*8Xu^EFfu2QzCrSFk{^Qm{s_RdB1|F2TD69}?Urcu?>I!2w8< z={ka0g3|=g7UX9eD0i-4o!~~nZGtxn-XZuC!KVaY5qwkdeZhYSs^M-rse&g6P8K{< zuvn0vQ((So1zQ9!6TDvVcEKMCJ}&s8;A?{K3I0#KB zNANDey@F2(z9#s#;GYG*5absfnC^*!(*=15I{7^Qo48zXwP1^2yWq`&uL`~)*d_QE z!7l{8*ej*puwc621i@UvS%M{k%LHo#d8|0~Y!WPXbWidxC!z{8BJ2!wpXt z%odz3c(!1P;A4W%2)-!zJHfvS{zLF8f}Si_&mh4u zf@cdB3ziE;1?vU33SKMtL&5z-tR4SA#N7L?;75X=3mz2=X1j8!f}@FuKS}UxBG!Dx zMASzm5qg&iT`lw)p__%?AoOKIZxec_(7S~05c)2me=PI^LO&(+b3*SI`hd`XA|iiZ z2^}2g=5vVPXu%T&a|O>9oF}-1h&AL&q1O>n&PJgx68aLMuNIo$5T#vi6}(6I_X+*5 z(2onfPw1C~ew~PPKM_7Z&dhX!<6TS@Jb?(g$%5YyTp)O!;5UiL&lQ5Z1@9wbjrx$# z&k~W&KA{f?eNgBwq2Cqy6QOw~FZEj!-1uH1=&;a3h0YK%N;~9tG~L3`*tQonGPnXfh8p_kC1e zm$s@EuRyG7jP`C2TT~esoFw%M~=hF^fO`&%dvn31hhNdtAAuEo9<10~g0TleCfh z8oVT2=6BV%FwcX)kgIi3j`0rTN=$ba=#@qp{6^o~@F(iq4SgBlQ6I}@^gRYY^u_Ym z30+Lbl;7xk2)smnk0s=f@N(=J5HvHTlceX;g@0Q$(M41Y#nb02*x6Y_`cr^JNCN_mB8mU&Ci6bhR66BRtuwT z;DSYdCTtZviFUzfx~wuJ$aJx-5KDJiX}Qy`aUzn2oqi`%bQc~9)4ucR6Gp=OYToKekZl@j&MxHaB? zPfXDFI^^&d`yJVY^`WFOQslzGsne$CWF-6&3D@tsr{?BrsgqBiF@1*itxUeOuw;(= zmW`W?jg_y-Cpiai)_k8k$4x*Vv8_+$PyQf$V8LN;IREf4Yf*QK$J*{G>pYZ_asA=k zowxVcso#D-XBP02EnO=RomVxrC5N6!wcv)c||-}Uv;qkp!-o!vV!I=iiv zormy*XOHGt%e(!vIu8Yd9T=XjhdHlKOHQ`BF#vYk!CBpdPMFobIlQ%}9rDZUn|kWU z+|;u#73o>u?(t9;(t_SpKhv?=4-d8$9s26%(fg9X|G8~_7uSbP)~+6=y=Q4hkFV_d zE?-9HA*S6bd_!-y4)%Dga5t(r*=xBnJQx>Gou}<-@ai zA5z{6`Fm|E`QKOyY`6BoF1Pd?2p>3PTNiYr-MxHq#zFAPyU{dbIvEe^iKF~8L z!#-?h%sy;Gc2@YZ8?ErOH{Bp0ksEhYirk* z@WGzV)`6b=8#;PYa<1*Ma#kK@SprShckQ#TJraZ+SuPu8p*=6Otr2dy+q;>6Z71+C zpO3f<`LvNDwfmpY`*GMlygj_Hhw*Hb zxhP{-&k(!(&^vt0HRG0^t(rgku$6;!!?Sxn#0OvhWW9#A+Sxq|cFUtql!JA>6mc$r zpSIhXjk1JS9%kK|I%RnlAkFr)4(PhR>uKmpTG@HXoAXFd66%6+*$2Kr-31{#5w^P& zJVPT*l?^#-mbLiQ^RAxDP>-9ToBB3q0f$a0Xj67WrTQd&Qk3Mxv&o=n&jOVof3iv(ZzY=~W{;S~k!q5KBep+Ph z@_ECTb+fM*WbEn*55m*b&}HY$?qb{N9NcMpt;;a3RG>dz-GlM)34|RkKs|3q8~8X! z9k!=merS8nz8-JRWnFegdC!#@FZ5iIu@y3?@23321x=`@oC;jezi;Q{9aiDXFy1c0 z*x7mLA4iYAj4=xK&Fk`F3`2gHheMsKIuD`0eyC7pw8;;>K&(|h^Z_w1X(Nm9oT+r*JkUv9*!*> zXOgT=b*Z(__kS`cw!^NN7Y-qB6Wcj2tz`Z?4}}k0d-#)Uo;t#|oTB?d-eL47q`3%v zWS_2&pwt8HZ&}Nb$5~yQAWOU8TYO!cAkRL*v4Q^0$S2DJyY!k%|0Dg1ee6J0*ZXfD zJ^G>Lv#h^BkZTiO6R(zzu8Nlp)G>m}^M5T=(*KDlVAc!rZ8_28gQDi+A6LaO21g zpl=2)1Q6O|0rc&30|*br0_fZ41`r-X8+27IL#yN)KawJnH@_5kFm4c7Gzu*0VCjtb zq7D$TA8&QBtRuLVSWMZOx?GD1roiPL^c5jZ+gfarhc~7vrlEow9>Zl@6@)Ha%tnQ_ zWsz20K`^Q-v}!Ky5rcp=yTqU^)3q%t2y1b7usi69K$UGRBdo*) zA-jVcE*u=dCzL>)j!ZkQzy-b}r1u|K6S0(7Z<^>U;ju2xy$VbU(BDsZ4#W51LU<1G zATHZlLSVzTtx5vRO9@l0^g}}b5Tr{E-VAD!)MmJ$?tTgLi}3$dZX|w8KYQC=T<8>k zK~_G|xhm(`53Fo(x#97J>wOmW_69C(4thRu3A=-yAZipLo(_64TtaowGs7jk9rTpB zgs+31wJzcBpr_p>0v+_+<`TgUdhT`!tAn2VUBd2o61Dv-F7{{C>P%h1Wu`gltn2~r zAzV7g^gQblb_YHCUBc5r&l@hGI_T+g32#R(n&T{7%DO;x6u`60B|IJUtiyz;n1b94_RoskJbSnr z$kfLVXFjk2>}JViXpj%DJh~FhNI16_nL5gzHiU|ng_ehwLhoRRN2Wn=2nFdGdi56D zq7c5y46l~Qqj=lF^+ax%jWRpTt}YxDL=y52a(JxZAV$Or9%8{q#>r4X$ePD;kWJkenlN`#5Je!)HI7*V7;X_zF0M>NJEZ&T8cPv&mw zDLTVBj&0h)G|8`z)i-lED{y+e2!?fXoaM^o!tD6E_C(GZ{ILV^|I=n_e1s%^ldvrH zco29R2+wFAx(wQAJ{<4eaFQ%v5y0ODiJ(2x9~cEsJvcVLS{oP-;$jl~YHbkvla_A- zoTN-GoqRj|QFy)fRDbAnc&tz%Tsu?-*JCA30tCD%+W|17Z_B6*dH@=&Ueuj2i2f( znPWiC<$J_~3P2`LjgeU(A7R|NKSpSHB2xXFaThQn;awoVj+2itPmDXCueOAL4{|X> zi#K3Q2yca|bK=7D&65k>9}=#U2)650pX6M7Ra4y<5LIhEN}DZUU7$FM>? zqQeelz!m-86olKmRH#sgpRdC&XL#s-xGJL~BtRe}AqfJ4HX#X+At5mfi-U@Qii``cqvM9-GN`C1>IiPAsJJuk z`-Dw#$8Fr@d(W+N)181b^FQDJ@sRW0_uN}|zvnJpOB4y6EJ3}D@4n64D!)b-=>D&mJ=sXLVD#&!F1#*b90dlCb88X9p5i-;H8giJ^qYI3vGZJ#R za}s2>vl24LxfXJS^DyK{=Y7ag&i9bVIDQ)y?hJ(-?Tm*U*RN+_LSYLymWHA#dtOR!}%Aa>3j$2 zb$qa$mV?O>%{&~ki!&M0c4k95P90=|b2emGX9Hw6=O)PR&Oadi&MwG+^FCw`=MZF1 z$LL1QoC2BT90%FUDTeIroC2BbG(x60^t@Kk`3qzp=T^v&vkfxUc@eU&vlp_T^9^L! z@xo&FcltpNaE^f-=uCu6bG!Uv+(KlCZeC|LbeeMpq;PJ8^f)^qb>|~U!}$f$bdvp4 z)^U)QQv>O9mP2-Nu7R|j?U0W17G#3+9b{LhM}W$j4cXl(g7iC!Ap_2(kUg9mA$vNH zLnbH*~1~SDdfedQN)P@4f0z-W6tcOZCmqL1+Yak8hR!E<7 zH>BU$1{rpCLXLM{hFm3_Hwioret*Gw-uZ&S=X?)v+=ySMh)v7!12tzjq;QHMJx(p8 z?yQA0oXa6i=VnN+vlY^E9*6X~b@_H8D1;kX@XMA;&u#A(7n&CAjg{;Skx-KNQYqP->0`R5-mLJx(U1<>W&8oKnax z&Z&^L=KB-IWJ(g|(hJPQ;5pDu!=N*hv|uF;A*H+5m|!*Bw_#YB$&JAl3-Cqc6eV<1Z9Uz2veV?Zk9f-G8 zt?xq*_Q(s<@FuJEeeeUJO9u&|ukUk6(ZND^*7u<|fylrS{06yR3(Z0)W+906$CPP+ zG1f`JbyRF*%9^PKuYr3oxn~(cdhlrkxo7)=qT5`wR)FmwIE_f?ov5`**rQ~`yL zCI>%-dkVSdg@W{kk_vLq4+m4=K9}58X~7|IldZC<(}US?(;CHEkQqDyZkg_)>|nlf z*N)PB-4Gx(2yq2s_ihlWRIm-?K2M}l-@cjL=Zn-65QZMp@~#(M?gd(gZz;TeCD8Z% z3W`t^E_yJ_n(o698_)MqXf+w2}1QC4klnVN*VAO zFu=Y%#5!;?JUzoinp_1gXGFgI&md}4W6Dw2LO71%W9%H zU|aNImKM1^RnzD(M18DPDk8Kbr3I;ef;CG-4h+G$9W?rh)?5+!6pRwo$6ND6S}P)Rz-Z9v)2($PQma_Gb%BVqf|Vja`W$P6h@1zO zKzW&KT_qxygZ+6RSk&4mB3FUUrI7Qin?>aBU@~Ww)+P~oG{!cI$m?K>DC81ri-`ON zMwP5LTla}bVg{@P)nJSDposKStkrs0M23Q0hj!DKT02B!tYXWoogy+xvE|k-5t$Aq z<2>DZK}0H*-%4w@NUu}uOv@1cUK8nb->{7KEGYUyaj8!IiY#UIoqe}*Ce#Wbb3017`8rzpjRP;`f)UMVhuq8k)vD#gW6bcN!t zO0fZo1SoD$ic6qyptwgVE``E|;$@|{42mvLe5e$cL*aws7p1rY3JZ#!!?($Wt4&1SP;95QM?^kW>?v!nhq5O7R2QfSpd)4|_XhXZqsV+kEY0%Z zr;461wR#3fJ;*j9nOJ-e{xm4Bm~C1saK!*Di}X3BW?cm1B!~H2)3B}qk#^)1(`Wr1 zOI^>0>5xv$t7+C`{iQ1#iOc#;Mz!nm#H#0@#CNLTK5;I#w?pLhA93vvnDAs6> z7m>FWJI%yi*cUHxVx;>v!RyzNEz&fFu7sz9>~$&b@+&lW!6seE2}}3T zn=zoUo((+?k0BKF)Gh-7c-bZm3mLSp=6f5ygWrQboT!IQ>rS}nIeopqsYUJwp@;SL z0j4G*+m+WqQwu~MQw(Q*J>*;~FB@cPJtHr}FG|-9Hnqga8;V6teM~qD6n$45@O0@3w0x=Sp*l#atRx@3D!}_bNV-T(vL?atEi?j8-diVwXjol~ zaFSu|1fls_3`p`>)D5Uti?k%aYz0XMCnd{@zl^R)PYPSF;TmdOF*GSnOQpUs1sbu# z<1-P&v?09rLX$0yNwT7FG|-jDBIy>88;DFm(x-#mM~4k$Inf1)jXCcBeCUR-1)O*&@RUdkM?@$1Fl??DL1^tl()sE&P>64w(#(0y>gLj19go}M5 zJIT5M4$7FwLHVg?Q&2G?$8Y1WVWW6o2@=2(Jw_hT^wSWpEc~jtemY+B(lh4idPbae9~N)jv*NA$@ObN<6K~x|!n%7A z)7ey%QLyed$lr+^1MA)mga)yGtQoTUfXEqPG)(<)5LvF{%rxsbMaG(gEP4iB&bG(n zClT*usTex?o!;0)bvF*28xcm@;4R*CYdMIF_a1MiMNh~}Q+=;D+qy=Pt=>@9y~xzz9XjD`mj z0wVMFv=?i)wv5vie+Il;TgH0DcY$|p%eY$cXTcNNGVW0PIdG>f<3Yur2e;cYo>Ke; z@Gfl`Zz%pExUVhapyDrqTWuM?DgH9Jw=JU!+DGPZH@MlBk*N4T!Hu?z!HT~EuD4~J zp!locp0yzYeaoWwa>%26(^y8EX}P6TI*KxJ}`On(tFI)!?_Wvim{k zKj_vjgmtH2U9;X-c8m8)?xUNoz#ETLsnPpt|ajoMOH76r_lv; z!&qr~`oV#qx@qjNP63e{v_#{OMUU9aJzsC*Tk8d^MI}i#ey~0T*_DoKQjA|B9&FBD zA%gqZL}ZNGs`WPv5t$9BuGGCxVN z(~N^Cqhd|QCumW{nvKsyH}Ya-n%Y zMRy#pr|4D+9NRD|b-WxiX8!u?Sezrcw1orE<=amR2I>jccw8e71BRmiPY02!`wTrX zwz|*6V3-XbS=?b54D}!~w&8l%I*SO|&jLNo`ZI{!1WeV_t;<0^rRYqLLX44j*^DRPp2qUL)PQKe*(%I+7W)e_~$4r{?w z=qLiazY(O@b4d39ucm*GD`X{k+$GRW@Dz`Eyv69B+4^kVqSd#Y$4^Fu(Mco|{Pu_- zvQ%?WElDwwX!VVeWGfOQAuB6J!q%}dl4hNt$XrxQL5yI1MD^&q8unxG6X?R5guYg{ znh`>d*K?^I6**5|6=^p%c)h5I9Wh<0V~2Ac0!j<>7k!k7YyzWqb?8^=*zY_H%OG3q zYJHrDs9$XLzv|<$8-=NqcH|m8UqqfpNZHWW>61m|pJ4L%=?1+>MDlU?L+|I)H|nM6 z*I?4(+^AQG$jOTRO`jzq^TDJYyh)!cBFn-4fj|8geV&Mv3}SYxUM(W0f<2W6zuWXh zB2o`VKile?^*ZcuagFSocj=8HvK4+ZXIu0Z5qS(u_NROF<#870eto5gysSb#psx~< ze<}74eXWRmq}YS{IuZFwv2FNNL*!S*w(A>2q&wO}ruUG3xrn4G_ON~xth8cJ=+}zK zc*UO7H;VL=!DP;M>aa~Wi}XgNcm|5TP_!GXT~MUnjMFoOkiGsn{T30qTe0W$TX}oI zt2W;gXi@VS2=AR}nQ>yJZEfX-7H8O+^(cs3$)05!7VT~%IotMG^u88J*4POaohnLl zj_tQzgwIaICf3=B)~||OU?*E$p_M)t*&(Yp2vvu;#12~n6}ik#vvNSFz~Tx!J>z&q zuEHHD{W3Gusg<}Iyl-a49OeI4@YGDJ5uA!HuC<3*s}#A;&ay5Bk(s=~&bDp=p|eME zyFE(tJqu>O1mWF_{Q5}@(uKHFTc^&&2Evz$ z*iGtj-eVy`;^VkG8$Q88^Iar&9_8S3uVMWJLW@T6mDgwap_Sy{-UO>3h^&mmUcaR} zu<%-mRzwB!S;?C30^{UW8eP@#g&9A3PsA8hg%d ziNU?VB#b=gj^yAMa0khKXDB#nAjf}qIA|cv@6kD(d(wg-xaplE&ertcEr>_v;r`4Z zz4t}B|B)TM8P_Ibec^0Fo1K9`=4y!0g%EF2vZGR-1td5JW2N{+3tpy5@wpMa7Vhl` z?tJOfe2-BKJ1K^jA+}Krqf>4LjB>sX-iVNYLVC`(TJUG!EK2v^M$mx2)c@cM_E7Gh z5`z7d`xk$32;9{a{?{(IE5)I0SQi1kTNe5Yte#_!!0}LQX@D3{@0^( zIm^)%o}-Ijhe)N1i&ByRKIf0Yr*VNypMGo#*v)%-uS;^@s3~LX_ABiLhpY-_xGw7uM)TbS9-?;`HB%PLQWnaBRRtqJS+E+nU^K-!3sJDw z;4t5&tM)_8p{r(jivS5uP*}s^NTOE6-H_H8kfB8SqF@t1jwKQnsLvo=Zds^`!z47{ za3}|``}mFlVr2=m$OuN@ zmfZ&ThIB~*!LNzG;BvQwl(TRGx}@d{KxS4UfD;Z4g!?ISmZWR}7|vzE+kvtiS0F6C zFlj)z7*aMOw`4iEN#oc@FHjl~b_aGX+_8b~nsK+~>6f@TpQ}JQrt9Dw=DVrgpHk9% zTOr+8<5PXMLnw~mgN{Kp-PO~U^BpEmyEvDJwxWhFL9aEI`e;fF4T6^(FjxDA z!WoxM+O&mfT_2VWPxG5Bl;$I)Zx+1GQy{#zpyMQni{qwFycb+fofpAdT!N|dDg==; z@TFdKyvv|Yy#Zo5)Z%=vn<)Km8m4t%SWbv^tDakla#nOF#24Y+mn@X;O}M;+QMhFN zC0#BAct|a&bgR0KYH6WvCh=lMTxo{YQ%MP(N7(((Q%&t zrS8Ty@*$|juWoV_dXzR|CsYYZG67ju-;Jmh?~viNq$}`RemF=kCZZ38Kq#b`gg!)v zvC?NUmS1#WD}4&R3EKag&u0G4*AD;3&oSarq`B>nBMqakx#N?z_*C>Teqbo8>UTa` zI5#eVx$1k5bLY3#;&bdBzEX%!kJi^z&aWM|babV9`Y9TF+(~^kR+FC_#V6yN+)tmj z;;l9d@ik{W)r2oP&Z@{Qn-ncBDK1d%{DM5?EGeys5>>BX;ujpbA1myv#Vc-d%gSgwU#D&cTjthG8aWN%gf4MeDPt}zD9bA-meF)lMJMNI6h}>Sm5Kr_5Y5XiDw>d+H#J&->Yh+k zSU%aU)0jtIQ6XZC#ud7ttgNJrD*lK-6AOzf3d*9TWd*VLjvDYkq=ssitr{OW>7vvk z9V06%$Sa_#?~oN%MoUZFt`i@REXh%?;!^(Ci)WS>$j-Gdv5UA#Y{~Y3XGQ#asTu?Eyq-<(jn|4fugUQ^)+Pz~KE^%?e zObiWKuZ6|vLd6w@xjZam72n=1N-9e7N{W6r-ICIR;_~vMXi-USeiW9fELX*i$}OBY zJDOKeR#DzDA4j={v-aPw!DyLSQZ`K`La~#VqB2EB*7!N=kpnKW}mYT0b{0ub{jyw9;>K#k5Wxgu0?T_Bxq_a>PYL zuCRDwNypqwLK~k%^J9mWmw7Cm)+uaU-Tj_jS3ObL5jH&k#g3Ha&Wx7L>X-%6xhsqg zIV1J&m~!&U&Buc6$cUsmN|VHqer2mw^VZ*pN#zMJ*vNrk!5 z(%iBms@)Ak@$$MZHV9}0sfN$3sL0Km+_5AxP}6cb+Wxl4rkcv;h9%9~wDL*OiA5zd zqce(Wv|}mJu5p(w?Gza*m{cO|K`ab)aLP@4D5{nYiiwC;E|MyWu;!|WPAI?>QlK#_ znX2WpGp`K2v#6-Vol#~>GljveLc+Ve>?95or=-r)i6WWYiW%i`T39$3E7VFXE!pW{ z3gc8V{(M^L$AYP`QBjyTwV*>n(oDyN>|D@1>Y-Q&%0jh=gEBtDGs*aN%$ge_dQ#cM z+3{C(Om1ehn2fKqA#tHP=b?Ni*J)fq%gf^PrE0%DB(DN!l8CE)cpq8&P{tPqv~yuN z1hu8grHU!Oo+(RlwE}uXL~e)+ ztEdReN4bZKE22C5xM9%uO0mzN(z{DGX>z!n@yn!+s%UQU?5JE}#ThaVqP*hf^!P|i zvG2l43nm#GCRj-9FXQsYz7^89981old*+v*p*nh^ad~NqXi@A6ce3G3O)Q#GJ{jvF zxt;Fhhak{nuT`2mTQ0(Rp5jaMa*Jt*&Z3&^v?+|wT+ZZ^<0%ilC}!mLNhaREu>9zH zm4}YmSK5v_!#qecJ}=(lV`rao7`wR2Wi9$Et-a%YigTx-{Bc+DSxD#C%%};c2y0=? zEE?g=+%oJL;3&qtl84rW)14dP$S;^M17{g<$)c_lNjfT3K~H7s;rm(#43PRm#073VB!$W~x`QUU`gy}8ML&znc-wA@+InOM$Y z2AxodwHQUrS02p^eRsl)iP6%TWg}!z^wtiX7P-+PthtJ$_q2j(af}Y4+|pDwEsWwt zLN&{AY(uRi`w7<9R3+_n0@m7P?#kZvr(zZs&xmc+Ty^_u*QKRub-`2}3&aAG^~-e^ zmvPGYrR9-oS;t379My~1;&MHC1g3A;AM6Erl)8~|r4~*q#_}OLtE4PCEw_BCY}aK? zwJkMxTXaK9Lsdf^#Wl0Mq%`k{BwejEyc5gNZDS$bs)}~f7MGNl7UV^v(`HD6z>zAO z=u%Z%%&4-ct1YXU-`r5OxTXb%j8zTQHOA_8Ez4?ZmP8kz z(9N}{*F=#*)52!N5nWVMSB-jd5uDxxPh6sU0ai_QlnTqiqDw35YOB@7%-~nq*jR%X ziOU04vbFJ1Y4>+~TMY6?Yg}Swh7#FrI(ppimBS%ot7e!@l_o zPT^3kupy|(#)f9ijbBCIw44$r{i2qZMk-$;whJ}dqUxroTQkTndRc8tEjrnv$|cp! zi|{5ixSAJ5=T|n@96JiW(NHCnZ@8pp*{JR z+q?+fts3byYjk|8EowlRhNjwu=q&9+yuPMoQA4#>yP&eFM!iOj-tteq9TCJuDI0J} z&9W%k#7%Dj-dslIiq%Sc6;t)dI&_0jEx|<S4f&wG(7Rk8 z3P){$Ypd!SQ2OSY8hj+6wW+tuprsQ12EE^XV?R3F!i5-{)%d~$4N=#h zhYbxFcQ{qyOA0(-DVAofx|YV$3N&hSZ8a5(Ueb?1l%o4H0(}DlBTTDrt!t?T!DkNW z9eEh@vZ9)5U|5=4qUr~O&PV?km?}IEkvL6LO?@Rg0ETs^FmW0V6Qvx5li>dRQDj^rx(cqTQoll{6qsb$TS(N?Nl#;9w4!K(3l&l0jjG!e-Dk5V2*NrO~Q7L63RYEezqVv4L0 zpPay?!WE=qr*Wm#S2i!!Wa!4q6?F}j)%51Tjtc6@6f8<(*PWQOrsk#ehi=w{lF|es z`z?AQKK_8D5y=9SmM(2=Sun;Oq8Q8Wq$^uCz65drl6NEeE9M`vGbl=Jb96o^`VVR% zdU{P$Lv%^Q5)5AamM3i%!cfl8P;Lh!JBF@ZRaaBFg!6!kcguw<+_B}BmJK@%J9OD4 zEwxKpE9EarXuIZGG_%&Q3^}Tl^Np;@s4NL=cMZl@oTjn9ssWT8JF-clAX%T zGYK_Ee8bTU)PcK0gj!D4BSnEGshltH=^2TQ z4Rv)eB`Ou!N#%HQ&9|Jb$b?IecvG&rr78m1I5(7QNl*x!IME_PcFpS6`uY{_7e*)- zG;C?j)NWX-(af}DptKqr8tPQ^pl*CTzqDZX$9iTlRvL|%Feo0bt|)$0jlzVYM6|hezVs(`Q_UaoTP3{weBt!%|_lkQ5xy@*D;Rxj5`vSwXpOxxH%(-S(a zR<*FUX30_vVCv<~8Voj8Y?KK#KStdcRRBcXR2i*Duc6`Ej1dNNhCYsNwXjz8CatOx z{Rx8*D<{kvGJDdbxca7=)@Cx991MMhR$a8xbp2(V^)=PCl})us!kw_&Gvt;_mOxsP zxGKP=4DCpBn}%<{V7=g0FB@=b{yN!XXiWtZQXO?CeN|N0Z&;N1FpF-hFp-N{svfNS zV5%{k=_h8n&Y~43ja@culA;G8W&Hl%ZegW5zD}_m;SC0AS5CmtEN#%#nx>h|ob++G zA#NvVZmz>Dxm;6|UK4B%W}7Nh5zLm`q;efj0kKTMDy+2yFNj^DRn=hDZmy|9eJ!o2 z)0Q8TeVi0nbh=2PNehcoQ{%eG>bov1=9a;Pd65I7skM>TzwQc!thBrGt zGCqpM@dtLp$jK2(t){67qZ#Yo_FPcr(SU9RP~N3ewjk-+7wT>Z)!E34rdqe~(q76K z&_`uJHRZWVOk%E@K2pX``bHLwC|V~_DDvu9Jf(H3MYc)o;LUA93c?+W1_hOwYTxZ# z(TOvP^JLtyz8CYwx}p&)78;`1Uy!?MzPneJI$|)Lm8fTxtyqjCedkc}AHyi6(X-1K5X}~3?lrUP5 zC3)5%eXFrPksns$g{5qO4&mgMNgkuj$F2$UqI)$>C2kSaDFH3gu-uBTC6`|K9|AvVaHX2Il9VS%A)&Hgjgif!d}i8Rh4Lt zTJ+*5tvTd9Y&3b(QVK(?iE4jYE!G$?D_GXyq@Y?`h(9c^u+*t;sORk+?Th8^gxZUB zv@B?DtXzhh;3&LYg2u0A?wRPBysacuMBBIp|OWcmU5XFgBR#m~8q9(C)!pb;4 zq-+DKZdyI6s)rj5+u|gbL3a-WF%8Odg;BIZG$$Uu%!KvPOb!Esj6y-sb%&s2CFo8%ODR&`22%3?x~5|N?;?1b1IBlT4`ci zAvgb61ImokjKxkm4u~s&Y$TWSft*X|imFAeOBTl_bY2CMJ(WjfbVfi`PMgU(^eCJ^ z;23R$+)l`|Q=COCY{F?64pkcDXc>WC2y>4y-Pl~yTHWBTD|r?`ZNTZhZWQ=yg zn6hdcmmbS~7V~2h?H;1&4Q?++S=>|Gs`)hO(5lJZgph&4IvJZ_d6s|{p)*xkgK-M9 zPZdr#+;(0DYk{L@Iv1v?3Pu5YX15)|cp^rH$n$u`r5&5!fWmQ3VxPTqcN0pD>ZwI) z*qpn~iEaQZD~BD`8l6{TeTC7$47P~|hgRiI@a}}p!$YgBX@M&d z=|lsO&p+gpKwB0ZNTEK^4`^fKp18=98C8Al^FB6F?bb?K97Kj6Byb$03P5L9?trds zsjqD0jxLj+p8)8tk?8ydWOon~J{7TqYNW}%znXt#aAzvl24F!!=WhjANMdH~SsBYesZ=M()7XG?T!h^=nTf(2xwkcie$ z$$RIhoHgBTa@;b5EEFqood5sm=K0*?a1X!yA`3e_uWjY}L>Estt-J7x zfTssuTacvn){{kw2zvU80b;Pgo2j(J_-AN%Gs4Pl33w_)qo=IYKYBNGez)*N;?JJ* z^>xO1=DFT;thK)UZrOM)2+xcd+Fc$zF(Aax-MSJ8T!=sMe|0-Q?$sZTWy|8>xQ)KP zVabYyW;s5F$K9(xT-~cbyu)4k#D-I&{oln2;Y|dIljnv-tkN&^}+LZ<+1`%RA;$pct$JP~5>Hj6FMH-?y z9dp701UBGAbgoO)*Ic*0=5l?_t*cvFKNq3qR@GsOnVW;|oRu?|TVXDYHHJT8z{6EA z4DuWb484);p&K)0PkA7JxTHN%&G2X@a)f7op3#KqvDbU`EoW^v6TJFQnx{pW{sC>o*jwX?xe0UDrrw2u>R+-84S3sY1R~)A!G@(hj;2DGDyl4Gwdxg6W5sC^m9-My3FTA z7VkUbYyAb!6rg8}@anI4rkH{A%x(|K5R|Ir`_K$dHmxGlUt*5d{fHEW)*DuvNg#Uj z6tj!ob&A(gJ_@2c ztIa+LZ%r{%R+~M&`t4`pf|t*PM!!c)p^_qm%CT>=X(9q$zv-;)Uj2r%$VdNDo8r|k zIcthJf}GGiY>q&TXsY>N%PYH}c75Kj%`Qmuf0x_!+Yx`jt3NKN#*e6!fZlbrEb8FZ zX69;hj4VSEayM)m)l%wIv+G(jX`&fKk0>&G$y)4PWDZ2h`%rC7H4y_GREx=IjGNJ4 zf?oX~3Ox*AdU(+f&Nh?IHG4f|CgIIj=bHK>xFq076EfLh6y_n>@B^tYp|vKPN$bpB zYfRr%GikEvTWcEUc=fN&n4(`yE$h|$`1Z>R8R9+P)KJT3tTq$9`g+}yjwl~S+e|UL zqxq1Z|K#u%n}c=qsgVet?9~@eF(YftAv&%ZsMk(0vkQr=Hv6I62+_-{FQCRmtifV4 zd6n7y8#8&T>@9}3&~3j45V6ul^9i`=%l?2dVa4WBT|Yco}##I35F({wIPr#_>$>mEd@=Q~D1CzX)zTRw#K8{3^I|1fPJJjD|Gr_;<6_YV)F#xa=pBf{g=4{`r=S&EoK*Sg0DT)M24m`c}@ zw0n_X_0JE-i;4h=@9M;BP#*P<{IBlB^-l4PSd#d zq`Kpm5LwsgjYxROq101LedYI0UbDU|z-;Wn9L%n(@z!moWZ?@p{Hv7&j9l zod=jd&Pe0UgUq}_2&4E0>-R7}!2A&NZlj-Z|HO#bddc)IX2i?9B)^97M#jyI z_cK1k_&6ikCo0G5jPEk;Vf={kbH;BN=~FOt-C;%(_KCQ|7+~zpn94YiaR}pZ#$y~B%NWmKT*G)i?qmFz@k_?<7=LCIu=7-(7Gqb&o{TAs{TK%^W-#V3j%NG=V;*B6V+rF7 zM!b_-rd!Flkg=YTJ~Ku6TETc05N&7G{4gIV;RRY;yn^lU&L6(IE(RA z#%jhtGBz?UWn9U)nvv#lO79{@`m`YN8yM;9ip1|?ypM4^;||8B8R;{N6#f-P`qCot z4;c3|;#rP5F^$9o#vY8xjC~o?7>6=uGmd7=V=Q7UW1Pi!Dq}U{9~m1NS2C_;+`xD( z<0eL0FH*jDFuuS@>qXMj`jGG&Mi16$!~=}9jw3#t@dU;)#@UROjP;Bw7|&t6gz-AY z+ZgX>e4Oz`#M^!*q!7)LXn$XLoaoAFG>KQrFMxRvou#x};! z8EveQDZL(ysf_e_FVc@>%x5fSoWoelxQy`}M*0jGU4J9v-HeYgKF|0z<426&G18iy zt`9KwV;shKJYyl_OvW0&bW{9E5^f&e(Vh>U;PZ+4< zwD+R)yD|nDBaFu|p2%3lIGb?+V>9C_#tRw$%J_H2`xqZ*e2MWr#!nc3VDw^7Ncl@- zOlKUycp@WxgN?$?W?aD7%y>5A#f;Z6-odzy@fpU~8TT=M#dw&p2ll9xUSGx>#<7f( z7%Lbn8JihTXFP{-1LI#9A7Xrh@g2tfj9)PxX6%Z+GUcZa;}FKtjE#)T8P_mwV7!{~ zRz~^)9L2YT@kPdW7(ZhCkBI&tg2DaWdl!#`%m_F}}p;;4DJM$Jn27 zIO7<`0>(1NC?kDXj;>$9crN2*j2jv6WZcg94C8Bzdl zM*hFO#PG>xoaWUg^#&Z}iW!%Vk7vsZ> z&oREm_#xxBjC7_W^TpVgF_UpD<7CE@7^@kZ7*{b~#CR>^?TimHKF#t}GX9J47e)hhLiy^-7-Wnvj$+JZEM}a;xQMZp zaW&EC)Va6=Rag0+KXE82dY++o@xPkF{#?6e| z8Fw+h!MLCCYeo%cr<9*=j3LIMjAIxlGFC9oXQcPk)Aef^uVB21aTnu189!kBl<@~f zGtBkE*pD%j@i@kbjOC2;7#kT^F>YYIj`4QJe=xqx_!i><#;+LlsgHyoB*_#$AlN8Q)_($oMTI{lG-^n!uRMn8ujRIF4~LV+G?p#yZCH7%yVH zlJRehcQHQ8xSR1U#{Gdj4K&0WxSg4M#eiC z>6PS^&dZE%Fn+-J38Oj44VS=}#5jO)I3vB|o#NZXcsJue7@uVPfbjt17mPnM`Ubo4 z%wU|$Sk2hTcs3(_pMcWcz<4d=os5q#?qsBI+fewo822-N#n>a_`lm9cF=jG$Pj~(M zF`mk}kg9OA|wVjRmjpRu0tbjI@-|H^m|@8UM|g zG1QGemvKJh3dRc<|HgO+QPleLmj_USDnP19K&2rqPDGT@CQ*d)e74g4>EsDw~3Zl{fC9teVS!CR= zRuf+Zd_V6|Z}_A-Im+FkT(k6QivMzF8&x~*{nfIXSJV@ByjPTOE#*5$-A2kfj$12h zjB<=tj$@T0=NRQ`cjSyxs&+@tNTnL7rB!FOvz!r1KSE2Z%xY&jIZB^H;lY|3WY<6; zazLX|dE+PU&R#}OG*&g@skx@?_G_{!vTXG7|Lxxaf!~+og8p(jY!1eT`Uh|M562`L zxxFsMtEM~tGnghLQ0H)TZ-V-#!X+Y5oLWm*j(Y~6!*)sLhr;>rw-_kMHIc?)?-LpNT&e-%ThRf8?aUA&e@WO}2Z_g$k$A z#dOdi-TRR4c<3ly%BMYwsE6AI-fzwtPyXd9|R#r#f(D!%@{ML7;(Z$#z55n+2dD&eO1R1XWEfN$mu zhl2l+AN}E&phLL1^_q4Phaphm9%Q%jx)+x^Y z&G8#`q-E|qeE1U`x-Hl2*rRP&b-=)%4}S^xqr42$X6$?G@L@Z9W5HfqJ9!_veN=e2EFwd26qTQ=^Y>#y8=N86!|JNCSc_%d;grp@SyBljTE+DDwr<=NujeE?;{ zh?~9-HqX8XoZKmJ@80;t9&FP;QE3g7X+0s+x`)%EI&#x`V$Xd@%hs+xxO?6cd&I`+ zd$lc3?)A=_-extvio86rNAusdSNKoci(cJRo2T_WgnUyy@1FM(!k>ij&+MgeR356A z`}{i&c(YG#v$Ef9!_OE)Ro?%K@|*BS^?u?7Qdu-@ zzj2R0eD(oj-o`zN*}%q)d$yFGeP9*h3jzBg&P_lKe+K>%@V6Czl+VrnwFlDuYxgFX z-g>}S`u79B9X|Z2&`S3W!iR|j;@(`k_JD!Bk{(~!+1C|yzg2tf!0zxfdxW-X?^bQ+ zf!*3pq1!X^Ky;52gQ;V&*G5fFpA^)&Tv{@#7M z1;h*(H%}InJ-p+S|1u#(?>5#s-if3X_B;{8MIVJ5+zNY=3MDr+PjA=15at!8Cq}%3 zHPTt#CHT_db%NvIqArFg?5THi9K>OwJ<{P5!l1<0q6<EdnLPWgrL9bVW+ZhDL)YQkEQtzMGPiDspFj3nfMLS!Bz%QLLEP_?ODhmaUQ_=k_o z;$MO`g8=_-azPsdl(XO=1Q4e*U^OQ4hMn8W5r3InlIDO4{y2@!LZoJ@&DXx?KQi*kzEWJs;Am`F=o1 z%aE7fNxmM(W7GYuntdUpu&;;oXwn~c3jP6)y-Kfh{{iX$F8SLArUu=^m(FcpwJd+kOl(+5QwV#qN&vPtZOQvX6Z-WXN6)nQCu<>}%f! z+0Why8Mfbt>~GUOGz0A3XvBf|1|d45JqdDZN64Ob3Nnyr=RhXelOTK9r$F|$mq8}m7ec1ke}@dZ z`88p34E?JFdoOgF{Vk-htsa!$R7l;|vKc_O$6I>O}iO$Rv9+WH0-9$lmrI z$YlFB$P~LzBDGBpWFNZ(GGs4?OtsH~>}y{R+0VWMGHh>y>~B90Il%q^a-jVyWSX6V zUCAJOB;;Vb1TtbThD^85ha6(x3OUsNCuD}bA2QSa5ptLv!q2Q(_BhDl_FTwpdnII! zeKq6=`%cJ_HvLpP%6)q1R>(it zyC6@nKZQKerrVUq+o_Pb_DIMH_B6;mdnshT{TIjr`yR-N_EV6P?6)8%+dn`S+6kDM zrr3QUr`jVSi|nb8)9g8r#dZs1iG40)sZBp%PPgxcEVG}2EVo~QtgydcSM(h%4)iws>!$(lxjdcKoyciwMzfQBc5K*17-C}ZJ4w# zdAf=Usq0Ns#w_TP#dJ?gda@|R!(*jd@4-+}`JwQ%V6+kcHpaD-*O8chSy#$hkTMkP ziX?-Q(!I}`^%InR79;Q^F$~?v0STKgnBDB!CE9jlkn?6urESRwCY4C4SttU zER(E85gMyPPO@4=XygEnbF#Hugi2M<jZ6U6-M0pTH1#img>5MBmGkti)O?Laktz zQm&_4>qKacV&&EaB1B)mn~6&D%)xi*LN|hSqrA+ut`ecUC}bEcYHbvud%>zG60CtjF0r@i`ScLMy z?nV=MmRdVRs6w%2)=m+sRBXAmON17K$^L)3^@0ffN%^g`c8k<=6+6?ySC(HBsn;sS zSy1$aVzW}Lf+7`)N0s7iC_+%YsuZiC=mW)jO0fotAQZnS#abv*py-p$nLo!eJiVdF zREl#Eq8Ak7l;S)nlAxHX6ziZ!grYi)<2WCRo=~(Z#d;`uKrvHY@@FUlP%Ko63!v~r zu}mp0grYkX=PAWSP;`UhDy6s>imp)HrxY8YNPuFSQd|Os1I6=7aVZow6dx5o%L@Pg-pvbV#wC)*cbkVNGPn zr>wmq6j1DGYo7@9SL_*UzX%OdY?pOFgvKfMto5M?O$3v9dCvL>!$bM)whm%=DE6xL zvC#UG(JB?5!B${DT%VHpir|^epE0z*?*WnlvH*7&T!%%7hi+-_L-#-6irHp>?qqqp z8}xW&BG4ViNe=V5rV$8%NIPJY9<64K<=iBsWkn8v(z>7&BVY3AXx$U zRGGqS$HXWIVq50m|3sSDcKjay(yp0-vcO;{-QA zbCoReR~{qq9SBVjp07Q=z)v7MyMuh=NeIvlJ?|3v!Q&4t1(EZ@kDh~`(B)ursA>*- z4tYX!r_MrRx;|A8{SB;zm{%`yLJufr>BUZnW_4*BeR`=AdKi9^bWr&(Zvg zpz?Y4c>)9BkOkb2dZ0U%22mOZP!H{qe(3QA=EFy(_Yt0=2-DE{12pC`UlzdfglYJk zOqwQN5x^(H70_HrnquEs1il`0J*O|-{b@mgllJgg@VJY@oa);|;OWr_4;i#C7FF=I zu7&7x3c61?(GxZUS#bHNBVo52Iu;~}$N*Clq2ra;K=kF%c*W98t%sa<*Kxu^z|8-lrk_A%w}+k4XwV3$F~i@>nGO0mvL86OiK;+bPyg69&UxwA^LC>Aum{q^qs|9KiMjEUw-t@p} zATr*2yqSTsK%`x}*P9)EbQGwe)r1iSbJ0|cb$fMXJdhYj*54-^)BY41@AJ_-- zEcyJyJ2`L=Y-hTzADDtGYEpUn=JH30-T0mspp7vs))0TF+;?ID0YfD?N_%86SZE064 z{w#PxTiP9pKL_r#r9G(l^Wb({+Ea?Z0N$l7?G43W1oyS29aQ`!aH}otH^pBD_qL^V zLHo%3?FKj7(h?Q_C%Dm;Hdygj!1cDY6BK_H+|!m;q4;ayqAjgj@z=q%wzL+--vIBo zKW(kzZ-V#TuZ1b`m(eobtRB=jayS@T%zdF|eTWw9^9?pGKM2ncdVp@ibEh#~3%sw$ zPr5Jgy&^yB{&uV7`9)6-9EJ~>8PBhJD9{x<6iGZrQJ@#d@*i0-nIiOhq7wnDF|5S38SR_K6I%%_Tl;#;Mtf`Ya}7P^a!qZ$fq zg+j?nQDa~=oe5S(by{a&{X7Ot)>OUGCPLG|q|s|I_G6Q(Sfhc}ZKGnR83$2D#hQ#y z(4vYp8=r~L-C%OP-ePvbe)A z80tZ!!5yxL180HAd*=)Ew7_*Bav?ocPY>J*@;POvM9&O71tKeVx;`rKGKgFOmg!>x zAArcZtI)>26ty z%)(>BzCVLlMvotHp{y&9yO6jaYW*>fzY5(n+cR4a&_Y(8TAhq~>jy0pUtj=;EZiK_ z&d?Z142+DC+m5V%H>^Ym4rcAImBuEm|!T&ZKTa4!N%L-QAXln6Zn_81NQt8{D~=-yP>a98W& zMCdE{Ndxj%eY}t>L&>hu^RekeNZH=k>61n1Q!sgwbAw(aLZ`x5ZNvQU*{GMIdxJ^C zbE94%LM@8@O`jz~E5W2Wyh)!cLYIO)O4r?@&l92AA$mdiT=wEsnza)x z>U|c%{|s7YoW9Zy&~4Jx(E1s+7I>9gRzJ%&{!er70v=U$u8*%hd-lwb1egp71dKR9 z2oW&^M8I1mBmojaGUUR=#ttC~5D6sa!bMRrf}#}#(c`U1thHLTr?j=!;teZSk6I7b zT3fAc0;ZyEEn2NTZI%D~uKn$qJ(JL$-*e7+p8tMk_Pf4y`PR3-b=|l1rSsx|6>DCd z5=j4z6LL*TS~_pg>5%Oy!So{tVLh5VQZmvGE>fzU$kODRZy1_W>8nGdDRQ2v)8uJ15T!GA#bpxKb3*X~+yJS0o!Jfw*x zsKIIN<|?S+FOC{kr=+P68=1wPrKO((LM!8hFPQE$VAJQ%NH27v1^ijce-l`pb{9@xfUo&=%f1F+ zA05M|!DA?zePTY!Pul++;)h?wsUB@QP&9D~V0K_{?p`H}Kt@+?jBHM)&vga-RVoEyE9{3cyK)MT1b zp#0ZCKD)AcBU<@y$2t6UoYE03FmEE>B~dkjC*#_9M#by#S#K^s1JJrX6o}X3PtxM` z_+l`ZukLfe4ZM^QulHB7a=#1zrL3=4vvc2r`x?4m%gLR9Iyyl2>r>)&{YF9VI{53l zesf0djZPc*)$H6`9rs)3=kAAFw}D^JiP!aSigQ15;`A=a{S@vCsg5J%xhBfT#vJI6 zDF3Z!gyDTS-2-U?r4#=RkQQjqea$Ikr^GR_h4&gL`(QAVlfM8&_k$w!xBIJ!%Wzs(a z(L`c|;Z6TLh)YRi8i90NsH)pYj55-czZNdLHYws5o|OL*cuo@chQtV5ndnC|%D)Rv zABR5wT?uiN{~^#}E>?C@#Hxu`69Nsng+N`fCc9w2K$O606zpv{e7#Kddz`u$eOYi7 zAT2P)NH2vWo3)#bf^i``jl@_KtPaElB*F&tISwwnEL8Cro|JzkJST~JZeoOZS;8w3 z@)no{&Yk!YA#hFZ<3Qa`x2yQraGh6$Z$jKrXb^!5CI$$BExEk!{2h1)u2i|7JL$F} z?x!B5K7@yNk^dQlhhM^}mWk#}oCin?+>m<)P`AGuRqpwY`zCL0A>6vzU>}XZSs*O0 z-$Warjz&(|2B z{1<`tu^;<6+f5o{cWi!76z}NvSZ>GXoaYMJ2U6O^H{d+o|4=NPIVt}EoNcb|Tn{J2 z5(fQ=QI-EMj79xusg>V{wmd!^Cz}qBH@{4u)XImzilDL*~^Q3U%Mnfe(dPcv_J&7XMvM$ezOA=uoF`SW{-!tBgju=|Ri z)7NR=#OW4zo7em7O!*vg3>Sm;L(L&x$qj3t}2>-{-l|$3F!chPpvtcOiy78(^uMobh zPFn!qcMxjs9O7RD_Zig96rMs9(^*KYK~UaPcwiXFJ?(P1JyVh7mh>~d=FREppTM7& zCFZVlJiGv*Z=CMN-G(VtsNN(m48$d>D#ky8e+~Z5@hBXJ@&7sgzjQnW`NkR#)TTc8 z+}b%R7gSb<^G*-zU5vx9(!t%=!}e~*;XH0~d?q$frya2Hj2Y9W&u&;XtDvB1`m9+6 zvm2&Oo4IP{ss=b#&SfpF~w4HKp7n(9|JpSfXHJ*;b7iXGlz_b0&yCM@VyRl_KAw6LhAbV*6Hs<2|d zww4Ruxyx%xVDfx1jpu@dIp}I_bQo?J@u`A=VHj=JLAJ$gA!yjRyriZ?TjgflUXp~1j5Uaon%d>59K zM52Y|D3zU>W)D!AG!CJ6%&)B~jZ{ZVi_1%t?W`^-sfbpW7gjGA;1MmZtQpi(2XwVJ zV`qLCV3E>+9TewqhEsEnlvEX!RA@FyUeN{96nTg(N`8n2y+(^*nSCw{p+}RAq{jlp zQnIViu(w?a``PZ)5@}v(c}+3`@rXV8*M2s!tF_ zJfjiE(sV4k2svn~#ITbm*4Cp7=b}CnG8OaPCkY)Wxo$^uD~oM=+A#@Z-Y_<;8#r2C zVn#X!)C{X&|18Ey1d;lwD5+UmS+$TBt)+PKG_5tw4{3NpM(C zORB(Fv#6}8EUKgp^}+M4jFeQ+23L7yVKEJ|R~0(E#daBOzEvm6I!GE3?O&%sZ<$wF zwaCeY+&N&B&MPe{WT#KeNt#Gu1X7|k7FHBjFMx&jsAEJvp+DG`?O6yEiQ`A*!osA= z7Jg6$Mm^Xkk43GnjYKM|252!-CF(1!D76i<$J$LSs2Clqsxm2~rPZa;BG^EORl9^n zOaDO=%rB{l)+|7ZVhk{eX$p&r(K*V?qw|siic87|4=94B=9felRTh^F9-+Jv!w-2T z=2Tm8k^ra1p*U@Py{cq!ZD|#TyGT{(5)?8@D}hM`jYdi^E>Us1dCF*>90^qbh0H6g zEl+M`Me|D&S;8ZVp>7dO*AJ*DhE>-TmsUiJ3u_7ornAEmrm#WBVW(ZPA0~03)%fC* zhdX1SG_gS#IP>TK6OSmHM4}{mjDWp+vKZSMMW@)7_BOu zzaUxjNT$OU)GSJBAZ&_u-%A=2s%`U%sP1`{iPFr+Qez3{$Ap^KWr!?FitEx{^d!Tn z(-NI=LS4NV`67$AVDtVG(SkF%vDSo*$i8Ub!@CFI!?H1S*+dsmFtO95!%D6N^Q) zBzVjN+v)}2TT{*@YIJT1rjQbcs$8gwC7`GZt+Twm(wE>tWYJTYs!$N{3+F``SV<}G(cOUiC(w1R`L9wS__l4Yn~Dmrx)w7SYIm!thy zOj!jaX&=D@wGU5sVL&DqMq;oo9Vs17Zaq^ZmsUUyU}VQg&6c5Cy$fFN3S^k zIh#SF{PXMw5lzo5l?$Uam7KTA%a^-GSVw$U9JIX%X4UvQOb%8*X>IGO2RdAq73PaZL$I2p7xLhy7Wu6j|iV7>(MVC>Nr5MkX7xEHq+JcMR z8A{iSVi6phWZdDU)r0#xG9-%c_$Eq*d60{2S-iQqOGq^aJC_o~SJvL{kcz@ZD8DP! zN%miHCLC6MP31yd)pOO1t8x|hL3>K}vKdz=MZ{gA8do}q~yIG_WREQ{dYXL3p4%Zu$~?|D^~i<14= zJqPP}@E=qN_}5na^A3$0r!}!YpPXNLX~n_;ekak!qC#8#Dk>2=mXtj;CXwlb>{`W?jGT8eo{286_hAiSd}nmXzeG9uuL!VqNS0f0N(hI7b;fim@!cOt`Kw&&bclh z-djkL2rWUc_3Q~>7C~5k$(0Mnqv}B-=zCANTY>g4STNTN1G(xY!9Z^rh6V=6xH>SP zbY5Y?#8^~Wn^4bO@bLQFUG(aOrIASDoalH(t9h%!)*RQYTtqszvb6Ge*)1!gMYYRn ztIG9-x^252+mkhI!jlKCsq6<(xNzrwdhKo41P@l`RZHvo)nR=~c!UJI&GwdVovMEI zYPGVfaWzuW0B;nnqpEN@=KqUI^h6kq!U$*wc65WKa&5y{GmdVkZ)pY(?2l%<8nEx4 zZ6?_kMA6)IXZvO(>}YO;)ptf^q?oMQFfwgh(`QX%JFIcHZB||S!H=q6qqGt6jUCO3 zd$Z{iEq>FGbQgptrh=z__n%|yiYj2REL zpRgftHkq`L2}NQg?okN4=p7x+tJlK}bzGZN2hBE1wql;R9fq1WQCoI~PJZp1D2+B& zjp}K`eU&C{hFmHU=AD~iYPq?-B}%K*9c${>Ho?`gCc3h|qiN<0gwkF&EwkFz#G|(L zaR|0X8wj^e$HP{1{koMcG#k#E>R6-d8yk@yEJ5QrmxAHiPSx7pyc#B!9V64&ez9{+ zYolsjRo?((*D$=j9_FU8S0bN^fq{#qwzj^$X(Oz1H{1EGYHn#_S+%ZgH?;v5OS`JI z4aVFReonY!?j0ehCD^{ULl}=bM_O%VFrPgBZCI#p#A9F-3NpY}`6g{?9oETVBfYD=T?^T|78dGTn%6bMoOVZpQ-!E@c*4pu znion?-$LWrTlhFx!FV{t>f&%9Xj`%;)rie8*V9@&cjs(rMw>z@2k~Uz zU=NPAF>=G2CTyXJMkHViwB9ja-A9<8y{LhqSOwg z?rK|2y1u0i5vE5wx>o9Ndbc<6tr^a7b}kM}k}a*RYoYxOoI-3xXgy*U*|a$tn`AVF z8LPP=THl2iEA;FpiS%5)j%Bvf+s?ReTPqcamaH09V-nhc`GHNpL#?mJaE%p4mpy1Z z6Iaxh#fgPx+Fl=BhcQQ6C`aGJc!$=HDP?uD)6P^wJ^Bc`=cXt-gO*VbHnx9zQ&&el zdznM(bq$7I@z6ZiH8nQZw>M)5wr5hzE3KWa4XrJhTTnP%3_ZrU^nmSxQJ?d;q#1Z!{BZagE$1?}ny6Dx-et;$(!bf7Bi5WC2BO=_$4Xm`%6*pAT% z(@_IdgaOU2SBk0_5$gvmjk-D;TQ{y(4NX{+bu=|VUmKcQ)TXlw&e13A`D`O&(-&h+ zQr4W_@A?B(yl%p)=4foq=}6IY#)j zK{z&Tz-GWq3$7(g@D!FecUTg7=!X=tiYh8p4NyyaOZ{f39U~@Nk{(Iw^)%Ps)X>_F zVTHj=i$~0rRmIWr!sWP<)v?#bpPKQO4Bm*s;t)~E2s1*9?Oeyim3(TbBQ1hPbyIN0 zJ$syD@6s!uwkAlU6HALhYMt1A;K6EaUbQ*Om51YwH9xJ{>KZ(rix%M~a{ESG7Tq!0 zyV@{#VD#rQhtrt7QWJKVhp?vN!lQm2dN~I(%}gF9;ku`A5z8^aQ#G}>qc>wg8k2&; zqXKOOPm>f@z^+0@k%q-i!7@|(cH@f9tF0)~yyI;z9*Px58`c6GZ?N#EyJ4li zMzZ}#Vf?Izo*l8`DwDdFsnBkQt_2aLLSuELVdZKs`+9)QSa+m&%f@(X@1Jf@ZZR@e zOM1t0j^NHk1+L1_@HpJWA}db3Sh2S8+RQbfXxg3!odKyst*y6L?m&31#OMN-Zh07{ z)!L?}He8Qxz(NjlKx>!X*nt=r8#Fyev6&1ti4N zcLCb5z{R!Z>eZMR?bMt~>>?=pB2`~jV1ePf#$eVi8doM-QJ7wMwcn1ufdlve=9@Wu|RvhKRL$3rld2>mHF4j)% zZ*0aw1H%dye7L-CRIBmFG7IaS#@2OmKY|ymu}f$1JeX;&b_8`7L9B^ zSYB$;+57Fel~N2?Np>{zy0LyenqP-*B^dNje0z>g4vZBY`6soQX;7EG&_wapHn-q% zO_msFCe5AE#@6+ALtc&M7p-q-z-S6hV*Rw*-Joy{=%|~kNS7NG+i9=#l8eEmsOZOD zTB7K7Q;UgUFI&Yo){|v5n^5U`6@&_nFXm&t)m`mQBbTv2Uk?d8UDwU_qKDVvxNNYy zhtzk&8vEsGjG??dq5^c67_d%3Bio<``0B-{Q_oBY^&wtsTRpTdZOXnzXy3G|1&a;2 zdh2ZGz^xmUsz>c&(1|Gm19L;CzB1N}EsiTPXs&E-RdY)#u~@UO^7Kj|p6ftwEgt$H z7Eb!oLEp@f`xW%D?{YYo6u3mh4J7nht~7CZq3;f04X6d@j3rLqFK`t=SCUQ3Z8Mu- ziiR~^>-ip#Oz5%-)*XU3>v$7^D(7Wp3tALzP;_>-P1n~HohaQp+^ksLj@t^j<Trjji^&Qf2{64)NhbE0lv$3ob95n_gNEm~(N}j1})XbhP!I2^|fy^O3DuRllLNi$f=`8F8D2H!F4Fr~?$O zzJ>L*Im&yQ=y4bZTN-&w4)-iuTDhR#SP%6>8z`!Mqm$meM#j}kbK8cQT>3y>%#ZE7 zdWfPmh>uhA4J$e6aMfgAgm8euIvG>gWlim^tSH|3)Eabopne)~-@~rwjTkMWD={e8 zQxygUTus~c2oa?rLLv1VXx~I=J&vtxMd3t}xTz2OYQph`dYX|NF5B(u#FZmPS>5fZ zHBP!%U!gY$g|Ug9Lp9hFygi{y_fXAEofu2ou=q!xYv!d3Z_epE6udKminH&G=qZ7h zEVyF@edskbW&rBdzGvg8FE;PvA}Tgo=@AFa&}eXv)hPgPZrL5WxpQ58n>2Kt1s3Z1 zy|?JfRUCKh8Hw$wL*L7C(;SRd19rK@gN6U~FH#E6!3Qte2#GTA*^Mfio{x(oUy8pF zn=pHZso_S@NcV)WQ%0s5Wo8+pjWM3F#&{zapUU7%AH7++S7AGjEyL3A`42XVjUW8H zrg&J+O~zL}H<;IZcUaf?uJvyZY#V|oY4K?K^Ba7R9Xt3LPVulTrn}C(*1O%>=2Nx! zn8~Y_;p;Y7L-_l!p#*-dgTGO7?o`b3Yp3G#m36J_H@9}^<}}sy9n4hcJD900&8{zC zNKLiplKwWKRy5K{Fzg6C%V10wR37$N1PXQb0)e_*QPU>s%~X7=JJwr>!`T8M8*9t z% zRj0q!sCK94K25Z zEw+Z5o6D>ri>=|;TPcV?)VBjdq;x-RjRF-y>QSZEsYsnxW@Y)zRbT`EQ+yTHsaIRW zuCY!nwSvBntxO1#jez0ZNLOj4U$w{@;_Eg)zOoEl&6|xfpZU?1-In1q?=u4D`^$N-R?2Y;yRN#!A4B-i6m!S{=w}n; zuCmh1OCWK%r5Gk;=0 z73G!(#U0_h#tJR8MwD9F*I46Gvea&CJkRE1SANVgJ!q6Ibc8c=KQ@;kZ!@pV8iT}$ z?(uE6hHkTrg+BA4E4$5K7-hEftn|bq!huB&ulnf3gDx5kL~UZ5b|QdYpAha>%?Wgh zqJ5h9CyA!&08L8~_F=035|S!?Wn*{B79zfFJuV1{$4lkBfNw^TelZdBWr96||0#%0kKGdO zxyJ)FF)Jc9;DMT0a?<08s0Mt;tocq8|MLas6ET4;6ncr^rGi@ow+nt%aJL}!#eDV( z-Y57i!To~N8{-`kd`a-I;M;=l3VtB?so)oa*eXo(Nf8VR(x3wQ=Ll-k3ZM&wK2NY% zuuPEsgXxwC)(O%C1O3+svR{zy6ueAutKhYQHwxY&NZVmdr)@O=zajKPg8Ky@6MRze z$AT{kzA8wQE#&u>V6Wis1lb-Lj@_a({#Eb`K`$l-hNlPy1xE^M%Mb`3FLa(@zTgbO za|P!J&J!#btP@=2-50>)}vrhaHL?i;2DC`1ZN3eAXp?=Dp)C4EBIx> zdcoC#>jXOlHw#`RxLxq8g1ZH87u+j&pWwFyza#hq!6yWt6?{SPr-H8w{z~w-g8hQO z7yL-@Gr`XVO$>O{<1oQdf~N{j5IkLQs^Hmz=Lr@H&KF!HSS`3*Fe=z2xK{8|!Ht4f z2wo$2z2MD)w+Y@Yc(33Cg5MVWzTne>F9`lr@O8mo3I0~FU-0*W9|?XY__?5obs+UO zL~yuZrr;@p;{+!OVh2#2?kvG`1TPdU5nL#^Sa7M}#exlj&4R6hU4oYjUM+Z?;7-9k zf_Dn;6TDyWVZrYT{!s8K!RG}3L-0QZ-w=FTuut$k!9NQAS@6FEPY7C=V5!$s!F0h< zf~N{j5IkLQs^Hmz=Lr@H&KF!HSS`3*Fe=z2xK{8|!Ht4f2wo$2z2MD)w+Y@Yc(33C zg5MVWzTl4ppAmds@MXc*1m6^VNARfN`+|QG{8aGof(Dj))Tdu?1QF|^$wE&TED|gi zTrRjuutRXG;7-B21RoH5RPb5BR|Ve|q%9xH^QoW*YdF$D!3lzs1*Z|Q9y?Fyc|@$6 zXaR`nYK2}dbfeH~gx*NRI_xU(-zoIHMDTrF@I}Elh~WEoK?`d_(jmdHV7}n_f@Ols z1Xl@m3exHj`Ro$BNAMBB1A;FK{zC9w!H)&GR41Qdg4u$T1!oJ+6RZ(jDcB}>rQnT% zcL~z2DfvGp_=4as1>YC^n;`A7F@Cn-nSwNqM*m8|6@s*eME`EVJ%Zm5{DI(41m6@q zCiq{1*ho(EIYn@a;01yef>FUX!K(#t5xh_EQNia0e8R zEEQZT*d*8?c(vfof_nuY7Caz$Nbohm-w6Ie@GpWU+BoG33Z5!BS#XwMvEX7snrdRY zwSt=jw+rqOyjSo$f=>y)Ecjc&_XYnVXo9zvOYl^|$%3;5=Lyp66XUNGY!kdv@J7MA z1RoT9Oz=Mh-w-?|_>tfjf~i3}pDe-2g3|=g7c3I25Uds4EVxy0uiyiMj|%=+@UY-- z1pgrTH^H-T?Z|RpC|E97E4WgyRd9>o^@9HB*iv=$c+$gwBaJS$+g8we~wBW0PG`Yq6 zKNS2za2W1Q&>y?`Ys?q?l3<14R|MA!UMYB!;5~x>F8G|_dx9Scej%8O8yCzsOK_s# zbioS+%LSJUt`h7J+$y+J@NU6x3I0&jiHYykGG9 zg0Bj`Dfq77M}l7nreYg2U0;F|1*Z$rq$tD71(yr166_G%D!5bdF2M%`4+#EP@KwRL z1m6?va@Rx$W6Z}NbgNIb) z6BHaPI7RSW!3Ba#1RDjr1g{mmUGRQE+IJ!U*9Ch8|0wu3K|eO8WxNc*ae_30LVsF3 zAubTC6Y1rD)=WsnlfTK+R-465Ijxr48d7~MS_)rUlv>~*dch6;BA6?1!*IL z`TRieu;815zZLww;Aetn*iJWG@D#yGf-?jQ1uF!Q<06PzztEf^JCE4Wec8o@gSdjua8d{pqD;4cK<5$qTI zNHA@@)URN+;OT-h1&ai~Blwu$(}FJv_6z<&@KZt01gR&%I>83PwSpT3x$8XJ!_9)X z3*IOAsNf;Nmj$`!IMe-B@b`j$6&#&ohvx{MA$XSH$cc7%u3(ekdcn&DcL?qid_(ZJ zg2x0u74+oVe8&iKzhBD9U37`ff}MigWtaXp2`U`CF82!JGF;QR{L+Z!vPLYMG=>FH zEKTPLP7$0<#I^JJf^&$tb}bfMKtz7!f|zEN2bo}))am93?Zl4=T|-1VT5Kl&D@`Ey z-a~}He)%HynP7fn)5@;Z(fXAu`O;Rtemg85FAwGyRxQeJ+JyH#v|qk{fyDI&hmOP8 z14Hm86F>J;|ALKv@ncXn@sN`XftLdDRf3kXz7wwpuI%E@k(!-dBK-*(d~6DD5UTw0 zd<`s}?aOyqRsQC4<>G-i3Yy%s{T`A#LTiKlty@QagCcjlbOhYI zj+j%Qe>P7uR8C|5S#(XOYZ^GV^7{hDp9V4-)o-Za4Xlm)YN4SGZ^pM5Fn$4Q>%V<0 zH~73Weso@~)VJa19FCLihi;z)%y1$IvVHR?!#_FRafb=QoOtu#Ml*{YKVOBdZb4!C z((*7KX>=poo^la(L)Z0-%ikOe*XYJ_FxE;GBVRX|QJm@c^JoD-r>vwI#y`!=6P<(4jeh44Kqssa z4tKse$d`I%IWRoN^2KeHSQB|iF9#sXsM~xLdeJMTr-c#zX z{!MCUf1bLv|BDkRevh{@n0X;|i!fOTE)?A}oS9qt!dsLKQJL!ha0> zE%==RKOg+s;rFERPM;TX$?s|79jGs2qMpZm@0NG^_IutzKFj;ofTnD!pyy~_cyCPR zW<7i_KMG9QwSU`@0=4Z(8p?GCFyJcRarJT^OsGdH%t|Lb$KwrkL3urq z=Y1-8A6^02)%(4PblvtbaA5aQj@Z+L@8 z=r_CIh9jwJ&#@5dxCe2+Q2-vSSH$snZ9e2N#dxd#c=%ACM{PYi#dxVdWlm4uuTY=t zYjcqQadoJVem{pF^TF+sF-*huF=xeHXzRhF$5$MJK2*vwb%X93EZ?wT@6ly#J^izh zXBcfJ2md^2Kik6l`aR)zT@OXt&LHaFrK2@T^f!_JGVvP{w)Nfvzh6!|gmLXIJtne0 zqA$J0e!mst%r^WftAVn;fVh0;i0e4MyR;1gKZ^fWG+WNAEATJJpU3|1Oy63t;LP_` zWS5>prWkMNa@u9wuFJ?e&I|5Geec$P);Im^_Del)L!I>;E!gqYG0pRuZJOs{_O zy=KAvy~oGFjWj0Om^&W(&kXdR;>Xa|deCQ9puA|eL9~TkZKzl2KLzMNPFo7Y&9W}r zwYNVT<2vi54(%!p?hK5TIp||qZ9DsMJ7xa-G+tMbqRko!qz^(YBt@YR8&v@a9iS20%cmy*O+tZcki>wcrctV=(NQ?1I-PxC7 zsFcHK|KSxoF|M>9QR>e}CSysK($;>2LD@9w9cQddKs-Tj!Kdi}eQ zPvm)waaZ?SkSz`RgTN`|OBwxYYj0ND-hS3~imHOFuOE2>vYwB+N>SH>t^&W;j~vG9 z6|6VP8xGulEVy-7f5yRG{efUD>UL*;THDLLzTVxvY19GgbXahCuRnOWH&!l`XGm{P zx-WPe%KY#VBe<;B8~k-I>Spqx@9*pP2k+5iIIhi7*jB>fz32n>dMS_Vq+ZlL+8XPg zItZ?y-Xll%qs?VN{ye0a0v#LJfsBW-4#L_7^Zk$e zj1?15w(-5b6}R?ff){n?XFm%**E=K}>8(S2PXYQ~_%-B>u{+EYRD7obR4Ek&=!w<5KVg@?@R4+unm1CxfVmI@Hm!tv4KLTyaBxaCmFqnq4>a z_kj zVLfb*MZsr}99Pey{oD<|ThQ*mihgu=KkL9iUqYRuZD8J4w}56p>qhu3(B*9s-rfI? z{rmbkmZI`MU>p4#=7?VLW4ooUQ-ar_{i9z6U&lCrOAOtX@9r;vEL`Vd{b9^-&DkNu zXMfdc7#HcV&YSEHSM_=$)Z24MLKs`r*1jWt^t&{cX%6BcZXo!Y?t>{J%Dk0~7EZqs85$GV@PTvKrUoo(Ts1OAVAmEv{s zlO_x%19|NKPTJOdT&GP{`IpqU;OA>vVL~;P0fPyAgj$_iH$h|x42f8WUiuLuqrI0q?FRmtf{v-+eKd$e$T zn#@Dc4EzU?0KQVQ5ms;*f3Nzp5gE{&5TJ$dsj5BR>OEdc!ZyTq3zES+9BJrwHL=Gr zv_O+j0%|bQ45Cyfu$vg)%Fu1aP_-;2)1rNEYM7!=I1?YJ*@JAaba1aCgFmajoUa|tvshvv?1A1*=FxH2Y{}fRFx{QqVDE_9p z;+NWS5Cj!iyT?msFaAEYT+?*_1A^+fbU-i=2&5woe%bcD*@8b)5qIHlDhNgg zE7wN?<#ei*5tFmtj~uAwK?Wg8#UQ6hbpINEsf+=fkYf-9HPn&}K#uKnVj1bi#9<>W zb69ZHDZ|o@+EI{uhBAkhj<|62xvA$_9tC+r`J_?+jX|UX<=0is;?xfMBBf^L<79T@v4;Je* z2~BlE!xEax&~Ypv^B^%kA5{|a&B?lb?r7VWY530D1WS2F#Utj-P@b$fIT55QH1||v z+6XdQmbyH3Ddd@i)LGMzL7t_uhtqNTsVXtbWD6cJKRQFhloTmIItGd}$*y*k!z`bo zFz!?eK}UfrKa2TIyT04d{P6%0PGis9EHXOl26%h2cF#pk&T#AO{Lw7q*~z8X`c!IW ztn3z*G%HqiP0o&$U6bd;gw>Lq%j{WFyz&*V2Rpy>IeT6}QAIv=9FHH-V{mwpfU~%> zK)9bIj%E0JKEi1>{^o5S3mqShiRgj_#@U(Pzk%9|zcDjYc^?9k+wnK%W_rE*;dq2Z zac02#1{``JH9s@Wd)y()GK1c~fEW&LMnz_Zm&0-i(=5)MqO7ljuaC<`KmGhy$4>kx zR0Uqd=?+HD&$NCDx49EUo^fiXm)9fH88Q|^jf6w<3_~b>-df3!@et|^I3gr+AV-Zu z~P(P`GIymPswBIuXx8{^T z5Ma_ydcEgKQ?>s|(1hfLyuK;#p9q-Q|{eR_&WmOi>*5^2-1)%L?aCq8>@H5ze zG4vGp47(5~d}7Wh0iz((`(JQS_r^46lWJm!F+J0(hNmHFz#p6iSjtqF*v(^T0|?D0 zMWrxyIt%VKTSB;>fpKg;&fd^PIQv2yaSnv`;G7cr7S3s*XK)@CdIRTR=r=fLgg(MK zE967d%MOjfd2EP_vv6oW&f`OMIOl{m;hY<~73awzetel9dJbn5dJ|`F=yy2#LVmRM zKq!oJN{AmoriDsz4u<$KV@9Y8=aC_PpqL%nhx6Fbew>Za%Q$;Nzr)!Kc{nMAPQ%#> z&BECis>InJYQ{N$Z3|G3q1$mz2|a>yYUn38r-gol^U%5UPpF=Lp%$D2p)Q<*p{sBXhi<@mPUtqAw;G|n1W)Kef;aRi zArN{Bkg6oCBC`Ey>)3aDD=5EmfIc zg?l6lXf5+*-U;`3x|ats4>)nYoR;~V6Q?ei`BNv(#Tl7z!p+uUMYA&bsolABugK0k z4tFu#E5n&XkSCjk)sT}p8t!Jg8!=+RO=ViErescrTj#r`AhW=6H_uSk7Z5U#f)v}q z5zFHM2ZOD2UuOiU{afk2-U#F)4nG3)-e3&*IuK(Phb!ws_@9E?Wh$)_t}o!Q7F&9K zNjd!b#M1kDf+={U`HXDtG}5-hXE=nhs;upBX4{dOLJj3;p+}B@8p?{)ZjZ}d=uXEFuzA(CeX7^lb<4J!ucTo zs7a2b6V`#GBzEK+&+aVBX#U`B%*PY&K_JC9AElJz_@$uv7@6iCL;)8dG>pIbgm01& z`6+xRnY)Ageg#L~$d7PVr+7$ zUcb({&7u3VCt16*CS>oUXj5&c7VvZ?n)N#E$ue;lckP2NY@bh63&w1k@b ztxmM}?Pw`+?kW51;*%TaTFw2#EX^$~&MnQw?Hf+CKiRT|RPl!%vr*k&5C=EoLa~xUtrk1TKA#?gWX7- zjlX&lG8q^5Fixq#c0KbaV9I44Xs+~T{sE`Y>~MCsnIWX$BPp}Y&~yc8F7ZHfDLKot zJMamkR~YZ11J3S5u#eHp4X(y!KL}b&u}DiXn~R(f!z;CjQ!?m&%lHJDOc_J>uZ=L$ z6>Nc@p;rjfBi*y0JKbZ0#iKTzXRs*8T2)I(H#xg_0oLyzG}qw-O#x z;Gr4tR-<;*(7~p#2@W-*9(wV=GK7PkpVNX~g{$*g;B9>FXANne^VN(lcv%6D_PUsP zS)3ndY^C?-_Ii}w@if|HS7|w-8y9~MQO$m>)0th+3zzYr*(PS+4O-X1d%6y^Zo>%A zV4Ob~p8UrULF-o+ltCqx=$X zCu>6=H7bub&ePP4z3A&)hJpKKAg_w!X89 zHcGH*CpPKj!%Al>S>~-bn{`{x;l8nP<3|ZrFP!v<0#h#BIo39zln^Oqu}Q~vnf&>e zCV8}RCVMl`xM84}Q7d-=TxNn|c_)~5`e(+21~Yr5x8S9~iB^TyG^&e=U>|EfOx4#` zm5>mdjxf(xToRqT-0f9SQbGf;Fq#WXp;d)NH4KDlxRR>E@@S;CO54bt3lm@S$_wW+ zjK;rc*^KsA#pnQh9YcNEVtBNsbdk*XBDWIQ9gq9!nBcI8HrnFeFvGYoT2Z@bF6`c6qx&jd$WoYStg1jMbt0G@ zuPU8eTT@a^$!In8WMNe$<narlT z2!@uEJu52F=U}@pLGX*pOXo&uanCK9)~Hh}E|JMG)?G`$r@Wk%qY;KME3^aIlor7d zHNr|O=2dD(amn0T6dqo*_y>C*bkaPcIMF+_mu(PHJIi4Jq@oCwf|xWfX@_gmgB+n? zW5zb4f?fDwZ*MjBwGSs5y~DUpQx-3w+#(krmcr)vkBVpfV~I2ZE{ds27?s^Y*5Z`_h8llIs`**aUSi6Ik~&IHWg>< zv1wBqzKheke6P0f)lEUF;) z1ch?Tdu=+6z8hd4PwSqWl&gAeiAdXWq=}NQY1n*RH7M;yt_cbBj7k$I1AY0KqT}1y z1TzEMYLbXn*$k%?Xa+?gn2$Z7B8}fZifJ6*61?pG0l>0R9Y-M&S> z1Lmrm!FyEkq#AkjL9J4er1Q`d-%mY@Y*}|roQD)6Bhv7*mSRwfg^G=fjnW*bo z=B3@%XmdDrdw<#*`Gl3d5RGUpRf#en{*SkmSz(`ftNF1O4EOcm;q#f#fkT@4C$xsJ zc{`ek&wL*n(`UfV4C&5X2+_IqeZ+#QvKH_>%DfCM6ZNyu8okhB%^=P-me<^6pg50i z`50<7-!v)i`&Xj(aQk?4Z1W&AJPMhjpc#0j0KIqrmII!ggi7o;4J#`JyT;!M39%*p z`(VTVnTZS_h^^osO`?L)kEPckyO)=tP22*tpj3ZC8c(?=kihs;FiuHXXn8)tV_J8! z`2qnGQ#@19JWgD$x53}$Wu6Dje_Z}CCOU}u0@~v=^TKZHbYwaWfa2?O8ted!pNBff z$n`Olbgku^XN|?#ht5Ys1%HKVCqVq6y1(0JKUx;L50r}nnLmY6AoCMYiqJ+g$V z%__G>quDJ2V`$fB9=hUVE7fPd>g~4t*TU6pg|rx8H_``%ef#n<^L0o*lgm`X!bCI5L#>nfEc?j2V9@Y7l(;|a;_vHsz@?&1Kg*y;-%v%Oz z*T9JLG`dDQcwxLA(rx~@=71L+PEMg5Uu_nNJ z1Tq=}V-Z8y8BlKYuN~0eWo38V#RNr+z^9@KGFds&Kbfv<@REt<8V_+fzdyj=``Qv2=tm$Z+$Z0r=q0Ak~dAO$iC?iZxobrS< z^crhiU?U|Rr{(qHe3g~<*`Iyp7ncPd!S-AR=ktW)7T4We+HyEo?%LXsOqG&A`_*Tz z_7(UeL4P=9-w{KLZ_wJ5%UGpmFD2O%?hH(D%WO`{FwOS)h5~WKV}p*UBE0 z=Mx6v;5yrbRI4OD*Tf!3w%HEWGI<8rl86;l#~Nsh0 zKYel?v_;`QOm&)@#PV@m5;e(6X0+e!2V5}(&dw3U&P6n-WX%E9z}IOiOs^^-gCAdSnH*g^WP z7-i@0OG@t|wR{DLpFPF?ejyu~2N5AVAJ=e#*^n=L8s1ALBK%h31p8AQ(&Z=zk$qx? zbI~>47Gg3Q@%iMB#>=NU*=H$rkcf|x4inF?KbFWwwehJ9F^4z_*K0)N^AFo_{~FLlXXqj3;@xZ_nkk?2nrV2tM8s>hd{$--#p^GEj}zHR zd5pJV@<{N8lljjkLN0wc;q1gb92ys-TA$D#pVsPhM99tOew6nh5s~JI-X105MbHOv z0hEnF;BgCxa%Z4_G9JegmWywVQSLe-p~Q)Tvji^`tQEXiaE)N6;N^mR zABTMS8V2!IK@aN<^bkRg6FNV^>4I|v`C2H$tBKf5Hoao%Yv^7zA5;Q;88)Y1DNhlf}aZhT@W8N>u|r|P{9#` zqXkbBoG7Smoq(^lbpq73PJkCkc#)vCbpn6BLqa)f1+}dc(Dg#E7Sy&*;Lkm)7+?1v zptf}ayg~eL5xhfC?}3N#ZwUR6Air55AHI4)d{Xc^!IuR2h6TfaDR@lqPl9~og5jy` zm%vei69oCHF8#HQ65xEHs|6bbTLty^D2T_;kC^T@!TSXd2tF_Pn&3Nv?+bn^XmDHr zpP_=I1t$tl6V&4f;*|=$Sny&&z9dXO+NKBaYN2-uYTF&~zhCI@3O*(HAA;H@2jcY! z{YOEQ;}!ge3!Wl4NpPy*9KljSJ>DVRWkMeid{*#P!M6l|C-|}83Bgp3li)K_aJ*o? z;5mXNM9c$~LSID0r1BM^n}uE{G+(M^_!gmW5WG$N`Eo7u{f6N8iQxa1;0J;h$7}fW z1zF-OBGP?H==ns9&y_^vw@k2Ju$72(+V%wSn?gS($k%-s?!|(Oc!pq=;7Y;k1-~o! zxZtaTZwmfKkng6E-`@q(v34QNcg=|71ZN5IH6fNu+lm0L75WOn8w76`{D$CniI}vW z5L(-cfF52J`b{F}w}s}1{-l2|^k+i@IM3(3-$^g7c?+&Gaqe(0yskGY{BtF=imBy^sjHQs^%W9Tj@5(5*sWF7#DGe^qF0+XDIDE%ZJK*ETM||2slI zA>q#m{j%WCh>-JbBI@m3BGP><{wIVUi8VI;bBKsPU2uWmGQl;1t%6qx?hyRC;NybN z6Cpnj_8ScE8qsYvLfsmndfgr%g2u35j$oeP6hSP(bv(VEL;IOS8gds4E)XmiTt-Cx zb%HC1NY^O1hKTmjBG^WRP@RICh~U3PP|F*ZbvgLzd_n7c!B?jTtc*b0#-6&mHm!wV4eQ!u6WV%g8tcS%?@Md%WBaez>nFd78}2&HqB;zD z@rkUCGRV%mvB>(N@<|xQ9ys&quzubhGuduBBl;wQ<4Y!I+_UF z+Tea}n7prW;^TgMSL6KIvb}NsEbcKp%b{j+8{wG_rMDwK+o7;8F*hd`2H2qZ|9+R^ zy||vh5;=B6A{g6U9_X(6z>tdjdw6%x0*M$?=>wR~f;HcNQXH$q_qd z&&53oP^aV1>=`eBKR-6budN$y9=tA~zayfo}> z_a>dg;r9VN-16N4e*57^epvFw_`L|XTfR;xi1ING4~O3&xZV5~6vgGEKjSeSzq549 zw*~w-wmXNz?+1wF=C{nn4@-|2Ki(I?FQ&g2MLx#i;qc>EHEw=uT>LO~#`tx>ji@pG z9R|NJXy>LiiI>dAH z+W~$%5b1RMdGEyG$B#wb@~uH3nU8bF*x@%biC?fdUT+yLei^1MA8sw`qYeBX5;uXe z^MAh}qU$3Y>xKex6P$eSh1*?@F!G%ZKb8a2Wvm=$h+Y8tCq;nFI`KO9fCt zZJQxr0JU-I&k0C^_(>}rRP2Us?Y|1aW)O`NWfO-gK>BD8{O{W5oJys{Ztr*R{qOhu z&)xN$T4(KX?RoFD*IvgmxwNj_b4|i%v8Tx$n?E+!F>cKGd{K08r|5rC9Gjo7ScoMF zjIlQuOHWsxfwLLQy66Aj&rQhkPkCx(#(wPa`5C+1vk77TS3C!gGWJuR&p}7@)8%9A zUp#`*!7lscyP0sgXU=0xC|>YC_bd-FA^KSdJo;&AV8Z{dr_IcSAA4TUX97KcLjL}= zp!&}G;?>l^B-YHnwmZAE3QZCzz)1$SOlS6NwnXMGh%>MI+H8>*I8 z)-G${czJbgePyxcrFcqbXi{+l$`i5eJj>N)kIOeUZZKy4;t&TXCmsVGom6k6l1}xTGm3S}b zQrsO?B&3p_7Pg)TuBpAVxW2MnK`0~jwdG3y7AXZ%*I2x$8eYmldtI%PUCj>3!sRmL z)YR5gA<<&W9xn~badCtUPiaj>b!Bl~BgGuax<(easH#_r7o}Z#`_jsq?h>l2L|n@& zD~iji8tPdw)oFF@?aL!?-SJf-&HAdP-s;MpcBK^+h@`$!$udg$zPZ)sga6*614Y|*01x=N+k)L4}oytA&Vp|aRp zSyQ34LMmr3(Wf}^f-J33Q(IP3Ra;ZsP*+-0U)6xu2=$9x^ zbdY6rYWGnZQdw1v+LS8m8&Fp0Ud3J%M6tIPf7HK}&QN~`nl-{MQfgu`5{|~vzm(q0 zQv#;+Vvg~iSalb5bR@9M%Ps3`yy*1}iwLRa>A-aH&v>|vHu|8xs5zIGsU0rT-=iFQ zj24$0qJGRT&s9}@{W6RjrOKee`%WacmBqZ+7FA(n=`m=apQ1jzL>4d2;u;LdYTu1^ zQ@Ub|qgpMIFz9hSqNv8_LGMCOR_tkXQu<^M>(Yh>v4)bYTB5UQtgw6umw zhWe%SianK$JR07m`5Ov#X=O1w3OaOYostN~g!-l270sr!s)l!K%uzJFm9D6+RcBT8 zy%@t$m6ng<%0^Eqx&#fFYN_&wBCUp3XT`FmOO>Q(w5qNut3%So%PZ^ZwSiHaHqe+b zj#n)&zKcfFa)o$p4%OTcNlyomtPY_(`%x{DTohF6idv&lN8aKJjAwPV3Ux~9@mZ1v zWo-q4NF&5V(M7WZcPMSBty4$WD4z|rODZt|pqX~BTQF%U4P0$M+B$=JU}X5?MW%S* z*}P039`|J(dA2a(L^ZS6@EAZFmMJqyU1h_vx*CO~C~HmuCc&z@%5t?IV6w0GlrE`M zi;<_T4sP6cS#8CN9}a(f`YSD``46Q^lQ>$+WuoBgEH9|RA_mKXx?&o%d3rpd+be4- z>(H*XI_&AHlA*46qQ_6w1!Yo$j1=cZQ{COiV|*>IDnPK!034e{$e?+eH*ZF9;rs=>Gqd+QOS??Lm3e zq{C+$Z7l_=>Xl|hBt?(nkxWNVoY9`5W(NvNOLrxV(oA~Rd5;M}%TzSwJZ5$I{sVhu zrY@_hEmj9nE$=<6GB-kVPkXgVsIl`3Q9U44hPIrG%BxUbs%vY#${SkYvTCJl=1nWe zRYnnSbtzWvGzHdIRxT+nUslIx#X+O~(yH=0lmY5p9s8;MV2xQ(s|?`vXn|OldC^ro z7=M%{8!Z=j9bi0CR~hBBPOav>jg~-Ob@=RIOBvPHSS#wWsNy;2#HpPuvWDT7$}&>z z4bHTGX_tH(pAt1PvtMOIkUIuuGPX;i!HGK;%wW#z4`tE#Q2Qs*?P z;vcTU)C5tdSjZ_0VAV>S;G)|XA8=?2Rmu%0ni#F!qf3))%gc&s5MHkI9nA)f0=KNe{2RTI<Fphi_Z1~G|o22h7kr?ztHYCg;GqviGMY$PceiI2G`m9P3Dfc(3H4L*(4fd z(}?trtFtoYIJ_H2eB34s*EJsY>xN5>RzIcnK;sidPlojZ3+vgekluXo)U41Y$Nn!u z4;W5q}RYUW)&tsEHh_PSV+p0 z4i*W1WJFXsO?&uZ1bj@#3hL+QhquhQQ)}=fy8=SMw_Dw51 zyGEbr9qs=u%IEyNKA{D zO)V^(DB7mZykWRFcGLv)gxs-?{Jg6~8bZ*dMZwubgQBsS`Mzqo|i z{_3|&_q&eD?2e;yy2aLEl9~pxEuv&8PqwV|ygIdYpLL0TTR*pc%aYfaMU)bFD)3** zEEFP9VjDzhxu=(=y;5WD3)`2(9~|9sE{zov-ahcF*gKN^pR>a>qqd9=ji98VR`uAeB*xM|+J;%W2e z&n});RNyX}J8z;m^M)BS#8OWJBljC>)U~BZe27Xhy8=D#zv0}V%n>xBc=#fL>rnbdisxzPaDmYP(Pe&;@MR^UdEiDndTB_R00(D4Ka9S4Bi-nv#5bY zorgxvD9mN}bFkv#*>j8L&%e1?x?yJF{OPl178j4o8xO;GE4(RFn~p>g&B3B=Q1p2~ z%qfm`v_<61z>|PUyPaTP#*Px~$JiID{oe^@-945h+tuNb!<60L#nGm9ybS{xx$Z8iA#Tmf#(8mN(kp zPnjzRB14ftQSni{T3#v6hk^KDnS^)hpOlYOJk-ac=gK5FG{H_Y8hxX4Cumzt4kL5r zm>=0^jv13ryH61^C;x7rxg(dS7MUx1vtF!aPySwm*q*R}cObivU^vzu|t@2s(lsUANS~JN7dx*FKqAjv0nAz16;j_ zV!>Qk(u|au{fxh7nt5l7n(;?}Ktu?}I^OSY!@9zwV5B zS5ohGI~3)1Bv{{n;1Yz+9oT00_WnAGy}rLO?9k;QAE}ni@{K|7UMdC3@w9zMWhYnz z##4l0t{-zyc7l>n3Cp%iv@Q^(!It;sj8e9FndiBwSTCq`2Dg|x)9?AO)*0o;8>zKZ zLDX4cleD_kETu?&r4~*p8)A}lokXRtjWrLKT+%dYhE*6#HWQ>giP>z@Hz%3Mcd@IV z>#so8k@_;)S;0~H=(J}{x5MZ7`Fo}#+~qcWwn@LT7deI9hh z`PuOF4th~F^JUB0?0*SmO*u4$ zou)4W`@fJ^3w#Z`cS$%%7`vFy>zCSpvSg6rp6Cr8&H%}@oo(4M)gYy|iIT3>yMMD> zVR`d>LE6^1i^q=18NG+M*?1llSA9s(+obaIQlI#Ga*t(QM#zK|0w(UP07=+HwCSiey7a9|`)-}O9_=pV{6%XDdOe$SOg_5c1yjP&qjE{^c9Z33 zX14M9{%gQLedLVqb}KT8_%(=&ndS3aaYQz+0t}rqEyJK zOh*51eIPp2r$O%9L;uF^^mQTv_=6I={zb7-x z5&5XC+2rns+ns7P9eodUwwM-nr0mYL-g9?*pPfF)pDK0nsX$fc~(g1rEAs=yP`QcyujSQc|h~P=FH|n&F{)3 zo&6rASOrOZ&4y9P^de!Qef#AR4pYmX?^mB^wpnNArI|aJwXjVu-R#i~pAgtyg)~!d z^(67KC%^W#Jmfj)`C;2B{FOAHtfsu|2quVeVY84YDK4HpgQh#AxU3a?7RcY{;3XO! zwCYObjp)viu9Gq?tXXK*HFw8$s*2e=0>6tY>BOj#R#GJ2EUFd+UJL(;_F9edCyp8I z%|d&Vq^+%Nxa2oVX35Fhwn@t06F0DU^w{GT)U(pZJt%c!*r)SZdAzovry4RX=wU0f z*buV0PhRP?NfUYa1#L_gt|QyG<%NPM^~e75KH1041dquJv5RK*3xRm-8Zjr0Rr3BN z-$i!gpApw`?8l%r6EsqLp|Ni@RupNpqOc^iQC~{MN+W}p*+I-$8L&&;FTh@pxRrPX z*su;-BkHfa+nrI;yG;k!zr;J0csH~ISuZaVobleNetChQ^m6Z1TEVQBy}8MfwJk0Z z*BaT2m5H)*7A0*hl7TottAqMl{@yRLXzWq^tdSSb$={y@7pzTqpQrKIC#`7(yFPSV zlirgg4QzW)J~Z+z`QXUovg|l6e>uBFzT?U5ZEV;kj6WIDd-C5)EYe%@1+OcVs#^^^ zD%COI4166pB+Df&^5R^<&O+OoS}?Y{&ZX47b)Ka)yUZPh7>AhM6KDZ{ArU_OP4V`% za&>O8KLMCwl>z?)n~uv1upV-T;#VQ2k9UQ$^l71gq+AcqG)oy0IF6DoYeWC?)=N$) z&+=zE;||Oaoy2n>H*z7aI=LEqxKeB_a%FB|$fsWmI5;GxI759`u`H*QCYh8G)W*)A z^wG${hB>7a%eCNV>mJqf9>{Eor&#D%lYSe^3HhCpZY$+mzrDrv7yohjg4o`61mz{? z+4uGC)QA7BLpeFh+ggfb(EN8tTFIEUf1=+08R1G$DNyOeO-c*>EhW7}urh12E2)DG z!H91d(nh6s!sHAOYjX1TbQ~)@)P@(eQ7~}NGs2`EYf2U}qvVn>caXm~xZkAS^ggja z6Z@AO!fNl3oFqiAE17)}D0k)xV|2(5<;H;3L58rF_(Z%sT2MPI>yVsbG1_nOQ_bop z3HBRK97oH?b}96&Z=r{cV4<*&d_EmE>x}k{4qZB(2iwqq? z*ruD?-w@c_*;2$p?Y;rhyd}&oqm6!w5&RHVSOZN1C~QBnd7*#p`QN8e_#=zUc=#9k zkH|9ww)4;}2)&7iX4XS;KKjlGrj+Ax>?PQcL-Gixi20l7JtSuqw8)Xv@3|y~_J5ZV%64BPF2Sm5; zDQBWfBdIqVzVbqN*SBX-GJ>*Ra7qS?vX)3h`BSYYTaKxGGy^YBYS%1h<%NyAUOz)M zD&$ChTTVtt7VL6%BQ=XIz^qEJofM^ze(l!w^c* z%6oiwnkUZax1D^A+NIIH^1`THE%JxrE&JGrDHm+Jbk?=K7xdAEbQn?mSX=gQqZY-) z{QbI+pu-BdFIK>FCbmVdDV?tT{n0B*!b5u#-2G>LBzroIjVs;%bic@qp^(WGPBrL5 z4*dp~)ol#v4U^rO{@$|i$NTnWhI}bs`jf)f=pWAR)s8H z+Aqs71^RaOlZDX=mf|0s^Vfigd3aLEm_~bBeIu>j65E9F*OV}k_TCe7z6msBGV2(x z!U;fJtiExmG#cX_vw!SITvL?y?*b=-qcCrnWc{SQ!K4Tc;y&lO*V2fF*MsJWEwk+n zoWq);75RM*&%JmsYOn!#DE}$6KkL1*wM9y`>NedkVI7&DE^Rj%j$&U~+Ak!UM)=uK zomIa@ztgzIw8gMxr<~*<&O)5uD-~d^ma4Yt!c$i1*59ON4VQMxy&U;`6fzDjIF&EO zJ+FI#T7}@q^6!@iGv{x7?R}{KHzjUK+?li`c}uS?DO*yv^xi`8n*0=NrW$L;se~*m zVjLmf`kTzGo$@FLmTggMz|^QUpeQM^CSe|QskKDwltbLVdHO`j3R{y$5ZPv73sFR_ z`-0b?ENE>=>l&4(wI{K}e(eA8I~xn;OJ%V~|}eL1o5(>7g>E_`Wx z#%Y{9OG2kEC*|}oyVYy%DEAt|f-$kt)bVVlZepG!3up2r}hg+By|YcEc?n4EgeN6!Fc_? zOs_DJ{0L*%h^_$38sH7>UoEo(rirU%q0=-*FB|UB%ldoZXU35DXKvHWx*7Ct2&EVZ z6K1>{6uh*4^B~XE4rYbyNgv7HP9wMg+2(%|1(R+ZYz>Kqr^Al8g30zh`W)+N(XQ*b z59tWw@}#f)@uSyv^dIq5Sg-4I0=7Q=IE0!!Fg^|SZ_lDHLcY$o18Ecs@ z{dSund}*w?V=V?Wb67BEbeLr!sZ(hiw)9huLSZu87_*Y=QPtjj$|UHl7u(+nrebtf z`X03cPR-uk;2a#y_sa(|{PIEDc0=-pq>Z{`>W*I=&3F8)BkAQ->_3O^Gh=tX|BF;7 z_SjR6FB-Nbse92KE?Woftu;54?<}LVxs{1Y;6zYMN)8W6NPlsTR46-=mDPL`I6jqr zVI)aztN}-Y)(X0jEc8pC0srfK=8+lx)RA-iBCz#7C;#{H|GnS(R+7KH-?EkFj#;7j zc%z?*eUWn(|uAl&;FbHXYz2b4!#Vt_4sGA4Vx)m)1#;_i~`1uxA1&vsT$(n z3JN1dujJQ_TqQjo&}hIul+#0Wd?fGaBnl|if4Z49`+B6Yo_vxGv;N%u?q8TdKFID} zIcYtmq}!Oo@kg**(#5amwMw~*j(I)YjPa}RZ;D@u|G4;j@NbS^5%JAw2Mw?Pz@`pk zWeAPtYdjnAtit2i`^#40rDQ2DOIcePrqPM7_125HVNu5gRDshO z=Au#vDppWR%8dY#q+msekKqakMI4b7gF6lomvOmhHI(YExYVu?A$uNip}bH&@2qD$ zUjTToXC$0+Lk-yQWpIqLLRn=~ z78qz_HxC`XJ6d5FsQL|BGki1bijx)j1?{>#=Wt1^kV)Ae!@bf&IhT>F`&KhS#;gp{RQT{1>a}@3XUJ>KJCCZ)rKNp2l ze63M9xrd@~IuBfnM==Wh7oyzB{~8)Fxe?ezz!nvwQ`ISW{~!u?CePMUj$k7vJAw%2weG_lv=Y z$KclhZ^E+!aZq|U#kg0-;7fp8u&%h4{3E?pG4AVP@C`Bee*j;K@I%z_{~6={N8lUa zPD3EY{{ir=QTSQlPe$Ri-g!O>kH>o(9*-K{iueAg)&> zgbxD#ZB+PC!2bb!2;3+=H*gE)6D|H*fDZ>gO?9sTt{IB22KXItC)rgBe<$z_z-bI6 z{Gk~CkH+9H#Nh2Q_-nw2gBX%2q4IhDR-0p1(K0$Edh-{7S$a4kGIm~0U6M${3}+XqlH6n;ny zo)?2Jh{5Y)@CRb>^)dK1;F~dDYV@=Me>@7`5B%9E{2kysqwtf!_X2l=R?1%&@b7@r z8iVpf5f@>;<^2(O3h;e2|Ele05GAY{o?mju3m@O$e{78Vgc!UC_`8^dau5flR{{Jx z;2J&kz^}&qw}#x2=xX3^0Qaf*2H*vlT-K`iuYhZY=y?(NVYm;)JB2?G<9-@=814?$ z{cMc;-+)`tI1Z@!O^B@3)bTn7w*&te^Qji!}wck{oXET~?Oxs@w^z(y?eP#0n=&$nVxrz}1ZKn^wwAJ1%gj=_b*n4&aoK(ElCB%Z=t#j% z7MG0~Kux)#n4y?1r1!ko9@&@j3(<-qmCM;_xA*>gDpx`7xv1x&iqh`u?CQlp^T*w=(iBw%3O~GBg4_CvW|PZniHW)3-&2>!|ECILkVj;VXOW8Oe?)H#U9jwV=`(V{ zQz{cq4~6RU_LqU3=mrs}xi9p%R^Ja_lKVtxUxcv*Et)$*ma{1R>tjX1<{v74ZEa5uvRWaWZln7$+Q=#I`1ZOIH_yjN$ zNG3gDHr7WfTtE=^_Y<58-UY#V3XhlK`$IktilJMF!m)uY-S8t z$0XF_A&A9XKZ3Pbp8}HX{bIu5pVmhS%NhF75;DcCKg0GzL5YkiO0)h|YjDaBNc$45S;4cyI5!@vr zi28q-;6scZBKS+R7lLz;4nef9dr=nTZ@mg%CAbc}B7$of`zOI!SZAY*64qnCNU#d+ zis1FgA3>!5f(lzOA_)5y6%y}GZ$G}u4Q*soRi3BhNv&qUjyemIKYOzc|;KF`<_1YdxEg8#wT zMHQN`H%Rz3v|SQ}`zV5NpP|AM6?zH6-#rB3Z>?(of{M4R`0FZuP{oP&r@sdMh2U76 zH>vms1jk`K08Dre<=GGLC56{lvJ?3LuFprihSOlQyM7pt2onEfFpeI+Gy|gE$>?0l zeuW^cIgaMYA*zc*WS2wQr;|T4DGo&yqN+I#z;rLt|4%cQyW^7%+BIWPUj_ok<8i8Z z2I|&5@H#A-oz7#jEA<5aL6(jTmyHXPF8$hp(w& zL>cl!<~}^2&C3z|kv}xsh|&C^n?}lx9IY6eH%ELaX%b5Qql$sO3V+1LO$E3X59Nd2 zDNkCN;FY~P1hPbN^rjdsT~*r&S9~GD{JT3yy>KKt0HuL4P(ka6HLsthudPr`nc%Ncsq z$41>0pxA298`9PQUWHo-1`AWAD~sT^ICm)YMNG&_^y7|{B@pL6rU#ywrS}``NgWAU zsacTO7c6vNCzlOzdPowS&e*xkV3S|Y?CqE5=l17vmpXEKEh{WAnvN8&5)=ZXj*-YS?H#)j>|$ExZ>lWAS$61nJZ>nKZ^NZaPFLa4axAaLi!+JXm=ijR~QANMDgxV78P~ z%3b2#k-Nk;X$K^=^pYmIO>!uY2949B@n1q7VE~#Ird7zTCrbC>rU%RFW1+hKvIO_Q z?ogKq%OQE#HF!&k+@=;px<{?t zriSE7uOmU+wVK^`XdG^D&}}OL@}3!U?sl^+OL5!kQ{?3q&b$2K&>{%P4(_o9-;<=l&1nAr3b5i0l^h zT?h0nYd=~`A{+UI$9-f+u5*{bg&kO%8WK`)t7a(62?mT^O}(d8XY4U{8O%awzVuhf zPr5DUu-NN3Lipv$cTjC@TYF+HNm3>hp7fDBxsm;;wWs1fJ4SUc49%C==+3}iIn+3% zosG^rjTn0|>j2P~&)&!g$Oo?v$cF|!>=ONNEZ87d6nqvp@Mu7xELG?_Ago>c4yRZw zJmjM=pg5IcJGfvAx*5f7Es40|&2(e$qC&=QVYmw5qkA z6z?%eefa$g8WT?W93}dIc7KY-1QGWHgsj^0tI&=Xak*-;g_KePT8~*D($Q^6UE!W) zxjt8ik?Lt*u7?e0pRN`ay_XE}?<8Y7Sao2MlgQPs%Q(OoMVCbN69RjY5Hi*INz{r!H>+}el znJSat$j7oY#8ig9v=DvC^_c7|I3_1?+2PwHp*8FdK_6s8N94?c4o zj|(0BWC_dp%KxCN>m=PB5v4V-Pla5$qU%Aa0UEXSTS@LS(fw&T#m7dxA2^AagmGv; zryvveBvJ6&z^^a{#c{biqV?`Q8l5?uPBu)T^o76;yez(;vJmN>C2m+c*@#a6tFp=Q zs%#JkIFH2jIhq#ANJ*g?5;sbeahG}z@9}CXEc;}TMrTXTt>_!N(9D^)q^GCPyk+Js zmp3!hDYO_&3mHs&_4w8aFlXRGnckBVlH-J#9=w}17_UDC_O>5r!};a z=2YRS*FcfwQImtTcvy_Mfsx*{z%(2;>oU;7ZbZAEAqc~c%F}x5-9%gb0K+EZhRRM# z&qT7!*|=?CeGWNQO6t})<1v!!Q`+(`0uIT7TWEx3yvDM>2r9L{E~?fqT`bv6^*&ls z%5&uf-R>KLS{#%Pvpt1%j-ev~{bWgQIcE7Wa91SGDKB)#Vh!NNAWAzGr7k8o1987U zcBPbsKEOhcVB9`9=m=&F%E7GzjGHVTjG|X3y7lMYoM+gC^7bc(Q=za!loBm-kspQn zOBYA&PV^hGJ~C`JZVn+$gStMtc(NsE+?IeGk&D&yP+QTp2C-@MyaIjeYrD#HKa=Q($1(@|9o<3kd2;lVaaZ~Th44#E-b>^4BWn+mb=Zh z@t~b} zchW!W?7F^n{R7nlq{Mxo&!(iXD$}@r%7v`mx>L-y@~^+%HIBD}u4==k^5AWzmEU&l zLU_yr2D_e*Uq!AX|$CbT2%7z1YF%-aCI_qi}35uYsDJd$=!B6iah^ zFloiQN|N)dhb$qK4~v}fPSbgm++e-8sv0iv3qio;^{U_?$scBWCyMi@Uti>g-fZ!v zg6Z?8&zwr4gd{XrQB@)0my4M6srpi##eSmf;%$iliEb`yo0MiAsbe>i@4^7^*_-$D(&+ zgd1Wca0I@7CYck(DDqImYfy}d*c?&D#KV6U<)7By&qX$f0@n>fdvnE@n249PDn>hQ zY#mu^lz$3e5+M_lKJXoQ6r=d}M7fiHRWB3X1Rmelkqx+#9|J8)xl!DQM&T6x5O3k+ zLEz`+2f1JRQ_}NCxksGvLh@M@zS|hNj4k2BFClrX>3||0u(vo45HY0pre}EKKy(|D zzasaqqVm)2O6f;!sNq2JSml6J9aJZD{(nzY0NR&75`#Y$gYSyL{}6*8jlusCgMSx; zg9P?Do_AnR^kfoosv&wt11EVU3Gd|YjB%%P0nL#AdBDGee=pui{-6eU721O)AMrqp z|DC{pj`BMRNdDi9asP7+{*M@(*~!S}}CZ^z&#WAM*n@Na03&EEWl4kx#z~Xvj_vH zTarT6k^~6}E)EebNpX2;hw&4}{Fod>{un-8DayWzfA~=b?O?H6U2V^k%bo|^|L%(< z-6xTkRg4@hH__v0TP*}lu~XEiA!6<{&^h=Iz80bBi^l)W{xtTB%X3E-JWa3FVj{SZaouK{V0r63Bwp4FB5Dy zUsdtPR7f((3Bwtevr5QO?#d9Pxm}NGqmv-!L4J;k^lrqsK<;$}M<{bR=?;4dIGrQD zL-wOEuMiv!8F`EY#IB?0Fp{Ja(P&ou%E{eMv5QG#GZ zUm!Rh<2eSTgna0KBshVw-x0(i!EDe<`M8nbM9lRBK_AWG36qdNf>}6UC5VNFAzs0U z5WE`aegv&Jw<3shoZk|p@*oJ|`S%Gr!53HEGZKI!pIHP8z|$s}jeHUW{c8wPz6iQ- zu0^m=Swm3%-vO@2BIyX=;Hz+6L{LJx6P$)h{E6mr=Q5p$Lo+m9lZic-c?SnYbQg-& zRREE51!RHas2*<8$wQPOzhqG4Sal!|guwimKL^|>44MNs8Hf+n7cmqE8L}gP+BwQ> z_&ZJxs-b+4`&1QDyku->b13eJAwTrYR-xuF6aJzN`5{w+2YK+)I~nr#Q_ekB!(Sv2 z!fEjl)bdL4U4TE*b4SUe`Tgj*2c4TrT4BPU7N7D-p2)GszdiRDn>X$!>-bjhd;H+s zV@<2L2fWczBXopZc?vx7kFO-|IQXT`0&~|RgTc@2%q;2E^*hrm-x-{bmAt%m$XUUV zUieJ=%f2D)3&BOFGXov*Hw;;AYzTIz#Kpl$L%Jo)qTdJ|J>n5L<73vW-}WK&S?`!? ze(g7&yFJ@nU-H5K$K@};cRuYuhMW9WXo|Vgk|mJ_5!OuF6ACkp{#MtY z{EGIaKN6p9tdP?Mw$@*So3w+3XV1@{@ve))Jl8}^D|l$!d#E2sK|@Pc^##&t`L zk8XAOLJuK-ujX%aHJ${|-J2XvN+6EAD9w|sq&MJWXe|LZ*KnW{+N^2=TcK_Hmdtf> zoXG5req)yjy3mDq8@MeW%F`UZpcUvk_n+`~4E!jZ9asv%llo9z01l_qa!_{Xq71!L zcYCQk4u!G4<9x|J)1B)5Zl|Q!5YJM1OPY>y zvBkQZ!eAxx6C+=+`~A%zhC1FKsr>K9?cXnFGYi@c&R5WmN{^w0^&7Xj3>%Ca*!i_6 zabD7>nRKe5UWH0oM>NDRn=`b@cT_gyrh&(7whSo2KQ!0D272)fmRG=4ac_9Bhh~)} z{@wkrmG&)dTr7my9AN_MI;>}1ZwUIstH01Qsv+W!+_ji$X0ALz1h>#ZoVK?R6WP(Z z3u>u1N+7RLwsg|T4{FR(U-W9nol+{e!y)Jtpqj8)3VCbP^w}tU)~POq9%15!2m5-cMSOpijtNgEu#Lii=P61>c#k2@h zpVh)1UG8a}YJwkUXonAa3h(F;;=AJX(V7uiXbozIPQ*lNQ!}b1IyE~De8+2X+f3WHx!(4d zNVlLxkRK`$a`Q>H*FKQHc=a{#p!ZVxvkOrsSK|Cujm1Z?6lV7EuP%BPCwCGr%N@Zu z^oVJ^M=Xnae}d{|{09EN3+Huoj+|&W`7uV~JSCN%&+xN0XrfB9kp4EJLy$cCP_C%0 z#8Vj2)U)1n%CAG<8mdzFD>{>@b!s}6$(8gd&|K4t+QD9&2wEO=4La_p)Vd1wx~{kM zTU~vRtQ&Cc#TTuAxcGwA58nRaRQ=zC@LbvA9NVVx=!q*Y1k^p!VK&`UKTeHt8-jjMaAv<1)tXb@laIJ+HY)zY^raWJ4z9 zl-WXoy)H9G&>|zk^qwXOU2hBIazZw2pg50#3a*_m`z*>2+2Tv(%WeqB5r#{jUuMH_ zxzEdy|M|G2y%ZlL!5!v$er=h!l?scI&EuabRBty|(RJ@y(NlH1hy2mqX6@Q@Pg}_0 zDSXF8^ffhp)tmMsYBZ${xFk(Uj1avIBdx&F^0;yBP$br5*7% zwSA8Wn(#RR!sxdKIpU>A&HTh!dw=ptoVYum!f8s;Z)JT2{<1LE{kc#(*WALYdAI9TDAo9OI#{F~*ekKNwnufmRO6laU~6LBDcrkouTb5IkC=;Ms!?&;b7_X+W7-1$ ze~K+O?#I|-4)xPtJ=t3kUds=yfA|5ffAKZYNIXCCEvpFc>!;ouiegKt{F@%17gYq> zfBd^xKg^DDQ6TDDxR;q0_mE~kz`fyOA}$G8cin{ociQ1BVhR>}Vsg7EhgL4l+_bT|oGArDIs@vI`4gLnxJgIpd#q(fsB@o^3j1P?)n zwoQDO!35z>V-wkrAlL`}gzQHm-vo(i@DmM=ifI>iI znTIETG%97QII_>p(Wtn{g3=;GB$EGs=g$E@6b9A7&2hvxTYV=$agd4SYuHeSe#MFZ z6MYm&HUUn zx8A)K*nK`xO19``SpLWVt6j3E)_C+S2nx=>?a5 ztF1$kRa}*6lIHshGkbA)nK-ToljQz%oh;{IV6>DkC2;--D9L>qRLr+*hYZw$T++xs zA978T5ssu!=V7-&v}^u%K?d(C=_9`#(uQnv7IyGsxI5(o(hJzT%+B38@Nrk-2}RE3 zpgemHgFbwU13K~r-yZ!|W<^SKa->{Ji%XEb1L>v(Si`^PXTyFMyh=J4OrNglf_x}w z+?AGv9l%wJ6jBQGHnA;siFU1Q$S>q!PKtXA?RKu(6x=!R&0ySg=u0Loy;mt({?=j* z{|qW;1|A0<3=t%|IE(fWq0|SUcm4`#5OJG!fL{Qeaf>(Pwgvt&+j^vbVVLRPz#EkX z^vH#pP%D&LHsmbycBkJw@^)UMM(nOg&ZecqFcR`HLl*>|4;yrlF?FTXJv+g4!q@B~I|m)UEa^AWr_#rg{%YgMAtw^M5_IOSBtfAQ z6o@XQj8wonIgZwoc=`|SRYko!4tFurd+paqB;jlBAS$5IneS<}7)6QVq4+4rCP{NA z>6;8lf!wuw*4c-kE%oE6K0uJN*vr>EqeV`gD1A zXo|5Yq%+*rnqx_ngK|lL-rQ{{(N9EG{#Ot-u$&_3jQgdZje4^~KVBc! z_qv$T`*gE>QXDJ`SK^z0Ovn@6YkXJK7@ zUg6;|6Ap(3_D2aC?+!eSeJ!KDGXtPu`ja!1=Y+0@(vTNXlw2Vn)suK~@l)j= zlu@lxIjljw6os5dDvK!>R_vyHZ$*bwgu z-J7W9qu1fEjva;;LEXl@1T9CsS}Avs9o=S@btS1md`D2Edb%RW!U+hyl0qYtK%r3@ z6#6jw4Z<8)gOI&i4~LDt^cz_gViXUDO^Ld#hr@AZ`!+UCke>#T(A)1T$e1=~zVWpRhQBVqi5T&p{kDBC;- zvTtKBnj{?%CF0w<(b|%BkaVFNBR6TSeOHa^aDb%GAm27;=wb>>PcHQMiqPXrV>@a% zFRN^UXBx(5k}hSNQ?eA<(&t?LPYI%#^HG(a&TKEJBlT=avB!uEIx({MR;28iZNo{# z=+HtXfS;?#NK%fro3f5RTQyhuw2I`nABT?VIIEt^#OVfqdg{rlxkdWziSDOMA4e*G z=+Y%*M<|{P-uY@yv*36n@GeI3kZ271lA7hZk6HH9RTg{+B|{jS)vIe}uX*lw<%|QY z>rcHptKOB# z;9jS|pLdLDd+#qZ1=hcy>$5xF!kfaC7p46DRF-;AqCK5UsL@-B`ev{v@HZ1_9rYOa zjQ}c_{Qb2g@eN)UmXgf8ch&`8p_U%5>zp!2;!KLf85fCD=jUas`k|Q2kg4}h&EbZN zpUuPfj7eaurt(fORlv-t9}Z@WY6%s3HRbqNScN!h)TjiyZ2~jBVOYHgiMGnyA@4@2 z_#jADBhuoZ3j>fCT76YTB^3N=AsRfDBDrxzdfILR+We{-#TB*7NcmqyCCkZCgy*1P zZ+U4ogx@%y2;YH(kzP(O6#q3;fe2V~**dNb5SeJGg(x2JH@fMk za1+I45nX;uvHhtnSJ_B>-@}O~FH350&6?ATJb25+(c+z6M7F37cjmzzt6w6jUrWdL zdLtSHp?i?N)J?*BBqPA}0FrLP`Xvn_)F=|S>c1T?Dxw(g|JXOysE)dg!qdSW2-PS& zr~?`bo(%Dznxk;KztU}toX7M<#KOpVRCKx7Tn=zak2!EmOCC8-)ioHWJ>5 z3jjS%sO4#c>B6oZ2u9x+63 z9Kvoz`Myl~LHHqnnj!bx82tJeyetN<1AaY<(TlJY-y<>Zn_}?o!1u$yTlN2HjQf7z z0``Bj=cD+TwwdeZVRh@r;reU1XcyOT!`0s?-@ofAfECNB`5{9lTKK42081NKi=$PR zL>NyrKF5enafLFf_*8c^|3*zigx1*am=oD`r8O0`OZjk0;ysncTy|;^l(rUQ_`IEe z^Op!Azg*kKzY{N`VY}E{<*kH(SnZO^?(d>=Eiua!-5t@zL4$8`O>HskSY2iLa=3S|o6zbP1iJLh?`MCA68L z$}9gTKlDsfA-BZe5%`NXTGR_*i9C2UH}dyW_+)V?5RVoJP>YXXWNO7bt)WCD05%vu z8=`!q;vsUhvcoG|k4gBb771|e6^lKLDfJOXS>)dHkMPNI^Tv+N=L^<sPo1QTd`Tt+DBAXdC5klCu}< zx(+bky60Sdj?DJlmWeMd-uA|Pv&4pfg)?6!Zj!$l$!}k-6Y{n-Q7HNr+DCyKJU5fy zK{_#EIve`+{1xtI+yS-n{fr>~Km3bM%D(#d;2Y5xL=T1&%sY^2yY|U&fxf@}E_X|Z zn5*kz`j(Ev?E~*k!?!FF{VAPs_M{UJx%&I{4qZ4y|JFjXHw4V~a{;0q-*^hG)IWst z=!EM8$KBxd4ZPQkyIP8y3E!5`yKlL7`@N}d)}_bpfpt_M%^`T`ZiBq{#w;UlXQto| zneklp>|UG~b)Wpr(zoSzmOkmJYRjrJo_ljP?R~6OxzgLX{j`JM+&+1K+Vuu8 zZTipM#%~|0T;W#ugpi=$~1IcCFPHcKIm2;c)+w z!M6qH;>2;oy&efPx$)TWU{75LKBwot)?UO(n~mLd6SLpoXW95l)NOPx>c*_M`hA4%XG@mv6FuzPoh1~4xNvcF|4d||W}lIEzpIxc zPs@Koo@)MOo+$P|1ZSOHdqr0dxt@FcUHwlkxuuP`S_7oX;AxeCr&SD|);xS0`#ZX? zYc_Vp#qaxWp@X%rb}jZZ+Xo#d;aKS!Z>Fle&7DyZRr5^p}ve7UADRJS~t25ng1L z8FDY@tMbCmE$-*=Pn5T)U-?`MnAm3ZxVbEdA}RG(@T;c^mxvut?cu>{7nKiYfyd<$&n3PztAu5i0g5tGSNd(9DE;syTVBh@hBbI89MF!5T0n8;;4v{*k4 zc1l~MdxJ+XAo=monshnZSOXsF3pDl;|JES+JP)<5qn25c?LpgY67h{zN*8>_61toE zd!KrDe9&5#6FL*9hR^q?VHVo$Gd*YOic6qy$7IjAgz)49Yny4?djp^==KN7#xIeSL z4SQ>ez2pzLYs#Q$VZJAQpZ?=4DN`y(JNQ1J3mX!$OHk*DBT8;YzdN}9#w_%{{n;Ms zrxY`K>3;Om{ZD$H-xJ+S$+y-^56b3Nl0F&YuSTn`{$Z>B7&%SlJvCPlg|0{XR!m=t zo@(rR>#{wS((Ud&B-Q%`PEe>Qs8y0smvJ?*hFCX*4FFZFW=G7Q7Grq77eV5+*%~|L22j zlR-pnkF-kQ;JtwxiXRIbp*3LStg|0vB0s&sZ#tmcIN(~th5?|JC?)*}%1EE2_7Y~h zFL16ujmAA&?bbkdF345s9ZESo5loj@kk%`|#`7Q^6CRpO%K#SQNqyPivA8$L)ka@i zS(^c~mN3zGcgDW>&X&7{i4L;Svm7}hEjTT*R={DWHaUEs` z+<{j7pbr$pc}!1Ca&MBWi{|fPqmoX?bsaP?>oa$!@5}0Z>2AXwVGL}Hdobew>YrG* z#nta*vb5c^!sEjiYHd<~xAMJO$VWLo!!&1gZ(ne9cz2)X`u9yrT+N-NhZEE zORdXU6ekThndeEz99mt}+*Y1B$77S`%3~Y~&oR%VL#mJ6y?xyvHyiOyAfM|Sh}Hj~ z^YrGWBeoT0&h}8~3^&bvdJkq2@ja{vj>wb9Z7yw*zJ^<*P23 zF-byAsndvUhc;%Uqb?kX!GN*io2!K}Yw)kUzl1yK7MvzE$<^cZ9;_S&A=TT2+(J2b zwt@?gWqU*an6C$Rhd>lM1EBDz{Modpv1ZBgXMlo?Ygu!&gq$8<7P&2RhUX2$+Pm@N z`Du-}wka`DtXtO!xm%m?jjl<|PLgNj+Z@TqhggwlXJOR#jt6fC^G{rFx_Nv5uSa544+r6#(1PaaH~$@j$z?oyt|-n+(ZVo5LWPJWq#j z(jgD2(2sTQeIMOGPt(O2lQDMoZ(^dn-&aMln7{GiJUz6aX@Ql2gKu-l(9V%5K8v_N zl4qFuBV}MH6Ejt&Wo<)fsbUzcp>j@cN$;o)c7~HKef6~JI-BB zeI#d$zuP^)oqBJa?a=Xg_s%=ZtSofhDgmcolbT3(#Jr|!@qc5}bo}4kbRGU(tFmw_ z+yu=S%zv^SwBW0$Bg|NWgl4Wf)$Wkf9OfKr84LZ|w*~79Vcb{k_XEBJ>fc)RK309E zuDA6pYg^OSl5O=^_c_K;-!W47&zb~>2|aQ9iZN{_^tKFX)7>=3b6b;W5v9F%T>9(t z-ygU_-XCY*e&R(J3%${#&tq8Uy|?g6)BQ*JD(~W@`lnaZ{bl;961Hw*~@_Z?Ie74X#&2wbd~>F`#Aq}`xyUq_FVt7 z&=_F0)5+wlvvd34%Zpho#~Iq*M0eLO{Wbr4W_$P4$_w#0|FJQ%ZRLf(?RpyDZT-)H zh%X3IuV*&W4pfnQOBQbpBI#XN16bY>8Wt3V8q)z zycOVWOUF~;tAtCI!|l`CS=LjfMQ4S+WmR9bQyV^xGtxexF#9c5?borJtUFdK?NyX4 zD(z1~YtBab7slw(hH|w=t`ar{QA^o$4i?z;agSan@6R3ytsO{>g)aKaswk}#q@@dO zeV`y6HOfQ1vg=dC@Ctu#-E|u8d-?kdyYTh8VaCum`q9vLGO-D5GZ}4-tzM_I_dP-F zQkeAM;O*_ggx}$Pb(5j<4$r!U!o<_%>HU)?0w&j$o+c_~6)jTWlkzD}_B zJ8nnJqd=P;E>kWH+dZ1--fK!>;IF^y0`V7jM}GYLWWe#@$UXmh7%yBM8bv+{G@fb1t|`sE0J|ogTi2z} z`qSsD~4Q~mEJy$uYE54_4hKfJ=2k5rIyigv1{jzXQ*Yy=NM09heTb$ zL}SjBiv_z#!^_awPnDYSUCD{N8b3!*=5={+XZQ^ID1ZO$&aN}mH&$L4z6)(Xn_|56 z%v0f;&~{r9>lEHUSH@2Z2ISB3+diL?J>!fhjYfUoTWhwLPxePl-7R7FzibIRVp>8= zFu`T;3)ZWV>M(~lXs4RZLg_&3M}c3=z5-evY!368tFzhgu7CmQQahNAbT3`}aHoQ~ zIQHkAEQ|b>m4-i8#(?qM{*ODU3~$S%w)R!~wskL#e7qjt$-{1%#?&bn=OY}_7Ri?~ zw!UR*D`{_Pr;(L?{P}3;r^&{6MlEdR1^-TJmG69>9Mi9o;p@$vRLUJY7Y1D>>?iT0 zA&!kNaOAlJEy{Tw@qCF}vD$;B%Q35X$_KN>$1$3JKZ${$4 z2KI(ZPR1JVH~oyRI}N7toiSynUzh3dt9Iv@yso367L>%@70deq*i?I_EmqdY3gm58 zMBXqzh2Q%q^Rmn;_|J^+htyBZ8sAi5YU`F^Rs3i{l6X4Z4EJ)O{+!wHi02o@i!0=RtB&VRQQuV?udFb5SZ*s;Lzsol>1d<_B1biLUzQvYHL~ zH@6C3N@qV;OsY|#(i?_c6-MOBrSlTs37z*SX&yOrVmSK8KDWaV$zzjBp$nK?59^n> z?swn6MD7C!tqnME_+gAyQ=4sVz|YSVsn289c3Ysl+;wJSnVN-yVnyb< z5$k4@eGqvfMEXylQ<62Y5w(up-tPZK4|aD=ojUamnjhW0Qk+|_gLMg>={UD^7ihmn zJJ`NP#icRVoO$3`G3I|-6SdF%9gm%IvH$w0BYutbQNm6A%1=)PkH{y!C>`d`j_AwE zYOu16J+j2TK4F4u1J{P+bsF`a&%7wv^^`3+XJ7YkL+-7V5GA_ShF;h?cPF_{qK@Bl zVLob>d?!yWDJy@b?5C$<^jI&_4`?YxO_=qH)bfe~j9GP=gRsXFbJ^={0&^~}8FLxG z&aX-ymtoO~2P zwKjFSwut1mBKFvC1}k51KbmH`9+`|i403qf`)P?_4p*W_I^VrJdroeTmc8R=$GBTp zR`WKb2~j@K51#Gl$j&MUAJs2928Z9DT=TJGgTgC_G;=O;SV4Xgj9f|%)rMo z*Mfk+cr&oM1vU1g*y~1!P2!Z%4}4MsP@nz#LI33d)a#RhX9G_M-2R8Gf|f_Ef_93} z-f9)>NDJI+jcU2q8r^=cH4KV8vE2RzE7X?989@`91xAd>nFKj=No= zCFXd4F#~tFaP{KRb)Wa|zZy?1ma*e|^4Y+%YsdHHvkTAe9rwv+_m0{ZS}e~FW4wyv zfnSu46NTq!9VZ&kF*;7nj=`h_jz=`)mFcjdv5#w=h5EPmUr8} z+wS{Z3|I|rtM7^afq{X#qeI8~prW^U9Zk`B!QsmHp$)eU+xvZbl>_r_sTQw*ke80a8?~J z8rB)5zjH5db;q8Di%}mV8VW>g&u3qpJiSf0>S9FG%K~1zg&WVMHAXCis@FA3&=fLa zj~!vq-NJ*joyHs84fnfaJG&1bJ+@m!eb)IIJfbT>Vz4{5+$$Qsay6ZG#cu!0u}@Ba zapd^1p6wMwM5RwG9V6;x7HXv5qW7MrPV!ID_Ajz2TgGsLE*vZq(&2G`}*q51J zk>wSWi;dXb!n<4a@BX6aiz8p0*bP3-BgeWBCH{+(N09h{p03MdL{@@`-T7>0jPMV1 z$8Hk?x1T=N)AQNMPS8pyj~C0I5sSZV)O^Q?J#q}?ZXAGePmU28H{wul(CO_*zBt*_ z{l$sx4Jda3N_y(dvC}=hwOeu{Q%MwL>l4u+%V$aCT^n58&kKyU47ltA{=V}Cj(Mj!4u zb6Q;X>EUkF_->JgA|6APjX81Ri@$6~L1fPui}cgsuv?7#>~z-`r$1AL%Lv!Zc)MaQ zKcWlnC!yUU69>sF`-#}YsJ^T&fm5hOIBo5^H%fAOc?B1cyGL=|Jw$v>gGoh_4F z>J`-&in@#0ySLlEyTuhJkM9Xl&^5r$-Cdboc|#Ws|oN0E0;O{L`&dnf&%?S^E*PAH|} zg{9}!R5zkKt1y&}H*M;5P@n4yOfQ-`t-#l?5@YgYURrHf3B^o!vcuXk{g76$vW8lJ z8!5bRyo>=%BZwps=oqQI9C}KcDuL1k@iVT5PUK36JSw(D`6=?^S~yFAfaIjX^;-yd z^4(gAs;PzOJ}^PvTHO>J=cAI7dX&j40?X@bsulC*vdX4l9W(jw&|q13Pq(aERSq~B zmp4@V8cS=zz}W4PfgMsiHDIAs$j zu#cb~7DF}kvgM6UR2_X=Wka1;Ol@kaTvktZPilWAS)ZhPU7hR(Wu@gy+5YvVt7_^> z!6i!JipdBuP02DsW0Oylwc%UY1il^+(&^xWux4A81pnjsG0#z0{QntWCV4b^jgkq7 z?GEt_tP6)oyd(Q?I6$P1;b@Tzzud5YbRWJHa^8?WX(^-V;igU)r+=CQXL`N7cZTGp zDYAouo*&QThfqe*-yab_3F`=D49VBhn|`#^y@T1cHY$F$BRtdJkG&sd49R=bYNJR$ zfak9qIP>4`2+#N>v339@Q?bT@)8F5(*S`>tH;41D@{{NAXZZUZIMZA2!0A7qjBC=U z^cFdA`v1a#GyZE1oc?hMGBW-QaUK2-IP$}~@8#2t7K?yybNI{lbHpdTMGl<)YaBTJ zk2-Mry9VJ;8r?s@3ufbzz5{1`>L;=NOYm?9){4qRiz+;%Iq(|bpE~l}0Nms7XJ5M6 zfqw^hz=1RU#~tYb4IA?DGC#d0O6razPF@|}Eq@enA^O+F8h-__9(a<*-vV6gz)t|* z2Aty-<2w!cfcvHw?szg7`GV=@{QsBHV z&M|=a#Bg0Ip02AR@IVAUHv%sQ{wvse)G_JZ9^oH~z$5u|dCqMc=9jc=L;Mi%9Mm6W zvyna)*Wxg$DI0#|+l__$g{X#+8ovbi6~JpXJ^}cXz()4K`ylfd5x9j3?qaQ5A65MYoC znFurMkr7(44C6|AgBV#M)qwI(GDi3EL~C|vcu4MOsR~qT|CGu{u*kzSyzZ&-fOUM^X^M=MWwvz z@-@?Mt&Y$k)Y4|yW&}O=E!LtU&!M5G>QaQHOc@nkySNhj2Q@Vix!70mKp*X-)wn(b zxhu7`xMfqkqPi5@4OMkn5i!ErO#7@G9P5A}RFc|E-oHIK0@SYq;^ju#P@NW#{Gnekbwxu{M|!{{IwGz z|2zX^{ykC3KZOwK%+zopA@W^Dhiu2k!$i+|Ygsj@FQKRff+dMEG1ngr7o)yAeK2kQi?q;WzQ!B}Do` z%rOa96MhTrM~HAeC=(&)oTQhaVWNgfgrm`ZgqMN7b{|QYhPaq3GX4Neum}%nxDRdW zEk$^=C3RX}O<0KUGGRH^s)QAo%MwCL~4Z>`ck1z-C1>r>0M-u2E{pax>P`BN`YtDCPVGU^62HjB_T))8VO^7^+ zfj4_B(#E@h>K8~-e!tOd=g0tg#X*Zv8I~p;mf=A{ny(AzhcDycb(MzUcG#JM3u(~g z!ZIAHOqwA23g=|DVHEn$(2#U#5`E{t+b|b?c3v57GQv5H?NmQR*x2FF zjlyN6XPwUx3Ai1O(2;G?j&Ln_=g^%6x`(Xi1VFZhU3YjC_2|3bbvW4cD2Ew?_PKW( za?URUBzHnCZavWa>$?p}Bbc%X-)$HKiFk2i;v{!J?*bbID zKe_cr%PVe_XCmHHNnVk5y6th1C-K~Q@8bS<(v5D(qx-Np-3fVokfsol=ZnTezlJQ1 z7)TX)4JWTBI=^ZaBR`QkpqQiILlSGnyaA@j82u5X`5`~!TMMAE%xJ#{HyezsB>z(? zH?i+pVp~AxW)N}{E9S}6V^1Z4C+~FIkHsqsse@>}hTgWA!U<-~O!8=|8y%Fh2OUKz zCp#r?=yx$J$hkf1=h%+ur=!fM7Lh!s=hcQJbA;*M@D8-b@Pu^6%n9ZU$&vm#ZX4M8 zS9r_5ruAbhc4z*qzXfg&cs5YSk9&(qf6eOJw&m?_I4(*E356Rdf`vt@#LgZY%{TJLEe8SH^Bm!!-O zZv08m1KmFf$v5I=KJ&CKXzRc^(Z&!SpX(v|e{dsx@3ETi9|_H5?a&=W-r@9~uslE0Rv z_iTOJTG>Lb`MlPfzzG($f&bAP7V$34hKH;SpT`HOj(O3Kyl2JwqaM26O7RJ)iSRvZ zc>NwT<^`k;$uo;T5+gsb;_644hpeO@;r+^aDgPU-iy%QXSN4RYY?0Q}_CHqKT!w!s ze@5#EcoQkF^N(%N3?_5%1|*4qmma0dPWIye=FGJ?(L4b85#L)P#@yKI+4{kfVLR#W z+4|5D^`3ejLK!o?HN!jytYGr@YYtfT$usd^lbm|cvsv}0f;}-P<;XPeu1xU8zXi#( z^3K7T)eU*(YnBKpS)|PUWYd6T4A#qYonq9}okLM;Rh>idp6J@r6h+!Qt$A7#6?kxD z|M6@|K%H$U`Fn@^&m&!JodbZK?TE*iMS2GM$xqsT+PNBiDFk~P>=M`@Y!xg%?V<$s zYFK=Z<##9HrDxIGUP*yuQCWw{lsY>>NXaSVcO?A$u9<7ViO)A3cNomWJ3PKzsYOYE zC-6+@C9Au@_3Q)aFqtD!kx_^`6S} z&iQ=Jkjn!x$NTjczPAG&^8+il{TFDdM6{X5m)||`7A1$*FXiwinW;NjLWTlALUz-1 zpZWRQxn`_R;}x7P|MXN|%)4!vJf|d^lnJeRP%2Q+x+I@;BaURG-6+w!7xeL)25&N(3V5` z$F`Tg?1sj)*C119oH@z7=p&KbUc=lzwiFzY6FV!C%>FX><-qf@ZH%#A$p7?1B@aXW z2bc8Tj#*lUTn3q!-{H%Xl)07PpIi9F5SJg=D@I;`be8U1V2$)8m@_4P`c1P&h6owf z$bL2d#0SHmsZrgyQL>o?q&}w^%-_3~XR2TOP1!kGj(8&de=sf%&pgs;=S#&cmHkib z3D7-x|EQp>lbyZ+!a1FH9DLEZ)6~2YrLiV@gg{2@ zxTpV5_=)b2MeGyf^13c=p3{?1LKlAfL|1k5yH?2W1E)0Z;Pr$Sya8So`nsNcr6k73 zC&Mqg<}|yuz5yxHID7-A?B7Gi$e*HbPN;sv8khUR(l@Mwxu@Y1yEifQ4eP_)m#r56 zPoX>RWos^EJaY^k_WT>*{(RY*4?K3SCsmC5snwNx-AA}n5-UbQl1!}1;{j_NHcv&@ ziO^c>>bb)AvoE`H|6mMrT=e3KSTUs&%b{Bb@BS~yaXX@9Am0*n~0Mp z#-javF36}kTHp>GvM{$lQ(WTtn=8@Cy19f@H{@fK^Pl{X`TMVsJrexv%kBarC-zic z>@)cR7fdp*O5-S>B&oR&3)kBR&2j#3;DJynTt0a#W-SW>pzk z^~+KNd6_Nws7^?uAq|l>4|?VJbQ(48N4;F8|}~9ORcHhRW@1 zehdER4J$YH4QonLBjWGNoq+%Spt98ycxOUTBt!q^{lMAgx@brM?ze_Oef-cdhaF-=%ui(cHgxWFV{x zXUmL7%vdEI+-(+isuI53+21tem?F~NMK1Pq`ewzapuW;>M;m14mUmv_pz{ny`Ch6& z>E!(rJ1>uRUKqxF=7ZpKDZ-q1E^HobK5RDZc-S=9KVlsJ5H<^za+10+j=u%_EbI!{ zT3C+rJcHnRKyJ4*)HT(W*VPoS2o~2jRIi}G0eDH%#~){xwg=tyJRJLUkd08cN`{X` z9{!)0M1&u%^X>=Cg$=;6d^B0(GspXVOK?cpm^YLE8PkH5wd1kBR$7y>V#4_BjLZpF zWGpVLD6g7Sg#{DOT5X{;VOhtcc$=DjUcpts3h0Mxl#-AM>*{f?4jKF_9l9)F4)s;F+{hAoNLRF_q*@HH;4mxZTuSX6x79J6rtbS+ni=h}1TTr0!)ih>kwf!=`1 zuLKhVAtYwglN+`fS1;wxE$S8GlgJiunLJeY`>Lya@ZmP454(=CzChC_1t6&w4iiFI z!x?M@U9(hH8d_0ptAf)&b|~~2^a=DmlnfHMD;qMneLNXWCe5gv<-W32O_hzl^xpPu zSn0#=r&s7MAlTL!b+t8o%lJI`^2;S`b zWzBeU!HjRfLqi=7`TIJkH~&BT>>povZIpgP8^dmv+*|71K2p2_evH$~7;@e0w^1EF z*Wo_^ek;S9DN6t0Y)5z>o;j{71KD4Au*YnsKNfh6_O%@IBu z&yPFsEAae;1LxY|LkB($&pi&j5YK7h@_4~rh4J5kbMNgdNBYdqxETCNqt52D9XS14 zbquUc0^o`Wyczg* zxUYjHy)6;`j{&~|mVJz8yDvrf^GwG!q~8YoUbLq?y9d2bBK&*XR`CYJh1*`?NfG#^ z!2gc-#RuBV-xU%5dB87;!kG>r{d@bCqPI9A{I?_U`y=pPU8*WR&(dwf^0i0c|A@f* zV_uho_xA}v=4S+;Z5V%Y1b$5fUKoMj9D$cd;I~BJ_eJ1OMc{8l;BCM;9P!L# zMMR@qQrOcBb#Sc0amj#{MKPvL4LB|?)+~FNXjTD6g;o@Z%e<|!7>C&nP0Q<5ZsjRBmOq%LNe3$8R1<5)vDZ1IRcxz?gv2!Z zAtps*3KXoec7=43!6YqbU3KRpB)mX-h$FYW{qVJ2YPxPb*s3$Gs1^8t?~%eT$1rD@)6&i>oWDRaw9gJf2YD4`62RU|kedWlHKa~go9(OpOewaYE59aU0UOU7A8 z#gNIjxU{}ru5B?*UR(*!y2aoGz>-L?wqf|aqg=TPK<`vFXY%HQPmnku*U@z6T*Vu} zHyn^>xY>l`)%fo<)qX1dcQf2n#WzQs<2rHfjS>GA;S4pGV|?=8x$&V25#l4rIRnqG z*Ail2e%0@ z(?1BDXZeQ+FT`Aq5R6*wggBEuN{F-bPYDt31R*B0U4%Hx?IA>dEkb-~WAW|bS$-lR z^5Z8AVE=&-_4QwbbHQIpI1lL(&KIIX!y-&6$Qw|hp_Ho!JVbnf<^d>D=ZOr*vwy;) z8h%cQNnwx11=^VYNrX4xyQy)`G1(4&LbSt7x+9+pHC&=0u2V?&?`XK1@J7rh2+=Oj z6Jm3Pa!b9Kd`dl{a4*1Ahv`-k0)K+=X6(%nBAq`Hn&@Qxl>bG9-~|W};_UxA!ea19 z5EekbAYlpWfe`UuBt*R((D(@ry9qJLPDEd2xY2~*Y48)4;(JSocsFbRB^s{O@E#30 z$1W*DIRV``Bi&4hgZ76BQPypQKCBH0lTkjx6wFNt%Q43$OhrBkM}l{caFo(->K+ZA z7vh(p{Rq=g4#F{7-|1NNPvYt5pM>MkPY5$mUofsK)HmA2#fKAzJE~Rsb3Vv$oMRC3 zeJA8vjPTzz=i@D)?p51(^usVfRK3X4coJklzJhlYuQX;oD!X^*=KwT!N2m)bKs;GaNvxOPrWwI+_LW}dEvG%SYUb|@x-;f)0|I7TaqIH`!rtd zup!Q|j(Ol%%(ZeRU^47TjdM)04Z}}^oenF*qkPwEPrfsfZ(6?$T#1Dz;^3L)EE?jB z)x_L6N$0a(MmUxPob1c6U~FwrY{+(GHO7%&j{6nVgT=ARi$dgSob^d}OxeT;HWZAD z1LMDG&i6f;>xj#;(nNkwc;@4WJBCHsvlxyo6!|?_12?C!TRk0)3~vuHUl%SLVHn35 z&dw8@<@iO&yg0}83Pd1%=8rwe&R+n}q{r|yYhlkfUfbUj83=#R+7BAq<-in)d8@a* z87{|00PS#*3$^5s+>j38AFyZlf0BU<~n&*%kE5ZslS_Q5?s`wFFZlQ2QGsXk zjY9?`$qh0m%ahfVVEia=^4pLsX-r5hdFT4n;G*FvB}3}1pZ5>GHPkgW{-cB!7Y&d1 zc}tS&y(#^J!gurVxRRmuO6H+~T#+vz#*8&DgdD<;tfWxPqdXTj%z~ZJE)vQ$V>XQi zmj=#Xr^0=&K@PKK#(~Zk)Afwk9AL&5MnTrurCR?q_%K2#rt#pgWH-1uNXxhDWZC#~ zsVSw|PPBS2d#q4AD#JYL)6&(LsO*N zYS&v<3*0s}l#k7OuVIO6Y}TPk;HVMD>GK45zTD6BHzySObWT#p6A}Vv$AfO@TVhUj z?0Oe^PQd*$HE~xOc+aw5I0gxe^!ZV6tPI^7R-~P5HGCJyljlok-WK?M=YcV?Z6lDA zUv^%C{~hvwPv_1vo9}$FZ5Ui$>UcYFy+%4NW$nR&UltXe^JZqfVg~q>)668p;spj^%Q?9 zR?2FfYR*S1-=*s*X{Vw2n38AuC1=g>WMkuPfqqhljY#{Vjk|9#x$Vy(Eg{x>9?+?D?ZxDm!ckF(N|vu_w{ z;TN5rId=x0?A(TOu7ItA<-3paP9vA+rKa~`XyAGz1=3zbi_+{?vPW#pH;o6bM4DGZ zKG#3aChbW?3B*R^{{cJy2X-Y$H{=#>hAh*{U1JeP@eUO1N(mMMi%p$BRC0Vy10~6K zDzUqitY$31A)*y?P1tR)-1~nKb{{OyB@V)#fbD{f!@%f+<+oxsEXU+KVAsNKhTR6c z5B4DJQCJI>cK{M$$?KmDI|X(&?9H$hur;tNVb{Sv4*M$X0a%_H9fEC#{S?-M<=Q_D zmTUf8*txJ3uq$EL!9EQ8IP5d9ufXnueG`^@09~*G-_clD$`Kn0n+rP^_GZ``*e2Kz z?8C4-U|)sh`k(y%?XaK1o`B`rpX>fu*hE-lO_~A>(%iSNfaU(~8rT-t$6;TDJpg+M z_9*NL*sov{P_N@)1F*dF$bFlGpmqZGE7(|s;U3XA*fik#VBdtL8CA1f!s~D|9k0ho8dHKz%WAHk zQdU>7>gp-M%&SK&pK>`tuXC_;K-b;148@xig54_ znFx};?*@Gdp2QX?mIBroY0a;^WjWYR1ZXVBb^Qix>B_pCTe^xVN`F+UbTifUd~7YM ze3=vugXe4IMSmZuPsJwgtqd)Z^76`hc?AvqjqDY^sYs)jq)t1W*J*XNRS+H^+iyl) zZ6!#H+3K=BgUW2oMFZDCcN9ee_!Of6+Fh2xHytb>O{;uVCqBEhVX=&F`&~c35Nsjv zsHrK7bR3JEzi(TjA(dJnrB{H@Ht0%j*|6lvY&IS)j(jS29^NR+eXknIJMC-=IoH z6Y-dI^!4lAnk9k0eoHG?Wk%A1TUMl-y{#YVUMgGcT)MS&wdE?mWQV{zmFYv;e9p?i zw4ax_j&6A;~a0pjjl>r$P^0m!q#M?#6a6=-M8OutW%7efa zt&GZATwMfpX32J|LBlM^J1X7kso7$r)-0fDzKB3N7(<(eG2^nH?eQ6Wt z1d|(4hGmt2`huWrjSOBYL?zqxn<2A?YLxZisAsOdZq4XTO4xNIJrLe5JJ^iSRpl!L z*IsvLW!qt$l^u2i)0pbXy>adOs%$Eijit1wO%{N7Z<$-n0ic?U4{U$k%zU<^@_Bjf zIXwg4sM5x!aE}222xVDHI^1Tk^TBZ&oKClvHh@Kqs)jAJP$B#@Tau>yjUp zTD0K`oY*lTTzHk~-FoY-5xGR(Svf2N#_tNLZCeP?&%l@_zdf>SK74EOYJq#Nx*nAD zd+CSsf9}3eL*4(|Y)9dBDU1ET*(>6juGc7CYKdV713PzWZ(BJje;?)~HlAQVN*E)< zk97FQ!+i?oHp-~IrED9;WNIj$IloaRM(UCqX`}Gxv&Vst!E^8aP>j6GAM5a+fag31 z&V81f9XQJqbmWKmE5LkJ8ADu!hcz~e^z-rji~}#g^D7RV^cFhelir68{5s&TI>Lt^ z@xZ+@hVL~|Qg#9H0P2u@GYj#|`6bgOUJS^&CF_8A72p%Vxwbf$&n6~i>A9^wXx zYs2{cfRBP@`RU)=m(+eqI^3(#eq9Jl|9s%KVf^_K_|3p?M0>1*AH!>*SL4eg*e)a+ zgyejXtPqkDLa{)QKjQps7mDE`i(@18P-gr61UUdfjG5!JCQkBa$)n{aC{e5By?BnC zn16Bq5JIpNQ-i+QU$&~a7JSLValRksG2q~)C5L@oT$#jqJ@r@1mIKfT&g|Nzs`Ccb z-(AP~IX(xG*Y=rtvR_ELD;1wZuO2&@Rm_*|g$TzIH#R-X0I8R3H{oT9mk)Xbq|6gY zxK(%F(H*~oCZaq0IQ5x5MR+;hA&q;{_6+YQgg?g?($CY7>nY*|gm@`t6XGSCOE>`Q zG(w!QEF?sS;o8eRNQe@`3o!p79E>#~pcgBYrwEasR|v=BJ_;ey|6IG1FNrwU$kf;7 zBgA@UqJ|t>c<#-0GtaxpkIr-MB0}V&9*}fb6M~LBhX*7-5%HG^L6>6+@&wG;Gmu zqlTL`d|1P68a}S!6B<6F;SLR7)bJGzU)6A*hWj-YIZ z!xI{IY1pHorQuf^a%f|@JsNWVfOwpS2^uD9n4}^17#Pl{A;(+dX&Q3>fw*78Yz=cY zoT6c#hWu7B{A>;9YRLT&x-Zm_<1+CQ4J$MZYFMLTy@pL1uGH`j4MQ5P(QvJX>ojc9 zaHEEsHGEjZZ5lqV;S(A@qu~w>QO*CBxfG!gg~ZjC ze1?mK9i?%bM3PMa?lcTbgP}r(|5xFdAI5Qpd&MTAX#kva4s#S^VhJKKe^Ib@{$}8r z(e)4{TH)z)Ofwjc{x@jo2c+o&q0#D5{xb|M=Qo75xd>yo)7XA>a71?MZ9j(lcg|~O zA>5sIBtV-Uq08a^Cc@<*0Va>nl`L-pAZJW=-QiKh;oDJb69H~ND)zpA|GXx1f?prl z{Oj}eR#l1N^BSJ7ThN=>0!=d)nVu_0rC)W3^5O?i`KM+u{Ra=e8Zx0PG6$LuMPGO@ zwf!J&fTr#|Xw9ByeYasF?z~1Tz%%ZKd@;=Q+X)kXwCA zrbvM#^0};yszFi5?;0Gx{&z70*MD4-cj|$V0Uaohl?{}8>l=}u!Cgjl$h-!c`ext` zG^y3~Jk(Ivv+0(*lFTI6__ceD^thIddyUaz^py7)B+P5KDVE7Q1>48M^ z&vVoryN|87D=q>50(SHVWugut)4#=MUKccycg)ymRc12R#%Lu$zEYOQZ%$D6UDNhL zqs|Kg)-@viwC7yEU6`Cs_h3SI2-WtqM8&@?Fn^)Ljbu9=jKr$jsjCqXA8Bc{!-_k{y#N^Ws8YvXGbl^*Alnc^Mwg3){XF z`yv|C95`NyMAmvei7_w-mP|GpLGUoBGOHViShm_tpxZxiEB74+X_-X8F7Kn+do{{W>s;H`t^ zuvo}<5dOdI90z?7{nCfEUWxn4zix&G96{L`KHRm=!?Q>`-j?;`cg7A17*=Qs-fr{A zAtNhpJ>x>ELHfsSS*zYUA<&U>X?1(rml#I479 zDde??uGZ$IQgX(d&2c%uwT8EN+8cv$(03!cei&M4UT?(>XDy63e{w3$9krnuEq$^r z`XP^Rk!hfm^xFuz59rB1EXWF2DfQP|vFo(!;XzOH{PPNPz^R!7j14JfRI2CreFJd* z+P-f_+D?xz_Mt_xj(^p8uT>!CbcF_>4;aZzb;@NadBJ->6$N%1e53gh=%V<+9!f~L z0ONTuIcDq3EYRBao8xXHYO`^FvN>pL5u{_-F=nD|oVmgEm<`N{YeUpSDQ1y1zJ5rm zcyQkgwr~=(vjm}Cat;2!)45RQifIhmnrzBcc962s617=T--F&hJMkv8@9dEVZYy&< zRp-ecTT>u!=k~x2$Ktkpg!*I~jA-t+C2qr#om-%LaH#3&9AvuiHYR09nH;yK9_zPZ zd}seh;&tB}9gIHn&8kc@M)yC_^;qaDNS$%{Cgc5KO3Z^bi|1*m$Ys*)6H+1TXF7Mh_h%_ve|7HSzbSTq)0cR zt&4qRO-Q7lX#FPM%dTxAmG3|tHhlX;>2MR@SM;s4=J%~MXe3-rvAPq^quuBvpBMSfC0(0Zc zzJ2C?8Rx2_Ezp0`TbBD|3uhg@7p{vOW&HlEM5HkKXcpRA$ri9%-lJPO3Nr?N0a^Pf zXEH}s&SBJO`gSmG!{A*QvvT7$#BIgm|5T!pFhRY`?T~a(+nV*XC&fr!U~OI|*2knA zwDOG6<)jsDuH3m4xry6ie{-s3Ue5ldeGkSPZ<|@uiS%yqnb;DLU&smOoxxXT%-zFL zC&qjNb&w5NHP`g~`kCdBQ*=$wYtQg4i+gbW3kM-<=Y{;Zy$8`3@TQK9f=;B7gLdY} z!ev}$+=UIgob{R)e!Zdmf-^PHaN^^d}?flYw*!bZd9VbO6l z>_pfE*bYqCxqtF5>;c%{z_w$uPdTcaV3)vh--mla+&3~|^I&sfvtZL;Q((D9d=xeX z_9EB>*dEOJPr`Ek`4aRGU!Uv&FG)fR=Aa?@#-^y*%yk$Qt1`iMf={`cgjm~h7Mh85bSb`5?E;)!ESnq>ur1piLr}@4o zCI7)ny5-5huaEch#7z+!?+9+2arZ3G7R;a4Ze2Mjw4vU!+2zlXGu;rlVq#AD2V7+) zOdR;zgh|V%o5;6`e4EI(sq^i9+P&ct^U9T%o6nc{OC~hlQZfd)nt~Fjd@IQswX^0X z-yXOWX^c&RRG9TX^SK2`YpZL5Do=1H=OC&y70%LZO+wxAJyKup`K|nJ&%t-7erH_H z&9fj2$4iM}t_^Pe1hu2%4ak=J=rWfzIYK6F*q(EcP(<0J;)5g&KTCeO|f3i#) zt?Fbkc6M9h_MAe&cdWg}!?@;o}Ka}3_p zF<~va7**7~%cojp#U*eo(I==4leX;Rscg%2q4Mm>%S+%D|e6>ra-) zx%#B8ucx66jBB!XH)jad&)M|M*1dnOd~Uv^_)h2BYX^5F4a~#W`@NWgz4508Moq-} zKg~Y|vT1zgBFsY8%Dk^0?l#9DPuF}P(y#h(+N}P_&&x7}q?kL;ECzMf{sp@4Ez`3I zTOYlu<#Y!XZ6}Yb#PqGY5APx`X}GUqU%m+5?fc zowB<#epVbxeWeWdRmVZ}?G{*`Q^mr*fh`)+Mej8H7A%{S+xm~ez!rsCRMqDzFVlYHt+E?J ziePuRFM}9%9{H(sm}Sr?ZSqZ$a+*-1(F>lKd`MFBO|ksyU(L3Lsvr@T-SM7=U(3n9#duxHz)?t!#@_m(04K%^ z^S0snpU1abPMr%&2~Z%Q8^ReEV?;3&N+GjMRtKl>B?tZ9Fn0EA);I8iGGFHn%X$yL z^eP};BlXIYiOGKH^m|M}MRoP7NKSx*t9+@f*BT1Ahh`}y73=!irL}dp)=Hdpl8n$` zC2cANcM>>}*bsdqfR>JIH#ph?C)3L%6QN9t?X+BqlwvoRZ=Py!dq9zuhclG(goC8_ zIw*ibNEL`-R9?|`=Nnm24J_Yz>#I}^EK*pP99VoS8g;|XQF^(q?b|h#R3@-VNl98} zSl$yxO`m@KQ6l#18Pki%n~J{8GJ@X;(x=!0;JvBGI{umH8yUZ=>vs zudZo!~Q4{cz$&>GR#8bSz1-aRii4# zpy5g}(%@d&{P}a{%XZ~EAe$C%D55E`YO>vIK5l;AQFO&KO&(N@D;hEyD^JGh?Ni{p zt84&QC%$`n3L!pw?km#QE%h&1Qtodav4 zHp-v(-<2^WPeu>cL&`);nO!!9oeX(bk9!Wbe=;84bcDYQ_(2Dr0i639%0!C^cp%@3 zjq`ds&&6&08a$-gDAL0eMBeML{b%CgMeLQ>_*^{fbKpGF^*QKsE<4*nzYO>qhkp=w zq9Z=%zdl%Hq6G)o9)~|zgvD15oaeUO#8)O-@}h+t{y%^R_i=3h`|+^Zfj)itL%>TM`6KU~&yoI7;03VCM2pYxQ177k1@IzAdS`%>UqqQ`@mD-- zv{AJGSv>n4;iEw7Lx;Z?c#|W2?tk6k@V^lFiw^%`z=y*s6OF5ExZmTTe;M#Y4*v{1 zb6>y?KLO9YGi2kGk5yu$$nVv_dFMx&XvupT>Tl!fecL>s7Y`u(NbC6WxoS21J1oiJ3je04mfb~1#sWe_HP2tyF@llx!EHf{vqI9j`G|C zoOhP&@O*bqIQ-WG=UpV*pF_(bM|sJ+@Rb9nzXv>L%INwT)QfLs`VM;B>s;%=ITi&S zIC=B9N2^SgsLj0nFr0^bIl{Inr7G{gTo!vDPp{ErcMX9WJ&2s}1C z7OC|z6k$05x7uuN+)l1mJ}VQq{u0`a!THuLjs+WH>cFdN%3?O zBnS2c8E}FM=n!+K1k+7WF67OgAm!LiPzvkRvr0+Hx>LjyVac$aE!n!W6|c8UBwHq; zQj$S(6m`YlEeTIhk)*qPRC4yRrKkK;lw|tyFIy(5Qc*1BGIEY|&XkE|syHfFEJ}__ zT{`E;AUTp&j!HrLPLyOON-`5A;fXRs6ICqfk|UGNQSS12l6;<|;woyY&@%ia6-K$p zRG@p0Z0{Sodao!#+u7?I;tcMhJ zGQZ1fMWu4-k98RDgJK`enH*NmeRRU9B}}oc0FdgZok{(Z{Z+2|BGlhWO?7?b0+#m` zv&T4c|DhQ7l$^o_)f)k!BFLXie|aqyf~q+30-AJ$sJZ3PJ}tG=HA3^8Qkln0^iko5 z-H+PxWlGc_J-O*3<2%{$C6RLM`BG)G+%|>|zlN2pah29eYPG|Kx?+3Fv=6(#6lVz0 zfyGp34K0TFqrg3-0+83OD5MaD;qnv&1ain5ugGa>S+UNHT5sB0+2P(1&Z^#}V5OB! z%r2JK?kGr6-i@&DCjc$i#lyZ#ad{bKtMrO0Tu?Bz&qkbDF5BuFWm1l%ds%f|u~tzS zUeuS?b62If_v%8p($GM3mG@n7-BwE|L^*o(I)8Lx1 z4p^-2i^%qY8^oH1uv&;u2y37hk8qii)9*!i&U3xk!Qgz- zdyCS0=4}w-*TmufiG~&-7F}F(c(F^Kq~UnNiNcP1g|+@@iR_TR7l-`DQ^{xX~w-zkP2ezKsz1+O6U52ya8a@ttD4{~|>A*ECM~0N&e?UrhbzKavm&ni~kejdMvt_-`RZ z<-e%iTL}^V0?b935Ar*cZZ09*=M$nmN;EEI{vljFanQMs5cTv4A>v(!IWOZi5Tbrt zHSX!B+@&5s_-AQc%JM_~%qEU>iU`p@C4^WcQ%AKogtZZ2Gh`wXBK|_m3kg?i$h`>a zpOmur@VuEg<~vdrUmWJK#4!neoDlO8DT{9)=n}_-b_d}g)C(c_*IxlFS&h3o#0O)q zfG`njCc+D`HX^(Tb9%yyQBJ}n>|qcN!P*6o@hJz-JrsKxgu}o;PdFTFC&EiGKO!7~ zwF=>-*fSvXK~@CeH?ig+OvX!rvQT!QhcFfWoNy#~wh2dJPD6HJp$DJg?%dyu$=tn;$%tSvX1f%?HLd2g- zh)tRz!fdn;VGhm&2`8d12q$4pN|=ka7vUA?|Ag3Bswcb>YjVOVxDQKs71rd0sLzdn z?4P>{*Pz}B?*<=?cK?*{9;}bh)(n?L2s}^Y*J(%{=5+s@@VlsYLiFPV^bN)vu3;J> z!qpP4MSsxvR~p8m4|%_bdL~3Z#uB1GW)Wh1T1SZZT(i6L&<_cxq8}3GqaPAZLq8-8 zpdS)WM?ci~i-ac9C7gkNNLYY=sQvd77NQ>#&P06>&O$#VoQ-}+crA9`1|lCnz<5en z13n_cyU>1w>(EYw$Zr+ly~sBq!aYlPAI4ciyw~q)_jbbnBg9_`ThMRt?lAsL!u#<) z60S#lLeP1Ia0A{4jh`e0y{`xnFBb0{>n)LRBlwXt9?)<$A;K-vc$vnR5I%r@qVd(* ze?4I>>K)KMAN5YS0QF8-gnB2u9`#Om1L~dd8>n}}g?Rr7Z$!Qc7opw>Z$iBj-i-I~ z-!yoYg#jC_!)F8T2Mya`IF|-Pg1m>3r%;iAcXJ;ip*zd?42L1~oVzoYgBGJQEt+&# zhR5eeny(AzhcDx}R4~DCY5JLfG-&Xu%5Yf{6T)`^-dWodZpaKx-{!B=8aa5 z@}FU7=V~Y&@%KE!ISs?ml)$14^?asbI1DFYV~1lk*kz?>C&Gmz0k^{u+GS<9g{XLb zW8&~!1ErH4G!28aLdyc2JIZt!)7qqc1Vveu9I1AkTc?L9IO>47m z9`xjzFQv9Rkv8drH1H%PN}8#uY3AMFoXTof@$Gu-Q;Ve+b@`$N%Ky~5`Mbqv*5XZ_ zy9x`;U9%P6%^iWU!MCgfm%L`}zvKaHNwN=|;-7@xu>#;j7hP{7cQz;25ON{jrApC| zzFe25F}+?t^-o_KF5|tepL8ah2~WA6PS`kT;{}eEQ7ux{=6cwhy4@P-FAuuVr(Dfm z^poSE$ExE`jT^AQiXC`ka7*xm;IrVSQ+!p^I_ra>taXJ20hRCOz`>3*Ggj9HYAbVO zO0MaC5;cMy|E9Q2@tX#08o22u^sdqV z)(-Tv%zo>=>-(>dTOYrE!1{sfmCx%)Nzu8p=ho*8)05JR*FBeJzAZVHstOmQPVc}w zVE7n%ey6j4+#emqo}qj74?`}Wp?TAOrTf#pAp@=6B^Y5Tdr3-eCF>u;#<%Hv=+ zVj$fF%QLoo*eS5tuq_z)*1}>+CiSu5lT5zJ8N35GMy%f9PV@foBWv8YDY)xVRoY^T z2d57&Jw4+hA2j2wvBp4SE_jklAJW{0`T9*R*)tjZkn?2@{d?x)d4YV6GObVhIId~*t-&W#phA( zdFQ_53R0)-L*TAF7`iDY%FH|US_r!P>Y0`r`F4iVgTCZ_kW@%F>JUXrnK8-fOOV>2 zMZ=A;%+1=pA3VR`3M6md8;|>I)!>5Pj~3-^3*-wwB&x688KFK*fMrqmU8H4RRZtW!^t+-X-j-r@&ICwUt*%Ffu z2l1a<9c-63Hrj(@s`I+fW{EQ)S&H^xb@ka4ab{Zy^Z#V^n4Jg*e4oTW3*+qyUqb(Z z@D~#QBq&l>TW9^B1o59O|8wO3MEO67{{wT=Yur1BgY(P)DCwII^21ik?Hwld<|_B??4oW=i1B7I^TVD5ySxPgQaLWW4%Ba&79{&?L% z>jbXXB;)Shu@bRAVkw5YypBbayYjAI(7c9wi@9^VZY7waHlT<|7Z(G};?@{I< zHOV|uqC(6?h;|)fU+bT6595T-2VJ{w<{A@T!$0LH`tuMAGOWp;ylF@LDNk$+WQksg zIxhm3_;6WY!?(&?7Mr3rT(Z^ufM;X$h7nt1He9+jc7tzgzYWP-y^`zxBEAVyCh7l< z4s)+)pvs+lN@~-QjxgM?ir8y{2qtK*tE!X!*g}Lv670ZL)%nt@>sMrt3A3@B*MFkJ z-)6NW0SG=r#AVe~Fh_1CwJ%5ZOuAFAo#gwfghoU1=h;qTn&M*w`^sdkO+i<^|v3@|p@N z^{cL+Ag!uZJ{=3Rd-<~JuwmWHvD3?Y!x~^QduxG$@emdKNt30ZzGbDgtHA!Fm?Gh0 zKO&jNtH@9`PO5(d&k!CUCQZ750OQ*_3jco|9oa>(263)xxF+$)?~3x}zah9xpsZ14 z3@LvqWTPTl%AY#uz(?ZQgKw-d(YS)>G|^J8-HTzTXesCDkORkdjqo|}tMTmQkqH1V za`+eGImwaU9N^gc(k5DlJz=BB?;<>7>qnbtDL(;Q2w@zrTOS^iMBraJ%Fp_s>{Mk8 zu>=om9qDsj=;SG3{2h+)jDJTA{-iOatlJ%q_zb_s;jaTqz%zTbY_naX!u%v$qw>st z6JQc7>)?E6_U+usXv&%Z+nd`55qsz5zZ(FLhZhM4(Z(At; zFC+Yoa9!xNas+;91U@nX=lsq#Tx(wyfs<#&HuNu!!0(K}?~lOA<6#@d|49V?%Lx39 z2>jy+{CEW39f8L?HWZlNCBUh7?nOM4=YeMrwxNF^@SW&y2SJDal@b2DS7aN8zdHh_ zjy&7Q@dLcQt@ce4%v3I4 zt9lJb?Zw4&=T9#xy0O^2{yKSiptzXg%Ch<#sr5aRiZ~LrkLeuWSE(<-oBUYT9L4dHF_VhWqTU=Vr zqekVezRNO{q=N5tu|7$(Peg$gEN&rpcF8 z>w@<=AtqP)3aPoxj!TZ0YT8_mt%4JGVHr>XB6WyT#Kjt?)ti2* z_lYvp$PY(ZaoY&}_)ZamP6uHobZg+vJ<)r8Yn%hWz`lrvydzHhSq*=o;qNqbp-#NhF;5~ydQ%8NhrEqm6ZJ|s zL(OxTZU{KfBRA3=<#=4f7d3oW!*)W@`7Kq*ymj3>%yT*Bz?SA(xibNUYD@3vr0G8#w#oh&mzcEY8&Q{=nM@> zmxkxLqt&DQXBgVK8cIj}<+Gp;W0Nj{8_HU5dodhd!?3Z#p^Nuff!vC4;Yjea!x7qL zB@v#(@}0vg_fKVw@mw(5u5^U8>0Lfi9-Hv!M4Eqft}-Dz=ik;1vrW}W_*^9pJ;dHy zJmO!&bCtQ@iss46q<3(lk|2`DCY7GP2Rmd({Ogyv?swl`wsT{?XRkPw=9)jm-L|a# z;ru17L(K))k@^yMvwdcH`9;aDr?`s|Jz`(?4@2%P>MSG{O2%)*j^z=*yDQG^Nx!{y z$megZ^0f+INrk*A{M{C7S!QCo=)Sx8<4*^7JtOWi)bIabH*~g$H)0L9(P%6&PKYDG zXBtzCGmt+x+;D9b=^wPZEf-_}h|HUC_y1sP)lT=;1v{Bq)bX_!s$0@W{7)|_FMpIa@3PD)nG2)qPVt?zIiI%;EzcAU zR_3n|F{_hXP%rUg>!jqiBmTUuVXKXsJ@BKA^ds)B8JHsToILGwBQ>?6U#GifK(EWR)C$oVvSucX*@=4f*PULC zTzujmoT|#%-O*n^{i(yNpFZvAA6>jx`1+;#Dp(hHo@syfMEFLytQpzEVzKwTrMbN3 zlO+p>msAW63~5TOF|I^<*zp|m9DB;4AdY*xHX_XCe8}|i-PyC}*%8Q1VMJ~&&?!IN z5wZ#*{03>iN8mRr!Y{RkX`OyHQHS|Khr1@ex9sJq6{|bqwBNTo*b9;?hT>lRAD&In zt_>Y87ur3~@Gb4I-=xJgKC@#9-!qY#Fwy;>Ym<84&i=XcS@)LN9oXUYA6vpRx2RJI zF@KD5zf)G@8Y{ZTLu$#=%znt#+s{_j7~==OH};ODcTD@-mHOD3+Z$dubK9M1dtGDm zx~tOQ4R}fpOm0)N%)FMu&N`6w2u^N46GNX zOIdjH>C%YRC#OFH{?gm=NL2#6E};Dkry1<~uTPantUfjI89CyXL7~X}MGY@+>l=}i zK&uRBwnhGB%a7P>u$6{i;pa+nGygMP!hs!KHak=8{&wAo8{*3a#b=7sc)x3-WejPD z@$3CgqE$1Nl6D;Q(uCk3z?lMbFL3mmMbs-z`L52Vcs!3RJm~cSfzH6d7^viau_OD zSgG7rSy!7NVSpSpYLrs7co}5IIC05P1=o#KErS%cetAv9NJZB@)&s%KT*50jv|Ck! zYoBpR4Gm>iins#(>?}@h!g#k*Rxi#z!;k_G6N`0@S&XWBGqp(fpC_{&ja6dKXb2kq z-D@kO^AWb$zjGG>=TF^E7P4E)|8yr~3m0n_1LN$6vc>DoNf2r$i@OdOU4B z=}u4IeZEVV4R_BwokHeFxufo!QW`upCJNbP?3|KTakCM(J|;fug@>|EmZ#gHQ^&Y7 z&l9;~Vwv78Z1S>tJab0b)RY(sObw;E7W_sFUTwkew&3?!@W(9p6BgW*Z3%Vdx>&(h zx1dUhsD!XeKPzA?^}7!Pm?8t{_TN&e-1AnEB=#GQTZHVtv4H{GM4i*;t)d<3Fw0W*$t=d*VEGwA$gB0!TLVe}IM z|0Gr(0cb|Cm%)1A^@(+~*(N}xNoe3#=rNqh4~GT1jYMN``k}SkWmn`Hi@hJ#iJJ%6 z3tV*VMmy2DdlFSAZZ#ZPxS)#jDGB;l4o#l4_h_!z(Qehe9F3d3dtPabzp6&PqtMk( zI#>@wD*E`OsnF`Gld`(nrf^RknM|*m)8xTkKV$8Ml)+aq6?|!lN`Jw@rleyhz2&$fF{bbIG~DheZH6T)+~UZP zI|`-E8Nkv|rYxVXsg!^_ER%h(!H5#Mq1mEqSn0T~XTrWW3C~bG_$f-QnA3C4d(hE$ zKg-^#jg<8}syAyvSh{n;(w$dMZem@KYqMuBEmgNPCd{f)?<|ZH?E;ItN)AfLQt{DS zhBp8H)|S^8*vq_HwcH%fb66>Ruue|f)YPg?N_!0tV9tfWa)IThNf|AmYeATPyD4Mk zF&8$;oooBf^&Ra1>|fyz<^Qein+{#?0Pkvwsn_`WZr)-#P?W=wdRc4wA!^d)G_`#- zE2Hn=g3d4MUx828hI%gF*{b{ao+8iy^gjl>J#7b^mU!*_nU1wO z8vP@853sAlO%B5t!m^Pl8S$~0zxtm34^b)Vi8QTO7C$GGE5}{qM{tJGS_LD7hcYo7T>TKJr zErvFh4ePhXIjp^++S6Dv%1@T$yxlPld5nw637$E4 zrsK)SbAI0|3BN9>ncG9$Gs7u8WB1A2LBr?+UL!_~fWi#cMg=%oNfjO4w$^MYwalG6 zQ!y@zL_9GX_`FPl5Fbn496`BP?=7SAf4 zC+tz_dDQR*Qr*5*O=X!_Dxm~oJ;X%IDsMIPZgf?hS=Y>*snp@@9w?~qqALs04wAmd z1^_=c){OWwHv6JlJbL=;roiIboT4d(3a%9FKFk-TVjhC#x;e%3iq1iV_F`ELlTSvG z>Z@VpYI#(_Xlg;h1SM{@e|dmB$et_@mWS9bw5Qt8K}OfFT#A#4fDLsz z^qW3#9?k1krO~>XoQ3uErmY+k{?D)RdQQ{y`{mH(B?XTSvn*`G#puJxV$Fjf!?`4; z=bTP=I(>tQB0b|*#Ngzo#o(O#amuDUmyjp;OjL4-`Da!PPJW3jpm2JAv1`migjX1` zJh?*p1`GZA=u%IXiV+{3jDmg^aEv5|)Af5^H&Mhdfd5x9_)YMKV(@bK-7)E_fPWDa zUkm@17@XzX7gL^S6g*s`vc0;UQ{3B497`LtZZx4Fv7>xF>0Kh+{C7V3H$OLt0Xc8( zUhnI87-4C6_|CZI-34em((lDH9FG?dZQ!S(}deUkH3k zOuQHPa^M^rNPjKxw}7`8c(o;cg9YDY!GCGNUj%*+9_~$%{~zIh08g%ge+s|pSiVjR z?#3dBIyGLzG5x@pMG@(#FJn65qb+#sei!4fMEpO&?@xHh?*LRKU6i*&sqfeZa3p_!zs z6bW)&>FAt#MPqVl`9LU|0OEpSQ6!X4ToN-o?CdQHCFDBX zVJpopDVoLPW>fbJD6d-?XsDG6<}4_gH(M|73eImpUQxM1qP{RI9<>Tuidz|PVFR#O z79z8dXCVqlL>C@uKI7 zQrh*6zPR#Oa|L7`wOasTc|(~{b2`IP1nFW8crd$IMy1Pe5hf;{X5r68tIPDrEk?Q* z!%Ku(nd$0UOvFwC4KaG_{mUCFV0{z<%UYvzL|f?G6Jw^tE7Li!&#n+}CyE=)%hA_G z7&GK-Rmv}(UD_k`R)+qNUKmoFa?3L&vQP_$844CipLf!1WRG7+4>dbBIBD6l&7NU4 zHq`RO7s3qZcRc|g7mhd79r_XBNPUe#ov3-h?HGK048Ig}8{!z|L&QPH@tQhSj}wlC z&Xs|`N(iPO81QRC&~q+Ex##zUoQ&ZUM){|MaJ)X3p&T?FICZ9kt{2KRpE%NU{AIZ~ z2cynWJ8=qi@Ij=GR01J3i75A{Zq#@}Oc1sc=A(QD{sCbT(i5uC5hI+6yBr9oVSK}P znfVnGPDj3kGoW`vI1}wacopQegqXzLOE??z0>To^*$n(y!mADWF$U>(i9=9-j1Y}0 zY+YOf-8OvJSx%wbb*&`suwecw!%_bdLg2I^#rof7;F}3i{znK=?l%dM&&NjmQ9|&g zPF4c=es6?xDo0(bL_*X%nGod~Nr-%M39myxFd*#+GTv{*HyAKzK+bWg>vb<7CW{*h z@qRZG4#XUk5dG*8LMUx-Cj?y&-7erlw`(xo6XPMId(NPHo)E(8mkhjxFa_;u!1n;z zUl1g8q=pir-pdHRs1N!{D&o2BPKA(}x_znWAC&W_7GR!;^o&1WcQFXT5;I`kp{q+L z!NYWDX5p;z_CoYo58iz*#4Vj1SDU&Em%lo>R$1mGRu7l*Ut zxhi{7p5VOtjT89;oDql9895zax!bFDOBpBP#zjifE*BCq$^!M%Z8Fl2lWkE+ z-}}J2Wsrj*!Su@cxL55$zb?g;l)XnaaZ1{e<`gotE7a+RbauMnqMuwvy0Vu$%sZ3x zyKLet(l%W>tgVxpZ$zb&@dOOHEwoNbSXVjKcF5f-D*>F&BW}wY(rV8dAS7)rNH@Ds z>zi|Mm*ar1#0heD@fb)HO=%?gn<+05dJ;==0(xMjvIaAGPZB9f13J ztfk2@+A66>98<=Y)|TZ!JwL$NN5(*!d9{Sxq~_aDb_^*JhC^KT_-W(1>V7AK^AcKL zt+~GGKI}|LLtlY(x&SBq*8o%0GDuqOxK%K@xxf1Nwm#V3AwNo*e=GXZnGR(NYGpnqXCsj={#jH*L7Sple||I>bqT1)|$4##p$Z4Rdt&jcy7T{gXbnZg?RYAGA5rr;Nt%)mQHm?k;F@=u$ zypS3#^_4Y?M%6>X1#;YSoJ6QvR8_8PtLRhROX@{1Z>-?C#+usNYTR8=i}Qu^FY{he zdTlA@mdcf|q8=4z8uq~zab`ngQD1{g6&n1t6)`2i@6EV_p$DBY;fy65J^E5yWl~p( zYQ~(Qtf_@%kU&DXtQ!w36Ult5^$)#;C4bsZ`WfiVEnLv9Qh%c>l-AnE&Tx%NWXI zoUZTlMKna$_lcsCQzHG>(Ey#kd+sAkn1;sa?CA77bD}$)J~2A!kcEuYYes{A2K<=f z8%|G88+*Fb(?_C{5q_d^)*{N^DeeS%E(XW)O5B&Fr+13E+xIc?n9j!7>vl>7z>n(0 z`0o^F*6xkLv3wEd?)0FT$twaV3+}0YVvX-Pv7;IT|7^ieSn#B1Tk7RWwcr>JqmJdJ9M*Kir(5t+3myXg zSJ3(Kust5J#6MxdDJwP|`TrO2Yw)mMOy6ON|EC2XfW9^ukA`s4=S2ISUcUkhKHGwq zTkzX0_`??bB@0e{P1CXb5exoz3!WVPE$HQ=Y%@9ur-;)kzZ9ZMA;i>0ligBF{XC^^ z#FjEoL%tc6g6L*DEoMPujwc2h>dYZnKq1bdT!%6|eG^rLQ@(hH$cKTk!Xk_ZUfNtO zTPo>8Y|)%zbwO##lsQwb5)w*3E?ZetQ?|JN?D09JB#7pReO%Zfh>FiBcG6{gX9|T_ zUsIdz3{l{D2_Y>lhB20RpycR{q9Z~W)m;jvIIFhZ*;$Pdte9M{7j5N24L4dnt87@X zj}>$4qq2}F&YL;cG;*O&PXup@!Av=xDeN^*cbZ}{zOwSF0ItW<1)yd)CnaXVVEGm| z6~TT(lq(1Gm?>5%ww0@vi7`D|{BsGW&oU1%Peht|vrMM!+GrbEfauO%+_e;y9Al<{ z-&i7^1PCXn-;|&ja=bKsU7i4VJ;T#+MvxE#)C$6(`aCpYn7*$?dEg@qzXUc@2{AA| zO9**N3*iV|M}cyw_lS=)^p0N}9mPkLIIMU}6 zLI}a}muC^{h(oBd(TLwp2tH2|B0ay2%>Q*G{yhV4H}EeAAy9}AB46&Skw3?4${#(1 z$frLcCIYhnc}8+RVJ_N-5c08G47iqX0_N<56LA)ia1!)A2_bi+t$oTH-y=l%4jS+a zLX`6)A?nHfu!PBww-V+-AB_<7Le2;{i#X_SA_RSn0dFCk0=cV!3ppdoA>@pp3H#zb5%z<8kgz{qngbB>JO?4c6m5MzrGdb7^XO)w!!aMP^%@B)MC*(J7Ky*=oqnN@KnhXq_v~;Ly z4>{Sn=+LDEKXeV@NT(oQ(~&)S;*|+VdOGUyX6jz?pEP`?8Bhe`-v+bdMu1tq`M^35K++7T8K_4{6z;8R-jYqe?>BXr!Hwbfv((;B_6IImqK`gkK9D*K7}K^EQUH z8-ii&`j)V^K$PNAPguLj7uHIU!#E|RO$>y!g^Heg4!Dky!rG5Z!rF~eNE-{9%NoO4 zIpFy1A?@;wAuTr;(ynL;X%pH*+N3~8yV4iZrXc+yJe8oW*dErZH-@z(!LU}<64w0f zVQm>`epC|DCQD(h47`0(NXzqtwc0>fTMXVsN?5yDVH@QmcBwC{)quJHRE40bN2)qd zsf{6R>h=)qQiinRU`U(Z64GY0hqRgC!nT_OE-RFfRs#AvB**<>Z8bsyjbZK9?ICS8 zIN!1{tSt{Z?{@*NQhp69X<@CQC9K^JE?0rWEMHi=EfCgL`a;^(o;Yy0(-YF>Hioo$ z+i|9>@qNt!PS;@Wgq^~)zv#5m^(g_6z`5C zx#PRs@owPHrZ_t9N}Q(+-)M^@+2(0kKKGb=ki$os;$yz>yXx|0A3I+6Crwda>{yOl z=)Y9KJy9N;*wx#X2p&vHp6)T^m?>S~8XJww2 z>3j3khkoF;*~hx7)*f@&ets;@b=NVcYhNLAQws+cGDjD%-zT!>ue90Pzl8qqOUzw@ z)lB3rp%%D&*F6^Am;g!u9a|PL31~M0>y9=I-oe&+y6H<`ha>1{d14E%fE3UtDP4_Lxsf zD=+NuWt3&mO51G6RblfjcTW%}Vtrl*$~jq_dIPkt)f7(lVNZnbe+bIN9-odY2i;qd!gUS7O$y2+exD6=Z+X$7iKWr;O zZ6E*sK+y*WuwU{E>e>eO^v0fp&l|*E4qJ<7BAGU}cXXP)!xc9=@A#iY@A%DGdPi!Z zD>B(tpOPs!+!gH|QsgOeIBWlqB3ne<*?Nc+35mF~^^w3i`iKNezaps-m$X!=JJ(0Z_ZfRdGqJD zW!LSvt-7xKww-kuw{_NietUNPj@zs2%WvOVpK*I<{pYK)8+NR!ZYW>1vms+uXM?`~ zbND;(^0-;J^KJN=!Y-}z4e z{nvtyZx{W}bs_rQBO)XT{f_gQaHDNk5LO}kgNGk>ee;jYmvLui`l)-oSDpITl%nIe zG$UGqUGrl(Qo7B_E|;4Kg3ur zz18WmxjW-y`t8>IT=d%^>V1U+#Qq7WykAL&zjE(9mTW^m8PX{y%;=JO{Y>*K?;unf zaiA?1lttgoD%yX5zJHw#YrQ;SEdgU?yceTrNmv^sg*A60?or<^ZwzaF@C-yq?_gL< zYzb@q+QVAkKv=uLmljwEIKYEZR@o6aQWw@P^kOzp;;UCM*4i<0bHsLT3~8=lNQ-L; zY3}yLb-$?_R{vQ2XZ0BkVQmP~4puO3d&?RgZ}`07B7SRsAvOOe$+-XBL$T(3niJlC z=S(c;>)lQk>wEHi5)*prOUJr1Ww2+;Y_XJ!I<5yU!t*qEaa~OrA=fkuu*O&hNZbo( zI?`i_EWL$z7Zw|gF96<#g&EiH)W?*Jg#*QP@a8~+uQFgtHbg+6tU`~$&Xb6tWhxO9 zBl!{6`y4~L60iWwM1F+Ao)6aUZmeyHKZ<+_j~Z|q8Y=`0A2R3*N-Sfn3H+y;xxz6)_? zk@WP9U}HOF_Y+CDdPYSrfF z^lE~(!c@nA*64xG zfvnqc$GOjSjnJ8xV*4$%CZu6xtb!`pjEQoH#o!h^?V#qi2Nj&roO2io$pmAh_-Y|=Kiv8k@k1cz_Q zW1?=qTCz^{s=UwO(cl%v8@jXYMeuDoepj%6vz#GiJX?5BgX|`&`;LVlwSJ;+>%O>N-6!oPW4&3f7~#K1Felb|TMMZU_D>DP>~3bamc62z@BWt3HG^FI!mm z>6$v!65*(dQpOKQUwo-n{Z3Zi>0lpzy8|WZcS8+p44XtaC%0hN1lZ?hT19;k zb0dX6aHJ60CHTEW_WT4r)}NE8y3k|oPuuS+-|e^rzYAEZk2g-&4;bOj^zLv4;WcG0XpAJ_Tx_;#H|)>!KO|>nt7BBhFz|Z7m1c&!55Y<} z+C{f7-jd`*Uz8R8=Xwu4raC{xCVHy!qOZCjMG=0dI&HV)Ppf9#eENTJ7F80bFZ&jA zO~m^|Ym{P6JKJ{|$$#-<+IZn3y z1>X;>UGi8y{F(~ZHLg+RC;F&^MEf4r96|oBE^aMUkN9)cH=2B+wA)|EUT@1D*_x1@ z)CS31ZJt`=|E>R+|7G9zzAMUZD--onXeT|gZm3@x+1{2X_$A=1bR1SXjF+?i3Jt0W z7wL8Obe;C}>osNsIH+~U0?rR_cH7VW~mYP8RkpwYt5yPwyNuLz2g9nhZ7+J`om zvWi> z$=j#(_w0idY@e3mC3Uye9X)mLV!O(7>!y|)X`Vu#dIrxzJab~6d4?Zb9l|ar$8C<| zn1Vq=K!^16;di;9Y}v9}7(K`RiIvo~saU>r=}IL~6{zGH%xFB%5$LKl-2|hNoHpYZ zR~f2D@Gm$0bD{pj0}%CON^2lOYev{?58NuKmM`PER7NktAqxdz&|#8bBVB=IAnqDc z(`k7?DXXh1TdB}Q&oC%R>06k(Rd(n!EuEmy5G-Ps;$W$=v@8HEsLPf^^QfVc$4sS5 zD=Kffbh&YZC2)%kcs)V^5e(E)Z)q3|5_Qw)R&PafklBBn4$ptiIZ*eFb$7l;Mjtbrr=>8WIX%uHF(%>i7x`oB?IAPsmk;U=n}dvlVajYPkjyD>AE`W zV{pd*DhB6zDaD{>DOmoeV&X~fk4}1J2|oo%!J|8!o_l?|)5}YpeiL5-PxlIO(|2=p_d4S&wzv)<>O~9YV(}IWePgvq#v)~_D@V{B` zQx=^2?Mu<0+2zPT)h0hT28YglYYhDmQzqojQ5w3X0#p$K>Wh`gaB3_z+;^D?~-0seksb)~sGU$Ne zAhCXwT9nl|Mrs&x>2bAyh_8Ts5#(>g_qaa5Xkh*22cSh*TTxXmRl}&IXf8BOcU@u) zq;v<1^1$dy0L_Y$312i#^x^>HDgrU-=XgrJu@Qv$w~!Ds{Tjkcb=x-7SK2~6N1uaG z?@PgVhV-KeA#~>4jkf8R7~w07aL&;f&bgR94SHFG_yBzYNd2tu3Biwc6sV^)jSz$G z{e&pjc0%x{Jpt-<9Uw$H>Z(#tD;?iCrW-++XXs@iJ?C=NmwJ%lg;+ZoQ0QF&|JcA! z8PJ9ABhQ6(HcEUlZ zKVdTJPdFI*dVoBiN*n$>kNO#5He}@n?1Qm_=R`9J=R$Xx5Q{xwgCB4SaZI3B7;q~g zm7p*NBtZC^KzKd$*a%CZw?~L_%_qeBy`RvB@)_YD8}PURIrrrGO)eaHr?-PJRhRAa zPJ%?@m@Ih+M`AoBM4DtmJSl__*eisJuIHGF`pp8%)KSobBgFf~P$i|}{ck6nfcC`u zNX2`;5$%wQ^41uTcgPd}o)CQcBd=7{GllTS;B%f1MPim>p2H-_S{jNnnhxxRv+g0R zM_<~9KGzGeOiwyg|BO9^`7yi@Eocc*WI>PW33o0!FJj3bSqVov#qbj_Pdd&sNoVTC ztpMFf1{jXzBRbW9l)Lb)JdZ9~> zcXr9nD_gTyD9~N`Q*b2q@8ciAYs^Sf6F2qVIh17wIpGiAZuoZgvFnFS%t$$$%^p8lPz4xv8 z{Xd+cN)P6-gxk~b-`zL?<>##r`i@XXY)KWP#Ns!55AFp`j{hlI11;l*F2{Xw_p=rm z)aXcXqJ^$iUF~a)_F1bwnxA~IXZ!5%vvrX3Mrl(bYUd8JZH|Z><3-zSRb3CqZCy~5 z+WY|Q+t;2b>h}}CgD>!1_lK3kceG@*Yf6y4F8PK1*d>&*UoxzJK7bR?1rZPQ&KBi3 zx9I%z9)O!s50M}4F;8-COU6E^bJKqDzVGJy{*tee3wXZ;^&2wg2A# zv!g-R_Nm)I)%b1jWJSDu*)v7&H%mhu5!q4Ebgkx?ou^)}I=7|a24`vHmpJ__5B<6$ zpvH;%;2lj_&pg&}-(hU)#n|0bavW-J{63RKp9wTQk6)C#IZutpIqso3!;Nsh58Ows z9+DCFz!j?P0eQ3I!Bx0J+Rc2|u($mK z`v?C?GTHwrofD`~#5h@uk2gj`WQp+$WALaK9_pZQJS~d`nj@zkKv`g{qup~%eZ=_6 zahkFPEDHn`&sq>Kib+7;l;ir#ag@g%QzfRCVkQN~F*PoV%;lo65EUiSZ-JwcE@3vk)I5pA z6g&lGq!Mc`Qk5@+%^zVKofKvWLYiY?2W~wmPDdp{jyt-HC%F}ITj9z?m?TYg+XqyBG(Z=EZ5C#k=&cgs#@Lm}H ztpTT@T@(6Z-9U(rAl5tmv0mePW00{v0X$!Kw)uA;rpqB4;jHuTFED?cj~GtD_`yBZeBMxN?kcN(Q=QUpj z9hNsyXXZtSR~B_#&jk^ffDq1^*)Ht!Y$vl#;FS(weUM->0d9IPy&|_;fd{_md>O%) z36m*fyd=o+ddH6&rzqnt%N6+f*ipF`b9A_<4o?zFNL>QQ#6fDpBfY`{vkNfK?H4J+ z7bG8l---YE(g2xQ?BAvGt8y9aw?BmQZp-{nh$i5J)2t1u@i?cQ|7=hF2WptZ7L?I+s3myLr}mTaGtk(3tF zR(TWBL)sl)H?+j>^vJM(yxNlr9m}8+huAd;UF!|O&Z{dv_BU%Ayj$a>u6Ngbf?IkVUAYotp#>sr<>>E+G}q%!oUC2ESt~(B-xb)U5bczb|kmYW^G-I zqqC3n&)M$uKV!zVSzGH_T_|C7;K;CNWE5_~o5Vb~<%WFuLEA&`Xo>CO{lmuhwQGE} zThnxtw|faTjKJ%J_{;FU1{4}uj?hKYev%& zf8VAIU$wv7=kd1tP~Qyvt~@NwPxCU$E{N;1|8tc19%Vtwr@kS9j4H<9rmiyFPbNyb z&@W{!dEp^3f0bSC)`>L()$A9x&5$!4=?i_g7iRd(w{E*==Am^d@?l%nv^Mtfkza1F z!K@WGFMXJ@A%DW*g*9n~;O^U!a$V};it-bVfhei3uO@%}V5(Aheaadw)V`=Nc`Z^^`DdT{ zzV5$HovwRtNJ8NfpC~~jFaFCT<@ieEx3L}{#{FpjMBENGu}vDC+m=z4{oyVp+(&h%M^V-3xf#Xzx{Y_<e)H`b-vb%<7S2 z5h#N(l!~By_nEIcTH7FQ1kV;LzQh+@j+Uf}`t>CR&Q0bu>4b-qI z>y{#2+2YDkM$6#RuA7%vftk|auY`h-euuG=HLQL(lljYT!KGZwlsWSi-N32xqbrr1 zF}Vp+&ge0t*?zS7jtRPG=3;CWMUBB5anK*))aO4_R|f{)X)ks(Ex*^*j;4Wvn*Vny zJU#l%zjJm$5e;YllZ8DTOzjOPOA37XCW_oL;OBf(clud`?Iw!ZIOo{iPQMS!{4H>{ z&Ur82sqWmuwmW|tCO#P+{zi1?7Pht;Ocd#h;Sa{(v*71%M|W;zau^ZcW@Kp12O_X4%*ci;snG#VLl=7I|)Z){3b;Co+Jbx zj{Bth--O`jKsRB0G9mCW2F~vm_bqQE94tvb1E-w`+8OZ^_QF_Cn20$5Ap~hZbpKn3 zbdZm%C&W+sUIX$h6vHCmhqGay)onnJ0h0}=7!Xww zbY27Ud&+d@>&_;B;rGIHXnx_W@|Wk(7F+O60mL_kbS&#I12?~B?cl|5)0uvb4fLCI zM`Q9NEm#Z3deM*WAROtk3_pR%ZxZ~ZGx>2JdKw7~XV!!5gV!$Q8R0V_lc1mVU=hrE z%!Z%*#^9mjzUw%%P{2t?^dyPP-(-Ry)7!28VzIM(4*5{d z4O?Nr|j9O}`gTs7f=UYiBStd4_(cK^Wa z&-61Qe*J{4gqw^R!^i34ies?Y@kku@zpfBkq?$hw=)M% z+S?l5g)-K^_a7z7)@b8?}&RO9=oBgt^LGm(_D??CP2|5Y?}b~ zVtDT608X6f5}I}c`l@tXG2nIs4)dFQMyk@N&)ahM{{OukhxlEJUxD~%{_6A)?$yM) zv+d1X00O2m&j)wUxAouo&=>~%-SazaI^vg`2q5u%3m*GTWjyEHrXzk09_lIQ0Sdk9 z*bfFbTe|V+9SDYfzSvn0{l?U&sZj2fbSQ} z%JaoH65@kbK?u5K2E2t3-+%5Ck$$Za{;q+4L5NCyZ{Q867x`=?L^_UtOef|(fG->P zn+AN>fFBsJ-GE?sUhZsTGv`yL!}mfs>)6b_nMTC$n@)1lak#OL&58|yG0tRd9h=WZ z=S5nkA*3VS*~Y#r5NGlxoqCRZixC$)_L1&<#y;A)

f9=9{e2bavI}m@090Qzg!>rOwsi>}JUh)l$x*Bs0OTB}L0olS13{ zRNvCRx~aKyWuEBGPHL*3UY!}booI^JY$S8gmLXa8r3}_$=ozevelk5bAaZDFX%6R+ z*iNzrop!28WE;sWa)x9PIfJ!`oWbT=o{5wb%h_q>V6LH|wKm)pTS=G9_&Tcw5cK%1 z7VfClybG|ARa_vfk^+%ONQtF8OFkyZqF=ElTC*VZ;S)kbd2gKuwYf*vdcY^q(@ifbF%;WWdYoy{wbWwrD!8pqBvN1m?ra4x4pW2AFhp4iBQ zHitJ7ZP}M3#xk`MgON_PUvOCnSiqT~8-!_twU7i`i~K_CSewjNi$r(U@P-I>t@aQ? z(J-znvSE$2!sqBUz(0d_#nShFi0~IE(M9Z)vvngsQmxK@Cg)8LY+F$VZ;J^6*#qT>g0! z1TNGj4z{K(Dbmo0Q%9a*>x8!2#`cVe3fJBm?ZV|#C$+A{UG@xcz$EpaHt`T{z z=)l!gb_>i`g*TDb-fTSh+9fX!OSnnaTnTm&b)3y~GIfcUQJX~sxuo*wh!^aZU|IIc z)sBe6borJ=+pHP=%Gx#yC7Oz|Ui6a-F1BupbeR1^)L04jm69doaBuC(?$+dr@*q|& zY38U!ug+`E!E7qpF5^s7z{*Ann=^ie&XG`|M+H02FW@#dKlT%W!kTenk&LF9FVgE(Cb14$dYMvuf7HttZi?$t-?1bD?lBtIEn3N@0&Pi4@-yUTLl94%A zedcEQ4^h?{$3G@n>kf8K%GR<^Nk&k86_|r#dn?$2{iu|!GT0(%%}#G?<5_Zp&Zw!i zu@>v6ExQQ=VF`|9*>crKjM-*U=GJK0%5|LewSlT<*+Nl|@|(qxIGj%FIS7^${3aB;ptm!$pX)|)`oi$~uwVpiW^VHL?&Qcs%_rtB8!Ah*)sASJri;Zvde7mKyTI8pN4*9rr@c+>Y@BB);?1_S z^Kc9|8=Wh0`)4(IgWeG7;FkgoxO(TN)ZEZ)x)Z1Hs#3Om23ilVHAp*2~ah?ok^w+Yvc~v7Dx}*nC{n zvD)Gf@tOq-Cl`h584FSuJ{M`Jr5j`;7SO6N?@u!}nKjisC|>GJspS`A=I;dA1b((Y z(mB=AhB$<1Q?1Ka)z0;K&y*@*T%3B}HaXJqze_OoqM{`?$ znWGC#JR3xVXO@8VV;a3q7>tv`=VzwVEc}e~fX!kJbS#2%MEh#fEE<#*tucJfQfrdg zpzx?@{wjj69;ZyJGWNRcSTcC?W|ygL^({tSb4-+}nrF_9`nJt3)5Ny5MH;xd@W!IO zsW#e~{VEZ#I<>U(?MYMf3fz-r4o~U`nGI%4m93tKS8ej6A#T2=H_x$lc2P zr5S-4A~cgi(( zHzNkAs-FufDz_@MtYuWyT#tM2PASUDFh17FPMIvKa|#=&BJRm?L!PbPpf1j{2-8f+ z7HaWl7?`vz$@;!SdULBqVc8-FWKujO&+Y*xfo%kivLPG|H}LHYJFwB4+i>NNXv-LW zUNVsR+OlqV1$;{@E<5s7Xzz+0m%C0MggveFc%o;O%5!XX%2+bb2+NEDjMD+Nkil7* zm?nlbO!Ja0+S#Z|rq#%=Npn@x5ovA59W@F3DjSg#UM}GEdON<(qeN0dT7$I&FVx%; zYi`S8TXDK$44!GEBP=y_p)&kT<$U$bJoT#ixUR;rP>w)4MB}dzD2Tl&m*rGl;v1m5_wCz$=j?EfgnC3THO(jM)^6BeS^zKH*`QT zZFGz32dA6&u>2gX6EQfaPnX3yErWA1dENXX>60`#2h&{HIAnJ&x$yE+vpZG3N-|=} z)384Om17NUnN^71QBPja)#I!fChBsII$<)xZ7x_tD(XFxK~I@^4W z2UmV}7tA;KZ17=S33SsIK*A2*wr%~i?jl>!j zZLe)M<-9ayTz1kReOs;8-bknBa^(HSAk%Il4KnSlG3d0DILNevnA~KJM z6!Qu()999Y*i@T0{3gEoG2An0{AgUhAEaZ>oFGYwv_@m{h?GUshv9U^?--5hiZ5Qo zzN{~Ipe~NlWT4EEs6b2MTU}T zl)>2ET4eDyzhEa=-W`~T=Bu47+H$v(MGq?HAl!5BeX_i47e98wARKKjCEH37tgT=c z`fauCqZqDBonrrR$U=feWoLkG;FMbsaodolPiWX&IVnpW-ETGEBFFFn*_ya|%Kkwa z(U!X@BH+1b-IliW1m@3USx-4JOEulE*}Je#Fq+ES-^{I)Sx7}O!t7iMU7w{()j;_@ zD?#2lTeYYBwWS(Hf=@Qv!;xrSc}(PdLMgH?1HSk+P8w#x?R5s>gM+f^)A5{ff{V3A zo*^4`I`IvvT~9We@q>_D>f)@$6b45hf#)}-YqBA>$oo$9753yOs8Rsb9H`x6Rks1E7hV>HwiLyCD z6VBot6yEIqB*wBZBqpB_xtwy9EgRdsoC%l9!sgp#-8^p1tRlWB&m$kuW;L-^j-rUn zRaF*imrqh`>LSjrFyiuyl#gRxwUI@x;cgq}bF)oLzmyNMx(XedBG!+x@tFf6gq(k5#e_Ehk%UBBHhPJ%n1jURj#@|a!}Q7af1uIy z?=$8Dr=3%+qwD;5T?Q+`pIUJiCN)fIpX@h(bf_@uhS|6nLO9>vpa_`{6}w{1EjkLD zg8o8>w}?4Nbv2laZfQopIcV!eLuU>hAHL?`co5D(;$WMD!~T_n>(rIN(}X?@9=mYY z--Z(i-%;c?QKyqEp63F-TvizFl7_cd7{h{e+tEjba7U7j85`_h*_>XjX78+X&NdrU~QGM5V}(I1`-38Oim2^?bxyRi0@m73+_iB=PTy&EGyE+jMWpvH3__VHx* z(W}n#8aX-(bp~J5BL-Dv=EP^g1(-VM+m=GG=G5kDIz(r7xej> z7*$l07;p&jo*y~-f3KK%%{{5PZtxNJC53nmdCkDnLW~O3^rV7`p8gB3>*+5F^rSS% zFGOO%7wk!`53NH*+vBN%t@kAx0zXWNVUMJb1;YK> zu+OC_=jX@W-bXndf%4?-Rf)dNst@0Nyy1>M56YXOiN4j*58r)a+MRu0>P+-GfqNkO zQre5WAyD2A{us{>Gh<3)JPUhwVf?;*7 zN}eyJhR_odr5CB3l~Nv{Yci=yk3BRdwSh4#7h4=zgdeX)H*($m?c08(5zlHr&QPFe|C`eJ))Bd5g<}N#RQL9TN)% zD0_Jk#y9NF^e4l!ve%U*`s#d%z7IO|@qvEWM0a64PO&+u1@7qAV51u5@rzh@`&b9# zF6!;+ryhiOA@%Iz@f6pBFSsi;*7xWUU-X`S>gI7rO`j`zPs$5kk6(y+2(It2&ObpcY$5Tan z?@JaZ?@K!BcBZ}2(~`G`?@5whMa_e$GOW8rv(sr;=$C01>|oKHbUIM=V2b6Ez=NsM zZoske$y4WozGi%~i*~`f>&7RGLJy`Yqnl87d~#w4dDXaNRn?{xZL~VDDK)P;oxV}8 z@2oPAulaY zc4Dnb+`4ku4*MRTETb%;iewODbXHX)E2=i74nvmHOtO5mRmpO6uUhBSxvTEs!_>E< z?w({R^j!uS=;xHa-_GhgKz+ZRE=ij84SGi3fOUNbArtjoL489nm7z`jTGgbaGg+DR zhc+B>*Gx)Q*KA6?1NlS%zP55#$|2_URlL^YaQvdjarC}#`{=tjxP_R5^fnAPfwUdz zO{Wn1ke)-@gXBW`7|!?zQWEJoq+X;sdTP;xVB$u>wD}oreQ)pA(JK3JFSzubEBY&M zhd+$=^oyEAp9A}cR+s3bU-Wgy)7+zk*pUiqJ+OVXxA?@yewWxN%bq}@&jmk8xy4qr zga2=Vtrx++`K15Ym?{F@0lXOgOxhRN2;JPDDnjl<9zb4%yaah^U}OIRA-=h@9P2U~ z>fZs|+41>!$`QOTx&3MQ0<4p*v$#I*OBVKG4ny}Piy)JCYHzx;4!*DM^|UAaSbD+2 zblP3>dfGkjk+i4g)Z~Jd>GZgnpn>k3vK@6Em3U{>sY!u-!d103)mii5yQ&S^H>PD> zPxuk=IqkUZU1;z7C)&$>N^DIr;IgA)9GLl#)B~lZ9B&GXxfeS zEW|jBpZncsVP|*t2Ljmd;3q{i(f8c3V=o8A7Wg~yUSRKq{Q+@%zXt=Q$_Pf6v8eZuS@ie9ljxX$zt6{?-D>fw~5d}rEOH9qNstvQ0@l1pc#VY`o{ooE-F ziCAdLwzRW*Y;s0-PihI;#c1DC9!(d8R9o&xY*%AyH_2!h8k?L6{VYbiF1=j<<7A&+ zy`8zg3Zq>TeJ6WTOVMtX-mb*fZlS5aQ;l|FY_dYA@vYI@mD<`ZGPOI+XcvW!U;~Rx z<15q07uv6dm$pgm~83$cFZ4{XBP5qPc zdN=FAkjYttd4_#(o^RFl;Hy*ZJbCm!-q1rG=DAMk-I(W9-56O9KyMABBGp^rT7>=s$TN?TsEt2Z9eHUWC4YFGgHYf_(8B*a&n(I%9-! z>rfAPZ&^9kA9Y&p&VwBG}1$CGCygA)kWVav9Uwm)Z9K@&0N#z9d#4L|5%R(y z%H8`?LDY2u7XXfZH~^OrMjH*Vir4q0oMHm@g?%ZHE0_$HfFEM*Apx{6P4pEP1(OqD z7vxn8+)&gD!tV#M-_sXY3&cu-XThzh5Y8g>|A<1Ivk{{h@d+HYj7xSRE-})Rnh;fV z)OdQo9_R+I%(>R=Uu%xzUvqqG!sc6hO}-WTB7G~)m??J+{Aw@!Y88BRU{n9Z8s%G$ z%#Npy;A}_VdiXGM*i>?ZiUAo*@C>+xzIAV+uMl>yAAT5n)xbWqNr(+H#^AZI4EkbR z=*N1!2|m{~>(TUX_-YZ|DPs}(S^C}^VcV{diWfZLhtnR!rR6R3y*n`f70IePtVi(i z-uMW7@6HtY(DyQ~bzwa-zIV-f7__m;adWX3&f0-E9BVSvlbTnd+WEvz_(Avqq5EE} zdA0r@mTUghiCq6X(hk@veeVL7S|9WeMOE1UwMV7zpx>A${f25cNw#}Pj?qyQOwNQ3 zS7BW(LVLCi*xD{NwN*anA=y7{DHTIIkx29{mTezPm)P1aGPSML`*j51y8`e%Xrp}H zW9d>`yTztO>6Mg&c$DRz^*n6RhKWPuNBkJWQjMGv6a9S`XKwRcUKR078*%$qb zqx>?ed2fXL;4^L={KAbp(%!w8|Ghn_ zYtcrYf6&fnYj=&Q-Kj>qI^~lWpq<)7A5IrRPWHz=lzy1|z_l~DKRhOF;&kcHcckgN zow`qE`~CCalSA9E&Nz1ZWX3?Sv*bbe<%96c+ftO7aY=E-*klQE`eo9*m1C0=*Rc+K z^2D*pBIH4&bO+NWWlTUt8_sK89Cu2VXPs1m>q)$fs z9H0Cmd@}GRpFH>P@X2%Gli!3tK441E0cN6)eikvik@mt@&!MBnWB1hpca0kEfY4+V z@8Fz4BSudQ@ZK>WPV(vAAnz8d5l1h30={u?qHm}ep1D_~-IwDo@n!H`2Aw-$KTEgb z{EIcFbu-qPH&C{>Cv`RMON6*~;JeK0a5sY(i2G96-d(9c-KKtzxE6IE!Wr_RlrQ)Y z?)aEC0Nw!H2JBrMQoU%4GfSTc9!PltN7L>o_s6BUGaQ@r1bD}QJ0Q?l)&ei394I3O zkYxwTPL!Q`*@?0XWtU!dq3lN4t(V;>dr_;l)ZY{i?R=8pI-K%T!3kzOuBc?ilw^zsmti%~At%f%=U#T}P72>k~RKp*AFp#nUh z4=?8PtGIihKEEROXUr*d9g#YJIEC1`--X!Ahd8UK>S6G?_Xyh+pq(51*bZwfRS12G zsslI=-PNxJ52i%#xTNTPG3D)ro}&lQ?qDj=du=~`nihO9<=A^r>bDd&Pz+iTe1!w} z5|oFqF7hJe&Tb@(qX^|flzph@L_PWiKgurTF6OA?4xnE#HtE7zaSP0I)j|00VA74U z2W4*(yioR_>_r*pw|-yZAo>sD{*pWoqzdW|f^QIh=fzY3$}Yq^9+V4E_M=RjBTxE< zLX>@=vs{RB5z0k+nd^E8$^pGR1m$9sOZ0Lv%0p2u)yrJpftro|L&XC}?6$iT^Ak*{ zJ4i%X1Ngrrq^e}Q`F+)<7_0_2Ib~dUczVBHB-dUHYmYIpBb4Z?S{a8t7xo{WJam9- z@mMf~yZd>4o;t>M52m8fWjWU4Cz`nXlA&Ar>w-P~PR#SrsH=Zx-LBM*8mzayJt@w4 z#qdO5QM4zu6>BjR=)qkA^q|{AUEQHnNE}MdOzcX9YYt&fPD{=T97@%P4y7&(9!fPt ziF+A(J2iPx)gk0BryQaJS5_}$e#R%A$Qx0AHh5G+cG{~8xCn3;1IL(&I5%*Ypxjh< zNS>`f3p)E+kvx=I3BGfJhf-yb(Sv%Ln3TLUdMMSr_Ymfu{f)yMzYKUH=Jw^(W#Ulk zdepB7k@wi-+|Z#^OYb3hhWCT+3Z0R>9CdC0k1MtwO10LoukpD1>`7hOeJIsdbtqL7 zdO1}PIu*9?a%u=*UuazNs=%RCJKB|XXC#dKu!m()E3xzdX^`5PCIL z3B0QW<QSy@Ie;?m($`}i!oYdwVvnud(Dyjn6jj{bcLQ*qIf&cmZs^;6L!xg* z-K(j`S0wtbM?SF*w%fR&?~CBqgnB{p3*O%MIQTWAT+K4x8N7K>GQBB;dbrPzpq&ps zHdz0IzDCr!6R~ggiRH<#5P2Q)8stsTG3UK~FXjb%G;O7LW_Mpp0&`Y( zDD^}k{7}gqebuPD0)2k|>_lIifZbsJnyOxvZHm@)qc7M1>U;_Mtpi*MIEz8R--k2X#Qqm>SBv#nd3#@wdE@PUmB=}k$Ekv^x>Lpar_&xNbns{;o$(UMrDPuPcyq4me*tb4HN2C$N6@VogDB&D~flz*E0< z$wR4d75qjJJ|l1lYZm@Hq2`nssw+S6at-P0e!9>)9i0{C}dD51&yA+RYK2+YHK%pash z0Cy3Ho%ya(1iqiv@Gcd6`u>1DB@pDhHoU*Xy#?!2cCSF4DDI8X*Pl>_GEtV9&=F;G z2-pw&JUWsw1GX9&iy_KHy+f&zI@Sv&1>y@$+=WHT_H_tDSd+k?;pDZbkYB3>9O77mOS;_gb! zy|X*fR{>jb)PR=Yx|%mIT*i`%1`1#^!(cBi@m5-^S%mkiZye^j)5H%BV}FNjZs;Ex z68-4TFTj)U`WdtP;iLSpImR6y${2Og0N)!(TMunc9li70N6b7qHu5AtSK#F|dH(*` zu}|TNvGqPBW2O?sOdQ)@dB(y!3;pgZ0KYUAvT-d8fm}0a>%H9r&Jg@G#;YZ;KZ@qz)!*B)F7&P%SjQg4atWDH=G$pzdnv(e%td*Az%QEyM#G~N# zXsWP^X+vsgH}3pQXPN=Vg{E_$iZ#{UT#0G^p2NIl<3g7{fA?GF5A%DsqZ?zW;~3PO zaUPus%wrAwgfVY*i!pBpp)J(K_nKw7b^toI z$O75@jD?)g@kGc}3A>^^g|s6n&l|ct`;gz$KeSgMj#g(zLmoHuZ`jaK*t;g8(Eq`a zT44Qf5qNQ=CPKq+41Rc`Cgu;L-@|tq@VAJydpD-4^4J6#{&LR&v{LEMAi?diYZR;4rQMd8RZrlUt{$iYPrIIi zrhW<`7th2>Pgf7@xdU+!(r%;#(pIGHNIQ^rBK0CYi}W1Q^GGg}9$)b(J!11xdt_ar z?|B_Z-D()G%K`nth61Y{1Lt0eu|UQE^!MyVyHeW+kS^*;5x@2OyHdRkID?Jbm3q#( zE46dluGI4*cBQs9Ko%!t839?o4_O8v%Q(m~jpt=`PN$AtRhW0g9WEs5j(UNU9Hm8< z^!Guh^c|cN^L+dabYni~lU=&(ay}AwOWk{5OVoWr&Z&4$v*8~BUc>l}IlJKAo_@|7 z=gI**>yyV#;Qy7a39Fq){TVyoGM>6zGO*d3JAZ3{Gwi%*h#2@{InF~vLj!xD7hi!G z@E3*#o&@Z2ivf=}G_V`6(8Pel85&3co~gILYj`*IbmgO|JH*n`4h(&5hdw9+enyp` zO(+PP!}=;1(Ve93WW5k@b%_CNHt(G~iFYTsQxy2lAn?63eJ1WEkmDPW5caw{(I3J- zSAnt99)1U1or`tKzO|s@_iOl}#1G=Q+rW8m?|sR)#q&qr7N18_`603M$RT{oCT$1( z;vFIV!h4MAJm{PIEABhsCpTeT?nB>q_79D+-^G*>|1BB7-Z+YVn)j&Rpx^2f?>=y1CqBD|cb-exiT>XV?no81FE%Yd4mrcn$%L{2zv1h8v%YQ* z-V^a|>Phgnui+i0{%8aA3$y{+!ryBLOLZQ1!w%@bC_DEu!yg!99WL$Q+5xPIQI%+8 z*n!_<2POZe-q-W4vgicN-(Jiq^!T=T8gsV?N#%#cHq74^Ie$l7O27VZbSF8Fv?KI^ zxr7Zdj>lZ$o=VvdVsvFcOQesc{TT6*c^(-r(Kh)m%RFE2(1r!$vzmd&FkexXJ_wk*o zR%+@a0Qjq+1ok4lKN#Md?uP#oXvgnn*k&{Qmuu|P>7(P22e%>?-kREiwYq_2u?=z1 zHr%ysOML{~gF}1zKS6u$aUX-;ZL-TRVVrxMN}eb2?c;{P2Dv}-eK5a+JnyL2N-di7xRPrM;V8Rz*{n|#(h>ME>dyG z!U4u1l#{l^J&}6O#vyO$amY(~;}G7hQ5G?LbMn06o_@m)+e~u^KkGl>Q1&C|P@kWN zOmkS8!2BUT8HaC%IS!7IbuSruH_m&|A9ync32g1|$3FHRZDSGops(`4PpvfOy4RJN z>qdMp$u(JrzRh#J&?L)Tz`LV~z98m>y1Ns)W?$@Ejtx4=%o+6xenZeNZF&ZB&MRfL z)~OlzSc|7VUa!W?_qJ%`pD5*CJaGDP+U-ZX{ib%Opzia-;wj3{1@wvuD2JqR#d2$=|1s zNkNt;A!W6mCL;eBn+PsO#TujvJ(VHfj|Ki5l0aGq<7bK?%|P0LV6hab2=GMYAG`6M zNl)96FGLC=1(2{83mp1H3sRY$N|5`IK6auV(hek^{8u8q2E{DZQw{PE(oqbMX|JB1 zMZOfN8mR(lgZjP^Q1%H1XI;GD%!@C&@XS-EbpbTC%y8*`DdcG!CoPkE?i(nHihx`2>8Qq{4F7}*|VGa=Sjc4cDH-WkN^6u|C({;Dea4wF2DP-Uw(hCd*a@= zdO9y2^|xB*cP8BS`#*M_e&mfihRrxSYq4j_(I&etpyOKdw16@|#z7{rkw3Kls{*>u#Ro>RW%`yA!%jdg92IB~x4@ z?sk82UBNXUZMfU_)5@Q&y!SIV|Geqoxo^Jkt&OjL?axPUe%kf7nF}K4Prmry+F#xL z%qw@@cl5jqem?0x&iq<%TJ@zLADQ`=%l3cq;4!ruccvyGom9$f99r1W9}Y(@X^gr?|*mbugCm(-w*fJ#&>@Cj;j(EK6T$WmtJ0Q z?Co1OeD|%jCtiN*s~a}$SU#ifoMXQ(Ij{2R{Zog{Y?zV?-TY2qM8yfI%kTgE`L8{B z+D-lc-Sx!A*r@;f(Z|6l^`BYv^x+%D4KIABe^My^;IBS&>#)uTMxOrEnRhQ4jomaKL?2;#z9UhkY%L^xs^3VV9kMW9&-?{41kzYGw*3Iv>oE;FF!|8H+ zyuJc|VbPG{p>~C=zN@C^#BKLE|1fj@TQ6Su=BW>b++%jue(=YOX8-BQv30+GrD|@Z z@{d=)w5I6`fuFzdv!|}JE98^!-P1F-;f{3$M@EVl0xqrRkw@O!`^T%>7wv4l;_Fv` z;dia^pl`{`E$8ptGyn3R@A={Bc7xhEYuyy2hLNA}YnE474e>^;};+4z)^o3Q6R{#F7TPr+kM*cbZ#zjB-(J50GY-?Dx z?K{rvYJyMhX$x;L-T6o_O!j7w>=dqSycMxgEdWxW)0k$mH+dKWX2>((A52@qxB; zriEtg`S6Z={!-e0EY|(CeU%T~{=v_Fy8YYF|pwY6~4Gh=>u>Ff8uGuL%% zVfljcO<#Cu)YzNu`ZW1x|C7%dx1Mlf?{*<#Odd~~{-Z*nd;E95g zcRo5?u>7k3_|iAlo*C|X;I}We&NS+o{Ufa>(76D$^2h^_=}D=E)MNJ#rXPG{*?Uj@KCs}_ zXS|cmZ5H6~9$O+o{GTuzZV0w^t}xT`!nU;=7&d%F$q6TpEInz|$z`L*AUv==pHe?q zK6ad~g{3%+j|pQhAH!piY3I0iXI6sb62I4K;s()NkyKP<#xY3Olhw+`_iSV6Q4nj}zFZ3Ma=2>{kU>oWN^HE-|cIixWDa zO1S*#gst|}1IHC%^IDwClz~TcDClo}`fkuw_L;y38pc($@1+EYX_9EjK z^8hQ6O;jM-$;VI^hpPrwV;Yz+53ImEFrRr~j?BOyhc`1W6g=i(xy{3JnTO@f3=3`i z=22;J4zF7drG^6F4HN#~2h#Wk{G^W^*LCm>C5H7QgZ_Hz)-LLuWQuf(x0c2J->Q$7oQ6 z(lR8cxW$(v?@SP8BSGF6vURdvS5ch622}{e32aw|k~jgE9Lqdrvyq(QMpvA`237FI z2^>&`qBwz%kT4i#_+mu0AmD-lpt&zjphy*p;sj{&ZgFGLI9HC)3n4-^$eO^{Ug|Lh z%R#I`a*7UDoItlK_~HcAAUcZTAERr`pC}MfG42Q&4~?_vGf*E$6pIw4khLT#k1*u9 z56LN_x5=TtEyuU|wzx6tl7brYF$853pR9?cKwyq4XmJ9YRlyM_pcFaGDY+j}lw75d zdl3?5lGzLiF3Q?PUdvMr<}oXg4Hn{8K8BnuOhkgYF`J8|{4JqDEDjW1l;d#@qLz|! zF&pqPIxPZRfdn6U|7~#^Fzpm0GdfiS;N)X8W0OHR60O!&&Iq%l9689Hviv`tLIpY6 z$tv!Ds#AIw=#*I%&-a4{Dr5||!OW;QFUK8#sL#@TPS!+lMBGtIG#|q{f`BWLFcM}H zk(^?cD^5U}*VW8uCBXaQ1bS7WC{EyGSy=0e6R48waIG&+fV;I*tSyQY*sThII05Ah z)|SKxl)#suT4|gBFDOtbixb$11aHPHA@Qq<;(GubmIZW4pbUEsTKM7w7OFx~oIpYq z0&xOQszO&&ttv+!`l94Yu?FN8bkl>MTjT-~Za0Vaw7?Z@p8YEZ;v&Q3EhjKsj zm>Cs6)jI0_KI@nPp3*u9%vJ?ooIq3+isA&GM1p#V6H0o;slg4UsoiZ z`94Jn#0hZEaf)>%a`Ty?3Z-!Z-KtO)CvX5s6U&mwO67cFyCuLNL~fo0Hmd@90dPPS z0&xOKRVa%SIIIdKaRNJF17J`ZC$Jj{8*V;>;8Y}#GSjvfg?&ia+HRGBB*&>61VKuj zF$fm;F^n6PVGz3k(zaz=@Q{yr{!4+u{4)z8DepjtD-{H0)kuT8jex8;k6BQ!I4@49 z0txfQ%;1pUVoGGi`OJbyYRe-;*MYr|nZY6V>;a?PSygsc= zc2&cS0;}N?S}F<4dZFm&kzg7?$j7Y4nZRJI%v7zVv!V4ln09i?KWq*Oqnm*&B*AOh z^aI(+wai>#f#{eSjSfdWRFjXn>ndO{c4l->IA5wdS!ZkvLv7@ge+!a47Z}4*q@(Cm z**W5*d|W6pLR-A!M9nJM+ahMFQCHx2joy@vSTj#3Ni9<_eEGi^Nmc zHNyGo=|c>}3D9+@a}a>%R6(6X_p5?Bl)b46PI>e?q6#i~+WJ@(+|mR4ARV}QWGGpx z3f?$@N>%X13Gm#6Y6Woub5y}EBhIC&P#7n$QWc8g1lFj+kT`+Os!%L_8OIB5L*vH4 zQ3%92V*>Vp0%i zc}4NX3A~~T1#tpztAamH-~&}Cj1%}o6^h~nc+^BcL*fL~20N@+Zm<&-WoVp$GA0ZT zLz7Rgwb#(v4VO?8Cq&!8;$*fG31$(9B3~oXHT$p=y@CXf284XfT#JCg@?|#LCmWZj zO4&ukG7SwYmYLD{eAzjB%(L)-)vbB~jk^l0=?-!|&|FXzk0orw#}JPl)gie>OjMs5 zC&-%ENp6!LO%f=g&NUy~9g^*4)WE@=T(=-W^is){1rE?D;A9A} zPgG=Y3B1wDbJ(YpoP7vV@+<^;PE9{EUA~+-Hk!D^Ex2PcYO0c5^nau-jgq41{Ral) z=@6mJd72j=-Ke+~$swl1neUMB)Hw6!B|I(8{51(z%R8mR5t985vwHlkj=36BUgF?<1 z#0~+2LjHk-r^T83@WR+3s^iQnBz#t!c}T+3f?XTDv+=fs)!O8DG3 z^H(H%UYz+63By>ByD%6U8uKy#StAnM=56vU`J7QeE+0c)TLnG$&^Ao&;# zpn09NP^V#GAQv1p}K;1}kUm?KpDAE={>`9X7yx3RX{f8_$CQMId2zfUW?iRB0 z`$(W9Rks^}5--mImF+5#pvS5Z z@&r>Ck3Eaq3K87OZqEv@8s5hV;ZAHShi z2u9oxn!z@e0dOudexHZ|X9Za@BO}O?tROk-F)PSo8oAQQ;u;v}LS?JWC=Aw8Alv=5 z6QKj@0wbn6ux1IagA^O2B=br!85MFua$f&(87GlUD-Gb2=$^|6ps|Di^5cjKIU$R= zI@H`OUWvhnWbZk9EdF7VI@mePdl3Ec36@Dll4zG^pb> zy3H^8@u`NC`P&|!x(9PiH?4&5B}=ExMyPy_hN z$1d@1P!9~+_Q?!2U)yysd~UAj*W~cEVcMz1Bizp7z{rz}hiQvOVs%Uca=0f{`p|_Z zIg8INJkLG;q)SI!a1s<%Eu6)djvxwr+`=(Z(Jvi=yNYVzD9sisKbDM!7tp{O8h78ah5n&l?~Cl!IhSXlwUIQ;R2 zs4!`rf}N@a`P_vkafqi)(p0nYC(S&GQ!(BxrKr^Ln4$|#3WC=Jw@J~b50#b97=gxx zZm1s>CJsRbIfsQaP&`u&QtxI`mK~W*&K55nK}6LEt*}r{|C9_LH~CC8iLYjw5(zPl z)0mz5YBNVA@mYp72r->AD#Y0t)`c^mKhchO4_*$B3##DZ$B3UFV-e30By2$lF(8Vz zoFDgV?|L3V=6oO6&#`=g&vpJ7A@0i3+|F%By%EBO_dQLjobWcF zXYDth3srfm_ZGJQtx@jwev$OQ80Dj$XIcKlD8K1Chy4ELnTD0;xe@)ZB>jk#&GXY! zgxE;BUak*9SQGtyl((@zogOO};sKUF@O%ekjZSDuf7_RcWX-8EK-T`d2> z^9#&_=gJCP=CS;-?AzDIes1?MTrA+8zZqR?n%C|BHwaY@geZ6he*~W(dXjfUp=%qw z#&>}!)UNq2Wd4iM!5ai_1TX+V6g6TFW&?mC_q%G?S=39#iGnL2!gFNxoOh`IigEbM zULb~a;K%MC;>m~pYq1zk3UqMGb@y7^h*L+1~|Bh^gw(xt%il0M^9}zeR;4K1w z1n@3^p})fqH$y4q3;`M9M&p&(+-OSL zHNFv&<2)e!lTdRxfD^hM&B&ngE@UUJ$Ir-atp{20TvT}&07iyi?!1ysz0T&lK>Dvo zo&N#=Hg6yUn*n4eeuy8i`3th*&8XsKOA!bndk#a9eAej$oPbi`8DL4lK!oOXsG)xg z2u0cpNUGHbl4DyyQgm7jG;AJ1+vIcmzlhExv2-SG2Hpm`^j>(jj|p54i!XzgN>^gr zm`Q+jDzNlqof!a5`U9qj=hji$0!IwL^BimOTjRJHG&17Zb(A*Wu}ad`WN2i`s8H2K zJ12}A6`6^XNM+o|mWnHXvs`)Z&2n8WX=~9V+cD;|wbI*Pt(oNzR%%^awa zZMsNxNPddQM$0gfYGC3dDxh1IYaBNjtQ7C(a?vqtF+509IZ6RH17=Hck_Y&1Nz>&Z zg44zd+e-0gV}NW85B97Yep zDwO?J7??4@$X+foFq43hJkK^T=K~{Eb)$i~+Q6(ZFxLY!9@ecrs$<45%#n(8iqSWN zdNHY64604pRbuo#MxC1to{s_}rTvnD;X6wy$r}dd`$nCY49r0T^B+29Tsh}44YZ@9 zd_Sb{zz`hk%RU6g>%)%27!I;6=Y~+I)kyy@(Q-FmPB#iPJ>aQaaKwt!hJuOnkK>;P zzwuloqOuYg?LAGKAcL&;v`MHdPG_i9em;Ia3$knF8O%yG*R>Nr1Avz4S}rDr0P~v6 zb)9P>L%tgc*ZRciH07*4&z9H1%4sj>#)fLBhz&t*W^jgTB;3qg(acs>c`aCKzcnQL zt&&WRuo6wQ<=jI2698tm4Jt$`1>1&yISScrgZqpmaobR8QI3fF#hFwPnbLK}_?60} z7IwY{!Q9ORZr0YrU3zaLyiUP)5WY#HF1#}S)Zsf#_`9;O7{i)|H$xBDiQwwBTE`U=W2whlPBhr51)vW!)SIXHQqbHRTS0IkHqdGOqTvXo_nqz5KL z=nZJYk8rdKN5Kf}K|Y=|MmV+wXCudH6*r&+82T?Gz`yukN#GPPiviG21-us1mdgvc z4N6*$R7$%+N&6hiQrZnl+Fzk8rQIl{L5Sm-L`0+3VM6=$4DyAQ@N3e4pSk>N!N>c|-4dosN6 z#igCdeY6HGvU@DIwi@i3YEvsiGr5PscTK(rqtkvUMb#$AVgFDLdx9MD%W}vQzQIcW z<@i1(Zvxe$z2ewU_yxkRD*O)!|48D!KPLPW$E&F0Jw*6535(O|cuuDcoX&|qnLibf zRDHp}oI#mi15O5FQvom#^DhO!P^|b>01U>8c`w9BOh#qJr=TDOdJiP%dQoa_3RRomeZubD>dff%Df0{5)gfujN{~(kU1ET&#Av7Os%&Wyn>8 z?xb}FMO9F{$~k2w7)-~kA_5gt&NmA4o!AMcQc6y=wtOq4+~l05)kyg^N%^K}^Q3fl zO6jI)^QCN?rEF(16lGgFOZgv*2k@30p1wQ3B}JRSzO`RS!UU%*Xk~*6YfI2fB znbjQxb}meV&`xuWz&Wstm4~omp>{P@i#tkrzLpAIhKf?fd(i46PTyew*>e$2QDV|? z4tc3dn=nBE9P0$R&0j6Y={O8qrh+1m2=ss8JgdRK$5 zRR8s^VenM0S5cPgzd_MILRqT6MXA4XxPFpvRqB>E#q6d{m464iRDZitzjIqs{;$Kd znAATml3o)Rb3VF^@?P~Cb(NZ*d1!wf>7BAaPYcQ`Sng2emr$1TccYX~YJWBrill9J z6(XFX^40xIp|*h97bPq4<5`MbR!;SOl9im|N;ZqThWe{OlvDf#946(mcoTqJ7A}zF z>=ld!D#R9FauxVbKT(J?fbbUqI2*u;7xCvR{#?tS75EVWw)p_I&ySt8hh0PbO-8#p zM!QVyECI4>Pi3mv{b1lja%@AOE;+Ujfl)U<@=#CHr0?98)Gd=ipghU%RrtNY)8+D8V;f$YG+#kVBX0qq zqJjeewB@`n^q+xlc~9t{2cU_-0|4Zu;ZFhFO3csj!`nmuZv5~D(NDU(MRWm>w}__z zkhh4x1HfCv>AXdh18+fZm@gr31GTHowr~wcjB7MGURimsQJL3`$EhrbybhJQNacNm z{H?(yj8eyI`Dtp=y$zzaoDq?Bid*`;5jc0qMR$r@`n+>cmWwW^=(Q-zMOW^YJ}-{4 z^m$|5(&xR1vh=m%+|uX$31zwHDkRp;{qEt*HDpE1#8zd-3&3-qzEa#Q0za5?O zmev0`IvR-Ve;Gi4z)=9aarJjWTHd<)DK>9ji%$f=Ti4<#0C)>Ko!75Y$~y3tbIq&Q zPn*6dD(9I#B_#*0Ef0gSe|vSkaQes`~Ic$<7)eU zN8-IrtUn;zdZiWhOP*e7L46Wd`(~+I$lI<(XyBf7I&HVQla1#}v(u%UD~(=BbcHl< zCDE1ctVCByLsk;iNF!Gg&69W~#RADxNw-k)QBp+RqWUiOy4Kw5T2rq#sb1r(bhGMJ zzV%tBdX;Z{ZZS!4t4V^}lmt>IcSt@;n%k8$QYY&bES<+>7R{@ggo;(wqFnL1yaw z_lfEJ_g8uTQ(_*I4ZQNqCuF4Nm1jQ9$zz;Xo(pwYo)=XeQH}SjxN0-^)^F-0^eQtZn7I*4~OyOEwmG9I>1 znDD)T&3xcXWHe3>+h{aG&M#p25`bUK@Ew5hOvEhnJCof=N05w%Z(aC3LIR1Ogqfcr zy+9Anhc1Q>0|Gw0>*2#&6q&0m^QS{RG4e6G5ezg`EUWn{F>%4k_Gqh$u8W%XUnEseE0yIKek3D-BDx$5k&XzOaNjYT?RodW;w zcX7#rdePO^*}S4H(im(&2coui*8KUiuC85h=`|PEF1)(t;@Vnq$-=5^EjH`I&$Owv zXuog@(p02rVm^4yN6q=b%?EBiaTi^6rNAigKbmij)i$=bMP!Kr)J7WWYxz&kk(@#B z-=E7M8tNOYHHfg*XsX9_)Hbg&HBzV>B5QMS4Y3?l)P!nps<&`r*}{ehGY^){3>sn` zwQcQf4UyW0_O7;Aq{Gx5NETkK+Y)KB)-W??1vB$Cu}&)oB4|;yUC?co577;n9V;eE z45w`dX04?iRxW=sb8pP*^lH!zyNR}hV@>THt+h8rI@+6Wiew1JjEaWX8qwAvI&Kj4 zT}>8pLpv0(Cd-RWnmQtC{#QiWYGdL0mPn_Fwy%afE8ymu#aeNbg@+trq@ler!jX3h zDiEo@8P9xW7Iq~vB{nmLMsXTC)<&fnidJ-i^$_ifiT17- zGo#*$CfHYNS4-`hT8Jw;M7`*!7h%y6&Q!^=YLKQUFs&v-LMGZo zMI{NTf>_2U||NLtwFM|npS75BNA?fRQTt;EbXW@E;k{^Ct|B3;oJ)O zriTqXBQYpWt~#@XCKA`5og^pLjMUlK>*nDO!;5sZg^)~hY;FifEQukJ4bl@-dR4az)>uQY5{GSW4NnCJ3)+emTD(yqa0(jvD#^xJeKjZ zSr@ivZCx?`$!Ya2$=F!A`5OTMaSQ^C0Dxt}vx|NAYIs>_#xppWOZ)~$CQx8~1`D%` zD_H+-=UuMN?mIo3yc>NR3g#5=CvPLDU|j|jdF#$D-p^PAXZ*}l188<};9hN$W219} z>$tRvOe=MrJxCub&Esb9Vs6JE=I?E1)=RaNQ|ZghkHOC%{FYjDg5YS7dW!mAn(m?DAc)<`$q}N~|dXV^qu3sFvxYTE>ug8KTr>GGbn)BIRX< zAf2(s#z+%5xS)2tvEi@tJ*Vb&`%iEbVLlApZ-FcDk8o>Oy4{yLd?w1DWo>8YWp2$m z{F@GVmrSGEU3#Od@Qp<4?e5X20I2OU3+rvD<@Wn7@;K8s`}Q~=c3lSGc6Wit`MAp$ z^L*3!OO%FqoEx3KJ?_ANx`$lu4s^T6&T+dvmpPBE`=)!C$Jyh&-Q)cIy4wjDxqGO` zG4Z6|yGMSqfB}*aBm@*tkgy3TON6kf z2qA=3QB+hM7jQ&H#gQ3T5S)y|IPL>8=(rn}fC~!ZJ~IyA^HiO_x9?2=XXc&n_x|w~ zbe=j@r%s(Zb*j3$Z+CT4;9I9f!Slh#mgPA;1Hryd3#idE_!ttMl;D1+XMvLjtJ+g3 zu^xmK0*YFi3-}k73=DIc*zI9&`|j)V?P`Cy)9Qp1 z%6D1^V41;A>!Gwj^Px`1rB3q#r^zs<`9P;hVSzKyUXag}fqDE}4^|i$$a9(ub<)uW zCsgR9BPj$SUThw?C~uh)%5??}(WUS=&lv<;d&)IIkvu09RnT6IW;6-dzxSiNcR^1? zYSXhx5hSvHqwPSgbF_x(gHNR#Tn+uvUkE4#i)LusoTMU6M;0ynPEzq`HCj?W` zJp*Z`B9VAPe#PWrxwxmOd?(j zSWe@F;IEwI;Z7oKegS$WIoIi%=Oh=f%HDZS-yu%o5T`FPdt;a|S)$13y<}+a5X?yE zjfXgJ?e_xZhy@QJl8=a<6F&&#`wm(4oOZtBR$UHUW(4f2zz(=+>Klxy*5jwg(Ru zl%d?Um{*~sa3cey%tST7Mwg*5GrtMgOWCrealyU;`{cqMzL2NGSH*EG)QjrD^+@xY zKN&9nvu!^Zws$T-C%`T^Prz+3mL2K7n!!<%^umK~67S#C{9s<39FdFcX?vKTzoO;)zg9(FdvJPA|&VjG3CT z&xu-7cTj@nby)5c@g%HfGIOQ&SVopEXJW5%HiwaL%9$c)??Uvmoq(p>^XVHOqG>oe zz7pgz<=F-0QOn3<#;sDwShk?tE{n$j{{lMg;Vh~4vBhws)eFn*@8fnj83Ft63NCgN zWNH`N;k3dzb%)a!Q|bp;0JO3cJuPq`M| zC|Yz_3YZW#Wl-Kk8tKAbC8!gYJ(}4RiD8E2wqp=9vj3=PJI0+=h+uN{U^3=etQ-bP z8h8r9a}9ZyF=CjnH`#`2fk&#BI}K5AISZ!PuPJcZ&!YlJ*Ag-YI}PE84i_c5!a|%F zUQ)rWSiHijIF+xB&$mbA+a0jd1!F@vZ&L6{Fb@nKTE^AxN|6PPQ8_4R_yf|e$q&xM zs!?mnx^#*BFI8Sr-xIb7|z^P?E)`g7&_6wjJVRmSVvmkrKh-?!W z%<0qKJ)iBf{{W`5*bDhiTiwFOSd}0@VE=}LWzE8T`@1;K!RXB;PU;Xn6LCUDG5akG zt6j+Y&3u%$-(>wrM%oVj*Tl78N!KZDG4@R4L~NvaG{gTcvK-p#reX&Ab3A9DU(Ju6 zfj*AcC$=P5@3#5)b1WVvyk$QAoQTKbp?u1x_Pe7USX-7cQu%E{39gb?^{{LD$_0oQQYM+YvQM??shZ9VCEZ zGr2xWKofsC50gm1-p}|(#9IdJPZLhCx;s%_LlCZ!Qeh-E5Zq`q>Q1%SyGDXxzJ#9E zMNw@$X(~*F=x?BA0w(-Ah@U9cRo=q*F~mCt?0f5&HXj5VWZi=$b9-F)pf*pfbEMWo zyb_^xz_|gO4Tc1Esn)x)s;+7^^Fi zabE;A)eTfQjfOZ$%bhfB+GZ6_(srjAQnur|E)l}*Yp?=E-ZxG?tWl3%U5-iAepp}j z&B1lik#Iu5eiv~$vo*4xgmf;Oknjek`1ohJJZoe>Ey+oN;eiu@RnI$(?E<3;oS_%m z_#%YV4cIRw!#HU$ex8#w)M>WUs}^)OY7P4OYge(YSEKB^$% z%Df>8s|U&B!yo_*2fPr?1W+wWiN>tSI{=8kLVxB#P@mpTpf@a7of0I!G)Zs`7WU065i zcYz(X^}u%1zBlWh*+tO4v!7@C+DEsKL+Mtw5Q=^cIgP=9*`x%gDGs$A7;)Ya=5TN| z;<`)6^n%kn%>G_C+&|II^0(Q#E7qo%u1E^3^!Rabt^@s`$!D`^$U9Q<1JBa~mVWIt z_|}OZ>@>hRM*mI1W$)qHF!06{J;CjV*d!1fpZ0!~hC|+KvJTGH18!pq{AB;^9l8X@ z@;|TD)5m`>lu?rm<|j-|dr@za4Wit1(x~t-=>kn(f{K`wzT{nsTNgpmcDUu1f{PQ5 z>ZHJ`7(2W`J3OxK@E3|loE{Lc-(e%;?WZvdCa%Ej_9|vk(09$lw5$_8X95b}I~&~z zJA9UcoFv?GK-zlR3G*2&yCcB+scT>zOb^RaaSC}pVErVyoeIN! zKTDrteoV;+(+blP-ft-R`*BIS!!hz-9wF!qI;>^`GZ0@^i?@g^6RKMQFONI8b#-*tx@uF)!k8a zftnjd7pnK8=(>vUmqtQ8bw?DPu0}@D8ESKsz9F>``eexiGyDbWH{hQfraLRX!^iiz zOz5R{gP-rkn$TDM3HkgT$b=jV^Uni~=k&t)YatJhE{5}`fbI^OzumF?5YYLa{JWw1cn^IP^{)m^ zw<3Q#$Y1B7SGsNGk3-m3hwtL*00p`E_^c>;oca>=Me;9KuSL=0)jE;a9!%J>M=g$$ zU#y;uk~dmSiK54->L_`asu!c^%k%?zte-=NyYOBn<0VVellAr!%s2EDHBRhbsq?Q; zmr37bYkI2cBKfq5g{K=j02xgA8R`c83y!=WsAj4mLYw@nR40*V%For`z>JiisD6pZ z_#*TqH84t_>1u?@HjnpWQ^Wy67XvMIwYo4$-z!ypv6so8t(Hi>(Wg|)p$L;dOZ`pk zXXp}Ug@essx;(+wUJ^;LmFEdDB-;v)ntOt+_(**u*xF0IwD%WgmgnPkkzlJ(gh0%W z`el_gy(kiFz2$+IW~(E?){pXe>0S{6F*iny6GJlFU z8}t=1^wb!7S`0lshQ2a}zAA>E5kt?6q4B_oC)jGXhoZi*8Z9*ONM`t#YAG@J#ml=+p< z#iU_A$`N_(Q6>%Z)hpm*sE;EJ^Vw11FVu8MeJ%Wk&QJm2=kqCPm~WnL~uW zxj^zq)k|kZX!Z+(%GGDMk;D3mQI7RZmh#hpZ0`&r+FwFMyGw~^_d>~EBD@Kp%C zO6VJjkh6{mzgQ2fp7ZjM)5<=EVS}bJxoZ@Kq5(Ps2E2d$?9- zeIC z&&IsZ@|%e$ca(^7x*t)ljQxpnn}{g)6cOcKC&GR_&#`e`A!iX0_IOI@qmqw3 z6jjDr=tqRyY$D`N6Xb4>9B16|k^R1ni28O)`pbg6R@D9gv|FNG#1^m@u{q{H;`y)( zu^-w+JPYk6g8v&L_wJO_*00jG2V#%(O<-Kp(C*; z+9lXV(%Taur!x_9vWSq=gV+ZCK!lvW#0y{#;sDrRFjvwGh>*jLLnvn?5pqTo+nRku z?DJp~(!DW15&Ocf#9kO5#6Iv}N#`yjl(&!wd5egUS4IrMzlj6!J}>b?yhubGg!xHu zy`*m-=Agfbkhh804*mpW|LCyHK*!7E{4&;{FAv+mAj_AJ2LlBc5r^OfSi!dh8(1dY zkMYEOy-5$SHO39;euA?FxmAb{=b4>?UkEnGcw+i_g2x51ZKqDZUhpYFCxCREk9rD@ z6c1YZ;UPH<>F!}o~b2ZF)+CcTH?SizKr zCOuQIK=4YzRe}!)u5M)b9~7(<{8}(I-Q;&Aj>4`}f_Do3RWR7tw;46aM%ZYrgni?D`IF~ra?88EQQ|NC5n`D^$a|HSIEAm|G z?t+DavjlGxd{hwAgYsQ(t}A>?FrG*Q;daco^M=sx3jLwbp9=kj&_4?OlhE;;k5N8}h<5P$ zlXNqoI|!a5>Ai*K?tbLso_;LHUHXV)iD>T>BHBNT2);!^-yt;j&tv){MDRaDMEO4w zQErdqe#?^3#bZ zpD#E>Pt(*&Cewh`ZlE!QFyYf?T&UzX8vq zz_xJ*i!P$akg8Dp+{JTlR4!kc+e1bS$sox3xvf!TtxeoSCR`^BM@c$^Ncs@q? zB;pi|Q=z$Um+uN(_Y2*PI2G#xp)Vv(!#Y@KZl~od#y%iIPbE&kI!x$mh!e3Hh|o6> zCt-ah^u5H(u?`aYdEz+uxzPKF)3Kfv`X}O*IJh2w{&k60VVx>;OCm0k+6jF&akg3K zlYcnrg;+02{ygGLtoww%i#QA0KnVRT5#{-UHp{<4MEN&`exF!^^|;Vq5U+;4h1Tnq zIamkAoARl|xtI@yZcQx3I$7xc#B0p;1?%JQHQf31O37b9oM)~(n7^9zbxPeN`TTth zyQb=WbeaD+=>|g5`S)4ip?NI8Jc7 z;5@;bi9@h{5c)wP>U~7$r-j}w^dE$NMd-JLepl#fp+6P+N8%7{OU(5qnZ;9}@aELO&z)i$cF7^q+-(Tj&FV zpAwk={PZ#_Qq%Rk|k2nnDL-L;y{H@^2f_nu&7W_nz`;xJ| zuPzSg(Mhm35$T13(}}oFnM;IymJq?eOz4}1zD?+jLO&q%Zv( zyiU@W2z`UlHw%5Y;KM|$qqa%@cEP1Q@I9@-3P7!QPM0+|5_7cnyEEF6oI8AUK z@e=s4&^Hj#-kXKKTj-5KKPL1OLO(C`Z-stM=syYlzR({FeN6DAU|nACLhq(T)Z0Sn zPC|DT`aGd85PBF9dS6Y1z2-~)wUWO^(r=UWdjua8{FUHNBFg_k=r;wA6CwX6p#u#- zL%+5}q-P4X}qDEKK6*YQ6P zp_kRrV1i&h!3@E+g8F^}_|FwOTQE=XG9u*a`wPIQh2AUp84=g<-w@Gm)yUNACxT89 zy1vjMq1y|yBJLY} zM@0Ki3I@{+t?!Q@y@}AR1v?9#BRH4{Ii-SYiMVfYkK{in_$$F@1uF$#5&W~@`+|oA zzYzRRP~VS%{Bs(cdM+ZOy_X426`U)$MDPZ|I|UyQd_wSf!9NQAMX*ZnsNj!+4leXr zZ>nH3!487w2=*5oDmX@PqTp=7>jYN{-X_Ss^jObhg3k*6Uhq$X?+YFg{95oIf=*K- zr>UU6?*zG>gg#erpkR^U<$_lV&KE2fyh-pEf)5EkDOf4^y5Kv4hXlEm9^3a1!C;1= z>kGCN>?nv4rssKF)@sCMh(;{m%=|BiX-d;@8;vNgu|4q;oEHSM1bYZ(3+4#oQbF?< z2o?&C6dWx$R&bi&48an?Qo)6Siv(8@FT?ej;5xzef|~?43vLnID)^k>PQgmS-GX}r z_X)lu_<`UjL|h*o6+BMNHNT$`e;|$PoPP)^-haV$3crLz3=(lYkSLf!9Ex?TAb)@3 zdNo5ZL>z|eZ^8D&LiC4V7I8SP7X|sdov%pgO~#1Xq(|U-S1^}|&L|KpBwmc)RRl*9 z(ck*M6tI}|DEzJ>IE^?O*YkoU#4(u91Q!x7mHSt~GScX;3c+;Rr3~#O!jA2Q?o5RJ zdI{Z^2s@&wnjb1_`%M#i1`&4D{a%LO6-mR6l|<0GKVe7RZ=kD~4m+Yn*L9HIFf0qr(Wswhd>B##^u*bjv5O!Ea zMEhSOqTM}%K(sfXh;}|74@CR;d@B9pDsN|DKjUPT%$7Q%;tVQncRd(??uK9kFXI^%?xhKRcl7AyMP@jS=S-QA*}rILCboi_yiliQMsJ_w?lq)2S>{yvMhZ65I-``+)aUN8RC{ev zxu=j4wJTFpfhgrq&2|d8>=1WDr`olP$~}dYsA{7MoLajGTa0VS#%wiQMs|a%k&d0D zxJMnfwaT0{d*;k3*gvlZ58W-YVbq!2gWP(Dui7mVoqY}!cl!Vi`41G)Q_Ex)DqO(sU=QJ{OmbdX!=S`S1*{dqHyffr!DxfBw zUFc4&ZY3)vR!QaW5I@-O5t_*)CWcCn?VV7BBLqx#W9e+`){wq1$j8<3>scogFcSo%? zNAIMn&m5WEyHm3H+YN$@wk8piwcbDxd$BHg>w<2z*|7y&w;l0$Ls}F~ah&kyDg@xyU1*8(evd!RM8i3wf-U`o-aJ^&4m8 zh4sTFhvp*>gDY=LjJ!gReyqop$LAKj_A5qSeH?CZ<^49My~Q5=>VVmm_X{I0tY0be z*beeAxbp6ZkvGkwAAY(D%j*|ozeUJvPeBq~d3|EqyU-&KKlOy==?&dI{ks`?)Q>z2 zt~`8tJE}icdF0^|FD#E={_xswEAsg4f*V|Uy}{@0-wlwr4NMg{aLYa{?^2Nm^XR}& z9oOd1X@)OsXMUKM?Vv0Mx87u=d+W`8M5%P-v)+cn$8vmb!P}1KP_EEbLihlxJNUfv ziXpEM>6Aygte5iY77`W1_QYc71$@385Q@O;J3{MM%5ftdcN^2iH$ zucPo$p2Apwys&;D$lFkh{doV%E3X9d z7NQ*W>x_f-Qr@4y=hg2yOu9@b4}+`UYccXZ@#vQ+d@T2CBQLC9CFHp>yz(B8k@o}S zu{`z5!r|(-+Q_yqH1oE=M zK>hmSV7-*bwxK`5`t1vubn-B``tkiAZ+~p_=+{s9D38yZd;9l;ka{!x`n_Z1h5Pq8$oqhTB)IbS#mK9I zybyRQaOB`1ALTu6V7uN3{$Sb1&39h`8 zG5(SQd91erM=lOm-n%jWm(kkrk%z&R_g0L&bdP@d!bkaMp#b_LtX~_*+XmVVuDsTW zc>ANhN529vlaKO#iuFIyk30;nydS~mm6zqw54Z2b@?JyStKSEZx1|mxnc&L1AEZ}a zHstZ0w+f^e;&Ao*9paSd!@*F|wf1$`b;tu>*bml$kL{x@2Djb?hc7n6!RLaB zuK#t-GUpl1Bs`4s!+Ku6@u%P$5hL&BQ}8W~k@wqE@LdcC_11d~e3ev40`nL~paEXK zZQacI$mANEF@6o~Og{Wvro(aYrAVAW+mb#%rd}Gd66tPm>pd@~-b(OgyG%gJW4I6l z#jBq>yLLOb1h1Db>lA#;V&oNrFHzTI{-ZvG{_^goCT!6Xv=s zoZc6FyW56Itvjj5z=tM>LnY=@zPnd}lzBL4XWDoY4p%m!_`w?QBDzNM=vS1)kk&#Fz;1%u2NKp+Ug!WF5jC+W_Ha4?h*+T*?+68<|M+Bp{$$cJ{iAbQFV?f4=e z+R>lcp<+?N^&=*7pEUQmg76Q_yuI)JVKnBaL$N1*j)?wQBC3+p5WHT3|AoUL#B#$_ z#7Aga9s$WSHjXgT4;XM7)O>Ec$XDC=2nioRhc#|Q&~&9aCwa#Q`P^$fvbucPh!ySMJbCgnW^UWItqiNzgUwHNwFb0^PCwqi%csGrvI8n>(?OM0R_(`OXT5pE%35~7 zN*r8W{@$06(Z(p{ezowk;hWOw;gRjsSWn@I=#mFucus{||irUSvk zvIADi@B^h)#||eKzjY*#ePdN=<*~zw*>4?5&i(`FimJroKO8B|K6coTG^_B>hn(y- zRaW-z4}D2}tI&?hGRWO@u%yhb@6od3!@7Jr;^UzQ(2o7n?2XmEwyizj+DffM+tkJ* zn5nCCt+my4)TaHg-{(2YHdY6VZ#bYfZ8{jtURxb3ySWN|`i3odhj{uj3>$t z!e0_HAk#`&a{y0-SFvmgXvWv1ZadOGWo@+|ZEcyjX@9c6Y=4$oTir5j$oAmv-6NKQeG&^z-!LtN1N{?JMF-dPUsV+!+SF2|ynV!% zz3+$>DnEd}tn%ZSoBjFWxmm{!2TS%%r7W!) z5c;tC>J;=L<*Bl&bhM)cGVJWPj||9uquLI=bi@~`sG1Wxb~ruj-fAECE<~C7;3Izt z`=|tIC2v&wHSbEz+dkXy=72Yaw#jZ?ctie(uW)5mB5X6Sw{g5Xui!Z|M5tP=>rIlofjW$RPEhu4@2z z6?`^1)T%0{E8nONqA%i7VB3@%t8z=kcHrUo=&Vq#@YvxCyS-8EpdOq(ss^E4uC8lom4iN^ zu02wqE81Z}{$S+4u3SGVt8$Xo9-wb=JSQvFBnVyUf0v#-nXpy(nD6@MDD-O(KGL^v zZFMi$DFJcj$De+`09M3)0F$q5ee|_6YGY zx=`!3llz2J$%MIcr%YCShy`G^9yoRNV{aTov8dptyXa=ldv;~nT~&X$qjdd?M^c6a zulXo_b^iy>9oL87og)v|@%3@oDphS{q%#gnjpzX=HBtQ4!CQn`*a9uMQSy|V87Vii zwyXjqV(Z1p03-e4SgyX|tWmL9q*)U7B}~KNS6^F&HIzVxZj_~lhY+Qm$vFHpj78MU zWh^=k;|R9PWgJn1vA*P53X5$MT+>9duwIYO@`GfPYBeb{S=OhrYE;)A=~RZ>WlC_X z>j9d^jDw|9PFhWBlqEmAALb;Ot{KTx23JgH#F=HQ>wDD@!A!p8t-Xhlg*dpirUX|A zbumKVWsDrhImA+zrhq+H7r8XH2)T@zuWx^wA6Evd42P|T-{xne0*7BQi!r{T9;d0x zZ}XF&9wr;PI=HIr2K5dOw7Loq!g2vo#B^}Esz8~nB9jp@2($iy1A`=p!iH-^EZ1=) zn5^NkSxnBx0i#(P8R2urAbcAcS#Jn?BO`pG7&-opjQG(m5Y9$MatsmJ$jBl?#BF3` zpCM`vO}Ae9kz1`#bqm+(Q{BUr`qbIsI(@1~xJsWoCtRaX_0$zUhYEe_+>Jz5?o%}# zh4tm&fT;@rr8wen0jB+OA&70>1QJy`VS(WwQ6G}ya2c$Ngh24A>2Lyn)-CfUtO7x0 zYH`M1kj6*6Emg!PyH}a$1^^9<)F6O+zd>1U{Z^u*!%G21VvUKZJ<9gL5r<7zwSI*l z*sSo_TLfaWPLL)&2jU%_AWixN#5X!Y%+en9vHGyk(ID8tacYsNh1b+uy&SQg=8njy zv1_GTZIkOcc5+Iirpc++#f{KoJ(QiCSFcZ<^XmB0;bfMTR}a=`sq*Tbi~G$^J4A39 z(gs}p>eN9>9HVvW^g}dQ7q!M`LTXwdJN?c9jk|$0!BM_+M(V6Cw^X-!w-0EXinb+Y zT6QvPIjeEs#uwmip(IC3PVS+6jmTaX<#Z$^!g)dC5URnm3#KSFNvo@i;k~uIdL|YA zQ4g}~IFznbgQReSdVy@HTjJmaG&Ynhl#(8)Bd?yRrLm_SuBObxLW7z`$~J|@=@Bx6 z4TzA<5~Lb7x_L9JTRmE5be%DEMnRhvj>@RZ)`lpAk(Ok+xRJ}y3P#gqu=Ud#*w2@K z%K&tX8sz7s#^8rsPTuZB>rTw%@*TyWb8%QJ9n6C0&OH3_lhxLLgUaEr41pijm6=jL?rx$JZZZjc+Cfej<8DA+f>n4Mz}%_8rHiu0@j)Xbe+H=Y3{se? z5_^Kn_g&Ir#FMz}QGsDdiQ}#avI-dYm67+OhT$BB306^E0G4>LJtJo$(v}g<)me;O zg$QqnCf|a{AViERTozd4#)7W9713#oyoCsNH>vwiL>4o07OGl}NHT}&dPc574WnG$ZdJQi+I4(Gy4)E0ue=SY5bdi%R1FulEH0aJ1X~>Jx&N-K)VI zL_TC%AJu@t4b zUs)ZeE9){{Gk2b`#_BrQHtTX-vsPj}c^k2nlB%mS3|JYvsanfoN>KHv;9g|;JEdUF zudME(L3eFd3_iRv$wk6A`iHfFbv5}r{xm>oLpHT`z2J4adKE_^_ z@vm1VlflNp!PB-kBnqJiFXE*_b6hd7E8Os3xzYC@e9RXg)txh8&NX8v=sQlQ_?GY3 zBU`r~dT#aMJGNKvxUG8Et%vV_U~KoS?)cv=YwW~%(`QT`AAX%^&P;yUyUYA@Cn(A^ zuQ%aklzFq}PM_KBgYgD96#Q}&KI5{g(pQm&|c%6 zgRoS*nh^PXI_uSMl;At(xF65FYp|PqL`US;_#!e;b#HK#u4NF zE_!<=O5iA}^*h`-$;UY$xi_j`WnxbG|M?y6nj@pDJ2JY8zq#Mx_IxnA>w?*HuIf4s zALgDt>l%E>o9|+Ebw7Un?|#x-4;j3V01Jf2iF{)l_R#}ee}LQbIc_~MIeI#?yYSmi z^?cs%Wq0Ryu4?;Sc0c_cD0~noaWOuNdXdvKkKc%~pIf58-SQ`Oq9E64G}H+VbW(@$ zo4fdgH2Clxx26I8L1lbOdmz6r>+nl`7QQUx^P|_4X!3!woa6-XT;!O~`=u7(3(oii zQ2t5TGJ9uhU05F*W$xAcP`<#i$2AN z4^0C#OA{1E+nVrm*5JlByTFCdJ&`S9i&L|vz4o$2{b|K$aI5@9?#ur^bYdo)rOqAJa>XFpsTn_vG_(bX^o(N8J!b zC#w}vbgH@r^rG-8B2^WM27FG!!b6X|L%=xh!)lrfcCG?ln)@*_=tU3y>I;c5-AFy8 zbKU%gLK*nizgwa&LBcX{11212#MV!oN0MxX>uFE0qs|EA*X!9Zhpn21z_m9cv9S=7!{{|s=zDmO-S6AU@9>1%=3rYsA4EbG!ViE{E zho!+D^F$uchx|^$A7bS5qRS1G`9e(om>9ZA3>`$7X6;0RoPfF47xih@HYT07BN$vh zR>+ zQ9*=~tBCkv;YK1Z^w$yb>)3iCoOA<_<#cfMfurM8uYAyxSKGvqg0ls07u-gK{_hI< zU?V1*cAGcucsjGLVAJVF~O_Q zAf|sWn1_oJ()dwCV}SZ&n6UqR7!JtN$dT&9aA+cQDG@mu`H9$WR;V*X*;UB*ie3pp%UlH6xg#EuELYbcg1GE$9x`OF~t%$H= zH=+9oUMR?UjO8vCsP};d&HJKE-!8~;Mw-{oMBT5z z6GHz@kP8v!^8%UJRFIdtq`L|7ZX@Zzg5w0I3-S&q^Op#&5#;%R>6-)}6MRPScY?ez zPreTX@k6?%KNtL-2xqY9N8sb{WV9E5B_Q2Gu!~?X$?q%lV4;TyeTmSQ3Oz;eDkADB z734T(JvRych|s$PUlQbVP2~HK2*0cr`b)v@1v#L}7cbaI#zAYLy9o{V(t3c@$a#)> z>2U$%`HgR9W32KsUk@2 zUp)S~Zw;dmht|&yoG&pIgv0KZ7!ycy1BQzZT)HsM^C1Jrtv7I9U^t8;mXC9U8(h8v zNWd~99Q+vQoKrZ?sSo)`SK@%Yl5!wJHV&q{I=k|ABF!r=5%Ms+wLF~4!}29^(#gm=Q20A z@}?NRaJ~D$zXxy zmu~?mZ+mk*^zX;ac4duDnZ-;FUKL^2(6b9tWoHu)MB_LqymvpFjZh zBM*ZsuM^^4dHX#2Vc8azC+|~--xuKXt|8>Rfx7d!PY~{)LkgTOUE&1tFu43KU;9(= zIbbBO%a?r$KK?4<%BK9$;QJd6H@JCx55U{rLul`DFwuTku7ul*rEZkGA~@6zSBNL? z7NmKSRU)n>@?GP4_|}5STkk$xlkl2_^+JVky=TYBy96DUi+ne@b#;xA_dy7q4JOLt z#sp1yJf0ME`CdWi)7RYK^8HHWx#`@`)f>pi&;k)Ok1FXv zzCJDibosdMb>qzD_fhWg@VTb^5=>tE6|_|P2@tlo4Gy=x2V&&?0C_W9A>ecC;=0=_ z?;gmbEFSGV@~(!hJmyl9;Uru$Q;yqjDTq&)GkwCp^1ST-J+FO+=e4yxYpf1n>7N(Q z1)FF3REIzh_7rvffXL%a=X0LN$mfoa9*EaAK0?9=(1FikdxKjqea1UJ$k)rm=<;2F zG_U{d1|7n|e5TX2wg1hX)vaX0oVioP39~|xVB+Sl`@TT;p6B*7DQA9O`?K{RR_Ccid5NeRhOyy2Ql|Fu_~7zP<*Dj>aFU;l>SwG z78uXi?N?Rh)#FvwvaD6RK3S6OKVW6&;JM_H2QhE0@mJk^z~BGABmUzzRk2;XZsC|5 ziNl9FF#L8{kmnQGpWu0MKhiN>?eL*)Khl|RXT4R;y8U<#na?ZRRb~4>1g`^L=(fYk zy1m*F8D}5+?cukPHwkTlT|cwI1AH_Q&r?&!UuV6w-xgjQ&o^g*|5f)n^<@=hDe_Es zawY9BR?An}A5~9)JhW>+nuh1yx9Dff zgL{S^*iejTXA3v&_u-lEKrx^1z5|~>SzE0_w^#cV>nJ>kOVu4J>(A8_AcM9?`*91d z`~Y@TuTBbW;k%6x18SGtX-H{@|XqK0KGMpNqYb3L|WL)G9j;KcLR(6GZ2dQ|o-TM`!jW#?mQu z?%>gxy0yjQC2aqmtUvF^+k6LG;xx(7U*l>V^Ch=V`i zIb$m{;D8_bu+y5kSx+3c)Li!Qt4zb14gCEN@VRqsi!9h0&!#K2vf9cnf}MsRpj_tL zJu3FAtd-S}iL30|?R0#Vv6Hdu%IfdX*NLc%;pU2e-)0H_XR`x0mcY+2E_@gtaU~oZ zcgomU4?i_ygL8p9Ht1)VN5s!6^w{uw#s<~^O;qu{)f_J>WqoxZB;$s0yh{*09#EHO zJh=T_rhC@(E#D8Zpr1-vSM4hXLQgA{Q^m24#}p6Zmh}!5+N;N{4Vt%3EwxmSTk7CX z!T51?z}Ur@OXoObd5!~IGw5-keLH1^9@A{AKkFqt`#*xu!Q&P({djqGP_4jN#yH12 z4W#{ee0GYest1`e=a~0P5;1Ikxnild`8e3vrxZ zoA|bYAMbVeLu*mrO4JYCp})N;GWTTCzA5Y@Jf|O8%K8rmRMGzSNDp9M>5Q##d#%Ge z3^JBl0sV!1rvFa7ZveehR#uY_=^c%oR-*s+;$0ViRRW&b$F1TftlzEMJkwvO`&_9p z2S3Ny&qCei{RBVf&i#imc3B5)twMKJ_eH*wwP}CvlU?_7zWf+v(50VoZdEC;gY?oh5eDf=!7En!ubaM zeS7s(>2KI2!SwZV^uv1Ca4&3A1YcU}!>$Y@9DY(>orr_JR-3P2 z-fzOO5b>4e)vmAGC9WQY2Rnj~ZTI?$AHLFteGDIf&vaa{>DXb{SFm3AtSn&#+I)L; zy!I9P`0)Km7hi$RO7`OYkx~0;bNY!}uj?ncT*JF2cT}rws26@nn|;dj1^Sova`_T5 zmf#c#3hmgBe*ZbXF&%yKEqJp$KBC`UgIx>yi(S!vzKeoi4xl^68`^KF!TKEE4}PQP z5ScHs(C@g03eOkrc|I-$W3DV>$8O;9%E1`hfnOM_Ez}hVu^$TY?$uup(`Woy<%inp z{Jj`wg$LQLmYzCjFUoiAfRi5n->&BtKkWv6`Mwe7mpF_qTgABfB{6eQepG27tQZOH2 z{ifGMV>$2;wr#P?=tF#OQLhWLF>dgF9@}0YeN5!o3qf~x9jMD;{pYT!@#~XblW^Ro zb4;lU*!y;oVUYHu49W}J7Gs-bzlt5pT&rhuycQnB<$nU_DEb0@8SVQly%_zdE;&g5 zW}iCf#~&esnpqY9(yeQT?bf*}PmM zb=GjgjW~<}7+YsD@K*UIfViv^UY(3Q#)KApoV(I;P7EcZ(Zq)Fz?6E~!mm zsvPB(vDB#80wE+6<8ZC99&uE^3Glj!5~^_cRaUo*jr3<~W2>tdZ{$*eO)*)_VK}4J z3|lm#k%_mDTwV36NVRd&GPSsTh`icFXR`4BbxBP}rtuiOeJ5R#;O&wG_Z^QY&i~0S z*#IppeRCvAArevzp$vx^0gP4PsKq6as-K*f`M^l7G1G*=RgA+O0cD8eMMeVU{!8;g z2@0?vrUnAbpL%MjZx{(|QZ4U@Aywbfo)*v`(KcdgviO zsuv*JL~AP$LL!<#Fa<7&6sVymnB-hll#S?(I4pG;VZDwP5jZU&H6q5`K}3#M(b2lV z2!auFX++G3h?q+wVlD-%4z8FGs2MomcYb0i4ms1%ftgI)s*^9?4d6oFfvkLBocLS^&r7SSdXwtM=v34(a~C0rN*~L5Xgyj3&9i^@j9aW zaL^xWzWPqBSdpV{^B3Lbck3j1$!-2k$e|d?twfX_E4ew+ZXuDWgWHrIpvrJ?un||` zfZ;X)D3i&=N*tCNLlu9(!DM1c8*~g}I(UV09mV&dX-4W$+dKBG{9oa-RaPi0P!m#d z*kfIZ7=3QVwG6}vmv#%PSBqPeKzJDrnBx%OxQXJg4sKf`*17B(WEhLom`EdBV@_kY z2-m2HtQyN(4;S6W)OZ@MODHQ{xA77Jodazmn6kB=Jv<{w?30TEV|CeDC!PAJMNYA0 zIy!1Sz?2;oDO*EPFv)l?>VaryUBe}j0<~&47M%D&g=5N3W4IJ1h3V& z4sjTO1$onl$!_o#DMq51!x*DCpwLdh%O(m^e}E3DNYKG8&Kh>(sKu+?EX=8a8Y>7| zj5T0l!CxI}imcUwSzv}Dgc2N_M{3`_!!Qo_GSMsrum;IB$BG zt5zc$W%T;c$O;dH+Ft$lzC&+E-thPHfg;DeXCDajICu!Fo>iv~UZF=c7=Fv%;am3c z`VD;Mfk+7F)nQ(pQ@&WA82w^>l82G6#wRn|-5Nl@ET0m!r9f)Um-y4XTLsiJdl%G? zenG!M>^u1l@lJjct7#N@_deb8?madJi0lWz{RowCbTHw5Bq*4M@3R=lbntooa6L`EWy8{S$}P$^Hru z=l46fx2*#C_@f`RA8N$~eR)>Uf#O#p(Kp0`r-HbeM1keUyBMGxzcZf+OY!Fd(DpO& zgcSSN2{iXFk!(My68a#HABL6vRHE`djz|ac-XBj$wC_%EYq9TD2@R0ej=cBz6B;A_ z9^)Ia-NMI=aD#=QEqn+?>c5VtuJAevtj}jUH#7HIifX{Ng%II6*LQttUF+hgMvh}68(M6kYQ!dv z#F36S-sj_7pv|=|rP=7pEk>>?BZ!d0>t`u>NdQBsBXhf z-G;w`)NRM1!_r&=?x1lK_x(#1}InsuipmZBvM&#$WA>qtz z*aQu%aUr&0w{F8&XrSA$TeqPcq;A6>bQ_)l*$_JTUh0i8RR05zx~E^!?pHS;?)Nf9 zMcer`*m-0v?q}>A<$k5E`!za>s!AY=?l@mu6K8}i@DTsE7At8HgbFRFTZ?WWm4i)j zR6L(4O!QYKR07H6e^Dj8h&Z+M|K7|meZc77jrrvQM11-9^9DHlztMB#ZbYp`x|g{W zx5m+Vd~a(D4M!`rh2GW{S^!d8=xuGGdqJktLVwMpg^J?DB=3ez!o^Gu4&Mi<$-f6T zjgtH+BAj}X>!N_3e9l26GBmj`a;-4jM+5Ze=Rrr&`i2j@oA|ZDY=}VOz3*9)%bmJv@sY#b;_Mg*qd1A(@6-ES9OOEi%<|so}ds zo24V)T=tE$dQ)l}{wYMJHSPwQceWPO_FY&~_y26u{|Okfy8lZ||8p^|MP98%ww(c5 zt1(BHZ}%8zT}`RQbx>E1pl*wiMv5=PYLsy&h~(Rl z^#CJ-5qW}CPyUXY5_9?Y)Ke zzRuXYDW1^N_P);8y8yJd_abBORiFpZ<*&C^K$W)JK@W=1?LGsoySq$xce`e|P|}{Z zM9U9PHrY_iSI)^sEHz47$}&q9Gu3qE%(Q`wH)7z9g(N+bK7ojyN!KHyhwcJIB15+r zCD>xlMV_UOw$#p;JYzqFdR$(XGvjrnq%K4m?VX&ata19a$A^uzUPZ;)S`Qm*eGOV$ zYm2c~24)0ptw*%AvasaR#@cHA60+J2M7B20V_ICJLO6St)^G$kp^=R%YBU8f9Q_8s z9R*n3a9QKJ!x58bLCATCbmJUjN}CC*`*IGi?Ut3P2gr7dA23(WQ2h0c#-HCH+kP>g z5VD_7_$Ba{V6bVj)Ud#~uadprt~{q9=uLw8!Cw5F@puuSfD` z99wblKAsymk+cEb7e|gKeGAgbdlbiU96#V-U2b6hb2ut-c+)FDufoClHsN5M90%Uu z7dhFI$a)yKiud9sL+abgjJo=<4hHrg11EBZVnGfahAac&n{CBH6aFhZApKA5mKAy4 z|9^JNtf>90WNWF?2~+hJR+Hw84_!$CdQ)UXH1_P zaSda0e&X0;%h77$T=@SyZ1N39E1etNtVnC2p`s#qGiSogxoR35Q)%gX3%dW#!(HBylg~rl7lx{xckAAs2ezEd-hYq z)@wKqxS2rC<$6E18^Zgsd$kLM;EhxLK*|l8K>CWEz2u|=M=9E zym`H1^4d_a1fF|NB|qdc0eNnU*`H3^!&?u}TViW%&-$M7JeL(nKX}U&>M|)eS<-jj zJ}TCE*b^_(2Wn9e%MyK)^=I#8_n+<__n)5?aVD&FU%P*2i#&|m8Ku{hOqrWGO`%UX z4aoa-3hO$O$iND4BKDM=H`Bz!rw-Zl4%ytF+Cc%V$huliYQhk`K^*q2s}op`&E4{` zH{CMqO;_%;2-uymquNI7s1|SU$Hrs04IPd*2-u^zO<2C2yMsG~ofq8d)L-tT4Z&V& zi94L;D;RB_>tqdKq+OnqnTM>EPNvStTpF;qU}HQK{Jkp2Zg;K9oi6r-a`JXr>f?TU z5iLJeu9{FJKd>CCS%E?)euv}bM7MtazCfH9d zsa1Bf^3~XYZgIYSCuAo=b{$@=5_)!{EmAGI(1;KXgRI&w?r)|MYrUjd8Z^1k8s!qo8XTh`cogjBD+_v}x zd-X4r{&=RZz|w7pQ;m%3fP;`SxEuA3cUqt6R3Di zqz6`F(?h4xF1^7c{HemJv)l;|apHH9@mAF7kMg9Grq0h7dp#-NzLh$Bg(0V%^;YY| zD&572sD~Z|-#u}CIsDfCrSAk>44xC{!2xvEK>J?rT#Y)6RF-pNNd~pKHUkfPI)Yw0EM%9gh){pk@PYKa4qhH$0)O zePO=S0d|F2+&*#nPNyFBWE@J9{Sp>MAAIKvmImxKuvvPP&3-aA`{Md=H^X$W-7uWk_*@5Dh{mIHQbBQstmk1vJs&U9Uhtp|FL-~E?u_*| z&Id;q?TDG6AF=pUSqS&c)JId<)REIkm z&%lKFP6pHf1`1;QZZ|mVCk$nt{TyUA4A`&22-G|yV3*SVp2Dy|ogGg7#X8jrtcvlQ zy;|jEmapdE>-U+x}D05qC2YeC^}Ou1MS{Fz`0$mipuYhJHhM;HeRdq20Ofq zj!CukZi5kyn)`P)iDV*Hb3e{jG5PIc=#DXTW(?guhVB_d_lco-S3eSLH6TJDW~-bS zdTl{+>={Yc6{ z`ex$UW(*aRnZYgJJi@0RqXZwvRt>%uKa(#M;hTYKGIGr?7ObChLJhes&CgHNQwLYC zR_4hzrtd)pu?O^`9L^;*P*Whc9pVY|*y>&Z) zEZ58(rmnp@C>0Vu6w&>@jy7a-X zcyFG__W9sH^9A{1Dd|0e`UhOleSAoV|6C>bxZp>Ey)izRKT(kT;gWt>@C{-Jk8ufR zLqXD43%)M+tsv(U=JR<6VllC$QY!>^2v!N!!+geko+o{+l)6sve!)Kqej!*d&hYgX zyhLybu{GYq72Ge_K4{Ws3+@&?Dp)_>&cn-gH5xa8kHQ12Y4bO224VS=Eb=bR1Xbw5@Unp28I8N{?!RrLe1=k4P zA^5Q1uLPeFd{OXC!79O{M2yGpgtj=&I?K=d&?iOc`b5wzgl;V~_if|2?I-CM3r>{u zX+)GO736u4^cun21)nBjT>n<+SBcQ$O`+cvnqSXh`A>vCD)je4^P4=(5BN;^1S06h zM93c~$Pbw@eX`(e!D|JV3vyq1^4%@SZ=G=-(fbM`{dc6H=N}}0kI?&s){i72pXYPR zIYC6f|4sO8+mzS)41=$U(5(fth^TLzpnfVQgm0LWhP>s%w_0fK^G$uY&o}e=TpwvY z?}2`XH0pmr(z%Xc{vN@P1dj-QLqvToWghH7Y$;FVKwchcl-EB-gB~sPSR&}DLhJpw zLC+WZTFGB7^lG6u5FvlJ;Cq5!NIss$)^hQ%w8mC~cnDb2IfBCkFCn&)`5N_KMH>3f zmi%jlUM%!#q1Ot%LFjvgevAlt&q{iw;46ZE7S!hf@cl@-HO~K-7+7zrAT}M)G_PBj z-cyj*MWk~D`IsE(%ZZS)nuz|}AoNp$Zwl@wwo&SHBHH^s5#|3bbR5qgpz9Ek-$>}D zLZ2mcC!x{+&YK zE%d`eKPI$ZSD^g!Lcc~teLoPPzg5S`=c8z>r=DPjU`HbO2MLZ9oFlk|*dF7B2>os+ zLe5=6KPdDgLO(6^cA;Mu+$ZVp2>l5Wa`if=1I{anMs7PI=(CBaudiT{;26OPf-?oL z5nL{KC$Xba_Y3_9v9nT-3%y1pi^duZf-T-2lmt=ensg)+t2j)mZ3eLU$0l zi_jMeju5<5aH8NW!D|KY7R2&FpQkWQYs9e72sJeFw>zFku+-3qs76dJ8ncL)-*|mN z{Ym>J3hH$o+NalbKwhWQul02pFhm;u+(xiH5q`$|6~rte z{EXMn#B|o5CH)IK^booi5q2mLx{wGv%n-VS2s^A3dOa~D*N2ez9O;(kbIFvi?E^dL zc7xXKh8?utptas;Kd-aN-p*N+Gx&tC~4$J8(&$}jHNDBm!o$Ko$s zv}je+_0Gsn9vy_qv5Ms0tD}@wOg^(DEzvR9gT0r&4EW?UXj*raVu^lv3n4O$$!{k2M3U1 zML1R+NrRn<{6=Y9cr3=In3eF^;d37X)W0{T+?|Jz9!+OuL+6nst4MZKzGYkXj?fHO zm65@3$mp{jI3baLqsKY8A^%37#k=?if;0JF{*5_9Zs7ltkrEvPrzJ~9jxM<_86&<+ zM$3QvTQYKt@na(Y&A-u-#r$^`ERel>3)ZZ-fub!=r52=C#U&&Dqj33;nfm>QxtJp{ zofgB}v+y1U^P~-!k|ki;bQrfuT$A_%rd|nL%aqe`-DHEMJK4|`eNb?Xf$6s>i=`Wc z``v72z_F9eH<#&%lZF@bJ%dWH7%N`_NCLPGmLGo%;paCQ{FtBonAh^-J0Gwp%9jR0 zI?Lbk<2xchziHqXReq$m{GLUA{1x+W0kQ|U4VE9@+4=ch34UA;QoaZ-%kLh;uPEPG ztc_S6X&5X&z7zEGYxc=kqjb#oBrcE^<)iN~u1{^S{J4hn^K0?R*Ar=0zB>^|_M&`C zJtH4!7%acr5%=@k<&%$kwES)aGrxR%cUMWiH6Zfy+vAgu?~g6N4;y|(`F0_JdLRvh zl@C8Q@5FDPPrh2EW4>QPUw-)>0)q_h+hF;<0y@8ZFM(eSL~LKa*CrkLJ!be7<>R|J z-X{%%<=0lm?`@xav>VIsRIjsq+%xfra5DcazoDS>%NLw%%B6gK-){N6S0>-vDj#VW zEWdZlxGD4zFOQ&@`eV|G4w#h&#z@NzIWq3^@m5a zBEPJ$=c4|WAQQ_W4TI(PYMDLn0Y9t15lY8=H1#?LB2I*{GJ5AIPz0IylN}T zmn@U-1q{qAhcpaUzG-Fr-t@^wzNBM5epB)5?+e1Av-1bPi&=gX z48NlOrgk^wkcPqXJFkpi?FA+MaSdSk-B)IRN${imHduc5fX**pJ@{Gq&IGaLx7_e6 z%9mF8NW)Z!vJceAB=$hI?$^@whC%(TIaz zQ9i!YWIK_D!SXu|aX-K1KKag7I_CQm>fx6!3x18bZ-eFcd(ip$-2{HjPx(HC%gVRU z@GHufz+_K4(lA(l{O024*8+Z4e+i{yz6pjOVkYnxg_rfRn30{>d1d@|f*<|xQof0} ztb90pM(PV7;Xb_Qxes(UP!|lxBVyyk$H(yFNxUbu!KU>_#9xn_rs91T1ZTMrp;+$Q zh}%5m@hTc9;k#j@hmhvy*GxuQk12@SdIXSxdE&Sj2I9Ri-$&WNG+sYbXzA8sKgn!M zq-mtfpbSDAeh4~$uxVM`#L$tlX{58Z$9tCUS;%7JydOrVt?}vEiuyDno$5Q&Fk!VX z!9_aS!Pm?9)uKbDnV`Xz_0@8Ivp@$L^7}9@%dZjk;uFW&2?Nb&8Fsvif}YQjH>_IL z{C<5Hoj&&TGseUij_t$f?zJcYpXoWCakiO5jp1DMTX3d6synfl5+&OCY?^f}NMK#TM2!7DZ) z=fu*5b?_tLIui;3K=N?nnf##e%=SK9YOze^>&(!ba55t_H-;Q={52R3sMm-as zym78S&)s*Ejt3tK@PU#L{;;s&ER$#ChoT9b@?g%=r%xH{3js1j%o+NhF5ob^Jf;LJ zuXh&qNB6h8&UJY#@xBj!Vwdn`f_6;g+~h{IWeeI7`iUkAXcO_f5{juzs0(JkJeCg) zP7Ho*oQcSvq+O%_6Cc2;_F>fHLBwI-8#Atxet*yWL0;tRrp*1|Oj%9LzJrN`4J z0qT=wdwKBV0sF=Fv4pQ}HmTk&%VWI27H;F4qF8UEzXtltsgBWS&5S&Dd}PpX9&i)s z2b|cZhvEMM{dvN})S0x4LbQX_nf^KYC+;hFl!Y=v7JLn1J3yUx6|PCse~oG5YS>UM z+L*p54y~gf1WniWf{!R^FDJUO*jA*m?Rm(TPFoKoOnV-HFNAZ`69v$qz!k zX`A%3!!&D0m|9V9@YZ_20^az_oaH#=I<07{jYwl#O(@{`w;`BHXDji6{dM949!7s@ z>Tl!2an+x#Gi}<`oqcXk+W5SH&Fod1$xcQ)d?XJ)8Q&JaHSx)i1->=n+c2I@hTZG} zq+QLRy*_U2ifPuakgnshv8!zld$gKP zwktE5%kAn`WTl9-gb}nNY`gf?k< z|HiT%e=OOiz}^zDs|;-pYb^NJ!k8SXj&8s_naNkDp2^?eYkk&BP06~A*A>pJ?%U2e z){Rffop}TEi2uMywbLihdv5Bw(C1Sb94Fb2{=Fiuvmu8e20kG{3*SH2G-feQO>ZBL zxv4sy&P9?FvJYMd8+9&gAA(czs^ib*-Sp<1(>f{ZICHpOjJWYBkYz&7bAH_6BwOH5 zE1U1z&B2&Ap}@I502}vWB#xONTbw@$xI_L)2Tcb3Z+mb8sW%fbObNiR}INXWHpIOX?MU2KCyS^I9jM zUh}kG4bWF2=S5Mk)JFK)%I5o>;AXid;XG&S1qWnWFFTLH#}(EwoEP2JM8VEOUF%hv z&#>&4F*G3kd}Fa*(x3eG`aAX`%mJe7BldClR13lKm^zm@77V~g7lu;csysDrRJfj`7GP9r8qK|;~ zV0TAp6jJxW{o8Z!)Azaq`TrGbDfC~b?W<1Op6g7U@1?QsB;ez^In|o6r6z%(xtPG% zK9fMOznH+7`5cxc;O-g2im_d|PzC|F$sGCQYz$Z+6dxj1nCZJ2n`{yYtT5AeGq%kn z5LjWR?`AA(5(xHanUxRWZWO{91eWy-Vf~OvAh4`w26)RB! zOIW!kcr(Vr2uN7rgm6kW3>Uo<5GHVejKJhbA|}Bvsi`=R?~|Qt6+8?ui=h(r)B-)i z$>WAfoO>8G&0$^!TOui_6v{}56*^_i0vwR2xF>ki+{J$h{>;F^7gaGuVR6Kz+^FZSxq6WDK@WjMw9W;S-p0F0*+m^Z{n@2{u*o9!(l%U^qgF zh5=r;nP91?Au7?f$x+CdL^8rgTo8IKfT_wXR;3kJrG{rA30x&}p9>862~rX*I=DN6 zD#!vof}mESU21~6{>~j0s^TkTTVGNcgPCzIqNb6>?-F-d9J%dG`7;S>a8>Yc$0Rlw z6+mc8nZ;7J=xxF`abaj8;Jyzq8VJBGudXwf^Wa#C&O*8bE4XEEbV#mgTn1x|ywODh zyI)4+5H4uzJ%Czamt+CtUa=RI#J!AcUYFcm6kMX3U83ru;1bmgQmKLwlVEF8qMB3U z)y29km8m5Oci}P^V~^p20txm@G>QKb%FAJ+F#kii7$UJ7W~j~VP%oJdG%6u=m1D=L7A zDl%dc{Iy~E=uiYtO0-M+GD}#JWNl%nx>z)+YK3Y>0$?(($`vNjI9$*SK|-QQf)}F&vE(|nl0a{J;5rD@e+NEzZ_ZD2Go|X|pszrh=hOBns3OHkS z6Otd}01_-6k^fa1v_VCbls4X{wDA>{W^CwKOO_b8V#z{a?BQ5T31bbiIyV{SZbROk z!iIJ)!QXh3aR-YP0%o9<&g`_t>FN-TJYu+1uxS$QVrr})rD0blG-O?R3dxv6GQuUe zFvi^kKzU%<+W@FpQUFM>HDGRvZtR({D{&z|L9;}CD~>LOv#=B{5AFcF@W%cBA1y46 zGP`JimDKTvQ3k79#_Mr)Udr+=gP&?3a9vnWmFRz>7{j2VHH`po8Uf)^$e2Vj!bV(} z$~ib11*k~QN15-c4N^4A6J zPKj2WQG6QIhS~;Vli_H}WYaN&nOtn1%2N%D~p-NP~V%TgI7CFrI{)#aS{-;>bB%cLM`d(Ht=eR+}We8yDv)Li3tnZs|2amziQ0sLUIL%Mp`cnQZ~~2rlS? z;8lrMe9;@0Bw2XwmuQ!f5_kRM{_{fBMHo`C3NQwOG_E5X!&D)hNni=Pt}D+)swu2X z^}SUlK z{qI}G5zvFtYZn6xYtoTdY1=^2ii;Eg60E5+cLLYZR%|x^QCBtcWy^e+sW{a2M( z@1k_s>h%<-tw=99Z579?-F)sr>8mti{jGLKMEtGRSU09{&06w-YMgfBL?CmEWgX{Z zTwb9G2jKazH`KQF}_YW&L&;%yz`2nt6l*y&Qid$<2Y!!8*!B36 zoWr=>Ro)~3nRQPMRD+^A7@(KZP%y|5TRePL1s5XfEyur^_{*@JWCV<96UF zC(IMbB>oRI;faXnc>n4C;VFo-xWL|lj>n#I8g2ycuO_God?q{?uz~6KIpLv*vx@~j z8w{U{_%9iU_tYR61Sx>*H|LjVcm6v8e(y){JVdr5(vuMvi6o zZ9wYX_XcF)h<&^`;hN#}{RM7tXgpq=0^&CPg!S#fojtz0^n=K>X58zy1^j}ab|)d; z|5jvof}h0y(4F{K{Vk-yfn}IKJf&d4?>gbnAWoU#z*3rcF9_+tGWZ-K9*=Kh^@Cp% zySxuk_ojZ&^3L%AvXCoy>0)a!5Q(jwKwXajRg9F6 zLf;<|Q@b4mqVbSu-0AU0io4P$?#hz5D@EL1)I*93?4ErkO34REC03Oxu@g7l`CkD0 z$QSYN8;tOGb$c0cA@@HsG7gcSB2x1XB6LGqb4C@;I6>qDS~^z;Wa&K#foF@!F9V^N z{OyQ{$$t?MG5P(7h{=m#aYFQ-W%=Ng}V*qRQO`i(B zSyI6_MFkvIyl=e=F?-UXuJ@DYlVj8Jl=msiw8#KOjnmypezEVTKqwGB=u+xyfp7d?xYP!vAcAHvX zpJ@caFcPuPbSheVj2K&n6fc%j#7oBZ7zk)=G&4IqtM1C=KIMFZH164*^*xV!_9{z~82 zQR|il4z~M15*0`!1INo?B|XYD1INI5wCaQ8tK;0kl2sp+Uc(94P?#A^dN|nl2yX1c230P@}wO6|=;zXW0E5#W4lYR~RtVKcw z7d)!>fI<8Qx4OG?{tOUV3UU{g7z^;Hz%@Mktsf&lLu3#lbsRPKGA}$VbRJ0}e8pm_ zF7wY8P_coVrGZPMiLW9bVMS_8MTQ}_RHVjK;(A}NM!GIiOESSiQxM7;ap(TC5 z*CdzG6eF*JsMO`I1a+y)twG$3?}Jjb)LzmK?qF$zUeXAIr2%?L0}Pfmks%tqgBg0e z96<+v%EW1}_0qHYx)PUeRVz%5@tO(ndbWAYw7G`?T#AdCHa`Wp6d5yZJ`cDQRVPKA zxC6KpS0_cBM76^x<*kM{SZqKV;Jct>1H@`X`>z9~_9I@@aYX&!LPXU61|pr*PtpDA zKLrFb8h;oO8I3=Rh_pZ}^A=kmR^9?Ky+%IRtCKCw)h3|w{Zp)T3ZtOAsGyULf-XRA zQP9aoLDv8m1)XdZvXsA)pi@-%eLn|ogl#+siSdof?`iO#t0~G~bfQTsQFNlbO zPQ`QFQ5AFzC`Ca#5D^9KK|~bvV?;^{N>ouz(i~$t}ExAMc(F@rOK(wAsYZHu$fAUrl_R z@IL8MjD5>N$T`!S$EKZi1#WeB=UojD3HF2EW=2jzJ!>Lnf5(jBfW<*Inu6`ZvHVDX`69Rri}fFxbrDqu;QD(%F8F^PHsmv4M8r<^@KJvJ9 zvuVue3EG%9o5nm7xHRU?rZKMuE{%DMY0S?8m*<~bOykYRFBfD&Sa0yp0GCN&o$xQt zc;g^~*HW7C{snxb!~6*m=`c~`ln!$yBBc(qmo?t(oAk^RO|UfM&D9#054R`(lty^F z%Nfxf{2L;zf(({NgB@mO6XAD=@J2^m{J8V+i)zQaU&v4VIRr`(f52Uf(e6a&1NwCF zpc!vQ13#1O9~3qxt_3cun1_tc_5okR{0|!)Wr2T!_~(WHNgv06J`h4CaCu*FdqqAA zf-Sf?bSM91@Xr}W%NmAj$W)L@_xqW91#moqFNIK{Yw^$H<2|45gWn6X*0R%kAK>%2 zUgixADBOWrNvR|3O~6K6>`p0MEO0HZ7F;$^%CWe(>^op@0{ZXo^4)(D@fUEhH@t+4 zGWhcaA!`&DUv%}y#rMqoI%GpDBIK9B^$@N{a6N|0hGV5K0inMxHvw<4nE@Md9j(6q z+4N)8k9BIp#X5Z(7xl%qvY`=?qsd1)zI9`$H$e6hG5V(BNrgKV@==I3t zBSB6G4Eqg`9UhFb-`Mcq*`2l?J@H@UPJ8jvg{#C9^*A`9uH@yI|Q89N@d`s%6kl1-h;d zx((YdF1pR_u1>nm{WZ;3jayL3C$~vX!C80n!bQvB=e&a7ZY^=)8AnMq-m*)F#8#-v z%Eis}0bikj)y*qcb#ih(*IB&0Y2k`BDZ0`Yol_6E1OK~llfGuv0%?rZOP5{M+ytx9 z8^+@{x{YL^`}+S0KDTS_XbH$cTzoy>7LZLWHi?5eCu$oeBjWc{V@+RO!2dCVhbhid>^|k~zhc;DhtZoTAei}}Km1vG7hn=ih4kykd_zWM$Ppv^Y z9rJ&Jf9_=~7B643r0Gf>1pYIAx|c6ov})n18*y4x7ysOF!i{Av2V)taMlN>nbY1k% zjU*@NIUz!PfubYSi|M>I3J0V;8sNQoBYd-p6V|in-1QRN)kL~>W+EZnYFCL{D3rc$*WM$9-@Rx0^&Nk zNO(vHFRAjj!2@`$_co-hmn<&)XGbm!g;3jd{ErH4Mup&m_C4z)yvXD*m~@Y9sq+5y z=JnntxO47Sb?X#5GOstqJKi6SC-Bc9E#iF?US^do(!sIsdbkcw(dBJJ2pZ@s0z|7? z=sXq`hwLD~NLngXb!k=jT(-_sWU}n_>6{&LvE5%{~Ug$T@NLf z)%*)^8r>t}9ljafc;SRS>YXC?g1lQq%D*BX4F^S?Ll5MtNH_*ICH$kKZm5fDphNR+ z5%@rcCgJ^@8m)&$k&za*saR?6S*M`|)&|aB0FAOn!9N3SmA40#33)$}_?Hmx0Rx4S zUWVGmhjg(#I`8g=lLdqeU7_2S^YS!0@5fL&UC{e_L0M&tXJ$A!@45c{NVon7(&6@N zIMxN;hE1*DmDyLT-$+gFmRh|b@lTg(^;VZ!y&|=`6yBgAevS7lnv+-wJ-B-}vY`WM#?Jk9n-OHm|7AfQ>LSP;5Ck^d zj>`CL7>=u1W!UfrGah)KbsILCivOTf#lJ3<-H*zKyhkPeFH&)7!pBfvXB)oXlt)wb zm)Et={H^7QqQBFnyw98RUihym@98e(ec6=vz5kl>p6gQHH%xgw|G=T|NqB!hvC4ZY zus+n^Lj%^sk9=sLhmO>1dZ^ncNb)T>MekMR{W#FDk$tOvMwRzPbL)oz^scYL8$7yG z2jlnPel4TeEOie!*B9extzukUoWBLP>Am2r{^C$yc9n(@M)*GLrx(KqeJHvv)a?oM z8+aY(SgnJ`@4&Lue|DglD(?>{G6a|IjQ<{S?LUW5?auw@S5ob*J|T-DVrCZ6|1XM& zvF46Ixrm2N%e;+h9^KM!3)tDAy^~6Iiy97yO74?*UR8qfGAOTe&w3cn*@s3pVpf5x zd+6^@x}bl{IBNflhwkC6Z3vY+YOnHs1B#wi-ao@Be80_z(WCvXp&n1rSRO%I41Vm9 zMi2GJV~ni5hzSp&h*RJO-oxVQMR>gLQRRIVL`eCODe!9^=3_7cIp*?iGBJM-N!`51 zy$0`l$PP#JPa+Fa2Vh`*BGe!A{lysYVYYoP3ib8+H-rW}A;mi0ZWIAIet=p)4)5#8 zUR&k;5ZQZq&9V~v2k?eg4p5+7H$5)a!u4UN@B!=+v4OtlL-6G5zxxW)W(D_s+{3K^bCwy>;6=KKs{Vrccig`Q-AIp6KKXmqC(jUVPARCyzTGRRb+1r`q{F^57dA~Q_I?yiw1D|nwJLfoc zil+o0==@2`<8yp(XRvd&^5=7RZ|8L9qks%1{UqlRrRTd2`f~rG^5c7p-mr&xc#LD< zb9Zm&EawtUPvTy0*vAu^Zup2(%h9XuO+59#iEDm)wG5c91iggt&%;XZ}$Dm)SM zG1EVx@D+uJ6%GlT^otct90a)tLP{Ds0`jiDPsi2fwLQ32N~e!s#WD~w|5B;DBx z7ZReMZC3bgg>NW~^)%@hD!f+VmlPgUSdAT2^vQUd!jCAtOX2qvzNxSpgPzbUv5 z{EHRdMp)-Kk1EV5JOO=-_Zt+Z6yB!rQH4KK_y>jk(I=Vje1+F3d|2TR2nRXN9~GW} zK1zI|!kZP|r|?;YIfY^LQPK}q_#uT?E4)YHV+wyxIM|U7281W0?-G7k;aY`vDtu1i zZxz;}4+iRSIHX$+^z6eghMc{q3;l$q3|Y!4=8+I;Q@uy z&}T@GZZAGQVfNzN6U{0R>Ji_bU@tgS zJqo|5@KJ@|QTUv~A1QpD5Vr9S;mP>t8rV%?A41r|AjP?fgLM2s8prR86`!SWzQU^% zu2d-V!6`T`oH$^sLjHtmJoD174A~_h{DGdeqZ5F6uzpE{-&58Z}SBnr*MG6lL=wF zXAq)(A5zGj)5Phwhj2b2X|b!bJ+X<%n|cAOt;sP(t~>sqh(vFDU$(!kogl z6nY_(FQV{xg>?!?C_GEyBtmqqOBAPHLDuU^#jjSJ>uJh!z2YBJe52yGD*kDO59s~R zDgLP9-%xxXA?o{r-v5chUn%TRcu3)26joK4d_4&vXFr88g{LSSqcA~;auyMyo;T_J zjSBD3`{H95>3psy{lDvd{$PapPA9~ebsiz~KtEzEf12WR6u(08s}%pJ;%gM=FHV@h zMe!|)f0_{dpH%oSnx574Hx<645N|bvPY;Ft6%JN7iV$P#*@|C42zf73{4&KaSG-B_ zWs2WOi2OVC{(}nlDEtoLFg!0R{%bo!hclwqQYM*e3KCCp+74g;JOfUR1t!2Z^e&Se30TN zD?Uc?GZnv(5d7xp{bdSQDg3y?7KJ+qLI1GgUs3oig?knLkP!7RDE>Af^7Y`lG=_dh z2zdt+LjIwOpRV{>iceB}isC$8m-KTKznT#IKCbt-D!fzSE`<*({2C$Xzo+=WD12FA zyTacQLjEeQi&0)*LgX7sSciFx5b{sf^r?!^QhcuBOB7$Kc(dYb72iS#e!KMkmlX1c zA}seQh2K;7A|dEI6hEZ!FA4)(pCezC5b_UI{7gdR`!FHozEa^*h0O}n3b!e|Tj4_r z+Y~-UILLASQSlcEQSQ$a=V9=~I~4z;;_oQVA9^rdo+BVnAI19-(k>Jqs`%*&&)55t z6#uZ|GZkM<2)S<7`|82s-n5X$10y%3G_EmVI!l4S| z3eQ$JQ6YaMLcZ4#g5OrcdW?&NsAq-{{2x-hP4UMR->djO#rG@zlHys#4=8>}@wXKZ z^7#nm^(RC*@;n7NT=CNtP9TJwiwQx06CvcgRpDIA3hJ45fw^BwRRiqBTMRSF#ht~0T$5g1m8 zZY?;Lav5LFjEPKb5XScT&ho~tmSaI(TAA?Ep63g;@kQsGjC%N3>+HY-dk zY*DyH;WmY>3U?~ZD11oaBMSE@Y*YA{!o7s3>^_ChD||uWeuXb7%o1W=JfQG(g>Nc6 zr0{Kp^8AANjqkHK&xIA%D2yuP=540O2r(bjE96FQ;v*FDy)JRS7b8p%#?1RM!l{Z+ zQ!E*z&ntXE;eLfLDa;bqLjMY1C&csMn+gvR;yLhbh3^u=-rrNmT~B;o2`UT| z!k*=M3@}O@_FAj3KOxqS0~N*yVK4OxhY`XaMktIEq8-O7l;=9M)49aiUW9Bfg;NRZ zu-;XeBpihPqHr!D^m(PiMndRoiNd9X=`4;v5mIoa5mFG>=lfT4g{dk4|+aG%Yq&^?70z^H2LkRihIR$e6 zGoL3Q?>S*W$SLb^$oG?Oz#-QK5kSaO+_v0xi+Izui&Hl`BbPKST66V+g^L!gYP#MT zDSNO-u4-C7a>9&DMmDWowq&i`8(Cq`Ft<4iDKj0BVDZXpuf-;6M;I<_#t!2}Ynq!@ zo1CWbRSQ>K%{vCeCS;R%YzZoE)IO?6N6vBV(tKOxk6MP0ZqedvQ~sJRTXEIO_ggt` z*ngibAv?>DDpQH#*!7fc?eDW>+3!Dc#Y#8|opR}Ar{Nb3i?4aVQgiqHQH3rNybqa| z*`Ed+m1AiS{QIrn!fTtBEGWx%BzrI4Xa7FS=(P9#sN#2}Jho=K{Cwc3B~+$9b}5~I z$#K*oDv%zVzyCK9N9Epy@YuYUm3};NRMzEm$L5Txb{c@?*ELdx8S0iVThU~?fWfa? z1#@$*TGga?k6i+PmvdC1<%c`ipS^OizaXOi&DkR{=;Ajf&dAj_UMuieGeDPLg&aYM zE_C$^N1pBA-#GpoeHQ=AztLwhD*r~G!KnNjJ(f}VH~Mr&<=^NrjLN^!qZu9TELgCx zY2l(}3)ZZ-VcCi$3l^tR3sS4%k|zJTPINhouYKi_p;$v91rSovyyz= z| za>Af|HeQYO@jC~!Rz99q>DM2B zOv`de!(jPwPn=)A$v%GPDIN2DqfCEc@T=6mkCxSUmXF{0K7Q-U^v7>mEQd4~VImNr;^ zTM)5vrad|W-;cN;(O}c~ZrHDvHy5B>=#b?$;Iid@7IB-0EJmTh)>bI@UZnZ?y>|@` z_(fZi-!xp7-yX!t&ptbReuCqyv&z*prmrib8+M`Lh1(KH!;9zM654Px=={N^ZN*K9 zQ(QWbZoH4s(tX~HL&cPDgKnI!zE;!+LFcdUt1BJ(4#4`(z-8;pJs_4hnI4*o_l@Z5 zHrO=o74`Fb50bWmi2P>ZviwF>;T@#S3^)ym+($z`XlkL00xnv(y6McZBNvZcIV#2w zm;dIUiJSjtjvXsEN5|u5pDD4%$SoI4yAZ#+1{V`toWE1TP|rbfKQvarFlP`_55f0y z4SYYxGxrq&jhS|Qh0kNH9&uVT?O%#S@?VTJZLm!C0n!ePVq!n3|V; zFqV$G?u=uLH<*MAU z-l#)ho%n%vaql=MoI9lt?z!e(0Qb&!y5;C6+GC#7=3Fqj5nGVvw09gnJU-lbU!l6~ zwrsHVz5;!W2&fzH)~J;I}&PTnBlw%=6&inRMqt7ijb0 z=K_XZCo5$po-0rWmf6j@Aj|q1ojq678Jnl=tATW}ZQ!#ykY?M=$=^;rX5g0{I$;|* z@QDrI)_DhILbnIq=(=3MnV#PaJ-cnU<=jL|uG*Q^jy4}oh_)RbbbitibCS8}aVy(1 zkRA3rz>T#a-<VdZFwi2fp2?flIOIxp9=r= z^N{yE-2Va6i94vrWw^J>`Q2;c*PC?(ujdaRp7&w!s!mWRSL7SOyV~iVgI{i>U!G4p z>1^6rpZ!uDY&Et%yFR)wn{n4=F_cH(WSrY8wxW0DyFrh^^!7p+b`?ij7=55y%E_~x zUFbBCO5~yAywhlOi({k;r$8>y9(0h`MH{+_S-Cpo#n*;H1is^shs-Ycf57e6{^!Go z2UIQ2zz&kUH^5DA$pIdex-@QTcUy0T-Cdr46Lcr{XFmYX=-vY?6J7@Lg~Nxpo*ZNy z=K}ve>;`R<*_v}9A9Q;#(D?m=2V7*ty`SS=FbaR`kT>km?|K95Yh3}uOi@>lp)965 zjav#;D9`pY>bvBVJdjQ$PJ5#j<3f1h?gDHJGR(?XHSX@f?!&@1XS>L9$U&NOyV!NY zL7B1bu#@eD8fSa%<@oMG8tvu9O*-2R)98SG$Ws&Do|_wk44Ri|=w}012J85UkMG4J3>QP&7YCi{?G`biY>~*w=4>yYsEvPwe&epLMJG<{QzK zgMQoR`(LjPUH?!2I(m6{?BVU-T|Um4^v0}De>HjWk0v~R*XViOKizP_(lxUoz?@ZM zMqPOJwaeB{T)c3?yjjg3T|0Kh>a!O&OrEwVb-|Qz%g$Pwym<8ui!WTVdc~QS%(>yB zOOvNwdc(ChjGb^nGBvxQ>H5nqxPHd;Mc2)~WcJEw%WpXEyrN?ZR+wufD3Ty4(aQ-q z1>!D2BQ83tN$zH>4VUX&PQWwN;4ULb$k%zejk^-8M++h*$MokBje?4-DmzO@lY<9; zl;A`q%DGsApWQIrfqx`|q(rYEXq4zof}13IMJqtYMC(!PSX`d-ad$T(H{l8aso)+p zfh>majAlg11#Ukw0Kom z`GqOoZbm4mdOt~;`|fT=QU(d^=8BubOAbbi-Z9vkP%ac*!eo#{sTe0Th0H-rg3ZEC zQ45aM&h<|8usdM4rWcLnN!(!GY8=)l1bl5p88GCP)9%HMfkJy@WoFD!j|(MvY@#fQ!Pb-Ufw$DzSX{^V=?#WfNHi77~?0rc>ByCVC|RHA4!P%bg}LJ6ZxalOS3WV|q!9 z=_*CB@mW$v`4GN|3+6&VrIS4wHEP^);{9?~6p8k#W^1JTM3~Z%GYp&HU5U;k2#cUe zYr(EF&zdiymALyWY)qo!fEYzylt%ELL}vk&LoO?fR&k|b53^(v$9)FdUegdy;(~E< zmVCrS@n1qES44DPb5Wo1-OuUHEisV~HgCsOWwr~A+oF6wjs2{>@K=zK@~2Gw--;?tw(HAhl=!ex*%x=%0Y1CEJG{)o;! zfvoV@Z#@zD90Bz%xf$x?b2C(HTq?cl-;x)ivM}t`5WiuErhrKso*8PWWadoCkuysa0`+>R`7pSxn}w zRan95G%%kB2fHJ>qdGeQRY6xH)*Y*8r(Mu~Ol<@D8qw1R0<8(`h#wS; zv_1G^B6;~eN>CR1d!~*i;~uXdN|z?CNv(m6^ViyLoKo~S4XE@0gI*5wuf^1!TM^~t zC=pJK5;3p3n4*bQq6xkY6HTn{q>0s1^?gW`x~>s)5X?XnbG@J+1^VwS_G41@%|Q9> z!@ZHM*W>p~|x;yazXBO(6P~h&=#{aH;WcS>xV2 zP#F7t9~|btqoxlIo!$|4dh-WgkCfkasvgGeP_UK))sk85B>WR=Jp}~>Zt|ESMxRCm zfvXh;HWC9Rx8c9*Nv@0Z#m@iPV_Xf_1$?epfTxJk0j_dB>4F6lX3Usy`GT1j&AVX1 ztjm)ZELfl~m`n~lmy~jF2OIZf@EBOcc^s_W=eD?cffj@u3xsvoBow~@Ct9w-nXSvN zUeUB9)`_l^f8~-UhhMwTnpSh4UDI`I7A{}yEL^;J&9!TmFT@d?3zjUq8r!3= z_GBebAA?%ziLci;ty;8lb(5TN``_&}PIOn;Hz(B~R*>#ZJ?St+7QWW(*(Hu}CS$zb z5&^Qy9Epz0SsU1;+tu1LFWKS-uKy#9eeg1`1Y-@ed;@f$L}mW zb;oP>KR9Ykd<_0Z$499FjIt*uUNC;t4J%h&GYSV1U%PU}jVo6#ShBEr;i#2M5nH|F zno%njHZQxrY1HW>$BaB<&}Cw*5H&Y7T4Vr*A1t&^~5o6wHE`d4-IJujV@)p2xnQ10FS7! z=~1w9Xbgo@)cn@eJRbFI$DCW)Oc}@+X6L1{cK*%*1r!hSqI$?ciAQVN; z&s2Hu;JmRO-mPwf#Bey$HXOxv5;8g7+c=KxB;r+1;Doy>;85jGx8a*r-XRlxd@s)P z0|S(Nzl*b|ykFv2#|Ocnrpmhl2O@f>HiU*#l)gCOaY|?m*y3<6oH97DAyf^u^qm$8 zJ%eMT8oX!a7`Uh0^%6r{f7=Zopdy~X`Eec?^%R&6LiP}k_L?S*{|r(<_+1{ecku=s z3I!IutGw@l@;Fd}4F7APZX6creZxrk0uoP#CVHXpdY&6q<$WF5>b)PhkB91TKok(P z>5qUN2eR%wXw3UE?Fv=F0a@UJBEJMKE>3~O35+-EiBZ}jzmX#e-wB^r<$dzz$E&=ZPKaQ-1D3(I^osM>`r)hXDaai(hZrTyYo3^hV?dj=W%k@4&yP! zGk|B~3M-yK{t1XzE6(43GbC`i7)=i=@5=@6h5x0{^=v3|DFx50i;Fir8J&wL-l~-I z^L@wzS=Y0o`js+EI%`%6p7HZgyuq`hR%(5ClXJr_i>U_xX;F6uf4(ezucmW8=*^ck zigO;}Sx0(}q5dKnO6zxNNw8HrcZze>2-&J@8R^7z;y`GRBN(fIz!GtRm z-lp(R3KLkyGySs)pCg34e^z)RbU+-y3BZgYio@S@(4q;CC&WLfSnxrFea!wIrk_q6 zkKz|;dQ#yWg^LMcAZr!BMd57yA=OCA-dO>6#u5;k1PJ1;{T-hONzg&_-hJ( zulN6?I0gmb%cpV5eVpQQ1_tmG6(6MO;(Qizj8>fXOSuw?f0z(*&sDfk;YSs&R(O-b zjS6ogM0vXi(Jr4;{82*i|Ayjw72l`$zbO8q;=fXyADqbVkU~B;lMlx~-jC3JfcGQ> zeuCm3RGjaYm_9=BvlKr^@e37iQ2a8*`HW6}O9@er>lEIg_qQm#oe=hQkK){q%JLpj z{F@57|AqITQ+&VTFDcFsN96Mtg*CK)lrLv)05Y&WVDS8nA0l#s<6X7)r_^rw*|M83bg5s(Qd`l0D z$NU9=5FBCif9I#lBWg;%za9N&1f8EkkH|@%QvDUbddwZ=LvU13#-j3~@z%jnEav8H0BSYyOZOZPe=e!c9{^1aX}3!LGX`s<1GSc>CQmJ#+m#o=vsVqtOo5<98GIah|Wkg=kTK(6mjaTk@;BFLqcerOK?6ekm z52}a+qdN<3FSA!J?CdPa9vAGbalzAxwqTD?OCgLant1B<63<7{hb}g}qSb-?aj9(H zai+IJ9b1Eq;D|HU)^V>H_U}a@ zTg=E(4Ll5-`K(;AK+7B4_s6tDw>|Z`)bHt*^q~npShcG%a}VA{$uw>?I;q|vEZ z_OjgRQui?G?$qt*fMRmoclHkU^th>Xj`D`E=Pi`VjAmI@_92uV^~0xE@R*IgRM=mJ zy=1Iom6a8`$1UE zFWA$CqMNs&n_%W1*v(yqYG)qme`^8y7%uIfVEfN$KMgvk%>MQsMxF`eOS5j+TL(OH zKk8xV+9NTet03?Q>T2|MkJw?_z4Z;~3wzg)KLLA0yFrH$v|-+b-YElZKkS%v<|Us) zo1c1}_o|}}*=jeP6^zI{S&}k~Z#K z276|CO%oaC-aqDXoa`iwuxL-{Y|B${Je|!GioCbCq=TrV1HKyq)7wL6YmOWD56ZNk z6m@d}x3z;~PP{IV4IqDMY-p4HsX^$@!?=JASNW0bi<#C!AYp8c{pbF#W!krbFV;T8 z*&ZihkFFcfzi!s*R)oHAu?b)%$+8*m)vc0>^80c+$<7MpYqaK+a)P2jMo3A?Q zINCB8m;tsB%J1v0G|nzHBiTKenaj=@W5QK^?|sPeIQ0VnTh?k znRbqc_%s53+p_-lEthF%1(~pZswflXfSot|E#*Tt*uWiyp<0jMVV^JcMY%F=SKAu_ z+lxMiJ*a8yhlUMyZ{z;d&lH9^+@Crj*Ap@vKz*I$k2&VTMxl#F*88%2G=+VtxWb@4 z6?Hfb_uK^Sc2j_TOKht((;kIQVqH6++PyK)GWLVt7bbAbK0)|>VM01unj2@e@0C7q zH}-d941vvF1H0##dRy;x&X(81sV#*J@&+}Jhy0XN#--HVTy}ODm(B(ac)+erIm}ZUmrNPd zYcPfjyim>?>_;*-p-;%zguHGW+wtXazeN$QhG>lnMG zfHi%jo3km)dbw?hoR`U(z2mVfI#|DGw6s3LdUHTHdUxS-P9$54{rv;u!5rlYV!yr< z+tE?wT;ASq@cMQqwyp!?9=tnaKR0Z6*rU4(r=fnd^&#L91P_i)gHU!1bq>ewF02b+ zF4QrD^RUng$F(ZU}zTAeslghM{7y9u*CyFryJXj9toJRcif_*rKelr^V zr*S>TkQp+DJQ#Dc560P-u;(A`!!e`^YY^xgQ~4GgQOEt~#x7;P)U_w?n{gZcROeCH zi#q~y>7m=r-fOWZpRRtx@hSQKY_JaYcPID3qeGyt%KLi&{GK9`b}*L5;}dfW_fE`B z$WF{fF#ZMbh*ITTnGZQ18H}-eYnAhn{8{mdIC}NU{2V|ho<`eeVNWwrH@wcqn0+{& zp$^dp!8eU{DSku4c@XOhS$hTAFpfZ8w=scr==Iu9?eMe2il}H6<5x?m9p_`BZdLHW*!h;QuxJIOyX^tV6LVLzY(|6Kw(g8qYR!y0jC1$1}k6>zVnXpy51=-`!*#XMJHX>JfC-=Nzm-+~^Lh zuhIwpdid~gJY!?7FzZqD6SICzR$jky>@$7z*z4CitY0}E%6OWx<0{x2ns&*~L zak=!{6erE++y3Zpvl1A;I36XqZr@p`jc+eRuyko51dC~s}cZu|~Ry5kd z+aazurpS5&-;cI>8T8lq4*WiieT!w!%ySII8W+F$z!;s}QP?nOeb!A(!dNgX&oxwV z^j#fpVsZ|@3BkRYGDZ{18Y+SDcRI)47L32MWc+{3^6N#_{-F z1(w77vW7za1F;QR+AjOC8+V@d5O*Et*|~e~D~v%~c%YAakSXS%{PkHhW;@#aUaY+e z)u`(a$=AtXeU3R77su#YK%DlCcq)Gh>cHRWalF7Biur1XjQ@|}{^Y^Xo70%1{RLvT zXECQ7JTC6#>R0`^!;Am8!%01dHhQiQ;P0tG!!csC}<5>GN=gP*N?fU>RmK;0{ zx}@&#+ra~FrXfcieg$dJul!CCzwbkxlldm-wYCk>c?s1GvCz{@ms75`klWLzb%^q9;9~$KRAZ`HsG3*Um!mlPUh!>x66F3nSB5B zeSM=*w(ZEj&~kdk2NAsth83U6nT^Db{D!~ z-FKFA>-r$l;?Avi@VABRJ5kL4;Z{CNFU0!iKG@ZLc*bU*NapLHUuX2r4p-JJ=68s! zJLk;rV=Tk-^1*?i$8Q$do&)gKx!|@sxfeP2ClVOTGWp5Q_SeG;!6R(e)hCD3vX1N( z-t-#R+3f#rdTtKC@k0J9@@^}h8C$0$xb{KZo$TEAI@;W=l!Sl@c5JNg&f2mNd?d30;bdIwQ% zG>!2MZBJdj2AuwE#(CylJ@*+fw0*Tk-T@8$erX#0>8K<7rP&N zZ8XoAkqq^EZ(*P4b)t;<7{9mTc``>Eag#=`Sktysw_e)llD~=MZzHYTl<#Y2JLY{U z^FV&AKO=Y-i8%P5U~C0^+*QBc9tixRB=b(0_hw_>yFH7szZchYVq>l5U82Mr$!Bx6 z#{dWVoSScp?#0-Qc?PsD+NK-I564YDH0elbIJZSXDk?2W#TpIH{AlK)R4{~fOV7p6~_n+(&!PF+K**8I!S>|04 zHOs_rgR-Qm4iQFmDP>vLKd?|(b%ZX26~oRzY|890%QPgzh%-nFe~Em4}Yy9d)(4Bug8_yUeV8 zCr&%*iS&BNN;#{d>#}aIG}7^&4DZXh_8K$l>DNv_|LNC)@$`XU4DW7Z6S$^m=NJSX z-^*vEPP*lLKD-C@+F_sWjCQ`WLx0&Ca6Zz`u?b_?z2RhQVg2Y#`{BJ<$0R`4xG z<>jgx@9H?SdSE-=T@K*y?Zfd6SciQ?e*Z1w8rESL6S+RlI|=lwMwFAv;P(#C9`s&ckutJ8@r^;!oxtAW#A&G!<>9EZ$U_j`@c z=2_SN$v`d)+dZ?1I+%cU)`lF`lOi*}O;jO{G2mW)ciH3`eN{n+Uh>&|f2=P<$sHYM z1O}RSrN|q`dXM?#_wp&W^_=`KWlo0ugP+t75W@<-bD3`*L9~UN0d0cxmvJu9_a8e8 z8|D4S1sHE<%KTO7{RiiG^x4w;$&~;7sGEHtM!qxi)sS1>k4CS~VeXMNaEQ>pD*>Ok z_?|LKyIqHMb2_^*kZi|V|K7|ZyhC@QGWKK^tuyZl(I@y$`$Mp;D(A9x%&)_%&=wd= z&0K)Kcoym+-_FuT7aS8qJ80`>9mBDk?aw);Thzqux3h%X@&?p&Fw}^$labsPR~a50 z`?1TGI+u2VPGJxD_JclCRoB{4RkyB#?_eL$GcLNKci0ssGJX>-+a-CH&SMu9}H{lNCHP4~6^I#0m zbMif7F}~AG%(0HHv)a&OTn$XP6a9T6`qnJ-9Tnq%vp19P8NY*dLOXo~^jM=ocl^H5 z6YE;E*S*eOoaq9&cn`lx&g1<;B#g4c7;{5)y*om9KBHa_@f#1uLyUjJdESE5VMEK` zUWdIKpsV*^hZ@K~NaVj# zHtNLK*FVCuPrlDOOFLGmGx8Se?8KJm0;(rRb!hcgt_yiiNuqy4w@z~5M4r>)?sX;w zrOld6n@~ zY+I|Fo;VAJcu~GAYz*}^I+|K#7@-Etwu_3Dq`|dRWJ-DcM2y;B2nJ^x^xCim3b1aGAnaiw^8#x{(^Gi8bgD1yb z>~6!_25Xv3W6qhdF3U5J@LY^OcUK{ZcQQ~)*2Ot1K_^;ZUd&SwH~mrb&bE+z-Ne1K%lzb58Qto9kjz=XpHOCQ^kliZb(?OjXR(na`Hg0qbh({B!pG zMzi0c_#P0t_P+?e5Z=2TYwWpP?{%tg81DvXA7VR+ zU5L-Zn1^<+6P>i<{bK>o1Lk=O?*f9Tx2ZGUgE+0y*5o0!lfrv9&^j^N)V4wh;}GPd zYpH{@72;^Od&Ag|5QMMFm_LYG6x_p`rlU9`50|)!0F(_ zyn*P{YykOOj1+2mG3|r=-ohOn)rnczs?_AHcU>Cq@Gy_1 zoYSi~CZslxF>Auh_{|$;GbfLAC!WoAVSKo(9c%aDA*?w#mt+1Mz;QBEm+lC~(PkL? zEgkAR9K5r^)Tg1#Ir4n(CO72RUgQ%3&k)-cYnV{4G};$^Il=zCO>}F|Hj=S|=V@{O z5Otd5yU9BWF3Q7R#VqXvynar-dr{LSY{xUfpX<+{b0=(`-*RYE*O_rOdS}6b4$K;P zw%Am#5j>-5*jQtZYpJRP>905RNDE%~DXg(3BYln;hh?oloon)~Zfa*c-=X8I1-2{N z$-HL?W1SgJp)8D#&UO7zM_F$nJuP!&0P>35v69?B5}ji$hV!a8hp-Oib;B821Ds?j zU3A2?^$~TH%)@3L|F6~s*2AI;z7zNBg3o)EbbD_00CkfU*yu4gCSO#^(cmk9Hk=_v^I-yv#W1#CVpSbFenOJ;%P`!KSG*juS!1 zf_^XgQRslzF=k^9hP~edK8c)@F=H_L7Ut4>x{SflrO-#5+p_$|<0jHFr()b}{}I|X z*mx(#FYcq5&9&KZj+dNUoVb3wiJS5Ed*shPlB6v1{!!+c5a>CV+Ifa^lbvTAyqC3O zt^+=CXTuvDTk#IPSWnJV<@Nj$>e(ji(%E_T@8_sTjGf`codvIv^AKd9j7c3!G55H@ zIi6PSMH=@%;2qNK$md44;#~oB#di}JgSpRu<7gD`qPfoI8h;(;T;A&r-cgJx=6ma% zg`LqUnBO<(_t*b-@Z+#{GT&ck=V22#ukr7%6Rdso`|E7ZBN4Z8c9(XN@2{{;j92JR zcNVJU+v^6{Hov`M-G()n|Jy6)Mm!gw-*Ar3v^T@%XaixC^$gZodEl}q1bx?KndtKY z*e}0FI#>(rz(x$(4d=pR@5P|anK6QVxF_mZ-!q!=4!Ahx=ywhDFSp+JU4y*XUp@3o z_9KonzrY$0b2RF47uKm}?0^pBxmwm9xKGG5$&c~GMZJ4D>)sfOI%h$QHJXIBuZHE@ z?EgpJ`@q+ARd>GUN>{cbi{u)MpcpaSfI^gD;7YpsV=z>Iu7nfR_UfM{I|@~bQ%q|> z2?ji^85ClI<2X|#aT*g$B_1wyU)@2pX2zv%pW3=@rgcAcr)lfQ^AuUKaPadhc~iIJ z&U5K}e`}wudv(uINZ+)d_dcJwA1|$a_Fil4wbx$z|31fK^o!?y-R;qW(5 z^8|kpzU@zB+w^lw3D%xkqs!j9OBbXx*XUpTgHR{+XItqvbHEm$9moKi z0NpRr9i$}p8awExvOoh+2dGV}-U@4N_EsC8zO4A=by%8wQxCAt=B`j6TEEUl2U};; zhx&Ck<2^cRj&QInGo^bWRb{Mo+*~2Nn;1N|RGB89MC!82C3;Jzd|FRy-LVC}r1qt$ zi`!L3>$`q#=^gk^NAM)`{jjcPT;253-(`vSYZCS8;(b5ysvmfkNXNFUON#pMF7%Y{ zWJ-Rn-}XMh8C2D#4tP3Q%fSoH74Ivarb)VW$WNTE%ms^l#O>>Q|5zV9W_Mbw-^J&h zAHlbLpWv}2WYHEz7by>IiaBygIhliPythb?#1y^@kJm@@2?7J7xFau_K~;MZ zk7#|~TSD4)a5kjfR75NNL|b1ZKNIq(9vVWPbPmNa@~G`F@puFH4cB%i*wN^=eE+3J}!$Gv6TiKUCA@0{dLh26L2 zUTk6C*ZKnDxqnghrXaoWrc`=C?V~mo&OOjk_47FMNa?9IBK>^(c$9eQm{7jxsXG&# zC)3C07BnZ*d8v33Q>@*vE9YrTkH3~P^-w+vU+KuGjDu>k_o@!*Ulwk%_0A*U$;;9Q zUvzzIsLzAsD}TzRvHzSqb5-A__LFEly4?S$e6pEzOtLSS%&0s=MrU`7!*h7iC4y%z z{uQ{KHUIyv{W<23W%zWKe1gpQ!k^PGOV=#2NYgm@Rm`IKIVyubZ%Z}`qk838F$!K&+w-!gVY`9ge`J9OI->Q&tJ}ili(q6S%P&V zekUHylZDghC4a(p)+g7aA9M0Zzj*cg_%d~EZQ1$la=+-?tnU}=XJ{+rr#57LBYlf+ zOPZ7F-jjSI;0|jYez%3P1nDomuB`K^*IOF#Wvm5~sY&L?l#_JXjI~9<@6h2H`cCDY zMqYAG?Y`9SSfhvIp8Tl{`-++HS6$TEkd49G|4XnRt33nN3%>Jw9kMxt z!yW_71%iWmmhSY+_sXBNt}*}aoVr|&Utq_AKWVSiwSjNC`l1f0gK2zB<*MtTkDJ2R zQnWA1r~b;?GG!a1Y>z+f=Jo!pMfJpcavRnDY#i`ykoY|D%k9tnaA5I%mAP^1vdsr* zYibX!f9YS`Mp_3tXb)oWAOG}Z z;LbL4G~Tz6Z5m`7=4^rHp=O(K9;*5vJxw245xDtElKj0K&K#>aL%bqcv=hcQ=s9Q7 z+!o)b|FwJCJKm`@;#~hbu$Z;82v-J|H}{M)E`QyT(-{nT(#N~~CCyLktleP;?Pe>MjZx|sz2Lv_lkoRDTcml8tc%oE`xoEFCc4f?-c0?a zDSKt+$kM^ra{ppnd+XcmynW5>oDs4vPwPGg_I7Q3z@4{`vrg5!1o_99cX5XaU;D~< z+5A^BvI*59z z5}A7z9!DqZBZw=fPq%lbiuA$gSE|!97rji)2{rDQCEy<~+y$7)l+Dis(rs{2cNpaB zLGTllOa2Ni=lx|>`9+L_4m{^)7Iy~pHRv%8F5fh>sI{lYef5=F0L=}y0(W$kyTeU@`A@sBFde6PC-S_rPAo zJqIfr`s+T!8p<=nytKx({eu-ee-A%O=4YPy(IEfK8OG)eIw$gv7rnzUe33e%9V27P z-4CVhExrrAk~2TIRKdD{v-G>wu9M{B`!v>|RRQ&{d1d7kXROpIy4!oC8nZM8R;68= z@@GimHTv-UMB(vZ^1HHa^|g z7maB9BqPkDBjnLKQa&i2twlVd70*ohmzMfMTCGpnKYgA2mHalmg?@7LN3Y{TR?Fs^JIr%Wnu2W1Ud!|u#~Y3WC# zKkel8#FyuTM_bXQed@`Db@;EZGx2cex~hH>{)w53Urhv8unG4`pXJWPBxg?S;mIcd^0qfpEs(lv*)NYMO%9mwdw7$3w5TtSD9&#%j=b5 ze@Le3H}NI)nQCw9KUI%A*{G%LxnS@l6*TEYfbq>J=GLHd8{TlGu7&AREE8aMfWb?((1;Ex!?^sblA9yIUt^Sh2%TD@`Z10>h7TNpH=(n{7+6!MI z&m5IHPF1+~KPPEJ!BdaS*G!Sm%&%LWXdEi7li!h#j%&=rp6OXTKU4YF5nqP>+N+X2 zTKChpTUoR=t|CtQrQp*XaydN9_Y1}+?fnLobrQPu74&=P81z3fuYI?QkXJVSd)7}X zqwLo(g`bYIjv!tBAp6{eZM-e?&gh!pKD#@q_a_oFlZ_A7aCD-eaiJ8GlWNGNGZJ<2SSDFz#%u^E#DTdIYns{uB9O?Gtf+J+rtM+M01^Kha9piS+lr!@D2W-|AU5 zWnH(?>_gtw{J&Tgj0NbmQ8r<3W+9tr&rD^S z8Zuv6+LLx|M(t&}t>Ba5@$`0%Gog9vg!V{mT`qg@J~w07xz{Cv)P^uxlkZrVIr#9;9(tR^T{UbhjofI!8m(d{GVJ_xB7pz&^Hl0 zX60*L*MIT%(D`oczlRQW3WbLlm^C=-_q7lFs+~pEa2BO^4Dk)>8^6xaT(mt_)?`|D zB`BZdD!=6X&(RO@jgqOu^c~#u9%rv^e&%+ytLprdOK)Lp2vtw;%N<{!&-ws$JhfEKzEhHVs+?s$&0V5og7ai(Zbq-0 zq+`BkAsKw}Qouc*XSfTLOg(n#f41jaXt(Z6d06Y(cUAuXz$V;B3(u7GO&9uD`jOIl zac9b-)H8mA5z~bNNtbjhJ%=}{i z()YgqkN5>^s1m>UF7rk81?m$j@w@kORy)uj~g<~UV} zFI-li#a;+^Wgow+vuXJi>zYN)_o_0EHW=sL9X_VJqH8C5=ab`8mlA2+863H|X5xMG ztSg$56OUXzadgbqj2gEzuS%f1Y_YcUsmp2ZFRI_p2I04Yuvr?J z+-u!v_iZzJuXe=Uo1BGDeg5pDv_Hx1U%ZNKE9aeU6Uf$Fq$2V2m(v}eXJ3_hN!bS0 zxSY+iMoTkiHMzP|iH^E6srzkzj?A*mbMwrVtJbmKTRp>Ed7Qc3>`dcpI>>*Vas$%8 z8hw(1_VET6e+&BZhd5tJBa3ekY46nU?NQ&hCjJIADnCPHmGn{h%Q*vo?Q`9m4lg(Jwhio%nqE!+bhs z7F&{GKI|E!IaeyqhqA25hwoU-S9hpxHNNWXuaM_6pI@q(pluMApMR3JCfx(dtaD%1N31hP7XK6LO!+Ejzg3BcD0~0Z zW!q`J7i6R6FbYG+{x;zsP*&;3+B8yL z&eN>CIwvkIui|`p=Yl7{tMaNHNY=ZNr8ciU9HYTz;@6z|HNRS1^dpbBLhrcUR^!<@k`2CThcO&il zBiJ^WdSt%5Lv4e0PM@}R@^RiVzjxty!mX3gm+{Hpt=DZ^;M4=f9*}+MmR?p11G5aL%ZGh(D#D`fu3bPVR$YlSgg6 zg`ITXolJd^`9%Lkd<8!zT;%7O-_>_ayq%v|;$9d1%fLnMl^nG5S7g%x-m5*fQ^@k? zx@)2N3N)G@+5HywaHS7-A!#r7nO`a|wHK|$r9;90-8(?DzY~6+lKd00XG-rZJ+Z|8 z7463HVw0kFc2VKJ}Fo2iZeoALXI(`8AKwRs!7> z*8J{^^kw;rU0UnOcIZ%O_j=!kblN@p2_^0Ri#89a%%=&|KM%@6_u?&7n1Z)1ffF^W7Epdo&Id_CoA_+Qu~Tid&wK z;z!I0>`spA@OK!0(&5;_JibcpS$hfc!FS0AJ7k;Siff<2mDk`Owr>Ql#wQz7=*y&= z;)R#Lm#Y3I9CH}ESA56q0L&*4+(5(J2hIVN!1+YsTk-lXo8IHvL!XvAMEy&bJbl49 z`#ZDv>7@F!BYcBZ^~U=(Y3=Dgym$<~^gU6#OJ#Rz{5REz)A?*?`O8DJBjJ~R!;2jyQ{Bd8vBvPKw9ah?ls7e@Do zmUaRSfbLW28#+l~dEB4Xc$#0_hwkHHeaOCJvR`Ol#ml}!N~fL}hZn~?XglzYfk*SQ zLr|43;t{QQwt{u;C)zx?FQm;C(TYa2x(Daw>nu+^Kj^OMZg}GEn(iu+FB-|u6v^Km z%HIXn8ISbeRKz1%@zjG~?Y&g(J$n6hH&y!k`>B$z`LMUCXeD3msWzmwJ45KAu}||! zPb(TntGSHLH}4J7)C2ys7TU5#-C-JB+@-lJex`Mi?L{*-ebD-Id{y%3UuctwJwYr8Kt!5L= zH6K~(2so<_<%VJWT1v8{Q|+lJ4j4 zKJVI9^8T4HZ}ZoZyuDxgyfsFue<{t|c*DH49;hrScl9cHkA->5r%Uba{oLoRHJ$pk z<-BKHxkZCw0{aIukJ%cr5_<6z(|m|= z$&W>%x9^Tq->a=znMX(J^Q|h^ggaC5zM;Ou+QiJ~m+B|zugSL#aCSdu`r&UjrgH9K z&ziGf&jsGu&|d%Y*!vOoahNA8jF!ZIh2I&4uYwkFI{5yEn4qnM8WJB`@ z%8&wlohx6RHU6M{zZ}#4RA0*1`@><)1;V!F{o!ZfQyu5i+V6PZLK$|^*{9lSg0qC; zd%S7rl4-sfk`Ya~*YUv9;ado(UFz2~f{aER}R_&|N-WT-E zsp5JnC!V&rkR-kqKauP@bSm6IA6dME$-U0Z)K9-znoA>J^Vxdz`Hyv z^7$_D@`r3mJRQ--Jo?LC3GORuZSjcgbi3ZuWe!vHUXkV@ec>M2JLqRWrFH^6b2GO` z@__b8wq4XYMDZTUDRfsJYQL_%ywCRe{weKcM_BLNeOc~H{hUF5HbmRc<70h*>zfPh z#r2tm_M&urgo8x&G#{B^xuyGYkBC_=0ta5n+%nw-|W}wmd^psKQz6hwawZI))eE2qJ|6$nPCDL~!be?W|-2J@MZ+j*#tqeNxvA#N}eSX*O3o`T_7|v&? z?|+(%cNOWOd&-jG$6f9fRo%?DE|ZhJ_Wh-6_HHKMS!Lf<`^M^vRQK4IdD0Q;O><9o zFIW0$e?)sA+8@$*pfjJfUx$wGW@_&Ew&m|;KJgttmn__A?&mBqsM=4S3C_-ck-H)K zCg8W}z!h_Zj_uCiR;r z-p^$H#a+2C>AdIvg!Ur)Ojq>(cD+oU?*%#l{ro=XPS%%po-@gQQ-*W-S>CC=X?kf4 z-^r(+T%etkpVpdFOXGptbIpM@7u*D-0nN>ZfIOh}Bk8vO(|76m#_2nO4nX}u7RUe% zKs`_gXgqg)hU&xKzqEHn6xKSVPi;Sg&!o`>eb)H%q6yB6)`sUre3KJDfJbEwWC|hxU74*l7UtW*SI6XR)cc6a9t@mx79j-?eFBu(5?{MqU z;ya+a|EW5SyJMP#C+==(hI0D#mS`lup-6tV!>#AE7S!D`$*(Ws5v_PMcW4M{?ft}% zHg3P-&|2*+h4m|0tk0_OshvgZGtGfy1O5+9^H^&ZQ*w0wp%Y=R#wznk+%%s;g6 z3Ne1(zj%VabyfP%*2icUnyadvDKFcTC9L}>liXR?oi+6{@`noDqvtL{={hp z_GERBe&Tc7qaRkEeDEuIe~*56ac$n;qyG?nBl;EHpSL|(d`$P}x2jx>OU$3D(!}-U zzqI1p)ZCw3_1n}Nqz67xrf*YE6!wOTzfHZiBh(}FA-?k`J)o!U6Fx{et`vW(n(zGY zkpJsj)uN%_c)lT}y6RY%e0ct1S^D$yn)d|k-@pFNzia1PubG)&d=q^RXFbkG=z|*O zG%xL2NYFOQ1Nr!%>-%&Tm63hjn5+5X)(L2N*HQNJbJz-fFKeO)y6`=%%(E8{AYXUJ z66lo1M&(xL!xuO5Y;&Bv=6|19{5QPAC10?0z20xMbv<|btj~Xhx-{R@dj6p3!1u}~ z8n-_NO&Q~{`sANnUQ^qc$@g?0SYSPWMS17YS>uR5Z+pPb+xYGf{Q72cKsoiDy>D6n z+Tr$`^A9etPRCD&m(SZ?L|5*bai5F+4_}vWx2N@ubZn6-tcTX)=k@cnHT?Ew;_08T zm3tScj6Kd|W6ng(q^C)5&QS7x^Xwex$ef5tC<2cGiv z+W+WZTogTL*wV%Jf|xsrr;K^lgX}RUrkG=xzYHuspmN}&`u{yXpm64+3%Ylqakbp+ z8s7J5WbZlO$=quLbH~pj+kOA2Z_eAcZ$WL#`)smbw#`8oo-y+cw_fBYX-A17pVc>Y z-sWwamu-jbn*i*caSxn17VU*Sn~OM87~`IU66EQ)`Ec<&d!ZvH?%{0epR zo7hTq175Zz@0Tsx@*6R>oW+*r_ZjE+Wmbpwo_F|uG5>cDGSpsqf9wyJ_v+TyT@LrC z-227s*V*|CZ9(rBC)tBDf6h36rcE<9f0{O1xZAMo%N?b@?E47k%jNj;Ti~zY4By*Z zce2azW%Xm`%h+4%RQa>DRqFH}^d0l%3){6T--vu>N3HI1Q%A0RBa1cPSN}3-Yr*pM zhcBDH_$)m5VE1zQ#B-Cqr}+W9lX~-d$~FHZ)VFId)(@rsE$zwH3$z!zC%*9pb7zIC zu-C`?76(`Cd(tmy?p3L_I-_%H>WFo3W$H=BmHvzGK!?kcN!pUb7Z<@h zS(qKbF#64Yt#;DZ7x-2~%J!Ymfq4E;L!Axi|6b6X4H*~bw=vHgr>!ss_;))p^j+oL zQTc~AC9qTe;{I^%{ncO9w?l7T{uWXqm|6VlukyX=DV=w`*3OFXy^UqWGoM`AP!TXD zZ@ah|e#Q-p>o0e4%&`yB1}yIJG8gww;=UTtCeZoc(M~kKyqh?_S-AN3w0+5ZE6;D> z`B|PB(;rpb?f8I~^-C2_7J3}42<3k|>EgIceDJFYTLW@t;N&CYAnW)Qy0H#9$U8t5 z_kV@DX?%SvyxdJ#=Ec7c)#Jmn&|WD~|8JolJ8SKs`mMlkSc@#Mr_VUYH#x#I`I626 zNi&=J_e5kD$z%_SeM`RKpITYBze>E{gVa7r9d=fmf2I9Q{O^kLrk-tIT=M@&x_9Vo z*V!LGtJ3^d^`tmg$Gp$f@g(KnZ@Sl_tJYJM9kR)b#HI9o$&KkropCZB8h7tv$w#EO z#+^+alpPsbPwAa4?>oN&AA2R-Yk&rsDyyvv;9Ef(+Jkjx)yLKUXP#e5PBCUq!b|@$ zRW`j;4v*HamF&k+PQrfO%r^>(*3D&=z*0*YggIao9m~gc0Hs zx7S==!(7MuYWhf9_v%gqyz&9&u-}wVFgBX~%Jca3*U6W4xYlgN>u|q@)4gE#Zt?R= zFZMgXb$a)9NO$=#&k3DbOTVv5kI4h9(?{)GxNcJM=gt1pq}9x6KD>3IR`jzf6W<)h zru66E-J2-bXI;cTjE6<`QF-+3R`pG_=KEudx7s|_m34#4xV{#9^y}Wn!R37b^C8~N zg;z3e3T?8t*d|YrS7?*FmiHze|4yk*^es)<;*5PSfbS^>D{YbtZNmJyD#1G;zsOw- z?)b;{H@+<~WLdg=thhh&>Dn_KBfp!2PnqrSMfQ2d@Mio|V?YCAz^AoG$oTc2G`8cD z=fL&S5kF9Uo#pw(H9>Hej%*)r0Ed~w*(QLKjEjsF!4ROI{r?|~k@^PK?t{n}$7egZ zuZQ3Hv-45v4?DPbLOa6ukHL1{OPam+$#a<+@%SkFhm1VfM=H+|(saF(cb0VWi%q9J*|{a>>I>R)FP1I)ABI=^ zfpM~bLVXW*#%xtHH}U=_?Z*Ef6$$L3eQ)Wg^gR8Y--qz~;kL&-j*n6o+7}mX9^5zK z_8~Nn^E{%JZd<_G`w?vp+!4~Y7txAFw015Y%GW-Tc-q0)kY`g7&x&*LkaiQeA*8iA z9D5Ry>(9TeKM&=r?~{D>m31M{s^{V%t@b_je`Cr%8l!z#HLtUJ2-GL&yS5sWoL?mk z^WGw9j^@bnccGZmtoSaJ>IQeNdeQb{oZqONo6__=o)3VjUY)*yR6%z4PqpE+rNLpuFC_I!31>6FONEPj+RLcA&R)ZYF3!nNanv3|^b zE1~#)>lMw7S?}8#gKrpp2Yz4Pm)59ncIBmQEpR`?&Y!ZGmHz#s^gnZNUEROmNBS|+ zv3acj|B&^y&c>5PdHze-n09J5rmK2hc47`gc?TE&gZgULHpf}poWusQ`}PvMe;GaH zv-ZuPA5ibr)O#g$@M`K^^B7<6`ah+7z28Ir$)b9Hq{vQV6@|LdKDGKCjd`jkoduTG z(RWzWY`SChI{GVHcey&KERy{%Q3ssoSb4RkR~@{aIwTgdB)nJ4&G zn#PEqov(UmigO+}KAD{G4hwa;>4hBHkekke(@N1j6z?h5EppA;4IEG1MCNO zL3;$A<2b?$kO5|y=f23?_L?TR{OsFbjZMwjme#iR&7ED{xt`u2xZ~q@d_3ss?a4GX zb~m+VTY7Vix$c(s)}GeQjqTaa-fU-cV^6N7x23sfb8}ZqF9LcyvyH9onfBJUuFl5B zOk;E7=4`gNr)_gfQ%_S%V_S1`TU&dkyDO9HYR~kvHgiO|u=BDQM z#tb<$HnsJ%b@jHlHnntSd$XH6TY8&&n%a7^xz6^kT+8O}Y+J51*V)8JDbvEZ(yINXR#wL{SL6ervJ?$-RJ)N6dIy22J zjTo{Et2L8fdwY(0>FjK2ZEfzt5RJL6&FG(N>dtnz^k$nHdwVEkwmp++>}qT3Y0tKI zHn(?o_B3|4w)D2O_q4Qjc2UzkjZL}c?o9LMuJ+DM6Z!YFY;Nw&bai#*5Z&9@)7{(J z*49WB_O@rTR77`UXLF{dyR(;C@9J%A&a}5-jn?kg##~Peo{_;NI-9cDw$7Huo*v5>4uMdV)u`IWa7hjy(=9wwY1`J&CRVD%GlC`W=&04CEJ#5%TRBd zJ2z*8*4D=6-lo>ZR;s5t*PCr`@7dg)%eHrSH#RqQw{>PZyEiv?w^2fsGPAjnXIn&&o!%@3ivrQ|MYf3ll{O~8ea?Pzhji}Jm z+0xR~*wUKWoNH=tq?+4%a+xMG&gRzcW|~W;w-wKB%x%u1S{IJl)!CWNZEkLA$u(tj zt)0!?_*rA7w=vV1+1%TiY47Z6Z(EUZbGqTdy%Rt7k&o?^RWg}oO4Zqu%i+rH+1~C< zTduu#b5D0`PjgpquBE#<*VWlZdu(lPZSHKOv2DgUJ)PZ6xm z=AI0d)RXDzX=~fu+m!2VZCsIcHr?>yk5Xorb#Ya-q#Hi|;g3x0elY!^51L*-@xX_7 zKe#jfz@GFSJF9}>kD~H}AKXLCgAYIav4=OMAAWGpCm#N2`hy?a`C$4z={qv*que2U z;Nu^EaA)9HgWwzVJr4lfTd@9XC;gMw+Uvgl$8TTrXZbYUQb1Hd7Z%WM1@zGY`x^mg zRRL#C0sEZ+d;S6UW`a9_y8z~80sF*33-E5>JwP|`KHwhUM}a|r`El?7@F4IZ;HQ9( z01pA50UiY&2c7_)1)c-G1bhYfMc`L}Ujx1Y{BOW-1HT9S0q|$Qw}C}q3HUDXJ>dTa z{vRMg!PWw=0eH7H;G+=1ZNM9VJAh_@@5BY0f%gFK2l|2gfct?5fDZv513m$8=Qa2Y z@HyZ~;3?n>z*m4@0KNu%9rzExZvejy{72xAfjH);4gvy3~2In8TcOXx4_>6iE{h`*Z{l{xC?k2&;qmp?*`rjybl-#wgdM8 zKL&gRcnJ77@G0O4;Aes7fG-2T1pEr{YrwAqe*pXu@Tb6E0^bI-(D}kYx*t_)Kj!WM zduT#iEjT392PCm+ewu*&#HBzQs0Y}u>)zm#_myRY_Eypp^IT;r^VZjk0q7x`;j$WcXd>>z2# zsPaNC^ATn27$TXg&JH^UA;&OE$bQ8tW{E*XAvsLEvxuu5z*&SmVSmJ{L|9aj$Bk!5 zvHBI~>!|vLoa;sktt3@QGFbogXQpQeNt}BkU_UQW)w>0tBtl~2;v;|U=c)8i1B6x5 zKydZ)7S)O;j4yA!lPGk~f{~IC8>B6%U&v9#YUeT?5OP!z+esIfbRQx6`QrJip?IZ9 zdx==Z3HFn87=TO2QN{Xc+EEE9182HXLgUL%1nlQkO7fHj%7VSzbAg0Wrl)6Rj+iov`B=_BzJ&3lQ0VVT`b9f`@>3mq?S60noDp zR??DgKd+saD4P`I3`(4n)9>YoB4l1Jo1Rku_7OVIh?)pSFM!fX3yMHLpPj<0K5Q*C zX~7{OqRh7R4utqNlW2q*mJ_xR8q>rf7!rCJP;K;2`wZQagy~nDr;3SrgwC4iZ9{PD zO-njB&mPm)rC}HY%7gU@Q%pLz2V(W}xugkS2g05evJ-%NQs{zX45k&}|MMi{{524* zOu;Q6z3fR)NZOH2Fs*jX^_I_;AbI19jX6_ms3#-c!<)kI!s$but6Gk}pOFz4dY zz<$0QyYyu0ZC6>HwYEzQ**g(zFIX$my&YQSwF=s43_~WKKR$<3gkJ#ATgYV=>FrhM z37{-!T&`b*#i5^<=ILJ9?>v<=qc1{OS5DvxiAOBwOi|8J=a)>;y>iZS;X1QtWQHjF z9tGmn*h$KSG3JFt$W6OY*JWkpTB;+pPI-rO=}66-g9IA>eY!@t-t^ATg3g7}!Y^BN zB$Fi3^2+ky)0L45@QIkAR5>Npn@II1_Vd-|b(P-I+2tG=%`0(I`7^@hz=vJ1R9HRH zSxXue)tC#GQjHV62T+#6dyQ;B=&%JNxqFV4U1))K@W3)}WDJ`n>7p09MRc7d<%KdpdGJa4%JAnk>)?47aK1iA=o}E^(7TD=XGt~?iib{zzxMOuF7Wgc zpt=;EGcOx_0rVme*HMVYkqromv^;n?Iqi9{nOHAa{6sQR0%hY`SEPN2CyTA)8#37h z)m9UEArY=Jh3X><)DYSUtUlFng#E>Y@w4hJCeg+{FL5AJGH8Od5$1*J0hhHxlay_h znNf;ll7#x`U#QG+h-;EA2-4RKVyYPW(6ddku*(us#n44ns^LwTogy_a<}AP*N+@Sp z>=<9pZHEZ-^R7})ct3J&;8S1y>=9xnbdqxCDB<++CB!_ z4V1GBHm!gg@rI8Rob&MtyZ}%%O`Px$N3TGoRpxLS)b8UI$hr7&&~6KE7uxG$Lw%M@ z(2mq0K&6ucQviN@8l-&Hn+TtG(KkTKR?)&K6FQOwDOW{r1&>;EWK2dBi zB@G<|owVS{Sy0-^l6Z+`qS^-=jN+#@zleOZwGBjHmB(*GPGQ}lU zyrou}BmTN&*)OEIC2ch&>_*)Fodl0qv+Wn67cmOqYJhg3_OsUoGSze@5mb$Jlvfjbv8tEO>8*eq0Bh?`RXoK1VL!i?xSSZXuA@hM!6=f8eU`_B$ zvT^zuv~)k;1a^})X#ykJDxViDssAkKoTCzY(Zvc~aIr$yU96CFiy15>(It(BYAk#H z97!&RZ9+GIir|w$M}4IBv&e2Y`H}gIgr)$7E+Kh%%w$khX#g(}a#RuLB_-S=8)zpu z58&-WX~b$+ijH6ESPvVa?Y*3|;J|6nSr>Z_bl!r4LYFKUDaJg}uJhVPo?+(|X}{N? zQon}lV-5H7wW_BY07D4vwcs{&$0uA+=!OM{>X4BIR@tH5VpRP?6BZm6+6Tx6{nJMY ziQPT%V83ETWIkM1$SE=;o*9cB67uX(gOV6-^A7eARIXI0&oZWN>!FZ-ZUW>r4Tqvy zE9J0|3Qemmlsz)*%!m15-fEwr!bIE8m+%x%&U}#>!VQvKMnjILFc;8s3J5(F%)f0J zkaNdKZHvLxXunVzh-qNNhExNhsxzuc=1P)(IU_05K*l!x@EX_y3HI|vt<{rhI^yYK zCRMv2+HHgp$38-|Y#B2zIZw1}4l=y`e6~_h+1ii~ma_PhS0QdDAP!e}TMP^tN2H2H zr81$8kfRz^tbRUwg`F(h$8}T@n_d^0WfRd~=5}0>p+Rz0YF85q^&unH_&Z6IX=7}6 znCK(%NiPyTZ%Glgt`VIyjU)B6g=jZ5h$N};I2X-}O6uanh_auznW*aHlT>XTmJ}JQ zB;pu=K%tX>oBp3BGzX9%bOvw<1nlSY)q}b=j3neG^iNBI*kY_lY&f~Jp4w4GbW^*R zxJ2-Qf-GJFbU&ZJ+$am+oIG9LQ0P60)B!h^SOL8BBN*U{xY?#Dd#|j#+SU7NpvNU=AdatMv{kBeQ9O z=C!K~eyVj`M#xb`rfqU(&5>gYxQXa9mK5oEl>1SW9jQ4bNuU%LK4B6DPJ*1Uh-->N zYPe2BArV?9qJUF8GB`EBCF5eN{h-4x$Y1+;^XGWl17L(hAV(GH6hx(htX$kFW)z?? z>;gG4176HZTGH)ToUizOwL3Y3LQc+zmlIdPGmtqy$g8i~2Qa!G067yzJoW+%R{Pt}pCnxoccK(3I3 zX9!+*vHZ24*SVG_$1pZS&@qgOq0b6AM#z4iLF#8ol3j(>%VWHdYI#(Y%zc1!y3*9G zM5y{OhmZ(kWE>}23MngTbS?}F%LG_M$SE3edks)7DWV+w;Z!rfm!Q*Awk@=cE+;7TFH~wI`;D^~3C;sDPjpLD=1Buoc0Fh-5L?-`B*@4y`>Z}` zwUxQjLyO5qQvkIltEk!u7TMt%G1pxzf9>bpw}YoXAZ{Z?gvthCLf1^u$i8EN%BIP6 z#$a>dj0GdZff%YCl@Q|j7a0SUV-|2dh(c;wbQ9`z)Ua&?8zOMQKg<)j3P2a}xSF0o^g@vUa-R~G^+=7wOBUZH=z zZxSk}V#GO=Tc63^eiU@vf_Wjw5HW3mVWc27VnXRD-=QEv&iTjW;;uD~5wf2*f*u@0 z(NR()^8!`TQBq|1kesW4^Gs!`Zqq&0u@~0>#7r1d5V^*YPZONQ2Iav|C#Fvmc+u=K zEOg$2gF@F`EX4NnW!c43SmH2cdDuNn#AyJ#lqT&$m@|K*LGE2nig3v{99P5vvLtl? za{Mu{q$n(W0AR{nsPae+z7n^~FtW7Sk5HGS#%n)slEWk^vzTeNIL^i=Nkk=pwS?-7 zYE-fMdD#j(s-m@0L^)Ay0_gFD+5rs>1Jer410)DJS5bmOm6qjzkaBk%#M{p+Ab)eZ zMLJ2J6(zU?)yn`u?~*E4D4C$iVNzQVz5mC}%%DvZ1<@gbAbDwg)5^D-ZTW z>4-13X4;DOKVZ!lkcZKP&I8Ui3aO+d_yW5G6LXtCt43>TaP7*u>FwzMfw_v1M5?j10x!< zF6eU;1;Xs-RrPjpL%<|yM*;Vwkh9K+`Y&ZfCv^&>Vp!%1%vvsyUNQ%F9}s(?WsHPL zfHPv{paKyrSm-{lGqI%G&#OGk(@B6ro&t&21|xAxIeR!yAZdeH|H~Y>Bu&Qwp&ASJ z`wWcQ#i0rB4fN##=G>AA)j?BK;Qj20M1;~46U!PZFUu?F@kFhra~0yY`Lpiqr5jO0PO zi9%;m;Ehy{7}QOywurQJRli-jA0u?yY`)_Kkmj*2AxB6VCW0NxbDvpd$3Dz>%q+U& z!m>qoRMVYbvo3vy(A*k1Di=g2*D_)NSaz(E{v05<2Q=w|hd@VM@B-*17kn9X!v!m; zff}oYd;_QhFv$vxTKo>72_LV(ITwE(q}N!RUWnTp#4=oWF@uw?5*#VNXkT zp70fOc9&u#FK(DPOkQ(Vjv-h2!U#4?v~q~?2Q?EVNupZDo>ioKI{c<#nb00eGxL2=d`u zMSb2=BHz=+WOW*ObCy-4lYfcmS|>f)7GEauT0CD3JbjKY+Dz+6NCULQ(wfn=8#SZY z(&R}Piszdpdd`yaLNZ9)nLJ(R7=ZL>X;LJl0cHc5hh|)`R6#{|04vW-6q7TCfgzCc zU<$k%uUyG<(B8`;UDa;*_n3@+A$9yr=W0)Y)txF_D*Gg9rvPj!bQ*xHMtIJmBi*c$ z&RWudP$*afvi*F=bU|rGHkf0K*=obhP#XBz9(2xvk?QxE zSq0TVa{-90El-&YK0Oyqds6pQs)okK8vq7L38xt+X$C?KfTD%xT(rhJjbSkjWekdO zfdBRE8NL*YRou_pO6e0oT(9eSWBj6!6fwvPNULWgkMEnVl6oDWj}Q_e(}q&5rieab zNdregX&d1qIh`iyJP^Bgei)u}z-n`wqomE6+yNnx#x(9DSoH;9RVk#+nB^nRsxtKf zlvHRZ@XxSBcM=DRCB|QT+G1G`3i+%DBdwOi;*HXi*2PCA3I!_L9j)Ox#wA3B5tSt5 zWJLzeYLYsD)eNe1nKB&b2#o^RP)IWto6{+9!o?p!=VNYY5;_6Id!D+9TF1j*`}sy7 z*$05tlo} EfocX>q}l@+q?3=QJV0em;W?(OFCCZwHM6u@gBlg*pmt1=t1=>a(DE zk~5DsdlZsx&=ge6j}zmoJU^|_DM!O!`+2SO&;U>@A(z{BAqgf{Ld8$8ASSY%0zvV$ zF(+oYAZDPTroEr-Bn}iLMjUQ868E}%_kkuYm>1e_!G57b7POOCRYFYNNQ_I0Op7N- znl!F$LZVvb!YC=lOFlYEvig9KWYQNy-o9nQ5(p&&CzSSAtQECSch0t7IL>_ z@7o2#VSqKTkocJo2)*QDH71N(r?_2cw*~Lp1KJBPqERhCPg{vbrQlUlWmKx1FyW)hr`;ruO88W@@)9E!v4;}`4psXU0y(T_DR~0pX3G3NkSt^I6xDvd{#5pzlmthZ zS?g_R4$YyE>Apsg-gDnrquz{H<;2dtRGV%Y~!oIHKWkehD`NmH0>eRr#Hsi2n;&_Pgv#1t@7Oo@*D;do3wn$|c=TSkkc2NdWECN!ic08SRK3GqSu;NLF7;rXAsH zMiyBG)ZqkuKzut;Y8p`9!VLf&ajAR>m;_>*OP&O+kz=M9;?X*m%wt;8eo_v^Giv>M zER9`{sQBu}e7C{G!;!{zDR&?w3qK>QrKK=Y#c*mg4%)foaK<;3fcq2 z?pf|4VXx5*>;ughUCbT4GbEfdy1bAI7IUU?iGsKZSYAkzu$Tc?ld)3({@EaW)yRg0 zG*M7=l0Im+^+TU-5LUm$yyHA*K8zODLXK!5O(euw)GaiWT5&Jk$9~t72)$^*$RMK* zX0PeN%?+@0q7<6C%$gbzW5;t0i{pkd4^P3UGN@k_Rv#N zBw5j=IY?E-3%lI5pCkA(Kw;{z)&Vo#4=l_+%d1~1TyR05DHGo`E$j-`SX8h`BhJHe z(z1@sp=9C%CV1csNHrg`(#{awXGz0jAk86T>?ev*OUiqy*m>h=ir!)4S!5k{fuxtr zGI=3K74Z>yRt-S6Ds+JU31g=et)K7d6;>p@s8G&=+k`?6dPDas<|tZ`sMFRE2nspS z$^D8s6v+%xC?umTxt}L%=h1BiMrvRSNjm{Kr|>1TO4yo%heBaQ<|IUYhNSDp6}f9C zfs+8^uZH*2Mzu}DfXgOg+5*Gi5%?TcO$8{;et693X?71Eh%L2}w40s*=+_6O5?5q^=pUkl|2VhAJWxS4nj)H&S4T z%(SJ(X=4~JFbo$MB1TNp-Zf=m?9oJf$byk6zo=YNq`|zZq)0G?G^*{@pc)q}wV$4A0D3JUZRAmRd$9arAf_6{P-hHwfInryh|x9?t-5m4 zEQK7Qy(WL&GRb#P3w>4-`SYMlE_jAn@Hv|a=f}}Nnqc{(AXk`(HPls&0g2##{@TyC z+dVufU-`N4QGn)s5_HOf%O75dY4oMcbH)+L-pf@UlJCg!gzV>4Im?p@K?^U`Mx=#{ zs?MwvDT|U`0+f&NH2}j@YpH7-Lqd)@qGTzvBa76Um#aJ^-;qUpUAqN)fz>uql->t0 zt_Y1;(5{4wE5>WRKvpN!kzU;=N-1=*pSS9(NsARKMGgQGDty=}b^%p+#yxfh0g#yc_z zQnyVbodrolf)b-Z=gHEQEz&ni8~C8DLzS6Qx8yMLh2b}j-N%925?{@M-^$}q!f>tj%rk~`uW;dI0fL)LXIjjo2Xq* zicBb_=T#uySi4D?0Akvj#;uw7qzgoAScqv18X@wS#bu|^Q8QAc0xF4Ca*W6CB6^P{ z<&kDTZw@7?YbNJIASXLQrKBT96{*}wqNgk=;#SH?Hb%CP=A8`8iq+3+ps>u1#e~|e z(Tr#-ZO9lR1r@_4W3aa%oY+`z*kXDO3Q0xQla<0}U9?b++!U>S#>1BLpwLl3$LxdC z(!+WDppaA&y>!se7ov`^la-mSfo7AVOK$;71Saq$it7wj9LL@`t#+Dm?DfJDv4TDN zF(R=~(x0+2-#1+izhv1m{SpD~dLp12Ibk!dCn(WHVvTi_xG{?#+69_&L4@1SmvswI zr-7K=0y)mOC2czfI_ZM^wVxNDHgXi8#!rA8Rm8DGwGUW%G@zJCfG&0lYMha^mXfG-S1A%I&@?S!5AuKcB~oJe>zHt&mI@w~e8+4*btg z?&Ox|ik?ZfpBH;UPo&50IC^1Jh?f&nHwCJZ0#&4O{Zpx4DaY&RoJ8rkVRMLhslkd; z<(|ZQV{Y&isO~FJMS2iXjhU>xki=s1YH?^7R#;f09MvME3RJY5ePST(wuSSg|tMDDZLiZH-Pw&MyX+ES*q^^l3oTV zijZW)h*u|}&d!Nf=mZc`eBCiT8hVM~P_+n#M5~{#F@| zq+JD^t0*L526NBj5@ZeMclT|NPn}5@@D`f3gv*<%Y%I+$OC>*9ZW(a59I`otMdfx z=RM>APhlz-KEuRiN1qB)SwBW^_8uv)UW&5L6j-BIm5&z^qqnPP3yG``vBU$mY^Nf?Xg+efro zc5D^yC*eRmpW1(#*6s|W=C8INZzfNx#^EXBIisBT}Xs6GR_gLVT+`l3`-LL3_=>IUV*_{(r8E*+pN6kezANunl&Q+| zna5S6Pm4FN*G!8dPZ_sBD$q4fd$rXq=`nhX+a*QxR&)&#UAemNLk0UjttSN zx0sw&t1c;$vnGT|=5};tOqaG2+Ozz0olu%to=YpO2G2=jsas~W2hV2@rEEvY@TjRd zFcap@NZ>OjDDE1YVn!A*y3;#nyd!5oFI#Z%8c0Q86H;ROT(C6X(?shA@M=StCb%yc zYsBGXgDjx>7T#jo4dg&uT~K!b4*_u=Ar7U-)Qh-XQlwrKy$^`@h%r)j0mu|m)-fKT z+4(g;LO&Mr3>NW3tdfT5xDo1qtMkHLb-zfw%3&*G3D?ihZQBW}OTZY>lU|>=T9y0s zI7fXoX|b6Oq0LUyDCXloyGb|<#7!2C5Py6%##s{1ufnK!S=kJ#XrbaxauMtn|pZ~`t(?-3} znC9y9e`TsVilFkSmb|dI8p}e{0nmnWAbC6OPN>ht3Jtkfp)nU*T1bg;Ns&Ej?FBfo z_X&xrBKVoO@AOM(3P1rNw^2LVz;f=e4J@M~(9c(z!gMiGUPuhuC-xi)i$uR-mRg>f zjtaRv?(-b09C+0j!=O-@N6K@Mhjg`{&qJ-l3Em+xw-*rphiE&ApnL~FQx@E@g=uV` zty1!PnS31ptQ8z4pvkj6D6rLLBl#iFP8ZZ1MZ0N6a*Tk+X?sv$%8Zs5a`ubdr#gzF zrvP;x!e;;`ITt|l7919O$%2vou9Vr4MK)!Qdsx8DVo3Dt!Ulv_7g^7d4S?e%_dRuN%I;7 zF0eO1hpH`t{dgcjd6=9lrkkCGVGf`#O2SZMypg?i9RS=gs)6cds>qltstdr%Q$fYd z8}Fd@s-2iYFJ>ieY1zC)nXDjZSmKI%fsy_w7<0sM=?3yfwt3T^^P* zyclwn(COu;Qt9oaYy~(C5#b3JETtMEdcP$NYCFnNMOvb$b^l(V#WMChJYqqTGlA|(=of-^BNZSITu@+%LLJr zmK5ok4iGKQxZzhYiuR6JivWvZK5e}o%11~ z9U$o06&wD17rPf?_fFc#WDZRaT67 zW)ls5YKXB0@|4a9o;2PhqCEy+5^c@YBA3ooJZ}9TsnEhs&B%pNBbu?#B<6f`3|UHE zZHhQfntR{)144U&SUXLUAUSciktt+XaLAuXp;?F+r)6#1z&*g zyzxe+N#Y$f-T@)aN*Hg2Bu4AsfoVyS2=`PFwp}u%lS_~&{d}`k*v*pd1sRn?vsPaa zg+-#DXOa3^H83l9czO9im7XGQ&Q!}^0%`t3M_r4=27sVYp9M!QfpipOGm8`*b^~A! z9R%FiH!@0a9zb@QE^?Fgp!qyVM-9Y|(=8mLXvV03icP#Py=kcOt0fXY54vQ*ywJ-o z)(TfrKG}iBaz5~eu!mC0AtKxi@IIeq%pzeNL#Wu;vRdLqs<5vZg-a!$gC`9wuic2n zSz%NhDnrc6I9s6VFosBvB>y^UNrT5g$6fFw=$s3dW-bPolrK%vQKC38rqF4iBKTC? zdd=4`^{)DLv%iSEagsCv(M&;j5@2vS06OG?he0ZS++1Qe@k%F;Qbon>k|GUU(Px49 z&9)g*P5{UhQr0n@wxTu9;4Y4QQH~gMEyq)te~L~6tUZhp5R*NW>b^Uqq?$clOpQ-M zrNcB7Jq|kMf~B(d5v`N780~!0Y6Fi?e+AZE8SW;xZktEvXaG#I_tg`DcPSO}H&gyA5fj$1A)X+L+ z6eS&ir;F(eW}un_V)WI8ni~K;O?2(&6IZJ%pZF}3CSVvP%f*(OPZGCUQlz$OiFP?`7m|RA;9tk}ITEVj3hN4OvJq(8 z2|6ivUa+l}{cmmL#}s!94BDGvsuOdLzBNq6zR|lm8V1BlV)QP^cp))*;bV6pF}l@# zh{Ree!mx^P4PeFb0=!jTWY$9Ej3-l7A?RF41=1$IWdD0Gwxzb)zu1GqOB|{)U1C<;lX*pQll1h}+3nM5|Ie?%S6k`hQ0=ULFGDc8~c~(FLF@qALu8r7I zQ)s}}_(U1&rt{D!AA3;APx*&eU`rOWC8vwnqMkQLZf8urffvGzDUY(<4-oX+F{OM7 zhO5Rq@-nE-x}3o@$c?Xq5;J6CBBeYIRf;65Nfqh^|8SJM*~dykw$yYH zTeMnd$?c@6H=yB58B-pgEkSXgvwpJwLYRL{fzQM1I@XbSg4HHwupnkoVrEQCq`+CC zm2AaQ`LyJ;2MswBd5nF1yh%Gf;#1<{^7Bc7n@Z%gv8B-q5Pf*-_0Kw5P|Cj>r zgwG8hBl?P*Zb{&=1u=sXQ)gl#1=e_@Lw!wrKyG-AT(s4NUR`ov;ZW+)5}@Sx`FNg` zF=MpvfFH16WTeu@K?8$ZybPrb0gR5NnV*O8k`phKGOEa{AR0nX0jo{F#!1s&d(6Jr zzL2$e8kJa|xZ~yx73DXlUjK%h*C&Qw&mfcy%5T1B!@JhKyP~WXA4w$c*+6k_5ANB} z#>sibTM3YVJyh>qw~m;#3a(rCULC6^Azrsmyg_hN1MzjY1VI%Lth>eds&56A-wXxh zuXzXgzjjSW?Q>nXH6rxpilD4kfm_~@a5Q(`mWD1>fh4gg=k*Z1UPP~bW1?|`_(#`m zUpE5ThQ~jf2oyz6R}iq}wja7J2wqoV+25KCnO|Q4C9@h>OiB>kb`b8e+NZiG^u_}F zJsW<=ba;cz;&rIofPPj^vVG%gNHK%0)2;7+Ra7Wn2nh*-H%aq?khF9uJl>uS>RwZL zd~;QpUl6>dRAR-QR;K!8c@;9u9muOS0rvRTs?Zj9%1*hcZ6uM6=I8 zHJL4{Wz)X}{a+*fTUA~K+F}dBBtY&|Fvw<#VFiCzK?mvl?sevcoLdzXxo3lOoA+#> z7Pe4#?=4Of*AFdQ)qJmG9lCbD(M)b0X}WeP%Yp{oF^V#{J0Eo%3Qr=XlyqW5*Q zsyk8QeWHA(t5$Sdl~~WMEJ;>p9ih28B=Fw|ST^H4XzwlYx!2sB7*RH_ zw=8Ovg%)SGCHl+u@;6`hDV{cdpXkIVR5OXxEt)=mVhw*&w_8x9dcy_(&vj zzLh_(1Im8CPN=$U?v3lgl2P_M!5d`|F_!&q@{QsZXW5y`;9r4*YGrr-$8f2{VKKbv zxA|lF9#+0@y3C{HeOMyWZ-Km@_{4Mecn^=J&d*8cYh{lU1crdb^!l3efHN zA5+&o-%<8d@GiQ5L}fx=;QaD9fyDiFa`uBn-lf1SfffR{{sn(smrz%Xp z#BGU+u(lc!R+uvEvRs(0kW`9HK5R|J`LJsz>P%ej8PVKd$3Dk;t<~;Qpr1esf#5EY zT`-DcDq(vtYZcD#=EwtLN zPi(R0x4Bw;mkHlw_4dOFE2s4y?@Lf?!`58i43ic0Jp`7Ex}x5SnyYiP(`ZnrH?>#m zV#Wz1?%(%riu*x?Jx<`(=LtNkz+V#hvH~|z>R%xcy!|dJBJrTEwn z_^OI)|L>EXeaHz($bk@|f=z2GF;yNmDk^QUMTHO*6_qO7fPfMW1e2hss2CoCr7D(I zdW&yuQPHYJi-?LAm8-O+YFn(dMMb4mt3_1mtN-tB&EDtilLV{x-~0LB|Askd&1=n? znKf(HS~L5^*F4%bns7rXCqZJodYrh~t%t8t&Pcx5tq0jnuL)h4znQqCJMr(K10V$o zObXm)QlO@crSVlQkDnO2ny&*}Pj7YcWD12q`9HQ9tNA8z+cCrVeb`qv{b5{JexFry zD~u~^rlBDjXS)2a+6wz~LaVk`d#r~<(P~eu(n=ef*=;LGr`h;!dorj^rhB#8(}$63 z67z0kk-wzidfVY^C8ES=O{)B)A$3A`j4j@&(4Sen+aeSl_FAvMB;qV#*pNu22hp%e z#sUD7j9b8xk&JWbu1O4SGm?zy`^h$$aRq=i+X$tZW~GQ(-#Us%*RDiL;u)h{tsdl> zJcqV3O|GPq*5rn;Nrp}hhQjzt%4S-d9gSqC)@o%~ql&o+*qkU%%dR`0#Pps3^97s$ zums@Xyd@Ray6>vn`1WeGRtuO$lQ3Hnz0*r6YU_0kfYxiRM9T!tw5VjcmL!h1#k!RO zTBGGX85XVDkQu}kl`8vUIHehOxSN~~>~Jh~9Xr?-`8M@(M6Ky$m2}>Kc>onNX?F{N z%C+%1Iu9MJVl}C9$?lOj!BQi=-~#gM5TasVm6g)vw%`*O42NxPmFfm@;O0>Hb6XV|!idRgk zRQ&=Jw(4Io!BX`X;wD^P2_#&qdO)`cm{)8os5ywZE!)=v?UFU)iQ6)N-|)GOFF#o; zzTZOg#{2ICQpsXGcvy+!L1VqG;OVRfjHO71^(vxS>&$vuro+H6Ls-0Iq)qg()v^HU zGDx(l=v^m;*sJ{lZAn283n%iDL0Spb1h(v2zS4gN&oGOhT+i2`o~SEdN$O+(w?*Fq z5Y4Np)D>TV>S*JhX*1szPHH7NZboFhB*wqVP$%BXA4zJ}NM_1rqOW{hIDI;f%Pr6O@I4~~}PD6=*k)^(0?*1+GYVylCVaUJY+mx97b!@Y#Wc*&ad#b7e|@)H1)FPi{D z`H~;Xmr}_WTY2@=)T&&PPd|MAng|oc*YT)C&#T$L*m?@L*uS_f+m@2c7+_oJUlT{- zb{g=eD*QEZ9PmIpDtIeVC)ifO8-{4$2P*S7r^h6;=H9eT%&m@sJg>WIbl1AH@fqx^ zOhvbm>LAv-MQng<;w!pk_xXx$w$JxbnZ3H1zGefxXE!a!fu_@i>85iy*c-fuD!iU_ zEgaw?rb!Hp!PeRv$!u$HCbL?_TS@6(POEr3XG#O%v^A=Q|k81 zH~MS`cd$43Xw|NZ*RFH5jq(V4!U#!~90#Utw<`4W6PTS!RX2C!YguK_$prCe^GA_4CL zR0t?7V?Y504dSE!7(S|nXICOsei>QwRpxnsB?5K=TnjMhHa@)C`}GNb)T(R$K!;J+ zenDcj_iH{a`htMODX;N`R#Ewm``-Vbe0#NZ42rfpK5^GdA7DI^}`P2%%VubI#C zdRn~@ptgvQO!1SDjB0NW68n5v<(eor7+}!X_z-%joSM~2B8i4@=rdY|&fOUExYD_I zZ;2q%JlhxMz)g~=OUk^8SqxY$q`J7tsj@v1C(Skzy#(YsFZbCOT7SZYQc7_N@#MqJH)%-&7e@-^oU33;(Oxr#2;+(z8Qei(m& zxUHrz{`jFGuex}s^CxvhCCC*2mxGR&a9k^P_ z^OLD`3FD*vH~kLzwgW#6U^{RlS+)b41u;xDE=%r_UO=*@KfMybEQsd-q|TcvHCE+h zIKbu3aM%~XRG~2k$5f#=U_|DnvtPxbnISY+(R+VM_4Q_d92=o&1dvAMER2OJxP%VY zfZgcI18_bc3TDiVd5n({D8<|eTuHWJo)=-hAS5s>DFrxjHK@N&x|Mtcz`C*mbvUEd zZJ}II)Rj|X{;vL7qML-}#b_Qg>r>jc^*`%^eFf}peOkr0UB!NB>E4-ox*pJ>UO)0< z^(tAbGRN?4rbEb$==R^egggLwOw_ zV>sz9fS5mSIHk4n(5uRi0dTuXe~G|ZBLBu@QTm50JuQ)RGk}S}JOD|*@~;C(7JB_( z`U*}9)wnCUcY4ZUOb-ctKI9`^N30vIrUwA@0w^y5_yWM7uZS39>lLc|U{b=i@AYDz z&_ta>(G2hC^w@Z3ol47JsM6wy&`7=zw#Spkuv1o2KtgvB?<;&}{8 z0UR1ukit$EY;&yjDysHD{cyRNE)+4hW`oZGFtmNuktKayst($fDtnz&kcb5RCWGSV zhk5+WG7am>eq_bdp>-;f9lvQ?=_@ zlS|DusQ1{^lsOJ8*{K7=m^9qpQh%p9_4m-;q53;D&(whi;->zF`SXd}TMAS2e#(w5 zC!X16=j7c)wB`Y_%}IB*Qx?5)CYc#eG?_YEvoG;y6+bIarbop|eLcIpuO6xo&JQB* zNIs;gPg(ECW6X-IU6mE@MR~B8H}o`EC72|QytjRfB(e7luzTHS^7*xi+&}v8n4WgU$SZuakBufbQZwV#BB(|@`Zg+Dwr$kheJ?mLvW27g2Tx+4S$K# zhvySFo#bjaBzF=&S=Gb%2I4kkF78acd-5t4B1)PdxMO!`lJ@np=uYB6bu#oHKd9L% zoomUfNOqkaV)Hvvo$c+bbk)nWW}WNp+x(VQgyu}SzfPS$jJTOI<-X9=OdxK(sj&Jr z%ZOVmd-^h9YkKSvYFK+%d8c80$sa_+wZr>4^>zb@68-$3&u9|RoKEBG8`@lr{hmVe zIytjJE~6}i6IXnnr%AU#enY+*Nu|Wo_=8TC2nU^Q={qT8YDG^W9u0<}!tzKC@~NGX zKb%4CgwYI&m{hs}z&mV_2K3#$gfrmZ&D*&*2E6tEU7O8;*Q>y;ydP3{;9Y{>H+a~< zwTh(7Z4PHD|A2K$dde6-JUnp`H&6S28ls7jhUJIIRWZWM*Gb5{?R%-m&>PwtGocLurF ze;^v(h>*9G#$=S+3#p15n&DQKPHG6?;wjaf;*$Z5= z-y&{|bD?Xtk+?N`p+kEmaclM>7hgx*nz`7;UnOo*{1U5QQ^W!`vgX9d*r?GTe~-vm z;mDXkF(YGz3OOTe9UHKR@fQhcHuh$#Q>_=U#Z^C6Jq{I|Zy#b+c!XtJM?vPQF8y`A+Tu zFm2bTiO_c-T zP9Ur~93A*)AbV24^8n8Rl`Q-)BAL!i028y+h3#kSVJca!18Y@iybRX#5s>m50M1>^Oud4* znW^^!n3-x_)~25rFFPXrCo-g-Qp2o=d0z^(>y-eeUB_z3SCf8@3~9gV3-Wf}wH};8cmZV&c)_RnTWmNI15BH`#m3GZ2Ha}nGT=28`f^KL#}fW0o(w5~PM+_Y`a?+Yb1VvjdjY6wRwac?8di}NluJUbmOz9J4w8TGb0<{ zp6(>^A>uZ^J>5y-%fxMbUA*S&U!foBW|`HmxsAAuw~M>+JRp$CVCPnq5Wbv{=o@rA zxB50!O&nbc;LfddPPLKJ&TQ&@Zl!arkFxpk1Ey#H1HxVb(^df``}2Z;fI|Rw0pM!R z&u_5r(o(+7V5~P(T^%r)5aPNqqt#oZb&ngZ31G9)y2p*y?Zj=g?s22_DsdYv7spU5 zn^!>f`|NIq?6%9Y(V8zE;CYuTe!m;bCB$tkf9B!^140qC%AMK{CvH>f;%=;82;^wC zLj^7LB0}Q9Aa5~+&B=$j3G;(4`4pUV*oOKA#L-v&~$Cae2V?aHre)1S~J;pFy8J=vs>vM zW7NgQ*I(zoD}-iKkV>zj_d5JdUjbmpzt4bJ$G_=UNYMdsc{PBY0gnc-GhjOrumMyP zf3$HcxIUv?*GG+KJ&qp4Ipx~w&Y(o4tGhR@sj_U{Ii2h7m8oljS*m-)=@QJN30V=0 zN@AsETk2>O6{q^@4IkU{7e>H#0Pld0B^`>A*NK<`X_CUofHJ|wmf<9K2%EGnPHJ}> z*hghblg|jQ%);>nrn8;&LUbLS=cMle(2-914*)vSNlW_)4|VdxL!D9`>exX^J&5ga zq{C4zb~Y!vCxp8ED!Q5&|1~YRPuxMt{vfr3kx$$~$qB@5!F}QmMrIMW1?S>54->Z~ zY+2jsgq6 z5grA886bNUc-Vg8qC2`J+@-fWy2Aqgf>+vM_y9YsU1{_m}^s+))#2mam~tQs=R^X`=p-|XTy5VvlI@m)voqK@*P zxB492ZSihZe5-Yl_$GHRHxu9GesE-Kx8I$Oug_ny-n%_kK5xm8JG0SmCRQo3#rjb5 z5p5gyzhJc2{C0S_f&9_sFFX?KDOUbT;??qSlu8~||(g6P1hQH>RI?sDb z`G0b_E+PI*EWUyG<{0k!QJ(iF#l!kH691xvbx6xv;(EU+%y*mF&k8mm#d1#xw|88v zTj*tn)v9G(O^}7b($21_FMYG~YHf-Nzb?$3efM9ZPG+@c3LEB_?|ys-%(@S^9L$SF z#@`IHS-P_*muu!uS@{vNt10hVs6&U@YVPH(4tHko&XaISR=(n&Ze zn>_TDeUJ#Vv z{g*QVSn8Ho|Fpj#D=ivEbVo3(0_u4KarH*2 zUkxIs@3Kl|BarT_hNt6ij-vcE=;5p>pYPn)NxcBhc^w?g&$GUb_6agH=Y zX@8DHnHg)tBKUZWfL&o+1PMiTp-`M?%|#u_>W?aMRaim?f)1}W4JW8xlq!;)H%S9f zik&djN<^t@Z(maD!_*6@%_y%A$yjX3I-Bf(G+X5D4lO$RE8wx*D(=-U(Ky2L!d_{3 zoU**ol6AJ}xTpe_*C@gZHbkStxM*P>np{I|u~Zud?^|N@g_61Br@#n_^SV`?Qy=P! z=Q;gx8F8~%&U5;%>NN_GY&6wYTZWSW+1w_+0-{k9)71=D*eH+a6<_d{tLit z>Q(@=smB7CO}zsIW>fD;irLhLW1Vm;21m*05XUzF49Du@LLAou7>=(17>))2hePhP zt-`UqTXA|LRgWMceGh=S)P4XUm)f9<_$Z%2%-m_O0hkvp@A%M*HvD)vOf#bCl*~9m zqQM(F1}TtiSpsOUX}Whck8C0}uf}cz_x>godmpV2IFb`>y*Amso_HXrY>^P$>?-RX zNAH$wQK9XAo{9<@d>cg*C)vH?&~JB=dvVInWlnJyj%^Y{*mQCSdxIZQ?HBCuC9M5| zo$L&-+Ar8C&Oke{`IDX447AgoKf3hiRXK#Mg%IANbXVRR{AWe_$1hX&H~I$Hi*@~t zKIcEIFxEatti8TqBz>#u$3Xu@{I$M77GBk{#LYZfUmz>5>Js9{?kK?)}MU3kt1J*<8)~N-sI_?gdi0YLpPM=1yDN*wQOo_S! zz?7)h0Gtw~1GcR&fLS-?DcvP2x?YEE)d@Rk+vj9=u6C%Mw;h_W!?uYe+8NtyfXo?N z8GGRf5vwycp^05dyM}^N8=c2d6uO&eMe&mXE(nKL>E5JRhVBg!-HGwi z^uqgd-SH!3sICUnZm2f3T#KYuEe%My^^wuaS4K6n9?rpFj(IpYQKHh--5X}e)XX?$ zvo-58HQlaBt*jETq{!{1Q^QoJQY>MI)wM7kWIGY<;=^DL#oNf&slaB7N9u@E{!m~{ zQ`0?LE3_U!5?X)%cS63AvKLV7zQ{0xorkh6 z<#qoFwU1Ie?#BZj5hUzR@~&ij65}rwE1YBqtIlMw%`tV75mfbE;yYjh@>Q+sXT*)L zlZ~*d=ZPC}rx)VZdl`o>wOn`$ECts@gy~Mu@VAoozg<(W0 zNdJ;lcdg}QyVkOuxNftQmz?VEw;bMiNu+y*M-QH0}cnT}z6E;?+ziZa+vA z#_uFdf_c(7&&aa$;DF23?V!pkV}m%v@6mGr;k9UOtg}?|{8TEvH_h6{x(j-2V{HJi zjrAFT%*MJ*6|}LgBvpG@`IP{+bqxoFZCze}-LNx{?o!xe0qMG7m!1HSSrVIsNK4|h z%#x^NX^|Rt4^=nhEQ#%^q$OdO1xga9np@#p6v{3Mozf2%7TvMSBG>JT4#R0O=Gq?k0B+qI#-hl(`8quu5wsH?&`GNQ|wu(!uN#Zk(pF! zb{)ojD$O`KXAAmmX2t+rZ8$n{;!@g)?{nKM9@+L6LhBnx<8A@3N@ig0 zV&oCxrp2#zVk0>*6eBLqp~N<)^*?BGg7{|7)cQ<(qy444L?*t@+eh;i#&PBDn-i@z zDIQc4PU(ofT_D^zwJLSQ?6Fd?uGz=Xh5022bs z05U>gkSa(Be3R6ycHMVUBnbdQNuYO*MyU8NV2pgmAZB;ymj+1RJKaQivpdX6nd6cV zNnf6myv!w!POr#GmIE)b9x?NHPVxqq+%NrdPV!cld~jOVi%dOL5|m zym$JrOtKuS^8O@B3&Z|oI6XhniPKM^Ud%;3!d2Wm-9mb%-jL4quF9=9%hfw1eMh|B z9i0Adyj~UJpo8SNJ-6Oe)$0kJkH_ojicyDpFXh%-=IZU8{y1K5Ugvsy zo{EzwF-E0W>W`iy9Ta(_kar>|iJeh`Xi5ivzF*FowhG-8 z(s-*^#9OTl!tM^rwpto*b!EI&o!@;*tAjvht^VFx&3COPY>=Ocx4JxPRSwaxuley- z-;TGcpLOoKRkMjF2**xr;vY4JHt{dd3T@)A0+w!(B$9 z4ADctMmgt%h~ElD*Amey$u|Y<9V5ClPV}81()i{O{W^)}e@N2T4AJth4p%dd=o}vX zA_X%}+8e(a^h7~QW^GDCN1 zafWVMi_x8Gj?rBUzE4{VW5_q@@v5;^ZJg|ZAnHW+G!l*Mg#a0{7lLL)G~E7@9D#c? z1v6AvM^vj&jOa%xlo{-mpF*^@t+n*1TCL?57P)ED-j(xn0rTJr?OOIOX{J0omn)y$ zx^AJMtUZbfwSLUXP$xm{FDbpg6Xw^TG=n))T$oini@4j23}W5tl1i{mG^YxS(sz?* z%i&7^wj90|mM)(TV9TN6oAB>;YGmAL(!fLCfSDIX@TvjBBA_V(Zis-55#XT=SYiDP zy#W&^0v8i=*InM`@h^oBFZQu{Ge+`FSnpX$=>%#OEIc{5U}b8=Jrx+dlQ zw6%Gjy7RMs0R_c;cvx`dIrM6pKUPzPuXbeVEzH38o znObA>0PGH&JB$UDd&P63>(9n8w-&B4(~Bl@UjWtpIhi`-s^3OO=8aWlE{`(Txy*>j zUdq&ME$f+nn^|?w3w!1cWy7B3yt}Gu&sk|2wDHDzvW|x@0S|>ut#7LUY?!LyuMTr( zLnu_WNUkU^K7^X6ddthaY+K5$(r+;piNgy=id)@p;~icoPm=R(e$6u6J-V+KuAXNI!sJ>mz^(n!O&6<=Lw&Z>E2n=|U?hTg2dVG=Rx3RCF=TSBF_9Ke*?KTzDP zzYhR1*56oFkW%{)salqUVgg|_tqvz79xY6nFv%oPqx?89o3E$|z$v~aM&#f>FUC$tKTFwE34APtQ$SsGTqQ^&?@F{h&n&AFx5x5LX9fj3dOx@ zcR~-Ng53$d6u^ESW;sCiPN-LL%~;Rd3LaZEFxw&E^OkE4$3HK|IN34A6I3(CIN34A z`^1egPBtE^s=*^_jB$!%jMIo4V~ll-p&J4#SZRrI#u+fm5W6p$iSBPl>X~Sz`8qPu zGP|GYqBU25+qmjfqpjw#b1_5^l8MudmYSDY!FIA5#t)knx;Vq~W6nqUh?T$Mg7DW= zTzTgLT~VmfH3z{Bnw5!WfAd#4&59o(Kf`L5-p?YN6gj;xu*h~7aXDTIIg<*5{(2vx zLXpM@*H%)v@2J-z4ocWN5%T`pOA)%;qPHSEJLOysP)|slRj5l`kYOi)htP97HEaX0 zQ^OwtxD!Bm4hE^U+oIMomUS&XV=m&3&+XKUc@9Rqiv7|)W0|R^t12DpRgxd8H%Iku z$3i|lUT^#PBWKgG=rUboO(33 zu$KwKOoBvOJ7ulXwNWK!0Zdgpmm{Gb$g~4s?bM)mT9q>ZtR0hS3svJgg~jG?xIq!& zzbPvGNL1MAYvW+TsiNwdaGXtFOGpGBnlS&x^%uqTwM=nvBFidc`r0FuGjd)7aH8Bu zSS=E+EZigg8ZDdBmZpGH+M+7cqbklxq8c~QXaC}`#sL6U9 zdZ+dIiKy_4QDLXXTt$DS4CqHD?DCZ9C7WOoZRj4nX?ogvWg`aN;cA6TMkfeUO??jJw|+} z_Q$Y%zd0cle{)m}x-_KXtw<#*vmXNc$f-o5DQ=tBF1LA|N^yG|@*i&VnnT<+)(>3% zD&j|J;|%l9Z3l*r5+9mE=QgYV=q|ItHmeFoEs@_n{8ht$wnmLO2fV&XL%u`q@an^rMjn6@sj z>RBya1}Rgmp`B{whqbJNKl@u}qi5Yi{Gj>;0M(!HOJw~;@Tl1Ba+0J-E}6_LM< zEJ^ir-vuH0>q#;46QpFw*Y7SG`9C4s$X^U#}F{|yWL?&8ok~tIY zYmzk+EgcHEiA*$KKaCznYgS(t%H8vfl$wSsLL@vl7}tS+)>}X2D8;wwY3Lbnib*>CDDEmC`oDoi<)Oq1r4QJFQW7%#+T$ zGHi5Pyiwg*utp1dWg5*n^65vlOrvk_wo&sTjRTqOQoGPlOh9NC4B zOmW|4ag=&_Bs2a{{Jtuj&r*@hUQ+5df#Jk$H_)bJz%3E5IRf%wcgq?Q0h0mjJ!f~j zlONcnt&)Itrp4CEu%%B{DS-MHv+99C20_2xUP~L%qkgR*tR}1@M9+H4l|jd3g6?TW&vw!oJNs+4UMwA< zWcAncy&)>xA#GbMeIfALSbmfhPum(L@?Ah*N(mK&`dGh)lc)Jn`%4MYQw>l{(70>N zqemnc5Gn|L36+F-1kt1UT1Hq&SVee)u#>Qh5IrNp_UG`uB}PXR1=PRo1l5b4TFML~ zj3cawmA?vD^CrKUHdEbrC}8bGkMeKmBK-~0-X`qQH}g4w>d)dRF-&U< z)8c%oG>wnamJ*^zY4Zq5)0jk$(u7-S`$I$YsGph_^+%WWqDSeHTuLv9r7tDEmJp3W zR6a@@OCG@k28)7(US73FUv?Ky&YZ6_gml(r>I6Awm@ z(uBj(80+ZKS*MJev4mNK*@St7=!w!6lC~{B7gmH}jWWq;;d~lB-j8+@r^I6N) zL+?6*aK-1pjJVcQJt59R5&n&&$J>t5MN53nqjZhkdcp?6#wf8v+V)ubPT&djb24E$ zA$rCFD}8E*bdBR6g2rtKVJKlOA$pnsmJ?PIRz-G8DLvGnDP=L*6~!e&DBR0E77ETgP=D|&X9u71uSv=L?zGzRMk z(WA6EgmnbXNA%1ASV)NGC`wnF=57N)V-Y<{TSkb+CrVe^4FrwpbA;%*0bm6|X`2br zqqMsTO4|}8hH0W*Xnd+^5+od z5f&1}6VcOE-U{+p67D9fBCI7uPgi-*k-wF&jj)~YHX(Yt%G17GL?|VQulf?Ar>neL z@`n+I6GjlkbJ5dP-c<6N2r~$6gg9Szl_y?|p0|N3;n!O_@a^u>7stvP)2!hh)MTucreVDd5maa6lskEiBbkRPX5UuHGUx0{B;RbGB<9Z9x-L@0v)wf9C(U*KqM z#P{bhq)U&}x?4$zp6$SI5Oxx#=DYPFog;dr!>v;se%1Z7tKi352+^~FyqyH)%_2n4 z?$Vc2M$WADgo+p*!4dAAvGk9CtKf6Jr!qOl@4HJEzlfj55hf6#XDR*LM3B7LLWrKN zz_QCG(Dw=IXZS=qy~3+CqYOdMQEoBy}A!diDn% zN*GR1x#&@uQuw@#pqIHM`^Ep&1g(J~1Re84kIJtnYz*r~>H4k+Ba(@F=D9EXv*rSa zg!3EauL$$CFX-9gzPt(Hw`8iGNUrYB80v}kkEzUuo~iE3-ZB?BENmzGj@lg)rmqjn zOQ+MbF-(v0*Sci$unNo%^CSL@_^xl5UKxHzbd-kcaa%ZUQTnQ|-0Bd&ehyL3!mzw- zd_7t#dZat(8C&GOcZKQ8L%gLf+2or*9nwY5aU+g9v9fx<%1KQVr=MAQ?v$3+#^&jj zgAW`qXu#mg>ZYc1ryVe(rTMHWliDh4YX=`VWYQUj3>q}$z(WohG-T4?!3Upl@EMZ; zPOqIbapFM}4<0me%7K&i^Nu`h;Can0XAhh@v1MBG^z)lr8zxU|n>g^bl`FTcUi9h@ z9(ZNV_g;DE>Q`^PdEkMA4&?vfK?A3qK4o%SQ|rK{#?xCSwwyoi^u{x%&zv@361c_* z*SK6<<2vIS7vUOr`pm|r$qgaK256Wv@$|+6&OKzJ*E(%tQ&Yo?md0sQyvFHmUPHqX zC!BD^w;N6zdFqi3W4=B5$c6^*%t@0QW=w2sY4v7KZ-t5}lPgv9m~S3Ad`$g`4abZg z*>Loc$2N>UVdODKHXK!d#L*4IM|@gt{c)!>9C^YC-b}E3^}vQUFCuK(jK&5fdaaEY zOd&nf+$8$y*+)||lVTs4OjS^=gKJ}`+8Sm~KD{Xi^955{n!)Rx>rKz3&uE(1c1Cl{ zw1y}%PRf}r&FAq4X<9M6V#(h0)0-Nno!**Bo78jx2HCWUt!H~@WfIku(;M5GrcC!5 za}pb;H|BQujFu@=a!NF{PHFQl&}?)XoL2RAv^>OB4Z{{G6SmR`k(m6Am+Zw0P8yn%~>1{1jCVR(v)28tYJSSOV>y##> zgEyu@UGf?y!yIlcH%w}?w1(50o0}S@oRdj6!X}}CI>e;jjApnQEN3(#3tA>lpWHl6 zvpc0_`ot!0dc*1Gw@qpF&S+?vekPov&t}Bp)F~4u=U{7cbkcL-nlyFFq_Z2GcsXO@ zq_$?nM-FYwgLon*ZE8#7^s{r4CNssjv#O7P$QO=L$brvb)9%#PNi0x z@m$`PT!{0waR#H`F-_&j%f&~zj%gaDj%ive9n&N^I;KsTg?wm+Z{QF%!ZvW_w8vJH z6OVCZPP${#oTSF-kRa5tIcjWmTU*1FS>bwx!>6>s${J$BDiyi-o`j?mIQ(rcbR z#hcMGWl{s_=b6-*KIKdi<6zc!t9PD#wzf@do8nDjmc64rHm;@%+-~bNHJ``8oQ@1( z2qB$@XU>>01!3IQV0jV*!ZYS1@1()rNsw`}ck*EG> z-rPFH^ZrMasUr?WSDPpm#!GN`?tKg0>`*UR*zJgdL@KYu>yaqs4>I@6FH7|H`uG)G ztk^Se@5Gl9`$`Lx>i18cd@tWi%r4Q7h}x|qzU+}IUKYaolFD6QQgB5A+on4W%jy|I@MKn0Pq~eOi!o17;1^M%XdC43cQm+li<-5nB z_J^00UXfUkH{YL^PjSq+r~$rZ3RoN8$+i({y;e#lLX|=8L#D#;k}A=CxxXlXVQ^V; zLAUt@^HRf0sv|Q*B_~)p+Wn5Tn=?j>$&0rkGb7%H%#Gc&F*-iBGDn7MY`>G2Q(xxE zZtCaIDD%MT&&#uMiPNxb_cV-+my@Z}#T*PT+1e|IrrneqQL?>P*K^u|FDjumdSotH zn;pu;=XE`WJI-r7Unbb6@s>=pF8Y-*HARb~Bg0!cd20=ScK+kMA+yeSGUSa<%Zrco zPOH~7@5Rf>Ox(@<4~mb0%*c*o5YLx+*)cy(>!Ds%D}Gv00}dY8dVXt5b939knXN4YLsSFtG#t>>IDO`<15^ta z2KvKpI{7)!dS1pC!l;GtR1cwnFQe`J8B2O^MZZ-GwXtY$eu}m&pIXhKe(hWC`|fqdhJ3qHwV$XhUmSZXg)>TgMGnJoLm!> zCg%rU(*NY*x}ex^Pt*nbScWkB^*e&S{e#y~u8!aAKSt%=r(7cGUy-QGD~M6KG$AVA z4~iBT@*ue&>Hq2CI{zjRmL}&4LtW54`Ec;1V}jJt!IvBjMXv2!q-bB-R`>Qz z`Zr#(ChFXaUc03hCXX3K!4VK&|9NT8P`jd5Zo(F>D63SF5;AOC()d+uaXvZ&DCZe3E>{c96zV7FID5X*S}rI%Q; z*hRd-SRLCgR#ASP{{fvSN&1Tzw!mLPnSz}`k7Ql)!Jv3#(8HL4D#s@MKVQ`D-w2s; ze*cLz-rMG&C*4xFtLuUub-{t^{HPpCS5vrW;W~Ia=|6lCL*YM`w{@#v zuV849o*R7OQrZ@aUz#L~LG%BR=L#`dTRY%+KQjup+{B3=&bER6BoAr}zGj#Tz5$l0 z?ZF=Yo>0TAs?1(V|F3!CU&I09D>x0$tO@p@js`G3+L!w_)iYSVh_E3 zMvi3GHs{ri4vN+VskK4zJk8z1bfnmS%&$uxlk^{)y~9l#i|)TKyi)#YVg1h_KI;*+ zC1RF3A1?7fhDB@{Aeuh^GC+_;%OK^iW>pmX8!oPsDEoPWkzT33CjH;}?a3X;%bO zTA%(i7uN}+!*eqg*!#GpAX}Ya!R{VB0|9!0G_DfiyAGI;}{=DuQzWN}@o0C`S_h@GeQ1h0MDD@$+EJ}Er zF15jHE2vU54`yrA?&_lT7EQwB#_<0hdCxuo{R#gsDO&xYbxn@gzOPVHhvkj{D>@oM z(2i~ZkIoIcGbxN)v37??X3}B*(ZV%Axf|4yd?!%ys$h>-F4TDYALh}J*fb@OJ!-y~ zORzyP=2gc(hd@JaN~E!sT%V}BAM)1tFJ4#|bW8fT<+IO?0@5@b6ZBwQe*-avNq>u1 zH}X;#d<*r|AJ2d4LJh9JmMXn3Q=0$Ch3)>M`TDL41||Kc^VbA>j%1rBusHquNd96{ zB@Dx!$pt~*`k>DUeZm$GT)0De-&54m4ml_}ifDUKfofn1;RSU;AJPxghQkCuKx0ql zqhbJA{!`!`q}GBx=Ng9HR0|8Q`IN$*{~(<^%zqq|VPmZCq`w;4*zHqD@bwqMw9n+% zL1B+1!?Y42iv8y(kWRjn^zXP3X;PN--(k3lO+fkg6_S+lk1c4sG$=N~R5&LnJ}xLk zAhMk!1pQ0T1?gq1TZHGw)ZCMX=GfMy*@A&Sp%u2iI}1Qn$Y8Kci(xZ~zT&!|pAcbNv3J-N{O`^#7@AiZ zQ!}=^1yEeDE$LqlCqTeInBCMn$sPUzCWEFv7URrCLNoK9kk=QH)SISLb^bpuknlp% z)dgQ08T1@Q9$ZN=()*IkexeAuM6@(vppS^Eo5cG&4bJmFpnS2vAgHTL&PU8%z(}wj zFAt#py$fi8YhGMzsS7`)$5F0V8;ct1!c zf;|gimRHYTC50;)(~>L(hb&H6g`;vadyuX`{8F-Ax5$O*`hVw zY+Q}-3=m6pPc@b?)&AzSYjZ|c7y3y0ln-a_dmMeSB?N=g8`)fp{q=}c|3y%uiQK>{ z834ZFEb}_HijhGtVhlwe1VM1A&ko}M{`_|Twq&k${ZsnhuaMFE)%iBK|J(b#28r>d zg~0)CY*?LIyxLM$GZPHWWz4(Sl46HEI*PSt>du~@+WgGRW}w3y|Vu#JfV^7%%RtTo%`KbZjxGbL$mJqj2NudDL+fmvE_ zKu@o~YiX5I5Y+isg8uJ-32k}bVand^Fl8S?Z6CB}$rmKg z9{&7pYPmkBB+W=jCm(>Zj7LiAf~tZ$)ppgW;7g>1ZG#@m+@A@F+h?`=%RmwJ=T(r> zA0@f|P{7!&8--s4WZ&d1mvjpE4rEe@Qh?=wBfefHq5L<+M=+1`i6^qL5`a~ zN!yq-&fExh-Y@!hNto3m&7Phmaq)pyH$T|-bE{U)YSS*eTrQ z=oS0{>Kp~{vI6y*-5R`}{|;>i{&x#vuAp@Cp)m6;JX)AX@yycXLrMSj^H?yXrjll> zZ$Hl%@g}AC;A73cmQ4yIY4@IIt8Fjs?kJx*I{!~{2zu5Cx-;HpmY`o7LHEQnAt*>a zgvMYrAfZz}W`Lr5Soh5{cdiljIH-I24~ooo|8Ym*nAAN+D)-eJHiu#{ z^sh)^2f2?V>OD-R+qriPd%KhN$bmg=bzzhov=gX|CYKv@jm8us8kD5BX3=y z7z>IP?x4LuRdPD>0-Z?}e(?TW)af5kqA=;dRlxp>Hw~Ua%ZR*&bvO=D;ugY`|Cg4P z+epj#g8U-m%teeEoBJoy5ce1n6dg17fuNiX^eEW<<8y7}Uxe!`<s^Q6#-*Fb0wN`@%UcO|CWF61h*2(l!3tb4`(zA2RDJ!5N4*wb(peauqU7i2N>y zYLENwiu@;;krICmgOu{0ut5X4_TagA4NPK`m3<^j2yke-5|@nse^C6g& z#f3X^Hr%VtbdFK0#qkbi@4ub6`8ZC^vM9u=>w{TIYg`z zITSznnT-8A&DehyWB<+$#{NCHUQ&gA_ky;h{|o#c%;FYr$H~ywVZaumJ>tqFOE-Q>k9Ug?--IE?hgDIBmo$UKf-uMF1&Vg;RXKBVAx{+m*=)4 zmHd0focBN~{(?==S_{`y!S%*FtI&uK@HaxP)*AD$>JmzSL}_`7B%nT&LzwW}k{W*uz_+>f4JO$bW z9+F-Eoz{>A+edPe!asz=y(n6R{x4_MvHelxXHxQ5mD-YX)t&%Ff}E~(p4~}_zhJ!= z`R~!L^mDduPGgW{&Lg|HxQ-okXA67CcMW`}Mdkb}&{8;aVan>E{I9K?c!UZw`yCR^ zG?)^zHhr9y|J`F9Q#!HYFQVHEX>yNb`wq>?`>pa`Akt~AdpqV&Wud>g zRR4C2n!&?8@V*W@S8K^s--vxZ^NTz#-{0+&NDaCH~An5ug-=*29 z47bi>7~Q|=tmi0;+Tjdye}|5XUWX6R;;(@z{J%gR>C1}SlN^R2%(`n!d`V1mEk}yQ zXoWAeQ0`h4ewo7b^LoKAw&4HAQMQ`RKk)y871kXaXjIUP@qb4h-$E-0$vX>ngn~4y zT4!Bt{xc|el#&+e#O<$bX(*m81!p5+=g$rGYX3>fz!p-aX(+B&v(exV+8ONS6iycY zIvPM3c$Bh(jp_YY@W<_tt8sJ74u6GlW?prf=?NSq_MzeSy5Mk(;ywIbZ0(2p3mI^O z(J64m(DI#bZl8sfk!$yY13G?1hxZ`@Yp2_T{qVNzgVKEqGNXUv3dh`rrmic#yAw&{EZ`abk*uNQ{ zq<<>}_k_*e>2{24)EFI>*$KJDIPpDG&T-DBR74_1&m2B1z|&yIDwkuVu^`NsWGFzhQ33aLbsK zp+3c^&F{2`Bb})O^Mor|NS-s2n1X~P&ztAe`QIz4i@tNz#bqT@_eRg>{>VAD+pU0Z zJJ@RXH=o1&W_|SjrgO|7|5XVybuXn^w6`DHvR))|ABCvS*?#_wRSyADQOA*RjqWW!`Z3`{&a6y z(D!Za0aVo<5IV_*_DIlhg~da&?Wt= zXGGc#EnbV{Ec9QRA$Gpb;Fo9AnGVE4k+S&*uU#6DdT@OY$h(Z9V9FfLk)H7heqNFw zj?Q3~_n@JEDd>O z2qe}B9DHxH6u8~#K~h7UN?mvY8pyu>BrQ_a&>fJXOM=3f;?w`)-Ks}1ou|uE(N!|k za#&&`oi6l$#?XG*|E0nAYMA|B0T=lzjbaXla7J`i$0AH`f+_GflroM_PcIlsx1|mE ztD7<40{=FG8apTT%wwLX%Tb@=FXUE=YtE>+}jB9Og9?Y#+sER$J{H@LO@#MTgB3*{61J<4uTw|Enws5 z%IDcLc@h2iN4Fge_0tfKka(aJVf17(`h)+lO~GTN!7NVZUzpAiQg#(1pBfRAAEnb**_G&qj6FK(Kk$$CVvIS~{1VA^{xZ;AZGt)nTlp_4;APMIsE01j&K6O^)uQea}dpegzknX@y zNN*))8KLLIE>in%hkM+V(Bq#Xw|`UGuBqW0Pi6C(oD<<)=p1_#7Tg_aK?vd!OoJkM zm~fh`W!Hhlu!FAXu>)y{tE$9DA@Ao{hG;)U)6#x%z6aa`P;4F=u?~~Jz(Vbdh-Mhc z$hu@CV*VX2nR(sueK@q7pe>gC+Q}IA;o1s0>cD5XAN1*7pYL@?g1p(b#{VAP9R%jQ z@Y)Fj1@H1%$fRK7W0Dv8Z%J`}g#nA)x>6mhVKT;{46iOuUJ~FJTvxrY>a~3p;sRH- zZ8O^aRNA`y*t@ZI7`j_8V1zR? zA|XEQ!YFHfQBQ0l_3t-K_2=pzl`p5V|K7AZfHmy^;r=F4F>-frCn9z}lMSyO#@~QR zM_aKChq1z4FGCDOzsBpd4Sv1v@v_GNXiIQiOV?E>q2guppJR=P-+q2CH|X| z0si+4{#yo4`&ZGcF3lfpNxO9-XkRM!|CHL{=zZ#6(wp`VLZtc6e70@96VbR2M5!!6 z&8UA{PbnY2pT<<(4(R`mX=0%6;6mF^Ss^|6iJhc>3&I;+<}+wXaN*~2vEJPiF}`V9 zuAuyVPhFisy#9Dvczpy;{oi_JhQWHVr)GYl22KZP4>N>Fug6K%YUJYDG$4x~&VHu* z5??d1bTr8r!Z=ejFj)|i~V(vn~ zp#97z$lyF$2yb3S6G;2-_EN8qzd`yD+xoh?MMVuvJobZ~!1N55rGMM!rFp?Nnc*dQHGT#{XaQvR1 z#-xGISsgR}A(xi|E=AP^ha`{R&8;X1y{>o-66TL|kM?h+tKyo`cy#AS4FtqO)4Do z{W5l(*UvV`?41~pq2ny;s}^hM=nB)+kY69Si+1$DQsIoNS&XdE|>TyYrNv-FGX|f?Qaarp(B3C(F;1F zrl<_{a9+-}GZU}znPKuav4EpD79#~KhP>S01oC~sH~=og2i*k6y=8o|M11nLK&&VB z`+u`)8Y3d@KZ(%$H{mz-V5FksfUcEy^zF`0``Eg2CvUsg+U=&oB8|{LY_Kj9_YSSNt!9{$aU^M5bjJeI>ZH;QjwwC-H5KD;CluOS2QZ<^OG znD^hxH=Xh8R57#z>B_&Hg3Y>5^TFBe{sQJt2ZhWA^Y>$}WMFD__Wp%Owm1OgXtR?h zlm52vBF14HvwMt_nR5z(m}9rDSU1ubBu+Uqwwsw<*qagvx?}VH*`~lNAcQ?OpuvE49;ll z5dLX+&~#p(DTK8ly*XYCv36+@!}y3JX+0fIqj-7#S{4HZwWy1un@kddh3)=py50LC zJ`L2(2TC|?-R=7+$Wy6M_tAN9tuJE?{C8W;Rm7QYoDfDk+JiUs)+;4K55~gs8u=i5BkBYa9yM-FJMd!M6A-f+_?C-+k9{4|C@2>Fw z&KCT6{1vDKWsvdxv+D%30}y*dQ>hL8Lz~)9Q||tsUK;rvI-TiBn)Ke%o1Z-kzWAGX z^lF%cxp`|lz~d(91whOiUasgWLMn=|O+vO526XJto{haQ;}(uD=> z^3gi@T$f39v!xx3H=o1Oz`uhwvnwpCUb=e^xobqKssCDvmDxf@ z-l`MYtQqdQ1|4;uyK54>>Y}cp4?^R$KHaQ7#YK-s&wr)}>&?Fhg{n*9b)dw-ZKs3U{!ZyI&pvBX6GcK)=hPnb-4 zQ=q8e@J=(9OH}7cgBAX4tiWA>EPESwF%Y`T6>8txVTzRhLtVn_a)zTTAb(@?(AyqY zYhRLBl2pp8h}rd<**S~#l2XpC%C|`6#ea9s^v_0f87|-!c%lEhvpCF5`FCiC`Jj>6 zTxiM9oCR(EUA;-z#ib1{$$qyS;@)Z0)mA`*NWG$bO>h8)-i}5)I`^+E7eh3XC=kdl z*j`gEQTi9Fd<`|Yw~k{@RSxi%fo!`g_QMd_Yaz1#gcN?KpkSr{Vq?31eR;t)YLwa$ zBDZ672fbZ_U@ias5TN@Yn`5>7htjy9a(|W zk#iamIUc+8MYO~5np6J?aF+TnolmP=I{MejR(OM`UH6CDgy3lr71O?$#Y-{+km&?v zKXWg@W=ASoz5^y+Jpr=)%gbyU@>Hz|mM; z!OWl^*A5G2P_~f~+N9NYH+**hw_gRn+PEffcuYFHTW&u+^DSoh&nz;#yU+Fg%zyM$ zy<2l5b$28eqUYF$|Gus`UD1bkKsnK6s1S+o>n=H~c-NV7Q2uYfGYpCUZ(Vv)Dv_ZT zT3ato)o&7{{2Thz!96?9G!x*e3gpAvXG&E0KkQS-$i6x?bih#u@s(A=v@W6@{Bvt6 zU07$d_%gx`rrkExB<6z!@Ey?{2g0YSR-o8c(hkvofN0jjiat9+Ug3pwJG;4z%wPV` z^(fq=Qw4`cYS{j$!CFL5(S5&bH!Z zTGX!)>E)9@^hR{}KR%1Q>nZ8@%GD!5Ag2kkwFGTKSK{U8j7NiaQ%?RQ@3@@!8D6iPc%%3Goc5c%ALYbncnvx6HgC_I_$+T* z4t=w|k8<*RdY|O9H^&>96QAe(Ca3&D@7p=?#a>xX{3`EHIqfa=*5%}vd%JS*FY|to z6JPFi%ZcCMJ)Kkk7VpHI_zG`xPJ1i89Xa*y4*v{xG~=thL{9!{Z&41uwcd!F_?})W zC%(7$Y)*S$^xh=DlAptL&j8OSJ~@hdhkAv~|H4fE*SwQxe`sc%9pU|v^0k@xQQptN zpRGUJTTb}`enZwhbG%~WTf;xYqCa%={ham|diPL&dHCmD^apIdMftK!{pH@3lwX;l z=N7Mo_?XO(QLpgspuYYrl6zKq^T;0&MZI$GD)24Mw12nvIQhFWe@%51l?_d`%CDO`|g;s_6caeV$@rE#d8u9mt?-|CwK)jS6Cynx7roCq3 zQT|VeFCsoMEPpofzsB+h63?gq{lffz(BJ>V+5Nz0HUIw~KWpoMGLuxM7AupfRV$@r zlA0tdOOt4|t+raVYW@FX)v8rfqavghA*6<42vK~-Cxku;Vf~qk5JCvQ=j)uuSyvbG zz5Nc`eb4iLpVxVxKi9dgc3r!!rpm${-&Xz5O1Zheyw;~rhIec;Z2Ya1&(+T}$v>#x z@__uDazpJufBjRHrzn3;|0|Vm4%nV3<$hY9y}z*4|5EE87?AyQC)#a))%$pB{hXw) zD!M)ns-_<_*?aR=(FaD}V}&%?`x95u$Z~3XxmfEAabEKR-}Oo3L78He?Ue`8ofGQr zrIU+c4XPR=LD}B<{^S(u-jV|IijzSWcRoV*pVioYd++xM-Cv%?{<8OD zkI?ycE!*Eqt5G#4k^c6+?h*RnA?fuOooKp9`#YPn8_HXQ*qdGR(EhWOK`q|{re-FJZAv=W4r1`=tI8edEMR5 zK8SE`aQ@V|ZSwZ_bilHEMWxrFiBXN5%Q{^<_ZXIGX8-Crcr-#!x|LZ3v|{gm@>nzM!d z5#=sF$vKnpdB?lH`?0Y$-ra7!{?6lU-!?bj=p5#FdE49Fsm=QB^D`oJ|FV*7HEetB zaezNrelDoJftK?pYabibK85YEKGr@ysQ=EO{cHW4``zzOi`%@%S&{$qKK?dxwKu=A zU3WKeniaW9k3q~`-bWl-{~XJ~{Zk!B|GWJQO!c?@ZvE}bZT;=Mvw8<;KT7*?+QrH7 z4R)M7MeD!LR6Tcj)!SlO^^Tc381+ItV@&mPCx1JK=raVY-vi!b*VL6k?P+Yk)?>%n z#+z)azPp{O?@oTb^q`#a@8djW`Jq9}4-3kfK{<>4svE&ZHQD|sH?^HdOpVvw4;rss zH!Vk-%BiOM=P}mv=Ye&AK+pTUFk&o&zyQ%h4Q|k3yspZ{| zpVt07U|IF;F|@VUG1YGW2D1GejWMXhYkt*N@DrcMU? z2w+=pB;$%^TnT3I@yhm&yKPshEw6E>%fFllBiU}%kFz@K_0gB+y=*6E_NZRr~Tf*eBHaAT7CPs zVr3n>QE6&1+CBqA>SXODZTsyMirne_Tf~+tv8=kA@sRnTj+fP!vF1nKzdfzKUB5%S zd+Q7Bqs}(@>l?%R#%lXD+t#OD?Cy_Tb2Ybj?VmMd4aGfP;^grjr}{SEAFukmw>K@n z+~zA6o60*(JI^$(zudmHQg{1Q$DRD!>3D9}!Sg40*YCi3;Z|4cbN9E_H_3AFauYdT z8b`W~NB!OHR{sLa!Tl$B!>PQUP7cabg7Q?xtMji|O*X#mrfvsT+SXTYYJJOXd}`lf zs(rhu_MPTxb+XCd57Tr$Dq8hJDX^>?ouns4``f7y=d`WRm8|1j%+o8ute z$zRV5J>Ii^nqQ8`O)ck6e!ttfJ-(}RSq=Yqd(6}A$J(_&+~cG1C)oHj&R(X*pJJ}& zc&Xn;%i38--*I!b?w{;>rEzsO)j!o#|2*bzG1b4!RR3dS_d2H>W!E9K$C%3YvF4Ts zl5@%Sao@IG_EG0n-@Q(2f4SFb^|y~ax8-wfJKyxKQ|3-`n6@`k$K` z9gwMdHL6S12{%XOGBi_;ZATYJ z9Wk~2?){DSr+XZ89F?@R+Ig6SUj?pXE5yjvv{*-%z&u4Qsdi3v1s&-c63T zrrOg@9p^o!_TLtcPr0dn?(tH;Fpf{O`KIF}m@n)4jOC`rUB`}#w#z<_-jh-7w#LROgea_0~8;YQ6PLtvAxtdV87cbbn%MJ@z|LJD-Yi4X(vgj{Dq` z_Z!D-|Es>%ctDGp#3GO}4(W5UKOny`9UQcHX?LFV2h3oEP0VFSeL! zcON%tdtz;U+KzZr+mT|vsq@!VefPSh_EOsa?z&~?h5e5AFSnn9laDuYY`m&7$<%s^ z$!p0v<=y?;z_v#r9yR;q_Rl|gKY7I3RqvR&TF2YATRGNLPUrTs26tl(+kVv_h?B6~ z)c$iHZ*A83Xxl5NnX2nv&sBG=WxL)<+g{s0=0>#rWO*~%_1^L}EW=Z_Yk{tRni2W5 z)^FRR^||*yTAw}svfRy7&LroMSCH3`-Sa{H-TQ^rx*pIT#(uGXhg!Wj@<6h?ztq2g zTtxc;Q`_racV5={XZy*{Kb(f;rp_lv+h_IN{iu4;mbJg#^GfZLXwNg%UQGK=Q|-rS zKS6t>U2n8}lBxC_Q}rjAT7Eh0F{%wmqh9zs07m$L@7Xb%O6#Qn@bWnW|r4 zYI*niq~+r5IwbA)H|BCI!4$jh*!WBvpQ+{D>yy^M!?KoZP|NGr!BoElQ~ipVU&8!S z=11FgNz2F8ky<{{)c&{UOzgaJC;$FsA?JziUy?%9PrB!UUAHaY;yt%w%h~NG^j7cR zVW!=V{!*`y$8lQk39ZQ1ThHpe#lH`1{FYbqxI{UZ>^@#pE+%g`m3NZe$0^G0{oQJA zzZz$foo{+@orfLl_-@ep?09TZyQ%Zgo&&P+F2_^$!yUT5X~y}_yK_%oKNc}Q)!%62 zkmaVf$9=q{{t32TjVsaAxZK-?#?`^jZykpu&i56Z@0(5a-)5?Rq@B0wmx%UzEISVF zc`T#tJd|;$kCb(f%Nn%jvTVCfprh@zZ1<~nob0@{T!(Cri!9f}26)Q;Sgh-pX4t>$ z*5EcQH@E1U?FY5H|BnAi`@yp92UFYS9#`dQWcRo#uO++3RoOky)Zbx0)?h!zlim9% zwWpFZX)iQCRy|Yud$Xx=xcmDP9$(5Wwx9JltK8Ih9ox?`%2fZvs#5*j$16H-?0(eU zZd2{<;}x|Zwf+4Zk1Msj`?yl=?(JRe(RRC5?q%wBoo#CSa!rljeVn4}(oWis(SCyV z7`wfzJ<-&4-5y`sxK5a=YtK>Iam$mTeKk%~PtO#X$=>6Z(0<-^A@nAl?>1jg*DN=C z=<$V_sBxIr>bTOr*6gYMWnQQIC+2T7d+B;)Ua$RYrf7efNjiT`)h{!9>)&_g&ANWz zPV)vm4l>oxo$mK&QRE&5r^+DRPBhE3XPT;{>iGcFE_AbYwNquV<9vk|g?RaT9EbOs zLmcN7tibv@FKoV@M^(}sCj%Fm>AGFx$5>70iOr8SGxU4{&M=2+zu{YW6l?2zvi9b9 z6%I3pInGM_1kcdDs#Fxzr{ zaU?D=M>x)Z%xuT`8qYq%%N=nrF2EApj~CYU`gg&BILjRAxUVlTcancMM>$UGGd)M* zk7<~_y-P;@aE6K?HGNwH-9!hi67uESg)Sf&pwFT z>gV7>{1lJl1?PDEt}sXIV^eWHzJy`*z4jK^-PG^h?!b4k?z!IlD{($Ph1>C~oR!*LE4;~TgaPnhE!r^|Vs zV{tjYjMXB&_NL|p$LWD1aS3k2FERXluYbBZ(Qy`F3H}$qz>vmXzqXi#i*XZHZ{qd4 z1}ESOe9oNYIG(>M?$9|ZD3-L`nf#+WAE#C&OH)rTINO&(E!!uiW?bqQryx+XtabCrP*!2=` z{;fC%pTxsvo}L?w_3VV{=1j*~k6&W*OTGEa@LR0Y(wm=%PvEB*+RAIc1pDB0d>D6O zY@F9W8SlbUJd9zjy?#yba!fU6InJH<8vcN-+Ia0Z;H_=FJPDWK)A%m_j1lo(|4VTs zF2EApjbZJ){w=UCj>G~i!H=<8dvCdxn1VC#Ufha@G3+vLxu)0|Z^m4_6W8JU_${8( z!K>2;r{I(LIacfF_3Mh`@Bw@iBQE#)wZYz)h57g(mf<&8yOX#4CD;eYV4*qNaW>&+ zSiQ41KhDf|oSSeOK8UYj%8`daSMKdb$T%_yaC6X^YrgEdw!Ot`AB#_6lY!p+%P|$_;%=;etJkkHrr{DS!CiO)FSyNH zE)mml0hZudgS>vR*aL@P0X~AS;z0~g^_FjseJ~s6nF}3fE7lt9aG}CAbTZVWTW>`Ri~zuEIC*J3Mo^ z*Z(pcg!Aw{`~@!?;q~u}BXJ=ITHJ~uqr85R zcp3J?srWqZ#BcG8(cbcHaSRsXqxd?0g|&0M<(lJFI2JeJduE~I{EAUyyqt^$_$q#e ze_*4rUjO!ZBj#WsK8CO3w|LGtZ~5++gT?q39>w~(UjHsQ2aEA7^A5-P4O@=)@*unm zJ5BKBPr_CB1|Grc6TN=XcqIf#jmjX46lD{ycHMW zTUdc-+^+tM9H%YbY%bRCYw!(hn&-_=#`u|Dz76xS6c1zAEU#ZXOu{KxjGy5zSZ}ts zTpLWm8Mp~Q!H|5fe!k^=6NP!2F}7&xEZ??c>Qn2iFg-oz_;)q+G8bKUlY6>`{P(#jF019Y_PyvJ{gN} zCpK8n>m*ey#_rVm*Fz<96ohEKQ z?G9Hh;`$J-$LH~N+>RgOK0J&^&D-?%Y$0B~GqDjiHwQURJ9CMiHzD^Ur;)QvZQoQg zRkwRn{g>bhe9Tn)8~Bl_<=p41ae+&6D{2k8-_4-AbLv(vIwH@tDt*;}w8#$4jjDwh;MjnNe zP1RdMdolTCe9ugCoKH-xZ@;Pa9VGui{+V1Y%L`~G_~H} zv1WBI+uu#u{PVE|w#Tm68*jm(I1;DeT)Ycc;^Vm09PT)8lRq-GeV>vKlfNeaLjIj> zuYa`hy3gNgxkz%1sT@o0K<-RVB-`r}Z21)OKyoJ8Uaw&7lgQJ^1-RJM_?M%-j>+;? zQ|o`9{5967>CHdKRKK>Sj$dcyUxU5z7E}GwP4yee{0VqF7Mkk!gsFb7GXEXsf5`l= zng1*E8`kocYi?@1t*`^$M0*-J8z(d0{!Yu5yBi;7zWsfnjpu#l?vYCk?i-avka{0ez1`Cak{w?#rS}qxfn!5drCQrhdSY&GXN3n$Y8%>RC3waxP2YDyCoP2=%qp9_| zuP@O!s_TKejVBx%;stmKUSVpv?&KRV1xJ_~=Q@0c`Ja$~BG*3K>(>lBm|A}ia(^6$ zlg(L<BE5*=?-c@_B~@&@uVud~s(29i^0&nCOCzft=%=Fc{@eTDc4{hlYkPyWKRIAAW*d!R7?PduZ(H^08A{n`X$ zu$`&pyO>(O2lJEgX3V6040#I9#v)U7)|;yHI(awk2bq7A{5$R8=c>Pr%hYl)>#9^Is-ah>v#Fd!&LK}H-%Wm;{3?Ek z<@gi+i8UH|_0PgacnNmGUN{i5aRJ_k58?CpE>>XZdEWXOVk^8J(=Znc%+Y!slXA5l>9?2sHTgU8@8pn3Z#`$3TJJ@81>Qva1e|J)(eFvf zcbZ!NGV*Hj!{n#Po5-({UnlRxa^@c(A0;0n+Zz+vdcsWY7x(pQ%Js-m7;9>L*O2?* zK+H79>GxLT8K&yYA}=D}MP5mMki4G!H2G!nYvgyx?~^~n3RCO-25UD~*6pXUsrju< zjU$2iH<8n6pNfl^zmohYK51&dJd3a4JNPjk#9z^UeV&%9*F?+bYCNWL3sd81Nxq!i zh1`?en>>Jg8+kZ+6nP4H26+K_5&1q`ZE75k<9|%;r;o{Bn;O>%=0`+%Im*;>mtjxl z4=}ZS8hIQ}!#SpwTSUH}ybk|^J8+jdUay-swV#fd8qZPk39{az!)>o)sy&<>Nsc1N zlH-YTkCLAuKS$n5{ttPlIni-GBY#Qz zH{@T*e~@ck;B9YRQ~Re8xiPr~xh45>au;$>a&Phg@@?edIL6etrr`8TNfLcQ*?bMUxo?T)10dJP$Lh)5txfJO^ss#c{#4eb>=i(M@${R*O>nX z`F-*(@;>qxys}aHz&6twu?{(A0YieBQlP@M;O72L$f_yFcdh*TW zTgh4IzW!P3nQU1urQZYi1oL0S|Ke^lPuB@k<2s7JVEv1|_SWW1?N3wN(Zf{#>&X4d zw~&XCN06uBd|XDm`?_n@dzkzf?VHHYlV2ylN&X-1F*U9VbXs`%3{&Gfj~qj8k5@B) zu&MK9IP=}td26|8xBWmKfN40^)OJtBdAI~uq5Hah^?Q!I4c|le_55l- zO#Tr=T6y))!1@?%&eh{t^5v$+*@fJb+?zard>eTuc&@+|UP@?GS+$q(XV zruOI4xZTwDd`>=2uG8A<7i+4$Be^emD0vFG(A4#28F?i>iqD!_?_1E{mB`o>Q5#wB(EZ`#pjs+0lA#~hpF*bZ|kiu92??ArrIwjUyXg3 zpJrSJf-55Qr}&mm7H7m(k=a&-T`MdSH}T;(!vJ+-kOo{w$O{reX!cRe`^ z=ivSL6n=n*u}%kXJ&_oTy)hl<;tG5Qci|DN(b22d1Y6;i*bg(!d3t6pC%=U5-{Yvx+vJbv_bK@>`D^kod)Lf?f zDdt~^iP#4RU>c4wwcHf)Y%IiOxDp@5O{SK6nfxEzfuG?)Jc@sq+P`OYlG=`ourE%> z1$Z|;i0ko1EW@2xjz{n~hIRJV7mnv+3v7>9n*};=$v2xiZnu)N$Ro*<$rq;jT)c*YyL$C10ah9p}i^y@<5qr>{OuiL|;%J<1s?G{i>v@>@ z>+w0qGK>@JJ8hr9!;KQYW;UI z|55TL+PCB9%>UNZ^7XFvmW#&LrsiKx?uj?zKvV0_Ade-_##Oi$H{fgL0==JysqNiu zYP@^Mhsf^V2de!z`2_7Xx_SNUm}-y2OYkzkuOs&--$EWn9zmW+o=ToaUP!(N zSDM<6M@{Xg5>wmpJpPyYJISBo7x*LXe~_zR<1HVK4Y9eY`mM+v@G4BA{buqI9L@Y$ zrpCF9`D>W}0=bO#&+&WaSLyC8*TmFzT}r;1+zW4J{t%qO{5!~{do$AMeEt_+LDTUz<8_Y9`8sy1kjoO-$9jklc#gmV71o zYVwVkhU0KH-i52N1Yf~-@MBZ!{fzu2erIZYzna=__MSS{uMVDrjqwsw{o=`8@j4tp z`&gXH{Q2a&$i?Kx$j_0tkl!JHNUk7%Lq0*S+S42F*`~%7Np3;D%GCBHGe3>_+2qNz z7n1L%eGU03+P9HEpnVVdFzqMEwXgHWQP0$VY-(!#@#L#bjk6c|W^?2HYviv?wI3sg^zz#4nRecpYL6wi!!FnZlTG!zl{^A-aW?IR zqaj(H&wSCxj#9bd^>p& z`F`>md=j6SE<;GMV{U%@?Cf!|=Qo4oZj$Bw4%PrGAZybXur1ialW)Mr$Ymzhf(=U(!| zyPQoABoeLe+S;j z{D<&q=9iJ*!~Le#bAg|sg>@6huQ=H0sf z(Ec>}W%6s}cgXLPKO^rWe~%$Id-cMx3AV(`O&!lJBV>-yr{w z_Rq*)(f$Ydj9a|A^-b-c3r*E;Prios-sD?oA4Q%{UP6A@)Hv6ZpTjNqF73O?d+`V6 zpCDHq=#8f?o^Psdb8;)}fLGxSrpE8SuYw%O{0TV6RGmfSd$1TE!{ZRBlD?fIUprNh05jLvRF6Hq~zyc_A*v2k;3~{Yvpw=D&p>nHtB>SobzB zN8_c~9Z#s(YMa`Q zbIIqCFCt$;zKq<7+yi@?8h?LN$8Qw*4pZB4H?G2`X+MOG2Ybt3ZmRzcn1UI!&m=E0 zwVp@F&(Qt>^Y<{n0>43Lh__r#Q|pPq^Dr7)o2q{~`D*Nix0u@AO!63sjIZK*_?cOx-$$4_zmAz&?{RXC3~zn|ya?OlHJFTPINDU5apc>{v&oC` zZd2=Dg)d^6spWT(_mjUP|3R)Z)LXuxss0y{8hXN0{24X5@HN>%D^9llEK5*|d)*&!T-9c@6DPl3$?xZSo%4 zE6CsA&*;7%i?*X~rZ!+LtnaHS@RNXUzYeTz9xv z|6FWtYCZ1z%g97>3XaD)xCrmTVtfpr#usrL9>kxq`Ur2mmtZGM!Au;3Q}B6Hw_}^^ z@2JDD2G+p_rq10+jKXM)GqvyIu>*F-L{s~$7bamcrlN-6_ERa>Y@B3jTc=?j=3@cs zA-&sgIj+EBT!SUJ5leA1mf?2XfjhC>)Zh-_Av}V|%~5)NBsw8p4#RM)hxU0H);|(s zFc#x59uv%Q-sc3EiR50Gf&(!X(=o@)_1+KOoJ5|61z3nhxD<4(d+ajeGErIo11o1M?{P7#_zH=v49ghoQY+y)9P<-S=xyw$BH!`3*1iYky-R_QDh#h^d&4Ip$35Z=8hFFc0&w2$$k=T!CwG9hTrmEXB=O zX3o;{N4NubVmThbLwE#_;|X*^y?S97j`gqsMq&)Q@83R4`Wx*THbChfx@fF&K++=)RwZ>U1D?#sut!Ntlc&I1p1Y9WyZ-C*d^A!+b2l zrMMhd;96XVCAbl{;5ID7?YP^VtLG8091q}8Jch^d1Ugl{<-^cE|HJCp=OdX7&^`~u zaty{|9L8e;c0>Do3tO%iy6+33Jdm7<>F9nAf!edllW-d5VLle&Qe2KJuo%~132wwv z+>B+o9e3bP+>Lv%91q}8Jch^d1Ul8c{Sk&W(0v~hZFe}i9!6m_#$YVE?{hL&k4MNI zurns0`~D|$_4^KTGN#}_%*1TW!CcJ4d@R61EW)K&Y|hj3V7M07VF_-;Ew~NKa69h6 zomh?s@DLus7U5D{jw`Sj*I)^5#8TXhWw;%8;7%+z=j-tx9>ODd98aKA z!|NZ0;aCqFU?j$1EXH9xCYTHK_yiNN7bamcreZo~Vm3~~X_$xkSb&AN99Lj5uEDjq z4oh(}ZozH119#$X+=GYk2p+{_=+yM~M;O+?I@rKmsPh@4FdE}99y_4>J~>)0k=zTD zFd0*DAZB7V=3p-7VLldMAuh)iSd4411UF(SZpJd)jyrHCmg50Dgh%i=o#W;*d_x*mfUptc%u@@#`GN#}_OvQA}#B7{|(=ZS7u>cFP2$$k=T!CwG z9hTrmEXB>Z1-D@tZpYoY2g~sQ9>ODd6p!I?Jb^W8d&j2^hGRW!fRPx5(HMiV*a16Z z0(Qeh?1f2~j43z}Gcg<8_g7k|e;<)2;WTvLZ%OU>&B;~qSONAM^fL;K)5yS{{B4XlF=FcPCM8troeZTWcYfSu7kKhWBHVG`Qs3EKQr zOh@;9pfo?5JPD^^9_C{ay6+dI<(89I;96XVCAbl{;5ID7?YJBFU^yPZLwE#_;|X-m zVEjWjj|pa>?msaR?ek!5ehLo6R7}Sl%*9DK4GXXki*P9x zn|J8(Alm24T3&~xxEZ(LHr#*F-MC^r0n2aen5Hm3wb1)Yt;WRA3 zLM+0iSd43MEv~~-+>Be$eP1)3cRR>CaX0S4LwE#_;xTmJ_e^!d!oB@m1M6S|bFm&D zViZPW9L8e@?2L)n3zIMz-OrsTN3d?Xi?!cW`jtB4%9>Jq{43Fapbk6eD7lz?j4;x@4MqxC@U@XRAJSJc_OvGN8 zgvpqK12GlTF$Z&T5>CTB%*O&O#3EdZ#kdC7;yNtBjaZ7CaSLw49k>&B;~p%>19%9J z;Bh>G_Que5K7?Tntb+|O5~DC0V=xxuFdh@I8zy2eOu}SL#dOTXY|O!2%)@*vz(Op- zrC5w>a4oLG65NPea2uB4cHE77upAHIAv}Ud@faS*6IkPH?|9U~aIA+>re3=ejWMQP z0}_jIW~v@PqWgY+gZ1w#%QC?nqQ^U!Xr}4$Bqo{ZdYw6@m>K&0B&M1}b^XFjbC@1q zVvd=q$MZPJ%+m9Bm}d^x<9RGFN9gr3SY&4FeJ60aIa05m!D4fi9xvfqbF>~WVTn0L zuh+&>bDW-!!Y!tr_u7VK=6F3nf;-F!dVUIbn|eNL50;yH{^|f8GAHZ#Dm-dV(d#4d zxT)uzPM}jySNbCYf_}{4vFx$NMMBRLccA{+Mab*YU?3bAgUOPBQg4+_>RZ0dTo1{>J(toLaDn7UoWkYi2VE)vMy%v6n=tW(sz zJ!n_B%WIR|+r?V)I#aicGV*p)3m+mMF?G9epYPTBPgvINA}T~GN1M7`bS5X5ncC0f zBvZGGf#g)vZWmpR*;L$Y@N5{GE=vUa`FLFw~HE8q}E@@)a@dU9B=A&kwPA5 zj?-}=yU#=BI!-Zpjj7wk7VUNPr z9%$-z;XZGtE`nfiSl zxtBRh>m$3*Q_a?SMs}Zv%Gcv1vip3KZWlYr{_{#sRd0P^rfv`J^FLa@`}|LVo=>1X z+0^Y~5_y`b+eIUI%FjyH9?aG$Tx z^6v8$x?Q-RXQ11`Yj!^9{I6}tD^-s(&B1z~ecNwCG~c!>O|SDe)AjcqW`^E}z#OX2 zCAM+s{4F(g-n!$^`8vnetMjy8O{w!U(bReAz7My~$6d9Qbsm0rhSd4z{(DU4UA;4v zb-sn$<3gQh=h)*9onKo`omZ)L|2NTbX4-X9=g~yFee3+GagNk^v)$DBa&LX9^Q81# zsq^E)hEnInd#28Z*^Q*mgRQ2Hf6Vz($NjborH;4z{$lys-e~1Hdi_!}IoEOA&q>ws ze7B{tj-&fIqdI=`+bZk06}6W-UM;VbI!=8Pq>fK!cd6qt!_@JZ+f(W|I4#F!WVgJk z@AWM+CS|2hYMGlcDYxawAsOkp+2aO{%*h%wacov@#-JftqXv(i>~;P>bU97Eu^EHY zPhajYJx)_CZFJ5*jmm8rnK3fW?{S(k!^V!D_zxTBHKk_^89!{$;2}fCW=wG0o%F9e zE^FMNoUvIWGX`mo{zL7*b~()$$7N&>9h93f?w^VUwV$R^de($NS)=}`&MB>@sggD_ z=VX=B^cy)o`((eroI9tqp03L1^wU)dY&}ht!Re=~a!TuIs*D>y|NYg87;BDj-oe#0_y2c>5X`==fOH`HIX1e%xw&Jr zhK$$g?hV1a{f!+wYM4LgG}~Zj=HMYLd76H9yes?tW&EeKo~DW&?|-gR+3IbOWlhlqd-Uk+K^bHIz52w#IbNr~ zmac5_#-255=;*(%r}K1VR(5vA*g<0l>z*R8UT{;uIPKnLyskro(ngQcffzR~YuG5q zZ@0#AgNJ6E()e$?N+)i1#wbU7*Z8;ILp5X#cvSl6k%1!)xH0^t$7xQ3(-sPB46b2& zX!NLDT?hk55iobqpmDi_(?$$R%N#Li=wN+NCCDgDM~jT#X+ zroU+%H99w=WslzdE_H|auOqYj79H7tD0)ikX+~zZ@5(Bt>1X#XmHqy5dY{sIx+=PF zIZc(o*3(q6tI0oCIi>Y9RqSf=&s9!oJxvwwA)Rg|S)+#i!=doVJ^j}XEyNXp_4RW#v=MEh`cI2Qb8DmGg4H+Xxj@D zgE#El!9)J(G5yIpr`baH$erx@mo)~opJs&tz5eCi&f5a-pBsbzWjlj<{o7Uqb^rTK z3F>s3nnTBC{L^7@n*uM}!^RIDo9+x6G&n=|kAuc%>q<9rbij-(X8hZgJ!_P%pIXrE z_m>SgrS&u;&zPj^=Ra0CrS&vb^oZ>r#$hdKI?YF?1)ky-hv+VT{K%HfKTYxMaYGz? zl%&&FP9AASr?+g^(Z0vK-`nc@;FfJV@_4FcYd3q}-5=X^unzI=_qH9>P4!x~aihL_ zkHT8ER!(=n4{quH*zPiSDfheHpR(v`j+0ZeS2HHo%=oB{odC7 z-lo0Zx3!z~on;lZm@U=5o&DI({T{FHgIl(Bzqe`U_igQFeP>xW>YED0yX$qo$GhL# z>U(<2Ht~Mn)^65!mi4;2>uu{UtMA&k?$2%A?`_)peOtR(-&xk{4hIYd7mV zCB3MVjcaV~*w!su|NR=`+(EnF+qvK4-S2JnT{|nTvZ6b;wfj9zza{xUPxsf=d-??Q zj$Kv7X{O&D`ICO#l{emVLTk~{U%_Zs^0 z$Kv<1&&$-W!YZd@XH;?Yt1jn#eOVv-vgNMU@5KVwo2+?O)1Ul$SE^rNy|B6`>)E#X z^%{HiD#ur>Hd~Ls{eHbhLG|hd)U*D6J^Q@X!11kBTfV;h$*)&iodU-ft$I=FWZSD> z0an)gQa`I}<@jP1Y<UH>=@oiJT zz*Lz4mYw^ncm#6d0)?s{#8tK5J2$~HdhW0PO6Nl?95)$?z^_S};7v*rHK zcml^)sD{7`nP1QTz9(?MY*vFU-&kKZ`TgwgfdaRqbHI9=(9f3J6|~-MDzL{2G5Pi0 z531KIV81j~U+ZV})(4Hxo|mxs*2gBl-s3^_vIE9xitGz4rGUORW%-UvIkCuX4Q|bRDtfFA3^rpKBVp-W37s zja6TNd+l}5f$L3By;y%`^t00Ty6M1r>r}5y^X>Z5QeS?(n4t05>vC;;*2gBlbaYU? z-0+jP4?F+;dUt#0Rps^BUe}xCR`S02_3ZEQv>lcE#a@4F>up0{zn@*70=FYSV7+>3 zrgFWbbe#>{FWXfwQ_K33UvIej1=d@tdWq^}`=y<}{O#!O)vFv|yq>?Z@mU|6{CZu3 z>g@>_-(~c(<$etsUuV_Jv_edNy`O^W9Z@~IKHB&?>dPPB`$6Ng*VEa0tdC88y?27@ zg`IWsxOJkREmt+@yt3Eh*>j@)OlLL=$H{A)@daRF4 zem(m;guvsG8!$dS)mB;0Uf&#eeC_oL2{wbtuh&BT0_)|go`1i3mHPVQ>q$NB9(O9# z^NX5QIr;U%yndDE!E*Jp?XX%l`TcC+!1Zp{di~?pjefSAeco^2b`-1L-))DzPCc;R zPSs1%^0uG52h{tBdj58l>yG#Dw&PB(U*&cjQ9m1x)w0RojyrA=m0rlSU>Q#;}Ry)tuV|{G$$M;51yar-uWl?7#T)yzyBdoBVpV z&cJ#{0>*bU{cO9+y~pj9=U->l+x|DlcTdpc_7kcXqvdV?-4amG{_ZdE_}0+t25ddn z$0mP#_IHATZ>K9lqUiG51yp3;=zWn_+*Q-}~ z{@Ldp+Ip;yP5$_11=ULq7~f#}*>bOGfxz))tKMcS#N^j2_4-w=H%1RiZTYmIe)f8q z!0kv6SZ})eT0L9tL46BcZ=C9d*$gJ@XOsP1p=MXEH$KW+eyH1ea(kDmU*LLk1J*lC zef{;uc=wkl&llDEyY)8q`cLsdc*oxB~5rJvQy)kfIv(!*@P{!eAdS%e|+}3roejL0>(Fiem1@r zyn2=6TdsOhe>1*kgX$#*jBipvy}P`6mE*I|iL>=sADjH~Eefia9WcHr^t0s>LQma) zTU0O83NiWh>~(r7SvgG$7@uBlRk{Bfc=amB7Zc-+&-&Qp*Q*y)Z)w2z^m47rdiM9c zfyXya^}=;-_>*7nfcgcFZ;k2|sFU43^7Li>)WzANZ>m>0zJyD?`PRoKzn=a5abUgJ zb55Rrv*>5_rg-%#k8h&t+26|glV5K_P`%Eom#Kl+`11ATkFT#+uX22``bUDT$NJdh z*XtcrZ%zG^x+Zj}Ed%*Y>(9g!#QY%&0%JHpHy^S`5$*g$iMnpdxK|E1_3 zJhmR|W0PO6N>IIH0pnXlKU;2N(EdwRy;3X0z4D+BjmlEH?6NXKI>zXKfXpm^$rA#ZzcU~e6_vpt-O8YtKPc5xqVa*+TLTTm!Rcs ze8u|m$M?DJCtmBYzE9LIaC_tRfF@k+R_{Uj+4z!!#@9jhw);isCmefU zkHC7}RIg0)t=<}a`Qy9Pt5>=I!t|it)?fN#TF!LwB-Z0Gz+<)n+m!M8IzIFQY$JfQHcXE8gyzyBdoBVp02i02> zFuwKlv+>>Roi8WHr+W5Y6aM7a>lbvsY*anlCpNwkefi_F*QIOKmE)^1#v7mYvB|Gz zuVW8bjWbXWy#4de=!(zK#0w$M>=N1&%L@ z@mU|6{Cf5}_Q3Jw28{1n`dR&6LF0>2y-1zA{^Zw7RKLJ_`KotFoosw|f8&qu0 z{_8f$+ke)_Ccj?epnBO&PVT=K=x5_A_0E^d{ntzN?7b%Z$**Vk$${gWrg}--J~pef zKfXm?y~^>$%=X4-eQfgUEeNW&z3IvEy-YtFpZ(pbx>o+)H%|4^{34ofZT6L?d8UTs zPD|(MZ*2J4@E6JCc=-KF)vwqO0sYdv>v&~_lm(7+-{Q*XuFKM(pzHV^ZO4v=-f`Qi zc3ZD)M{^C%#^+DpHwPD#DL)_YL>0*~*`sa2dU`ZvFwe`NvnGOK#^;wX`^GQ_ceGx?LP z%f1F^+f2XTQ;&u?H~F3DW9?nEb4-7#zBVwOY`aV2Q^}mbetM`=Ir&T3`+@jBTVprX z%hSH{C)+PJ+53kC4BJ_HpUyw6z_#}teOW&{Zg1(f5Lj>9`Vi-~K5Ag{+ul&Wz7b%{S}V0ph`~h z-s<5I`}XN6)PmWoDiVw5?+dx4cz=z&#d_ zaQ0UTo>#}&9~v|-{=!uikA@WQwJ|$!#rvy7EiQL*iuZ>k&D&Q!XV*dfHg<1FQgPF& z3A+x4B+bz}`t7Ygso0$tmOF26;C$;BmgCKCw@`Q}L$yyYVjTU0#?e1$925U$9Mu^|NO<0U8%uSq-)TMfpp7SF@7#knmdbH7IL$Z` zqRXQhM{>%+gH`)zewxR#8>^BRA>WFWmNlmc9KE7Br5q(~TqYG~-B$ zE^o#-`UUNeenIdsY?z8n&jVj)I=+8eFghdrq)Q!@);uKX}kX*dCTGG~v3sQ6~(CswT z*;-LON;y{7vU*xZZB@dzRzx*Wu2Z}>Ol|s0L4E05*8I4Fmkzo6Zgzg&(Hky39Jb^7 zediXH@2~De?60DIR@2ckJMP$bbn#1vVsjp-2uNg4LmHJswTwYWYz&OH@1bPWj$mpSwH)kx~6pYt`A z{E82B47a-X6aDtTs`1-$c6+bJ_?_arE5b_duCQym{?fC;mUZHGy7fZBKU57}=d`{M zZFiNZ4`meFx3eO2%ZJ*|C|&1l`*v2;agUR2+lN8h_F>SreHgTDAD+5x+J>+ajlVd* z;(d*OiGM%0!O64xGbdq5g@0dG-AUfBhdvAJ*oEd5?~T^6v||`m{D8*ZXaCt8JKf(m ziqJV6=6tOCnST4UZ3nz#^~QlP=Pg|q^Y>LxaQ3O6j&bt-V_L7BBO%&XwY0Bl=~&x7 z`i6a}ha`>cTyqi%D(v@B@}M)Tp<6is{K-rHlp>v8Yu=%2Ii zd}iPGAvNlsSTtvMR90G6@BU*R`Xgn{j4PHLTb#S>jFe{=jZJxb;h1lFo-^zGHOW&q z-8|s6j{l2WadztWEiNp1@Aac|QezrSzUr-SJA6`FvS;$5x(zN*U08Qzc9#W>OJ1FL z&W9IW*ZQT8TWy$>Ixw~056$|0vGj?4j}KX%*gv7(p|s&0-|F{l_!BMS2X5c^&Y`Q$ z+AueH^^(J5r=3;rn`c^V9-VgU>yKUXQ|kt~^}7swr}2_`_qTmv*M@=bMrY5wvCWi; zbC<;|Ph8w-!}HgTIPcIa+m+b&GhtVU??AZ0#>{;Dvw+xHQU(@qwS=Md$H(A*=^NptWWgq@& z@QOOajuw3I#QVj4hG(`)-W~JknRh?bw$BsUwZ9#8pwpDIla6+JVR?(+W}Kh#-RcP; z8#;Em`K_S^b+4Y)aPBvS8&{3KX6wWG(_g-AVW-{WN0*O_dUejKZjBNi8UE@`LmvO2 zceROEwjcZXALm_B<^HbGAMUs;F{0Lv557F}ll!-PckP>FZ>&D`ynFL@Pu|(==g$uP z)F|nX{hfMEe)gsE?0a6Qwk7P@8y2qRa?6SD~yInJLd(D?_+Yq*6|I5GkZ2MXDm@|hyb6v}Z{n!3?%bB@l*K{0I z`~6RT`{4PPwoL9S^4syl4=*}?L7PuLuRp%?IU@%D zUe-9N)f0WIKKbjWE83*ayYTnKsjY9E^|{mK#r^|V78j0wtL07e8hw&=?&m+P?fSp1 zf6j<`qs_2&uBlnD}D_xo!#{J>`f_y63m+KK}mGy=`awcgoD zh&*~mQSoh0-VnKUaps-hz5CviudaQj!3C{aO+2^m%YR%t{>#-(sw_NndvV2~+|iqM z{jjdVz5C|BQ+~tRjn9>z{rk*L+opZA_R05$J~*g;)rrgU>W$mJWMaKWO*5jN{9^8} zn-YF0pWi(H>Q^V-e&c|T9=v6G)a%bzRGARkeD-7SE*p~BudXDS; z)}=k3>G@c_sePS3=bdx$jrU#I|IA$n-nf7Bgf*#`IJsZU+%)=y8chzL*MG#3yT3o@ zqcd7G%}9Ip*n))y)P@fZ~9GpS3dRH!&TZhytr4* z@d;<&T-@dI1_$n2o_uA-16^;~bzt#`U042mZ}k=Lul_Oa(6?W7xb*s0Z*6vTZq%o} zntzp(|Hk22X}4`}T;<9UnKj@1_JuC>8r;))bi*tBsy+AIy}@#6(ED=IGE^YLq!#ZTB&_UNZS+}C|@x5w&+?l`l{f69(r z)p-1xd*AM`uT|YIJFR{(uTAS`x-{spFu8Y)=SSWUdPdjLuY}e5sVJf}cJj1)qQ{m@ zzG=h!4V#-xyzjH{8cRNkSikU@mRG*Jr^(oee$it_wEW`JMoIJD&R^A_N6M6QKdzCx z`My<~3#VUq`0^uDj{JK5oKJ>cT{G?dt?Ao(G>H7R#z*J0xvbOGpVoijwdkv_UmekB zTSkj2&eEh$4_tos%HyAp>DRk;_^yfTX5QcMtU=%1)Glnqe;)d}J%;p^% zrcQpXVU0&G?E7rQ**}l^XRp@f7>Fz)u>xyo^5(g&fw}7kMHs6k??a?4USv8{p`D6 z8vIq`KjK5*O$&XzXyCX_9Usi;ReR;i|JD2K@&9g~yZxI-V~32DoZh^-ABB$ie* zmRed&l(t&5+G@3`q-d+HqDAdGlNeF7Rn=0ZzTfZMdy|nw+xL6l@2~H2=2^~jp7WgN zJZHIgCiko!y5gt6xfRD$YOtt<|M#^of3fk0i>ub|?mzR@tl#^Mm{ONc2FlR;1uh)luf9|n5X#-ka%uLDn`Rmtj zX2(rzHseT^-RrdtwmVh(oc`rXi`8d_z4`jsH};$SKD)QoF!20WzV;?hcixZ{)8&A1 z^vU~QZm8vd{M^)Y-z@55nRRyP=(tX!3rEHr{OojWyU82wL_BVNFyYst&~_o+AK&pp zBS+!o+uP@#8#D0nA8*IaU0I`E!XGgW#;&|=4e4A1@wfJjkzP45Im~=w+%0SK zT_<*RdV82;Yw}0yT3x$@tY>FyA#_q>-5xx+eID5{AHc_Rj=QD z{#yOs->0|rjq6hX#rWNA+9dT^m^0tH>y7b$_jqyDu|1==^y&Xn$i@*3-ZlHpthmI=2=g~Ri3zL@U_ID&A!cl`Q!_q?zx%TBCtcu%xA(=)-_Dobmh(u)ze1Q z-oLY=|AuBR-M3GUdOKw9w_iD5tUKPdyj}C*zG08m`DpLY{;#~7y|%*c%S->#UH= zO5-jwD;~SQa@UK)&9hT){C>D-(xz_7cjIR-tbc#~fm%83e(Nye37?DyP1bImIH^sm z`*&`ooUgd$&V_3m6I|8TRv16=oTbk*pSOw}J>jtvBkLQk96SF-g$BQFdLSKM9?<%I z-=6};{^fXP)VkT{j`$v3mbYn0$eBe=gFX)1{#4?=Su3Bp_Wfhi-)qvk)vN)5hgTQW zvp0@za_jZ&9mhP@Xx!(A6Q)(H@oSTrtvXg5SCqJX*X55lnrtKf>QTiqzS`ZNz6w13 zN%-Sm9&i;5sMN9Zf}n~%6R-Q7X?S(($zG%1P93^s!P!MW?%VtKflI0V?0eQP$iIE# z&NDMpdZy@8y3W7QmZzGJ?>K+*)>=0fcChalIz(!_w_o0ju(z&! zvbJN_KEs;y-}l0;{=Htgf8l2AFB!M?f3kStfj>tjWh{N~P@kLAc7Al`Ue{suu05Ug zL(S)B`H#ygcyZ{mr2{5*P4BnUx~$L1B?%XGU%IyWess(@@8kI4TLL${kumLqs?YB7 zKL3Vuqj%#`&AT=`sH;8j%96b|yucDMXJv1ZN3KdSb_=2v|KZZ6n3_SZ2H^Uv-& z|F@}izn6~`Z0!B)H&4n#0&REan_fTozAmr+vC9?eFS+wlhXw6tm=aPByl>hvEaK_P zH=GN8&wsOjiZp!o`KVJHE(ead8e4beh5bn}mGoY}xA2=NDp{y>zPLyb;Tn-t`~tlv3ha z9ckU>=$>}mEA?L7W+)u8_r}S)8(&InJg#8LFC*&wyx^q|_b<->qe)n&H}$n% z-F)oky4}O_=l2}<A z$V{rz-gtRJ`|7`kj;Qt5sCBOXF~`?G`PG;r-XQTK1=P#s1u?U#d6E#|jg343?Kh5L=O$Bqj1^7iTa(t8*3yQChynAZQTL)ID>Zts06 zE~kI>XXWn>e_Xh8{G4>-UON^`a zqP!lnjwJ5-vRTtFch}CFbEt;%k8i)&b0APY`o)`9Hg;Q>TkWM!o;>mO#k0p^&-$Ef zc%Zd@bjxL*XGZ^-^JJrUoVx~WxZURC-#b01dh+JFE@$dT)>*x;;l0ZtlkY7H2oG8L z@~{=|yVurzaAZL0mi^yu*Bl}w&RE8$DNI0@{ZTKIeBr144>*tVm9@#PTu?3>1NXpyLiF)&0Hh^k%O`x7e~m z_s!wH!{^@E_WreL16Q}KH1Y7%?-nf|zUtz!ZXeC9o@+}8?)&-VPrms4vQO~S%}mE! zU0!`*hBg=XU)0=F@ZD{4-(D{`jg(p8HF8 zY1{$%PuI2Y$KE-Sn|E>0YmLLb+dD3s_ct5XYu8f+GmaGg@It@KQx3FQG_HNvar36^ zCeKw3>O3`FUnkak^RZ}0gEe=Xm=~w@x_&t{qRWh+W3fj^CGSo1`!Qx$gKha2Y?)ua ze=@6mW$!26KXbCu^6G!hTKoVPpDFO-cPz4GBlu8HbO5=$Jf-*zkSrw<@I`wbUtxJl zS%p+@f<*%DN8l$4C||XJ)CxoZk4Mr;Q4YdE0*`hOrVG58gU~MU<_^L&0*`U<2dPxc zvV?X~MIr&eYeIVncqAK)CfJFlQ5faL^?3%#gVT$-)4FAs^fo&dxn zHi-4Zr?|=!%R^2+l1^&oAUrSdXb0gHfyX!q756kR;~ooIIR*(2rywORtr}(x5?MnC zQUz)w$Pj1}0X>GV3Ck;MRip?MHMSBpNmOGO0%g1q3wD2zrTt>RIHKagR_rJf!zH?f ziJ9dqpvie6Yseh{<)_d?ve13}RT~=Ohn|TQy)$HGaYvPD9C=oVPVGt%HQpFMlE$v~Jy^aK%32q5Ak$?@8r6dAH z`4B445Xy%TDE0IsV9Oy(kSEX~to@#X5-5fw6VNq~C5RB{5So{zpahDgeF*3~$P(-j zXc-sg!Mq)cr36Y-5=)wr#HJ|YFOl}g3Y(G$l&176X-X2CqS)V$_U9|I1WHqqOPZ3z zrYQC&)Bbp2UJ`-Qls+X*Nn%qJ`}qeU;?hP3ji!lS(qzfHrtUf^$}zt8KmE2 zn}ZlXNKrln<;2g}%dxFWae+Z41qR&!*AIotnNqFD%0zlZR=UUfH;BnVLJ?>>ONGcSWzZA zAf#H6WCa?5ggJpgDUb|ITw1+;plG&EnjL8cWW~f;ozlJi2yP(hr5R?iFWf22=tn@U zf{%Q0m7_PpiX2sMM2X(M)XNs>rRj=Z#l+&DacQbpBo#?71xgMg844jgh-4{*PRva! z6+-VIvRNSv4k9}h!ssA!P$5hXA}18WOYHs>djidl2pASAj6`(|V2NA`Is1%lnOKZ6mnPEb5;0gl~N}41PPpvSN z7ADQ!M8pzsGx~_zjyRE(m;sQ5R5GvqDB#0DfpA>*pB)v54S;vP! z_Gkp4xU@!*up%KY304ZU{~7?rBIA&wh?Q}s<^*<_qM*do1Ta#N9_dUwGFKw$G31KJiX141`v)2I{+7zs z{R8Dbm0@a(r1$R@)W-KQUtJZ5%W}6MM02RrEvOZK1YxWP1mma@fZm@{s51;j+WGnd zH52vqZ3oo5Sdo#6e1rxg{%RrsR`@kR)fG)~RaSSbs;H@7wS84ds$i6KRTKuR@n1Yo zmZF1R>{vArgEydwtjV?&()eRDN(Gkit*E%75jM~=<^|CTjlhe{$qNaB9$%wke5DEy zP}&=d!j(&Obqk`lD&<((Er_;Og{_rKlvj&+h^$^yjt=TmxxeoK-+oY2gSpYDye9c< zyOvXnYM4{oh^9)CHAa9?6sSVF4tyYr;HNpy!5z9P%R0iJVWsUd)~~AA6<%zYk*%#) zY?mOV)A-4V0bPJk_>|M0wh(S2i7OvTcLN`-h%_={Z;U|bgb%|&d{mT-9Au^>d^|vs zGrevCcp1!QC^UO{*8rFbj&8MFx~##68Ze4{P0InfHpo-FYO$QmaimPbgLi|Wn_oe; z4HQT`K1Gf)9SlB3?qV%_F|+-h5a9rk0=Qq+|6y4`25poAds4oeTv2H2M)8U>1ZyqP zr;E{`*+diYvuPB1x5*>}6l?PvD=E^q^76@wmI$V&ft!h1xyr$fI_va*p9WmTnc@ zT5UEygu~VdQil?}iPI@0ev2*5A-R^-RyzrDen~Fx!m>+p`+-onAggwu*N{} zODf}g1(eF9!0jll8>RN`DABhfBuABmq(GIB99t5SW9UvLBo$PIq(H?V<%!!xd9V%* z(|sp8btxNATGaH?;2!&Iq zpwPR916h0*Rt+9J{1FiuKj%A0!~x_e5YbCpC_mZ17SHJ|ufoT{FR5?{D7BZwAmO%A z9*jSkl61F($3BCA@aHYz&p$v4fBr6VTj1w*Z&3J;eQ15vOpv=s-lj*Z8nF}zZ{HCk zYCCd;zyB2ewjp;m1LH5Ms>b)+h~B;T705d0&>kn6QddsIsTy@%Kr7Ris82M( zE*hC68rfTI>MXT+r_0Y1J3wU@Hn&H3Kc0GeK$2XwU~JKT&B; z4(P8)Pg0sw1Dh2-&eEkT^zXcxQejk1`af*-uudO2W$M^T6RpwBnnX2;wnn6-O`p&>eafV9BS&OdV`8G4#f})& zDk^GZvsSI5Vn;+rw;a`S)CeHMV@3=c)?!%8s9__Ujc6csY14GZq$%T@;$Q;2lz!Hv zsY7`>L(`&d+b(^$`0}cc+`Ct}KUscxFTTIVFllq+<1DcVfaF3+C&}^Ff!GO7l=zdIiPv7 zp&5A1Ylq&wI}8|_)NNpwp~(YmU4{S4xkBT{zc5nlvqgpnsIqKU%_B45Kr~ zNa9$E3~B6i{2w}L)F^49G;xH2Oqw`?2R%%Kho|uLhLOW2422s;jK_Pc{=bOw4y`eW z#Jjj9xhc?27&NUVlaE&iv+S+&mjYyq9H^^k2$n;n%K9pDRk@n3mRv{1LeG)PTUi6{ zE96XnKTPS$ZXJ*pN3=GoNmJfRM7=n|JNsLg%FpQ*>lYao8W)(dy|T>8c1D%q=uT%hqQZl=)uGcKVq*;>|ODY-Q(x#=3Y>I*17;oyIHnTBH4H7~12(@Kri$~5q|C{McwQP_&0uUc* zX&JN9M^0@rhK<%nCEi`mbwE3hU|Po5Gzg$miv+KU{lzSPC-E`)M@>U@)#%Ga9UpQx;e!bjXh4YNnOnSfWM(=LMYCTN)Q*+F1^>4_a zO&Vj~ztP4DCjDl)yGeh3PIqGilm1=#rZLRa-56-FV~ zy$fUoeICdd{dwR)J&l#;8;xB}`h#fM|6T1BP`myrDlm67*6M{SSEI_>dN(-LdK%5o zn)Dz4AJ=zB>aJh)Z1*0rwyJHe!PXk9@^P3mrJq7PsgF@FDF#9x3(|ARCS1C3FJh`J%ogWBE< z#z?57MjI;n4-wtCyRq35CjD~gG3tMY8mLB4OD265Stk88c^;`3=jC03b{l1V_&m%3vv*_o>lfOaO1#E`FGQ(&;(2Sis8V{aNOWdAzf*rca1*k)`)q2OM|CS8rO zFa|cX5oW}ehbv4N44MCqqxCcdfuNr`uT+eDpyM2iDbu9?WHvqy>fo|Hv+?nT4s)kv zp0U|J`hD|kRH{F(6ZO^>6I%#e2>`%4{^?V3H0vuOcJ z$vqKj<3xwPqsSitH?oH^*O_`6gW`?V6JX&C#tjthgrZVCdsDI12gc2(t$)+jd8h*c zF;@@#LFPPTLz8}q9yY+{Tbb-<{qy?n#t2NnYLIhsMS-cvV?FmW&214KkO}Ew+TFdo z{!Zp@mRbgm+*5dqOO)r8AQml!V~~D*!1t|{T==We|;hp)6n&5wr?S*k5<(B!ePl8fI`uGFCCI_z=j@eP6JrI+x` z!Q;|PxI^{0^u=$hSD5x%H)Q|++$Wm`;V*n)KwAwdY!_!xQDHX z7PJ$T^7ynO{5MjSC!1wFNI`$1%4_*}S|!!gnps`RjpH&!)b~67d6~3av ziz?gzLzq7V&sz!KRpHMnY=|eI zh<@6r!a^0+MJ$n@tinku+^E9iD*Q!-7Whbqer>73@hV)V!d)u-PKAG}(26#)9N&{p zI9P>nv!tt}#5uo!Ko-8uQqG&uVH)8~Lb?tizKX1`(#;8jm3KrlpW}d#U$+ttSK%bW zAm!;2`72cZON8*jW|iKq!jA~i)&nYiScT_QzDuQlQ{i7K6mbmwfs9{3e#b*tUxm$7 z__zvtt8jn{hpTX+3LPqZO@(57K;I`SeMp6zmsrn575=EgTPoyT81uc(gs4*6QI&TDs5F^BbDD& zrQ4`97pwF}6~3*)y@b&7l}aC1A>TJlJKZY0NeDf6 zRT^KYi+rmJ#d+zNXIhd*yE>@+E-GzPX>pD^@`tMQ2sMAAN>5Sg*(yC(rI)C5u1deG z(hik=Q>FQR8tear5cd3_LUH~&<~bebb>#aKqJ0%rx|T}UQRyZs-Atw1sdPt`?xoVb zReFd@4_E1lDm_J|=cx2Nm0qgS%T@XnLfE%gg{KHH8M@T`p9o>^uPS|CrDd)=Xio(~ z zsu0to7_SH$0kP}}h^bdVbdi9V$_2ElFieFJDvVTNlnP^17^}jzDvVQMXBEb)FhPYj z6^iu&^GJV{9;CuCDoj&hx(YK?I8%k(4{;u{t1wH2xr7)`D^<8gh3izfMTOf`xI=|I zRhUoc2mh(?5Fys1!zw&Rhz)H_q9GYL^&o=R^fM7^RN&@bA7db@C4LOo9rLcjQe z8+uUiD9_(u8hYFzQ4?SDI=UVF4SRDJee_VmXx63SVq51&{6U(O>hR#b8* z`9sG{KAf)|63&Ah|M|pjkJGRJ;Q-KL?dn$&JS>~y<(p7S$n%iuQpXZ&-)a;;w$+Z2 z71~Rm8>`Tx{`ExGVrw695@0uDNAcCtzc)dM@f=B>#i*P>$y)#EB*!QW z$NzjSz}^bmmEtR`C)RTh28OPtNwf1rj_OverbiUSDRSrOW zqwc9M2Kw0X^dD{qi}lg>&{u4q6&2Aw%J9JtB>m7tnU>%tD#ihyhgPdo*86NerUns|Nyl3(BODgp7`HpsJ`s$a`m*t@kOH#4E zdnk+l#r8#@!&nbxcxn3hYY9*LR(j|QR^?cZ&n9S&Ha?=D?>uPj()95+Yo7Wxd+5Wh zaj|`$DEf-+^Ft-9hcdi0eIJ$5x6?yk6;+Pq_^ij%zF;tSQjvOT`mCkedl33qo^i$d zbIOta9SNev_8kI~e9G|B^!*Clv%QBs?5m;5vD_-OgZ2T4i$Ce|9GE0|<&~C0Bjc4U z@u}7O6O>V(c2&W?WV#l7U}|~1hxWAZJnXZg4z|~dq_vm7h1bdem6k?4d=`wB*A0k< zQ*Is}hVdLD?b7nNH}b6aUT6Hc3o*@l>mq6Oo(8U!p^hQV9%g8HC&2d9cfLD(g-q%T zN7D3NR*Q44;5DQJAq}tzJ>Wx-=MoXshR=r5qvEadTcD0 zCCc!9!kOtg;$4$B@-Da`Tev7C$GyassRXq_Z`bO?wghi?%z@_xOM4H z*Dd=6_n+zCxMkqK=U;H&1#SZVhx3B_FW_e2_W=C>?*sY+{tb9L{es&I_ygb=N>?e* z@~lJCPu;F4)DwaC;zGW_cEPQW&2tq>DBE_vD>*91ZH$@kvPn5^X~%q*kKa6(1-NXm zyPmCNDl|!UR}|W?!P32OCiuRR)tSM3i`8lNb-15T@h(h^Eh>^;hHs@8#Jg9$b6;>C z9^a`jH1b%{bsvXYA9bdPc}Cl@A}KG=b)G!fa0&M4V1vkm4dOkml(FLdr&04=ZrEz< zkN1%JWxFl|Pe8rKWV@>fwxXWrJmCZb|yv?6(t&ASLQ`w zhtA4=K3~LG^NO73k__`)cOo3_{yTEqd@nZblo3x7{L6L@Gh3Z0F`>>3%X+trxEf)w zI(>IoolU*;g};~*Fs>Rotu?+YvY{TG^`g)#*O=$Bg%uU0OTS=hM_s5h(w^fEMjY#c z=eo?+x=u-&>)Kny0qSnmlC6%Q0LeftMgU8vG9SR3+%1yq^;H( zu+@6{A$#w9;c(xX;c(M#zx)@RF*fK&e1)aZH|OEEQ$+t8UfhPIzBGNqg^N<66ay&vM!Kb`M!y;x)#1KZOOr-*%H>H_cs}GbXz)z{?NvLXymCP+7p2` zu^pzAQ%e1j3tWk*MMc329q!;(4mabI?^_Rs9(@$$P8UhJcz?I$c##Qq$(DJpnvHdZ zW195DyVDyudn3+!Bc|%4ohq7Q#e17=ke7}Z9d60K!gxgNn+9dObk^fVk^zwM6vnpJ zai&_=yBSkDYZGTmaHvy%JETxc=Hv1#e+fPRjJlZdxcv4!~ewj#cuH-q(|e^M|P(C2=bpW^b@yOZtf-JN0M z60ba$9ph$;+3wng{Q02c)7QHD0p{4qvgEiqHu_>L#Mr2#Utwg*dN;?# zIvaeI4_~FgSE#QOd{qPdnU?ift04K=Bh}abz#FQ5_6FWW^|3GT2C9FbgU`0AzFi9ZP2lwFV&HE9r(d53{)XyP z5lfsS?RhRdOQ`09Ha1dy;t#x`>JM+=O;lg_0&k%D!MfbxjFiWdM`#J6yL+mTY z7h{I;#Ms)X_E9$QZEF8`!53N#aX#Sq=J@vm&REjMKI4evzAb&lxUtedQ$*b8LbbS= zR~$EoC5PK?%`4=b$MG%8cIP6?BBxvtYc}`>%UmZ?!FN#>=$TrmkIu3fqE>|HqUFl6 zwPQgrbaSk;F3E!Ze<YiUlUs_PdgL@CI zw#9>|JNTW#Eu>3Ghmm5DZkX{s4AONk&r-QUUg;_h#3Gt%01UY%bhO$zAF1=M{e+M)TVn<+(d{?8{PJ zApq~={BX{J*|Oa2my(OK9G1JIYwx=(GiSZMmq8Bcp;wA_}FmfgKX_wAVuZ4%~r%)eq2FRl*MfT9c)>5MYh&)#;kO> zdtWIkirVaO^Pa{h?*(U_wr7g`ZD)&oQn1Iu{(<}O-dOW3mmF>jtLv<1 zi@5IVtn*#ws4!X*x=l(X0~oGCKILuW#k%an?Z3bv#!aP>pEeqr3FEWkMv7mMnrofCG>NQW%iIG$JBM2?XW2|)EQ~9V1HfDnK+Ys(=*sNoh#yflrD0ii+k+| z_>_AJ{gR;ywMeXg@||9Q5^ zfPU$XGVDL@#h6#8EqrJ@EB2o34?X(B*g4D9wzslx(^*dz8F!$4)-0D!+#l3+)<7GF z!8gOP=QJU1gnfu9eN-K%8Fto9I4Ro9do;Gqkf8Jr`=&~Y1^Yqz=4_EECDh5f>J2&r zI?L4;w)I6nO;5pDIKpnqDD7gL=)$sGz8KRc_|Ra7O^6qLR6Ws8>?1GOGGb>PXE55X zvo><}9)o>#<_YLP|BgXFXD)E{PAw8`Wt^H)a1VhqiFDS5F2D4;P7B(_erJCr!H0}9 zEuIWvlyrG{A$=NP*9QXLym}8O)^@uai*p=<&(7XBj64@ zv<|dRrFEe7p!F)P2d$iWqR1OS8wow6{uo zgZ2UKqtZU0eL?%Gv@d8s(0(fI2f7023MyRzv_EKnmG%c606IXW13-IA>KZ7mbX(FF z;@lEIoFQViu5|lF0guZP3>xcd}@|&VW{YeiH5ESwQsn z3Do83?-Ql`eWH}VPn7aE&bU#_EB-!F%HJnS`TImEf8)FxwY=i*6Q%rpqLjZ+Jmhcs zGeBB@g?^+z=~w!9JAB#=K1GAYwc{=0LucM_uN8p#182WH^2{52XN7Umrx4G>s|Ehc znKuD(QUSJKkS{r##`C-zjFGF<#XUX8?|(V(hB`~1cT-j;#yQTlDt*?C(!Qq(>y$d{ z279vq(OEYEIO`@rw5#N-8zbUSJI5ygZQ;G`Kb><^B-)NPmvhby?cRrdr<9lHT4ct( z%Z?oJEL`k0#r~J`RIdAuj?aXZ*snD)r@(7=PQgKGK|$rEIR#ZPhuL9AeqxUMAkrbE z!$`-FP9U8|I*$~bm*ajlj`zDcZo>+@Q??l~76-C_eJpr>$o}zz4c->6yDwlYAzAa} zdtS;jXO24y>an7H7WV&PxjD-7$~^c0ww{Ju4eW(j&Y-tDpQ~thdZ{*x`&sOXXw$F4bM&jJ4#rxu=eaf={C7ihAY_>*$<2`FX5ua|`xJt1vGlx$;w1VeVh(u9C7) z?5pY1x$^VQC7}z%zItw8M`w9^Yud@ZwJBGz^@>UHO_t8?^r^U`C_NDNT5>TKb75Pq zI|KC0&>VLr?icb^S&k*Pnf=K&Yq~b8`TwTJ?pY`5HBDg5V4sdU%~49dX{fJ~e@=nF zWWU0C%vRJBrPy4lR!#xi!Fwvr-{~^$X%SPh6jCUoKXDIK=$(@1!V8qE1?RC(2NrUC z`>Az{Sg_$a2I7I|Et(KJqakZV+xR@ilRpf68GIkeiu&SECf87~Ii2g|z(PCvi!rz} zoW2}TxWkBNok4T)46q~y^T1`0lY<<#ss* zAxCmBAFj9(0G$Tt@Ur}K%-_;0{bod*;wO4nE0xl5TFoy{kLX7!%c+ea#yDgBQE?su z-E0@2Jz9%d%=HEk`xJP09M&WtmLBy#~N}fxLcQ3?bTh%_sMOYm6hgfe- zSmSy@7F*7%o;<9#55>6w_lyy_IR!?HE6JW$$a_cnUbZj7UL13X)W2{o>fkebInIo^ z*e1rnN07(;)gk2D;WxH*kfGkRV2qHV{SUD?!~^k#Pj30rs6wh z>=l$XwN{gy0^#`g6LT8upglgY zg|W$YnBXTqv!OlMI~VcHJ_+X^s(VA&v!Ea#MJm9bHNl>~;ykio!U)@_&RPK8)|H=D2p2uatQ1Rm%z&mi@F{DelS=xh? zhm?twOcB7%MkTES zEkm069&gvaE%EAAs#dFO4Xs0*b%?USQB^(isISdqv8^>-tfNE6PH`}!GV>cnG-wDE zx62P6R1C5N`a($n3RSIEy-LkmwQG>aJYH67rw%>4BqVg}(6~#dj*Y{cr&=Szr#5I~ zmH4I-z754gqEp9Co)Vrp$-Nun9Wz?l^kGw{j!czC4I7&VFnV-!Z1SqHQ_cNMedDk0 z?G)QKt>M;Rp1m0U%@e-2Gd4x z4m`N=mACx(&M~ZR_&((!{7kHM(vZbScpN*QZsh`Skt; zZPI>@#OBFT+6U+IlOG#!HvSB5S3o=EXX?**wte@?3vQ5pYfSGu6)mF=_qhG)^gc6w z+b}20G_&$u=c!KLAF16eY1xSB%l7Jr*sNQ&O&pfp;Lp7C{N0WfDGVunUgY)n>gT&J zW%p}w)$gqib$=PZqD$3RLx1vrvRBQK%RgE0;oC1{UaNhiUDWxZLq7AZ_L{5pS0|qs z{P-Dp;P;7r(|SH%;iXZ39p2G6qhcfLjd!xv{*dtX{+Kz_jT3gg5&dmt!>Qo@ZH8T} z9$2GUz`9CFRc_Y#yYta^54`{MvM}?NEh+cL+TJ{tH+$pa;j5FMs`aAtLF#vwgHrsa z+tbcHr@wsGyZwcg3kS{DebYU+`P9*W{I>qteFeQ=K3(rntIr>syJ}L8puHoS{5b3N zC60-EmNxkP&kvg3-#K9B8q>IF%fB)9u{;%C^%lRj$_J@a?t323`s48|NC~ z-F)Ag)!Ae2UH3UVDQWnoCg!&zc4X}Tq-CAh)LN}0UyE{gzQ4#Za^d(}b>l7HCg%V7 zU0$D!9qx7tI@ol}2W=aD`ry#3*2Plp6Te*D6=M44{fcuwZV>RHm*M4=p`$Jz`Kjo! zzn}eVbE|g}mQBo=u5WyCRlV7t4?2GH$*S$o&#Kw`+HVtv{5AI78_|9zjxH&f_D1)9 zS%F=u|9;7T>YKk_7!aJcJo(tn^ulg-+v|VKSg~M!!!Mrt@#h!h$74HGntoWg;2zc9LXm5FaREy%8rbYtDftDD~1 zaNXW`{FX*7U;Au9&*t|>^ z`=>5*r%uRn{M`LOlTYQ#;qhxfdheM(kL>$la)WQuf>K`|u|B`Yu2&ZieW&uRJ;%Eq zZ8hYHm3QwwwfgUY+uA1RTl`k{!@=X0pA7As`1$PC^UuGTIis(!`sR?BS~c$Uwg&(B z$%RWBozMOH{nH;8#yy!H`Ck5|eplbBJHE@SKRsD<`GU7IYqvW;#P_w-TeFLfv3Z+q>OztZ{zUfTFz99v}xLNm%T46 zoc~Sk)IZkm>wWsr=W{0ojrj3($DRg%Hr+YXR5ba-)SPrdlyyMyt!&*{&$UpYwEz4_?ho-KH}UaQAe z_1N2F){==!fB)eAfHmW~?hfzx%3ZHMKl^kW6T3O$nJ+&ry!FKfxo(%yi?@FB%irgB zubH0Qj8nt^=qgh_uuk*NeMZgruSy?T&?kxB4J6FH!9Xb9PO)ll}YnG6&Chu)D z^{pG(vuDh$-6GQKv0>&@jn`N)87JFU<=c_L6mB=Ja#5eeo;Ff4ya6i3zJfu@uf?@v%dB>Ur)QXsA<-^f}Yt&r>?u) zqtT%CQ-6K3@!<7G)-3+!2ipSWSCVSMq_Go6r;W7Y?>t6~w@#Qky0pGBbg8wI`wi|T zunnn>?F#-nzSQ+E^4Pl6^(?`ChDI~E@I0G2M)UYfl~CK8DRdrB1H#~#Y1DPp*=OCY7@ z6xWdoMg|g(1X=``tKx**Eb`nR!ZiYqEs{h5b}$A>L-lFQy}Um%oKQx;{>1?w`SxM^2>h86LuDOw1aS+ zz;VVCpat7D`k636;LRL_SpskFAlxbN7{_@)1BL{Bn4%63;^+x+X`z`4Dgya9@IWpW z6oe{R9H|m|nvyH=QsBdXX5FO**|EZ4d4A)&7xhF=AG`M6U&ZWqi{5Y>$bS3hJ-hA| zv-f82{R($`YS~v`zyG?CLhCMmvy@y#<=vwz7Yg0$&*uGhznHy$+1Ys|72KcyvZI(P z&sq`JX!8og|0ZdpquoQA{^vU5;6EEu+kepW?^>xL8R@Zq)MEQ*MO456{rEpBnSD$8 zXEjv8x!^Gmxra-vF#M|$DllMzXyvKItaaFbP{6`|NG<~Lx!tL8@LNR}#LOFaxtDP+M~?V)kV3PU-96iPsTJ|$Knsm{}sm6^yWa|@|d zr9y5%Nn7ldY?$Ec;q z&PRwrizY^q50TV9c&JJ-J~crK<(Ji`g|j9`k%MK$&<77`qsTp^f3226+@Gm~qO5(h z!_)>-Y7ur(oHQ^f;4dXgL{Esyi$y8Mt5r8cZ2bOOPkfL;^oiLsIFooB_uuQtJSe0=Cjp zd>PtlA!XCH*|=NbE}O#@hdU7{o9x+DN*Cs@l&T1^!~}r;3R+q!4eVTzW!nkBLCf1X z0P2;+`!hrt?)Qisg4B6YAkhyJN`W%INk*1kC`jZcKN$g0jt93PYmboXeFK1_vYfjy z{){$KD6sLyfWcahR0`O3k(IawfFr4#8rcF1659xHL!f=|DK4#zB=F-6Dj?`A(0&97 z3KyT^@+`m(z)dMZyg-u)lmhtmmU3wYVnFsslBL0FPVttWQJ~nBTskWaj4ULRlzvRE zYbbNyFa~*)!5Lh^4k8%}VHO9a*|i)ZR0FZHIq01D8miBuPvO zH51_zPO z3Sn{3B>rsAD5d+A<1}`d70HO*6c$FJ5h{rpi6}eEjM*8v;E;+%@-60IIwgY-6v*r^ z#K0sY4#`hK$zm=!W=umK+&^|X9eYLq_WtRDL|=IA=NJnV2MD>jPiA0 zd#skn6sgkyafpQStVPx(Atlab=Hgk-%xeX^vyznpz^E!mDgkUB#(`?`05&TqeZWiW z4&FAM5Lx1!UZ;ZI0LT!%QKsdWkabT;^^Jr?l#nXZ@;I;uDOqU%$I6$Q3HBn9mGmJ1 zBfFf=p}7_$b)kt9=zz`uk|;2M7%#0vi(DU=$cpcw$$;9KP+Mq)dKrxW)8P}9F2 z(MV;=q}`j*s6=sJs;4$=eyC8fsmvo%WT-YJQH`>eB@rkE$}F70Y5|Obwpzu+S)E-} zmrSq{NiSts9ITst!vO?9t%46!T$*z{^u~JVjV;mJk9yf697d|>rLuC)aTi6PTpT89 z2a>B0vV%yTLg*Ysb|{42K_p)x3=Sg46v8N;>N*v|5cmxJ(j z5V0zRkAp~*Lijp}#3_WIc<5_WhzbrODGK55Ad;>S0piS2rQLxR2S+KN-H65!xvmhh zgUCIF(23{6R`?rYdIymxg)lgX#3_W)LBysICI^ueh42y&mD3f%>>y%S2yX|GT!rv) z5Xn;rUk8yL3gPDO}z69O%FT*Zm3 z#7qD?k}_t9EkeS8V|TLnzYeAd2t|rAeNq5Yk;HkYJAr(t5rE>-f|rC939|%2u0Z>* z1W-)w4@_KI0W&BiD_PAco+a2`8h}9+5eH~T!Wb@5R%Q%)ln5&+(XXULKd2CwRy|9w zdemVR8Tioh@_@6Uk36Cid7ks$4v>#Hgf>iMB@)CV6`yyyMI!*krPWQsiiEX+fO7wS z-f5nYDl<{Bjf!ng0TY*2jRjN$5}F?s2bhP1`3axmDn~3b4mo*9> z=XBWEVkI~Wnc8L|L5{$QA&SOX2(Kf7O>j$P6W&1*GZK+4Vp>in*kKe!!w7dG!OQso z2URxV35AV%#HF<=0~D39U!W*Y=C{=!|Zy=YCM$}dlg``6IIfz;`(&8Y>TU8+(Ebdxq&m&r`sTQrK;(MZ=a$8NU zO4G`;ntg3R1o3-5JD?5yUfy?pd}yIWT3>?mNNUh2A>EfCt^AOt@FgVdot|~v0m4`n zgzC)V;Ky&X#Us2&PB~RjGD?&#XUbvq86p#Bd@lmRVI~&9()G+l#uB7Q*0Tkf`J%K( zJ@P*u<&3HxagcM#+09-hXE&RR&u$inKznOvH~SRx#hK2^QO=%6L09lNm6(SY`x_M@4E57dyQcrRg2NwskZk*XHh!Eu@=Sm*cDVf?K z$dysCayYY)ufo%mONv*0_)O$##b-4ec~*0E&)K-$WR z+4PbFoRtHe>-yka=RgecFpm?UMSbBVCp_2lIN`Z|NwqxKnGT8YQGFmu4K$Q0rG^$U zb~%DcVsX=!?M)KqM1j?s4lFg%G5llU}C#&{C<@L`s{d?0Q1GS>na4UYVj z5d#=O#8TcYg#l)+qvcLga?SNM#(b3#sWDb747_Ck$1$+r2;*-1m_46?6T{QcQu)Ts*F!HthiOU>e@6;6sQz(vNSzupoEw7l5sL{Q&)T#4L;og zoX#~R#iv|RmV@|9b|5@3BxtV(o=-eT z9tnQ%e&QiA45XC--1pg z-9i2g`l=G|Njgr{U-cQ_omsxKe2wKB0Pjw^i+mq+wGiaa{>rZ^#cGnNTAS zt?5YQTOhrFDB`gcpHWu)wkF;jT~Z>RLh;P9;sYQhw6A(dd=bTGmlfZmiU0JF_zsF^ z$=;=H55gZS3GJi{1g_o zs@b4LtQRP;z87?FmM@UKfmSW3sQgYqb_snVmd%_G@0RW0Mp$`8JR|}siH8V^-zzIV zLlfVkiHC8d@F80k8Y}-@w#X5!$OEm2FesiiNV+ls8V+v@gL(idF=!0Mb!EjTYvQjw zB%VugLs{`dn)uI}xH3T*=-$EC_-WON2`V^5?I5d8Oi*1wi%tqv@|T0=!6XWNl2=BxTbefT(Ro@b&F zN?6syvE>Xjh8w~Ud8b95#w`v%r8Otm6@yJwKS;55MisR+gOt{+2Q6ANSjqnZv}nx` zr8Tvy;usQ^AFAui)*J;bT9=}FMs+NP zM1BXSDv={V!hzIy4@fkTSjaq1WB`zEK$H%6$cky2g;M>>Y|0yAbg9$e8_F;iOW2!Y z*anH^YpYnkf_cP_{I<+VGPo1*?V@n77{)u41+_c*?qjyF1--h;-_VUCovY_4;VwWok@PZ+KBg04xk96zdeN}e8lA5b zja#G8x@8e!(ORcxPgMN~=7`>SNtjpF1^Q{K&r#?pSQs)r=(j-6@t|eAWkR%Hm9JS_ zlI+Z1r5BryE}$2d&<#ZI#TxkZORPJXgT&Xn@&>)px(<~q>kb#YTgc-2ByZPO@YgSk zaEOI(G%Do6=dW89Ce}STL@yS;1muW?FB=HgyBba)TmhAZ&##up!pD0XVE}7^U&X@b zZ-6dG$;w9|k;j!!^z9P&!<7wVtR3g^p`amAGuOm3ZzGr|4`@RQKVxJDK zDqfh!z-PifR`V$PC{(U}oEZ3&B9#pbHYn~Blf+z9!bw7D4krg-`0HcN4*v2$&J6&Z z8A9c!#JsQ-CB(dN7zpPDDU9m*a6+iB>#6?7e^j5Ws83eZ_Z8}ctg8ALAc}f!I?@p! z+>^+y4Mx%VCEE@@vn$zfOjkD?`GRZHk>=*a4_m7esb|#bjCT&4aHr$5w{9jrZ90+1 z&O{=YD@meGnd&s{8Spe^HSLQ8{jeWlFrOM`i4xD?GfBS;-?Ip_)}U9k1uc3Qjo?VaYN~c#HR?_l>(%69=C?t#hd0e zNb8VxAnio@5J|hr%Zr6i(vZ@Tw9Avnhx`8zckcopRdue7uRS|^GE71;gn$8~4iGfl zk_iL|7<7ODxdGv#qGEIBA_3AQC@5+SLGgm3wMT2E6Dw_L<+N#QTZ`Dz*5gN8ZL!tX zR;>de1+C|Zs4bp)>i>Dxe)nW&GNJ7`zwh_^pKm35J?mZTUGI9=eeFGK@5Qow!4*!v zRAJ^2LBm^6nzJ^<%9SfW8m^gWx^2*tmpIkZ(xoecxf6o*O|_fW25)F=Xv+p=wSee9$8khc29%`F>Nud8j@xOvmI&8^i9wQaSl2OfOC zdTMAY{tH5@>$a?KYN&S3HA1|`+Pd{qZkSoCR+KGTJhys&>D=Wj)Rs-H>(_2-YzWpv zw5qP2yL|cFtE*R(U9+Hi<<(USs;kw)6?MF((wauAP_?dGzoxBKt>4tpxV5oWxh1r< z)NX2R-rNdrNB!!y#@4p##`?PI4UO9p_|~s)Uf0-?AOL4Et=|;qUtd>Wz5a#-o&#l* zHKA+rO~wguL- zsnxcl2fYYdAWxA$ueQR4|6MjD1pl(uSAyrloixp$iCv?@fZB?6ERLh2e;q{x5 z%dLIM#UkqCsvIR^zV_K-)qLxp#el1BJ(@v%+cwqG*rt|Os1+4zeZy9@9!=t=M&zS$ z>-q%J`%dLTxvgzmr#97BZ(g%T^)LI@wwA`)jn(=UMHFuHmNvC{OB(@gVqjiGIev~{ zfZ~0pSPc?{7BN_?`Zaav@&iL#8=KbXmW`c}E0J^dDOE9FZQR_@i2a63maDeLjm-*e zb^Q%GcXeCVsMeNx)zI3eFvirOkErX_7IlL{-l4r>Bl^EH7R{Z7p{|zwUm5vu&d1O; zOL_gtbA84T9Br3w1dL&xjHFCsggVd6GDaDrJr^2djf)Kqul)He3BP|C+tcs~qrRaR zPCX1eLosRc=h7jD!*WSl&V9x`p1aMvl6F~ldhbZy>FXR)l6HhMLyp4;3b?v9gJgeldPE~kbBeErhov@uAUx$gY( zo@fxhF3z+oQ9wy*1}06zF#ei0l)xF39t&pYbBxdLKgQ<|9OLtyF+N|KbH2o?UmZE0xC$3!uuY5k@x zTcY%#=4-S3zT=j)_>kA^zU82Gf!BQ1 zQ*NDqtJgemOSzTiHGc zjC0sz%qBmX%_oq`Ft2%EWuMe;C}^GUSvk`3n@_XLc!2KUxgbHZbyV6<|m#rR*o0>_}lg~ zPCIc5aB&Mrk_u_B^+(m1});@8c}DHIA}x%y0$ zD}*qAKJ$xgDE*p4!t&XH2!GV6e(tvN9ZXi#@S9)0t;1D9XiQZVWtC-Rl~O5ap}JZ3 z)r^0M&F^Cgp^Q82wrF|H-KMYD>#58*cm~B}zQ5g5gb@M09iFWjz7yr;9pxxD?@n~K z?Pt8^17^9m!&h96!19iR<(};s2q%l>y~A5xeo+6Jf7xgF1?*CZoI@R-Ytms3&(gy2W^Jg*DFGVGZ||B7t(VXM2Zbc+Gt#GGaG2R$oYW7d-w0rA1!zTicm? z^Sd02es&8q_zm)9er@}~enaP*P$SiE20E;vORZG%CiEuDzsyQqSZWPjhTgoT+)Ayo z{EKy%MM^TX}@AdD@eSN9}eF`lmeIdI~ zCH|bY;j~SAgs8Mf62FpQdi1i8OVF?%Q2M zcN;t8&~nOmkIx*2P$DVjr;!1U(Xr9e8nysxqF@(TvoVs|lgQ$Vic*NsBVxsl1fvth z57eH5U4uXM^FtXoqdm67M59TZGBEO)pTE@^_)yxGZxP4(p=Q*;$YPnzXrNFZoyKfN zgQK&Oe_r#?H=_l6&HIzkuHL(uVfQB?uU=Hz&`QgXR=3RZFGSlbtz5L&cd4%xf7`s~ z$(s*)vRs|&OG#WJn0^c$=Fywco6sv?NkX%K5^WU|{#-Ud+Uc8P<$Y*nR$=Z2 z8+h^-T1Ch%ayeUPv?!6=_C%3@=l?%$R3Nju9GTn78vgms9Uk1a#1@Fh?b=VlfcN0d zu-;{Bdf;YQXOeuy9OI_`kW=nQkTTo6)6#jnsN5RPDZ7%b!2An>Fs5}{<>)Pcz3B`a z%?C-4buSwwW+g;27F&7d^?LHY1I-rfAEB*IuCUHSxsLEIwuYlcRYJ)d5m*U1cinuZ zpPqXyyOlz*S8sysuUc^Z7WIbV`T*T8!#&Y!e$PS+hQ2>#t}&7$?Od!zkjgNq%hV8| z6=6)|rJFGMd<XY|B16gr_a zhkC29Xrk7;tP4x6luB!8MWvO3evcs+a~Ir;FoSu`gP5Z-z2*_DX9mt}b})4L1%d;R zjQI_-Tx^Pi2B$FE3^mUto$*W_e#kcmvop)<#jU!te>d5aV^~8!@SZV`Y}JMP)nt_R zZ_##Gt%s9Y$3Fz`D6jcAvdfwLO_Dan<%OAp96y7|7@K~PjCljY(PHbuL)K;Aw=S%( zhN4iuVJG%-vhRd%&ifcRk#>jqHN-*bznXjyTK)!A@psFKbNEniqGF0o{~iDBLgETQ zH;31di6I|a!+c-g@xCW#_y_N^ydK@^nT&$+nr|Z$3`1?6=QUd}PC}_6<>nXd+&q8*DTv3vOobPAj0t+zT-&_*$9vf8MC; z>MmdTGi4QJ6}P|t;iAQh7Bl4i8+8%hkBFe&LubOI;5*1g@_*dOn$GNlf?tTU>Y#G`G z%hqd7Lw|n}S=CE5Pc9}by;wWwWAA+a#)FQnvb9JR3@ouV%8N2jawesrdK9Y0C*nJiU=@W*_PPma0_G{5j= zn-rA^n!jG!CS9Q&>h~aRI#ab#UhF4C^DRjhd<|AWs`jPgB$S(S>SEKYF@ap&w&7 zZ}3b}brPM=&kVellP7eIri;|Kgg>O|JiQ;2EPFIPOFwrbZHI@{+rrNxHSp~ko)=DI zhv%!4HYxFEEBK|A8JWLhrBj7UoJ=r7e zeu76jUjIpP@h8X8Q{rf+_H1ucpPJmqV(MCO)7%}|XH2vww=vZ;Hwpa;opkqjXR@x)|NdG~`J3jNxKzsO(^iMw9%|LtLPr5YSxH8Zl=14f7C1;>LaTf^< zWo4j!&XV@b{*wV^o?{>kpYLX%{oEz#@tJi7+H11VeBPab_M981uZYt!n8s3<2k9|! z{JZ1w*BZyqq4R=kwK!~=v~ePuE%m+N>Nx+2*y#TN{~_^zgb4YM3Ef2m-#+o* zPrL;64WvHZq@C{Ri{0|esr;U?7x_1~JOs5U?lDz`y3$oqD(slUplgn1}gYN}FKwrIu zASaPOh6M!adOJYG@AD^!s5cC<+MhqqGyjK($UoaT>1HC*YbP$Xe}>Qgl)X(M8xvUw zdQ#pVBII$40^7$CBI6_9l-EfF-GKg*T?IXfkhh-*d9M;7uMqv0@*X0B|0of11DHUm z$7&+zE}>5lAt!)_ObihruY?GB{M;gGe#@PD@NGhtH`fd--!7nueX#r#qlxKZKQVxM zC5}hE5_3?m#EX$X!9(JIm^c#KABfo6d4vdgFAyQ`C~-LIm3RU2Njx7LkBAp46%{-| zMEq04vDkt^gq+hv$oYVniQl$}LA)?U9E1A9IAUTyQ4(<+>Wzr_sX_-NJd+6dS-=79 z3eyCt2ipVraXTA7EqGAy6~QY|ujIQ;a0()lX1^o8BKTLqnL};=>jWPaJS_O0;CX2_ z-yFeu!Mg;%L7WWvg5GqSo+-FoaHHUE!IuQzA?D%xbf{b6Rf2a3{#fvjD07DAqt1v| z2;MAsK=4DKk|CNH91s@muwcxvgfzjYEz{d~;HwZo;_&vd234SCPMB8P&V!`VKZz7@{ zbqPKz*eiHLwjKU0K?{9>{8fS*1n&|&As9d(A>Smyg@Uz$w+a4U(2Kr6{xO1Of;$Dj zA$U~q-v!SL+VP46G3+SMLVF(clyWWx4Ma64Pr1F`CylPAJd2dNM8eAis|2qStS1&L z{7i4lxt%yisXK&zka(F=4-5SS@pAi(a;Ech@&7Gxno=JL&GDPz++yV^RBD{iA!1mm z#X?_0oUYW3LgQvndFCqhd7<|cXDIc3p`Rzt!=`DW-zLt)eT)Z)^fHM>s28D&h_kRu zQRs5wY^+a&UQN7IsTQHP3En}Ruhd?lzeX&vw|p_3XT<+`!54`WFnaIM>xo?+1eaN093P z`t!b-$opyHSwRaOlkw98&nF^$g3$8>`J91#8;BU6w-8ajw-dp?Q|Jc-_lp1HLjSAK z-xT^;p?@Uwi$cF7^czAS6Z$e)eDgwr{N zenRk@;{Q{jeG*#Z z^rYByn&4=`iv_0&UM5&BSWCpbyFut1iOA>8Lf<3!dBGlZN zPegu43O!ori-n#j^bDbA3%yY2a-pvj`Wm6v2z|ZKHwfNBM8572{0tHKdR*x53C&kL z>HmAd9>Mnn|3-wIWUhCC;{?NkR}vAwTJY0?Hwo?#d_eFEM9BGy;7(^%$e#PU&NP%uX@S8%c*mL{4HOD>IJ!4g3AFpy9DnQ+#~pq;3I;M33dtY6YLgzO7LmHLxP6|pA$SH_=4b3 z!IuSJ6?|Rrl;Asprv*O{JS+IIAh+>ze$wkqAfFeI&J@fN%ofZQoGhrH;3~n@g6jmE1e*oh1h)!q7i<^Q>t5)wN9czH9}#>^uuE{CU^j6B)}?|^ z6DQiwONfU_qy0Q5c!W3^&jAFF5|Qr9g0B+u@f<)fN(^Bh6g)-5eDIFoX(Ia32ZC9w zmohxdAVRNPp^>E4t4Qc#BJ|Sj82sxD)8~2>Dx6fRGzZ1tOmjBJ!s;Hg2qM-lpoEqLuB7Vdg2L#J(*8{XAeOD3DbhI^G)nWy0& zDZ{>P{O8Dyn`y8z?7#1SkW8b(o=|094nEy77Fo+ zUJ0R8+dpxttPAejudZ%wtF7NqUB7NaHIFn@d7C!3HRdf^a>W!Kpqg9oj>nqVYXq^K z&Nnr-Y{t71ZZ)y{x*xr!1zVJA?BJI3_B9&8{SA>BRa(*6vY+5PmfJ` znw*Lrr(bBP-m>XN41U%1&CS)#Ed`pjz+tt?m@wp^Ag>^C%#e<$ZBCp2s99y<`MisH z-~CGc0&}KgFr8|%6E@vWP@(M|vy;R%4NUQTm||nb;mZdTrsSB(yjdw9sB&D?hkT@m z*z%e?;HC-VqQ9fFBhQMHmkoIV@KGMJ7?a1}i`@E^B8+^Fapc_#KDU08UHah>M@-%t zTV71RRS2Vg|4l~ewWyMv3vx<$M}>*LwPjg;Bco~jC8Z$&vY|zk&p3aqEWc> z!TVMImhKqGISqVnc`G50{fqK4aXIpQw!D~r?;tUzLmnDOUQ(RAPFFee8NVa%RXE)G zeE@lU*6bKZ-pg>f^?L~Nf?%S4%(o-&tG2wDerNG}5A`DtjU(?%aq^yW>4%?UV)DKb zSAP6~;$4iX4YpI;4CB=#_2#5| z0(>=^!?wsn!{_pJvrp5Mj_p5=GY=fsE8^s>0^c4+5aY<>?>}?{v^fPn_H)NLeBR&VPhzm9&L;L{0+f{uRkrJQ4YYyeK6%Q-2YZ@eqe zqz~3>Byer|L z+u?f-e2MD!P4Kw+R!&IF_hYkPaj6sFTNZRu?F;(>_}u*{oBarW?3b6~Vt->BxDl75 zE1YUN7&zuQ#&LcD8F1VTn^tM>8Hne56nyS@W10R0gjTwjUia2@O!B^!3g45q+L#9ogF@1)1)%b5)P`S{48ykXP46L{uJxQN;iyfZ#F1UB|%pC)M0_ELBB&@YIbzJNdH$ z5BCPtvL1Bp(O&SAhnS3bnqO6cSNTuxdKTYY?mA|{KPd>Ap{}0OrO%#vya;u(vlWu)DVim6N#65>MVtu=c;o2(W-=v7spK{-6C!;ucYU4Co`b{DTay4!R5{%3tG z4-d+3PjD|jHo3g#gHJy32Y_cj`Q&axWgI{K$tR;d15;0HHgbRqV6)AclR2B(x?&a zIG*18qu!RlyMMf-jrDuwv9m~v~4y!j%Ub~NnAUl9~a~1M{@+m<23*ep(ECbF0 zKAZH$v1iQ}k1a)<%fX+mP=4^wLb$H?J!nHHn`a=GdH62c0QE_O`v;jX9!o(vlq0Wc z&0XUb0zJsfJm51I{qT?72v0_ywxbLwD}*!(0&k$agHh_1qQ*oEfK#Jy^v*-rw8L-o z&PO;#&FED4V-I?C8n7hvMsFd)7X;tHR)}D<5Ps7^&j7Cn^mNb*K{Kz|y%U`QdJ*WE zTGp88OwgsEi-ax$T?TrV(6d07gPtw)Y|s^;FBSSy(3PNzg)RoY81x*W=YU=U`ZA#} z1Fg$bXm`1?URbuQ50=T{FGqTnlrh_6Ey_8$>)I%WdjEFtB{#Q61L~TdKzCPaG}P#% z=DocsUDrfYn(vJ6L)izrcOT!n2ldl@&+$~WTOaBmhKxv_U41{>^{_|TG7M03>@Cu`zq=&06Nf&vA4MkzgDaU@9y4}7-y4Fhk@W))aO+_ zl*jsX>XPFt`%bJLLsE~ZJKQ1L^@wt}>v62EN7mQ0E~hTXNL@~hu7gh0NB5=whwJk< zC{y?Nm4Y&4nfO9>IkL`Q)Z6b+*1Ei3IcWrLKdwTrp7aFAp+7x$^3&?wKVlp`_7{w& ztUsI>*>lC;sjDP+U7`F#uDbGv`s!*((5|OxsDre?nCQ!2jP#~r{9@fq4ZPUvuAhRS z-T&hIT`2UT?rZ;>`yR`cb#Xn)mHj5UYG*V#+^PFia%g@Ocd0!_pdy+ce5qH@bwPWs z^QdK*>)JD#1MiN+oHy)4J?E|HxtMbk>l5)fPckm}j;A9Yc>l=x@gwlM+eQ%Ma5%L4 zINJyNm@@_&fBR%K=c#bBJy*@GVSl?M$}w|ZmEGSAb#ZhW>Ue(G?rZq+pzdpUr$>*Q zoU2L#Z}f6~;M5=Is|D~Q&AOWbdZEyquV#W?BsAx%BG9EmbH17dx=d)!SF=Hv3(fiJ zQqUDbbG|ADT`4r@t2v+-3(fiJGSEwe=6rQI=%qq)zPeZK)oTbTo1SO>3v0_gUB|u; z40PFZ7TfK2Ky!c8Q&=!@&3!rv&jfJ2APeR0Z)EDVsC$i9iE$NoWIcH9=P!-!?JWuK z?G0D$?Jcg^+gsGUw|AG?eTwTjt^--Gz8b9Es&@AV!n=DjqxRg!bspEET*EqUB(Lu0 zny+HYTOq9ZUf2`qHNsuTJXKxC8X$XhJJyUCQ-|z{oXl>CV1JE5p3s(bI}BmnS9SEH5!!Lw z6a4K-3;o^`xcyjb@ZCRp)pCw4xcynygJSY?-sbqha!%9harL%t$J8yz_2sf-A+9^` zvDckXF_SPq>`aN}^N8e=d1T(GlasfxNTcfT?&B;2=AZfY1|B=* zN9I-6yX5h|lQ%Sn0eM4{c-y|`ICmZo*;%yni1qsc)Ma2k+8px0@(rV$lfumBL%sVI z>JMvH>g!QmJ?#iL5N@gxzeV>lx?fn;66p_#> z9;DrTe-t|PWLI&`tllY zcVx6j+4h|>ouT^@(ns8tkjb**y&2nPC6Kz50!tW%s}QnM+o3b{4TI0O`z@xOxd-hR z`ewzYe<9`T{2>iprlb-w84)Alr=$D%#y(}}P&pLD8 z4`bLHon6JT?24ZIa1VGu^|gh&aW4)%kNc%vWn+9`o1|Q}n_Z)py4Q$b^c z(tcCsE?5y9H-5|PplYsdZH2dl+OmRU#*WJwfAJ-`6DCfYJS8tbR4{c~;q)0ZG3M!K zy8O)|Ff3zu=7^E!WsMqrKKh)VKlF1`!(%2{-elhpe@g1mv~=?MBwi+vGBCbq{!iB# z*DgLV{yLBe&95Fm9bNWzb)9eYjSnWzxq8k;&oBMq0W1O?)AKFks~>)E^i7}7e*2vl zA3m8dG z#?8h2;NU-kEenfG+qk*x6jun(WmbigbHMSGBHcp%z zP_vTe7W zgm$z-o)bvy#04Gs{wALX+Q)8km$-;!KC~Gqb~(keuFx0=N44{+6M%PcQB>m7#EUhf zK27|P?IeVu0<=mc@-+|WO`t9mwIbruibbJ~qZM;cv36UcVkHKYuFm~YZ%Pa^C zY1vh$kX!o+XjLkDWEL(I?jz{TUAW+!j0Rqc#1X9$z#a5#CIBh|U&3nJm%su`aK0ur zV|C%w$2|rWBcCSV*2bL&;k?()c`x)IlyjGxlTWJ$?9s*-mbi#b#tB_zF0f_2B5qBn6Bt^|j3QUNw#o(D+$02kUd0jRx+0qri(2M1?q_w)!csNJ*l z8NzyxsG1WYhP40X`Z!^>Lyrnah^$kOni?T;o@27aecD|RAs*1~sS)B++C5F5(tJd_ z3nRo++C4o&JgeO^B1FE&>`^l##4PPDiV$C6k!r`-h+Vy1RajS!2qds>88rQL-QVvTlBj}V)+ zdq#xVuH7>u#68+w6d`tL_pAu9Tf1jRh=;ZN(g^XWb{9v8QSF`+A)eOm%OXS!6VUl` zeMBW&8}srU@Q8MYBE+NGT@WF@uH923!~jMSkD3-C2DQ5|LJVp5^awGm-7_M@D(#*b zA=YSjQH0p6-LoRZcI}=WA@0%cOC!WC?JkZGyR~~xgm_rHFN+Y5YWL+4;%V&;N3t=r zt;n7yLJ~uh`Y3VYJ}LW-P0n(BifDT27Fz+r$>nIX!nc=@nh|t86l?X zK3EhXW^4DX2ywD@&yEm_wfoWtu~NH>BgEC(JtsnJ((cP5#O>OBd4$N}nN`#cd|JCh z5#kHDFhIWyu)BWM2XF>3io>@MP=t#aCx*4VAVRFv?x_)Cn|4o&5O-;JVTAaIc2AEG z_iOiz2=Qs{o*5w?(e9!M@m1}f6(OF|?%5IIS?#_wLgYK^9#tG6^8IuV#tdSvc3&1D z7HRk85h6!2W}Ks#Jv)a7tP?oi*kQM1bLgUR=9eaf+4JC4N6}T;)D3m5&C|!V3tSwP zF#VGGEG`Vngvq+y-;zYMBVW}FXBD!71ALuv7S28eZ$Y?i93>c|M#os$7lX5&HV)Sw za7A@}CS2x`AC*d2jmuuL(N%*B0fcq9>;O2lafFk|#DyFZY+-r@!#Ei9VQb@#z;zIU z2#jPeZu+9HX6klyy0mdeFM}N<>;)QK zTX8{c*xEQMkdfM9!F0k7ft?^Qdagj~VVeXoDSgnumz}UgX&xOA*aV+WT>9{7I-bIX zW(HduCwYgDqY>Gj#)UGonfmfax(1iDXbQ8dlP)_>6@gj!hw7QxNpK?uU%lA~_000# zs=2P%4tNBY-PD=nAsvvgdz9#)6$D4k6_LI;D;V`KE(#mi9EuTAqeFQoNEb^eL35z@ zzQjR}4BX6sK^v#I8N`;ApldUzQU?vFBnC;g;L^q|P)aFLPz^j2D9;%Cb$O%eZ7*1${`vE8D??oIiKRFQ-9If639l5YiP#)(9I*b^sj06M3 zIfAlKO(nSOnxJbXt^_HQkrfPmS;t3gXM8#Kab3~JHK6JBab4TTHDHC&$F;JLYvtf6 zUem`lpne@$b~QPSi7UrlefQQNR#P?x+=eTFM&T$`Zdw+J`s9_itGTo=T7mvDp6i%45 zR2ia=w9m9ZPaiH%rEoi#6+2wsDuRxqV%j5Y^l&I#jQHpGiL?b~k1#HQ{{S1@P@M-ZGoiu14|H$@A^585$ai@~{l+B(PDPr!i&jIP5c#`2F0Pm1L~h54U+fl)A=>aI$; z+PVrJQ>Yfp9`9N8iOBEEOpF=XLl`D)DgC?h2 zDtjoCpJAbV^;;s@>2wrP(JRh#)Krh*ciSZ0dy>!w_;}wLi@%_KarXrD{0UYOF5^kV z!qkaLy98De*Fphhl>xjT!SWf&$q?g9_M8t`4uu8$^ndH3`keuY7NSwJpUE2v;13OkMi?dMx*`Dz&_vq8tiQUUtwS1 zKOdd-LO;9nMSgyVDClp2J;r|*?6LlRu*doF9d?!De+~9{|6gEV>>rLtGne@DVdwf6 z!=B(@4|}5jcG#2rkHMbo{~qiq{$Ih)^Php8@8|b>LjI|+3;au9PxW69dz$|a*oFQt z!k+H`0qhz6-@~5i{|I)GKg*}oEdNZ{v;8YzU+UisyV!pZ>^c6gz`o4?6WEvg--I3Z z{}uLJ|9N<>G0#5@_I&>m*d_k;uow6{VK4MYU@!6?gk9?Y73?zq`>@OXL-Bidh5r)R zmHxS~7yDPkUgEzI_EM*!f9!t{r1I~BZTP?Hpw*p~kz*j~RM9X#28 zA#9&NANCM`7`ETP3U-Qr9qd#!PWHFJ_WAFEJw&DY$`Dz9W3UAi2vdfb>rTR* zW>mdPFYVo?z5fa~rx=xtUw_jth9iTHN;oc{qXiDWXBJ>jokqtCa9jq*u&<$E1wmvO z%S_y$Wf)a}WolR_nof!K*T8n z^Zp30uz8u0wFQoGC>C=rvO&$YN+rm~?I30`qzu`JfG8oc6xnzZL^X*jWaE1vZY8l2 z**F4%m1bULa6RKPZ>p7uOZ|lvtDZytC6{gZB2nSiY3efHfI^Wc7)$U zcXVVK!m>wP1A7ETXiJS`iyO($eP5s}sxNpO{M1OD7%r1PVHpTL3Rp>tEv*MXDIvoSQz z#=?9Xi!QaXcoA^eeHhj3X3u_6g?7&Fk%6;&@e`-rbJTVSHm*iZwpVavH-^wm-+v&+5=BkXi#+`tQ|IV0?GJ84SWyoV?5HfBb^m&@(UdkLd9+mfJGJal%zJr4KQD0~t3gZ_f zAE&nCc7yyC$uCm9@rbX+`QZ0F{a&LybuoYBTa7d?`L+`<%+Mjjo`7t2WR6DA;#M7YGnxTYdk9ToAa5=vFg6F2rVb3E`OZfXnEx5y z1D-&J>^}EXNK+$8=U&ayx?J}mV}foomm6#}6Lbr?TxWKIZXRKSr8Ysgjj-*n8^&DQ zU$=_6w!dx?^K5_J9_AS=;t9Gj%(vaTCCs-AbL7=X(Z>(2-3oQA6%z?zYw08oE8F00 z;jz^y4s#sk%vMA9-gVI5xQ?IIO8*6T>gWhyg4;yLTsWAW^maJzfCD|QhBy{IC zuF`$mxKej*;|krgjg`7%8=qpoPUoD=j;$_a&(@C~bY`MV;kpd;()72%auFTFVNIfA z7Oa_c@LOr~=~#?NOX=Xu!r420I2>!~_%p0lI(`T1HaZT$x(C-3&jZ;H0|We|+7onK zk4WF3<3Tu{fkTfs4bX+nk5j2Vt?IEy4dambv<_URXWJ^YP_&_cLs1!x?l#ouYD0~7 zo6v1&jjIiD1lRSa4quz9b;f|Rg+!=2k)TKWR9vV+wro> zu^q3fknMO~72A%eDzzOa)Jixevr_p)mt|#q-WZzBFDA2s(~On6dif<~UA_FYvaVj< zyzA;U;Lz3kN9e%nO*2;M%KbTLR&JVcWxuNZBK&pL?m|pmwNJpos-q{oCg91>K)5QsA7a|{;$`ScG_Tce~L5kky?v48_b=u$cta*)Z< z^--$FZmv#@GOkaQk884V;4&L?=aYG(XMkON-quE$(w^ai2?z`)z;Skngv( z$lppW)=CMl)g?a_#iiD<+^>6tp)YA2r~Lr#KlRat<^!+V^Zu_5j;NpytKTsEcgCH# zZ7=jZ5R8)iz3~~4mkbTawEDUhcgaD}x{JJ~HJQxCKD_Krbbm0c^mh?iFa0O8lT1bs zhYBNV3`t8u(h;uyr+YGB&$s~A%yvUB`Zqv`Ui3c%2N(USh@*CpanBg(>C=bF=sg+^ zJ$nBh4mP|Q9J$l?f#T3TgX8uLj?n3w;KdQTh$D0r1z~hf{}}T10_+$ZdI9!B@NtZu z!SOl$E>IkyXK;L;p~vGD@Y3V4D&jEEPEkpo^z`TP=tB<&U2y2(U}z@7Pyp#S!H2`a z3=Re9D?xE6NdFqbITWO?go8stdLDu}6r}s$;80M+p`e>da2R+Ub)d)j@4}%6f-~UL z1Hm5na3GkW2Z8HB=|P|!lJyv$3x^&CN)V*S_zU6C1A+O#BZeO2KSa*-NboY4^+@n8 z9C{>Bley;o0PB=2DwE~0?E2#ZSY60FvM?O_7R;Uts&LDt^etF30=Uk&0k-YSTd+Oa zw~Fo09%i@#<*gh%INIDK-h46~=gm2VPyQ+NCOh!3r2VnY&DFP_dbpd%S&f?<#Py9p zmg;i{achQ@n{jb3*HaMiG_DYGc&Ow9rMrfpGMpd7$4~- z;qu{1#pV12a2Rgp*D?PrKjWcgXoG^$CP#3UAa4k0xI&_dYTN!*oKB7;j#*l|bVV?C zLa@FGUz7{tbo18rn>PguaLjmKK`^(e>4uF{np-ws-&o%kEG)!v>h)`8hC+=~XU+^2 z)fW`ZSTkcyJsfp~^|iIrYiERN8>iM!80;|Xf8sps)%AQG9D-K!VC~iY57u5iP|#}U zVC~g)Th=!-$9V}?-^cjN%QQ-V}^9K_+NDu`M5~Kw#oCg?G=AfZk?4Y4q^2+6dicK7(WhM@y zz(w;H4<>MsAPP(nG=J{m1(lU$a|f%UzVO8L6bq;P1XUah*Tpcf#`?k`KSABZ!gYb1 zD?VF9!b*sVC}0xjX3?pfn`Myt?4QcOnu~?&B+d~&NcG0zGZ*KoNXkzTUV?6zpnm9` zpx8Bc$%4UREI`oUv8J6P+O$OR=2b4eYGK)m(nRrMVF}Xf3tKpEMqzx1=nEZK+H;rB zFJzOCkK+thc!4Hi5L-~RpFX=3rri z^w*fo1l19fIarvMnXq^Di5)yxm%!k`T6m(GW&yEq2MN<+2MMFh1br!{?OIb5wxd$^m5_E@oU`GUE9Baj`-RrlJ%T?;mct^*cyEbrRiRZK!xDJ~kF z#oN-V1n(m$HZJHcuY+^F%G%syt!I0<~G zCH8hk#RM^&Q9nTt2mOTJWpfjFJ1tjjL0J`HaqTSX?T9#M^?p^=F#}>CP3sTGLd!wpGi|LY8$`VUO6%`9yE33QH#fG_w&A8Lrg_W6Yk3D8~F;U zeXrs6U{>&nbxEbZZEH-lkYt~?=Nla-(u|M2i*Vxe3)LN}&H1f;S zQhzmg#wp6c&`fN13&~94$!XYX?lkQ~tDdi5Z+XP~34qIt=c;6@Q>lC!Y$KF59 zQbPHxL28-&Bh}gDRFhXeVy&>o%kHs{bqZ{BvjFk%IoPvoiAG zoR3Ecv#_@yd9KeG;z?8KM!*>6$wlCOYpc(Z*xz=)*@qj zS}L9{#vXFOsomLhh~a~elC-S*jC(wHns+4av^u@|bpa=w4@4@{eD@ihp4fL@8O8@B zCG@|?Q<9cz|E@!S8a^~BNy}l_-R50MyR19CcO>uhbq*;>+Zxmyw#A1kacP&N74?@D z)jUDUy35>^bf0ep7wZmWIZBJcpTruj6moI)$-T>wfb;&`iXx z7ER^rfy{4hQxk{$*1UCm0%wnRaH9ZYQc;4A z*YnD-hWmfyHNSP6uZ`!rA64bn$enPN<7oGt7M_z1@gB5ryt}`{8fI=Q_hh+ZpG52- z{^6Ff#Il~Q@B~~zKk*pWP`__Jqav2r}P7{Gki2^LAN7pY=>0 z?)8Mhd)UYT;{!+mS$Yo~&}xWzW4YIS7=nj+&D%X4ItQuVGRxXwjd+HX`8SloP_Mbe zgY5j*EvyCeeowhI`U7j|p=Uk05S|O+Q3_|)yuJhGA8+X}AN6z~HMki0F;DqU%~}c8 zL(n;T3j(`5<#0gkK2Ld>*L(xQGrZ=PJkaPhxKR!VkkBx1`5E(NNF;&8>k;8Sh($J^ z@*K2Am080ptYOgDTh7!^ba*|b!^=ER8;JkYTMl}PTs8e`G=d>$1W3hJ?B^a|v1OPe zPz#<+7vo!C9OgHN`VM%_yKeCnn}0##Lp-4jBy%@P3b9dO?dBP4LYXzX!pcI`rj=Xg zv*h4JIdpo>kGJcFdY8%O@R#i!{Tkif?Qv4WfD7HT-&twCE58b8%AJv?_H+Og{*{0&m zMAr`_N$R~%xSzAnn0mikADyhq`h|~ECH?3WHLD+;t_u6n!_~xo^m&T=cKXcuYIr~T zBDDiFep(W9kwSA(!Pt)&<5WIqzI$q$;VKI>=T_UCuejxj20wsdj>uI@5l%PP9i;hA z0oM%JlA-Af5I)I8dqLCK@u#TYNO|#x7(?Z$howZhhVZE2u`}lF@X6{^{rD%TQlahi zFHv9Y7d}yc4~*$$Y55aWtAy8RI;77yhf}YM48_$}pD{Vtxs0iE)#qU<>@RT{lRs*@ zj0yeS##HCINk~6Gj=m_49v4Sn5=T#nqbJ7EEcrfT>K~fj^prjVE)(VNHs*lx2)Tp7 zUl2!6i=**XC6_VvKK4EjQ*Y*Q)0e3xX&>}uo!%+!&7p@#{W&zx2XSQruE0TrA&mwKZ{t7_5q~cIY2WD`VvRuzKe)P6e8jsn?fQQVG$9N1>eLlF`R~pBXJK$ zJP*4pgkC1NO0ba#X5G&q zZwF}%W_u-kpWu^%PZK97^;4mLL!5|BYeJtQPEv}m#!)}70i29YYedjl#3`7ogq}#u z!y8FL^Nlz1T_Jd_V6EUF8E>!P6M|nA{D$Cn1fLQ7 zk>LLkd{K~R3sK(h1m6_I$3V3|J`%3+Jwd+7K>q&{G&%l&9wL}7I70Az!7+lD2u=~4 zCOAv*a=`_HJVS@_mkC}a$n_8X>jl>fZWi1kc(dT`f?O9e9^bhjen#+ff)T+l2|g+K zO~LO8J}dYW!Ji8LQt%bQ*94CVa^1&t|6TBX!H)z#5#;NS2g8NbEK~n-kDrob{Oy7d z3O-3hzF!jjz2Hf~4+IU%=1UXg`5|`oq~@DJ}&rm!Dj@I z2)-hCT<~4Nj|GQdprt+|1*ZyLCU}qF7X|ePzOWAYEoqeB2_oo!7yM7*OHGD<5HG$F z!IvXAMR0~-D-nG66UX31CL;9NC*k{r{m-^fl_}E|KsBSA4HVvU&Nnp&$4_|W!*MbP=7lNe0-Od{QA3K zKz$Z9aF6)!BO?AU1z#6DCHR3LzZ|X85zG?I5ex|y3ziCgO0ZFIqu{NAcM!)a^;sgy z?+b!o5$qOxj|jfuTt|ZMa>2z!_^%+2!#F1X8wA?~`K~VG-643t;3I;M3w}-T+k(#t zz9{$`K^$bF)8hjmraPR7atsPi7Az7h5#(2R$+uc?onV__yWqWoj|l4bfDx}-XueTI zIX@-l;J%KC{2dd-2g^16zTga556>rpZ-wA$!A3#7o<{hMLf`Oz;Z9I>GA&Zy=6Ws$FP(|B#RVCv=w}-@IhH zKNS2qF(3U>=+}gPQ)s>jLb)G{KMrfr^fY2V?t2Bxi5N##2)$acQLt6;4#Ce5!T*@h zUlRPf;32_Z3jToz{*ywV7W_!iGtAZ}AUH~Jtl%WULczJj0<2er=G!66&uYO&!B)ZT zf;$E86MR_ktAgJWd`9qRM3mnj1>Y6?L~ulg9e%Ok9Kn@>8w76_#O;C}XR%Dsh+$bH zx}QcAheq5EX$%sPKDv&^T*1kLAwhlr13o-5(R_S9!+2rA62U6Lm4f>I2z;xBt`Tey zTqoEh*euv4*e=*9xJ&R}!99Wx2|gmIpK~DHE}{1cb_+fwsPDtTcSz{Ng3k#a5qv@L zsNl`fkb71#yprL$mdv`M^Xg?M2zd1g8IHM z2hXBN1A|29pCgz>`O^?igkHHqPbNaIQlTq}(5pu124WEFQK8$3W3XNldOs0*9T8fW z2lUeULwY)Y&`0aX^hKWqMCh@Ki1h!3h;+Y64BDSeV>;h8K|}tVM97_+1cbaUBJ!s; zHg2qM-qyFn#@>M=8C_Hxp*}HfWoSNLtU~yyV%%kBZ^3HZh&of)-R0U;C7Z6|_xkAys%>j)SzosWZ`{~v+m+dZ zH<{>TQ#d*vhsxV_9s%O@7Qa~Xu|~C}S=H5VY9Q1T5`n{9q@NEo^bzL;({2QHLiAI>Z6w8cbz2`9naO=f<0nuVx23tKjx;!md)Jz z7)!w}AlcWaW!puI4LyzS!dlb9{gZLg^yW4l=^Pp8V;az#bdb9S)^4e7X>cct&6$cj zdFmDGx2?7gxNW1xmd$(-E00?|`(De+6W@OCYB`?$-?(yo2fWGU1PpvD%n6abi3!pj z_~Mrnr~eygj&HxW#&T-&W~rQpydt|%=gm~`(bf!lPbXPOYZ}RdsdQ?qpa3ygKzRl9 z10}@(uL6+O)q3+@^_ERHuE!3|`sU{9=9Z8a0=qUZgyHxfHGJU`Lwd}-x>>3FtQg7Z zPn%}gbmKN(n?gYcAV!;4!4%Jz>M#KvzL&v-TgI36{apYlY?I$l6@*Mq`j-wyH_T|>^IfUila*QMIKfveKugE12x12F~FWT~A z`kg`;^&=0BBahG7-116Y@^EVwlgH*Leaq?oEekH-xqjp`-Z}~rqOQ zbv`cgQIF?vL0+uj-y@BX1Fy-17Fg z^uzKtChtO9UQ9n98awqP4~-*lbez0ymwsb}kMZ{50&A>(1CYmO<&JUWb-}}}-(koL zAz~Q*<8YCW@@~Qf@0fmDF=)`AJT#6x{;uVgcY1YS`{VN5kr#%8`gw5Cv_l@pA;&O` zhTk}&d#a}J90E*^n_dj#bt+EY5%BRI$1&8E=FvF5DEJc13s=VRy%Wdh=y!V@-`O}m z1Z(rRIKCtd7MT)8aOC|WjxP&*iS&CajxT2rz727FA@J2CNcSS)bAtAOZv+PnF^+!c zgU?;R>N=(OI)uSjfD6I8UDN@cIB=>jU5w9UIhE}SGTT>%~8M>*4RkuQJ?_gDCz8p^BB+ngT^21B?UW4mp8Mq#1$E-0E2vVCg&w=Jk# zXurJxK``8(>F7y15T>mxd##wOW+F6HI^`{%`KQ7-`>)DA=P#@}k2~i8wpVrbhU9$v z?j4=&*dfz%;V1bJR?zWLO>T<+<>F_1sCL>+a+2>XBZ* zeReS1yL!*yyx=NqS@CzzjfQcS`lbBDs=6!cZ|;nmHSNd4YS;0k@NVdci)X?r`#i=F zI082_;1K(70w8Mskbc5u$<@+ z_$7lb7upZn2f9M&6wpIJR|=g9+7EiM&_h9|fLJK;X!cSrLS)eR?=FK1IjH)2c zI+Z-KOgy2ZCp|U4J!yt6hWke+d1j_ZU3=^-%CNnAm#+8Jqd1HA{%23=y8ni!opp9E z>WpXU9vaRwOd}^1+Q}}^r2(FAxx4or)qUz6^*AmYKURBAeXMRjg>yE0I#K31;N>~N zJfD~6@fHGkK5q!v4lDsS0gHj#fo(Wnv$Se&Z$tCm-e%;pCc3wGU1)FbsxF)@44&2C z$pvl&76C)RU~o6;M}xSWfKi zednF~q7B)3(b`?@NFVeIxzVQC_eE>UFOJrp8W$}@oD-=#aTe^}-c8vUe~_0V=vJE@ zjMhGVPxM6Pq-cY`9Xjvst@QG^;2fB`JD&7@sx@larc63hE z2rfU~`%c%fV@T`dcAVW@)pd;Zi1SuQCxJg0#`(E{2TvJQJEN1KtFPuk^oiS}mEb7^ zo!b6juNQO`Xx4dP&x7dGw?{L>5B6pv?n?L%3EUlB1q^m|9M1($X3gH-EQDtvoN-qp zEDQeG-4CKI-xtm9MmfVT6zw>k4S%)#3#W|0ozVvP{W$4Sde57KBySPsIdPZQz? z;fHZ1+6jN0i+em7{zB4CU1t|RjXBj>vvz-DY^;BGcj4UHDxUY-b4htUsroFXq} z7w)lnx`TVQyr)7uue&cUWyw7FC!Mb31#^?>&d(zps9>DDG`_j`c<6zM%vCFU>@&1K z*Sp8q-HWXIvv|HS(&t&j94k{FkMs^lzL9s#n_WHruKS~^Yj^M2_DF9y)YbC=&J6ao zW@+^b#kv9qLi&oH~r z5zlCR6K9RzZ=W@;s+i}MJs;xC;mNKzer2yq-o^RD{N0AX@qCQ(d`GVTkG*#Rtg5*7 z#`iw^?30rR$$6%`+~Xz+FG zgH~#-#b?u&TCcCtO1)@l8;DU#QBkQ?TlM?>*36u<&&dgTU;q34zweu5_L?=bX3d&4 zYtNpuA8Ymk@}5UAVl(0shzyU7DQdvp!3*c%e|Sllw=u(gR)qD&!Qo={Idp%spRlU* zA3j2;lmQy}f8l>X17nw55njIHqDvPo7r$)vOT+aG7lbEGtU4>q54@Mu!hzXES4ie~ zd_ONwLzXTJUyN9{;-bZi=8J2A@Vw<=d>9*M?!0C7;iVUc=PglOCV|VcB@5~YPgpkZ zVw5ZkPd{rsN^23(bUi-h=d+#grSobRgjX)AU$|(Aw5Gq-_p+KdAD;m)s=p$MQ7c7RCx@Ak3ESitzFTHdH64LwSO89y8(xv)Emo5-RES@)i!JzQUg^M7@ zyk!f*xGj&H|8S@fu3viju9hEc|L}}0k?L=^Rc?5$__^PmuxtC~_X-|5<%3slT-oW@ zZ;hS3x?*Pe=9NV)V|MMEJnGxycOC1Re{bP0uX}RQX)~YO^wppqQ?8hCWWXI;Z+v}O|E@27{Q9WBzh38N-*fvL zXaDq*7!+Y>${ga3OkiKut_g}~zIxc(q7143e zeZF$}zK7ksvwz&b@W9x@h5iLI2K>uz_otVibK!N*KXm?{oW@D--L!1a8y7w5_PzO~ zi^olQ@zTMcW!vEa3|F-uU?|t6gR{PzjzPRs{cMs+7oRay=Z6{rK$qA=_Ib+d^F&n#VYQEu- z@6G@1y-OQD=u`D?`P;_!oVDns>A%`F=KiH0b$jaPuUi*A|LhlofAwt3%_o$8@%_6t zeDcnnul?KXUw-wy+La@2I^%)QUR|Ge_`7RgdF;nyA1^!SP2b1Aee}u~di-wN(q2zr zuwm$^lGfEh^Mo);upJjaJO13kD_xOLRWtzborV;f zm!iZ9BVxlRg6%?u$3-f5c@-iH+hY-|mShzHA1Pp?Xg{Hv4_go+H0 z7*sH1+koyubga6d?EXxNfrOeGV!Ws8IcN^J+p?T2m9&BnCgoxnRIU015YN zcnJBvqd>|K?HOh(w8_Bye2U_eW7u->G{Opejsv!V<8+K|;Ar`H_`v-n_z@DUG^tva z6)XnLX3|_{JKqIVOfB~wq|+b9VLSy`9XJIb%^&2)!7^d|&30b&kiTlkXOn!OuLj^S z^6ZuEo6exzD{aeni6MGY6J@5e7bvoP%XmqY-|u$ydr(m)qJKjo`#coq0m+fwt)eO; ztTXDHkqGhAJLi+mIRKs62U&=zsiFFNI9=fQ{C4(&A*U>=#O!Ol*-}NG(c*bDaAKwlm>c+2(j}ZMEiMzc3 zlpmzopAgOd4w9RYfB-(oDfmK=$}o-fy0dT-$Nr^dn1>h zuh|>eX1;Uti`L&rxbaL#)NK-y(&qJS^Mp5*VO#c=^iJtWA3!`|D-QW6wO6_Y&i8>7 zq&?1K=5sveyojSBijWAdX?_c)r0et(BuLtc-}jNa6EzpFP{Rr<+%A3y)wB)e1-9^a zg@3y6?-VEBLh{SqPSxlRsXL8DLK^CWgfx_ngfzr2{Ngof_V#KczTd+>J5GcPk7Zxw zmB#1kZ7^AyGLm2EC0D`+gu7BsR-8M}F8d0%(_fA7{Ps?S|FIGN4kP?kNJvfV#Eq!d ztsgoohVmdsN!jL3(9kxaI=pv$C%I3vd+>!Vd)i*m_ux0Ec9a!*{FKQGNj}BobV>5# zRJ&3*o<#dEe2y8*G?QgyV)gtT^L}9W5F7siZQMF3fMYr?JmS~iKQT=A{*C@Iz1TRd z%0JfXbp+|jOplAm{#)lUJ-)$m*pf_GA>pzLpWY1~L-=%Bq5@}B+(QZV$`T>>>v&pz0H!Gx-5jLACY6gBHRBo5r)L0SwBWLzVMNf}Ea%!Jq^E~V0yV)-)E3>Js zzWiXZh}BP(=KB>hJyo_DDdtqU3q7|ZaEJCG5Kfs^@jO)7!|b!{%r4H&{w7XTUF?~h zrn=a(IZ0XlIWyjggq)w}*sc(Ao>WFM8VSx6D>Ob;0 zsa7RWJ)o(;TfH~4kiu3!LnUYWM9JK|kFFs!4yELZjyn0aLq~ldK(S0d**?zrefI$u zCFMx@mb@uzGvaQIqmh{kt7Rt8=!8FnjR(Qr-pZ*dL!pK$c3 zT~N-!>m>N+8zuj>dxFSY;dniK`8U`PL}-^RT>`hemZaw|UBSEOp1QavFW!nr42O?c zp@COcc(Yw@>HR?@Z;|-1m85oNo9yAZ-Mjdv|8pZ9wm9qjdL~M>7b`F0Fcn*L3ruK7xQzI zMHc;|!of1X@_^%Feu}ba-eQf#lw|Qs0&%iSFT(Q|FPOIk-;4bJ%cm}96%#mHOvnz= zN9}s2(XW0R=t9mQS%wgB6{5Fp1h}_u5pWYY%XHwYw#3X(q~$Es0UalQ`5k3=a;EyG zw4BX4pxwoZFBHHP%(@9wc+2enMqjz9_f+z}v}Zv%iGFlr^O47Qu9=a=fv)idJV*Hg zo}+yM&*27Ab1;d|na};D=BRz8<{0kigE=+sE{ii*}2N%&X-@Lm(tG(-{m;1aPbbpSL+>9HZdg>{+Thz@%^=@GE zAAxRQY69m!fOB5PG`axJ3(#X}oUJ?6%`10%PNlekX>QMQ*PWUm@5iVMzrN}4-MJ24 zZ%=Z*fcsviT%^{z1%dUG#B(d0w&tAc_MYT+o9OmNQ&+={XeRx7PIf+3j%IK4!3%1? zXWXJs+|$sxqRH-Qlijk(ZtuzP{95kzp6aHTyG7?np~^0Tpd|gT#Nc*xyQBRn z^vK(N(z*oT7EE=!H=t;P+x={}V4d52jV5pln%(Xb-GXUyM8P@Np8N4cIFW^(yF07E z8p9i9axEMtS0Hi4(-Wsnaju-aZkn@ft&=_(s^Rf+_`P+yLdGZM3`!5c3-wv>YkUn< z@(8>(J8!`D;9B}oxU!``>9q;Ee-bW-;j#B~cyl&qBRt;r46GAonE_{u{j}TD`4~Jh zoy|B?yE*q=ONGeEhSLJ}f3BP7TmhS?2sn2_C#duiETX4#FZ|MGI)A3GU*{u=vm0J= zp}g1V(@D#f&R!<`m-~E{&2ta;P{1Q z@%yKENV8r{z%#91Cg9oD^9gtt>!}31oAvz!yui9U0Y6Fne@1vwlyH*u1j_fsXu4VV zA>FJ?aTm!-)4x3OkY`)HEgLw~ysi`90eW7u@hent`mbW(HQ5KRX!s03!u!a#tv=R# z-F5`IHh%3M);QM$HaJZZYRgjeyayQ%|9*e8aE9Rtj(BT}XE@@u&5IYr5u_aJq$K?0 zB;31NA$^~u@?`n@C6)J2!UrYcLz3{}NqDJs0D3loW5VwjOdvilsk~cK`G=aA>!L0g z?w>TL_=}q%g4o5%w*I8s<65o@{%%TY ze`6A!orKfBoC%bPu@Gt~)KJQ_S_eQFt~GlYHJN<8+?POykIzbwK|TrjFv5+@M=L6smpn{g#1egL0?8#itz$u zd%Pp!bW(RvoX)s&K)j23set}OtB7L)m_>-wi+4|)9Msj2dSiVFM(#qclQAD)d>|^G zkHL?NhN}so_xm(_S;J$5&^NzpBcyzU7i)OGhA(OO6(RK97xqJVj)rSAyj#PkG!(yf zp!-ncoiKi^*I&bl8uI*M{E{ANWD(NT>1Prm2o4hQhryv>Ifh#NX+$;7 z=i|)3P{T_IG3~9@`289_qT!D;{GEnxYWNOePs{pJ`3;q`>Dms@rDJ%qhrFB<=W#($)7-g&1zy`uAfui>9G{Hreij1czZ zaQq=3=N>eKA#Mcu7&VqJUP?(d?H1>z)`R_A@~l|uvEh{G~|3wdhv@0 z$n^^8Z`6=?6p3>kLHI8ka^1jsZ)zCyD}0oOV+cWCu3?3S=W94$!zF~^L%;N-UrAU5 zzvqO|&utpNTf>Jm{IQ15Yxu7kzNH~PauGi7Yxs$VnLK}r^!WyeXYGRb)o{3m7if5q zhD$WOLc>N4w`jOcL*9ue|DA+5ub_$M0wT;l#+15qN>d`)fE-)19jEi5gBNggi3{q3;U`QJ;RmiQlZtcWC&mhOcONP{WTj45lf5 zT?sKi^(2H`0|~)*sK(FKaI(%nSL5ev{6dW{Aq1aB4Ka<#`1>^sYRKz5?EKc-l^d>4YzCffQAogxI@F88a|=nE)Ad6@I?(@(QuE3do|pr;eHKUG<;jb zLmD2@@Ti8zG{j-`MH&`sI7maTOIUBThI0J} z&h-iN%QfWsgm_d#u1|>9Xvp;l@r4>L*04^)dJR`;xLU)F8g9~Xi-ub@yi>z%8gAF{ z0SzD0aEFGw2yy;Bt6{T-yEWXS;a&~*X}Dj*Lxi|a9?|e9A+D3hH2jnh*U5isXz@Cb zk9C)ZK|)-AvNQ}4LN9q5<`Y6bK7k?(6BgpPorYi~ezcG!a+GSkj1Y26(0Dl^Y$cU@G$Rkd#O>BM(}a55a~!et1EFu=q)R&?lEKi=*1pbh z*EjUhmBNc#(u1UU2a*et{Cjt+JHLw4yL@!rnV7wH^^RV@en(N4=mTBx8`qk3p zcQF#PBP z-plWw9{HG0I@ZfU^vbsy_$ovb3_teCtCwTISwB+~8andwwwqNF*K-!iOuPJz>23F) zD2pJPVEFMjsh3|N_!+(M4y56Cx#AZax6!~!XYNuOe#?^h6?x?2xEOx>aLog0Y}~ju z;(Egb!*4I>yz-TL`0>7h;kQHai^+EsIOQV^gW>m362A!^etDXX_2w&nG5J0PZr&L2 z@|&B)uL}IaAfR1gX%UkzqWHz++k+F2?U07S$j3E-x4-os`LI-o@%t;%Uj6L@zujb{ zgW>lsa4)|`@QWai@?ohF`7Pm5;vGnNJ!9!*3zdUVf`_e=>wT@(Uvxe!tW6 z#&F~@cT?;ynmkEY$1~R;KcYu!13rsL{ zW0UCCL zM!M4s0%+(mlE$qZbor(bbnFL1AZgsD;=;FF~Bcm@0- znjhByhM(*y0^EdpD7Qw-Z0v>Sm0B{^EnR$t@^VxXjt7-iN8{sY_=wU{mGkvJj`Ay{ z^_Y*N@z7oiEz#oy7tn@8li zLvjB^4>h3e!<3A^l8(YxQ91n8JPW@KRuq1PAe#lB3TbupiE&5U1S{^p!m2?TWWbzS z(1~gIW(Zi@4@5xE{?PXVeN_a)+YbavR3A+pJeDYEwALT&1fLb8HTgK@3XpEKt?jLQ zYSy>yMcjwDAF;(+-}ZK7eOo8ZSL#tF?b`xv+vW7tu~GSK*dgkMr;5hT4fMg(QnCg9 zJSyo|qF~QC&FI_K7AyMT!J|kw($7!%bBCylO87JK`jt95cJN>Fp_9Bd&`Ayadr&WR z+YbaAsFOR}=xc^`T0*zC+2OI6I;Xe7_HJ+@poO0i*j2$EYr{bwbkP#p(1tU-EhiK@ zn1Ne}xZB(s3eP*32_Do%5Rg8B@GVSRBkHI=Mq9(+u@Cs3aPt8-d`pW}a{s}jNWX2} z4qEZ~ltKD5@Nl7TQxEF}+?GTh^3#y-FHvP^_;9Lx@^Vp!yy%O>%L}qPRtWut&k-Md zNaa)4Ym~12`dr_+!)-A7nlMkksa$TYu1QfIiVK#y$gI z%(ddt7EEfZ=!ml55+GxOsqrvv@SEvweN1=#!NZ|Fg@1j3Hq;nhe{her`#>-F(6Ovn z+tTV@ZR@p)zE=R@i^c^Ei_aNA_@W8>As_N=(4L&N{Xh<3aQlI5LX>p^?2Y_PLgZ%< zB0m^@RmLwuG`1l|j%jmmB@?b-$^vm@rgV8U~(XtBYHv$`@ z{!rfnf2RiWN2%}INpj^`?EB&{T|jyhKxh!rJ?aW}LFw zWS#mW)alm5`A@ei^B>bmI_0%<@1>^j8o zo;Irm{^qtIhWoYnLVs+_uItm{G!wt>fK&2E_?PO{Vu#iq$O@m_;s@>vtvTRFJs)sa z0I2aon%yX}x&Wnh<5t|X8Mcjo*`ufiFp``pN zaju8G#rz?i!!*XZifvhnrW}1K@72_nRf6jj{A7jUv(6WWFQ?GvHu`NlggmQcbK5f5 zzCR3KT%ZjPYr=Tm)Z&z+ZfAsU=bs)wN_e~G@X-+Jg5NUCNnROoy^hIPg!C((dSTRS zMm@^L`L&~Zm}fG!dFtW1c$l*9sZrP1nEs+1x2jevx&i*YHnas1vk*gwd59eESsp$a z(6^iuxGwGW_>Q`qzN7RygwGXrBGw`DH%b{I*T#&W!Uo<(d=c>p#5)nI5XX$P*X-PR zQzMeG5cd}~IEn@8un{FA&o;uZA}eh|DVEm=N)*#a`zC(Gv&&=+b;jz zf(@^|FlAo1f&-ber==hK_BC6Eyu7C-aI^VXpM%KX_qgT}@TW-!&QSO(1XKj06%|1Q zv15NMo;oxn+v3l13EuYclLti=1g{`=>}DlT2&WS$cC<(dh8<2rd2LJi9w-5(WIeAI z$&HA%b>0I2s``0INifxkkOlflK#5f6m?Ae65Kv9usMlefN@x<~61?rG&QuU6s+79n zy$!6}2^7^#VT6O1m+E9CL6)?bQZWrER*GRtX(PG|$=!(P*dBRIZM^Uk_5=`fb51qXch-FmklN z5XH8gX^>ADqUsh?6Qs_}#Q|To>{EMG2 zZ*Va5^jfNNag<=>A`(W_mI;Xe|31rX?~Une?4?;`Yo`s?>d-Pvq!a&M%j6QsXQdX9 zWhv$`NIq(?Ooz9Q+e zCc^!aKDCMPh@?+zBK)VMPj4d3f>P=Eu?C z#XcptDl%h0y?ahj%9CQU41;PFqA~`iwjko9CfFv)itPY9BpGc1_*5kc{KB+?BNLKj z6qyo?6bpeR@^3&6_zM*dhOi!K5_&Gp|KB-X^4pVgGc)0i33o;^i}4P4A#Rmr@eyq& zj}IYwV1lOxUw0;Q;vSen9uG{N<8FwQ2PV7&O_xTw%B4}B*Mm{lL=Q&Yly9caP-J)G zuL(Yt3Olj66I65BaZ^FOl}Wj(ofGN9h?IEoT}jv@1D>A9?W6>!PadyIlXB^LDeQH< z)Qg^}s0a!TpGqD0hdMdtKuHLTVjhzO?c?!^B+j4cQOV;Ps-LG^+$a@$`=fk4_19jP zAm9L9D(;&o@jxxHxMv!qB^G3`@zsQPqmqS>d4C!j6JF|+xX=?e^oYqQxx-^!5_Cjd zLM2~mq9Z8lJ9yyjhry_m0@f4z>F}WBsw>Fs^8DjuM~WOL=Hbs2E?Qjbw0MER?dgW$kQ41jX*lTh=c$9F63|J z-pgXXH3&a6UHR7hYb+gWb$uJ~EvCmsx_$uo4%6csEQhb~8$UE>nsg+tYj;RzzD*yP z)8$K)TDg4XK5q&R<$*C>M-Z|UEsQkjaiOlGkmg(-7$5G+ckOGKo>1C#EFfDBOq}3p z+3!ii;A2vRl;^AnnzgG-prh=*NR}bdtqF{%hMXNp@b?B4r1VjX9RC8PkIq*D30$m1 z7bVkj?P?#=-R)?$fQl0U@^87e2;c-h9VCrbc*w4R-til%U<(UYX5o&puN?!d$UYy*)l4)XaUBy6BXJ87C;D!-?glLU4KlbDeGl$K{{WC2 zewZ={2{aF9HKz3(KC7>h>`LF|$eu1o@n@6sca-sZ0%Gu`+$&%gIsBAmr{;7sU;#Dd z-<;TiF0@grU^k0?7%yV3bg&CIjI(lSvjzJ>6j&idv;?Jq&c~3O_DPpBm?O+Y4W+1H zSI-Ed)7dDQheUU~VzGefD*;ZL2JzTY+$Tm8fg2L}Dpo!FpvXRrMRvGM(s!a-uU|8H z#vm8T*O(kl8@6)!kwH4YFxY`iXHp))At%z6o1%S&Y-gO+brRBkRCLBSc0CX29HuAi z>3WSxPuwS`4cm0iYU#?C$$F9I?6<9So?JY){1el87VsnpoSlw`G1dx@`PKw31V{^} z7lZB=GB{0q@W|PfWA$clS!7oqfi(6mwsA67WYV==?ApnE$*2Jg?WZ{5oy?PZDT$w^ zxt;tApeu+z!*MA(1e9ND*w2wwpKl|{)kX=T{Yp-E`@GAMLt|S5Sa=4+-GqddL)|wZ zL0h@J(N>0|vUf@LbY*+Km4?I;3*0M(mA-mpPnW_9A&kNr6~&R`Qm|b=WM*wKZs8;{ z;1h%v^ua!tJ<)@GZhWvS;)5NP!4_rC0x!EdKz039lsOAs6lMNZlz9!%@38a;)zue@ zXe9Q*6}W;GJ&i(9-up4-O@Q@@9CIXZ4#IP?`hqHtjVY#jIiP!h@K-mUa=Q zmD=lQr@e+Vcf&K_-%EP8p7r{VXYK>aC6t(B#2PS#dEIQ`J5aRN%_if4!mYbab^~ik zlyB1*2TFq{*lcm&CCo2SX`V;+iHb&ywNT}YrS`C?`+=)Tf0CpJiCkf6c(4dof~}nz zNbsAkox2wmaf;~x@!A7LT3??Zv_#tpH zgUM=G_W~C)n4*T&1zRzLsS5uE)GKCij-r1MxD4~Ts(d4GF^g#mzXZ6LMO4gS7&>+f z#i_J8(F`AlVlnyYBHr*4=#<}^*;T@RIN#&DhxiOBk6BS6t*F}WoZSx$#ELSJh+EN7 zh#j}0Kch^n=yN1!MI~_y;@4nbV?p$E0)vOWx?Q3nXL9O`*KcJYVKXd>C75I2a@(eO}S7w$OM)rmOGzA{|9Bc z{b36C$MIp#&4+Ah_m4IgH?XX*7+Qn8rhu=;T^yby^HqJ0>bHYwxUIC~%1aCKbx7!q6`TcuowGuU4m zE?khSUn&tKs8lWo_(Nr?#yOl^Sg-PwuY+;4D4gB2a=4_&6hQ_mgA3M8v0=h;ipx;* zQze#u5o;L`Z9&|MxC7A}IBhXRQKR1G=3FmSL;_}|+%o_Z7U zzsEb?H+7CD?$yLc8XmGP`qq*Kwb<3AKEd~$@((AU`^=kHt9;}kA(cE|WJyvx$CLD> z^X6OUjGH*2YHH=&@#SOjADuRJ_S}i*j-Ng|T9vA3!bDYMeCrX4U%qzk=j4Ma<@_z? z?(IM76OY5d=k3bP-ZE>sHE;fW>#`LKRxD6Q>8TMRM%|%ny#$AOG4h1m*vCuSjUH8Q z8i<#vZ?@Xy>u-)seyj!k1y?M8@w|F$Ds<`GD;F$Vy6DOUu?Aul5`6VBcWxbqm19g_ zgE2XX#Oe?+gTI*X6v!dLb~tLMl){_h{6%#O7r^!5s(PhCytWV%LUETyFGW76joh9R zqhj^|9vrz565afXPeEbnp{3~Y24mb}f?o`iS-voq@2RQvrp!D>PX~lvw}GAt32$9k z%3UOtlIW`tZ)BuuO(|WpoTA5K*D3O~olvM0r73JnG@E28o-TB(jRi{*yO*N5c`ND{ z&aGXbK6Fe`zI=iC>=L@6evDsBObGKAE|`A_-&VnGz1l?=U;MwZJ4U(8@>zf%zcuaE z*;%}L=9xCf>xXM=ye+ZdRT zU8C;G8Zy;J+~;H16aex{DD^jb>SNvDrQucb>u7idZAVjsWrU|KUR|*}6J@>L+33H{ z-4Ixx))<_SjrEAPJzjm=_35Z%?Z=wbZ_(fO|MTH^>Cz=vEL}dA-boWbO0b}wL@$o< zQx+~4u|`!moa+7;xo|Yoo#L0mXJpLB<9>^t<<`5s#j~T+1g~)?1e{iQgR_GxeO?cb zhd?PF9^uXoo&~Rb+SIv4)j2A49!se63F>5KbWg}z2S0+D8Nu;xdhiDU=NMfs2Ar+% zS(o`SvMzTAtcPzpc*_ek2AsE1+9TjJ*=s+Z5^(+uw{@U>knZySa1A^+{)-J)a&KLe z=%VgX@XyXTSKJtO39NSq9fPMibSJPb!IRxHAPZ&qiu2tP_;P$6KJVZ{@kO%Ug+}2@ z@FjQ*ETu<0w>PS%2jB;D>|}R9z=5jn+&RFT>R#7?!HER`+=kr9Ow;MFNK!#eY6eFe}56re|Nz1pV#5u5$R3vak6wa z!w=`j_S0@@!1>o}K63G8&ICAa3^;o%cmo8s6C(iy-ROf`KKMbr65>vG-LrjVxo)Pf zEYEctCb^mCxam{eOo;Qr)za=(`uRI@bz-y6z~NwK1{{A<;=f((`W|5zHMYIVw~60Ip60&do`R|ARxHkWTtX9Id-nf5Z`L!8y`fyi;OI zku!r+N~UuHoJFQPANW2BIJd1{>-^Q3?14|yb>w>v#`)IOPcs2afs4r!oE$fR_!AJv zA+-7_NQ0xDjVMEMEfUE5hss=!OeEJj>sO1(yk|X)8RQno0=JV5e#~;t(bYH+oh?qV z9C^)DVA>&gT?&3Z5a?`cI6 z@RO|p33xwiS^}PFot}W_SbY-kT=8ENZ@;@0OejCmx&(N6tQS2k`ZubJ{gOV}>Iu9h zR^HDl0scyiVUE=mcu}mpyY&zBpAT`1JWsj|^i0E*h~Q@dKLzQq#`mG^ z^N{YY@lGhe6lt!%SlP8yva$6wh(2mjH;4wA8**{!1A$r{Fp_YyXlxfJU^-2_**3n%PX1Cf%vUS^{?XMT?dw5 zscoC<;w~5uKHg;DTDl9y>jI5){oMuQd05wvfQJ4)-_-TFzNf#>o*L)+xeLbgROB(k+|vZ&z9fC{CZGu{zbdK!^OO3| zHw{c6{f9~X@eyGxu)HV<$2~=>5a08%tZ=F()n+pQAIeMqY3jF7;gqCueLD0Qos=KO zZz5zBo`JcH5Vs!Z5W>9b3C~e4jTKH(@81@VQgc|1F;CNeFU69M3$uSwwuk=J z>UKpg^iSkM|Bf&pe6z^!Y~9XS{5I44IoG%2-{;@YpU-~CpLSR{7W^^J)bCl2l=$C^F7~e8* zy5fZ>LQLCPgxz4jgxx{MzzZ9~08G<7jRwF-3F-fH03q!8Lc(6Sudd+_G<;pdE@-JRzuXKJaCJ zC|$w9g#Bq>j_Wmki-y|?QSS#D^5qg=7(P)n{JYNQyH2D#fv^|mH$w0m zrXk-@ATEAg0cUAC@na17RT?*bT_4r>E<*5qUBgc`%;x!l{4il}*f$~gPS$u-m-F#A z>BN64;98CI1qSBdr{TjI{zyaa1;}za9|3=_@dFyZr{R|xrt^FQU7m&~YS>pp?jFba zWxU4EC4{_uBZBp+H9k+{i#1-S@vAg`t;TQAI3JU;{@sM&zf0%8pz%Ly__>CKII&1~ zriQZ!QNLEhr5f`07W4Vkob%xpjen02ayM!G5sm*)8lK4c z0r+qY%Qd`!5cMz9@M;bDY6A0b)$kq-W&T0_6B>U}!{2LoK*RSm{7gfa^AYNG*06_$ z{WTn^;aCmN(eOMCFVgT*4OeN{NZ1E&XKDN{Lg?!rjX$FCA8Pz*jX$sPmo)yG#^2KT zpEQ10PVMaG{3RXm}%GUwCjJM1SrjME@St_>VOH z6OI2|o5nxX_}?^c;o}<@oN5cVx=+CJdk7~GB z!*v?os^KFVzM$cL4L=}+KK`yDed!a=(Xc?nJ{k_w@Kg;a685vKX&S$P5OU4c_)-n8 z(Qvbd-_`IzLeM{~@uvvE@An!W(dB>Bkb3}dU2q~H=mu(dx`tCUoTK5T8sf4p^qAHK z;y&A1ygb?%b1P#jx z!ECCASi;NsRHfl8LfFF`4QmL|zgi7Nz7bfv6UX{O+6OM}Lr&ojT=<7^9VQ)c;RpFv zYrKIF*VQ{UzKsxaKCAI&Lde;o@wW+a-urDp@Cy<`&OsV4A%vXI5<)J%D^I-@=yk*p z!d{p+3DGV$7G`^M96+=q*MH7Ke&FEyl?w=d-@t#aJlfR{gya5DQ$B|kFT05)!%ODI z>L&V=wfG*N@B7Yo>cX` z`ub&yE?R*Xew5`ZC%DV7a~yLNhAk_VuUQ=Fl9n9+vt`ydbPJs1+E<3`>xWst;&9vn zPI?U@)^l&&uWu>&m5JjvnN0kjcT_CntY7swZqrGxgT#89lph;sFVFv+b7K)v-cmWP zfC=xh#KcR;jR~i@d8RP+0?%CT0*Y5m<}bWt?zgb>YHiGcvAmSV*K|aNuOC*`eR)&o zxKbz6X;m$S|7EYMY`zYsq-W2Dr0~vM3-8QBrs4z{Qbu>oWf~b}71hF9GjhaL^RSUj z$^qX8qDT(IMle?n!-nhgY{+ot4Y%gbows1#MT_RHSh8{vT*b_ z&Km+uOAH}~0Zm!6L`dbxtMNAra2ROe(iaO0C*z~1Kn&$=2MIUe$h0Zqb>16rxs>oa zh?42Nw1)0CAi`2T7NYu|^El*C9@245^nJyzZY|Ob3lW)bWH$WnPvTeO;fF59_`Qt^ zUis=!7C|(@@M}TBD_@<5UmA!>M>%#WelhuW>U`2L7=BMA@oVt#V>^Z)mNW_S?eg$I zGR6-})CBpqfFI?d{;))k@nhf7-C@FHyeTDBFW* zg5ft4bY6ZBfnOPjC|?eu>F;30FD4(~K&E`8VKDsqC-H0X$k$oZvEE(iuy=g<{Z}gc zyB&01`Hp(@m+RrTQ1Oe&w@1rI8U`a@Z4$pvJ@Vl;bgaMQQNb(UJ|MhDZ-U{+SI@oj z1xLsA$J^JWV}H9UelhuYVldy_;x_y`C-IAbUkG#@58O_V@tcAAUipH+XQhy@0{LF~ zqTpAo`JL$D*H7__$yWn8C?9DUjC?02@muAQkI$n?$9mi!(ktIW6!6)e35MV9Bz_yg zFA5^|7e5DL{PkGe0^`VbNW)!s;fuO7@Oj+rN)1;2XOt_g-; z9f-XA4uKzkBT>GS5lKgW5ydYiAHRKJK4};XKYk16bK3!QZeZ82O$-21sN5m<2k@LtYGq?x#q5+bug& zJ!@pU12i4$T?+++pZG5Zuxh|>BNIBXjPVi;jeLhd7e<~5q+u9>abnug1u;Q-`(fxR zlj!m~pnCwky!^tTTgHZTF#NUv_tM?c0o|)f?fM}c$JYeI?-!cR zzg3g)tP%9=FNQGI-#e1{MX+FKF_RMLOk1}m@ynkapC=<8ejh_u=t?YvF<9`1A$<54 z9&E%O)vNx>k9QcMga;i|S{;oq?~x_LOH|I+`|{rTLuo$d%lmq?UaS2=S|RvBh2Q5c zxYbhy-;{O;zGK5TBX4?Z8vI8FOV%8mp!5CVHE##Qx4zA?e|+^-0d#S=NSE30XK96- zQI9?;*RM-jt_5yTK81ATZ;2-E*&)4TrAEg}a_;|!~W>B<98dqyz4 z7QUTT8FU4CZbAE%2R@Vbw;xcx!MD@5_<@LURebB{s~kQCTN%xYP85aW)=0r!Acv=z3OQ3#*jR>`gKMOt|vSh59=BrEMt(1suR zKIDDO_BK9uNOTA|)wI>n*g${15$G6l9%eRmN51H{ZG5VahOchs;kYglGw7$aFKpBgIUB5owdnU6zjf0=yYrTJ?V}AXdEiov$nl}A zapG7ESr%(qC`TuZM-B37JbAE#!&S(m?NesbL4SwKkyq}?3t4MX4xiYewQaPu5-9_Y zeAWr+{93fj$TbNg$B;3iV-X;Oj34aBYUY^DX~nuYBd=vY`gu|-?4}^tvJL4A;jf!p z*;b;RhQDxJ{m6G(&V_AVNL#(3uw+{s$2|-kS?~#;E8|m19vLw`!j=qOQ34(0XlN9l zz8D{jD`c4l-A|+L#ou*C295 z5%~Uxec{qy5QJ~@;_!xpWhJ*mzp(KreBDPji!b!xp3P#vM!zu}JZK}6zyouq@L*j# zTyd~CwBeu~wsP4A>X!XA^+-dX_kQ$I^1SEhBX+~lX@mcgN4X>5KNsVJ^AvB+wBAP9 zw`@O92EWa!Pt@C*w*0!SkYgt2^bG&bt!+*Ne6DY2-!5py??d>lzn~SrtqL+QW+wp_ zhPSo_OQ4hOYv8B+_BMa>Ep6$Lg>vPguSciBexS#U>WK$e;oKly2IOTq=~&m$skvoq z8^@A1@O88S@SG2xL2LE_oEsTFYs$d}_`FX;{c6~gy^~{e(?QF=`CaSinwBsIb35XT zh%JZzVnKw7cIDb6t7KU$W3r22f<9QsmHyX5ypCAb`K@nYZt#wS9bq5zdB^dR zIYh37n1|H(!Oyv!20DM;WLz(}|HSnzJm<`q^PKVPaetokP^vyeRUeH0Mtb`3BhwEp z{|_6*e3^ zjD8lOF7q&#AHcP&pb*y?+IJ8#=Ftu?=ClXV7si)U<@{#leWw2eCI{2JQ>Zu-Xg|6fJdYCZ}Hhm@QaQ$C%&}nXd_p*`?-f^rsTxZ_ky@pt?ajg_>{pvTnSVV!f}Q|M=z^}#!A4{J;te(eu%-xt%Cg|Ks7qpU-HEn{06&=0N) zd?n5AVjWp#vtP~hGmrdseY;Tlrq-Kk9UyDw#|QJ>pGLxMjuJ*whRf`)@7~!=ytW`A7PARHiz{Y_XC376V}DNw)0wsITEMaT3pU6a%C;kJpLf(O^ag! z9dW$u=zfgJ4A|qkTt8&ATfWoT4ppG9;0e3rZxHVuLZ&VDQ_WG+(FWQHt?e3XM%8P1-ruuL<(V^Wo)@x5klypcyB>s{L$0dU4>1>TPV-}534d5$|AkMq^{>z&^Euzd%Fs6E zh78~8Ne7|8!%80LppN~O--*Ka52$PS%9=v+#5FF)GZfagq07J%-nk%0NXhXsbb5@& zj_|Wa>}v%5grJ|%H$y*B^i{9x)3nQ6Z2`Y8>=5^h(zd{NWEg(d=p^nxhIM(N{GNbLTA-um z?FVK>?ry7Uz`j1PwP^J2wy9gN_YdaF^6=el6Sm*o7TI}s8}CW*cLuKeV&gW>dn>%Y zEg0PV7uvqng8fRiZ*B`=U6>cy+?L;<`dG+oIM!o4k9_Dq>tuyt*TKz)vQaOHI$5X_ z0zK=o-=>aLhihU_oFhG_!S-g#^`15zirntv+QZlCL>4b!YbVyF;28wZEb#R5YY463 zy5c~LKlHQnu|R75@b@8fW4CDiKqvn29c|GX=m)wA!Y;}~$@-bzisu(1Q#SgDv7~+u zQ9mLN`WJ$1d0H;m+kq}tT`T%=nEGi~2ej;i(W%%3>g1q~H5k7YhfZ^RmZv|E&#G3x zwI)G6tWV@z^$l8oFci51uklscAIW(eZ;Se}0vJOr(|P0_-QL+nJMZHB%ox1BwN2J3 zN>|)_EDZaJMDA{j*4^D!4t@Be*Wq^Ki~~4d?lQkG!yNZD&mEe8^3lzAx0SV!ZbOT| z8DrDD`5<*jn~B<+4&_B*FLnBy!2V}xA*@A08`}&I+VRdEX|nGb+m3=C+s|sL!u=ZS zwDKtTSCabsr_b+s}$jXxSdYIMl@LEFW@EpRqRd{hJuB+cbWtOM#ao zV%^DGH8m=UqXa`mB!Y-va|9C*)%F@psp?Sz{EE{BNJ#K)~%><@lSP-DAQ5=RN99U^6j5P`rbprVO&ni1KbiY6o^ zc&l;TFfs(Q5LL&Ss#OI9i(>^$scuIJ8e#=VNbs^|53v{{Fsv(^n5t6+1PzF6vofV{ z9wqFOIx}#T;BBV_Ip{gTDoLK#0H7+Ihm-_w1@;08C13@%KfS2|sV#^pwv?EFY{hvd zsTAj#NJ;Q=_9F+{BnV3qH$YVIQe{bz821iIrj)W!iYf@AlAJ+MBgqN^Rd)u#PQ;GK zxCo`_7J=d@A4s`kesVR1!xChKfirBB%(+ z4|`b{w#xFzNl9~_SDI)Od$>>4AlQ$nYA}_Br2$xRg}|rPNHzdGi`hHHW*MM2gA+zl zi80$NMnzLxjM-i>Dm-G$_KH!_6c=N5T#VUqF=n$_2Cp{Cfn#6@lo;oG#h5N)D7{W6 zP>MOne3IiEo3D5Wh=5aB8blyI}W!c}^NtBeab z%PU-^N4QyD;VM1C&5EmQR$N`P(5eKZt{|{1bR)i(M=g4yFs4-ZW{?9NRjUG~=z|e^ zgFF!HY`Zzcu=ZJ3mr)q%glR27Y{W{Dp)@gbBa&(~X2uP3X50p5l20?DZOz;Z(4vw@ z0Qku#a{1OmF(Q)u*et4&6o0A++-^w7u>q0S5|TZD$TZ&??>^P_C zaZaVWI>PmxKsFt;uI%mC6UX1Y=x8LWrnBK+#gm@7IJ> zyrD!TDt6ZEn){<9W6zCbIr3V z2O@zjnRFf!7-s@D!ydIa7V0~UNPQD3f!d8a$tYxs5kqdrmR%=xq6EiRKdlcPCNPAl z7p|)N(+Lb=`(Dv&# z1f`}vW?mG4J?REzD_BOvf9pDjYp0*dxiA1iVD2HY614>3Vu2l3Ni;IK7Ff z2M|-7vB;I{8w_qLlIr^3POU{KYDQFgVQL?ubov+)Mbd{Vq$C*Ka(tT+Q~Z_)qDCS# zdB}n03F;&{hYczf&S4YBR4$p4lP$IkBvJGbaOj*svAHnL=E69e3*&53E(vA{n@R%K zr`VNEOl?sG1V#guO>w@Jl+tLRvMJt5yUBnZWk0Zw-##Q&FbeS$?lonx5%Lu7IbPu_ z$18mCc!j%RHkQv{^WOjm18Njnh9YTbW5rkrv!BoDCZWQ?vj82HK>)J>bOHxL6 zyGoKNO7VYToK4EnRcvIHq1cG6DK>NBZ05w-%pq?EuQap{oWuk)jku9)QUwI2&y`Ja zzLk{H^trMr-bzX%p*lJ=5?z?uNOWOpBhiJgKt>fz&!`+-nA%8mVQM4Mh0U62TwxQC zQ-`SLGp4As6w@QKdD<&NrXEU7xDVOXq#|UBQyff+Kur-d2&mr_?XY%{aF83UB}gjc zWU59L5Y!{80wg3DO%bU_MJSg@LzsF!qzEg$9NXV&Sp4@W?w2k7lf(+WRrR8+L+Jn=9fOn|C9~ z%*2f#vutcfiJjAWfqoR)$YyhynP(!IBh_5BQ)S3g&4ss#7=IvLV*G*N;k%PPDHpZe zGBC;OD_c@_?TTjl;W=M7wMAw3uE-{y-_<5KA$bGE%zh_K${mA}g4o`OvfU%Lo{aAq zSs2?~QObG%_3Zq3QVO2r*ppjS-a0P7Gftpz!d92PJezA`KT6e5zZ2A^mnVC7hE)49 z7J2uEl#M87bf1+uTWv#0*|^tZKaUv1i(^8|W{>@~G&X1)Y!0GE#H~ws2X(P zFve`kNqHlEaYl?)TW*e1wU|9V*ESolTG!y&s-I`9IE26iYncV~y^^bzM!xrfoQbG* zN8>&x!%iyc-Q;|MJlF51QwYCriOZe#EVnm~wtEVWKDPo#$6bu0-@Oh;*S!zNfcqSd zY3@E8gYG9drn|fync)t{G1EN<$1Hatj-A|fIA*)|;F#k+g=5Iwi(_Z^7>-@sJO`&7 zyj0^%bE|Od>hhj)H+L(J-QAz!nD4%Y;|cB;I2O1)(Ag8+GjJ?)t8wh%UX9~P?%g={ zbf3d9?C!;}m-|;7d%FRg(kHvUa4d4qz_E`z8^^xx3LN{nH{)3BK89m|_hlRhxO{hI zp!+3`gWwI@vIfIDH9wB3!f~iuk7J3u6~|#NKN249zJlWj_YjVyu0IVX=7w=R#T|{~ zD3?x_%G@h)Jk|X!j;Fal!SQtWw>XY==_=_AxQNEkxP5RO@LM|ihDhdQ{DS8WE@@h0vrSGVjR=l1{{O#%{ZpJ z_u-h~K8<6h`x1^>mNujF-9G@e+>daC!*!gjKDQ^1jyn=ZzdIF2*Zmfb0e3BqY3_G% z47xjUOt<_rQ@?M2;ANoK1`gtA1wO*jHvC_AeOct6k0Z6p*6fUQ zuLWwkcj0JTX~7||pY&64z*fSRJ28Wx(H)cd6O>n=8&*9J? z*SfT54#7q{ZCvIMl%EQNO`Bk4;#D;3Etp2y#7Jfa2qb-0bEp&2?=b)Dh#l%|kn(an zbOMmqSTZSUhfX%g`)CFp?1@zHsCFwiD>RMH04`vcOi`U&a`vsMd-IE z@Qt;t+^aObZ-VX5-3XG|FmvA|JDAH4+r%;0G&?Kz9w6cs42|bL0)(RYs_eYnXMj+J zzL|DW?#rg+0=qbO3s_6Zg?3pkJI{v=*hqJ@6?_BD=lubP&iD?;T83J_Q|&H6%v_|WFGDARun%HNT)CAbK=c{J>x99E^M$ib9~9u~oS zJ0g6^G~=Zvi{ReGD#A7;^%ut_WEZ@=>0L9qufkh89Pf3oDv>ZwBT5M_Pb`*-v@9#Q z871AR$lx7F<%>?O;Qf*oX@nIIR`979mv{*~X=PErdY;MRxo+m150SQUF8kLwhcTRK z!QdCjNe|*$@D#G0Nf`u(oJi&wfSl@_aaQJJq-TQ!Th(T6M4B9(341cPnDoSbGX2pA zoU>Xoc{;sH`m?cBZ7mW@K^QzcgP=S(CUYj>!^jR|s+?`o<3gDiApH~Oj}K?gMf&GV zPbke?fHZp?oH)TVh59{d*NRV`m|FQ!X%i|rr(vColM&Ib9^M7V=pepC#!OBCcI7ER zPdu83Dm?O#h1qD7sl!N!^y6$CH-YWzYrO{NWYA8 zhvHu!r>_Rl|pz3^v1gy41(^t3AmAtRiQG|76|vRkIrdoT2s{)sx5 z#UxLD4>|Txhtk+Z!r`bx7DXc1ht64SFUZSI`VrW0X9(eYQxxCGD%G#B{hzaX;m0@# zho6%{;czS?c&V^|K{fO_k&F=Ry;*&)MG+Sfedi-l%7UJ@+*h~yk>n7`s#&2gzcd!g zmkp(7(D4qSWq%=U`yiXN{RP{Gl1EYFU-I08l11ZRk+8TLguG1Imc1HE?{CXJAb0%hAcJ*Fz^N4a$Er#Aamybbv2 z?A)zo)ICB~ZDH;O}jotV5>&pGcy;!qgf#8S9R6Q1;>`-^JFz zD}Zkl9K9&E!rukHQZ>~6h^PD(~1AproxKpg>|OFIn@@YV+OoP;hb=X{t$-?iN7cOhYmwI z*97+aQh(SJkf#Iw4g#>rD=Ieaf9+d<=0YU9gJMpAkl*CPNG5Z1qLw6exHmP)jub zHWH%wmz|jA%Qz%^Pyi;D{if4v6f!UCC~;Y?Y|@3Q(Sks9wdW9?jmr?K{nmN>z81v&msHwWdMpV2bmc5`_jm1cEv5M^uAOo z-i17n_USVVvil|Z<|U~MO@!d3qw5W=p$kOE{mrhi## z9M4Au>0c*@R&M&Iu%YWvD$V6c>Ck&jb0LTQwWNO=h5ahB@2-r8?qa2X-BlyGm`$aJ z-4hzg7tnF9gbSSFYLG}DFHp_% z2a)u0j%xlf;L^OphwcL|O)aki%^ftsxz)ZVlfid$d5U(_V-MztkzAg zWFrHeF{fs$vaJ|E_1kGM>+z9`UEKu}kUd+;aT?ZRBFAizqxcfwBFXuFx!P|7F0!2e zzqor7_$;ccfBeofnJ39ZNFb~NLV&0!kcA!B0Es}@7mEuRLJ}Yn2xehXt6>p$#V&4L z#ND@|qSe--R$jF(b?t7|y41DRSFKu?s`dB%-h1vmGn09c{%ZgK_y512%$zyPJ@?#m z&s}Do%$+RSa%AG-tOsb?;w;`#mp%cu9yXU~bw@ox-t~B>j)e-%W+&sEV5anov()f* z6n<@hYKAp@O&vVe&rCfAr|c(MHYmkaCV!~mghjphR>&UY)8J{`lLOQ z^IhN-Lq|ctsnLFsrDu(vu#5Q=z*(v%>*8q?s?`(i;d6Lhr?1t}6Ny|M%zd@aZ5nv4 zcI5nw1W+Du<10S>89PPlzOxDE3dD?-Gd%B0=BjehEk9%|=+}l$}{S%hkR|owQI&aa( zz0I7D+Tlxqa}js|^H3{*`KUg?0-04fb302Gvv!5LcEeV|v$}qTx_-l61g>k?L)$s* zK&-uW9ee1)hOGv!YuVHAH=$GLYW6hzdf>XAy$pXUa9z<}hJOffUDMvWF2lM4*H!JU zt2*pG=+|}aWB9)Tt}EL|=b!u%e(6|?W*I&d5ny`ig2d@~?t3cm55Z6)T2X~;v&`13 zI^F5gOSiZye|$2d(TEG6qRUk}V=eURp)0+dk6!8Az6zDI99dHT1r-%t=J?MkyUfGD zcrS=X zSZ0Bz!?I47HEafO9hP;vuwmZaK;5saq zo3I-NT!-ay6PA1=qQi29$^Qw;(_y(n=O0&zijKii%IQasbr&Y~QZ5ZA-I_Q%2{fX@Jq`*q7#BVIyGWj~{1Rfl^zr1pNr z2vZ|IMeZ&i{Y#PVN2(fIh~DYW-IsXQnRJnQs&8W@mh6HToli}RFN7m>i+^fb{1V{0 z#s6VEejjk%;{Px$_9k%M;-6_g#>fe}!9UY%poi=B{@ifgi}#rJ{@k$Liyt)Y{e_8a z_u@y)TJHcB3`huiY5K^=miAu>IPN zP15Cu`n4Nt`BJ-aNj<;#wHv4Tli76_vNk#8cq-JBHO$ec3Zhjw<<7L$XzM`4Hq^q30*tvQ$t0@X(Xb^Lz4Fhn{?7t}1Y_!%V}m5{FG3*SF)i496}@ z1RQ~I@8E&kb3Wj(i86QKxCh6BmIzo6*_Alf;@E)0rl)c7TO7~e;J?-cQ->gP1uhm? zFA%E8I7D)dvS-jYwzQ2kDZxhHN zl!;3{rYr;WzYhg*D`)dDRBf6wZO($CVFwr0HDS;9qIC@|t&PoVipocol$Deh4Qpyz zw|eB-mgbWh>e`CNj42;Ap>Fy3va*IzaSFCBMFCsE)a#iKRnG0&BOrJZgYJSb^IkT%e(TzU{PTPmR5N5WPpr1Gjg@sj9jgG;rxth<5^l~ zJc|maPMMWSVFnfz#;~SLnpHJ(=JZLKnkdbWZzrEm{V`4K^R*i~w^*7F{V{Fh^R+|v zmY)$3+X%jjau%_75namOMKZK!xRlN<=ks+Dd*NqjUOzu;vA2e#{uq8Gx?xQFkR0Q7 zEnQiaDMuApnRAWaOSaK*`6kbtv*_sQ3#P^8^La7lrFlnB9ycc1A=2E=-kvmn${2=x zG>;vureyA48CbemJLgI_8{>0tdFjO>Q z!NU1flhQN1$rWgOO$fGvk9eQS%$+f1!FXTFQn3=QnKZky=J=}lbJ7m5Tus&dnN_np<&Do13OrK@wrfq) zt^mtc0iOtJYf$Z2v5y{A(}vI7OqxG`(s4BlrXOEbv+%gNRW&tgRl`Pn1gD{P^@Q{a zUw^cUxh5c!FHo~=BR(xu)85)puUZ>VX#mgOI{05Js%u`uuWu=HS5i~gw!vODu36r! z+BU9jNM~wXyRxCBhBT^buJ6Pm%~(*gtg)@BVU1c-ySjm27iv+B>uP9(THaKBGqg!>e^Zi zYeQSBxiEf{>jr*FBdh^EvaF%Lt*Ny} zd`Sm_>RYR7>+5UQ;?%fig<8?j=3lq3!HsBLLo3>;roOhV7VVlQ(20%fqPnHopnlp+ z)zpj|Tzv}N@-ZI9jiJaiMJ+6zP+N=J-WIh{Eo)!yt6ovJy2cNOm9=Oze3Fj=;eYUo zNQ-J!wRLss5wVX%edO(Zf`jYN;t6yR91ENg93ZQJtZ zmen<lw)F#s%+P?nW!i71-XEpD5tFkpYN+%y*BC~IuVfv>S%+La z-*~pEu{B+#V4q&z(!5%ag6V3R9JM7_5(HM5z)RdZb!a*J?YF8Lol^N;I!&&<)H^7#5A^FprUCSRklE>f<@- zJi(E(bBSx3ePt1+u5W22M#TkZlQ(^=ouzBYjm;dKk|5Y693stf0GdZJc7$9cv?JBB~#gx z@E%7ZUllmrobHLjte#FU)yM7Y?C11L40MJ#2ReEq1HN^M_fPQer}=sKKNl+ zM+E1i`M#D3$Vc>*`Q0vbwk6JVx8k>k0Iy#2axQevON4atF@8{vkMn2dLvCv#q1|DhY$*aiD9@h?0`);w^KTI# z>%^ZBD)Wn}?_Bqsth2qdlH0P+%-Nb-nLok)JU~JI#88=EM7eX^v$M|fwk6NZ-kMXH zKP>ED{sa;9=lQ_v>Cf{z`?CVPO8N=@4Cdj_69Jn;zOA%*;M<_Tn5SNR9;CAlx-BAQ zth8l_UBR{}0xzheP0JcPgFfNU9l#W&my9YITQaV+bz^Hwb8}m1duvOn zs4B%TJR_SL*R*dK$y|$ZPt~gARteu}MU~AMUb0f*$Heqn$>6wq;W*z441LXTN0o`J zjQ6yK(4k59A3(c7Q&;NUq?IbobCT{qRdv$c46B0rwm7tE79`(yKRq3}+_Rj` zo>z^^Z1Dy{(E3<%ZZO?P9N6)pHvt(A&>4p6^Ngf> z6G*+?XJAdPdn2y6r%J(5Z&UE3~E9sU1$c0^*PYgEOS(6HQ(O3_1X}y(G&5AGmvs?3Op|U`*nPgqw8MobUOJ7M+>aC0 zwE3KG(s4vaAmqBv@&=scrBGs5MET4!y&kyC-_2U}+U!-itkf#b`|n0^r)_rMa5tmE?yAjNwht_vJKGz4v^Q~%H@M0xobBb$LObO`jeE*wW)Ahf zw{)@RBJXbZd=%Ry>2At;KP%x4oSx-)=m7oCO1ht%3gwua>3|Qt5oe*btG$BcG_T(* zZ`5>+O+pA%yMH?s-8|`jFAD|DfU&xP1|)MPYws1H9w5)rWcRsKa}LKF*zS)YoO=$v z{?w`T`fXX&xZ3RXOuBbvCCbnZA+Ov=PJQ2-1d6$?_GanpBhX*^p3O1C>kI3uy&=gn zy#lxKeXkgP{2kPcaBo7M+~m)2^=I|IH*$v88`6{D$Weetq7V0*&eA_bjP-NRM;9NF zbh~Yagzn`1G+waV;@y)oy?)b};dgK+M4$HF*B+>(2RJO?T&UZFRt-jb9At_dhawLG zNx6GaRDrt(Me*81u7@{I4{={Y#~!L>9)L6YB;7~h9bG%b;m~Pb--dhk? zn=zto@w)3;T?(HansncT1j{Y;z1npiMuLs#Di=TkL+a;{7#?c_+OJB|Q>85gC^`@h|+~gjw@Iw~uKDpt2aNQl*7~S0ccWZM7 zqInU*h|m0_`^IUT5u=0LtI$vS%>XUeeF5FLcowK#-5-KF$nA!4kgS334X45O4xI(v z<+1F|ntJDH)sQZ9AA|G=j0%xvo~omxD?D^S@?2VAO8x&e!4eshSz;MhG32ZTSKGByU5cgHJiqrkHG5VeuyB$V9_1<+?L&Fm(7@8 zwxE-8+M4C{INi&ggK60-)Dthlb-LGohIX}w%L!-d*i!E28+DYPncN&2)hv=HnVTkOXbayA; zr-4I!m-fLZH9*@iBjnoqw4vIy_aJK@_d#PQhKiwXD_vU+*UmsU^9p8oeZ{v)_YUKl zr@`)KoO}R0+jWNL1^j!nvG=zT|2~g0J*U`3@9rJ&_`(zH=W;Wv%HwD2qc~8-TcfTo;b-+jCiOG-09` zYqcaKWZl4(!fw{?9IPR}dZkc>s7!q#D}#I&OFP!}IgBD$3*3hBqr3YQ49!jE?DWQA zq#pzKacQ#~1LZb25(8$n`$@a*gXg6%@&CPjcgTrPbit69a&w(fvt62Uydf!f2psbe zGMBo$Q@g3OJehN=Zm|MHB4%XA9faX`w0n|XA7F40YHv_0+_h}Z-LOkH=WXqnYuu+& z)tDvD2`R}rCFx$UF7V`TuOyjs8;7UlbPPi| zZ+azMD+O@){P{K=Yxg5Vh1^RD-^qHYZF6W!`X|il59eUE zVq?76s=d22kK+!m5og!uVKp<&>yq<^=iC=^_fPU1udmLFz-g^^|Cm<|xEX_``vS}z z4|jFN^2nh}e%QL%{d1ng74Mq@i5ptkl%@Xm<;XEJG! zx+KJHH06c7KiYWsvx94TP+OX<;n%le{VIZT)iI3KUO^&!Y8QPL-=9p zdm;QtwKarKQmaFFrTRt)pQ>hu?5XC*i~?!4`XVGhPrVev7pezB__6A{A$+moo;B&T zRLu?H_3C#ayo;I^Du1Qw8N!>?$07N(>e&$9rfvw~1!`jm@1d53@IGn;^f&niy6QmS zr}=n)^)}@BjL@V(>Mr09T2u{EMUdySACt-zx80d(QI)NB0_R??CLOCzC*Q{xtDgfu z*0NO>wH^3UA1_e1@&BcfDsUvQ3Cq!Vt&M2}js*6LzDMv%jaRDAM4r#45~^CQ5`K}! z=cz5i=QFs3nxqB`|9p)frY;oR@TaOJBF|@V2{l_4$-iIoxm5z58=@av7#}3C!|yY~ zXB8d2F(NJ`xqPS+NG|*nOfKplOs>M~dx7LCyc7~huEIab2a>D!YD7A@XrEwm(SL&p ztsO*R-60WNzpCKVTvhI0^TJhQBRC$&1(IuC(DW&;-bBYok$+Me!Ii7nis|I4sc8gP zF4{AgT(n0px#`UeHQ6=)!|#i@fk-0}-+1(S245P%>mxX$Af4Pm&mq;-FJ=Y#d}^6a zZl`$Im}cV2Ri{Sq(<69C1m7CLx2f%T`_iUvxF|>ew262tUP7>m_~{Y(CnTOJL;mGC zyfTS+WtPPZ|Hz2^x`_ODBIWgoTwxM41cM5 zQZm!?_$HX@D*D-93(@|~(gpdPyAbWaIARah`Z}Gj`D0a{*uycf5dH0784nmah3K!} z!)x?Rb8!@+Ki?_(>NQ@V?vwJ^429^wr;EKE8g~^|S2`7G{1CO=pn8k!LiEoQrTjNF ze~|xsNr%RVV)HnYVXMabtE(dZ8z=Vhx06Ej-vSw8c4_&MiW|o<8GkKQ^CInaN2GnZ zXOB&6pJyWSwfr06FNA2}hglE8G(E`i_fX_Zia5%=_5x zIHg`9j^X)L!cjOeS-q1C>f@7*9|x>3JMs=VKf<39!7I`4K^kxlUd1O|Wwy-Te|1Ez zO6cbr`}Rj;HKBp2pTE8gsKskd34<4*ory0cjFx|NM6aC&Y<;Fh_|qeJbp)Rg!DmMB zS>|^@wvSG>96P;Od`^TvSK9k*^BULwCq?-4%x|;<>cnr5+X0aQXBz(ufc%Go=g~ii z8?Kd>)<^Wrm;7k2yC@HTy-m2;tUCs@<5e=|M>#X&@-Hy@_P5ist<-s8;cTM6{rL!c^w ze%eHc{`dnz^uGrP(XT!xtiV<=s5jvXfm;OrkZ=-q$P<`M0H2Is>;+y!I7O*P1^z=I z_d_F{8;m9p{HG8izIO=xtH3c?hCWANJ0artbAektgBK+Yyj@_|Y=e&#_+x?G2PrWX zy9Ei{An<;H1sG2g(-3z8YXqJ`I32G73VcoAfRv$65y<%@QH`&j3gniY#D7PKe$uCl zffWLI|3dl&0{0N2|NKQ@VV=P!3grD=0{!U{f%ge~Q{bSkhJUocT0-=*a|Qlb;PV1M zCPcp*o^Rknfu{<*gb@AkmxSnVM-~90zi|IK!W{yCC2&eN(9s_n1^z(buLOQ9aAbEQ z$9GaG-%N;p@QT1g3Jrd;z&{B5P+<2ShF>CZhQO5q&lGqyA^Jy7PXp%&+E$|tEF9>{9;9mv4C-5VI zp9@TI974VM`Yj>1PbTEJPuNdjkwE;Lkfx6i$Zhl}H$mW$0xJbp3*`Eia^DcRSl}{& zd_9=_H3HiNo+7YA;5LEh3;dQq&gaap$5+5>1^^h1@E(Ep3w%W2lLCJ$@L7Q` z34C4P+XCMg_=&)O3e4iT4Lec-y9w+qaDYJGuTzd+!6Pgc$om-Ll>(~;&K39#fr|w$ z6UYs#nQx82Hi4%I>=3w3;CBUnPvBJoZxDF1z#j|b_Se*ZpFr+BNc=H@&kB4=;Ohea zF7Pvf4(BW6%NE#G-~fR`1dbMXsKChrXA3-D;Cg|l3;eFY?+d&^Ah+XYxjz^9u)yC4 zd{N+A0zVPxasEU;eCS-mK>|kzJW}A%0`>e0dEU=4U!%Zv0=EdF3Oq&NMFKAsc%{Ib1pZXu0|K8C z_?*Bu1b!g!OMzXu&VYS=1P&EAM&OA8-{QIha_feivz3*^@1lsi)(_ZuSq1A)I5_(wvl`(6?J9l{e}pWt5z%;ow9>%ty{&@+$_ zazg|kDR3eo){RpHpG^q4`GPMI*hq+VWvk$)6GCpY;1>z}zQ7v<{+RGcrS28{A%VXp z#3c8;;I9xu-y4E+8+G!(5SZfn3-!?JHNb-fA1iQ%!1;s~h;zYL5JK-N!Pg0Xis0uE zV*cd@?3BAg;Pr&ivy*TV_Hq&Wg94u^hA2Uq|3<zwuF4wonS3n3pz9ph@y-o%`RPa*aj~4tW!KVm5NALxL*Ab%p4TPxg zH-*1R_}t%|{ObkYFHo<$X}92d{S7?D^)>9&>u|ssf*&iefe`mC&4TOoIqW|}@bd_P zUnKbV1iw=7n+TEr4x!&A^hXF`|DS~akwAX=h4cZ0$TvpdWPx)9))7uqYBeG3UN3M9 zA?!Iz@b3z|O6b=Kew*NT3VuJ~bUc?4{2AdtFZf>tekAmN2%hA91);41{@o@UIqUhu7i zvy{3}@GFG>L&1L}_$`9(7X0Ue|5ETL1%FoH>q7sl;2#P855co}e>WTRA|dLzA0h18 zU+{wkA1U}m!H*Dpy5O?}Kb~+7{vTZMwZd-`yhCvAAkOl>CGdwrzgqBH1ixMIp9_49 za4zoe1?MK&wD&c^KM?5fJ{0=%3Fl$_6TFxZ^1}olC$LiBLPE$d5m+bmGX!2jI3M@n zf^)l5>f0swJ%aBM{Bgmb7W_qlZwdWf!9Np-e?8Rty9gXC@Cbpk1l9>$M~He}D)3r? z+=+|ydjvir@OJ|LEbv{z1!n6f%6q)OMtyP#fpecU;`)9a_yK|+Ec~&8PZWHbK<>T9 z{L2Nl5JJy7!8Z%eU1TYD2_fvbL+JMl{+z(K1ZMNT9&-H%7vecIA@YwBSRrt>z{LVr z2|PvMIRY;ec!R*72>gY>-w~pmPY92}!RG}iFP{+gDHMF5;6ns25qy;3M+!b!@Y#aT z7yLxQmkG}O#He3CuRwXH3%*(S7YhC@!G9?D)q>w5`0awFTwW{`~blZ7JRJW z69umle7fMr5W@Zwg}zMa%|hQG^wWfX4k70M3x)nIpPw-0#Pf+T6g5MzcO@jYa@VfJi`3mMYxOjk!CwS!n=s${_Y-udk8Dc?|X!gDB!s7dR*Ysgt%Y&t-xmpaUb-& zz?TRs&F_1JZxYA-$=d?oBZU7x6!-}t*2SL-RD4c04ecXPKYzqJHjg-9H$tp4^>awT zzQnOk93ZfW5Y8_aIE)bMFa2B+u#7m?MPmf&=aX3198Mgtf^aULuL+z+h;_qEf%8Bdhmk{kgOz;teX#WXv-C+CPVOLq3m?_o;%9AVeH!e}b?5i8#>y0IvOkIMDS6 zuIrEXzgF_!NQm~oNANv_h=XSYf1VI=@Sflw5~BTc5`eUa5OGi>crhX4K=2Ae#KBC# z_48H4LA~Jmc`DkUADyDU?Sx$C2!0nKod2NUj}Rgb_%#~Jzek8T_*`)10!JJa6N0Zl z8iq!jCiqN3#KCo}2ipBDLbP`|^P`1^O=kE~okw1fT~5B}HBli>Hik`8|_N&&*p-zJ2Av%3Jo zuVsYrXFDPMsGpC(e{T_o-_FVdgulwV0>V%FcQ*LvapLgHp9$fQx_m(RLEnF){)!tq ztlg+eS{j;4Ce5E!g4d_(H-FpG8Ow>6+MOJc zwoj zYhJy&0XwhmgPGi)A#;-(?y}a_lE@~n=;hpXWgiL%Z_ko`Q8>D-4V@pmpAB{biqg#+ z#Od87TKC0}^bRSq14>3Oc9vwL)V5(`m1XVN*2fd zrA7R_=?J&`*ZeEnKyeI;-#jYwu3zaAWs|Hp&-(V6kt-+}=cvebTQn<}W$%tl_awd5 zPDby=$(d0F+deb|$GGJ!+(~aA>ZLb~%2;5UyY~uU__G@-nH|(JYV0H#912&o*S6GS z8$-RPPEC7bed9Xp@|GS9O;h;uTAC4U(Hd+cw=cCfO;lrrGdHX+BJOUkvzuwusS*s7 zZMDk)H?Afut}Piok>^qRT&~ahGvOq2<5XWVdb}pDTx%k|luMw2{RpGV=0Jo>B&V@7GFK9ADpa&t}cm~zd;xxQqS zK9`$wx`EcLZ^YJIb!*qwtZgaNdGvX-K4XJeXerm{GTdeCbE?4o3~s6XH0^49PZ{?% zHsLl+r*m=Ub<&{v`H@^|fZH#fc>f!f>kuA+mE-dR+=BV(y$jzKbCjv~L*nv0UoI zt);K8&gk>)%Y$;tQHIItZ=IoLzDXY z-bLl1!ncplZ)hK7n5@3HAQ#j(H=qxqFF*(?eEY`Wxe4i%VY2$3gmVD>nLk|LsCM=7y2v%haD&Hg1!#mHd*@^laTYvod5>Q z9V&uWjAHU|yawx-O z^^L-HP~WtGzF{KAe4oP)LHjr;7lCe*)%U)U^Zil;Ip#k^1g+dVkPDW3Y@poXkfj{+ zL}(AhZ3aoGAMjXvLh{69LDLm4KkFA>rANWi|)BFB99 zz@DIe*COBfBuKLQZZ~p%xqN=g{9_|>w?Gam{PawqT*jQOM+GL(V7U{ZZ-k#KU5{}_ z&M&uK%B63ZtbL;(7cBS9K)Dk|j`sGCl-mS-=Tng+tFL>c+)t!jJkr+5%JKb^V7Z?J z%H_Ck>w6Ohj9`5^X;m0iA$?aFIlsOYkfYsrWFC_H0px<^=4?riS9q-Mm;22~xqL7F zY|%wv>(Lr1_h~72lE_-Q=194H1LaN@eYE!{5kEfzeU+k%!0Ou>@$&#IMws8qTDcn| zejXMmw@UOe-`SCJi=i*BzNbgZ-6`cxg$^cL?kSOSCj`o!CUPwI?-4)W0e!_(B+2Ug zTf~3UpikQkxoRAgBmPvRJ@}1a(ka7a^*t8RH#cD4Op#;0MG^a6g1(hhB+2TV6)ATb ze&1kz{A8k&m75+ZcWIzp{H)^Fqao5B{48;iQ5Dj6LZm&`O1bz+CM35g(jIFA<>F@> zzuZMII@sSfKwq2aBCz#X0J&g4>Imq=&py6BeqkN@{C@ei*hd*AtM9;wzU={h_}R$U zmmRV1L+I;EgC$vgZbaV>=(F>}v5=)4MAWkp|K(xvM>=JgtiInz{P#@2zT-uX`5N7@ z|9V0n@6~Lw`Whe?^xvD%R|cW8ad0hS?W-{QeE-#BQO|NH!({ax9?{o#YkFKeQRJBK zA=pB55QaK6L7&w@g1zQ@GC})>K_BzezNI2Z{1T(jw{NZ3M;RuokMHdS^_4*%T%+|Z z6FKS|kOao`sM(kS&eJq#utrR)pe2)i3`~KT5_ECn(>N_!_Z!Pp$|D7aq z)Ys3%i{HMNL0??|;P1yl|8+p0^N_2W)%UUJgIPMw!le5GA4Eu^J|0_9H$p2nyaDeriVT4-7pdnOk;5*3S-#z?f<(@z#>@}J9KyGEg&#VX2qmT>MciNR8N`1HDl5%V}z84hK zSKNquHO!edS>Dg0`mTZmnDpN^99G{n#0!c^rw#a@7ZgN2wKyo(4Tt=?v%aNvZAo28 zb7@&oI+<&89yex;W{e*_Gg_ zFTd2(UAuO5d|lVwDn|arQ9E8adeDwnpz|$NvEyaT=C8n(RF>NDGHHa}I_`awrtI2v zV+Zq4&gWI!`)1mn8#^2|?-lqcr2thyZjUbu=JXi&WodWSO_%YNb+9%K9k}l{(Pot4 ze3fm9vK=owMLS+jL~OBTF8dn&@Kt417#qG8pQru5t0P+#hW$Qm*joI@%XRWkV)R!R`oUd%EpKniN}oeZaZFf5x<#i z%tW`gcYKX8hd%Ug*^=CU-}^W1-`kjzson~)58hkz)LQll7h{ndjej*K_Z25^{wrV3 znS*g_M|X^MeVK=2ir}HKkNsuq*XT!GxBm+p-uxPE;C#pVrvpbYah_x1^i2L99CBnTH`Lus|41Wq}tYZg`b{y6&3oAh*e-DmLI4s@5D$vNM{tIIG zSaN6|bpT!-!>7;b!#y~z!(sJWh(|V>PyM&W@Q((KJ|O?z82(htM4;iK7F@ z?{Lr_sPgULZ+7JG!SOPVD4%wc&rJUl!ygVB+pq)2r#PbdM}S8D9vmKYMEN6yPyO9v z_=kYc80x^WKlnD;%L75+bq5aKA2Bf=Stip#IEZ)P7!5w@LH;n{jIRzH6*2sSL1+7s zKPQHdM*x2Li=}*!eE;GWSM&D(u8!gJH%U##>GT*rZaaMYF9P4jjfK2DV14%B*b&3; zEqoSoTMVDSIokU3xr)_mA;$#U|9&6C-%t3||JN9PKk%*pxF3ntYaxGAwEd$16|r;+ z2MC|~i(>e^ePeuf;NbtIN8@Xt@b>^tj^XonMdqje1u^^*uoyEPIQW0~QT_Z~i2OY` z+GF@-!l!=ja}v#81U^`*0>`D`+eDpALvWDaf#b>;ezEZP0NxbC9}GIl6*%~QfYoc^ zP~mp~?up?aApAXmkH_$*fzJL(BmW3K>&HZ!nWp357)`>TWB4HH#291BGC;=!FLm1h z>M{VW-Fi#}u5|-W!NF8%fT|M6@tMim#qpNuXaoFRRPAji$3rF?e;nVKMi}7#X2@}g z=|BVYIK#_ff^*zp;`qSCae#^aor(RL$==?xpEBA10kCs1`xg`Y5tIE5p8bN!KE7a_ zGclf-7`IG}PbS78Q;|NKxZ)+_hiR|@{%_fAcP6$k6WcME@Xh0q__*{)egj%xPaNf6 zhwN{7^OIsO!?wr?Jm8C-u zzZz}n_L_P54QiX$UNf(~*7^f7{7kvkqp$H@W_m~2Z#Qdq_z3HrMvk65ZcG4$dG=$_ zzJt>Q@v={#Rcr#EpiP7RGyz#ypij_F2oiJ_<6vJ1ABi71B|_5~BQ%{iWHK`b2|8Dh zz$|oRsH_lySwaL|N;C@{?d#B`fPk-SYkz21SrxnFRJRpyx6c~P&#TpffbzJN$_iS^8api@Wj^^onN;uj)&;Q1YB;j{o|X} z2+p^HF+D$R8vmI??wUGv!mqihSm^&B>JS)K_CBfy#u6(S-(W^ik91bBb3crbm;suz<|( z;kfxa6A)|^NP}n&6?XG^K)UyW_JeRcUFc~oJ$R?zQ$ld`=C=5FlM|fIcTa0GNOy>!BP^uj}1PV%!3Dyz=-o zBe@W#wP^c9dv;FZsPL09Y zNln8!k*dSlP4NkCR_bz`z0@5zCsW*8KRd-Iqd6(=1CpCM5a(2?66Y?d8l3Y|+z+{H zin|}@r*`37km3%;-BSF&rS7RD%r8tGh;xtB(Kz=^EyuZ6Y8%eIQ`h6%C-o@KeN%7a zykDvS-szVr#kqfqJO2(yHRHU0>LQ#6rf$V~Q0gh1i&C%SJUI0Q&O=h%t9NK>G|t8N zE-)e{wF>70Q~1uCIw*Aw&cjmwjq|~&KjC~x3Lkk>!&BXGi#Q@R9Osd#qj4@tEyuYu zwGHR8)b%)*r|!pjRO$tsN2mUQ^O#g`+=z}%@xQyrrDo$iKD8R>390jOo|w7`=R;Eu z<9t}^6`T)GeTnlCss5NKj!ccm`KS~Z1r@1goF}Eu!+CP*2Arp)?#H<@^(UOGQlH>_ zbc%c6PED2IJS}xJ&eKyXaIQ{m!g)rDU#OXxx)bMFsi$$Coq7xBIjTz!Hd|KS$!Gy@ z9Zp?0<8(ZN#hK{j6Bao=odO#&&VG(67>p445K_(nC#zs61`Y;`GsMX$C;{>fw2gCs zlUKljNpprf-3s_7-wJZdot_2NmNUlbTfjYE*N`*b8K9D1(gaYPrzHgMPaTNjRB8g_ zGBq9NMCy2)-4r*w%}SkyvzNL6=Va=KIA^DB$2lkU0M5Co-{PD~y^V91)aN+osk{?V zmbVnAE~8OSj??96052=AmGlibb>)8@Rnh~wPB+4`L`lx^5ZWK{lPFg?d;@Vcug7HN zJdEo{c|9>F=MT7Mj3p}aa$dr986qb!wOh_#aD5!F=k&~ZAJ>eu#5elpe1_{?yk0UO zCmZGHU7eQ|<@B-F%Zqak!u4M$bJDP!ak$nyJg*+1lEYBYJScD)#8JnmYGI>FZNS+{ z=^bHG*Wubt-HmfrihJRDssF(_naV-N?9?Efb5i4Q&Q*CW(AS+URCqqF3NPU4$2>iV zlj@PY4B$GJ_fjsUvYh98t^s;R&ogmWJ-& z-GNe)3>W_IzB@cGfl9~b;k#YYjCs_S$FCp-vgi_GrMV4vW3QK9Xlom_bW+~saluIq;TuZspQod^`KeLn_ zmcs9W=+fV^l;=Rv?s?i$-n23wS<0uDazH{nmckNB=So>hA5gUBGD{g|DTi6gL`ylz zQmU<%CuX`N=xaml#Q0MI9u%De#P3JNtSYnm3cEMGB;Y8CoJVBR^~%XdBjp2 ztA{%n>w4u|$~%_wuC*r%H!-^O-&#r`C_2|aEM=Ibc&^xUq@{GXl!cZuz*0`Kl!Gj# z!&1gr%H@`Fl%?EmDb<$pn58VTl$R}KnWgX>FWTnSmeLhJVQI?uErt6Q>zZz|6z*KC zWp1#P8J2RprPNx=%a+3ZinX4HEae<4^R}g2X(=CD%AJ-{VB70{tLH;cy!x1xnQUdA zw=xG=%3rKZyQO?)WsbL$T>NaO>($>i&IqrPLBXjuIxw9*GZm`b0;o11}2xNoV##+ z1O-pb%6Smivv^&Tqw*&6g2U_Gpt`5I#Py=MQstdUUL#K1v5e22+mGOECwp?v^N@WF z^z2HNGap1wV%b#{IqmlP=so>6;QAM&PpxqJpJtJ1)13ZWf!s{a^tn#|3oTN;)ag&l zG-t+Ir$3iZG(UT0hoidw4aH4_tkde`6IM7!It6b)o~v?a5|&$BVNu?x#Bz%}HFE}X zrenGF1(0u|KxYn?Te-;mZ6b5A-0CHzI}5SgIuHmaBWICQT)?fHX^L}#GfXehH0MNT zLIEq!Nyw>n4p(`bA=BH;vw9-qN#$Jzs+l?UEU7u1VwKB@Ui-J3a_JtqPI5YLLYeNS zF2?|5=j1&PO7abyt_7a6pc_F&&K%$QIrC7EgBdBAhZDDk&ONdpL5`COjj zsvP=QUmup0vm4ikLO%EK9AnG?&XA0wnN+n1r{6&&HN79fv~H=&oL}K$Bj~B4RnBj4 zeI~D`PE+YvDGXd^`3iqPg*W2#4l;GA>POJi=~CebW|zq(Fd2+prevwSrh>| zys6y?I`XFEWCOkna$Xf2*0xt8vXbXa3@#)sei`gK#uzruj$k;yw$|91hhDrdbmp=1Wu3w9H_(|slbjB&;s!bk=4*s~V$h#p3?S~C=DPTismPfJFt5m& z4=}&TSpcvAccb0${}9Qp4vQ)LC$bdktH5fKBVWL(?X+rJ(5h`gtG0<%$I*~&bONkm zU(Y&=Rt-#CthB*rX@e6NXK9NyZ_q`U3HQO`gJ|&)QHwdmMwjCOv#+7q7X{6}C}{RY zL9@4u*-Kf6?HpEUwywl>sYI5p#KlsH99@Zvwc8hBO52A@9KlL_FSZi=m_W29d8}Tb zIzMA|E)Q1ca;c7X{N<(w^K}g_*ENt$e1jGEGEf2C0CBbl z%zm6^UmZ02>Y&+Ii`gsa_^ZY2HAJqlW}gn)xyJ6Xy`=^FC4^wrqV;%3shFzgxnaL?HGmZ|IO^@ zo9x=%MLPQsX5YzrA2i3R*hv)!Z2+pr!=1q{e6w`ni)raC+ADVCxm7ST^6X+05B)Zj ze2=2HUxx}0y#*-ege=`0!&0!R2qZQ5*R<{=6ZHIcf*CAz&}hHu6E&*5L&5I%Ax>q9 z~#xX#XOjLnZa2ymUX;YD?daA{F@!t@epU84yv0S>OVxH>K2FP z4tM5i!*@Bfe9&Xm4Q;W5K7uR{|Mix9P6wH`UmL80EMUki8gfU-kUK(#+z~S5&X6HL zHHIuiL3=agAR6*sMng>4HPDc|bK(vsL)Xb=( zTPBZp2)ZvAuY8||9LJJ}o{N%nrA{DPyc@ZTO+m&dXHau(A+-iOaZLVzEBM)gtZ5-vOf#E2bM)tioupH&X7UZ6yU2{Eh=&2zvH|6mrMO(&dJ4?QxWka=PC2h8LL$z%sKLD-+ zcBrD|Rmk|OLdIWhjn}KrtCL*6(RjUZzS`Estl6%ybumllYfN3Xv%s%zgKw}d zzl^kju1nnVGf*LZt|aTGP=#)?71I8{NvbekuRw1yRd5#QCFo9D1EtrXK58m-bGSk` zn+oxJBwt;j!L6)N53{V$trMvX12oXp12wvUHM%2IqdRPkbPvBnV%@An@6=DC2K{Ys zW?@3&=ZR9Q(+-a9`B$^(-MX+5N7|lyPjV_cK=Bm(b9`~I=ktTjsbh5L1$+LT)bVh# zv+x1L@@mKf!?TKK|zgW*ohsb^M#R=W> zlU(?Hb=3VD7IZmJJLN#+=+yK1ASPhhi?r;rkY$&JEW6BFX71P$!JdD)w#@JOR~WNx z&%eUh{qudZ`+sQn%@Mo5qUZCwJ6TtUjK4Z${M8}jud&AKo_|du)bp>gb&G?itDs)S@LbsR-oiKP`Dm3^&R;bkUd|jhRWit2tLs+A`Lp8eF)=2mKyCv35&%ej4 zzuwxLS?KwbXwS-Yuta)3z3MEP!lLgC6@6!@=sQD2|HKr%e8^rrf})qO=nWZ*Hp`90 zEc(B7VI#Pis9r8SkhqM4&Rr-VH0W%k#(9PGYjDtMrj92QB{$mqPilR|pCW&F(7A{T zjyDQ)*EV+oo2cLvm!{f9-zhGa8zs+!q@90?OV5=gaMBB_Q(ZRfps%kDZHy@%=7lw?w zP#a}O^b55~Sj*{td!ZK`H!srW_~Yh9+FGFIUf*yBeFOtw|5vQH2lHEbd4mEr>(Km) zf%A{F{)UkCH(2X+qupRkl6&|YJslRO91v#_`oynj!yUR{-)%u>{SS+~GF04^q2jI# z6}Q6__m@n?y~*Mph%3(YJ_pls)>FEG5!{OB8qPq!^7vDK@wfvcz3)pZt0|=2!QNLu z9nX0sSy&zF-us-^SG*qi!@aK?Z^BM83Ib6(fC{#S>by;>DB*tq>Pdf_iP~D==3%pm zTK>O_dE9KG_LFdtouYOy4JbDe(DR^h)bclxK-8Aes7pgeU1}Rbn{;U?YA+2%?PcMp zy(}EHhC65{4A_ULoj{vs1Z>`ysI8>+KMh&`Q)|7B+MkBP=q?jRWy9huLe$Qo4NvNV zeYXXjbv%o^HB{WKq2g{06}QV2cV(vHRilr1 z&JTy`{D`UZx1phPqr=7gpl06dadoD+v*a2UcVDQu`$EOt7bt4A*KMonO1Ncrh z(J5MA@pUi?|5*4H!}X9qz{IY%XcK>d9GxDI@Fz*#9%yk`{3I(hmDax|rw(0hfYY%xzqDxpP}a%T2O*iyU# zT0)_hjmI5bk1wS4!O;7NI<{w*)Y$yn&C`(^kv|-I`%^)KQ4pwV4xRaPQ`K)BN4GFV^I85^!T;NQR&O-F zwb#NtV_rsoM)Uux^41Out>4&HnWFkL(J4D;+MESN!wxR0Yr;3Riqv^F-cDJmaT zQdUx4G_0v<-RhBRTbfU5sB0@4GX}3Y*DW7kR@N|T{P?m7b>-#bmXBLrhl^!n>S}Ap z){ZNyZ5UN|u&O$=bbWKns?wFUEvuW?Y;10=sjqFTEq!C>&R6d`=k-f|_S)`mzjp7p zUcc&^(otoj@K;_|Dj(}9ZE9TBQrog|acB!XC|pd1i^B>RcUHLADqOs*y|Jmj#(o0` zhBVYJYaF?5d~N!hGo8O^ra#`(zNWQt#hQltqDFkpZPw(f%7rr*)J&N^cUsl_n%Q$^ zS9PKtGjnE?hL`PY;H?_I`W{iCSrbQPV&O&cOe`wo>);s_W?)fa29{Q6UYO6MGb2~4 z&B)c7@lt&zwec*iGoD3-eC0la!VD}bjA7Zg@-sD2njhazKA-wyn%L)OXt6XO`eWM0 z=WB;_ZgHQVxdGE6EF!j@d=XvB-bFIBr>_FrG1PEZg-G-Gd|kv|_!*kl&rkh(Ye?#k z;bRkpxb`7A#_d|VvMN)KDzGx=8oifnqvP_~4L0KP`Mj9&(mcH}N5tc4Zf9>#!mb|- z`DiQI!HOGJMAX^ADg#S5Yv)|)X5)ypH$KB=FZ>MpC(WNeDO2AyJm`(-mzqbNnRq(P zJNGwVXH0YWIy3RK&e-0SR-2ivJ&>8LmB+O-9TeXu(*|eCmtm;YPLJ=0zRs9FXlfZB z2x$*=4gz0iOn}&k<$gLDA~pky{>;FlFS*H1j6&v$VNJ1Hu|%?1dX2v`OGLohKVwl` zX>7Q74(*8N(D)gP=4MtG%QE`rMwdif2Gz7FeymX8^L-7z)>(5f28Px^niA|znh@*@ zh7f2dO$fGukqAViCImxC6BaC-Uo|N`LYZ8FxY2}QD;WvhMr??1Edp-Ta&(?uEz07P zRfik!z3iH0jcrX0Yt$NklM$cOZBdQuYFZmlX;90XYFD(vQ*CNlQ!~B?tBK2MTOp>G zmwutLfSg_#_FsS;vy6l^LM28Arm7g~=y3*&>!aeNqhBhJ4hAjrH(g zL*25P?c4=PQ&{Erm8x-jDSLwPr z>Xy}+66k+$>y}H2&Gw?Mt;I-eXloVGww8w4)pD&ri(Z58mxgeB7~J4>Z5wK8o6y2( zlwZ~~m^DwrhOG}1B2@k5&ra0z=aiA7re@Oo`IC;TSup+hs+xtz&8@1biE2rIIkUE* zRZoHRt?sBK_!k^PLLBz=5P<^*y%x$6A}~vcptCGrMi9;wq3Mhf8Z)siLK#B@<_ZyX zacH$r7B-_#&;D zgqAwJ7!x)z9XMJVW6ApEjjb!wP3BX=e7}8sJ|chI7^5^zvp%ZB_|??ZSR0NUpQ?5H zSSW^kDxKg5l26s1u+fyJ!h^nrK2^6`XIaK$AZUDXni0#;dSY`>Rp%;GPbaEY(uvCI z_$|!~-g-JI6fC}cXPti7_%hl~8$0y~M!yY+XbqZ*87stT03pa7-HAOq z&G*~Ns)`au2bxoVu@~QoH`ZG$9m9dI&Id%+HaB55uJa3&L0`&*HPdFQre-`#($X9y_GN21cv!|=P7-q z+SWJJrdyg>I3LDUo%9UW1Xxjv$m(Pji6P4v+eWuv9Wz`8szX936N5jJ$&8YLOeBOd znV!K`^h?qtC~99DCWXyrj|yo@cco4-5n%-bBg*33>=zql24cZyMQZHRL)QA#kj4Jg zVS*qS#SvD};wUQ|&rxo`WS?bB4#jYk7YrMp7pjs^4OK}GO`ZIorUolQYK$oXa?lEr zLk5r#EgM5%T;Y}+DSb4H9~JG+(3@sNEZ|HWh-NL?*#>AGok^=^1hx8uZ2MaL1k>Qh zo=-O}>P!z=;!B6D2@IaGTJ%&Oqes)Vru1maH48s?q|zj~vlGdz_9BA3X^4=x&htse zIDKyyrNLEcIsYEd7=b&!h>;w~v<6<#(5U7J-PdmE=@NnzT?)s$fJ$8qY3VE$)8ZWI zqT-~b#Vuy)pjQYwc+I3OwI*3AVO*o-?7gls!>4tGKg{^Oz-Wok{dSAe^^J)xCd#p` z<I z)(vQ@6=ZN|iZnr*CO_7# zjceAnx2fj#HUcc{SG29e+8)JFXYN8#pM+I{yz~LPGwKR<_(E_Rp4}U zx+e;=dOE#SAGa^I6YG~4h^@o$K@!oNE>r{(jtD*b;a06OuX6zo4Zkno?t z^^1tQH1p37mH9arI$IO|Hw?()KS@}6(4HdDgLs^M`=XzEW=gq1ee}=1TFYKQYpj-b0W*KmSjc z7gwL4Km9n0#2x=RDK73tWT5+cBK`Z{(X$8t#+RjT#ml$&a^`3GT?v3F68??M*SZEtNU6;-A9 zKcAxo-e6Wc#9)_FCgMt63Vb@6|MGyi%LVX%Qz8`wT{6s;R#vhd4qA%<#Qr~sjMvJ z!5r*#)8RN?UaAM)AaR^D^{iOx#j(^YVyV~0QlE&WJ{(K^HK;|Y8D1_n|2ori&P?Ql zOnd=sFSTVxA}>VVrOCaM?qjFF?>R~L0jE0Y-g|nrmzQ+^+o_J!^A^|fx~6(YsCULv z?*?_4wr7jyZH-v-3ovt2y*y`*=iL>xX=@gJyd{$5kIM17XVUiym@&0`G*;8wd(-q$ zyrv)Kv*yuuzZTToRL`XQ$CEeHdpq;1y{R3Zm#lVwe{yxC0=Gc8OKN7O2D%&Um?~`V z8W(Vv$5O9}rQRG%y)%}&8`Qnn_%PTpHeT$-*?2`P_1akKEwR*lVyQogrT#ald$IgU zuwyL$EEyMSd$QxG9bHJB8EMsvG&LF+H)?9HNJrTbOMME|y>#5?z>cx}EUhbQ&1ISz zwdO8OjasuSmin^Mn<+})0XxQ;M`CsDiKTv``@t+PcZTQuJmR6ZbcfpFIp=rc;C01xa@FmF(-^kx zP@jeH;c90HFI8JY_-M5>gpXH8gz&@E7ezt+N2zB+_!RZi5I$9XCxp*XhlcPu>YR}N zF6!?ge1WyjzlF-XNIetOS zk9sA9Kc>DD!k<#BLilggv=IIWbwCJzPQ4Z???rWg2!BOg8N%OCRU!N>H6(<;t6mD> z{nejB<$a(o4B;QEdqeVr)DHw!6o4GI*;c!&0vn8azm(w?7-xun{ko|+47ee|AoYzA2^_=%Y z@&`G+LgjUF4h@yp$Khs;Ohq^x^`+_+%0JlQ&Yes}I2?TWc3{X~{hjeCa?SIc1jbL? zH3jf4%EfzaOuR2l;H#3{pOwkru38ep3)FpNAQj~{IN14vw2#T(>bw!McY!LyyTVMS{1epo z@a`IuDZfUI6?=<8OW@1Ti$d)&()o3$yi%tlsI;k1V0=`iPnQ2$uqoD=fbB!r`b{PIgHD5l&%9|1r*?A^lUF#UcIEohL)~k9Wq0^v`jg47J}DwItMj zXQ?Yf?RTC!E!2KzsP{tcb*WksYOn998>D_F9@jg)a#=guKHpZ0Lh*c&x+E0;Cp+8? ziiu_?@YUF@A$_Mh{}bY0qgIFPnW0_?^{+YV<50Y8adw9K!yBpx-X>%+{oyUu8~dg( z72$AHowHH;2cOF%)GMkSZ;3J)`4`n~A^m4Mhll$62kNJy&&YqQo(qk)4bG|hzTbQy zDWTp~eM95P1L`61KS4s>rA& zKM2L&m1=Y-{*F@DhvILFx;x~b(Q1_N>5l|Hk#l^g{MAlJ$lg-LuevZ9dxslD&MqHW z1(J*TE0|m*jU_}^$zb8*(ilE2jpyTHypIQNMnH4TzM#S-evp673s*($EsgL;NAU3x z{ICdqR0N+A!KX&>84-L=1YZ!r7e(+BB6v*%uZ!R-BKWEZ-Wiy$F6~1ivPN-w?rXir}|K@E=F;pGNSzBlvw0{DBDma0GuW zfSAcB7!!9R=OUqtXPBe;It@6#|oI6i_4 zS9uXUJA&s%@GcR&YXmQd;QW+WI=Q$XNnlZ$|7TVhkn#-?`6p#PPBHS&SKZ@w%uF*D;|9{AP^Y|)??0vZUcJ3uWfUt)U zBp^#bmLx2qq6P(l01_4z6%8STWeg;efT%bI1i=Nx9Y!3YqJuj+>Y$?HjyozUu9Jlb zDvr3L;|#y&sXpDeZslJ5{yyLL{p0<-1>H}bI;WmGwRUyio7;nAzsWSpSyug$t@izo zmH#En{?ArtD_~)xAHqy{sB>U zbo;zz+0V4>&$R3ZcZ?>mzVj{l_NZF(8+2OUC<$AEt<@aoODX?TLDv*baR{JSNux5_`(D*r9NFd)mTvhsgvjpylB{sUHiW4dcT zs=N4?0l9qiecsE|pDx?CF8*c2Pk&MDCtLO}NxI*NzWvLR?q5#)blDDeIo;yf z;eCfCW4xm>ku}4=Ecy9f^?rLQW2&RSbJWGZ?D_iFyq`zv;$PnUblGlp@h@9``Wxck zS(YDfT7LMKKR+Kji+z+a&Cx%{)W{EPXL%pqCA_#y#^rqu*o|e6^B3$11N*(&t*~a(mKco|V2w>=#(+4U+C}d;D_0u6emjkF&2lzAh`Qa^!ZZi@(kB{o5~oueR*Jk#v9C%R<$W*dRhGTn{&n%Ub-w+NmVbQRF@vxFN&Lh1Fs^?;d*)r1 zTlwVnvWvfM^!W~Y&zCa%?W&*ttIW$vi|04XKY!cn=fiEQZoh>I{QF&a{mq-754X25 z^WEPr`}+S1@8Sf!hrIluq278KIvVd^LsR_!MjmF>*Oqa68PgtrBp++p|B-y0Wk39X zDIag;|Nokd&3;UK|B-y6W&cNVo@GD6l25Ya|6BW$t^6Y$c@8bw#Kt*Ax2~tp{qoQO_j$i~US8ali0kzoPB2KhgHshv@RK z-_Z8hUub*mCv^R=f6(?niaquP+8)>cxc0dIYkOSpHNRo6+a1??&5P^1wgYNAT+cNx zCV|%DI<56Ut;cm)>v8?n$g5MCij|>CRf5VCBzY@W#1Ro}%AKoBx z-xdL)ANmMR7Q9$+li-^~^v}2fgOnXj!GA~J8`t5Kk1`>Fy#v!b*kvk6f6;3EVxqeD#7an^>_f!Z6e<( zc#q&if{zJ4CHS1+D}s6)fd@lE`;D&Eh_2PxAc(HgGP*(|ri4Z`kw#p?G~&{v5tkf| zxRhwbB|;;XevMetHDamOh$UDfwpJQ(3D-DEkXu={+ay6gvY>p9V6oslLEK7fJ-6nx z}P&M4pj?`GN(4MS^n$ zFA-cRxJGcj;9Y_b3qCFQs^I&AwSxS94a@&kFwAufa%;ivf;oam3mz|s_f2d2v4Rr? zPZK;_ut;!@;Prxf9YuM66ZrwbX9Rx{)axYdnsEICwj*AIZzzh)@9Bh;qlSun5)t=< zqeY%dbR2c2$g_#q$DSuLzb6vHVsMGbR}zyPb*;!7h}hrWF7ks!>~sGv@^)eqN4+HS zyToKieJJuCA{Lo1Mb_&$_QC%aIhpG;_QNfRs9!oU#Zh{lhun{H3rFRM{sbcS$tR0k zK*Zv8n#ePWxF4J&awQS_=nF-@oQVDORU)q=ViCJd$OXFnt|e?p%7?dL>(i`Wk9 zugEn-+%NK{<>~+TL@c7eh@8ah4)*0uiO_c-Vt?LQpp6f*ZD-jppJ4N0?#C_0XB0o<&*-@{Eyo)%*Q6Gu?1#u+$ zPvl<(n>I%}{7n_?B-m3hM{u-YvEZKsD+DhUyh`vE!A*h>3qB+Gy5MfXuLQpr{I_6o zisxT@!R~?s1&0fc6+B(ASg>61HNkfTYX$cS9uSPQ@XBi;*g>$n-~ho%g3|@Mysk1Wys1EO@TqD#2R>|0;O5;3I<12)-ux zfnc5B4}!l5hFW=kwG>Pj>?N2hI7e^+@p;^*h`dtpdclo?_X|Eng#G6tC#6Du0rxRP zv`=TjEWsgyCkYk^^85I-pHD>owIV-7d{L>FM1EKBpMv`Ze-&)f+T&?2c%)!15j>}f zd?oQErEV1YcEJY)pAy_5_<`Ua!5@go-vKuy^m_#HWjqQOd75B};6lMm1=k4PDtM3J zRw8&l5xIF=$ge2Xo``a~3l0<e3BD${TdjkR? z`C@t6zajEo;+sl+C-Nb|7PwJm{?3AZ1dk!Y{xp%xiEk-&k;s=5QLigS{)_1UCNf_j z&F2!&i2O1U_OFS|_cK%eSmdvWusdtBJyt(`9aY?CGrm9yGrr>r7ZU&BJ4jCdB5m?6PfSW3^h1Ci@Q{zBxRiOB!E z$o%^OK2PFXm{@)vBKZ1?e7xxMMLvW05&Bi+c|_Rrdoav@iRiBqc^&a%rS1@Ui{LYY zZwP)Y_!aSErCN0M_;QJ#;Q5ot`GV5~XA4#eUM6_G;2p$Ia9t4jTjHlm|6LRPZIa=Y z(_ZjM!5qOn!HI(B3N9diisx-2Zzq1H)N3N|7W_i+N5N1Rue{cRnSuiaPb7Y()J&1D zC*t|<29fU-+$zWyPqH2#5MlSd$Ssb5jE6`3z7q9E646h+MLt^ee2E_QlZZ7+oh@=P z5%zOLzCiRVMZTU`3%^9ZS8%J~%YwTE_Yh&QTST-=SHb>* z#|e%j!fuYp%ZYn&ofml>5&gSC)T`CGh&oQU!|5YZm# zBKH;j(ISr|9#HC3kxwVW{w$IIB>E*HuOxn_)U_htCU_4K`5qAY36Y-``BjnM6!|kE zczzW*y*K3V@i`3%Z#PZ7CLr9Ef zCSremzu*?)Zp=5qtwijfw+U`1V!!*M;11#^xL*{6%X*&)7c_!O?+-r}tRa4`)E>co z#D8MHAb5aSgZGOH9wgRc|1XG-81z009}Q?sCf1|>1@VYo?_2O_Tq7P~>-~uSoV!8c zy{3@AK>rJ75%=QyCWuF(dLMyDnHup3UtjO>=vyNmvFhtL9$jk0(AU@B@qz_JRA#E+ zG$O8x(*5sgqOxP*x7%u>NBBCZoF1XmNW{$DM)mWal?QE(j* z>-q-4Y9iL&e|oon}~Jd zQ^6V{)`>lW`-oTv_6w%5pU2Agn=sF_MD9n#{2nIqa3Tib7?H;lUs7tC$kU0K-*ZJS zCB7o_3H(bb?@(&B=&vSXo>z;k=LhEbR*|<6G0%}j`}YPBr`;ldO2j@`RJf9}=bYhKC^Vf1dmm>L+p!;@7C3$b*UKchN*VKf zhUjMzG0&HXyp)J}zE-G0#&)Zbv+b`ib0wh{O!Pg!MyE9#C$!8h)Ji%4d&+slrb-_A!0smBVr!D zOXU0`V%~*Wf6TY;M9ee&c|YdYX_PUqN{N_H%ZZpr8;O`dj}tL(-XLPW=+EUbPtxc= z=Ep!H=EW!?=7aux9rNIP${7Evh#2>`5i#Dk5i!o+BVv4iNvy+f9~0~G{5uTXgMAaR zL8%c$jN3Da7_WpUBCSsiF&*3q? z&Y_HPRYAmfx`K#tw2_GM^9&K==6xc@%hyDV6Q>Cf;fqQ9+I1Q@@R9ccIq_1=$X2TA-9b1TXJ)lWO!`w3CJAV%y5%qp3=Xij0#%$W;I z7OMgJjXv{dmdvUw#gFd?zh|!o6qn7PUxK&m_&SeA`xo=_0sdS*e^NUp5kE5;n?S1= z3sx#7fmMo02r3kl8vLevOsaM~CWXK39m^LqM2sCB^M3Uml~4l~mXr?QPlfBq!mF2qZ}nc_7yevdq8#b|NnJ8FWe%FpQ=8G`yY zR_RKkSMkaf?JoT(Su$_d65Xi-j1Kd<-ur=fZOUFhtbxVF-lFUAi4tlp7ItxBmV{c1 zC1|Yp&Lmb_JoGwf-S}LGH?jEW{~z!j-o)bbyO%E|(ZBp3?Ya0WD}ONF*+Tw{0 zSx$4?6Lb0)%7h%jD@2Ui1RSwSizDdRU?v#l=>dIM3yUr2sf28YwXoQ9hj>ipdlQU0 z1}ke}BLj;o+A-dH46GJUthRW#220lmFOP^ilu&E2u+NP-8;9wz78cv#nG$L(mY`=6 zSMTs97N5RWfGhU>7%^?7U&IkdpMc4KKao8`{gUG78#DR67rf*n#-sRJi^b}jI82AN zu-J_LiNlmoYq8i}6Nl>XCKjLHrm^oaiD|27@5L6DfGPIXDvg=q=o>T1t|EAwOAJk1 zrNzPal*P$^WmA+Rk<#L@SH#9dhqbWSf^JFZ)?qCyHr;OtnG$L(mS{r+@2iT}O0i0d z17%4|2k+yFawJk(98o{wa3oS%99Cb%Av&yu#b)(I9Ja$+SZqdr#9>OPwOFDJQEa># zD%#kG(OXQG@A2vW$jIWfS{Iynt*CYR{R12G-od+4%N^5f{Pd`ObHUp3^|f4s^($24 zTJROMi7hxh34ihv~~P<|HiG7erIn&i=fvIZ$>X-UNhXN zsDSA3X1W{9w-_fT(l1R;=(yjXY}@$l6L`d`B{uV`me?X7V$~9x`Bh775fH_^mb+04 z_*LV;_#ad)v6)}B#1?@^y4Mnx=U452K%{#uAyF`9je6<3ctbXx2pF?E`o87H?Zy56 zVf4W+{xCM2+QECK8n zL|X*QQerc|zKJaYB6ee9v!ELjn`o!ea)~X1ve>|h&A9XhrtzDQOUNIY_-~Ai&)_$) zY(wH31x4t|;_ZLpTlx+CKcmxA=8x#~SU;Rm)H_}Z4`-<#cCZfdoe##Ww||On6pVoQ z>R@^F)C^i=7(A5q-&HAZ;q}%?y>{beUM1!e+1U%xfmTMnGt+OG z)ETYKps~*L6_rst``Kx%)?#5jV-0ln#>rMbfAbb6Z+w-NpCc$v-p0vRK0R9+SGRGp zl}}Hh#`zj2Tlu1crE%s2I*TC~w{fbQKxZ*{5APb6A1B?)iEhNDsBz9X=~m8QfXB(* zSmzITb|1T64@N(cV<{$qRxt_ey_f`cOH4x0)G?_+^Tnj*5pWECzqd z*}3DSTRHtnXXlKQZsqi+ot-mIx|K5+2=SULk<#J_hD|(76%hbiV6;I(mK8-0mcn}z*vgpRC(J`psNRFGAAVc6(<6PRO zXmad(HqB1+Y_MGqSlKXMD)yK`YScM1)pE{MS2t0==jgLO z4H>FU^m&jz=jwBgKI_wvA=*Tr2kCRJKIiE3kiaji3H2V5Ifo3^`Sp2_KIiIlj+d@Y z25A$09;DB?`kdpXXp>xRqR)f$Iai-^yf~FZbF`s857y^F`kbrJIo=spt1|tl4}Fz0 zAV(GAGcvs88!s5YVBUgRg~jFNh2;ygHJv^W(dWVXJV>8&^*KkMv+*^M|7mEGslSpH zm`}rZeIHTAOS^VS=b{_Urm zQ3$>Yr0tS{TRpz=)&{T1JQsl33jG``waik6anAo zDVi_vuK+rhLmLL)zmH*O@*ObzLs0?W8D4(`<6xS>Ve(C}`h#DPX1VN-Rt8_T#~1iF z9Xi_4hQar*pT(C9KEHokiyia*2N}$9I?LcdG~oLcc4mFk4FB4S9r-@+_yYgtB8};^ zVSrkPcP+k5!@u@o$9xeC4AZ}I(P`cC4hJT&Jj`?21$@Fij!GUPNw;gsS-x$Nc&SFQt4IW?MUlr1rP8$Z_zjYR0f#F{l zv17g;kkRySHPZUw@Pp6CzvDFhn_=*Eg)!~O_m0OG`1h!!(}uz4d(+}8H~6}V9r@;_ z#rn4mX-Eo!&o>K+rhioi-;uEP{TuD^1^(@Vj^)sX!RI^K;#+I*^%Ohidjc8E_WKlR znK=C5^F4-$>0dSYn4j~vH;{Ie`MX9)3jF(B(rLrs^Ic={Z8rStBX;E5=8flIec|`G zeGZdvt2Lgt8vY$+@U6AxM>6iWyx5Vye@3i-Yrz+`!!{GbJzk@gV3JksxVn_d~ zt^VcTJs>FvKHmnbKV}$wC&Surze_#7z(4-o1k0ffgU@%d#aC|djS@TNOLAk|Zx8t5 z^)EM=W__!`$NcQy(FWhAR{!$vIA}*32H(HkR{yRx{2MEF%s0pC-`~L(uYZfJ{#a-5 zjWhU0S^b*@KUfZJ7<~UmSbUoez6oN-e7n8=2dF?pKq7dA6pH+iLj;}`TpVY z1^qil{G$zn&-ZtWZ->D*N$kj1i_JcoEby-Yd_D(~gZO8#Gy8Wp_?VylJ4Ng$Kko4b z{!JDCXv5%hKVtFK82+6mcI4yVGnoGI?{a#ONP^FI6e6a72MqttfGzFF*9;Nx1^!iu zf3#un`63qILBqc@#g2S^vDq^HTMfQ=@BVFq83*wMeN zlvw|`KKL9aUk})s{*3`2^K<+a8+^YvkL}+Y@sBnPKKDV`nS2F?ekF?FK8MM7lC>VJHT)|x_|iST zz&~D}SPpF%eC`ew-#Wv;^Tm$&#v#Aieklq38;x|c{Wcr^RTzBydoJ(={-r`@IkaK$ z{X4?q+hX{)NbH#JZtMD%hJ5kXmpiQM(RPFH0)y{T>-siQ{G$zn@8881-%f+?Lb0QN z?Y;FN=-=_+i?_bCw$_6hgYRO4?_2BoHcR}Y4TJCB*VgszfWdc(*wMem*7{NkKA*$n zTWGB>>XzvGa;d?W@9_owTQ2_5hQa4P#o|i_pa1-2nb^_49oG87zrXZ3OuiSb^&rjg z?=pjLgSEc!?>JcwZ5Vv+brxTy;onNJW4<%I^&sfq6$$*CVyy?+hJULJzATR~Xus9s zA8i8U*KQ0_(vNC-@iVTA@&L z{o9RKV;ot3I$9#J&|1uN!S8ws{GyJ>L;Cs^J3;fF#|7gSD`^UedHtT!9 z@b50Mqkp$Hk8MBx{W+HQAozUz{a%w#t&6tb-(XEU@>P0#fqx^RU^;CWe7=tsM){cLEv+kd|$%O^e@fu?>>W%zxxcnz(4+dJ@@s)#o&9!;|tnvpZG@`2H(FYExz4`f3J!i{kt2L zF#GpF0{{4X_hx4M z&R>0go^6Z;bdy8wQ{69*ZyA;Co-}=-*$x@e+)`0`U19Cf{GI@sbBV z=I8wV(BR{HE|3)XH&y(j4TH~JZt;yV{QF4k$Uhy8Vz%G(1pZBfo!NfV4F5hc_;NkI zz`q&dA8iu;6#M;iv;zyBiL ztnU)Tzgn@Qe-+4Jw%=;x%Oa5kpRWuNlW(=*Up;JTN4|WIFKE9l;va1oe7;jGzO{yb z4Pr;WyS@1qjK8hmi#LDou;yE}!ME4oyVT9Os% zAAIrpw<+w*_StbYd*@LdHv)4#a} zpMwhe^&QzZmM<08olKPH2fzLDU}y3zG5GLWs(^2|&xqGJiaNgGwZwA;A?8|C0l%J6YwQjd|M4ZyjCml zZ;jO-TN3bHVfDujgAcFa3i#f!_;x1Xd(-0EZSdi>T>;-i7TFoN@Zq&z0pH?Qv3$J0j>oqUb|zo)tiwiO~BW}YQJFyA6`Qi@I7nQcS{03 zzW>McZ;Zi**OUc(lkm_8Vz8d>Ou#n*b|&96gAcDY3;2>Pz5@yPk}STt246RW?=Kc# zDx8QnUT(JdmKc0^ZCc=8zt*w!%}&6V1v|68s|~)M24B79UqJ#sz8A^lTW9d$wQPZZ zcU$XKc>=yWto3TM!Pm#&Yi(WM)+XR5b^X|qfbSIR`mw{{!)xFI zzL%`}?o7bu+5zvlH<3v96cN8=~tUUPBk~J!kn>kbv)L%fB>(53jil_#U?Uw>$yg16KcL z8GLvRWWYDux*n}fz&F#n9t|`2@LI=!?>Ec8EeZI3w)`7o@Zq(M0pI6Vf9y=a_p#L< z(+obm_AuaEYK`Xu3HX*+<9V*ZH^SiSZ}IWHg7L;5-(Q8H9)u+ZA6{b^_!qIRAN+fP zczk?6oyoV_;2UM|t+V(F67bz<@vSrXMjLz+Ek1tE5zoJI7T;!r4?kZV)VJ2+TbqFI zGmCGl!8gv}tFYGlEeZI_to43}!8gI+>ud4tOu*O6;@fTTO*HtnS$qc)@NKpD_8EMW z48BvX>t!mQTgU5;!y{#g}|rbp1Qc;QPT^UkVcNeQT{RX$IdJ z2H#+7JuOebmu;=5Sq9&k2H!r5Z*2m;Jr>_EgYRsEub;jCCE&}l*FS^r9D{GZ#kVs7 z-#m+Nn!#6S@O88L<3IwwE>?fcHTa4QzNX&uh+u!3ihXyy@fWt9M=UY;iVeQEto?m< z0>0O*{rzf#uf*WH9&!8+{3}4dtxS;M-~V2NG;=*&2fi&xxi5 z2^Js6V?4gG7T;R%WuZLs%{TbYv-qYb;G1LdZ3SPZ@Rb>SS6F;kC*WIY@$EMF&Nuj8 zv(~F^3HV;N)~ka?eJc#UMHb)w1bpXPe3{iszjIelS^!MDuhv&PHtM10nG zDF>fF-!3!wHd%b73HYilzIEWsl=fR`@V(H*t1nbKYyjUmxaao+Om%n`c4qr+1s~T* z_Qxt5{`z-5tRV*B*9^Sl#9G&=?`rTr==*`EV!eltexQ!WIzfMo{Bu5@ znfpefqg@ZV4*IGg3;dXev|)G>5x7(CNlMY~SYH78b~7x#a@g^^4}S2Y)2-|3>gS{N z<+abRZ-K=(xB`55_UH${-0>FQ+?Ty~wy^zfH2Bgp@%{xrGw|R=N^Qpn8|3l#W(-xu$EL?wx}wVI-^dhWwqN|Ro6z-xBOqHJ1Vbcd#jpQ4%MxO{En(Zc{R1wb{U!7 zYM3viw%0nTA;ha1+ho(f8)`$T)sq|*>tkwO|1a@omHO1Gr<2w8;yS11+z>w z1$8R#I@H~*X_=RVc34rHl)Y>Z+W@xvyt;3$>IC0LWLDJ;LK)rKJzx99z*hC4%&HnU zb9wFP?5eu%Jzl6i9y%v=dF>m9E-5=t>rQ|!l)9|;`GIbb?(i{COwa~SXNuEzWu^%?`ONVsy{1}WmVN&B)oZXTNwN3%zc{tRx`lK1vweF0S1x~@r zI;Z@MIyK{i24}{Lx_`eubm%LufA6n4FtPuaQ#ntNFEg~U!ChNj8`@G`>yTG%+>1{E z8w%8#2F&<|{~kK@wE{2W$*DIssMIw&EvaBlovN41T6#9sz$734&>DQV%a+fY6&1qy3ih_o83y zv^u2WO*;+A;7G>!v-KZCzXIhmo#mK(?-@EX{Y|5s-st0`EoJelA5*i})X@i}dIf6>ePg>j1(#v%ld+inUW1eU z+@5f@Hx^muKMx)18%e!F*UypuW4@0t-q?557(1zOlJ5l5W9XrFRR_lP|I(?VpVu{n z%2DpxsBb;#Tk84-RWqk9xnMoU{<6AN+n=k=SL?9GOsUs$s#BAax~#@Y9fA3AMFSp# zG;_*F*M(ETnRoLZCwoer%Dk?D>r|7>P)!o%Vp68JRwZSxL%q~jT<4Qej)OUZEluCI zx?&8c*3`P)ZrbZ0kK1kKUe2MU%=MU0Q)&+$I&|!Tt7M&fc16{JF<2*2Kc%Yc9d%mm z0QxY)s}sjE>*cpM`YJss^`?dh()~1yrSyop33Zx`>&?wxJ+q&y#d=-03JW{_YJ=-| zol+|sRw)PlA~vboMs$~>F4gt8J#3Z?J>$ulH#M+sZqfC7@eTEQcf@sjBYD-1J7W1> ziMMt~Ec5C%gFa2E{eg8`Ep@vVbsOFP%cSh<8q{{wr+jULt7`BS>@#Yy1;e;OdclT< zYSiT}m09D=Q1G$3{;u*!4Ziu%kd(aveoU$FMxXLFG~89g@sGZ!s;N!dKC&)p?T9*e z(t7x^VQ)CKM@>?}s2Zo>C5#29#>tzFwR&YO`|b9LIJ#b5+azxV)~MwTZqbIlPC-$f zd;a>p$<^T+_Hm@3cTJNSr__XJyj=cN$u%vuj&s>h&cD>q0%YGwC7Kvkv`SpHx*<>tb#0 zgDqER?XtR1`FO5@_0%~tKH8(#Of?&AaXH3BjlLFD7sGd*wxSk&5KW)5vgSMZ1%A9@ zES4Wz+G9iI;8)u4{uU(w??H729V?E2qdL3$-SL49nx=N%c zRjsc59^872BY(0QRd+~rs1IR|RkvEr@#U(#8Ffi{>(H)i8p3(wYuvRXC#RrpO{-6; z!T$Hyds|i2HqXN~NMB=DV;@sfs|t2CI9tv}TcGU=UfhH0NqWkbWf-St)rV5Y)qsBl z$1-kxuxCQMR#n%BQNI-R&R(Z#HR?01_N7*;CPh8B7mrbzH7yu}ywmG{=5+~kh3gaE zfL7mRM)_XOWhZZE1KMnagE6e~wl}~oo!6m$d0dyy#hg>kT;$R7DHCZK&Fc?!oml@` zE6f$nskJK_+>~V}b8m)q-P@l$q^b@fplx)(?TkXZ@hdgl1}3Q=oC4h1d!e!6q)cdh z!%2rRoQ(ULz;JRSLvC$ZbVy}4($SY5I2`>_Rz&bNHt{$U@hluzv2fPGS5d$s#>x;_ zK;p{$KW~`i6-~es!NU}77_y>&Kit0aKAj%8g@GP4MI2A3SrzVP3+mIm3?)b zoTM>Yh&`FuO%~xOe$1|X!}xAe>!`^%>tMR+sT$RQc7`7uFNytNec%VdH*D+&*@8Cd z)u>IN)tS*Ibjcs*hn*1FhGF9Zql}ZyDb{#GL=C5yhEp2(NcV@~h%-Al7!pk?@|Wst z1%wqi61OGG;LId0#esGuROx5|&N`Sqn2D4y{>XP&J7zPX zV*WT?K^1F)F?&&?t}v8Ejg&o*OPtym*C`I5F*p*8kKvL(j#E^LQ^zza*HAXT*yaf- zT54xpr`YryBMF@1cxI*II7O8>byOp#4y&9lq;Tr}xK454kvf4>m6AV>Q&fpl0~3j8Z2;C%rXoQdvRz7Lv|>OZhUdzw4gTlA}x(o#90@0jyMfKL%Vb;%0Hx6^_)!zqqsm1$W8PrMMv@^@u${_Y#b<2-0u9&BXEk+1=W6a7@c zFK#%J^R#Lbp$11tT@uhS?gu~1cqCNfNK&n@zjPyGH8}8WBHGHQrJ`PZ5|32Abe%t7 zhCbg8*yTlgpuhQgYff~4*Zrq~M+dX08l*VtEWarb^=zVzI}DV0ns$<{Dn~*M4o6Lk z5=^tL*kYas!KWs^2Q}c`=eca>V)FjOs}kH6FlP#CoviN~;!UC*u-J(s-XwZMa$}&S z#$80bFf1}>}O%|mN1AI;OKk(kF@f+iEF$5dPaSnWk|*1>N&a;4#LRcp18 z5zmSBbx18WY)oVk?pb-N1O`PHC} z#e)%Di-WyVu#vGFaX>-f$MK#5f)0LlDNKVF{Yvl+|8R!Q)pYh9x@PlI7L z4$cDNFdR)Vn^F%s=^H5w$AK#rU0;WTcEk-{GMjO~7sXizztA*DY4C?Rh^$1M<)3C# zanOudjsv^I)c}@>5lLVI*UCZ$;5Ka->9E#evkCD_@t-Vq{B36qaG${CREY{j?^=VMCi^xjcjsxS$E`VF& zbz)}gHX(hB&UQM%V_;M0;JeQ~9#skJM+4>$hIu>&ubhC~Y3=lE**5I9OzqgYWozd& ze2NiDa>ll8-u&3+$Kj(mH%qxKGw_*IQV&Eg1*M?liXTiJkD6KdeF>y(DrpAFM)YQ88sO3Lyn`Eub?@TQ=9; zwKAx4V3kTjMp_SWqD5uG%{F0!tS!upg4%U)a@x|xY0b}U&R_O#Pd#ZmuvA7mntUgA zB4e77E6iM-3}Y~Mru*zt~Lb|a2j2uDg(>lT(P26>`Vrr)N z09wz3Zc-=B(p_3h3r99b&-aMq4_m!wP}|L_ydVLcQEv<1;{$OFwL^h~m&NnS!uTXdU0 z+HzYU=h(I!0mIO|gD~#YV6zFlA9?aOv7D8=sZM{oDMYLTn#&o0D4 z*CN(Dbe&rW@7-Z6E#)`b4PD6S?~ESJXp4(++C-xv%!02KAng{MK7$kPiOVQHg3~_( zQQldRibUs}JCHN=O++6=#QOrCr+9}hpH9kVKjW0d60~Rz48;BQ}9gy<*w0Dd?>5jwT!9=&2%fKkmj62EbS)k z(irG9s}|cjlQi$m)U{)0F~C~6>sq#V3hqQoduP&vTG5I+UO1g|aw4ew`A9vUk-s1^ z29XXgATouK&k>o&$bS$y7ZLAm9~nCH0T898p;>-sWCS8j&~hFAgh(4kRwB}cZQ1c# zy#fY?IP z8KhBfM8r9V&brf_28^5Z88FZtGEFyP=PMxdXG7exw5%Iw26DNDPD;iIUDjDfgLZgI z3h2Ohu0(6Mgjr@dDXEj2NW%<4L_3*|h<5Vde%3OiM6<4C)*@ux>t}t<&-##`l|K}q z8-~Bc7R|buS!W{aQY7o{C`3e;Iua3GYEMLT*7b-)vu&S&)HMX0%oFgK>X+?Jfv6m?4F zF9Wq<zKq<1$WTPuhptm60lS`xQ-@?+49-HNWetcr^o2ABl1k&U#1)T+ zTkWK$zKiT!qL^K;Q2g;hu25aMD0Sr$h0R9={af!i-LCQ?i$KW&AcB@BUZDs~uLjyIzWKcP>TVBfD>+Vv{z)b&iudOhtsT9yq*@TF*I) z<8!mq(<#tiY$i8#W!txRrs$S;CPy3oZNK3UB43B^ zVj7;yf?ie7@W`v1-I=Ugoj*yguM0OJ!j|vAKa%xY-&^>Gqmi6*D%b{Foz-AUZ_(Vl zs6bA|P9>dtmhr5?6S^(Z%OIad`AJ=)^!p&sr2LepKMR9kHRWxdJ{$7Il%MwG2xR_* zqx*~}e~SEbC_k%PzE|kF)GUf0I^Sc-fS5Fr;%+AlZ#u6)?sb&k#>E8kM#v9Se$VMi z`CZ5p*;gOy+H^i1mx;%ze_xM~&c%?oQ{Ls-{~7X2l;8FAn;`4H{z!Y5#UFujTZFc< zjoEj6q^tYxpwqOso;#DVf$@6pEU))YXYcin_FX#|=t+}`yd8!@icXrHNaDqrlcv3M zI{U7}vv5Io+Q*3KPWuTFuhaUJptacHeJ)3Yj`ZcviB3i2D5oH_2=ac&vkbWjTI6ai zPYzuSt4W~?v~4A4I&}AoZn4%~80e0KZoBYYm!$f#A5-8i%c<11*QKhyqmh~!qn;2Sjfby=X#u3^H>{WodjdvMN4#nZxZ_JS>>(w1Dq2vuD$hspmP@E+JkJp7x0$vTy5`_I@~FQ zjS6$~o;(pJ2lG7X5qBVHPQFlS%oKww49pyD@hg50Q zQC_1ChpZd*6i+UP{0$pzv~JYyx&g;|4anbW(G5J-Yv2~RY0wRtuN$;G-Eu{@61wln zGhXK%qL=29P#PP$0AA^9;8~%R_Rbk>?o|H$JDa?Bw7EY-5}RAMa)<9BvCWn4D?Vm( z&km)e4n{fA{+b9$6X@R2o%Sar1uR~BXMu%F4;Nsz|8S8P13M04CF(g%n;W_v%y_Ad3>`#uz}2XU!4Xy1XX+k3v2v02d^3qm6?q&xox z?ayqrh5Cs?=T2?BUq1BZ!H|=%p7?SJWM1fec?D$MBjvhBj^IsXIh$&IC^dB>l=^1! zNksI`3{ zg~=1Vg(;*J-ooU1i;mv60A!%c@eJZ-EL+4 z&)yoPcLA4r>yK`L~dis|j>$Vd4oDR6cQ@=x(m&T_C+)5?maK8$5YTx8S?@2nJB4p@C z2pJBaAav!^19b%Lxg&7*huWovL8hNJ^g@JB8+u1A(`G_GfGlWg<^C8-$w*#+l=jYP z7Xmz@%_RCys6%f}a#AA_{jh?MCidE>E1Smkjhm!dEWVE$#`B+R zyj*_)^u8OX4*X4-M-b`aOnQd$osju==`HzKr|XA^X>ZwP+S^r5dT-CyY1-G89CIC> zMXo)}-WyNj4qsb=Egpfj#F|k*lmQ~85`kdC_Ipf zyiV~lmGpA>L|QU2%()%bGa0OU>E|{&8;2h_#@Lh8Q|E^sh;X^4?Jz$Pn1^E|j`29A z;qU{iL>{h7Ek{6J3nO5a$vAIMpbgMO{>6M^(Mo}X_Z zeJ74xICkUs6h{pXKO98lcO0Byyc24NBMpZi3J{-)gV$kB13zp)yc!4Z1hyFI>k#MX zTAbEQe-y`79DXQAoOc&Xajd|>Ik6pwA9f+mA-f01J{)YX131i(CqilhOp)|7!3@E6 zg2M#;_PbH!;eu>q2Hu4;Z1X_3A){AL;5@8&_R-ndCAmi*ojt5LCuivFp|gt-nK`() zsAx#h(Cng;+~PiJ)Ug9EC|h{mz_~>W=a((Gu&knx?@S-K_x}6$Y`x-(o1bWS@`i?| zum9rqI|t@w=i+}(_Q3fwOJ-G;RtzkiH*;ap!V9Mtmo2EMELu=mSUGQg$$(-|PABE` zSjy>*DX06C(`PQ4S30XuhzsEg-_+iJ@zF(U(SnM3a~71$%AB{LQcXB%)X1shrxZ>Y zS$OKiQ%9Ndgps+i;^0_uh$&7PGa|>5bMdNrgB}*SLxx%@gNE5QL-101BiH1y1*0a6 z%o&;;b-Ng?py+$Wyo*W-E0tfz;>tpuGQX(eyu#8-Osor4#iE%!augFy%S9k4)QO9W zN*9&Hs91p36_(8|T!@iTqDspyP;=+anX8H!^)gcSVzvh}%gRa%OU_rb=FOh1PlfX< zX6gtW@w&PY-p((XUtE4+;k?<}wxj|zS_uA<1*$kl73Zpw^A{DBs(C?{`Lhb=lweF; zSRVBkY4aA$E;E`ztk@K0&Up*wp{YD;VsYgXHFthdv5xpoF}-X-WyunhVrH%=sa#ZU zCM+t)n2zC}y|5%!Mu8P`%{&;<3o9$k6kYzp60n=8#ieBnqEu)nxHPM`=a((UNG>ZZEt!o$z;;rV zWtHgsve~oQIx`o|Rtw4s%gR;pqJ;}fF!mRqk4$2YrTI}${i5t)AGC+9h|V00cE7%0 znORg(GIVfZ$pQ=%&b!8{StZ4V-W-x;#kP}SE>$rI*!=+^J*z01UE=k&^ptNLtE{-7 zC|XmhO1+LQj%ksF6-6Z#h2`fJSL75f&KXj;XhC_=tXcCG%uz*ZrW&D6!i1cIIRW3L znG5I7TOd(0v1o}ZTC}9FY*D2uEF3X;@`y7Fr;I&oRN>S!3q}GVw4x_K{TtdsB})WZD#37kMTP1ypjvm+@gxPdZ|-o z6la!}6`$wH#ib=h3ouis;R~+Pgr)Q5&-7L)-E5T@Bxe@Rt0-JhGN-6=-r^E9i?eN7 zOw#GM2RVrJ1SRbEUI4AlD@nE#1PThpGK z9#iJ#$CSAV@;5?=>douOmdV#RD?%}L+#H$txJfc)ZkEXHhf+jFwoJRmSshyCUY@iv zydt7{_(~u*QzKjUxW>6EbftSm((3T4$mLB|Ca-8ZvgMLY!;YJ+ku5W6cZIt;X;t|0 z$jT-wl4Hu^227WARkSRV!_$M~%2*E5A8y_f_>=W8J{C(-17Lw)pZPZ)>jAjeW5WMp zPd0Bsap|I2CDUasO0>Nzn~RNJ#jNuNF3{6z;GhAy1BMJ3I--5EF36Q z1F;+HUpjBWq9y&AYx>N2xGerJJd|A{J|>+tU@og$R9ebSLIouBA1+NXn@QX#&cs!8 z(R|NXCAliB_ss4fCme3JI-D^k93CI;JTcsMRJbS3;ig=zbw>;Sc!&G?MYGSxO%vweY!cDdL1XS9xy(~mh_q9Jex?&j-e2y2d z_FG^VZsxYm4?E){?zT(vLG8W}S{`mYHr!`iI0O7Sx?Nxqj*NwsRnTi7=-14xK|!au zccF}a?k9iF51+tz#N7hItcZIL(mPEEpQ;T`0B665`!TGVyLZ#-A_wmyF@W2Q@JzcKHP|t|_1@fkk4fh-;=hmp& zC$Pe7*yOUmt)6^9v#ks}t55^jjf}VtyUSTDzEie5jBl2Gx^%fwhWi{`L^*fCDE*0W z&&$Fn0p??^#(oyOdClBbp)4od3l_s7tHb@rMBE2Z#t{+seHZ-qEzM^HxhJ_zmq*-N zmwq4a8gbuclG}FqGZFWerOEe4+^=YSvyNVqgy{Dd<8*CO^6-fJ-NjEv+yn0NpCay> zrJ$%v%1=Hq;{NAiDpx>w0RJwCxW8PyJdE@o+$UKzwC;-J<59?imnIL7spI!-$7mfJ zwIy;d!<7C|6C->a^aQ{iVBRinyo4Hr|x`_J>><>RjTf0AVQ0+iPJG)y^NH|{$ ztt0LeNz21sp9ptmN99K@w?@D#aJgx-=P_-O6~p8MH1YS5%OX#PQ{Z@bVmS8{`1XqD za3}Xd%gHTpvcLN#)I;#(nbmmNGv%V@)#G6#qXF(h1AzZ?cHtd}W5ugU`aaxmTsRx1 z{qnTrIz8QCI}+3oIuiw9PT(KJajzR^TVU_!yT80hoZ5x zw474Y$Y?Y^N8W8ZXT8ojG29va6DNN??a!4^0r z+}1r8&4`)D_E?7@mEm5m<6pb^6EMm?MmfBI9u4>5cZRzP+OT^)EL*!TvbWuBi1$Pr zjDz{(p1J$TrTO7D5qCXuwi_F6GcFunhNea5XSknnj<|Q~q8M-L{zqZ7{0B?Wpon`N zW^Wg^I{Fer!%g7;(_;#0t=$hXiJIcOHpuW3GN2dM=sNw%6$>BEpvGgu-6x=!gW7T> zQrex0ifa3a`)DMeP4mvh%Og+n8sa{t{diqh7%V&tK!EJi*?{Ub(hs_u`GQ`GG- zaw~OnjNC?D6(hG-RWWj!S`;I9R)30-k5IQl=GQU3(ASS>bkSaBa1}lgFoNrS!!}59 zW9}B%+N}Z|Bd)?nkw$P8K0q*ns~@dL6I|6fDj?>nBP_X_C7Zi_+V{5fcKrre`dmvM zYRSAUj0RU79~BUD)rppTk|mF{WPW524X(;p{933VcwhK#&^O+F;@3&O){~DDnfGdK zR5$%6GqhNtJzl=Dk)Mb&UQUZD!#;Y8(8U5M$p|y&(ScKC=zSi^%P? zoTh$}@;&~Dx-*+~#t@|qzjo^f%55!qo+aPq8v|)yWXbnQ`!JdM21|d2#g}a9 z-xitor)|_w^_bL$_q=V?0M%J!PoK*hupqF!^8?8%UyJ>{M1FH7M#d+FF)}_djFH(1 z41Rw7;kP04*T)!qy+8eYnVrty%lMH(9emlJp1$1G(q~$7H+)=+q>Pij@tARv_u*H@ zD5YjF{S@!3Fd3L8n<)d?ZW$xI5418ceSf5UDn6VG;%@!zqM*Wme+pf|m;3D)_kIJ4E#RZ$$L>k*H4y{XCwC{#`^wzy4M56~Q_| z2lb>rgNXhfCAdKF3PFCEAcX#ZQ}AcO_LzSmjDr&d=LoJ9d_r)S-~l4WNheg4I8N|S zf-42@5PU}PpMw7t>=gF$4;7puSSfge;Dds%3+@waic1;G?;$u!a265cc8%b(f}aZ> z666<6X?Kj^>4Fu4Hwyk;@GZfw1^Lc#=IOX_^9A}fam1=H}|1eSBG;OT-D#3PkjFZib5 ze+7Htl0*Fn!Rdk*2wpGvfZz_nJ%Wb>)3I2GdSD$BtQ6$C(wM$o@DstG1zY3$8q^OH zoFd5YiZJ~O!H0-Fm3m+Bzk*$`rDFOpLB11&@@m051)mZ8NbpC&R`}u)?S}{!2%bmm zrPKq09|-;~*bx_K>dzNkCwNeB0@g0-7Ykl5_@Lmcf=#h@(XOxHDS}0URf2yLd_nL_ z!Dd+VnExoj2-m?Z@40oTFR!tXfiPF0e)#5=$QUXr)CXV56nTi?ae^ZRM+;66oFaIp zV4+}%V5#78!7BuB6!h2cyF}hX>@9yC4nLn2`32FxCGxu>*9d+s__H7%R+A@81Wzgv z^=mKbeE%WSdx)GR@(>~#XQZT`N<>@ox=H(DNuMJ!|Fn_UmrF$EmpNGO)grGG+$8vr zApgXXd@l*^6s#rUI`y^4KNG?Co5)QFXf)j-U+eEtoBMjNnOv zKLfR|x9sDXv$45&3Q+%DGqM$3=cp|1S~aph=QvpDL)YzsTQR zEKIcLyR@0!UhoLP-h#PA)awMnv4T?t z3kClq$Uo=_Wh!+g5xh4DZV#i`qn(JT$3{uNQ{;z4{=3M}iu{7eZ;Sk%$o~|%UgU2@{z2qJ zBD+n!@>&t$cUzIW3+4zOFZvN8PY`*M$mfV$B=UTb&lmX;k(Y_QM&#>6zD?xYMb`U6 zw8Nv6(JoI5zAbiqS10}bmDmUCiO72Y2>Z-tp1zM@uHXnF^m<7<${G&MXb`k6^c(UM`g0qQz@umsERf6jT?-hJR@EO6^1RDgu5lrU(6ns4d za|Fi-@{jGPFBQC6aJ}GNf)5KmE%>V7`+~KC{}TK~(B(cC{H+8#3-%TqBsf-Zs$dE6 zNTtd|zL<#qyj0|?M7~z!TSeX|@_iydB=S=tKP&Rv2OwxhdRt z1KSH`5izcEMArLv==n}F+Ub2fa293oEhM5H)(G+shbZ4J_<-P(#2#4hMBYgR&n}Vq zZfweYmp1bs5cx-u`6!C%DMZ+%iku;GrpWyShe`Tyk;e#5CBl!nqQ6-13c*{5sDHJ{ z4+=gfxQmGV`hElW9cB3SA3?s`nQ~jf|HIzffJaqb`@`qVnVC#N2onexV$=yli4wvD z0-{nGFi40f;Y(2Ql0br>e1s4b6m@`rfJB1gR}0P5aw}K4HMM9dwKZ03ZN(OQX^Xdh zOfrr^Yb&+3rL8UR@3;3lGbfYy(f@t!^S;mjdH0huzrFTed+oK?Ui;&moR4z_`3+0% z>&t{z=Ot)IxzJTa(6fbJD7Zq>8-%_~=#4_(C-nV7e^uzmg#M<`PYeA+BHH(gq#qZ2 zQ}A8EkBQKi-bwY;C-nJ5v~!f;<%0aiCDX4JTqL+s@OHs1f;$DjBKWxAw*{XU zd`0ktU|jGIf*zhfU4ZdOMEz$Iq3?M@4;Ol*(3c54LFlW5o-XtaLN5^d7NJ)PeTUF@ z3w^K9JB9v=(5*s0DfCl9e^2P=g?>fop9}pPq2Ctzw?cm?^cf=BJCf&r=+ALPw0EN5 zbwuQ^mHaJ|zE{$p5&Wg#yF|#zm-EH(M97;aIERS*MUsD~&>JQHUO{!<3BGR#{gmKK zM5Lb}La%p;=%+J+89e_4eV$;MAWo;$bvL&lmTyI48dk_lsNBC|>#r~%h@q+IpkSFG zuLqKUykLdkG{Gvt*@D$X?0;(omk2HsTr0Rjl;ME&NBF-vV2h z4%{uM&UZoY5qiJi0l_xGgMxjlF^obNXYZYAP;eutnskIzSckOn?N#QFFh!3YuKZ=c|P zBF5JN!8T$5`(MFB!~*!$jIi=oTXEvq$I%5q47J z9{L<24Lco?e0$uhagO{GOb^I72d&0A?4-sqXdnG=h>TOvLDH~O6%q7oBJ5NzbR!XV z+AXv_j=n@1cH#F=X%D`UiFWu75$*pq5$#rfkMTWekcyqH+vS{V<<-EbZq@iwE$;6pgm(;CYTDw+dme{wW^R9geQTO-b-hVq;Jzc@4 zEb5l?rv1;8pr8Ioxh)`y||%fxg>mg6B1U3=G_d<=dYZOanqWb zhFYh1JSOsaj-sB(>DA;aC-qM95=IV-2BC38$OBpRi+tkw>c#h|`rFb4}QGNY_`i7v&Q@>n( zzi?15s&a6*VDWtq>xdn&M5%z&8G~^wEh>}=+JGfUg`a{cl`kZD1e>p2^VM&Zyhfl8 z2bMS$Y(DNS(XH#Yca;)q4PG zz18basrNZ4p9y5J>&;B5x5`m3E_WsB{XPmf+j|6gwk)T-Z)?6pdygTLdgD@$3UEp6o2&T}^_~I;%j1+^1)Fac_?-3DJL<*he4^fR z#GUn?292#*BG~dSMGE*5_2z(Jy#s~Q<{JyzS#Q`;FSdw@djFQvzxj}tBeDp#Jl=!i zte1OL)@$3w=Hr_uo%Oaj>cti`QSa=OaWoF{#<4;Pwmkl?(pfL}!mJnDR~2l&D^tc% z#8EHpNIsSuh4T1IjKj4cnn2sZmRF?t5_aafBFkfYtb)x~h;(Or+Z^>`3!SKU3<`iX zQLh{NatzzSmdF1of-g}o&&^nGfiT*9e5Zu7-gZa5L%>TumTQJEXT3bP8!xg5w!BT6 zFHtYg#aO;jcx}GB!RM^^n4?~t0wn6)g1EC@p35y0Sp-|&dd-)pw+jBldbtiT*nDdd zch(zq)LSHcELVm##aS=^S3Dkd+rgF>1fNshDaea}X&Me(;!3mwFVODRAG<-b9`Z2Q z@-kE8wOpHAKZ=Eq<@mpHr+#}-?l}sQV9R?Fd`|r$kjL`WuLKAANb`U6ke9IEJS;Fw zCl7-y@AedV`yKiPg^%S1rs!7-s^zU+`!CVVXS6C7YojHB_8*PDLNYrceC{3y)wV{tIp^?na=XT2vJ^rhzb_ovKE?c#{q<&a*$wwXrTORLaaO!u;q2Fb~$8x6j zQx;Vr7xE_I8h{;aRsR9OPI<;$toqi1mhW*!A)~?Y3-6`5p{%3T5qJ=cOUyY)ANJ!>EQ3%A174 zmdAT|ScX2%@FXTb{(s#L%;Paa(B=!4Vjz6E^FKpuv_;DEX66@ee} zaqYH)&BuE-?Ktz=!FR}!fNT}`!ewWBqbm&c>Poh^0tfl%2lpf5C~mC1(lDNJ6twg1 zOOZ!STTq_zDskBI7Q#0i<~M>>=ntubHY1-O$0EF1pkz_W%8>ybf`SAc*S}-S%2dvn zaW+SF#@&;rU8$cOh9CqJuOzbdBweft59a~Ct|*PU|2xmHbI8jx>}=hqKEv)xKEuu@ z*r`|d5Ok1yrl!Z$E}n2YFBYYo(QA9+M6de^pF`?rN7)d^a8>_nnBpj6t4!p9X_ZSVRt{~JAaY?kl)*PM(kpy2O5{-HL&W!oO)Z>wOk<}c>9J_tt-OZgY)MZjn)Rl(%^GZ-pMAz$YYwqOt z)+s+|L}Izs_jI`B;ka9dMn9gNHb0*_z!+5`PLUU(k z_1^fk@FjQKUX*>{WWcyK<~8o=!V#s9Wf|f3?ls?py~3UMDtTKv_ntX(>9y0FJC$ts zf*U?WKU=cF9ye9W59zbMmc4Pz$$5cLljesm^fx!`s>Vl^9!J=><3BXJ<8J@%xG%6f zo*CQ?n{QM4X9l;$$?ppQS=PTTZnw$y8JwT?DDRi@`BFYt%IEY_9$PY19`ewhqz=U> zTZD3jC=-A@%)9Te4@)~E@JneUZNc^|?AP3xcdj0T*CKAu1J@uPkbbB{+%Iv%n8P_F zBi)E}*u0(yZGy2rK+hK$m@i&=yV-SWr=Bm|P@*0)#ynHc8&6d}9X@rH%w4;nTL@!3 ztmlPbAQDS&;oR}4n#1~{9_ksWZtCoZab+6yF~fiSEYrWCzu`Y}mT83guL^uP2w%L) z{>zy&d42069h@gZg zshev?aI3DDdtZi4sMiRp_PkHJt*uS1A&anv1jH9Eu8$^sV5^CFylOY}n-lZ!R^YyM zomO?E!!oL(uC@sNMOsyWJ<&yM^VV$be^^`0MGpV-MKGs?wSS?FG5Dv_dtB-6cm`}d z-rODc1R@=yu?CMu-JEmYhy7VEc28KVj12O6{M)1C^$IWfqTusZZH~gbQSJsll9}N# zwnu%C+XsBKPaov_Fy2@P);^VH)FY1ake%nldTiU$PB)E+g}89EIAA=V)JTRt!sM-C3m0hq6`=HWme zBEMO!vDA6o#LaQ~UvB6@mBux6{Ho31nH}@jKNt^&B35o_vq$+Q+5sQQGmWOsioo9Z zNbs=zks#J<1MLhNxNLP>3}f*H#qWPKUI;#yF{7ghK4SakKHV(%W_tM4lo9V$pj~^u zrssz-=ohok%veT*e);8iIdr`a{;-7eHS;pBi{aAHcFt?ADzv>?_c!Mg+Jp7_F<<9n zuH>EuKK#=h(Ch>3mEqr*uc32#fcnaKtJi&my)DM-oEWZUW(2}boqby(9baTF@lF5|nCA`Sy4Z27m9&A~7G-bLWBXcf^59N+KZ0M;_gL1RM>wY>=Y7~*#x=)R1^ewD zJ+^mE5?lI?VZPd`_u1hlGkj{|i1#L8%$fDkdpod~$)K$<_7eIf)+w~FkDU(RwbL)I*7K4FWmP%R9etsE2A5ynzeMrO zj{O-vV5hU+KY}0G^c7gkGwD+S@yBZI8(dSaz#f`DtL%+*^4h-OtdnyhZbQl2js8*g zcl6O9whcC5A5k9rNR0z$A4#3;Bi3Q}kte9@HkYA~s-pu`p0tzoaPHG>d^DcfU(fXz zJ7&RK$vLDEzF3QcePlgtZfI+JzDc@E!KvvZ-g^;#cjD`<@rn@iqpt7~b$(clwL#_= zpT#**>%;R!j{jP;1@lHm#6n*i+Akk@pfw&qTldv8$J1MOMkByIIE?CT@kfBWakSvr zfnzHU?qjMU$B#1efE@d@_iV^q2zx1ChU_M@IbOaA>oW4I>-WZe;hoX&2F}rQWAj3L z<3X$q)%DGZ`4{JUn1Ao-%o)&%`FCzC5QxMguxAB)NzcEHF^(mSgBR@a#PdV54Pysw zW4qpPCELY0)+hTpobQ+~I@VLlL>f-pDkMkWP)Eu|vpM>Apyf%+BpKIr` z{;gbpI+^br>#rlvwhd);JNKTV`-AqYMSUC-MGoBqjyTIE`nO(>clMW2zb&5H50tfU zRdYOoV-Jo;aO}p>f@24ctvJ}WBc|@FYV?D%zqmG1XReLxtLjj*XCC^_w#PoSiEHFm z%m-W}d-l<7$_9yb5@Yval&QuV=k0r4Z1M>t}^wjP$X_Z{5dG(sNBu&y^cVpUptOvMtjwPqbq~+k;~V zjtU&(aGZvd^B%@(9ECXYaU8^4u?$BTvqK06!&8%1Hb?2VhOq%-GZMpo_axT$#Q(tCHZ_HBTWB;aGy;JuX3tzuK6BEPKvC7q zz?TBEXU>^?Vc^n0&zvhKPMbCPLgdurzNWfbgSRpPemd_TAAR?>SEe41-hegi_3bx* z`=ya@H~w<-&esmt&c5R}=f3oQVf)`QTLz{F?w>Sj?BvOJ25!CO=Z_71d1UKzTPK8H zEB?-)*TP@z_{q1oo?S5c!>`@_vzPB5Gv}h$&$+MvxC7=j<8p7^^U<@%2RvJRTYJ~L znN!Li{K57055Bh{G;{Q>S$D1Z)!@D7{%7AGJ^t3R^P=zPj^2NlH}KxiM*im6*S~Yg zX7@|&lYUtGqjSD;{dK4B>U(tI9d+4r{J;I`m-hWV|K{BG#^1czDu|` z(uI%zW7s{9UG?W5O!@HQO@H{#2Un&IU9_q4Y;*KSKODE~H`BAfv1P_bmtT7Cd2d+X zy8p*rTYrBjdh)VAUU=1izgqq1Z{K--&Ihk&PgoWI?JJYl{P9=c*nZ2u&j^35w1{GA8i`@l)88IA_u-s1Pp|)`_1HtRJ3mfe{Ql_LVCc0_ zzjtrD=hD;Z>(6`dl{vfTfaOe-yGseq%__8^ERp?n}rnAh<)?}HP zsbvC4(7I;df4BO8IhkPwyNv!qcWN=xjz;ia2Yi~Ga2!JxAM5rJ_hCpQnQ#aPlZgSh zO72Z&84}Sl0uX<52tE|ht?#W2)yKsJLO_+7%`FCR@n)Hst-RTqlZvKNC9oG+hh=0N zt&C_HbLOK2Wx$1whyZ9qIUnOt+>GeEb>6CR8i!*7;khJUapD)LJWg9f3+& z23Q!OCLRz&{jDvCYNgf%TBUaNI$_2i!LbhqG|q2jgA*7buIgHHKgxShSwI*DxjBM3})yhaj6Yf?< z+BD&5Wu#pb-d0AAX(Fwak*Fqot&E(~M0zVDa9rw^(aMNl6Mb4431}j-m64z(`nEC> z(nMA(BUPH{*UAX{1=9SjG&P5VB4`2zySFn@ZvcmB+@Ld(Sviu0a)$a)y}rYyiqHh% z7-pHo9XQ~<`v7e^YWsmIne+tcVtWE|06^p(Q@A*KF<%fg7pE;1Y(sMHZ^WV6%!pQU4wckJ zdL3y^b`eHi)`Y*65f)TtLR8V+1WGFw^C zBR0W$-mnRv3U)CPxj0}Q!V(pojb9a7A^rnL#ey*ck*}U>;&B*p-tQj{}txblDrK z5!D5H3@7BMW|_vUWSg!{7D)VW)~+Fd0u-z5K*rMviZQ(y&JCbJy2`moR3TM@%Luks zBWDi|#)-N}51&Mi({OZ7u(%0*Py zIFG3ewyYrHO*phM7;C`+r#J}U{NIazunfgn#+?KmY=LbcSr*+PIf=SR`&E|O)$RXW zk6|xGRDo;VVD{nAW1tK%J@|X{F4&EbDl?PNqAKaNJE|1dECM^uH0BZPN@letE1Ac- z)=KTOdL39>QB+M)jI=0mb58(Hsc2O$3KuC==2C1G4#mxgZpd7_4j7zOX~lc=YL1A9 z?N1sMrAy;NtqyiKPz7e2#D2hcVU#T{G>p@_^hXJeyQM)?Df+Q8}@)SEB2Q(z; zBD3uxy)=nj^Kt05GggbEmno(~82_~_6mnXO*P}6Bn95*l%{U!YR`eznowEZ#|3{7W z0PV0nOdJ3gTg`birS*+Sh7%GfiyXu@olKxyCL^kXtxy0IwNPV?W!|s}M#d?ndJKx$ z$kGDu?1QKZwm>_tm+cJoID$j>0Aruv!1%+j3bu@wK`{$MIJ1Yw%n)O#Lin-EF^eiI zhhb!%)_*>L`u0*4ccEIEnt?P|57U!_^0elRg>dvDj{8NO)uZb_Ba7|G!2z!&XaRG| zA?u{tKK9V37+mEz++1IJSf~X#$5k%Rco~c0=w(Qd(T`dz!{76C$j#}XXc#Ej{_sDd;V>`o>lv!HaSN7I?H6^E9>SPPC`nx2cj`C1&B zkujc7^ujm~$+f*_@dWyy%IeYCd<^=4%IdMkv&3l}9F0UY1oigVN0QBrEUh48MT&7= zF(9O)Vwr^hGkHD^U52q*#n{7!OkSU0WUQ%oM%Ivz1BM}t$MNaQm|ro@Am}n`^Hr!) zd#Hd^b%7F1&qS1xdzmuaNY=6v0?cgl{Hy^UE6ab@*;(1rcGQ-N6I^fbimwEUM zvo*+=I>5>TiP_0rh`h`D^g+~Pnp5!{jkf^V7lTf_01>R<A!8G zX_OAghEEPa)YQ?O?MQXy?wSPM2bQ2#);VnO_`wq(auCYqvg}z7p*9N{a><|**qXs* z!k>qTs`Ts(sWQJ82`q9B)k{h^mlBfXd6bhR0~xRc6=Wj{609By8j@gD34;T$^)QdFP>C#JPos84;GI~Sz`Yl#O@mAtXLzD%szmWQ z%H;jM^ZH!pnG4|~Jg^O(fY6=s;H1G+btI_=Cgn07>_za@0Tf;8G4lJd@TdV$V?0tu zE60LAlqDPx#F%8mb%XFq-K04$PUcc98$8Zw114NTt>>I&>wGCH?#qfV>s2>+@Z$qH zOc^-ga-7*K$k$0C9Kzu`g`aVZlvo}Ne+--}@RN=r=5Y5Xh^Dz+eo*rfb^XDmc|1!% zc^mOlZ=@{;xQBqnXZnJKG#6K`W)|oxLX!mohHDyfpJeXf9=RdIbuDs#!d$aQZk6G> z*_J#&a$VdgDQQC`CEXoHlE(szi+3v=V!i(_%g6>!Uj%pDnm`V zH_k*n`vRn0k4S&M<}(+>fI37tbLZe&@9gY>rATn^=vNIeGT5wvlMwa%S?fT@(NcYg zm^Y4wut8?kWeR3o32^4}C0oe-tAZKsL~c-(^@Gm79?^V62AMO4F(0!$+zW?!<4U-; z>$Y68itl=N-DX0UTyq9L!|Ym1tLU26D_*{SF?$c9eE(wh4-q-V$e$7U1d+k6U2Y%$ z4S5lSf-AfW!x-cV*Iedqyb!8^ zJmh+uqBh~yQJ^+#bn0_myZm%g*A}|zdBdUHuV|xtsKt4_RKAjuHdBl9W>qIV{9_aVBOq!JbQZ&uR5E4>4@p+&Yq?g0G|=uaS! zX1s%DV*`u<&mx)ICuLoKjycP9JK{6(tBX9R@@ByGG>0y6N~O+HsWVgZf~cJmSVD84 z-~75<{io#7+uK#1=4Edl)iirSkAf3+!U^b2j(6+?HiQYM>;&xkR03}{rQYk%@O&KV z)6C|L`{)t>P#*C-jHlf9A9UYyc>93zh=0-}3S7Gk)#ZlCJ|EHtX{sMBlZA)y-KDB; zT$)}3T6L^xvS){U1GMT{oj+7{&qZbx@|5B0A%sS{En%=K*R7IwQ03XiwNp>`NM*m4 zK_HuXD}FH?Ac5B4$(HIglo@yf65N~gtWn7S3%I|{Ca8pdY-_(OKpGibRLwx5LT{+5W~i!$7lT&S%~aJDbGFHagz-3B z^UTZck&KS-1+tarj4b2F42jryfcMyVJaJG2+>Li|lGfeu~K5jQkyudl@N) zn1>O;)am;=Fz-ere2>uMN0AVA|S-hgaQK@Il+f~{jNuzUdmi^elgK_9n z4fW|6m#62B<|CCZRxGKzP$TNnpJO*~o$qT-Z~dCX zTOZTj%I~kZ9#ih4F7BxR<(W7Bk{;-CaR3bGrv(PUPN2Eo5B~(TT1_k$hsE&AGGK1z zTdr};uK}&R)a~Mc7@mhMr1Da?%E#>DSL4Fx;_Q-`Y%*M2LWX=3rPWaJs@jL}0|aVv zNmsQMsqv8J;63O|D-NLNt`lJ5+{HY5mV&j_@|=Tu9L|EtpYFviCwZOHxG-=* zukBHS?!`SK<&cXsFCi!zbt`uZAY$J59kez(f}bOd`~*M882Jc4Z{Wx~8|SqjGcp#D zlZXuX4w}gJLs)O4@Pfb78Kx^+n!{9=Pgh+&Om+8k)d9m)S63+m>p5+vDxf=Nmg*R- zWxLYy6;z(R06!-fX~EAsIJogS1RcJ{5v zVOvYXF4e$MpxLgx8xUbjbqnVqLUVQBCGC(@?xosL;clTDfrZ1-Pu?rlbWeqhj3425 z)F`B0a2Y+jPHdu_uTHgb7%y+Q7Q47@bhE33apk;Av`rS1XQ}Hlr0Y5VPM47} z1XLQ|>+7yTw$D@>_R-YCFpZ25GRj!}5@ec}m_erRfd`m3{+WZaNl6~Q3v5c8CZ)~r z?|@bsZB`m#RH^;EYr9fv$RCldl-a738B&2~XOyD%C~-sX1ih6Ts(W3_QQr`LPGdXi zZH|!?ah*h-T4fF)Qij9zRac)u<~+5#eG_H4)?j3*mB!k&!=*O22a%CjYTiI8qnKX7 zZ5dnb`i847WGMgm8(5Wpu&{EFftU@IgYb>J2?yaKuN;K)e8NGV28+`{R)AIx!ng1$ z2hjs6j9S%z$~5}Z7q)^PFcUlx$+!(PGuj+9$8x)(^|;4sn8|?zMfG4lAVZ;Nh!BPk9sA@C|r)(z0;B&I)=BpxJH{}l@pBSbZA_#ooUZI zXZ+{&jQDs>(e;AKseD+31%BvQ30^eEA-zcL@PA}-i?99pB_*`zN%H?# z@i@*i1ICzVm@!whnM-ZPs+DCP#Tgg>irF_(dttdT$?|WCWz3(*GDEUwsO$j!eI`p8 zWB9HS*F?#lsG2)&BGZ;So4eGpz}@U<)-6iqVM_gFx`_)}c!hZk6Kc^-jIY$`YE;xK zp?b(->?KEN*wm{eRWonIr7y!(Zc)SGufkTG(uFRtcD<|z=#>^P24Fz?)GRT@`YKMV zF5&qwgKMhg$^It@bzXc4w-C8Zo{i*%&`oV6zJiF_N`w*NR$_$OMob2!wh=s8Q2Pj; zv8sKCDM!Pt#2WUIhGkuAjt_-D`l?hK)&AP?TOKnyTIFwS$Yz}9$XlxFB*K#{o zS-S~JDQho9Bw_8+KzCDzkf}`FiikEfw-~%^PIJ3f*)qAyC^fjrC^fjpDCQ0~!M4xr zt9yjo-BPvJEma%cQoYM%*Q#yqVN}E2ZC(c=-0!MwE-%K*OgIfuBpa@Vgn0+{w|j^^ zxXfl)onW}!W>EHzu=K6A-pc-JANmN=IbCwY%zfzb1g$1Io~Ww*J^D9s?o0RA)0>{h zFk50{joH#p-m18}CG&Lnpi0(tak6aJv@XY!`*I{Ym06phyD4)(CCjc@mB!h?NtKw~ zis=oS0lO&Gwps}h9Lc#V9Wy!8MRTe&F3GQ3$aNPbQ(MS?YosKzh5L1JWlf4ZXp4ho zjLUGSO%E<%aWWaHCzqShPwM=9q@}jtEuhtGGSX68@E1U<`8H^AHXYIhT5Xy~S=@p< zCa{R}q%#Bsk;@`HWdxZB9Ei5$Dja#=)Mp!vVx!#&HzK zaYy>ci2Km$d>jEBcF1+4vG44_73v6%mvQjYh%*!kLERaA8WI>xq1Ow|>thV-MX!2I zCd!pb`Y}mw6FMMtyC7Bu6}T8MlxtAG|0}Qjn0)ET+g3K*GIB{x!}66Y)~#H{{8#k{o2<@jtY*#Uukfpyohq-vZV_fY8uwfUzB+FgfaQj z`II)lyR`W|rOmgc&0n}?>9X1d_RB4yMP1Fpr6X>=xW>RsWE&UA>uT4mSiSV76?L_N zrFd1YdL?C}fw$&1tgK(RVD-v14U6jVaz-P;wFnB}1&$ME&YXDNf>~3qpS)o9bybrW zEHLWp8dj6Dp>Fk>WsQubNLjHGX^Kn5gipm;^`ez)Ry5YB@^y81DWs6~4Ry6k7d0+j zxncoIEX7+%S1hVah+bB=f)%m=WYjg>TC)sqSy{bcQR7-;1!Ub~@I9fUM=fYH7Oq*G zc*&+>S&0I8P4MCcqNh=xh}kx??GJ4JQfWgqln%df>v<;hG zTf2bfATC`|zorp}K~JuARGE;XO=ghYRy>(kv!Zt8au}mw#ZAV_HI0;{L5W|Ccb~4t z>q)0hUvTBrX_I@FzpY_uW8DJPC5!P82%ZROTw*A%S!}2hi|ZO1RyOo3*v&c#btuSK zv}Sc9bb_sn6)VyIN|PR%!>bq%{`6{dYVIsS zH(rRByyCsUOY4`^;RQ5{(cStzGz-K9l)qDS4~eAamfOB$)^=` z^j#0ptLv66UclKSsZJuvw!M)UiH&%nGkSjM3WGDB`cWNIZ!G0-RPmdQHLG=hF1^)Q zWUMf5t!r3F5Bpzw57Q->@Z~*BBN6@7_b{2s_b{Dn@=Z*BaPzJbH}IM7%u9f1kOb}Rb#k)DJ z$yc6*jfJyLuDzgd#gYxAe*(8le7QwOf!z3PB=Ir+H0E57Y1x-QWtV|KFw zN*?;-UKdox{>9D!w&N(z%DvCr>bl3;;@<3O@|I^sT;1y7exX-=+T7jj%>BftwUKtt z#bJkXL>%@r-o-{A&vm0FoC^Ovt1khB!GurQKCE1Vjl}BOTSl&^X54_m*3{OG#F9S(Z>ChKUhTpRU?!Pfz&jGtGX{7}E3?vb z&a)nmx6+F;2k$=Y8SJ%wW>k9eHh3^CbT9P_lnSuaRVf)KkTIyYjJJ@Hl`+th?%n7y zz1Dz@o^-2zqi3*{b=YH0bNRX{bsEfhy-E4Li`xF#YyIF(-*`{9*LulSNs-p~?%YW7 z$F54R_1!xUqZ!sKj6Z{PRQIaOH{NS~`_98D75x(xrDs@unfviw5Q%a-&BI>n4y7D?J(BN^n$s|2vz#R_9%ntg+SH=oHizdJ9Pdy^}rZ(>(+2-@dBiFUa94 zf`h`4rmxX!ef2Jw`d!-l%d}k=V~;X+lCeh^dyjf;y2pbrrS7^5UgO1o7C!P?&37Gk z`MbH#KTUeRZ<5#gJKV(D?5aeBeq!x#!A-96961V%`hM%lY4T)k_GDXqDm^*YYUnl1lUwDr{vFct zywH&stoHlO!ad58(=k(!4X5VA4OT1;CD2^13ffpa;pg>owLP9cc?kT zjo$k34yDy@_hC=g$DTq|SH=Og$&)_S)7QH1?v2);4EUVK>Idc%V1{r0Czw;6ZUDS5 z{drH$$DTe@!Mz05IB|zk_lTR#IPA&wZie-*W6e>>fk!`voW3yYTbkUb$ivnfcc||B zDb;)S4*b00hO}qEgx0<4M(e(PN9y!=46W;vVWp$w3n}jMF0%S*clii+`R#_BK3?m; z(FRO69MHR1#~)G0M^-a3(MSJuS2lUAu&!~VhbsT`_QS5sZew?|N6GyyJp*$8c)PMq ziwD9^-LCBGf!ZJ5{*krIQwda(zvh84nm94Mc{_)n^^gZnij^jv*%)zg@S%@i!tm$x z{28l-*HXeZd-_=wWd1*D+~Xd2=Idx%_j&1vm-CW!Y8~5gmG2#hw|)lS$g@6JhXz=? zy_HvSCGl9NIV7yD@Jz<(lv^z{Ma9qYUEvvIZO2SC*c!~lH!<{b==B(D@cPOPh-Sgv ztTjlV;z{59Sz`da4u4OMfsY)c!DIc7v(JHb%2&>KU4?L&4eJi;9><~(u>QvW$8MAg zpW#CCIGB|~P{Xk6qfJ;m(1q)e^~~M)Ich-S!Mj!OzKxz5Y<&nD$JMZlEfwSEDM=3V2- zo$kq=4(qE~;EP#c3rc2Lo6#>aKT@~9!t&0!5dNm7LyW>OXB8_)4btQc$I@tP_ZiMQ zZowcsZG)lJ)*~)B(0z6aP57v7!e93^q1vcHwDkmp=UKm0&h#XmsV|m~rga-#o!{7h83VDM$jP4Ki;c6gQj8{@_4Wbd<7-BF|*GAlK3m!PGJYW$9E9^ z+mH;F!EYHSLz?05mVci5R&p|bsL|Msf0%K7H+r}+vKu|p=-Z7RZG5vE-N*Q8H~M0u zr5k;jv7#G2!ML;=U2f!dqbrPiyU|(3?cL~XV`(=!$C%!YKFcWVMxSjQ1I>R@>2RL0 z8T2xnG=>^eK?f80!;N!6A5G+s8pn1NSC;8Q&0}lEj z(3gUy+pv5H^h5`}OzPr!zYAZnATL8X4j1(Mrs&RdeV1{b@egTR74q?bnQ@t1$LBe| zX+!jgYeGDs}%KX^J(Cs~JrM zOIaa7f^rNFBwGgmbD0d5fjbWzfzP8kgVpT{49lxKf)gwj?Bfg;?BNU+{Kpxr#8)G9 zss(#EgJtkqQZiV^=p=!dWn7#>tA8CO(kx>_BF>1VdN!G4sa|x_6-h$zr`q$Hl>F%_ zG@NoK^Xr&_&Qs@OKbdAApwA%rfYm9HF&?Cfu z$;12z2a5#Kyg}Fwq~90+Wg2OIlh6*NSEbNTI9!hT52lpwNXhr6)c>k29LVy|r|@4T z{G2oT!@v8>cq&q~Wek+|1r&X;u}#YJdRKq=(@7~$v-F2QmP!6GMUOQ81IWPZQT^dB z_e%RTf0ofMbPzoKF?mop#w zD*k^nj4_5|t$J-L>$zBa*+1-YgweTi&0k?jWdXg9952U!mGDknPZ zwS+Xvv7R2~uy{c|;~aaMwe5&$6Dp~4jYR1A1`&2VMMORPe>dx)e^Ec`+e7|%{oFym z-4C$0YA5P@S>$uC(4!naWKzX^)Eg#(|2Pp!ohCvLztmqrgg(_mhl$WgmT^`s%Mi3oXni1VPY(3Hpa9Vf!x?-0R%N>KF!^i=)=J*(JW=vgc6S9XAY zEz`_L9 zym>^_w^ndB5%umPqF(+ZgnTE6s5eSnt@oPjH;!j(h<HUH)5;5QK+mFP4UX7Ck*9kr$h?lM#F3dA&SVxIL!RrJ!3hpJs2tN}% zBN+7Q^cumh3vyrY!aVVb;1HZ=kggD1A^4c!^Me0P#JI=XXcbNntP^}%@Z3H+|4PAS zg4+c55iw7^D)?u?^D=e%rGkryA&eivmjpe1b^2Jr1%kH=K1iI1yV?Z*A~+3Oa;9$( z+$(rUutV^lf`j{M{%L{@f?pAQR`4|<{L$st7!aH)$Q$&S-z3;7cv$e4g8vjeJ6rRY z3oaMjD)@E59|*<;2lv^N-wSd*pqw<$lPK4R2zrpvc*(e;&lmbaq059GC-fCUPZ4^i z(ANrGBXph6^@6t&(Z0I{cM5((@P~pY1V0w^bKXX|V!`o(R}21|pt@5Md|{!RiJ0#n zCZe5>5z+2%2>mUgpAlNE6X5%~r2m(szb!OB+CVuU3jIf+&j@XC-9WxtUx0&1qyF;* zFB6<0c$46rg4>BG_pso11WyR!1==eA4}$*?Oy|0Tasvem1jiDweuadtAfo-#gq|n# ze4&>Jy-eu!M3jF(()S5|OVYn5_=+IUgUSDUBKG5hxXuAb5wT8AB%=OG!C8Xy1(yrn zD!7S=a@z&JD#+`ROy_k-VpQ;VM0^vUkLq{(49j6Ug(d6{-@9`uH&dDi-_|5g)R^b3XYfjkkHeF zt`d5_;1Wq+CiGgN*9*N>a3>M^KO*?N;BN%~BG{Mv1@K)cI6-i_;Cv$X7q<|hf1@B@ z?nHWv;7-9kMDQOXqTMeEz9#sl;Cq695_DyPKZK{yh>)8nI9#wya3T?Wm4b66{U*VB z!Mh~i-tX)a`ddWk^<%-Kg0Bn41^*!U55aWqdr)qmV3FWt!K;ZA;b%fGB2F`mn}l91 z^ld_K5xig09}@a8p}!&Y(?UNh^bdvpkABSf_&tM@?IDGNbqlh9_|m3pDlQfV3A;%;CR6)g0lo~5WGpSQ7|mH zL+}y7eS&R*&k4RP_!jXB?8}7yn23HkEwqpOQs~R4a)`r-*Wf&c2)@gOo+5OW;B|sG z39b{|DA+`R53Z5WI|7ZWxn^=)W06v~P~kHA2@3y-MgcLT?ay zv(N?t?S<`>LM)RCGX--6^92Kfg@Q$b#ezY>GQp4_R912;1fjB`=LyaitQM>ltQTw) zTr0RYf)T-eg8Kyz2p%Gq>g!y@cG9EpJc{7U#L@bHfW%{@(YWJ+Cx~P8 z^+aNnG|mU!5j;u6zWxKjQ^axl0a4;<(%1)nB53gZ1^Xmkk0SDV823q;f_~z7T#pgV zC1PKaFBl+V9p-f`Vi6JRXt7|B7}D?6AdVwF5!Y)3LqzyPxnKpcTtDGX%r!t)p*|w) z6%-mKQFf~kTJ4p48{O|=`eYB%gQkLjT26JfWo(7e7!d+itc01&t{lwk*iv9DLme(y`RKLzBsjXYM=B5QT3l}!j-D-bmxR>fa z<2iw3b)UtwXyx+dcnl};NJ8Rincf=LLy&rMo$->pEVWZ^pPhY48 z$7462QICTQPtB}0RIfNc#Z1#_lj2#7o9e)!DSV6BD4E7jGNU(F@?iQ z$%m)xl-?e(vhzd&9=ftq>_@b0I;Au?<=Gr)ub$XhxCl>hs0M32m#$d6(pbE*9?uPZ zA+x1Ek@JNMC7;syLPhkGEm|k#+C5xEI2J6x17v)xX2~rJ_>Gz`-i*}8b9&P&G3rtu z(NWCZ$6T*0DWkY&D;$ry@zI~8+|OrC`3!h{10K^^+-v(&pFB#|lA2@Jnz*0de(G(p zdJ3#p>2{eEV|`Xzw5<$z^h~Lv{Sgm0)ainnUffW#ToOLdl&O!YB^%j8!CqNEPrmeT z@;SKAsGujWmfl#iP*3MQRO(T}=HSGso=8*GeV&p@&fZ5&GXL`=aisVD?3{DR-L$5r zq4tY;g&uF8g~Ou>hZiUWU|zU=su%cQ(0ln8qq@BcV+kIK4C=raZr17 z;4v0w*Dgvt8Op^1{$Z4?UbmcBSX(mc5~HxDq!hokB`P{<9HXW9ttnB_Q5P!?{MMGJ z=%}$+cOa>xbgW{a7k7YS{Yj4FH8?eu^1Gai9+>Bqwu~k!ndu3<97EgstFs1SpIT&p|ADA4~ z81rw$c>?$r;h;X`Bi)Guto0j#4BUe=-PYNb_ZHHe@@gT^k2K1|HZvh_G8*92uNHaO zf+m73ZzA}d@){lTV6ud~v$ed0ei7tRKk_ix^3F<;*W{4LddSCeD^v8_FX;dkYOBoU)|-uk!RF&T8JzVVbkvK>Dv5fh!GWCZCDB`Z zCuzP!d+E32%VDJmcDzYB$r@>sxWzY~yG#smqrJpQlOX}{T! zhf57gzu`dgQQj-yL-B-unJC0`@-W!)ew-q2heN*+!pCwY(8sA?4&)u9APKg-i@@j9 zZx7@Zfrs`RiNn^q>3dq?ym4}&d_3yM?T5r=-bG?S3GDMh~zP^hgJ``w))?>OYm zgBb&GUO%f$JgpnKk_ix^7xWbr~S&SlltM(R6^cWm`|Mg9fiDhq1OW1il_*kB@7;L_VlzPY4=cv~xM+1#BV02T&hvakgVN6CZep6rTGCmfRDDa17$G`P2sBtUqI#P zADb^bg|7vCpUH(qK05)KOUif~V!WRNxs29G2dR|N9gu&-R z-F9GI3~ed%+B*yN{ZH)Q**IuF+Lz}gb{RyCjl*E8gwd0Ee3P1!@82)Nry00Glwjx8 zfY0d%pVXm0Ffdu~TpV`2PoaQah9as$dVDa>VCOxFh*RFO2JGul2jyLd!P@UMbIu=zaD z#f~%cDEMZh9d=+l7)gK3ZEZXix+Y%Dp@%)AR%Z+fI6;!$Cj0;oU(Dju{xzX7FtLMMeX2{gGHWpuV~OK9k$p+QQH*cJ7&xW*B++MtU+G zG{0HjElqgk8}mutiV^P_{$p`7a4hbM9*bM;$Ktbtt#K>3Gx|0Ee{~uD_V{B!6ZlP_ z3wQu%0o^D^9yj71iF*+DO5BThn#9u(H}JjoD%B?FA8ra8sB&|bwKNftg3(szK zSEKFi}PF#ItR4npwSn3ZU>DamgjNM7~6SX2MssKOEZqeBmURA@Uf>TEIR-; z>@e{?d18~TAM6{1ZCYmFoA>xGz1tt@@WK9`s+~~}zDv(<($oIeq6EQ3UrfpMG z_|)_f@A-~h-Dw71i{qm_I9`jpf;fsI9ajBo@Y7v!qj+P7Rk*REc2;Y=^t|WaO$%)7 z=y$iF`m$Lh8MCX>ry1X?HcDX0=h;(eJY3i6;5mR(i z^_Gsg({$X8_^&5P`Xa=yjCK9`_E^_3SEu4lTlHX`fiV z#_6<8{tX?+#_PC+`1oKX7AUo%R`C9=O#?P`RE?E9#xIR^1+rih$TCbE@aIkaH$a~a z9sOpu$F^YVoX`-B<+Vp*t_a4%_Oz%gFA__y^L1W6KGI=Mio~qT-O+RN%&2$NrVevT zBxZgY$HkjEF3;cEv9a3h9C$d=VHkVk-b*%hoO`o7YF-(MZ8XDC?`YELQM@w>bIr!i zEoG!59p4DKqkdy%%pHWhX=bN;%%%?4R9~mN6m&%-cEMzKROdxv11ojhRT+srd8LjI zpOhXQ_~kUkGiLp^jzB1_(~Y{!tH1-U1~L zr%GAIuh#J!rbW9b&j^O&cw>5}>59a*R2WfLChT}|Q-`ZU>+cT%FGIcM&|hS_Ci^;@ zP&UB4acFxb9@j~O?V^#6CbZeCKt9@h!4-zm*$qC^hw=-JXcO$qI=m=9@Ma@QbY(!V z8r)jyGgP`CKI?@|FT6?Tn|;vES|b`TbU7FDx4F4FngNPisVIi4tQ%rdkC@wBQ) zhZlN0iF(}ZN94KDUaXz?Ufj&st!K_`XBjKo7xTNaI~vZM$v6)_b9Ou05{blCVIA@v zYwkR?^ZO@fV?)4a0vXz#GQ$SuQ$0UMVq6PUdbla<4`B_$9Lv15#_o8Qe>d`);_DH2 z1M7i4U?VUS=m)O#H^rCucgL52&H?QQy$tj+(7B*byU0 z)F13}2R6su1)JkWU~1F|ZtL!;^FFz@uuL$_;3G(zS-|=&sEyb*dEn4@H6vM z`(|^ZZ_LbXXiv|6^1vplk5*}aQ*Ei1w$!7q&?iQ4GTOtw+NRobx?Z=1J{GS37us`g z($^*wm>b&Ko^O(-DX{khMi6U%C=%lyVDyCN-{tzl^}k;~BQ~_5Alk2AC}z~BMMqm! z%=8ZfUJ*+hH8g4jn&YeL&%8VSvDWy|wZo$0p5{JvShTFOHJ&zZXf(L6HD0i4Xta1H zd;#U3$jFFU!C}D4SXy>LG$XPz+NW)2G%LC@TF^K&>aE7U5qrnm>VN(&`Ozok4o~Gcds-7xG{Z**HDpTuVn5Yvv z8SMqp!)MOqJ&~6Y`@krQK9N_+%LvgA`~mn*Ai8yAq~lD`h((Nzz)&nuSP-=WuIT8| z?8_m*D`GBpAQ~vp>HQ`cD!t!?P|RfpqV<6@?-mpdiQ-P(s4KT1S}-J_${WGGn4^(~ zJz$_P(vfDo821KVj0dov3}j;ebGec;6yl z%%~27>miPIG-MwR-UArIQHXm+^Gjs0wCI2yy-7I=vi=NRw}Syzigd*c?yYEk{( zxC`UeXu%Q2`ir@w1m`z6laGCbb=fd}88`gDj=KZYFA&99f7~>F4L?S@QGm7oNZbY5 zCA15)1=By} zwTN$qE}P@W(a$fbbJ%NRFG6>gOG7#8ZbTlAyW1X)YZ=GmEN29Nsbrb{<0y}Dgt|<$ z*A+Mp3`pC48MoSxqm6;6Zrd-he?T9D*KHh6Y1i?Tb{$V?*YR%cqW4SBZ93~$9eG%uDFz}S^}Xj)G9d5B}*o`*OG1(Bb&>QR}C zob%8_@2%iGRQ-_5Ltk;sL%VyOhg=0MT`tT6nV5gxSlt@u9K?Bra}ehp&Ocd>xrg(P zRr+Wb=bN_C`Z|W0{eY@x*^moV8`w6h6!Q}1n3-kd->u`AyQsfaig^(AGT#*~h<*?K z8^(HvaTe>N`m-6ngE=CCy>c7+Hyr6mAM&j(vt=7>bsgqx*s2X!+<*fv`?>cf2|`!$R*)KlxVy9?(^N-y?>vLkevq3rmGvOCuR-473Tnb}w$kZ-mR ziGB-q^kIE7GsCb`bG-O|tew~k(+7RDCvAwms1Mgwl)s4$eUr2e>C5aZ>T2tGYNFPS zd0eZ~R_#u#d$gPKw|~`c&@~fwTPAjEscDV3U`^}IZtTzQcH7;>eUPsTeu0Dbn}@PV z`(bTEpMJjWb|-9?5ybo*9TI&8_TyUkd!sn97XBVM*7(^!z&WE|U;E}7ivK8LzHEuNSO2!=EduX(#AEo?M(W@3&Rn$_G{ z6lv}Z`!TQho8x}0n{cW3xvnwKi?!_o?61svU+4Z7>@~1=!u?GdCobXKG&goUy)`~A zfa@K>ozc~7UKPgs(dY2AJ ziv@C~#EKEW-eqie2X=P)vhVLQPi>6y|Bd|LMmdgSIO^fwO*pCtx2iUBPfxjLUyio8 z_QrXQ=DAgS<5|W7C);p6pcrWffdSwlU?H%me{=jf#M{li@!bA<jbBvOBD1wpg#fq3Fvn~p9Fmh^eNCML4N@HW6*^S&2dkCq@#EU+BK>< z{xR}DK>j@R-L%~9cA15=!usa;xOuH{b$#Bi{UQ@<4X=;bePUKeWAr665Q>^r;iy^P z6m?Z^k?SMZ#>`+-ml4NnGckKKAt*KlVI@IA8EVzudEMz7PFuzv6iCrKHtX z;eQ=S=NQX?Ju?E@re@Wg&NPe<`u<-q*HBJsKGJaxGMDEqc?Z25M>r3JtOF9?mK~0A zZ{fqZV&528@9!}6c}p&2?hroaImhWh$VE9-hGWbS9doMoDmyUEgw4FLR~9D_PcjTwv`j%BxuljIoEWBIejO#$@ChaU8A=bZBY<`|~$VvB_T%Ng%C4d_0G zb6c9@A7X60iuvtHjH{OFNNjCeBzA2i5-V$o#QKLLvDy&+XMnO;k2-_6mTStGE;8PX zo1xjA7y94C{1Av<6nHaUWW0)V_k!r~;G6NZaHQix&>6;%=taOjINu%)JRjFaicvNn zdv`C&6(el~Xiv4i-Y^1m3FrXwc}`vedL-yVp+|xqhHEIEJ>iaFxQ61{55zST&%toV z`MHsf^AYF&2@A1~=VI>U^^W2ytTmV~@&i~Gu$I1pIf3m_J|yk=DbB^~U9Gt0Pu`u; z4VZ7PLAz)7?{2e}%Q9m9XIrsXCtMS|cHWfOhwZRm6!wGNS`64P0{ewvKiIT?0QRen z#0K?dzW~~YYZArKk!|IA@2ZM)u$_UUuo37X`Iv|HZRi++b{Q4G9AN&2j{k?fcMpv6 zs@8}1JGTtE5fUx|0t}ay03iejC9PNkgc2aY5N@G`5+I>qDWnjtrR|hUOO;wE*kUgx zRgR*fauhw3($lC|@ko^((SurTxV6~JDZQxpYi+;hS$n-RZzc))`##TK-+5ub&suw} zz4qE`UuW{pOypAI*~nqgML@JQ5`73h&pSUT`umH6>(DP**EA1_{r=*htQYZ`b71pe zU}{!=^AKPG`fETD_4~$SpO5}ZL#*A{^R-5Pr*(T3NU$MNd!W%xwu#X~t9Q_-`SpUzwS+rz{5{opM0fwdbwkH1;;zRI0nA4lfRv7O027hV z?D9M5He*e%KqF3|QOke@SnC5whf!_?60dKs_)g661yaIk8JSr*UAlJfk=G~E|C(zD z4K5fqd_?i+l23f{#?tWs& zfAiayUuiyn@zp=R{^r~7y!-xNu6*z}{4j>SKGLfXu1s9bxZc6#^ufPOCsV<3n(^-) z=N$#d`N;lLaQZa&Y0i8n^Bq7RKxUth`h1j$e*htxKWhHy9sC0b!8jl+a&we$m;(l$ ziG&>gF^d9{1YT6YB`UU%aH1kQDr8Yx$ZD}D%a>*u{=*e8rC9+|SVB7woXCXb#2mpB#AUEezhRHM;s=YdJ^cOM2y!B9OjaonGz%(C7aLL^Y3fjy^@$I#LtO}v2PBUReuym=NysE0 z^@|Nx7kW}h#EHbreGxoeffO@Ht{8991l+YOd9@Ky8ZuE78!;iNLpw1mix?lCQuc*SK%`jjN&CVPJOs-8 z2=YPW@?p{;@d8o?N_D|oniG>xJ+rKoBP}*zSMq6x7j--cKg5>WrhQ1Q4eBCE9k$+t zf9jX@)3qseSl?MU>tWqiS8NH5d z^@;WHzx9K8)@K&c`cMybXkYxMGAj|A7Hr+5ok*l?!pv)y44p83+|X-A)x?B-m7x^Fu~5iUe7pfkc&+1t23? zjRaXxg0RfWf{>A{v$9YFi49g3f{f%2D@$o0!PcX`6v#ly*ZGa5)# zTUiEVBh7yp-ISF z=^f+Xm|GKN@hMq*xn(QBHX%9g7u+XWO9K^1h^T2G!G<{Q7qchyXfP}$q69|9t{x!d za_b^v75NQPamChgNhpfNu(V4g+5c%O4b>&JS579Wk`;hPiU_Q zL=rO{eaEE4&CKQHjY-Uu-@SB8uoI{6oD;Aa?D&-vCNWn zfL)e+5^%th2LaaIxhFwhk=)A8Fg{D_nMs&0~g3OZkRCWgBTe1L9 zVo82KV1*@NT`t#CGPWb55s<}52n)g1!;c!u)w;lp2n2S(&0s4(M6!J?l(;#AVWXw? z2Z61n~^YR373%k_yt7S84kc8 z@(J`*@*$V24ZHafNYrkA!tUH=WLuZlTf4T|{Me~nt|=Cok0kz+SYa7QPXC)N<7*(X z(=vWJ;Xi4aKm&<`mI*eHIA)np1BsKCNogSQp=H7i3|d4Q$1^Sno?_rZi_@AX<(+a?Gc@LPo5BXc|9hB0#tiY~$VQ9ZIYzpI6 zAPm&ya%-3cjx~so1Px*pr#b#b8Due_1PRV|CLWjU*#vD*XV%BRV^f8A8VN5K_?1Cd zgsh?yvurCnqXxNLA6V@MB*)B)0jvk}=mD!n?kueeBx@Rjzleh*)F7eK+`O>;qdAr& z{zl3^sdQeV{&}pMQARmbAy@0_=Wd3;RzH{3=Oba6C)i``YyuCh$R!*{LiGcPCu}yM z8cQy-iM9!IqwywGu?h2~303rUKN6yx@U_+HXc@d>d|)#FgnF1}vVQ)D-*0{7ttWTY zH_%ru{w*?@!RG>4ipaidp+G;XPyR*teeyQhF3W`EeX&E92{({9Wtr3l5|=HL-asN9JqH7s4J0C#2{e!xV42qMldxV2 z+j^gbvJxc9h&4zUHiY(yaL+GBYNLf^$gUAltJe%y5wS!)lHaWJH8g@aZkg7v_fJD` z8L5pI`BxFWj}loJXMVHR*T6$x)H1E@?}UIOQr4Mjow>rSz}Vp&5GJ|L-GMvBjBD8A zWEJx^hqn#9?c&hj<&gV^rImZJ1&4=i>_trud@daSRHHOlkJQst?Q!Pqacx2-`V6c-`&NLFD@utFWm%aE?> zjXS^psc~Re9!APBdwjDb3=)W2_c-(SI21G?WwaC;EDQYlyIiahY=JF@Xdr^NAf+Wp z-Kf!)0)?}Xx_T8n1}KXmwdocGT(^?lN?L&2!I*Bc9=UYphY!5_`m1j{4IE8ubjw`k z97hTp^u4T;wM5AR=8%Q)+CcS~g1Vfkg2PB{ z*uRSC2uhr`CVdT;L3GA~fy!FjcUO~;nY$-|@sZrQd_b@qsXcj_%7fU(`?r4A;U5%Z ze6(M-&Gnjt{A#Cz@?2?jDE6b*Ej*d!$L+da9f7B7)}P4Ua^nz1Vg}ln&wd#Rz>+URoRJCDyY;RcZ5r zb5XP}B?#7$TgfiTRt^bDg$2a|LyJvb1|2B0y+RF>0^ZJ}09mZp?n&y4WN}@>X~y>kh!P~{ zIwy$p3Pw{IZUMf>6f?m|fDqq73_B^QFcVJk^#&|QjRZ_9-Fqp&a0$iF8WDK+8guJBRSp6O<+)C~TX ztQ5aVGj4G+zOESy-Ha`ovBb@|Su<{PGe+2q)Z39!jpP*h6LG>LJ{ysD5Az54t!6@+ zYkWH(;oDu#s8&+HhRpZ4t20J*QV$|W>MHa5_=DGCVUkLHKXY@Unv>Rno%MTU`&RQM zIXWCQE_fAtXoeGg8z4FM50eY-fE3y50Ga#-OTP1II^w}@qT!%mlP0zZW+KraDwISpP+JZw$;4g5IDA8|N-bIL$7xqJ-tO&xmk$o8T?ms2@-CFZlUf_4+f-_$H6-bdZL@V4#A$EPhtj$Vi0|Ny91@b2!BC10>uqf z&h`Z}oSR1=E5pA#(7oM5$kTAy~owLXqP+XVwHEnSfB<1DaUFxZ!vI44lC zv*154fSgjv?lKjQeS$ViedE!_E^EMxiLqj$FS_AV6p!~Uhd6Q&gCqhYd_TyUz}}ek zJ!DD4e*mKE7f}915Zw=h_zj4by;0v*i=+PaiQeGoE<-Wtoh$~TKIXH5;4o#EvXf*T zu+2Ho=1jBA;qRJBbEetm1j5>!=`EWxBhj1zuquOVrgoq-$eAt88I1DMoCzQj&H0Bq za4kE~+njaMoQ>@^=P(1kfM2`rEU?X4g<7RK3w$49UGDNI_;ku|mF9Fg13sJlLZ7Ub zAA^^9w@AwOl7(uq42+zCFdz%jVxKHbE5XY`rTq86%fe)NI}POT77O0MVDGvR{eOkT zE)bl+U4IWEi^KqA=aF!5%O~+QV#?-C7CQ za}qEcpe7q2{=kL=?|HG6b0c^OSd$Id6W}Fa%3lF50kga}U{e_<{`Tw5B!*zmTuNdC zh}9&X2XPOHC$YnPhC~^NM?rMI4AD^%uOa7KB+h2zcgI2WdjYp@-$NI-7ck1&3t0cb z99?->yd^$)4hNL!?Vt}kq~kUY;=sfKgjitwHJtQ)+0hfQ(Q~}W@grjT^A`x6L9UrW z4p$A+yPRfb;ES73kYV{cW++t2gs63q7bG={&zZG5f&yhV-6hsS{fsdSImyL)71 z$rJDH^>`Qacz2)2yDc8?wtBpKz~kL^k9YTby!(#N^#3G1=%mkbLA(an%UG>{-@yQdiYOw!G}G`SNj?NoWflEOt42@3tswgiIu;L)73)C7YjdF z`lV+e0AC_JW3yEQkesFdVAmQrBPZ?%Pt7IBE~4l*KhF|H4RVH#@HEH2Wbl1{XOllC zBY+k+$kFc3u6nfF2||u`RZ!|4z-xbdwBrKaJpxvab|%6zeqt8IYFcoF$b>9Y1&L2%tZ-4hHT5x`M%Te(E+> z0@v761NSTl30y9m={_>g4O|`B>0mv9!Fo6fwaHAR`o74iRa!V@U235fA%0zfbD8UAV{R`_E%E-~+7&PTX@D!cn{(mDveRnBe3_p2Rad|$f zCkIxQ^WhZtys#mQ`Zf@8V@Su*gtNL`G$JYFZUA&o8{_lLO$-CS)* z9(K z=wubz7ZrRT)mlPlv%|4`mIn0kdZBkn)j= zkV=utkjjywNVAZtkgAbtkd`6UA=M*oK#C!4L)w9~3u!OXKBPvZ{YVFp4j~;zI)c=M zbR6jf(kZ0VNN13mkuD%zLb{CfKGGE=`fA@y1c8h5hYt%BAQdBxK`KKkN2)-IB2^>R zA;pk(AvGc$LTW-fh18668Ofj*JF_Q|-0OeBHg`$);=~DH7^Wk2M#@FvQ*aTaBBWBJ zC{i_29a0Qw7g8hAA*3dxQ%HQvr5VY+{+Tu}d+c(#Jc4u#=|d#`35|av^Ijb5ys|9F z*!S}Fn$K~;i~S*p3D3(d$9J4~aeVM{@q}e%%#h@(TV6bo@ZyU%UM|mro_kF%pFT5^ zKPa+f1%AmovaWXZn&qojMuv|lEGirx$zQQz-5o>gRUNlU99d+1><%?G@TD@_;{GN{!|EnYr!-RMPTRZY#px<#v(*Kb^iUs_#J zYu2t@v;4M|wKWm>k?e&F$5vL3owso2q?;!!oHZ{xVc|lvzIM^=3;A2Fwm?PsnnWS| z?y^~n+sF|M>rEvjGsl%6U58YRGy-Wf(kP^nNW=LnDI*ukPnIuUyVS$M{u&QkyJYb~ zehM?8&K!OwGm*1=orhVncu7(L=CAvslE>)sBDM4i z;*rd9jUaQO{1W?;`V9u^-uxx2R`Q2=y?G<8vPWy=!Zy_K3-|J)xomlh@~(jGX<Mnv~?pRe*YgW{*ysdtjS+jgoEnQ=8a^$4W-A6aL{UXNu=euLOJ!$6M5vUR-)rKXGxI~{zPrlXVPbn;~f zIy+rVH-E0v-RXh9mGyJ3#lpx%mCxe@Ou#ssGt=>QReWIvDYUzAlc&CyC++1a?~LSL zT-3`l!=H0L>uaIMMLyS60&=l0%gmzQcK^13ykK?3jo1LnG6zuh8UKTU9l-}e_or+R zZ|hK&S>UaUb-Q(W^SNP2{x)9=yWBX+G9#aJKI41Pza#KK@cz*Dlx^X%%me=aS9;ul z{tp*Il*9RjxQZybMu}?UWe42pffEP zoa768BwuSo`&;d5{{WKysndelp?8B>M}ygugISYX-21!iRR||ECFFnR?#Vu^9B~g% z!g5Ax*I>8MXth0-5E+9~8e2J!W%qesYp=ayiBzaz9m{^PcS=O7IF>!9ez zD4|*bE1rUaV4=>;sliS$WJ0zjcs=X-fwkPkibMV;n(~vO_7)VK0&OYVJG9kWlCsvW z*nlOkY;v$;$iI$e5D9n@+8!*J80@WXc$~6@JuXgWJnn0)%BFN;B~!%`no!Orz#l|U zgyN<3nfA5?J6VA@02D|GxS|#j0PAakKNTds4*GAK9L%W*`Cr=15$^v_fA~Vk|1Atr z?<_upAsS4bQqdywoMdhfc9{0;eOvE)Z_cmM?fGuXw=K{3tU&eYL zgcAcp{wwH@UI;>PvVR9Us9VVYA;v}*(`!~uw z$w4OhE)~E{lcxl`Oqx=GI{oV>hy3?%#%)gkx3})v67qjOa5Ut9 z-z72mX26XJLNmqn>p$<3@O&q*C5V;>B|;S%sU1^LU$D#cV7H0EF69+;xr>Aft{^Jv z&Z)cL$qRJnDBU?hca9{v^9$?F{1!23#|`#UP6)kVJE+n+F)8ZtqT6&hFf|?!@!&K) zI7knEO%J}FBsImN&-0fpNL1*9v0d50n50F%oab^pPcQ%jAw#5TZ4tugPo(n8#tOePYV{_6fA*PaOMW_ zr=%^~X2Nsm{Npr&fT^8<#mR@?8;tMW&q=g)Yz_IJKeOp5 z3E<>^A|6$HM6u7&P}*WNd~cJl!14bKK7_wH$ybyU@*jo^Cxdj&SKl!j?C^fDd-#UL z@cH&84xg7$z&9X=B`|(=IvhaX*z_((!+!<0w5Z{0QsBQ>1IC-^?-l)j*~9_&I|w`j zu5r^AUzI0>Z?zb3=QhfK`}6+}xV8t}??SRA{qU~vn2`V6-CTvg;luFy)!pv~yJO1; zG3WExaDt$5M#YxjaZ)g2YOweA;Pua7L&xg+No?$pVdiGwz=b_H18djA8@ZDB{}h^B zQ69b#`yFkB{IB}CvUd1$$p7eOtOsxSCr{dXAGXp-@4XZMhYB|zr6@EB$J@_iqeQ{q zg7tr8^SdGcU;OW4e(czM)b5r?vA|B`mSC4*?uJn;|I_b|@0G3hsKknVKfU;ie{%Sf zEluJKG8KES?5jBw?H~nYI_e0tWXk>HJ@iAAgq7nd+CxXNAlV+uXAixX+%3;YXBYt_mM8xou+QOz z!HzKKE9>9oIQTs~|I4iGZ$aM}scb8>P}%#|;!c#u3xWH>Tb`MM2^8B9zQF#66#m(| zuUO3;wx&Hn-wK>#-+~qBZ3|=M>|h)Iyk0W)gfVdN;tHG$5cb?;_V`(jo7dL!C4m1c zDMwl4w-^iP`>*&oR)2dp!t!0N0x#YzC*?1Nk?{xEL4loY();VfV|+1weXr-e2$%db z{xaxZ0rSqsdDxly$Lwn%?{C(&;0Kz@7W@#?u?3HB(B>N-@oS{{ zY72Rq>Di*b(dLmB@-e2O1z&20wcyLln=R~@o1e7cE6iOj^gEg^sEWM%qZ|pE^CIEccGu)hsk$mACJpNnqNUb!H+h4 z;E-SZV6QQz19<+S%U)&XOR)F8%i`M}egQc@KWncFvmAU){0})5<`dxSTrr;JzJl_5 z<9s*seeh4lo?>!sVf}d%A277YBC&%1kcC_H~d(O6o3fqdTxtBZ-fsF|Q+ z#qxM)+;jQ)#+T>vOB53se#7TH5|`ibgFlJOZ=cqWXW$uwI8DMYJ(tMxOV4@v{s~6( z2PW}Dl6bzmp1AyGWP$M;{PLAWUcNNJfbz?q)Du~LQ=VW%UXjE{llbKL zRwl`3Ch@b9c=vNSHrt>0>Ke)Lo4HB)RZ0B3BtHJla$5eDB>93Q{?;UZVG>`R#4k$X z7bo#GN&Ia|{PHCJjwF7S`N*A5knryd2b1`fI-gmP@?U#~H2HZ+@>g^|@jdoz^zU6d zANk&VHu|4mtHXrbz4O-x{(pKDV~0KgB%UqJFn)}J-z%@n%iwYwpTU#t*~UK{59eSU`iEj1 z5Jw=s#3IC(ScrHKv7PKEVw*WYEI@y2{vpkW8;O3JY#)rutH<9`*`GkU-1tpF9_AP8 zix5%Y03zzkC&GRK5&jhsQExF3ev}a5?-=Dvl`kVgznlnt&R^<9HGdWn<*O9utGrs} zHAIwKru+&b^y?H`_>akO8X0*jw0*!9@~QS=v^>mb3^7A&BF0o7{Z)jxvERxSXDOah zyx`_zoO3+Z5%0vqOT^W7{4=h{$fN$tM9ib~0B{T9NxTpJN<_WF&FDE>n$dt-Z~=cDaAs?dY2L5#~~u}H{(3d{6-@DXd=RoW+MDBsh00dgx!eZ z7~(Q}R_1tL2Ht-y)&t@-sFyeZ4@nVA@X(&(X2qD|HpLx^JBc^|^D{br9Dnu_2Vr~@ z^ASHH>S-jRp8dpu7~e$Hb5QY+;$g)jipLb2h{c$%#8G%KkO=!Hfou<-i*7ZK@evSo zhw)+keUMmc%+C~`#eDINHRi11zoK7#v-u5@KJNnyK zhEHlLa(t6-R^)gfKMeiun}81hDBh*`sA3cGCSzVzOviX2KTvT7aiTHn6`xW(qR1cO z^Oa*A4qGf#oTRvhI2li%EAsn-$oo539HO{d@fpP>h_4Up3Hz6LR*?_Tlb@&fO~qik z&F5E}Q$9Jv;(B5Q9?nzzy<#BK=8scsQ2bEwqmGbIMf|Xd6E`dVNb!Be@=jLXsQ8BB z#cZ3OodcYP@vnHl;(sVk>ulvODz3zbF{r;5A9o<`QVipz2KfPsa}`%BKBRa+@jn&c zQVi$X@*@gOqrR$QcbpW@Ss zO^UB5eyG^Jx3x1#aj7DPr|~Va=OEt_p54F$5gy~KwV(JU-;exaj9-;w3LD>aj0fds zC{`(=sPRSZ=RH||2YD!cN#$QtJfwJxSZT};lz)*p)0jUf|2lCNKJ%jd2SmQi;k<`^ zo|k-c48CjB^1X<2;kWXIL^wB6`A-q?GKUWnvwW0@mpQYQze8~o@fKq~tNcFVeEjB@ z^2dk^;J5NGD*l#ut1+)A|0Z!EJ`b$?--w^E4;CmH(;DN)-=K=~5^F_`7 zsv^Igllea-VqKPXAN8D7`Rj`B5f|ejbLD*j%cl^b--U?sgNaKpP89h;Sn^X8`2jET zD;3ugu@A_;0y__p2YyNOpI82b;;%LTEk!=a&GMay*dHQ9lpmycqvqeDJkMQ}uh#qr z6&n@5NrZpjSNx&k&lP{G_!@DdG4Ck&6j-; za(Uo$?L;h2 z4--+}6GW76Q2rare_Q!ym49COpDF(f<@x?8?YyS>Zz%s4{IMA&;u@%u#V!%alSl?Xk4We|Be7l3b8{!Nu% zR-O;}Q!mW(0rb*|^jrBn<@1#K*jxK;6C#U~VbuBH9&EAqTb z{v}0zgq{5Bihoh`^W22|j*5ATgA_+8j#Zqdc#Gm~ifa__Rs5{tV~Sr^{I=q=ia$|2 zt@x(mUlrv%2md*SKOxfkmBP+o_~}-L`1(HR{pr+ zFBM-=`FZ8vR{lNZKUUtKq46ccUXJp8l<%+nFy%)o|0(6iD?eTNnaVFzTuOxBs}wgA zQO{?T{};t$n*U?PpA)ga{8D*24}(9a{5wS04QE<=U5Vfel$Y}|_{GZKuDFSa{9Vd_ zMfn$$|ApcoH2+V^f25eg^EUiQC!!r)mG7ziVB$1m#wtHu`C8@gQvM0$_bYx^^M9)R zE6RVYe3<8W)Ypv&`y-W~qCB4|rhKX5Dn)+N0rT%u{45dv?^1p*5#x405q4it{DaEh zQvUxaALi=@==E0|sW@J7rs5LCjfxK{KBD*~#qTKoT=8|q4;0h+`ULgmDHbS>Q>;|H zMe%mU2Nd@!9#%Z1_?F^FiUt?YD>z07Vi_02G!aDe1@ZDn5HCvv^AsbB0~GTW3lxhK z<(!XtN|eVDRqT{1LL_{-VufN<5l42B%j*It&sV-$u|{#3;tIt&#d^gJiklT5>2NVw~9#TB4ctr7-Vw2)=#S@Ar6;COiRy?ElvSPF11;tB>Zz^6^ zd|&a3;)jaHv2hG2@_lypzr5}NW+~rUk?$i?o~Ia52L66N_F+srRjEK}tBs?4uYj4JYdR_0eJ&R48f ztWm5}tXJHixLGl#xJ_|~;!ed~ihC9JDL$##sJLJ8fZ{>LLyCtLk0>5fJfV0}@s#3e z#WRX8D_$bv_4%8Mmx*KW41?koB3_?=sA&A)@j5-A7$)L%I=`5Om_;nb>wU#s;#hqh z4UCWvc zD&^-B5wAMs>xret#EjM7Mnt@xRKAgjxE)vi1aZ9mdm8;|CSPWsJs~gaD&m&Mc?Uj1 zWZaZ5Cn9bul$Ui1&dNFieOYG^H(58pH&G99lX(wb<~lXOOZ{ea}rf_xbio&s#Qw#Ay(V7i~{QPU7 z_rsF>7-p-Fc1ofD3)R14-}9-`_AMtXUB#w;q_k~YuCS(d@!H!KE?T^Jb?rJM?f$#5 zNPKX#J=5+7OAD8*y5o*oddOYpf_@yn_#U%7OZSqRNV_>}OHWw$TnkMNqpm8N-0 ze9%}vN8Dz+la=aL2qIb@M~-eDG|D#;^%iGIO=+kc5U;eJ=a-|@lyR6jq4-lhkw z6#kL;v}-L9A5pQk@SP5=R_i3it1s<|KwiCK38YnNE0AqV+^>Q7dx1=R8$sJ~Op;$M zj7h4kr$$17pW6Mq1I_d80ax=4E&cmL)>a)?ZO=DRz$%KqHHB+7-a#BtQ#j&!-iKe0 zH5S4`;lSv!#4qj`u&8i^+=rK_l5k++N~1*ycUY49XpitZsRs8&g~PAYrMysBaB&l( z#02gzA@@-pVX+A1K3wj_9^puq87cP>xT6-ikMyXFVD?D4kC6ND5w0UP6T63eS;E4# zE7vbyS+j6SUERXE)x$j|hD$ASA0hYQkjl1H2o{ybbrHtlVB54`vaNXk z5n6X5(I4uOud(*(wt(hUio|@^XV+eJlD#_E%Yq*5;rJQ1cQ*<`HQtVL(A0A;*WO0x zdHsvQp6ee%7PrUODzF##kFOP|M;%_SJ-)W_+S>tpu7AvT+xs83y>b7lA!{psFC?{h zpT|GEogTNh-`b1&w*oTyM;%_Se~n4@8a@8u?cun+e@8o@8uyQ{f!d1SQRsQwd&uJ- z-iD3a+h^^?{o4i^{i6;q*T20<_Kv`w8$Z0g8Mn6=wAa6#;OV1#x%PG;!|UG(kAHYf zBW|x2H0;IwBSZhF!^^d|2(;JUDUW}6yd!Rpk3o9<3xnB*Joj?#U55;>y=ISpc)TNS zk7FAq;{G*)p?}oj<=SJNUVE23{&iP9mir-I!%^3r=Lf*hrhB>e{vCQ=dskp@2b4J9 zdLmJe_V!qNasT+*pZV0`<=T5V$zE(*qJMj-9?LZ&dHv&i2aQPX<=T508D9T(dF=Ip zjC!>93=-_c{kx2YGoL!VTzlUG?X}nFvDa7iSngUB@cMTJ_S%{s{h;TycL?@ap7HDN zvG)Pm=Jk(XzD_;r@PZk+{sKL(y(6&a&W~$UkL7N{fbsg5MSIN9%eBYX?p}K*JpK)Y zF7;@yr?nT4AOEJzeCqIW?R87CcMA4g{|2cZ%N<7nuYVC_9;YF_TzgF*y#6(Bv+wIL zenXI`M|+Qf@W$@~GMP^uUex2oAKmfV3vW;OHxzQ$9-lq%`p3Un9~TSu=GyB3J+Hl7 z*vp3s{Tqhl+G|dV-ysyDf7IdS+Iu-Eex)A&hN~XS)uVvdzay}Bf`;^R?eQmXz5YdE zuLwHyZzK}+Xm6sm7w_K~-jiWIb$Ge<#wXc}dHfrtdMx)G+Trz&&v>@w-!ABR{oCd7 zZ?wnWchw%254ob)*xK4JZ?k&wcFcz!{h=*hZabDF)!T%6b0KG3xOP*IoR1aXTg`T$^XJ9XieA>fXYjJx#Fu-2izuZh)4|RCC{(YDY^=}q7UDiV#Uaq~HlI(>aNW||Z)nmEepdAbs zK(6_)*H-*~1qE;a=6dXvqonKKx2(N*|8~X(&3dTA%k}T;N%rzR_V5;I+}1tTkmbv8v!w|4cJi2EGc)^#q>wqy!9S~9@kU%qKwx~c7DYB_jEgYe?!N3?Y-HK zUO|$*KtbE}o=>uu*N)zsI-ae!_?rpzV!d6?`b6#$^t|(}3iE@n5jo!$BcVE(_kRVt zZ3k%%V{-HFFYe{a7VCI+^WVgTOmkm+Ak)>m6?)!!5ADQym1gU$g`Qh4f2qhVLz{nD zh;uvqb1zrcCCT10yhz!Fn6e$WA-VSChb6%C?7-{ZC6H677ws|e_sEE@-m5TzN224G zt9Ngbe`A)#RfM1(FMfd?+^(}6_EP9^e|9fduN#zHnz9Yhn~$>Y<+_>!J#YN3d=b8) zAlrKflH1;tBzvbnjW6EIa;+um@+aBLZ?v!TXm6Fr-s70(9(PR1U8q;*)>74@`I=>S z6fP-TH7uf6kxKwAZSU6=7mH-%h*2X-gsM)xcS6NY_FEBQ2$zGCs5d6%_62gVSfu%8 z0;O4v=Ql?h&wups$FDQ{(4j-I%M*wGG3(USb0^0(Tr|5H&pOqOXJg+^KmYN!r=Jg$ zHoS(vL|#lc4_!1_yYW+Mz49!k z(a}Kc!E?b#DV{c=4brB|AAj5<-X4SYnENkgz#eQ!`-$PK# z>@P)K)#$6pQy1w&anVy3-Fn$CfnD3rbx_+`b=%LGLkU0f8@HbeV=Sbq+!wq5TmU@v z(;~Kgt}Q$^)*~&pqdAOvp6&SjtG=uq=MI?{;%(x1z})N+MyvzS84jHY#?Zf-9nG{K zfWB*s<0fY6&cBdR`or{751qUG@N<_~#%Fe%8`0G{KU@T>G+H0 z(DsXX7va3CFXR2&K8ZtT#9`;t81HC*pmh5=j(N@ve_i9*)W(L_d@+uL$1i4~Z2|Z~ zKVr|PBd&AKfBgLP^B8AX*`w$Klj_Rz5VsJ<4CeLYj7KO7@rWRHMLPbgX;b>KM`w)t zG~rQ)j6hwWIS4L^Jez(yE0Ox;7apVZC()SYS8ogW0GUvFRx(B zI{oedTaG)Yfm-WWggQ0opT<%|5@bMW02c^3dHJ4hyF1TMPHWM z@#^}@7-D|($THi`F~;r~LDAG-XOy0+i#>NKp}S4S0Q1D|p|8hG`OrV&Qz88Lcd9Ac zg)ubqEa<_pj#%?LPCsvUJa?%WW5~5TBE2-5c~U;MEp{2@W2-n8W}g3e)%5dtpDoqY zv2S->;)VS3}(|GnW>i4a<3FFJs;>*ME1#`LpV>xR-#xi`MU-XG%nBzAeV*u}#ppDV9 zh|l98`1BU~D6jOPbN)l$N0 zwsHP>b-w`JsKNS)xNr@qfj;$;Z9WV=H=k>P*TxQ&NgibQ#Fx~?x#Q~5Pod51^Y=g> zeR2M7_@7?=(8a21+is2ts}nun1HO=FoI*+UEkb!$mh8*Tkk!DRD^D(4*+$u~VZKH& zzPU!tLM&*L@rwJSaUJg|8($MthW9~wuqyaMJV|mUGH$II25Xjiq zd69=?J>dT2mG_4{?E05f7Uzt1Wp?d*>LTqX*O_^hayUoy;25&&FWOYpcs4zPvEr#a z-ahmz&LlmmA{cLIU-J0DdYbBvfsykkz$WH&R^n_@;Mp&zC-KvI%DK*Bg7P}_ZET;2 zRqv07Iayd&xu(|X8drmLl<}%ktWYdfELO}{%v0q0%W{D@HlE##e#|O;?h^7}mwFE! zh+UpC^p7Q2qlzL}i%{>uI~y+Y{NY5gH`Z~TdhB8``YaKXIp^_NP|WxHo3WnA9K%Z^ zoa-9T7qN}1YqB1?7({Hb7hRm+so~=Mz6}?htcRO@k%yb5|IyxSUPBRuZ4}G zYR*}#OW1!xS=*bjKAtOxJan$8sPTM$RL2d<@f=xzF%yVxJI8njBN*G&_lbUd4T4?} zdRYYT`<0JLwca)yHe4EqNBVEoy>*c9%M(eocqpMJg&^|SAMoV(Sw z{q7p!V86?!9Aklb)HBed4F~5b?0x6s>mls*g)Y~6_D2YP&pl82y3v*=9W*zeF$?Z$bW*bH`AG6h?K#)2kL8%pKEwI{lIwFaAH(>k{C&h_ zK7)hn(4lX|ig-@IxIYp_d|;bx<7=;AlwvOm%^`?ddk5k*wXmXAMJaz&xxV$i+0$)KY;d> zBke+pA=M#a-IitUMAOTRC>>gjo|RXG*@2`-Ev_ZOJ0YoEpI| z%HR>V`r6fz6{{B2+z>IV7u!*_L6r%sw!K6cf_abqVJ z55K-_+=S`3-7#a5L`QuAeonc+{x%w@t`&vZSuNh8L7k9EE-<2bmP*>>!&ZDGhyny+g41kyZz2Nt0q=V8+~WZs6{iTO+PY0e(>AV}Q@3vU+U4V>Pa1yPwB;qM*3GP%yJ_rg6UJwxUL{)i*dc#y zLjx~=Wy9*oHxcqNFn0Km@%fOM6-1u)GZnnADy<|GQl-?H%*D3t=0gmf`Gmj(Fl ziDTvxSXscl=TtU8MJ~5ED=9_7*VYj>2st+f*l9`J6D zb?h&pkY0vleT>FHZbL#h;VzeJi*B4ka?Bk1aKVze%hg(IZbEBrvepq~G$FN7%|T?d zo$xbZpq0xkY@LZx>t!j>%4Pa!$AJu-`4Xg7U6jyj zTcDN8V<6&w)JB_GVl$H8bTSPj4vOAv!eOMK=@e_Yw}IpdD?!8La>Gt07YW7*Kzc)p zmscwS9&?I7El!3RttJD7S)x!$u;y9?j*@hd&Lmi^S)_Qml}11pA;Gm3fS4tB0rp$+ z2;hVzPXTB~0zsOWYlsVY6B52S($(X4Nb2QkRe*0o^5G$VSBxXr~~ zE^od0$ib>bum!4EpjmRO67^OgLoRRG2yz@VlVE#eF3UbCjNW`R)IlBP1zE1ij`i)*2jbZ ztWm=@iBz%JXQ<@zR?QZ}c>?DR&LE zF%KY@>ySrAw_C`@fMYw+r1^k)OKt$zirS0;4Wa-cjNl;#{4%+SC6OtYTRWLDB!q)- z8Rvh@_(Xv=Pl**$ppw7>j9+DgTgGw_$>pu56ggP>2)3SE+%j$KDg&T(5Xp8ssbfgk zV#_hznq|t(K7z_mh{v;E2H3yT&Q2I@)mt>mnE1`zr{yd57!_e4kjwSgqj}1!dCFCc z52!NaEJKo&g2X-~_(^C)(v^bbVWc(=3G78HssbgK>&6LiCDPcrR{*xLt;Y0+ajn_; zcp)D{LN!MK{Fo_7ei{@Gl8hu`CN<&aR>sf3?vw&ElSRxvE}~X0CPb}Pqehfa50VY? zbFR%|uvK0BNbJiZVqoNQJ-mQyZHG$Y&Xebm*O9+M$XSFsBo4~xRSsP;Tbd-$ttKyu z>!LU#52SW)E|eouU^cghVoOq&m+LU;TqK+p2<1Y~A?!uMa!^FHCg*UFpG3koL+g1+ z)F847WVilmxw~N8esS3d4vs;JBPsY2G$e;pGcQ^0>g5-&NBi}B4L0Mjw7Ls`9vF$ z83g*nY`0p{tiD`oh*ki2%wRTgugyjwx!k%~!7(JL6%bD$p|QBj7nC^lPlUtf4`84YK40Uulh&_ov!!^@y$kweAdKcGD@cW`ZcscFL56m4 zJQTtX@w7C^U=*Mo+N7cCL69C4dK<#t8>YP{W{R};gcMCx- zX}Ubh#`5#yy0hl%(qus4Y3W47+*p>xhc5oaaeWR(#u${pA))xG?)24EVDJZIR`5L> zzASQQJ)X3Z>k96^H*n)T^nKm;fg@jL9w-Cb8D*Ry!4yDBAk-7UY3keS3*sn)yydus z*W&hp@vj5~`CXd$Wn%6O;grAw$hsM%vpUEPBJ8B5F)Qs0xcNy17b80uNTVGtzV=ny zf<0X^dz|PK0F${CD!y^_*6FxT=pgPLWw#l>fFzfHUm2H$EctHEo2Z<1fVo1Nv{cZ6 zF1YO@@j@p;dY~zL1CYvrADV0yy`J=s0@*Y^4k>UvY|MxI3MewOX_1KfD|KHDjm1LQ@d-2cSw42h?4JCD?z{qf%3fY ze3hMg#=dy(N@SroHv;mu@n(N`KbL|#>KFu()G-}Iyp9w9 zcpc@e^k0+p3%|z8*oid!cUj>)p zRDB1~%eUJ+2khPpmQR4_{Y%`AAelas5u{}xB2Lt|0ryHDrjq0~NiKQHHfGt}F(^fT zeO&i;TF_jU-2k3rI^xU_i&3%oMdb1bXv>;D-viICcWuppkEYK_DMAN`g>*pCCJUm0#DjdQDi8lo6DB{I`DkIYG*N1H{+V*Z2lvq;|}YOS|g zd*cdy%a}dSlTDfFU&ZX-Xa&p3Jm!=^&`-oN3k<9}3!a9$?-VQRvJi2XS#U~b!FI6s zV98YJx4>>E`x2*em(yT(3Y&`QGr+gI=m2W*{paSeaK-W!y1)D!RJ;BksLF)-6|3nw z9yRV}$zO8~>AD>3-UPcF>|+V`8L%=H|BJO=BlG#gQy}|%DuiwUfv)l6WfS@lFvE66 zvCa2w)XphWe!cRul-~rNzh%UOm^%2x35Xuj#CPQzHiW!UCVyjZ8$WS zf%iSrF_*tv^hxl!H-jiA5d$%k#8*Jv3Zgr|E0(_x)w>=yz9=x=I1OVo@j|EEcOm8^ z%*{=~_lAPNGz`czyb&4kX}E(0`*3=cfMA>JHI`K#{!vuH2@r8+>eS<8o#9(2B^c3{ zpwXlnb|TluWq*O}LzOYN68*=Ttc|sp+MLAPXqoFy;sL_XfIn_7y>u4(g z3^G{&>a?t_hyHPDy9)q^V&6@iJ6%2Vi{sEvFJh1;7zZe_x95gZ~6xhI9uhKZJWACo8M)b#kx?e!iVeu+PhQfG8JgwwL46 zo!JGF?GCeg3>2=&WpQPM;ypGp>|K#rWj>M&XlDT@s;{SQRWTwet?Fr8wGRB_n2f$W zXDjO99n~Rf|ubn+~MdMe4KJb);Ch>8!D^jcxOIjvTTk4 z!7y?;C4qX}u7l~|-JJ-VgR8RhfNWdvPLs_6L<_;yfou*Qq1R+(^9Ut$ zeO`7yH-Bw@_BAfOt~fj2rPr5c4|eGd71={wdSg{~kxOr?$sXy_ch%Y68i0Os7T{$k z4k)&_{)A{s+jrUCx)zVTO7HBpy)zg5*QmeS_Ria7KXOhLb0o%~o*n&4zF7S{uh*8}~T)!R6g~4YYw{pIG>! zTF89{gjhN4wIc5d8(As%);YSz_f-8jMRV;Y$ZhMTENlYk zBb4>8KcgA>ZU(GKIi9IGAMM7r8+CGnv|H9pJ+rF6S)9G=;l(9b-q)fWH7fnszrww%5?NCOR>4Eet__mvgf-?GG(m2 zRAshy8xXf#^;ODkZl@ei6Hkha_1kvYZs*uboIF?ub(>Xpcb-?5BaAIzE)Mt_My^P% zg-Vg3v)nM2h>&44eIjVsEDz5h)G1G6Z1_%(oV|Ehc=n>cnh@TOB$huTe4_8A4>?lU z1DpopFM5E+^N{EEDNJB6pcOFEcQOcf77XNC_ETpNzk^(s&7aD$SwPQop&?C(fIt)c^%pcF-_39v zS>$G%RE-ihqe(MLZHBMD*xD?2`FzVqT^@bF%Bx%+VIyDd@&Pl7Up!6s8CDE*)BiEF zHS}kD7%M}D-5gF~>^loe*urMJIrPUPjQqv`@Nxi}1pWt>--}X%wuAo(`LnV)V6o5p z9@*ENGQ8b1_%g%?VAOYB%nkl#roP;{D0|D`?j6y+aK(2)iVrRY&)1_qD<67_wyyVa z%3sIzq7-#qW##0mfnjHSgMB$YV_(oS*1Y658u|n}+lO)(2aetG;5VQg z5A^mGHgne__mJdbVibrjV*VI%(RE|)pGKH3)$w9R;G-KPH`1Un_#uM_f3 zT36gVy@Z_fl=0a=0P-}JGQnj37&K2SDK`bOPrCUN!)EkFFe&oZlbGoDFHo|#y`<#E z;nZ)nR6ug{-%uv}wj9kDz!j@Rc|SW{v*B~Ni=D0s1v!=X9|&2>YU^%c2^ilLQFMll zvkV;=M%N)=;bHQ&-xMEDCPfpeGu79TwEQ&7G~YF#O&Z&l)){0;1h-14IoCVaPXY$# z^A_NAwSRP5FpWd)E~$0U0~nq%8}9PSZ1^U4apW!^9T}XGrNjMh(I0#Syf}BSkD(p> zOYq|0JwCcHvI$W*1;V%0*D3c+7~>C8<^6`Yi@0?!h5kDv?ga5S5T;;8S9@IPb0>&0 zux;kSU_=iz%}31D3uvfS}z$SYVo#JD^(i)@C-?9rJPu6Qhv59?rBhy2mC zh*gKE^y~`A`Z2iuq*K!v*U=ow9cD-_R~Pk2F{GVH?uEG<&pQnI z2oe^1Swk)W-HV-a28ns;2rt(H&Ug1Z0D|SJkyr1@r!Mn$BJJ|zmqE7zDatZPHAn}M z+>5qKp#LFK6Pn^)TtAN?H6a~Gx{P!M$v}_Y?!D5LX?F7!8x>hMuM!IqQ<8l3!K=pBc#?6j`zY-zpnfSG#)6@>MG%!$%Yr6%LQ&uUN6}j-hp{SADv6 zNqwZac=-Rr+`GV6QC;oBGiS~@~-!~rAxM1$$Ig78FC4UGGL9-}mR-&L;?FG%Uf@aNKx}dSX)_yJ- z3N*}_yI{Z-!{_*4o5kmJn`IcaLIh9anY5|#rRVIM?RIy zs?5isKrU9-^L9l(7*{CS1w-A+yLW<9%8IH3+oqMRy((Wjhp0*cP_47yzmmINzOr0Xn12S zS_vBtlEOiA@sfsyOP!0G8yXv(i{~{iS`zPl zS}IAl6S6E7@)#fBc)}%WB0?ib>7@%XSszuMQ=Y-*0VkQ<5#FJ5Hfr+U%%P z*epTUHtv+r*mKzy-Mdh>3*$x0z(zI>|SM){macy5xf9arwbD9@i z(J<(YfkOrk9XM>zlBLaU%Br< zZ2RkbhZ}|eFCtX4Svog667|1mB<4k9WAjx__?Gp2+6|KvAGOAlA-QBD4Ld=z1u${u zOQOHdFKu4Xs7Vc)$JN;+EorV_un18MBqtn_j|1U{-G4f6B$AOE%0h?5Q&+og6MYL(KV6WHIa<5k*?z+>3I4a^&Yu?Wu!~g`?Ujx=$^0_$%%RgoR#5F zWTZE@GIE0Vlj|!Z8D7>(JaKK_10Iz!zGEpX6Q#_fl)Yb7iW~L5<$f6T-nnj%(Q9Rb zUQzG2*HuEfjHvgTvoh-KxPDJ00&b^rbu?`xSXV~|ME7{Np;hTo?{7}!3O14?xIT71 zjHG+rDkHHqQSbfhRz^B|x4V^$g|HX}O!q2Gmzm+Er|pQOUl{4-byflsJH664_WUg?#jpsdn1`B(>Yod ziA+f9sUM)aqKuEB@k;O2>sER{az9k8jC7BtjbamChPvtABW`6B4aElpy_aAh80(ib z)?t^SkvoeNZ&pJ0)#o)O#NF`6k2YhOo>v)Z2$rMN#iBG(uEr z&@wW1P}VFh`=RyaR69Nbma?C}~H$HjbD3FfZP8KSV{%-im9H(Bf4_KlEA{ zT_MpgmLs~-TZ!5BZ$?)!6%}}&El)cV_104t@6<}F>iy0%1NzB`co$aGd5m6p7LD`v zE|+$1hdl4V@;yo2^b2%Tdd7(uL?>WIa2<-kc-^BH{wFY66^bPc>w~C`OJ1nNjpU8T zcwQOl%C7QmMKex_ddJwEp<;aLH|niJQo8p~G!_}1q5MCusl*go7hWkbtgIWuD8ky**pM^2Tp1x*JlDR$$%XOv(Rqec{(%T=d z1fn+?L;v7G9%Qo(-m6H+L8oDz!(7|Jw5azxBxZdQ$wBgyH;{L$6h4Av2XUJB2&~B% z^!fnF7~&stlIJ4oHC9G48AHK;UHu_v`OOht2)s(HAl@(*uR(3F2n0wjta0q>(geDjGe3du!H>4dpI#Xm zJ)GUhf7WmI>CSgR$9%fKb2aD}{R#&;e*n#23r*SgY+-~!G z2Xa~e=}C0|B${__@!+*<&(L@#VxBWRiKeCF!Sla>VbVPL5h<8|p5p~f!u!DI)xP8+ zU55wHHjr*jqH!DM2j-7XD$kc|Y+ye9wc9}Yw@Li_lIZu7=yQ_lTdDoe`?ws~e}Kww zg6tfpw?D->zH(r(kL}n6=Ai%IQ~uSG-_3bY>*IZ04*Khe*2l-RIrwt>`52!JZ9;c) z&cgU);QeO~#>Y)UAz$c04nNw)P>mx8T;PYf1V2lIlM>iJq5KUso#}Ncl69_#aEk4^$`o=OpQq6JVgcJJenjLz+LN z*g(20iGOlZ{#{A=*Cxs1y3*Z#LZH-0?gu9i^@tWsHa`Opiy^0Au=%-wbUo?u=4Xh4 zDdwk#f-#s6OdpGK#47w;LBxW_HM7okrmY7HBiF?OEE`NBU%6tnBGxT%D(@eY&KY0?NH-FA3m}Gv&D5!)jsTcGwBtn1w48rnNMCjkB>HJBB z?cf^UPX9vlmVLoE^IH|Mob^x%2HVb_nh(24u<5NbN-d37_JXL|%zvnc_&r3PrFAAG?(G zOFsY`L3f{t6GN$iey5q2Aq&u%%}6SkVSa8a_?r21y#id0-eWp1OSI=S9fxP5oYG^7 z=)dVi@X0(webPTrqE-3!5z%h;6WjYD(91RR%{$5Hh^8Rn1c3WlLR(q%f|zM&FHC*F&w1rxbCXNVM<#={&*?f3 zu-=HBQ8~KIDS+I1BL0r3Md__d%lL+Uo+XX;z6fM{Ujljs=67uGWMf~_2bkW~=;@sT zg2C2b%x8zV#$ernDFiQ8{I25bik~a?LOaMWztsb2f70~%M0`&%2jiOb0L96QS1E2& z+@ts##VE!x%k@;`^(BP$>;}b06#1GI)BmkF1`Q#7nc^LaKT$kPEX42FxV{j%&mhVl z8~|TbdIYZ5O#g-=9tR6e-v>`x zSeD`EpZ&62qvATn?AH&6%PeidQLaQ+!BHA-TX}NBJ9;Q)EIwQl> z+nI>`u1e!C?}e7@VL!|>rO(p*bCkY_2zfQc-j4GPP5&mbpW`f4`f8=GQ~E}wZ&CU# zrSDbxL8Tv3dXLgSRr9I;zDLq~3SxWQIPbg3JACP~IrprDA={G5Tr{cZDB3u`UC64nL5q!@pzDh*? zo5T{wc}vsXY{Q3N(j`Anu}ISgC=OGsP@G7Fyss-R)ASXJH!9w#`QK4|Uh#Fs_Y^-@ z%;EkBa(gKbQ9Ms^y5d5`>lHUDeoyg5#iNQY_fwGDMe%gS;fiAv=P6#Vc(>vcioa6i z$EGRopNc1N{{^~4ain6E;w;5R#pQ}OEB-+7NyS%)1K_hsF~a>E=$?va6HkLrK&2-T z(chDmo~QYZiq|UMqPR_Qr{X@v{fcdhA1HF;$ojI0(4z;j4_^CMdMFX~pQ-d{rN=2f zMd=wz&sS{L^kqt~R(ieCo0Z<8^aDz7S9+J?Q$*;qPw^#9e?#fC6HR`;;y}d;#X801 ziZ?56RotPtSMh-2+lrqmMsiUP?31V1L$SZ&aK#G6Wr|xAcPai%@nyx|E54=pq2j+4 zPr*IEj1R>=iUWwJ1j&OQ~DC6mneOu(yNqSr}UjftS7CS{;1+! z#s4Cr{#O+bD}JQNdw1sdP#mf_T5%E)_FSyEN^!H|R>keaV*G`m(my4lozE!!YsEJ; z{h-qCD;^`F{QoFs;28$X=M#}$tT;k(91(gka3331#CAbwEU$u?zJll`!9qnW6+%O_ zAWSG&s#vCoM>CQ>QgN(em14DGjpB60S&H+Cg}9C=HYqkMwkWPvT(5Yu;ua#5-KyBC z_<-Ve#T|;f756IcQ+!r&KN0=?n&JV)Hx%0xk0`#a_@3gYMBGn)uITXoi}qJcBVxat zrO4+|Y(Jkz5&63X_gw{wg+%O!iWG~9*pKje9I=#$_LnL0IWgD4k&5L+tUDEoV~J>= z+?N8YNf%?krI=5>2cmw}A6Y_|5YZ0lPvlE~q8-aLe>t%b^Gs>6e^2w=m-6;89qkai zf)=|%|6|H8c0)U)-N=`AqaD&N(9$lnV;1!UT}OoeElRH@LRq;_hW+LKn0EJ&4n3C; z3-KowVPH=@7a&5P?L_GDKCuYT6{A4Z8|s7u_3`g+SX+)>a{CVYK)&+ZfcJ{OtZI3&ICZTF?;QItQwKFL91WKxzsfD|c7IvT^8)V< zr&b`yffs$3pfQX1R}#K$lKxELOB)+}IXZQf?KqCpYcdS<73|c~5;!PnPIL3(1#_1| zZ=3^aY+pnF)&AgH{C0vRr+t;bQt$=xZv~nbGn3l< zEktT*K@N;xyxu$z^SF7=T;Nrg5sT&wJkuG-**$Os37qN&4jzsqat<8MG&v0(X48f- z4JYso$4t8p5uc@iFX>qC4fb*PzrMOCdErn~Z4Y;gJn20muV3$y) zXaSdR37_Gd%$KEk1k3ji#PP_=4;!(e!6n|Qz(IY;NBVUfkk_;l$WV@h=~ibe?-is4 z5-0@0%HwBbg8IcEZv^ryaNrS?FYo6@p08gi3`hOQ z!(in-og{B;K)-C|V>v$m59&7pbSo1ySb6=C9@K9-2Oxm; zkcYv_>y#vKUqC-Rg7D@2!SshePTL@WduAJ~yx%7E$9~Am2U7(O+^YNXer)9V`juiZ zQ9tr9Sb0B6lJ|B%zmt@Y<@lYl1p7fA`^^R`uM~Vi`+W*|EKmJ#Yw7EkX5{($HK~5& zVX*STN%EYj@$tu>!O2JYZ=rlpzh$6TBi#lo?-0_1`o#kB@VbgGZ;z4Z>-RZm)~5zs``H32lP8l`6%xJGv9puwnN^2w9N)9uQh4DwL#u`Fje5d?U=9M)kdDL-!d%r zVh0sy?|e8g=TinyvLp2c8n*kJQM zGwZHRcGeVO9nbSgU&cR@*4?IAj#Gy|VZ9@8*m@Tw$@|UMz-KE1pN(FcByax$JmWzc z<>7TJUmpIfQOcAejbZ57`0WHXuz~V;{6f+4<-h<~iu_>t-h>UT4$PcSLj{7(`#S0c zD~FN<@=-4vEFXU#w{hk@0KTn(1lon+ZbX9p#s`7>kk0m&;~*c$)vbsGiaX__9j7)> z(B|EgByS(&)uBA)orlB9tHU@&Q~c0+5yp#-HQI`NF&qu^>gNxfH*nFQLK8|A2_|mN z!^+AeXUK@5!%VC$3;aOCH>FnypP1#X2c0_jn=G}y7R3j62K>q&`d|h9O2hYP>Doi| zYZ`Un&l5f=!zf38-|*2bzHH;XsA~s&xvNjr9UHeDjg`YcE$gZ_ezM&b__W+eACuoc zO24Y`=V*Lnq8|E}WjztdpG6;|rS$&{U&4sfUu`GL3t5;&hq2_t&$jhJTzwe*kkL|| zdH9Rk35PMZ-l30V`qC8tnJ5$IMcwL8GJ;)S(3j|DF{SY#YJJhN{BrdpyIygJ;(o<8 z#Zf01zq6H!wBH-f>Z38=$M^OY`uG-|(1sQ_^F;XdJ~8OSn{5mF!fjJuxXH4u?T)8g zJAb$E$z6bP5MBXap0G(;3;SZr(R{J<9k6rtVXV0s6?OL4K8&BV;EVpAqp{Krhm4QnF>UxoxXp7myiNX~PuotG7yaruE5LUn z5WYz<4q6o|IWmN1p(j0e8$eO^WmuYPfvq=mNyyugrG0yi1h``@raKd zA9V`PYm56Q6~CwO0esI<>Sb*qXnhQRV#gZa$m^AscA))~&GMZ8EWaH2%LDvWa_6n9 z#ov1_Y{&IvI&@??tbG|Ht2vg|9vabtv9yz8>06>V#}ekGtSd723lrBN>X^%Q=+>XS zZTryD>o=}Fl)N_4H?G*WCB8OMhxfnu0)CL`vl!zQJQ<~}2V2rM&=2&xR-Uxs;c!b6 z{7n3pX((YJNz*QeR9QxDrYIs&%BULa#S z?8kOtKa!D)^_BBeY*}d5(|XvuZlm>KPrtrv5A6u7;j}g9pk2TBSHqTQCuQOqi8&Wv zQ!|l{wbY-ZGA57~=czfIi+nrQI$`{=47OJ{Qco9tg*!R1!>v7A54QGP5n~^~Rfh3_ zUU(PgV)bF%!*`7Z<_^~NcPNAF(g>t;Ooy>fj||M&AU}2g2)?5WU1QLl4|i^{K315* zYcOQkOLoUTnFAU)8hrEBT+(ol_nP=!xWenFVLkjI)GbfqbN37!WEXI)zXt z(MdQJ0$Z%Oe|?Rpyp zWUCFsrXk7-;kbyY3|1q?nXO#;h;}?N4dXUG+)i>iX24ie14j61ZV3&!$252);oF!NV_kr4v z11*wtoNU&!h`%IRw5kM~H4@ZV9H@ps^)TPF01_-)87St#>6gif3uo3W97b)%>T#s# zXELsqtakI^I9ZK;sfjGSIkkYV#>K+BaG-^`MA`+4wgKKYQJf{%cJBjq1P4mQh{tfG zFfdZ>=#C+}Ubxz=733De&nKM&=rJP5}iq)W=JKNvNI8r zU@c0b6bIHnf+;IkbyIdyyllG`v23xFolG!gzaFo5a=a`bcS^AJW`UwjjWx))*{2wL z07r^pYKy@NapCRER)oS74hPe5uIWgSU{xpqH3A2!A+P|~16zV|BuTJEm_S3O^o_|{ zt8kbmF=lkAMofa0V%6hLjkRsXk!sgw`7m-VTZ&6woJ$%@VJY0O$GOCChU++n`~R!P zCT)L;E6{PWP)J97bs3_xPU;N>8QE!=1O#0Yn95)~gz;P)m;?mF#mqv(vdcI|drl*PV+f9oUiUMX841TrL8g#w&yLC!Yii;rm5yc&mT7-MF} z*X%@eAC44v7%aoAR7(-_T5zN=g)Nq12FJ77tu+5}f%VXCxoFsK%bp@DmDkrWoP=6$ zs$Q|(CVMju=<5o&75DfbRs~=PQVq@AEanzkfQeKUnJm6@U0h2d5{UY!rZ$lLM`w z*H(NS%=mZB_x+HH1K7CVSL@BSTily#LBN}9_n;G0!7&Sro-|6NZi5e;GiGaA#r6mcG#vfQmA9b zRT&K!7c{gC4tL|^Fu%h@yWxpWY)5n#kG0~iSMr@lPv#22z-60TO?$cVpCBPUv`QG3 z;ai;uUN(|kkKe-$dFSHndDC$Ydza%J@ovPKpWwsf@OI;z=KVL$=^mYvW_Y0x-azuY z;hg1_;hgP+--FCfVN*wFxW~VDc0B%-Gn@mPiZ^?UC2>6yy&vL?uZKpN_X6TxfBcl8 zk49!cig@_UD%Q)y7M#Op4rb}}mvIh{WtN-qSBX!iN_Tlk9>=$WGPX+e?~LBdXyqr2 z@@o#%@Nd=!_(jpJNJNL}^)nV04BPeh1u}39?yOinh*iwVaqD6igP@t*6W#jQr6Bmh755}}e(Z8foa{EnmVsa!-8{D` zc0CB1!OeG@V=F*NJ*T+KoM<2Le9Wx%(J_D$WJaFvLdc5j%gF-LCJ}hZ?X2Y@@Q@or zycz6~XVaW)e)$65(8Q}iNR2!q9hrluw>)|mQY#R3pXfp;a(|q24p2<y@C#L2-gwsGAr|=^MXX5C}oxv=Wbh?EwZ;KHr z5Vtf1#sg@9@c>!?cUK>|lbvo=U?MvbLd`hS2N+o441~q5K>6Rj|lpk7x7Ufm1~~ zzgBW8)6(-03pY`iPS+-xuB<+Md3?Gq?t*3BOyb4e7?qj3BtCPS*$Ojrm&(lL#0xLu zI53m=O4eZ}@j55_WXL#G21y}f97xjl`yj=g{Xe`qcBOi`h+K$BE+dyC!oTOs`wk-g z5b5D^x52?;)+{k8#TD1!^xNXCv|gBYf}i73RN* zQ!nRjoO{Eo(MP~jUPU#0@2hJ%bld`gPPZZW4YLdp_HHw1_I#bvSDN0&nVyI^3dm88 z5dS6SWoLC4KXbCie!t!@jD+8XC_iq3>!DNpwiGB}Jnj~~TdDQY;-gY`a zBq98Z!|v%%+5$`P_gs`}-MK)mv5?F-eg)*A=D@U14Xw!s|HUaCY z6sfQY+hLBPchMYoRw$R#(diq)Xo>8X3GSqy2qOFp4Wixf47(xYbSD3tS1B_)o+F2u z0=)TfXKzQt^1cl_>|*2@M4m>Z@Lx0#7-BfW2eR|tMMf01$%`Vj3nHiVM5KV$>UImx zjHr2Z(Zbl_w>R9Gffb|=xSZ2QQ>XV;&G%)r^kYU14tMtNSaZ7DpB_i0Z_-_MPRVys zMKL%^aD;R4HQejK@FUhcfPEIW8#Jnm#OWylLmsWYQRHcxf&%~M@`HLl~8)-1tu;!E&cxsaRzIdXk-XTQrX zn=AG9|F-S6xzcU@p9U>$ohxna{{iz^`#fo5f7~ZH($0CJYniucpCfIpm$rg_){*u$ zNPCAm(%?&^vXV{c3QoHNIKs_tb`N*Ty-4c$AWnH~_YEkpjS@e7hX?BWEgh{9A4ouZWq+ReL_#!Bk-HH+#~dGXUGm= zJZOK1z)^-B0t#?{&{OsX{8$V31}Gpq1FrJi8T2ySf^?Anw%}%zLXeHYEJWlAk276) znKd5+5bM9WHjvxy3YaR}h+1>X)f`>a(c<7D&Pou9ICD*{}yP2eEQP2wMthn9w4HRDfa#jBj- zX0>{itCf?@OUIyo6qz=Cxv`nt8QhxY$(6X}L<5JlY zE~4eA1ywlV@5?CRa@xb4=r5*z_5ltFE~Utog_I7ZWg&G+_M;H{T1MLsWjymc9=H(w zMPTa30H<4jyyL5v4){c~>#eNAW0CKV3$Qi&v>hE75j)T&-N(Xe?n={JW5Ah9TjrYX z?1NI>FD663KzGXiFV2;|f_5K71L#^_x(0Hb>>F`DRl1KK8-nL`>1VV0{ls+NL(KT8 z`zvskKF|2mZZ4k2m=)}2QozZ6g>rt2Q|H4tJpwlOarXq`4tJ*;vzrGO&Vplh_uxM2 zE|1ymgS*RJ??i8ePQOH<(AQ)%Yz67g?#|Kh8#5X{MF+@e_>CD2eUT>$zAg&(p9xx& z{H-WCoOhuz8h$6`M_dN&*e^(S!hdqpWjL^ZB;l}o5;{D2IQZG^hQqxmWroABTOoKX zg?`{>=e>aRtw_k@mx{JC(ih9sE<{e5iO4=g%%ylFB02;H&cOA%QRs%>5A8fhSoDQs+n|8vmY-=y`o#y5s?3*ZdmSD?b3Bw6QYr%?RzmKKU%-qM80 zT;9?{@ylC!D1Ld%2*odN*`fI5t+SLhgCiz!GqLwVGk5k-*dtsj$^CDEC8R4$LtIe$ z?*c7XpHfk!{|C(HL?0|F^e@5cEmxnxqDEP0(+Iiv3=vI0j+AT98KTVaQ}HNAEQwx`WhxJpG7C&moCled+lePrt_Ll=(<{6A`(@ zus^~@p)Prq&^&&Txe1iqh!!DYZbYGmf0^0HQn(R4fW-KPrU|@q6Z!~}`ZYxStIcMJL6ECW6(aUFl>SF~iQwI)IGvO`5pw(MiCm8Y_n>kq*`+eBmeRap zNoi+L8YWwKir7y_%oH!5k{#8Io>B!1TZfXhJpa?29-8=9>}l zJ+xd#zGpsKRA}xBt%&>2R7JEM-t?GXdmU)?CyQO9Q zmw=Wz_N25<_jgZ8Wy5a8{rPrw%yZ}%e#wbn>FK$hr(Hbl!zph((qCdE3lV;oKLTfYj?iXQ8vH3HOwDf#&abN;}=BV{k?8bh$r}XFyJOe!G|N{kA(KOKU;+QP;ctG97hWd8sCO5%O_u&GE)Y_J~^A` z6^ycO2DXENi#o$b19H`7bg$A)ik!hV{NL(c)%Xc&6 zs~$Qyg`($AnKX6ukfB2dpP8x&XxoJywXK7Up~Ko|NF`-uBLY=ajIEt8Wzyutl$x=l z$0ejy8^5&eOfTMQCy$*lsitgV$V%r5(TQGCDRjY-T7Fi=XXO_~zdr7<*YsavN|PCQk`?&eOkA?$1U?;; zlrt~>xvY3jg6fHr#kU9hKjDi*(*N{i3@4lkT)_{Xp-(%^^D{){d2<%l*2kxqq$PYh zOj2a1C8!%1a)|;1J)D>k?~lavfH@O00@h5-2pH431f%2sHZQ<2Y>xOkR!2U7xi2fU z8z><6XBC~{S9iVdSGS^bvH8u&vh5Qd_z6zo8#mW70jq`2_|^@kbFXK8`Ucav_en{pT(#)(MH^t zb|9zjd%RzlUG`V@{rgp%^#12P?Ear}BaHR837&OfBF<1q*i(>jDy=XbO!s`b?`a392ADe_EvA27Oi*9-cc_`KaQ1=q#Wx)+px^R052f7h2wkIk726%5Z9zEfXx3{;zc=SxFA?ketUOwT*HBfmHOOn-& zic?r`A|3a_EWdy^*sqD-*Qoa-;_%b>8eF^5CFu@hvDY1Xi2S=tm!;%@8_t*LNfsU^ zv*`MAC!D_`?Ny|~YjXOyNSE=FnH^n=wpT_@g8Ruz?+5VO3cruXLhR(5uT?*}zA^5C zL(vL&ne7Vqo^Y$WoW4Nsr~A&zNI%HQ^jcxbbg#`tFVj`(ps06?w=<> zlcx7H{4)3bC~^jx(gm^T`p6IyJzFX}3+{ZqF)KAO$=Hv=@n=qkH%Gk8dhf!&CT#rx zy^X#>x1GMNX`1)w*md7EE4_ViW9l%*RAc>@y|g2dtaTVBd1=i_b^HZ&bm8o2j+}!& z=^7QMsdSY5-D^+^GX55ZAMr|TmKGEoha}x2a^Od3Xw`+ zWuz?XeJ4^G89NRd`~mJ$&xOlW6cYmd6`W{LeFaLSdzf|-gS<7IYIf2g3vOI*5C^9R zt|sSph(0+wK2nIZg33rC(%=Ic&R^53*i)|x(~rOuqhsDzj0e%@;KS6o6V1XHL?$@* z!;L6CeA}x+9Qh-l4fG@0f(KFY;EDgCI30EP-MV<_>@5Nz+K6U>3&Irx1b5IhIZGy}mCFF)}F&%D^-CwNYBefW@XAb9xU zIT$>rPmsjbrC$;~Fo_L$j{y!(#=a|+a`@HIwexd~BvmnT}yMOY@tEXPN#gI8T55 zL?`TKI;I2rweEDB7_6L=%=ju8VcJ+wVV=)YZXwu+xFv9yZtDZ9q?c62jV$-~;gbm&u{DD696-zCHJ;*2W*4Hn@;m4em4?nswl<>jkgV4wBKpnV=7mYYAI zDHw(Jz~F2*pL4fsH~tVp+H(%pJeGsLV!v}$9?Eg8Y*!A;khCBC93S1GbTi8Xw~&V2 zC0ISX=_^;zb0adS=T0K@lVJH^6wwFuQ!e%9+T5=G?)t_S`ehmUAW!6?-?x)S{kw=T z;-nt$ZL^uvlDDE^P4_)SE9UdZqjDGpN{r8rixT5*=*e8uY& zZ&2KyHiVrJ3rFb&evtD@BQn4Qq>*$$8*qMKSLcCD1Msc>{H;FyXevEwAX!>f! z4T|4V+@{F=7Wp3|qCWls3h{`d$Mq6=jaTG%97%s)@exJw_loovm3~$6kBWa$l=T;U zc%UhA@P~}(?#Utzuc01@y`o6 z`;~6f{P&4S|4ivHuX8AOl42jlVTxlE#SbF*7ASos5qhjvltllikZBgLSCL?U&Wz{<%$<7PF0+vco`A|E1WS`vTDCDvDo1*zr2jz#k|+rnpb>*NT5sd`IyU#T@P%a1kyb zLQXLe?I=-tgwi9G9;0w0J<1D2w zP`Xm-sY=gO`eLQOsr1!E$P+)(zz3CnR{35fVm!Q|^ijpXD*i(;!u=G=pQJcIakS!0 zBHD4e;&qBQDt=2*_G#dINa;O_&nt?5L*)Na>350P_kOIj+XXc2A$||R*G1`*h@iy} zBJxjDda&jXRk}iPvSO{~i(f>PUqTx8Sgz?eD&C_gei0%6C(8G{roX26rs7+Q9}yw% zGo{n90j2&qiro~86bC4tMMS$VP!zw2pl?+Aej@bUskm41Ma9wN6Q(IWj|lxQQF@8eS1P?q>2*rquJoNs z->>xdm3~y|CzO6x@iij){Y}mPSW)~kqW&!GfvAW0X9Qm_rH3k>qc}#fh6uh{N-t7e zrno}!M#Z}ow-eF+U5d{tzODGFB0e%9e5Wc7R6IxVBE_#0Vdu*fuUEWV5w{z%U&VG( z5ZeJkEcb%A)XQ}QLs_s;u}HC0u}pD<;z-4@M65$qiq(oWigiQ?uUDL}*r>Qnak*lP z;%dc>iklU;C~j5UPJ}&oDDG6;rMOS=S;ZF>UsBw!_?lvy;t|ES72i|*K=GI&f8^zT zUs#dPn|Ob~mvM=F9>@JPpT`mT+?o5;0>wfi_JeZY2P`IyPT}(^BHvZzb-qlI&#!o0 zX-BcrB}C|7rF1nB`Zp`R zjEHvJtn@}A^nXBU=@$s!tMoo1+97uBjhCxQLw~UsXt5Xcm-d5}_CqPrAGFoKiF$)> zR{ix<0?+&z& z|27O?4hp{Z<7e+>+^?C>~FGR2POCBP1|_%GiDs!#3XFJ5>17i4W-@)QofxyL!GZ>}zGh`-P$ zQ&-+UO?WMjk|aU&I^H;lb0s)qlx~u|pn(z{{jqNU1x)|-%rC7m>E%Y@Z(ny3mo-tm zz4Eeb(CmxUo8a+U8-Ja0UB;&u=pl`Ru?NT9|?H${PCo0Z2unhWZ;9eJ$Bw%^LjPLek= zAdmc3-gAfq_1lTOeK>5e@_vR$P`@h38v!P^7mt*DdHm8&P(SW-SRZ*9th`N0@>U1* z%Thj;>w@z5@3(Im2=3u*u=4m+4q^8So? zP~K|+{bI_;a!+F)1`)n~`$1rP<_9Z}&;Nt+jzAvEkHUdlXJ5Z9MxL+V+o~UV7_2=0 z-Vl`cUO+!=AANb_P#~z^2Ow%hk~vvld?gZ3dG%Y6!cg8K10ZTU>lVC5Y{T2Q|#$SVcUC>+@S`tp7WKK%FftH(TL zJ>+4q@?J=iw>+R9w$Hvi{tg6IzkeGcZzBb1u<~e!pnf+)UNLw^;o$b$wzr#+=j->m z>PH?1E04cV1?BAu=vSzGY}XHEvOs^1hxVFRL;>{)&~4<=!yz;{6M{iGnm(c?Xi@6+oWVuOE1=eh(XYzWpel z^^k|b%A+5=p#91M`thFC%A0BW!`JT!%8f;u4OZUNr2eRYyy;+~{RZN&@&*`rzJ4Y6 z{fGLIhr!D0nf>(DMT9O4aZ^S@poaCp{*Fko`K(<>mE?`#~l zy*DMv`v92_Vr~ui(dNzJsz3{FFH@(4iVWo#6ASl|Gt~r#_l8;G?NA;G?Mq{Ma=e zKK8{I8Ey;xNWo7P{6Tr}*A&`l{G@q1)*K?wdtZD}S+#TBA^3SZm)X{aC4!`xq z7ynhE{;1&p>JZaQ6bluLopp!kzmE2a!LL=pPS~J)!_iF0&FH@75d6y>y%$?S7k>1z zHo_;|#u7Syp^wq1+ObD}dZIq>%)kZ!mcM^3dH~#2?I)J~D zd~9bpAoBw7w?gN_*oH$7pl!kSV19IsK`;7#q#wTYKs_UnXXOQT#M^6)A4w+Yf0gTL(HRpH!BN2QAs}}r{gDJk;8s)T1{Ux z!rvRmJo}ygBiSz;`RcF?r!6M4Q)M*w@7GLCui*;^wZJSIjskaF|UeR%sMgV1T*KhG;NT% z87;)Pp-gLM)Ipo!-U(y!?xQ<4nen@QRDAqW9><_RKC}#eip{X{$-{oze)+be^tFif z_MMg%_)ffa0{Z06qb*&GA2`e(cg~;SBk@+_LyvWG9-xo>d0=HZTF+7V|Ep@b=@8R7 zhVA%3nMz4Rn=lqkx|TVBGSS$&Hs-UC zT`R2bz3GQ>t;pC7n@5lipLs`Puq)T5T@L!m+4ko`%=4l`t`+bp2tKYU9DBZxOw{=p z#!VUQZ|5ZIW8Bt9-R8$&H>AZ1vA)G_Z42t#8GV!6g!KzLR3z0)|BK0WQ@>#SWv~I| z-3~o?zp)czb{39u91ozQ7#=>iumwEtFiwB7!8m;z*5lf;@e#DS9AmQ;W3$PO&CH$j zKYI7kI_LqvqEb(d;#kFzilvI!F&uSPnz0eRY%Ip5xhCOfiHsWNVLW0>ma)DLV+M0P z3cH9skk0k5YUAodOtWhRuQOOHexFt+zD>WP4$v8W2e%a%d#!GL;JSBnihBQy>sxZ2 zhj4A11%0`mam{aaryXp)ymbZJ->Fb_hE8k`$0K>y=~!Q4TEX#2& zX^`oUbLD>q{5PW=w6#A!HSa0p(e^d54Tr`Sn!d61?9x1zNtXE|psgxoWS)~>%15Fyp9)_u0E87dPkyOj?XZ73&X}|r_}-Dv8x?3Z09XXr_yOX@~Bgg zAM1m=0%LYL#AFKQuh6d_fTljESLSE6v*9nk-_UZ?w;33##jq927br>{I=;|$ z_eGAcb!N>QQ4YN@u5ZFzr(Ia?CiovNLmfB{6%?BFmg$^tv<>!AmCPFfn-(Kq@{o?( zoXT)@OPkG$K-XY7j61(vDeAN3pfmnVZgtz+h1ffluV|w`<@Ye|L(nJe%UH|#e)t8h z3((^^;0RqWc0M%Nzvgk@%027<=6YwZm!W;=7t}|4IHg!au-D5frJri-d!ZA3wH5)X zck-T>GU)3yhWhPw75;Yv`(pTI#ds(MPwqslU3C}>7!RRV)LD+PTg|a>$I%kl9s5uC zJ2ux$JI1OVuI(ERm6k%cCUY(EubZ$vhFwNWkMLo)yu1x_^qnH`7eiP2FQy+=TvIc; zmSdfpFaiB!`pn9fdcn)}2V=l34UCWc7U%+g)|Cd^*giYV`GK)&^EfVT-W!}B@Da;3 zir4B4 zec}K1?d9-;yuNVFA+7=8Qt;Io+u3}Xj}N*c&xI_GAJG-^IG(wOqu=Z0v9)F_YdY5V zuJqBpzI{4|Y|UZn0DFln)=gcY<6%FJig)gOu!VKd2RG_Wc}+X7YTQK?<1QLgcs@SN zGkSVWg6}2XZ=+)fxi~s@<-|KYFcNrQ{bh_3gN&&iU>b>&f{c@RuP?#+-63HZCkGiP zr)1>aE_5VROLSTdU_SP-@K=PGgrH>H5+G|Lx#~@nU<%kRZ-Ti@fk`aTECnVJUXthx z!fQC_jHw7ShTlI=;hF~=^1A@sDN#-n4nzqo4DUcCC|4$BClM%y=5F6++<{0#;jw7M zHp-&rLLe@|Ha5WdfE(bnd!o4eq5x-Wkh2xTu|t_#gPdEB$GIiQx#f7An}eM3=PoH) zv@yuJv7O9fs9k~sBSTx@cj;av(CFe+j*&NTfbVUSpMPOVsemoQep1bEFv z32d<#Gtl(pYFLG_%8cYJ(xo_H1OjJU#|w>NoET(Gz0ep&ak6M7re0_ak_LB}e z$zwI>7(?_J4vdXY0qnvQ!vs0)0yBu?;st%ZBR<+MmRYWvZO=49eOjSihQxzW4 zm|zD#sazabx(H1Yts$@qG>~AXQw?h}#+ibc1S^J<^B9h>bM4m9Hp^%z!x>+i$h%y4 zyWDpDHpX`1Km&IJOs&&xt!AKdT2|oz&wK#a21MTgw3%o=8fY||4jB@XHN$$k+p~%Z zaU9NFLC#&6fhMGoxiiSQ^LU&)f}A^!$GJVoxxF1{6_lZ=;Es^(SuQ5c`t}_$)5^UMcpx7tI`izy%969S16Z080zM+P}Zwlf(ysj3-LI}m#f2Zk`^ zZ-(L~gRw2rjH$Z-#%ArtcA(mu-GG9;@|loA!SzAT_3b#>G2Atx<5Y&fy(j>42exHa zIS!*eV@){FECL%N(<9KTWZ9J4Dn*XdZ`JI+Rvg&>J^-lexIm$BO(ZOn=u{RcmjY9{ zwJ~MenG{Sq3@33knzB<^mXjof(@Lc3Fr1u^Xp?Z!h!U**OF%Kp*oU!J9M~LFGRFg= zHPDKhAv()fFr_4x#W+0XS|bR7L4#fwC84WUA!)f7mxf#EpT+Y1r< zj2Oa56u=&&j94XwC)%;WWN=8ZcG?H(4IK1qN;E@47VTUqJ%z(~gb_qwm!dntD#6Mj z!4Uyn39P5%eW78T7-USnFEoskf{dy6g@$o*kTLbXkcvS^!pP(57!yYRMZMnLw(E1` z==ER{xe9T(&MbndWHMqBf;K8d3RY`^t-rmZ|7&rOCLvf;E>h4^LIIABd&4kJ3^Jzf z4Z|p2psmEzyv(u_ zEz@ncscdGvvUV3r@XD)C=qp~5s-$eYbv%$oj%FN~WW~hwQeq;j;6!3F(X_1^sS<35 zQP6Z8W|3fQJ`Qvrp;4mJ(k7Ei;ie5WFCu!tq#gkrGf|o$KeZ`}!NIavL-)&vN-YljM?rB6Ti=R3pg%0hc1odd&U?!H55JQY4Q=zf^ahkK~b(tyICYwDhH z*VMgy5qN;yJLr?T$aldkKB-Uh^B}s9pO;C0)u&sZ)Wyapb>E<>zGG(FTPC4@TwRk; zlH3y!`ryU~dlG#i56r{}F}Ua5CEI(n=D6vp2K~r?9&W--JZ)_<VAEyg+G@z2%p$w-_# zc~9b;=IzHh-FpY;49~+&UZz)obCx$0XSip6A2NOS%;$LHk?MG}ady2%oI@U8$n(4# zaSnU*+#2!ts4(jN6z5JJ9}=c{hj31Z&*tBtaQGiga-#<+m1_P% zb{2oTlRCrm3f=BHcuxaY4+w?3Oe+34^^W}tiK6%CR6F)>kfQegQ0o}Kzav^3@=B1R z^uMWd>?g39DE)8h9J?K)DE)8h99sZVl>UM`$Ib;QN`FC}Gfx6J54Q9iX;LQtQgIq- z*JXZ}VT^~|Goe%ty(gYPI_lmJ$vN?ugt zVG>|ML+`S5iJ|vey3om{$D|l)qS&P(_DV?EfmGg%v6?F-uNh}L@pZD_MP8kjU}|*; z`ejqkW-URw6K2zPq3H&aTrArgsV^xPX*TLef-I(<1unLpHL?b)8S|(wpIXK>+f?Xe zPelnn7iKDJqq}J*dofb^69eU#RMSGrVF^B`GObFigL(WBBA6O%eXEvB){Q>hcBja@ zO6%j2M484OJi`eW`h*sJJ1Ngt6jKLWY?G5sSD_V#HeJmRx>YFyyP7mV2E_stOL~^2 z3voS;fbdqzaCf_$YKTv`-i5n@h=jZMLA)2D?)p=QGy5=?54VS`9f#*)O!jD#WUd=M zWK}rARiTHh2uHXg6w0)Di{%RWVLtEAlKKgwZ!_9c=F*2w^b&~c#Bb*H;)j%81_NBy z_a@S1ebEJoP&c})FB%7e%K%;07hPuwxU4T~u>@S!7p(-r#lwZm`l78i2QKT2?ghcx z>9W4)0ZYJTebIv;R-p}aSzpAb%YPsnT-F!;7{mu8;Ih8x2}{6bebG-rZ~>#s`l9DR zM9_hBSzq)52&soI>$_K@G{1@(e*QEI<@6hbWQ_G<`E5N)W&2-1&i%!6nIDz1)5z2k7UAnDoO#8!@nlrkfM_QUkm#L= z8MT>Hyq~94I5~Y6QOH40guKC`tg={iJ;<0ZPGyR?w~*6`TJ^n&TJ<%>rFtnTjp!@> z<35%dV^rgC*J__&xlyLwQqE|@Kc^2r97qm``xEp2kUEdP*Wma~T9K?qCytoMQ>xgn z8}i`a+}OGQ5OV&`m>3r{^BbZ&`)Rb+8z90n`FH;^qX&d!7xNTo*$xZ{$u8yyXxR@8 zG&KKCP&NbuLkYW>K_ME$-^C0Hao}?ob1Tp*4PBFuMT=M1Qm|o7qNhQuet?Ns_yF;3 zO9?fVUw>!6PEEI){njwlEShdN`>jhri>5y?`>j_%i>6BRi`t^;gR)F(D)pdj zxH7kbmZj=Jm%3&y#z~a@p-W{m$AXsq$_}$%ITf_*SAG=OuRLV;D_cXWxn=mVJKF4D zwzxNwe$=fd4LfjY@gA4`OYUl@COe}?+*!!Z2ra8OTfUYDA!Q*(Pf7S7}u46tMF1Vcrp=H7}@7kbd8tgH|}*_$|&dL}c4B z9TB%X}Jr0}B2jQ%QdnpRSlO4%to2?-3t5i_<1PlpbF-5r9 z=kLxG5f@BT)NAS{Sbfm>7$BjWA4h$~H=+(F`V^v__+8Y}*~sd@2&d@k;#ZL1M1PC( zX{TZU)JJFZS&N)Om4`aFvG2FAaU)#n$8a|MdlR`odmIUS*Py^s1ZKdtfR8@ z#;+9p_^ICLZLYD%Ao@6uzApr1yz2S)4q7iOy-Bk7v&6X?m=gU^d9szNA5CbhvcTy z+w`LIBKYytL1;KxemQ|G{dEGFB{#6&2yx$(I}us0F}qfJJog&J4+QA%A}&{eS<+Cm z!ao+`Iw<#;b% zYzm{JZ<1NM=UR2k*xQ3#X4O6RDbja|t(&###Q#7{;O7$K8!3JC=h8<<>m>Sx zpM&_wH;w;gh<&<@0l)J1&@bKSMPYP0H&TI@g#Pq*NdKQQE@1uxTFO-yyx8gWT)>am8324n?hH9R9tG!^37GypQQ`n2~4$!rwGumN2XV zbBaiRT%;Lx3Bpo?<9^m)SQueBJ9|?G@?ozazbp~ol9AkuOn)#V6V@rBpm*#*R3bVu z!J^&BDLVM0NN$FbGXh+0o!Nk*_QCTwT;TLT2!~N+9XBHqo|29`;2C;91i6Qvufy|M zcqZZG=*z%jeya4F^ps+{{a1RH!}9}pOrNiUhh~D3WK4)@nC8ccs7b@J)X^gtuD<36 zZaD!GcHg9uaLL7Rn+=yZ!;hb7e(ixas1{rzR#|1zjtMR7x=gIJ+NOoi;yJIeW1jfH zg41aqMOvw(xniC1e}<_H`J}7`hJnItFKNO~9!+mNKf*lZ5>L8p_{NtpX_hC6OBQp! zOda{I?*h}I4?}rBrsqH4`4v4U;OVF5g419e@SKG+;=dX!9SW;Mxavv1zYgV> zgC**Eiut|dQX1m9vSaj(6e~VAKr0?8790t1zcW&-_q+g?H6z7x&kN9UM~c;s31s@* zm;fzyq*&|u0WLd6ilvqYxaM&3CV<;HpTM76kv;$FF|*-qgxB{kzVnIueVx8i&f+}p z@!^LeO1b)BXY_r`x2cr#HRnv<0biSQ&USEo5F!5+upoO3-@uL;mHG_38oH7yMWsr^ z_#uC(N`+Kq7=O53s#77=8TJ!|rAn1jC9GB=(hn=8RtT1gQYMH}&SXoWvQ7jpFeNbj zEMJ^$hK49*lbz+8Ck@80)3U*ao)dN)ZLtVjY_h}ln(VN(Omoo!(#^$86JKw5`-|x~bu}5SALwkaScjEH#`V$;011 z+f*qnM9xjP$WkW5;8!TiHAa?~tt{6VS%!~PS>i^PD-af0;zpL+5EfbHn)KRHI_%Ar zbTh2Y3&?`Y|3I+}Yl{Q41?)ZxWmq%8q7*pEaK1p=t>`s`WtgiK$%;M&&N9R=63#`B zA^b9G5m+cCn_+NUfFp{GPTCGA)P$#+c9H3=?L*jcN!V;pF}-3?!O&7_hNX5(i@Y4B z9fzW z2+M)+0|6eo4!aQd6Q#F*T6+7iIS5OS|Frb@qGp7pDRv3J;Z3k%+WSBYbB5oA_?X0F z#lcjpv7pw#`Zk=z&JCn}iRsr6n{>n?=5X)t>On|LVmimlbxg#OI0L;5-3 zf*#-m9tq%nPVGM-${BtO-fw55x4QQuzD(lh1~#0KWfw|dXvBGIdFIK zI2JS7JWz2x>x3bV^_arq3z>8Y|8UpnyZ!|A_3Z$*vZASPi>9j1gL;^*6-FVOSjY-n z2*>q2T4~-VK>4wcL#g?vso;c)f$Sk*7ao`M+yc_Um$W3JXeG>cfZeavxfxON1 zaW;`NsmFou!trrC_r)=q*Hi;?*OT6A4RayOi(>P#$So!>F8FwHRN!U#KrwQ0B;+;A zfIKxquP6*?`7!RAS=Y>ul#Pw7XsTaxV`M{P^SV`Q*F-8R$3@3gM9P|)Hmtrl(Y*GP zjVoFrRaF(0)hlk89E~4r%+tbk{E)r$K1iS?7B^^KJ)#yT@E8Gp;# z=9|XjXUr(yn30N&9tEB^3EzM@Nv@%+W{}s`t z%h#`JYLH(j=Z6^~LSy~%RTpoVT<@fR_nki}f7SGvHMMi*FPk|dzN{v`?CNW-p6QL7 zkF<&@mGdfcB~(^c4U#Z%QtpHa)q~`iSXq&sV|u(Y7o+L%oNT7YCsyPTbjE^t3ujhN zoLDg>R~1mVD+jCFAPEyEWhY1>RaMpLBCe_#s7{2hs;P7*UsY2zFgVd2oIh(?Ml57T z7~1wwKs%loD8>^5ow#G>T@jyoRZYdDXvPv&z_8L^+7+X-A4R2&@W-^Xzq*OYhQ{Vq z8yc746Qlg$cn2|YXPvVKzngwrhwd)t} zTbwn9ZvDDO<5|(vSic5jws1ssoYTk4lLWj^OhCa9_?*U~diKKr?R)fx;BX*n3bZsn>QT9##6QR3Dw&&tp8 zkTxK1eM5FRtJZ8_`DwaLU2}h4HZ5ZV>VCsod~(ZuA8~6_S*Q&Wy>6B zvayk5>p|D-G_GlBUYocTU(a3Rz+f6yt!Tl(PJOR}#@DQ9v>DLSjm;bCo17b#X&xt$ z_Svds#8olU%AvAzesMdKWq{T)(IPI5GrN%W37B;wgv}^S4TkNN%VwBtzk+Of@w!zv zuBmTX-;D0Kc3J(pH5E=XdgqPKI%sC4|Daj4Xn%CTjHsW8)ScK)5 zwB0hLBi+@a2<9`z^6g;DK%&u4b4xd%1v4B5d_SFrFd%|-SrN+Le3#i>xJ~ek9{Bzl z2C5s^m`|aJcaZkCl*<}mH5n6N@O|W1hOU*?rpb-9(5f45RaPc&3Pzr${{WPfH=_ww zLk7Bx6`d;a6y@L}&QPj{wTw-<8(B0z&$-FL?1CY~N!$b@1L?As=2eaB;HN|yXkKT= zD;=JU!n9vXikRoJ<@gMEgE3h3yLe<+!;&SF%w-x-dQ7fn2&1{1IB8(vysW8yd1I3! zQ}{Xzq#K;|70&ufCn2r^V_<_r75wika;Htf^0}UCOUE}J-WgakPjT`JhD^)%4aF}b zo#qSsM*2qui+pF`#Io3Twr{lm!@e=T3w^QyTJ6u9sIo?lf+S()qCSEwu#$xlzhlcHF#CVoAA?su>Z!-?z=bHP9NY8G!=a zWh4fs56}(ul+%E>VWY-unilG#oCqF z)2(Z`X*{M_tb@l-7*{!N;WsfiQdI)q^7>BWO4V&;}{*Udt>a_TdYc);2T z$-X(TCEyE%3QiCC0tIjR(eZqlq|YL0ctK$36QNL^zigC0e?aOMzb|xQfxmQgC=~b; zzigNnII-!8kS{Ng47`OucRUfAm>0O$KRYxuZ+761cWlWE?DWsh3%q&96ZGKKfH&`$ z9U7bVZwZx)f9MlP*n%PhpC|7=t#Z(H75p>SSnXz0I&N&>s@d;j@y7uJ5O z)E-{(O=Ki}_`w`^lXV8!WKXlfO1%yC2%7Vp0)P2gp);D&GC*P97ln=XSpE+~RO8v6*q1;Xf&z>40v)VrFKhZG)bt#B#RsMIF?J7PKTL1v z!n~`XLj;l38bF^2^!lC<^?%`Z$n+PGjD?-y-v90F0SwQ#L1g)t5Qv_;4J^MM!k-`A z#?s&wAJQLZ?6ZjdFume~-k%ITkr(*>Z7e5nBDh6LD5v?-%#X3zuL_O1JapET1DbLW zYkwV7n|NJf7Jb>J@gl6kZ9{N}X%JumR9(3ViiA3{Ya_G?fYiv2Yd{6yd@%={bFVfL25KT_M> z5}jgn54>CQHp9l5&=Z;+8igj^&Fq202o1~oPF~=Pw{7u<2UynLJlfDxC?o%{XXyNv zBn39)PX&w9vXZ|q$=^lJEuM@&LrM{}P!tNy%L{ykwfhb0`H#2G#!wgN&f5|y4QxQf z!#0AwWecn;b?X)mg0I5VIGhbb{OrKz5eXICJp>B+(?(=#8-hRY(zl&)?`(X6Y=4hT zQ=z0!gB-y(z!2l*1%VL=UIBJ8s?HAlb)$Cz`ScK9Xjno1w9wEiL%zF1lais2UKuL9 zBIJA9Q?I=s90^@r4%TBa;#NY$k+VY|9}pUvmkgW@fwu;3LaY4y#w~%zhRpUbdK!#| zayGj<6uQD=Lf=MOsNf8V#j;|+#Rntp6?EP_$yZe}SHOA6m5vi_=idf|$2gA;2w&*z z9T2|A`TT(JIET-ZWUfkQXm1Hz-7bpyg5cKBPjDOoU(%ZHsOkY2~dnOtL>yAbAGcym=c|BUcTtWC^S z;Ot^Joqv?`Q-pcp4j|S$mpQNDt^zNvxBd8aj48Npz>Dj6KW_hgPSd%D_RFs;m~{RP za1rFX0%#xi6)?At(oq2i_q$zJKz@xQ6A?)NvW1BYq<=}mhH*c`bp_JDlwi{@bfr?h zi#*|Ro^YinJjoN5+d1jDfb)s8pPm4YOWjuhho|l<;9TJjf_{!Ce6=S$&l9e7ey{Dt z1l}mS-F3HwVLr8NFNSw}(#vrx$zDvq(v$uxPk5S#{w-}{-Xt1@8oYzO0x#|%MnNC< zYI;J#mpCD{Meb2XIg^|+wLKOy3i`@d6X8B+6n+We0_DfO&nWylLAA=mJ=7@J6Q7jg zRSh=^_H(21H~h|YzAC9^4>$_;@~Fzs{n;qzLg#my-|)N0IiU82>3h)d1y)RbIr9?mSO z#e*G;uQQ)8AU>|)LI_lHCHC*cxwvUfT#i@iiQu!B*nr0%h>hm+V&wZS!#Ch82J$k0 zl(+&nRf$W?(}xTvHGVg7IUWlo*5hGMjX$jMCx|F72K|-H2Or`x)Ju`CMlsB}q;4Xf zH&RR}wkV=nc*k1)Iu~JhE{C@SPszw-_WC?`T6qCe<^b72Yc^KhwTF&<(iqP=ijBm7Tje3UPnYZoExQn z#6@TaU;u|HEgIga=@27R&xnMabG-FDPvh}aiCnh+V^lAwJgOq~pQ>1+$eE#}&fKVH zyXkqw(o?uTK8AiP53;Ns7aJ|~w z3iA#r?FN&**jI#zFyHA~XSDA;COQxV583qO^XSE~Wek-}eyn<2!W~^6MxuxbzvSb!A^Rn_>pz?U* zFEnFG$uvWrrvFGreiSY3Q%js|e#4gX?_wAz?F9LsVHnGZZbgT3!yZa=$ysL3R!go@ z{me!tURK_*W}Yp9aiB_0$v-IF73LAEl52!ILyzT7KBCU?#(&h%ox?$km*tPn8blCB z8P3JTbIkAI5bxCRKE!q~g^2Oer2!EW%9y(tkp6rQ)X*zp41FVi}h9 zq`yJ&5#j}o^Gij3P=VpGit~u*ceg8kS@CCze^ERyZ0M#EKZ1v074KL4wqiH24Eq{v zY=~DWeoAq#;_HfwM;W>;ivO(mpTx1)8=Y?OBE`7k2E{KCFG7D;JgNwDa{S{=zx7AC z#zYv12e2J~B|b=?;W5PVuxkx-=p^086sIX(u6UK=e8p=OG4x2jM#Y;HZ&tiT@eajS z#m^{yUa>>*tBT)Hd`$7%icczjU-3tZzfgRYi1Fkd;>GyG@c`oqeu&8Efr$9g8piD> z316h)NgBRH!Fl;eS*7rDC6^^P3th{||~MH9in9@uw-CNrb-6RV*ihKlek7m)|}| zxK86&Dc+*U7v@QKzvAZkZc+TS;vPjlY)`sJ6~C?ceZ_xQ9LD()bmfXO6lH!zJnvC5 z{hNx%6!SS>BED4dV~UFud7j4for>R3{8z;v60wdrq~Vu|u=8#WAJg!04fCm9rt@fv zd<%&Phc$ez;y6V( z@On+(tl_O1en9adBJ}WOA|}CyiQw}s#e<4JQ2Y-?S;v6xHHMM@4aL6@QT`CFUyweG zi11k&{*Z>tiO4rmk?)={yil=O@qWb)#YYvNQvA8%n~Fn*8$K5)#uVd<>lE)&{Ji4V zh>-JX#UCoZsMxJ|Oz~aCAlFsM7gj7$lyw;5t28`QagJiGVx3}>;@yg0Q2dUftlz+| zU&A4;%Md<~cpkDbM9BXW#n*|Tdq;5yHYf~-70*`u2od=vD_*YnNyXa~w<~^4 z@q3EDQGAmKJ&ioeV7cPu#0xO~5>fs##g&RTD}IRxx~GZY^Ap9F6kkz%OYv`t1vtwi z{h5km6sr|yC|;>pt5~nNMlq>)H}OKp!K-h=cMlPAe_6xd)bL{(ep16vYxu_+{;7t$ z72i-iNd*5fXB)mBRlJIb_*KM@ILUF24-=*Q58vcxiJ2dkZ)x~@ia#TQ z?;nX}`0WFYABGJp>vtLv<$XxQ=W6()8Xm9Vk7@W)4PU9@Yc#w>@so7Ju>s3ulO;=`HD9wZX`nfor+&md{Xfc@uT=5H^t+` za*WHG9>kuB`HP5%AEV(*6=y3pDLT0PSdU@*CWvLeAeLEz=pJ&ufNBUvh$ss~lpvZ` z_Gu_e5Jk(nyGpT|7%}Il#2CX^Z`3HxB4XVzM=?&sJX5QMS1pPgi4by=Vv>k4gx{xO-j|?Wp4IU4MCj$PhK~@Tm$x;{`(xD0%|z(o zJ|gVmVIt~%X#j}&E+Iysham7g?7xVp7w?<1KK$?(>+u{B^7j)Vx9pc8uk4c{=Z}XV z9`e0Igj|>A10l~6B9(6+lOObr6ei?)hiH%&8nWJB$h_guxOzq6R%cvuW7D{4^R61# zxN%j(#&LW*XPgycz$*koICyd<4_?i1y({(J{Phw4!T8(chQ{UVZ(LTte0g)@21n$4 zAF|7n`h0nUZ$=DO!T=&$57CppLpE;3+SRM^UQxPrs8xBpE&Dw&eJx>N0+|hXCnWt0 zu!(+eB}wkVDqvVQu3qPQ2_sX2>pi6RF30NPJ(cx7l<$3;gztz9R)w6jG|T!Hyt%P_ zeG6XRki5nWn(>}5V@zmWi~CI^V}IHX??cQ1Z<7or-vA=Fjd-39z z(nzNq06n%jsM>SVoszTX9jU>L&qHQgR$sJqy{hRlIJ~UTXe2d#KG&oQ9i<4dng`b=pK!3TwmXu zd6Ai==X$x>^**QwV9dU0?F#eqBi_mxhj{`oX#;OvO)RY+hc61?ul%W~rWb!2##KzF zSN>E?Vg&wxb|U}EpNcAa{QW#Rk1t{=+hOEcH;O*q3S$b_-1m8%RM`ms!v zt4h%VmbG#n12ZpOktG6JI(`ifbcrpRHVcR)ZCVyf$NP5>F@5c;!yXr*g>a;yW4=mw z+~vj*Hx6`SHg)-29G!AIqhDIJ!^Ex5DsC%Qr{mBMmRhZ<&YRahH5-XVQ^>9~2KY zr1f8m1U^e{FU#+@pmWRTEO(qP5K%rH38(q-c^vRd%g6heEQd6_EI)qs+0CyD{H*=a zuC09aVCI(ZMdY(Q-2AQwk(=Kk@U!|m)5WjS@Jq}0vdTvqUY7Sb55E^(@^Q~@P%`(pc@=GS2OrRC%M3Dh%bcv<=CJp7J;pKafW(lH-DJnxooH~8_4 z!Csc%!=C>3F8Hkk5#<{LXWJv;>A%h}BOhsaS$<6(esv8Q`AU_J^6@zWw|x2F=N_Xi zzpsMMt-l2LF+b(I(8cc-!!NDBsVX07cv*hyJp49-pVeQP(vg3^f1rFd;FoKB?g5=! zzBZS9IQ~fMkI$!|zG?aR92(0Z4KFL-H$42>UGnkxgmlcu=PBI!YXd*pr@bt{zj^AL z0zc-b{>H&sen0i-Z?DQn8eW#)k3IbMfuGf1RO!h7T>Np%w;%jCC)>;N`w-~d`gdE_@#8W{ubYk@d`{>-+6FWe>1%N=Hgxo8&oe_?xh}nD>s=h9+O`!oaNVuLS5oG z`PboH1ubKO(uIMID?XX1zo~KDig9blM{q^?M=#?ye+DWSI9taD~jgU*-&9>i^1@4yR2dgyqe&?fm1qY#Qyx-A730-kVuEj-75BdFCFu-R=*c9Nz;GKniD<* znz?;gbB*2Px_o#Z=nsaFQe6PP$Te07faiHI-F5s%xm1>qd= z7%>V?K;Pc_jYa&C9Pt+*9>0~5MSmXRyS(vX*bVC39^Q&qh*CY#wkMCE&H9LSprt

vquc zoD#wxNy?Os3J=SFdI;C_S1O$3H|@YH25!p#K@48lOO{W3j#D~A2<>;#Cybw>aH?0p zPgXd|Z{nK`deiT{(x5l-n+*CLEP?#<|46$ZFssJ?d;Et=Aq*=0qlu&xMSq0Uj8b7R zs3c)fgfJx(#UKfx@~5a6gb<1%kB|x>REp3;C_+(0A^gsJ_FB!dp4r#+`CZ?0T{SbW zS@XW{ec$)qXP##a5h5P!+F=w3`a9=<1yj$Gp%r}C2yRF6bygE<(DjDZZ;%AF*g?s-qSnu@1u>V$r zv!6+?v)9GVnQsD*{%gDOdX>1be)3f&)6SfA@~l4doz0o=507@wlI<zTx8CEF0=Z{PiK$A=FIa~3ZvaK zWjw3lJl)%^ZhkJtGhTNWH(x)s&6#fx_jbEk{iJI48mT$!6k2`eyPGrL7ar~E`R)JT z>oY}YD8^?28_j;~i_c>m)F;8C-DbG&3z`b|apt<9^J`vb@NxF@Vdhs#yBB2J=4~}T zVSV~q^SSui&xe`cgiqKX=9{Cf*xrkzT|ZxCojA{n8~d}W?5oVSYe%dP-gZrZ&U`Ov zSMQg3zRLQn)7RSNxb=s#KJx?2ndf7c*k0C*pBZEIS?6x^75K(9tIzy&bLM#-8||Kl zO#I9WeD2$ucHM*LpHb(0sgsAb>gVU(;4yEfNxnqR>-7AmR9yGFLTsS-v%C4g?DLv& z>y>=?pW_U#e{jB-AAr2i%V_b2=v&Yjxc6rQob~Z#rquEiF&0xSPoE8s{^9uarXKvto});&++&AtE@irJg)k7Wl+!Ct!&O?Yc;sH zTiu-b`tWG?Tzno~oFK0I?^bc$UozNtyq|oW>;1{G{6y6C>zwo^a@^4UrKQz*8Fl<| zE}hpu>t%DgzZ6;>OjD-2IUk$#f%|q9nKM5a?(On8>EkxS+HHgF8fEp_&(Y@0PfBSw z7eDC7^G0w#o)^HqpMKotbrT-9eSCVM4xRb_a37!9;#)8VK|CIMe-)#`h2}^Zw!bd!*XvqkUzZlQ|LgTS=2uC(dS1cnY~Fvq)e*fj+O3T1SH4}< z%$etPHXnapXJh?jtFr6Ou8&=YcAHy$=3AOGuh->t{ZB$Z`qLEqPSl!e?Xvzf^HTI@ zy0y#vOmpTJ!lPZi|5_$~ldQwF;v>bI+w~>3+tPdn`pN5lK40zax)bx=;XYrZrGBCG zXN=TQ=XExpUtVXU^LRBy>U5U+Q_Y#5E&b8_9CPM*9nZ&MK}vmIuVX(s&b(enXZ@8{ zhxt|J%x{6mIPWLxu(DlGi{Cenn_u_)3eM|(+%D#G>^d9s&E-1VzS3^Hly-SNklV{T zc~+n8b~b0eS4z7Btlea5v%fcCz8LFyu+?XNh&l74;J%(0TYc79X8sG>U19Z^Uun+# zI=Hu6SS|U@NG3Lyd z!oA&TR-bjIo43FkooV%%pKZ?k3b>E+N~_O0tIYSpysx(U%&#?Pek(lM)#H3~oY(mL zwlx14U$@3bpWpaB)40)@?*{jA?k}#__i~alW!H7z#^>>&20oAa>Mh~X|99|td}xi& zBd?wZkNms%JU(>B=aE-$1dsmnF`DMip=|>)&MyBk1x0V#x9-t5(HvAb-Qxmv0VdYyL23G71wbXBd+6cuXvu+ z=W_}{IzAUmK5cx8q>er>++SSBb4ZGhO7St`yoL}oLHvH{=X7|Cr}l^I&F8T;^7Ijy zM_wQ1d?A+M{z7M7_ZOWudg_WtmC9i90Bs1xf}$0sLgX504S%Wd~l z?9Y0%%k|9q%=>y~zBvLu4(-JEk$D**uGiuD`~v&Kc30sO`ah_(8t(mEYtH-@xc9Tb z#vic^AB(ZwLvY=M^X2XOd@;{sqqkd%cEfp%Hrk#luFpqIPwD4O^NIL+4nBH6=bAIW z3?BW_^R5lz%kg>ia|=G__=Lrc*HP*5eim`7jCu3^R5NG3Hk@^mD%tlZH$M;cbFB{Z zJO;8|=365l+gs88;@9PP{BM`d>+{0gU;d|`=m7l+_7l$ju%AuLnQssGe)bpVTmg)4jc~VDR`}3EKoA&2p{A_&qzwXz3{^kqzTnAV8yNT;M;dw>WQRkS4>+9%>rOqIH9{m_5ew(=N@0W{@mOMX?I^5r*-LaCN zB6)rMK3#mgc3bs0*$CSnbWW2JjL6IUoZX9eyZzw({{E0>e`>?vR~+WR!_UX)^>G043PfodKe+D z>p{ms+s#3~Zgvblm2s#6=l#N5JnpD%9`92VxBAJ4ZO<1lpKH!M*C*>ggF5Ud?_cN~ zx5%F${p5T_UY+Zf^?yQrjwkEW*>2=dl=`iu|LR&_y(lF=2JZDIq~vw{`C8G4>Nu-& z9HPED*Hvt<`e^Bo`rXnW^#v*Ug(-P(+4Ck}%6M|SV!u|OgdYh1TJo&Vd1T#1_=LV0 z^Sc<%`DK2YIrFRG(XO7Ka6QC+q4#ULzr;0V-q>#R=Xh~#S6$DObwA}fXY@y%^B$fn z^;@F@;d;K&UR;kG+>au!-d*x~zqV3bk27n<^>vI}#PxMYdOxWBO=FIE( z>pCn#KDJByqx*~Ye=hRu55C-X{zakuj@qHt)9{@_fxie9@?#u(r#^Y=9|D{{I%Vd;(A^^1Rm|i^HA0B^)P(o^HB6r z@Tk8Q+a5F;&i>=eZGQ=o<3s0qV15v`w-f>9=`-Qcu3n#<181F4s595<(0SbR@hL<; z_M?wvyZXX?dyC<07hnF*^&Iw}Fu&5Azpu0k&N|GmHfNsuosWMFjCr^|KT;d+JdyG1|-*G?n>#p@NK5@UQ&pYJ7eS15bFT?zHgLAv^Wv0NK`94;M z`6BZdQNJ(T>-RTjp6lGlp#*s!2Odv+9CSZ@0An5{{;%tEcf1a8725UwuQq3%>(j@7 z3-a_IF+N+Z4!+#>KFw^G`Ly+1AKS?KeEn|PI&XwL>oecq>aah&w#NF`V|!Ptg>iK^$^6snfxFlR3ch|sr z57+Zjo@e=Z)<>Sc0Na}j_w~T{Eu=G_C+(h-ZJW0OalP)>U0k0hD!~u3Kddvt{6Snd z=5dMrVV>tXbmpfZ5aXl$oGt#b^k45!b-q?3@AIhlQ#>X_RPT56aY|pb75&l2P2Atz zhe=)^Pt6wRz8URuzliai8-N@4i*S9Pmc^(O<2IM!>_>hlFdQu5p{eB8!JUhC+7q3e_9t3J-Uzi2-fNPXR| zMdF%Ymg3y+yxk3w*M4ph*ZP&S;}tirlOwMEQb8B&}(_UQr6KkoW{&a); zx-BsO6zjGS?(4R@IrChrv0eN;`Y{Cgy4jD~|N3RU%w+sLFc;n~o7eNAOY`E5$1CQ<6h|ij2rVMex`z^~LbmuH*1|)Y1DR^;O73yO&CS z6F&F#ycHhp>U!or9(DBmg!dypU)*2ZTSjNIw{YFR+9muy$E8AX&G!=5;|ceRsISiB zzwg)D|C_Qu!&`Hyudew^B;OkOm=~_$AZ}Nz2leh!Uw>b0u+-_C{Tcoq)(~_49@a2; z)Yp88IrDeJV|?`Y#kjrE|0A;hc;j|Oef0taB7dahxm}T0*W(-S3!(()EAr|!P~X>Q zZMd&buD9qnruSz2W+L7#{z_Z<9Q?H~cbj z&SUr}ajx5N9;2e`cccH|w@7}1ZPz?(S1Fw1K%WbbI(q)k^A?WJXQ;E#>d;q89UY(5 z;`)0Z>%?!B{%?T$yl;X3&%EPjqyKtb;yUp0H zdm-=h+h6<+8K1%8cZze~*)Hd?1bMbgFO@nvznpj0;XHEQS%*GH>gfC~5FaD`Pu&yPRV@fgjI zV|=}C)cJooj^$y)qs}ntPdD+a#CaU^aV|ujem%yy7o6jXFSq?=Jv#Hn(k|Ct&=7Hb z-S{Z+Yo(ul97Al|c`W<6?R~!yV1Jk|HD`V%JjU%hX?G5s_3>q9uK9-;AKrg?yMEkb zejVyWyW9tZ{5Xc#|NNfO8nl~1pS|76=FI29yj>!+fE% zdj&p^TpxVS`eAV^GT)5tB%OU-5b|{9xi7@_>i#|g`S2_8dDP-@EL`_%9>;vY zF2&FKe!Up(^;d}N{+^2s@%oM6UZ3Y1QD66?KFEi2+ko)3KBVHSyhYu0w{bRV!BiB#3UjG?@pLHKB-W#7s zf7q7KO9?VQFN>tkP^q&@{2K8M;%qD0-72ni_`GNIU+eH1ez?}r-{a7E8G!qv$m=?+ zAB|^kzP-6+n!PTS&7YS2$6IH7;`=Y}cepw4Dn_R&&Dub)g3=Q&SMDV*EY0R5Z_XFut4;n7ch+{FEYby}g$BCA7Rol<8loOMn^ z9qvc;uJ8?3pZQJZ%vZ;pM*oZPc|>cA>v>vdINQAd?RJB6eCV7zA0OQx^}I{>M?LT2 zeiwCgzaC-z8HWCFPT3#&B;=zG`xe_<3itIt74GYQnbi4z*^ly~@$8M`$@%jAi}U6C z7xUb|xV_95l~qr!pN~hMgSdaOUBtG%&X#rP1Mms+cVL{kKQd1rfxM5i-oM-}{o&(N z)_)51OHqgQ>H7GzqWvz~y+`VEzYD)te2Z-t*X>qom#+JTw%Z6bqrR@sCU9;S*I{!w zw~L-9b##4phWq*~fcyF!B6W0q*2Z>u9UlL^PJ0_4uD3jMt~ah*ZWr^uZkg|cIx%i~ zovp~~!57#a8^b+KwT^;8!;(DEp>z4EQIqFYBp7rT7rH-zXx#D`g zZlU-X%v}(V+iaKXkn5K1(rd`PYrDDPx<0vXS)c2W>z4KD?WK;68`rI`t8U2qy5fCJ zjK8kWMlue(F9>QUuGdL;+>1JQp{-EY?n3tdrZ~vjc|Q^PLB9o{;+(E zeC(Sa;Pp3JC;Vf$)(QUt&i#>fzOA6n%hF!_-SD_YUY+aHeM1s2%g@2*@!{<3&&MtD zuOy$A{l6r|55jq)=Wj{zH7TBt?ejX5Q~dW7=j-31j?Ux#m6MHe|0Tr>@Olu>Kbqoy zr}*i3oa%LcO!4cmP(1%hiZ{Uf_<4RviocrT8&mvDyx*bMUzy^^;(031Pf78=#C8Ab zS-pI|)F-9*uPJ`wE)~~#JjFA+R-8Xwd~Omc`~SHV-;&}d?^a%4>pYp_m2iNF@zi{u z6rUyjdeT(c|9__V^4*hA)YtsMdsOV_r1;}0e(;_Z*LgU_kE&5|{)rT?S+nB&r78Y% zinps(UT0qNY1#kpqy-)aR%8 zPWx9}=cp7P+PLEU+7$0}K*jmzQhb*t<@q;~Ps{$lFvVx2_#fhLN}ar><@MF4rT8uf zR-DgE@sTOMD8-AKRb2nB6#pc}8#FJk^H%a{+5baQ{F#F)&Sws;*juM~trivM`=|Ib zDgI@O*JxRB{j*YhN{WA+;tda}xc*Bie%7HC=PR|U*xRP~5v?oEKbGR3q1_6iQ|&4&%6{Lnc^>{__`EtaCpW2JSD|%O7X8!y!jCo z*B_MPvs1kCkrme|Nb&1Z{J9igBmQ>MRN4Q{a6u&IMSWn3zbO8W)X5xG-v4*Sj}>1e z{;2qS;@fp7uk*fmaf-i?;=6UMxK0o8#ZrHU_!9A5^2+O|4^8pqDSknId7Y)nr)B@o zP4RI@SDb${#eWz7Q0n*SR9@#J@rfzEI>mc-F0b>k)Ok*Ph4{|Ll;_p^ruf7ZUz+08 zx|G-dR@yyT{5$a{Q+$W6<#jaQPkg=9c`C&>rubpq%Ij;Li&A`YiZ2%bN&0j2vE}vE zA4u^(Qv9IfDy~zM;&+MvBK`R!#Ty)7USIS5Qv9hD-nj=#e1AkasKrb z-z5H<)IZ|H@;d4zDgI`P?{-pooy}6eM~Xj_;#CVPu5&_)-<9Gk#kWX*_C2}0zIy)@ zpCP_g>TFK&qfRNWulc9M|CTx%Q~a<~%j;qD#SiUXUgsZa_Zso4+51l3z8Bv^ zyiboL5%;rkZJM|D#d)nezIS2IBoXiG*Qq1^e2VAvsW{&$#ji~9CsO>U6mN58dAo7#p0}~$ zajl=XN@pdX#k{K*h}W0=b>e%AzmeiQpIu&G^B0KkBXyom@g0lG>uCO@6u&3MKTGkU z=T=<*^z$nA(J8)Eyn$?2?Y`x8)Xz%s|D^bOaXu#%mAmvSudn`YiWi<=aejG<|9U~i z`6K&R?3bqa%oN}6!ty!|W!%Q4_}&+l=l7NTl_~yBiZ{Qw;yTZZ?f)wBT=8E%IiXSO;K1lHVY_&#@3oWCl?7pHjB zJ1eep(U^*Tx_C$F|BhqJ^XliO_{%ANz_^O*l%)8&6uQ(6DzJWQv7IX_lp!iaZ-65&5uv<|EBnUlgsOLl6Egl@n=(fhonqq`)rL(`Q9kc!(+Sn zTF0O{mgj3O-}!~Zh>6kZ7*InKY}>mAMc`-;1n^Sz{b zZH;w0Y@am9YcKR3@P<~0zkkAWd**LMp7Tkc4Cgr^{RKGBG3Xz_dEY@_3+HbF~7&*^Vs66EZ+k8;pQFTe2*ixdm@~_TR}e)&esOh2f**K`orK8&F_Fe zWL^q?-26E>*B9Ge0H0&|PvG;+zk@F{-vWQ%e8pAEmt{A&1c z^LyYt-f%pp!})q<`eOK8Xe;Cq_i2CrlOIJ|-RYw-QeKZQ3l{}s-^%gX-e?38TRVU}+R zKgzri-pRZeeysUu_(|qd;XTY3z|SyW1wY4pEBpfU+B+xPb&2_5@XO76!iSn)0l&_C zEc_<(r{TAmzYQO2z6L(td^?);#B?}u+Tp9Qaq`&G8P z7`}`7_wYTn8@}zlEPK8dj|U%x^Y2}7yIz9d zVRhbt-);UGoWD23I={e6EzjT6c-Fi|PBNae%$vbqHa`;nuKDrsCFVu&kIk=ye`|gl ze7*UjaQ;3NxA#@}@0R}<{*U=@@G3aJW1U*NC*!cQd0ROD{s8mc;d@#Ba`@incft2F ze-7T%d@d)J&!bR0v~JM4nDy=AO4VeZ}^Mm9rsH1 z)7Mgbq4~L}v)ue*_*dp7@Sn^_!?&7GfbWRMa~x0Zr?t!$KWl^f58Rsqs+I% zI2>nQ4St&Wp76fr`@sjA9}K_Id?5Pyl=)Za=W{9kviWq>;p1kG+sp6|E&m<-3-k5x zAIyJ+Z#LfwuY|{`Y`1dFWL@oMz8k!rc|G_6=KbKU%rAlGnNNYAVE#0`xA{!?1?E4% z2b=#2zur89`MSfrDtw~(vGA$pXTfKg_lM6j9|Zrv{95=*^HK2c%s7K6#vS62=YIg4~PF@em#5#T>s#_-vr;o z{8sor=6Aqbn6H4hP4N!qFCu@O`4V_P^Vi@5Qk>U~xLvKVZc8k`H~i)lztg-9@)OND zzcb9AL4J<;TkwVEr{ex)i8=50KZnQjSuZDt=Cc3SS-#+q*YBTv<1(w$ z1o>g+-QeTR@p6dF6!WRbKLh9bxd8Jr$9y>aee-+aE6u0Dx5xFW7&kuG98K4RbNtt$ zKl@r9hrLWk^IYT$%sCEy#a}@-J`93$d;4MiTq_>)a$5FZ+-?w$d0Bw%aDInJo0=#W1e{AKSln1@yH*J>yk^w zBmX7xpNmKS9^}6gkNh{tZ!ljE-zpw;c%78*bHaHUyl*o8yW+ZFte==izCNS2_^U~@ z?El7a))|WVJybl}<=?AoD<1vld>t(w`Ej_e)I~hFBmV>PJ;fu>`8roT@}2QG z|9tVtbG`1Lr-h z#UuYQ#y?Ly^2?C#EFSqInX$`=4;`vn{R+GGw1uluQ$)d_*cbsX!euu3x9xl0rL6gW8gi^ zC&4c>p9&vkUJdshn51+x-GQ*z)wD=C#nDyUkm|pEb{iziZwL{;m0C@W0JR!gFvP zk^P?p-y0s|{93YWmHpq$@;4lkeDg5zIL`cvX8LOk-E$1dWLZ!j+D&vD|B=REclkNgni`S_LV zob!0To1CRNQ z@#p>8WXn&(dB~II^WiU;FWx(5G5g+_=J~i@x5B&;d{v5nZ~h+I-E96DyfQv=zP`iP zyPI#o*ZY|Nj<1`U?@%Y%u6E{i;K!Kn4?o4cE&Ocre((Y21K>l=`Tn6if8_S|-Z$yz zU6wx|UTV(kNKc#Jh5Uca=ffA8{|5ia{4}hG)#hiwe>T6J7l^Ul+^%N(CEK;Dc{_N0 z^JCx#nis;4GVcvP&ipd?Y397{(bs$)@>iNa0Kd_k&s&W#UyS^N<{!bIHvbC#viW-W z+vb15KQ`Z`Q8LbJ%yZ$tn0JJ4hhH$`e07EIW_~h!Z}WceX69GH4>y0VVbag8<~JhW z!+aY2Jo9(p1I>SiUuXVRgQVTt&FkVgR%*`mG&RL%nCD@9Up4Ox|J0oG@l}fdV9wWF zY;i~ZD)o}><2>FB-@|+gyn*>tcyse5@Wai&fOj$HasE_u9_Ne9*Q3r5^Bdqdn%@Dx z!+aKemU$N(-(E@ax6HY|mzh6+(x4_DR-FPxHF)^UOQLi_MRN4>#`tztx!DV84zFESqoztns(e3_$ye-A#>{1f;*^RM8G&3}Y{ZvHELop}bw^FPdM!mHtap5wVcyq0+z zcq{YUunvw)@ng(+f5-RdXS=+=JKOTSKOJDs`_rN3`{Mq7q&d&G?lNzKe5rW{_|xX6 z!~bK>*O$I!&eu;aGw0)}FU>DN{U6OQhyQ6l3SJGz363XU&so#_0p#~Je+J&d{6%-`?D7-rMZ_e*^@H*x^&uMJV^PE=ZccD(6`F-#c%pZjJHh%`r z<2w7v^T@%Le-ruZ&6mUPFkcOyXucjk)tu*%v&{Fy`Nw?oL*Pry`8fRx^O?x6H-82G zr+FJ3CwIhgl;gwmlD*82N1n%H=1+#VvOKRp5BUepAA~=i;?vFVMgA4@iEuuiX8-wm z$Zss)2;;dv#eXyB>)yA=<80RF^BKFE^L6ihT+TdS-`?2re0}?&=6oG{2lEBk-s8*{ z!+V;qgr94^C&uA2^Lp@M=6wD3E#`dv_PyqO{q`f~eEs%xbI#X1^R4Lr+bO=pob&Zx zb3V`Xo%vU&|EoD4FKyR2Q+DG#vY#!@*JIpznpeen-Ua4O;p5EL;e6u$6rW;Vf;uzI zZ-&2WemneK^ZVc{%uC^G%pZsUZ2k=VAM;u8>IeLLJmk=oL^LpAP=6rp~5ObbimZbPC=AWXU_nPm3em-K}13umSa`-Fe*TLU0zYYGe`6T#i z^J(yn=DWlHHh&gg7f;-9zvu|xH^rNoe}nO9XZ{2H7;}!>Ddxj*-Rx|0_J4pmuh$JV zuY>-NG;ai-V7>wUeA>Jz^0QL>RdYVR+NtTk_lu)*ldqebpAYY3z8Zd<`EvNl=C9*? zXsY=zoM-&k{8{+w6klh~=NGn^^Y>vZADC<(*AIWcHOHL47g^tYBKp(B`~i4t^M~O4 zJ7R425qN>+AA|QYe*)gud>Z@;^Dp7UQv4=!{{HeGFWOM%h@{{I^(C&-oAHWxw zFM%&H=QwA%>P221I#OnkNIiGiX!2A*9XPF;>^UhaN{7rNIe%XiS-0xPI^LV@7oaZzDm`^}| zc4+?Zd8F@ZejD<2&H21TWAm}dpJYA@-ZRC|GH1INnX}z1&Dri<=AWV6`&0a3bGG}8 zIoth@Ioo~Hd^y_v+Po6ZN54<;pUv5yzs=d7oeuiP1vx|?@Ff6g)I^BR|! z^Y^KTnxBq3H<_OaA8URQe6l$ow>)9K?R9bHH=)k!=6Aq9gvaYrUQdRq?EfzhpCP4aHB*I&Uq+ zqt5AjB;RRg-Wc9RJnFPWp_9a;&O>;8UN7@q@cOWG%-bM8$oxUHdyRQxyq_nLnXFNJe{b1+8JB_HF-*CoDg`9h4tSLUpv zbzm=uN1l&c=ZQ!DZsgw-k363jSSlWQzE0~S@yPRaQ(uWkeiL5L^o@Ar`8fAy@yMTm z$4$S9N1l(DcfdSw9{D^@Epr~<_BXH5F`1V`#G~CRcz&Ucc(mIT`F!!n?~3cm$B0Ls z$H|k$BmW1k=kySdJdcy-h(~?}uG{eUO}V{%{65g~1Ms--3h}7V*Gpe79`%pI{gD6C{1hBt*23d>632(;RgyXzB_H=kV-n8%CLZ<;+aGZa~d@%fbbG~2n-{!R|C;e&A+WHCa zVBQ~ok$DE|WVCq`_;4{tnd%ka)uSNc6^DS`wd(iW;o6>xTWP2L7`S*4WfOj=t z06)jPa@FMLuQtzvkAd@e_2m9Z{$+DsPyf>VQ{;a%=l#o{=0706SKFi=w!1T~^R_Z? z3O~mDICxL1F@_Wcd$p zJo-~Sjx(F~O@8Pf@i<~Y_v*8?1oPK0(kbE4sd0u_9c+?+= z`Mpg%>hpYHym;hSAwN+(^1MzmRXp0w%l?bo)8bL*NL&Y>A+GJdA|ClCk$+u0@ zOW_=cRb{Paf8WBqCHm8-T@qlv54?kU3H%iEMesr9IXKSW4d;IS3dZeg^X2e84^R5T z{EzTX<~v{<2Ak)?uQ%s@al1L^_kMVc!y6d0_%PM-8?Zml6pwkSg6r?I#baLB?gH^x z55?JkaeG@l>YRf*?}Q}*a|JTH0 ze<{uWi`zo+$hSj&iTSngFW~G?F6wNyJg?(dL5G=V{~MccO1hKjV$S;Kn`dx5yxP1u zywtoKe6INr_*(N)`0sG8+X>h&4m>L9FrCi_A7;+|rIR^dKY5Zl*KHs3C203TbJoAo z{14=BG-rN{`R>^7CYv+=g!w_p&oXZXf8Ct>*L&vNk3KQy`d?#y6zXp@?*#wDycfJ` zhkwr(w`))HE0AwsJ{;c6{1$ju^KtO*=4`jfoaVFlKBg$ zGu520hn#87*F(N;&e!$5XU^C4eP+)0;rz~=^Sd36m)yS=pr5;%vrawprN}oi=lHia z=ku6(=HH{v3Fbe-dzc-((+oY#m)z8LxM#3RrC|0*8&$MAg2@8Xf? z{!%3`>2$1<$ZtV@NAbvWf2k=R`Q~_@ppJOtx!>(C9{K8cAkf-xqa?aR0kTysTZU!ynCg{dBYW2WU5w zUtT}z)WPG99nBBM^{+k555;w*dgf2!yr+qH^nVrle~5Ur`zQL}Q9SZFxGr~+c;p{I zyJwp(fnNgWc=o~dw_D8@S4*~kg4Bt2`F>3giATGYab4+2^J4h(=9}Pi%!_b6TUkl&i=wzHYp8Wd+d&0TD%s@U@ zJlb81d2DN*gL&yF9{pL3I^E3o!sE}A&5wf@iATFdsDGh&)aT>LLFSF{IIYBdI{X&% z;b?c9`KR!S=37x`ig{=3FVBca|Hq*J&x=R@uR?wvobxgunWoHF=5yeGny-a7?DX&X zEy}hLw}Z|3{O^(Gybg1cIUiqKY2Iu5r2akTCGc71W8fc}^L^XCHLqPMssE>WBlvEe zlkaofM!{Q{H^=y&Va~q;beTE-zRoS?t5N4!^ZHeietclg>-j&KmmVI;!m3QfzLM|4gcDF1H4j~e{WZJ9G~l(m%!Vb zPl5L_UkSg$JhNlc-bC{P_-uF_-{L;G1=Ck zlg*dFUxLSaUYImh_WxU!KLPi%OU!v*`h__kAFY%6Z%h3@EPpZTZ{Mwad*gWZUmUM? z5RdU>yL*U7em`7as3jhGzE9J>;*q})`Nrar=XLV7@ED)ye-muODdzYxb0I$AeEo@W zzQueGT>p7O>bxW4^P=T%#`wG@9{qn7{hu$cIs1Ppoc&?{Z?=4A^#5_mFOvSx zvivLP|109r|9o5@d0kxlzr^a-M;o7;H-Z0Pj?ns~wko!g)Ch+f~P$ug^Zv z{C4E?%pZsMgvWTkhc@FwU(2t+_zVz_@!|EaVsRax606@FZ9HU-)AP(M^8)1OnU8>f zA^turKCFjx+^XVn%CF+l|KBmczl&@Cs~n#cjXII$H~b6pN$_9HXTo-dYz+ciu2bBXzJ@DlTL;dj7e9v5R<hJX3qQqtHGGhH_3SpsZKQc~_+#en;Quk_^PwNZ zxvqv|UcQ(7lBCJ9|F>AaBj%;@iAjjZjVG}GRuk8GsUaToSS2s{`P$-#llg+onUojt$ zZ98uNHJ<|CXg&>I<)q~2xVEG3Y0|Z_ z|HoRsH`dQ&@t7B0&w5Ba=7s0U)6IDvHAg(^%+605pDV8GWRZB}Z^d$hLSWBg-#M`u6AZG+^?uK!d{{CDwa_f@o8wJ`ZU>*OV0W*VCp!Sl=qz)v@y0Kd+B z1AKyc4fKDuc^-U)c_I8a^C9qBCnpVYyGFqeG@k(PWZoLrJx(*{>mCQgxo$UN9o}PJ zsd>_mN2Jb&7=!rmg5+afHez1pTfRGfX0bW<_ci9cfBD0FFzW1lO7aQ&zd!m}2Oi_L z4B7b5T70?q(N^aQ>|X`u+>cI|Iv+`$3oJhpbuJf=@i_t4m97%k{q#oh$lrzh&Ek>g z``z7Z{y2{RkD5OZpCKOgSEBwb@u<)Hh1bnrMV*E480Q!V?k~&DIq%<@bKd_lzZ+v( z@6_ZI&hO!v-=^?r_hT9V!z@1m%~v6R zr+E_`pC2(VgwKU@{hxt___jIUkMSe(!N`AMo|Bu5%R2Krk^j}4k6X9znfx64^91rc zo4*I&%X|sEsrd@{q2{d9(fl{$3(Tt?l=Sa(^E&YJ%@2ZKZk`V>F+T-NVGcv-?4lX)L&-K@%+ksDeC_u^}mq%e_8%m)USGa65_bA|255Tt(oNZGhc;vTf$== zS4q1aEI$D4b~9(YJ9x3H6d zhDos(r2aQje}UyUp#J;j9RHQ(tFga)C-uLT`kO7kYn$Yo+nteo&lK zOB$JA-VgpLJo@>a^yhiYcR_z%6OVB_7SB)57msn{IDa4>`G=AJP(1QHU;RQn@_!@$ zwRq%tUhxZ@{pb0>U*g}(cI}K41Fna&uw6CHInMi;uj6qW9_{`h^*dO880vR3XZ@b$ ztl!t1uge@{{txP(0QZ$KfFH$UlPoA>xtW zB`>LSlz8O7Lq1L<{Y0{=6qfHd~?1oeK9=x`IEH!x#hQ@-S5R?92TPgKZ-{`d7Sw} zJn~22dGWu+b-s2wE9pe6lgQtT{I23UU;Bv1e6_@U9UvZceny=m%=bSoX|EHU+oa?-~`5fdAH)sABbH0!9 z$>w|?6O^vEFXOIvFM&>w*0lB_8=D$d49}Jb&MLf_UWjIzH*t zB=N}e_o=6fNB&IYr-?_N<1kx1@{b@tM?CTzpM~O){|@;@;*sb1z)CpBGZ$m}yZID& zqoU*!=GVeIn)AG(zK?Bk^d6;$HgPhd4FC!@+X{-DZ9NW9(m6DTX6QjWfIS~rUUo0N^A;@1Q9(lgM`ZeN_e--)b#3RrB;!ZfX z7ne&j&zf^yJ}~c&G5XpZr)Qa8;hdK>SpT)oO@5Hh_kG(B9{t%Yj+u+4;_OmtmI>I~;KEWJiGPBM5Bfr9Y2z;G+3H&cO z$8*<%lW){HFZme#+=6U;H~`N4>sZgN#ABS7p`(Y1>w4}a9{IX>{-xL^&i*&THe6%g5`L$7d-xOP9RK;|MaX|_&Usl2=eRY-IR7L0-%%qz?9w;+ zg845n&U=~j_^`iwUh?yY!ebo%NT}@pJj?U_Q;sud{a)scP`{tl|5NH;Zh5}1%5Zbm zzs;O~Ct`xs-zxPVvwW+=l5ajI9_!=@tdkeSW1aARZJv1Ke?tCE@yLJDFsZ*(Jo0Vu zyz)olk#CllTZ+spo(D;{}1AAi1hIsbmsjZ(jo)E{g4Ur>LdIqN@R&c6fog4E}G%f&V< zuzbyS$(Fru&iX6OPs&U3-%0%{(*MntKMeJ^yCC^F&M)ilW_~K_*N4aW?;!OLwEWqq z-`bq@k2XII^-q%eRi*x!mLHD#7mCOJayj;wOT=S;VY}Cu^Y4z0g2#4MlXma5{6w@{ zYR>x4nD@bUy)5;2l=^R5{$fxEP+u`Qye^>J%sNY@cSC{(dTD~#r4=`u_tIbEE{>@T<7pZ@bKOXyE`b8hds=Ie33QEbk?J2o61?d~q^-e!5epVvL+ zZ1)j!{=Ksq=4|&>c(l8Rw7baie_?x9h{tj1D;$?ritGLOcT#^(slVCs^^Qp9wbDi9 z^BeWM_ej33Dz5eSf=B9)HzUG$Fr??`ygx=nTn6oxM=!Ld)kNf3@X% z^-jJq%JO(vlzGIw1a)Rw9lp+Bp59c*tK@o4uH>_F)R`_G`BLO(iAVlY&;*tLr`A@_nfBpVR{yTWAhnN@acA2V|B;TjkPQJ|4 zH!p>^G+zrp0nYP*OR-MQmVDi8yS!au`A@MPhKk2_@p8l=I>%sp9}|KA5s!RVc4~fh2l}4^V>%}@;SI8FA|SD=WBp?#Ym_BO``Kbqq6&2y1oZ{806hdGb`dlV;uXg4?ekGEVnj~ka^oSTcs zcCEoUv=rBIZZ97B4!91OCmwn3M+M@MpO1W@c;q=ReZ(W*4cDQH#3Rpn86Y0{_mD3Z zk39E_Vd9ZrkLw*J;*me4MKW@u#UtMekDtegN1pq|B=N|fk9?_k%X zAs%(6q0TJvsKfR4CYO`BwOPb6!K)EZ#6%pSPU`CZF+mQV)+a_cXs1o(qru zM4bW@YHg0wn9MO!C${U(gOeXP&3p#@Lh}#dSDN#@;s$e$+nw;}=f2s0yiK-z3HFyK z#A9A+;_=nf;?aM$`;vI%FGc*3rk9v^lY zl+>eRch595FHK^ZHs-6~J7xXEgswT6#73#T*q^gc;q)C zUn;KSIUOF`8~x#Nc!_!I=w$Y`#(Z?bncvN4!y81?_(avipO~Fb!k%P9&w$=hr}aajQpeGk>~y64DrZ!#(BUj@yPQ$^L6pa z*T(Vv4e`kHJadV7Ykre`dmEnIoMCW5|2FRK@rJi`yS&McXndf8u9b`Ti-qySh`q$CCE57b# z{sq21*}N;Z>nu3ui|IFo6g)L9`OLlj2QaQGYg^^SC?K)jV@PpZkIN{WzYl zFlT>~Kx=HhC>ltmkHRldtzQ{{VGz%~_|pIbV0(&U`)UbT;Sf zt_#h7LB5YUkN+3KWBoLh@xRLQO)>sAipPF^F4pDE;xP`~uDiq||1$F9#Us!0e?&a; zl`-y*i|aT)FCO_bk$+J<^8NFZd6_RB`4^CXOFZ%%pO4`jA0C(fG{^8{>J3ZUVV?V4 zGdS0CAN1!4^K;?HiO2m;an+>msp8T9h3H2gbM~*F`8eb+H$MwL%)BQ2HaNG7uaSDt zyhgT9aeLl89$Ut3nR$EoFXjdCs>73?W4kdoajR!O7v98tHT+OG$NzWi7ah#^!hyTH z)Hx6}qTO>Xe@y$(>~$dVn3tB=oFtM4%9`ST?69~&lho;3dz{vtfa zty%UTZ*N$>5Bk4EJo-Nr{a-Gw{r}qh^8BQQjpkRw|1oF(ceytCInE3FU)Q_^=4C%~ z{=K;t=6t+xq&eSLwi`Ugr+M}tZ#^x4ImYKK@fe?Z7@u>+V|;kr8)Wr)UG7H7N1dxM zE~Cx&f!|}!`F_Oe*Tx1+H_wH?Vcr_P)Vw?V3v-@tY!*LA#;wYA$q#ZKZ^O9lE*{&v z0ozqmJjRWGziEGX%uCegc6Bu8`Be|`gR^iJ(r6|f4|9Jb^^8CAZTg_R2r;_9+Iq$4r+nn#CwLd)CJyhE5D&9)Ght;WdRHp29 zj(Cj2!{}c>@fe5v{geD4c(mI(`;WI0IQ!oU^+$_G{TldsjCj<)JwH=+n+%WoZL4ZU%!KoQKzlcSt0pow-EhYEgtndT%Restrd?vA7^b6kNkM#**?di z@_tF3%J@F}|6hDvO+4z4$xrgN#pAqXI?h{~h)28o-H_xDG4BcQ2G$quqQQ z2riNQVOi(x8p~gXal2VO`g04~y-i%l?LKqP`=jDf=TFpmLOkm5{^$jGY!@FhMPJ{R zeALOmG1-Ep<~PGXGv9Yal3#7!AHLrF8TfDJzrp`8A9GVuzZ$lW>tO-BCY;;VD~V^C znoodt6hC}BVD`faQa{G+R?OGw;xRs((e9bzI$sx?bH0Yaqn}4eyCW^nzjJwqc(i-o z$fU31#I@ZA#3Mfk`G>_L&*RcF;*qa;b5j2~@yJifPkf&FMEDZ(2jO4BxxIx+nM^gT zBRc16Z}TGL4>2!>cQG%4_crJG!xiRS4|kd`K%LjkSHZtEUkl%Az5%`q)-{iBeR14q zYJMgB81q};XPB452f|}KkIeq#?K;c9!sCy4%=@L7_uIsEU5yuy{9DLR6xVh2xOn7q zMKLKqVX}cwB9E zOR`~A#dW@FnNP=jHHOFd$9A>D_#9#02VP`806y4!2>cH7De$@GbK&2ZFNAM~a~!_K zyzGf}P2UP{3XknND*KPO!z}*`=BtxqI@K%e62eYFBXqH*Z(l_$X|wh ziFo9>{zr>Pej)N>#3Rqgl@FR`!8-^n0HP%v&p;wz8&^s))@?MXwLi7Hs)9+nUld5lHeUNkR(FEJklUt>N2Uir499=CTHye6FcMXf`U+yUlI;GN8mfcKXAd8i$g z`dj`K?03cDu^zhOgmtiZi~;w%67k5FB0oYr@_c@OjCkaCyD!AH*X+5&56QBmYN!(*J+pF~2eX{S(gY zkA+I-IzPg^1o;!qv72VjGcQH{Ds!GsPBmYP{3qr)*}leYlX-o3bsR6*|IYBv=KbMU zm>0uuH6H?hz?}DAv&~D9|4cj|7XAMY&i#mg_idwi%;T4s$6v)`9=Xo9!|^!kME;2T zqk8sjBE=)mb-ufJrX!mEdTPPmway|DEk9@m{ z$#xZqN1p4s7#{N;oiXGWOg^dR%3ISvn*SIv3;v%!2J>hFa6F}AxHUf+BRyt_Hq z?M>!QvfB{12hF*j=ZPPUY~&Zixvp-)@pFZEjOVo&&z0gao?KUJ#UuYQ^6SJS&vms$ zJn~&8MQ^h2jUyg;uB)AKpkP0_uIife@zeq4Tvx5cquo2v?qTB5F4t8j@yIVnzN>iT zxvoxw$Na`P7nN;Q_V*IZN5IFL-wl7%d^Y@Ja~=;jnlD1W(%9q^_Gc6PNb}m+zQ%2U zInN(Pn)5#R3Gq&-5p`aKbG{zNx_V7K#*>tMPR^bKd{vnNQ2M zAGdDFhqCt~ivCQ8b6nZanQ(3gy*eJ36K35*e+m;HPg z>P#>n4KFq4--VxQJ{|e#<}=~5&F8`wo0n8hV1@Z8_$u?!@U`Y+;2X^O_u{vh&qbc| z9OF4Zn^}Myk1O=bn8#dvr1S9w@5ktik>l}(UIX6E>J;K@eq^3?dRaaP<5?{JMz-(u z(f=Xlh42#dm2hrHv>SD{!b>IpX4YoHrZAW9mY)J2Wxg8w%NX-XJ0t@-!JMyiE;VmmEy+(cZx5et zz8F5+JhNj`XRdj3_(Jnu@Kxqq-)qfzoZnzR9pk^nd=A$S#*gFN9OK60G@ZYHk!$&G z$n$m3%=7m$T3Wt4^6kuf!FfNxI-JK|mghVcnR6bwAFxg?=B3#3-QYvar@%|hb1*O5 zpID#sSZevgDp)_}-Qm;C`@mQ zygr+)jeIrp=I|Wzmhjr!Ux#=DF}8 z=1t%w=IrMv^X~s&Y3BnS_f_5bfh3>?CnzBVm4;YW< z{;2R2@Ew%@s_;I;`^2Aq!*yOeV0d2Shk^6&9EXJ$4KE7U@q_(md7T%|8u?QqKWDg( z$v{ z5Bswu_0VSc3E}OAuL$ojd`-Ci{!H`N`Cp%rzeDCj{f6tjaKP|0B0p$&kJQ7E;aWds z;QafMV^W{9hA#;}WcZ5k!-ng4J7@U$QV;Wn4+&oc&flNZ{&3WA9VeFz?-75N4IdD` z2K+u@yjwSXoA|Q%=v#A zA&?(3yeRcG4E$k`FB*QA^yf10 zzXJJL!!^D;1pE<@KWw3=N5r~737Z^J|O3ofIkZI z%Z6{0b1T5V2J)+htNa@96Cl5Cxca{V{4tQlz@iCW+ zxsGGQApd_Q58f3GACPlp;C~15vxckfL%_cQ@`nw-RmwXDT<0dNHg9;3)c+CS--P@Z z443YaSOoqpkUwg;$}a)`dyro?T;*4Qp91++!&QC__!A(%Zn(;C0RIP&-!!~k&t2&M z;C6pf8SUE)*ZkXouYr7r;VPd5{%w%&G+gCVz`q0XeTJ)iKk%nOe!y^*9|V3H(nc(MZgd5~W<0QmvKQ!*Y70zU)tLxvxb zbHl)Y2=Yb4)t@r(e+Kzk!^?8+5bz&?{9(iA<=hQ;=UaT;*4Qp9T3y z`lXy5>F*A_KMv9 z@x97zh8HFOcHl|yr^E35l7ABTc98Ehyd?Rjfb;scZheOH+B9$dz^?@P0mF5!KL}j& z;CzM*&r4pzzyx1!-g(m~6>c|BIQS;GfpJ?ao}eh-yyhYdd@=jMQSg8aPU`y`_y zzx1dhMgK5Dp*eM`Xcceu-zi|rNQ`@o-7!#BmBHQ@L=#C5~> z$@RMd9DnDvX}CTwOGu!~{r?@{Pn+Ro$-f6ka>_)S&hzY6)!0>}00+koS`^bz2={(KMcQ;`2Ma9mG51svCn_4`ZgKduk! zb8_ZukiR}BXZ~&A`aL-2-vO@QFJk@_aQ$8zbDg{KY5g7%b6k%-DDyAoxbCXo7h;a< zt9OCCUTd8HQQ){D zWED8B*Bu6q>vH-%GR_~@-xfjstarhsCxJJtrvb-xvu&^T%A7y0k0pU8=$vjn!1G}*SZlnu3zc*9N6ypkk73k&*ya0?qsX-9@mTX`vxqJ z>q7edJLb6l(=HQK=D5zY130ed^a00poBhCXeP$RquESJ;<9drePiKE{UFA-Y$Mq9^ z4$ktpPI4UNaXmzzU$Z=}dpr;FxW18)=W#5r_jGQ{%Yfs0MGtUXmlyz!>kl^qzk+P& zRtApi3AX~rb%VQs+>nLi}AHSS7MHF^clzpX7v@mdCiMA2`NGW#BsZW*c_`$9U&BaExo7 z2afT}?K02gdkDrU?~r*KbBt4d3pmCpe+nGql!xU$&iP=Ratip8RvPVp2>e0d*U9~Y z^LYsPPvtsd{xI-Ssek5w1^g$#9|8WqVcq5{z(4;wf57=H1HVKTLYaRR_`88W3Oo<| zYrsDO`~>i?0)Gtn&%E9ruw9H(z62cOl;6L+E{}1_{cosqj8neRQRf(^ocFVJe$xNx z(l-OgIAtGjj8pCgj&aI$KUdEmx58xQ5ECI(j zWeqsSDL)0i2Kit9CV#-~^=;s3;25Xu2mTbuj{!do{3F2s5%_0-e;4?@z@G;GE#T|G zH-SF`{Mvuz54c><0{;;3=YSsq{ygwc0e=Dbi@-5XdCi->5ZlE#WehmRDTje$oU#BM zhK`w7sQn7vq#G zfuDtZJ`em~fFB3`67VaptmpqS@OJ>mIORV8=Qh*rX5bj7+zuS$lrI9uIAs|)-&1va z3OL3oF9F9mCB4IIvX2<2><5l<${28rQ+^LP#wni$j&aIS;25WT9XQ4*F9OFn<-)ht z{l_@vD&QEWTnilIln(>PIOTJ|F-}m1{hF5noadvo60K`sWC6j8o16$2jGq zSJ(5wIAvE?oxc_GUweCnaNF+Z)wo=pfHgm?$ua4H#K!&ypYKi3%LWC{LI8e;N;EI zrrCkiAR6LgKKGFmx>Tsbo~UCxZ>Go|rLR5w?c zu2RkXMkbdPxp4JN7b=Cxe5P0^m8MvJrV!7wI-Q-Yl&7YnMzhnoo=jz?9FgIQEf=U| z*|}JIaorXxnW>wphn_>s)nrXbE62BNd3v0hF4t&-TW6-6&r(NqeYr9-k*QR(@xoBG zl&2`8xTF3$;u@@GoM3KhVuE^2pgp2S-t)*PLho*>^L<9ty-bFK|?g&bW}5%b(Q<70BRZk?N; z-uWAHo5(kMLDxt3?%qZ=k>A}2NN9JuyNRU@ahK)zSh1RMMV_F-HkZv06FiKLWb+f* z99=XlI8m6O)~z)bm%t4?e$3&vq_dHcM;pNlX&0rE7CC=WZ5p1PBQ$1H_bcQx6WL1D z4TZUBaD&?@mo4RJh-~1lO+qK|y1l@UtzFLsDrWPE@OD-0< z>?^UpslBN>o;y&e*3EL4bbX0>J>PgTZqO=BH%drR8_t72oQdln6m73eGtFP zE&IY(W@rjB!uM@HjhXXZGUJC!Clt@xO*>R3X5gGc(ug$5Rf_CoxC|8<8&x7=Mo+uJ z(_g)G^Br>~ce9sDbvo8U@p^6eCMsg=I8*kx?h>_r~mWh3|~hHN*8e;!HVK5#$)1)Xcb_ zIspA%&v8ep-4M8g+pKGU zhHJ6XIFC2uMi<`{s4AM8kDF&?d`c?G_oea4(WzQN$_MD$pUmV*q)C~LWJ-mxZ0;5s zWhM(_Q`PZomBNQ;o%58+iiWdoEx&r_iQKLp&u@JD+#Bq&WIyXv$UhB`iNdL%I5b-HlC67jje6c^ZDpG#Nif zd0flY;vNbK19ih)gXY>4BG6bKlyJFhb)I`3yF4;pEfppcG&J!p(#N?BK0cz!&1`0L zIy*)k?407`lN3$0EZvxEq=H+p?C&cYE5wR3Ri>ej#<^Nh5fik-3zfW3;M%Xv!%@@S z*`~@fC5~5u64);q+B(qAT;~n9*F=WrDiqM?iU%^I+3^zE#+;>x(48VC;cTDdJm2g_ zr>AIaqAVt-s)ep!e%}pOJL>^YU2dbCy4e!WDqtT_QC8O`u?J#;2BQ5mao?g@TZTQ|s*AmUvoJlyCz|WqSErlM#$2YNvdK&(dlThQ546=X zw~9`!tjxL2p+36~_pg|l`pvvvNNPkMchrha#9f1eBQE>y&Z|G;qvJUm0b@pKO^>F9 zD5#!OH(|%Cx0LJd$dr-iKE9JRoF&&HXC%DLm8K@^nQ?sFNF=Cif@zWSh4r1WG)`H0 zP~aY)ozTOk`;{Akrz+J+meJyIT!_ieW1`!t7-GnMRERG_x}QJ0K#6}d>bcs|GaoH;sSYtq45 zb*rJ-5@$F;3*|v4`OaM{8#l#h$t^EA9&uDFrb)MUbEj?q+47v~T=_K!^Wfb8+(J+T zVK-^;8>Ob6VzhVgoh}xV*S0m*qsh*4KFL-`x;!sG{4}cr-KV>%1z$3otB+1%`p0 z>YFBM<~-HKP1?I@al2e9R11wcxa&pwe_bL{G(WKGicqWq{HR`+3O8_LwHIhmpU#nQ z&E27);;H3hW_dj2*n!u`WSUgY-cp*%Mm6;IdoCHh?yU@Ww}x}n9{}!qfhi3EuCR?b^GS z(>|B(acQqhcT<}0O82+}PU&EmJMd|`+a35copuM3rkwO%YD~ZAmaA0zoGF*~xpa?9 zdnu)Sce?{l*`hn(lr6dgpQgLrflt$EcOYrX9k^ug9#(Gvd-cF72h1jkp6& z*@!#vX?mAC@M)U9xE)+pW=`Cecja!~2hnQrHnOZ!~9$ECfLvRm$e zQ+CT8Pzs%Dmt$$alY?%@e40*s0iUM)8FZ4H-8K|Wsi@1Roo6oXbLk$J_EO58xdTqw zGk4(A^e%Vc({#5x@M${j4kS(agIZx|98GsQwm0P($)$T-+Dj?hbO)TWO?Tka^e%Vc z({#5J;B>Yto%TCP-7e+7_VWLoUQOTEJui?;-{ARP*0TCP8(=KgG5bp1CG@+!{GDAcXB$J>I{Yqi#~Z@-_e(+d zi=6JP{ZEj-Wh~ovi?=^4ifsP^=5nm|dtVo}KQH$CMP7H-R+{uJW7(qE*M7qGUrirt z|Kkz+t72c@m&BjL$|X35_Mqf6Wi|(*yo?rSo-_=rU|2rgS84It8eH_2}UTN)LlMLIR z6Z_jZGuW)Hy~(is_W$Y2kK-qaHraoIoO%Uud;h<)Mf~D(wTUi-4TmSstAj??%h}a+G%B79%^G_tK{VX*Q zi`e=<$dyIgalfmj*4B-rZy5`3Eco_E`<=wC{ZG;Sk?mi~O0e}`=?}F3=qc6LeJ|aV zL;eqmep$+|`qtMp>08FK{a^6@>;LEC`uo@PQM>Bbf1^PqWPf=F=aNY1`_KJRv#mQw zKV*ONZf`#Y<0t`hzX%Z_of8vOgsHTlJskNZ-XOh*Z!o}?@bgGh3pqwtiKbH`mc)q5IX~#_4O;HZyAfH0{;IBaqE9~B>p|o zqW`ziqC%+rtD?Wv{qv$o{hbkg^;fIFmi2UG{5vc9Tg@MyBz>DF+ZqVe->(Mh@4Xj? z%U_njX)FKlkN7_;`dj(Wx4Dr2!vX(q2>AcDi2u)v{jIK_CnDqLS<&BW{P+a<6zV^1 zJXxb{tNNQD2SfVpqMzcEu-UpQlD=guJ}dRNA-a73{&o7OKYIPYH)6lP+bbUNyIN{( zy(eP7cpo(^ZNo10@z;&?x3<iGOVTwI=peUb1N_>-S$9uD^BBFRP;Lt^d!HzGW=B z9PmFwT>a7dyCBm4hIV;_^L|%Ln{1JO6C>%)W4`|8M3dVuOCM{W-(e8yKO18Ipy=z) z+T!`OWh{F%U_VFP+CLB}f2qe?RC#~YZ0l2z@w?ih{x`@#sQd?8)PL;tVf|Z0{~mQ* z_O`B;N#8OS9pHhHHf+Bl9cz7P|M>x3KOz77IM@Msf7ER2FCyjd7yYgJ|J|e?@_$wQ zS3kM`9RPonUlQ?uu|@wcirjyXivCvP@3Dyf@fP*(i}=6NqW>>bhb<>djjTZIa6d8XvMSq8OT-n>c_T!%m+rL8I=b+b%W@Gg)y)>-9 zqecDqM&_?OTh#w-M4!G8;0`_P>4^Q4V*gCdvj4-{=l`!^8A~4ivM>LVS98w~K1P3A`#*`;U+(jY zHg9|U!-)NXC2wEbnals51NQlyFrn-JgxDYQZq!n1zc(`e?%>5n-Z*pEtbUsGEo1Rv z@qa;d+5g+*srs@wZ>}Q(|9t*4JlA-!hhMd$76wIo7lOUoX$U zZTwOe`&*5_7e&U8gQ8ET8#e1}TV(u52K>K0;D0(|e@^TteKpj4u=aOG?DvWNVbSFF zzk@!u{%(u(zr}rCu_*ewv-Uq0>3{QLe^wOP{vXlD+Fy*=?~wN;>Hj;5+5fYM{q~1^ z#jS$<`GEaHxH7t8u{(ByAK!h(E?E0F zkiKOs*YU6~zkUyk?cYfsYyV*6`aRQ6!nB?CyIN{(-5j}o7mqjF{|x0~?N=lHfAv~# zGQY+6Hx=ps1CMz7Lw@J(A4dZApP}!$gvRfE*LnN;|EK&>b6uY%eOo6idqlpta+u-+ z-njlhOCMYQVx<4y@yo15aV*V`aI>~@k^bNLxG#7=l>aWu$l5Mg zma**O*S%tg)IaP#^qJNtjmc1?O zUedRWMVJ51mw!q0xcpzFkCunj-1cAE!}jyn`||@Lr#oxwFzH*yvWLIn?c@0Q=fti3 zKfW|<|8BA0sfJ~5ZJmnfpA`MA=0Bf|#D5#2zjF)w7e}uDD+aw{&ldW7BG3N@MPKVn zv$5sRM)Ze7KdFkcxBB-+>Tg!`x2nHKBIEBJqTjcL{nxxP-2Nv-e|QW1SCPIg6RRAR z{-^z%`~SW4(fU+=Yoz{m{yWYkk=V-r=OXw2yy!2vTs z>FwkFZ;80Izwzd<{bTRvTxi?E{&S=svOoOy-u{~CbNL^lkG21a$oCJAeSnSA|5x|B zT54^5Jo5d+{wJF4AE#Wb{SOfc)&D(wW1>y}|D8W-F6$8KTc21q$qzhBo*QM3I&Absl-%ML&54deXl1aWKs@?_Zl zW&e?LNhA(#QU8}D!}b?m@b-^D`5&kJto<)V`u|*pt<(Rl+QR-~r2h|WG}~XH{H*=$ zG`|bg|M^*GK2i3&T59Y13evZXh1dVd+aDH9ZvVffkF`Jf7H_{>v8>^rjM3i>yO_NZ}Vi0 z56M4gc()dqA#GOnYP!HJW4X`DKVNA3Lq4i+R<@J$jR_~*@kZaH%j`I9ynC8H*8gwI z^~*B2ec>)|X;>RdPFnk?NIzu%@HS6}f59uV{b%T7?SD_~rzC&fUHBz$=@su(;`eG_ z_aCQX^50hfH9ztaA8b^w)wSyX8I@1}M$xS3BjdlV>;td&%=X`+=(kAj>M zs=xJKPZ#6{!1ebceNU2{Yn1rC^?xB^f9|?w`x}&nwZEIb|76R~ zme#KGlzt2EHn#ggO053dyStOPrQpE-?bF_#9(SgE zeb_kue~NwviGKRM4C!4zaQ*v}oo`F#O7s@lq`X@)neOgNb)}P?rP56kSJPWQ{!<}W zP4@KAdnR(Dds3-F_ntkez8t*+VYGKNM}Lg;%34 zwGP-j5JC4YlSEhT1?uKSf%0;a^e*>$5qd{S(|bJfUG}=Lwp%$)lTg6B#F{9-$7E7( z5r2Y@`SU6x*KdyX&|VL;#OU;GSyX?kYn(3eV88eyHE8zM|GjiR)W_#VZ$S2}$Mt0U G`2Pc~HoT?) literal 0 HcmV?d00001 diff --git a/openharmony/arm64-v8a/lib/libwebsockets.a b/openharmony/arm64-v8a/lib/libwebsockets.a new file mode 100644 index 0000000000000000000000000000000000000000..e42c1547293e9147c0d78af5f026bfbc1c2a2015 GIT binary patch literal 2186418 zcmeFa34D~*_5XioCX)$aC!l}|QBe^!5I_XAnh*j6LK2d&DRr160~tv&VJ2a515sP* z3huU5?5@;W_ocN}YqeIbb?L5cwbj9kMhiO z-}l_@+N)0`ujJ0cG!#tN&sr&yJQp|MtCX zmhu0MJ?``7|Kz`MS6^rTlmGT#eyQp2-vRAUnhDEJ8}Q%6>bng6D?RiVxqmNRX-Z$Z zvSU*=-ZE=uye-+9ZcE0qJ(*P3I^$@vOVdm;(PrZ0-;rJyJZ!X2na%OF9qCQ+)^t}- zCf#9DT|LRn+C*zI-jj}J69z%z9m$Q!4o)D^c4}|7C*GY&_oQ3X9r5mLTh^wW>S_xx zlh#B>M@yo0eH@?vf=_&7dpg@Qa7gPPPh{5F1cT@~T#$hC>`Hf~AQGoYyAqvA8*zIQ z`RVOhJKH)tl8H>bwLR5=tS7tLpv8E)E50d{>PfV8NRW+W*&WYzL&;1zhSX_PlZi}EZ?}bhlIxN^ zHlOSjxCYEMOK@&Fl3nY1+H=7eb|WTNXQ^TDcOsKS@U}z`T92e)SoNoq*xO^Ghi8hc7R3?fE^$;`%NTf8OJlZ!W-Ze33W$dx#owN*xu^kzEHs^TqM z;z2_poNJG%Y`k@yt$RFjZJ|XZ)^(zooHEl4`h})0nN!gs;@!QO)Y>f^pbH%?n{2f? zgl^Ep;K^Qa^`y{nTYA^7O=gld%Rzrb##kzo>`ZT@cA4&s_oOE51rM@sq+lt2v$ zbrbKVHr<`ZjihWNbUmKc*|&E(Z)Xsw3bUj=SN-J3w+ciCsC@F02GN?xWKzj&JeB4m zuumqv*=mGbQjowG9WK{(vR&OUb3JRVudUD)7#-{0027l_Z??CS`jWJO-mVn1-;+sn zWm7$PVY!ak{PajSj6P! zw%$%QGJzv!;X62kP@a?6n98Qe7?KT(2S&F&(bWb8Wj52;!I==!P+wbHzpOcq5koph zdrwbyytN}mHi1VXYEU*H;%jZUHjuh)N_w_D!$9z0liw^@%ynfaxfXgA>l~nt1X{ke z>YPF6;kpY_Ze5@6gD7~IY(-(#!H}gpI$$$WT?k6ODHRt(f_9ij7Hszobkb+&a08&{ z(YL$x7d%hOGer6M;*Lq}VPkvH9^y8$wpiNF8Vw`1!z&M)5m%m6HVY%3N!V&7ttI1J zhukIdEF8=ms<4{|ORm~@7p4qiS$#iizLlpNaXrj(whG!{!!qeD@kG0Iw__+m1LT1j zX;Ei`HUQGppiKvcSvzLSgG`QC5g2H=_8{AqNu;{SCepAR7)%rjYJ?SsK}lq+L27S9 zb5D2YJMs-Yi8y`u-JQ4{#p11K@jbSMd$ha9T4F*y=^j{n&sgM@G||(8F2beA<88_Q z`Py{G&fKg3*9=)g$%3y$6gSlcHBm(WOwKBs8XFH(oEJA_`8HH06>&@*Qm#Nyb9(|4 zMmLP5In9=IZGy;(u;v}!mFFy!iiQ;m~wS?! zmo;u(w7QYO3zMI9UMYIJF+0cnM#UzhG;6XY-L@rf{1i`KAELitQb9vQCQbu?wmq?4 z`jj2$WuTNXm&>p&*_F&tsxFnha6v5MovTtOPSXh3B1~qpHYv^~PwNt`G_Ql&Y2^T8 zgV zx{{kr;9vt4xX7!zu`v$gmBzSY+pGrhE|%dYXGOB6si`(z)w~kQpoWm{CLQG{C*nk? zO~O7VdOPeK4Z|*V1K&Hj*{(&B>F|C88+%DG^~Rku%(W4s?-7))px* zrG87iZWMDn!CAiw7lq9z_B z>$i9EwE7IZ`{GjxfV@P{UCQXfq6YhkXr3qIrZ-_T6u3qI?u#Gd^IF_?&V0jK1AcZy8HmM*) zJkLJj8_VP6eSkR?I)#tG>|B7|Co3@FaK@R zQ+~ed8>;K5-DKBWE9kkYwE50>S1)#TNSumF(_7JTRb@aaYcv^1t;NnYnxd0dJeOyu zH7}6OIECz+28`V_TEiteIclG>YanKPc{ldcGMOJ7f_x_xv=z}i!GWDr0_E8iDYhU7vLr41~~Cy(<;wd z+7Jz%dwA=bCRQHGU0hyUU|PeAe_n4>oE>&C&Yoi5@>elbebyJ!u5qFc$#d+jU zG8}cyz`6AvO;BcT-n4;ET5;OK7CxDMUP+)owPEMZiEK)?h`Rd`qSUZ{gi_mS9!xuf zTy)2R9T5kzc%7CfVOPA2@@w8MVyS9rO_i^oJV`Owej^anlEQ2Z9YS{5sKDYQbLaA) zp7Oa}BsMLqEH_v|m(y&d+dg$;2FXY|C~r%5cO=lS>BWR?6bka&3dOjaD#mXsFr&76 zKeZ&{iP3J6zHI3Vy-##;~lh&JU^t4MyNx!VcAI2b$MGz@7CO=IEQY_q`TvZ z?r!Y1r#7M**2$|&_Dtc8XdLea?AzNM>h6&@PJ-Ol9VtLIXC%SAw+bxntJ()xfn-wY zwv^q_6CX_7ZN}X?fU1ICVeme8vWrFp?zOPicrS>xVQV|~VYZD(39n*&b92W$Xg8TxwUUb5!N+dWEZye?F0dv6yq zi_N@F{x(4?-W+puGzfOlJ6!9^v+CTpE$8k@t2H;_#p@6D!G2;JUd&;`j-6xxI#GUF zJTnN!L?^w!IaToJlY8ePLcG~V*+W0< z@5>Dw3L8YW5xAyfr{(-++v*EnJIFIuaQYpAyxkV7O&EYu^>$}ThLEglxlsXO)0t}} zr?F`>ryb3aU{tg_YP6>2ErbrYwdPkCZ@Q6)%_?nUwzjaIH`>Z@1dSSxIVt--!f*J& zTPzYp6hV8T`4Q`XY1fcmXi-&G2|pUFz>I@%MIz?;-;Ng-`{Qo z(wp@7X({=hhdAO{)T=R5^%rEl@5lD{Sbp?O!E1_J64~UenMc|8+GVX}>8Zt-)C2=- z)*?Fu9Tn749%V&lBnmMy(ipZMct<|;j!=aFISIFFLaxO=Wd1Yemxq=@n%)XHPT+GZIWX#T2 zB4*DEk%@Z_51Czs#*E$*+t&E%AT!5|FuP72YUUhRXlA}1DcbYLF%`2<$ ziBtZBe=p+SpYiWC{Cg!be9v%%FOF8sIkCuWc+r??$+c8jr$1N@K{Nia8Xf zXsFqB;1IKv{DzM(BR>p9*6)d!=7uv1n$jQ4eYQKg|BUifdiJ!M?%9itxu72Z-VB*J z-BB~=$-l;CU3_L?Q{B)BGp5vZ&89qe8Z(RX|MZ6+?tA{2ic6=YPM!TEp64Q580n&% zQ;Lk4J`w4hiu}cmne#v-{u5)ijiS%tree<5N9E~d3h5<^urE^iLKSmL!@~xDeWaQB z26Xbu*UZwQ1I(z29}8{xGd@#@^G%z^=ttodbK)+u0s3zq`L0*4?;`;grA0AC?4cwH@QH5sd*9ZOY(s5~=O>rVkmrexnPeuIXe_`m7@n1k4 zcim)`K8Z5?8fEF)-%A+2p5pfKUnq8De1a(jC;0q|r zn@9uYWB>J`9pj&ln3|I#J>n-*oih2 zLp@EyC)HO2J|p<-#wX=zWC6+$9x?dCP7MVFOMn>%EMY}t&$n47EliOW^895PYQ@cA+wY$o>Rr9LnFIZT! zXmRb5y84EtjZMwVmaka3>ZC+VD=fyk_SC8CJ3714-5an|+PiVn<}Ig9E1y1N=Fzi` znLX!-spgDHlO~-Rc%2RxT_>DaF+j}LAMu~O`s1g>*Yrund?*(i4DU8Xo|mG1HR0L52g$fIkud?H^KyS$; zKcGv_ed=VLMt6z;Yt%X3&%w}c=UAOnNqDz&xJ+>Aox|x1@ZV9M%c}bvD9f%LhRw9y z%_7_`pCPl-*_9gtl(8#$GjdTx1wUaoD(;k`u=n zGbn1p`&vZ7i{Tuba}J)F=R1V5K%q%==x|QZ{0^lk;EWe>d4>dq&=1@tFy}L&qXuD0 zYOly*d={+0t7{$>pUb zKWi;EFO8IZh(&WLw&f@B&z;F%=4DR_Cx1fOV?{>`hEfF#CCx_&b5%rKE##1`Vo3e# zSN+2JrqaoWm$r7`>t&_#V!pI|dfBwH^3us29UD83!luxv_}*3N%$eoWXSc3BX49;t>{R;8lBxK1Z)dt|3%)W+e@QYG zul6%-^pYk!ed_dS)A4`#w5fU98|0eWnaZ}VRvRIRay3P{IzP(QUX-g{l&f2M>Cb`k zBE}ybbz)y-_JWn*LIs(4e)N!9V@RSnhgxbgm`fc`=&|8KFd4al28 zegAeV)rD`F^OuqEha86fn1f$nw57YS?}eRZgKvG&AI0=y*J@o?vaOUefDKH%WotDX zdhxbkqcQ)L>cIAhy+Wron$Q^&Li-Jw$P6ZmFY1i)x}K=k6g#<)Y~5$cc-hg9~d5BlmAz6dh3*dBiM=#tIij zCl-D(dceZyQH!HPY8Dqp?t(8;`o39oPIPE(bmHRZ?3(DlkSksk9ZJD(gTUm-lV*E# zUy5)C#edV*?a{%JA0b8v4k|n^8d_2q`SR99kzbfa;R5K)ctyfrzDEZY?-LCdE{a@( z$Oc7zPsJ)Kj2uoyTCu2*F-r3WA{=~AbR<&U3Be-)wnqD zTofHoEn#tVa7{F}I67%@bUXPg}Mw$UAw;1 z-{&s@3(T7zYQH($@TnK(U!}}>w9WI_k9jb<27dc6$B!+jYb5hvxC(rSFdrJY-9wBy zc1qP1X6~#?&hrC)9F+s|bRx?K(}}?U5a!qcQ`aMKhfEB!4STt5jQfQP4*ba-!GHZ- z5z{w*E8kb2miN`C<$d*Od0)L*-dAsy_pRSg!DEz{PiK4Endi#o?6e!_OQ64z6scUU zM#d=aO6267UR_R{yyH%ujJ#ipPfI$Q&x9OZnqM*i|M>v?FfsW$o?8aslSDNn@5)a3 zczpnVxhPJ{zc~QkC{0JpxAC;hme)`BxdHga($sW3B5tTZVYVJzZhB69OhBoP*vs){ z;@-#O?wQbdk5fE1i2G2FyEZ`R2#=HeTjD-OJ}LixdvpEL&#A)y?s1Zz z=%!fW@ASD<+=D$%@;8Y5aF0{`XN%j8M}7MR-b?Z2;-4XIXE&Vw_m_S{JWlaHEAqQNPV%lE_jsJ-KOy$$W{;D+%f~kqpDOO3D!xJ72+9}P z2fv@{am0;Z&SsLld!`87dc<)z4!T{psEU7@P1X?iZA-#`oo~mzLo>?8&kPb<2*zH#YI- z$yR`(ETgYk^j%Z-Bar{IAbt|Ol(Zn(j_;V_uU_4XRu-;#()fcxy|^kvuJMPqrYyUq zlRhW4mCd2sY`Psow^?*Mnr<`cHiK@{&7{p`XL zNtezGfBgjOoG10?Je8B%9x*qrI=Kq>pgyG=2ebuG|17*~zb=3d|8aO|MzRh2+7M1l zG)7Z7UH@?H{v5FW(sy>u^#>bU-?YwxM}O&W>nD9ONjm*0NSxB2?h=sCC!|s?Rh(q$ za-Yw5&+H+$QzTQHU4p`0I4Ao9JoK0UTO|MO5`gqaQMu@x{>WR$31ogE6RNM0!@IO> zCHyoa@v~)$|Els-PIEkD`^*1WY~s@OsCZKTX%(jPe=wMi6UeL=qw3lZF}k!Yb(8+m zf8hWYH*4&Nq4cRpI{k7mic_ca8A<ToT$AHm&)bDvA#9G|@UH!R5lrU^$UGqF z&yapZj4my^8?3+dyZcF>=IuKDcfoYofz10d$zLg+lrD8C9X|gHWgq<=ubFe^Otati z`q#hXHSOD!BYRcwM+MeCA@gA*^z;X(hi-gtMfk>d>LWLPP-S)@e>;mp6?@;t_gd)l zm6+N4V#Mq%I=*Jk#B#G?N3m(fKK)Mm-cxbNj5s3IK6}xi!56%P?}@z|3DbAQru;Ti zvZo?6@h1qk>xIbZJ->;J*@I*+N8yj&aV+8)YBn4=$TVyJZAI_TItE*!JLb>5w`j}6 zQ9I^`@7)nb9*nsY`r8Rr?mW<#U32lT6yMvSIA1_oFG~D<;wvymzZa>X{O9H4fr#V- z<#_?$_1Q71X3h--X4Z}qY~Ct~-CVKvw+OrAHnaE9LUYHX;V~DC2}K_7jhH)j+*Yx7 zGCn7U#{BV9Pgd+5Q+~y#i$Y@_C)vr-ioM%^Q?d7Rp>2&+_LnGcp%Z^nf$ukwo4ymr zy1;kJu)9ISTc2|MHd4eguS6>DHKCHlr0-W^6?+dyebB!XLq&gl5qW&4z6y0W_r?!S zue=d;xr@G|hA?}PmkaQ{J>;ErcgK!zRP3#k{DiNadoQK`2maoX&ChQnPm~wZ?>5ox z4wQ|`@}Pt*LfL+c?*hJre^jPzdp|syboc0AhtGNiGCNKfH0N2wOYskD9C>t&X{a&u z-yzv!OKVp&HN_V;H#fu=R#(oeZfrWXv~F2#ZE2#t*nZcO{`?a{@v6$&+PRfgi>>h7 z`gyD3RrO06YO9-T>g$R*u4VX}2KptPwo?8Jozg?vph~$K|V&WmwN+*mcopj*texj%l%j>FI2hmBW zcgv$NqYW3}Wiq`i#>?F(=8u!{o_Bu?%mul($x#wv0n9E6J$X1|``}fueKQQhPXqd( z0be-N8)ol?vwp)|Y~L_PN1{50ieoT2hJ9*#C{$iTkHgR39>QztU2`!ujv##5+_A(* zmW4PIQF^(3{5X2OJu1pCsY~p;>d_?-7#y{Q95WP2@%!}XY?NUi&j}Umn{y5xJaq7o z!LtF!?(2mg7Ze&kr{C%J3fC>9jL;8{O{KJ>qZ04muQ1+R}_+G?!`wfL+ejd#CA$%Xo z_hEb=&i4^~AIbMod@teqXugl(`#yZ%m+xcwK929>`Mw|D?XK1V{5*m06Zu}s_XGKU z5Z@2xyWQ13gr5)P`(b>?D39xKzE9!%5qv+A??>^yjPLZm7PEN1m-Br(-|hT!CO;p| z_gQ>DhVQfaK8Nqe^8GlzAJ6xX@%;q8pU8L2B5+mmeJR&)6@1@j zMYmbYu+0i@v(ke-MTBPN*$xhCNk68EegE}JxB2;x^*1lq;Zv=}_`kXO&<8ye{;sW$ z|9XbKG{a%vY`C762+!c4$j z{rMk~=id-2H^XM(Mv-Op})fQB>#zd4U&zCs`A_$GRq?p@r&V4|uNn*rV1( zEjF|?_LS#piv7&G9yknsC&yl}uCpjFt7C6iSNI^f;;-rfKG+6ufDg_F*xv`+0rvC3IRN8*a4x_&ADoBz^1eR! z1SIzH!6yO6_+SUXXdiqEpu`8~1B~*)1pp&`a3R15A6x`5+y@r}4D-Py07HGS6JUrB zb^#3b!KDDjKDZ2EkPj{gDDuG-05Koz1}OBw^#D;Hd=8+%2cHLs_}~VBun)c(D=651 zp;y_rLSjDw1+XTeI|0V~;4Xl13vKhcmYU?fu|?MPb#i?>R%=~fB-aD6CDt{CTo1h`C3fo>#&&pI?2hfZJ{H?5rTOO9SO6+1`i=tMcLpTi#>wS$x$1E zyZP#95&N(m`FL~$I|h?ciATq>gZo?}TFMR%(-OrZ7Z;6(q1NcMoTDu|n;mzOPcmA; zj*a*lOsGA&kS$F;Wiu5u)(WK%OQ<7SVO^ghS7&sdb#d%n(S@EX9c}Pj-O-hvYeRHR z$dsIj0&#r2c z&`5`MamyGHIp1@Qj9f6-lu(1^v8^aHjv}Wk^g=jB^+i|V1>>86_qz+XlMTOaFADwE z>VymXlIY}82!vh^7qGTCx!;8gbB^DKV}_ zHTv+RF}4-5}Ch&?3;xj;A%!9i-UxU}4yE zeWx(uxgNsielC{p7Dhw4Deoij8(!dn?*R<+!J_~}eeivNAwGBvV6YD!2PpQz699vJ z@B@G%A3O+!4WNx*$S`wMi*RftC!c3`xeN$ zk6mL6Zn1u|X>~QOK-PV8$u+*<0qe)Bzyk|p-M5+i4k~!c^E z-FHaAE7tWT3U_G18`gC&zJw4urr>?+Vk@#d9Pvb^Ano@+(H4W4Ud!A;&8A&v$& z@fHuP0hr)}1i%44XaU&Y2dx16`JfG8{4HMYk_C5I*EdP09R>Gz`ROdU&$`$SrVAeM zT-^oV@mw1UzU#R%1&?^HY{8?}buAgNo`T0bS8u@+*2OcnO$ASe&G>m}gWUK-*3fr{ z#@VKR1hq%Jt>Bi*cJe@J>g+g3nmRiUmZr|_ZHhE?oQ{IAKHBhRY$Bn=Jmzmh_%Nbr|i^6tUcy7u{5%V!+eYi+8AkL2kWjmVvRG~&t;KQ z*@qp=BkN7cG(>eE1|Iy$>coTSlkyWQHT+Bw#11UTJs(tP#-|X1l@#`7Pxps;&eRZE zWfjIl`AMQMaah~Hr8-#@CJt*G#8H|n{K=v)@v#aMhgBFmR{IKD9a(5fNRK6hktH@+ zBf_C`ZML|-enPUvj!#Cm5gB@T_v*@s*dMkrS4CvCG?n`N)sZ!}&vT7k6KS_D zwj7_1bbGGPL^gZY;o8VH>*AfQ-H{#Eb$BV_ygstiy4d1;E^@W!`h4Vi>tb8@g~$!o zRYu{y6uHH7eK~TEbsc{&{BDdqU|kPkKQDAs(0mvp5$GTmps?qkykv|J&`|ou6rYIc&=|m-tk=DjJ)r;?u-20bA2abY~SRZJrpVM zOwo5S_DwAE!1n+q_~2211Bz?}+|VD34Dwu$M~czagN4#IQ!*1ZI<e+=ko3XB2Z2 zq>2uoS!_E!&v~~N+cwOOvy1Kc#*TA}Z5w9CdBwI3Q$2=v6i?>Z*l}U8ZNu!ixY)K~ zDr9(9aRrO9^u-+-lXpdByj4I4C=kz8cp0YFJl1){Ljd zB?hA85{mP37w7EoAMA{jbMUInNcX}!{92(^EzK^&Zx&kBvg5r%t6EmZhlN(Plt#EP zW>w2#MX_n7&qMbs`s!qU zKA)byHjSS-&acnr=XHmG-&(=XveoejC?yPNrW2g%=yihBncn79|WSOI4q zcqTuLD0(Fq>Q%24uh~+RL#pWYB2zL84-=2WEjFJ60w2Q`R}&uKO*^m*sA(7J)4m21;a=Y;gIbG6Ub2zvb|s?ISNAyxy{v( zqbOvX>q+D&4y|OLQ^_$Tw8oVD1^Kg;O&jy3B!+uz6lWbGwop5Y?qk3@zu%UH>+wNb z7Utje>hTe;9v`)3A%k1=*kq1}>-`B^kKdaF{-mwPx9R!m3YM8d<$ZQxF5Ms7dgQwP z>B=1c`I_AGFWUH-+rabf{LFRztL~i43qAaN1I7QF&HPM_x#;C>rlbH3FE*Tw1V{~6 z@RNKDCixMPRlMpsdz6s$E@u%s>6e25gSL%|l~ zVPXS?I@yI<$psr*G~O2MLK59y3idg2OptyGbD?v=vdBdQPDZMDm>3-mfP$n3ry@EPWEFWdj`u+r1o)^C%X-@?oZYtOG>7~ zKXxo`oK6LY9b0rhhvoKnp$*H=7u%-7&1NTx)`4)gXq1gnXHYaHXXDQC6_v&=;|JuR zo+B>l&2u49- z8j8n5OG;JSmBwE??A?#7T;j!MQdiX>y;2n{~&29A-_L z$i@;H<6>99i>{(;NzZ*6^3uaactYzK@QhW~OOSo)4xQK61?+z{8=d>g(#Nk!eIwRa@UwZ9{l; zadmY=ys{RhvZ1}-b?4vMUe;LC&=jwkS6glDV^ei?UA(EbvT0!-5T94y+%IGgoDqee z)$VC`r9*U3oQoNc9CJf;V^wt>N25@DVY#6=>^WQbh4?I~F83||YN&f|ZB5fctJ9oE zRc#Go#CQ7xRp2Or`o{dwA~e6Iwz;}7-hg9Jg82Fs41D{h1~qf7`Z*xRe`k;%Sz~oo zHK{(YAOhnJ^|tBw@o-7{4J8Hm$iOQaYnrQ}D3xeabt76@d;ni+OZl1P)dhQq0N*9F2t5SXnm@XIm_;mcNrxvh{T^WlN|KI7f->NB!bT zRoN0Bl%YhMmNhigH}=tDL!+p#rmluE4L z>gIU!LWGzH1Ct-7a^5`jtlHZ6eC08(y0(9hDrjm!b$m(vyz2f1YU}YwL=ZILjiNG2USk(bV`iTRou2j`-4OtC3glmKO1)rYL`-mLF#m;-W5BQ#Zdp-)8~pcsY%ac{R^@Y*?aXJ;e-U z*Ii3=c0>%%N7#|Z$`$d(mHAm9W@i|AIU_uPDJQSWdG!sdECG(wAkjCG#+3tj1j!8G z&$;Wzj}AZTtLUnQHMR3>*5k`-D(P&qK5Dlz6tB$da-D#BkgNF0=H|+(h502}22Jx{ zBL*i{-~^N`ovg8>X+eB`ZT*V)vO4PR7>NR6r!9dK8LD1T&-NfELk*mA6G)L-^1ysV z%abHJ->|7UKDQb}NVO4H{bDmu9;+JBI%{j|?TE69%@jJflZ1Cu<8qPlAT=K4L^74l z%bGk&r!`iugjRBCaifDN^bp5Cuf8tG9i=IKqq(MPadlooY^J@?x}a6mLNO8KLIrYw zeuh_&@y*Ygm548IoWIHsm7m;-cpVvEwh^9`&O_4*(WzI^rba(sPWyqR%mQeT@U#!_ zzS;-$3j?Pvj7U&jx?H-Ld_7Z^JgvalCn776rxl3xRRTqorz(Jcw9-pM6L3bB1w{MtqsP`LT;n6O5gw1fgiJH23y>>MEC@{9Y*fWuo8=px|6$I`oSN zoLbCG%k<2B@1F!Lf8#jp#*(oZ4mY)pb3omHghr?M`XFc zH1VM+4|-~qi1ECxPo`blr8%dk3>1ngkVkvBK$Up%ylngDj^%sTG&L>5Qqc9hf8sU0 zA3yrJ1-Bc(%J=dDefc3=7R9Re$%ymkuFTV5G;-R+@*{D*A02vL4HhZbO`r*zFXG~9 z!s@IkzM!!hzw1!90G1RMWnei;>!ZXfmo+aG8E?m|Gu@Un*d}zjYpz*RUB9f^D0jTl z<;~Sa6ZU#wJO`A^gc4bwoA)+(b-7Uig7LhfW z7O>4RuU1`sEUd4k)lj^$Z&lH7ghpA}gi&{HB|4uRog1g)HR)&GVX5u!$mE{lq*02` zElu-(XvPzCwy+7KCN`l+#diG0|9s1tQzOrkokdb!aX$w{0rsfZc+{Twll)d%BI%l?cQ0 z{7RZdI89FX%g3WPW;JA$c}vtPGf&0_rCvqT1<%s*&+*6$0Gboa3KR1dSt=k++l6yJ zjY}$J1I7=rpdRU?b<2*M?*;2@w|jYdq$6BbX9r-~OUHDp3fqH}-TYK(;)_Ly>^b?7 zW0)8ytCe%>u&G;#nGyx)8);45a@dk!j@wrNdyzF&tFUiTj|o_?4eY1B1gq#uY-%>w z*T-us8|~Yy{H*6pIL&{tKiN+qmSMfufT5Y%S3O4J{u84${`|_C+GW^g=%XQ5V-x`| z!Q4uPYn)Ek<`+i2I88K-Q!Mh{%h4$eaeHV(@D@@!S794SnoS+Y8+fAaa4e4bKz1lPFX~?8A zsdYFp14oPWq+8P+#-4F&Qfm{fNh2q0^XcU_0xwEFVuKC=MoroD=s0aE7uS8?2Ebai zBBW_Nks@$_E1jk+2PzX?+ZN}ynRK)(A8BsugXE}o5Y`^q9h|+LOOGnTC6iuDqEJDb zv8QpbO&L_0i;NDKr8Cn>oKJn`!@wy?ddP0c_9Q#`aB72zB9AjJq&xiC=A6>Ni7iRe zFlreGLK|Mcp?R)bXIgsOaJnx(){;LCHD{^##zaR7ayTv7KDG8_Oe>w6OlN)5QP^!M zq?y@*iq57mP0f-h2~lqCYiBxL7Kb03&fbom6dX9-myZ8M6s){Vazii9a?k@1Mg@OkLmkZC@Rbt)bB+eVGq^g@@&1N!1-{JbriA+-&h zm7d{Da!c<>b>fg;c}a}+2?=VuJ;@B3K1z`2KvT`&q+I(R+Mcp*+j@}HrYvQ&msBjD zaqbu7YRjM;bVM|=VB084*$<>cy2F&gq zj&!0eP8rAp)VfKG`*XUxmDU@X>_+;BW1(^IX1p`I&bDPbA)Lb^lC>x;1?}xwJKJ_! z^lxs#wr2ejaHk~iZnWAiXbV=0&Kt+C8^ekA15LzFOJ>sXt~3suH#nt-EgNJgXQ(LK zz~uLf?fKs}4^X@<7ed(nW($XwNIIgfh$h?Blj`bC^w9CosJmkn6_2K(VPjA(I7RzbW3}I4-Wyos0uoUnrzD2bf(j~ z=!EKS7(E>Rp4`Zz3Vz?3Kj~C?7(bT^8*c7T(#&}bgjr_~-@LnK>54#>&PrKJLOmX1 z56*4prrFlp*}27@RZqDfLqf-!2gbIIrfhU_JJRS*r*YDKvTGei2{>(hGUoKaaCIOc z4)^YcH^n3BisQuUcuzZ9TuPk#EVQ!Ow3m}i7k%=0g}H>)u^4h{1|8gTXch)j(iXQ9 z0v9vvI4nyG{i-@wjX2_Kd%IdmM_8Z1WTRV?VcZ4%fR+v)WNy+H0IiRrK}nf#1sZI zwBDY!^d=ktmc$sIO}0W`84h@C~Qg+fR}v3d@pA+9$I9_6ZZcO)%wa)7EL{ zQs@R|C52d0-Mp}Vo=93|y4NSS@Qo562WN*LI01g*1o$ZzV*|b8kr>LtEMCgjH_pSFV-+?- zS-La#u96l+_#PU*(8nDecAvCqr6_PcZ4$815@?j0g0ph`i8g{va2RPQ2*hFROGB!? z)Y>g^-lvo2pw+QLdBq#A!j64rlPwGPhfHrbO^NLUg^aYF{z()VY%pV@X+@$FottbJ zM<#FXux(MfgtFfUnq($}PP{f9?8*bF74GW8_66tt~v8OREJ; z9qGZ1cot#|vl#P8_lOk^cO;r7kQ9047tc|v7Osk5yUtb$2bA_ieSykM+P7^gJ|CMH zzDS-grWM^7@X5?z$wAMpExc;8j9f6A3Fz5nE2ubU6lA=!tNpN7!wL zKWB%sW_`jg2k;5l0;7T_Zh5fIW_>c*4I{k~YhBr!azi`JN;Zz+G=<+N=0b5};%NZS z#>g1PQCMEqZK4?)x#IG{Ss`Oi-%x-zY3L)7B!_>;?MOOjfD8fGmWM0V?kSE9MrVM7WSmmx;hvCqMrV+#z!Pw<7&(Sci@Kz9%wCBdUgB68Qh1O0P z^bItq3{4B|lmcT@W@8G|Pgq=>W{LR_ECH;aoyns4QiNE`(7c`piq-_GBZXERr&Tjg z0BFpnnH0KMhP1yah4}@{3fd|58rsY{{KM=D)10<+r>yR1smzNLUL?sp4YPr4cVZKc zq9l1Poj;ZGn-AuYoOSB`_E<~GMW5+nHbtw#L>IP3G0Q_MfzdfHVNIb)Oq(z<_9eLvNZmAfbgIWQDz?W? z@N_X~1}ZwUGfE8mwy6aX+u5p6uiNt^Hm}lo@`DP^&Dew9>Q}pKv~kpj3&^qHQZk!>`6D9<@vJySra4|3`51hg-0il<72)u|ze zIeX}Xm@n~)fp6 zrqv(NrF)oEvIn-b8*_g2xfIPLXvdFt>R{E-5oP;>hXh)wU_T1_Ks!KTX@dbP5WA&@ zwNhZ6*uo$%8VPoDU506^%68yXPiLZA8a79X`8a>aBi^!>>NAsDDKCiJ|E5;_#9C@)^M$K`9r?yq9GE=% zK0Zi!2nrCz@28!Edtv0ONU)$V@-oto{v|r>?dagz=%9r-w;53_D*P7C(Z1v?KHB@O z5E8ohtnFbwPn-JNK-US-dw*vv<5&t@P`fy=`vCme0r&$0@Uj7T#{j%)08VG*jiNp-7u$P0 z)8FUzm;bW|;QVVn@H+0KQ9ihJ6fYI`9r8)(`ttWE?&Kd3PU-UBGK>2OkMmz)i~D(x`}u#z z<8I6)Wc#TtFaOGs$eoMy=yK(%wNA4`@lxRz3U}pl^6o5F$DRCVMP8Td2I0DXZxOER z_kAxO{FQfb4WWSn7sc=M5yD-$4!2@vv~ZVC$M^T*@%8UcB%=87BbdSEEC8KV>$mG6 zB0-%0=3LzPt8%^^UnXu>7sQB0{Y@kM8}y0i#PwV2P!Ciyk+r_1#V zm+pHOn-k>I@gX8VPjMj{G`MVYWyYO!*K2+j)Nb!S& zKdJau;XhS;vG89izFhck6;BEOv*Jr+i2jS>7mNG{iho6TM9Syd+Y`bEDgLhT;fmYy zgkT#Lx99!X{!dA}_~%A!Mh;Z+D}=lD>*O~GKT648Bz%VAHw&Mm_!GiURQy%p)r$XJ z_+rINFcYS0sp3ZqU!nL4;U8B#E8IW3o9x4oPH*29o>uX^D!f;5oKD8q>59)6 zezxML3IC+xw+O#T@#lqKrnnIUe2wDMgzr{-vG6Y`o)Yf*w`&h)3%^y#e_Ht6ir*>x zTZ%s^{2|4EFZ}z87s(Xzhl)=W{$s^w3x7`WQ-!~%_$9)BulP;EUsL>B!rxZ>=fd|Y z{;u#372ije0#WJTPS3{)AFTMv!bd88hVXqA-!1$A#UB=au;MQZKV0#sEKQ~=eyH%H z6|WHP?7b`3D&dt%J}Z2I;-3<}MDg9in-u?!@KuVxFFdaJ5ILzQsrbRd*DHR4@C}MD z6TV6D4Z_b<{Cwf(D85Jdrxbrg_$7)zFZ>F{-4g0Eiti`m)aMjGPWY{gw+O#m@gCvd zQv4j@4=H}N@b4>rqwpUp{te;3Qv3 z{5r*t7yd=X>xJ)8yj}P$ik~I?F2yeq{-EM_(Buf$V~T%Xgilla4&k#Dr_*HUI$rTth0j&ISn7SD;s*(@Q+&4Y zX2t7-pQL!Z@HL8`C48;oR}0^u_#)XP*rNEeBEMDf=Y*f9_)EesQ2ce_yA*$4_*IIB zB|q0HK2-P@6dx;mkK(1mZ&jRr#gDFg6sMyE=(=C=3gM3_ULu=1&nmu3k5QbC zeW7bV#TN@dQ1NBL4^zBdIF3T$%jNSl;WHG!LiilTZxMc?;y)B#t@x|L7b{*Uo5V{M zKT!Az#b*ouxZ*2?w<><7@RZ`$3r{QlsPJCJUl+bj@#ka{_fv`=EbaLc#c?q#!XH-rT;Y!^{yE`KEB<}q zKUMq<;lEUT_`X(ezg7HT;eSw^&a|QHb;Z-d-&Ood;eS*7o5Dk~AK?1SAB4vg-$&ZR zP{k{RmnhyUe4OIv3ZJO>ZsCV0{te;fif@sP>SGoEqsUh%{;u%(iVu;OEwzeI5Zv=3E!yrqr%Tn`~~6L6_1JDb|^kZ_{EAJE&OuD zR|$9fQm*}U3;&XmUoS6_ZdUvfk-tOn8-;&U@dt%}NAc%{e_!#x3V%xRiSp9sr;5)J z{wu|sg}^xZ9s|e3IyMxRS3FzMtY33qMHl zGlWkO9>V^aEKS+YxP3mC?%^{Tn<_6JH^nEP1sj!bjkl#kCXg)B7cs@Nq&yVU+i&`ckdA|^*G5_ ziTt%5C;4AV{GanU$v29;+Xr=eZV`UF$h&&!mU!+{@vIa1hm`#FBL9SvZx;Dyl>AJQ ze@@A#MgB!4PhZTT>(7dJTWp5Oey7X-PT^&We^+>=;!g>8`?4;c7lfa#opK9elt9YyMJ&Ki2P*5pA|k!@fU^9Q~WjIjf#ILe2wBm zrrG>-DLz8@8H!I7?)JG|{$~llTFEaF{$<5C3co|~3x$72@vDSCrTFKC|4Q-Og#StL z`-T5i@$U;Sl6_@YuAd9vNAZ`0AEx+Uh0j*JxZLWwM)CcHpQL!X@b!uxEBp+_PZEBS z;#-7Yr}+88zpnVFg+HM9jl!Q+{P9C|4A1+;W7~!)V2SF7k&c{zu`n6#u*M1&WW9abcO_V};XM z7<9S(94dT+;&X&=Rs3R^r(LA@2_pX)#p{IMsCYv7-HN;YhldqUi~O^SXNAA0`1!)! zdjnVA%Y}cS;(r!?f#N4iey&lxNBCD1-zxl0#kUK8NbxI$Kdty@h5uUd>xI9j_|3xq zrucor2aPa%xqAGC@O>5ESNIW%KO*{>rT7cN=PLeF;mZ`CBk`Z2_&XxMUU9cR#kppA z`FHs|Pw^QN|5b_)6MmiIA4-=g>d!tYjmf$;Ar-YNY1inj@WP4SC`zoYmL z;Uh=p>!DKYzm@mGX5DZY=SyIS#4!c&U7dfBA-vm(Du@h;&PDc&Re(~55v{uRZy3co|~ zbA&&rxZAILQgPSbo>Sb-8(&eJ4rrz8UB#~#9v*G|UA^oPK3wseh3~KUH-#Ur_(Q^H zDgK!7)rvn;YV(m)+|9=_io5yPR>j?X>_WxeeC!&<-F)oJif@(t+^+aJ!XHrllfr+X z_~pWXq4*8Lf3Ns$!rxK+Vc}tUFX!rOi0sb{QQXak$0_~?iRVzo-xNMW@ehSpC_ef? z!!{siIc6t~Am8q=frYLP!%@r3Y;70(F&jN<1Azd`W}h2N?8Wx^j) z{3_v3EB+n^h{3pT($@@%Kzpn`&ulU=-k5D{vkgb>F6?X^bE>V1v z$e*Hkx$v~&CkVGktLN&yUidC0pAi0e#WxARUGeS0zpMB~!hfvzZsEUE{BGfYQTzwO zi{yQ*)AKKdk5l|L;Zqd-fmrk|%Z&kcf`f0b~%Y~n*c(?HL6?gNKs}$cX@?TW^ z6T)v*{1V~cR{ZoyHvdm3{&V5KQ2Zs~uP8q6NE^?4inj_ckoU$;|ECEbrT8tvOBH`w zc$wmE|M_^u3y-q-S)}-A;VTtCQutcM7YpxE{1oBa6<;fSr{bpxzfSS9gx{q2cH!>5 zz0=!;!XH)g*9-rN;tjHI`I6$diTqoNKO)@y@uW-lS>eOveYoQ<3EyAwy~3v`zE7F0 zm)VLRCcH**oaM^bNs3Pw`Sprd2|q*eM&TDJo)mta;v0p#?+du{o-h0xO8!dW?t27I z{;R@&qU0YC{*vNP3V%!SmxQ}NEOhbzP53Z*KkxWZu}k|aez5Q(0jP<)l}a>c(S`FG#HaPhnK zZ?%%YQskE^ey#8>#rKzVH!A*^@U4oweXt7^|Afe2qxh$Ue_3%ld!4S^75}vG2NeH; z@E<6?N4Wc*h||w)!hf&izajh`#UB(tMD~qbJjaT?+DGx%MgCyL!(yMODelJQ6BKvv zmunRtC-I!5_$1-&iht}-tIv&!uN3)n6?gkKmnyzM;<;Y&M&WK>-|6RJ;rA)|p9+6W z@#lp9O!40e|DED{g}Z%3m+tqb*z$&D|IG292p^&N%fcrp{soEuNX3tk_fW?wevI&i zio0=nx#9~%-t7yze6A3lQSx!&+Z0a;cl(Ggo?hW@U%~ND3g4sR`K<7J6nF349#Q-r zk^hn6&j^26@mGYur??yUW3mtA@;O5K*BHeQ6Mn4XWl~>Nicghx-k|ug!auIK+y6XO z@oJIZq`2D`Jy-D>k>92GS;DVV{9@r>Rs3q<_bC2F;SVc*oA758zfbsY6nF2z-%{MY z2M^1>j;oh9B_6jg=y*uwjz*?5~2A0#}kxYPf7#oc>>O^VNuc+OG0c(UQ^62(uFe11mpwZgxm z`27;k?TViv^7ku#x$wsoKUCuRsp4N0`QIwO|KWzOe<)rr@=@8>as8!I_)x{2{>Ldk zTJ&~^;s*$?P`q5?U!eE|;ckD<<>w%Y=VT?Hm2$09{0!k)#m^VMRq?BYU!eHsgu8t> zm!Cbtzo_JI7k;ba_X~IXb1t68gg>t2e=PiGioY!UWySv{e2DB1x%ktyK_f z&*|-Pk^icae^t2K=X3IJ34ch*4--BAP;u8EpHsYEm-+-sN`pa z;vYzTja7WM@JWi#6+TVzF9@Hn_;tdUD1N2zWr{Blo>1J?`x%O#FY@Ooe!B1r6|Wb5 zjp8eXe_8Ps;kPT^A$+2&pPZiG5q_xRuLv(w{08C2D(=eb*4Zxp=S6V}*E2aHBt9ZHa=MVed{(HINlZAg)@q>hK zmHCt_?;sgBFHyWp_>+nsAnP5s-gWV~`Q%GV-pwc9RD6WQQzY%k#q)-wdxGL=SsyJ_ z{5s)F6?gOMQxv~QtH7edA{o-*1|oNBvUqHNsz2yixdH z6kjFWjfYNe-Mkka>2tKJLPQT@h-!N}&$M2Za&l#6>rF)WP3+k2~#U31|`u*hK*O&d+ z@Z-5jV?nar{w_3*4$MWqt~Zfs69LjeS@5gNWtlXck>dfYG5p$i-VfN8p@{fNZc~=s z(n+6_+REn8Z8qJGq1!CF9Zk2Hbelo9>2xbc!Zs1aQ4Z&%&1KTQf_nNNJ}g2zi1ZV7 z=Y1A_2LAq~oMt#Yi52=nc&<=x=PYm!@>znw|1A9KaDD(Cei#C4Mj@uHx8bgr@bvW| zDrb?!!S90}Boyn87h_HeizF5 zyKuf+GxDp8S_#*$eR=mxpO@iZf8jU9tkh*?i4e5dLZX zC%`Cu-JFXBoFjG%B7C{Lx=$KD`wM@OD1Nzwb0038`@BWMJAe22TU~MD;leq&x9~tr zx1U!e{A?#EpRW84zlMkY^tVR(pS(8Z-~1c~Sr^{%7r}I%DDKiE-HmBdomeroxgQvaIfIqb8&&zd=teah#Q&zwD* z9@i9at*)IP4&_P|GI#f@i;72bIjle)$U0pG$!&wp9Uq+jtsCE45xVi6`tXe(M9i)+ z_f+gHdZJ?QJ`FW<-j0|(?ICkV(V&XGlkvIcHx+wdFy@Z-Q8jaJFq4l#tUKo#v+Kpk z#65`g@-?qk?8Vosc3vL-|JZvM_^PTae|(>N?#(?n0Sw#_9wNCYXn3dr14$^z4M{MO zK%QU_+60nlBJYO^RZFN?vG^cWr;geN`j`Th89T)mT3b^zilTfFN&r5?ja zA2RL>#Jdg#)WIE-))egR?#|tj67R~QI^Es1u*fdbZ5(tX{bH)E`Zs8gF8d_%s67#|AOrOkmGrc8;^} z^%0SMzspM9*BMp^UOUG+@cM|rf!}4>2aq#%O|;@&Z-m;u@Fx88mK|s(JoTMd-#u_t zwPQ@|T4@E^?|f3V@4GeY^qZ51?0fsN!TX-E;)gqLpLbx6rLOC|J#^qmK-G5MUUJ}s zZS99&Cv`Rk+kbP^Za<#YR{fgo?C-oieBgb+r$DFvXMJR^cXI9@ofT5+=fe*jS7zrU zc6T{w`#5;e?@7v<^9#~%@2&NxNhkU@$8z3$68z{_JK5zU*oFE}eP{c>qV1acGW>kR zv#SHT*p+y@i>w#V++^+hFsiyfxXMO+2KSvQQthGx#b&*urjkAlpUD#zHM-vR}0_Vxxoh{!{UGPiBNzh2fR?sJc-U@nu`jI_PgtaZjp2uO& zQx(OCu_D+b-gV}t!hNt$yV$h*RO6r zxDEe3AMaX$9J4LlR!x3#Lh-KOAaA@*`314oGH>o-(y3)$;4t})c?K1qc8~{%m;N!| z54D^<(2aS1%{Tx)lUSRl}O~Z)W$I@C$IJLvVu9#3wEiUG*ng9pQqNh z&W#itJ4e;(F{#>j;wP=AY`Jdp%E+Ld4OZ4KTAo6@1l7R^+Peexq#Q>5e8Z0HpZH9? z>m=faXxosZ78jAG z`Iuyk`#4*o{xK_ihVbqQ^=LA%FD+pOp>@M%IUAYLgJWNZ*0@yPh0G3X@m z=&`8B&y&W^uYnJ|oIml}Z2eENR4sBq#&<4Ix%eHw_Ty}`DD!mNs;fIqac+tKt~>9w zw6?<^U|#ylU%GRTBX5c=PNc;TXDMf8=b7%>?C$On8D}vTc9^jsvLwG0nz2Lu_2-xG zLsyC?@cikbVq z{Mo}DscPytitAq^cfl_ox7MIONSjzpaPH&w22huDq582s*3XWUW~o#M+e*Y2I7aa1M6l)Fh@FDh7LPf9eHSP zKpmcR*TU0RqEGe6cU1SJow|S0UB#zAk2!>F)^Z`QDZ8jX&icBXz-E?_x+Q(s3CP$F z8Ii#iSXbz=NHR_!k46TUoW27xu&mE$orE<6=H9K7R9C}T-4E#l_YLdLtz%W!5#(L! zqrZ&So?Ab#3#ff(%gAA*Gvz$aO}3Lqc_6UY7H2E1uWECiSz?f8@x?u-VFS z&yJq*+xF_M)}ZUKq^_m0Lp~>aOKeeY#yLSo)?l^15dC-qF-|rt1izazO&uC%QcuRC zWyXzveC<}J=}!po8aIx*)Zg=&F9UJnw#{R)H(naQt%wWBFA?i>o{SUNdOGDFlIf_n zVJ+te4vU^o+I{DCsZaA`@|qC8lY%u&3Dz*hSf|h$X6`<$TX+p~J#y*|v<53uy!Q0x zQeK~b+`20b{z1PTD}&cvtypVyB2ToyPZYPyk0Rfv78fi+pPZxJxySG7PgSFp|zjV{5w(on&x>3=8 zivQiM&fN6vVkp_AzT+15;kC=Z=xp{Td^Q!AU%zbUCv}VGb0Djo!F^MVCvjO}^!s_5=%mv+nj5kO9e%s-% zAZ8t`&$8>ChqA1UH!(hIcLYW}ck(-TRXb;jUTXdK?`*JciJU93Fcxu-O;PUsfq2&k zm>Vdc{vt&UonvRN{O~o^egyUJ@9sW$9Oc-%9qhD+^Bmaum+t8#WBk91$6liuStpX#^G_tBmcD=Wb7Ef1r0 ze?r@_xreD;=f7zTi%y7vj59YqzVCFsg}4l0Ut#kZ0p{uboruR%wvD|+U_bU0?6VI+ zzcoVnA(L|u_WP3%m+U`#g1%2zpMUF(i8-XC&6gDmFtM!I%nQ ze;3AD1a>@rfogv(s`F3-?1{bD;j9w19&6~@6DYH+&-^pxTRO|Y+M9JuMY}X!l!|lC zq}aiFXa6|Nr;?jV|K9TA9?S>SAI^uie@_>{o-T}jIN5P>jd~Vjyar$V z2IGu!$ZuiC-{D_JKovYe|85<-x${G)n8n&; zKef?-b!I2_ubqhT6R<%f6hAyCqShs-%emmQJFds@8Z4mTjq(p z%eXu-wh7ncF6q4N^=*frNKxx|B0i!|$Ga%TkmvRE`t&5g); zld=E9_=gX@vm-ep>1!^?-2S62i?RREajbaEjcBvmX&v<8Q&#&8w#q%RB7PX{RKdo% zry;)!|0v%UgjM^TqU<;EnTU3*udx@1cYXe+IAdr%bSS>1^|V6Xji8Tntl@9&LHXVk z%pIL{4iKFrYZ2O4ll-?~v*esfV^8wtnVY`1@1wQWzCT?X!1%P`CvzTQtM-w5<6Wa} z|IwCFA?inv@(216m_+&HL)dNft-3!~Bi6gnpVG$oVd&2N`7`?R5&qFUkd66I>o*+w zWnlk{eG~K}{)f@m4)paV^z|w18OpGiNPUU=`hBmj@ar5allw~j{^FT#?Ds~zIgV_@ z{nP7|)AdE@2hOn87Vgu1{4wVm^3k8Jwa~xB`8pH*`{n0;wB?scetP+{x?dyFFXYHv z2YP;J{6s$bQ;&Wn+MW2XM!)LOFMKYY`xQaIo@E~%PU=^N+pqh%U&DR<(q~9C*Zt{Q z>64!Cddu?;>=gNJ;o&)0t3HQuN4XxqqfW6m=|kvz!_Dz~N77me>k^7}Iya&ZV!aii;nF)hd&j`Yuiq&g`UJ-rSLD{4HSMXZyV;tC$UdD{tvH9q8E-P_*vL_yGQ(dAK*5>N(QdhwrX;@jO}N&6AXKsqa|VwbR^!c?{>G7JRPu zV~*@PiG91t-@Af}%IW+y@w{>za-p6RIM=cc@5{L*=D0Taf@E|bReWygKdbCSeA8Sa z^R%=@b4v1_VjJws^X5^kBM}S4+kkn8=5dX;@meWu8O}zO+AvYwSv^VZs4lba7(GV~ z+c44EHk!^nan`fpIx8}%)tZ=kCCYHtx8dZ7j?ojXtZ8ZE!ZmZOw3VsLA_Yfi?`Aub zCWS^_mRcM*yiGOawWuSsHkoAF$9n09n6E8fCuLwhpmo_noFUWxVy}wNXvKc}8LSg! zeN1&vRnR&{uL19S7Vk9>8#^-bj-@*c*?K+uC*-BbmJ!3~%8q$fv*MoZNHGr#i#zcmG;=BILh^c%`)mtx+dh&a{c})p5)-uVKFV z4d$KK?GWcBKEv7)9!7h-Hq6no?j>K6Z3Tx88CYlZxgL{P-G*~R8Y>o$A-(>4js2v3 zxMM7Ag?&ecb>D*)pFwFl) z+=4$@D&r=SgSdeXf=`6aVg)U!etuOlv__Ay;sSd5eJ*=sD}vmFb&G{_nofFe105XX zF^YrZc*jM0(4JPIjPygEOn67gwm^J~->IGMBJz6*)-hp>YX|RDymdI8S3+mZiGfKJ z0~B|({w6uQ?X1(gi`0w98+G0%zf%8R{fo7JE7sMIz;4GduCmUk^*hqMcM4E4eR69{ z{*{rmowSaOTUo!D0eg&rA7A}Tc>P<*L9Ye^>vv;5el-wWzbB$Uw_Kp4RyUs1oJmj32`_eY-<)$NUS54gc)1Rb&<6XR`*!9LmB@=)0 zy_erT0Gt1AMDfHovx+7@a@X(PJ+S45(}QmL$wNb4+g^R=nfWh~-7omoc|(gsYUqwV zL(ZLxIHB?OHulnZ$9edKITy}^F0BuJ?x)wGjb}di-n-ADoix-fd*R>TeHQJkL_4jG zC*IwUHk#2!v;y+K-rq|Zi4#PjXGWhP@GCi1IlOuAD>-F3V)h9ang}*bzHZ*3(Ay#N#t1#Z= zoj#qdQhn+hy)#9O@50%0dlBZK7;vfgI_j;!ncOw__gmUCK$qU^@g&E>JoKB+gNpaT z4xUYJ4Z$W+yw}b^J{XRDIr16WBY%m{41PEZ@7|AKoEECM_ul=h*fZN$;)o!JA2R_>|r$DWrVLNGefCpbOΝiAE2F+ z6nB<>_lv{H_W8GL{X%OfZD*Ms+38qmX>ZwS`|-EO4llb*9lA53{&@Ads-527)>~ss=&)6~!&TD{{;Gvd6Dbq^-?|u{STY+PxMk=g#JtUoSx;+!lz|d zpbfkm+Y28?;NLm$Z)ED{N0(Np_Okh^U^-&uG-B>zJeMLLy$l#ZpRsg=YCi;+_LNHz zV-ElxPjHrM-wYVzBV#GXL>*u{Q(tA6+ z9eFP2&K7&*PQ*Ho;WD)U8uY_{WfG0$h^4krK0ASRD#dmeo?q?MpUt9j;_EB_>NVwj z$C%b!d6m(Tbq&tWb61%BfEGwV^> z!=_?>jNqSxe_{Mf!M_mx1@X_uzX1MO_@@q7`PloB44gCY^N@LB@5DIPob+_k^}81f zIgQpG)K6O5#9&9r$*?+g&ZRSFuJ^R5hdqm94dTz*F#UB+w_ex$v}aO_hV%NDU}sC} zFb8`Y=5_RX82YkZvYjJWM{Y^4A=^X-JDVeT_p}1%8AbS)ddhAeJSfm!Zw-EP{t_i9aUqwD!x$W);SHhoL3)LTO;w;F2j08`^ZFY&Lr8nyYF`D}3x>z@?+mFwUOZgozn#}H8vE%t zp90TlGhE2JCY|WjaF~e3`gVI(Os-aYdcf7TjKZapW*g0`gyxUp~OGu z8MVFzde?8W*RMeCzhh`y_3x;Bn_U$tYt8=+V2q;zT4#}d_nA`A~mi$xL+tB(h z8})w{P+fV-Tk~|9c`}Z3CyGlw_VnDj8|@_1j$j|0Oxuk$T}z(c8#t+L)%31>2d&{& zTkDs@9y_rAJcf3Ob_{0*S=U?Z(Oxb722VTDa2`D!eam>`imHF6y5R{E#0v;c!#J53RPArP zzP+08RfxBaFCpF_BXxq>Jl9cGG)9qMs?w0pCL_0zocSpKCf-?N&f(ldb&n%A)sN9_ z?8IkDq>afKBX@lBZrY3QilqF*2IS6mx2-$W`Xi9lvEJes=Jsz<>$9OF=G4O^W9~>* zwen2yOY>V-=BEu+1w>mpIQ|93hpPf-6y7n7fnI3)ImnuSrh7W=??vY>3^FZvocC}(Xvmf(4?XyY0yI_kawyE_C(08&&1pR-_9!x)Rm2vl$(Zik( zSyj)2=harV{sQQG_mfKF6V&>B@LeiwLv3IUS#>A$U)8!Qe^5x%?u7n~N1*>;oy&(H z2M$6VYU6}GWd9WE6Z9opKZ5ga=|k`NRqcN*MdilO9_>lm0Mj`Q&M+Y>Yf>iqMfnA1 zn=c+je|IBKHQ)&x=TrEs$Qb0A`;l+akKLK^e0pb!Ib{0zs6(IKLB6TYim3G#axjgN zhG2ePWQ>YVv_`Oe{C&QB4I^irx9_9(FwTm? zZoYENI8*V$Gs@XLq_ZgHBd7Mtf)(c3tB5_bRSJsQuSae&7K0hb+_Js0r#PTTCXJ@gJC zZRf<8>IyD6GCR!*wl|{ef5F&GO{r9> z>1(%e<3hi-dDFV)<_&9>uWm-;8!_x#Hf>rr^U_QCNzylOiLGgFZrT{zv^KV)IkvoM zRJ(pdb3GN;>*A#o za&nt4osct4-(m#K^xtxuJ_(Ix#?;aYt5#i)B9}0sal%IauW@P4YP2(9qe@jMuLCnA z)ZxC7n=e|vhD^D!nasI~y18oAmWy#)+qisFb5qPyM{5a2@&v1?v=ea;MM8%P%OL zTU1;!53&Eh<@)+vzU#KT?t1X4+go8z8yW4UjBF%6Aw5N(=acOKKD@dG;k`yIZA7 zz`ZW1PHM|DS&DR76!`0Okp>@i8?F@ah)e2M7tv8X=yN75Na?avW3~aOcqCos-IF^h zB@G6!RF!}&hD0Gz)gjo;9;1Nt3WqLBHEY1T_tl&Pf~Bejlm@7|YPY$~Miv+a^qP~Z zZhOhiturMOoB?$YfBAvPUZB=JZP-LIu_a&0qF+d=1M~M+Mapvx04EB#%h5DQIby&^ zu&AKxEClE18mLkw;3h1;>4I+rJYq=NuYw)(7=LC!`Kz<2D_|+DB5;|yM%AZX?VAP6 zFxqQI!7AN8H47-+)QnoXcTcwZEK}6rYTMLgz;zy}XP=s+Pwxb^1mq$t-1$0Wo*X_ABm692iz%|yH3CYEg3A=TkL2D9gH-+Nr0g)+Aswd*blGaC z>d>HfPj31FQ|W8w8B|+#*&TvC;!-~is$h@1RO0P4*og$H*P@1!+s!aaI>x)KtROMh z<(1;!6MjDNaHZ?v%9{RzSVA4m;E6tuV-PF|ny0ytjK4_ktb`AWvd0MKjKQV2F^@w@G z5TSkpHMvqi%{uEk14y~MjX}QV`v00E2K~tx~HUQRU0=Bu$H3=xq>eY~7(&7My z$Q09zO!Ahxwx^V9MJahED=jPg-G-regGg<8CQIow1tU#AId2Iv-XmJB18O~D|4R}P z|Bh(}T{V#VNY+RSM!Hoh1(cN~y4rJ@)!1SxtTRs?HzH1+eKjY87%?dzPB8g8J3$$y z76b{{;F1~z6lDh{JKG45$QeLZGBwsB8xqN`>JUs?9Ds36eKp3FO&{~* zOWJ^=dkXH?_qj$&+&lv+-XUm1j%+Zr0W17RgGgB0&fkG)f}P;8!I0ihCsKojm*My+}jO5Kv5f7FkfL;;ol}F;|x+ zQBTZz7UM<2+fs`J^aMBd6x{E45%oHaVUXpvcD!y7F)0&8c$4V}6UChJOg5{Cm!w8x zM&Kz%5SGC~5iTYnn#h!AvTTtfb!>H4UB3ge&PbCk{&msPQ_3~cgBI7%*NEcsOzuEW zDQ;+ZQktZ;Jo}g8#(^iL-#FN9#EV_nn8|$_kcGcyB)wvuaHS(~r=ek_i|kS_3LJqe zT^ovzO+BTOdw;}~NK%I6mkmi89YAUq@j(MXihzzGon7ve+J6(&(`91pY|q#^2F(Af zj6L2JR3%`kOKLKZ`$&$UbW`yT9ZaRNFxnr+VW1-O@?F#O${E z+|~{Wiel3?6Qw)yOzy5Q*BXX^%IOf;Q>ay{%QIQbCR6aRdBTIjD$nF9LKn4BMZl+B zDFY52i8?Hz1oWizYfsTd>aD`CIc72MQj!0jH%K<*>Cmr@{h^Nj>gaC4hs z^927_28SoOv8Uhxj~8(&61-%n2BRh|e{1^PU5zx{B8b;gf-EzIINFsk_0%5lR2Fol z{I6T0r@LLN5-`J%^nr;%+(%!LC$$iH0*YtOPEgD=g%Kv;J1%L!Q$n^|#eG}ymP;CN z)O*88{_uwKr1Tr&VuxOI$@g>-&=V|?YIu6idv&J7i|&3Cs<7@bRe6*Ma?m4M9fEXv z#QxvW8D7=P>?i#@i=%i?io5H`H7%UQ-etU7#ocvma!HMn1H}ddIOESYwd1aoB?3xZ z;^4vkjH0xF^@M=Z7_lW^$pfp{FtnH_#zV3gkouD%<&Gysz(IzjPZK#+ja72Tp>t2{=jE6=`Uk8!J13FyVl5~(fEzNARMprL?Xur|g`^@q)K z00EM0Fa)c3vDB3!#xR7Qqgx7MZWT8XKJJqGO+F%Jyj#URsPLrptBcqrW~Au7w_w>W z^;X}G+!Nn#RubjJdA7Q3tGkDvWu!CF!0sd2r@~xrIB1zCu&0oOT%TgrnUX{1Ie-z? zcJ@_F4SaY&UuZ=@$B^_85k`3?_gd&94FEv`dXZcwT=MK+iu)c_Oo-sGHPx57Z4EdE zB~E-hD^I;DQA?hEsV6~#m7;*26#B+*!qu0Q9K(g900BKIH3=es^d%+NmEyh=@uY~Q zTw%#lgtg9L;CxOu*?xU}08e}*iNI+5X>=Mv_o3X?e&`7`rSIGfK zZmwIUNQ`02n@Urkza&VoPo0=48^C(Na4N5gJCnD$Qm(nvfO|dCBL+O;k=`=k zJ09tj0VVFw;$^Xfi|?G^9bbYlpP3Gt=UH^MmsIZwZoXs z69S5qfVyj)Ti*c5Vx&&FDW~;8e|0JigM6xw_e_Gcx#p@A@Mng^eEkWRkFm+CZM-o| zmU9*_5pOol!8!u&FeE*Y1(RR{qkxAJ82i&($~PGR5hS3rfp8H}+5neSlxMPsgf9AH zu^^yGqpnnU222;>t zp6HZ-n_bd?)fwbg`7ch_wVogW*9A50EDl(TT`5%pdQt{_#wIq#co)!<(yzb8cI%8T zl-C8`?dsQh!hr91Bm=pRWY>w5Wv*fReRF%C5w_brNg073H#AJr0{+Y;)d?ti+G?}a zA&4kV;)+d5k&mr_acD=mAy%4a2*eAlj%5awd4=i=yxWuo)YJ}vkGQmH9Rhc{w9DKt zV96|w-|pxTIA&&c{2qOWz;Ty0qeI{ZmzLKdaGOiZ?+|#mODpIQ_=roJ*&%SJOZ!BJ zz{=K!5y+St#WBO9RhE5X;V7{-tN+-bqKu6rCrt` z@WU=Gw?p8)E^T^;z}~l?W^@RA#O2HD5cnr9Ex$wHmt9&xhrqA9w3!_OzvI$A(IN0h zE^Staz>XOO^o<{ZGhEu`9RiPWX>Z3|7YTm+sH1=~4wz2{g2X=flH=V{ zE0>wBh+DCwYBD78B)HZYk~k8in+-|)2+|Hi5;uZ$pCLVLo*?Zupg0kvM+`}P2+|=# z5*LE>v>}NHL3+WE#DO5aVo2gYkWLtqxDTXLhV+qnf+UAc;yjQB8DEL-Koa*&F-24{ z=}OL%Qfz7{OmPCHn=)8kzzml(;02*K>s1NpN$Gb6{uuQfQ>GVf!YI$a`YAe~p8`tf z&Q6e6$!D;?PNTmG5});bU^m9Fz}N!D3`u)UuxyXfK<=aeh;Rc`q>=2Z4#7Ox0}lTG z#lDqbhf4&M0rfw9Al+$V25VZGhoi9~sQE#LBZT@ly-~ zj=KcRcl*^On_P*O0h~>U-XaYdSiqOvwi-q0Qyxk5mvh+xoOw%I<*t+(0mVl6(2KMs z4GiFOFfzQh8^J-9-ez?O_K2a<_mu<|;hIx0=?ih1O70`sBeP6Nn|b0$Fug;NU51D# zkQN{HNCHYvd+9VwGd0{tUn+>Z@ztM}ekUrCmh0&w;4+ug?+6hoVkU%*fa6UWr)ojs zuITDw1D1Lu0Y!lUWqDIwNfW*k;CxeNt1aGF6U1R55OLTesHnrdf`~$x6Qmh=CObjs zo*KPO0Ci>El)8uPUS}`nTQGzSBIaqE(x#K%IaO7!pDz&>@H@jF8!F%Eh*p`jmi=o1(MG3M1Vr?kAXVlEjzq zy_ZaA1DKqRyx!93EVr#@0po_mpEVPt(&H1b!Otg1lgGEtfOq=&#Asjh_yiP-al6M% z`Oo~7Uopt*UgdWTc*-Nmi$O8afIc&4s{1~)>#mhN(M`#s2e1eeXXcw0=*5G;p5$wL zO78a)`N@*8u28P%I@ca`4F(i{fX{N@3vKuKdb+0WQBx}3;3fq5iC49!W9oW3MpQD@ zdTyFU7YUdlYMmOE9-fdB8=LNoAJ-xDT}HwX{GAVfxhNztlU!fuqU{j1IibGzKwecR z*LM{+KwlYA+>2>Qz*(k>-X{!HP|z?!kburv36fe3uAsUm1FrH&267+PP;0`FXviLt zKH}UVL#;*l!%2Z$We+Kf&KWf`?GtH%k@%g%@gQ8DmWCf|4_<-_!&2fSzc_c4Jp>G) zi$={Eg}-Q`>kxrzq=Zypgf1_O;_sg1s=!DOb%6RxBX@k(vZh9dBJHJq{<9WX+vh?? zS}#qJR!R*@V?75`o75sTF~qXyan3kZ7R`gA=@$Y}YAC6mmUcNP!#ow0ik`#887_@G zI()cw5#(ovxNt-eBB?gDq14E1h#G@GY%_}JOoi0ZJ|>{&x@D+A%<8LAPEneuX{WV8QzfOuji2xzi zY9d-cL|Vi3KEY3=cvVt}N*6dtoF6YhBjJEPhOnMYdHYjPi+PFtD6=QykxMFt0~yh( zw5F*@cwqu5upI@}f%IvqRuv0pt?`HCgljK}UrU%3c1S1Id@J=O;`F9@*f})VuX#^= z)EK|&P~Nn(`O@#`WZ-X{vKU|>#& z(hHdpm&JFQT47MW2l=jfQnZo7L0@&A(7?@Xrn>T#57ojMojK8m6*7}Rz8@tiQ5Z7YlDCrX*;f0Aw498d(e+zm`8K||Ik-8 z+RY&L+dZ73lZGB+dgR2IM|-?Y`>#!BhBnRIrn%GnhPY0Tz5kaDfoS%UogMHeqZ8UK zC-vhE{diM9-qMe^_2Uov@t^wfj(+@6Ki<`k_w?gK{kUhLI+w?gy;3Kg|L08Pvq~U0 zVG7_t&=hSg?SGx-&o-WQSpB!9O~2Of>nQ!dZdqTO_8;~1^MAcf_QBsKv;X>Jb_H9q zl<#GHzmo6s`CiWV1$>3(9p9Jm{c651<@++e zf0FN?;(I;c8zegn(>~Ub9Op7gzVbBGBPJ&cIc7uz9@axu7YF>o`YWA_J{x1XdKB-_ zNWVFMyw*kM{I(p8>AG!3Bhf^r37IF%MA6o!8)<7Z)!ce+MYpC~warmuqO@6vK84-H zd9=#Sw@;?vFA(c3f&E5`V&tMBSpUAA;xIxx68n!S=^pYy%1A~i2ix5#F-E=%k#!p_BBHgIuR zoloTb*rx<$hFdJgiclwTd3c@1K8OLE6W**bY9kO2xB0Nb@D3j~H@r(@pB@j+dEo~% z_D7O(MR>Q5^NR3ZA66QE)W=yCKBO_~Nnm04h!3j>AJZ7^`T|wq7kpSv_+^b{PC?ny zaHq!BkS@!@?`Z6k7Xqsfs{r@*eBx{fI~wEuEf1$BU?Vkl3309o$23MJ4{QvN*H}JT za8o$jhg~0@qA~Jl;D&IH54$m(>%%sO^EJjYKOLUsE4w)y4_ttz6ifL`IA~=R`v_Y> z80#mrfpDImunmMUe!^!#IM+|O6@<}#!gdfw`3bj$gMkr#!soz|=_lL{!f-!f2M8H{ z!W|$){e;hhFw9Tb3Bpi6;Z6|J{e-(fILA-88-yW#!aX1i_7ir2Fvw462O-T*_yP#2 ze!{&VMEr#NK)_#<_S|qk2w^{=1B4VmVK)dNKVc6DK|kRuAlQDwUJwF)!Z*Xg;FwZh zv)=;8xrT5x1><8NjP?`01H!0M9X=0GNFEMfsWHk>fggs;HP%68N5TtCpiwA48D8ka zo(fm^u%qEhANF*(%7^_ZTo(*5+D|;ba=fhqK zFA3;(f-P3yLY=-AQ2M$ktTSr?&UOQn4e}}>Q^F?Up~jLBC%joW842Kkju9T_%R)LA za~}C*Nay1B$TIaIFBb=vhjcFHIx9jt7k@qzY>lBDmc~d^D4&rpQAu+s&IrxEftFAy zXPS#iv(}K(S?D9m3adhKjg3Lt4y+CpYm5c136=V=wV_HMwk}lX!`6oyEEO$82RX^_ zN(=mFfScz&zZ3BF`HunJXF8b*yc^JcofsQ{Uex|Zt6*a`eb8-siKx-rIG)X;AOK{gY&^Sgka zvl;n)Agm_P0Ait^gLCL8bOH?`xY7>RfxR9Qk*AsHSL=6{R5K=?g%#4l4-(vT$2_Y3_>@!sF z!jQ`Fu!}de(OzhpX5FiX z*Qw~es1T#^oJll3@zl2iKvk3!cB9b#eIR<2_(|W)=b3@3Mqei43EVPS5KLJwe&Df`21Z!G zcT!pynM@_$Oo4vpp*kWkR9O?a1= z5!|gE{sEPZ2%23UVax2hqij^r?D8HUY;^F5F5^AlxS-kPJx^ul2Vd}&T@W<8 zJj!^1@xe}Ab|LNZCInAt?9Wv1!r(g^i^7$Gyx?h#ao)NjxLGf27@Hrw*@u+}+Y+$t zK5SudhYza^-s!`tg1a=v;awfP&xh3nAMjzd!H0d=qTp_gu`Y{)U-MyC1^4=}y5J+e z9YH-pFzZntp#g-ke!_AP&hryifH1~SXawP0KcNYP(U1DHYYraN*ihPZtO_3T>9acc zxW+g$t_>dXVe5iV`LOlDr+wIl;E#RS#^5oH(V8o;Dfp}pyFU06jq%Ft#^Cb-H6#}? z$iZ*v)W0q;N{9Nn6m#d9Q0L4!&V)K6=bKPxkQ2?QDrx99a`W7s_iC5*mkwHPS>1Y z7unZw2_uW`l`0y8sEZUXC!Cc{PtqqGQw)=U@VKA{pP!}HUcBJ+ihOPx!+cLB=cF--`OVraE|$+ZT3c4H0B?$8#E_-?C(!j@4oB(Aaj$F}v+u8sm(!$9}+veZ}6bG0ufwwfAc54yyNc z`%xeE5B4FAeGzUA?6Z$(Y!v0KN9@mC3$N3%m zbszR!`-BfWWWVLZ4%_eeu9x2`sK<>iCzpGX?ws%>yy5G`+qxHblIH*EsAxM$_&buYMyPuynv}A|z<(fcrclDOM>* zMh78|r6c1}LQ<_dE;&NTAge(|tD&FXQPPRGimt$Y!fFC>IrF$LJDkToYdoR*!hU>G z_l0fyw9k(}_WALc?hEBM=h@ZeuHG0ZXWN(;m6>tC<)cse&R{1=k{+Gd6+n4RCYsc1dAJK;L+Gbm*YjC3}5 zl{e|mbAaBUJHHa8&gOI#eV8hLLn@auknUXPwXj-OK86x!En??i0i^#Fw+a8j%pfn) zgVj05VmF;jvhm?aM#x@H)Y3U?79qo}bS_y+$OybCi^c$HZ<30cbW_pkAPzThVIsp~ zp!`WK6{U~0Mah<4eHA6UO}Gg+x}0iOGu>%q0$Z(F_vv9!oNLjiJpj`G0k;X?VkVI5 zxKAUU(YjBs5$hP!rw<7kYx-o9OJWvG`FoJH8f4u}x~b?#xDPk516Ch{*Nq9;D51-l z$;vv;tyEcYh~B1^W%%}>noujevkmXf%zHiQ@fja)8+hpx(sTtEL~ld+gk4fM&UHsR zpXa(9dUxu&4BxGzgd=7by7m<6Y0XKE%%75&=r3`{h@|dMI4OcFSa8s}*XzLj;I+Xx zJTn7#{SiA7qoSjLr_)Wks}z{$~8x13s1(Jil!(!>C{DisHyv^IJ-!#LyUY3&YHc6w{vnwduVm#*PQge+iIoIq3Uf;+xhoPK1o&dI%_Vdj zLTbu9eG!V-h|YysGo{KGhF%)9?-|O{Y1MD<8mblJL)mtGe)SSEXq5Kx(N@&rzNAMs z>T!D)D3MKO-2Ocw*IU>#kal#1Zm_&n*bp^=wk~v~4vszsW{&0b)O3zz5|uhs50XC+ zJS@QUE`pJaArI`P6O-if-S|74hTn>CgAt=q_F(-^$H z0Mb;HHiVZEfi84KKA$@~SCc@P?NypXm8QETaoY6F7)^rAMGGJ6ra+$6cs{847gJHe ztV^UA7V;zXdFJhX(CU1Z=+nBlg72DMXtyNLYQRSypPs5B!!Pw(H3DWPHqJuTCx|WZ zOoYNu2Qkg#`eVAYxa@ll$GYMCXa3}}j(&Da}fSn-?w1j$~-O< zDO7kT6_y4lL-ZwUjZYT!z}gT9gZ(BV&nBWaVvvJ~f znCWWjJ^uy&~%AB6KU;HuOBN$ZtJZ^Z_3V91z+^>7JS=>^kO#^ z`H_!-w8zBz@#gIS#S8X zfmFTZ&|lB83VN-PULe6Iv$QHW-$(0JtA#3ZIg-9yea<}Ty~J#~QVXf#;OV@{m_W%P zN?-+1?LEV3deBP&ApF+7l1i*6;X!_Si@v9cS1%fma`viXj@e;PhBZ4({ARWJppo$) z(X_Y+>%uPRiTe_*|Fz_Yc{!>VDKl-eNSSGq1U&=JvZ8@f!-uIQU?8vQ}!a8x2dKou3)h9BrSS!GLF;ZM_dy~~ni+DX-2nE$S z6Fjlni7R+nXUx4Kg^f^6taKgXbrwO^YgEzO61+x?K9tV-y=}qodO^!BGvSWqFwa+U z!g+S|D*l;T(edyn0((vKl>QTjeZ-#~%qS^npGo!g71`@UWEdsVssf)g%je|rTf+le z&s23HQDzOyQAl__Cp8lbKhc|trR1vzM%;(xjVvSsB8t6*lcVy!G%39`1fTxjgZEp({8g zI3n3<>J^WyhNX;V{`!H?<~KWe7nQKRy4pZQ*bu2nXEQ59<7Q4Kxus6pi6vDRc8 zJ2s4U;2Rk$^U*1|aXNA>evF!5P5rlCPO|vRNfv+EPPFjLY*Fk`*vQtaHl174@_xbU zOtSXB+cTkt=Z$3ixJ~)VE7y2LuU<(zni{dd36jOpU?iKPRZ8^IPG9-TZKkT-M& zz0;RLo5&m&kf10X2OCo8^T4!7BVV-%F=sH2JlDCy>Gh~Z)SJc!|_K1^je zV^B6#CO@PP*LBGN>6!Z71L>7MBE~$_OghL}WEQ$Y>#Zm$=x$O+VOidL zB)8Y;AzP&)vzeQC^Cnw z`yN8Ht3#9codLaYO3x=ZWv+tsOg=*!4-K#@$K(O#BS0u z`VetaP(>-+kl%pjWpaeO*@@gq`3(2V*?(TBTppy6=S>|x*5V}AVh)X7S+8U%p42Nj zfO}=FOk%Cg~ew0T_(UB0p<&El>m(ZD2~)x0d5lDb^-1cpaVcc`?b6;)5|wL!_dDoXzk*z zn&iHVO{|l3JKIEHifRpifn!Zz`naf0NB6UhG<+Z1SHpkDw(1FgF)2iT#ulOeS^JaR zwLi)8-%N7XH<^DvSyQgv0IUPS2YC3WLl z++#25dX`hdPA>PN?At6a$*X$F#`}4l!{`-)H*HaEGw^;8ltK3ccF$Fo-t_z+NT1mB z#*MGa(I98U9;6Sti{3wHMz5kS z)uHuE=3L_aT_!!xAj`O}8R^OGOpx1|Bv+SytStIr9pmN`Y(Gz{o;c+xul!^%@%LEX zO3GtzvOLf2Z?oIIZtS3L=m;AbB7bhl&zAQ&v*6LQQWw35=Zoo70-BPJZb@8SE zQ#lF6oW~RB&@`Sv{}pWJ#qCc4@{7In(1~oSOvfal6Z+-gdngQ@z)L_n&7mu_!u7W= zj%I{Ns%MxPA>P}gvc6W~VXZw~X3}v8t0wGAhT_2)_dEbsH=@+N+(sUzn%Wz`;%rm2ohagWtf(ogmHTQkdMkHSXKP)chs#Q4^76zB zUN?4yye{kt{p+Xvc54sOJnwbs-q0^m?&0@`5+}xF{61D^J{ejr+TvMX3WYdRli`JD5%E9&ydS- zt+sD%vwAz{De(WMlsOi-Cxgc`G3{{&tCQWN`+CFNWm3Eb!Ta!g1pJWy^J%bMDI9Z@Fablz&w+^qlm#%GCVmK>!Stcxnzt-zf>PH&?GfDC!6Us zA_h;*!T0~5Q96|@BXt7Z5i*hMyF;KE->FoR>xGa?P4tyYrI7NMQycDCLLiks%ivHW zbXhiwo2w0V&b1^v=?qr4eF185NYW=T7@$vKFu3$|f7I$YjRAf>5mz3Sm-PWzS|2~l+VLh};NT4`Q_rfxJ+ zzm4b0!t{YV&t_%%otMj+?y*)TnY%KH)hBf^Yvf5?tXbWT&GMu+hb43XVHTIrX%1)M z11G)eygFQugBnlz>Tu#p!KcVZF7jA6hC}szNZpduy)Au9-5O4u6}BdIFWc+hZ9c!< z#%!K4x3QR+Ng+V*8C~=Hx^hoa?R)y}%Kb^K_iI+y{642Xq2ITA5kHQgj-xKlUB#}Snp-_7Uk}&9=Vcp1Hd|Ahm@{q<&PTb@_vESr7vERgR zJoI+pdYj&k2uz6pi485?$dx^V)8Aw9(6@JDdy*F|UgcJBbI{U*^`m^4$&{=g+4%Npf-Cd)^6~H%ra@X31`E>7aK@ zb?M%#CGRsw6ePOi@31;5lJwR|pE+|^oAc*9lXHTcXh#Rp=WsLm!?^mz&~3gKL+(Mhd17@{|9mNw$#5bf8!nP>+P6Fv12FLLT5G!$mj(Ewf6HId13 zM9|wAfiJr(BX&LhS4U`pBeTHj2+gcA3+OVh!PWfs-wU3#T-U?bacwW^_j=82OK4^r zGkSt`sUN46lqdMsq=vR9HT1OC(3cY$`f^f3y3}jv%Sk=joz&2tq=x7ZL>Nyz&Q(28 zk0&+tIE(U^C-&)y$omO>{9%$R8ZY?D)!;H$0%G1g2Eqrykx8-?w%N!W-p@C$0&28< zJ4xHOBQ$HfY2!a5W0qnFMsSmh)YN-8sdw~Ou(+hf ziF+lhol+0k3Rul=yI!$Ufp&ojd6{DX6+hwOEBdB`KqeT;DDzU4gNA>Vd( zGcxv55dB?eFC+Y2!tXhcGQ$1&fpdrv7I4Hl!U%s2^Qd#oEBTT00wb)>G3R9udER-2 z5!yc4FFBna@^j||Bb4y$UpntF!W#U>Iek7ki;>?u%3_SI_y>F!jxko~11H^wbvYw_ z*hlyplE)c{Wc#pSBu8U(7;8r&`5NOMr$^#G&S8;Kjd9P0M=E`s7es1(*d>uVA7^f4 znZ~$xd65PmHYc(|V;6i1tNUF+~r)fstWs$}DdsdREE*?3~=hI)TeoSb?iaP$2U`*(xbJCwfd-w#rZ zu(eJM!WYJV3OVWYa}?262%@iOc;6#w@WIo3aHWc-qJ{Kjm}R0Qi}(C(86!S99^{OX z>QikQBR`o#@F-Q^mN63;_Fx9e{f_?rd(W`Vz1;BOZAn+5)6fqpGeQCd+G%bpl(T(x}7wXqwTH*9QOyCybu z+9f%cOpRr)T6M$fi`Q*fdtGzmrdV$7)M@#R*W~5oG*8RR%gJw?I(5c1Gp=a_up+l{ z`SR(@XXGqzp4K=~mCU^K#Q*$l_dSmm7jcXfMHgDQU*s=u5C5@1_jHE3~l(x(#ZJ9`0w&MEMRosLpvmQ#! z$i4W6{N-xZ+H31qHQ&&@O0}-pq&98Zq8cGoHRoKDtFB+OvGv+D%}p^T)z=qRR~Ig+ zuPM8_q`r1ZWl4R#+PG@@#uiUT{hH;gn>VV)wX4=%zhR?Vb>qfW_06kWH>sB9&7L%B zsQjv$>YDn674?NhwPlM->Z=PEUQuGGbC=YX)YO+$8FXG*bxo~-YibLtYs(g1VbGF= z#U4^rv7oZNq_(73c$X}!Ev!=;;Kb(ojhmKlf@Y<)wUzaYOR8(iDi+pHtIbAQ^@e$pBe$Wl42W z$wC&BM5-^Hsz^rj#zqkVztk5MmY2^hESg_m0&~wTFRLllHuVaM%F7_J-e-!E>gtMW zGJFrFd1d9bCDrwn)g_+1UKu~8HJF*b>K9J5dh%zYu)Du!5JS)oJ6FNb^5 zYc12uek)&9T~=EHLnSp@Q&NpctM8+ z*=|K;$-bEIcrx2PBctGXhop{r`j>WivN;FrV>5xv(6SCrJ& z*OsD2F%nE-ox4#({wzOzr9|huZ zL}o4QTVGvLwWzEb>8`T6Y%w}nKfk1h0qQGDFg(d{9G)hdC*%#JGm=(ZGOut^d2*B$ zT~U^(9SHSEbqmTC_6&C_tEt6oRbO0KTiCOnE=!ogJXiWMqr_#;^ud!+ao^>V#!QIy zB0%QPvyuT*7bdw~XRI;|2#LYO{&IP7bwy<#@P1)YQAtfreRbItrOB3uSS~BA zU62$Y6pDK6C8dNK$f6-vws2lWqBd8+$BSuxOz=GGSh*mH*Jr!F^14K#WfRRr%9q`Bh__%6u8awQO?@+Qbzf@r=g2V z%gT$j>h+7u3hOHit9zJT^N?J#uJZ-~jUaJ+VQp<;QE6gN7QxcA;;e66zG~Hq<&7)r zH#9HbxOUA(wV>vT`g!FQSJf|CNTVG~374XmEiMX$O0KBjeBkj=fRi>Z7nvo2Fb`sR zkyKlbHCJu@+!9P7CCXqG^Hs3{i>eWw<>eK6Mp?pX3WHlXQCw5K*zov>6g){NnklSZ z^#8H<-f>b_*Z=>pZ)RAQ1!+tKmL|I_EK(E`bX;~9SlQ+liW?Ia#v13D{#2R~vF^N&EQDd-|#NX@O`#Ljs&wIviKJCBX`vE)e_w%0jx#ynS&b{yV z&dvxZMmP*s@Jco>*XS@52FU3jUokafo#e^BF|%~sI0Rw=L*6X`u)NU7<2^ zfT6*M$l%-2G%t}pc>2Uc!@D|WcSw4w48Cp*38btIGY+9ogM!YO9@?ee&qy)~kVzu& zK9b|!2Mh~?OIsL9NL{Lxswwodm=t&gmoY_NqJvi;7I%WE>fkDX9A3#?t!i$^_9L{T z%0sd$W%!Yr7&jJ8#l^Hb&EgZW#jJ6Dz@bbwhH+DIP8p-eMI1k`Ca1{HXP?6~H?ves zPS326d8@n};iFr_1x56;kC#E)n}&6Ul-`GIZpdLd!!W5MN|#JMH0>g+U?8K2CIxeP zsB{|EU5K} zJmi+sCJiFsSZhryIn)K=oTqr}xRR;TMQ4jA&7v?gZq%e-hL`MmY0Su(NhVA$ospZX z4IRx_+R-x1gEHeYcnh^NWd;Vjz`3MouM&HQDN{?Pp!~sIGR@R1X|2Kj2v+s638x&f zFlLs7d>&FV9cu=hOvSu14z-C>KR4oJ{DiTyu$O@|SJnOwT|0on$1c^o)}59kwwyW+ z!7P&9lqVCH*baWYvalR2} zx=T#6#5NL|BFM7lxR?>ypn~Fw8H+Rr*_}ZjRVBU)&X|e7VZ2LW6u|*X#b)}NOwX7! zYv%ZhL#86ILD$V_(PUYh*jt==vN`4Uru;UMmBC0adnA|)Bm@@&)6;T!zN4J14c*p? zRmZZH&X_R^3q3!6#O%s=W(F30Gtvi6pD;nfE3`2TRR1sOY_0wW!X>lNBy+2sTv}cZ z$B)JKrUtLJFj)~su2#S|#}2is^)acUTw=&{NxZ706U$^Y17p?L5_G<%nuhAyhWY8% z+WMNtwpKR~QMHTtFp_Zcmch%UOrKK1C6UZ)j1toaRv>funQP!M$%R+40pkWNt8ms- z-_~V!3j^RdEZF1rp!Z5xz*S(V979k(Q%lB9#WqU`#xA)buC#RO!Dy$MStl-l-GS0^ zhhimBfgv%oF%#xK1#xW&wi#wtRHVyGru+TnjtBWR#~?=`W+4KbhCvU_1Fda5 z229-r3Nw?adtymx`78wfIqJo`K@_;4NMi@LUa4zr@f*}_Epn@fqF#d?F}IdgTrv$i zH|nzx>OwqZVu_nzL&c&Y1|5)T2&dTpFI zHse0d5NI*t&_MYVjQXbNS}+6y<-UV@^$->PuIJ@Qs=z~$pA(R55Jj3h$N5dK^3o}# zGcgz;d1`4#pSn#kpYHbpI||6dAMx$DDQ@rGP4F^7#8JivOp^xyXpPRfG7|bZ)Zdro z6n5i~gp+~dUG-ivDWN>2;4mCe-3*11MhMTD4l#lu@~ay>@xT=Bw{M|B=2CBF_GZ~q zk0=w4wTT)2Vd+6ysJZ!kF5QarLMxAenQO#DfyFj4Yl$%c?PD> z8Bo3s8Ny%T9crQ*;ANVUSvJT`)3f7fj>70XiKW8$Qfz!Z+t8c8X5fd;f@F9{vbIz5yS~tsxgKb3;_2CS3BMdB(nO{+0xr{y>JUNqT z+AWS;BgvOIYbp!G9+_z%SgpEH%+K|*kO-efV2^ad%vsZ?%KYSJq>^$OsQk#44e^OEhsa?HFEfKo)#1dK8s3&&~3ool!*gjJNIzJ3LZ+DRKw@NQ_ zvtjmWDWBQOFf_AbGM|%59?bbkx}|eL!fk8&^>=xiprG zXp)7W)Z)xo2{ct+cd(hsNM@OTjlpD$9x`D%rjsm2YY48e9Vsi+fXu+7Skv5*rf_PMVRUw z5_W`4A_iX8B3_n|-TB-_&e1TOc)WbR9>=^qjTAc|W*zaC z%_PWcRM}fIm5vz$)gPpw`^es5KqRCx7NI4$opV3oGipNc!{5BnQgDh_t5lxvjd)D-F7dW*xF05%t*EUqwEWwLz2*%@N%c1XSkK@SiYvx(Kg;rp&SON z07iFFlS5)+dC7sYjqP3xm|Edhd1{KEFoI%dRwVwJm!xoo!%cqf2BrNTls?mEb9B$~ z;`d1XsTwSGDyCv!!?r&v-AOxHbHTic9YJ)BgQaKZQiJFJv)wW+m-#vG z5Z9&;-lJkF9+|m$)9;{m%s3Q+muBUv?^y@KzX+iZoH60RgXMD~-k;TtDs44vd}Xs_ zQG?xE*=68x6mM=5(S+Pvn({2u?`jx5uHDF#6TjINDED2yW%@l3JZ8X48aeLwua0?7 z`yDMjk>m2M6;H;}jZN~xYfD022u|n&vP7GEBQ{aFAkhG!#Nw9PguDgqe&8+ShWV`v z5^Z=rc(+~Ct&noBNT+M7m*8q%bLIS&MB}`9Ej6tPh-P0WZduUS-0E%{wFd+nMABXE zDYwM0$SH4LB3TP} zF9tW)v^1fVHHih)&1nw6)l2Xub!}^HWnFqfWkYq#g35(8IBQvuo?F>cv&U$prrU4} z-co6-!b{23=>;{F)p*HV3cR?owiR!Kx3ngj@b*gm+`5`HEWtt;Z&_DXS0lfcguL;a zSkMTW#^&1jwJ@i-v9%HJTqo*lS{F1{Cu-+aR>A3YwJ0r$Gp|uz?uCLtr8paPusDq> z@cGTFt*eo8IiI*6nYX{iL(YRz@P(J-&EDLt<`fq$AluiC%lj1<%s9%c9xk&~Lh zy;ZW^ooK14S(vVBYYy@YvuT_sqHsZVVsUeAYYlQtpwd)X3u{SoZK|tmO^ZQjb1lxY zmZdGNHTCJH=GsLG?DDt=DSD@v>uhzFOCIuixOfRRO4yc8APQj0yN77-O8$=AP)-c*U- zDQK9VsBf!lt;I!a8XHr1oZRZ2*IaW{TTM%A=DqV^*UG&?-nt|sk6MsU6OiVb`bsp4 z=9o-CD3cb8Ttk-4FuX4XSJqTZV@|Zem#_gnZAojTG(%|{sIO*cqzg6bYURy-zB?|> z3r!MjskNpVO&=wwtV2_6ZmDVZ@0KTgZmz9ovRd3ChPH`|`I&b8LawTtQ4V>ML6oCY+k4%B6LU zmDOpntOJl{FJdw*p@CP)E@E@bBKeP2*bEocx6JpA9F5f51SRv}2D!DZb>5!7KcnNj zrtPadESl@BlH7#m+yFOX=t3E5TheoJiG~FirH`&@ZcH~cHlU~Dw?5qP1{tvoHRxNO z40$s8*40!tNI_r&YQ&cdcleIz3&%%}(nryj8(M1{+A7^|ETB?bYEl1*#>KFx5=Csl zFNna!X;+f!nt3(oegSE!uc|@otjA!}(t=y?`yefqzK69e$dsASIBhjcI}U4@eaGb| zhQc4>VI9hSlgj*BOQuzsC#YyV(o$U)!>of}SwTPZ4_9e9+POd(O{5KBOlLz%wvbK?kM(Y1lkwgq zgyX)pS1p1JfnLfFF)|cjQmScQH$4#fXOKXkog#rU}D|j0<#Ex(O|}b%7g-C3DxA;guzc1*1f!K|WhCtYJ#T ztnE&4cU#kZxvs2hg21lnmbSSrU2t=a{OS~1DRWVka#`2dxDdWxB-5KOw(}ZhxFt)| znF-KcVK%L;N>{ew*I(Ss%bQ$aQSXLh=Uji9rA>`8&!F8Vs^(*YT!cRCBNYtmZ8gp& zoln!=3>Cl-(_ERZM{|%txCNaILmiqqTGsqpZBU4H&>7GVm!zfDJM-MA;(2pTTZ;^* z6hm{7$wcNBpYC+l*HqV5HrFBxKfz-r(+OV6ZTZloMFt?3;w|xY(}G{`szOW9-;Zj> zXn+Z#3YKF)@t&U7)=-rYK|~t}rrKJo8y8~;sljyHQd5Ou$giF)*?r_*?nk<*-hYa; zQ1tbh8h<9^u|Gphw%7$W{?dm%XqbuFatGJx?ryR~)54mi?uTR`7tS1a;xce&E(3R# z)i_Pw(xk?kMNMg!46PFm#@p+%jVmRQtlgrJG1s_~gt(=-u5u}cT#Q&!!LBD)x@o4l zrm9hX>ray9UaWyCrjN%v3Ws9#?WF6oZyU?zD}IvUK3UP^ARkd=`WngWkv zv~FzBamRh)eG(Yq?(wN|le@>i_A9klJ8x;)JrCn~CSZ3Cbx(-W;}GFDFZN||&9u3# zNupODOUSV4BQ>hP@Q>g|B7n+zbT=7QoHD+9i;azvDPln7QE$H7 zV!Jza6(=kcW_t;3W0E9upD(-{z?=p&O(&>xkcXI6JVwZ;r&wyZc~d5Ck&>j2#Z&6t z;;JI^RMuCDyOHfl`ht4jx2g0*JoF1iST}5OGJN{pkJW*kSIu=RC(q;x16d{ftY&3h z#=6#*h+OLn;t(+$ZB(t1%5}&u8l?5Q{*!Ic82$X~j((QOTxM!1Ev1v8R97BYtD)h^ zsGbo{U|<5m`UYE7O|onYhIe=EXC)nsS`rH@efW+~z_}P%aORpHM$W{-nwlmIpo=>pXV+nXDgV)WIDQ3)7;ojEKw7W>M>dW}dtZY=$x;7c)-MQT4uO%mR8JHv;!lzba*siN>sL^oG)j|h3x6WxsaEVpv{P~!w{M{%& zi;(ckSr9*#@wTjWn$bbfs+uKQ^D{l_qIpp*qCyP2_@!lpDHskg z1o{9IZCDgy?IGc|n=Ps;Q605t%4rD$+zx`wrxM_xpEZm37uRCi$Jm0P3rqd##C-fm z(1Ylsy0MOkBrF`c>|=cw3LA9vYeNMK0+_&^Uu_f0LM*awlMneNQk zvO}f2z(g9SGfV>MOm7XVT^l*a0=E{SI#<`Vu2nDw^&Laz5~=U11^)NhF;vRZMDlT6 zA{L{dku6HZs0#(Pp5;ck4|0u7mGC~>l#kDwm&~g}puv?>YqN~resx-j+Qp!gaRf%^ zs#dp7bpxD?D;zoJ);1=_mR4k5>U869Hdl2+7CZCM2N5*6K;G?WaMMDF-|El+AImdr zHKEr^@P}aEt<|xra)!&a#Zy_m2L*7IBZ%;#H&M#!gc|EMczmFttdu4whrbuBWlDRNTcg5yP_3hxJRFEYN=_fZuFgpvjC=p z?C{|nDuYrTf_>c{bAG_Yixn%DBK7EK4XsF*AlF6GEFr$4Kz`4^wGmrB&9ZCe_R?Gd zbk*YfP&N?9u2SV9d{F^RmGv4{wz5^@3MW25(JJetVwR?5M+ZF)!yvv%!P)B?EH-L*}N_F$XEB-tzheHyL7w_=oqS+h0U*V%h zWPitb&@K5rK>bu<&%xL8VvH8)xfm4uRE0qSD_LKUC<7ZJ98$TcvNqE&-NZY$5rv~A ze&@^mLWAtdW-#1Si`=ke_SK1X97b8!?Zj*HhBAUI^afsGY?98AsPYrMpU~Mo616q0 z7)zTF_@mF&x>(i4oi2Woj>ugJHzmj(4)%}W4;MdU25|czehUoin9S(pMi|_TMuJTl zHCVQmdli!*(hWl)K*zOwXMs=|~QK;6c-^k`YuBH(q)TS=0x%sX)ELJ@v4)!l&T zCb-YtCGErY7D>T~z=^fK5tTEqxv^e@q-+EMFGx3Yf}GR*ZXfnIWCm%JNdpU7w*%;_ zK}y#_)Jr%OGCg77ko;uwb$NPUp^LdO+U)^it-45tH7uX8kAg1UnpjkqNJ~9q>n@$1 zFMH`tI9a48ATmyQq-T{>iRyqZxM&fHetHKi!d9}|9`^fPu4Q=}{Y2udtZYC(@Y9QQ zwM3JwlSLGxj*RAVDysnvGkxrRGA1Uj;V>hqVCS7sS3 zYB_Lm$H)mc8=J zHPI5ABfTq1QuShiglr&+~xNC5#P3^8>FQOlC_z%d#rn~NLVC~OZ?L( zH`g^|rw;$!d1Y;)5{=V67?Km;*Kj6&bAt=cwF8T&sFj&f((#F2NGP8!SapWs!cE>H zE~^dqz-BZmMz#grVi-1xq)WtkMo`*J=0Xai%Q%?@Gp2CKQQ3?KTKLhFs29Ju7CEoF za%rM<5t?X~d|-w`_#i(U@c;_;ijb_AL^sASH!4bO)r`O|UDM!Z9u!cL=k75YM7Fgx zimz;K^nF2Gobii1yh5+Twor4Twch7kkKHkBKGY*_$CDj=);qiKDSHz2>7}w5$LC_= zrTnaIsYWn|g!%QY=-qO5w1m5@_0Dn$Zt82Rn(^Go6(~{LQYl|l1as@sGKTm^3P75Wf04RNz0#T~|L7CW|=Ar+M!;axB->lGQ4-7OMlz&%Uc04D*6dkAPINTD4b zg^4X>Lc6SDwkXLO&Dz@qdFJOAn2<1GiXZ#I$=Yri-`T#w#iCF zc4I}iSS5poA7|a|7!&dQNhVdjqN`7q( z(&OCoB)7uN+>xm=(a$cLN%X4?-Ng_+5{hNIh7_U$5FL#BMA)g6?FFaMRfG!)!}XiW z<=8NgB)KV1QbxP3tvamy-l&G0EPZnH$3sN^C*+<~7b+URI?Os)q_@HuLqESAN zO3an@G9nthjgpX|#7)+V+|MSw6XJ#ttgw-D6}Cz2@=>1saU;}sXFjWJL_fm5ioAW} z){F8Oe=#;2@qhy_iTEX??A>#B;*>V5DHBz0@e33199U+D(NY9V%^J<75ppy) z)ZjUhE7*{KY0|&Q?#o1;+~iHzO1h+#|FwZ$!B@-;GyStzC3kVVZxPN?!_Tx zl0(Yfmu!K6Kwk13$+R0J4Svbmjy#?9_yTk!&8A$T$l<`3w<^a^`C2YVw2`y>ZT;G6K}P&-9mU$V|F#oIQV>v2iXOM9>GdwIXhq%MZz|Fx8V1?O?SkasnmNQezD zP}a4dpQ)d3DHoQz*!=~Lj=mV0gN@F?CXvaX-;qQ7IEPHiA&1!4r1wf)tsxtUb2)^qBa?GEZv*AS_V6v4)|to^^UvLAUh+AVER-8f zwlC7<5V=V?J6V@(dZbvf88WMMfz%pvz<4%V}a&rs(B(J_oH z)VC*D=$G;w>N2nsjqxW9u$$Em>Wa zmCaQP@Xg?OywkR1C%JQuTSw;pzVZKs9RC+o%t1l^H`HJoM7EUksS3VZ{b#Vale(5`j&FQ(*!bqix9H2a+Rt%cvOmXvx&9nB={eYUz}qU&fKDh6MsS8n zLh@17$jGl(k%Y0cwgI0QLpoaL%JSc~09$n40$KBBEWioI3+zt7Mi0?us^|JsO2Qzd z!WK`ZRpAWFhm6TZ7*7&i8TjE3E$!DSnJVg+>|S_4vfH%e*3r>rspx^@%aVOl(KCs% zS zosxw`QGLO*POzh2S+X!XvT$FV_Ag8Jj%uMo&Qds=l8P>EZjavUUY08Sctx^kd9ncL z>}E)JN<}|(FKkUkC*mrW#fhCdC5wwT{W)VhmB;S71b3y13WoJVNsrw4b2mp3Op5+; z+*4V~7eqBo9f$4ObTd#c>mP+9caab?NPQ_&jGP2sFANI_k^1iF1Hx(#%*^5o{_ z$t|WP`%g}8U78#WH*V3MEKWt!%aZ-0UCI=u9O;(J=c(xL&&S(Rv=;GNZq!Zu7i*M#`8kj0aS&m(s+#waMgA%xH z9dg~lU37yVQj09Ug>Ip?;E+lD!JYB#R)}BNcTmOAd}cg+sQ1 zwLpa^afHv_Yo(~gsgskVah2K#`4f}H{%%Mn%aTLfPv39kzRAfR<;iFgdYUWnAQpQH z{9KIw7_~}H#qH9qw}Q{lKc+o7A{Bks8M%C!Oif7kh+c&;{iEM5YEN!~JkfncY3GV$ z^1)Pe(lHyoN7nww4#ALth6Fdhfs#nIB0FgTW0Cs?q_}oomfR%zEs9?d{Q*h+P!CA` zkDGZadJ2lRj_&PL=FX7Wi_9z$-G)j;gIJkdTPh7Oihh4AdX=jcjAMU;+|Dp+aO&&i zc9WCE4>}XON{K;xu1&%*o1-bBD$tk~jx0;| z`ZT%e8JE5Hrh?`I<-M27$um z$!@NCeJ6;%LsK4H=3Lrd{Xut?fd(qoy)IDV)*T{yfoPv1KpcPZAAJqmFfRS<2;5;@dKlRiN6(;G9Ovhxj zH#%6d+vH?HX>u3z^5w~4D0{EeLvVk4bSq3Al8Ro1@Me>eLm-HO1L;yN-A+hFHy({{ zmWuwElpZLzO;2upV6qDec7?xlL%usN@ppd6JGVxMj>?n8h5JjF>4IF!lS6Q^1-$r( z3=Stk-{9znWEpanuDP>}xRYU=wCKsnk!YpuP>F_gnlyo^G!=cb6eruHqLU%h{o!Qc zie&HjIFw3Fck z;}$p`6@;dUsU;;10kJ^gqGV6_Xfg)#Z;Q&3JEC}_A?Yi>PYS&pX>jTVEix}h-#`tn zPQ@V9T`t_&rVittZQ-B@wH=*u9HxVxI-zb(IIavQGKQXl0SRrar$j^O{AJ0Z7zQw; z%RKe(U$2!KJQp)+=V&onS>cD`CPZj5>q9&defeuNw$7>OlVa3vr|7!2!Zii>OQ#*8 zqIZfVWO=|<`Dz%9p7Rl=f}brEvi%Y=ouefiF?6;-tBtiD>d`6Lqo^;MRNU2TQxX?E zgpnRi_`lnN3wqjeKx^-!!nRbjdTD#K0lK?l2rWSSjxJg1#`urGx?qy*iXlfh9CQhK z0Y;**#v=2vIoYliH@T);mwy(@5))C+&rwNqg;Q z(%wQ^r=qBPrk%THIbagRA zFBd};VKgcHBH6v%*|7-+RLo)hQ=j7YZtVqwOv62|Yp3L}qQYB}Ta>%3KY&tXeL>g4 zeG$0h0(oEK^2T{K@Aq+qnd3@ijwM*K6mcFRfvr(cjKJ2Gfxug}Cx0Oh`MzMNvEXKB zL9_tv#M*%3{~wqTZL%@uhC5(H|01kxWkN0}i=IKy+9ws=(-l@ps5ulPb=g|Du~d5E zGbnw}=x(?LldP**kw?w0?YcHrvkyVFH0Mr}V{PbnNa~fR#Xj{jY0v*m+N&mwOL{`&&Gv9jp_4T8)DA55y}eCNK(8_H{sDE}qF!ioDVfWMeUsc0(~WF__;z;!3`M_()Bvm@c6%h*>EvY5@iC2W zZUT+hHDTo+{T16G-KV>WrWX>Dw3J-3@1#tv|+-jA?E+zB~#L$vZK&SCo%-QchY zvq*L*`4B1nqgCD3Cb!NG9m|7ZtY0ch!wVJ3VWpuz`ng?!0nQIa2y(uL9(2L0y2S_A zYhhLYJpF79(uN?!NIj4og1But!uI{-qF_q0%YCu(JpyUje?gS^0P=$~o|1X*-d0y< za(?0i$pPhV%t%Cch)DE2${b;}o%|}ix5{rWb^0~$Yb0^EFx8zh%WVo{;nHl@hGa7LHm-{cvD=D z$SvR0_$<=;U|(+_I`D0X>I$M45wLAnmfW)}do5?+@d)iTcehN|@m$|RT0v2t*aZKL zvnHChHdz{t!d!`v2KnyjqsdK|qc5U&NnqUBm%IheMa?ejURF?S`uB2d)b%PVd>^Y* z?82SYeXWc%*o-PhrF_=BQ7ULv_p(W79v?QB;k006C!C>!uj<~86N&JmOS%{A3-#|e zW0=PU+BVMJt(VFc+I!#wvChYiOp)};fu|&kCYC1$u0S~Gg2g3klfBE6y(T9&slYy= zL_iym12&PO8@i()TNK_bQTZ07^0RPRvL_~Itk&Obb}{)aZin#YTswrz`ntBZFWUbP z3tekDr7t4=!dqkn`f{P`zUTBU+>nYsUl@-CABJbT6czp!4Hcew0>zS{4NmQXD69aD zEA^!t3|1htLkZ!t7f`}zqFlB|&tkKoTk15lTl72$FrqchG7?2EL1=ge-r9_I2j9Ks zN^w)JQvA_vr4|g^%x$+Jti*u(Gdrdmou;#LY5F%b6{8oUk9MD&YuENftR%Y1fD8Ky z;sfpJF1cW2cPD@XOV9o6DCgM=df@!;N3D(I1g+&G;6fPM0~Od0YdLJPVR`Rwe?}Oe8T=$%aui*L)E?Mb#5Pa#x1%;jS2*c{VSSQO;Xcyl|8^AI4ZJq# zQZPfj?K8c)2gVC&B<|qSxn++9=)Qt{$@U{p?XWVv2jw zC<}@v$0nMm+^RVDBIpIANkl1Iz6CjkWT!If+9@{hzUNZBc$lWWS_$3WT&aIQ08n%k=aASaeWfQc$HBA`n<~3X)M7h2v_DJ1BG+78?3k2b(g!GB%xyE+cpS%kpr0f9= zz_TH_AG=B?x;1ZMS@bk?;7QEQ5b63Q;%3}|{e#<~5{)-{0jZdP*CMqOriI@%wnq>3 zj1Sz8!pOp+g5mv>#mglo=vs={8$)n=a(nCty6wsoVpN!XhgbL<^mnO{EiN&6@W$kp znBe4jLpet2jS|~*+Zf#p*j6Zwt{tPlF&D%y+%pBW%=3Bfy#hdk_WjC#5I! zk+EfJvbaKW_^M8fJiSjl&RmN;qYvD$tqU~0`d)Y_Q=Z&(5()?)Q8ud6pE?7WA?|lU zBSkE&M9tBZc4KEfo{x)lVz`5hJTzU%cAFT8{D!+ZhNH;KO{4Hr%z7rJP7l! zlwBhBJ%YOnqDSEyIqQlunB;afG)0CHseokHd$Zz%(PkT6lzt8F?TZ*jiitLds~+yc zJ>t9qmk6gG@6&!-auf8eyK#*M^eBugjC!{_1#7_2A72;8-YB=@AwVC5;j*2NsE3Ba zWgj3587?k_gJM(MrzlvzqQVd4Nl@w_H)x(z=UVHJeWWF>keloh{Cq^(1x5X0%5Ln7 zzWCZgBu2ONElU=aCwoqnr=o*o9U$)C62pe90=B}Z?D7r8r|d~=33m;W7PHAg$*p`+ zB6<=bI|?nDI$<}~TOsdQ~V{$!Kh>MmrG#fc+(2-3IkvdMcpeq0vt>?fz^ z_!xiO@ntc7s^jf3KHBl+F@Dk}f=-O_eH}kJ#ydHFN{p{}_MaBxr#pUnjE{Ew%ozX9 z*?D%1KkWE9F}~dK^J08w$5+PqgU)`wARMGNJI!R7K>X=E$A`uEj*jEyM{|7c?BCYVMB;A8w~O(^9UmU!TRXmejDP6LwL^^G;`oj+ zKHKpTG5({|kC(H|ag!_8PKM(5K^)&X#38^zRzuw>dsK#%DXedyEfu{1-9) zjw{z*G5#CJ_lfc8j_aGx+2lu^e)oo17UJw$SFZg#FuC}p<6~lc3&%@he1p?JHpXvs zd|ZrAcYJ(|_ji0^j9=x-RT|^vj!%y9%blH5Vtl6K6)`^0@q=RgFV3DBF@BBXvtqp5 z@k3&~m*cZz{55C)p)r1`c0U1Eo{Rjyq6R&_RMs^f=c0nhq4et3+( z;q<3t{4&QYV|=3Hb7Q=l<5e;Kf-}83#xHQZCdS7&J}<_YCoB*wcqesqjK>+C-^#?N*9*D+r0?CBlje=U%A=(F*R_K>xh+B+qdW#qMn z7DIohL^ht$8G4k{lZ}6L#FrVWQ=&bi2QMpUj!51`&T&NYUU7~il9!2d98u=C(>f+b ziTHRc5>bx0(R1gdj!K-otArdpUcX*X+|QoJ;~&rC@sH=~UAf90Q6e7yNNVJMYbz_K zXHg;^|9JU${Ns5%{_%XMe8i3@5s!aFC`xP3a z@i<3>qC`B-@jM>qcpi^)Jl{z^Vn>wNImQG;iFiEYc|4x+JRZ+@9*<`{kH<5f$Kx5# z>a!8PBKW z(NmF!$Kx5VCmzpu9*<`{kH<5f>u4=k*&|BC;~7bf67hJ(^LRYtc|30MJRY}r9*+OkBryu&mW;6Dr-YZ8^C)pz<~%%!5@&{& zne!-dcIG@hi4rTrOLx9w%Kwg~O;~^}E%}{Dd)(JGH$O6up8F6g<U$=Uea8ulFW?Ol+aUsjVpTbNt_OL_8LhWm2a`F)=9w&&rU^7!E^gp#@R z_sAnZ8zEyZ`RY7edR#8~5eRK_@gd#CpV@d1?sA7jbh+gB&trcPZtPWX9PgIBQ-36J z(mOFe!x!*uY#zUzk9N|#07mg}-<5&$2I1}-34Fpjrtgk+(L1p%ukgF{JgY=`dndB- z+XnKd^7w5}C%;`r&nljkK)!b(8;7WWy5#8>t>Vvu?6`UZ_4Gu0>z$aN(XYO}5(;}4 zAQK+$`$KTPh2z<{eF4+=mv$bE=bw;2;{2SAt8u$KR!Y7F+4Vvb`Sp4He`-PQdY^@Q z?;VV{b<|Vu?1b}pxbI)V`FF0o*?Cj#`Ox`uo{DEyKAm7s?}U~z`<)ik;pg7Lyrz0S zhKAmWY&@WRrt?EK9#D?K7V_D+Litpj^bXbwxZNEaT)x%3%G$HewYO}XpnA@A`m^gG z_nj!X`!ZMF0U13{@~qDJCmR>3o-VGPkIBd@zXtWvJ25WCw{Ui53JO)^$zB1&9|p3Z%HQ0 zkv#j-**P}DRp-5~yxH|HvUA6s_^C2P?qe!`_736@^+TI$KiT!pOy2acv$H;er_TCv>+RgokCvf z+EsR)^#b{)&TrZES{?c2dFuVNJoWpjvtO;q_Lq$=-|Tusd&2LW-)fj!R{l?JoT~6)z7n>|Fi3$eQD2ZH$E)k6~5<*)q~DI+4Z&Bun)?s=b4*uGAqycup8{mCBF;m zHy59sryX9MN6&Bb@C#6`T>5X!BQM`~lS_Ve9z7C4<&xhHe#^y&Xcy~OuV z@#_(J{4homar8mET<6aGkMTU;)bMih&A|t;Eeq0lK=mLycg*Ie>QP=zZuMx7wtPh( z-y_KPoPc)^_#5PE54OSG@s{CR^ZIRms+}so!ElxToLuaDk>~QEPs68?OTO<0@(XxA*zjw~#r_%iug8Nt5j~G9 z#OFGm4>4SAvvz8|SUZ2D9?AE4p3BDoo?AVG$gQ3u$VJcRJeQAS13nFDdVI?hs~-k#{b)70wjbqTJ%;V4iS~=0Cf+L_x-JntA=fxg z^BsZlT8<|JJ?n5imHb(9wMXS&FkI!|AeZun{irj>e>sFd<4@hsp#lFi;L8FY*6*_c z|2UA>@6WU4`h@bz)y~h!ZMnWQT;=t<_-wh(>FkXV{#9VlgL(KH0oOTMZX1SqL=Mq2 z5&!kTuR*y(__GS}Ssn1_0*)8#+#&LzKV{yRL->J#{u=@w%6}5@u;1zT(utmMJRFJn zQT2!R?-}r|f_%r2YrSYY*YBy*dQmWJK$9R8B7~adDX9cWS}S1 zUmozCg8G^r@YjQU&j`4Vy^?$mxgCdBk=t=t_ATX*@`nArnhn76H31Ljm)TxTtUb&j zS3hXGswTJXLB~wtVY^lTsh_{({pT3{%2x*Z_YeH}M!;n+LXVz2mwYD&d}zQ!dGVth zYR^c2nb_BGEx)cK)ekB^p7P37Uh6{a3ERm^qyH!7yUK7~AFVd}RsKrDRelY*&38ES z(ekRFN06)i%C&r=C-na`qetzTX}H>>?Mn5ly!uJG$}gZEYyY5thy6>-CGuha()KBF zW7xk!`6=|3s2(5aFAn$-0iPQ1V*?(_bDBy>zMBN{Jt=SdbzgGZuO|ii-{QG^GzDDp z&|^u!|DX_`%K}~=$gd#R_HZq)wV!IeC|?=q3ET5(a$7FF&z9@)Kui&lhyGD}g#U^6%Ew(i7yf3z^T^jO9dk*^5&%7DM8!uY(F=W5Sid3^&v)gI-ylZ*baUq2i0 zFyFAhgm!KSreEe6(hmkC!+W#d|;$yx|%TOd?nPDqn86%FiUX{_jivpSHu$evRcsh1x0l-=R+V(Ecdpx+LIr zJQw>z{w=xaISBvt7|wIi^Qc06hV>QlnSuN|$jSbb9M$|(zbRirF8S`jbCExX=QiIk z{(Mvfd8`ZM*MUvq^^^S6e3idIZu5PG+}6umvxMakJu{e> zpfkv=o|WWQ&t2r!p8sll3+KDXs8c?4UhW4QL%wg2@81G>ZJ$`*!UfRz(oX_Vy>Njl<%CDuo_)W(^K{|fgeAUl3-}|UX^8Fpp<>Nt~ zOTHn0l3eXPly*KF$gjh>^0&#Yog2t)JNbm%wv(RB=YQHxhEc!R|1QtvL)*FC$DTtO z$#({A5Y$R8dLHMwd}zOr@gn45dw3y`*Lt_*)%vpK)myFoota?mFDAEk_9VA<{#W%6 zUdXzUA z`3A~s{i?k3Wt5kEb<7sDCJ!IZ3KMzV0};{D# zD6h+-r-|Iw?-Fubzc&PW!udtpo5Z&zER&SCP=4Uh@*c;uu-&dh`mN-uN9|YnzM=$& za+TM4LGlg#6XyGbzt#QJd__;lTPdS0LydQis!)w7;@&Y-;7uY6@5 zJ*&x8&r{TMrO~7OhCF(1H+r6@p1X`5h@GAp8A<(aW6aC@-#(k96@_x>H z)Nfi|(epC(yiKlplz);(&$j^&?F{!%%7b$0`bh2HoX_KmDWmx+?@KOz z2<;z0ZtHO$u(f5QG1`iJ83?R9RR zZKQt+nV`IdT9;WfvnX(FAsky5ATBa>vH+6A`ibH z5C2mhzGb)E`se52m*nBk<>7scbL; z5A__AhyOhfAIe{G5j{F)issrp{Ea+(RG+Lpp`J7H@O63kmJCp=JqrWA#AoGx-j#>< z+%#)XC|{e0-Ir#S9)3<9{*OF-ufe(XFU!O44EPCwo!{l*2Mo#T59LqH!=K5+du@?h&oA@v zGxPA*^Y9@B4AP?Yk9^7HcW+w$9800%6;3oxqb-+&!_o3I4Qv<#@;HL%rp*%d=E~_V$FU`ZR&ck2L!$%L#>OVcO=jc3qT^>Gg``mg?&cmMz z_?bbz2kem5b5_7F&BOl|@UsK?y?4y&3Hh>spA*Qh&%=vHWc7sd3-j>1^Y9<@@LhJw zt$%L7&kgLnIpF67{GWMv+0I%0q5L^{_-lFipj~q7nVW}S5b*N@J3Ecc>Ir#$9{y9n zR|a|}jmqk|AmHx?{K9~b*flGEQNY^*zAE4kzS8_uL=02ft^G4$m$9C;ynE2JUsP_te(|@{9PrBm z{SW2g(Oy|Sp?rBBeqO+@2=xCc;8zBG%e}MuLq0zbza69&*zcJvy4fw`@-x=_ICin{}?_B}E zDGyIh%q_oX9)51X?+)}w2WItzyfhC#HxK_;!0!q4-#aO*Kjewh+kV`t{(tMl;s zS-ItRIylQ8@~7_SqJTdf@J9mvNWfD(FF=3)eZY$Y{#3ww8&2~w-;g7Eo(|+UGx9n{ zZyWF@asGLM2RjB_^8J+8oPOQ@_Pb>AF^1=ougHJHYYqcWKAhjxUX@RRs>{WU+;pFi>XUx9o$ zo_B*@IaK~N_Rs!?>+|eke-}pmf9gb^ILhehL%;18a4F*tlrIUm_(A=w zzayjiOW2_FomI8}>YaSPhXr~>|EZL(47ljOiuGF`aB2VN6nH(&0T=meD1WZuU3tCA zaP{LAzVIY0T=oGOYsB8cL5jq63(MZ`c>^&LHVu$7x^o=p4>FxqW@{i z4-B}-f5&y>_T=j4YT7a0$ZNZt7RWyeJ$f8zVh95)u zgALblM!x?|4)u?GKam_q8h$@{li`n(FEU))!3l;x(9P>V&F~+o=N!W~<@JSz@6GGg zhF9_WYQvZF`Ub-<;`ObD-_Gm141a>x@;%#fsNep|>ve|z!0Yvf59;ji*Y71zJ$sYC zWaMX)zhU^1Fw9=H&FXWkQeYi<+I5P4PQpy z!|=Pv`x^cs`DTU>NqKvQ8eT@et>F#iBMiTsd{@KoC*RZX*U9%c{2%1{-mm&WzjvU_ z$jkRS$uZ6FeaR0td=~i}!xxdyHT+ES1%_Ww-eC9}v`Ysk>sBkK978(;YX8yYxue3|2BLL zd1v-l_0R9fiwyrOc~8T?CC48qbBF2~z`6Gt!N&bZ42a-Qy_%F#{G`xZQb;FM*|FhvM$=@~H|GlC_;v>T!p!`1!_kRxt z>odbYr~D6w`@g4xbw1}S^-td(-d|k|-;TVy;r{Qp;rBocpGx_Gh95@0h2c%)+Zeur zT)ux>4z=@Q@==E0ME(oIA0pq+@Yl%48U6`*sp0=3*Y6ind$#KB?K{lK_uRzuD#J&U z*BU;XywUJu$lDC}f43=-IL7chDSv|D&y$~Q_!s178a}9}xBq;@cOk#n@ag1N7=9GF zeDAIt>bJAWZ#H}l`5lHoMK0fG8|wLh{2{}mUS95ZhHpjwl;Nf1&l^6Q{8hu3kpIc> zbIAW@`1Rx;82%u+eBW$XuGh%FF#Hqp?+j0|9d>5CrhdMUT)*c^c?o%MBVS5B!0_qh zLkvHRT)!7f_0J>U!N@m}>-S=*{4wNv82OXP_cQz~^6`dWOg`E0>&T}Yek=K5h9BS0 z*T+1=e^2>3!`~!tHoTyZ*R#a%5#+}iKAn7p;m44lX86VA=NNt``GtmmK)%}W?tQ(T zR~tT@{074(kl$)}J^5XRuOwe<_?_hI4F5g(dc*%t{;c7BHud(uWcc3Xy1vo&mL~s; zkw24sgW+q*KQ?>=xqhFU>hHq#^Rp#^$lU%-MUJm80*&xU_R{;uIY z_#p8k!-tUn!|+|mzcPF}`45Kwnq2MtNb-{nA4`6w;fIl*Z}<}Oiw(bs z{0hT=OMacgHO9Lj$j>Mj${8$NhT z&tElsZ*u*8M%8mD`QMEE67mlWKa2cR!*3@4!tf`_zcc(Vs6U@3f7kH0$v-mud-8u6zV)_V?^lM8C;!3l!^t~w zzhCWXCYQfACx`MA$-5hV9eE$a?;dZ~|o+d9fyqUbh@Z-s68Ga?X{{Fc7^AYk&Bd@=&HQ(@0C|_@QlJQ21 z;X}xm8omel@rF+%Khf}ClAmsPJ^8tYpGl<#5q$o;&$e!qvxe?|EnjC|o3 zFTbbZ{m3U8z7_dQ!$*_PHN1qp$?yr}#~D78{0zevl3!wYJNXTU-%Ngw;g6C(Zuqn0 zFB$$i`P+tnK>nHGUy}c5_`k`E_NWQ({yO8f~_yOdT4L^u{j^Xpj z>kV%tKhE&8$@Mw2+J7tgl}7#%@;eNFp8PSx|3dz<;njP1|7Yqq{h>@Q{ zUSs&L$Xg6=AV0xy{XLhn4R4|RWri;&zuE8$$?rE@pM&djZ!Ooglz-L8-$4GZ;g692 z)9|Ore=_`a^6q?It@&;sA7r@Bv)dXzhx6}lh9^e(el*7Lh2&EW|7fI_pKW+0_174_ zg!5^$;U|(GZ}_?7`n^nA-Z#kgIluA`$*(thz9QG>|0=)LF5Z6qekbKSkUwYid`kYN z;YZRB9~yoF`PYV@OWv8!?KR)4$a@=pC;3prpCI4a@Yl)58a|JHC^x*C^>wJ>wdC^* zuP1LYyqSEN;TMpfY53dZmm2;Z`HhBmrv3LC-i7=L!#5{?+3+pN|7Q3$lHcrpX5y{xHim%J7rP_cQ!B@@a;@M1H8@my*vj{A%(R!_}T;hCfUB^9;Y6 z{9?neC%@M4$I12k%G5s_$?q}pACbRlcpv)nZ-#d#|IYCB|mRr31`A4UFz z;p53)GW=D^{HI3#81k`4xui?;Wo(T-)3IhHJdH z-td9c|FYrRkiTvCF65sYz8m@XhL0id!uNF4KakYaIKH;SJQ&neQKIzKh6v8NPyC->Xvji^+F1^0$)jY54ERCm8-IxxR;` z`oAYn8~LBe>kRL?tM|iF!?z?q$?zS>&o_J&`BjGRPJWx=$Z%@58@MFloG5mD$LcVXMe!i4^h~e+EeQsm;E99ky zpTzyl8HWFr`j0UDOY(ZddyMw&|7gQCo;lg@ew1Hn_%QOT4Bv_TR>KGG?(==n@Wtd$ z8{SU-hT%*1^?Kend=>eZhTleB!1u+pUfv_`X?TkJ$wLg+edZB{??d^$4KF31WOya{ z!G2o>nS3+8AE$gW`EbMMknd&q?raZbhR>(`uMA&8uJ8S6 zz9*Ca+Q?r*ewN`kldm@X5%QZ1e}?=%!`~)fZ}?Z_uNWS2JbB0Pf#jbXK9c<3hL0sL z-on?L`e8QtW`-Y6uJ0kLd;#0f{ziTz$CJs1YrHYraE&)=4AzT=#j}4S$<@&N2M&9ER@ClSpZr!oI=8*4T`0v@?b~F4r_KPuwzd=65aNRHcrQz>Ve!k(lkJ@VZ z2b4d-@cy*(EW@`Wztr$i4dhoFK8oYd zt%mPKzSeNHbG_lZ-~N)}Rn+qr!}s3P`}bqRPote*8-5{q0pI7v|!)}IeNpk>Ogu?S^YVI?M21vR*DRT>H`WhHF3it>NR@ zo*y<``{~n$Pon&5h95`%j^S&`KQmnWUq#`t@qarUrYJF7=APP2ZkR{{-xokkayyH=vv8k%I=DWS&mE@xg zuOQ#gaGj^78h$I~XBmD4`C*3Z^SfHZS5p3H!%rkX&G2{0&o%rN@{0|BjQl#opC-S< z@aM_jFuWW4>AQy4lYeaZZ1RnUPbYts@9%4U?Zxr`J;N_2*Z22TehSwSJMn#aDhg zPutmWeO_|_xqScgLhpL_bBd84QtlIH27G-WKRe)0for~1hHJhJ0T(@u)TQsoX?gYe z{t1*2SgyBuJ ze?M|9@B6IBLk-_ZKHu=c6MV+U1^Vk~i+r46jeg7e7mRUl1iY`tki5_2=%i zXPDu?BHzhyE$?22Yq=&E-a!w-Gm0i*HO<>!*3-&&hTr=R~WvC{9MD2 zBfs46lgV#3{2cQ848MeYJ-PV5-n-uYd_Uj~0oV7TwEaBCdMx1kKFYT(@Hcfc`~q@) zUrFUVM_ztg%8NacFCQZ$4h-~2dzPb`2T%)I&@{0^#Mt*X@8_DG30&>wW z{b)4%-DLrnc77i7)%TiJUdPW{jQrmze@DPY|JD=n1IIeU&tkuOHsF%)tDT*A;)Q^V z9^Lt%h)>(}?E)IZvf z28{CQDt~xae?2JRqF?{M$?$-SJx^19M8HM@9`~Y%kZ&L54usu&Q@~=_8 z!pM&<^!n!n^3pz+d7P*TxY()ROQ`Q>X?d^h;%``NzLsjQb5jUN5GJf8)6q+IK~nTc-#F6BC~hzWcTNcI23dg*Goem_fp!}WU&hLLN% ztYdqd7|4q~pEKKvfQvmlGT+&Te?x!j`&nw|W8_B~`D4g`O|JI*NP8{~hB+LvGc)VZ>PTJrFu>w-`>d2Am7#SV)6;(>VGaz z6VnaXaekiRH+XXrM;ZPh`KgBYWVu!vKAQX%!`~u**ziKmcj4dJlyPPZxxVM6Z54N)$C9;{>*IQUm9F04EUjTFdp7%6EK9l76b$gc2A^uxKK1h7N!B-H! z(%?4|UuW>gi9coVBg9`dIL{{^89bHdfkOr#NBnz(=Mw+b;QW2QG4#3_`yrLqogN0~ z_2>+PA0YX24Stk(p258|pHvy#Pkf!hc|Co|;MpX6?a(Tb{s3AX$^gLtmk;GpzIPXjM8hkX#ziV)| z=Whn*{p8mMpGta;8Jyqm-Afb?``n;#M2GFf_Rp}Zzn$A;Exi&&fwdLZ!q{i z;@b@VH{!1uoL|rStHJ+4@?RS~`aIo#y3%u5_CsIdry86;XOwF2(@B1U!MVMr5y$bh zNEfNXIfndsQ}xApg1-jnJK7H{5FE!N>t7-`%3t4E>$zNTl;_{AyH;?N|B2*R3y$)K zXrH!TaFjpT1p+wubx8Kx*ChX_kZ%ULCfX-FB{=FCM|v6sNBJYXuMiyN`Flfl3yyYv zLFK+>a2^-(ccRh%ys=+@do^J3#RIeEZ&mkT( zcn$HZ48E24t;E^?{JV{t4L+6n=T4!gifqKwAB8;nIqnpF@nb`twky_`1~1d%R*T@( z#PHOKUQa+fQUBGXzXx&jGy53jhZ^#4lKfeQd=d)7G1ZVyiq-r#hP+>6tK8tji7zvF zF7aCp&i&*;!55P(o}MPo?Q#iqxR(S+KU_+7?h;&%>$e0)`TI$p-*?9P`E{Sa8uI)* z5eEfF{rr57-;c)aazw^JU^%YMR2sIn&fSI-G=Sqao1UJl;`iQ=qfnc^Bs-f z0mQLCpg%L=50CQ^L);q=iv6emHNZbb9DL4e@Fa$gFj9DVuQa*ywKpU z5w9>fxBGH~zfSV}xed1GJ>s_+@*ff3Xz)*n^XEBOPbLk#=MDL3#P=9{Ch>O-KA!lW z4gM*W`*(wXP5hq*=ilM|)!;Vi_l~Q5FGXJbMJ!&=hp@PAvo&c?@jn#aMZ)|+b@End|UzqaM%HL3VnYg&p(|F9!>LD z9C7X^{2Y6LkZ%T+etOb*DINI|V=~+#j>zf1D@YoViC-uAPwGiE;lhz*tI>Pchh<|7B1H_LT zoc(#q1TDaN_&IPNgBL-6$KxF0JT5ND)O@MIi-|vC@I}O*C647T(<)TB%aFf^=7F~a zN5AEfpWhK2`yr3dzY$0Mmka&h81h?4|1rT)e*@`1F1Q+ZqqVZ=iTaHCmka#~#MwVD zlKxW#NB!TE{vm>+exAoth5i*n|3pK6FX^8qIO;#Mm(Da(aH&5}=)XefUuejGMEaKr zj{2`A{Z|Ms_1_@$Un%r&Fys%D{znYXet1^sSt<1FGUShwp0@-?JKrQb-w_<`gqTs0iInv)p zaMaK9bCTdFf1Kop3y$*q`H>94QJ#OtWSrnA&(G^J1xNY%J`lh$RdAH&=W@A%qx=^n zKSyws=htV0f}?y&UkKnR6CCB)pS6Ocd@aeZ5FF*X|J*>F{eLf9!{Z*oS81feCxsr= z{}}0i-r(O8Z!&m#Kdp?vua5T#{5j!w4f$6|{x1fP?yvRm_t>$XnZ*BL$X`qRCxicy zc&ovC__coDWPL{epdWay8A6=<=an>Xry88cQNZBb-=-Rz`&F*NA0+)n2IqZ6rNOzs ztuQ!`i+Y1|e_L;G?pK=(&i&^J;^?2Nw5wG3q9LC` zQT|bqe^+pn=YD>GIQk9!GY9_gaGtBr$gj~+6?P@g^FTTIt+&B>+zmB2f8R)&(0{Ga zKiQC9PWrP2e+}gMb7eV#W4-wGvI630|8+utg&|*0`j-p-8pvNTSZ7)(xYU0manygk z(0{ife-G(@MDW)@em&{mBDmE5JaN=tFZBQ3kl#xB-!nM-;S<4M13iDGaz7Is%jNGy z{LbKAsUQAAob938XzLVu-hh0yu#;c^;ePTO*~zc-FlRf{Ne|CI{CTjm1ebPZ8Rhak zcB$Yu2zyEmJs*=jiv>sjRGg+WEfXBe<$imu;3&VHn$%3Q&N|H|%9OZ|QKPMAs|4i2Ets;Z-9J)&I8%Y*Vn+%>r*LDzRKWw4& zdj@}((tk1d^OXL=;4f49n89D8bSs^)UN;FlJ7?(x+vAv~(>(=8zx|&4)>rVoz9SY;-49OE%6rO+%A8n_KP}S z3ovKgKKy^C*)Dj5Squ{HRN|FY0LUp@O8xS^p((qZ+X`7cR+jNsC569h;3i6bC@ zV~XG?&-Xhs1V{OLlAkR&%JcWG6bO#;Z#WW!fG~{`oGs57xq-P9q^bgkeAv6Mxi3Z=G zu{Gb|+lXIb@WaHfC(iY1q4}`E;HPBi42?q1deVWXH-$Xb_g_@s4~6{gLjI7DNB^&; z_BtXs>ItOiOh*Mrd7fwN3-xvM&mB6d!c&NIy*85m-h!k4zmWd^f=m6wh5kE*{xc2v z?WF%)!BPL9Q99H4f=m4u8$2#c%NH4(>$`|J)|cBHbF4Jv-ynO|2#)qFBztZVT-w9; zbKGyACHakpdr--vXowWH@laR-9kCUFa4S9N8YJF{Ro(GN@JeTx)seV}QUBvLz zgE+VQAxaMv9POD%uWOtpIQn5b`G1t)DE~gmrwNYoJbot%j`F-NpDQ@Z^E^4*;H#M$wb*T`*Q7ky>sUZI^5*+2H0di``|2{9$;|x^H77Q zko*{fXAqxY@bSbiH28VMFERLZ;>8BPi1;FdUq<{2gO?CrZSZp9w;OyZ@%s(FiuewL z-$;B9acswXv@2Ekt|9*ewa4EC$A0n<^^;Ep-wS*h^}}xkM|pmq{XYdq`722NSHV%f zA`JpK9NBaRJ5ioL$J*84Yi4M%HAOO?}R;%2t8P@uH?t92IqP2WrOqk@81ym zHwyiK6Y^N!8_3SXf@8T2r#=YCi% zILfz@{8GVDo`0|5YQa%{)L9U~alPOu&-a7336Amw=b*G@-6=TA^LqCvac-|h$RJmm}hSnedUvrKR-_q6~7a8wG8^1R>U`49C! zs3di;#*m**`tKAR_4E5(?h#z-Zy=8P`Q8Fcc+QY7BK^AsNBy}IP#WqXxYYli(EqR& zRpCKHeiiBe+TiSm7K8KezD3Q_O40sDg#I|<+>UpUe!t*o|NUhDAi>doem;;Q^gk-} zk2mBWB>fi%j{5m`45te&{WC}CZxH(D8}iSR{w0E={?QY4rppDF_FpgbZx;G*H{|z{ z{`&<-{ro$I4+}2se@5uvBJ?*I@*k4^X2DVa@5%l*1(*8w3y$&wCh0;x798dI_sG5> zj{O1c@oRDGxZsZw!;>#ZC%B({L3Z{K9Lv3e%Izh%v~vh?EcbD(QiWp-`JYJt1i?}N zYovdQ;8Oogq5lb?Ki`md(fT^y;5?3&3O!E>J=YrY{YcL`!O_lBChJVM3oh+^K<UPg~5*yx9A3e>y-%o z6pvWqT(3{EG#_B_&xxOH@UMtpV(_1c&o}sS;!6!4&Ha-&+POoUqQYAZc_-bs+$}h^ z`yBJ%6rJpam3LNF97G` zd_z8k>YHnDu5XdxSnhOseiam4l}mo85gg?=kbJG+(ht`Nj`F=}zgI7~^uv0=QT}%% zzd>;6hlh!yA6^7`KAtt?Cy*a@8Jzv_mf%=!D$W1z2rm8bSHV&K3X(r4xb(w61V{Pq z+z$npe)vUjlz*Az?cYEG4xR_NKXf6Ee%Pr+RM^LmpH6y`1V{bF)USpMF6)~ixUz@) zq2MUb{>&5{7qMO#6}* zf}=dIQ#TT4e_jLE@VLw1Z)$8kXz1xg^W=7eClcQ&^t?nm@btPN|66LW4+Tg22h+Ov zXTi~azEA(s;N8e?EyS^2SnfFZ!^3x}K6AesM0WNyxQph!AqMCDNvgqlA2Pw<{Ch6b z49>rka;d@j_u7I6KbP!WZ16ndR~ek&7jlciZy@=54SqNA%?9V+-+9j9WoKzWzG`s( zUABD&=g;N-)!_X7^IsX9-?#8DgWq_TF4r}uZ9DSsxpXx+|DH=fgKwewo^EjdUA7E^ z^Y4*OF*yGo*-V4;@5JR9oPQ^-%;3Apo@EAqi}-a0-%tEDgY)kJZ8A9je$5jGKSX+7 zF!=Yx|6uU5&enc^-{AbY=z|77MtZ(Aco*6~|J&gGh1`n$nDCjCbZeweu9vbOE@Bk@>+^Y7G*BaZX)%Q~wH&o|_& zXkEBSa9kJ4Xc0lF~^Auc36Z!D}gjG`EU7Ft_SmD#OvscyaM9MP7Ue}UPOGY!4DJPU~rd9gG~lMLcGD? zezyiq2H!!P>&<^Y-LEHkr;K96(xYyuK#Qg@Z zkJ9;*48D_ivca2(XBd1BasK=_+mk`{%{Ao55zjaHWa2@C^Y`i189bBxR⋁%g0_ zOMHXD=Mdjy@FL<327jD*li-WMl`FJ6t!9I7BEHYy>nXk8;9Dtu#NY==&oP51QQD&C z9O!?vCzUvVKPdAY;(j4t3-Y<7Kgr;Sh$kC7ne=2BJV>0sw*bqP`g0BWI?|tS@EeH- z4bJvd8l3H^HF!4JvsUo!pgWHAZ!mZw@l6IFM7+V^>xnlBz601e;>`xnB)-q!Q;F|4 zIM1_31Ybb1csgeA8mg~F;~xEw^FJT_eXb!+^07jGAq&Gf(cnpR%`Z64=X@j?d^qXn z`5Vi{`J9goA&-13jjw><*q`~xH24nEpDlP53&T0r;FWYOU+`)nA2fI;x>hMTubFtM z*5E;suM>PRF+9~9yn(K*6?}=1-(YYrUE3u1QX$`9@MgNURd5`SeC#lI8TqqG@MSCv z=VpVmJ^KW|T*&V?ILjXpe7TT6Y;cx8A~?^rnC+OsS>B@c9Q)f9LciDGEFUZQl|nwz z;FPrdg0B?vNe0iSYsrGw3Hc0zH_^3#;H!juroj)I=`jK<{W()aSg?z5T zi|AUu;I|2R{(f%Mk30ZpJSv6!dW}?AYjC!wPVn1>e7(Vw>DpSs?-24E3?56@HVJ;G zkZ&+J+p|@09@Cg@hrxrSt4Z*?g#KoOyJ-KhPw;z${Ci-IriH{!Yky4bI~?R`88NKGERpf4|_HgnW|0AE)t|EcpFGKEvQV9s`0u zAmlR*&h48m_=7^8zpowrfSm2m7xE7Y`JlmBf2H6L3;9}u^S-xE@JEDvy}?=kTEXS} z12-6)OuI&^2F(JR-;H>|E;ExOW!v<&h zBZ5C61FA#C?2g}m3`tUp%pr-VFzuRrQR&hmaCzg5U58Jzde$$~#EhMT-aqnDYw!lTP$&3vEDYy*gYN;q z;;~ln=QUE{27^x}`Avd{<~+#JVDNgy&p?`&X4^U*{R)FbbU4+}2ue_bGl2g=L)T=pyS8ZDwi zer|+Z-nY&XdgT3SrQq^DbgkfAM=W5Q;BD?J1()}a9}6z;6ORbKLfFsy5wu_4_a)Lk z1-ZPx8!ouKkINRkPUx={e3jt*TnP1FCHVV7UfyRN7yKF_AM4Z!)N`%ig9N`$@C?DP z7ksMV^@8UMF7In<1efK2>o*3Wzjl?@^XI_CwNEuD3q7`rEx-D?u)Vom;0Y0!R0=uR&cqWxlwSrZ{hs| z+9UTTyzV2H`;c#h9=YG(bs6R5z9Np+S>$s6kRRL?m+N?=;Bp=RPH?%7zefE5^~iO+y0fkfa=DI|bqRC1j_(#+uH%0byv;g( zN?4Cv$FCP$uHzd8m+N?E+K{82avgt9aJi0uC%9b4W4eazk?Z&n!R0zWNpQK2=Ls&? z@nwR`b-Y>dI&Fdq1Kq;*tP*^;;Bp;5uX|YjY9arC;MWNLlHk`0{wKk&6Z}WPuNS;) zoKB$s>jh5}T(0AJg3EQhe|%VvT*u1jb|;@OuTnQ}AtqZxFmyaJi2ErKc9c_LA#( z&t73J*YW!Wm+Sb~g3EQhQ}3`IxsIPM_$Do)!lu4q`TGUmFSuOCj|wi=@$UV?dgMBO zhTsni{TB-Uh~TAyKPvdOf;R|$zu25z2rJRO7JIz zJ<|k#O7K#_w+hbRuZ;Si7JQSCe@5_~fpdY;8IxcqB4f_ifd|07Zz8P6csG93WEhzc{LSz!Qxt}XmNFM zRbF91S=roz!UcK3g7TuW;=HQblCp}W7MfXFUA-7U!BUwi53iI}%v)lOC@P-2cwSz? z+__c7kP2A=MduY(lw(>`nVqYzj9W|s$|;y_NwA_?vXF6LBzml-qOhW@om5rv!ipuu zc_md93-d^CURfz9QiXw2NnmMpsTP{MxTK`Gs<=o<6)Y?Uz2P!S%fUI)6g020psKhW zU}43=g&0Bo!6NWsMddQkTrf}3uqR5Z^GZsqs%s)%D=#P$*HjZ171R`jyMnc_cp>x_ z;oT)As1zEiy0~}&_9S@?-IoWJ3KsGjVl)_1xJQYk>7Yu41f>fqvudoE}{$?)Snb0@5SVfXz-7w6-06Ex&*`ZmZ?e(@+&Mhr362*jUL?_i0 zmz9Axp{ZeMEDSElD=8>7t67E%D)uEkMVQsWZV{S4U<9g(o#zu%ST`{C6E$j7$F@e4 zSJV`bIB(kQGn5^oe&|N%;Y%y37NESTjrEwkZ7Fay)U)&2U23yqf$k0c5B3{YK}`h| z7xESKkHUEpp!3i==veb=fuOT~0BP7uAP&30+svT zb=w=Z;e{etGmA_cRCQFl;T%x`%~)vG3wl%a;wtFYxDT$bEC2yH;^!?cs46mxqs17f z4pHgQw5m2`P;YT9Wp};bnepPxw`D?5rx(W7+lb(a9*}hokL?CC$x&nf<y&5uwo7cQFsA$C4u@;0G5Y~=JS7Dk8$EXl~b{qI; z6^>G2iVDX{typMbuo!0V#Wf`vsBWwZGav+|Doj)17!{_faI^|XsW3%_5J1*+We5rt5CX`Wrm{i^Syh;(!Z9jLRpDqAj#6QY3L${3V^mfMA*%}0 zR5(V3sVW?;!ci(rfv{-A81RCa)g`-tCN`)yZOqRFu z|C9I=o!~cVI#5vioI}xF^qiYT;IT=Y<7Y@AqsR84Yk^R#ZG>Jv2*G*qI>Ud;A9{a2 z9aildmy5sWsb$4YP<-wC#)(FUNGL+kKk1qHK zCg8yG-SB6YKO4kQ()8ap?S3l>uF1nJ3t#`~DF4TlpFdB)I?Vi-xg7)HhI>&foK>jp zN83&NR|4p$d@m{G&nJ+Yc4b`-`8z5<`#xPhzut=e^L0@E1}dMb%f(nb==Gx55YZ7+ z?k0HMtt0!JDL;Q+g4LL|;`@_KhO*uVwfzV5Nwq(!H2rsTOvmNd(YUMRg6V9QwHor9 z3`Gw=qzi7MeCR(^X_o&qbi9u0e}u}1>7mVGmerH|Z}#8glt0)ecY9m$bxczyW@&g> z+n-7K(SCfX3B=XG<99K1ijM3rqK0oEc|MtCRYHD~q3jVVKc6yU`S?mStx*NO7+B_6YU{2W0?@m3{ASyj>An%>&l<{~&yJ_F znLjbo{J9yeg3r@YKJ5Pk;g8#sc`!ox?^F3rl%G##`IkoMzw7CB;X|B}&Sw6R5!$bo zUiW?f1o=lrD1Ryrb~rZZQz$gc{~|*BAENy1FIHgYe>j5wzB$SKpGN3EM^7?;*9i01 z@srFyF+%-a^!hh7BUiuOT=P+c^*537b3bDRrvJJ{Xuo92&!1n4l)rO?`Oi=NKa(=v z0p}6$$L+~>)kRppGf1GG3#PMa|8mH0G87F``Aw7$%TIA$NyT&h~RDM9a0adEQEDJB23*LHz!DQq!*f_&#IPCn$TE%0HmZP~-R94$6O-$_F>LIfC^5 zmp~h;ZI!4Z!t;*?%D+PjL)^4=euU>A%};5=<@}um`Az@b3JN>&U%p=#97pxnsrKdH z1o=&yP&Sty{3MZMu>CH8KePPTfOS+p{~q^=>c0!}cT|4eGurSYa2*dU|3dgP%g6Wq zc2xfGftV}2|JAAXWqlE0{;hmgm!D4=vHa=qXO{n5g!y+em4Bk~`*ei+$9+_OvM7H> z2j#yVq5e5kK7SsR)U@;U-U#*Q56;N;pVdM6S49}V)(~CdiS`dyL>RwG&uRbjI)VP5 z-9h;qVdCtl{o|;7ZZB<3`}R+Xu>a{p`A^h-B@y<&!%wpO=@INtrTpXAa5|e~7c7*;@f0FsXictPq%Aa%s|9uYm;eWd$K>e?l zu3-PmgFo(1+%I2%%6C-%9Vco34-xuL(@Ez4AcFszDgTN3@82Ty|NSRf{!0<^A2`YU zpGKHJ4^w_n-{vse$``?ZM^Cc;|Aq$bsQp~jak#zN2($dD5$fORB=h6vk~%6sj`DxQ z1=HCqzdXY8Q){Ts&~SqMr4gQ=?x6lJ*PjKTi~Yg~Em*`SZqXhH3w^kl$n| zdzi}S@Aty-w-El!@^?jO|FY9ji)HcWmvyRrSvw(rN9AYJ3m364zv6-ASHPcHe$NQw zZ^v-V)%G(Km^RCbi?IIXUfS6f+kjiI!K};QHS?`kn zBjwNKjCAJm8NUVjO`Uix^Cev}KYvC0uZBO)&-R}lq5LMYpXE^}9%lNq2<2zLtjp(e zu>5O9e&!WjbX$U&Hb*m+&vJax^yjU#e)DxcAE5ldT*O45&HOh({*L??B>Okfb8NJ~ z9{#xgY}bdtOr2QLU)Nx0S??OkP1*jmf6&t5@F^PjSK+2r9A^Grkl!dmNqaxkl79M7 z4cd<;nfCt?I-aQ$6{H-&5T1E+2Aymt`#R+BsQjdLx<#Albs#MNCir7@?7yoZGnP-& z4V41FgLzCxd*My1IM`M`{}Cb`bHEul?CA8#V0WP9m*o>T zLp|0tIrBa&Jrm2bw~W8bT2z4L^vW9B;PR*E#8}%BFfeU()=6YcyI>_R)O+K znc?z-(aC8jgV!^`cK9stqD@XKr~hDU(E&G{2Y~(Yiq*dUaoZwjzD9BBO|@E zTh`dkp5*j;PhFaK*(u$y%m>4D*#h6EqROoMu{AyTLZD@Uqi&|-KHVm$^FE<3^Iz#{ zbAOsN7TTa&f7@DA4|?{(->G(eFVxF*_y5qEj^#%$OYF88^w)o%p0*zJnEvAS3WERp zgYWY#@D14OJ>p3V*HyPE+JX%0DC^&FBt7jas?R}cn>r{f(_Nds3hIJ3L7Q#)jIIT~ zg?8(gHTLk4k!e`2w`c!u{Zp((yRdBRU&|cbupL%{j@w&XQ$Ib`TDJgcITlQSeii>qYbsw4K>S=N zV^Y|5Whd6tI^3F;3D;ostsMYgzvu@U>?_FAZj#A04yi0Z-k`fZhMYxlktOkjct$mu@0X@o$xyP4X(xE+^6TWNt=JVcp}sV=d?Xkx0g2m z2z5I;-J$B`?NT>0(@MI>yExEt7(TuXbsKgN>VWmYx}wel@KxqNfPLUQ@Y6)dkNRF! z`Wm3F(V)XSBl;fiwV>nI)@{*^7cKL>bkVZ$wr|0NUt4o<&JVV>Za)J3@t5T|1j|bYR)k&VgkMY^&QEJ7(Ag zovme$!OPFy!K%#d*oIhl^as|dVVd_I@47$>?A5o2(qLb`!`eOwW~ zgqERD&M+wFbSUS1C}+Oy8#WBe+48Fg=5DX@1?vAE>Vb92bXaZbn%~-*6Ak@rSl6tv zzE)5A4PgIJus^GFbccGs`o)um`p~C8U5x!t`}CLPFKqrdw9(J=9Gj2jIpLZM{N<+c z;@I*d^uGaCpk<;JXyozo6U-&J9&rEONON}@tfiksSt$o$jPRU+{RjI_9mr$*TF_sP zPM-qhOos9%ZT@-QL?|EI_%+qWKXo~leh28oIS}?pYnMX4L>Rkc;rtu;^Dc9By9drV z7GeCwLAybnt<-vZUwRVoGl4Ce8$A~0{TBG{C0KtfXoo-}#AiTzG~%4w{A)s5a4yXC z(J5Jcar!J219?Dtvv*FReLP zmrX6>(}U+sY>e(>bsyT->Xy{iJ1lsPqwyfLnJORUhr(KWtThMaE(g0Z|J^z!05*oM zkAds|YRy>=*WNSo-TzZ-&Pw1bLFb!rtrT<|hQ7BKY%P5z&~k&Lt`YkE*Qcl4&}+PH zeV=8o>D2)J6w89Kyuj5MxIDV+>R!RO11*K023j71I;33@xDDq|M^xR+gD{pqr}-lA z1FT2jbMRvtmXif-i8cHHuCzk>D$&+?n?_HFATaQd^FYS zjDo#ix6Q{ZxRJ?FsM zitTxW55_mFomuB!GjsLfEme6iAKn0Vl^C*%o)EWytefS)epzrerOxC`Aa9XIn0SkGoU`#23m4`x;{OiPQ3=W)?uAKggM+y;Ii~yDeHJW-I%7SKIeTqM1l{oclH0temyd0LJy8PGe<{qX-jx$t zlHmL$*!?B=_AB5+TUIq@+TJ&Yes8VA`koHs`rssMox_hlO4!mm$r_7#T`zvP%>BxT z%c2S|X#5PW<2-c`>iKENHrQ*CY~9bT+hEb(atv(4y$Zbdv+Dt8qVhBHx|Y^$NzTC7 z%of~VVIA}}FRZcsTbzsP4I4hA>-}BUqQ{^;!sTNd_T17s-lc5(JNUN#jw#EMJXR|9 z&(%?|Rt>e*;n>IidFO|))&&$ zix$Az0ep)a>VWLSC~Ms(yN7=LI@tFW=$gH3$+6pEef}BB-45v=VV&I!_dny|J_5#X z&SuyfXSJrMZ-)K-Fgwur)vwp5KQfeQXGnnV%mz5s-5!UHom%y_A z?!Hw`&`(Q!fn{Dh+84B~^akk5xKC?p$#MI5*&Z9PG32hx{mq zeINjH-6qEbnBT2!n1=o9uza7DIv(0(mCwrA1by-n%!~I2*IJ9baPJfi{TcVP=O1qk z?P+m8tMvDT`>jNEp9gkeU()wtn_%vT?>1?-uL`e?*7^xxFWP`@_#DUvdj-Y@9kFRj z@7Yi`>;Z>@OwxenUeQH&&4j)^KcDJ?^SR0kdnhFj_j~ul+7g7lbpzbHy#W42?i~RA zv9q;kAmqb+EBm1V+A|v3bLg_zZqd+oxV|!r?pB-La2c$fU9B;wBRaY=4eu*=d957u z3+ll2a~JrFecxlnCg0VdL+=&hw@ih&@-x)WTidr=f9Q(^F702m18rXiHe#I{tXS9w zVLR$N<$sTB0?w&nfBJ#VM;}3-Xm-S=!#GRZ3~LM8^B~M$DC>u{r9Z5(LAZ~IhI@*E zaE~b08dzV(VE(ScwmP^EK%4skW8dKY-YW7H-+TN2(K=?^H#&djaZft-%K_iC=1hTn ztG$)!o4*RQ?1g<>!-$EE>5zA*?OpRF?6o$-zB|eGUU0a#)d+Ka$R|zzYE9Mmkm3G| z<6#uYuupOC1?yj2DcC$8`u|Yd=YzdV+Lt)a;cpsT<9@me`U;MVdPjY_*LIKMwnqDL zoS?rOz+dRA-D)j{@nEdQn?7$HgT846yIa9tC_nX6m?sO=y=Z*sem4IQ+-LT#!|VDU z6!vuNJ6MC#upTSBSj%7?!RIM!8=P&Qi%jTb?PR z>(%oS+>bQF{LXrH|Ip7tn85=s-S?qy+R(o@kIEXm7stcIKx2Q)yC8a19qf_xJ?82M zV4q|~FBl4J3-s-;er_GJ1Rwz&=;vK=?|J}a9^BuW)8A{Q6dY;Ic@*qv z?PpbO0$Vmg-^)MRs`?)GH<%|D9Q>g*hxg;qpY&V-W8@XMSH!+>C*;TTz=2j;TH3&B z{5N=Ib-QC=8vGtLv?s{M@gIEejlZh6vZAV{+Ft@6VJ`ElZ$0r@v&-?*?Eabxe|2SP z8DJ0`T;yL;4I#`G@ZBFp{))vl{-p)*bsOdL{O|<<*5K+h{qXH5C1s`Xr2)Y77byAR z1KY#>g^R238-x6VEB)~Cbx<5WW~;AUg6|H2&nsKu>`F6~;4dtwRA!Np z_{rvAO-&_yxj-o>$8QBGQnKoMKnlQ$igK_BKgeGL_Er}xtM;D(kB-q${gHfsQE_Ee zaUpzBK@pmcAMn~n zeH2{}y$=uDD%6p17)fz1iP+W*j^-0`SwGk_HkMK9ny?@jw?B+HN}t*U3yL_p3AX=u zXmy;bgN}>`2y*lxLRyehYeRJ^(mBGRSts^PK8ZN3u2JpmSCDHEM@1^g34h46Ss4^% zBa~d&039>UI6?yaRo*f1MVx7aQ+ma=+PyZi#&M*%&BYUG&L>ya(iwWg`xHGKMr=P9 z1yZJq!R!15)yX0MW^;6M2+iW3FT62~PGsaxs@eXK8?z5n^qUYW_L9Q5km78PP7R^r zAVq6JD4Q+fCb6yJ6Is+u#qOgsw4%L{ZQ)V@S{u1ME=0i-spsonih#d4%7X_+7fbQk z>@}%$A%o6Pbj(J6_hKLneH$lJA~OtQH^Sab9ock-C1#hk5g&8l5w-(2X>AVE4!-E8 z2-Jq78$zg%VxdzcEwQ02GdLR7a>4=ar`((9{9iQ(XBHKxB|XsnS5Q<~b1$JCVW}pH z?g=A`g-(%bJ}8uB21nlvp+b&+Oi0gpA*B?Fq&q;@ZEGe+xjrx)IQmdnila@0u(+8U zIkhJwc*3DXl2)HkmRTJ26GGjyHgYOABzO_qwKI$;7CJ?$aB?V1Hb*l;s3@DFbzwxY z&?%B)ZW+aJmj z8r_MZ738EVSrgJSqlu!;bUwKb&3z{+q$roCtlTiFq$tC`u?hn4 z(2))XTx<~mHNS9TM@UaLN4at!XK&=hppf6VRat$+^1`m>!Xjp=qbpotsQa6Q!UdnO zqMUmzWwou6dnwA*07N8oGTp@&k|_c+D@SWXsF0&v7WRbfjhxyV+5(((FXMqJ#wbrE zFx$0Pe8Qo`^$07T$x${QR*3eBPuN%)q&Yw2jS|+<6h;&aolG~6qYlMyz3l=&2Hq{! zGdS7bFV;I~z((e|p^kUSK8nKAC3V;qJnw3In5FR5aTI~Z3a)JotB<0cj8pBU!{dA!u)o!c${)z>N(@xd1)UaEgB(`oFjX z8cr6$V#?9F5ISLB3i-^b^QbAL4<(Z53}cI|E#YWQ2+iQ=wh$`e=*|$z=ICKUs;->iA1ndeINIRWK7p>q(Z@rmgriL% zG=rmWhEVp$6m^9Gs(z7O>qhn2jM`{g$BBQlP&n;lll zMvk*fQO@7ar}NrdHSd37l`M^aQEZ%7Ys86?qLV}D5{~k%A4qYOf8qotWqvo}@o>gO zc$$jGAUZ=v4Z>k0f9@d>^a;nCiP=^eN8c1;96u6TD9X%+M{VJFuX?TU{Q;>LiD4G+Zd z*eh<|%Zo$)por-f_Ca`(2*y$sxRy}6|6WUJTstkLC#&TM3EI{?Z#yj~9JgE})}kgV zQ;&itvWJ_O+ZG&gjO^hDW+&mBO6tki&{-ADiE!TtR?@7sg3i#-)>8D|5X$Cgc)cj$ zR_FNyGV-Jmo`g$IRM{FbZ$)U}Wpgxat zc&F18>pTK1=@u18ymMkteQ8L~tnTA`T2>dg>&pY9ofFF)*Aq)la4XXiyTg?jxAsQQ z&QL&BcT8k}^}R$As@pr9jEU(S(_%d2dXJDJ%HZc)(j}@81Er#uNW~isAhCYkzQ;Bif zK2&ga*f{KAe(=RPZe0~6I$mDKtAS9LQ`aZ-h3+#uAvfj{_r-8^A||o#GMEHrB%;-m z!JE;)A=nEzj6`rC(Ju!Dxar_!F%j&K|{fbDuiuX`qf(rEn-c!YUsj#;S z_1$h?74N6Q{wnmVaDWO2s_;}5>Q|lytN3Xu9HK(KDhyTeVJbXbh5DBH3>6=t!jUS} zch4y*j$dPES))~`Z=uJic$x~+RhXf|u_`=Mg=eX7oC?oY;W;WCufl)|C#Z0u3MZ*h zzdSZY#m`mYVUOj;-sf`aJSS*57S2|gPav#hqEz^QSToBm-9^{n|JQYu_U_h0B$B;) z07q(-fNHHeJ#*B-3LBo8e$+6M-ZnGS|D?@jnW=52E2UMF4rasuvP{2{|KB#mh1HJv z|G5SJw|Pp{;Q!eq2*W-q)U=L&C{4P3wSTpZdRo?#t@c;j{-I^-v~Zo4j=T&@o5N$N{|`bwX^)~9du=^y&^tv-FHPe=6Wdwu$+KK-Ci|I(*h zrdf_8+R3}@FTEYGQwMeE4 zvs8G#3NKLMR25#R!f7g;u0p-w&QS50Dx9Ul92L%1;YBLEScUpA&Lt}T8x`W$^;*^( z75-L*m#HvMh51&rZ@Z5+tX@0j4-m)0^;@;cbbEd80qL|qEaJmB+#c#$JM~TI-SLs#oIINR4XoOxOu^fyQm$Dw`bX@ zki&U3tfT)$o-v_3OWWz}xSan`L`QX)iFLT8oo=k$mJp9$4eI+Xr12iq%6HfUJaG32H|o%?_8A@v zKd@o#1X24;PtaDWRLEnWVSUx6pKO)62R8d0*`-r+o~b%@4_<5XT&PpHF4?<0(?n{wXSzte>d6+VJ)RjN^?T1uk$TND zOQinb$q}h$&uo#}>$ym$lr67&E*97Jd2&VSJBR>-2s)D0*{#OpgU8|H2u)BQn#gNA$Pq4}V>Ckmf!aD!p&~+YcMoc-Km+I7On2K`F ziBZ>7%HzCDr_|)=b>@pyw6jR3)RgCQ26bvbYU%7O(<#+6Vx2dLR9EMk7^^QT#KS(| zh`~0(!?mX01%UfM0>P!0ACcGoO#4Aq@DTZ7HJ0(Y!=;>}iuk)DDxCPj;jvZINK4E+oOz+%2|D`W08^s)KRW*}8&i3oB zIUBpo0JmO?=VD?Y_Y!sKRJYYtxmBeGxvg&D)L^&OU8O28-)U|uE}RG6S>=+cU`<6C_7XKazaM z7+v&A%$Y_-KZS{jRP-K9Os1moXC)lxQPC=KJ{290ul!7-qLuA4;&UzEHIU&{9KQ+3 z65fV-=-_vdw0vlAsOvetaQL>NJldP^iW0!AzP$+l1VMt*gfXk{=NQ7__`CKl+#P(6 zaw@Zuivg1oVlhA`Sw0MX*v0w{0H|8YsofCkNY-vZ`y46c1{8ISiuY=n9d?%PTG*^M zeD9rVGD_%HqJ(ZGO6XRigl?s7IB8u#vz{8PQ{4?p+b}TGzR>-+N~k4dntQ8EJS`K? z$i%ZUu}vnn%fxe5KfH%hm9G=sHJ~e*VV^Fh_A}(vK0;3IBjwbdBB%DzG_^m7RY`RZ zQibou#2BhEj%7Q|JzQN;%RxF#`l`lb-Kk-N&vcJb3ANOoP?93aIRAo_;1OGn{xfDqAJgHho)Eu1ffDm%cqJUnP`+=c0lt(Fd6?bL%FCpr7LQxAHaW$j;_ex*Pq9IiT*=m{UKg{mJ=jd~H@$GKg!7g2Y0ajs3e z!PT8&f{X6zR4UQ6RbT6g+tr>fx~n@CQ@vbG`kK1O8{ne5x=ZldK-WHT?Nk@t)!~e1 z4{{yQ*AnoqZm{dHPF;ujPIDd6Dc3+qrMr&ll$y8BbJgl?j7nYLS|L(XU3G0z*ND_K zSG`DOyKWSz8LqWDr3TGdR?RzyWZ3(wKrSpdfQ?38w`C=b$(k<{grl4 z-PQ5gm<=ySs-CK5&H>cbRbn7@b(J`ky1MFb!>FsPE%NEkq_BeF&SaHPO>>4*&(KQ2 zNM}G@!NF-yaq1ab-9233)HC!sXwGz}o}pErnBmMg@&N)Drho*O9PS9vI*9YzW5FiL2Lsl*)VusP05%ZGmSeFKK7 zDJ#}tU!%=ZSYd z26al!9Cte_Md}`BtxlC7C zi_~`K0U`OE^N>hA?>sD0JDlH$RHO5VNWI`ZDpD^xkBQVy=W&tR?X>jRRF=K!bcv~G z53Gj$y#o9JKtBnZ0rd511*)UJ?u-_xH=OVTLE(F)I?ERiE!wFU1b%G$pkswkbwO-s z#}z)^ht)24rBC-^m00D|>zhhk?bCf&C9d`9K8)??sQ2kUtP(f+bRSlUn|-xeA9gO9 zAbgdmb2018aD1uvsLFz`Xpj15xa{~xly)udHyz(cY1gX6Pf^;n${DRu+O=4QBg&&) ztHivXWXtynsOtMQ1b8?eaO*oC9HR+e0!hGZI>0=Z57WLl7(_As)g%bh;3O5v_udzp z4ZR!nY=}+cy%UtN3wU_w6YEt8S`4V%)OzDEJN&4qK0cR!q2TJqqH{MNxL9>T|;|;k9*lJqr^) zJ6Bz~027_;e9N~V?9+{nkKHXF);s10jKbkPSJkE7yHf$>^H+3TR6Fj{by0keXvfz? zJ2vaO;DqaaJxS?N?f#~2$A%=}Z|in^ALH)?luQiP>b=ZxxgY3uRBioHZkYcmKOFya zk&3H6@NrPZRa^h9GAwhTM#Wd7{!eRF96Pi3^E%7-IdsC9BWjWWlBFu2=&cH8uF;iO z9dwDV{7=|fYhx|nK#0Vg0fF+|RFyf_J3m~)LY;XUW~hL^GYcY}axqsS=bG)u%zp1F zwrZyPQ54=Ls1na%qPwj}`)*9c+j_MB9TN$5qUC!8V!Aca!~_g1--{3qq4*!#3Ve)G z*nF1nAVfRi)aU!Ujf~~{H>6{tpl$H*>W}BedJDr9E7lbog3SlN;qDs_kxnTP#Ej!y zxqi%?=AIkc6ELuR*8?0v@!Q%8gzFOXEL_3E zd!}jyulMS36JD#0Rekn)mlg8~%brcLE0iq$=7{%7AzKHs4Gyi>d7&>BuE+F-01t0~ zy2=eIuj+p{>bxp`v+gRY+pLAET?qMf)zFND-=Z4dTnLpdUVlstE1s?tyS%rBD{wo= z-VE1=By5CGwH`I$Ly+!t7$kj9s_S}0zX0*@2-lOiZu0lrUilJ|r0H9T4)q-kUB{9v zp9^Mh5m(Q%7dIN@VtYAAgImmTY9;Z#fN ztx?b{hXD6I0s$V5)ls@o+|nlCE>OR0yVFVK$>p#g+=!`sz9fkGF@K`{w%$6co9TVD zbyhd{@6as}&O7$IPAK^@$knNkvp(mT+gaIpIS@x7EW-WpK1^*5F17mJ3KS2=P0_wP zA$~ggW;h1@&`jPzJOh_>e>$!2?>Wn@UC(eiZt1GDBjl)QFrT3&1`38tSD46_#c*$Is<+vzT zm7sPUs&R3FNhouH5>Nn!K75My|F>@7$`Ea2j%g%%RR}oF>>kpre_6xvi|)SI@S~}! zi?kN&49MHjt_Q8Ld~Ud`J4Hm9R5TWkP4EY=7=iI)FxibG{UDNtWEe!!(;zV3x-iRe z4ZLGxhCLD9w&8@2Yr`8A;8bB{*twVu5B-LYcss|Qf|Br#gQvhUKIrWp+Hdyf9$ldg z9=JZ1Wj=-oy}PAcy^-rozTz%-VC7^Q+e4<&pJqDl{1L1H?VI7a4l366tr4@~O(2e?0L+N`h9Kmn@lRSick_}A#wc4~xIUc8IvZ=~PFAgGpF;^$ z$8nrLbtWY?;+llLjuGB7P+o84BiR)Wf_BBTtL}BTMq%~v(CK?a=?OUL;^B6=ylV1oKj&KNZF3E=! zx8Z^lT)4Lgr{i6!n;7r4TjatATvYx+SeNuc_JqZ(sY!U?}%_2dwSe<7PRo$EjG4D0^btwPlv$+R(+w zD-6!>$Blxn2jsVttMO~bb#&O)JaXA3QH zGJ&ai!HmF8eUW)2o)A9aw|SXY%>T_S1cWgt`}2nQraHfd<#B-wX>MqvxuK0_eeJx4(1yp<%oX}c_)xV}s1Bl}C)Q9B5MDC`?I7D@iLUgvi{~!h(V^1!>6z#iI&`T2sy(xwN8c!N_1i)xwJM zWfj$VMerrjBWr@CRYiGarE{xCjU1Ic3jU`gkA&pX;3nKO5BX_-IN0Cnin5Fnj8h zoGFu8_L6Bi6LPI8aB6X0bq#z`bhVY4larly(Uh69vZhbVOUX+%K}uUN%2MA^O--V& zO`1M!+7vJv6ik{reb$tA^nxi=u+v$AL9Wlf$s zg`%^jOqrH9YwCpmMctc#NmX3`-?yjxHnXrV0s=B1AfU3z8c}D3*_at-5ipphneJg) zW~RsK9u`*w7mOMqYBW&;{-Oz}F&H;MRN}5N#$6L*;+9BU5`(CaVEBJe)v504Gu@iJ zzxV$&v=Ss zzMIgz@~Vc?x&RoD<>A9`b!p17;WySN$Q*#Fp zKv%b*yt=!)Q&@ciMyo(cVMAf}cseX)2uoI_)iWBu?B0E-!Kfs2xar2&#nLD+2wBT^nfi6(iKZXnj^`Wtk-EY~fx5-1 zSsql&-xP^O+hfjx z`uTx*RW*wOjn&lJF_lOVJ#9(cB15I~YgB)blpzPF+$5yPEGb|f)T&8RLlx#+4S}Lk z3?Zcs-_=w)C45<22k)$^s?j6L64gziaT`el*VmoSG8QD~5w}RDu%WTuqUhn!S-~pF zw3O4KE3}Z(Us6+@$Q`B0ZKI*QxUw`QA=OP=v1LJv$wM&_RE0{&0ooZ}M4fMH*0e<6 z^tyRV>{zMEEecdq=d1b}wKpLy0uU3=YRR1BGs&Y|MC3Qbk6U9Yv z6*Z?d!z?~Aw`eTZ9S+MR=P+t0PAenys2RuCt4S;J^~tBnni^SZDgzBQG;UQ@Vfv`n za8?oZ=%Z!ed$m|+Q0euQO?5e3PJ5b^iUNhzO9Eg$wO-P4Nc7%#z7kK zdGcm!=a71Ic9wCO!e43bZHH7BE69&QdKNW2l4X=$=f1K z4eRtoREJYTDz9!#t}HZ8OwROetr-mY)~sTa!qiv`^<2n;_DrZdrX^Rp#IY#@ZC0+! zreU-}bHUPuok}a?3NN2ujnOW!xTY?!ps>DDjlrusBk^zmyH@dNQ?!+I)hE{K`YKRf zU*CvwAuT;8VQl4@iCGfYqbjlbsK?SkR~&k!)C~%3K4>3Qv$srvjnybPZQzkuGEEAEsKg--vA>a z_mqI1A80jNtiG(Vp`>P!vbrwzG_BH<2))6)!eZ4Km~g9n)LB4v15HcR#5awMPKXvQ zO1;8`W+8;l!$m^SMtaD?HWvCZy(WhWvV+cMGBVAR$s5tJ7h756D(Ft6 zF;MENgfp>^ajcXe-Ce4F*bb%!ft>@>QGZR)v@~I~v1wY0GQO1;*vpP#T$KmmZW%G* zs^?d$rZj~yg9ZBkl5(tRvH3*v`?Tqx#nuPr*Oiu%f1(*-0Lm=KX?>GeVPiuX%UHhL z77c|RbYLcT4dn|;YZ@CIai46irY`ESHHfh`qg*mq86*>}F|eo{In%bytS@2v4C)g7 ziR$}hwvwHU3`xZ6R(UX1hP2QpVRFYkXTtrYX5HwDOR>6?L8`ljh0wsd2PSf4QlRbv zmKQ3j^S<&V&oS60=R4<*@ z@~LvPDW>+6r8+LFZqhtG>6WjAWoSt2)rN|=DPg7a=6zkb9gmtf`xIu)^?`YXG!lND z1Z~insemc9)S_hq^=M1!RAHKe8J(WC8x`z1DFvq9619%`XM>(TYhfz9ZQ&wm*&=cX zWxm8%t%#+30lFhmbWB1W3@JzvP(^EF*fzPr;5Rc=3#olnxY(|b*8Kq7U|3;TUTmP%BxRD zm!4Rec25;g5Xy^}V7IXb?Hz92U19Gyf*Mf?))VOxqn$ZwSB=;lOj9q~45UD9oS6LuHC=Cw#`Ht%u9(Bm&$Ztc)+)Ov zpT8<^X1ahDX54sGzZQ$NV!5h*iCI1Ig|^bF;#%yWE!G#sb^OVrxeCP|2qp*|qHe0@ z=~YBaSNlplg6_oo0uDK6Lro=~Wz(>TXVDf>ky4RfPS*=Tyb94^#Y^@`7Hq7YUx&wQ z7OBBg0`xG+9F)`*&P&l#hRvQ*dc`0qlc?8v3u04lYU=GY>((>`3u)iCKy^(u#;0U5 zH2V;@wCLfrTB@8`Ky{{k6lwG18F{jIy*x*N|9V~ zO-*Haw^UTCz&w>|v7uWDOlZTB+HNsvaUwIIUpEm6V~Jf_hZSNH!yBwSY#Y;R$RhQ4 zWG+09=fYK()Nm;qY#mncf>Icv#L{Mk)fT2JBPp$iSr>FG51yb?nC|kE`Bxfw495O0 zb`$MJVTUS%baN|;ik%y-MZDBPPf^krIgMi|@$ThQ%Y;BlIaVX}x}y{sHkFylA5C~B zhfIXm@FV*S`qMf=X+vSR2B7l-v)7ivhf zd6`~Sd39wsmcbee3i0@_rVbPAl5SbLBxmrxK zVyuqjs6(&2B@2+Kbc`6Nek%mchjvFTLW7RT5j;UX;m`v9*x9eUEx4yaJAE=UMh5gElxY0Ksc*o5rhfk|N=oFAIl|bhjN}jlSzp^tN>%fEh zu+tLi46uDdYcS7^#3RAhKufSa6l)2t4C5-+5?CILh4FJsk@i3rqTpeFv(2J8!OB6EE&d7=gvSXfB zw1wj>(U22q4mO3Irq&2bjN&v$X~ql%mP#@>>S1*N)u7XBjLQrGa7||glN40^tO|&9#V&U-0KvNfcPQrbRnrJhL z!UQ2lJ&{3*4l2nggI|#ws@sm%U_3w>3Q&@C5nCIJhuiQFC$h@HzN*@mF)=B-DiM`) zN`v0AB@4rku#MxWr(mzG{khI!)0o*jnj| zIiU#B>|BeAjzzGm8zWH?qIC63y|nO%w6Ad5x?1BA+{Edz2A;~rwedQ`XLp5T@ql@K z*V-pmFXG16B;-*G)Nm})8Ey;0DLT8!ScGK)lq2QHwEc|NPGHJ#h@9E!f-R8;w6-d}S{391jz7#(%@GY>KWsErnkZT#xC8Fo4l|t${A`qt6_v& zvo??z0M#8v(@0Yw*oD6$P$Mr#Qj?1|)g3G2>dPeUh|+Kdzjc~cV1QhOHcXBlbK0q` zpl|OAtBjdJHK6liq~MgD!9W}O9BQ^|ODo(7Ux$0Gh#0SOnu2H%XpCzDK2}alsl;@a~G^I)owB&a|P?FaT>FlRZ+)Ggksd)sSy1dhV}%t1qi=0qhcre z9t=lKFcG>hU9Xf?hXgUV!PKoQ9*V9;hZV-)9t$_YUU)L%teG)ojyeT8+Vm$$6GhJw z4(luG{q+@QfUDIsO5f^97Mg*xm}2mxUBzbRbgT@oRVPY-Zd7*Eg-SqOsRYzjQe!Q> zTE`m0t2zQI7+OnD$1BIQr$Z&7q}3aFJi{w4bedq6&eq^sm>vBid6Mckf@)Cf3^zsT zPp2rD;^KYknz|Bf8ZW^DR!O%dUlFC982tGUCa$WXqu(cMYAK3bL%Xy}XaOv$T*35m z>JvVKOsF{QD2Sxu=yx@#_9D$|1L}Dv>cXq;QfYu|DnT>iX^1gQV@xp3B^EcTA<;B}q$nu0c!p}TsH#Z3 zb)hRoMPz@Xwm@Yj>uaA1%)={0wn$1SrWGBSu+U-xYZ1C`TCUb=n$aD)%^>V-vXwL$ z*ENrK+WV|o4`m!aYH~xBtB_uzkoT(glXPfwv-%x1J*FjY6Sb7=lsFPrhj2XVWfH;; z4FFiOcF-Ep8b{Q<9{x-}6mwPv^*RBcfXmUT;7WNOdS_>4INX6wdKG4j{EXKO?dVow z0Su>+5PDrIlyW9D4N$W&>I?(mYQ49bW^8m9;187*>Mk)tc67iTXm;9GP7{2HJYJ7K z$&4-!llO^SQdK~ToLW$IVit?#?}`-|4s~oAL39xuy>3=> zG|Vfkr3EEz-D5$b424mJ7FC^S8*r#jnilFQ1;(b%RS`@-(c|JzKQSLdPk`P}&t&1g zq!5c7n%Ap=qA7^#h`@^jG~ZAY02;GtCWR)}N!DK-!TbW<3TAiMR|q*P@E@})Omjlf zHeUA88d|Md)ar@nX_yVfI)bb5XQL#qN@q`{Z1=$&Qe~Z5zaCO47u}|du?Q^}gY9_5 zAf~(oogRv>hh`a=C_2&?9y1l@QtL|;Z)Kzvt2Ev}fSX|VArwV*k`t~#aRR}nCiJGT zB&JO(Y=^>x+L)UrkJdFRHm)alvKTZ2Wt-_4C5CjL-%Tz0uY%D_(i(^ipqfOt=?R={mD7!? zIj5;-iU{*TF4_@<_1UNNLZEX^b1UW;yhMw4Qpc?v$_b)&(di@%fsVN;t`@{)6u{t+>^_u1sZ(mjs>1BU zDLY`y#nKoP-8M9|_Bg_6BCTfYTtaMZ(%)srqu5*Or0qGiX-BH;BJSSNT;Ai(N2m3{nIXRqrRM=jwWa zAL&>%lcqkjHPaOAq(wsj-oV7veA99obZFM3*B;bCVS3yZ*INmw5!y&n7F2r+8lb;y z!sdpq=hf&f0?W}U=%EUo0+!6W9#IB%L>MHvDi}#Prs~I*M^QM=iQZyME+Pzuc_K&+ zYja(la0B$Rs@aj%=*23`uh1I!4t*0f4yQ>E@VejS=HW!barC7fnDe8}MJO@a3Pi_7 zvtw$Ay#1ku1X`(JqYCywAgyQghKt^q!CEQNJEMoR{V^G)JuKaTBk{Ii2RpV> ziTSwtTdu(JX6k2jU!xs}w+JW$dMZm-GzT;@47x|d$GppwR7+rLt`_`FEf_09dJhCE zKkeRTN~Wf%YWJ9OrqgAY!Prd;KvIUxk@u@>>hgo_YgJ8QyPA6=xGZ^QAkHyJ3QabO zYM^1Sxii|9lvKT=$|TKU_-ze}4wD3FgB)Ak*v-~orjU3C6Brd=Jwu3NHo|Su zz@})&S`{l%xpqS)DHNWD0-EV37QMvHfQjxLnc#vu$WRA{Y&G_i6gfPNKeXf1i4mGu zvN6ZnlwK+YW`9vV$L3)D%^L~Dl>X`h&ryU!eA$GK2=&Y{fMqx@2 zZIdQ4O-hst82%5)C&uQ=`(8VKXJhh)GE)&xz@$BKm0oq@6bO zGk8*gZZ{BJsXs%JFpqdTQL{|P{xo(k;m8_6;2xpx_Yo;p^bgrxg!(K|CMi% z;V;!uUlNIH&pCCD=e%P)!|=UL!*M@^!|7*`orazxrd*SCt?#<*ALriOQ+R@K2&FE&k@TK>Ezzf^M}2E)c3}LKR)W_A&&YM zV$wrm_`*$RSvuMNH)(18-HlUNp2|cA*{_5deXkT9#1;$oCwx1y&pANf(CYF0t9LK@ zAQAlc{I9;y=YRKgK$F{+hePpJYV(-0ggYlk+M8OtLScMjiIw!sn_BQyL71s@tvQimE?pkMk}3Tc5dFW9 zVkQ;VR~voJS0rV!$x?b+OQXpD-Xu$5CI_>o$STaIU>EC4nkKc7PozOKv7m=(5P%n9 zTB7#XafcSlJ^!R8ifgK7sjix(Ts2GS>!y~{S3s$6qgtxJg=#5R_)<)DF}On=yqIQQ zxN@NwiJEkfD)n`V09@cZSG(G=a0@ZS#3g8Asv#A;2fWW9MbZp=Z6{`$y0E%iaE!ZjUNAyVAek9qO-f2R@_}`1}j} z-kZ)}4?*t_@w`ds7=_5Q-M-pyU$ z4xR6g*x=^w@q6!rqJGE$De|v(kN0~ASGXe{b_XMEwx!&9g*IVumsHAM) z0j-Gi3lB*Tx_VM<@uTc8E@12kAcyG?CaHsn#-E5VmK?^D5cL>S${tO{K{NCL4 zZg!pD`xFd-yT5wY`?Kegt;WOre?Nb}>-xRhvMT)EH_qRmgV6KuXl4QvV7g*?Z9vT`C-ldlv+;|h}>qVf1&z3&hI^X zz1y?WJx*1kKIc@rxmB*O%~PeeoRF@?ICG=gwJA z7pN;-R#5z>2=6)v7RmE_A4Hm{t0xeY<@fG!E8M(FG$SNWF&;Z-eVVeqfTWJg{fy$> zh5Q}oeF;hsyALwC1&ZLT??KUcXqoK4s1nw_m}GC#X}p6V+>u~Uzjwd8-_6?K_g;lt zWakRRLEz_WRd%j~H+c`Nh1$;$DSH7lSGWWGW$ySYcQPyX!K*GpE|C6}{@o_`$5goE z;As_Z4jlg|#5$4ulcHo_0*BM;f8?*o>f6nbTm2q)dM zl($=hqX2R)HP@H8Lo40kmm~f4aIgiG*DI0y81DgPxr6R7${2bcsvc_4aCS1!@Cx*# zWz?g153kuzHE|`3Hw;=3mp^V*@%!>S6}yI5-bNV1F;nL`5clAG3#2eP>OD ziw5?S9w<|l3)NGVF7I1wcB5PB0kgceWbkHY(G5fjgrbtq&^tqJGgJQMZ2Y&hsi{M}ne0 zcrGRW1iFd;tVdD(N}@+W8@MJLHBMRh80n$4Ka-su-{AIt*!7|IFK~UAqMcD;{N8J` z*SoziHfihUqY^9JsnnI|Ham<)z)E*yxqBkI;xgBVCh6wwa($JRZcg^cZr*%1X8}t7 z{AyU??(F>-OVNKqSsq-a_k(WEBUC&;{C(J`aCX1<5hU9O?F9xH3$f#&ybnGnqrezS zj=k6&SLu3Dz24U@fX4e_!CvUBa`waUXCW`>{NPYmtX_{X_;X}^B8o=}H;{*X7rGJi zAavtyBZORa(+7!6phO@xXamxviq>e9|6#ZP#cq%CJ#O!d-SOpAD<_n@;~2O599z1DvQJAa9BEhoE+$_w>Z z!$mO_`5*N9#{u+)8gz!>v|u6ONjw^tptTJLM1aI!nl7<*oZW z2z;t*KXs>j5U5hit3Wu?KMMUDu6p?&adQ@8ltmlQ*#Hl^sY`j#lQ6)rM@T*TnM!vU z&6w!M@!kq6AZzP;>8zoIyK2#jykDG0d86{c8>-x%rEVVd&R3&-shj-;x>h&>)DHJP za3S?m6=ZYFm%LNgKj`1@uXg(^Bn8ydnasX{xkFEHp2|8hU5h>&u1eFKDm6Hu5F`BF zmoKo?!4vL44$%$%6;|?lukYGT<^K_s9E+Gkp^HlKm$E_j{+WcaK7aqG@S0jQa~v#!j{C%N)fv+rW?7TUkpZ-K|0T*#UXD{k z@a{s#N2x&JWoS$TA%UL!5Yq08E?Tj%FaacHU>2K;&wR9JOhLz7plA+eKjQ!{a@|YZ z!56yj0!-ibJNwa*qdL?~x+h#_B=Quk4=TR^D2H^H@;u#p`X)AJ?>Xr{lG*@z+|N- z@e3=7us({bNC`$4If|>Vpibcjm8jX(Nd|qO_|ZwgSDz?ub~%#4? zh`Z+$Py94gBK%j1(@sh1afjlGU*1RregG3>(TbE0vzJ7-URnaDIlPv<9qd(WQk&>& zFMeS$-Qjh*mzU(cPWSR^-o3nvV5-B;|Fww>!n}Ki2pr2|mot|4Wqy8Y1j>*8!%AkK{2Ki4j$oI>TpDQ!)Ct-*F zR{K@^&0tWU);`x{urvKMV>)}%k5#4P1K}tAtq`?Wj5POUNcWNq<)xp4N~iy<40by^ zgMaqUpnp~d`Nj-6o&w`$_@V~#+ zPp-o~9ZxIyWPfFP-ZM~-{gc1Er1#|^e~@@qvR_sE|KLxeT>UX+F~?TE7^Czg`!^(~ zj!SS(S6^)z{HGv;o!`nJe_aOs&t#CFmcc)%r0Mb*%utVOGUyqVK@WaUQXR9P?MBC7JM$%eLoej!Pf5-E2<% z5gnw*_yXPgvgoY2?QfehaJwHcHlg^pvb-tR%LH+lpN=+mFg#y{A}`2~-4BmpF8fcD z7Ukdg0*ThLJn=AJ(}%GS@hXcO{~lf;zuq@luO_Y;ilEC04x`TJj-_+wH5v z;z3LP$_(821Ld>Cl7HHgFShtTi`(hmYxTEFE%`kbw|*+i8ROGJvR=w8UT*1GY;pT1 zXxA~PdK_cPU(B59%jP?nQ@WDu#(T8q!rD%5$g#qD_)yR$>{C^JS| z(G;(=0bi5+42yHI@O;&AlB+7bhr%+F&wv~qlAC^8@}szall;L9d;#}wQvObh+y1;i z13!liM0)JqEz|!`N2ArurwvH2r+i>~ zesu=^Y6d=xx2k1+!WsA-8F(FU6-hleWZ=Kf!21nOU#@u>I5$Tp3-vxxM^$I8cEwMy zIGZ`a8##=#qxgxIyy;6xKk2!d!^ZI^@#EnTs0vh0L3T{0DsBF8EC>zgqB>%+DA6Jmwn&zl!jmG=+|+}~|0B$|3HdoZKHV+&-&y_v!T-tpA;I%l&trn;Gk;$2^O?UccscX8 z1aDyep5QB(|4r~p?gzgV+^lE568tvS_Yr)6S1UI2ccbSx<}@Fo z!*H`-HcIeDmOoDLDDx8qzk>Nmf}8oo9KoMu`O^g7$GlYVe=@HWydTd$O#3k9I*Iur zA>YWHo`2bPIGcHs;5RUj2yWJ0QNj1Ie3#&Tc^-4F;3dp25_}Ew%LKoRxoMZCyuW9D zjgZ&R-5uwLf=}X(d5hrX%;|ZVZJ!m)?-2Y#=64Hj=3x&AehkEXM(@Z{E*Sr@t7zD@nk z;rXKJ=L}!Myq}OihxuT^)gP0fVn+!67|S0k_U&GRpl?pEgGg#10sPZ0cR=JfoO4x{IF=CcL=kol>C|C@P< z;C* zRm^`S_%C_=Z02#s4qI9N1tI@9^VbC5$NUe1=k?L{c~|gB%*{N}q+87VZ$du6{D9ya zn45W}(Q_wrhv#vIKf>HE_`A$|3hv>3hyH?(WIjajxyz z%x@LEg8A)&2br7aK}P>2%|IIvK z@SbeXae|+~`~<;knNJgZ1@lt`FBq)zH&5_OS-wi}A2P2K{66N31%HwGcLaZzc}Vd6 z%+C_s&-;=cf)8iDO7P>EpC@=JbNt;(O1&&*zESXY=HC;14fAUSU(ftUf?vnnJeM?n z^)u!_74nZVzf8}{c2Ud-G)H#g;NV}7ZS-^Bb%!S81N zeZik&ZuX^&{tuYnD&((b|GZQ1AyjF1U2%Z1a z1s}|Oso+zXFBiOkx!Kn=`B})kUC76o#|7WQ{2ak|GhZk8o6Ij2`~Y+F{)x%YKz^A2 zeIY-C`OSil%-8n$so=#df2ZJQGQUUgF6O%h-^Bb^g5SmbX~AD+{#(I6Vg8!n+5FPM zTY`^g{=VSl%s&!*CG-7)e~r$u1fR|P8o|q%|4{HH%(n>M#{4$H*E7FE@XgHc7JMu7 z2L!)|`9p#~&fGkIFn;(7^Jj$od(3|;_+jR+3f_OTw)2~UPiOv);El}9`#B~*oyL>Vg=7R;VWj;di5c6XNU(0-g z;G39F7W~J|X9&K7`N@Jm#=KDQcbU%@{NKzM2tH(twnM$()0r<3yq0-D@OI{5!LMMx zQt-bVx<$NUMwi<$pg@I}mD6g2iH8_z>p*5_}qS4?mYP{_}0-Jp@0Gc`w0#ztI!n|DYmCViijmB=5FmDv{*E9dN z;I}gm3jP4|6@tIPyiM>gna2e0H9^~Ft>9yrUnuw~%r6oAbmmtG-p+ip;1@8zUhwZT zzgh6xnEyoZN0@IH{1xW+3x1gSuLK`3QQP5Z!E>4aPVl3d|CzbRlls2&XF~qU60P4n z-zIRWG?IPWpR>UqSZM4EPevm(NlH6NWmAEYCh58q{qA$HObGu%KCQ* z{Y#ZJ{{BU9AM1HbaPxOr{}6l`%lGT46&m~8zeg27Qy#0-z~U#FX4BBk6}OgL~!$5-^0(bO?j8G{LzBb-%-sik9CX_+8953;xnvEx$$ZH<-%*}fZrd-v`hw^&_hA&}0QSd19lLfz!d6nRsnV%{6Pnow1{tM<8 z3jSN>n*{$G^IHTz!u*$l_c=}5|1rUjVg8EX1t)3wKMTH)`4@suWIa9j{RLysZ!sSt zcm?wbf}g?sTY|4-UMcux%$Ev&CG$4Hf6V*>!S^t~TJV>dZx#Hn%Lha<;M%YjQJeF&t_gB_@&Gj3w{-I^Ztm* z&yCFELjEr1>jnSt1VkvHS)aYBAFkH6CefBi(AUZLPclQgdpd@su{5qvu9 zZx+0U$J3bLOPQ||yoLEyg8zc~j|6{&`OgG@j`_WUA7cJ1!9DCh&kO!I^EU-AWIOy- z@Wsr(6ugDG%kP_*`dY($fZ*R{K1%SLm`@h`F6PC8pTgx`Aowh#P-m7qEO> z@KWX%3Esl|dxAg3{3gL)V1B#cZ!+I0_#c@+DfoWouLypS`MZK2X8x(*xokJ{evqlJ zAy63 z!4ETkQE)%o;g5pnGXF^M!ORZ|K9af1?{gVDk7Itk;FEYBHC=EsUn&&b%$KSKH}j=$ z3vT91ErOf*QkURwaz57!{wL;F3;rJSn*{%q`F6p5T;BTy@6G%%!ACKFQSghV==tZH zf}8p3KEX>_&*y?KV4lVAwVC?*HuFA$cQ79=_$ACI2>v7HGX;N~d9mOxGB@w>nf$!Q z{7fPL0rRs2KgfKw;GW6aZWjxl&HVd<_hi0R@S~aECHP6q_Xs|l`LlvoGJiwx<;?#o zcnkA?3ciMU9>4cz>~znFht$or=1_OeCrPnrK*@akz= z{z1W)Fn>nyU30Yj>w>?*{Lg~_o%v^ikNuX`;~B0$O})%x-be7nezM@_vi$LaU(S4v z;I}ZJFZf>Oje@_-yh-pknV&8A-pDFlL z%-aS3J@X3%|A_fjf*)aiqu_aSxn2a%Xa0cTGnhXicro*r1z*Da9l<-8|6TC)%)b)+ z2IhIkq}IzL%*P4-JMJGQ3*LkIT*1wJqg-$^-#A@x^Zcku@JXz{L-5m>pD(zXPkvYM z`7D3E;NNC`tKe$~CiuTt&pCqsoB3se`&s|Bg7;y5 zi{L|;-zE4+<_`*f9P_6IpUnJK!Dll6MDSm5fAyu{A(r>$r`FeM=KTaW$w8<~$5{0+9x@q(NE$=QON_Ejpl>EG%Ee~I<468r>i?-vSg z^jseAYhv23??h*WPmVa9Cr_|ZWPV8SpL0FB{C5nd-XCDz zPw*kE=QzO!FrOrN9`l)k?_vE#f}46jQ}81!9}@gi=52yM&iov~f5ZGT!Cz;7t>Eu4 zH$Q%3>=WT~_29p6F#JsBeFPuDe3;;-yfXz~$nvKMUc`K!;A5HB3qFbYGQnpv|GD7z zGrw2xpEBPg__fTR7Tko(gnS?7a|IvByh-p{=H~BFjQ(FT?-KGiGe2MO>zOa(_ce^33%LL9 z5d1ynzYzTUJWtpuxS3BrA-I`Oz9jf1tmm(ShnbJ$_bg04-{5@j^I4f$86@t zZk;|IXx=w8d?)h?A^&gYONIV1oW@0hpT~TQ;2W9mu=G<=Za3w%4>CO=L% z`dOUxoA+wWdkR!vRNloTjAI7N8@@+lr&8#7i0!t*lIN{Z6{AbYzsPpG$l{dGBb-n3 zK7uKi+5g-u-h&{!ksZu*=1n304BKr#bCS>3s`Z(ls~bCf%yu*HHJJR=a(?;>d1JTX7AHIW zfaUWoZrkAmi!p5<#TPV&b7OD#_F zo?M)8EVDSt8~e9foaE=Te22wJelO=|9dl#@}snYn{o{*(t6$$d?Iu6 zeut5t$^3wjFJkWJ=VnH}h4}!%jbDuvd_Bt_FSx14S%RDPST6WR)^obxCfz3HWFOwD zRE9WP$REx1e!j)Y-_Gc%?RJsH$={6Kud+DFf6Vgcxuvm>c}{w>kpFfst=~MqHS%U$ z*kQ?2y5{e!_gI|Ly@mDcwK&Nedp>7zk~e=3_JYMp{(ZK?A1qGtPxQqJ$J-Vs`M_5pioIRF2!ILU8f`Ohs*@@8Di;^!VFKU)z-M-PjWp2t{Ep2bPe2u^p1;Io*I zWNz$lzVC0mkT>t)PZsiKo;Fu-^ZjK@EInk;7x15spUVEzA@o!!X~(%(@CN2L z2)>p1or2%Ve6Qf+d3=0J@O8{R({)5+pDUT0=URq8$9#g2e}nlcf`7_V zc}(!7%-0EiFY~Q}o8L*jM{x5!+It0moAtab_;6R-{}aI*nEQGE%-G>p<^u%Z%RFE3 zH<+I&_@~V03-0sl{FvthCfzdT=L&iAJ+m7H?_l|x1izU1eS*Kj{87R8G5@XL2bupt z@G|b7KNsA5Z)P9fUo_>~#PX8_H{Uy1B)E^)aiE;&ebVmz5n)#`M z&tzUJcm?wnf(Mvy6ug!Bj|9Jjxp{BM&%+32gM*acje--i%Ge08uW6Y1@ zePW~Mb>`;19>e!BuNLy=xnx-IFIfH}!TXkI`(GpYG0blh{6yw^1fRv+yl-yuS-|{5 zAz#b&`z=XoJt#`^ytxXI6llC%6l!QU^?iDdKp)Fxe% z&+*KS{a0~5O9by={R;$N#{3Myo0*#;Qo2Xu=3@q?ehfGB9A0iEe(!j8mX0ul;~Du{ z=4KvE{8&prH@n2|#(v823oJb(KM?WgDAOMa`Ps~C1vmQ@iv_=yDgT z_+jQ71^<-GyH)U>UJbShK7{!W!N)V-Dfk=AUl9BzuBbNzzm@shg709yPw<`09WI}# zM;3Fk1;3W_)7Rp|j4(cj2;RzJ`4+dIgBbs!bct_e`6-sX{oKLSKgkpS1Irg!^7ejv znc(YKzSiRT%;;mW;O2YAmRWq1CEp_W4)%u*iyv#ruMvDH&j;37e5@tEQE*dTn=Eek zpEn3@`jf2|xBItkf*bkaoCg=-)IXSGE?*G0>)o_R;&%O-c1PT<$7?M;c75Gz@qE6f z598;gXOzW#xTk}-ZRhD0x9w^Cf#hwwEw$ur`*_*kWxMdYI$h$n9qivpx9xD7C2!lo z{B8y5vF)(gpVXhPFV#89^IVc2W$^>-7{qNm{HV7UB5vE^UW?myc;4c+9h}zHu|P|x zGtd<6SnITf+nVsv)Dr9r#G`?h@EWHp7DiyOwRL&0X=R`#*dA&P2Rhd@w?J6*RT13^WHLt(k1gMul9sX{9r%JsJ;BnqS>`qKeJA zh{nROXjqw6C)v>&j3=rm9*bnuo;j#F6wnc)px+4cSho2l~D4k#m-Z6v=h#a z^mXP`K4Er5(kW}#XpOXo9jYa!;TF_I5Vw>xc~eIirHn<$Hx)~?KDaEUOnPNmNJckN z*i>bYrIMAAQ6!~_>ZXkr5C74rlOLf(XnEB1$Za%NO(qbFHmyXSxn-*mx~39z53#*W zmcVGR{d`4NuruVqCLNIwXNKBfpd;Ga+8oNDA%GC&X{hx;N2DW+rU1w2Cf-8bfoYMb zMyN{~t6Ly7b>#)*r%Hd~f?TXA*rBRB0ddjV8g1e{a?RtOa%P(WwcQzsh9XT48(>lht8U!*;5DyNy> z4bj2Q!+`11e}#===GQFVEv;RUOPBsuUQm>AL`t8gC^G#&ar&H1lZ;cqO2;IKzL56c z3y?1VA&$RQ#Fu$}5RoOLDEm17%Q!yepYksA-vg1;rSIeUm{~utnr>-jA%42_%U;wm z%)FG+r&kkX`XR7%>A%hCuS2+f$g~0ol#Jx_U(&IRpHTWe@n5FD9~GA_{bk%B%=$)a z>z>vph@UR~*=f?JsiRE)ABdbT{fl`XYt~Dd(*GFo)1_a_>6`TzmA`MA^n1e2l)m)e z>HHoESA$7j$tG@aF(-rl%y7U*`V?62>uF zeoTPOIHxal%lmTyB%_q4 zq)DIBl<6PC_LKep)Bj=mLlHk+`ekX-r**PSpMKwv>VzND;z}RSar&2u3NyFnvzh(Z z#514ugY?zegALK2CZ3@|#7~$1Wt{(m97z60>s6WmN-(LDber$X+{)t+F*>B|LIBA~ zF2vJ=&Xegbc}UqRfOPp^{3jjfU`&5f{`2u)=6@{WOPv(swUuC&&Q z*OK{`{irR<^iP5qNpf*1Np<|7O@EfoW56F;YckJN%yjYJyhlekJvF+LC1muxjSF*a zi%vBgEjF~`8N5Ej_&=NDoBr3xoAR6c^E1ppIu_|%Wpn1J{%F6!#5es%E2nStna{2F z>8tm6zrt`?))g7jU&9-HcKY-_flU8qv>$W<-HwfqYqX8`?nmV04o)x0cEvP2%|fwXnG?r+KL6{yPs?Dcq@ug-mF z`xlEm+Yi)aZU4&aY|i&P_hyeN+Vz>&xqX{^a8_h=`J4k@@9lxU&e=$&;T^o@{ERbx zW()Y+-jNftJx5P#8J#odSZv34?JhVJsVkq8+k0KzgvQ((&l+8{Yr@$DhrXNT?3&pt z`--P?3)beG;ta_4jLOaSWKFz0*V%>N6j_@Mw$bnGYUy7-Cp#;9R?EW$hnBxvaH!C? zuI_E`fZMa5C^+<sdq>`$?G_wzJg2?3OuZ(&u0Kpa@bdpDm@v|lv+`Gt(?EGT zP*a356>k6P+{d=<^#)#h+dJs?ccAB8?@_m-=+_qf`^b!YcNgut_uogRQ(EtMbvo~o zewEh9l(a_roTfEgD_-)HWUo7&$p6>Rq zHaMG6*PF6E1&81QoANycU(xlp4I>YZ&M(^a_G8ZBY}o4EJlLnUe2({qqFp2Ny|2ES zm3`y(qQYI-Yl?QA=JBp9%5oY4PWH;%@i~4^!J*M_7aaP`>$&{^>PY4HSZ8w(wi@HC zt0VhR{$}A?*~#lnAKXkHl?@-s`^|(a&hj|B@S9s}vwP)Sk)5-5 z?Y=(FF3OAXhxbrU56VeprZU?8U}RvEi6lod7qLx9*7!}fGjQTak8}2C-YsW5h594? z-&A+h7EHZmq231WEI4%Jh-U)TTlSFhIc1*wSsTtN+7)oTE89>ZxbL!H`Xf6qH;BE=*52ruAa>OmOye^frI?{xnDwuk;qVqJf-3AN|6<@7oY2Wm>Te{R}ov2LfNm(qO) z_4BTGpi0-IDccXp+3k$%x(;@I-?SaCF8hHRZ`yKa&n=&W_o&at8m1w;M2{=k{wcG{ zdTgB)%u4pV@1b7F?gc%Z8Ok<2;2Y1w<~^KyDGwC36=Rdh=hxY0nd{7;@b&By@33wY z_nXSN%CdH4f*FIb-_)_=M_v;CC>%WnOeqJV4@vYJrroWBUh+#ylgfMf1?OLr{c6FXTu;swXT9Vc%8f)0p7ok@Xg~yQ zk@_F%kN(HMIR|~uff^b!A5~)}<>j+H=Mc>ae2=3Z-oI$qpW(ajVcgl`cs|;OelDj6 z{H|ZljToaont=P<2d;W)8`{ZPZ{EK@;`n}jd)u4)Cwx`>^0W7UvVX$)xi=0#+L)3i z>NAG)?>TbhKC)*nl?VE$9PsH)e&`*Av8ss2D=H89`)7GH=9oP0-u^G-@t-TQwjT_5 zF(&c2i#+dzuM9+9uEi&oLG&u@CK@w`AdUO7oXxM{e;(4j_{oApR2OIqYJTADH{`~@ z^dEBLpV1dmn%CY{a47C`?!Epm7wy8|Tb*5ra&APNbNmH|4q?84?=sph&vJTYCf^gJ9Ofatn80| z{;wkqm%}Er*0vm6bodDDG+5=~ORxuEr?=oIX6!u}DBk|h6-6jNjfEp8es%7Xs@@u+ z(fl?%6UlE5#q!6G4dt(j<&Ox_+kOI^{Uviz|fls!CZ%BSaa5Q@g)1jpn5iMT*!Y2Q2D zgNy*S$peXJZYrj8gbx@$(Z*P+mg`B7n#(LPpCJ4rJs1M+T(;w)(-6(%d7N*awjp09K4ivgIm8&j^3DnfWmz$F42EH_n3TZvZ=nu&fGf8~NDx1zB+Y(Vick<j0?6bQ9xQ5ryR0?rWGfnEJ=~ajf`T#r|<<@ zv$da+QamXlsAt4nqm!=TZ zP``O(8p8@M=1=W3d}CB9Xl@Q9lQfqmNm!Qy6CcuURUBfR>_3QNbeUFyDCW{+04|!( zeq{XWKk(Y6ta&GYs$!a(R~Y^Wqf9G{ZcIe^Ml+1(+!~kuFU&9`nTokImG>W%nIk&` z6IvFU%cPc&kusmM7V|k^3V;3=37b5l#OBh}gU4x%v%+f=iW~VV@gehK0){7|EHsx% z#r544*PDpuQz~A}0md3Ar14s#?Y}5@Ng{i-ck<;P{`~L8_2~&k<}c8k0}1qv^XM@w znk-bv6e_931hQ=RZq*dV2%?cZ$HM=G7SnF7PV8QXh+>+Ril@UY(fJdN1F%<_542Y7qu<$WuUUMA#yh2IXRO&{XG5s1w*bc8tUy0t$D`{Egx{& zP`tk2I$47?Dj(oDdDByFdro(T_ezHLnvV1-Hi`DmZTlem->RQYAwe}u9 zD|((5PKoYV;r&v=?GQI(!nRb;G*VW0*0uaz`+t&sCDTKlv(-6AopaSWPo4E&yYy1m zz16voI`>uQe(Ky`od>A%Ky@CZ&PS>9V0G4i9Wzv2AFa;A)Ool%k5K1h)On;j=d1H5 zbsnwG$Ex!fbsnqE$bsn$I6V!R4Iv=mjC#ds@>O4uEC#&-mb)Kru)71GSb)K%y zGt_yeI?qz)+3Gw;oxi2dC#&;Zbv{L%PgUpB)VV;N3)Q(uor~4EM4e03d7e7&>*2WM zeLk;_lj1o_BE|8HaIFgZ24N-RSLgqqRkQ8Vy>$uxKV4SGpXfodK2Zj@yAIuH=r*QX zPQH>UQ0H}8be--Q)@k8&S~|}%gy(ZD_8idn5BTz*HfQ$G0wGF8*pBj)pxYhFNa^Gq(u69 z>as3XArxMlbqVHUc5II4sd4&!G?pUhLo39@jBY(2hwG^wO(-PA&}QIplScH~;izCvX1c?W=Bvlh|SJ5Op(-Zocy7CvUQR>(tFKn9$?% zy{%qoYr)@Cd0bzuN8NpfH`6==eOvV%4dtG}zHQds5Z?}c*MwquhWd8uyEeKz+P7EV z(JQx}QNE}3-A^cNwC@Eg>{#C$`tEepglCNJZGHEz;kX;?+o$hdpm^hapX$4%l+Rhd zgZhpP=b7(YlcjR4?kaufS$9>wbt!ijTX)sIjn-YQ?@H@#p>LDEqZa3>^IdD*)%$L+ z?izeIS$B=Tt@=*o<#gYz*4-lCHtTM&@6IfmCORsGfY0X{xx)g>0FJRi5MYE2mIDm8 zK@-3*8-xIk-eKh~?7LUr{e^7W>f34Mr_HxV-xa|7JW=0X>#oE1sC9R??{Vv{)Ayux z7xO)>@6I0xEpgwo)?JtHIeqsM)%I%N^I6W&LGVsG+%wgL(9Iq=3gl>VT2!>-EX$fP zNIB~jAXzg9Y1eOsf~=xJ+VwA@o037=^|#Z_{6X6F)lJ19?fUOiNcEucN*lG1tc8OX zI|Dc2YWV+Q?@hp~s;>V3bMCqK<|biI7!rnD5HKLK%vw!I0ttj9Bw0-{3Iiu2eOu!FWvI8;$vaj4a5Tie%GP*fahor>VZ|GV~H``&$566yPY-{156 z{?GG251hOAXRovN-fOQtoO5r^-iuQTu@rJdeOiH#Gw^;uI(%b#r#_6ZD%3dNKwT(W zTKfiZp_I-r7m8fpH-rl{io}L;p;Tlz7wT+E$>c)Kp~y(Q_f?H)D%Zz-1L=-Oh2Qci z6D5QOlAuEG_|nLG=m=bvdMRBFw%zf&AX;6l!P&_^H{sTg8BZL}V~ zaoT8PV&8Z+8eQz0&^zRW>FQ9zpi^;$y3Ey=HM(hf?4v=^#e!6|9}Sc4U>^HaWC)La zDsl>seQE$2$z$Ir+^D#xdD;P#*eGwD(x&?AXm4sv^;j=UMZz@l<$3ukaxb~`9Ir%0 z7E%u?_7caE9r7A+LRAw0bgn%($oyG)aMRPP+F5QrMROL95o&$p{d>J2{n4Gr1`}? zE1^-x)R=yD!g?K3=EzEDvtro^TddfOgdI9oOf$pGgk3tO=80Jew_1|35_Vg${DiwL z$%2Fjbxbu(QGz{B6ek?eY0Av=5?-`oWeKn9n2)S}ZUWB}IaHP<2_NaS=kaSAHsOn5thzLXWsuKOIXa$@+w_jwxSgP8h0Vsx4a*GObu^!YCb6jlMQvoE2M_ zFwu&wPnfD>O6T_z&a~3bPsp+c`;B;Nl#y$JO#p*z&;~Hj1{VShu)$`4{x-M>Al(KR z1EksD65Jv8wZWy3=wpK)0Q9!O7JyV6Yz0WM!8U+iHnvJHL+kYt0a01|C*H9*J)*8n8g;1+Sp*x)t*zYT5&@NBRf zz-NQI68!!F`Br1!1Bw0&O34}T14y^Q{QznC+I`f-x-Vh2j;SH#HwlG0rY6?M6Xxm| zO$F}$gd!{UL_)C@dorQKianJu&x-vvq11}~E}_hdJ)KZ)#SSFQw_?vEEYLAkmS+0AbWC|h4{w_l>*-yV?4**zMi)2kLEoT>xK1qwⅇ7ko%^#fU4SIwm=hU$LdJg zMk#;W7mP*T@g+EE)NAMnT&fpQzCk3&x>a~6tyS>X1ZgzO(h*oahzg`+205wJ(^7u} zHL5Yfscu+1;7Ia?!2vzvPNB#U;|nV3lz`Jy8BfKA2Ap28*sy?;qGGvp-SB{u8jGD8 z=#lEE66lh-cBF@nsIv9Ywt3Jk&;_CeqdS{>1V^-Ya723tN3?fvME3|hqsKajdxUDp z!oY52&yg^TJ2&t%6;Z=WQQ&Sna*rMPl^yxD9l6(z+-FDbcLvciR#mLcs$`a~4yww;z)+R>GZdM`HC9Wu$$?QSMGX~GctB7!o)(xG zEAaFH4N{JyhT$^;leKg7aNVD42UJ7YFN3&}{@jXF3o~SYCSHXOxOGSPi zEKw1)gu6GmNJVrbzm7#734Rlc zJQ`HL+Se8MO^^pMb#a20#bOY&JmW}6-|OWeiU zMbsF74!a0P^t_<%a?j-(XpZQ4fg^fe;7Fz#JvcJXj_8q1r7W>;pqF_0_>DHaEBzas z@DEEq-}y=EQgS-q1xb2@RF4KWCFxSB$c0Hgl$eTKl%z|gB9|oTQjt&jwj}9NsmS&u zT`Cp1B1xBu4DQ>Rl%=$($W=+XDnf4IyCzBRE2tv7Ft%hAVkNF0&iSrGe2^8t9`S*N z>S8jy@5ZFLvB*tHMJl2Sc}r4>iqM^^Z*LNwH#rEU2XInm2>U9v8B|&ETW=+;BGtAT zmfL1nk<`x_M2@b;2A`8!PC6GGol|}9>d8ly;60vveuHG+KZDw|G?Dl|4rc^4#wF4HHv27lp!cq%2Q z(%$fCA$}WIC`Uc?SQ@%%2q~gA3EiR}dZ_Si`k@E8Q|OM6lG%q#LqEntcpT4!5&mgE z6{Zm(v?r{>#TXAlcV((@IfZ{dPKA}uUrtrw@wn{>-IJxl^aL{W>-?C^eI>E*1LZ1Q zO7i>AdbAmP`ja@NyaK8v zB7RqQg>NVlbn}(trI5WsuJ+lX6iIRysg#Kn>EbSRQum{Ly2a^%i<9~i&S|ev5JzaH zvc{IsBQa|{rt6~GalfvMYKy0=cKn^yjt6vIXa)#9o2m4uc7I;C<4%y!3%VU2rSMBx zO6D^PznrhaO8=j9JF2$+%c2(W^GZ&fO+eBiYj6;^HikH(nH!4?&6B165gUWLh{ zLvOV?sV{_4`M=^sN2owmzF$ahwX6!!qARZ)bgi!Z>yQeq@8P5-BaqfdT?1060zE=2 zV>ztW7n6U48sIx;B9NYqQ<@eAp09_IP4;tPkvP77K)^}y35~1k>0NE@_(R6 zUo1jWuS7_lQ}y0%|vo4Qu{-*$bi3SXgJMY+umRBbY@(^aEl zq|78WsdI2XRcQ;Seb*>1R*LFw&1K^`6HsN=`RRorv5#ePB}TL|HOHC3Td@-^)Qxb{n7F`sr>*gQ73f- zNs%#Bsh!km6wk#;$J72~OuIIfCc3l;lIRFsms&-l%1|n6+L<|po(83;7GDM-RVgQx zVCoN%oPI4%+T(mzTC*oMFH>FV0Fr$>dG=KE>JNixmfr&p{3}j$__hXhrs|7aT9)c> zb06_IKWk1LM9F6QP8nv}arnUD2rFej>^Z{kyRxUseI}r9M^9apFs(Rt_N0udO>p=g z^NplR4I(+Cv|AHyYoK)aE>BE7gzzXT+DJN$R`_tTGKG_CF;j+C3|%l;0&dM|g!tMBbkp>Oh` zW$a=4{U0AaKer+zroY6$xI<0&@;}T_rJ$cM{Z438MV(goK{gN90 z-(2@}DiQ)z-I$qD;p1$k*W=CfdYoO}h_}ljvLUk6hyO^-Oo!ut6QNRKf^U;xEczDZ zF)>LEF(};o-Xv0(Lh;Fl5*da6{x5w~+)95`F>EMq4Pa3A@m6@bVAM~?|OYnmV zt3`y?GL_zmZZy^4|3*`drcB*`SnZ+*wW(YhRYA9bsyxLlQFV+aeMOh9zI_CK!Aa7; zG=Yar;AsS=!Si0m=X4Tz-2~o8;Ed04>Uk+n=HQ=(bl_sBmGR=9htN>wAY;*QROV@u zC?{6F-m#9ThpHc+_+ILzhO1pvgw&gGPN#1b&m`sk$u2nr`{rcjo7zuxf*t;jx?s9X zj;O)DmeDCY$xoU*N4kl`hp-g@M4mI5j|9{YKPS5Y1 zX0*^xfy|G6a{lKns#TS`6FYZfxPxiRvD3+-=FmSXDi4w6^bDjzG_-5K&M}hP5#ZtF zcW%spzf%UZJTTeQBTk()P(O-5My+e)yG3Po8wMf1}6I)YV8$r>A96ze$bxO`4CY6{}{NZyZK~ zSUlZF3bRaI`~!USxGWYQsIJeY+R@=Z&F7ESGB2)%j;PLj)nCmo$7rCVfvlY!egLhh z)S*%*pIJh84lvL!rm;`j+uE0<3hH?DfZlqut;R*oM(dHLk!l?W`GSXogqsbccDis}j24?J)B z*mVs}tH$DG-K!hwH#9Uy=)KEhTWV^X=ndJ+nkS5%Fm3|=jUP7_(RJ0!^c#7bDYnGC zzzS-XkeVg&YL-}PmKZflmbKQ_Dcvz;5#&C3;^?(gE1cH)=GqnY)p%6_UbtPju&lH! zQdAtt&M7ZgkQXVERNWC=gu!LFNrM3D=jN1E{cqgjFVt|Jec697yWXJ=(L>T zqM|$$8VYg>i_7xb(K&f}C6Vkx)Jk8C*L2sT>FAB(EgKrEo%y8&C1sI<+`>E#mgVIY zMal}Z%ktZSNN#a?hfpQ7Hq}NND_Uwy?VuTkGnx@pnoIIZbMlIm8i6AD;~mmb-CSu@ zpj{$4*@cBOvUBD{@?h>6g#~5#+NQCDoWcTVj98|~D=jT9CBwH9npsd-o>v+vDb0)N z>rn7pa)X&wtJ=zmMW{XFm6hh@h7y^U z<(0zIBAukRFS+u~8O6Da7WcwPq*Fmv9wOLS5YZl9vO@`c5vbF4Ov&xFNP zX=3djFT*u1%3Fx8q3l{v1Q#kQFUaO@88dv;EsD#FbBYT)&9}HDuZUi*U09r*8_8Q# zUYc!m!?*=A7e{jPO3TaQ%hAC#T(py4gWfW;xOA?`gtXIuQ82S0C!0Ebd`?`=>=Kj` z-k4pKTb7?aCohtpmz|p@`$KUNhO)U-2~>&3kK#GmqOoHgONf@uFDWT5ZD+-jQZ`>f zQGpsGV+M{U<)UMi7K@A)mK8*DO7qYz@f9N8;RUnu$|L3ZxFQz=O#C(3xw+_Bg@uus zA|W@gu;YXrSZY>YWNvY8UdIB3#Tb4_XM9fci#ka#Ee_8thkYZZdGqEMlw!CmDJ@ul zN=D}7wKG7ZBoEz_45!?aNAtLG1H&0<%gvjaJ-<+TS* zi{nc(3vIlB=Et~}S7j`jD`YL(bvCXWPc-8Q4?HIsM@q97MoJgO7lD{wVZ@b;a3@1K zC1vLpmx#JVafBv`_L-C}>LekWO(*H9bRDG8c-`L6Ir#;Jxw`0)1qIoWlI+rUX4f*L zm)CW%PCz}#G<d3H{Id`;%V(($j6!X69F4fV~=+_G7bnT5p*BlC->w__<0C3@Ks zjiNw#vx?Pt5R)MXr_w~F$SiSSCe*4$Qh6cPT;-7&d6+`-9F7&wadJ7BQws0I1~hs` zS*(UBbZ#SwuOoi9P&^s1XZP?a)5S$7t-JxUom#|n^#Se5ASx@v64aKaltzK@LjqMm)U41BKy_Zd`sy<}5E z4%gFOCdH#jcG2R9T47lO8H<=CYfiV7mf*e%D=iGkxM9KwiTg{dY@AxIQp>R9>^L#E z7!4Jlh{olmDb%9c<$AK=Ld`6kUzU&ckh+}~X%GR&y;e!~Vzmh8d5SO1$u6QUx`-?( zZVK(fjn6;Fj&j$FU`CEkGIn}FS;yRzA-?#A#+MB9AkFx^c(b*0N*M+_%eYM8ueA2I zQ;M?ZqW;!Z^tM9m0#%JC8njQC+5XH-IE7dXV`g#ab76KV?imm$!n~4$)oK&2T<5prE1fvU?J9)MLAf^B3Vs&6v!!_j|B{s3VU5)Ppq}obr{&Dil~(Rd z)hsK=JdDy)26|G~YP48c{`~UX;)Uv#PFH(^R%vR4E;uur+RRvTf?av)p-^2;YXP;| zG&upnDq<<0i{+rGx~UlYRiVE7*Xkik)}_Zt9VHdx8R)kOP&Sw}gwh;+k6TzUx1cwDkX_Sgz_bQ*u1aVX+>#HpFoHN8XB>GA~52s8;}V~8B5^& zNd`%3uS=)04m%=Z1GZ{xuh`mTWo|4(c{VI3g=&MhXqjlIOqKamBdwauy15lQw8>|L<`U!hH9J4R`rnDsi<-AUSNm5B2Xu@ zv0_Dy`r05;TeTilz($0yX2bI3*p4&yJYQ!X^4;Il#cBol~iPHMIE*|q+JVjs1iGj zs`oQvdsVgbXjLsdwrKZXQBeM3Eb z9$)ui;G}IxBUCapmUc4UnzXX6x}u)NvdICbUVjWqDk$P2fvZ>gXo-*N?h;MjHfPyk#M};j@YTe)P)Y*j3GMG+PH$^ z6?Kgem=I}hUDiyWgqy1AD`K<_b$CmqDosR9C#&gw?t0+Y!5D39pxF%8b}Cn3fLjaC zqvmOL>S^;?3^}cOmNbK6M5{GY=p9WJk=2+>X(&;HdUX?82u4{^Ys}=RePiK5>m$@) z$^xoGXx>!a+N}1aHBmLt(Fmvk3RvB=y1J^iqNx^H=utZQc6dzYsGO>X>IasUaaV+n zLL;#gX|2a3p>4!N5Uz6SXnR!}v>kMSs)!!xO;s@h@hzSCF1n`krMYIIvH2kNVIyHZgd62#nu)d6ohU0IFUr@6Wk_QEZrvwqUJ zY3dYdT&+JznyB8_SA}TI(hT$dIyDXIsGcO@#?B(TVs2h}esL~KYUVVqs@|YZlmSIl zaa2HU9IQer0~LyCETM;Gtg(7+V?-q*r@RID5&>xr)r7KE&)9f|&dGKvVV0)4iVZM3 zdNp|xEzlwrYA9~1u56&+LQpbYi*HDZOLHSwmg7mXl3pEq=u4|~e4&qphw7*pt;m{M ziY_ju6}S?b3yUgOP|I7|z+9~`Y1?Mi0>)8rk-A1deWli`UA`egGolGcy-pca-ONUE z@aUsyovw@O4^6GKD+6tY&PzMJ&SZ5MA~Dy~gjlf}ox2fpwo=BAKyd?@J(r5#4m#M+ z8G}65IMGs2h0$)h-c)uKR1HTgx+v2U#>Xg$<_BGQwLVrF;F?O%jMExoZaETRf101tSTU3FpgM-D)*etc#7G z8j*4Il#PCZg(j9C`iD$#5?Y#&UbU8QH~wORTkEu=YEm_JP#4+}^0as&w?O^Rb49M^?6|+c`D4z)0o>Wm#>5GozpwlapR~ zDc_^g=mNCIs@Sj}CJJl{!*}937`qd$Qgt{&V zX+dvQNKMr`&i9o%LRVDQwAQbRjcmLMAjeYog|y12rlF-^UA4M{z@F`TP1J(guEyQO ziYD9w;3NA%koHbBNjjCjTB!BvgI^r>)~1Zsajgn!wfZ~*bgeVoIZ6o{x&y1oQJ(2FlhK4$$4pDtQKUrzP5*A%y6$V*aNRVZqxdp97{UOp)L-{IP z*U+#E&-L^Wt%}Q|HG8!hrCarnB2{u@T`MioRhabZIE~?0hoD!`DnqAMArCY;1{{5# zsq%}HQ_oVU@8ZGGiWRug&{xB^d2&GKS%qOh-LqjZiba$zE3R#(R)`_@%y`#cDvgOtreXSL^P|3XC|lSQJF)>5{siqFW%cJshfuCbM<5 zxEa*_5f2QjoE7+w2aveyt7=%yt%$o5Yb@fHrB2#du@1khC3#gPyD`kfqXx}JERop< z^eqXMLiIk|!J2F7@el^LhSp{^>0%Ap(p0PObYx<*>d0SAz~f;q^*jmHTZM7K?i6?! zr$#`U(^p_X#U2E1K{SnC|QeQ0K?Q!6PjZ zv-q_q6Y|?wtLn9us%`w&30z%rbTieOD(l**$EqFGsH03(`P!LD=fN#dSGNq$@H#Ci zEMO|%NH-%Dw9ue$4B+fEfvtAdst2<4+@RiZ{*U~Q-|4}BZQy<%+y9Q*6(_cwZ`NEX<&B2@KuP7<~RZibd zpM~-1RJUWCPJh3n)AiL<2KoycI@ITqE(4cF>y@;t%XQtZ?{P!w&3$enEqHqdGW0ur z>8}`F_e;FN6CZRr{=5I9Ka%*L{fWic)yt}@TI!my;KFLDx@l}}ePvy1RW&}bWT0oV zofNJClSrhwYSq|!OgL++$DTfB!k9^8CXdB;WK9hXEn{1oW4bCTnksAX_ZOHjTi1`K zE0&fCkb7(3naR#)zSwBq9ZW zyG$tv`5nhpe~GUC60ZId`ZJj&^rtK8uV|L&zn)pbMqPr1EY=9nfWNk)JdJAddB5LD zq)&BtX>K4n>3AR|I6DyB97qn%4Gh5Nz@V4-Nx%tuWwQeVz0tD+J%e8ILxDka0$nc+ z^v1a$kT|CxkX9H-#f2k-a{{O1vsbVn(0@*#JAz%IE?5{yz9i6XP5`(UlmchadA9fP zCKC3JIEc=rY_8d~Ie=H*U5Iz6C3tn81V0I+2TKA8&^0HJgzNe|6iAvKIAt@PL&3sJ z1A&Wz-o=|X`}}b4_zGR`x`F;lzM(0BQ-co$`p*u0C-`t+%)CH9sByg4Ha-*xdUv|B zgIfd1Uh-xXFX%n9aWfU?e&imcLPBKrL*BC+X9v8X_hWZ+C@1K>vhfot;cIT_Fs|Pi z`WZyMhjB$uT;U6P-8Tn%dTTZZd=~|V{w6S~Ffb@T00Rt1>WJBa(FhJJ3Uq-Ld}Nln z9he2i_fS2um)AO*g1vCDDbH+g&&G%FCz-OkucNxBCizCC28Jo)2e$==Y*E$lg0Rt* z8$)N3;riT~$shLd_*{j&pO;AbI>lHTX%sUct+ zm^Y6u``3BY&piT&9Yr!6cC-JXp!dyrFaw(LNB-Fz;k3woAVx`j35+9pMy+hd;fLbX79)ThXSL}NiaAe=h+z1G5VnD>1fJ{ z_)MJby$X#9L2oZ4yIzbA3EOq|5;s%E-&Pyf%iQb>!(wLsX#aT^<`%#6@d=qS0@E5^ z@F}sQ_lxP>j_W;c)E}qErRm*s^jgPG=&JP7%dg@Oy_1M~8An{g=V}hbUmJ@9e-V#^ z-!x^V9a21O5go)n+&G4`<9d%9Rj9Z$y|Yg+j!`5#KSD z`fA?3zM8kMujcLRt9fVjZSS92zP*2H-rheoZ|{eixA#NMhtNmdaSi&Oxks`Srl7q# z;;X=W=}w@;v$*fx--(`skm}`&wU@e=0vkkn^qXIl9(A9CPy_Vza$k}s zhq|vpIb-ds?z13!sFQM1%XXxvpc6X`?nKXho#3GvZ^f23%62~hDqKEOQDd5&Cbkw~i3DI>n z5A&5N;I@|zWj;u7(>^4h!7}u*o5Q^Ye~`J6HzV&OLf-J_nNz(oIZPifa#+^uRpzo@ zi*P+1q({AlLPwnkEk2AHef)RrR>IesdQIhcIe!{E7`~Lbtk+PhJQG-kK1{zc`sZ?5 z3CkP(hA*-7*mir3xwPA1=F)CG&@bqqa@zL6E2Y#S^%%QJJ^3t8dd6{>J}&04)MNUM z)blvYlb%yKOdrQAZkMwMbE)5yU+OQk^o->&ebiXoF8^+e+vRzcxy<(U-x9wp2&r+5r{dT_VnH&8yKGJc%{%{O` zi{qxu+eYyjOrxcsY1VzH};YFF6|`WyDdJ2!}M|3;5zJ^=!C!838#6vBRy4}@M}Ba&sto)#9FI$F5{&hmDA?S z{IPs({+Px4u@3q;D-e^n`Nf^^=R4siI^h$79qX^|gzvI=y1rDMKkkIj=2roc9c=l1 zo$wLtC{lij#qHJLeVy>HJK^IJWA(N5R9bw1Rj)mr@PBo}hwu`I%5Seu&+CN0(g{!J zB^~Lp@2V<0;k1Dm9a8>Zo$yIrI+p)oC!Cwt@u56}^`+{};)fK zD&j*edE*;K{zgt4&Y#4GAZ*4RGdCIe?;@QJGrk%Asm9UQY8jr$^0}ODct7T|1vm3e ziQuQR`~tzv{lXH#&3dI$@V7aRFNoA(%5wwjUnlrV<`)Ql9`lO?-_HCB!T-wqTETZS zze(`lFyAfsR2~QK5&T1ze?ai#%pVmT?}b;#lY(b3e?jo`ng2!beCB@_yo~vqf-h(O zq2RN*|9md^Wi0=-;CC|jxPGP`pJ8tN&T#$QfnMXO6&bE~M8;ex_;63l(K>(*Bd_-i zM&A^?oaIjyyq@`J!M8Cter@#M#eABOe}?(lg1^H&PjGArs*X8=_u%<&p5POhFBH6- zx#{<&oQ=#Yh5WV5YXyIpIo*%bVf4JiyjAe-Jdc`wX5@32Unu0)G5>+!KWBcq;Pj$D zI<6A@Yv$JpKAH#STLjN%{$s(HGrvpljm+;6{95J@2>vVPj|%=A^CtyA%={U_1H2CS zgWv<0|4Hyk%>PU970eF_zMc6yg70DePr)Bz{;A-9W^TqU)9#-zKOy8(c>NLJesAQb zGEWwK5%ZpcZ(vT}Ow(cX+{k>O;7>3=MesM6j}Y9)>zJ{EpTc~S;NM|>hTsdBXA9oQ ze3sysGM_8>jm*tBZR-0N^Tk5`-^?R|C-S7YP0X z<`)V6Q|9!%&d&Eq=2r^-SLW9U{x$O(1n}zbj(ijps2VU%@<8@K)yOf?vTrEch+V%{*`P|BCr2A^$Y<34;Hb`BcH* zWqy|6Uo+1YTy5|T3(pq(6#nX^P2^q#{5pf3z_c~yqfvlf}h9y ze!;gh-!J$*{8huVg5SdOc=vu>|9X=7p9O!1`D=nF@mB$F2tJzm5y59L|4{JnG5<{P z&CI_L{4VD7V<0+=pZtb-Q1C;{y9jQ+gy<#spdMOpKf%vnK1lFI%!dlTmib7*f5?2C z;P)_}EcmO;&lLO}<}(CO;C9a!JcD_W;FFk}b+@tS9OmZ;`D*4%1wW7Za>1`*zDDp_ z{2*b2;4iZLCc$52eu?0Rm|rIN2h4X0{%_{yzQNS@1oNAOd=i)Q4#9gf-z)e)=JyDm z$^1dVCo(tB2~Bxu8(KP^74nDqtHqZEU%>Kz6?`f4*9Bk4{4K$^GJjw2UCcigd=K-_ z1%HV7*Mk3rxyScCroR7To+x-w=q9e@LQRW7W^sZ zrwjgH%+39xDd!i=@mn%=7~Ye=sKIZz;`ngp^97&I9QzE%$(J#&5WI%@3c)usUoH5} z%$o(L?PlrNAo!n|ZxZ|%^GgIDz+VnrCU_3>oq|W0Un_Vs^P2?U&ioF+Z)Cnl@SijP zrQk0zzfbTlnLjLeAAaz;U+^i+pB7wiZ00z>7rc?>Ulx2P^S=px3-dRaySPu~BC7WK zNXQ=@qpjEb zro~CVFW+yEvN*}_V)-c+C;3ZR{tSzg{PkmT!ZAzmds$DZ#lw($k@YOFIO%z2AWk?c z1kYvr)LA?XxjuX!(r9tgb0?SQJd2b35|-a&agyK7^4ly<^5%Z>3X3cGkx0aGo#6Mf zp4*ulKQZm{gy5fPHO@i7&2#eOf}hEDOXBAx#((Z$|2$3bw@2#?%<~>2{}9X15c01x zFBbeb^Cg1oolYI6R`Ai>UTXzEgZV{*oA%uyxXWMK+${JDZ2zAL{#WMa`ID*dVde*f zymy+mk9jU-DBh32?K9k#bl;BUZym`)N^t{TvNXWm# zJRmr!l`?@GR!L1)tCSe!(l5KPC7E=6@7?2lIo1-_HC) z!5?J)mEf;4@1CUF+1TM#9+&zE{s-o#3f`Z`pK*c*`)a-45&Tx>vjzVN^M!&x#~d5` zs>77?ZRTqP|A6^M!TWGIe<}DCEdPk$7cu{>;K|JYD7YE7Ul)83%YPvF80N?H_`7WB!5Q z{g{6tcqa2u_xScYoq3wz1XTDnSA2Hu3_|KVNDfpAjZx#G+%+2=+roIQ6KOy9gFn?L_W6Tc=-gAVu z^S=c@I#lx@KSwwDX0m)=!KX9N6nqZzX@W0hK1=Ww%;yW<%DhtWEzH*lp3Xm1+$8wr zEPuJ+v`;M^Hwb<=^F4z9hWP`6zrg&rg8z~E%Ywhl+!j>z^;US&uCfd^OLr4T5iAe!k$3 zGdJIFnEJlR{6|9m@67KI{4M5p3;s{$j|%=7^JfKL!*+O8@GZ>W7JL`;&jjDi+{fQD zn0h_Lyocb=Gan@QKbTJtyok$xrr_p&ut0G0+<1ZD+qiuz1;3Jcqu_g(Um*A!%r6uC zedgB*ew6u71wYRGKEV^XzE28n?l)f&yerGUE_i?D{}g-#^DhOT#XOO}KQZn20+(~J z;5RUzB={@L&l3EX%;yMh?&B5-Zt|@b+}ua66a2TVf1}{{GrwK%6U-kI{13qjLoRg5_5T zZvJ?pMQ}gsxlr(A=2r;bo%s!d_hG(UaO2PS32x@WCj<|(o<9gaiur4TPiFqE;M18O z6?_(RkDrqnI~OzWA@~C3lLh}C&pT%eZswOl!Oi@#Sa37HEEn9&FU^9R`K3+pWG>I; zf_GuQM+a`~&7@+%o0)n0bwm_wgSIwF;iXe6!#K zm|rRQDa>yY{8Z+52|kJWKEaEaKP`9}^FIl`ocWuAU%>n`!7pMS;PKel=PKrAo;Un< z=BEnzdznuad_VI7!Czp0j^M8|UnTg*%+31LlqZ4x_HrTLi}}rh4`goUL!)Ob^T&n! zEaoo>{$1u~J!15%X8x&=zks=)=K&*sIrDVEUuFLsEcox3=Lz1%&v}Xk{|oD1BKUjE zYXvvoZ>|&EJWsns@Cbijc9q~OnVb33)b}F3fB&VBznSG972M3T&k24x>-nqTyO_Tt zcyd_Xt~vh}d?0g==Mz)T!OVLKK7x6M;Ab-*EqGVHFFr%?0n7^oKaKf9!QbV2RSUj` z<(mb+fcb@jo9{QT6#R0Qze(_$nBOJ%kD2ci{Flt17W`r6e-ixn%-IPD*9u<3{%r1pO?k}y$R;7*h2^&k z-kte%g7; z#(aq2X5Btk@XJ{KOu@~1zCiFRS$=`wPcg3){1xVng8zfLnO9A{-ebN^$RA^Vt>8Yk z&rbz6&p#g!+&uq$TJR~X=M}+cF+U{u0_GnIUdKGh^Mk3^9xi`(!Oi+$fZ%4F86mhC z=O+t(2kSpa@UOW%m4X{Rje_6K@@Bp@<=@YIn~?tt^J@ivoB5rBn{oIa!9QgA1A^bh z+{g7ZZZ^kXg@Jq4c?R@fORcrkO+zm0xl|4BmL%*WY+Z(u!h1uq$_^Ia_X ztz6D(!GFeljo^VHTF(W7Kf&@_1^*lKYXq<3^4uo)do2HR!IyEq2L!){<^Le~519W& zaAW^B1wV)F_AkLJnJ1a{$M57w^*YvX`nPGXD&}cIzJ~P-6MP@nYrNo3F#nF=FETF> z{O`=?3;quC3c){OUN87@=I03>;CgKlya)4Z1n^kZY6)0qEK$Y(SEv*7n}dHyc= zFPOh2xM|;y1vmZ3j6D}H}jMkk4=4_V)iR%*}Xg^t{KsE03dwzsfvK@Po{U3H}!ILcs@fITi|j5%cc}UeA2F z;5Ez(c->^mSD@D)?xY|B>L6ng2rYZOk7K zd?R!7`zB+b7ny$`_=_4l zmkVy*llWu7+h9LBo)p}?7w9eK#-5=uTK<^eJ((x-?{|#+c;=~s8@ml=PW9@iRjcz@ zAwQJcak|CBkbJ--lWLW{ZcxzsvHsTb$${W%+w7&O<6v z9cQ1#!-zk{<$RjCX|Lx=7{{A}S842gCivsb(=v6y=*eV1oF@2E<|TsP%Di6iSD5c$ zZv1dA`{8a&o*(_Hf|%b=QF-`LqT+wH^n^inusvTF{9Wee_fw{Q&EGE_7xMQcDD{qy zf2U*Q2ZuCIWp2t-sIfC#@D}DX1%Hb9O2I#1{sZR5KC9V2cL;s~bMreUBX9ceBSPN% z-QNMh&ENOEBDm>~2L(6d;Rk}7{&-Aq)4u}zJ0?@kpK|%l@0$!azgzAvaEPI`XJ z`Ch`@lyixa#`|F``7qee+20-#{NK!fFZ7hKp0@?BV}4BVtC{!X`P`J}XUr!F{tEN? zf}8On!ra*TL2j2eOP(KLDos}i`9*A>A6YyM$#dDB*IV3fm!DXi`pvj~D$5&g+Hs1dhwA$*+do%u^Sk;I!Oe5{C4w9OZ)Q&U@*_0l;y4!y`4(=+ z%Pk&;T(4x3cAT9Sr*fKc<0gxT!Ovy++bmAwILY6}^7mMr+=L>!&$4dk^a*G5nv|QuQ={-xyVoKc{3!qdH;J4iimzuJ3TZ4<`HA_4?f6cD>&AbOt1E*9-gY zsDrp&uN@Y*>y^UmWs&F4gD%Vg}ZSy{6xvYfWe98=%W zQaxr?(frXWA-3mftWnxo*V@@Me!EfIplVNG4XSH+-)qY*owasc30JgMH0ceDm7U@@ zC$*Gyuyv`Gs0mhHfY#a%V zs^hlOZbRx}hJ@W)3TdN1g=U7sZ~l-DoC z^^#E*$9Nz&78(jhRS8id4l_2=`!XpD{xc1gMyEE;*T|a$6E~lKLqbR8-@@0M`QBVF z%laoINJg@mTlE!YzN7M!jZMC${FHe|`R8)Gne~I#);_Nk+N3eO?!J(*9;&1v6iEcKyaq+Q02GeZ_9RkjhU>bXop>o#fxf4sF&u ztfrlkOs$ z2X|EdySe<2b3dl?(@*+k`AMJDNxDDgMd4b$o){fcb`gMNB)5VWeP{6fDKR>vY#BgD zP-HRp!~A#bmfB=>Fcx1{SBftR>|udT3Z@hTgFt5X&4)(W1Kqc zlMd_i_;Y^u%1(b#H{|^^B=Uy^N8o@k#L`K4)U>hgrwZcKf`4 z0CFoQ&)ApghAs=aNtb1Sz2Q3L2g{tD%Y1F6hrB*}DG$_a$6!3FI}9Fn+DhN>Que;- zrS3g(i!+VV`#5dA=0pD*r#L%rbK6P}>U5e?u0H4^{^eUKk#0gEQ88Tzv zZs*u!Q?@LWi)3nF$U2^xmUVoKOS;jS z5pu>a4Lapi#tgqR{?HdE%4=p)`O+uU%=GQUx;FK5ug}O6zSQ^IJg0mqYX?{jVV zD!69CjD3&!LhtW^&ER`GX23>=ybM)V6F-RfA+Pt|)(O6SRKBGjI>*DFbMGe9xfS(4 zf^xlqbl2@mE0wEFxyTN9HeLWZq~k(@Pn7n0+b*HaQ1!TSsOcPjpe< zKDpCw8R^CN zfp#`Frt_j>0IxW);Pce49@K^56%{&fd^ngsFQ+~@A-n8$3dg9&_L1zv2m?%He z&FQ%nGI+1{n$Z5O>3DB(&-@f;=Lpn$+ZQ?0lHIInBLdFHh2XOTSwGy4>$mxmE}MN% z_O#h<^6aGE&eZ+ioG9N?kFf=Iy%_yTje8g`sT^;5y+@M2Wc~BRly_6I_8oMciO=9a zwM!!G_U_8W8%QqX_MAZNlDPq675r`D20fl%)5kxJuDj2dJ^}5mt~=n=Ob%`6)r;h} z^va#KH<;dQz8e}zV+W1dkAHlkd?fUL>T~YJee9%_PR*3veVkrfdikg2yD2K4+uDr@ zeRVm(jct#5p}l*A9MxqC*z67Iy+$JcW`wbn-GTk9c3!r4)q{ntgUa@PKcj56o7QWk zn>6yoQFjf(rI{EL-}kzVJkQS#rl`GLifAhG`_qo5%F(oUf$Xj@r@ZN+j=6tanZ|Lds96BWzw}R z&6#%DKxf+4!Opa6hdI+$LAO0Fe%0WIA9g-2+H-N=2eXd%DJf8MA>G6v&HA`to8YKegVJjv){k-UC*J{=cU$QE~2@V z@^jrpHGhQDkD)*4`SS5EPfS{db-@$goS0NIJZBHas`s<{IOPX?xbDN8Y5j*eJ8K0z9PPIs6y?;!G_@tE|HJY84wWSF*T z#JH%-u@YnQY}fxBo>}i)IoUZr66IKV)SLDm^sT}?U$>XiojI#8-_M55Tim4gw~gO+ zeZ)G72<$NO!fn?t9g=l?73TUbBb=Rc zNBCZ%`fPH0HuZD2U%$k?{Q41HvyLCaJoARv5B++;UaDib`>`oCeF~<%i@ulS^?xqI zO>4@>*q8?UZ%B3~zH#%6ec8MQqPmf6jWc!1SEw)6s;OH%U(aL7&hg`?cq6Dyk`ge7 z^#)p(mP_~0u^K3#}hET>DjIqRN{(GOw>ZPs1vbem>2meAj zs9lVYLFOI@^DV7+4;+d4b>$JP+t8ky&Ps%CjIXedSr62}SCqZ5Rwi4%f%YML(%OOS zNqJ{sol0wiREz^#kgwF?V4ctvX|(>#a5I`hh&zET=Y)9N`1-uxVD04Y`Py@K(pt$0 z&)D}S{CLLsSyz#M8ZWLw9$V0+=xg^TUWhvFKmD@A3mugg$-v&22eUB_Jh7YBa>RU2 z*1pq`R|NB!bK*pKWR$b!am+tt)4}LJWLJ`-b<9U7%h%^UrpiG1d(M_plmAlZ*p#o& z+aJ{%f?m|O7tMoN&`WD>(ogj?a?}s093#~c9@aQLTvlCQRa?IzTwlE|JglxYoH?v{ z#Hes1)0U>z`pSxy>ZXxVEmYdPPNDxTPUn)ex?z57XoJbxpM` z)nVLuHP=?*bGf;qrKUPeX%)-rs>78Pb#=?|WyJLG^4j&`4GpbL;mU@p>Lh36$Z&O2 zQ$tg@wtj6zU2RpkxuJ4Zcv)*pxO#nKbtRPoxizC`N$Lxm#oyXI#Bn2~bUwoMFw=!_BSDjkT4v4Xw@Ly6Sr5+!7vEH7eX%*8rO+sc5~N`qsKS z6lXbXR5d~uK~v$A;H6COONSDppq`&*oL(71j0CO%*M*4fSFA z0;U>up!};E$oT48s4%{XX+rjOR5r@Bxw>g>b)=@Hr7^M`SJ0O!E7TWQ^u0&dq@0HO z7JQvGx_m=p_4M#Cihfr+EiVkd}Dc2!|HJJs+KUaLArh}fbm8h@LP57jkTadX(#wliPmWWQ$qlQ0;neh3{ zTxXtnBGDyU%tiXT*txS}4rLM7DK)`Z{j1v7-_#+hSt`cOvpW8Fv=p*7G>-``jiPE3 zG}eTa3EmsEPPM57%|&#$PPGoi&ax7(anfP_gklpk&4WfXt+OSX*K(6rNi?tJv0QXW z=4BLyVp>cv`lAP@$^^~#_Q*cW7nouInO}9cM0G7P!I-<0nqaKlB_@~}E4QhNF`LgB zcZ&(v#l%ilJ(Hfr0hrPRua0V|x|@UjqL0r`>S#u>aX9n?6EyaNMU36(xg#Awi#XU4 zLniwJ{PY%5CU`iC77g%g9k@4F2c*n4O=kNg*ZGfoo_PX{o@au_$1w7=_linW6?%kD z2c%5!ktkYWf}v>bDowB^idL9l%m$Ul2K0oJ)tg{p)CMa|5Ni)3WrD^QuCu}fV`ix| z!PICAuh1G|XW27M$|w%FPMHbriWaiklso1+C+*%@tkC$0hp&omk>*vfy@6L515e~4 zXgQ7;ySmOQ6Er4Pa;C7xvI?4ru`Mn(LE~~t&O~DVw@MmX$rZAH)bI42$OwzH^dT+9HbEtf>Qaft~ojiO2uG?u`HA8~3b4?pmC|1C>7 zg6E^^fLuPe+fx2?opVj_l_OsFEPPbBc8NHo?7j1)?G zqDoV*r7^^z=!f)rlh7}ENr?#>gHgRoPFkGyisp5s=s!15YP3Y9CTN%FW$joSlC++yAvi{g5CKzJWvDMt3?yznt0k2z+zWuxPbm!yC2A|(8Nb$NQ zCr?j41B-7j)A70uz;CnsLlHPDIXT&J0wkgY5D7*jkWR2JMp{T++|_XsyF2u1XSL05 z@)+dWE11>q+8JqHH{_ChYFa_c*=df`CE)n_YDCgqC&op)O+*1moYJsSl8*Gm@Yo|+ zX~a*sa7DkEP_M0>_RF3>Z8W*wMK67*~l0s0e4KQ6c&SR8jk;ASF4V zjnJ14wW>J1~FiVQQN zlDI7Ff;!IN!MI=wvKm5GPfk7y!Be7FBQi9aXEK#&SYNBO!_~!5c4|~8zy*V7W^b2r z9npskh(8J*4j(zKuWOoo)Ff5f(J7EP6QW~!BTmn)g)Lug+Q~=%~J(;I}SM z*24G-0ta92Sm{0E((RN$ry1K)T{@7m(tTI!V#ejK%F;pc6;Dv-kUA%-bCNnIt8*81 z?yAn+)VaGl_fY4a>fB46Q`A|n?|Z9oA9e1l&i&LmO`X%#xxYFOQ0IZ_JV>20)H$rq zgVlM6I-jD>di^j=g@>#2sp_1m&Lh+rUqjF)JVl-LB4wHiPgmzN)cH(x{*F4IrOs!obCx=1tMd$X&Qa%Fbiqw)X0~0ro36qC)pd1(sttXswA24zS60iO?!Wc0 z^nbjJPC|54_5D*hA&-YDtOrs(?Ztaz3>w`tKfJzBPD;WjOuY*ohhgdUGNtBf8k zJL>}Rd0|-+EwDQ=Zk$$S(&T?Wj_P_2Ryv2M^Z#gUvrGMUXHDBd_qVR|t^9T?YV&`) zE&or?8W<;i@9`fy_}zCyYB{}0oj2-vIN(pjuh?`rGw z;+L-wm`J*#3k3hfSFzBxq5&weqBr6vhgeMO!#|ax-6-OpQa|2Knfx5S$BYS1r%Yne zY2>s$4dNd6^q**{$QNEHmhz?7 zLq(n-v9G*-D)KxvwH4fso36>AP7mg>J%#~wpt zyM6t;tyn+*-8x2Z&vDcI59-)IDVFYkT*v$�L8h=-4T!l{>`$qLp@v|5Y9P3NGRf z^&iwRdh@0`%zs43=>0kFaQ{a-_8OIQivO67k$1VX{Of(H)G9W|f4&tf^tZ*uF1BJt z{w-Fl#J}B&&GYZjF>+Y9)PJ=VEA#KNV&(oDt=N43tvaU4vcP|*6w*{6046;E5z(5-;0~la~N`U@0r~*j8+bUhP|6U!VJ>A?o|ASU}R{I~( zv6s+4-3I^TR;1c-&F%vAe8tt$N+L$^|#VXeUo}CXB`g@@lEcnT|XHLd^37$*AG)9x3_lvY>Le4 ztzBP5X7|>v-%2S(y)%_I>LI>)y%#x&lc9G|2~K^8^&v;pry%5=j3tQE;TzLCu>xUL zsByl5x=^$=rf(1zO6d%9p~&@pL%2|XB(b4fC>0sbg?fupGPzJ6Q)FcCQBDRqkIMCN zU&cQ`RroC*5AYczsL(sU{^UJ$1TIT-QQ`qKA0(36#2$zaB29hzQ&keFl8M6zPQs~= zsxyV0jGibg9lp1Hi8Dz+U8MwQ)5|{9bfR)QiF8h+_UliR3>|?B!xthx_{TVT+CDve zYLMGX5Qt94080@+AH5;lt+hGZZE*~r48C!oM_xV2WbMHO( z+;f+CXWlAt0*5&jYesUI+us}4jB<5bE3wh8+AnZaw;bc@XM3nK z(BS7Qa7$F;?URrwb{D9G>aBC!#VSD!;VX43RYLWfa<@t)$U45c?(%qIp1Z;c-HOVb zpsF7jGK@Z{Jb^Sv9g~8BZ@@t58OEt`_ltyFXJ zXq{4xzAAaVm0F!V$x5wBo~Bbu=h?}pTIbd!XIOFlJZw`A$+p0Hfa7ei0bsBV&IcG| zgN*7yv1QZO1{Xo1j}0yc=xu||0I4?E0?^9_mjLv%!B&7CHrNKx z-3FHebhE)_09|cxIY1X1YzOFUgB<{!Y;XlYiVdy=2-)B&fS?Vo21vHSPJn<7b^&-c zxCtQ11~&t^HrNf|x51ssNlAlpt;W6|5(62$PR{rszyKRO1kgWMyN?<}Taxp2N`;ii zlM8i9jiFB_&(%bs$;DRcndA~H^=$GSEA?D*sg-&@xy(xaCb`^7y^uWD zN*zd^r&FpdFDB2o&b^krz)Jl-d7)-sX3TSR6pEofzG^Q+r?yb4#>>_zrLfk^ zwNiCniIuAN7Fem3-eR8sF~8%gbAu@5xPGNip{b^64ylVRJQ#}s| z`aaT?SGD>JSN`8rE6jnEC6wO3`2+F9$NpqzAaxjec^B!al0S_ES+_bKPSX_JZaa_$ zSbBLiY1Da?%yCXA2O5-;v{YZ3cDwtjMngS4&OT0w*I-!cyU7O_*U!E=y%?N$?3lLR#PH3Otg!Tze zXrJJO?gzKxN?!r@1J!(m-fpFBBrM{a?cJpkDyS5B zc+gHfgs+)Qn{2QunV~B=%{R*G>|^ZCKGyE+0Yu{6W>)wEF3)Lm>3+O1K z6yJ}p8p(Pp^86~08&CW?P@)oQ;`TsbflAP>itoX|VwF$|9tu>c#2s|z;Xt)Y&=Zk- zErEKKP$hdTa5SFS7x;HPu|IH3xttz70vx(j>WP3)hai=DD&V(LPX}Bp^$fmfjca)} z;Q8V!*XMDr8wN3|rYiDp0J_@X1%NI#H~`Su1}_41vcXFLDK>Z+AY_Bz0t9XF3IGkJ zt>t(X0RQ6PHKg$MaUA>(fR@Oum%I+(+Tiy9_)w>ORq5LR z$KmU^fwaP)SMu02vbgHoNlyIuQYZ8*T2_Uh?tb3|dNHInJTBtJkV;(aZcvS(wrs9; zxk=TW|K~1`F>20#jmu+96MkRJcdffvH==UJ>)a}xQd=*-aOxg^Y*K|si>^}D$ozi{Hea}ig=pM8rA9DXw=>v%Y8HQ$vCl_zl2uHh2MGFfU+KZ+y`W z=@DC{UUF0XR;=8hV`YhNp>`1!+|Ohe;e;L#)S~vMyk6#n9uPR82Lw)}tFXa|@peLo zG<9Z?ygwcmNFQgVe}VMiLUl12-hV^N?0DkFlp>W-h1{7^q7t+)_3ur=PSOS(4Z09- z$_#1#3T*~eR{YVAl2(bRZHA?`8J6LaG;(wm8~je_4bu6p(K*fki5_)S2|ndf=X7)^ z{}%ymS{gz8Uj?*jRpR@AHm$1fv4A!$<>3z`Ytt&RVDfk;lm%5oit$D-|IMD>2%>n= z=M#`VbeVpmYn%|JLv%WHZW^|PHsg(6!7R1Mu{d~R>mEmNr{3eB_6gpk_c+L%g0}>f z%=Do+zOB1D&coHgJNl_(iU`3yY3le@+$$2iGhH3OLC1HGSI0`{z0=h3{a9rL@6S-j zw6_@ib#7edL4ALdl7F~d@z+Vd1+8~F3NR=OZv%_)rfM-s)uMawP+Y^ORxQ5JwK#`L z{`Vl-pEO)Z8nzn^QjgEhpp=6rq`1iT-eBadVsM`AN1#$lF;`s3&D%G*_f%mG^v1;o- z)yHKHHmT#UN&kmy)G>K<@UI)3P!Xy-aG|O*2)QJF886rnzqm(beE^+tOk4gbeAutL|V_lTnpDI-^yY+y0jBdY8Ql`dL9!1upA*W*;UJ2C zA?hS?87D+W9ax7qdId{WS-S`IlW3IbqPk++Arf4Mid~I^LBF7@ZZlUcP!;PJ9H1-q z7KskxihV|j}f2!PRYi|KhCpcH$Zl`pVVN>dv<6o&JVo6T$`b;?H9a6 zU90?Wo4!^ZU#49}xy^P|?IB#Jt477>^E{~uy@dA>q&=86@O`6LKOZP5cxAi-S3~v( zoKNo)L@!pY$4%G;=|R+iL-d%K^gg;rpMYbX8Kre3*G+y};+aw;S<`$RjtrgEdY*D} zLN$2TTJ2mnB}lOXdY+FZ>V)=?6d6O6+6lE#`dPf`^uRZbX;+14pd0vSoT69oy3k)p zR2fQDAb1ikqRpQ^s>PQ;NL9)S5e)Uj=|O$*rajJoxixy?X&9<2(d59tgGWy_u3iy9 zv&;q_vJh|d@^1;~Ox3ruG%f9;#>9Ot=Vy(HX>{5Q-}I;x-HyYD+-{Uz(PLDS|MDIx z_vZoq+k5DusBe>Y^gza{O(^3h{G+K-X(VTq9>Vb$Dpu%g9OFKb_7`&-VAM!8hqKc9Y;;(?c(`Xk(W%g5i{{>1f|D~Z&1jl2k zXrt*ZRFC8!`d(t35;&?IflN4F{~oiiJgAyV*-9NzA+%RurwdBY>)tBBm$;!;q8pZy zeC~jnZ)jW7n4`X@bLch!C#gTl;j4OeOc~NPkCQZ1UEX^41O4G0-~I3$oq-SPSJHEI zjg=(-v63|1i6@_b7kY4~0%VZK%Z(@kYOP;MuaIJ$`)}#8_?eeTX*~HNMOZC(Ab!mY ziMLZIZ6}lJq(AsL3rDBv_eJ$<5`DxKe?tqdHn&yi!v5|Wve)Eq((%r(G<@Pa`rs5_ z)XhVI#PuLa#Tk$C?_xw@&MOugg&3#Vt%D1DK>umrbfI6eER z>@~+N4~i{nM^4=Dq2$&i$d&pgp)~FVpF^v>$3xvtfomY(%jxJI4=PS#4NCnN^L-ep z_6cV?mDjgDN%eMi!WEWJQ+xIyPt@o9m-M7|?4zPY+|^GZE&h9Y(|4`DpKyZqn9Z^J z5>`t+)|)i2)MLHlQjhhfZ({Wo`+CzCvgVj}njL-hP4?9{^;Tc|o=O?gi~f#^eLqv( zR&<)?X#7k+dH?DD%hjzoNjd&E;Us6Yp3d@9jpFG%KY4BjoyYefNq{qPvwuFmuam}JN!uqxB8{ihk2ZEoXo4(MUrCvUNcDMCIEGCH=W5e&ooK8+n+qe zSMnRcDemRLoxjIH)}M{+XCyn>=pr@L=aatjhj0yPoZ_3K^&KWjI_GzjR5spdq$V3o zr|7RLlG0s2x|KTFbAXDIbc*^D-^$e94M?)DY=Xmzi`%_XX_AxeTd4KpiqVPL`L`m| zvZTwMtAgm*tzy)rx8Y2we>2|asP3I7uB02Q=J-x=dPWjX%uzkQ)ZZQb5w~1*ms!s7 zO>uhmQNy1u6zQkD+P}?elGF3P1pOs+7nN0`gm9!INV^5{osk&1lqmPmQ+lZ$O76~N zo$j-=b*s9v8dS#XuJ6CCn;z(g&{?{YgTP811h%2PTHq6$(gTy~_bMiYcHp$0H&A|Z z1s#tYzH(2M>S@S3A^O6pwbO0};Z8fwC82ny9p{o(J54>!PLq5F6gWu}UFxO!c!HbQ zn@?7Hd!9R7mPgYHFuy)M^ZEyw++JA|I|+ zzNl8ds8+t4SS>9d4;Y2I_ zAquua70lX&OLanY2g_iR?(Y9vXElo=Kk|RvSx@LlxBpP*pq5GV|IkgzP`mjLchfRd zJO7bxdMT%NV*c4pFXd>G;r|ydQ91PU-(=-*vz@~&o%Pi!yIVVJF_pNjbL-8ORLcMV z^*^ydac*&0TKb5zifa4{P}-_!LnHm>(1eL&$B&(mmR?=Gs%A`mL)~)xo>JPRNfRbc zt5`a9{P^g^sZ+;KtC%oh%F-!ID{!!6Qbi;(IWlE@Bs#HTgp+g1xYczHE5=nt8fxll z*VZ+L>Cp(|nyO+AmEr2xlE#VSCXSzoe-p-!LvnR=3H^3cw5gF&i_A~)Ld_ylvnWx` zB1_F8qh`^P=2*4T9ak1c?o%d>Sv4)y_EGo}j zpno!no~40bR&sL7%S*!Za!Skcii^S%!s8{FkO(F^>ZhEzMfAC>;-aD)6dDS$3X98f z+R%cWoRV;6A!?5SKBmxBC9YD8pD<;a!N~!OUdwUgl6Uymgkg)OG+qUG& zH)j-QFH9_ZD~7q1gTwRMk${yE7$|;{;Tv}kYX<{ZUrb-iU_e2@4aZ%2E zbPZ+KydtTY| zI4h^LyezRC?Oek}`|sDFx6CXqoozB9?G!NbX69vOQm0SMiL04ef>Od8GmEmzax)8Z z!nrw_**UU56c-_s&8AAAN)$he3o=Dx$2*n~Et^|XQe4``iY29NzPzG56(i#YZatNa zj#XMLGMZnO7tSipLAxYYh*?C26-JQ;rm1DFDXJ?jYw!KcD zOBll9O=(3&BsJ3ep17`s?I3e5QVf29Ma&J@kABUT?|`l|EUrNt#3 zoX^V5LF;E`W#yEWg-i2h&6pJ9O1z8U*bq<=KOH!g2W;a(=&{Ok`eA8l+&rq?BWtpmsT96 zL85IYr3*SZ(V9&M=T+(2IY;rjt)a7W^9r+d(ZlodGQ%aArEScvWk@g2>*Ae&dXQ=O z%<}TgtlY$!%!Q@ZZ*ZC)D-GkfFdOS?8=cu@v%)hAi|2>u7Ey1<9p%Y=qdYIGASWRs z6{fALWks{dLopFlm1>m(vCA=pRf*Zn4;NAJRWZbpl4U5H&o;Fx zT2^Y8%UHivl4k)lNLbd#>9*Dfv@3(8tPD#~TbfcDO}3q>NS0NQY@HK#ShEIu)}n46^o4$H*nFls1nS4QYj zGmihPrd^T$oP9e*QzJ`pLAbn_#;w9aOdr)6&Z?pweY6aGuLSE1s=c1FsgT3$bIKaiZKWkxcVVW5kc%btF&|RPX>krB;8<&wWG+;ba2}`l(yYuP>Y@wCl44P47j8oC znRb%9UKk^C>mXyF&ns)6n=&L8-_XR8VH~6ppC@m&c0N;vU}qVZDg2e@-u9WI%-N{F zbrt>8GoGgz#f}D6^=$?mD5dU&wXn6UQ48ILWZqYrd~{;%2JhZE@$S<|8(BIj)r+yi+4lH!ZR~5y-+S`3MnOMPFKQaR~w<@J2kq=gY@w3<)N zK&iBfSk|14L0(kdR1Dr$sMmB_Jw!=AZ4R_|su(+4|4D$dK`0PPv-HZPFmHBVc{no{ zr;G9u?XFff`n+DyB?^?~ovFeKY{~m4`Y4=NRyG$io7O2EV{1mu#B5WPA#*fG8J26h zGhw7a&8e=`I%~tMS+?^neHsuFDy@3h+}z>Q$Dw}2yLY2 zqM3!%yt=)^nMMhp%PLUbi@6}89aXce9Md$Eo-)vLHmg&H%W~(IXBW@cUZ^ZJQL8jH zLWG`~nPpjWqFs3k;80yoQ$_7OtfQ?Bu#lvPVr>-ic4Z+J)tI6>^f^DX6h*-S8G&-e zp`K*pAUkKqTx^QsNR1i#3bP3TieRnI>b6jag;=B(Wx-T9t>(^jkX1YvDtRi?tctLS#cy?x4fii}A zW?lS4W`M@WJBb4zL_wz-RefoX3G_s@A+v?1aoHIM6OF z58HetQL`C@5(y#fv(FcTHqx^@?D)bp^!620@ID8Q;uq7Bk`|Mg17)#3)fR0EZTgA{ zkgfI0B9GR6oV$K|r}WH1ODI!@O zn?-F3V$Q2clGo&B>v#(Q$qha1mMc;QQai zGUt}(vWyjCYVZILD#HA-;u1AaN$5P9stNqeQcQp1lDgA}1uZHrE6K?UhiA`K6H8WV zW;i-&`aP$p+f$@z{jw;Gr*NQ9jp6ZA9rRjbHXhv_k&cIV<0NI+-p72oL%F!QI*@FQ z%;EWYFqv-jj`g)VMF;9y#~)R3S*-Y=B+s;7*T$>RiXG&IF$@bd9%)+CIeqAg^mJk;#GL7=ovf)9Z&0hf^cQE!jG<>XEori#bgJM_!_eN8hZeFV^&T zTv7&6l)m6W@1p%fHLAC3`9wL|*jC>QNp)OT9cy@r(WYFjmeD;@^jxV@NXH!#OS1o_ z+UmtpZ9!fkLUDM;LKW`Sq@ZIF-gc7$+8q;G)wD-$aUpGhVXE1tj5Kk8Q)ZT7p*15D zosXYF6mE*uMDZQ6!{7Dl33FzNnh3|gDkQUm@~vyIrVj% zMcblN@kksZlrQP4jx1|*no*jQClVroIy_E@FwzLys`&8}oIlCnlv7b%*BEsgqtO-N zie^}gGpJiiSJUHxl!sk3ACPJI(h)97FdS=-d;G*;C$Q1&`iUsqiXyEUu{ zS2jdqwPa=J#$5@GO-{4=*4&9yIjb9E4&Ae$-Y^-hUDi|uuI^(9$12yL3iNy>w8PS+ zjZs`_ZZOc9kqIYEflw_;=?e1Wm>Qi(qrMqIY2Z3HtU-yWt;~fDYp6lgEdUMCM)&~? zTUFT*ZmL@mt)&t`GS(D}REMh~wUv!kkrjCMQ>3vfyd=^XoiYh$!_BxvJ->>c$Q7=F z`Ehp#Rbq7{#uctdqtuX-BY({M8&Su~O61q*(0BVzRUM2{*AQD4t94pupf%B^s=7)i zwlq=^MT^H^V^m^k9d#5auvC)W&~mH8u%CCEh^}moqQ9COFs$i|I^VQL_iMYrmL8KZj*?>ob>6{`bVjbI}F?KcuGoz23&!GpKIXbLG)>hX=D#Mgz0wA9tG3DTTO6D{) zuA=|w^bM$6P2(~hX5e$W1W>XR^`lFho0d+~ehi1#3n$Z7t({$YDV;_jjn%?F=%EO_ zvBvNcB;hfrd-&{VLtVJGt`;7SyNwV9l?;^(O`}~(Gn6G7silgb3^28>7p~BuP*)DV zM`4D-D4evmDOTI89_>c$*%(9jbLv*3L=jZ67UK+!3#ulS(WOyDJB!rUR7BxYHRxoG zjku%+ACYCMQ#4k!)|m%FvVLo|(O?c7G$E}!h02c#3VV=+DPpxgH_naqjaRY9s(1?jm=BcdBP1*xvSXRbf3OWkKTPNIHiy=YVNHvhU%BiLY2U3W3&;csLI!uK zjnqli8NCsr#}hSAgWs4S-GCm0=vV<0q0{MhrJ_0{h>-|$f##-4JbTfph+?d1j8?#2 z*l2RrOdda7y@l&*^e0IZMSqA!^%2D^eS}edwHowvQV)r6V`l+fF*~O`w>X<6HFN4$ zMAxb}%77B8IO;%UppH}q>L{+Ugubg|jnP&0VRafg<;=r93^=E1LRqV?_;@_d%5*AV zmWJxcT9_TZnmmanVBv@g#SPJlI=U5;PSdrxL8G`dJBMqjO;Z0MQYHw>oK2E%J>^ttVOU5 zhmy2`^h8SpdCX{9OF@N4yXksU+0~(HIAX0+FfCzxj84(`pewKDze)pKQwf?ltsx?> z#DdzUC91KeSzvs*4I82o{9Z$TO{Eu2E%#` zv$Xk$nIj!nEKzfD%_xPi8G)TmvEnALP_4chWb+6 zp%G^FmtL3nIy45BVoN;#8Se_#N>BnZKfmY8aGzMAG4 zYQf1LswfmLF~Zf?!yM>#+Ez{lj7T1@$DepXmqf|?v3=FlP`4Hl-n5C4KmllB)eu>& z+YKAZjL0~8$VNZGv=Y+~eIGU4fTkv-SB;r%;x7icRZbhK232DRb)lU=?zl+T4Fdrp zNqq#fY?_MGlvXXc8rCeWMsVdBm3lNUPe&sdabWG%hKEO1G^xd#8eGVr-0(|cbvwKiDOl4*bf5*Zbav0wLXk5t1YZopk~dDX&jbfXg(TgE3wv9BRN-u zx-K8m^xdkE8me`gSCKkFS5#EtA;Iy;#2a021A0lkQIvrjFf*>ktkxs?27Q_) zW5lnC)S|s`o@NwwWw8l@X9*)u>=iW7s#2{rQPTK4FI-tyYi2bx>xnu`BdhRKXB3r| z=9mG~v{Y4&YyfYLR8vE(4bzgYf@b7(xYJ*iS52}j9a_)Q1*oc?($Y2r&(CA^tESKx zK>k$`X`tCt7~a9ectXXJFq)5s4?PLPysZ)Qgytr_5YijZ3a}Vx&^tI4)}6(v(2-6@HtsG?EZVd*+=ypnqXMg9G?ZfaeTK?1IA6q^&r9}vFDw}I+VBAc z)H{_NZG+U;Aq=uQB=z;YZ_H6wsnv$zy(yP-HvoY^LFQ8e4K3j=A(8QQP>2;;bFF{W2lu%#A zw$HLaTi5r5-9C!V}6 zRbFLX4Ywj~7{y}`w=8wa`p9bh84t;;D%p);1{xJ4>zh>3$p`d`gi4`$o9$qYG1~k= zFvA1g)gX&GV^c#+uWaPW)~X|aG2l*sxzuhEs<#4h!0r^-YEu!9#_(kbrRbRz@F`f5 zp5<{j6iOW|Lmu%4(1gv(2Qhe`gvGFB(%Ot&Oe*B=SgA zFxq-q%MA9GjhylB=+JP0MHaleMkgN>v<)@JiYikB3k-CaDlqQH2hu!$xB*w&!b`ROEx| z*6#)MKx}5wYGt9eXDNp2YS9SWsP{C~_(ST|nbsPqRNQ8&jkWWuinMO{wn;ZmwE_oyRtoR(9-%3 z{;$>I&Sv^7>^wM)bpJANBmT%&mF*EePk#XI-XFaVL+RICk>bDdX_{Tti)5)41lwxUNW~p`r?Zt%~u! zdCeHQauIyF@&AG94*rbx|AFR3sEC6u8C!+kjgnh`$UC-*TCE+V!a63K5I{R)-df+> zG`50-(W%t_DbC=hFK8Z%Be;vP;v#LuMQp`I^tZ{2=dU=6TuhVSL3Aj(J&-Z@fKILrm0vo+f zfg)m$t;eDJ99ZvsZ&!eTa(v;(5VS{hiUD6V3g+&*ueF z@Z+BuJ}$wHC;^Q1rSDO1FzU6>I}w>oB;&i684$8@&`l*)H^Yis_+mmhF%I4}4Y)XP1BYl4(f zpu{^q&l_2QBUB8jlncCJfqeJKxhO)weZ?0%)$8S6>W2|weaF3R9mL!}y7+x+>o_Ig zPDeG|eqVc?H+lV`Du6Qf&+}l;)Y+=R9rx99HhKdB?yr-`4c>!(s%hX+uX})6D**NW zfZG>!b!#b)o_y5Z?S?AB_=R3~_er#4klXsE{lsD&=@2D-1pR$bkPQLTaQ0URg0 z_rq-N=7785+>P!Alou`2TebOT>%JzlJ)VRTxW7X=&~{(p15Novl5WbU&hZaJLj~OD z-ABFTO^d@mGm_xba^<1X|@Z1R$3d&kYBgA;J&V3;nc&^xij>*j_~ zlUZK>+1_xfDf%AHow&*Cf>f$<4hT?pa@<=`1Jvpx=nQW1h81|n1CzMxc6~J9ZaWtZ zi55EG;u95qc-^Da7+;`aUAGqmHk^x^2Hfl1{Qa|LQ-OlHUTPr<4!fcr=&QkfUTBl& zpdk>5b;q8jh7Rqb|X zAb3~6eRD0GI}HtyL@m+9kqZGmXd@m(1OL=f-I1cp@v{wrGPCnf4Vy}O3jyJs6 zI~7S7*>SHwNBPUgNsoGygZH4!Nq(<~``qySq$KZn_tAyU&}%qSyiMt%rnT^@yl4@ExiPf?AFkkN#IdlVTRU*HWsztHP- zk=L1wGJwpJp6m6YM7p~gR}==^f1Qokvdzm^eFx3e3u^ayLs3;^aH8r+o#{eUjEamH zI(#F_m+T(mGG9CVQ7$vC{`jT6VTN>;_wgW>KWX=^1!GALqLUioGEPUf&W5BQWK!p>UY{Tj(2r zj!OO=L{p?(q&%9M;8CwH!p;B`09~aM95&c;u{UtG*AJotbfDdJHlj2d8}$xe=pBcg z9z%@x(!QmLIAoTW2G6)aX}-i8bpaxwYOcpm%!g_;5n3qVK6NI_c8St@64{5EG{xP0 zBAKU~`~I0^uaJ8SuA#6$KwpNA=6-|=Nlh9JTGTCqKMA=1Tubr@d$)|*NcN=OsIGC} zFDHkyAVZ&PPz`T%g?XIO?+dJfDh*?%J<0$UX|s z{Q-mU+OPfiU05-qyr@)NWT`5|#R#JTw|XO8?A`?>h;4@g`R!c(87}vy^i^lfq@eBR z3z#q@IbR)21NAsH5y>&|cB$)cGbqhMqcWMGd zKf#sw!jm-c!msv-*Jq03cX`C?Z;G4MM*QRliua5IKFU<(QEv(7^iP-3f+O*z9|lZ6 zL6rE?j~T|Vu8CJbsqQ4G+wy4Mwmh15 zRGzl>*Ya)cuX$VhYu?uWnz!{U&D;8w=576CIA-7N<@&1*_y*X&J^9~vAit~w`A<5K zUx0$Pr+;b(^7JE)J@wODsfv0%jL#?Vzdb#*9q_w4DChSb$Y0Ze{LPT>Y5A2}PlKJ; zfu8p|sMpWIds=>|*4fZ8p@V#Dm3-Vk)w&zDsz+X&-q*ibCa*(xt1O~-!&GuegV#TR_K44 z^}itW8~&Q5hn|6BUT+9JFY$?YgdW2Wb)YBc*B6o~3+}KK+=>c28q2+r6B* zvFAa~V*ztxPs1yj%XX}{cpB@V4|6QbW7=Al=MZ0O$`fF_d@lHC=Ko-B%4y`k72L=t z@pZEN<~;FHd@X(0esYq}>bb_bkr8 zdaX*eh=*{hm$5mWxXR+T|9s2b*nbL_|1fi7XTz}xp1=NnXo_lY9U#nIv!QfRDlVJ?-VY z*y5&5Nv@>>eyjt2awnx;)yvlNPzOA>bNlk=binWFfPc^dKZU2@WFNacS9QRD(*f_o zOG>FH!{YX;@VXB8haK=yyfh{Kww{$1@1sqn-XHCN;&YjsG7!h(x>{dmN5#nBz-P>yggC{zCz+dAZRF3wd3u?( zhT-36?3~V@hKE=_TW~Y}z*`745( z`R?0-oB8znf|s$Lj|5-J{7b>}IZpi`_*RxbD)_C;U9O+;w*$Zj^KL@Er>hmy zxJxf1Kb$#@qc%T-`B1^leB~s;YgvAb;FmBrer@u-llgQZe}MTJf`821tXGVlBg_kg ze0Lr%=LkNL`Fz34nVWuZ^w%@55c1bBj|u)5^E$ylX5K7#Hy*!DKQsAeF+X3(uV#L+ z;CC~>RB-wYc6wbY_)+H92|k7c^G?BYncpV(Qs#FGejfAt1;2**!-D^c`F_D)V*ZTa ze_?(=aF6FVuL?eh`I~}IX8uRPmofi9@NLXL7JLu$F9d&-`8R^U#oWX#)9zn0H|q(* zd-43tuN7%LRXz`PG6SWq!Tj{dkG5zL|Epo%yRm{$b{S68r#jJbXQ&ecxvOso)Sg#d%-<6HW9IJ(p2F+W4+S5?{E*-?n13nw z&zPJ2F;kw6%>OCm?_^GQFVf4%Kh8WL_y^283vRw7>nZqgyiV>X_)nN0C-?&9!vtT& ze5Bx4Fdr}Y{miEb{tk1q?``V)G4mNhKAGD+SMVXsiv*v{+|0X;{sQJ_3i&AW#e$#1 ze5v49GhZe6Ys}XP{xNg2&t}T=BlFEdzB_M7TqgJk=2r=RI`dx$zJU2I!JC-hF8Ec< z?-Kkj=D!mB73Pl!{x$Q*1@F(Bh|dZ>nfZ%?=P`dx@FmRO61;)=dxCFb{-NNvGe0Ew z@0fon_~*>O6}$^?&izyH;bzm0*F&b=XEF~6zKnSf!Cl^n8X$Nx%clvxp80UWf6jcg z;JcYm6#QZ4(*%Ek`RRhc%RF1~@0sIg9m_ID|&zL_h_)_N23BHo~%YvWF{P%)i#QaZ!-`H2%@ngYvviui<-^2VH!JlA$ zMDVwm9~1nq%+2>2rk{Sxyc6#S818a8dkEf-d0)ZDF&`{=8S@hauVg+_@O8|m2)>** zq|XriK9jeKD^PPf!&ippPllja1I|U!k{C>eRnLjM} zSU7W`4>T?BuXc`w2L#Js=YpEDmO_)Gky&=|pc@s~~~3qG9rbis?5pCR}f z<~f4@l6isPzhOQ{@V_#jFZeO$X9<2XeR+jfh2RUB#{_R;UMKht=FNh)Fh57|gUrtt z{223#1@ARjm-AA=r!v1%@G$f11iy&+PQmYFew*O$GQU&s0Qf>$wr zl(}j5MeP5-6MQb)|Br%Kv-}~!cQ7~KGZ_7MGWYX-yy3rQ-c9hw)3iYc3H~zk5rP}P zog(-K_Rnm=Pdi!bH{Vy7^5il%_wyKD#@u|5VR!@cbwd9Z=JfaB^fK~KFuzvtgUoLi zym73){sF;LCTae(;Qg4tCir;fe-gZy`R9T!Vg66SmopFY_X(z6=P~ai_(tZ#1iy&+ zM8UT+&k+1p=0$?{K1thQk>C%p{BprxWWGl5x0zog_#x(334WCM&4Le@tjlws;G>v7 zCHQk=wEXLWPht6w1fRwHTfyfs_xO7W(=IXQ=KCDO&t^VM$X~{MqTs(^o+0?X%+2>a zM*p+S7YX^-nJ*Xo5c4&HA7g%z;5|4lT_yNQ%x@OFi1~wpU&8TcpWx>+|E=J6rRnxE z-xrzsKEm=J3HjM9{|~{-n49mBjGpDpQ}}xl!&fu!EBLw0hY5ZM^SOd&Fkd40WacXb z-_P}0Be;p%7YhCw%U>b*LFPLJ4{^SC3EqWyi{PV~za;pRtp9Dn|Hb^zg8zm2r-Bb+ z{of1Ti}@-1y^U#?Ma=62uVcPZ@C%r46?_BpYXvvWPY3AU!`d~+%352cP)ay$MVk! z{t5Hf1^vc%*F5E8P2|khMQRedJZ@4?@j8D7HjLj(`8|BMm5J9G1W zpwTmsd7h9TalE$Me8JOMJ}UU>%o_za{(QdR5thGPa5EpnPZg<`Dd%}Cf2ZI(n70VN zllgB1zmxf!g70Vkk>D>f|4Q&zm>(1Tedb;Gdp}eDZnapzp zk1{V4yqGhFuzXlUoqb+_zTP*6Z{?KFAM%D^Y;Zm#{5gc zgX6V5j|ra6+$xm5_~oDa>2Lr{5dN4P0UvbzKQi*Eclho zuNC|j=6eMHHS0V66#UQ3-x2(8%>O3% zx6Hp4Jb5D9H#O1DcXHhBE_i2_KThyL%ts48j`=BqoBi-y!B1oPd4gv$uM~U%^9I3} zFyA0}J@d;1KbQH9f}3&n4#B(e`1^q1*Pfv5_>|x-&(mHN{Ct)---nxclFIu3Cgjb0 z>>I)V&GP1tYK)!~ZpSXY6WezV^8tcKn4ctgE%Ql&uVS7l_<78W1iz5^PX+h09b$s_ zXTDnS5zH?Xd^+e2_&Vn1z5wG77c-wGwI zHo@Ov{tLmw%|2xOA=LI+8%kKp@3?RY)&K7!xOe3;<3GoL8<1I#l7|1I+(!Cz;-NbtWhH}^f6a{kEt93k&N zQP*di;60h&DELt3_XvJ6^Ctw)VE&rmvzdP&_|KSsEqFb1m+#9k^}2|8s^B}ApD6eZ z%%=!`5A#`qKhJ!D;O{Yy3H~|rvjzW=`BuR@bHBSu@cGX!9QU>RB(T~_N#G%59amzX@Z;av_SCAtjFA6W6IN) z`7$AY3G-&bZ(zPj@LkN!{WwPdZst3M{Nv2;7JS=iUEjw9zn=L4!S^zMTktB@|5w5P z!Sde-{v&fA-IRcrDZlytv76wX*?$HLK8X1!!G|%QF8EmHvjjhd`CP#ZnO6uNVZKsu zv!AeD@N-%IQo*lb{!78{W`3{W=KIYj1%H#}UlIIs=AQ`uD*OM}f}3^6F~PU8d}qFI z$h6mG%=-)ebLPVZ-^u)B!FMyy5d2=|vju;c`I&-0!F-wE&of^y_&40IHw*qP%U><{ zG3GZ5ZszCr3ZBCH_X%$1?FR(!%JOdsp2hql!ONKcL-4bh9~C^tJcYlnGwryVd0)ZL zXMU34W}kDa;AWq5mf#Puo^rvTXC4v!P3EGnV ze@O7-S^pmdU&nFpBf*WHe+WL5<&O%U!90b_YuaTV^S**dnGX}(#Ni2o*RXu9;3JuD z6#N2?&szjv%Y296&$FHz1%HM49>IK3{NS{|dq1 zWxLf0{vmU-pJeLw{U~jR9YX#i=GO`SG3&Wa@M$c6zu=k7_X}Rk{D9z#n7=9bQsy5B zUdQ}P!PhYVm*5vL5AwR)*x_>Ky#@aTa})24{9fkcg#44t=LtTE`B{RGVICFSwC_s6 zO+PwU@V|4rY!Te_BePFq%5VD7O+x-%_UF3=H~q9l@b_8%Il+6epZ`wqV&?A)Zu;XV zf^TQ}?*zY>xsUe=OuZgv-bL`=GdKIzM&9(t6NP*#x61^<`!PRF@ZrqM1b>n3bEe== zGhZV3QEtat!IN43Y{9FTZx_6R`89(7l=)7O_LcW># zKEcmpen9Ze%=_^A+vpFl-wqc1dzL>@@V_vhAh;Q)W(c0e`tt;z#C(q6X5aNJ!AG!s zt>6QgpC|Yl<`)VcV}7aN^O;{Kc$oQZf>$zsS@2!V-xl1@{r69Tf5Gy96Z~W52Y7v8 z+Uph8^RD10^Elp*=aokOL*_#TH}lD{f}8o|PXvFH^^^+!AoHsPf0yr9*(vx~zVG5L z!MihW5&R_PFA3h4`6q&(ce0*un01)3!`;k(6!K<1AL6)ZJ_*5V|;kL7Q%ILR*!YWX`XPV&#O{I3N6J@fs7znP}>ykK$Czapgh%N8g7 z#vk4m{C(E{C+5aa7QkQV^|6ru8_Rzw|=iSXEcvLh6lNS&%#Hk?S0>3_GgF3(*SC;9O#|A@s&eqt9bzt7?%Z~W&4iQruNC}B=DP%cmicbM&G_=9#e4EGeY_xe6PNQfi`)AZ?+9+5 zTX)dn_B{NM;O2RJ|FF0{jvN+zGp8N4w}}G=n{}b#W`1J)g}5CD%yS+L53(YfJJHL7 zyltNhMK!nWP;GI$zBgFhuGc<`+i~02lk&C8xt803%4wI!{BA07yF3GU|AV+)p1T>c()av9THFA~;bQUDCWP99goYA-c+Gh*qp}NMKpCDO^!k zOBXomGDRCAwacQ7;aZ|3)d;DkSWOhqt#`&&)Ya5PYjKd66$-T~8m?+;st+%Xp+HL; zBFmIqLOH@v8IDv`L>n7ffi9QM(UcMu*5!ycHbokm!YD$0tae$rz7B6xkcNbdW3@}` zoNzeW&`?_!uCA+yG{x#_TdN1vm31|`cFHJ?jn(1$Xl*5F#05yUsS6}3BK46asK@Gt zSX1< zLaS|%!vrMh%y>F8o@2oO=HqvW3mobb)Kv9AN5*TWIH_q|vt86m zWF-6AE&2*Of7;@f`BQvvul_G{{59j7*48$!YjC2y{1@D=uh?bPpH#~Hw!{m4ETw`ug0(`jg5}^BYHzJk@5%iCN}&(|@! zT7_`1h_AO99ZT7>I`H4ceElJzz|`O11s(WbE>E~kF{u4$J#DTx{#V$6|L5+|Ib6o` zPm`Z4KRr*Tz4m*jo&2dU%KYEO_4wE3_0IJg)${k7lrP;XDzC4PG+>h1IJRPJ-MBQo z#?u?W^s#=QGHH^c6DCX@KVb?TE>2mWQ#jM_i`U5KJlv*zs1yrY;xZWooDAm-NTMv; zJFUyO5^J6vBa(b`QerEnjTr3o9KFHmaYoEpxn;un177q`n_6@3;@^*Uo_xIs|Lc6g zt#|o4Z@tskb?X;hoE^1b#kl6!P-o=^zf)e}I_3FDhkYYfWFWnF@{`k?&Q6bQkY9oS zd;fiG3Z2jIuVp?!hzOw!BRpqEFczCO1bWhX>^$>HH~g04Z0Jd!TaGTiaykBoa6TAY zJ}or3-^pn{rxTq!dd}l}zUkx~IqEt)u$I{yx^%|jPaNlgZ(QHrGkm>1dlLE&xuLxy zd>Kc!96R=4nzNx4>z~w^KjR3Vp>`x#nb8vToH@Ztr)6FHuS&S+0gH9=gAGHIrYvC z|4%oRLdQtw{tHee-6Xqy?AYmxf8`xb)VF`ncc|C5#r{21x86?1k#Ak!NYYE!?Dluw zv8y4jZ`a2DckkNR@9tesBOgom6VSa2x??kEv~2FQp|t7`&h)CsGmeZ{JEZ6OGo7`u znf@04k<6B%?uJsTAC+m>hn=YRTor*m&QEe4SaN(u%dXlkidEs**n@1b`|&<&$!;XS zKE*kb>N=CE9?dusE6tmp(se^AJa0S6rw>iJKDZKm_{Nr@ur1k_+9I_}XzS*#8EfH# z6E}Bt){>sZxPA$)|G-V%`)%_fh#*ot`&+ z$Y5vX`S2ZM6a0?<1Jvf{pbV=~zBMRc5cT_HW6s(kY3`f-!@=v*ubi=Vh%dBaDEywz zg@|p*IPwB~>QgtkHw=Hw=z{*?WgOWHUmTH{w4*8jAA~HPlXryl1aZwmCDbQcC0*osIvnx49oNlJ?NRAL^gkg1$B< z)Zf?g{p~X-GHj>za2n1pCEFiFdsBOT2b)nFq0aF6KH4wPz8S9b0F{l(8M-jz$Vjvy z?)}?wJU;jMog=+3bdEeUz-bBPWVUdB8HxOQgmQc>%{aezG}k#ry0 z9_Q12y6x%QFOD7SOJ&gc_ipWTwqLD>E~?Wg_|IJQW-x)`;uMA4&<95lwtR#@L`G_^#2TB@H2$l@^6c0 z!q0N{91ds0@5nc2?13NdAb+H5$-m&w4}5ZLXK4sNM(GfIE0{f_h5S62?QbDjBNu9! zw>G$c-dgBiK|V)v2+u0^k$%llIys zv(tZWn}dj>)IRIa^Bs8t{zLsD=prV-=a0Y!htapbqyBYy#^KHIorA~^F=*tkA&cL+ zKeGO3os@6v9zLUGi04c|UCWK{Ygxo~=qG!H;BV=!ZLd&5-`mYG=B6XZ5My+`FhBU} zV6UBL9)SN-A3KD$qCU0ZT>z%y=IoJMgUDxy&%Yuc zG2>G=W#rti&i(zU5cT)oTSpAeXgP>6=tKBK#24C1^``g~#5uZd=koMvCQWsscAyw6 z$0#cA_w#)im-JXp<^9Ae?>DZ0B%ZG`>09*OgP6B`2YVkvS<<_tZ|wxVL6rMJf2U6H z$;nUnd#yP1>z!w!9_63(LKV;VX{VVVc#PVF&z7Oh~BnR{p) zHf=|3PwjR9{W^v6!dOoEWgtIpuf6nX&(TyYL|k$s1uesFo6)k~Nm{W4?eh)lj3sO8 z2RNqwPyL?y{K@#Q{mn@wj`FERQ%hd#glV~8h^>=soguW5Dl>HFre;jrj5Z?wH)SKc-6U-F8v15?HX{4INHOI} zjQf~-~!q=)o&R&J*BBHtWpch$aF574>Ld(NC8{V^w>py%Y$mxJjU zEi^ZsggQ{48xn#n?27of@=5q;FyKty`ExMX*B5Zg7msvWzC=53ej0jFjx87Y=3oz} zd?fM;BOe#Xmjrxs!YC89N!1{v|K!ZUnxR+9pu5 zj%%nbQ++8Tr$F~4^t<)Qvub!o%aAV4%3u$yiQwlWur9j<+b*MGRnziAowjE9hP;Kp zZ*ADs3-jfs z@vNsg>G08!@U7igA7GEDeEnO_bS1x}pk+6%fuFRHUk`!Ye)taZ?KxyW?DoU4@*yqG z%BMWU8kD_ixYP2WeIA_7NAOw2=kKQT{y`H}I~;XZX5t*>rSj=AW6c?;a~Ar>UgS;V zOacDqhnzWgF6q>QF@gHQoKdI2#_+AZ%*cQ5#C&5#-tuWwpY2mWuVAC{5MtTByInKPi%|4znq7iAcVF(-rNsqR5sLo#wqB7H#~LruIs_Kbsd zD$fD364$0dtSt^DJ4Zg~g>eIUrK0?ymA*ODFE+z(kq_3fIu>-o9*Btr%g@}f*2D=~ z8;wHD9*zBx6^K7$u!plg=B&IEdpIv+52pxwIJ2==GY+0;N z2it*b@Y`1_cOjNgU)+ZDPT!~%X?>mY&#{Mt=dSj++t(e}bl-Xx_HgL@HtgY$j1Tkf z{Btv|gq?ScLjLQqhm(&zoaNYG*qgFu%8FC+rmskGCfCDWBL*R#^U+t~-&_1aHGkOB zRk!Vd&d#LJiKzF9&dL{Xp4OImLk|r2bn%ALGkht_BVZICk4L;phn^wOWBCJK#S_c6s^;4`P$(Cft&oF;Y zNm(PMTP^Z&5- zCh&0;NB(%fdGlsQr{zOfGCpK5U>n~U9|W*uNw!A!Y`~Z! zI44N}IoJMy#R;(Cupk?Ukc0psWXUFMmh9qy!Ny=4+nfvW|6A4F@4Y#Mo!|cU^V#3$ zvjcvwtGc?nx~jUmy5E}-d>&^E^4w`$wz%rPAvAx*od-=ZnbyC|4^Jhmf9-!Np1*&1 z@q9Wbr1KE1+x_qjig`QUKXoykuaTZlVLp)!H2;0sAI;r|ocTU=4o2fz4H=%t+2Vuv zcOmpSCDJkPR_Jh@k(ot0pZxZgx!*^unlwbrUSOe5$hQFN5c$$hj6c&OE~eN)a*<5m z`QTJD&Z{rpJ5QoHi$2?DiM`)J+~e`Td+OqL(}-`y$U?JpN)G1Q2_7U@hTwg>r6J?A5VUAXc)? z{qme;k~(WC!I)^@@!2&cIA0NbzH$rZ>dsv3i;8zQ2KShgBGCIzPsXi5>_dXcp?Bs^ zx-~d;;XLf2FE)718~#9r!Ec{^b>E>=a}L0kK_h$DMBvC~B=?SWS$kgtekc5U=ZRAn z@1`<*d@{=SpiE;G>!RNh%dZU6=kHppV`2l&@(aAX5WDx{C7&kFnE_`2ju_o@GjZ;c zh4pNbF>F>g_VO79)^6;{E2d_DJEIrzeS-K{^oozET?X1sM7wrR_Z;1h+T?5=I&7-D z-R-qFi=wjtadZZG=?`{PGV=sRNq_|h2{coW}KrSfd_eVmP+tn((Ei9&8Z z3q6H(2lHfaATK!o*$ZdP4U`3C9^W9Ys+c3^BKl0pL)%BmvEDMOd+zEv!TF)t$m`A( z&6A9=vk=cl(3;%xm@%K^)U=Z}j~PaKsDN+7PbAGidYX37oYH*$DLu^&(2)JMd}6{6 zGv-eRPuabZb;iz7l+#iB`_T3k$hHnTsDj-lUF&U{ zSRjT?GR6#Bzj^eq^`IN~nQ>JWXp2W+&HC85>IU4~|5`f#zQTgJ&!RonH>?ZAUncnv z0S^3m)5{bW+GpX6d{o(d%2ADB^Ek(xIJ)BHNwl8K5+6q}&i54^t)uwoZFn5P%YvZk`XTNwPy*(#_rccuh<~yL-tZ4@G9nes& z!F>(lJ2XDh-7TOcosth794;Qc9PP-5GGW)}tnRt(>x%cTUx@s(MC@8%WF7ts@}o>6 zZ|=HJO6OyrG8AX|UtW*4>pVE?dbnhMiD6W(8;f-gb?xiK-jc|qdDIu+_ef9sC{DkK zd76XsGw{BD6wT+r;UeI1csxSS$8~tVupT)b#eu1a19+Uw@gs=%F%fZKM}~YRfR`%x z+;$@30G(Mb0uMSrqPwATi&-=#_};Tt!Q23BHVH7EM@(J^dG5!$JP~nj3v@skAv2W%p{m%Gtu&VQR6KF z9pNW~7P%kJyl{4VzWDfJ;AsqQ`CEsHX8b1QuAgzA!ykAZyr^via!rO0RBg^3b|K{2 z>OoF7eCytEhIsFtk^Q3{^kiq=mM7-!#`?Mg|90kd&n266z-H?a^K)P~YDY0YI5X$l zlM(aRL57PE^IJ$RteXLhnbu07*1zOu4f~O|ovbUn|9$<8p;SI&n4H-?XT9p{$f<8M z{_xaKW7J=*k(;>=eN98ZLHNk81M=LsIDoT4tQA4ERuohJun~>hP~#53MzjYZpClb% zF7RHMV+7`N0DFiY)b)RWy&+;GwO{4&?D`ANM-8+ko%MWxIIQeRJ~7ECWSdeQ*=P&q z!!NO(Qri~t4b`r_7SG$tkvn0npmvnM(X$w8carP{dh%(vj3nQ)?;+QL&k}F)Tbe^y z3r9v^gGt}P89nxjs}9lm`nbvW5gxt}RKCzZR-K<9r>nwxa0t1_f(XuY;lJdwSOu6_kTECeEh*O6X(QOs}uH!9z4GkI2Shf*$&w$@PdpX5g{Jk zf$?TwygQ)NorpE-k^fCH0#(>69}dpEWz-hj*WpfU8uHy{I@5~62X290Z-s5Y1A6>D z?}o`Zw=ITEvix~-Z%2H);}K)m1Bh?WVZVUCTRn8WC5AniA%?z{N$GmsW7W01-?40-F^`548$BFsVEHV4HpgDy#xD|eL?EULs9_le}ojFY4 zPvQ+dybycG0QP|a>|X*6h_NDY_`8TH2Ql7581HnWc>as9QJpcQatLy^>Dc2$scfN~ zQ9S=kRL&6dXXF&mpFULVy5GpF%)>n+N6bHH=7GnM2ljt<3NdoX0|et8xDg+kXTiTl zK0r1a519I){+{=Vn803Y3i{lFJ}ZsvN<7z?zY6~GwwW~<@&0$%+rGCN^NI3@qnJ}i z@NA&M$bKF=*>wo}U$nXPdEBe>i|0+nKZ^Ue899|5`C?uRp4IGtUa9|paaI=UhV8)G zaUb*_Fh<^bpGSO5HoS$_3)D|CMn1m-zIF@ZH0AW5dA=Pq>2hT{1AGm9DPDZAtQ5XP z&n1yJtC(>VG9A0>+An8(aQ(~0IYw;@{`KJ>_VZN%fxRRCeGl+^(9s0(AJsD#iudwH zPw1LC`n;~j(dT!?M_hKKQ-@TxJ)B;cL;pwP<59NNed&n4?N%&Jn?%^Z2lOA7s-#>Q`V%P1sZ@B^bg^#|A z{ck>O(|PEcFCRf4Q_97z7x8Zh{v9)O9@ux|mOXv9Z`qUA2mRiFI{Xu(&*>UJ`rNM9 zZd|bEDB%4#58MJ-R-MG%y6*T^*s=S)>%NS?wZ7{$lG{`K$aI`%!ZDE>^! z&|7iN@qE!u#h;G9vG~(HEek|f znb>fX5xva_9N+&YI`;1rfsaleIC6r-8W0%=KAxE=W@U;?LPlUfWDba|<3~>(ef{V= z10wtN*AE;+lboYRUPtG-Cy!0{i&=Rh@bC|3`o)a1&A@IkWY38MCr=(a@)mgIwdRQ4 z2gTa!jE?J#!0QK~fOswxaEV_`T_FNu=!reAA3bvN_|bRv#4!2_jQ73w51cr;=imX1 z?l?FMdvi}`j_4{9v3rf)?-~J8(j7+NjYDr9I`GDx6Ngxi;YW`g*z@lGldm5f5F^4l zqGN<;JuG7HiNKN9kG=s>21Ne;BX7OG|1Ai8Rtpq-uMv3b-Teb%H&;h1M6I21Yo3C4b*<%_yArbE5ZP|qw&Y35zlGK5uGChe(XFx zN(A0#VNQN5&OLzA8)Cx#lLy6l_>0j!V0-Yuy9dPi`%k`qLR@fg|8Z!1Kup9C4?ty; z-g)QfhkGy(_KeBs|3V-J#FRrPjvYO5NDgkQt(j?BG1FgH1D`>R2E@!Bzu1%^0{fx9 zS;ruI1iH{KNgn-vHxFKl*qoT>eS)3>~0f{PnrOk&}l&4XG}340QQ{6VUyF z;~(#VACpdtKcH&~40@DpxA6F(*H7*_d3^s7jQsdXIOgl`A3t>R;{j0$cMESv4@XYC zdEoe-1GYBG0KrX;V3_4FAr1LB=oi6P7JvBR9+C)^N|p)?UIb5y%6AT&JRqtL?b(0) ztrMbJ)Q~r?!L&HA|D8RDjtz*~-J(v84^E4bih9wo|BcWDS0dKL!ePOe^Wv8j z(N`Vt4Ui)G-b$nuUPL7A_!0-cT*F_e2*twq-isjG^SUo7DlMt4t!pkSD{n3-ttg6Z z>W;=QIj?OBN*&=YE^UlQre5CO77NjfiuC0Yd{d^oBis{iE4r-cytXtww1x3Ck#^D8 z(p7{nM-)ZZ6iES!==&W-@$MFqiv&Pt;4r1ABhne^v3UU-igblmM|->4;-V%R3m2jL zBKqb{yr>6X3@X|f#yGo*+VG8xB79e*eM(VVEZR-qrO6a!z1Zi^>(fAif-(}NW!f}8}RNX zzL&$&uby)ejTV|)+tXgu*&FXES{*LBIvhi^F6rqBcXpFlQ8b}%H5Fxw+9(^0zVSqT zcDHQqh_?RGmh;wKD z7-Ge4ReVt0fl?*=HW=gCc9VKtoTpG;al)wY*HFDfsEa!i2o+%82I~>ejQC@S23^Ef zQ=wXQch@>7RkCl%jB!}ZAI;4W%O@(7<_46)*tcXZx!trVXH1`6-XWFw)#F8 zZ%4v zAIBe{PRB*d;0*G#9cz}eRRLzuMLMOY4^%}D2uRgf1d(gQTH>L?XN0Q zN19eGjsE&Hw5o{gTe36tegA;u)cVZX1aSrGc$B5>ro=?OU?k�Q0)cp)rK|L;QJdgO2&0ZIhyIHQ3 z+h!}dT^GA;6t?QJz2=PJYlixs%vf{L9%Tre%_V-4n+WA}*|zho(8UopYPl{>v{C=} z^QB@XD5jDwYCk%&X{-lYU^8meMV&mDV)K@M9UNvTIv}q70kg6N|HMH9y)NS=WSwR|qt=*(a z7d1EH-IRtmzBrTk8H~5%BF%b=RH&B3yZN+EnWv~VqcbwS*7>EXu{{Nf6=G#_g@Wzd zVB^u8;S;*}kZOcA>nT;#(HT@WM^zY%v37B|i7q;f>r)vwoGIf8iqH^^y67-&O=W!A z#ZGsub!dpD9SZk-b(e0F%KMDnM(ft4=4yK!ZCV0-Pu6Lksz?YI8gTfWHh0lYE>-++ zPIqPzM7y}7=+pM4wRx@G*WVbmi&R6XOc%Ai$sG0ix7b6y7*cGp@vR6gu3`q0-=VST)AEs z^`_@<8-v!hYdz3X6QhQH4ZUNF)}V`87)hw1PaQ&Cbc@z-+8C?ai+MJqMqSjxP>+qa zXxOLo2Qft#-90v*w#Tiir@Pc0c6v<}wHbiY1Jnu!N)g$&!F=#V!-Xx)hwks^8c|sMRbx?YkqwQffl%=_SBv~s?0D`&Y@&a)0GbvVnl z=oPj^%j;FK*+HcWx%_lSouLRE*Jw+14LuT@S+Z+r0@p0j#dlOALtLrHh1dM}1C-5C z6$WFxTh$xl3LW)NIw)1LZ^>LHDmT^cN^aDl^sP-nIBkm;R2|`T`S&(%X1^}KYU5`0 z>+%~m?xKEO)~hJKBG9kPCvCcm`*rzK8#kw4m%X+F&+XS`J$pQ2UcWBiX4B2+->1q` zlxxs9bXof}wN3UHqO+B#3dy?cP%>)0;Sq$MiCP4TTS@|FMy}8;)cRn@Hz*lVnuQ;7Dbd&9>$r+y^-K84b=N3Q%Po22{y2*pK z0N0$^7F3TcTNR)*UCdJ`x#Vg>eNXm>DXQX9bw`vdR>fuqrAqcKnTxJ)xY&Ef`|OC@ z`id%EOFzDc&lw!Ejh2*Rlkyvc@*k_B*H&{wwkqmL0;(qz>IH}D6;*uIK^;@YlMc$O zgw#KF2wqAC`<6WV393dnVRsyjZwSyQPYw2rPPR0s2bB=qNULqRo0A4s*}AOPMZ9pt zA8xDxN9U)_K(r99;rRMBaJOyFHZ7MPDKbS}d{zw}BKZ0>@R34-P8VIu@%3xK5w%SY z#JMJG{#E4*@7V6KA~l?>&?X&W%YNF222Ux5I_kkyQ@OM{g2_^{czRWKlvbarw0b@6 zOC3|5j&UlNR?TI!&E>S>=^rZ1vkh~_2vyXE#Dbm5__T3Vi|MgDAbunC(UTK z!$=qF)j|euYE#7*Y%e&i<7mb@{9%^sVzbRStc$t>nO3gyxX#50KaGlmV z<7iD~d|DH3R}4qnyR`;goM59?=;9QG!ht zx;Wcb+a{x51H}%~)31SM2Wj?eK%3VPt8~$^bbYF&>$RotR@@+pE;^QmD8Ef%9LkZX*7tsuwJ_1e-pO~oU3qd(QsKx!50d$KCOsw#f0?z~WH;8_Q0^lRWH2kGh8 zz$*^Y?AO4nHuCx{{Tk4QLPy?y4J@}+@OQ}yWjd|W-L_uv^i%^{kDzpvr8UIOHK1LL zDV1>c%@}H&mpj}tbMr=?ojcT6g0Jd$W(zYnIDA3jC0Sp{@)Y2gq75TB96t;?UId5F z#R_Vjj{<(=dIIP!&&tA=x&2hk%DNoIfNYJnpv>SVz-D^Ef=DDjYa-}J4-q1p@Qejf zj*AFj?pf%@%q1!C7mGkF@}@!DVZP#mZ!9dF2?>T;!ZVTz!?L&nKWaN$VMg52XNZ}@ zheCDvC>pYO)=pqO1-lkvR3oPu%-p)5FgX0u!Ucu+^A{EmtZ)e5Mk#`<3s6}E8P2vK zHHkx`A3Yq+vn)BDF*&FS4kut92*{plh?TaI2SuskT#g(XkD9Su7i>^^I$%FnM&FZ<{{%;;()>7g!n?5L6BGD*PtPH zfg|c=nNn_xPB(BVYv{h;Pl4Gp4O~njq>>)E)Yg>-Ny0mPB zsJF!E92!%DBdqLQWG&FY6dZsYn82a@Ct(m0~9JKbZK8_wzNt*9^X9@|EH*^v~BEzUK0E2w(H~ zI+U-&_&S`gBlw!n*R%LKlCK4PE#&JczMjq3(R>}l*RgyZ$5)zZLX79@Iea~ruM_xs z9$(Mr>jiwB$k$1Hoy=GHHx{RGc`9G0@pU?1XYh3aQ$Lf~%JvnLqN6X7T@xN10PQk^jjS9X7`C7@>D!x|p zwT7>?e68cFoPiBoZscndU+Gt%gjmAYrF^ADUWnymb(TvLp7$l; zf4e5!edfyOnWj%S)$D|&okt}xX)*_{J@c3>H8q}Fox|7v(sJmM+WeE0qEB`q^}a&_ zr?t`q7DZWU>kJ9Wwp)uOr0uE=t1YV=ZIzvD-Kv_|?d*njOS|b-cfw|N%W&Jq{XHwa z;{|zpQQr1QGyG8Aek5-X$=jXMIJ@NS%kuUWc~iO6*Ch0HdHaUE-6e0|l(%om+qdQI zZh5;$-tLvRetFw1Z{Lx(lk)byynP^VAIjTD^7gUmvX98Oc@!M!^9=qO(XP4JfD?GNF5HL$|5+Tu z3Oe*MI_XcjFjclLj6?yyqar`uxM6>Rzx)a;{+57i8@UGE_p4Xg4xFhx@{&s_* z(W6jxxxZUNzXi^-z`sdCtdwH^Ru@#_-{FE5`tOub(>Z9j$bXlFo+B=c{kvV1i~aYx zpbGy(F3O<)2?>$eJ+=OQE~w7`tb~35XYw@oUvfcB{#PV)D_P}A|7#LjOtP%>ACu7Y zIG6W?{6ZS(8$`LvACM4_uf?C202N5+dqmmgFOm=&BJQ6cAvRf$f1(TO^-qxyt-qcP z{uwT4qkpyw+T@=nA?A6t|58`owfHzg*#% z;cGzn-H3i5d~U>UAS^fHJ3x5di0=Ynx)JvQ;c+AW!SD5su5fkxFeuJeh~JVkJ_^Jr zH{vlM3M-`hM2KRqzfwYU?Be++f3<`-Qtb2BNQlCy=V$&}7xc8h&ISG4U+;pR@i(}j zU-%nc&@cT>F6dYOW*79Ve~AnFwSTFESeEDf%UpFY`Ioz(m;Ea|qKM`|yWu%shOfsc zd|lv|k=loq!gHYl{*izwI9lR>hZZX=4tN~fue4mTeWfL1JI9ePS~9jjKtUyB$=J?w zuEi>11{@kzTlgtbd`d=utks&~0BzPh2AZiRY!x$rvtHq8w<fs zt5`yRAgI$SlMr+7vMO9q)T(zu-PUp!bd|Nr5QSvn!XH6=9(d6RPmvt>*(A_-OGf&M z1e~K~;Hq=+`&KL;Llf}JOb&FOC5AIZzx3)k-x4Dn=mINmgfPi>_-s!YZXizre3F+Z z#@C=Zear(Mm0^rurBT!J3&SWQMB{J4nPc)2PFh zPop=!MY}Hy1xq*k>z$0$p zAKk!@-N2)6;4xuRYRQA&>T=>@ImmgQ3ti!4sym!abBB}Z?r<{G9ZoJ%;p7+%Wwtee zJ3kBO>Yj_$h##Z~HpiO6H5`KGszAddo^Q=|1ir+&m;ny&U$Ew=l-|QJAkXmZ@o_ar z$RGLSbmCn0A)gFa%>Q9uF_UqKd&F1a0RQN#XMhviAN!Uw@ERp$kNQ?IzziPqwKL$Q z)bVj&2LpKo?Dcgszydz$`^*8J^8M8Te&RdDk%h_r$){o@LqGKyGS)HlGoQx=J?%4H z(9eBHhRB1N@)@6HI7{{~Q8xt16IHXwzXBrHjd&IaJe71PehmbkSvrX4fXH$qo(BR? zI~|G_fXHwoegj0njd&3VEYePs-vWXE9mGq3EH~nJKzQAVe+I&IBVGo=<3{`*2*Zu| z7a)Wi@dqHr1zg?!5s0yPzEem}mirktGW79%k>j-$FiEF8E4;!f-!2Nr!^-S!FL^v4 znQT$H3o@m*G4P2g0{{d6Y03aVVbJrbDFXn-Vb5n~5i?-Gy>9oW9 zgiD@I?^6=uC>izcb3xtSr(Muh-e+7;%==3h6!$(WAx@HeywACyUhfMM;>2{L_eE^r zbKryQ{Dxcxx;=%`)lZUhj!~}8;d8ulbq3B+uFk-@%GKH5CM#FxwDdxABD*@1O)+OM zz^0jM$}r6})6HV8p<@tFxhcamXRlSJ4AbY+^r$msm}Z}7FjsLK-k>&`Z49vPnoSwA zIan?+*KrL4OU?D7@MFOI0$ad8?mP+wB#*yHaG4nR$9tXfIX+|p=$w`0aphS*^>B7o z?^z)g#tZ!wN?{6+v4KZ*rBavzWNc7?j13Bq3R8eom;$827+C36*h;fP6p|hbe-AWF6i&gCnSVddW7eGbDxB6rpWl9`K*N4H-BipBq5gUA@dapu|GX*zUqP= zHD7a4K4!k*f*v;yx}Yb_cU;h3^Oy@7Fi*OmC(Vys&{O88F6e1f$hpaq{oM4rLeVp{ zBnDiFUjZ@Jjd&J_F#*Yd9sM~o!v#HW;!j%ehDK$7g`dHqmIq;;eYoAcHj^g_8QQ!q zQ!v08@s>>K!wlSzDc3g!wq;5mX5hw5>BD44b4RB1VFqr?ls?SB9huUHX^`fw%wq0` zfv;qiF+ip;zm{16OUiV{yo>UXY6t!%;IS_FTY$$@b7LC1d3R=w1Kg8Y%K!`6pDAMr z9h#XBWMb#yMajy*h1F1Gwn{aytoWHhZpuK|t%fyjHLT4n5GFa73J`_MiRTwJ&w1t{ znW(Y^Z>vQ0X;ho<`lMR{|dNF6EJXp5toCQeu00O$mLop@0r16GI!ud^SFHBM3f&c z<}xK_fq$%UXdbP1%8xg5xti$r!f-!<0M^sEey!{Vt;at2EUk zR2GJu1^-Nd$B?t&F9diEISW1_z-Lsj&*hN50)}+gu>@oq%eiJ60oleX1boORjZMeC zqVOeLbN`Ks_yiVlVMpL8M;kwtV_`e~Opb+Z@r=ukzjWF0SveL8xPj*;G9R}43(}6a zUI6@y(vFW)`FF)kbA-w-S2+Fti?k!#`j5*U{J*Yp%71F(GW)=*?ObMC|9iJX^I8v= zJ4jJ~*~DdX=D>liqVP8Wb6;T`FhL%CK_JEm9wdGrmGr_6xOph3|X;1*@1^Rq0kscm@^)hEP&3#4SXMH}M#_mw@4hob3+~ zkZ;J@{%Zn88U>>84wR%dNyGxWh{EsTdVwncD3Rb9qN0(B!fLv_m{2VW{~d7dAzbJa zkiV&t7ie|H6qaMkBx|k3n1-NWjld;$94_37A{lxKjFMxjCsMri%VP=?FjkG}DgufO zsB#HPav1;00+IlQ>wvtVfDoc^Ln47QjNGrIhCYEy*Z_gRHphB5N@3ZOH+x0y)0*}& zMSCsNz7BNYdKWFe7?=CLNAmU76rMnR?q7A=V&x?}xh=ciZL%$w?~q=?9&;y#HUoaA zh6c446ay56<+xG-!_QsD1r+O;u{ZD)X8>OV?NzA1pr8*|Hk`8F&44YMyM?>BUQXtF zPJ}wPx~a`eh%?@++Xnzl;lg%v*f2Q_5xwC;=?sl`zAr z`jeWJE1`is82(51S-8obJuk|vnfK8zsjQjz_P^5`eT>QT&n9{0#a(G+*pxKk0o#JrJIJ zA;xsT<7L*oIm98W1H9$&i(DEEeS9~WM4^~+S)P&yL@sTfn5NT7Hphx-5{VHZAHlP9 ze2lB7You{CS;z&FGUzcne~fEs8#$B8#&zaYcg^**L!CvB!}Vu2QQhdd$O!YZ@%-W` zx<&~3=>06C!3c`{<%t#MjUVCs-~FIIzblc#m?>u8kbr9NYzOm;sRQ!|L!_7G_~B(F zzL-P!jEi~dM5tXM73UJx{7lY6^5A*$O#t)kY-&}&PD`VbOy(20@k8}&|A(X|sfdUF z87yV-A<~H~K0^B>>BiaSVQFP{6MWU1ZOLBtuCg)%M?47pn>h2d#cfWG_ zc$WK+)Wu{OMO{oJ@*RX?@+>LQLZT2~Al~%(Dgv?5NhRY|>dCSBtBEeawU>In6kyud zoYDRVb>sNPzmvjbSNn}(*_}aVl9Po?eA!82 z6_S<9^q?vB8Bv0ac}BTGZ@y58x^Z63Av+n-KcO`%^eq(FCMSsBBK#A^LW6oR7At_- zS8%z^VBZWfu!4!C`>t?2c?FSFO8>fY2D@D$p{l46edtSF%AteYQMJSa8)RACF!fQR zeY)15;nv#ZRR+1T6s^V}5uCbe7S)044O)*JxXz$SnGDOh@b5`;;SWZFW3Pk&Mw3Ai zGmTp>Al2#*eOJY3G5jD+RP+L8LJDy$QN3n(O6ff*%&>&Fq^Ob&#BWJ`ZoqAV^TFj2 zc9UbZ=S%R)^z$Q~zY-gliziPXG)av6?nOYqt!3Mr+*5hwTS@kQi|t)*G=M}HZy9@$ za5&bN)Q*V`acjqu=P~027b#D!M&Tl(VL5KBuQpxiM!|8vhp1I2F2cz1kb5~D=6J}} z-7q~GbHj=Bxt>IUbD5tba9$ETlwmc=K566Up+Ya`?7hfA0)r zO42~4Bn@PWCvhOj^iz2tj^NXi1fRk10#dd9@PaViGlYYPRDIJRs&_0lg+z|-!ivt# z?nMC>djPkR$8d27dx)^}Zloqmcs~khl8ZDbrQD?~u!>+ySsRWAjBpaF&LqWkCMm8n z$-A84(35?~uupn^1cnYg;Gxj$z)yK7OO+YGI#b>|)xFzX zND|Y>cv+2`C3nz&^kg~%TA-<^1zY|(4+3FZQkz#imeVHxkDLQi3tFk&Yj|P}y%9?F zdDBEvoBz`qA?jqeLL5XvDfsJ23jTVMg1_!*0I{5)cX=q=cbwx}9v_d4y!VXUcUC$o zAy?aRuGN;ya^W3EPiK|yRProWzEjD9%7{|QUMz*I<^egAfqp_vjdiP;7~Zy;iQ#ao zNn>@KWt&OMuLJj)iO#g$Omwzn_(tweF1gpir{zb&T}iP19?tRL@0!NDAQdOBB6b(z^Be**6{WLNeU&dmFYDe^a{DNL1imFG*|w7f?YyBMWJ zG`Q;^ld?#?tZhD*OD-i-S8@iK*76+B%;zeKr;azWR-(WNW4kxe8@GEC^H{n1pMZcD z8TFsyRuZ5+lO1E16O-sKWc`a&|0XWOiT9sSkiY9=eABDu%Qu<5oFjL8DL0hmZ+lJT zm5O?&rrznIzD-it;dv|evuZ{?o-~HXxmh*IKp*3AFU=@BzkSks03p|zPy^h2aCmRp zdO3mi__zyPB%F_VE-FC-n($M}`k%K?qFX)BV|sydluHBXL4>O zJ+q=6q$vCcRLgTcnmNhOwU}lkY0}dy*)bI}<_BL?QYS6f=Q$E^{4kr10zN}!F1G6j z&_bp9kNW7i&~f!geLQ__Qu_HEHA{Z#Bkm6APnpyW(>bUE@AG9W;90{l-gw$aZ<#r> z4-?ox3XPFLI<;P3dBdERR6!9 z|JA_%YT*A34b)ZCH5E;qRMgthf9q`6bggMq}%zx3|PP zqg|WvryJ=n4^HoCkHp$S9g)@XS<`3Dn1%mm&X^8xV|aBu+PXg66DMdo{gujaY$g3= zN&FebX{}(llGv?GWVh1AZlz|oa&>Q{gZprph9Je9*;6;nYY`pcP5k#RMQ>L;vbGC< zGO-m*MJQC#*jTb6)D*m;Jk-3RzC08X^6x~(9m+^okEmYO)YufNtqYZuHV2oMhZ;+2 z7ndvS!WGTsO`-Az1uhCUHZ`kqQ*%jUbFg-?0?TX59H6wWroOtoxx7r%uBdG;SuSEQ zM>rJ6ADRruMMZOSeQ0TUV^grMHZ(IdBN;I>5iv`&_w;m!lrd#pXYCFcxdMMg6Mr_er(KT@oS`_)8Aaw?U*1?+UdwEfP@#&Mf_Q}Et(pbw5-KgJu3lJD zS`{jXx))Xln<}JEor==xAUK9xswi)4tZO92rw}a)RyUV7hUy#39e!yEKc_dSnXT$( zPPh=+Gm%+id1*PRK0y?P4As|3*KzaVk)&;KbcwC&ZlsMsQKEw1g&oVoz$ACH0UJ-dIvw)>KhaRUWD+ zFDWZeo)2}k2xT=i2n>nhM_pA(lChnMl|`i5rWTin zYU;|$(-TzJA^Z@}#GaPa4pN~l4$o|cenXAr4NHQJ2zT|3!KD~vsH!|g0ipVGOixlA zyQhlg32_7AjJTDRFDhA5o$O_$i-U>M0TDu|s|nVox;xc1HDk33m6bG?q_&fF2}_t` zN>^mmewi9Rcrhv)yk3Vf+|SD!Q%8y%uWBDIso z<%3k%-3(IC(xs`Rc%7=~(u!bpnG`*=G*}XyM&d+LcJ zSprS-pJQ*u-)N^l`Hert-V%>?;cuKbEeC`pQrbf41 zTKhJo$^vMSaA_aasoDq9Js5z=gHaS@OD(15V(lY4tLTJ93L9r83|s8YhS0r8q535+BYuKA%lm zlF#oxjcB~G)K!I=>uBAou15OEdpOq+f9aA<)i!f&6H?Cfm1T7>RAMEJt5Q?2#ju;@ zVxxpwRK29B0{IYcr<3YH0zCFw^(8Af30LcsYFb)SOH*_?X)EwEQTZ^MF1jzVAy<=G-I($ zYAt&WmDiSn2iE-b)z#R&EGbD)Axl@^ShBdLB)L&3QWe^o*J2mu)|VX6lI9B7>yd(!2X9FoH`K7Yi zLusW$Ty=Y@yOtG_)*Z1MQC7t99_5qihn&VSm^^iS(o$u?CIkhflnDw|Dv%_D`J*=W zU=C^5*QvvcB!%euv`$doT#_;Y%9q#U>@#^Jz|v+r8NH~nt|l2r(=*+~13s+~z%Qx& z{0WVN(`I|lC-+w!tgTAH4Wf;j5^RL(8kdzcmZgkEE^*|?m|S!el;U^}#h~*U(+X-z znX--L&5bKU2-68OjvYYeNy!6%^THF;#RjB2!BR|q=n_taqpPO!Qmj9z6OSn{$p;N} zw4DmUm9a5Sa+;+jjVbdO`?+MYWy`P`O|LJ^>C%d%<*t57^0J82Bb??Zk+D`VB0OhE zSTk7r$s#Q0Brg=KPpY7Ue`ip((XnE{{H_{I4_b3w7&==>k_eu_xt?6`RT6~sOYK|` zkDAgD@YxeiE8q|5swrnk<;p2RDq4l1)Cv_>Q!9dtN)i^v(z+!HcBX`f_UG=QH&q4e z>l4>RjS4lguN*2ex!lbmbCDJ|6!z64e zG!waFXllke2l6b`s6!96pVDN_(vqR3iY3iub<1jT4uhSB%|%z!QEGA%7LT5#@uM{P zR4bVV8&i6ugB6`l3|S0z(a)!&q@14wC6lSK2Ai6eko)s?Cq*t>Gfg<7ZVD}KEH9@7 z7KXyU>U7kORnLH!qURuNtAa@4p>sTG)n{$VgKAegD8}h zFI<8LxhU~ISGLd(PJqQ+;96-FE>>gRtu4h#KC1b=j|wt)(UziA+jrtN}qx%wClWBVe~_|Cdi0*PllFTMVx~mvvfTYMMfxhz3i=nRW8AHf@iaQ ziiy3gieos2V5gO)ASJmUGvV;Nym?7uEex$fM>U;A@`H>fCm1?mg$KR3z46|T9=3XE4VxXZH7a)zFJ7+*q%(3iV~o|1(gyo9{YkpSFh3}nE5N&EM<+a*L}0H%60Xjj=*SGatk6=dhjbVv zAB(H-!$-@hZ74z0Y%s{WTI^g9jFH`?=|JvjLBzhPZnTL=Lt7nOSiUq39(!4O5dtaq z(m9_~T}Q8pxSrfAE2@!lZcHPhWdkvg$1RUK6A4)rWVR*Ei{_>2j^#5TEHTpCu+TpfgsmUtC?c5GthvH;n+;7*_{Nk^3&C)IA*=Jd#?@ z3rw2U>06L$Lrdq>)#4PFH^%b8cA|7{B4~-iYl=fHSxWC;H3b(pl`mdO_eFSJs|op2 z8rsSwbZUu{aEdQ#zmdvu5nPC09HQfO8PBx$Dbupw(4I22F%KwxE9sds`XQCXbHg<4 z<=YHW(`=ej91^RArw50%p=dX~gQea9lLti3>ci$%NIbA}gHRGJQY5t-P1~a&OrNf< zrfw+~Z9D?5DXB#}geG^(Mc8eXC1CKLR;Ug~3yld_@_v2vkx;P^Nr^f^Prxs!rHDeu z4_MsXJtCK_p&h9`m)wl7t=#bcMtMBG(C5$@nBNMhisumCA2^$v_7)$8 z3ma?Ub8527r`PUo$N)jwc$2x4#zEK}uQHR99cB!@2#Up2YHFXda3~xezaD;m|b+TU*zJ^X*Uwhg1$J z@2?z?4;bto`5b{nvfq-%IzxMscxc94L2o*DMDaSf{gyOg;*qPvAym*n!gyIF+A8GB z(}Zacx3q<0A%3}<_BG)i(b6uuuz-n;@rdZ}sNhRX2CfXfZ(My#6NTG{1W;74L##p2$3=yF6 zwSuJJzR{mNb!4!+qos%Ch2i2XZhUjRC)^q8jzu;I8s{34LLe>YGY-vzMx)rFNIlbw z=460akHDFT;0MI8-rBWdb#L2R7;<&*8mfm#OcmPD(h&h&SDPxe_QXVMv=^peUUAVD z0pr+a_)$E9O+lPUiHQ1@@3qrT7^g3y6Z_u?fF9asL%jW_HgTZ>2c(2bjn4xrT|1= zw4m8RYSX>Z^cA$K32xopvbiJL(iS3t5)kB!y!b`hHo^HRVu)CL1O0>TY;-7qqt~)&k)p@z833@G58~baglu z4RuAk5C!lp5KLUAA<1Aq>2?waS;8${G!V!DL&$NVg`AsmaOxr3 zmjmU;*j6(yC7FBAtb3-SFRcFnfl&d$vcx;uI!w!qSnsQnL6h=Op_J1674gI ztc&hF2y1cCjzxeAV9?vWmf)6-ZV=20#d}wCJ)vV^`Z^UHRduAf64()qu7|oe(CQ~g z&WghVxM_39ULP4+-4c(qhFW^@MH+r2r5f>?+sWaW^(%`GwmV7z0j?`r*JAzLfN3l@ zm|d7=0J$z)^$44C1{sdY$QD!qC(COcsNBou8~8Qo)C|BU>V&c^!K`A z2tQbeTA?CDFlkp3RS+RkA1qhBJ#EpAh*@DQTk&u!^o7R^V$;Pl=JO@g-6`)xO;`k% za9EaT0gxrEdK)>*lA!!z9A<)8PA$~aT5hdyqI-RKGhe6!0$3a_a0guC4!GoStf!=1 zaSU(h4skWOmM_Iy_w+IkjfA@9lS7pNmX-)oORS@1Gt`a{NuI=^qlMSC7*5;idxum_ zZD~{8Sccv53Y=Upb*J-|G##ek8*nXf4#@~hK!+@LQsX*0K4YR9Xp~(+2RgpPM<4{Z zQI3K}+(y2xOxBC6*&O2IQdPFSjupxeKtgm36x%38;Q0{i?MBQ%jzZZDE%7o-R4nA9 z1j;m8Ix)E^j4?Cy&M;1WN@_^_6r>2pVwl88p=~Khc-T#jn`GxA8;)?Kn|OQ6dL(wF z8SP^P&|)hG&k>XB;hIdS7d?r@GA7YTFm(}|2A)WiDG(J^B@RzxrCQh&_MyEr3O7{# zM00`0Oxjl`K#TB9%T1C{i_D@MISYlExGcA><}HlGg#aOJwjgEIVmT^PwpL4?^gdVO zLxRIcwKQa0M#&uvc`wf&$Dt8sc z3Gg`y1;Y^Vl(!*{AZa5gq;4z+7< zBD}VVrhou=H3R#ajnZz|H!2h$!*+0bh2sjwW%*0h4iAqe?G38!gsH{g8rSnfMWk_1|* zH!L!=$D;2{!@pvbD9Q{2OI2(`1PLhuFup&H3<-e&!BFP5@MdC&tdTN(UN>4>V4Vn@ zIz;IQ=L58aQ*MPB7b9bAj3C`Wl%f2y7c1Rb{6oHltfwv7sdj<1<0fOHBbY~JZb%N| z-7OpOm20Bs!Mc+xw>KfHWYH-Y$Q72PNJ${$5!yYrbm8$m@;*2XVjzYuSL)U*im)Nhxa6&Dutq88rB(kWrZvR4xt<_EGq^k@& z_sD!Nc^H(FD*ebD6Ip=tJX-{rzbdRfu~k}|V06xfU{EKAwkxCX#Rk}%>mosvm_ zTC}$JcG0)L)cUS+VG6HwAVCVEBNN!Fv%3Qxg<}eQ$$u8_EP61EP8?aRjo}myXD?Bn zEwkW-i2j(<-SKd5TU2J3YEeLv;)D-YD8;A_Y%=VbD}R%LcHYQ)J2BC^dQeY!H7DRV zbv3O)ltjs`2n8r)%e_7FZ~+#f0}|FCpEgJY?9+VWoRUPIxH)?YjfQ$6=ncDdX->ESqAX84(i*+AgmeqDK|zR3 zG&w}8T<>MvRntR6!aazk-Pi(P&PAv*IvGS@qhy&TqB;alw%_vqiR)uanKMnIFQtxg;ev0i8 zTIqB)i&DHDYjiw3XEtj2V8EUW>U>+BF+c@63*yr}Y&%&(9rP(kKy&VsJ|uJScO19l z$4J8Lc*=n}f_Asi(e;LqIzQo*114^XK_T6=Sq(8S#D*yBy(Sjzq>M|?0cODjGG#&? z>sqdz#7wy&O-OR64H3%h)!IgtL4 zyT~;Ot|x;LRL9@h<(WyrkEQ~1#1e%KgPxOY1WoJ?JE(vUhBx6Tt6L5baSw@{`#}mT z(~WNFAp@k6<7^Ju9*rT{LMbdHg=7Ic>A9s%#q_|pM!PrLl{PhDZ9rK=x*lVB@;k4& ziAX$-1)iT35nrxmLiCz&vP-oHK=DqlwO2y4;4^D=daL@7C%HJ&iD(DID%Rf8iyaTv zk6!HIWcDk%v4|rG(1Q#L!(A{C&8bkh1J9P|6sjxA;aDzfdRD2}f=JPZd}j^iQQ+MK*r+$H*e&mxrB>x13dx#K8@)rSBrs}z0yB_lM2&J6uibl&x z`n*=*dQeW*=Uu9fell8AWRJ~-MUwHys!q#Y1l+RBQ|exFn{C)%IdY*+R4 zBaZYb!oRx|j()9CEYBWOZ2Ls^y}9?~iAOLXuZV-nFpU4q&7m6&5C4q+8^4J5U;A0L z|61$movXubJso&qAckx=9Gf2LYVGK43*(OSe|k)p{zuvd>otlKhETk1{q!!JMr;UA zzi8U5X%|nMGaV1HW6@~O^xnABMN3PpwH-g;hSaxr(^P7?a&-i0;2=8v8(0h46kwg8 zADM%d=+Qay8Fb|ONxEt60v1h!;&UqG&>(QF1vPx^1c{S>)tYK7Pd4ra*!{dc>ySw~X{B;vg=95122U`Zf+I&@1`poZd z>9agO^WUia1C(=o=AT6$^=zHxtFp3xLOog*iry1G^PVk%OR2}VMWrV@iT%6G{;5Fk z-YP4z+R6@EnN^liokI5s=%!?X+4e1!)b%mZw{7nUr^y(zpwb$Dy_L~ujag)kUu=!3 zvGQt3I}pYLVTStZEg$arzG}-1TBEjGW|ft*m#+S&tRXeld8qXIZn1`JwF-QFC{|lp zPgp}SgeR@hRn~N>uEa0`3p{yAgLu_2tf84^mS?uXeL(5+E3KR=%TsNQ+)CH18mg<_p(XlG-07%ndve z!MIUA^GV=_Z-bV7=FhJmuz-2iZihBNKMHmkKJz)CNe94Lqs+`cpZO2q3MpSSj-&TJ zYcvK64>%jeX+Cq#fHmHH5){6ZR!)s2eCA##J;(f&sI;<@q7Y)4UJ$Q_Qyn)UXhv zeF?qh`OKR=mDbtjKcJ6{?Psh767=U_2Tyy{K=dTMqnBve+c*t18$sXn}VTA%H z65T=a0;p&#q%)pMY4kK2O+lmVYHK*CieS7-YZ@j&pE+`rU&Ar!orr-}1`OG)Wz=N>Q&0BCAV&=j=^)%`HjjWQ7u7zwq z^D8E~3_NlS3}Rm0M-^w9oE=DF`S?eo>xtCy%5DL-%nVefbT}~bn~%m2f&9S zh2=*OaRP_s-$vkoj2#%|_h4;5!U#pHDuj_fD;vC0;s}PcAF}1c3c~D%u=xa|G>~F} zw@kwtmYGlT_-eM1?C^1D;tsU(o5#Ur90d2Uc5Vd@y7>smbIUE`<`ib1Ftf8XGqCyW zno8>&pLr9a!Z=LpAa!8yba@{&hIy+u)hX`4AGsfv`GMrJ-De&ICDik6Zy)p6W@W)A z*bPa`6e#}vnm+4NL|ODQ1{IfrzRx-bo=5Yq8vY7_`>YWtj)z14@fwcp51{MhAhn0P zHXCRHLmxi#uh$?DZ1Y0(_DGI9Bk`G&F)kDHT?VY5LypUQ=1(C<5d^yo-DCdBczOn~Ans41B~<$?TKdd&7!%^oHGL`aJqP)QDr;@C3Tmvm;5vqy zveEXiPG3%=(?4*-C#^z6m!Ne{mE{XkANQeKILoV0t%)i2y=w-{KYJ^2XN?~q$-aF} z;8GJM^ih{0&%0oolerC^NSc0Ku$YMZ^h#?MqA%ni_Yme^v2sJH zH(I3BWi-cmh~!LqXgw)De6wX(Lo$cIZw)(P8THnX>pcZYE7=pE$j>x0jw70ELQq8H zdImj#>(l7TAGq8a{v?7%89e91tB;$vSe3pVKJ&e+kHh=SKUxE*dt^)HPpn~}x}InT zK+~sb5Ncnvj$?)JnGb{O5U9}#JZN5h9795Id=Yb>+fzfB=QeaXY@0P?J1Ly{m_>b% zW09U}G4pdsv`X_X#3y*$+g6|_uo08oH-P#Y#3Mw^O6x+HC9vHZy~r9@ZH=y=B@J=l zoEloG$U21_&&NQ~;}8YSQ5f6d%>m50-4y>`Ly?xGN5J%~k9ZCSC^T)e#vmdFEelCY z1(nCvSQl=yaw@E`Rn~=7Ru*`HIh+x?+dP0}!~7ZGv#Kijob z!)~DU0AnB9ht8|fr!XJg3^ib>1w{t5i+ByRAD%!d$#976ub{Li4_e7U28deU%?Jok zNu_xVZNYsPpn$m#DcTTji==_)$d4rJmx&m9+(WC)AANxy5M@Kb{wHaKv_O3ygmAax zq>(!|AE&st1C7oz{{Wt}ZjOc=82GpfYkaLW6B+<+7$pjKZ|?KpFB~W2lwXIJAzv!# zOYr}h<}bi(be%P?+`K`>b>8C@u2COTNCT&syL!@APASBf%vIz;P^r zb@0ed1LoKK2v>)Jhp*oQs*&3{{KFkHplNb3cs5iv(ubuP_Y6wRw~<+Lf)*x$^v!WK z)|72lZUuS!6u58|xADOt0{eUe=JOccXy_FDGtAw{+sHBQ-$*mg{4=^Dr-mBGS0Wd` zVdHTc#sLf?rygSfmPCJlBMslYGf)ZI3*eGI+!vsOLJZ^}SRudoX23JS2qLAF9ef8^ z^!i$$l7oFeIDqJgzt2~h`0<%};A-|sEsz3Dq!rHqgnZBWka zuA?;GU%L%4?S2dr^mCzH*Y4+R^M}$Pg(gzFjKF0sn*2$)%{j+eOnP=I6p0>o=*1D)TAg$PAo4UgDff?dgk z&pd<$Yu7bWCpLvl6*%4Sn{Q+FDllIIFST4k(C-2_I%tilCu7_U&5lB1gYGF{nLkC! zHS{SqqgO6vzW@d1LSF_ff*Ji2%qE)Axd9!BkQs7ktS-bv$k4(sPJKo3Niba zfdT7W9>HE9&N6?6eqgyq(h?gxWf9t*VOYbFN+Y{WsoROVJkA07upOvC2jq+m)&);O zmI3%0lJlyRR^LRcp_!DLQLDwO)lTRIu{8tx9aOm|Ps>&F^j)pkVM9 z>d8jlEs+NkkY5M#EUa-ro(L zCUCjW{EuGVia!b|C?Cmz_ah*iPw}?$If1QJLf5KIDsq68HMMFmB#3JR!r z0Yy{ypb|y+o>TQYGnJFfTR*@5e*J*%s%M`%b?Vfq>gt}J z4B0^VUc%J9KadHOyOR_*P4a(Dd5&g&BL2;Ex+&$aqZ?*Rt~caQha4+qnHy5+@(-C` z4Y`@fO&~uTa=SymH)LrlPx~fKwxrVa&cxU^bdo&!P%67W=F(3}ji1+1nK*pk!Y3=h zH!a-kLh8>KxQ#E7Zl06rT>T;8+CEoGJzSdyXj8fh(m1#&$=^UyP3R&?Lz~vyVY)l2 zP7@p7Lwo)@I!E)~N2zp~Bemc>{|B}k^07~=!a}9O(`QiTlh3sVR$Nwu> zLo|+3Xw~Fj@*GcQ{=dl6&651rs55Bxsy393-$;xcbA+m(VDuN2nm{<3O2I)zlKkq= zk%crhRHsSkf^h2Ka4m`}dVWN+);Tok|6F2LWB1VMnnO5t{BKGQ@ihNLjYF*donn3< z;_tDsv2Nxe&b>*VqH|A^PicwajHe|3T?*jp6fdN&E442|9&5M5m}&JBm=bE99Q2GI3tdv%(W%oT)-)WG#OoOA=l5jl{C%nziV*J5EzZccHq>eK?1q5u@*4T%&+xUZnR_8P`wWE^ekrCsX zbd4w6gIG;EP!pc3kl+Bcj;wxe*dI#E$KqfwGL_~#QcrP9i$^M_~H7#*#3A-$;B+@SwfgJv+_pGxDiPOwuQ zvV$IrQ9p9q{3N<_T3$>mZK^kkDh`egP?9gl$umsV%?^cY)50fdOSpNkR~?H?i1|r$ zfg?+Ub$P{|a65?}Lx;SdPiTRQ`STdBnZ{mI^8;tCD)G5S9>4wWoITy}E)KED_J*HQ ziKiR=nUy%rJ+yVJ#6K~dez{O>|1{kB=|7xbY`F8Ygy6Fcmrs=9%ElY+{FEC`QFPPR zCoYIo2V*~fcvNu<8Ey(yIMK>*^V@P2_;DjzuL9%De+@UkVpieY(}vTBQ)*joIQ?9h z+Gy&cjXx!;xJ@(M`~p~o6H&u6DlpERVt9*6{0GDNgSU#?QNvqTgp}KFc$-Rmz2R*u z@w*LgSBd8v-mwxNVYqw>8b7_o@M>{@)Psi8ue7P{7Q^Y+<IJR z-2Av;g>$DFo>qZz<~S65S2>{#^Y@u^n6W2y>>8uJuM{rc)Ng(X~FnBu)|{SK02la@_@%c^aJ;&G+ zpFhnzN2KR*Bj18jb~Ep}P_m2ZulT%S-k%}9fw=e(MaK^R?F90?GOViJe^b9y#YZQQ=Q?<+L-mZZNwXLK)l;1H@W%3I+oaix zUs>Me*^oJz_+&>u7iq00A6)B^{?~fCJNiY2Q8WRcfSz&S zqDQ#AFUWe_ID7;0%r9{C?*$h-<HAv~%ioDD%qW>Lm zDJ%L#el*St7x`>(U2i*Z(f=j#op2OA!lhkW&jF=J+AHxddW1`yOTA*h#JO;>pI_bN zP4tL-NO6&`4zBIY2WR~1U%&1f^3f~zdHe!I21pK z-{zox@q=(TJ|#9-bUEZjPczu}n9?JBBe?e4cBM!Bze92Hzg(}yPLY2D^1?;_eQ;fG zEpR=L)dkn{SRZh1@0m#RA&NBD>+&(+Ebp%C#yRpXFC{tNbUz+Qz|-Mx@xNTB8-t4< zgtr3Me(3J-sn!IuFLU&ByFxf8@3u>Og=aYNHqp`330(Xp>!t4CqDOd{qsNWsbW|km z!^FO!C<Ozo?cEr%Gl@T zJqE7(aU;0y$7qsu3ft-GDRj8Iepuk}i)>M|f7s#04&UzZ=?))_M@zb2vcV-zw!=TU z;4)r>7dm>}>%|<0yKye@to_p%wrT&&Lj7!~>xWFtS6WXmaII&jGtap8B%@ybY^%NF zpP>o(KONq|k#7h)S&z$$6Y$Lr@95~M3;S7*teyDu)CBz11iU)htM&ACcxR{HdlK*n z;-B@n^8B2TH_h)#z&}aAhhbb)(vyJiOu%a)&RLK9l=!*?e3Qd7ZBxv?JK~o0xct@x z{JjLcAp%S5xg`OAApt*>fS->WMy>za1pGsXcXir3IK^gIkINrPz(04m`*eLoYFv-Y zA5Xyl>+n+@dpcK->v4HW0{(Ua-mym2dP)=UwF&qi4)5;RIT{NX_M6MsC*VnVG_2*v zC*W%m@ShU!_O;^eb?q6KfZyft)0}oiYRC2TaQJM8_jLG~ctp+kLGX$g2f79?7JM*^NwKW>k!|JDS2djg)+plUt69qz6J-%r3h;{wU{ zyYe?WT<%S{#?KS*lN!bCapgBA;J+u}qfV|`&%Fuw*SL_g{cgRvO{&(jE&)H3fOl+K zwVsj${4s~0Ws92qFAk47{0w~5%J%nj_|gQtcZLle>wrL-lA&xkqP*t z3HZ+m_<1ek`Ulvg+285#fe!yZ0l&0WT#qZiF#$i(x@!4uZK~!EB;en+ty&(JcP~i& zc&-&Odt5FIAM9{US22De&SAJ4ex4(b;S!U780TQ7;e&|P3fdF0#$$W9-X9?^b0Ejh zC@?;ZL|Wv3L;e!Q!&Hv9Y_q3#JD^|IqjMC$2lDe3?*e{{;_^Ac62(VB{vV2Gf#0wA zH1LNMzZ!h4;k*#?@)X-`0I*41HN1F*T6qfT-N1ZDgGtozf-&%{1?Uf z8~?l=w})7NwFj5ykkXIxye0+ugr5z0c|I?EEI8jU@h1FP@K%an58grX+rTpwUj=@K z;`6bdlX#JO<^JS6CI30}3|Cy9Z(gK$XWzC*K5r8J7l4mf@;Tu0oL1zo0+)Cceml54 zmlM7g{3@mY74R~}zX88dae2JE++VWiuVHl zM)7>`?-jou{E*_Sz>g}v1^l?;?}CRA*W$Myz*7`Y!hNG$A4I+xczq=w1()Z&B7ZS> z3nf1tT>kEf$Ug|)MajPgF7u7Ze+7QJlK%xfs(5YOub!iLXK?xaPV^52AF1R^z~%Eh zk-roCawWeJTt3eg`47P-EBQacrz_qB_sKIAKNEb8;+KP8r}!-J1&S{Lm-$ufd=z}C zl7A8WKE>sJex>5SL;exPGjZSknBoJ$pHlo%@XdyTR)#z8}1? z;)lRHDjvcDwyWZ4;5`*@41T8KeZU7OJ_3BO;@RNC6rTxxq2dd{FI9XwxLlvbZyUfT zDfxecPgVS5@Djy;0H3XR5YKVuDqb6WzT&OGZ&AD#_!7kjga1SE%fatg{0i`g6rT?+ z>kjeHec(?h`RBklDgHM2R>l7V{-WYPgTJPD2+y7;GZi#6rA5j zG72W5_pA{5W_^#arO{ zU3W=PLdUxIE7nKa_)yQu2-Q-0%{`&j8O-{1Wgy z#b<&~QT$HuD-?ec{7S{&1iwb{@4>HEybk(tq2evTWxXtZ=npQRYX~0;zD((v4!%n9 z8^Qmn_)75gia!JXwBozLUr@XYp2xkWcq$%jys3B-@b?tY1pi3!bHG1W{6g@r6`u@# zQ1Ln7KP!GK_-~5e5B{g(PlEfnKahTT6}+0_AAs}s)ZBUIEAV=X{|0`t;>mbU-CXf> z@V1J#1@EkQ6#P`hF9Pqa_$=_gir))v z4^}AN27I;R{lOnqd>r_biq8UnR`I3a&nx~E_{)mF4gPP%e+PeC@fvu*`GMjs!0q=U zEC{B7_v6#p5#pW=1#IncR^cLcvc@pHgO zDLxMT62)hNXDPk{JWuiM;8PU;82k#we+0i$@jyd6Utgnmb8vZnBmI6F_(COrF8J+= zj|0C;@lx<*ir)Y(&xfSm`@#RIgpH}=6aCy!o`hNufmy-Vj{1wF;;{%Fa zik|`gj^ZQ0KU6#){4>Spfq$v^ec<0J{uKEC6n_c)7sdC0|DpJ|-~l{;694#E|3nl| z2TxP{C_eu?S@9_3n=3A#gSJ)tYRGq1d^Px~ithsNt@sh}zKW;e^VG8y?*x9n;@RLM z6u%K%o)?PWR)JrpKx2(C_yuek%A1#V-S2t#}#uql&Kre^T*n;Lj@lA^6LR&&B7>yA)3be@F3J z;2$d95d1U6TY-P6cxUi$74HfDKgIil%kyCI{{`U3l>CL@KAyjdd^UKB;)USyTv_C2 zfHzk1jhox+MQg=xgM3HD?*Z?s_!Hng6@L-@OvQJD4^VtR_+Z5kfe%ysqzr5Sg^ITY zzf|#I;5mv<0iUG!_25$#Uk5JF-NnzF!DlP^z2I{dKL$Qu@jB?2#fs;H->Y~x@D++j z!B;DO0r;beUjqJ&;%Bw;%=RzEZ-D$OivI(Am*Vo?#yg6?4SD(eLHxN7{4*v06Zn^k zhgw)Wzg4^u`2Q4d5B`hd1Hk`K{37rGJ~t3M3&A6b&jhcbco}#d#qR`fsQ7B|W{PhI zZ>{(z;2jnJ9lWdJ^;%lL^;EnoxO|=??HvL>K*>)4AFTNG;KLMO1Ad|6yTC71{4jWq z;*AiWg^J(R*0yVg;zJ=nNAc^xuT%U9@P&$h0)D&Vhr#bsJgv30XPM%?z#mjR2YjvK z^T0PKz8w5n#W#Y#p!jFtuP7dDW9@uH@mApPD;@>^RPl?zzf$~a@b4900e(dBUEs$Q z{~0`l&$}c(>!9CjDBcCUzT$(yn<+jGytCr9I$HnqP<$=q`zZbb_yEP<1V2ylufRtr z?zOY^j#0cRc$VUs;1d-;2YjmHS>UCLUkQG-;)}trQ+z%6Ld9POU#$2?;QvtkDEI@4 z*J*G4uv+m`!5>q682HnQ=Yl_{_zdtD6<-3rQ}HLk-&Xux@I8wE5BxL5(>mC8eWiFW z@Pmq941P%Q+2G}h-v#dB^HLcv>%k+6zX@Jb@o&K!DW2ci+TT*~#vLthuXua#Qxxw5 zewyOLz|T;8Ja|9FuL3_;@ulDwDE<_8M zC_WMVO2uygzee!~!LL_*JNQDy_krK8xO{o#F2ys@zsnSlfJZWr5+Un|}L{CmaI!H&-z zZ<6A(z-Kvn1{3QFKRlrLnc%A(JsqKg51So%_JO=__maa|e}CwCUGcHtpD5nsY}W31 zUn_nY!@rzgzL6;14TaAAWvH@s*H&Rq;vSyA_`Z|9__VyQfg}ue0LWjU_$A<%Dt>8qtEWKm zBFJB<__i~x{CvgdLHl_(9|L}d;uF9JD_#PAvEpUmd5Yf*UZVJY;PVt;4St8> zTfrYvd>8me#XkdoMe#%6dldfz{J)By+~4~7sN$!CSHpWE(l6(OH&Xmk@Q#X42JfTz zH9c&-7bt!k_~nYvgq|YBZv-z>{BH0iia!GWpyJPhKdtzC;5!uG3;u!P-+_Olc=7<- z-rp2&2A+)fR>aSzfj3lq2zUp@M}nWB_*n2Eicbc=O!4c%rzt+ZkF|fU;`c#*vEq+` zuTuPZ@TU}i7ksP1^l4mi@=X7 zz8XA&_ou`U_k-6}T>4So3lsT5jJu9XJ_6oL@fzUr9+~K=4L(xIr-NrH-Wa@4@s{AT z6_@zDQE|C$-l=$J=vk?FZ}9bs4*-8o@pHjnQ+zb|`-+bP->>)t@Ce@j62D!6>r^ep z<$Baaak(CKP+YD@Jr$Sh(LlxJdNe}ubl7vb;*G(lD4qd6OYu{|=PQ0L_#KLm0AHba zF8F%IJA-djeCw(9`uKw4vQF5g_yXwJtN3E@uN8j){E*^LgP%}*CwO(dA1D3(19(Hl zkAt^SJhhu`*Qtuv0*@-*9Q*>syMd2Y{0#6(iuVVfq4+uA*DF36e2L;y!R38J@k25A zdL=&}e5>Ni!QW8)LGaHMe+pdQPn3FJ1V5qV-vh6O_wq!3AGo}?DEtTTZc6?*_yEOg zAwEYd-Ud8R@vh)A74HLnlj1|c?@@dr_*%v1fIp}BBJf>`F9-ir@yEb_Q~Vpm^Kr#L z18;%%0mYwbQ5)x-6#ohOdn+F9ZspHWyczf?#bsTTt$16=PgVRh@T(L*3;ZU;9C`64gPP%w}F4C z_*>xe_mRY(Ux6Q1@~Khlx0+4tQRM4jyf;w1ALf%*ipzSVtKzcWI7@MPZhyYw`OrT` z@!8;cipx5)Sn+v~pR4#?;PRfYwD+Ij_bU0P!5>k48@Rj|EP6fx->&4p27goWBj6t^ z9)kb>t9UZ_?~0Fxo?z38{V4a{H5ES_@{JT90^U>cUEqBcp96aaDK4M8U8s03$d6b2 z4Dcew2Y}B}dbcRJk-p~y=k%YQSj%L{OmKVJ-ZZN0REBU{{a85;uk{yFN%K#c|W6K ze|-yHTXDHAH&eVE@|_j0hPXOI@!H^n6+apLV#V8n=PBMByhQP#;PVuh&o6FQd@|(k zSNsO>#}&U1{9lU8b$_?wFG2o4ihl&|H}}jY@vsl^SzYn{7#9r{{~o-J;_}?}RKlpeyozugq@QVkAjyfejfNd#V-QCP4QgtWr|M&e^hb#JaMby@_FJe z#UFy6y^22#{vA~Unu@6{Pv^bZ-ZBBRk7c{g#KEJ z?*>m-{C((YrFd(|XDZ$WypQ62zy~Ql7<{ziqrkHj9|t~F@jURW6u$!eCdKD~FID^| z@KuWc1N?Et*MonccysVi6>kLomEzLBKPfKb=$PW4qF<8n{R0^T>AZN#rr_d5XC!#U#NHhe7xc*;6;kp1)rmMQ}8bpe+2wH#qR?@r1)6yvD@x$Q%Q2a~q6^g$D{;1+|o!X{&CdS3f ziZ=(}rMP@v`Jv+VA%8&e2>4OO^T1Ciei3*C-%}C)4+O8H_z>`BijM%7@8yV|Tfs*t z`Tv2BQT$`@Y{lOPAJD$yxZ8?(V3gt+xW3<^_}k#i6qohn8pUNjxk>Stpyv(69|RBL zWq0vI^E0j8)fFEOUQcmZSGQ2SFXT^Ad=U7#ia!cIT=B)=lNDbMK11$q=5UtZ zGsx<>*WoNLf5-EFhqJuAKd?q|`P}MhhqE5}`KQyLuynUhg9E-g_ z6u$wy7Mv)0Hi9=%{1|wq;_1{6y!8W@em~`G%P&z}=C>ln`$GOY#Rq{up!lWWk0>tv z_@v_VA-_#=@&9XzuY&x0iZ2EKRB?I!{H@~h{P|bK7eG(7&el)jw@1M1DK71j?^lVu z*xymfi~T(n-wFK#6c;^175@r+dJ~ zKX{Di$@k2}{_i1wP{}X1>b+WcKau6R%CkfEL{o6l|0(28QS!G!{!GQ??-ic!aF}8= zWjmbfJvVGCnC5VnA8xUCrNdeNR>oqJ-Tz1NLd;9@ zUZ?2U4PG1X@ItldR+3QT!_KPaMv1-WYZsP+aPj_hH2kG7rdm&B6ylkG!8KT*jTe zhbUb1w8DFN!bd|-4{+`;Bu&ExD*12Vx8V+F74rAO|xoBY(GOg~M5o`0Y`Lv%LI$mM0v}@;_s6Z*@4! zf0s-<+WzHmmY3_uE{C(c{9TW?9nSKsI-`+SnNFTkZAf5Nzv_sykWWIp^&$zvJl z$@_yW&-T=Y{Vnhwljz^hmC|-PxX51*`9Vtl2<*vAz>AfhnboZRc}jkp#old-SBL(8 zDn0~!tKy5mKT!NJ@FR+U1)hxe-NX;$u#T;#xct5THV%hM(}M2c(l5s`zM>9i|Gy1C z40Jemxs0!oicjG}v|a9SM*UI@_QpG$^)%!iZPOgi^73~dG=@#%6p3vCxcUsxc8`%m+!G}a`fYsI8)$dN1jcuk8$y~!`c4NplfPenyaMnKs@`oMHqH@1>!r?6c8svR6M(mOPI?3TI-?9enXshFJ)-V0l z%;79A-#2dQaF&<;I>q5EzY6+KbvVnn;T>&J#V_JQv|XUM`12CQrCoW7i+`?ATZI-KR3*PQ=>b zjTXb;r{=X(3su_qdXbANGr@fg@^uXrsw z&s%SYi!5__e@fzK8T4P|)XOH$ga0QeelPfR#cu__(y14ZP`O%fzLFn?ep%vhRw3V8 zyUXEjzsP%4V!wP3ZMBl`3O_&TaMqt)kFD{%O%7+#?vQ`c;Vi!m@~=3YMP;4&j>B0# zSf6&Zec*7G7r)7SC=x%tQ17=&J_`P`;^%_@>2P-C2CkI0Bn(dRkNkb?x(;XgeJo5{ z6Nj_?n_+)PaE>?b$A?*%wn2_O>ydaH;c(V-9D1^po;8Ti*@}OK_1K+?9|d2pcru<# zyr%g3;PPGx+mA=&Y`*sm57Fg^JQG7Famg0NCiyZxI$}+BmwyPD7eXmV% zY1bW!KMFl76c@kA`+DMknLnRZ@^T&A0nY7}XGLu1yGni<`td&wXH%|)-@b6T+mAmw zoaH}+{2_DCF}uX4q|1DDTZ#c%gOPitI^C9YcH{o^i* zPXU+rI7H8O=*fk=@L8Czu2uYd@H-T5hd5cScrS2yk3;mgLO;sqw8C!y|553AA9nts zcw_WeO?-YE(*rK=H_5#80(Tm1{U9&=1MrcKp0li|*=H;HS(uj!9nLBqhM%W9oI_LQ z$!i?_eI5PxJ3Q*}ZH^w+{{!^D>TuToG3mph_(5YI#YR9y5| zlh3O$Pl}%U;M_0$oOZQR@{8clOowxmPR0A#-5u`wGwN`bUj+Gq4rh6}u8mTB5ucEz(e@4k4Gquw5QYF6|@~Gi z3;8`tJ{{xqbEUt|dA8zjlzb_kGaq*3IdnEqeDQY7;p{j0JJ?|?GT0vG@}6{EhqH<0 zuv6Z<7rzZpqLZ|>Qu5VcXGd_6Uj+GHiWj22V;wzgzx*EU1c$So524?$Q2bl)xk~?Z z`2SAD<$AGR@dJ?GuDDzW-&DL0?3eGyNP7pOy{UM=L%8^%nc{08FW(;(`5oXv!aF@eb&tuSYufthS2F90sKUMtpTWeeIS|#5W@|zsa z`sMw|Ee>b>r$YV}hqL_MZLI!(JDla^?>2nkaF*ZS*2;h6aF&<(`5VO_=99GjPw}PT z#}vO0+?Mh@jyL`YUG6KBaYFbFm=E#TE+#LZv!pBe<&e)%Tz(h4o#OJj48kI&e=qc4 z85`rWZXB-k2p^;PQRvB5{1|w?;UjuDIygskppfv`_IHkUyaK!^r=ncnEeLRb1+o=Q`XjwqNR%qwvPilYygf z$+uH{5b_d_EYFwXWY{6+g=c^dcl5CQbnr2XF9Oe2d^>o);(Ni%9L|@rG2janKLWm3 z@#VffagX8~!DZdS?dnIO+rT$F^30EdZ&y5o>*-F#>w@o7d@uL`#TzGCJAYEVR>bn7 ziZ=$A-;rng+gnkym-~LBiMn z4tL{9e*c~IyK%Jx*K_7>T$MZAjjK+$&a=E5SC3=-F?ZwY4~M&P)ei%Z<=wd2=5RNz z##OUUWO+BP25npm7OH7~26Bx`)Z zw4CDEUYFv$!kqZ&{M_QK2}RRqdnKjC(2=A?8$V-GR?hhG#d$MrS&u6($t%q&Etr~DG^5lp zDJM5K>&lV>R-9X$Q!uSy+N3NpH>%$(QmaaH#&cWplt=;z#>IK1Gm58W<(HOD&nhX+DVa^rDiif@xXfi)KvArIS{a{O-7hyQ8FF>U1(^I-iKQtDvN0MqUAxvX@LX;jrshX86~B8xuykVU1i6fEQ$I?kTT$5y#r zy7l&2&Fa$C>}f}!mjPx^yWB3P_GHkF_PJfUnzTut+QVS8?`rn6Bk9wO655kivp3+> z?nc_|>2*0eNjs80)nK!yzkW&hRNJ401vIhI)I4ok-h|SunFTo%coU1dnKHB|d(6J8 zO&i?RV6*RP_pw-^W_RsEj4I6JeK*>Zd1mik(4A|}|4XtVtsAfesZgxl({#b2?G&sZ z|^{$9|-_4ATY*MDCk|05{nIZUGZ z?@HkRvKqExdEUnLr&dvaZK{VQb^GtZdb*udjH7OA{{-db{@h*DvkG1Q`2_9%9`(!f z9x+3g=jSq-v25l^w*BqsJa63oljy(pKY#zBs`k%;;6N_yY`U(i5|rPL^6r|Q)#&oS z5UZ;GqbR?@sk^H3KUJZV<;LI#+}!xDLtM8%gIHDdufhF`Jhvh-vuXQJCaM_=POqZ= zdc<}8Pf+Dm)jtRKH-8mBJWo_rehtdYb1}AwH*M=pR9G{XTLAmFbA~pKANHlTe@24% zZ_I;@HhE5AbCv7j=S5Z3KPZh`<$2t{ym9@F=)bPNKe4LXpIMzw&^FK>VtZXzbplnD zFGYEIjwcFq`3M2cShiOkYyTP)Wc!=Ye{Fvo)Q@2bY0ukU%OAIFA=>G!-rx-{n~$p4QzdQ{oZD1kLFa!Gt={b8Ooy@V)EMlrO>I%FGl&ln*X*YD8Ccs$HZ#3 z30;4H8eWzC8JPIwIjgAA<@xhb%~*Cp1M4Yy&d&aCNB_0|YomVc|CP;Hi;WqZvU{sF zPF|tPtFnJP%1eDxLfd*%g7Q02UY-LdDt{f7*E(5tdLwJ;Vie@|^IRuy@Mlt5MW&sq&h$AA1BRM*e%ORyyS*4;Ya zXLG&Jb7|aGX!rh0r>iPI@he;IqKd_1ZI$xfF@BYpw+-brmvX}2OA!CtQC>bb6nSaC zF7ThkcCKgS=xN-E`L{5_BQMV}mJv14d^Mg(m()_!EY%?aw?jT;BIetvGO z>u*luPYqF{IukWTu@2(aoL@zGdQ4!RGEV4HbV>$onY_bh({|sZdv`;7pW5xzZYGtT zGWYBu=L7@s9tn8QR%#y`v*Gf%Oq78arDyMk@$|N2yPvh^&#SksJ(?9*`|HKQwMT~e zYyb4UCCNLZj@AO3^1qq4g-R}NPUXCxuX&HkFU@}4E6+~yHuAY< zVeg9i*F^6)-}goryc#Y4&2P4DZLr#|_WQjh^#A8F`pV;PN#2qZ!Q_LtoH#L>j#K)P zESF0SdZVwTGMj?Y@}pF4A07Am_11A6+XG(r^oY0Q^I-bH-@fpcG^et3KUEp@q_ zb?Hd;bm$SZe&BSoK>aDJ0-k9z`Ns5Df9kUguWaO(ejTfm%2N1J*>oen^7x6-E63(1 zX#aC-j}-;h{yr&4e(}jaA&Qf*iIWq4$~!bJ7AFUy<@|q*-|T4e#{OIK>Faby$d((a zj+5Vymbat2IhK+)2Dj`R;4KLbDI2+;&U61Bj(FvVU-rt+sOfE__AIVP|7i)dxN)Rx zBs~LIvWfoxM*rz@S+}6&px*5Q&AR2cOzwU46VdWz)xC{>yylfNUwGoAp85anXX5Z6 zwdXLkk>;1WB@}aWUut)-1F>1JMav7WZM-bSuXf9KAA04DrW71)bmGLunQuqSfAzeL z+fz918W|t0q&DoK{+M~<#HMo6MW4CV{U|9~es9>@NK?z=bQ&k)w?@lbrAEuksD1nW zy6e6~+0%(}{O&_ON^zQxy15L?`xI~c{d7}TN!#S!T!!WM`wa}!WjKbp440KSF6o%u zySE=L-$J&F{zfG8@re@+*j8?Dvkd=({PB&KC5K5r`98-l8~Fvb=S#ogy07Ty1^VvE zrjP2_cbll3)f2rVh5XjN^gqa#cTYmqwOhX_Dzzt&c~~ z>sB_BZQ%BDxiV^}*hF&OJ+CZ{=aTW&qwTqk>{s?L%hLGjaG3h!&#PZD^`3Y+@XnuC z2gsHn+2oULA+j+{VmF1xjDkZ_DKC z0$V!FA8?fClh-LetA)K01>Xd=teqI$vX1PRwiJ9pY%In6TVDCvYw7qd9edF6J35Z- zx251XoqsO6rEkEyVsKz#qk>;4e|f(x=LO0}#@O$HEemgcWp=wja%we-3GbTr%h*5B zpq=+uQM;J`O6?3@Q_Y-Pa1r%4jq9C(c0Je7d5#^PgZBCLDZZPn%YW4?XC3T&u{8sJ zzlzvQI$!1WW{+3CW@5B_{BzOr+;94s>rwtwUim}8=oXsKO#iKR`tUiDZA5c*eLBZ; z${x%mbm^}}TSU`(ohj(X}mR=bJIMpKN6t$2E(VFQ@)GLSth&l^J*Z z#Kuy(-mOUTu6UGU?VgjOLa}pTL&6L9ciI$AK-Y zIz-D~q;bDyY;;RL)pdl&9-ZfF1KDk^?`%Kw{nR(v)CR7P^D+k3Tt#IM1-7g_J^E+< zjpz2x{?+?)jn}J(^htay)T4g0*N&Amm+hmuP4XEkUq;s}DKC8*@Bccc|Jg2{pV^Kh z!_J{`bT*Brfi$iL(D>?4W4+&68gFKO@*VkfFwGGM{FHSaa>7g2QoPe6it+_Crz9V5 z+k@r|(@#H;uTH!ip)uNI?Xh7^X-r0z$hC>D&+LPJEop5-x`MsRMy|QO*-^G5ndSiI z+@1re9!;g*QXZRYuCF*ht)jKXv0;~!ZI_X45n~(6R<(ZO_RBmVK4e**bK>o;yw(uE zd1IZqgW{L%S@3am3(u82N6;fGnkS;=i|GG%WcT12!J{n0=g)uATWjYLnwNQ8uMe!P z=3O_kU0^{Yk;$s(m7h1S+0jAsf?JvgqU#6E3oPju@YiRA`>$_Nqu=^LoxSpCIJ~}p zjnMi94@Aoc@%3dI`TRPHv0v$UBN)XcuS2+P*))$W=-+Qk{<@&?VfIzQEeme5v03d* zuMV$sW~QVrN&a9(BkGq*<9;jkAD`#7LjH~6*$dO6kmj|5yMtR6-tEj) z4^aM#ezObiX4w~KFQmDB;eVoA2Gfz-Tkr^-uitO>&7_aMYf?w%v$c6FZjh&4O?h9_YnZ{U3#Ot1XO|_GguV^xg``EiC zz81|crnxZUZ7iG2>jH0M_8~hrX5SH>&EtdD73|-#Bp!D*y@2NM{2$5RclYbP#%pJ; zvm&>W;)Ug8e6D%x)_3#YTz}}m4{sgXS!3TJ(V2hT)>HP<*~h%(l{K^b2mWMz`9>e= zp*g2nm|hd2HLWejzG=ok?HTJoUYFfm9Nm&dem!{9uC<%f94uphAoc5b@`uE>aMs7| z>O<#SP#=l@FUkM3F6qGMwtsV?$FFo=${wV2RpTuh@-`-KKd(1mYj=if^(?({{_Ny1 ztrKajv61HZdNs>N^4vR`(o2)PcNPwiep?otIMKalAiRY0zfzsO=J`u_j@*;v z)&89BPp+fBtw!_Du4}KkbMm`%4K8?eb98pWQIFP)`}f~q*FWSVk{@vxcJf@u?eCB4 z5VuFJbCu8W{8w=vpmx{opTHmE6L4N%9q=-GWbcWVucR2N`&iUmUpWpo(tMeJ<14eN zAFt?0{m5%_gKjXQ)pc59ok@-w~VhF+}}190yoiovdk-A zMc2Q2*ZWJ-TZZU*Ztu|oDTPyX!&-sh1<-&U|rm&b1B|grmA-TdG+&j zEeOz>DroL6>c1Z?=RQ3`^Y=`?2c>qF{_d6kdU3zC$pO#w?~!4Ay?EKI(e^w}>v*#7 zgJyb@%>2pC^*JG|SbCiwc{uHul&d`z8|vpC4XMMb?vc90a`x=$p)Y53fX(}m#bC0H>dSZa>k(EgKF05S(p00 z!A9Hv$$_Tb?&A3}Bf0mL-$|MDym_k@aKqW-ppIInU2w zdSl+C>tbzwuEXzmXwY-#$8^s^|M}U;ek#BHg=l#W{m-T`pF{t-Uo&W2eE5u4K9~OQ zqE2UrV?j+&P-dZ9015G+qY=oo5s5?*nf)SUZE_;6f)p>DlvW zzFz$D9<9r1405@7vHNOs{WAB}9D{r<+4O~(Tc_MYHZLIm{@pRc_lvPHLbg=w8tI_@QK#GL{6ccpsJc(oF73bc$;yl3d=+Qj8kNl*s8{{Xx zmspxj<9a*I?-HMK%>IVv4l2ho{C@_`B{RrRRLIPCJa&1mTSN1eo!{!N%m2bFe=x<) zZ!2-c98K36JI@(C$8CK)zb6`7(~FBrizXBmX3fmcnqFKmv&5U3pTP;Qb;;=&Gp0?M zR&?bw0#+)c_4E|`+L|hsHHqFc&7f^&eo;wjMvK-ZEjqR6M zMq#NpDzCJZ-h|CSK3;}iQY2*=txGaWi)f$X73W+Tlcx0lA<33oJE%0j<(Ze8LGRm^ zD$^NxLoObbHK5;+A^rOeI6rIDs3BQ{hn_R+^o%R>>1DjrGcsqjp4BOXUVF946wkic zXtjH$j?N|1^ClEbESQiny>P~)f@vA{CB$LFF0j>2EY8dGO6YB5ZjE`@cL2W}$!)&K z_^NH|lC~Msi;7D#TIY76|FMRZbjlb!d}a^R_@apu*}YTgC0bLobxGVY1(T)~6|+9+ ztpa*1UOb(wj;S&_%xk;Ule1>Cs!^jyW#mocHz{*dJa$C}z3DtNuNV#^;|s>mn3+*B zW4f`8UX#tB_l~E-ndAxk@ZB3)ltHf<7ZuOW;2yg&Z+uA+zpO~Y=HYybH@%czh%TPV zZ#Yst6N@^ZHHF{mBNJ!l6lP4wnbx*6V|*Sxyf2uTL1*~g&kTC&nyi|bOPz1t^(1d* zn3o)_nfIY1ZMUb2wZkl+KF9HY}$X zKaIE-KYuzIL7kU7n+&!=Yb1=V+|Av(bnntFV^-n#&fPM*b@`Z=Ur08tlD2lGDd_({ zwiDR2wHW{bZ@46D(e;YAfH%P=;`>BeT0tb>jgTZi4dN}}-DO0^U~l9UQaN|N8l3jSr7)rIIl9E~p}lO5ADMv~$fBPSU#g?ui_ z&91&rkvS04moLe zw{3A`L42>Z$k5pyEAp2Wi?VbiDBvY2kxx#LWOiIilG1~Apy7P%pe>XWosghmAjv*J zc2blYCC*4tl5UM7R)|J9CaSSltj1B2bZZ>7LTVfx7nG!1FH#oIYydjm6}fzz;jjo{jGl8Py6R)CH2vh8nt5Y0ZS< zDs4(D9t43QF~wsfIXZ5iCz|ItO#brRf|vngB)Kw%#{QK7((zIoMYvQZ4*DA-U&bt6 zdZHd0E=lPX8u^mUjdjp)>7f6IVY(TmcgM6$ejiEc=72Z3aw8`Hl`BNy-k9P-emjx3 z5a#57SD1|CtT?hV@xAV3`A%^w6fyIwWCq3b6i9N2D<>}i<;LaWHQAJ|Z#zVH#)^#i zt0Hn)k>sZ` z-po=JaAfNp}L{%LkH~F_bGwxr~rhtQI76WfDOnSDGm7>TEuDT@rotcD~2XSkz5%^NW~7?>2jiRtjGvS#uevE zG72fXc9Yyn(7!SHNK}jQ)Sc4p@wxFYdrm5j7s-fN~*D?k| zu|pyUCPRWcQ|_zsfJ7oi;(k&jNf~K>W6dSC#2q|BlFM=KZ!CE_K{Ouc`I1~3 z(=tht_ry>>Qn7<>WGkHM6)PgYvFydQUPR&vC+J5au?Y|X8FRij|F5sv(!hL}#&IO+T z-(#p}2aXgNNW~7iGh`XN1GR*_Su{!{_ePBJ*pb}c7-iW{k=s{+#wtWY*DL2`P&ngb zBhLMe>0U~wqX_ zu30DS*R0jx1uTXe$CWWQWEyOlp3Nj+>6eo)+Zsqraf1^9u;ickbZ9`Y^tbf z3Wn{;lbnL2r&c_hnpz{ZdTK9%wHt6vD3BIYP4(1aYg1FtqGVlT7fILSub|ftQJrz~ z8nh$1#&jY*W;7LP7^^ImjcydnhEX@clj{Z8^v0~uG?rMC`lQV|uW1{qtXUn(_aUi_ zdelG`Z+@C-X^RE{aZt;cGgH}_tsMJEW9u$n?Lb;mH2oj_8(P(E8xF41mo&BMLj70e znYLjs*uV;NzqIRKA=`f8bpfwyo!T^vI&>lTvA0=gpN6cpBb^P{vz=}x!C?B5{$y2W zNT#-JXyv+a_@5G|gX?6FwV7eGpX;T+RuVU&8yS%v&z_oM&xP5H?oCXMX-Q*JFG;bPtHsX*3xGlK3!={s#iVYIp)cb45O%oSe*0 zV?$FZO|Otpmj=I0O5p_S3VxU5nasPK`5`IUWFDX~8vHq_Ry^}-Qo70f5}`9Ek}^z& zTM0MCLsFIcCGB_%J{YbZq?Xm7*S@?OYns!Ji`gC5W1A2T`87#^zQ^Tx z*+IW~#OQpJn&)?pm_KLXT|w>ePmkmWxRAG#_WoIs={9#YT{Qf@ky$p!Rr%3KnUm`m zS>WXQM;6=M37Ureb0YWH+)UPTZe*n+d2VEllN%J-;7AURY_>UWkUuoC-N_A$?6kS( z*y<6H-A-;)WUtL-kvIHHBl~RbFxxUN@{`SdMv?1hMZBPC?G%>GjwIWhXj^Y+!3_i&x?p}J6l~yv z8%d(R3vMD%&jkwz)OEo^0(D$)Gl4W0+(MwX3l1c+(jVbf)xakT(FWr*afQygk10-0pA5{2n1d5Xe1PB zJjm(nCrRRDfQL93HxX#$f@cUc9Av|11P_lbk@IYB0_R?c46(T}oZB9`z~*?i^Iwb% zb#gC7hB>*HBg38Cj>rfn_ex}>lY2EX%E`SJ8SUhDMlN)6|BhT_bH?T9<(!)u9%yq$;k57|Cs!06?&PM2$2hqw z!r1}OKTHiYZC;$}|1TJC^G`vi%|8cin?K??=}^$N`9GXF9JFmd#+jo*UQ5ysd$Kpm zgGX&|@XuQNCxX17rj0+?_kI6Tn_JGgB!670IcIVa|8ko%lVh@2k^{5~q1qy8 zbL7Nj=0rF-!fIfKN!R5igO}{3{ZmAzTG3#H8)ZbBdcGO0J4nQIXhvN>!v=9C2N!)? z-Z=S8&a{wtGN)S7OZeuT$+Zf5Y4Kd^uvf?A&f{`z!d~5Yu5GwhUC&rx4Gg%MS~g>B ztL3GRr{cT?zYbc5B&W_0)TN$(6{Sr!GuWh_@$2W54K}T3qwpYSGV0kVG^?Bz^=uS! z&<9)9vr%X=ZR**PcP*(2wyS4H9(Q}NL%mL3Du<3SWP8y6i3*2)p&k9>WzK1~>akq1 z2dciAGyPHZ3eF5f)vs~pTvTl`=b`GK_{>mLZEPP=ZwyTkgsbyNufePaFZb+jHl6T% zHaHfa!T$#R+gYCNt#O|bFq6c?3^&rQhS9_+FLgWbX$yX1y&F#U-(WdY*vNguB@XhA zo#gpuvfwz293yCY$+vE(70k45Fw4=da0815yVXnf>KR{c_6OV8;(qnd!vu+p?IvVw zHz8xY2^rf>Kk{UEJ|;*ru7`xzkV&5RJD<5A{Fup@tIg2x1~>Dhn|aF3Jnd$Ti_BkK z_lJfzxo4j7BD`=ntuOQH$L0gSZ==TTQjsx47LhkL$u zh4a?;z5I^Ob*Hm?-Ra_9cTRDyJ6+xD&Z)TWH029g_i!uI+<}}q4L;^M#P1RAWX_oN zVNYC4cf}jMxiFxE7n-zmfv>nrd<{CIy|`OG&Ff;R~y zyWlMXv>1%r@iqba7YDm37k0rr1VS!&mw@kr_Xq@C@IHZn3qBy=xnK{0X30*q9};Lv zH{@w+jSJ}}wF@pI5q75;!67f6zSZ;JBuR52+#U3f`ld7O!o>IDncsaoS(!6`_;#}5 z+1Wql+sTSA5B{INovchI7%DRg)~C^#P-vgA=sUWa`{59lTjs{KZfK?LaC0-b6u;)I^pmGgExN+UjxkjPw_MEwmZ63mnYXe@pw+QWa&b18T#+9dPzg1|TJ@+V0 zPk!sr0h=4h<=TXPvblTcTX25Q&{3N+^X<8zS$3sna_5KUIJqIAvI@ByoZQgR0w*^- zw8+Vg2rafb6U`$-OP$=P&^=CWbZEJgyD+rU=8P>Dg&uZt7l+n3xiO)~oSU313c+R@ z9FR?*sS9!lG;zUr0*zfTfxyWw$R*HdgJWG@Xrs-IWuF#?HaqrA4Q;bIGrtyvwmZ4$ zp_iQ86`>tYt~m6nlPd}Bv^ics`lX@Qo!pGj8#ZTFnOBD13VM+(6oV%C1NH(k-EU|^ zeI>_Z6NI{%Ih!NYO{N7x-DFxK)J?o~K&YELpN@Vz6Y55+lb>larfWL;c7`@*PVuAW z3=dBKY~Rk%<_76}-_FqQvN^+iJ42h87~yA|GG>`S(x>lh&}Mu$+PBlSnI|vwCz~@S zbCEyA^H-B9e*WquCpDvIGPEqA6;e`$XVR=7sd*@#Zb8@Q|4<3zq@c6>`&ZB`WQO~f zScjQK$yhiH89O(aR$U5*A!FwTWbE94jCB|?)?vt4hndVc*J0!QL7s2?SVqsg%#>9t z=-*(?GUN3|m}N3I`DO7L=Puu~BiTHDyW7Y7W9FED__*DBn8*A*ezuh~HQnpy+nkv> z?(?TRxn=$=n=>7Kzh7o^=F!{=e}T<~s0;j+{$iUmGtMgi9w+ypztZN+T=2K!4q@=Hzzy^p)`Von9F^iF!2jIPFXf=LhGcm_foF9lR#RGa0jd zpPOQ1*ktCV*z23gT%TfN*ktCX*cj%13@%8qF>Er6Qfv&H%xx()hPjc!B`Hx;kICGb zGSFnWD}r~W3~Iy!(`4?UB}lU&@%+7%Z|dalqkNMgrZ6`>xIBfv`9_<`+@CVkWQ>t3 zQtVv9&t-$_Qs{c}HLW4-c#8}$iR{Szu{kHQ!p=GDfXFI4=kVx`Jd|u?UZ)a~)wN9eV{$;`pXnye zVIEnVVbY}()nS=4SJTTy`&X+%l6}2oPH;2 zWV&&C-y0OK_XFFHrmsI76Xzdg$I~C@nzV_5PxDRM^!0zH$7S}Fn)C+N|HUkm=3tI| zO|!=56ohHtnW0EzuxWgHq&Qx<)HdD(=uF%ApEy`&)$;ttlt^n!JL9<_rf{vuyKfRTtPLeX9ch==LrRS?4NH$SvJIQWqK(n8Ih<*VhArSs2Hn{Bg_N>wVHeln zo#)RZcrwzrRuqW0C2c*O;Vp8yF*Z4JeY^|jTVqYk(jVwe`$%NZgzOw6`#a&twT^5V z$%ZLtcuT&ZF;Cs0SeQS<(e=_ZDNv?@LIH3H=HCU@#YrhIoP;gO2 zQO}>mQvV-&?;RgUb@l(x?r7I5S?(2Mj4-w_*vJ)Qz<^~-wj|4vEXj>HtX0;Quv)Y$ zxzLPF522dgObMZd{tz(DbP@;<;GrimC4mPBp#=z`{66R2b9V2Z)spA;e81n<@B7DZ zUee6m_nbNR-gEoCvomB26Kc<2Pwp+)S@+;y;FPvV52r)*e_TbIm@_ z?E9L1zS;LP`~GG>!0ZQ_{UEa+Z1zLUeyG_GGyCCYKf>%sn*DBOKg#TPH~Z0MzlYh6 zG5bBuzQFAFGW)S+zqi@rVHIlM2cL-ckG4J+`={a5NvB`K*^kB({Y)vK%xTij^UWaR zH@KX0KX$eh2G4Sq)6eE^`F;V^hEO|WtO+>=P)Bh{Ztfl;C?I7bV5dV1|WSFUtKk#7D zbc9~;ss7&!M&1iMbL-u~hJL1Uo(&Rg#Qb6(8nK#A)K9#=)u6Nmf064i#d!f0vb{{D zL}rz~Rwph|Y4Z9^=(|;JId{<5oZwl5jCLBi1?fQ3{$^ij_EXG$s@YF7`{`ys!|Z38 z{Q+h_%j^#{``KoHkl7z>_J^4L9J4>v><=^h!_9uK*%z7pJhPu~_QhsjV)hHn{{24Q z-W1+run$afo{u>dz+{d-UJez~ag@@u1ZGG5e^gm_qdd41}wTE9@9k~hm)>&a%hEqPz^#^jyJTQ^7C z2n21cJQJ4pZEXI_9zL*#5AES2d-$6@d~6SYw}(&c;Zu9~%pN|shp+76tV%DnFk9)< zAk(MW-|=Kq+OYKQ1v=;~FoCk_1UjXy099R}jm`pHRDJG4r?dsSXj&%ajMI#YXL8Alel%P$ONpsqc&T8VlOBw7(t~j>1taC}Hu87Up2=|G z+Y5o(;8yIb1Jn3}sKM`Sr-$NQ=uI(^yO{>sfvNVKeBe`(!F{-P3rVB`h*uMdogOAX zlRgF>ruKJw@GP_H5O|!PLraD4QPQ1qK9O#<$H;-icAGgp=@n87Eb!;N z0|M&~13e&cR2dGlNU)BiG7ND#46!75qA|xzeR)an)ZQ;t2WEN)23C+-+Q_1(k)psN zn3W=`{2^0Mx*{15x}zFtz~4&_uEppW2~KA6W|KnN68PtQH$Fhu4>FkO_yA4%x$f)t zvhVaq<_%EpNL{n;gXvyeqs6pCl6ocvdLTF{wyzKg7^312+~#|ePRO{F8MT=bjoh>X-%VXhMe$lc8O7m2$_J@n4-b+xQtlDK-6r#Aj01ZG$)8j-Mg^~g zV9LFl(Uo!+1h2*QITV$bdYjf$~|8BwReyfG;J1~f#BP1l3T8kw*J7g zbJ7d@qz5O7ur>0@8JUqXNm>Pwk%@ZApeOg9L6-ziF&Cimb;sjLA36@sgT46@gso+x z@?olr;7JJbp;LrYG~6q7S+As5KBg>aYoIJlT1^F%HwxQ{INy)l{%>uqsH(<8>00g# zN)KCC8sXr>xh5AEN1sY9kXl-Q|}&XnWlkwnUYH%J%< z&2|OPi)=OyT5<_q7CANLxH3Wy&G7v1b&)etj_V_5ryMs&wi$5bLJCUzZ(RiM5ychB8B7m{t$B~G2nHYT;8R)qF z85!xgzKs+(u3+v&$CZ;i)w;}sL%F%Lt;@uCVD4N;a&T^`b(xqA%dK`K_s*?zT!pzS z9LbrvtE|h!?!esDj_dH;2J0G6wqKCjWL?w9wLEt-o*1M)dLLS~PpIofzxd~Y0uShZ*l0Qav!7aM0oc-#h8~h9!^L9W0S2+EuMFPnLfLn0^`%^T$1Q} zE#)1X*}k!PkP_PDIL3WaS<@?`d;G-_nzYUR&_+MVs*)`>UDnvm{xt|PC?>6Pu*B=kPJrlo}Asv9H1WIbovwut=l|I)|K(`}={*+TK2-U-4f^h!=Dg?v#8>$b1>dQLBi^|A3!C*fd~gj7wXl+FrK2i5B} z2{X!+8d)p}RFL7R?z1JK#M+R8){h?Qz*BE{XvA9XlUzH9NM`G2a9suw;gr$FhtsXH zkI7@H09$uyZt@NcpGecvaPWXY<8a`zz*y|d3$Zh!tAlZp%)r%YPjDWpj^Q`jVw~ z1B}4dEOzSEVpWeWRQ2qFPd5yU7ekW=Wa4Dzuagm%N%@7=L05V_KEf zTiur~a9XnCA!Fq9N-s^i*9>M$Xun)L`bcKC)d(pY=yu0Iw<`nPX$+vkxg=1EGUI=a zJTu9y%DEt=C9hWrkG#O8#&7{UA8@I$x|~zRXe+)eLbPaL&o4I~S6Rn)Ygx~Kt3axp z0bJ$S=zYd6|7fHDrq|G`44!TmB}jb`-*PiuZ{s+_&+$z6&!_1%{}$YmLxZyafBV1O z0#&6|wFMLREof}5$9tynmgqRW$$J{Tx_DZ_#MaiHw*B#9>7!zeiGrCkr%j*TxaPpA zQ)AN)JaFpl#%a@Lt(mo^5ho2Z8|&*2sGl{pJ~q8^U$5lgDeF7B)=g=y?`rF4-`Ek4 zHq|HUrzDzNx|*VR`*eKz6ud^+yh(WqoXJ;9$H}!S`SC~SSw(tQrR!Pc=vgItRyB0D zv>N3pZBckXYv%qvv+L=V*Io5p8>1XSuMsLedG|Sj*WK2((QC)MyghlxGTvyN@Vd?0 znZ5dEuRXRQ;jNFicoY+}i?+tv*Cv|1?)Es|(;cH1k>dvJW=xMJaEpm^w54eSTx+`O z*Ty}(>N}2?spG!XP4Q;DAKctFZ59OENiucS1e0{mCMB(;gx>5-LT$13MBIx;i)w0$ zRz_>fjwp%Nt*kDIM!ovD4UpH`fh46+(VMq96nH;(Q*49RMSqA>)151_~T; z^GflqSiG~NJs$I#o4TTjj&-qiiVrN)l4z-KjW*Y}H^rOl*TrxaZ;m$9$7A?md`o*2 zFZuTPrQWfoXfxicjeJEWSzq6hKn92>VEb5o8(vW!MM&Za-0sykHNn5Q*I5sv()-gr zy!#xlT~8*H*A`1OcQkn|Yw8=3POUAl0HU*|BWe{mDk*J{Wb30yG3y__T$|!$Y+`n4 z>1M2IMaWP%BMoahI-_fv@V0Vmbl0B5P?Wr+llVrw^}Efy)8A|B zK!A|Cawi2h86sT5yY<`GA~=b9jzrW{B~W3~tSk1jZoK$CSqGHX)m2BAmDJRh zRaHi(MW=cSOiKsTZJ9{cARX=Ps1;FLTJ7fM`BjybB`_Wo&abGdEwLILx~Qb2I$Bf# z>soCHV49Z1hGdwL0jYX%NLQ?_9_67cL&hO26D6ydGK?I8LKZ_Vis9|^O50V~MNKR6DSaOxN@W)1sEf+Ft$|uw+VFJ;mPNe*393`@)d5sVNaFfd zR3TmXFoD(OSyPxgC~1fFak64JWqm$IO?^eKrY;y6*(i!2*t!Er&pCkZz; z#~Rns?Va`XkpyWRGHaT6%O zMl>^sV@o{R04GWwOcdP|>*|QMceJAhMl)=hBFIq4kiBftq~?hl($-jgJ4FOxK#JIS z;SO6t+Q^{{lkuqTG@qSlY465&AW)=`sPPu0zt^!I0j@_B+tFsj#8DFyd<_C$+OS5q zq_eFthN9DkMj(z)OhnsosJAtr6K7P|^AEv*AKzGK_;MhJ1eH+U8m`RXwEDP{kU*8+iW~8jicZvZ zRB5rfqMgXOiDuJ8lINx{!zvrR=4m9;PDgxr1EFe0f6JWU?(WXD56wqh ztl8{oigtET`;UA}pZAEh_n`AY866+xsc-GJ&9`(%`NJI|fGVb|KH7$iL#twdO1a(y&(tcGcg4En=5s6JG_5VQ`4$+RZLy}7`mPpuVLM*vVc2g2 zp_hTQG%+xhiDQD+4)oAW_r!~Kx6{X6jCr}`p&Za^G7a^dQHwN1ZRbriqqnC%Hw4nt z;YpW~zOG}xU&P-sGHDZ!x1#0W;7L>5h1viOL?c3u@@*}>rn|k-BSG{6(aG&jG~sJU zUSka1pm?ki(ddb_dK(UydXU*gJKOA$q=}-e$71%3>SKF`zVdq0;j~WM9Yx0UR?r=b zOX^CiidoV!uX9~&quG%MON>+--SWjovT!v32%c`Sv&BTPf zo?lW^Cw<}hMIM=@tF?Y3s$A4ql)$DW*PCXhE7sUS12DQw_tuomuc|4IRuru)sj*$a zHg9q5!svpEs^!t8m1UJ>)NxCalA4;Tnv}Dqq_SjTRb5$8U5N{eOz$sw)AE`!(>F|l z1yEaC>gq-R5h`dfVG23wd`dSH`Zfw?6@9$P2rWk1pf*%+mskenw+c_!&<>#Ax>qVwy}FM(a5cxg=oJlMyFp+F&s55G<6Y3iY}!`PpCCZT?IOG zb2)= zM~F&9$%^@<4l;u9!$C%WaaCn9bO=(d%?HuCviXZj+`!B)H6xsq&&kXwXgT`vm31~! zNnZe|)TLxHf@US6%W4*^bi|Z*%cGSgE9#=vHC1(0j+72V?Q*uM6VcilH(X-7jg^|iX zMAKC+PpLE&46YW}mKH54u~m&J4qP8oTOxIet>vQ&mR8PpMYzV{Hh{Vxw)MoU2c0)I zm3lPy7n%7LWf-pgxQxuWvNcA7UmvFeljSm12h?|$ZWpF?(f>#j_RtdsGN0$e00^B< z(<4S_7b6Jcw!EGMWZQ5}Z-DKV5llkVO z>6_cDO&F%OwzS7&e!-+dnw+TsyD*!9f!o@(7#rEU5r6pzq%*68@uivMwgY$a+HuEC zqDJGG;Gx+^`l2SPVfs8L4=v5dFk3JUfqp)gEif)duMmB1JEMV0pA=#yj^=mF@C0AT z>}YR6-5(_zo7D#zz|n{r-K{R_d#-Q6I1^n=nzQZ3V0kV6G0Mhpx2dCz=SOLdJ2~6V zjE05?>3Xb7ki3bIJEWEw0?Iz_cRZssJ%x#;4R-R-oi>QK(7bAWJLWIqCYPWCjOg2< zpf4t)4*yk-nFe#2iC9E$T}vxw>tqN>>k84P4kRaK!nGK^MC%(H(X)mnF?_}Zi7RQ+ zfXq#k2$UXtj)YCvfxeCg%|x($?92k9ZocfAQfy}}m^xL1naoH_bTbmB%$c0IF=GY{ ztdns^9RZu$DK4%H%;Xo(jhM7#J#4|CAqAy(W3ye+Lf?Ys!pI*x{MCbEWU?MF zW2kKA9weRVM#K_w9i8>CKIbVrA=I^DO)EyWJXM$IqVA5J4y{M(qS8qk0^OO$gqavM z6&%$o+|_7k>G0;2Rbeb<<7ID(I<{>jmm=DC76YNQ| z4VYcBACKjL)98gyX}Z{nfJr3l=EXPbpgS6y@m1Z_;ErcPOo5=~E}BColhd4HD{_?m zbgP|GN+5P^m`GpSg_SL=N_3dgG99@PD`Y6so$*+AQ->`)+zOyMu=OleAI6|mDYb5N zO0NC9F3q=M?yC(2tv!M3G^=8!Za9Wm62yuQ{KTwG7cHNeMKy$!CK~OWmMudv)dO$6 zHT69m-CYPOO%P%#l@?D-(C4Z)EGPZ1O@zk1%Sdf~eD_g%*@m)L~?SUT-w1FWno~mb_}$ z23s=hKe|vL!M>iQn9tvf- zni+DlUO2C+*bY3BYLXZOFSB$?6If}nGZHW}Caiu;B1=FxeJV@pmRHp*qS2k(%TES_ z#f)FsWH`o^B^X=VF+&-KkwukeN>C+WGFxD-V}4adR)4E7c%i8~GeW_TrKU)9^PC3F zG1R6Tq?da*X#f5mEJ|W3Yq5Aj+U?v`+593JcBK2n(JZQ_Ayzas7Aq|&D#jFQS~BtY zBQ@s4c(q6+HtWk2tzBAOT~))&=Bey!ri#dXG&P&P+U^c`vp7m5?x$XT++KhMHPngq%+;8rIlGO zNQ%R7X8wYPp=C8#Rj#fnTZTx|)Kj`D)Kt|asF%oaG-F+i6sPrhWeqdB=aHt$W%C!7 zrAq@uQPnLjt0aAy*J|r96CN!tsw>KNE$!imR4O|)qvT5}he`_tpJHJuw9M;Ljb#-` zdj9`P2TixAxSBd*UKt966fG?V!h-^!da?vx>Qt*>5TNaBrzs9c{V1^6U<5Vej({img^>TygtLx@1K@pOJQj{bV4t>0nc2Zqm`Pqk@-|J z&Ng#3w4BU~N4DE%2D<1h^5m*vcPnn!K^=DmYC&{`JUT8fszGak zlS-_K%}33GQ)?BR6qn3fisz$nX66Fz9nxxmqNOueZH_ai6{uAz=c5|KWfNICnP0UO zS(gHZg;%?X8Mn_E+39X-SFzl-lpj1|hy@yx!P$uiyiCOjO)f^rP&JyS89t|9TU@ma zl?^ia;-X4it5}(K=K_SPIE~Pz>+JerQ=r6QLvtt?uK zMb#QS+?aj?W(pT09Ofoe{OK3bpwBBSE-tA|^MgFk3@A_M(?v`pS1nhn3`fmWO_RLo zMn&etWGRKO_fW{xXkFRjlB%WY=A;I{q72jRZe$nIqLm9ON-7s-(~kZ%loX>e!_@17 zA{6v=8^HG{3{+N!DdMUsEb-RhNj_IO3E(*`dzJdh?!~2*$qon>p^H&^>Cw_O5xUx zB=#a(Q8uq+Sueb}td^`1EvsHO>qjnE(Xh^}=GkU7Js_qZWje}aAC9-}6Qm0oQy_h! zOY0WQ?!`NbN6GwRTd}9#iU=(2EdnU&F!FpX$kMZ$SpA`6Z-Jzx6R2NUQ8f=HO?H>l zeL?O-DJ(;e9}mHEuOnRo4?(Pm)}nXXTkw0mgG?J;Hmj-CrOc{X z(ehsWH2DSvt(QwCLQvn!C7Uy`28L!MiX~J$8IT#B`DXNCEp3v9mM*Cw`{j2 zW5ANB0^_1odpo63LZDtO+9>tV-X9CapnVhi6&N-XsbsEPeGUnMr!=vx4R^ReGKl>beqmfR8-r ziY2p3t zn7gYHddjO4zrmm-AiFq^htAAww)tg)7BxRipr1U@g+_YP6+cu+x?4J% z(Q!4?{s>AB9(>0HtzGOl@>uYXH8$a?%5JPj$)kugDa%V3n9`)*Jm3*qQEQ&%Lszz! zB_2#*BMe*+Df(${`=pWMd9M+6uG7PIDSw>{?v2TCIoDk)xY#iU&6S&;Io4C<`AnCY zRB7qtg)jVmCwWd!B2r$!OnxjubJ}*DSCY38!w6nzSksZ2@TuTrUbC6PaPy-LQHck% zFpp39#zXFEGV|Z5!3F)i!(5{*C%4#4hQ#3CEoFL^oW$m*Z|!;{J-^kG@%l37n7 z2W2g4l2Pv`mtKk6C!y2VZ1Jcw79nuE*R;m##J?yI`?$WO*_wXlkfxq2qJR8F+GJ2? zpDu0biE{1J>oq8`@l9KQG@+N#r>S1-&&Uj?Y($T)((jlEm=v|Ona)F2l%r;Zdy8g@ z*)?VR%&<@_8p&camO{uw>lYhpdM3&w(|YrJx>;?&0wk7&@l&jx4qCpYfi|9C1ohUV zexip=Z7eB~=>Y`uc%!!l6_Qcf>EY>DuYp!&X!QcCkUh;KMxPtdUs1im%Zdw*H;2(GdBX<&Cat(iObSYO`?|NnyuEZ(aGZxXxuc^L^_qHYtD# z`3m`VoO|$Zs>Jn*yvxbPWVMGi zc-NGc_Quxkrr4DF`mV-i{N@$Qmfainr#n|Qw4g%o{g<@=8+^>B!ugHvkNnnmN?Sv$ zDbX6ox-eR$SSlXoSql0M60K?{&?Xf&l7Uf^Cx3PmFKi~noe9J^;}Ys-^OFe(BDKVf ztE?GUu^Cs4{FA~)u>!e>~;Uc*b zST%02g0yUF&$`?32u71V$M5Mmli|1W69S=N-jHBE@{x-__X45*d6Btc|J38Rgu?#U z-j+~)xFWPqS!ncDvk#Yt`Tz{A42{ESez+<$t|aWAaD2J{17zoH2?g=-H*$x@fs}{B z;gdq+PYnCt9=9dzpA^^;%EN7b_=HfXA~e1f3d%#{=?+|nVth^HvycaW$py!bP(k?Q z&?E>Il!tPS@-bUN1H+3#xnP0tqTo;!gL4CcP`|v$;h~Wbz~9jDVuX}pVMF@fapnHS zfmBH0Mo2FXq(b^Oh4jkoA;onH>D7TqB9yb0Li@+#A~##KBb0k;D3BSdhY_j)dBLe8 zVGoM!J@9qUu>W)*GA9(Q2>W*)_gSca*nbwm2v&yuTkPfYgOPVb`S*u{{(Z1#zeSx(Liv7Pd1yD>8`%LPjR^bI@WG$4B{bBpq_gR;@Mp&c#|1)T!~WU9^05EOv6QU- zWyn2ymWGhQ@Cm>%CzATNjx7(3@vjV)<7^9(+`l>)Nre4B(e1$;mHO8ODPQ|}h{-#&g@!F64=;zrq5eA%fJKnLC~~_!KsFxqDfY0+ zCZxfia&g)B zd}~uVP5^u)A1?lR6LK#s{wt`0^R-RLrp7T6F@a+LRgl84e?!Pt3Mk(D!4vXwa5=m* z*CVhi?w@^kC{h^;ZAGj%eFk&*F9QyS~2th@J&x7Akvo*ZKs2L8AkwEm(9`@=p9?+91ef5ZYQ=MOPe z(=!`w#`#ScasKT_%EY;0|2p`JNWQ+2g5}=`SDyu;+(n@QOH6>E072ilB_qS$7p4pw zc`xigys_MW2w`@Pr1+6=`DRoQ4?=Mejz|KhpJk|d!l?0gN6^Cl;K&>bjeiF2K@Ptv z7n#R@`B$7DnffB7?N%G2O72* zxq3@zDpF@6E};YrqzamZ;3n z^grrTPG>l73GIPOb$3)B)Z`7Xp#r?uqR{Ssyxg=&2tBH$ZSWB)zlV>5{dTe$vhSqD zp&9TVA3BEqeuzcHR)`0M{heqPN1TXqjYD~87?spTq5NtSOscujFpfcP^!t`0bE0q| zPopLr4)JifIuzN8z!0xOAzhDp?z_lmCoBq$SR5K~0&ePuN^YwpLmz}b$A1%T%UFNJ z4 jgqVK49)%I@PXwC$mpo(`|E(U=tX+iM0)h8?cAzBspGP8dGOEW%`vyYcyvV%J z0J80t(137FXmkY>jW2t_FQD@tbZaEV4jm; zpWUl*R_^~JjvV3tJRcrSqNG9j*&6bzL;b%9`K2gCAK?x}>im4vxF^6%y8oomuoKxb ziz0^yN2&(p+T1{%|3=Seh}~VeJ5UscqRv@_CO$O0G!!rm)ZH)@!f_W2hZdm^K3$9I z4f_*9=pCR6m~HaGlh&XQS@S*&W9RtfprS&3nPK6rLA*RPtvB}j+(2k>-VkWdtT--3 zA`Hlj++w;9yAo(f!v3{=QRC)Rgm(X&YEd$lzroa5bbSo!_P!=<{{(xFA&37ba0Goj zPWzQ-#Qm|nKxkav7h(V2Ze!`^kfsApG{xxFZgXQA*@2AUzX%ybKKEYQ2bYBUoEY}6 zvBGcQQlAq;IjD%Q1VJP7ClKnV;1rfXcn721M><}B%gD>0=6!}11C?0*R)n5J7nM=z z$i2@v2ZtAg(9~1;q5K2yK1bPz6qDJ5{_x10&w~ZZptr+ld*$7Sda#Ew+S4!uqJIy} zGU#N}$kG`!6+q(vDsL60m{LDe_mp2j+T`Wovuu-57$ENXSN5Q<6!!mys0{Z}zTm-S zK*RlaDRL%?K<5D=vwsX0^b630eAZp=pNUw&7E)mT4tvk>&&f+KF#Rfwv2u`Qr}`UV zAymd;|1Xf;8(N?b+Rub`bff-``V2-Jjd1lvbjW!7QC2f$pJaxb8}`ICWY9VvunN&h&)i=OU1h%qJoi0~3)?Lp<}3ZRYLiOXoS9?qja-b3Ayn=_iaU*-q! zv15b`J?BMK;;8@fw5<#7L|x!hmKa=$ge?y**^1g@Kq`j}@SmohFRB765y-CB_Wg_s zOzvh=Y!Jd^vGMN--cM1_`?cYi+)>+Qh7VHI^Ug7RNCrRI@L?JJ zaD+eTrQ&Pmq98TU@RZ%mJQsL5%`l}tYLR@k-T5?4(aYx3yhJaX zk1zZ6w(_cHBid8R!r&$OrInfA0i)1H=R=1BUp_J? zfRDbDUhXB|D{!63bHA5*hA#R}dL@MoAMZMo=YHyw8%ahdelPWm<(c(~<(c(~<(c)v zHOM+NSF5)>G2hi2ezPaeyne+n*uJ;!H_AGWIb-l?ymWBT;3*QEw{HQ0+ zSL2_y!?T2wYPR0|eIiTv-^*g>!?Wb)BeKNT1PZ$$@Mjv1i*Y|~5I5T}#VMS$iM)03 z$Cls_dEvA9WOwLk5s2eu4sUh%yL>MC@uqOIeZ)u6FZ>hcTK_Q)clF=HT=YvzdB5V) za_nR-{)#;12ik;-{PPxj6rMSJPKN?MKM?$2KBvPtKA)}lD(0kT9iP)d;v(U%;A@?H z6uyDoQtpM{$Xx6r;TJud`MPk?bE4v+=L_Z(P6->Kp>WeC{%$rdtOGL_{lcd**LIuh za996ohr4!8INX&#mAQoH77oug<`N#^7dd)d{W&Oiw27XVtkcxzE~ox0ZL%gS`bB;q z>k%&U)PB*HVF!mVwIXI;$6V*DRm^q1I@{4h?;MwHCZCYMjRJ9;>+t0cuj6yEgU9w- z!Cc}cd^K|&FUkL+XA0|?tn>(X!|B#1)hthXoUeH#pJkx%xV*`cr+QEFd9(6Y_{~aw z4u|tLB`-XmuTy;8a87jiQG72Q;ZcVV7?hdmiTKmoh@}b-BcsIhPW$#Ds$3fz8k{s zGaPxBZ*$~}_?!+G@j2;t`OVBp|2#gY!)<&{@-EMTn>MmryFE4gp$?b4L>K6O+9X|y zg4QkVj--q5Vn>f#j&!}+zpGuE|A#nz zltZ>ANB&5GICeT*@+4h8!{N1#y!cQ07d!lZM_%$OU4GT!G^Zh()RPk56>OJpSzh8R ze4whY+F4HOPmvcs+Nqb^^qQ#jT*rE(UKKsUXJ*kO^(Wb(Tq1?z3P--q;Z4fl2iV_c z=Hjn#DMzGV>N-+)8S50g`F#I&#Ro9ImbvH``Rf%I`FoU}y;;xwii`YCrAOo+Q(WYC zF&~9^x#{vXbBeEPw}Eiern%d1oMJ`HelE+4eM&j}70ksB!lhqF`WqZQXFL8TKTL${ z(jO!FBOH0@cWHm`%Hpro8`@u~AILt79Q{(JNZ!p4qgjUdN=JS&pG$cD$oXxm;?lm) zW-j&-c}XMTBEN#=$zPEnwA$hO^En-)J<{=&I!D4O`Xvu&e^;|kt>-r8T94#st>@h= zdOXC3Hmyh67p=z~*SPt|ZFkmKm1aLWi~a)UTECmmUH!AO=+W($*wbylTs?KHhwSOj zt2AZN-^^TxQ_2zLTUUQR$6f6CkDvuZnTsCb1qYR^AEcH?| z-z!}5xulWUS>!ueUbx7g%ACUE+WBmUyYb!ba5tYzJ)^^OKg(->pJJ}d3uAh2#>_uo z!1*V_7lU4yvzS13t!FQCHZlVo*h~E-?H%1oRq(= zo-?!Xm$L9aSRbK{!ZY5UnmwMMGMnajBD`0A1fDmbP0Rnn;S;Qg*^lL=CX#pg(OLMn zS@=9oc&+D_EWA&y4TP3oorOQ2h1*XS+W79{#4DPY((iKn;c_c4d7C5$@uLqE9+$Uf z;a6ti{kS0{J^MQ0xhD%B-!BzTSN@1B{KhPNRR7-fEY89=XW>scd_O1rd-9Sh#mnVq zX5lYo;iI@>(t1`qe3Iku4Gy2|@V{r_2MkKt!IeKV3x6pK@52ji6i&BYSe%8QmxVu( zh4&kh3a6`oZWi8?g+J)JXnuX68 zp0b0hXH6FVCx=gU;yaEXO`!0&{G2TOl`NdANsqpJdVr&!i?87aI-HX?$(Qmq4yNI= z9r;mwPWnmDY3n-uTI{!0H!!n1sY6?|OD4`lf_6@P*C`y4LO zL;Ww>1}Of`o|a30L*&P>+yo_Gk!$6p|1a_l%;zcjGk3T0)rxOpex%};GH+G*8aa!^23sccIbLK@#{zm3Cir>e)QSqmlClr63`ALfZo%?e#4wLYBT=D-($^Vu0 z+@tuH%w?P;dctF@{a;t|!lFW-`EL||i`#{#6wl-O{58c#GpFYmUHk0M z{9lUCW1h?7EU{-9^AUqnOW7Jk0(TDc-^IRf-?a{HKba%Y2>U+nH}v{5IyN zD1I07^A&%Z`8A6FC-d7Ce~0-)ihsiVS;eKDeN}OpC;f}!AF~@jw@ORLFQwzgM@g?& zST0ZT@!SrLP<$QNYvUB(zkCvP*U=H zFh5?&?_z$2;xg}WiQ*q}KD=J>gV=6&D}EO9#}v1}OYyuH6u*<@cPaij^Dh)%$#(c& zahV_Q+b2EU_vdsRsrWSJ;}xI9e7fTDJkQ~ZzsT~775|9&PZa-(d5hxTFki2De~#}- zicA0IJjF+{{8friV1BFOGnqf2cn$NX6+er^`Htc;AN_a5t62U^#pf~4jijg7?aT)& zF8$p-6_2z0WW^<%2PrPkFD+91WY$xo_8gX zDK7op>lK&z{l^u*m(%e%#p!u>+TK)L`j;OlPQSaL?Q6y5Ie;*a52Rj|amP@_Z)QDX z6~B}DPZaON^;M(d^4wLs;xf;CwBk>(o)Z<9=c~?9{6Ln!Lh)Of-=w&d$9oi){Q0=z zk`G@{{2|u=uHySJ|5EYGng5`;JeQEq^PG|{^!o?ec2j&g^9hO{!+eI~CorF@IQ?#f zw#AA|{k&Ci>BrxzcsuKPSaF$`|4#8USw77Dbcyfj%!ep0=`vRFN4UM4r1)Q1&uqm% zVqT*7C(LUU|B883@qaOw`D6({es*iNjY?kf+sTSczwtc9x3Zq?il4>&*NR`ve23zf zGk;R?8=1eP_#MpOQv6=#KPcYAJi_BDu|q!d{)&%fK2-5(%ttAHDDwivE0|AEd?oYA zinlPIulQu{w^S%D^I3j{;(IV}RD2WjR>jMhcPSoazESbFx&O39aq0J-rMUEa zFH>Cly*DT>{ocD3mwxY~ic5d}dBv+aoPSjOLgpVRel7E_6u*ag4zG_$zIufDAjSWa z`QD1pWjzJ=lJj(n?#buljQ~UsKKROhb z@zgPj|C9Bfrg(t+c^4=?fcZ6wk7ItD;s-H*K=DfEzf*hz^H&s?e)GGEpU(21Dt;;R z?-jq9d0$@tlKk@@%ttDIKl2HS?_@qx@n@OOQ~W*V)rx<_{7A)rVBV_uaPGGqtN3W< zXDTlJ=_?gKgynBjd@=Kf6+eRc3yQC0{*K}sn17-8>C8jCZYcKO&V0DyH!Rk8n7EWexLw=$ogxb%-_D1I&X=ZX{$a{r)8@qWyIs(3d) zz_L#9ZOk_+eiQRk6n~5P`HBa5UE>& zE5$El9^&b*SU8(pxEWcLqub6i$p2G{I zTNNM1{2ayiV}7OL3z`2~@fFM;RD2rehvyV;Wcgi+CzyY#_*UjYUKo~ixq$f)#ecVMDp6OP6GV`s9AIAI~#p{?~srb>%cPRb~ zt{)y%{64N{o>yG@8-G+>`Wqi8F6*0LDgHL=&*A4NB)vXoK1gxtCy!D5Uo1aK@c|sK z*^2MQyhQQ+nb#;ji+NP>rOaCum*<~0D&EfWCo6s&^Yawn!u&eLpXK=8qPWbr>`?q6 zmVZL=Cz!vZcnSOaq2ix2|3Yz@cMb6KDw2-3vV4EV?_j>W;yaj6RQyrq2Ppmw^LdKD z$h=DNH<+(d{2k^kihscT1jW~Jef4w2M{>J)k>WDn@k_;}UA|Lsd7j~6#pkj9=M-Pe z{Ev#)^EmB8#pQXDe=08XgnjsVAxXz|tY?_wJSYICCq((;7QW!I_85EzlZsrivOPZ{))>w?;(o+7t5C^?sK^~Lh;?0uTxyw{bLj_ zV)@e*U%~uV#bw^-9>rI1xp-XhM&>UlF7xewR=l0%KT=%g;s2?47t4p)PLeKHGasV( z9n1?9zn}U3ia*8tV8vf%zEJU9%q3q-c;vZ@wMt%|yI8OIFfMl|Dn6dMJntv^XEMJ+ z$(J*~Tk%skoDV53^V`oTF6HYr#if4xtKuiH{vn)?B%IP-j#B(qt{=uKem{r5Q1Qo@ zAFQ~9bAjTrUQ?s^$E@c_#UJN+lcN-0%Hix$yq@_M#oy)e|Cx%fXZcGMKa2TwioeC- zxkK?QS^h!Ai+J4on&Rawzf18s%->gB?Ei)0&#~P+9^Xj%zRG-e#V51=v5N1;d_Toy zo^+Pt7jeAiDSj36O2uzweuU!pGhd_l6U@65e~$U_ipxC38H&Hl@)s-qcjnhA{ta^( zr;0uEcs#sQ$rmtxPw{Q6=VQfXzUE8CC4GZDP7;5m9Q9ZHFPy%k6qj-|L2)TZ(-nV? z^YdYfOF1o9{6&^urg$!wuLi|$W!|p1l*dhqf5P%7D?Whjd9LCkm|vmz4CXf~F6HrV z#S<+5h~gWVKdbo3%->afC)?*k#qVMMx#FL5I?DK1()~N;eR=#UT;|{RQhX)rpQ!i} z=2I09GM}Tkr2BHkOIZF$#b+^Jt9TysgyKV(pP=|2%;ouIiSItlzftnHG7s?cry?)w z0lA7dvivZ`CBE{Uujsju$1)$K_%!AP ziZ5V3LGk6xCoA5}e2(I;GM}&bZ<#Mr{5Q;(EB+AkM#Udve!Aiw*Bj?6-oX4a#TPTb zR`G?*PvPfP#m+LXbb;c9+)iDl_#Ea}E53mF^@^`yev9HqGrvpm)0yv3d^_`ln z3B{ja{*2{z>r>%->afGV>1NH#cyZcp!n~YH!Hr2dAs7DGCxl77VcL+pm-UN)1FXV z#&ItyF28%)rT84y^OfSGnNKdT&-+Ne`i{r#2PiJ{o`)ztfalAK6raI-q2kM!FIIdb z^IFBvWWG}I8<|HHf0lVn@voS#Q#_C7kA9~3{>;}aUcvlW#pQQ~TNOWrmO^HcXKegexsr1*u*A6NW#=1(jB zB=bKg{uc8;D!!e^x9=(b9P>{UmwA%!6qj*$-d>*BB>z9jdd4a)&&++{sZ&t6dyg_#_MLq_h){G;$_V5Q9Q={LB&sI{+Qx7 zG5?+7PcwgB@sF6ltoVQlHvDfYegN~g6<^ByeZ{+(f2{Zg%)e0lHs;?b{#)iA=Oan? zcbJD2|0nZ&#Ru$T<26|E>C8te-pqWA;>R!_r}%ly_fz~9=2I1aocS!p-(o&T@o$*V zQ+yP+Bc+PZVqU3u1@k(^JDDG$_|KWIR{SRB&5G~8ueEc6IlVVvhDBz7u9CltWinlU+f*IXEWbJ@p9(l z6kpAJlHwbgPgndL<_9T$BlEe6KgoQd;(ugbsrcv2mnuGZl8x^w#rJ34sQ6;$M=9RI z{AY?E$6VSgNtd&jAFt$ZVt%sXPc#38;vX^Jrg-jT8?Q?hpUnJf#cP<~p!m<2-=_F^ z%zvZ!t;`=({7L4IEB+qyXB782|G%pEu~Til-co!P%fGMqQOrM9{6gmcQ2bHm|5E%7 z<^gV3B^|$E-be9*LL1KhikC4Trg#f;>0gNc6PfR=K#nXgd%6y~cHzms{h;;%99RQzAeH!41y^TQU!r!oJz;>(y{ta#gW zYlo{9KZoV7SNtaCw<`W9^Sc%Q6Y~cY|CaeS_yo46&;2zC|9s}s4;6kK^8%KqegzN7j3Ek@o;PP% z`yAxRbJx;bSg7Q`VEGz{&$KGcewo7$1d;WvdWVzz0=_5aaFQQ8+g|8&ILSZF@(G8N z{5~vyyu(Re<`1_zoa867{JG4@J`~?M_^0hk#lNuFyFuwWh3&l4k>{?2x#L+SKaf1f z_L{>focF_j+WzQp5*53>?{JbY3X-(vedKVG7rTAsaFYKu%m2&at{w8Yzf5+Z@V|tA z+6tIUzB-rVJ45kHnIEqB-OS4sm-*hMipz6@^~@EdP|lNxqQt^NWhhJmKri#hw>gZ@u>vf0ucP$19ZX*kK#taME)q>)D4nr6bvgu{TfgVp4)_nc__rdux>bXW9NT&XaKdh50r|4_8G- z)745(Ed>_aEe@x6oy76F!{H<<<@!N~ll-VY*kOCb;UvGDBmAu5tC+v;aMBZJJ%4gI z={b_+KX5q7f5Gw}JDlXD-uTAhB!6%OJ8UwJ6uULB{yZLU317>6xWh@$b*x9mog)7! zPby4M@;|Wreh#N_O8qm-;iP{>E_T=sb~wpPd%D2kB>xo4%eYp;)576j=E#$tbnyKr{X6v->LXr%wJSo-mmwO;t8&=LOi~d zc-_NX#?8WCVm?91%lAAEQar-#POai2nYSrEk@+c#i=8h~yqe{2QG7e|hnP$H=5T&{ zL-B#kWt=VYBbfUt3;a}Z`Q74C ziZ5V)*DD@nexl+(V}6d}r!&7o@k^NBq`3SJy#d<@Z+4C@#O#d0lb&UC;Z9zsdT) zRQ!GBIXvGZ>GcohgB6$GYskEm$dBRrcBzs-n0YI6YQK0$Ve-!=CErAiJhqb^PC=31 zb)N2U5|w`11r8_q<$2g)yTsunFXQDK6z}AY!oAEToTWyK=RNQ6iOlHmC#B~&4*v%Z zr|{gy;rZC%Zuq}(ILYVsCGF_%Ih^FBADhSXSY&^aZ({lW4k!68j@KxMll+A&KgQuC zFa5Or6qkON%=3|b$PTl)eLsxlg^P`rD9+7+cckL0po_M+;t}pgZB~3F^Is@l%6z-x z@}9T56raoesD~Ao_XxkCxb)NhuK3xkCzt2##17k;@2&Vw=7%c&Ci5kV7qFe16c_ui zS9~tZ|6K7^%+F^o<+p~*=~ar$bG*M%yq)DAQT!O@uPJ^y^A8pO74z>Ef0X$k9v4bD z|H6Dv=459cDw+JVzmh+PGBvgX98UQ^ly9(iki*^bRpM}xzm4U~98U5wUR&yLl9%W9 zS2~>JWn30>ILXWVhFTm>@-m;$?QoL6x*vAfHaeW-rTm`caFQR~pQJtSG>4PCyeH&* zhx62}k-x;@q^E@ST;XsxoHsF-bQ#Cx@g7H>^lV@~_dA^Qtmpdb_e#&%CN!S+w&F4$ z^>@X;W%&sAUnD$3IXrtQKACx;;v1OHQ+ylqWr|GVF9-_PMBFXdvE;*$U8Ih;() z)w{RQ;dI)-`WHEz^q;`_c7?-9&uaYB_EU$`>7?NXd-V<{J!0o}=9F(KeQ)D@b+jW- zr$@4$;~h?Vj^ps0t@J#GYqb4RacMX2R$S&|pHcevrO08E{-fmEgP4Em=n-3zyo}35 zz8{A(pX+tWCogln20EPLCHZQ!!^taouDihDBro}SvcpOKv=P{0o9b|qm-)K6%*p-~ z{uLyQtXS8_U1&Xt|ylWIMX8GSJUcvln#l_!O6+eUJKUI7i z^Y0bEmib6dPqD)@%q9Ja^Hi3(av;k~`u>uPitTWRQ(Pb9`hUK|NmSCe%Hbq0zh|s< zILRN)`6uddl9%5hHaeW-B|mgHoaCPwfE~8D!%1Gs@%Na^ z`mL15lLuKv-zoWLn1?yM6kqbUz>0fAn2VnMS$?l9@`Z{^eqN|}6YH;2Ji&Y&bIFG* zINa+Ud7ip3cbuf;|C8Ona5&lR2M)jVD@DKLtIL)A&j;H8UFC2(mGt_x!%6>xEPuPh z=~UXg2OLiFp&{5|d)VQ0dL_sA_YNodc9#Ex!|7Do$3HTsbR_$X#6N8xIP#>Ygv0r< z!|C*D_V-^(kEBh@#+^D$p4^L+<`60%3xX6(&v_Ulc>y-TaY_D4!PIkVV)9Vh0lc?mk2OUoGgNGXR z-XjhtdC3niFeiIbc*a?A?<2)Ym)Q=o2azvkoX1?^do0IygyNFV_g4ITmY<^drOXde zT*6)H-KC04eqOEkMeLULO7uL&yi>_P#qJG? zi@#?(d@nwygZM-GiRbgR?R+FYme1*Mz2fp+lG_};pOD0Z z{3X7P#}^V0;_h<-uR3~&C)mBq;qLnN`-)%7^Dv({+?^NwT5-|uaXctI6Iq515yd-M zztn#u@6MA*{U=<;p<-9!Zoh7#qo4S8@)X-thr9im*@{d0&ULukKau=M{t}mTt#;(y z_IiclQV*|oxLe;gE54cnkFC?;RE}g5eH0$z^4+q{j{H;+#_?3epW$nx`540Wy&QSD zm$;kHS2*%+e%|bGH{Xh#NROL8#ed>%KK$0v9`jG-i~zmSb;doJS)k&_P?9U z6LHu6V?y?3;;#Lh9PZlxIezYgL*2WUC_8zaWDb~=vHd^1%&=rGA#jz_!;o&HGCh}Qi zOuW3p#*VhOSbM_QJ1t_?mSpy)_-3@#vU41?f!1C^Nu6cFjh{+!v)-AX7FruZym!Z)x=k+dC4m!iAMf_cs@; z;?|CMEV`yE7K^Trx7e_9k&D(hTX$>6S`QIxO4K*B#^NxKj?((BmPAZPMr_;^>+Fg( zBA@HK8p-Q4i?+73$Gk*Ko6uM@LRJr_Df}jxC@)4E>)SipTN>+Iqg2}4NkUn&u{nmA zH^tV(y1HUbCVrl4kG0+PT}?)2r z!i;;;OL#_6+JsWl(P(^jPI0Tj_HJ8ckQm#ru+b|-j)DDg+}K9PaZQEO4)VrrD8vq@ zv*{E&oE}K0*fkYSpJf2{8w$` zR`*Uf>ad50X8+^j(~LOw5Vw11?=bZQJeyW%uTM4C%|5L$vTfA=WZ#MQoVx&Nw@>7b z=+_aDSg7;C}yH*V2WqN z;^h1feJ7_k|0`IofG#?l_G={W*NntBu>aTdz2rZ2owWZiK!0!kOFz_HWF2(Se*GRd zYesSfPtra$J}3XFi>Cd*C7b`;kCgEu>7q^hbwd{aZ)5-EIRWxN7ysIS`i?gKGV+fx z7I<=eh;!Ps|KIn*NUr*Kv`0GFgZb7vbs@F?(JcNaD6z1~c-Fcy{XZg0{GVd~<@>P| zf9iT_{}*M+|0Bs**#2Go7i7u*XFq4}zuq29{HZIe{XZm2{Lf(jWxUO5GVD*^yVPky zva_GJcU;65DgHFYto>gO1{E3U|1B4M8NWlsY}&6HP|Zm2`In5iC*vyepQaqO|08j8 zZ~n{s;18q|2?nRJ9d$BY~(+^ zN>lrPCRlI&-^}Y7t8v}kv|p#;qGlw2(QEcDxBj3x5AFX!S>m71>j*NxVzp)ZH8V^6 z2fl9anC--$UL~jf{~$~IHD{>3{~7U^k2wBgcQb6;JLX zl-aQjRLWVMNi(|s7XFD*+w5*5ceAce7vfy}7yKqplo#gGQ*;5_RC_S_XK$R#{ZcLu zMLXA<|EIG5v-y5G$o=A;jr)7^|7-UDdKRSoJ0AaXzxe+XPCwBn$K-p5MUXFu{X}kA zmh{{HM=P-t=|da&PxCU`f13Z)I!Ruhf1~=*-Lx$IE<-btf1NzUb{DTNSXZX(S6S@0 z`dxd+^{w_u>S#Vlhd-Ld|1&%6ecM&wl+!yRi~o@&RV-HT~T;G5D4fg(JqL7brpB(Sv{(}ptsabDlktHpYzJC5HS{m>2H`QABjZ~N}( zhp*q|?|I`+Kl(Dld$u2#`_I+ho-coQ^n*8iQ57(9#3SIJ``(Rj`+*xt{w;sVjb7mJ zm%jiboxA*@V0-TOHgV`B_ZL+~H+*;WBiD;=1mmA{j_b+o2i}r^PbAF)UbUQ3lS*5T z_j#cDN_(E#|9eGCdQ-IIf1pUdPXNQ(jY3rOKTwp6S}7|Ec#U#e?dbmR$5uiV@RrEw z#H4QO|E6u)W>jg>CSeG8O%|l~fkA=s{fC77{sTws-hWVF=?D~wnV#RjY{=oe9o+Yj zzCjq-AK;ZC8|DlPlnvPjZDS~8++ix7eTL)Q?@yvAAmec7VSW4JGWaW0)g}9jXZzeZuFLe0jF;X;QBf9 z5Xylw(^L*(NfH~}i+WP-{Tdf-4Hm&!YQ>h$(>GI391a#-n49dc_{9J@E3pfi-4S$V z8m(}j7|v-66h`RKC*o79klTZu0g(XLE_UrD&_+_h8Kj5Cs%Fb@k_XOJ<5fNjo8{(! zY5Ia?q^4iM{E^H3<(2tS~O@;6ZRJ`_^H-LFfj{W%7?BvP>eejBNkEf2%63 zsx6qfZ$V=#X4?yR*1BNY^unoy(+VcGw)V8`k7>-KVvUJ{nKP$NpWV3Tz^PMX(+@mw z>g>j8(`K!iwWbj#4Ko|->kp`(HMKrAy>VZ!uBHDfr(SBr%XvS zw{$hp40(L|l<8Ba<8Rv3DR8cjHN-m_*ToWXa;@T41zJ{-mR0FmRykT$iI!Cj-7T#~ zbxKzhp3j=Of6wfCJ69{ytgRi0Xg5|Q*0#r*3R6Uz!_UL4YK%=kApc;5dJtJ=huOcmHv;{}cx6WBd}Pct@^wqP8I)#dLo z@QR@M+&Ib4w6`YnG1a6}B~q65D)RRzI4`&@=Zf&Ae^Ds-d2nEc@XHV$ z0Dl8p@o9Re^Fv`$+W=$lPk&I@TTMncvnlCUY?l+Qm)gpW{BDY(FJ*YLE=^viIWaq1 zmqg}-=DJXEr9-%;87{dpb=f|1m#or~7xppoJU~xU&s$@7vSmqL`HA7^sH%E`^7h7g;ay$wd$A{p_^GBK z?GE3|w40UBOkbLU9wZ+C#<^*8al8uunW=?$n1Bxsrs6B*zLK~TFX6Wvd74$Xo2f@| zO7k?m>HjJVx4jR{Zz0|Gw5rTrV!Au{D2L1G5O6ovqGyca5?(DYVbt<-*aPyH;-WXL zC!4==AC+?PizZG}iZp-6;ch8A9RATp@-9Cq3+E{k^IM)__ExhOyV0|t zZml9Zg)ilMhVzlQv_*s@?L_`kmYd+n%e{mqIh_3c3%d{GBgM;2_o$N3;dri5{4;j1 zSG+IFAIDtV`3xmLkmWCQxa3tr5{y&ubx$M5z;UvF^ z)F8rb@y&mF0fPN8vT>mK$|`)AfV2Q&NYBo#lQhYr_8@_TB@`s_N?hKX=Z((G|D3dKsW1WOd`8Vi;rV2Nn#6^#W;5^RYr zirs{m*kZtF{D0TlYu~%?x^u9z5~E5Kdl~g`j3H8`q~D!fze^*jVsap5IlNHf4gMd)-#o#R%JFm%V}Oi>FeWF z0h^Vla(c9o>?!@7lKwi0htluqSq+L$$4Nof%A)#TXC>g&;_b{-GR{EfeUJPjt)$pf-)Y8n>p*3NqMO(2g3b7MK9l-5qRO-lT$YR zW3adDt9e1(0}XBZ_6%=*dh{M>;AU9Oy1%17=$$l^6D&711%J*;Hc*fA3 zR8JdGwxNMNcRUU~WFpL;aNiXBi|da%!uu=?HoK{5a&MF!-aXM$#dh0Uc&;`ZhnX-q-@^%)fcRX8VFk++RSKU-^O2e}^uI z7J4Ucg8tSbEo(dIvIjJ7OFMe#K<~t@4j(mV)Ol0~=t>5pbNzUdhPVFob%7H}=cMmZ zfwfni9`;Xc+8jK37OpX0ShsOT-u;*ZuRm%%+WPo&ud=eIZwa1Q5IEw2Dsi2G566M6Y6BZjvM-;-NN6k6Oy|hb#e^;r=$KdQ2*5SvCqJL zgmq(oZ_36;rtcd3!t`A~4S9F%gFa$qByZDpsarg2A$`sO?sGEyp8K4fG-_J|q|X_! z0~34hb0|&xy&I>Q!?u(owlrYJyM3tdOUM2EL9nG9wk67UdLZX}^Lw&Ceb+y~{_gI3 zLZ2SC=>hb2pH1JDhrCnRN$byAMfpf*3q#`DLNoGpAap`)fx=N3(-sEo2xs)%U#5F| zN?$o(2X01Gzw7TA&GRPK^PaoyBT3ikXU&|_=uJM1`nz#tbCP~So|}Gno>x2VmvoN) z&(!lZ)NTjtSc7(J?R;2Z`fUdu{FBOOT7KD)G0eLkYxCPE50sybOO2gSc{0|=+e!&B z#QS}1cNqGcFUx14J(i$d7NdR6L_00Q^BIMk&~9UG*rzt^Z`!q=w`*r41o>37-?UBN z{yNqNeueh>ceGb}9)#MT?e7{ZOQvM>U0wNhiuc*O`$0aC@zeAxr|+`md&eI*dO)7H z9`AkLmA+xd{oB!BP6}Lh)!LNw^9JR4FT5wVy&Yo&jYkwt_d(ZZQ#ocLUqvWKA@WK6 zQ2wUxd{c&x)5vB9CED4<_&WOw@?h=EhB09qMe*j^Y3O zj{9@!TV|pB=k!@!c?;^G_ZV;e9QT@7J5_AdXI_swR-gsSOzSk?|CtkMY#BAOYY*39M-&dXufA6_G@$G)lj>TVoSN#t1 zWcn-9?*D{xZ$z06MB5*YcKK(NWfb)BXK=E+*($e-Fx+jrm5^cc@MJp_9Rz;04t&ptobbg?&m*G}Ib z{STg71#f=O4`Cb%!M1}p)40xY;CAqr<@pFV1L5;FdDubu_T(q{nWl~0KlCuZkBqmq z?;GF4-^S_&gD>0K2E?0lI?Vxdq+i=}$GfmOw?C$|H$nf@CzCGi7*3q(MYA5~A*xM$ zUp}}0BQc+pmT42n-&gQQ9UO=@L1X&4XcL*kyeX*PT`YH?x1P#JdCow)V1|4Xqx_N` z5bH6Y%GSRxpBrFz8HhI%}A$yW*T zMeI4T>s$V2?D`huo9vq6HqXBGznSbq>z(Yz&t6@b66pUN*%8?e?25M3|L^!e4g9ar zz{uw2Zm+nyx?}TuCc47*&A8!O{0q=r!8))Uv=cP#_>mv?4CA` zembX(GmIsVMCwz+=C83c`EN;k_{(hkp={V|$KS_>y|#Ax%ht}YM}ICmmHw)<6-5A= z>UFm-?ZB?YRIjb0X=xJx{)~D|^a-jl^&PcK5TZ|};<3Nz)*+TPtQy|~o1mHf%UI28 z>*^ZXkz{;6@b|uT$Rz!-E-Gw1N`k8iV{pF()wHy8s%L}IZ)fKi`cu`8w&pP%4JUTv z{Q_gm)(hmCmW*kUx*XGq%0Q$*h`wP=OKn$Oqm5}yLu(!6T9-xvJssDL+MMdOchoLz zsf8YE@n^<1DadtqHA0Ig;ZY^hY+YO1vL;CLU(L35jlti0FYQA7*4?$L9lm%f4rjix zgdh5Q<%SMjc&Jn(c}h=XTZvO8FI}s=sVxo2R=qd1y|$~-o7#yi|<7eb)qF;&{K$8;GbZFNz-nNXsW zhOS!FLBq;+SSN|XS&>TcC_+*}JIuyCq}n{CT*j;2WsbxB*t z3j9$x;)ZFiTs4MNh}`4P%&CTA%&B737czr7Mf2-Gh$UU7^5}g6R5e{N4r2tkS4f=% z|D8E^5-@M+B$%Pz9W{01ulT9sXhn&a;|&@(H^JUktXQFQMTPg;ySu#l2Kt+I4{?sE z?O57r@*DP6q6O48k7;U;ww+vpQr3ogy0ZNN8WlDu!|0HvdNXiQY1)og(`qdn{a;1x zDtZA0d!i=ly`r{`#Z7qLu9f@ABD~C@-kZZF7p9Igk4y$)e9cXpULxRCkcz{3P;o3K zNiSTD7XY-ONcnB8OPZlIZzfu&SIW&NCS8GExUIFGO)Xr6*Bc-a8$%(gt!q`dx~(l- z3T-q*J!&dT!d*o104U1U+1*Z+foDMHpj)pESEETKek(?Q-OuBNo4C z`Dt_t&owWRFuAbV{a-P{{%4ugkMG-9?7cnw?S#FgTRe1_zn!oy`%nS|?PZw7te`le zKgm+Gq48%2Hi7~P1QZP}7s+BdB^spCUfw0h{Dp;e-4_#-tLRU%xK~GmRM|@#8^v99 zopr_Hu8Kw~7s=wb>ckd{y?iK|T-^_iWpy-2jlHyaq8!%rki(iE8u!|0+(+BXCj?R4 zM_*@MTVsMhH16}GK`QN~jm^}Wb;aVQ)p^{JOtb4mD&SSwOBQX0z4y z(#D2A!->lt9J|k9O;0(j=|QtUxYhFG``Q(>@GZV!Psnc%f54~bYnEge0#YiijH|+E@Khf4oy4~2bJyO^S=C|Q}~Nq#$wrR$BvfC$HJ(+ z)Jr7MAFYJMAiJ*+l}d`2yW1vYlfjKgK7K$G`VWHGN6u~eeec5FyUp5s$&!6&CEzW? zpEU7tX4IIL84x>bJ=!-hJrpfqV@%jwB@41mg7|oS@@{h*maIJ_zdyjv6NBuwifs_O zxkASen9AEA|Kl^}ds%tARkJB}>>+K~tL?gMgU3{Hi-^4%Rnu-YYa_N@7&L1y*NPwd zXB+X=(TIO=mpv*POQpTMHHwzlh+{e4?NDyJ>h@?XyB&mVuhSI`Qg1J9Ayd2y(`{x} zN-2ri>$TC6SDY`GxcS3JAo{v*i9WGAZ4{r4@=F7RT*gXnb15E)v7914HqSmDVZ6@9 zV{^mMI<`i$xLX~4Z{+s-N*uX$q{kw+cJXo)?bbeQdYh$C0dJ`-N=zk7#WVV&`>Zpi zuUZ%F=5{+M+3c4_^SawqbP)98>AP*RIuHsNErwj^(&!-nQ93_l25A#=s_=*A?LP=& zHI3p7__x*eg96#i_ps`kE`Dfo_R`LNXyIOQopr5^+C#m)w8M=Nw29bXU3-?>j@g-{ zx)J^G_k4sUMohl!WpNZOwfSz0=6kpHC4r-F3&DzPA7Rs?5jWb1?}{NC(EcVXdN>-S z+Fs^H(Qdm0k@RfPfLCKL?U?ifX8Ac1&2;(2xM)jc>-7ihs@Nd^h7x{2ke=RI(!(1* z=oKdTg9Y<86Zj{^N69uXR_Pae zZAyQ-?A7Z?$P5S~3^|bX5dP$S6nyrycgpLypN1+}Cj;Gecv}UcLJC>fLKHV0e%depoao z@EOiAOF{NyC4i2w?~@s6-Y2s^{dN5TQBkBiDw<3$$^@Q`wRw_M0Y?uE&^u}H?Kx8t zY{Bf0c*gXHdm22(4usB0V%$W2BTeq0fK};uG7Ve$3G}`gs%_6Z#CfaCp`x_V0eElC zw7tlpCQ{p&6jP?5hdJ8jSUCjALpNenAyV^{sEx66s$_y4hdTxrB7>V2wJUZWVKOOi zzwzE4Zy)M6dkMXzu_pdV@8)^5k~Xh!30(X^ru;q65O@bJ%Yc_Tg7zYC@gI>1$N4R; zW6n!*4vcf&fe1q>7jiZNS3il|rAA}Aih{F}iwEt+Q}*HoT*OCn2}ScnT6{E_fu(VgWCrReip)SgN6^bZ zh!RA=-=(GRfoo2GZ+kHk7wNgyb-2AK!bR_+aq4A@5m=PL>88hJJv~Xbop7(1{BpQ- z%4wew6i8*$>w6$HyvI>EVQoa(&OQXEtjRd_qwJ>#V2t=l<7z(^I3+D+0>X9N=>bpM5?D`5fZ2`A%jUUz>MIX7F_; zpL_Ay#MXze`|^1YK4DuK3DU(hR<{PJde-w`MiM7$ME@BJ}>0+ zaeO|W&k;T^GDe&hjG0#OC}TDr3+%?U9Fq+8G6onI&h^iZ^LKqhNmF#CdiNmZ`1_X_ z(~nD^%kY0q;(un7zyr&B@<ZP-NI_q<*zm))N0dluQu|lC4dcKgRC|wthRwxn?zRI zV9{{VfYFfApsVpGg|T7vaWm|BoWaDt&-6ga%qqTE0dG(&-cJ%DG+8&L-K}ncvRX-AS&ba=HiFU9k z?F!>+pjc+6ZEz%Krfqaw#c7)z$&$4DjO%F_O|UF&i{mO!+iF}?w&2le+Z?uW$%yV6EEuI{vhjf?yDQT(AzHw+q$-^m4&P0GTeh z7$Cz1mjI-@;8K7z7hDIB>VgdbAs1W^5Ol!}0KN-00;IU$mb74SpJJ!7?|{T$0mqXu z-VLy~3+@5ftJs*&Ueu`XPn%_2)c*w^Nh>w3F!^msn`2zmO9mfHD|1|rrw{Tae;~sSPv+ zg8Q59>m};G4oLI3FS`w|JqsQrjw<|7SMcC8>F^L@L5PJO&j!bP^4Y=7d|@b^9o&x` z7s_Hs3uz`2%3%k$x!O=T7G`m16gz?gAXXR3jXCN=li86)J`JJi?AS`(S7WG{dz$Mh zn@u6l^g`3HZxw6~O*gKE{3 zTM8%7W&Sk9Df4G3rp&)5bND>Pl=(L5yuL^=WqyJjJ5%=IEc3vyD`lstjY*`N?@~OU z{brEM_m4HMa&o2m3wyC2yVCsQjf*?SbbpcK%JA!ri@Ur`ztOmADV9EdvvILyWclYh zu5ACjUfwW@kdEN?lpH(3NIkFbHelYSIM#eLG(Gs9(E}IoebGZ-O5=l+AZv(|_%J0k z=J+Tj&C8*-Lr3b_oKjj!4z(X9KZ?yZj_XUoB}Km8k2Xp0#*3U|Yy>SFK`5m!H8K|6 z*URpJFIQD~Krn2~^DUs@u#g##caUSawG{T+FXUyjYS}d+lvbXNwB#Dh0Xc`k$r$2h&!QL>k20HvLDcP4J zaMsm0ang(Yi6&{9k^0!L;G}6+!=E8Z(XT)Nps$h9ys62 zrWx%BYP=(fjihZZbK?1THf1rWV% z?(NUIx-VE_jEX8WI7|9GahPfnhp8rUm}(M-sisS*%bG2H9yis}&_+%YcR#$~oY1Z8 z-~ps8wApps;X3Yg9lvrNce#$cUB^9MU)pBm(yw+5b-K~Sze=rO2lvHyrOs!^PiT&Q zcj_W`a0K_HHnQV7^0_y)nH{%~F~`HH-*LCWVvnTCFvYG% zQv+tWVb^1+DUR#$RNry^Iu-L#GIo}HA~h62ZvfI=@LK@PlVbV!9RU8tz&5x-E_eYT=z6a~km7=u z0Rk>~1;BH`?*WFUJIVe5U|-yS$+-g6Mn~FMGyJ6YC3SL32zs$=yb$0aNb*RsEhV_q z=gKr=wr>oL9bfyV(X->9zG?K-%LTvjO{1r7Hu$X{<_Or45?pN@h&>n#Zs$sU4Ja52 z%1ngUbOVALOoj70aZpg!bnMCrZZ>`wVL=+)D=2HatI4%@aEtNd72dF*tm$4Pzv01c zj^BPkS<_LM7aS4XZv5y*PH<%KW8?ac!tEdY)VO{ehU>84PUGT!Yi4kznZ&SbcJLI( zRT^9!=Q`7Il?B&2u8QFKj_c^)I^$w%t_)t{xT=CzIIim8)sCwsxWTwMFLQ%8Ij(uZ zjgD)6@K$I3A0ZRm?0`i8`?{bOV2BGA1MK61I)K40s0Y}4vy;1q;9bT=ubv1t2k&$8 z(-M5hxVUF*3vO{-?ZL+#*NMR=99Kv1DaX|r+-h9BMCl4X>$tju&l?xd%vJ<{o8tA| z2peSM516jMJ-C-K^$W=!hlr_j&pAv?ogKr))Y-A0m^$0rXfbu3ARpw9VpC_agZ*4~ zaMg_QO%KgJ-puV)AAuG%-< zHTRP>{t4{Ej=BCaFZ&X>51=j}J$>jX`lbA&ht11#DT4H2LFRltJk{&_8-!pbr8v{5 zM^ku0P!U{U6vl)5F`_VWn7)Bab*v~%9Hws&hv^%{VH73~qcCw8g|TCytFVQBv6oGH z%x*(h!d+HYO7KjREpD%Pe<3S@9Y6M0$9kMgeHn~+XX-Lv`XBCNF85_6ba5EUzrtT+ z+C10Tm42gfanEs;-|o16>aTQqhim-R#>Kl<*ZFIW>nG4&aD%_jxVXo;-oL_e-QaI9 zF769&^fwyUMHKF5{$|JZbN@c$+AtD+oBS=tHH7-DTm7xZ#kToNf17c!32ydZH7>TN zJN!2t*WLbhNAe#3eaCgL|FPq`&;N_#y5IlQaXsLF>9`*BcRH?z{BIoB6DsXJr~2rh4?(W*Qr2$N8DYhS_mJrm>jnpupxGcy_g3YvnH#@tuJy|3fG3hp7L9GHskU!6H8=C~%a zj2)cG>oQGWLR*&p&6!x3T!*Wyn{Z+^g#9|B2F`1}sDT{~t{RrOYFL_?m{! z>1nxM_F_aetd;W*{~JPP=|gRFT6scJH=H@zYCI~g~ovrN@~xc*rdU)Q10W&9$Cuc-lMYzp)B+c;<3GK#O?r|a8t z`I_UreKKD^hLkhzn9kR9qaov0#W9(?D`MC8R`d0{B!53DZay-QbsSDPjX2SfaVVD} zE92u>s6RWU_{5arQp)+?(!K1fD2D4OhMR2+hj9#z8J}|ubFr13@ui7jI7r46N3qy~!FTyG>tdcc_L zUF66N%x9k`$k98n$jd$!`7@PGo9>IFZ*W{c(V;$%7L>oPKc$@VgkPak&HIj&hK%N^#+Cd z(1xnv#uU!jBf!-(g5t(gYV4Roj{X7D+6&1sFko7HgdBqcIbQaGxH7d#SsY0xFZ)Qq z(Q-X2UV!dSjil=Hvg_k~yzDNxb56&Jj*LnvPF<`x4WbK(WGqE-euj&zn<>=YHq?AB zPEN+&rZ^vxDE@wki}O!%>?_4dquLG!pv4`)rUazek#xc{`|utu*S&G=2*gT|b1>%- z5l!Wb^o%oN6?c}&EL-Z2gI>;jD|>{drS|`T7E5AZ#q_P_(BYZgNi982Nh&o&5&R2T}YP;hax6K3tabMKI&y zSOG4DY#N-SM^fA3I+KbU0(TZQ+w23_-?ZaHaBUJJx9Pe~MbC-%Sq!Jdv=o;IXSYQC zDJ3uaRGdeTI|yD5?=ciA`+8iNl!L!D z6J}mQZ<7f#FY8~Bg%9;M!54j`{0D@}dea8I$6wrsTgDe4ejQ#+-j`NiJRvyN8`f(y zr39a!WMpUIdMxQ?9G&`7HtoFOAb1&j+JD%QxaJ@iW#>%krK3gvTM-EAEj2dp zpDjh;-97nWA703F^q3dZV_r;6GpH0X-Mk7diEiGG*Uj7Ux_O(7DW;6=)YhO3C=3yN z{6d^E-lc|Ss^Yyr#`(NYsmHYTLA>)L%0bLmIX~<{IHvJWjmG=zLl5$%ld}6{kft+z z{E-qp#fztcck>Ldc@{T=pT(t6=Aq%GFZ7}^rcukW$E~;s>{NBkmHR_#IqpGdj;hBe ziNCkm^rDAb=m>n9YMybS9GjsLjqMPKPE4H%kvO? z(eo^vD^t)bPVn%yU3(l7s7^T>K2`AdCJc%5u_4bS|G**Mgd^j<1Bc4T8~qphap(IL z~_mRJ+6HP(+2GB(DoSVg-WQ=C0U#*db!&g>K9c*-2vBQ^`OgTDVNNmWBGm$RPbGJtkkdZg zwVjQ`X9dJu4<~blX~x-2W}v}X?2@R(#@P%<;o3~%6YmYic$XOCP0T=*%|JqX`FGQH zTTS45lD&e;J>Mofn9AKJz%6t)DRMx!w0#2HL{(zbqAlV$Bw`->YA_9AiD?j{sY>LK z1_86DFXh5|@lyly$4|9)M7)((`B`fN)Ig}2RHU4VC}KM%SmM*(0uR;G96kUuC*E(f zDgNK@|7qZVfd>AceERpl_CaO)>5>1&FDf_UC5Q6Cuo z{LpLY=r}YtmwqPVC+>U8^QuZB)#bAb%OW!it0Qym|2-uQ0S2I%95ESu1G;;UQt{;#d)Qrg=I6{K!x+G3(Kk~4^B+8 z3m1%!cTRAe6_w@H<@x2M4$8~VFRXBrDl0F`cax!4{yFmGoDiuhtgbF8o9U)Z9+8CD zghnb0kFF_%4vPy>^2&s8B}I`r2sK4sUIDMG{)l?Uw&W_1bHOrp)<>j+W zv<5k*!m{cJ)nau*2`C-%B}>&gDafl%V3jCKA}lN_tSqc_!owOI*IXz*-V&?kC0L#m zp|rd#l4nX;?Z)AF&nbiw3Y_>Izlyw`%1Dt`L9KHVvJRUhzv{f|ngrW0HWkS)&Z~sk z>GZ^x71CqSsw!KH5wxN5d6Axr+=F4TxK7X3R6$7 z(&>Z$SaWhF35o)OKdnO{>`%CB|rYFpOO8fj{+ zZ&=yT>6Ol_s;t7$j4`;nWNx8!2ZqjAP+eFRDLh()ib^UmH!@!6=__dhAR3Zdc*_d(3F;^5;=2OEqzAlOskEge6M;bcoY!pysBp(CVjJ*8W5lp=DW|Wpx z6&JEjV;*Anjw%W(E76$ZLW@vQNh!KIG>^hqd_4+&PijzeLJo*UsQTg~t1QefB-O`d zMPQ_&+?Y;6NqP(=1=wxidFXNrp(vH8>CGcad=qodrZ}U#U_pG|qu4ewnu^7hjwPUG zns#zC>{%j7Mx=hq3ac@xn~f-}BufSrZsx(qsj=mU6m&!aFHyUY4(Sk^RVP$nyyh3^iBU#&h7_=4)3v+BD6gzbX zSYpVeDo!g>%)AQZ64sbkR!~)(H@i@lEAhF4*3gyBp+cDTSEPJ)o~mq#FHy9rrh-Oz ztwlTNM5xb=PcG_JfQD6Bt`ed#EFa?~y6m_D5$`bot!=A|5uyMcOnev&Y-m}frI8}# zfib;j56sE24xwor2A-ZmmX@RYA)ok^YRZy$*cyl8s-a(AHqs;&-A>6|6f#098dcB; zkIJMtHc#ozwGhQtP*{{#Q>v{je`ZO1lmHQQb#qF}63w0bs;V(sMX)T(OAKfH;)bwT zC*|~v)-I_Xs#s_+DoE~cyD>4b9wLx2{NIa%CS9u9xsRApf(Bu2Fg~a3Ur zJ=8ue(69!>4o9)pJfda4;_5ldK*$vBRzX}%Rv|7LvP;T}%Hwl06H|@3G(N`3a~><^ zC|O5$$@+C`iMAh+j%PRhNF}CJmGk4XK+McA;&MhfNmou@c?H;DN{oncga(O3ze>!B zd-RAVlf<8M*MlGR*NKYGFD@x9Fj;X5viYwMOp@VSsqd@9JBQ#CVEL@W53GHUJUL!-n@TcS>6sBmUE_XjZtz=+r4_Ri&FRtNo~?%mQR@(Z&t$ zMC}8*g@IESMkJ^%bxf|FDNBx4;7o|fNW^IcVu?zisNz%w(1TWNmlt2HHoLNCCY4Pz zKFWEqD5?9Qn#iAl1qJO;&}5B=S^Q#dQG-RZBNLm$B$rX~@Qma8qv=uP`;+e>Ydo@) z&&KMM#;wv)Odoj-=VsrLf$d?l4ht7MWpm5vPLo7Ef+Bfk3wRmsc4Q)Ay__-KjkE&m zF3hyhC1b%vt83F=OJMP>W?$?&n1MIJv!I-|B;q_#xiU3Hv?zA98EhnIQE5$8G3G%!6M_~K*SVoKACU__1%GOm9~RnOe! zAwK(-#^=o3Xt9$wH+J!%U12ASLS^pl`p^bRLBt8wyrMG_{cKz$VZfnC#lj^Jl^65T z$Xx6TP)ue`V>L$oLSh)&Z?Vxp%jIQQfs{rlFFgpGEoulwXz-OES~2t>TUs)saBdGA zThp|P#SYrsN#EmLPCEq7vMau%JgMe^r>s0W4>zV5FUYE(sd-Ix(c~VIqjD7H7no5# zJ}3%M(^CN|3k#rR?1=L04Q-r$&Dt~oivw$Sr&h+_)LYpVke_pq*-p+5j4(O3G@? zosbwNlW?SXk2B^Q-5@e?upMD&%`?jk2fB-lM9c$Z4~e775Sx>HF>Z-gVAChvTB4 za7GRGO>xD;iV0zg!IaerU(+cuDn;`w%ZE~dd3sG3X7`xtrnzltq`6^vLvv^BhB$qF z5g#LLU5c-Rc6s>U-qjK5GK6v5t#gv0n9SaAR~vRAJMf)KkKOE3TVEfc?_);HUH{19 zRgu`>S4Uqt}Ygm_9#Q%O_-tK2Pa&Bl<%oAobeD2zf@D>Q}C zMvxQies?x{&?VCA^!V$U^!ZfzP%3?3v8%1Ft=W_BYc?&Zt!wb=nwwBa6lV$53q{~W zNjiqwS42<|CcP#2Y$274HDs$GQp(dDA15^pK zht=Y%yJ-HnwbBfI(6=8WWCWp^DBisPUg)jS}#k4M^Ihip=l(Gj%jg-2INIMDR>#=pq zD0n+I3mOp6C@8U)>TEiR8n;cBS{pux+_}u-XxeL6HMiB)M<{1;fXtr6sM~>o;}g6M zUPtG0`VTAYfC^eVml`97k(xXq5_~?D8&`MNlF6pwqJ^7IpR3$08aGSwZihMJqn*^Z zp^QzPk;QPru%M#INevxs5quRGO}eWQUPgv;h8i@MXBhI*P}@ocK^{;erd$YN8lov2 zOq7&IZInO%i!V#__d}`LJDccxsPv80NG*!kibtxT;s}?d9^V5-^K(dhOI-sjuLZqI zXD5QR;0GUyRb@uUKndzLCvwa_)uAkyB})@-AP)5IsEP8WJKj62IB_4u@PBllExj@Ay# z?P}z%m=fp446Us68pl%)(@MYmg&7St;>+fKAJ^mnjz znAg%KYgOjE+Yx-TIYOq-dE~BzzsC(T?e667=~^d`C^Wzrz;U+F_kKH?kc9b~b!=|P zCE{XmkK*V7Q#aHnjfGyMyA`tuqhsme$qbs=a%h@`uB1L6GhL`&|t2p_cvFV>aF1Ul5v{Z6qjhDga2VoZjk zxuDFW-b}eE?|jJ>M=UyfHxkyy$csi=Q+Vz!IR=;}3)&ISK#XAqV}fZfv2fvrL^BMM zBCq)3S!&e6RT0|(G&M&eVo%f-sLZ5&V^fi$nzDS3J7#h*Ura07F=3%q0~Q^0UALIm zV1|(k-DWNHY_k+a2Pq*ZH7PF4|RIWYRx(UzkrL;so;t&552Ru ztf8SD)Bfd{F`6OW8a?{My3PoO)24d#x>P7OCY}ah0Kjw-onZu=7j`RX#zwA){BTyN zyTl0D-VSx3*%@7Vb+93_cr*UQGP<~dtiQeii|V#j=;3XhSP5hR4`X3nv%=IHR)B&? zIUJh|m3EH7admSSZ+hDH=588Dc>Lsko86QWS_`s7ZNd1~V|vou)Y@R@m0SUFa=f6T zPtRk(Ub+;+p$SbRh$({E7C>~EqhVgbt7S7`qof@-79^}Fj4HIK>Ok9oLGjLlnNpxG z_?z_+^tda~<#kd|fZor{WMRG(Ar?6_ujhfHt`^nN1S^ive1j(dG-lIG3Qeqow7;SW z^9yt`S5Goe!)&0ly>T!*V?J^TQT@0Fm ziq6c85=A$r7LC}XzJM1!GAHJ`ZepvD$*yS_ zG>lMv*EKdZ%jBEZK%@X}5((227}@f~Nej<8Z9P*!s1I^&?X}Rp*c4BrFoRmsj5&rZ z(YiXQ<7R{MYEirBbfStt$6VLN3u2yQQNJSn-{Ph=Z$?Qu#$U6P;|V}4)kMtMLmR|= ziB}A~bt1bXM9iLwT}faah|MdsTAE;DRl%DAHsds6Nf~IHz$pM%l5xw{oN-Wyy2kES zx}8tk70|6rez`%=z8UQukjiN-*$j)qz65p*C-73D3#Dtp9>vlQY>{EJrHxz51Xv-u zd$j5H&W7&#HnV{yqW}hnSogsSrB11NmD6&m)EINIG)6;hK|^cpf@9WBJ{<4PaRKb|$h09lyGOF#lG^2M-PCo`!VpVn+7sf!kq%I_+GeV+RT0`c zLW@H;2+QOAvcX~(3_E}nfOb<6)-2v>A&jl9ruOBN#AY!*cF>|B0&6f?Y2Bg!C#2!+%x zuWgDNCii2D+fX>kiP>U{Eg~$2dYX_LZ7*?kV!?=BmYW@E4LQYbR4rPAxX?FI7T@0O*!2FyaUx_SULj4YHRFl@*xfAMPSDc4G z_T-%)+Ol%S1@@q6qV2w@G@Y&3_-yUs_+^sJJ8xJV_LvHX#ipKQg`&_IA-!~)nHb92 z-O*|?;b6{`Ex)(e?6t%qMPsK8Mp{*HkAn=OF8D<5j;40%TfFx1UMKYoja@CUGnkCm zLc0>4_y6SY73J?V@wRh50w+~^fm8Mk4DLPDBbFmPEWh-3zVhez-V?-1dk+a;oN`I< z+SF_Cju8%1N*qUl`Qdl*Et2b(=~smb1Fgn?I_L!!-u&J}rc<1kre2nQdGBlcUX#UX z-oz5-yKvs3-a{5eWiqemeP!RPvVPj{>H*j8c@5=x1paec_@x&=cnf97^r!ZLz(4!;p&!aBy>H{c^e3PAOV4qbrY#$X zn@cTit*hEPc{Ch{?Mzy(HZAU)Fm6Kb1pFJHI}Xn1K3^xf#C)B-i424{{m}aSkQx{Us7sluOzad4uhaclWL&w-U(y!foA7iGuonsrB zx~edUZgrsRLOvZW882Q=ptZq;D#VD#`&MxIo@Z6D(5PaesA6Gr^YWI3h-+b8Gse1w z<0p*G9Xo!ZD0m@84b1QnL(s#Xe{(agLLSc;ZPa9Sc+DA|>F@^!LaCYkLtd(1wxmRc}M3Xwpzvpxo+~y&QBE;|j$AE}`bvlUu8*fdhH%ZJ%D8Va;C^gfc`9LVs z@4p7cSQFYi)o))D+SAW^Amk(Z|Nip4<0Tg81I|avh&@yN%T8b8|JhrE-_P+&8Ssl{ zk%IjSDA><^fD}!+>i?rq-`Sze5>|d%>i22+i|^5LD4gm~n3d{ZWR&>1mws!if5GYL zT?xv%BoGMglbLexpin=*4??_l+8X~Cfd}wA3%|2M*~nDC2SeFhr@uc9m7MC|8c3h^ z@ac2r%$yVIR}o6}Pnwl}XDI!QRR8JI$R7NM5q{TcpKG)DB9#7xV+s!-ZvSi~fjWKU zG%_9k*8$|>gSS){#%C7 z55a8`>9?^NP&@MvpA~HjsI_AKZG7uiT`1QeTk^vuv+MWKn5eCpAuYy6851bxXPDe1SOt$ltfe*W{K zq^BPh>f_&!DoF94K*YUELn+0f^f@TgEc7(+nH3sFmuo`9P~6Xvhcl4s1F*S&Gf~xD z!9e0`X>h9Fcb4=+(CeAD3jOzB64xL->d%J2PLQK?rNRXpgec zkWx5d!qhxMX%(|WDQ8nnJ$Wh`VM5oJ5(w>;nSMm7|In#i2~Vf2L4i+wz{drvcpvl` z{%;WWzgX4>by;D6UH^7Z6lZ|lp>*ouP5%tLBb)wDqx5H?_EY^S(A(_zX8U<4S*<|B z7pI^G{7+6bHM5Ta)X0X?pk&l-#=)M?$77rfdY^r#egDSeCtf+Hj^8oImw43i1oP;d z;G(|wGv_y{MHyZEk~zOwE{@;GoZk=~$FE=>j$`Eb3G?9zd<}DXx2og2f;qk4GXD4z zb9s@X<7GZ%&M)hCsOO!^@&n=+IS#7BKU46v7!^k>5?iU5?67@qqKF#EMID9WrKP2YkdptcIKEJvv(Z}yWKP2UQiTW`-Q9p*q z%0+H__+Fwtke~19$I2QW({nseY)3{uu^kzn*p3Vj(@(-7U!3WIC)$4m3xS@rFb(zD z6aQrr`7q@BIraO5q&@@k{hWHVYsd4L$LyTfrwG%D|NWeLq;Hkek;?KhJ1H>O!)I=K z%;#M2evS{XLBXzM9@u_S=^hIyyXumdA!n(k1g_R>(_GIe^CD2QT|m&-sSHLx8=1X z(8rEE>BsWFDET~bf2!my-zi+%Z5a8ZL)&4a!;df`e16s8Zu=c2_HOfkY|sSC6>jxo z`T4?ix^Jp@W=Y!kwjLig9?K_7muJ&$5cz4st-R%Hh3j^)PPlFtTZHTOW&0ByPgv5| z@mM>ecqWPr{n++p^Kb2czR1}8TfSO2#dC;U(~s>Bb$+b<>-;<~VQso6iGHo!+H@@+ zCG~FQ&z0~83%Bx?FBDGsbnR!6ipS=!Ud3biN+%w-zdb(*zgop_``epT{Fe7lVuuTr z9bPWwU8L;L@-v-yY+X|jJKrQd@Ox4v9y5P7;~ll@M}^;~(tS?&Ln>V>zeRB?ztzc) z^P*bsWrw@t#i5dpwyQkvA& z@HwWR0^wT~uM)mZ@x{VlRowPh+ZDI%Hz%zAx{x{*<6#tj-R~5J8%XY>4%6Rm#;`<2yRPkKlI~6Y! zPPYf?u=ZIdJY8`+kIhoNPULeGZxc@Y4{rSD3LmBTHNx%u+2&`H@X1R4cHz?%ze{+r z;!g>$Q2cq}^A+DFe39aR5Z*DBsy7DDS3A1M3^#Rm)D zptzk^n_7w0yNE}3gslGUj!c#Wuw3t;Sw2)EN>}m+3D@yV7M`QzON56NuM$2=@#BQ& zD&8)9vf`%;pRV}D!iyEZQFw*ow+f%H_#MI*DgK!7M#Wzd-mdsxg|AfHmv3pTR(x;a zYZad=TyV6#&k>%k+5vkVHMBC!bd57qi{D}cbD}fN8YYI32jNj_i_3+ zSAJy@{zwvT=Rsu8Zd+OIv?G_ln1qj&eqG1Ym4w^zM9cfqA80-)32#cmuTH{$mxQN? z-BG%B&xurjY!ZG~65dDZS;w;^3BNK4e?AHSE(xC?Tha;XCgE2m;m;@G{lsu7{;=32 z{mf6ouT8?=Pr{GjPsEu1*^R$F34bOD-y_pxPUmw*65gGJZ%V@7Ov3l*)pNQ9N%*-* z_`^x~=Sld;-aV%~KM6lC34bIB|11d~(WmEh7dU*F5#jTlNq8?AaH+mr`T8XM@+3TG zk63=(c#coPA56jzk^w;H=fouZrX>6iNqFzHbN%*r#__s;8be~=d@_C?1iqB%^%nx$7 z6gSFi#E697I&GF=MO6)f5$6+ zx8&y}hmVGw)#HyHPWstL#*cN1|4AC|wTj;({1=L!A^d)aQ@WnGpK~~+TOsnVDLzE_ zyNdr=%JrGUDgIn>Pmy*{`ltHcf&X+&SNv0hy_t#!B_6xKNcxwi!XfNB-Nv6T@?8=S z$=kk&0-U4b-$Uf>ej&*pAbFu5^E{QYH_CsJ*u%Xlp8X`AhZUbF{MU*X3x7s&Yd7Y3 zuvoe+B5$5|it#nV-%#;fBK#f2e-)|3dM%gzr-P6XACM($>p2!b84M zuH}13_+ERv$xZN*3QSn#Ay+ZN7i2GE< zzZUlyiuaav={brI6@H=OM+(1G@neMlRPiq1*DJnG_%9T{Rrqa+KP&uKiram^`xWme z>*PljA1VAv#it5?PI0^6^@8H3iu@lGzee~U6@OUxdy2m<{7;J8{V2PiZQEBc)wJ8c zEBV2~|Ec&m;Q`T~jc2CtG{qyr`zXFfcz?yO6TX+?zY=ck$fo<8@R3UXBjE=ro+0}J z;}t(x_+g6Y3qL~fs}zq2KV9)I;b$p+zVP!DzgqZu#qSn=x#CX?xAz&W9^MgtqmutZxV`^i z@W&Ky68^N}tA+nY@hgSDr1+h}UsL>9;cqMcy6_Ja z|EusFiU(w#^O@pnea)9-z_{(aZl#G_^TT}Z2o^I@)e427d}_<&xF@1ex$^Ig5rII+xs3i z-Tj20tmLl|ex~A8!p~Lwc;V|5Zxeo*;%5rKUh#K?->mp;!Z#~^pYVGWe@^&gir+5# z9nUKMsmO0rJVVwmzgK*$@HZ8oXV*K5uMqyR;&z|Wj-R$(ZW8$~mHhp}zgGMu;r3hV zHlDu;PnGe?@+?^=_EvnX@P3My3eQpec;Wjh-YtBD;+G2_t@!=Ia}|F@_$0-@5k5`v zuF7XH5CZwddi;sMz}{Z#P- zgny;@OyS=szEpUM%;Rji)(THo{08BD6@O6p0L5PszPI8#gohOm$o}>IijNR(=fyUk z#|XFg=`3#*K3TzH z@~w)WD%{TZtsd~I20qSI@=pjqSMlEqU#Iv7!Y@<&YvETb-b?=U@CL>A5q^i_V};xG zht2;q;SVeMBH_PQe2MU96hB$`?-V~*_$!KU5dMbZzY_kA;!g?xNb%Q&f1>yo!oN^F zC^tZMDLzQ}cZwe@JS6K3tGC02_fot}c(&q;g%47^Q}__Y*9zZH@t+DmQ1RP^k5l{! z;S&{qU-;pQ?-HJ;c)C1DG*j`x!tFZJ>SwI*DkVQd_yWa`7H-#_HlBLn4N88c@MVhs zMEHq{Un_it;&%u?RqQL7XA;#-w^(-;{Oot%evW?cTc$ynxXg+!uL?TRQN!}n}rWn{7m7) z6u(ON0g7)HK1T6pg&(5$cHvVL|5|u~;-|<%QgalaD0W+|c$4sB6u(S(t>TXhU#j@) z!dn#ICA?Gdq4KcUNs1Q>|B>R2!q+N(hVTm&|EciH6n{eaHH!a9_)UuUl0P-RRq+Fa z-=+8w!XHw6vG6ApKU?_oir*>xWyN0={-)wz3;#gzfnpDKKgqU>T;cyv@-@Okvj1V_ zFOY}P`YOIo4s zS&G*PKU(n?;m0YS6E^*7gW}hV{4&Ki2|rQsJB6=M{9)mCzs=UyQ^L z3;#qo-Cvfj%Hu=!t0>)3hVVI4ILS+w!F;%q?~pJDDSn^uLlqw&`>{tT-Y&dIar<{n z6~ZY$(gkn|D;)WQKo*Bh!e=PHT=<2GpCbIHieDl8=ZX(F(8Pa-;(G~yNbz$HGxAR> zZlBM2QE~em&U=cVCGmWs_|=lnuN8lLf0J&y?Auwp`n&Kw72oR+BR@j%p~5F9zQ6G4 zijNmwruYZLO#BNKKT_mRP`q0BO2r!wF!7wN_z5C^iQ@O>8u=R(KSks>D}JGH`+TO= z+cmGLGf3GzpMBs z!oN`bE8#)eueJKzbE47nK*c8t-(T?};fE^n zDLzy9OvUF2pRah0@Fv9@grB7NX~NG_ym_3-|J90LD)M$e-j??l!XHuc_X+=<;=d98 zN5x+jzC-bMh3``Q@50k$U)<(r{C;BRihnKg`zf9&iVQT%Y>$0~l5 z@FvCQ3SXi4BH?E#-YWcJ#ZMM~gW`6ay;bpR!$v>%E57dt!=F<89N{l3o+kV)#c!1O zcPM_FjHf#le?WLh?hn{{d`fsf#rq65`Ly>pto#t+2P^r}!lx)cU3ih=#lou;?*Xck{T1I=@-s~FvBJkGK1KKuicb?hTk#6v3lyI#JbJ$(4vSNsy;*D3yu=;2PqpA`Ox;tvUbLGdh!|8>P*6Zwx6-!A-1#ch7< zeJWdDnG%2h{vIEeeWqY+jbFAe7n?dv*OlHRw@2xiT^ysD}~$pc-F4A3jev1Un=}pik~8Ui{fj9 z|3>j&2!CDiTZMn5_?^PPRNVHHqX)*ln8Y(v z@qFRciq8>VtN78vTNOWE_{oYd5pM4jTDxr#{!1m_E%Ty#6~9s1k-bl7z!FH*cwc(vkNWuNDG z#qGRwnd0Y5Jof&i)#oL`&r{_bc9Oq|xtFisuM_N%0}V z?R`$0|FOb9QSwI#|61{4;c0UJ(8g0Pe4yf0!uM0WR`__uPZEBV;-?FrqxeO_k5zn= z@Mgtt7k;YZj|#s)@!tx+PVw!+H!J>$@W&MYTKJ2K_YymNPw^qbzf}AX;UT%tY4v}k z@I4hT5q^N;#|odUc&G3Z#m^CbjN(@cU#9pb;io8mzwnC`4~l-SRQz+Xe|sO;mbcF# z#{QpH^507QFDu?p_C?=O{9xgKRou>J{;Bw(BA+hzU2T452p_2UY~jNdKTK{WhsHvXRozevg3ed7&^KQ8jWRD7H8 zhZO%HiVqk5rQ(x>r^rnm8~;?{S&APid|$07$p239 z?}Tqxyzc}P&u5Ac6P_YB&uqO+5T2!Yk??&LuM~c;;!A~3Rs0m;_W1&v?zzI}D)|k< z>lMFOc!%Q82w$!E+rlqUJXQL!O^S!5z2B*Lne-=*DsJZ+&ns@{8?PyD?-PBfc(=s= zh2m!mw>KB9-t2s`&k$43mR}(9dn@I1wz5niVF$HI?Q{Bz-r ziU&l`-HK-mU!(Xy;g>32EAd~WxLq%AQoK^+?^b+)@D~+-Rru?QpDp=$PjS0{^{L`B zME+aF3x#LOa}%~+<_I68_*~&56psiWulN$-M=IVbe754th0j;~RN?K4eq*!eFM-y!YdF2%nR z{+Qx+U-Y+%2PFPC6u0}OA1fXb`M)bZRk+QE{vPQx)GPdOJt)*M#4s_$LzoEsDP`{8x&w75|s;OB9btJU1(TjPN@YuM~d2;=b@F6}R6@OUdPg6WwxZQWL@w5rQRLL(AevRT~!Z#^CSNPqEA1nM# z#V;5Bk>b0A|5fq#g@2{^Tf$$H^?@zdlhP0TN%7G#zK@c5tCfFE_;|(beDX-e?R;{! z;?GMwixt0BxSgllbPtmK?HiQ*F~VZu{hfkrX>dfRIPz4b{ZdT)XDQw) z`~tj$}D4!IM{l3NqCEx6u`0sSMT(ZXl4ySmwiu_iG)1|1*d&S`-Z{Hte=W#Ya z_B~u5DfzKMPS*QWar=I#U5Z~K@$35R+rQVC zrnvokjhTwudA}VGZ9Z+gJ6`0;9%RdeGiv*FE5B39wZe&?^!&Bx;be!?r7iE-4kvm0 z{ep8HPM5Wlal&z_!%5zLU*JlI)1@u19rtYghEgdOe1}WPTRq&Pctp~*^A{V>6KN)% zCzZT?U#p!Dl02D4yAk)^apWogqa~it6kjj=YsLQ|`S+#Yjpj%AK!;Ph8zkMa4ySbO zd({q8e7(doUGd|EmpYuXcDvO3e8p}3)+ui5rB!jO|C5B1y$zGR)6ZHZKS}E4Vuw?? zj_zXu+3}6^L;1A%xk1U_Eb?|9ZRPEIfbUT9eqR&+-43Vtuao@zTJfud|JLD@&xI1t ziw>uF>^}A%6}R`PKXy39bD_lZ7l%_kR?q)%ILT-2ffJ5@I-KOQWj&cHV{xgwwG zaFX97B0JtXZ>W_C7naiwvCjd0g;)9?R$V?~8r> z><^b2ILYVt=4Ti<$v+vv2?yU#lYH|3CS2*b+2ALf_XR$rarQUHdHuqAb_|wc#4ijv zqz}K}{5v21Yt4VshtJUXD?U7^@xN-^uTOzqzpy@+=P7+I^x^xooN+$XXSNa}uJ_^FHGaPj=kN4<$A>?t*8{)t;ZJM)WsOsNseg~_IAcvw z6*2yt#xL~YFKc{`5C5~q>oiX78l!cmOOua(vG#L*uFv-0pzXiG$Io$Qi-D7$ysi0r z4V>D=apo=qC;lt-d&4^oocO=4^|{}`iT@up|2_jZ$HjvNPW*3Z{zC>%{2Vv+cT{9QhN-HqaYAI|$HYqjM5?X(Ub zpaDl;sb0c$v)pfYGd@=H75eyfbKG??^Rpb*i*c3{O(Un;hwssJ%!l8v=|&%ZOw$_- zoYt9(G`-n}Kdb3pAO4)CcldDb-+exuNv*b$ex6c z)c8rH>0q4q>prbu7w7N1@_zHo&+>V{cE(wLuJ${|S$?4pXZa;Q{DjuC+=n;n`>d!B z=l!&KUv{o{yXJ2)_(!9SM|C^fe0Zg%H~4UtyV-~HcZGNQaF)NvhqL^BKAh$6_u(x6 zs1Kj5?Q`6RuhjSnAI|&iKj*`FpZzxsd<<;E^3VEkmM?TYWM|@M`Hl}~`P~1+uV3|& zJy2}$6CRN$?wbvKq{iq{?!$TfMh#rQx*|(e`|wIFD`w#4bB0DA&f~Gkz|H$mZa1}y z@Y%T1vBBVvNJO1B`|xAhKYI;)w86i_hd-z3od!O};NRoJnU8H4f_|p`OLSSnnTMd5 zft&VhHE`2z+YQ{b563r>AJIH?;kZQjXag6Z=^)%}*DRx5rv5DkZtDNMft&hYtnE$x zW$MrS#&bU^Erh5GsubZ7265$mN(mor;J?%N&4io!i*<>0EgNnWlUoz3Hm!*_uUgfW zxL$PJ&>dfs=!v&rmpphF^NMd+ts{&O#+1! z)!oyTLNU@Lb!C&=u1}zZTiNRN_01jaA5EBgu|R2?_Vuef1#0O?toJMGuVK}V@t)4L z;EPksTGqx}+SbNbH@A0)$?H3N5|gi5vTTyfIG-Td0qc9>sB=wEn}}0$Iy%?*i^lsM2#aDMVuVd1+Op4a6CpNQjYc@4^ zwI&PhY!Rw=C%1^nP^_nU6|Og~qwCn#$)z*tEKjB7l$58^8Di|_$vA;wIwf&JavCLZ zLb8mKI3al%C2>M>DkX73vXqjg(4|v)C~7VRiJYk=GQWh?H2gQw)itdoO-30qAdw@I zF{u6%$u$`NdZ;Ir-Z2FO6URhfrb0c|OOPZ?KX!66qHZcVp~Hj=K8C`7uYAPiR0)6i z@1n3DBhEJ-RQzludVEh!aTF{H^_9MpnX3LKoqtSU`Qopu0OkD{@kSm}CAc1{KZO7O z`l<3%^^YYGN2R*BXMbHZkESZ$rpxoZ%mV!7XMoR-5pTKHzgib0{YiJf{gr8Xf3L3J(e0r6vr^Q*4j8fc{cp4OTV6MSMIQdPwgL5H#JJ-dl3g@uIaEL0 z+xgpn53p4A&(`xBuS1ly{&jr{8L8?&{je%=0{%q@)jtUT{q@uOBUSype;luCz$OoW zT?>KwF=Bl5uw-|?A5Zn?;=jNCS-_}%Uzia4$yhk{YyB1Fm1lYy5~=Dx`iSBz}Lt9+StfEQAx+&-5>lNTvUyKTsUi znvwLUKgs3tEO!VhPG!GhUH?v9o-bUU=|L!;s($f9#c@bClkL`@-cbNj+3)C26#wQXbtU`J zI^3^64HLgiD)D|3orO3A`Ib?P+z$mUpFAZX_NI~UEahf?dQ$b{^v83cvP2<_zH0QS#CIu z|2dOY!K0dy>_@K>ae4Ot_rT_>LY8>$^Qz#yOm*e6pZ9G5srv7Diu%Vvh`;_$=YarD{_?m1m_$qb$t{yRr$i!=68z^wrPXd0%L?_@owP?CM6um(0YhUC6VDSLE4YvHDR0x?tOGqC7YB%^DIoez3h@Z>sQe)Z zPr2ns9Xx3dIe4aaF6yl~@WD+_?mueBfBV5rKRobOw&)`roM5z%>e(U0;p;A`96!g( zT6@Y84NZY)-%(&Jmu22U^+D!a*-`q$psbVfKDg;e`=L+%bto6LGVc`DoZqe;Q#t;+ zODYZ&Th5)CnLoX^_<^kZZn2!TZI_56;)8Py?GvI0A{E7VM#1~`xpTuZiz~;+t<1H} zLNsJXDh^=%nNM^k^l=76`)aJrh2t&fXLB;e#tFd47Sx_>@Lp$S-IKArv=a{4xR1*_9}GBx;g8U5xsS$e%a7(ft4+JfA+U?4GU1u0_Z3C z|8@>rf=2rWIMKdIR#x_Dd(;HVUyCxgqfL9Qfv=4(z2n}Kwle|0r}Wj}zib!Ul8G{o zW!;$tovRq3VOP_OKW9siS@VPkJPqwB$Qnq%at=k7h z`_Lw|D^u!9wx)JrXy>m5FWLH1^eMN6Y^~bz)V&kX_DgRL+}EBJ?YrfP39sEyddKiA zYgjh?>a{OI4*AD)$o|d8qW7G#^AAQL=LNe!`a8AxGl7CT-wh01c*_`Z1pbx(Hh9`m z<{imjaPS3t=t1%s_}cEaG0`K}O|Cd_ATadK@mBuN9Mm%aezxO*tPyP}f2MXG{C+NM z5bcX({_NflZaSv@|N95}V3)J;0P=0vCg_gGw_z8u&sO;U{y_9dA9O>!%5S?QdgMsA z*tLI@IMR-KCm6odo)fY8$nS?C@E%sn8y_5Z{?RLUwOMyYe5(8c_y%T38%* zZc#p(kGyxZjb612CoG2!Cm~148z$uy+tDM`9}aXNA8CY-lta!Y=+lP2ekw3b+K3wC{tPek^U)7LN9v4vNF=u)`dyaBUR+OMS^>o$TWu>!ZL&WBug& z{l_}V!&)0LCwe4q<*)7S0}tdy;9C?sOnKR8dmCcMDDaWI$l3n#HUs}TVn`3JM{uPW zcc#`-KCfdOe11Y3>QrsWUmHO`oWBjK&Z8J7{&+=oovEd``Xgy0GsaMSp*Sp}^g zaxdwm@B>y$EajvpWwl#eC(=oQE6T$Xyy=tJ;zF%DL=SX0=Xle}nDvYBdhWyd(l)hb4=iLd?|i**JI zw8RQ-O@k|Y1()WlUkc-_Y+AjUk+10l>04#2XqIv^Uzf22x0HqS>osl^ufRV<5tbEo zYl(5PQbWq1OzrjPFB1b?tFJkqoclEc8`TmYdQKRti^7TUUaUQ4QJRlOy*sG10B9y}ttOx`cc28Ga;`)>Y3*){KTu z{a&Vyd5rz_tY>Au>}pWYNmfpYV-;WW7`0&c;#ZYBbgWw>!8Y)uoHtf**o?aEXmo4T z34g`Ry2UMW-tpeQ$ay`8)o5~SIqwwErdfOR)fP92y-WmMGqr8kN$vtmwDq??3)8Yh zzZv>2ox`4BiSvdC?jKeFQwi(93Vev!rN5N6{!-4XKI_0mQ8DZAl548-c5Htst^K96 zx;E4azejO?zD^(xa?)Ezv~bexQMp9rvV2V^yU>-rl#?tFk%*I~?4^5ICSTLZj<~Yj z`wJeOYQ@FWM30e^B^pwUns6`aY8>DSau=7mF2qCUyi$U0kr*c(4W(Ac8f;xWXh_H& zlsjz1puyHM{Pqx_pJcG_ehpq}4GzV{9yBZa@@)JrI#$?&uFTFxGCUat^TN@>f1F#S zvd0zG44H#p4l+U_Fib%tz$r^2GjHE!S*1e;!ymKm*k*}9;jX#pyllWi!2>2+vUG?9 z&MqR614B}mL6^u&PKv6DD_4pB%-kZ9KA0rlGq;e^c}9s+=rn{>q(nX`M~MPmX|`%b z1T7pILSw1j)QVwc22nT!8fIrB4-b!u1|p|s2odEdHN3#0od-vthC;9S$P3WsWy2b? zS7a{-(*;D5`53s+YxA5Us(h5LJVcd84D~(JP?JZyww8=zE}^deKhR3`y;@+hV`(=q zE&-cdHF&v(tgR@C9OCkqjrS0kH!Ki+;-$cF`YU+6>OHi|`aSJvqD*54G46 zg*}qWX8wT-{Cgbq$+dG`k@q6IoNVX;b6;~x#-7Ed91|Q>O2Nf=rbYc zg+&?i{sjs7lPIC09RID(uh^RFVNN`Tgk=8-67m;FVb3FzTJi@rdmiaXKMV@HY87lL z?AHNc=-|)(f)51X4C?*p;1>h(_d7ub4}K}&$Q%+B{Bl5j>`)S42^7kl7_ogd5b=nw z1u)EO01uaT6~Swfro*~Zc|%ZMLP6Il_EBahvDi0}Zk|)zL|Tuqma4p8px_8g-jLW^ zehtENh>uaZkz_o{x;31_hQjSeT6pRTcaN}QvdC_;s@-!5a}_LvT;1*WQjVwKy;RB| zk3%biBxX;^`=3kF`SYZ+mn+E&xCvB$6aL%#QZ_~YT530weBHs#q>1Y5=3m1HR9~;6 zI)qKVB;W3{!oxEvl&jQ| zyF7R~$EkXcd@9*6k{n4cPlx@CGDsTFANd^f{XQst;1pt?`cbRozpkOf8v;f2Ac;K;Dp8)!o^$Hqp~f z)RcAY-7PDDIV!}bl^2kSwaGM(yw0(-h{VO>Ct{X(UG8+ zg1hCTe?gD_TN8NavhzmHA&lOc)r|Bmt9&uk(}=1ig)WlZLgN~c$FDFwm#9^6>nePo#^U`%U6y) zj#Zo1ZHUuLt{$WqJsNNDc5lMVvTil>UbWUX88nq_>4bgpvT<`)k63kM58iTKFS@&0 z#Jc9qcqyCmIwdJ>Ejqi}*C>N^QX|Cb=C$ZTGNAY$adACtbM@8wXq~XOTxg9LFiHkS zxtc-V4$6-WxS-^o!0zB@!k=}%ko9?5?@|72%EPgTPKyRy5VJxu^a5#FWb>Pn|q%^7JX)H+FY*cJ@r!)ZI0u zeSJ&Erq;xi=H{-JHVk@r?xxL?sN~93?HHe_L&<+by!x++z#ax29X&U0NOVtbBNK2_ zSE{D2)JSE?wzQa5^KcTa0;Vl^aS3dT^=@5s<=l6d?5dc**j!-%zD zqB5b#Avqvrng~QI3p+R=$g3vJgqYFZVVxjz-Lpe2+7!aoH zg&})kNQCX>&g_sCwx=uzAnL2PY$J954OEVOY-EwJ0>e z&fXTvrxFW78R6SPIg3LMl0(9aLYcT`F9-!v>G!_Uul~d8Hz{mywNS~Tu>HZuNGE$2 z$Q*lqKXt)5mKdpJ#Ck#4{y10%Lm6Se2SCwg8q%`ANBn;#(U80?MT2)+R%mF}kkCX3 z8nGaRItG&2QrYHSu)_F{+~Uj*+lOG?uzdo?J%2CcgzevnZT=2Gi=IUBk&8nYEF~>} z3oQrR2QA128oncxQ4=att~44hvLI9(wzIZ{hR+X$7KR2@h3%(5wkb7|OT53|A_!|5bc1 zY#)YR1MR0#%Yd-`CFx>GK9LETLr~3h<#{7-lfEhJ2caIk@psmOrJ*shH6^Mw(asG5dNU|Z-C*~|gq?Xp2bBJ}`GU{{jF-u{!j>1J#8iS7gyukIxHnX=C={p;O<1To z?7!ShU2E@vL1`5Kr)3m`?b`zj!rM|9{Nn*DG%)M?Vf*aO2(eIHRhDBe8h&!TrB zjYleOcB{nYJ)DbCVui$gFDL`2carrzHznL-p2TUjk$jX(e0VYlYLdjwzv5FYV6j1AQnSP)Xcf2p8&Z1qg9Ujf^DZjqE{ zd(S0&c>neigDwAhC5crMw&>qp#oxcZ3h&=ug{Nz8|9({b?gK_5-NRPTDqNZqwt9BR zq@nXpBFf2IsOX?H4B<|M{rD(!y`JkPKjuc2>|xMv@^Muw<*iFi`+3Q%r@^00gTG_oW|U~tLznb4@o%KT&!oX;sh_E2dq*1W>P>^6 zOM_plr$*Apl=DCu{EunyN&2a-U(Tj9_-oMQ=TGGKtGkBPS#xVg&u zeHuKXrzp}VqD0EG?p{GZDqdvZT8zXmHgKM)iJ$OgI*(%o;g=ZvJa(A>OFEBv2p%=l0*FSB_+gGeP#Lg>bP^4ffGN|I}M!VFW2(#GjQVnm8SO^IPovh{NKhj4sFgA#I2822Smwy+r7k zWZ-7IW^0_~vwzh1@Rdr8xYmcaX?(R0=lP8OmX8jSZ_Y=zYMk^ZJ$p2LmkACA9elE;VOEk6DSHLmU- zRsV8~BL2-j{-K(_)xgJq@83232?IC%bGHxQr|AcL_*XT}dmFM}y{^|2hkX3Z_qc&m z{N&>&20jL0la_PBhksS$|Dtj7PxJ2n6@#DJrJf52@fRP?es#`=bGx#2JtW^;w-jld z`)i>tKi0sSc?8Eh{LfIO0D1R~o<0z^UGg^m=!_fm6NDY5p4xocRB& z`ENFG;%C3zVc^974|*MZmw^*M`|W)OJ{CByL%w9-Bg;j-MGg$seiL+0Xj$RT_W6z)23T!(KITlCx8{_bng(TaBCdapboR+W)gcAaJlh z_iDVrhkse)5g$&k+|eTmjvtPGsz7G%T1wMX7kq7BRa>^7bR{HQJjjuLv z^S-0Ukbg0FI|8b}Ee1|@Ytr@JYT(4rao|%1PW->p{GT>(;^*=B1&x#b5#W6A9`76< zwrYJIHRO=|LVaKKn1Pdg)`#Vhd~=#{uEwC&d~s z*H^|_e$)r3ex!$7&Zr-mQ_u)G3O=4cuIh@$*{ZC!E((5rdyG62A5T zKD>u2#St@bGd?u>@Dj!D?zK*OMl?p3HiMsVhd>J?aBQ^xM{bEpy?nyB2(&gx5mkCrX5~1 zaMKP8bo?WJ(+*!ZaMKR28n|hP`}I1Fnn|3JF>ny@eJ8Uy> z(+-arxM>G>k50Mmrn@a8{i%JNUs_Avzfu{L%2w%@08Q159Wj%Q!>{rw zW^cF5WUjPt4f+)Jy*sF1wMC#^EkNCQ<(SuK<>+etsUs^A)S% zFHi0BW5l~(+n?wE(ZJ{y#c%%`)9BC78+d&}GU@Qw)r0bWjQE~QQ9t>bzy6_V>gW3k zUhj}hI{bB!e?UaP@fXnplG{&Z>F}3-7g(zDF6** zg+5Xo2XCtS3!@|j&mRo?kG!k2dJ*=5Uf+R59$Y_P>w%^!|CU~qU9HRU zh0F1k?k70SJanyzn3R|H^V0Kv!hCAFTOpBr^WgR~wiEfO?6-fO;&62N(ICkrT%P@p z?msjOi#$FpG@knKL-u>x1CBh6|3?mwQ$mL9RB;u zw{*1Q4^Ma}#PjckSXwf5`poGO93Or!#J1Z#3q_?`QQW)q-wV+xubGMWBd}lLs0pLK zA~sfsMZxU%b54*-_A|P{ZIamSEGG9 zu;1H`$#ai5Au)KzvZ6DkeC+Gj9Tsn%!k%V$teF3R=6eD4 zzi1DUI#3(XFZn|B=K1$tbSmc_nIpu;S2FevFSdf0Ih6sq2iQ5=dgga&8w(M-_>U&QRDVRx>keP;cE^umjm{x|Ma`Z|;ruL9dY8l|wk$;3OW$ zF>ge+RpCFz-f>hv`3UtX@ov>RGu=B#OluocGjr5H(FHl!x2~cOwt0m0j%J^o!TE4? z>{F@Qb8>(v+b7P_C$FT9>d>BB0#;ut-rnqFUcAE~dG`l<>)K{z&fNBexks8U&z4GO z)rKayXK2Af6C?XZY}h#{N~75Kj{33Kj?CDRjsC-)qqkfmZfyI#nAxsnQ=2gj=C@(& zj4Blydr`);m$ad_lS+@8fN49Q+bZRMFmC#BL*I&ksqd%>7lEJ3I`F$ulf=d*>?7%~ zqZ$3d_Ch#y5v~N6oi2l#9oY$T}-|`-kAKX-N0AqBQ+_#U)gqGYecy+!w_hb;` zcHn{cyG7r7YjUt}VlKw;VC+4Zci@A0wmXJtzs?coTsCFwqQE`rZ1v*WjJsbBA71LOct;Tp`{~}pmhdx|C?Y+rur1nwUQe%3!-U$}b0Ue3$#Pe&Zi#JFkC5QnkW+4(Nw zU?KJj{v7;e_*StC%gX%fPgI=69DR76{gJaT$gx&{m^p;z2^ll7snE1G$fL1HJQbKH zoF6MaX)Ymqlbw%#aBdpu|2xEEnrmM{yNfI_lXS<=rupLAM`v61(JO|w!wwJk&bDA1 z@~sLxe%7>grWm>q->@C*JTYF{W&z4qUnHKPHN~g zd)Nfnv5fQ}8=H1zo35H(GZViPm7N3+_ciwm+mG>+7g=(Qo%^Mlf2=Lola(-xJu1@{ zfE|$DiZS>k>=Jl*lEM+Y4q$G36?Kr^$VRsZGO;&n*3ZV4if1q;cUj<<{R!KlkEQMW zIt%y#*^c#5^PBQZ@@ewJ{kO)?nz3#)=BYEab%)Ua=kVj`zwcsgw*Sh^ zndeq#A1MZXN{-QjgZt-OGPYA(#oFeP{fMVd=(wDF--3_Q8s+U_&Y2SCShB%e!wU2av9PMa&@7!Vb^^@bok>yycom95KFwe?0_NX6-ji)f5@5dVE0T~|(4h|WJ zKM8!o?Lhq=nb4nIk%a_GHKfS&XZ!-Q-SEWsJ%~UTTr`6#wnUF zkiYF>HK$Pe6k_1H&d^NC$Di69#u|3lQ{M>g8e@r{VQ+54K-D(lc^LJwUaR06+=oqB zp1vl2)WDXPOKB>H^~=Uruy%QTRVMDm z!k1CGW*NhjUq-NIF=>`Tahld3`@SKtmJ_=uUia#@?*9hH;I~BIBqPS9vsVW6e?Z3s zk{xwK*#nTnz5`m03l*zG*>~XkxY?Iu;dmfA6L+2EzXjHY`Hb6Uly&W>>Q`+t`{0j% z)BY-QXV6%tc=JWXnF_6gf8DVU{b2g;?@*rVGuJv~*8^J4R`{c{X;_|P6-_1E79)-k zKkkj>JsZuj)JLXHKY~n?{-KZlo>8aSAO3!z@pz1Q;d@(k-{2nOKW)#WhF_+$=RH1M z?*>gVS*>%F{ojS(Y&H5E&kV{;n&Rs3peK*VKJ@bn#I-`2r?J+hHRB6*p^Q7|k7=i` z+g!e5oG2Uhu-F(KCmQCA5?v9@m#5(u<41|SIl$k=*zd*t!fBK*Du|Y^fWKfp@=V`_ z(egRBij7BcZ!;5X9rmFJ>}8H`nvW<}U5oadLyZ3})=p>9ho}FE<|xs3`nOnn-*WRk zS@<5n!C#5KtoHV^2Y-uui1zVk<(!24Hp~kLz8Kz>`3%O4(f+34qHNU{=N`F8V;rNJ z3eL{JqsE=I-#qsBpYRI)qfZY~Oq>DzZnDKL(uMB3@Gj|_j||;?FRiC`qut*fCdyv7 zvnFI?zxhwXey`dCCOrO-*ofb{8}MAS?D30n&xrIuDhvD2`r`lmbVB*<;Kh5RD68rt zSy{Nxhd<^&{wLT8&sFAJAiC)J%HvzbM*JaJ1L;M4qx!6kujBg%KfmtM@;2ntvl_}f z4IK&pSB!P6EsoIol-2^LktTb;fcEr)CjTXWrdUbsa()o)D||WH_vj$_EbjfDW}SjhybSwPm(C=cLw{g2fmFlHc-uznWZ%|$3w5o z(#)C85Xf)AHvUFgDkQF&)z=ADIaiax&%FV7RZzJzv= z9!WYpk+F+(=zag(v{Tf!C&f$~^}U4pil2`5y?`}SC>QetVguE)FAQCujLvLBKfDM2 zccH`k*z2G4tG*0#YmRg02(*iMU&dG=IVVx)DSJ4^#R$Zfkq7?@KPMj{o|D;P+GpN5 zcbMvak>r5)CB&d&*y&}vXhJdU6wvabZ=Wms2<&@$T=d9k)c;xzuINM4|EO;+{nNQ= zW5GxL+lqeWaYJ!|>NI2Ir#?{ejK&X*qdPz|KiN4|nXTX<8xbGPHRKyK$I!SW-TifJ z0zZv2b1r!YG(C62JkeKxH9S3&qH<0B;#fXx)?a25WO57=-#a&r`kUqjj@=IWE^rcS zFX}gni7%C2v%t$S=yAlJKE$A6jD>3WF~y|!?4pAe zae^cP;&zWx5WVc&x-{`uGE9$`MR zU#b}XDtM_4$$a^;&DT($qixM7o3@|z8i4EmE#%2HIO0`4;?=WXJ9l_T81}+*p35Qc z6|{GrjP3N?GGE3hicjP-JMyA^G*9ndg;;Rkxx*C8sBdd9HlIR03*LzK;rkn}?L(}l z`*M1gPS@8l<|@xd`{slYgYm7N*X+y*3r=S2S{oA25D%_zE*K48LmXaY#n0}A3_PoA zsKotVAIg$#=vf)=Ipn+~5)0*XZuHLt!ed>Xn{SNZjga-&9gKDjyLdyScy;R)7q^a& zv|>Z3EKyZgS6dgs7FwFJEDNvuzFVS}7V zTl4zX?lx>46 z=zc?Ydt?)K_=@0j$f{6n?PBbEwrTxZnEK-GSrKeB)VYpWVdx%MCZayc8@afnV^fyg z$V+zwHY!VWZNR6CIbgr82GU-Bj-lP<<5~NLo3vy1fI1{Q1p2k*fNJin)tw z>Z_|Nr52js@ViYLaMx8*YHHwCI4iOShFpa{BVU6rc5lFLWQoYQi@V3ER^HH!Zk49P zCUDK0dfKp+*hkUgQb;7z8ToE$>Kx9mm^ZH~){xZ8%VJm6Ra92Fn7bL>c~o4c^-ykP z=*SuH)$Y!932c3bUg+#;LvQtD+LmQogFOVV2_T>FkWGYF`5{PPD9* zo~xXVL{U@mDqv6Z`kr<*0<>pwCbdI~Qe!594}8mkf=#xXH+5h)F&Yza84M(uFM# zl0__Azji(1NQ4B@02yuA6Jdb!QhQNzOG{#dDi^t-i}qB!zT0r&3YFc~+});jx0_NT3wrUe&k}zH}lb~Qk#nYXB>YDq)fj5t?SHHf;3<*ZT-sGbMkd8~FN! zud)QsXwF<$y%=jeTSJnM-yUU$f?MZm|6tbvgm*3EvDx*a*m0eF+Ji>wwy@uPh*7mj ztLeExg6-wGK|(XR7r$9p$|6^n1ScC^D7Hr@4|&jkqOO;;7LK-JK-?YlH=Hn6S)K6f z%=zUy0b_CUgf5H$@VZXE;Xz!Gujd!Mw7=li{(@UsAYc80S;}$EfZ)W*H(Y2nC)qyu z@Es@1U0+DNa=V7$t%B2gT((9|-tR&&P9AchR;`13@jFda=kNfR zL5B%$C_cT!Np7>`W8%2m>NS29B%fQmPNY+U|J2zMiT?iop`*-hT?<^Vzk{x31s`;6 zwEBGNZO{yxUBPQO`I760ZGH>kt5;l?*B@=?tBWU#!){$M4uZn9at!am$b)Am1gEHm zdOa@I=%@$v@3GieZHS4kLC(9@+OI>vAvYAnIQggxE#=nl|L}sJ)#l_TW8iY~eVt{C zJ2vlSQ|#0&1K70pe5U36**XEEadM>#C3_w!2-I;N<-pqLQ3Gn6 zIUJht-#PN%eZV|>bnZ)dkB1I$9d}gngubGOUf0PpE)+YflZAK@g$^v|B04$Ig&Lc5 zvdx1w=;US>ifz%!`(3E+%R1?9nI@J#tD(XyuJO8vPDWj5>1LgD_ec{7ytW~aTzy3w zV>;R7LaRBs#f4%!b@DM6y6&`2mJDDe5@k9Wb)i_LPA>AGm`*l&&`O@aPPV#GY>Q6zx=`b8ojl}1b;oqFco2)HUwM)a ze|YCn_O#}ba{`YbUf@cQ32#`rV~Cdwl8*@xWV#sx{@#!Q1e!X6$9k3wbTvVcd4b=x@A2&)0f?rBYL_;CUTDCCJ18-CG&rR*`$o z8ot*bTO~L90~-)4bT;2{(+8N~j(4RpkmLzW?02JV3p)p|_hju%u*U$j_AGduT z;<@xu58`R{B@g21^^Bh3U@xBR#<~+!3p>pQ58B*s&T3JO_RjwJT&=UV=qtG%r#U#{ zwuoKJ3pi`oY4*5Ivxc3<-Jg=6 z-N434URDy@gW838%z}-Rd|M+c)xOL=4K_}eXg?%2PP3nbjg!6F5v6WA&HhTdX=tVP zQ)1&ZJ1p2Zxl{Wcv2mK67;Kz8X0UOZy%=nqJY%qNnmrqAoUGQqN|kb&y&Y_vJZ!LW zn%y02oWu)F@*ruP<{PByrmaQ6UCw`t50*K!iSq-(R? zJz%p=b9c*nnc!Z->@$D^5F3>+PV;JB7G`s@=_Ke{NGH-6>X^=lz1d91+`GkAo|6jQ zz|rcr8w&Dlv)P?mT6t>mZnWL8SL{v)?l^1nAf8%yOEHM&spV;pi>H?7J&324&3aIx zAdk--9>h~iqdT>@!;||Q1-Xyza=X%XZMHnP*zP0UsNQ-$tMelic27JHVyk;kDOPjR z>xdX99j_y}Z^pV%jFSy6)XFO+_I)yo&fVj3t!BUHo&*;sIRHadPJY?zXO6qv-zdn* z6FU5&ASb=M{TL@X)Z&(qliax|$Vu*8JOJQizT2s*Iq5wnNN{qZ%N64!dj)FbBzpzK zbCRDkfa|!H!EqdVl$H{#(7uJgH3uO6X?-H{sO zPTlEts=LgMy4@AyCM4aCozP=}2LR%S*gIQCxRq|uyJm|{?sK6=P9AfiYdCpYLsA+O z{G>&OsA~Ouq*{+M2`mc2}zb@|Ra zZaD;%xlt*>$x01L(M(jkeCHL->-Z9PVq3$>GIufa32QGCcr{rbw)jL~FNcK=uP_gg zH{5Wx=6vQqthGJrY8~TeK_@k2iw(l9je`)P?)gM>h~kMEuEzo3em79GaxB1~i^&6A z91-5|APx?~ZCNXah(jL4E8gcl=zL0^(bnTQDp$W66K;S^1a*?b8fF+y@_Lau<(0@g9RyQC@-IZ{z+nN<4brOFrrft50lRR}$YdF2xW8=Al z8+x8b_qaW{!ry2r>2Eb*=WF(}S{a^|5bw+MoW!OEt*2RN{ zgzQ1N!$u4mY%RkdCrXy)L_mMk42fwPN9WL`+tIb;ZOvO}st`2*38 znju7#L*D{}gvLWXGCO-<_JHhifWw9v`(|L8{&&Pm%zrC z3;{hG8RH6|1922jlNK01%;FB6kfH;~R+qy3g`W8*mWh!AJ#rGr9FLq_rYoifPsvh5 zh&rc)I_I9bg_JJUJ%TP){V|oi@iMQU6k6ujNcJGME(Lgo*~bUJZH*tmOQI(dZ?x9K#2^J=Nx&?mFL0ooF~si zpIJP(s+_0~m^Ob?gm5%N4zo-dH+3*~u~JgcSgXqg@(&lkz_Sb4r!o-dK- zaq?U&&*SBJf;?X;&lBZ&k~~kA=PB}BBG0ArJXM}Aljkydo+i)JEN1mhdTp`bM<$0bwSITphJkOWs(-|T}-WRl0ne+4UWg6^%n*874V+ih~hC=~GiuL{1~$dRvX*|M8(|))`XHpSDhsA!kGDeic}BKr$o*ey=2Ki^vA6 zz_UXU=M7V1Wf>i&dP@|g%JxPT#et0@8;3S7)T=7#?bXHHa&AGlq+7JtQA@>8(D@v0 zljWk+u`->ndW6I>9Onq2EMme6R~=_@vDQ&KSoBF`xXajJQ8$8D_yZ5awn)7=$vB`xmGN&9oRU7A=j!8-~}R;qdq=uB^(l(M{49zTZFS2Ni5Zc zXbM=PGvux94BYctlQIN$Y zFgUW>= z))N^^4C+T2wFdQMM$Dj&Wh^zQA7|7V)IVj^8`MuS8Vu@q#xjF?D&uNJNnL)LvE0Zz zk&yCtL?+--T_O*(7i>R=@GF#?JD#QMWqGWJ%>?VWCv|AM=Ltd8Mrl=4ZZ=l_w zDCrrw_8kT_*uFDc6p}zXtdoHv>LWTrcMe|-c*GMpU8_EX7 z^QenMVu+;fr*fCT<2`B|dAY1y>1LTkt|FvbxuWnPs7OcPm-Oo4JU^6J3Y0_A3sxTHW0t*59=ae*3I)VYBP z1rtRf`34<Dol2tbarm3pGLM5l`s((YoTwV36L{#dk$vlCpbk&krpsT)| za+c_-rS3}$8ijKZrAN_F&Lb@EFf>u8V<3e?3cFqy_+!BNJ@J#ic`r)_D(d{1z;ig| zNlBCvh02*x=^p~xZ=7M!K^2yKr6BXrCXq)*5)Pdm@~z=l0hHZiD>LK&>@p}*d)GX65lq7!zS^FNqk2PKY|)%<9iK1jjBeLTbHUv%7{0~jPjGs zC_lxF@}*{!zf4E@FHuv+ix@srOoo{i znkET3>s}t3uEuw+Wj&-KjhwN*8CLxzWAUM|nm(l9hr{IQLda?ATj6St_;xrZ2^p9V zhZ`k9w-nYR;U-B)0pAI?Nn$SLd^g-7i6ulF32%^u)a?7=4?N*VcVdd#BW=klw;wL1rO3I*?&S_4i=Fv@Dl)oOyD?x zfhO=2fB`1(Qvlf}@G}5eCh#zchg9Aix{WFd>KnWoqJ{^LsyunS zH#(?q@NS{JF~Ji?-bF!ugGUk18XG*R@~)s8yo-aU74;yMyCnFAq9#N@%?O@Vl#E+f z1vje|jieR^w;0r-U~dw&-Jq5PcNkPGc$Yyf4enHw9DsGf-3C=3++$D;!TSwrS#Y1C zq%Kznzid#;gZmAtG5DZyGZ2RhjyhxjO#m)5fo1>~n7}FkBTb+Mzz7p)1u*=OpyQx`W3RMQbjrC-_r?+7x_R zQF57fL+}>?F?=C>P&&V*LjMM0djclfC6bU`Gs#vFS_+tA)4;&5q7+lBY!#v9jl@D*Md(&ir`A>xTKdFNyGfRz z1&&o`w@O0VuEAE}T1M1m_H{Bx5?9-6g);-9;KW!3WQ>BN3qks1M1)L}fQ->WFFhtK zhHpR#X{3O$ih4XC*G@5Og)-PfG=%W@Qr4yk6&qx$uGI$9go+KCh{!UUPzKY4GMFZm z!6dQLG}ubJS~z4!ClAksWXQ@5Slg9aa=dv$l>uGRFL) zt#6B_N6@rAc9R(Ma{byc?ayHiux&@6j~43#}y@g^BeXF zMM)PtWIv}U=}!;a&l}Vu_DO^DJN8Qk^WaW;vZ~R`YH1VLgC)qQMIQY*&=(r?y`V2x zBnwm11NUbw_K44CEs=y&a&MN3CG`9f`B^Z>y5cD2XzNX$!rw?U@wCjKMnxW7VyEO8N9 zk&P1_PFaL5xz1^?)T>4-{-jz_4tD3yj&QC(B5N*5Sj-Y;NC|DuU!;US;yj}y{F3T@ zN3~tzXI0x}`aRWlnSNij{a=XxZ>p=_rnIosC@3I91S~ZQE+!&qMWvfvPDI$MmPCvQ z$5QUvOhlH|D04OvF~Dkqc<84(o1VZ6XAsUsMU*6JeuOSNoX0$CJg(Xz`|%0Y7TFia zjDGwlqaTl}wot%zep)Q$$bNrX_2Vz_ikI^X)sOE{`kAQYDW&%Qy4tJvH>w|HU;nPr z!~eO-OaH!Arlk)&-zL+tum5d>$8)krroTz@U)U_u(wSfG6;3uBuV^SvbT~B;x)eHH zUf~|qc*I(;OW!D~y=KNBypV-H2T zIJbITc$-pI`s^oyq9_DMkW5!Zpr9q;n*!ouXE@GEO{z&a z6F^^-C#6Wem6T`_mlm)rnN>KeiHnROwHD6xL~q4O(M7*u(_Zh;99MKdvgmL==R82H zvO-xk{dAj0tNJ|I^_dMDQEq*QR>rB+NOsKlk#QbkC90O~jdtLk6wmr{=RQ~gr1 zzd@1^kF28`%!yJ)@S4?En7`t$AUWQT`i;9mPEwp#Q=fZT%P4CyWd$2HCdpV%0TJJN zL{6hc7djOE6_?H#qr}Qg`qlqdybn;8gw?6{0j#Ma=c=R(V$QYdtkPU-X#o2L=Ct(7 z7C9eH!j=YZOCkR@df&h*6*>1MF)L-h-48=`R+-58WxouOb1DV)Rtl_tMI`ickrR@p zl-7V!q%Iq!wp5{XPR>a-mu$$|Bxco+kEOu+>mdf2;&OKOFH~YRvL^Jh#&)eCH2@|| zQL`QqQ{@e^3k)#nx38l*=EBByv3>!F-6w*hWyzlC7s%Ti->X&`rn$eEK=C?j!ik9t(P;@ zc$R-ZDu;65W4Uqw)A$nZP^7=m((_^6O#3j~N2W2=PP6U+*HN)0td<_2gW&XidL z0yL|6BOoXxrKdyZ$Z37-O%W&s@9hMAfa+ZmlH9k2sRW}6g&XwaXA_Hq7wGpEr z=hI2NtmoauBIgH5In*@&3QaCK(yNgs2Qk|m_@s`s9WC^dGo<`q_EST4Pi0yIASY!R zYhjuq$Qbkoqn3VJAmAq}W@wzcsw>h}HLbrW>d_b)?~9enlVB77l!Sgr#Tv++*ng@> z)o1-?Q@N`3H;}bT=Vq8>Qa2qFR?3d2nap2_>UWHm)S_mJoOg|Wp?+7ZPExMkLUyu1 zOwH1{OT?f;83fcQEwQfihU?P64q3RyUwCQYPT3J3Uc|IqYZ*or1R0e9vvYeb(j#}A z9CjFFwTmI7KESv$s<$vfshf_+9h$Gz z0_KZh_@i3D+@WrT9vdycGKC~Cc;@;Yd)RVseVcVDF8s}(F&q}7ws#jotPe0kd@A1}!pF(L()P*`R? zX<1k51T{g+eJWGRkSAG!8Y<=xV^)FNa>X3@pG7Ah{)P~Kj`fTz z8q!&Zb4#ISxa;CwC3q0&55Zk<3-i1DK~U>t)0@=+_kQA{f(X7@z&;^<|+7q zTvuznqkUEP)G1R-rs7{|$rO<8cc8k7nxekLwNhOsw?NuTlD0Bg+Db#(N|v^A)u#3i zS%oJv4kf0SO}f6kS!}|$pw_HUwBnnBJz~-F`nvk~lG=C$K3aEmRlKfZ$yHSvox7r; zsy<$|RFm^->gpSG8s7!1Yp7Xrl_sl}RC>g`+QqR&RSo!Lpb}ocVo5_qqreBY)+FNi z=37q!UqizO0pnL!)z#xedGXSCi66k{|4fdl@*|9K-7zZ9`_f)~-lE$2s($Fgs;XGL zVi8)UN_$@|jQ8BQAtCU!$5?&5rgBl0PS#gdEs57Js;IB-2gECD8&ZNYV^ddqd_!|j z8@CRUVK|nIq?8=1s+)&ToRJtG6t6B7BqPz?!XjY0_`Hfmi{@6$TbT4ww4@CE(KN#p z^2?oMc(1f(nqRZ1p{gz(tE=+lrDQZe!R8YLGs|8zg%cL1-bxl$S2eGSOrIn{gYj6c zavf8S{QO(WQn~@>Exf$0rlAVotMpY`UsVTBi>Jx$uetQRxwVxml680CxOQ;3ZVC>V zx$5t8q)|lo&yuQ!<+XJSA%Z_7nOuoxliH-?(Jfw5wH!l3+O=j0M(mP?nhHHEJ;S?h zp*|X!w%*!U)e?N{G`^^|qB4$8D%Mr7Y#6s@{)+g#s=9{yWL;B~(W;%l3`WcR+PcMD z2}!4bQ8T}0UIl$#Gr1<+%!(Magf~_!sjRQASXdRWuEMuK>wLVmOAyKyQzOtM3P80B zD}0@;<-x!{*7{|!SZ!TDEAlrt<26faWQ_C->}FMBVAa+7Dq3D&6Q5UCg?>p^lJJxT z@KMBgLp4fNBETe^P$Xc{0KHry7S+yv2#ynW+s;c1J`;TmAycwN=fWi@pOcd@#ftI^2#!m54-h{vihJjrm-LB(1V)e#Npy zelMGMRZX&X0OAOBi))tjcX!IGZ@_F7udHaO=wD9dB~4*oR~nI#{jz`fkdskm`g{&! z+Qm``;Q8}EBm<_d@O8V2STz_B?1RbemHCx*wXrn$^Qx=R`}B?7`uccX%~jQY%R{Wp zt8Q5Aa}aVxHTHZVp&qhm$ki;FUz@DWRp{fZX?{%Vd8uP;v5(iVUAnl=p2%@T2cGl9 z5qxemUe}nc0%2-}k)#>HX+k+=RaDl-d~I>zI874$E2(Qtli^mACSPioB9G#Ae?!l! zu31#6RF7X>QxT6<)b%sF;vu8Z4B)^k8d)|!1^x~2QiSjwp+A)+!5kG86ox-4LGfG@MNXv+Wi!~`J zDVBC%I@G$~sxB+Wn5!%?Wg5DWX%Wv#W<^tZSWpV@EG{nbJ<9nmOrdeBBreY@olltn ziu0ILB$HoOJ};n%a0pf?m2_Ip=@1G7M(34=c4_IS zBsmI@P9i9MT<%!n6EreuDm=GZ`zYJ{S)iQT=9)_HqUz~~`y*3w7xg458EwWwa zI~y7`y|{edOpJ%zblO~l2sq|ibMw!4gK+j!ytN>Ijx^DQQj%`SkNV~>(TB#3oq0ic z%BGhqMpPaGF{#lym{rAgsIQ}50}Pua!po%bRO;sKd=Sm z72csHGM;rXM6bI>2go zwH(v>JhA-pvYC_#)~Z(2S0$rj%<3>ka-R$GOELQen1c~g0pb!4{U{FyQ>RTS$EqBT zT+s4&=qwl%1>ml#*8&wIr*jHmK91esO%4i5$}tp|_ElTIEK!?WnXGM!uuQ0BR8}~9 zT1k0XWX==$T0-g(^RU)~;Mt{Ix@@|TOausr97Yub!h`799XmbNE)rR z!Uc3_k)|L)3tf>a@tw)M zG7N#Ix+@$Hv#V7x)?{Md%<{6SB@5lJurA04Gbg{QM^JJOTt+M(BPb-6vDXV>G zN-~)g0~2#QEBW?vvdZBW39UNj)dv>#Hy!Lsl}xA2)T%VnX@`_H{W-!xleLnw3X2hU z6I0H2vE4P$u0=QpvjW~7+tsSp$IOyqnGGfKJ64r6VmM{~JoLI#^3nJjl66%zb;}aX zH7k)qETTeGPN{+dOJNcG4`J(Pn^GNKE}JUl@$p64nIK?xy|xhxBH1ea$|Lm^BJv<27Z z=69AyQ92LBI=e%De1Z&EY5VCt5(Z_ukI7}&D8j3*Kst3tEXlGK@r+Xz)jH2|CywF7 zJLb;~G7?h@F_xL z#<)rkO z;Z%5jH*Z=2`k#&s&q<(>cNyy3hz72VQLssUetv0(c8o=BE4E+(R^&S`FSO}`nWnp& zTW-5WJVL`O4MxnB3UZXdP#~-%SNhh3g)$_=OwIN>^7cbIQ>jWvkAdnBuAuqIdQL!O zT4yYRC%6SK-{Etx?4}{wN6za+z&(J&BOCZbXP0Hn&{3-!5_H52Lme+Lu6DdoI6c2z z&+Mn3=^~L;ADPXDS)VtnaITw1q{S2^=E?IKUve@BmO-*U&vS(*t1cW7%`RV9URvy? zxy|*FYJq ziVNmq(6%sg2k;jE$(go0absh>;!cXEdu`P%b<6R-Ph(TEQPRO8v3siJ`_%yGY>q4X za)qlCT*BlGA>rpG`oxme>Yh?`yhq$z)nK8jWDep#mV(emoGtAW@FN2Vxj865Boucd zTUXfK4} z1!jqeAoC>vcBTeTHy65w+nM>D-XTSsn14pe96S(k!wWyFZl7={giH)_ZovbU`bxa8 zS(T_xR#f4&SSf^66*bLxf3>MOYQU5I6-#Q9D9s2jb~aT<6;)M8uPKtZA*1Sg$kaF1 zEUSSzjrGm-mG!mJiez(jeN|Mmw4yQ@`L|nnV}$1DHVWvS(QMw`1F?6)Fvfg zuK4`1ln9PQbZLDRdrux1yzXIt>RWy_)^Emh0lX-is`%5@mwq!KGDYHJ`@SH+{s z=EkV9zNM}?;dC`cRW(SnaW!hRsRj=cnnYBDBwhbXuJmMB9gJ4A)Hc`Pq&b174|t~5 z>aweU&l zvHb`j@~JteP9?RfNepd~BIakpH2^uQYD7L{4OPO9bAIHq6DW;TVo9Pwge$9)mCNP! z2D}H8#ErgyI)F5lCMa2oVvt)~nwL)W4HqrkxwfzJFl(+^%H;;Qa~+BiaSM5@ zX-X`?DI5z$l(;zASf8k?uS1i@3+XPlK}IY?4SLU$c(+1Ye6pfWG6EY=BR*fa!#6~q zIj&Yq8-*{|HP_U&RJg$#Dz&Kw^&i!*f<+a`VjaRhia6nNQk7hqMDq(s!-~ozJZ}Y} zN>dYVS%HrV-@=-zQ+ej{xUFXK!O~rYyYiK^GyIxHKySoquc=cD!f`mXXA__Dpa$CCP}NIzP?t~Y*xr(KhH3Aa@V2NF;!I;jVg+K3MB*m2G{igjI^1hn zje1p7S%DUT#@Lz=*LOC$(BgSxvZYC4D#hS4(xXTR-S*H2^kva&wX5l@qZ zJ9our*?U4$Q!TpD)=2*(r4g|Q-BBfq2;s}utC$*zAO-x0 z@K8N!op9PDw@Wmv@Sh?r6pAOTZnu1l&ZB{!GIbj=CPMu|FC&?x6V;Uh4@-9tygP3|85rlr(g&C=Bg_lgCNQ(or^)GcHr zWZKcV%IC$khsKr$85H}Giv(#uE~E-{HW*6Dc%xzk8n?tSr;M*VVo@r8wwT`mM#;uT zG-3>fQ&x!as5hT)vE3cIiW8O^y?Y7uF}Wl?tFNXe!4*;DF^#Z^V>9S2`2?ne5Pv<1ntl)m?=#B{7pg(B^)Vp!3D0gHqgOgiMa za*3Oyc_wEFn-wT$H7i|YtZRMR?Yu7-^@!o{QME=Y*P&WOV2mE%y{`SF9U5WQzhUP4 zwA5*;meN6qH(^=`$CD_N5{{$;zzSo7Ob&y7#GU)@PvcNiw7kO46YvSR1VIHy&hrqR zqvgqD1A_EQj2QVqU%PgMm8Jx`)0!$oUCESlCN~UlqcI7F32-;DTO}hlIZN=vnIhp5 zJ!C@ziUZBgmsM1WLKKhp{ZHD^B}wuAD$EZW>sKSfYn`YB48Vda<~6H)y=3aoe3sN@y)GN!o(HT7}_BZB1QL$Ca)E+R3>IRU<~R znCC8AhVIbcEj@_OLgXjNZj6R;MKHCHq=R!zNL)doSCL6oBiaTWs!@i8en^47sc~fu zhM$PI_`^+%hY$%6{rpH4?kfs0$&qor>nJKKP#rb!;)IMh+yFrOY#B+Ri8V^;ud2cL z0$~MyiUozLXc_)vbcJC~Rs9N1`((20W-V^^#Bmx%15FJTtMEskBJXk+4y8i(!5Gq+ zF0J2psbWQk;bK#bOcyKa@IFbC^AZF-WZ!qq_F^jQNZ)wOSQM9=Um|P}0?b6t@f>wdiq-if#4-Jev&}fwIi}h!Wkt zceRvaKUyVCwPX%r+f}+7{GdY9Blc8l4Xa(9oUy>ar{Pm^bzS4fIx_vn+`u;v)^}yK z|C?S!Ntpvl0k|g7VR!;3TN!nrZp^9mEH|R~AXnc|fzqc>`H4Vd>(W|`F*rqQZj`|7 z94e|n?IP%;3Ic(-ve`|D-55*a3gh3Bn)+x;VM*%6BNu|xscJE#u`>^C5aT5`V{l6+ zTpbbO*Hm;Sfq5Vnuh42`fQea!TNJ?1&lxT~77t~aAjp8LB!A9zJAWc~RJuj|REN&N zuf$WgZYFC7Qsgq1tc6EmT>@)sresT1 zy&q1p7eMEb4j-;SB`DQmR-p@St{l+kVrq4ULASQx0pevP7B_r7uR^p)EJ0B4T@``?rp&$`kq0^=3Z!CXMNP^v zT^w6dkIc~$zr>cFL?}k_)F3s?&3$#k4G?8rvy)Pjx9BjwLTlg|Vv{tEsM2@vKJK!4 zL^a7~#L@D*d|3wlmt zyZilZjw3c>Xe?nwqKdC#JY5+JS8GHw#=04%1Wpo_C9x)|Xs-7K;=K-EL*OoJ`$@XT z8!!VSV8jd`1~8UDSkS_1u5ZSmg-sUf(247%%KC=Y?nFuu9^|?;A4#KiV_&l zAq6v2hh=57T)kg)hf33}lLLkHRLzx+JeqNpDuDwPoa$Mq)mtr6no7HeIhYdG%hXE3 zaBXs_i&GMdFU4hP*KYkdFN*$u`C1nDg)jJ3QMYAWTpDFudUVDSy@p4*Ao7JfvK^4! z++IhWc75gzSvO|ilygUq@5uMf%6<5bAh)S(F3#q96v=l^M`a!F!&fpz&6JU^!i^U9 zI%=`%zPZOOy}sS&)_%7Sx?{+9hPkhv-bh*buFg(nZyP{qZ_`f7%XbUOHVFUUa!2Vr z$?3y=@qJU#!8b)30I=2YWb;kn4GOlo_hM2abqToIpb73x@)YjZ$7o9 zDQ!?iMPp?(zDNfnftJ=&&+LbG z)82|_@Dq8tJqE@za?Z)j>TvaWTiH#_7`^h3wLF1&yKxz8B+a0W>LIPaXeNS@3!ON_@r1b(Ib88SxW)WKJ9yA2};N@Vt2UM*IZ6{gB5T zNN;odLgZ&3ifnc~>;2jBoH_AsmxD;*;IJ?yB56ZpMqKy4h9$vYtdx3v4Bip%?)-ZD zSGIo?@3udF;%or#KM?yD#8AZF=#HBGYP?5ryxUB;rudw5kCL_Uqjy%KJ!QvsKn8d0 zSh+@W{AGw0lR?~-`W;`j(jK6@to z)|qh(iU{u4(^+~Gl7@qPh@|2DJ&Yj-Jxh!cI>NA-#zv(2;lBs;@ME-aw7_*Y43>l{ZNuV7M=$- z1Ttt5Js)=a^Wvjt#lHXyO9ms=;j`j-a%1)tsQJFxa}Xa|qzZ4q^{h2GS%adBU5VsS z37@QVk?H0hId5gh_O|4_)rrHd!H=5`>ybGb4qF^Qd{+FNl6e0ZlpP*hg=AvgQBBA$ zN^*d6+}P~w*qfJZM+1r7nS}}{j1NYW-*t(Y6x#}N^cCXH{n1>WxuhueldK~7l#74L z*&go+(+6a)jrTy?a21an&x~h6`%qlTL=+x+Sv>P=*|CjC98K-boSge$#Gfva0Er?R z{!u);xWxH*Hc}ZpE8Z8WZ-YH3@u#wKCO1?dh!qiTx}DP|*mB!1i#Xrz*f_$f#M ztvxPDJ{<3bEx#&^*Br50Z zi)}>82yy=e?-x52wiZhm>xbsF4oMw>(i?=V_TL^yPcZ~hvH$dVx2r&UWfvp8?MMWl zZSi9fV`j%s+mB910(0zmxcK+Q2-N7__`dAz*>fL;fBykd76tz>B4lRlNkq9rt=!>X^Mup<+RW zTZ#xV=dc;^A+81Oi*5B1FUHYTJ|byvxfosJVcD_IP%+u)(b0>?e*K@A^;p`hf31dD zhiAvWo{fr>h6)pV?u%zXEU}^&`q7!_Nmj3k4@4m#iP)>FoygsgJQ7($2k0ERNA}MV znj|d6hq`?agse3v&>nz&BxjFh$DWh4P%5|M#=~aCkC$Md8=E1)!PO{Evv71&_7zeC zM-|3Tm<{K5O$a!OeIIF0fH^qnHWzAEZ;y{e?~haDeqZc5T!y23jGQ2F;{>t!GqHIs z>__EY(M_sq6~KC2lz@ezm*@vS?uXpxpupi?`_VnY$ZsJEqTlHeyAYr25wP2!1&;ky zXaVmhevEdX9Xr@s6#E*6A_rR~zQ=Atlj)A;jWFH^?G?raA^We;eSCK8576BkSB4bD z$3j~XTnz)RnG&~i+Q5+u#3O`x_!q`UsA{<}7P}Q`AB_^nFikr4x$*36@vK>M;<<89 zQT$Xh31 zy!$#>m-8lyq<0a94^ryI@!m7zN3D(bc9F6-$^;lCJ8TUK@^)X4?{q`0XU4wy6<6?X zNcw&@+SG>CZV>aAZc<&hwR+chxf{kn_q3um;MX6cC{eR$Sr1G1a|B9VQbpc`))S5;r9D{s%%Y;$0mM{P-r6}W9aClWKbYdh_C2C zykK`Jn4hgG>ZB9?eJmrM(IYk@BNM;7Xl4)xacv-G5KvT zvK{Z<9^&j@E?xPK=JuOg(@FpQSL)(loV+aJblhSxo9<+b`9ke*B_?y^PPQ0+#Iv(4 z7Im~=9E0 z`!e(o$V~f#TW>_EzKs8!rTbJD<$Mn88IYOwPqz*V9n-tW*MctWf4hrx|J?LOn+cfk*Jk#0>F<+h=Vbl>d4&JkVcpVNh(59xy6 z)`k81y5MuVuzz(I{FN^3m&n#xy-e#O-AlUQ5`jC@^NTLz*L1<9=j}{SaToGsUGNcI z=qUr2?FigA%^$jb8;^yb7VxcI@RtHUJ&>2@8nT@UJ;(V&x7YSD(ePr*3@SGYU7qKqP*72UpOSJBG-CRuH~WfdntdZ zkyoy9SkevS%=ZI3C-PW6cJNr_NAXxbb_P7m*Nfz8&-vXvc$Hl3SH36EqcKd-2jr^f zLh9L1u6mSfe75D83%g}gJvUL$D00=K{4{dW6WXKk-0Ii(Y`Ml^P4|aPx51>VJdC$9 zyvc6Ap7N^a@2uaejUMGUkc&O)lcMPR0hh6vZd(I>qC$M`3Ap=hEneFn@Y#X9Jmi*5 z(se(|uh1$x5rKiTMcoO;HSs~+WHd@iRg@=+D&597uS0T2CI z8e`;0wUk8;~qV~_GMo`?C`W%LZEo;^m7@-PmM_er|F#y7FEG~gP?wERzGx#|2; zc`^A`#yu@hm4C=^mETXUdd{N#2aLS(Pszp3upD}2d81X&eCp{(uJ$O;CAWG`3-}2^ zIm`_BsDR&2uIYATIcy}?bd}#1=ot~{*-CEvg-6J3zwmCL=h#3`E|0AqP0Q+8OnJ3m z%0sp)|B)JJDz7D%^8y~r$NGSW?fSlehwWkqxu&ae_9=2LH|1{ydct-$jP{B>VSlan z*>cdhZOfrL&=cBuX~0L)2Kfl%UMT-+ARqE9(@q;HXXBW1jbmCq+OHgG+O=|xZ&D7j z_M+QN$_t;O5TA36J*Bi~q0z6rInZ-zpy%3vpC0gAjQ&Tc|8}EaxsH3qPW4q$r}0zE z;Wg^f_^E!P{Heg6u>3V1ivEy?mjlU59LoIS3AE+J9J#Cb}A3Y zp9{Q7x1VYB{5SO!ldB%(3j=#XJ&TQ=4b)R*^eAr#^n~T#Z1l)Fk!+V5J<8V^`I}i^ zI!;#mmEX`sx*Lt2P1Li=q^o?Zk=OQY`yJ&wf^@@i>{CXMj>Dcc=_-G*3q9H&iJwgN zMdtQLX89BAhuR;h|NMpd9YJ|5H|3)OJ)!-@0T0t%6!6gh7YF?Kz|Jaiwde1&r`qto z^oM40wNvF=4OjU#aw&%qLAuwHYr5*6HyAz2wV$g1onSw(j86z(4~J(S9uQBOJx)NVLkRE*K!z7J%h+qkMi6=&j_#5?ME0r%c$pM zqepp_k)ObFt2Xk=+sMWK89}-a89n9Hv%~07{*;lA(axPlUinK#ehB4v8F}R&kc*w+ z{9?b+(?mND7_NT%snM_U`e;z=Mdfoi-;#90dO0%SVSAhy@X)V{$<-fpTt1gv(^bAO z&=dOAVxvdnW|h&SydlsN+TU#Syu|Xq)aX&Z&dA?L`Kyh*@{QzDZejU65b!X*?Fe`% zzcb+BxbfY9hy7+A$M0Is@6pbwe}MBL&DXt@e}r7~rF;ju&DRG3KQm=b6y<+m95 zU6hxf!j?_bRldo{KhL;xpOIJo5V@_dM~t4oP|psdNBK@8|4qujXt>6=my8~jf7Ni6 z-$QQgeAnoIkm-J4^eE5aBXiLcw)fnChkiJUTOYxW%U}8AKu=ijc}CA@#*wK; zkMgoWPdGnnGkWr*d>>=n4H~a=>SJ5x1Wi@NoQ4 z7VvQ0qblH213fp8s~=v#dcU1q{ZRR)KuWa(0h+xe(6`0(*4L-12)UV|j%8WwU&Gz{9t;)^OY^@*$V^B2-Vv zpW(R1%HPiNwtRONT;2oeO#e**AL>Qi{{1faOqQ#p8_HkC0<~OUIkJ2v#|f5yw+r5z z{fm`SK>s(P! z9@4p?+^`GrSx&hI>`bG~(W=X_>v=lrK#@K3wo3y$er&x2j?2@E1Ozt?ub zCmh$g{`b4!e`Rp7`jaC&*Ynpdc;4}8c~*r3R|PzL`qvFCxFp@HOOX4ZoiJ8pC&y z-)#7Qk$=bVC&@P%elGio9~u5J<$q?lKCgY$@cz{EgyF}N|IYBW9zDF2a>e~tX0;RneN8Gbm&opH8r)qgH|Ps0=B z8vj(jjeMw)zl;1R!+%45oZ)-PPc*zc$F-*#KAK$D>D8X8|ac4WB}Ok>Tf)uQI%a{4&F@A=iFM?ffD6 zRYv}4@^2Zwi~L5zv)CWqX83UO?;3tC`Hu`=O8zs$Tge|a{A=X;yi4p{OU^7m8z zIm3TW{<`5i$=@>kb@I0j-$VX^;W-?T{=@L2$UimwWODt}5zW^W@*MVW%FD_77+y_2 z$nZ$Zq@?67zKz_X8+sIEg{CDKz41bM$qTwHq%io)X?MT;OrW!t&>l8(Xk0zgM z_&MbB4L^^3k>N|pml%E}d9~rUk=Gf%g}mADN69ZXd?$IE;ct;&Y4}IvR~w$)$Cu-E zh96FTi{Yn|-(h$j`S%T=d*h2anN_x3++_zx(r<2&{Lr^)|l zF*Sk$+>iqAlLbXmfHeyeQ!kh3i2&R&!yxK7=9D^PYvHpuJ4(s{>R959;5s> zw~)tA4C3E!)KGfYj`#JKEv0MA29q*@_!rtQ}Qg% ztF#>cNZ!Nnf065ZGAe&G{Y~e2%BPbbY4ofhKf&-}Tqix%@b6N7g5jIV&o=x)@_fS| zC7)sVugGT`zLR{O;jfUNZ}?xy7aRT_`7*-~lGhm?XF2%4-%pR*`;fO8`Typ6vH#wK zwEPK__umhY=4X-LX!I;0zs>Ng$-is(gXH%Z{tEg1h94yVvEc)`4!+Is8RU-{zJmNo z!`G8PWBA?Vzc>81_>YIk2K)%=TS>*csMcYLa`Nu~7R`P!t{up@% z*8^0~-^sffemMQ1x8YOC2O7SN{4m4UlMgriF7lCv|D1fR;m>fP`YglWr@TII*L-#7 z;`$6De+>B?!zYuM8-4-#BE!EzUTOHZ$uBf~EBQr+zewI{_{Zd5F?=Y?;Y!2LBLAl0 zUnal7@O9+38U9`JdkjBxocCLOk4ww>Rm%U=$iGMah~XK0&ZN&>RnJiJr;PmZg1PeI04|3FOBbUPwO5@C(Vu82&Z#@rM6^{4B$tB-i)!G{3KqPdD-h z$o21yRDSSLK3}Cq{v>jJPfz6w$-ivmljK!~uO`>OFH}9(kT)3lyUAA?{$uh>4S$k+ zjo~kmuQ&Xk+`~f0X<^!(SxdZ}=YaPYjQ8 zU3EqJl|yR(F!F4!6DvQPyqDn%$p;u-OFqo-b>v4IzL9){;g6G#HvBK-ry2e!`5A@} zJtlJ7WW!G(pJMn7@|lJ=kk2uE19_R@_mW>=_+#XY4S$||sp0#`YYopn*5|9y@L}Yw zhMz)yx#82u*BM?;{&mCa$gefLjr=CVZzaFo@cYQWXZT~}n+$)J{D+4BoqVg|y*N(T zZuqg}`hK$d`6TjR8TnH3XANIY{=DI9$zL-3dh*u|zlZ!S!?%;aZTO4i`X05~znA=9 zM*hqZ-cPdloJ8gOllL(EDDr-Wk0L+9@K;89{UZ#YO?iEer0FgoKh4P3k)L6B8~J3z zzePU9@Qvj99+#&3Bl0;${&(bMhU~k2U;k@=1m-AkQ~^1$m+2*O8xR_)p38IjWY= zZt@BvpL3$Ov&Qhz2ayiW$d>`&+7#~zxsC&qK8uscR~LSLiKkW?dAU#=n?tp9!Kv4T!w&KPWBi6 z5pa>elk%SgT;%gc`wMYCUsZb!P`-P>MgGC5{=zVF&F@0Wk2HK8`8dNLBA;&ftK?rI z*K&A|<-FSPeR=+dwT2&{y#5`8>REJ}m%qcvH*cF z-!G^=hm$Wc^2d`m7(S8wa>J*QUu}3H`K^X8B-g)pP$!1|3&`1;ZKt5 z-$AJUo#gKs`B%t4HT)g&9(UO>Lg z@N)82!!IPi%J3%gTMfUS{9eN!B!9&4C&+(m_zUE(8@`+TeZ#X(_vNNv!Kvjrn7luq zS1W&ydX6>x-{hwo-sfDef2!d}lb0KQD)~~wXOXWmd@lKV!Er#Dr{;=Wq zlRs?->5WlOwm?YxpY4Z!`RBuFu8ZG<*}~ zKQ#P4@U$8X{}cAVB}V?XQ=A#mBEz%C zcz&Vb>nPuB_#x`Q!tl}TPp>ijO!C_dFCgD!_}9sQV)(7(j~jju`E!OpO8%-Dt|ipW+Q(c`Ogf$m;6b?e@gy>;oHdHF#NaV?;HLC z`DcdziM%J@vrzm0LVlRxACaG6cz>4j1j83mex~6g$;%8sl6;xr4de}mPa?m}aGghd z-Eg(%X2UO}9(~V6%V8e*14e!-`NM`UA%EQP%gKLh`1i?QH2gMleg8%6d6N8)k$;SQ zC?|U=-^zM9#_&RNeP2f9&m*5~{4;tH13u zT*rH_8NQYJ-!^;)`9BSRnmmi|>1e(Dj=aC&uaF;Y_?zS>8U8l;d4}&}e|>@BI*wXq zxQ?Tm4cBqh6^83L>Kem!9Ce%Fcha6shTld06T|Nzf86k`<&Y41bpVA;Wi)|H|;!$zL@5pX9p@|CIa#!~34<>+#=) zA5Y$Qn7^*|dop>h;giY78a|7Bis4@(pJ(`mZvDR zY~;Vr^~?(mznJ=08U8Kub%t*y-(a|oXYMfkN0h(U@W;p>GW;p>Ck@{^*8AlPh7TC$ z`5T5GMgG3wmre5WpBa8Tc~8DKr{(!$^1}?@OMZgkJ-D7c!Ejw?E-?ID%AaTWZ1RNR zN%9qjuOq+2@SDl6GW<^Rn+^Xl`Q3*9jQq!jKTQ4$!=EI7&hVGXUo-qF*4I0RzeD+h zh94sD#`o{EzIvVQ>vyo>N0A?A_&D;hhL@0^YxrXFxrR@oKU5gLobru^UrN5#@Nbac zVE7&6cN_j+%VJ_2fN|YG03+lMgfe8uF2bUq?RC@Yh*x zd4}tJx!CaMD8JC~Ka#f?Ue0tcGd#vPbEVxxTNe?XijR>ZqgJ*Y7Bn&uGKXCO^|~?U$z+uFsL@ z8D2^~6^4I_yx#DYr+fP@GkgQ(zhStp=X~4nHtM;@@Nba+#PENUKVf*k@!p=_8$O8q zzYRZ<{O^X3BmbA-(L}Gm`|$Sl(wBUw;YX8?H2hWCf4bpSl+QQ3fxN_U?U%n~cpK%H z8-6YMYQt|K|C-_7Bfrt`ACli?_zvL~ z-|v&#zP<`6f284y$@2|g#`-EUyqbQ#!0;yWD#LYM^diGAr~KuH>w4)o3|~X}TMYjh z`Q3*9n*2e-e^36H;jfWDYxq0lFB|?b`Ch~IdG|rX^?7%9zDKNaZ#2t!h~a0EA7^+W z`DunH$Y&aUJMBEra9yALvfwDQ+K3mD3 zHS$lBzijx+y{xCazE`gNV)8*oUdun%@YyW4lMSCwKEv<}seg{)3&`gi{zd9p zV)%W`SDoQMA-~x0C&;ffd?)#JhX0xT4#VFhzt`}0$saQO0Qr-K$C%&e4evw#--aJe z{;uKU$p`YiZ>`5oO!siZze|3s;ab0A4A*vamf@AGm+6LUJ1R9?+tHT|pG|+h&~R<1 zD-A!7@@owL8u>MbKS6%0;o2U5V0aeG=Rw1dBmcSKCy_sG_zdzt8m{eex8dt4|DNGj zlYe6Pt>pdqKD*ZY7nt9nhMz$`-0+K7k0%*^3Hh0Zze+ya@IR548U7skBE#Frs}0wB zUu*ail>fTnTgk6Cd_DO_!#9xMZ}@HG+YP^){CK`cujPCS%kvb&k0GC6_#4!dZ@A`n zk>P`>r_%6j@>;|9QvYhh_mN*|_^0GA7=AJJ|Jm>h$#)yRko-NvwVyg<_|GVx&G-7X zJU5Z|FMgn*YV^5!wadWFW*yBdrl=Rn&-ZJzeEyN=^^Y>VTfXOow4o3!}UFlX96yIo`_+G?YV%9o)?&}KL=do^>?;j54gzxf%0z~{u24e0T(^` zeM1KWE_z<2d=}qlQGd|qWqkuKdZx#*!!|JBt{kZ6Xv24rk0clWk@{_Ad5$si|DgN? zBR`qtHpTE-XH698`&_F3cJg{7zn}aX!w1oSzGwJk@}C;Mo?PE=N~KHwrjfso{8Pi9 zCGW@gN>tBVp$(I|xnEb1TZzb3FfHd7578;+xG%4@d3aMLymGJ8X{!T;#Q1_+7w7KGsvDqv-j7i~OVVp~OjT^tp_xfuM zf0g_zhQCj~AxL+aSK;<|8u^)1{l$9&E`Gk4?d87$E`F|Y@8^aePyhd|;ir z{t|FW_vJp`p1lE=bSF~J#{n1lzxVa>2Lmqh=TJV*b$TgJkzd)*%XbgB$WNjC;DC$# zJCr{x;3BVoA38GNB0p&WcGyk~xX71K|Ac^x{Pck$jr#&F@)}pC1zhC6$-#bMz(ro) zn=KEx$oC$C9k%lWF7i6=O$J=#e?(`g3Ao75qx~%b7x_OQh8?!m0T+24Z+|u5BCqf3 zTorJU*KzfY0T=n3kHQYyw*xNn8t3m0xX9lp7qM*)xFG$zhMxpnB_BBL5}I{~_QazvUQ_hF=F<@`oAuD$0)xxY+ah2(SOdfQx?Z zXD0+)4;# zk#Fth##iEa(JpBb*d>vrsTFQEF5M7hc~+3;F&eZHjfZR8gkc^xOLGhBZs z=nlhmzV@`?I$wUv@EbTUJ7D-G@}3iXKGe=<$wwOgF8R5J>-WFwI;-l@?_pnV-Sv$-f;aL^w$kvM?D`JuHPTsgX@=S{|?IQa~0(~$tN565piFR z^9)~1UTgR|^2-g^->JF9aQ)ru`wZ`u?bChC@Lcle4R0oY$MEly$GI-6`Q1vc&-ax7 zlKe~~ufL-_*YK^3CpCsYORmp*Q~Ejo`mT}RPkx`_!#JOM((py(ZyB!N_w>Huw^P2) z#P;ptm*l4!K8W+9FB+aleu?4wJH*!*uD|8{e^?O*(F#ILTml&Sc%a_+8!;8sl3|~losp0y&9#1#@{D9$e$q$?C)7NtN68QwfSCFqW{3`NohJT;@al`dF*K>y7 zN%_|d-%9?D;V+Q)=kpx#+rxZT+j|7@{yyvF|T*jF?FPbTw-|na=Nkh)h{y7=$#BV=Y!CPkR}O=DEFTXUuD_SFBj8dmx;@1ME&mT#K05=h zX$pGD@KIbp*%k26&-WOf!}AXU9{TM8!!>R3RoUY3v#>n#9Q8abx3YkT<<_tD@#8tdeWvEG=VnPtVq_kG)FjY zs;^vL-vEKi`V}jZbvS5D)>b(2G0rTc)Kp!uJejDht#Q{ylfTs5+>mH)tf*_MsBEsO zuR~%h8fufx$tsl<1^%`~V-kruvv7N&a!CSNN#L+4#TqIao019G0#!{k!)FXhEK36U zGn7xNz?y0##Y6*;6kE0XaG%ZfD4C>}MB2?2jm-&I(@;~lEYVPpos@yUYej?HTvv%t zpLw57P2JLZmrzTcWX@%@MvRLRiDYAAU45dqzOupr++LfkbHbY4)fpjAnvRUIXy0&DA+d85u4pGekK)>kEANh8Y9JC$<<=DJ!uVo80~>O@1bu1Z9j z8X(!c)G26cs)YwPxCB-;)-)$Orn|JhvCfh2LT|2RYv;w7& zY;0(R3!ovdL_w!-kV5t?8O2js-61Jzke15ZYbr&kzN(_RA}oF*A$pT_O)ZVdgo_?c z4HdXA^rK}h6^&Is%P?md8WKEhsV8A=p`bm)K`p$#eJSGHn>Yp+;2J0|e6C(0pChWq zOp@KiXhiFnGv#RP8FGjn4kySVb~qd_huGopblIPtb{Sveh-7ui%I0z2+;%K6&fSN7 z>llAM@D$!R*4;O6X8u?wi+$^uv8h6Y)njogsh=iSPSX(ofBJj|{WrUsc6xTMMaO{c z2KFm@(NjH(qDmYJ<1i+5Aun~*{(!@U6ub^c|I_^kQj-3_-v3Qt%S7@e4kQ-K2{u`i zlzi%VLi@sp(EoOp{zPU}UHm$(`o!vi|_v?7d-`(+kSzog{MRwv|e~0$#V!xEJ zwSNNB=P<(GBzx8yyZ;oYS*dgR-Ner9&*A+#zSA45t#{*o%S5*IJ%7hyI)>OUOET8} z7rIFQ0M~DHyy&%cOzU@Dr2o=>e@7b!Rg%6eh1m4(2kR{V`aKpZ@3nPIe`Xi5a>rNJ%N}_)7tLuT@0oR$e!n&^*}#S=>C1TCrZ2xcFOoKzf9onh zY&T8wpSt&2(>AZeh0g9D`JBIFzTU`Bd;b}Xe?~02g!fyn_bXpR|F`j{jrSi=L4Iof z6<^jx`)ym}Q`$s9DL6({7cqU+r=P7m{n2Bb&nUO{*LIQqDE5D0`ZA}q>A!%= zw|SSeChn4b6m8@UlI}71Z|^_#^ohCQc3N=akNy6P@#EcCvz&rNHGAIORF4x(?^T0MQrw&vp(Y;G+roRqV=*MREjncGIamcMOOJQ|!(+Ue0ZUznypRyFJ=Ucf|&78S;y)4M_Ng%A2OHhQ-(7_ip9U^M+lq!CQnc`FY;K z!I$P;KeN}&iF=}G{8O2E2SrX~qKv`c5SgDmp8E~qoAa+I%>f(UJ(|=#BU-%*_x_|u zwBaAG=gZf~4#Ir-TDcd`(l*Hbxlvo`?${ug&IDXnn?&bI*z-@=@^NhV7P$vy;?kUg z``U2do3Q<@*id(G^j1_aWwI-lasRGvZRbQ8d7q6E-38HxH;^c=pN78c5e6RqFvphvYf$r2iG4u z^pm_O+A8;Sr9;YBu2-Lhy0{`b59M-EPG(eAjdE$(op*2-@}Bc#-oYX9yn`b5mMeQ- zFS}9xZ{qrn%ya)Jb()jWZ=BR+_3=}-4Ub1-H%3vJ=tsUr%f0AB2WfgCmvWObBXjnA zgt9<4e(k2Ui32CXf8_tU89DD{4D&kom&}B}&4Axc-~8Dn(>B8oH|&Td{+QD{@8I6! zqSZMl3w%HC!97ExZFww%>SL#DTc3I0%w4e|&YoQ-M5`Bry@5K&%xo(a8;55_V|T=& zGV!UIujX%?37-t>9KWqKUdz80`N=~a9^-t(=W+3|ncFtT51jc%EE>HSIz;EB=?Lb;qGYvP6Vx&D%EfsSH;SccJ_en=&ri_^(4{iIby?-pKKJ7rC~;jw0BRk%4Qgc@KNqbI;PL%s|VI$UFFKWuX^VT0AZS@byPiR*w zu8A*nN4pf8W6}E39JE!b`|6vrRu9jO{UK*w_uDeiUgf@xSqILP@@QuZ?5IZCS3}oK z9E&Y)z%PW!Js78sx8-pGWVLJtAb)G1GxV9<_YbA&p@-z3ZA98#Xg@;qAl37K@##6R z=U8Jy_3zNeqUa~0SK3JR?;^yvyn{=2BX-5Sy>G&g-@^YW>yn{vtTnXa$J?;P6t zCfb(xOa;n$H`~m{w-246_V0uZlDE$;d3f`u%QE2mnP>ws#N4dSpP`Nqt?lu9i7^sy z_pXg^keGAgMOhm({_c4q+K_|u+>Ew!P?q=aiVeX3{`lVy|NG*9AN=o)|Gn_P=lzk$ zt?hpQuC+P%-wpq>@js6LS@<8r|4jTxJX;&xf9NX_z77&`{({0u!+S>;9g`82Nu7i- zF_(3-3*~{K$sp+)4#qM@qfh9c;mTt0mVd==7S^!v{PDKX`0T_el?-eQfzc_eqWR=4RLWZ z_v1qo_N<*Y=_&MsyHQqJu99}%eq4JZ&tF41h2^*SBU~%sHIzYEc5VA`EyioHXhXYl z`|!{N@wGkiw$j{;ya%VCZr(uq-m^CD+P2v6i=duzKR7f&%XM*PbnuCkPyZZ#oZ2jCgltncIM0|_e`;0+jvy$>j%GAzh%cjj3-bJ8H_9Iw?_v>HV5^x9(7W4 zR^GPJ@UH~=HS{rMn^Ct{ozZ>LUewv0yQ715qMoio9j!ke{nmiIZR=5Ii_gkChl01Lf$vuzn|E;3p+j5OyMFVCaqFeu1X~ZAs!Q`GT?HT0elcU+n$qsQqtnGt zu7WR#p0+;G!Q7tF)||XGrNgU7OF(ierNe7Z^yh83rpIgiaU0|+vh!RS z$vqYLzx&V?rBQ|-V>vbex^lg)D5JX@KUECLJNOIa$EAZbC7skYS;~=dd3gg&Wi8 zm}D`=1Jz?tSDDD$w|(%6rB8jf@z zGf0j_W`Bva*~eX*{p^xQH-FqSI=H_i)A{?LUVfZh1{-{Q7>M}b{iQ7SDw9ke-hXUhm@1GNg0C}o9l)F!~ zqvz(&p2$qiIX3srJGfT*XmoRwQqRfWe7P2fE`U%bYHA(4>>PPy`ECt1}a>d2yk`j*+6@dH0YJ6JawTSk7RPa{h@q-qvmd&e z1J*=qqZ&L}Y4mq^`vZgISr+e!eDb+mlGnTEmJ}D4l$W_gd3%9h?59Mod)#);NEC~? z6;I7tSLeEiNvdsWO=A;`#6uQ5B~d7kLgcBKtCO<&`rH*2b*pn5lT|f%TH4&cUi_0v z|3pIyfe$xw@f@nD+9@b0ncZnkuB@p@xTl7PxWVz;Z71_ABbuv+ix325%ZMsvEGXMA zF(#J{=qVmHU?r2tAEfs-EmeFqMKYt)?$l$h+dy+t4|5Q}WfL(y-a!U2wP`EY;eg)d zVcMpoSCQUZnveyWNNCEs)~8omPYG&_-Yzq zX70AKR931M@o;e(Rr9bdjn?x}Uz36L`ljrrw3HT0b*ieWn8nnGEtXe#Mau$;FJ<1f zEP%8&(wLke-*ZJJA9m%9URtAQ@kV}TM&HWO<4t5}r<&MC zdY}{I@qH<;ocnpHEjHyN%}rHrN~u2W&i_=a;zRCPtRm?a_U3cJRqls>Pt>;F}*)s5uaN$YWLM?`}GAjt&faop|>Tyw?3(V z^Pb1t!N9bzKeD$JGlO$ee)PGwV71F_b5o6ct{!U6GopE)m#|)cga@!y4|fn{MIU9% zz4IxaX}f@+9=?<+t;$}k?VTxitmJ*E51Vzpa32pcqVx1{2a#BCUdn=J={Sg7L=wecsDJmhiMCzb+q7fgAMgXnj9)l%X?2Mt$BKwPOG|O zTGgscKfB6pI;}EI>#bB;WqO!StEyvKRhou=etufzn%1sVTIG6}PHSn$v_3b8-cE&| zro1t!T3$?fW0FFt4{Py$)xuA>`KLV8@DB%-sitg4rqY_LhZ@TvHJ(=|r=|38W(u8G z#=}J^G*=I+Q|LUOUV3ls)+_yZ0K4_@tyJzmw=L=|wbX(*+WT|+fr%7OxB1WY3w45> zX={0u`sgZy`alpF)WgLoEtSnY)S}0@RS%0SsNJrhDn@=i< z#`6G1>*0E$|I8d!v^b^cJUt8*o%gww)lpGtXNpSy7mDU}rfA;(LQz>~ipu^Mipo1v zRQ|tEG`}-N^Zyr$7Ida)!GEmiw8(GpBRyP4^#9I}7Nr!Or-z}U|J;xC?u@8Z4?{)& zxgY7>==$_9RP>+wk=~63D?JPq{pWt9cV|T9dKfDD&;3a6&WPsgVW{Xo_anVKBU+$` zp`wm{l+iz9WS@cYSf74FkLc4sqa2TOaStPwc) zLeHLf@EaEqCxDaeKpv;v`bLF#za~dsx9C1FgNkqgKja+iQ#cS>drrh@&moYD_3?@H zN}b?J?+j>=aLI2q#9#Jvea12xc!KR2Vb@t!?<_w3bkBH&>|B|p63aAzOr5rbjx35TJx zk2~v*>ToNpIC^k~hzuXX^rI+OUdY0)9me{|Px2f)825_AaTA=95koVy21YVRam~^3 z%u!r&bix?a;ehPCVK+}XES>Rlp=ne+${d=``ibMC%wg%%(KrpRp47t|7VnQ<@Z_U1 z#tsy%3wxg5a{;VB1up;~tufFzOb$*JU2ot_)yJuZ32AB4J6Lrv%V+}$|kFtL7$l!m_~6%oBYN#6kT1HoQk zoo|^-$g?uejr%#E+h@3arrXEdKFjUBOm>tdw{^=3Ztv-Z{oI+iN5S>}?XHJc;$0>j zO7-eQD!86`gEzBX`dyjtcsIAtar^FW-^1;Dx_vLV@9p+|+`g~d_jCLHZa={72fF!T$GQFKZa?1bC%F9?ZhxlRPjvf9Zhw~B zpY8U3;ouy1`~|l^*X{j6LcTkm;`Rk@Kh^E0x&3sv-_tFMi}z*4{5_vjb1KZgLUJlT z$4i~e|HIyUz{gcx`~GLp-4!wC0mwcNp4^=mZh;JtcEml z0Sv~bn9w^U^b&e7gkr#^Lk#!=2@qOB93a#X2pvLszqR(-nmtPza_{Hf_xZp7`@H$s zXU_iab=GccuU*d3od2ISvuo0Q!d!xXQ!y-KB>z7ss~7I_AirjMDPlgl!u z#W$Gt+h9Dy1|z(|NN2ef@lVqm|BtQ+F4zC-+oo^N=GrLXV<{i!@Nq65&6essJ}>8E z1s_e!0T9Q}gwi`TELyon7vv8u-F^mjCV5WadGkjL2%-Oy@aKW*{@N2?6}W zA|aF$rSEMBg?97!{5d-B7v%H5(Ru$2J}1f0fJ`rI2VV+xs{>}170iB3P$)aQEA|v- z8KFLW^|z!6f5)6{f8;ULJG;vai9Uw;m$zN>rKUGy?yvE889O}3M4RqE{SB^201x>9n(@d zow~RDnQ$chGn{&nJ0Z3^U9l_}7!~0Zjz*pW6C>v5M_)iz0tZGK%=>$f#VkBIhkH+6v1@@J|AUL|fgorpi zT(Km?4)44i@FPOz3hw4hLzx`Ie&ond4hKe&Q;CHJbAbC?Z77!me9iLEcn)kOvAWQd zWS~AYlLOCCOgxm&fivKd0}Y`P_B3(IW@E@RUZ|10LQ^Q;gifPSbEwFKSbIyT#0j;A zDxFYUXt5JII)uCUk&974cJk+B1wIaP@?7Rmf=-$L88l@+nwtF6pegfua{r$NO_@)l zz}LZHoMj#uz6pM9TH|jN^<&WUIqshn^8F)B=m!dg{iRtP$DxS-a}#3cnCUNbLcRQY z6JnPa^&3ox@)PLoH<=JyMvngrC$yV?dX|@Ehv2}jVDAf&Fb|MNm;p62@Rlh&mkPJL zxF%?P5Bx2d!2#C$PB5Gdyc>*o*>6A-eKL;ZVLOzW9Mq5S_(8NE zNfNt)1CpV=LOBD>Ou=L@;0AJ>IYf?^^*Ao4PY{(s-;vC$mo1t!F!Cpyb2Ur}4j;(8 z0P~9Ah=HaW=TRVcps^tun}eeV8XF>$4UQdXY={GU4$Nf*AJ8@92bz9EEf?Hp-~=y= z8lFDEhl7zSh~zB7fsm?KFqrI>O_ zn)5z?;9@WG2viNFemacUFq%1;!{2b`MRwtsLq0J=S?@BoAdKW+07EI~!@^MQMMy~m zmG2GB#bFrhq%$vT0v+)QzGLb+lo^>xa(pq%RnZlT=s?xwMd%nI)9l><$R>?DuB0O; zIK@;5^&5-{y00n=U*FzqD)(_Tx+P0bZQ$KA6m zbR*@^+Xw#x^Fm~S_|0O}LZCdf#SPry2JUnNzjXt5xq-Xgz&&1Xs(mi}2FGyoO(ACn z_H~>&HmdnrcFdDpXFl0==2Kl~zMnYrYpE#HLStFMQxw==N=#ilFg-MZV|W0VA#R>a zd_ZU#$8g}l(Ec3Y!S!dM>88Wy1Om4i-@*ga?O~HmcDY-^Gn0z%2WKm){*;#sSXRJ>dop)KSd6;U*5WQsBOD8wWUN4}`x@2DXKNNCvit z`45vkGdl>&(8QsK!T~eHaOjb6&Hf3ye^3$BL&4k!9wq`u+gxWG5bwWpHJnn?rGoExp9T_`Jh?gaa zjHjJYXU0ww;)&UsjAya$(F7Z0;}00u-xk=zn0htYBkt<3rLyN7C8o}S(PHWx7$c_6 z_O_3hI!}uC^~Wa_Oz@|0fSYEbZ#**{Sf2hi03Y z?=RzPc-C9x*K>gDuEsa+n*HPg|0s^(z(RkO7g-Ed7*yc`dW}Ta_dLo^uUxaKMGAV2 zG8;9hmv|QB8|$qC)o|8pnw zfd91<+U9@fgdX)h(>FP1kNFvnD|#HG;mAw}{0?A*3w8hu&om0y(4Y2uIiY9#sJq3v z!HXT`A&yD7Dq8vCsTEqcrir|IO5*V_X+5|7b6l7#sGJGk*Bb@Lr z5guN~7gN!Lmqq6#1D8k3Il!5`GHQGYZBqtsj$(yUhqIgp9Jm^CgLS4FIIs9)BfgXa zakm;)xYe*SI@s$?#w89SaxdxJW_8XCzHjEJoP!T!jyeiP9Q-J3s+Q)P!GDHL)pFp= zu&G+Ej32|MYAKCiIAW@n#WEvPu>OUrtUMg(6TBv5RzB26hrJInj4m?=y2gu8IC2E! zvscJP(Lx~4TNb^%%Ns_oG~SS!CVI8;hU9mm*JiQ|{?gxzUTVVOk za{2r=bie2=-}XY%>kcwQ%ZM?Rm^wm|f^B}tjPE0gE<*6{fjlD`iP zHw+ob8HGdk1RUrSrN0gbjJ}t=>I0_~ADL1tp`3r5=|z4{8tO7%ylCLqJhO6a~=h<1IxU~NaW8nHf^+fk;yn_A4sS8L}zhXHb=K5 zYvUnP7H-E!Oj)=s9(UUDNv9omn6i+=jXph|^>DlIH0}8DIPhmpI}WAt{yv{&s_6WM zl4QCsnRev1etB_{zq%}W{u+84K5PSjYT$Ej>o?kxGP@Fd{ygb_b1k2fF-QNl!HZ0Q z;bqUjfj-evF8ttVd-CFhDLfnKYE$@wsQ_zpyhtNmoUj*{@x?jOqmn5!n~N`mNEAO( z6QTE0=Uhow-E6N~U_3~)uerhb&#sHbk!yt=o4Mc1sfb4VhVN_i4K#3Jw<^LQm~gOkQ+dK-iI@jRjT4)bnqh2 z;y6OiUrQB8mL>aJlEo)_AZIo+x+&R&C!5T&&7PX!W!twrM-LX+<5+e!*~jsY>;}l% zKe6)XMHV4GdpQoAPCj2dIQk2|mhJBhb1k2rWlV+5<{T950$gW`M%fs49jS@jgyTro zmYe;6Rb0V}Got4w3veN1UqbwdVejC`ttUQqrLaw38TNn$-{E7GDk_E)?83VB`}-=X`;KvAE#b z&cJz&44ivn-4r}m22LJQ&kLhj_65$GfdhSlr-ea<02jh zBds_yDF>c4Q)gaGKQB{fUf};;mO$ip0)Oz4^7XhX=Vp89J;CL@xywHS60E~(5qi@) zjHd=icv-K4at_bz6?p^aqp5Dj(4jYF)6O8iL6otlJ+rd+mP^jtZEQyH?A=&9tw)0A z>}I?RZyeK4U5%j%jZDV{5xN}>t@JFZaqg5xmfW}J^L}PH?my zT)TzNcQ*qAZLVbv%4Hc!DQoa}FN@NpPsY)>TZbs_!-2yBq%c7C=SjdrAP);&EqFEsyvSHuy6wZ~6x{3Ah{P@`PRHDV(`3wOYWiew z99c>-I6gJFC*?C4JBrGc460aGwJ)dn%K&}R$As@v;oG~y6U@kEgppA%(wseULlh7H z23DR-xR1F2;#ZKt@gE-~+0~R!JXd@-e;HA#w8%d)rc&rp z;@xAvbz<}E3p7c7zd&Vh6OQwPISahJS0@oOpZx+=!ILOHFxC4{Us4l16_-@A%F4hr zFYoUu8Y?CG>`c;*)>bJ}TGMu)Y_ou;pi^_ic^Tuxo9ui02Ugf?D0RwqRq$lWyeS+N zVQTlw@``$3RXwoA?kqK%Co6$dkoAjFSXCgOYMIJ>XG(-y|Ienx%nwYZ>d*70ecWrKX8v@=> zC4&}7q+B`Q7zr8+KLh8)9P<>JEoGoxG8AuPhr4K8&6;@*=z8 zG>2R}Uz{~#7<+&N>9WB6nXKG1p}$2;QX4W6XV7F3F!{MNlat|bk@j-!}zH!))7919lR;QfpA*GcpNbLA9eIod5t1--3I46&V`eKo6L2z{bc4N zTq(WBX}MdI`c3(Q*Y`C=elB7!<avPw=d#G$OwX+=H>_;NaP8p2=X2#6D(XIX{S{+mDBEfG*y_nN5a&7a)T^ z)E#`ttRr6rf|CN3Joa?!r9F%u1J7)i(F>NNspWK@{jCS~wmi_mnW#1l5wd~u2 z&%w5m#&c(o^e4l2uzWK7+u)tKc2<>-S-bg|S(f=D3?kF)Yac0)_or#}Wj+`y{G44G zUfyS^kf#G^zFcowcz-L5Ylk}l8fP#N<)sev^Zgv$KFgcjgPk72MA9P(xjjjY6YcUo^yk>(edhY9 zZDhj9HkjwrBU<@L#*19&D{GSZpfg|8)+RGawziWt^kD8H(5%^|D~}aaR&p0++Gu7aRe^$^oCwVD3Uoi(1SMt^T&TtnGa&E~ zOC2EDcQzv+?Q*4Rmn(fTmZaCe(ogmBSNW-OU0QWpn6EwrpEf*|w^(ZB==@PnE5EIJIo|tLt_6 zfz+}+!0NjSvps!bvd%{_=@WR(ADa_+$?Ol%)A4~<;h&O^w3SBahAKa$#?OdNkY~hr zX`kywsJeKQ;l|(-=3WD}ZtzL>mdg&g*FfzWd|K``aA0S20I&b4)WK)n`!CPS{TGh; zgWP}Nz>9MKg%$i!?!QnY249i;FEsrLz7{n*&wS0F-ij_u=HQ)Z z0|&?>1>cLdae(G9!4INqlVV>)H*nx3%;kcCtj*5t5}GpnU-qdesi@8!zjtn36JDs3 zix>TL;EhqaQ}ZTGnKU(bd{fiv=85>xx})%`bGg%|P0gEGw_?VWDe=4+Gp5X}n>uy+ zis>uraI$<_U2X0DwbQ56#`Eg-_KFXjyr#8%)#QfS_U6`>b*&vSdiBrbL_=eHeGI=$ z*pW9mZ%Q8iO`S41<%bF>G}-)=-BR;4vFp7c!SGK6SsybF)5i2OHDP33`t12j;T`cslB{jv> zvEum>oK;#?T_fk!H3d~QrRB3FSX^F|3=~$(t1K(7DK4_IOUi2s7JK|=FnTdo0`CW- zA8w2-EUv09ttgL8jZM*DYAVR{_$^V=L?%vt36c~PmQ~=r_pH;QbBl{BV+Ca>mAP7e zkC0ywwyrJiEvPE3td5lyl@-frb#ZZdth%hAx}+P36;;&q2sr|8?25J3CK_z%pcxfs zHRF^uR~AUBJ<<{HsIw~2F0sObva-Vp3g^a(QQe1?l~$LSI!#6tmX$(d z%qetnRaHe5ReU$0S*2w)#Z|G&s^X-+9tD3QHB>XVs;it>jOspBSygdiF;#s^Rs_Z> zD~##5dblJ#UL~dcw-+y}Dy=C-MX5xqi>qL1u{5#WbIx{jSVhs2)Vz0LR5u$qEUyO% zRCDo9OQgw&v`=|)&7z8`xlWs=CL&^-n`FDE%1DXJix;75aJ`n6!-UFfN(-c0CM&+n zEGlX$3M32MvzEjPi>qp?Q}fZoHIlV|e+_!e ztct36HWAWJ4x@BdX<2GZ$qMd@DniGqs!$0nsxFNcRu!XNQmc-5 zj~C1?u8Gx@;EEzRnAB?uii*&)%F1H1R76p6S&C>ydQf1;&;ODRRCR%BcH^;1(IKo2rk0oEi>fLr)5I5+6r=SE3JZ&?t7BEAvrBZ% zLoLUZ)XY-`LZ)c?o^lD*&_!LYw0u@YYHntujTh4Rn9}l`$I5w1)~UO6e%)H4^&{eV z{*520Dp(Y&TAZ2%VrGVsk~6|-TscJ*6jfBJvUK4X4HDfGsal*SqAQs+@tnIJ;>cfj zujs;((y}6x_1MDFf>>oiRkvz4GNf1Lb;(XZJ;*kEK}}6TVM%I97NDlhZ)e*#;Nne` z9rT{qdDXLHv&t$K#TJxPZ^u-ki`AC%u2&?dg;lUl{F1d9QI@cqLg%)Uh_0?$C^8Nt<558*Q&6*@+M)1p za8{_5WLj)=aD@(H{Y4e!UAdz)rEk=f7S1hBNr>IFbG0sLAz3IUf?TLBIY2kVi^%z= zX3a>%7FNw#;$D@S+@e@HIbZf6j+D+r^&+WLr=ZnUZoX{ocS*`DfCdSt_7UB^_5t0( zAgBu?64aJ9msXQo&y*#nRuJr_$VjBr3dFis0;x)=Du5nprRQd~*-f<{qNyquB~_C9 zp_V8-45q?!T06|*8*_^Vg~s8COmYsxLvfEXN)OLCep*eBB0rsc4_V`prDATZrh>+; zvNB8`c@5_j(TqMu2DVp;bq1B*Oxf7wNIBhUQYwlSlrM?#49jt3B4VSQG2K;KiFFrd zT5!o&Fu_A&ed**)Vrw|I8dJ`mBa14~P^pn!yWRzD2b?m@g)y>t z^u4H{3d=Q|lw({eL~G*IjEy)cDn4uh_A+qBO>M5QYX?x&F~^#!<cbo$`#(kjW>3$jyH99WPmjlbFsHTb9d|wI0RO$kttra62w+jjdL9;hhBq0 z>!76i1(ma_u-tJ-1!irfu1HZ;!K@TLCFp#`wB?gj!-htav}y;!Nlr}-<~czg8?btG z5KS8~0ZOVZuP8^gC&N7PO%3LuyVTH-?xxH$z;4=v+L60!vYDzdRyvCoH&`^nZZMVU zmH`q##;^n`sKJn}t~RO0(9Y0-nMcpjWmrQkC`hS7Gi$9Xm_4sRUsQ+*6KxQbV=d^` zmnqPKni90x;bw)ak}IsJm|LoAkTuaB5Vc}Ww-Qh~6kD^TvfGtd0Ci(#`%fiYRXnS> z3X{4dhBY`L4C7=j4ync#hO#^^A4~+Epum)}#?|3O&nreH6gk?QxXOZ_%1BD9QLXd3 zmB%C~V{9`2rn1>WX}pDZcP-V8USF&1!otau0^V;@!( zQ^y1EF%#em%73~;WBazItIzB7%1X=Uc4KL3V_pH4V--~xH;THI#SFA$$LL(NA=S2YiTX11ma0ON%v_T(Ed@hUAu=SN+_sIY-nU0jIq zr+dd^33T$bu8u~y7)%+Xn=+b(1y$YpF;Xu^y$J9HQZG$(8D73uy9X7 ziE*utul`4X6KO_s))#w;8(ELsex(AK94xt%>$`LGqXPjoh zm#G*gfwF#rKdSCQfOo*KX99cZDVpXC-L>+RpgR^f)ICD{YWIlJSp_KrqnX7dtAwUq zG%<3EUOl(8vNCl{v?x|h8z!daXgUQc*r&NC#Fa;jf0+@@Td;URRTW+ACs!}#%Ax`%;utuV8LW#+ zGPHq0H(+E&?ocX&6Lf^&xfVGwTv!L0g&S_>U|cpk)5y4NVd5+)NxMa~PlV-7q3AQC z08j6`6I~f76wP{hi-blhwq08nPL%Ofyc!Xud}V2M^#bgl+vUnnMCJ7mN4NLvEfkb0 zB`>H{_X?XuOq!og)AUSUV(2J$ zu9QAUHU)AQSfX1cW(8hdgMCA+7!V_yh_XLn#iS);)g=pRiYgYBV_y?1_bx3qn)T4a<^2ks)Piy|meI{^?0;Z6Dz^_@73fhkxX4W)HwG>!T~-SYE5}{d0&HE- z1>Fl-TD}l=+O_G_T>v)+OAD9aMnVO4L}<~{tv2RiQiG`@M*NCc8768yq>^+Gv>}Dn zLl1>mfDKq$ZooWXZAE5<)GaaEbe~mFTDAcD{@o&Ni;)7}6SZ51v}04()Y=i}$1gg0 z`cd8WP=h&(QTHL^u{Uo7JGZ%n*nzJa`%0J~Qhzc#T-d%vJ2+2r*eQsa=%kBWfc*y^ zzD>1YOHM|0?4Gi3Fcwc6TkhR)+_NjLSx{9@6~@+3P)4^<*!ZfGV~)hZd!xQkdF05b zm}z|=i&@8KE+U_nXH+6B-hRYfjHi_>ZQ`Bs@l>sAv!`bnqncbOH;;MEDDCsfGeq?G zQXL+L@;Vw@Vk>H!8=KZ8pKa>EyIvDsN3BG}a1N<9f}OZ<>U0nR5=XCf^*UnwMI!s< z84&`>Ggfm(g5wWOLj zKbD2Ju(sj;UfgS-nljV)`n9Ou#zbRnQ>^PLHk@@d#PH(X`1EO1`JK1~_Xu0-@JLvF ztRY@ok4NyRKx=9n6L?mxBjL4SE4LZ1%Z(u?=B2Jwk$6L|N6%Y%4Xu#DOMO?OX7Q+A zqP4EI$!m_|MZfi4u%fjswxZs{KO4WIK9-~bQUb4mkGK*p(t(LXTmc`!8?iC4RFrMJAZ9#)C36%?Nkso3h;rbfuM)XQ02q8)Gi z?QBWJSXYNv--tBZ*P)?1@DgMc6`~|W>6&K&+iLN|Wy?yhxw9$Jh(IESxih6}Dz80$ zbZ5LH5wlPIITLHH+{D^0d9(uc1&6f9n`>bd?cHP?A~G?`5gRhi*JJH*RAs!LjM?i% zT_O+YNoy1I)@C@64iD|s&Y5IOZ)$9AM4g!@_sG0plCY&jyd9>G64W-qRNL{6W8=0w zlN#H4S5j*_D5ITJ#qu5FenFx7c9etWA;^NUQIxU=NPU+)M68X3>l)&9tLXB!+PYP7 zTxcq&yG3_29z%WJCQF^rYp(5B<*}N!+I3B>we>N|SqdPtCoyt6Fz`BB=(KmNrvI=) zywy3@+_BOaIgHfg2})L=8tBr_#EO}wKcnNbX`3c@i^jc`qT683EvQDgE|jscBZk*h z*TS$+MKSWkv6j{r^mIH4%kB*_lryxTu{?5l&EyE;wJlT-K_#86Wjg zdV6)Ev89vW7EaCH(TMi)7*t?dT*WaiNqu}p9No_$ZOwIYSZ6bwO-BbVX~q}c zPOi! zoFI7Y*w_kH=EEgjcr~VykUKZhZ|lrw6x22TWeDjJdI6- zJvw(Z(R{QnrLikYi(_^>Jc>hWH3s=qhUB&6|0Z8!JUv_km`!H!EzG~?20LI?#!r_wO+$i zl4+su1l$^iM9drb1Xp*qt)y^mQyT>GVjZ2!Ii7HPoE|KPl}ajBB?Zlk;l0%~yqRKi zt??Vwd4j?NAiYnWM$^W+7`@xxjJ$FY&lQ^49dqTH((#AnjJK>tA5LIu z)#0^JUx9D$jC029pc*rIu~P6e?X|IH_#E=Y9q4KBcd&Js*UCm~RbE{!dIUP-+8CKW z=aF5D;qCFx4)UoY2AiP~g$5WC&pMm&+V|S_MkHZIc?@TEl&8XRG1#Lx^?+NiXipjf zy;x@pCK;xV#lw>sG_mE-?26uaA2Txrs~HYn9$Yd_BZ1h8&Xzi=BP?>tMQ~rHT`8*`31V)8sat2FzI6>8R-9(U@jBEO?n`@X_n&eAA7X9I=9{F6 z!n4HV=8U|*Il~Na4Ns#?&`h$>4ZOv4h3qZ!)xx~CRq=Ivpadwu+2IpTfX_GqK1*t> zq$hGjV|;a6jH98ocp;utq+5?v5=xpMI}%M3NQ$CTi)X2+7H*2J zeL~YHe4*GA^#v+3)xNQ**eoolU6GVnOe@+jVIenzwFsTpE$5||VHASftVKQBY;`r9 zbqaRJh^^0=^-#uPqc%6xxQv?MfiZi4^>Y778Z_Ljd9=lhX@ft7^?U0pEbj;Z$(OmIv?bt%}Fn;G|b$#weR&c4&uN z!P2<_(?NJ$Dij+NPXl;1M$Rw>&g;E3G-IPsOuo#roae}$ZEdIybURa5UL7itEZ&Si z$&4H9)&0$Ijy#-mKzF=bOF+FK&Y>C@>B{x8d951NaF^k23y>canLvuBaAf^bOSvT_> z4f6_TX+cRlVJt|vqA;q^qN*Kz0|wQO+K?#)#-{ewjhKGI^fcG;qS(q;= z#3G00^*m72)uK5XVZ||;Z}0?w#%!8Np^LRs?XPLX`~q$Tc8cwjdT%BEV|ImUPJL^$ zEc<8;&8rq(J;^)`vw@Db+BNuVGm_`hxl<|Ed@zUPtW)og@nA{0=r&#KXr$$0Z435f zJJ?F#^iX^=H0#K&q9c7}F;h`pyuL*7Ry8(Zl_oO_mRZvAWP~eGoLFsL9lR-O z64NG3j9p1?1FCMCJld+qIT|)$CV09SGy|17Gc!sI`^MC|6r0(q(5{{=lh~9-=gAKm zG&y7M>aA|GTO$`=VD>sqD%{qMX0AiaZ>$YW_mK9kYcPLI2ro%%AgTcF65XaJFtXLy z)l!odo^#rErVCMhkZWzLMeU1CnT0_6+7(ThW5^OM(N2z=4a%!U>%!@DRRkP!U4j?H zJjWuxBK~iAW2<*qX+_uOJ-gs!sz&a3nTIjVj z!NjV9Hw7^D#9D1gBs={~qZ$tg9h zb9ye78e=Y&#+c|fqocJX5Kj|no~=s>vFV8&BczGFrFPn$<4rsALS4%v(}$9ieQbx- zu5Rrl*GUUQ+6B_#8e*^pA-3h~meZg^vnI3lAP0r%ac9D8C7?xUBZ+H}_ZAF5`_y4` z!?g1nc#GI_I0Z9Q!6{(LY}yfJ5JN@rODW6N7nILV3GVoNR}EJpP-A~med zO>@Ew;AOenQLWLPD9o?W8zcnZM4iK{GXuQwyV5;MT4b(T+i12#JvuRa_&6gQD0+!Bplbm{w2nXx<;v<{&w(@JV}Bh9d3q?B5kxD-uRJr9R){5@QVVHmfM zaOk?bgkT%m4Q5WuDzoWJE|#a>Z5~E0+GA;Lo(3n4os;^h^6j;e)#A1T&Bu+=kr!dd zf~hC_uhw>K1z~)EXN~jl!Z)d;C|o(>gh>_soqKy6W{EySZJYuyob*r&Tsy11<>XH3 zfZt5~-}2K9{4*-}jf=oBRbJq@5rLuEBfYT*<7YqkL%)RSEzTaEe}3?Sj0?jTWnLV; zB>Rd!m(z9htC;!tPapc>FmGx0@Jd(i(mt2vT+#1xyvN8JhW}0YPapazCa)}ecrM9a z5x$&$1&-p+z<>JC&j5Lq*~6!>uFNZvOIMUQR#JL3!Ol3?KSA z7dP$~c%6HO*NI<22?PTF>eHLPNIm`1(0}V^EB>25deOW*UY}^{z^IHNHQqkCv8Ar5 zvp$Y*>?+dEf11p-V!aaUs9!a?1zvr1eDZ#i@+R#+Y5HW``D$-%O-%0WNb0JsZLe#< z4`5&*?OZ#Nu3Wmj5#9E`uX<@q9CH#lr2hd`$ay+7&JTV3`yUX2lAeAoB%SX6LPh=$ zs90Lt-d5{jI?=cq6AiS;@~(Rq9g`Z!8hb#-|J27JfF1*{%Nx%K!I~Re@D1ZPgAmTq zPmT9U`304*=h=cTH5Ri}EM_VF*2_|)iXUFVw05ca37Dl~hf6U*#9|(L@dIBpn&AxH zlyYPX(}svId;thkGyt;bKF*jEL8ZdOLso5rI&@sK0w~LLd|l&k1FR{a$lI zS(PC#>~A}P!-vcX_1jF53`T_gC%ieKjFUqnP6%bp3-y{Ciq4{w=^UJQ9T_eUjSp`OWz7lo32zEzmWFmO3;Vx8B7WGPF(>SoX5Jd= z753kR`o0f@dX-Whu0V8V*#8hL=wE(9=G&oue&0_+y-r3-t)GSl`n{36xuIV3LJ|KI zyj(5A9}Z2A9sg&GKL?Ee~3A!Nq$UpszdD1#!Q*B=2oH_2e)r=eij zzsyJeP6~~KXl8hOs8?BNG*0`5OG3l&Jvv+#@;8JAXC4~L+RoL5OZsdK`_CMAf7rjt zpR?(Ku>aC=nFodNzQwIRinEvh$$ESZ@<-2^8}jFd29<_T3pk0C^Yw$m{(qoo15qu5 z5kW0bdVeS@?4#EDA%K68a8>wz|K{~`LJ)pCa6g1U1uUc5`6Ws>K8&}Ckk}lQ9(6wQ zGrTQpfB!`f_3+^OIT;Z|`8Ndb4~;@1sLE*Ot>KOSbI^y(Z}y?@%TV~iQ1*Ii%5eGI za@6*5Tu1K)pyE1c?%>BX4MEFzxN#q8N@>menxE-2s^%fu1m|2Eg zlev_HhT?k^5({n!4MP3<{!V19_cxrUAt*M<^_v5MEL3zUwa^!#$Tq5^kD+{c*gr2g zCo~B{nRCLM!v06==LB;w@T7KzC;UJt5)F>;AKD{~r}hl`_o8b1o(vA_A2&DD-#_O5P+xy7%1I<=c4*MtP@lP> z-m^j12o0ij*=RmL7DWsDXJpLrKRC`H(>gJpago`*V$gy+J@!fDUTt&G15 z8ep#1XKaKyk-IoCLjYOi@K_B4+TQKqF;%XLlm6?%^l7>I5c2h zCzsh*nczxA5saT4MsD}m!N2emgpooB`4q$%RSHNk|f|^F)Mu&kY4n3FXeB zlM(2Xy`geAz6T{*;EUI7B&*yJ?x~AD6ApwXM?VYuzr{7-u>V|m&U_f#%y1>?y5GMJ_<*qg7pS5z zlwS=3b(clpn%-VZwvRC;yb%J{%;$3^E`l5!&xf!Q^j@}o&p*$=k5k}T27bnHWZ2I^ zGtCQyXCohecyrkQYArj%GvPlXr_dlWW^1U|wqRzrPH=4`5DG>!Zx3aE9_rox^~dNE0USO>HR(QrU#6oHUCc0U94y)DY{D(*_lB1@9Qw9 z$?*R9qmDU_CipbrQJ>Y!X=Rc6S;~C(REW@g=5|$+jQ)XD?~w#@_8D{hSfcv8#~eQ* zs6KBnx2vgSB>n!P{H9_O;_P?K>1R??Kg&6vd`O8{#0b+l^~qpPE2z}ZH>{t27&`Uy z59Zma5TUo2_vyw7_&wCW;ob9Tc=vo7-aVg&ch9Hc-ScU9x_ox8em(-=m8s6Q04DW6af5nu(r`!y{Y`7=h2ld|*KM@J^#Mh?L^M^G2o-}$+O_R@K z)9^o}(Gy7{zkix?-2y%Rykt9`gfM*$f=Ts*)3G1ke?XuXdir@ud)O=jTaa!)TAIj* z_ZDzIfb}HpiuV-2+wi}im$Xmbw*cEeO}%}chChgFdTN)u(#V&jsh^TG^2^fj)6(!G z(&&FBO+KsB@Xcx3YhoJt*=gjdNAy%bxoPB|PE)R(Y0C9Y8ooY_{?TdVr=*d;G)?|b zOq0(~)9458u^y}^nE`=Okg*@y2cyqS#TyLvhJri4^3C>4QT@Sb6tjBQiu^#uHwY&^ zC2~$*m&m!*QzqfdK zQ}5`Z_O`sH!3|3N!+bUkLC8QL%M#p zDm|}>o^48x<&O&|Ju{vB{N3TD4j+$xN*|KP-g(z&n!^w7qS(iFIKRI{;);Y@`}tPV zBfm`_TmP2VIC>5;B79sbT=(~S;kv)y=;(3lf2+gCJNkDze4NAWcu4gy&EcPmye*fF zqVbMCwp=EJ-w^lB8R?mAA->6<(}y^}8o&g-@xrbCT&cGS!mWPGr#X7Yhz|NX$l+rh zo-f?$KTPx&3Ag$!FLU(p%gaPp!r=!v`j1okPZa$dlzz)EaP%DN=()?`U2iWy{0^o6 zGr4A`(r@{Tj-D}&{#TTqsO0lcN{{8)GPR=in&s%pb-0`Ve24Gt$d@^MtivmX+jdzZ z`Kb|Z+r@ITUQ3Q&e-rs-O5XB>aLWHaPP%5DnACHz=-Ht3SiV`f&F9S`e}tQC{ufvDr-F7T;xH~>Bb$C8s zX%6+mZT+m0d^QNT?Pz(MqbJwVW9Kv4?^&5{eowBo>H6Z2?6_q4P~lrd-sZ>3-=(;f z-zJ>u$8EaTRTD_`$$SH8*N1x`Ng zxKH^U>+s_o`C^CLahc>tJA8*D?~Ws{2-oeqOSo>|!P0J|-__%e%Py}>Bj1#UZ%)JA z@zkw1cRY2|ecaJA!KsJm9iHoOdrsx*dbbGTZJk@YogmlSvD@0M zNv^&}kbyhX>mM7XU7JI}jJ@p%%yO1^FVSo!M|xAM0Nr+RSx%ogD`T{~~Q zOX;!vVMmW!|JHs;ziYQvM)MlS9$fiz(s1ivC;y^yJDpePzmd0Q&noJduWHNxR{fol~ z8WBE@i<$tX>+-|X@H5l!haK+TRhf+Es^~-dUEb;NK}Lj+52oP}=}4ru+h$hnojO~QLRd>GD`NqDluNq-CU(Z}xLSUnlS z?Hbu~8VBf8WWKuczqjx?itjJHQgJ)aUa0tdk+*)>rdun#PRV~I;TFa1{?{7Cj}<-Z z6+c7xCdDroewN}N2)|hI`-ESv_;bQID_#KM>DDw9z9u@iRire+nV~S4^`DYbB zQ~1k@FA@G{#p{K?rT7}*|4{r0@h@K~Zs&8~D}J}=@ul3h-Cq;lOL5;f3i>KOMmWt2 z>0|ZG5KiO0%PWPCQamnvFU3y~K2h;s3ExlgZNd*w{59c+D*mvv9f}>bBQ| z!p~Iv1L5Z@-bWnprHUUS{7S`_2)|zOHNtOE{A}TOD1M{xdli37_;$trB;4*x+4}iH z_)|)LcbVTHf8Ax8=fr zrua(X1&W_2e752j3%Bc9TR*o6uU7KU3%7pV%7uNU5;_+7#i zivLddF^az?+}?My`TvLTQl_erNOZoXCe2|5UiWk7?z1la0WBN`A8N!HSm&AE9`o z@Ue=YDtsTsuN6K;@kfPESNwh9^qiY(KVJ(!O!2|e?j?#(5nitNEaCQktF51QUaa_w!twVxDgFHm;qw*mC!5fV6rU>m zNX09K*D1b2c%$N*gtsbwmGDl*?-72i;x7t6QSncNpQ?C&$J!XH!o6X8!O-bXf8pHqBa;V&t^Q26VL zHwyo&;>QbrSMjTbf28;$!aq~|ufo4kJTS=E@sEm+5FV2K1M3I!gl8#UB78T+W5Vry z8LOv5_;4kEy6`cIUn_iX#h(;DS@E}o@2~h*!hfcCU%3fTp!mMRXDdEW_&mkigjXwm zs&KnMWb5G?;V~t@Rd`(SKL}r?_`if7t@to{$P^#D|76phE_}U`pCf#e;ztTUP4V@@ z?LL;(f3ENgmHf5Bf2H_V;a4mEyzmE&yD;^WxU-5+S5sELAn^AiyewoPI{Yaai+lB9^NH zNjJOjnXC9P;qw*G6TV3C0^vt0euVHk#ao0oDt?miR>jW}-l_N{!jDz_7U3rZUm@~uDZWnl`-)#J{A0zR5&nhZ{}lc&#fOYE`3cB=v+XZ4 zg+~;x65dR)BNcyJ_&CM0b4@X53E@X5e!TEb#m^RgqT*KzKSS|#2b*@kSn>73uTlI1 z;lEY9Q}}kpua|V6R{Sp$OuDZq{)O;&6yM_jBmcSLBZUX$KAvr_J%#5eK2`V##h=~F z=%1kYAtHaE;x)oc6mOVl^ej~TD3PyM{NCwCzFqO-M1F(fXA3_|@ymr@rua?5Z&v&P z;ae5oA^b_jcM5+|@z;gFsraYDKT*8bfu_7aD4r)gTkb2`b}SJ-MDc3j;}!q8@UHu@ z0rT8oi|`^Pf2{B-#ZMN#Oz{haw zMJ2!c&rCi4P4WGOf2sH^;Ssq%Y4tA@K3MU%@Vym3b+SqKK*cW+K3DOhMbA>jPZZv) z__@N5SNv+>XDfcE@T(MmR`?x?zaack#s4P!1;zb?OnKi{e2DNb6rUp8KCf%*dA9ID za{trvdBVplzCgIW4{YV*!tH%v%a0d+gwoTrzsY}-;unhidc|)LewN}}gse@J+P;=dQZTJg7ppQQK~!Y@($B&oM+6u({C>vqNM{BWD% zcZvK{ir**vkBYw_{4K?Q5dKfa2T4AERD87X-f~~v*5^3kLlr+j_}+>iDtw0Gg~E#! zpD(;x@tE*h#n%gORs3x!??%O+5Pp&3p9sHF@mGc4s`xJ9_bG1EeNyocME(`Ub0q(N zQ9L5tm;2MgJ_ttAsCBe24H_#a9Y%QT#aJ$11*2_-4g#5PqTJw+g>T@jHdzuDJDk zA1mG@^5f*W09$XD3ZJO>>B1WozfX9(;&%%_L2=tIXDYs0{P{(S?rQ+=s3Ixx&9!@(YAVO-cAs{o8spQAF23F!lx*HyYK?V9}-@r__M<66yGI0 zq4-C_PgeX};TI{MC3bj&;=_e+ReV3;Pbq$g@YfVC75<^(M+pB;@ebj=<#`rc|ECEb zq4=f3Co6uF@O;JZ6TVRK45^)SyMApjms6c_kC_wyi@ewtN1CxA6MMYCx5T_St9?2;@1fOQ1QEj+vmb;|9x0^ zXjp1{Jte%K;_nF`sraYDCnz3}dOkq$-Gt9le4y|pir0$%TE*>pxmoclkzc3y65$sq z{)+G`6hB4sbA#e`Kk6>U4-@%E6fYM3tm5;8zpnT~;qNIP6aIzbD})D!r?z8@@V<(# z7Cubz^}?qq{-yYpzy_t+i`h?;`TmoLh+YG&ql>}2|q{iZ)9A!Lh%8@ zZ&lpx^W3kvKgHDJ4#oQj|D)n33V&Pi^M!w^_{GBQkCoW|c%|?@@*JGycMBh;_@-$l zpZh3&p75E9UoCu=;xW-*qxicbzg+RpgtsYf$K~S{_r-qBP`tnJUn)LS_>GE>6Mm24 zQ-wdSc%kq=D85+uF2(KruYV|>5c%&EKTCLTc^=TV*LA{2C~n97$%^k3`GXaIOZald zKM;FfrTB-^FV-slrSOv#xBI2%DIO60S1NAzQSI}Rw!9&czfZ{@DEvvq=Lmm6@fzW~ z6kjI%BgI>Uf2;Uf;nCbwe`xPV4^iCSkKRY|+eFU{#kUJDQhcZI`HH_OyixIy!rK+M z`;#XqZu{36id+A7sp5Nx{_To)NPmA)ajWMA#RrT0F2!dE|48w9!oO8~sqlzA*J_Kd1Pyc}CCciq91JcNMP`{+Z%$N`8J+e3{5+$@8kVycr{eC8&`zvnizd-TlrQYT#{;Kc>#Xl1Lt%|=Ue2wC7h@MS~PZs&J6`v{mSBlRP zeuLuG!hfsyk-{HRe1-6xinj`XRq01xNYAG#ce-2Lh*N`T~;b?`%#DDwjZ6K`14}Vrz>vz>BWk_DDu}T z9u+&kUGZ7MA5h%($KNS_s>r{f_^*ZkMe*MV|4{L#g@2{E?T@}Zk8Im3OWLKc;(dkN z=e4c;aN$#x{3B97GZnv2c)sGFOFNb+{)6zvipNBceU97a=WyYjO1?_?dc}R=rzvjR z{W`^GiTo{!&k$~(2e`dU#!UU&ZY> zm8d|%;{6}R^#f2Me@$lK?*ZGLtWzEsJ#3a?XqnebJLmkVE`_(I{E6hA`v z&5BqTq{+Qx+pYVC%fk5i-PQRh#=jEGvd*9)* z)y)wfIea*XeO~TgioY&;ddYn@+rA$QAK-A(--Q448SHS<|5-j!{5HGd_Wsu-hjTtr zKKkT2ob=dzwu2o`^7eNC3mi`JUI88Oih75Wy#4*PN{5rY{riz498U7%eH`$KIh^D( zME_9^C;1CRzQy4rZ~qQuox@3fP6iJ6tamucXNmsJ4kvm0I~Vr31KTckKk#Blp7iV{ zdae*|?dRbDBJsIF$?q=mzftnJK_hSP8`yM5i2Q>}{#Gg1Gm4LwbiZ-Zr7dBZUU@$_ zoXQ&%Jwdq-Y}4%}>GpQGY%Oy}`#GHS3=c8(c6T_{PjAt)mvCD@2T425aO6pk{r#6> zC0{1_T%hDHl632oyzMXR75}@*rgxFz-wEHMxUJ9U6kjIw{ITNpJte^jMxib5jUwMy z@vXu~E51YcG{rN;PL?P>L3p#`Glie1xP9-#g^Dj0dHWoJ&A)vQ#63!Wo5(+{xP8CK zTZ-G?PqfbqSp7L-4+G_Xi{)d5k5=6N&fxxv=Zn03F2L$pD}14nx4)N{P<*S%+xux& z&nv>OR`NMwpW79;zrXgn;zc6=h2r+TQ$g96wdt-E`JswmB7B14e-b`l@$ZB;C_X{@ z(TR#5B>YOnON8I2_%h*-3Ag?vaER#-uPHu2_(zHl7d}Y#DXpHpg^yKyy6`;3YlRmp zo)BKG__@N5Qv4?2rzn26@QW3HK=^MJe@ysuioYuSL&bLq4~he~^XEQ^Luf2Z*nwua}kl@_eFrkF&#RT<9BS z?7i!78ehg082*{VN&Z}s|H|PcZ~t!5?gvnPlDz%hmWZq`Z9UuP&-*)^vrut+UnZ`&-3Lf0 zZs$2098URpH4_JXPI5So-mo`F|>TYvsU&q@H^VxAlCN$PZBRkBj^$#mAcB zdXp5FpjW7PrN|$t_zvMmDgK`D;}xHRa?s~|#n(zcZ&2Kp_kP7~xt)}DMpFb=9 zyztKze_eP)?vqb++bUo8AR#V-(^Df?Ac{}$nU zE51|s9L25utWw;*H|H0M4->n(QSmb2_X)S{dqBQP_%Dw9Aju1TeWc`X%{P(XIGpOg zS?d3Lhg1FAeUe`C+$E(;^7n{*Z-g1aFYK~Y_)hm*Xuhhm45{9Phn>Tr^` z_OMuSYY+DMV%y(syRQ*>YWKm=vlRd7bB5CMc0Ob8QpI-(zeVw{g}iRt!l-F&S2}<79{{f2IdY+}Yt>-{UwTDC;FEu zE*MXQMD6mXxbTkFx>bno z`O>=9mX>&(NeUT_)h&upW73C_RK6>DuvG*X<=Y0BGP+p;p= z;Wf5&#M=|GH64vH5pHZrw8mD{cX(1@CyL8XQBr59LQb!tzCG5_*xZIPvdUG$U!XL-rm~ot&AsX>+9PaTUNAsE863z0tvYJ%}OwmeyEPYh5h^k--33>) zw%2jK%oS`JNInraqRG0hYmZyn(a{9!LdH_sxT&$lf_MY6jPkOMcuPlTdpy>OrjK>B z)z-yRO1`qQw!NO^#3GhAw$ytaaU9r)8_05EZLLjBD?}{bzPb@vM)0Q_3}y-~adXu% zFx=KUR*7=(x!e8}XZp)TBv{|kP`fHVsm_~(Rzz>X_qt~K9$P=@0HoSlUz@0%RM(N1 zNrVqGys>L1O{X9piN`4pIGskPIN)?YI^FNzWZBwS-oKH{W0g3ron%g@(&^N$tRdS| z5u|jd&~b|OfB)U@d*N5bwWg@rd;lCFKK6Z$HquZVGQN_SY#(<;qrDi&ZcX}f}_BC zN`ITo8|-|*XzQL%nvv`| z51A|4ob*YhPQMQ>?kWA_WZbm#6{D?tTD@?6Pw9J)nkzn$3#t4xbnEnw5c|>gw?o$F zo8@}@rPEr7>op_UPb7Uif1&hArB45Pu%60aDeKvj5bu6;T2~=bGm_u%7#-0L=F6k> zX-TTnUx|w;ec8?yY3%X-FMsk;2K?~Z}I!Mu&4TKm}ydS`_E8ZWUsgW`_F0eKmKZy!dc?SYmJgl zeFvTXL$GgMc1mmOttQ1xyN*GSY(QT>dHR%G_v41lxj9asHjTyhpPn~!CZ8>fo={vi zD;P+YDB#`OV_W9FZ1O_Kd_K*`8b09txGC`a?~e`M^wm)Bn=cn--1K=x=%(*CdFLXJ z=VS)*zZo<*B*BES@(a^8-fX!2;%xIWZdcer}-qHAt=NkC- zbLIrRb5HlYoU+D-nX7tbpS~vTh>6p+%F)aZH2oRd7rUVQR0YWDsi6Ibr zucm(gz0W=~ceX~5Ja4kr_pbF`@SVGVXP>rDKXWx_!dElj%FNx_Fy5K=x!)O=FY(YYQ_EyK4(djtT zcjNiman5uK^YYQox?IPp-a6*1nQtSE;xW#xk)v~eIj3>VtcE9Z_eO%q_kPZ;eKVbD zq`y1EnMP@&@Xtf~$8E~Wz`3bASI#J&9i8T^do|Ok9@E3g82&S7UBmbO*;~gu)fjWm z9^WJPoYP^O8(^C=H?7%tLrSmHvYgEs+hL#L(YZ75oop6L@$3=U#?E#&S5Ct}iem!! zn4sII-1D!F!VHv|mIP1{7svEw}pPdqP`k+3X)A+T2c7rc+TIA-u*{(K?yC>jOw;(QCry33} zo*fzC9D*}p*Zl)^iTtd5EqCufP&Z#k{igazy07~2wyZnngMtsO`gpYMl9aU5s2%1~`@So8ZwK-pSyVE6jO)yx{89QJLV2w~dpxeh+2%`e4xu#d z>4i3lJW{xudm(?&Jz=i14ew5@!+F}(r|grvY3$F^tH!46I&{tzz1Qsv+mE}s_aV`V z&bp$0PW5=?_3#mo4|;dcag|Xw?eOh=5k~H%m0S05HgP$?UbV2-8~(_+2Lqccvth4S zrM)_7&U9;MvRlKvxjQ57ps5Y>d^<0MEg~p)vRMQ2PPVf4%tf4(_9C!G&B9PYQgNc0_cONFAB_> z*#W)Fzi`(Tp*~PpD}26fulcifpdM|bxI4b^&xY20ckg#c&bbL(r!U znA#W$%%(n#Y+TZrl`;0bxjV-m9jO}U_M;=9vc^GgEcoHj8wY*rJH|mKKgae8%*HUB zHO}ojm1Kn3*60gxpV2tAc=p(DewdaPbPjpjpE|B-sFN{vNO*soL%0rekDVyj>TzF} z&%DAJfPb@QjP2}~K^$XxR?XfyGa4Od=2*A?RAR@%&$ZB}`ubM?%Lk>n!}lkCE$Ya+ zAAaahwq1#`I36x$p`p}HC}mCMW$Tou1?Y7cK+ zf7F((&e<1ScFm1VO-*@pISW@{)OJhU{bT=?yH)rvE_be7v$kc!+U)k$`r7RE^=<9g z|H>YfGqo<&Svh0>?3Pv8*!WuA(U9HT+1`=8vOfEW`nHx-*TGOFW!nuL8(w3(^_q%&m}`uDx=w|CY?Z~G>(rhg zk6UBYqFU=wf7+R!>l~7c)=1ac@(FacJZ?q7(*;CZ5p>xjm4RLt^j2K!BYA9)Stqo5 zU~r@>TRwquzbCdZ{z#HMjOYu0`yqw=W&gf0 zUr-$xOFhT zM#Y)NN|OYoS+kj6Hv9`lYEvmA+{0lEPI6KA>02od0e4Q&v^&1LeE0F)&-Vb|jZVmf z9u9cCrx|6lk1XE3!S_jU_qqhTjo7QzBZ-#B-FL1@WY?@5^`dCmo~sc{Jbm&g z`wYI%MsrCi@ z#?McboK>!1&p)BeIw8LQUslZCD&5QE;Q!Zo^``gF#@1W1+3=>r*lGmRY|L{mJ8w39 z#AeeiY&P|KvuTc-O)cGQ^f!wK>%)54Y+~4KJ#99TY_{HF{$d_uK4V@tM?4vD|7p_X za01P&AWWcS*c4ld~=Hngn@vixJ&wRXZK0YuXADWMk%*V&(;}i4osrmTQe4JJ0jrBp( z)pu8%W+3XWcgant-I({pi{|hj57(If$3y>b4^ilp!`Q*%D=>-Y5aCFq8ib#*Ic41N z4ijb%ZZk>2p{HTfF1C0J4t*cb9+7;f`Oe}{gZtctxk+q363iyAadCK}s9cq}FCD`g z_d8;GLQt&Slhar3vxzqH_dF>gX5@;P+>7-KedhBXxA)&;`M@;Rt?(U>iS4D>ezBKf z>Fy!!ymYscGTHk+<$Myn{8=#y=B-5LPH~dO*2i5MkLwWM39(cp@tznnlrxY#|MAEB zoZj{?=_xFv7Wts$rjK@dm!LfCWpk**p4wfeb8V)VcMT=O{SU&pv}!W)f5;kmit%^oQ)ywxMk4WDhKVI!b9FMOeq&ZAJ~hqrq)=ZCNLNJZhB zJetMfJB^frWV>bIT^^}CyxT}rx!ps;PkW@Q@JmLjM%8f-3-2*f2Bl?r_#-2ozb~X{ z7;7{##0t_}5sny%^H&p2Pml%}sfje#hO>=C?a*xxk2KQr_|n$x2#@hdo#6>aqVCOI zAI|Ye8^Y5((#G&CBXO8Vgb(t#9Tm>?p*$RiLpdfKaEBLoz_9?sykIlHP%k(RV2BrN z0T}EB#{&%Vf)fA+dclcU$MpAtlc3Sh3r+^;>jhf@vb^9FfJ`qq6(GY4P6O!U1*Zd~ zd%+n1y}jT}fL>m37C=ugI2)jc7ifZq$Q1@L*nZ^MDWkRnfE-wchx0_cZJ+}i*KdBN=f1B*=cq0Zjj87?sr z4KeP0;Zh?VL~gsn3yt(3Ro(}}Wgh9laJff%C|u!@9u6Pkk^T^_^hl3{t31-9;cAbx zJG{svJr-VUBu>lY;Uylor^8D<(zD@ZJ_qZ4ye;6mqfPhq59+@53!8USKcr4#ya?x^ zdvhmX=;aO%K9&W!!+Rzj{IH<$!OeVmFv2d}kNiBC&cbD6nP||QFT!oECYa4G>}O?g z3=7k-&*9bvbK*i>a25+io`%juaT|k<>4h4RAGax(Yot?1Y7Q0{ zi9=r-Eb>S#!3vMm8eHm;)&*C%PUJ;okn?Qsxl0yFFY3z@su>TiE;?6PR zU*VBb{B=g+E-%&JV5D;>l%D=3BXP}0_n+#K`uI;vb0Sn>Wwtel0;kK};|o)H(G@yv z@O!{R<|DYn`0p5;i2Dy?6VB}GVv}(c-y6OFTZ^Onr!N#2-t=LzN9~9MJ;_Y=d|_%! zOpe1>w-{c-;bm6m=d2Tq45q*&etsTKX~Am=VSDmdsM)BRUrGrE22-Zk$1o>y6_mLw zv$Nc6Q-6C?y&4fT1NIOS_OVroo%Y2yqilPYMh2aXxHKy0WU_=!G{+qsbh6^oe!=uC zha)#hbiG2l5ja`t&Y(Par^^SE(Pua^sM?}QeIv{8OfPRZIliHN*^2jp_=fd074UHq zviq6}NCUfXpT4F7QhoQ0>}x6@3#0p*Mz=Z(E@S$dMn^^M8`pP&Gl*&pUA|qu$W!o~ z{Tyx_^$Oo~6ZLHJIYXjuCtsjC- zr!07rS1@N5iOVfsm*0DZTfM?UJ3>t?{Dp*_p;i_+Wp{_ZiwpOJzK;v{hWLwB$ILB4GO)39f5-k+kl!OcgfC*aH)73)LqRt_-F*aZy#pTbC_pbS*bUIr3myaL;RTNaqVtPXXZnICvTozFvxhKLG^1;28kF7d#7qFRkKUo&#{b z;CTSY3tj*i9`Sg25nvd;!5B=&<9Z+PJfGo2-b3&_kUZ^kzw&d@ajn?vH`R)Tul=Tp zv+#}IG;!+P+;9D+iBtFLe&^5T09fz^HnZ>q-WEhg_iz!W&?+w&keLdv`LY7rP4V(N zvVTCr4P5V8A4E~% zhTr4?D*%RhK@GrAFIWjM#0zQx275srz@VEvsjCm%YNT?qX;a`%PkNdI_ZW%$!Ir=- zkJK7?&?Bu2JnWI$0*`p4_P}l<@e-yZ@VH0n3_M{Zo~>;NJn3@=zl1u-mEScTeXBdr zRQ3Du=Xox^LE@Uq{p1L#>MZOdRh@->rK)p%8z)trC(z^lW8wi!@aM3=MKjTF`eP1Y zvOkwyXmijl^qc;e*A@%>ra%6el2h(C{V~^xL;Ne)56_S*{dFv`?W+BzbLL)gk^gXZ zVPUaeK4E_#2*hoIl^yz+ceoKYB z%ovP^@#u6{9$4+aWMuH!5EB%0a7b+U`HwNZjLG;lI!$UFqL$B<>5Z@?UGD z2g%1h<3d!2umk(N+jc)fqOk+^Q&=zrQsTm^6Pzhoq?PdEEt@kqD% z_jojK_rLCu?(o0mk?!=r=aF{$Kk`U-`9JeWcl*EcNcZ@^^+*r;9n&^BWe@oSp04O& zjD5o+9`Go@FfZ5*Ff?KU;EMjZKgA>ck3SVnon}!ozl-cfiDv&1H=e>a_>M~DDo6$G zJ37@gdY<$in`-JX3&*9J@r{M!Q%xOa;lxx^hp8NWTT{nyXe^wbYU(fxXQrAuOquj; zOU-397JivpzycM8@4VEaQPcogxDXSL;iYl;BFMu$^2Lycma=Ecy6=+Ig>m81)G`)0 zk(Z~MzJ#_keLGUIAbASO&3+CyHbb_r)|i3QidWOvD+~2rGpzEOVRh;NXE0SR=^!He zBJ}JrxN(@Xd~cf>DW~8anUS7BDR@6*OiQy%-^U?iS{A+t8Pjt9e+U`VQXIZe*qD~p zBHhInl% z{(Ob$4XNLWToqwXM=?aMN$2NZ;vV_U0Dh(h7`ZN+pXukKBflNP&%@~Xh8%vT;*R{z z{5btLcsnI>b1rk*2Z;Q>D6Vr`Mf~}WYJMKFA9Qx2;I<+G*=OJuz7RLMBGWh*>5;eM zzTWZV;(e2gKTyg)j5v|UDTJpegg@I5W^xD(kxw{;lORPtGa)Rec)u`tXa1GRJ3oJI z^3KoSn!GoV{`aP+w$QWVnpSWn2|m}ff?G%kxTY2CCL!b&ah>}s2@%&+*AGZYb(gZs z_ayXiS2&T=kUmq`v?=dIeuaDZ*YrrzJbu_3xhHOo`%PZB93L=w;j(zx|1?Ns zy~+G_=u;va)1Aokx*2LpyNbtgdE<98(on~$yjYXWA!Fue}+nAH8S>hJY>I4zCN_R%&Bk#B7;oE z=*Rpc_ys7=*mM$xNyhR>$aZ1RQFtJw6|OdCBWn&SpUD~}BP$&uN)vZ_K=#A?@dF;sDJp>oH7hg4jGPCY2lvrg zmAG^1Nf9oAoJ|clQp4`1MK|L)-oi~MZi@WmM3+k-N=R4WaZKblF?Wi|iQIwv=qw7= z8|xnvv?PGn5>=hZr=&&3;8Z&iydCO{=!Kh+!_QmOu8+_d7aj{Ix*``vCXp%|ileS1 zPvsHZxWrdNi8BRb0Y;X?IlBfoZb}1uXL$zBvt{5s2hP52GH~*cdQJ$%aslw5t8k;s zcS^`aN>kb_ng#M#xmox4B|h(P_$N4HEr#g-f+rKR`=psV^J4mGnL6_V|4*_6qF%v$ z#*di$z;kv#+}P{wzLh<>WlRL|)#3$!!L$zJslj2+phAubE@z}fO7J|6Y%`v2gDIJI z22l?u7#(REJ!qr#a!#KK0pD4DICNT%_|EQQ8X@l!Z^PVfJQ;K%`E#oyY;~Rm@DnB2 z6tGbUr84Hi;2Vt!{Hr;R`;L6|J&A(yeP?P6*?O{szRrYB=hz#|z70iVRE~$kij0S| zDTic}5!T_f`06rai8T@Uj!BOb?4BSM)ovD7@^~_R*Yq}#pB_%gns0I3v#D(4CuQiQ&@dO)?jsJtqB%-HPOCj5#->~9sOOr4Z7X-f8(rl$4H z6Y+B#hvPR+vZqa(GIdt%s+l=C^;2ig%$Zd?Wy*|IGgj5&Vdb>inwse~GjeL`r`C>j z3J;jPp`~rj^vud19 z{3OZhwe@w`_`MIObV*fZRkW-;nwMW)ytpu0nO8QyQ0Uxc)rD2j!b3!yS6o?DEzece zd6m`0W%ETWEGvi$`Q-~MN(-wC3#{(4vg*90__I0soeut!j&`T0y1F8|xUjOSxV$Vn z1&7QjFeMR8#jnY9v_|D`NsL>5d0AN@5{&@zOUtVYyU+!Ng%#1fQsm0`_WbZm$EMbL zXHjKwMOC!8ptMjPs|pLtqE)4NRYhGuw4l5?DP)Jvw#H~{O-F;x9YTiTY{+=zkShu+ z^9##37=@xmQydDTzP;84fpUrF=arVu&C6d9Erhw}mKIkP8Jor(@=J>mV$@@b!ph3> zN-}&GrFq4r)rFPOips)xcu5t1BsQ3tOVt}Vu_zT^Vqlep`GsWqgro?JR+O8n;|+&% zlGK;v@+UnnsVuH8grQWVRfUzPY0++6yQZA0;@t9rWr=BzVVIjMIBH%J4Vby`$2Gc1 zh?GxRVfB*o$_1V>O^ig;I5qKdPt=hdmlZBS(_p(6m!S%kRTt+;vy2-)RxQe_%k#@i zyN$QJqOh#0sx(?!o>vepTv}b3XTyeZi{~wi<`-60S0$z+i62SYPy0b@nO9!9&_+U` zQ-@JJuQ)%C8hv6+lFhsdq!P6;udJY|C~rYww5TwzpisAm@-lQ~3n>%G67?VD3-VN9 z#~YSXty)x3QC``_iWQY&zT&cC?jz#{jyV;eVO5r^h?Z0pNAoKSQ7(xYBA(R4{KD#J zbrF0Npo2;DlUGoHmQ`9Bou?cM3QLnaCbg2FBah*lJ$d6MC{dP;Ae&~KnSqtFTp=jAOb)wL{t zesN;z0HWyX78aLvt?uMjRgKXqT98+r*VUhKOBll9Md|4oZN2Q;eehsZ(7n6u#-xfR z3BZn@|5g|#<#T{kpA*wjYs>=O_A+ z%Dg4f%B6`(AZBJ52`MAoO;=7%c?IPaDlah{r9q-=B$Z3Mafn6JjXS3K zt(|`FZ(-H^=)BVMCDBD?)Y>tXh!HbwiHS&1;rw#$58^sh!6`K{Eiy|2n1^6_l2l!a zIahUbZXt${LPwChE=5Qkq-UKUFo#VKv0x;TG9VM0XQO?!OnjOJ4f#YB)Z71IOsCU^;T zzKKaQ8qvj-^OkviB}TU-T1K5O_aPoForbCt17+eveu7j$}E5e36J&R+|~Mk z-poMMnGp>tOPfj?lGo0ZB#%`fb_vL6Bv=J%U5!9NC722ziB*ypt4(fV{UMqds1zn})>X zTbh_MjDs}d%jC@)y0}!Kv-22NDC#TCy}d4Fc?*$$k1zTGQ2r4J`iY5XtsZbFP^sbK ziSmp2Xmm051t=u5rm+^Iexa+Mss+UrHW*mBybLRl(kP`Ri8AUk1~@21Y4DW~S}`Qi zEiIl~xHt(fD6XPaY_zyy@r)mFE~hoVXW5mQQ=U}wz*ANpn}?fvnyAR8psD$y>Up!0 zL`V53%r7vbe4tqU=sDb&!(r6WyD#?F^qA*%jQEb+yiODQkggFVON7!Ur5-rDsI;qw?yX!-JW8RV^>Ee20 zr)-H)aE6lmGBp#sNa#kQSRG?x)U~dgrKqtq7fn7|IRDHpeuD)qE%w{Z@Vca`ydt0W z3or>=6kC%U$|KIaN@*j8&Bc1Ga#>W-vhu2m!u)7-;Uew{B~UvU7!l^=oko#p^N7+E z+ucN}YFp~++oL%%IZu^Kv9X8UkGPOCE!vD9j=^c>lxKFgXlhrqe*)qJM~ez7mG3w& zEi}b#!%c9RG9#K8g?3F$Q-bS^X;IT8lZFgePkxaf?bq}k-T9r~O)ileggos>UAwc8 z@%tnBMabU#&P4qwEv2r)q@CtsKjrQXJ(+)R+LF0@a%KmtMX1Br+A1uYUtNSrMo}JG zDwZcy$=WtzYZrU)W@FYV#r6soEBv`6uM*`BfF8CuAI%AmX1Rrjg2K6rP-*eRvj^kD zZbyM)*k)HV_V8mVdf~Es^h9vxRTMqsmm_hU68uVcw5fi5eN#IXO;v2q)jUOutEv{E zoy3-bf<3EnA$DuC3TebH67`#A0LJVxaibXnjG0StKi-|=qB8UWv=wjmhB0Hv<8>Kz z{51VBQ#&@2ck>R-u&{bjWf?|vvwqDhr4=4`#8uHe8;H1>zP$?TN6e5Yn^o0V+9CB6 zfm!F7V2o|5iWXHDlrQ0CX|g@l1Zi`GS>3!mDl==zsou=fqz^$?)AF*a8y$mb^GW(g z`XzjthR9bO)X|v4n<+jFAangBE|m-OWCw+MK3P;o=a(aXSVFeUyiU9tqy1X0j5?}C zWwdKkLEjn_VwRJS{XI%_gH1Y;cBbr&(cJY)qw+y?o7_8&-^@L0omzk-R zw5+bNVl%Nge;GC&%2C~8`?%iN7h)Nlhh53)^73eDUZwduDlzFi7v_B=nb0N4#3C%% zFtVUl(il~MDrq;3y^+x(eO_L1=^_~p6Eb5gp?RV& znu-d5)`(4VS-zM!q&p~{k4jJ&U0PllU6@z3zzoK1jUD(IemQT#L6EU!O!30P@EL%_=kxi_#y490z2K`1inz0@#x}+E#xtSVuAD&E|x(zPY2XSfWWSN?RWn%Xc z#H;B~CLR447WUHH+BIUAkZH1PT6PyFt`k(bXkw_-8q0}|f!0MRS*vH(o!xe+R;}8U zBxaAMcQw6nEEMZZeWLcl$)j&%`3qU|-Kf?<2SpVfJ0P_0%sqQj%O~p57b4s~ba1w^ zVqC6i)4uoNB8Be)+ z3ZXL-SCQ>ntsotjw^VI;6qT3K#%VOKs7r=unt?>+Rbiz%HxG@k6(?fg=N0XdGEP$q z-it_hW1zk92pk6ze~X|NZzPzRk~xuv4rt+%S?bzqaOw=gqIClwP1DI=#5*+&&RQ^s z&MToeBODHbo-n_mABJ=~@oK{UQxQu|1HU^FZLHe}2|ob2y4`76wTcd`p~F*R32Sd? zX+xUe4b$xoXDw;6IE%bBkvHnI3Dem)?Koj1ud*@^1}{DoBh4}_+M-TPyLmCfWSZWN zpaXX#UL5UGSHIC|qyJl5+8q<4jj(MaC5Je_sDLANTCw9@@6b^+9W86>*HR8}x=jcE z;XIg{rfBRG5j?dwL|4|d*Uy*+S2_m8;qymum`a_T$kR@S*ih3bc5KCtdNUu8bPOG8m3Igy1Nriv{ z+Q6sqaJj8&Y^tZcab@UQBiOP=g^YzK3Sm`CD;>dt|E>F~x+uSR0T+}aYMOB&Jt`si zHD|`O*Vp6Fn@-d!s(gGS%h_OBR*@=9Q0Hu*K?gB9C^#EfyOb2E^RYjaAgmDEIc4pe z+B@o-F-|qEcbZ#}Ae6B6Ny+6%IOP-vy|O|UM%|+GW_YU!m2&lJXJuy{&JDuHDso36 zSSz}|rl}EnYwP5x7UvJuwsg`dOB7bSQ`d+%+cu$~+Z*fPi&RO8;x%u`&}sv%#%bS%<3Qv39;eHTW*)zYysrjJsf#^fP5LkVpXHCXF-i0GK}py;g| zn28R9!XZvLDhCzX>4Ytj2DHG9=ApPT59T|lz;?4wVQVns7;%#2dAxlJ^hQWYHUMJo7-2L zx{SJLqDCOAkX!QF*|BPtX|`zJT!T%?dUL>ylAK#nYuCbB=(&)U#`Y*qKdM3ffhD5! zv$@f=Eo;%B@fsNSZqT8Wp`c6!lT(&zo9b)UQbv#l7~bRyK1_QvnUjv6nj)&~+K$Gx zoqSLgj#fgyh~CC&*?<()Ad73!W7APuoRhlxRXF#_*w&ENW}Lo+Q^?S#w70`cGd^le zLuzk`Z4%uCuv$6B6A@CtjIhj$S8> zb+&aVX6k`x2x)D>QE<{NKs4dWnA3rd3$1HSw64Aty#{qiVy+a zqth^jbk@=*A9dz5V9-W4){e0~+S$6AdnIhHVJHr7UKI`QTm53=HkCl}4!>#~3I7^kf*G@PK`I<>2D z0^WMGVRIlIoxtXx3-2^Tf*m`fCM{MA-AP+bv>9Csb;xvP9lABtbyTm_jkZ=fwK!dk z8so+&Reeq)cP)mu)pxejNot~oIzs~ojU&dL!)&gvYpiK&L=OpsSQg9$0BMH9p*+&S$bN=RJ!qq>=UfZ!!af=>suVtI8eQ*yJHtQz>rIl z&y_>Hvx8q7`W}orwJ;I7FH^3RREHEXg~2SXv!f2bMefw%SV6RzTG$IaXwJszIkWi| zZEZH6q)ik(OMSh0qTb&;VY0WuobAUdW-f(h;4CE{3k$1@$_qr(FsF4*{U*Lq1SD{B z_<_;jJJh311egl4HYgUa|S8Z-i_3j;uV@F+tkmPF)b#> zN-5qci6<-!QSqpki77kOZD94)O3Op;1d%z6BP^TY&-O#@&YBvt9Ka{wN^~lC;+luv z*;!Lx--=EeXRg{T+MylYN_!N;X=5FFUCIYa?C^#?cHqeZXq^NvwQmDJc z2-(^SbD-H7TRG-LO{^vOe9(A8SJqSQ#}{5W7GV>5cv~h`0}0@@YRv{yZsq`3LS!5c zO@>N4$KbF!&Hgp_w5?5@G?4H!_uDK}OlU1gBDDqMT8HTgpX@2~N{%BzkJn9Yn8jk1 zyLvT-L*tu95R(PRERlJRhIxf&1wm1JWUM>bP<%)zjbq%M;o#EMsBbi-z}RFC|3r_A zKbOFK2t5IMKQog>^`!tYN2GZ@4-~aED2_(d;wageCjc~N(@Y9Ytd07c4UL#zpj*ML z4qFO!&T9O_>2vP9Qz>ut!5os4POTqj z*J4PeRCJjx;#6C-y_&T+1sEp+qn4o4>u75q0o8qg944u*ki5LTkN)yOJBf?9tn=i+MJpzlU>s=Xc(dLu5B=X zNrOI=)<9$cZW3LlC#YoWyG~ko&S}e;Ji>g?YiX^4^`%bnGzv4QRZW;r<=)`6y%55o#ailxUl98nGk~v>V{b02h*xW#`TaYcgvO>Yy+^ z?(8sI39>L`3-aEA0VtnZY;Kqex&ggKbR{|kGgP5dz>?XNBk~{vF$_|(o(`-QnftMo zEy$dt#O$QS7ZDc2JdKDAYjabas0Qd|x!IA``0Vrg8ngzH&^J-zaB95+x-<``vAzR+ zDb6552G%!HWVGYQJ9Yd`74|6jh-#$P?5^!g>Ash|j=Z$64g`hAvCado)cQ|0UtKW#7gI3nkXUm&;HT#z%;xTV)cIsEHq7KRo z&~}(cD<(xAq)`!K>qjmcGPx;2q^A{@;wnq;>Nsm1&TG71!wKXx63N+5m@CG1D!6;E zYintZw-Fkk{yTrXiN74h?}PH?9#QGIM-6ia_ZaSEgYYkq;gf!^+*#UVXznk4=LXIT zogcZN$7Q`PO?Q@o2b@~`i8M~)`=(b<`f#C&fA0U$--P}j{zYl?%KEyFCcH1zhE`kO zHo0+aZBu7mJwCBdVpNVs?xW@E7XFMiWif zfj{yMIJ8FKZ6zoKkv#NzcnUc@9kULI+X)1n6#C@LKhzDTr$*il`48LTAGIYIDhc`1 zN`k#l4EjPP{)JnD{*ZsHZ<-tIQxxpGAn0EZ4Eta5mqZQ@?t4fu43#gAED81r`OgY$ z2@VOB1osKu6YR4fxKB|q5-Qme%nVfoM*`0*3HA>iAM(F_WQqTR0KyMd28V*DhwkH0 z{)$jWhWx*VQ_oVUmIT8k!IV%%$o~v{+z1>X;fW)+1c!(GGvM(Aq^u-3FmysNP#Wx8 zgnP(eKz{uH<3wH$`u*Sgw}kw692q%?d|ZHE-0XQmaClMBZ|L&>Mmpz#D6uMhe6&FIz`B( zO#a~^=QDW+WUJ_$&EzAHlZBkdiOJWLFh4!_g_V7G1;fV&hb{>DKRkL1k@J09 zEP2b2OXK8KL$0{dvL*rq>l3-{{a7L&! z*b@M@9?JIvQ6{0%&|RSZR4Pu&{Z525+W#m#heKt-fd5_CrN;@uDRAr&x<8mw%B4J^ zB-k%hL{W$C5BcvySqG38WATrV`Glk=A!Ych@8UA~8*)1$PqWJy4K?Wlz4PWH?;Hcu@Sd{AV$Qf0`A)vcBW^;S91T07Xvl!!P%+V+NEzzg-~CA7!eHM!5H+O=L6rvkp>dR&)ZBM0WuPRq z5SdTqM_B5V;OJu5giN>~7$^=7FAHYlVPPE)5BW=iSqp+0Mz<%z zpezPM(6|FBL@oV_G{E|hITxV1lpq78l)MuW#903~aCh*GDirb`7q~03J~#$d>)Rvm z3gU;Rp9{dM`}p5El8n0`IJB7VLly)FA($a0!9iP)pRK`BDB>cz5Avt5X@7St7v8JR zT@=yfkot%GuRCOXYOiG>|Aohv_}_9$=o88Fe*m|k_XV@&1&5Xe_u0z17=&a-?kx)r zLcUKxiqPs{&6CkO{Cn}78SoCCe6y7qEl=u_488FL!k6R!`M({E-ZUhgnZNraHzV4l{6 z?_nN0W+dkR7v_9WNQ}|Lqs;AWB<_^K{XT||B$uCtl_Zy+Mw29$pT?FXm*44X2U7Fn zXK|8UejI3a2qC}?H)czp6TNy54UL}BuCrh97V_cK8xtpL8i;5Cz~Zq%!J$Y zSbn-kpIXyQ(YMF6lD?N;BKj0BeljO^oi0sC=j#dKlpb$u#jghOWy7}tz2phU8~*Dm z9Q-OPUvH^!EFXhuAzjuEHmnK4tsN|H5>Dy&+W9RHA7O&z`)3|*<0OY6(q-8E+Io;J z+~(KvF~YSyn>^fGAFlTBY)*-}-Q(f>` z+r?7hx?R*sS4iRTK?V}OJU}@tbr^(`O_1D0iu36@T!>9DvLH1z9ssE*`zYQ_|b}=BK&y8FBX2L;%^GSK=Ip! zU#d8bH*{TVK4STuC+oJG75`TB?@&A}`u8e6K=?z7PZa*7;-?CKQSrsX|EhS6@P8=Y zA^Zcym&z32OT{k|{qGdNMYvz`ZR^R4!c!EtQ=8t3XZuaS)F07h!!ZYu;`i1RUnu$` z6kjQPKgEv{K2h-th3~KUPT{i^e^K}x#XlEbsCZcVV`RZ&ds-;Vp`PF1%Cmq0%oOsrVtnk5l|a;WWSUmgC*R&rtkL;lEToO*-I<6hBb- z<%%yBevRTC!hfsy>B4VT{2JkRD85Vhy^6mq{2|3Z5&oFsnKBMNrT94E&nuoU{4a`k z3V&7ci-p^M&bFgFguk!!cMJbi@z;f$bymDR+NHw}N`HhbDT31OZM^e@rzyTlcpt@2 z7T#a+9m0ny{pSVBAUry4n`cz@ybicb>0M)6|d>l9xhe1qag2|rr#^MoI-_-(>ZQT$KB&rW$E5%0(ze4eO!f#f*S@<1_A1nM`#m^M}km6Sfe@yXPg+HbEAB6u+@fU^T za4x=VdwE0nJBoiO90!~w==YXM;ungK6#lK^`wO>AWgBm?aC6dcyuB|MZVo+<^A_Re zpz}CCUicsx4{i9D2)ESh$_f+IUw9AF1?D5I#=v?ZR^u zzhC$a#s4Y%AjLlyK3DO+Qtm~HPZVCJc)svz#g_>`RPlDM=pah&iJ z#jg^cq4<5m2P;koHqtdx@$ZFCReYz^s{<9EEj&;0a^dq8uNA&f@lC?36hBk=GQ}?y z9##Ce!Vgz`m~4W!EB=h=Z&Lj4!jDz_6XAB9YRknOmWbc|SNi5$7suJAxH%ofaV}82 zL^k{`RlGs?Rf?Y^{5r+27XCZM9~6F@;(LVKb+*lyIl<6z9#Hz`$Xk3rrT78;O}+Y~ z;!A};tN421FDrh&@V_g5yYM#@e?j=Wihm*e3&pRM`tZHtQ-lX({cY_qTX?GCbA_iX zzEF5S#TN@7qWB8oIDL#S8}Az7V-#O6e6r%l2%n+&DZ+oI_<6z$6u(S(x#ESg@oe|W zZ94A|{a+~k2ZYxt{*v&+6@N!~tKxfwuU9;k&$@P;qZA)3e2e06Lim}AZxnv6 z;^zv#Sn=zHZ&&vW{9WOnD;|_DoxW8(Tex5LlWcl&g{LZBBfO8|#|s~z_^*Wz zSNw6|qZR*1_(a8fik)XGK5wXL&vO+o68$2@mk2LYyg_)i;>QX zzfbrrioY)WPQ`o57i;$^K3@34iWdrhT=7l9pH}>G;V&qDm+)5M7M`K_@N8Cd1}I)Ce3;_v zg^yJHBH`l{ze{+I;?E18q4-C_=PJIx)X!qYM+je}_yNL~3wPbb?`IEJ`a@M2_8=R#iWdDtA~?*g@k{;;uD2m;o%g{IHZ@ZYdoC7IetIJ&P^Up z`e%y%tsYMLl@k8_9!~mp-~S;GC;gS8|D=bL{utSpe8$5`zfSc3>fxks_oH9+aMEuQ z{r5ba^ly;x?e_q--nNMTH%k8>qW^=3Q}{=SeyZ%p+i=bi-bc8t5B7bFK}!E9(I27o zN6L6PPU)X6`u2N?SopHeJV5FHPW0z0evR-l74O-|8(k|EzuI8uIK^KPexBk7Njp`UzjVD0ms@Epaz5?-MA1X({UQM^_7dc}7M zKUMMPgkPZeN5X%r_$(>+#}#jo{(6saTi=RCm;(4z@#V7&|4#9>qMs_?8`yAOmi9hC z@ehUD?^UdR<}?%jG^IaK_*})ag;yv(UidE*e{~-dev{&}ME?lI%Y<)LeB~Gu&iRVh ziT>4!-#o?W-=g?>(ch)`DZ-yr`~u;xD1MdjcND)(_*aTQC_E(JS6KT$B0Nj+=Y{X1 z_06!%Xz`8`1P<*NI^@=wLKSA+M;pZrRtnlrMpC$Z8#V;0q zzv4Fue_HWf!e3SV8R4HO{-$uhd>>-VeHEyDk<_@lz#SNuug-zffy@D!Rn;j;GsPT zrudXm#%?bteu?nc6(1!01I0Tf{BIP$PR7%Sd=F;J@pj>T6@O6pK8mO8YtlJc@qxk* zQhc;<`+cB|w@Ub8rGJ?4TE&M+y=qnbSHh1`{1)M-EB>JHixq!H__d0^F8p@IzYzYg z;t?sAmlVH1?D?AF8>PHHRNSunzE%7<(NCd82rg^S(}ed^{6^vXD&AAlGez;y!sjSH zMfgI+rwKny@gm`kikAuBpm?S56BS<}{FjQi3BN+|vxWao@fXDo4=H|<@Fx}DF8t4m zUm*N_#orbFh2pmg_sjR6w!H2Zp02n}=TODp5dF!DKPh~M;`a;BQ~a;Oixl50yh`!m zV$VYr?$+mDnHNB|Jm%`-Klz z{13t>C~o`bCdH2x{VNr}Uic2hFBASx#h(!Vq2jxRf2+7Hm$bf#`8`GINtWUxg^y5t zobXACPZEBh;?so}DLz~HBE@rsuT<5@beXaQ1+L$D{kk*Hz!L8*tM6z?y5hT;>2&sThw@TH393vX0>k?r;yJ>9t@tY8w<>5?-eGT;a3(LYJ?qlBNU_$k7#RQzJ$H!1!*;rA*2gzzU6|Euu7Dt^1vs}B@^ zOZ0zGe6R3yc|XOLS7d)vjw2KwEPSfs6NKCMYiu~V!poF?sqp2B*9bpc@%6$tDt?0S zlN7&L__>PTEc{Bv9}<3(;x7xoPjN^3v6mGeB<=k*#fzjr`A~5?fB05$JAX)#_hPI) z?e|Un6mOC6_f>qe@EpbM{P1UrZx#I##V-+V-!ro5xlwqX(!WdiI>jFnevIO;2|rEo z_k>@l_&36@Q9MoTe~aS1h5teE!z7$PDsI=mFDqUu`fn&+CEO?P0a^PzBRo~{&61u> z#qB;=w&Dkg{zS#+2tPpa`NHQbULm|%@nynm6kj2Ht>O*Bk5s%>_*TU?2;Z*wN77&I zQ2ZLvzeDjmg+Hvg9haX`+f|5V0>RC!OzmTxcN0~ELWHlr2) zPV}cK9vN@?+qsG#DZE1QGlc&_@omDJ6u(IL5sLp#_*TV_o@~-{zT&3~zgqEM3BN`0 zWfJ}_#a|WuCl!BR_$!Lrarqs^zZ3nh6z?hZDkSfV+4AZuJWKK6!uL^pyzm^wepzPn<^2(I($12_|?R~1^Hk>(%XNZ2O;!}h#Q+&SgRf;bb-mbXqe>N-r3(>dV zx7d6Q7XF0N@05P#S;Y?*{ujmXkZ|5q{C?q|DsJungW~pkfi(FZz^3zU38%l}yCyh% z?W=gYq;s<3Lxdlwc;`eD&V0qEihh;iCBmbMzar^bqxhkszd`Y5B;Ior4~qUpihnuD zr1J{Jt^IFM{Bg0{PQ{-U{+!}(O89?K{5j$OQ2Zqc=R?KEivBl>PZb`P{dilxxxzCQ zUnqRI;!A{&SA2!=S&BCbx8Eb#csqqxD*esEql%v-&XuP3IB7&ZMmn*{=F^tTnVSY;!}iY zD;^X+QSn~F4^Vu7@cD}GBmDP@?+|{M;+F}3Q1M>~e^POq-?tS%NAy2Z{CMGe6<;Mh zB>UyoZY{zy72hO$h2mcdU#<9?!dn!7UiguU+i}W%&tTItP1?mTmHsHOr^3f5{x{({ zioYa0)9#D7=64J4mwsSh#Yf8cZuhrrdY%=&M(Nx6}K{;=ZHh5t$M1BJ^rp%X;??_r|kdz;S)_U}hxPR;er zwXK`XVKerCG(I#A2NBDO9h2(nS9Y$B)~sAf2Les%z0 z=u{oESw>#g71)M2Dt|BOP7l7(i*7)a4M6No_53?qgSnD9)0>vAQ_i z1m_0P;V+Zcwsh1_nqRhPB0HFqT5&!l=abGas$FT%Z=qPsp(Eb3;Jk-=NlSf$IirRB z#!Tux)WjS8>du-rbN)$}Ls2A~bd0b*d|?s{gM)FLN$s1O>2qY=q}e9EhS*`ZV6(_! zCf#PxZ93hi(QSXaO{Louq}o^sK~8}O{_D{h-ZT}0wD1Kd) ze=q&>Jway z@!t>sI`0(oiX%+?IZ}Tq-c0<{>F3jLaE|Vz+DR>wv$L~v@Xuc6+1zJLo5pz7%-K_o z`-;?K3rpwu+<1;$=Z-GrL#bG52U|Sn62N@`G`~CYzUw|Kcdz@-?`*^Gn(c7>n=9dX z?x%Rp_Bpq9IL@u-Zppn4`ODhlAHIX!@OzYd_ki#5XBj!d8v)*%7gZz z<3X1w0SoLY5m$yw~srjS7y-PE4}~VUVYp}c;C%82{0p+JK%!31E-)-`-6_JKRpDd z$wM&JnUdKDEi*(9juSp*i|ZN^IdzNc_y%mFA390_7RA&_uD{m-X$Pk5H?TPKpn-D+ zI!;>9DTd!3y^)ljBOQOQgVX5OS9`@Zjb88Gte2jN5Yo~p3@j;oLcchZgjo>rRwM<5 zmtKoAO*E+fG5sKpYKZ9vNxxrTw>Wb@q@jObmp%r><1EgcGcX$}193hMCzt{rG|eLn zP89*C9e6Ai&mLuN=uoytMrdi;va}@#Z&=V7(wl5GJc%FjffEvZ{o_$OyV0|no;$)_ zpm!Bv3(tJU`sY^2Zu9w2=U(|rJa7m%*oQmq1O0q-@JZb46|_GDO(66NT*6maH+)9i z3b)8fxyyr`R1$ncZ^1q7_w?L@=M>=xjbn~KFYQtK?EM68Tv5{lwS9ZbOkDV(@7!ySz~85jKxQDFNnj$Ose=zvkl}Xg+>sKIS;R--cGEIYS7EGJniAAkfBk zq67pwjGZWm!1@St3OTS5xg8CdIYml8P%1_~JZ|J>wD<8r_`U_v7AQp8qFN!DHGt z5?tb^!K@&wHsj{F^T?n>sY2VUfN)WdVb1@$a{qM2maneOq*YQ<{)6 zPHY!k{e!t_k5D7*ZOg}c|6hHU7nN6Kj~ScIhXZEg1Zz5(G}{~!m_3Hh4xEVdN9i!@ z>}k`cOr2G`YGzJO{nVK=b7s{}nKEP5j8(OGSUIh>re=E0jGUVKskLLfI|{L*p|Ool zo?h8Lb@J4lsrY|N&g6u14N01;4~PV7t7+S`JU-z=1j})r_L}7lHEqo;Yd7KWM%o2f z?ulTzjbQo8PIG9o=S0OQyx|1L^|NaDAVX}BM33N8cb%q|wX3r`*S0sV#yQ#9IFiyS zTwD>YSWvi(PYHKgagukmwb?Pp)f;hb{RYRYX($~@Zl36PZzmQePU~$mJbvUohrh6} zx~ROssbAk3UyNyIq5czt~nA5L#hs7G4(qw(oIr;oMl$jXE32JGY*8Q~INNuP)40*Zg~QiPR_I}E zOB9A=@5WY%X}1~S^!>LEOXZFV?ZA6hDovg2jEjabr?kh=Y&t9Tve2awahpXP*9y9^ zyKyDI)x>b+(9PpU;!Jcj0jCA6_CI{aYIlv`KistJ*{iKhH65#3+M54M!N-nv<>p4! zXi_bv+bp%VK;i>TslHInhlKu(BzwZBh*U$3BRWP{-dz3xZm>t{SHYCK%Y&IXY4A`! zl5ye|oC8Wncj7R^ay)L~$AOhN%do^8S2%YI9Z2|qQ{qdfvxYnYKH^Y_{-t*zOq`+E zla3TM{<{w>YMsG#fozZOHJ%1LYw|%p95i>WM>H0fG3^~W_;6L0&HRg z&z<%NFm`%~dE^;L!tSx*`K-^wOoE?-ncLPCcbd(drv-6{r)kVFB~{mI<}`XGUdx$d zHmxpmc8uDH5S@SjY{Blr>1sEMqWd!hyV}R-ceRhB5wO=LKPnFwcb(>=P9trHZ3~dY>&P-UYkE1Z>~q*8*h<^d*k)ySN_b7 zHSKbp!uN(VLBbgX?hS{=A-ZTwikAaMbT-JR=Cn~nm*yWC+=b6TxO9=exAxjIl{CM! z8~s0dI4!R2W%uxDh2`xHs2=Gne^PK_yplQ6}L;XhZVPH zGCigEED7fY#q)&!Rq+zxA1FRj_~(ib5&oUx*Nbc?Kh{3C3-2rbEVtk3jaNKF_Hp8tyeWl|9jDIQ2ayT>lCL=D7ubO+@67Wn&Q^(7b?C-!ueP@wNr2Z z`Ge9wOypiN#j*Of9~>#1@=N{CBnf|_;x)o&D1M&sd=>sdoLh{WiqoD3UB6J=_O0s_ zxB5qVxVN7_MYt_5TORheFm1jblXRY|^lf{&N`-Ixy_*!z=F~gRT`HVI#LnW}rJvX1 zX{#vOKHrv$^>5?1e1$k<%O`QK9mXi0BeEU$gV6Vmdm-ZM4;_U0vU9 z_2~rkdXY~I zJ&gSQn19=jtQYN{{AxzJOJ!2HQ9ROIobqYgscnDRV9DaY37oDKe2?FBT(tYG8EHSA zBz{`e==h%mOBR1RL0q<-8>wqtkHH~X{Pwr2io_%3pH^Es{$7Yjq7qH>kt=YN?)MV3 zumb?SWbvOZljB{YPw^*vr(z*^viR$zQeLDSmFS$&jsNc@QBSDKt^IF>|77W}kj2AB zso0c$8dJ6XTDpn*xkl!mG8#`F_lc`CGp>C73I_B-{QOQkj#Ed zrT;1tMY10isr7H$|BYZeP2{CWCQt{eglXODpqniI?MdRNb-9jz0s>S~Q1s4L8El^x zM~XL@e;QWsb%lK;9PaZavtG^`fM&D}XX=&ak*|MEff z&WN)jcPD*DI&yb5U`sCB*<8soxL41*<2{mbG54PFaFV*Gc-$#Gk37e5)-_|>+=hp9 z0(U&%d^IzYmpgm7JG|{$q{9hrHEHaG-yY7oU9M9-JmRd|jL%%xnI5Uh-FY4K4#z(V zyVyNt&~T)wi2UN2(zzYaoZbPsdn3Wzz3!CUz1hxiyeo6>b)Vy1na|37{C>`MypO~0 zwBQ|^Ts-spI(SB0x8khp9ZnDP?#?bOqx(MXUY8kh_BQx(ccO0WM0b<5$KRLV%dzk6 z(EB!@mCr>S^#064UEa^(xO&L@Ga2&PFL!UQS*G)QKHhg}T*Nol$=ykIqB24s&gF&z z-Ann?`B@Q?JoGW?rug;*u>~OSAUSyEd?An9@y=0hz`3<^w6k|}FG));yoUrkY_@63 zaQ0@?J4^kXy<71v61{uWFv!_^3T)8mb9SB*%H7+DcZp6p0CJ_XlWZMv5tcjWgp z+6o(vgx@hbckkxdJ5A{k`v8 zMNsCHZ%zx+LuvU}(m~PylX}ElNgnAvUjikl`uKa2+ziMg(p6*J!~47NqM0Taz9|}pQ&H*ciAZZMyi7= zoSmQfedEY4+qtjA=VYy^LEE*2DiU^fjA({nwD2O((f+1#|jbe&}cA`AFkjq?O*U zdzjm=lV#ePgZy`~3EC#L&(9LI&-S-G0?zdXee<61<%7OE@&V3w1n>Dp+!3cn0@NlW zJ1Fn;?jL;`H+P5EjhF-dpVWgLU&VMr`Sy*XzHj&ol$L*meRpI$?XO7~kr5{Srrnsd z|EKjFlriTUpAommAvE4xi#mjP^4ViuXIu8m4PSA-%`|Wu>ke@;hX2uBcP-i==|zU* zo20IH`b@-nl-`| z=>Kdv#KsKt;|XKk+0MG%(2F2{5#-HzdBs;&SNr{MhwoM=j)%UnX6$hfa(GNj3B>2w zV}nkgl%VKizK(gD>Hlf&?wYZ{f$jc3_Ra;qit1YUbI!>LNeB?021Ps|YE%dz1dK{G zJc0=X5<-Be=t)QpBodM|2@n)CA_`g`Sn<{RKt)CC11(jwR%x}p*lKIl_NvuNt-aT( z?dAF^wpPEj)?RC7ojr35^!9$=z2DFI!OY(Oz4qE`uf1pQnK_v~)IMV%eT7b{-4I zOkONIJeKuv8(>+#gZUi%KLqWBYoVRne}2V_P0!!|!8?EY`3HOY?ZwwhKb7`D8N9E- zBi?U(vM2=CaOVDLmQ(U+c}~fik0W8Yjtkv8J5+Ka-b1|ubMyO=ta~qyI#*v2%KF(; zq0IO0g?aGu(DC26;Bcp7H}r}7Ar1NRs55W*7hlxCGq)k%fczQY``Mp=fj@^0c_-== zVSL!Sb=TyDhJ6F>U#eB~+KRBpl%@rVj zU#S1jZVe51FDv5I%!2s)k$(504R}9!<H*1R4sJM z=R4)4&Vu>Q+-he5@JeUFTxVLfGp)>7P~|L`4Q~jxbtYo);JkS$yv^B~=x&F<%1kuE zWA4t*`eg}cNqu9iBhk>-(HL7%-{3Sta7B9uB;sFm;yaKlI}%P)eQRT9Q~mOUOIq7v z_!n8tOPd?&yNnhchd*3g*^Ymt1%D5zxe7z6tJ;<)8tD%NSx*eiYwobv%GTwrZL3?I z=9ZSkvig=7yboCqe~g&uKw~@Bw0DW6kdJEuZE+_eV(o-@(W3MLx0D?1Y%v4;BAhC~aL2p;Q5v?i88OVpE6?IU=VGy#7<3PouT zt!!;u(pBHwTEC2A6c9`QqqB&P->4v%0>cwYhbfvlRYDw#BI~bE>B~)ic1u&|#Wj2mYt< zlD5V*Ce+vl@47CSJA2XGm@|KVMQJtk(DJ$EH599y9dl|HO)qn5s^`;gI)-MK!XElL z1ZQ9}z(vy$E}FiO;`3oYvwSW}O^0wbg%_1!4%D>>buF5Y*+|zS)U^n8fjsU^0SlcO zAP##lV4<@l0e`iah=Galx4O;H94*b~nkGS{nkcpu(mR{L-<>O|_bgr6(y|8Ywrb+| znu_@`dfylR3Yxk>Q=+A%O(l|dpbJ1>1c#+gQ%#s6H~e`coEh*p!0-!M3K69QI>6Ug zLg!5(*~#a2S98PiL@FU_$`tifMX4f^T#>?Hmhr|7JfCn}@|8qYjWsm4H-YmyVaW1{ zNYkhUa=7tQimW7&GG}lz8l$NJ13YU|Q?#Q%j_<(TMolat53j6Tnk6OhB*aHgtELmU0+4^z1o)}c94DBg@f^(X zUu|D`;D4|O?AIy9RQX#Tcr{XjIh+>!9%L#-@-S2L$6+SB{`6)oqJUz%_D!61z`6IFa^2slbh8`jo$T5|LX|6f{ z#j(gM+imZiuI@$&?qOuADzTS6!H+ly50q#-fVb+!vo~>8=-JM#64}NOTEH%iS3(#HU=@$FTJj5aQa1ci4{Zq7b|5LO`%?@A$ld1-|>L6+)LxWdvRSRqG za%)s2Wyvv>cgJ{HBv|62UVE%)m-#5<%#)zBH1?u-z0NA4NNfl>)e`i~X%s0r+Lf}) zK8RsiN`ovCypM}Hh?X7UW|=2JIjKWVud|9&OAJs>@NDVT2~uE-YfEA+2QT-~Rt|3W z5Qp4@?Ojp4$<4CNmF0k)Mfz%qn`Nm4XSk?Vf;(Kaltb>pRxDn4!p&0U%5uQYBI#*f z771oBI=B%}azmGq;6J8Fx(X;k2Ye3Zx>@E)(9_b$iSEJn&SFjxL9j)7%Vt;c z|9u}zO~4!p=CL^k)>tu?mRz8SiF>eJAqhDgfGiS}k^8{P7DduKK#>Ihv5q2U{Fg0~ z;z5xFv)S7J?NyUA2&yJQY5Rk#n&gH#O@dm{fzN4@`zwna-|g5x{S*msb}Xr9OKc2N zXcY;LO%mjYd$5NI`&2%NJ1pr(P__i8B$Zvpu^af7=fHYyG3OFppne7;Q3y!JzZy;g zw3vf+9%|xXi-+XuvfD#F9NgfcfLY@PPQA&K+Qz}{9@@ddogR9EgS$Pnhl9^~=w%MR z;-S49eA`3sb8w%B_H*zv52dlgy}Pz5dEaA*d;3`h>qF5N^H3fK@vp{l1FxEe4;%-V zi(*v5!5JQ^;9!-9YB^|DLLgm@jG8>Db`ExVNM04|@z5p?UhbhS9F)!lrWymiz1`O( zC65D;MS@cpnJ!w!G12{1$0dh=zrO0Y;)(wk9d|7EOK1oQ7BD)nE^6mGh?7RL{=X=D zgja6~#**qSu`!;Y1jX(HbC8S&lItKGB$h!I35r>!Y>A0wASgj8?!Vp0T+cxg6dO$0 z5-aiqC0NJkz>E|hh(f5X468Cw1FB`6q8kts_mFB77yBWL1f{J1ZB@zO%0g8nC{;R$ z>oLiyv}Cj518XvId75XA1V#73DU#yBA_?Xkltog!@q z;vtI!$NWR){L?(0$Hjw15-f0U85*Vba!l0^W3HBY67;kj@RLk&2|WLnpxjFxz*BTN zea5=BR7>z6v`C{Cuon7dQ0DV)S9R?c4sO?SJ2{f=dhqld4tlqYr%TYgWvu0V?!or6 z->P#%w~AFWI9teB+{D3lK1Q6ipnV%5uxBF?!N+$xdxJvk1!hoE)S(_mF`S)n|V2djjSfMs6N zyrs>fW+n46wxyBhvPEx*G$X3cG_@UTz;flO8y90bR8375^_${n6ks|UK8bDN znxH+Cxyi|z6WDNy6uXT_(GzuE%y|+v0<;?zcyhkuemsC07)rnboi}2#>VtWNCzCWJ zSz8$Oq=k5ytO%xtXdkA1g!XB)kJ8?JM5hmhGiaYldw9_Vw!XB_rhPx!n}xpyP&kM7 z18F~q_Je6Zg!V&eKaBQ=&_0*;!)bpg?GK~<2-+V``;oLig7z`mkD~o(+8;^#F-{s9 z*C&l@TSC;KeahN8QFuqqNnZdv+``joG0?g&Es^Y`!;3oMTg`GA6uvDj1I79wzr%d7 zXb6Vy%ppDoEC}D7OW}G9-xH(oW1uzsojeNv0>k$gP?&T+SWMw>!=ek}he{~C1;gJh z^JKnfZuv<5QGDghah^b#$7)TbqiLq@8PVZjPUcA1r5_7B+`>gvr=0LRp1yZgo&IF% zv=Hm@9~n**7jw(3Lk-JC!wICJDf|Ixz-9}7WHfw+R(xVSL43dQ1cm=p%RKTVI)0NMv-+Gfo~^J`O9FL=(h>PIkPgnw>YHHQBAWeLeF!thIFUb(+Atx7HbueBb3wayE_)<|LM z5wABxE;~;qehhf&%0;3?BjqT?| zkA`68@vy@@@X3wn2}z<(^fZX4SHljsFm^k5gFW2fRWM;H*a;$G_^L*<8v>c@FxMu@ zRZI2D4IgUi_ZW)8#TC`!=NN&nYEa}gjKpB=g6NYFGF3uXXXDO^z6ARL9DXxdz^hXF z7bpu`_#`qmBYct9louOgsqbz~bJCB84neYCW7)MNTY>%Ld?nihvbj70hUP>ULwfo$ z$y-8sbHkTWUh0RJo4gdh(sUW>KAUrRG|Gr>h3uw=bRzCRZPD++o^DyfvGjit{gtFY zEqskvk845pcaT0H`vcfhTXKW`1>%`_K1V~4Z2+I({UGd}@Y&e+S^k*hlqnG9l&KIL z7(LBR$C8}rB8VHUy3`d(QmkNovZxci2Bpv^WVI8$1LF_C&cx+=+D>Ry^hu!6r(u`5 z2X@>!(_e!yZs8lFZ$ePjC<4C8Mn`8;Pr%unYUxA~MzM!SQIoqCFnT%EwhXQk;2O$t zI`MMBO+-hB+A82ci8SyGL9s{$HkSErNu+{2A}bR+G0H?z3sDM}vZ5`r5CwBloora4 z$XWe{hpNn==9V0Tgiu=xymCqQ0eW-rMCx{zB)jOaS9q4S(mJ2U9gf1 zJtf9J4az?a$^OARwh*qv=0r9oE8mEMhlb{PX}DY;ZIMe+G#4Er8(zdkt}aM&3$b(h zd99@y(^Tp(xMKl#9|MOGg|Iu^6o*Pj!et+PZwx*vBSmyUzYpuPJxpH0D{i z3(smV`Y2xBc+p2N?-8gp@~Wsd(cefkhJnZ%qa3)Tm2Fgxij2mKUD?3Wa88{wdV<9+ zhD(K0EVcnM9f=v!j>k`2MRAg%cr@=YjN^#+&88Ba`_Ao{SQz5YWRl>mR}kBd?JDAuMDp zD#I<36GGd)_&|~$M``kNzT=qqOf-)+6ECykczJEMd^|)dLgU{lnIwY4EPOppcPMJ8WDiqEF%I6S9lVjMWE^~{<=`Gr%>Cwi zO7i;7^_0y!DQ~3oe8}KL?hh5B{jwDxyE)X?txqpi393tS^{_4nLcFe01~za_c3L&r zNj33mwljo7w2mhaKaWuUBDb!_|5? zjJOhZ$>%ej;*L3?=TLqgG3QYE=7g>^iruzAS94pOX_r=mo)I|nk(IJ zTDsq~ber^lO!xbi?)NR-CcSsv?tN(n_0F^5f}c*llfl;k-$H-aNqAr>qf%!E#4MC3>~<;je~Zk0H~BxaM9 z7gK`U>+sJ|xtP&bF{8;kZ=@MxS*WsJVP(C-%6gTR6)!co)csc0{Z`h$rp`Jb4SnhP zWk6c;6~I7B4|M6#R@S4_a5D7jnwL83G%M>gE9(rC6-Ngraw=NH*OI3uPtA4c12f;A zmDUgXl2?(l(ood1CQj*v_+UmhYVd|M9OLORP13|l6Tq^xfsjZO>q*{4r{|42P{rjx zYnA`3RsPRXl>dt_EB~e7@{6PfP-E!>Cr4%IJUObToRg#9j)9b$#mu*;AX4gPDUD*& z$t+b$S^VRz(xM8kaIVIcC^o6rR%ejKo{ia%kGpoWtGzi%do!u< zw5u$gmiEqQa;H(Yud_tgMemAfo0YRRM)3ioXYnugrnKIo5 zQleYk%5P1o{8m%>pe*;gS?*0T@LtPbs+66U6LzNd*OQj*Pnw2vM?$4_k0rXt5>>8! z(Gq=;Dw_ulL0iP6d(Ko@e`{s^t(DcJ2WEYjvdT&GE>$|{vNNc1A6YK@D0Lft?l#Eh zNe%LO>ITV3Pd+^|(y0RnHTR%&slcFgeF_gE6@h2e2sg`!bUjdvpe)7aDl0M~9e*1O zRB()|;FzQ`k4aK+jHO@*XybEwe7e`R)pF+)obk=PbB3zS8RSr}^fS`& zCubeULcCF8arzD@#EZwN7%zTSI{wJu#m`R1-y6KRNgt)3kTUQ5fW72{yt*K=UG+*nc3gu>#6r6&{=BnnSBp`f^7 z!i337CogS)z>=bd`ua)rlMCt-g$>94lRt$HUj^!@?^v_g{X!7vU%a}lWBKBy`i>QC zt!vsk*B7a=8i`Eh)`$Y;=+PL_&1?o@sgFzEd*C5mUOn^YM-5P$TqoX+^XVw zSnaj5d08v0Z3?T_;u?$b`8Dxrr86t5Vf9rLtDNoNVvU$Ey*gf2T2WCMUszgQKJ)Z= zb?LkXrSoe<5|ZavFJu`7rFM#(+Uc;6t6LTcLKzB?{uz~X zUF)#S()shtE9b^*%3+_!m_dD^UF$MU05z-QG9yE+!|9U4Yk3G;y%+L z8`fcA^~}?CuH@nt#pjmR*2Jr-D{Cs1lx@TOMeI{m(fQTdF7duA8SH&X_In?o_C7@I z%CH2srC2GNw4c!=r*h8x)8aEL zDi_5U%*Azxq4`|`ixXE?d(rCBxuvI7)|5}JDb;Z5jPkjsd0c})^k%Fi9sIEMVQ#*61W!8{6A3)6$i#=KGTP&CJfGm0gXv zcH~S@s`A@M2pisso+G~#oJeyBT6HU)8{KG)Y4Yp=$+iK9Bzk^=xl0R9jDJ| zl9(|d4$B1BV*WX$HD#4ESkf@39aes&9Tta?I2K0%Dvm-_9ECiMRoFvVV`5c%oRXm= z`Rpdu3yY?XWtLBl!xG&MUENMcOZ^&LS{fI#PJl1#8{_r3+%yDnk@7etW8Ui0>6O(p z;uTX*hn3JtdWAW7?S);Xlol_C45+RR2T~)8Dk@>!VH%H0=YW@KAzi1dc}1daWtV9( zY#9Vjdjf2t%tj1zQ)V*)Ic5pl_zGB4T*3|YEiFsx8zL)hSj#?v@WiwfR(&gwsbkP;5jT(-rm(@l<_c7HMM%`9JGX5P(uea z!)oM9+v2VjXgoBdaRAy*LHDbt?h5ZlLOLLdH?$<64`B#f!=yvMr9e9baFK9Qo9K!! zHF%j9?1bPFSS!6H(MnR7#NOiSVP2%hEz~A(M$edEHg$HXX&uVQ-3w0?@xJL|@tF%? z$$Zq}^+0SJ?tt|z?X7WIz`fI;^#t_Y4biaYffs)LhYnF z9A(4R`4f$WutGZ?C+H4ovc^#{HUL$*rI|ZzV_V#7?hdmCxM~3`#vOq$B8`k;8R$^6 ztcoA+YJ=)`P(Ogr_UeJR=Cn5h+hh5H$l_)QIh&T20VLF zFPGt(YMPS9c1#kJRMBLOoL{bt2CzhjApTOVeNb~ z=ZI3&BqNnDl+_Gns48Y&6|n$Jt?$jiBKaja$rYY{G0Uy3wnx>4X9Qgk&lP6&lLXY~ zOHg_|=|D+oSfj!WFZS>V$kprg65+o|tZ1|LRo@E+2;W`rw6 zxa>63BwUd-w5^1>tljy#)Mf_!?KT{KX%7ooN$wLJj%mU zc=|~jvJw+?Vthna6Tq4R*jkkbgP3(r!tI*P~G1N1UeXXx>FLe}#j|Scbf7N@-RZn2t}faijWD z8DImIV(PM()3Hq4@Yo)}HdqYplI58^-9|H}?PU2L2gwOi-arzUO zUXy)z3HdGkx{T|yZpgl+|IKJ4{?Fy-*t)I9S`5o8VYU^*#ul$U)Kh2WLDm((HZj9= z+_0WEG0Q_xmVJ26En$2|hwR(MX+tm#Hq7^2fZn|Uavw3vrkp0Pd0o(Jf7EAQ<%17R zDY*jptrs`VW(2TWi(!3QnA!Egv`t@I)rOe1HbolRhHqryrt5VdGfc+~kGlipUS@`6 z;D&PVFw<@RSpds{ABk|&<&I&d%Y|2AeR356tS*3c1u%IpOP707fZPsd+LmVm*ee0- z{Q!Lq{!$5>E_X-(%L`yrm}#F@1+YeD`kd)z#!WzNbUCvz#w23+Miy>jAExbOM&qwL zF2fi`qd$o|pMitYoDX2M3xz^|>)#I#IP@VXJ!w2X%N?KmEO)$mmOEaa<&K9(yWUe= zjE!HhB+=N_(h2t?_3iD6j`7W{4J|7h6L2&iA^Y!n6#Y-uDn_@r)OW#0xmKi7-_`_A zx;q<}k8gz!b*)N_pO{~mKPi9m_|7$*9c^u0<5zZi4ydp1XlR0m+%3(mE4#;G&c#cb zyE@@LF1QE8i>~}8bU()MHlovuf?M+&92k``4R1ufB)nJmV)%hLh{3ppl9-KD!tJ|g z#Qp@YglF;)kADIciVn>h8a*t1Ry34;NjMF9LbAYfPAEDMB%qsjLkfV7_~7Jie_dVk{5*$fv(h7fI)7HQe|qGq(5z^` zNZ(n}L6J2dltssZw+5z1p1L4oN_u1mn9(mia&-uDWt>7;FmFH!cR>mLvJMI7_?*0x z%Kl4w5(71;Bf%M(jz}Za8YzfRdir^bi`aR80)oh1LoNV z6@Z3#6O8Z|^)?ihoAoiaXLLw<1s(gt5n3>so<2Jotq92UF=QH;H7t54$Zv=aDnluM zSJ@E$vaWI^q-JJ)0uEXSeoT+t5QZ9jKRO_C3DgLx0*2SkiVjVW95pLC7>vmTV+KX` zLp_gzN&*;Q*wK|xf3V%e`d3DCXGi-YWWkVrN< zX;w6s>wOp;b0hx&_5e+vogO)DeR?DxTX`R}W;8MmzN?uY`QAEm=g-03v`9NP`Hz4= z4R(iTg)@9@`4ZGKn)QR|kc?9T3j2)|7P%|DKETs|fZTlp`^bls5?LJz$n|%VwjwBP zV+4C0bc)BLnUUXxGNwfPZit359t==(y%F7#B$^o+0C}PtqkW-5nHgV8kG!^)PV@&O zv*7(Md%V~QI{IcsG9Ql)>cNsSKLSUsU5|bChY@geML?csBcZIwBWuHXA#nXmAk`Po zwSJ}0p|JsOhw{dxNA^O(fH~2A84pH>ZH(rg79BPRQ?G^8VUhPBaZLJ!(abr~!Ly^- zmRAFZvw2?xPUFpBKvsI>0}z57SFW8E9^y0nb1*#hK({IF%Tm7ysr|EdM@PXh`0wYf z2S?wSMtynEdKfn@gznr2c25u^@= zAviQU;FNqG5`(+bZzv_Q8cpl}0km&GSAHL4hSS*pctGkWkeb?IJ<%`Adl{r+-r;aI zMuW!6Ei4c`?cDOE%C|!*R@&djkEBd_CS}TtkP^+hB;%BTj{D}9q`m(oX`ez`YS-P6 zj;WDG7%wAP;Gf9QjQau#za7M)SukL}w&wBl$i_b5u`uX=+C2+`>;Hd026Xi+`mj6x zqZ{1ufpN!`;EoT#9si#n1KhD6+=0Ua&TNr>Fti59Tm`FV^d@r`$PCXq#OTQh?1(?o zA_D?N-T;xIS&=``aI-Z7Ou89@aM^TU=mY5G-|zDQ4$L>M&X^L;^^MHWW>V%)SK(N7 zc_w6j2!d|ryE7>B{i^~qe?Kb}Jv7zu_+vd$>1P_55`{I;yNc2#;Wb3(acTJjPhuoifH;J(c>$l1t2kXR&+L84Z&r- zxy8t;N{?I&%JR}9f6ZPW&6tawc;M{l2#|FmJy=Yn2ksrivmo*~UbtNdF)XVuT-XmQ zi)PKnyQ6_+lw%kOf|B&7qL~%ZjM-(;!!|_w(7n@NI@Uw3$mNh3Ps0IlwGU3lTO#um z#J^t)i*}?r|M`WTQbwyA6xrB$h5q1~UJ*-5+eh*ZNem-*5pVSI<;0izcmeSyAOD!j zJ;%p)6L0bHZxC6Z!}xm3nVX32ff5=i4XJuht42QZ{{VX9YK6(62r*5 z!H~;lycyn549~$ zzex6+=HoXLFZ1yx;^jU*k@zeh|D49#**^Y#lBdL^w9m-SiX?`Shl$Ve@zuoV`uG&$ zl|CLKUghJ@kv;Q#{CeW<+x2ex65{jSxCCHzSJ-MK>K^w~RTsE%30y+*v=c?&E)>BG2&gpAbLO$FC-SmX9wcezuPvL%hz%KOjHU`}jPP zCu5V+MiB3p#3T~I9|{7t2wVXLZ4q3aF<^_xk7QO_#PN?mC=zjhtxC=SKT9M7jz!Fi zWWKbBuAnXA_~(6;iISz>oJa1QGWyg_4saX7ROTNb>&q9fcx}e;zm7KaU&k zpT`aN-`5!KpWhAl-|raipZ5*-&-;e^=Y7Nd^SZg@E!d|SksN2KaU%E|2%HEe;zm7KaU&kpT`aN&*O&s=W)aR z^SI&udE9XSJZ`vuzBb%HUmNb9uMPLl*M|G&Ys3BXwc-Bx+Hn7TZFn6Xd|Slv&(|mv zas1B*3~%)5FnnnW-jsr$lY+OT;H@cmdkWr}g0D=$&-L-`a7i&J?D=yHOI!t)CWFFW zy9{CeMhLmrE^?)E4{`54QRMH2OOQcf?|MK+oEI~Yd;J`uwEYM!K?a5EIOhFb%^K1# z)_Hs!$$RIK=ovuzb9{P!3}jH)JFi8)3@S1x?41|FUm^RwaYHy-J}B&6|8#LlSCc*U zZn^R|m?x1xXSiJSlvBODc~kuM7Z4Z}_Qn&D$4>@UMgM2%DDRE8qW=TZ<6SR_{@Y02o7d#;_tsOtn#84fe=oX(>< zpFv~~B=XkI$6Khqjuq_w{pB@e&oM3+J+nx^H!lc3kMtbp%1eLvF|~WS%cZ_s$R6)H zQ1px?J>K=C@X1u)ELV^CVHx!YZ=4tT!^nQ|iuqeb%#44dIw)M=>KV(SMO3bL-6i(F zOzl3}mCxf)6C4MHz3Y7WJLh*vev~UOc0Nt|4|RDNhyFtSM@AR#Z^56UdU@9~VrL`y zv((ii`mZ4UBIPac@d3%tbmc*ewg&P~p39}aL#Tbd>jaT+CjH}FdC9q*^q09@+IJoK zIp%WF^9i-%NSANr(3!-&>jbISgOENb>|G}a$MOe-y?I&69Y=oi=65N#6as_7-t{o% z$L%|0r;HZf6NH)6jwK|6yE+c#QhQC~n8)+T593`f<>H612Ek7)vI+kI=?7)J#rXIj z*$Iif#rQao`~y4QVtkxO_KQ}ppC3)~-hJE?ERXBLiw_ymp#%0oygdcSEBPS#S5xrk zQX+O?2YNJR~e>csvpQ2l2C@-v)7Te;}6@$8jPPg?JmoN96MDFGNL(u-eSqa@IqTV zAEmy+yP1oBq&?PJ^1?S*@_4}Lz>*hUZ0VOPB)N|i`-RJgBSgPk(Uw{Ig;!bnWxS}d140b$|NuSNbGmMgO4g-bsYd6~aTEP3J5ZX&;qKe zKau@XYsm|*V=nTuS-#Pd7v5sYU(WG%OI~=lC4W1|*IM$zH(2sJIljq~7rxn&f12Z4 zEP3HKS@JJ&e5)lde7hz89>?#qd6JIC$uU${N~f0yO$@n5(-{y)p|_V_Q{9{*oqd3*d9Zjb-}#`5;~FWesg|HAS$ ze3bE1xIO;U7oVU_?D1c?J^tf;DQ@=oFI?JL{9nxS-IhJV?eV{sDkPBMp*K~ZF^*#x9zzlg*_r~+avO} zJ=dkMN4V%g|2)h#<3aSGA2g4#jQCUR8N*!sCS2?PF3aFS>(@NSG6$+(^oab+T;E*Q zBlZZNqV(_NFdj-cjPjaSF&F*Mv;G<-zXQU;|10)Jh|B=gWvUmo|w_DtN zSle;BEp9%h?KnLaH=oh=o+n5@5&Jh=^5&D;@OziVWnGS~7N5j+ZnyY3%y(EEe@Db^ zmpQoo_EhG(Ek1+!9*fUn{({9TnZIK38s>W~eme7aEFNdR&*I{@{T7#Ym+Lz5v$VTh z*9jLrIXvdrJlEpVj&l7b^3q;xj_c2Mwm-wN^D^c+7XLXvP|LOW^DG~;_#c_)SzPK> zVDY{@02f<4pLvPJ*D)`%crEiPi=VOpuO1s6s&*gSo{7vRP z77w#Mn=CH=*=+HnSpEi!Z(+XG;`qgB+_sy8+wOnncHCj{hgp7?#eczkx5eLMzQ^Jj ztp5dz&u0FL#pQ$1do6w`%fDms` zpUme6@+PHcZ3_OQ6g-2^4_nX4iZ?6$*DEg1kTCfT#g{Ajqq(1={uagY?}Bi%c`moV z&CgE3A60yXQAzv3eEo%bzOHyn3jVO-9ZG(G3VsTAEYz>%H>BV{RlHN_&*2{?P><%P zr{K4y;4doPrS#`!nF#9F{OlBbTMGX76x_VOX4+BfH}BW@`4fFTdsZqtqkN-_cCJ!< zuHvf|-;#pAmV(FndF6I1J_$DR)EyXWYJbRF* zNApt^zf8&Bl7jE&8(pl|&aiGu9if2-ncif>hXm*Tf69^xM^QP1s)&q~2JD}INPe>DX^ z;s_&z`tMZoO^V;G_(O_+NAbU=;3Y95g!=DS@|P<9fZ{JI{-ENyqf7+#XnuAIzAXiR zHwEt*9jt%ck->cMm|)J+yAuXGA2lMh=V6}sV~X?e;PM5WCV#PsdLCEud|J5j@@(s9 zmO=Sl5H8^OM8&aOxh_1>;`qD@w^Pl*)i2NSOD!(X*=Jk)bk;M^;_@7Pk;UbD^el^C z&3YOvzKwaa#dk4pv-mHW%iN9rK|j33{5(tkW9AoHJd3Y)W$q9?!ZPK;dZMzxc*?b)1#@}!D_r!Bvh=*g^74D5$bZCqoFyOO`<96o&t)#ZON*Xk znV)LOpTxY<;`8{rf1$-^GC$kmvWDzA7MJHLt1RBY<*v85JfFGJ;&-t8w=6E}uijtTz_ebJK^uiydurxx$e_5HQQk7oXs#kWOGxqr6!WS0M{#qZ&A<@*A}l}{(FlrV!qGfOPK%N z;vLMh`1}_8H!+`JaeV&-w_=Nb%)G?n(!LcIm-9~6xt4Oj#qA=$lL(jdPM-S;m-9}> zQQ_a@{=dm8SI+A#7Qc?=w_5x;=J#2=Ki7Ac#pV2c#^SXs|ANI=Gk@LU7chUv;`C)$ z@V|`5QeQcL<<)fI^c`rB&t|_0-^==CoE9$6SLM02a9Dkmwn>(r^O%3l;@df1Zt;gX zzQE$6SdWY=Qtk-m9hUqM=I2`cQI20?acTG4EuO)8?y>l%92a}V9(-Q~H#rL5!~8i* z&x;&?)#C4Rd@PqQdR}KPYk>>zV7d90{8EmeX>oaOxXj|>2YmkvH_?9v$1k-wEE7eW zoKGU3&-_+P{sfNSXYr{V|J347aa@*25d9A_m*?@qZ)PrQj0>0f?kMip!owVw=iU1&lf|Vz*IIle#~-n{*zrS) z|CHl%0E`>fMBE=RF{3G)OW(Vitrf2XBqMW#tSUvacko*AuI9Lp8`S6lk| z@t||B;ti_YA1FPjKMm}{O+ODudC~KGrKgc3&F(*y9<=9tw*NE5QNLUt%Tgn@e+Fg5y&a$8z7{dX*}!{Z_*q%hmd&9Yp_9uFskjdM;LamMS~1 zvE*;(_$`W~ofG)_Nz$cUY2OExJlemOpHn}sIO_Qc>v>XfluzgQ^L)hmqMb9~KW@KE z!T(d~LH&PY{eM^T%SeOSja0u!AeVM5P`pXWpTb<~yMy(XD~{#n^YzLc#j##8@6;-e z@?9)%*7@<~ql?*Z%PjfFS$?_Vs9&xRS1FGA<$B1hpXTY8`RrmPk9w}+a?N^x=Jyx$ zLlx?RZHp!UL+)?iVvg;F^0g!lc3JYzvit*zngglbM#L$+kywPexPU16Wp)r zl^$%ziF{pT)r5(F0{kdGmg%*!7|Ayk{FvG)*s$A?3&$2z+6i0imVtckLj`Cv9 z_bh%r_p2W=M?WkFdD(tp$;)~E8^y8QUvar_Dz3|Y-{KFk|My#5?q4GOAXwU6`g4}W zrQZ&+_%B(%Sx?ey7twz-%VT|8q_S`@3#Zg|y^LC5h#O=76xzuYbwK$;d;-4{J%UsTjx455QqvThxEFNyN)3AJ0+x<+lvsH4 z=Gb0X-?8u?w}AuA5qXyh(*6kM;s>+-tm7Q7IF|cUE_b}*+7Blyj`C(*X82uOag-N7 z%vK!b&HCf;1y{wjAI?-9Zl&|AyiyFW28!DUR}Te%;Jm{ND&^xIM18{8o;9kEQ2pT;G=!$8vYFov$d4<;wW; z2c>@%D(3A&OJ43{zfc_Y|DE+m_zxzepNRe(=2)-Qq8yGRE%`dO|2V}_|4bfG@)g(i zpQJd-U(WKUD30=S-#trll$Yzdxr*y{Im6;I?k#05^^)^weG0Ds-VFUv0{?N_VaYEx z*!hvgyP3ai@ynV2L2;4Aqz{=(yL7Ujzfc_gkjvLek-{g*1P^pxm? zt-r|PQm?7ZvE22l+)7J+D3^Pd#l>&U7MJsPwWXh{?`&55B314!mYx`wd!NOn++7xz za(`m!mvY}!e1j_YPnMpsT<+g2F6H(aW-?2=NV!9qqd!rk#j4yXmY!lRw@mRz zK>iwT-wMTb`_?Ls@~^Y}V#QJZRqp@iFh@Jlo)PdLx62g2#30(=VCk98c5YMr5s*BJ zCxGpWYdd!;j`FQ6ze{m#=TDfUooJ8P`EQDEBn!>%BTG*u+vyx)(y_fBf#9QDZkpoS z&K$*2-r?)2A&P4|M>9t|(H^mLn&O*K4{r;U9@JmX`s0eD{s}y9wpd*H;Tns7jpZ+~ zxcq&~H!Uu|SKZ1S?Y~rvgya2|{F&^}#}r5VzsdIhKymHQ=Tqo^*Wzhh_TQ8q)St%J zL+L!RqMetqEFOk1m-Eqlhskkbild$rSkD;6(azWTyeLo{<*#G;BE?Z&{5F+2+9TI` zknB`i@^XK1rsAl79}f_5#kD=l6-Rj)m)jKA_N--&_FRdE@OGIce-pRkb&8|@d)V*a zQe4|}m*Ob@0n6X3xVGm}=4j7VVhkLAY{{GNn!s}{#ZmuJ9RHQ#+MeGjj`FP>|AXS% zo)4I#J)4z1&Ttcv{_{NhCtGpUe;en|Q5^Nl`8YyxlpoCTnBpie{bw9=wC8HzvYl+n z%kLJ#u~i8;g&DJh**g@gjpAhs!}d z*9e1Sf9BFp`tbeip^BrOk8pgX;%KMT>o~rTufw@sH&|TmJMOZ$Jn#Ch(toYe|3gcDD(nB5#l=6bT3q!1yQQC} zapzOTuT$mrVZTbf>bcy37MF65u=pQ&UKq<9{eQjEf089Hzqid)9NYIoj?YpY+gJR# zh&k%NLFrFe@|UpvZ59{%*IE31w*NAv|3;<%221{C*1t`0wEtf?zFl$MpTEZ(?f;h2 z|Fk8)ll9B{W!NsLKZh@vUb5uHKYNw_Z!7(Ow&b5<{eM*)^`FlAKUZA)KbzB~pM1c6 zllR@k&f8gTgeCtG%OA@e{cw}A^8`y?evh24INJFuj-RHuwzGyg>c3g(Ut-CB#C~Y8 zxb%~AE&d7HzftMGMd`oRlJCRMC2qC2wAcL>7yXYb{qoKZ7PH5aAIbV(Rvi5^@^E9+ zD~juW_y?tbs}ZIBhnD;V*8hd#sDByjkML3YgVZaBIr{%LrC;n4`7+jjoYI5(cW^vk zaoxTrEB&`C{pFVYGS8=DnJdFlVFm}7nKQ1)!F=1+Mb7)qdnV{Jx^Kk8`z%bEiV24H%Y?C;{Tg0F81G}^xvcOKWfQ;!uo$`aq-VD zEH2Nn->|s6@9-{jY?pggx%(~oOdco0>?b+jrCvD}mvTp1T*^J3IhOk!RqlzFd@h$e zRdH;udpKUIIJVbcS$>}4DE|S+7buSMpRs&{#pSxIojKZhAIQsgz9oM=>$yb9-!H;& z++xX3Vfn3!qn*VulWCjcx?T@kTHs^{27@rzno{H?jOQ#Zf+k<>xAn@^7(xwc;o*e=l;j;waxe8g{TPiP6Ee zKcDrtDvt6;9ckn`6i5BiKhIYj<@@rD(0avDzJT?Alex5)Je%8U$-l+z^@zofU_DP+ zyf5?TEG~AwX7L=BcX&g4S|FUqakbqI-r5wh?4Hg$Wwkp1i!+6+kanZj+aj7GsT^8@+_-@6UIgE!r7N5fL7Zg8-!+3bb z;<+5(tN3ybUI%Q22*Xj*Q66~>r|EUTT9v$Be-F9% zQ?CQorsVTLFK(zGxyTnN-cAx`S8Q>SFH!vKO1{kEVtP{{ES|w> zyA{{J$L+EBSeAc5as9j4D;AgYd9UJ^D|_CtxXABQ{7NOi-{J+57BK#d?Za;a}j$?M-u@+>a$1&Zt6DP(;B)Q`N5%Pvv!*D%9FnZ@fktxEAN z%bYFGR^W_akfxajXuTtBbgWO2D3*sS;sO8*TO&*rqP zir=W@w_9A~cPOr(5AU+L*uPuxZ!7(KEH3_eLGhcE{3{k0{d*O^S;@a+agpDr_$^9) zzr{sf-si)1zg5ZWbvTiWd`_AXLiw#qUe-MjF7h!Yf18rev$)6?D1N(=FSfY&vqbSb zlzf@RMZQY$ZAxC&vqAfji+r7u*U#CSEH3u9E3TiLbz5BIdlc8t!8Tc3X_v)Cez)TKxzHYq%Y65O;`b^0U$HnxoxO_d=QHnEd<^T_ zr}zU(|9*>$f1Ich!gha9$;&zx!sUA;BUlF4i>g!d1&Y@zK11;(iq|UMpm>Yojf(du zo={xIaI{C?4@%!auJ8Ngx*K_u((}5~ukYjbE3WU?WSu$GqwmXN5XTL<)CJ=uitGEV zI>q(sCc*1FV}~tU*AW_x=G0O{eoQAA=mc>vJMjRwMxHScOlo;`EM(G^!2=4 zFQL4?ZkP4mkoPG4F`i$LU#NJI;_DSJQ~V;u7c0I&@pi>8R{V0s_4TmK?`V&{?v-_f zkZ)3YWd232uVdd=`t|jylV&ob{N+l|5XJTNXP)BvI&+HRo0Xm_#r1V#qvHDdut#xy z9e9)CGFD(QI~3Q~bR#`@~(wD*;~z8;ft73KAHm#i~{Twh=1@i>fJUq?+* z{3h)m#r1VjqvHDdN7lbb{rWoRawWf2>6iDOQT{f?cPjbY72l)y9g4rM_%_A&DSoHo zY3U|{PW&IrFdcNMQ^yqnc zo8o%@-KDsmXG1*x;5=Jrs!sdSiq|V%qWBWUS1I10_ydYJDlY3>Vz~*$`||mYe5v9q z6xZ|VM#c4fir-Ji4fW{x^cX&0kn8z$j^cVgmG!$&UeBkpZWVGppI*)V3b~$7zoWRG zPya=6J)izwaXp{PIs~X+&!^SgzR2}_dWqtCK9%=qQC`od$M*63rsvbs6xZ|Vor>%E z^l8QQe7aY0J)iznaXp`o%<$~d^XU}D^?Z7U;(9*qR$R}gvd#zkp~nZ&th8@c z{5HieSNwLxA5i=b#a~c-o8s>(ey8H{J23XEyA(fafQcZ#Tk+|NZ&$od@p}~SQC!cb zTNT&y>Envur}Vt6`2C9iUGWDLKP1OQ(EbM%cRIT|S{vHeIQd#ak1ro&1hOOMSA20E{ReubotIqRG^lSh8|iyne}& zj>IZcet;ES%_|aZE4x$*n&GEt^)i)02BK(vOM7d)rMXk9sBdUUv;$~pTd^Y1s#8|i zCq+@C@k6{L(Ydlki#D{iwk8@h5zn=?cQv=Qc3L+3so3mK!E*f+ zTV+Ql#=EhdTiV)|uWU~$x4Cs`o07#Q>TFus)!4SWRbjLs0DCC8$8kG#g4?CA`mTDc zZhl8wett#g>gKM7ru?q@B`pc+D5BSa2r|W)T>H>1O*7+P|7w2;T2z-fqRDYzg20D5Z3~&lJ)py3*6RnNO)K9R_ zu55=Bcd5!uI#RTH- zo9dS*9CuR1QQP(rni|B3(X47xUDek4xT3957fb^$jB_gzT}^F`$|A{z#`qGc)UxNc%$CPoO>QAX71AqWxsrPojMh z?I+T{koFU34?DcV8WDj0%e6gWTpLN z+E1c=5$z|^zL544%pSU%89|}fOvncY_7{*Q*n=k8Pp17O+85D&BJB%lKY{iI`gY+T z4c`a%_xy+}Nkzu7a6|`~* zvNAzoQ2rcfSKOpL6Z6};1QLSs=SqIIBUS#hAR(y!CH!zD#`&@S1L42eBlUVLh5zMu z$Qmh_k9Ju*Q~1A*AL8it9~@Br>J;V6`rEzr-w9B^ApdRPLAAI1?}JT2`L`Tk{yS5g zzuP!}Z~i+uMSl4^qaOCV9BlvNI{ZQQce7xbWaOirKbFG(yIJswUh@AM=C7dg*YfWk z(%(dlT|RzKAt?Wb1I&->SO(>n-y^q5!F;sKzcPjY<@dne>|dQCzkI)=xBPFXnE$5m zgx*{K{dtP~6`Vh>m-^oU&I|Hi7v~?+Oa9Ij`Q^JHz14quiv04sXm8~|l_J0VerjDl z`NqmCQsm#k_3zF8vr^=j-)VcZ{{|=kRQRsno;yJQuS}7D?*ZnYmm>d12bh0jiu@UH zUgDN#4({GQ{~A){$Lkv0ddq)miu|<)n16JN`M-zrgZiY+w*Lny&VTt%+1RAq{<(S= zh{Rih|+~n`MP0U|bH{=g0zgT{3;eLSS7s7wL z{2RG^s7BIO0rLWGUFP8K(N?{k4&!`~{ku7TZ}!(f{y_U5;!>3TlK|QFpUdUj_SfRY zDr~*kznJUK#h6U6e~$BGo9WHAbrEE=8Oj$wYI1Gn%;^7O_;1@kF@^s=JHYbsds#u{ z?+GaXq=53DOi}(=9(a4}|Bt08zjl|Yc%3=W-{4INDE~q*KB)iH9$@)vA%9T)cLkJx zNOt-fbypWl#hRx z7*v1x4uaTgYUB6y*(vf@@bBn3l97*gTjAdo29>{<^Y>Q%Cn?&mk@L$qD`wc`-=3m; z`A!2jgJk!$|5GXQZ{qTM%l{&b^Fj6Ba)9-}3M>oCFMkiwoBy9mk^jB}EWdw>`-hze zm><6%7G(bu2bh0Git?X1!2HLg$S><{^w$5LOJV=Z2Uz}s6z%^y=kKlk?n%*p?;l|P zq2T-=|9^IX`KP5Azq0x7Pa&%bDVKL?Z>~v3u^x!E??wXjjyb4q{zRC^UM1( zsq$X}`Gf4=!S;)v(f;}X`|&$oXg^-t>+Ko-d#U63K0?w^7B@M*0vFC0hHj9w?HgvI zu_WsGPw-2SKgj+)Y=0dKqWz8VU;HWc`VF_gUB0a6D{`#H%`fp^r)dAY?;D9S7R2(G z!hgGb{JvjM{qqhn8G9@L7RVn||Mr0Ln*z!|j;~+r`j>F|dD2kE9M^u1I{01Mpz?Qd z`Q5A->wiu_`Jbhze-l@{xAOmzqW%SVVF8;izXjs9|G&=X4+*Q?=HVu?W{iRmwA|se zq&R=J|H$N%`%tWZEBv?1KQBNh=FG&K1=!>}tB&k}k)Srkc?2VnWQ(wts1g z^QY-K&UdOgqW$>y=eGSHfOW0=S(3*QEFb@#-7X*B zTR=$}XQix@mzhu@=NB&J%kl4!5R`uf|IzzG$;d~^CrA9gxrDXo)0|&34BN6R`1%W~ zk+kjM{I9_Ir8lX+uqMbK=)XfvNmV@lqW`+#zvP#3rJTzbeRA9?e@u@*`l!vee@2S( zca8Fwe=g{;%ijs-k6m{xZtIn%&^>$}qBa~-?EKyz({$!H6spU*ptNFUIONqR>I5YSoDyfDk=zWCt9M7@zlP)g_Apez^94ly zuWb=)@(Ek_U{ZHz9a^GWymk&M_PLfEG6X{<*7*QBb z?zE$wa`?S8It&g*5Pl;V9E$Ys+ZRRPLo@wcdHjY%#u$j6(zh=JGY3%CELR|k0)2;u z$_F0<1!YGmxgQR!{auYP%nukE!t|VBpvjamFb(oZfrIjZ<7WZ~AB}!E1$3H$D}#J* z->7)La)$>L3AJHDWK;wS1UJJ%y%f!)FvguUyv&X^QyApU4{14}cW5BI4shsQ#|!@{ zjl%eJ~6*o5Z|BU z$^13f3x9^cmcqIQDF1n07KWe1uoE($r~WNQ!l7bH`7=h+LM0SID?{m_GKvhxNJglN zBFAAQD`dVueG*2pLv>DO1K8IWYn$DQ?#;yC*`nuT5Vp`v(2Z+5JpuCY%>wuzddk#= zt|xwI>O%Y(Q(|Ndzn>A^M$J!gJ-!S~!kKQAW!uNeMi358F_ zTD?@}mHR6*Lp7kxzt(#E)jBWyS|f$=H{HcfmQWjujXvln3 zuLmQCgmRtC6Cq?;6>ZGMos&5i-~bMvku1;#(QIr+Clmi5B5e)qsEcQWGA~XNbuzDo zcyuf5a0{9D2y;RWUIi1TfaSISSwa4v$L~P*pk&Qlizc!!0zO+OsZnv)7)t8jGnP z-)2s9>fd*mwx#}hr|RE#tNwjYjP&686QS?qQ5e739J=51Z_@do>EG0MA1Wak>Z9K+ z^KAH@>E9&(Xbo}dyN}g6nK*W3_5-b%gJ73-2<*6ZqQ^oQx6qB5_!EnFDrZ+iG#X0*$QUI&OsCHXKdbd6^}yhIm$ zMAA>9^o-C&Ui!t##~ag}=vyNDHI`jVvJr@d&R4QMAS*AihUW~#YNUlr29X`K579nM zd-F9y^G%nilZh`?M`x3M(26nm;9cl4Du^23a#Ik6uQZKKC-r9NaQKVofb1(_PiF?7 z9@juT4F}20n#6ULur2)?MKl5aN3*CNFG7q z80|;Vel+cmr2QBNdpm9Fir`2*n`s=PD}p1{6+w{rQOV**^&);uviLE*h##9Qerzw| z`N`t>y@(eiix>1FUYIOi*o$~kvUpK1;**obC-)+Lac$Lcw^5u1+lJY-?Da=<3AS_!UbMja@CB@zovm?d^#UWF7S#YZfOx z#egyvV;PH+%UG<+SS)2MUb3>eg$njcii2sBi^i=gu6JrG=EF;*&G0HNzj0(S-i8o7z^>`;#VWw7|=KPA$IkI;XUzta1iR z8s@YwPpqL`97@Fqy#Y-DDvm-_9ECiMRkKS^7mbNk?Qu$ml1dj=#WBsHcd!9WFRiX| z*oV`nIt^Xj4!qQs=t#6Sz+1lbCK2?auC`8x>Or7kiB~)HSu4B(9w#Y$-H2b~q}Rse zMJi_QYok=*`8Ac*rTE%7xVaPGnRQ>!re;CS>ZK?Os&{1D>*0+!$Gj0r>K2w(m(M&s zUNyCP>Kxap8k*PSy1Fq@-fik=sb7=maLj9vP+UVB_H$$?Rb4v0vU*0mV(RIo)$qnU zzQ=41&YbzD#b;JjE{ZRhTRykErgVl!;FZhDYA;${I=A$+%9`@2HKiI(ol!pbG!HDQ zF0V-fGePbAGOc%h4XVJG{=hVRe^9?&4aQbtok(boIMk8%-RWJz_5{=vPepMz`(b|R z{Q2dTbEVLaMJ1bgRwa1 zx>PE8or2VNktM&v=$?C+WL^%(5Vkzq-D(2zJ|?M!H`U-hKMdkaYaGPa;IOmc+tiYj zY^zXHM;uA!*Tkol&V)Wm;|jzoXFD@EVS07EthAz{GR_^Ux^&)x()l$a3CZ)T7qX0k zbar_vFiK6dV7?NzP2E$MbA zF=kPGdd1utQz^F;fH)j@GCtFcM0{cO%+r;aRotTZ+|t^bcvW>}O{J2uZJ57^eX1%t zzgpWR-ghN~y${KL?*r78fv8;>mWb=(S(ElNnxwn}QJ*3sk>nK+^E&}mCAAEI0Ivi$ ztC)+YxYvJ>CaYZJsiYwRQfJIBn>xGH3=VWU@I--gqKt-S`iak6Fn78Z;W2_IC+Hcg zCd3PaCS8*>A$3x~L=7X>s);Fbz$n!LXKd2ME@h-lDomX#Ade|NAOTMRb`iZ7E7kV1 z2?26i$`qjq%~cx6lx%B~I9<4)MM)0C^UB{8Os!U6nw&qt_jIl%xx>{LL@j5tY_ep4 zi>Vaj0M1g#Rdq{CO67?5q`6??1j~Q$P1ygA3uCwlr>9DA44qr;gw~D>9hQ9rG5M`g z9`U2xSiWf2tR#Td1hA$6hQDv(ruE?ua=2->&7dT;95+_Wtd)*V^Mb=bmA2=i*5};dk?6 z`A`j+5yPS)Mnpx7jEWc)6>(Tp#Mr2aaZwS6M@1YF6>&^d#Bos(pO1>z=0(Lk8X5Cs zWX!WFM%pQRk8{K3cz;emXBCOp=ziuw5=`%(AbxN zmH6B&?&flwpT$q3d@ji1>xt9Nw2ZhG;&A)exJ!xii*PD#Iq?CCIPW~-2WIi3i4V@= z!-x;b;@yc4&EmVL9)@S}lS!T;Gve^uHhA=q!7wn2I6Qwht~YUh@mj^XIXU6Uy>V}n zN%Mjb$UH+F-aatyZsJ9T!di3iY{d7brMX-$^npivz88!~xxRRtZQ|nYiJYORC%b>5P@HCa$Px#h-9MdtcK>udyMH>K-9H`A?w^il9|s)I zJ`OmZeH?H+`#9iu_Hn@R?Bjsr!*Q48;;NtP$ha5u=S&{-w@e=N=S&{-t4tn@(@Y+W zmrNe?|4bhA=S&{-&rBYS_e>s)>r5Vuqf8!*(@Y+WmrOoI2h;wz7mSxQ1W#NY-!l1h z9ZdV9pdx7Os&CVnIKV-yY}q$b;j*@ZXYr&<}<8BOZ(k;rQ)( zfqGd__7sP_`F8mv$2M%UN&&MPm zj8l<6l6Y`@5Pm=D364v`dsBXb@hf~G=?RV}!g1}bg4j^WPWm_J7|<`r*mNX#sz84j z2k}t8I)Wb^p}#yr|2q+SCPnZABlKg-hUNd)5&WEp{7j7C_&YsJ|I`TijS=#t5&6ft z<-_#j^+*_B8^HmS>jQS?N&xn7S|*3zylKwZL;3j|iza}hy#d|6hUZePtM9_1?~0DCR3 zxrm^Al?05u=Jc}z;_)WdJS8t)6_;cW^0NiP zew5-DC|;uYg^Ev9yiM_x;ukAkruZ7grRiu}upSFsqm6{n{#FT zH|j@HVm+^ufYI|6#dSZtL~-2@zpA)+QU7WQz+SiGD#f+_vlNG)Yvge4_-e)FdIWim z;`BBhgoVp7x-ZKhuT}B`6-PZ=IXqJFCG5wY{DQ!8eO~dS*)MkA=S!`rhQ}ctI_blx zN1r#PETU%_SJ;!*7Ky{_ws@EMZ>o-|E=NAGJn@_oa+PK$8MLdpWiW;`j&e5BlBLIFX8yjCAz_e zNeu?4I?pGQv-%8(P_{kjp zzTuS|zSr=XaNUpYF~d({{+!`!IQ(nFOXE(@9}Jf@*giBI->^rw&+zNmZg<{GJK+Zn)vgn2$AlEpwcU5S{4R$Kh#)U&-srI<9dIbmt%kqF@>>o6E%R-L;~WL(WG!Z?pBCo7F!ItLWDRAJ|0&Dk z?^$%hA7BnQ2Qv7D%nva9GUfvfznb~MhW~&${$4{Tc4eGgZ}<_Mzi%6U2=h&bzs>sZ zHeBlAdBX>@o|g^p!F-3|e`fvf8;4u-e z`dbW_xEz0E+(DZO*lZ|C;638=mC$z1DD9 zqwXfd6D)t1;Wf_{HKOXeaf1KQa`=8e&00mKJ#}CKa2H$Z1`^Gd3-@B z`v1VZpW$C-KG^Upm=8DnTg(qJ{71~k8vZ!*BMko~^HRf0xx6xmspS7i<`qVM1oJAx z$1ra&d>nIpo}$OsaK5hlqT#c-e%)7$!FW84x%-GP;C0O1*Np*}{<_NOzn365Z$>-kG?OBb8Vr+a-HbBw7tsc z*}(d5GW-w@e_!d5dxNOxZpEi5{f`+vx3T_b4WG>6UnxEMzV};-mnr>!F?zPL{=J6F z+NE7N9_vBhC-0;9bfteNbLl^ib9jv5XRtjte}b!LeP4aD(mzA#cM~ZDoz1_z8f1>p0 z`~1%-K3nO3&FKG>!#fSXm-X*bdh~OFzbUStV(0UtXvt?Dhx-}+6zd<(9Q#j|%I9H5 z{xz0ATFJ}3M3s!jqrN}MhlwP9l1U}%P~Z_$X6--`gmJ!xX7SYN zz2f@#cAeoOf3xCJCx|v0F7kINKAruzyU%cu-=_Es_T%m;!$tmi#b>e~ciRmY`5lVS zVn6P78ZPo5D6Yrv9>YZ*ULGTd?XJh8yuU77x(MAE*fU-!cYl)Ub5(k>{k`_)@YzKs32llnw?-B0o%j1IZ( z4@t#!yUYE4l%M62(zZ;=>vmkMxNa|8Lkk_Ymu{CKitBcnsCbG}x{cg#M?I4i|B{l| z?Q)Ugx?R4hxNeub71!voa*WGJuO zrB2D~b~#^h-7eoyT(^sSm`vX!<2MZ}mXmiie$C8&UM4tmv1VC5nbY8Bo0;Ec?ti^u zPUb!k6=T7-)jBaP8qD$;UzbAm^e3XlX31MlqQ5hR6qr%>xu~|`mhPlAY18X;a{A!& zR{H)LRHVOr6~E-4BAi-Uo-zA_FBKW~?UsrT|1>O1AoF{$tZ4fYS*AedhjwPoQTV7Y z^E0r_wDjFt2Lc^LkBc^7zX!{-EuWexs=mm}E(d>Pro^Roqhg}Cd@4wv|4{#vubEw6 zT*}`zyM6{C=`-|wzw{FdaQC7Qqg~EuNnl>K8oQ3mL}hx?0~f{*jIve(rJifkXY`HY ztj@^Gg=QrU>6o}sarj4`p*hd~rV*`Y)2JLc;jHX~f(*9*FVp03Nw6*O?W?+xzkg1bN_d% z+GcfAHR6kvKT5Z27N?TiWB>Z4Avj59Fv^OP%1F`~D{@##*RoCoi?`z9ytT!+IB#vS zTAUY`-vvxtwfrtFunU;BYJpu`LKm=ILKhdw1#B0|#bs~-+huTZiCe&SiCbL07O-8u z78j_6+|xF5fm*=0<}5_g_8-3H>^*UO4?Wve@x{;8d6{u=d6nVDLkL-J2F?79prdkh z0Q?If@&3}w?-faA)0abH%TRXF7?(nR&)~gBETbH8sw4Y&y&YEm`$Ft@39-K=!hS8+Pe=CejIh5m#6I4_vGv~?VShy@?Kef( z?|+z6pxYmB9a;OkBJ9gMm>re>PZ9RZLhK(9VjrJ_gNm&2v(9BdeZPl;S#5m=qz`NV z)gkurD+^oxk_h|qd%UCa9~xnQV~BnHI>XwZA7TGyE^tToXGPfG9%8>wi2dFX_HXZ` z{rm{~dBskF?teug_HU1{e_to^~J^e{hKXS0d_vXD99B`(|O~-xFeg zNQnJMBkb?$qR|3gFUZ-}r@jRNu=jsLGj*k2T4e|U&}obwplA9fi| z-jnT>L4)I$V465t0&2gG?aOrrUVj_}|MvKIS%m#0W(r)r+oiXXUcgr%eOUe9%=YE} zAlg3|{w2NS3*WB^EB`vS-%V1b{X;|S zuZyt1v6J>Mim;zI4vc}*<;PQ!t^eEz`}cLyKE4kIe_1XWVjsJNwciacO2g{^sZQEY zK>9HI6GQAHvi5V~heMeC?VYsmL;5iL^Fr(&9%7%Sl?HCd|ISX@KR=@U^&$3;2(kZU zME&pSr2R)D?6-y3KPtq2X@vbeIIg1WaQsKuzb?c+ek)?zzb&Hu`*+g*nuzwlE5!b> zA@&b|A4OsPZ&WAk2Bkb=8v5(JU&VrW z{wsxlNiX@rl`F#f-#WH0a;zquUcyr&?5|_{Wh{vHr@_CqKLQvZYFN_kZf5(hWzcNd zZ$_k-_lPIsk8b6xt!p7JZ2UaW`7bGQi8259ywB#p5}4JADIV^DThB|HNE4)Ymcs1I z!^jdoF`)ff@Nexe2ZlQNaszzM{kEsu_m3#Q#RxBZ%+}wh_d7Qr9B#`opAU-D#tG|+&PC~BZu>R)5zobw1Yql@?WPjfv z=exsX%w)&=D~N^Je+nB5oVJhePg?sALHimLl&&6sEP?xge}JIfI{3Hg>FE^ARZR<) zC6mb#_!sB=Zkt}SY~qA*N0LD2*DPy8!|YPDPkAGu)%LD=Xw$B_{-(WgZ^N#*x7mxe zl|%GZAA*0I?`>)Iye)0Hsdgw|A@ZtR4_@m`weN`c+5CFEaI@#1@KT%SO~9~AH)J#V zcg>x&Y44gxH{x1oXye1~UOU>*`l~>Hw$34uIzQ~5Y7f(ymy>G8{N^Q6?U*05FS4M& zaPOK2Hhm2CcQ1@VS>sgJkK*yoyW_FVyW;-lZ$lZcjHTLJV1Ja?R(=4MRn-Gr*hS_O z>gb4%<3mQ*LmfQ=I?(nT@uJarT{$nlH{oN?I|}15PUkVRzNT#2y>K$*6U+EG)mz2B zeULA&eb2sq{r0YTaMMRnhFx=Gl>fZ^RC^KFcsS<2+va-}A3`~ffco4BcCa0H#EX=z zB5Ip;JyPv`x}uKBpexm$gtG2k^BA|$KVSdug+A23%RknyZUd}~9WieUwqs+^03>JR4Npt{>%yAUTZazXB*V!yz3l%-i>Kgdmnor4-os(J6lePkcRNRa`E1t*0MBP@lr`B`zXay_rAA4yn*7n zY{lxN#(1tSh$M!o#+9Jvyyb!&m>D%1y-^P*kK1hms5W&tz}-e zmJaj6iPKk@(1A;sm8BI+hDA7Qd`iTKbdvevos~u%mMGhBhpjAzCF#Ft_LJ#KnlIjq z)2Mbmd!Gpq`_enx`z1mKsT!~A(pr{gEB<@NYg<}zohZI8K%}Cs`ogwlwOn zKS&bkyD_h%!$EJ;bm~YUiP}8pI%7zN#28KkomIS&-%cEGrgG{a$vh_Movm9DZA}~Q za4c4_XhS+lhgPJ~gKpZP6;@6^AkYsrBIiQU@^_#3{ymWXJ&>rM*-`O-aUkXJh=PG6 z-aJO1Z6HbNzgtm$kR$Q-N+Y~yli_R|Nu(6Q_vVW?(1N!mGF-=6%CoiL{hJIIwy3sV zraCUmRObXMVkgw9+vEDci#G``)(<^hCa?!q?H$(#?~B2=jTq7Gs~7sdBi%2((D!2f zH%#siPo@F0-~lLc<>daDs7Em@%q@#~A2$G(^X} z+PKPhpK7%N@Zy3}(GSfXunr zLfGf{sW=5`>(kcFgBvG*4s8?eCS#WzPBV|FdukY&hGg&s5$IgB&7-Yb_OToJ-Lxb5 ziZOHzCl0FzK#Pe7EJtI3qgPRJ#Y&V9yE9!zAge!d_3=G;@J+Kyf;%_E`${hhU3|n+TrRvH8i)wBBcHIoDYDr=f&Yx5*#~F zK6W&fbr|_4ahWF}3(E621pMV+1^vUXh7BpbSv=nt53XoUeex0UJR_c$!ISp}Y{Yea z8v;YHhQwi>V_)o*QDMZQD-1MX8O7mgF4o$0gkOUN{%=%ZMje&M*2-YW;HIjpz>>c_ z2310}(nCB0z>|?X>`bw>T}g`aXSA+`_;dw1t$8pANxo1#L%@@*^}79QbzORn>e6$t z^Sa(W_s?L|dFSm;d*}ZZyso1!Kw0NKDd_$cLHBQV-G8N5fYAjwwrDIR@|@vwQIz}D zxd%acoV9bQixrFp&`%~IN=%`#UX{3!#y2KR+~meO`M;e*9FIqdTl2{Odq|(Strz)s z!=*~%d;Q6OIK1SX*pwvyHaKA>zCVimFQNYjCFCcacTOb#E!}|sFhzbWeBwuCfy~|W z0{^`g6cXVyX0u=lW zw*9*Dbz|a0D$BaW13_&(?8-vz_=qbDwZ-GA9iLF`_>?OPcAmu3qeu_6`!lW`W7rnY zx^^r^{|hOSsYCyZWr5vax^|?tetA*AU#SZGzp5oa^?_IG$xm(ln-zh~j#l!&iTdAI zO@2Br{jSX`_$!pVUoO644=ypC3g17`93*aag{Ka>$`u}mLSi+X6(>Tvep4jzEbd2N z3M?#liEFWUH$mT72A)2RnCfgvbrPM7lZl@0WQ-F?B;bOK+Uyw&^x>27b_^8xy(k9f z8%gx@`+EfsfX}riX0a!3yn+{CJCOZ21%wh%C)1BJV!VC_Kn0;o9783^OI#FG!&+Ao zYWGWWynaWE?C~snF3FyXb$p(ZZ3EfSPOaz9F8C6}_gg7xQ(WDbQd(-muer43|GKMg zs`~X%-QRftPIMvSFjnwcf-bo`+X5h4$fay@Drc~Ps66qbFks-qkgZ0A6?=b1-}Qc zDp5E1)!MTsZm3J(MLm_$D?nI)7g+~WQrJ8L|31F6;l*yjN^s`{@{U4^E_MqJ_#k*I zs#QTO#UV}uRX|v`co-7|t!;y-B8c6V*)_Ihc8$k^uJLHlHC}XG zT=|NpD!2dG>hw9&09x>YMGDH_(17adNXCcL32n$jd~tp*MaPJ$;gfRvS$l9nbITDIa0lJJ`A zTD_&!%Npuxy~ZXiK-vb$r4x~@+VRUO=QS@|Roz-Qv+isU*JJjoy%j6GhPuYnTkBn+ zu{g_F=Xlb2C>R5sMDs%!9Yf*0Dr)JblS(lqT0WuJV(R4~DOM-&m% z)gqjIiEE#tp#G3~Xb+|@@^D;wJQ>QANnUe9_1SgJUbCCn2&a^(tgeSGl&Gc&56T#g z>B>u|%q^crR5$;FL%4(u(_ZD534xq5zmvh*Sc(Z zUDL`|5BJ`RI>-v8aj}?)(v&V(Fn#VEtnFn>&#qh!i)V|!2DY6j$n(zxM=9ZUY zTY1fAxe`GG)HOG+T+v!rTiINVMaZUuA( zs>PE_%cq}sO69ys<&$P(PO_i}nqdSiZK_P?g3fhNF;s5MJ9()Ekp(kCkwpE<*4n1C z8cD{@XN8#N^`Us^LKLSbqQZHrc&;Fvkcz!}HY-e;J*k#ZS1r^OWs~MiT~Ib@W~plw zGQ~X!`>fQy>rIs>o-}8Q7U8zxzE<6^qOo#Cb5mQQ9ZQasp zsBD?=E2uYaaOn=z5tpo73Zn`J2-i^SYRM9|Fm?*-Lans-)OODqJ(!THiwZ{Rt!=woQu@}k98fzL> z*4B-s<5XjH16(4H#Y^O|nU~08)g|&+xkMfdSIoi1F^0x2Us6}w+Ry?Axat)v>Y9<^ zHTXYRt7LjbLv`!Yre?T%gh!VeI4l>}V;x}#&+RbZ7~DFbP*Za&#KF@b47r0$OCXGA zV-9*bF|RA6axUJ_Pvm#oo#^`GxrxCu6aC@i)ZF-KGZNi%lMg{RD_k)T=|MEoNTueMWBWWTxer#CMM?61~==R{Q5UnpjRQGQ2 zu6b`IdVt2RGvc?MKO>Q!8y|FGwjs#iLdxZO-_w$@q-;AgHL%Zv163{vcGgt3t94 zg-7#T_W18Z&A$rf6W#iRWbCcTnD;2l7f~AN$)WoVFj#WDKWBZ9&`blMUsf8oCKlcK z&WLm0X3Gk8LDXw_&~i8U0tmjJ6Q|p58T?7&Loyf!9w0t6i~o@L@GS1urh?IK+-fS9 zx&h4bZY>*n{E?BOo%F*EM&tfS9G-C)_anYsp8IH@h9NR^ncEe|9{(KRZr0rqP?>;_iV$2E#zy%kGC2 z&@KhBp#RV{4ahD5uFvx+O( z@=q%+>#!o)8^Psz9rfs=$JZc?4tam)rS0z`xU7w6k!0(PQJ|lvES#f>#e=LG`14J6Bd6Cr;T zAA+s?`Uw6~1n-7#AAqxZWNjnMTO#CT4HYZ@UWEJ*J_TC&@(8|Gae8yjW!rmJaeWoq zj}JhoUtfiOA%fo;!MXd;no>jAChp|;76bkIYN3E-grCG=IYuEL!3=jYc0~RjjvL8) zU8G9o^|} zmzF<^IlUhOaZ=v3%v+5770k~z{7&ZQ8~!-+wT9yyu;?yxyR=O~DzRB>}%y9X z!(U+eR}6oP`EL#1!~A!KyBF_0?_I+Wi#zaV!zVNU*zozx<@_$~Qp-Hf?Iv8-?Cfed z&IyPPudC6CysXU&^BrXHAFw=L|DhB4N0<*a{3YfG8!l^t9%i_#se8ELefYe4wBd&^ zKf&;0n4icTk9+$1>J%lPq>{MJ62ljB+!=;n!F)Ay(O<^=Qp4q1>PEv$Sbn47Q<*=^ zTufMcO*B(@c(2! z!|?AiFE?D)F8-q7SF-%shF{P8F2kQ=ey`#0F@MbPzcPQ;@O{i*F+7K_+vIp4^_Iu{ zT_X?QX_5PoIrbkpCt`&AWXD~HAeZxNlE)M3PXd1w{?Q#`_(u+VM=}@v6PZsnTz-Ep zG(5@jOAMdDyhU;SI|AnlMJM?j#r4+HLq1%=Z~Sn!|bAU!)#ZFfU>*`D}wcp*z@c zspn%O_Y7oCToOC{^dA%w~;@W_5aN9tC;^r zas7Mk&&;LX+{>M?=DOjZa(#B;eu4QxJ)>BEKjxxmGN+e*B=S<;2}+M#i=wJ&M$byt zGtY22PRg3%s2}x6ewG_~pTlSKUgRY|mn!+;pl2M1uQ5Eu;cpv`b8e!$-Eb+-y@tbc z1#&poCpxS*w0kOte`dIhyX}U{@$gN<7jyU>!)rPGsp0cE9OoY%lAi|VJq^Ez`9Q-Z zpL&gOEY~M_SV~wM*vQLTwVyZq64pP%@GF>~Y`Cnky~J=ie>ED8-<6>|$8gEVR}5dz z`Ij}RrGCE6{98u;BMxsi{9cy7$MENvKWey?Q`WE+yT4`mUm5vwzF#2rMP7dAe`@5< zVm&#WPUNNjdl`NU*V`b&@r`$MM;Q*ERFeC=;T6nJH2f~sBju3%Y+|`D8hKfJT(8lN z{cRh|>9yFA|BU&CM$gL})@!Sy{0`gP62-_7uEG1qH^qaJBry%sof8Ap1}Z{+uJyXdvOk;^!mZ0yQ7nq#;e zH%>KN#_3YS%ecQb8-5=1^9-}sp}XJksmz}+T>A0P z4PVRha-U7w@vF?=G4iseyT|v_ME+-H2gB=O@_bCe3jvH zUOCV3r&wOEjg9^7dFIy``Cl@B(D2^e&z~|J=gvkaYh6qI%W?l@Bfp5{@8|omB7Xvp zpXUw#Ci7n#zKMB}x*x0W&ktuV`Uh~oDK=cL506$n3FVRN-QyLrLaTMeJR%Cb)^Q7T&J{rRu>unJ0#@#VS{s`7ns(2FQ zCUF0st~mC88NU^Zqx_dyev#rRFZrxd9OYkP`O_6gc^SXWilh8k&gUw{QC`OH1&X8m z3_gCXRUGAI{H`}##_tV=%lN&;a2dZpU@rA6eU|e%-taRxKgSyWL*`{hzx4lwhD$zM z4VUqIjp5&M)#Lrh@Da?PFkHs(3x-c+`8N%(Vh;1?kdu0o{P!_j#_tHl_4Cm2%w=59 z=K4Hd@g!LKGPmO-#j)SYd2o*5n^@0jhRZlTojK-TKZjju*qUsm`lGWBmG>`p}fA|F87LsSFqls(y#Atk1~7= zhf5R}orvVVJL*UNILoDYk6hpXEHk`{!}Ao^_a_$_F7mQR{rbAGUdbbWhQliq*XOU* zhKqcg;(FYzGdz#O>lN4I;yS}c{$|B>zujnfFAhtd6Hs2=ALM>2a^3DyZ^(7~%JBwy zf7XpV$tQB%UiYyKa@{W571#Cusp67nL`g`G4)y5zoS?X_w=%_b{anBt+g;bgql)W# z*sHj%hyMIL0rlv5xI}SX4^Jqr>%mP;=bmTjdblX=%8UASJ;ZVXuIpit;<_G=R9x4C zUU=SosHm2n$1k4blcV5!Bb_$nn<$mud`GEb(w|D=M~B6=bxT&BURk|lNpsyQuecRH z;PQ%VnwBrGgO3?`)pn9-u5LUXK6qsLme%HsSo|=~D{gFRtt*~3=cL2nyEFJoPbY6! z)>y}&uD)_9e0>K&w1$gphZNL(cNIvOFS+PLtFSWB*LUd>x^GYTGnDivuNnD*Phiy- zEX7c;*6Jl*am(4uaX(^pv0F_W7SCQ?>{if*1+!NdyH&Gkk!)HodmJr{O>1P2qs6dk zUF>nR05+|KJ&qQ=9?x~Kzmn6}YpQJ7?d-lfGa}MiLcULf^|Qyp;@Yc=-3FG@UR_+` zI`iML{U(eL9x54H_AGHhS;I*pc{oeZy8(R2_~&Vwr_#Pm4-cm_tODQu($}UXoyVp> z4X|Y>dGpauzRc~sgJ6&4l;gh~bIt)4X8${!PR`dH%(Ar-BEszN46%>5IIR6SU_8wJ z9yTcF|0w&@A#s@fl4D#7DJPa6e}Y^4*luC=M<4|ExZ9<-))tCchQeiRU)Mig0$Te? zU}5&%_c5MV1@YQhTX@X34CU8{lpimBt^LWs!t9sv`KAiuwX?R4he*p%eq)GzyhUK` zmIfBZ>g?T?PI-^vGtj_e-<>BHpy2b+dlRancbATZQv&%~oK0k}K(cdrWtd6j&88zREeZ!dN!PL_nc zmvpj!h0_}`uXwB_E-dLJb{}|ZGSi*YyUf-(3TxjZlB=NKgG(?E|$Tj$IDK- zQ0B$+N|J$dez%pi^NyT2VWN}h{Mvcj3SC}sn<8%telvxvofi+*&TGT9?Q&dr8>}n0 z4%QB&x*NRtylYT%y6cU*cU1D$#XrH3Ip4ILjr1nyq19dS|mUiesjxlgvxYvd1Qo z9$%JD(xH_RESgFu>Cg&Grk^{hdP=6X)QDG#5nfMWOB3ix`{QoX{~VdoAJ);vx%YE} zg$lZi1ePqCq@hs6LFMX=P?(Z+(4%=?<@4W^8bldk& z;=!YKKHdrvcR)S_dTf&*?0dq5_hnfq)+@=+G~h!KOhP~YczXNTph8gP)Au>C zL8Bp-t^{JAL+rdm=7X1xX|coI?g%eF09Z_Zb@=1x-co=6RJxah^8R9Xe+_HE|6(3- z)b3aH^5Q3hK>Re=P)_pv^qru%ue%9naG4D6XY}GKX5idoTh8;ywW*%U!~;?n8{@Miu9~q z`<)m~CBj>0wbiZFZu+CfmCGyLY-(^b32%Mj)I}l+jNaji$^M{~&!&dH#89_#UeKj(5-zHt{W-?Dwq z$k%h&9iM}CsbsFdy~TDEyYBcO$S+{|QlnqWwb*ccR)VgE_t-AF|DS2(WzG?}7eY?t zrGHcqU84F8Dv?MBaW%si{Jvz0Y2?D0qXKk7s$_2WXpu}k>$_r zb-Qalcn=SqoKjuk#b6rEVd-$Dc#r;J1%n#Z_ z)ukt@RX=*d9*xT{u&ig}weHzCJr$?t;q)Y&o`KWTZ+iGmkG9<$FeVNAEb^fEpqnN5#rEkoH7?wnVVfMet>0}&mFw55I5D{j7b%=eu`m*+a3@pt4E;cCRmxEch?tzFf z``g%l2`9wzhdq17^BLN=ZV*E`|46)*-2o9{_CH|z>p3CX$6pt={CHQ!>ck{B!;dm_ z_SuJ(Jq=_m!*qMNQ_EZj$k18YlYxchzl{%u+gT6hAJ17f|M=|L>ICHBk{akzv<)^^ zb|OTD*h*t711@ zf28jn1y3s`h^)>hmVXC4L)cXNdBHsIh!<_%1?3Cu6m3R3tp%8FGNi}0Zz~sD{}Vd%@>A_a&_0+~ zX!j2DTHhnpUYO`ye*clWQI`k##5&LJH*S3Fj#K}^Cn#6#i0!|hwE5l<((bRv`$8Wn zO7{_n+h3m;ZTrMJs1sL*ecnxS9b#MCc1F2APLp@)e$oi?^1g!k_nA-Gf-VBCWfIed(P| zGL>UyrIXA{%d*ENk+Y#B?Zngf39Rb4&RdaO;0XX7)RTBeI0C3fyki)3uAW#peH{e4 zOPEQ;e>O!@CB8Rbym+mG&iCq^C)nBwl^7|X@0E*pBga9P5GmPPEn-+o5QkfYH;J(9 zZK4Srp&CZKi#Vzi&0E2uL6QzTk>v8a&RaQ`MZcC#BK8<~k%KKKokU&}OkZ1lwub)y zPmzoO=)>YorAyo4@RypC@dF)Lyn&Wlk&?abMcGL@-RC9G|DxF+#Z>~?7jIb_b-MQD z-~+WU-at!-wV$1&)3q;o{uj-DUb?F1i8r6oXB*aXxP^KU@5O1|wd>jYRDjr*-q{f$ z5uy!RR=i1$`}EnY`=fAtB zt8S@}B-j4GyC-*Pt`Dz@J^wS^Gl#7~_Y`j)qtA92mehZ@A~6q&#GC)Wo1=eN(LxmM zzi44E1?TwF`*iPqO!s5qU7h$SFWzGiJhsaTUIR{qycj#Z555|k3$MoZckkEYtHWLJ zo!=`b_rH4bfZlM|F;Bhs`}e&-40_?EV$|7-O`t#H#o^-yV20quVa!M$eC}9S3`N0G z9Xvo@H7;_mJog<*QvK2|5W^k!{^=Kp6BD5x2FP2{1NAG@2c}bi$e?tJ?wDe5k$*7c z;B(n;GY`>kGbi=i%tM2>nTOf;l84KC$s=?*-22f71x6egi4B3TT_2qJvht|DTn8`} z@JOhW(fGP{&|rtMeJKAJ+sFy5HmuXb(kc^Jx5a4{6dcRtp+Jc$L}DRS3d~E&9fab& zU%|a~*Jt5wBsl4;=+AU9Y~dV#UYsy(ecHM=l;Y&ip>2Y;?o;wESP+V-JsA#ICj+n2WeXxpE*186&twg=L75N!w3_H(oyLfa&5 zhthT!ZHLo#gsY4$Ib7NlQF_|wMV8is)^ZMOk5_H)hcjO1`gGk9>(>T>E^g&`l+1%_ zgf-dSV>C)yiz%05MbN_nED5w0thpebvEa!+1~%djm;`|yd#KeM1Fe3_>)9J@iRIGf$=;WRAr9r@ohQg-rNZ8;L7cZIU>GwxZ zEszBC1`6Or0*O9;9tD1mfg-;b1@>Z~A0#PS2EGAU9|c$sv~l&E$SGP2WZ-((pi9ic zXNX>}#Fyx57;~3c?&cf#A^My0yrO%+)Az@)8HhPUmpG~Dr{Epz6c@b=er4@F2o|7m zujtRP?YkQ`RMtGd2)k||>L!4R4Z%$MaI+qs=8!*0-eHKHcPOeGO7tkVJDMJdBB3{Z z{pIbTd6?_hL}_A?*yQ}-UMHINvo))0(Ddt`W5AxjJOM?do^$|sGI{~`yb+kKSc=Me z5c$iv%w@=e@@#>Czx;G~hDiEwf<5w_Cmx(~lKSdZ;<-sYo56DcPGx$)1F#u}l_Cza z8LK`ZqmGD0*AZyIVu|a88d|!J^lPw;|BX7!sFrdX9P?vqWr$?Nx;jpebG&NdaenT0 zID#H5d5WF;BsN5t;9Bf7f#6z9m+KA*v9Hh&3`?~>Gu3*XYC~qK3e41U%t`F}%v9HZ z2(=%Wz8)Jmqbie_=$1sf!a|?A)Gd=XNZ7VCVL5J6rZ|C*6@3gHeC^^N@AQ z7tUl$ok(46Q9L+NR<_pd``4OoF?Ha714|uL!W)}0j=s8$orF<5 z%1(M5is242C*dKAz5fL?2?@N|LabZoJq6P_?;@n`m~*DvwR%MuO#>s5=L|iBQf%lU zY<#EvAr$nA_5c_t696Zs&>^=faU&gaF=65+cgQ9Gw{wVNS4-TQNB%9){S&wKBLCx1 zi;3^`CqHUWY)X>K#>z_gyJ=W6oj9@S?w>20X?M?9Tly zaTIB&PyB^6+zU9d%W2qxc6Yn76W`;?PX13^*~$N@EBiK-|Jx`!3H}QGo?k+NPcRVk zCsLpr)=G|_q5w|sn8@|ZC~yP@;6zP<6EV=uUqpeEF_7<9c|{LE{@j_14md^6U|C+4 zvYbd|S(kVqsEvnRS*RT!ab=;lcwDvP6RI7ba%I8JlX!X*>7jOi#k;Qv)E`Kb@QT2Fpz>))&hWOlTY|0>k~#%l7@ z<-zaTyrTbtPB`!vG@c=LIu*WuqB%(1>IzRCbd@W-kC|TG%PYzS&%oZWp?*}({ir6e zQ0Eel#{@7PdC^he>3bZenkK0h(FIcf#6Wj}v>HX>tt)D?%Q5gdzCij029iFQ#fj`( z17c1JaN`yI2W$tk|67>?!DY_bcqz#=%tjFn(1pUE&0FhYLsesJrr#bq;o~XY!uX^ znxf^f9Yxxb1J4)5b4hVd;>w@^SA*;~AbxNG9ysa3jj!JBgm7Q%=S5p7-gW$+fIk=r z1$04+X1$`{X2$G-AZuy|?;%C|((!bNF6s$`Yj6Q-)m9Gz>h!1c;}so~De4u?L@BHc z%C%Q?8itp`#)Sut#*%~cR~4-ST7=WB_HBa=9k%oQf&T%1bct^iT?<}Sq8~%B0AB$t zpe}&F!l;y95yB$8oK2sGo&pVg3Gg0P!oj2yHnI0IF9A&K`>0y-=*2$3rc7em*q>0% zq2%>^w~zV5@M=(8J$Pb&={nqN0Z3!8vsZ>0*Mk#Kjkz8q7JWUK@pH(Wz0Jj;Hw>>M z#Fe0}J>5t8wRlkh7m!((6gYBYPb5bAb#!g{_g`G%W## zE`J_-r#qKFk8R|Qfq!zU<-7Wr;xLJcb@efo4rj)9^Re}d)A9%SsCq1hWBH`ZwfkUh z{~>-!R{Qt#|9|fQC3wjvjygb*k39e{0HFtDUH(xI*#5uV1Jcc#2RY{-93xHhj`VS8 zkKX9+sjkv<(v!!mxn zv3R^sXNEA*$wqXt5mgzOMmY^KFwMuquvdf^5dU`nB6FYJO#7%d*oO z>uQtu`FzE!1(gdbDkqnoIJdl1LUU(&Q#oQvd1YDYtXXp_PcAK=e&Q*W<)!maDqT<^ zk`TS1{A89=aeq0sGL_mw_>i6vUymrkn2e`2(EeuOwTS_iP zldfmXlByL5W+`$K8MOjp*_D8*GO7wdNUel7t7JE`{~*m&xiC;Ud%?8I6KBm`Sb5SM zX#Wam{xm5qFP~c;1j|e3lunylF?~`+sfLrLPMg+qri&g9>&fOgw?i1?USeO3~0%UF)SS z)YMluvv_^eS(P+-D~UO+ID189C8;K}tG(4;b6u;qw0c=XT`f;uL1rjhBuJ)kHd_pN zHFeFc-jbC|m)13V4Rwtk6%ez(oRy5{{Wwog|BA_$EnQYq-CF0>w66A6)it*)Yib1J zps22~2Iik_TG0xm#j9(qUD1RZ(^Gd~R$J;P>Kdq+-ikBo&ZbQz zR2>E=$2r_O)FbH+Xl=5dlrHmY|IH+(9i?T(ASqXRi<-+nTM8h z<;J{|H~j%4)=f)&^%-?eBHalfRZT-3^mR;#jo{*;?~rE&cp%#hTPv43e0p8l+X7zf z#@L5Z2S#NUPpGRFY6>{MOkGemX=bTw6iUcF3OlRRzUx($C!RECiWcFv;XYU0u%fYY zMRQYYQ;VBwhCs~{uMwtBb`g~js;ygE4V5i<3+jy=?(z>*v`t+9UW_C@ZBv2tvVq9HY3vn`% zkY*EX2%SSoYjW-;O2){@2$?onX>)T=hoz!vr!fNU{vW-*0c#Yow_?$p^kAZIS!CroC;EgQ#MN^Ac-y!n^%|Z?i zAEfAcf>0OUO+iOG)I32+U>9QqxGlJump{1V%GgyoSLa@n_pNR>qJ7NIMvMc8zx2={ zdw_hI?0Lg5-)}Lae5Lg}?HG^Wx1o!QAHng9Q79z+)cwR`K5IE1%YrTm|Erljg&?gn zC^O1@vjZ8_y^Upbz5F7C?PMl-z_g!+$jLmWqOTC-M&KP8aFQ1N&2Von$7==+|DM~a z({nr3z)82b-h)cRGs$YWcq*>(pmH&^B0aMchTJKnB@kBALYbML`uU0cZhd0;&=5H> z5APE@7a!s$x^~dV`bp0@qC`VF86G9yuHk;Enn9Zqc zw|LF{KTZ^tC;H@K+F2PXVIHVQy|AQDLDEFG2Y1mNP??$fB}Db;mUk{pP6gSR5x?d9 z8M*Nh7s4_(x$)CxB#LOtDrF4tJj(Uk9?0jdOmv@~=nB(W#h2WVNw%E-mxP}i-|gKW zV(U||)w5flL@akkEGMgazT*3dShvDhURKP8$e8OPrUy>51(}D^|KR)!^HwDa<1cwo zjk9BgS(--#^Jav!!=*7Y{*AxK__xV8c9Xz3)D0Tvs)>I$)cAM7cml>%cK5g= zGUgtL!Rj0sRhxtG|+WH1c4SLo6=>(lXX(ebP#9Ttz9JAsS{qP?37 zAt!@j;4dT!ZxtH%bK>~bdZt@RoF0E>MAQ4G2k8+>27ia@Cz-)8u!i*KX7Trk56$9VA}(kBAo>*I{0KV0UKw$HMc^Wj zA`Z9ejT=cEXNSmi?v+RN2!o^D3zvGfu^?UaoOs#oj;Z2ac0D+rU0%nt%jo^I{nqg$?y_9m zy$BS-hi5SaaWDHg=6LpT%<=5wmE+mRE61~sKls{aK`dxT`t1P1{|U$Ff>_XA^qT?r zWzhc%VnO{sg^I!TBt1brOOM1iP77i|e-Qn64k&<&J#ix6N<3(Hk@!0Cpk0Ljl6cU6 zB%eQ`dBP0NO>6t}_%ZR|^!B8bH{nzqq zS;q3G700n7ZZCUKUUNN1s6HCY9EvDELX^NBk2B~jKM=-67_W}t*F^AFBe=U>%C_sS z$FjM*-gEpQmo?fx#D@UPzdoCE;f6u3uZrbUG~_a-P|-C?Uh`KYcu#)!3H9i+)kzWj zh6w(w;-gi$3i%L;`ZYf_f?uw1ebNH zQNNZyhX;n`KZxM(NAO|rY7siCr#^z;5W!{rWUI&LQ;6jg6fbsJpzY-m{KW`9pu0<S6m{0566w< zJ#smRB9c6dyv)ffc@U20F?1)mT{@o!F)uZ|l=)1 zew*RvF#o>cUuXV9!*6ANui=j|f6(yl%pWuS56u6|@K2aOXSjR<_DjRvr-z>RYr{+U zJo>ufQ<(q3@P*9ZH@t!QhlYQddAs53neQ`v6LXw97@hRzhnaUb{CVaDhU3kAbVCh) zljRRK{3GUi?rR*gIeZ;(xRD>gT+fM(@}rr%wFZLxAItni)`Q2fB*=@y)i}^edF6Y! zYQy)ko<`=PM~-)GiVt-vX?vy8bEM+(EDP--U(9hb?uB2$9DhfnL%Ty^Uq&HVXVh@{ zMg6kja&CCT@Tsh)ow?M*Y%Z@H4}>pfUclo(cq8+J4d21M#PD;NA8+`b%x4(BmH9%$ zUtliB3CYhz%r7vtM_p$u3Mn2BhyKcdbS!a*CJ0VKAdH7_Zo97FXmI`e&1>22XUHDlsq0!dUO5c za=l8u4P@TKaA}u;%&|U4ux{KPrsOd{7xQ?Nb$i(>)Hr@gV7`B-|ray3(n7vjGlF@|2e~@9p5lK#q#ePUcp@YyX3!> z`Cx7z;ny)QR{S7lxI2!yv~O?z-7-yaY_H|qKj3K}Ig$UAe=jX$j&|i56$R^ze3JFA zP#pE&!}?nl$9_1GfA3vj_}TnB=W^y~_h2;0PJaJNK2vP>yGjq*-N$w}E3WO{Yq;2b zOxYbJMq&Sgkzc}gUsW9KN@CyPC^2RdLK`7tTkS;wUfuWP#!+Kbz$jDz3}5lsV=T z^CRV2rQ}i1m8|DNBQNE;Qt{CsFYdcW&l9ZYPQ&v#{D9GuWJS*y`Em|#H}Z1)e_QcG zB{Q)9)aY5u;RKHZX~&;3FJO-KgL;yzYnYMm&EaArFZnq^aXA*Es@X~pw#%j5?u!)1 z`k%_-#fs~8uQz-I*K@1kFy{-o^9>)*{8Gb@W-j-OWW1lq{AMFBFD zgNDyz{- z;c~rqoZ-@5GWWgYX9V}p3M0RY!&Qb~!r=zPf6aPU8-62)FE;#c4zD--IM(w`!+*lz zjfTs4=P|?2;PBIie}Th4H(cufH-=xq_56XuBj)oAmvOS#@F!S)nc>edUuF2OnO|i1@0qVR{Ljp9G~DO< z*=%?}<}Vn28SB|@_{Ge37%uJmp5Zc%_85K}w@VIRzeu~tIO=7%jH5w@%W-3r;WAF; zzOm>p=Kh~D^0mxo87}9=MTX0GtTp@(tY?Mcxm<7O8s3BXI>SdZzshhKk2f2B2Fu@W zcoXyc4F59oXAK|1`TwQi{g}UI_#NDiZySCe^N$RFka_p+?))b0BG+dHhRY-CfrdZI zdPW*9?LNuy-7H^b_#c?hH~eYlUo`wh=4TlG8uR-Mm+QHQ4WGvK`J~}TFn`f-Ic~pY z`1LIRuHlz4|IqL=nC~;Zjd?HrfiLZHCiA4>&oMvP@NLY;8h!`!V-3HD`830S%)HU? zkC~rs_$l0<+YFcMv2})jp5@Qr=N(esgZOxOf#DZ2|C-@fFn@wMUVk3ux;AZpVdTHX z$HCt!j@ONsbAH}b9IqSY`1VJ|QC^P!e^DIe>&9c4OT86>4RrIAJm#mF^M8urw=rL0`0tpXVfd9? zu2#dJV15B}o1d#A`1g&TfvjhX;Z@8ZF?!^F#q);OQZ0Di`-ZP)-m|CkNIq|7KF077 z%ug^}?gP&-d@9Q?HoS`YIfhIAzh?MdEPo?&>2Eu^T{ammzl*mRF8ytr(qGKFardl| z|1sC|uN0^L&;9&2itFEH?hb3D%p8ulY(I^CJ@?ooe`0K2Ovbelha~!^d;ERvKQ% z{6gk7Ki5R?+l`*BZ1--%<$U(2(Ifry1;b^0{n7CCP#5TW_jY^9=gltY6&o(&Ym(t5 zEI-R|8DC#Cyo%+|HC*!lb;Ivs`I{6U%M5ovU@qhC7d$SuDo*{D+vP#Uu^-BL=ck5W z!2SFc!@t7(_sp^0qz*7YyNvvwIX|+1v5bpCK5ymlivp5=IX)B^F8N6sF8Mi(Ip${^ zW`y0bM!p;8f12W0KVRVd%v2ofNAe?U{h|Kxq8#>1jr?%d->f+5|1RrarMRyDi%T+kpMZ+lJz(TdWBpGlj`}C^`RN(OQU7HuFZwY5 zNeRH7PXqKE6FGOo^t-DlKUB&0XTNY6znB&s@?p+P+fnQnUcq7MlgNiFdAa{5d<@5> zc#mAhI-)Yew{Uo#;s>!GcZ&>{@>eN7lKr@=H(cabD1I>eaktuVk#AFc6#H?v&Ty%p z^@<CD?4`n~@?lWBEw<#`dg6Jv3rT;vy_+jkF-FCwz z{SL+Tb;VA@Mg9ZD_3?I(;dvbPpx>aw{!`+-v~{y@2VCTPDS3UoO3&2?@yMmTNhLpC z>6ho6XcxKY*YBz7?Wl{zy{EOWBbRReT=%k?Zl>ptv5V z>lD}H@pi@axZ9?<9$&vuT#uujijQJH?xejipL$$KJtNosU+M?B?&tLoMu&Wi^V0TQ z#dW{ES#jMz<$Vv-qx<1@B`eIMwa$zWZ}r zxBFUtj*9uz?f#(Ry4`=HxNi5;a$IGh9^LNS71!vpeJT(`Sk3tml^qgIHg2_bM^n&R5JB`Z&_j944K73T6N?r8oDw;Fu56islVX3@|q zxHnffo(^;7uyvSE!c$t(lez@+QE)UDCYb6&>!itooEn}8LuLTUT9rO1SBNd1`@+^% zd75f6a|B^EcR(>Tb8Gbyuejyx<+N|EYp4#) zXHT%AY-15J=UN$2TRi?~Z^Y{2aYyS~N>B6zF%S(x6G@1+umNxs0ouX_z>x%K3mX7O z5TGq=08Ai2Ti5_NoB(ZM17JJ>+K$)xiK_ca3+9Zoa<&0T29=K^3TeuWQ#841^|a>2bO5)M}x4u5MPEXj<8omg= z{iV-OOFEBDk9Nb-&*F5o9i+#!RwpLeKGh{Gb2~alqg)<``|}>Jx5Dh-#qkxqmz}lM z4*<`6pq3vT?t^Ik>eqr`=5Q5X^It*J|GaNQUCdF zMEyM#(tbT5uTmaq*JmQ^W4}Vzk^Ltl?C%J%-y8H<`?o_qg|**z*uMM@rOd#_w%_+4 zv1KT`C&Ydq;MV?g5%%Sv*pdCGBkcD&5pxmDSB2xJ2>z{oe2*RevW}mN`MBHB@ei+e z!_wDt`lmp*cDAnYePPQ`eiY}wiW6i0vCr82{~*GC2`lZ${>BLV>q6|~w@B7L&MOpF z{yl78pwfW{p2DA`_EALm-5K*2j33|6&b&QAn27ugHsH<&{n}aCKS88rC_k~UOZA%qx0kJz zeFq}K^1p7DOOYJr_LzVCy>0V<12C%-Q}pE@+f^pg1ifoOHq8D;JTZd%0NNKF+DDbv z{w83kQ~C*b$*tla_40kGaIr6Y{C+Sjef$WQ;$%t4dr2pIyx%8&EqV&4*9`qub|0rV z&Foci`iUk&$}f69f%IYZcU`lS*uw^~{_sA8q?hsYN478eWPcrh47!TPfpAtQLGSGd z`|Desh_;VyWbJAfy7d);WazOr>Z74G-b>;R7>#+5{JT85vZDX>_z=u9l@ZJOI@igLm^VRmN!>`jV11%a z&uc5d`rUX@nB5f*1*5B+h_Az>3j?sedT1Y{q24G@aNi9d)GV!{lwn{zl}E(rd&I>L7QP*8?=|( zyLN4ZHpB3acp>HSe9*IN?xan7*F3rrZSP(40OZMsyv0CgoOE{GIB8S&d8w^Mtox8} zr#3BuvK$Hj%M#xF6Atjs+z4&a4e|`ULVd~E^W&-ZYR|jd z?~-bV_S=H_kotWjMsZu-fc-5X^GI&09fs4EH(>uL%VOTE;FI$mpt}HUZ2V;M)-6z` zA(Ol_cR(JbT+n}xz&Pa9`}S4TkHmT`+?>}n)!qm4M0#?)_9XO)U2~^Ec_%};u^t|$ zddOSdzu@g5mlq82yPk3Lr~4{4f*iJI{VH$kE~s~`b9k4o9qT-g>&1J7>lX4iB;}8T za#A`>gK4o}Vm{C&<^#tsEJfS?VRvkQssH~uy_3&PT`76q=IuE$EYBU~P3wR)b&lML zb>`)r0f)1Sojsi&+XZ#M&h-K3m%=ir1MDO9u$TJDwDmCcJ*->FyvW4OukZoAIf9Das50PGkKot6D`o^`Xs;~!zp$zreo*L z(ElKxFc!THukX94{7o3!c&x?#1IN?R(%;U{h5mQzO{Zd+u&p!4RA7tJ#@fn1jQgY` z3Ho<}zP6YL{d34@xc{_e8T5ZVR&<5F(UHDF$U7d_+aS$0H#P88=*Rrs1Ug&6pUxwM zGxL=_*87vb*yvrDKNzcRtg|2ZUxxbeX5%>UuKF13Anvup@3k%UxnA$0FQ=}Q<6#Qw zujRbdm9Nv-?z4F}*Vk{qbofNniRp3wI-DQg;Nz*QOLt!Rk?&1FdvaWrG_Z6pq{X_; z9XG*fil1f^?BEw17dJ&fN{g;0UXmQ z9zRtvIB%%)>|B^;?WyYsak;EP4ie%Di@&N zVXI1B3)usO5bxA9su8dBn;Z{TNbgWL_HT5O+V^T52)4Gg5;KB5kR9>vOrsj{N_D#I z$k)X7RDW1S z(lBDi5j2d5Ncha|3TTsUfB{H#mJN`u`!;Y1dmS<CuqGelIbI*V{`=qK+vDme|BRf6KGBO9mErAm{EnmClaWHKj>Yo6mwM^?6! zP|N|?J4^7PBx;i2(~MB};+rKVC4P>MAx#VGt^`*ki;GBb2O})5zDIF}vPklxJtfQf z<1FEGT6)^ulFZHltwrYfwxpIi3GPUu=AMcVd+)M^b9-7MJ+&Nmq_C3zKWe$%#2<3~ zzkk%e!lwSmqt@%^O%jyxX-2KYq{RRAQM=QsO8w2cxX(9gWh}s`)rtT~^UC#ej9M`g z9)KxMO17%f-KT7#Yw~J zBq%egsiDM{dx8>N$LPph!NS%yWAPwnW0Ja~60As~IteaIq9zG8CDCC!21_O%jl=pT z?hySWt^}nJ zm?$JDh9Ak!TT1InYCi0uC>4+%2gXQHylHyF@hn-#*U#5SM5m>G`u|ALAkGDwCkd7( zk@$*1&*qQ>aTN3!33^%%JDC)-8gWUQ(dp~wJ2tPs8_3Hq8j{z~w-i3-@s~S+yt(~n z3_daEq#XR2q`)Wur{v(*Ck2DPx&3o;Fa`d8Zw&CG;SKAoBz56iDCw2!zRp~D8!)@S zFOZkx8u8wJNH0bzAa{-xg>1P4Ax9w3i1wj;Tufdv1;qL$H9{mmslr8#{j4aY7Wlwc z$LT);6i^I?y4<15wkC6!c zA>!p5eZI2(NJm|<(FZEF&V;r&wgfzi24G>+2V-%^dB}j#4BXL!4H)AA$uu^N^{8x| zr)+NjVsO=Xm+ix<9FJWCOUK9wwpJ8{@42N^7gHy&C`C$jX<(Z1Raw$kBnW?s#Ll7U zq@mz~rA5nf&TvnM0?IM943tksj^3A)DLK>_jx*IN2_@m3Sd(QM_|q}|Jkd6M#$Yu4 zB>ax~=~iA-karUHe46rKHaHeae8q_9ipEIRk1vv~y@Uh06OH=T3nZ2ly(4~6sS zY<|=xpTgz~rwb_DpU&o0>;V)WNM{%%a15gJU^<(xqaH$G^Xm0b3PbmY1713UqnOSk z=zI*FN78we!_};$sCn}|V>MYgaLSPglS~?)u##Z-^D1$&s72gKrU5eA$^~St`@98^ z{9#&7j2LtnBS_c(a=&nTg?4&Bu^!tuf*gB1QE@?%3VrX1%o z7=XUf+kF)IHJp88-}X~v5v*pu@lOVw+!@^edo|-L1x~QnN>bARxECywl6gV|o>=%D$!CDJxLnB%1!6U_A@#|Ha&kugE@RZNs;e6X*VQWDJfB4xpT zUZgx&K#}{g3e~|vFH#d6`MQ6YB_W zrpTR`5({qeQsTkw6sdzfgu5=d!%JBo-09`HAb6LTa$)d(id+b1cT;dLMNrtiEchfv z$m+|3&rsxPO!-Q1A4NXG$kyO~ijde>gRfI$a6d@-dhl(E%*4nI!2@t{91^=3e#4q# zmtxXw!H|hPhq0Z(d=qO8L2OrWkcs^r({=}oP3$#v>qEgYCUz_g6nAg1)WlB2*yF(p zEB2FMorz6F*ZwBhVq()V_F}NhO8Z@Kot5@laD$0$M4fL0H~Y+p3i)#7TSh|{rS17b3HA94C@w=?^uPA1SdR#KgL%Ho!nU*@AI$R zg&fSij}#W?-c1Urrav$WJ5j|wgPah`=E{$u1?J}7jGJ&cf-NB&8=-BGZp}EiqUz8t zI1j*CB=m#S9{2Iw^R z5HI=^fxU(&=DKFyp_DAw%saFgXS-(2rqwUcHIop!&+Y4uAq5F6w7@N;$gLRZ?^aOc zUW^pFX0D<1t#)6h2+hiK+_$~RsjgYg=K*qSU0%&eZh_0I`EpEK?DA?( zv3i$RbCO)@@@h_no$m5#PO&rGyICuD$NJ zxy!7yc6Wt|QF)!Ny(j2$c~3xgp6&9UfHr_@+zlol)qTCY*~C_1Z8x}ASUN9tuQIU? zOuNe6Vq&<|yIbAuCPsC*+1+7cRNfAEr-_kex4Cy&X}jI~O)QQ&zw7R`Vz;|b`<&2x z=x+n?HX^hXLe>DrCD?2+Iw8Rc;VK+j55c@kFb;>iz;DT0gZX9<7=Y7a2)_h2Pky1p zjrv1-5Ii9YF0>V3)o3;-!lInepHcK35xv__vsdV2q~;z0EVzp)ZrSsO!U+%eIzR7~ zP!VgJgc37EVy9KGle?60=u+?l+zI)U`=b#4*%mx<^M!D8Re&ejoaH*9O_0f|{^eA6r@6u!l* zd=&n+S@|gZ9dIgs>1f`cS&@4Wx9&et{YOmm!n6U~;mey%`f(SLH^=Cw@Tq2r#?g>B z*DTS*=T&&}wRIH64OQO477F7YDz9#*7hb%V!cP?dU$T#uCepLC(%UoToxaS9EbB56 z+{@&hvDrj$FO&C$t4suE>bx)VrmGn467tU6?sIZqfHLsNJB3`=k~fixrsB%2s!cIf zBU3A^s-0Lv@co)On_4^{jmX*k+nIu8sd2LHQ#AIsIRFhdaUnb zra0^+eSd6PCkEnuAJ2C}Yf%r*%#?Xc2&bmpud=fIm#AHq`SR}|V?G0(|2?A(HRs>u z?Pl`#6p{>hwB*xIm?f^AffP_W4RioSJ)rIcoeLsGRG90O=T_vTo5;9Vz(L56 z3a|0TOTpS=CpRMcR)<<3Xw4+v42?6A6S@qN%~(K|e;$t3kl z0KTb4io(-C3U5?G`yeIvk8r}Ha1QC-T=)>>LjM##Vshc_YvH3_I}|={>hlcz@l4?p zrapb(!Gr<3u&;Tbw-rUq7_Wooe%#0&okZE!7WxB)eMM>I?&4K0N@x*ew;ws3{-8x1Ql{Gq8k@dKvr z6#mH6ox-1(x_6-bXJe@KHe(nj8j9@1h~HO1k;gC+^i@)1A4al#H57RZBOzZMMLxqw zZ{ISC3~i1{|4uv&?<-zEHdGEN}Bg5&Ix@vHRTqF(!SXV-3GxSp*xc4 z_e01D{RqwjaHb3W6hcP7*=U=w@VgXwR`qVGs1pi+)q}8si;UL(7#{{F6VIK44u`|P zCbt|Y9);J1rlAxTL$xYWn^wFprkXjSl}SO8j-iUsS~$~3_Jzf{mm`6ra1k|eu<#nM zlY9-jz%EHYkP1^{P1TDDXiXqDVpTJ49*R{lScWLpyx&|NfD~^W1)#2Y?N=YZ;~_es+5F!|K+6d z5;#-xttuIdG8!LBNipoX6t);jMrkzsgOn5_9Vkw%AUdL-V(5rrDQqz~o3%Q}qJjZK zagi^ghwjHA=+#m5IQlb$pT~_x;=28cUL=H{y^&D57r@k1{&?XUq^WB}Hy=nbme+i)I$jxh!dV_#7$f0@tt z$++ki<02!t%Xr6lpt2bBkquvfkQ1tgv*iZMLE+Stq=SlPKtAuw!D}JHlf+}#EOhuD z!wI68V~+1}9P}eqM+$7(9_Z1N0-K)9?%54D!EiAH->8I+71;DPeDG{)cz(WV|8bb= z`!zbwH{OKN4tf{K_X65rf-mh%(ib--gD-o*=TU``eGY@>x2}9X>Qp}bf+zjUc%cvN^5XqTeo`Jyb09y^ms5_y#{!^0sRT}v zz#IuImcVidIFnoO%m?ntd?S3hq~an>m?BBIc6jAa^r0J^kq;ju>1JBn1nk)~>~CpU z?~y(89^I31>z&RcfE;Za^rqfsu;2$BMfilkjB58#Zxpi9T+|xEj|9x9xxFt5&}?AH ztiB~6Q&d5Mli)mn9@L+VA)GFzimA&W;A_7Pcm<++AVALAD}kpWkaSuhh*0uNK%Hq{ z!?PTw;5GT4DJNo*Z-(7{W>7yc-Df8C0TZqwp_5ExzG)1vV;Lh!+fvoBmXgBBSOGaI zA>cdRm;3oEq-vDx*t1ci*%EwFmH$O5-|OgK^x?#6$I%~NNBffM_-B&7k$)W})?>e0 z9Du*@kj5S8dDJ}Vqxm{%TbpNFm$I!(+1BO54XS6Gk@swiE8Akmwu@;YGxjOl8Z6tq zNi=C2jxqMzP0F^Le7JY@%HBa`Py4G?7I*F&^030DD^C|M<)Y?JjQPIpJK0yqA)I7R zM%NKX&!6n8w_;v-w^4as7qb-Ju1vk1Ock{z)l+n*QiSs-TlNDVZpuA>|3KCGhsxjg zlDub=)wFLZo8I!_Zq~EnT^cf8{2d=YgYn{T`|y(mFaA%`cM7?tz;CXF{*eiqh>&78 zTtb_f#ew`ou=vsN&METK@J3~{r!j9M;9TRGjg7&rK8VCU4-E37**fl-b(9~cVPnqm z{^Ya+rCGKgOG1v``}!*3#X=CIqXy1wL#f{@uawI7%9}{4rkzQZ$&YBj@;W5Fxc$a|&EqEfy1Oh0Zjym%GqrwxZM3bTnhj8|IyDb`M#Ggi`J zrE0JuqkQ$W!(9y9aA%}lL)@QU2DwZ{tGJ@3eV?X&K~*=8{!=F#t7+Sn6Waaw$i%C( ziF=jm^yBs;LzAwf#3OFf4OWwGpmM!(Hj=7orL-$z-%w41S-v7#I7`K2uRwr1$!gO^Wwac6R_IHj~PIx#ZVsXlSS+RoVO2`!DW_Rfy=o$)aK*vN!LOKYqt+}64> zK5@dt(uwe|taJiI*G5;yJ0q*3i8#h4$d{v)3 zo~nPjrGL5TU%s-twT%k(N(qBmQ_4?RQ_<+OH?G4kYD+{r65+OJhtu5=Z(Y?9Z7Oc< zNH`6(OTtSU!ZWMqEUK@T*rNH)Y)+U}AFipctz8s8t-5~hoHN4p)r*%_FKG}-NM2HZ z8p~L4R&~8CgHb4^s$uC8OK5)e8R6<>vuZ3vf>4HqNdN3b3zODinbk{{%w4oF+%R|6 z{OXi~YN{5VYD>m9n92@af?mra?BW!)f(%&aiW(7I%7h zVfC_xa9#bPhDDZ?wqeQX>{F|vOX_XA#QRCf^xlW$p56y&dmo~@GAw~@DOQRm+s|l{ zMFSJF4Dn48*vkfy3U-BY<>$*JKvwTn&Gg9PQb5x91v9Iuu@=k@FT_4-#TU$; zm>MlljZU_sOKPghRD2@*36rG`BqmOtqR6BQEi<_+rPTVlb=3=ImrW^6W~`f^YAM9) zmsHuw)i9{e=mEmBYf{Tvgj(%K%yev~I}~n=Y!Wf;l8f@Q0spvZr%^Rwgj$a(YJ{b}wPf4Eu2BlA! zJh7~2!pu6bG96BsjC94WhxA~dsmLXyCl%5GxNO^fh zvIz9HSvF+7kis!#R_)yC